--- linux-qcom-6.8.0.orig/.editorconfig
+++ linux-qcom-6.8.0/.editorconfig
@@ -5,7 +5,6 @@
 [{*.{awk,c,dts,dtsi,dtso,h,mk,s,S},Kconfig,Makefile,Makefile.*}]
 charset = utf-8
 end_of_line = lf
-trim_trailing_whitespace = true
 insert_final_newline = true
 indent_style = tab
 indent_size = 8
@@ -13,7 +12,6 @@
 [*.{json,py,rs}]
 charset = utf-8
 end_of_line = lf
-trim_trailing_whitespace = true
 insert_final_newline = true
 indent_style = space
 indent_size = 4
@@ -26,7 +24,6 @@
 [*.yaml]
 charset = utf-8
 end_of_line = lf
-trim_trailing_whitespace = unset
 insert_final_newline = true
 indent_style = space
 indent_size = 2
--- linux-qcom-6.8.0.orig/Documentation/ABI/stable/sysfs-block
+++ linux-qcom-6.8.0/Documentation/ABI/stable/sysfs-block
@@ -101,6 +101,16 @@
 		devices that support receiving integrity metadata.
 
 
+What:		/sys/block/<disk>/partscan
+Date:		May 2024
+Contact:	Christoph Hellwig <hch@lst.de>
+Description:
+		The /sys/block/<disk>/partscan files reports if partition
+		scanning is enabled for the disk.  It returns "1" if partition
+		scanning is enabled, or "0" if not.  The value type is a 32-bit
+		unsigned integer, but only "0" and "1" are valid values.
+
+
 What:		/sys/block/<disk>/<partition>/alignment_offset
 Date:		April 2009
 Contact:	Martin K. Petersen <martin.petersen@oracle.com>
@@ -166,6 +176,16 @@
 		encryption, refer to Documentation/block/inline-encryption.rst.
 
 
+What:		/sys/block/<disk>/queue/crypto/hw_wrapped_keys
+Contact:	linux-block@vger.kernel.org
+Description:
+		[RO] The presence of this file indicates that the device
+		supports hardware-wrapped inline encryption keys, i.e. key blobs
+		that can only be unwrapped and used by dedicated hardware.  For
+		more information about hardware-wrapped inline encryption keys,
+		see Documentation/block/inline-encryption.rst.
+
+
 What:		/sys/block/<disk>/queue/crypto/max_dun_bits
 Date:		February 2022
 Contact:	linux-block@vger.kernel.org
@@ -204,6 +224,14 @@
 		use with inline encryption.
 
 
+What:		/sys/block/<disk>/queue/crypto/standard_keys
+Contact:	linux-block@vger.kernel.org
+Description:
+		[RO] The presence of this file indicates that the device
+		supports standard inline encryption keys, i.e. keys that are
+		managed in raw, plaintext form in software.
+
+
 What:		/sys/block/<disk>/queue/dax
 Date:		June 2016
 Contact:	linux-block@vger.kernel.org
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/debugfs-driver-dcc
+++ linux-qcom-6.8.0/Documentation/ABI/testing/debugfs-driver-dcc
@@ -1,4 +1,4 @@
-What:           /sys/kernel/debug/dcc/.../ready
+What:           /sys/kernel/debug/qcom-dcc/.../ready
 Date:           December 2022
 Contact:        Souradeep Chowdhury <quic_schowdhu@quicinc.com>
 Description:
@@ -6,7 +6,7 @@
 		hardware if it's ready to receive user configurations.
 		A 'Y' here indicates dcc is ready.
 
-What:           /sys/kernel/debug/dcc/.../trigger
+What:           /sys/kernel/debug/qcom-dcc/.../trigger
 Date:           December 2022
 Contact:        Souradeep Chowdhury <quic_schowdhu@quicinc.com>
 Description:
@@ -14,7 +14,7 @@
 		triggers. The trigger can be invoked by writing '1'
 		to the file.
 
-What:           /sys/kernel/debug/dcc/.../config_reset
+What:           /sys/kernel/debug/qcom-dcc/.../config_reset
 Date:           December 2022
 Contact:        Souradeep Chowdhury <quic_schowdhu@quicinc.com>
 Description:
@@ -24,7 +24,7 @@
 		stored in the driver gets removed and users need to
 		reconfigure addresses again.
 
-What:           /sys/kernel/debug/dcc/.../[list-number]/config
+What:           /sys/kernel/debug/qcom-dcc/.../[list-number]/config
 Date:		 December 2022
 Contact:        Souradeep Chowdhury <quic_schowdhu@quicinc.com>
 Description:
@@ -109,7 +109,7 @@
 		    <address>
 			Space-separated list of addresses.
 
-What:           /sys/kernel/debug/dcc/.../[list-number]/enable
+What:           /sys/kernel/debug/qcom-dcc/.../[list-number]/enable
 Date:           December 2022
 Contact:        Souradeep Chowdhury <quic_schowdhu@quicinc.com>
 Description:
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/debugfs-driver-qat
+++ linux-qcom-6.8.0/Documentation/ABI/testing/debugfs-driver-qat
@@ -81,3 +81,29 @@
 			<N>: Number of Compress and Verify (CnV) errors and type
 			     of the last CnV error detected by Acceleration
 			     Engine N.
+
+What:		/sys/kernel/debug/qat_<device>_<BDF>/heartbeat/inject_error
+Date:		March 2024
+KernelVersion:	6.8
+Contact:	qat-linux@intel.com
+Description:	(WO) Write to inject an error that simulates an heartbeat
+		failure. This is to be used for testing purposes.
+
+		After writing this file, the driver stops arbitration on a
+		random engine and disables the fetching of heartbeat counters.
+		If a workload is running on the device, a job submitted to the
+		accelerator might not get a response and a read of the
+		`heartbeat/status` attribute might report -1, i.e. device
+		unresponsive.
+		The error is unrecoverable thus the device must be restarted to
+		restore its functionality.
+
+		This attribute is available only when the kernel is built with
+		CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION=y.
+
+		A write of 1 enables error injection.
+
+		The following example shows how to enable error injection::
+
+			# cd /sys/kernel/debug/qat_<device>_<BDF>
+			# echo 1 > heartbeat/inject_error
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/ima_policy
+++ linux-qcom-6.8.0/Documentation/ABI/testing/ima_policy
@@ -26,7 +26,7 @@
 				[uid=] [euid=] [gid=] [egid=]
 				[fowner=] [fgroup=]]
 			lsm:	[[subj_user=] [subj_role=] [subj_type=]
-				 [obj_user=] [obj_role=] [obj_type=]]
+				 [obj_user=] [obj_role=] [obj_type=] [lsm=]]
 			option:	[digest_type=] [template=] [permit_directio]
 				[appraise_type=] [appraise_flag=]
 				[appraise_algos=] [keyrings=]
@@ -138,6 +138,12 @@
 
 			measure subj_user=_ func=FILE_CHECK mask=MAY_READ
 
+		It is possible to explicitly specify which security
+		module a rule applies to using lsm=.  If the security
+		module specified is not active on the system the rule
+		will be rejected.  If lsm= is not specified the first
+		security module registered on the system will be assumed.
+
 		Example of measure rules using alternate PCRs::
 
 			measure func=KEXEC_KERNEL_CHECK pcr=4
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/sysfs-bus-coresight-devices-dummy-source
+++ linux-qcom-6.8.0/Documentation/ABI/testing/sysfs-bus-coresight-devices-dummy-source
@@ -0,0 +1,15 @@
+What:		/sys/bus/coresight/devices/dummy_source<N>/enable_source
+Date:		June 2024
+KernelVersion:	6.9
+Contact:	Mao Jinlong <quic_jinlmao@quicinc.com>
+Description:	(RW) Enable/disable tracing of dummy source. A sink should be activated
+		before enabling the source. The path of coresight components linking
+		the source to the sink is configured and managed automatically by the
+		coresight framework.
+
+What:		/sys/bus/coresight/devices/dummy_source<N>/traceid
+Date:		June 2024
+KernelVersion:	6.9
+Contact:	Mao Jinlong <quic_jinlmao@quicinc.com>
+Description:	(R) Show the trace ID that will appear in the trace stream
+		coming from this trace entity.
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/sysfs-bus-coresight-devices-tmc
+++ linux-qcom-6.8.0/Documentation/ABI/testing/sysfs-bus-coresight-devices-tmc
@@ -91,19 +91,3 @@
 Description:	(RW) Size of the trace buffer for TMC-ETR when used in SYSFS
 		mode. Writable only for TMC-ETR configurations. The value
 		should be aligned to the kernel pagesize.
-
-What:		/sys/bus/coresight/devices/<memory_map>.tmc/buf_modes_available
-Date:		August 2023
-KernelVersion:	6.7
-Contact:	Anshuman Khandual <anshuman.khandual@arm.com>
-Description:	(Read) Shows all supported Coresight TMC-ETR buffer modes available
-		for the users to configure explicitly. This file is avaialble only
-		for TMC ETR devices.
-
-What:		/sys/bus/coresight/devices/<memory_map>.tmc/buf_mode_preferred
-Date:		August 2023
-KernelVersion:	6.7
-Contact:	Anshuman Khandual <anshuman.khandual@arm.com>
-Description:	(RW) Current Coresight TMC-ETR buffer mode selected. But user could
-		only provide a mode which is supported for a given ETR device. This
-		file is available only for TMC ETR devices.
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/sysfs-bus-coresight-devices-tpdm
+++ linux-qcom-6.8.0/Documentation/ABI/testing/sysfs-bus-coresight-devices-tpdm
@@ -170,3 +170,90 @@
 Description:
 		(RW) Set/Get the MSR(mux select register) for the DSB subunit
 		TPDM.
+
+What:		/sys/bus/coresight/devices/<tpdm-name>/cmb_mode
+Date:		January 2024
+KernelVersion	6.9
+Contact:	Jinlong Mao (QUIC) <quic_jinlmao@quicinc.com>, Tao Zhang (QUIC) <quic_taozha@quicinc.com>
+Description:	(Write) Set the data collection mode of CMB tpdm. Continuous
+		change creates CMB data set elements on every CMBCLK edge.
+		Trace-on-change creates CMB data set elements only when a new
+		data set element differs in value from the previous element
+		in a CMB data set.
+
+		Accepts only one of the 2 values -  0 or 1.
+		0 : Continuous CMB collection mode.
+		1 : Trace-on-change CMB collection mode.
+
+What:		/sys/bus/coresight/devices/<tpdm-name>/cmb_trig_patt/xpr[0:1]
+Date:		January 2024
+KernelVersion	6.9
+Contact:	Jinlong Mao (QUIC) <quic_jinlmao@quicinc.com>, Tao Zhang (QUIC) <quic_taozha@quicinc.com>
+Description:
+		(RW) Set/Get the value of the trigger pattern for the CMB
+		subunit TPDM.
+
+What:		/sys/bus/coresight/devices/<tpdm-name>/cmb_trig_patt/xpmr[0:1]
+Date:		January 2024
+KernelVersion	6.9
+Contact:	Jinlong Mao (QUIC) <quic_jinlmao@quicinc.com>, Tao Zhang (QUIC) <quic_taozha@quicinc.com>
+Description:
+		(RW) Set/Get the mask of the trigger pattern for the CMB
+		subunit TPDM.
+
+What:		/sys/bus/coresight/devices/<tpdm-name>/dsb_patt/tpr[0:1]
+Date:		January 2024
+KernelVersion	6.9
+Contact:	Jinlong Mao (QUIC) <quic_jinlmao@quicinc.com>, Tao Zhang (QUIC) <quic_taozha@quicinc.com>
+Description:
+		(RW) Set/Get the value of the pattern for the CMB subunit TPDM.
+
+What:		/sys/bus/coresight/devices/<tpdm-name>/dsb_patt/tpmr[0:1]
+Date:		January 2024
+KernelVersion	6.9
+Contact:	Jinlong Mao (QUIC) <quic_jinlmao@quicinc.com>, Tao Zhang (QUIC) <quic_taozha@quicinc.com>
+Description:
+		(RW) Set/Get the mask of the pattern for the CMB subunit TPDM.
+
+What:		/sys/bus/coresight/devices/<tpdm-name>/cmb_patt/enable_ts
+Date:		January 2024
+KernelVersion	6.9
+Contact:	Jinlong Mao (QUIC) <quic_jinlmao@quicinc.com>, Tao Zhang (QUIC) <quic_taozha@quicinc.com>
+Description:
+		(Write) Set the pattern timestamp of CMB tpdm. Read
+		the pattern timestamp of CMB tpdm.
+
+		Accepts only one of the 2 values -  0 or 1.
+		0 : Disable CMB pattern timestamp.
+		1 : Enable CMB pattern timestamp.
+
+What:		/sys/bus/coresight/devices/<tpdm-name>/cmb_trig_ts
+Date:		January 2024
+KernelVersion	6.9
+Contact:	Jinlong Mao (QUIC) <quic_jinlmao@quicinc.com>, Tao Zhang (QUIC) <quic_taozha@quicinc.com>
+Description:
+		(RW) Set/Get the trigger timestamp of the CMB for tpdm.
+
+		Accepts only one of the 2 values -  0 or 1.
+		0 : Set the CMB trigger type to false
+		1 : Set the CMB trigger type to true
+
+What:		/sys/bus/coresight/devices/<tpdm-name>/cmb_ts_all
+Date:		January 2024
+KernelVersion	6.9
+Contact:	Jinlong Mao (QUIC) <quic_jinlmao@quicinc.com>, Tao Zhang (QUIC) <quic_taozha@quicinc.com>
+Description:
+		(RW) Read or write the status of timestamp upon all interface.
+		Only value 0 and 1  can be written to this node. Set this node to 1 to requeset
+		timestamp to all trace packet.
+		Accepts only one of the 2 values -  0 or 1.
+		0 : Disable the timestamp of all trace packets.
+		1 : Enable the timestamp of all trace packets.
+
+What:		/sys/bus/coresight/devices/<tpdm-name>/cmb_msr/msr[0:31]
+Date:		January 2024
+KernelVersion	6.9
+Contact:	Jinlong Mao (QUIC) <quic_jinlmao@quicinc.com>, Tao Zhang (QUIC) <quic_taozha@quicinc.com>
+Description:
+		(RW) Set/Get the MSR(mux select register) for the CMB subunit
+		TPDM.
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/sysfs-bus-iio-filter-admv8818
+++ linux-qcom-6.8.0/Documentation/ABI/testing/sysfs-bus-iio-filter-admv8818
@@ -3,7 +3,7 @@
 Contact:	linux-iio@vger.kernel.org
 Description:
 		Reading this returns the valid values that can be written to the
-		on_altvoltage0_mode attribute:
+		filter_mode attribute:
 
 		- auto -> Adjust bandpass filter to track changes in input clock rate.
 		- manual -> disable/unregister the clock rate notifier / input clock tracking.
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/sysfs-bus-pci
+++ linux-qcom-6.8.0/Documentation/ABI/testing/sysfs-bus-pci
@@ -163,6 +163,17 @@
 		will be present in sysfs.  Writing 1 to this file
 		will perform reset.
 
+What:		/sys/bus/pci/devices/.../reset_subordinate
+Date:		October 2024
+Contact:	linux-pci@vger.kernel.org
+Description:
+		This is visible only for bridge devices. If you want to reset
+		all devices attached through the subordinate bus of a specific
+		bridge device, writing 1 to this will try to do it.  This will
+		affect all devices attached to the system through this bridge
+		similiar to writing 1 to their individual "reset" file, so use
+		with caution.
+
 What:		/sys/bus/pci/devices/.../vpd
 Date:		February 2008
 Contact:	Ben Hutchings <bwh@kernel.org>
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ linux-qcom-6.8.0/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -516,6 +516,7 @@
 		/sys/devices/system/cpu/vulnerabilities/mds
 		/sys/devices/system/cpu/vulnerabilities/meltdown
 		/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
+		/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
 		/sys/devices/system/cpu/vulnerabilities/retbleed
 		/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
 		/sys/devices/system/cpu/vulnerabilities/spectre_v1
@@ -561,7 +562,8 @@
 			 ================ =========================================
 
 			 If control status is "forceoff" or "notsupported" writes
-			 are rejected.
+			 are rejected. Note that enabling SMT on PowerPC skips
+			 offline cores.
 
 What:		/sys/devices/system/cpu/cpuX/power/energy_perf_bias
 Date:		March 2019
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/sysfs-driver-qat
+++ linux-qcom-6.8.0/Documentation/ABI/testing/sysfs-driver-qat
@@ -141,3 +141,23 @@
 			64
 
 		This attribute is only available for qat_4xxx devices.
+
+What:		/sys/bus/pci/devices/<BDF>/qat/auto_reset
+Date:		March 2024
+KernelVersion:	6.8
+Contact:	qat-linux@intel.com
+Description:	(RW) Reports the current state of the autoreset feature
+		for a QAT device
+
+		Write to the attribute to enable or disable device auto reset.
+
+		Device auto reset is disabled by default.
+
+		The values are:
+
+		* 1/Yy/on: auto reset enabled. If the device encounters an
+		  unrecoverable error, it will be reset automatically.
+		* 0/Nn/off: auto reset disabled. If the device encounters an
+		  unrecoverable error, it will not be reset.
+
+		This attribute is only available for qat_4xxx devices.
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/sysfs-fs-f2fs
+++ linux-qcom-6.8.0/Documentation/ABI/testing/sysfs-fs-f2fs
@@ -311,10 +311,13 @@
 		GC approach and turns SSR mode on.
 		gc urgent low(2): lowers the bar of checking I/O idling in
 		order to process outstanding discard commands and GC a
-		little bit aggressively. uses cost benefit GC approach.
+		little bit aggressively. always uses cost benefit GC approach,
+		and will override age-threshold GC approach if ATGC is enabled
+		at the same time.
 		gc urgent mid(3): does GC forcibly in a period of given
 		gc_urgent_sleep_time and executes a mid level of I/O idling check.
-		uses cost benefit GC approach.
+		always uses cost benefit GC approach, and will override
+		age-threshold GC approach if ATGC is enabled at the same time.
 
 What:		/sys/fs/f2fs/<disk>/gc_urgent_sleep_time
 Date:		August 2017
@@ -761,3 +764,25 @@
 Contact:	"Chao Yu" <chao@kernel.org>
 Description:	It controls to enable/disable IO aware feature for background discard.
 		By default, the value is 1 which indicates IO aware is on.
+
+What:		/sys/fs/f2fs/<disk>/blkzone_alloc_policy
+Date:		July 2024
+Contact:	"Yuanhong Liao" <liaoyuanhong@vivo.com>
+Description:	The zone UFS we are currently using consists of two parts:
+		conventional zones and sequential zones. It can be used to control which part
+		to prioritize for writes, with a default value of 0.
+
+		========================  =========================================
+		value					  description
+		blkzone_alloc_policy = 0  Prioritize writing to sequential zones
+		blkzone_alloc_policy = 1  Only allow writing to sequential zones
+		blkzone_alloc_policy = 2  Prioritize writing to conventional zones
+		========================  =========================================
+
+What:		/sys/fs/f2fs/<disk>/migration_window_granularity
+Date:		September 2024
+Contact:	"Daeho Jeong" <daehojeong@google.com>
+Description:	Controls migration window granularity of garbage collection on large
+		section. it can control the scanning window granularity for GC migration
+		in a unit of segment, while migration_granularity controls the number
+		of segments which can be migrated at the same turn.
--- linux-qcom-6.8.0.orig/Documentation/ABI/testing/sysfs-fs-xfs
+++ linux-qcom-6.8.0/Documentation/ABI/testing/sysfs-fs-xfs
@@ -1,7 +1,7 @@
 What:		/sys/fs/xfs/<disk>/log/log_head_lsn
 Date:		July 2014
 KernelVersion:	3.17
-Contact:	xfs@oss.sgi.com
+Contact:	linux-xfs@vger.kernel.org
 Description:
 		The log sequence number (LSN) of the current head of the
 		log. The LSN is exported in "cycle:basic block" format.
@@ -10,7 +10,7 @@
 What:		/sys/fs/xfs/<disk>/log/log_tail_lsn
 Date:		July 2014
 KernelVersion:	3.17
-Contact:	xfs@oss.sgi.com
+Contact:	linux-xfs@vger.kernel.org
 Description:
 		The log sequence number (LSN) of the current tail of the
 		log. The LSN is exported in "cycle:basic block" format.
@@ -18,7 +18,7 @@
 What:		/sys/fs/xfs/<disk>/log/reserve_grant_head
 Date:		July 2014
 KernelVersion:	3.17
-Contact:	xfs@oss.sgi.com
+Contact:	linux-xfs@vger.kernel.org
 Description:
 		The current state of the log reserve grant head. It
 		represents the total log reservation of all currently
@@ -29,7 +29,7 @@
 What:		/sys/fs/xfs/<disk>/log/write_grant_head
 Date:		July 2014
 KernelVersion:	3.17
-Contact:	xfs@oss.sgi.com
+Contact:	linux-xfs@vger.kernel.org
 Description:
 		The current state of the log write grant head. It
 		represents the total log reservation of all currently
--- linux-qcom-6.8.0.orig/Documentation/Makefile
+++ linux-qcom-6.8.0/Documentation/Makefile
@@ -111,8 +111,10 @@
 $(YNL_RST_DIR)/%.rst: $(YNL_YAML_DIR)/%.yaml $(YNL_TOOL)
 	$(Q)$(YNL_TOOL) -i $< -o $@
 
-htmldocs: $(YNL_INDEX)
-	@$(srctree)/scripts/sphinx-pre-install --version-check
+htmldocs texinfodocs latexdocs epubdocs xmldocs: $(YNL_INDEX)
+
+htmldocs:
+	@$(srctree)/scripts/sphinx-pre-install --version-check --no-virtualenv
 	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,html,$(var),,$(var)))
 
 # If Rust support is available and .config exists, add rustdoc generated contents.
--- linux-qcom-6.8.0.orig/Documentation/RCU/stallwarn.rst
+++ linux-qcom-6.8.0/Documentation/RCU/stallwarn.rst
@@ -249,7 +249,7 @@
 interrupts during the current stalled grace period.
 
 The "idle=" portion of the message prints the dyntick-idle state.
-The hex number before the first "/" is the low-order 12 bits of the
+The hex number before the first "/" is the low-order 16 bits of the
 dynticks counter, which will have an even-numbered value if the CPU
 is in dyntick-idle mode and an odd-numbered value otherwise.  The hex
 number between the two "/"s is the value of the nesting, which will be
--- linux-qcom-6.8.0.orig/Documentation/accel/qaic/aic080.rst
+++ linux-qcom-6.8.0/Documentation/accel/qaic/aic080.rst
@@ -0,0 +1,14 @@
+.. SPDX-License-Identifier: GPL-2.0-only
+
+===============================
+ Qualcomm Cloud AI 80 (AIC080)
+===============================
+
+Overview
+========
+
+The Qualcomm Cloud AI 80/AIC080 family of products are a derivative of AIC100.
+The number of NSPs and clock rates are reduced to fit within resource
+constrained solutions. The PCIe Product ID is 0xa080.
+
+As a derivative product, all AIC100 documentation applies.
--- linux-qcom-6.8.0.orig/Documentation/accel/qaic/index.rst
+++ linux-qcom-6.8.0/Documentation/accel/qaic/index.rst
@@ -10,4 +10,5 @@
 .. toctree::
 
    qaic
+   aic080
    aic100
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/blockdev/zram.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/blockdev/zram.rst
@@ -47,6 +47,8 @@
 -ENOMEM	  zram was not able to allocate enough memory to fulfil your
 	  needs.
 -EINVAL	  invalid input has been provided.
+-EAGAIN	  re-try operation later (e.g. when attempting to run recompress
+	  and writeback simultaneously).
 ========  =============================================================
 
 If you use 'echo', the returned value is set by the 'echo' utility,
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/cgroup-v2.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/cgroup-v2.rst
@@ -1694,9 +1694,10 @@
 	entries fault back in or are written out to disk.
 
   memory.zswap.writeback
-	A read-write single value file. The default value is "1". The
-	initial value of the root cgroup is 1, and when a new cgroup is
-	created, it inherits the current value of its parent.
+	A read-write single value file. The default value is "1".
+	Note that this setting is hierarchical, i.e. the writeback would be
+	implicitly disabled for child cgroups if the upper hierarchy
+	does so.
 
 	When this is set to 0, all swapping attempts to swapping devices
 	are disabled. This included both zswap writebacks, and swapping due
@@ -2320,8 +2321,12 @@
 	is always a subset of it.
 
 	Users can manually set it to a value that is different from
-	"cpuset.cpus".	The only constraint in setting it is that the
-	list of CPUs must be exclusive with respect to its sibling.
+	"cpuset.cpus".	One constraint in setting it is that the list of
+	CPUs must be exclusive with respect to "cpuset.cpus.exclusive"
+	of its sibling.  If "cpuset.cpus.exclusive" of a sibling cgroup
+	isn't set, its "cpuset.cpus" value, if set, cannot be a subset
+	of it to leave at least one CPU available when the exclusive
+	CPUs are taken away.
 
 	For a parent cgroup, any one of its exclusive CPUs can only
 	be distributed to at most one of its child cgroups.  Having an
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/cifs/usage.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/cifs/usage.rst
@@ -723,40 +723,26 @@
 ======================= =======================================================
 SecurityFlags		Flags which control security negotiation and
 			also packet signing. Authentication (may/must)
-			flags (e.g. for NTLM and/or NTLMv2) may be combined with
+			flags (e.g. for NTLMv2) may be combined with
 			the signing flags.  Specifying two different password
 			hashing mechanisms (as "must use") on the other hand
 			does not make much sense. Default flags are::
 
-				0x07007
+				0x00C5
 
-			(NTLM, NTLMv2 and packet signing allowed).  The maximum
-			allowable flags if you want to allow mounts to servers
-			using weaker password hashes is 0x37037 (lanman,
-			plaintext, ntlm, ntlmv2, signing allowed).  Some
-			SecurityFlags require the corresponding menuconfig
-			options to be enabled.  Enabling plaintext
-			authentication currently requires also enabling
-			lanman authentication in the security flags
-			because the cifs module only supports sending
-			laintext passwords using the older lanman dialect
-			form of the session setup SMB.  (e.g. for authentication
-			using plain text passwords, set the SecurityFlags
-			to 0x30030)::
+			(NTLMv2 and packet signing allowed).  Some SecurityFlags
+			may require enabling a corresponding menuconfig option.
 
 			  may use packet signing			0x00001
 			  must use packet signing			0x01001
-			  may use NTLM (most common password hash)	0x00002
-			  must use NTLM					0x02002
 			  may use NTLMv2				0x00004
 			  must use NTLMv2				0x04004
-			  may use Kerberos security			0x00008
-			  must use Kerberos				0x08008
-			  may use lanman (weak) password hash		0x00010
-			  must use lanman password hash			0x10010
-			  may use plaintext passwords			0x00020
-			  must use plaintext passwords			0x20020
-			  (reserved for future packet encryption)	0x00040
+			  may use Kerberos security (krb5)		0x00008
+			  must use Kerberos                             0x08008
+			  may use NTLMSSP               		0x00080
+			  must use NTLMSSP           			0x80080
+			  seal (packet encryption)			0x00040
+			  must seal                                     0x40040
 
 cifsFYI			If set to non-zero value, additional debug information
 			will be logged to the system error log.  This field
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/gpio/gpio-aggregator.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/gpio/gpio-aggregator.rst
@@ -69,6 +69,113 @@
 		    $ echo gpio-aggregator.0 > delete_device
 
 
+Aggregating GPIOs using Configfs
+--------------------------------
+
+**Group:** ``/config/gpio-aggregator``
+
+    This is the root directory of the gpio-aggregator configfs tree.
+
+**Group:** ``/config/gpio-aggregator/<example-name>``
+
+    This directory represents a GPIO aggregator device. You can assign any
+    name to ``<example-name>`` (e.g. ``agg0``), except names starting with
+    ``_sysfs`` prefix, which are reserved for auto-generated configfs
+    entries corresponding to devices created via Sysfs.
+
+**Attribute:** ``/config/gpio-aggregator/<example-name>/live``
+
+    The ``live`` attribute allows to trigger the actual creation of the device
+    once it's fully configured. Accepted values are:
+
+    * ``1``, ``yes``, ``true`` : enable the virtual device
+    * ``0``, ``no``, ``false`` : disable the virtual device
+
+**Attribute:** ``/config/gpio-aggregator/<example-name>/dev_name``
+
+    The read-only ``dev_name`` attribute exposes the name of the device as it
+    will appear in the system on the platform bus (e.g. ``gpio-aggregator.0``).
+    This is useful for identifying a character device for the newly created
+    aggregator. If it's ``gpio-aggregator.0``,
+    ``/sys/devices/platform/gpio-aggregator.0/gpiochipX`` path tells you that the
+    GPIO device id is ``X``.
+
+You must create subdirectories for each virtual line you want to
+instantiate, named exactly as ``line0``, ``line1``, ..., ``lineY``, when
+you want to instantiate ``Y+1`` (Y >= 0) lines.  Configure all lines before
+activating the device by setting ``live`` to 1.
+
+**Group:** ``/config/gpio-aggregator/<example-name>/<lineY>/``
+
+    This directory represents a GPIO line to include in the aggregator.
+
+**Attribute:** ``/config/gpio-aggregator/<example-name>/<lineY>/key``
+
+**Attribute:** ``/config/gpio-aggregator/<example-name>/<lineY>/offset``
+
+    The default values after creating the ``<lineY>`` directory are:
+
+    * ``key`` : <empty>
+    * ``offset`` : -1
+
+    ``key`` must always be explicitly configured, while ``offset`` depends.
+    Two configuration patterns exist for each ``<lineY>``:
+
+    (a). For lookup by GPIO line name:
+
+         * Set ``key`` to the line name.
+         * Ensure ``offset`` remains -1 (the default).
+
+    (b). For lookup by GPIO chip name and the line offset within the chip:
+
+         * Set ``key`` to the chip name.
+         * Set ``offset`` to the line offset (0 <= ``offset`` < 65535).
+
+**Attribute:** ``/config/gpio-aggregator/<example-name>/<lineY>/name``
+
+    The ``name`` attribute sets a custom name for lineY. If left unset, the
+    line will remain unnamed.
+
+Once the configuration is done, the ``'live'`` attribute must be set to 1
+in order to instantiate the aggregator device. It can be set back to 0 to
+destroy the virtual device. The module will synchronously wait for the new
+aggregator device to be successfully probed and if this doesn't happen, writing
+to ``'live'`` will result in an error. This is a different behaviour from the
+case when you create it using sysfs ``new_device`` interface.
+
+.. note::
+
+   For aggregators created via Sysfs, the configfs entries are
+   auto-generated and appear as ``/config/gpio-aggregator/_sysfs.<N>/``. You
+   cannot add or remove line directories with mkdir(2)/rmdir(2). To modify
+   lines, you must use the "delete_device" interface to tear down the
+   existing device and reconfigure it from scratch. However, you can still
+   toggle the aggregator with the ``live`` attribute and adjust the
+   ``key``, ``offset``, and ``name`` attributes for each line when ``live``
+   is set to 0 by hand (i.e. it's not waiting for deferred probe).
+
+Sample configuration commands
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. code-block:: sh
+
+    # Create a directory for an aggregator device
+    $ mkdir /sys/kernel/config/gpio-aggregator/agg0
+
+    # Configure each line
+    $ mkdir /sys/kernel/config/gpio-aggregator/agg0/line0
+    $ echo gpiochip0 > /sys/kernel/config/gpio-aggregator/agg0/line0/key
+    $ echo 6         > /sys/kernel/config/gpio-aggregator/agg0/line0/offset
+    $ echo test0     > /sys/kernel/config/gpio-aggregator/agg0/line0/name
+    $ mkdir /sys/kernel/config/gpio-aggregator/agg0/line1
+    $ echo gpiochip0 > /sys/kernel/config/gpio-aggregator/agg0/line1/key
+    $ echo 7         > /sys/kernel/config/gpio-aggregator/agg0/line1/offset
+    $ echo test1     > /sys/kernel/config/gpio-aggregator/agg0/line1/name
+
+    # Activate the aggregator device
+    $ echo 1         > /sys/kernel/config/gpio-aggregator/agg0/live
+
+
 Generic GPIO Driver
 -------------------
 
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/hw-vuln/core-scheduling.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/hw-vuln/core-scheduling.rst
@@ -67,8 +67,8 @@
     will be performed for all tasks in the task group of ``pid``.
 
 arg5:
-    userspace pointer to an unsigned long for storing the cookie returned by
-    ``PR_SCHED_CORE_GET`` command. Should be 0 for all other commands.
+    userspace pointer to an unsigned long long for storing the cookie returned
+    by ``PR_SCHED_CORE_GET`` command. Should be 0 for all other commands.
 
 In order for a process to push a cookie to, or pull a cookie from a process, it
 is required to have the ptrace access mode: `PTRACE_MODE_READ_REALCREDS` to the
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/hw-vuln/index.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/hw-vuln/index.rst
@@ -21,3 +21,4 @@
    cross-thread-rsb
    srso
    gather_data_sampling
+   reg-file-data-sampling
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
@@ -0,0 +1,104 @@
+==================================
+Register File Data Sampling (RFDS)
+==================================
+
+Register File Data Sampling (RFDS) is a microarchitectural vulnerability that
+only affects Intel Atom parts(also branded as E-cores). RFDS may allow
+a malicious actor to infer data values previously used in floating point
+registers, vector registers, or integer registers. RFDS does not provide the
+ability to choose which data is inferred. CVE-2023-28746 is assigned to RFDS.
+
+Affected Processors
+===================
+Below is the list of affected Intel processors [#f1]_:
+
+   ===================  ============
+   Common name          Family_Model
+   ===================  ============
+   ATOM_GOLDMONT           06_5CH
+   ATOM_GOLDMONT_D         06_5FH
+   ATOM_GOLDMONT_PLUS      06_7AH
+   ATOM_TREMONT_D          06_86H
+   ATOM_TREMONT            06_96H
+   ALDERLAKE               06_97H
+   ALDERLAKE_L             06_9AH
+   ATOM_TREMONT_L          06_9CH
+   RAPTORLAKE              06_B7H
+   RAPTORLAKE_P            06_BAH
+   ATOM_GRACEMONT          06_BEH
+   RAPTORLAKE_S            06_BFH
+   ===================  ============
+
+As an exception to this table, Intel Xeon E family parts ALDERLAKE(06_97H) and
+RAPTORLAKE(06_B7H) codenamed Catlow are not affected. They are reported as
+vulnerable in Linux because they share the same family/model with an affected
+part. Unlike their affected counterparts, they do not enumerate RFDS_CLEAR or
+CPUID.HYBRID. This information could be used to distinguish between the
+affected and unaffected parts, but it is deemed not worth adding complexity as
+the reporting is fixed automatically when these parts enumerate RFDS_NO.
+
+Mitigation
+==========
+Intel released a microcode update that enables software to clear sensitive
+information using the VERW instruction. Like MDS, RFDS deploys the same
+mitigation strategy to force the CPU to clear the affected buffers before an
+attacker can extract the secrets. This is achieved by using the otherwise
+unused and obsolete VERW instruction in combination with a microcode update.
+The microcode clears the affected CPU buffers when the VERW instruction is
+executed.
+
+Mitigation points
+-----------------
+VERW is executed by the kernel before returning to user space, and by KVM
+before VMentry. None of the affected cores support SMT, so VERW is not required
+at C-state transitions.
+
+New bits in IA32_ARCH_CAPABILITIES
+----------------------------------
+Newer processors and microcode update on existing affected processors added new
+bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate
+vulnerability and mitigation capability:
+
+- Bit 27 - RFDS_NO - When set, processor is not affected by RFDS.
+- Bit 28 - RFDS_CLEAR - When set, processor is affected by RFDS, and has the
+  microcode that clears the affected buffers on VERW execution.
+
+Mitigation control on the kernel command line
+---------------------------------------------
+The kernel command line allows to control RFDS mitigation at boot time with the
+parameter "reg_file_data_sampling=". The valid arguments are:
+
+  ==========  =================================================================
+  on          If the CPU is vulnerable, enable mitigation; CPU buffer clearing
+              on exit to userspace and before entering a VM.
+  off         Disables mitigation.
+  ==========  =================================================================
+
+Mitigation default is selected by CONFIG_MITIGATION_RFDS.
+
+Mitigation status information
+-----------------------------
+The Linux kernel provides a sysfs interface to enumerate the current
+vulnerability status of the system: whether the system is vulnerable, and
+which mitigations are active. The relevant sysfs file is:
+
+	/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
+
+The possible values in this file are:
+
+  .. list-table::
+
+     * - 'Not affected'
+       - The processor is not vulnerable
+     * - 'Vulnerable'
+       - The processor is vulnerable, but no mitigation enabled
+     * - 'Vulnerable: No microcode'
+       - The processor is vulnerable but microcode is not updated.
+     * - 'Mitigation: Clear Register File'
+       - The processor is vulnerable and the CPU buffer clearing mitigation is
+	 enabled.
+
+References
+----------
+.. [#f1] Affected Processors
+   https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/hw-vuln/spectre.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -138,11 +138,10 @@
 the BHB might be shared across privilege levels even in the presence of
 Enhanced IBRS.
 
-Currently the only known real-world BHB attack vector is via
-unprivileged eBPF. Therefore, it's highly recommended to not enable
-unprivileged eBPF, especially when eIBRS is used (without retpolines).
-For a full mitigation against BHB attacks, it's recommended to use
-retpolines (or eIBRS combined with retpolines).
+Previously the only known real-world BHB attack vector was via unprivileged
+eBPF. Further research has found attacks that don't require unprivileged eBPF.
+For a full mitigation against BHB attacks it is recommended to set BHI_DIS_S or
+use the BHB clearing sequence.
 
 Attack scenarios
 ----------------
@@ -430,6 +429,23 @@
   'PBRSB-eIBRS: Not affected'  CPU is not affected by PBRSB
   ===========================  =======================================================
 
+  - Branch History Injection (BHI) protection status:
+
+.. list-table::
+
+ * - BHI: Not affected
+   - System is not affected
+ * - BHI: Retpoline
+   - System is protected by retpoline
+ * - BHI: BHI_DIS_S
+   - System is protected by BHI_DIS_S
+ * - BHI: SW loop, KVM SW loop
+   - System is protected by software clearing sequence
+ * - BHI: Vulnerable
+   - System is vulnerable to BHI
+ * - BHI: Vulnerable, KVM: SW loop
+   - System is vulnerable; KVM is protected by software clearing sequence
+
 Full mitigation might require a microcode update from the CPU
 vendor. When the necessary microcode is not available, the kernel will
 report vulnerability.
@@ -484,7 +500,11 @@
 
    Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at
    boot, by setting the IBRS bit, and they're automatically protected against
-   Spectre v2 variant attacks.
+   some Spectre v2 variant attacks. The BHB can still influence the choice of
+   indirect branch predictor entry, and although branch predictor entries are
+   isolated between modes when eIBRS is enabled, the BHB itself is not isolated
+   between modes. Systems which support BHI_DIS_S will set it to protect against
+   BHI attacks.
 
    On Intel's enhanced IBRS systems, this includes cross-thread branch target
    injections on SMT systems (STIBP). In other words, Intel eIBRS enables
@@ -638,6 +658,18 @@
 		spectre_v2=off. Spectre variant 1 mitigations
 		cannot be disabled.
 
+	spectre_bhi=
+
+		[X86] Control mitigation of Branch History Injection
+		(BHI) vulnerability.  This setting affects the deployment
+		of the HW BHI control and the SW BHB clearing sequence.
+
+		on
+			(default) Enable the HW or SW mitigation as
+			needed.
+		off
+			Disable the mitigation.
+
 For spectre_v2_user see Documentation/admin-guide/kernel-parameters.txt
 
 Mitigation selection guide
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/kernel-parameters.txt
+++ linux-qcom-6.8.0/Documentation/admin-guide/kernel-parameters.txt
@@ -679,12 +679,6 @@
 			loops can be debugged more effectively on production
 			systems.
 
-	clocksource.max_cswd_read_retries= [KNL]
-			Number of clocksource_watchdog() retries due to
-			external delays before the clock will be marked
-			unstable.  Defaults to two retries, that is,
-			three attempts to read the clock under test.
-
 	clocksource.verify_n_cpus= [KNL]
 			Limit the number of CPUs checked for clocksources
 			marked with CLOCK_SOURCE_VERIFY_PERCPU that
@@ -848,6 +842,10 @@
 			Format:
 			<first_slot>,<last_slot>,<port>,<enum_bit>[,<debug>]
 
+	cpufreq_driver= [X86] Allow only the named cpu frequency scaling driver
+			to register. Example: cpufreq_driver=powernow-k8
+			Format: { none | STRING }
+
 	cpuidle.off=1	[CPU_IDLE]
 			disable the cpuidle sub-system
 
@@ -1150,6 +1148,26 @@
 			The filter can be disabled or changed to another
 			driver later using sysfs.
 
+	reg_file_data_sampling=
+			[X86] Controls mitigation for Register File Data
+			Sampling (RFDS) vulnerability. RFDS is a CPU
+			vulnerability which may allow userspace to infer
+			kernel data values previously stored in floating point
+			registers, vector registers, or integer registers.
+			RFDS only affects Intel Atom processors.
+
+			on:	Turns ON the mitigation.
+			off:	Turns OFF the mitigation.
+
+			This parameter overrides the compile time default set
+			by CONFIG_MITIGATION_RFDS. Mitigation cannot be
+			disabled when other VERW based mitigations (like MDS)
+			are enabled. In order to disable RFDS mitigation all
+			VERW based mitigations need to be disabled.
+
+			For details see:
+			Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst
+
 	driver_async_probe=  [KNL]
 			List of driver names to be probed asynchronously. *
 			matches with all driver names. If * is specified, the
@@ -3320,9 +3338,7 @@
 
 	mem_encrypt=	[X86-64] AMD Secure Memory Encryption (SME) control
 			Valid arguments: on, off
-			Default (depends on kernel configuration option):
-			  on  (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y)
-			  off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n)
+			Default: off
 			mem_encrypt=on:		Activate SME
 			mem_encrypt=off:	Do not activate SME
 
@@ -3381,6 +3397,9 @@
 			arch-independent options, each of which is an
 			aggregation of existing arch-specific options.
 
+			Note, "mitigations" is supported if and only if the
+			kernel was built with CPU_MITIGATIONS=y.
+
 			off
 				Disable all optional CPU mitigations.  This
 				improves system performance, but it may also
@@ -3398,8 +3417,10 @@
 					       nospectre_bhb [ARM64]
 					       nospectre_v1 [X86,PPC]
 					       nospectre_v2 [X86,PPC,S390,ARM64]
+					       reg_file_data_sampling=off [X86]
 					       retbleed=off [X86]
 					       spec_store_bypass_disable=off [X86,PPC]
+					       spectre_bhi=off [X86]
 					       spectre_v2_user=off [X86]
 					       srbds=off [X86,INTEL]
 					       ssbd=force-off [ARM64]
@@ -4370,6 +4391,12 @@
 		nomsi		[MSI] If the PCI_MSI kernel config parameter is
 				enabled, this kernel boot option can be used to
 				disable the use of MSI interrupts system-wide.
+		clearmsi	[X86] Clears MSI/MSI-X enable bits early in boot
+				time in order to avoid issues like adapters
+				screaming irqs and preventing boot progress.
+				Also, it enforces the PCI Local Bus spec
+				rule that those bits should be 0 in system reset
+				events (useful for kexec/kdump cases).
 		noioapicquirk	[APIC] Disable all boot interrupt quirks.
 				Safety option to keep boot IRQs enabled. This
 				should never be necessary.
@@ -4665,7 +4692,9 @@
 			none - Limited to cond_resched() calls
 			voluntary - Limited to cond_resched() and might_sleep() calls
 			full - Any section that isn't explicitly preempt disabled
-			       can be preempted anytime.
+			       can be preempted anytime.  Tasks will also yield
+			       contended spinlocks (if the critical section isn't
+			       explicitly preempt disabled beyond the lock itself).
 
 	print-fatal-signals=
 			[KNL] debug: print fatal signals
@@ -4705,6 +4734,16 @@
 	printk.time=	Show timing data prefixed to each printk message line
 			Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
 
+	proc_mem.force_override= [KNL]
+			Format: {always | ptrace | never}
+			Traditionally /proc/pid/mem allows memory permissions to be
+			overridden without restrictions. This option may be set to
+			restrict that. Can be one of:
+			- 'always': traditional behavior always allows mem overrides.
+			- 'ptrace': only allow mem overrides for active ptracers.
+			- 'never':  never allow mem overrides.
+			If not specified, default is the CONFIG_PROC_MEM_* choice.
+
 	processor.max_cstate=	[HW,ACPI]
 			Limit processor to maximum C-state
 			max_cstate=9 overrides any DMI blacklist limit.
@@ -4715,11 +4754,9 @@
 
 	profile=	[KNL] Enable kernel profiling via /proc/profile
 			Format: [<profiletype>,]<number>
-			Param: <profiletype>: "schedule", "sleep", or "kvm"
+			Param: <profiletype>: "schedule" or "kvm"
 				[defaults to kernel profiling]
 			Param: "schedule" - profile schedule points.
-			Param: "sleep" - profile D-state sleeping (millisecs).
-				Requires CONFIG_SCHEDSTATS
 			Param: "kvm" - profile VM exits.
 			Param: <number> - step/bucket size as a power of 2 for
 				statistical time based profiling.
@@ -5034,6 +5071,11 @@
 			this kernel boot parameter, forcibly setting it
 			to zero.
 
+	rcutree.enable_rcu_lazy= [KNL]
+			To save power, batch RCU callbacks and flush after
+			delay, memory pressure or callback list growing too
+			big.
+
 	rcuscale.gp_async= [KNL]
 			Measure performance of asynchronous
 			grace-period primitives such as call_rcu().
@@ -6012,6 +6054,15 @@
 	sonypi.*=	[HW] Sony Programmable I/O Control Device driver
 			See Documentation/admin-guide/laptops/sonypi.rst
 
+	spectre_bhi=	[X86] Control mitigation of Branch History Injection
+			(BHI) vulnerability.  This setting affects the
+			deployment of the HW BHI control and the SW BHB
+			clearing sequence.
+
+			on   - (default) Enable the HW or SW mitigation
+			       as needed.
+			off  - Disable the mitigation.
+
 	spectre_v2=	[X86] Control mitigation of Spectre variant 2
 			(indirect branch speculation) vulnerability.
 			The default operation protects the kernel from
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/media/building.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/media/building.rst
@@ -15,7 +15,7 @@
 
 you should use the main media development tree ``master`` branch:
 
-    https://git.linuxtv.org/media_tree.git/
+    https://git.linuxtv.org/media.git/
 
 In this case, you may find some useful information at the
 `LinuxTv wiki pages <https://linuxtv.org/wiki>`_:
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/media/saa7134.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/media/saa7134.rst
@@ -67,7 +67,7 @@
 Please mail to linux-media AT vger.kernel.org unified diffs against
 the linux media git tree:
 
-    https://git.linuxtv.org/media_tree.git/
+    https://git.linuxtv.org/media.git/
 
 This is done by committing a patch at a clone of the git tree and
 submitting the patch using ``git send-email``. Don't forget to
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/mm/damon/usage.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/mm/damon/usage.rst
@@ -450,7 +450,7 @@
     # # further filter out all cgroups except one at '/having_care_already'
     echo memcg > 1/type
     echo /having_care_already > 1/memcg_path
-    echo N > 1/matching
+    echo Y > 1/matching
 
 Note that ``anon`` and ``memcg`` filters are currently supported only when
 ``paddr`` :ref:`implementation <sysfs_context>` is being used.
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/mm/transhuge.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/mm/transhuge.rst
@@ -202,12 +202,11 @@
 
 	cat /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
 
-khugepaged will be automatically started when one or more hugepage
-sizes are enabled (either by directly setting "always" or "madvise",
-or by setting "inherit" while the top-level enabled is set to "always"
-or "madvise"), and it'll be automatically shutdown when the last
-hugepage size is disabled (either by directly setting "never", or by
-setting "inherit" while the top-level enabled is set to "never").
+khugepaged will be automatically started when PMD-sized THP is enabled
+(either of the per-size anon control or the top-level control are set
+to "always" or "madvise"), and it'll be automatically shutdown when
+PMD-sized THP is disabled (when both the per-size anon control and the
+top-level control are "never")
 
 Khugepaged controls
 -------------------
--- linux-qcom-6.8.0.orig/Documentation/admin-guide/sysctl/net.rst
+++ linux-qcom-6.8.0/Documentation/admin-guide/sysctl/net.rst
@@ -206,6 +206,11 @@
 
 Default: 0 (off)
 
+mem_pcpu_rsv
+------------
+
+Per-cpu reserved forward alloc cache size in page units. Default 1MB per CPU.
+
 rmem_default
 ------------
 
--- linux-qcom-6.8.0.orig/Documentation/arch/arm64/silicon-errata.rst
+++ linux-qcom-6.8.0/Documentation/arch/arm64/silicon-errata.rst
@@ -54,6 +54,8 @@
 +----------------+-----------------+-----------------+-----------------------------+
 | Ampere         | AmpereOne       | AC03_CPU_38     | AMPERE_ERRATUM_AC03_CPU_38  |
 +----------------+-----------------+-----------------+-----------------------------+
+| Ampere         | AmpereOne AC04  | AC04_CPU_10     | AMPERE_ERRATUM_AC03_CPU_38  |
++----------------+-----------------+-----------------+-----------------------------+
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A510     | #2457168        | ARM64_ERRATUM_2457168       |
 +----------------+-----------------+-----------------+-----------------------------+
@@ -123,22 +125,50 @@
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A77      | #1491015        | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A76      | #3324349        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A77      | #1508412        | ARM64_ERRATUM_1508412       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A77      | #3324348        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A78      | #3324344        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A78C     | #3324346,3324347| ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A710     | #2119858        | ARM64_ERRATUM_2119858       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A710     | #2054223        | ARM64_ERRATUM_2054223       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A710     | #2224489        | ARM64_ERRATUM_2224489       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A710     | #3324338        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A715     | #2645198        | ARM64_ERRATUM_2645198       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-X1       | #1502854        | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A715     | #3456084        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A720     | #3456091        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A725     | #3456106        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X1       | #3324344        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X1C      | #3324346        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-X2       | #2119858        | ARM64_ERRATUM_2119858       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-X2       | #2224489        | ARM64_ERRATUM_2224489       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X2       | #3324338        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X3       | #3324335        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X4       | #3194386        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-X925     | #3324334        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1188873,1418040| ARM64_ERRATUM_1418040       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1349291        | N/A                         |
@@ -147,6 +177,8 @@
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1542419        | ARM64_ERRATUM_1542419       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-N1     | #3324349        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N2     | #2139208        | ARM64_ERRATUM_2139208       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N2     | #2067961        | ARM64_ERRATUM_2067961       |
@@ -155,6 +187,16 @@
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-V1     | #1619801        | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-N2     | #3324339        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-N3     | #3456111        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V1     | #3324341        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V2     | #3324336        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V3     | #3312417        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | MMU-500         | #841119,826419  | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | MMU-600         | #1076982,1209401| N/A                         |
@@ -212,8 +254,11 @@
 +----------------+-----------------+-----------------+-----------------------------+
 | Hisilicon      | Hip08 SMMU PMCG | #162001800      | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
-| Hisilicon      | Hip08 SMMU PMCG | #162001900      | N/A                         |
-|                | Hip09 SMMU PMCG |                 |                             |
+| Hisilicon      | Hip{08,09,09A,10| #162001900      | N/A                         |
+|                | ,10C,11}        |                 |                             |
+|                | SMMU PMCG       |                 |                             |
++----------------+-----------------+-----------------+-----------------------------+
+| Hisilicon      | Hip09           | #162100801      | HISILICON_ERRATUM_162100801 |
 +----------------+-----------------+-----------------+-----------------------------+
 +----------------+-----------------+-----------------+-----------------------------+
 | Qualcomm Tech. | Kryo/Falkor v1  | E1003           | QCOM_FALKOR_ERRATUM_1003    |
@@ -250,3 +295,5 @@
 +----------------+-----------------+-----------------+-----------------------------+
 | Microsoft      | Azure Cobalt 100| #2253138        | ARM64_ERRATUM_2253138       |
 +----------------+-----------------+-----------------+-----------------------------+
+| Microsoft      | Azure Cobalt 100| #3324339        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
--- linux-qcom-6.8.0.orig/Documentation/arch/powerpc/kvm-nested.rst
+++ linux-qcom-6.8.0/Documentation/arch/powerpc/kvm-nested.rst
@@ -546,7 +546,9 @@
 +--------+-------+----+--------+----------------------------------+
 | 0x1052 | 0x08  | RW |   T    | CTRL                             |
 +--------+-------+----+--------+----------------------------------+
-| 0x1053-|       |    |        | Reserved                         |
+| 0x1053 | 0x08  | RW |   T    | DPDES                            |
++--------+-------+----+--------+----------------------------------+
+| 0x1054-|       |    |        | Reserved                         |
 | 0x1FFF |       |    |        |                                  |
 +--------+-------+----+--------+----------------------------------+
 | 0x2000 | 0x04  | RW |   T    | CR                               |
--- linux-qcom-6.8.0.orig/Documentation/arch/x86/amd-memory-encryption.rst
+++ linux-qcom-6.8.0/Documentation/arch/x86/amd-memory-encryption.rst
@@ -87,14 +87,14 @@
 	  kernel is non-zero).
 
 SME can also be enabled and activated in the BIOS. If SME is enabled and
-activated in the BIOS, then all memory accesses will be encrypted and it will
-not be necessary to activate the Linux memory encryption support.  If the BIOS
-merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG), then Linux can activate
-memory encryption by default (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) or
-by supplying mem_encrypt=on on the kernel command line.  However, if BIOS does
-not enable SME, then Linux will not be able to activate memory encryption, even
-if configured to do so by default or the mem_encrypt=on command line parameter
-is specified.
+activated in the BIOS, then all memory accesses will be encrypted and it
+will not be necessary to activate the Linux memory encryption support.
+
+If the BIOS merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG),
+then memory encryption can be enabled by supplying mem_encrypt=on on the
+kernel command line.  However, if BIOS does not enable SME, then Linux
+will not be able to activate memory encryption, even if configured to do
+so by default or the mem_encrypt=on command line parameter is specified.
 
 Secure Nested Paging (SNP)
 ==========================
--- linux-qcom-6.8.0.orig/Documentation/arch/x86/boot.rst
+++ linux-qcom-6.8.0/Documentation/arch/x86/boot.rst
@@ -895,10 +895,19 @@
 
   The kernel runtime start address is determined by the following algorithm::
 
-	if (relocatable_kernel)
-	runtime_start = align_up(load_address, kernel_alignment)
-	else
-	runtime_start = pref_address
+   	if (relocatable_kernel) {
+   		if (load_address < pref_address)
+   			load_address = pref_address;
+   		runtime_start = align_up(load_address, kernel_alignment);
+   	} else {
+   		runtime_start = pref_address;
+   	}
+
+Hence the necessary memory window location and size can be estimated by
+a boot loader as::
+
+   	memory_window_start = runtime_start;
+   	memory_window_size = init_size;
 
 ============	===============
 Field name:	handover_offset
--- linux-qcom-6.8.0.orig/Documentation/block/inline-encryption.rst
+++ linux-qcom-6.8.0/Documentation/block/inline-encryption.rst
@@ -77,10 +77,10 @@
 ============
 
 We introduce ``struct blk_crypto_key`` to represent an inline encryption key and
-how it will be used.  This includes the actual bytes of the key; the size of the
-key; the algorithm and data unit size the key will be used with; and the number
-of bytes needed to represent the maximum data unit number the key will be used
-with.
+how it will be used.  This includes the type of the key (standard or
+hardware-wrapped); the actual bytes of the key; the size of the key; the
+algorithm and data unit size the key will be used with; and the number of bytes
+needed to represent the maximum data unit number the key will be used with.
 
 We introduce ``struct bio_crypt_ctx`` to represent an encryption context.  It
 contains a data unit number and a pointer to a blk_crypto_key.  We add pointers
@@ -301,3 +301,240 @@
 When the crypto API fallback is enabled, this means that all bios with and
 encryption context will use the fallback, and IO will complete as usual.  When
 the fallback is disabled, a bio with an encryption context will be failed.
+
+.. _hardware_wrapped_keys:
+
+Hardware-wrapped keys
+=====================
+
+Motivation and threat model
+---------------------------
+
+Linux storage encryption (dm-crypt, fscrypt, eCryptfs, etc.) traditionally
+relies on the raw encryption key(s) being present in kernel memory so that the
+encryption can be performed.  This traditionally isn't seen as a problem because
+the key(s) won't be present during an offline attack, which is the main type of
+attack that storage encryption is intended to protect from.
+
+However, there is an increasing desire to also protect users' data from other
+types of attacks (to the extent possible), including:
+
+- Cold boot attacks, where an attacker with physical access to a system suddenly
+  powers it off, then immediately dumps the system memory to extract recently
+  in-use encryption keys, then uses these keys to decrypt user data on-disk.
+
+- Online attacks where the attacker is able to read kernel memory without fully
+  compromising the system, followed by an offline attack where any extracted
+  keys can be used to decrypt user data on-disk.  An example of such an online
+  attack would be if the attacker is able to run some code on the system that
+  exploits a Meltdown-like vulnerability but is unable to escalate privileges.
+
+- Online attacks where the attacker fully compromises the system, but their data
+  exfiltration is significantly time-limited and/or bandwidth-limited, so in
+  order to completely exfiltrate the data they need to extract the encryption
+  keys to use in a later offline attack.
+
+Hardware-wrapped keys are a feature of inline encryption hardware that is
+designed to protect users' data from the above attacks (to the extent possible),
+without introducing limitations such as a maximum number of keys.
+
+Note that it is impossible to **fully** protect users' data from these attacks.
+Even in the attacks where the attacker "just" gets read access to kernel memory,
+they can still extract any user data that is present in memory, including
+plaintext pagecache pages of encrypted files.  The focus here is just on
+protecting the encryption keys, as those instantly give access to **all** user
+data in any following offline attack, rather than just some of it (where which
+data is included in that "some" might not be controlled by the attacker).
+
+Solution overview
+-----------------
+
+Inline encryption hardware typically has "keyslots" into which software can
+program keys for the hardware to use; the contents of keyslots typically can't
+be read back by software.  As such, the above security goals could be achieved
+if the kernel simply erased its copy of the key(s) after programming them into
+keyslot(s) and thereafter only referred to them via keyslot number.
+
+However, that naive approach runs into the problem that it limits the number of
+unlocked keys to the number of keyslots, which typically is a small number.  In
+cases where there is only one encryption key system-wide (e.g., a full-disk
+encryption key), that can be tolerable.  However, in general there can be many
+logged-in users with many different keys, and/or many running applications with
+application-specific encrypted storage areas.  This is especially true if
+file-based encryption (e.g. fscrypt) is being used.
+
+Thus, it is important for the kernel to still have a way to "remind" the
+hardware about a key, without actually having the raw key itself.  This would
+ensure that the number of hardware keyslots only limits the number of active I/O
+requests, not other things such as the number of logged-in users, the number of
+running apps, or the number of encrypted storage areas that apps can create.
+
+Somewhat less importantly, it is also desirable that the raw keys are never
+visible to software at all, even while being initially unlocked.  This would
+ensure that a read-only compromise of system memory will never allow a key to be
+extracted to be used off-system, even if it occurs when a key is being unlocked.
+
+To solve all these problems, some vendors of inline encryption hardware have
+made their hardware support *hardware-wrapped keys*.  Hardware-wrapped keys
+are encrypted keys that can only be unwrapped (decrypted) and used by hardware
+-- either by the inline encryption hardware itself, or by a dedicated hardware
+block that can directly provision keys to the inline encryption hardware.
+
+(We refer to them as "hardware-wrapped keys" rather than simply "wrapped keys"
+to add some clarity in cases where there could be other types of wrapped keys,
+such as in file-based encryption.  Key wrapping is a commonly used technique.)
+
+The key which wraps (encrypts) hardware-wrapped keys is a hardware-internal key
+that is never exposed to software; it is either a persistent key (a "long-term
+wrapping key") or a per-boot key (an "ephemeral wrapping key").  The long-term
+wrapped form of the key is what is initially unlocked, but it is erased from
+memory as soon as it is converted into an ephemerally-wrapped key.  In-use
+hardware-wrapped keys are always ephemerally-wrapped, not long-term wrapped.
+
+As inline encryption hardware can only be used to encrypt/decrypt data on-disk,
+the hardware also includes a level of indirection; it doesn't use the unwrapped
+key directly for inline encryption, but rather derives both an inline encryption
+key and a "software secret" from it.  Software can use the "software secret" for
+tasks that can't use the inline encryption hardware, such as filenames
+encryption.  The software secret is not protected from memory compromise.
+
+Key hierarchy
+-------------
+
+Here is the key hierarchy for a hardware-wrapped key::
+
+                       Hardware-wrapped key
+                                |
+                                |
+                          <Hardware KDF>
+                                |
+                  -----------------------------
+                  |                           |
+        Inline encryption key           Software secret
+
+The components are:
+
+- *Hardware-wrapped key*: a key for the hardware's KDF (Key Derivation
+  Function), in ephemerally-wrapped form.  The key wrapping algorithm is a
+  hardware implementation detail that doesn't impact kernel operation, but a
+  strong authenticated encryption algorithm such as AES-256-GCM is recommended.
+
+- *Hardware KDF*: a KDF (Key Derivation Function) which the hardware uses to
+  derive subkeys after unwrapping the wrapped key.  The hardware's choice of KDF
+  doesn't impact kernel operation, but it does need to be known for testing
+  purposes, and it's also assumed to have at least a 256-bit security strength.
+  All known hardware uses the SP800-108 KDF in Counter Mode with AES-256-CMAC,
+  with a particular choice of labels and contexts; new hardware should use this
+  already-vetted KDF.
+
+- *Inline encryption key*: a derived key which the hardware directly provisions
+  to a keyslot of the inline encryption hardware, without exposing it to
+  software.  In all known hardware, this will always be an AES-256-XTS key.
+  However, in principle other encryption algorithms could be supported too.
+  Hardware must derive distinct subkeys for each supported encryption algorithm.
+
+- *Software secret*: a derived key which the hardware returns to software so
+  that software can use it for cryptographic tasks that can't use inline
+  encryption.  This value is cryptographically isolated from the inline
+  encryption key, i.e. knowing one doesn't reveal the other.  (The KDF ensures
+  this.)  Currently, the software secret is always 32 bytes and thus is suitable
+  for cryptographic applications that require up to a 256-bit security strength.
+  Some use cases (e.g. full-disk encryption) won't require the software secret.
+
+Example: in the case of fscrypt, the fscrypt master key (the key that protects a
+particular set of encrypted directories) is made hardware-wrapped.  The inline
+encryption key is used as the file contents encryption key, while the software
+secret (rather than the master key directly) is used to key fscrypt's KDF
+(HKDF-SHA512) to derive other subkeys such as filenames encryption keys.
+
+Note that currently this design assumes a single inline encryption key per
+hardware-wrapped key, without any further key derivation.  Thus, in the case of
+fscrypt, currently hardware-wrapped keys are only compatible with the "inline
+encryption optimized" settings, which use one file contents encryption key per
+encryption policy rather than one per file.  This design could be extended to
+make the hardware derive per-file keys using per-file nonces passed down the
+storage stack, and in fact some hardware already supports this; future work is
+planned to remove this limitation by adding the corresponding kernel support.
+
+Kernel support
+--------------
+
+The inline encryption support of the kernel's block layer ("blk-crypto") has
+been extended to support hardware-wrapped keys as an alternative to standard
+keys, when hardware support is available.  This works in the following way:
+
+- A ``key_types_supported`` field is added to the crypto capabilities in
+  ``struct blk_crypto_profile``.  This allows device drivers to declare that
+  they support standard keys, hardware-wrapped keys, or both.
+
+- ``struct blk_crypto_key`` can now contain a hardware-wrapped key as an
+  alternative to a standard key; a ``key_type`` field is added to
+  ``struct blk_crypto_config`` to distinguish between the different key types.
+  This allows users of blk-crypto to en/decrypt data using a hardware-wrapped
+  key in a way very similar to using a standard key.
+
+- A new method ``blk_crypto_ll_ops::derive_sw_secret`` is added.  Device drivers
+  that support hardware-wrapped keys must implement this method.  Users of
+  blk-crypto can call ``blk_crypto_derive_sw_secret()`` to access this method.
+
+- The programming and eviction of hardware-wrapped keys happens via
+  ``blk_crypto_ll_ops::keyslot_program`` and
+  ``blk_crypto_ll_ops::keyslot_evict``, just like it does for standard keys.  If
+  a driver supports hardware-wrapped keys, then it must handle hardware-wrapped
+  keys being passed to these methods.
+
+blk-crypto-fallback doesn't support hardware-wrapped keys.  Therefore,
+hardware-wrapped keys can only be used with actual inline encryption hardware.
+
+All the above deals with hardware-wrapped keys in ephemerally-wrapped form only.
+To get such keys in the first place, new block device ioctls have been added to
+provide a generic interface to creating and preparing such keys:
+
+- ``BLKCRYPTOIMPORTKEY`` converts a raw key to long-term wrapped form.  It takes
+  in a pointer to a ``struct blk_crypto_import_key_arg``.  The caller must set
+  ``raw_key_ptr`` and ``raw_key_size`` to the pointer and size (in bytes) of the
+  raw key to import.  On success, ``BLKCRYPTOIMPORTKEY`` returns 0 and writes
+  the resulting long-term wrapped key blob to the buffer pointed to by
+  ``lt_key_ptr``, which is of maximum size ``lt_key_size``.  It also updates
+  ``lt_key_size`` to be the actual size of the key.  On failure, it returns -1
+  and sets errno.
+
+- ``BLKCRYPTOGENERATEKEY`` is like ``BLKCRYPTOIMPORTKEY``, but it has the
+  hardware generate the key instead of importing one.  It takes in a pointer to
+  a ``struct blk_crypto_generate_key_arg``.
+
+- ``BLKCRYPTOPREPAREKEY`` converts a key from long-term wrapped form to
+  ephemerally-wrapped form.  It takes in a pointer to a ``struct
+  blk_crypto_prepare_key_arg``.  The caller must set ``lt_key_ptr`` and
+  ``lt_key_size`` to the pointer and size (in bytes) of the long-term wrapped
+  key blob to convert.  On success, ``BLKCRYPTOPREPAREKEY`` returns 0 and writes
+  the resulting ephemerally-wrapped key blob to the buffer pointed to by
+  ``eph_key_ptr``, which is of maximum size ``eph_key_size``.  It also updates
+  ``eph_key_size`` to be the actual size of the key.  On failure, it returns -1
+  and sets errno.
+
+Userspace needs to use either ``BLKCRYPTOIMPORTKEY`` or ``BLKCRYPTOGENERATEKEY``
+once to create a key, and then ``BLKCRYPTOPREPAREKEY`` each time the key is
+unlocked and added to the kernel.  Note that these ioctls have no relevance for
+standard keys; they are only for hardware-wrapped keys.
+
+Testability
+-----------
+
+Both the hardware KDF and the inline encryption itself are well-defined
+algorithms that don't depend on any secrets other than the unwrapped key.
+Therefore, if the unwrapped key is known to software, these algorithms can be
+reproduced in software in order to verify the ciphertext that is written to disk
+by the inline encryption hardware.
+
+However, the unwrapped key will only be known to software for testing if the
+"import" functionality is used.  Proper testing is not possible in the
+"generate" case where the hardware generates the key itself.  The correct
+operation of the "generate" mode thus relies on the security and correctness of
+the hardware RNG and its use to generate the key, as well as the testing of the
+"import" mode as that should cover all parts other than the key generation.
+
+For an example of a test that verifies the ciphertext written to disk in the
+"import" mode, see the fscrypt hardware-wrapped key tests in xfstests, or
+`Android's vts_kernel_encryption_test
+<https://android.googlesource.com/platform/test/vts-testcase/kernel/+/refs/heads/master/encryption/>`_.
--- linux-qcom-6.8.0.orig/Documentation/bpf/map_lpm_trie.rst
+++ linux-qcom-6.8.0/Documentation/bpf/map_lpm_trie.rst
@@ -17,7 +17,7 @@
 
 LPM tries may be created with a maximum prefix length that is a multiple
 of 8, in the range from 8 to 2048. The key used for lookup and update
-operations is a ``struct bpf_lpm_trie_key``, extended by
+operations is a ``struct bpf_lpm_trie_key_u8``, extended by
 ``max_prefixlen/8`` bytes.
 
 - For IPv4 addresses the data length is 4 bytes
--- linux-qcom-6.8.0.orig/Documentation/cdrom/cdrom-standard.rst
+++ linux-qcom-6.8.0/Documentation/cdrom/cdrom-standard.rst
@@ -217,7 +217,7 @@
 		int (*media_changed)(struct cdrom_device_info *, int);
 		int (*tray_move)(struct cdrom_device_info *, int);
 		int (*lock_door)(struct cdrom_device_info *, int);
-		int (*select_speed)(struct cdrom_device_info *, int);
+		int (*select_speed)(struct cdrom_device_info *, unsigned long);
 		int (*get_last_session) (struct cdrom_device_info *,
 					 struct cdrom_multisession *);
 		int (*get_mcn)(struct cdrom_device_info *, struct cdrom_mcn *);
@@ -396,7 +396,7 @@
 
 ::
 
-	int select_speed(struct cdrom_device_info *cdi, int speed)
+	int select_speed(struct cdrom_device_info *cdi, unsigned long speed)
 
 Some CD-ROM drives are capable of changing their head-speed. There
 are several reasons for changing the speed of a CD-ROM drive. Badly
--- linux-qcom-6.8.0.orig/Documentation/cgroups/namespace.txt
+++ linux-qcom-6.8.0/Documentation/cgroups/namespace.txt
@@ -0,0 +1,142 @@
+			CGroup Namespaces
+
+CGroup Namespace provides a mechanism to virtualize the view of the
+/proc/<pid>/cgroup file. The CLONE_NEWCGROUP clone-flag can be used with
+clone() and unshare() syscalls to create a new cgroup namespace.
+The process running inside the cgroup namespace will have its /proc/<pid>/cgroup
+output restricted to cgroupns-root. cgroupns-root is the cgroup of the process
+at the time of creation of the cgroup namespace.
+
+Prior to CGroup Namespace, the /proc/<pid>/cgroup file used to show complete
+path of the cgroup of a process. In a container setup (where a set of cgroups
+and namespaces are intended to isolate processes), the /proc/<pid>/cgroup file
+may leak potential system level information to the isolated processes.
+
+For Example:
+  $ cat /proc/self/cgroup
+  0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/batchjobs/container_id1
+
+The path '/batchjobs/container_id1' can generally be considered as system-data
+and its desirable to not expose it to the isolated process.
+
+CGroup Namespaces can be used to restrict visibility of this path.
+For Example:
+  # Before creating cgroup namespace
+  $ ls -l /proc/self/ns/cgroup
+  lrwxrwxrwx 1 root root 0 2014-07-15 10:37 /proc/self/ns/cgroup -> cgroup:[4026531835]
+  $ cat /proc/self/cgroup
+  0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/batchjobs/container_id1
+
+  # unshare(CLONE_NEWCGROUP) and exec /bin/bash
+  $ ~/unshare -c
+  [ns]$ ls -l /proc/self/ns/cgroup
+  lrwxrwxrwx 1 root root 0 2014-07-15 10:35 /proc/self/ns/cgroup -> cgroup:[4026532183]
+  # From within new cgroupns, process sees that its in the root cgroup
+  [ns]$ cat /proc/self/cgroup
+  0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/
+
+  # From global cgroupns:
+  $ cat /proc/<pid>/cgroup
+  0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/batchjobs/container_id1
+
+  # Unshare cgroupns along with userns and mountns
+  # Following calls unshare(CLONE_NEWCGROUP|CLONE_NEWUSER|CLONE_NEWNS), then
+  # sets up uid/gid map and execs /bin/bash
+  $ ~/unshare -c -u -m
+  # Originally, we were in /batchjobs/container_id1 cgroup. Mount our own cgroup
+  # hierarchy.
+  [ns]$ mount -t cgroup cgroup /tmp/cgroup
+  [ns]$ ls -l /tmp/cgroup
+  total 0
+  -r--r--r-- 1 root root 0 2014-10-13 09:32 cgroup.controllers
+  -r--r--r-- 1 root root 0 2014-10-13 09:32 cgroup.populated
+  -rw-r--r-- 1 root root 0 2014-10-13 09:25 cgroup.procs
+  -rw-r--r-- 1 root root 0 2014-10-13 09:32 cgroup.subtree_control
+
+The cgroupns-root (/batchjobs/container_id1 in above example) becomes the
+filesystem root for the namespace specific cgroupfs mount.
+
+The virtualization of /proc/self/cgroup file combined with restricting
+the view of cgroup hierarchy by namespace-private cgroupfs mount
+should provide a completely isolated cgroup view inside the container.
+
+In its current form, the cgroup namespaces patcheset provides following
+behavior:
+
+(1) The 'cgroupns-root' for a cgroup namespace is the cgroup in which
+    the process calling unshare is running.
+    For ex. if a process in /batchjobs/container_id1 cgroup calls unshare,
+    cgroup /batchjobs/container_id1 becomes the cgroupns-root.
+    For the init_cgroup_ns, this is the real root ('/') cgroup
+    (identified in code as cgrp_dfl_root.cgrp).
+
+(2) The cgroupns-root cgroup does not change even if the namespace
+    creator process later moves to a different cgroup.
+    $ ~/unshare -c # unshare cgroupns in some cgroup
+    [ns]$ cat /proc/self/cgroup
+    0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/
+    [ns]$ mkdir sub_cgrp_1
+    [ns]$ echo 0 > sub_cgrp_1/cgroup.procs
+    [ns]$ cat /proc/self/cgroup
+    0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/sub_cgrp_1
+
+(3) Each process gets its CGROUPNS specific view of /proc/<pid>/cgroup
+(a) Processes running inside the cgroup namespace will be able to see
+    cgroup paths (in /proc/self/cgroup) only inside their root cgroup
+    [ns]$ sleep 100000 &  # From within unshared cgroupns
+    [1] 7353
+    [ns]$ echo 7353 > sub_cgrp_1/cgroup.procs
+    [ns]$ cat /proc/7353/cgroup
+    0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/sub_cgrp_1
+
+(b) From global cgroupns, the real cgroup path will be visible:
+    $ cat /proc/7353/cgroup
+    0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/batchjobs/container_id1/sub_cgrp_1
+
+(c) From a sibling cgroupns (cgroupns root-ed at a different cgroup), cgroup
+    path relative to its own cgroupns-root will be shown:
+    # ns2's cgroupns-root is at '/batchjobs/container_id2'
+    [ns2]$ cat /proc/7353/cgroup
+    0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/../container_id2/sub_cgrp_1
+
+    Note that the relative path always starts with '/' to indicate that its
+    relative to the cgroupns-root of the caller.
+
+(4) Processes inside a cgroupns can move in-and-out of the cgroupns-root
+    (if they have proper access to external cgroups).
+    # From inside cgroupns (with cgroupns-root at /batchjobs/container_id1), and
+    # assuming that the global hierarchy is still accessible inside cgroupns:
+    $ cat /proc/7353/cgroup
+    0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/sub_cgrp_1
+    $ echo 7353 > batchjobs/container_id2/cgroup.procs
+    $ cat /proc/7353/cgroup
+    0:cpuset,cpu,cpuacct,memory,devices,freezer,hugetlb:/../container_id2
+
+    Note that this kind of setup is not encouraged. A task inside cgroupns
+    should only be exposed to its own cgroupns hierarchy. Otherwise it makes
+    the virtualization of /proc/<pid>/cgroup less useful.
+
+(5) Setns to another cgroup namespace is allowed when:
+    (a) the process has CAP_SYS_ADMIN in its current userns
+    (b) the process has CAP_SYS_ADMIN in the target cgroupns' userns
+    No implicit cgroup changes happen with attaching to another cgroupns. It
+    is expected that the somone moves the attaching process under the target
+    cgroupns-root.
+
+(6) When some thread from a multi-threaded process unshares its
+    cgroup-namespace, the new cgroupns gets applied to the entire process (all
+    the threads). For the unified-hierarchy this is expected as it only allows
+    process-level containerization.  For the legacy hierarchies this may be
+    unexpected.  So all the threads in the process will have the same cgroup.
+
+(7) The cgroup namespace is alive as long as there is atleast 1
+    process inside it. When the last process exits, the cgroup
+    namespace is destroyed. The cgroupns-root and the actual cgroups
+    remain though.
+
+(8) Namespace specific cgroup hierarchy can be mounted by a process running
+    inside cgroupns:
+    $ mount -t cgroup -o __DEVEL__sane_behavior cgroup $MOUNT_POINT
+
+    This will mount the unified cgroup hierarchy with cgroupns-root as the
+    filesystem root. The process needs CAP_SYS_ADMIN in its userns and mntns.
--- linux-qcom-6.8.0.orig/Documentation/conf.py
+++ linux-qcom-6.8.0/Documentation/conf.py
@@ -75,6 +75,8 @@
             "__rcu",
             "__user",
             "__force",
+            "__counted_by_le",
+            "__counted_by_be",
 
             # include/linux/compiler_attributes.h:
             "__alias",
@@ -346,9 +348,9 @@
 html_static_path = ['sphinx-static']
 
 # If true, Docutils "smart quotes" will be used to convert quotes and dashes
-# to typographically correct entities.  This will convert "--" to "—",
-# which is not always what we want, so disable it.
-smartquotes = False
+# to typographically correct entities.  However, conversion of "--" to "—"
+# is not always what we want, so enable only quotes.
+smartquotes_action = 'q'
 
 # Custom sidebar templates, maps document names to template names.
 # Note that the RTD theme ignores this
--- linux-qcom-6.8.0.orig/Documentation/dev-tools/kselftest.rst
+++ linux-qcom-6.8.0/Documentation/dev-tools/kselftest.rst
@@ -255,9 +255,21 @@
 
    TEST_PROGS_EXTENDED, TEST_GEN_PROGS_EXTENDED mean it is the
    executable which is not tested by default.
+
    TEST_FILES, TEST_GEN_FILES mean it is the file which is used by
    test.
 
+   TEST_INCLUDES is similar to TEST_FILES, it lists files which should be
+   included when exporting or installing the tests, with the following
+   differences:
+
+    * symlinks to files in other directories are preserved
+    * the part of paths below tools/testing/selftests/ is preserved when
+      copying the files to the output directory
+
+   TEST_INCLUDES is meant to list dependencies located in other directories of
+   the selftests hierarchy.
+
  * First use the headers inside the kernel source and/or git repo, and then the
    system headers.  Headers for the kernel release as opposed to headers
    installed by the distro on the system should be the primary focus to be able
--- linux-qcom-6.8.0.orig/Documentation/dev-tools/ubsan.rst
+++ linux-qcom-6.8.0/Documentation/dev-tools/ubsan.rst
@@ -49,34 +49,22 @@
 Usage
 -----
 
-To enable UBSAN configure kernel with::
+To enable UBSAN, configure the kernel with::
 
-	CONFIG_UBSAN=y
+  CONFIG_UBSAN=y
 
-and to check the entire kernel::
-
-        CONFIG_UBSAN_SANITIZE_ALL=y
-
-To enable instrumentation for specific files or directories, add a line
-similar to the following to the respective kernel Makefile:
-
-- For a single file (e.g. main.o)::
-
-    UBSAN_SANITIZE_main.o := y
-
-- For all files in one directory::
-
-    UBSAN_SANITIZE := y
-
-To exclude files from being instrumented even if
-``CONFIG_UBSAN_SANITIZE_ALL=y``, use::
+To exclude files from being instrumented use::
 
   UBSAN_SANITIZE_main.o := n
 
-and::
+and to exclude all targets in one directory use::
 
   UBSAN_SANITIZE := n
 
+When disabled for all targets, specific files can be enabled using::
+
+  UBSAN_SANITIZE_main.o := y
+
 Detection of unaligned accesses controlled through the separate option -
 CONFIG_UBSAN_ALIGNMENT. It's off by default on architectures that support
 unaligned accesses (CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y). One could
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/cache/qcom,llcc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/cache/qcom,llcc.yaml
@@ -38,11 +38,11 @@
 
   reg:
     minItems: 2
-    maxItems: 9
+    maxItems: 10
 
   reg-names:
     minItems: 2
-    maxItems: 9
+    maxItems: 10
 
   interrupts:
     maxItems: 1
@@ -66,7 +66,6 @@
         compatible:
           contains:
             enum:
-              - qcom,qdu1000-llcc
               - qcom,sc7180-llcc
               - qcom,sm6350-llcc
     then:
@@ -104,8 +103,39 @@
         compatible:
           contains:
             enum:
+              - qcom,qdu1000-llcc
               - qcom,sc8180x-llcc
               - qcom,sc8280xp-llcc
+    then:
+      properties:
+        reg:
+          items:
+            - description: LLCC0 base register region
+            - description: LLCC1 base register region
+            - description: LLCC2 base register region
+            - description: LLCC3 base register region
+            - description: LLCC4 base register region
+            - description: LLCC5 base register region
+            - description: LLCC6 base register region
+            - description: LLCC7 base register region
+            - description: LLCC broadcast base register region
+        reg-names:
+          items:
+            - const: llcc0_base
+            - const: llcc1_base
+            - const: llcc2_base
+            - const: llcc3_base
+            - const: llcc4_base
+            - const: llcc5_base
+            - const: llcc6_base
+            - const: llcc7_base
+            - const: llcc_broadcast_base
+
+  - if:
+      properties:
+        compatible:
+          contains:
+            enum:
               - qcom,x1e80100-llcc
     then:
       properties:
@@ -120,6 +150,7 @@
             - description: LLCC6 base register region
             - description: LLCC7 base register region
             - description: LLCC broadcast base register region
+            - description: LLCC broadcast AND register region
         reg-names:
           items:
             - const: llcc0_base
@@ -131,6 +162,7 @@
             - const: llcc6_base
             - const: llcc7_base
             - const: llcc_broadcast_base
+            - const: llcc_broadcast_and_base
 
   - if:
       properties:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml
@@ -26,9 +26,21 @@
     description:
       Specifies the reference clock(s) from which the output frequency is
       derived. This must either reference one clock if only the first clock
-      input is connected or two if both clock inputs are connected.
-    minItems: 1
-    maxItems: 2
+      input is connected or two if both clock inputs are connected. The last
+      clock is the AXI bus clock that needs to be enabled so we can access the
+      core registers.
+    minItems: 2
+    maxItems: 3
+
+  clock-names:
+    oneOf:
+      - items:
+          - const: clkin1
+          - const: s_axi_aclk
+      - items:
+          - const: clkin1
+          - const: clkin2
+          - const: s_axi_aclk
 
   '#clock-cells':
     const: 0
@@ -40,6 +52,7 @@
   - compatible
   - reg
   - clocks
+  - clock-names
   - '#clock-cells'
 
 additionalProperties: false
@@ -50,5 +63,6 @@
       compatible = "adi,axi-clkgen-2.00.a";
       #clock-cells = <0>;
       reg = <0xff000000 0x1000>;
-      clocks = <&osc 1>;
+      clocks = <&osc 1>, <&clkc 15>;
+      clock-names = "clkin1", "s_axi_aclk";
     };
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,gpucc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,gpucc.yaml
@@ -27,6 +27,7 @@
 properties:
   compatible:
     enum:
+      - qcom,qcs8300-gpucc
       - qcom,sdm845-gpucc
       - qcom,sa8775p-gpucc
       - qcom,sc7180-gpucc
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,qcs615-camcc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,qcs615-camcc.yaml
@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/qcom,qcs615-camcc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Camera Clock & Reset Controller on QCS615
+
+maintainers:
+  - Taniya Das <quic_tdas@quicinc.com>
+
+description: |
+  Qualcomm camera clock control module provides the clocks, resets and power
+  domains on QCS615
+
+  See also: include/dt-bindings/clock/qcom,qcs615-camcc.h
+
+properties:
+  compatible:
+    const: qcom,qcs615-camcc
+
+  reg:
+    maxItems: 1
+
+  clocks:
+    items:
+      - description: Board XO source
+
+required:
+  - compatible
+  - reg
+  - clocks
+  - '#clock-cells'
+  - '#reset-cells'
+  - '#power-domain-cells'
+
+allOf:
+  - $ref: qcom,gcc.yaml#
+
+unevaluatedProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/qcom,rpmh.h>
+    clock-controller@ad00000 {
+      compatible = "qcom,qcs615-camcc";
+      reg = <0xad00000 0x10000>;
+      clocks = <&rpmhcc RPMH_CXO_CLK>;
+
+      #clock-cells = <1>;
+      #reset-cells = <1>;
+      #power-domain-cells = <1>;
+    };
+...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,qcs615-dispcc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,qcs615-dispcc.yaml
@@ -0,0 +1,72 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/qcom,qcs615-dispcc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Display Clock & Reset Controller on QCS615
+
+maintainers:
+  - Ajit Pandey <quic_ajipan@quicinc.com>
+  - Taniya Das <quic_tdas@quicinc.com>
+
+description: |
+  Qualcomm display clock control module provides the clocks, resets and power
+  domains on QCS615
+
+  See also: include/dt-bindings/clock/qcom,qcs615-dispcc.h
+
+properties:
+  compatible:
+    const: qcom,qcs615-dispcc
+
+  reg:
+    maxItems: 1
+
+  clocks:
+    items:
+      - description: Board XO source
+      - description: GPLL0 clock source from GCC
+      - description: Byte clock from DSI PHY0
+      - description: Pixel clock from DSI PHY0
+      - description: Pixel clock from DSI PHY1
+      - description: Display port PLL link clock
+      - description: Display port PLL VCO DIV clock
+
+  '#clock-cells':
+    const: 1
+
+  '#reset-cells':
+    const: 1
+
+  '#power-domain-cells':
+    const: 1
+
+required:
+  - compatible
+  - reg
+  - clocks
+  - '#clock-cells'
+  - '#reset-cells'
+  - '#power-domain-cells'
+
+additionalProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/qcom,rpmh.h>
+    clock-controller@af00000 {
+      compatible = "qcom,qcs615-dispcc";
+      reg = <0x0af00000 0x20000>;
+      clocks = <&rpmhcc RPMH_CXO_CLK>,
+               <&gcc GCC_DISP_GPLL0_DIV_CLK_SRC>,
+               <&mdss_dsi0_phy 0>,
+               <&mdss_dsi0_phy 1>,
+               <&mdss_dsi1_phy 0>,
+               <&mdss_dp_phy   0>,
+               <&mdss_dp_vco   0>;
+      #clock-cells = <1>;
+      #reset-cells = <1>;
+      #power-domain-cells = <1>;
+    };
+...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,qcs615-gcc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,qcs615-gcc.yaml
@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/qcom,qcs615-gcc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Global Clock & Reset Controller on QCS615
+
+maintainers:
+  - Taniya Das <quic_tdas@quicinc.com>
+
+description: |
+  Qualcomm global clock control module provides the clocks, resets and power
+  domains on QCS615.
+
+  See also: include/dt-bindings/clock/qcom,qcs615-gcc.h
+
+properties:
+  compatible:
+    const: qcom,qcs615-gcc
+
+  clocks:
+    items:
+      - description: Board XO source
+      - description: Board active XO source
+      - description: Sleep clock source
+
+  clock-names:
+    items:
+      - const: bi_tcxo
+      - const: bi_tcxo_ao
+      - const: sleep_clk
+
+required:
+  - compatible
+  - clocks
+  - clock-names
+  - '#power-domain-cells'
+
+allOf:
+  - $ref: qcom,gcc.yaml#
+
+unevaluatedProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/qcom,rpmh.h>
+    clock-controller@100000 {
+      compatible = "qcom,qcs615-gcc";
+      reg = <0x00100000 0x1f0000>;
+      clocks = <&rpmhcc RPMH_CXO_CLK>,
+               <&rpmhcc RPMH_CXO_CLK_A>,
+               <&sleep_clk>;
+      clock-names = "bi_tcxo", "bi_tcxo_ao", "sleep_clk";
+      #clock-cells = <1>;
+      #reset-cells = <1>;
+      #power-domain-cells = <1>;
+    };
+...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,qcs615-gpucc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,qcs615-gpucc.yaml
@@ -0,0 +1,65 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/qcom,qcs615-gpucc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Graphics Clock & Reset Controller on QCS615
+
+maintainers:
+  - Taniya Das <quic_tdas@quicinc.com>
+
+description: |
+  Qualcomm graphics clock control module provides clocks, resets and power
+  domains on QCS615 Qualcomm SoCs.
+
+  See also: include/dt-bindings/clock/qcom,qcs615-gpucc.h
+
+properties:
+  compatible:
+    const: qcom,qcs615-gpucc
+
+  reg:
+    maxItems: 1
+
+  clocks:
+    items:
+      - description: Board XO source
+      - description: GPLL0 main branch source
+      - description: GPLL0 GPUCC div branch source
+
+  '#clock-cells':
+    const: 1
+
+  '#reset-cells':
+    const: 1
+
+  '#power-domain-cells':
+    const: 1
+
+required:
+  - compatible
+  - reg
+  - clocks
+  - '#clock-cells'
+  - '#reset-cells'
+  - '#power-domain-cells'
+
+additionalProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/qcom,rpmh.h>
+
+    clock-controller@5090000 {
+      compatible = "qcom,qcs615-gpucc";
+      reg = <0x5090000 0x9000>;
+      clocks = <&rpmhcc RPMH_CXO_CLK>,
+               <&gcc    GPLL0>,
+               <&gcc    GCC_GPU_GPLL0_DIV_CLK_SRC>;
+
+      #clock-cells = <1>;
+      #reset-cells = <1>;
+      #power-domain-cells = <1>;
+    };
+...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,qcs615-videocc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,qcs615-videocc.yaml
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/qcom,qcs615-videocc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Video Clock & Reset Controller on QCS615
+
+maintainers:
+  - Taniya Das <quic_tdas@quicinc.com>
+
+description: |
+  Qualcomm video clock control module provides clocks, resets and power
+  domains on QCS615 Qualcomm SoCs.
+
+  See also: include/dt-bindings/clock/qcom,qcs615-videocc.h
+
+properties:
+  compatible:
+    const: qcom,qcs615-videocc
+
+  reg:
+    maxItems: 1
+
+  clocks:
+    items:
+      - description: Board XO source
+      - description: Sleep clock source
+
+  '#clock-cells':
+    const: 1
+
+  '#reset-cells':
+    const: 1
+
+  '#power-domain-cells':
+    const: 1
+
+required:
+  - compatible
+  - reg
+  - clocks
+  - '#clock-cells'
+  - '#reset-cells'
+  - '#power-domain-cells'
+
+additionalProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/qcom,rpmh.h>
+
+    clock-controller@ab00000 {
+      compatible = "qcom,qcs615-videocc";
+      reg = <0xab00000 0x10000>;
+      clocks = <&rpmhcc RPMH_CXO_CLK>,
+               <&sleep_clk>;
+
+      #clock-cells = <1>;
+      #reset-cells = <1>;
+      #power-domain-cells = <1>;
+    };
+...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,qcs8300-gcc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,qcs8300-gcc.yaml
@@ -0,0 +1,66 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/qcom,qcs8300-gcc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Technologies, Inc. Global Clock & Reset Controller on QCS8300
+
+maintainers:
+  - Taniya Das <quic_tdas@quicinc.com>
+  - Imran Shaik <quic_imrashai@quicinc.com>
+
+description: |
+  Qualcomm Technologies, Inc. Global clock control module provides the clocks, resets and
+  power domains on QCS8300
+
+  See also: include/dt-bindings/clock/qcom,qcs8300-gcc.h
+
+properties:
+  compatible:
+    const: qcom,qcs8300-gcc
+
+  clocks:
+    items:
+      - description: Board XO source
+      - description: Sleep clock source
+      - description: PCIE 0 Pipe clock source
+      - description: PCIE 1 Pipe clock source
+      - description: PCIE Phy Auxiliary clock source
+      - description: First EMAC controller reference clock
+      - description: UFS Phy Rx symbol 0 clock source
+      - description: UFS Phy Rx symbol 1 clock source
+      - description: UFS Phy Tx symbol 0 clock source
+      - description: USB3 Phy wrapper pipe clock source
+
+required:
+  - compatible
+  - clocks
+  - '#power-domain-cells'
+
+allOf:
+  - $ref: qcom,gcc.yaml#
+
+unevaluatedProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/qcom,rpmh.h>
+    clock-controller@100000 {
+      compatible = "qcom,qcs8300-gcc";
+      reg = <0x00100000 0xc7018>;
+      clocks = <&rpmhcc RPMH_CXO_CLK>,
+               <&sleep_clk>,
+               <&pcie_0_pipe_clk>,
+               <&pcie_1_pipe_clk>,
+               <&pcie_phy_aux_clk>,
+               <&rxc0_ref_clk>,
+               <&ufs_phy_rx_symbol_0_clk>,
+               <&ufs_phy_rx_symbol_1_clk>,
+               <&ufs_phy_tx_symbol_0_clk>,
+               <&usb3_phy_wrapper_gcc_usb30_prim_pipe_clk>;
+      #clock-cells = <1>;
+      #reset-cells = <1>;
+      #power-domain-cells = <1>;
+    };
+...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,sa8775p-camcc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,sa8775p-camcc.yaml
@@ -0,0 +1,84 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/qcom,sa8775p-camcc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Technologies, Inc. Camera Clock & Reset Controller on SA8775P
+
+maintainers:
+  - Taniya Das <quic_tdas@quicinc.com>
+
+description: |
+  Qualcomm Technologies, Inc. camera clock control module provides the clocks, resets and power
+  domains on SA8775p.
+
+  See also::
+    include/dt-bindings/clock/qcom,sa8775p-camcc.h
+
+properties:
+  compatible:
+    enum:
+      - qcom,qcs8300-camcc
+      - qcom,sa8775p-camcc
+
+  clocks:
+    items:
+      - description: Camera AHB clock from GCC
+      - description: Board XO source
+      - description: Board active XO source
+      - description: Sleep clock source
+
+  power-domains:
+    maxItems: 1
+    description:
+      A phandle and PM domain specifier for the MMCX power domain.
+
+  required-opps:
+    maxItems: 1
+    description:
+      A phandle to an OPP node describing required MMCX performance point.
+
+  '#clock-cells':
+    const: 1
+
+  '#reset-cells':
+    const: 1
+
+  '#power-domain-cells':
+    const: 1
+
+  reg:
+    maxItems: 1
+
+required:
+  - compatible
+  - reg
+  - clocks
+  - power-domains
+  - required-opps
+  - '#clock-cells'
+  - '#reset-cells'
+  - '#power-domain-cells'
+
+additionalProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/qcom,rpmh.h>
+    #include <dt-bindings/power/qcom-rpmpd.h>
+    #include <dt-bindings/clock/qcom,sa8775p-gcc.h>
+    clock-controller@ade0000 {
+      compatible = "qcom,sa8775p-camcc";
+      reg = <0x0ade0000 0x20000>;
+      clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+               <&rpmhcc RPMH_CXO_CLK>,
+               <&rpmhcc RPMH_CXO_CLK_A>,
+               <&sleep_clk>;
+      power-domains = <&rpmhpd SA8775P_MMCX>;
+      required-opps = <&rpmhpd_opp_low_svs>;
+      #clock-cells = <1>;
+      #reset-cells = <1>;
+      #power-domain-cells = <1>;
+    };
+...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,sa8775p-dispcc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,sa8775p-dispcc.yaml
@@ -0,0 +1,93 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/qcom,dispcc-sa8775p.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Technologies, Inc. Display Clock & Reset Controller on SA8775P
+
+maintainers:
+  - Taniya Das <quic_tdas@quicinc.com>
+
+description: |
+  Qualcomm Technologies, Inc. display clock control module provides the clocks, resets and power
+  domains on SA8775P.
+
+  See also:: include/dt-bindings/clock/qcom,sa8775p-dispcc.h
+
+properties:
+  compatible:
+    const: qcom,sa8775p-dispcc0
+    const: qcom,sa8775p-dispcc1
+
+  clocks:
+    items:
+      - description: GCC AHB clock source
+      - description: Board XO source
+      - description: Board XO_AO source
+      - description: Sleep clock source
+      - description: Link clock from DP0 PHY
+      - description: VCO DIV clock from DP0 PHY
+      - description: Link clock from DP1 PHY
+      - description: VCO DIV clock from DP1 PHY
+      - description: Byte clock from DSI0 PHY
+      - description: Pixel clock from DSI0 PHY
+      - description: Byte clock from DSI1 PHY
+      - description: Pixel clock from DSI1 PHY
+
+  '#clock-cells':
+    const: 1
+
+  '#reset-cells':
+    const: 1
+
+  '#power-domain-cells':
+    const: 1
+
+  reg:
+    maxItems: 1
+
+  power-domains:
+    description:
+      A phandle and PM domain specifier for the MMCX power domain.
+    maxItems: 1
+
+  required-opps:
+    description:
+      A phandle to an OPP node describing required MMCX performance point.
+    maxItems: 1
+
+required:
+  - compatible
+  - reg
+  - clocks
+  - '#clock-cells'
+  - '#reset-cells'
+  - '#power-domain-cells'
+
+additionalProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/qcom,rpmh.h>
+    #include <dt-bindings/power/qcom-rpmpd.h>
+    #include <dt-bindings/clock/qcom,sa8755p-gcc.h>
+    clock-controller@af00000 {
+      compatible = "qcom,sa8755p-dispcc0";
+      reg = <0x0af00000 0x20000>;
+      clocks = <&gcc GCC_DISP_AHB_CLK>,
+               <&rpmhcc RPMH_CXO_CLK>,
+               <&rpmhcc RPMH_CXO_CLK_A>,
+               <&sleep_clk>,
+               <0>, <0>, <0>, <0>,
+               <&dsi_phy0 0>,
+               <&dsi_phy0 1>
+               <&dsi_phy1 2>,
+               <&dsi_phy1 3>;
+      power-domains = <&rpmhpd SA8775P_MMCX>;
+      required-opps = <&rpmhpd_opp_low_svs>;
+      #clock-cells = <1>;
+      #reset-cells = <1>;
+      #power-domain-cells = <1>;
+    };
+...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/clock/qcom,sa8775p-videocc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/clock/qcom,sa8775p-videocc.yaml
@@ -0,0 +1,82 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/clock/qcom,sa8775p-videocc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Technologies, Inc. Video Clock & Reset Controller on SA8775P
+
+maintainers:
+  - Taniya Das <quic_tdas@quicinc.com>
+
+description: |
+  Qualcomm Technologies, Inc. video clock control module provides the clocks, resets and power
+  domains on SA8775P.
+
+  See also:: include/dt-bindings/clock/qcom,sa8775p-videocc.h
+
+properties:
+  compatible:
+    enum:
+      - qcom,sa8775p-videocc
+
+  reg:
+    maxItems: 1
+
+  clocks:
+    items:
+      - description: Video AHB clock from GCC
+      - description: Board XO source
+      - description: Board active XO source
+      - description: Sleep Clock source
+
+  power-domains:
+    maxItems: 1
+    description:
+      MMCX power domain.
+
+  required-opps:
+    maxItems: 1
+    description:
+      A phandle to an OPP node describing required MMCX performance point.
+
+  '#clock-cells':
+    const: 1
+
+  '#reset-cells':
+    const: 1
+
+  '#power-domain-cells':
+    const: 1
+
+required:
+  - compatible
+  - reg
+  - clocks
+  - power-domains
+  - required-opps
+  - '#clock-cells'
+  - '#reset-cells'
+  - '#power-domain-cells'
+
+additionalProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/qcom,rpmh.h>
+    #include <dt-bindings/power/qcom-rpmpd.h>
+    #include <dt-bindings/clock/qcom,sa8775p-gcc.h>
+    videocc: clock-controller@abf0000 {
+      compatible = "qcom,sa8775p-videocc";
+      reg = <0x0abf0000 0x10000>;
+      clocks = <&gcc GCC_VIDEO_AHB_CLK>,
+               <&rpmhcc RPMH_CXO_CLK>,
+               <&rpmhcc RPMH_CXO_CLK_A>,
+               <&sleep_clk>;
+      power-domains = <&rpmhpd SA8775P_MMCX>;
+      required-opps = <&rpmhpd_opp_low_svs>;
+      #clock-cells = <1>;
+      #reset-cells = <1>;
+      #power-domain-cells = <1>;
+    };
+...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml
@@ -90,7 +90,7 @@
   adi,dsi-lanes:
     description: Number of DSI data lanes connected to the DSI host.
     $ref: /schemas/types.yaml#/definitions/uint32
-    enum: [ 1, 2, 3, 4 ]
+    enum: [ 2, 3, 4 ]
 
   "#sound-dai-cells":
     const: 0
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/display/msm/qcom,mdss.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/display/msm/qcom,mdss.yaml
@@ -127,6 +127,7 @@
           - qcom,dsi-phy-20nm
           - qcom,dsi-phy-28nm-8226
           - qcom,dsi-phy-28nm-hpm
+          - qcom,dsi-phy-28nm-hpm-fam-b
           - qcom,dsi-phy-28nm-lp
           - qcom,hdmi-phy-8084
           - qcom,hdmi-phy-8660
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/display/msm/qcom,sm8150-mdss.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/display/msm/qcom,sm8150-mdss.yaml
@@ -53,6 +53,15 @@
       compatible:
         const: qcom,sm8150-dpu
 
+  "^displayport-controller@[0-9a-f]+$":
+    type: object
+    additionalProperties: true
+
+    properties:
+      compatible:
+        contains:
+          const: qcom,sm8150-dp
+
   "^dsi@[0-9a-f]+$":
     type: object
     additionalProperties: true
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/dma/fsl,edma.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/dma/fsl,edma.yaml
@@ -47,8 +47,8 @@
       - 3
 
   dma-channels:
-    minItems: 1
-    maxItems: 64
+    minimum: 1
+    maximum: 64
 
   clocks:
     minItems: 1
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/eeprom/at24.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/eeprom/at24.yaml
@@ -69,14 +69,10 @@
               - items:
                   pattern: c32$
               - items:
-                  pattern: c32d-wl$
-              - items:
                   pattern: cs32$
               - items:
                   pattern: c64$
               - items:
-                  pattern: c64d-wl$
-              - items:
                   pattern: cs64$
               - items:
                   pattern: c128$
@@ -136,6 +132,7 @@
               - renesas,r1ex24128
               - samsung,s524ad0xd1
           - const: atmel,24c128
+      - pattern: '^atmel,24c(32|64)d-wl$' # Actual vendor is st
 
   label:
     description: Descriptive name of the EEPROM.
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/i2c/atmel,at91sam-i2c.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/i2c/atmel,at91sam-i2c.yaml
@@ -75,7 +75,7 @@
   - clocks
 
 allOf:
-  - $ref: i2c-controller.yaml
+  - $ref: /schemas/i2c/i2c-controller.yaml#
   - if:
       properties:
         compatible:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/i2c/google,cros-ec-i2c-tunnel.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/i2c/google,cros-ec-i2c-tunnel.yaml
@@ -21,7 +21,7 @@
   google,cros-ec-spi or google,cros-ec-i2c.
 
 allOf:
-  - $ref: i2c-controller.yaml#
+  - $ref: /schemas/i2c/i2c-controller.yaml#
 
 properties:
   compatible:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/iio/adc/adi,axi-adc.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/iio/adc/adi,axi-adc.yaml
@@ -28,6 +28,9 @@
   reg:
     maxItems: 1
 
+  clocks:
+    maxItems: 1
+
   dmas:
     maxItems: 1
 
@@ -39,12 +42,16 @@
     $ref: /schemas/types.yaml#/definitions/phandle
     description:
       A reference to a the actual ADC to which this FPGA ADC interfaces to.
+    deprecated: true
+
+  '#io-backend-cells':
+    const: 0
 
 required:
   - compatible
   - dmas
   - reg
-  - adi,adc-dev
+  - clocks
 
 additionalProperties: false
 
@@ -55,7 +62,7 @@
         reg = <0x44a00000 0x10000>;
         dmas = <&rx_dma 0>;
         dma-names = "rx";
-
-        adi,adc-dev = <&spi_adc>;
+        clocks = <&axi_clk>;
+        #io-backend-cells = <0>;
     };
 ...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/iio/dac/adi,ad3552r.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/iio/dac/adi,ad3552r.yaml
@@ -26,7 +26,7 @@
     maxItems: 1
 
   spi-max-frequency:
-    maximum: 30000000
+    maximum: 66000000
 
   reset-gpios:
     maxItems: 1
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/iio/health/maxim,max30102.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/iio/health/maxim,max30102.yaml
@@ -42,7 +42,7 @@
       properties:
         compatible:
           contains:
-            const: maxim,max30100
+            const: maxim,max30102
     then:
       properties:
         maxim,green-led-current-microamp: false
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/iio/magnetometer/asahi-kasei,ak8975.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/iio/magnetometer/asahi-kasei,ak8975.yaml
@@ -23,7 +23,6 @@
           - ak8963
           - ak09911
           - ak09912
-          - ak09916
         deprecated: true
 
   reg:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/interconnect/qcom,qcs615-rpmh.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/interconnect/qcom,qcs615-rpmh.yaml
@@ -0,0 +1,73 @@
+# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/interconnect/qcom,qcs615-rpmh.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm RPMh Network-On-Chip Interconnect on QCS615
+
+maintainers:
+  - Raviteja Laggyshetty <quic_rlaggysh@quicinc.com>
+
+description: |
+  RPMh interconnect providers support system bandwidth requirements through
+  RPMh hardware accelerators known as Bus Clock Manager (BCM). The provider is
+  able to communicate with the BCM through the Resource State Coordinator (RSC)
+  associated with each execution environment. Provider nodes must point to at
+  least one RPMh device child node pertaining to their RSC and each provider
+  can map to multiple RPMh resources.
+
+  See also: include/dt-bindings/interconnect/qcom,qcs615-rpmh.h
+
+properties:
+  compatible:
+    enum:
+      - qcom,qcs615-aggre1-noc
+      - qcom,qcs615-camnoc-virt
+      - qcom,qcs615-config-noc
+      - qcom,qcs615-dc-noc
+      - qcom,qcs615-gem-noc
+      - qcom,qcs615-ipa-virt
+      - qcom,qcs615-mc-virt
+      - qcom,qcs615-mmss-noc
+      - qcom,qcs615-system-noc
+
+  reg:
+    maxItems: 1
+
+required:
+  - compatible
+
+allOf:
+  - $ref: qcom,rpmh-common.yaml#
+  - if:
+      properties:
+        compatible:
+          contains:
+            enum:
+              - qcom,qcs615-camnoc-virt
+              - qcom,qcs615-ipa-virt
+              - qcom,qcs615-mc-virt
+    then:
+      properties:
+        reg: false
+    else:
+      required:
+        - reg
+
+unevaluatedProperties: false
+
+examples:
+  - |
+    gem_noc: interconnect@9680000 {
+        compatible = "qcom,qcs615-gem-noc";
+        reg = <0x9680000 0x3e200>;
+        #interconnect-cells = <2>;
+        qcom,bcm-voters = <&apps_bcm_voter>;
+    };
+
+    mc_virt: interconnect-2 {
+        compatible = "qcom,qcs615-mc-virt";
+        #interconnect-cells = <2>;
+        qcom,bcm-voters = <&apps_bcm_voter>;
+    };
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/interconnect/qcom,qcs8300-rpmh.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/interconnect/qcom,qcs8300-rpmh.yaml
@@ -0,0 +1,50 @@
+# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/interconnect/qcom,qcs8300-rpmh.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Technologies, Inc. RPMh Network-On-Chip Interconnect on QCS8300
+
+maintainers:
+  - Bjorn Andersson <andersson@kernel.org>
+  - Konrad Dybcio <konrad.dybcio@linaro.org>
+
+description: |
+  RPMh interconnect providers support system bandwidth requirements through
+  RPMh hardware accelerators known as Bus Clock Manager (BCM).
+
+  See also:: include/dt-bindings/interconnect/qcom,qcs8300.h
+
+properties:
+  compatible:
+    enum:
+      - qcom,qcs8300-aggre1-noc
+      - qcom,qcs8300-aggre2-noc
+      - qcom,qcs8300-clk-virt
+      - qcom,qcs8300-config-noc
+      - qcom,qcs8300-dc-noc
+      - qcom,qcs8300-gem-noc
+      - qcom,qcs8300-gpdsp-anoc
+      - qcom,qcs8300-lpass-ag-noc
+      - qcom,qcs8300-mc-virt
+      - qcom,qcs8300-mmss-noc
+      - qcom,qcs8300-nspa-noc
+      - qcom,qcs8300-pcie-anoc
+      - qcom,qcs8300-system-noc
+
+  reg:
+    maxItems: 1
+
+required:
+  - compatible
+
+unevaluatedProperties: false
+
+examples:
+  - |
+    gem_noc: interconnect-gem-noc {
+        compatible = "qcom,qcs8300-gem-noc";
+        #interconnect-cells = <2>;
+        qcom,bcm-voters = <&apps_bcm_voter>;
+    };
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/iommu/arm,smmu.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/iommu/arm,smmu.yaml
@@ -484,7 +484,12 @@
   - if:
       properties:
         compatible:
-          const: qcom,sm8450-smmu-500
+          items:
+            - const: qcom,sm8450-smmu-500
+            - const: qcom,adreno-smmu
+            - const: qcom,smmu-500
+            - const: arm,mmu-500
+
     then:
       properties:
         clock-names:
@@ -508,7 +513,11 @@
   - if:
       properties:
         compatible:
-          const: qcom,sm8550-smmu-500
+          items:
+            - const: qcom,sm8550-smmu-500
+            - const: qcom,adreno-smmu
+            - const: qcom,smmu-500
+            - const: arm,mmu-500
     then:
       properties:
         clock-names:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml
@@ -37,15 +37,15 @@
       active low.
     maxItems: 1
 
-  dovdd-supply:
+  DOVDD-supply:
     description:
       Definition of the regulator used as interface power supply.
 
-  avdd-supply:
+  AVDD-supply:
     description:
       Definition of the regulator used as analog power supply.
 
-  dvdd-supply:
+  DVDD-supply:
     description:
       Definition of the regulator used as digital power supply.
 
@@ -59,9 +59,9 @@
   - reg
   - clocks
   - clock-names
-  - dovdd-supply
-  - avdd-supply
-  - dvdd-supply
+  - DOVDD-supply
+  - AVDD-supply
+  - DVDD-supply
   - reset-gpios
   - port
 
@@ -82,9 +82,9 @@
                 clock-names = "xvclk";
                 reset-gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
 
-                dovdd-supply = <&sw2_reg>;
-                dvdd-supply = <&sw2_reg>;
-                avdd-supply = <&reg_peri_3p15v>;
+                DOVDD-supply = <&sw2_reg>;
+                DVDD-supply = <&sw2_reg>;
+                AVDD-supply = <&reg_peri_3p15v>;
 
                 port {
                         ov2680_to_mipi: endpoint {
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/media/i2c/techwell,tw9900.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/media/i2c/techwell,tw9900.yaml
@@ -36,7 +36,7 @@
 
     properties:
       port@0:
-        $ref: /schemas/graph.yaml#/$defs/port-base
+        $ref: /schemas/graph.yaml#/properties/port
         description: Analog input port
 
         properties:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/net/fsl,fec.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/net/fsl,fec.yaml
@@ -183,6 +183,13 @@
     description:
       Register bits of stop mode control, the format is <&gpr req_gpr req_bit>.
 
+  fsl,pps-channel:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    default: 0
+    description:
+      Specifies to which timer instance the PPS signal is routed.
+    enum: [0, 1, 2, 3]
+
   mdio:
     $ref: mdio.yaml#
     unevaluatedProperties: false
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/net/mediatek,net.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/net/mediatek,net.yaml
@@ -337,8 +337,8 @@
           minItems: 4
 
         clocks:
-          minItems: 34
-          maxItems: 34
+          minItems: 24
+          maxItems: 24
 
         clock-names:
           items:
@@ -351,18 +351,6 @@
             - const: ethwarp_wocpu1
             - const: ethwarp_wocpu0
             - const: esw
-            - const: netsys0
-            - const: netsys1
-            - const: sgmii_tx250m
-            - const: sgmii_rx250m
-            - const: sgmii2_tx250m
-            - const: sgmii2_rx250m
-            - const: top_usxgmii0_sel
-            - const: top_usxgmii1_sel
-            - const: top_sgm0_sel
-            - const: top_sgm1_sel
-            - const: top_xfi_phy0_xtal_sel
-            - const: top_xfi_phy1_xtal_sel
             - const: top_eth_gmii_sel
             - const: top_eth_refck_50m_sel
             - const: top_eth_sys_200m_sel
@@ -375,16 +363,10 @@
             - const: top_netsys_sync_250m_sel
             - const: top_netsys_ppefb_250m_sel
             - const: top_netsys_warp_sel
-            - const: wocpu1
-            - const: wocpu0
             - const: xgp1
             - const: xgp2
             - const: xgp3
 
-        mediatek,sgmiisys:
-          minItems: 2
-          maxItems: 2
-
 patternProperties:
   "^mac@[0-1]$":
     type: object
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml
@@ -34,6 +34,7 @@
       and length of the AXI DMA controller IO space, unless
       axistream-connected is specified, in which case the reg
       attribute of the node referenced by it is used.
+    minItems: 1
     maxItems: 2
 
   interrupts:
@@ -60,7 +61,7 @@
       - gmii
       - rgmii
       - sgmii
-      - 1000BaseX
+      - 1000base-x
 
   xlnx,phy-type:
     description:
@@ -181,7 +182,7 @@
         clock-names = "s_axi_lite_clk", "axis_clk", "ref_clk", "mgt_clk";
         clocks = <&axi_clk>, <&axi_clk>, <&pl_enet_ref_clk>, <&mgt_clk>;
         phy-mode = "mii";
-        reg = <0x00 0x40000000 0x00 0x40000>;
+        reg = <0x40000000 0x40000>;
         xlnx,rxcsum = <0x2>;
         xlnx,rxmem = <0x800>;
         xlnx,txcsum = <0x2>;
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/pci/rcar-pci-host.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/pci/rcar-pci-host.yaml
@@ -77,6 +77,9 @@
   vpcie12v-supply:
     description: The 12v regulator to use for PCIe.
 
+  iommu-map: true
+  iommu-map-mask: true
+
 required:
   - compatible
   - reg
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/pci/rockchip,rk3399-pcie.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/pci/rockchip,rk3399-pcie.yaml
@@ -37,6 +37,7 @@
     description: This property is needed if using 24MHz OSC for RC's PHY.
 
   ep-gpios:
+    maxItems: 1
     description: pre-reset GPIO
 
   vpcie12v-supply:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/phy/qcom,sc8280xp-qmp-ufs-phy.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/phy/qcom,sc8280xp-qmp-ufs-phy.yaml
@@ -73,7 +73,6 @@
   - reg
   - clocks
   - clock-names
-  - power-domains
   - resets
   - reset-names
   - vdda-phy-supply
@@ -134,6 +133,21 @@
         clock-names:
           maxItems: 1
 
+  - if:
+      properties:
+        compatible:
+          contains:
+            enum:
+              - qcom,msm8996-qmp-ufs-phy
+              - qcom,msm8998-qmp-ufs-phy
+    then:
+      properties:
+        power-domains:
+          false
+    else:
+      required:
+        - power-domains
+
 additionalProperties: false
 
 examples:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/phy/qcom,usb-snps-femto-v2.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/phy/qcom,usb-snps-femto-v2.yaml
@@ -15,9 +15,6 @@
 properties:
   compatible:
     oneOf:
-      - enum:
-          - qcom,sc8180x-usb-hs-phy
-          - qcom,usb-snps-femto-v2-phy
       - items:
           - enum:
               - qcom,sa8775p-usb-hs-phy
@@ -26,6 +23,7 @@
       - items:
           - enum:
               - qcom,sc7280-usb-hs-phy
+              - qcom,sc8180x-usb-hs-phy
               - qcom,sdx55-usb-hs-phy
               - qcom,sdx65-usb-hs-phy
               - qcom,sm6375-usb-hs-phy
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/pinctrl/mediatek,mt7622-pinctrl.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/pinctrl/mediatek,mt7622-pinctrl.yaml
@@ -97,7 +97,8 @@
             then:
               properties:
                 groups:
-                  enum: [emmc, emmc_rst]
+                  items:
+                    enum: [emmc, emmc_rst]
           - if:
               properties:
                 function:
@@ -105,8 +106,9 @@
             then:
               properties:
                 groups:
-                  enum: [esw, esw_p0_p1, esw_p2_p3_p4, rgmii_via_esw,
-                         rgmii_via_gmac1, rgmii_via_gmac2, mdc_mdio]
+                  items:
+                    enum: [esw, esw_p0_p1, esw_p2_p3_p4, rgmii_via_esw,
+                           rgmii_via_gmac1, rgmii_via_gmac2, mdc_mdio]
           - if:
               properties:
                 function:
@@ -123,10 +125,11 @@
             then:
               properties:
                 groups:
-                  enum: [i2s_in_mclk_bclk_ws, i2s1_in_data, i2s2_in_data,
-                         i2s3_in_data, i2s4_in_data, i2s_out_mclk_bclk_ws,
-                         i2s1_out_data, i2s2_out_data, i2s3_out_data,
-                         i2s4_out_data]
+                  items:
+                    enum: [i2s_in_mclk_bclk_ws, i2s1_in_data, i2s2_in_data,
+                           i2s3_in_data, i2s4_in_data, i2s_out_mclk_bclk_ws,
+                           i2s1_out_data, i2s2_out_data, i2s3_out_data,
+                           i2s4_out_data]
           - if:
               properties:
                 function:
@@ -159,10 +162,11 @@
             then:
               properties:
                 groups:
-                  enum: [pcie0_0_waken, pcie0_1_waken, pcie1_0_waken,
-                         pcie0_0_clkreq, pcie0_1_clkreq, pcie1_0_clkreq,
-                         pcie0_pad_perst, pcie1_pad_perst, pcie_pereset,
-                         pcie_wake, pcie_clkreq]
+                  items:
+                    enum: [pcie0_0_waken, pcie0_1_waken, pcie1_0_waken,
+                           pcie0_0_clkreq, pcie0_1_clkreq, pcie1_0_clkreq,
+                           pcie0_pad_perst, pcie1_pad_perst, pcie_pereset,
+                           pcie_wake, pcie_clkreq]
           - if:
               properties:
                 function:
@@ -178,11 +182,12 @@
             then:
               properties:
                 groups:
-                  enum: [pwm_ch1_0, pwm_ch1_1, pwm_ch1_2, pwm_ch2_0, pwm_ch2_1,
-                         pwm_ch2_2, pwm_ch3_0, pwm_ch3_1, pwm_ch3_2, pwm_ch4_0,
-                         pwm_ch4_1, pwm_ch4_2, pwm_ch4_3, pwm_ch5_0, pwm_ch5_1,
-                         pwm_ch5_2, pwm_ch6_0, pwm_ch6_1, pwm_ch6_2, pwm_ch6_3,
-                         pwm_ch7_0, pwm_0, pwm_1]
+                  items:
+                    enum: [pwm_ch1_0, pwm_ch1_1, pwm_ch1_2, pwm_ch2_0, pwm_ch2_1,
+                           pwm_ch2_2, pwm_ch3_0, pwm_ch3_1, pwm_ch3_2, pwm_ch4_0,
+                           pwm_ch4_1, pwm_ch4_2, pwm_ch4_3, pwm_ch5_0, pwm_ch5_1,
+                           pwm_ch5_2, pwm_ch6_0, pwm_ch6_1, pwm_ch6_2, pwm_ch6_3,
+                           pwm_ch7_0, pwm_0, pwm_1]
           - if:
               properties:
                 function:
@@ -260,33 +265,34 @@
           pins:
             description:
               An array of strings. Each string contains the name of a pin.
-            enum: [GPIO_A, I2S1_IN, I2S1_OUT, I2S_BCLK, I2S_WS, I2S_MCLK, TXD0,
-                   RXD0, SPI_WP, SPI_HOLD, SPI_CLK, SPI_MOSI, SPI_MISO, SPI_CS,
-                   I2C_SDA, I2C_SCL, I2S2_IN, I2S3_IN, I2S4_IN, I2S2_OUT,
-                   I2S3_OUT, I2S4_OUT, GPIO_B, MDC, MDIO, G2_TXD0, G2_TXD1,
-                   G2_TXD2, G2_TXD3, G2_TXEN, G2_TXC, G2_RXD0, G2_RXD1, G2_RXD2,
-                   G2_RXD3, G2_RXDV, G2_RXC, NCEB, NWEB, NREB, NDL4, NDL5, NDL6,
-                   NDL7, NRB, NCLE, NALE, NDL0, NDL1, NDL2, NDL3, MDI_TP_P0,
-                   MDI_TN_P0, MDI_RP_P0, MDI_RN_P0, MDI_TP_P1, MDI_TN_P1,
-                   MDI_RP_P1, MDI_RN_P1, MDI_RP_P2, MDI_RN_P2, MDI_TP_P2,
-                   MDI_TN_P2, MDI_TP_P3, MDI_TN_P3, MDI_RP_P3, MDI_RN_P3,
-                   MDI_RP_P4, MDI_RN_P4, MDI_TP_P4, MDI_TN_P4, PMIC_SCL,
-                   PMIC_SDA, SPIC1_CLK, SPIC1_MOSI, SPIC1_MISO, SPIC1_CS,
-                   GPIO_D, WATCHDOG, RTS3_N, CTS3_N, TXD3, RXD3, PERST0_N,
-                   PERST1_N, WLED_N, EPHY_LED0_N, AUXIN0, AUXIN1, AUXIN2,
-                   AUXIN3, TXD4, RXD4, RTS4_N, CST4_N, PWM1, PWM2, PWM3, PWM4,
-                   PWM5, PWM6, PWM7, GPIO_E, TOP_5G_CLK, TOP_5G_DATA,
-                   WF0_5G_HB0, WF0_5G_HB1, WF0_5G_HB2, WF0_5G_HB3, WF0_5G_HB4,
-                   WF0_5G_HB5, WF0_5G_HB6, XO_REQ, TOP_RST_N, SYS_WATCHDOG,
-                   EPHY_LED0_N_JTDO, EPHY_LED1_N_JTDI, EPHY_LED2_N_JTMS,
-                   EPHY_LED3_N_JTCLK, EPHY_LED4_N_JTRST_N, WF2G_LED_N,
-                   WF5G_LED_N, GPIO_9, GPIO_10, GPIO_11, GPIO_12, UART1_TXD,
-                   UART1_RXD, UART1_CTS, UART1_RTS, UART2_TXD, UART2_RXD,
-                   UART2_CTS, UART2_RTS, SMI_MDC, SMI_MDIO, PCIE_PERESET_N,
-                   PWM_0, GPIO_0, GPIO_1, GPIO_2, GPIO_3, GPIO_4, GPIO_5,
-                   GPIO_6, GPIO_7, GPIO_8, UART0_TXD, UART0_RXD, TOP_2G_CLK,
-                   TOP_2G_DATA, WF0_2G_HB0, WF0_2G_HB1, WF0_2G_HB2, WF0_2G_HB3,
-                   WF0_2G_HB4, WF0_2G_HB5, WF0_2G_HB6]
+            items:
+              enum: [GPIO_A, I2S1_IN, I2S1_OUT, I2S_BCLK, I2S_WS, I2S_MCLK, TXD0,
+                     RXD0, SPI_WP, SPI_HOLD, SPI_CLK, SPI_MOSI, SPI_MISO, SPI_CS,
+                     I2C_SDA, I2C_SCL, I2S2_IN, I2S3_IN, I2S4_IN, I2S2_OUT,
+                     I2S3_OUT, I2S4_OUT, GPIO_B, MDC, MDIO, G2_TXD0, G2_TXD1,
+                     G2_TXD2, G2_TXD3, G2_TXEN, G2_TXC, G2_RXD0, G2_RXD1, G2_RXD2,
+                     G2_RXD3, G2_RXDV, G2_RXC, NCEB, NWEB, NREB, NDL4, NDL5, NDL6,
+                     NDL7, NRB, NCLE, NALE, NDL0, NDL1, NDL2, NDL3, MDI_TP_P0,
+                     MDI_TN_P0, MDI_RP_P0, MDI_RN_P0, MDI_TP_P1, MDI_TN_P1,
+                     MDI_RP_P1, MDI_RN_P1, MDI_RP_P2, MDI_RN_P2, MDI_TP_P2,
+                     MDI_TN_P2, MDI_TP_P3, MDI_TN_P3, MDI_RP_P3, MDI_RN_P3,
+                     MDI_RP_P4, MDI_RN_P4, MDI_TP_P4, MDI_TN_P4, PMIC_SCL,
+                     PMIC_SDA, SPIC1_CLK, SPIC1_MOSI, SPIC1_MISO, SPIC1_CS,
+                     GPIO_D, WATCHDOG, RTS3_N, CTS3_N, TXD3, RXD3, PERST0_N,
+                     PERST1_N, WLED_N, EPHY_LED0_N, AUXIN0, AUXIN1, AUXIN2,
+                     AUXIN3, TXD4, RXD4, RTS4_N, CST4_N, PWM1, PWM2, PWM3, PWM4,
+                     PWM5, PWM6, PWM7, GPIO_E, TOP_5G_CLK, TOP_5G_DATA,
+                     WF0_5G_HB0, WF0_5G_HB1, WF0_5G_HB2, WF0_5G_HB3, WF0_5G_HB4,
+                     WF0_5G_HB5, WF0_5G_HB6, XO_REQ, TOP_RST_N, SYS_WATCHDOG,
+                     EPHY_LED0_N_JTDO, EPHY_LED1_N_JTDI, EPHY_LED2_N_JTMS,
+                     EPHY_LED3_N_JTCLK, EPHY_LED4_N_JTRST_N, WF2G_LED_N,
+                     WF5G_LED_N, GPIO_9, GPIO_10, GPIO_11, GPIO_12, UART1_TXD,
+                     UART1_RXD, UART1_CTS, UART1_RTS, UART2_TXD, UART2_RXD,
+                     UART2_CTS, UART2_RTS, SMI_MDC, SMI_MDIO, PCIE_PERESET_N,
+                     PWM_0, GPIO_0, GPIO_1, GPIO_2, GPIO_3, GPIO_4, GPIO_5,
+                     GPIO_6, GPIO_7, GPIO_8, UART0_TXD, UART0_RXD, TOP_2G_CLK,
+                     TOP_2G_DATA, WF0_2G_HB0, WF0_2G_HB1, WF0_2G_HB2, WF0_2G_HB3,
+                     WF0_2G_HB4, WF0_2G_HB5, WF0_2G_HB6]
 
           bias-disable: true
 
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/pinctrl/qcom,sm4450-tlmm.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/pinctrl/qcom,sm4450-tlmm.yaml
@@ -72,40 +72,24 @@
         description:
           Specify the alternative function to be configured for the specified
           pins.
-        enum: [ gpio, atest_char, atest_char0, atest_char1, atest_char2,
-                atest_char3, atest_usb0, atest_usb00, atest_usb01, atest_usb02,
-                atest_usb03, audio_ref, cam_mclk, cci_async, cci_i2c,
-                cci_timer0, cci_timer1, cci_timer2, cci_timer3, cci_timer4,
-                cmu_rng0, cmu_rng1, cmu_rng2, cmu_rng3, coex_uart1, cri_trng,
-                cri_trng0, cri_trng1, dbg_out, ddr_bist, ddr_pxi0, ddr_pxi1,
-                dp0_hot, gcc_gp1, gcc_gp2, gcc_gp3, host2wlan_sol, ibi_i3c,
-                jitter_bist, mdp_vsync, mdp_vsync0, mdp_vsync1, mdp_vsync2,
-                mdp_vsync3, mi2s0_data0, mi2s0_data1, mi2s0_sck, mi2s0_ws,
-                mi2s2_data0, mi2s2_data1, mi2s2_sck, mi2s2_ws, mi2s_mclk0,
-                mi2s_mclk1, nav_gpio0, nav_gpio1, nav_gpio2, pcie0_clk,
-                phase_flag0, phase_flag1, phase_flag10, phase_flag11,
-                phase_flag12, phase_flag13, phase_flag14, phase_flag15,
-                phase_flag16, phase_flag17, phase_flag18, phase_flag19,
-                phase_flag2, phase_flag20, phase_flag21, phase_flag22,
-                phase_flag23, phase_flag24, phase_flag25, phase_flag26,
-                phase_flag27, phase_flag28, phase_flag29, phase_flag3,
-                phase_flag30, phase_flag31, phase_flag4, phase_flag5,
-                phase_flag6, phase_flag7, phase_flag8, phase_flag9,
-                pll_bist, pll_clk, prng_rosc0, prng_rosc1, prng_rosc2,
-                prng_rosc3, qdss_cti, qdss_gpio, qdss_gpio0, qdss_gpio1,
-                qdss_gpio10, qdss_gpio11, qdss_gpio12, qdss_gpio13, qdss_gpio14,
-                qdss_gpio15, qdss_gpio2, qdss_gpio3, qdss_gpio4, qdss_gpio5,
-                qdss_gpio6, qdss_gpio7, qdss_gpio8, qdss_gpio9, qlink0_enable,
-                qlink0_request, qlink0_wmss, qlink1_enable, qlink1_request,
-                qlink1_wmss, qlink2_enable, qlink2_request, qlink2_wmss,
-                qup0_se0, qup0_se1, qup0_se2, qup0_se3, qup0_se4, qup0_se5,
-                qup0_se6, qup0_se7, qup1_se0, qup1_se1, qup1_se2, qup1_se3,
-                qup1_se4, qup1_se5, qup1_se6, sd_write, tb_trig, tgu_ch0,
-                tgu_ch1, tgu_ch2, tgu_ch3, tmess_prng0, tmess_prng1,
-                tmess_prng2, tmess_prng3, tsense_pwm1, tsense_pwm2, uim0_clk,
-                uim0_data, uim0_present, uim0_reset, uim1_clk, uim1_data,
-                uim1_present, uim1_reset, usb0_hs, usb0_phy, vfr_0, vfr_1,
-                vsense_trigger ]
+        enum: [ gpio, atest_char, atest_usb0, audio_ref_clk, cam_mclk,
+                cci_async_in0, cci_i2c, cci, cmu_rng, coex_uart1_rx,
+                coex_uart1_tx, cri_trng, dbg_out_clk, ddr_bist,
+                ddr_pxi0_test, ddr_pxi1_test, gcc_gp1_clk, gcc_gp2_clk,
+                gcc_gp3_clk, host2wlan_sol, ibi_i3c_qup0, ibi_i3c_qup1,
+                jitter_bist_ref, mdp_vsync0_out, mdp_vsync1_out,
+                mdp_vsync2_out, mdp_vsync3_out, mdp_vsync, nav,
+                pcie0_clk_req, phase_flag, pll_bist_sync, pll_clk_aux,
+                prng_rosc, qdss_cti_trig0, qdss_cti_trig1, qdss_gpio,
+                qlink0_enable, qlink0_request, qlink0_wmss_reset,
+                qup0_se0, qup0_se1, qup0_se2, qup0_se3, qup0_se4,
+                qup1_se0, qup1_se1, qup1_se2, qup1_se2_l2, qup1_se3,
+                qup1_se4, sd_write_protect, tb_trig_sdc1, tb_trig_sdc2,
+                tgu_ch0_trigout, tgu_ch1_trigout, tgu_ch2_trigout,
+                tgu_ch3_trigout, tmess_prng, tsense_pwm1_out,
+                tsense_pwm2_out, uim0, uim1, usb0_hs_ac, usb0_phy_ps,
+                vfr_0_mira, vfr_0_mirb, vfr_1, vsense_trigger_mirnat,
+                wlan1_adc_dtest0, wlan1_adc_dtest1 ]
 
         required:
           - pins
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/pinctrl/samsung,pinctrl-wakeup-interrupt.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/pinctrl/samsung,pinctrl-wakeup-interrupt.yaml
@@ -91,14 +91,17 @@
   - if:
       properties:
         compatible:
-          # Match without "contains", to skip newer variants which are still
-          # compatible with samsung,exynos7-wakeup-eint
-          enum:
-            - samsung,s5pv210-wakeup-eint
-            - samsung,exynos4210-wakeup-eint
-            - samsung,exynos5433-wakeup-eint
-            - samsung,exynos7-wakeup-eint
-            - samsung,exynos7885-wakeup-eint
+          oneOf:
+            # Match without "contains", to skip newer variants which are still
+            # compatible with samsung,exynos7-wakeup-eint
+            - enum:
+                - samsung,exynos4210-wakeup-eint
+                - samsung,exynos7-wakeup-eint
+                - samsung,s5pv210-wakeup-eint
+            - contains:
+                enum:
+                  - samsung,exynos5433-wakeup-eint
+                  - samsung,exynos7885-wakeup-eint
     then:
       properties:
         interrupts:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/serial/rs485.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/serial/rs485.yaml
@@ -18,16 +18,15 @@
     description: prop-encoded-array <a b>
     $ref: /schemas/types.yaml#/definitions/uint32-array
     items:
-      items:
-        - description: Delay between rts signal and beginning of data sent in
-            milliseconds. It corresponds to the delay before sending data.
-          default: 0
-          maximum: 100
-        - description: Delay between end of data sent and rts signal in milliseconds.
-            It corresponds to the delay after sending data and actual release
-            of the line.
-          default: 0
-          maximum: 100
+      - description: Delay between rts signal and beginning of data sent in
+          milliseconds. It corresponds to the delay before sending data.
+        default: 0
+        maximum: 100
+      - description: Delay between end of data sent and rts signal in milliseconds.
+          It corresponds to the delay after sending data and actual release
+          of the line.
+        default: 0
+        maximum: 100
 
   rs485-rts-active-high:
     description: drive RTS high when sending (this is the default).
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/soc/rockchip/grf.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/soc/rockchip/grf.yaml
@@ -165,6 +165,7 @@
           unevaluatedProperties: false
 
         pcie-phy:
+          type: object
           description:
             Documentation/devicetree/bindings/phy/rockchip-pcie-phy.txt
 
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml
@@ -102,21 +102,21 @@
     default: 2
 
   interrupts:
-    anyOf:
-      - minItems: 1
-        items:
-          - description: TX interrupt
-          - description: RX interrupt
-      - items:
-          - description: common/combined interrupt
+    minItems: 1
+    maxItems: 2
 
   interrupt-names:
     oneOf:
-      - minItems: 1
+      - description: TX interrupt
+        const: tx
+      - description: RX interrupt
+        const: rx
+      - description: TX and RX interrupts
         items:
           - const: tx
           - const: rx
-      - const: common
+      - description: Common/combined interrupt
+        const: common
 
   fck_parent:
     $ref: /schemas/types.yaml#/definitions/string
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/sound/mt6359.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/sound/mt6359.yaml
@@ -23,8 +23,8 @@
       Indicates how many data pins are used to transmit two channels of PDM
       signal. 0 means two wires, 1 means one wire. Default value is 0.
     enum:
-      - 0 # one wire
-      - 1 # two wires
+      - 0 # two wires
+      - 1 # one wire
 
   mediatek,mic-type-0:
     $ref: /schemas/types.yaml#/definitions/uint32
@@ -53,9 +53,9 @@
 
 examples:
   - |
-    mt6359codec: mt6359codec {
-      mediatek,dmic-mode = <0>;
-      mediatek,mic-type-0 = <2>;
+    mt6359codec: audio-codec {
+        mediatek,dmic-mode = <0>;
+        mediatek,mic-type-0 = <2>;
     };
 
 ...
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/sound/rt5645.txt
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/sound/rt5645.txt
@@ -20,6 +20,11 @@
   a GPIO spec for the external headphone detect pin. If jd-mode = 0,
   we will get the JD status by getting the value of hp-detect-gpios.
 
+- cbj-sleeve-gpios:
+  a GPIO spec to control the external combo jack circuit to tie the sleeve/ring2
+  contacts to the ground or floating. It could avoid some electric noise from the
+  active speaker jacks.
+
 - realtek,in2-differential
   Boolean. Indicate MIC2 input are differential, rather than single-ended.
 
@@ -68,6 +73,7 @@
 	compatible = "realtek,rt5650";
 	reg = <0x1a>;
 	hp-detect-gpios = <&gpio 19 0>;
+	cbj-sleeve-gpios = <&gpio 20 0>;
 	interrupt-parent = <&gpio>;
 	interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
 	realtek,dmic-en = "true";
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/spi/spi-nxp-fspi.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/spi/spi-nxp-fspi.yaml
@@ -15,12 +15,19 @@
 
 properties:
   compatible:
-    enum:
-      - nxp,imx8dxl-fspi
-      - nxp,imx8mm-fspi
-      - nxp,imx8mp-fspi
-      - nxp,imx8qxp-fspi
-      - nxp,lx2160a-fspi
+    oneOf:
+      - enum:
+          - nxp,imx8dxl-fspi
+          - nxp,imx8mm-fspi
+          - nxp,imx8mp-fspi
+          - nxp,imx8qxp-fspi
+          - nxp,imx8ulp-fspi
+          - nxp,lx2160a-fspi
+      - items:
+          - enum:
+              - nxp,imx93-fspi
+              - nxp,imx95-fspi
+          - const: nxp,imx8mm-fspi
 
   reg:
     items:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/spmi/hisilicon,hisi-spmi-controller.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/spmi/hisilicon,hisi-spmi-controller.yaml
@@ -14,7 +14,7 @@
   It is a MIPI System Power Management (SPMI) controller.
 
   The PMIC part is provided by
-  ./Documentation/devicetree/bindings/mfd/hisilicon,hi6421-spmi-pmic.yaml.
+  Documentation/devicetree/bindings/mfd/hisilicon,hi6421-spmi-pmic.yaml.
 
 allOf:
   - $ref: spmi.yaml#
@@ -48,7 +48,7 @@
       PMIC properties, which are specific to the used SPMI PMIC device(s).
       When used in combination with HiSilicon 6421v600, the properties
       are documented at
-      drivers/staging/hikey9xx/hisilicon,hi6421-spmi-pmic.yaml.
+      Documentation/devicetree/bindings/mfd/hisilicon,hi6421-spmi-pmic.yaml
 
 unevaluatedProperties: false
 
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml
@@ -18,13 +18,15 @@
     oneOf:
       - enum:
           - loongson,ls2k1000-thermal
+          - loongson,ls2k2000-thermal
       - items:
           - enum:
-              - loongson,ls2k2000-thermal
+              - loongson,ls2k0500-thermal
           - const: loongson,ls2k1000-thermal
 
   reg:
-    maxItems: 1
+    minItems: 1
+    maxItems: 2
 
   interrupts:
     maxItems: 1
@@ -38,6 +40,24 @@
   - interrupts
   - '#thermal-sensor-cells'
 
+if:
+  properties:
+    compatible:
+      contains:
+        enum:
+          - loongson,ls2k2000-thermal
+
+then:
+  properties:
+    reg:
+      minItems: 2
+      maxItems: 2
+
+else:
+  properties:
+    reg:
+      maxItems: 1
+
 unevaluatedProperties: false
 
 examples:
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/thermal/thermal-zones.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/thermal/thermal-zones.yaml
@@ -49,7 +49,10 @@
       to take when the temperature crosses those thresholds.
 
 patternProperties:
-  "^[a-zA-Z][a-zA-Z0-9\\-]{1,12}-thermal$":
+  # Node name is limited in size due to Linux kernel requirements - 19
+  # characters in total (see THERMAL_NAME_LENGTH, including terminating NUL
+  # byte):
+  "^[a-zA-Z][a-zA-Z0-9\\-]{1,10}-thermal$":
     type: object
     description:
       Each thermal zone node contains information about how frequently it
--- linux-qcom-6.8.0.orig/Documentation/devicetree/bindings/vendor-prefixes.yaml
+++ linux-qcom-6.8.0/Documentation/devicetree/bindings/vendor-prefixes.yaml
@@ -957,6 +957,8 @@
     description: National Semiconductor
   "^nec,.*":
     description: NEC LCD Technologies, Ltd.
+  "^neofidelity,.*":
+    description: Neofidelity Inc.
   "^neonode,.*":
     description: Neonode Inc.
   "^netgear,.*":
--- linux-qcom-6.8.0.orig/Documentation/driver-api/dpll.rst
+++ linux-qcom-6.8.0/Documentation/driver-api/dpll.rst
@@ -214,6 +214,27 @@
 divided with ``DPLL_PIN_PHASE_OFFSET_DIVIDER`` to get integer part and
 modulo divided to get fractional part.
 
+Embedded SYNC
+=============
+
+Device may provide ability to use Embedded SYNC feature. It allows
+to embed additional SYNC signal into the base frequency of a pin - a one
+special pulse of base frequency signal every time SYNC signal pulse
+happens. The user can configure the frequency of Embedded SYNC.
+The Embedded SYNC capability is always related to a given base frequency
+and HW capabilities. The user is provided a range of Embedded SYNC
+frequencies supported, depending on current base frequency configured for
+the pin.
+
+  ========================================= =================================
+  ``DPLL_A_PIN_ESYNC_FREQUENCY``            current Embedded SYNC frequency
+  ``DPLL_A_PIN_ESYNC_FREQUENCY_SUPPORTED``  nest available Embedded SYNC
+                                            frequency ranges
+    ``DPLL_A_PIN_FREQUENCY_MIN``            attr minimum value of frequency
+    ``DPLL_A_PIN_FREQUENCY_MAX``            attr maximum value of frequency
+  ``DPLL_A_PIN_ESYNC_PULSE``                pulse type of Embedded SYNC
+  ========================================= =================================
+
 Configuration commands group
 ============================
 
--- linux-qcom-6.8.0.orig/Documentation/driver-api/fpga/fpga-bridge.rst
+++ linux-qcom-6.8.0/Documentation/driver-api/fpga/fpga-bridge.rst
@@ -6,9 +6,12 @@
 
 * struct fpga_bridge - The FPGA Bridge structure
 * struct fpga_bridge_ops - Low level Bridge driver ops
-* fpga_bridge_register() - Create and register a bridge
+* __fpga_bridge_register() - Create and register a bridge
 * fpga_bridge_unregister() - Unregister a bridge
 
+The helper macro ``fpga_bridge_register()`` automatically sets
+the module that registers the FPGA bridge as the owner.
+
 .. kernel-doc:: include/linux/fpga/fpga-bridge.h
    :functions: fpga_bridge
 
@@ -16,7 +19,7 @@
    :functions: fpga_bridge_ops
 
 .. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: fpga_bridge_register
+   :functions: __fpga_bridge_register
 
 .. kernel-doc:: drivers/fpga/fpga-bridge.c
    :functions: fpga_bridge_unregister
--- linux-qcom-6.8.0.orig/Documentation/driver-api/fpga/fpga-mgr.rst
+++ linux-qcom-6.8.0/Documentation/driver-api/fpga/fpga-mgr.rst
@@ -24,7 +24,8 @@
 --------------------------------
 
 To add another FPGA manager, write a driver that implements a set of ops.  The
-probe function calls fpga_mgr_register() or fpga_mgr_register_full(), such as::
+probe function calls ``fpga_mgr_register()`` or ``fpga_mgr_register_full()``,
+such as::
 
 	static const struct fpga_manager_ops socfpga_fpga_ops = {
 		.write_init = socfpga_fpga_ops_configure_init,
@@ -69,10 +70,11 @@
 	}
 
 Alternatively, the probe function could call one of the resource managed
-register functions, devm_fpga_mgr_register() or devm_fpga_mgr_register_full().
-When these functions are used, the parameter syntax is the same, but the call
-to fpga_mgr_unregister() should be removed. In the above example, the
-socfpga_fpga_remove() function would not be required.
+register functions, ``devm_fpga_mgr_register()`` or
+``devm_fpga_mgr_register_full()``.  When these functions are used, the
+parameter syntax is the same, but the call to ``fpga_mgr_unregister()`` should be
+removed. In the above example, the ``socfpga_fpga_remove()`` function would not be
+required.
 
 The ops will implement whatever device specific register writes are needed to
 do the programming sequence for this particular FPGA.  These ops return 0 for
@@ -125,15 +127,19 @@
 * struct fpga_manager -  the FPGA manager struct
 * struct fpga_manager_ops -  Low level FPGA manager driver ops
 * struct fpga_manager_info -  Parameter structure for fpga_mgr_register_full()
-* fpga_mgr_register_full() -  Create and register an FPGA manager using the
+* __fpga_mgr_register_full() -  Create and register an FPGA manager using the
   fpga_mgr_info structure to provide the full flexibility of options
-* fpga_mgr_register() -  Create and register an FPGA manager using standard
+* __fpga_mgr_register() -  Create and register an FPGA manager using standard
   arguments
-* devm_fpga_mgr_register_full() -  Resource managed version of
-  fpga_mgr_register_full()
-* devm_fpga_mgr_register() -  Resource managed version of fpga_mgr_register()
+* __devm_fpga_mgr_register_full() -  Resource managed version of
+  __fpga_mgr_register_full()
+* __devm_fpga_mgr_register() -  Resource managed version of __fpga_mgr_register()
 * fpga_mgr_unregister() -  Unregister an FPGA manager
 
+Helper macros ``fpga_mgr_register_full()``, ``fpga_mgr_register()``,
+``devm_fpga_mgr_register_full()``, and ``devm_fpga_mgr_register()`` are available
+to ease the registration.
+
 .. kernel-doc:: include/linux/fpga/fpga-mgr.h
    :functions: fpga_mgr_states
 
@@ -147,16 +153,16 @@
    :functions: fpga_manager_info
 
 .. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_mgr_register_full
+   :functions: __fpga_mgr_register_full
 
 .. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_mgr_register
+   :functions: __fpga_mgr_register
 
 .. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: devm_fpga_mgr_register_full
+   :functions: __devm_fpga_mgr_register_full
 
 .. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: devm_fpga_mgr_register
+   :functions: __devm_fpga_mgr_register
 
 .. kernel-doc:: drivers/fpga/fpga-mgr.c
    :functions: fpga_mgr_unregister
--- linux-qcom-6.8.0.orig/Documentation/driver-api/fpga/fpga-region.rst
+++ linux-qcom-6.8.0/Documentation/driver-api/fpga/fpga-region.rst
@@ -46,13 +46,16 @@
 ----------------------------
 
 * struct fpga_region - The FPGA region struct
-* struct fpga_region_info - Parameter structure for fpga_region_register_full()
-* fpga_region_register_full() -  Create and register an FPGA region using the
+* struct fpga_region_info - Parameter structure for __fpga_region_register_full()
+* __fpga_region_register_full() -  Create and register an FPGA region using the
   fpga_region_info structure to provide the full flexibility of options
-* fpga_region_register() -  Create and register an FPGA region using standard
+* __fpga_region_register() -  Create and register an FPGA region using standard
   arguments
 * fpga_region_unregister() -  Unregister an FPGA region
 
+Helper macros ``fpga_region_register()`` and ``fpga_region_register_full()``
+automatically set the module that registers the FPGA region as the owner.
+
 The FPGA region's probe function will need to get a reference to the FPGA
 Manager it will be using to do the programming.  This usually would happen
 during the region's probe function.
@@ -82,10 +85,10 @@
    :functions: fpga_region_info
 
 .. kernel-doc:: drivers/fpga/fpga-region.c
-   :functions: fpga_region_register_full
+   :functions: __fpga_region_register_full
 
 .. kernel-doc:: drivers/fpga/fpga-region.c
-   :functions: fpga_region_register
+   :functions: __fpga_region_register
 
 .. kernel-doc:: drivers/fpga/fpga-region.c
    :functions: fpga_region_unregister
--- linux-qcom-6.8.0.orig/Documentation/driver-api/ipmi.rst
+++ linux-qcom-6.8.0/Documentation/driver-api/ipmi.rst
@@ -540,7 +540,7 @@
 	alerts_broken
 
 The addresses are normal I2C addresses.  The adapter is the string
-name of the adapter, as shown in /sys/class/i2c-adapter/i2c-<n>/name.
+name of the adapter, as shown in /sys/bus/i2c/devices/i2c-<n>/name.
 It is *NOT* i2c-<n> itself.  Also, the comparison is done ignoring
 spaces, so if the name is "This is an I2C chip" you can say
 adapter_name=ThisisanI2cchip.  This is because it's hard to pass in
--- linux-qcom-6.8.0.orig/Documentation/driver-api/soundwire/stream.rst
+++ linux-qcom-6.8.0/Documentation/driver-api/soundwire/stream.rst
@@ -324,12 +324,12 @@
 
   int sdw_stream_add_master(struct sdw_bus * bus,
 		struct sdw_stream_config * stream_config,
-		struct sdw_ports_config * ports_config,
+		const struct sdw_ports_config * ports_config,
 		struct sdw_stream_runtime * stream);
 
   int sdw_stream_add_slave(struct sdw_slave * slave,
 		struct sdw_stream_config * stream_config,
-		struct sdw_ports_config * ports_config,
+		const struct sdw_ports_config * ports_config,
 		struct sdw_stream_runtime * stream);
 
 
--- linux-qcom-6.8.0.orig/Documentation/filesystems/f2fs.rst
+++ linux-qcom-6.8.0/Documentation/filesystems/f2fs.rst
@@ -126,9 +126,7 @@
 discard/nodiscard	 Enable/disable real-time discard in f2fs, if discard is
 			 enabled, f2fs will issue discard/TRIM commands when a
 			 segment is cleaned.
-no_heap			 Disable heap-style segment allocation which finds free
-			 segments for data from the beginning of main area, while
-			 for node from the end of main area.
+heap/no_heap		 Deprecated.
 nouser_xattr		 Disable Extended User Attributes. Note: xattr is enabled
 			 by default if CONFIG_F2FS_FS_XATTR is selected.
 noacl			 Disable POSIX Access Control List. Note: acl is enabled
@@ -228,8 +226,6 @@
 			 option for more randomness.
 			 Please, use these options for your experiments and we strongly
 			 recommend to re-format the filesystem after using these options.
-io_bits=%u		 Set the bit size of write IO requests. It should be set
-			 with "mode=lfs".
 usrquota		 Enable plain user disk quota accounting.
 grpquota		 Enable plain group disk quota accounting.
 prjquota		 Enable plain project quota accounting.
--- linux-qcom-6.8.0.orig/Documentation/filesystems/fscrypt.rst
+++ linux-qcom-6.8.0/Documentation/filesystems/fscrypt.rst
@@ -70,7 +70,7 @@
 --------------
 
 fscrypt (and storage encryption in general) can only provide limited
-protection, if any at all, against online attacks.  In detail:
+protection against online attacks.  In detail:
 
 Side-channel attacks
 ~~~~~~~~~~~~~~~~~~~~
@@ -99,16 +99,23 @@
 be enforced by kernel *code* and therefore would be largely redundant
 with the wide variety of access control mechanisms already available.)
 
-Kernel memory compromise
-~~~~~~~~~~~~~~~~~~~~~~~~
+Read-only kernel memory compromise
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-An attacker who compromises the system enough to read from arbitrary
-memory, e.g. by mounting a physical attack or by exploiting a kernel
-security vulnerability, can compromise all encryption keys that are
-currently in use.
+Unless `hardware-wrapped keys`_ are used, an attacker who gains the
+ability to read from arbitrary kernel memory, e.g. by mounting a
+physical attack or by exploiting a kernel security vulnerability, can
+compromise all fscrypt keys that are currently in-use.  This also
+extends to cold boot attacks; if the system is suddenly powered off,
+keys the system was using may remain in memory for a short time.
+
+However, if hardware-wrapped keys are used, then the fscrypt master
+keys and file contents encryption keys (but not other types of fscrypt
+subkeys such as filenames encryption keys) are protected from
+compromises of arbitrary kernel memory.
 
-However, fscrypt allows encryption keys to be removed from the kernel,
-which may protect them from later compromise.
+In addition, fscrypt allows encryption keys to be removed from the
+kernel, which may protect them from later compromise.
 
 In more detail, the FS_IOC_REMOVE_ENCRYPTION_KEY ioctl (or the
 FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS ioctl) can wipe a master
@@ -145,6 +152,24 @@
   accelerator hardware (if used by the crypto API to implement any of
   the algorithms), or in other places not explicitly considered here.
 
+Full system compromise
+~~~~~~~~~~~~~~~~~~~~~~
+
+An attacker who gains "root" access and/or the ability to execute
+arbitrary kernel code can freely exfiltrate data that is protected by
+any in-use fscrypt keys.  Thus, usually fscrypt provides no meaningful
+protection in this scenario.  (Data that is protected by a key that is
+absent throughout the entire attack remains protected, modulo the
+limitations of key removal mentioned above in the case where the key
+was removed prior to the attack.)
+
+However, if `hardware-wrapped keys`_ are used, such attackers will be
+unable to exfiltrate the master keys or file contents keys in a form
+that will be usable after the system is powered off.  This may be
+useful if the attacker is significantly time-limited and/or
+bandwidth-limited, so they can only exfiltrate some data and need to
+rely on a later offline attack to exfiltrate the rest of it.
+
 Limitations of v1 policies
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -171,6 +196,11 @@
 Key hierarchy
 =============
 
+Note: this section assumes the use of standard keys (i.e. "software
+keys") rather than hardware-wrapped keys.  The use of hardware-wrapped
+keys modifies the key hierarchy slightly.  For details, see the
+`Hardware-wrapped keys`_ section.
+
 Master Keys
 -----------
 
@@ -611,6 +641,8 @@
     policies`_.
   - FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32: See `IV_INO_LBLK_32
     policies`_.
+  - FSCRYPT_POLICY_FLAG_HW_WRAPPED_KEY: This flag denotes that this
+    policy uses a hardware-wrapped key.  See `Hardware-wrapped keys`_.
 
   v1 encryption policies only support the PAD_* and DIRECT_KEY flags.
   The other flags are only supported by v2 encryption policies.
@@ -833,7 +865,8 @@
             struct fscrypt_key_specifier key_spec;
             __u32 raw_size;
             __u32 key_id;
-            __u32 __reserved[8];
+            __u32 flags;
+            __u32 __reserved[7];
             __u8 raw[];
     };
 
@@ -852,7 +885,7 @@
 
     struct fscrypt_provisioning_key_payload {
             __u32 type;
-            __u32 __reserved;
+            __u32 flags;
             __u8 raw[];
     };
 
@@ -880,6 +913,12 @@
   Alternatively, if ``key_id`` is nonzero, this field must be 0, since
   in that case the size is implied by the specified Linux keyring key.
 
+- ``flags`` contains optional flags from ``<linux/fscrypt.h>``:
+
+  - FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED: This denotes that the key is a
+    hardware-wrapped key.  See `Hardware-wrapped keys`_.  This flag
+    can't be used if FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR is used.
+
 - ``key_id`` is 0 if the raw key is given directly in the ``raw``
   field.  Otherwise ``key_id`` is the ID of a Linux keyring key of
   type "fscrypt-provisioning" whose payload is
@@ -921,6 +960,8 @@
   caller does not have the CAP_SYS_ADMIN capability in the initial
   user namespace; or the raw key was specified by Linux key ID but the
   process lacks Search permission on the key.
+- ``EBADMSG``: FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED was specified, but the
+  key isn't a valid hardware-wrapped key
 - ``EDQUOT``: the key quota for this user would be exceeded by adding
   the key
 - ``EINVAL``: invalid key size or key specifier type, or reserved bits
@@ -932,7 +973,9 @@
 - ``ENOTTY``: this type of filesystem does not implement encryption
 - ``EOPNOTSUPP``: the kernel was not configured with encryption
   support for this filesystem, or the filesystem superblock has not
-  had encryption enabled on it
+  had encryption enabled on it, or FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED was
+  specified but the filesystem and/or the hardware doesn't support
+  hardware-wrapped keys
 
 Legacy method
 ~~~~~~~~~~~~~
@@ -995,9 +1038,8 @@
 These ioctls don't work on keys that were added via the legacy
 process-subscribed keyrings mechanism.
 
-Before using these ioctls, read the `Kernel memory compromise`_
-section for a discussion of the security goals and limitations of
-these ioctls.
+Before using these ioctls, read the `Online attacks`_ section for a
+discussion of the security goals and limitations of these ioctls.
 
 FS_IOC_REMOVE_ENCRYPTION_KEY
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -1317,7 +1359,8 @@
 (e.g. support for the needed encryption algorithm and data unit size)
 and where blk-crypto-fallback is unusable.  (For blk-crypto-fallback
 to be usable, it must be enabled in the kernel configuration with
-CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y.)
+CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y, and the file must be
+protected by a standard key rather than a hardware-wrapped key.)
 
 Currently fscrypt always uses the filesystem block size (which is
 usually 4096 bytes) as the data unit size.  Therefore, it can only use
@@ -1325,7 +1368,84 @@
 
 Inline encryption doesn't affect the ciphertext or other aspects of
 the on-disk format, so users may freely switch back and forth between
-using "inlinecrypt" and not using "inlinecrypt".
+using "inlinecrypt" and not using "inlinecrypt".  An exception is that
+files that are protected by a hardware-wrapped key can only be
+encrypted/decrypted by the inline encryption hardware and therefore
+can only be accessed when the "inlinecrypt" mount option is used.  For
+more information about hardware-wrapped keys, see below.
+
+Hardware-wrapped keys
+---------------------
+
+fscrypt supports using *hardware-wrapped keys* when the inline
+encryption hardware supports it.  Such keys are only present in kernel
+memory in wrapped (encrypted) form; they can only be unwrapped
+(decrypted) by the inline encryption hardware and are temporally bound
+to the current boot.  This prevents the keys from being compromised if
+kernel memory is leaked.  This is done without limiting the number of
+keys that can be used and while still allowing the execution of
+cryptographic tasks that are tied to the same key but can't use inline
+encryption hardware, e.g. filenames encryption.
+
+Note that hardware-wrapped keys aren't specific to fscrypt; they are a
+block layer feature (part of *blk-crypto*).  For more details about
+hardware-wrapped keys, see the block layer documentation at
+:ref:`Documentation/block/inline-encryption.rst
+<hardware_wrapped_keys>`.  Below, we just focus on the details of how
+fscrypt can use hardware-wrapped keys.
+
+fscrypt supports hardware-wrapped keys by allowing the fscrypt master
+keys to be hardware-wrapped keys as an alternative to standard keys.
+To add a hardware-wrapped key with `FS_IOC_ADD_ENCRYPTION_KEY`_,
+userspace must specify FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED in the
+``flags`` field of struct fscrypt_add_key_arg and also in the
+``flags`` field of struct fscrypt_provisioning_key_payload when
+applicable.  The key must be in ephemerally-wrapped form, not
+long-term wrapped form.
+
+To specify that files will be protected by a hardware-wrapped key,
+userspace must specify FSCRYPT_POLICY_FLAG_HW_WRAPPED_KEY in the
+encryption policy.  (Note that this flag is somewhat redundant, as the
+encryption policy also contains the key identifier, and
+hardware-wrapped keys and standard keys will have different key
+identifiers.  However, it is sometimes helpful to make it explicit
+that an encryption policy is supposed to use a hardware-wrapped key.)
+
+Some limitations apply.  First, files protected by a hardware-wrapped
+key are tied to the system's inline encryption hardware.  Therefore
+they can only be accessed when the "inlinecrypt" mount option is used,
+and they can't be included in portable filesystem images.  Second,
+currently the hardware-wrapped key support is only compatible with
+`IV_INO_LBLK_64 policies`_ and `IV_INO_LBLK_32 policies`_, as it
+assumes that there is just one file contents encryption key per
+fscrypt master key rather than one per file.  Future work may address
+this limitation by passing per-file nonces down the storage stack to
+allow the hardware to derive per-file keys.
+
+Implementation-wise, to encrypt/decrypt the contents of files that are
+protected by a hardware-wrapped key, fscrypt uses blk-crypto,
+attaching the hardware-wrapped key to the bio crypt contexts.  As is
+the case with standard keys, the block layer will program the key into
+a keyslot when it isn't already in one.  However, when programming a
+hardware-wrapped key, the hardware doesn't program the given key
+directly into a keyslot but rather unwraps it (using the hardware's
+ephemeral wrapping key) and derives the inline encryption key from it.
+The inline encryption key is the key that actually gets programmed
+into a keyslot, and it is never exposed to software.
+
+However, fscrypt doesn't just do file contents encryption; it also
+uses its master keys to derive filenames encryption keys, key
+identifiers, and sometimes some more obscure types of subkeys such as
+dirhash keys.  So even with file contents encryption out of the
+picture, fscrypt still needs a raw key to work with.  To get such a
+key from a hardware-wrapped key, fscrypt asks the inline encryption
+hardware to derive a cryptographically isolated "software secret" from
+the hardware-wrapped key.  fscrypt uses this "software secret" to key
+its KDF to derive all subkeys other than file contents keys.
+
+Note that this implies that the hardware-wrapped key feature only
+protects the file contents encryption keys.  It doesn't protect other
+fscrypt subkeys such as filenames encryption keys.
 
 Direct I/O support
 ==================
--- linux-qcom-6.8.0.orig/Documentation/filesystems/mount_api.rst
+++ linux-qcom-6.8.0/Documentation/filesystems/mount_api.rst
@@ -645,6 +645,8 @@
 	fs_param_is_blockdev	Blockdev path		* Needs lookup
 	fs_param_is_path	Path			* Needs lookup
 	fs_param_is_fd		File descriptor		result->int_32
+	fs_param_is_uid		User ID (u32)           result->uid
+	fs_param_is_gid		Group ID (u32)          result->gid
 	=======================	=======================	=====================
 
      Note that if the value is of fs_param_is_bool type, fs_parse() will try
@@ -678,6 +680,8 @@
 	fsparam_bdev()		fs_param_is_blockdev
 	fsparam_path()		fs_param_is_path
 	fsparam_fd()		fs_param_is_fd
+	fsparam_uid()		fs_param_is_uid
+	fsparam_gid()		fs_param_is_gid
 	=======================	===============================================
 
      all of which take two arguments, name string and option number - for
@@ -766,7 +770,8 @@
 
    * ::
 
-       bool fs_validate_description(const struct fs_parameter_description *desc);
+       bool fs_validate_description(const char *name,
+                                    const struct fs_parameter_description *desc);
 
      This performs some validation checks on a parameter description.  It
      returns true if the description is good and false if it is not.  It will
@@ -784,8 +789,9 @@
      option number (which it returns).
 
      If successful, and if the parameter type indicates the result is a
-     boolean, integer or enum type, the value is converted by this function and
-     the result stored in result->{boolean,int_32,uint_32,uint_64}.
+     boolean, integer, enum, uid, or gid type, the value is converted by this
+     function and the result stored in
+     result->{boolean,int_32,uint_32,uint_64,uid,gid}.
 
      If a match isn't initially made, the key is prefixed with "no" and no
      value is present then an attempt will be made to look up the key with the
--- linux-qcom-6.8.0.orig/Documentation/hwmon/corsair-psu.rst
+++ linux-qcom-6.8.0/Documentation/hwmon/corsair-psu.rst
@@ -15,11 +15,11 @@
 
   Corsair HX850i
 
-  Corsair HX1000i (Series 2022 and 2023)
+  Corsair HX1000i (Legacy and Series 2023)
 
-  Corsair HX1200i
+  Corsair HX1200i (Legacy and Series 2023)
 
-  Corsair HX1500i (Series 2022 and 2023)
+  Corsair HX1500i (Legacy and Series 2023)
 
   Corsair RM550i
 
--- linux-qcom-6.8.0.orig/Documentation/i2c/busses/i2c-i801.rst
+++ linux-qcom-6.8.0/Documentation/i2c/busses/i2c-i801.rst
@@ -48,6 +48,8 @@
   * Intel Raptor Lake (PCH)
   * Intel Meteor Lake (SOC and PCH)
   * Intel Birch Stream (SOC)
+  * Intel Arrow Lake (SOC)
+  * Intel Panther Lake (SOC)
 
    Datasheets: Publicly available at the Intel website
 
--- linux-qcom-6.8.0.orig/Documentation/kbuild/modules.rst
+++ linux-qcom-6.8.0/Documentation/kbuild/modules.rst
@@ -128,7 +128,7 @@
 
 	modules_install
 		Install the external module(s). The default location is
-		/lib/modules/<kernel_release>/extra/, but a prefix may
+		/lib/modules/<kernel_release>/updates/, but a prefix may
 		be added with INSTALL_MOD_PATH (discussed in section 5).
 
 	clean
@@ -417,7 +417,7 @@
 
 And external modules are installed in:
 
-	/lib/modules/$(KERNELRELEASE)/extra/
+	/lib/modules/$(KERNELRELEASE)/updates/
 
 5.1 INSTALL_MOD_PATH
 --------------------
@@ -438,10 +438,10 @@
 -------------------
 
 	External modules are by default installed to a directory under
-	/lib/modules/$(KERNELRELEASE)/extra/, but you may wish to
+	/lib/modules/$(KERNELRELEASE)/updates/, but you may wish to
 	locate modules for a specific functionality in a separate
 	directory. For this purpose, use INSTALL_MOD_DIR to specify an
-	alternative name to "extra."::
+	alternative name to "updates."::
 
 		$ make INSTALL_MOD_DIR=gandalf -C $KDIR \
 		       M=$PWD modules_install
--- linux-qcom-6.8.0.orig/Documentation/locking/hwspinlock.rst
+++ linux-qcom-6.8.0/Documentation/locking/hwspinlock.rst
@@ -87,6 +87,17 @@
 
 ::
 
+  int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id);
+
+After verifying the owner of the hwspinlock, release a previously acquired
+hwspinlock; returns 0 on success, or an appropriate error code on failure
+(e.g. -EOPNOTSUPP if the bust operation is not defined for the specific
+hwspinlock).
+
+Should be called from a process context (might sleep).
+
+::
+
   int hwspin_lock_timeout(struct hwspinlock *hwlock, unsigned int timeout);
 
 Lock a previously-assigned hwspinlock with a timeout limit (specified in
--- linux-qcom-6.8.0.orig/Documentation/locking/seqlock.rst
+++ linux-qcom-6.8.0/Documentation/locking/seqlock.rst
@@ -153,7 +153,7 @@
 from interruption by readers. This is typically the case when the read
 side can be invoked from NMI handlers.
 
-Check `raw_write_seqcount_latch()` for more information.
+Check `write_seqcount_latch()` for more information.
 
 
 .. _seqlock_t:
--- linux-qcom-6.8.0.orig/Documentation/mm/arch_pgtable_helpers.rst
+++ linux-qcom-6.8.0/Documentation/mm/arch_pgtable_helpers.rst
@@ -140,7 +140,8 @@
 +---------------------------+--------------------------------------------------+
 | pmd_swp_clear_soft_dirty  | Clears a soft dirty swapped PMD                  |
 +---------------------------+--------------------------------------------------+
-| pmd_mkinvalid             | Invalidates a mapped PMD [1]                     |
+| pmd_mkinvalid             | Invalidates a present PMD; do not call for       |
+|                           | non-present PMD [1]                              |
 +---------------------------+--------------------------------------------------+
 | pmd_set_huge              | Creates a PMD huge mapping                       |
 +---------------------------+--------------------------------------------------+
@@ -196,7 +197,8 @@
 +---------------------------+--------------------------------------------------+
 | pud_mkdevmap              | Creates a ZONE_DEVICE mapped PUD                 |
 +---------------------------+--------------------------------------------------+
-| pud_mkinvalid             | Invalidates a mapped PUD [1]                     |
+| pud_mkinvalid             | Invalidates a present PUD; do not call for       |
+|                           | non-present PUD [1]                              |
 +---------------------------+--------------------------------------------------+
 | pud_set_huge              | Creates a PUD huge mapping                       |
 +---------------------------+--------------------------------------------------+
--- linux-qcom-6.8.0.orig/Documentation/mm/page_table_check.rst
+++ linux-qcom-6.8.0/Documentation/mm/page_table_check.rst
@@ -14,7 +14,7 @@
 accessible from the userspace by getting their page table entries (PTEs PMDs
 etc.) added into the table.
 
-In case of detected corruption, the kernel is crashed. There is a small
+In case of most detected corruption, the kernel is crashed. There is a small
 performance and memory overhead associated with the page table check. Therefore,
 it is disabled by default, but can be optionally enabled on systems where the
 extra hardening outweighs the performance costs. Also, because page table check
@@ -22,6 +22,13 @@
 by crashing kernel at the time wrong mapping occurs instead of later which is
 often the case with memory corruptions bugs.
 
+It can also be used to do page table entry checks over various flags, dump
+warnings when illegal combinations of entry flags are detected.  Currently,
+userfaultfd is the only user of such to sanity check wr-protect bit against
+any writable flags.  Illegal flag combinations will not directly cause data
+corruption in this case immediately, but that will cause read-only data to
+be writable, leading to corrupt when the page content is later modified.
+
 Double mapping detection logic
 ==============================
 
--- linux-qcom-6.8.0.orig/Documentation/netlink/specs/devlink.yaml
+++ linux-qcom-6.8.0/Documentation/netlink/specs/devlink.yaml
@@ -290,7 +290,7 @@
         enum: eswitch-mode
       -
         name: eswitch-inline-mode
-        type: u16
+        type: u8
         enum: eswitch-inline-mode
       -
         name: dpipe-tables
--- linux-qcom-6.8.0.orig/Documentation/netlink/specs/dpll.yaml
+++ linux-qcom-6.8.0/Documentation/netlink/specs/dpll.yaml
@@ -274,6 +274,7 @@
       -
         name: capabilities
         type: u32
+        enum: pin-capabilities
       -
         name: parent-device
         type: nest
@@ -306,6 +307,26 @@
           Value is in PPM (parts per million).
           This may be implemented for example for pin of type
           PIN_TYPE_SYNCE_ETH_PORT.
+      -
+        name: esync-frequency
+        type: u64
+        doc: |
+          Frequency of Embedded SYNC signal. If provided, the pin is configured
+          with a SYNC signal embedded into its base clock frequency.
+      -
+        name: esync-frequency-supported
+        type: nest
+        multi-attr: true
+        nested-attributes: frequency-range
+        doc: |
+          If provided a pin is capable of embedding a SYNC signal (within given
+          range) into its base frequency signal.
+      -
+        name: esync-pulse
+        type: u32
+        doc: |
+          A ratio of high to low state of a SYNC signal pulse embedded
+          into base clock frequency. Value is in percents.
   -
     name: pin-parent-device
     subset-of: pin
@@ -469,6 +490,9 @@
             - phase-adjust-max
             - phase-adjust
             - fractional-frequency-offset
+            - esync-frequency
+            - esync-frequency-supported
+            - esync-pulse
 
       dump:
         request:
@@ -495,6 +519,7 @@
             - parent-device
             - parent-pin
             - phase-adjust
+            - esync-frequency
     -
       name: pin-create-ntf
       doc: Notification about pin appearing
--- linux-qcom-6.8.0.orig/Documentation/netlink/specs/ethtool.yaml
+++ linux-qcom-6.8.0/Documentation/netlink/specs/ethtool.yaml
@@ -64,7 +64,12 @@
         name: bits
         type: nest
         nested-attributes: bitset-bits
-
+      -
+        name: value
+        type: binary
+      -
+        name: mask
+        type: binary
   -
     name: string
     attributes:
@@ -1594,6 +1599,7 @@
         request:
           attributes:
             - header
+            - context
         reply:
           attributes:
             - header
@@ -1602,7 +1608,6 @@
             - indir
             - hkey
             - input_xfrm
-      dump: *rss-get-op
     -
       name: plca-get-cfg
       doc: Get PLCA params.
--- linux-qcom-6.8.0.orig/Documentation/netlink/specs/mptcp_pm.yaml
+++ linux-qcom-6.8.0/Documentation/netlink/specs/mptcp_pm.yaml
@@ -109,7 +109,6 @@
       -
         name: port
         type: u16
-        byte-order: big-endian
       -
         name: flags
         type: u32
@@ -294,7 +293,6 @@
       doc: Get endpoint information
       attribute-set: endpoint
       dont-validate: [ strict ]
-      flags: [ uns-admin-perm ]
       do: &get-addr-attrs
         request:
           attributes:
--- linux-qcom-6.8.0.orig/Documentation/netlink/specs/rt_link.yaml
+++ linux-qcom-6.8.0/Documentation/netlink/specs/rt_link.yaml
@@ -1144,6 +1144,12 @@
       -
         name: mcast-querier-state
         type: binary
+      -
+        name: fdb-n-learned
+        type: u32
+      -
+        name: fdb-max-learned
+        type: u32
   -
     name: linkinfo-brport-attrs
     name-prefix: ifla-brport-
--- linux-qcom-6.8.0.orig/Documentation/networking/device_drivers/wwan/t7xx.rst
+++ linux-qcom-6.8.0/Documentation/networking/device_drivers/wwan/t7xx.rst
@@ -39,6 +39,34 @@
 
 - open the AT control channel using a UART tool or a special user tool
 
+Sysfs
+=====
+The driver provides sysfs interfaces to userspace.
+
+t7xx_mode
+---------
+The sysfs interface provides userspace with access to the device mode, this interface
+supports read and write operations.
+
+Device mode:
+
+- ``unknown`` represents that device in unknown status
+- ``ready`` represents that device in ready status
+- ``reset`` represents that device in reset status
+- ``fastboot_switching`` represents that device in fastboot switching status
+- ``fastboot_download`` represents that device in fastboot download status
+- ``fastboot_dump`` represents that device in fastboot dump status
+
+Read from userspace to get the current device mode.
+
+::
+  $ cat /sys/bus/pci/devices/${bdf}/t7xx_mode
+
+Write from userspace to set the device mode.
+
+::
+  $ echo fastboot_switching > /sys/bus/pci/devices/${bdf}/t7xx_mode
+
 Management application development
 ==================================
 The driver and userspace interfaces are described below. The MBIM protocol is
@@ -97,6 +125,20 @@
 The userspace end of the control port is a /dev/wwan0at0 character
 device. Application shall use this interface to issue AT commands.
 
+fastboot port userspace ABI
+---------------------------
+
+/dev/wwan0fastboot0 character device
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+The driver exposes a fastboot protocol interface by implementing
+fastboot WWAN Port. The userspace end of the fastboot channel pipe is a
+/dev/wwan0fastboot0 character device. Application shall use this interface for
+fastboot protocol communication.
+
+Please note that driver needs to be reloaded to export /dev/wwan0fastboot0
+port, because device needs a cold reset after enter ``fastboot_switching``
+mode.
+
 The MediaTek's T700 modem supports the 3GPP TS 27.007 [4] specification.
 
 References
@@ -118,3 +160,7 @@
 [4] *Specification # 27.007 - 3GPP*
 
 - https://www.3gpp.org/DynaReport/27007.htm
+
+[5] *fastboot "a mechanism for communicating with bootloaders"*
+
+- https://android.googlesource.com/platform/system/core/+/refs/heads/main/fastboot/README.md
--- linux-qcom-6.8.0.orig/Documentation/networking/ethtool-netlink.rst
+++ linux-qcom-6.8.0/Documentation/networking/ethtool-netlink.rst
@@ -1771,6 +1771,7 @@
 
 =====================================  ======  ==========================
   ``ETHTOOL_A_RSS_HEADER``             nested  reply header
+  ``ETHTOOL_A_RSS_CONTEXT``            u32     context number
   ``ETHTOOL_A_RSS_HFUNC``              u32     RSS hash func
   ``ETHTOOL_A_RSS_INDIR``              binary  Indir table bytes
   ``ETHTOOL_A_RSS_HKEY``               binary  Hash key bytes
--- linux-qcom-6.8.0.orig/Documentation/networking/j1939.rst
+++ linux-qcom-6.8.0/Documentation/networking/j1939.rst
@@ -121,7 +121,7 @@
 
 On the other hand, when using PDU1 format, the PS-field contains a so-called
 Destination Address, which is _not_ part of the PGN. When communicating a PGN
-from user space to kernel (or vice versa) and PDU2 format is used, the PS-field
+from user space to kernel (or vice versa) and PDU1 format is used, the PS-field
 of the PGN shall be set to zero. The Destination Address shall be set
 elsewhere.
 
--- linux-qcom-6.8.0.orig/Documentation/networking/net_cachelines/net_device.rst
+++ linux-qcom-6.8.0/Documentation/networking/net_cachelines/net_device.rst
@@ -13,7 +13,7 @@
 unsigned_long                       mem_end                                                         
 unsigned_long                       mem_start                                                       
 unsigned_long                       base_addr                                                       
-unsigned_long                       state                                                           
+unsigned_long                       state                   read_mostly         read_mostly         netif_running(dev)
 struct_list_head                    dev_list                                                        
 struct_list_head                    napi_list                                                       
 struct_list_head                    unreg_list                                                      
@@ -98,7 +98,7 @@
 unsigned_int                        real_num_rx_queues      -                   read_mostly         get_rps_cpu
 struct_bpf_prog*                    xdp_prog                -                   read_mostly         netif_elide_gro()
 unsigned_long                       gro_flush_timeout       -                   read_mostly         napi_complete_done
-int                                 napi_defer_hard_irqs    -                   read_mostly         napi_complete_done
+u32                                 napi_defer_hard_irqs    -                   read_mostly         napi_complete_done
 unsigned_int                        gro_max_size            -                   read_mostly         skb_gro_receive
 unsigned_int                        gro_ipv4_max_size       -                   read_mostly         skb_gro_receive
 rx_handler_func_t*                  rx_handler              read_mostly         -                   __netif_receive_skb_core
--- linux-qcom-6.8.0.orig/Documentation/networking/sfp-phylink.rst
+++ linux-qcom-6.8.0/Documentation/networking/sfp-phylink.rst
@@ -207,6 +207,11 @@
    capabilities for ``interface`` to determine the allowable ethtool link
    modes.
 
+   The :c:func:`validate` method should mask the supplied supported mask,
+   and ``state->advertising`` with the supported ethtool link modes.
+   These are the new ethtool link modes, so bitmask operations must be
+   used. For an example, see ``drivers/net/ethernet/marvell/mvneta.c``.
+
    The :c:func:`mac_link_state` method is used to read the link state
    from the MAC, and report back the settings that the MAC is currently
    using. This is particularly important for in-band negotiation
--- linux-qcom-6.8.0.orig/Documentation/networking/xsk-tx-metadata.rst
+++ linux-qcom-6.8.0/Documentation/networking/xsk-tx-metadata.rst
@@ -11,12 +11,16 @@
 General Design
 ==============
 
-The headroom for the metadata is reserved via ``tx_metadata_len`` in
-``struct xdp_umem_reg``. The metadata length is therefore the same for
-every socket that shares the same umem. The metadata layout is a fixed UAPI,
-refer to ``union xsk_tx_metadata`` in ``include/uapi/linux/if_xdp.h``.
-Thus, generally, the ``tx_metadata_len`` field above should contain
-``sizeof(union xsk_tx_metadata)``.
+The headroom for the metadata is reserved via ``tx_metadata_len`` and
+``XDP_UMEM_TX_METADATA_LEN`` flag in ``struct xdp_umem_reg``. The metadata
+length is therefore the same for every socket that shares the same umem.
+The metadata layout is a fixed UAPI, refer to ``union xsk_tx_metadata`` in
+``include/uapi/linux/if_xdp.h``. Thus, generally, the ``tx_metadata_len``
+field above should contain ``sizeof(union xsk_tx_metadata)``.
+
+Note that in the original implementation the ``XDP_UMEM_TX_METADATA_LEN``
+flag was not required. Applications might attempt to create a umem
+with a flag first and if it fails, do another attempt without a flag.
 
 The headroom and the metadata itself should be located right before
 ``xdp_desc->addr`` in the umem frame. Within a frame, the metadata
--- linux-qcom-6.8.0.orig/Documentation/power/runtime_pm.rst
+++ linux-qcom-6.8.0/Documentation/power/runtime_pm.rst
@@ -347,7 +347,9 @@
 
   `int pm_runtime_resume_and_get(struct device *dev);`
     - run pm_runtime_resume(dev) and if successful, increment the device's
-      usage counter; return the result of pm_runtime_resume
+      usage counter; returns 0 on success (whether or not the device's
+      runtime PM status was already 'active') or the error code from
+      pm_runtime_resume() on failure.
 
   `int pm_request_idle(struct device *dev);`
     - submit a request to execute the subsystem-level idle callback for the
@@ -396,10 +398,9 @@
       nonzero, increment the counter and return 1; otherwise return 0 without
       changing the counter
 
-  `int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count);`
+  `int pm_runtime_get_if_active(struct device *dev);`
     - return -EINVAL if 'power.disable_depth' is nonzero; otherwise, if the
-      runtime PM status is RPM_ACTIVE, and either ign_usage_count is true
-      or the device's usage_count is non-zero, increment the counter and
+      runtime PM status is RPM_ACTIVE, increment the counter and
       return 1; otherwise return 0 without changing the counter
 
   `void pm_runtime_put_noidle(struct device *dev);`
--- linux-qcom-6.8.0.orig/Documentation/process/changes.rst
+++ linux-qcom-6.8.0/Documentation/process/changes.rst
@@ -31,7 +31,7 @@
 ====================== ===============  ========================================
 GNU C                  5.1              gcc --version
 Clang/LLVM (optional)  11.0.0           clang --version
-Rust (optional)        1.74.1           rustc --version
+Rust (optional)        1.75.0           rustc --version
 bindgen (optional)     0.65.1           bindgen --version
 GNU make               3.82             make --version
 bash                   4.2              bash --version
--- linux-qcom-6.8.0.orig/Documentation/sphinx/cdomain.py
+++ linux-qcom-6.8.0/Documentation/sphinx/cdomain.py
@@ -37,12 +37,29 @@
 
 import sphinx
 from sphinx import addnodes
-from sphinx.domains.c import c_funcptr_sig_re, c_sig_re
 from sphinx.domains.c import CObject as Base_CObject
 from sphinx.domains.c import CDomain as Base_CDomain
 from itertools import chain
 import re
 
+# fixes https://github.com/sphinx-doc/sphinx/commit/0f49e30c51b5cc5055cda5b4b294c2dd9d1df573#r38750737
+
+# pylint: disable=invalid-name
+c_sig_re = re.compile(
+    r'''^([^(]*?)          # return type
+        ([\w:.]+)  \s*     # thing name (colon allowed for C++)
+        (?: \((.*)\) )?    # optionally arguments
+        (\s+const)? $      # const specifier
+    ''', re.VERBOSE)
+
+c_funcptr_sig_re = re.compile(
+    r'''^([^(]+?)          # return type
+        (\( [^()]+ \)) \s* # name in parentheses
+        \( (.*) \)         # arguments
+        (\s+const)? $      # const specifier
+    ''', re.VERBOSE)
+# pylint: enable=invalid-name
+
 __version__  = '1.1'
 
 # Get Sphinx version
--- linux-qcom-6.8.0.orig/Documentation/sphinx/kernel_include.py
+++ linux-qcom-6.8.0/Documentation/sphinx/kernel_include.py
@@ -97,7 +97,6 @@
         # HINT: this is the only line I had to change / commented out:
         #path = utils.relative_path(None, path)
 
-        path = nodes.reprunicode(path)
         encoding = self.options.get(
             'encoding', self.state.document.settings.input_encoding)
         e_handler=self.state.document.settings.input_encoding_error_handler
--- linux-qcom-6.8.0.orig/Documentation/sphinx/kerneldoc.py
+++ linux-qcom-6.8.0/Documentation/sphinx/kerneldoc.py
@@ -61,9 +61,9 @@
         env = self.state.document.settings.env
         cmd = [env.config.kerneldoc_bin, '-rst', '-enable-lineno']
 
-	# Pass the version string to kernel-doc, as it needs to use a different
-	# dialect, depending what the C domain supports for each specific
-	# Sphinx versions
+        # Pass the version string to kernel-doc, as it needs to use a different
+        # dialect, depending what the C domain supports for each specific
+        # Sphinx versions
         cmd += ['-sphinx-version', sphinx.__version__]
 
         filename = env.config.kerneldoc_srctree + '/' + self.arguments[0]
--- linux-qcom-6.8.0.orig/Documentation/userspace-api/ioctl/ioctl-number.rst
+++ linux-qcom-6.8.0/Documentation/userspace-api/ioctl/ioctl-number.rst
@@ -82,8 +82,8 @@
 0x10  00-0F  drivers/char/s390/vmcp.h
 0x10  10-1F  arch/s390/include/uapi/sclp_ctl.h
 0x10  20-2F  arch/s390/include/uapi/asm/hypfs.h
-0x12  all    linux/fs.h
-             linux/blkpg.h
+0x12  all    linux/fs.h, linux/blkpg.h, linux/blkzoned.h,
+             linux/blk-crypto.h
 0x1b  all                                                            InfiniBand Subsystem
                                                                      <http://infiniband.sourceforge.net/>
 0x20  all    drivers/cdrom/cm206.h
@@ -136,6 +136,7 @@
 'F'   DD     video/sstfb.h                                           conflict!
 'G'   00-3F  drivers/misc/sgi-gru/grulib.h                           conflict!
 'G'   00-0F  xen/gntalloc.h, xen/gntdev.h                            conflict!
+'G'   00-0F  linux/gunyah.h                                          conflict!
 'H'   00-7F  linux/hiddev.h                                          conflict!
 'H'   00-0F  linux/hidraw.h                                          conflict!
 'H'   01     linux/mei.h                                             conflict!
--- linux-qcom-6.8.0.orig/Documentation/userspace-api/media/mediactl/media-types.rst
+++ linux-qcom-6.8.0/Documentation/userspace-api/media/mediactl/media-types.rst
@@ -375,12 +375,11 @@
 	  are origins of links.
 
     *  -  ``MEDIA_PAD_FL_MUST_CONNECT``
-       -  If this flag is set and the pad is linked to any other pad, then
-	  at least one of those links must be enabled for the entity to be
-	  able to stream. There could be temporary reasons (e.g. device
-	  configuration dependent) for the pad to need enabled links even
-	  when this flag isn't set; the absence of the flag doesn't imply
-	  there is none.
+       -  If this flag is set, then for this pad to be able to stream, it must
+	  be connected by at least one enabled link. There could be temporary
+	  reasons (e.g. device configuration dependent) for the pad to need
+	  enabled links even when this flag isn't set; the absence of the flag
+	  doesn't imply there is none.
 
 
 One and only one of ``MEDIA_PAD_FL_SINK`` and ``MEDIA_PAD_FL_SOURCE``
--- linux-qcom-6.8.0.orig/Documentation/userspace-api/media/v4l/ext-ctrls-codec.rst
+++ linux-qcom-6.8.0/Documentation/userspace-api/media/v4l/ext-ctrls-codec.rst
@@ -576,6 +576,8 @@
       - Constant bitrate
     * - ``V4L2_MPEG_VIDEO_BITRATE_MODE_CQ``
       - Constant quality
+    * - ``V4L2_MPEG_VIDEO_BITRATE_MODE_MBR``
+      - Maximum bitrate
 
 
 
--- linux-qcom-6.8.0.orig/Documentation/virt/gunyah/index.rst
+++ linux-qcom-6.8.0/Documentation/virt/gunyah/index.rst
@@ -0,0 +1,114 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+=================
+Gunyah Hypervisor
+=================
+
+.. toctree::
+   :maxdepth: 1
+
+   vm-manager
+   message-queue
+
+Gunyah is a Type-1 hypervisor which is independent of any OS kernel, and runs in
+a higher CPU privilege level. It does not depend on any lower-privileged operating system
+for its core functionality. This increases its security and can support a much smaller
+trusted computing base than a Type-2 hypervisor.
+
+Gunyah is an open source hypervisor. The source repo is available at
+https://github.com/quic/gunyah-hypervisor.
+
+Gunyah provides these following features.
+
+- Scheduling:
+
+  A scheduler for virtual CPUs (vCPUs) on physical CPUs enables time-sharing
+  of the CPUs. Gunyah supports two models of scheduling:
+
+    1. "Behind the back" scheduling in which Gunyah hypervisor schedules vCPUS on its own.
+    2. "Proxy" scheduling in which a delegated VM can donate part of one of its vCPU slice
+       to another VM's vCPU via a hypercall.
+
+- Memory Management:
+
+  APIs handling memory, abstracted as objects, limiting direct use of physical
+  addresses. Memory ownership and usage tracking of all memory under its control.
+  Memory partitioning between VMs is a fundamental security feature.
+
+- Interrupt Virtualization:
+
+  Uses CPU hardware interrupt virtualization capabilities. Interrupts are handled
+  in the hypervisor and routed to the assigned VM.
+
+- Inter-VM Communication:
+
+  There are several different mechanisms provided for communicating between VMs.
+
+- Virtual platform:
+
+  Architectural devices such as interrupt controllers and CPU timers are directly provided
+  by the hypervisor as well as core virtual platform devices and system APIs such as ARM PSCI.
+
+- Device Virtualization:
+
+  Para-virtualization of devices is supported using inter-VM communication.
+
+Architectures supported
+=======================
+AArch64 with a GIC
+
+Resources and Capabilities
+==========================
+
+Some services or resources provided by the Gunyah hypervisor are described to a virtual machine by
+capability IDs. For instance, inter-VM communication is performed with doorbells and message queues.
+Gunyah allows access to manipulate that doorbell via the capability ID. These resources are
+described in Linux as a struct gh_resource.
+
+High level management of these resources is performed by the resource manager VM. RM informs a
+guest VM about resources it can access through either the device tree or via guest-initiated RPC.
+
+For each virtual machine, Gunyah maintains a table of resources which can be accessed by that VM.
+An entry in this table is called a "capability" and VMs can only access resources via this
+capability table. Hence, virtual Gunyah resources are referenced by a "capability IDs" and not
+"resource IDs". If 2 VMs have access to the same resource, they might not be using the same
+capability ID to access that resource since the capability tables are independent per VM.
+
+Resource Manager
+================
+
+The resource manager (RM) is a privileged application VM supporting the Gunyah Hypervisor.
+It provides policy enforcement aspects of the virtualization system. The resource manager can
+be treated as an extension of the Hypervisor but is separated to its own partition to ensure
+that the hypervisor layer itself remains small and secure and to maintain a separation of policy
+and mechanism in the platform. RM runs at arm64 NS-EL1 similar to other virtual machines.
+
+Communication with the resource manager from each guest VM happens with message-queue.rst. Details
+about the specific messages can be found in drivers/virt/gunyah/rsc_mgr.c
+
+::
+
+  +-------+   +--------+   +--------+
+  |  RM   |   |  VM_A  |   |  VM_B  |
+  +-.-.-.-+   +---.----+   +---.----+
+    | |           |            |
+  +-.-.-----------.------------.----+
+  | | \==========/             |    |
+  |  \========================/     |
+  |            Gunyah               |
+  +---------------------------------+
+
+The source for the resource manager is available at https://github.com/quic/gunyah-resource-manager.
+
+The resource manager provides the following features:
+
+- VM lifecycle management: allocating a VM, starting VMs, destruction of VMs
+- VM access control policy, including memory sharing and lending
+- Interrupt routing configuration
+- Forwarding of system-level events (e.g. VM shutdown) to owner VM
+
+When booting a virtual machine which uses a devicetree such as Linux, resource manager overlays a
+/hypervisor node. This node can let Linux know it is running as a Gunyah guest VM,
+how to communicate with resource manager, and basic description and capabilities of
+this VM. See Documentation/devicetree/bindings/firmware/gunyah-hypervisor.yaml for a description
+of this node.
--- linux-qcom-6.8.0.orig/Documentation/virt/gunyah/message-queue.rst
+++ linux-qcom-6.8.0/Documentation/virt/gunyah/message-queue.rst
@@ -0,0 +1,71 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+Message Queues
+==============
+Message queue is a simple low-capacity IPC channel between two VMs. It is
+intended for sending small control and configuration messages. Each message
+queue is unidirectional, so a full-duplex IPC channel requires a pair of queues.
+
+Messages can be up to 240 bytes in length. Longer messages require a further
+protocol on top of the message queue messages themselves. For instance, communication
+with the resource manager adds a header field for sending longer messages via multiple
+message fragments.
+
+The diagram below shows how message queue works. A typical configuration involves
+2 message queues. Message queue 1 allows VM_A to send messages to VM_B. Message
+queue 2 allows VM_B to send messages to VM_A.
+
+1. VM_A sends a message of up to 240 bytes in length. It raises a hypercall
+   with the message to inform the hypervisor to add the message to
+   message queue 1's queue. The hypervisor copies memory into the internal
+   message queue representation; the memory doesn't need to be shared between
+   VM_A and VM_B.
+
+2. Gunyah raises the corresponding interrupt for VM_B (Rx vIRQ) when any of
+   these happens:
+
+   a. gh_msgq_send() has PUSH flag. Queue is immediately flushed. This is the typical case.
+   b. Explicility with gh_msgq_push command from VM_A.
+   c. Message queue has reached a threshold depth.
+
+3. VM_B calls gh_msgq_recv() and Gunyah copies message to requested buffer.
+
+4. Gunyah buffers messages in the queue. If the queue became full when VM_A added a message,
+   the return values for gh_msgq_send() include a flag that indicates the queue is full.
+   Once VM_B receives the message and, thus, there is space in the queue, Gunyah
+   will raise the Tx vIRQ on VM_A to indicate it can continue sending messages.
+
+For VM_B to send a message to VM_A, the process is identical, except that hypercalls
+reference message queue 2's capability ID. Each message queue has its own independent
+vIRQ: two TX message queues will have two vIRQs (and two capability IDs).
+
+::
+
+      +---------------+         +-----------------+         +---------------+
+      |      VM_A     |         |Gunyah hypervisor|         |      VM_B     |
+      |               |         |                 |         |               |
+      |               |         |                 |         |               |
+      |               |   Tx    |                 |         |               |
+      |               |-------->|                 | Rx vIRQ |               |
+      |gh_msgq_send() | Tx vIRQ |Message queue 1  |-------->|gh_msgq_recv() |
+      |               |<------- |                 |         |               |
+      |               |         |                 |         |               |
+      | Message Queue |         |                 |         | Message Queue |
+      | driver        |         |                 |         | driver        |
+      |               |         |                 |         |               |
+      |               |         |                 |         |               |
+      |               |         |                 |   Tx    |               |
+      |               | Rx vIRQ |                 |<--------|               |
+      |gh_msgq_recv() |<--------|Message queue 2  | Tx vIRQ |gh_msgq_send() |
+      |               |         |                 |-------->|               |
+      |               |         |                 |         |               |
+      |               |         |                 |         |               |
+      +---------------+         +-----------------+         +---------------+
+
+Gunyah message queues are exposed as mailboxes. To create the mailbox, create
+a mbox_client and call `gh_msgq_init()`. On receipt of the RX_READY interrupt,
+all messages in the RX message queue are read and pushed via the `rx_callback`
+of the registered mbox_client.
+
+.. kernel-doc:: drivers/mailbox/gunyah-msgq.c
+   :identifiers: gh_msgq_init
--- linux-qcom-6.8.0.orig/Documentation/virt/gunyah/vm-manager.rst
+++ linux-qcom-6.8.0/Documentation/virt/gunyah/vm-manager.rst
@@ -0,0 +1,143 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+=======================
+Virtual Machine Manager
+=======================
+
+The Gunyah Virtual Machine Manager is a Linux driver to support launching
+virtual machines using Gunyah.
+
+Configuration of a Gunyah virtual machine is done via a devicetree. When the VM
+is launched, memory is provided by the host VM which contains the devictree.
+Gunyah reads the devicetree to configure the memory map and create resources
+such as vCPUs for the VM. Memory can be shared with the VM with
+`GH_VM_SET_USER_MEM_REGION`_. Userspace can interact with the resources in Linux
+by adding "functions" to the VM.
+
+Gunyah Functions
+================
+
+Components of a Gunyah VM's configuration that need kernel configuration are
+called "functions" and are built on top of a framework. Functions are identified
+by a string and have some argument(s) to configure them. They are typically
+created by the `GH_VM_ADD_FUNCTION`_ ioctl.
+
+Functions typically will always do at least one of these operations:
+
+1. Create resource ticket(s). Resource tickets allow a function to register
+   itself as the client for a Gunyah resource (e.g. doorbell or vCPU) and
+   the function is given the pointer to the &struct gh_resource when the
+   VM is starting.
+
+2. Register IO handler(s). IO handlers allow a function to handle stage-2 faults
+   from the virtual machine.
+
+Sample Userspace VMM
+====================
+
+A sample userspace VMM is included in samples/gunyah/ along with a minimal
+devicetree that can be used to launch a VM. To build this sample, enable
+CONFIG_SAMPLE_GUNYAH.
+
+IOCTLs and userspace VMM flows
+==============================
+
+The kernel exposes a char device interface at /dev/gunyah.
+
+To create a VM, use the `GH_CREATE_VM`_ ioctl. A successful call will return a
+"Gunyah VM" file descriptor.
+
+/dev/gunyah API Descriptions
+----------------------------
+
+GH_CREATE_VM
+~~~~~~~~~~~~
+
+Creates a Gunyah VM. The argument is reserved for future use and must be 0.
+A successful call will return a Gunyah VM file descriptor. See
+`Gunyah VM API Descriptions`_ for list of IOCTLs that can be made on this file
+file descriptor.
+
+Gunyah VM API Descriptions
+--------------------------
+
+GH_VM_SET_USER_MEM_REGION
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This ioctl allows the user to create or delete a memory parcel for a guest
+virtual machine. Each memory region is uniquely identified by a label;
+attempting to create two regions with the same label is not allowed. Labels are
+unique per virtual machine.
+
+While VMM is guest-agnostic and allows runtime addition of memory regions,
+Linux guest virtual machines do not support accepting memory regions at runtime.
+Thus, for Linux guests, memory regions should be provided before starting the VM
+and the VM must be configured via the devicetree to accept these at boot-up.
+
+The guest physical address is used by Linux kernel to check that the requested
+user regions do not overlap and to help find the corresponding memory region
+for calls like `GH_VM_SET_DTB_CONFIG`_. It must be page aligned.
+
+To add a memory region, call `GH_VM_SET_USER_MEM_REGION`_ with fields set as
+described above.
+
+.. kernel-doc:: include/uapi/linux/gunyah.h
+   :identifiers: gh_userspace_memory_region gh_mem_flags
+
+GH_VM_SET_DTB_CONFIG
+~~~~~~~~~~~~~~~~~~~~
+
+This ioctl sets the location of the VM's devicetree blob and is used by Gunyah
+Resource Manager to allocate resources. The guest physical memory must be part
+of the primary memory parcel provided to the VM prior to GH_VM_START.
+
+.. kernel-doc:: include/uapi/linux/gunyah.h
+   :identifiers: gh_vm_dtb_config
+
+GH_VM_START
+~~~~~~~~~~~
+
+This ioctl starts the VM.
+
+GH_VM_ADD_FUNCTION
+~~~~~~~~~~~~~~~~~~
+
+This ioctl registers a Gunyah VM function with the VM manager. The VM function
+is described with a &struct gh_fn_desc.type and some arguments for that type.
+Typically, the function is added before the VM starts, but the function doesn't
+"operate" until the VM starts with `GH_VM_START`_. For example, vCPU ioctls will
+all return an error until the VM starts because the vCPUs don't exist until the
+VM is started. This allows the VMM to set up all the kernel functions needed for
+the VM *before* the VM starts.
+
+.. kernel-doc:: include/uapi/linux/gunyah.h
+   :identifiers: gh_fn_desc gh_fn_type
+
+The argument types are documented below:
+
+.. kernel-doc:: include/uapi/linux/gunyah.h
+   :identifiers: gh_fn_vcpu_arg gh_fn_irqfd_arg gh_irqfd_flags gh_fn_ioeventfd_arg gh_ioeventfd_flags
+
+Gunyah VCPU API Descriptions
+----------------------------
+
+A vCPU file descriptor is created after calling `GH_VM_ADD_FUNCTION` with the type `GH_FN_VCPU`.
+
+GH_VCPU_RUN
+~~~~~~~~~~~
+
+This ioctl is used to run a guest virtual cpu.  While there are no
+explicit parameters, there is an implicit parameter block that can be
+obtained by mmap()ing the vcpu fd at offset 0, with the size given by
+`GH_VCPU_MMAP_SIZE`_. The parameter block is formatted as a 'struct
+gh_vcpu_run' (see below).
+
+GH_VCPU_MMAP_SIZE
+~~~~~~~~~~~~~~~~~
+
+The `GH_VCPU_RUN`_ ioctl communicates with userspace via a shared
+memory region. This ioctl returns the size of that region. See the
+`GH_VCPU_RUN`_ documentation for details.
+
+.. kernel-doc:: include/uapi/linux/gunyah.h
+   :identifiers: gh_vcpu_exit gh_vcpu_run gh_vm_status gh_vm_exit_info
--- linux-qcom-6.8.0.orig/Documentation/virt/index.rst
+++ linux-qcom-6.8.0/Documentation/virt/index.rst
@@ -16,6 +16,7 @@
    coco/sev-guest
    coco/tdx-guest
    hyperv/index
+   gunyah/index
 
 .. only:: html and subproject
 
--- linux-qcom-6.8.0.orig/Documentation/virt/kvm/api.rst
+++ linux-qcom-6.8.0/Documentation/virt/kvm/api.rst
@@ -1403,6 +1403,12 @@
 was a load or a store, instruction abort if it was an instruction
 fetch) is injected in the guest.
 
+S390:
+^^^^^
+
+Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set.
+Returns -EINVAL if called on a protected VM.
+
 4.36 KVM_SET_TSS_ADDR
 ---------------------
 
@@ -2439,8 +2445,11 @@
   PPC     KVM_REG_PPC_PSSCR               64
   PPC     KVM_REG_PPC_DEC_EXPIRY          64
   PPC     KVM_REG_PPC_PTCR                64
+  PPC     KVM_REG_PPC_HASHKEYR            64
+  PPC     KVM_REG_PPC_HASHPKEYR           64
   PPC     KVM_REG_PPC_DAWR1               64
   PPC     KVM_REG_PPC_DAWRX1              64
+  PPC     KVM_REG_PPC_DEXCR               64
   PPC     KVM_REG_PPC_TM_GPR0             64
   ...
   PPC     KVM_REG_PPC_TM_GPR31            64
@@ -6244,6 +6253,12 @@
 is '0' for all gfns.  Userspace can control whether memory is shared/private by
 toggling KVM_MEMORY_ATTRIBUTE_PRIVATE via KVM_SET_MEMORY_ATTRIBUTES as needed.
 
+S390:
+^^^^^
+
+Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set.
+Returns -EINVAL if called on a protected VM.
+
 4.141 KVM_SET_MEMORY_ATTRIBUTES
 -------------------------------
 
--- linux-qcom-6.8.0.orig/Documentation/virt/kvm/locking.rst
+++ linux-qcom-6.8.0/Documentation/virt/kvm/locking.rst
@@ -9,7 +9,7 @@
 
 The acquisition orders for mutexes are as follows:
 
-- cpus_read_lock() is taken outside kvm_lock
+- cpus_read_lock() is taken outside kvm_lock and kvm_usage_lock
 
 - kvm->lock is taken outside vcpu->mutex
 
@@ -24,6 +24,13 @@
   are taken on the waiting side when modifying memslots, so MMU notifiers
   must not take either kvm->slots_lock or kvm->slots_arch_lock.
 
+cpus_read_lock() vs kvm_lock:
+
+- Taking cpus_read_lock() outside of kvm_lock is problematic, despite that
+  being the official ordering, as it is quite easy to unknowingly trigger
+  cpus_read_lock() while holding kvm_lock.  Use caution when walking vm_list,
+  e.g. avoid complex operations when possible.
+
 For SRCU:
 
 - ``synchronize_srcu(&kvm->srcu)`` is called inside critical sections
@@ -227,10 +234,17 @@
 :Type:		mutex
 :Arch:		any
 :Protects:	- vm_list
-		- kvm_usage_count
+
+``kvm_usage_lock``
+^^^^^^^^^^^^^^^^^^
+
+:Type:		mutex
+:Arch:		any
+:Protects:	- kvm_usage_count
 		- hardware virtualization enable/disable
-:Comment:	KVM also disables CPU hotplug via cpus_read_lock() during
-		enable/disable.
+:Comment:	Exists because using kvm_lock leads to deadlock (see earlier comment
+		on cpus_read_lock() vs kvm_lock).  Note, KVM also disables CPU hotplug via
+		cpus_read_lock() when enabling/disabling virtualization.
 
 ``kvm->mn_invalidate_lock``
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
@@ -290,11 +304,12 @@
 		wakeup.
 
 ``vendor_module_lock``
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+^^^^^^^^^^^^^^^^^^^^^^
 :Type:		mutex
 :Arch:		x86
 :Protects:	loading a vendor module (kvm_amd or kvm_intel)
-:Comment:	Exists because using kvm_lock leads to deadlock.  cpu_hotplug_lock is
-    taken outside of kvm_lock, e.g. in KVM's CPU online/offline callbacks, and
-    many operations need to take cpu_hotplug_lock when loading a vendor module,
-    e.g. updating static calls.
+:Comment:	Exists because using kvm_lock leads to deadlock.  kvm_lock is taken
+    in notifiers, e.g. __kvmclock_cpufreq_notifier(), that may be invoked while
+    cpu_hotplug_lock is held, e.g. from cpufreq_boost_trigger_state(), and many
+    operations need to take cpu_hotplug_lock when loading a vendor module, e.g.
+    updating static calls.
--- linux-qcom-6.8.0.orig/Kbuild
+++ linux-qcom-6.8.0/Kbuild
@@ -97,3 +97,4 @@
 obj-$(CONFIG_NET)	+= net/
 obj-y			+= virt/
 obj-y			+= $(ARCH_DRIVERS)
+obj-y			+= ubuntu/
--- linux-qcom-6.8.0.orig/Kconfig
+++ linux-qcom-6.8.0/Kconfig
@@ -19,6 +19,8 @@
 
 source "drivers/Kconfig"
 
+source "ubuntu/Kconfig"
+
 source "fs/Kconfig"
 
 source "security/Kconfig"
--- linux-qcom-6.8.0.orig/MAINTAINERS
+++ linux-qcom-6.8.0/MAINTAINERS
@@ -190,6 +190,18 @@
 F:	Documentation/devicetree/bindings/power/supply/*ab8500*
 F:	drivers/power/supply/*ab8500*
 
+AAEON DEVICE DRIVER WITH WMI INTERFACE
+M:	Edward Lin<edward1_lin@asus.com>
+M:	Kunyang Fan <kunyang_fan@asus.com>
+M:	Frank Hsieh <frank2_hsieh@asus.com>
+M:	Jacob Wu <jacob_wu@asus.com>
+S:	Supported
+F:	drivers/gpio/gpio-aaeon.c
+F:	drivers/hwmon/hwmon-aaeon.c
+F:	drivers/leds/leds-aaeon.c
+F:	drivers/mfd/mfd-aaeon.c
+F:	drivers/watchdog/wdt_aaeon.c
+
 ABI/API
 L:	linux-api@vger.kernel.org
 F:	include/linux/syscalls.h
@@ -1054,7 +1066,6 @@
 S:	Supported
 F:	Documentation/admin-guide/pm/amd-pstate.rst
 F:	drivers/cpufreq/amd-pstate*
-F:	include/linux/amd-pstate.h
 F:	tools/power/x86/amd_pstate_tracer/amd_pstate_trace.py
 
 AMD PTDMA DRIVER
@@ -2591,7 +2602,7 @@
 F:	drivers/mfd/ssbi.c
 F:	drivers/mmc/host/mmci_qcom*
 F:	drivers/mmc/host/sdhci-msm.c
-F:	drivers/pci/controller/dwc/pcie-qcom.c
+F:	drivers/pci/controller/dwc/pcie-qcom*
 F:	drivers/phy/qualcomm/
 F:	drivers/power/*/msm*
 F:	drivers/reset/reset-qcom-*
@@ -10389,6 +10400,14 @@
 S:	Maintained
 F:	drivers/media/rc/iguanair.c
 
+IIO BACKEND FRAMEWORK
+M:	Nuno Sa <nuno.sa@analog.com>
+R:	Olivier Moysan <olivier.moysan@foss.st.com>
+L:	linux-iio@vger.kernel.org
+S:	Maintained
+F:	drivers/iio/industrialio-backend.c
+F:	include/linux/iio/backend.h
+
 IIO DIGITAL POTENTIOMETER DAC
 M:	Peter Rosin <peda@axentia.se>
 L:	linux-iio@vger.kernel.org
@@ -12192,6 +12211,12 @@
 W:	http://legousb.sourceforge.net/
 F:	drivers/usb/misc/legousbtower.c
 
+LENOVO WMI HOTKEY UTILITIES DRIVER
+M:	Jackie Dong <xy-jackie@139.com>
+L:	platform-driver-x86@vger.kernel.org
+S:	Maintained
+F:	drivers/platform/x86/lenovo-wmi-hotkey-utilities.c
+
 LETSKETCH HID TABLET DRIVER
 M:	Hans de Goede <hdegoede@redhat.com>
 L:	linux-input@vger.kernel.org
@@ -14048,7 +14073,7 @@
 M:	"Paul E. McKenney" <paulmck@kernel.org>
 L:	linux-kernel@vger.kernel.org
 S:	Supported
-F:	arch/powerpc/include/asm/membarrier.h
+F:	arch/*/include/asm/membarrier.h
 F:	include/uapi/linux/membarrier.h
 F:	kernel/sched/membarrier.c
 
@@ -16960,6 +16985,14 @@
 F:	drivers/pci/p2pdma.c
 F:	include/linux/pci-p2pdma.h
 
+PCI POWER CONTROL
+M:	Bartosz Golaszewski <brgl@bgdev.pl>
+L:	linux-pci@vger.kernel.org
+S:	Maintained
+T:	git git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci.git
+F:	drivers/pci/pwrctl/*
+F:	include/linux/pci-pwrctl.h
+
 PCI SUBSYSTEM
 M:	Bjorn Helgaas <bhelgaas@google.com>
 L:	linux-pci@vger.kernel.org
@@ -17066,6 +17099,7 @@
 L:	linux-pci@vger.kernel.org
 L:	linux-arm-msm@vger.kernel.org
 S:	Maintained
+F:	drivers/pci/controller/dwc/pcie-qcom-common.c
 F:	drivers/pci/controller/dwc/pcie-qcom.c
 
 PCIE DRIVER FOR ROCKCHIP
@@ -17095,6 +17129,7 @@
 L:	linux-arm-msm@vger.kernel.org
 S:	Maintained
 F:	Documentation/devicetree/bindings/pci/qcom,pcie-ep.yaml
+F:	drivers/pci/controller/dwc/pcie-qcom-common.c
 F:	drivers/pci/controller/dwc/pcie-qcom-ep.c
 
 PCMCIA SUBSYSTEM
@@ -17531,6 +17566,14 @@
 F:	include/linux/powercap.h
 F:	kernel/configs/nopm.config
 
+POWER SEQUENCING
+M:	Bartosz Golaszewski <brgl@bgdev.pl>
+L:	linux-pm@vger.kernel.org
+S:	Maintained
+T:	git git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git
+F:	drivers/power/sequencing/
+F:	include/linux/pwrseq/
+
 POWER STATE COORDINATION INTERFACE (PSCI)
 M:	Mark Rutland <mark.rutland@arm.com>
 M:	Lorenzo Pieralisi <lpieralisi@kernel.org>
@@ -18083,6 +18126,13 @@
 F:	Documentation/devicetree/bindings/power/avs/qcom,cpr.yaml
 F:	drivers/pmdomain/qcom/cpr.c
 
+QUALCOMM CPUCP MAILBOX DRIVER
+M:	Sibi Sankar <quic_sibis@quicinc.com>
+L:	linux-arm-msm@vger.kernel.org
+S:	Supported
+F:	Documentation/devicetree/bindings/mailbox/qcom,cpucp-mbox.yaml
+F:	drivers/mailbox/qcom-cpucp-mbox.c
+
 QUALCOMM CPUFREQ DRIVER MSM8996/APQ8096
 M:	Ilia Lin <ilia.lin@kernel.org>
 L:	linux-pm@vger.kernel.org
@@ -18223,6 +18273,14 @@
 F:	drivers/net/ethernet/qualcomm/rmnet/
 F:	include/linux/if_rmnet.h
 
+QUALCOMM TRUST ZONE MEMORY ALLOCATOR
+M:	Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+L:	linux-arm-msm@vger.kernel.org
+S:	Maintained
+F:	drivers/firmware/qcom/qcom_tzmem.c
+F:	drivers/firmware/qcom/qcom_tzmem.h
+F:	include/linux/firmware/qcom/qcom_tzmem.h
+
 QUALCOMM TSENS THERMAL DRIVER
 M:	Amit Kucheria <amitk@kernel.org>
 M:	Thara Gopinath <thara.gopinath@gmail.com>
--- linux-qcom-6.8.0.orig/Makefile
+++ linux-qcom-6.8.0/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 8
-SUBLEVEL = 0
+SUBLEVEL = 12
 EXTRAVERSION =
 NAME = Hurr durr I'ma ninja sloth
 
@@ -549,6 +549,9 @@
 		-I$(objtree)/include \
 		$(USERINCLUDE)
 
+# UBUNTU: Include our third party driver stuff too
+LINUXINCLUDE   += -I$(srctree)/ubuntu/include
+
 KBUILD_AFLAGS   := -D__ASSEMBLY__ -fno-PIE
 
 KBUILD_CFLAGS :=
@@ -943,7 +946,6 @@
 ifdef CONFIG_LTO_CLANG
 ifdef CONFIG_LTO_CLANG_THIN
 CC_FLAGS_LTO	:= -flto=thin -fsplit-lto-unit
-KBUILD_LDFLAGS	+= --thinlto-cache-dir=$(extmod_prefix).thinlto-cache
 else
 CC_FLAGS_LTO	:= -flto
 endif
@@ -1278,8 +1280,9 @@
 quiet_cmd_headers_install = INSTALL $(INSTALL_HDR_PATH)/include
       cmd_headers_install = \
 	mkdir -p $(INSTALL_HDR_PATH); \
-	rsync -mrl --include='*/' --include='*\.h' --exclude='*' \
-	usr/include $(INSTALL_HDR_PATH)
+	find usr/include -type f -name '*.h' -print0 | \
+	tar -czf - --null --no-recursion --no-wildcards-match-slash -T- | \
+	tar -xzf - --strip-components=1 -C $(INSTALL_HDR_PATH)
 
 PHONY += headers_install
 headers_install: headers
@@ -1294,6 +1297,7 @@
 	$(if $(filter um, $(SRCARCH)), $(error Headers not exportable for UML))
 	$(Q)$(MAKE) $(hdr-inst)=include/uapi
 	$(Q)$(MAKE) $(hdr-inst)=arch/$(SRCARCH)/include/uapi
+	$(Q)$(MAKE) $(hdr-inst)=ubuntu/include dst=include oldheaders=
 
 ifdef CONFIG_HEADERS_INSTALL
 prepare: headers
@@ -1479,13 +1483,13 @@
 # Directories & files removed with 'make clean'
 CLEAN_FILES += vmlinux.symvers modules-only.symvers \
 	       modules.builtin modules.builtin.modinfo modules.nsdeps \
-	       compile_commands.json .thinlto-cache rust/test \
+	       compile_commands.json rust/test \
 	       rust-project.json .vmlinux.objs .vmlinux.export.c
 
 # Directories & files removed with 'make mrproper'
 MRPROPER_FILES += include/config include/generated          \
 		  arch/$(SRCARCH)/include/generated .objdiff \
-		  debian snap tar-install \
+		  snap tar-install \
 		  .config .config.old .version \
 		  Module.symvers \
 		  certs/signing_key.pem \
@@ -1785,7 +1789,7 @@
 
 clean-dirs := $(KBUILD_EXTMOD)
 clean: rm-files := $(KBUILD_EXTMOD)/Module.symvers $(KBUILD_EXTMOD)/modules.nsdeps \
-	$(KBUILD_EXTMOD)/compile_commands.json $(KBUILD_EXTMOD)/.thinlto-cache
+	$(KBUILD_EXTMOD)/compile_commands.json
 
 PHONY += prepare
 # now expand this into a simple variable to reduce the cost of shell evaluations
--- linux-qcom-6.8.0.orig/Ubuntu.md
+++ linux-qcom-6.8.0/Ubuntu.md
@@ -0,0 +1,8 @@
+Name:    linux-qcom
+Version: 6.8.0
+Series:  24.04 (noble)
+Description:
+    This is the source code for the Ubuntu linux kernel for the 24.04 series. This
+    source tree is used to produce the flavours: qcom.
+    This kernel is configured to support the widest range of desktop, laptop and
+    server configurations.
--- linux-qcom-6.8.0.orig/arch/Kconfig
+++ linux-qcom-6.8.0/arch/Kconfig
@@ -9,6 +9,14 @@
 #
 source "arch/$(SRCARCH)/Kconfig"
 
+config ARCH_CONFIGURES_CPU_MITIGATIONS
+	bool
+
+if !ARCH_CONFIGURES_CPU_MITIGATIONS
+config CPU_MITIGATIONS
+	def_bool y
+endif
+
 menu "General architecture-dependent options"
 
 config ARCH_HAS_SUBPAGE_FAULTS
--- linux-qcom-6.8.0.orig/arch/arc/Kconfig
+++ linux-qcom-6.8.0/arch/arc/Kconfig
@@ -292,7 +292,6 @@
 
 config ARC_PAGE_SIZE_4K
 	bool "4KB"
-	depends on ARC_MMU_V3 || ARC_MMU_V4
 
 endchoice
 
@@ -469,7 +468,8 @@
 
 config ARC_HAS_PAE40
 	bool "Support for the 40-bit Physical Address Extension"
-	depends on ISA_ARCV2
+	depends on MMU_V4
+	depends on !ARC_PAGE_SIZE_4K
 	select HIGHMEM
 	select PHYS_ADDR_T_64BIT
 	help
--- linux-qcom-6.8.0.orig/arch/arc/Makefile
+++ linux-qcom-6.8.0/arch/arc/Makefile
@@ -6,7 +6,7 @@
 KBUILD_DEFCONFIG := haps_hs_smp_defconfig
 
 ifeq ($(CROSS_COMPILE),)
-CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux-)
+CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux- arc-linux-gnu-)
 endif
 
 cflags-y	+= -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
--- linux-qcom-6.8.0.orig/arch/arc/boot/dts/hsdk.dts
+++ linux-qcom-6.8.0/arch/arc/boot/dts/hsdk.dts
@@ -205,7 +205,6 @@
 		};
 
 		gmac: ethernet@8000 {
-			#interrupt-cells = <1>;
 			compatible = "snps,dwmac";
 			reg = <0x8000 0x2000>;
 			interrupts = <10>;
--- linux-qcom-6.8.0.orig/arch/arc/kernel/devtree.c
+++ linux-qcom-6.8.0/arch/arc/kernel/devtree.c
@@ -62,7 +62,7 @@
 	const struct machine_desc *mdesc;
 	unsigned long dt_root;
 
-	if (!early_init_dt_scan(dt))
+	if (!early_init_dt_scan(dt, __pa(dt)))
 		return NULL;
 
 	mdesc = of_flat_dt_match_machine(NULL, arch_get_next_mach);
--- linux-qcom-6.8.0.orig/arch/arm/Kconfig
+++ linux-qcom-6.8.0/arch/arm/Kconfig
@@ -29,7 +29,7 @@
 	select ARCH_HAVE_NMI_SAFE_CMPXCHG if CPU_V7 || CPU_V7M || CPU_V6K
 	select ARCH_HAS_GCOV_PROFILE_ALL
 	select ARCH_KEEP_MEMBLOCK
-	select ARCH_HAS_UBSAN_SANITIZE_ALL
+	select ARCH_HAS_UBSAN
 	select ARCH_MIGHT_HAVE_PC_PARPORT
 	select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX
 	select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7
@@ -503,8 +503,8 @@
 
 config IWMMXT
 	bool "Enable iWMMXt support"
-	depends on CPU_XSCALE || CPU_XSC3 || CPU_MOHAWK || CPU_PJ4 || CPU_PJ4B
-	default y if PXA27x || PXA3xx || ARCH_MMP || CPU_PJ4 || CPU_PJ4B
+	depends on CPU_XSCALE || CPU_XSC3 || CPU_MOHAWK
+	default y if PXA27x || PXA3xx || ARCH_MMP
 	help
 	  Enable support for iWMMXt context switching at run time if
 	  running on a CPU that supports it.
--- linux-qcom-6.8.0.orig/arch/arm/Makefile
+++ linux-qcom-6.8.0/arch/arm/Makefile
@@ -59,6 +59,9 @@
 #
 KBUILD_CFLAGS	+= $(call cc-option,-fno-ipa-sra)
 
+# Need -msoft-float for gcc 11 for the below instruction set selection
+KBUILD_CFLAGS	+= -msoft-float
+
 # This selects which instruction set is used.
 arch-$(CONFIG_CPU_32v7M)	:=-march=armv7-m
 arch-$(CONFIG_CPU_32v7)		:=-march=armv7-a
@@ -141,7 +144,7 @@
 
 # Need -Uarm for gcc < 3.x
 KBUILD_CPPFLAGS	+=$(cpp-y)
-KBUILD_CFLAGS	+=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm
+KBUILD_CFLAGS	+=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -Uarm
 KBUILD_AFLAGS	+=$(CFLAGS_ABI) $(AFLAGS_ISA) -Wa,$(arch-y) $(tune-y) -include asm/unified.h -msoft-float
 
 CHECKFLAGS	+= -D__arm__
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/allwinner/Makefile
+++ linux-qcom-6.8.0/arch/arm/boot/dts/allwinner/Makefile
@@ -260,68 +260,6 @@
 	sun8i-v3s-licheepi-zero.dtb \
 	sun8i-v3s-licheepi-zero-dock.dtb \
 	sun8i-v40-bananapi-m2-berry.dtb
-dtb-$(CONFIG_MACH_SUN8I) += \
-	sun8i-a23-evb.dtb \
-	sun8i-a23-gt90h-v4.dtb \
-	sun8i-a23-inet86dz.dtb \
-	sun8i-a23-ippo-q8h-v5.dtb \
-	sun8i-a23-ippo-q8h-v1.2.dtb \
-	sun8i-a23-polaroid-mid2407pxe03.dtb \
-	sun8i-a23-polaroid-mid2809pxe04.dtb \
-	sun8i-a23-q8-tablet.dtb \
-	sun8i-a33-et-q8-v1.6.dtb \
-	sun8i-a33-ga10h-v1.1.dtb \
-	sun8i-a33-inet-d978-rev2.dtb \
-	sun8i-a33-ippo-q8h-v1.2.dtb \
-	sun8i-a33-olinuxino.dtb \
-	sun8i-a33-q8-tablet.dtb \
-	sun8i-a33-sinlinx-sina33.dtb \
-	sun8i-a83t-allwinner-h8homlet-v2.dtb \
-	sun8i-a83t-bananapi-m3.dtb \
-	sun8i-a83t-cubietruck-plus.dtb \
-	sun8i-a83t-tbs-a711.dtb \
-	sun8i-h2-plus-bananapi-m2-zero.dtb \
-	sun8i-h2-plus-libretech-all-h3-cc.dtb \
-	sun8i-h2-plus-orangepi-r1.dtb \
-	sun8i-h2-plus-orangepi-zero.dtb \
-	sun8i-h3-bananapi-m2-plus.dtb \
-	sun8i-h3-bananapi-m2-plus-v1.2.dtb \
-	sun8i-h3-beelink-x2.dtb \
-	sun8i-h3-libretech-all-h3-cc.dtb \
-	sun8i-h3-mapleboard-mp130.dtb \
-	sun8i-h3-nanopi-duo2.dtb \
-	sun8i-h3-nanopi-m1.dtb\
-	\
-	sun8i-h3-nanopi-m1-plus.dtb \
-	sun8i-h3-nanopi-neo.dtb \
-	sun8i-h3-nanopi-neo-air.dtb \
-	sun8i-h3-nanopi-r1.dtb \
-	sun8i-h3-orangepi-2.dtb \
-	sun8i-h3-orangepi-lite.dtb \
-	sun8i-h3-orangepi-one.dtb \
-	sun8i-h3-orangepi-pc.dtb \
-	sun8i-h3-orangepi-pc-plus.dtb \
-	sun8i-h3-orangepi-plus.dtb \
-	sun8i-h3-orangepi-plus2e.dtb \
-	sun8i-h3-orangepi-zero-plus2.dtb \
-	sun8i-h3-rervision-dvk.dtb \
-	sun8i-h3-zeropi.dtb \
-	sun8i-h3-emlid-neutis-n5h3-devboard.dtb \
-	sun8i-r16-bananapi-m2m.dtb \
-	sun8i-r16-nintendo-nes-classic.dtb \
-	sun8i-r16-nintendo-super-nes-classic.dtb \
-	sun8i-r16-parrot.dtb \
-	sun8i-r40-bananapi-m2-ultra.dtb \
-	sun8i-r40-oka40i-c.dtb \
-	sun8i-s3-elimo-initium.dtb \
-	sun8i-s3-lichee-zero-plus.dtb \
-	sun8i-s3-pinecube.dtb \
-	sun8i-t113s-mangopi-mq-r-t113.dtb \
-	sun8i-t3-cqa3t-bv3.dtb \
-	sun8i-v3-sl631-imx179.dtb \
-	sun8i-v3s-licheepi-zero.dtb \
-	sun8i-v3s-licheepi-zero-dock.dtb \
-	sun8i-v40-bananapi-m2-berry.dtb
 dtb-$(CONFIG_MACH_SUN9I) += \
 	sun9i-a80-optimus.dtb \
 	sun9i-a80-cubieboard4.dtb
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/allwinner/sun9i-a80-cubieboard4.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/allwinner/sun9i-a80-cubieboard4.dts
@@ -280,8 +280,8 @@
 
 			reg_dcdc5: dcdc5 {
 				regulator-always-on;
-				regulator-min-microvolt = <1425000>;
-				regulator-max-microvolt = <1575000>;
+				regulator-min-microvolt = <1450000>;
+				regulator-max-microvolt = <1550000>;
 				regulator-name = "vcc-dram";
 			};
 
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/arm/arm-realview-pb1176.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/arm/arm-realview-pb1176.dts
@@ -451,7 +451,7 @@
 
 		/* Direct-mapped development chip ROM */
 		pb1176_rom@10200000 {
-			compatible = "direct-mapped";
+			compatible = "mtd-rom";
 			reg = <0x10200000 0x4000>;
 			bank-width = <1>;
 		};
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/broadcom/bcm2837-rpi-cm3-io3.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/broadcom/bcm2837-rpi-cm3-io3.dts
@@ -77,7 +77,7 @@
 };
 
 &hdmi {
-	hpd-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
 	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/marvell/mmp2-brownstone.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/marvell/mmp2-brownstone.dts
@@ -28,7 +28,7 @@
 &twsi1 {
 	status = "okay";
 	pmic: max8925@3c {
-		compatible = "maxium,max8925";
+		compatible = "maxim,max8925";
 		reg = <0x3c>;
 		interrupts = <1>;
 		interrupt-parent = <&intcmux4>;
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/microchip/at91-sama7g5ek.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/microchip/at91-sama7g5ek.dts
@@ -293,7 +293,7 @@
 
 					regulator-state-standby {
 						regulator-on-in-suspend;
-						regulator-suspend-voltage = <1150000>;
+						regulator-suspend-microvolt = <1150000>;
 						regulator-mode = <4>;
 					};
 
@@ -314,7 +314,7 @@
 
 					regulator-state-standby {
 						regulator-on-in-suspend;
-						regulator-suspend-voltage = <1050000>;
+						regulator-suspend-microvolt = <1050000>;
 						regulator-mode = <4>;
 					};
 
@@ -331,7 +331,7 @@
 					regulator-always-on;
 
 					regulator-state-standby {
-						regulator-suspend-voltage = <1800000>;
+						regulator-suspend-microvolt = <1800000>;
 						regulator-on-in-suspend;
 					};
 
@@ -346,7 +346,7 @@
 					regulator-max-microvolt = <3700000>;
 
 					regulator-state-standby {
-						regulator-suspend-voltage = <1800000>;
+						regulator-suspend-microvolt = <1800000>;
 						regulator-on-in-suspend;
 					};
 
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/microchip/sam9x60.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/microchip/sam9x60.dtsi
@@ -186,6 +186,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 13>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -384,6 +385,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 32>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -433,6 +435,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 33>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -590,6 +593,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 9>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -639,6 +643,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 10>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -688,6 +693,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 11>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -737,6 +743,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 5>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -805,6 +812,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 6>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -873,6 +881,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 7>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -941,6 +950,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 8>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -1064,6 +1074,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 15>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -1113,6 +1124,7 @@
 					dma-names = "tx", "rx";
 					clocks = <&pmc PMC_TYPE_PERIPHERAL 16>;
 					clock-names = "usart";
+					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
 					atmel,use-dma-rx;
 					atmel,use-dma-tx;
 					atmel,fifo-size = <16>;
@@ -1312,7 +1324,7 @@
 				compatible = "microchip,sam9x60-rtt", "atmel,at91sam9260-rtt";
 				reg = <0xfffffe20 0x20>;
 				interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>;
-				clocks = <&clk32k 0>;
+				clocks = <&clk32k 1>;
 			};
 
 			pit: timer@fffffe40 {
@@ -1338,7 +1350,7 @@
 				compatible = "microchip,sam9x60-rtc", "atmel,at91sam9x5-rtc";
 				reg = <0xfffffea8 0x100>;
 				interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>;
-				clocks = <&clk32k 0>;
+				clocks = <&clk32k 1>;
 			};
 
 			watchdog: watchdog@ffffff80 {
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/microchip/sama7g5.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/microchip/sama7g5.dtsi
@@ -272,7 +272,7 @@
 			compatible = "microchip,sama7g5-rtt", "microchip,sam9x60-rtt", "atmel,at91sam9260-rtt";
 			reg = <0xe001d020 0x30>;
 			interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&clk32k 0>;
+			clocks = <&clk32k 1>;
 		};
 
 		clk32k: clock-controller@e001d050 {
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi
@@ -117,17 +117,9 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 
-		phy_port2: phy@1 {
-			reg = <1>;
-		};
-
-		phy_port3: phy@2 {
-			reg = <2>;
-		};
-
 		switch@10 {
 			compatible = "qca,qca8334";
-			reg = <10>;
+			reg = <0x10>;
 			reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>;
 
 			switch_ports: ports {
@@ -149,15 +141,30 @@
 				eth2: port@2 {
 					reg = <2>;
 					label = "eth2";
+					phy-mode = "internal";
 					phy-handle = <&phy_port2>;
 				};
 
 				eth1: port@3 {
 					reg = <3>;
 					label = "eth1";
+					phy-mode = "internal";
 					phy-handle = <&phy_port3>;
 				};
 			};
+
+			mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				phy_port2: ethernet-phy@1 {
+					reg = <1>;
+				};
+
+				phy_port3: ethernet-phy@2 {
+					reg = <2>;
+				};
+			};
 		};
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi
@@ -274,24 +274,24 @@
 
 		led@0 {
 			chan-name = "R";
-			led-cur = /bits/ 8 <0x20>;
-			max-cur = /bits/ 8 <0x60>;
+			led-cur = /bits/ 8 <0x6e>;
+			max-cur = /bits/ 8 <0xc8>;
 			reg = <0>;
 			color = <LED_COLOR_ID_RED>;
 		};
 
 		led@1 {
 			chan-name = "G";
-			led-cur = /bits/ 8 <0x20>;
-			max-cur = /bits/ 8 <0x60>;
+			led-cur = /bits/ 8 <0xbe>;
+			max-cur = /bits/ 8 <0xc8>;
 			reg = <1>;
 			color = <LED_COLOR_ID_GREEN>;
 		};
 
 		led@2 {
 			chan-name = "B";
-			led-cur = /bits/ 8 <0x20>;
-			max-cur = /bits/ 8 <0x60>;
+			led-cur = /bits/ 8 <0xbe>;
+			max-cur = /bits/ 8 <0xc8>;
 			reg = <2>;
 			color = <LED_COLOR_ID_BLUE>;
 		};
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/nxp/imx/imx6q-kontron-samx6i.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/nxp/imx/imx6q-kontron-samx6i.dtsi
@@ -5,31 +5,8 @@
 
 #include "imx6q.dtsi"
 #include "imx6qdl-kontron-samx6i.dtsi"
-#include <dt-bindings/gpio/gpio.h>
 
 / {
 	model = "Kontron SMARC sAMX6i Quad/Dual";
 	compatible = "kontron,imx6q-samx6i", "fsl,imx6q";
 };
-
-/* Quad/Dual SoMs have 3 chip-select signals */
-&ecspi4 {
-	cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>,
-		   <&gpio3 29 GPIO_ACTIVE_LOW>,
-		   <&gpio3 25 GPIO_ACTIVE_LOW>;
-};
-
-&pinctrl_ecspi4 {
-	fsl,pins = <
-		MX6QDL_PAD_EIM_D21__ECSPI4_SCLK 0x100b1
-		MX6QDL_PAD_EIM_D28__ECSPI4_MOSI 0x100b1
-		MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1
-
-		/* SPI4_IMX_CS2# - connected to internal flash */
-		MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0
-		/* SPI4_IMX_CS0# - connected to SMARC SPI0_CS0# */
-		MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0
-		/* SPI4_CS3# - connected to  SMARC SPI0_CS1# */
-		MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0
-	>;
-};
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi
@@ -244,7 +244,8 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_ecspi4>;
 	cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>,
-		   <&gpio3 29 GPIO_ACTIVE_LOW>;
+		   <&gpio3 29 GPIO_ACTIVE_LOW>,
+		   <&gpio3 25 GPIO_ACTIVE_LOW>;
 	status = "okay";
 
 	/* default boot source: workaround #1 for errata ERR006282 */
@@ -259,7 +260,7 @@
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
+	phy-connection-type = "rgmii-id";
 	phy-handle = <&ethphy>;
 
 	mdio {
@@ -269,7 +270,7 @@
 		ethphy: ethernet-phy@1 {
 			compatible = "ethernet-phy-ieee802.3-c22";
 			reg = <1>;
-			reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>;
+			reset-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
 			reset-assert-us = <1000>;
 		};
 	};
@@ -464,6 +465,8 @@
 			MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0
 			/* SPI_IMX_CS0# - connected to SMARC SPI0_CS0# */
 			MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0
+			/* SPI4_CS3# - connected to SMARC SPI0_CS1# */
+			MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0
 		>;
 	};
 
@@ -516,7 +519,7 @@
 			MX6QDL_PAD_ENET_MDIO__ENET_MDIO       0x1b0b0
 			MX6QDL_PAD_ENET_MDC__ENET_MDC         0x1b0b0
 			MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK  0x1b0b0
-			MX6QDL_PAD_ENET_CRS_DV__GPIO1_IO25    0x1b0b0 /* RST_GBE0_PHY# */
+			MX6QDL_PAD_NANDF_D1__GPIO2_IO01       0x1b0b0 /* RST_GBE0_PHY# */
 		>;
 	};
 
@@ -729,7 +732,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_pcie>;
 	wake-up-gpio = <&gpio6 18 GPIO_ACTIVE_HIGH>;
-	reset-gpio = <&gpio3 13 GPIO_ACTIVE_HIGH>;
+	reset-gpio = <&gpio3 13 GPIO_ACTIVE_LOW>;
 };
 
 /* LCD_BKLT_PWM */
@@ -817,5 +820,6 @@
 	/* CPLD is feeded by watchdog (hardwired) */
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_wdog1>;
+	fsl,ext-reset-output;
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/nxp/imx/imx6ul-geam.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/nxp/imx/imx6ul-geam.dts
@@ -366,7 +366,7 @@
 	};
 
 	pinctrl_tsc: tscgrp {
-		fsl,pin = <
+		fsl,pins = <
 			MX6UL_PAD_GPIO1_IO01__GPIO1_IO01	0xb0
 			MX6UL_PAD_GPIO1_IO02__GPIO1_IO02	0xb0
 			MX6UL_PAD_GPIO1_IO03__GPIO1_IO03	0xb0
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/nxp/imx/imx6ull-tarragon-common.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/nxp/imx/imx6ull-tarragon-common.dtsi
@@ -805,6 +805,7 @@
 		     &pinctrl_usb_pwr>;
 	dr_mode = "host";
 	power-active-high;
+	over-current-active-low;
 	disable-over-current;
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/nxp/imx/imx7d-zii-rmu2.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/nxp/imx/imx7d-zii-rmu2.dts
@@ -350,7 +350,7 @@
 
 &iomuxc_lpsr {
 	pinctrl_enet1_phy_interrupt: enet1phyinterruptgrp {
-		fsl,phy = <
+		fsl,pins = <
 			MX7D_PAD_LPSR_GPIO1_IO02__GPIO1_IO2	0x08
 		>;
 	};
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/nxp/imx/imx7s-warp.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/nxp/imx/imx7s-warp.dts
@@ -210,6 +210,7 @@
 				remote-endpoint = <&mipi_from_sensor>;
 				clock-lanes = <0>;
 				data-lanes = <1>;
+				link-frequencies = /bits/ 64 <330000000>;
 			};
 		};
 	};
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi
@@ -87,7 +87,7 @@
 			reg = <0x402c0000 0x4000>;
 			interrupts = <110>;
 			clocks = <&clks IMXRT1050_CLK_IPG_PDOF>,
-				<&clks IMXRT1050_CLK_OSC>,
+				<&clks IMXRT1050_CLK_AHB_PODF>,
 				<&clks IMXRT1050_CLK_USDHC1>;
 			clock-names = "ipg", "ahb", "per";
 			bus-width = <4>;
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/qcom/qcom-msm8226-microsoft-common.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/qcom/qcom-msm8226-microsoft-common.dtsi
@@ -287,6 +287,10 @@
 	status = "okay";
 };
 
+&smbb {
+	status = "okay";
+};
+
 &usb {
 	extcon = <&smbb>;
 	dr_mode = "peripheral";
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi
@@ -1234,7 +1234,7 @@
 
 		qfprom: qfprom@fc4bc000 {
 			compatible = "qcom,msm8974-qfprom", "qcom,qfprom";
-			reg = <0xfc4bc000 0x1000>;
+			reg = <0xfc4bc000 0x2100>;
 			#address-cells = <1>;
 			#size-cells = <1>;
 
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi
@@ -580,12 +580,16 @@
 					  <&gcc GCC_USB30_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 51 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 11 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq", "ss_phy_irq",
-					  "dm_hs_phy_irq", "dp_hs_phy_irq";
+					      <&pdc 51 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq",
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_GDSC>;
 
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi
@@ -501,14 +501,16 @@
 					  <&gcc GCC_USB30_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 76 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 19 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 18 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 19 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq",
-					  "ss_phy_irq",
+					      <&pdc 76 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
-					  "dp_hs_phy_irq";
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_GDSC>;
 
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
@@ -53,7 +53,7 @@
 
 			partition@4000000 {
 				label = "user1";
-				reg = <0x04000000 0x40000000>;
+				reg = <0x04000000 0x04000000>;
 			};
 		};
 	};
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts
@@ -209,6 +209,18 @@
 	status = "okay";
 };
 
+&extal1_clk {
+	clock-frequency = <26000000>;
+};
+
+&extal2_clk {
+	clock-frequency = <48000000>;
+};
+
+&extalr_clk {
+	clock-frequency = <32768>;
+};
+
 &pfc {
 	scifa0_pins: scifa0 {
 		groups = "scifa0_data";
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/renesas/r8a73a4.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/renesas/r8a73a4.dtsi
@@ -450,17 +450,20 @@
 		extalr_clk: extalr {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
-			clock-frequency = <32768>;
+			/* This value must be overridden by the board. */
+			clock-frequency = <0>;
 		};
 		extal1_clk: extal1 {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
-			clock-frequency = <25000000>;
+			/* This value must be overridden by the board. */
+			clock-frequency = <0>;
 		};
 		extal2_clk: extal2 {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
-			clock-frequency = <48000000>;
+			/* This value must be overridden by the board. */
+			clock-frequency = <0>;
 		};
 		fsiack_clk: fsiack {
 			compatible = "fixed-clock";
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/rockchip/rk3036-kylin.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/rockchip/rk3036-kylin.dts
@@ -325,8 +325,8 @@
 &i2c2 {
 	status = "okay";
 
-	rt5616: rt5616@1b {
-		compatible = "rt5616";
+	rt5616: audio-codec@1b {
+		compatible = "realtek,rt5616";
 		reg = <0x1b>;
 		clocks = <&cru SCLK_I2S_OUT>;
 		clock-names = "mclk";
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/rockchip/rk3036.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/rockchip/rk3036.dtsi
@@ -384,12 +384,13 @@
 		};
 	};
 
-	acodec: acodec-ana@20030000 {
-		compatible = "rk3036-codec";
+	acodec: audio-codec@20030000 {
+		compatible = "rockchip,rk3036-codec";
 		reg = <0x20030000 0x4000>;
-		rockchip,grf = <&grf>;
 		clock-names = "acodec_pclk";
 		clocks = <&cru PCLK_ACODEC>;
+		rockchip,grf = <&grf>;
+		#sound-dai-cells = <0>;
 		status = "disabled";
 	};
 
@@ -399,7 +400,6 @@
 		interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&cru  PCLK_HDMI>;
 		clock-names = "pclk";
-		rockchip,grf = <&grf>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&hdmi_ctl>;
 		status = "disabled";
@@ -552,11 +552,11 @@
 	};
 
 	spi: spi@20074000 {
-		compatible = "rockchip,rockchip-spi";
+		compatible = "rockchip,rk3036-spi";
 		reg = <0x20074000 0x1000>;
 		interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
-		clocks = <&cru PCLK_SPI>, <&cru SCLK_SPI>;
-		clock-names = "apb-pclk","spi_pclk";
+		clocks = <&cru SCLK_SPI>, <&cru PCLK_SPI>;
+		clock-names = "spiclk", "apb_pclk";
 		dmas = <&pdma 8>, <&pdma 9>;
 		dma-names = "tx", "rx";
 		pinctrl-names = "default";
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/rockchip/rk3066a.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/rockchip/rk3066a.dtsi
@@ -128,6 +128,7 @@
 		pinctrl-0 = <&hdmii2c_xfer>, <&hdmi_hpd>;
 		power-domains = <&power RK3066_PD_VIO>;
 		rockchip,grf = <&grf>;
+		#sound-dai-cells = <0>;
 		status = "disabled";
 
 		ports {
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/rockchip/rk322x.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/rockchip/rk322x.dtsi
@@ -736,14 +736,20 @@
 		status = "disabled";
 
 		ports {
-			hdmi_in: port {
-				#address-cells = <1>;
-				#size-cells = <0>;
-				hdmi_in_vop: endpoint@0 {
-					reg = <0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hdmi_in: port@0 {
+				reg = <0>;
+
+				hdmi_in_vop: endpoint {
 					remote-endpoint = <&vop_out_hdmi>;
 				};
 			};
+
+			hdmi_out: port@1 {
+				reg = <1>;
+			};
 		};
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/rockchip/rk3288.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/rockchip/rk3288.dtsi
@@ -1240,27 +1240,37 @@
 		compatible = "rockchip,rk3288-dw-hdmi";
 		reg = <0x0 0xff980000 0x0 0x20000>;
 		reg-io-width = <4>;
-		#sound-dai-cells = <0>;
-		rockchip,grf = <&grf>;
 		interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&cru  PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>, <&cru SCLK_HDMI_CEC>;
 		clock-names = "iahb", "isfr", "cec";
 		power-domains = <&power RK3288_PD_VIO>;
+		rockchip,grf = <&grf>;
+		#sound-dai-cells = <0>;
 		status = "disabled";
 
 		ports {
-			hdmi_in: port {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hdmi_in: port@0 {
+				reg = <0>;
 				#address-cells = <1>;
 				#size-cells = <0>;
+
 				hdmi_in_vopb: endpoint@0 {
 					reg = <0>;
 					remote-endpoint = <&vopb_out_hdmi>;
 				};
+
 				hdmi_in_vopl: endpoint@1 {
 					reg = <1>;
 					remote-endpoint = <&vopl_out_hdmi>;
 				};
 			};
+
+			hdmi_out: port@1 {
+				reg = <1>;
+			};
 		};
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/samsung/exynos4210-smdkv310.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/samsung/exynos4210-smdkv310.dts
@@ -88,7 +88,7 @@
 &keypad {
 	samsung,keypad-num-rows = <2>;
 	samsung,keypad-num-columns = <8>;
-	linux,keypad-no-autorepeat;
+	linux,input-no-autorepeat;
 	wakeup-source;
 	pinctrl-names = "default";
 	pinctrl-0 = <&keypad_rows &keypad_cols>;
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/samsung/exynos4412-origen.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/samsung/exynos4412-origen.dts
@@ -453,7 +453,7 @@
 &keypad {
 	samsung,keypad-num-rows = <3>;
 	samsung,keypad-num-columns = <2>;
-	linux,keypad-no-autorepeat;
+	linux,input-no-autorepeat;
 	wakeup-source;
 	pinctrl-0 = <&keypad_rows &keypad_cols>;
 	pinctrl-names = "default";
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/samsung/exynos4412-smdk4412.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/samsung/exynos4412-smdk4412.dts
@@ -69,7 +69,7 @@
 &keypad {
 	samsung,keypad-num-rows = <3>;
 	samsung,keypad-num-columns = <8>;
-	linux,keypad-no-autorepeat;
+	linux,input-no-autorepeat;
 	wakeup-source;
 	pinctrl-0 = <&keypad_rows &keypad_cols>;
 	pinctrl-names = "default";
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/st/stm32mp151.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/st/stm32mp151.dtsi
@@ -50,6 +50,7 @@
 			     <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>,
 			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>;
 		interrupt-parent = <&intc>;
+		arm,no-tick-in-suspend;
 	};
 
 	clocks {
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/ti/omap/omap3-n900.dts
+++ linux-qcom-6.8.0/arch/arm/boot/dts/ti/omap/omap3-n900.dts
@@ -781,7 +781,7 @@
 
 		mount-matrix =	 "-1",  "0",  "0",
 				  "0",  "1",  "0",
-				  "0",  "0",  "1";
+				  "0",  "0",  "-1";
 	};
 
 	cam1: camera@3e {
--- linux-qcom-6.8.0.orig/arch/arm/boot/dts/ti/omap/omap36xx.dtsi
+++ linux-qcom-6.8.0/arch/arm/boot/dts/ti/omap/omap36xx.dtsi
@@ -72,6 +72,7 @@
 					 <1375000 1375000 1375000>;
 			/* only on am/dm37x with speed-binned bit set */
 			opp-supported-hw = <0xffffffff 2>;
+			turbo-mode;
 		};
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm/configs/sunxi_defconfig
+++ linux-qcom-6.8.0/arch/arm/configs/sunxi_defconfig
@@ -110,6 +110,7 @@
 CONFIG_DRM_PANEL_SIMPLE=y
 CONFIG_DRM_PANEL_EDP=y
 CONFIG_DRM_SIMPLE_BRIDGE=y
+CONFIG_DRM_DW_HDMI=y
 CONFIG_DRM_LIMA=y
 CONFIG_FB_SIMPLE=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
--- linux-qcom-6.8.0.orig/arch/arm/crypto/aes-ce-glue.c
+++ linux-qcom-6.8.0/arch/arm/crypto/aes-ce-glue.c
@@ -711,7 +711,7 @@
 		algname = aes_algs[i].base.cra_name + 2;
 		drvname = aes_algs[i].base.cra_driver_name + 2;
 		basename = aes_algs[i].base.cra_driver_name;
-		simd = simd_skcipher_create_compat(algname, drvname, basename);
+		simd = simd_skcipher_create_compat(aes_algs + i, algname, drvname, basename);
 		err = PTR_ERR(simd);
 		if (IS_ERR(simd))
 			goto unregister_simds;
--- linux-qcom-6.8.0.orig/arch/arm/crypto/aes-neonbs-glue.c
+++ linux-qcom-6.8.0/arch/arm/crypto/aes-neonbs-glue.c
@@ -539,7 +539,7 @@
 		algname = aes_algs[i].base.cra_name + 2;
 		drvname = aes_algs[i].base.cra_driver_name + 2;
 		basename = aes_algs[i].base.cra_driver_name;
-		simd = simd_skcipher_create_compat(algname, drvname, basename);
+		simd = simd_skcipher_create_compat(aes_algs + i, algname, drvname, basename);
 		err = PTR_ERR(simd);
 		if (IS_ERR(simd))
 			goto unregister_simds;
--- linux-qcom-6.8.0.orig/arch/arm/crypto/sha256_glue.c
+++ linux-qcom-6.8.0/arch/arm/crypto/sha256_glue.c
@@ -24,8 +24,8 @@
 
 #include "sha256_glue.h"
 
-asmlinkage void sha256_block_data_order(u32 *digest, const void *data,
-					unsigned int num_blks);
+asmlinkage void sha256_block_data_order(struct sha256_state *state,
+					const u8 *data, int num_blks);
 
 int crypto_sha256_arm_update(struct shash_desc *desc, const u8 *data,
 			     unsigned int len)
@@ -33,23 +33,20 @@
 	/* make sure casting to sha256_block_fn() is safe */
 	BUILD_BUG_ON(offsetof(struct sha256_state, state) != 0);
 
-	return sha256_base_do_update(desc, data, len,
-				(sha256_block_fn *)sha256_block_data_order);
+	return sha256_base_do_update(desc, data, len, sha256_block_data_order);
 }
 EXPORT_SYMBOL(crypto_sha256_arm_update);
 
 static int crypto_sha256_arm_final(struct shash_desc *desc, u8 *out)
 {
-	sha256_base_do_finalize(desc,
-				(sha256_block_fn *)sha256_block_data_order);
+	sha256_base_do_finalize(desc, sha256_block_data_order);
 	return sha256_base_finish(desc, out);
 }
 
 int crypto_sha256_arm_finup(struct shash_desc *desc, const u8 *data,
 			    unsigned int len, u8 *out)
 {
-	sha256_base_do_update(desc, data, len,
-			      (sha256_block_fn *)sha256_block_data_order);
+	sha256_base_do_update(desc, data, len, sha256_block_data_order);
 	return crypto_sha256_arm_final(desc, out);
 }
 EXPORT_SYMBOL(crypto_sha256_arm_finup);
--- linux-qcom-6.8.0.orig/arch/arm/crypto/sha512-glue.c
+++ linux-qcom-6.8.0/arch/arm/crypto/sha512-glue.c
@@ -25,27 +25,25 @@
 MODULE_ALIAS_CRYPTO("sha384-arm");
 MODULE_ALIAS_CRYPTO("sha512-arm");
 
-asmlinkage void sha512_block_data_order(u64 *state, u8 const *src, int blocks);
+asmlinkage void sha512_block_data_order(struct sha512_state *state,
+					u8 const *src, int blocks);
 
 int sha512_arm_update(struct shash_desc *desc, const u8 *data,
 		      unsigned int len)
 {
-	return sha512_base_do_update(desc, data, len,
-		(sha512_block_fn *)sha512_block_data_order);
+	return sha512_base_do_update(desc, data, len, sha512_block_data_order);
 }
 
 static int sha512_arm_final(struct shash_desc *desc, u8 *out)
 {
-	sha512_base_do_finalize(desc,
-		(sha512_block_fn *)sha512_block_data_order);
+	sha512_base_do_finalize(desc, sha512_block_data_order);
 	return sha512_base_finish(desc, out);
 }
 
 int sha512_arm_finup(struct shash_desc *desc, const u8 *data,
 		     unsigned int len, u8 *out)
 {
-	sha512_base_do_update(desc, data, len,
-		(sha512_block_fn *)sha512_block_data_order);
+	sha512_base_do_update(desc, data, len, sha512_block_data_order);
 	return sha512_arm_final(desc, out);
 }
 
--- linux-qcom-6.8.0.orig/arch/arm/include/asm/mman.h
+++ linux-qcom-6.8.0/arch/arm/include/asm/mman.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __ASM_MMAN_H__
+#define __ASM_MMAN_H__
+
+#include <asm/system_info.h>
+#include <uapi/asm/mman.h>
+
+static inline bool arch_memory_deny_write_exec_supported(void)
+{
+	return cpu_architecture() >= CPU_ARCH_ARMv6;
+}
+#define arch_memory_deny_write_exec_supported arch_memory_deny_write_exec_supported
+
+#endif /* __ASM_MMAN_H__ */
--- linux-qcom-6.8.0.orig/arch/arm/kernel/Makefile
+++ linux-qcom-6.8.0/arch/arm/kernel/Makefile
@@ -75,8 +75,6 @@
 obj-$(CONFIG_CPU_XSCALE)	+= xscale-cp0.o
 obj-$(CONFIG_CPU_XSC3)		+= xscale-cp0.o
 obj-$(CONFIG_CPU_MOHAWK)	+= xscale-cp0.o
-obj-$(CONFIG_CPU_PJ4)		+= pj4-cp0.o
-obj-$(CONFIG_CPU_PJ4B)		+= pj4-cp0.o
 obj-$(CONFIG_IWMMXT)		+= iwmmxt.o
 obj-$(CONFIG_PERF_EVENTS)	+= perf_regs.o perf_callchain.o
 obj-$(CONFIG_HW_PERF_EVENTS)	+= perf_event_xscale.o perf_event_v6.o \
--- linux-qcom-6.8.0.orig/arch/arm/kernel/devtree.c
+++ linux-qcom-6.8.0/arch/arm/kernel/devtree.c
@@ -200,7 +200,7 @@
 
 	mdesc_best = &__mach_desc_GENERIC_DT;
 
-	if (!dt_virt || !early_init_dt_verify(dt_virt))
+	if (!dt_virt || !early_init_dt_verify(dt_virt, __pa(dt_virt)))
 		return NULL;
 
 	mdesc = of_flat_dt_match_machine(mdesc_best, arch_get_next_mach);
--- linux-qcom-6.8.0.orig/arch/arm/kernel/entry-armv.S
+++ linux-qcom-6.8.0/arch/arm/kernel/entry-armv.S
@@ -25,6 +25,7 @@
 #include <asm/tls.h>
 #include <asm/system_info.h>
 #include <asm/uaccess-asm.h>
+#include <asm/kasan_def.h>
 
 #include "entry-header.S"
 #include <asm/probes.h>
@@ -555,6 +556,13 @@
 	@ entries covering the vmalloc region.
 	@
 	ldr	r2, [ip]
+#ifdef CONFIG_KASAN_VMALLOC
+	@ Also dummy read from the KASAN shadow memory for the new stack if we
+	@ are using KASAN
+	mov_l	r2, KASAN_SHADOW_OFFSET
+	add	r2, r2, ip, lsr #KASAN_SHADOW_SCALE_SHIFT
+	ldr	r2, [r2]
+#endif
 #endif
 
 	@ When CONFIG_THREAD_INFO_IN_TASK=n, the update of SP itself is what
--- linux-qcom-6.8.0.orig/arch/arm/kernel/head.S
+++ linux-qcom-6.8.0/arch/arm/kernel/head.S
@@ -252,18 +252,23 @@
 	 */
 	add	r0, r4, #KERNEL_OFFSET >> (SECTION_SHIFT - PMD_ENTRY_ORDER)
 	ldr	r6, =(_end - 1)
+
+	/* For XIP, kernel_sec_start/kernel_sec_end are currently in RO memory */
+#ifndef CONFIG_XIP_KERNEL
 	adr_l	r5, kernel_sec_start		@ _pa(kernel_sec_start)
 #if defined CONFIG_CPU_ENDIAN_BE8 || defined CONFIG_CPU_ENDIAN_BE32
 	str	r8, [r5, #4]			@ Save physical start of kernel (BE)
 #else
 	str	r8, [r5]			@ Save physical start of kernel (LE)
 #endif
+#endif
 	orr	r3, r8, r7			@ Add the MMU flags
 	add	r6, r4, r6, lsr #(SECTION_SHIFT - PMD_ENTRY_ORDER)
 1:	str	r3, [r0], #1 << PMD_ENTRY_ORDER
 	add	r3, r3, #1 << SECTION_SHIFT
 	cmp	r0, r6
 	bls	1b
+#ifndef CONFIG_XIP_KERNEL
 	eor	r3, r3, r7			@ Remove the MMU flags
 	adr_l	r5, kernel_sec_end		@ _pa(kernel_sec_end)
 #if defined CONFIG_CPU_ENDIAN_BE8 || defined CONFIG_CPU_ENDIAN_BE32
@@ -271,8 +276,7 @@
 #else
 	str	r3, [r5]			@ Save physical end of kernel (LE)
 #endif
-
-#ifdef CONFIG_XIP_KERNEL
+#else
 	/*
 	 * Map the kernel image separately as it is not located in RAM.
 	 */
@@ -407,7 +411,11 @@
 	/*
 	 * Use the page tables supplied from  __cpu_up.
 	 */
+#ifdef CONFIG_XIP_KERNEL
+	ldr	r3, =(secondary_data + PLAT_PHYS_OFFSET - PAGE_OFFSET)
+#else
 	adr_l	r3, secondary_data
+#endif
 	mov_l	r12, __secondary_switched
 	ldrd	r4, r5, [r3, #0]		@ get secondary_data.pgdir
 ARM_BE8(eor	r4, r4, r5)			@ Swap r5 and r4 in BE:
--- linux-qcom-6.8.0.orig/arch/arm/kernel/iwmmxt.S
+++ linux-qcom-6.8.0/arch/arm/kernel/iwmmxt.S
@@ -18,18 +18,6 @@
 #include <asm/assembler.h>
 #include "iwmmxt.h"
 
-#if defined(CONFIG_CPU_PJ4) || defined(CONFIG_CPU_PJ4B)
-#define PJ4(code...)		code
-#define XSC(code...)
-#elif defined(CONFIG_CPU_MOHAWK) || \
-	defined(CONFIG_CPU_XSC3) || \
-	defined(CONFIG_CPU_XSCALE)
-#define PJ4(code...)
-#define XSC(code...)		code
-#else
-#error "Unsupported iWMMXt architecture"
-#endif
-
 #define MMX_WR0		 	(0x00)
 #define MMX_WR1		 	(0x08)
 #define MMX_WR2		 	(0x10)
@@ -81,17 +69,13 @@
 ENTRY(iwmmxt_task_enable)
 	inc_preempt_count r10, r3
 
-	XSC(mrc	p15, 0, r2, c15, c1, 0)
-	PJ4(mrc p15, 0, r2, c1, c0, 2)
+	mrc	p15, 0, r2, c15, c1, 0
 	@ CP0 and CP1 accessible?
-	XSC(tst	r2, #0x3)
-	PJ4(tst	r2, #0xf)
+	tst	r2, #0x3
 	bne	4f				@ if so no business here
 	@ enable access to CP0 and CP1
-	XSC(orr	r2, r2, #0x3)
-	XSC(mcr	p15, 0, r2, c15, c1, 0)
-	PJ4(orr	r2, r2, #0xf)
-	PJ4(mcr	p15, 0, r2, c1, c0, 2)
+	orr	r2, r2, #0x3
+	mcr	p15, 0, r2, c15, c1, 0
 
 	ldr	r3, =concan_owner
 	ldr	r2, [r0, #S_PC]			@ current task pc value
@@ -218,12 +202,9 @@
 	bne	1f				@ no: quit
 
 	@ enable access to CP0 and CP1
-	XSC(mrc	p15, 0, r4, c15, c1, 0)
-	XSC(orr	r4, r4, #0x3)
-	XSC(mcr	p15, 0, r4, c15, c1, 0)
-	PJ4(mrc p15, 0, r4, c1, c0, 2)
-	PJ4(orr	r4, r4, #0xf)
-	PJ4(mcr	p15, 0, r4, c1, c0, 2)
+	mrc	p15, 0, r4, c15, c1, 0
+	orr	r4, r4, #0x3
+	mcr	p15, 0, r4, c15, c1, 0
 
 	mov	r0, #0				@ nothing to load
 	str	r0, [r3]			@ no more current owner
@@ -232,10 +213,8 @@
 	bl	concan_save
 
 	@ disable access to CP0 and CP1
-	XSC(bic	r4, r4, #0x3)
-	XSC(mcr	p15, 0, r4, c15, c1, 0)
-	PJ4(bic	r4, r4, #0xf)
-	PJ4(mcr	p15, 0, r4, c1, c0, 2)
+	bic	r4, r4, #0x3
+	mcr	p15, 0, r4, c15, c1, 0
 
 	mrc	p15, 0, r2, c2, c0, 0
 	mov	r2, r2				@ cpwait
@@ -330,11 +309,9 @@
  */
 ENTRY(iwmmxt_task_switch)
 
-	XSC(mrc	p15, 0, r1, c15, c1, 0)
-	PJ4(mrc	p15, 0, r1, c1, c0, 2)
+	mrc	p15, 0, r1, c15, c1, 0
 	@ CP0 and CP1 accessible?
-	XSC(tst	r1, #0x3)
-	PJ4(tst	r1, #0xf)
+	tst	r1, #0x3
 	bne	1f				@ yes: block them for next task
 
 	ldr	r2, =concan_owner
@@ -344,10 +321,8 @@
 	retne	lr				@ no: leave Concan disabled
 
 1:	@ flip Concan access
-	XSC(eor	r1, r1, #0x3)
-	XSC(mcr	p15, 0, r1, c15, c1, 0)
-	PJ4(eor r1, r1, #0xf)
-	PJ4(mcr	p15, 0, r1, c1, c0, 2)
+	eor	r1, r1, #0x3
+	mcr	p15, 0, r1, c15, c1, 0
 
 	mrc	p15, 0, r1, c2, c0, 0
 	sub	pc, lr, r1, lsr #32		@ cpwait and return
--- linux-qcom-6.8.0.orig/arch/arm/kernel/perf_callchain.c
+++ linux-qcom-6.8.0/arch/arm/kernel/perf_callchain.c
@@ -85,8 +85,7 @@
 callchain_trace(void *data, unsigned long pc)
 {
 	struct perf_callchain_entry_ctx *entry = data;
-	perf_callchain_store(entry, pc);
-	return true;
+	return perf_callchain_store(entry, pc) == 0;
 }
 
 void
--- linux-qcom-6.8.0.orig/arch/arm/kernel/psci_smp.c
+++ linux-qcom-6.8.0/arch/arm/kernel/psci_smp.c
@@ -45,8 +45,15 @@
 static int psci_boot_secondary(unsigned int cpu, struct task_struct *idle)
 {
 	if (psci_ops.cpu_on)
+#ifdef CONFIG_XIP_KERNEL
+		return psci_ops.cpu_on(cpu_logical_map(cpu),
+			((phys_addr_t)(&secondary_startup)
+			- XIP_VIRT_ADDR(CONFIG_XIP_PHYS_ADDR)
+			+ CONFIG_XIP_PHYS_ADDR));
+#else
 		return psci_ops.cpu_on(cpu_logical_map(cpu),
 					virt_to_idmap(&secondary_startup));
+#endif
 	return -ENODEV;
 }
 
--- linux-qcom-6.8.0.orig/arch/arm/kernel/sleep.S
+++ linux-qcom-6.8.0/arch/arm/kernel/sleep.S
@@ -127,6 +127,10 @@
 	instr_sync
 #endif
 	bl	cpu_init		@ restore the und/abt/irq banked regs
+#if defined(CONFIG_KASAN) && defined(CONFIG_KASAN_STACK)
+	mov	r0, sp
+	bl	kasan_unpoison_task_stack_below
+#endif
 	mov	r0, #0			@ return zero on success
 	ldmfd	sp!, {r4 - r11, pc}
 ENDPROC(cpu_resume_after_mmu)
--- linux-qcom-6.8.0.orig/arch/arm/kernel/traps.c
+++ linux-qcom-6.8.0/arch/arm/kernel/traps.c
@@ -569,6 +569,7 @@
 static inline int
 __do_cache_op(unsigned long start, unsigned long end)
 {
+	unsigned int ua_flags;
 	int ret;
 
 	do {
@@ -577,7 +578,9 @@
 		if (fatal_signal_pending(current))
 			return 0;
 
+		ua_flags = uaccess_save_and_enable();
 		ret = flush_icache_user_range(start, start + chunk);
+		uaccess_restore(ua_flags);
 		if (ret)
 			return ret;
 
--- linux-qcom-6.8.0.orig/arch/arm/mach-davinci/pm.c
+++ linux-qcom-6.8.0/arch/arm/mach-davinci/pm.c
@@ -61,7 +61,7 @@
 
 	/* Configure sleep count in deep sleep register */
 	val = __raw_readl(pm_config.deepsleep_reg);
-	val &= ~DEEPSLEEP_SLEEPCOUNT_MASK,
+	val &= ~DEEPSLEEP_SLEEPCOUNT_MASK;
 	val |= pm_config.sleepcount;
 	__raw_writel(val, pm_config.deepsleep_reg);
 
--- linux-qcom-6.8.0.orig/arch/arm/mach-ep93xx/clock.c
+++ linux-qcom-6.8.0/arch/arm/mach-ep93xx/clock.c
@@ -359,7 +359,7 @@
 	u32 val = __raw_readl(psc->reg);
 	u8 index = (val & psc->mask) >> psc->shift;
 
-	if (index > psc->num_div)
+	if (index >= psc->num_div)
 		return 0;
 
 	return DIV_ROUND_UP_ULL(parent_rate, psc->div[index]);
--- linux-qcom-6.8.0.orig/arch/arm/mach-omap2/board-n8x0.c
+++ linux-qcom-6.8.0/arch/arm/mach-omap2/board-n8x0.c
@@ -79,10 +79,8 @@
 static struct gpiod_lookup_table tusb_gpio_table = {
 	.dev_id = "musb-tusb",
 	.table = {
-		GPIO_LOOKUP("gpio-0-15", 0, "enable",
-			    GPIO_ACTIVE_HIGH),
-		GPIO_LOOKUP("gpio-48-63", 10, "int",
-			    GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("gpio-0-31", 0, "enable", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("gpio-32-63", 26, "int", GPIO_ACTIVE_HIGH),
 		{ }
 	},
 };
@@ -140,12 +138,11 @@
 static int slot2_cover_open;
 static struct device *mmc_device;
 
-static struct gpiod_lookup_table nokia8xx_mmc_gpio_table = {
+static struct gpiod_lookup_table nokia800_mmc_gpio_table = {
 	.dev_id = "mmci-omap.0",
 	.table = {
 		/* Slot switch, GPIO 96 */
-		GPIO_LOOKUP("gpio-80-111", 16,
-			    "switch", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("gpio-96-127", 0, "switch", GPIO_ACTIVE_HIGH),
 		{ }
 	},
 };
@@ -153,12 +150,12 @@
 static struct gpiod_lookup_table nokia810_mmc_gpio_table = {
 	.dev_id = "mmci-omap.0",
 	.table = {
+		/* Slot switch, GPIO 96 */
+		GPIO_LOOKUP("gpio-96-127", 0, "switch", GPIO_ACTIVE_HIGH),
 		/* Slot index 1, VSD power, GPIO 23 */
-		GPIO_LOOKUP_IDX("gpio-16-31", 7,
-				"vsd", 1, GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP_IDX("gpio-0-31", 23, "vsd", 1, GPIO_ACTIVE_HIGH),
 		/* Slot index 1, VIO power, GPIO 9 */
-		GPIO_LOOKUP_IDX("gpio-0-15", 9,
-				"vio", 1, GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP_IDX("gpio-0-31", 9, "vio", 1, GPIO_ACTIVE_HIGH),
 		{ }
 	},
 };
@@ -415,8 +412,6 @@
 
 static void __init n8x0_mmc_init(void)
 {
-	gpiod_add_lookup_table(&nokia8xx_mmc_gpio_table);
-
 	if (board_is_n810()) {
 		mmc1_data.slots[0].name = "external";
 
@@ -429,6 +424,8 @@
 		mmc1_data.slots[1].name = "internal";
 		mmc1_data.slots[1].ban_openended = 1;
 		gpiod_add_lookup_table(&nokia810_mmc_gpio_table);
+	} else {
+		gpiod_add_lookup_table(&nokia800_mmc_gpio_table);
 	}
 
 	mmc1_data.nr_slots = 2;
--- linux-qcom-6.8.0.orig/arch/arm/mach-pxa/spitz.c
+++ linux-qcom-6.8.0/arch/arm/mach-pxa/spitz.c
@@ -520,10 +520,8 @@
 static struct gpiod_lookup_table spitz_lcdcon_gpio_table = {
 	.dev_id = "spi2.1",
 	.table = {
-		GPIO_LOOKUP("gpio-pxa", SPITZ_GPIO_BACKLIGHT_CONT,
-			    "BL_CONT", GPIO_ACTIVE_LOW),
-		GPIO_LOOKUP("gpio-pxa", SPITZ_GPIO_BACKLIGHT_ON,
-			    "BL_ON", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sharp-scoop.1", 6, "BL_CONT", GPIO_ACTIVE_LOW),
+		GPIO_LOOKUP("sharp-scoop.1", 7, "BL_ON", GPIO_ACTIVE_HIGH),
 		{ },
 	},
 };
@@ -531,10 +529,8 @@
 static struct gpiod_lookup_table akita_lcdcon_gpio_table = {
 	.dev_id = "spi2.1",
 	.table = {
-		GPIO_LOOKUP("gpio-pxa", AKITA_GPIO_BACKLIGHT_CONT,
-			    "BL_CONT", GPIO_ACTIVE_LOW),
-		GPIO_LOOKUP("gpio-pxa", AKITA_GPIO_BACKLIGHT_ON,
-			    "BL_ON", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("i2c-max7310", 3, "BL_ON", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("i2c-max7310", 4, "BL_CONT", GPIO_ACTIVE_LOW),
 		{ },
 	},
 };
@@ -941,12 +937,9 @@
 static struct gpiod_lookup_table spitz_audio_gpio_table = {
 	.dev_id = "spitz-audio",
 	.table = {
-		GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_L - SPITZ_SCP_GPIO_BASE,
-			    "mute-l", GPIO_ACTIVE_HIGH),
-		GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_R - SPITZ_SCP_GPIO_BASE,
-			    "mute-r", GPIO_ACTIVE_HIGH),
-		GPIO_LOOKUP("sharp-scoop.1", SPITZ_GPIO_MIC_BIAS - SPITZ_SCP2_GPIO_BASE,
-			    "mic", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sharp-scoop.0", 3, "mute-l", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sharp-scoop.0", 4, "mute-r", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sharp-scoop.1", 8, "mic", GPIO_ACTIVE_HIGH),
 		{ },
 	},
 };
@@ -954,12 +947,9 @@
 static struct gpiod_lookup_table akita_audio_gpio_table = {
 	.dev_id = "spitz-audio",
 	.table = {
-		GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_L - SPITZ_SCP_GPIO_BASE,
-			    "mute-l", GPIO_ACTIVE_HIGH),
-		GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_R - SPITZ_SCP_GPIO_BASE,
-			    "mute-r", GPIO_ACTIVE_HIGH),
-		GPIO_LOOKUP("i2c-max7310", AKITA_GPIO_MIC_BIAS - AKITA_IOEXP_GPIO_BASE,
-			    "mic", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sharp-scoop.0", 3, "mute-l", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sharp-scoop.0", 4, "mute-r", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("i2c-max7310", 2, "mic", GPIO_ACTIVE_HIGH),
 		{ },
 	},
 };
--- linux-qcom-6.8.0.orig/arch/arm/mach-versatile/platsmp-realview.c
+++ linux-qcom-6.8.0/arch/arm/mach-versatile/platsmp-realview.c
@@ -70,6 +70,7 @@
 		return;
 	}
 	map = syscon_node_to_regmap(np);
+	of_node_put(np);
 	if (IS_ERR(map)) {
 		pr_err("PLATSMP: No syscon regmap\n");
 		return;
--- linux-qcom-6.8.0.orig/arch/arm/mm/flush.c
+++ linux-qcom-6.8.0/arch/arm/mm/flush.c
@@ -296,6 +296,9 @@
 		return;
 
 	folio = page_folio(pfn_to_page(pfn));
+	if (folio_test_reserved(folio))
+		return;
+
 	if (cache_is_vipt_aliasing())
 		mapping = folio_flush_mapping(folio);
 	else
--- linux-qcom-6.8.0.orig/arch/arm/mm/idmap.c
+++ linux-qcom-6.8.0/arch/arm/mm/idmap.c
@@ -84,8 +84,15 @@
 	unsigned long addr, end;
 	unsigned long next;
 
+#ifdef CONFIG_XIP_KERNEL
+	addr = (phys_addr_t)(text_start) - XIP_VIRT_ADDR(CONFIG_XIP_PHYS_ADDR)
+		+ CONFIG_XIP_PHYS_ADDR;
+	end = (phys_addr_t)(text_end) - XIP_VIRT_ADDR(CONFIG_XIP_PHYS_ADDR)
+		+ CONFIG_XIP_PHYS_ADDR;
+#else
 	addr = virt_to_idmap(text_start);
 	end = virt_to_idmap(text_end);
+#endif
 	pr_info("Setting up static identity map for 0x%lx - 0x%lx\n", addr, end);
 
 	prot |= PMD_TYPE_SECT | PMD_SECT_AP_WRITE | PMD_SECT_AF;
--- linux-qcom-6.8.0.orig/arch/arm/mm/ioremap.c
+++ linux-qcom-6.8.0/arch/arm/mm/ioremap.c
@@ -23,6 +23,7 @@
  */
 #include <linux/module.h>
 #include <linux/errno.h>
+#include <linux/kasan.h>
 #include <linux/mm.h>
 #include <linux/vmalloc.h>
 #include <linux/io.h>
@@ -115,16 +116,40 @@
 }
 EXPORT_SYMBOL(ioremap_page);
 
+#ifdef CONFIG_KASAN
+static unsigned long arm_kasan_mem_to_shadow(unsigned long addr)
+{
+	return (unsigned long)kasan_mem_to_shadow((void *)addr);
+}
+#else
+static unsigned long arm_kasan_mem_to_shadow(unsigned long addr)
+{
+	return 0;
+}
+#endif
+
+static void memcpy_pgd(struct mm_struct *mm, unsigned long start,
+		       unsigned long end)
+{
+	end = ALIGN(end, PGDIR_SIZE);
+	memcpy(pgd_offset(mm, start), pgd_offset_k(start),
+	       sizeof(pgd_t) * (pgd_index(end) - pgd_index(start)));
+}
+
 void __check_vmalloc_seq(struct mm_struct *mm)
 {
 	int seq;
 
 	do {
-		seq = atomic_read(&init_mm.context.vmalloc_seq);
-		memcpy(pgd_offset(mm, VMALLOC_START),
-		       pgd_offset_k(VMALLOC_START),
-		       sizeof(pgd_t) * (pgd_index(VMALLOC_END) -
-					pgd_index(VMALLOC_START)));
+		seq = atomic_read_acquire(&init_mm.context.vmalloc_seq);
+		memcpy_pgd(mm, VMALLOC_START, VMALLOC_END);
+		if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
+			unsigned long start =
+				arm_kasan_mem_to_shadow(VMALLOC_START);
+			unsigned long end =
+				arm_kasan_mem_to_shadow(VMALLOC_END);
+			memcpy_pgd(mm, start, end);
+		}
 		/*
 		 * Use a store-release so that other CPUs that observe the
 		 * counter's new value are guaranteed to see the results of the
--- linux-qcom-6.8.0.orig/arch/arm/mm/mmu.c
+++ linux-qcom-6.8.0/arch/arm/mm/mmu.c
@@ -1403,18 +1403,6 @@
 	}
 
 	/*
-	 * Map the kernel if it is XIP.
-	 * It is always first in the modulearea.
-	 */
-#ifdef CONFIG_XIP_KERNEL
-	map.pfn = __phys_to_pfn(CONFIG_XIP_PHYS_ADDR & SECTION_MASK);
-	map.virtual = MODULES_VADDR;
-	map.length = ((unsigned long)_exiprom - map.virtual + ~SECTION_MASK) & SECTION_MASK;
-	map.type = MT_ROM;
-	create_mapping(&map);
-#endif
-
-	/*
 	 * Map the cache flushing regions.
 	 */
 #ifdef FLUSH_BASE
@@ -1603,12 +1591,27 @@
 	 * This will only persist until we turn on proper memory management later on
 	 * and we remap the whole kernel with page granularity.
 	 */
+#ifdef CONFIG_XIP_KERNEL
+	phys_addr_t kernel_nx_start = kernel_sec_start;
+#else
 	phys_addr_t kernel_x_start = kernel_sec_start;
 	phys_addr_t kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
 	phys_addr_t kernel_nx_start = kernel_x_end;
+#endif
 	phys_addr_t kernel_nx_end = kernel_sec_end;
 	struct map_desc map;
 
+	/*
+	 * Map the kernel if it is XIP.
+	 * It is always first in the modulearea.
+	 */
+#ifdef CONFIG_XIP_KERNEL
+	map.pfn = __phys_to_pfn(CONFIG_XIP_PHYS_ADDR & SECTION_MASK);
+	map.virtual = MODULES_VADDR;
+	map.length = ((unsigned long)_exiprom - map.virtual + ~SECTION_MASK) & SECTION_MASK;
+	map.type = MT_ROM;
+	create_mapping(&map);
+#else
 	map.pfn = __phys_to_pfn(kernel_x_start);
 	map.virtual = __phys_to_virt(kernel_x_start);
 	map.length = kernel_x_end - kernel_x_start;
@@ -1618,7 +1621,7 @@
 	/* If the nx part is small it may end up covered by the tail of the RWX section */
 	if (kernel_x_end == kernel_nx_end)
 		return;
-
+#endif
 	map.pfn = __phys_to_pfn(kernel_nx_start);
 	map.virtual = __phys_to_virt(kernel_nx_start);
 	map.length = kernel_nx_end - kernel_nx_start;
@@ -1763,6 +1766,11 @@
 {
 	void *zero_page;
 
+#ifdef CONFIG_XIP_KERNEL
+	/* Store the kernel RW RAM region start/end in these variables */
+	kernel_sec_start = CONFIG_PHYS_OFFSET & SECTION_MASK;
+	kernel_sec_end = round_up(__pa(_end), SECTION_SIZE);
+#endif
 	pr_debug("physical kernel sections: 0x%08llx-0x%08llx\n",
 		 kernel_sec_start, kernel_sec_end);
 
--- linux-qcom-6.8.0.orig/arch/arm/mm/proc-v7.S
+++ linux-qcom-6.8.0/arch/arm/mm/proc-v7.S
@@ -93,7 +93,7 @@
 	ret	lr
 ENDPROC(cpu_v7_dcache_clean_area)
 
-#ifdef CONFIG_ARM_PSCI
+#if defined(CONFIG_ARM_PSCI) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
 	.arch_extension sec
 ENTRY(cpu_v7_smc_switch_mm)
 	stmfd	sp!, {r0 - r3}
--- linux-qcom-6.8.0.orig/arch/arm/net/bpf_jit_32.c
+++ linux-qcom-6.8.0/arch/arm/net/bpf_jit_32.c
@@ -871,16 +871,11 @@
 }
 
 /* dst = src (4 bytes)*/
-static inline void emit_a32_mov_r(const s8 dst, const s8 src, const u8 off,
-				  struct jit_ctx *ctx) {
+static inline void emit_a32_mov_r(const s8 dst, const s8 src, struct jit_ctx *ctx) {
 	const s8 *tmp = bpf2a32[TMP_REG_1];
 	s8 rt;
 
 	rt = arm_bpf_get_reg32(src, tmp[0], ctx);
-	if (off && off != 32) {
-		emit(ARM_LSL_I(rt, rt, 32 - off), ctx);
-		emit(ARM_ASR_I(rt, rt, 32 - off), ctx);
-	}
 	arm_bpf_put_reg32(dst, rt, ctx);
 }
 
@@ -889,15 +884,15 @@
 				  const s8 src[],
 				  struct jit_ctx *ctx) {
 	if (!is64) {
-		emit_a32_mov_r(dst_lo, src_lo, 0, ctx);
+		emit_a32_mov_r(dst_lo, src_lo, ctx);
 		if (!ctx->prog->aux->verifier_zext)
 			/* Zero out high 4 bytes */
 			emit_a32_mov_i(dst_hi, 0, ctx);
 	} else if (__LINUX_ARM_ARCH__ < 6 &&
 		   ctx->cpu_architecture < CPU_ARCH_ARMv5TE) {
 		/* complete 8 byte move */
-		emit_a32_mov_r(dst_lo, src_lo, 0, ctx);
-		emit_a32_mov_r(dst_hi, src_hi, 0, ctx);
+		emit_a32_mov_r(dst_lo, src_lo, ctx);
+		emit_a32_mov_r(dst_hi, src_hi, ctx);
 	} else if (is_stacked(src_lo) && is_stacked(dst_lo)) {
 		const u8 *tmp = bpf2a32[TMP_REG_1];
 
@@ -917,17 +912,52 @@
 static inline void emit_a32_movsx_r64(const bool is64, const u8 off, const s8 dst[], const s8 src[],
 				      struct jit_ctx *ctx) {
 	const s8 *tmp = bpf2a32[TMP_REG_1];
-	const s8 *rt;
+	s8 rs;
+	s8 rd;
 
-	rt = arm_bpf_get_reg64(dst, tmp, ctx);
+	if (is_stacked(dst_lo))
+		rd = tmp[1];
+	else
+		rd = dst_lo;
+	rs = arm_bpf_get_reg32(src_lo, rd, ctx);
+	/* rs may be one of src[1], dst[1], or tmp[1] */
+
+	/* Sign extend rs if needed. If off == 32, lower 32-bits of src are moved to dst and sign
+	 * extension only happens in the upper 64 bits.
+	 */
+	if (off != 32) {
+		/* Sign extend rs into rd */
+		emit(ARM_LSL_I(rd, rs, 32 - off), ctx);
+		emit(ARM_ASR_I(rd, rd, 32 - off), ctx);
+	} else {
+		rd = rs;
+	}
+
+	/* Write rd to dst_lo
+	 *
+	 * Optimization:
+	 * Assume:
+	 * 1. dst == src and stacked.
+	 * 2. off == 32
+	 *
+	 * In this case src_lo was loaded into rd(tmp[1]) but rd was not sign extended as off==32.
+	 * So, we don't need to write rd back to dst_lo as they have the same value.
+	 * This saves us one str instruction.
+	 */
+	if (dst_lo != src_lo || off != 32)
+		arm_bpf_put_reg32(dst_lo, rd, ctx);
 
-	emit_a32_mov_r(dst_lo, src_lo, off, ctx);
 	if (!is64) {
 		if (!ctx->prog->aux->verifier_zext)
 			/* Zero out high 4 bytes */
 			emit_a32_mov_i(dst_hi, 0, ctx);
 	} else {
-		emit(ARM_ASR_I(rt[0], rt[1], 31), ctx);
+		if (is_stacked(dst_hi)) {
+			emit(ARM_ASR_I(tmp[0], rd, 31), ctx);
+			arm_bpf_put_reg32(dst_hi, tmp[0], ctx);
+		} else {
+			emit(ARM_ASR_I(dst_hi, rd, 31), ctx);
+		}
 	}
 }
 
@@ -2222,28 +2252,21 @@
 	/* If building the body of the JITed code fails somehow,
 	 * we fall back to the interpretation.
 	 */
-	if (build_body(&ctx) < 0) {
-		image_ptr = NULL;
-		bpf_jit_binary_free(header);
-		prog = orig_prog;
-		goto out_imms;
-	}
+	if (build_body(&ctx) < 0)
+		goto out_free;
 	build_epilogue(&ctx);
 
 	/* 3.) Extra pass to validate JITed Code */
-	if (validate_code(&ctx)) {
-		image_ptr = NULL;
-		bpf_jit_binary_free(header);
-		prog = orig_prog;
-		goto out_imms;
-	}
+	if (validate_code(&ctx))
+		goto out_free;
 	flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx));
 
 	if (bpf_jit_enable > 1)
 		/* there are 2 passes here */
 		bpf_jit_dump(prog->len, image_size, 2, ctx.target);
 
-	bpf_jit_binary_lock_ro(header);
+	if (bpf_jit_binary_lock_ro(header))
+		goto out_free;
 	prog->bpf_func = (void *)ctx.target;
 	prog->jited = 1;
 	prog->jited_len = image_size;
@@ -2260,5 +2283,11 @@
 		bpf_jit_prog_release_other(prog, prog == orig_prog ?
 					   tmp : orig_prog);
 	return prog;
+
+out_free:
+	image_ptr = NULL;
+	bpf_jit_binary_free(header);
+	prog = orig_prog;
+	goto out_imms;
 }
 
--- linux-qcom-6.8.0.orig/arch/arm/vfp/vfpinstr.h
+++ linux-qcom-6.8.0/arch/arm/vfp/vfpinstr.h
@@ -64,33 +64,37 @@
 
 #ifdef CONFIG_AS_VFP_VMRS_FPINST
 
-#define fmrx(_vfp_) ({			\
-	u32 __v;			\
-	asm(".fpu	vfpv2\n"	\
-	    "vmrs	%0, " #_vfp_	\
-	    : "=r" (__v) : : "cc");	\
-	__v;				\
- })
-
-#define fmxr(_vfp_,_var_)		\
-	asm(".fpu	vfpv2\n"	\
-	    "vmsr	" #_vfp_ ", %0"	\
-	   : : "r" (_var_) : "cc")
+#define fmrx(_vfp_) ({				\
+	u32 __v;				\
+	asm volatile (".fpu	vfpv2\n"	\
+		      "vmrs	%0, " #_vfp_	\
+		     : "=r" (__v) : : "cc");	\
+	__v;					\
+})
+
+#define fmxr(_vfp_, _var_) ({			\
+	asm volatile (".fpu	vfpv2\n"	\
+		      "vmsr	" #_vfp_ ", %0"	\
+		     : : "r" (_var_) : "cc");	\
+})
 
 #else
 
 #define vfpreg(_vfp_) #_vfp_
 
-#define fmrx(_vfp_) ({			\
-	u32 __v;			\
-	asm("mrc p10, 7, %0, " vfpreg(_vfp_) ", cr0, 0 @ fmrx	%0, " #_vfp_	\
-	    : "=r" (__v) : : "cc");	\
-	__v;				\
- })
-
-#define fmxr(_vfp_,_var_)		\
-	asm("mcr p10, 7, %0, " vfpreg(_vfp_) ", cr0, 0 @ fmxr	" #_vfp_ ", %0"	\
-	   : : "r" (_var_) : "cc")
+#define fmrx(_vfp_) ({						\
+	u32 __v;						\
+	asm volatile ("mrc p10, 7, %0, " vfpreg(_vfp_) ","	\
+		      "cr0, 0 @ fmrx	%0, " #_vfp_		\
+		     : "=r" (__v) : : "cc");			\
+	__v;							\
+})
+
+#define fmxr(_vfp_, _var_) ({					\
+	asm volatile ("mcr p10, 7, %0, " vfpreg(_vfp_) ","	\
+		      "cr0, 0 @ fmxr	" #_vfp_ ", %0"		\
+		     : : "r" (_var_) : "cc");			\
+})
 
 #endif
 
--- linux-qcom-6.8.0.orig/arch/arm64/Kbuild
+++ linux-qcom-6.8.0/arch/arm64/Kbuild
@@ -3,6 +3,7 @@
 obj-$(CONFIG_KVM)	+= kvm/
 obj-$(CONFIG_XEN)	+= xen/
 obj-$(subst m,y,$(CONFIG_HYPERV))	+= hyperv/
+obj-$(CONFIG_GUNYAH)	+= gunyah/
 obj-$(CONFIG_CRYPTO)	+= crypto/
 
 # for cleaning
--- linux-qcom-6.8.0.orig/arch/arm64/Kconfig
+++ linux-qcom-6.8.0/arch/arm64/Kconfig
@@ -107,7 +107,7 @@
 	select ARCH_WANT_LD_ORPHAN_WARN
 	select ARCH_WANTS_NO_INSTR
 	select ARCH_WANTS_THP_SWAP if ARM64_4K_PAGES
-	select ARCH_HAS_UBSAN_SANITIZE_ALL
+	select ARCH_HAS_UBSAN
 	select ARM_AMBA
 	select ARM_ARCH_TIMER
 	select ARM_GIC
@@ -193,12 +193,13 @@
 	select HAVE_DMA_CONTIGUOUS
 	select HAVE_DYNAMIC_FTRACE
 	select HAVE_DYNAMIC_FTRACE_WITH_ARGS \
-		if $(cc-option,-fpatchable-function-entry=2)
+		if (GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS || \
+		    CLANG_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS)
 	select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS \
 		if DYNAMIC_FTRACE_WITH_ARGS && DYNAMIC_FTRACE_WITH_CALL_OPS
 	select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS \
 		if (DYNAMIC_FTRACE_WITH_ARGS && !CFI_CLANG && \
-		    !CC_OPTIMIZE_FOR_SIZE)
+		    (CC_IS_CLANG || !CC_OPTIMIZE_FOR_SIZE))
 	select FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY \
 		if DYNAMIC_FTRACE_WITH_ARGS
 	select HAVE_SAMPLE_FTRACE_DIRECT
@@ -264,12 +265,10 @@
 	def_bool CC_IS_CLANG
 	# https://github.com/ClangBuiltLinux/linux/issues/1507
 	depends on AS_IS_GNU || (AS_IS_LLVM && (LD_IS_LLD || LD_VERSION >= 23600))
-	select HAVE_DYNAMIC_FTRACE_WITH_ARGS
 
 config GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS
 	def_bool CC_IS_GCC
 	depends on $(cc-option,-fpatchable-function-entry=2)
-	select HAVE_DYNAMIC_FTRACE_WITH_ARGS
 
 config 64BIT
 	def_bool y
@@ -422,7 +421,7 @@
 	default y
 	help
 	  This option adds an alternative code sequence to work around Ampere
-	  erratum AC03_CPU_38 on AmpereOne.
+	  errata AC03_CPU_38 and AC04_CPU_10 on AmpereOne.
 
 	  The affected design reports FEAT_HAFDBS as not implemented in
 	  ID_AA64MMFR1_EL1.HAFDBS, but (V)TCR_ELx.{HA,HD} are not RES0
@@ -1070,6 +1069,46 @@
 
 	  If unsure, say Y.
 
+config ARM64_ERRATUM_3194386
+	bool "Cortex-*/Neoverse-*: workaround for MSR SSBS not self-synchronizing"
+	default y
+	help
+	  This option adds the workaround for the following errata:
+
+	  * ARM Cortex-A76 erratum 3324349
+	  * ARM Cortex-A77 erratum 3324348
+	  * ARM Cortex-A78 erratum 3324344
+	  * ARM Cortex-A78C erratum 3324346
+	  * ARM Cortex-A78C erratum 3324347
+	  * ARM Cortex-A710 erratam 3324338
+	  * ARM Cortex-A715 errartum 3456084
+	  * ARM Cortex-A720 erratum 3456091
+	  * ARM Cortex-A725 erratum 3456106
+	  * ARM Cortex-X1 erratum 3324344
+	  * ARM Cortex-X1C erratum 3324346
+	  * ARM Cortex-X2 erratum 3324338
+	  * ARM Cortex-X3 erratum 3324335
+	  * ARM Cortex-X4 erratum 3194386
+	  * ARM Cortex-X925 erratum 3324334
+	  * ARM Neoverse-N1 erratum 3324349
+	  * ARM Neoverse N2 erratum 3324339
+	  * ARM Neoverse-N3 erratum 3456111
+	  * ARM Neoverse-V1 erratum 3324341
+	  * ARM Neoverse V2 erratum 3324336
+	  * ARM Neoverse-V3 erratum 3312417
+
+	  On affected cores "MSR SSBS, #0" instructions may not affect
+	  subsequent speculative instructions, which may permit unexepected
+	  speculative store bypassing.
+
+	  Work around this problem by placing a Speculation Barrier (SB) or
+	  Instruction Synchronization Barrier (ISB) after kernel changes to
+	  SSBS. The presence of the SSBS special-purpose register is hidden
+	  from hwcaps and EL0 reads of ID_AA64PFR1_EL1, such that userspace
+	  will use the PR_SPEC_STORE_BYPASS prctl to change SSBS.
+
+	  If unsure, say Y.
+
 config CAVIUM_ERRATUM_22375
 	bool "Cavium erratum 22375, 24313"
 	default y
@@ -1178,6 +1217,17 @@
 
 	  If unsure, say Y.
 
+config HISILICON_ERRATUM_162100801
+	bool "Hip09 162100801 erratum support"
+	default y
+	help
+	  When enabling GICv4.1 in hip09, VMAPP will fail to clear some caches
+	  during unmapping operation, which will cause some vSGIs lost.
+	  To fix the issue, invalidate related vPE cache through GICR_INVALLR
+	  after VMOVP.
+
+	  If unsure, say Y.
+
 config QCOM_FALKOR_ERRATUM_1003
 	bool "Falkor E1003: Incorrect translation due to ASID change"
 	default y
@@ -1550,7 +1600,7 @@
 # 64K |       29          |      16      |       13             |         13              |
 config ARCH_FORCE_MAX_ORDER
 	int
-	default "13" if ARM64_64K_PAGES
+	default "13" if ARM64_64K_PAGES || (ARCH_THUNDER && ARM64_4K_PAGES)
 	default "11" if ARM64_16K_PAGES
 	default "10"
 	help
@@ -2133,6 +2183,7 @@
 	bool "ARM Scalable Matrix Extension support"
 	default y
 	depends on ARM64_SVE
+	depends on BROKEN
 	help
 	  The Scalable Matrix Extension (SME) is an extension to the AArch64
 	  execution state which utilises a substantial subset of the SVE
--- linux-qcom-6.8.0.orig/arch/arm64/Makefile
+++ linux-qcom-6.8.0/arch/arm64/Makefile
@@ -10,7 +10,7 @@
 #
 # Copyright (C) 1995-2001 by Russell King
 
-LDFLAGS_vmlinux	:=--no-undefined -X
+LDFLAGS_vmlinux	:=--no-undefined -X --pic-veneer
 
 ifeq ($(CONFIG_RELOCATABLE), y)
 # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
@@ -202,6 +202,9 @@
 		interrupts = <7 5 IRQ_TYPE_EDGE_RISING>; /* PH5 */
 		vdd-supply = <&reg_dldo1>;
 		vddio-supply = <&reg_dldo1>;
+		mount-matrix = "0", "1", "0",
+			       "-1", "0", "0",
+			       "0", "0", "1";
 	};
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
@@ -291,6 +291,8 @@
 };
 
 &spdif {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spdif_tx_pin>;
 	status = "okay";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi
@@ -166,6 +166,8 @@
 };
 
 &spdif {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spdif_tx_pin>;
 	status = "okay";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
@@ -406,6 +406,7 @@
 				function = "spi1";
 			};
 
+			/omit-if-no-ref/
 			spdif_tx_pin: spdif-tx-pin {
 				pins = "PH7";
 				function = "spdif";
@@ -655,10 +656,8 @@
 			clocks = <&ccu CLK_BUS_SPDIF>, <&ccu CLK_SPDIF>;
 			clock-names = "apb", "spdif";
 			resets = <&ccu RST_BUS_SPDIF>;
-			dmas = <&dma 2>;
-			dma-names = "tx";
-			pinctrl-names = "default";
-			pinctrl-0 = <&spdif_tx_pin>;
+			dmas = <&dma 2>, <&dma 2>;
+			dma-names = "rx", "tx";
 			status = "disabled";
 		};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
@@ -215,6 +215,11 @@
 				#sound-dai-cells = <0>;
 				status = "disabled";
 
+				assigned-clocks = <&clkc CLKID_HDMI_SEL>,
+						  <&clkc CLKID_HDMI>;
+				assigned-clock-parents = <&xtal>, <0>;
+				assigned-clock-rates = <0>, <24000000>;
+
 				/* VPU VENC Input */
 				hdmi_tx_venc_port: port@0 {
 					reg = <0>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/amlogic/meson-g12.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/amlogic/meson-g12.dtsi
@@ -363,6 +363,10 @@
 	power-domains = <&pwrc PWRC_G12A_ETH_ID>;
 };
 
+&hdmi_tx {
+	power-domains = <&pwrc PWRC_G12A_VPU_ID>;
+};
+
 &vpu {
 	power-domains = <&pwrc PWRC_G12A_VPU_ID>;
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@@ -311,10 +311,16 @@
 		 <&reset RESET_HDMI_SYSTEM_RESET>,
 		 <&reset RESET_HDMI_TX>;
 	reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy";
-	clocks = <&clkc CLKID_HDMI_PCLK>,
-		 <&clkc CLKID_CLK81>,
+	clocks = <&clkc CLKID_HDMI>,
+		 <&clkc CLKID_HDMI_PCLK>,
 		 <&clkc CLKID_GCLK_VENCI_INT0>;
 	clock-names = "isfr", "iahb", "venci";
+	power-domains = <&pwrc PWRC_GXBB_VPU_ID>;
+
+	assigned-clocks = <&clkc CLKID_HDMI_SEL>,
+			  <&clkc CLKID_HDMI>;
+	assigned-clock-parents = <&xtal>, <0>;
+	assigned-clock-rates = <0>, <24000000>;
 };
 
 &sysctrl {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -323,10 +323,16 @@
 		 <&reset RESET_HDMI_SYSTEM_RESET>,
 		 <&reset RESET_HDMI_TX>;
 	reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy";
-	clocks = <&clkc CLKID_HDMI_PCLK>,
-		 <&clkc CLKID_CLK81>,
+	clocks = <&clkc CLKID_HDMI>,
+		 <&clkc CLKID_HDMI_PCLK>,
 		 <&clkc CLKID_GCLK_VENCI_INT0>;
 	clock-names = "isfr", "iahb", "venci";
+	power-domains = <&pwrc PWRC_GXBB_VPU_ID>;
+
+	assigned-clocks = <&clkc CLKID_HDMI_SEL>,
+			  <&clkc CLKID_HDMI>;
+	assigned-clock-parents = <&xtal>, <0>;
+	assigned-clock-rates = <0>, <24000000>;
 };
 
 &sysctrl {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/amlogic/meson-s4.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/amlogic/meson-s4.dtsi
@@ -65,10 +65,15 @@
 		#clock-cells = <0>;
 	};
 
-	pwrc: power-controller {
-		compatible = "amlogic,meson-s4-pwrc";
-		#power-domain-cells = <1>;
-		status = "okay";
+	firmware {
+		sm: secure-monitor {
+			compatible = "amlogic,meson-gxbb-sm";
+
+			pwrc: power-controller {
+				compatible = "amlogic,meson-s4-pwrc";
+				#power-domain-cells = <1>;
+			};
+		};
 	};
 
 	soc {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
@@ -339,7 +339,7 @@
 		};
 
 		spdifin: audio-controller@400 {
-			compatible = "amlogic,g12a-spdifin",
+			compatible = "amlogic,sm1-spdifin",
 				     "amlogic,axg-spdifin";
 			reg = <0x0 0x400 0x0 0x30>;
 			#sound-dai-cells = <0>;
@@ -353,7 +353,7 @@
 		};
 
 		spdifout_a: audio-controller@480 {
-			compatible = "amlogic,g12a-spdifout",
+			compatible = "amlogic,sm1-spdifout",
 				     "amlogic,axg-spdifout";
 			reg = <0x0 0x480 0x0 0x50>;
 			#sound-dai-cells = <0>;
@@ -518,6 +518,10 @@
 		     "amlogic,meson-gpio-intc";
 };
 
+&hdmi_tx {
+	power-domains = <&pwrc PWRC_SM1_VPU_ID>;
+};
+
 &pcie {
 	power-domains = <&pwrc PWRC_SM1_PCIE_ID>;
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi
@@ -227,9 +227,6 @@
 				brcm,num-gphy = <5>;
 				brcm,num-rgmii-ports = <2>;
 
-				#address-cells = <1>;
-				#size-cells = <0>;
-
 				ports: ports {
 					#address-cells = <1>;
 					#size-cells = <0>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts
@@ -32,7 +32,7 @@
 		device_type = "memory";
 		reg = <0x0 0x80000000 0x3da00000>,
 		      <0x0 0xc0000000 0x40000000>,
-		      <0x8 0x80000000 0x40000000>;
+		      <0x8 0x80000000 0x80000000>;
 	};
 
 	gpio-keys {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi
@@ -41,7 +41,7 @@
 		interrupts = <GIC_SPI 267 IRQ_TYPE_LEVEL_HIGH>;
 		fsl,usbphy = <&usbphy1>;
 		fsl,usbmisc = <&usbmisc1 0>;
-		clocks = <&usb2_lpcg 0>;
+		clocks = <&usb2_lpcg IMX_LPCG_CLK_6>;
 		ahb-burst-config = <0x0>;
 		tx-burst-size-dword = <0x10>;
 		rx-burst-size-dword = <0x10>;
@@ -58,7 +58,7 @@
 	usbphy1: usbphy@5b100000 {
 		compatible = "fsl,imx7ulp-usbphy";
 		reg = <0x5b100000 0x1000>;
-		clocks = <&usb2_lpcg 1>;
+		clocks = <&usb2_lpcg IMX_LPCG_CLK_7>;
 		power-domains = <&pd IMX_SC_R_USB_0_PHY>;
 		status = "disabled";
 	};
@@ -67,8 +67,8 @@
 		interrupts = <GIC_SPI 232 IRQ_TYPE_LEVEL_HIGH>;
 		reg = <0x5b010000 0x10000>;
 		clocks = <&sdhc0_lpcg IMX_LPCG_CLK_4>,
-			 <&sdhc0_lpcg IMX_LPCG_CLK_0>,
-			 <&sdhc0_lpcg IMX_LPCG_CLK_5>;
+			 <&sdhc0_lpcg IMX_LPCG_CLK_5>,
+			 <&sdhc0_lpcg IMX_LPCG_CLK_0>;
 		clock-names = "ipg", "ahb", "per";
 		power-domains = <&pd IMX_SC_R_SDHC_0>;
 		status = "disabled";
@@ -78,8 +78,8 @@
 		interrupts = <GIC_SPI 233 IRQ_TYPE_LEVEL_HIGH>;
 		reg = <0x5b020000 0x10000>;
 		clocks = <&sdhc1_lpcg IMX_LPCG_CLK_4>,
-			 <&sdhc1_lpcg IMX_LPCG_CLK_0>,
-			 <&sdhc1_lpcg IMX_LPCG_CLK_5>;
+			 <&sdhc1_lpcg IMX_LPCG_CLK_5>,
+			 <&sdhc1_lpcg IMX_LPCG_CLK_0>;
 		clock-names = "ipg", "ahb", "per";
 		power-domains = <&pd IMX_SC_R_SDHC_1>;
 		fsl,tuning-start-tap = <20>;
@@ -91,8 +91,8 @@
 		interrupts = <GIC_SPI 234 IRQ_TYPE_LEVEL_HIGH>;
 		reg = <0x5b030000 0x10000>;
 		clocks = <&sdhc2_lpcg IMX_LPCG_CLK_4>,
-			 <&sdhc2_lpcg IMX_LPCG_CLK_0>,
-			 <&sdhc2_lpcg IMX_LPCG_CLK_5>;
+			 <&sdhc2_lpcg IMX_LPCG_CLK_5>,
+			 <&sdhc2_lpcg IMX_LPCG_CLK_0>;
 		clock-names = "ipg", "ahb", "per";
 		power-domains = <&pd IMX_SC_R_SDHC_2>;
 		status = "disabled";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi
@@ -27,8 +27,8 @@
 		#size-cells = <0>;
 		interrupts = <GIC_SPI 336 IRQ_TYPE_LEVEL_HIGH>;
 		interrupt-parent = <&gic>;
-		clocks = <&spi0_lpcg 0>,
-			 <&spi0_lpcg 1>;
+		clocks = <&spi0_lpcg IMX_LPCG_CLK_0>,
+			 <&spi0_lpcg IMX_LPCG_CLK_4>;
 		clock-names = "per", "ipg";
 		assigned-clocks = <&clk IMX_SC_R_SPI_0 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <60000000>;
@@ -43,8 +43,8 @@
 		#size-cells = <0>;
 		interrupts = <GIC_SPI 337 IRQ_TYPE_LEVEL_HIGH>;
 		interrupt-parent = <&gic>;
-		clocks = <&spi1_lpcg 0>,
-			 <&spi1_lpcg 1>;
+		clocks = <&spi1_lpcg IMX_LPCG_CLK_0>,
+			 <&spi1_lpcg IMX_LPCG_CLK_4>;
 		clock-names = "per", "ipg";
 		assigned-clocks = <&clk IMX_SC_R_SPI_1 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <60000000>;
@@ -59,8 +59,8 @@
 		#size-cells = <0>;
 		interrupts = <GIC_SPI 338 IRQ_TYPE_LEVEL_HIGH>;
 		interrupt-parent = <&gic>;
-		clocks = <&spi2_lpcg 0>,
-			 <&spi2_lpcg 1>;
+		clocks = <&spi2_lpcg IMX_LPCG_CLK_0>,
+			 <&spi2_lpcg IMX_LPCG_CLK_4>;
 		clock-names = "per", "ipg";
 		assigned-clocks = <&clk IMX_SC_R_SPI_2 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <60000000>;
@@ -75,8 +75,8 @@
 		#size-cells = <0>;
 		interrupts = <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>;
 		interrupt-parent = <&gic>;
-		clocks = <&spi3_lpcg 0>,
-			 <&spi3_lpcg 1>;
+		clocks = <&spi3_lpcg IMX_LPCG_CLK_0>,
+			 <&spi3_lpcg IMX_LPCG_CLK_4>;
 		clock-names = "per", "ipg";
 		assigned-clocks = <&clk IMX_SC_R_SPI_3 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <60000000>;
@@ -144,8 +144,8 @@
 		compatible = "fsl,imx8qxp-pwm", "fsl,imx27-pwm";
 		reg = <0x5a190000 0x1000>;
 		interrupts = <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>;
-		clocks = <&adma_pwm_lpcg 1>,
-			 <&adma_pwm_lpcg 0>;
+		clocks = <&adma_pwm_lpcg IMX_LPCG_CLK_4>,
+			 <&adma_pwm_lpcg IMX_LPCG_CLK_0>;
 		clock-names = "ipg", "per";
 		assigned-clocks = <&clk IMX_SC_R_LCD_0_PWM_0 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <24000000>;
@@ -377,8 +377,8 @@
 		reg = <0x5a880000 0x10000>;
 		interrupts = <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>;
 		interrupt-parent = <&gic>;
-		clocks = <&adc0_lpcg 0>,
-			 <&adc0_lpcg 1>;
+		clocks = <&adc0_lpcg IMX_LPCG_CLK_0>,
+			 <&adc0_lpcg IMX_LPCG_CLK_4>;
 		clock-names = "per", "ipg";
 		assigned-clocks = <&clk IMX_SC_R_ADC_0 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <24000000>;
@@ -392,8 +392,8 @@
 		reg = <0x5a890000 0x10000>;
 		interrupts = <GIC_SPI 241 IRQ_TYPE_LEVEL_HIGH>;
 		interrupt-parent = <&gic>;
-		clocks = <&adc1_lpcg 0>,
-			 <&adc1_lpcg 1>;
+		clocks = <&adc1_lpcg IMX_LPCG_CLK_0>,
+			 <&adc1_lpcg IMX_LPCG_CLK_4>;
 		clock-names = "per", "ipg";
 		assigned-clocks = <&clk IMX_SC_R_ADC_1 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <24000000>;
@@ -406,8 +406,8 @@
 		reg = <0x5a8d0000 0x10000>;
 		interrupts = <GIC_SPI 235 IRQ_TYPE_LEVEL_HIGH>;
 		interrupt-parent = <&gic>;
-		clocks = <&can0_lpcg 1>,
-			 <&can0_lpcg 0>;
+		clocks = <&can0_lpcg IMX_LPCG_CLK_4>,
+			 <&can0_lpcg IMX_LPCG_CLK_0>;
 		clock-names = "ipg", "per";
 		assigned-clocks = <&clk IMX_SC_R_CAN_0 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <40000000>;
@@ -427,8 +427,8 @@
 		 * CAN1 shares CAN0's clock and to enable CAN0's clock it
 		 * has to be powered on.
 		 */
-		clocks = <&can0_lpcg 1>,
-			 <&can0_lpcg 0>;
+		clocks = <&can0_lpcg IMX_LPCG_CLK_4>,
+			 <&can0_lpcg IMX_LPCG_CLK_0>;
 		clock-names = "ipg", "per";
 		assigned-clocks = <&clk IMX_SC_R_CAN_0 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <40000000>;
@@ -448,8 +448,8 @@
 		 * CAN2 shares CAN0's clock and to enable CAN0's clock it
 		 * has to be powered on.
 		 */
-		clocks = <&can0_lpcg 1>,
-			 <&can0_lpcg 0>;
+		clocks = <&can0_lpcg IMX_LPCG_CLK_4>,
+			 <&can0_lpcg IMX_LPCG_CLK_0>;
 		clock-names = "ipg", "per";
 		assigned-clocks = <&clk IMX_SC_R_CAN_0 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <40000000>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi
@@ -25,8 +25,8 @@
 		compatible = "fsl,imx27-pwm";
 		reg = <0x5d000000 0x10000>;
 		clock-names = "ipg", "per";
-		clocks = <&pwm0_lpcg 4>,
-			 <&pwm0_lpcg 1>;
+		clocks = <&pwm0_lpcg IMX_LPCG_CLK_6>,
+			 <&pwm0_lpcg IMX_LPCG_CLK_1>;
 		assigned-clocks = <&clk IMX_SC_R_PWM_0 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <24000000>;
 		#pwm-cells = <3>;
@@ -38,8 +38,8 @@
 		compatible = "fsl,imx27-pwm";
 		reg = <0x5d010000 0x10000>;
 		clock-names = "ipg", "per";
-		clocks = <&pwm1_lpcg 4>,
-			 <&pwm1_lpcg 1>;
+		clocks = <&pwm1_lpcg IMX_LPCG_CLK_6>,
+			 <&pwm1_lpcg IMX_LPCG_CLK_1>;
 		assigned-clocks = <&clk IMX_SC_R_PWM_1 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <24000000>;
 		#pwm-cells = <3>;
@@ -51,8 +51,8 @@
 		compatible = "fsl,imx27-pwm";
 		reg = <0x5d020000 0x10000>;
 		clock-names = "ipg", "per";
-		clocks = <&pwm2_lpcg 4>,
-			 <&pwm2_lpcg 1>;
+		clocks = <&pwm2_lpcg IMX_LPCG_CLK_6>,
+			 <&pwm2_lpcg IMX_LPCG_CLK_1>;
 		assigned-clocks = <&clk IMX_SC_R_PWM_2 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <24000000>;
 		#pwm-cells = <3>;
@@ -64,8 +64,8 @@
 		compatible = "fsl,imx27-pwm";
 		reg = <0x5d030000 0x10000>;
 		clock-names = "ipg", "per";
-		clocks = <&pwm3_lpcg 4>,
-			 <&pwm3_lpcg 1>;
+		clocks = <&pwm3_lpcg IMX_LPCG_CLK_6>,
+			 <&pwm3_lpcg IMX_LPCG_CLK_1>;
 		assigned-clocks = <&clk IMX_SC_R_PWM_3 IMX_SC_PM_CLK_PER>;
 		assigned-clock-rates = <24000000>;
 		#pwm-cells = <3>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi
@@ -15,7 +15,7 @@
 	mu_m0: mailbox@2d000000 {
 		compatible = "fsl,imx6sx-mu";
 		reg = <0x2d000000 0x20000>;
-		interrupts = <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts = <GIC_SPI 472 IRQ_TYPE_LEVEL_HIGH>;
 		#mbox-cells = <2>;
 		power-domains = <&pd IMX_SC_R_VPU_MU_0>;
 		status = "disabled";
@@ -24,7 +24,7 @@
 	mu1_m0: mailbox@2d020000 {
 		compatible = "fsl,imx6sx-mu";
 		reg = <0x2d020000 0x20000>;
-		interrupts = <GIC_SPI 470 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts = <GIC_SPI 473 IRQ_TYPE_LEVEL_HIGH>;
 		#mbox-cells = <2>;
 		power-domains = <&pd IMX_SC_R_VPU_MU_1>;
 		status = "disabled";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
@@ -294,8 +294,8 @@
 
 	pinctrl_i2c4: i2c4grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x400001c3
-			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x400001c3
+			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x40000083
+			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x40000083
 		>;
 	};
 
@@ -313,19 +313,19 @@
 
 	pinctrl_uart1: uart1grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x140
-			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x140
-			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x140
-			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x140
+			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x0
+			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x0
+			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x0
+			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x0
 		>;
 	};
 
 	pinctrl_uart2: uart2grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x140
-			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x140
-			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x140
-			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x140
+			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x0
+			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x0
+			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x0
+			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x0
 		>;
 	};
 
@@ -337,40 +337,40 @@
 
 	pinctrl_usdhc2: usdhc2grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x190
+			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x90
 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d0
 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d0
 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d0
 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d0
 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d0
-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
+			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
+			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
 		>;
 	};
 
 	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x194
+			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x94
 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d4
 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d4
 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d4
 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d4
 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d4
-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
+			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
+			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
 		>;
 	};
 
 	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x196
+			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x96
 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d6
 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d6
 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d6
 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d6
 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d6
-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
+			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
+			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
 		>;
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
@@ -279,8 +279,8 @@
 
 	pinctrl_i2c4: i2c4grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x400001c3
-			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x400001c3
+			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x40000083
+			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x40000083
 		>;
 	};
 
@@ -292,19 +292,19 @@
 
 	pinctrl_uart1: uart1grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x140
-			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x140
-			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x140
-			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x140
+			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x0
+			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x0
+			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x0
+			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x0
 		>;
 	};
 
 	pinctrl_uart2: uart2grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x140
-			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x140
-			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x140
-			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x140
+			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x0
+			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x0
+			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x0
+			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x0
 		>;
 	};
 
@@ -316,40 +316,40 @@
 
 	pinctrl_usdhc2: usdhc2grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x190
+			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x90
 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d0
 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d0
 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d0
 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d0
 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d0
-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
+			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
+			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
 		>;
 	};
 
 	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x194
+			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x94
 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d4
 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d4
 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d4
 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d4
 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d4
-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
+			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
+			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
 		>;
 	};
 
 	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
 		fsl,pins = <
-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x196
+			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x96
 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d6
 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d6
 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d6
 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d6
 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d6
-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
+			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
+			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
 		>;
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi
@@ -210,7 +210,7 @@
 		reg = <0x52>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&pinctrl_rtc>;
-		interrupts-extended = <&gpio4 1 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts-extended = <&gpio4 1 IRQ_TYPE_LEVEL_LOW>;
 		trickle-diode-disable;
 	};
 };
@@ -252,8 +252,8 @@
 
 	pinctrl_i2c1: i2c1grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x400001c3
-			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x400001c3
+			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x40000083
+			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x40000083
 		>;
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi
@@ -237,8 +237,8 @@
 
 	pinctrl_i2c1: i2c1grp {
 		fsl,pins = <
-			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x400001c3
-			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x400001c3
+			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x40000083
+			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x40000083
 		>;
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
@@ -47,17 +47,6 @@
 		gpios = <&gpio1 15 GPIO_ACTIVE_HIGH>;
 		status = "okay";
 	};
-
-	reg_usb_otg1_vbus: regulator-usb-otg1 {
-		pinctrl-names = "default";
-		pinctrl-0 = <&pinctrl_reg_usb1_en>;
-		compatible = "regulator-fixed";
-		regulator-name = "usb_otg1_vbus";
-		gpio = <&gpio1 10 GPIO_ACTIVE_HIGH>;
-		enable-active-high;
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-	};
 };
 
 /* off-board header */
@@ -144,9 +133,10 @@
 };
 
 &usbotg1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_usbotg1>;
 	dr_mode = "otg";
 	over-current-active-low;
-	vbus-supply = <&reg_usb_otg1_vbus>;
 	status = "okay";
 };
 
@@ -204,14 +194,6 @@
 		>;
 	};
 
-	pinctrl_reg_usb1_en: regusb1grp {
-		fsl,pins = <
-			MX8MM_IOMUXC_GPIO1_IO10_GPIO1_IO10	0x41
-			MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12	0x141
-			MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC	0x41
-		>;
-	};
-
 	pinctrl_spi2: spi2grp {
 		fsl,pins = <
 			MX8MM_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK	0xd6
@@ -234,4 +216,11 @@
 			MX8MM_IOMUXC_UART3_TXD_UART3_DCE_TX	0x140
 		>;
 	};
+
+	pinctrl_usbotg1: usbotg1grp {
+		fsl,pins = <
+			MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12	0x141
+			MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC	0x41
+		>;
+	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
@@ -6,6 +6,7 @@
 #include <dt-bindings/phy/phy-imx8-pcie.h>
 #include <dt-bindings/pwm/pwm.h>
 #include "imx8mm.dtsi"
+#include "imx8mm-overdrive.dtsi"
 
 / {
 	chosen {
@@ -145,7 +146,7 @@
 		regulator-max-microvolt = <3300000>;
 		regulator-min-microvolt = <3300000>;
 		regulator-name = "+V3.3_SD";
-		startup-delay-us = <2000>;
+		startup-delay-us = <20000>;
 	};
 
 	reserved-memory {
@@ -929,7 +930,7 @@
 	/* Verdin GPIO_9_DSI (pulled-up as active-low) */
 	pinctrl_gpio_9_dsi: gpio9dsigrp {
 		fsl,pins =
-			<MX8MM_IOMUXC_NAND_RE_B_GPIO3_IO15		0x146>;	/* SODIMM 17 */
+			<MX8MM_IOMUXC_NAND_RE_B_GPIO3_IO15		0x1c6>;	/* SODIMM 17 */
 	};
 
 	/* Verdin GPIO_10_DSI (pulled-up as active-low) */
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts
@@ -211,13 +211,12 @@
 
 		simple-audio-card,cpu {
 			sound-dai = <&sai3>;
+			frame-master;
+			bitclock-master;
 		};
 
 		simple-audio-card,codec {
 			sound-dai = <&wm8962>;
-			clocks = <&clk IMX8MP_CLK_IPP_DO_CLKO1>;
-			frame-master;
-			bitclock-master;
 		};
 	};
 };
@@ -499,10 +498,9 @@
 &sai3 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_sai3>;
-	assigned-clocks = <&clk IMX8MP_CLK_SAI3>,
-			  <&clk IMX8MP_AUDIO_PLL2> ;
-	assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL2_OUT>;
-	assigned-clock-rates = <12288000>, <361267200>;
+	assigned-clocks = <&clk IMX8MP_CLK_SAI3>;
+	assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL1_OUT>;
+	assigned-clock-rates = <12288000>;
 	fsl,sai-mclk-direction-output;
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts
@@ -121,7 +121,7 @@
 	flash@0 {	/* W25Q128JVEI */
 		compatible = "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <100000000>;	/* Up to 133 MHz */
+		spi-max-frequency = <40000000>;
 		spi-tx-bus-width = <1>;
 		spi-rx-bus-width = <1>;
 	};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
@@ -254,7 +254,7 @@
 				  <&clk IMX8MP_CLK_CLKOUT2>,
 				  <&clk IMX8MP_AUDIO_PLL2_OUT>;
 		assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL2_OUT>;
-		assigned-clock-rates = <13000000>, <13000000>, <156000000>;
+		assigned-clock-rates = <13000000>, <13000000>, <208000000>;
 		reset-gpios = <&gpio4 1 GPIO_ACTIVE_HIGH>;
 		status = "disabled";
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mp-evk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mp-evk.dts
@@ -23,7 +23,7 @@
 
 		port {
 			hdmi_connector_in: endpoint {
-				remote-endpoint = <&adv7533_out>;
+				remote-endpoint = <&adv7535_out>;
 			};
 		};
 	};
@@ -107,6 +107,13 @@
 		enable-active-high;
 	};
 
+	reg_vext_3v3: regulator-vext-3v3 {
+		compatible = "regulator-fixed";
+		regulator-name = "VEXT_3V3";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+	};
+
 	sound {
 		compatible = "simple-audio-card";
 		simple-audio-card,name = "wm8960-audio";
@@ -364,7 +371,7 @@
 				regulator-always-on;
 			};
 
-			BUCK5 {
+			reg_buck5: BUCK5 {
 				regulator-name = "BUCK5";
 				regulator-min-microvolt = <1650000>;
 				regulator-max-microvolt = <1950000>;
@@ -415,14 +422,16 @@
 
 	hdmi@3d {
 		compatible = "adi,adv7535";
-		reg = <0x3d>, <0x3c>, <0x3e>, <0x3f>;
-		reg-names = "main", "cec", "edid", "packet";
+		reg = <0x3d>;
+		interrupt-parent = <&gpio1>;
+		interrupts = <9 IRQ_TYPE_EDGE_FALLING>;
 		adi,dsi-lanes = <4>;
-		adi,input-depth = <8>;
-		adi,input-colorspace = "rgb";
-		adi,input-clock = "1x";
-		adi,input-style = <1>;
-		adi,input-justification = "evenly";
+		avdd-supply = <&reg_buck5>;
+		dvdd-supply = <&reg_buck5>;
+		pvdd-supply = <&reg_buck5>;
+		a2vdd-supply = <&reg_buck5>;
+		v3p3-supply = <&reg_vext_3v3>;
+		v1p2-supply = <&reg_buck5>;
 
 		ports {
 			#address-cells = <1>;
@@ -431,7 +440,7 @@
 			port@0 {
 				reg = <0>;
 
-				adv7533_in: endpoint {
+				adv7535_in: endpoint {
 					remote-endpoint = <&dsi_out>;
 				};
 			};
@@ -439,7 +448,7 @@
 			port@1 {
 				reg = <1>;
 
-				adv7533_out: endpoint {
+				adv7535_out: endpoint {
 					remote-endpoint = <&hdmi_connector_in>;
 				};
 			};
@@ -524,7 +533,7 @@
 			reg = <1>;
 
 			dsi_out: endpoint {
-				remote-endpoint = <&adv7533_in>;
+				remote-endpoint = <&adv7535_in>;
 				data-lanes = <1 2 3 4>;
 			};
 		};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi
@@ -14,6 +14,7 @@
 		pinctrl-0 = <&pinctrl_usbcon1>;
 		type = "micro";
 		label = "otg";
+		vbus-supply = <&reg_usb1_vbus>;
 		id-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>;
 
 		port {
@@ -183,7 +184,6 @@
 };
 
 &usb3_phy0 {
-	vbus-supply = <&reg_usb1_vbus>;
 	status = "okay";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mp-venice-gw73xx.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mp-venice-gw73xx.dtsi
@@ -14,6 +14,7 @@
 		pinctrl-0 = <&pinctrl_usbcon1>;
 		type = "micro";
 		label = "otg";
+		vbus-supply = <&reg_usb1_vbus>;
 		id-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>;
 
 		port {
@@ -182,7 +183,7 @@
 
 	bluetooth {
 		compatible = "brcm,bcm4330-bt";
-		shutdown-gpios = <&gpio4 16 GPIO_ACTIVE_HIGH>;
+		shutdown-gpios = <&gpio1 3 GPIO_ACTIVE_HIGH>;
 	};
 };
 
@@ -202,7 +203,6 @@
 };
 
 &usb3_phy0 {
-	vbus-supply = <&reg_usb1_vbus>;
 	status = "okay";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi
@@ -151,7 +151,7 @@
 		regulator-max-microvolt = <3300000>;
 		regulator-min-microvolt = <3300000>;
 		regulator-name = "+V3.3_SD";
-		startup-delay-us = <2000>;
+		startup-delay-us = <20000>;
 	};
 
 	reserved-memory {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8mp.dtsi
@@ -789,6 +789,23 @@
 						reg = <IMX8MP_POWER_DOMAIN_USB2_PHY>;
 					};
 
+					pgc_mlmix: power-domain@4 {
+						#power-domain-cells = <0>;
+						reg = <IMX8MP_POWER_DOMAIN_MLMIX>;
+						clocks = <&clk IMX8MP_CLK_ML_AXI>,
+							 <&clk IMX8MP_CLK_ML_AHB>,
+							 <&clk IMX8MP_CLK_NPU_ROOT>;
+						assigned-clocks = <&clk IMX8MP_CLK_ML_CORE>,
+								  <&clk IMX8MP_CLK_ML_AXI>,
+								  <&clk IMX8MP_CLK_ML_AHB>;
+						assigned-clock-parents = <&clk IMX8MP_SYS_PLL1_800M>,
+									 <&clk IMX8MP_SYS_PLL1_800M>,
+									 <&clk IMX8MP_SYS_PLL1_800M>;
+						assigned-clock-rates = <800000000>,
+								       <800000000>,
+								       <300000000>;
+					};
+
 					pgc_audio: power-domain@5 {
 						#power-domain-cells = <0>;
 						reg = <IMX8MP_POWER_DOMAIN_AUDIOMIX>;
@@ -821,6 +838,12 @@
 						assigned-clock-rates = <800000000>, <400000000>;
 					};
 
+					pgc_vpumix: power-domain@8 {
+						#power-domain-cells = <0>;
+						reg = <IMX8MP_POWER_DOMAIN_VPUMIX>;
+						clocks = <&clk IMX8MP_CLK_VPU_ROOT>;
+					};
+
 					pgc_gpu3d: power-domain@9 {
 						#power-domain-cells = <0>;
 						reg = <IMX8MP_POWER_DOMAIN_GPU3D>;
@@ -836,69 +859,64 @@
 							 <&clk IMX8MP_CLK_MEDIA_APB_ROOT>;
 					};
 
-					pgc_mipi_phy2: power-domain@16 {
+					pgc_vpu_g1: power-domain@11 {
 						#power-domain-cells = <0>;
-						reg = <IMX8MP_POWER_DOMAIN_MIPI_PHY2>;
+						power-domains = <&pgc_vpumix>;
+						reg = <IMX8MP_POWER_DOMAIN_VPU_G1>;
+						clocks = <&clk IMX8MP_CLK_VPU_G1_ROOT>;
 					};
 
-					pgc_hsiomix: power-domain@17 {
+					pgc_vpu_g2: power-domain@12 {
 						#power-domain-cells = <0>;
-						reg = <IMX8MP_POWER_DOMAIN_HSIOMIX>;
-						clocks = <&clk IMX8MP_CLK_HSIO_AXI>,
-							 <&clk IMX8MP_CLK_HSIO_ROOT>;
-						assigned-clocks = <&clk IMX8MP_CLK_HSIO_AXI>;
-						assigned-clock-parents = <&clk IMX8MP_SYS_PLL2_500M>;
-						assigned-clock-rates = <500000000>;
+						power-domains = <&pgc_vpumix>;
+						reg = <IMX8MP_POWER_DOMAIN_VPU_G2>;
+						clocks = <&clk IMX8MP_CLK_VPU_G2_ROOT>;
+
 					};
 
-					pgc_ispdwp: power-domain@18 {
+					pgc_vpu_vc8000e: power-domain@13 {
 						#power-domain-cells = <0>;
-						reg = <IMX8MP_POWER_DOMAIN_MEDIAMIX_ISPDWP>;
-						clocks = <&clk IMX8MP_CLK_MEDIA_ISP_ROOT>;
+						power-domains = <&pgc_vpumix>;
+						reg = <IMX8MP_POWER_DOMAIN_VPU_VC8000E>;
+						clocks = <&clk IMX8MP_CLK_VPU_VC8KE_ROOT>;
 					};
 
-					pgc_vpumix: power-domain@19 {
+					pgc_hdmimix: power-domain@14 {
 						#power-domain-cells = <0>;
-						reg = <IMX8MP_POWER_DOMAIN_VPUMIX>;
-						clocks = <&clk IMX8MP_CLK_VPU_ROOT>;
+						reg = <IMX8MP_POWER_DOMAIN_HDMIMIX>;
+						clocks = <&clk IMX8MP_CLK_HDMI_ROOT>,
+							 <&clk IMX8MP_CLK_HDMI_APB>;
+						assigned-clocks = <&clk IMX8MP_CLK_HDMI_AXI>,
+								  <&clk IMX8MP_CLK_HDMI_APB>;
+						assigned-clock-parents = <&clk IMX8MP_SYS_PLL2_500M>,
+									 <&clk IMX8MP_SYS_PLL1_133M>;
+						assigned-clock-rates = <500000000>, <133000000>;
 					};
 
-					pgc_vpu_g1: power-domain@20 {
+					pgc_hdmi_phy: power-domain@15 {
 						#power-domain-cells = <0>;
-						power-domains = <&pgc_vpumix>;
-						reg = <IMX8MP_POWER_DOMAIN_VPU_G1>;
-						clocks = <&clk IMX8MP_CLK_VPU_G1_ROOT>;
+						reg = <IMX8MP_POWER_DOMAIN_HDMI_PHY>;
 					};
 
-					pgc_vpu_g2: power-domain@21 {
+					pgc_mipi_phy2: power-domain@16 {
 						#power-domain-cells = <0>;
-						power-domains = <&pgc_vpumix>;
-						reg = <IMX8MP_POWER_DOMAIN_VPU_G2>;
-						clocks = <&clk IMX8MP_CLK_VPU_G2_ROOT>;
+						reg = <IMX8MP_POWER_DOMAIN_MIPI_PHY2>;
 					};
 
-					pgc_vpu_vc8000e: power-domain@22 {
+					pgc_hsiomix: power-domain@17 {
 						#power-domain-cells = <0>;
-						power-domains = <&pgc_vpumix>;
-						reg = <IMX8MP_POWER_DOMAIN_VPU_VC8000E>;
-						clocks = <&clk IMX8MP_CLK_VPU_VC8KE_ROOT>;
+						reg = <IMX8MP_POWER_DOMAIN_HSIOMIX>;
+						clocks = <&clk IMX8MP_CLK_HSIO_AXI>,
+							 <&clk IMX8MP_CLK_HSIO_ROOT>;
+						assigned-clocks = <&clk IMX8MP_CLK_HSIO_AXI>;
+						assigned-clock-parents = <&clk IMX8MP_SYS_PLL2_500M>;
+						assigned-clock-rates = <500000000>;
 					};
 
-					pgc_mlmix: power-domain@24 {
+					pgc_ispdwp: power-domain@18 {
 						#power-domain-cells = <0>;
-						reg = <IMX8MP_POWER_DOMAIN_MLMIX>;
-						clocks = <&clk IMX8MP_CLK_ML_AXI>,
-							 <&clk IMX8MP_CLK_ML_AHB>,
-							 <&clk IMX8MP_CLK_NPU_ROOT>;
-						assigned-clocks = <&clk IMX8MP_CLK_ML_CORE>,
-								  <&clk IMX8MP_CLK_ML_AXI>,
-								  <&clk IMX8MP_CLK_ML_AHB>;
-						assigned-clock-parents = <&clk IMX8MP_SYS_PLL1_800M>,
-									 <&clk IMX8MP_SYS_PLL1_800M>,
-									 <&clk IMX8MP_SYS_PLL1_800M>;
-						assigned-clock-rates = <800000000>,
-								       <800000000>,
-								       <300000000>;
+						reg = <IMX8MP_POWER_DOMAIN_MEDIAMIX_ISPDWP>;
+						clocks = <&clk IMX8MP_CLK_MEDIA_ISP_ROOT>;
 					};
 				};
 			};
@@ -1243,7 +1261,7 @@
 				compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc";
 				reg = <0x30b40000 0x10000>;
 				interrupts = <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>;
-				clocks = <&clk IMX8MP_CLK_DUMMY>,
+				clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
 					 <&clk IMX8MP_CLK_NAND_USDHC_BUS>,
 					 <&clk IMX8MP_CLK_USDHC1_ROOT>;
 				clock-names = "ipg", "ahb", "per";
@@ -1257,7 +1275,7 @@
 				compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc";
 				reg = <0x30b50000 0x10000>;
 				interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
-				clocks = <&clk IMX8MP_CLK_DUMMY>,
+				clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
 					 <&clk IMX8MP_CLK_NAND_USDHC_BUS>,
 					 <&clk IMX8MP_CLK_USDHC2_ROOT>;
 				clock-names = "ipg", "ahb", "per";
@@ -1271,7 +1289,7 @@
 				compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc";
 				reg = <0x30b60000 0x10000>;
 				interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>;
-				clocks = <&clk IMX8MP_CLK_DUMMY>,
+				clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
 					 <&clk IMX8MP_CLK_NAND_USDHC_BUS>,
 					 <&clk IMX8MP_CLK_USDHC3_ROOT>;
 				clock-names = "ipg", "ahb", "per";
@@ -1885,6 +1903,27 @@
 				#power-domain-cells = <1>;
 				#clock-cells = <0>;
 			};
+
+			hdmi_blk_ctrl: blk-ctrl@32fc0000 {
+				compatible = "fsl,imx8mp-hdmi-blk-ctrl", "syscon";
+				reg = <0x32fc0000 0x1000>;
+				clocks = <&clk IMX8MP_CLK_HDMI_APB>,
+					 <&clk IMX8MP_CLK_HDMI_ROOT>,
+					 <&clk IMX8MP_CLK_HDMI_REF_266M>,
+					 <&clk IMX8MP_CLK_HDMI_24M>,
+					 <&clk IMX8MP_CLK_HDMI_FDCC_TST>;
+				clock-names = "apb", "axi", "ref_266m", "ref_24m", "fdcc";
+				power-domains = <&pgc_hdmimix>, <&pgc_hdmimix>,
+						<&pgc_hdmimix>, <&pgc_hdmimix>,
+						<&pgc_hdmimix>, <&pgc_hdmimix>,
+						<&pgc_hdmimix>, <&pgc_hdmi_phy>,
+						<&pgc_hdmimix>, <&pgc_hdmimix>;
+				power-domain-names = "bus", "irqsteer", "lcdif",
+						     "pai", "pvi", "trng",
+						     "hdmi-tx", "hdmi-tx-phy",
+						     "hdcp", "hrv";
+				#power-domain-cells = <1>;
+			};
 		};
 
 		pcie: pcie@33800000 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
@@ -36,7 +36,7 @@
 		regulator-name = "SD1_SPWR";
 		regulator-min-microvolt = <3000000>;
 		regulator-max-microvolt = <3000000>;
-		gpio = <&lsio_gpio4 19 GPIO_ACTIVE_HIGH>;
+		gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>;
 		enable-active-high;
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
@@ -96,15 +96,30 @@
 	status = "okay";
 };
 
+/* It is eDMA1 in 8QM RM, but 8QXP it is eDMA3 */
 &edma3 {
+	reg = <0x5a9f0000 0x210000>;
+	dma-channels = <10>;
+	interrupts = <GIC_SPI 424 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 425 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 426 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 427 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 428 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 429 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 430 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 431 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 432 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 433 IRQ_TYPE_LEVEL_HIGH>;
 	power-domains = <&pd IMX_SC_R_DMA_1_CH0>,
-		     <&pd IMX_SC_R_DMA_1_CH1>,
-		     <&pd IMX_SC_R_DMA_1_CH2>,
-		     <&pd IMX_SC_R_DMA_1_CH3>,
-		     <&pd IMX_SC_R_DMA_1_CH4>,
-		     <&pd IMX_SC_R_DMA_1_CH5>,
-		     <&pd IMX_SC_R_DMA_1_CH6>,
-		     <&pd IMX_SC_R_DMA_1_CH7>;
+			<&pd IMX_SC_R_DMA_1_CH1>,
+			<&pd IMX_SC_R_DMA_1_CH2>,
+			<&pd IMX_SC_R_DMA_1_CH3>,
+			<&pd IMX_SC_R_DMA_1_CH4>,
+			<&pd IMX_SC_R_DMA_1_CH5>,
+			<&pd IMX_SC_R_DMA_1_CH6>,
+			<&pd IMX_SC_R_DMA_1_CH7>,
+			<&pd IMX_SC_R_DMA_1_CH8>,
+			<&pd IMX_SC_R_DMA_1_CH9>;
 };
 
 &flexcan1 {
@@ -112,15 +127,15 @@
 };
 
 &flexcan2 {
-	clocks = <&can1_lpcg 1>,
-		 <&can1_lpcg 0>;
+	clocks = <&can1_lpcg IMX_LPCG_CLK_4>,
+		 <&can1_lpcg IMX_LPCG_CLK_0>;
 	assigned-clocks = <&clk IMX_SC_R_CAN_1 IMX_SC_PM_CLK_PER>;
 	fsl,clk-source = /bits/ 8 <1>;
 };
 
 &flexcan3 {
-	clocks = <&can2_lpcg 1>,
-		 <&can2_lpcg 0>;
+	clocks = <&can2_lpcg IMX_LPCG_CLK_4>,
+		 <&can2_lpcg IMX_LPCG_CLK_0>;
 	assigned-clocks = <&clk IMX_SC_R_CAN_2 IMX_SC_PM_CLK_PER>;
 	fsl,clk-source = /bits/ 8 <1>;
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi
@@ -5,6 +5,14 @@
  * Author: Alexander Stein
  */
 
+&mu_m0 {
+	interrupts = <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&mu1_m0 {
+	interrupts = <GIC_SPI 470 IRQ_TYPE_LEVEL_HIGH>;
+};
+
 &vpu_core0 {
 	reg = <0x2d040000 0x10000>;
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx8ulp.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx8ulp.dtsi
@@ -352,7 +352,7 @@
 			};
 
 			flexspi2: spi@29810000 {
-				compatible = "nxp,imx8mm-fspi";
+				compatible = "nxp,imx8ulp-fspi";
 				reg = <0x29810000 0x10000>, <0x60000000 0x10000000>;
 				reg-names = "fspi_base", "fspi_mmap";
 				#address-cells = <1>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts
@@ -175,7 +175,6 @@
 	vmmc-supply = <&reg_usdhc2_vmmc>;
 	bus-width = <4>;
 	status = "okay";
-	no-sdio;
 	no-mmc;
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts
@@ -438,7 +438,7 @@
 	pinctrl-0 = <&pinctrl_usdhc2_hs>, <&pinctrl_usdhc2_gpio>;
 	pinctrl-1 = <&pinctrl_usdhc2_uhs>, <&pinctrl_usdhc2_gpio>;
 	pinctrl-2 = <&pinctrl_usdhc2_uhs>, <&pinctrl_usdhc2_gpio>;
-	cd-gpios = <&gpio3 00 GPIO_ACTIVE_LOW>;
+	cd-gpios = <&gpio3 0 GPIO_ACTIVE_LOW>;
 	vmmc-supply = <&reg_usdhc2_vmmc>;
 	bus-width = <4>;
 	no-sdio;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi
@@ -19,7 +19,7 @@
 		linux,cma {
 			compatible = "shared-dma-pool";
 			reusable;
-			alloc-ranges = <0 0x60000000 0 0x40000000>;
+			alloc-ranges = <0 0x80000000 0 0x40000000>;
 			size = <0 0x10000000>;
 			linux,cma-default;
 		};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/freescale/imx93.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/freescale/imx93.dtsi
@@ -1030,6 +1030,8 @@
 				fsl,num-tx-queues = <3>;
 				fsl,num-rx-queues = <3>;
 				fsl,stop-mode = <&wakeupmix_gpr 0x0c 1>;
+				nvmem-cells = <&eth_mac1>;
+				nvmem-cell-names = "mac-address";
 				status = "disabled";
 			};
 
@@ -1051,7 +1053,9 @@
 							 <&clk IMX93_CLK_SYS_PLL_PFD0_DIV2>;
 				assigned-clock-rates = <100000000>, <250000000>;
 				intf_mode = <&wakeupmix_gpr 0x28>;
-				snps,clk-csr = <0>;
+				snps,clk-csr = <6>;
+				nvmem-cells = <&eth_mac2>;
+				nvmem-cell-names = "mac-address";
 				status = "disabled";
 			};
 
@@ -1136,6 +1140,15 @@
 			reg = <0x47510000 0x10000>;
 			#address-cells = <1>;
 			#size-cells = <1>;
+
+			eth_mac1: mac-address@4ec {
+				reg = <0x4ec 0x6>;
+			};
+
+			eth_mac2: mac-address@4f2 {
+				reg = <0x4f2 0x6>;
+			};
+
 		};
 
 		s4muap: mailbox@47520000 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi
@@ -58,7 +58,7 @@
 	gic: interrupt-controller@f1001000 {
 		compatible = "arm,gic-400";
 		reg = <0x0 0xf1001000 0x0 0x1000>,  /* GICD */
-		      <0x0 0xf1002000 0x0 0x100>;   /* GICC */
+		      <0x0 0xf1002000 0x0 0x2000>;  /* GICC */
 		#address-cells = <0>;
 		#interrupt-cells = <3>;
 		interrupt-controller;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
@@ -431,14 +431,14 @@
 			crypto: crypto@90000 {
 				compatible = "inside-secure,safexcel-eip97ies";
 				reg = <0x90000 0x20000>;
-				interrupts = <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>,
-					     <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
+				interrupts = <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
 					     <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>,
 					     <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>,
 					     <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>,
-					     <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>;
-				interrupt-names = "mem", "ring0", "ring1",
-						  "ring2", "ring3", "eip";
+					     <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
+					     <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
+				interrupt-names = "ring0", "ring1", "ring2",
+						  "ring3", "eip", "mem";
 				clocks = <&nb_periph_clk 15>;
 			};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
@@ -511,14 +511,14 @@
 		CP11X_LABEL(crypto): crypto@800000 {
 			compatible = "inside-secure,safexcel-eip197b";
 			reg = <0x800000 0x200000>;
-			interrupts = <87 IRQ_TYPE_LEVEL_HIGH>,
-				<88 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts = <88 IRQ_TYPE_LEVEL_HIGH>,
 				<89 IRQ_TYPE_LEVEL_HIGH>,
 				<90 IRQ_TYPE_LEVEL_HIGH>,
 				<91 IRQ_TYPE_LEVEL_HIGH>,
-				<92 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-names = "mem", "ring0", "ring1",
-				"ring2", "ring3", "eip";
+				<92 IRQ_TYPE_LEVEL_HIGH>,
+				<87 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "ring0", "ring1", "ring2", "ring3",
+					  "eip", "mem";
 			clock-names = "core", "reg";
 			clocks = <&CP11X_LABEL(clk) 1 26>,
 				 <&CP11X_LABEL(clk) 1 17>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt2712-evb.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt2712-evb.dts
@@ -129,7 +129,7 @@
 };
 
 &pio {
-	eth_default: eth_default {
+	eth_default: eth-default-pins {
 		tx_pins {
 			pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GBE_TXD3>,
 				 <MT2712_PIN_72_GBE_TXD2__FUNC_GBE_TXD2>,
@@ -156,7 +156,7 @@
 		};
 	};
 
-	eth_sleep: eth_sleep {
+	eth_sleep: eth-sleep-pins {
 		tx_pins {
 			pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GPIO71>,
 				 <MT2712_PIN_72_GBE_TXD2__FUNC_GPIO72>,
@@ -182,14 +182,14 @@
 		};
 	};
 
-	usb0_id_pins_float: usb0_iddig {
+	usb0_id_pins_float: usb0-iddig-pins {
 		pins_iddig {
 			pinmux = <MT2712_PIN_12_IDDIG_P0__FUNC_IDDIG_A>;
 			bias-pull-up;
 		};
 	};
 
-	usb1_id_pins_float: usb1_iddig {
+	usb1_id_pins_float: usb1-iddig-pins {
 		pins_iddig {
 			pinmux = <MT2712_PIN_14_IDDIG_P1__FUNC_IDDIG_B>;
 			bias-pull-up;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt2712e.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt2712e.dtsi
@@ -249,10 +249,11 @@
 		#clock-cells = <1>;
 	};
 
-	infracfg: syscon@10001000 {
+	infracfg: clock-controller@10001000 {
 		compatible = "mediatek,mt2712-infracfg", "syscon";
 		reg = <0 0x10001000 0 0x1000>;
 		#clock-cells = <1>;
+		#reset-cells = <1>;
 	};
 
 	pericfg: syscon@10003000 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt6357.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt6357.dtsi
@@ -10,6 +10,11 @@
 	mt6357_pmic: pmic {
 		compatible = "mediatek,mt6357";
 
+		pmic_adc: adc {
+			compatible = "mediatek,mt6357-auxadc";
+			#io-channel-cells = <1>;
+		};
+
 		regulators {
 			mt6357_vproc_reg: buck-vproc {
 				regulator-name = "vproc";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt6358.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt6358.dtsi
@@ -10,12 +10,17 @@
 		interrupt-controller;
 		#interrupt-cells = <2>;
 
-		mt6358codec: mt6358codec {
+		pmic_adc: adc {
+			compatible = "mediatek,mt6358-auxadc";
+			#io-channel-cells = <1>;
+		};
+
+		mt6358codec: audio-codec {
 			compatible = "mediatek,mt6358-sound";
 			mediatek,dmic-mode = <0>; /* two-wires */
 		};
 
-		mt6358regulator: mt6358regulator {
+		mt6358regulator: regulators {
 			compatible = "mediatek,mt6358-regulator";
 
 			mt6358_vdram1_reg: buck_vdram1 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt6359.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt6359.dtsi
@@ -9,6 +9,11 @@
 		interrupt-controller;
 		#interrupt-cells = <2>;
 
+		pmic_adc: adc {
+			compatible = "mediatek,mt6359-auxadc";
+			#io-channel-cells = <1>;
+		};
+
 		mt6359codec: mt6359codec {
 		};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
@@ -75,6 +75,7 @@
 
 	memory@40000000 {
 		reg = <0 0x40000000 0 0x40000000>;
+		device_type = "memory";
 	};
 
 	reg_1p8v: regulator-1p8v {
@@ -316,8 +317,8 @@
 	/* eMMC is shared pin with parallel NAND */
 	emmc_pins_default: emmc-pins-default {
 		mux {
-			function = "emmc", "emmc_rst";
-			groups = "emmc";
+			function = "emmc";
+			groups = "emmc", "emmc_rst";
 		};
 
 		/* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
@@ -57,6 +57,7 @@
 
 	memory@40000000 {
 		reg = <0 0x40000000 0 0x20000000>;
+		device_type = "memory";
 	};
 
 	reg_1p8v: regulator-1p8v {
@@ -243,8 +244,8 @@
 	/* eMMC is shared pin with parallel NAND */
 	emmc_pins_default: emmc-pins-default {
 		mux {
-			function = "emmc", "emmc_rst";
-			groups = "emmc";
+			function = "emmc";
+			groups = "emmc", "emmc_rst";
 		};
 
 		/* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt7622.dtsi
@@ -252,7 +252,7 @@
 		clock-names = "hif_sel";
 	};
 
-	cir: cir@10009000 {
+	cir: ir-receiver@10009000 {
 		compatible = "mediatek,mt7622-cir";
 		reg = <0 0x10009000 0 0x1000>;
 		interrupts = <GIC_SPI 175 IRQ_TYPE_LEVEL_LOW>;
@@ -283,16 +283,14 @@
 		};
 	};
 
-	apmixedsys: apmixedsys@10209000 {
-		compatible = "mediatek,mt7622-apmixedsys",
-			     "syscon";
+	apmixedsys: clock-controller@10209000 {
+		compatible = "mediatek,mt7622-apmixedsys";
 		reg = <0 0x10209000 0 0x1000>;
 		#clock-cells = <1>;
 	};
 
-	topckgen: topckgen@10210000 {
-		compatible = "mediatek,mt7622-topckgen",
-			     "syscon";
+	topckgen: clock-controller@10210000 {
+		compatible = "mediatek,mt7622-topckgen";
 		reg = <0 0x10210000 0 0x1000>;
 		#clock-cells = <1>;
 	};
@@ -515,7 +513,6 @@
 			 <&pericfg CLK_PERI_AUXADC_PD>;
 		clock-names = "therm", "auxadc";
 		resets = <&pericfg MT7622_PERI_THERM_SW_RST>;
-		reset-names = "therm";
 		mediatek,auxadc = <&auxadc>;
 		mediatek,apmixedsys = <&apmixedsys>;
 		nvmem-cells = <&thermal_calibration>;
@@ -734,9 +731,8 @@
 		power-domains = <&scpsys MT7622_POWER_DOMAIN_WB>;
 	};
 
-	ssusbsys: ssusbsys@1a000000 {
-		compatible = "mediatek,mt7622-ssusbsys",
-			     "syscon";
+	ssusbsys: clock-controller@1a000000 {
+		compatible = "mediatek,mt7622-ssusbsys";
 		reg = <0 0x1a000000 0 0x1000>;
 		#clock-cells = <1>;
 		#reset-cells = <1>;
@@ -793,9 +789,8 @@
 		};
 	};
 
-	pciesys: pciesys@1a100800 {
-		compatible = "mediatek,mt7622-pciesys",
-			     "syscon";
+	pciesys: clock-controller@1a100800 {
+		compatible = "mediatek,mt7622-pciesys";
 		reg = <0 0x1a100800 0 0x1000>;
 		#clock-cells = <1>;
 		#reset-cells = <1>;
@@ -921,12 +916,13 @@
 		};
 	};
 
-	hifsys: syscon@1af00000 {
-		compatible = "mediatek,mt7622-hifsys", "syscon";
+	hifsys: clock-controller@1af00000 {
+		compatible = "mediatek,mt7622-hifsys";
 		reg = <0 0x1af00000 0 0x70>;
+		#clock-cells = <1>;
 	};
 
-	ethsys: syscon@1b000000 {
+	ethsys: clock-controller@1b000000 {
 		compatible = "mediatek,mt7622-ethsys",
 			     "syscon";
 		reg = <0 0x1b000000 0 0x1000>;
@@ -966,9 +962,7 @@
 	};
 
 	eth: ethernet@1b100000 {
-		compatible = "mediatek,mt7622-eth",
-			     "mediatek,mt2701-eth",
-			     "syscon";
+		compatible = "mediatek,mt7622-eth";
 		reg = <0 0x1b100000 0 0x20000>;
 		interrupts = <GIC_SPI 223 IRQ_TYPE_LEVEL_LOW>,
 			     <GIC_SPI 224 IRQ_TYPE_LEVEL_LOW>,
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
@@ -43,7 +43,7 @@
 		#cooling-cells = <2>;
 		/* cooling level (0, 1, 2) - pwm inverted */
 		cooling-levels = <255 96 0>;
-		pwms = <&pwm 0 10000 0>;
+		pwms = <&pwm 0 10000>;
 		status = "okay";
 	};
 
@@ -146,19 +146,19 @@
 
 &cpu_thermal {
 	cooling-maps {
-		cpu-active-high {
+		map-cpu-active-high {
 			/* active: set fan to cooling level 2 */
 			cooling-device = <&fan 2 2>;
 			trip = <&cpu_trip_active_high>;
 		};
 
-		cpu-active-med {
+		map-cpu-active-med {
 			/* active: set fan to cooling level 1 */
 			cooling-device = <&fan 1 1>;
 			trip = <&cpu_trip_active_med>;
 		};
 
-		cpu-active-low {
+		map-cpu-active-low {
 			/* active: set fan to cooling level 0 */
 			cooling-device = <&fan 0 0>;
 			trip = <&cpu_trip_active_low>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts
@@ -237,12 +237,13 @@
 	pinctrl-0 = <&spi_flash_pins>;
 	cs-gpios = <0>, <0>;
 	status = "okay";
-	spi_nand: spi_nand@0 {
+
+	spi_nand: flash@0 {
 		compatible = "spi-nand";
 		reg = <0>;
 		spi-max-frequency = <10000000>;
-		spi-tx-buswidth = <4>;
-		spi-rx-buswidth = <4>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
 	};
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
@@ -16,49 +16,49 @@
 	#address-cells = <2>;
 	#size-cells = <2>;
 
-	clk40m: oscillator-40m {
-		compatible = "fixed-clock";
-		clock-frequency = <40000000>;
-		#clock-cells = <0>;
-		clock-output-names = "clkxtal";
-	};
-
 	cpus {
 		#address-cells = <1>;
 		#size-cells = <0>;
 		cpu0: cpu@0 {
-			device_type = "cpu";
 			compatible = "arm,cortex-a53";
-			enable-method = "psci";
 			reg = <0x0>;
+			device_type = "cpu";
+			enable-method = "psci";
 			#cooling-cells = <2>;
 		};
 
 		cpu1: cpu@1 {
-			device_type = "cpu";
 			compatible = "arm,cortex-a53";
-			enable-method = "psci";
 			reg = <0x1>;
+			device_type = "cpu";
+			enable-method = "psci";
 			#cooling-cells = <2>;
 		};
 
 		cpu2: cpu@2 {
-			device_type = "cpu";
 			compatible = "arm,cortex-a53";
-			enable-method = "psci";
 			reg = <0x2>;
+			device_type = "cpu";
+			enable-method = "psci";
 			#cooling-cells = <2>;
 		};
 
 		cpu3: cpu@3 {
-			device_type = "cpu";
-			enable-method = "psci";
 			compatible = "arm,cortex-a53";
 			reg = <0x3>;
+			device_type = "cpu";
+			enable-method = "psci";
 			#cooling-cells = <2>;
 		};
 	};
 
+	clk40m: oscillator-40m {
+		compatible = "fixed-clock";
+		clock-frequency = <40000000>;
+		#clock-cells = <0>;
+		clock-output-names = "clkxtal";
+	};
+
 	psci {
 		compatible = "arm,psci-0.2";
 		method = "smc";
@@ -121,38 +121,30 @@
 
 	};
 
-	timer {
-		compatible = "arm,armv8-timer";
-		interrupt-parent = <&gic>;
-		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
-			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
-			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
-	};
-
 	soc {
-		#address-cells = <2>;
-		#size-cells = <2>;
 		compatible = "simple-bus";
 		ranges;
+		#address-cells = <2>;
+		#size-cells = <2>;
 
 		gic: interrupt-controller@c000000 {
 			compatible = "arm,gic-v3";
-			#interrupt-cells = <3>;
-			interrupt-parent = <&gic>;
-			interrupt-controller;
 			reg = <0 0x0c000000 0 0x10000>,  /* GICD */
 			      <0 0x0c080000 0 0x80000>,  /* GICR */
 			      <0 0x0c400000 0 0x2000>,   /* GICC */
 			      <0 0x0c410000 0 0x1000>,   /* GICH */
 			      <0 0x0c420000 0 0x2000>;   /* GICV */
+			interrupt-parent = <&gic>;
 			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
 		};
 
 		infracfg: infracfg@10001000 {
 			compatible = "mediatek,mt7986-infracfg", "syscon";
 			reg = <0 0x10001000 0 0x1000>;
 			#clock-cells = <1>;
+			#reset-cells = <1>;
 		};
 
 		wed_pcie: wed-pcie@10003000 {
@@ -202,6 +194,19 @@
 			#interrupt-cells = <2>;
 		};
 
+		pwm: pwm@10048000 {
+			compatible = "mediatek,mt7986-pwm";
+			reg = <0 0x10048000 0 0x1000>;
+			#pwm-cells = <2>;
+			interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_PWM_SEL>,
+				 <&infracfg CLK_INFRA_PWM_STA>,
+				 <&infracfg CLK_INFRA_PWM1_CK>,
+				 <&infracfg CLK_INFRA_PWM2_CK>;
+			clock-names = "top", "main", "pwm1", "pwm2";
+			status = "disabled";
+		};
+
 		sgmiisys0: syscon@10060000 {
 			compatible = "mediatek,mt7986-sgmiisys_0",
 				     "syscon";
@@ -234,26 +239,11 @@
 				     <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "ring0", "ring1", "ring2", "ring3";
 			clocks = <&infracfg CLK_INFRA_EIP97_CK>;
-			clock-names = "infra_eip97_ck";
 			assigned-clocks = <&topckgen CLK_TOP_EIP_B_SEL>;
 			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>;
 			status = "disabled";
 		};
 
-		pwm: pwm@10048000 {
-			compatible = "mediatek,mt7986-pwm";
-			reg = <0 0x10048000 0 0x1000>;
-			#clock-cells = <1>;
-			#pwm-cells = <2>;
-			interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&topckgen CLK_TOP_PWM_SEL>,
-				 <&infracfg CLK_INFRA_PWM_STA>,
-				 <&infracfg CLK_INFRA_PWM1_CK>,
-				 <&infracfg CLK_INFRA_PWM2_CK>;
-			clock-names = "top", "main", "pwm1", "pwm2";
-			status = "disabled";
-		};
-
 		uart0: serial@11002000 {
 			compatible = "mediatek,mt7986-uart",
 				     "mediatek,mt6577-uart";
@@ -311,9 +301,9 @@
 
 		spi0: spi@1100a000 {
 			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			reg = <0 0x1100a000 0 0x100>;
 			#address-cells = <1>;
 			#size-cells = <0>;
-			reg = <0 0x1100a000 0 0x100>;
 			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&topckgen CLK_TOP_MPLL_D2>,
 				 <&topckgen CLK_TOP_SPI_SEL>,
@@ -325,9 +315,9 @@
 
 		spi1: spi@1100b000 {
 			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			reg = <0 0x1100b000 0 0x100>;
 			#address-cells = <1>;
 			#size-cells = <0>;
-			reg = <0 0x1100b000 0 0x100>;
 			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&topckgen CLK_TOP_MPLL_D2>,
 				 <&topckgen CLK_TOP_SPIM_MST_SEL>,
@@ -337,6 +327,20 @@
 			status = "disabled";
 		};
 
+		thermal: thermal@1100c800 {
+			compatible = "mediatek,mt7986-thermal";
+			reg = <0 0x1100c800 0 0x800>;
+			interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_THERM_CK>,
+				 <&infracfg CLK_INFRA_ADC_26M_CK>;
+			clock-names = "therm", "auxadc";
+			nvmem-cells = <&thermal_calibration>;
+			nvmem-cell-names = "calibration-data";
+			#thermal-sensor-cells = <1>;
+			mediatek,auxadc = <&auxadc>;
+			mediatek,apmixedsys = <&apmixedsys>;
+		};
+
 		auxadc: adc@1100d000 {
 			compatible = "mediatek,mt7986-auxadc";
 			reg = <0 0x1100d000 0 0x1000>;
@@ -388,39 +392,23 @@
 			status = "disabled";
 		};
 
-		thermal: thermal@1100c800 {
-			#thermal-sensor-cells = <1>;
-			compatible = "mediatek,mt7986-thermal";
-			reg = <0 0x1100c800 0 0x800>;
-			interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_THERM_CK>,
-				 <&infracfg CLK_INFRA_ADC_26M_CK>,
-				 <&infracfg CLK_INFRA_ADC_FRC_CK>;
-			clock-names = "therm", "auxadc", "adc_32k";
-			mediatek,auxadc = <&auxadc>;
-			mediatek,apmixedsys = <&apmixedsys>;
-			nvmem-cells = <&thermal_calibration>;
-			nvmem-cell-names = "calibration-data";
-		};
-
 		pcie: pcie@11280000 {
 			compatible = "mediatek,mt7986-pcie",
 				     "mediatek,mt8192-pcie";
+			reg = <0x00 0x11280000 0x00 0x4000>;
+			reg-names = "pcie-mac";
+			ranges = <0x82000000 0x00 0x20000000 0x00
+				  0x20000000 0x00 0x10000000>;
 			device_type = "pci";
 			#address-cells = <3>;
 			#size-cells = <2>;
-			reg = <0x00 0x11280000 0x00 0x4000>;
-			reg-names = "pcie-mac";
 			interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
 			bus-range = <0x00 0xff>;
-			ranges = <0x82000000 0x00 0x20000000 0x00
-				  0x20000000 0x00 0x10000000>;
 			clocks = <&infracfg CLK_INFRA_IPCIE_PIPE_CK>,
 				 <&infracfg CLK_INFRA_IPCIE_CK>,
 				 <&infracfg CLK_INFRA_IPCIER_CK>,
 				 <&infracfg CLK_INFRA_IPCIEB_CK>;
 			clock-names = "pl_250m", "tl_26m", "peri_26m", "top_133m";
-			status = "disabled";
 
 			phys = <&pcie_port PHY_TYPE_PCIE>;
 			phy-names = "pcie-phy";
@@ -431,6 +419,8 @@
 					<0 0 0 2 &pcie_intc 1>,
 					<0 0 0 3 &pcie_intc 2>,
 					<0 0 0 4 &pcie_intc 3>;
+			status = "disabled";
+
 			pcie_intc: interrupt-controller {
 				#address-cells = <0>;
 				#interrupt-cells = <1>;
@@ -441,9 +431,9 @@
 		pcie_phy: t-phy {
 			compatible = "mediatek,mt7986-tphy",
 				     "mediatek,generic-tphy-v2";
+			ranges;
 			#address-cells = <2>;
 			#size-cells = <2>;
-			ranges;
 			status = "disabled";
 
 			pcie_port: pcie-phy@11c00000 {
@@ -468,9 +458,9 @@
 		usb_phy: t-phy@11e10000 {
 			compatible = "mediatek,mt7986-tphy",
 				     "mediatek,generic-tphy-v2";
+			ranges = <0 0 0x11e10000 0x1700>;
 			#address-cells = <1>;
 			#size-cells = <1>;
-			ranges = <0 0 0x11e10000 0x1700>;
 			status = "disabled";
 
 			u2port0: usb-phy@0 {
@@ -498,8 +488,6 @@
 		};
 
 		ethsys: syscon@15000000 {
-			 #address-cells = <1>;
-			 #size-cells = <1>;
 			 compatible = "mediatek,mt7986-ethsys",
 				      "syscon";
 			 reg = <0 0x15000000 0 0x1000>;
@@ -533,20 +521,6 @@
 			mediatek,wo-ccif = <&wo_ccif1>;
 		};
 
-		wo_ccif0: syscon@151a5000 {
-			compatible = "mediatek,mt7986-wo-ccif", "syscon";
-			reg = <0 0x151a5000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
-		};
-
-		wo_ccif1: syscon@151ad000 {
-			compatible = "mediatek,mt7986-wo-ccif", "syscon";
-			reg = <0 0x151ad000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
-		};
-
 		eth: ethernet@15100000 {
 			compatible = "mediatek,mt7986-eth";
 			reg = <0 0x15100000 0 0x80000>;
@@ -579,26 +553,39 @@
 					  <&topckgen CLK_TOP_SGM_325M_SEL>;
 			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>,
 						 <&apmixedsys CLK_APMIXED_SGMPLL>;
+			#address-cells = <1>;
+			#size-cells = <0>;
 			mediatek,ethsys = <&ethsys>;
 			mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>;
 			mediatek,wed-pcie = <&wed_pcie>;
 			mediatek,wed = <&wed0>, <&wed1>;
-			#reset-cells = <1>;
-			#address-cells = <1>;
-			#size-cells = <0>;
 			status = "disabled";
 		};
 
+		wo_ccif0: syscon@151a5000 {
+			compatible = "mediatek,mt7986-wo-ccif", "syscon";
+			reg = <0 0x151a5000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		wo_ccif1: syscon@151ad000 {
+			compatible = "mediatek,mt7986-wo-ccif", "syscon";
+			reg = <0 0x151ad000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
 		wifi: wifi@18000000 {
 			compatible = "mediatek,mt7986-wmac";
+			reg = <0 0x18000000 0 0x1000000>,
+			      <0 0x10003000 0 0x1000>,
+			      <0 0x11d10000 0 0x1000>;
 			resets = <&watchdog MT7986_TOPRGU_CONSYS_SW_RST>;
 			reset-names = "consys";
 			clocks = <&topckgen CLK_TOP_CONN_MCUSYS_SEL>,
 				 <&topckgen CLK_TOP_AP2CNN_HOST_SEL>;
 			clock-names = "mcu", "ap2conn";
-			reg = <0 0x18000000 0 0x1000000>,
-			      <0 0x10003000 0 0x1000>,
-			      <0 0x11d10000 0 0x1000>;
 			interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 215 IRQ_TYPE_LEVEL_HIGH>,
@@ -646,4 +633,13 @@
 			};
 		};
 	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
@@ -152,12 +152,13 @@
 	pinctrl-0 = <&spi_flash_pins>;
 	cs-gpios = <0>, <0>;
 	status = "okay";
-	spi_nand: spi_nand@0 {
+
+	spi_nand: flash@0 {
 		compatible = "spi-nand";
 		reg = <0>;
 		spi-max-frequency = <10000000>;
-		spi-tx-buswidth = <4>;
-		spi-rx-buswidth = <4>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
 	};
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi
@@ -40,6 +40,14 @@
 		interrupts-extended = <&pio 117 IRQ_TYPE_LEVEL_LOW>;
 		reg = <0x2c>;
 		hid-descr-addr = <0x0020>;
+		/*
+		 * The trackpad needs a post-power-on delay of 100ms,
+		 * but at time of writing, the power supply for it on
+		 * this board is always on. The delay is therefore not
+		 * added to avoid impacting the readiness of the
+		 * trackpad.
+		 */
+		vdd-supply = <&mt6397_vgp6_reg>;
 		wakeup-source;
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-audio-da7219.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-audio-da7219.dtsi
@@ -27,7 +27,7 @@
 			dlg,btn-cfg = <50>;
 			dlg,mic-det-thr = <500>;
 			dlg,jack-ins-deb = <20>;
-			dlg,jack-det-rate = "32ms_64ms";
+			dlg,jack-det-rate = "32_64";
 			dlg,jack-rem-deb = <1>;
 
 			dlg,a-d-btn-thr = <0xa>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts
@@ -30,3 +30,6 @@
 	};
 };
 
+&i2c2 {
+	i2c-scl-internal-delay-ns = <4100>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts
@@ -17,6 +17,8 @@
 };
 
 &i2c2 {
+	i2c-scl-internal-delay-ns = <25000>;
+
 	trackpad@2c {
 		compatible = "hid-over-i2c";
 		reg = <0x2c>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts
@@ -30,3 +30,6 @@
 	qcom,ath10k-calibration-variant = "GO_DAMU";
 };
 
+&i2c2 {
+	i2c-scl-internal-delay-ns = <20000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi
@@ -25,3 +25,6 @@
 	};
 };
 
+&i2c2 {
+	i2c-scl-internal-delay-ns = <21500>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts
@@ -17,7 +17,7 @@
 		pinctrl-names = "default";
 		pinctrl-0 = <&bt_pins_wakeup>;
 
-		wobt {
+		event-wobt {
 			label = "Wake on BT";
 			gpios = <&pio 42 GPIO_ACTIVE_HIGH>;
 			linux,code = <KEY_WAKEUP>;
@@ -47,10 +47,8 @@
 	};
 };
 
-&wifi_wakeup {
-	wowlan {
-		gpios = <&pio 113 GPIO_ACTIVE_LOW>;
-	};
+&wifi_wakeup_event {
+	gpios = <&pio 113 GPIO_ACTIVE_LOW>;
 };
 
 &wifi_pwrseq {
@@ -82,7 +80,8 @@
 };
 
 &mmc1 {
-	bt_reset: bt-reset {
+	bluetooth@2 {
+		reg = <2>;
 		compatible = "mediatek,mt7921s-bluetooth";
 		pinctrl-names = "default";
 		pinctrl-0 = <&bt_pins_reset>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
@@ -8,28 +8,32 @@
 #include <arm/cros-ec-keyboard.dtsi>
 
 / {
-	pp1200_mipibrdg: pp1200-mipibrdg {
+	pp1000_mipibrdg: pp1000-mipibrdg {
 		compatible = "regulator-fixed";
-		regulator-name = "pp1200_mipibrdg";
+		regulator-name = "pp1000_mipibrdg";
+		regulator-min-microvolt = <1000000>;
+		regulator-max-microvolt = <1000000>;
 		pinctrl-names = "default";
-		pinctrl-0 = <&pp1200_mipibrdg_en>;
+		pinctrl-0 = <&pp1000_mipibrdg_en>;
 
 		enable-active-high;
 		regulator-boot-on;
 
 		gpio = <&pio 54 GPIO_ACTIVE_HIGH>;
+		vin-supply = <&pp1800_alw>;
 	};
 
 	pp1800_mipibrdg: pp1800-mipibrdg {
 		compatible = "regulator-fixed";
 		regulator-name = "pp1800_mipibrdg";
 		pinctrl-names = "default";
-		pinctrl-0 = <&pp1800_lcd_en>;
+		pinctrl-0 = <&pp1800_mipibrdg_en>;
 
 		enable-active-high;
 		regulator-boot-on;
 
 		gpio = <&pio 36 GPIO_ACTIVE_HIGH>;
+		vin-supply = <&pp1800_alw>;
 	};
 
 	pp3300_panel: pp3300-panel {
@@ -44,18 +48,20 @@
 		regulator-boot-on;
 
 		gpio = <&pio 35 GPIO_ACTIVE_HIGH>;
+		vin-supply = <&pp3300_alw>;
 	};
 
-	vddio_mipibrdg: vddio-mipibrdg {
+	pp3300_mipibrdg: pp3300-mipibrdg {
 		compatible = "regulator-fixed";
-		regulator-name = "vddio_mipibrdg";
+		regulator-name = "pp3300_mipibrdg";
 		pinctrl-names = "default";
-		pinctrl-0 = <&vddio_mipibrdg_en>;
+		pinctrl-0 = <&pp3300_mipibrdg_en>;
 
 		enable-active-high;
 		regulator-boot-on;
 
 		gpio = <&pio 37 GPIO_ACTIVE_HIGH>;
+		vin-supply = <&pp3300_alw>;
 	};
 
 	volume_buttons: volume-buttons {
@@ -151,25 +157,28 @@
 		pinctrl-0 = <&anx7625_pins>;
 		enable-gpios = <&pio 45 GPIO_ACTIVE_HIGH>;
 		reset-gpios = <&pio 73 GPIO_ACTIVE_HIGH>;
-		vdd10-supply = <&pp1200_mipibrdg>;
+		vdd10-supply = <&pp1000_mipibrdg>;
 		vdd18-supply = <&pp1800_mipibrdg>;
-		vdd33-supply = <&vddio_mipibrdg>;
+		vdd33-supply = <&pp3300_mipibrdg>;
 
-		#address-cells = <1>;
-		#size-cells = <0>;
-		port@0 {
-			reg = <0>;
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
 
-			anx7625_in: endpoint {
-				remote-endpoint = <&dsi_out>;
+			port@0 {
+				reg = <0>;
+
+				anx7625_in: endpoint {
+					remote-endpoint = <&dsi_out>;
+				};
 			};
-		};
 
-		port@1 {
-			reg = <1>;
+			port@1 {
+				reg = <1>;
 
-			anx7625_out: endpoint {
-				remote-endpoint = <&panel_in>;
+				anx7625_out: endpoint {
+					remote-endpoint = <&panel_in>;
+				};
 			};
 		};
 
@@ -393,14 +402,14 @@
 		"",
 		"";
 
-	pp1200_mipibrdg_en: pp1200-mipibrdg-en {
+	pp1000_mipibrdg_en: pp1000-mipibrdg-en {
 		pins1 {
 			pinmux = <PINMUX_GPIO54__FUNC_GPIO54>;
 			output-low;
 		};
 	};
 
-	pp1800_lcd_en: pp1800-lcd-en {
+	pp1800_mipibrdg_en: pp1800-mipibrdg-en {
 		pins1 {
 			pinmux = <PINMUX_GPIO36__FUNC_GPIO36>;
 			output-low;
@@ -462,7 +471,7 @@
 		};
 	};
 
-	vddio_mipibrdg_en: vddio-mipibrdg-en {
+	pp3300_mipibrdg_en: pp3300-mipibrdg-en {
 		pins1 {
 			pinmux = <PINMUX_GPIO37__FUNC_GPIO37>;
 			output-low;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
@@ -92,9 +92,9 @@
 	clock-frequency = <400000>;
 	vbus-supply = <&mt6358_vcn18_reg>;
 
-	eeprom@54 {
+	eeprom@50 {
 		compatible = "atmel,24c32";
-		reg = <0x54>;
+		reg = <0x50>;
 		pagesize = <32>;
 		vcc-supply = <&mt6358_vcn18_reg>;
 	};
@@ -360,6 +360,10 @@
 };
 
 &cros_ec {
+	cbas {
+		compatible = "google,cros-cbas";
+	};
+
 	keyboard-controller {
 		compatible = "google,cros-ec-keyb-switches";
 	};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
@@ -79,9 +79,9 @@
 	clock-frequency = <400000>;
 	vbus-supply = <&mt6358_vcn18_reg>;
 
-	eeprom@54 {
+	eeprom@50 {
 		compatible = "atmel,24c64";
-		reg = <0x54>;
+		reg = <0x50>;
 		pagesize = <32>;
 		vcc-supply = <&mt6358_vcn18_reg>;
 	};
@@ -339,6 +339,10 @@
 };
 
 &cros_ec {
+	cbas {
+		compatible = "google,cros-cbas";
+	};
+
 	keyboard-controller {
 		compatible = "google,cros-ec-keyb-switches";
 	};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
@@ -88,9 +88,9 @@
 	clock-frequency = <400000>;
 	vbus-supply = <&mt6358_vcn18_reg>;
 
-	eeprom@54 {
+	eeprom@50 {
 		compatible = "atmel,24c32";
-		reg = <0x54>;
+		reg = <0x50>;
 		pagesize = <32>;
 		vcc-supply = <&mt6358_vcn18_reg>;
 	};
@@ -343,6 +343,10 @@
 };
 
 &cros_ec {
+	cbas {
+		compatible = "google,cros-cbas";
+	};
+
 	keyboard-controller {
 		compatible = "google,cros-ec-keyb-switches";
 	};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
@@ -152,7 +152,7 @@
 		pinctrl-names = "default";
 		pinctrl-0 = <&wifi_pins_wakeup>;
 
-		button-wowlan {
+		wifi_wakeup_event: event-wowlan {
 			label = "Wake on WiFi";
 			gpios = <&pio 113 GPIO_ACTIVE_HIGH>;
 			linux,code = <KEY_WAKEUP>;
@@ -433,7 +433,6 @@
 };
 
 &mt6358_vgpu_reg {
-	regulator-min-microvolt = <625000>;
 	regulator-max-microvolt = <900000>;
 
 	regulator-coupled-with = <&mt6358_vsram_gpu_reg>;
@@ -804,7 +803,6 @@
 		};
 		pins-rts {
 			pinmux = <PINMUX_GPIO47__FUNC_URTS1>;
-			output-enable;
 		};
 		pins-cts {
 			pinmux = <PINMUX_GPIO46__FUNC_UCTS1>;
@@ -823,7 +821,6 @@
 		};
 		pins-rts {
 			pinmux = <PINMUX_GPIO47__FUNC_URTS1>;
-			output-enable;
 		};
 		pins-cts {
 			pinmux = <PINMUX_GPIO46__FUNC_UCTS1>;
@@ -937,10 +934,6 @@
 			google,usb-port-id = <0>;
 		};
 
-		cbas {
-			compatible = "google,cros-cbas";
-		};
-
 		typec {
 			compatible = "google,cros-ec-typec";
 			#address-cells = <1>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8183.dtsi
@@ -1628,6 +1628,7 @@
 			compatible = "mediatek,mt8183-mfgcfg", "syscon";
 			reg = <0 0x13000000 0 0x1000>;
 			#clock-cells = <1>;
+			power-domains = <&spm MT8183_POWER_DOMAIN_MFG_ASYNC>;
 		};
 
 		gpu: gpu@13040000 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8186.dtsi
@@ -731,7 +731,7 @@
 		opp-900000000-3 {
 			opp-hz = /bits/ 64 <900000000>;
 			opp-microvolt = <850000>;
-			opp-supported-hw = <0x8>;
+			opp-supported-hw = <0xcf>;
 		};
 
 		opp-900000000-4 {
@@ -743,13 +743,13 @@
 		opp-900000000-5 {
 			opp-hz = /bits/ 64 <900000000>;
 			opp-microvolt = <825000>;
-			opp-supported-hw = <0x30>;
+			opp-supported-hw = <0x20>;
 		};
 
 		opp-950000000-3 {
 			opp-hz = /bits/ 64 <950000000>;
 			opp-microvolt = <900000>;
-			opp-supported-hw = <0x8>;
+			opp-supported-hw = <0xcf>;
 		};
 
 		opp-950000000-4 {
@@ -761,13 +761,13 @@
 		opp-950000000-5 {
 			opp-hz = /bits/ 64 <950000000>;
 			opp-microvolt = <850000>;
-			opp-supported-hw = <0x30>;
+			opp-supported-hw = <0x20>;
 		};
 
 		opp-1000000000-3 {
 			opp-hz = /bits/ 64 <1000000000>;
 			opp-microvolt = <950000>;
-			opp-supported-hw = <0x8>;
+			opp-supported-hw = <0xcf>;
 		};
 
 		opp-1000000000-4 {
@@ -779,7 +779,7 @@
 		opp-1000000000-5 {
 			opp-hz = /bits/ 64 <1000000000>;
 			opp-microvolt = <875000>;
-			opp-supported-hw = <0x30>;
+			opp-supported-hw = <0x20>;
 		};
 	};
 
@@ -931,11 +931,17 @@
 
 				power-domain@MT8186_POWER_DOMAIN_SSUSB {
 					reg = <MT8186_POWER_DOMAIN_SSUSB>;
+					clocks = <&topckgen CLK_TOP_USB_TOP>,
+						 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_REF>;
+					clock-names = "sys_ck", "ref_ck";
 					#power-domain-cells = <0>;
 				};
 
 				power-domain@MT8186_POWER_DOMAIN_SSUSB_P1 {
 					reg = <MT8186_POWER_DOMAIN_SSUSB_P1>;
+					clocks = <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_SYS>,
+						 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_REF>;
+					clock-names = "sys_ck", "ref_ck";
 					#power-domain-cells = <0>;
 				};
 
@@ -1061,7 +1067,7 @@
 						reg = <MT8186_POWER_DOMAIN_VENC>;
 						clocks = <&topckgen CLK_TOP_VENC>,
 							 <&vencsys CLK_VENC_CKE1_VENC>;
-						clock-names = "venc0", "larb";
+						clock-names = "venc0", "subsys-larb";
 						mediatek,infracfg = <&infracfg_ao>;
 						#power-domain-cells = <0>;
 					};
@@ -1530,8 +1536,9 @@
 			clocks = <&topckgen CLK_TOP_USB_TOP>,
 				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_REF>,
 				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_HCLK>,
-				 <&infracfg_ao CLK_INFRA_AO_ICUSB>;
-			clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck";
+				 <&infracfg_ao CLK_INFRA_AO_ICUSB>,
+				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_XHCI>;
+			clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck", "xhci_ck";
 			interrupts = <GIC_SPI 303 IRQ_TYPE_LEVEL_HIGH 0>;
 			phys = <&u2port0 PHY_TYPE_USB2>;
 			power-domains = <&spm MT8186_POWER_DOMAIN_SSUSB>;
@@ -1595,8 +1602,9 @@
 			clocks = <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_SYS>,
 				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_REF>,
 				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_HCLK>,
-				 <&clk26m>;
-			clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck";
+				 <&clk26m>,
+				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_XHCI>;
+			clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck", "xhci_ck";
 			interrupts = <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH 0>;
 			phys = <&u2port1 PHY_TYPE_USB2>, <&u3port1 PHY_TYPE_USB3>;
 			power-domains = <&spm MT8186_POWER_DOMAIN_SSUSB_P1>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8188.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8188.dtsi
@@ -773,7 +773,6 @@
 					 <&clk26m>;
 				clock-names = "ref", "da_ref";
 				#phy-cells = <1>;
-				status = "disabled";
 			};
 		};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
@@ -147,6 +147,7 @@
 		regulator-boot-on;
 		gpio = <&pio 127 GPIO_ACTIVE_HIGH>;
 		vin-supply = <&pp3300_g>;
+		off-on-delay-us = <500000>;
 	};
 
 	/* separately switched 3.3V power rail */
@@ -1336,10 +1337,6 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 
-		base_detection: cbas {
-			compatible = "google,cros-cbas";
-		};
-
 		cros_ec_pwm: pwm {
 			compatible = "google,cros-ec-pwm";
 			#pwm-cells = <1>;
@@ -1424,7 +1421,7 @@
 			mt6315_6_vbuck1: vbuck1 {
 				regulator-compatible = "vbuck1";
 				regulator-name = "Vbcpu";
-				regulator-min-microvolt = <300000>;
+				regulator-min-microvolt = <400000>;
 				regulator-max-microvolt = <1193750>;
 				regulator-enable-ramp-delay = <256>;
 				regulator-allowed-modes = <0 1 2>;
@@ -1434,7 +1431,7 @@
 			mt6315_6_vbuck3: vbuck3 {
 				regulator-compatible = "vbuck3";
 				regulator-name = "Vlcpu";
-				regulator-min-microvolt = <300000>;
+				regulator-min-microvolt = <400000>;
 				regulator-max-microvolt = <1193750>;
 				regulator-enable-ramp-delay = <256>;
 				regulator-allowed-modes = <0 1 2>;
@@ -1451,7 +1448,7 @@
 			mt6315_7_vbuck1: vbuck1 {
 				regulator-compatible = "vbuck1";
 				regulator-name = "Vgpu";
-				regulator-min-microvolt = <606250>;
+				regulator-min-microvolt = <400000>;
 				regulator-max-microvolt = <800000>;
 				regulator-enable-ramp-delay = <256>;
 				regulator-allowed-modes = <0 1 2>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8192.dtsi
@@ -1456,6 +1456,7 @@
 			reg = <0 0x14001000 0 0x1000>;
 			interrupts = <GIC_SPI 252 IRQ_TYPE_LEVEL_HIGH 0>;
 			clocks = <&mmsys CLK_MM_DISP_MUTEX0>;
+			mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>;
 			mediatek,gce-events = <CMDQ_EVENT_DISP_STREAM_DONE_ENG_EVENT_0>,
 					      <CMDQ_EVENT_DISP_STREAM_DONE_ENG_EVENT_1>;
 			power-domains = <&spm MT8192_POWER_DOMAIN_DISP>;
@@ -1814,7 +1815,7 @@
 			mediatek,scp = <&scp>;
 			power-domains = <&spm MT8192_POWER_DOMAIN_VENC>;
 			clocks = <&vencsys CLK_VENC_SET1_VENC>;
-			clock-names = "venc-set1";
+			clock-names = "venc_sel";
 			assigned-clocks = <&topckgen CLK_TOP_VENC_SEL>;
 			assigned-clock-parents = <&topckgen CLK_TOP_UNIVPLL_D4>;
 		};
@@ -2225,7 +2226,7 @@
 			};
 		};
 
-		gpu0-thermal {
+		gpu-thermal {
 			polling-delay = <1000>;
 			polling-delay-passive = <250>;
 			thermal-sensors = <&lvts_ap MT8192_AP_GPU0>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts
@@ -23,3 +23,7 @@
 &ts_10 {
 	status = "okay";
 };
+
+&watchdog {
+	/delete-property/ mediatek,disable-extrst;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts
@@ -43,3 +43,7 @@
 &ts_10 {
 	status = "okay";
 };
+
+&watchdog {
+	/delete-property/ mediatek,disable-extrst;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts
@@ -44,3 +44,7 @@
 &ts_10 {
 	status = "okay";
 };
+
+&watchdog {
+	/delete-property/ mediatek,disable-extrst;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi
@@ -264,6 +264,38 @@
 	status = "okay";
 };
 
+&cpu0 {
+	cpu-supply = <&mt6359_vcore_buck_reg>;
+};
+
+&cpu1 {
+	cpu-supply = <&mt6359_vcore_buck_reg>;
+};
+
+&cpu2 {
+	cpu-supply = <&mt6359_vcore_buck_reg>;
+};
+
+&cpu3 {
+	cpu-supply = <&mt6359_vcore_buck_reg>;
+};
+
+&cpu4 {
+	cpu-supply = <&mt6315_6_vbuck1>;
+};
+
+&cpu5 {
+	cpu-supply = <&mt6315_6_vbuck1>;
+};
+
+&cpu6 {
+	cpu-supply = <&mt6315_6_vbuck1>;
+};
+
+&cpu7 {
+	cpu-supply = <&mt6315_6_vbuck1>;
+};
+
 &dp_intf0 {
 	status = "okay";
 
@@ -1213,7 +1245,7 @@
 			mt6315_6_vbuck1: vbuck1 {
 				regulator-compatible = "vbuck1";
 				regulator-name = "Vbcpu";
-				regulator-min-microvolt = <300000>;
+				regulator-min-microvolt = <400000>;
 				regulator-max-microvolt = <1193750>;
 				regulator-enable-ramp-delay = <256>;
 				regulator-ramp-delay = <6250>;
@@ -1231,7 +1263,7 @@
 			mt6315_7_vbuck1: vbuck1 {
 				regulator-compatible = "vbuck1";
 				regulator-name = "Vgpu";
-				regulator-min-microvolt = <625000>;
+				regulator-min-microvolt = <400000>;
 				regulator-max-microvolt = <1193750>;
 				regulator-enable-ramp-delay = <256>;
 				regulator-ramp-delay = <6250>;
@@ -1305,6 +1337,7 @@
 	rx-fifo-depth = <3072>;
 	vusb33-supply = <&mt6359_vusb_ldo_reg>;
 	vbus-supply = <&usb_vbus>;
+	mediatek,u3p-dis-msk = <1>;
 };
 
 &xhci2 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8195.dtsi
@@ -487,7 +487,7 @@
 		};
 
 		infracfg_ao: syscon@10001000 {
-			compatible = "mediatek,mt8195-infracfg_ao", "syscon", "simple-mfd";
+			compatible = "mediatek,mt8195-infracfg_ao", "syscon";
 			reg = <0 0x10001000 0 0x1000>;
 			#clock-cells = <1>;
 			#reset-cells = <1>;
@@ -1998,6 +1998,7 @@
 			compatible = "mediatek,mt8195-vppsys0", "syscon";
 			reg = <0 0x14000000 0 0x1000>;
 			#clock-cells = <1>;
+			mediatek,gce-client-reg = <&gce1 SUBSYS_1400XXXX 0 0x1000>;
 		};
 
 		dma-controller@14001000 {
@@ -2221,6 +2222,7 @@
 			compatible = "mediatek,mt8195-vppsys1", "syscon";
 			reg = <0 0x14f00000 0 0x1000>;
 			#clock-cells = <1>;
+			mediatek,gce-client-reg = <&gce1 SUBSYS_14f0XXXX 0 0x1000>;
 		};
 
 		mutex@14f01000 {
@@ -3050,6 +3052,7 @@
 			reg = <0 0x1c01a000 0 0x1000>;
 			mboxes = <&gce0 0 CMDQ_THR_PRIO_4>;
 			#clock-cells = <1>;
+			mediatek,gce-client-reg = <&gce0 SUBSYS_1c01XXXX 0xa000 0x1000>;
 		};
 
 
@@ -3218,10 +3221,10 @@
 			compatible = "mediatek,mt8195-dp-intf";
 			reg = <0 0x1c015000 0 0x1000>;
 			interrupts = <GIC_SPI 657 IRQ_TYPE_LEVEL_HIGH 0>;
-			clocks = <&vdosys0  CLK_VDO0_DP_INTF0>,
-				 <&vdosys0 CLK_VDO0_DP_INTF0_DP_INTF>,
+			clocks = <&vdosys0 CLK_VDO0_DP_INTF0_DP_INTF>,
+				 <&vdosys0  CLK_VDO0_DP_INTF0>,
 				 <&apmixedsys CLK_APMIXED_TVDPLL1>;
-			clock-names = "engine", "pixel", "pll";
+			clock-names = "pixel", "engine", "pll";
 			status = "disabled";
 		};
 
@@ -3231,6 +3234,7 @@
 			interrupts = <GIC_SPI 658 IRQ_TYPE_LEVEL_HIGH 0>;
 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS0>;
 			clocks = <&vdosys0 CLK_VDO0_DISP_MUTEX0>;
+			mediatek,gce-client-reg = <&gce0 SUBSYS_1c01XXXX 0x6000 0x1000>;
 			mediatek,gce-events = <CMDQ_EVENT_VDO0_DISP_STREAM_DONE_0>;
 		};
 
@@ -3296,11 +3300,10 @@
 		mutex1: mutex@1c101000 {
 			compatible = "mediatek,mt8195-disp-mutex";
 			reg = <0 0x1c101000 0 0x1000>;
-			reg-names = "vdo1_mutex";
 			interrupts = <GIC_SPI 494 IRQ_TYPE_LEVEL_HIGH 0>;
 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
 			clocks = <&vdosys1 CLK_VDO1_DISP_MUTEX>;
-			clock-names = "vdo1_mutex";
+			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x1000 0x1000>;
 			mediatek,gce-events = <CMDQ_EVENT_VDO1_STREAM_DONE_ENG_0>;
 		};
 
@@ -3486,10 +3489,10 @@
 			reg = <0 0x1c113000 0 0x1000>;
 			interrupts = <GIC_SPI 513 IRQ_TYPE_LEVEL_HIGH 0>;
 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
-			clocks = <&vdosys1 CLK_VDO1_DP_INTF0_MM>,
-				 <&vdosys1 CLK_VDO1_DPINTF>,
+			clocks = <&vdosys1 CLK_VDO1_DPINTF>,
+				 <&vdosys1 CLK_VDO1_DP_INTF0_MM>,
 				 <&apmixedsys CLK_APMIXED_TVDPLL2>;
-			clock-names = "engine", "pixel", "pll";
+			clock-names = "pixel", "engine", "pll";
 			status = "disabled";
 		};
 
@@ -3845,7 +3848,7 @@
 			};
 		};
 
-		gpu0-thermal {
+		gpu-thermal {
 			polling-delay = <1000>;
 			polling-delay-passive = <250>;
 			thermal-sensors = <&lvts_ap MT8195_AP_GPU0>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts
@@ -187,7 +187,7 @@
 		compatible = "snps,dwmac-mdio";
 		#address-cells = <1>;
 		#size-cells = <0>;
-		eth_phy0: eth-phy0@1 {
+		eth_phy0: ethernet-phy@1 {
 			compatible = "ethernet-phy-id001c.c916";
 			reg = <0x1>;
 		};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
@@ -9,8 +9,8 @@
 	compatible = "nvidia,norrin", "nvidia,tegra132", "nvidia,tegra124";
 
 	aliases {
-		rtc0 = "/i2c@7000d000/as3722@40";
-		rtc1 = "/rtc@7000e000";
+		rtc0 = &as3722;
+		rtc1 = &tegra_rtc;
 		serial0 = &uarta;
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/nvidia/tegra132.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/nvidia/tegra132.dtsi
@@ -572,7 +572,7 @@
 		status = "disabled";
 	};
 
-	rtc@7000e000 {
+	tegra_rtc: rtc@7000e000 {
 		compatible = "nvidia,tegra124-rtc", "nvidia,tegra20-rtc";
 		reg = <0x0 0x7000e000 0x0 0x100>;
 		interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/nvidia/tegra234-p3701-0008.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/nvidia/tegra234-p3701-0008.dtsi
@@ -44,39 +44,6 @@
 			status = "okay";
 		};
 
-		i2c@c250000 {
-			power-sensor@41 {
-				compatible = "ti,ina3221";
-				reg = <0x41>;
-				#address-cells = <1>;
-				#size-cells = <0>;
-
-				input@0 {
-					reg = <0x0>;
-					label = "CVB_ATX_12V";
-					shunt-resistor-micro-ohms = <2000>;
-				};
-
-				input@1 {
-					reg = <0x1>;
-					label = "CVB_ATX_3V3";
-					shunt-resistor-micro-ohms = <2000>;
-				};
-
-				input@2 {
-					reg = <0x2>;
-					label = "CVB_ATX_5V";
-					shunt-resistor-micro-ohms = <2000>;
-				};
-			};
-
-			power-sensor@44 {
-				compatible = "ti,ina219";
-				reg = <0x44>;
-				shunt-resistor = <2000>;
-			};
-		};
-
 		rtc@c2a0000 {
 			status = "okay";
 		};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/nvidia/tegra234-p3740-0002.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/nvidia/tegra234-p3740-0002.dtsi
@@ -183,6 +183,39 @@
 			phy-names = "usb2-0", "usb2-1", "usb2-2", "usb2-3",
 				"usb3-0", "usb3-1", "usb3-2";
 		};
+
+		i2c@c250000 {
+			power-sensor@41 {
+				compatible = "ti,ina3221";
+				reg = <0x41>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				input@0 {
+					reg = <0x0>;
+					label = "CVB_ATX_12V";
+					shunt-resistor-micro-ohms = <2000>;
+				};
+
+				input@1 {
+					reg = <0x1>;
+					label = "CVB_ATX_3V3";
+					shunt-resistor-micro-ohms = <2000>;
+				};
+
+				input@2 {
+					reg = <0x2>;
+					label = "CVB_ATX_5V";
+					shunt-resistor-micro-ohms = <2000>;
+				};
+			};
+
+			power-sensor@44 {
+				compatible = "ti,ina219";
+				reg = <0x44>;
+				shunt-resistor = <2000>;
+			};
+		};
 	};
 
 	vdd_3v3_dp: regulator-vdd-3v3-dp {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/Makefile
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/Makefile
@@ -88,20 +88,86 @@
 dtb-$(CONFIG_ARCH_QCOM)	+= msm8998-sony-xperia-yoshino-poplar.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= msm8998-xiaomi-sagit.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qcm6490-fairphone-fp5.dtb
+#dtb-$(CONFIG_ARCH_QCOM)	+= qcm6490-addons-idp.dtb
+#dtb-$(CONFIG_ARCH_QCOM)	+= qcm6490-addons-idp-amoled.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qcm6490-idp.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qcs404-evb-1000.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qcs404-evb-4000.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs5430-fp1-addons-rb3gen2.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp1-addons-rb3gen2-hsp.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs5430-fp1-addons-rb3gen2-vision-mezz.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp1-addons-rb3gen2-vision-mezz-hsp.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs5430-fp1p5-addons-rb3gen2.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs5430-fp1p5-addons-rb3gen2-vision-mezz.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs5430-fp2-addons-rb3gen2.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp2-addons-rb3gen2-hsp.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs5430-fp2-addons-rb3gen2-vision-mezz.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp2-addons-rb3gen2-vision-mezz-hsp.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp2p5-addons-rb3gen2.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp2p5-addons-rb3gen2-hsp.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp2p5-addons-rb3gen2-vision-mezz.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp2p5-addons-rb3gen2-vision-mezz-hsp.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp3-addons-rb3gen2.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp3-addons-rb3gen2-hsp.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp3-addons-rb3gen2-vision-mezz.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp3-addons-rb3gen2-vision-mezz-hsp.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs615-addons-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs615-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs6490-addons-rb3gen2.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs6490-addons-rb3gen2-hsp.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs6490-addons-rb3gen2-ia-mezz.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs6490-addons-rb3gen2-ptz-mezz.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs6490-addons-rb3gen2-video-mezz.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs6490-addons-rb3gen2-vision-mezz.dtb
+dtb-$(CONFIG_ARCH_QCOM) += qcs6490-addons-rb3gen2-vision-mezz-hsp.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qcs6490-rb3gen2.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs6490-rb3gen2-vision-mezzanine.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs8300-addons-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs8300-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs8550-addons-aim300-aiot.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs8550-aim300-aiot.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs8550-rb5gen2-hdk.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9075-addons-iq-9075-evk.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9075-addons-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9075-addons-ride-r3.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9075-iq-9075-evk.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9075-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9075-ride-r3.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9100-addons-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9100-addons-ride-r3.dtb
+
+qcs9100-addons-ride-el2-dtbs:= qcs9100-addons-ride.dtb sa8775p-el2.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs9100-addons-ride-el2.dtb
+
+qcs9100-addons-ride-r3-el2-dtbs:= qcs9100-addons-ride-r3.dtb sa8775p-el2.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs9100-addons-ride-r3-el2.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9100-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= qcs9100-ride-r3.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qdu1000-idp.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qrb2210-rb1.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qrb4210-rb2.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qrb5165-rb5.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qrb5165-rb5-vision-mezzanine.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= qru1000-idp.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= sa7255p-ride.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sa8155p-adp.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= sa8255p-ride.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sa8295p-adp.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sa8540p-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= sa8775p-addons-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= sa8775p-addons-ride-r3.dtb
+
+sa8775p-addons-ride-el2-dtbs:= sa8775p-addons-ride.dtb sa8775p-el2.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += sa8775p-addons-ride-el2.dtb
+
+sa8775p-addons-ride-r3-el2-dtbs:= sa8775p-addons-ride-r3.dtb sa8775p-el2.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += sa8775p-addons-ride-r3-el2.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sa8775p-ride.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= sa8775p-ride-r3.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sc7180-acer-aspire1.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sc7180-idp.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sc7180-trogdor-coachz-r1.dtb
@@ -237,5 +303,88 @@
 dtb-$(CONFIG_ARCH_QCOM)	+= sm8550-qrd.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sm8650-mtp.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sm8650-qrd.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= sm8650p-addons-aim500-aiot.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= sm8650p-aim500-aiot.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= x1e80100-addons-crd.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= x1e80100-crd.dtb
+dtb-$(CONFIG_ARCH_QCOM)	+= x1e80100-addons-qcp.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= x1e80100-qcp.dtb
+
+# External overlays
+dtb-$(CONFIG_ARCH_QCOM) += qcs6490-addons-rb3gen2-video-mezz-ovl.dtb
+qcs6490-addons-rb3gen2-video-mezz-ovl-dtbs := \
+    qcs6490-addons-rb3gen2-video-mezz.dtb \
+    qcm6490-graphics.dtbo \
+    qcm6490-camera-rb3.dtbo \
+    qcm6490-video.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs6490-addons-rb3gen2-vision-mezz-ovl.dtb
+qcs6490-addons-rb3gen2-vision-mezz-ovl-dtbs := \
+    qcs6490-addons-rb3gen2-vision-mezz.dtb \
+    qcm6490-graphics.dtbo \
+    qcm6490-camera-rb3.dtbo \
+    qcm6490-video.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs6490-addons-rb3gen2-ia-mezz-ovl.dtb
+
+$(obj)/qcs6490-addons-rb3gen2-ia-mezz-ovl.dtb: $(obj)/qcs6490-addons-rb3gen2-ia-mezz.dtb FORCE
+	$(call if_changed,copy)
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp1-addons-rb3gen2-vision-mezz-ovl.dtb
+qcs5430-fp1-addons-rb3gen2-vision-mezz-ovl-dtbs := \
+    qcs5430-fp1-addons-rb3gen2-vision-mezz.dtb \
+    qcs5430-graphics.dtbo \
+    qcm5430-camera-rb3.dtbo \
+    qcm6490-video.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp2-addons-rb3gen2-vision-mezz-ovl.dtb
+qcs5430-fp2-addons-rb3gen2-vision-mezz-ovl-dtbs := \
+    qcs5430-fp2-addons-rb3gen2-vision-mezz.dtb \
+    qcs5430-graphics.dtbo \
+    qcm5430-camera-rb3.dtbo \
+    qcm6490-video.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp2p5-addons-rb3gen2-vision-mezz-ovl.dtb
+qcs5430-fp2p5-addons-rb3gen2-vision-mezz-ovl-dtbs := \
+    qcs5430-fp2p5-addons-rb3gen2-vision-mezz.dtb \
+    qcs5430-graphics.dtbo \
+    qcm5430-camera-rb3.dtbo \
+    qcm6490-video.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs5430-fp3-addons-rb3gen2-vision-mezz-ovl.dtb
+qcs5430-fp3-addons-rb3gen2-vision-mezz-ovl-dtbs := \
+    qcs5430-fp3-addons-rb3gen2-vision-mezz.dtb \
+    qcs5430-graphics.dtbo \
+    qcm5430-camera-rb3.dtbo \
+    qcm6490-video.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs9100-addons-ride-ovl.dtb
+qcs9100-addons-ride-ovl-dtbs := \
+    qcs9100-addons-ride.dtb \
+    sa8775p-video.dtbo \
+    qcs9100-graphics.dtbo \
+    qcs9100-ride-sx-camera.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs9100-addons-ride-r3-ovl.dtb
+qcs9100-addons-ride-r3-ovl-dtbs := \
+    qcs9100-addons-ride-r3.dtb \
+    sa8775p-video.dtbo \
+    qcs9100-graphics.dtbo \
+    qcs9100-ride-sx-camera.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM) += qcs9075-addons-iq-9075-evk-ovl.dtb
+qcs9075-addons-iq-9075-evk-ovl-dtbs := \
+    qcs9075-addons-iq-9075-evk.dtb \
+    sa8775p-video.dtbo \
+    qcs9100-graphics.dtbo \
+    qcs9075-camera-iq-9075-evk.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM)	+= combined-dtb.dtb
+
+dtbs-to-combined := $(filter %-ovl.dtb, $(dtb-y))
+
+quiet_cmd_cat = CAT     $@
+      cmd_cat = cat $(real-prereqs) > $@
+
+$(obj)/combined-dtb.dtb: $(addprefix $(obj)/, $(filter %-ovl.dtb, $(dtb-y))) FORCE
+	$(call if_changed,cat)
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/ipq6018.dtsi
@@ -642,6 +642,7 @@
 				clocks = <&xo>;
 				clock-names = "ref";
 				tx-fifo-resize;
+				snps,parkmode-disable-ss-quirk;
 				snps,is-utmi-l1-suspend;
 				snps,hird-threshold = /bits/ 8 <0x0>;
 				snps,dis_u2_susphy_quirk;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/ipq8074.dtsi
@@ -638,6 +638,7 @@
 				interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
 				phys = <&qusb_phy_0>, <&ssphy_0>;
 				phy-names = "usb2-phy", "usb3-phy";
+				snps,parkmode-disable-ss-quirk;
 				snps,is-utmi-l1-suspend;
 				snps,hird-threshold = /bits/ 8 <0x0>;
 				snps,dis_u2_susphy_quirk;
@@ -680,6 +681,7 @@
 				interrupts = <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
 				phys = <&qusb_phy_1>, <&ssphy_1>;
 				phy-names = "usb2-phy", "usb3-phy";
+				snps,parkmode-disable-ss-quirk;
 				snps,is-utmi-l1-suspend;
 				snps,hird-threshold = /bits/ 8 <0x0>;
 				snps,dis_u2_susphy_quirk;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8939.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8939.dtsi
@@ -2463,7 +2463,7 @@
 					type = "passive";
 				};
 
-				gpu_crit: gpu_crit {
+				gpu_crit: gpu-crit {
 					temperature = <95000>;
 					hysteresis = <2000>;
 					type = "critical";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8953-motorola-potter.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8953-motorola-potter.dts
@@ -301,5 +301,6 @@
 };
 
 &usb3_dwc3 {
+	/delete-property/ usb-role-switch;
 	dr_mode = "peripheral";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8953-xiaomi-daisy.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8953-xiaomi-daisy.dts
@@ -321,5 +321,6 @@
 };
 
 &usb3_dwc3 {
+	/delete-property/ usb-role-switch;
 	dr_mode = "peripheral";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8953-xiaomi-mido.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8953-xiaomi-mido.dts
@@ -326,5 +326,6 @@
 };
 
 &usb3_dwc3 {
+	/delete-property/ usb-role-switch;
 	dr_mode = "peripheral";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8953-xiaomi-tissot.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8953-xiaomi-tissot.dts
@@ -322,5 +322,6 @@
 };
 
 &usb3_dwc3 {
+	/delete-property/ usb-role-switch;
 	dr_mode = "peripheral";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8953-xiaomi-vince.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8953-xiaomi-vince.dts
@@ -357,5 +357,6 @@
 };
 
 &usb3_dwc3 {
+	/delete-property/ usb-role-switch;
 	dr_mode = "peripheral";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi
@@ -377,7 +377,7 @@
 &blsp2_i2c1 {
 	status = "okay";
 
-	sideinteraction: ad7147_captouch@2c {
+	sideinteraction: touch@2c {
 		compatible = "ad,ad7147_captouch";
 		reg = <0x2c>;
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi
@@ -79,7 +79,7 @@
 			pmsg-size = <0x80000>;
 		};
 
-		fb_region: fb_region@40000000 {
+		fb_region: fb@40000000 {
 			reg = <0 0x40000000 0 0x1000000>;
 			no-map;
 		};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8994.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8994.dtsi
@@ -233,7 +233,7 @@
 		#size-cells = <2>;
 		ranges;
 
-		dfps_data_mem: dfps_data_mem@3400000 {
+		dfps_data_mem: dfps-data@3400000 {
 			reg = <0 0x03400000 0 0x1000>;
 			no-map;
 		};
@@ -243,7 +243,7 @@
 			no-map;
 		};
 
-		smem_mem: smem_region@6a00000 {
+		smem_mem: smem@6a00000 {
 			reg = <0 0x06a00000 0 0x200000>;
 			no-map;
 		};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi
@@ -405,7 +405,6 @@
 
 &hsusb_phy1 {
 	status = "okay";
-	extcon = <&typec>;
 
 	vdda-pll-supply = <&vreg_l12a_1p8>;
 	vdda-phy-dpdm-supply = <&vreg_l24a_3p075>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -756,12 +756,12 @@
 			#address-cells = <1>;
 			#size-cells = <1>;
 
-			qusb2p_hstx_trim: hstx_trim@24e {
+			qusb2p_hstx_trim: hstx-trim@24e {
 				reg = <0x24e 0x2>;
 				bits = <5 4>;
 			};
 
-			qusb2s_hstx_trim: hstx_trim@24f {
+			qusb2s_hstx_trim: hstx-trim@24f {
 				reg = <0x24f 0x1>;
 				bits = <1 4>;
 			};
@@ -2072,7 +2072,7 @@
 				<&gcc GCC_UFS_RX_SYMBOL_0_CLK>;
 			freq-table-hz =
 				<100000000 200000000>,
-				<0 0>,
+				<100000000 200000000>,
 				<0 0>,
 				<0 0>,
 				<0 0>,
@@ -3061,6 +3061,7 @@
 				snps,dis_u2_susphy_quirk;
 				snps,dis_enblslpm_quirk;
 				snps,is-utmi-l1-suspend;
+				snps,parkmode-disable-ss-quirk;
 				tx-fifo-resize;
 			};
 		};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/msm8998.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/msm8998.dtsi
@@ -1575,7 +1575,6 @@
 			 * SoC VDDMX RPM Power Domain in the Adreno driver.
 			 */
 			power-domains = <&gpucc GPU_GX_GDSC>;
-			status = "disabled";
 		};
 
 		gpucc: clock-controller@5065000 {
@@ -2146,6 +2145,7 @@
 				interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
 				snps,dis_u2_susphy_quirk;
 				snps,dis_enblslpm_quirk;
+				snps,parkmode-disable-ss-quirk;
 				phys = <&qusb2phy>, <&usb3phy>;
 				phy-names = "usb2-phy", "usb3-phy";
 				snps,has-lpm-erratum;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/pineapple-gpu-pwrlevels.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/pineapple-gpu-pwrlevels.dtsi
@@ -0,0 +1,687 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/* ACD Control register values */
+#define ACD_LEVEL_TURBO_L1    0x882f5ffd
+#define ACD_LEVEL_TURBO       0x882f5ffd
+#define ACD_LEVEL_NOM_L1      0x882f5ffd
+#define ACD_LEVEL_NOM         0xc0285ffd
+#define ACD_LEVEL_SVS_L2      0xe0295ffd
+#define ACD_LEVEL_SVS_L1      0xe0295ffd
+#define ACD_LEVEL_SVS_L0      0xc02a5ffd
+#define ACD_LEVEL_SVS         0xc02a5ffd
+#define ACD_LEVEL_LOW_SVS_L1  0xc02c5ffd
+#define ACD_LEVEL_LOW_SVS     0xc02f5ffd
+#define ACD_LEVEL_LOW_SVS_D0  0xc02f5ffd
+
+&msm_gpu {
+	/* Power levels */
+	qcom,gpu-pwrlevel-bins {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "qcom,gpu-pwrlevels-bins";
+
+		qcom,gpu-pwrlevels-0 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,sku-codes = <SKU_CODE(PCODE_UNKNOWN, FC_AC)>;
+			qcom,speed-bin = <2>;
+
+			qcom,initial-pwrlevel = <12>;
+
+			/* Turbo_L1 */
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <903000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_TURBO_L1>;
+
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_TURBO_L1>;
+			};
+
+			/* Turbo */
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <869000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_TURBO>;
+
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <8>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_TURBO>;
+			};
+
+			/* Nom_L1 */
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <834000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_NOM_L1>;
+			};
+
+			/* Nom */
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <770000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_NOM>;
+			};
+
+			/* SVS_L2 */
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <720000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L2>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L2>;
+			};
+
+			/* SVS_L1 */
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <680000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <5>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L1>;
+			};
+
+			/* SVS_L0 */
+			qcom,gpu-pwrlevel@6 {
+				reg = <6>;
+				qcom,gpu-freq = <629000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L0>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <4>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L0>;
+			};
+
+			/* SVS */
+			qcom,gpu-pwrlevel@7 {
+				reg = <7>;
+				qcom,gpu-freq = <578000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <4>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS>;
+			};
+
+			/* Low_SVS_L1 */
+			qcom,gpu-pwrlevel@8 {
+				reg = <8>;
+				qcom,gpu-freq = <500000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_L1>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS_L1>;
+			};
+
+			/* Low_SVS */
+			qcom,gpu-pwrlevel@9 {
+				reg = <9>;
+				qcom,gpu-freq = <422000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS>;
+			};
+
+			/* Low_SVS_D0 */
+			qcom,gpu-pwrlevel@10 {
+				reg = <10>;
+				qcom,gpu-freq = <366000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D0>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <5>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS_D0>;
+			};
+
+			/* Low_SVS_D1 */
+			qcom,gpu-pwrlevel@11 {
+				reg = <11>;
+				qcom,gpu-freq = <310000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D1>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <4>;
+			};
+
+			/* Low_SVS_D2 */
+			qcom,gpu-pwrlevel@12 {
+				reg = <12>;
+				qcom,gpu-freq = <231000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D2>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-1 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,sku-codes = <SKU_CODE(PCODE_UNKNOWN, FC_AC)>;
+
+			qcom,initial-pwrlevel = <11>;
+
+			/* Turbo */
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <869000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_TURBO>;
+
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_TURBO>;
+			};
+
+			/* Nom_L1 */
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <834000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_NOM_L1>;
+			};
+
+			/* Nom */
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <770000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_NOM>;
+			};
+
+			/* SVS_L2 */
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <720000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L2>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L2>;
+			};
+
+			/* SVS_L1 */
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <680000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <5>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L1>;
+			};
+
+			/* SVS_L0 */
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <629000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L0>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L0>;
+			};
+
+			/* SVS */
+			qcom,gpu-pwrlevel@6 {
+				reg = <6>;
+				qcom,gpu-freq = <578000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS>;
+			};
+
+			/* Low_SVS_L1 */
+			qcom,gpu-pwrlevel@7 {
+				reg = <7>;
+				qcom,gpu-freq = <500000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_L1>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <5>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS_L1>;
+			};
+
+			/* Low_SVS */
+			qcom,gpu-pwrlevel@8 {
+				reg = <8>;
+				qcom,gpu-freq = <422000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <5>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS>;
+			};
+
+			/* Low_SVS_D0 */
+			qcom,gpu-pwrlevel@9 {
+				reg = <9>;
+				qcom,gpu-freq = <366000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D0>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS_D0>;
+			};
+
+			/* Low_SVS_D1 */
+			qcom,gpu-pwrlevel@10 {
+				reg = <10>;
+				qcom,gpu-freq = <310000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D1>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+			};
+
+			/* Low_SVS_D2 */
+			qcom,gpu-pwrlevel@11 {
+				reg = <11>;
+				qcom,gpu-freq = <231000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D2>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-2 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,sku-codes = <SKU_CODE(PCODE_0, FC_Y0)
+					SKU_CODE(PCODE_1, FC_Y0)
+					SKU_CODE(PCODE_0, FC_Y1)>;
+
+			qcom,initial-pwrlevel = <12>;
+
+			/* Turbo_L1 */
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <903000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_TURBO_L1>;
+
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_TURBO_L1>;
+			};
+
+			/* Turbo */
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <869000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_TURBO>;
+
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <8>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_TURBO>;
+			};
+
+			/* Nom_L1 */
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <834000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_NOM_L1>;
+			};
+
+			/* Nom */
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <770000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_NOM>;
+			};
+
+			/* SVS_L2 */
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <720000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L2>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L2>;
+			};
+
+			/* SVS_L1 */
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <680000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <5>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L1>;
+			};
+
+			/* SVS_L0 */
+			qcom,gpu-pwrlevel@6 {
+				reg = <6>;
+				qcom,gpu-freq = <629000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L0>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L0>;
+			};
+
+			/* SVS */
+			qcom,gpu-pwrlevel@7 {
+				reg = <7>;
+				qcom,gpu-freq = <578000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS>;
+			};
+
+			/* Low_SVS_L1 */
+			qcom,gpu-pwrlevel@8 {
+				reg = <8>;
+				qcom,gpu-freq = <500000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_L1>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <5>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS_L1>;
+			};
+
+			/* Low_SVS */
+			qcom,gpu-pwrlevel@9 {
+				reg = <9>;
+				qcom,gpu-freq = <422000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <5>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS>;
+			};
+
+			/* Low_SVS_D0 */
+			qcom,gpu-pwrlevel@10 {
+				reg = <10>;
+				qcom,gpu-freq = <366000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D0>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS_D0>;
+			};
+
+			/* Low_SVS_D1 */
+			qcom,gpu-pwrlevel@11 {
+				reg = <11>;
+				qcom,gpu-freq = <310000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D1>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+			};
+
+			/* Low_SVS_D2 */
+			qcom,gpu-pwrlevel@12 {
+				reg = <12>;
+				qcom,gpu-freq = <231000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D2>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-3 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,sku-codes = <SKU_CODE(PCODE_UNKNOWN, FC_UNKNOWN)>;
+
+			qcom,initial-pwrlevel = <10>;
+
+			/* Nom_L1 */
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <834000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_NOM_L1>;
+			};
+
+			/* Nom */
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <770000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_NOM>;
+			};
+
+			/* SVS_L2 */
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <720000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L2>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L2>;
+			};
+
+			/* SVS_L1 */
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <680000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <5>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L1>;
+			};
+
+			/* SVS_L0 */
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <629000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L0>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS_L0>;
+			};
+
+			/* SVS */
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <578000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <ACD_LEVEL_SVS>;
+			};
+
+			/* Low_SVS_L1 */
+			qcom,gpu-pwrlevel@6 {
+				reg = <6>;
+				qcom,gpu-freq = <500000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_L1>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <5>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS_L1>;
+			};
+
+			/* Low_SVS */
+			qcom,gpu-pwrlevel@7 {
+				reg = <7>;
+				qcom,gpu-freq = <422000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <5>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <5>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS>;
+			};
+
+			/* Low_SVS_D0 */
+			qcom,gpu-pwrlevel@8 {
+				reg = <8>;
+				qcom,gpu-freq = <366000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D0>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+
+				qcom,acd-level = <ACD_LEVEL_LOW_SVS_D0>;
+			};
+
+			/* Low_SVS_D1 */
+			qcom,gpu-pwrlevel@9 {
+				reg = <9>;
+				qcom,gpu-freq = <310000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D1>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+			};
+
+			/* Low_SVS_D2 */
+			qcom,gpu-pwrlevel@10 {
+				reg = <10>;
+				qcom,gpu-freq = <231000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D2>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/pineapple-gpu.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/pineapple-gpu.dts
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,aop-qmp.h>
+#include <dt-bindings/clock/qcom,gcc-pineapple.h>
+#include <dt-bindings/clock/qcom,gpucc-pineapple.h>
+#include <dt-bindings/clock/qcom,rpmh.h>
+#include <dt-bindings/interconnect/qcom,pineapple.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/regulator/qcom,rpmh-regulator-levels.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "pineapple-gpu.dtsi"
+#include "pineapple-gpu-pwrlevels.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. Pineapple";
+	compatible = "qcom,pineapple";
+	qcom,msm-id = <557 0x10000>, <577 0x10000>;
+	qcom,board-id = <0 0>;
+};
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/pineapple-gpu.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/pineapple-gpu.dtsi
@@ -0,0 +1,260 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define MHZ_TO_KBPS(mhz, w) ((mhz * 1000000 * w) / (1024))
+
+/* External feature codes */
+#define FC_UNKNOWN 0x0
+#define FC_AA 0x1
+#define FC_AB 0x2
+#define FC_AC 0x3
+#define FC_AD 0x4
+
+/* Internal feature codes */
+#define FC_Y0 0x00f1
+#define FC_Y1 0x00f2
+
+/* Pcodes */
+#define PCODE_UNKNOWN 0
+#define PCODE_0 1
+#define PCODE_1 2
+#define PCODE_2 3
+#define PCODE_3 4
+#define PCODE_4 5
+#define PCODE_5 6
+#define PCODE_6 7
+#define PCODE_7 8
+
+#define SKU_CODE(pcode, featurecode) ((pcode << 16) + featurecode)
+
+&msm_gpu {
+	compatible = "qcom,adreno-gpu-gen7-9-0", "qcom,kgsl-3d0";
+	status = "ok";
+	reg = <0x3d00000 0x40000>, <0x3d61000 0x3000>,
+		<0x03d50000 0x10000>, <0x03d9e000 0x2000>,
+		<0x10900000 0x80000>, <0x10048000 0x8000>,
+		<0x10b05000 0x1000>;
+	reg-names = "kgsl_3d0_reg_memory", "cx_dbgc", "rscc", "cx_misc",
+		"qdss_gfx", "qdss_etr", "qdss_tmc";
+	interrupts = <0 300 IRQ_TYPE_LEVEL_HIGH>;
+	interrupt-names = "kgsl_3d0_irq";
+
+	clocks = <&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+		<&gcc GCC_GPU_SNOC_DVM_GFX_CLK>,
+		<&gpucc GPU_CC_AHB_CLK>,
+		<&aoss_qmp QDSS_CLK>;
+	clock-names = "gcc_gpu_memnoc_gfx",
+			"gcc_gpu_snoc_dvm_gfx",
+			"gpu_cc_ahb",
+			"apb_pclk";
+
+	qcom,gpu-model = "Adreno750";
+
+	qcom,chipid = <0x43051400>;
+
+	qcom,no-nap;
+
+	qcom,min-access-length = <32>;
+
+	qcom,ubwc-mode = <4>;
+
+	qcom,gpu-qdss-stm = <0x161c0000 0x40000>; /* base addr, size */
+
+	qcom,tzone-names = "gpuss-0", "gpuss-1", "gpuss-2", "gpuss-3",
+			"gpuss-4", "gpuss-5", "gpuss-6", "gpuss-7";
+
+	interconnects = <&gem_noc MASTER_GFX3D &mc_virt SLAVE_EBI1>;
+	interconnect-names = "gpu_icc_path";
+
+	qcom,bus-table-cnoc =
+		<0>,   /* Off */
+		<100>; /* On */
+
+	qcom,bus-table-ddr =
+		<MHZ_TO_KBPS(0, 4)>,    /* index=0 */
+		<MHZ_TO_KBPS(547, 4) >, /* index=1 */
+		<MHZ_TO_KBPS(768, 4) >, /* index=2 */
+		<MHZ_TO_KBPS(1555, 4)>, /* index=3 */
+		<MHZ_TO_KBPS(1708, 4)>, /* index=4 */
+		<MHZ_TO_KBPS(2092, 4)>, /* index=5 */
+		<MHZ_TO_KBPS(2736, 4)>, /* index=6 */
+		<MHZ_TO_KBPS(3187, 4)>, /* index=7 */
+		<MHZ_TO_KBPS(3686, 4)>, /* index=8 */
+		<MHZ_TO_KBPS(4224, 4)>; /* index=9 */
+
+	nvmem-cells = <&gpu_speed_bin>;
+	nvmem-cell-names = "speed_bin";
+
+	zap-shader {
+		memory-region = <&gpu_micro_code_mem>;
+	};
+
+	qcom,gpu-mempools {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "qcom,gpu-mempools";
+
+		/* 4K Page Pool configuration */
+		qcom,gpu-mempool@0 {
+			reg = <0>;
+			qcom,mempool-page-size = <4096>;
+			qcom,mempool-reserved = <2048>;
+		};
+		/* 8K Page Pool configuration */
+		qcom,gpu-mempool@1 {
+			reg = <1>;
+			qcom,mempool-page-size = <8192>;
+			qcom,mempool-reserved = <1024>;
+		};
+		/* 64K Page Pool configuration */
+		qcom,gpu-mempool@2 {
+			reg = <2>;
+			qcom,mempool-page-size = <65536>;
+			qcom,mempool-reserved = <256>;
+		};
+		/* 128K Page Pool configuration */
+		qcom,gpu-mempool@3 {
+			reg = <3>;
+			qcom,mempool-page-size = <131072>;
+			qcom,mempool-reserved = <128>;
+		};
+		/* 256K Page Pool configuration */
+		qcom,gpu-mempool@4 {
+			reg = <4>;
+			qcom,mempool-page-size = <262144>;
+			qcom,mempool-reserved = <80>;
+		};
+		/* 1M Page Pool configuration */
+		qcom,gpu-mempool@5 {
+			reg = <5>;
+			qcom,mempool-page-size = <1048576>;
+			qcom,mempool-reserved = <32>;
+		};
+	};
+};
+
+&soc {
+	kgsl_msm_iommu: qcom,kgsl-iommu@3da0000 {
+		compatible = "qcom,kgsl-smmu-v2";
+		reg = <0x03da0000 0x40000>;
+
+		vddcx-supply = <&gpu_cc_cx_gdsc>;
+
+		gfx3d_user: gfx3d_user {
+			compatible = "qcom,smmu-kgsl-cb";
+			iommus = <&kgsl_smmu 0x0 0x000>;
+			qcom,iommu-dma = "disabled";
+		};
+
+		gfx3d_lpac: gfx3d_lpac {
+			compatible = "qcom,smmu-kgsl-cb";
+			iommus = <&kgsl_smmu 0x1 0x000>;
+			qcom,iommu-dma = "disabled";
+		};
+
+		gfx3d_secure: gfx3d_secure {
+			compatible = "qcom,smmu-kgsl-cb";
+			iommus = <&kgsl_smmu 0x2 0x000>;
+			qcom,iommu-dma = "disabled";
+		};
+	};
+
+	gmu: qcom,gmu@3d69000 {
+		compatible = "qcom,gen7-gmu";
+
+		reg = <0x3d68000 0x37000>,
+		      <0xb280000 0x10000>,
+		      <0x03D40000 0x10000>;
+
+		reg-names = "gmu", "gmu_pdc", "gmu_ao_blk_dec0";
+
+		interrupts = <0 304 IRQ_TYPE_LEVEL_HIGH>,
+			<0 305 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "hfi", "gmu";
+
+		regulator-names = "vddcx", "vdd";
+
+		vddcx-supply = <&gpu_cc_cx_gdsc>;
+		vdd-supply = <&gpu_cc_gx_gdsc>;
+
+		clocks = <&gpucc GPU_CC_CX_GMU_CLK>,
+			<&gpucc GPU_CC_CXO_CLK>,
+			<&gcc GCC_DDRSS_GPU_AXI_CLK>,
+			<&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+			<&gpucc GPU_CC_AHB_CLK>,
+			<&gpucc GPU_CC_HUB_CX_INT_CLK>;
+
+		clock-names = "gmu_clk", "cxo_clk", "axi_clk",
+			"memnoc_clk", "ahb_clk", "hub_clk";
+
+		qcom,gmu-freq-table = <260000000 RPMH_REGULATOR_LEVEL_LOW_SVS>,
+					<625000000 RPMH_REGULATOR_LEVEL_SVS>;
+		qcom,gmu-perf-ddr-bw = <MHZ_TO_KBPS(768, 4)>;
+
+		iommus = <&kgsl_smmu 0x5 0x000>;
+		qcom,iommu-dma = "disabled";
+
+		qcom,ipc-core = <0x00400000 0x140000>;
+
+		mboxes = <&qmp_aop 0>;
+		mbox-names = "aop";
+	};
+
+	coresight_cx_dgbc: qcom,gpu-coresight-cx {
+		compatible = "qcom,gpu-coresight-cx";
+
+		coresight-name = "coresight-gfx-cx";
+		coresight-atid = <52>;
+
+		out-ports {
+			port {
+				cx_dbgc_out_funnel_gfx: endpoint {
+					remote-endpoint =
+					  <&funnel_gfx_in_cx_dbgc>;
+				};
+			};
+		};
+	};
+
+	coresight_gx_dgbc: qcom,gpu-coresight-gx {
+		compatible = "qcom,gpu-coresight-gx";
+
+		coresight-name = "coresight-gfx";
+		coresight-atid = <53>;
+
+		out-ports {
+			port {
+				gx_dbgc_out_funnel_gfx: endpoint {
+					remote-endpoint =
+					  <&funnel_gfx_in_gx_dbgc>;
+				};
+			};
+		};
+	};
+};
+
+&funnel_gfx {
+	status = "ok";
+	in-ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			funnel_gfx_in_gx_dbgc: endpoint {
+			remote-endpoint =
+				<&gx_dbgc_out_funnel_gfx>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			funnel_gfx_in_cx_dbgc: endpoint {
+			remote-endpoint =
+				<&cx_dbgc_out_funnel_gfx>;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/pineapple-v2-gpu-pwrlevels.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/pineapple-v2-gpu-pwrlevels.dtsi
@@ -0,0 +1,181 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/* ACD Control register values */
+#define ACD_LEVEL_TURBO_L1    0x882f5ffd
+#define ACD_LEVEL_TURBO       0x882f5ffd
+#define ACD_LEVEL_NOM_L1      0x882f5ffd
+#define ACD_LEVEL_NOM         0xc0285ffd
+#define ACD_LEVEL_SVS_L2      0xe0295ffd
+#define ACD_LEVEL_SVS_L1      0xe0295ffd
+#define ACD_LEVEL_SVS_L0      0xc02a5ffd
+#define ACD_LEVEL_SVS         0xc02a5ffd
+#define ACD_LEVEL_LOW_SVS_L1  0xc02c5ffd
+#define ACD_LEVEL_LOW_SVS     0xc02f5ffd
+#define ACD_LEVEL_LOW_SVS_D0  0xc02f5ffd
+
+&msm_gpu {
+	/* Power levels */
+	qcom,gpu-pwrlevels {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "qcom,gpu-pwrlevels";
+
+		qcom,initial-pwrlevel = <11>;
+
+		/* Turbo */
+		qcom,gpu-pwrlevel@0 {
+			reg = <0>;
+			qcom,gpu-freq = <903000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_TURBO>;
+
+			qcom,bus-freq = <9>;
+			qcom,bus-min = <9>;
+			qcom,bus-max = <9>;
+
+			qcom,acd-level = <ACD_LEVEL_TURBO>;
+		};
+
+		/* Nom_L1 */
+		qcom,gpu-pwrlevel@1 {
+			reg = <1>;
+			qcom,gpu-freq = <834000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+
+			qcom,bus-freq = <8>;
+			qcom,bus-min = <7>;
+			qcom,bus-max = <9>;
+
+			qcom,acd-level = <ACD_LEVEL_NOM_L1>;
+		};
+
+		/* Nom */
+		qcom,gpu-pwrlevel@2 {
+			reg = <2>;
+			qcom,gpu-freq = <770000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+			qcom,bus-freq = <7>;
+			qcom,bus-min = <6>;
+			qcom,bus-max = <9>;
+
+			qcom,acd-level = <ACD_LEVEL_NOM>;
+		};
+
+		/* SVS_L2 */
+		qcom,gpu-pwrlevel@3 {
+			reg = <3>;
+			qcom,gpu-freq = <720000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L2>;
+
+			qcom,bus-freq = <7>;
+			qcom,bus-min = <6>;
+			qcom,bus-max = <9>;
+
+			qcom,acd-level = <ACD_LEVEL_SVS_L2>;
+		};
+
+		/* SVS_L1 */
+		qcom,gpu-pwrlevel@4 {
+			reg = <4>;
+			qcom,gpu-freq = <680000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+			qcom,bus-freq = <7>;
+			qcom,bus-min = <5>;
+			qcom,bus-max = <9>;
+
+			qcom,acd-level = <ACD_LEVEL_SVS_L1>;
+		};
+
+		/* SVS_L0 */
+		qcom,gpu-pwrlevel@5 {
+			reg = <5>;
+			qcom,gpu-freq = <629000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L0>;
+
+			qcom,bus-freq = <6>;
+			qcom,bus-min = <4>;
+			qcom,bus-max = <7>;
+
+			qcom,acd-level = <ACD_LEVEL_SVS_L0>;
+		};
+
+		/* SVS */
+		qcom,gpu-pwrlevel@6 {
+			reg = <6>;
+			qcom,gpu-freq = <578000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+			qcom,bus-freq = <5>;
+			qcom,bus-min = <4>;
+			qcom,bus-max = <7>;
+
+			qcom,acd-level = <ACD_LEVEL_SVS>;
+		};
+
+		/* Low_SVS_L1 */
+		qcom,gpu-pwrlevel@7 {
+			reg = <7>;
+			qcom,gpu-freq = <500000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_L1>;
+
+			qcom,bus-freq = <5>;
+			qcom,bus-min = <3>;
+			qcom,bus-max = <7>;
+
+			qcom,acd-level = <ACD_LEVEL_LOW_SVS_L1>;
+		};
+
+		/* Low_SVS */
+		qcom,gpu-pwrlevel@8 {
+			reg = <8>;
+			qcom,gpu-freq = <422000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+			qcom,bus-freq = <5>;
+			qcom,bus-min = <3>;
+			qcom,bus-max = <7>;
+
+			qcom,acd-level = <ACD_LEVEL_LOW_SVS>;
+		};
+
+		/* Low_SVS_D0 */
+		qcom,gpu-pwrlevel@9 {
+			reg = <9>;
+			qcom,gpu-freq = <366000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D0>;
+
+			qcom,bus-freq = <3>;
+			qcom,bus-min = <2>;
+			qcom,bus-max = <5>;
+
+			qcom,acd-level = <ACD_LEVEL_LOW_SVS_D0>;
+		};
+
+		/* Low_SVS_D1 */
+		qcom,gpu-pwrlevel@10 {
+			reg = <10>;
+			qcom,gpu-freq = <310000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D1>;
+
+			qcom,bus-freq = <1>;
+			qcom,bus-min = <1>;
+			qcom,bus-max = <4>;
+		};
+
+		/* Low_SVS_D2 */
+		qcom,gpu-pwrlevel@11 {
+			reg = <11>;
+			qcom,gpu-freq = <231000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D2>;
+
+			qcom,bus-freq = <1>;
+			qcom,bus-min = <1>;
+			qcom,bus-max = <3>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/pineapple-v2-gpu.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/pineapple-v2-gpu.dts
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,aop-qmp.h>
+#include <dt-bindings/clock/qcom,gcc-pineapple.h>
+#include <dt-bindings/clock/qcom,gpucc-pineapple.h>
+#include <dt-bindings/clock/qcom,rpmh.h>
+#include <dt-bindings/interconnect/qcom,pineapple.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/regulator/qcom,rpmh-regulator-levels.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "pineapple-v2-gpu.dtsi"
+#include "pineapple-v2-gpu-pwrlevels.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. Pineapple";
+	compatible = "qcom,pineapple";
+	qcom,msm-id = <557 0x20000>, <577 0x20000>;
+	qcom,board-id = <0 0>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/pineapple-v2-gpu.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/pineapple-v2-gpu.dtsi
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "pineapple-gpu.dtsi"
+
+&msm_gpu {
+	compatible = "qcom,adreno-gpu-gen7-9-1", "qcom,kgsl-3d0";
+
+	qcom,gpu-model = "Adreno750v2";
+
+	qcom,chipid = <0x43051401>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/pm4125.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/pm4125.dtsi
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR BSD-3-Clause)
+/*
+ * Copyright (c) 2023, Linaro Ltd
+ */
+
+#include <dt-bindings/iio/qcom,spmi-vadc.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/spmi/spmi.h>
+
+&spmi_bus {
+	pmic@0 {
+		compatible = "qcom,pm2250", "qcom,spmi-pmic";
+		reg = <0x0 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pon@800 {
+			compatible = "qcom,pm8916-pon";
+			reg = <0x800>;
+
+			pm4125_pwrkey: pwrkey {
+				compatible = "qcom,pm8941-pwrkey";
+				interrupts-extended = <&spmi_bus 0x0 0x8 0 IRQ_TYPE_EDGE_BOTH>;
+				linux,code = <KEY_POWER>;
+				debounce = <15625>;
+				bias-pull-up;
+			};
+
+			pm4125_resin: resin {
+				compatible = "qcom,pm8941-resin";
+				interrupts-extended = <&spmi_bus 0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>;
+				debounce = <15625>;
+				bias-pull-up;
+				status = "disabled";
+			};
+		};
+
+		rtc@6000 {
+			compatible = "qcom,pm8941-rtc";
+			reg = <0x6000>, <0x6100>;
+			reg-names = "rtc", "alarm";
+			interrupts-extended = <&spmi_bus 0x0 0x61 0x1 IRQ_TYPE_EDGE_RISING>;
+		};
+
+		pm4125_gpios: gpio@c000 {
+			compatible = "qcom,pm2250-gpio", "qcom,spmi-gpio";
+			reg = <0xc000>;
+			gpio-controller;
+			gpio-ranges = <&pm4125_gpios 0 0 10>;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	pmic@1 {
+		compatible = "qcom,pm2250", "qcom,spmi-pmic";
+		reg = <0x1 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/pm7250b.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/pm7250b.dtsi
@@ -164,5 +164,10 @@
 		reg = <PM7250B_SID1 SPMI_USID>;
 		#address-cells = <1>;
 		#size-cells = <0>;
+
+		pm7250b_vib: pm7250b-vib@5300 {
+			compatible = "qcom,pm7250b-vib", "qcom,pmi632-vib";
+			reg = <0x5300>;
+		};
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/pm7325b.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/pm7325b.dtsi
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/iio/qcom,spmi-vadc.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/spmi/spmi.h>
+
+&spmi_bus {
+	pm7325b: pmic@3 {
+		compatible = "qcom,pm7325", "qcom,spmi-pmic";
+		reg = <0x3 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pm7325b_temp_alarm: temp-alarm@a00 {
+			compatible = "qcom,spmi-temp-alarm";
+			reg = <0xa00>;
+			interrupts = <0x3 0xa 0x0 IRQ_TYPE_EDGE_BOTH>;
+			#thermal-sensor-cells = <0>;
+		};
+
+		pm7325b_gpios: gpio@8800 {
+			compatible = "qcom,pm7325b-gpio", "qcom,spmi-gpio";
+			reg = <0x8800>;
+			gpio-controller;
+			gpio-ranges = <&pm7325b_gpios 0 0 8>;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		pm7325b_lcdb: qcom,lcdb@fd00 {
+			compatible = "qcom,lcdb-pm7325b";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <0xfd00>;
+			interrupts = <0x3 0xfd 0x1 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "sc-irq";
+
+			lcdb_ldo_vreg: ldo {
+				label = "ldo";
+				regulator-name = "lcdb_ldo";
+				regulator-min-microvolt = <4400000>;
+				regulator-max-microvolt = <6000000>;
+			};
+
+			lcdb_ncp_vreg: ncp {
+				label = "ncp";
+				regulator-name = "lcdb_ncp";
+				regulator-min-microvolt = <4400000>;
+				regulator-max-microvolt = <6000000>;
+			};
+
+			lcdb_bst_vreg: bst {
+				label = "bst";
+				regulator-name = "lcdb_bst";
+				regulator-min-microvolt = <4700000>;
+				regulator-max-microvolt = <6400000>;
+			};
+		};
+
+		pm7325b_wled: qcom,wled@d800 {
+			compatible = "qcom,pm7325b-wled";
+			reg = <0xfb00>, <0xfc00>;
+			reg-names = "wled-ctrl-base", "wled-sink-base";
+			label = "backlight";
+			interrupts = <0x3 0xfb 0x1 IRQ_TYPE_EDGE_RISING>,
+					<0x3 0xfb 0x2 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "ovp", "short";
+			qcom,current-limit-microamp = <22500>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm2290.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm2290.dtsi
@@ -442,6 +442,11 @@
 			#hwlock-cells = <1>;
 		};
 
+		tcsr_regs: syscon@3c0000 {
+			compatible = "qcom,qcm2290-tcsr", "syscon";
+			reg = <0x0 0x003c0000 0x0 0x40000>;
+		};
+
 		tlmm: pinctrl@500000 {
 			compatible = "qcom,qcm2290-tlmm";
 			reg = <0x0 0x00500000 0x0 0x300000>;
@@ -690,6 +695,8 @@
 
 			#phy-cells = <0>;
 
+			qcom,tcsr-reg = <&tcsr_regs 0xb244>;
+
 			status = "disabled";
 		};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm5430-camera-rb3.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm5430-camera-rb3.dtso
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,gcc-sc7280.h>
+#include <dt-bindings/clock/qcom,camcc-sc7280.h>
+#include <dt-bindings/interconnect/qcom,sc7280.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+
+#include "qcm6490-camera-rb3.dtsi"
+#include "qcm6490-camera-sensor-rb3.dtsi"
+
+&cam_csid2 {
+		status = "disabled";
+};
+
+&cam_vfe2 {
+		status = "disabled";
+};
\ No newline at end of file
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-addons-idp-amoled.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-addons-idp-amoled.dts
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * qcm6490-addons IDP amoled device tree source
+ *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+/dts-v1/;
+
+#include "qcm6490-addons-idp.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcm6490-addons IDP + amoled platform";
+	compatible = "qcom,qcm6490-addons-idp-amoled","qcom,sc7280";
+
+	/* This will be deprecated soon */
+	qcom,msm-id = <497 0x10000>;
+	qcom,board-id = <34 0x2>, <34 0x602>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-addons-idp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-addons-idp.dts
@@ -0,0 +1,347 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * qcm6490-addons IDP device tree source
+ *
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+/dts-v1/;
+
+#include "qcm6490-idp.dts"
+#include "qcm6490-addons.dtsi"
+#include "pm7325b.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcm6490-addons IDP platform";
+	compatible = "qcom,qcm6490-addons-idp","qcom,sc7280";
+
+	pmic_glink: pmic-glink {
+	};
+};
+
+&i2c1 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	status = "okay";
+
+	pm8008i_chip: pm8008i@8 {
+		compatible = "qcom,i2c-pmic";
+		reg = <0x8>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&pm8008i_active>;
+
+		pm8008-chip@900 {
+			compatible = "qcom,pm8008-chip";
+			reg = <0x900>;
+
+			PM8008I_EN: qcom,pm8008-chip-en {
+				regulator-name = "pm8008i-chip-en";
+			};
+		};
+	};
+
+	pm8008i_ldo: pm8008i@9 {
+		compatible = "qcom,i2c-pmic";
+		reg = <0x9>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,pm8008i-regulator {
+			compatible = "qcom,pm8008-regulator";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pm8008_en-supply = <&PM8008I_EN>;
+			vdd_l1_l2-supply = <&vreg_s8b_1p272>;
+			vdd_l3_l4-supply = <&vreg_bob_3p296>;
+			vdd_l5-supply = <&vreg_s1b_1p872>;
+			vdd_l6-supply = <&vreg_bob_3p296>;
+			vdd_l7-supply = <&vreg_bob_3p296>;
+
+			L1I: PM8008I_L1: regulator@4000 {
+				reg = <0x4000>;
+				regulator-name = "pm8008i_l1";
+				regulator-min-microvolt = <1000000>;
+				regulator-max-microvolt = <1200000>;
+				qcom,min-dropout-voltage = <160000>;
+				qcom,hpm-min-load = <30000>;
+			};
+
+			L2I: PM8008I_L2: regulator@4100 {
+				reg = <0x4100>;
+				regulator-name = "pm8008i_l2";
+				regulator-min-microvolt = <950000>;
+				regulator-max-microvolt = <1150000>;
+				qcom,min-dropout-voltage = <128000>;
+				qcom,hpm-min-load = <30000>;
+			};
+
+			L3I: PM8008I_L3: regulator@4200 {
+				reg = <0x4200>;
+				regulator-name = "pm8008i_l3";
+				regulator-min-microvolt = <2700000>;
+				regulator-max-microvolt = <3000000>;
+				qcom,min-dropout-voltage = <144000>;
+			};
+
+			L4I: PM8008I_L4: regulator@4300 {
+				reg = <0x4300>;
+				regulator-name = "pm8008i_l4";
+				regulator-min-microvolt = <2700000>;
+				regulator-max-microvolt = <2900000>;
+				qcom,min-dropout-voltage = <128000>;
+			};
+
+			L5I: PM8008I_L5: regulator@4400 {
+				reg = <0x4400>;
+				regulator-name = "pm8008i_l5";
+				regulator-min-microvolt = <1700000>;
+				regulator-max-microvolt = <1900000>;
+				qcom,min-dropout-voltage = <136000>;
+			};
+
+			L6I: PM8008I_L6: regulator@4500 {
+				reg = <0x4500>;
+				regulator-name = "pm8008i_l6";
+				regulator-min-microvolt = <2700000>;
+				regulator-max-microvolt = <2900000>;
+				qcom,min-dropout-voltage = <128000>;
+			};
+
+			L7I: PM8008I_L7: regulator@4600 {
+				reg = <0x4600>;
+				regulator-name = "pm8008i_l7";
+				regulator-min-microvolt = <2700000>;
+				regulator-max-microvolt = <3000000>;
+				qcom,min-dropout-voltage = <312000>;
+			};
+		};
+	};
+
+	pm8008j_chip: pm8008j@c {
+		compatible = "qcom,i2c-pmic";
+		reg = <0xc>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&pm8008j_active>;
+
+		pm8008-chip@900 {
+			compatible = "qcom,pm8008-chip";
+			reg = <0x900>;
+
+			PM8008J_EN: qcom,pm8008-chip-en {
+				regulator-name = "pm8008j-chip-en";
+			};
+		};
+	};
+
+	pm8008j_ldo: pm8008j@d {
+		compatible = "qcom,i2c-pmic";
+		reg = <0xd>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,pm8008j-regulator {
+			compatible = "qcom,pm8008-regulator";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pm8008_en-supply = <&PM8008J_EN>;
+			vdd_l1_l2-supply = <&vreg_s8b_1p272>;
+			vdd_l3_l4-supply = <&vreg_s1b_1p872>;
+			vdd_l5-supply = <&vreg_bob_3p296>;
+			vdd_l6-supply = <&vreg_bob_3p296>;
+			vdd_l7-supply = <&vreg_bob_3p296>;
+
+			L1J: PM8008J_L1: regulator@4000 {
+				reg = <0x4000>;
+				regulator-name = "pm8008j_l1";
+				regulator-min-microvolt = <950000>;
+				regulator-max-microvolt = <1150000>;
+				qcom,min-dropout-voltage = <96000>;
+				qcom,hpm-min-load = <30000>;
+			};
+
+			L2J: PM8008J_L2: regulator@4100 {
+				reg = <0x4100>;
+				regulator-name = "pm8008j_l2";
+				regulator-min-microvolt = <950000>;
+				regulator-max-microvolt = <1250000>;
+				qcom,min-dropout-voltage = <24000>;
+				qcom,hpm-min-load = <30000>;
+			};
+
+			L3J: PM8008J_L3: regulator@4200 {
+				reg = <0x4200>;
+				regulator-name = "pm8008j_l3";
+				regulator-min-microvolt = <1460000>;
+				regulator-max-microvolt = <1800000>;
+				qcom,min-dropout-voltage = <224000>;
+			};
+
+			L4J: PM8008J_L4: regulator@4300 {
+				reg = <0x4300>;
+				regulator-name = "pm8008j_l4";
+				regulator-min-microvolt = <1504000>;
+				regulator-max-microvolt = <1600000>;
+				qcom,min-dropout-voltage = <0>;
+			};
+
+			L5J: PM8008J_L5: regulator@4400 {
+				reg = <0x4400>;
+				regulator-name = "pm8008j_l5";
+				regulator-min-microvolt = <2700000>;
+				regulator-max-microvolt = <2900000>;
+				qcom,min-dropout-voltage = <104000>;
+			};
+
+			L6J: PM8008J_L6: regulator@4500 {
+				reg = <0x4500>;
+				regulator-name = "pm8008j_l6";
+				regulator-min-microvolt = <2800000>;
+				regulator-max-microvolt = <2800000>;
+				qcom,min-dropout-voltage = <112000>;
+			};
+
+			L7J: PM8008J_L7: regulator@4600 {
+				reg = <0x4600>;
+				regulator-name = "pm8008j_l7";
+				regulator-min-microvolt = <3000000>;
+				regulator-max-microvolt = <3544000>;
+				qcom,min-dropout-voltage = <96000>;
+			};
+		};
+	};
+};
+
+&pm8350c_gpios {
+	pm8008i-reset-state {
+		pm8008i_active: pm8008i-active-pins {
+			pins = "gpio3";
+			function = "normal";
+			bias-disable;
+			output-high;
+			power-source = <0>;
+		};
+	};
+
+	pm8008j-reset-state {
+		pm8008j_active: pm8008j-active-pins {
+			pins = "gpio4";
+			function = "normal";
+			bias-disable;
+			output-high;
+			power-source = <0>;
+		};
+	};
+};
+
+&q6apmbedai {
+	qcom,prmcc_clk = <&q6prmcc>;
+};
+
+&sound {
+	pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep";
+	pinctrl-0 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+				<&mi2s0_sclk_sleep>, <&mi2s0_ws_sleep>;
+	pinctrl-1 = <&mi2s0_data0>, <&mi2s0_data1>, <&mi2s0_mclk>,
+				<&mi2s0_sclk>, <&mi2s0_ws>;
+	pinctrl-2 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+				<&mi2s0_sclk_sleep>, <&mi2s0_ws_sleep>;
+
+	mi2s-capture-dai-link {
+		link-name = "MI2S-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	mi2s-playback-dai-link {
+		link-name = "MI2S-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+	tdm-capture-dai-link {
+		link-name = "TDM-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	tdm-playback-dai-link {
+		link-name = "TDM-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+};
+
+&tlmm {
+	mi2s0_data0_sleep: mi2s0-data0-sleep {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_data1_sleep: mi2s0-data1-sleep {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_mclk_sleep: mi2s0-mclk-sleep {
+		pins = "gpio96";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_sclk_sleep: mi2s0-sclk-sleep {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_ws_sleep: mi2s0-ws-sleep {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-addons.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-addons.dtsi
@@ -0,0 +1,1982 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * qcm6490-addons device tree source
+ *
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+/{
+	reserved-memory {
+		audio_cma_mem: qcom,audio-ml {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1000000>; /* 16M */
+		};
+
+		qseecom_mem: qcom,qseecom {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1400000>; /* 20M */
+		};
+
+		qseecom_ta_mem: qcom,qseecom-ta {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1000000>; /* 16M */
+		};
+
+		dump_mem: mem-dump-region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			size = <0 0x2c00000>;
+		};
+	};
+
+	/* Add overlay for firmware node containing qcom_scm in sc7280.dtsi */
+	firmware {
+		qtee_shmbridge {
+			compatible = "qcom,tee-shared-memory-bridge";
+		};
+
+		qcom_smcinvoke {
+			compatible = "qcom,smcinvoke";
+		};
+	};
+
+	mem-dump {
+		compatible = "qcom,mem-dump";
+		memory-region = <&dump_mem>;
+
+		c0-context {
+			qcom,dump-size = <0x800>;
+			qcom,dump-id = <0x0>;
+		};
+
+		c0-scandump {
+			qcom,dump-size = <0x10100>;
+			qcom,dump-id = <0x130>;
+		};
+
+		c100-context {
+			qcom,dump-size = <0x800>;
+			qcom,dump-id = <0x1>;
+		};
+
+		c100-scandump {
+			qcom,dump-size = <0x10100>;
+			qcom,dump-id = <0x131>;
+		};
+
+		c200-context {
+			qcom,dump-size = <0x800>;
+			qcom,dump-id = <0x2>;
+		};
+
+		c200-scandump {
+			qcom,dump-size = <0x10100>;
+			qcom,dump-id = <0x132>;
+		};
+
+		c300-context {
+			qcom,dump-size = <0x800>;
+			qcom,dump-id = <0x3>;
+		};
+
+		c300-scandump {
+			qcom,dump-size = <0x10100>;
+			qcom,dump-id = <0x133>;
+		};
+
+		c400-context {
+			qcom,dump-size = <0x800>;
+			qcom,dump-id = <0x4>;
+		};
+
+		c400-scandump {
+			qcom,dump-size = <0x40000>;
+			qcom,dump-id = <0x134>;
+		};
+
+		c500-context {
+			qcom,dump-size = <0x800>;
+			qcom,dump-id = <0x5>;
+		};
+
+		c500-scandump {
+			qcom,dump-size = <0x40000>;
+			qcom,dump-id = <0x135>;
+		};
+
+		c600-context {
+			qcom,dump-size = <0x800>;
+			qcom,dump-id = <0x6>;
+		};
+
+		c600-scandump {
+			qcom,dump-size = <0x40000>;
+			qcom,dump-id = <0x136>;
+		};
+
+		c700-context {
+			qcom,dump-size = <0x800>;
+			qcom,dump-id = <0x7>;
+		};
+
+		c700-scandump {
+			qcom,dump-size = <0x40000>;
+			qcom,dump-id = <0x137>;
+		};
+
+		cpuss-reg {
+			qcom,dump-size = <0x30000>;
+			qcom,dump-id = <0xef>;
+		};
+
+		etf-lpass {
+			qcom,dump-size = <0x4000>;
+			qcom,dump-id = <0xf4>;
+		};
+
+		etflpass-reg {
+			qcom,dump-size = <0x1000>;
+			qcom,dump-id = <0x104>;
+		};
+
+
+		etf-swao {
+			qcom,dump-size = <0x10000>;
+			qcom,dump-id = <0xf1>;
+		};
+
+		etfswao-reg {
+			qcom,dump-size = <0x1000>;
+			qcom,dump-id = <0x102>;
+		};
+
+		etr-reg {
+			qcom,dump-size = <0x1000>;
+			qcom,dump-id = <0x100>;
+		};
+
+		fcm {
+			qcom,dump-size = <0x8400>;
+			qcom,dump-id = <0xee>;
+		};
+
+		fsm-data {
+			qcom,dump-size = <0x400>;
+			qcom,dump-id = <0x165>;
+		};
+
+		gemnoc {
+			qcom,dump-size = <0x100000>;
+			qcom,dump-id = <0x162>;
+		};
+
+		l1-dcache0 {
+			qcom,dump-size = <0x9100>;
+			qcom,dump-id = <0x80>;
+		};
+
+		l1-dcache100 {
+			qcom,dump-size = <0x9100>;
+			qcom,dump-id = <0x81>;
+		};
+
+		l1-dcache200 {
+			qcom,dump-size = <0x9100>;
+			qcom,dump-id = <0x82>;
+		};
+
+		l1-dcache300 {
+			qcom,dump-size = <0x9100>;
+			qcom,dump-id = <0x83>;
+		};
+
+		l1-dcache400 {
+			qcom,dump-size = <0x9100>;
+			qcom,dump-id = <0x84>;
+		};
+
+		l1-dcache500 {
+			qcom,dump-size = <0x9100>;
+			qcom,dump-id = <0x85>;
+		};
+
+		l1-dcache600 {
+			qcom,dump-size = <0x9100>;
+			qcom,dump-id = <0x86>;
+		};
+
+		l1-dcache700 {
+			qcom,dump-size = <0x12100>;
+			qcom,dump-id = <0x87>;
+		};
+
+		l1-dtlb400 {
+			qcom,dump-size = <0x300>;
+			qcom,dump-id = <0x44>;
+		};
+
+		l1-dtlb500 {
+			qcom,dump-size = <0x300>;
+			qcom,dump-id = <0x45>;
+		};
+
+		l1-dtlb600 {
+			qcom,dump-size = <0x300>;
+			qcom,dump-id = <0x46>;
+		};
+
+		l1-dtlb700 {
+			qcom,dump-size = <0x3a0>;
+			qcom,dump-id = <0x47>;
+		};
+
+		l1-icache0 {
+			qcom,dump-size = <0x10900>;
+			qcom,dump-id = <0x60>;
+		};
+
+		l1-icache100 {
+			qcom,dump-size = <0x10900>;
+			qcom,dump-id = <0x61>;
+		};
+
+		l1-icache200 {
+			qcom,dump-size = <0x10900>;
+			qcom,dump-id = <0x62>;
+		};
+
+		l1-icache300 {
+			qcom,dump-size = <0x10900>;
+			qcom,dump-id = <0x63>;
+		};
+
+		l1-icache400 {
+			qcom,dump-size = <0x15100>;
+			qcom,dump-id = <0x64>;
+		};
+
+		l1-icache500 {
+			qcom,dump-size = <0x15100>;
+			qcom,dump-id = <0x65>;
+		};
+
+		l1-icache600 {
+			qcom,dump-size = <0x15100>;
+			qcom,dump-id = <0x66>;
+		};
+
+		l1-icache700 {
+			qcom,dump-size = <0x32100>;
+			qcom,dump-id = <0x67>;
+		};
+
+		l1-itlb400 {
+			qcom,dump-size = <0x300>;
+			qcom,dump-id = <0x24>;
+		};
+
+		l1-itlb500 {
+			qcom,dump-size = <0x300>;
+			qcom,dump-id = <0x25>;
+		};
+
+		l1-itlb600 {
+			qcom,dump-size = <0x300>;
+			qcom,dump-id = <0x26>;
+		};
+
+		l1-itlb700 {
+			qcom,dump-size = <0x400>;
+			qcom,dump-id = <0x27>;
+		};
+
+		l2-cache400 {
+			qcom,dump-size = <0x90100>;
+			qcom,dump-id = <0xc4>;
+		};
+
+		l2-cache500 {
+			qcom,dump-size = <0x90100>;
+			qcom,dump-id = <0xc5>;
+		};
+
+		l2-cache600 {
+			qcom,dump-size = <0x90100>;
+			qcom,dump-id = <0xc6>;
+		};
+
+		l2-cache700 {
+			qcom,dump-size = <0x120100>;
+			qcom,dump-id = <0xc7>;
+		};
+
+		l2-tlb0 {
+			qcom,dump-size = <0x5b00>;
+			qcom,dump-id = <0x120>;
+		};
+
+		l2-tlb100 {
+			qcom,dump-size = <0x5b00>;
+			qcom,dump-id = <0x121>;
+		};
+
+		l2-tlb200 {
+			qcom,dump-size = <0x5b00>;
+			qcom,dump-id = <0x122>;
+		};
+
+		l2-tlb300 {
+			qcom,dump-size = <0x5b00>;
+			qcom,dump-id = <0x123>;
+		};
+
+		l2-tlb400 {
+			qcom,dump-size = <0x6100>;
+			qcom,dump-id = <0x124>;
+		};
+
+		l2-tlb500 {
+			qcom,dump-size = <0x6100>;
+			qcom,dump-id = <0x125>;
+		};
+
+		l2-tlb600 {
+			qcom,dump-size = <0x6100>;
+			qcom,dump-id = <0x126>;
+		};
+
+		l2-tlb700 {
+			qcom,dump-size = <0xc100>;
+			qcom,dump-id = <0x127>;
+		};
+
+		llcc-1-dcache {
+			qcom,dump-size = <0x1141c0>;
+			qcom,dump-id = <0x140>;
+		};
+
+		llcc-2-dcache {
+			qcom,dump-size = <0x1141c0>;
+			qcom,dump-id = <0x141>;
+		};
+
+		mhm-scan {
+			qcom,dump-size = <0x20000>;
+			qcom,dump-id = <0x161>;
+		};
+
+		misc-data {
+			qcom,dump-size = <0x1000>;
+			qcom,dump-id = <0xe8>;
+		};
+
+		osm-reg {
+			qcom,dump-size = <0x400>;
+			qcom,dump-id = <0x163>;
+		};
+
+		pcu-reg {
+			qcom,dump-size = <0x400>;
+			qcom,dump-id = <0x164>;
+		};
+
+		pmic {
+			qcom,dump-size = <0x200000>;
+			qcom,dump-id = <0xe4>;
+		};
+
+		rpmh {
+			qcom,dump-size = <0x2000000>;
+			qcom,dump-id = <0xec>;
+		};
+
+		rpm-sw {
+			qcom,dump-size = <0x28000>;
+			qcom,dump-id = <0xea>;
+		};
+	};
+
+	pmic_glink: pmic-glink {
+	};
+
+	/* add overlay for smp2p nodes in sc7280.dtsi */
+	smp2p-adsp {
+		smp2p_rdbg2_out: smp2p-rdbg2-out {
+			qcom,entry-name = "rdbg";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_rdbg2_in: smp2p-rdbg2-in {
+			qcom,entry-name = "rdbg";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		sleepstate_smp2p_in: qcom,sleepstate-in {
+			qcom,entry-name = "sleepstate_see";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		sleepstate_smp2p_out: sleepstate-out {
+			qcom,entry-name = "sleepstate";
+			#qcom,smem-state-cells = <1>;
+		};
+	};
+
+	smp2p-cdsp {
+		smp2p_rdbg5_out: smp2p-rdbg5-out {
+			qcom,entry-name = "rdbg";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_rdbg5_in: smp2p-rdbg5-in {
+			qcom,entry-name = "rdbg";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	/* Gunyah expects arch_timer symbol for boot time overlay */
+	arch_timer: timer {
+	};
+
+	redriver: typec-retimer@1c {
+	};
+};
+
+/* Delete venus node properties to adapt with downstream video driver  */
+&venus {
+	/delete-property/ iommus;
+	/delete-node/ video-decoder;
+	/delete-node/ video-encoder;
+};
+
+&pm8350c {
+	pm8350c_bcl: bcl@4700 {
+		compatible = "qcom,bcl-v5";
+		reg = <0x4700 0x100>;
+		interrupts = <0x2 0x47 0x0 IRQ_TYPE_NONE>,
+				<0x2 0x47 0x1 IRQ_TYPE_NONE>,
+				<0x2 0x47 0x2 IRQ_TYPE_NONE>;
+		interrupt-names = "bcl-lvl0",
+					"bcl-lvl1",
+					"bcl-lvl2";
+		qcom,pmic7-threshold;
+		#thermal-sensor-cells = <1>;
+	};
+};
+
+&qfprom {
+	tsens_chipinfo: tsens_chipinfo@180 {
+		reg = <0x180 0x4>;
+	};
+};
+
+&remoteproc_cdsp {
+	cooling {
+		compatible = "qcom,qmi-cooling-cdsp";
+
+		cdsp_sw: cdsp_sw {
+			label = "cdsp_sw";
+			#cooling-cells = <2>;
+		};
+	};
+};
+
+&remoteproc_mpss {
+	cooling {
+		compatible = "qcom,qmi-cooling-modem";
+
+		modem_pa: modem_pa {
+			label = "pa";
+			#cooling-cells = <2>;
+		};
+
+		modem_pa_fr1: modem_pa_fr1 {
+			label = "pa_fr1";
+			#cooling-cells = <2>;
+		};
+
+		modem_skin: modem_skin {
+			label = "modem_skin";
+			#cooling-cells = <2>;
+		};
+
+		modem_pa_dsc: modem_pa_dsc {
+			label = "pa_dsc";
+			#cooling-cells = <2>;
+		};
+
+		modem_pa_fr1_dsc: modem_pa_fr1_dsc {
+			label = "pa_fr1_dsc";
+			#cooling-cells = <2>;
+		};
+
+		modem_tj: modem_tj {
+			label = "modem";
+			#cooling-cells = <2>;
+		};
+
+		modem_skin_lte_dsc: modem_skin_lte_dsc {
+			label = "modem_skin_lte_dsc";
+			#cooling-cells = <2>;
+		};
+
+		modem_skin_nr_dsc: modem_skin_nr_dsc {
+			label = "modem_skin_nr_dsc";
+			#cooling-cells = <2>;
+		};
+	};
+};
+
+&soc {
+	audio-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		qcom,inst-id = <5>;
+		device-name = "audio_etm0";
+
+		out-ports {
+			port {
+				audio_etm0_out_funnel_lpass_lpi: endpoint {
+					remote-endpoint =
+					<&funnel_lpass_lpi_in_audio_etm0>;
+				};
+			};
+		};
+	};
+
+	funnel@6042000 {
+		in-ports {
+			port@5 {
+				reg = <5>;
+				funnel_in1_in_funnel_modem: endpoint {
+					remote-endpoint =
+					<&funnel_modem_out_funnel_in1>;
+				};
+			};
+		};
+	};
+
+	funnel@6804000 {
+		compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+
+		reg = <0x0 0x06804000 0x0 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-modem";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		out-ports {
+			port {
+				funnel_modem_out_funnel_in1: endpoint {
+					remote-endpoint =
+						<&funnel_in1_in_funnel_modem>;
+				};
+			};
+		};
+
+		in-ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@1 {
+				reg = <1>;
+				funnel_modem_in_modem2_etm0: endpoint {
+					remote-endpoint =
+						<&modem2_etm0_out_funnel_modem>;
+				};
+			};
+
+			port@3 {
+				reg = <3>;
+				funnel_modem_in_funnel_mq6_dup: endpoint {
+					remote-endpoint =
+					  <&funnel_mq6_dup_out_funnel_modem>;
+				};
+			};
+		};
+	};
+
+	funnel@680c000 {
+		compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+
+		reg = <0x0 0x0680c000 0x0 0x1000>;
+		reg-names = "funnel-base";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		out-ports {
+			port {
+				funnel_modem_q6_out_funnel_mq6_dup: endpoint {
+					remote-endpoint =
+					<&funnel_mq6_dup_in_funnel_modem_q6>;
+				};
+			};
+		};
+
+		in-ports {
+			port {
+				funnel_modem_q6_in_modem_etm0: endpoint {
+					remote-endpoint =
+					<&modem_etm0_out_funnel_modem_q6>;
+				};
+			};
+		};
+	};
+
+	funnel@680d000 {
+		compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+		arm,primecell-periphid = <0x000bb908>;
+
+		reg = <0x0 0x0680d000 0x0 0x1000>,
+			<0x0 0x0680c000 0x0 0x1000>;
+
+		reg-names = "funnel-base-dummy", "funnel-base-real";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+		qcom,duplicate-funnel;
+
+		out-ports {
+			port {
+				funnel_mq6_dup_out_funnel_modem: endpoint {
+					remote-endpoint =
+					<&funnel_modem_in_funnel_mq6_dup>;
+				};
+			};
+		};
+
+		in-ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@1 {
+				reg = <1>;
+				funnel_mq6_dup_in_funnel_modem_q6: endpoint {
+					remote-endpoint =
+					<&funnel_modem_q6_out_funnel_mq6_dup>;
+				};
+			};
+
+			port@2 {
+				reg = <2>;
+				funnel_mq6_dup_in_modem_diag: endpoint {
+					remote-endpoint =
+					<&modem_diag_out_funnel_mq6_dup>;
+				};
+			};
+		};
+	};
+
+	funnel@6985000 {
+		compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+
+		reg = <0x0 0x06985000 0x0 0x1000>;
+		reg-names = "funnel-base";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		out-ports {
+			port {
+				funnel_dl_turing_out_funnel_dlct5: endpoint {
+					remote-endpoint =
+						<&funnel_dlct5_in_funnel_dl_turing>;
+				};
+			};
+		};
+
+		in-ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@4 {
+				reg = <4>;
+				turing_in_turing_dup: endpoint {
+					remote-endpoint =
+					  <&turing_dup_out_turing>;
+				};
+			};
+		};
+	};
+
+	funnel@6986000 {
+		compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+		arm,primecell-periphid = <0x000bb908>;
+
+		reg = <0x0 0x06986000 0x0 0x1000>,
+			<0x0 0x06985000 0x0 0x1000>;
+		reg-names = "funnel-base-dummy", "funnel-base-real";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+		qcom,duplicate-funnel;
+
+		out-ports {
+			port {
+				turing_dup_out_turing: endpoint {
+					remote-endpoint =
+					<&turing_in_turing_dup>;
+				};
+			};
+		};
+
+		in-ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@3 {
+				reg = <3>;
+				funnel_dup_turing_in_turing_etm: endpoint {
+					remote-endpoint =
+					<&turing_etm_out_funnel_dup_turing>;
+				};
+			};
+		};
+	};
+
+	funnel@6b04000 {
+		in-ports {
+			port@5 {
+				reg = <5>;
+				funnel_swao_in_funnel_lpass_lpi: endpoint {
+					remote-endpoint =
+					<&funnel_lpass_lpi_out_funnel_swao>;
+				};
+			};
+		};
+	};
+
+	tgu@6b0e000 {
+		compatible = "arm,primecell", "qcom,coresight-tgu";
+		arm,primecell-periphid = <0x000bb999>;
+		reg = <0x0 0x06b0e000 0x0 0x1000>;
+		device-name = "tgu_ipcb";
+
+		tgu-steps = <3>;
+		tgu-conditions = <4>;
+		tgu-regs = <4>;
+		tgu-timer-counters = <8>;
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+	};
+
+	swao_csr: csr@6b0f000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x0 0x06b0f000 0x0 0x1000>,
+		      <0x0 0x06b0f0f8 0x0 0x50>;
+		reg-names = "csr-base", "msr-base";
+
+		device-name = "swao_csr";
+		qcom,timestamp-support;
+		qcom,msr-support;
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		qcom,blk-size = <1>;
+	};
+
+	funnel@6b44000 {
+		compatible = "arm,coresight-static-funnel";
+		coresight-name = "coresight-funnel-lpass_lpi";
+
+		out-ports {
+			port {
+				funnel_lpass_lpi_out_funnel_swao: endpoint {
+					remote-endpoint =
+					<&funnel_swao_in_funnel_lpass_lpi>;
+				};
+			};
+		};
+
+		in-ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_lpass_lpi_in_audio_etm0: endpoint {
+					remote-endpoint =
+					<&audio_etm0_out_funnel_lpass_lpi>;
+				};
+			};
+		};
+	};
+
+	funnel@6c38000 {
+		in-ports {
+			port@6 {
+				reg = <6>;
+				funnel_dlct5_in_funnel_dl_turing: endpoint {
+					remote-endpoint =
+					<&funnel_dl_turing_out_funnel_dlct5>;
+				};
+			};
+		};
+	};
+
+	funnel@6c73000 {
+		in-ports {
+			port@2 {
+				reg = <2>;
+				funnel_wpss_in_wpss_etm0: endpoint {
+					remote-endpoint =
+						<&wpss_etm0_out_funnel_wpss>;
+				};
+			};
+		};
+	};
+
+	modem-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		device-name = "modem_etm0";
+		qcom,inst-id = <2>;
+
+		out-ports {
+			port {
+				modem_etm0_out_funnel_modem_q6: endpoint {
+					remote-endpoint =
+						<&funnel_modem_q6_in_modem_etm0>;
+				};
+			};
+		};
+	};
+
+	modem2-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		device-name = "modem2_etm0";
+		qcom,inst-id = <11>;
+
+		out-ports {
+			port {
+				modem2_etm0_out_funnel_modem: endpoint {
+					remote-endpoint =
+						<&funnel_modem_in_modem2_etm0>;
+				};
+			};
+		};
+	};
+
+	msm_gpu: qcom,kgsl-3d0@3d00000 {
+		#cooling-cells = <2>;
+	};
+
+	msm_stub_codec: msm-stub-codec {
+		compatible = "qcom,msm-stub-codec";
+		#sound-dai-cells = <1>;
+	};
+
+	qcom,devfreq-cdev {
+		compatible = "qcom,devfreq-cdev";
+		qcom,devfreq = <&msm_gpu>;
+		#cooling-cells = <2>;
+	};
+
+	/* smp2p information */
+	qcom-smp2p-interrupt-rdbg-2-in {
+		compatible = "qcom,smp2p-interrupt-rdbg-2-in";
+		interrupts-extended = <&smp2p_rdbg2_in 0 IRQ_TYPE_NONE>;
+		interrupt-names = "rdbg-smp2p-in";
+	};
+
+	qcom-smp2p-interrupt-rdbg-2-out {
+		compatible = "qcom,smp2p-interrupt-rdbg-2-out";
+		qcom,smem-states = <&smp2p_rdbg2_out 0>;
+		qcom,smem-state-names = "rdbg-smp2p-out";
+	};
+
+	qcom-smp2p-interrupt-rdbg-5-in {
+		compatible = "qcom,smp2p-interrupt-rdbg-5-in";
+		interrupts-extended = <&smp2p_rdbg5_in 0 IRQ_TYPE_NONE>;
+		interrupt-names = "rdbg-smp2p-in";
+	};
+
+	qcom-smp2p-interrupt-rdbg-5-out {
+		compatible = "qcom,smp2p-interrupt-rdbg-5-out";
+		qcom,smem-states = <&smp2p_rdbg5_out 0>;
+		qcom,smem-state-names = "rdbg-smp2p-out";
+	};
+
+	qcom,smp2p_sleepstate {
+		compatible = "qcom,smp2p-sleepstate";
+		qcom,smem-states = <&sleepstate_smp2p_out 0>;
+		interrupt-parent = <&sleepstate_smp2p_in>;
+		interrupts = <0 0>;
+		interrupt-names = "smp2p-sleepstate-in";
+	};
+
+	spf_core_platform: spf-core-platform {
+		compatible = "qcom,spf-core-platform";
+
+		msm_audio_mem: msm-audio-mem {
+			compatible = "qcom,msm-audio-mem";
+			qcom,smmu-version = <2>;
+			qcom,smmu-enabled;
+			iommus = <&apps_smmu 0x1801 0x0>;
+			qcom,iommu-dma-addr-pool = <0x10000000 0x10000000>;
+			qcom,smmu-sid-mask = /bits/ 64 <0xf>;
+			dma-coherent;
+		};
+
+		msm_audio_mem_cma: msm-audio-mem-cma {
+			compatible = "qcom,msm-audio-mem";
+			memory-region = <&audio_cma_mem>;
+		};
+	};
+
+	source {
+		compatible = "arm,coresight-dummy-source";
+
+		device-name = "modem_diag";
+
+		arm,trace-id = <50>;
+		out-ports {
+			port {
+				modem_diag_out_funnel_mq6_dup: endpoint {
+					remote-endpoint =
+						<&funnel_mq6_dup_in_modem_diag>;
+				};
+			};
+		};
+	};
+
+	turing-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		device-name = "turing_etm0";
+		qcom,inst-id = <13>;
+
+		out-ports {
+			port {
+				turing_etm_out_funnel_dup_turing: endpoint {
+					remote-endpoint =
+					<&funnel_dup_turing_in_turing_etm>;
+				};
+			};
+		};
+	};
+
+	wpss-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		device-name = "wpss_etm0";
+		qcom,inst-id = <3>;
+
+		out-ports {
+			port {
+				wpss_etm0_out_funnel_wpss: endpoint {
+					remote-endpoint =
+					<&funnel_wpss_in_wpss_etm0>;
+				};
+			};
+		};
+	};
+
+	sram@146a5000{
+		kaslr_offset@56d0 {
+			compatible = "qcom,msm-imem-kaslr_offset";
+			reg = <0x56d0 0xc>;
+		};
+
+		mem-dump-table@5010 {
+			compatible = "qcom,msm-imem-mem-dump-table";
+			reg = <0x5010 0x8>;
+		};
+	};
+
+	qcom_tzlog: tz-log@146aa720 {
+		compatible = "qcom,tz-log";
+		reg = <0x0 0x146aa720 0x0 0x3000>;
+		qcom,hyplog-enabled;
+		hyplog-address-offset = <0x410>;
+		hyplog-size-offset = <0x414>;
+	};
+
+	qcom,mem-buf {
+		compatible = "qcom,mem-buf";
+		qcom,mem-buf-capabilities = "supplier";
+		qcom,vmid = <3>;
+	};
+
+	qcom,mem-buf-msgq {
+		compatible = "qcom,mem-buf-msgq";
+	};
+
+	qcom,secure-buffer {
+		compatible = "qcom,secure-buffer";
+		qcom,vmid-cp-camera-preview-ro;
+	};
+
+	csr: csr@6001000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x0 0x06001000 0x0 0x1000>;
+		reg-names = "csr-base";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		device-name = "csr";
+		qcom,set-byte-cntr-support;
+
+		qcom,blk-size = <1>;
+	};
+
+	etr@6048000 {
+		qcom,sw-usb;
+		coresight-csr = <&csr>;
+		interrupts = <GIC_SPI 270 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "byte-cntr-irq";
+	};
+};
+
+&thermal_zones {
+	aoss0-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			aoss0-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+	};
+
+	aoss1-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <2000>;
+				type = "passive";
+			};
+
+			aoss1-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+	};
+
+	camera0-thermal {
+		polling-delay-passive = <100>;
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			camera0_alert1: trip-point1 {
+				temperature = <100000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			camera0-crit {
+				temperature = <118000>;
+				hysteresis = <0>;
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&camera0_alert1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map1 {
+				trip = <&camera0_alert1>;
+				cooling-device = <&modem_pa 3 3>;
+			};
+
+			map2 {
+				trip = <&camera0_alert1>;
+				cooling-device = <&msm_gpu 5 5>;
+			};
+		};
+	};
+
+	cpu0-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu0_alert1>;
+				cooling-device = <&CPU0_idle 100 100>;
+			};
+		};
+	};
+
+	cpu1-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu1_alert1>;
+				cooling-device = <&CPU1_idle 100 100>;
+			};
+		};
+	};
+
+	cpu2-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu2_alert1>;
+				cooling-device = <&CPU2_idle 100 100>;
+			};
+		};
+	};
+
+	cpu3-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu3_alert1>;
+				cooling-device = <&CPU3_idle 100 100>;
+			};
+		};
+	};
+
+	cpu4-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu4_alert1>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+		};
+	};
+
+	cpu5-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu5_alert1>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+		};
+	};
+
+	cpu6-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu6_alert1>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+		};
+	};
+
+	cpu7-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu7_alert1>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+		};
+	};
+
+	cpu8-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu8_alert1>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+		};
+	};
+
+	cpu9-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu9_alert1>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+		};
+	};
+
+	cpu10-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu10_alert1>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+		};
+	};
+
+	cpu11-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+			};
+
+			trip-point1 {
+				temperature = <110000>;
+				hysteresis = <5000>;
+			};
+
+			cpu-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		/delete-node/ cooling-maps;
+		cooling-maps {
+			map0 {
+				trip = <&cpu11_alert1>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+		};
+	};
+
+	cpuss0-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			cluster0-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+	};
+
+	cpuss1-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "hot";
+			};
+
+			cluster0-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+	};
+
+	ddr-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			ddr-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+	};
+
+	gpuss0-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <2000>;
+				type = "passive";
+			};
+
+			gpuss0_alert1: trip-point1 {
+				temperature = <95000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			gpuss0-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+				type = "critical";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&gpuss0_alert1>;
+				cooling-device = <&msm_gpu THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+
+			};
+		};
+	};
+
+	gpuss1-thermal {
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			gpuss1_alert1: trip-point1 {
+				temperature = <95000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			gpuss1-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&gpuss1_alert1>;
+				cooling-device = <&msm_gpu THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	mdmss0-thermal {
+		polling-delay-passive = <100>;
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			mdmss0_alert1: trip-point1 {
+				temperature = <95000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss0_alert2: trip-point2 {
+				temperature = <105000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss0_alert3: trip-point3 {
+				temperature = <115000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss0-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&mdmss0_alert1>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+
+			map1 {
+				trip = <&mdmss0_alert2>;
+				cooling-device = <&modem_tj 2 2>;
+			};
+
+			map2 {
+				trip = <&mdmss0_alert3>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	mdmss1-thermal {
+		polling-delay-passive = <100>;
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			mdmss1_alert1: trip-point1 {
+				temperature = <95000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss1_alert2: trip-point2 {
+				temperature = <105000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss1_alert3: trip-point3 {
+				temperature = <115000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss1-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&mdmss1_alert1>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+
+			map1 {
+				trip = <&mdmss1_alert2>;
+				cooling-device = <&modem_tj 2 2>;
+			};
+
+			map2 {
+				trip = <&mdmss1_alert3>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	mdmss2-thermal {
+		polling-delay-passive = <100>;
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			mdmss2_alert1: trip-point1 {
+				temperature = <95000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss2_alert2: trip-point2 {
+				temperature = <105000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss2_alert3: trip-point3 {
+				temperature = <115000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss2-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&mdmss2_alert1>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+
+			map1 {
+				trip = <&mdmss2_alert2>;
+				cooling-device = <&modem_tj 2 2>;
+			};
+
+			map2 {
+				trip = <&mdmss2_alert3>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	mdmss3-thermal {
+		polling-delay-passive = <100>;
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			mdmss3_alert1: trip-point1 {
+				temperature = <95000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss3_alert2: trip-point2 {
+				temperature = <105000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss3_alert3: trip-point3 {
+				temperature = <115000>;
+				hysteresis = <15000>;
+				type = "passive";
+			};
+
+			mdmss3-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&mdmss3_alert1>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+
+			map1 {
+				trip = <&mdmss3_alert2>;
+				cooling-device = <&modem_tj 2 2>;
+			};
+
+			map2 {
+				trip = <&mdmss3_alert3>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	nspss0-thermal {
+		polling-delay-passive = <100>;
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			nspss0_alert1: trip-point1 {
+				temperature = <100000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			nspss0-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&nspss0_alert1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map1 {
+				trip = <&nspss0_alert1>;
+				cooling-device = <&modem_pa 3 3>;
+			};
+
+			map2 {
+				trip = <&nspss0_alert1>;
+				cooling-device = <&msm_gpu 5 5>;
+			};
+		};
+	};
+
+	nspss1-thermal {
+		polling-delay-passive = <100>;
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			nspss1_alert1: trip-point1 {
+				temperature = <100000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			nspss1-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&nspss1_alert1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map1 {
+				trip = <&nspss1_alert1>;
+				cooling-device = <&modem_pa 3 3>;
+			};
+
+			map2 {
+				trip = <&nspss1_alert1>;
+				cooling-device = <&msm_gpu 5 5>;
+			};
+		};
+	};
+
+	pm8350c-bcl-lvl0 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm8350c_bcl 5>;
+
+		trips {
+			c_bcl_lvl0: c-bcl-lvl0 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&c_bcl_lvl0>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+
+			map1 {
+				trip = <&c_bcl_lvl0>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+
+			map2 {
+				trip = <&c_bcl_lvl0>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+
+			map3 {
+				trip = <&c_bcl_lvl0>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+
+			map4 {
+				trip = <&c_bcl_lvl0>;
+				cooling-device = <&cdsp_sw 2 2>;
+			};
+
+			map5 {
+				trip = <&c_bcl_lvl0>;
+				cooling-device = <&modem_pa 2 2>;
+			};
+
+			map6 {
+				trip = <&c_bcl_lvl0>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+		};
+	};
+
+	pm8350c-bcl-lvl1 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm8350c_bcl 6>;
+
+		trips {
+			c_bcl_lvl1: c-bcl-lvl1 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&c_bcl_lvl1>;
+				cooling-device = <&msm_gpu 5 THERMAL_NO_LIMIT>;
+			};
+
+			//map1 {
+			//	trip = <&c_bcl_lvl1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map2 {
+				trip = <&c_bcl_lvl1>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	pm8350c-bcl-lvl2 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm8350c_bcl 7>;
+
+		trips {
+			c_bcl_lvl2: c-bcl-lvl2 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&c_bcl_lvl2>;
+			//	cooling-device = <&cdsp_sw 5 5>;
+			//};
+		};
+	};
+
+	video-thermal {
+		polling-delay-passive = <100>;
+		trips {
+			trip-point0 {
+				temperature = <125000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			video_alert1: trip-point1 {
+				temperature = <100000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+
+			video-crit {
+				temperature = <118000>;
+				hysteresis = <2000>;
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&video_alert1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map1 {
+				trip = <&video_alert1>;
+				cooling-device = <&modem_pa 3 3>;
+			};
+
+			map2 {
+				trip = <&video_alert1>;
+				cooling-device = <&msm_gpu 5 5>;
+			};
+		};
+	};
+};
+
+&tsens0 {
+	nvmem-cells = <&tsens_chipinfo>;
+	nvmem-cell-names = "tsens_chipinfo";
+};
+
+&tsens1 {
+	nvmem-cells = <&tsens_chipinfo>;
+	nvmem-cell-names = "tsens_chipinfo";
+};
+
+#include "qcm6490-dma-heaps.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-camera-idp.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-camera-idp.dtso
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,gcc-sc7280.h>
+#include <dt-bindings/clock/qcom,camcc-sc7280.h>
+#include <dt-bindings/interconnect/qcom,sc7280.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+
+#include "qcm6490-camera.dtsi"
+#include "qcm6490-camera-sensor-idp.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-camera-rb3.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-camera-rb3.dtsi
@@ -0,0 +1,2520 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&tlmm {
+	cci0_active: cci0_active {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio69","gpio70"; // Only 2
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio69","gpio70";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci0_suspend: cci0_suspend {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio69","gpio70";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio69","gpio70";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci1_active: cci1_active {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio71","gpio72";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio71","gpio72";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci1_suspend: cci1_suspend {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio71","gpio72";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio71","gpio72";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci2_active: cci2_active {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio73","gpio74";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio73","gpio74";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci2_suspend: cci2_suspend {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio73","gpio74";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio73","gpio74";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci3_active: cci3_active {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio75","gpio76";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio75","gpio76";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci3_suspend: cci3_suspend {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio75","gpio76";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio75","gpio76";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+
+	};
+
+	cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+		/* MCLK0 */
+		mux {
+			pins = "gpio64";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio64";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk0_suspend: cam_sensor_mclk0_suspend {
+		/* MCLK0 */
+		mux {
+			pins = "gpio64";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio64";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_active: cam_sensor_mclk1_active {
+		/* MCLK1 */
+		mux {
+			pins = "gpio65";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio65";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_suspend: cam_sensor_mclk1_suspend {
+		/* MCLK1 */
+		mux {
+			pins = "gpio65";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio65";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+		/* MCLK2 */
+		mux {
+			pins = "gpio66";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio66";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_suspend: cam_sensor_mclk2_suspend {
+		/* MCLK2 */
+		mux {
+			pins = "gpio66";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio66";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk3_active: cam_sensor_mclk3_active {
+		/* MCLK3 */
+		mux {
+			pins = "gpio67";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk3_suspend: cam_sensor_mclk3_suspend {
+		/* MCLK3 */
+		mux {
+			pins = "gpio67";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk4_active: cam_sensor_mclk4_active {
+		/* MCLK4 */
+		mux {
+			pins = "gpio68";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio68";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk4_suspend: cam_sensor_mclk4_suspend {
+		/* MCLK4 */
+		mux {
+			pins = "gpio68";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio68";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk5_active: cam_sensor_mclk5_active {
+		/* MCLK5 */
+		mux {
+			pins = "gpio98";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio98";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk5_suspend: cam_sensor_mclk5_suspend {
+		/* MCLK5 */
+		mux {
+			pins = "gpio98";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio98";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_active_rst0: cam_sensor_active_rst0 {
+		/* RESET REAR */
+		mux {
+			pins = "gpio20";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio20";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst0: cam_sensor_suspend_rst0 {
+		/* RESET REAR */
+		mux {
+			pins = "gpio20";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio20";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst1: cam_sensor_active_rst1 {
+		/* RESET REARAUX */
+		mux {
+			pins = "gpio21";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio21";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst1: cam_sensor_suspend_rst1 {
+		/* RESET REARAUX */
+		mux {
+			pins = "gpio21";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio21";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst2: cam_sensor_active_rst2 {
+		/* RESET 2 */
+		mux {
+			pins = "gpio77";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio77";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst2: cam_sensor_suspend_rst2 {
+		/* RESET 2 */
+		mux {
+			pins = "gpio77";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio77";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst3: cam_sensor_active_rst3 {
+		/* RESET 3 */
+		mux {
+			pins = "gpio78";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio78";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst3: cam_sensor_suspend_rst3 {
+		/* RESET 3 */
+		mux {
+			pins = "gpio78";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio78";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst4: cam_sensor_active_rst4 {
+		/* RESET 4 */
+		mux {
+			pins = "gpio79";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio79";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst4: cam_sensor_suspend_rst4 {
+		/* RESET 4 */
+		mux {
+			pins = "gpio79";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio79";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_mux: cam_sensor_active_mux {
+		/* GC630 bypass mux */
+		mux {
+			pins = "gpio1";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio1";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_mux: cam_sensor_suspend_mux {
+		/* GC630 bypass mux */
+		mux {
+			pins = "gpio1";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio1";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+};
+
+&soc {
+	qcom,cam-req-mgr {
+		compatible = "qcom,cam-req-mgr";
+		status = "ok";
+	};
+
+	qcom,cam-sync {
+		compatible = "qcom,cam-sync";
+		status = "ok";
+	};
+
+	cam_csiphy0: qcom,csiphy0 {
+		cell-index = <0>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0x0ace0000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe0000>;
+		interrupts = <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy0";
+		operating-points-v2 = <&csiphy0_opp_table>;
+		refgen-supply = <&refgen>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY0_CLK>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy0_clk",
+			"csi0phytimer_clk_src",
+			"csi0phytimer_clk";
+		src-clock-name = "csi0phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_csiphy1: qcom,csiphy1 {
+		cell-index = <1>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0xace2000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe2000>;
+		interrupts = <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy1";
+		operating-points-v2 = <&csiphy1_opp_table>;
+		refgen-supply = <&refgen>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY1_CLK>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy1_clk",
+			"csi1phytimer_clk_src",
+			"csi1phytimer_clk";
+		src-clock-name = "csi1phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_csiphy2: qcom,csiphy2 {
+		cell-index = <2>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0xace4000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe4000>;
+		interrupts = <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy2";
+		refgen-supply = <&refgen>;
+		operating-points-v2 = <&csiphy2_opp_table>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY2_CLK>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy2_clk",
+			"csi2phytimer_clk_src",
+			"csi2phytimer_clk";
+		src-clock-name = "csi2phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_csiphy3: qcom,csiphy3 {
+		cell-index = <3>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0xace6000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe6000>;
+		interrupts = <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy3";
+		refgen-supply = <&refgen>;
+		operating-points-v2 = <&csiphy3_opp_table>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY3_CLK>,
+			<&camcc CAM_CC_CSI3PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI3PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy3_clk",
+			"csi3phytimer_clk_src",
+			"csi3phytimer_clk";
+		src-clock-name = "csi3phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_csiphy4: qcom,csiphy4 {
+		cell-index = <4>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0xace8000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe8000>;
+		interrupts = <GIC_SPI 122 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy4";
+		refgen-supply = <&refgen>;
+		operating-points-v2 = <&csiphy4_opp_table>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY4_CLK>,
+			<&camcc CAM_CC_CSI4PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI4PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy4_clk",
+			"csi4phytimer_clk_src",
+			"csi4phytimer_clk";
+		src-clock-name = "csi4phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy4_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_cci0: qcom,cci0 {
+		cell-index = <0>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac4a000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x4a000>;
+		interrupt-names = "cci";
+		interrupts = <GIC_SPI 460 IRQ_TYPE_EDGE_RISING>;
+		status = "ok";
+		operating-points-v2 = <&cci0_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clocks = <&camcc CAM_CC_CCI_0_CLK_SRC>,
+			<&camcc CAM_CC_CCI_0_CLK>;
+		clock-names = "cci_0_clk_src",
+			"cci_0_clk";
+		src-clock-name = "cci_0_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates = <37500000 0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cci0_active &cci1_active>;
+		pinctrl-1 = <&cci0_suspend &cci1_suspend>;
+		gpios = <&tlmm 69 0>,
+			<&tlmm 70 0>,
+			<&tlmm 71 0>,
+			<&tlmm 72 0>;
+		gpio-req-tbl-num = <0 1 2 3>;
+		gpio-req-tbl-flags = <1 1 1 1>;
+		gpio-req-tbl-label = "CCI_I2C_DATA0",
+					"CCI_I2C_CLK0",
+					"CCI_I2C_DATA1",
+					"CCI_I2C_CLK1";
+		cci0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci0: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci0: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci0: qcom,i2c_custom_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci0: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci1: qcom,cci1 {
+		cell-index = <1>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac4b000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x4b000>;
+		interrupt-names = "cci";
+		interrupts = <GIC_SPI 271 IRQ_TYPE_EDGE_RISING>;
+		status = "ok";
+		operating-points-v2 = <&cci1_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clocks = <&camcc CAM_CC_CCI_1_CLK_SRC>,
+			<&camcc CAM_CC_CCI_1_CLK>;
+		clock-names = "cci_1_clk_src",
+			"cci_1_clk";
+		src-clock-name = "cci_1_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates = <37500000 0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cci2_active &cci3_active>;
+		pinctrl-1 = <&cci2_suspend &cci3_suspend>;
+		gpios = <&tlmm 73 0>,
+			<&tlmm 74 0>,
+			<&tlmm 75 0>,
+			<&tlmm 76 0>;
+		gpio-req-tbl-num = <0 1 2 3>;
+		gpio-req-tbl-flags = <1 1 1 1>;
+		gpio-req-tbl-label = "CCI_I2C_DATA2",
+					"CCI_I2C_CLK2",
+					"CCI_I2C_DATA3",
+					"CCI_I2C_CLK3";
+		cci1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci1: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci1: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci1: qcom,i2c_custom_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci1: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu", "simple-bus";
+		status = "ok";
+		force_cache_allocs;
+
+		msm_cam_smmu_ife {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x800 0x4E0>,
+				<&apps_smmu 0x820 0x4E0>,
+				<&apps_smmu 0x840 0x4E0>,
+				<&apps_smmu 0x860 0x4E0>,
+				<&apps_smmu 0x880 0x4E0>,
+				<&apps_smmu 0x8A0 0x4E0>,
+				<&apps_smmu 0x8C0 0x4E0>,
+				<&apps_smmu 0x8E0 0x4E0>,
+				<&apps_smmu 0xC00 0x4E0>,
+				<&apps_smmu 0xC20 0x4E0>,
+				<&apps_smmu 0xC40 0x4E0>,
+				<&apps_smmu 0xC60 0x4E0>,
+				<&apps_smmu 0xC80 0x4E0>,
+				<&apps_smmu 0xCA0 0x4E0>,
+				<&apps_smmu 0xCC0 0x4E0>,
+				<&apps_smmu 0xCE0 0x4E0>;
+			cam-smmu-label = "ife";
+			multiple-client-devices;
+			dma-coherent;
+			ife_iova_mem_map: iova-mem-map {
+				/* IO region is approximately 4 GB */
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x100000>;
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_jpeg {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x20C0 0x20>,
+				<&apps_smmu 0x20E0 0x20>;
+			cam-smmu-label = "jpeg";
+			dma-coherent;
+			jpeg_iova_mem_map: iova-mem-map {
+				/* IO region is approximately 3.4 GB */
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x100000>;
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_icp_fw {
+			compatible = "qcom,msm-cam-smmu-fw-dev";
+			label="icp";
+			memory-region = <&camera_mem>;
+		};
+
+		msm_cam_smmu_icp {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x2000 0x20>,
+				<&apps_smmu 0x2020 0x20>,
+				<&apps_smmu 0x2062 0x0>,
+				<&apps_smmu 0x2080 0x20>,
+				<&apps_smmu 0x20A0 0x20>,
+				<&apps_smmu 0x2140 0x0>;
+			cam-smmu-label = "icp";
+			dma-coherent;
+			icp_iova_mem_map: iova-mem-map {
+				iova-mem-region-firmware {
+					/* Firmware region is 5MB */
+					iova-region-name = "firmware";
+					iova-region-start = <0x0>;
+					iova-region-len = <0x500000>;
+					iova-region-id = <0x0>;
+					status = "ok";
+				};
+
+				iova-mem-region-shared {
+					/* Shared region is 150MB long */
+					iova-region-name = "shared";
+					iova-region-start = <0x7400000>;
+					iova-region-len = <0x9600000>;
+					iova-region-id = <0x1>;
+					status = "ok";
+				};
+
+				iova-mem-region-secondary-heap {
+					/* Secondary heap region is 1MB long */
+					iova-region-name = "secheap";
+					iova-region-start = <0x10a00000>;
+					iova-region-len = <0x100000>;
+					iova-region-id = <0x4>;
+					status = "ok";
+				};
+
+				iova-mem-region-io {
+					/* IO region is approximately 3.7 GB */
+					iova-region-name = "io";
+					iova-region-start = <0x10c00000>;
+					iova-region-len = <0xcf300000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+
+				iova-mem-qdss-region {
+					/* QDSS region is appropriate 1MB */
+					iova-region-name = "qdss";
+					iova-region-start = <0x10b00000>;
+					iova-region-len = <0x100000>;
+					iova-region-id = <0x5>;
+					qdss-phy-addr = <0x16790000>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_cpas_cdm {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x2040 0x0>;
+			cam-smmu-label = "cpas-cdm";
+			dma-coherent;
+			cpas_cdm_iova_mem_map: iova-mem-map {
+				iova-mem-region-io {
+					/* IO region is approximately 3.4 GB */
+					iova-region-name = "io";
+					iova-region-start = <0x100000>;
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_lrme {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x2100 0x20>,
+				<&apps_smmu 0x2120 0x20>;
+			cam-smmu-label = "lrme";
+			dma-coherent;
+			lrme_iova_mem_map: iova-mem-map {
+				iova-mem-region-shared {
+					/* Shared region is 100MB long */
+					iova-region-name = "shared";
+					iova-region-start = <0x7400000>;
+					iova-region-len = <0x6400000>;
+					iova-region-id = <0x1>;
+					status = "ok";
+				};
+				/* IO region is approximately 3.3 GB */
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x100000>;
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_secure {
+			compatible = "qcom,msm-cam-smmu-cb";
+			cam-smmu-label = "cam-secure";
+			qcom,secure-cb;
+		};
+	};
+
+	qcom,cam-cdm-intf {
+		compatible = "qcom,cam-cdm-intf";
+		cell-index = <0>;
+		label = "cam-cdm-intf";
+		num-hw-cdm = <1>;
+		cdm-client-names = "vfe",
+			"jpegdma",
+			"jpegenc",
+			"lrmecdm";
+		status = "ok";
+	};
+
+	qcom,cpas-cdm0 {
+		cell-index = <0>;
+		compatible = "qcom,cam170-cpas-cdm0";
+		label = "cpas-cdm";
+		reg = <0x0 0xac48000 0x0 0x1000>;
+		reg-names = "cpas-cdm";
+		reg-cam-base = <0x48000>;
+		interrupts = <GIC_SPI 461 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "cpas-cdm";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_slow_ahb_clk_src";
+		clock-rates = <80000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table>;
+		clock-cntl-level = "svs";
+		cdm-client-names = "ife0", "ife1", "ife2",
+				   "ife3", "ife4", "dualife";
+		status = "ok";
+		cdm_cpas_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-80000000 {
+				opp-hz = /bits/ 64 <80000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,cam-isp {
+		compatible = "qcom,cam-isp";
+		arch-compat = "ife";
+		status = "ok";
+	};
+
+	cam_csid0: qcom,csid0 {
+		cell-index = <0>;
+		compatible = "qcom,csid165_204";
+		reg-names = "csid";
+		reg = <0x0 0xacb3000 0x0 0x1000>;
+		reg-cam-base = <0xb3000>;
+		interrupt-names = "csid0";
+		interrupts = <GIC_SPI 464 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_0_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_0_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_0_CSID_CLK>,
+			<&camcc CAM_CC_IFE_0_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_AXI_CLK>;
+		clock-rates =
+			<300000000 0 0 380000000 0 0>,
+			<400000000 0 0 510000000 0 0>,
+			<400000000 0 0 637000000 0 0>,
+			<400000000 0 0 760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+
+		operating-points-v2 = <&csid0_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe0: qcom,vfe0 {
+		cell-index = <0>;
+		compatible = "qcom,vfe165_160";
+		reg-names = "ife";
+		reg = <0x0 0xacaf000 0x0 0x5200>;
+		reg-cam-base = <0xaf000>;
+		interrupt-names = "ife0";
+		interrupts = <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_0_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_AXI_CLK>;
+		clock-rates =
+			<380000000 0 0>,
+			<510000000 0 0>,
+			<637000000 0 0>,
+			<760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+
+		operating-points-v2 = <&vfe0_opp_table>;
+		clock-control-debugfs = "true";
+		clock-names-option =  "ife_dsp_clk";
+		clocks-option = <&camcc CAM_CC_IFE_0_DSP_CLK>;
+		clock-rates-option = <760000000>;
+		cam_hw_pid = <24 8>;
+		status = "ok";
+		vfe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid1: qcom,csid1 {
+		cell-index = <1>;
+		compatible = "qcom,csid165_204";
+		reg-names = "csid";
+		reg = <0x0 0xacba000 0x0 0x1000>;
+		reg-cam-base = <0xba000>;
+		interrupt-names = "csid1";
+		interrupts = <GIC_SPI 466 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_1_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_1_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_1_CSID_CLK>,
+			<&camcc CAM_CC_IFE_1_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_AXI_CLK>;
+		clock-rates =
+			<300000000 0 0 380000000 0 0>,
+			<400000000 0 0 510000000 0 0>,
+			<400000000 0 0 637000000 0 0>,
+			<400000000 0 0 760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+
+		operating-points-v2 = <&csid1_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe1: qcom,vfe1 {
+		cell-index = <1>;
+		compatible = "qcom,vfe165_160";
+		reg-names = "ife";
+		reg = <0x0 0xacb6000 0x0 0x5200>;
+		reg-cam-base = <0xb6000>;
+		interrupt-names = "ife1";
+		interrupts = <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_1_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_AXI_CLK>;
+		clock-rates =
+			<380000000 0 0>,
+			<510000000 0 0>,
+			<637000000 0 0>,
+			<760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		operating-points-v2 = <&vfe1_opp_table>;
+
+		clock-control-debugfs = "true";
+		clock-names-option =  "ife_dsp_clk";
+		clocks-option = <&camcc CAM_CC_IFE_1_DSP_CLK>;
+		clock-rates-option = <760000000>;
+		cam_hw_pid = <25 9>;
+		status = "ok";
+		vfe1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid2: qcom,csid2 {
+		cell-index = <2>;
+		compatible = "qcom,csid165_204";
+		reg-names = "csid";
+		reg = <0x0 0x0acc1000 0x0 0x1000>;
+		reg-cam-base = <0xc1000>;
+		interrupt-names = "csid2";
+		interrupts = <GIC_SPI 640 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_2_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_2_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_2_CSID_CLK>,
+			<&camcc CAM_CC_IFE_2_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_2_CLK_SRC>,
+			<&camcc CAM_CC_IFE_2_CLK>,
+			<&camcc CAM_CC_IFE_2_AXI_CLK>;
+		clock-rates =
+			<300000000 0 0 380000000 0 0>,
+			<400000000 0 0 510000000 0 0>,
+			<400000000 0 0 637000000 0 0>,
+			<400000000 0 0 760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+		operating-points-v2 = <&csid2_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe2: qcom,vfe2 {
+		cell-index = <2>;
+		compatible = "qcom,vfe165_160";
+		reg-names = "ife";
+		reg = <0x0 0x0acbd000 0x0 0x5200>;
+		reg-cam-base = <0xbd000>;
+		interrupt-names = "ife2";
+		interrupts = <GIC_SPI 641 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_2_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_2_CLK_SRC>,
+			<&camcc CAM_CC_IFE_2_CLK>,
+			<&camcc CAM_CC_IFE_2_AXI_CLK>;
+		clock-rates =
+			<380000000 0 0>,
+			<510000000 0 0>,
+			<637000000 0 0>,
+			<760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		operating-points-v2 = <&vfe2_opp_table>;
+
+		clock-control-debugfs = "true";
+		clock-names-option =  "ife_dsp_clk";
+		clocks-option = <&camcc CAM_CC_IFE_2_DSP_CLK>;
+		clock-rates-option = <760000000>;
+		cam_hw_pid = <3 10>;
+		status = "ok";
+		vfe2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite0: qcom,csid-lite0 {
+		cell-index = <3>;
+		compatible = "qcom,csid-lite165";
+		reg-names = "csid-lite";
+		reg = <0x0 0xacc8000 0x0 0x1000>;
+		reg-cam-base = <0xc8000>;
+		interrupt-names = "csid-lite0";
+		interrupts = <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_LITE_0_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_0_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_0_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_0_CLK>;
+		clock-rates =
+			<300000000 0 0 320000000 0>,
+			<400000000 0 0 400000000 0>,
+			<400000000 0 0 480000000 0>,
+			<400000000 0 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+		operating-points-v2 = <&csid_lite0_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite0: qcom,vfe-lite0 {
+		cell-index = <3>;
+		compatible = "qcom,vfe-lite165";
+		reg-names = "ife-lite";
+		reg = <0x0 0xacc4000 0x0 0x5000>;
+		reg-cam-base = <0xc4000>;
+		interrupt-names = "ife-lite0";
+		interrupts = <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_LITE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_0_CLK>;
+		clock-rates =
+			<320000000 0>,
+			<400000000 0>,
+			<480000000 0>,
+			<600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		operating-points-v2 = <&vfe_lite0_opp_table>;
+
+		clock-control-debugfs = "true";
+		cam_hw_pid = <11>;
+		status = "ok";
+		vfe_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite1: qcom,csid-lite1 {
+		cell-index = <4>;
+		compatible = "qcom,csid-lite165";
+		reg-names = "csid-lite";
+		reg = <0x0 0x0accf000 0x0 0x1000>;
+		reg-cam-base = <0xcf000>;
+		interrupt-names = "csid-lite1";
+		interrupts = <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_LITE_1_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_1_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_1_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_1_CLK>;
+		clock-rates =
+			<300000000 0 0 320000000 0>,
+			<400000000 0 0 400000000 0>,
+			<400000000 0 0 480000000 0>,
+			<400000000 0 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+		operating-points-v2 = <&csid_lite1_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite1: qcom,vfe-lite1 {
+		cell-index = <4>;
+		compatible = "qcom,vfe-lite165";
+		reg-names = "ife-lite";
+		reg = <0x0 0x0accb000 0x0 0x5000>;
+		reg-cam-base = <0xcb000>;
+		interrupt-names = "ife-lite1";
+		interrupts = <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_LITE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_1_CLK>;
+		clock-rates =
+			<320000000 0>,
+			<400000000 0>,
+			<480000000 0>,
+			<600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		operating-points-v2 = <&vfe_lite1_opp_table>;
+
+		clock-control-debugfs = "true";
+		cam_hw_pid = <12>;
+		status = "ok";
+		vfe_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-icp {
+		compatible = "qcom,cam-icp";
+		compat-hw-name = "qcom,a5",
+			"qcom,ipe0",
+			"qcom,bps";
+		num-a5 = <1>;
+		num-ipe = <1>;
+		num-bps = <1>;
+		icp_pc_en;
+		status = "ok";
+	};
+
+	cam_a5: qcom,a5 {
+		cell-index = <0>;
+		compatible = "qcom,cam-a5";
+		reg = <0x0 0xac00000 0x0 0x6000>,
+			<0x0 0xac10000 0x0 0x8000>,
+			<0x0 0xac18000 0x0 0x3000>;
+		reg-names = "a5_qgic", "a5_sierra", "a5_csr";
+		reg-cam-base = <0x00000 0x10000 0x18000>;
+		interrupts = <GIC_SPI 463 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a5";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"soc_fast_ahb",
+			"icp_ahb_clk",
+			"icp_clk_src",
+			"icp_clk";
+		src-clock-name = "soc_fast_ahb";
+		clocks =
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_ICP_AHB_CLK>,
+			<&camcc CAM_CC_ICP_CLK_SRC>,
+			<&camcc CAM_CC_ICP_CLK>;
+		clock-rates =
+			<100000000 0 400000000 0>,
+			<200000000 0 400000000 0>,
+			<300000000 0 600000000 0>,
+			<400000000 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1",
+					"nominal";
+		operating-points-v2 = <&a5_opp_table>;
+
+		fw_name = "CAMERA_ICP_170.elf";
+		ubwc-ipe-fetch-cfg = <0x7073 0x707b>;
+		ubwc-ipe-write-cfg = <0x161cf 0x161ef>;
+		ubwc-bps-fetch-cfg = <0x7073 0x707b>;
+		ubwc-bps-write-cfg = <0x161cf 0x161ef>;
+		qos-val = <0x00000A0A>;
+		status = "ok";
+		a5_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-100000000 {
+				opp-hz = /bits/ 64 <100000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-200000000 {
+				opp-hz = /bits/ 64 <200000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_ipe0: qcom,ipe0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-ipe";
+		reg = <0x0 0xac87000 0x0 0xa000>;
+		reg-names = "ipe0_top";
+		reg-cam-base = <0x87000>;
+		power-domains = <&camcc CAM_CC_IPE_0_GDSC>;
+		clock-names =
+			"ipe_0_ahb_clk",
+			"ipe_0_areg_clk",
+			"ipe_0_axi_clk",
+			"ipe_0_clk_src",
+			"ipe_0_clk";
+		src-clock-name = "ipe_0_clk_src";
+		clock-control-debugfs = "true";
+		clocks =
+			<&camcc CAM_CC_IPE_0_AHB_CLK>,
+			<&camcc CAM_CC_IPE_0_AREG_CLK>,
+			<&camcc CAM_CC_IPE_0_AXI_CLK>,
+			<&camcc CAM_CC_IPE_0_CLK_SRC>,
+			<&camcc CAM_CC_IPE_0_CLK>;
+
+		clock-rates =
+			<0 0 0 300000000 0>,
+			<0 0 0 430000000 0>,
+			<0 0 0 520000000 0>,
+			<0 0 0 600000000 0>,
+			<0 0 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1",
+				"nominal", "turbo";
+		operating-points-v2 = <&ipe0_opp_table>;
+
+		status = "ok";
+		ipe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-430000000 {
+				opp-hz = /bits/ 64 <430000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-520000000 {
+				opp-hz = /bits/ 64 <520000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_bps: qcom,bps {
+		cell-index = <0>;
+		compatible = "qcom,cam-bps";
+		reg = <0x0 0xac6f000 0x0 0x8000>;
+		reg-names = "bps_top";
+		reg-cam-base = <0x6f000>;
+		power-domains = <&camcc CAM_CC_BPS_GDSC>;
+		clock-names =
+			"bps_ahb_clk",
+			"bps_areg_clk",
+			"bps_axi_clk",
+			"bps_clk_src",
+			"bps_clk";
+		src-clock-name = "bps_clk_src";
+		clock-control-debugfs = "true";
+		clocks =
+			<&camcc CAM_CC_BPS_AHB_CLK>,
+			<&camcc CAM_CC_BPS_AREG_CLK>,
+			<&camcc CAM_CC_BPS_AXI_CLK>,
+			<&camcc CAM_CC_BPS_CLK_SRC>,
+			<&camcc CAM_CC_BPS_CLK>;
+
+		clock-rates =
+			<0 0 0 200000000 0>,
+			<0 0 0 400000000 0>,
+			<0 0 0 480000000 0>,
+			<0 0 0 600000000 0>,
+			<0 0 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1",
+				"nominal", "turbo";
+		operating-points-v2 = <&bps_opp_table>;
+
+		status = "ok";
+		bps_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-200000000 {
+				opp-hz = /bits/ 64 <200000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-jpeg {
+		compatible = "qcom,cam-jpeg";
+		compat-hw-name = "qcom,jpegenc",
+			"qcom,jpegdma";
+		num-jpeg-enc = <1>;
+		num-jpeg-dma = <1>;
+		status = "ok";
+	};
+
+	cam_jpeg_enc: qcom,jpegenc {
+		cell-index = <0>;
+		compatible = "qcom,cam_jpeg_enc_165";
+		reg-names = "jpege_hw", "cam_camnoc";
+		reg = <0x0 0xac4e000 0x0 0x4000>,
+			<0x0 0x0ac9f000 0x0 0x10000>;
+		reg-cam-base = <0x4e000 0x9f000>;
+		interrupt-names = "jpeg";
+		interrupts = <GIC_SPI 474 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"jpegenc_clk_src",
+			"jpegenc_clk";
+		clocks =
+			<&camcc CAM_CC_JPEG_CLK_SRC>,
+			<&camcc CAM_CC_JPEG_CLK>;
+
+		clock-rates = <600000000 0>;
+		src-clock-name = "jpegenc_clk_src";
+		operating-points-v2 = <&jpeg_enc_opp_table>;
+
+		clock-cntl-level = "nominal";
+		cam_hw_pid = <22 23>;
+		cam_hw_rd_mid = <0>;
+		cam_hw_wr_mid = <2>;
+		status = "ok";
+		jpeg_enc_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_jpeg_dma: qcom,jpegdma {
+		cell-index = <0>;
+		compatible = "qcom,cam_jpeg_dma_165";
+		reg-names = "jpegdma_hw", "cam_camnoc";
+		reg = <0x0 0xac52000 0x0 0x4000>,
+			<0x0 0x0ac9f000 0x0 0x10000>;
+		reg-cam-base = <0x52000 0x9f000>;
+		interrupt-names = "jpegdma";
+		interrupts = <GIC_SPI 475 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"jpegdma_clk_src",
+			"jpegdma_clk";
+		clocks =
+			<&camcc CAM_CC_JPEG_CLK_SRC>,
+			<&camcc CAM_CC_JPEG_CLK>;
+
+		clock-rates = <600000000 0>;
+		src-clock-name = "jpegdma_clk_src";
+		operating-points-v2 = <&jpeg_dma_opp_table>;
+
+		clock-cntl-level = "nominal";
+		cam_hw_pid = <20 21>;
+		cam_hw_rd_mid = <0>;
+		cam_hw_wr_mid = <2>;
+		status = "ok";
+		jpeg_dma_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-lrme {
+		compatible = "qcom,cam-lrme";
+		arch-compat = "lrme";
+		status = "ok";
+	};
+
+	cam_lrme: qcom,lrme {
+		cell-index = <0>;
+		compatible = "qcom,lrme";
+		reg-names = "lrme";
+		reg = <0x0 0xac6b000 0x0 0x1000>;
+		reg-cam-base = <0x6b000>;
+		interrupt-names = "lrme";
+		interrupts = <GIC_SPI 476 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "lrme_clk_src",
+			"lrme_clk";
+		clocks = <&camcc CAM_CC_LRME_CLK_SRC>,
+			<&camcc CAM_CC_LRME_CLK>;
+		clock-rates = <240000000 0>,
+			<300000000 0>,
+			<320000000 0>,
+			<400000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "nominal";
+		src-clock-name = "lrme_clk_src";
+		operating-points-v2 = <&lrme_opp_table>;
+
+		status = "ok";
+		lrme_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-240000000 {
+				opp-hz = /bits/ 64 <240000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-cpas {
+		cell-index = <0>;
+		compatible = "qcom,cam-cpas";
+		label = "cpas";
+		arch-compat = "cpas_top";
+		status = "ok";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg-names = "cam_cpas_top", "cam_camnoc";
+		reg = <0x0 0x0ac40000 0x0 0x1000>,
+			<0x0 0x0ac9f000 0x0 0x10000>;
+		reg-cam-base = <0x40000 0x9f000>;
+		cam_hw_fuse = <CAM_CPAS_ISP_FUSE 0x7801FC 0x10 CAM_CPAS_FEATURE_TYPE_DISABLE 0x4>,
+			      <CAM_CPAS_ISP_LITE_FUSE 0x7801FC 0x20 CAM_CPAS_FEATURE_TYPE_DISABLE 0x10>,
+			      <CAM_CPAS_SHDR_FUSE 0x7801FC 0x40 CAM_CPAS_FEATURE_TYPE_DISABLE 0xFF>,
+			      <CAM_CPAS_QCFA_BINNING_ENABLE 0x7801FC 0x80 CAM_CPAS_FEATURE_TYPE_DISABLE 0xFF>,
+			      <CAM_CPAS_CSIPHY_FUSE 0x7801FC 0x100 CAM_CPAS_FEATURE_TYPE_DISABLE 0x10>,
+			      <CAM_CPAS_RT_OT_FUSE 0x7801A4 0x10000000 CAM_CPAS_FEATURE_TYPE_DISABLE 0xFF>;
+		interrupt-names = "cpas_camnoc";
+		interrupts = <GIC_SPI 459 IRQ_TYPE_EDGE_RISING>;
+		camnoc-axi-min-ib-bw = <3000000000>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"gcc_camera_hf_axi_clk",
+			"gcc_camera_sf_axi_clk",
+			"cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk",
+			"cam_cc_camnoc_axi_clk_src",
+			"cam_cc_camnoc_axi_clk",
+			"cam_cc_icp_ahb_clk",
+			"cam_cc_icp_clk";
+		clocks =
+			<&gcc GCC_CAMERA_HF_AXI_CLK>,
+			<&gcc GCC_CAMERA_SF_AXI_CLK>,
+			<&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK_SRC>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&camcc CAM_CC_ICP_AHB_CLK>,
+			<&camcc CAM_CC_ICP_CLK>;
+		src-clock-name = "cam_cc_camnoc_axi_clk_src";
+		clock-rates =
+			<0 0 0 0 0 0 0 0>,
+			<0 0 80000000 0 150000000 0 0 0>,
+			<0 0 80000000 0 240000000 0 0 0>,
+			<0 0 80000000 0 320000000 0 0 0>,
+			<0 0 80000000 0 400000000 0 0 0>,
+			<0 0 80000000 0 480000000 0 0 0>;
+		clock-cntl-level = "suspend", "lowsvs", "svs",
+			"svs_l1", "nominal", "turbo";
+		operating-points-v2 = <&cpas_opp_table>;
+		control-camnoc-axi-clk;
+		camnoc-bus-width = <32>;
+		camnoc-axi-clk-bw-margin-perc = <20>;
+		interconnect-names = "cam_ahb", "cam_hf_0", "cam_sf_0", "cam_sf_icp";
+		interconnects =<&gem_noc MASTER_APPSS_PROC 0
+			&cnoc2 SLAVE_CAMERA_CFG 0>,
+				<&mmss_noc MASTER_CAMNOC_HF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_SF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_ICP 0
+			&mc_virt SLAVE_EBI1 0>;
+
+		cam-ahb-num-cases = <7>;
+		cam-ahb-bw-KBps =
+			<0 0>, <0 76800>, <0 150000>, <0 150000>,
+			<0 300000>, <0 300000>, <0 300000>;
+		vdd-corners = <RPMH_REGULATOR_LEVEL_RETENTION
+			RPMH_REGULATOR_LEVEL_MIN_SVS
+			RPMH_REGULATOR_LEVEL_LOW_SVS
+			RPMH_REGULATOR_LEVEL_SVS
+			RPMH_REGULATOR_LEVEL_SVS_L1
+			RPMH_REGULATOR_LEVEL_NOM
+			RPMH_REGULATOR_LEVEL_NOM_L1
+			RPMH_REGULATOR_LEVEL_NOM_L2
+			RPMH_REGULATOR_LEVEL_TURBO
+			RPMH_REGULATOR_LEVEL_TURBO_L1>;
+		vdd-corner-ahb-mapping = "suspend",
+			"lowsvs", "lowsvs", "svs", "svs_l1",
+			"nominal", "nominal", "nominal",
+			"turbo", "turbo";
+		client-id-based;
+		client-names =
+			"csiphy0", "csiphy1", "csiphy2", "csiphy3",
+			"csiphy4", "cci0", "cci1",
+			"csid0", "csid1", "csid2", "csid3", "csid4",
+			"ife0", "ife1", "ife2", "ife3", "ife4",
+			"ipe0", "cam-cdm-intf0", "cpas-cdm0",
+			"bps0", "icp0", "jpeg-dma0", "jpeg-enc0",
+			"lrmecpas0";
+
+		cpas_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-150000000 {
+				opp-hz = /bits/ 64 <150000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-240000000 {
+				opp-hz = /bits/ 64 <240000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_turbo>;
+			};
+		};
+		camera-bus-nodes {
+			level0-nodes {
+				level-index = <0>;
+				ife0_rdi_wr: ife0-rdi-wr {
+					cell-index = <16>;
+					node-name = "ife0-rdi-wr";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife1_rdi_wr: ife1-rdi-wr {
+					cell-index = <17>;
+					node-name = "ife1-rdi-wr";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife2_rdi_wr: ife2-rdi-wr {
+					cell-index = <18>;
+					node-name = "ife2-rdi-wr";
+					client-name = "ife2";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife3_rdi_wr: ife3-rdi-wr {
+					cell-index = <19>;
+					node-name = "ife3-rdi-wr";
+					client-name = "ife3";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife4_rdi_wr: ife4-rdi-wr {
+					cell-index = <20>;
+					node-name = "ife4-rdi-wr";
+					client-name = "ife4";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife0_pixelall_wr: ife0-pixelall-wr {
+					cell-index = <21>;
+					node-name = "ife0-pixelall-wr";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_PIXEL_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_DISP
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt1_write0>;
+				};
+
+				ife1_pixelall_wr: ife1-pixelall-wr {
+					cell-index = <22>;
+					node-name = "ife1-pixelall-wr";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_PIXEL_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_DISP
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt1_write0>;
+				};
+
+				ife2_pixelall_wr: ife2-pixelall-wr {
+					cell-index = <23>;
+					node-name = "ife2-pixelall-wr";
+					client-name = "ife2";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_PIXEL_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_DISP
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt1_write1>;
+				};
+
+				ipe0_ref_wr: ipe0-ref-wr {
+					cell-index = <24>;
+					node-name = "ipe0-ref-wr";
+					client-name = "ipe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IPE_WR_REF>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt0_write0>;
+				};
+
+				bps0_all_wr: bps0-all-wr {
+					cell-index = <25>;
+					node-name = "bps0-all-wr";
+					client-name = "bps0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt0_write0>;
+				};
+
+				lrme0_all_wr: lrme0-all-wr {
+					cell-index = <26>;
+					node-name = "lrme0-all-wr";
+					client-name = "lrmecpas0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt0_write0>;
+				};
+
+				ipe0_viddisp_wr: ipe0-viddisp-wr {
+					cell-index = <27>;
+					node-name = "ipe0-viddisp-wr";
+					client-name = "ipe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IPE_WR_VID_DISP>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_WR_VID
+					CAM_CPAS_PATH_DATA_IPE_WR_DISP>;
+					parent-node = <&level1_nrt0_write0>;
+				};
+
+				ipe0_all_rd: ipe0-all-rd {
+					cell-index = <28>;
+					node-name = "ipe0-all-rd";
+					client-name = "ipe0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_RD_IN
+					CAM_CPAS_PATH_DATA_IPE_RD_REF>;
+					parent-node = <&level1_nrt0_read0>;
+				};
+
+				bps0_all_rd: bps0-all-rd {
+					cell-index = <29>;
+					node-name = "bps0-all-rd";
+					client-name = "bps0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt0_read0>;
+				};
+
+				lrme0_all_rd: lrme0-all-rd {
+					cell-index = <30>;
+					node-name = "lrme0-all-rd";
+					client-name = "lrmecpas0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt0_read0>;
+				};
+
+				jpeg_enc0_all_wr: jpeg-enc0-all-wr {
+					cell-index = <31>;
+					node-name = "jpeg-enc0-all-wr";
+					client-name = "jpeg-enc0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt1_write0>;
+				};
+
+				jpeg_enc0_all_rd: jpeg-enc0-all-rd {
+					cell-index = <32>;
+					node-name = "jpeg-enc0-all-rd";
+					client-name = "jpeg-enc0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt1_read0>;
+				};
+
+				jpeg_dma0_all_wr: jpeg-dma0-all-wr {
+					cell-index = <33>;
+					node-name = "jpeg-dma0-all-wr";
+					client-name = "jpeg-dma0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt1_write0>;
+				};
+
+				jpeg_dma0_all_rd: jpeg-dma0-all-rd {
+					cell-index = <34>;
+					node-name = "jpeg-dma0-all-rd";
+					client-name = "jpeg-dma0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt1_read0>;
+				};
+
+				cpas_cdm0_all_rd: cpas-cdm0-all-rd {
+					cell-index = <35>;
+					node-name = "cpas-cdm0-all-rd";
+					client-name = "cpas-cdm0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level2_nrt0_read0>;
+				};
+
+				icp0_all_rd: icp0-all-rd {
+					cell-index = <36>;
+					node-name = "icp0-all-rd";
+					client-name = "icp0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level2_nrt1_read0>;
+				};
+			};
+			level1-nodes {
+				level-index = <1>;
+				camnoc-max-needed;
+				level1_rt0_write0: level1-rt0-write0 {
+					cell-index = <8>;
+					node-name = "level1-rt0-write0";
+					parent-node = <&level2_rt0_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt1_write0: level1-rt1-write0 {
+					cell-index = <9>;
+					node-name = "level1-rt1-write0";
+					parent-node = <&level2_rt1_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt1_write1: level1-rt1-write1 {
+					cell-index = <10>;
+					node-name = "level1-rt1-write1";
+					parent-node = <&level2_rt1_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt0_write0: level1-nrt0-write0 {
+					cell-index = <11>;
+					node-name = "level1-nrt0-write0";
+					parent-node = <&level2_nrt0_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt0_read0: level1-nrt0-read0 {
+					cell-index = <12>;
+					node-name = "level1-nrt0-read0";
+					parent-node = <&level2_nrt0_read0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt1_write0: level1-nrt1-write0 {
+					cell-index = <13>;
+					node-name = "level1-nrt1-write0";
+					parent-node = <&level2_nrt0_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt1_read0: level1-nrt1-read0 {
+					cell-index = <14>;
+					node-name = "level1-nrt1-read0";
+					parent-node = <&level2_nrt0_read0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+			};
+			level2-nodes {
+				level-index = <3>;
+				camnoc-max-needed;
+				level2_rt0_write0: level2-rt0-write0 {
+					cell-index = <3>;
+					node-name = "level2-rt0-write0";
+					parent-node = <&level3_rt0_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM_INTERLEAVE>;
+				};
+
+				level2_rt1_write0: level2-rt1-write0 {
+					cell-index = <4>;
+					node-name = "level2-rt1-write0";
+					parent-node = <&level3_rt0_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM_INTERLEAVE>;
+				};
+
+				level2_nrt0_write0: level2-nrt0-write0 {
+					cell-index = <5>;
+					node-name = "level2-nrt0-write0";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt0_read0: level2-nrt0-read0 {
+					cell-index = <6>;
+					node-name = "level2-nrt0-read0";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt1_read0: level2-nrt1-read0 {
+					cell-index = <7>;
+					node-name = "level2-nrt1-read0";
+					parent-node = <&level3_nrt1_rd_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					bus-width-factor = <4>;
+				};
+			};
+			level3-nodes {
+				level-index = <3>;
+				level3_rt0_wr_sum: level3-rt0-wr-sum {
+					cell-index = <0>;
+					node-name = "level3-rt0-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					ib-bw-voting-needed;
+					qcom,axi-port-mnoc {
+						interconnect-names = "cam_hf_0";
+						interconnects =
+						<&mmss_noc MASTER_CAMNOC_HF 0
+						&mc_virt SLAVE_EBI1 0>;
+					};
+				};
+
+				level3_nrt0_rd_wr_sum: level3-nrt0-rd-wr-sum {
+					cell-index = <1>;
+					node-name = "level3-nrt0-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						interconnect-names = "cam_sf_0";
+						interconnects =
+						<&mmss_noc MASTER_CAMNOC_SF 0
+						&mc_virt SLAVE_EBI1 0>;
+					};
+				};
+
+				level3_nrt1_rd_sum: level3-nrt1-rd-sum {
+					cell-index = <2>;
+					node-name = "level3-nrt1-rd-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						interconnect-names = "cam_sf_icp";
+						interconnects =
+						<&mmss_noc MASTER_CAMNOC_ICP 0
+						&mc_virt SLAVE_EBI1 0>;
+					};
+				};
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-camera-rb3.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-camera-rb3.dtso
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,gcc-sc7280.h>
+#include <dt-bindings/clock/qcom,camcc-sc7280.h>
+#include <dt-bindings/interconnect/qcom,sc7280.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+
+#include "qcm6490-camera-rb3.dtsi"
+#include "qcm6490-camera-sensor-rb3.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-camera-sensor-idp.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-camera-sensor-idp.dtsi
@@ -0,0 +1,506 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&soc {
+
+	led_flash_triple_rear: qcom,camera-flash@4 {
+		cell-index = <4>;
+		compatible = "qcom,camera-flash";
+		status = "disabled";
+	};
+
+	led_flash_triple_rear_aux: qcom,camera-flash@5 {
+		cell-index = <5>;
+		compatible = "qcom,camera-flash";
+		status = "disabled";
+	};
+
+	led_flash_triple_rear_aux2: qcom,camera-flash@6 {
+		cell-index = <6>;
+		compatible = "qcom,camera-flash";
+		status = "disabled";
+	};
+
+	qcom,cam-res-mgr {
+		compatible = "qcom,cam-res-mgr";
+		status = "ok";
+	};
+};
+
+&cam_cci0 {
+
+	actuator_triple_wide: qcom,actuator0 {
+		cell-index = <4>;
+		compatible = "qcom,actuator";
+		cci-master = <0>;
+		cam_vaf-supply = <&L7I>;
+		regulator-names = "cam_vaf";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <2960000>;
+		rgltr-max-voltage = <3000000>;
+		rgltr-load-current = <103000>;
+	};
+
+	actuator_triple_tele: qcom,actuator1 {
+		cell-index = <5>;
+		compatible = "qcom,actuator";
+		cci-master = <1>;
+		cam_vaf-supply = <&L7I>;
+		regulator-names = "cam_vaf";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <2960000>;
+		rgltr-max-voltage = <3000000>;
+		rgltr-load-current = <103000>;
+	};
+
+	eeprom_triple_wide: qcom,eeprom0 {
+		cell-index = <4>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L3I>;
+		cam_vana1-supply = <&L5I>;
+		cam_vdig-supply = <&L1I>;
+		cam_vaf-supply = <&L7I>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vana1",
+			"cam_vdig", "cam_vaf";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2904000 1800000 1104000 2960000>;
+		rgltr-max-voltage = <1800000 3000000 1900000 1200000 3000000>;
+		rgltr-load-current = <5000 68000 74000 805000 103000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_active_rst0>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_suspend_rst0>;
+		gpios = <&tlmm 64 0>,
+			<&tlmm 20 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0";
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK0_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	eeprom_triple_tele: qcom,eeprom1 {
+		cell-index = <5>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L4I>;
+		cam_vdig-supply = <&L2I>;
+		cam_vaf-supply = <&L7I>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vdig",
+			"cam_vaf";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2800000 1056000 2960000>;
+		rgltr-max-voltage = <1800000 2900000 1150000 3000000>;
+		rgltr-load-current = <10000 52000 140000 103000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_active_rst1>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_suspend_rst1>;
+		gpios = <&tlmm 65 0>,
+			<&tlmm 21 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK1",
+					"CAM_RESET1";
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/* Rear (W) */
+	qcom,cam-sensor0 {
+		cell-index = <4>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <0>;
+		sensor-position-roll = <90>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		actuator-src = <&actuator_triple_wide>;
+		eeprom-src = <&eeprom_triple_wide>;
+		led-flash-src = <&led_flash_triple_rear>;
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L3I>;
+		cam_vaf-supply = <&L7I>;
+		cam_v_custom1-supply = <&L5I>;
+		cam_vdig-supply = <&L1I>;
+		cam_bob-supply = <&vreg_bob_3p296>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vaf", "cam_v_custom1",
+			"cam_vdig", "cam_bob";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2904000 2960000 1800000 1104000 3296000>;
+		rgltr-max-voltage = <1800000 3000000 3000000 1900000 1200000 3960000>;
+		rgltr-load-current = <5000 68000 103000 74000 805000 2000000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_active_rst0>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_suspend_rst0>;
+		gpios = <&tlmm 64 0>,
+			<&tlmm 20 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0";
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK0_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/* Rear-aux (T) */
+	qcom,cam-sensor1 {
+		cell-index = <5>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <90>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		eeprom-src = <&eeprom_triple_tele>;
+		actuator-src = <&actuator_triple_tele>;
+		led-flash-src = <&led_flash_triple_rear_aux>;
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L4I>;
+		cam_vaf-supply = <&L7I>;
+		cam_vdig-supply = <&L2I>;
+		cam_bob-supply = <&vreg_bob_3p296>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vaf", "cam_vdig",
+			"cam_bob";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2800000 2960000 1056000 3296000>;
+		rgltr-max-voltage = <1800000 2900000 3000000 1150000 3960000>;
+		rgltr-load-current = <10000 52000 103000 140000 2000000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				&cam_sensor_active_rst1>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				&cam_sensor_suspend_rst1>;
+		gpios = <&tlmm 65 0>,
+			<&tlmm 21 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK1",
+					"CAM_RESET1";
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	eeprom_tof: qcom,eeprom4 {
+		cell-index = <7>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L3I>;
+		regulator-names = "cam_vio", "cam_vana";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2904000>;
+		rgltr-max-voltage = <1800000 3000000>;
+		rgltr-load-current = <2000 20000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				&cam_sensor_active_rst1>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				&cam_sensor_suspend_rst1>;
+		gpios = <&tlmm 65 0>,
+			<&tlmm 21 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK1",
+					"CAM_RESET1";
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "turbo";
+		clock-rates = <24000000>;
+	};
+
+	/* TOF */
+	qcom,cam-sensor5 {
+		cell-index = <7>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <270>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		eeprom-src = <&eeprom_tof>;
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L3I>;
+		regulator-names = "cam_vio", "cam_vana";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2904000>;
+		rgltr-max-voltage = <1800000 3000000>;
+		rgltr-load-current = <2000 20000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				&cam_sensor_active_rst1>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				&cam_sensor_suspend_rst1>;
+		gpios = <&tlmm 65 0>,
+			<&tlmm 21 0>,
+			<&tlmm 0 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK1",
+					"CAM_RESET1",
+					"CUSTOM_GPIO1";
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "turbo";
+		clock-rates = <24000000>;
+	};
+};
+
+&cam_cci1 {
+	actuator_triple_uw: qcom,actuator2 {
+		cell-index = <6>;
+		compatible = "qcom,actuator";
+		cci-master = <0>;
+		cam_vaf-supply = <&L7I>;
+		regulator-names = "cam_vaf";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <2960000>;
+		rgltr-max-voltage = <3000000>;
+		rgltr-load-current = <103000>;
+	};
+
+	eeprom_triple_uw: qcom,eeprom2 {
+		cell-index = <6>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L6I>;
+		cam_vdig-supply = <&L2I>;
+		cam_vaf-supply = <&L7I>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vdig",
+			"cam_vaf";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2800000 1056000 2960000>;
+		rgltr-max-voltage = <1800000 2900000 1150000 3000000>;
+		rgltr-load-current = <3000 52000 257000 103000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_active_rst2>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_suspend_rst2>;
+		gpios = <&tlmm 66 0>,
+			<&tlmm 77 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2";
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	eeprom_front: qcom,eeprom3 {
+		cell-index = <2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L5J>;
+		cam_vdig-supply = <&L1J>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vdig";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2800000 1056000>;
+		rgltr-max-voltage = <1800000 2900000 1150000>;
+		rgltr-load-current = <5000 35000 301000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active
+				 &cam_sensor_active_rst3>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend
+				 &cam_sensor_suspend_rst3>;
+		gpios = <&tlmm 67 0>,
+			<&tlmm 78 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK3",
+					"CAM_RESET3";
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK3_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/* Rear-aux (UW) */
+	qcom,cam-sensor2 {
+		cell-index = <6>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <2>;
+		sensor-position-roll = <90>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		eeprom-src = <&eeprom_triple_uw>;
+		actuator-src = <&actuator_triple_uw>;
+		led-flash-src = <&led_flash_triple_rear_aux2>;
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L6I>;
+		cam_vaf-supply = <&L7I>;
+		cam_vdig-supply = <&L2I>;
+		cam_bob-supply = <&vreg_bob_3p296>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vaf", "cam_vdig",
+			"cam_bob";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2800000 2960000 1056000 3296000>;
+		rgltr-max-voltage = <1800000 2900000 3000000 1150000 3960000>;
+		rgltr-load-current = <3000 52000 103000 257000 2000000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_active_rst2>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_suspend_rst2>;
+		gpios = <&tlmm 66 0>,
+			<&tlmm 77 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2";
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/* Front */
+	qcom,cam-sensor3 {
+		cell-index = <2>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <3>;
+		sensor-position-roll = <270>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <0>;
+		eeprom-src = <&eeprom_front>;
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L5J>;
+		cam_vdig-supply = <&L1J>;
+		cam_bob-supply = <&vreg_bob_3p296>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vdig",
+			"cam_bob";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2800000 1056000 3296000>;
+		rgltr-max-voltage = <1800000 2900000 1150000 3960000>;
+		rgltr-load-current = <5000 35000 301000 2000000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active
+				 &cam_sensor_active_rst3>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend
+				 &cam_sensor_suspend_rst3>;
+		gpios = <&tlmm 67 0>,
+			<&tlmm 78 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK3",
+					"CAM_RESET3";
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK3_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/* Rear */
+	qcom,cam-sensor4 {
+		cell-index = <1>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <270>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		eeprom-src = <&eeprom_triple_uw>;
+		actuator-src = <&actuator_triple_uw>;
+		cam_vio-supply = <&L3J>;
+		cam_vana-supply = <&L6I>;
+		cam_vdig-supply = <&L2I>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vdig";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000 2800000 1056000>;
+		rgltr-max-voltage = <1800000 2900000 1150000>;
+		rgltr-load-current = <3000 52000 257000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend", "cam_mux";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				&cam_sensor_active_rst2
+				&cam_sensor_active_mux>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				&cam_sensor_suspend_rst2
+				&cam_sensor_suspend_mux>;
+		gpios = <&tlmm 66 0>,
+			<&tlmm 77 0>,
+			<&tlmm 1 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_MUX";
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "turbo";
+		clock-rates = <24000000>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-camera-sensor-rb3.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-camera-sensor-rb3.dtsi
@@ -0,0 +1,547 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&soc {
+	qcom,cam-res-mgr {
+		compatible = "qcom,cam-res-mgr";
+		status = "ok";
+		gpios-shared-pinctrl = <640>;
+		shared-pctrl-gpio-names = "gmsl";
+		pinctrl-names = "gmsl_active", "gmsl_suspend";
+		pinctrl-0 = <&cam_sensor_active_gmsl>;
+		pinctrl-1 = <&cam_sensor_suspend_gmsl>;
+	};
+};
+&tlmm {
+	cam_sensor_active_rst5: cam_sensor_active_rst5 {
+		/* RESET 5 */
+		mux {
+			pins = "gpio115";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio115";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst5: cam_sensor_suspend_rst5 {
+		/* RESET 5 */
+		mux {
+			pins = "gpio115";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio115";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_gmsl: cam_sensor_active_gmsl {
+		/* GMSL_ENABLE */
+		mux {
+			pins = "gpio93";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio93";
+			bias-pull-up;
+			drive-strength = <2>; /* 2 MA */
+			output-high;
+		};
+	};
+
+	cam_sensor_suspend_gmsl: cam_sensor_suspend_gmsl {
+		/* GMSL_ENABLE */
+		mux {
+			pins = "gpio93";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio93";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+};
+
+&cam_cci0 {
+	/*cam0a-ov9282*/
+	qcom,cam-sensor1 {
+		cell-index = <1>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <0>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_active_rst0>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_suspend_rst0>;
+		gpios = <&tlmm 64 0>,
+			<&tlmm 20 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0";
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK0_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+    /*cam1-ov9282*/
+	qcom,cam-sensor6 {
+		cell-index = <6>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				&cam_sensor_active_rst1>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				&cam_sensor_suspend_rst1>;
+		gpios = <&tlmm 65 0>,
+			<&tlmm 21 0>,
+			<&pm7250b_gpios 3 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK1",
+					"CAM_RESET1",
+					"CAM_CUSTOM1";
+		sensor-mode = <0>;
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	//cam1 interpose on dk csi0
+	actuator_rear_cam11: qcom,actuator11 {
+		cell-index = <11>;
+		compatible = "qcom,actuator";
+		cci-master = <1>;
+		regulator-names = "cam_vaf";
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <2856000>;
+		rgltr-max-voltage = <3104000>;
+		rgltr-load-current = <100000>;
+	};
+
+	eeprom_rear_cam11: qcom,eeprom11 {
+		cell-index = <11>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio", "cam_clk";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000 0>;
+		rgltr-max-voltage = <1800000 0>;
+		rgltr-load-current = <120000 0>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_active_rst1>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_suspend_rst1>;
+		gpios = <&tlmm 65 0>,
+			<&tlmm 21 0>,
+			<&pm7250b_gpios 3 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK1",
+					"CAM_RESET1",
+					"CAM_CUSTOM1";
+		sensor-mode = <0>;
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/*cam1-imx586/imx686*/
+	qcom,cam-sensor11 {
+		cell-index = <11>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		actuator-src = <&actuator_rear_cam11>;
+		eeprom-src = <&eeprom_rear_cam11>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		regulator-names = "cam_vio", "cam_clk";
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000 0>;
+		rgltr-max-voltage = <1800000 0>;
+		rgltr-load-current = <120000 0>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				&cam_sensor_active_rst1>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				&cam_sensor_suspend_rst1>;
+		gpios = <&tlmm 65 0>,
+			<&tlmm 21 0>,
+			<&pm7250b_gpios 3 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK1",
+					"CAM_RESET1",
+					"CAM_CUSTOM1";
+		sensor-mode = <0>;
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+};
+
+&cam_cci1 {
+	eeprom_cam2: qcom,eeprom0 {
+		cell-index = <8>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_active_rst2>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_suspend_rst2>;
+		gpios = <&tlmm 66 0>,
+			<&tlmm 77 0>,
+			<&pm7250b_gpios 7 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_CUSTOM1";
+		sensor-mode = <0>;
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	eeprom_cam3: qcom,eeprom3 {
+		cell-index = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active
+			&cam_sensor_active_rst3>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend
+			&cam_sensor_suspend_rst3>;
+		gpios = <&tlmm 67 0>,
+			<&tlmm 78 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK3",
+			"CAM_RESET3";
+		sensor-position = <1>;
+		sensor-mode = <0>;
+		cci-master = <1>;
+		qcom,cam-power-seq-type ="cam_reset","cam_vio","cam_clk","cam_reset";
+		qcom,cam-power-seq-val = "cam_reset","cam_vio"
+			,"cam_mclk","cam_reset";
+		qcom,cam-power-seq-cfg-val = <0 1 24000000 1>;
+		qcom,cam-power-seq-delay = <1 0 1 18>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK3_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/*cam3-imx577*/
+	qcom,cam-sensor0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <3>;
+		eeprom-src = <&eeprom_cam3>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active
+				&cam_sensor_active_rst3>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend
+				&cam_sensor_suspend_rst3>;
+		gpios = <&tlmm 67 0>,
+			<&tlmm 78 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK3",
+					"CAM_RESET3";
+		sensor-mode = <0>;
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK3_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/* GMSL 1 */
+	qcom,cam-sensor4 {
+		cell-index = <4>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <4>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		gpios = <&tlmm 93 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_4";
+		sensor-mode = <0>;
+		cci-master = <1>;
+		status = "ok";
+	};
+
+	/* GMSL 2 */
+	qcom,cam-sensor5 {
+		cell-index = <5>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <3>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		gpios = <&tlmm 93 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_5";
+		sensor-mode = <0>;
+		cci-master = <1>;
+		status = "ok";
+	};
+
+	/*cam0b-ov9282*/
+	qcom,cam-sensor7 {
+		cell-index = <7>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <0>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk4_active
+			&cam_sensor_active_rst5>;
+		pinctrl-1 = <&cam_sensor_mclk4_suspend
+			&cam_sensor_suspend_rst5>;
+		gpios = <&tlmm 68 0>,
+			<&tlmm 149 0>;
+		gpio-reset = <1>;
+		gpio-req-tbl-num = <0 1>;
+		gpio-req-tbl-flags = <1 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK4",
+				"CAM_RESET5";
+		sensor-mode = <0>;
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK4_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/*cam2-imx577*/
+	qcom,cam-sensor8 {
+		cell-index = <8>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <2>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		eeprom-src = <&eeprom_cam2>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_active_rst2>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_suspend_rst2>;
+		gpios = <&tlmm 66 0>,
+			<&tlmm 77 0>,
+			<&pm7250b_gpios 7 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_CUSTOM1";
+		sensor-mode = <0>;
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+	};
+
+	/* GMSL 3 */
+	qcom,cam-sensor9 {
+		cell-index = <9>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <4>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		gpios = <&tlmm 93 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_9";
+		sensor-mode = <0>;
+		cci-master = <1>;
+		status = "ok";
+	};
+
+	/* GMSL 4 */
+	qcom,cam-sensor10 {
+		cell-index = <10>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <4>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_l18b_1p8>;
+		regulator-names = "cam_vio";
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		gpios = <&tlmm 93 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_10";
+		sensor-mode = <0>;
+		cci-master = <1>;
+		status = "ok";
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-camera.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-camera.dtsi
@@ -0,0 +1,2520 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&tlmm {
+	cci0_active: cci0_active {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio69","gpio70"; // Only 2
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio69","gpio70";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci0_suspend: cci0_suspend {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio69","gpio70";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio69","gpio70";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci1_active: cci1_active {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio71","gpio72";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio71","gpio72";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci1_suspend: cci1_suspend {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio71","gpio72";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio71","gpio72";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci2_active: cci2_active {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio73","gpio74";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio73","gpio74";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci2_suspend: cci2_suspend {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio73","gpio74";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio73","gpio74";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci3_active: cci3_active {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio75","gpio76";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio75","gpio76";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci3_suspend: cci3_suspend {
+		mux {
+			/* DATA, CLK */
+			pins = "gpio75","gpio76";
+			function = "cci_i2c";
+		};
+
+		config {
+			pins = "gpio75","gpio76";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+
+	};
+
+	cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+		/* MCLK0 */
+		mux {
+			pins = "gpio64";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio64";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk0_suspend: cam_sensor_mclk0_suspend {
+		/* MCLK0 */
+		mux {
+			pins = "gpio64";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio64";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_active: cam_sensor_mclk1_active {
+		/* MCLK1 */
+		mux {
+			pins = "gpio65";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio65";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_suspend: cam_sensor_mclk1_suspend {
+		/* MCLK1 */
+		mux {
+			pins = "gpio65";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio65";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+		/* MCLK2 */
+		mux {
+			pins = "gpio66";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio66";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_suspend: cam_sensor_mclk2_suspend {
+		/* MCLK2 */
+		mux {
+			pins = "gpio66";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio66";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk3_active: cam_sensor_mclk3_active {
+		/* MCLK3 */
+		mux {
+			pins = "gpio67";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk3_suspend: cam_sensor_mclk3_suspend {
+		/* MCLK3 */
+		mux {
+			pins = "gpio67";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk4_active: cam_sensor_mclk4_active {
+		/* MCLK4 */
+		mux {
+			pins = "gpio68";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio68";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk4_suspend: cam_sensor_mclk4_suspend {
+		/* MCLK4 */
+		mux {
+			pins = "gpio68";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio68";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk5_active: cam_sensor_mclk5_active {
+		/* MCLK5 */
+		mux {
+			pins = "gpio98";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio98";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk5_suspend: cam_sensor_mclk5_suspend {
+		/* MCLK5 */
+		mux {
+			pins = "gpio98";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio98";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_active_rst0: cam_sensor_active_rst0 {
+		/* RESET REAR */
+		mux {
+			pins = "gpio20";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio20";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst0: cam_sensor_suspend_rst0 {
+		/* RESET REAR */
+		mux {
+			pins = "gpio20";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio20";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst1: cam_sensor_active_rst1 {
+		/* RESET REARAUX */
+		mux {
+			pins = "gpio21";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio21";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst1: cam_sensor_suspend_rst1 {
+		/* RESET REARAUX */
+		mux {
+			pins = "gpio21";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio21";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst2: cam_sensor_active_rst2 {
+		/* RESET 2 */
+		mux {
+			pins = "gpio77";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio77";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst2: cam_sensor_suspend_rst2 {
+		/* RESET 2 */
+		mux {
+			pins = "gpio77";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio77";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst3: cam_sensor_active_rst3 {
+		/* RESET 3 */
+		mux {
+			pins = "gpio78";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio78";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst3: cam_sensor_suspend_rst3 {
+		/* RESET 3 */
+		mux {
+			pins = "gpio78";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio78";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst4: cam_sensor_active_rst4 {
+		/* RESET 4 */
+		mux {
+			pins = "gpio79";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio79";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst4: cam_sensor_suspend_rst4 {
+		/* RESET 4 */
+		mux {
+			pins = "gpio79";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio79";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_mux: cam_sensor_active_mux {
+		/* GC630 bypass mux */
+		mux {
+			pins = "gpio1";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio1";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_mux: cam_sensor_suspend_mux {
+		/* GC630 bypass mux */
+		mux {
+			pins = "gpio1";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio1";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+};
+
+&soc {
+	qcom,cam-req-mgr {
+		compatible = "qcom,cam-req-mgr";
+		status = "ok";
+	};
+
+	qcom,cam-sync {
+		compatible = "qcom,cam-sync";
+		status = "ok";
+	};
+
+	cam_csiphy0: qcom,csiphy0 {
+		cell-index = <0>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0x0ace0000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe0000>;
+		interrupts = <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy0";
+		operating-points-v2 = <&csiphy0_opp_table>;
+		refgen-supply = <&refgen>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY0_CLK>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy0_clk",
+			"csi0phytimer_clk_src",
+			"csi0phytimer_clk";
+		src-clock-name = "csi0phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_csiphy1: qcom,csiphy1 {
+		cell-index = <1>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0xace2000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe2000>;
+		interrupts = <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy1";
+		operating-points-v2 = <&csiphy1_opp_table>;
+		refgen-supply = <&refgen>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY1_CLK>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy1_clk",
+			"csi1phytimer_clk_src",
+			"csi1phytimer_clk";
+		src-clock-name = "csi1phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_csiphy2: qcom,csiphy2 {
+		cell-index = <2>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0xace4000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe4000>;
+		interrupts = <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy2";
+		refgen-supply = <&refgen>;
+		operating-points-v2 = <&csiphy2_opp_table>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY2_CLK>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy2_clk",
+			"csi2phytimer_clk_src",
+			"csi2phytimer_clk";
+		src-clock-name = "csi2phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_csiphy3: qcom,csiphy3 {
+		cell-index = <3>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0xace6000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe6000>;
+		interrupts = <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy3";
+		refgen-supply = <&refgen>;
+		operating-points-v2 = <&csiphy3_opp_table>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY3_CLK>,
+			<&camcc CAM_CC_CSI3PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI3PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy3_clk",
+			"csi3phytimer_clk_src",
+			"csi3phytimer_clk";
+		src-clock-name = "csi3phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_csiphy4: qcom,csiphy4 {
+		cell-index = <4>;
+		compatible = "qcom,csiphy-v1.2.1", "qcom,csiphy";
+		reg = <0x0 0xace8000 0x0 0x2000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0xe8000>;
+		interrupts = <GIC_SPI 122 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy4";
+		refgen-supply = <&refgen>;
+		operating-points-v2 = <&csiphy4_opp_table>;
+		csi-vdd-1p2-supply = <&vreg_l6b_1p2>;
+		csi-vdd-0p9-supply = <&vreg_l10c_0p88>;
+		regulator-names = "refgen", "csi-vdd-1p2",
+			"csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 1200000 880000>;
+		rgltr-max-voltage = <0 1260000 1050000>;
+		rgltr-load-current = <0 54000 96400>;
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY4_CLK>,
+			<&camcc CAM_CC_CSI4PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI4PHYTIMER_CLK>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy4_clk",
+			"csi4phytimer_clk_src",
+			"csi4phytimer_clk";
+		src-clock-name = "csi4phytimer_clk_src";
+		clock-cntl-level = "lowsvs", "svs";
+		clock-rates =
+			<300000000 0 300000000 0>,
+			<400000000 0 300000000 0>;
+		status = "ok";
+		csiphy4_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+		};
+	};
+
+	cam_cci0: qcom,cci0 {
+		cell-index = <0>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac4a000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x4a000>;
+		interrupt-names = "cci";
+		interrupts = <GIC_SPI 460 IRQ_TYPE_EDGE_RISING>;
+		status = "ok";
+		operating-points-v2 = <&cci0_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clocks = <&camcc CAM_CC_CCI_0_CLK_SRC>,
+			<&camcc CAM_CC_CCI_0_CLK>;
+		clock-names = "cci_0_clk_src",
+			"cci_0_clk";
+		src-clock-name = "cci_0_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates = <37500000 0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cci0_active &cci1_active>;
+		pinctrl-1 = <&cci0_suspend &cci1_suspend>;
+		gpios = <&tlmm 69 0>,
+			<&tlmm 70 0>,
+			<&tlmm 71 0>,
+			<&tlmm 72 0>;
+		gpio-req-tbl-num = <0 1 2 3>;
+		gpio-req-tbl-flags = <1 1 1 1>;
+		gpio-req-tbl-label = "CCI_I2C_DATA0",
+					"CCI_I2C_CLK0",
+					"CCI_I2C_DATA1",
+					"CCI_I2C_CLK1";
+		cci0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci0: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci0: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci0: qcom,i2c_custom_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci0: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci1: qcom,cci1 {
+		cell-index = <1>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac4b000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x4b000>;
+		interrupt-names = "cci";
+		interrupts = <GIC_SPI 271 IRQ_TYPE_EDGE_RISING>;
+		status = "ok";
+		operating-points-v2 = <&cci1_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clocks = <&camcc CAM_CC_CCI_1_CLK_SRC>,
+			<&camcc CAM_CC_CCI_1_CLK>;
+		clock-names = "cci_1_clk_src",
+			"cci_1_clk";
+		src-clock-name = "cci_1_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates = <37500000 0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cci2_active &cci3_active>;
+		pinctrl-1 = <&cci2_suspend &cci3_suspend>;
+		gpios = <&tlmm 73 0>,
+			<&tlmm 74 0>,
+			<&tlmm 75 0>,
+			<&tlmm 76 0>;
+		gpio-req-tbl-num = <0 1 2 3>;
+		gpio-req-tbl-flags = <1 1 1 1>;
+		gpio-req-tbl-label = "CCI_I2C_DATA2",
+					"CCI_I2C_CLK2",
+					"CCI_I2C_DATA3",
+					"CCI_I2C_CLK3";
+		cci1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci1: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci1: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci1: qcom,i2c_custom_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci1: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu", "simple-bus";
+		status = "ok";
+		force_cache_allocs;
+
+		msm_cam_smmu_ife {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x800 0x4E0>,
+				<&apps_smmu 0x820 0x4E0>,
+				<&apps_smmu 0x840 0x4E0>,
+				<&apps_smmu 0x860 0x4E0>,
+				<&apps_smmu 0x880 0x4E0>,
+				<&apps_smmu 0x8A0 0x4E0>,
+				<&apps_smmu 0x8C0 0x4E0>,
+				<&apps_smmu 0x8E0 0x4E0>,
+				<&apps_smmu 0xC00 0x4E0>,
+				<&apps_smmu 0xC20 0x4E0>,
+				<&apps_smmu 0xC40 0x4E0>,
+				<&apps_smmu 0xC60 0x4E0>,
+				<&apps_smmu 0xC80 0x4E0>,
+				<&apps_smmu 0xCA0 0x4E0>,
+				<&apps_smmu 0xCC0 0x4E0>,
+				<&apps_smmu 0xCE0 0x4E0>;
+			cam-smmu-label = "ife";
+			multiple-client-devices;
+			dma-coherent;
+			ife_iova_mem_map: iova-mem-map {
+				/* IO region is approximately 4 GB */
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x100000>;
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_jpeg {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x20C0 0x20>,
+				<&apps_smmu 0x20E0 0x20>;
+			cam-smmu-label = "jpeg";
+			dma-coherent;
+			jpeg_iova_mem_map: iova-mem-map {
+				/* IO region is approximately 3.4 GB */
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x100000>;
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_icp_fw {
+			compatible = "qcom,msm-cam-smmu-fw-dev";
+			label="icp";
+			memory-region = <&camera_mem>;
+		};
+
+		msm_cam_smmu_icp {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x2000 0x20>,
+				<&apps_smmu 0x2020 0x20>,
+				<&apps_smmu 0x2062 0x0>,
+				<&apps_smmu 0x2080 0x20>,
+				<&apps_smmu 0x20A0 0x20>,
+				<&apps_smmu 0x2140 0x0>;
+			cam-smmu-label = "icp";
+			dma-coherent;
+			icp_iova_mem_map: iova-mem-map {
+				iova-mem-region-firmware {
+					/* Firmware region is 5MB */
+					iova-region-name = "firmware";
+					iova-region-start = <0x0>;
+					iova-region-len = <0x500000>;
+					iova-region-id = <0x0>;
+					status = "ok";
+				};
+
+				iova-mem-region-shared {
+					/* Shared region is 150MB long */
+					iova-region-name = "shared";
+					iova-region-start = <0x7400000>;
+					iova-region-len = <0x9600000>;
+					iova-region-id = <0x1>;
+					status = "ok";
+				};
+
+				iova-mem-region-secondary-heap {
+					/* Secondary heap region is 1MB long */
+					iova-region-name = "secheap";
+					iova-region-start = <0x10a00000>;
+					iova-region-len = <0x100000>;
+					iova-region-id = <0x4>;
+					status = "ok";
+				};
+
+				iova-mem-region-io {
+					/* IO region is approximately 3.7 GB */
+					iova-region-name = "io";
+					iova-region-start = <0x10c00000>;
+					iova-region-len = <0xcf300000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+
+				iova-mem-qdss-region {
+					/* QDSS region is appropriate 1MB */
+					iova-region-name = "qdss";
+					iova-region-start = <0x10b00000>;
+					iova-region-len = <0x100000>;
+					iova-region-id = <0x5>;
+					qdss-phy-addr = <0x16790000>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_cpas_cdm {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x2040 0x0>;
+			cam-smmu-label = "cpas-cdm";
+			dma-coherent;
+			cpas_cdm_iova_mem_map: iova-mem-map {
+				iova-mem-region-io {
+					/* IO region is approximately 3.4 GB */
+					iova-region-name = "io";
+					iova-region-start = <0x100000>;
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_lrme {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x2100 0x20>,
+				<&apps_smmu 0x2120 0x20>;
+			cam-smmu-label = "lrme";
+			dma-coherent;
+			lrme_iova_mem_map: iova-mem-map {
+				iova-mem-region-shared {
+					/* Shared region is 100MB long */
+					iova-region-name = "shared";
+					iova-region-start = <0x7400000>;
+					iova-region-len = <0x6400000>;
+					iova-region-id = <0x1>;
+					status = "ok";
+				};
+				/* IO region is approximately 3.3 GB */
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x100000>;
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_secure {
+			compatible = "qcom,msm-cam-smmu-cb";
+			cam-smmu-label = "cam-secure";
+			qcom,secure-cb;
+		};
+	};
+
+	qcom,cam-cdm-intf {
+		compatible = "qcom,cam-cdm-intf";
+		cell-index = <0>;
+		label = "cam-cdm-intf";
+		num-hw-cdm = <1>;
+		cdm-client-names = "vfe",
+			"jpegdma",
+			"jpegenc",
+			"lrmecdm";
+		status = "ok";
+	};
+
+	qcom,cpas-cdm0 {
+		cell-index = <0>;
+		compatible = "qcom,cam170-cpas-cdm0";
+		label = "cpas-cdm";
+		reg = <0x0 0xac48000 0x0 0x1000>;
+		reg-names = "cpas-cdm";
+		reg-cam-base = <0x48000>;
+		interrupts = <GIC_SPI 461 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "cpas-cdm";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_slow_ahb_clk_src";
+		clock-rates = <80000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table>;
+		clock-cntl-level = "svs";
+		cdm-client-names = "ife0", "ife1", "ife2",
+				   "ife3", "ife4", "dualife";
+		status = "ok";
+		cdm_cpas_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-80000000 {
+				opp-hz = /bits/ 64 <80000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,cam-isp {
+		compatible = "qcom,cam-isp";
+		arch-compat = "ife";
+		status = "ok";
+	};
+
+	cam_csid0: qcom,csid0 {
+		cell-index = <0>;
+		compatible = "qcom,csid165_204";
+		reg-names = "csid";
+		reg = <0x0 0xacb3000 0x0 0x1000>;
+		reg-cam-base = <0xb3000>;
+		interrupt-names = "csid0";
+		interrupts = <GIC_SPI 464 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_0_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_0_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_0_CSID_CLK>,
+			<&camcc CAM_CC_IFE_0_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_AXI_CLK>;
+		clock-rates =
+			<300000000 0 0 380000000 0 0>,
+			<400000000 0 0 510000000 0 0>,
+			<400000000 0 0 637000000 0 0>,
+			<400000000 0 0 760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+
+		operating-points-v2 = <&csid0_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe0: qcom,vfe0 {
+		cell-index = <0>;
+		compatible = "qcom,vfe165_160";
+		reg-names = "ife";
+		reg = <0x0 0xacaf000 0x0 0x5200>;
+		reg-cam-base = <0xaf000>;
+		interrupt-names = "ife0";
+		interrupts = <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_0_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_AXI_CLK>;
+		clock-rates =
+			<380000000 0 0>,
+			<510000000 0 0>,
+			<637000000 0 0>,
+			<760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+
+		operating-points-v2 = <&vfe0_opp_table>;
+		clock-control-debugfs = "true";
+		clock-names-option =  "ife_dsp_clk";
+		clocks-option = <&camcc CAM_CC_IFE_0_DSP_CLK>;
+		clock-rates-option = <760000000>;
+		cam_hw_pid = <24 8>;
+		status = "ok";
+		vfe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid1: qcom,csid1 {
+		cell-index = <1>;
+		compatible = "qcom,csid165_204";
+		reg-names = "csid";
+		reg = <0x0 0xacba000 0x0 0x1000>;
+		reg-cam-base = <0xba000>;
+		interrupt-names = "csid1";
+		interrupts = <GIC_SPI 466 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_1_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_1_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_1_CSID_CLK>,
+			<&camcc CAM_CC_IFE_1_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_AXI_CLK>;
+		clock-rates =
+			<300000000 0 0 380000000 0 0>,
+			<400000000 0 0 510000000 0 0>,
+			<400000000 0 0 637000000 0 0>,
+			<400000000 0 0 760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+
+		operating-points-v2 = <&csid1_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe1: qcom,vfe1 {
+		cell-index = <1>;
+		compatible = "qcom,vfe165_160";
+		reg-names = "ife";
+		reg = <0x0 0xacb6000 0x0 0x5200>;
+		reg-cam-base = <0xb6000>;
+		interrupt-names = "ife1";
+		interrupts = <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_1_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_AXI_CLK>;
+		clock-rates =
+			<380000000 0 0>,
+			<510000000 0 0>,
+			<637000000 0 0>,
+			<760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		operating-points-v2 = <&vfe1_opp_table>;
+
+		clock-control-debugfs = "true";
+		clock-names-option =  "ife_dsp_clk";
+		clocks-option = <&camcc CAM_CC_IFE_1_DSP_CLK>;
+		clock-rates-option = <760000000>;
+		cam_hw_pid = <25 9>;
+		status = "ok";
+		vfe1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid2: qcom,csid2 {
+		cell-index = <2>;
+		compatible = "qcom,csid165_204";
+		reg-names = "csid";
+		reg = <0x0 0x0acc1000 0x0 0x1000>;
+		reg-cam-base = <0xc1000>;
+		interrupt-names = "csid2";
+		interrupts = <GIC_SPI 640 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_2_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_2_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_2_CSID_CLK>,
+			<&camcc CAM_CC_IFE_2_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_2_CLK_SRC>,
+			<&camcc CAM_CC_IFE_2_CLK>,
+			<&camcc CAM_CC_IFE_2_AXI_CLK>;
+		clock-rates =
+			<300000000 0 0 380000000 0 0>,
+			<400000000 0 0 510000000 0 0>,
+			<400000000 0 0 637000000 0 0>,
+			<400000000 0 0 760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+		operating-points-v2 = <&csid2_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe2: qcom,vfe2 {
+		cell-index = <2>;
+		compatible = "qcom,vfe165_160";
+		reg-names = "ife";
+		reg = <0x0 0x0acbd000 0x0 0x5200>;
+		reg-cam-base = <0xbd000>;
+		interrupt-names = "ife2";
+		interrupts = <GIC_SPI 641 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_IFE_2_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk",
+			"ife_axi_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_2_CLK_SRC>,
+			<&camcc CAM_CC_IFE_2_CLK>,
+			<&camcc CAM_CC_IFE_2_AXI_CLK>;
+		clock-rates =
+			<380000000 0 0>,
+			<510000000 0 0>,
+			<637000000 0 0>,
+			<760000000 0 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		operating-points-v2 = <&vfe2_opp_table>;
+
+		clock-control-debugfs = "true";
+		clock-names-option =  "ife_dsp_clk";
+		clocks-option = <&camcc CAM_CC_IFE_2_DSP_CLK>;
+		clock-rates-option = <760000000>;
+		cam_hw_pid = <3 10>;
+		status = "ok";
+		vfe2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-380000000 {
+				opp-hz = /bits/ 64 <380000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-510000000 {
+				opp-hz = /bits/ 64 <510000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-637000000 {
+				opp-hz = /bits/ 64 <637000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-760000000 {
+				opp-hz = /bits/ 64 <760000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite0: qcom,csid-lite0 {
+		cell-index = <3>;
+		compatible = "qcom,csid-lite165";
+		reg-names = "csid-lite";
+		reg = <0x0 0xacc8000 0x0 0x1000>;
+		reg-cam-base = <0xc8000>;
+		interrupt-names = "csid-lite0";
+		interrupts = <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_LITE_0_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_0_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_0_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_0_CLK>;
+		clock-rates =
+			<300000000 0 0 320000000 0>,
+			<400000000 0 0 400000000 0>,
+			<400000000 0 0 480000000 0>,
+			<400000000 0 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+		operating-points-v2 = <&csid_lite0_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite0: qcom,vfe-lite0 {
+		cell-index = <3>;
+		compatible = "qcom,vfe-lite165";
+		reg-names = "ife-lite";
+		reg = <0x0 0xacc4000 0x0 0x5000>;
+		reg-cam-base = <0xc4000>;
+		interrupt-names = "ife-lite0";
+		interrupts = <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_LITE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_0_CLK>;
+		clock-rates =
+			<320000000 0>,
+			<400000000 0>,
+			<480000000 0>,
+			<600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		operating-points-v2 = <&vfe_lite0_opp_table>;
+
+		clock-control-debugfs = "true";
+		cam_hw_pid = <11>;
+		status = "ok";
+		vfe_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite1: qcom,csid-lite1 {
+		cell-index = <4>;
+		compatible = "qcom,csid-lite165";
+		reg-names = "csid-lite";
+		reg = <0x0 0x0accf000 0x0 0x1000>;
+		reg-cam-base = <0xcf000>;
+		interrupt-names = "csid-lite1";
+		interrupts = <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"ife_csid_clk_src",
+			"ife_csid_clk",
+			"ife_cphy_rx_clk",
+			"ife_clk_src",
+			"ife_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_LITE_1_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_1_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_1_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_1_CLK>;
+		clock-rates =
+			<300000000 0 0 320000000 0>,
+			<400000000 0 0 400000000 0>,
+			<400000000 0 0 480000000 0>,
+			<400000000 0 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+		operating-points-v2 = <&csid_lite1_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite1: qcom,vfe-lite1 {
+		cell-index = <4>;
+		compatible = "qcom,vfe-lite165";
+		reg-names = "ife-lite";
+		reg = <0x0 0x0accb000 0x0 0x5000>;
+		reg-cam-base = <0xcb000>;
+		interrupt-names = "ife-lite1";
+		interrupts = <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"ife_clk_src",
+			"ife_clk";
+		clocks =
+			<&camcc CAM_CC_IFE_LITE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_1_CLK>;
+		clock-rates =
+			<320000000 0>,
+			<400000000 0>,
+			<480000000 0>,
+			<600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		operating-points-v2 = <&vfe_lite1_opp_table>;
+
+		clock-control-debugfs = "true";
+		cam_hw_pid = <12>;
+		status = "ok";
+		vfe_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-icp {
+		compatible = "qcom,cam-icp";
+		compat-hw-name = "qcom,a5",
+			"qcom,ipe0",
+			"qcom,bps";
+		num-a5 = <1>;
+		num-ipe = <1>;
+		num-bps = <1>;
+		icp_pc_en;
+		status = "ok";
+	};
+
+	cam_a5: qcom,a5 {
+		cell-index = <0>;
+		compatible = "qcom,cam-a5";
+		reg = <0x0 0xac00000 0x0 0x6000>,
+			<0x0 0xac10000 0x0 0x8000>,
+			<0x0 0xac18000 0x0 0x3000>;
+		reg-names = "a5_qgic", "a5_sierra", "a5_csr";
+		reg-cam-base = <0x00000 0x10000 0x18000>;
+		interrupts = <GIC_SPI 463 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a5";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"soc_fast_ahb",
+			"icp_ahb_clk",
+			"icp_clk_src",
+			"icp_clk";
+		src-clock-name = "soc_fast_ahb";
+		clocks =
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_ICP_AHB_CLK>,
+			<&camcc CAM_CC_ICP_CLK_SRC>,
+			<&camcc CAM_CC_ICP_CLK>;
+		clock-rates =
+			<100000000 0 400000000 0>,
+			<200000000 0 400000000 0>,
+			<300000000 0 600000000 0>,
+			<400000000 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1",
+					"nominal";
+		operating-points-v2 = <&a5_opp_table>;
+
+		fw_name = "CAMERA_ICP_170.elf";
+		ubwc-ipe-fetch-cfg = <0x7073 0x707b>;
+		ubwc-ipe-write-cfg = <0x161cf 0x161ef>;
+		ubwc-bps-fetch-cfg = <0x7073 0x707b>;
+		ubwc-bps-write-cfg = <0x161cf 0x161ef>;
+		qos-val = <0x00000A0A>;
+		status = "ok";
+		a5_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-100000000 {
+				opp-hz = /bits/ 64 <100000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-200000000 {
+				opp-hz = /bits/ 64 <200000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_ipe0: qcom,ipe0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-ipe";
+		reg = <0x0 0xac87000 0x0 0xa000>;
+		reg-names = "ipe0_top";
+		reg-cam-base = <0x87000>;
+		power-domains = <&camcc CAM_CC_IPE_0_GDSC>;
+		clock-names =
+			"ipe_0_ahb_clk",
+			"ipe_0_areg_clk",
+			"ipe_0_axi_clk",
+			"ipe_0_clk_src",
+			"ipe_0_clk";
+		src-clock-name = "ipe_0_clk_src";
+		clock-control-debugfs = "true";
+		clocks =
+			<&camcc CAM_CC_IPE_0_AHB_CLK>,
+			<&camcc CAM_CC_IPE_0_AREG_CLK>,
+			<&camcc CAM_CC_IPE_0_AXI_CLK>,
+			<&camcc CAM_CC_IPE_0_CLK_SRC>,
+			<&camcc CAM_CC_IPE_0_CLK>;
+
+		clock-rates =
+			<0 0 0 300000000 0>,
+			<0 0 0 430000000 0>,
+			<0 0 0 520000000 0>,
+			<0 0 0 600000000 0>,
+			<0 0 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1",
+				"nominal", "turbo";
+		operating-points-v2 = <&ipe0_opp_table>;
+
+		status = "ok";
+		ipe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-430000000 {
+				opp-hz = /bits/ 64 <430000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-520000000 {
+				opp-hz = /bits/ 64 <520000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_bps: qcom,bps {
+		cell-index = <0>;
+		compatible = "qcom,cam-bps";
+		reg = <0x0 0xac6f000 0x0 0x8000>;
+		reg-names = "bps_top";
+		reg-cam-base = <0x6f000>;
+		power-domains = <&camcc CAM_CC_BPS_GDSC>;
+		clock-names =
+			"bps_ahb_clk",
+			"bps_areg_clk",
+			"bps_axi_clk",
+			"bps_clk_src",
+			"bps_clk";
+		src-clock-name = "bps_clk_src";
+		clock-control-debugfs = "true";
+		clocks =
+			<&camcc CAM_CC_BPS_AHB_CLK>,
+			<&camcc CAM_CC_BPS_AREG_CLK>,
+			<&camcc CAM_CC_BPS_AXI_CLK>,
+			<&camcc CAM_CC_BPS_CLK_SRC>,
+			<&camcc CAM_CC_BPS_CLK>;
+
+		clock-rates =
+			<0 0 0 200000000 0>,
+			<0 0 0 400000000 0>,
+			<0 0 0 480000000 0>,
+			<0 0 0 600000000 0>,
+			<0 0 0 600000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1",
+				"nominal", "turbo";
+		operating-points-v2 = <&bps_opp_table>;
+
+		status = "ok";
+		bps_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-200000000 {
+				opp-hz = /bits/ 64 <200000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-jpeg {
+		compatible = "qcom,cam-jpeg";
+		compat-hw-name = "qcom,jpegenc",
+			"qcom,jpegdma";
+		num-jpeg-enc = <1>;
+		num-jpeg-dma = <1>;
+		status = "ok";
+	};
+
+	cam_jpeg_enc: qcom,jpegenc {
+		cell-index = <0>;
+		compatible = "qcom,cam_jpeg_enc_165";
+		reg-names = "jpege_hw", "cam_camnoc";
+		reg = <0x0 0xac4e000 0x0 0x4000>,
+			<0x0 0x0ac9f000 0x0 0x10000>;
+		reg-cam-base = <0x4e000 0x9f000>;
+		interrupt-names = "jpeg";
+		interrupts = <GIC_SPI 474 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"jpegenc_clk_src",
+			"jpegenc_clk";
+		clocks =
+			<&camcc CAM_CC_JPEG_CLK_SRC>,
+			<&camcc CAM_CC_JPEG_CLK>;
+
+		clock-rates = <600000000 0>;
+		src-clock-name = "jpegenc_clk_src";
+		operating-points-v2 = <&jpeg_enc_opp_table>;
+
+		clock-cntl-level = "nominal";
+		cam_hw_pid = <22 23>;
+		cam_hw_rd_mid = <0>;
+		cam_hw_wr_mid = <2>;
+		status = "ok";
+		jpeg_enc_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_jpeg_dma: qcom,jpegdma {
+		cell-index = <0>;
+		compatible = "qcom,cam_jpeg_dma_165";
+		reg-names = "jpegdma_hw", "cam_camnoc";
+		reg = <0x0 0xac52000 0x0 0x4000>,
+			<0x0 0x0ac9f000 0x0 0x10000>;
+		reg-cam-base = <0x52000 0x9f000>;
+		interrupt-names = "jpegdma";
+		interrupts = <GIC_SPI 475 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"jpegdma_clk_src",
+			"jpegdma_clk";
+		clocks =
+			<&camcc CAM_CC_JPEG_CLK_SRC>,
+			<&camcc CAM_CC_JPEG_CLK>;
+
+		clock-rates = <600000000 0>;
+		src-clock-name = "jpegdma_clk_src";
+		operating-points-v2 = <&jpeg_dma_opp_table>;
+
+		clock-cntl-level = "nominal";
+		cam_hw_pid = <20 21>;
+		cam_hw_rd_mid = <0>;
+		cam_hw_wr_mid = <2>;
+		status = "ok";
+		jpeg_dma_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-lrme {
+		compatible = "qcom,cam-lrme";
+		arch-compat = "lrme";
+		status = "ok";
+	};
+
+	cam_lrme: qcom,lrme {
+		cell-index = <0>;
+		compatible = "qcom,lrme";
+		reg-names = "lrme";
+		reg = <0x0 0xac6b000 0x0 0x1000>;
+		reg-cam-base = <0x6b000>;
+		interrupt-names = "lrme";
+		interrupts = <GIC_SPI 476 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "lrme_clk_src",
+			"lrme_clk";
+		clocks = <&camcc CAM_CC_LRME_CLK_SRC>,
+			<&camcc CAM_CC_LRME_CLK>;
+		clock-rates = <240000000 0>,
+			<300000000 0>,
+			<320000000 0>,
+			<400000000 0>;
+		clock-cntl-level = "lowsvs", "svs", "svs_l1", "nominal";
+		src-clock-name = "lrme_clk_src";
+		operating-points-v2 = <&lrme_opp_table>;
+
+		status = "ok";
+		lrme_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-240000000 {
+				opp-hz = /bits/ 64 <240000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-cpas {
+		cell-index = <0>;
+		compatible = "qcom,cam-cpas";
+		label = "cpas";
+		arch-compat = "cpas_top";
+		status = "ok";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg-names = "cam_cpas_top", "cam_camnoc";
+		reg = <0x0 0x0ac40000 0x0 0x1000>,
+			<0x0 0x0ac9f000 0x0 0x10000>;
+		reg-cam-base = <0x40000 0x9f000>;
+		cam_hw_fuse = <CAM_CPAS_ISP_FUSE 0x7801FC 0x10 CAM_CPAS_FEATURE_TYPE_DISABLE 0x4>,
+			      <CAM_CPAS_ISP_LITE_FUSE 0x7801FC 0x20 CAM_CPAS_FEATURE_TYPE_DISABLE 0x10>,
+			      <CAM_CPAS_SHDR_FUSE 0x7801FC 0x40 CAM_CPAS_FEATURE_TYPE_DISABLE 0xFF>,
+			      <CAM_CPAS_QCFA_BINNING_ENABLE 0x7801FC 0x80 CAM_CPAS_FEATURE_TYPE_DISABLE 0xFF>,
+			      <CAM_CPAS_CSIPHY_FUSE 0x7801FC 0x100 CAM_CPAS_FEATURE_TYPE_DISABLE 0x10>,
+			      <CAM_CPAS_RT_OT_FUSE 0x7801A4 0x10000000 CAM_CPAS_FEATURE_TYPE_DISABLE 0xFF>;
+		interrupt-names = "cpas_camnoc";
+		interrupts = <GIC_SPI 459 IRQ_TYPE_EDGE_RISING>;
+		camnoc-axi-min-ib-bw = <3000000000>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"gcc_camera_hf_axi_clk",
+			"gcc_camera_sf_axi_clk",
+			"cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk",
+			"cam_cc_camnoc_axi_clk_src",
+			"cam_cc_camnoc_axi_clk",
+			"cam_cc_icp_ahb_clk",
+			"cam_cc_icp_clk";
+		clocks =
+			<&gcc GCC_CAMERA_HF_AXI_CLK>,
+			<&gcc GCC_CAMERA_SF_AXI_CLK>,
+			<&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK_SRC>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&camcc CAM_CC_ICP_AHB_CLK>,
+			<&camcc CAM_CC_ICP_CLK>;
+		src-clock-name = "cam_cc_camnoc_axi_clk_src";
+		clock-rates =
+			<0 0 0 0 0 0 0 0>,
+			<0 0 80000000 0 150000000 0 0 0>,
+			<0 0 80000000 0 240000000 0 0 0>,
+			<0 0 80000000 0 320000000 0 0 0>,
+			<0 0 80000000 0 400000000 0 0 0>,
+			<0 0 80000000 0 480000000 0 0 0>;
+		clock-cntl-level = "suspend", "lowsvs", "svs",
+			"svs_l1", "nominal", "turbo";
+		operating-points-v2 = <&cpas_opp_table>;
+		control-camnoc-axi-clk;
+		camnoc-bus-width = <32>;
+		camnoc-axi-clk-bw-margin-perc = <20>;
+		interconnect-names = "cam_ahb", "cam_hf_0", "cam_sf_0", "cam_sf_icp";
+		interconnects =<&gem_noc MASTER_APPSS_PROC 0
+			&cnoc2 SLAVE_CAMERA_CFG 0>,
+				<&mmss_noc MASTER_CAMNOC_HF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_SF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_ICP 0
+			&mc_virt SLAVE_EBI1 0>;
+
+		cam-ahb-num-cases = <7>;
+		cam-ahb-bw-KBps =
+			<0 0>, <0 76800>, <0 150000>, <0 150000>,
+			<0 300000>, <0 300000>, <0 300000>;
+		vdd-corners = <RPMH_REGULATOR_LEVEL_RETENTION
+			RPMH_REGULATOR_LEVEL_MIN_SVS
+			RPMH_REGULATOR_LEVEL_LOW_SVS
+			RPMH_REGULATOR_LEVEL_SVS
+			RPMH_REGULATOR_LEVEL_SVS_L1
+			RPMH_REGULATOR_LEVEL_NOM
+			RPMH_REGULATOR_LEVEL_NOM_L1
+			RPMH_REGULATOR_LEVEL_NOM_L2
+			RPMH_REGULATOR_LEVEL_TURBO
+			RPMH_REGULATOR_LEVEL_TURBO_L1>;
+		vdd-corner-ahb-mapping = "suspend",
+			"lowsvs", "lowsvs", "svs", "svs_l1",
+			"nominal", "nominal", "nominal",
+			"turbo", "turbo";
+		client-id-based;
+		client-names =
+			"csiphy0", "csiphy1", "csiphy2", "csiphy3",
+			"csiphy4", "cci0", "cci1",
+			"csid0", "csid1", "csid2", "csid3", "csid4",
+			"ife0", "ife1", "ife2", "ife3", "ife4",
+			"ipe0", "cam-cdm-intf0", "cpas-cdm0",
+			"bps0", "icp0", "jpeg-dma0", "jpeg-enc0",
+			"lrmecpas0";
+
+		cpas_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-150000000 {
+				opp-hz = /bits/ 64 <150000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+			opp-240000000 {
+				opp-hz = /bits/ 64 <240000000>;
+				required-opps = <&rpmhpd_opp_svs>;
+			};
+			opp-320000000 {
+				opp-hz = /bits/ 64 <320000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_turbo>;
+			};
+		};
+		camera-bus-nodes {
+			level0-nodes {
+				level-index = <0>;
+				ife0_rdi_wr: ife0-rdi-wr {
+					cell-index = <16>;
+					node-name = "ife0-rdi-wr";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife1_rdi_wr: ife1-rdi-wr {
+					cell-index = <17>;
+					node-name = "ife1-rdi-wr";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife2_rdi_wr: ife2-rdi-wr {
+					cell-index = <18>;
+					node-name = "ife2-rdi-wr";
+					client-name = "ife2";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife3_rdi_wr: ife3-rdi-wr {
+					cell-index = <19>;
+					node-name = "ife3-rdi-wr";
+					client-name = "ife3";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife4_rdi_wr: ife4-rdi-wr {
+					cell-index = <20>;
+					node-name = "ife4-rdi-wr";
+					client-name = "ife4";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3>;
+					parent-node = <&level1_rt0_write0>;
+				};
+
+				ife0_pixelall_wr: ife0-pixelall-wr {
+					cell-index = <21>;
+					node-name = "ife0-pixelall-wr";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_PIXEL_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_DISP
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt1_write0>;
+				};
+
+				ife1_pixelall_wr: ife1-pixelall-wr {
+					cell-index = <22>;
+					node-name = "ife1-pixelall-wr";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_PIXEL_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_DISP
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt1_write0>;
+				};
+
+				ife2_pixelall_wr: ife2-pixelall-wr {
+					cell-index = <23>;
+					node-name = "ife2-pixelall-wr";
+					client-name = "ife2";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_PIXEL_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_DISP
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt1_write1>;
+				};
+
+				ipe0_ref_wr: ipe0-ref-wr {
+					cell-index = <24>;
+					node-name = "ipe0-ref-wr";
+					client-name = "ipe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IPE_WR_REF>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt0_write0>;
+				};
+
+				bps0_all_wr: bps0-all-wr {
+					cell-index = <25>;
+					node-name = "bps0-all-wr";
+					client-name = "bps0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt0_write0>;
+				};
+
+				lrme0_all_wr: lrme0-all-wr {
+					cell-index = <26>;
+					node-name = "lrme0-all-wr";
+					client-name = "lrmecpas0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt0_write0>;
+				};
+
+				ipe0_viddisp_wr: ipe0-viddisp-wr {
+					cell-index = <27>;
+					node-name = "ipe0-viddisp-wr";
+					client-name = "ipe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IPE_WR_VID_DISP>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_WR_VID
+					CAM_CPAS_PATH_DATA_IPE_WR_DISP>;
+					parent-node = <&level1_nrt0_write0>;
+				};
+
+				ipe0_all_rd: ipe0-all-rd {
+					cell-index = <28>;
+					node-name = "ipe0-all-rd";
+					client-name = "ipe0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_RD_IN
+					CAM_CPAS_PATH_DATA_IPE_RD_REF>;
+					parent-node = <&level1_nrt0_read0>;
+				};
+
+				bps0_all_rd: bps0-all-rd {
+					cell-index = <29>;
+					node-name = "bps0-all-rd";
+					client-name = "bps0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt0_read0>;
+				};
+
+				lrme0_all_rd: lrme0-all-rd {
+					cell-index = <30>;
+					node-name = "lrme0-all-rd";
+					client-name = "lrmecpas0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt0_read0>;
+				};
+
+				jpeg_enc0_all_wr: jpeg-enc0-all-wr {
+					cell-index = <31>;
+					node-name = "jpeg-enc0-all-wr";
+					client-name = "jpeg-enc0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt1_write0>;
+				};
+
+				jpeg_enc0_all_rd: jpeg-enc0-all-rd {
+					cell-index = <32>;
+					node-name = "jpeg-enc0-all-rd";
+					client-name = "jpeg-enc0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt1_read0>;
+				};
+
+				jpeg_dma0_all_wr: jpeg-dma0-all-wr {
+					cell-index = <33>;
+					node-name = "jpeg-dma0-all-wr";
+					client-name = "jpeg-dma0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					parent-node = <&level1_nrt1_write0>;
+				};
+
+				jpeg_dma0_all_rd: jpeg-dma0-all-rd {
+					cell-index = <34>;
+					node-name = "jpeg-dma0-all-rd";
+					client-name = "jpeg-dma0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt1_read0>;
+				};
+
+				cpas_cdm0_all_rd: cpas-cdm0-all-rd {
+					cell-index = <35>;
+					node-name = "cpas-cdm0-all-rd";
+					client-name = "cpas-cdm0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level2_nrt0_read0>;
+				};
+
+				icp0_all_rd: icp0-all-rd {
+					cell-index = <36>;
+					node-name = "icp0-all-rd";
+					client-name = "icp0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level2_nrt1_read0>;
+				};
+			};
+			level1-nodes {
+				level-index = <1>;
+				camnoc-max-needed;
+				level1_rt0_write0: level1-rt0-write0 {
+					cell-index = <8>;
+					node-name = "level1-rt0-write0";
+					parent-node = <&level2_rt0_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt1_write0: level1-rt1-write0 {
+					cell-index = <9>;
+					node-name = "level1-rt1-write0";
+					parent-node = <&level2_rt1_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt1_write1: level1-rt1-write1 {
+					cell-index = <10>;
+					node-name = "level1-rt1-write1";
+					parent-node = <&level2_rt1_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt0_write0: level1-nrt0-write0 {
+					cell-index = <11>;
+					node-name = "level1-nrt0-write0";
+					parent-node = <&level2_nrt0_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt0_read0: level1-nrt0-read0 {
+					cell-index = <12>;
+					node-name = "level1-nrt0-read0";
+					parent-node = <&level2_nrt0_read0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt1_write0: level1-nrt1-write0 {
+					cell-index = <13>;
+					node-name = "level1-nrt1-write0";
+					parent-node = <&level2_nrt0_write0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt1_read0: level1-nrt1-read0 {
+					cell-index = <14>;
+					node-name = "level1-nrt1-read0";
+					parent-node = <&level2_nrt0_read0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+			};
+			level2-nodes {
+				level-index = <3>;
+				camnoc-max-needed;
+				level2_rt0_write0: level2-rt0-write0 {
+					cell-index = <3>;
+					node-name = "level2-rt0-write0";
+					parent-node = <&level3_rt0_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM_INTERLEAVE>;
+				};
+
+				level2_rt1_write0: level2-rt1-write0 {
+					cell-index = <4>;
+					node-name = "level2-rt1-write0";
+					parent-node = <&level3_rt0_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM_INTERLEAVE>;
+				};
+
+				level2_nrt0_write0: level2-nrt0-write0 {
+					cell-index = <5>;
+					node-name = "level2-nrt0-write0";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt0_read0: level2-nrt0-read0 {
+					cell-index = <6>;
+					node-name = "level2-nrt0-read0";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt1_read0: level2-nrt1-read0 {
+					cell-index = <7>;
+					node-name = "level2-nrt1-read0";
+					parent-node = <&level3_nrt1_rd_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					bus-width-factor = <4>;
+				};
+			};
+			level3-nodes {
+				level-index = <3>;
+				level3_rt0_wr_sum: level3-rt0-wr-sum {
+					cell-index = <0>;
+					node-name = "level3-rt0-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					ib-bw-voting-needed;
+					qcom,axi-port-mnoc {
+						interconnect-names = "cam_hf_0";
+						interconnects =
+						<&mmss_noc MASTER_CAMNOC_HF 0
+						&mc_virt SLAVE_EBI1 0>;
+					};
+				};
+
+				level3_nrt0_rd_wr_sum: level3-nrt0-rd-wr-sum {
+					cell-index = <1>;
+					node-name = "level3-nrt0-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						interconnect-names = "cam_sf_0";
+						interconnects =
+						<&mmss_noc MASTER_CAMNOC_SF 0
+						&mc_virt SLAVE_EBI1 0>;
+					};
+				};
+
+				level3_nrt1_rd_sum: level3-nrt1-rd-sum {
+					cell-index = <2>;
+					node-name = "level3-nrt1-rd-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						interconnect-names = "cam_sf_icp";
+						interconnects =
+						<&mmss_noc MASTER_CAMNOC_ICP 0
+						&mc_virt SLAVE_EBI1 0>;
+					};
+				};
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-dma-heaps.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-dma-heaps.dtsi
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/arm/qcom_dma_heap_dt_constants.h>
+
+&soc {
+	qcom,dma-heaps {
+		compatible = "qcom,dma-heaps";
+
+		qcom,qseecom {
+			qcom,dma-heap-name = "qcom,qseecom";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&qseecom_mem>;
+		};
+
+		qcom,qseecom_ta {
+			qcom,dma-heap-name = "qcom,qseecom-ta";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&qseecom_ta_mem>;
+		};
+
+		qcom,secure_cdsp {
+			qcom,dma-heap-name = "qcom,cma-secure-cdsp";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&cdsp_secure_heap>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts
@@ -71,6 +71,41 @@
 		};
 	};
 
+	pmic-glink {
+		compatible = "qcom,qcm6490-pmic-glink", "qcom,pmic-glink";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		connector@0 {
+			compatible = "usb-c-connector";
+			reg = <0>;
+			power-role = "dual";
+			data-role = "dual";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					pmic_glink_hs_in: endpoint {
+						remote-endpoint = <&usb_1_dwc3_hs>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+
+					pmic_glink_ss_in: endpoint {
+						remote-endpoint = <&usb_1_dwc3_ss>;
+					};
+				};
+			};
+		};
+	};
+
 	reserved-memory {
 		cont_splash_mem: cont-splash@e1000000 {
 			reg = <0x0 0xe1000000 0x0 0x2300000>;
@@ -82,6 +117,11 @@
 			no-map;
 		};
 
+		removed_mem: removed@c0000000 {
+			reg = <0x0 0xc0000000 0x0 0x5100000>;
+			no-map;
+		};
+
 		rmtfs_mem: memory@f8500000 {
 			compatible = "qcom,rmtfs-mem";
 			reg = <0x0 0xf8500000 0x0 0x600000>;
@@ -822,7 +862,6 @@
 };
 
 &uart5 {
-	compatible = "qcom,geni-debug-uart";
 	status = "okay";
 };
 
@@ -886,7 +925,16 @@
 };
 
 &usb_1_dwc3 {
-	dr_mode = "peripheral";
+	dr_mode = "otg";
+	usb-role-switch;
+};
+
+&usb_1_dwc3_hs {
+	remote-endpoint = <&pmic_glink_hs_in>;
+};
+
+&usb_1_dwc3_ss {
+	remote-endpoint = <&pmic_glink_ss_in>;
 };
 
 &usb_1_hsphy {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-graphics-pwrlevels.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-graphics-pwrlevels.dtsi
@@ -0,0 +1,379 @@
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+&msm_gpu {
+	/*
+	 * Speed-bin zero is default speed bin.
+	 * For rest of the speed bins, speed-bin value
+	 * is calculated as FMAX/4.8 MHz round up to zero
+	 * decimal places plus two margin to account for
+	 * clock jitters.
+	 */
+	qcom,gpu-pwrlevel-bins {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "qcom,gpu-pwrlevel-bins";
+		qcom,gpu-pwrlevels-0 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <0>;
+			qcom,initial-pwrlevel = <5>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <812000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+
+				qcom,bus-freq = <10>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <10>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <700000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <8>;
+				qcom,bus-max = <10>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <608000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L2>;
+
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <10>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <550000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <450000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <8>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <315000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <0x882F5FFD>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-1 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			/* Keeping speed bin for FMAX 812 */
+			qcom,speed-bin = <172>;
+			qcom,initial-pwrlevel = <5>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <812000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+
+				qcom,bus-freq = <10>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <10>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <700000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <8>;
+				qcom,bus-max = <10>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <608000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L2>;
+
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <10>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <550000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <450000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <8>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <315000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <0x882F5FFD>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-2 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <117>;
+			qcom,initial-pwrlevel = <2>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <550000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <450000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <8>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <315000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <0x882F5FFD>;
+			};
+		};
+		qcom,gpu-pwrlevels-3 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <96>;
+			qcom,initial-pwrlevel = <1>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <450000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <8>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <315000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <0x882F5FFD>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-4 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <129>;
+			qcom,initial-pwrlevel = <3>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <608000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L2>;
+
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <10>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <550000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <450000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <8>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <315000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <0x882F5FFD>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-5 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <148>;
+			qcom,initial-pwrlevel = <4>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <700000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <8>;
+				qcom,bus-max = <10>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <608000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L2>;
+
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <10>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <550000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <450000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <8>;
+
+				qcom,acd-level = <0x802B5FFD>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <315000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <0x882F5FFD>;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-graphics.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-graphics.dtsi
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2024-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+#define MHZ_TO_KBPS(mhz, w) ((mhz * 1000000 * w) / (1024))
+
+&msm_gpu {
+	compatible = "qcom,kgsl",
+		"qcom,adreno-gpu-a643";
+	status = "ok";
+
+	reg = <0x0 0x3d00000 0x0 0x40000>, <0x0 0x3d61000 0x0 0x800>,
+		<0x0 0x3de0000 0x0 0x10000>, <0x0 0x3d8b000 0x0 0x2000>,
+		<0x0 0x06900000 0x0 0x80000>, <0x0 0x0636000 0x0 0x1000>,
+		<0x0 0x3d9e000 0x0 0x1000>;
+
+	reg-names = "kgsl_3d0_reg_memory", "cx_dbgc", "rscc",
+		"isense_cntl", "qdss_gfx", "rdpm_mx",
+		"cx_misc";
+
+	interrupts = <0 300 IRQ_TYPE_LEVEL_HIGH>;
+	interrupt-names = "kgsl_3d0_irq";
+
+	clocks = <&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+		<&gcc GCC_GPU_SNOC_DVM_GFX_CLK>,
+		<&gpucc GPU_CC_AHB_CLK>,
+		<&aoss_qmp>,
+		<&gpucc GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK>,
+		<&gpucc GPU_CC_CX_GMU_CLK>,
+		<&gpucc GPU_CC_HUB_AON_CLK>,
+		<&gpucc GPU_CC_HUB_CX_INT_CLK>;
+
+	clock-names = "gcc_gpu_memnoc_gfx",
+			"gcc_gpu_snoc_dvm_gfx",
+			"gpu_cc_ahb",
+			"apb_pclk",
+			"gpu_cc_hlos1_vote_gpu_smmu",
+			"gpu_cc_cx_gmu",
+			"gpu_cc_hub_aon",
+			"gpu_cc_hub_cx_int";
+
+	qcom,chipid = <0x06030500>;
+	qcom,gpu-model = "Adreno643v1";
+
+	qcom,min-access-length = <32>;
+	qcom,ubwc-mode = <3>;
+
+	nvmem-cells = <&gpu_speed_bin>;
+	nvmem-cell-names = "speed_bin";
+
+	qcom,tzone-names = "gpuss-0-usr", "gpuss-1-usr";
+
+	interconnects = <&gem_noc MASTER_GFX3D 0 &mc_virt SLAVE_EBI1 0>;
+	interconnect-names = "gpu_icc_path";
+
+	qcom,bus-table-ddr =
+		<MHZ_TO_KBPS(0, 4)>,    /* index=0 */
+		<MHZ_TO_KBPS(200, 4)>,  /* index=1,  LOW_SVS */
+		<MHZ_TO_KBPS(451, 4)>,  /* index=2,  LOW_SVS  */
+		<MHZ_TO_KBPS(547, 4)>,  /* index=3,  LOW_SVS  */
+		<MHZ_TO_KBPS(681, 4)>,  /* index=4,  SVS */
+		<MHZ_TO_KBPS(768, 4)>,  /* index=5,  SVS  */
+		<MHZ_TO_KBPS(1555, 4)>, /* index=6,  SVS  */
+		<MHZ_TO_KBPS(1708, 4)>, /* index=7,  SVS_L1  */
+		<MHZ_TO_KBPS(2092, 4)>, /* index=8,  NOM  */
+		<MHZ_TO_KBPS(2736, 4)>, /* index=9, TURBO_L1  */
+		<MHZ_TO_KBPS(3196, 4)>; /* index=10, TURBO_L1  */
+
+	qcom,bus-table-cnoc =
+		<0>,   /* Off */
+		<100>; /* On */
+
+	zap-shader {
+		memory-region = <&gpu_microcode_mem>;
+	};
+
+	qcom,gpu-mempools {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "qcom,gpu-mempools";
+
+		/* 4K Page Pool configuration */
+		qcom,gpu-mempool@0 {
+			reg = <0>;
+			qcom,mempool-page-size = <4096>;
+			qcom,mempool-reserved = <2048>;
+			qcom,mempool-allocate;
+		};
+		/* 8K Page Pool configuration */
+		qcom,gpu-mempool@1 {
+			reg = <1>;
+			qcom,mempool-page-size = <8192>;
+			qcom,mempool-reserved = <1024>;
+			qcom,mempool-allocate;
+		};
+		/* 64K Page Pool configuration */
+		qcom,gpu-mempool@2 {
+			reg = <2>;
+			qcom,mempool-page-size = <65536>;
+			qcom,mempool-reserved = <256>;
+		};
+		/* 1M Page Pool configuration */
+		qcom,gpu-mempool@3 {
+			reg = <3>;
+			qcom,mempool-page-size = <1048576>;
+			qcom,mempool-reserved = <32>;
+		};
+	};
+};
+
+&soc {
+	kgsl_msm_iommu: qcom,kgsl-iommu@3da0000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		compatible = "qcom,kgsl-smmu-v2";
+
+		reg = <0x03da0000 0x20000>;
+
+		power-domains = <&gpucc GPU_CC_CX_GDSC>;
+
+		gfx3d_user: gfx3d_user {
+			compatible = "qcom,smmu-kgsl-cb", "qcom,adreno-gmu";
+			iommus = <&adreno_smmu 0 0x400>, <&adreno_smmu 1 0x400>;
+			qcom,iommu-dma = "disabled";
+		};
+
+	};
+
+	gmu: qcom,gmu@3d6a000 {
+		compatible = "qcom,gpu-gmu";
+
+		reg = <0x0 0x3d6a000 0x0 0x34000>,
+			<0x0 0xb290000 0x0 0x10000>;
+
+		reg-names = "kgsl_gmu_reg",
+			"kgsl_gmu_pdc_cfg";
+
+		interrupts = <0 304 IRQ_TYPE_LEVEL_HIGH>,
+			<0 305 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "kgsl_hfi_irq", "kgsl_gmu_irq";
+
+
+		iommus = <&adreno_smmu 0x5 0x400>;
+		qcom,iommu-dma = "disabled";
+
+		power-domains = <&gpucc GPU_CC_CX_GDSC>, <&gpucc GPU_CC_GX_GDSC>;
+		power-domain-names = "cx", "gx";
+
+		clocks = <&gpucc GPU_CC_CX_GMU_CLK>,
+			<&gpucc GPU_CC_CXO_CLK>,
+			<&gcc GCC_DDRSS_GPU_AXI_CLK>,
+			<&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+			<&gpucc GPU_CC_AHB_CLK>,
+			<&gpucc GPU_CC_HUB_CX_INT_CLK>,
+			<&gpucc GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK>;
+
+		clock-names = "gmu_clk", "cxo_clk", "axi_clk",
+			"memnoc_clk", "ahb_clk", "hub_clk", "smmu_vote";
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-graphics.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-graphics.dtso
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,gcc-sc7280.h>
+#include <dt-bindings/clock/qcom,gpucc-sc7280.h>
+#include <dt-bindings/interconnect/qcom,sc7280.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <dt-bindings/reset/qcom,sdm845-pdc.h>
+#include <dt-bindings/soc/qcom,rpmh-rsc.h>
+#include <dt-bindings/thermal/thermal.h>
+
+#include "qcm6490-graphics.dtsi"
+#include "qcm6490-graphics-pwrlevels.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCM6490 IDP";
+	compatible = "qcom,qcm6490-idp", "qcom,qcm6490";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-idp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-idp.dts
@@ -5,8 +5,16 @@
 
 /dts-v1/;
 
+/* PM7250B is configured to use SID8/9 */
+#define PM7250B_SID 8
+#define PM7250B_SID1 9
+
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
 #include <dt-bindings/regulator/qcom,rpmh-regulator.h>
 #include "sc7280.dtsi"
+#include "pm7250b.dtsi"
 #include "pm7325.dtsi"
 #include "pm8350c.dtsi"
 #include "pmk8350.dtsi"
@@ -29,10 +37,45 @@
 		serial0 = &uart5;
 	};
 
+	pm8350c_pwm_backlight: backlight {
+		compatible = "pwm-backlight";
+		pwms = <&pm8350c_pwm 3 65535>;
+		enable-gpios = <&pm8350c_gpios 7 GPIO_ACTIVE_HIGH>;
+		pinctrl-0 = <&pmic_lcd_bl_en>;
+		pinctrl-names = "default";
+	};
+
 	chosen {
 		stdout-path = "serial0:115200n8";
 	};
 
+	lcd_disp_bias: regulator-lcd-disp-bias {
+		compatible = "regulator-fixed";
+		regulator-name = "lcd_disp_bias";
+		regulator-min-microvolt = <5500000>;
+		regulator-max-microvolt = <5500000>;
+		gpio = <&pm7250b_gpios 2 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		pinctrl-0 = <&lcd_disp_bias_en>;
+		pinctrl-names = "default";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&key_vol_up_default>;
+		pinctrl-names = "default";
+
+		key-volume-up {
+			label = "Volume_up";
+			gpios = <&pm7325_gpios 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_VOLUMEUP>;
+			wakeup-source;
+			debounce-interval = <15>;
+			linux,can-disable;
+		};
+	};
+
 	reserved-memory {
 		xbl_mem: xbl@80700000 {
 			reg = <0x0 0x80700000 0x0 0x100000>;
@@ -109,7 +152,7 @@
 			no-map;
 		};
 
-		trusted_apps_mem: trusted_apps@c1800000 {
+		trusted_apps_mem: trusted-apps@c1800000 {
 			reg = <0x0 0xc1800000 0x0 0x1c00000>;
 			no-map;
 		};
@@ -123,8 +166,8 @@
 	vph_pwr: vph-pwr-regulator {
 		compatible = "regulator-fixed";
 		regulator-name = "vph_pwr";
-		regulator-min-microvolt = <2500000>;
-		regulator-max-microvolt = <4350000>;
+		regulator-min-microvolt = <3700000>;
+		regulator-max-microvolt = <3700000>;
 	};
 };
 
@@ -152,129 +195,151 @@
 		vdd-l14-l16-supply = <&vreg_s8b_1p272>;
 
 		vreg_s1b_1p872: smps1 {
+			regulator-name = "vreg_s1b_1p872";
 			regulator-min-microvolt = <1840000>;
 			regulator-max-microvolt = <2040000>;
 		};
 
 		vreg_s2b_0p876: smps2 {
+			regulator-name = "vreg_s2b_0p876";
 			regulator-min-microvolt = <570070>;
 			regulator-max-microvolt = <1050000>;
 		};
 
 		vreg_s7b_0p972: smps7 {
+			regulator-name = "vreg_s7b_0p972";
 			regulator-min-microvolt = <535000>;
 			regulator-max-microvolt = <1120000>;
 		};
 
 		vreg_s8b_1p272: smps8 {
+			regulator-name = "vreg_s8b_1p272";
 			regulator-min-microvolt = <1200000>;
 			regulator-max-microvolt = <1500000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_RET>;
 		};
 
 		vreg_l1b_0p912: ldo1 {
+			regulator-name = "vreg_l1b_0p912";
 			regulator-min-microvolt = <825000>;
 			regulator-max-microvolt = <925000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l2b_3p072: ldo2 {
+			regulator-name = "vreg_l2b_3p072";
 			regulator-min-microvolt = <2700000>;
 			regulator-max-microvolt = <3544000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l3b_0p504: ldo3 {
+			regulator-name = "vreg_l3b_0p504";
 			regulator-min-microvolt = <312000>;
 			regulator-max-microvolt = <910000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l4b_0p752: ldo4 {
+			regulator-name = "vreg_l4b_0p752";
 			regulator-min-microvolt = <752000>;
 			regulator-max-microvolt = <820000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		reg_l5b_0p752: ldo5 {
+			regulator-name = "reg_l5b_0p752";
 			regulator-min-microvolt = <552000>;
 			regulator-max-microvolt = <832000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l6b_1p2: ldo6 {
+			regulator-name = "vreg_l6b_1p2";
 			regulator-min-microvolt = <1140000>;
 			regulator-max-microvolt = <1260000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l7b_2p952: ldo7 {
+			regulator-name = "vreg_l7b_2p952";
 			regulator-min-microvolt = <2400000>;
 			regulator-max-microvolt = <3544000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l8b_0p904: ldo8 {
+			regulator-name = "vreg_l8b_0p904";
 			regulator-min-microvolt = <870000>;
 			regulator-max-microvolt = <970000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l9b_1p2: ldo9 {
+			regulator-name = "vreg_l9b_1p2";
 			regulator-min-microvolt = <1200000>;
 			regulator-max-microvolt = <1304000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l11b_1p504: ldo11 {
+			regulator-name = "vreg_l11b_1p504";
 			regulator-min-microvolt = <1504000>;
 			regulator-max-microvolt = <2000000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l12b_0p751: ldo12 {
+			regulator-name = "vreg_l12b_0p751";
 			regulator-min-microvolt = <751000>;
 			regulator-max-microvolt = <824000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l13b_0p53: ldo13 {
+			regulator-name = "vreg_l13b_0p53";
 			regulator-min-microvolt = <530000>;
 			regulator-max-microvolt = <824000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l14b_1p08: ldo14 {
+			regulator-name = "vreg_l14b_1p08";
 			regulator-min-microvolt = <1080000>;
 			regulator-max-microvolt = <1304000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l15b_0p765: ldo15 {
+			regulator-name = "vreg_l15b_0p765";
 			regulator-min-microvolt = <765000>;
 			regulator-max-microvolt = <1020000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l16b_1p1: ldo16 {
+			regulator-name = "vreg_l16b_1p1";
 			regulator-min-microvolt = <1100000>;
 			regulator-max-microvolt = <1300000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l17b_1p7: ldo17 {
+			regulator-name = "vreg_l17b_1p7";
 			regulator-min-microvolt = <1700000>;
 			regulator-max-microvolt = <1900000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l18b_1p8: ldo18 {
+			regulator-name = "vreg_l18b_1p8";
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <2000000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l19b_1p8: ldo19 {
+			regulator-name = "vreg_l19b_1p8";
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <2000000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
@@ -306,119 +371,299 @@
 		vdd-bob-supply = <&vph_pwr>;
 
 		vreg_s1c_2p19: smps1 {
+			regulator-name = "vreg_s1c_2p19";
 			regulator-min-microvolt = <2190000>;
 			regulator-max-microvolt = <2210000>;
 		};
 
 		vreg_s2c_0p752: smps2 {
+			regulator-name = "vreg_s2c_0p752";
 			regulator-min-microvolt = <750000>;
 			regulator-max-microvolt = <800000>;
 		};
 
 		vreg_s5c_0p752: smps5 {
+			regulator-name = "vreg_s5c_0p752";
 			regulator-min-microvolt = <465000>;
 			regulator-max-microvolt = <1050000>;
 		};
 
 		vreg_s7c_0p752: smps7 {
+			regulator-name = "vreg_s7c_0p752";
 			regulator-min-microvolt = <465000>;
 			regulator-max-microvolt = <800000>;
 		};
 
 		vreg_s9c_1p084: smps9 {
+			regulator-name = "vreg_s9c_1p084";
 			regulator-min-microvolt = <1010000>;
 			regulator-max-microvolt = <1170000>;
 		};
 
 		vreg_l1c_1p8: ldo1 {
+			regulator-name = "vreg_l1c_1p8";
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <1980000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l2c_1p62: ldo2 {
+			regulator-name = "vreg_l2c_1p62";
 			regulator-min-microvolt = <1620000>;
 			regulator-max-microvolt = <1980000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l3c_2p8: ldo3 {
+			regulator-name = "vreg_l3c_2p8";
 			regulator-min-microvolt = <2800000>;
 			regulator-max-microvolt = <3540000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l4c_1p62: ldo4 {
+			regulator-name = "vreg_l4c_1p62";
 			regulator-min-microvolt = <1620000>;
 			regulator-max-microvolt = <3300000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l5c_1p62: ldo5 {
+			regulator-name = "vreg_l5c_1p62";
 			regulator-min-microvolt = <1620000>;
 			regulator-max-microvolt = <3300000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l6c_2p96: ldo6 {
+			regulator-name = "vreg_l6c_2p96";
 			regulator-min-microvolt = <1650000>;
 			regulator-max-microvolt = <3544000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l7c_3p0: ldo7 {
+			regulator-name = "vreg_l7c_3p0";
 			regulator-min-microvolt = <3000000>;
 			regulator-max-microvolt = <3544000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l8c_1p62: ldo8 {
+			regulator-name = "vreg_l8c_1p62";
 			regulator-min-microvolt = <1620000>;
 			regulator-max-microvolt = <2000000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l9c_2p96: ldo9 {
+			regulator-name = "vreg_l9c_2p96";
 			regulator-min-microvolt = <2700000>;
 			regulator-max-microvolt = <35440000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l10c_0p88: ldo10 {
+			regulator-name = "vreg_l10c_0p88";
 			regulator-min-microvolt = <720000>;
 			regulator-max-microvolt = <1050000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l11c_2p8: ldo11 {
+			regulator-name = "vreg_l11c_2p8";
 			regulator-min-microvolt = <2800000>;
 			regulator-max-microvolt = <3544000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l12c_1p65: ldo12 {
+			regulator-name = "vreg_l12c_1p65";
 			regulator-min-microvolt = <1650000>;
 			regulator-max-microvolt = <2000000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l13c_2p7: ldo13 {
+			regulator-name = "vreg_l13c_2p7";
 			regulator-min-microvolt = <2700000>;
 			regulator-max-microvolt = <3544000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_bob_3p296: bob {
+			regulator-name = "vreg_bob_3p296";
 			regulator-min-microvolt = <3008000>;
 			regulator-max-microvolt = <3960000>;
 		};
 	};
 };
 
+&gpu {
+	status = "okay";
+};
+
+&gpu_zap_shader {
+	firmware-name = "qcom/qcm6490/a660_zap.mbn";
+};
+
+&mdss {
+	status = "okay";
+};
+
+&mdss_dsi {
+	vdda-supply = <&vreg_l6b_1p2>;
+	status = "okay";
+
+	panel@0 {
+		compatible = "novatek,nt36672e";
+		reg = <0>;
+
+		reset-gpios = <&tlmm 44 GPIO_ACTIVE_HIGH>;
+
+		vddi-supply = <&vreg_l8c_1p62>;
+		avdd-supply = <&lcd_disp_bias>;
+		avee-supply = <&lcd_disp_bias>;
+
+		backlight = <&pm8350c_pwm_backlight>;
+
+		port {
+			panel0_in: endpoint {
+				remote-endpoint = <&mdss_dsi0_out>;
+			};
+		};
+	};
+};
+
+&mdss_dsi0_out {
+	remote-endpoint = <&panel0_in>;
+	data-lanes = <0 1 2 3>;
+};
+
+&mdss_dsi_phy {
+	vdds-supply = <&vreg_l10c_0p88>;
+	status = "okay";
+};
+
+&pm7250b_gpios {
+	lcd_disp_bias_en: lcd-disp-bias-en-state {
+		pins = "gpio2";
+		function = "func1";
+		bias-disable;
+		qcom,drive-strength = <PMIC_GPIO_STRENGTH_LOW>;
+		input-disable;
+		output-enable;
+		power-source = <0>;
+	};
+};
+
+&pm8350c_gpios {
+	pmic_lcd_bl_en: pmic-lcd-bl-en-state {
+		pins = "gpio7";
+		function = "normal";
+		bias-disable;
+		qcom,drive-strength = <PMIC_GPIO_STRENGTH_LOW>;
+		output-low;
+		power-source = <0>;
+	};
+
+	pmic_lcd_bl_pwm: pmic-lcd-bl-pwm-state {
+		pins = "gpio8";
+		function = "func1";
+		bias-disable;
+		qcom,drive-strength = <PMIC_GPIO_STRENGTH_LOW>;
+		output-low;
+		power-source = <0>;
+	};
+};
+
+&pm7325_gpios {
+	key_vol_up_default: key-vol-up-state {
+		pins = "gpio6";
+		function = "normal";
+		input-enable;
+		bias-pull-up;
+		qcom,drive-strength = <PMIC_GPIO_STRENGTH_LOW>;
+	};
+};
+
+&pm8350c_pwm {
+	pinctrl-0 = <&pmic_lcd_bl_pwm>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	multi-led {
+		color = <LED_COLOR_ID_RGB>;
+		function = LED_FUNCTION_STATUS;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+	};
+};
+
+&pon_pwrkey {
+	status = "okay";
+};
+
+&pon_resin {
+	linux,code = <KEY_VOLUMEDOWN>;
+	status = "okay";
+};
+
 &qupv3_id_0 {
 	status = "okay";
 };
 
+&remoteproc_adsp {
+	firmware-name = "qcom/qcm6490/adsp.mbn";
+	status = "okay";
+};
+
+&remoteproc_cdsp {
+	firmware-name = "qcom/qcm6490/cdsp.mbn";
+	status = "okay";
+};
+
+&remoteproc_mpss {
+	firmware-name = "qcom/qcm6490/modem.mbn";
+	status = "okay";
+};
+
+&remoteproc_wpss {
+	firmware-name = "qcom/qcm6490/wpss.mbn";
+	status = "okay";
+};
+
+&sdc2_clk {
+	bias-disable;
+	drive-strength = <16>;
+};
+
+&sdc2_cmd {
+	bias-pull-up;
+	drive-strength = <10>;
+};
+
+&sdc2_data {
+	bias-pull-up;
+	drive-strength = <10>;
+};
+
 &sdhc_1 {
 	non-removable;
 	no-sd;
@@ -430,13 +675,30 @@
 	status = "okay";
 };
 
+&sdhc_2 {
+	status = "okay";
+
+	pinctrl-0 = <&sdc2_clk>, <&sdc2_cmd>, <&sdc2_data>, <&sd_cd>;
+	pinctrl-1 = <&sdc2_clk_sleep>, <&sdc2_cmd_sleep>, <&sdc2_data_sleep>, <&sd_cd>;
+
+	vmmc-supply = <&vreg_l9c_2p96>;
+	vqmmc-supply = <&vreg_l6c_2p96>;
+
+	cd-gpios = <&tlmm 91 GPIO_ACTIVE_LOW>;
+};
+
 &tlmm {
 	gpio-reserved-ranges = <32 2>, /* ADSP */
 			       <48 4>; /* NFC */
+
+	sd_cd: sd-cd-state {
+		pins = "gpio91";
+		function = "gpio";
+		bias-pull-up;
+	};
 };
 
 &uart5 {
-	compatible = "qcom,geni-debug-uart";
 	status = "okay";
 };
 
@@ -445,6 +707,7 @@
 };
 
 &usb_1_dwc3 {
+	/delete-property/ usb-role-switch;
 	dr_mode = "peripheral";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-video.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-video.dtsi
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+&venus {
+	compatible = "qcom,qcm6490-iris-vpu";
+	status = "okay";
+	interconnect-names = "iris-cnoc", "iris-ddr";
+	non-secure-cb {
+		compatible = "qcom,vidc,cb-ns";
+		iommus = <&apps_smmu 0x2180 0x20>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490-video.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490-video.dtso
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include "qcm6490-video.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm6490.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm6490.dtsi
@@ -0,0 +1,605 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/soc/qcom,gpr.h>
+#include <dt-bindings/sound/qcom,q6afe.h>
+#include "sc7280.dtsi"
+
+/*
+ * Delete unused sc7280 memory nodes and define the memory regions
+ * required by qcm6490
+ */
+/delete-node/ &rmtfs_mem;
+/delete-node/ &wpss_mem;
+/delete-node/ &adsp_mem;
+/delete-node/ &cdsp_mem;
+/delete-node/ &remoteproc_adsp;
+
+/{
+	firmware {
+		scm {
+			qcom,dload-mode = <&tcsr_2 0x13000>;
+		};
+	};
+
+	psci {
+		mode-bootloader = <0x10001 0x2>;
+		mode-edl = <0 0x1>;
+	};
+
+	reboot-mode {
+		status = "disabled";
+	};
+
+	reserved-memory {
+		camera_mem: camera@84300000 {
+			reg = <0x0 0x84300000 0x0 0x500000>;
+			no-map;
+		};
+
+		wpss_mem: wpss@84800000 {
+			reg = <0x0 0x84800000 0x0 0x1900000>;
+			no-map;
+		};
+
+		adsp_mem: adsp@86100000 {
+			reg = <0x0 0x86100000 0x0 0x2800000>;
+			no-map;
+		};
+
+		cdsp_mem: cdsp@88900000 {
+			reg = <0x0 0x88900000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		cvp_mem: cvp@8ae00000 {
+			reg = <0x0 0x8ae00000 0x0 0x500000>;
+			no-map;
+		};
+
+		ipa_gsi_mem: ipa-gsi@8b310000 {
+			reg = <0x0 0x8b310000 0x0 0xa000>;
+			no-map;
+		};
+
+		gpu_microcode_mem: gpu-microcode@8b31a000 {
+			reg = <0x0 0x8b31a000 0x0 0x2000>;
+			no-map;
+		};
+
+		mpss_mem: mpss@8b800000 {
+			reg = <0x0 0x8b800000 0x0 0xf600000>;
+			no-map;
+		};
+
+		tz_stat_mem: tz-stat@c0000000 {
+			reg = <0x0 0xc0000000 0x0 0x100000>;
+			no-map;
+		};
+
+		tags_mem: tags@c0100000 {
+			reg = <0x0 0xc0100000 0x0 0x1200000>;
+			no-map;
+		};
+
+		qtee_mem: qtee@c1300000 {
+			reg = <0x0 0xc1300000 0x0 0x500000>;
+			no-map;
+		};
+
+		trusted_apps_mem: trusted_apps@c1800000 {
+			reg = <0x0 0xc1800000 0x0 0x1c00000>;
+			no-map;
+		};
+
+		debug_vm_mem: debug-vm@d0600000 {
+			reg = <0x0 0xd0600000 0x0 0x100000>;
+			no-map;
+		};
+
+		adsp_heap_mem: adsp-heap {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0xc00000>;
+		};
+
+		cdsp_secure_heap: secure-cdsp-region { /* Secure DSP */
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x2000000>;
+		};
+	};
+};
+
+&CPU0 {
+	CPU0_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <2000000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU1 {
+	CPU1_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <2000000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU2 {
+	CPU2_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <2000000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU3 {
+	CPU3_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <2000000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU4 {
+	CPU4_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <2000000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU5 {
+	CPU5_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <2000000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU6 {
+	CPU6_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <2000000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU7 {
+	CPU7_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <2000000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&gcc {
+	protected-clocks = <GCC_AGGRE_NOC_PCIE_1_AXI_CLK> ,<GCC_PCIE_1_AUX_CLK>,
+			<GCC_PCIE_1_AUX_CLK_SRC>, <GCC_PCIE_1_CFG_AHB_CLK>,
+			<GCC_PCIE_1_MSTR_AXI_CLK>, <GCC_PCIE_1_PHY_RCHNG_CLK_SRC>,
+			<GCC_PCIE_1_PIPE_CLK>, <GCC_PCIE_1_PIPE_CLK_SRC>,
+			<GCC_PCIE_1_SLV_AXI_CLK>, <GCC_PCIE_1_SLV_Q2A_AXI_CLK>,
+			<GCC_QSPI_CNOC_PERIPH_AHB_CLK>, <GCC_QSPI_CORE_CLK>,
+			<GCC_QSPI_CORE_CLK_SRC>,<GCC_USB30_SEC_MASTER_CLK>,
+			<GCC_USB30_SEC_MASTER_CLK_SRC>, <GCC_USB30_SEC_MOCK_UTMI_CLK>,
+			<GCC_USB30_SEC_MOCK_UTMI_CLK_SRC>,
+			<GCC_USB30_SEC_MOCK_UTMI_POSTDIV_CLK_SRC>, <GCC_USB30_SEC_SLEEP_CLK>,
+			<GCC_USB3_SEC_PHY_AUX_CLK>, <GCC_USB3_SEC_PHY_AUX_CLK_SRC>,
+			<GCC_USB3_SEC_PHY_COM_AUX_CLK>, <GCC_USB3_SEC_PHY_PIPE_CLK>,
+			<GCC_USB3_SEC_PHY_PIPE_CLK_SRC>, <GCC_CFG_NOC_LPASS_CLK>,
+			<GCC_MSS_GPLL0_MAIN_DIV_CLK_SRC>, <GCC_MSS_CFG_AHB_CLK>,
+			<GCC_MSS_OFFLINE_AXI_CLK>, <GCC_MSS_SNOC_AXI_CLK>,
+			<GCC_MSS_Q6_MEMNOC_AXI_CLK>, <GCC_MSS_Q6SS_BOOT_CLK_SRC>,
+			<GCC_SEC_CTRL_CLK_SRC>, <GCC_WPSS_AHB_CLK>,
+			<GCC_WPSS_AHB_BDG_MST_CLK>, <GCC_WPSS_RSCP_CLK>;
+};
+
+&ipa {
+	qcom,gsi-loader = "self";
+	memory-region = <&ipa_fw_mem>;
+	firmware-name = "qcom/qcm6490/ipa_fws.mdt";
+	status = "okay";
+};
+
+&ipa_fw_mem {
+	reg = <0x0 0x8b300000 0x0 0x10000>;
+};
+
+&lpass_audiocc {
+	qcom,adsp-skip-pll;
+	protected-clocks = <LPASS_AUDIO_CC_CDIV_RX_MCLK_DIV_CLK_SRC>,
+		<LPASS_AUDIO_CC_CODEC_MEM0_CLK>, <LPASS_AUDIO_CC_CODEC_MEM1_CLK>,
+		<LPASS_AUDIO_CC_CODEC_MEM2_CLK>, <LPASS_AUDIO_CC_CODEC_MEM_CLK>,
+		<LPASS_AUDIO_CC_EXT_MCLK0_CLK>, <LPASS_AUDIO_CC_EXT_MCLK0_CLK_SRC>,
+		<LPASS_AUDIO_CC_EXT_MCLK1_CLK>, <LPASS_AUDIO_CC_EXT_MCLK1_CLK_SRC>,
+		<LPASS_AUDIO_CC_PLL>, <LPASS_AUDIO_CC_PLL_OUT_AUX2>,
+		<LPASS_AUDIO_CC_PLL_OUT_AUX2_DIV_CLK_SRC>,
+		<LPASS_AUDIO_CC_PLL_OUT_MAIN_DIV_CLK_SRC>,
+		<LPASS_AUDIO_CC_RX_MCLK_2X_CLK>, <LPASS_AUDIO_CC_RX_MCLK_CLK>,
+		<LPASS_AUDIO_CC_RX_MCLK_CLK_SRC>;
+	/delete-property/ power-domains;
+};
+
+&lpass_aon {
+	status = "disabled";
+};
+
+&lpass_core {
+	status = "disabled";
+};
+
+&lpass_hm {
+	status = "disabled";
+};
+
+&lpass_rx_macro {
+	/delete-property/ power-domains;
+	/delete-property/ power-domain-names;
+	clocks = <&q6prmcc LPASS_CLK_ID_TX_CORE_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_CLK_ID_TX_CORE_NPL_MCLK  LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_CLK_ID_RX_CORE_MCLK  LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_CLK_ID_RX_CORE_NPL_MCLK  LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&lpass_va_macro>;
+	clock-names = "mclk", "npl", "rx-mclk", "rx-npl", "macro", "dcodec", "fsgen";
+
+	qcom,rx_mclk_mode_muxsel = <0x033240D8>;
+
+	status = "okay";
+};
+
+&lpass_tlmm {
+	clocks = <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>;
+	clock-names = "core", "audio";
+
+	lpass_dmic45_clk: dmic45-clk-state {
+		pins = "gpio12";
+		function = "dmic3_clk";
+	};
+
+	lpass_dmic45_data: dmic45-data-state {
+		pins = "gpio13";
+		function = "dmic3_data";
+	};
+};
+
+&lpass_tx_macro {
+	/delete-property/ power-domains;
+	/delete-property/ power-domain-names;
+	clocks = <&q6prmcc LPASS_CLK_ID_TX_CORE_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_CLK_ID_TX_CORE_NPL_MCLK  LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&lpass_va_macro>;
+	clock-names = "mclk", "npl", "macro", "dcodec", "fsgen";
+
+	status = "okay";
+};
+
+&lpass_va_macro {
+	/delete-property/ power-domains;
+	/delete-property/ power-domain-names;
+	clocks = <&q6prmcc LPASS_CLK_ID_VA_CORE_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>;
+	clock-names = "mclk", "macro", "dcodec";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&lpass_dmic01_clk>, <&lpass_dmic01_data>,
+		    <&lpass_dmic23_clk>, <&lpass_dmic23_data>,
+		    <&lpass_dmic45_clk>, <&lpass_dmic45_data>;
+
+	status = "okay";
+};
+
+&lpass_wsa_macro {
+	/delete-property/ power-domains;
+	/delete-property/ power-domain-names;
+	clocks = <&q6prmcc LPASS_CLK_ID_TX_CORE_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_CLK_ID_TX_CORE_NPL_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+		 <&lpass_va_macro>;
+	clock-names = "mclk", "npl", "macro", "dcodec", "fsgen";
+
+	status = "okay";
+};
+
+&soc {
+	refgen:regulator@88e7000 {
+		compatible = "qcom,sm8250-refgen-regulator";
+		reg = <0x0 0x088e7000 0x0 0x84>;
+	};
+
+	remoteproc_adsp: remoteproc@3000000 {
+		compatible = "qcom,sc7280-adsp-pas";
+		reg = <0x0 0x03000000 0x0 0x100>;
+
+		interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
+					<&adsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>,
+					<&adsp_smp2p_in 1 IRQ_TYPE_EDGE_RISING>,
+					<&adsp_smp2p_in 2 IRQ_TYPE_EDGE_RISING>,
+					<&adsp_smp2p_in 3 IRQ_TYPE_EDGE_RISING>,
+					<&adsp_smp2p_in 7 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "wdog", "fatal", "ready", "handover",
+				"stop-ack", "shutdown-ack";
+
+		clocks = <&rpmhcc RPMH_CXO_CLK>;
+		clock-names = "xo";
+
+		power-domains = <&rpmhpd SC7280_CX>,
+				<&rpmhpd SC7280_MX>;
+		power-domain-names = "cx", "mx";
+
+		memory-region = <&adsp_mem>;
+
+		qcom,qmp = <&aoss_qmp>;
+
+		qcom,smem-states = <&adsp_smp2p_out 0>;
+		qcom,smem-state-names = "stop";
+
+		status = "disabled";
+
+		remoteproc_adsp_glink: glink-edge {
+			interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+						IPCC_MPROC_SIGNAL_GLINK_QMP
+						IRQ_TYPE_EDGE_RISING>;
+			mboxes = <&ipcc IPCC_CLIENT_LPASS
+					IPCC_MPROC_SIGNAL_GLINK_QMP>;
+			label = "adsp";
+			qcom,remote-pid = <2>;
+
+			fastrpc {
+				compatible = "qcom,fastrpc";
+				qcom,glink-channels = "fastrpcglink-apps-dsp";
+				label = "adsp";
+				memory-region = <&adsp_heap_mem>;
+				qcom,vmids = <22 37>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				compute-cb@1 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <3>;
+					iommus = <&apps_smmu 0x1803 0x0>;
+					dma-coherent;
+				};
+
+				compute-cb@2 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <4>;
+					iommus = <&apps_smmu 0x1804 0x0>;
+					dma-coherent;
+				};
+
+				compute-cb@3 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <5>;
+					iommus = <&apps_smmu 0x1805 0x0>;
+					qcom,nsessions = <5>;
+					dma-coherent;
+				};
+			};
+
+			gpr {
+				compatible = "qcom,gpr";
+				qcom,glink-channels = "adsp_apps";
+				qcom,domain = <GPR_DOMAIN_ID_ADSP>;
+				qcom,intents = <512 20>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				q6apm: service@1 {
+					compatible = "qcom,q6apm";
+					reg = <GPR_APM_MODULE_IID>;
+					#sound-dai-cells = <0>;
+
+					q6apmbedai: bedais {
+						compatible = "qcom,q6apm-lpass-dais";
+						#sound-dai-cells = <1>;
+					};
+					q6apmdai: dais {
+						compatible = "qcom,q6apm-dais";
+						iommus = <&apps_smmu 0x1801 0x0>;
+					};
+				};
+
+				q6prm: service@2 {
+					compatible = "qcom,q6prm";
+					reg = <GPR_PRM_MODULE_IID>;
+
+					q6prmcc: clock-controller {
+						compatible = "qcom,q6prm-lpass-clocks";
+						#clock-cells = <2>;
+					};
+				};
+
+				spf-core {
+					compatible = "qcom,spf_core";
+					reg = <GPR_AMDB_MODULE_IID>;
+				};
+
+				audio-pkt {
+					compatible = "qcom,audio-pkt";
+					reg = <GPR_VCPM_MODULE_IID>;
+
+					qcom,audiopkt-ch-name = "apr_audio_svc";
+				};
+			};
+		};
+	};
+
+	remoteproc_cdsp: remoteproc@a300000 {
+		compatible = "qcom,sc7280-cdsp-pas";
+		reg = <0x0 0x0a300000 0x0 0x100000>;
+
+		interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
+					<&cdsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>,
+					<&cdsp_smp2p_in 1 IRQ_TYPE_EDGE_RISING>,
+					<&cdsp_smp2p_in 2 IRQ_TYPE_EDGE_RISING>,
+					<&cdsp_smp2p_in 3 IRQ_TYPE_EDGE_RISING>,
+					<&cdsp_smp2p_in 7 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "wdog", "fatal", "ready", "handover",
+				"stop-ack", "shutdown-ack";
+
+		clocks = <&rpmhcc RPMH_CXO_CLK>;
+		clock-names = "xo";
+
+		power-domains = <&rpmhpd SC7280_CX>,
+				<&rpmhpd SC7280_MX>;
+		power-domain-names = "cx", "mx";
+
+		memory-region = <&cdsp_mem>;
+
+		qcom,qmp = <&aoss_qmp>;
+
+		qcom,smem-states = <&cdsp_smp2p_out 0>;
+		qcom,smem-state-names = "stop";
+
+		interconnects = <&nsp_noc MASTER_CDSP_PROC 0 &mc_virt SLAVE_EBI1 0>;
+
+		status = "disabled";
+
+		glink-edge {
+			interrupts-extended = <&ipcc IPCC_CLIENT_CDSP
+						IPCC_MPROC_SIGNAL_GLINK_QMP
+						IRQ_TYPE_EDGE_RISING>;
+			mboxes = <&ipcc IPCC_CLIENT_CDSP
+					IPCC_MPROC_SIGNAL_GLINK_QMP>;
+			label = "cdsp";
+			qcom,remote-pid = <5>;
+
+			fastrpc {
+				compatible = "qcom,fastrpc";
+				qcom,glink-channels = "fastrpcglink-apps-dsp";
+				label = "cdsp";
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				compute-cb@1 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <1>;
+					iommus = <&apps_smmu 0x11A1 0x0420>,
+						 <&apps_smmu 0x1181 0x0420>;
+					dma-coherent;
+				};
+
+				compute-cb@2 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <2>;
+					iommus = <&apps_smmu 0x11A2 0x0420>,
+						 <&apps_smmu 0x1182 0x0420>;
+					dma-coherent;
+				};
+
+				compute-cb@3 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <3>;
+					iommus = <&apps_smmu 0x11A3 0x0420>,
+						 <&apps_smmu 0x1183 0x0420>;
+					dma-coherent;
+				};
+
+				compute-cb@4 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <4>;
+					iommus = <&apps_smmu 0x11A4 0x0420>,
+						 <&apps_smmu 0x1184 0x0420>;
+					dma-coherent;
+				};
+
+				compute-cb@5 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <5>;
+					iommus = <&apps_smmu 0x11A5 0x0420>,
+						 <&apps_smmu 0x1185 0x0420>;
+					dma-coherent;
+				};
+
+				compute-cb@6 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <6>;
+					iommus = <&apps_smmu 0x11A6 0x0420>,
+						 <&apps_smmu 0x1186 0x0420>;
+					dma-coherent;
+				};
+
+				compute-cb@7 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <7>;
+					iommus = <&apps_smmu 0x11A7 0x0420>,
+						 <&apps_smmu 0x1187 0x0420>;
+					dma-coherent;
+				};
+
+				compute-cb@8 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <8>;
+					iommus = <&apps_smmu 0x11A8 0x0420>,
+						 <&apps_smmu 0x1188 0x0420>;
+					dma-coherent;
+				};
+
+				/* note: secure cb9 in downstream */
+
+				compute-cb@10 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <12>;
+					iommus = <&apps_smmu 0x11AC 0x0420>,
+						 <&apps_smmu 0x118C 0x0420>;
+					dma-coherent;
+				};
+
+				compute-cb@11 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <13>;
+					iommus = <&apps_smmu 0x11AD 0x0420>,
+						 <&apps_smmu 0x118D 0x0420>;
+					dma-coherent;
+				};
+
+				compute-cb@12 {
+					compatible = "qcom,fastrpc-compute-cb";
+					reg = <14>;
+					iommus = <&apps_smmu 0x11AE 0x0420>,
+						 <&apps_smmu 0x118E 0x0420>;
+					dma-coherent;
+				};
+			};
+		};
+	};
+};
+
+&swr0 {
+	status = "okay";
+};
+
+&swr1 {
+	status = "okay";
+};
+
+&swr2 {
+	status = "okay";
+};
+
+&tlmm {
+	gpio-reserved-ranges = <32 2>, <48 4>;
+};
+
+&video_mem {
+	reg = <0x0 0x8a700000 0x0 0x700000>;
+};
+
+&xbl_mem {
+	reg = <0x0 0x80700000 0x0 0x100000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcm8550.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcm8550.dtsi
@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "sm8550.dtsi"
+
+/delete-node/ &reserved_memory;
+
+/ {
+	reserved_memory: reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		/*
+		 * There are 3 types of reserved memory regions here:
+		 * 1. Firmware related regions.
+		 *     This will be described as: reserved-region@address. Current
+		 * reserved-region may have reserved area which was not yet used,
+		 * release note of the firmware can have such kind of information.
+		 * 2. Firmware related which shared with kernel access.
+		 *     Each region will have a specific node with specific label
+		 * name for later phandle reference from other driver dt node. May
+		 * overlapping with above type regions.
+		 * 3. PIL regions.
+		 *     PIL regions are allocated by kernel and assigned to subsystem
+		 * firmware later.
+		 * Here is a map for this platform:
+		 * 0x100000000 +------------------+
+		 *             |                  |
+		 *             | Firmware Related |
+		 *             |                  |
+		 *  0xd4d00000 +------------------+
+		 *             |                  |
+		 *             | Kernel Available |
+		 *             |                  |
+		 *  0xA7000000 +------------------+
+		 *             |                  |
+		 *             |    PIL Region    |
+		 *             |                  |
+		 *  0x8A800000 +------------------+
+		 *             |                  |
+		 *             | Firmware Related |
+		 *             |                  |
+		 *  0x80000000 +------------------+
+		 * Note that:
+		 * 1. 0xA7000000 to 0xA8000000 was used by bootloader as well, not
+		 * suggest for other usage.
+		 * 2. Kernel start address was start at 0xA8000000.
+		 */
+
+		/* Firmware related regions */
+		reserved-region@80000000 {
+			reg = <0x0 0x80000000 0x0 0xa800000>;
+			no-map;
+		};
+
+		aop_image_mem: aop-image-region@81c00000 {
+			reg = <0x0 0x81c00000 0x0 0x60000>;
+			no-map;
+		};
+
+		aop_cmd_db_mem: aop-cmd-db-region@81c60000 {
+			compatible = "qcom,cmd-db";
+			reg = <0x0 0x81c60000 0x0 0x20000>;
+			no-map;
+		};
+
+		aop_config_mem: aop-config-region@81c80000 {
+			no-map;
+			reg = <0x0 0x81c80000 0x0 0x20000>;
+		};
+
+		smem_mem: smem-region@81d00000 {
+			compatible = "qcom,smem";
+			reg = <0x0 0x81d00000 0x0 0x200000>;
+			hwlocks = <&tcsr_mutex 3>;
+			no-map;
+		};
+
+		adsp_mhi_mem: adsp-mhi-region@81f00000 {
+			reg = <0x0 0x81f00000 0x0 0x20000>;
+			no-map;
+		};
+
+		/* PIL region */
+		mpss_mem: mpss-region@8a800000 {
+			reg = <0x0 0x8a800000 0x0 0x10800000>;
+			no-map;
+		};
+
+		q6_mpss_dtb_mem: q6-mpss-dtb-region@9b000000 {
+			reg = <0x0 0x9b000000 0x0 0x80000>;
+			no-map;
+		};
+
+		ipa_fw_mem: ipa-fw-region@9b080000 {
+			reg = <0x0 0x9b080000 0x0 0x10000>;
+			no-map;
+		};
+
+		ipa_gsi_mem: ipa-gsi-region@9b090000 {
+			reg = <0x0 0x9b090000 0x0 0xa000>;
+			no-map;
+		};
+
+		gpu_micro_code_mem: gpu-micro-code-region@9b09a000 {
+			reg = <0x0 0x9b09a000 0x0 0x2000>;
+			no-map;
+		};
+
+		spss_region_mem: spss-region@9b100000 {
+			reg = <0x0 0x9b100000 0x0 0x180000>;
+			no-map;
+		};
+
+		spu_secure_shared_memory_mem: spu-secure-shared-memory-region@9b280000 {
+			reg = <0x0 0x9b280000 0x0 0x80000>;
+			no-map;
+		};
+
+		camera_mem: camera-region@9b300000 {
+			reg = <0x0 0x9b300000 0x0 0x800000>;
+			no-map;
+		};
+
+		video_mem: video-region@9bb00000 {
+			reg = <0x0 0x9bb00000 0x0 0x700000>;
+			no-map;
+		};
+
+		cvp_mem: cvp-region@9c200000 {
+			reg = <0x0 0x9c200000 0x0 0x700000>;
+			no-map;
+		};
+
+		cdsp_mem: cdsp-region@9c900000 {
+			reg = <0x0 0x9c900000 0x0 0x2000000>;
+			no-map;
+		};
+
+		q6_cdsp_dtb_mem: q6-cdsp-dtb-region@9e900000 {
+			reg = <0x0 0x9e900000 0x0 0x80000>;
+			no-map;
+		};
+
+		q6_adsp_dtb_mem: q6-adsp-dtb-region@9e980000 {
+			reg = <0x0 0x9e980000 0x0 0x80000>;
+			no-map;
+		};
+
+		adspslpi_mem: adspslpi-region@9ea00000 {
+			reg = <0x0 0x9ea00000 0x0 0x4080000>;
+			no-map;
+		};
+
+		/* Firmware related regions */
+		mpss_dsm_mem: mpss_dsm_region@d4d00000 {
+			reg = <0x0 0xd4d00000 0x0 0x3300000>;
+			no-map;
+		};
+
+		reserved-region@d8000000 {
+			reg = <0x0 0xd8000000 0x0 0x28000000>;
+			no-map;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs404-evb.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs404-evb.dtsi
@@ -62,7 +62,7 @@
 		vddrf-supply = <&vreg_l1_1p3>;
 		vddch0-supply = <&vdd_ch0_3p3>;
 
-		local-bd-address = [ 02 00 00 00 5a ad ];
+		local-bd-address = [ 00 00 00 00 00 00 ];
 
 		max-speed = <3200000>;
 	};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp1-addons-rb3gen2-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp1-addons-rb3gen2-hsp.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp1-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp1 addons rb3gen2 hsp platform";
+	compatible = "qcom,qcs5430-fp1-addons-rb3gen2-hsp","qcom,qcs5430";
+	qcom,msm-id = <0x1023F 0x10000>;
+	qcom,board-id = <32 0x6>, <32 0x606>;
+};
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp1-addons-rb3gen2-vision-mezz-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp1-addons-rb3gen2-vision-mezz-hsp.dts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp1-addons-rb3gen2-vision-mezz.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp1 addons rb3gen2 vision mezz hsp platform";
+	compatible = "qcom,qcs5430-fp1-addons-rb3gen2-vision-mezz-hsp","qcom,qcs5430";
+	qcom,msm-id = <0x1023F 0x10000>;
+	qcom,board-id = <32 0x7>, <32 0x607>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp1-addons-rb3gen2-vision-mezz.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp1-addons-rb3gen2-vision-mezz.dts
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp1-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp1 addons rb3gen2 vision mezz platform";
+	compatible = "qcom,qcs5430-fp1-addons-rb3gen2-vision-mezz","qcom,qcs5430";
+	qcom,msm-id = <0x1023F 0x10000>;
+	qcom,board-id = <32 0x2>, <32 0x602>;
+};
+
+&mi2s0_data0 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_data1 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_mclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_sclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_ws {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&q6apmbedai {
+	qcom,prmcc_clk = <&q6prmcc>;
+};
+
+&sound {
+	compatible = "qcom,qcm6490-sndcard";
+	model = "qcm6490-rb3-vision-snd-card";
+
+	audio-routing =
+		"SpkrLeft IN", "WSA_SPK1 OUT",
+		"SpkrRight IN", "WSA_SPK2 OUT",
+		"VA DMIC0", "vdd-micb",
+		"VA DMIC1", "vdd-micb",
+		"VA DMIC2", "vdd-micb",
+		"VA DMIC3", "vdd-micb",
+		"VA DMIC4", "vdd-micb",
+		"VA DMIC5", "vdd-micb";
+
+	pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep";
+	pinctrl-0 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+	pinctrl-1 = <&mi2s0_data0>, <&mi2s0_data1>, <&mi2s0_mclk>, <&mi2s0_sclk>, <&mi2s0_ws>;
+	pinctrl-2 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+
+	mi2s-capture-dai-link {
+		link-name = "MI2S-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	mi2s-playback-dai-link {
+		link-name = "MI2S-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+	tdm-capture-dai-link {
+		link-name = "TDM-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	tdm-playback-dai-link {
+		link-name = "TDM-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+};
+
+&tlmm {
+	mi2s0_data0_sleep: mi2s0-data0-sleep {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_data1_sleep: mi2s0-data1-sleep {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_mclk_sleep: mi2s0-mclk-sleep {
+		pins = "gpio96";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_sclk_sleep: mi2s0-sclk-sleep {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_ws_sleep: mi2s0-ws-sleep {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp1-addons-rb3gen2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp1-addons-rb3gen2.dts
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs6490-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp1 addons rb3gen2 platform";
+	compatible = "qcom,qcs5430-fp1-addons-rb3gen2","qcom,qcs5430";
+	qcom,msm-id = <0x1023F 0x10000>;
+	qcom,board-id = <32 0x5>, <32 0x605>;
+
+	cpus {
+		cpu-map {
+			cluster0 {
+				/delete-node/ core6;
+				/delete-node/ core7;
+			};
+		};
+	};
+};
+
+&CPU6 {
+	enable-method = "none";
+};
+
+&CPU7 {
+	enable-method = "none";
+};
+
+&pcie1 {
+	status = "ok";
+};
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp1p5-addons-rb3gen2-vision-mezz.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp1p5-addons-rb3gen2-vision-mezz.dts
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp1p5-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp1p5 addons rb3gen2 vision mezz platform";
+	compatible = "qcom,qcs5430-fp1p5-addons-rb3gen2-vision-mezz","qcom,qcs5430";
+	qcom,msm-id = <0x9023F 0x10000>;
+	qcom,board-id = <32 0x2>, <32 0x602>;
+};
+
+&mi2s0_data0 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_data1 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_mclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_sclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_ws {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&q6apmbedai {
+	qcom,prmcc_clk = <&q6prmcc>;
+};
+
+&sound {
+	compatible = "qcom,qcm6490-sndcard";
+	model = "qcm6490-rb3-vision-snd-card";
+
+	audio-routing =
+		"SpkrLeft IN", "WSA_SPK1 OUT",
+		"SpkrRight IN", "WSA_SPK2 OUT",
+		"VA DMIC0", "vdd-micb",
+		"VA DMIC1", "vdd-micb",
+		"VA DMIC2", "vdd-micb",
+		"VA DMIC3", "vdd-micb",
+		"VA DMIC4", "vdd-micb",
+		"VA DMIC5", "vdd-micb";
+
+	pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep";
+	pinctrl-0 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+	pinctrl-1 = <&mi2s0_data0>, <&mi2s0_data1>, <&mi2s0_mclk>, <&mi2s0_sclk>, <&mi2s0_ws>;
+	pinctrl-2 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+
+	mi2s-capture-dai-link {
+		link-name = "MI2S-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	mi2s-playback-dai-link {
+		link-name = "MI2S-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+	tdm-capture-dai-link {
+		link-name = "TDM-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	tdm-playback-dai-link {
+		link-name = "TDM-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+};
+
+&tlmm {
+	mi2s0_data0_sleep: mi2s0-data0-sleep {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_data1_sleep: mi2s0-data1-sleep {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_mclk_sleep: mi2s0-mclk-sleep {
+		pins = "gpio96";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_sclk_sleep: mi2s0-sclk-sleep {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_ws_sleep: mi2s0-ws-sleep {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp1p5-addons-rb3gen2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp1p5-addons-rb3gen2.dts
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp1-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp1p5 addons rb3gen2 platform";
+	compatible = "qcom,qcs5430-fp1p5-addons-rb3gen2","qcom,qcs5430";
+	qcom,msm-id = <0x9023F 0x10000>;
+	qcom,board-id = <32 0x5>, <32 0x605>;
+};
+
+&pcie1 {
+	status = "ok";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2-addons-rb3gen2-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2-addons-rb3gen2-hsp.dts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp2-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp2 addons rb3gen2 hsp platform";
+	compatible = "qcom,qcs5430-fp2-addons-rb3gen2-hsp","qcom,qcs5430";
+	qcom,msm-id = <0x2023F 0x10000>;
+	qcom,board-id = <32 0x6>, <32 0x606>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2-addons-rb3gen2-vision-mezz-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2-addons-rb3gen2-vision-mezz-hsp.dts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp2-addons-rb3gen2-vision-mezz.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp2 addons rb3gen2 vision mezz hsp platform";
+	compatible = "qcom,qcs5430-fp2-addons-rb3gen2-vision-mezz-hsp","qcom,qcs5430";
+	qcom,msm-id = <0x2023F 0x10000>;
+	qcom,board-id = <32 0x7>, <32 0x607>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2-addons-rb3gen2-vision-mezz.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2-addons-rb3gen2-vision-mezz.dts
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp2-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp2 addons rb3gen2 vision mezz platform";
+	compatible = "qcom,qcs5430-fp2-addons-rb3gen2-vision-mezz","qcom,qcs5430";
+	qcom,msm-id = <0x2023F 0x10000>;
+	qcom,board-id = <32 0x2>, <32 0x602>;
+};
+
+&mi2s0_data0 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_data1 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_mclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_sclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_ws {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&q6apmbedai {
+	qcom,prmcc_clk = <&q6prmcc>;
+};
+
+&sound {
+	compatible = "qcom,qcm6490-sndcard";
+	model = "qcm6490-rb3-vision-snd-card";
+
+	audio-routing =
+		"SpkrLeft IN", "WSA_SPK1 OUT",
+		"SpkrRight IN", "WSA_SPK2 OUT",
+		"VA DMIC0", "vdd-micb",
+		"VA DMIC1", "vdd-micb",
+		"VA DMIC2", "vdd-micb",
+		"VA DMIC3", "vdd-micb",
+		"VA DMIC4", "vdd-micb",
+		"VA DMIC5", "vdd-micb";
+
+	pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep";
+	pinctrl-0 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+	pinctrl-1 = <&mi2s0_data0>, <&mi2s0_data1>, <&mi2s0_mclk>, <&mi2s0_sclk>, <&mi2s0_ws>;
+	pinctrl-2 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+
+	mi2s-capture-dai-link {
+		link-name = "MI2S-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	mi2s-playback-dai-link {
+		link-name = "MI2S-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+	tdm-capture-dai-link {
+		link-name = "TDM-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	tdm-playback-dai-link {
+		link-name = "TDM-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+};
+
+&tlmm {
+	mi2s0_data0_sleep: mi2s0-data0-sleep {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_data1_sleep: mi2s0-data1-sleep {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_mclk_sleep: mi2s0-mclk-sleep {
+		pins = "gpio96";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_sclk_sleep: mi2s0-sclk-sleep {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_ws_sleep: mi2s0-ws-sleep {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2-addons-rb3gen2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2-addons-rb3gen2.dts
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp1-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp2 addons rb3gen2 platform";
+	compatible = "qcom,qcs5430-fp2-addons-rb3gen2","qcom,qcs5430";
+	qcom,msm-id = <0x2023F 0x10000>;
+	qcom,board-id = <32 0x5>, <32 0x605>;
+
+	cpus {
+		cpu-map {
+			cluster0 {
+				core6 {
+					cpu = <&CPU6>;
+				};
+
+				core7 {
+					cpu = <&CPU7>;
+				};
+			};
+		};
+	};
+};
+
+&CPU6 {
+	enable-method = "psci";
+};
+
+&CPU7 {
+	enable-method = "psci";
+};
+
+&pcie1 {
+        status = "ok";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-addons-rb3gen2-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-addons-rb3gen2-hsp.dts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp2p5-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp2p5 addons rb3gen2 hsp platform";
+	compatible = "qcom,qcs5430-fp2p5-addons-rb3gen2-hsp","qcom,qcs5430";
+	qcom,msm-id = <0x8023F 0x10000>;
+	qcom,board-id = <32 0x6>, <32 0x606>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-addons-rb3gen2-vision-mezz-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-addons-rb3gen2-vision-mezz-hsp.dts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp2p5-addons-rb3gen2-vision-mezz.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp2p5 addons rb3gen2 vision mezz hsp platform";
+	compatible = "qcom,qcs5430-fp2p5-addons-rb3gen2-vision-mezz-hsp","qcom,qcs5430";
+	qcom,msm-id = <0x8023F 0x10000>;
+	qcom,board-id = <32 0x7>, <32 0x607>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-addons-rb3gen2-vision-mezz.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-addons-rb3gen2-vision-mezz.dts
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp2p5-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp2p5 addons rb3gen2 vision mezz platform";
+	compatible = "qcom,qcs5430-fp2p5-addons-rb3gen2-vision-mezz","qcom,qcs5430";
+	qcom,msm-id = <0x8023F 0x10000>;
+	qcom,board-id = <32 0x2>, <32 0x602>;
+};
+
+&mi2s0_data0 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_data1 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_mclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_sclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_ws {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&q6apmbedai {
+	qcom,prmcc_clk = <&q6prmcc>;
+};
+
+&sound {
+	compatible = "qcom,qcm6490-sndcard";
+	model = "qcm6490-rb3-vision-snd-card";
+
+	audio-routing =
+		"SpkrLeft IN", "WSA_SPK1 OUT",
+		"SpkrRight IN", "WSA_SPK2 OUT",
+		"VA DMIC0", "vdd-micb",
+		"VA DMIC1", "vdd-micb",
+		"VA DMIC2", "vdd-micb",
+		"VA DMIC3", "vdd-micb",
+		"VA DMIC4", "vdd-micb",
+		"VA DMIC5", "vdd-micb";
+
+	pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep";
+	pinctrl-0 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+	pinctrl-1 = <&mi2s0_data0>, <&mi2s0_data1>, <&mi2s0_mclk>, <&mi2s0_sclk>, <&mi2s0_ws>;
+	pinctrl-2 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+
+	mi2s-capture-dai-link {
+		link-name = "MI2S-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	mi2s-playback-dai-link {
+		link-name = "MI2S-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+	tdm-capture-dai-link {
+		link-name = "TDM-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	tdm-playback-dai-link {
+		link-name = "TDM-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+};
+
+&tlmm {
+	mi2s0_data0_sleep: mi2s0-data0-sleep {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_data1_sleep: mi2s0-data1-sleep {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_mclk_sleep: mi2s0-mclk-sleep {
+		pins = "gpio96";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_sclk_sleep: mi2s0-sclk-sleep {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_ws_sleep: mi2s0-ws-sleep {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-addons-rb3gen2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-addons-rb3gen2.dts
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp1-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp2p5 addons rb3gen2 platform";
+	compatible = "qcom,qcs5430-fp2p5-addons-rb3gen2","qcom,qcs5430";
+	qcom,msm-id = <0x8023F 0x10000>;
+	qcom,board-id = <32 0x5>, <32 0x605>;
+
+	cpus {
+		cpu-map {
+			cluster0 {
+				core6 {
+					cpu = <&CPU6>;
+				};
+
+				core7 {
+					cpu = <&CPU7>;
+				};
+			};
+		};
+	};
+};
+
+&CPU6 {
+	enable-method = "psci";
+};
+
+&CPU7 {
+	enable-method = "psci";
+};
+
+&pcie1 {
+	status = "ok";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-graphics-pwrlevels.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-graphics-pwrlevels.dtsi
@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+&msm_gpu {
+	qcom,initial-pwrlevel = <2>;
+
+	/* Power levels */
+	qcom,gpu-pwrlevels {
+		compatible="qcom,gpu-pwrlevels";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,gpu-pwrlevel@0 {
+			reg = <0>;
+			qcom,gpu-freq = <550000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+			qcom,bus-freq = <7>;
+			qcom,bus-min = <6>;
+			qcom,bus-max = <9>;
+
+			qcom,acd-level = <0x802B5FFD>;
+		};
+
+		qcom,gpu-pwrlevel@1 {
+			reg = <1>;
+			qcom,gpu-freq = <450000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+			qcom,bus-freq = <6>;
+			qcom,bus-min = <6>;
+			qcom,bus-max = <8>;
+
+			qcom,acd-level = <0x802B5FFD>;
+		};
+
+		qcom,gpu-pwrlevel@2 {
+			reg = <2>;
+			qcom,gpu-freq = <315000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+			qcom,bus-freq = <3>;
+			qcom,bus-min = <2>;
+			qcom,bus-max = <7>;
+
+			qcom,acd-level = <0x882F5FFD>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-graphics.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp2p5-graphics.dtso
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,gcc-sc7280.h>
+#include <dt-bindings/clock/qcom,gpucc-sc7280.h>
+#include <dt-bindings/interconnect/qcom,sc7280.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <dt-bindings/reset/qcom,sdm845-pdc.h>
+#include <dt-bindings/soc/qcom,rpmh-rsc.h>
+#include <dt-bindings/thermal/thermal.h>
+
+#include "qcs5430-graphics.dtsi"
+#include "qcs5430-fp2p5-graphics-pwrlevels.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 rb3gen2 platform";
+	compatible = "qcom,qcs5430-fp2p5-addons-rb3gen2",
+			"qcom,qcs5430-fp2p5-addons-rb3gen2-vision-mezz",
+			"qcom,qcs5430-fp3-addons-rb3gen2",
+			"qcom,qcs5430-fp3-addons-rb3gen2-vision-mezz",
+			"qcom,qcs5430";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp3-addons-rb3gen2-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp3-addons-rb3gen2-hsp.dts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp3-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp3 addons rb3gen2 hsp platform";
+	compatible = "qcom,qcs5430-fp3-addons-rb3gen2-hsp","qcom,qcs5430";
+	qcom,msm-id = <0x3023F 0x10000>;
+	qcom,board-id = <32 0x6>, <32 0x606>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp3-addons-rb3gen2-vision-mezz-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp3-addons-rb3gen2-vision-mezz-hsp.dts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp3-addons-rb3gen2-vision-mezz.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp3 addons rb3gen2 vision mezz hsp platform";
+	compatible = "qcom,qcs5430-fp3-addons-rb3gen2-vision-mezz-hsp","qcom,qcs5430";
+	qcom,msm-id = <0x3023F 0x10000>;
+	qcom,board-id = <32 0x7>, <32 0x607>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp3-addons-rb3gen2-vision-mezz.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp3-addons-rb3gen2-vision-mezz.dts
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp3-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp3 addons rb3gen2 vision mezz platform";
+	compatible = "qcom,qcs5430-fp3-addons-rb3gen2-vision-mezz","qcom,qcs5430";
+	qcom,msm-id = <0x3023F 0x10000>;
+	qcom,board-id = <32 0x2>, <32 0x602>;
+};
+
+&mi2s0_data0 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_data1 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_mclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_sclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_ws {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&q6apmbedai {
+	qcom,prmcc_clk = <&q6prmcc>;
+};
+
+&sound {
+	compatible = "qcom,qcm6490-sndcard";
+	model = "qcm6490-rb3-vision-snd-card";
+
+	audio-routing =
+		"SpkrLeft IN", "WSA_SPK1 OUT",
+		"SpkrRight IN", "WSA_SPK2 OUT",
+		"VA DMIC0", "vdd-micb",
+		"VA DMIC1", "vdd-micb",
+		"VA DMIC2", "vdd-micb",
+		"VA DMIC3", "vdd-micb",
+		"VA DMIC4", "vdd-micb",
+		"VA DMIC5", "vdd-micb";
+
+	pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep";
+	pinctrl-0 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+	pinctrl-1 = <&mi2s0_data0>, <&mi2s0_data1>, <&mi2s0_mclk>, <&mi2s0_sclk>, <&mi2s0_ws>;
+	pinctrl-2 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+
+	mi2s-capture-dai-link {
+		link-name = "MI2S-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	mi2s-playback-dai-link {
+		link-name = "MI2S-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+	tdm-capture-dai-link {
+		link-name = "TDM-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	tdm-playback-dai-link {
+		link-name = "TDM-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+};
+
+&tlmm {
+	mi2s0_data0_sleep: mi2s0-data0-sleep {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_data1_sleep: mi2s0-data1-sleep {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_mclk_sleep: mi2s0-mclk-sleep {
+		pins = "gpio96";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_sclk_sleep: mi2s0-sclk-sleep {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_ws_sleep: mi2s0-ws-sleep {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-fp3-addons-rb3gen2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-fp3-addons-rb3gen2.dts
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs5430-fp1-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 fp3 addons rb3gen2 platform";
+	compatible = "qcom,qcs5430-fp3-addons-rb3gen2","qcom,qcs5430";
+	qcom,msm-id = <0x3023F 0x10000>;
+	qcom,board-id = <32 0x5>, <32 0x605>;
+
+	cpus {
+		cpu-map {
+			cluster0 {
+				core6 {
+					cpu = <&CPU6>;
+				};
+
+				core7 {
+					cpu = <&CPU7>;
+				};
+			};
+		};
+	};
+};
+
+&CPU6 {
+	enable-method = "psci";
+};
+
+&CPU7 {
+	enable-method = "psci";
+};
+
+&pcie1 {
+	status = "ok";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-graphics-pwrlevels.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-graphics-pwrlevels.dtsi
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+&msm_gpu {
+	qcom,initial-pwrlevel = <0>;
+
+	/* Power levels */
+	qcom,gpu-pwrlevels {
+		compatible="qcom,gpu-pwrlevels";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,gpu-pwrlevel@0 {
+			reg = <0>;
+			qcom,gpu-freq = <315000000>;
+			qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+			qcom,bus-freq = <3>;
+			qcom,bus-min = <2>;
+			qcom,bus-max = <7>;
+
+			qcom,acd-level = <0x882F5FFD>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-graphics.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-graphics.dtsi
@@ -0,0 +1,10 @@
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include "qcm6490-graphics.dtsi"
+
+&msm_gpu {
+	qcom,gpu-model = "Adreno642l";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs5430-graphics.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs5430-graphics.dtso
@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,gcc-sc7280.h>
+#include <dt-bindings/clock/qcom,gpucc-sc7280.h>
+#include <dt-bindings/interconnect/qcom,sc7280.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <dt-bindings/reset/qcom,sdm845-pdc.h>
+#include <dt-bindings/soc/qcom,rpmh-rsc.h>
+#include <dt-bindings/thermal/thermal.h>
+
+#include "qcs5430-graphics.dtsi"
+#include "qcs5430-graphics-pwrlevels.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qcs5430 rb3gen2 platform";
+	compatible = "qcom,qcs5430-fp1-addons-rb3gen2",
+			"qcom,qcs5430-fp1-addons-rb3gen2-vision-mezz",
+			"qcom,qcs5430-fp1p5-addons-rb3gen2",
+			"qcom,qcs5430-fp1p5-addons-rb3gen2-vision-mezz",
+			"qcom,qcs5430-fp2-addons-rb3gen2",
+			"qcom,qcs5430-fp2-addons-rb3gen2-vision-mezz",
+			"qcom,qcs5430";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs615-addons-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs615-addons-ride.dts
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * qcs615-addons ride device tree source
+ *
+ * Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+/dts-v1/;
+
+#include "qcs615-ride.dts"
+#include "qcs615-addons.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS615-addons RIDE";
+	compatible = "qcom,qcs615-addons-ride", "qcom,qcs615";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs615-addons.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs615-addons.dtsi
@@ -0,0 +1,314 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * qcs615-addons device tree source
+ *
+ * Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+/ {
+	reserved-memory {
+		dump_mem: mem_dump_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			size = <0 0x2800000>;
+		};
+	};
+
+	mem_dump {
+		compatible = "qcom,mem-dump";
+		memory-region = <&dump_mem>;
+
+		c0-context {
+			qcom,dump-id = <0x0>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c100-context {
+			qcom,dump-id = <0x1>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c200-context {
+			qcom,dump-id = <0x2>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c300-context {
+			qcom,dump-id = <0x3>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c400-context {
+			qcom,dump-id = <0x4>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c500-context {
+			qcom,dump-id = <0x5>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c600-context {
+			qcom,dump-id = <0x6>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c700-context {
+			qcom,dump-id = <0x7>;
+			qcom,dump-size = <0x800>;
+		};
+
+		etfswao-reg {
+			qcom,dump-size = <0x1000>;
+			qcom,dump-id = <0x102>;
+		};
+
+		etf-reg {
+			qcom,dump-size = <0x1000>;
+			qcom,dump-id = <0x101>;
+		};
+
+		etf-swao {
+			qcom,dump-size = <0x8000>;
+			qcom,dump-id = <0xf1>;
+		};
+
+		etr-reg {
+			qcom,dump-size = <0x1000>;
+			qcom,dump-id = <0x100>;
+		};
+
+		fcm {
+			qcom,dump-id = <0xee>;
+			qcom,dump-size = <0x8400>;
+		};
+
+		l1-dcache0 {
+			qcom,dump-id = <0x80>;
+			qcom,dump-size = <0x9000>;
+		};
+
+		l1-dcache100 {
+			qcom,dump-id = <0x81>;
+			qcom,dump-size = <0x9000>;
+		};
+
+		l1-dcache200 {
+			qcom,dump-id = <0x82>;
+			qcom,dump-size = <0x9000>;
+		};
+
+		l1-dcache300 {
+			qcom,dump-id = <0x83>;
+			qcom,dump-size = <0x9000>;
+		};
+
+		l1-dcache400 {
+			qcom,dump-id = <0x84>;
+			qcom,dump-size = <0x9000>;
+		};
+
+		l1-dcache500 {
+			qcom,dump-id = <0x85>;
+			qcom,dump-size = <0x9000>;
+		};
+
+		l1-dcache600 {
+			qcom,dump-id = <0x86>;
+			qcom,dump-size = <0x12000>;
+		};
+
+		l1-dcache700 {
+			qcom,dump-id = <0x87>;
+			qcom,dump-size = <0x12000>;
+		};
+
+		l1-dtlb600 {
+			qcom,dump-id = <0x46>;
+			qcom,dump-size = <0x480>;
+		};
+
+		l1-dtlb700 {
+			qcom,dump-id = <0x47>;
+			qcom,dump-size = <0x480>;
+		};
+
+		l1-icache0 {
+			qcom,dump-id = <0x60>;
+			qcom,dump-size = <0x8800>;
+		};
+
+		l1-icache100 {
+			qcom,dump-id = <0x61>;
+			qcom,dump-size = <0x8800>;
+		};
+
+		l1-icache200 {
+			qcom,dump-id = <0x62>;
+			qcom,dump-size = <0x8800>;
+		};
+
+		l1-icache300 {
+			qcom,dump-id = <0x63>;
+			qcom,dump-size = <0x8800>;
+		};
+
+		l1-icache400 {
+			qcom,dump-id = <0x64>;
+			qcom,dump-size = <0x8800>;
+		};
+
+		l1-icache500 {
+			qcom,dump-id = <0x65>;
+			qcom,dump-size = <0x8800>;
+		};
+
+		l1-icache600 {
+			qcom,dump-id = <0x66>;
+			qcom,dump-size = <0x11000>;
+		};
+
+		l1-icache700 {
+			qcom,dump-id = <0x67>;
+			qcom,dump-size = <0x11000>;
+		};
+
+		l1-itlb600 {
+			qcom,dump-id = <0x26>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-itlb700 {
+			qcom,dump-id = <0x27>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l2-cache600 {
+			qcom,dump-id = <0xc6>;
+			qcom,dump-size = <0x48000>;
+		};
+
+		l2-cache700 {
+			qcom,dump-id = <0xc7>;
+			qcom,dump-size = <0x48000>;
+		};
+
+		l2-tlb0 {
+			qcom,dump-id = <0x120>;
+			qcom,dump-size = <0x5000>;
+		};
+
+		l2-tlb100 {
+			qcom,dump-id = <0x121>;
+			qcom,dump-size = <0x5000>;
+		};
+
+		l2-tlb200 {
+			qcom,dump-id = <0x122>;
+			qcom,dump-size = <0x5000>;
+		};
+
+		l2-tlb300 {
+			qcom,dump-id = <0x123>;
+			qcom,dump-size = <0x5000>;
+		};
+
+		l2-tlb400 {
+			qcom,dump-id = <0x124>;
+			qcom,dump-size = <0x5000>;
+		};
+
+		l2-tlb500 {
+			qcom,dump-id = <0x125>;
+			qcom,dump-size = <0x5000>;
+		};
+
+		l2-tlb600 {
+			qcom,dump-id = <0x126>;
+			qcom,dump-size = <0x7800>;
+		};
+
+		l2-tlb700 {
+			qcom,dump-id = <0x127>;
+			qcom,dump-size = <0x7800>;
+		};
+
+		llcc1-d-cache {
+			qcom,dump-id = <0x140>;
+			qcom,dump-size = <0x6c000>;
+		};
+
+		misc-data {
+			qcom,dump-id = <0xe8>;
+			qcom,dump-size = <0x1000>;
+		};
+
+		pmic {
+			qcom,dump-id = <0xe4>;
+			qcom,dump-size = <0x10000>;
+		};
+
+		rpmh {
+			qcom,dump-id = <0xec>;
+			qcom,dump-size = <0x2000000>;
+		};
+
+		rpm-sw {
+			qcom,dump-id = <0xea>;
+			qcom,dump-size = <0x28000>;
+		};
+
+		tmc-etf {
+			qcom,dump-id = <0xf0>;
+			qcom,dump-size = <0x8000>;
+		};
+	};
+};
+
+&soc {
+	csr: csr@6001000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x0 0x6001000 0x0 0x1000>;
+		reg-names = "csr-base";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		qcom,blk-size = <1>;
+		qcom,hwctrl-set-support;
+		qcom,set-byte-cntr-support;
+		qcom,usb-bam-support;
+	};
+
+	dma@10a2000 {
+		compatible = "qcom,dcc-v1", "qcom,dcc";
+		reg = <0x0 0x010a2000 0x0 0x1000>,
+		      <0x0 0x010ae000 0x0 0x2000>;
+
+		qcom,dcc-offset = <0x6000>;
+	};
+
+	tmc_etr: tmc@6048000 {
+		interrupts = <GIC_SPI 270 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "byte-cntr-irq";
+		qcom,sw-usb;
+		qcom,mem_support;
+		coresight-csr = <&csr>;
+		csr-irqctrl-offset = <0x6c>;
+		byte-cntr-name = "byte-cntr";
+		byte-cntr-class-name = "coresight-tmc-etr-stream";
+	};
+
+	swao_csr: csr@6b0e000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x0 0x6b0e000 0x0 0x1000>;
+		reg-names = "csr-base";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		qcom,blk-size = <1>;
+		qcom,timestamp-support;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs615-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs615-ride.dts
@@ -0,0 +1,451 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/regulator/qcom,rpmh-regulator.h>
+#include <dt-bindings/gpio/gpio.h>
+#include "qcs615.dtsi"
+#include "pm8150.dtsi"
+/ {
+	model = "Qualcomm Technologies, Inc. QCS615 Ride";
+	compatible = "qcom,qcs615-ride", "qcom,qcs615";
+	chassis-type = "embedded";
+	qcom,msm-id = <377 0x0>, <380 0>, <384 0x0>, <680 0x0>;
+	qcom,board-id = <0x03010019 0>, <0x03020019 0>, <0x10019 0>, <0x20019 0>;
+
+	aliases {
+		mmc0 = &sdhc_1;
+		mmc1 = &sdhc_2;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	clocks {
+		sleep_clk: sleep-clk {
+			compatible = "fixed-clock";
+			clock-frequency = <32000>;
+			#clock-cells = <0>;
+		};
+
+		xo_board_clk: xo-board-clk {
+			compatible = "fixed-clock";
+			clock-frequency = <38400000>;
+			#clock-cells = <0>;
+		};
+	};
+
+	regulator-usb2-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "USB2_VBUS";
+		gpio = <&pm8150_gpios 10 GPIO_ACTIVE_HIGH>;
+		pinctrl-0 = <&usb2_en>;
+		pinctrl-names = "default";
+		enable-active-high;
+		regulator-always-on;
+	};
+};
+
+&apps_rsc {
+	regulators-0 {
+		compatible = "qcom,pm8150-rpmh-regulators";
+		qcom,pmic-id = "a";
+
+		vreg_s3a: smps3 {
+			regulator-name = "vreg_s3a";
+			regulator-min-microvolt = <600000>;
+			regulator-max-microvolt = <650000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s4a: smps4 {
+			regulator-name = "vreg_s4a";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1829000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5a: smps5 {
+			regulator-name = "vreg_s5a";
+			regulator-min-microvolt = <1896000>;
+			regulator-max-microvolt = <2040000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s6a: smps6 {
+			regulator-name = "vreg_s6a";
+			regulator-min-microvolt = <1304000>;
+			regulator-max-microvolt = <1404000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1a: ldo1 {
+			regulator-name = "vreg_l1a";
+			regulator-min-microvolt = <488000>;
+			regulator-max-microvolt = <852000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_LPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2a: ldo2 {
+			regulator-name = "vreg_l2a";
+			regulator-min-microvolt = <1650000>;
+			regulator-max-microvolt = <3100000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_LPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3a: ldo3 {
+			regulator-name = "vreg_l3a";
+			regulator-min-microvolt = <1000000>;
+			regulator-max-microvolt = <1248000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_LPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l5a: ldo5 {
+			regulator-name = "vreg_l5a";
+			regulator-min-microvolt = <875000>;
+			regulator-max-microvolt = <975000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7a: ldo7 {
+			regulator-name = "vreg_l7a";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1900000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8a: ldo8 {
+			regulator-name = "vreg_l8a";
+			regulator-min-microvolt = <1150000>;
+			regulator-max-microvolt = <1350000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l10a: ldo10 {
+			regulator-name = "vreg_l10a";
+			regulator-min-microvolt = <2950000>;
+			regulator-max-microvolt = <3312000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l11a: ldo11 {
+			regulator-name = "vreg_l11a";
+			regulator-min-microvolt = <1232000>;
+			regulator-max-microvolt = <1260000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_LPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l12a: ldo12 {
+			regulator-name = "vreg_l12a";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1890000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_LPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l13a: ldo13 {
+			regulator-name = "vreg_l13a";
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3230000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_LPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l15a: ldo15 {
+			regulator-name = "vreg_l15a";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1904000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_LPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l16a: ldo16 {
+			regulator-name = "vreg_l16a";
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3312000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_LPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l17a: ldo17 {
+			regulator-name = "vreg_l17a";
+			regulator-min-microvolt = <2950000>;
+			regulator-max-microvolt = <3312000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+};
+
+&ethernet {
+	status = "okay";
+
+	pinctrl-0 = <&ethernet_defaults>;
+	pinctrl-names = "default";
+
+	phy-handle = <&rgmii_phy>;
+	phy-mode = "rgmii";
+	max-speed = <1000>;
+	qcom,rx-prog-swap;
+
+	snps,mtl-rx-config = <&mtl_rx_setup>;
+	snps,mtl-tx-config = <&mtl_tx_setup>;
+
+	mdio: mdio {
+		compatible = "snps,dwmac-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		rgmii_phy: phy@7 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <0x7>;
+
+			interrupts-extended = <&tlmm 121 IRQ_TYPE_EDGE_FALLING>;
+			device_type = "ethernet-phy";
+			reset-gpios = <&tlmm 104 GPIO_ACTIVE_LOW>;
+			reset-assert-us = <11000>;
+			reset-deassert-us = <70000>;
+		};
+	};
+
+	mtl_rx_setup: rx-queues-config {
+		snps,rx-queues-to-use = <1>;
+		snps,rx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x0>;
+			snps,route-up;
+			snps,priority = <0x1>;
+		};
+	};
+
+	mtl_tx_setup: tx-queues-config {
+		snps,tx-queues-to-use = <1>;
+		snps,tx-sched-wrr;
+
+		queue0 {
+			snps,weight = <0x10>;
+			snps,dcb-algorithm;
+			snps,priority = <0x0>;
+		};
+	};
+};
+
+&gcc {
+	clocks = <&rpmhcc RPMH_CXO_CLK>,
+		 <&rpmhcc RPMH_CXO_CLK_A>,
+		 <&sleep_clk>;
+};
+
+&pm8150_gpios {
+	usb2_en: usb2-en-state {
+		pins = "gpio10";
+		function = "normal";
+		output-enable;
+		power-source = <0>;
+	};
+};
+
+&pon_pwrkey {
+	status = "okay";
+};
+
+&pon_resin {
+	linux,code = <KEY_VOLUMEDOWN>;
+
+	status = "okay";
+};
+
+&qupv3_id_0 {
+	status = "okay";
+};
+
+&rpmhcc {
+	clocks = <&xo_board_clk>;
+};
+
+&sdhc_1 {
+	pinctrl-0 = <&sdc1_state_on>;
+	pinctrl-1 = <&sdc1_state_off>;
+	pinctrl-names = "default", "sleep";
+
+	bus-width = <8>;
+	mmc-ddr-1_8v;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	mmc-hs400-enhanced-strobe;
+	vmmc-supply = <&vreg_l17a>;
+	vqmmc-supply = <&vreg_s4a>;
+
+	non-removable;
+	no-sd;
+	no-sdio;
+
+	status = "okay";
+};
+
+&sdhc_2 {
+	pinctrl-0 = <&sdc2_state_on>;
+	pinctrl-1 = <&sdc2_state_off>;
+	pinctrl-names = "default", "sleep";
+
+	bus-width = <4>;
+	cd-gpios = <&tlmm 99 GPIO_ACTIVE_LOW>;
+
+	vmmc-supply = <&vreg_l10a>;
+	vqmmc-supply = <&vreg_s4a>;
+
+	status = "okay";
+};
+
+&tlmm {
+	ethernet_defaults: ethernet-defaults-state {
+		mdc-pins {
+			pins = "gpio113";
+			function = "rgmii";
+			bias-pull-up;
+		};
+
+		mdio-pins {
+			pins = "gpio114";
+			function = "rgmii";
+			bias-pull-up;
+		};
+
+		rgmii-rx-pins {
+			pins = "gpio81", "gpio82", "gpio83", "gpio102", "gpio103", "gpio112";
+			function = "rgmii";
+			bias-disable;
+			drive-strength = <2>;
+		};
+
+		rgmii-tx-pins {
+			pins = "gpio92", "gpio93", "gpio94", "gpio95", "gpio96", "gpio97";
+			function = "rgmii";
+			bias-pull-up;
+			drive-strength = <16>;
+		};
+
+		phy-intr-pins {
+			pins = "gpio121";
+			function = "gpio";
+			bias-disable;
+			drive-strength = <8>;
+		};
+
+		pps-pins {
+			pins = "gpio91";
+			function = "rgmii";
+			bias-disable;
+			drive-strength = <8>;
+		};
+
+		phy-reset-pins {
+			pins = "gpio104";
+			function = "gpio";
+			bias-pull-up;
+			drive-strength = <16>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_1_hsphy {
+	vdd-supply = <&vreg_l5a>;
+	vdda-pll-supply = <&vreg_l12a>;
+	vdda-phy-dpdm-supply = <&vreg_l13a>;
+
+	status = "okay";
+};
+
+&usb_qmpphy {
+	vdda-phy-supply = <&vreg_l5a>;
+	vdda-pll-supply = <&vreg_l12a>;
+
+	status = "okay";
+};
+
+&usb_1 {
+	status = "okay";
+};
+
+&usb_1_dwc3 {
+	dr_mode = "peripheral";
+};
+
+&usb_hsphy_2 {
+	vdd-supply = <&vreg_l5a>;
+	vdda-pll-supply = <&vreg_l12a>;
+	vdda-phy-dpdm-supply = <&vreg_l13a>;
+
+	status = "okay";
+};
+
+&usb_2 {
+	status = "okay";
+};
+
+&usb_2_dwc3 {
+	dr_mode = "host";
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 123 GPIO_ACTIVE_LOW>;
+	vcc-supply = <&vreg_l17a>;
+	vcc-max-microamp = <600000>;
+	vccq2-supply = <&vreg_s4a>;
+	vccq2-max-microamp = <600000>;
+
+	status = "okay";
+};
+
+&ufs_mem_phy {
+	vdda-phy-supply = <&vreg_l5a>;
+	vdda-pll-supply = <&vreg_l12a>;
+
+	status = "okay";
+};
+
+&watchdog {
+	clocks = <&sleep_clk>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs615.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs615.dtsi
@@ -0,0 +1,3999 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/clock/qcom,qcs615-camcc.h>
+#include <dt-bindings/clock/qcom,qcs615-dispcc.h>
+#include <dt-bindings/clock/qcom,qcs615-gcc.h>
+#include <dt-bindings/clock/qcom,qcs615-gpucc.h>
+#include <dt-bindings/clock/qcom,qcs615-videocc.h>
+#include <dt-bindings/clock/qcom,rpmh.h>
+#include <dt-bindings/dma/qcom-gpi.h>
+#include <dt-bindings/interconnect/qcom,icc.h>
+#include <dt-bindings/interconnect/qcom,qcs615-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <dt-bindings/power/qcom,rpmhpd.h>
+#include <dt-bindings/soc/qcom,rpmh-rsc.h>
+
+/ {
+	interrupt-parent = <&intc>;
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	audio-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+		device-name = "audio_etm0";
+
+		qcom,inst-id = <5>;
+		atid = <40>;
+
+		out-ports {
+			port {
+				audio_out: endpoint {
+					remote-endpoint = <&dup_funnel_monaq_in1>;
+				};
+			};
+		};
+	};
+
+	cpus {
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		cpu0: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x0>;
+			enable-method = "psci";
+			power-domains = <&cpu_pd0>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			next-level-cache = <&l2_0>;
+			clocks = <&cpufreq_hw 0>;
+			qcom,freq-domain = <&cpufreq_hw 0>;
+			#cooling-cells = <2>;
+
+			l2_0: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      cache-unified;
+			      next-level-cache = <&l3_0>;
+			};
+		};
+
+		cpu1: cpu@100 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x100>;
+			enable-method = "psci";
+			power-domains = <&cpu_pd1>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			next-level-cache = <&l2_100>;
+			clocks = <&cpufreq_hw 0>;
+			qcom,freq-domain = <&cpufreq_hw 0>;
+
+			l2_100: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      cache-unified;
+			      next-level-cache = <&l3_0>;
+			};
+		};
+
+		cpu2: cpu@200 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x200>;
+			enable-method = "psci";
+			power-domains = <&cpu_pd2>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			next-level-cache = <&l2_200>;
+			clocks = <&cpufreq_hw 0>;
+			qcom,freq-domain = <&cpufreq_hw 0>;
+
+			l2_200: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      cache-unified;
+			      next-level-cache = <&l3_0>;
+			};
+		};
+
+		cpu3: cpu@300 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x300>;
+			enable-method = "psci";
+			power-domains = <&cpu_pd3>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			next-level-cache = <&l2_300>;
+			clocks = <&cpufreq_hw 0>;
+			qcom,freq-domain = <&cpufreq_hw 0>;
+
+			l2_300: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      cache-unified;
+			      next-level-cache = <&l3_0>;
+			};
+		};
+
+		cpu4: cpu@400 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x400>;
+			enable-method = "psci";
+			power-domains = <&cpu_pd4>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			next-level-cache = <&l2_400>;
+			clocks = <&cpufreq_hw 0>;
+			qcom,freq-domain = <&cpufreq_hw 0>;
+
+			l2_400: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      cache-unified;
+			      next-level-cache = <&l3_0>;
+			};
+		};
+
+		cpu5: cpu@500 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x500>;
+			enable-method = "psci";
+			power-domains = <&cpu_pd5>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			next-level-cache = <&l2_500>;
+			clocks = <&cpufreq_hw 0>;
+			qcom,freq-domain = <&cpufreq_hw 0>;
+
+			l2_500: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      cache-unified;
+			      next-level-cache = <&l3_0>;
+			};
+		};
+
+		cpu6: cpu@600 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a76";
+			reg = <0x0 0x600>;
+			enable-method = "psci";
+			power-domains = <&cpu_pd6>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1740>;
+			dynamic-power-coefficient = <404>;
+			next-level-cache = <&l2_600>;
+			clocks = <&cpufreq_hw 1>;
+			qcom,freq-domain = <&cpufreq_hw 1>;
+			#cooling-cells = <2>;
+
+			l2_600: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      cache-unified;
+			      next-level-cache = <&l3_0>;
+			};
+		};
+
+		cpu7: cpu@700 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a76";
+			reg = <0x0 0x700>;
+			enable-method = "psci";
+			power-domains = <&cpu_pd7>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1740>;
+			dynamic-power-coefficient = <404>;
+			next-level-cache = <&l2_700>;
+			clocks = <&cpufreq_hw 1>;
+			qcom,freq-domain = <&cpufreq_hw 1>;
+
+			l2_700: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      cache-unified;
+			      next-level-cache = <&l3_0>;
+			};
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&cpu0>;
+				};
+
+				core1 {
+					cpu = <&cpu1>;
+				};
+
+				core2 {
+					cpu = <&cpu2>;
+				};
+
+				core3 {
+					cpu = <&cpu3>;
+				};
+
+				core4 {
+					cpu = <&cpu4>;
+				};
+
+				core5 {
+					cpu = <&cpu5>;
+				};
+
+				core6 {
+					cpu = <&cpu6>;
+				};
+
+				core7 {
+					cpu = <&cpu7>;
+				};
+			};
+		};
+
+		l3_0: l3-cache {
+			compatible = "cache";
+			cache-level = <3>;
+			cache-unified;
+		};
+	};
+
+	dummy_eud: dummy-sink {
+		compatible = "arm,coresight-dummy-sink";
+
+		in-ports {
+			port {
+				eud_in: endpoint {
+					remote-endpoint = <&replicator_swao_out1>;
+				};
+			};
+		};
+	};
+
+	idle-states {
+		entry-method = "psci";
+
+		little_cpu_sleep_0: cpu-sleep-0-0 {
+			compatible = "arm,idle-state";
+			idle-state-name = "silver-power-collapse";
+			arm,psci-suspend-param = <0x40000003>;
+			entry-latency-us = <549>;
+			exit-latency-us = <901>;
+			min-residency-us = <1774>;
+			local-timer-stop;
+		};
+
+		little_cpu_sleep_1: cpu-sleep-0-1 {
+			compatible = "arm,idle-state";
+			idle-state-name = "silver-rail-power-collapse";
+			arm,psci-suspend-param = <0x40000004>;
+			entry-latency-us = <702>;
+			exit-latency-us = <915>;
+			min-residency-us = <4001>;
+			local-timer-stop;
+		};
+
+		big_cpu_sleep_0: cpu-sleep-1-0 {
+			compatible = "arm,idle-state";
+			idle-state-name = "gold-power-collapse";
+			arm,psci-suspend-param = <0x40000003>;
+			entry-latency-us = <523>;
+			exit-latency-us = <1244>;
+			min-residency-us = <2207>;
+			local-timer-stop;
+		};
+
+		big_cpu_sleep_1: cpu-sleep-1-1 {
+			compatible = "arm,idle-state";
+			idle-state-name = "gold-rail-power-collapse";
+			arm,psci-suspend-param = <0x40000004>;
+			entry-latency-us = <526>;
+			exit-latency-us = <1854>;
+			min-residency-us = <5555>;
+			local-timer-stop;
+		};
+	};
+
+	domain-idle-states {
+		cluster_sleep_0: cluster-sleep-0 {
+			compatible = "domain-idle-state";
+			arm,psci-suspend-param = <0x41000044>;
+			entry-latency-us = <2752>;
+			exit-latency-us = <3048>;
+			min-residency-us = <6118>;
+		};
+
+		cluster_sleep_1: cluster-sleep-1 {
+			compatible = "domain-idle-state";
+			arm,psci-suspend-param = <0x41001344>;
+			entry-latency-us = <3263>;
+			exit-latency-us = <4562>;
+			min-residency-us = <8467>;
+		};
+
+		cluster_sleep_2: cluster-sleep-2 {
+			compatible = "domain-idle-state";
+			arm,psci-suspend-param = <0x4100b344>;
+			entry-latency-us = <3638>;
+			exit-latency-us = <6562>;
+			min-residency-us = <9826>;
+		};
+	};
+
+	memory@80000000 {
+		device_type = "memory";
+		/* We expect the bootloader to fill in the size */
+		reg = <0 0x80000000 0 0>;
+	};
+
+	firmware {
+		scm {
+			compatible = "qcom,scm-qcs615", "qcom,scm";
+			qcom,dload-mode = <&tcsr 0x13000>;
+		};
+	};
+
+	camnoc_virt: interconnect-0 {
+		compatible = "qcom,qcs615-camnoc-virt";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	ipa_virt: interconnect-1 {
+		compatible = "qcom,qcs615-ipa-virt";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	mc_virt: interconnect-2 {
+		compatible = "qcom,qcs615-mc-virt";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	qup_opp_table: opp-table-qup {
+		compatible = "operating-points-v2";
+		opp-shared;
+
+		opp-75000000 {
+			opp-hz = /bits/ 64 <75000000>;
+			required-opps = <&rpmhpd_opp_low_svs>;
+		};
+
+		opp-100000000 {
+			opp-hz = /bits/ 64 <100000000>;
+			required-opps = <&rpmhpd_opp_svs>;
+		};
+
+		opp-128000000 {
+			opp-hz = /bits/ 64 <128000000>;
+			required-opps = <&rpmhpd_opp_nom>;
+		};
+	};
+
+	psci {
+		compatible = "arm,psci-1.0";
+		method = "smc";
+
+		cpu_pd0: power-domain-cpu0 {
+			#power-domain-cells = <0>;
+			power-domains = <&cluster_pd>;
+			domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>;
+		};
+
+		cpu_pd1: power-domain-cpu1 {
+			#power-domain-cells = <0>;
+			power-domains = <&cluster_pd>;
+			domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>;
+		};
+
+		cpu_pd2: power-domain-cpu2 {
+			#power-domain-cells = <0>;
+			power-domains = <&cluster_pd>;
+			domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>;
+		};
+
+		cpu_pd3: power-domain-cpu3 {
+			#power-domain-cells = <0>;
+			power-domains = <&cluster_pd>;
+			domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>;
+		};
+
+		cpu_pd4: power-domain-cpu4 {
+			#power-domain-cells = <0>;
+			power-domains = <&cluster_pd>;
+			domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>;
+		};
+
+		cpu_pd5: power-domain-cpu5 {
+			#power-domain-cells = <0>;
+			power-domains = <&cluster_pd>;
+			domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>;
+		};
+
+		cpu_pd6: power-domain-cpu6 {
+			#power-domain-cells = <0>;
+			power-domains = <&cluster_pd>;
+			domain-idle-states = <&big_cpu_sleep_0 &big_cpu_sleep_1>;
+		};
+
+		cpu_pd7: power-domain-cpu7 {
+			#power-domain-cells = <0>;
+			power-domains = <&cluster_pd>;
+			domain-idle-states = <&big_cpu_sleep_0 &big_cpu_sleep_1>;
+		};
+
+		cluster_pd: power-domain-cluster {
+			#power-domain-cells = <0>;
+			domain-idle-states = <&cluster_sleep_0
+					      &cluster_sleep_1
+					      &cluster_sleep_2>;
+		};
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		smem_region: smem@86000000 {
+			compatible = "qcom,smem";
+			reg = <0x0 0x86000000 0x0 0x200000>;
+			no-map;
+			hwlocks = <&tcsr_mutex 3>;
+		};
+	};
+
+	soc: soc@0 {
+		compatible = "simple-bus";
+		ranges = <0 0 0 0 0x10 0>;
+		dma-ranges = <0 0 0 0 0x10 0>;
+		#address-cells = <2>;
+		#size-cells = <2>;
+
+		ethernet: ethernet@20000 {
+			compatible = "qcom,qcs615-ethqos";
+			reg = <0x0 0x00020000 0x0 0x00010000>,
+			      <0x0 0x00036000 0x0 0x00000100>;
+			reg-names = "stmmaceth", "rgmii";
+
+			clocks = <&gcc GCC_EMAC_AXI_CLK>,
+				 <&gcc GCC_EMAC_SLV_AHB_CLK>,
+				 <&gcc GCC_EMAC_PTP_CLK>,
+				 <&gcc GCC_EMAC_RGMII_CLK>;
+			clock-names = "stmmaceth",
+				      "pclk",
+				      "ptp_ref",
+				      "rgmii";
+
+			interrupts = <GIC_SPI 660 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 661 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "macirq", "eth_lpi";
+
+			power-domains = <&gcc EMAC_GDSC>;
+			resets = <&gcc GCC_EMAC_BCR>;
+
+			iommus = <&apps_smmu 0x1c0 0x0>;
+
+			snps,tso;
+			snps,pbl = <32>;
+			rx-fifo-depth = <16384>;
+			tx-fifo-depth = <20480>;
+
+			status = "disabled";
+		};
+
+		gcc: clock-controller@100000 {
+			compatible = "qcom,qcs615-gcc";
+			reg = <0 0x00100000 0 0x1f0000>;
+
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		qfprom: efuse@780000 {
+			compatible = "qcom,qcs615-qfprom", "qcom,qfprom";
+			reg = <0x0 0x00780000 0x0 0x7000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qusb2_hstx_trim: hstx-trim@1f8 {
+				reg = <0x1fb 0x1>;
+				bits = <1 4>;
+			};
+		};
+
+		sdhc_1: mmc@7c4000 {
+			compatible = "qcom,qcs615-sdhci", "qcom,sdhci-msm-v5";
+			reg = <0x0 0x007c4000 0x0 0x1000>,
+			      <0x0 0x007c5000 0x0 0x1000>,
+			      <0x0 0x007c8000 0x0 0x8000>;
+			reg-names = "hc",
+				    "cqhci",
+				    "ice";
+
+			interrupts = <GIC_SPI 641 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 644 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "hc_irq",
+					  "pwr_irq";
+
+			clocks = <&gcc GCC_SDCC1_AHB_CLK>,
+				 <&gcc GCC_SDCC1_APPS_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GCC_SDCC1_ICE_CORE_CLK>;
+			clock-names = "iface",
+				      "core",
+				      "xo",
+				      "ice";
+
+			resets = <&gcc GCC_SDCC1_BCR>;
+
+			power-domains = <&rpmhpd RPMHPD_CX>;
+			operating-points-v2 = <&sdhc1_opp_table>;
+			iommus = <&apps_smmu 0x02c0 0x0>;
+			interconnects = <&aggre1_noc MASTER_SDCC_1 QCOM_ICC_TAG_ALWAYS
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+					<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &config_noc SLAVE_SDCC_1 QCOM_ICC_TAG_ACTIVE_ONLY>;
+			interconnect-names = "sdhc-ddr",
+					     "cpu-sdhc";
+
+			qcom,dll-config = <0x000f642c>;
+			qcom,ddr-config = <0x80040868>;
+			supports-cqe;
+			dma-coherent;
+
+			status = "disabled";
+
+			sdhc1_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-50000000 {
+					opp-hz = /bits/ 64 <50000000>;
+					required-opps = <&rpmhpd_opp_low_svs>;
+				};
+
+				opp-100000000 {
+					opp-hz = /bits/ 64 <100000000>;
+					required-opps = <&rpmhpd_opp_svs>;
+				};
+
+				opp-200000000 {
+					opp-hz = /bits/ 64 <200000000>;
+					required-opps = <&rpmhpd_opp_svs_l1>;
+				};
+
+				opp-384000000 {
+					opp-hz = /bits/ 64 <384000000>;
+					required-opps = <&rpmhpd_opp_nom>;
+				};
+			};
+		};
+
+		gpi_dma0: dma-controller@800000  {
+			compatible = "qcom,qcs615-gpi-dma", "qcom,sdm845-gpi-dma";
+			reg = <0x0 0x800000 0x0 0x60000>;
+			#dma-cells = <3>;
+			interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 246 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 247 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 248 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 250 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 251 IRQ_TYPE_LEVEL_HIGH>;
+			dma-channels = <8>;
+			dma-channel-mask = <0xf>;
+			iommus = <&apps_smmu 0xd6 0x0>;
+			status = "disabled";
+		};
+
+		qupv3_id_0: geniqup@8c0000 {
+			compatible = "qcom,geni-se-qup";
+			reg = <0x0 0x008c0000 0x0 0x6000>;
+			ranges;
+			clocks = <&gcc GCC_QUPV3_WRAP_0_M_AHB_CLK>,
+				 <&gcc GCC_QUPV3_WRAP_0_S_AHB_CLK>;
+			clock-names = "m-ahb",
+				      "s-ahb";
+			iommus = <&apps_smmu 0xc3 0x0>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			uart0: serial@880000 {
+				compatible = "qcom,geni-debug-uart";
+				reg = <0x0 0x00880000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S0_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_uart0_tx>, <&qup_uart0_rx>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 601 IRQ_TYPE_LEVEL_HIGH>;
+				interconnects = <&aggre1_noc MASTER_QUP_0 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				status = "disabled";
+			};
+
+			i2c1: i2c@884000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x884000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 602 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S1_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_i2c1_data_clk>;
+				pinctrl-names = "default";
+				interconnects = <&aggre1_noc MASTER_QUP_0 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>,
+						<&aggre1_noc MASTER_QUP_0 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config",
+						     "qup-memory";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				dmas = <&gpi_dma0 0 1 QCOM_GPI_I2C>,
+				       <&gpi_dma0 1 1 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			i2c2: i2c@888000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x888000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 603 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S2_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_i2c2_data_clk>;
+				pinctrl-names = "default";
+				interconnects = <&aggre1_noc MASTER_QUP_0 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>,
+						<&aggre1_noc MASTER_QUP_0 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config",
+						     "qup-memory";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				dmas = <&gpi_dma0 0 2 QCOM_GPI_I2C>,
+				       <&gpi_dma0 1 2 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			spi2: spi@888000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0x00888000 0x0 0x4000>;
+				interrupts = <GIC_SPI 603 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S2_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_spi2_data_clk>, <&qup_spi2_cs>;
+				pinctrl-names = "default";
+				interconnects = <&aggre1_noc MASTER_QUP_0 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				dmas = <&gpi_dma0 0 2 QCOM_GPI_SPI>,
+				       <&gpi_dma0 1 2 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				status = "disabled";
+			};
+
+			uart2: serial@888000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00888000 0x0 0x4000>;
+				interrupts = <GIC_SPI 603 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S2_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_uart2_cts>, <&qup_uart2_rts>,
+					    <&qup_uart2_tx>, <&qup_uart2_rx>;
+				pinctrl-names = "default";
+				interconnects = <&aggre1_noc MASTER_QUP_0 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				status = "disabled";
+			};
+
+			i2c3: i2c@88c000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x88c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 604 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S3_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_i2c3_data_clk>;
+				pinctrl-names = "default";
+				interconnects = <&aggre1_noc MASTER_QUP_0 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>,
+						<&aggre1_noc MASTER_QUP_0 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config",
+						     "qup-memory";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				dmas = <&gpi_dma0 0 3 QCOM_GPI_I2C>,
+				       <&gpi_dma0 1 3 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+		};
+
+		gpi_dma1: dma-controller@a00000 {
+			compatible = "qcom,qcs615-gpi-dma", "qcom,sdm845-gpi-dma";
+			reg = <0x0 0xa00000 0x0 0x60000>;
+			#dma-cells = <3>;
+			interrupts = <GIC_SPI 279 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 280 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 283 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 284 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 293 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 294 IRQ_TYPE_LEVEL_HIGH>;
+			dma-channels = <8>;
+			dma-channel-mask = <0xf>;
+			iommus = <&apps_smmu 0x376 0x0>;
+			status = "disabled";
+		};
+
+		qupv3_id_1: geniqup@ac0000 {
+			compatible = "qcom,geni-se-qup";
+			reg = <0x0 0xac0000 0x0 0x2000>;
+			ranges;
+			clocks = <&gcc GCC_QUPV3_WRAP_1_M_AHB_CLK>,
+				 <&gcc GCC_QUPV3_WRAP_1_S_AHB_CLK>;
+			clock-names = "m-ahb",
+				      "s-ahb";
+			iommus = <&apps_smmu 0x363 0x0>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			i2c4: i2c@a80000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S0_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_i2c4_data_clk>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>,
+						<&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config",
+						     "qup-memory";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 0 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 0 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			spi4: spi@a80000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S0_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_spi4_data_clk>, <&qup_spi4_cs>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 0 QCOM_GPI_SPI>,
+				       <&gpi_dma1 1 0 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart4: serial@a80000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S0_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_uart4_cts>, <&qup_uart4_rts>,
+					    <&qup_uart4_tx>, <&qup_uart4_rx>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c5: i2c@a84000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa84000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S1_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_i2c5_data_clk>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>,
+						<&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config",
+						     "qup-memory";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 1 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 1 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			i2c6: i2c@a88000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S2_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_i2c6_data_clk>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>,
+						<&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config",
+						     "qup-memory";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 2 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 2 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			spi6: spi@a88000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S2_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_spi6_data_clk>, <&qup_spi6_cs>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 2 QCOM_GPI_SPI>,
+				       <&gpi_dma1 1 2 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart6: serial@a88000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S2_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_uart6_cts>, <&qup_uart6_rts>,
+					    <&qup_uart6_tx>, <&qup_uart6_rx>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c7: i2c@a8c000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa8c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S3_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_i2c7_data_clk>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>,
+						<&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config",
+						     "qup-memory";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 3 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 3 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			spi7: spi@a8c000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa8c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S3_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_spi7_data_clk>, <&qup_spi7_cs>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 3 QCOM_GPI_SPI>,
+				       <&gpi_dma1 1 3 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart7: serial@a8c000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa8c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S3_CLK>;
+				clock-names = "se";
+				pinctrl-0 = <&qup_uart7_cts>, <&qup_uart7_rts>,
+					    <&qup_uart7_tx>, <&qup_uart7_rx>;
+				pinctrl-names = "default";
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				interconnects = <&aggre1_noc MASTER_BLSP_1 QCOM_ICC_TAG_ALWAYS
+						 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
+				power-domains = <&rpmhpd RPMHPD_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+		};
+
+		config_noc: interconnect@1500000 {
+			reg = <0x0 0x01500000 0x0 0x5080>;
+			compatible = "qcom,qcs615-config-noc";
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		system_noc: interconnect@1620000 {
+			reg = <0x0 0x01620000 0x0 0x1f300>;
+			compatible = "qcom,qcs615-system-noc";
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		aggre1_noc: interconnect@1700000 {
+			reg = <0x0 0x01700000 0x0 0x3f200>;
+			compatible = "qcom,qcs615-aggre1-noc";
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		mmss_noc: interconnect@1740000 {
+			reg = <0x0 0x01740000 0x0 0x1c100>;
+			compatible = "qcom,qcs615-mmss-noc";
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		ufs_mem_hc: ufshc@1d84000 {
+			compatible = "qcom,qcs615-ufshc", "qcom,ufshc", "jedec,ufs-2.0";
+			reg = <0x0 0x01d84000 0x0 0x3000>,
+			      <0x0 0x01d90000 0x0 0x8000>;
+			reg-names = "std",
+				    "ice";
+
+			interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>;
+
+			clocks = <&gcc GCC_UFS_PHY_AXI_CLK>,
+				 <&gcc GCC_AGGRE_UFS_PHY_AXI_CLK>,
+				 <&gcc GCC_UFS_PHY_AHB_CLK>,
+				 <&gcc GCC_UFS_PHY_UNIPRO_CORE_CLK>,
+				 <&gcc GCC_UFS_PHY_ICE_CORE_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GCC_UFS_PHY_TX_SYMBOL_0_CLK>,
+				 <&gcc GCC_UFS_PHY_RX_SYMBOL_0_CLK>;
+			clock-names = "core_clk",
+				      "bus_aggr_clk",
+				      "iface_clk",
+				      "core_clk_unipro",
+				      "core_clk_ice",
+				      "ref_clk",
+				      "tx_lane0_sync_clk",
+				      "rx_lane0_sync_clk";
+
+			resets = <&gcc GCC_UFS_PHY_BCR>;
+			reset-names = "rst";
+
+			operating-points-v2 = <&ufs_opp_table>;
+			interconnects = <&aggre1_noc MASTER_UFS_MEM QCOM_ICC_TAG_ALWAYS
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+					<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &config_noc SLAVE_UFS_MEM_CFG QCOM_ICC_TAG_ACTIVE_ONLY>;
+			interconnect-names = "ufs-ddr",
+					     "cpu-ufs";
+
+			power-domains = <&gcc UFS_PHY_GDSC>;
+
+			iommus = <&apps_smmu 0x300 0x0>;
+			dma-coherent;
+
+			lanes-per-direction = <1>;
+
+			phys = <&ufs_mem_phy>;
+			phy-names = "ufsphy";
+
+			#reset-cells = <1>;
+
+			status = "disabled";
+
+			ufs_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-50000000 {
+					opp-hz = /bits/ 64 <50000000>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <37500000>,
+						 /bits/ 64 <75000000>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <0>;
+					required-opps = <&rpmhpd_opp_low_svs>;
+				};
+
+				opp-100000000 {
+					opp-hz = /bits/ 64 <100000000>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <75000000>,
+						 /bits/ 64 <150000000>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <0>;
+					required-opps = <&rpmhpd_opp_svs>;
+				};
+
+				opp-200000000 {
+					opp-hz = /bits/ 64 <200000000>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <150000000>,
+						 /bits/ 64 <300000000>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <0>,
+						 /bits/ 64 <0>;
+					required-opps = <&rpmhpd_opp_nom>;
+				};
+			};
+		};
+
+		ufs_mem_phy: phy@1d87000 {
+			compatible = "qcom,qcs615-qmp-ufs-phy", "qcom,sm6115-qmp-ufs-phy";
+			reg = <0x0 0x01d87000 0x0 0xe00>;
+			clocks = <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
+				 <&gcc GCC_UFS_MEM_CLKREF_CLK>;
+			clock-names = "ref",
+				      "ref_aux",
+				      "qref";
+
+			power-domains = <&gcc UFS_PHY_GDSC>;
+
+			resets = <&ufs_mem_hc 0>;
+			reset-names = "ufsphy";
+
+			#clock-cells = <1>;
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		tcsr_mutex: hwlock@1f40000 {
+			compatible = "qcom,tcsr-mutex";
+			reg = <0x0 0x01f40000 0x0 0x20000>;
+			#hwlock-cells = <1>;
+		};
+
+		tcsr: syscon@1fc0000 {
+			compatible = "qcom,qcs615-tcsr", "syscon";
+			reg = <0x0 0x01fc0000 0x0 0x30000>;
+		};
+
+		tlmm: pinctrl@3100000 {
+			compatible = "qcom,qcs615-tlmm";
+			reg = <0x0 0x03100000 0x0 0x300000>,
+			      <0x0 0x03500000 0x0 0x300000>,
+			      <0x0 0x03d00000 0x0 0x300000>;
+			reg-names = "east",
+				    "west",
+				    "south";
+			interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
+			gpio-ranges = <&tlmm 0 0 124>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+			wakeup-parent = <&pdc>;
+
+			qup_i2c1_data_clk: qup-i2c1-data-clk-state {
+				pins = "gpio4", "gpio5";
+				function = "qup0";
+
+			};
+
+			qup_i2c2_data_clk: qup-i2c2-data-clk-state {
+				pins = "gpio0", "gpio1";
+				function = "qup0";
+			};
+
+			qup_i2c3_data_clk: qup-i2c3-data-clk-state {
+				pins = "gpio18", "gpio19";
+				function = "qup0";
+			};
+
+			qup_i2c4_data_clk: qup-i2c4-data-clk-state {
+				pins = "gpio20", "gpio21";
+				function = "qup1";
+			};
+
+			qup_i2c5_data_clk: qup-i2c5-data-clk-state {
+				pins = "gpio14", "gpio15";
+				function = "qup1";
+			};
+
+			qup_i2c6_data_clk: qup-i2c6-data-clk-state {
+				pins = "gpio6", "gpio7";
+				function = "qup1";
+			};
+
+			qup_i2c7_data_clk: qup-i2c7-data-clk-state {
+				pins = "gpio10", "gpio11";
+				function = "qup1";
+			};
+
+			qup_spi2_data_clk: qup-spi2-data-clk-state {
+				pins = "gpio0", "gpio1", "gpio2";
+				function = "qup0";
+			};
+
+			qup_spi2_cs: qup-spi2-cs-state {
+				pins = "gpio3";
+				function = "qup0";
+			};
+
+			qup_spi2_cs_gpio: qup-spi2-cs-gpio-state {
+				pins = "gpio3";
+				function = "gpio";
+			};
+
+			qup_spi4_data_clk: qup-spi4-data-clk-state {
+				pins = "gpio20", "gpio21", "gpio22";
+				function = "qup1";
+			};
+
+			qup_spi4_cs: qup-spi4-cs-state {
+				pins = "gpio23";
+				function = "qup1";
+			};
+
+			qup_spi4_cs_gpio: qup-spi4-cs-gpio-state {
+				pins = "gpio23";
+				function = "gpio";
+			};
+
+			qup_spi6_data_clk: qup-spi6-data-clk-state {
+				pins = "gpio6", "gpio7", "gpio8";
+				function = "qup1";
+			};
+
+			qup_spi6_cs: qup-spi6-cs-state {
+				pins = "gpio9";
+				function = "qup1";
+			};
+
+			qup_spi6_cs_gpio: qup-spi6-cs-gpio-state {
+				pins = "gpio9";
+				function = "gpio";
+			};
+
+			qup_spi7_data_clk: qup-spi7-data-clk-state {
+				pins = "gpio10", "gpio11", "gpio12";
+				function = "qup1";
+			};
+
+			qup_spi7_cs: qup-spi7-cs-state {
+				pins = "gpio13";
+				function = "qup1";
+			};
+
+			qup_spi7_cs_gpio: qup-spi7-cs-gpio-state {
+				pins = "gpio13";
+				function = "gpio";
+			};
+
+			qup_uart0_tx: qup-uart0-tx-state {
+				pins = "gpio16";
+				function = "qup0";
+			};
+
+			qup_uart0_rx: qup-uart0-rx-state {
+				pins = "gpio17";
+				function = "qup0";
+			};
+
+			qup_uart2_cts: qup-uart2-cts-state {
+				pins = "gpio0";
+				function = "qup0";
+			};
+
+			qup_uart2_rts: qup-uart2-rts-state {
+				pins = "gpio1";
+				function = "qup0";
+			};
+
+			qup_uart2_tx: qup-uart2-tx-state {
+				pins = "gpio2";
+				function = "qup0";
+			};
+
+			qup_uart2_rx: qup-uart2-rx-state {
+				pins = "gpio3";
+				function = "qup0";
+			};
+
+			qup_uart4_cts: qup-uart4-cts-state {
+				pins = "gpio20";
+				function = "qup1";
+			};
+
+			qup_uart4_rts: qup-uart4-rts-state {
+				pins = "gpio21";
+				function = "qup1";
+			};
+
+			qup_uart4_tx: qup-uart4-tx-state {
+				pins = "gpio22";
+				function = "qup1";
+			};
+
+			qup_uart4_rx: qup-uart4-rx-state {
+				pins = "gpio23";
+				function = "qup1";
+			};
+
+			qup_uart6_cts: qup-uart6-cts-state {
+				pins = "gpio6";
+				function = "qup1";
+			};
+
+			qup_uart6_rts: qup-uart6-rts-state {
+				pins = "gpio7";
+				function = "qup1";
+			};
+
+			qup_uart6_tx: qup-uart6-tx-state {
+				pins = "gpio8";
+				function = "qup1";
+			};
+
+			qup_uart6_rx: qup-uart6-rx-state {
+				pins = "gpio9";
+				function = "qup1";
+			};
+
+			qup_uart7_cts: qup-uart7-cts-state {
+				pins = "gpio10";
+				function = "qup1";
+			};
+
+			qup_uart7_rts: qup-uart7-rts-state {
+				pins = "gpio11";
+				function = "qup1";
+			};
+
+			qup_uart7_tx: qup-uart7-tx-state {
+				pins = "gpio12";
+				function = "qup1";
+			};
+
+			qup_uart7_rx: qup-uart7-rx-state {
+				pins = "gpio13";
+				function = "qup1";
+			};
+
+			sdc1_state_on: sdc1-on-state {
+				clk-pins {
+					pins = "sdc1_clk";
+					bias-disable;
+					drive-strength = <16>;
+				};
+
+				cmd-pins {
+					pins = "sdc1_cmd";
+					bias-pull-up;
+					drive-strength = <10>;
+				};
+
+				data-pins {
+					pins = "sdc1_data";
+					bias-pull-up;
+					drive-strength = <10>;
+				};
+
+				rclk-pins {
+					pins = "sdc1_rclk";
+					bias-pull-down;
+				};
+			};
+
+			sdc1_state_off: sdc1-off-state {
+				clk-pins {
+					pins = "sdc1_clk";
+					bias-disable;
+					drive-strength = <2>;
+				};
+
+				cmd-pins {
+					pins = "sdc1_cmd";
+					bias-pull-up;
+					drive-strength = <2>;
+				};
+
+				data-pins {
+					pins = "sdc1_data";
+					bias-pull-up;
+					drive-strength = <2>;
+				};
+
+				rclk-pins {
+					pins = "sdc1_rclk";
+					bias-pull-down;
+				};
+			};
+
+			sdc2_state_on: sdc2-on-state {
+				clk-pins {
+					pins = "sdc2_clk";
+					bias-disable;
+					drive-strength = <16>;
+				};
+
+				cmd-pins {
+					pins = "sdc2_cmd";
+					bias-pull-up;
+					drive-strength = <10>;
+				};
+
+				data-pins {
+					pins = "sdc2_data";
+					bias-pull-up;
+					drive-strength = <10>;
+				};
+			};
+
+			sdc2_state_off: sdc2-off-state {
+				clk-pins {
+					pins = "sdc2_clk";
+					bias-disable;
+					drive-strength = <2>;
+				};
+
+				cmd-pins {
+					pins = "sdc2_cmd";
+					bias-pull-up;
+					drive-strength = <2>;
+				};
+
+				data-pins {
+					pins = "sdc2_data";
+					bias-pull-up;
+					drive-strength = <2>;
+				};
+			};
+		};
+
+		stm@6002000 {
+			compatible = "arm,coresight-stm", "arm,primecell";
+			reg = <0x0 0x06002000 0x0 0x1000>,
+			      <0x0 0x16280000 0x0 0x180000>;
+			reg-names = "stm-base",
+				    "stm-stimulus-base";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					stm_out: endpoint {
+						remote-endpoint = <&funnel_in0_in7>;
+					};
+				};
+			};
+		};
+
+		tpda@6004000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x06004000 0x0 0x1000>;
+			device-name = "tpda_qdss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					tpda_qdss_in0: endpoint {
+						remote-endpoint = <&tpdm_center_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+
+					tpda_qdss_in4: endpoint {
+						remote-endpoint = <&funnel_monaq_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+
+					tpda_qdss_in5: endpoint {
+						remote-endpoint = <&funnel_ddr_0_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+
+					tpda_qdss_in6: endpoint {
+						remote-endpoint = <&funnel_turing_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+
+					tpda_qdss_in7: endpoint {
+						remote-endpoint = <&tpdm_vsense_out>;
+					};
+				};
+
+				port@8 {
+					reg = <8>;
+
+					tpda_qdss_in8: endpoint {
+						remote-endpoint = <&tpdm_dcc_out>;
+					};
+				};
+
+				port@9 {
+					reg = <9>;
+
+					tpda_qdss_in9: endpoint {
+						remote-endpoint = <&tpdm_prng_out>;
+					};
+				};
+
+				port@b {
+					reg = <11>;
+
+					tpda_qdss_in11: endpoint {
+						remote-endpoint = <&tpdm_qm_out>;
+					};
+				};
+
+				port@c {
+					reg = <12>;
+
+					tpda_qdss_in12: endpoint {
+						remote-endpoint = <&tpdm_west_out>;
+					};
+				};
+
+				port@d {
+					reg = <13>;
+
+					tpda_qdss_in13: endpoint {
+						remote-endpoint = <&tpdm_pimem_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					tpda_qdss_out: endpoint {
+						remote-endpoint = <&funnel_qatb_in>;
+					};
+				};
+			};
+		};
+
+		funnel@6005000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x06005000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					funnel_qatb_in: endpoint {
+						remote-endpoint = <&tpda_qdss_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+
+					funnel_qatb_in5: endpoint {
+						remote-endpoint = <&dup_funnel_monaq_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+
+					funnel_qatb_in7: endpoint {
+						remote-endpoint = <&dup_funnel_turing_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_qatb_out: endpoint {
+						remote-endpoint = <&funnel_in0_in6>;
+					};
+				};
+			};
+		};
+
+		cti@6010000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06010000 0x0 0x1000>;
+			device-name = "cti_qdss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6011000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06011000 0x0 0x1000>;
+			device-name = "cti_qdss_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6012000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06012000 0x0 0x1000>;
+			device-name = "cti_qdss_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6013000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06013000 0x0 0x1000>;
+			device-name = "cti_qdss_3";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6014000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06014000 0x0 0x1000>;
+			device-name = "cti_qdss_4";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6015000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06015000 0x0 0x1000>;
+			device-name = "cti_qdss_5";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6016000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06016000 0x0 0x1000>;
+			device-name = "cti_qdss_6";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6017000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06017000 0x0 0x1000>;
+			device-name = "cti_qdss_7";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6018000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06018000 0x0 0x1000>;
+			device-name = "cti_qdss_8";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6019000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06019000 0x0 0x1000>;
+			device-name = "cti_qdss_9";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@601a000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601a000 0x0 0x1000>;
+			device-name = "cti_qdss_10";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@601b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601b000 0x0 0x1000>;
+			device-name = "cti_qdss_11";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@601c000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601c000 0x0 0x1000>;
+			device-name = "cti_qdss_12";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@601d000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601d000 0x0 0x1000>;
+			device-name = "cti_qdss_13";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@601e000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601e000 0x0 0x1000>;
+			device-name = "cti_qdss_14";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@601f000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601f000 0x0 0x1000>;
+			device-name = "cti_qdss_15";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		funnel@6041000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x06041000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@6 {
+					reg = <6>;
+
+					funnel_in0_in6: endpoint {
+						remote-endpoint = <&funnel_qatb_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+
+					funnel_in0_in7: endpoint {
+						remote-endpoint = <&stm_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_in0_out: endpoint {
+						remote-endpoint = <&funnel_merg_in0>;
+					};
+				};
+			};
+		};
+
+		funnel@6042000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x06042000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@3 {
+					reg = <3>;
+
+					funnel_in1_in3: endpoint {
+						remote-endpoint = <&replicator_swao_out0>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+
+					funnel_in1_in4: endpoint {
+						remote-endpoint = <&tpdm_wcss_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+
+					funnel_in1_in7: endpoint {
+						remote-endpoint = <&funnel_apss_merg_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_in1_out: endpoint {
+						remote-endpoint = <&funnel_merg_in1>;
+					};
+				};
+			};
+		};
+
+		funnel@6045000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x06045000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					funnel_merg_in0: endpoint {
+						remote-endpoint = <&funnel_in0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+
+					funnel_merg_in1: endpoint {
+						remote-endpoint = <&funnel_in1_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_merg_out: endpoint {
+						remote-endpoint = <&tmc_etf_in>;
+					};
+				};
+			};
+		};
+
+		replicator@6046000 {
+			compatible = "arm,coresight-dynamic-replicator", "arm,primecell";
+			reg = <0x0 0x06046000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					replicator0_in: endpoint {
+						remote-endpoint= <&tmc_etf_out>;
+					};
+				};
+			};
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					replicator0_out0: endpoint {
+						remote-endpoint = <&tmc_etr_in>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+
+					replicator0_out1: endpoint {
+						remote-endpoint= <&replicator1_in>;
+					};
+				};
+			};
+		};
+
+		tmc@6047000 {
+			compatible = "arm,coresight-tmc", "arm,primecell";
+			reg = <0x0 0x06047000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					tmc_etf_in: endpoint {
+						remote-endpoint = <&funnel_merg_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					tmc_etf_out: endpoint {
+						remote-endpoint = <&replicator0_in>;
+					};
+				};
+			};
+		};
+
+		tmc_etr: tmc@6048000 {
+			compatible = "arm,coresight-tmc", "arm,primecell";
+			reg = <0x0 0x06048000 0x0 0x1000>,
+			      <0x0 0x06064000 0x0 0x15000>;
+			reg-names = "tmc-base",
+				    "bam-base";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			iommus = <&apps_smmu 0x00a0 0x0>,
+				 <&apps_smmu 0x01e0 0x0>;
+
+			arm,scatter-gather;
+			arm,buffer-size = <0x400000>;
+
+			in-ports {
+				port {
+					tmc_etr_in: endpoint {
+						remote-endpoint = <&replicator0_out0>;
+					};
+				};
+			};
+		};
+
+		replicator@604a000 {
+			compatible = "arm,coresight-dynamic-replicator", "arm,primecell";
+			reg = <0x0 0x0604a000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					replicator1_in: endpoint {
+						remote-endpoint= <&replicator0_out1>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					replicator1_out: endpoint {
+						remote-endpoint= <&funnel_swao_in6>;
+					};
+				};
+			};
+		};
+
+		funnel@6080000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x06080000 0x0 0x10>,
+			      <0x0 0x06861000 0x0 0x1000>;
+			reg-names = "funnel-base-dummy",
+				    "funnel-base-real";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,primecell-periphid = <0x000bb908>;
+			qcom,duplicate-funnel;
+
+			in-ports {
+				port {
+					dup_funnel_turing_in: endpoint {
+						remote-endpoint = <&turing0_etm0_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					dup_funnel_turing_out: endpoint {
+						remote-endpoint = <&funnel_qatb_in7>;
+					};
+				};
+			};
+		};
+
+		cti@683b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0683b000 0x0 0x1000>;
+			device-name = "cti_qdsp6";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@6840000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06840000 0x0 0x1000>;
+			device-name = "tpdm_vsense";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					tpdm_vsense_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in7>;
+					};
+				};
+			};
+		};
+
+		tpdm@684c000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x0684c000 0x0 0x1000>;
+			device-name = "tpdm_prng";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_prng_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in9>;
+					};
+				};
+			};
+		};
+
+		tpdm@6850000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06850000 0x0 0x1000>;
+			device-name = "tpdm_pimem";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_pimem_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in13>;
+					};
+				};
+			};
+		};
+
+		tpdm@6860000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06860000 0x0 0x1000>;
+			device-name = "tpdm_turing";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_turing_out: endpoint {
+						remote-endpoint = <&funnel_turing_in>;
+					};
+				};
+			};
+		};
+
+		funnel@6861000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x06861000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					funnel_turing_in: endpoint {
+						remote-endpoint = <&tpdm_turing_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_turing_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in6>;
+					};
+				};
+			};
+		};
+
+		cti@6867000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06867000 0x0 0x1000>;
+			device-name = "cti_turing";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@6870000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06870000 0x0 0x1000>;
+			device-name = "tpdm_dcc";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					tpdm_dcc_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in8>;
+					};
+				};
+			};
+		};
+
+		tpdm@699c000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x0699c000 0x0 0x1000>;
+			device-name = "tpdm_wcss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					tpdm_wcss_out: endpoint {
+						remote-endpoint = <&funnel_in1_in4>;
+					};
+				};
+			};
+		};
+
+		tpdm@69c0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x069c0000 0x0 0x1000>;
+			device-name = "tpdm_monaq";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_monaq_out: endpoint {
+						remote-endpoint = <&funnel_monaq_in>;
+					};
+				};
+			};
+		};
+
+		funnel@69c1000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x069c1000 0x0 0x1>,
+			      <0x0 0x069c3000 0x0 0x1000>;
+			reg-names = "funnel-base-dummy",
+				    "funnel-base-real";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,primecell-periphid = <0x000bb908>;
+			qcom,duplicate-funnel;
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@1 {
+					reg = <1>;
+
+					dup_funnel_monaq_in1: endpoint {
+						remote-endpoint = <&audio_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					dup_funnel_monaq_out: endpoint {
+						remote-endpoint = <&funnel_qatb_in5>;
+					};
+				};
+			};
+		};
+
+		funnel@69c3000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x069c3000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					funnel_monaq_in: endpoint {
+						remote-endpoint = <&tpdm_monaq_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_monaq_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in4>;
+					};
+				};
+			};
+		};
+
+		tpdm@69d0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x069d0000 0x0 0x1000>;
+			device-name = "tpdm_qm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					tpdm_qm_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in11>;
+					};
+				};
+			};
+		};
+
+		tpdm@6a00000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06a00000 0x0 0x1000>;
+			device-name = "tpdm_ddr";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					tpdm_ddr_out: endpoint {
+						remote-endpoint = <&funnel_ddr_0_in>;
+					};
+				};
+			};
+		};
+
+		cti@6a02000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06a02000 0x0 0x1000>;
+			device-name = "cti_ddr_dl0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6a03000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06a03000 0x0 0x1000>;
+			device-name = "cti_ddr_dl0_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6a10000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06a10000 0x0 0x1000>;
+			device-name = "cti_ddr_dl1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6a11000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06a11000 0x0 0x1000>;
+			device-name = "cti_ddr_dl1_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		funnel@6a05000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x06a05000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					funnel_ddr_0_in: endpoint {
+						remote-endpoint = <&tpdm_ddr_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_ddr_0_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in5>;
+					};
+				};
+			};
+		};
+
+		tpda@6b01000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x06b01000 0x0 0x1000>;
+			device-name = "tpda_swao";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					tpda_swao_in0: endpoint {
+						remote-endpoint = <&tpdm_swao0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+
+					tpda_swao_in1: endpoint {
+						remote-endpoint = <&tpdm_swao1_out>;
+					};
+
+				};
+			};
+
+			out-ports {
+				port {
+					tpda_swao_out: endpoint {
+						remote-endpoint = <&funnel_swao_in7>;
+					};
+				};
+			};
+		};
+
+		tpdm@6b02000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06b02000 0x0 0x1000>;
+			device-name = "tpdm_swao_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					tpdm_swao0_out: endpoint {
+						remote-endpoint = <&tpda_swao_in0>;
+					};
+				};
+			};
+		};
+
+		tpdm@6b03000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06b03000 0x0 0x1000>;
+			device-name = "tpdm_swao_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					tpdm_swao1_out: endpoint {
+						remote-endpoint = <&tpda_swao_in1>;
+					};
+				};
+			};
+		};
+
+		cti@6b04000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b04000 0x0 0x1000>;
+			device-name = "cti_swao";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6b05000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b05000 0x0 0x1000>;
+			device-name = "cti_swao_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6b06000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b06000 0x0 0x1000>;
+			device-name = "cti_swao_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6b07000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b07000 0x0 0x1000>;
+			device-name = "cti_swao_3";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		funnel@6b08000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x06b08000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@6 {
+					reg = <6>;
+
+					funnel_swao_in6: endpoint {
+						remote-endpoint= <&replicator1_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+
+					funnel_swao_in7: endpoint {
+						remote-endpoint= <&tpda_swao_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_swao_out: endpoint {
+						remote-endpoint = <&tmc_etf_swao_in>;
+					};
+				};
+			};
+		};
+
+		tmc@6b09000 {
+			compatible = "arm,coresight-tmc", "arm,primecell";
+			reg = <0x0 0x06b09000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					tmc_etf_swao_in: endpoint {
+						remote-endpoint= <&funnel_swao_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					tmc_etf_swao_out: endpoint {
+						remote-endpoint= <&replicator_swao_in>;
+					};
+				};
+			};
+		};
+
+		replicator@6b0a000 {
+			compatible = "arm,coresight-dynamic-replicator", "arm,primecell";
+			reg = <0x0 0x06b0a000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					replicator_swao_in: endpoint {
+						remote-endpoint = <&tmc_etf_swao_out>;
+					};
+				};
+			};
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					replicator_swao_out0: endpoint {
+						remote-endpoint = <&funnel_in1_in3>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+
+					replicator_swao_out1: endpoint {
+						remote-endpoint = <&eud_in>;
+					};
+				};
+			};
+		};
+
+		cti@6b21000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b21000 0x0 0x1000>;
+			device-name = "cti_aop_m3";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@6b48000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06b48000 0x0 0x1000>;
+			device-name = "tpdm_west";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_west_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in12>;
+					};
+				};
+			};
+		};
+
+		cti@6c13000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06c13000 0x0 0x1000>;
+			device-name = "cti_titan";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6c20000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06c20000 0x0 0x1000>;
+			device-name = "cti_venus";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+		};
+
+		tpdm@6c28000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06c28000 0x0 0x1000>;
+			device-name = "tpdm_center";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_center_out: endpoint {
+						remote-endpoint = <&tpda_qdss_in0>;
+					};
+				};
+			};
+		};
+
+		cti@6c29000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06c29000 0x0 0x1000>;
+			device-name = "cti_dlct";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6c2a000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06c2a000 0x0 0x1000>;
+			device-name = "cti_dlct_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@7020000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07020000 0x0 0x1000>;
+			device-name = "cti_apss_apb_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		etm@7040000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x07040000 0x0 0x1000>;
+			cpu = <&cpu0>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm0_out: endpoint {
+						remote-endpoint = <&funnel_apss_in0>;
+					};
+				};
+			};
+		};
+
+		cti@7120000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07120000 0x0 0x1000>;
+			device-name = "cti_apss_apb_3";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		etm@7140000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x07140000 0x0 0x1000>;
+			cpu = <&cpu1>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm1_out: endpoint {
+						remote-endpoint = <&funnel_apss_in1>;
+					};
+				};
+			};
+		};
+
+		cti@7220000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07220000 0x0 0x1000>;
+			device-name = "cti_apss_apb_4";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		etm@7240000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x07240000 0x0 0x1000>;
+			cpu = <&cpu2>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm2_out: endpoint {
+						remote-endpoint = <&funnel_apss_in2>;
+					};
+				};
+			};
+		};
+
+		cti@7320000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07320000 0x0 0x1000>;
+			device-name = "cti_apss_apb_5";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		etm@7340000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x07340000 0x0 0x1000>;
+			cpu = <&cpu3>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm3_out: endpoint {
+						remote-endpoint = <&funnel_apss_in3>;
+					};
+				};
+			};
+		};
+
+		cti@7420000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07420000 0x0 0x1000>;
+			device-name = "cti_apss_apb_6";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		etm@7440000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x07440000 0x0 0x1000>;
+			cpu = <&cpu4>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm4_out: endpoint {
+						remote-endpoint = <&funnel_apss_in4>;
+					};
+				};
+			};
+		};
+
+		cti@7520000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07520000 0x0 0x1000>;
+			device-name = "cti_apss_apb_7";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		etm@7540000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x07540000 0x0 0x1000>;
+			cpu = <&cpu5>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm5_out: endpoint {
+						remote-endpoint = <&funnel_apss_in5>;
+					};
+				};
+			};
+		};
+
+		cti@7620000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07620000 0x0 0x1000>;
+			device-name = "cti_apss_apb_8";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		etm@7640000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x07640000 0x0 0x1000>;
+			cpu = <&cpu6>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm6_out: endpoint {
+						remote-endpoint = <&funnel_apss_in6>;
+					};
+				};
+			};
+		};
+
+		cti@7720000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07720000 0x0 0x1000>;
+			device-name = "cti_apss_apb_9";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		etm@7740000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x07740000 0x0 0x1000>;
+			cpu = <&cpu7>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm7_out: endpoint {
+						remote-endpoint = <&funnel_apss_in7>;
+					};
+				};
+			};
+		};
+
+		funnel@7800000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x07800000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					funnel_apss_in0: endpoint {
+						remote-endpoint = <&etm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+
+					funnel_apss_in1: endpoint {
+						remote-endpoint = <&etm1_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+
+					funnel_apss_in2: endpoint {
+						remote-endpoint = <&etm2_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+
+					funnel_apss_in3: endpoint {
+						remote-endpoint = <&etm3_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+
+					funnel_apss_in4: endpoint {
+						remote-endpoint = <&etm4_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+
+					funnel_apss_in5: endpoint {
+						remote-endpoint = <&etm5_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+
+					funnel_apss_in6: endpoint {
+						remote-endpoint = <&etm6_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+
+					funnel_apss_in7: endpoint {
+						remote-endpoint = <&etm7_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_apss_out: endpoint {
+						remote-endpoint = <&funnel_apss_merg_in0>;
+					};
+				};
+			};
+		};
+
+		funnel@7810000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x07810000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					funnel_apss_merg_in0: endpoint {
+						remote-endpoint = <&funnel_apss_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+
+					funnel_apss_merg_in2: endpoint {
+						remote-endpoint = <&tpda_olc_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+
+					funnel_apss_merg_in3: endpoint {
+						remote-endpoint = <&tpda_llm_silver_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+
+					funnel_apss_merg_in4: endpoint {
+						remote-endpoint = <&tpda_llm_gold_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+
+					funnel_apss_merg_in5: endpoint {
+						remote-endpoint = <&tpda_apss_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					funnel_apss_merg_out: endpoint {
+						remote-endpoint = <&funnel_in1_in7>;
+					};
+				};
+			};
+		};
+
+		tpdm@7830000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x07830000 0x0 0x1000>;
+			device-name = "tpdm_olc";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_olc_out: endpoint {
+						remote-endpoint = <&tpda_olc_in>;
+					};
+				};
+			};
+		};
+
+		tpda@7832000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x07832000 0x0 0x1000>;
+			device-name = "tpda_olc";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					tpda_olc_in: endpoint {
+						remote-endpoint = <&tpdm_olc_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					tpda_olc_out: endpoint {
+						remote-endpoint = <&funnel_apss_merg_in2>;
+					};
+				};
+			};
+		};
+
+		tpdm@7860000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x07860000 0x0 0x1000>;
+			device-name = "tpdm_apss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_apss_out: endpoint {
+						remote-endpoint = <&tpda_apss_in>;
+					};
+				};
+			};
+		};
+
+		tpda@7862000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x07862000 0x0 0x1000>;
+			device-name = "tpda_apss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					tpda_apss_in: endpoint {
+						remote-endpoint = <&tpdm_apss_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					tpda_apss_out: endpoint {
+						remote-endpoint = <&funnel_apss_merg_in5>;
+					};
+				};
+			};
+		};
+
+		tpdm@78a0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x078a0000 0x0 0x1000>;
+			device-name = "tpdm_llm_silver";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_llm_silver_out: endpoint {
+						remote-endpoint = <&tpda_llm_silver_in>;
+					};
+				};
+			};
+		};
+
+		tpdm@78b0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x078b0000 0x0 0x1000>;
+			device-name = "tpdm_llm_gold";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_llm_gold_out: endpoint {
+						remote-endpoint = <&tpda_llm_gold_in>;
+					};
+				};
+			};
+		};
+
+		tpda@78c0000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x078c0000 0x0 0x1000>;
+			device-name = "tpda_llm_silver";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					tpda_llm_silver_in: endpoint {
+						remote-endpoint = <&tpdm_llm_silver_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					tpda_llm_silver_out: endpoint {
+						remote-endpoint = <&funnel_apss_merg_in3>;
+					};
+				};
+			};
+		};
+
+		tpda@78d0000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x078d0000 0x0 0x1000>;
+			device-name = "tpda_llm_gold";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					tpda_llm_gold_in: endpoint {
+						remote-endpoint = <&tpdm_llm_gold_out>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					tpda_llm_gold_out: endpoint {
+						remote-endpoint = <&funnel_apss_merg_in4>;
+					};
+				};
+			};
+		};
+
+		cti@78e0000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x078e0000 0x0 0x1000>;
+			device-name = "cti_apss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@78f0000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x078f0000 0x0 0x1000>;
+			device-name = "cti_apss_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@7900000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07900000 0x0 0x1000>;
+			device-name = "cti_apss_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		pmu@90b6300 {
+			compatible = "qcom,qcs615-cpu-bwmon", "qcom,sdm845-bwmon";
+			reg = <0x0 0x090b6300 0x0 0x600>;
+			interrupts = <GIC_SPI 581 IRQ_TYPE_LEVEL_HIGH>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &gem_noc SLAVE_LLCC QCOM_ICC_TAG_ACTIVE_ONLY>;
+
+			operating-points-v2 = <&cpu_bwmon_opp_table>;
+
+			cpu_bwmon_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-0 {
+					opp-peak-kBps = <12896000>;
+				};
+
+				opp-1 {
+					opp-peak-kBps = <14928000>;
+				};
+			};
+		};
+
+		pmu@90cd000 {
+			compatible = "qcom,qcs615-llcc-bwmon", "qcom,sc7280-llcc-bwmon";
+			reg = <0x0 0x090cd000 0x0 0x1000>;
+			interrupts = <GIC_SPI 667 IRQ_TYPE_LEVEL_HIGH>;
+			interconnects = <&mc_virt MASTER_LLCC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>;
+
+			operating-points-v2 = <&llcc_bwmon_opp_table>;
+
+			llcc_bwmon_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-0 {
+					opp-peak-kBps = <800000>;
+				};
+
+				opp-1 {
+					opp-peak-kBps = <1200000>;
+				};
+
+				opp-2 {
+					opp-peak-kBps = <1804800>;
+				};
+
+				opp-3 {
+					opp-peak-kBps = <2188800>;
+				};
+
+				opp-4 {
+					opp-peak-kBps = <2726400>;
+				};
+
+				opp-5 {
+					opp-peak-kBps = <3072000>;
+				};
+
+				opp-6 {
+					opp-peak-kBps = <4070400>;
+				};
+
+				opp-7 {
+					opp-peak-kBps = <5414400>;
+				};
+
+				opp-8 {
+					opp-peak-kBps = <6220800>;
+				};
+			};
+		};
+
+		sdhc_2: mmc@8804000 {
+			compatible = "qcom,qcs615-sdhci", "qcom,sdhci-msm-v5";
+			reg = <0x0 0x08804000 0x0 0x1000>;
+			reg-names = "hc";
+
+			interrupts = <GIC_SPI 204 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 222 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "hc_irq",
+					  "pwr_irq";
+
+			clocks = <&gcc GCC_SDCC2_AHB_CLK>,
+				 <&gcc GCC_SDCC2_APPS_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "iface",
+				      "core",
+				      "xo";
+
+			power-domains = <&rpmhpd RPMHPD_CX>;
+			operating-points-v2 = <&sdhc2_opp_table>;
+			iommus = <&apps_smmu 0x02a0 0x0>;
+			resets = <&gcc GCC_SDCC2_BCR>;
+			interconnects = <&aggre1_noc MASTER_SDCC_2 QCOM_ICC_TAG_ALWAYS
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+					<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &config_noc SLAVE_SDCC_2 QCOM_ICC_TAG_ACTIVE_ONLY>;
+			interconnect-names = "sdhc-ddr",
+					     "cpu-sdhc";
+
+			qcom,dll-config = <0x0007642c>;
+			qcom,ddr-config = <0x80040868>;
+			dma-coherent;
+
+			status = "disabled";
+
+			sdhc2_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-50000000 {
+					opp-hz = /bits/ 64 <50000000>;
+					required-opps = <&rpmhpd_opp_low_svs>;
+				};
+
+				opp-100000000 {
+					opp-hz = /bits/ 64 <100000000>;
+					required-opps = <&rpmhpd_opp_svs>;
+				};
+
+				opp-202000000 {
+					opp-hz = /bits/ 64 <202000000>;
+					required-opps = <&rpmhpd_opp_nom>;
+				};
+			};
+		};
+
+		gpucc: clock-controller@5090000 {
+			compatible = "qcom,qcs615-gpucc";
+			reg = <0x0 0x05090000 0x0 0x9000>;
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GPLL0>;
+
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		dc_noc: interconnect@9160000 {
+			reg = <0x0 0x09160000 0x0 0x3200>;
+			compatible = "qcom,qcs615-dc-noc";
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		llcc: system-cache-controller@9200000 {
+			compatible = "qcom,qcs615-llcc";
+			reg = <0x0 0x09200000 0x0 0x50000>,
+			      <0x0 0x09600000 0x0 0x50000>;
+			reg-names = "llcc0_base",
+				    "llcc_broadcast_base";
+		};
+
+		gem_noc: interconnect@9680000 {
+			reg = <0x0 0x09680000 0x0 0x3e200>;
+			compatible = "qcom,qcs615-gem-noc";
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		videocc: clock-controller@ab00000 {
+			compatible = "qcom,qcs615-videocc";
+			reg = <0x0 0x0ab00000 0x0 0x10000>;
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>,
+				 <&sleep_clk>;
+
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		camcc: clock-controller@ad00000 {
+			compatible = "qcom,qcs615-camcc";
+			reg = <0x0 0x0ad00000 0x0 0x10000>;
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>;
+
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		dispcc: clock-controller@af00000 {
+			compatible = "qcom,qcs615-dispcc";
+			reg = <0x0 0x0af00000 0x0 0x20000>;
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GCC_DISP_GPLL0_DIV_CLK_SRC>;
+
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		pdc: interrupt-controller@b220000 {
+			compatible = "qcom,qcs615-pdc", "qcom,pdc";
+			reg = <0x0 0x0b220000 0x0 0x30000>,
+			      <0x0 0x17c000f0 0x0 0x64>;
+			qcom,pdc-ranges = <0 480 94>, <94 609 31>, <125 63 1>;
+			interrupt-parent = <&intc>;
+			#interrupt-cells = <2>;
+			interrupt-controller;
+		};
+
+		aoss_qmp: power-controller@c300000 {
+			compatible = "qcom,qcs615-aoss-qmp", "qcom,aoss-qmp";
+			reg = <0x0 0x0c300000 0x0 0x400>;
+			interrupts = <GIC_SPI 389 IRQ_TYPE_EDGE_RISING>;
+			mboxes = <&apss_shared 0>;
+
+			#clock-cells = <0>;
+			#power-domain-cells = <1>;
+		};
+
+		sram@c3f0000 {
+			compatible = "qcom,rpmh-stats";
+			reg = <0x0 0x0c3f0000 0x0 0x400>;
+		};
+
+		apps_smmu: iommu@15000000 {
+			compatible = "qcom,qcs615-smmu-500", "qcom,smmu-500", "arm,mmu-500";
+			reg = <0x0 0x15000000 0x0 0x80000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <1>;
+			dma-coherent;
+
+			interrupts = <GIC_SPI 65 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 109 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 183 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 185 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 315 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 316 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 336 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 337 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 338 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 340 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		spmi_bus: spmi@c440000 {
+			compatible = "qcom,spmi-pmic-arb";
+			reg = <0x0 0x0c440000 0x0 0x1100>,
+			      <0x0 0x0c600000 0x0 0x2000000>,
+			      <0x0 0x0e600000 0x0 0x100000>,
+			      <0x0 0x0e700000 0x0 0xa0000>,
+			      <0x0 0x0c40a000 0x0 0x26000>;
+			reg-names = "core",
+				    "chnls",
+				    "obsrvr",
+				    "intr",
+				    "cnfg";
+			interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "periph_irq";
+			interrupt-controller;
+			#interrupt-cells = <4>;
+			#address-cells = <2>;
+			#size-cells = <0>;
+			cell-index = <0>;
+			qcom,channel = <0>;
+			qcom,ee = <0>;
+		};
+
+		intc: interrupt-controller@17a00000 {
+			compatible = "arm,gic-v3";
+			reg = <0x0 0x17a00000 0x0 0x10000>,     /* GICD */
+			      <0x0 0x17a60000 0x0 0x100000>;    /* GICR * 8 */
+			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+			#interrupt-cells = <3>;
+			interrupt-controller;
+			#redistributor-regions = <1>;
+			redistributor-stride = <0x0 0x20000>;
+		};
+
+		apss_shared: mailbox@17c00000 {
+			compatible = "qcom,qcs615-apss-shared",
+				     "qcom,sdm845-apss-shared";
+			reg = <0x0 0x17c00000 0x0 0x1000>;
+			#mbox-cells = <1>;
+		};
+
+		watchdog: watchdog@17c10000 {
+			compatible = "qcom,apss-wdt-qcs615", "qcom,kpss-wdt";
+			reg = <0x0 0x17c10000 0x0 0x1000>;
+			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		timer@17c20000 {
+			compatible = "arm,armv7-timer-mem";
+			reg = <0x0 0x17c20000 0x0 0x1000>;
+			ranges = <0 0 0 0x20000000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			frame@17c21000 {
+				reg = <0x17c21000 0x1000>,
+				      <0x17c22000 0x1000>;
+				frame-number = <0>;
+				interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
+					     <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>;
+			};
+
+			frame@17c23000 {
+				reg = <0x17c23000 0x1000>;
+				frame-number = <1>;
+				interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c25000 {
+				reg = <0x17c25000 0x1000>;
+				frame-number = <2>;
+				interrupts = <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c27000 {
+				reg = <0x17c27000 0x1000>;
+				frame-number = <3>;
+				interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c29000 {
+				reg = <0x17c29000 0x1000>;
+				frame-number = <4>;
+				interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c2b000 {
+				reg = <0x17c2b000 0x1000>;
+				frame-number = <5>;
+				interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c2d000 {
+				reg = <0x17c2d000 0x1000>;
+				frame-number = <6>;
+				interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+		};
+
+		apps_rsc: rsc@18200000 {
+			compatible = "qcom,rpmh-rsc";
+			reg = <0x0 0x18200000 0x0 0x10000>,
+			      <0x0 0x18210000 0x0 0x10000>,
+			      <0x0 0x18220000 0x0 0x10000>;
+			reg-names = "drv-0",
+				    "drv-1",
+				    "drv-2";
+
+			interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
+
+			qcom,drv-id = <2>;
+			qcom,tcs-offset = <0xd00>;
+			qcom,tcs-config = <ACTIVE_TCS    2>,
+					  <SLEEP_TCS     3>,
+					  <WAKE_TCS      3>,
+					  <CONTROL_TCS   1>;
+
+			label = "apps_rsc";
+			power-domains = <&cluster_pd>;
+
+			apps_bcm_voter: bcm-voter {
+				compatible = "qcom,bcm-voter";
+			};
+
+			rpmhcc: clock-controller {
+				compatible = "qcom,qcs615-rpmh-clk";
+				clock-names = "xo";
+
+				#clock-cells = <1>;
+			};
+
+			rpmhpd: power-controller {
+				compatible = "qcom,qcs615-rpmhpd";
+				#power-domain-cells = <1>;
+				operating-points-v2 = <&rpmhpd_opp_table>;
+
+				rpmhpd_opp_table: opp-table {
+					compatible = "operating-points-v2";
+
+					rpmhpd_opp_ret: opp-0 {
+						opp-level = <RPMH_REGULATOR_LEVEL_RETENTION>;
+					};
+
+					rpmhpd_opp_min_svs: opp-1 {
+						opp-level = <RPMH_REGULATOR_LEVEL_MIN_SVS>;
+					};
+
+					rpmhpd_opp_low_svs: opp-2 {
+						opp-level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+					};
+
+					rpmhpd_opp_svs: opp-3 {
+						opp-level = <RPMH_REGULATOR_LEVEL_SVS>;
+					};
+
+					rpmhpd_opp_svs_l1: opp-4 {
+						opp-level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+					};
+
+					rpmhpd_opp_nom: opp-5 {
+						opp-level = <RPMH_REGULATOR_LEVEL_NOM>;
+					};
+
+					rpmhpd_opp_nom_l1: opp-6 {
+						opp-level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+					};
+
+					rpmhpd_opp_nom_l2: opp-7 {
+						opp-level = <RPMH_REGULATOR_LEVEL_NOM_L2>;
+					};
+
+					rpmhpd_opp_turbo: opp-8 {
+						opp-level = <RPMH_REGULATOR_LEVEL_TURBO>;
+					};
+
+					rpmhpd_opp_turbo_l1: opp-9 {
+						opp-level = <RPMH_REGULATOR_LEVEL_TURBO_L1>;
+					};
+				};
+			};
+		};
+
+		usb_1_hsphy: phy@88e2000 {
+			compatible = "qcom,qcs615-qusb2-phy";
+			reg = <0x0 0x88e2000 0x0 0x180>;
+
+			clocks = <&gcc GCC_AHB2PHY_WEST_CLK>, <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "cfg_ahb", "ref";
+
+			resets = <&gcc GCC_QUSB2PHY_PRIM_BCR>;
+			nvmem-cells = <&qusb2_hstx_trim>;
+
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_hsphy_2: phy@88e3000 {
+			compatible = "qcom,qcs615-qusb2-phy";
+			reg = <0x0 0x088e3000 0x0 0x180>;
+
+			clocks = <&gcc GCC_AHB2PHY_WEST_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "cfg_ahb",
+				      "ref";
+
+			resets = <&gcc GCC_QUSB2PHY_SEC_BCR>;
+
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_qmpphy: phy@88e6000 {
+			compatible = "qcom,qcs615-qmp-usb3-phy";
+			reg = <0x0 0x88e6000 0x0 0x1000>;
+
+			clocks = <&gcc GCC_USB3_PRIM_PHY_AUX_CLK>,
+				 <&gcc GCC_USB3_PRIM_CLKREF_CLK>,
+				 <&gcc GCC_AHB2PHY_WEST_CLK>,
+				 <&gcc GCC_USB3_PRIM_PHY_PIPE_CLK>;
+			clock-names = "aux",
+				      "ref",
+				      "cfg_ahb",
+				      "pipe";
+
+			resets = <&gcc GCC_USB3_PHY_PRIM_SP0_BCR>,
+				 <&gcc GCC_USB3PHY_PHY_PRIM_SP0_BCR>;
+			reset-names = "phy", "phy_phy";
+
+			qcom,tcsr-reg = <&tcsr 0xb244>;
+
+			clock-output-names = "usb3_phy_pipe_clk_src";
+			#clock-cells = <0>;
+
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_1: usb@a6f8800 {
+			compatible = "qcom,qcs615-dwc3", "qcom,dwc3";
+			reg = <0x0 0x0a6f8800 0x0 0x400>;
+
+			clocks = <&gcc GCC_CFG_NOC_USB3_PRIM_AXI_CLK>,
+				 <&gcc GCC_USB30_PRIM_MASTER_CLK>,
+				 <&gcc GCC_AGGRE_USB3_PRIM_AXI_CLK>,
+				 <&gcc GCC_USB30_PRIM_SLEEP_CLK>,
+				 <&gcc GCC_USB30_PRIM_MOCK_UTMI_CLK>,
+				 <&gcc GCC_USB3_PRIM_CLKREF_CLK>;
+			clock-names = "cfg_noc",
+				      "core",
+				      "iface",
+				      "sleep",
+				      "mock_utmi",
+				      "xo";
+
+			assigned-clocks = <&gcc GCC_USB30_PRIM_MOCK_UTMI_CLK>,
+					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
+			assigned-clock-rates = <19200000>, <200000000>;
+
+			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 8 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 6 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq",
+					  "ss_phy_irq";
+
+			power-domains = <&gcc USB30_PRIM_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
+
+			resets = <&gcc GCC_USB30_PRIM_BCR>;
+
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			status = "disabled";
+
+			usb_1_dwc3: usb@a600000 {
+				compatible = "snps,dwc3";
+				reg = <0x0 0x0a600000 0x0 0xcd00>;
+
+				iommus = <&apps_smmu 0x140 0x0>;
+				interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>;
+
+				phys = <&usb_1_hsphy>, <&usb_qmpphy>;
+				phy-names = "usb2-phy", "usb3-phy";
+
+				snps,dis-u1-entry-quirk;
+				snps,dis-u2-entry-quirk;
+				snps,dis_u2_susphy_quirk;
+				snps,dis_enblslpm_quirk;
+				snps,has-lpm-erratum;
+				snps,hird-threshold = /bits/ 8 <0x10>;
+				snps,usb3_lpm_capable;
+			};
+		};
+
+		usb_2: usb@a8f8800 {
+			compatible = "qcom,qcs615-dwc3", "qcom,dwc3";
+			reg = <0x0 0x0a8f8800 0x0 0x400>;
+
+			clocks = <&gcc GCC_CFG_NOC_USB2_SEC_AXI_CLK>,
+				 <&gcc GCC_USB20_SEC_MASTER_CLK>,
+				 <&gcc GCC_AGGRE_USB2_SEC_AXI_CLK>,
+				 <&gcc GCC_USB20_SEC_SLEEP_CLK>,
+				 <&gcc GCC_USB20_SEC_MOCK_UTMI_CLK>,
+				 <&gcc GCC_USB2_PRIM_CLKREF_CLK>;
+			clock-names = "cfg_noc",
+				      "core",
+				      "iface",
+				      "sleep",
+				      "mock_utmi",
+				      "xo";
+
+			assigned-clocks = <&gcc GCC_USB20_SEC_MOCK_UTMI_CLK>,
+					  <&gcc GCC_USB20_SEC_MASTER_CLK>;
+			assigned-clock-rates = <19200000>, <200000000>;
+
+			interrupts-extended = <&intc GIC_SPI 663 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 662 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 11 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq";
+
+			power-domains = <&gcc USB20_SEC_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
+
+			resets = <&gcc GCC_USB20_SEC_BCR>;
+
+			qcom,select-utmi-as-pipe-clk;
+
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			status = "disabled";
+
+			usb_2_dwc3: usb@a800000 {
+				compatible = "snps,dwc3";
+				reg = <0x0 0x0a800000 0x0 0xcd00>;
+
+				iommus = <&apps_smmu 0xe0 0x0>;
+				interrupts = <GIC_SPI 664 IRQ_TYPE_LEVEL_HIGH>;
+
+				phys = <&usb_hsphy_2>;
+				phy-names = "usb2-phy";
+
+				snps,dis_u2_susphy_quirk;
+				snps,dis_enblslpm_quirk;
+				snps,has-lpm-erratum;
+				snps,hird-threshold = /bits/ 8 <0x10>;
+
+				maximum-speed = "high-speed";
+			};
+		};
+	};
+
+	turing0-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+		device-name = "turing0_etm0";
+
+		qcom,atid-num = <2>;
+		qcom,inst-id = <13>;
+		atid = <38 39>;
+
+		out-ports {
+			port {
+				turing0_etm0_out: endpoint {
+					remote-endpoint = <&dup_funnel_turing_in>;
+				};
+			};
+		};
+	};
+
+	cpufreq_hw: cpufreq@18323000 {
+		compatible = "qcom,cpufreq-hw";
+		reg = <0x0 0x18323000 0x0 0x1400>,
+		      <0x0 0x18325800 0x0 0x1400>;
+		reg-names = "freq-domain0", "freq-domain1";
+
+		clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GPLL0>;
+		clock-names = "xo", "alternate";
+
+		#freq-domain-cells = <1>;
+		#clock-cells = <1>;
+	};
+
+	arch_timer: timer {
+		compatible = "arm,armv8-timer";
+		interrupts = <GIC_PPI 1 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 2 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 3 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 0 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-hsp.dts
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * qcs6490-addons RB3gen2 device tree source
+ *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+/dts-v1/;
+
+#include "qcs6490-addons-rb3gen2.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. Robotics RB3gen2 addons hsp platform";
+	compatible = "qcom,qcs6490-addons-rb3gen2-hsp","qcom,qcm6490";
+
+	qcom,msm-id = <497 0x10000>, <498 0x10000>, <475 0x10000>, <515 0x10000>;
+	qcom,board-id = <32 0x6>, <32 0x606>;
+};
+
+&pcie0 {
+	perst-gpios = <&tlmm 87 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie0_reset_n>, <&pcie0_wake_n>, <&pcie0_clkreq_n>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&pcie0_phy {
+	status = "okay";
+	vdda-phy-supply = <&vreg_l10c_0p88>;
+	vdda-pll-supply = <&vreg_l6b_1p2>;
+};
+
+&remoteproc_mpss {
+	status = "disabled";
+};
+
+&remoteproc_wpss {
+	status = "disabled";
+};
+
+&uart7 {
+	/delete-node/ bluetooth;
+
+	bluetooth: bluetooth {
+		compatible = "qcom,wcn6855-bt";
+		pinctrl-names = "default";
+		pinctrl-0 = <&bt_en>, <&sw_ctrl>;
+		enable-gpios = <&tlmm 85 GPIO_ACTIVE_HIGH>;
+		swctrl-gpios = <&tlmm 86 GPIO_ACTIVE_HIGH>;
+		vddio-supply = <&vreg_s7b_0p972>;
+		vddbtcxmx-supply = <&vreg_s7b_0p972>;
+		vddrfacmn-supply = <&vreg_s7b_0p972>;
+		vddrfa0p8-supply = <&vreg_s7b_0p972>;
+		vddrfa1p7-supply = <&vreg_s1b_1p872>;
+		vddrfa1p2-supply = <&vreg_s8b_1p272>;
+		max-speed = <3200000>;
+	};
+};
+
+&wifi {
+	status = "disabled";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-ia-mezz.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-ia-mezz.dts
@@ -0,0 +1,651 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs6490-rb3gen2.dts"
+#include "qcs6490-addons-rb3gen2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. Robotics RB3gen2 addons ia mezz platform";
+	compatible = "qcom,qcs6490-addons-rb3gen2-ia-mezz", "qcom,qcm6490";
+
+	qcom,msm-id = <497 0x10000>, <498 0x10000>, <475 0x10000>, <515 0x10000>;
+	qcom,board-id = <32 0x9>, <32 0x609>;
+
+	aliases {
+		hsuart0 = &uart4;
+	};
+
+	wcd9375: audio-codec-0 {
+		compatible = "qcom,wcd9370-codec";
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&wcd_reset_n>;
+		pinctrl-1 = <&wcd_reset_n_sleep>;
+		reset-gpios = <&tlmm 83 GPIO_ACTIVE_HIGH>;
+		qcom,micbias1-microvolt = <1800000>;
+		qcom,micbias2-microvolt = <1800000>;
+		qcom,micbias3-microvolt = <1800000>;
+		qcom,rx-device = <&wcd937x_rx>;
+		qcom,tx-device = <&wcd937x_tx>;
+		qcom,hphl-jack-type-normally-closed = <1>;
+		qcom,ground-jack-type-normally-closed = <1>;
+		qcom,always-on-supply;
+		#sound-dai-cells = <1>;
+	};
+
+	qps615_rc0_resx_vreg: qps615-rc0-resx-vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "qps615_rc0_resx_vreg";
+		gpio = <&tlmm 78 0>;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		enable-active-high;
+		regulator-enable-ramp-delay = <10000>;
+	};
+
+	qps615_rc1_resx_vreg: qps615-rc1-resx-vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "qps615_rc1_resx_vreg";
+		gpio = <&tlmm 124 0>;
+		vin-supply = <&qps615_1p8_vreg>;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		enable-active-high;
+		regulator-enable-ramp-delay = <10000>;
+	};
+};
+
+&i2c1 {
+	status = "okay";
+
+	i2c-mux@71 {
+		compatible = "nxp,pca9847";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x71>;
+
+		i2c@1 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <1>;
+			usb-hub@2d {
+				compatible = "microchip,usb5807";
+				reg = <0x2d>;
+				/* Swapped D+/D- on port 0 */
+				swap-dx-lanes = <1>;
+			};
+		};
+
+		i2c@2 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <2>;
+			usb-hub@2d {
+				compatible = "microchip,usb5807";
+				reg = <0x2d>;
+				/* Swapped D+/D- on port 0 */
+				swap-dx-lanes = <1>;
+			};
+		};
+
+		i2c@3 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <3>;
+		};
+
+		i2c@4 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <4>;
+		};
+
+		i2c@5 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <5>;
+		};
+
+		i2c@6 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <6>;
+		};
+
+		i2c@7 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <7>;
+		};
+	};
+
+	qps615_rc0_switch: pcie-switch-0@33 {
+		compatible = "qcom,switch-i2c";
+		reg = <0x33>;
+		vdda-supply = <&qps615_rc0_resx_vreg>;
+		status = "okay";
+	};
+};
+
+&i2c2 {
+	status = "okay";
+
+	i2c-mux@71 {
+		compatible = "nxp,pca9847";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x71>;
+
+		i2c@0 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <0>;
+		};
+
+		i2c@1 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <1>;
+		};
+
+		i2c@2 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <2>;
+		};
+
+		i2c@3 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <3>;
+		};
+
+		i2c@4 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <4>;
+		};
+	};
+
+	qps615_rc1_switch: pcie-switch-1@77 {
+		compatible = "qcom,switch-i2c";
+		reg = <0x77>;
+		status = "okay";
+	};
+};
+
+&lpass_rx_swr_clk {
+	drive-strength = <2>;
+	slew-rate = <1>;
+	bias-disable;
+};
+
+&lpass_rx_swr_data {
+	drive-strength = <2>;
+	slew-rate = <1>;
+	bias-bus-hold;
+};
+
+&lpass_tx_swr_clk {
+	drive-strength = <2>;
+	slew-rate = <1>;
+	bias-disable;
+};
+
+&lpass_tx_swr_data {
+	drive-strength = <2>;
+	slew-rate = <1>;
+	bias-bus-hold;
+};
+
+
+&pcie0 {
+	bus-range = <0x80 0xff>;
+	iommu-map = <0x8000 &apps_smmu 0x1c00 0x1>,
+		    <0x8100 &apps_smmu 0x1c01 0x1>,
+		    <0x8208 &apps_smmu 0x1c04 0x1>,
+		    <0x8210 &apps_smmu 0x1c05 0x1>,
+		    <0x8218 &apps_smmu 0x1c06 0x1>,
+		    <0x8300 &apps_smmu 0x1c07 0x1>,
+		    <0x8400 &apps_smmu 0x1c08 0x1>,
+		    <0x8500 &apps_smmu 0x1c09 0x1>,
+		    <0x8501 &apps_smmu 0x1c10 0x1>;
+	dummy-supply = <&qps615_rc0_switch>;
+	status = "okay";
+
+	pcieport: pcie@0 {
+		device_type = "pci";
+		reg = <0x0 0x0 0x0 0x0 0x0>;
+		#address-cells = <5>;
+		#size-cells = <0>;
+		/* BDF 1.0.0 */
+		pcie0_bus1_dev0_fn0: pcie0-bus1-dev0-fn0 {
+			reg = <0x0 0x0 0x0 0x0 0x0>;
+			/* BDF 2.1.0 */
+			pcie0_bus2_dev1_fn0: pcie0-bus2-dev1-fn0 {
+				reg = <0x800 0x0 0x0 0x0 0x0>;
+				/* BDF 3.0.0 */
+				pcie0_bus3_dev0_fn0: pcie0-bus3-dev0-fn0 {
+					reg = <0x0 0x0 0x0 0x0 0x0>;
+				};
+			};
+			/* BDF 2.2.0 */
+			pcie0_bus2_dev2_fn0: pcie0-bus2-dev2-fn0 {
+				reg = <0x1000 0x0 0x0 0x0 0x0>;
+				/* BDF 4.0.0 */
+				pcie0_bus4_dev0_fn0: pcie0-bus4-dev0-fn0 {
+					reg = <0x0 0x0 0x0 0x0 0x0>;
+				};
+			};
+			/* BDF 2.3.0 */
+			pcie0_bus2_dev3_fn0: pcie0-bus2-dev3-fn0 {
+				reg = <0x1800 0x0 0x0 0x0 0x0>;
+				pcie0_qps615_eth0,pcie0_qps615_eth0@pcie0_rp {
+					reg = <0x0 0x0 0x0 0x0 0x0>;
+					pinctrl-names = "default";
+					pinctrl-0 = <&rtl_rc0_intn_wol_sig>;
+					phy-rst-som-gpios = <&tlmm 90 GPIO_ACTIVE_HIGH>;
+					interrupts-extended = <&tlmm 136 IRQ_TYPE_EDGE_FALLING>;
+					qcom,phy-port-interface = <4>;
+					qcom,mdc-clk = <0x8>;
+					qcom,c45-state = <0>;
+					qcom,link-down-macrst = <0>;
+					interrupt-names = "wol_irq";
+					qcom,always-on-supply;
+					qcom,phy-rst-delay-us = <75000>;
+					#address-cells = <1>;
+					#size-cells = <1>;
+				};
+
+
+				/* BDF 5.0.0 */
+				pcie0_bus5_dev0_fn0: pcie1-qps-eth0 {
+					reg = <0x0 0x0 0x0 0x0 0x0>;
+				};
+
+
+				pcie0_qps615_eth1,pcie0_qps615_eth1@pcie0_rp {
+					reg = <0x100 0x0 0x0 0x0 0x0>;
+					pinctrl-names = "default";
+					pinctrl-0 = <&napa_rc0_intn_wol_sig>;
+					phy-rst-som-gpios = <&tlmm 25 GPIO_ACTIVE_HIGH>;
+					interrupts-extended = <&tlmm 142 IRQ_TYPE_EDGE_FALLING>;
+					interrupt-names = "wol_irq";
+					qcom,always-on-supply;
+					qcom,phy-rst-delay-us = <20000>;
+					#address-cells = <1>;
+					#size-cells = <1>;
+				};
+				/* BDF 5.0.1 */
+				pcie0_bus5_dev0_fn1: pcie1-qps-eth1 {
+					reg = <0x100 0x0 0x0 0x0 0x0>;
+				};
+			};
+		};
+	};
+};
+
+&pcie0_phy {
+	qcom,refclk-always-on;
+	status = "okay";
+};
+
+&pcie1 {
+	iommu-map = <0x0 &apps_smmu 0x1c80 0x1>,
+		    <0x100 &apps_smmu 0x1c81 0x1>,
+		    <0x208 &apps_smmu 0x1c84 0x1>,
+		    <0x210 &apps_smmu 0x1c85 0x1>,
+		    <0x218 &apps_smmu 0x1c86 0x1>,
+		    <0x300 &apps_smmu 0x1c87 0x1>,
+		    <0x408 &apps_smmu 0x1c90 0x1>,
+		    <0x410 &apps_smmu 0x1c91 0x1>,
+		    <0x418 &apps_smmu 0x1c92 0x1>,
+		    <0x500 &apps_smmu 0x1c93 0x1>,
+		    <0x600 &apps_smmu 0x1c94 0x1>,
+		    <0x700 &apps_smmu 0x1c95 0x1>,
+		    <0x701 &apps_smmu 0x1c96 0x1>,
+		    <0x800 &apps_smmu 0x1c97 0x1>,
+		    <0x900 &apps_smmu 0x1c98 0x1>,
+		    <0x901 &apps_smmu 0x1c99 0x1>;
+};
+
+&pcie1_bus3_dev0_fn0 {
+	reg = <0x0 0x0 0x0 0x0 0x0>;
+
+	/* BDF 4.1.0 */
+	pcie1_bus4_dev1_fn0: pcie1-bus4-dev1-fn0 {
+		reg = <0x800 0x0 0x0 0x0 0x0>;
+
+		/* BDF 5.0.0 */
+		pcie1_bus5_rc1_dev0_fn0: pcie1-bus5-rc1-dev0-fn0 {
+			reg = <0x0 0x0 0x0 0x0 0x0>;
+		};
+	};
+
+	/* BDF 4.2.0 */
+	pcie1_bus4_dev2_fn0: pcie1-bus4-dev2-fn0 {
+		reg = <0x1000 0x0 0x0 0x0 0x0>;
+
+		/* BDF 6.0.0 */
+		pcie1_bus6_dev0_fn0: pcie1-bus6-dev0-fn0 {
+			reg = <0x0 0x0 0x0 0x0 0x0>;
+		};
+	};
+
+	/* BDF 4.3.0 */
+	pcie1_bus4_dev3_fn0: pcie1-bus4-dev3-fn0 {
+		reg = <0x1800 0x0 0x0 0x0 0x0>;
+		/* BDF 7.0.0 */
+		pcie1_bus7_dev0_fn0: pcie1-bus7-dev0-fn0 {
+			reg = <0x0 0x0 0x0 0x0 0x0>;
+		};
+
+		/* BDF 7.0.1 */
+		pcie1_bus7_dev0_fn1: pcie1-bus7-dev0-fn1 {
+			reg = <0x100 0x0 0x0 0x0 0x0>;
+		};
+	};
+};
+
+&pm7250b_gpios {
+	gpio5_tpm_dig_out {
+		gpio5_dig_out_default: gpio5_dig_out_default {
+			pins = "gpio5";
+			function = "normal";
+			power-source = <1>;
+			output-high;
+			input-disable;
+			bias-pull-up;
+			qcom,drive-strength = <3>;
+		};
+	};
+};
+
+&qps615_rsex_vreg {
+	vin-supply = <&qps615_rc1_resx_vreg>;
+};
+
+&qupv3_id_1 {
+	status = "okay";
+};
+
+&sound {
+	compatible = "qcom,qcs6490-rb3gen2-ia-sndcard";
+	model = "qcm6490-rb3-ia-snd-card";
+	audio-routing =
+		"SpkrLeft IN", "WSA_SPK1 OUT",
+		"SpkrRight IN", "WSA_SPK2 OUT",
+		"IN1_HPHL", "HPHL_OUT",
+		"IN2_HPHR", "HPHR_OUT",
+		"AMIC2", "MIC BIAS2",
+		"TX SWR_ADC1", "ADC2_OUTPUT",
+		"VA DMIC0", "vdd-micb",
+		"VA DMIC1", "vdd-micb",
+		"VA DMIC2", "vdd-micb",
+		"VA DMIC3", "vdd-micb";
+	#address-cells = <1>;
+	#size-cells = <0>;
+	wcd-playback-dai-link {
+		link-name = "CODEC_DMA-LPAIF_RXTX-RX-0";
+		cpu {
+			sound-dai = <&q6apmbedai RX_CODEC_DMA_RX_0>;
+		};
+
+
+		codec {
+			sound-dai = <&wcd9375 0>, <&swr0 0>, <&lpass_rx_macro 0>;
+		};
+	};
+
+
+	wcd-capture-dai-link {
+		link-name = "CODEC_DMA-LPAIF_RXTX-TX-3";
+		cpu {
+			sound-dai = <&q6apmbedai TX_CODEC_DMA_TX_3>;
+		};
+
+
+		codec {
+			sound-dai = <&wcd9375 1>, <&swr1 0>, <&lpass_tx_macro 0>;
+		};
+	};
+};
+
+&spi11 {
+	status = "okay";
+
+	st33htpm0: st33htpm@0 {
+		compatible = "st,st33htpm-spi";
+		reg = <0>;
+		spi-max-frequency = <20000000>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&gpio5_dig_out_default>;
+		status = "okay";
+	};
+};
+
+&spmi_bus {
+	pmic@PM7250B_SID {
+		pm7250b_bcl: bcl@1d00 {
+			compatible = "qcom,bcl-v5";
+			reg = <0x1d00>;
+			interrupts = <PM7250B_SID 0x1d 0x0 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x1 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x2 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "bcl-lvl0",
+						"bcl-lvl1",
+						"bcl-lvl2";
+			#thermal-sensor-cells = <1>;
+		};
+	};
+};
+
+&swr0 {
+	wcd937x_rx: codec@0,4 {
+		compatible = "sdw20217010a00";
+		reg = <0 4>;
+		qcom,rx-port-mapping = <1 2 3 4 5>;
+	};
+};
+
+&swr1 {
+	wcd937x_tx: codec@0,3 {
+		compatible = "sdw20217010a00";
+		reg = <0 3>;
+		qcom,tx-port-mapping = <1 1 2 3>;
+	};
+};
+
+&thermal_zones {
+	pm7250b-ibat-lvl0 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 0>;
+
+		trips {
+			ibat_lvl0:ibat-lvl0 {
+				temperature = <6000>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-ibat-lvl1 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 1>;
+
+		trips {
+			ibat_lvl1:ibat-lvl1 {
+				temperature = <7500>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl0 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 5>;
+
+		trips {
+			b_bcl_lvl0: b-bcl-lvl0 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+
+			map1 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+
+			map2 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+
+			map3 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+
+			map4 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&cdsp_sw 2 2>;
+			};
+
+			map5 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_pa 2 2>;
+			};
+
+			map6 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl1 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 6>;
+
+		trips {
+			b_bcl_lvl1: b-bcl-lvl1 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&msm_gpu 5 THERMAL_NO_LIMIT>;
+			};
+
+			//map1 {
+			//	trip = <&b_bcl_lvl1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map2 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl2 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 7>;
+
+		trips {
+			b_bcl_lvl2: b-bcl-lvl2 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&b_bcl_lvl2>;
+			//	cooling-device = <&cdsp_sw 5 5>;
+			//};
+		};
+	};
+};
+
+&tlmm {
+	qps615_rc0_intn_wol {
+		rtl_rc0_intn_wol_sig: rtl-rc0-intn-wol-sig {
+			pins = "gpio136";
+			function = "gpio";
+			input-enable;
+			bias-disable;
+		};
+
+		napa_rc0_intn_wol_sig: napa-rc0-intn-wol-sig {
+			pins = "gpio142";
+			function = "gpio";
+			input-enable;
+			bias-disable;
+		};
+	};
+
+	wcd_reset_n: wcd-reset-n-state {
+		pins = "gpio83";
+		function = "gpio";
+		drive-strength = <8>;
+	};
+
+
+	wcd_reset_n_sleep: wcd-reset-n-sleep-state {
+		pins = "gpio83";
+		function = "gpio";
+		drive-strength = <8>;
+		bias-disable;
+	};
+};
+
+&uart4 {
+	status = "okay";
+};
+
+&uart7 {
+	status = "disabled";
+};
+
+&soc {
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "blue:user1";
+			function = LED_FUNCTION_INDICATOR;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pm8350c_gpios 9 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+			panic-indicator;
+			status = "okay";
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-ptz-mezz.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-ptz-mezz.dts
@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs6490-rb3gen2.dts"
+#include "qcs6490-addons-rb3gen2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. Robotics RB3gen2 addons ptz mezz platform";
+	compatible = "qcom,qcs6490-addons-rb3gen2-ptz-mezz", "qcom,qcm6490";
+};
+
+&spmi_bus {
+	pmic@PM7250B_SID {
+		pm7250b_bcl: bcl@1d00 {
+			compatible = "qcom,bcl-v5";
+			reg = <0x1d00>;
+			interrupts = <PM7250B_SID 0x1d 0x0 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x1 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x2 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "bcl-lvl0",
+						"bcl-lvl1",
+						"bcl-lvl2";
+			#thermal-sensor-cells = <1>;
+		};
+	};
+};
+
+&thermal_zones {
+	pm7250b-ibat-lvl0 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 0>;
+
+		trips {
+			ibat_lvl0:ibat-lvl0 {
+				temperature = <6000>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-ibat-lvl1 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 1>;
+
+		trips {
+			ibat_lvl1:ibat-lvl1 {
+				temperature = <7500>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl0 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 5>;
+
+		trips {
+			b_bcl_lvl0: b-bcl-lvl0 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+
+			map1 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+
+			map2 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+
+			map3 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+
+			map4 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&cdsp_sw 2 2>;
+			};
+
+			map5 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_pa 2 2>;
+			};
+
+			map6 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl1 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 6>;
+
+		trips {
+			b_bcl_lvl1: b-bcl-lvl1 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&msm_gpu 5 THERMAL_NO_LIMIT>;
+			};
+
+			//map1 {
+			//	trip = <&b_bcl_lvl1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map2 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl2 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 7>;
+
+		trips {
+			b_bcl_lvl2: b-bcl-lvl2 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&b_bcl_lvl2>;
+			//	cooling-device = <&cdsp_sw 5 5>;
+			//};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-video-mezz.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-video-mezz.dts
@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs6490-rb3gen2.dts"
+#include "qcs6490-addons-rb3gen2.dtsi"
+/ {
+	model = "Qualcomm Technologies, Inc. Robotics RB3gen2 addons video mezz platform";
+	compatible = "qcom,qcs6490-addons-rb3gen2-video-mezz", "qcom,qcm6490";
+
+	qcom,msm-id = <497 0x10000>, <498 0x10000>, <475 0x10000>, <515 0x10000>;
+	qcom,board-id = <32 0x1>, <32 0x601>;
+
+	aliases {
+		serial2 = &uart4;
+	};
+};
+
+&q6apmbedai {
+	qcom,prmcc_clk = <&q6prmcc>;
+};
+
+&sound {
+	compatible = "qcom,qcm6490-sndcard";
+	model = "qcm6490-rb3-vc-snd-card";
+
+	audio-routing =
+		"SpkrLeft IN", "WSA_SPK1 OUT",
+		"SpkrRight IN", "WSA_SPK2 OUT",
+		"VA DMIC0", "vdd-micb",
+		"VA DMIC1", "vdd-micb",
+		"VA DMIC2", "vdd-micb",
+		"VA DMIC3", "vdd-micb",
+		"VA DMIC4", "vdd-micb",
+		"VA DMIC5", "vdd-micb";
+
+	pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep";
+	pinctrl-0 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>, <&mi2s0_ws_sleep>;
+	pinctrl-1 = <&mi2s0_data0>, <&mi2s0_data1>, <&mi2s0_mclk>, <&mi2s0_sclk>, <&mi2s0_ws>;
+	pinctrl-2 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>, <&mi2s0_ws_sleep>;
+
+	mi2s-capture-dai-link {
+		link-name = "MI2S-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	mi2s-playback-dai-link {
+		link-name = "MI2S-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+	tdm-capture-dai-link {
+		link-name = "TDM-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	tdm-playback-dai-link {
+		link-name = "TDM-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+};
+
+&spmi_bus {
+	pmic@PM7250B_SID {
+		pm7250b_bcl: bcl@1d00 {
+			compatible = "qcom,bcl-v5";
+			reg = <0x1d00>;
+			interrupts = <PM7250B_SID 0x1d 0x0 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x1 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x2 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "bcl-lvl0",
+						"bcl-lvl1",
+						"bcl-lvl2";
+			#thermal-sensor-cells = <1>;
+		};
+	};
+};
+
+&thermal_zones {
+	pm7250b-ibat-lvl0 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 0>;
+
+		trips {
+			ibat_lvl0:ibat-lvl0 {
+				temperature = <6000>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-ibat-lvl1 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 1>;
+
+		trips {
+			ibat_lvl1:ibat-lvl1 {
+				temperature = <7500>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl0 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 5>;
+
+		trips {
+			b_bcl_lvl0: b-bcl-lvl0 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+
+			map1 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+
+			map2 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+
+			map3 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+
+			map4 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&cdsp_sw 2 2>;
+			};
+
+			map5 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_pa 2 2>;
+			};
+
+			map6 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl1 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 6>;
+
+		trips {
+			b_bcl_lvl1: b-bcl-lvl1 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&msm_gpu 5 THERMAL_NO_LIMIT>;
+			};
+
+			//map1 {
+			//	trip = <&b_bcl_lvl1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map2 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl2 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 7>;
+
+		trips {
+			b_bcl_lvl2: b-bcl-lvl2 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&b_bcl_lvl2>;
+			//	cooling-device = <&cdsp_sw 5 5>;
+			//};
+		};
+	};
+};
+
+&tlmm {
+	mi2s0_data0_sleep: mi2s0-data0-sleep {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_data1_sleep: mi2s0-data1-sleep {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_mclk_sleep: mi2s0-mclk-sleep {
+		pins = "gpio96";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_sclk_sleep: mi2s0-sclk-sleep {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_ws_sleep: mi2s0-ws-sleep {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+};
+
+&uart4 {
+	status = "okay";
+};
+
+&mi2s0_data0 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_data1 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_mclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_sclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_ws {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-vision-mezz-hsp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-vision-mezz-hsp.dts
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs6490-addons-rb3gen2-vision-mezz.dts"
+
+/ {
+	model = "Qualcomm Technologies, Inc. Robotics RB3gen2 addons vision mezz hsp platform";
+	compatible = "qcom,qcs6490-addons-rb3gen2-vision-mezz-hsp", "qcom,qcm6490";
+
+	qcom,msm-id = <497 0x10000>, <498 0x10000>, <475 0x10000>, <515 0x10000>;
+	qcom,board-id = <32 0x7>, <32 0x607>;
+
+	aliases {
+		serial2 = &uart4;
+	};
+};
+
+&pcie0 {
+	perst-gpios = <&tlmm 87 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&pcie0_reset_n>, <&pcie0_wake_n>, <&pcie0_clkreq_n>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&pcie0_phy {
+	status = "okay";
+	vdda-phy-supply = <&vreg_l10c_0p88>;
+	vdda-pll-supply = <&vreg_l6b_1p2>;
+};
+
+&remoteproc_mpss {
+	status = "disabled";
+};
+
+&remoteproc_wpss {
+	status = "disabled";
+};
+
+&uart7 {
+	/delete-node/ bluetooth;
+
+	bluetooth: bluetooth {
+		compatible = "qcom,wcn6855-bt";
+		pinctrl-names = "default";
+		pinctrl-0 = <&bt_en>, <&sw_ctrl>;
+		enable-gpios = <&tlmm 85 GPIO_ACTIVE_HIGH>;
+		swctrl-gpios = <&tlmm 86 GPIO_ACTIVE_HIGH>;
+		vddio-supply = <&vreg_s7b_0p972>;
+		vddbtcxmx-supply = <&vreg_s7b_0p972>;
+		vddrfacmn-supply = <&vreg_s7b_0p972>;
+		vddrfa0p8-supply = <&vreg_s7b_0p972>;
+		vddrfa1p7-supply = <&vreg_s1b_1p872>;
+		vddrfa1p2-supply = <&vreg_s8b_1p272>;
+		max-speed = <3200000>;
+	};
+};
+
+&wifi {
+	status = "disabled";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-vision-mezz.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2-vision-mezz.dts
@@ -0,0 +1,319 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs6490-rb3gen2.dts"
+#include "qcs6490-addons-rb3gen2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. Robotics RB3gen2 addons vision mezz platform";
+	compatible = "qcom,qcs6490-addons-rb3gen2-vision-mezz", "qcom,qcm6490";
+
+	qcom,msm-id = <497 0x10000>, <498 0x10000>, <475 0x10000>, <515 0x10000>;
+	qcom,board-id = <32 0x2>, <32 0x602>;
+
+	aliases {
+		serial2 = &uart4;
+	};
+};
+
+&q6apmbedai {
+	qcom,prmcc_clk = <&q6prmcc>;
+};
+
+&sound {
+	compatible = "qcom,qcm6490-sndcard";
+	model = "qcm6490-rb3-vision-snd-card";
+
+	audio-routing =
+		"SpkrLeft IN", "WSA_SPK1 OUT",
+		"SpkrRight IN", "WSA_SPK2 OUT",
+		"VA DMIC0", "vdd-micb",
+		"VA DMIC1", "vdd-micb",
+		"VA DMIC2", "vdd-micb",
+		"VA DMIC3", "vdd-micb",
+		"VA DMIC4", "vdd-micb",
+		"VA DMIC5", "vdd-micb";
+
+	pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep";
+	pinctrl-0 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+	pinctrl-1 = <&mi2s0_data0>, <&mi2s0_data1>, <&mi2s0_mclk>, <&mi2s0_sclk>, <&mi2s0_ws>;
+	pinctrl-2 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>,<&mi2s0_ws_sleep>;
+
+	mi2s-capture-dai-link {
+		link-name = "MI2S-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	mi2s-playback-dai-link {
+		link-name = "MI2S-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+	tdm-capture-dai-link {
+		link-name = "TDM-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+	};
+
+	tdm-playback-dai-link {
+		link-name = "TDM-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+	};
+
+};
+
+&spmi_bus {
+	pmic@PM7250B_SID {
+		pm7250b_bcl: bcl@1d00 {
+			compatible = "qcom,bcl-v5";
+			reg = <0x1d00>;
+			interrupts = <PM7250B_SID 0x1d 0x0 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x1 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x2 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "bcl-lvl0",
+						"bcl-lvl1",
+						"bcl-lvl2";
+			#thermal-sensor-cells = <1>;
+		};
+	};
+};
+
+&thermal_zones {
+	pm7250b-ibat-lvl0 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 0>;
+
+		trips {
+			ibat_lvl0:ibat-lvl0 {
+				temperature = <6000>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-ibat-lvl1 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 1>;
+
+		trips {
+			ibat_lvl1:ibat-lvl1 {
+				temperature = <7500>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl0 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 5>;
+
+		trips {
+			b_bcl_lvl0: b-bcl-lvl0 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+
+			map1 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+
+			map2 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+
+			map3 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+
+			map4 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&cdsp_sw 2 2>;
+			};
+
+			map5 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_pa 2 2>;
+			};
+
+			map6 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl1 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 6>;
+
+		trips {
+			b_bcl_lvl1: b-bcl-lvl1 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&msm_gpu 5 THERMAL_NO_LIMIT>;
+			};
+
+			//map1 {
+			//	trip = <&b_bcl_lvl1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map2 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl2 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 7>;
+
+		trips {
+			b_bcl_lvl2: b-bcl-lvl2 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&b_bcl_lvl2>;
+			//	cooling-device = <&cdsp_sw 5 5>;
+			//};
+		};
+	};
+};
+
+&tlmm {
+	mi2s0_data0_sleep: mi2s0-data0-sleep {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_data1_sleep: mi2s0-data1-sleep {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_mclk_sleep: mi2s0-mclk-sleep {
+		pins = "gpio96";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_sclk_sleep: mi2s0-sclk-sleep {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_ws_sleep: mi2s0-ws-sleep {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+};
+
+&uart4 {
+	status = "okay";
+};
+
+&mi2s0_data0 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_data1 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_mclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_sclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_ws {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2.dts
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * qcs6490-addons RB3gen2 device tree source
+ *
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+/dts-v1/;
+
+#include "qcs6490-rb3gen2.dts"
+#include "qcs6490-addons-rb3gen2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. Robotics RB3gen2 addons platform";
+	compatible = "qcom,qcs6490-addons-rb3gen2","qcom,qcm6490";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-addons-rb3gen2.dtsi
@@ -0,0 +1,579 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * qcm6490-addons-rb3gen2 device tree source include
+ *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+#include "qcm6490-addons.dtsi"
+
+/ {
+	qps615_0p9_vreg: qps615-0p9-vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "qps615_0p9_vreg";
+		gpio = <&pm8350c_gpios 2 0>;
+		regulator-min-microvolt = <1000000>;
+		regulator-max-microvolt = <1000000>;
+		enable-active-high;
+		regulator-enable-ramp-delay = <4300>;
+	};
+
+	qps615_1p8_vreg: qps615-1p8-vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "qps615_1p8_vreg";
+		gpio = <&pm8350c_gpios 3 0>;
+		vin-supply = <&qps615_0p9_vreg>;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		enable-active-high;
+		regulator-enable-ramp-delay = <10000>;
+	};
+
+	qps615_rsex_vreg: qps615-rsex-vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "qps615_rsex_vreg";
+		gpio = <&pm8350c_gpios 1 0>;
+		vin-supply = <&qps615_1p8_vreg>;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		enable-active-high;
+		regulator-enable-ramp-delay = <10000>;
+	};
+
+	upd_3p3_vreg: upd_3p3_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "upd_3p3_vreg";
+		gpio = <&pm7250b_gpios 1 0>;
+		vin-supply = <&qps615_rsex_vreg>;
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		enable-active-high;
+		regulator-enable-ramp-delay = <10000>;
+		regulator-always-on;
+	};
+
+	upd_rest_vreg: upd_rest_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "upd_rest_vreg";
+		gpio = <&pm8350c_gpios 4 0>;
+		vin-supply = <&upd_3p3_vreg>;
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		enable-active-high;
+		regulator-always-on;
+	};
+
+	usbhub_rest_vreg: usbhub_rest_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "usbhub_rest_vreg";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pcie1_usb_hub_reset_default>;
+		gpio = <&tlmm 162 GPIO_ACTIVE_LOW>;
+		enable-active-high;
+	};
+
+	qep_vreg: qep_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "qep_vreg";
+		gpio = <&pm7325_gpios 8 0>;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		enable-active-high;
+	};
+
+	aqr_vreg: aqr_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "aqr_vreg";
+		gpio = <&pm7250b_gpios 4 0>;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		enable-active-high;
+	};
+};
+
+&camcc {
+	status = "okay";
+};
+
+&camss {
+	status = "disabled";
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		/* The port index denotes CSIPHY id i.e. csiphy2 */
+		port@3 {
+			reg = <3>;
+			csiphy3_ep: endpoint {
+				clock-lanes = <7>;
+				data-lanes = <0 1 2 3>;
+				remote-endpoint = <&imx577_ep>;
+			};
+		};
+	};
+};
+
+&cci1 {
+	status = "disabled";
+};
+
+&cci1_i2c1 {
+	camera@1a {
+		compatible = "sony,imx577";
+		reg = <0x1a>;
+
+		reset-gpios = <&tlmm 78 GPIO_ACTIVE_LOW>;
+		pinctrl-names = "default", "suspend";
+		pinctrl-0 = <&cam2_default>;
+		pinctrl-1 = <&cam2_suspend>;
+
+		clocks = <&camcc CAM_CC_MCLK3_CLK>,
+			 <&camcc CAM_CC_MCLK2_CLK>;
+		assigned-clocks = <&camcc CAM_CC_MCLK3_CLK>,
+				  <&camcc CAM_CC_MCLK2_CLK>;
+		assigned-clock-rates = <24000000>,
+				       <24000000>;
+
+		dovdd-supply  = <&vreg_l18b_1p8>;
+
+		port {
+			imx577_ep: endpoint {
+				clock-lanes = <7>;
+				link-frequencies = /bits/ 64 <600000000>;
+				data-lanes = <0 1 2 3>;
+				remote-endpoint = <&csiphy3_ep>;
+			};
+		};
+	};
+};
+
+&i2c0 {
+	clock-frequency = <100000>;
+	status = "okay";
+
+	qps615_switch: pcie-switch@77 {
+		compatible = "qcom,switch-i2c";
+		reg = <0x77>;
+		vdda-supply = <&qps615_rsex_vreg>;
+
+		status = "okay";
+	};
+};
+
+&pcie1 {
+	dummy-supply = <&qps615_switch>;
+	pcieport0: pcie@0 {
+		device_type = "pci";
+		reg = <0x0 0x0 0x0 0x0 0x0>;
+		#address-cells = <5>;
+		#size-cells = <0>;
+
+		/* BDF 1.0.0 */
+		pcie1_bus1_dev0_fn0: pcie1_bus1_dev0_fn0 {
+			reg = <0 0 0 0 0>;
+
+			/* BDF 2.1.0 */
+			pcie1_bus2_dev1_fn0: pcie1_bus2_dev1_fn0 {
+				reg = <0x800 0x0 0x0 0x0 0x0>;
+
+				/* BDF 3.0.0 */
+				pcie1_bus3_dev0_fn0: pcie1_bus3_dev0_fn0 {
+					reg = <0x0 0x0 0x0 0x0 0x0>;
+				};
+			};
+
+			/* BDF 2.2.0 */
+			pcie1_bus2_dev2_fn0: pcie1_bus2_dev2_fn0 {
+				reg = <0x1000 0x0 0x0 0x0 0x0>;
+
+				/* BDF 4.0.0 */
+				pcie1_bus4_dev0_fn0: pcie1_bus4_dev0_fn0 {
+					reg = <0x0 0x0 0x0 0x0 0x0>;
+				};
+			};
+
+			/* BDF 2.3.0 */
+			pcie1_bus2_dev3_fn0: pcie1_bus2_dev3_fn0 {
+				reg = <0x1800 0x0 0x0 0x0 0x0>;
+				qps615_eth0,qps615_eth0@pcie1_rp {
+					reg = <0x0 0x0 0x0 0x0 0x0>;
+					pinctrl-names = "default";
+					pinctrl-0 = <&aqr_intn_wol_sig>;
+					qcom,phy-rst-gpio-id = <0>;
+					interrupts-extended = <&tlmm 141 IRQ_TYPE_EDGE_FALLING>;
+					interrupt-names = "wol_irq";
+					phy-supply = <&aqr_vreg>;
+					qcom,phy-rst-delay-us = <221000>;
+					#address-cells = <1>;
+					#size-cells = <1>;
+				};
+
+				/* BDF 5.0.0 */
+				pcie1_bus5_dev0_fn0: pcie1_qps_eth0 {
+					reg = <0x0 0x0 0x0 0x0 0x0>;
+					qcom,iommu-group = <&eth0_pci_iommu_group>;
+					eth0_pci_iommu_group: eth0_pci_iommu_group {
+						qcom,iommu-dma = "atomic";
+					};
+				};
+
+				qps615_eth1,qps615_eth1@pcie1_rp {
+					reg = <0x100 0x0 0x0 0x0 0x0>;
+					pinctrl-names = "default";
+					pinctrl-0 = <&napa_intn_wol_sig>;
+					qcom,phy-rst-gpio-id = <1>;
+					interrupts-extended = <&tlmm 101 IRQ_TYPE_EDGE_FALLING>;
+					interrupt-names = "wol_irq";
+					phy-supply = <&qep_vreg>;
+					qcom,phy-rst-delay-us = <20000>;
+					#address-cells = <1>;
+					#size-cells = <1>;
+				};
+
+				/* BDF 5.0.1 */
+				pcie1_bus5_dev0_fn1: pcie1_qps_eth1 {
+					reg = <0x100 0x0 0x0 0x0 0x0>;
+					qcom,iommu-group = <&eth1_pci_iommu_group>;
+					eth1_pci_iommu_group: eth1_pci_iommu_group {
+						qcom,iommu-dma = "atomic";
+					};
+				};
+			};
+
+		};
+	};
+};
+
+&pcie1_phy {
+	qcom,refclk-always-on;
+};
+
+&q6apmbedai {
+	qcom,prmcc_clk = <&q6prmcc>;
+};
+
+&sound {
+
+	pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep";
+	pinctrl-0 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>, <&mi2s0_ws_sleep>;
+	pinctrl-1 = <&mi2s0_data0>, <&mi2s0_data1>, <&mi2s0_mclk>, <&mi2s0_sclk>, <&mi2s0_ws>;
+	pinctrl-2 = <&mi2s0_data0_sleep>, <&mi2s0_data1_sleep>, <&mi2s0_mclk_sleep>,
+		    <&mi2s0_sclk_sleep>, <&mi2s0_ws_sleep>;
+
+	mi2s-capture-dai-link {
+		link-name = "MI2S-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+		platform {
+			sound-dai = <&q6apm>;
+		};
+	};
+
+	mi2s-playback-dai-link {
+		link-name = "MI2S-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+		platform {
+			sound-dai = <&q6apm>;
+		};
+	};
+
+	tdm-capture-dai-link {
+		link-name = "TDM-LPAIF-TX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 1>;
+		};
+		platform {
+			sound-dai = <&q6apm>;
+		};
+	};
+
+	tdm-playback-dai-link {
+		link-name = "TDM-LPAIF-RX-PRIMARY";
+
+		cpu {
+			sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+		};
+
+		codec {
+			sound-dai = <&msm_stub_codec 0>;
+		};
+		platform {
+			sound-dai = <&q6apm>;
+		};
+	};
+
+};
+
+&tlmm {
+	mi2s0_data0_sleep: mi2s0-data0-sleep {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_data1_sleep: mi2s0-data1-sleep {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_mclk_sleep: mi2s0-mclk-sleep {
+		pins = "gpio96";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_sclk_sleep: mi2s0-sclk-sleep {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s0_ws_sleep: mi2s0-ws-sleep {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	pcie1_usb_hub_reset_default: pcie1_usb_hub_reset_default {
+		pins = "gpio162";
+		function = "gpio";
+		drive-strength = <2>;
+		output-high;
+		bias-pull-down;
+	};
+
+	qps615_intn_wol {
+		aqr_intn_wol_sig: aqr_intn_wol_sig {
+			mux {
+				pins = "gpio141";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio141";
+				input-enable;
+				bias-disable;
+			};
+		};
+
+		napa_intn_wol_sig: napa_intn_wol_sig {
+			mux {
+				pins = "gpio101";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio101";
+				input-enable;
+				bias-disable;
+			};
+		};
+	};
+};
+
+&mi2s0_data0 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_data1 {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&mi2s0_mclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_sclk {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&mi2s0_ws {
+	drive-strength = <8>;
+	bias-disable;
+	output-high;
+};
+
+&spmi_bus {
+	pmic@PM7250B_SID {
+		pm7250b_bcl: bcl@1d00 {
+			compatible = "qcom,bcl-v5";
+			reg = <0x1d00>;
+			interrupts = <PM7250B_SID 0x1d 0x0 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x1 IRQ_TYPE_EDGE_RISING>,
+					<PM7250B_SID 0x1d 0x2 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "bcl-lvl0",
+						"bcl-lvl1",
+						"bcl-lvl2";
+			#thermal-sensor-cells = <1>;
+		};
+	};
+};
+
+&thermal_zones {
+	pm7250b-ibat-lvl0 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 0>;
+
+		trips {
+			ibat_lvl0:ibat-lvl0 {
+				temperature = <6000>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-ibat-lvl1 {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 1>;
+
+		trips {
+			ibat_lvl1:ibat-lvl1 {
+				temperature = <7500>;
+				hysteresis = <200>;
+				type = "passive";
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl0 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 5>;
+
+		trips {
+			b_bcl_lvl0: b-bcl-lvl0 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+
+			map1 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+
+			map2 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+
+			map3 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+
+			map4 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&cdsp_sw 2 2>;
+			};
+
+			map5 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_pa 2 2>;
+			};
+
+			map6 {
+				trip = <&b_bcl_lvl0>;
+				cooling-device = <&modem_tj 1 1>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl1 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 6>;
+
+		trips {
+			b_bcl_lvl1: b-bcl-lvl1 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&msm_gpu 5 THERMAL_NO_LIMIT>;
+			};
+
+			//map1 {
+			//	trip = <&b_bcl_lvl1>;
+			//	cooling-device = <&cdsp_sw 4 4>;
+			//};
+
+			map2 {
+				trip = <&b_bcl_lvl1>;
+				cooling-device = <&modem_tj 3 3>;
+			};
+		};
+	};
+
+	pm7250b-bcl-lvl2 {
+		polling-delay-passive = <100>;
+		polling-delay = <0>;
+		thermal-sensors = <&pm7250b_bcl 7>;
+
+		trips {
+			b_bcl_lvl2: b-bcl-lvl2 {
+				temperature = <1>;
+				hysteresis = <1>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			//map0 {
+			//	trip = <&b_bcl_lvl2>;
+			//	cooling-device = <&cdsp_sw 5 5>;
+			//};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2-vision-mezzanine.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2-vision-mezzanine.dts
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs6490-rb3gen2.dts"
+
+&camcc {
+	status = "okay";
+};
+
+&camss {
+	vdda-phy-supply = <&vreg_l10c_0p88>;
+	vdda-pll-supply = <&vreg_l6b_1p2>;
+	status = "okay";
+
+	ports {
+		/* The port index denotes CSIPHY id i.e. csiphy3 */
+		port@3 {
+			reg = <3>;
+			csiphy3_ep: endpoint {
+				clock-lanes = <7>;
+				data-lanes = <0 1 2 3>;
+				remote-endpoint = <&imx577_ep>;
+			};
+		};
+	};
+};
+
+&cci1 {
+	status = "okay";
+};
+
+&cci1_i2c1 {
+	camera@1a {
+		compatible = "sony,imx577";
+		reg = <0x1a>;
+
+		reset-gpios = <&tlmm 78 GPIO_ACTIVE_LOW>;
+		pinctrl-names = "default", "suspend";
+		pinctrl-0 = <&cam2_default>;
+		pinctrl-1 = <&cam2_suspend>;
+
+		clocks = <&camcc CAM_CC_MCLK3_CLK>;
+		assigned-clocks = <&camcc CAM_CC_MCLK3_CLK>;
+		assigned-clock-rates = <24000000>;
+
+		dovdd-supply  = <&vreg_l18b_1p8>;
+
+		port {
+			imx577_ep: endpoint {
+				clock-lanes = <7>;
+				link-frequencies = /bits/ 64 <600000000>;
+				data-lanes = <0 1 2 3>;
+				remote-endpoint = <&csiphy3_ep>;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: BSD-3-Clause
 /*
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 /dts-v1/;
@@ -9,123 +9,222 @@
 #define PM7250B_SID 8
 #define PM7250B_SID1 9
 
+#include <dt-bindings/iio/qcom,spmi-adc7-pm7325.h>
+#include <dt-bindings/iio/qcom,spmi-adc7-pmk8350.h>
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
 #include <dt-bindings/regulator/qcom,rpmh-regulator.h>
-#include "sc7280.dtsi"
+#include "qcm6490.dtsi"
 #include "pm7250b.dtsi"
 #include "pm7325.dtsi"
 #include "pm8350c.dtsi"
 #include "pmk8350.dtsi"
 
-/delete-node/ &ipa_fw_mem;
-/delete-node/ &remoteproc_mpss;
-/delete-node/ &rmtfs_mem;
-/delete-node/ &adsp_mem;
-/delete-node/ &cdsp_mem;
-/delete-node/ &video_mem;
-/delete-node/ &wlan_ce_mem;
-/delete-node/ &wpss_mem;
-/delete-node/ &xbl_mem;
+/delete-node/ &usb_2_dwc3;
 
 / {
 	model = "Qualcomm Technologies, Inc. Robotics RB3gen2";
-	compatible = "qcom,qcs6490-rb3gen2", "qcom,qcm6490";
-	chassis-type = "embedded";
+	compatible = "qcom,qcm6490-rb3gen2", "qcom,qcm6490";
+
+	qcom,msm-id = <497 0x10000>, <498 0x10000>, <475 0x10000>, <515 0x10000>;
+	qcom,board-id = <32 0x5>, <32 0x605>;
 
 	aliases {
 		serial0 = &uart5;
+		bluetooth0 = &bluetooth;
+		serial1 = &uart7;
 	};
 
 	chosen {
 		stdout-path = "serial0:115200n8";
 	};
 
-	reserved-memory {
-		xbl_mem: xbl@80700000 {
-			reg = <0x0 0x80700000 0x0 0x100000>;
-			no-map;
-		};
-
-		cdsp_secure_heap_mem: cdsp-secure-heap@81800000 {
-			reg = <0x0 0x81800000 0x0 0x1e00000>;
-			no-map;
-		};
-
-		camera_mem: camera@84300000 {
-			reg = <0x0 0x84300000 0x0 0x500000>;
-			no-map;
-		};
-
-		wpss_mem: wpss@84800000 {
-			reg = <0x0 0x84800000 0x0 0x1900000>;
-			no-map;
-		};
-
-		adsp_mem: adsp@86100000 {
-			reg = <0x0 0x86100000 0x0 0x2800000>;
-			no-map;
-		};
-
-		cdsp_mem: cdsp@88900000 {
-			reg = <0x0 0x88900000 0x0 0x1e00000>;
-			no-map;
-		};
-
-		video_mem: video@8a700000 {
-			reg = <0x0 0x8a700000 0x0 0x700000>;
-			no-map;
-		};
-
-		cvp_mem: cvp@8ae00000 {
-			reg = <0x0 0x8ae00000 0x0 0x500000>;
-			no-map;
-		};
-
-		ipa_fw_mem: ipa-fw@8b300000 {
-			reg = <0x0 0x8b300000 0x0 0x10000>;
-			no-map;
-		};
-
-		ipa_gsi_mem: ipa-gsi@8b310000 {
-			reg = <0x0 0x8b310000 0x0 0xa000>;
-			no-map;
-		};
-
-		gpu_microcode_mem: gpu-microcode@8b31a000 {
-			reg = <0x0 0x8b31a000 0x0 0x2000>;
-			no-map;
+	hdmi-connector {
+		compatible = "hdmi-connector";
+		type = "a";
+
+		port {
+			hdmi_con: endpoint {
+				remote-endpoint = <&lt9611_out>;
+			};
 		};
+	};
 
-		tz_stat_mem: tz-stat@c0000000 {
-			reg = <0x0 0xc0000000 0x0 0x100000>;
-			no-map;
-		};
+	lt9611_1v2: lt9611-vdd12-regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "LT9611_1V2";
 
-		tags_mem: tags@c0100000 {
-			reg = <0x0 0xc0100000 0x0 0x1200000>;
-			no-map;
-		};
+		regulator-min-microvolt = <1200000>;
+		regulator-max-microvolt = <1200000>;
+	};
 
-		qtee_mem: qtee@c1300000 {
-			reg = <0x0 0xc1300000 0x0 0x500000>;
-			no-map;
+	gpio-keys {
+		compatible = "gpio-keys";
+		label = "gpio-keys";
+
+		pinctrl-0 = <&key_vol_up_default>;
+		pinctrl-names = "default";
+
+		key-volume-up {
+			label = "volume_up";
+			gpios = <&pm7325_gpios 6 GPIO_ACTIVE_LOW>;
+			linux,input-type = <1>;
+			linux,code = <KEY_VOLUMEUP>;
+			wakeup-source;
+			debounce-interval = <15>;
+			linux,can-disable;
 		};
+	};
 
-		trusted_apps_mem: trusted_apps@c1800000 {
-			reg = <0x0 0xc1800000 0x0 0x1c00000>;
-			no-map;
+	pmic-glink {
+		compatible = "qcom,sm8350-pmic-glink", "qcom,pmic-glink";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		orientation-gpios = <&tlmm 140 GPIO_ACTIVE_HIGH>;
+		qcom,thermal-mitigation = <3000000 1500000 1000000 500000>;
+
+		connector@0 {
+			compatible = "usb-c-connector";
+			reg = <0>;
+			power-role = "dual";
+			data-role = "dual";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					pmic_glink_hs_in: endpoint {
+						remote-endpoint = <&usb_1_dwc3_hs>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+
+					pmic_glink_ss_in: endpoint {
+						remote-endpoint = <&redriver_ss_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+
+					pmic_glink_sbu: endpoint {
+						remote-endpoint = <&fsa4480_sbu_mux>;
+					};
+				};
+			};
 		};
+	};
 
-		debug_vm_mem: debug-vm@d0600000 {
-			reg = <0x0 0xd0600000 0x0 0x100000>;
-			no-map;
+	sound: sound {
+		compatible = "qcom,qcm6490-sndcard";
+		model = "qcm6490-rb3-snd-card";
+
+		audio-routing =
+			"SpkrLeft IN", "WSA_SPK1 OUT",
+			"SpkrRight IN", "WSA_SPK2 OUT",
+			"VA DMIC0", "vdd-micb",
+			"VA DMIC1", "vdd-micb",
+			"VA DMIC2", "vdd-micb",
+			"VA DMIC3", "vdd-micb";
+
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+		wsa-dai-link {
+			link-name = "CODEC_DMA-LPAIF_WSA-RX-0";
+
+			cpu {
+				sound-dai = <&q6apmbedai WSA_CODEC_DMA_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&left_spkr>, <&right_spkr>, <&swr2 0>,
+					    <&lpass_wsa_macro 0>;
+			};
+			platform {
+				sound-dai = <&q6apm>;
+			};
+		};
+
+		va-dai-link {
+			link-name = "CODEC_DMA-LPAIF_VA-TX-0";
+
+			cpu {
+				sound-dai = <&q6apmbedai VA_CODEC_DMA_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&lpass_va_macro 0>;
+			};
+			platform {
+				sound-dai = <&q6apm>;
+			};
+		};
+
+		vi-feedback-dai-link {
+			link-name = "CODEC_DMA-LPAIF_WSA-TX-0";
+
+			cpu {
+				sound-dai = <&q6apmbedai WSA_CODEC_DMA_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&swr2 6>, <&lpass_wsa_macro 2>;
+			};
+			platform {
+				sound-dai = <&q6apm>;
+			};
 		};
 	};
 
-	vph_pwr: vph-pwr-regulator {
-		compatible = "regulator-fixed";
-		regulator-name = "vph_pwr";
-		regulator-min-microvolt = <2500000>;
-		regulator-max-microvolt = <4350000>;
+	thermal-zones {
+		quiet-thermal {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmk8350_adc_tm 1>;
+
+			trips {
+				active-config0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		sdm-skin-thermal {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmk8350_adc_tm 3>;
+
+			trips {
+				active-config0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		xo-thermal {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmk8350_adc_tm 0>;
+
+			trips {
+				active-config0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
 	};
 };
 
@@ -134,24 +233,6 @@
 		compatible = "qcom,pm7325-rpmh-regulators";
 		qcom,pmic-id = "b";
 
-		vdd-s1-supply = <&vph_pwr>;
-		vdd-s2-supply = <&vph_pwr>;
-		vdd-s3-supply = <&vph_pwr>;
-		vdd-s4-supply = <&vph_pwr>;
-		vdd-s5-supply = <&vph_pwr>;
-		vdd-s6-supply = <&vph_pwr>;
-		vdd-s7-supply = <&vph_pwr>;
-		vdd-s8-supply = <&vph_pwr>;
-		vdd-l1-l4-l12-l15-supply = <&vreg_s7b_0p972>;
-		vdd-l2-l7-supply = <&vreg_bob_3p296>;
-		vdd-l3-supply = <&vreg_s2b_0p876>;
-		vdd-l5-supply = <&vreg_s2b_0p876>;
-		vdd-l6-l9-l10-supply = <&vreg_s8b_1p272>;
-		vdd-l8-supply = <&vreg_s7b_0p972>;
-		vdd-l11-l17-l18-l19-supply = <&vreg_s1b_1p872>;
-		vdd-l13-supply = <&vreg_s7b_0p972>;
-		vdd-l14-l16-supply = <&vreg_s8b_1p272>;
-
 		vreg_s1b_1p872: smps1 {
 			regulator-min-microvolt = <1840000>;
 			regulator-max-microvolt = <2040000>;
@@ -170,11 +251,10 @@
 		vreg_s8b_1p272: smps8 {
 			regulator-min-microvolt = <1200000>;
 			regulator-max-microvolt = <1500000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_RET>;
 		};
 
 		vreg_l1b_0p912: ldo1 {
-			regulator-min-microvolt = <825000>;
+			regulator-min-microvolt = <912000>;
 			regulator-max-microvolt = <925000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
@@ -197,7 +277,7 @@
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
-		reg_l5b_0p752: ldo5 {
+		vreg_l5b_0p752: ldo5 {
 			regulator-min-microvolt = <552000>;
 			regulator-max-microvolt = <832000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
@@ -286,23 +366,6 @@
 		compatible = "qcom,pm8350c-rpmh-regulators";
 		qcom,pmic-id = "c";
 
-		vdd-s1-supply = <&vph_pwr>;
-		vdd-s2-supply = <&vph_pwr>;
-		vdd-s3-supply = <&vph_pwr>;
-		vdd-s4-supply = <&vph_pwr>;
-		vdd-s5-supply = <&vph_pwr>;
-		vdd-s6-supply = <&vph_pwr>;
-		vdd-s7-supply = <&vph_pwr>;
-		vdd-s8-supply = <&vph_pwr>;
-		vdd-s9-supply = <&vph_pwr>;
-		vdd-s10-supply = <&vph_pwr>;
-		vdd-l1-l12-supply = <&vreg_s1b_1p872>;
-		vdd-l2-l8-supply = <&vreg_s1b_1p872>;
-		vdd-l3-l4-l5-l7-l13-supply = <&vreg_bob_3p296>;
-		vdd-l6-l9-l11-supply = <&vreg_bob_3p296>;
-		vdd-l10-supply = <&vreg_s7b_0p972>;
-		vdd-bob-supply = <&vph_pwr>;
-
 		vreg_s1c_2p19: smps1 {
 			regulator-min-microvolt = <2190000>;
 			regulator-max-microvolt = <2210000>;
@@ -328,6 +391,11 @@
 			regulator-max-microvolt = <1170000>;
 		};
 
+		vreg_s10c_0p752:smps10 {
+			regulator-min-microvolt = <752000>;
+			regulator-max-microvolt = <800000>;
+		};
+
 		vreg_l1c_1p8: ldo1 {
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <1980000>;
@@ -378,12 +446,12 @@
 
 		vreg_l9c_2p96: ldo9 {
 			regulator-min-microvolt = <2700000>;
-			regulator-max-microvolt = <35440000>;
+			regulator-max-microvolt = <3544000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
 		vreg_l10c_0p88: ldo10 {
-			regulator-min-microvolt = <720000>;
+			regulator-min-microvolt = <880000>;
 			regulator-max-microvolt = <1050000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
@@ -413,13 +481,532 @@
 	};
 };
 
+&gcc {
+	protected-clocks = <GCC_QSPI_CNOC_PERIPH_AHB_CLK>, <GCC_QSPI_CORE_CLK>,
+			<GCC_QSPI_CORE_CLK_SRC>, <GCC_CFG_NOC_LPASS_CLK>,
+			<GCC_MSS_GPLL0_MAIN_DIV_CLK_SRC>, <GCC_MSS_CFG_AHB_CLK>,
+			<GCC_MSS_OFFLINE_AXI_CLK>, <GCC_MSS_SNOC_AXI_CLK>,
+			<GCC_MSS_Q6_MEMNOC_AXI_CLK>, <GCC_MSS_Q6SS_BOOT_CLK_SRC>,
+			<GCC_SEC_CTRL_CLK_SRC>, <GCC_WPSS_AHB_CLK>,
+			<GCC_WPSS_AHB_BDG_MST_CLK>, <GCC_WPSS_RSCP_CLK>;
+};
+
+&gpu {
+	status = "okay";
+};
+
+&gpu_zap_shader {
+	firmware-name = "qcom/qcs6490/a660_zap.mbn";
+};
+
+&i2c0 {
+	clock-frequency = <400000>;
+	status = "okay";
+
+	lt9611_codec: hdmi-bridge@2b {
+		compatible = "lontium,lt9611uxc";
+		reg = <0x2b>;
+
+		interrupts-extended = <&tlmm 24 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&pm7250b_gpios 2 GPIO_ACTIVE_HIGH>;
+
+		vdd-supply = <&lt9611_1v2>;
+		vcc-supply = <&vreg_l11c_2p8>;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&lt9611_irq_pin &lt9611_rst_pin>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+
+				lt9611_a: endpoint {
+					remote-endpoint = <&mdss_dsi0_out>;
+				};
+			};
+
+			port@2 {
+				reg = <2>;
+
+				lt9611_out: endpoint {
+					remote-endpoint = <&hdmi_con>;
+				};
+			};
+		};
+	};
+};
+
+&i2c1 {
+	clock-frequency = <100000>;
+	status = "okay";
+
+	typec-mux@42 {
+		compatible = "fcs,fsa4480";
+		reg = <0x42>;
+		interrupts-extended = <&tlmm 2 IRQ_TYPE_LEVEL_LOW>;
+		vcc-supply = <&vreg_bob_3p296>;
+		mode-switch;
+		orientation-switch;
+		svid = /bits/ 16 <0xff01>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+
+				fsa4480_sbu_mux: endpoint {
+					remote-endpoint = <&pmic_glink_sbu>;
+				};
+			};
+		};
+	};
+
+	typec-retimer@1c {
+		compatible = "onnn,nb7vpq904m";
+		reg = <0x1c>;
+
+		vcc-supply = <&vreg_l7b_2p952>;
+
+		retimer-switch;
+		orientation-switch;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+
+				redriver_ss_out: endpoint {
+					remote-endpoint = <&pmic_glink_ss_in>;
+				};
+			};
+
+			port@1 {
+				reg = <1>;
+
+				redriver_ss_in: endpoint {
+					data-lanes = <3 2 1 0>;
+					remote-endpoint = <&usb_1_qmpphy_out>;
+				};
+			};
+		};
+	};
+};
+
+&ipa {
+	status = "disabled";
+};
+
+&lpasscc {
+	status = "disabled";
+};
+
+&pm7325_gpios {
+	key_vol_up_default: key-vol-up-state {
+		pins = "gpio6";
+		function = "normal";
+		input-enable;
+		bias-pull-up;
+		power-source = <0>;
+		qcom,drive-strength = <3>;
+	};
+};
+
+&pm7325_temp_alarm {
+	io-channels = <&pmk8350_vadc PM7325_ADC7_DIE_TEMP>;
+	io-channel-names = "thermal";
+};
+
+&pm8350c_pwm {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	status = "okay";
+
+	led@1 {
+		reg = <1>;
+		color = <LED_COLOR_ID_RED>;
+		label = "red";
+	};
+
+	led@2 {
+		reg = <2>;
+		color = <LED_COLOR_ID_GREEN>;
+		label = "green";
+	};
+
+	led@3 {
+		reg = <3>;
+		color = <LED_COLOR_ID_BLUE>;
+		label = "blue";
+	};
+};
+
+&pmk8350_adc_tm {
+	status = "okay";
+
+	xo-therm@0 {
+		reg = <0>;
+		io-channels = <&pmk8350_vadc PMK8350_ADC7_AMUX_THM1_100K_PU>;
+		qcom,ratiometric;
+		qcom,hw-settle-time-us = <200>;
+	};
+
+	quiet-therm@1 {
+		reg = <1>;
+		io-channels = <&pmk8350_vadc PM7325_ADC7_AMUX_THM1_100K_PU>;
+		qcom,ratiometric;
+		qcom,hw-settle-time-us = <200>;
+	};
+
+	sdm-skin-therm@3 {
+		reg = <3>;
+		io-channels = <&pmk8350_vadc PM7325_ADC7_AMUX_THM3_100K_PU>;
+		qcom,ratiometric;
+		qcom,hw-settle-time-us = <200>;
+	};
+};
+
+&pmk8350_pon {
+	status = "okay";
+};
+
+&pmk8350_rtc {
+	status = "okay";
+};
+
+&pmk8350_vadc {
+	channel@44 {
+		reg = <PMK8350_ADC7_AMUX_THM1_100K_PU>;
+		label = "xo_therm";
+		qcom,hw-settle-time = <200>;
+		qcom,pre-scaling = <1 1>;
+		qcom,ratiometric;
+	};
+
+	channel@103 {
+		reg = <PM7325_ADC7_DIE_TEMP>;
+		label = "pm7325_die_temp";
+		qcom,pre-scaling = <1 1>;
+	};
+
+	channel@144 {
+		reg = <PM7325_ADC7_AMUX_THM1_100K_PU>;
+		qcom,ratiometric;
+		qcom,hw-settle-time = <200>;
+		qcom,pre-scaling = <1 1>;
+		label = "pm7325_quiet_therm";
+	};
+
+	channel@146 {
+		reg = <PM7325_ADC7_AMUX_THM3_100K_PU>;
+		qcom,ratiometric;
+		qcom,hw-settle-time = <200>;
+		qcom,pre-scaling = <1 1>;
+		label = "pm7325_sdm_skin_therm";
+	};
+
+	pmk8350-die-temp@3 {
+		reg = <PMK8350_ADC7_DIE_TEMP>;
+		label = "pmk8350_die_temp";
+		qcom,pre-scaling = <1 1>;
+	};
+};
+
+&pon_pwrkey {
+	status = "okay";
+};
+
+&pon_resin {
+	linux,code = <KEY_VOLUMEDOWN>;
+	status = "okay";
+};
+
+&lpass_dmic01_clk {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&lpass_dmic01_data {
+	bias-pull-down;
+};
+
+&lpass_dmic23_clk {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&lpass_dmic23_data {
+	bias-pull-down;
+};
+
+&lpass_dmic45_clk {
+	drive-strength = <8>;
+	bias-disable;
+};
+
+&lpass_dmic45_data {
+	bias-pull-down;
+};
+
+&lpass_wsa_swr_clk {
+	drive-strength = <2>;
+	slew-rate = <1>;
+	bias-disable;
+};
+
+&lpass_wsa_swr_data {
+	drive-strength = <2>;
+	slew-rate = <1>;
+	bias-bus-hold;
+};
+
+&mdss {
+	status = "okay";
+};
+
+&mdss_dsi {
+	vdda-supply = <&vreg_l6b_1p2>;
+	status = "okay";
+};
+
+&mdss_dsi0_out {
+	remote-endpoint = <&lt9611_a>;
+	data-lanes = <0 1 2 3>;
+};
+
+&mdss_dsi_phy {
+	vdds-supply = <&vreg_l10c_0p88>;
+	status = "okay";
+};
+
+&pcie1 {
+	perst-gpios = <&tlmm 2 GPIO_ACTIVE_LOW>;
+
+	pinctrl-0 = <&pcie1_reset_n>, <&pcie1_wake_n>, <&pcie1_clkreq_n>;
+	pinctrl-names = "default";
+
+	iommu-map = <0x0 &apps_smmu 0x1c80 0x1>,
+		    <0x100 &apps_smmu 0x1c81 0x1>,
+		    <0x208 &apps_smmu 0x1c84 0x1>,
+		    <0x210 &apps_smmu 0x1c85 0x1>,
+		    <0x218 &apps_smmu 0x1c86 0x1>,
+		    <0x300 &apps_smmu 0x1c87 0x1>,
+		    <0x400 &apps_smmu 0x1c88 0x1>,
+		    <0x500 &apps_smmu 0x1c89 0x1>,
+		    <0x501 &apps_smmu 0x1c90 0x1>;
+
+	status = "okay";
+};
+
+&pcie1_phy {
+	vdda-phy-supply = <&vreg_l10c_0p88>;
+	vdda-pll-supply = <&vreg_l6b_1p2>;
+
+	status = "okay";
+};
+
+&qup_uart5_rx {
+	drive-strength = <2>;
+	bias-pull-up;
+};
+
+&qup_uart5_tx {
+	drive-strength = <2>;
+	bias-disable;
+};
+
+&qup_uart7_cts {
+	/*
+	 * Configure a bias-bus-hold on CTS to lower power
+	 * usage when Bluetooth is turned off. Bus hold will
+	 * maintain a low power state regardless of whether
+	 * the Bluetooth module drives the pin in either
+	 * direction or leaves the pin fully unpowered.
+	 */
+	bias-bus-hold;
+};
+
+&qup_uart7_rts {
+	/* We'll drive RTS, so no pull */
+	drive-strength = <2>;
+	bias-disable;
+};
+
+&qup_uart7_rx {
+	/*
+	 * Configure a pull-up on RX. This is needed to avoid
+	 * garbage data when the TX pin of the Bluetooth module is
+	 * in tri-state (module powered off or not driving the
+	 * signal yet).
+	 */
+	bias-pull-up;
+};
+
+&qup_uart7_tx {
+	/* We'll drive TX, so no pull */
+	drive-strength = <2>;
+	bias-disable;
+};
+
+&gpi_dma0 {
+	status = "okay";
+};
+
+&gpi_dma1 {
+	status = "okay";
+};
+
 &qupv3_id_0 {
 	status = "okay";
 };
 
+&qupv3_id_1 {
+	status = "okay";
+};
+
+&remoteproc_adsp {
+	firmware-name = "qcom/qcs6490/adsp.mdt";
+	status = "okay";
+};
+
+&remoteproc_cdsp {
+	firmware-name = "qcom/qcs6490/cdsp.mdt";
+	status = "okay";
+};
+
+&remoteproc_mpss {
+	firmware-name = "qcom/qcs6490/modem.mdt";
+	status = "okay";
+};
+
+&remoteproc_wpss {
+	firmware-name = "qcom/qcs6490/wpss.mbn";
+	status = "okay";
+};
+
+&spi3 {
+	status = "okay";
+
+	mcp2518fd: can@0 {
+		compatible = "microchip,mcp2518fd";
+		reg = <0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		clock-frequency = <40000000>;
+		spi-max-frequency = <10000000>;
+		interrupt-names = "can_irq";
+		interrupts-extended = <&tlmm 7 IRQ_TYPE_LEVEL_LOW>;
+		status = "okay";
+	};
+};
+
+&swr2 {
+	qcom,din-ports = <0>;
+	qcom,dout-ports = <8>;
+
+	left_spkr: speaker@0,1 {
+		compatible = "sdw10217020200";
+		reg = <0 1>;
+		powerdown-gpios = <&tlmm 158 GPIO_ACTIVE_LOW>;
+		#sound-dai-cells = <0>;
+		sound-name-prefix = "SpkrLeft";
+		#thermal-sensor-cells = <0>;
+		vdd-supply = <&vreg_l18b_1p8>;
+		qcom,port-mapping = <1 2 3 7>;
+	};
+
+	right_spkr: speaker@0,2 {
+		compatible = "sdw10217020200";
+		reg = <0 2>;
+		powerdown-gpios = <&tlmm 158 GPIO_ACTIVE_LOW>;
+		#sound-dai-cells = <0>;
+		sound-name-prefix = "SpkrRight";
+		#thermal-sensor-cells = <0>;
+		vdd-supply = <&vreg_l18b_1p8>;
+		qcom,port-mapping = <4 5 6 8>;
+	};
+};
+
 &tlmm {
-	gpio-reserved-ranges = <32 2>, /* ADSP */
-			       <48 4>; /* NFC */
+	bt_en: bt-en-state {
+		pins = "gpio85";
+		function = "gpio";
+		output-low;
+		bias-disable;
+	};
+
+	pcie1_reset_n: pcie1-reset-n-state {
+		pins = "gpio2";
+		function = "gpio";
+		drive-strength = <16>;
+		output-low;
+		bias-disable;
+	};
+
+	pcie1_wake_n: pcie1-wake-n-state {
+		pins = "gpio3";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-up;
+	};
+
+	qup_uart7_sleep_cts: qup-uart7-sleep-cts-state {
+		pins = "gpio28";
+		function = "gpio";
+		/*
+		 * Configure a bias-bus-hold on CTS to lower power
+		 * usage when Bluetooth is turned off. Bus hold will
+		 * maintain a low power state regardless of whether
+		 * the Bluetooth module drives the pin in either
+		 * direction or leaves the pin fully unpowered.
+		 */
+		bias-bus-hold;
+	};
+
+	qup_uart7_sleep_rts: qup-uart7-sleep-rts-state {
+		pins = "gpio29";
+		function = "gpio";
+		/*
+		 * Configure pull-down on RTS. As RTS is active low
+		 * signal, pull it low to indicate the BT SoC that it
+		 * can wakeup the system anytime from suspend state by
+		 * pulling RX low (by sending wakeup bytes).
+		 */
+		bias-pull-down;
+	};
+
+	qup_uart7_sleep_rx: qup-uart7-sleep-rx-state {
+		pins = "gpio31";
+		function = "gpio";
+		/*
+		 * Configure a pull-up on RX. This is needed to avoid
+		 * garbage data when the TX pin of the Bluetooth module
+		 * is floating which may cause spurious wakeups.
+		 */
+		bias-pull-up;
+	};
+
+	qup_uart7_sleep_tx: qup-uart7-sleep-tx-state {
+		pins = "gpio30";
+		function = "gpio";
+		/*
+		 * Configure pull-up on TX when it isn't actively driven
+		 * to prevent BT SoC from receiving garbage during sleep.
+		 */
+		bias-pull-up;
+	};
+
+	sw_ctrl: sw-ctrl-state {
+		pins = "gpio86";
+		function = "gpio";
+		bias-pull-down;
+	};
 };
 
 &uart5 {
@@ -427,18 +1014,117 @@
 	status = "okay";
 };
 
+&uart7 {
+	status = "okay";
+	/delete-property/interrupts;
+	interrupts-extended = <&intc GIC_SPI 608 IRQ_TYPE_LEVEL_HIGH>,
+				<&tlmm 31 IRQ_TYPE_EDGE_FALLING>;
+	pinctrl-names = "default", "sleep";
+	pinctrl-1 = <&qup_uart7_sleep_cts>, <&qup_uart7_sleep_rts>,
+			<&qup_uart7_sleep_tx>, <&qup_uart7_sleep_rx>;
+
+	bluetooth: bluetooth {
+		compatible = "qcom,wcn6750-bt";
+		pinctrl-names = "default";
+		pinctrl-0 = <&bt_en>, <&sw_ctrl>;
+		enable-gpios = <&tlmm 85 GPIO_ACTIVE_HIGH>;
+		swctrl-gpios = <&tlmm 86 GPIO_ACTIVE_HIGH>;
+		vddaon-supply = <&vreg_s7b_0p972>;
+		vddbtcxmx-supply = <&vreg_s7b_0p972>;
+		vddrfacmn-supply = <&vreg_s7b_0p972>;
+		vddrfa0p8-supply = <&vreg_s7b_0p972>;
+		vddrfa1p7-supply = <&vreg_s1b_1p872>;
+		vddrfa1p2-supply = <&vreg_s8b_1p272>;
+		vddrfa2p2-supply = <&vreg_s1c_2p19>;
+		vddasd-supply = <&vreg_l11c_2p8>;
+		max-speed = <3200000>;
+		local-bd-address = [ad 5a 00 00 90 64];
+	};
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 175 GPIO_ACTIVE_LOW>;
+	vcc-supply = <&vreg_l7b_2p952>;
+	vcc-max-microamp = <800000>;
+	vccq-supply = <&vreg_l9b_1p2>;
+	vccq-max-microamp = <900000>;
+	vccq2-supply = <&vreg_l9b_1p2>;
+	vccq2-max-microamp = <900000>;
+
+	status = "okay";
+};
+
+&ufs_mem_phy {
+	vdda-phy-supply = <&vreg_l10c_0p88>;
+	vdda-pll-supply = <&vreg_l6b_1p2>;
+
+	status = "okay";
+};
+
+&sdhc_2 {
+	status = "okay";
+
+	pinctrl-0 = <&sdc2_clk>, <&sdc2_cmd>, <&sdc2_data>, <&sd_cd>;
+	pinctrl-1 = <&sdc2_clk_sleep>, <&sdc2_cmd_sleep>, <&sdc2_data_sleep>, <&sd_cd>;
+
+	vmmc-supply = <&vreg_l9c_2p96>;
+	vqmmc-supply = <&vreg_l6c_2p96>;
+
+	cd-gpios = <&tlmm 91 GPIO_ACTIVE_LOW>;
+};
+
+/delete-node/ &usb_1_dwc3;
+
 &usb_1 {
+
+	reg = <0x0 0x0a600000 0x0 0x200000>;
+
+	interrupts-extended = <&intc GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
+			      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+			      <&pdc 14 IRQ_TYPE_LEVEL_HIGH>,
+			      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
+			      <&pdc 17 IRQ_TYPE_EDGE_BOTH>;
+	interrupt-names = "dwc_usb3",
+			  "hs_phy_irq",
+			  "dp_hs_phy_irq",
+			  "dm_hs_phy_irq",
+			  "ss_phy_irq";
+
+	iommus = <&apps_smmu 0xe0 0x0>;
+	snps,dis_u2_susphy_quirk;
+	snps,dis_enblslpm_quirk;
+	phys = <&usb_1_hsphy>, <&usb_1_qmpphy QMP_USB43DP_USB3_PHY>;
+	phy-names = "usb2-phy", "usb3-phy";
+	maximum-speed = "super-speed";
+	snps,dis-u2-entry-quirk;
+	snps,dis-u1-entry-quirk;
+	dr_mode = "otg";
+	usb-role-switch;
+	qcom,enable-rt;
+	wakeup-source;
+
 	status = "okay";
+
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			usb_1_dwc3_hs: endpoint {
+			};
+		};
+	};
 };
 
-&usb_1_dwc3 {
-	dr_mode = "peripheral";
+&usb_1_dwc3_hs {
+	remote-endpoint = <&pmic_glink_hs_in>;
 };
 
 &usb_1_hsphy {
 	vdda-pll-supply = <&vreg_l10c_0p88>;
-	vdda33-supply = <&vreg_l2b_3p072>;
 	vdda18-supply = <&vreg_l1c_1p8>;
+	vdda33-supply = <&vreg_l2b_3p072>;
 
 	status = "okay";
 };
@@ -447,9 +1133,181 @@
 	vdda-phy-supply = <&vreg_l6b_1p2>;
 	vdda-pll-supply = <&vreg_l1b_0p912>;
 
+	orientation-switch;
 	status = "okay";
 };
 
+&usb_1_qmpphy_out {
+	remote-endpoint = <&redriver_ss_in>;
+};
+
+&vreg_l7b_2p952 {
+	/delete-property/regulator-min-microvolt;
+	/delete-property/regulator-max-microvolt;
+	regulator-allow-set-load;
+	regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM RPMH_REGULATOR_MODE_HPM>;
+};
+
+&vreg_l9b_1p2 {
+	/delete-property/regulator-min-microvolt;
+	/delete-property/regulator-max-microvolt;
+	regulator-allow-set-load;
+	regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM RPMH_REGULATOR_MODE_HPM>;
+};
+
+/*     USB2 Related Start        */
+/*==============================*/
+
+&pm7325_gpios {
+	usb2_vbus_det_default: usb2_vbus_det_state {
+		pins = "gpio9";
+		function = "normal";
+		bias-pull-down;
+		input-enable;
+		power-source = <0>;
+	};
+};
+
+&sdc2_clk {
+	bias-disable;
+	drive-strength = <16>;
+};
+
+&sdc2_cmd {
+	bias-pull-up;
+	drive-strength = <10>;
+};
+
+&sdc2_data {
+	bias-pull-up;
+	drive-strength = <10>;
+};
+
+&tlmm {
+	usb2_id_det_default: usb2_id_det_default {
+		pins = "gpio61";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-up;
+	};
+
+	sd_cd: sd-cd-state {
+		pins = "gpio91";
+		function = "gpio";
+		bias-pull-up;
+	};
+};
+
+&soc {
+	vbus_supply_regulator: vbus_supply_regulator {
+	       compatible = "regulator-fixed";
+	       regulator-name = "vbus_supply";
+	       gpio = <&tlmm 63 GPIO_ACTIVE_HIGH>;
+	       regulator-min-microvolt = <5000000>;
+	       regulator-max-microvolt = <5000000>;
+	       regulator-boot-on;
+	       enable-active-high;
+	};
+
+	connector_usb2: connector_usb2 {
+		compatible = "gpio-usb-b-connector";
+		vbus-gpio = <&pm7325_gpios 9 GPIO_ACTIVE_HIGH>;
+		id-gpio = <&tlmm 61 GPIO_ACTIVE_HIGH>;
+		vbus-supply = <&vbus_supply_regulator>;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&usb2_vbus_det_default>,
+			     <&usb2_id_det_default>;
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				usb2_port_connector: endpoint {
+					remote-endpoint = <&usb2_port>;
+				};
+			};
+		};
+	};
+};
+
+&usb_2 {
+	reg = <0x0 0x08c00000 0x0 0x100000>;
+
+	interrupts-extended = <&intc GIC_SPI 242 IRQ_TYPE_LEVEL_HIGH>,
+				<&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+				<&pdc 12 IRQ_TYPE_LEVEL_HIGH>,
+				<&pdc 13 IRQ_TYPE_EDGE_BOTH>;
+	interrupt-names = "dwc_usb2",
+			"hs_phy_irq",
+			"dp_hs_phy_irq",
+			"dm_hs_phy_irq";
+
+	iommus = <&apps_smmu 0xa0 0x0>;
+	snps,dis_u2_susphy_quirk;
+	snps,dis_enblslpm_quirk;
+	phys = <&usb_2_hsphy>;
+	phy-names = "usb2-phy";
+	maximum-speed = "high-speed";
+	snps,dis-u2-entry-quirk;
+	snps,dis-u1-entry-quirk;
+
+	usb-role-switch;
+	qcom,enable-rt;
+	wakeup-source;
+	dr_mode = "otg";
+
+	status = "okay";
+
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			usb2_port: endpoint {
+				remote-endpoint = <&usb2_port_connector>;
+			};
+		};
+
+		port@1 {
+			usb2_role_switch: endpoint {
+				remote-endpoint = <&eud_ep>;
+			};
+		};
+	};
+};
+
+&pm7250b_gpios {
+	lt9611_rst_pin: lt9611-rst-state {
+		pins = "gpio2";
+		function = "normal";
+
+		output-high;
+		input-disable;
+		power-source = <0>;
+	};
+};
+
+&tlmm {
+	lt9611_irq_pin: lt9611-irq-state {
+		pins = "gpio24";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-disable;
+	};
+};
+
+&usb_2_hsphy {
+	vdda-pll-supply = <&vreg_l10c_0p88>;
+	vdda18-supply = <&vreg_l1c_1p8>;
+	vdda33-supply = <&vreg_l2b_3p072>;
+
+	status = "okay";
+};
+
+/* moved from qcm6490-wlan-upstream.dtsi */
 &wifi {
-	memory-region = <&wlan_fw_mem>;
+	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-addons-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-addons-ride.dts
@@ -0,0 +1,497 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs8300-ride.dts"
+#include "qcs8300-addons.dtsi"
+
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS8300-addons RIDE";
+	compatible = "qcom,qcs8300-addons-ride", "qcom,qcs8300-ride", "qcom,qcs8275",
+		     "qcom,qcs8300";
+
+	sound {
+		compatible = "qcom,qcs8300-sndcard";
+		model = "qcs8300-ridesx-snd-card";
+
+		clocks = <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+			 <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>;
+		clock-names = "macro", "dcodec";
+
+		pinctrl-names = "default", "stub_aif1_active", "stub_aif1_sleep",
+				"stub_aif2_active", "stub_aif2_sleep", "stub_aif3_active",
+				"stub_aif3_sleep", "stub_aif4_active", "stub_aif4_sleep";
+		pinctrl-0 = <&mi2s1_data0_sleep>, <&mi2s1_data1_sleep>, <&mi2s1_sck_sleep>,
+			    <&mi2s1_ws_sleep>, <&lpass_i2s1_clk_sleep>,
+			    <&lpass_i2s1_data_sleep>, <&lpass_i2s1_ws_sleep>, <&mi2s_mclk_sleep>,
+			    <&hs0_mi2s_data0_sleep>, <&hs0_mi2s_sck_sleep>, <&hs0_mi2s_data1_sleep>,
+			    <&hs0_mi2s_ws_sleep>;
+		pinctrl-1 = <&mi2s1_data0>, <&mi2s1_data1>, <&mi2s1_sck>, <&mi2s1_ws>;
+		pinctrl-2 = <&mi2s1_data0_sleep>, <&mi2s1_data1_sleep>, <&mi2s1_sck_sleep>,
+			    <&mi2s1_ws_sleep>;
+		pinctrl-3 = <&lpass_i2s1_clk>, <&lpass_i2s1_data>, <&lpass_i2s1_ws>;
+		pinctrl-4 = <&lpass_i2s1_clk_sleep>, <&lpass_i2s1_data_sleep>,
+			    <&lpass_i2s1_ws_sleep>;
+		pinctrl-5 = <&hs0_mi2s_data0>, <&hs0_mi2s_data1>, <&hs0_mi2s_sck>, <&mi2s_mclk>,
+			    <&hs0_mi2s_ws>;
+		pinctrl-6 = <&hs0_mi2s_data0_sleep>, <&hs0_mi2s_data1_sleep>, <&hs0_mi2s_sck_sleep>,
+			    <&mi2s_mclk_sleep>,<&hs0_mi2s_ws_sleep>;
+		pinctrl-7 = <&mi2s1_data0>, <&mi2s1_data1>, <&mi2s1_sck>, <&mi2s_mclk>,
+			    <&mi2s1_ws>;
+		pinctrl-8 = <&mi2s1_data0_sleep>, <&mi2s1_data1_sleep>, <&mi2s1_sck_sleep>,
+			    <&mi2s1_ws_sleep>, <&mi2s_mclk_sleep>;
+
+		mi2s1-capture-dai-link {
+			link-name = "MI2S-LPAIF-TX-SECONDARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai SECONDARY_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 1>;
+			};
+		};
+
+		mi2s1-playback-dai-link {
+			link-name = "MI2S-LPAIF-RX-SECONDARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai SECONDARY_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 0>;
+			};
+		};
+
+		lpi-mi2s1-capture-dai-link {
+			link-name = "MI2S-LPAIF_VA-TX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 3>;
+			};
+		};
+
+		lpi-mi2s1-playback-dai-link {
+			link-name = "MI2S-LPAIF_VA-RX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 2>;
+			};
+		};
+
+		tdm1-capture-dai-link {
+			link-name = "TDM-LPAIF-TX-SECONDARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai SECONDARY_TDM_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 1>;
+			};
+		};
+
+		tdm1-playback-dai-link {
+			link-name = "TDM-LPAIF-RX-SECONDARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai SECONDARY_TDM_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 0>;
+			};
+		};
+
+		lpi-tdm1-capture-dai-link {
+			link-name = "TDM-LPAIF_VA-TX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 3>;
+			};
+		};
+
+		lpi-tdm1-playback-dai-link {
+			link-name = "TDM-LPAIF_VA-RX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 2>;
+			};
+		};
+
+		hs0-mi2s-capture-dai-link {
+			link-name = "MI2S-LPAIF_SDR-TX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_SDR_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 5>;
+			};
+		};
+
+		hs0-mi2s-playback-dai-link {
+			link-name = "MI2S-LPAIF_SDR-RX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_SDR_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 4>;
+			};
+		};
+
+		tdm0-capture-dai-link {
+			link-name = "TDM-LPAIF_SDR-TX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_SDR_TDM_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 5>;
+			};
+		};
+
+		tdm0-playback-dai-link {
+			link-name = "TDM-LPAIF_SDR-RX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_SDR_TDM_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 4>;
+			};
+		};
+
+		hs3-mi2s-capture-dai-link {
+			link-name = "MI2S-LPAIF_SDR-TX-QUATERNARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai QUATERNARY_SDR_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 7>;
+			};
+		};
+
+		hs3-mi2s-playback-dai-link {
+			link-name = "MI2S-LPAIF_SDR-RX-QUATERNARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai QUATERNARY_SDR_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 6>;
+			};
+		};
+
+		tdm3-capture-dai-link {
+			link-name = "TDM-LPAIF_SDR-TX-QUATERNARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai QUATERNARY_SDR_TDM_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 7>;
+			};
+		};
+
+		tdm3-playback-dai-link {
+			link-name = "TDM-LPAIF_SDR-RX-QUATERNARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai QUATERNARY_SDR_TDM_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 6>;
+			};
+		};
+	};
+};
+
+&lpass_tlmm {
+	lpass_i2s1_clk: i2s1-clk-state {
+			pins = "gpio6";
+			function = "i2s1_clk";
+			drive-strength = <8>;
+			bias-disable;
+			output-high;
+	};
+
+	lpass_i2s1_clk_sleep: i2s1-clk-sleep-state {
+			pins = "gpio6";
+			function = "i2s1_clk";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+
+	lpass_i2s1_data: i2s1-data-state {
+			pins = "gpio8", "gpio9";
+			function = "i2s1_data";
+			drive-strength = <8>;
+			bias-disable;
+	};
+
+	lpass_i2s1_data_sleep: i2s1-data-sleep-state {
+			pins = "gpio8", "gpio9";
+			function = "i2s1_data";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+
+	lpass_i2s1_ws: i2s1-ws-state {
+			pins = "gpio7";
+			function = "i2s1_ws";
+			drive-strength = <8>;
+			output-high;
+	};
+
+	lpass_i2s1_ws_sleep: i2s1-ws-sleep-state {
+			pins = "gpio7";
+			function = "i2s1_ws";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+};
+
+&soc {
+	msm_stub_codec: msm-stub-codec {
+		compatible = "qcom,msm-stub-codec";
+		#sound-dai-cells = <1>;
+	};
+
+	spf_core_platform: spf-core-platform {
+		compatible = "qcom,spf-core-platform";
+
+		msm_audio_mem: msm-audio-mem {
+			compatible = "qcom,msm-audio-mem";
+			qcom,smmu-version = <2>;
+			qcom,smmu-enabled;
+			iommus = <&apps_smmu 0x2001 0x0>;
+			qcom,iommu-dma-addr-pool = <0x10000000 0x10000000>;
+			qcom,smmu-sid-mask = /bits/ 64 <0xf>;
+			dma-coherent;
+		};
+
+		msm_audio_mem_cma: msm-audio-mem-cma {
+			compatible = "qcom,msm-audio-mem";
+			memory-region = <&audio_cma_mem>;
+		};
+	};
+};
+
+&tlmm {
+	hs1_mi2s: hs1-mi2s-state {
+		pins = "gpio45", "gpio46", "gpio47", "gpio48";
+		function = "hs1_mi2s";
+	};
+
+	hs2_mi2s: hs2-mi2s-state {
+		pins = "gpio49", "gpio50", "gpio51", "gpio52";
+		function = "hs2_mi2s";
+	};
+
+	hs0_mi2s_data0: hs0-mi2s-data0-state {
+		pins = "gpio108";
+		function = "hs0_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	hs0_mi2s_data0_sleep: hs0-mi2s-data0-sleep-state {
+		pins = "gpio108";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs0_mi2s_data1: hs0-mi2s-data1-state {
+		pins = "gpio109";
+		function = "hs0_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs0_mi2s_data1_sleep: hs0-mi2s-data1-sleep-state {
+		pins = "gpio109";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs0_mi2s_sck: hs0-mi2s-sck-state {
+		pins = "gpio106";
+		function = "hs0_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs0_mi2s_sck_sleep: hs0-mi2s-sck-sleep-state {
+		pins = "gpio106";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s_mclk: mi2s-mclk-state {
+		pins = "gpio97";
+		function = "mi2s_mclk0";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	mi2s_mclk_sleep: mi2s-mclk-sleep-state {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs0_mi2s_ws: hs0-mi2s-ws-state {
+		pins = "gpio107";
+		function = "hs0_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs0_mi2s_ws_sleep: hs0-mi2s-ws-sleep-state {
+		pins = "gpio107";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s1_data0: mi2s1-data0-state {
+		pins = "gpio100";
+		function = "mi2s1_data0";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	mi2s1_data0_sleep: mi2s1-data0-sleep-state {
+		pins = "gpio100";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s1_data1: mi2s1-data1-state {
+		pins = "gpio101";
+		function = "mi2s1_data1";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	mi2s1_data1_sleep: mi2s1-data1-sleep-state {
+		pins = "gpio101";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s1_sck: mi2s1-sck-state {
+		pins = "gpio98";
+		function = "mi2s1_sck";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	mi2s1_sck_sleep: mi2s1-sck-sleep-state {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s1_ws: mi2s1-ws-state {
+		pins = "gpio99";
+		function = "mi2s1_ws";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	mi2s1_ws_sleep: mi2s1-ws-sleep-state {
+		pins = "gpio99";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s2_data0: mi2s2-data0-state {
+		pins = "gpio104";
+		function = "mi2s2_data0";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	mi2s2_data1: mi2s2-data1-state {
+		pins = "gpio105";
+		function = "mi2s2_data1";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	mi2s2_sck: mi2s2-sck-state {
+		pins = "gpio102";
+		function = "mi2s2_sck";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	mi2s2_ws: mi2s2-ws-state {
+		pins = "gpio103";
+		function = "mi2s2_ws";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-addons.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-addons.dtsi
@@ -0,0 +1,499 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "qcs8300-dma-heaps.dtsi"
+/ {
+	firmware {
+		qtee_shmbridge {
+			compatible = "qcom,tee-shared-memory-bridge";
+		};
+
+		qcom_smcinvoke {
+			compatible = "qcom,smcinvoke";
+		};
+	};
+
+	reserved-memory {
+		audio_cma_mem: qcom,audio-ml {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1000000>;
+		};
+
+		dump_mem: mem-dump-region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			size = <0x0 0x3000000>;
+		};
+
+		qseecom_mem: qcom,qseecom {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1400000>; /* 20M */
+		};
+
+		qseecom_ta_mem: qcom,qseecom-ta {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1000000>; /* 16M */
+		};
+	};
+
+	mem-dump {
+		compatible = "qcom,mem-dump";
+		memory-region = <&dump_mem>;
+
+		c0-context {
+			qcom,dump-id = <0x0>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c0-scandump {
+			qcom,dump-id = <0x130>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c100-context {
+			qcom,dump-id = <0x1>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c100-scandump {
+			qcom,dump-id = <0x131>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c200-context {
+			qcom,dump-id = <0x2>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c200-scandump {
+			qcom,dump-id = <0x132>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c300-context {
+			qcom,dump-id = <0x3>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c300-scandump {
+			qcom,dump-id = <0x133>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c400-context {
+			qcom,dump-id = <0x4>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c500-context {
+			qcom,dump-id = <0x5>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c600-context {
+			qcom,dump-id = <0x6>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c700-context {
+			qcom,dump-id = <0x7>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c10000-scandump {
+			qcom,dump-id = <0x134>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c10100-scandump {
+			qcom,dump-id = <0x135>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c10200-scandump {
+			qcom,dump-id = <0x136>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c10300-scandump {
+			qcom,dump-id = <0x137>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		cpuss-reg {
+			qcom,dump-id = <0xef>;
+			qcom,dump-size = <0x20000>;
+		};
+
+		etf-swao {
+			qcom,dump-id = <0xf1>;
+			qcom,dump-size = <0x10000>;
+		};
+
+		etfswao-reg {
+			qcom,dump-id = <0x102>;
+			qcom,dump-size = <0x1000>;
+		};
+
+		etr-reg {
+			qcom,dump-id = <0x100>;
+			qcom,dump-size = <0x1000>;
+		};
+
+		fcm {
+			qcom,dump-id = <0xee>;
+			qcom,dump-size = <0x8400>;
+		};
+
+		l1-dcache0 {
+			qcom,dump-id = <0x80>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache100 {
+			qcom,dump-id = <0x81>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache200 {
+			qcom,dump-id = <0x82>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache300 {
+			qcom,dump-id = <0x83>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache10000 {
+			qcom,dump-id = <0x84>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache10100 {
+			qcom,dump-id = <0x85>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache10200 {
+			qcom,dump-id = <0x86>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache10300 {
+			qcom,dump-id = <0x87>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dtlb10000 {
+			qcom,dump-id = <0x44>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-dtlb10100 {
+			qcom,dump-id = <0x45>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-dtlb10200 {
+			qcom,dump-id = <0x46>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-dtlb10300 {
+			qcom,dump-id = <0x47>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-icache0 {
+			qcom,dump-id = <0x60>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache100 {
+			qcom,dump-id = <0x61>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache200 {
+			qcom,dump-id = <0x62>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache300 {
+			qcom,dump-id = <0x63>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache10000 {
+			qcom,dump-id = <0x64>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache10100 {
+			qcom,dump-id = <0x65>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache10200 {
+			qcom,dump-id = <0x66>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache10300 {
+			qcom,dump-id = <0x67>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-itlb10000 {
+			qcom,dump-id = <0x24>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-itlb10100 {
+			qcom,dump-id = <0x25>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-itlb10200 {
+			qcom,dump-id = <0x26>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-itlb10300 {
+			qcom,dump-id = <0x27>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l2-cache10000 {
+			qcom,dump-id = <0xc4>;
+			qcom,dump-size = <0x90100>;
+		};
+
+		l2-cache10100 {
+			qcom,dump-id = <0xc5>;
+			qcom,dump-size = <0x90100>;
+		};
+
+		l2-cache10200 {
+			qcom,dump-id = <0xc6>;
+			qcom,dump-size = <0x90100>;
+		};
+
+		l2-cache10300 {
+			qcom,dump-id = <0xc7>;
+			qcom,dump-size = <0x90100>;
+		};
+
+		l2-tlb0 {
+			qcom,dump-id = <0x120>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb100 {
+			qcom,dump-id = <0x121>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb200 {
+			qcom,dump-id = <0x122>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb300 {
+			qcom,dump-id = <0x123>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb10000 {
+			qcom,dump-id = <0x124>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb10100 {
+			qcom,dump-id = <0x125>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb10200 {
+			qcom,dump-id = <0x126>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb10300 {
+			qcom,dump-id = <0x127>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		misc-data {
+			qcom,dump-id = <0xe8>;
+			qcom,dump-size = <0x1000>;
+		};
+
+		pmic {
+			qcom,dump-id = <0xe4>;
+			qcom,dump-size = <0x80000>;
+		};
+
+		rpm-sw {
+			qcom,dump-id = <0xea>;
+			qcom,dump-size = <0x28000>;
+		};
+
+		rpmh {
+			qcom,dump-id = <0xec>;
+			qcom,dump-size = <0x2000000>;
+		};
+	};
+};
+
+&soc {
+	lpass_tlmm: pinctrl@3440000 {
+		compatible = "qcom,qcs8300-lpass-lpi-pinctrl";
+		reg = <0x0 0x03440000 0x0 0x20000>,
+		      <0x0 0x034D0000 0x0 0x10000>;
+
+		clocks = <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+			 <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>;
+		clock-names = "core", "audio";
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&lpass_tlmm 0 0 23>;
+	};
+
+	csr: csr@4001000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x0 0x4001000 0x0 0x1000>;
+		reg-names = "csr-base";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		qcom,hwctrl-set-support;
+		qcom,set-byte-cntr-support;
+		qcom,blk-size = <1>;
+	};
+
+	tmc_etr: tmc@4048000 {
+		interrupts = <GIC_SPI 270 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "byte-cntr-irq";
+		qcom,sw-usb;
+		coresight-csr = <&csr>;
+		csr-atid-offset = <0xf8>;
+		csr-irqctrl-offset = <0x6c>;
+		byte-cntr-name = "byte-cntr";
+		byte-cntr-class-name = "coresight-tmc-etr-stream";
+	};
+
+	tmc_etr1: tmc@404f000 {
+		interrupts = <GIC_SPI 262 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "byte-cntr-irq";
+		coresight-csr = <&csr>;
+		csr-atid-offset = <0x108>;
+		csr-irqctrl-offset = <0x70>;
+		byte-cntr-name = "byte-cntr1";
+		byte-cntr-class-name = "coresight-tmc-etr1-stream";
+	};
+
+	dma@40ff000 {
+		compatible = "qcom,dcc-v3", "qcom,dcc";
+		reg = <0x0 0x040ff000 0x0 0x1000>,
+		      <0x0 0x040b8800 0x0 0x6000>;
+
+		qcom,dcc-offset = <0x38800>;
+	};
+
+	tgu@4b0e000 {
+		compatible = "arm,primecell", "qcom,coresight-tgu";
+		reg = <0x0 0x4b0e000 0x0 0x1000>;
+		reg-names = "tgu-base";
+		device-name = "tgu_ipcb";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		arm,primecell-periphid = <0x0003b999>;
+		tgu-conditions = <4>;
+		tgu-regs = <4>;
+		tgu-steps = <3>;
+		tgu-timer-counters = <8>;
+	};
+
+	tgu@4b0f000 {
+		compatible = "arm,primecell", "qcom,coresight-tgu";
+		reg = <0x0 0x4b0f000 0x0 0x1000>;
+		reg-names = "tgu-base";
+		device-name = "tgu_spmi0";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		arm,primecell-periphid = <0x0003b999>;
+		tgu-conditions = <4>;
+		tgu-regs = <8>;
+		tgu-steps = <3>;
+		tgu-timer-counters = <8>;
+	};
+
+	swao_csr: csr@4b11000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x0 0x4b11000 0x0 0x1000>,
+		      <0x0 0x4b110f8 0x0 0x50>;
+		reg-names = "csr-base", "msr-base";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		qcom,timestamp-support;
+		qcom,msr-support;
+		qcom,blk-size = <1>;
+	};
+
+	qcom,mem-buf {
+		compatible = "qcom,mem-buf";
+		qcom,mem-buf-capabilities = "supplier";
+		qcom,vmid = <3>;
+	};
+
+	qcom,mem-buf-msgq {
+		compatible = "qcom,mem-buf-msgq";
+	};
+
+	qcom,secure-buffer {
+		compatible = "qcom,secure-buffer";
+		qcom,vmid-cp-camera-preview-ro;
+	};
+
+	qcom_tzlog: tz-log@146d8720 {
+		compatible = "qcom,tz-log";
+		reg = <0x0 0x146d8720 0x0 0x3000>;
+		qcom,hyplog-enabled;
+		hyplog-address-offset = <0x410>;
+		hyplog-size-offset = <0x414>;
+	};
+};
+
+&sram {
+	mem_dump_table@10 {
+		compatible = "qcom,msm-imem-mem-dump-table";
+		reg = <0x10 0x8>;
+	};
+
+	kaslr_offset@6d0 {
+		compatible = "qcom,msm-imem-kaslr_offset";
+		reg = <0x6d0 0xc>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-camera-sensor-idp.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-camera-sensor-idp.dtsi
@@ -0,0 +1,364 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&soc {
+	qcom,cam-res-mgr {
+		compatible = "qcom,cam-res-mgr";
+		status = "ok";
+		gpios-shared = <609 610 611>;
+	};
+};
+
+&cam_cci0 {
+
+	/* GMSL deserializer 0 */
+	qcom,cam-gmsl-deserializer0 {
+		cell-index = <0>;
+		csiphy-sd-index = <0>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend>;
+		gpios = <&tlmm 73 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET0";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK0_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser0_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor0_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser0_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor1_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser0_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor2_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser0_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor3_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 0 */
+	qcom,cam-gmsl-sensor0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor0_ep: endpoint {
+				remote-endpoint = <&deser0_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 1 */
+	qcom,cam-gmsl-sensor1 {
+		cell-index = <1>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor1_ep: endpoint {
+				remote-endpoint = <&deser0_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 2 */
+	qcom,cam-gmsl-sensor2 {
+		cell-index = <2>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor2_ep: endpoint {
+				remote-endpoint = <&deser0_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 3 */
+	qcom,cam-gmsl-sensor3 {
+		cell-index = <3>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor3_ep: endpoint {
+				remote-endpoint = <&deser0_port3>;
+			};
+		};
+	};
+
+};
+
+
+&cam_cci1 {
+
+	/* GMSL deserializer 1 */
+	qcom,cam-gmsl-deserializer1 {
+		cell-index = <1>;
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend>;
+		gpios = <&tlmm 74 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET1";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser1_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor4_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser1_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor5_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser1_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor6_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser1_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor7_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 0 */
+	qcom,cam-gmsl-sensor4 {
+		cell-index = <4>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor4_ep: endpoint {
+				remote-endpoint = <&deser1_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 1 */
+	qcom,cam-gmsl-sensor5 {
+		cell-index = <5>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor5_ep: endpoint {
+				remote-endpoint = <&deser1_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 2 */
+	qcom,cam-gmsl-sensor6 {
+		cell-index = <6>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor6_ep: endpoint {
+				remote-endpoint = <&deser1_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 3 */
+	qcom,cam-gmsl-sensor7 {
+		cell-index = <7>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor7_ep: endpoint {
+				remote-endpoint = <&deser1_port3>;
+			};
+		};
+	};
+
+};
+
+&cam_cci2 {
+
+	/* GMSL deserializer 2 */
+	qcom,cam-gmsl-deserializer2 {
+		cell-index = <2>;
+		csiphy-sd-index = <2>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend>;
+		gpios = <&tlmm 75 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET2";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser2_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor8_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser2_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor9_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser2_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor10_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser2_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor11_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 0 */
+	qcom,cam-gmsl-sensor8 {
+		cell-index = <8>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor8_ep: endpoint {
+				remote-endpoint = <&deser2_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 1 */
+	qcom,cam-gmsl-sensor9 {
+		cell-index = <9>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor9_ep: endpoint {
+				remote-endpoint = <&deser2_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 2 */
+	qcom,cam-gmsl-sensor10 {
+		cell-index = <10>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor10_ep: endpoint {
+				remote-endpoint = <&deser2_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 3 */
+	qcom,cam-gmsl-sensor11 {
+		cell-index = <11>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor11_ep: endpoint {
+				remote-endpoint = <&deser2_port3>;
+			};
+		};
+	};
+
+};
+
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-camera.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-camera.dtsi
@@ -0,0 +1,2548 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&tlmm {
+	cci_i2c_sda0_active: cci_i2c_sda0_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio57";
+			function = "cci_i2c_sda0";
+		};
+
+		config {
+			pins = "gpio57";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda0_suspend: cci_i2c_sda0_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio57";
+			function = "cci_i2c_sda0";
+		};
+
+		config {
+			pins = "gpio57";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl0_active: cci_i2c_scl0_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio58";
+			function = "cci_i2c_scl0";
+		};
+
+		config {
+			pins = "gpio58";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl0_suspend: cci_i2c_scl0_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio58";
+			function = "cci_i2c_scl0";
+		};
+
+		config {
+			pins = "gpio58";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda1_active: cci_i2c_sda1_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio29";
+			function = "cci_i2c_sda1";
+		};
+
+		config {
+			pins = "gpio29";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda1_suspend: cci_i2c_sda1_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio29";
+			function = "cci_i2c_sda1";
+		};
+
+		config {
+			pins = "gpio29";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl1_active: cci_i2c_scl1_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio30";
+			function = "cci_i2c_scl1";
+		};
+
+		config {
+			pins = "gpio30";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl1_suspend: cci_i2c_scl1_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio30";
+			function = "cci_i2c_scl1";
+		};
+
+		config {
+			pins = "gpio30";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda2_active: cci_i2c_sda2_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio59";
+			function = "cci_i2c_sda2";
+		};
+
+		config {
+			pins = "gpio59";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda2_suspend: cci_i2c_sda2_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio59";
+			function = "cci_i2c_sda2";
+		};
+
+		config {
+			pins = "gpio59";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl2_active: cci_i2c_scl2_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio60";
+			function = "cci_i2c_scl2";
+		};
+
+		config {
+			pins = "gpio60";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl2_suspend: cci_i2c_scl2_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio60";
+			function = "cci_i2c_scl2";
+		};
+
+		config {
+			pins = "gpio60";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda3_active: cci_i2c_sda3_active {
+		mux {
+			pins = "gpio31";
+			function = "cci_i2c_sda3";
+		};
+
+		config {
+			pins = "gpio31";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda3_suspend: cci_i2c_sda3_suspend {
+		mux {
+			pins = "gpio31";
+			function = "cci_i2c_sda3";
+		};
+
+		config {
+			pins = "gpio31";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl3_active: cci_i2c_scl3_active {
+		mux {
+			pins = "gpio32";
+			function = "cci_i2c_scl3";
+		};
+
+		config {
+			pins = "gpio32";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl3_suspend: cci_i2c_scl3_suspend {
+		mux {
+			pins = "gpio32";
+			function = "cci_i2c_scl3";
+		};
+
+		config {
+			pins = "gpio32";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda4_active: cci_i2c_sda4_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio61";
+			function = "cci_i2c_sda4";
+		};
+
+		config {
+			pins = "gpio61";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda4_suspend: cci_i2c_sda4_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio61";
+			function = "cci_i2c_sda4";
+		};
+
+		config {
+			pins = "gpio61";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl4_active: cci_i2c_scl4_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio62";
+			function = "cci_i2c_scl4";
+		};
+
+		config {
+			pins = "gpio62";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl4_suspend: cci_i2c_scl4_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio62";
+			function = "cci_i2c_scl4";
+		};
+
+		config {
+			pins = "gpio62";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda5_active: cci_i2c_sda5_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio54";
+			function = "cci_i2c_sda5";
+		};
+
+		config {
+			pins = "gpio54";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda5_suspend: cci_i2c_sda5_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio54";
+			function = "cci_i2c_sda5";
+		};
+
+		config {
+			pins = "gpio54";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl5_active: cci_i2c_scl5_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio55";
+			function = "cci_i2c_scl5";
+		};
+
+		config {
+			pins = "gpio55";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl5_suspend: cci_i2c_scl5_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio55";
+			function = "cci_i2c_scl5";
+		};
+
+		config {
+			pins = "gpio55";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+		/* MCLK0 */
+		mux {
+			pins = "gpio67";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk0_suspend: cam_sensor_mclk0_suspend {
+		/* MCLK0 */
+		mux {
+			pins = "gpio67";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_active: cam_sensor_mclk1_active {
+		/* MCLK1 */
+		mux {
+			pins = "gpio68";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio68";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_suspend: cam_sensor_mclk1_suspend {
+		/* MCLK1 */
+		mux {
+			pins = "gpio68";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio68";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+		/* MCLK2 */
+		mux {
+			pins = "gpio69";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio69";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_suspend: cam_sensor_mclk2_suspend {
+		/* MCLK2 */
+		mux {
+			pins = "gpio69";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio69";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+};
+
+&soc {
+	qcom,cam-req-mgr {
+		compatible = "qcom,cam-req-mgr";
+		status = "ok";
+	};
+
+	qcom,cam-sync {
+		compatible = "qcom,cam-sync";
+		status = "ok";
+	};
+
+	qcom,cam-i3c-id-table {
+		i3c-sensor-id-table = <0x1B0 0x0766>;
+		i3c-eeprom-id-table = <>;
+		i3c-actuator-id-table = <>;
+		i3c-ois-id-table = <>;
+		status = "disabled";
+	};
+
+	cam_csiphy_tpg13: qcom,tpg13@acac000 {
+		cell-index = <13>;
+		phy-id = <0>;
+		compatible = "qcom,cam-tpg1031";
+		reg-names = "tpg0", "cam_cpas_top";
+		reg = <0x0 0xacac000 0x0 0x400>,
+			<0x0 0xac11000 0x0 0x1000>;
+		reg-cam-base = <0xac000 0x11000>;
+		operating-points-v2 = <&csiphy_tpg0_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		interrupt-names = "tpg0";
+		interrupts = <GIC_SPI 545 IRQ_TYPE_EDGE_RISING>;
+		shared-clks = <1 0>;
+		clock-names =
+			"cphy_rx_clk_src",
+			"csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cphy_rx_clk_src";
+		status = "ok";
+		csiphy_tpg0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy_tpg14: qcom,tpg14@acad000 {
+		cell-index = <14>;
+		phy-id = <1>;
+		compatible = "qcom,cam-tpg1031";
+		reg-names = "tpg1", "cam_cpas_top";
+		reg = <0x0 0xacad000 0x0 0x400>,
+			<0x0 0xac11000 0x0 0x1000>;
+		reg-cam-base = <0xad000 0x11000>;
+		operating-points-v2 = <&csiphy_tpg1_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		interrupt-names = "tpg1";
+		interrupts = <GIC_SPI 546 IRQ_TYPE_EDGE_RISING>;
+		shared-clks = <1 0>;
+		clock-names =
+			"cphy_rx_clk_src",
+			"csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cphy_rx_clk_src";
+		status = "ok";
+		csiphy_tpg1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy_tpg15: qcom,tpg15@acae000 {
+		cell-index = <15>;
+		phy-id = <2>;
+		compatible = "qcom,cam-tpg1031";
+		reg-names = "tpg2", "cam_cpas_top";
+		reg = <0x0 0xacae000 0x0 0x400>,
+			<0x0 0xac11000 0x0 0x1000>;
+		reg-cam-base = <0xae000 0x11000>;
+		operating-points-v2 = <&csiphy_tpg2_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		interrupt-names = "tpg2";
+		interrupts = <GIC_SPI 547 IRQ_TYPE_EDGE_RISING>;
+		shared-clks = <1 0>;
+		clock-names =
+			"cphy_rx_clk_src",
+			"csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cphy_rx_clk_src";
+		status = "ok";
+		csiphy_tpg2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy0: qcom,csiphy0@ac9c000 {
+		cell-index = <0>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0x0ac9c000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy0_opp_table>;
+		reg-cam-base = <0x9c000>;
+		interrupt-names = "CSIPHY0";
+		interrupts = <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l5a>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1200000 880000>;
+		rgltr-max-voltage = <1200000 912000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy0_clk",
+			"csi0phytimer_clk_src",
+			"csi0phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY0_CLK>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy1: qcom,csiphy1@ac9e000 {
+		cell-index = <1>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0xac9e000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy1_opp_table>;
+		reg-cam-base = <0x9e000>;
+		interrupt-names = "CSIPHY1";
+		interrupts = <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l5a>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1200000 880000>;
+		rgltr-max-voltage = <1200000 912000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy1_clk",
+			"csi1phytimer_clk_src",
+			"csi1phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY1_CLK>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy2: qcom,csiphy2@aca0000 {
+		cell-index = <2>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0xaca0000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy2_opp_table>;
+		reg-cam-base = <0xa0000>;
+		interrupt-names = "CSIPHY2";
+		interrupts = <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l5a>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1200000 880000>;
+		rgltr-max-voltage = <1200000 912000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy2_clk",
+			"csi2phytimer_clk_src",
+			"csi2phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY2_CLK>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_cci0: qcom,cci0@ac13000 {
+		cell-index = <0>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac13000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x13000>;
+		interrupt-names = "CCI0";
+		interrupts = <GIC_SPI 460 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci0_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_0_clk_src",
+			"cci_0_clk";
+		clocks = <&camcc CAM_CC_CCI_0_CLK_SRC>,
+			<&camcc CAM_CC_CCI_0_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_0_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl0_active &cci_i2c_sda0_active>;
+		pinctrl-1 = <&cci_i2c_scl0_suspend &cci_i2c_sda0_suspend>;
+		pinctrl-2 = <&cci_i2c_scl1_active &cci_i2c_sda1_active>;
+		pinctrl-3 = <&cci_i2c_scl1_suspend &cci_i2c_sda1_suspend>;
+		status = "ok";
+		cci0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci0: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci0: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci0: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci0: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci1: qcom,cci1@ac14000 {
+		cell-index = <1>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac14000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x14000>;
+		interrupt-names = "CCI1";
+		interrupts = <GIC_SPI 271 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci1_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_1_clk_src",
+			"cci_1_clk";
+		clocks = <&camcc CAM_CC_CCI_1_CLK_SRC>,
+			<&camcc CAM_CC_CCI_1_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_1_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl2_active &cci_i2c_sda2_active>;
+		pinctrl-1 = <&cci_i2c_scl2_suspend &cci_i2c_sda2_suspend>;
+		pinctrl-2 = <&cci_i2c_scl3_active &cci_i2c_sda3_active>;
+		pinctrl-3 = <&cci_i2c_scl3_suspend &cci_i2c_sda3_suspend>;
+		status = "ok";
+		cci1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci1: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci1: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci1: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci1: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci2: qcom,cci2@ac15000 {
+		cell-index = <2>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac15000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x15000>;
+		interrupt-names = "CCI2";
+		interrupts = <GIC_SPI 651 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci2_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_2_clk_src",
+			"cci_2_clk";
+		clocks = <&camcc CAM_CC_CCI_2_CLK_SRC>,
+			<&camcc CAM_CC_CCI_2_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_2_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl4_active &cci_i2c_sda4_active>;
+		pinctrl-1 = <&cci_i2c_scl4_suspend &cci_i2c_sda4_suspend>;
+		pinctrl-2 = <&cci_i2c_scl5_active &cci_i2c_sda5_active>;
+		pinctrl-3 = <&cci_i2c_scl5_suspend &cci_i2c_sda5_suspend>;
+		status = "ok";
+		cci2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci2: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci2: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci2: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci2: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu", "simple-bus";
+		status = "ok";
+		force_cache_allocs;
+
+		msm_cam_smmu_ife {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x2400 0x0020>,
+				<&apps_smmu 0x2420 0x0020>;
+			cam-smmu-label = "ife", "sfe";
+			multiple-client-devices;
+			dma-coherent;
+			ife_iova_mem_map: iova-mem-map {
+				/* IO region is approximately 64 GB */
+				iova-mem-region-io {
+					iova-region-name = "io";
+					/* start address: 0x100000 */
+					/* leaving 1 MB pad at start  */
+					iova-region-start = <0x100000>;
+					/* Length: 0xfffe00000 */
+					/* leaving 1 MB pad at end */
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_icp {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus =
+				<&apps_smmu 0x0800 0x400>,
+				<&apps_smmu 0x0840 0x480>,
+				<&apps_smmu 0x08C0 0x480>,
+				<&apps_smmu 0x0C00 0x400>,
+				<&apps_smmu 0x0C40 0x480>,
+				<&apps_smmu 0x0CC0 0x480>;
+			cam-smmu-label = "icp";
+			qcom,iommu-faults = "stall-disable", "non-fatal";
+			dma-coherent;
+			icp_iova_mem_map: iova-mem-map {
+				iova-mem-region-shared {
+					/* Shared region is ~250MB long */
+					iova-region-name = "shared";
+					iova-region-start = <0x800000>;
+					iova-region-len = <0xfc00000>;
+					iova-region-id = <0x1>;
+					status = "ok";
+				};
+
+				iova-mem-region-fwuncached-region {
+					/* FW uncached region is 7MB long */
+					iova-region-name = "fw_uncached";
+					iova-region-start = <0x10400000>;
+					iova-region-len = <0x700000>;
+					iova-region-id = <0x6>;
+					subregion_support;
+					status = "ok";
+					/* Used for HFI queues/sec heap */
+					iova-mem-region-generic-region {
+						iova-region-name = "icp_hfi";
+						iova-region-start = <0x10400000>;
+						iova-region-len = <0x200000>;
+						iova-region-id = <0x0>;
+					};
+				};
+
+				iova-mem-region-io {
+					/* IO region is approximately 3.8 GB */
+					iova-region-name = "io";
+					iova-region-start = <0x10c00000>;
+					iova-region-len = <0xee300000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+
+				iova-mem-qdss-region {
+					/* QDSS region is appropriate 1MB */
+					iova-region-name = "qdss";
+					iova-region-start = <0x10b00000>;
+					iova-region-len = <0x100000>;
+					iova-region-id = <0x5>;
+					qdss-phy-addr = <0x16790000>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_cdm {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x0860 0x400>,
+				<&apps_smmu 0x0C60 0x400>;
+			cam-smmu-label = "rt-cdm";
+			dma-coherent;
+			multiple-client-devices;
+			rt_cdm_iova_mem_map: iova-mem-map {
+				iova-mem-region-io {
+					/* IO region is approximately 4.0 GB */
+					iova-region-name = "io";
+					/* 1 MB pad for start */
+					iova-region-start = <0x100000>;
+					/* 1 MB pad for end */
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_secure {
+			compatible = "qcom,msm-cam-smmu-cb";
+			cam-smmu-label = "cam-secure";
+			qcom,secure-cb;
+		};
+	};
+
+	qcom,cam-cdm-intf {
+		compatible = "qcom,cam-cdm-intf";
+		cell-index = <0>;
+		label = "cam-cdm-intf";
+		num-hw-cdm = <1>;
+		cdm-client-names = "vfe";
+		status = "ok";
+	};
+
+	qcom,rt-cdm0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac26000 0x0 0x1000>;
+		reg-names = "rt-cdm0";
+		reg-cam-base = <0x26000>;
+		interrupts = <GIC_SPI 543 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm0";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_fast_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_fast_ahb_clk_src";
+		clock-rates = <300000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table0>;
+		clock-cntl-level = "svs";
+		cdm-client-names = "ife0", "dualife0";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table0: opp-table {
+			compatible = "operating-points-v2";
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,rt-cdm1 {
+		cell-index = <1>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac27000 0x0 0x1000>;
+		reg-names = "rt-cdm1";
+		reg-cam-base = <0x27000>;
+		interrupts = <GIC_SPI 544 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm1";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_fast_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_fast_ahb_clk_src";
+		clock-rates = <300000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table1>;
+		clock-cntl-level = "svs_l1";
+		cdm-client-names = "ife1", "dualife1";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table1: opp-table {
+			compatible = "operating-points-v2";
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,rt-cdm2 {
+		cell-index = <2>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac28000 0x0 0x1000>;
+		reg-names = "rt-cdm2";
+		reg-cam-base = <0x28000>;
+		interrupts = <GIC_SPI 567 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm2";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_slow_ahb_clk_src";
+		clock-rates = <80000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table2>;
+		clock-cntl-level = "svs_l1";
+		cdm-client-names = "ife2", "ife3", "ife4", "ife5", "ife6";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table2: opp-table {
+			compatible = "operating-points-v2";
+			opp-80000000 {
+				opp-hz = /bits/ 64 <80000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,rt-cdm3 {
+		cell-index = <3>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac29000 0x0 0x1000>;
+		reg-names = "rt-cdm3";
+		reg-cam-base = <0x29000>;
+		interrupts = <GIC_SPI 566 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm3";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_slow_ahb_clk_src";
+		clock-rates = <80000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table3>;
+		clock-cntl-level = "svs";
+		cdm-client-names = "ife2", "ife3", "ife4", "ife5", "ife6";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table3: opp-table {
+			compatible = "operating-points-v2";
+			opp-80000000 {
+				opp-hz = /bits/ 64 <80000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,cam-isp {
+		compatible = "qcom,cam-isp";
+		arch-compat = "ife";
+		status = "ok";
+	};
+
+	cam_csid0: qcom,csid0 {
+		cell-index = <0>;
+		compatible = "qcom,csid692";
+		reg-names = "csid0", "csid_top";
+		reg = <0x0 0xac7a000 0x0 0xf01>,
+			<0x0 0xac78000 0x0 0x1000>;
+		reg-cam-base = <0x7a000 0x78000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "csid0";
+		interrupts = <GIC_SPI 565 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_csid_clk_src",
+			"cam_cc_csid_clk",
+			"cam_cc_csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CSID_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CLK>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0 0>;
+		clock-cntl-level = "svs_l1";
+		src-clock-name = "cam_cc_csid_clk_src";
+		operating-points-v2 = <&csid0_opp_table>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+		};
+	};
+
+	cam_vfe0: qcom,ife0 {
+		cell-index = <0>;
+		compatible = "qcom,vfe692";
+		reg-names = "ife0", "cam_camnoc";
+		reg = <0x0 0xac4d000 0x0 0xf000>,
+			<0x0 0xac1a000 0x0 0x9400>;
+		reg-cam-base = <0x4d000 0x1a000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "ife0";
+		interrupts = <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_0_clk",
+			"cam_cc_ife_0_clk",
+			"cam_cc_ife_0_clk_src",
+			"cam_cc_ife_0_fast_ahb_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_0_FAST_AHB_CLK>;
+		clock-rates =
+			<0 0 480000000 0>,
+			<0 0 600000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_0_clk_src";
+		operating-points-v2 = <&vfe0_opp_table>;
+		clock-control-debugfs = "true";
+		ubwc-static-cfg = <0x1026 0x1036>;
+		cam_hw_pid = <8 16>;
+		status = "ok";
+		vfe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid1: qcom,csid1 {
+		cell-index = <1>;
+		compatible = "qcom,csid692";
+		reg-names = "csid1", "csid_top";
+		reg = <0x0 0xac7c000 0x0 0xf01>,
+			<0x0 0xac78000 0x0 0x1000>;
+		reg-cam-base = <0x7c000 0x78000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "csid1";
+		interrupts = <GIC_SPI 564 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_csid_clk_src",
+			"cam_cc_csid_clk",
+			"cam_cc_csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CSID_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CLK>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0 0>;
+		clock-cntl-level = "svs_l1";
+		src-clock-name = "cam_cc_csid_clk_src";
+		operating-points-v2 = <&csid1_opp_table>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+		};
+	};
+
+	cam_vfe1: qcom,ife1 {
+		cell-index = <1>;
+		compatible = "qcom,vfe692";
+		reg-names = "ife1", "cam_camnoc";
+		reg = <0x0 0xac60000 0x0 0xf000>,
+			<0x0 0xac1a000 0x0 0x9400>;
+		reg-cam-base = <0x60000 0x1a000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "ife1";
+		interrupts = <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_1_clk",
+			"cam_cc_ife_1_clk",
+			"cam_cc_ife_1_clk_src",
+			"cam_cc_ife_1_fast_ahb_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_1_FAST_AHB_CLK>;
+		clock-rates =
+			<0 0 480000000 0>,
+			<0 0 600000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_1_clk_src";
+		operating-points-v2 = <&vfe1_opp_table>;
+		clock-control-debugfs = "true";
+		ubwc-static-cfg = <0x1026 0x1036>;
+		cam_hw_pid = <9 17>;
+		status = "ok";
+		vfe1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite0: qcom,csid-lite0 {
+		cell-index = <2>;
+		compatible = "qcom,csid-lite692";
+		reg-names = "csid-lite0";
+		reg = <0x0 0xac84000 0x0 0xf01>;
+		reg-cam-base = <0x84000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite0";
+		interrupts = <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite0_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite0: qcom,ife-lite0 {
+		cell-index = <2>;
+		compatible = "qcom,vfe-lite692";
+		reg-names = "ife-lite0";
+		reg = <0x0 0xac84000 0x0 0x1d00>;
+		reg-cam-base = <0x84000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite0";
+		interrupts = <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite0_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite1: qcom,csid-lite1 {
+		cell-index = <3>;
+		compatible = "qcom,csid-lite692";
+		reg-names = "csid-lite1";
+		reg = <0x0 0xac88000 0x0 0xf01>;
+		reg-cam-base = <0x88000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite1";
+		interrupts = <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite1_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite1: qcom,ife-lite1 {
+		cell-index = <3>;
+		compatible = "qcom,vfe-lite692";
+		reg-names = "ife-lite1";
+		reg = <0x0 0xac88000 0x0 0x1d00>;
+		reg-cam-base = <0x88000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite1";
+		interrupts = <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite1_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite2: qcom,csid-lite2 {
+		cell-index = <4>;
+		compatible = "qcom,csid-lite692";
+		reg-names = "csid-lite2";
+		reg = <0x0 0xac8c000 0x0 0xf01>;
+		reg-cam-base = <0x8c000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite2";
+		interrupts = <GIC_SPI 759 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite2_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite2: qcom,ife-lite2 {
+		cell-index = <4>;
+		compatible = "qcom,vfe-lite692";
+		reg-names = "ife-lite2";
+		reg = <0x0 0xac8c000 0x0 0x1d00>;
+		reg-cam-base = <0x8c000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite2";
+		interrupts = <GIC_SPI 761 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite2_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite3: qcom,csid-lite3 {
+		cell-index = <5>;
+		compatible = "qcom,csid-lite692";
+		reg-names = "csid-lite3";
+		reg = <0x0 0xac90000 0x0 0xf01>;
+		reg-cam-base = <0x90000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite3";
+		interrupts = <GIC_SPI 758 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite3_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite3: qcom,ife-lite3 {
+		cell-index = <5>;
+		compatible = "qcom,vfe-lite692";
+		reg-names = "ife-lite3";
+		reg = <0x0 0xac90000 0x0 0x1d00>;
+		reg-cam-base = <0x90000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite3";
+		interrupts = <GIC_SPI 760 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite3_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite4: qcom,csid-lite4 {
+		cell-index = <6>;
+		compatible = "qcom,csid-lite692";
+		reg-names = "csid-lite4";
+		reg = <0x0 0xac94000 0x0 0xf01>;
+		reg-cam-base = <0x94000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite4";
+		interrupts = <GIC_SPI 604 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite4_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite4_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite4: qcom,ife-lite4 {
+		cell-index = <6>;
+		compatible = "qcom,vfe-lite692";
+		reg-names = "ife-lite4";
+		reg = <0x0 0xac94000 0x0 0x1d00>;
+		reg-cam-base = <0x94000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite4";
+		interrupts = <GIC_SPI 605 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite4_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite4_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_sfe_lite0: qcom,sfe-lite0 {
+		cell-index = <0>;
+		compatible = "qcom,sfe-lite692";
+		reg-names = "sfe-lite0";
+		reg = <0x0 0xac74000 0x0 0x1000>;
+		reg-cam-base = <0x74000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "sfe-lite0";
+		interrupts = <GIC_SPI 563 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_sfe_lite_0_fast_ahb_clk",
+			"cam_cc_sfe_lite_0_clk",
+			"cam_cc_cpas_sfe_lite_0_clk";
+		clocks =
+			<&camcc CAM_CC_SFE_LITE_0_FAST_AHB_CLK>,
+			<&camcc CAM_CC_SFE_LITE_0_CLK>,
+			<&camcc CAM_CC_CPAS_SFE_LITE_0_CLK>;
+		clock-rates =
+			<0 480000000 300000000>,
+			<0 600000000 400000000>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_sfe_lite_0_clk";
+		operating-points-v2 = <&cam_sfe_lite_opp_table0>;
+		cam_hw_pid = <4>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		cam_sfe_lite_opp_table0: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_sfe_lite1: qcom,sfe-lite1 {
+		cell-index = <1>;
+		compatible = "qcom,sfe-lite692";
+		reg-names = "sfe-lite1";
+		reg = <0x0 0xac75000 0x0 0x1000>;
+		reg-cam-base = <0x75000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "sfe-lite1";
+		interrupts = <GIC_SPI 562 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_sfe_lite_1_fast_ahb_clk",
+			"cam_cc_sfe_lite_1_clk",
+			"cam_cc_cpas_sfe_1_clk";
+		clocks =
+			<&camcc CAM_CC_SFE_LITE_1_FAST_AHB_CLK>,
+			<&camcc CAM_CC_SFE_LITE_1_CLK>,
+			<&camcc CAM_CC_CPAS_SFE_LITE_1_CLK>;
+		clock-rates =
+			<0 480000000 300000000>,
+			<0 600000000 400000000>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_sfe_lite_1_clk";
+		operating-points-v2 = <&cam_sfe_lite_opp_table1>;
+		cam_hw_pid = <5>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		cam_sfe_lite_opp_table1: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-icp {
+		compatible = "qcom,cam-icp";
+		compat-hw-name = "qcom,icp",
+			"qcom,ipe0";
+		num-icp = <1>;
+		num-ipe = <1>;
+		icp_use_pil;
+		status = "ok";
+	};
+
+	cam_icp: qcom,icp {
+		cell-index = <0>;
+		compatible = "qcom,cam-icp_v3_0";
+		icp-version = <0x0300>;
+
+		reg-names ="icp_csr", "icp_cirq", "icp_wd0";
+		reg = <0x0 0xac01000 0x0 0x400>,
+			<0x0 0xac01800 0x0 0x400>,
+			<0x0 0xac04000 0x0 0x1000>;
+		reg-cam-base = <0x1000 0x1800 0x4000>;
+		interrupt-names = "icp";
+		interrupts = <GIC_SPI 463 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		memory-region = <&camera_mem>;
+		clock-names =
+			"cam_cc_soc_fast_ahb_clk_src",
+			"cam_cc_icp_ahb_clk",
+			"cam_cc_icp_clk_src",
+			"cam_cc_icp_clk";
+		src-clock-name = "cam_cc_icp_clk_src";
+		clocks =
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_ICP_AHB_CLK>,
+			<&camcc CAM_CC_ICP_CLK_SRC>,
+			<&camcc CAM_CC_ICP_CLK>;
+		clock-rates =
+			<300000000 0 480000000 0>,
+			<400000000 0 600000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		nrt-device;
+		fw_name = "CAMERA_ICP";
+		ubwc-ipe-fetch-cfg = <0x707b 0x7083>;
+		ubwc-ipe-write-cfg = <0x161ef 0x1620f>;
+		qos-val = <0xa0a>;
+		operating-points-v2 = <&icp_opp_table>;
+		cam_hw_pid = <12>;
+		status = "ok";
+		icp_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_ipe0: qcom,ipe0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-ipe";
+		reg-names = "ipe0_top";
+		reg = <0x0 0xac2d000 0x0 0x18000>;
+		reg-cam-base = <0x2d000>;
+
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+
+		clock-names =
+			"cam_cc_cpas_ipe_clk",
+			"cam_cc_ipe_ahb_clk",
+			"cam_cc_ipe_clk",
+			"cam_cc_ipe_clk_src",
+			"cam_cc_ipe_fast_ahb_clk",
+			"cam_cc_fast_ahb_clk_src";
+		src-clock-name = "cam_cc_ipe_clk_src";
+		clocks =
+			<&camcc CAM_CC_CPAS_IPE_CLK>,
+			<&camcc CAM_CC_IPE_AHB_CLK>,
+			<&camcc CAM_CC_IPE_CLK>,
+			<&camcc CAM_CC_IPE_CLK_SRC>,
+			<&camcc CAM_CC_IPE_FAST_AHB_CLK>,
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>;
+		clock-rates =
+			<0 0 0 480000000 0 300000000>,
+			<0 0 0 600000000 0 400000000>;
+		clock-cntl-level = "svs_l1", "nominal";
+
+		operating-points-v2 = <&ipe0_opp_table>;
+		nrt-device;
+		cam_hw_pid = <14 15>;
+		status = "ok";
+
+		ipe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+
+	};
+
+	qcom,cam-cpas {
+		cell-index = <0>;
+		compatible = "qcom,cam-cpas";
+		label = "cpas";
+		arch-compat = "cpas_top";
+		reg-names = "cam_cpas_top", "cam_camnoc", "cam_rpmh";
+		reg = <0x0 0xac11000 0x0 0x1000>,
+			<0x0 0xac1A000 0x0 0x9400>,
+			<0x0 0xbbf0000 0x0 0x1f00>;
+		reg-cam-base = <0x11000 0x1A000 0x0bbf0000>;
+		interrupt-names = "cpas_camnoc";
+		interrupts = <GIC_SPI 459 IRQ_TYPE_EDGE_RISING>;
+		camnoc-axi-min-ib-bw = <3000000000>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"gcc_camera_ahb_clk",
+			"gcc_camera_hf_axi_clk",
+			"gcc_camera_sf_axi_clk",
+			"cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk",
+			"cam_cc_core_ahb_clk",
+			"cam_cc_fast_ahb_clk_src",
+			"cam_cc_cpas_fast_ahb_clk",
+			"cam_cc_camnoc_axi_clk_src",
+			"cam_cc_camnoc_axi_clk",
+			"cam_cc_qdss_debug_xo_clk";
+		clocks =
+			<&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_HF_AXI_CLK>,
+			<&gcc GCC_CAMERA_SF_AXI_CLK>,
+			<&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>,
+			<&camcc CAM_CC_CORE_AHB_CLK>,
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_FAST_AHB_CLK>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK_SRC>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&camcc CAM_CC_QDSS_DEBUG_XO_CLK>;
+		src-clock-name = "cam_cc_fast_ahb_clk_src";
+		clock-rates =
+			<0 0 0 0 0 0 0 0 0 0 0>,
+			<0 0 0 80000000 0 0 300000000 0 400000000 0 0>,
+			<0 0 0 80000000 0 0 400000000 0 400000000 0 0>;
+		clock-cntl-level = "suspend", "svs_l1", "nominal";
+		clock-names-option = "cam_icp_clk";
+		clocks-option = <&camcc CAM_CC_ICP_CLK>;
+		clock-rates-option = <480000000>;
+		operating-points-v2 = <&cpas_opp_table>;
+		control-camnoc-axi-clk;
+		camnoc-bus-width = <32>;
+		camnoc-axi-clk-bw-margin-perc = <20>;
+		cam-icc-path-names = "cam_ahb";
+		interconnect-names = "cam_ahb", "cam_hf_0", "cam_sf_0", "cam_sf_icp";
+		interconnects =<&gem_noc MASTER_APPSS_PROC 0
+			&config_noc SLAVE_CAMERA_CFG 0>,
+				<&mmss_noc MASTER_CAMNOC_HF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_SF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_ICP 0
+			&mc_virt SLAVE_EBI1 0>;
+		cam-ahb-num-cases = <7>;
+		cam-ahb-bw-KBps =
+			<0 0>, <0 76800>, <0 150000>, <0 150000>,
+			<0 300000>, <0 300000>, <0 300000>;
+		vdd-corners = <RPMH_REGULATOR_LEVEL_RETENTION
+			RPMH_REGULATOR_LEVEL_MIN_SVS
+			RPMH_REGULATOR_LEVEL_LOW_SVS
+			RPMH_REGULATOR_LEVEL_SVS
+			RPMH_REGULATOR_LEVEL_SVS_L1
+			RPMH_REGULATOR_LEVEL_NOM
+			RPMH_REGULATOR_LEVEL_NOM_L1
+			RPMH_REGULATOR_LEVEL_NOM_L2
+			RPMH_REGULATOR_LEVEL_TURBO
+			RPMH_REGULATOR_LEVEL_TURBO_L1>;
+		vdd-corner-ahb-mapping = "suspend",
+			"lowsvs", "lowsvs", "svs", "svs_l1",
+			"nominal", "nominal", "nominal",
+			"turbo", "turbo";
+		client-id-based;
+		client-names =
+			"csiphy0", "csiphy1", "csiphy2",
+			"cci0", "cci1", "cci2",
+			"csid0", "csid1", "csid2", "csid3",
+			"csid4", "csid5", "csid6", "ife0",
+			"ife1",	"ife2", "ife3", "ife4",
+			"ife5",	"ife6", "ipe0", "sfe0", "sfe1",
+			"cam-cdm-intf0", "rt-cdm0", "rt-cdm1", "rt-cdm2",
+			"rt-cdm3", "icp0", "tpg13", "tpg14", "tpg15";
+
+		status = "ok";
+		enable-secure-qos-update;
+		cpas_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+
+		camera-bus-nodes {
+			level3-nodes {
+				level-index = <3>;
+				level3_rt_rd_wr_sum: level3-rt-rd-wr-sum {
+					cell-index = <0>;
+					node-name = "level3-rt-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					ib-bw-voting-needed;
+					qcom,axi-port-mnoc {
+						cam-icc-path-names = "cam_hf_0";
+					};
+				};
+
+				level3_nrt0_rd_wr_sum: level3-nrt0-rd-wr-sum {
+					cell-index = <1>;
+					node-name = "level3-nrt0-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						cam-icc-path-names = "cam_sf_0";
+					};
+				};
+
+				level3_nrt1_rd_wr_sum: level3-nrt1-rd-wr-sum {
+					cell-index = <2>;
+					node-name = "level3-nrt1-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						cam-icc-path-names = "cam_sf_icp";
+					};
+				};
+			};
+
+			level2-nodes {
+				level-index = <2>;
+				camnoc-max-needed;
+				level2_rt_wr0: level2-rt-wr0 {
+					cell-index = <3>;
+					node-name = "level2-rt-wr0";
+					parent-node = <&level3_rt_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_rt_wr1: level2-rt-wr1 {
+					cell-index = <4>;
+					node-name = "level2-rt-wr1";
+					parent-node = <&level3_rt_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt_wr2: level2-nrt-wr2 {
+					cell-index = <5>;
+					node-name = "level2-nrt-wr2";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_rt_rd0: level2-rt-read0 {
+					cell-index = <6>;
+					node-name = "level2-rt-rd0";
+					parent-node = <&level3_rt_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt_rd1: level2-nrt-rd1 {
+					cell-index = <7>;
+					node-name = "level2-nrt-rd1";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt_rd2: level2-nrt-rd2 {
+					cell-index = <8>;
+					node-name = "level2-nrt-rd2";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_icp_rd: level2-icp-rd {
+					cell-index = <9>;
+					node-name = "level2-icp-rd";
+					parent-node = <&level3_nrt1_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+			};
+
+			level1-nodes {
+				level-index = <1>;
+				camnoc-max-needed;
+				level1_rt_wr0: level1-rt-wr0 {
+					cell-index = <10>;
+					node-name = "level1-rt-wr0";
+					parent-node = <&level2_rt_wr0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt_wr1: level1-rt-wr1 {
+					cell-index = <11>;
+					node-name = "level1-rt-wr1";
+					parent-node = <&level2_rt_wr1>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt_rd0: level1-rt-read0 {
+					cell-index = <13>;
+					node-name = "level1-rt-rd0";
+					parent-node = <&level2_rt_rd0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt_rd2: level1-nrt-rd2 {
+					cell-index = <15>;
+					node-name = "level1-nrt-rd2";
+					parent-node = <&level2_nrt_rd2>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+			};
+
+			level0-nodes {
+				level-index = <0>;
+				ife_0_wr_0: ife-0-wr-0 {
+					cell-index = <16>;
+					node-name = "ife-0-wr-0";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_1_wr_0: ife-1-wr-0 {
+					cell-index = <17>;
+					node-name = "ife-1-wr-0";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_0_wr_0: ife-lite-0-wr-0 {
+					cell-index = <18>;
+					node-name = "ife-lite-0-wr-0";
+					client-name = "ife2";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_1_wr_0: ife-lite-1-wr-0 {
+					cell-index = <19>;
+					node-name = "ife-lite-1-wr-0";
+					client-name = "ife3";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_2_wr_0: ife-lite-2-wr-0 {
+					cell-index = <20>;
+					node-name = "ife-lite-2-wr-0";
+					client-name = "ife4";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_3_wr_0: ife-lite-3-wr-0 {
+					cell-index = <21>;
+					node-name = "ife-lite-3-wr-0";
+					client-name = "ife5";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_4_wr_0: ife-lite-4-wr-0 {
+					cell-index = <22>;
+					node-name = "ife-lite-4-wr-0";
+					client-name = "ife6";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_0_wr_1: ife-0-wr-1 {
+					cell-index = <23>;
+					node-name = "ife-0-wr-1";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_UBWC>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_DISP>;
+					parent-node = <&level1_rt_wr1>;
+				};
+				ife_1_wr_1: ife-1-wr-1 {
+					cell-index = <24>;
+					node-name = "ife-1-wr-1";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_UBWC>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_DISP>;
+					parent-node = <&level1_rt_wr1>;
+				};
+				sfe_0_rd_0: sfe-0-rd-0 {
+					cell-index = <25>;
+					node-name = "sfe-0-rd-0";
+					client-name = "sfe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_SFE_NRDI>;
+					parent-node = <&level1_rt_rd0>;
+				};
+				sfe_1_rd_0: sfe-1-rd-0 {
+					cell-index = <26>;
+					node-name = "sfe-1-rd-0";
+					client-name = "sfe1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_SFE_NRDI>;
+					parent-node = <&level1_rt_rd0>;
+				};
+				ipe_0_wr_2: ipe-0-wr-2 {
+					cell-index = <27>;
+					node-name = "ipe-0-wr-2";
+					client-name = "ipe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_WR_VID
+					CAM_CPAS_PATH_DATA_IPE_WR_DISP
+					CAM_CPAS_PATH_DATA_IPE_WR_REF
+					CAM_CPAS_PATH_DATA_IPE_WR_APP>;
+					parent-node = <&level2_nrt_wr2>;
+				};
+				ipe_0_rd_all: ipe-0-rd-all {
+					cell-index = <28>;
+					node-name = "ipe-0-rd-all";
+					client-name = "ipe0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_RD_IN
+					CAM_CPAS_PATH_DATA_IPE_RD_REF>;
+					parent-node = <&level2_nrt_rd1>;
+				};
+				rt_cdm0_all_rd_2: rt-cdm0-all-rd-2 {
+					cell-index = <29>;
+					node-name = "rt-cdm0-all-rd-2";
+					client-name = "rt-cdm0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				rt_cdm1_all_rd_2: rt-cdm1-all-rd-2 {
+					cell-index = <30>;
+					node-name = "rt-cdm1-all-rd-2";
+					client-name = "rt-cdm1";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				rt_cdm2_all_rd_2: rt-cdm2-all-rd-2 {
+					cell-index = <31>;
+					node-name = "rt-cdm2-all-rd-2";
+					client-name = "rt-cdm2";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				rt_cdm3_all_rd_2: rt-cdm3-all-rd-2 {
+					cell-index = <32>;
+					node-name = "rt-cdm3-all-rd-2";
+					client-name = "rt-cdm3";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				ipe_cdm0_all_rd: ipe-cdm0-all-rd {
+					cell-index = <33>;
+					node-name = "ipe-cdm0-all-rd";
+					client-name = "ipe0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				icp_all_rd: icp-all-rd {
+					cell-index = <34>;
+					node-name = "icp-all-rd";
+					client-name = "icp0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level2_icp_rd>;
+				};
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-camera.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-camera.dtso
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,qcs8300-gcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-camcc.h>
+#include <dt-bindings/interconnect/qcom,qcs8300-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+
+#include "qcs8300-camera.dtsi"
+#include "qcs8300-camera-sensor-idp.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-dma-heaps.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-dma-heaps.dtsi
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/arm/qcom_dma_heap_dt_constants.h>
+
+&soc {
+	qcom,dma-heaps {
+		compatible = "qcom,dma-heaps";
+
+		qcom,qseecom {
+			qcom,dma-heap-name = "qcom,qseecom";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&qseecom_mem>;
+		};
+
+		qcom,qseecom_ta {
+			qcom,dma-heap-name = "qcom,qseecom-ta";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&qseecom_ta_mem>;
+		};
+
+		qcom,secure_cdsp {
+			qcom,dma-heap-name = "qcom,cma-secure-cdsp";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&cdsp_secure_heap>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-graphics.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-graphics.dtsi
@@ -0,0 +1,212 @@
+/*
+ * Copyright (c) 2024-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+#define MHZ_TO_KBPS(mhz, w) ((mhz * 1000000 * w) / (1024))
+
+&soc {
+	msm_gpu: qcom,kgsl-3d0@3d00000 {
+		compatible = "qcom,kgsl";
+		status = "ok";
+		reg = <0 0x3d00000 0 0x40000>, <0 0x3d61000 0 0x800>,
+			<0 0x3de0000 0 0x10000>, <0 0x4900000 0 0x80000>,
+			<0 0x3dff000 0 0x1000>;
+		reg-names = "kgsl_3d0_reg_memory", "cx_dbgc", "rscc",
+			"qdss_gfx", "fusa";
+		interrupts = <0 300 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "kgsl_3d0_irq";
+
+		clocks = <&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+			<&gcc GCC_GPU_SNOC_DVM_GFX_CLK>,
+			<&gpucc GPU_CC_AHB_CLK>,
+			<&gpucc GPU_CC_CX_GMU_CLK>,
+			<&gpucc GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK>,
+			<&gpucc GPU_CC_HUB_AON_CLK>,
+			<&gpucc GPU_CC_HUB_CX_INT_CLK>;
+		clock-names = "gcc_gpu_memnoc_gfx",
+				"gcc_gpu_snoc_dvm_gfx",
+				"gpu_cc_ahb",
+				"gpu_cc_cx_gmu",
+				"gpu_cc_hlos1_vote_gpu_smmu",
+				"gpu_cc_hub_aon",
+				"gpu_cc_hub_cx_int";
+
+		qcom,chipid = <0x06020300>;
+		qcom,gpu-model = "Adreno623";
+
+		qcom,initial-pwrlevel = <0>;
+
+		qcom,min-access-length = <32>;
+
+		qcom,ubwc-mode = <4>;
+
+		qcom,gpu-qdss-stm = <0x161c0000 0x40000>; /* base addr, size */
+
+		qcom,tzone-names = "gpuss-0-usr", "gpuss-1-usr";
+
+		interconnect-names = "gpu_icc_path";
+		interconnects = <&gem_noc MASTER_GFX3D 0 &mc_virt SLAVE_EBI1 0>;
+		qcom,bus-table-ddr =
+			<MHZ_TO_KBPS(0, 4)>,    /* index=0  */
+			<MHZ_TO_KBPS(200, 4)>,  /* index=1  */
+			<MHZ_TO_KBPS(451, 4)>,  /* index=2  */
+			<MHZ_TO_KBPS(547, 4)>,  /* index=3  */
+			<MHZ_TO_KBPS(681, 4)>,  /* index=4  */
+			<MHZ_TO_KBPS(768, 4)>,  /* index=5  */
+			<MHZ_TO_KBPS(1017, 4)>, /* index=6  */
+			<MHZ_TO_KBPS(1353, 4)>, /* index=7  */
+			<MHZ_TO_KBPS(1555, 4)>, /* index=8  */
+			<MHZ_TO_KBPS(1708, 4)>, /* index=9  */
+			<MHZ_TO_KBPS(2092, 4)>, /* index=10  */
+			<MHZ_TO_KBPS(2736, 4)>, /* index=11  */
+			<MHZ_TO_KBPS(3196, 4)>; /* index=12  */
+
+		qcom,bus-table-cnoc =
+			<0>,   /* Off */
+			<100>; /* On */
+
+		zap-shader {
+			memory-region = <&gpu_microcode_mem>;
+		};
+
+		qcom,gpu-mempools {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			compatible = "qcom,gpu-mempools";
+
+			/* 4K Page Pool configuration */
+			qcom,gpu-mempool@0 {
+				reg = <0>;
+				qcom,mempool-page-size = <4096>;
+				qcom,mempool-reserved = <2048>;
+			};
+			/* 8K Page Pool configuration */
+			qcom,gpu-mempool@1 {
+				reg = <1>;
+				qcom,mempool-page-size = <8192>;
+				qcom,mempool-reserved = <1024>;
+			};
+			/* 64K Page Pool configuration */
+			qcom,gpu-mempool@2 {
+				reg = <2>;
+				qcom,mempool-page-size = <65536>;
+				qcom,mempool-reserved = <256>;
+			};
+			/* 128K Page Pool configuration */
+			qcom,gpu-mempool@3 {
+				reg = <3>;
+				qcom,mempool-page-size = <131072>;
+				qcom,mempool-reserved = <128>;
+			};
+			/* 256K Page Pool configuration */
+			qcom,gpu-mempool@4 {
+				reg = <4>;
+				qcom,mempool-page-size = <262144>;
+				qcom,mempool-reserved = <80>;
+			};
+			/* 1M Page Pool configuration */
+			qcom,gpu-mempool@5 {
+				reg = <5>;
+				qcom,mempool-page-size = <1048576>;
+				qcom,mempool-reserved = <32>;
+			};
+		};
+
+		/* Power levels */
+		qcom,gpu-pwrlevels {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			compatible = "qcom,gpu-pwrlevels";
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <877000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_TURBO_L1>;
+
+				qcom,bus-freq = <12>;
+				qcom,bus-min = <12>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <780000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_TURBO>;
+
+				qcom,bus-freq = <11>;
+				qcom,bus-min = <11>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <599000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+				qcom,bus-freq = <10>;
+				qcom,bus-min = <10>;
+				qcom,bus-max = <11>;
+			};
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <479000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <10>;
+			};
+
+		};
+	};
+
+	kgsl_msm_iommu: qcom,kgsl-iommu@3da0000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "qcom,kgsl-smmu-v2";
+		reg = <0x03da0000 0x20000>;
+
+		power-domains = <&gpucc GPU_CC_CX_GDSC>;
+
+		gfx3d_user: gfx3d_user {
+			compatible = "qcom,smmu-kgsl-cb" , "qcom,adreno-gmu";
+			iommus = <&adreno_smmu 0x0 0xc00>, <&adreno_smmu 0x1 0xc00>;
+			qcom,iommu-dma = "disabled";
+		};
+	};
+
+	gmu: qcom,gmu@3d6a000 {
+		compatible = "qcom,gpu-gmu";
+
+		reg = <0 0x3d6a000 0 0x34000>,
+			<0 0xb290000 0 0x10000>;
+
+		reg-names = "kgsl_gmu_reg",
+			"kgsl_gmu_pdc_cfg";
+
+		interrupts = <0 304 IRQ_TYPE_LEVEL_HIGH>,
+			<0 305 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "kgsl_hfi_irq", "kgsl_gmu_irq";
+
+		iommus = <&adreno_smmu 0x5 0xc00>;
+		qcom,iommu-dma = "disabled";
+
+		power-domains = <&gpucc GPU_CC_CX_GDSC>, <&gpucc GPU_CC_GX_GDSC>;
+		power-domain-names = "cx", "gx";
+
+		clocks = <&gpucc GPU_CC_CX_GMU_CLK>,
+			<&gpucc GPU_CC_CXO_CLK>,
+			<&gcc GCC_DDRSS_GPU_AXI_CLK>,
+			<&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+			<&gpucc GPU_CC_AHB_CLK>,
+			<&gpucc GPU_CC_HUB_CX_INT_CLK>;
+
+		clock-names = "gmu_clk", "cxo_clk", "axi_clk",
+			"memnoc_clk", "ahb_clk", "hub_clk";
+
+		qcom,qmp = <&aoss_qmp>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-graphics.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-graphics.dtso
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,qcs8300-gcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-gpucc.h>
+#include <dt-bindings/interconnect/qcom,qcs8300-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+
+#include "qcs8300-graphics.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS8300 Ride";
+	compatible = "qcom,qcs8300-ride", "qcom,qcs8300";
+
+	qcom,msm-id = <606 0x10000>;
+	qcom,board-id = <0x00010019 0>, <0x01010019 1>;
+};
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-pmics.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-pmics.dtsi
@@ -0,0 +1,403 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/iio/qcom,spmi-adc5-gen3-pm8775.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/spmi/spmi.h>
+
+/ {
+	thermal-zones {
+		pmm8620au_0_mbg_tz {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8620au_sail_0_tz>;
+
+			trips {
+				trip0 {
+					temperature = <115000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <135000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pmm8620au-0-therm {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8620au_0_temp_alarm>;
+
+			trips {
+				trip0 {
+					temperature = <105000>;
+					hysteresis = <0>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <0>;
+					type = "critical";
+				};
+			};
+		};
+
+		pmm8620au_0_sail_xo {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8620au_0_adc PM8775_1_ADC5_GEN3_AMUX6_THM_100K_PU>;
+			trips {
+				trip0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pmm8620au_0_ufs0 {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8620au_0_adc PM8775_1_ADC5_GEN3_AMUX5_THM_100K_PU>;
+			trips {
+				trip0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pmm8620au_0_xo {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8620au_0_adc PM8775_1_ADC5_GEN3_AMUX1_THM_100K_PU>;
+			trips {
+				trip0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pmm8650au_1_mbg_tz {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8620au_sail_1_tz>;
+
+			trips {
+				trip0 {
+					temperature = <115000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <135000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pmm8650au-1-therm {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8650au_1_temp_alarm>;
+
+			trips {
+				trip0 {
+					temperature = <105000>;
+					hysteresis = <0>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <0>;
+					type = "critical";
+				};
+			};
+		};
+
+		pmm8650au_1_sdram {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8650au_1_adc PM8775_2_ADC5_GEN3_AMUX6_THM_100K_PU>;
+			trips {
+				trip0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+	};
+};
+
+&spmi_bus {
+	pmm8620au_0: pmic@0 {
+		compatible = "qcom,spmi-pmic";
+		reg = <0x0 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pmm8620au_0_adc: vadc@8000 {
+			compatible = "qcom,spmi-adc5-gen3";
+			reg = <0x8000>;
+			reg-names = "adc5-gen3-base";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts-extended = <&spmi_bus 0x0 0x80 0x1 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "adc-sdam0";
+			#io-channel-cells = <1>;
+			#thermal-sensor-cells = <1>;
+
+			pmm8620au_0_ref_gnd {
+				reg = <PM8775_1_ADC5_GEN3_OFFSET_REF>;
+				label = "pmm8620au_0_ref_gnd";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8620au_0_vref_1p25 {
+				reg = <PM8775_1_ADC5_GEN3_1P25VREF>;
+				label = "pmm8620au_0_vref_1p25";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8620au_0_die_temp {
+				reg = <PM8775_1_ADC5_GEN3_DIE_TEMP>;
+				label = "pmm8620au_0_die_temp";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8620au_0_vph_pwr {
+				reg = <PM8775_1_ADC5_GEN3_VPH_PWR>;
+				label = "pmm8620au_0_vph_pwr";
+				qcom,pre-scaling = <1 3>;
+			};
+
+			pmm8620au_0_sail_xo_therm {
+				reg = <PM8775_1_ADC5_GEN3_AMUX6_THM_100K_PU>;
+				label = "pmm8620au_0_sail_xo_therm";
+				qcom,ratiometric;
+				qcom,hw-settle-time = <200>;
+				qcom,adc-tm;
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8620au_0_ufs0_therm {
+				reg = <PM8775_1_ADC5_GEN3_AMUX5_THM_100K_PU>;
+				label = "pmm8620au_0_ufs0_therm";
+				qcom,ratiometric;
+				qcom,hw-settle-time = <200>;
+				qcom,adc-tm;
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8620au_0_xo_therm {
+				reg = <PM8775_1_ADC5_GEN3_AMUX1_THM_100K_PU>;
+				label = "pmm8620au_0_xo_therm";
+				qcom,ratiometric;
+				qcom,hw-settle-time = <700>;
+				qcom,adc-tm;
+				qcom,pre-scaling = <1 1>;
+			};
+		};
+
+		pmm8620au_0_temp_alarm: temp-alarm@a00 {
+			compatible = "qcom,spmi-temp-alarm";
+			reg = <0xa00>;
+			interrupts-extended = <&spmi_bus 0x0 0xa 0x0 IRQ_TYPE_EDGE_BOTH>;
+			io-channels = <&pmm8620au_0_adc PM8775_1_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
+			#thermal-sensor-cells = <0>;
+		};
+
+		pmm8620au_0_pon: pon@1200 {
+			compatible = "qcom,pmk8350-pon";
+			reg = <0x1200>, <0x800>;
+			reg-names = "hlos", "pbs";
+
+			pmm8620au_0_pon_pwrkey: pwrkey {
+				compatible = "qcom,pmk8350-pwrkey";
+				interrupts-extended = <&spmi_bus 0x0 0x12 0x7 IRQ_TYPE_EDGE_BOTH>;
+				linux,code = <KEY_POWER>;
+				debounce = <15625>;
+			};
+
+			pmm8620au_0_pon_resin: resin {
+				compatible = "qcom,pmk8350-resin";
+				interrupts-extended = <&spmi_bus 0x0 0x12 0x6 IRQ_TYPE_EDGE_BOTH>;
+				debounce = <15625>;
+				linux,code = <KEY_VOLUMEDOWN>;
+			};
+		};
+
+		pmm8620au_0_rtc: rtc@6100 {
+			compatible = "qcom,pmk8350-rtc";
+			reg = <0x6100>, <0x6200>;
+			reg-names = "rtc", "alarm";
+			interrupts = <0x0 0x62 0x1 IRQ_TYPE_EDGE_RISING>;
+			allow-set-time;
+		};
+
+		pmm8620au_0_sdam_0: nvram@7100 {
+			compatible = "qcom,spmi-sdam";
+			reg = <0x7100>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			ranges = <0 0x7100 0x100>;
+
+			reboot_reason: reboot-reason@48 {
+				reg = <0x48 0x1>;
+				bits = <1 7>;
+			};
+		};
+
+		pmm8620au_0_gpios: gpio@8800 {
+			compatible = "qcom,pmm8654au-gpio";
+			reg = <0x8800>;
+			gpio-controller;
+			gpio-ranges = <&pmm8620au_0_gpios 0 0 12>;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	pmm8620au_sail_0: pmic@1 {
+		compatible = "qcom,spmi-pmic";
+		reg = <1 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pmm8620au_sail_0_tz: qcom,mbg-tm@d700 {
+			compatible = "qcom,spmi-mgb-tm";
+			reg = <0xd700>;
+			io-channels = <&pmm8620au_0_adc PM8775_1_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
+			interrupts-extended = <&spmi_bus 0x1 0xd7 0x0 IRQ_TYPE_EDGE_RISING>;
+			#thermal-sensor-cells = <0>;
+		};
+	};
+
+	pmm8650au_1: pmic@2 {
+		compatible = "qcom,spmi-pmic";
+		reg = <0x2 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pmm8650au_1_adc: vadc@8000 {
+			compatible = "qcom,spmi-adc5-gen3";
+			reg = <0x8000>;
+			reg-names = "adc5-gen3-base";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts-extended = <&spmi_bus 0x2 0x80 0x1 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "adc-sdam0";
+			#io-channel-cells = <1>;
+			#thermal-sensor-cells = <1>;
+
+			pmm8650au_1_ref_gnd {
+				reg = <PM8775_2_ADC5_GEN3_OFFSET_REF>;
+				label = "pmm8650au_1_ref_gnd";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8650au_1_vref_1p25 {
+				reg = <PM8775_2_ADC5_GEN3_1P25VREF>;
+				label = "pmm8650au_1_vref_1p25";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8650au_1_die_temp {
+				reg = <PM8775_2_ADC5_GEN3_DIE_TEMP>;
+				label = "pmm8650au_1_die_temp";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8650au_1_vph_pwr {
+				reg = <PM8775_2_ADC5_GEN3_VPH_PWR>;
+				label = "pmm8650au_1_vph_pwr";
+				qcom,pre-scaling = <1 3>;
+			};
+
+			pmm8650au_1_sdram_therm {
+				reg = <PM8775_2_ADC5_GEN3_AMUX6_THM_100K_PU>;
+				label = "pmm8650au_1_sdram_therm";
+				qcom,ratiometric;
+				qcom,hw-settle-time = <200>;
+				qcom,adc-tm;
+				qcom,pre-scaling = <1 1>;
+			};
+		};
+
+		pmm8650au_1_temp_alarm: temp-alarm@a00 {
+			compatible = "qcom,spmi-temp-alarm";
+			reg = <0xa00>;
+			interrupts-extended = <&spmi_bus 0x2 0xa 0x0 IRQ_TYPE_EDGE_BOTH>;
+			io-channels = <&pmm8650au_1_adc PM8775_2_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
+			#thermal-sensor-cells = <0>;
+		};
+
+		pmm8650au_1_gpios: gpio@8800 {
+			compatible = "qcom,pmm8654au-gpio";
+			reg = <0x8800>;
+			gpio-controller;
+			gpio-ranges = <&pmm8650au_1_gpios 0 0 12>;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	pmm8650au_sail_1: pmic@3 {
+		compatible = "qcom,spmi-pmic";
+		reg = <3 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pmm8620au_sail_1_tz: qcom,mbg-tm@d700 {
+			compatible = "qcom,spmi-mgb-tm";
+			reg = <0xd700>;
+			io-channels = <&pmm8650au_1_adc PM8775_2_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
+			interrupts-extended = <&spmi_bus 0x3 0xd7 0x0 IRQ_TYPE_EDGE_RISING>;
+			#thermal-sensor-cells = <0>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-ride.dts
@@ -0,0 +1,814 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/regulator/qcom,rpmh-regulator.h>
+#include <dt-bindings/spmi/spmi.h>
+
+#include "qcs8300.dtsi"
+#include "qcs8300-pmics.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS8300 Ride";
+	compatible = "qcom,qcs8300-ride", "qcom,qcs8275", "qcom,qcs8300";
+
+	qcom,msm-id = <606 0x10000>, <674 0x10000>, <675 0x10000>;
+	qcom,board-id = <0x00010019 0>, <0x01010019 1>;
+
+	aliases {
+		serial0 = &uart7;
+		serial1 = &uart2;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	dsi0-connector {
+		compatible = "dp-connector";
+		type = "full-size";
+		label = "DSI0";
+
+		port {
+			 dsi0_connector_in: endpoint {
+			};
+		};
+	};
+
+	/* PWR_CTR2_VDD_1P8 supply */
+	vreg_conn_1p8: vreg_conn_1p8 {
+		compatible = "regulator-fixed";
+		regulator-name = "vreg_conn_1p8";
+		startup-delay-us = <4000>;
+		enable-active-high;
+		gpio = <&pmm8650au_1_gpios 4 GPIO_ACTIVE_HIGH>;
+	};
+
+	/* PWR_CTR1_VDD_PA supply */
+	vreg_conn_pa: vreg_conn_pa {
+		compatible = "regulator-fixed";
+		regulator-name = "vreg_conn_pa";
+		startup-delay-us = <4000>;
+		enable-active-high;
+		gpio = <&pmm8650au_1_gpios 6 GPIO_ACTIVE_HIGH>;
+	};
+
+	wcn6855-pmu {
+		compatible = "qcom,wcn6855-pmu";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&wlan_en_state>;
+
+		vddctrl1-supply = <&vreg_conn_pa>;
+		vddctrl2-supply = <&vreg_conn_1p8>;
+		vddaon-supply = <&vreg_conn_pa>;
+		vddvm-supply = <&vreg_conn_1p8>;
+		vddvl-supply = <&vreg_conn_pa>;
+		vddvh-supply = <&vreg_conn_1p8>;
+
+		wlan-enable-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
+		regulators {
+			vreg_pmu_rfa_cmn: ldo0 {
+				regulator-name = "vreg_pmu_rfa_cmn";
+			};
+
+			vreg_pmu_aon_0p59: ldo1 {
+				regulator-name = "vreg_pmu_aon_0p59";
+			};
+
+			vreg_pmu_wlcx_0p8: ldo2 {
+				regulator-name = "vreg_pmu_wlcx_0p8";
+			};
+
+			vreg_pmu_wlmx_0p85: ldo3 {
+				regulator-name = "vreg_pmu_wlmx_0p85";
+			};
+
+			vreg_pmu_btcmx_0p85: ldo4 {
+				regulator-name = "vreg_pmu_btcmx_0p85";
+			};
+
+			vreg_pmu_rfa_0p8: ldo5 {
+				regulator-name = "vreg_pmu_rfa_0p8";
+			};
+
+			vreg_pmu_rfa_1p2: ldo6 {
+				regulator-name = "vreg_pmu_rfa_1p2";
+			};
+
+			vreg_pmu_rfa_1p7: ldo7 {
+				regulator-name = "vreg_pmu_rfa_1p7";
+			};
+
+			vreg_pmu_pcie_0p9: ldo8 {
+				regulator-name = "vreg_pmu_pcie_0p9";
+			};
+
+			vreg_pmu_pcie_1p8: ldo9 {
+				regulator-name = "vreg_pmu_pcie_1p8";
+			};
+		};
+	};
+};
+
+&apps_rsc {
+	regulators-0 {
+		compatible = "qcom,pmm8654au-rpmh-regulators";
+		qcom,pmic-id = "a";
+
+		vreg_s4a: smps4 {
+			regulator-name = "vreg_s4a";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s9a: smps9 {
+			regulator-name = "vreg_s9a";
+			regulator-min-microvolt = <1352000>;
+			regulator-max-microvolt = <1352000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3a: ldo3 {
+			regulator-name = "vreg_l3a";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l4a: ldo4 {
+			regulator-name = "vreg_l4a";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l5a: ldo5 {
+			regulator-name = "vreg_l5a";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6a: ldo6 {
+			regulator-name = "vreg_l6a";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7a: ldo7 {
+			regulator-name = "vreg_l7a";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8a: ldo8 {
+			regulator-name = "vreg_l8a";
+			regulator-min-microvolt = <2504000>;
+			regulator-max-microvolt = <2960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l9a: ldo9 {
+			regulator-name = "vreg_l9a";
+			regulator-min-microvolt = <2970000>;
+			regulator-max-microvolt = <3072000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-1 {
+		compatible = "qcom,pmm8654au-rpmh-regulators";
+		qcom,pmic-id = "c";
+
+		vreg_s5c: smps5 {
+			regulator-name = "vreg_s5c";
+			regulator-min-microvolt = <1104000>;
+			regulator-max-microvolt = <1104000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1c: ldo1 {
+			regulator-name = "vreg_l1c";
+			regulator-min-microvolt = <300000>;
+			regulator-max-microvolt = <500000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2c: ldo2 {
+			regulator-name = "vreg_l2c";
+			regulator-min-microvolt = <900000>;
+			regulator-max-microvolt = <904000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l4c: ldo4 {
+			regulator-name = "vreg_l4c";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6c: ldo6 {
+			regulator-name = "vreg_l6c";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7c: ldo7 {
+			regulator-name = "vreg_l7c";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8c: ldo8 {
+			regulator-name = "vreg_l8c";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l9c: ldo9 {
+			regulator-name = "vreg_l9c";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+};
+
+&dsi0_connector_in {
+	remote-endpoint = <&anx7625_1_out>;
+};
+
+&ethernet0 {
+	phy-mode = "2500base-x";
+	phy-handle = <&sgmii_phy0>;
+
+	pinctrl-0 = <&ethernet0_default>;
+	pinctrl-names = "default";
+
+	snps,mtl-rx-config = <&mtl_rx_setup>;
+	snps,mtl-tx-config = <&mtl_tx_setup>;
+	snps,ps-speed = <1000>;
+
+	status = "okay";
+
+	mdio {
+		compatible = "snps,dwmac-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		sgmii_phy0: phy@8 {
+			compatible = "ethernet-phy-id31c3.1c33";
+			reg = <0x8>;
+			device_type = "ethernet-phy";
+			interrupts-extended = <&tlmm 4 IRQ_TYPE_EDGE_FALLING>;
+			reset-gpios = <&tlmm 31 GPIO_ACTIVE_LOW>;
+			reset-assert-us = <11000>;
+			reset-deassert-us = <70000>;
+		};
+	};
+
+	mtl_rx_setup: rx-queues-config {
+		snps,rx-queues-to-use = <4>;
+		snps,rx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x0>;
+			snps,route-up;
+			snps,priority = <0x1>;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x1>;
+			snps,route-ptp;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x2>;
+			snps,route-avcp;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x3>;
+			snps,priority = <0xc>;
+		};
+	};
+
+	mtl_tx_setup: tx-queues-config {
+		snps,tx-queues-to-use = <4>;
+		snps,tx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+	};
+};
+
+&eud {
+	status = "okay";
+};
+
+&i2c8 {
+	clock-frequency = <400000>;
+	pinctrl-0 = <&qup_i2c8_data_clk
+		     &io_expander_intr_active
+		     &io_expander_reset_active>;
+	pinctrl-names = "default";
+
+	status = "okay";
+
+	io_expander: gpio@74 {
+		compatible = "ti,tca9539";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x74>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <93 IRQ_TYPE_EDGE_BOTH>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&dsi0_hpd_cfg_pins
+			    &dsi0_cdet_cfg_pins>;
+
+		dsi0_hpd_cfg_pins: gpio2-cfg {
+			pins = "gpio2";
+			input-enable;
+			bias-disable;
+		};
+
+		dsi0_cdet_cfg_pins: gpio3-cfg {
+			pins = "gpio3";
+			bias-pull-down;
+		};
+	};
+
+	i2c-mux@70 {
+		compatible = "nxp,pca9543";
+		#address-cells = <1>;
+
+		#size-cells = <0>;
+		reg = <0x70>;
+
+		i2c@0 {
+			reg = <0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			anx_7625_1: anx7625@58 {
+				compatible = "analogix,anx7625";
+				reg = <0x58>;
+				interrupt-parent = <&io_expander>;
+				interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
+				enable-gpios = <&io_expander 1 0>;
+				reset-gpios = <&io_expander 0 0>;
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					dsi2dp_bridge_1_in: port@0 {
+						reg = <0>;
+						anx7625_1_in: endpoint {
+							remote-endpoint = <&mdss_dsi0_out>;
+						};
+					};
+
+					dsi2dp_bridge_1_out: port@1 {
+						reg = <1>;
+						anx7625_1_out: endpoint {
+							remote-endpoint = <&dsi0_connector_in>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&i2c15 {
+	clock-frequency = <400000>;
+	status = "okay";
+};
+
+&mdss_dsi0 {
+	vdda-supply = <&vreg_l5a>;
+
+	status = "okay";
+};
+
+&mdss_dsi0_phy {
+	vdds-supply = <&vreg_l4a>;
+
+	status = "okay";
+};
+
+&mdss_dsi0_out {
+	data-lanes = <0 1 2 3>;
+	remote-endpoint = <&anx7625_1_in>;
+};
+
+&pcieport0 {
+	wifi@0 {
+		compatible = "qcom,wcn6855-wifi";
+		reg = <0x10000 0x0 0x0 0x0 0x0>;
+
+		vddrfacmn-supply = <&vreg_pmu_rfa_cmn>;
+		vddaon-supply = <&vreg_pmu_aon_0p59>;
+		vddwlcx-supply = <&vreg_pmu_wlcx_0p8>;
+		vddwlmx-supply = <&vreg_pmu_wlmx_0p85>;
+		vddrfa0p8-supply = <&vreg_pmu_rfa_0p8>;
+		vddrfa1p2-supply = <&vreg_pmu_rfa_1p2>;
+		vddrfa1p7-supply = <&vreg_pmu_rfa_1p7>;
+		vddpcie0p9-supply = <&vreg_pmu_pcie_0p9>;
+		vddpcie1p8-supply = <&vreg_pmu_pcie_1p8>;
+	};
+};
+
+&qupv3_id_0 {
+	status = "okay";
+};
+
+&qupv3_id_1 {
+	status = "okay";
+};
+
+&mdss {
+	status = "okay";
+};
+
+&mdss_dp0 {
+	status = "okay";
+};
+
+&mdss_dp_out {
+	data-lanes = <0 1 2 3>;
+	link-frequencies = /bits/ 64 <1620000000 2700000000 5400000000 8100000000>;
+};
+
+&mdss_edp_phy {
+	status = "okay";
+};
+
+&spmi_bus {
+	pmm8654au_2: pmic@2 {
+		compatible = "qcom,pmm8654au", "qcom,spmi-pmic";
+		reg = <2 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pmm8654au_2_gpios: gpio@8800 {
+			compatible = "qcom,pmm8654au-gpio", "qcom,spmi-gpio";
+			reg = <0x8800>;
+			gpio-controller;
+			gpio-ranges = <&pmm8654au_2_gpios 0 0 12>;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+};
+
+&tlmm {
+	bt_en_state: bt-en-state {
+		pins = "gpio55";
+		function = "normal";
+		output-low;
+		bias-pull-down;
+	};
+
+	dp_hot_plug_det: dp-hot-plug-det-state {
+		pins = "gpio94";
+		function = "edp0_hot";
+		bias-disable;
+	};
+
+	ethernet0_default: ethernet0-default-state {
+		ethernet0_mdc: ethernet0-mdc-pins {
+			pins = "gpio5";
+			function = "emac0_mdc";
+			drive-strength = <16>;
+			bias-pull-up;
+		};
+
+		ethernet0_mdio: ethernet0-mdio-pins {
+			pins = "gpio6";
+			function = "emac0_mdio";
+			drive-strength = <16>;
+			bias-pull-up;
+		};
+	};
+
+	io_expander_intr_active: io_expander_intr_active {
+		pins = "gpio93";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-disable;
+	};
+
+	io_expander_reset_active: io_expander_reset_active {
+		pins = "gpio66";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-disable;
+		output-high;
+	};
+
+	wlan_en_state: wlan-en-state {
+		pins = "gpio54";
+		function = "normal";
+		output-low;
+		bias-pull-up;
+	};
+};
+
+&remoteproc_adsp {
+	firmware-name = "qcom/qcs8300/adsp.mbn";
+	status = "okay";
+};
+
+&remoteproc_cdsp {
+	firmware-name = "qcom/qcs8300/cdsp0.mbn";
+	status = "okay";
+};
+
+&remoteproc_gpdsp {
+	firmware-name = "qcom/qcs8300/gpdsp0.mbn";
+	status = "okay";
+};
+
+&serdes0 {
+	phy-supply = <&vreg_l5a>;
+	status = "okay";
+};
+
+/* HS UART Instance */
+&uart2 {
+	status = "okay";
+	bluetooth: bluetooth {
+		compatible = "qcom,wcn6855-bt";
+		firmware-name = "QCA6698/hpnv21", "QCA6698/hpbtfw21.tlv";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&bt_en_state>;
+		enable-gpios = <&tlmm 55 GPIO_ACTIVE_HIGH>; /* BT_EN */
+
+		vddio-supply       = <&vreg_conn_pa>;         /* bt-vdd-ctrl1-supply */
+		vddbtcxmx-supply   = <&vreg_conn_1p8>;        /* bt-vdd-ctrl2-supply */
+		vddrfacmn-supply   = <&vreg_conn_1p8>;             /* bt-vdd-aon-supply, dummy */
+		vddrfa0p8-supply   = <&vreg_conn_1p8>;             /* bt-vdd-aon-supply, dummy */
+		vddrfa1p7-supply   = <&vreg_conn_1p8>;             /* bt-vdd-aon-supply, dummy */
+		vddrfa1p2-supply   = <&vreg_conn_1p8>;             /* bt-vdd-aon-supply, dummy */
+		//vddrfacmn-supply   = <&vreg_l2c>;             /* bt-vdd-aon-supply */
+		//vddrfa0p8-supply   = <&vreg_l2c>;             /* bt-vdd-rfa1-supply */
+		//vddrfa1p7-supply   = <&vreg_s5a>;             /* bt-vdd-rfa2-supply */
+		//vddrfa1p2-supply   = <&vreg_l6e>;             /* bt-vdd-rfa3-supply */
+		max-speed = <3200000>;
+	};
+};
+
+&tlmm {
+	pcie0_default_state: pcie0-default-state {
+		perst-pins {
+			pins = "gpio2";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+
+		clkreq-pins {
+			pins = "gpio1";
+			function = "pcie0_clkreq";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+
+		wake-pins {
+			pins = "gpio0";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	pcie1_default_state: pcie1-default-state {
+		perst-pins {
+			pins = "gpio23";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+
+		clkreq-pins {
+			pins = "gpio22";
+			function = "pcie1_clkreq";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+
+		wake-pins {
+			pins = "gpio21";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&pcie0 {
+	perst-gpios = <&tlmm 2 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_default_state>;
+
+	status = "okay";
+};
+
+&pcie1 {
+	perst-gpios = <&tlmm 23 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 21 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie1_default_state>;
+
+	status = "okay";
+};
+
+&pcie0_phy {
+	vdda-phy-supply = <&vreg_l6a>;
+	vdda-pll-supply = <&vreg_l5a>;
+
+	status = "okay";
+};
+
+&pcie1_phy {
+	vdda-phy-supply = <&vreg_l6a>;
+	vdda-pll-supply = <&vreg_l5a>;
+
+	status = "okay";
+};
+
+&uart7 {
+	status = "okay";
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 133 GPIO_ACTIVE_LOW>;
+	vcc-supply = <&vreg_l8a>;
+	vcc-max-microamp = <1100000>;
+	vccq-supply = <&vreg_l4c>;
+	vccq-max-microamp = <1200000>;
+	status = "okay";
+};
+
+&ufs_mem_phy {
+	vdda-phy-supply = <&vreg_l4a>;
+	vdda-pll-supply = <&vreg_l5a>;
+	status = "okay";
+};
+
+&pmm8654au_2_gpios {
+	usb1_en_state: usb1-en-state {
+		pins = "gpio7";
+		function = "normal";
+		output-high;
+		power-source = <0>;
+	};
+};
+
+&usb_qmpphy {
+	vdda-phy-supply = <&vreg_l7a>;
+	vdda-pll-supply = <&vreg_l5a>;
+
+	status = "okay";
+};
+
+&usb_1_hsphy {
+	vdda-pll-supply = <&vreg_l7a>;
+	vdda18-supply = <&vreg_l7c>;
+	vdda33-supply = <&vreg_l9a>;
+
+	status = "okay";
+};
+
+&usb_2_hsphy {
+	vdda-pll-supply = <&vreg_l7a>;
+	vdda18-supply = <&vreg_l7c>;
+	vdda33-supply = <&vreg_l9a>;
+
+	status = "okay";
+};
+
+&usb_1 {
+	status = "okay";
+};
+
+&usb_1_dwc3 {
+	snps,dis-u2-entry-quirk;
+	snps,dis-u1-entry-quirk;
+	snps,dis_u2_susphy_quirk;
+	snps,dis_u3_susphy_quirk;
+
+	dr_mode = "peripheral";
+};
+
+&usb_2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&usb1_en_state>;
+	status = "okay";
+};
+
+&usb_2_dwc3 {
+	dr_mode = "host";
+};
+
+&spi10 {
+	status = "okay";
+	spidev@0 {
+		compatible = "rohm,dh2228fv";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+		spi-cpha;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-video.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-video.dtsi
@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+&soc {
+	iris: video-codec@aa00000 {
+		compatible = "qcom,qcs8300-iris";
+
+		reg = <0 0x0aa00000 0 0xf0000>;
+		interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>;
+
+		power-domains = <&videocc VIDEO_CC_MVS0C_GDSC>,
+			<&videocc VIDEO_CC_MVS0_GDSC>,
+			<&rpmhpd QCS8300_MX>,
+			<&rpmhpd QCS8300_MMCX>;
+
+		power-domain-names = "iris-ctl", "vcodec", "mx", "mmcx";
+		operating-points-v2 = <&iris_opp_table>;
+
+		clocks = <&gcc GCC_VIDEO_AXI0_CLK>,
+				<&videocc VIDEO_CC_MVS0C_CLK>,
+				<&videocc VIDEO_CC_MVS0_CLK>;
+		clock-names = "gcc_video_axi0", "core_clk", "vcodec_clk";
+
+		interconnects =
+			<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+				&config_noc SLAVE_VENUS_CFG QCOM_ICC_TAG_ALWAYS>,
+			<&mmss_noc MASTER_VIDEO_P0 QCOM_ICC_TAG_ALWAYS
+				&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+		interconnect-names = "iris-cnoc", "iris-ddr";
+
+		/* FW load region */
+		memory-region = <&video_mem>;
+
+		resets = <&gcc GCC_VIDEO_AXI0_CLK_ARES>;
+		reset-names = "video_axi_reset";
+
+		status = "okay";
+
+		/* MMUs */
+		video_resv_region: video_resv_region {
+			iommu-addresses = <&non_secure_cb 0x0 0x0 0x0 0x25800000>,
+					<&non_secure_cb 0x0 0xe0000000 0x0 0x20000000>,
+					<&secure_non_pixel_cb 0x0 0x0 0x0 0x01000000>,
+					<&secure_non_pixel_cb 0x0 0x25800000 0x0 0xda800000>,
+					<&non_secure_pixel_cb 0x0 0x0 0x0 0x00100000>,
+					<&non_secure_pixel_cb 0x0 0xe0000000 0x0 0x20000000>;
+		};
+
+		non_secure_cb: non_secure_cb {
+			compatible = "qcom,vidc,cb-ns";
+			iommus = <&apps_smmu 0x0880 0x0400>;
+			memory-region = <&video_resv_region>;
+		};
+
+		secure_non_pixel_cb: secure_non_pixel_cb {
+			compatible = "qcom,vidc,cb-sec-non-pxl";
+			iommus = <&apps_smmu 0x0884 0x0400>;
+			memory-region = <&video_resv_region>;
+		};
+
+		non_secure_pixel_cb: non_secure_pixel_cb {
+			compatible = "qcom,vidc,cb-ns-pxl";
+			iommus = <&apps_smmu 0x0887 0x0400>;
+			memory-region = <&video_resv_region>;
+		};
+
+		iris_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-366000000 {
+				opp-hz = /bits/ 64 <366000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>,
+						<&rpmhpd_opp_svs_l1>;
+			};
+
+			opp-444000000 {
+				opp-hz = /bits/ 64 <444000000>;
+				required-opps = <&rpmhpd_opp_nom>,
+						<&rpmhpd_opp_nom>;
+			};
+
+			opp-533000000 {
+				opp-hz = /bits/ 64 <533000000>;
+				required-opps = <&rpmhpd_opp_turbo>,
+						<&rpmhpd_opp_turbo>;
+			};
+
+			opp-560000000 {
+				opp-hz = /bits/ 64 <560000000>;
+				required-opps = <&rpmhpd_opp_turbo_l1>,
+						<&rpmhpd_opp_turbo_l1>;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300-video.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300-video.dtso
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <dt-bindings/interconnect/qcom,icc.h>
+#include <dt-bindings/clock/qcom,qcs8300-gcc.h>
+#include <dt-bindings/interconnect/qcom,qcs8300-rpmh.h>
+#include <dt-bindings/clock/qcom,sa8775p-dispcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-videocc.h>
+#include "qcs8300-video.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8300.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8300.dtsi
@@ -0,0 +1,7899 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/clock/qcom,qcs8300-gcc.h>
+#include <dt-bindings/clock/qcom,rpmh.h>
+#include <dt-bindings/clock/qcom,sa8775p-camcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-dispcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-gpucc.h>
+#include <dt-bindings/clock/qcom,sa8775p-videocc.h>
+#include <dt-bindings/dma/qcom-gpi.h>
+#include <dt-bindings/firmware/qcom,scm.h>
+#include <dt-bindings/interconnect/qcom,icc.h>
+#include <dt-bindings/interconnect/qcom,qcs8300-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/mailbox/qcom-ipcc.h>
+#include <dt-bindings/power/qcom,rpmhpd.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <dt-bindings/soc/qcom,rpmh-rsc.h>
+#include <dt-bindings/soc/qcom,gpr.h>
+#include <dt-bindings/sound/qcom,q6dsp-lpass-ports.h>
+#include <dt-bindings/interconnect/qcom,osm-l3.h>
+
+/ {
+	interrupt-parent = <&intc>;
+
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	chosen { };
+
+	aliases {
+		i2c0 = &i2c0;
+		i2c1 = &i2c1;
+		i2c2 = &i2c2;
+		i2c3 = &i2c3;
+		i2c4 = &i2c4;
+		i2c5 = &i2c5;
+		i2c6 = &i2c6;
+		i2c8 = &i2c8;
+		i2c9 = &i2c9;
+		i2c10 = &i2c10;
+		i2c11 = &i2c11;
+		i2c12 = &i2c12;
+		i2c13 = &i2c13;
+		i2c14 = &i2c14;
+		i2c15 = &i2c15;
+		spi0 = &spi0;
+		spi1 = &spi1;
+		spi2 = &spi2;
+		spi3 = &spi3;
+		spi4 = &spi4;
+		spi5 = &spi5;
+		spi6 = &spi6;
+		spi8 = &spi8;
+		spi9 = &spi9;
+		spi10 = &spi10;
+		spi12 = &spi12;
+		spi13 = &spi13;
+		spi14 = &spi14;
+		spi15 = &spi15;
+		serial0 = &uart7;
+	};
+
+	audio-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+		device-name = "audio_etm0";
+
+		qcom,inst-id = <5>;
+		atid = <40>;
+
+		out-ports {
+			port {
+				audio_out: endpoint {
+					remote-endpoint =
+					<&lpi_funnel_in0>;
+				};
+			};
+		};
+	};
+
+	clocks {
+		xo_board: xo-board {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+			clock-frequency = <38400000>;
+		};
+
+		sleep_clk: sleep-clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+			clock-frequency = <32000>;
+		};
+	};
+
+	cpus {
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		CPU0: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a78c";
+			reg = <0x0 0x0>;
+			enable-method = "psci";
+			next-level-cache = <&L2_0>;
+			power-domains = <&CPU_PD0>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1946>;
+			dynamic-power-coefficient = <472>;
+			qcom,freq-domain = <&cpufreq_hw 0>;
+			operating-points-v2 = <&cpu0_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl0 MASTER_EPSS_L3_APPS
+					 &epss_l3_cl0 SLAVE_EPSS_L3_SHARED>;
+
+			L2_0: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_0>;
+
+				L3_0: l3-cache {
+					compatible = "cache";
+					cache-level = <3>;
+					cache-unified;
+				};
+			};
+		};
+
+		CPU1: cpu@100 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a78c";
+			reg = <0x0 0x100>;
+			enable-method = "psci";
+			next-level-cache = <&L2_1>;
+			power-domains = <&CPU_PD1>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1946>;
+			dynamic-power-coefficient = <472>;
+			qcom,freq-domain = <&cpufreq_hw 0>;
+			operating-points-v2 = <&cpu0_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl0 MASTER_EPSS_L3_APPS
+					 &epss_l3_cl0 SLAVE_EPSS_L3_SHARED>;
+
+			L2_1: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_0>;
+			};
+		};
+
+		CPU2: cpu@200 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a78c";
+			reg = <0x0 0x200>;
+			enable-method = "psci";
+			next-level-cache = <&L2_2>;
+			power-domains = <&CPU_PD2>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1946>;
+			dynamic-power-coefficient = <507>;
+			qcom,freq-domain = <&cpufreq_hw 1>;
+			operating-points-v2 = <&cpu2_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl0 MASTER_EPSS_L3_APPS
+					 &epss_l3_cl0 SLAVE_EPSS_L3_SHARED>;
+
+			L2_2: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_0>;
+			};
+		};
+
+		CPU3: cpu@300 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a78c";
+			reg = <0x0 0x300>;
+			enable-method = "psci";
+			next-level-cache = <&L2_3>;
+			power-domains = <&CPU_PD3>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1946>;
+			dynamic-power-coefficient = <507>;
+			qcom,freq-domain = <&cpufreq_hw 1>;
+			operating-points-v2 = <&cpu2_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl0 MASTER_EPSS_L3_APPS
+					 &epss_l3_cl0 SLAVE_EPSS_L3_SHARED>;
+
+			L2_3: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_0>;
+			};
+		};
+
+		CPU4: cpu@10000 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x10000>;
+			enable-method = "psci";
+			next-level-cache = <&L2_4>;
+			power-domains = <&CPU_PD4>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			qcom,freq-domain = <&cpufreq_hw 2>;
+			operating-points-v2 = <&cpu4_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl1 MASTER_EPSS_L3_APPS
+					 &epss_l3_cl1 SLAVE_EPSS_L3_SHARED>;
+
+			L2_4: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_1>;
+
+				L3_1: l3-cache {
+					compatible = "cache";
+					cache-level = <3>;
+					cache-unified;
+				};
+			};
+		};
+
+		CPU5: cpu@10100 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x10100>;
+			enable-method = "psci";
+			next-level-cache = <&L2_5>;
+			power-domains = <&CPU_PD5>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			qcom,freq-domain = <&cpufreq_hw 2>;
+			operating-points-v2 = <&cpu4_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl1 MASTER_EPSS_L3_APPS
+					 &epss_l3_cl1 SLAVE_EPSS_L3_SHARED>;
+
+			L2_5: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_1>;
+			};
+		};
+
+		CPU6: cpu@10200 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x10200>;
+			enable-method = "psci";
+			next-level-cache = <&L2_6>;
+			power-domains = <&CPU_PD6>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			qcom,freq-domain = <&cpufreq_hw 2>;
+			operating-points-v2 = <&cpu4_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl1 MASTER_EPSS_L3_APPS
+					 &epss_l3_cl1 SLAVE_EPSS_L3_SHARED>;
+
+			L2_6: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_1>;
+			};
+		};
+
+		CPU7: cpu@10300 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a55";
+			reg = <0x0 0x10300>;
+			enable-method = "psci";
+			next-level-cache = <&L2_7>;
+			power-domains = <&CPU_PD7>;
+			power-domain-names = "psci";
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			qcom,freq-domain = <&cpufreq_hw 2>;
+			operating-points-v2 = <&cpu4_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl1 MASTER_EPSS_L3_APPS
+					 &epss_l3_cl1 SLAVE_EPSS_L3_SHARED>;
+
+			L2_7: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_1>;
+			};
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&CPU0>;
+				};
+
+				core1 {
+					cpu = <&CPU1>;
+				};
+			};
+
+			cluster1 {
+				core0 {
+					cpu = <&CPU2>;
+				};
+
+				core1 {
+					cpu = <&CPU3>;
+				};
+			};
+
+			cluster2 {
+				core0 {
+					cpu = <&CPU4>;
+				};
+
+				core1 {
+					cpu = <&CPU5>;
+				};
+
+				core2 {
+					cpu = <&CPU6>;
+				};
+
+				core3 {
+					cpu = <&CPU7>;
+				};
+			};
+		};
+
+		idle-states {
+			entry-method = "psci";
+
+			LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 {
+				compatible = "arm,idle-state";
+				idle-state-name = "silver-power-collapse";
+				arm,psci-suspend-param = <0x40000003>;
+				entry-latency-us = <449>;
+				exit-latency-us = <801>;
+				min-residency-us = <1574>;
+				local-timer-stop;
+			};
+
+			LITTLE_CPU_SLEEP_1: cpu-sleep-0-1 {
+				compatible = "arm,idle-state";
+				idle-state-name = "silver-rail-power-collapse";
+				arm,psci-suspend-param = <0x40000004>;
+				entry-latency-us = <602>;
+				exit-latency-us = <961>;
+				min-residency-us = <4288>;
+				local-timer-stop;
+			};
+
+			BIG_CPU_SLEEP_0: cpu-sleep-1-0 {
+				compatible = "arm,idle-state";
+				idle-state-name = "gold-power-collapse";
+				arm,psci-suspend-param = <0x40000003>;
+				entry-latency-us = <549>;
+				exit-latency-us = <901>;
+				min-residency-us = <1774>;
+				local-timer-stop;
+			};
+
+			BIG_CPU_SLEEP_1: cpu-sleep-1-1 {
+				compatible = "arm,idle-state";
+				idle-state-name = "gold-rail-power-collapse";
+				arm,psci-suspend-param = <0x40000004>;
+				entry-latency-us = <702>;
+				exit-latency-us = <1061>;
+				min-residency-us = <4488>;
+				local-timer-stop;
+			};
+		};
+
+		domain-idle-states {
+			SILVER_CLUSTER_SLEEP: cluster-sleep-0 {
+				compatible = "domain-idle-state";
+				arm,psci-suspend-param = <0x41000044>;
+				entry-latency-us = <2552>;
+				exit-latency-us = <2848>;
+				min-residency-us = <5908>;
+			};
+
+			GOLD_CLUSTER_SLEEP: cluster-sleep-1 {
+				compatible = "domain-idle-state";
+				arm,psci-suspend-param = <0x41000044>;
+				entry-latency-us = <2752>;
+				exit-latency-us = <3048>;
+				min-residency-us = <6118>;
+			};
+
+			SYSTEM_SLEEP: domain-sleep {
+				compatible = "domain-idle-state";
+				arm,psci-suspend-param = <0x42000144>;
+				entry-latency-us = <3263>;
+				exit-latency-us = <6562>;
+				min-residency-us = <9987>;
+			};
+		};
+	};
+
+	cpu0_opp_table: opp-table-cpu0 {
+		compatible = "operating-points-v2";
+		opp-shared;
+
+		cpu0_opp_1190mhz: opp-1190400000 {
+			opp-hz = /bits/ 64 <1190400000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu0_opp_1267mhz: opp-1267200000 {
+			opp-hz = /bits/ 64 <1267200000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu0_opp_1344mhz: opp-1344000000 {
+			opp-hz = /bits/ 64 <1344000000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu0_opp_1420mhz: opp-1420800000 {
+			opp-hz = /bits/ 64 <1420800000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu0_opp_1497mhz: opp-1497600000 {
+			opp-hz = /bits/ 64 <1497600000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_1574mhz: opp-1574400000 {
+			opp-hz = /bits/ 64 <1574400000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_1670mhz: opp-1670400000 {
+			opp-hz = /bits/ 64 <1670400000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_1747mhz: opp-1747200000 {
+			opp-hz = /bits/ 64 <1747200000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_1824mhz: opp-1824000000 {
+			opp-hz = /bits/ 64 <1824000000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_1900mhz: opp-1900800000 {
+			opp-hz = /bits/ 64 <1900800000>;
+			opp-peak-kBps = <8371200 47318400>;
+		};
+
+		cpu0_opp_1977mhz: opp-1977600000 {
+			opp-hz = /bits/ 64 <1977600000>;
+			opp-peak-kBps = <8371200 47318400>;
+		};
+
+		cpu0_opp_2054mhz: opp-2054400000 {
+			opp-hz = /bits/ 64 <2054400000>;
+			opp-peak-kBps = <8371200 47318400>;
+		};
+
+		cpu0_opp_2112mhz: opp-2112000000 {
+			opp-hz = /bits/ 64 <2112000000>;
+			opp-peak-kBps = <12787200 51609600>;
+		};
+	};
+
+	cpu2_opp_table: opp-table-cpu2 {
+		compatible = "operating-points-v2";
+		opp-shared;
+
+		cpu2_opp_1267mhz: opp-1267200000 {
+			opp-hz = /bits/ 64 <1267200000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu2_opp_1344mhz: opp-1344000000 {
+			opp-hz = /bits/ 64 <1344000000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu2_opp_1420mhz: opp-1420800000 {
+			opp-hz = /bits/ 64 <1420800000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu2_opp_1497mhz: opp-1497600000 {
+			opp-hz = /bits/ 64 <1497600000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu2_opp_1574mhz: opp-1574400000 {
+			opp-hz = /bits/ 64 <1574400000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu2_opp_1632mhz: opp-1632000000 {
+			opp-hz = /bits/ 64 <1632000000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu2_opp_1708mhz: opp-1708800000 {
+			opp-hz = /bits/ 64 <1708800000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu2_opp_1804mhz: opp-1804800000 {
+			opp-hz = /bits/ 64 <1804800000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu2_opp_1900mhz: opp-1900800000 {
+			opp-hz = /bits/ 64 <1900800000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu2_opp_1977mhz: opp-1977600000 {
+			opp-hz = /bits/ 64 <1977600000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu2_opp_2054mhz: opp-2054400000 {
+			opp-hz = /bits/ 64 <2054400000>;
+			opp-peak-kBps = <8371200 47318400>;
+		};
+
+		cpu2_opp_2131mhz: opp-2131200000 {
+			opp-hz = /bits/ 64 <2131200000>;
+			opp-peak-kBps = <8371200 47318400>;
+		};
+
+		cpu2_opp_2208mhz: opp-2208000000 {
+			opp-hz = /bits/ 64 <2208000000>;
+			opp-peak-kBps = <8371200 47318400>;
+		};
+
+		cpu2_opp_2284mhz: opp-2284800000 {
+			opp-hz = /bits/ 64 <2284800000>;
+			opp-peak-kBps = <8371200 47318400>;
+		};
+
+		cpu2_opp_2361mhz: opp-2361600000 {
+			opp-hz = /bits/ 64 <2361600000>;
+			opp-peak-kBps = <12787200 51609600>;
+		};
+	};
+
+	cpu4_opp_table: opp-table-cpu4 {
+		compatible = "operating-points-v2";
+		opp-shared;
+
+		cpu4_opp_1113mhz: opp-1113600000 {
+			opp-hz = /bits/ 64 <1113600000>;
+			opp-peak-kBps = <3072000 29491200>;
+		};
+
+		cpu4_opp_1209mhz: opp-1209600000 {
+			opp-hz = /bits/ 64 <1209600000>;
+			opp-peak-kBps = <3072000 29491200>;
+		};
+
+		cpu4_opp_1305mhz: opp-1305600000 {
+			opp-hz = /bits/ 64 <1305600000>;
+			opp-peak-kBps = <3072000 29491200>;
+		};
+
+		cpu4_opp_1382mhz: opp-1382400000 {
+			opp-hz = /bits/ 64 <1382400000>;
+			opp-peak-kBps = <3072000 29491200>;
+		};
+
+		cpu4_opp_1459mhz: opp-1459200000 {
+			opp-hz = /bits/ 64 <14592000000>;
+			opp-peak-kBps = <5414400 39321600>;
+		};
+
+		cpu4_opp_1497mhz: opp-1497600000 {
+			opp-hz = /bits/ 64 <1497600000>;
+			opp-peak-kBps = <5414400 39321600>;
+		};
+
+		cpu4_opp_1574mhz: opp-1574400000 {
+			opp-hz = /bits/ 64 <1574400000>;
+			opp-peak-kBps = <5414400 39321600>;
+		};
+
+		cpu4_opp_1651mhz: opp-1651200000 {
+			opp-hz = /bits/ 64 <1651200000>;
+			opp-peak-kBps = <5414400 39321600>;
+		};
+
+		cpu4_opp_1728mhz: opp-1728000000 {
+			opp-hz = /bits/ 64 <1728000000>;
+			opp-peak-kBps = <5414400 39321600>;
+		};
+
+		cpu4_opp_1804mhz: opp-1804800000 {
+			opp-hz = /bits/ 64 <1804800000>;
+			opp-peak-kBps = <6835200 47318400>;
+		};
+
+		cpu4_opp_1881mhz: opp-1881600000 {
+			opp-hz = /bits/ 64 <1881600000>;
+			opp-peak-kBps = <6835200 47318400>;
+		};
+
+		cpu4_opp_1958mhz: opp-1958400000 {
+			opp-hz = /bits/ 64 <1958400000>;
+			opp-peak-kBps = <8371200 51609600>;
+		};
+	};
+
+	dummy_eud: dummy-sink {
+		compatible = "arm,coresight-dummy-sink";
+		device-name = "eud";
+
+		in-ports {
+			port {
+				eud_in: endpoint {
+					remote-endpoint =
+					<&swao_rep_out1>;
+				};
+			};
+		};
+	};
+
+	firmware {
+		scm: scm {
+			compatible = "qcom,scm-qcs8300", "qcom,scm";
+			qcom,dload-mode = <&tcsr 0x13000>;
+		};
+	};
+
+	memory@80000000 {
+		device_type = "memory";
+		/* We expect the bootloader to fill in the size */
+		reg = <0x0 0x80000000 0x0 0x0>;
+	};
+
+	pmu-a55 {
+		compatible = "arm,cortex-a55-pmu";
+		interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
+	};
+
+	pmu-a78 {
+		compatible = "arm,cortex-a78-pmu";
+		interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
+	};
+
+	psci {
+		compatible = "arm,psci-1.0";
+		method = "smc";
+		mode-bootloader = <0x10001 0x2>;
+		mode-edl = <0x0 0x1>;
+
+		CPU_PD0: power-domain-cpu0 {
+			#power-domain-cells = <0>;
+			power-domains = <&CLUSTER_PD0>;
+			domain-idle-states = <&BIG_CPU_SLEEP_0 &BIG_CPU_SLEEP_1>;
+		};
+
+		CPU_PD1: power-domain-cpu1 {
+			#power-domain-cells = <0>;
+			power-domains = <&CLUSTER_PD0>;
+			domain-idle-states = <&BIG_CPU_SLEEP_0 &BIG_CPU_SLEEP_1>;
+		};
+
+		CPU_PD2: power-domain-cpu2 {
+			#power-domain-cells = <0>;
+			power-domains = <&CLUSTER_PD0>;
+			domain-idle-states = <&BIG_CPU_SLEEP_0 &BIG_CPU_SLEEP_1>;
+		};
+
+		CPU_PD3: power-domain-cpu3 {
+			#power-domain-cells = <0>;
+			power-domains = <&CLUSTER_PD0>;
+			domain-idle-states = <&BIG_CPU_SLEEP_0 &BIG_CPU_SLEEP_1>;
+		};
+
+		CPU_PD4: power-domain-cpu4 {
+			#power-domain-cells = <0>;
+			power-domains = <&CLUSTER_PD1>;
+			domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>;
+		};
+
+		CPU_PD5: power-domain-cpu5 {
+			#power-domain-cells = <0>;
+			power-domains = <&CLUSTER_PD1>;
+			domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>;
+		};
+
+		CPU_PD6: power-domain-cpu6 {
+			#power-domain-cells = <0>;
+			power-domains = <&CLUSTER_PD1>;
+			domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>;
+		};
+
+		CPU_PD7: power-domain-cpu7 {
+			#power-domain-cells = <0>;
+			power-domains = <&CLUSTER_PD1>;
+			domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>;
+		};
+
+		CLUSTER_PD0: power-domain-cluster0 {
+			#power-domain-cells = <0>;
+			power-domains = <&SYSTEM_PD>;
+			domain-idle-states = <&GOLD_CLUSTER_SLEEP>;
+		};
+
+		CLUSTER_PD1: power-domain-cluster1 {
+			#power-domain-cells = <0>;
+			power-domains = <&SYSTEM_PD>;
+			domain-idle-states = <&SILVER_CLUSTER_SLEEP>;
+		};
+
+		SYSTEM_PD: power-domain-system {
+			#power-domain-cells = <0>;
+			domain-idle-states = <&SYSTEM_SLEEP>;
+		};
+	};
+
+	aggre1_noc: interconnect-aggre1-noc {
+		compatible = "qcom,qcs8300-aggre1-noc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	aggre2_noc: interconnect-aggre2-noc {
+		compatible = "qcom,qcs8300-aggre2-noc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	clk_virt: interconnect-clk-virt {
+		compatible = "qcom,qcs8300-clk-virt";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	config_noc: interconnect-config-noc {
+		compatible = "qcom,qcs8300-config-noc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	dc_noc: interconnect-dc-noc {
+		compatible = "qcom,qcs8300-dc-noc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	gem_noc: interconnect-gem-noc {
+		compatible = "qcom,qcs8300-gem-noc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	gpdsp_anoc: interconnect-gpdsp-anoc {
+		compatible = "qcom,qcs8300-gpdsp-anoc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	lpass_ag_noc: interconnect-lpass-ag-noc {
+		compatible = "qcom,qcs8300-lpass-ag-noc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	mc_virt: interconnect-mc-virt {
+		compatible = "qcom,qcs8300-mc-virt";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	mmss_noc: interconnect-mmss-noc {
+		compatible = "qcom,qcs8300-mmss-noc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	nspa_noc: interconnect-nspa-noc {
+		compatible = "qcom,qcs8300-nspa-noc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	pcie_anoc: interconnect-pcie-anoc {
+		compatible = "qcom,qcs8300-pcie-anoc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	system_noc: interconnect-system-noc {
+		compatible = "qcom,qcs8300-system-noc";
+		#interconnect-cells = <2>;
+		qcom,bcm-voters = <&apps_bcm_voter>;
+	};
+
+	qup_opp_table: opp-table-qup {
+		compatible = "operating-points-v2";
+
+		opp-120000000 {
+			opp-hz = /bits/ 64 <120000000>;
+			required-opps = <&rpmhpd_opp_svs_l1>;
+		};
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		sail_ss_mem: sail-ss-region@80000000 {
+			reg = <0x0 0x80000000 0x0 0x10000000>;
+			no-map;
+		};
+
+		hyp_mem: hyp-region@90000000 {
+			reg = <0x0 0x90000000 0x0 0x600000>;
+			no-map;
+		};
+
+		xbl_boot_mem: xbl-boot-region@90600000 {
+			reg = <0x0 0x90600000 0x0 0x200000>;
+			no-map;
+		};
+
+		aop_image_mem: aop-image-region@90800000 {
+			reg = <0x0 0x90800000 0x0 0x60000>;
+			no-map;
+		};
+
+		aop_cmd_db_mem: aop-cmd-db-region@90860000 {
+			compatible = "qcom,cmd-db";
+			reg = <0x0 0x90860000 0x0 0x20000>;
+			no-map;
+		};
+
+		uefi_logs_mem: uefi-logs-region@908b0000 {
+			reg = <0x0 0x908b0000 0x0 0x10000>;
+			no-map;
+		};
+
+		ddr_training_checksum_data_mem: ddr-training-checksum-data-region@908c0000 {
+			reg = <0x0 0x908c0000 0x0 0x1000>;
+			no-map;
+		};
+
+		reserved_mem: reserved-region@908f0000 {
+			reg = <0x0 0x908f0000 0x0 0xe000>;
+			no-map;
+		};
+
+		secboot_emulation_mem: secboot-emulation-region@908fe000 {
+			reg = <0x0 0x908fe000 0x0 0x2000>;
+			no-map;
+		};
+
+		smem_mem: smem@90900000 {
+			compatible = "qcom,smem";
+			reg = <0x0 0x90900000 0x0 0x200000>;
+			no-map;
+			hwlocks = <&tcsr_mutex 3>;
+		};
+
+		tz_sail_mailbox_mem: tz-sail-mailbox-region@90c00000 {
+			reg = <0x0 0x90c00000 0x0 0x100000>;
+			no-map;
+		};
+
+		sail_mailbox_mem: sail-mailbox-region@90d00000 {
+			reg = <0x0 0x90d00000 0x0 0x100000>;
+			no-map;
+		};
+
+		sail_ota_mem: sail-ota-region@90e00000 {
+			reg = <0x0 0x90e00000 0x0 0x300000>;
+			no-map;
+		};
+
+		xbl_dtlog_mem: xbl-dtlog-region@91a40000 {
+			reg = <0x0 0x91a40000 0x0 0x40000>;
+			no-map;
+		};
+
+		gunyah_md_mem: gunyah-md-region@91a80000 {
+			reg = <0x0 0x91a80000 0x0 0x80000>;
+			no-map;
+		};
+
+		aoss_backup_mem: aoss-backup-region@91b00000 {
+			reg = <0x0 0x91b00000 0x0 0x40000>;
+			no-map;
+		};
+
+		cpucp_backup_mem: cpucp-backup-region@91b40000 {
+			reg = <0x0 0x91b40000 0x0 0x40000>;
+			no-map;
+		};
+
+		tz_config_backup_mem: tz-config-backup-region@91b80000 {
+			reg = <0x0 0x91b80000 0x0 0x10000>;
+			no-map;
+		};
+
+		ddr_training_data_mem: ddr-training-data-region@91b90000 {
+			reg = <0x0 0x91b90000 0x0 0x10000>;
+			no-map;
+		};
+
+		cdt_data_backup_mem: cdt-data-backup-region@91ba0000 {
+			reg = <0x0 0x91ba0000 0x0 0x1000>;
+			no-map;
+		};
+
+		tzffi_mem: tzffi-region@91c00000 {
+			reg = <0x0 0x91c00000 0x0 0x1400000>;
+			no-map;
+		};
+
+		lpass_machine_learning_mem: lpass-machine-learning-region@93b00000 {
+			reg = <0x0 0x93b00000 0x0 0xf00000>;
+			no-map;
+		};
+
+		adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap-region@94a00000 {
+			reg = <0x0 0x94a00000 0x0 0x800000>;
+			no-map;
+		};
+
+		camera_mem: pil-camera-region@95200000 {
+			reg = <0x0 0x95200000 0x0 0x700000>;
+			no-map;
+		};
+
+		adsp_mem: pil-adsp-region@95c00000 {
+			no-map;
+			reg = <0x0 0x95c00000 0x0 0x1e00000>;
+		};
+
+		q6_adsp_dtb_mem: q6-adsp-dtb-region@97a00000 {
+			reg = <0x0 0x97a00000 0x0 0x80000>;
+			no-map;
+		};
+
+		q6_gpdsp_dtb_mem: q6-gpdsp-dtb-region@97a80000 {
+			reg = <0x0 0x97a80000 0x0 0x80000>;
+			no-map;
+		};
+
+		gpdsp_mem: pil-gpdsp-region@97b00000 {
+			reg = <0x0 0x97b00000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		q6_cdsp_dtb_mem: q6-cdsp-dtb-region@9b700000 {
+			reg = <0x0 0x9b700000 0x0 0x80000>;
+			no-map;
+		};
+
+		cdsp_mem: pil_cdsp-region@99900000 {
+			reg = <0x0 0x99900000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		gpu_microcode_mem: pil-gpu-region@9b780000 {
+			reg = <0x0 0x9b780000 0x0 0x2000>;
+			no-map;
+		};
+
+		cvp_mem: pil-cvp-region@9b782000 {
+			reg = <0x0 0x9b782000 0x0 0x700000>;
+			no-map;
+		};
+
+		video_mem: pil-video-region@9be82000 {
+			reg = <0x0 0x9be82000 0x0 0x700000>;
+			no-map;
+		};
+
+		audio_mdf_mem: audio-mdf-region@ae000000 {
+			reg = <0x0 0xae000000 0x0 0x1000000>;
+			no-map;
+		};
+
+		firmware_mem: firmware-region@b0000000 {
+			reg = <0x0 0xb0000000 0x0 0x800000>;
+			no-map;
+		};
+
+		hyptz_reserved_mem: hyptz-reserved@beb00000 {
+			reg = <0x0 0xbeb00000 0x0 0x11500000>;
+			no-map;
+		};
+
+		firmware_scmi_mem: scmi-region@d0000000 {
+			reg = <0x0 0xd0000000 0x0 0x40000>;
+			no-map;
+		};
+
+		firmware_logs_mem: firmware-logs-region@d0040000 {
+			reg = <0x0 0xd0040000 0x0 0x10000>;
+			no-map;
+		};
+
+		firmware_audio_mem: firmware-audio-region@d0050000 {
+			reg = <0x0 0xd0050000 0x0 0x4000>;
+			no-map;
+		};
+
+		firmware_reserved_mem: firmware-reserved@d0054000 {
+			reg = <0x0 0xd0054000 0x0 0x9c000>;
+			no-map;
+		};
+
+		firmwarequantum_test_mem: firmwarequantum-test-region@d00f0000 {
+			reg = <0x0 0xd00f0000 0x0 0x10000>;
+			no-map;
+		};
+
+		tags_mem: tags-region@d0100000 {
+			reg = <0x0 0xd0100000 0x0 0x800000>;
+			no-map;
+		};
+
+		qtee_mem: qtee-region@d1300000 {
+			reg = <0x0 0xd1300000 0x0 0x500000>;
+			no-map;
+		};
+
+		deep_sleep_back_up_mem: deep-sleep-back-up-region@d1800000 {
+			reg = <0x0 0xd1800000 0x0 0x100000>;
+			no-map;
+		};
+
+		trusted_apps_mem: trusted-apps-region@d1900000 {
+			reg = <0x0 0xd1900000 0x0 0x1900000>;
+			no-map;
+		};
+
+		tz_stat_mem: tz-stat-region@db100000 {
+			reg = <0x0 0xdb100000 0x0 0x100000>;
+			no-map;
+		};
+
+		cpucp_fw_mem: cpucp-fw-region@db200000 {
+			reg = <0x0 0xdb200000 0x0 0x100000>;
+			no-map;
+		};
+
+		cdsp_secure_heap: secure-cdsp-region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x2000000>;
+		};
+	};
+
+	smp2p-adsp {
+		compatible = "qcom,smp2p";
+		qcom,smem = <443>, <429>;
+		interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+					     IPCC_MPROC_SIGNAL_SMP2P
+					     IRQ_TYPE_EDGE_RISING>;
+		mboxes = <&ipcc IPCC_CLIENT_LPASS
+				IPCC_MPROC_SIGNAL_SMP2P>;
+
+		qcom,local-pid = <0>;
+		qcom,remote-pid = <2>;
+
+		smp2p_adsp_out: master-kernel {
+			qcom,entry-name = "master-kernel";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_adsp_in: slave-kernel {
+			qcom,entry-name = "slave-kernel";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		smp2p_rdbg2_out: smp2p-rdbg2-out {
+			qcom,entry-name = "rdbg";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_rdbg2_in: smp2p-rdbg2-in {
+			qcom,entry-name = "rdbg";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	smp2p-cdsp {
+		compatible = "qcom,smp2p";
+		qcom,smem = <94>, <432>;
+		interrupts-extended = <&ipcc IPCC_CLIENT_CDSP
+					     IPCC_MPROC_SIGNAL_SMP2P
+					     IRQ_TYPE_EDGE_RISING>;
+		mboxes = <&ipcc IPCC_CLIENT_CDSP
+				IPCC_MPROC_SIGNAL_SMP2P>;
+
+		qcom,local-pid = <0>;
+		qcom,remote-pid = <5>;
+
+		smp2p_cdsp_out: master-kernel {
+			qcom,entry-name = "master-kernel";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_cdsp_in: slave-kernel {
+			qcom,entry-name = "slave-kernel";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		smp2p_rdbg5_out: smp2p-rdbg5-out {
+			qcom,entry-name = "rdbg";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_rdbg5_in: smp2p-rdbg5-in {
+			qcom,entry-name = "rdbg";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	smp2p-gpdsp {
+		compatible = "qcom,smp2p";
+		qcom,smem = <617>, <616>;
+		interrupts-extended = <&ipcc IPCC_CLIENT_GPDSP0
+					     IPCC_MPROC_SIGNAL_SMP2P
+					     IRQ_TYPE_EDGE_RISING>;
+		mboxes = <&ipcc IPCC_CLIENT_GPDSP0
+				IPCC_MPROC_SIGNAL_SMP2P>;
+
+		qcom,local-pid = <0>;
+		qcom,remote-pid = <17>;
+
+		smp2p_gpdsp_out: master-kernel {
+			qcom,entry-name = "master-kernel";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_gpdsp_in: slave-kernel {
+			qcom,entry-name = "slave-kernel";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	qcom-smp2p-interrupt-rdbg-2-in {
+		compatible = "qcom,smp2p-interrupt-rdbg-2-in";
+		interrupts-extended = <&smp2p_rdbg2_in 0 IRQ_TYPE_NONE>;
+		interrupt-names = "rdbg-smp2p-in";
+	};
+
+	qcom-smp2p-interrupt-rdbg-2-out {
+		compatible = "qcom,smp2p-interrupt-rdbg-2-out";
+		qcom,smem-states = <&smp2p_rdbg2_out 0>;
+		qcom,smem-state-names = "rdbg-smp2p-out";
+	};
+
+	qcom-smp2p-interrupt-rdbg-5-in {
+		compatible = "qcom,smp2p-interrupt-rdbg-5-in";
+		interrupts-extended = <&smp2p_rdbg5_in 0 IRQ_TYPE_NONE>;
+		interrupt-names = "rdbg-smp2p-in";
+	};
+
+	qcom-smp2p-interrupt-rdbg-5-out {
+		compatible = "qcom,smp2p-interrupt-rdbg-5-out";
+		qcom,smem-states = <&smp2p_rdbg5_out 0>;
+		qcom,smem-state-names = "rdbg-smp2p-out";
+	};
+
+	soc: soc@0 {
+		compatible = "simple-bus";
+		ranges = <0 0 0 0 0x10 0>;
+		#address-cells = <2>;
+		#size-cells = <2>;
+
+		ethernet0: ethernet@23040000 {
+			compatible = "qcom,qcs8300-ethqos";
+			reg = <0x0 0x23040000 0x0 0x10000>,
+			      <0x0 0x23056000 0x0 0x100>;
+			reg-names = "stmmaceth", "rgmii";
+
+			interrupts = <GIC_SPI 946 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 783 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "macirq", "sfty";
+
+			clocks = <&gcc GCC_EMAC0_AXI_CLK>,
+				 <&gcc GCC_EMAC0_SLV_AHB_CLK>,
+				 <&gcc GCC_EMAC0_PTP_CLK>,
+				 <&gcc GCC_EMAC0_PHY_AUX_CLK>;
+			clock-names = "stmmaceth",
+				      "pclk",
+				      "ptp_ref",
+				      "phyaux";
+			power-domains = <&gcc GCC_EMAC0_GDSC>;
+
+			phys = <&serdes0>;
+			phy-names = "serdes";
+
+			iommus = <&apps_smmu 0x120 0xf>;
+			dma-coherent;
+
+			snps,tso;
+			snps,pbl = <32>;
+			rx-fifo-depth = <16384>;
+			tx-fifo-depth = <20480>;
+
+			status = "disabled";
+		};
+
+		gcc: clock-controller@100000 {
+			compatible = "qcom,qcs8300-gcc";
+			reg = <0x0 0x00100000 0x0 0xc7018>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+			clocks = <&rpmhcc RPMH_CXO_CLK>,
+				 <&sleep_clk>,
+				 <&pcie0_phy>,
+				 <&pcie1_phy>,
+				 <0>,
+				 <0>,
+				 <0>,
+				 <0>,
+				 <0>,
+				 <0>;
+		};
+
+		ipcc: mailbox@408000 {
+			compatible = "qcom,qcs8300-ipcc", "qcom,ipcc";
+			reg = <0x0 0x408000 0x0 0x1000>;
+			interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			#mbox-cells = <2>;
+		};
+
+		qfprom: efuse@784000 {
+			compatible = "qcom,qcs8300-qfprom", "qcom,qfprom";
+			reg = <0x0 0x00784000 0x0 0x11d0>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+		};
+
+		gpi_dma0: qcom,gpi-dma@900000 {
+			compatible = "qcom,sm6350-gpi-dma";
+			#dma-cells = <3>;
+			reg = <0x0 0x900000 0x0 0x60000>;
+			interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 246 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 247 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 248 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 250 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 251 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 252 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 253 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 254 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 255 IRQ_TYPE_LEVEL_HIGH>;
+			iommus = <&apps_smmu 0x416 0x0>;
+			dma-channels = <12>;
+			dma-channel-mask = <0xfff>;
+			dma-coherent;
+			status = "ok";
+		};
+
+		qupv3_id_0: geniqup@9c0000 {
+			compatible = "qcom,geni-se-qup";
+			reg = <0x0 0x9c0000 0x0 0x2000>;
+			ranges;
+			clocks = <&gcc GCC_QUPV3_WRAP_0_M_AHB_CLK>,
+				 <&gcc GCC_QUPV3_WRAP_0_S_AHB_CLK>;
+			clock-names = "m-ahb", "s-ahb";
+			#address-cells = <2>;
+			#size-cells = <2>;
+			iommus = <&apps_smmu 0x403 0x0>;
+			dma-coherent;
+			status = "disabled";
+
+			i2c0: i2c@980000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S0_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c0_data_clk>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>,
+				<&aggre2_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma0 0 0 QCOM_GPI_I2C>,
+					<&gpi_dma0 1 0 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi0: spi@980000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S0_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi0_data_clk>, <&qup_spi0_cs>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma0 0 0 QCOM_GPI_SPI>,
+					<&gpi_dma0 1 0 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart0: serial@980000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S0_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart0_cts>, <&qup_uart0_rts>,
+					    <&qup_uart0_tx>, <&qup_uart0_rx>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c1: i2c@984000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S1_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c1_data_clk>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>,
+				<&aggre2_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma0 0 1 QCOM_GPI_I2C>,
+					<&gpi_dma0 1 1 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi1: spi@984000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S1_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi1_data_clk>, <&qup_spi1_cs>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma0 0 1 QCOM_GPI_SPI>,
+					<&gpi_dma0 1 1 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart1: serial@984000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S1_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart1_cts>, <&qup_uart1_rts>,
+					    <&qup_uart1_tx>, <&qup_uart1_rx>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c2: i2c@988000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S2_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c2_data_clk>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>,
+				<&aggre2_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma0 0 2 QCOM_GPI_I2C>,
+					<&gpi_dma0 1 2 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi2: spi@988000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S2_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi2_data_clk>, <&qup_spi2_cs>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma0 0 2 QCOM_GPI_SPI>,
+					<&gpi_dma0 1 2 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart2: serial@988000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S2_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart2_cts>, <&qup_uart2_rts>,
+					    <&qup_uart2_tx>, <&qup_uart2_rx>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c3: i2c@98c000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S3_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c3_data_clk>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>,
+				<&aggre2_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma0 0 3 QCOM_GPI_I2C>,
+					<&gpi_dma0 1 3 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi3: spi@98c000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S3_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi3_data_clk>, <&qup_spi3_cs>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma0 0 3 QCOM_GPI_SPI>,
+					<&gpi_dma0 1 3 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart3: serial@98c000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S3_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart3_cts>, <&qup_uart3_rts>,
+					    <&qup_uart3_tx>, <&qup_uart3_rx>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c4: i2c@990000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S4_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c4_data_clk>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>,
+				<&aggre2_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma0 0 4 QCOM_GPI_I2C>,
+					<&gpi_dma0 1 4 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi4: spi@990000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S4_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi4_data_clk>, <&qup_spi4_cs>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma0 0 4 QCOM_GPI_SPI>,
+					<&gpi_dma0 1 4 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart4: serial@990000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S4_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart4_cts>, <&qup_uart4_rts>,
+					    <&qup_uart4_tx>, <&qup_uart4_rx>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c5: i2c@994000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x994000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S5_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c5_data_clk>;
+				interrupts = <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>,
+				<&aggre2_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma0 0 5 QCOM_GPI_I2C>,
+					<&gpi_dma0 1 5 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi5: spi@994000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0x994000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S5_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi5_data_clk>, <&qup_spi5_cs>;
+				interrupts = <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma0 0 5 QCOM_GPI_SPI>,
+					<&gpi_dma0 1 5 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart5: serial@994000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x994000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S5_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart5_cts>, <&qup_uart5_rts>,
+					    <&qup_uart5_tx>, <&qup_uart5_rx>;
+				interrupts = <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c6: i2c@998000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0x998000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S6_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c6_data_clk>;
+				interrupts = <GIC_SPI 536 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>,
+				<&aggre2_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma0 0 6 QCOM_GPI_I2C>,
+					<&gpi_dma0 1 6 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi6: spi@998000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0x998000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S6_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi6_data_clk>, <&qup_spi6_cs>;
+				interrupts = <GIC_SPI 536 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma0 0 6 QCOM_GPI_SPI>,
+					<&gpi_dma0 1 6 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart6: serial@998000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x998000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S6_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart6_cts>, <&qup_uart6_rts>,
+					    <&qup_uart6_tx>, <&qup_uart6_rx>;
+				interrupts = <GIC_SPI 536 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			uart7: serial@99c000 {
+				compatible = "qcom,geni-debug-uart";
+				reg = <0x0 0x0099c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S7_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart7_tx>, <&qup_uart7_rx>;
+				interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_0 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+		};
+
+		gpi_dma1: qcom,gpi-dma@a00000 {
+			compatible = "qcom,sm6350-gpi-dma";
+			#dma-cells = <3>;
+			reg = <0x0 0xa00000 0x0 0x60000>;
+			interrupts = <GIC_SPI 279 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 280 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 283 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 284 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 293 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 294 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 295 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 296 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 298 IRQ_TYPE_LEVEL_HIGH>;
+			iommus = <&apps_smmu 0x456 0x0>;
+			dma-channels = <12>;
+			dma-channel-mask = <0xfff>;
+			dma-coherent;
+			status = "ok";
+		};
+
+		qupv3_id_1: geniqup@ac0000 {
+			compatible = "qcom,geni-se-qup";
+			reg = <0x0 0xac0000 0x0 0x2000>;
+			ranges;
+			clocks = <&gcc GCC_QUPV3_WRAP_1_M_AHB_CLK>,
+				 <&gcc GCC_QUPV3_WRAP_1_S_AHB_CLK>;
+			clock-names = "m-ahb", "s-ahb";
+			#address-cells = <2>;
+			#size-cells = <2>;
+			iommus = <&apps_smmu 0x443 0x0>;
+			dma-coherent;
+			status = "disabled";
+
+			i2c8: i2c@a80000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S0_CLK>;
+				clock-names = "se";
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>,
+				<&aggre2_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 0 QCOM_GPI_I2C>,
+					<&gpi_dma1 1 0 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi8: spi@a80000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S0_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi8_data_clk>, <&qup_spi8_cs>;
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 0 QCOM_GPI_SPI>,
+					<&gpi_dma1 1 0 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart8: serial@a80000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S0_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart8_cts>, <&qup_uart8_rts>,
+					    <&qup_uart8_tx>, <&qup_uart8_rx>;
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c9: i2c@a84000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa84000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S1_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c9_data_clk>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>,
+				<&aggre2_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 1 QCOM_GPI_I2C>,
+					<&gpi_dma1 1 1 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi9: spi@a84000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa84000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S1_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi9_data_clk>, <&qup_spi9_cs>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 1 QCOM_GPI_SPI>,
+					<&gpi_dma1 1 1 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart9: serial@a84000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa84000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S1_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart9_cts>, <&qup_uart9_rts>,
+					    <&qup_uart9_tx>, <&qup_uart9_rx>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c10: i2c@a88000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S2_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c10_data_clk>;
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>,
+				<&aggre2_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 2 QCOM_GPI_I2C>,
+					<&gpi_dma1 1 2 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi10: spi@a88000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S2_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi10_data_clk>, <&qup_spi10_cs>;
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 2 QCOM_GPI_SPI>,
+					<&gpi_dma1 1 2 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart10: serial@a88000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S2_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart10_cts>, <&qup_uart10_rts>,
+					    <&qup_uart10_tx>, <&qup_uart10_rx>;
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c11: i2c@a8c000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa8c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S3_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c11_data_clk>;
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>,
+				<&aggre2_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 3 QCOM_GPI_I2C>,
+					<&gpi_dma1 1 3 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart11: serial@a8c000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa8c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S3_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart11_tx>, <&qup_uart11_rx>;
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c12: i2c@a90000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa90000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S4_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c12_data_clk>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>,
+				<&aggre2_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 4 QCOM_GPI_I2C>,
+					<&gpi_dma1 1 4 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi12: spi@a90000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa90000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S4_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi12_data_clk>, <&qup_spi12_cs>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 4 QCOM_GPI_SPI>,
+					<&gpi_dma1 1 4 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart12: serial@a90000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa90000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S4_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart12_cts>, <&qup_uart12_rts>,
+					    <&qup_uart12_tx>, <&qup_uart12_rx>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c13: i2c@a94000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa94000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S5_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c13_data_clk>;
+				interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>,
+				<&aggre2_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 5 QCOM_GPI_I2C>,
+					<&gpi_dma1 1 5 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi13: spi@a94000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa94000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S5_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi13_data_clk>, <&qup_spi13_cs>;
+				interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 5 QCOM_GPI_SPI>,
+					<&gpi_dma1 1 5 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart13: serial@a94000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa94000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S5_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart13_cts>, <&qup_uart13_rts>,
+					    <&qup_uart13_tx>, <&qup_uart13_rx>;
+				interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c14: i2c@a98000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa98000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S6_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c14_data_clk>;
+				interrupts = <GIC_SPI 835 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>,
+				<&aggre2_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 6 QCOM_GPI_I2C>,
+					<&gpi_dma1 1 6 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi14: spi@a98000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa98000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S6_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi14_data_clk>, <&qup_spi14_cs>;
+				interrupts = <GIC_SPI 835 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 6 QCOM_GPI_SPI>,
+					<&gpi_dma1 1 6 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart14: serial@a98000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa98000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S6_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart14_cts>, <&qup_uart14_rts>,
+					    <&qup_uart14_tx>, <&qup_uart14_rx>;
+				interrupts = <GIC_SPI 835 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+
+			i2c15: i2c@a9c000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xa9c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S7_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c15_data_clk>;
+				interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>,
+				<&aggre2_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma1 0 7 QCOM_GPI_I2C>,
+					<&gpi_dma1 1 7 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi15: spi@a9c000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xa9c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S7_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi15_data_clk>, <&qup_spi15_cs>;
+				interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma1 0 7 QCOM_GPI_SPI>,
+					<&gpi_dma1 1 7 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart15: serial@a9c000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xa9c000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP1_S7_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart15_cts>, <&qup_uart15_rts>,
+					    <&qup_uart15_tx>, <&qup_uart15_rx>;
+				interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+		};
+
+		gpi_dma3: qcom,gpi-dma@b00000 {
+			compatible = "qcom,sm6350-gpi-dma";
+			#dma-cells = <3>;
+			reg = <0x0 0xb00000 0x0 0x60000>;
+			interrupts = <GIC_SPI 368 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 369 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 527 IRQ_TYPE_LEVEL_HIGH>,
+				<GIC_SPI 528 IRQ_TYPE_LEVEL_HIGH>;
+			iommus = <&apps_smmu 0x56 0x0>;
+			dma-channels = <4>;
+			dma-channel-mask = <0xf>;
+			dma-coherent;
+			status = "ok";
+		};
+
+		qupv3_id_3: geniqup@bc0000 {
+			compatible = "qcom,geni-se-qup";
+			reg = <0x0 0xbc0000 0x0 0x2000>;
+			ranges;
+			clocks = <&gcc GCC_QUPV3_WRAP_3_M_AHB_CLK>,
+				 <&gcc GCC_QUPV3_WRAP_3_S_AHB_CLK>;
+			clock-names = "m-ahb", "s-ahb";
+			#address-cells = <2>;
+			#size-cells = <2>;
+			iommus = <&apps_smmu 0x43 0x0>;
+			dma-coherent;
+			status = "disabled";
+
+			i2c16: i2c@b80000 {
+				compatible = "qcom,geni-i2c";
+				reg = <0x0 0xb80000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP3_S0_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_i2c16_data_clk>;
+				interrupts = <GIC_SPI 830 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config", "qup-memory";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_3 0 &clk_virt SLAVE_QUP_CORE_3 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_3 0>,
+				<&aggre2_noc MASTER_QUP_3 0 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+				dmas = <&gpi_dma3 0 0 QCOM_GPI_I2C>,
+					<&gpi_dma3 1 0 QCOM_GPI_I2C>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			spi16: spi@b80000 {
+				compatible = "qcom,geni-spi";
+				reg = <0x0 0xb80000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP3_S0_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_spi16_data_clk>, <&qup_spi16_cs>;
+				interrupts = <GIC_SPI 830 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_3 0 &clk_virt SLAVE_QUP_CORE_3 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_3 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				dmas = <&gpi_dma3 0 0 QCOM_GPI_SPI>,
+					<&gpi_dma3 1 0 QCOM_GPI_SPI>;
+				dma-names = "tx", "rx";
+				status = "disabled";
+			};
+
+			uart16: serial@b80000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0xb80000 0x0 0x4000>;
+				clocks = <&gcc GCC_QUPV3_WRAP3_S0_CLK>;
+				clock-names = "se";
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart16_cts>, <&qup_uart16_rts>,
+					    <&qup_uart16_tx>, <&qup_uart16_rx>;
+				interrupts = <GIC_SPI 830 IRQ_TYPE_LEVEL_HIGH>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects =
+				<&clk_virt MASTER_QUP_CORE_3 0 &clk_virt SLAVE_QUP_CORE_3 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_3 0>;
+				power-domains = <&rpmhpd QCS8300_CX>;
+				operating-points-v2 = <&qup_opp_table>;
+				status = "disabled";
+			};
+		};
+
+		rng: rng@10d2000 {
+			compatible = "qcom,qcs8300-trng", "qcom,trng";
+			reg = <0 0x010d2000 0 0x1000>;
+		};
+
+		pcie0: pci@1c00000 {
+			compatible = "qcom,pcie-qcs8300";
+			reg = <0x0 0x01c00000 0x0 0x3000>,
+				<0x0 0x40000000 0x0 0xf20>,
+				<0x0 0x40000f20 0x0 0xa8>,
+				<0x0 0x40001000 0x0 0x4000>,
+				<0x0 0x40100000 0x0 0x100000>,
+				<0x0 0x01c03000 0x0 0x1000>;
+			reg-names = "parf", "dbi", "elbi", "atu", "config", "mhi";
+			device_type = "pci";
+
+			#address-cells = <3>;
+			#size-cells = <2>;
+			ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
+				<0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
+			bus-range = <0x00 0xff>;
+
+			dma-coherent;
+
+			linux,pci-domain = <0>;
+			num-lanes = <2>;
+
+			interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 308 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 309 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 312 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 313 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 314 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 374 IRQ_TYPE_LEVEL_HIGH>,
+					<GIC_SPI 375 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "msi0", "msi1", "msi2", "msi3",
+					"msi4", "msi5", "msi6", "msi7";
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &intc GIC_SPI 434 IRQ_TYPE_LEVEL_HIGH>,
+					<0 0 0 2 &intc GIC_SPI 435 IRQ_TYPE_LEVEL_HIGH>,
+					<0 0 0 3 &intc GIC_SPI 438 IRQ_TYPE_LEVEL_HIGH>,
+					<0 0 0 4 &intc GIC_SPI 439 IRQ_TYPE_LEVEL_HIGH>;
+
+			clocks = <&gcc GCC_PCIE_0_AUX_CLK>,
+				<&gcc GCC_PCIE_0_CFG_AHB_CLK>,
+				<&gcc GCC_PCIE_0_MSTR_AXI_CLK>,
+				<&gcc GCC_PCIE_0_SLV_AXI_CLK>,
+				<&gcc GCC_PCIE_0_SLV_Q2A_AXI_CLK>;
+
+			clock-names = "aux",
+					"cfg",
+					"bus_master",
+					"bus_slave",
+					"slave_q2a";
+
+			assigned-clocks = <&gcc GCC_PCIE_0_AUX_CLK>;
+			assigned-clock-rates = <19200000>;
+
+			interconnects = <&pcie_anoc MASTER_PCIE_0 0 &mc_virt SLAVE_EBI1 0>,
+					<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_PCIE_0 0>;
+			interconnect-names = "pcie-mem", "cpu-pcie";
+
+			iommu-map = <0x0 &pcie_smmu 0x0000 0x1>,
+					<0x100 &pcie_smmu 0x0001 0x1>;
+
+			resets = <&gcc GCC_PCIE_0_BCR>;
+			reset-names = "pci";
+			power-domains = <&gcc GCC_PCIE_0_GDSC>;
+
+			phys = <&pcie0_phy>;
+			phy-names = "pciephy";
+
+			status = "disabled";
+
+			pcie3_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				/* GEN 1 x1 */
+				opp-2500000 {
+					opp-hz = /bits/ 64 <2500000>;
+					required-opps = <&rpmhpd_opp_svs_l1>;
+					opp-peak-kBps = <250000 1>;
+				};
+
+				/* GEN 1 x2 and GEN 2 x1 */
+				opp-5000000 {
+					opp-hz = /bits/ 64 <5000000>;
+					required-opps = <&rpmhpd_opp_svs_l1>;
+					opp-peak-kBps = <500000 1>;
+				};
+
+				/* GEN 2 x2 */
+				opp-10000000 {
+					opp-hz = /bits/ 64 <10000000>;
+					required-opps = <&rpmhpd_opp_svs_l1>;
+					opp-peak-kBps = <1000000 1>;
+				};
+
+				/* GEN 3 x1 */
+				opp-8000000 {
+					opp-hz = /bits/ 64 <8000000>;
+					required-opps = <&rpmhpd_opp_svs_l1>;
+					opp-peak-kBps = <984500 1>;
+				};
+
+				/* GEN 3 x2 and GEN 4 x1 */
+				opp-16000000 {
+					opp-hz = /bits/ 64 <16000000>;
+					required-opps = <&rpmhpd_opp_nom>;
+					opp-peak-kBps = <1969000 1>;
+				};
+
+				/* GEN 4 x2 */
+				opp-32000000 {
+					opp-hz = /bits/ 64 <32000000>;
+					required-opps = <&rpmhpd_opp_nom>;
+					opp-peak-kBps = <3938000 1>;
+				};
+			};
+
+			pcieport0: pcie@0 {
+				device_type = "pci";
+				reg = <0x0 0x0 0x0 0x0 0x0>;
+				#address-cells = <3>;
+				#size-cells = <2>;
+				ranges;
+				bus-range = <0x01 0xff>;
+			};
+		};
+
+		pcie0_phy: phy@1c04000 {
+			compatible = "qcom,qcs8300-qmp-gen4x2-pcie-phy";
+			reg = <0x0 0x1c04000 0x0 0x2000>;
+
+			clocks = <&gcc GCC_PCIE_0_AUX_CLK>,
+				<&gcc GCC_PCIE_0_CFG_AHB_CLK>,
+				<&gcc GCC_PCIE_CLKREF_EN>,
+				<&gcc GCC_PCIE_0_PHY_RCHNG_CLK>,
+				<&gcc GCC_PCIE_0_PIPE_CLK>,
+				<&gcc GCC_PCIE_0_PIPEDIV2_CLK>,
+				<&gcc GCC_PCIE_0_PHY_AUX_CLK>;
+
+			clock-names = "aux", "cfg_ahb", "ref", "rchng", "pipe",
+					"pipediv2", "phy_aux";
+
+			assigned-clocks = <&gcc GCC_PCIE_0_PHY_RCHNG_CLK>;
+			assigned-clock-rates = <100000000>;
+
+			resets = <&gcc GCC_PCIE_0_PHY_BCR>;
+			reset-names = "phy";
+
+			#clock-cells = <0>;
+			clock-output-names = "pcie_0_pipe_clk";
+
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+
+		pcie1: pci@1c10000 {
+			compatible = "qcom,pcie-qcs8300";
+			reg = <0x0 0x01c10000 0x0 0x3000>,
+			      <0x0 0x60000000 0x0 0xf20>,
+			      <0x0 0x60000f20 0x0 0xa8>,
+			      <0x0 0x60001000 0x0 0x4000>,
+			      <0x0 0x60100000 0x0 0x100000>,
+			      <0x0 0x01c13000 0x0 0x1000>;
+			reg-names = "parf", "dbi", "elbi", "atu", "config", "mhi";
+			device_type = "pci";
+
+			#address-cells = <3>;
+			#size-cells = <2>;
+			ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
+				 <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x1fd00000>;
+			bus-range = <0x00 0xff>;
+
+			dma-coherent;
+
+			linux,pci-domain = <1>;
+			num-lanes = <4>;
+
+			interrupts = <GIC_SPI 519 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 144 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 145 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 146 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "msi0", "msi1", "msi2", "msi3",
+					  "msi4", "msi5", "msi6", "msi7";
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &intc GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>,
+					<0 0 0 2 &intc GIC_SPI 149 IRQ_TYPE_LEVEL_HIGH>,
+					<0 0 0 3 &intc GIC_SPI 150 IRQ_TYPE_LEVEL_HIGH>,
+					<0 0 0 4 &intc GIC_SPI 151 IRQ_TYPE_LEVEL_HIGH>;
+
+			clocks = <&gcc GCC_PCIE_1_AUX_CLK>,
+				 <&gcc GCC_PCIE_1_CFG_AHB_CLK>,
+				 <&gcc GCC_PCIE_1_MSTR_AXI_CLK>,
+				 <&gcc GCC_PCIE_1_SLV_AXI_CLK>,
+				 <&gcc GCC_PCIE_1_SLV_Q2A_AXI_CLK>;
+
+			clock-names = "aux",
+				      "cfg",
+				      "bus_master",
+				      "bus_slave",
+				      "slave_q2a";
+
+			assigned-clocks = <&gcc GCC_PCIE_1_AUX_CLK>;
+			assigned-clock-rates = <19200000>;
+
+			interconnects = <&pcie_anoc MASTER_PCIE_1 0 &mc_virt SLAVE_EBI1 0>,
+					<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_PCIE_1 0>;
+			interconnect-names = "pcie-mem", "cpu-pcie";
+
+			iommu-map = <0x0 &pcie_smmu 0x0080 0x1>,
+				    <0x100 &pcie_smmu 0x0081 0x1>;
+
+			resets = <&gcc GCC_PCIE_1_BCR>;
+			reset-names = "pci";
+			power-domains = <&gcc GCC_PCIE_1_GDSC>;
+
+			phys = <&pcie1_phy>;
+			phy-names = "pciephy";
+
+			status = "disabled";
+		};
+
+		pcie1_phy: phy@1c14000 {
+			compatible = "qcom,sa8775p-qmp-gen4x4-pcie-phy";
+			reg = <0x0 0x1c14000 0x0 0x4000>;
+
+			clocks = <&gcc GCC_PCIE_1_AUX_CLK>,
+				<&gcc GCC_PCIE_1_CFG_AHB_CLK>,
+				<&gcc GCC_PCIE_CLKREF_EN>,
+				<&gcc GCC_PCIE_1_PHY_RCHNG_CLK>,
+				<&gcc GCC_PCIE_1_PIPE_CLK>,
+				<&gcc GCC_PCIE_1_PIPEDIV2_CLK>,
+				<&gcc GCC_PCIE_1_PHY_AUX_CLK>;
+
+			clock-names = "aux", "cfg_ahb", "ref", "rchng", "pipe",
+					"pipediv2", "phy_aux";
+
+			assigned-clocks = <&gcc GCC_PCIE_1_PHY_RCHNG_CLK>;
+			assigned-clock-rates = <100000000>;
+
+			resets = <&gcc GCC_PCIE_1_PHY_BCR>;
+			reset-names = "phy";
+
+			#clock-cells = <0>;
+			clock-output-names = "pcie_1_pipe_clk";
+
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		ufs_mem_hc: ufs@1d84000 {
+			compatible = "qcom,qcs8300-ufshc", "qcom,ufshc", "jedec,ufs-2.0";
+			reg = <0x0 0x01d84000 0x0 0x3000>;
+			interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>;
+			phys = <&ufs_mem_phy>;
+			phy-names = "ufsphy";
+			lanes-per-direction = <2>;
+			#reset-cells = <1>;
+			reset-gpios = <&tlmm 133 1>;
+			resets = <&gcc GCC_UFS_PHY_BCR>;
+			reset-names = "rst";
+
+			power-domains = <&gcc GCC_UFS_PHY_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
+
+			iommus = <&apps_smmu 0x100 0x0>;
+			dma-coherent;
+
+			interconnects = <&aggre1_noc MASTER_UFS_MEM 0
+					&mc_virt SLAVE_EBI1 0>,
+					<&gem_noc MASTER_APPSS_PROC 0
+					&config_noc SLAVE_UFS_MEM_CFG 0>;
+			interconnect-names = "ufs-ddr", "cpu-ufs";
+
+			clocks = <&gcc GCC_UFS_PHY_AXI_CLK>,
+				 <&gcc GCC_AGGRE_UFS_PHY_AXI_CLK>,
+				 <&gcc GCC_UFS_PHY_AHB_CLK>,
+				 <&gcc GCC_UFS_PHY_UNIPRO_CORE_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GCC_UFS_PHY_TX_SYMBOL_0_CLK>,
+				 <&gcc GCC_UFS_PHY_RX_SYMBOL_0_CLK>,
+				 <&gcc GCC_UFS_PHY_RX_SYMBOL_1_CLK>;
+			clock-names = "core_clk",
+				      "bus_aggr_clk",
+				      "iface_clk",
+				      "core_clk_unipro",
+				      "ref_clk",
+				      "tx_lane0_sync_clk",
+				      "rx_lane0_sync_clk",
+				      "rx_lane1_sync_clk";
+			freq-table-hz = <75000000 300000000>,
+					<0 0>,
+					<0 0>,
+					<75000000 300000000>,
+					<0 0>,
+					<0 0>,
+					<0 0>,
+					<0 0>;
+			qcom,ice = <&ice>;
+			status = "disabled";
+		};
+
+		ufs_mem_phy: phy@1d87000 {
+			compatible = "qcom,qcs8300-qmp-ufs-phy";
+			reg = <0x0 0x01d87000 0x0 0xe10>;
+			/*
+			 * Yes, GCC_EDP_REF_CLKREF_EN is correct in qref. It
+			 * enables the CXO clock to eDP *and* UFS PHY.
+			 */
+			clocks = <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
+				 <&gcc GCC_EDP_REF_CLKREF_EN>;
+			clock-names = "ref", "ref_aux", "qref";
+			power-domains = <&gcc GCC_UFS_PHY_GDSC>;
+
+			resets = <&ufs_mem_hc 0>;
+			reset-names = "ufsphy";
+
+			#phy-cells = <0>;
+			status = "disabled";
+		};
+
+		ice: crypto@1d88000 {
+			compatible = "qcom,inline-crypto-engine";
+			reg = <0x0 0x01d88000 0x0 0x10000>;
+			qcom,ice-use-hwkm;
+			clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>;
+		};
+
+		cryptobam: dma-controller@1dc4000 {
+			compatible = "qcom,bam-v1.7.4", "qcom,bam-v1.7.0";
+			reg = <0x0 0x01dc4000 0x0 0x28000>;
+			interrupts = <GIC_SPI 272 IRQ_TYPE_LEVEL_HIGH>;
+			#dma-cells = <1>;
+			qcom,ee = <0>;
+			qcom,controlled-remotely;
+			num-channels = <20>;
+			qcom,num-ees = <4>;
+			iommus = <&apps_smmu 0x480 0x00>,
+				 <&apps_smmu 0x481 0x00>;
+		};
+
+		crypto: crypto@1dfa000 {
+			compatible = "qcom,qcs8300-qce", "qcom,qce";
+			reg = <0x0 0x01dfa000 0x0 0x6000>;
+			dmas = <&cryptobam 4>, <&cryptobam 5>;
+			dma-names = "rx", "tx";
+			iommus = <&apps_smmu 0x480 0x00>,
+				 <&apps_smmu 0x481 0x00>;
+			interconnects = <&aggre2_noc MASTER_CRYPTO_CORE0 0 &mc_virt SLAVE_EBI1 0>;
+			interconnect-names = "memory";
+		};
+
+		remoteproc_adsp: remoteproc@3000000 {
+			compatible = "qcom,qcs8300-adsp-pas";
+			reg = <0x0 0x3000000 0x0 0x00100>;
+
+			interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "wdog", "fatal", "ready",
+					  "handover", "stop-ack";
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "xo";
+
+			power-domains = <&rpmhpd RPMHPD_LCX>,
+					<&rpmhpd RPMHPD_LMX>;
+			power-domain-names = "lcx", "lmx";
+
+			memory-region = <&adsp_mem>;
+
+			qcom,qmp = <&aoss_qmp>;
+
+			qcom,smem-states = <&smp2p_adsp_out 0>;
+			qcom,smem-state-names = "stop";
+
+			status = "disabled";
+
+			remoteproc_adsp_glink: glink-edge {
+				interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+							     IPCC_MPROC_SIGNAL_GLINK_QMP
+							     IRQ_TYPE_EDGE_RISING>;
+				mboxes = <&ipcc IPCC_CLIENT_LPASS
+						IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+				label = "lpass";
+				qcom,remote-pid = <2>;
+
+				fastrpc {
+					compatible = "qcom,fastrpc";
+					qcom,glink-channels = "fastrpcglink-apps-dsp";
+					label = "adsp";
+					memory-region = <&adsp_rpc_remote_heap_mem>;
+					qcom,vmids = <QCOM_SCM_VMID_LPASS
+						      QCOM_SCM_VMID_ADSP_HEAP>;
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					compute-cb@3 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <3>;
+						iommus = <&apps_smmu 0x2003 0x0>;
+						dma-coherent;
+					};
+
+					compute-cb@4 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <4>;
+						iommus = <&apps_smmu 0x2004 0x0>;
+						dma-coherent;
+					};
+
+					compute-cb@5 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <5>;
+						iommus = <&apps_smmu 0x2005 0x0>;
+						dma-coherent;
+					};
+				};
+
+				gpr {
+					compatible = "qcom,gpr";
+					qcom,glink-channels = "adsp_apps";
+					qcom,domain = <GPR_DOMAIN_ID_ADSP>;
+					qcom,intents = <512 20>;
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					q6apm: service@1 {
+						compatible = "qcom,q6apm";
+						reg = <GPR_APM_MODULE_IID>;
+						#sound-dai-cells = <0>;
+
+						q6apmbedai: bedais {
+							compatible = "qcom,q6apm-lpass-dais";
+							q6apm-dai-uses-dummy-ops;
+							#sound-dai-cells = <1>;
+						};
+					};
+
+					q6prm: service@2 {
+						compatible = "qcom,q6prm";
+						reg = <GPR_PRM_MODULE_IID>;
+
+						q6prmcc: clock-controller {
+							compatible = "qcom,q6prm-lpass-clocks";
+							#clock-cells = <2>;
+						};
+					};
+
+					spf-core {
+						compatible = "qcom,spf_core";
+						reg = <GPR_AMDB_MODULE_IID>;
+					};
+
+					audio-pkt {
+						compatible = "qcom,audio-pkt";
+						reg = <GPR_VCPM_MODULE_IID>;
+						qcom,audiopkt-ch-name = "apr_audio_svc";
+					};
+				};
+			};
+		};
+
+		serdes0: phy@8909000 {
+			compatible = "qcom,qcs8300-dwmac-sgmii-phy";
+			reg = <0x0 0x8909000 0x0 0xe10>;
+			clocks = <&gcc GCC_SGMI_CLKREF_EN>;
+			clock-names = "sgmi_ref";
+			#phy-cells = <0>;
+			status = "disabled";
+		};
+
+		tcsr_mutex: hwlock@1f40000 {
+			compatible = "qcom,tcsr-mutex";
+			reg = <0x0 0x01f40000 0x0 0x20000>;
+			#hwlock-cells = <1>;
+		};
+
+		gpucc: clock-controller@3d90000 {
+			compatible = "qcom,qcs8300-gpucc";
+			reg = <0x0 0x03d90000 0x0 0xa000>;
+			clocks = <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GCC_GPU_GPLL0_CLK_SRC>,
+				 <&gcc GCC_GPU_GPLL0_DIV_CLK_SRC>;
+			clock-names = "bi_tcxo",
+				      "gcc_gpu_gpll0_clk_src",
+				      "gcc_gpu_gpll0_div_clk_src";
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		adreno_smmu: iommu@3da0000 {
+			compatible = "qcom,qcs8300-smmu-500", "qcom,adreno-smmu",
+				     "qcom,smmu-500", "arm,mmu-500";
+			reg = <0x0 0x3da0000 0x0 0x20000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <2>;
+			dma-coherent;
+
+			power-domains = <&gpucc GPU_CC_CX_GDSC>;
+			clocks = <&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+				 <&gcc GCC_GPU_SNOC_DVM_GFX_CLK>,
+				 <&gpucc GPU_CC_AHB_CLK>,
+				 <&gpucc GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK>,
+				 <&gpucc GPU_CC_CX_GMU_CLK>,
+				 <&gpucc GPU_CC_HUB_CX_INT_CLK>,
+				 <&gpucc GPU_CC_HUB_AON_CLK>;
+			clock-names = "gcc_gpu_memnoc_gfx_clk",
+				      "gcc_gpu_snoc_dvm_gfx_clk",
+				      "gpu_cc_ahb_clk",
+				      "gpu_cc_hlos1_vote_gpu_smmu_clk",
+				      "gpu_cc_cx_gmu_clk",
+				      "gpu_cc_hub_cx_int_clk",
+				      "gpu_cc_hub_aon_clk";
+			interrupts = <GIC_SPI 672 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 673 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 678 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 679 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 680 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 681 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 682 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 683 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 684 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 685 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 686 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 687 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		eud: eud@8901000 {
+			compatible = "qcom,secure-eud";
+			reg = <0x0 0x8901000 0x0 0x2000>,
+			      <0x0 0x8903000 0x0 0x1000>;
+			interrupts-extended = <&pdc 11 IRQ_TYPE_LEVEL_HIGH>;
+
+			status = "disabled";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					eud_ep: endpoint {
+						remote-endpoint = <&usb1_role_switch>;
+					};
+				};
+			};
+		};
+
+		pmu@9091000 {
+			compatible = "qcom,qcs8300-llcc-bwmon", "qcom,sc7280-llcc-bwmon";
+			reg = <0x0 0x9091000 0x0 0x1000>;
+
+			interrupts = <GIC_SPI 620 IRQ_TYPE_LEVEL_HIGH>;
+
+			interconnects = <&mc_virt MASTER_LLCC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>;
+
+			operating-points-v2 = <&llcc_bwmon_opp_table>;
+
+			llcc_bwmon_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-0 {
+					opp-peak-kBps = <762000>;
+				};
+
+				opp-1 {
+					opp-peak-kBps = <1720000>;
+				};
+
+				opp-2 {
+					opp-peak-kBps = <2086000>;
+				};
+
+				opp-3 {
+					opp-peak-kBps = <2601000>;
+				};
+
+				opp-4 {
+					opp-peak-kBps = <2929000>;
+				};
+
+				opp-5 {
+					opp-peak-kBps = <5931000>;
+				};
+
+				opp-6 {
+					opp-peak-kBps = <6515000>;
+				};
+
+				opp-7 {
+					opp-peak-kBps = <7984000>;
+				};
+
+				opp-8 {
+					opp-peak-kBps = <10437000>;
+				};
+
+				opp-9 {
+					opp-peak-kBps = <12195000>;
+				};
+			};
+		};
+
+		pmu@90b5400 {
+			compatible = "qcom,qcs8300-cpu-bwmon", "qcom,sdm845-bwmon";
+			reg = <0x0 0x90b5400 0x0 0x600>;
+			interrupts = <GIC_SPI 581 IRQ_TYPE_LEVEL_HIGH>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &gem_noc SLAVE_LLCC QCOM_ICC_TAG_ACTIVE_ONLY>;
+
+			operating-points-v2 = <&cpu_bwmon_opp_table>;
+
+			cpu_bwmon_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-0 {
+					opp-peak-kBps = <9155000>;
+				};
+
+				opp-1 {
+					opp-peak-kBps = <12298000>;
+				};
+
+				opp-2 {
+					opp-peak-kBps = <14236000>;
+				};
+
+				opp-3 {
+					opp-peak-kBps = <16265000>;
+				};
+			};
+		};
+
+		pmu@90b6400 {
+			compatible = "qcom,qcs8300-cpu-bwmon", "qcom,sdm845-bwmon";
+			reg = <0x0 0x90b6400 0x0 0x600>;
+			interrupts = <GIC_SPI 581 IRQ_TYPE_LEVEL_HIGH>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &gem_noc SLAVE_LLCC QCOM_ICC_TAG_ACTIVE_ONLY>;
+
+			operating-points-v2 = <&cpu_bwmon_opp_table>;
+		};
+
+		llcc: system-cache-controller@9200000 {
+			compatible = "qcom,qcs8300-llcc";
+			reg = <0x0 0x09200000 0x0 0x80000>,
+			      <0x0 0x09300000 0x0 0x80000>,
+			      <0x0 0x09400000 0x0 0x80000>,
+			      <0x0 0x09500000 0x0 0x80000>,
+			      <0x0 0x09a00000 0x0 0x80000>;
+			reg-names = "llcc0_base",
+				    "llcc1_base",
+				    "llcc2_base",
+				    "llcc3_base",
+				    "llcc_broadcast_base";
+			interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>;
+			num-banks = <4>;
+		};
+
+		videocc: clock-controller@abf0000 {
+			compatible = "qcom,qcs8300-videocc";
+			reg = <0x0 0x0abf0000 0x0 0x10000>;
+			clocks = <&gcc GCC_VIDEO_AHB_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK_A>,
+				 <&sleep_clk>;
+			power-domains = <&rpmhpd QCS8300_MMCX>;
+			required-opps = <&rpmhpd_opp_low_svs>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		camss: isp@ac7a000 {
+			compatible = "qcom,qcs8300-camss";
+
+			reg = <0x0 0x0ac7a000 0x0 0x0f01>,
+			      <0x0 0x0ac7c000 0x0 0x0f01>,
+			      <0x0 0x0ac84000 0x0 0x0f01>,
+			      <0x0 0x0ac88000 0x0 0x0f01>,
+			      <0x0 0x0ac8c000 0x0 0x0f01>,
+			      <0x0 0x0ac90000 0x0 0x0f01>,
+			      <0x0 0x0ac94000 0x0 0x0f01>,
+			      <0x0 0x0ac78000 0x0 0x1000>,
+			      <0x0 0x0ac9c000 0x0 0x2000>,
+			      <0x0 0x0ac9e000 0x0 0x2000>,
+			      <0x0 0x0aca0000 0x0 0x2000>,
+			      <0x0 0x0acac000 0x0 0x0400>,
+			      <0x0 0x0acad000 0x0 0x0400>,
+			      <0x0 0x0acae000 0x0 0x0400>,
+			      <0x0 0x0ac4d000 0x0 0xf000>,
+			      <0x0 0x0ac60000 0x0 0xf000>,
+			      <0x0 0x0ac85000 0x0 0x0d00>,
+			      <0x0 0x0ac89000 0x0 0x0d00>,
+			      <0x0 0x0ac8d000 0x0 0x0d00>,
+			      <0x0 0x0ac91000 0x0 0x0d00>,
+			      <0x0 0x0ac95000 0x0 0x0d00>;
+			reg-names = "csid0",
+				    "csid1",
+				    "csid_lite0",
+				    "csid_lite1",
+				    "csid_lite2",
+				    "csid_lite3",
+				    "csid_lite4",
+				    "csid_top",
+				    "csiphy0",
+				    "csiphy1",
+				    "csiphy2",
+				    "tpg0",
+				    "tpg1",
+				    "tpg2",
+				    "vfe0",
+				    "vfe1",
+				    "vfe_lite0",
+				    "vfe_lite1",
+				    "vfe_lite2",
+				    "vfe_lite3",
+				    "vfe_lite4";
+
+			clocks = <&camcc CAM_CC_CAMNOC_AXI_CLK>,
+				 <&camcc CAM_CC_CCI_0_CLK>,
+				 <&camcc CAM_CC_CCI_1_CLK>,
+				 <&camcc CAM_CC_CCI_2_CLK>,
+				 <&camcc CAM_CC_CORE_AHB_CLK>,
+				 <&camcc CAM_CC_CPAS_AHB_CLK>,
+				 <&camcc CAM_CC_CPAS_FAST_AHB_CLK>,
+				 <&camcc CAM_CC_CPAS_IFE_0_CLK>,
+				 <&camcc CAM_CC_CPAS_IFE_1_CLK>,
+				 <&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+				 <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+				 <&camcc CAM_CC_CSID_CLK>,
+				 <&camcc CAM_CC_CSID_CSIPHY_RX_CLK>,
+				 <&camcc CAM_CC_CSIPHY0_CLK>,
+				 <&camcc CAM_CC_CSI0PHYTIMER_CLK>,
+				 <&camcc CAM_CC_CSIPHY1_CLK>,
+				 <&camcc CAM_CC_CSI1PHYTIMER_CLK>,
+				 <&camcc CAM_CC_CSIPHY2_CLK>,
+				 <&camcc CAM_CC_CSI2PHYTIMER_CLK>,
+				 <&gcc   GCC_CAMERA_HF_AXI_CLK>,
+				 <&gcc   GCC_CAMERA_SF_AXI_CLK>,
+				 <&gcc   GCC_CAMERA_AHB_CLK>,
+				 <&camcc CAM_CC_ICP_AHB_CLK>,
+				 <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+				 <&camcc CAM_CC_IFE_0_CLK>,
+				 <&camcc CAM_CC_IFE_0_FAST_AHB_CLK>,
+				 <&camcc CAM_CC_IFE_1_CLK>,
+				 <&camcc CAM_CC_IFE_1_FAST_AHB_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_CSID_CLK>;
+			clock-names = "camnoc_axi",
+				      "cci_0",
+				      "cci_1",
+				      "cci_2",
+				      "core_ahb",
+				      "cpas_ahb",
+				      "cpas_fast_ahb_clk",
+				      "cpas_vfe0",
+				      "cpas_vfe1",
+				      "cpas_vfe_lite",
+				      "cphy_rx_clk",
+				      "csid",
+				      "csid_csiphy_rx",
+				      "csiphy0",
+				      "csiphy0_timer",
+				      "csiphy1",
+				      "csiphy1_timer",
+				      "csiphy2",
+				      "csiphy2_timer",
+				      "gcc_axi_hf",
+				      "gcc_axi_sf",
+				      "gcc_camera_ahb",
+				      "icp_ahb",
+				      "slow_ahb_src",
+				      "vfe0",
+				      "vfe0_fast_ahb",
+				      "vfe1",
+				      "vfe1_fast_ahb",
+				      "vfe_lite",
+				      "vfe_lite_ahb",
+				      "vfe_lite_cphy_rx",
+				      "vfe_lite_csid";
+
+			interconnects = <&gem_noc MASTER_APPSS_PROC 0
+					 &config_noc SLAVE_CAMERA_CFG 0>,
+					<&mmss_noc MASTER_CAMNOC_HF 0 &mc_virt SLAVE_EBI1 0>,
+					<&mmss_noc MASTER_CAMNOC_SF 0 &mc_virt SLAVE_EBI1 0>;
+			interconnect-names = "ahb", "hf_0", "sf_0";
+
+			interrupts = <GIC_SPI 565 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 564 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 759 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 758 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 604 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 545 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 546 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 547 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 761 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 760 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 605 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "csid0",
+					  "csid1",
+					  "csid-lite0",
+					  "csid-lite1",
+					  "csid-lite2",
+					  "csid-lite3",
+					  "csid-lite4",
+					  "csiphy0",
+					  "csiphy1",
+					  "csiphy2",
+					  "tpg0",
+					  "tpg1",
+					  "tpg2",
+					  "vfe0",
+					  "vfe1",
+					  "vfe-lite0",
+					  "vfe-lite1",
+					  "vfe-lite2",
+					  "vfe-lite3",
+					  "vfe-lite4";
+
+			iommus = <&apps_smmu 0x2400 0x20>;
+
+			power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+			power-domain-names = "top";
+			operating-points-v2 = <&camss_opp_table>;
+
+			status = "disabled";
+
+			camss_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-400000000 {
+					opp-hz = /bits/ 64 <400000000>;
+					required-opps = <&rpmhpd_opp_svs_l1>;
+				};
+
+				opp-480000000 {
+					opp-hz = /bits/ 64 <480000000>;
+					required-opps = <&rpmhpd_opp_svs_l1>;
+				};
+
+				opp-600000000 {
+					opp-hz = /bits/ 64 <600000000>;
+					required-opps = <&rpmhpd_opp_nom>;
+				};
+			};
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@0 {
+					reg = <0>;
+				};
+
+				port@1 {
+					reg = <1>;
+				};
+
+				port@2 {
+					reg = <2>;
+				};
+			};
+		};
+
+		camcc: clock-controller@ade0000 {
+			compatible = "qcom,qcs8300-camcc";
+			reg = <0x0 0x0ade0000 0x0 0x20000>;
+			clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK_A>,
+				 <&sleep_clk>;
+			power-domains = <&rpmhpd QCS8300_MMCX>,
+					<&rpmhpd QCS8300_MXC>;
+			required-opps = <&rpmhpd_opp_low_svs>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		mdss: display-subsystem@ae00000 {
+			compatible = "qcom,qcs8300-mdss";
+			reg = <0x0 0x0ae00000 0x0 0x1000>;
+			reg-names = "mdss";
+
+			/* same path used twice */
+			interconnects = <&mmss_noc MASTER_MDP0 0 &mc_virt SLAVE_EBI1 0>,
+					<&mmss_noc MASTER_MDP1 0 &mc_virt SLAVE_EBI1 0>,
+					<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &config_noc SLAVE_DISPLAY_CFG QCOM_ICC_TAG_ACTIVE_ONLY>;
+			interconnect-names = "mdp0-mem",
+					     "mdp1-mem",
+					     "cpu-cfg";
+
+			power-domains = <&dispcc0 MDSS_DISP_CC_MDSS_CORE_GDSC>;
+
+			clocks = <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+				 <&gcc GCC_DISP_HF_AXI_CLK>,
+				 <&dispcc0 MDSS_DISP_CC_MDSS_MDP_CLK>;
+
+			interrupts = <GIC_SPI 92 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+
+			iommus = <&apps_smmu 0x1000 0x402>;
+
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			status = "disabled";
+
+			mdss_mdp: display-controller@ae01000 {
+				compatible = "qcom,qcs8300-dpu";
+				reg = <0x0 0x0ae01000 0x0 0x8f000>,
+				      <0x0 0x0aeb0000 0x0 0x2008>;
+				reg-names = "mdp", "vbif";
+
+				clocks = <&gcc GCC_DISP_HF_AXI_CLK>,
+					<&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					<&dispcc0 MDSS_DISP_CC_MDSS_MDP_LUT_CLK>,
+					<&dispcc0 MDSS_DISP_CC_MDSS_MDP_CLK>,
+					<&dispcc0 MDSS_DISP_CC_MDSS_VSYNC_CLK>;
+				clock-names = "bus",
+					      "iface",
+					      "lut",
+					      "core",
+					      "vsync";
+
+				assigned-clocks = <&dispcc0 MDSS_DISP_CC_MDSS_VSYNC_CLK>;
+				assigned-clock-rates = <19200000>;
+
+				operating-points-v2 = <&mdp_opp_table>;
+				power-domains = <&rpmhpd QCS8300_MMCX>;
+
+				interrupt-parent = <&mdss>;
+				interrupts = <0>;
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+						dpu_intf0_out: endpoint {
+							remote-endpoint = <&mdss_dp0_in>;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+						dpu_intf1_out: endpoint {
+							remote-endpoint = <&mdss_dsi0_in>;
+						};
+					};
+				};
+
+				mdp_opp_table: opp-table {
+					compatible = "operating-points-v2";
+
+					opp-375000000 {
+						opp-hz = /bits/ 64 <375000000>;
+						required-opps = <&rpmhpd_opp_svs_l1>;
+					};
+
+					opp-500000000 {
+						opp-hz = /bits/ 64 <500000000>;
+						required-opps = <&rpmhpd_opp_nom>;
+					};
+
+					opp-575000000 {
+						opp-hz = /bits/ 64 <575000000>;
+						required-opps = <&rpmhpd_opp_turbo>;
+					};
+
+					opp-650000000 {
+						opp-hz = /bits/ 64 <650000000>;
+						required-opps = <&rpmhpd_opp_turbo_l1>;
+					};
+				};
+			};
+
+			mdss_dsi0: dsi@ae94000 {
+				compatible = "qcom,mdss-dsi-ctrl";
+				reg = <0x0 0x0ae94000 0x0 0x400>;
+				reg-names = "dsi_ctrl";
+
+				interrupt-parent = <&mdss>;
+				interrupts = <4>;
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_BYTE0_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_BYTE0_INTF_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_PCLK0_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_ESC0_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					 <&gcc GCC_DISP_HF_AXI_CLK>;
+				clock-names = "byte",
+					      "byte_intf",
+					      "pixel",
+					      "core",
+					      "iface",
+					      "bus";
+
+				assigned-clocks = <&dispcc0 MDSS_DISP_CC_MDSS_BYTE0_CLK_SRC>,
+						  <&dispcc0 MDSS_DISP_CC_MDSS_PCLK0_CLK_SRC>;
+				assigned-clock-parents = <&mdss_dsi0_phy 0>,
+							 <&mdss_dsi0_phy 1>;
+
+				phys = <&mdss_dsi0_phy>;
+
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				status = "disabled";
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+						mdss_dsi0_in: endpoint {
+							remote-endpoint = <&dpu_intf1_out>;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+						mdss_dsi0_out: endpoint {
+						};
+					};
+				};
+
+				dsi0_opp_table: opp-table {
+					compatible = "operating-points-v2";
+
+					opp-358000000 {
+						opp-hz = /bits/ 64 <358000000>;
+						required-opps = <&rpmhpd_opp_svs_l1>;
+					};
+				};
+			};
+
+			mdss_dsi0_phy: phy@ae94400 {
+				compatible = "qcom,sa8775p-dsi-phy-5nm";
+				reg = <0x0 0x0ae94400 0x0 0x200>,
+				      <0x0 0x0ae94600 0x0 0x280>,
+				      <0x0 0x0ae94900 0x0 0x27c>;
+				reg-names = "dsi_phy",
+					    "dsi_phy_lane",
+					    "dsi_pll";
+
+				#clock-cells = <1>;
+				#phy-cells = <0>;
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					 <&rpmhcc RPMH_CXO_CLK>;
+				clock-names = "iface", "ref";
+
+				status = "disabled";
+			};
+
+			mdss_edp_phy: phy@aec2a00 {
+				compatible = "qcom,qcs8300-edp-phy";
+
+				reg = <0x0 0xaec2a00 0x0 0x200>,
+					<0x0 0xaec2200 0x0 0xd0>,
+					<0x0 0xaec2600 0x0 0xd0>,
+					<0x0 0xaec2000 0x0 0x1c8>;
+
+				clocks = <&rpmhcc RPMH_CXO_CLK>,
+					 <&gcc GCC_EDP_REF_CLKREF_EN>;
+				clock-names = "aux",
+					      "cfg_ahb";
+
+				vdda-phy-supply = <&vreg_l5a>;
+				vdda-pll-supply = <&vreg_l4a>;
+				#clock-cells = <1>;
+				#phy-cells = <0>;
+
+				status = "disabled";
+			};
+
+			mdss_dp0: displayport-controller@af54000 {
+				compatible = "qcom,qcs8300-dp";
+
+				pinctrl-0 = <&dp_hot_plug_det>;
+				pinctrl-names = "default";
+
+
+				reg = <0x0 0xaf54000 0x0 0x104>,
+					<0x0 0xaf54200 0x0 0x0c0>,
+					<0x0 0xaf55000 0x0 0x770>,
+					<0x0 0xaf56000 0x0 0x09c>,
+					<0x0 0xaf57000 0x0 0x09c>;
+
+				interrupt-parent = <&mdss>;
+				interrupts = <12>;
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_AUX_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_LINK_INTF_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK>;
+				clock-names = "core_iface",
+						"core_aux",
+						"ctrl_link",
+						"ctrl_link_iface",
+						"stream_pixel",
+						"stream_1_pixel";
+				assigned-clocks = <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK_SRC>,
+						  <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK_SRC>,
+						  <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK_SRC>;
+				assigned-clock-parents = <&mdss_edp_phy 0>,
+							 <&mdss_edp_phy 1>,
+							 <&mdss_edp_phy 1>;
+				phys = <&mdss_edp_phy>;
+				phy-names = "dp";
+
+				operating-points-v2 = <&dp_opp_table>;
+				power-domains = <&rpmhpd QCS8300_MMCX>;
+
+				#sound-dai-cells = <0>;
+
+				status = "disabled";
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+						mdss_dp0_in: endpoint {
+							remote-endpoint = <&dpu_intf0_out>;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+						mdss_dp_out: endpoint { };
+					};
+				};
+
+				dp_opp_table: opp-table {
+					compatible = "operating-points-v2";
+
+					opp-160000000 {
+						opp-hz = /bits/ 64 <160000000>;
+						required-opps = <&rpmhpd_opp_low_svs>;
+					};
+
+					opp-270000000 {
+						opp-hz = /bits/ 64 <270000000>;
+						required-opps = <&rpmhpd_opp_svs>;
+					};
+
+					opp-540000000 {
+						opp-hz = /bits/ 64 <540000000>;
+						required-opps = <&rpmhpd_opp_svs_l1>;
+					};
+
+					opp-810000000 {
+						opp-hz = /bits/ 64 <810000000>;
+						required-opps = <&rpmhpd_opp_nom>;
+					};
+				};
+			};
+		};
+
+		dispcc0: clock-controller@af00000 {
+			compatible = "qcom,sa8775p-dispcc0";
+			reg = <0x0 0x0af00000 0x0 0x20000>;
+			clocks = <&gcc GCC_DISP_AHB_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK_A>,
+				 <&sleep_clk>,
+				 <&mdss_edp_phy 0>, <&mdss_edp_phy 1>,
+				 <0>, <0>,
+				 <&mdss_dsi0_phy 0>, <&mdss_dsi0_phy 1>,
+				 <0>, <0>;
+			power-domains = <&rpmhpd QCS8300_MMCX>;
+			required-opps = <&rpmhpd_opp_low_svs>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		pdc: interrupt-controller@b220000 {
+			compatible = "qcom,qcs8300-pdc", "qcom,pdc";
+			reg = <0x0 0xb220000 0x0 0x30000>,
+			      <0x0 0x17c000f0 0x0 0x64>;
+			qcom,pdc-ranges = <0 480 40>,
+					  <40 140 14>,
+					  <54 263 1>,
+					  <55 306 4>,
+					  <59 312 3>,
+					  <62 374 2>,
+					  <64 434 2>,
+					  <66 438 2>,
+					  <70 520 1>,
+					  <73 523 1>,
+					  <118 568 6>,
+					  <124 609 3>,
+					  <159 638 1>,
+					  <160 720 3>,
+					  <169 728 30>,
+					  <199 416 2>,
+					  <201 449 1>,
+					  <202 89 1>,
+					  <203 451 1>,
+					  <204 462 1>,
+					  <205 264 1>,
+					  <206 579 1>,
+					  <207 653 1>,
+					  <208 656 1>,
+					  <209 659 1>,
+					  <210 122 1>,
+					  <211 699 1>,
+					  <212 705 1>,
+					  <213 450 1>,
+					  <214 643 2>,
+					  <216 646 5>,
+					  <221 390 5>,
+					  <226 700 2>,
+					  <228 440 1>,
+					  <229 663 1>,
+					  <230 524 2>,
+					  <232 612 3>,
+					  <235 723 5>;
+			interrupt-parent = <&intc>;
+			#interrupt-cells = <2>;
+			interrupt-controller;
+		};
+
+		aoss_qmp: power-management@c300000 {
+			compatible = "qcom,qcs8300-aoss-qmp", "qcom,aoss-qmp";
+			reg = <0x0 0x0c300000 0x0 0x400>;
+			interrupts-extended = <&ipcc IPCC_CLIENT_AOP
+					       IPCC_MPROC_SIGNAL_GLINK_QMP
+					       IRQ_TYPE_EDGE_RISING>;
+			mboxes = <&ipcc IPCC_CLIENT_AOP IPCC_MPROC_SIGNAL_GLINK_QMP>;
+			#clock-cells = <0>;
+		};
+
+		spmi_bus: spmi@c440000 {
+			compatible = "qcom,spmi-pmic-arb";
+			reg = <0x0 0x0c440000 0x0 0x1100>,
+			      <0x0 0x0c600000 0x0 0x2000000>,
+			      <0x0 0x0e600000 0x0 0x100000>,
+			      <0x0 0x0e700000 0x0 0xa0000>,
+			      <0x0 0x0c40a000 0x0 0x26000>;
+			reg-names = "core",
+				    "chnls",
+				    "obsrvr",
+				    "intr",
+				    "cnfg";
+			qcom,channel = <0>;
+			qcom,ee = <0>;
+			interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "periph_irq";
+			interrupt-controller;
+			#interrupt-cells = <4>;
+			#address-cells = <2>;
+			#size-cells = <0>;
+		};
+
+		intc: interrupt-controller@17a00000 {
+			compatible = "arm,gic-v3";
+			reg = <0x0 0x17a00000 0x0 0x10000>,     /* GICD */
+			      <0x0 0x17a60000 0x0 0x100000>;    /* GICR * 8 */
+			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+			#interrupt-cells = <3>;
+			interrupt-controller;
+			#redistributor-regions = <1>;
+			redistributor-stride = <0x0 0x20000>;
+		};
+
+		sram: sram@146d8000 {
+			compatible = "qcom,qcs8300-imem", "syscon", "simple-mfd";
+			reg = <0x0 0x146d8000 0x0 0x1000>;
+
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			ranges = <0x0 0x0 0x146d8000 0x1000>;
+
+			pil-reloc@94c {
+				compatible = "qcom,pil-reloc-info";
+				reg = <0x94c 0xc8>;
+			};
+		};
+
+		apps_smmu: iommu@15000000 {
+			compatible = "qcom,qcs8300-smmu-500", "qcom,smmu-500", "arm,mmu-500";
+
+			reg = <0x0 0x15000000 0x0 0x100000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <2>;
+			dma-coherent;
+
+			interrupts = <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI  98 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI  99 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 109 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 183 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 185 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 315 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 316 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 336 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 337 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 338 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 340 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 342 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 343 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 344 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 345 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 396 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 397 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 398 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 399 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 401 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 402 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 403 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 404 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 409 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 418 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 419 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 412 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 421 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 706 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 423 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 424 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 425 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 689 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 690 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 691 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 692 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 693 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 694 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 695 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 696 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 410 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 411 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 420 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 413 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 422 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 707 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 708 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 709 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 710 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 711 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 414 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 712 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 713 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 714 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 715 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 912 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 911 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 910 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 909 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 908 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 907 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 906 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 905 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 904 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 903 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 902 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 901 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 900 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 899 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 898 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 897 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 896 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 895 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		pcie_smmu: iommu@15200000 {
+			compatible = "qcom,qcs8300-smmu-500", "qcom,smmu-500", "arm,mmu-500";
+			reg = <0x0 0x15200000 0x0 0x80000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <2>;
+			dma-coherent;
+
+			interrupts = <GIC_SPI 920 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 921 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 925 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 926 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 927 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 928 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 950 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 951 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 952 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 953 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 954 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 955 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 956 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 957 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 958 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 885 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 886 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 887 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 888 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 820 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 822 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 823 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 310 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 446 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 447 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 452 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 840 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 841 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 842 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 843 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 844 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 845 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 846 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 847 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 848 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 849 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 802 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 803 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 804 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 805 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 806 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 807 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 808 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 809 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 810 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 811 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 812 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 813 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 814 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 836 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 837 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 838 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 839 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 854 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 855 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 856 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 790 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 791 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 792 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 793 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 794 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 795 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 796 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 639 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 79 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 640 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		tcsr: syscon@1fc0000 {
+		       compatible = "qcom,qcs8300-tcsr", "syscon";
+		       reg = <0x0 0x1fc0000 0x0 0x30000>;
+		};
+
+		watchdog@17c10000 {
+			compatible = "qcom,apss-wdt-qcs8300", "qcom,kpss-wdt";
+			reg = <0x0 0x17c10000 0x0 0x1000>;
+			clocks = <&sleep_clk>;
+			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+		};
+
+		memtimer: timer@17c20000 {
+			compatible = "arm,armv7-timer-mem";
+			reg = <0x0 0x17c20000 0x0 0x1000>;
+			ranges = <0x0 0x0 0x0 0x20000000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			frame@17c21000 {
+				reg = <0x17c21000 0x1000>,
+				      <0x17c22000 0x1000>;
+				frame-number = <0>;
+				interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
+					     <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>;
+			};
+
+			frame@17c23000 {
+				reg = <0x17c23000 0x1000>;
+				frame-number = <1>;
+				interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c25000 {
+				reg = <0x17c25000 0x1000>;
+				frame-number = <2>;
+				interrupts = <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c27000 {
+				reg = <0x17c27000 0x1000>;
+				frame-number = <3>;
+				interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c29000 {
+				reg = <0x17c29000 0x1000>;
+				frame-number = <4>;
+				interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c2b000 {
+				reg = <0x17c2b000 0x1000>;
+				frame-number = <5>;
+				interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			frame@17c2d000 {
+				reg = <0x17c2d000 0x1000>;
+				frame-number = <6>;
+				interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+		};
+
+		apps_rsc: rsc@18200000 {
+			compatible = "qcom,rpmh-rsc";
+			reg = <0x0 0x18200000 0x0 0x10000>,
+			      <0x0 0x18210000 0x0 0x10000>,
+			      <0x0 0x18220000 0x0 0x10000>;
+			reg-names = "drv-0", "drv-1", "drv-2";
+			interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
+			qcom,tcs-offset = <0xd00>;
+			qcom,drv-id = <2>;
+			qcom,tcs-config = <ACTIVE_TCS 2>,
+					  <SLEEP_TCS 3>,
+					  <WAKE_TCS 3>,
+					  <CONTROL_TCS 0>;
+			label = "apps_rsc";
+			power-domains = <&SYSTEM_PD>;
+
+			apps_bcm_voter: bcm-voter {
+				compatible = "qcom,bcm-voter";
+			};
+
+			rpmhcc: clock-controller {
+				compatible = "qcom,sa8775p-rpmh-clk";
+				#clock-cells = <1>;
+				clocks = <&xo_board>;
+				clock-names = "xo";
+			};
+
+			rpmhpd: power-controller {
+				compatible = "qcom,qcs8300-rpmhpd";
+				#power-domain-cells = <1>;
+				operating-points-v2 = <&rpmhpd_opp_table>;
+
+				rpmhpd_opp_table: opp-table {
+					compatible = "operating-points-v2";
+
+					rpmhpd_opp_ret: opp-0 {
+						opp-level = <RPMH_REGULATOR_LEVEL_RETENTION>;
+					};
+
+					rpmhpd_opp_min_svs: opp-1 {
+						opp-level = <RPMH_REGULATOR_LEVEL_MIN_SVS>;
+					};
+
+					rpmhpd_opp_low_svs: opp2 {
+						opp-level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+					};
+
+					rpmhpd_opp_svs: opp3 {
+						opp-level = <RPMH_REGULATOR_LEVEL_SVS>;
+					};
+
+					rpmhpd_opp_svs_l1: opp-4 {
+						opp-level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+					};
+
+					rpmhpd_opp_nom: opp-5 {
+						opp-level = <RPMH_REGULATOR_LEVEL_NOM>;
+					};
+
+					rpmhpd_opp_nom_l1: opp-6 {
+						opp-level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+					};
+
+					rpmhpd_opp_nom_l2: opp-7 {
+						opp-level = <RPMH_REGULATOR_LEVEL_NOM_L2>;
+					};
+
+					rpmhpd_opp_turbo: opp-8 {
+						opp-level = <RPMH_REGULATOR_LEVEL_TURBO>;
+					};
+
+					rpmhpd_opp_turbo_l1: opp-9 {
+						opp-level = <RPMH_REGULATOR_LEVEL_TURBO_L1>;
+					};
+				};
+			};
+		};
+
+		epss_l3_cl0: interconnect@18590000 {
+			compatible = "qcom,sa8775p-epss-l3-cl0",
+				     "qcom,epss-l3";
+			reg = <0x0 0x18590000 0x0 0x1000>;
+			clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>;
+			clock-names = "xo", "alternate";
+			#interconnect-cells = <1>;
+		};
+
+		cpufreq_hw: cpufreq@18591000 {
+			compatible = "qcom,qcs8300-cpufreq-epss", "qcom,cpufreq-epss";
+			reg = <0x0 0x18591000 0x0 0x1000>,
+			      <0x0 0x18594000 0x0 0x1000>,
+			      <0x0 0x18593000 0x0 0x1000>;
+			reg-names = "freq-domain0", "freq-domain1", "freq-domain2";
+			interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "dcvsh-irq-0", "dcvsh-irq-1", "dcvsh-irq-2";
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>;
+			clock-names = "xo", "alternate";
+
+			#freq-domain-cells = <1>;
+		};
+
+		epss_l3_cl1: interconnect@18592000 {
+			compatible = "qcom,sa8775p-epss-l3-cl1",
+				     "qcom,epss-l3";
+			reg = <0x0 0x18592000 0x0 0x1000>;
+			clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>;
+			clock-names = "xo", "alternate";
+			#interconnect-cells = <1>;
+		};
+
+		remoteproc_gpdsp: remoteproc@20c00000 {
+			compatible = "qcom,qcs8300-gpdsp-pas";
+			reg = <0x0 0x20c00000 0x0 0x10000>;
+
+			interrupts-extended = <&intc GIC_SPI 768 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_gpdsp_in 0 0>,
+					      <&smp2p_gpdsp_in 2 0>,
+					      <&smp2p_gpdsp_in 1 0>,
+					      <&smp2p_gpdsp_in 3 0>;
+			interrupt-names = "wdog", "fatal", "handover",
+					  "ready", "stop-ack";
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "xo";
+
+			power-domains = <&rpmhpd RPMHPD_CX>,
+					<&rpmhpd RPMHPD_MXC>;
+			power-domain-names = "cx", "mxc";
+
+			interconnects = <&gpdsp_anoc MASTER_DSP0 0 &config_noc SLAVE_CLK_CTL 0>;
+
+			memory-region = <&gpdsp_mem>;
+
+			qcom,qmp = <&aoss_qmp>;
+
+			qcom,smem-states = <&smp2p_gpdsp_out 0>;
+			qcom,smem-state-names = "stop";
+
+			status = "disabled";
+
+			glink-edge {
+				interrupts-extended = <&ipcc IPCC_CLIENT_GPDSP0
+							     IPCC_MPROC_SIGNAL_GLINK_QMP
+							     IRQ_TYPE_EDGE_RISING>;
+				mboxes = <&ipcc IPCC_CLIENT_GPDSP0
+						IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+				label = "gpdsp";
+				qcom,remote-pid = <17>;
+			};
+		};
+
+		remoteproc_cdsp: remoteproc@26300000 {
+			compatible = "qcom,qcs8300-cdsp-pas";
+			reg = <0x0 0x26300000 0x0 0x10000>;
+
+			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp_in 3 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "wdog", "fatal", "ready",
+					  "handover", "stop-ack";
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "xo";
+
+			power-domains = <&rpmhpd RPMHPD_CX>,
+					<&rpmhpd RPMHPD_MXC>,
+					<&rpmhpd RPMHPD_NSP0>;
+
+			power-domain-names = "cx", "mxc", "nsp0";
+
+			interconnects = <&nspa_noc MASTER_CDSP_PROC 0 &mc_virt SLAVE_EBI1 0>;
+
+			memory-region = <&cdsp_mem>;
+
+			qcom,qmp = <&aoss_qmp>;
+
+			qcom,smem-states = <&smp2p_cdsp_out 0>;
+			qcom,smem-state-names = "stop";
+
+			status = "disabled";
+
+			glink-edge {
+				interrupts-extended = <&ipcc IPCC_CLIENT_CDSP
+							     IPCC_MPROC_SIGNAL_GLINK_QMP
+							     IRQ_TYPE_EDGE_RISING>;
+				mboxes = <&ipcc IPCC_CLIENT_CDSP
+						IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+				label = "cdsp";
+				qcom,remote-pid = <5>;
+
+				fastrpc {
+					compatible = "qcom,fastrpc";
+					qcom,glink-channels = "fastrpcglink-apps-dsp";
+					label = "cdsp";
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					compute-cb@1 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <1>;
+						iommus = <&apps_smmu 0x19c1 0x0440>,
+							 <&apps_smmu 0x1961 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@2 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <2>;
+						iommus = <&apps_smmu 0x19c2 0x0440>,
+							 <&apps_smmu 0x1962 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@3 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <3>;
+						iommus = <&apps_smmu 0x19c3 0x0440>,
+							 <&apps_smmu 0x1963 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@4 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <4>;
+						iommus = <&apps_smmu 0x19c4 0x0440>,
+							 <&apps_smmu 0x1964 0x0400>;
+						dma-coherent;
+					};
+				};
+			};
+		};
+
+		tlmm: pinctrl@f100000 {
+			compatible = "qcom,qcs8300-tlmm";
+			reg = <0x0 0x0f100000 0x0 0x300000>;
+			interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			gpio-ranges = <&tlmm 0 0 133>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+			wakeup-parent = <&pdc>;
+
+			qup_i2c0_data_clk: qup-i2c0-data-clk-state {
+				pins = "gpio17", "gpio18";
+				function = "qup0_se0";
+			};
+
+			qup_i2c1_data_clk: qup-i2c1-data-clk-state {
+				pins = "gpio19", "gpio20";
+				function = "qup0_se1";
+			};
+
+			qup_i2c2_data_clk: qup-i2c2-data-clk-state {
+				pins = "gpio33", "gpio34";
+				function = "qup0_se2";
+			};
+
+			qup_i2c3_data_clk: qup-i2c3-data-clk-state {
+				pins = "gpio25", "gpio26";
+				function = "qup0_se3";
+			};
+
+			qup_i2c4_data_clk: qup-i2c4-data-clk-state {
+				pins = "gpio29", "gpio30";
+				function = "qup0_se4";
+			};
+
+			qup_i2c5_data_clk: qup-i2c5-data-clk-state {
+				pins = "gpio21", "gpio22";
+				function = "qup0_se5";
+			};
+
+			qup_i2c6_data_clk: qup-i2c6-data-clk-state {
+				pins = "gpio80", "gpio81";
+				function = "qup0_se6";
+			};
+
+			qup_i2c8_data_clk: qup-i2c8-data-clk-state {
+				pins = "gpio37", "gpio38";
+				function = "qup1_se0";
+			};
+
+			qup_i2c9_data_clk: qup-i2c9-data-clk-state {
+				pins = "gpio39", "gpio40";
+				function = "qup1_se1";
+			};
+
+			qup_i2c10_data_clk: qup-i2c10-data-clk-state {
+				pins = "gpio84", "gpio85";
+				function = "qup1_se2";
+			};
+
+			qup_i2c11_data_clk: qup-i2c11-data-clk-state {
+				pins = "gpio41", "gpio42";
+				function = "qup1_se3";
+			};
+
+			qup_i2c12_data_clk: qup-i2c12-data-clk-state {
+				pins = "gpio45", "gpio46";
+				function = "qup1_se4";
+			};
+
+			qup_i2c13_data_clk: qup-i2c13-data-clk-state {
+				pins = "gpio49", "gpio50";
+				function = "qup1_se5";
+			};
+
+			qup_i2c14_data_clk: qup-i2c14-data-clk-state {
+				pins = "gpio89", "gpio90";
+				function = "qup1_se6";
+			};
+
+			qup_i2c15_data_clk: qup-i2c15-data-clk-state {
+				pins = "gpio91", "gpio92";
+				function = "qup1_se7";
+			};
+
+			qup_i2c16_data_clk: qup-i2c16-data-clk-state {
+				pins = "gpio10", "gpio11";
+				function = "qup2_se0";
+			};
+
+			qup_spi0_data_clk: qup-spi0-data-clk-state {
+				pins = "gpio17", "gpio18", "gpio19";
+				function = "qup0_se0";
+			};
+
+			qup_spi0_cs: qup-spi0-cs-state {
+				pins = "gpio20";
+				function = "qup0_se0";
+			};
+
+			qup_spi0_cs_gpio: qup-spi0-cs-gpio-state {
+				pins = "gpio20";
+				function = "gpio";
+			};
+
+			qup_spi1_data_clk: qup-spi1-data-clk-state {
+				pins = "gpio19", "gpio20", "gpio17";
+				function = "qup0_se1";
+			};
+
+			qup_spi1_cs: qup-spi1-cs-state {
+				pins = "gpio18";
+				function = "qup0_se1";
+			};
+
+			qup_spi1_cs_gpio: qup-spi1-cs-gpio-state {
+				pins = "gpio18";
+				function = "gpio";
+			};
+
+			qup_spi2_data_clk: qup-spi2-data-clk-state {
+				pins = "gpio33", "gpio34", "gpio35";
+				function = "qup0_se2";
+			};
+
+			qup_spi2_cs: qup-spi2-cs-state {
+				pins = "gpio36";
+				function = "qup0_se2";
+			};
+
+			qup_spi2_cs_gpio: qup-spi2-cs-gpio-state {
+				pins = "gpio36";
+				function = "gpio";
+			};
+
+			qup_spi3_data_clk: qup-spi3-data-clk-state {
+				pins = "gpio25", "gpio26", "gpio27";
+				function = "qup0_se3";
+			};
+
+			qup_spi3_cs: qup-spi3-cs-state {
+				pins = "gpio28";
+				function = "qup0_se3";
+			};
+
+			qup_spi3_cs_gpio: qup-spi3-cs-gpio-state {
+				pins = "gpio28";
+				function = "gpio";
+			};
+
+			qup_spi4_data_clk: qup-spi4-data-clk-state {
+				pins = "gpio29", "gpio30", "gpio31";
+				function = "qup0_se4";
+			};
+
+			qup_spi4_cs: qup-spi4-cs-state {
+				pins = "gpio32";
+				function = "qup0_se4";
+			};
+
+			qup_spi4_cs_gpio: qup-spi4-cs-gpio-state {
+				pins = "gpio32";
+				function = "gpio";
+			};
+
+			qup_spi5_data_clk: qup-spi5-data-clk-state {
+				pins = "gpio21", "gpio22", "gpio23";
+				function = "qup0_se5";
+			};
+
+			qup_spi5_cs: qup-spi5-cs-state {
+				pins = "gpio24";
+				function = "qup0_se5";
+			};
+
+			qup_spi5_cs_gpio: qup-spi5-cs-gpio-state {
+				pins = "gpio24";
+				function = "gpio";
+			};
+
+			qup_spi6_data_clk: qup-spi6-data-clk-state {
+				pins = "gpio80", "gpio81", "gpio82";
+				function = "qup0_se6";
+			};
+
+			qup_spi6_cs: qup-spi6-cs-state {
+				pins = "gpio83";
+				function = "qup0_se6";
+			};
+
+			qup_spi6_cs_gpio: qup-spi6-cs-gpio-state {
+				pins = "gpio83";
+				function = "gpio";
+			};
+
+			qup_spi8_data_clk: qup-spi8-data-clk-state {
+				pins = "gpio37", "gpio38", "gpio39";
+				function = "qup1_se0";
+			};
+
+			qup_spi8_cs: qup-spi8-cs-state {
+				pins = "gpio40";
+				function = "qup1_se0";
+			};
+
+			qup_spi8_cs_gpio: qup-spi8-cs-gpio-state {
+				pins = "gpio40";
+				function = "gpio";
+			};
+
+			qup_spi9_data_clk: qup-spi9-data-clk-state {
+				pins = "gpio39", "gpio40", "gpio37";
+				function = "qup1_se1";
+			};
+
+			qup_spi9_cs: qup-spi9-cs-state {
+				pins = "gpio38";
+				function = "qup1_se1";
+			};
+
+			qup_spi9_cs_gpio: qup-spi9-cs-gpio-state {
+				pins = "gpio38";
+				function = "gpio";
+			};
+
+			qup_spi10_data_clk: qup-spi10-data-clk-state {
+				pins = "gpio84", "gpio85", "gpio86";
+				function = "qup1_se2";
+			};
+
+			qup_spi10_cs: qup-spi10-cs-state {
+				pins = "gpio87";
+				function = "qup1_se2";
+			};
+
+			qup_spi10_cs_gpio: qup-spi10-cs-gpio-state {
+				pins = "gpio87";
+				function = "gpio";
+			};
+
+			qup_spi12_data_clk: qup-spi12-data-clk-state {
+				pins = "gpio45", "gpio46", "gpio47";
+				function = "qup1_se4";
+			};
+
+			qup_spi12_cs: qup-spi12-cs-state {
+				pins = "gpio48";
+				function = "qup1_se4";
+			};
+
+			qup_spi12_cs_gpio: qup-spi12-cs-gpio-state {
+				pins = "gpio48";
+				function = "gpio";
+			};
+
+			qup_spi13_data_clk: qup-spi13-data-clk-state {
+				pins = "gpio49", "gpio50", "gpio51";
+				function = "qup1_se5";
+			};
+
+			qup_spi13_cs: qup-spi13-cs-state {
+				pins = "gpio52";
+				function = "qup1_se5";
+			};
+
+			qup_spi13_cs_gpio: qup-spi13-cs-gpio-state {
+				pins = "gpio52";
+				function = "gpio";
+			};
+
+			qup_spi14_data_clk: qup-spi14-data-clk-state {
+				pins = "gpio89", "gpio90", "gpio91";
+				function = "qup1_se6";
+			};
+
+			qup_spi14_cs: qup-spi14-cs-state {
+				pins = "gpio92";
+				function = "qup1_se6";
+			};
+
+			qup_spi14_cs_gpio: qup-spi14-cs-gpio-state {
+				pins = "gpio92";
+				function = "gpio";
+			};
+
+			qup_spi15_data_clk: qup-spi15-data-clk-state {
+				pins = "gpio91", "gpio92", "gpio89";
+				function = "qup1_se7";
+			};
+
+			qup_spi15_cs: qup-spi15-cs-state {
+				pins = "gpio90";
+				function = "qup1_se7";
+			};
+
+			qup_spi15_cs_gpio: qup-spi15-cs-gpio-state {
+				pins = "gpio90";
+				function = "gpio";
+			};
+
+			qup_spi16_data_clk: qup-spi16-data-clk-state {
+				pins = "gpio10", "gpio11", "gpio12";
+				function = "qup2_se0";
+			};
+
+			qup_spi16_cs: qup-spi16-cs-state {
+				pins = "gpio13";
+				function = "qup2_se0";
+			};
+
+			qup_spi16_cs_gpio: qup-spi16-cs-gpio-state {
+				pins = "gpio13";
+				function = "gpio";
+			};
+
+			qup_uart0_cts: qup-uart0-cts-state {
+				pins = "gpio17";
+				function = "qup0_se0";
+			};
+
+			qup_uart0_rts: qup-uart0-rts-state {
+				pins = "gpio18";
+				function = "qup0_se0";
+			};
+
+			qup_uart0_tx: qup-uart0-tx-state {
+				pins = "gpio19";
+				function = "qup0_se0";
+			};
+
+			qup_uart0_rx: qup-uart0-rx-state {
+				pins = "gpio20";
+				function = "qup0_se0";
+			};
+
+			qup_uart1_cts: qup-uart1-cts-state {
+				pins = "gpio19";
+				function = "qup0_se1";
+			};
+
+			qup_uart1_rts: qup-uart1-rts-state {
+				pins = "gpio20";
+				function = "qup0_se1";
+			};
+
+			qup_uart1_tx: qup-uart1-tx-state {
+				pins = "gpio17";
+				function = "qup0_se1";
+			};
+
+			qup_uart1_rx: qup-uart1-rx-state {
+				pins = "gpio18";
+				function = "qup0_se1";
+			};
+
+			qup_uart2_cts: qup-uart2-cts-state {
+				pins = "gpio33";
+				function = "qup0_se2";
+			};
+
+			qup_uart2_rts: qup-uart2-rts-state {
+				pins = "gpio34";
+				function = "qup0_se2";
+			};
+
+			qup_uart2_tx: qup-uart2-tx-state {
+				pins = "gpio35";
+				function = "qup0_se2";
+			};
+
+			qup_uart2_rx: qup-uart2-rx-state {
+				pins = "gpio36";
+				function = "qup0_se2";
+			};
+
+			qup_uart3_cts: qup-uart3-cts-state {
+				pins = "gpio25";
+				function = "qup0_se3";
+			};
+
+			qup_uart3_rts: qup-uart3-rts-state {
+				pins = "gpio26";
+				function = "qup0_se3";
+			};
+
+			qup_uart3_tx: qup-uart3-tx-state {
+				pins = "gpio27";
+				function = "qup0_se3";
+			};
+
+			qup_uart3_rx: qup-uart3-rx-state {
+				pins = "gpio28";
+				function = "qup0_se3";
+			};
+
+			qup_uart4_cts: qup-uart4-cts-state {
+				pins = "gpio29";
+				function = "qup0_se4";
+			};
+
+			qup_uart4_rts: qup-uart4-rts-state {
+				pins = "gpio30";
+				function = "qup0_se4";
+			};
+
+			qup_uart4_tx: qup-uart4-tx-state {
+				pins = "gpio31";
+				function = "qup0_se4";
+			};
+
+			qup_uart4_rx: qup-uart4-rx-state {
+				pins = "gpio32";
+				function = "qup0_se4";
+			};
+
+			qup_uart5_cts: qup-uart5-cts-state {
+				pins = "gpio21";
+				function = "qup0_se5";
+			};
+
+			qup_uart5_rts: qup-uart5-rts-state {
+				pins = "gpio22";
+				function = "qup0_se5";
+			};
+
+			qup_uart5_tx: qup-uart5-tx-state {
+				pins = "gpio23";
+				function = "qup0_se5";
+			};
+
+			qup_uart5_rx: qup-uart5-rx-state {
+				pins = "gpio23";
+				function = "qup0_se5";
+			};
+
+			qup_uart6_cts: qup-uart6-cts-state {
+				pins = "gpio80";
+				function = "qup0_se6";
+			};
+
+			qup_uart6_rts: qup-uart6-rts-state {
+				pins = "gpio81";
+				function = "qup0_se6";
+			};
+
+			qup_uart6_tx: qup-uart6-tx-state {
+				pins = "gpio82";
+				function = "qup0_se6";
+			};
+
+			qup_uart6_rx: qup-uart6-rx-state {
+				pins = "gpio83";
+				function = "qup0_se6";
+			};
+
+			qup_uart7_tx: qup-uart7-tx-state {
+				pins = "gpio43";
+				function = "qup0_se7";
+			};
+
+			qup_uart7_rx: qup-uart7-rx-state {
+				pins = "gpio44";
+				function = "qup0_se7";
+			};
+
+			qup_uart8_cts: qup-uart8-cts-state {
+				pins = "gpio37";
+				function = "qup1_se0";
+			};
+
+			qup_uart8_rts: qup-uart8-rts-state {
+				pins = "gpio38";
+				function = "qup1_se0";
+			};
+
+			qup_uart8_tx: qup-uart8-tx-state {
+				pins = "gpio39";
+				function = "qup1_se0";
+			};
+
+			qup_uart8_rx: qup-uart8-rx-state {
+				pins = "gpio40";
+				function = "qup1_se0";
+			};
+
+			qup_uart9_cts: qup-uart9-cts-state {
+				pins = "gpio39";
+				function = "qup1_se1";
+			};
+
+			qup_uart9_rts: qup-uart9-rts-state {
+				pins = "gpio40";
+				function = "qup1_se1";
+			};
+
+			qup_uart9_tx: qup-uart9-tx-state {
+				pins = "gpio37";
+				function = "qup1_se1";
+			};
+
+			qup_uart9_rx: qup-uart9-rx-state {
+				pins = "gpio38";
+				function = "qup1_se1";
+			};
+
+			qup_uart10_cts: qup-uart10-cts-state {
+				pins = "gpio84";
+				function = "qup1_se2";
+			};
+
+			qup_uart10_rts: qup-uart10-rts-state {
+				pins = "gpio84";
+				function = "qup1_se2";
+			};
+
+			qup_uart10_tx: qup-uart10-tx-state {
+				pins = "gpio85";
+				function = "qup1_se2";
+			};
+
+			qup_uart10_rx: qup-uart10-rx-state {
+				pins = "gpio87";
+				function = "qup1_se2";
+			};
+
+			qup_uart11_tx: qup-uart11-tx-state {
+				pins = "gpio41";
+				function = "qup1_se3";
+			};
+
+			qup_uart11_rx: qup-uart11-rx-state {
+				pins = "gpio42";
+				function = "qup1_se3";
+			};
+
+			qup_uart12_cts: qup-uart12-cts-state {
+				pins = "gpio45";
+				function = "qup1_se4";
+			};
+
+			qup_uart12_rts: qup-uart12-rts-state {
+				pins = "gpio46";
+				function = "qup1_se4";
+			};
+
+			qup_uart12_tx: qup-uart12-tx-state {
+				pins = "gpio47";
+				function = "qup1_se4";
+			};
+
+			qup_uart12_rx: qup-uart12-rx-state {
+				pins = "gpio48";
+				function = "qup1_se4";
+			};
+
+			qup_uart13_cts: qup-uart13-cts-state {
+				pins = "gpio49";
+				function = "qup1_se5";
+			};
+
+			qup_uart13_rts: qup-uart13-rts-state {
+				pins = "gpio50";
+				function = "qup1_se5";
+			};
+
+			qup_uart13_tx: qup-uart13-tx-state {
+				pins = "gpio51";
+				function = "qup1_se5";
+			};
+
+			qup_uart13_rx: qup-uart13-rx-state {
+				pins = "gpio52";
+				function = "qup1_se5";
+			};
+
+			qup_uart14_cts: qup-uart14-cts-state {
+				pins = "gpio89";
+				function = "qup1_se6";
+			};
+
+			qup_uart14_rts: qup-uart14-rts-state {
+				pins = "gpio90";
+				function = "qup1_se6";
+			};
+
+			qup_uart14_tx: qup-uart14-tx-state {
+				pins = "gpio91";
+				function = "qup1_se6";
+			};
+
+			qup_uart14_rx: qup-uart14-rx-state {
+				pins = "gpio92";
+				function = "qup1_se6";
+			};
+
+			qup_uart15_cts: qup-uart15-cts-state {
+				pins = "gpio91";
+				function = "qup1_se7";
+			};
+
+			qup_uart15_rts: qup-uart15-rts-state {
+				pins = "gpio92";
+				function = "qup1_se7";
+			};
+
+			qup_uart15_tx: qup-uart15-tx-state {
+				pins = "gpio89";
+				function = "qup1_se7";
+			};
+
+			qup_uart15_rx: qup-uart15-rx-state {
+				pins = "gpio90";
+				function = "qup1_se7";
+			};
+
+			qup_uart16_cts: qup-uart16-cts-state {
+				pins = "gpio10";
+				function = "qup2_se0";
+			};
+
+			qup_uart16_rts: qup-uart16-rts-state {
+				pins = "gpio11";
+				function = "qup2_se0";
+			};
+
+			qup_uart16_tx: qup-uart16-tx-state {
+				pins = "gpio12";
+				function = "qup2_se0";
+			};
+
+			qup_uart16_rx: qup-uart16-rx-state {
+				pins = "gpio13";
+				function = "qup2_se0";
+			};
+		};
+
+		stm@4002000 {
+			compatible = "arm,coresight-stm", "arm,primecell";
+			reg = <0x0 0x4002000 0x0 0x1000>,
+			      <0x0 0x16280000 0x0 0x180000>;
+			reg-names = "stm-base", "stm-stimulus-base";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					stm_out: endpoint {
+						remote-endpoint =
+						<&funnel0_in7>;
+					};
+				};
+			};
+		};
+
+		tpdm@4003000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4003000 0x0 0x1000>;
+			device-name = "tpdm_dcc";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					qdss_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&qdss_tpda_in0>;
+					};
+				};
+			};
+		};
+
+		tpda@4004000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4004000 0x0 0x1000>;
+			device-name = "tpda_qdss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					qdss_tpda_out: endpoint {
+						remote-endpoint =
+						<&funnel0_in6>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					qdss_tpda_in0: endpoint {
+						remote-endpoint =
+						<&qdss_tpdm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					qdss_tpda_in1: endpoint {
+						remote-endpoint =
+						<&qdss_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@400f000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x400f000 0x0 0x1000>;
+			device-name = "tpdm_spdm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					qdss_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&qdss_tpda_in1>;
+					};
+				};
+			};
+		};
+
+		cti@4010000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4010000 0x0 0x1000>;
+			device-name = "cti_qdss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4041000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4041000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					funnel0_out: endpoint {
+						remote-endpoint =
+						<&qdss_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@6 {
+					reg = <6>;
+					funnel0_in6: endpoint {
+						remote-endpoint =
+						<&qdss_tpda_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+					funnel0_in7: endpoint {
+						remote-endpoint =
+						<&stm_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4042000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4042000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					funnel1_out: endpoint {
+						remote-endpoint =
+						<&qdss_funnel_in1>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@4 {
+					reg = <4>;
+					funnel1_in4: endpoint {
+						remote-endpoint =
+						<&apss_funnel1_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+					funnel1_in5: endpoint {
+						remote-endpoint =
+						<&dlct0_funnel_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					funnel1_in6: endpoint {
+						remote-endpoint =
+						<&dlmm_funnel_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+					funnel1_in7: endpoint {
+						remote-endpoint =
+						<&dlst_ch_funnel_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4045000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4045000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					qdss_funnel_out: endpoint {
+						remote-endpoint =
+						<&aoss_funnel_in7>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					qdss_funnel_in0: endpoint {
+						remote-endpoint =
+						<&funnel0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					qdss_funnel_in1: endpoint {
+						remote-endpoint =
+						<&funnel1_out>;
+					};
+				};
+			};
+		};
+
+		replicator@4046000 {
+			compatible = "arm,coresight-dynamic-replicator", "arm,primecell";
+			reg = <0x0 0x4046000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					qdss_rep_out0: endpoint {
+						remote-endpoint =
+						<&etr_rep_in>;
+					};
+				};
+			};
+
+			in-ports {
+				port {
+					qdss_rep_in: endpoint {
+						remote-endpoint =
+						<&swao_rep_out0>;
+					};
+				};
+			};
+		};
+
+		tmc_etr: tmc@4048000 {
+			compatible = "arm,coresight-tmc", "arm,primecell";
+			reg = <0x0 0x4048000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			iommus = <&apps_smmu 0x04c0 0x00>;
+
+			arm,scatter-gather;
+
+			in-ports {
+				port {
+					etr0_in: endpoint {
+						remote-endpoint =
+						<&etr_rep_out0>;
+					};
+				};
+			};
+		};
+
+		replicator@404e000 {
+			compatible = "arm,coresight-dynamic-replicator", "arm,primecell";
+			reg = <0x0 0x404e000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					etr_rep_out0: endpoint {
+						remote-endpoint =
+						<&etr0_in>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					etr_rep_out1: endpoint {
+						remote-endpoint =
+						<&etr1_in>;
+					};
+				};
+			};
+
+			in-ports {
+				port {
+					etr_rep_in: endpoint {
+						remote-endpoint =
+						<&qdss_rep_out0>;
+					};
+				};
+			};
+		};
+
+		tmc_etr1: tmc@404f000 {
+			compatible = "arm,coresight-tmc", "arm,primecell";
+			reg = <0x0 0x404f000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			iommus = <&apps_smmu 0x04a0 0x40>;
+
+			arm,scatter-gather;
+			arm,buffer-size = <0x400000>;
+
+			in-ports {
+				port {
+					etr1_in: endpoint {
+						remote-endpoint =
+						<&etr_rep_out1>;
+					};
+				};
+			};
+		};
+
+		tpdm@482c000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x482c000 0x0 0x1000>;
+			device-name = "tpdm_gcc";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					gcc_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in20>;
+					};
+				};
+			};
+		};
+
+		cti@4831000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4831000 0x0 0x1000>;
+			device-name = "cti_venus";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+			status = "disabled";
+		};
+
+		tpdm@4841000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4841000 0x0 0x1000>;
+			device-name = "tpdm_prng";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					prng_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in19>;
+					};
+				};
+			};
+		};
+
+		cti@4845000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4845000 0x0 0x1000>;
+			device-name = "cti_lpass";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpdm@4850000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4850000 0x0 0x1000>;
+			device-name = "tpdm_pimem";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					pimem_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in25>;
+					};
+				};
+			};
+		};
+
+		tpdm@4860000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4860000 0x0 0x1000>;
+			device-name = "tpdm_dl_ch_south";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					dlst_ch_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&dlst_ch_tpda_in8>;
+					};
+				};
+			};
+		};
+
+		tpdm@4861000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4861000 0x0 0x1000>;
+			device-name = "tpdm_dl_ch_south_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlst_ch_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&dlst_ch_tpda_in9>;
+					};
+				};
+			};
+		};
+
+		cti@4862000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4862000 0x0 0x1000>;
+			device-name = "cti_dl_ch_south";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		cti@4863000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4863000 0x0 0x1000>;
+			device-name = "cti_dl_ch_south_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4864000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4864000 0x0 0x1000>;
+			device-name = "tpda_dlst_ch";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlst_ch_tpda_out: endpoint {
+						remote-endpoint =
+						<&dlst_ch_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@8 {
+					reg = <8>;
+					dlst_ch_tpda_in8: endpoint {
+						remote-endpoint =
+						<&dlst_ch_tpdm0_out>;
+					};
+				};
+
+				port@9 {
+					reg = <9>;
+					dlst_ch_tpda_in9: endpoint {
+						remote-endpoint =
+						<&dlst_ch_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4865000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4865000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlst_ch_funnel_out: endpoint {
+						remote-endpoint =
+						<&funnel1_in7>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlst_ch_funnel_in0: endpoint {
+						remote-endpoint =
+						<&dlst_ch_tpda_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					dlst_ch_funnel_in4: endpoint {
+						remote-endpoint =
+						<&dlst_funnel_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					dlst_ch_funnel_in6: endpoint {
+						remote-endpoint =
+						<&gdsp_funnel_out>;
+					};
+				};
+			};
+		};
+
+		cti@4901000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4901000 0x0 0x1000>;
+			device-name = "cti_gfx";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4940000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4940000 0x0 0x1000>,
+			      <0x0 0x4b87000 0x0 0x1000>;
+			reg-names = "funnel-base-dummy", "funnel-base-real";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,duplicate-funnel;
+			arm,primecell-periphid = <0x000bb908>;
+
+			out-ports {
+				port {
+					turing0_dup_funnel_out: endpoint {
+						remote-endpoint =
+						<&turing0_funnel_in4>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@3 {
+					reg = <3>;
+					turing0_dup_funnel_in3: endpoint {
+						remote-endpoint =
+						<&turing0_etm0_out>;
+					};
+				};
+			};
+		};
+
+		cti@4961000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4961000 0x0 0x1000>;
+			device-name = "cti_gfx_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+		};
+
+		cti@4962000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4962000 0x0 0x1000>;
+			device-name = "cti_gfx_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+		};
+
+		tpdm@4980000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4980000 0x0 0x1000>;
+			device-name = "tpdm_turing";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					turing2_tpdm_out: endpoint {
+						remote-endpoint =
+						<&turing2_funnel_in0>;
+					};
+				};
+			};
+		};
+
+		cti@4982000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4982000 0x0 0x1000>;
+			device-name = "cti_turing";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4983000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4983000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					turing2_funnel_out0: endpoint {
+						remote-endpoint =
+						<&gdsp_tpda_in5>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					turing2_funnel_in0: endpoint {
+						remote-endpoint =
+						<&turing2_tpdm_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@49ca000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x49ca000 0x0 0x1000>;
+			device-name = "tpdm_sdcc_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					sdcc_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlst_tpda_in1>;
+					};
+				};
+			};
+		};
+
+		tpdm@49c0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x49c0000 0x0 0x1000>;
+			device-name = "tpdm_rdpm_mxa";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					rdpm_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in23>;
+					};
+				};
+			};
+		};
+
+		tpdm@49d0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x49d0000 0x0 0x1000>;
+			device-name = "tpdm_qm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					qm_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in21>;
+					};
+				};
+			};
+		};
+
+		tpdm@4ac0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4ac0000 0x0 0x1000>;
+			device-name = "tpdm_mmnoc_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					dlmm_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&dlmm_tpda_in27>;
+					};
+				};
+			};
+		};
+
+		tpdm@4ac1000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4ac1000 0x0 0x1000>;
+			device-name = "tpdm_mmnoc_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlmm_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&dlmm_tpda_in28>;
+					};
+				};
+			};
+		};
+
+		cti@4ac2000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4ac2000 0x0 0x1000>;
+			device-name = "cti_mmnoc_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		cti@4ac3000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4ac3000 0x0 0x1000>;
+			device-name = "cti_mmnoc_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4ac4000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4ac4000 0x0 0x1000>;
+			device-name = "tpda_dlmm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlmm_tpda_out: endpoint {
+						remote-endpoint =
+						<&dlmm_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@8 {
+					reg = <8>;
+					dlmm_tpda_in8: endpoint {
+						remote-endpoint =
+						<&mdss1_tpdm_out>;
+					};
+				};
+
+				port@1b {
+					reg = <27>;
+					dlmm_tpda_in27: endpoint {
+						remote-endpoint =
+						<&dlmm_tpdm0_out>;
+					};
+				};
+
+				port@1c {
+					reg = <28>;
+					dlmm_tpda_in28: endpoint {
+						remote-endpoint =
+						<&dlmm_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4ac5000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4ac5000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlmm_funnel_out: endpoint {
+						remote-endpoint =
+						<&funnel1_in6>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlmm_funnel_in0: endpoint {
+						remote-endpoint =
+						<&dlmm_tpda_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4ad0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4ad0000 0x0 0x1000>;
+			device-name = "tpdm_dlct";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					dlct0_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in26>;
+					};
+				};
+			};
+		};
+
+		tpdm@4ad1000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4ad1000 0x0 0x1000>;
+			device-name = "tpdm_ipcc";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlct0_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in27>;
+					};
+				};
+			};
+		};
+
+		cti@4ad2000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4ad2000 0x0 0x1000>;
+			device-name = "cti_dlct";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4ad3000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4ad3000 0x0 0x1000>;
+			device-name = "tpda_dlct0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlct0_tpda_out: endpoint {
+						remote-endpoint =
+						<&dlct0_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@13 {
+					reg = <19>;
+					dlct0_tpda_in19: endpoint {
+						remote-endpoint =
+						<&prng_tpdm_out>;
+					};
+				};
+
+				port@14 {
+					reg = <20>;
+					dlct0_tpda_in20: endpoint {
+						remote-endpoint =
+						<&gcc_tpdm_out>;
+					};
+				};
+
+				port@15 {
+					reg = <21>;
+					dlct0_tpda_in21: endpoint {
+						remote-endpoint =
+						<&qm_tpdm_out>;
+					};
+				};
+
+				port@17 {
+					reg = <23>;
+					dlct0_tpda_in23: endpoint {
+						remote-endpoint =
+						<&rdpm_tpdm_out>;
+					};
+				};
+
+				port@19 {
+					reg = <25>;
+					dlct0_tpda_in25: endpoint {
+						remote-endpoint =
+						<&pimem_tpdm_out>;
+					};
+				};
+
+				port@1a {
+					reg = <26>;
+					dlct0_tpda_in26: endpoint {
+						remote-endpoint =
+						<&dlct0_tpdm0_out>;
+					};
+				};
+
+				port@1b {
+					reg = <27>;
+					dlct0_tpda_in27: endpoint {
+						remote-endpoint =
+						<&dlct0_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4ad4000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4ad4000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlct0_funnel_out: endpoint {
+						remote-endpoint =
+						<&funnel1_in5>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlct0_funnel_in0: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					dlct0_funnel_in4: endpoint {
+						remote-endpoint =
+						<&ddr_funnel5_out>;
+					};
+				};
+			};
+		};
+
+		cti@4b00000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b00000 0x0 0x1000>;
+			device-name = "cti_swao";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4b04000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4b04000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					aoss_funnel_out: endpoint {
+						remote-endpoint =
+						<&etf0_in>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@5 {
+					reg = <5>;
+					aoss_funnel_in5: endpoint {
+						remote-endpoint =
+						<&lpi_funnel_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					aoss_funnel_in6: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+					aoss_funnel_in7: endpoint {
+						remote-endpoint =
+						<&qdss_funnel_out>;
+					};
+				};
+			};
+		};
+
+		tmc_etf: tmc@4b05000 {
+			compatible = "arm,coresight-tmc", "arm,primecell";
+			reg = <0x0 0x4b05000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					etf0_out: endpoint {
+						remote-endpoint =
+						<&swao_rep_in>;
+					};
+				};
+			};
+
+			in-ports {
+				port {
+					etf0_in: endpoint {
+						remote-endpoint =
+						<&aoss_funnel_out>;
+					};
+				};
+			};
+		};
+
+		replicator@4b06000 {
+			compatible = "arm,coresight-dynamic-replicator", "arm,primecell";
+			reg = <0x0 0x4b06000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					swao_rep_out0: endpoint {
+						remote-endpoint =
+						<&qdss_rep_in>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					swao_rep_out1: endpoint {
+						remote-endpoint =
+						<&eud_in>;
+					};
+				};
+			};
+
+			in-ports {
+				port {
+					swao_rep_in: endpoint {
+						remote-endpoint =
+						<&etf0_out>;
+					};
+				};
+			};
+		};
+
+		tpda@4b08000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4b08000 0x0 0x1000>;
+			device-name = "tpda_aoss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					aoss_tpda_out: endpoint {
+						remote-endpoint =
+						<&aoss_funnel_in6>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					aoss_tpda_in0: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					aoss_tpda_in1: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm1_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					aoss_tpda_in2: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm2_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					aoss_tpda_in3: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm3_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					aoss_tpda_in4: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm4_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b09000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b09000 0x0 0x1000>;
+			device-name = "tpdm_swao_prio_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in0>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b0a000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b0a000 0x0 0x1000>;
+			device-name = "tpdm_swao_prio_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in1>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b0b000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b0b000 0x0 0x1000>;
+			device-name = "tpdm_swao_prio_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm2_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in2>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b0c000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b0c000 0x0 0x1000>;
+			device-name = "tpdm_swao_prio_3";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm3_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in3>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b0d000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b0d000 0x0 0x1000>;
+			device-name = "tpdm_swao_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm4_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in4>;
+					};
+				};
+			};
+		};
+
+		cti@4b13000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b13000 0x0 0x1000>;
+			device-name = "cti_aoss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@4b41000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b41000 0x0 0x1000>;
+			device-name = "cti_lpass_core";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+		};
+
+		tpdm@4b46000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b46000 0x0 0x1000>;
+			device-name = "tpdm_lpass_lpi";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					lpi_tpdm_out: endpoint {
+						remote-endpoint =
+						<&lpi_tpda_in>;
+					};
+				};
+			};
+		};
+
+		tpda@4b47000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4b47000 0x0 0x1000>;
+			device-name = "tpda_lpi";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+
+			out-ports {
+				port {
+					lpi_tpda_out: endpoint {
+						remote-endpoint =
+						<&lpi_funnel_in5>;
+					};
+				};
+			};
+
+			in-ports {
+				port {
+					lpi_tpda_in: endpoint {
+						remote-endpoint =
+						<&lpi_tpdm_out>;
+					};
+				};
+			};
+		};
+
+		cti@4b4b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b4b000 0x0 0x1000>;
+			device-name = "cti_lpass_lpi";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+		};
+
+		tpdm@4b80000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b80000 0x0 0x1000>;
+			device-name = "tpdm_turing_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					turing0_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&turing0_tpda_in0>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b81000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b81000 0x0 0x1000>;
+			device-name = "tpdm_turing_llm_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					turing0_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&turing0_tpda_in1>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b82000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b82000 0x0 0x1000>;
+			device-name = "tpdm_turing_llm_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					turing0_tpdm2_out: endpoint {
+						remote-endpoint =
+						<&turing0_tpda_in2>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b83000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b83000 0x0 0x1000>;
+			device-name = "tpdm_turing_llm_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					turing0_tpdm3_out: endpoint {
+						remote-endpoint =
+						<&turing0_tpda_in3>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b84000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b84000 0x0 0x1000>;
+			device-name = "tpdm_turing_llm_3";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					turing0_tpdm4_out: endpoint {
+						remote-endpoint =
+						<&turing0_tpda_in4>;
+					};
+				};
+			};
+		};
+
+		cti@4b85000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b85000 0x0 0x1000>;
+			device-name = "cti_turing_llm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4b86000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4b86000 0x0 0x1000>;
+			device-name = "tpda_turing0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					turing0_tpda_out: endpoint {
+						remote-endpoint =
+						<&turing0_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					turing0_tpda_in0: endpoint {
+						remote-endpoint =
+						<&turing0_tpdm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					turing0_tpda_in1: endpoint {
+						remote-endpoint =
+						<&turing0_tpdm1_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					turing0_tpda_in2: endpoint {
+						remote-endpoint =
+						<&turing0_tpdm2_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					turing0_tpda_in3: endpoint {
+						remote-endpoint =
+						<&turing0_tpdm3_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					turing0_tpda_in4: endpoint {
+						remote-endpoint =
+						<&turing0_tpdm4_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4b87000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4b87000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					turing0_funnel_out: endpoint {
+						remote-endpoint =
+						<&gdsp_funnel_in4>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					turing0_funnel_in0: endpoint {
+						remote-endpoint =
+						<&turing0_tpda_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					turing0_funnel_in4: endpoint {
+						remote-endpoint =
+						<&turing0_etm0_out>;
+					};
+				};
+			};
+		};
+
+		cti@4b8b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b8b000 0x0 0x1000>;
+			device-name = "cti_turing_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@4c40000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c40000 0x0 0x1000>;
+			device-name = "tpdm_gpdsp_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					gdsp_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&gdsp_tpda_in8>;
+					};
+				};
+			};
+		};
+
+		tpdm@4c41000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c41000 0x0 0x1000>;
+			device-name = "tpdm_gpdsp_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					gdsp_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&gdsp_tpda_in9>;
+					};
+				};
+			};
+		};
+
+		cti@4c42000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c42000 0x0 0x1000>;
+			device-name = "cti_gpdsp_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		cti@4c43000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c43000 0x0 0x1000>;
+			device-name = "cti_gpdsp_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4c44000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4c44000 0x0 0x1000>;
+			device-name = "tpda_gpdsp";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					gdsp_tpda_out: endpoint {
+						remote-endpoint =
+						<&gdsp_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@5 {
+					reg = <5>;
+					gdsp_tpda_in5: endpoint {
+						remote-endpoint =
+						<&turing2_funnel_out0>;
+					};
+				};
+
+				port@8 {
+					reg = <8>;
+					gdsp_tpda_in8: endpoint {
+						remote-endpoint =
+						<&gdsp_tpdm0_out>;
+					};
+				};
+
+				port@9 {
+					reg = <9>;
+					gdsp_tpda_in9: endpoint {
+						remote-endpoint =
+						<&gdsp_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4c45000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4c45000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					gdsp_funnel_out: endpoint {
+						remote-endpoint =
+						<&dlst_ch_funnel_in6>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					gdsp_funnel_in0: endpoint {
+						remote-endpoint =
+						<&gdsp_tpda_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					gdsp_funnel_in4: endpoint {
+						remote-endpoint =
+						<&turing0_funnel_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4c50000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c50000 0x0 0x1000>;
+			device-name = "tpdm_dl_south";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					dlst_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&dlst_tpda_in8>;
+					};
+				};
+			};
+		};
+
+		tpdm@4c51000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c51000 0x0 0x1000>;
+			device-name = "tpdm_dl_south_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlst_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&dlst_tpda_in9>;
+					};
+				};
+			};
+		};
+
+		cti@4c52000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c52000 0x0 0x1000>;
+			device-name = "cti_dl_south";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		cti@4c53000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c53000 0x0 0x1000>;
+			device-name = "cti_dl_south_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4c54000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4c54000 0x0 0x1000>;
+			device-name = "tpda_dlst";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlst_tpda_out: endpoint {
+						remote-endpoint =
+						<&dlst_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@1 {
+					reg = <1>;
+					dlst_tpda_in1: endpoint {
+						remote-endpoint =
+						<&sdcc_tpdm_out>;
+					};
+				};
+
+				port@8 {
+					reg = <8>;
+					dlst_tpda_in8: endpoint {
+						remote-endpoint =
+						<&dlst_tpdm0_out>;
+					};
+				};
+
+				port@9 {
+					reg = <9>;
+					dlst_tpda_in9: endpoint {
+						remote-endpoint =
+						<&dlst_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4c55000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4c55000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlst_funnel_out: endpoint {
+						remote-endpoint =
+						<&dlst_ch_funnel_in4>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlst_funnel_in0: endpoint {
+						remote-endpoint =
+						<&dlst_tpda_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4c70000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c70000 0x0 0x1000>;
+			device-name = "tpdm_mdss_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					mdss1_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlmm_tpda_in8>;
+					};
+				};
+			};
+		};
+
+		cti@4c71000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c71000 0x0 0x1000>;
+			device-name = "cti_mdss_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+			status = "disabled";
+		};
+
+		tpdm@4e00000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4e00000 0x0 0x1000>;
+			device-name = "tpdm_ddr";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					ddr_tpdm3_out: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_in4>;
+					};
+				};
+			};
+		};
+
+		tpdm@4e01000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4e01000 0x0 0x1000>;
+			device-name = "tpdm_shrm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					ddr_tpdm4_out: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_in5>;
+					};
+				};
+			};
+		};
+
+		cti@4e02000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e02000 0x0 0x1000>;
+			device-name = "cti_ddr";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4e03000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4e03000 0x0 0x1000>;
+			device-name = "tpda_ddr";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					ddr_tpda_out: endpoint {
+						remote-endpoint =
+						<&ddr_funnel5_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_tpda_in0: endpoint {
+						remote-endpoint =
+						<&ddr_funnel0_out0>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					ddr_tpda_in1: endpoint {
+						remote-endpoint =
+						<&ddr_funnel1_out0>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					ddr_tpda_in4: endpoint {
+						remote-endpoint =
+						<&ddr_tpdm3_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+					ddr_tpda_in5: endpoint {
+						remote-endpoint =
+						<&ddr_tpdm4_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4e04000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4e04000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					ddr_funnel5_out: endpoint {
+						remote-endpoint =
+						<&dlct0_funnel_in4>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel5_in0: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_out>;
+					};
+				};
+			};
+		};
+
+		cti@4e0c000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e0c000 0x0 0x1000>;
+			device-name = "cti_ddr_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpdm@4e10000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4e10000 0x0 0x1000>;
+			device-name = "tpdm_ddr_ch0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					ddr_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&ddr_funnel0_in0>;
+					};
+				};
+			};
+		};
+
+		cti@4e11000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e11000 0x0 0x1000>;
+			device-name = "cti_ddr_ch0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4e12000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4e12000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					ddr_funnel0_out0: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel0_in0: endpoint {
+						remote-endpoint =
+						<&ddr_tpdm0_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4e20000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4e20000 0x0 0x1000>;
+			device-name = "tpdm_ddr_ch1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					ddr_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&ddr_funnel1_in0>;
+					};
+				};
+			};
+		};
+
+		cti@4e21000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e21000 0x0 0x1000>;
+			device-name = "cti_ddr_ch1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4e22000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4e22000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					ddr_funnel1_out0: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_in1>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel1_in0: endpoint {
+						remote-endpoint =
+						<&ddr_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		cti@4e34000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e34000 0x0 0x1000>;
+			device-name = "cti_ddr_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		etm@6040000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6040000 0x0 0x1000>;
+			cpu = <&CPU0>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm0_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in0>;
+					};
+				};
+			};
+		};
+
+		etm@6140000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6140000 0x0 0x1000>;
+			cpu = <&CPU1>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm1_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in1>;
+					};
+				};
+			};
+		};
+
+		etm@6240000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6240000 0x0 0x1000>;
+			cpu = <&CPU2>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm2_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in2>;
+					};
+				};
+			};
+		};
+
+		etm@6340000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6340000 0x0 0x1000>;
+			cpu = <&CPU3>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm3_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in3>;
+					};
+				};
+			};
+		};
+
+		etm@6440000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6440000 0x0 0x1000>;
+			cpu = <&CPU4>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm4_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in4>;
+					};
+				};
+			};
+		};
+
+		etm@6540000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6540000 0x0 0x1000>;
+			cpu = <&CPU5>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm5_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in5>;
+					};
+				};
+			};
+		};
+
+		etm@6640000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6640000 0x0 0x1000>;
+			cpu = <&CPU6>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm6_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in6>;
+					};
+				};
+			};
+		};
+
+		etm@6740000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6740000 0x0 0x1000>;
+			cpu = <&CPU7>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm7_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in7>;
+					};
+				};
+			};
+		};
+
+		funnel@6800000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x6800000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					apss_funnel0_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel1_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					apss_funnel0_in0: endpoint {
+						remote-endpoint =
+						<&etm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					apss_funnel0_in1: endpoint {
+						remote-endpoint =
+						<&etm1_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					apss_funnel0_in2: endpoint {
+						remote-endpoint =
+						<&etm2_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					apss_funnel0_in3: endpoint {
+						remote-endpoint =
+						<&etm3_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					apss_funnel0_in4: endpoint {
+						remote-endpoint =
+						<&etm4_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+					apss_funnel0_in5: endpoint {
+						remote-endpoint =
+						<&etm5_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					apss_funnel0_in6: endpoint {
+						remote-endpoint =
+						<&etm6_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+					apss_funnel0_in7: endpoint {
+						remote-endpoint =
+						<&etm7_out>;
+					};
+				};
+			};
+		};
+
+		funnel@6810000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x6810000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					apss_funnel1_out: endpoint {
+						remote-endpoint =
+						<&funnel1_in4>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					apss_funnel1_in0: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					apss_funnel1_in3: endpoint {
+						remote-endpoint =
+						<&apss_tpda_out>;
+					};
+				};
+			};
+		};
+
+		cti@682b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x682b000 0x0 0x1000>;
+			device-name = "cti_apss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@6860000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x6860000 0x0 0x1000>;
+			device-name = "tpdm_actpm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					apss_tpdm3_out: endpoint {
+						remote-endpoint =
+						<&apss_tpda_in3>;
+					};
+				};
+			};
+		};
+
+		tpdm@6861000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x6861000 0x0 0x1000>;
+			device-name = "tpdm_apss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					apss_tpdm4_out: endpoint {
+						remote-endpoint =
+						<&apss_tpda_in4>;
+					};
+				};
+			};
+		};
+
+		cti@6862000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x6862000 0x0 0x1000>;
+			device-name = "cti_apss_riscv";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@6863000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x6863000 0x0 0x1000>;
+			device-name = "tpda_apss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					apss_tpda_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel1_in3>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					apss_tpda_in0: endpoint {
+						remote-endpoint =
+						<&apss_tpdm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					apss_tpda_in1: endpoint {
+						remote-endpoint =
+						<&apss_tpdm1_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					apss_tpda_in2: endpoint {
+						remote-endpoint =
+						<&apss_tpdm2_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					apss_tpda_in3: endpoint {
+						remote-endpoint =
+						<&apss_tpdm3_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					apss_tpda_in4: endpoint {
+						remote-endpoint =
+						<&apss_tpdm4_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@68a0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x68a0000 0x0 0x1000>;
+			device-name = "tpdm_llm_gold";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					apss_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&apss_tpda_in1>;
+					};
+				};
+			};
+		};
+
+		tpdm@68b0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x68b0000 0x0 0x1000>;
+			device-name = "tpdm_llm_silver";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					apss_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&apss_tpda_in0>;
+					};
+				};
+			};
+		};
+
+		tpdm@68c0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x68c0000 0x0 0x1000>;
+			device-name = "tpdm_ext_dsb";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					apss_tpdm2_out: endpoint {
+						remote-endpoint =
+						<&apss_tpda_in2>;
+					};
+				};
+			};
+		};
+
+		cti@68e0000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x68e0000 0x0 0x1000>;
+			device-name = "cti_llm_gold";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@68f0000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x68f0000 0x0 0x1000>;
+			device-name = "cti_llm_silver";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6900000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x6900000 0x0 0x1000>;
+			device-name = "cti_ext_dsb";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+	};
+
+	lpass-stm {
+		compatible = "arm,coresight-dummy-source";
+		device-name = "stm_lpass";
+
+		arm,trace-id = <25>;
+
+		out-ports {
+			port {
+				lpass_stm_out: endpoint {
+					remote-endpoint =
+					<&lpi_funnel_in1>;
+				};
+			};
+		};
+	};
+
+	lpi_funnel {
+		compatible = "arm,coresight-static-funnel";
+
+		out-ports {
+			port {
+				lpi_funnel_out: endpoint {
+					remote-endpoint =
+						<&aoss_funnel_in5>;
+				};
+			};
+		};
+
+		in-ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				lpi_funnel_in0: endpoint {
+					remote-endpoint =
+					<&audio_out>;
+				};
+			};
+
+			port@1 {
+				reg = <1>;
+				lpi_funnel_in1: endpoint {
+					remote-endpoint =
+					<&lpass_stm_out>;
+				};
+			};
+
+			port@5 {
+				reg = <5>;
+				lpi_funnel_in5: endpoint {
+					remote-endpoint =
+					<&lpi_tpda_out>;
+				};
+			};
+		};
+	};
+
+	usb_qmpphy: phy@88e8000 {
+		compatible = "qcom,qcs8300-qmp-usb3-uni-phy";
+		reg = <0x0 0x8907000 0x0 0x2000>;
+
+		clocks = <&gcc GCC_USB3_PRIM_PHY_AUX_CLK>,
+			 <&gcc GCC_USB_CLKREF_EN>,
+			 <&gcc GCC_USB3_PRIM_PHY_COM_AUX_CLK>,
+			 <&gcc GCC_USB3_PRIM_PHY_PIPE_CLK>;
+		clock-names = "aux", "ref", "com_aux", "pipe";
+
+		resets = <&gcc GCC_USB3_PHY_PRIM_BCR>,
+			 <&gcc GCC_USB3PHY_PHY_PRIM_BCR>;
+		reset-names = "phy", "phy_phy";
+
+		power-domains = <&gcc GCC_USB30_PRIM_GDSC>;
+
+		#clock-cells = <0>;
+		clock-output-names = "usb3_prim_phy_pipe_clk_src";
+
+		#phy-cells = <0>;
+
+		status = "disabled";
+	};
+
+	usb_1_hsphy: phy@8904000 {
+		compatible = "qcom,qcs8300-usb-hs-phy",
+			     "qcom,usb-snps-hs-7nm-phy";
+		reg = <0x0 0x8904000 0x0 0x400>;
+
+		status = "disabled";
+
+		#phy-cells = <0>;
+
+		clocks = <&rpmhcc RPMH_CXO_CLK>;
+		clock-names = "ref";
+
+		resets = <&gcc GCC_USB2_PHY_PRIM_BCR>;
+	};
+
+	usb_2_hsphy: phy@8906000 {
+		compatible = "qcom,qcs8300-usb-hs-phy",
+			     "qcom,usb-snps-hs-7nm-phy";
+		reg = <0x0 0x08906000 0x0 0x400>;
+		status = "disabled";
+		#phy-cells = <0>;
+
+		clocks = <&rpmhcc RPMH_CXO_CLK>;
+		clock-names = "ref";
+
+		resets = <&gcc GCC_USB2_PHY_SEC_BCR>;
+	};
+
+	usb_1: usb@a6f8800 {
+		compatible = "qcom,qcs8300-dwc3", "qcom,dwc3";
+		reg = <0x0 0x0a6f8800 0x0 0x400>;
+		status = "disabled";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+		dma-ranges;
+
+		clocks = <&gcc GCC_CFG_NOC_USB3_PRIM_AXI_CLK>,
+			 <&gcc GCC_USB30_PRIM_MASTER_CLK>,
+			 <&gcc GCC_AGGRE_USB3_PRIM_AXI_CLK>,
+			 <&gcc GCC_USB30_PRIM_SLEEP_CLK>,
+			 <&gcc GCC_USB30_PRIM_MOCK_UTMI_CLK>;
+		clock-names = "cfg_noc",
+			      "core",
+			      "iface",
+			      "sleep",
+			      "mock_utmi";
+
+		assigned-clocks = <&gcc GCC_USB30_PRIM_MOCK_UTMI_CLK>,
+				  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
+		assigned-clock-rates = <19200000>, <200000000>;
+
+		interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+				      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
+				      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
+				      <&pdc 12 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "pwr_event",
+				  "dp_hs_phy_irq",
+				  "dm_hs_phy_irq",
+				  "ss_phy_irq";
+
+		power-domains = <&gcc GCC_USB30_PRIM_GDSC>;
+		required-opps = <&rpmhpd_opp_nom>;
+
+		resets = <&gcc GCC_USB30_PRIM_BCR>;
+		interconnects = <&aggre1_noc MASTER_USB3_0 0 &mc_virt SLAVE_EBI1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_USB3_0 0>;
+		interconnect-names = "usb-ddr", "apps-usb";
+
+		wakeup-source;
+
+		usb_1_dwc3: usb@a600000 {
+			compatible = "snps,dwc3";
+			reg = <0x0 0x0a600000 0x0 0xe000>;
+			interrupts = <GIC_SPI 292 IRQ_TYPE_LEVEL_HIGH>;
+			iommus = <&apps_smmu 0x80 0x0>;
+			snps,dis_u2_susphy_quirk;
+			snps,dis_enblslpm_quirk;
+			phys = <&usb_1_hsphy>, <&usb_qmpphy>;
+			phy-names = "usb2-phy", "usb3-phy";
+			maximum-speed = "super-speed";
+			role-switch;
+
+			port {
+				usb1_role_switch: endpoint {
+					remote-endpoint = <&eud_ep>;
+				};
+			};
+		};
+	};
+
+	usb_2: usb@a4f8800 {
+		compatible = "qcom,qcs8300-dwc3", "qcom,dwc3";
+		reg = <0x0 0x0a4f8800 0x0 0x400>;
+		status = "disabled";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+		dma-ranges;
+
+		clocks = <&gcc GCC_CFG_NOC_USB2_PRIM_AXI_CLK>,
+			 <&gcc GCC_USB20_MASTER_CLK>,
+			 <&gcc GCC_AGGRE_USB2_PRIM_AXI_CLK>,
+			 <&gcc GCC_USB20_SLEEP_CLK>,
+			 <&gcc GCC_USB20_MOCK_UTMI_CLK>;
+		clock-names = "cfg_noc",
+			      "core",
+			      "iface",
+			      "sleep",
+			      "mock_utmi";
+
+		assigned-clocks = <&gcc GCC_USB20_MOCK_UTMI_CLK>,
+				  <&gcc GCC_USB20_MASTER_CLK>;
+		assigned-clock-rates = <19200000>, <120000000>;
+
+		interrupts-extended = <&intc GIC_SPI 444 IRQ_TYPE_LEVEL_HIGH>,
+				      <&pdc 10 IRQ_TYPE_EDGE_BOTH>,
+				      <&pdc 9 IRQ_TYPE_EDGE_BOTH>;
+		interrupt-names = "pwr_event",
+				  "dp_hs_phy_irq",
+				  "dm_hs_phy_irq";
+
+		power-domains = <&gcc GCC_USB20_PRIM_GDSC>;
+		required-opps = <&rpmhpd_opp_nom>;
+
+		resets = <&gcc GCC_USB20_PRIM_BCR>;
+
+		interconnects = <&aggre1_noc MASTER_USB2 0 &mc_virt SLAVE_EBI1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_USB2 0>;
+		interconnect-names = "usb-ddr", "apps-usb";
+
+		usb_2_dwc3: usb@a400000 {
+			compatible = "snps,dwc3";
+			reg = <0x0 0x0a400000 0x0 0xe000>;
+			interrupts = <GIC_SPI 442 IRQ_TYPE_LEVEL_HIGH>;
+			iommus = <&apps_smmu 0x20 0x0>;
+			snps,dis_u2_susphy_quirk;
+			snps,dis_enblslpm_quirk;
+			phys = <&usb_2_hsphy>;
+			phy-names = "usb2-phy";
+			maximum-speed = "high-speed";
+		};
+	};
+
+	arch_timer: timer {
+		compatible = "arm,armv8-timer";
+		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>;
+	};
+
+	turing0-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+		device-name = "turing_etm0";
+
+		qcom,atid-num = <2>;
+		qcom,inst-id = <13>;
+		atid = <38 39>;
+
+		out-ports {
+			port {
+				turing0_etm0_out: endpoint {
+					remote-endpoint =
+					<&turing0_dup_funnel_in3>;
+				};
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-addons-aim300-aiot.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-addons-aim300-aiot.dts
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs8550-aim300-aiot.dts"
+#include "qcs8550-addons.dtsi"
+
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS8550-addons AIM300 AIOT";
+	compatible = "qcom,qcs8550-addons-aim300-aiot", "qcom,qcs8550-aim300", "qcom,qcs8550",
+		     "qcom,qcm8550", "qcom,sm8550";
+
+	qps615_vreg: qps615-vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "qps615_vreg";
+		gpio = <&tlmm 178 GPIO_ACTIVE_HIGH>;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		enable-active-high;
+		regulator-enable-ramp-delay = <10000>;
+	};
+};
+
+&i2c_hub_2 {
+	qps615_switch: pcie-switch@77 {
+		compatible = "qcom,switch-i2c";
+		reg = <0x77>;
+		vdda-supply = <&qps615_vreg>;
+		status = "okay";
+	};
+};
+
+&pcie1 {
+	dummy-supply = <&qps615_switch>;
+};
+
+&pcie1_phy {
+	qcom,refclk-always-on;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-addons.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-addons.dtsi
@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/{
+	reserved-memory {
+		qseecom_mem: qcom,qseecom {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1400000>; /* 20M */
+		};
+
+		qseecom_ta_mem: qcom,qseecom-ta {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1000000>; /* 16M */
+		};
+	};
+
+	/* Add overlay for firmware node containing qcom_scm in sm8550.dtsi */
+	firmware {
+		qtee_shmbridge {
+			compatible = "qcom,tee-shared-memory-bridge";
+		};
+
+		qcom_smcinvoke {
+			compatible = "qcom,smcinvoke";
+		};
+	};
+};
+
+&soc {
+	wdog_gh: qcom,wdt_gh {
+		compatible = "qcom,gh-watchdog";
+		interrupts = <0 0 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	qcom_tzlog: tz-log@146aa720 {
+		compatible = "qcom,tz-log";
+		reg = <0x0 0x146aa720 0x0 0x3000>;
+		qcom,hyplog-enabled;
+		hyplog-address-offset = <0x410>;
+		hyplog-size-offset = <0x414>;
+	};
+
+	qcom,mem-buf {
+		compatible = "qcom,mem-buf";
+		qcom,mem-buf-capabilities = "supplier";
+		qcom,vmid = <3>;
+	};
+
+	qcom,mem-buf-msgq {
+		compatible = "qcom,mem-buf-msgq";
+	};
+
+	qcom,secure-buffer {
+		compatible = "qcom,secure-buffer";
+		qcom,vmid-cp-camera-preview-ro;
+	};
+};
+
+#include "qcs8550-dma-heaps.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-aim300-aiot.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-aim300-aiot.dts
@@ -0,0 +1,629 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/leds/common.h>
+#include "qcs8550-aim300.dtsi"
+#include "pm8010.dtsi"
+#include "pmr735d_a.dtsi"
+#include "pmr735d_b.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS8550 AIM300 AIOT";
+	compatible = "qcom,qcs8550-aim300-aiot", "qcom,qcs8550-aim300", "qcom,qcs8550",
+		     "qcom,qcm8550", "qcom,sm8550";
+	qcom,msm-id = <603 0x20000>;
+	qcom,board-id = <0x1011f 3>;
+
+	aliases {
+		serial0 = &uart7;
+	};
+
+	wcd938x: audio-codec {
+		compatible = "qcom,wcd9385-codec";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&wcd_default>;
+
+		qcom,micbias1-microvolt = <1800000>;
+		qcom,micbias2-microvolt = <1800000>;
+		qcom,micbias3-microvolt = <1800000>;
+		qcom,micbias4-microvolt = <1800000>;
+		qcom,mbhc-buttons-vthreshold-microvolt = <75000 150000 237000 500000 500000
+							  500000 500000 500000>;
+		qcom,mbhc-headset-vthreshold-microvolt = <1700000>;
+		qcom,mbhc-headphone-vthreshold-microvolt = <50000>;
+		qcom,rx-device = <&wcd_rx>;
+		qcom,tx-device = <&wcd_tx>;
+
+		reset-gpios = <&tlmm 108 GPIO_ACTIVE_LOW>;
+
+		#sound-dai-cells = <1>;
+
+		vdd-buck-supply = <&vreg_l15b_1p8>;
+		vdd-rxtx-supply = <&vreg_l15b_1p8>;
+		vdd-io-supply = <&vreg_l15b_1p8>;
+		vdd-mic-bias-supply = <&vreg_bob1>;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&volume_up_n>;
+		pinctrl-names = "default";
+
+		key-volume-up {
+			label = "Volume Up";
+			debounce-interval = <15>;
+			gpios = <&pm8550_gpios 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_VOLUMEUP>;
+			linux,can-disable;
+			wakeup-source;
+		};
+	};
+
+	pmic-glink {
+		compatible = "qcom,sm8550-pmic-glink", "qcom,pmic-glink";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		orientation-gpios = <&tlmm 11 GPIO_ACTIVE_HIGH>;
+
+		connector@0 {
+			compatible = "usb-c-connector";
+			reg = <0>;
+			power-role = "dual";
+			data-role = "dual";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					pmic_glink_hs_in: endpoint {
+						remote-endpoint = <&usb_1_dwc3_hs>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+
+					pmic_glink_ss_in: endpoint {
+						remote-endpoint = <&redriver_ss_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+
+					pmic_glink_sbu: endpoint {
+						remote-endpoint = <&fsa4480_sbu_mux>;
+					};
+				};
+			};
+		};
+	};
+
+	sound {
+		compatible = "qcom,sm8550-sndcard", "qcom,sm8450-sndcard";
+		model = "AIM300-AIOT";
+		audio-routing = "SpkrLeft IN", "WSA_SPK1 OUT",
+				"SpkrRight IN", "WSA_SPK2 OUT",
+				"IN1_HPHL", "HPHL_OUT",
+				"IN2_HPHR", "HPHR_OUT",
+				"AMIC2", "MIC BIAS2",
+				"VA DMIC0", "MIC BIAS1",
+				"VA DMIC1", "MIC BIAS1",
+				"VA DMIC2", "MIC BIAS3",
+				"TX DMIC0", "MIC BIAS1",
+				"TX DMIC1", "MIC BIAS2",
+				"TX DMIC2", "MIC BIAS3",
+				"TX SWR_ADC1", "ADC2_OUTPUT";
+
+		wcd-capture-dai-link {
+			link-name = "WCD Capture";
+
+			cpu {
+				sound-dai = <&q6apmbedai TX_CODEC_DMA_TX_3>;
+			};
+
+			codec {
+				sound-dai = <&wcd938x 1>, <&swr2 0>, <&lpass_txmacro 0>;
+			};
+
+			platform {
+				sound-dai = <&q6apm>;
+			};
+		};
+
+		wcd-playback-dai-link {
+			link-name = "WCD Playback";
+
+			cpu {
+				sound-dai = <&q6apmbedai RX_CODEC_DMA_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&wcd938x 0>, <&swr1 0>, <&lpass_rxmacro 0>;
+			};
+
+			platform {
+				sound-dai = <&q6apm>;
+			};
+		};
+
+		wsa-dai-link {
+			link-name = "WSA Playback";
+
+			cpu {
+				sound-dai = <&q6apmbedai WSA_CODEC_DMA_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&north_spkr>, <&south_spkr>,
+					    <&swr0 0>, <&lpass_wsamacro 0>;
+			};
+
+			platform {
+				sound-dai = <&q6apm>;
+			};
+		};
+
+		va-dai-link {
+			link-name = "VA Capture";
+
+			cpu {
+				sound-dai = <&q6apmbedai TX_CODEC_DMA_TX_3>;
+			};
+
+			codec {
+				sound-dai = <&lpass_vamacro 0>;
+			};
+
+			platform {
+				sound-dai = <&q6apm>;
+			};
+		};
+	};
+};
+
+&i2c_master_hub_0 {
+	status = "okay";
+};
+
+&i2c_hub_2 {
+	status = "okay";
+
+	typec-mux@42 {
+		compatible = "fcs,fsa4480";
+		reg = <0x42>;
+
+		vcc-supply = <&vreg_bob1>;
+
+		mode-switch;
+		orientation-switch;
+
+		port {
+			fsa4480_sbu_mux: endpoint {
+				remote-endpoint = <&pmic_glink_sbu>;
+			};
+		};
+	};
+
+	typec-retimer@1c {
+		compatible = "onnn,nb7vpq904m";
+		reg = <0x1c>;
+
+		vcc-supply = <&vreg_l15b_1p8>;
+
+		orientation-switch;
+		retimer-switch;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+
+				redriver_ss_out: endpoint {
+					remote-endpoint = <&pmic_glink_ss_in>;
+				};
+			};
+
+			port@1 {
+				reg = <1>;
+
+				redriver_ss_in: endpoint {
+					data-lanes = <3 2 1 0>;
+					remote-endpoint = <&usb_dp_qmpphy_out>;
+				};
+			};
+		};
+	};
+};
+
+&gcc {
+	clocks = <&bi_tcxo_div2>, <&sleep_clk>,
+		 <&pcie0_phy>,
+		 <&pcie1_phy>,
+		 <0>,
+		 <&ufs_mem_phy 0>,
+		 <&ufs_mem_phy 1>,
+		 <&ufs_mem_phy 2>,
+		 <&usb_dp_qmpphy QMP_USB43DP_USB3_PIPE_CLK>;
+};
+
+&lpass_tlmm {
+	spkr_1_sd_n_active: spkr-1-sd-n-active-state {
+		pins = "gpio17";
+		function = "gpio";
+		drive-strength = <16>;
+		bias-disable;
+		output-low;
+	};
+
+	spkr_2_sd_n_active: spkr-2-sd-n-active-state {
+		pins = "gpio18";
+		function = "gpio";
+		drive-strength = <16>;
+		bias-disable;
+		output-low;
+	};
+};
+
+&mdss {
+	status = "okay";
+};
+
+&mdss_dp0 {
+	status = "okay";
+};
+
+&mdss_dp0_out {
+	data-lanes = <0 1>;
+	remote-endpoint = <&usb_dp_qmpphy_dp_in>;
+};
+
+&mdss_dsi0 {
+	vdda-supply = <&vreg_l3e_1p2>;
+	status = "okay";
+
+	panel@0 {
+		compatible = "visionox,vtdr6130";
+		reg = <0>;
+
+		pinctrl-0 = <&dsi_active>, <&te_active>;
+		pinctrl-1 = <&dsi_suspend>, <&te_suspend>;
+		pinctrl-names = "default", "sleep";
+
+		reset-gpios = <&tlmm 133 GPIO_ACTIVE_LOW>;
+
+		vci-supply = <&vreg_l13b_3p0>;
+		vdd-supply = <&vreg_l11b_1p2>;
+		vddio-supply = <&vreg_l12b_1p8>;
+
+		port {
+			panel0_in: endpoint {
+				remote-endpoint = <&mdss_dsi0_out>;
+			};
+		};
+	};
+};
+
+&mdss_dsi0_out {
+	remote-endpoint = <&panel0_in>;
+	data-lanes = <0 1 2 3>;
+};
+
+&mdss_dsi0_phy {
+	vdds-supply = <&vreg_l1e_0p88>;
+	status = "okay";
+};
+
+&pcie_1_phy_aux_clk {
+	clock-frequency = <1000>;
+};
+
+&pcie1 {
+	perst-gpios = <&tlmm 97 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 99 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-0 = <&pcie1_default_state>;
+	pinctrl-names = "default";
+
+	iommu-map = <0x0 &apps_smmu 0x1480 0x1>,
+		<0x100 &apps_smmu 0x1481 0x1>,
+		<0x208 &apps_smmu 0x1482 0x1>,
+		<0x210 &apps_smmu 0x1483 0x1>,
+		<0x218 &apps_smmu 0x1484 0x1>,
+		<0x300 &apps_smmu 0x1487 0x1>,
+		<0x400 &apps_smmu 0x1488 0x1>,
+		<0x500 &apps_smmu 0x148c 0x1>,
+		<0x501 &apps_smmu 0x148e 0x1>;
+
+	status = "okay";
+};
+
+&pcie1_phy {
+	vdda-phy-supply = <&vreg_l3c_0p9>;
+	vdda-pll-supply = <&vreg_l3e_1p2>;
+	vdda-qref-supply = <&vreg_l1e_0p88>;
+
+	status = "okay";
+};
+
+&pcie0 {
+	wake-gpios = <&tlmm 96 GPIO_ACTIVE_HIGH>;
+	perst-gpios = <&tlmm 94 GPIO_ACTIVE_LOW>;
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_default_state>;
+
+	status = "okay";
+};
+
+&pcie0_phy {
+	vdda-phy-supply = <&vreg_l1e_0p88>;
+	vdda-pll-supply = <&vreg_l3e_1p2>;
+
+	status = "okay";
+};
+
+&pm8550_flash {
+	status = "okay";
+
+	led-0 {
+		function = LED_FUNCTION_FLASH;
+		color = <LED_COLOR_ID_YELLOW>;
+		flash-max-microamp = <2000000>;
+		flash-max-timeout-us = <1280000>;
+		function-enumerator = <0>;
+		led-sources = <1>, <4>;
+		led-max-microamp = <500000>;
+	};
+
+	led-1 {
+		function = LED_FUNCTION_FLASH;
+		color = <LED_COLOR_ID_WHITE>;
+		flash-max-microamp = <2000000>;
+		flash-max-timeout-us = <1280000>;
+		function-enumerator = <1>;
+		led-sources = <2>, <3>;
+		led-max-microamp = <500000>;
+	};
+};
+
+&pm8550_gpios {
+	volume_up_n: volume-up-n-state {
+		pins = "gpio6";
+		function = "normal";
+		power-source = <1>;
+		bias-pull-up;
+		input-enable;
+	};
+};
+
+&pm8550_pwm {
+	status = "okay";
+
+	multi-led {
+		color = <LED_COLOR_ID_RGB>;
+		function = LED_FUNCTION_STATUS;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+	};
+};
+
+&pm8550b_eusb2_repeater {
+	vdd18-supply = <&vreg_l15b_1p8>;
+	vdd3-supply = <&vreg_l5b_3p1>;
+};
+
+
+&pon_pwrkey {
+	status = "okay";
+};
+
+&pon_resin {
+	linux,code = <KEY_VOLUMEDOWN>;
+
+	status = "okay";
+};
+
+&qupv3_id_0 {
+	status = "okay";
+};
+
+&remoteproc_adsp {
+	firmware-name = "qcom/qcs8550/adsp.mbn",
+			"qcom/qcs8550/adsp_dtbs.elf";
+	status = "okay";
+};
+
+&remoteproc_cdsp {
+	firmware-name = "qcom/qcs8550/cdsp.mbn",
+			"qcom/qcs8550/cdsp_dtbs.elf";
+	status = "okay";
+};
+
+&remoteproc_mpss {
+	firmware-name = "qcom/qcs8550/qdsp6sw.mbn",
+			"qcom/qcs8550/qdsp6sw_dtbs.elf";
+	status = "okay";
+};
+
+&sleep_clk {
+	clock-frequency = <32000>;
+};
+
+&swr0 {
+	status = "okay";
+
+	/* WSA8845, Speaker North */
+	north_spkr: speaker@0,0 {
+		compatible = "sdw20217020400";
+		reg = <0 0>;
+		pinctrl-0 = <&spkr_1_sd_n_active>;
+		pinctrl-names = "default";
+		powerdown-gpios = <&lpass_tlmm 17 GPIO_ACTIVE_LOW>;
+		#sound-dai-cells = <0>;
+		sound-name-prefix = "SpkrLeft";
+		vdd-1p8-supply = <&vreg_l15b_1p8>;
+		vdd-io-supply = <&vreg_l3g_1p2>;
+	};
+
+	/* WSA8845, Speaker South */
+	south_spkr: speaker@0,1 {
+		compatible = "sdw20217020400";
+		reg = <0 1>;
+		pinctrl-0 = <&spkr_2_sd_n_active>;
+		pinctrl-names = "default";
+		powerdown-gpios = <&lpass_tlmm 18 GPIO_ACTIVE_LOW>;
+		#sound-dai-cells = <0>;
+		sound-name-prefix = "SpkrRight";
+		vdd-1p8-supply = <&vreg_l15b_1p8>;
+		vdd-io-supply = <&vreg_l3g_1p2>;
+	};
+};
+
+&swr1 {
+	status = "okay";
+
+	/* WCD9385 RX */
+	wcd_rx: codec@0,4 {
+		compatible = "sdw20217010d00";
+		reg = <0 4>;
+		qcom,rx-port-mapping = <1 2 3 4 5>;
+	};
+};
+
+&swr2 {
+	status = "okay";
+
+	/* WCD9385 TX */
+	wcd_tx: codec@0,3 {
+		compatible = "sdw20217010d00";
+		reg = <0 3>;
+		qcom,tx-port-mapping = <1 1 2 3>;
+	};
+};
+
+&tlmm {
+	gpio-reserved-ranges = <32 8>;
+
+	dsi_active: dsi-active-state {
+		pins = "gpio133";
+		function = "gpio";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	dsi_suspend: dsi-suspend-state {
+		pins = "gpio133";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+	};
+
+	te_active: te-active-state {
+		pins = "gpio86";
+		function = "mdp_vsync";
+		drive-strength = <2>;
+		bias-pull-down;
+	};
+
+	te_suspend: te-suspend-state {
+		pins = "gpio86";
+		function = "mdp_vsync";
+		drive-strength = <2>;
+		bias-pull-down;
+	};
+
+	wcd_default: wcd-reset-n-active-state {
+		pins = "gpio108";
+		function = "gpio";
+		drive-strength = <16>;
+		bias-disable;
+		output-low;
+	};
+};
+
+&uart7 {
+	status = "okay";
+};
+
+&usb_1 {
+	status = "okay";
+};
+
+&usb_1_dwc3 {
+	dr_mode = "otg";
+	usb-role-switch;
+};
+
+&usb_1_dwc3_hs {
+	remote-endpoint = <&pmic_glink_hs_in>;
+};
+
+&usb_1_dwc3_ss {
+	remote-endpoint = <&usb_dp_qmpphy_usb_ss_in>;
+};
+
+&usb_1_hsphy {
+	phys = <&pm8550b_eusb2_repeater>;
+
+	vdd-supply = <&vreg_l1e_0p88>;
+	vdda12-supply = <&vreg_l3e_1p2>;
+
+	status = "okay";
+};
+
+&usb_dp_qmpphy {
+	vdda-phy-supply = <&vreg_l3e_1p2>;
+	vdda-pll-supply = <&vreg_l3f_0p88>;
+
+	orientation-switch;
+
+	status = "okay";
+};
+
+&usb_dp_qmpphy_dp_in {
+	remote-endpoint = <&mdss_dp0_out>;
+};
+
+&usb_dp_qmpphy_out {
+	remote-endpoint = <&redriver_ss_in>;
+};
+
+&usb_dp_qmpphy_usb_ss_in {
+	remote-endpoint = <&usb_1_dwc3_ss>;
+};
+
+&xo_board {
+	clock-frequency = <76800000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi
@@ -0,0 +1,409 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/regulator/qcom,rpmh-regulator.h>
+#include "qcs8550.dtsi"
+#include "pm8550.dtsi"
+#include "pm8550b.dtsi"
+#define PMK8550VE_SID 5
+#include "pm8550ve.dtsi"
+#include "pm8550vs.dtsi"
+#include "pmk8550.dtsi"
+
+&apps_rsc {
+	regulators-0 {
+		compatible = "qcom,pm8550-rpmh-regulators";
+		qcom,pmic-id = "b";
+
+		vdd-l1-l4-l10-supply = <&vreg_s6g_1p86>;
+		vdd-l2-l13-l14-supply = <&vreg_bob1>;
+		vdd-l3-supply = <&vreg_s4g_1p25>;
+		vdd-l5-l16-supply = <&vreg_bob1>;
+		vdd-l6-l7-supply = <&vreg_bob1>;
+		vdd-l8-l9-supply = <&vreg_bob1>;
+		vdd-l11-supply = <&vreg_s4g_1p25>;
+		vdd-l12-supply = <&vreg_s6g_1p86>;
+		vdd-l15-supply = <&vreg_s6g_1p86>;
+		vdd-l17-supply = <&vreg_bob2>;
+
+		vreg_bob1: bob1 {
+			regulator-name = "vreg_bob1";
+			regulator-min-microvolt = <3296000>;
+			regulator-max-microvolt = <3960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_bob2: bob2 {
+			regulator-name = "vreg_bob2";
+			regulator-min-microvolt = <2720000>;
+			regulator-max-microvolt = <3960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1b_1p8: ldo1 {
+			regulator-name = "vreg_l1b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2b_3p0: ldo2 {
+			regulator-name = "vreg_l2b_3p0";
+			regulator-min-microvolt = <3008000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l5b_3p1: ldo5 {
+			regulator-name = "vreg_l5b_3p1";
+			regulator-min-microvolt = <3104000>;
+			regulator-max-microvolt = <3104000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6b_1p8: ldo6 {
+			regulator-name = "vreg_l6b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7b_1p8: ldo7 {
+			regulator-name = "vreg_l7b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8b_1p8: ldo8 {
+			regulator-name = "vreg_l8b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l9b_2p9: ldo9 {
+			regulator-name = "vreg_l9b_2p9";
+			regulator-min-microvolt = <2960000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l11b_1p2: ldo11 {
+			regulator-name = "vreg_l11b_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1504000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l12b_1p8: ldo12 {
+			regulator-name = "vreg_l12b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l13b_3p0: ldo13 {
+			regulator-name = "vreg_l13b_3p0";
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l14b_3p2: ldo14 {
+			regulator-name = "vreg_l14b_3p2";
+			regulator-min-microvolt = <3200000>;
+			regulator-max-microvolt = <3200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l15b_1p8: ldo15 {
+			regulator-name = "vreg_l15b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l16b_2p8: ldo16 {
+			regulator-name = "vreg_l16b_2p8";
+			regulator-min-microvolt = <2800000>;
+			regulator-max-microvolt = <2800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l17b_2p5: ldo17 {
+			regulator-name = "vreg_l17b_2p5";
+			regulator-min-microvolt = <2504000>;
+			regulator-max-microvolt = <2504000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-1 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+		qcom,pmic-id = "c";
+
+		vdd-l1-supply = <&vreg_s4g_1p25>;
+		vdd-l2-supply = <&vreg_s4e_0p95>;
+		vdd-l3-supply = <&vreg_s4e_0p95>;
+
+		vreg_l3c_0p9: ldo3 {
+			regulator-name = "vreg_l3c_0p9";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-2 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+		qcom,pmic-id = "d";
+
+		vdd-l1-supply = <&vreg_s4e_0p95>;
+		vdd-l2-supply = <&vreg_s4e_0p95>;
+		vdd-l3-supply = <&vreg_s4e_0p95>;
+
+		vreg_l1d_0p88: ldo1 {
+			regulator-name = "vreg_l1d_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <920000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-3 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+		qcom,pmic-id = "e";
+
+		vdd-l1-supply = <&vreg_s4e_0p95>;
+		vdd-l2-supply = <&vreg_s4e_0p95>;
+		vdd-l3-supply = <&vreg_s4g_1p25>;
+
+		vreg_s4e_0p95: smps4 {
+			regulator-name = "vreg_s4e_0p95";
+			regulator-min-microvolt = <904000>;
+			regulator-max-microvolt = <984000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5e_1p08: smps5 {
+			regulator-name = "vreg_s5e_1p08";
+			regulator-min-microvolt = <1010000>;
+			regulator-max-microvolt = <1120000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1e_0p88: ldo1 {
+			regulator-name = "vreg_l1e_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2e_0p9: ldo2 {
+			regulator-name = "vreg_l2e_0p9";
+			regulator-min-microvolt = <870000>;
+			regulator-max-microvolt = <970000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3e_1p2: ldo3 {
+			regulator-name = "vreg_l3e_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-4 {
+		compatible = "qcom,pm8550ve-rpmh-regulators";
+		qcom,pmic-id = "f";
+
+		vdd-l1-supply = <&vreg_s4e_0p95>;
+		vdd-l2-supply = <&vreg_s4e_0p95>;
+		vdd-l3-supply = <&vreg_s4e_0p95>;
+
+		vreg_s4f_0p5: smps4 {
+			regulator-name = "vreg_s4f_0p5";
+			regulator-min-microvolt = <300000>;
+			regulator-max-microvolt = <700000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1f_0p9: ldo1 {
+			regulator-name = "vreg_l1f_0p9";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2f_0p88: ldo2 {
+			regulator-name = "vreg_l2f_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3f_0p88: ldo3 {
+			regulator-name = "vreg_l3f_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-5 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+		qcom,pmic-id = "g";
+		vdd-l1-supply = <&vreg_s4g_1p25>;
+		vdd-l2-supply = <&vreg_s4g_1p25>;
+		vdd-l3-supply = <&vreg_s4g_1p25>;
+
+		vreg_s1g_1p25: smps1 {
+			regulator-name = "vreg_s1g_1p25";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s2g_0p85: smps2 {
+			regulator-name = "vreg_s2g_0p85";
+			regulator-min-microvolt = <500000>;
+			regulator-max-microvolt = <1036000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s3g_0p8: smps3 {
+			regulator-name = "vreg_s3g_0p8";
+			regulator-min-microvolt = <300000>;
+			regulator-max-microvolt = <1004000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s4g_1p25: smps4 {
+			regulator-name = "vreg_s4g_1p25";
+			regulator-min-microvolt = <1256000>;
+			regulator-max-microvolt = <1408000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5g_0p85: smps5 {
+			regulator-name = "vreg_s5g_0p85";
+			regulator-min-microvolt = <500000>;
+			regulator-max-microvolt = <1004000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s6g_1p86: smps6 {
+			regulator-name = "vreg_s6g_1p86";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <2000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1g_1p2: ldo1 {
+			regulator-name = "vreg_l1g_1p2";
+			regulator-min-microvolt = <1128000>;
+			regulator-max-microvolt = <1272000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2g_1p2: ldo2 {
+			regulator-name = "vreg_l2g_1p2";
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3g_1p2: ldo3 {
+			regulator-name = "vreg_l3g_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+};
+
+&mdss_dsi0 {
+	vdda-supply = <&vreg_l3e_1p2>;
+};
+
+&mdss_dsi0_phy {
+	vdds-supply = <&vreg_l1e_0p88>;
+};
+
+&pcie0 {
+	perst-gpios = <&tlmm 94 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 96 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-0 = <&pcie0_default_state>;
+	pinctrl-names = "default";
+};
+
+&pcie0_phy {
+	vdda-phy-supply = <&vreg_l1e_0p88>;
+	vdda-pll-supply = <&vreg_l3e_1p2>;
+};
+
+&pcie1 {
+	perst-gpios = <&tlmm 97 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 99 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-0 = <&pcie1_default_state>;
+	pinctrl-names = "default";
+};
+
+&pcie1_phy {
+	vdda-phy-supply = <&vreg_l3c_0p9>;
+	vdda-pll-supply = <&vreg_l3e_1p2>;
+	vdda-qref-supply = <&vreg_l1e_0p88>;
+};
+
+&pm8550b_eusb2_repeater {
+	vdd18-supply = <&vreg_l15b_1p8>;
+	vdd3-supply = <&vreg_l5b_3p1>;
+};
+
+&sleep_clk {
+	clock-frequency = <32000>;
+};
+
+&iris {
+	status = "okay";
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 210 GPIO_ACTIVE_LOW>;
+	vcc-supply = <&vreg_l17b_2p5>;
+	vcc-max-microamp = <1300000>;
+	vccq-supply = <&vreg_l1g_1p2>;
+	vccq-max-microamp = <1200000>;
+	vdd-hba-supply = <&vreg_l3g_1p2>;
+
+	status = "okay";
+};
+
+&ufs_mem_phy {
+	vdda-phy-supply = <&vreg_l1d_0p88>;
+	vdda-pll-supply = <&vreg_l3e_1p2>;
+
+	status = "okay";
+};
+
+&usb_1_hsphy {
+	phys = <&pm8550b_eusb2_repeater>;
+
+	vdd-supply = <&vreg_l1e_0p88>;
+	vdda12-supply = <&vreg_l3e_1p2>;
+};
+
+&usb_dp_qmpphy {
+	vdda-phy-supply = <&vreg_l3e_1p2>;
+	vdda-pll-supply = <&vreg_l3f_0p88>;
+};
+
+&xo_board {
+	clock-frequency = <76800000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-dma-heaps.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-dma-heaps.dtsi
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/arm/qcom_dma_heap_dt_constants.h>
+
+&soc {
+	qcom,dma-heaps {
+		compatible = "qcom,dma-heaps";
+
+		qcom,qseecom {
+			qcom,dma-heap-name = "qcom,qseecom";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&qseecom_mem>;
+		};
+
+		qcom,qseecom_ta {
+			qcom,dma-heap-name = "qcom,qseecom-ta";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&qseecom_ta_mem>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-graphics.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-graphics.dtsi
@@ -0,0 +1,282 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define MHZ_TO_KBPS(mhz, w) ((mhz * 1000000 * w) / (1024))
+
+&soc {
+	msm_gpu: qcom,kgsl-3d0@3d00000 {
+		compatible = "qcom,kgsl-3d0",
+			"qcom,adreno-gpu-gen7-2-1";
+		status = "ok";
+		reg = <0 0x3d00000 0 0x40000>, <0 0x3d61000 0 0x800>,
+			<0 0x03d50000 0 0x10000>, <0 0x3d8b000 0 0x2000>,
+			<0 0x03d9e000 0 0x1000>, <0 0x10900000 0 0x80000>,
+			<0 0x10048000 0 0x8000>, <0 0x10b05000 0 0x1000>;
+		reg-names = "kgsl_3d0_reg_memory", "cx_dbgc", "rscc",
+			"isense_cntl", "cx_misc", "qdss_gfx", "qdss_etr",
+			"qdss_tmc";
+		interrupts = <0 300 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "kgsl_3d0_irq";
+
+		clocks = <&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+			<&gcc GCC_GPU_SNOC_DVM_GFX_CLK>,
+			<&gpucc GPU_CC_AHB_CLK>,
+			<&aoss_qmp>;
+		clock-names = "gcc_gpu_memnoc_gfx",
+				"gcc_gpu_snoc_dvm_gfx",
+				"gpu_cc_ahb", "apb_pclk";
+
+		qcom,chipid = <0x43050a01>;
+		qcom,gpu-model = "Adreno740v2";
+
+		qcom,min-access-length = <32>;
+
+		qcom,ubwc-mode = <4>;
+
+		qcom,gpu-qdss-stm = <0x161c0000 0x40000>; /* base addr, size */
+
+		qcom,tzone-names = "gpuss-0", "gpuss-1", "gpuss-2", "gpuss-3",
+				"gpuss-4", "gpuss-5", "gpuss-6", "gpuss-7";
+
+		interconnects = <&gem_noc MASTER_GFX3D 0 &mc_virt SLAVE_EBI1 0>;
+		interconnect-names = "gpu_icc_path";
+
+		qcom,initial-pwrlevel = <7>;
+		qcom,initial-min-pwrlevel = <7>;
+
+		qcom,bus-table-cnoc =
+			<0>,   /* Off */
+			<100>; /* On */
+
+		qcom,bus-table-ddr =
+			<MHZ_TO_KBPS(0, 4)>,    /* index=0 */
+			<MHZ_TO_KBPS(547, 4) >, /* index=1 */
+			<MHZ_TO_KBPS(768, 4) >, /* index=2 */
+			<MHZ_TO_KBPS(1555, 4)>, /* index=3 */
+			<MHZ_TO_KBPS(1708, 4)>, /* index=4 */
+			<MHZ_TO_KBPS(2092, 4)>, /* index=5 */
+			<MHZ_TO_KBPS(2736, 4)>, /* index=6 */
+			<MHZ_TO_KBPS(3187, 4)>, /* index=7 */
+			<MHZ_TO_KBPS(3686, 4)>, /* index=8 */
+			<MHZ_TO_KBPS(4224, 4)>; /* index=9 */
+
+		zap-shader {
+			memory-region = <&gpu_micro_code_mem>;
+		};
+
+		qcom,gpu-mempools {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			compatible = "qcom,gpu-mempools";
+
+			/* 4K Page Pool configuration */
+			qcom,gpu-mempool@0 {
+				reg = <0>;
+				qcom,mempool-page-size = <4096>;
+				qcom,mempool-reserved = <2048>;
+			};
+			/* 8K Page Pool configuration */
+			qcom,gpu-mempool@1 {
+				reg = <1>;
+				qcom,mempool-page-size = <8192>;
+				qcom,mempool-reserved = <1024>;
+			};
+			/* 64K Page Pool configuration */
+			qcom,gpu-mempool@2 {
+				reg = <2>;
+				qcom,mempool-page-size = <65536>;
+				qcom,mempool-reserved = <256>;
+			};
+			/* 128K Page Pool configuration */
+			qcom,gpu-mempool@3 {
+				reg = <3>;
+				qcom,mempool-page-size = <131072>;
+				qcom,mempool-reserved = <128>;
+			};
+			/* 256K Page Pool configuration */
+			qcom,gpu-mempool@4 {
+				reg = <4>;
+				qcom,mempool-page-size = <262144>;
+				qcom,mempool-reserved = <80>;
+			};
+			/* 1M Page Pool configuration */
+			qcom,gpu-mempool@5 {
+				reg = <5>;
+				qcom,mempool-page-size = <1048576>;
+				qcom,mempool-reserved = <32>;
+			};
+		};
+
+		/* Power levels */
+		qcom,gpu-pwrlevels {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			compatible = "qcom,gpu-pwrlevels";
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <680000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <0x882e5ffd>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <615000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L0>;
+
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <9>;
+
+				qcom,acd-level = <0xa82f5ffd>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <550000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <7>;
+
+				qcom,acd-level = <0xe0285ffd>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <475000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_L1>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <5>;
+
+				qcom,acd-level = <0xe0285ffd>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <401000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <4>;
+
+				qcom,acd-level = <0xc02a5ffd>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <348000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D0>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+
+				qcom,acd-level = <0xe02b5ffd>;
+			};
+
+			qcom,gpu-pwrlevel@6 {
+				reg = <6>;
+				qcom,gpu-freq = <295000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D1>;
+
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+
+				qcom,acd-level = <0xe02d5ffd>;
+			};
+
+			qcom,gpu-pwrlevel@7 {
+				reg = <7>;
+				qcom,gpu-freq = <220000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D2>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+
+				qcom,acd-level = <0xc02f5ffd>;
+			};
+
+			qcom,gpu-pwrlevel@8 {
+				reg = <8>;
+				qcom,gpu-freq = <124800000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_LOW_SVS_D2>;
+
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <1>;
+			};
+		};
+	};
+
+	kgsl_msm_iommu: qcom,kgsl-iommu@3da0000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		compatible = "qcom,kgsl-smmu-v2";
+
+		reg = <0x03da0000 0x40000>;
+
+		power-domains = <&gpucc GPU_CC_CX_GDSC>;
+
+		gfx3d_user: gfx3d_user {
+			compatible = "qcom,smmu-kgsl-cb", "qcom,adreno";
+			iommus = <&adreno_smmu 0x0 0x000>, <&adreno_smmu 0x1 0x000>;
+			qcom,iommu-dma = "disabled";
+		};
+	};
+
+	gmu: qcom,gmu@3d68000 {
+		compatible = "qcom,gen7-gmu";
+
+		reg = <0 0x3d68000 0 0x37000>,
+			<0 0xb280000 0 0x10000>,
+			<0 0x03D40000 0 0x10000>;
+
+		reg-names = "gmu", "gmu_pdc", "gmu_ao_blk_dec0";
+
+		interrupts = <0 304 IRQ_TYPE_LEVEL_HIGH>,
+			<0 305 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "hfi", "gmu";
+
+		power-domains = <&gpucc GPU_CC_CX_GDSC>, <&gpucc GPU_CC_GX_GDSC>;
+		power-domain-names = "cx", "gx";
+
+		clocks = <&gpucc GPU_CC_CX_GMU_CLK>,
+			<&gpucc GPU_CC_CXO_CLK>,
+			<&gcc GCC_DDRSS_GPU_AXI_CLK>,
+			<&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+			<&gpucc GPU_CC_AHB_CLK>,
+			<&gpucc GPU_CC_HUB_CX_INT_CLK>;
+
+		clock-names = "gmu_clk", "cxo_clk", "axi_clk",
+			"memnoc_clk", "ahb_clk", "hub_clk";
+
+		qcom,gmu-freq-table = <220000000 RPMH_REGULATOR_LEVEL_LOW_SVS>,
+					<550000000 RPMH_REGULATOR_LEVEL_SVS>;
+
+		iommus = <&adreno_smmu 0x5 0x000>;
+		qcom,iommu-dma = "disabled";
+
+		qcom,qmp = <&aoss_qmp>;
+
+		qcom,ipc-core = <0x00400000 0xfc000>;
+	};
+
+};
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-graphics.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-graphics.dtso
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,sm8550-gcc.h>
+#include <dt-bindings/clock/qcom,sm8550-gpucc.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <dt-bindings/interconnect/qcom,sm8550-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "qcs8550-graphics.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS8550 AIM300";
+	compatible = "qcom,kalama", "qcom,kalamap", "qcom,qcs8550-aim300", "qcom,qcs8550";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-qps615.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-qps615.dtsi
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+* Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+*/
+
+#include <dt-bindings/gpio/gpio.h>
+
+&pcie1 {
+	pcie1_rp: pcie1-rp {
+		reg = <0x0 0x0 0x0 0x0 0x0>;
+	};
+};
+
+&pcie1_rp {
+	#address-cells = <5>;
+	#size-cells = <0>;
+
+	/* BDF 1.0.0 */
+	pcie1_bus1_dev0_fn0: pcie1-bus1-dev0-fn0 {
+		reg = <0x0 0x0 0x0 0x0 0x0>;
+
+		/* BDF 2.3.0 */
+		pcie1_bus2_dev3_fn0: pcie1-bus2-dev3-fn0 {
+			reg = <0x1800 0x0 0x0 0x0 0x0>;
+			qps615_rlt8211_eth1,qps615-rlt8211-eth1@pcie1_rp {
+				reg = <0x100 0x0 0x0 0x0 0x0>;
+				qcom,not-need-pinctrl;
+				qcom,phy-port-interface = <2>;
+				/* phy intn_wol int */
+				qcom,phy-built-in-wol;
+
+				/* phy reset*/
+				qcom,phy-rst-gpio-id = <1>;
+				qcom,phy-rst-delay-us = <10000>;
+				qcom,phy-rst-settling-delay-us = <72000>;
+				qcom,phy-reverse-rst;
+
+				/* power enable*/
+				phy-supply = <&ethernet_phy_vreg>;
+			};
+		};
+	};
+};
+
+&soc {
+	ethernet_phy_vreg: phy-vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "ethernet_phy_vreg";
+		gpio = <&tlmm 106 GPIO_ACTIVE_HIGH>;
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		enable-active-high;
+		regulator-enable-ramp-delay = <10000>;
+	};
+};
\ No newline at end of file
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-qps615.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-qps615.dtso
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+* Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+*/
+/dts-v1/;
+/plugin/;
+
+#include "qcs8550-qps615.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS8550 AIM300";
+	compatible = "qcom,qcs8550-aim300", "qcom,qcs8550";
+};
\ No newline at end of file
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-rb5gen2-hdk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-rb5gen2-hdk.dts
@@ -0,0 +1,226 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/leds/common.h>
+#include "qcs8550-rb5gen2.dtsi"
+#include "pm8010.dtsi"
+#include "pmr735d_a.dtsi"
+#include "pmr735d_b.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS8550 RB5Gen2 HDK";
+	compatible = "qcom,qcs8550-rb5gen2-hdk", "qcom,qcs8550-rb5gen2",
+			"qcom,qcs8550", "qcom,qcm8550", "qcom,sm8550";
+
+	qcom,msm-id = <603 0x20000>;
+	qcom,board-id = <0x1001f 2>;
+
+	aliases {
+		serial0 = &uart7;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&volume_up_n>;
+		pinctrl-names = "default";
+
+		key-volume-up {
+			label = "Volume Up";
+			debounce-interval = <15>;
+			gpios = <&pm8550_gpios 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_VOLUMEUP>;
+			linux,can-disable;
+			wakeup-source;
+		};
+	};
+
+	pmic-glink {
+		compatible = "qcom,sm8550-pmic-glink", "qcom,pmic-glink";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		connector@0 {
+			compatible = "usb-c-connector";
+			reg = <0>;
+			power-role = "dual";
+			data-role = "dual";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					pmic_glink_hs_in: endpoint {
+						remote-endpoint = <&usb_1_dwc3_hs>;
+					};
+				};
+			};
+		};
+	};
+
+	vph_pwr: vph-pwr-regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "vph_pwr";
+		regulator-min-microvolt = <3700000>;
+		regulator-max-microvolt = <3700000>;
+
+		regulator-always-on;
+		regulator-boot-on;
+	};
+};
+
+&apps_rsc {
+	regulators-0 {
+		vdd-bob1-supply = <&vph_pwr>;
+		vdd-bob2-supply = <&vph_pwr>;
+	};
+
+	regulators-2 {
+		vdd-s4-supply = <&vph_pwr>;
+		vdd-s5-supply = <&vph_pwr>;
+	};
+
+	regulators-3 {
+		vdd-s1-supply = <&vph_pwr>;
+		vdd-s3-supply = <&vph_pwr>;
+		vdd-s4-supply = <&vph_pwr>;
+		vdd-s5-supply = <&vph_pwr>;
+		vdd-s6-supply = <&vph_pwr>;
+	};
+
+	regulators-4 {
+		vdd-s1-supply = <&vph_pwr>;
+		vdd-s3-supply = <&vph_pwr>;
+		vdd-s4-supply = <&vph_pwr>;
+		vdd-s5-supply = <&vph_pwr>;
+		vdd-s7-supply = <&vph_pwr>;
+	};
+
+	regulators-5 {
+		vdd-s1-supply = <&vph_pwr>;
+		vdd-s2-supply = <&vph_pwr>;
+		vdd-s3-supply = <&vph_pwr>;
+		vdd-s4-supply = <&vph_pwr>;
+		vdd-s5-supply = <&vph_pwr>;
+		vdd-s6-supply = <&vph_pwr>;
+	};
+};
+
+&pm8550_flash {
+	status = "okay";
+
+	led-0 {
+		function = LED_FUNCTION_FLASH;
+		color = <LED_COLOR_ID_YELLOW>;
+		flash-max-microamp = <2000000>;
+		flash-max-timeout-us = <1280000>;
+		function-enumerator = <0>;
+		led-sources = <1>, <4>;
+		led-max-microamp = <500000>;
+	};
+
+	led-1 {
+		function = LED_FUNCTION_FLASH;
+		color = <LED_COLOR_ID_WHITE>;
+		flash-max-microamp = <2000000>;
+		flash-max-timeout-us = <1280000>;
+		function-enumerator = <1>;
+		led-sources = <2>, <3>;
+		led-max-microamp = <500000>;
+	};
+};
+
+&pm8550_gpios {
+	volume_up_n: volume-up-n-state {
+		pins = "gpio6";
+		function = "normal";
+		power-source = <1>;
+		bias-pull-up;
+		input-enable;
+	};
+};
+
+&pm8550_pwm {
+	status = "okay";
+
+	multi-led {
+		color = <LED_COLOR_ID_RGB>;
+		function = LED_FUNCTION_STATUS;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+	};
+};
+
+&pm8550b_eusb2_repeater {
+	vdd18-supply = <&vreg_l15b_1p8>;
+	vdd3-supply = <&vreg_l5b_3p1>;
+};
+
+&pon_pwrkey {
+	status = "okay";
+};
+
+&pon_resin {
+	linux,code = <KEY_VOLUMEDOWN>;
+	status = "okay";
+};
+
+&uart7 {
+	status = "okay";
+};
+
+&usb_1 {
+	status = "okay";
+};
+
+&usb_1_dwc3 {
+	dr_mode = "otg";
+	usb-role-switch;
+};
+
+&usb_1_dwc3_hs {
+	remote-endpoint = <&pmic_glink_hs_in>;
+};
+
+&usb_1_hsphy {
+	vdd-supply = <&vreg_l1e_0p88>;
+	vdda12-supply = <&vreg_l3e_1p2>;
+
+	phys = <&pm8550b_eusb2_repeater>;
+
+	status = "okay";
+};
+
+&usb_dp_qmpphy {
+	vdda-phy-supply = <&vreg_l3e_1p2>;
+	vdda-pll-supply = <&vreg_l3f_0p88>;
+
+	status = "okay";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550-rb5gen2.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550-rb5gen2.dtsi
@@ -0,0 +1,460 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/regulator/qcom,rpmh-regulator.h>
+#include "qcs8550.dtsi"
+#include "pm8550.dtsi"
+#include "pm8550b.dtsi"
+#define PMK8550VE_SID 5
+#include "pm8550ve.dtsi"
+#include "pm8550vs.dtsi"
+#include "pmk8550.dtsi"
+
+&apps_rsc {
+	regulators-0 {
+		compatible = "qcom,pm8550-rpmh-regulators";
+		qcom,pmic-id = "b";
+
+		vdd-l1-l4-l10-supply = <&vreg_s6g_1p86>;
+		vdd-l2-l13-l14-supply = <&vreg_bob1>;
+		vdd-l5-l16-supply = <&vreg_bob1>;
+		vdd-l6-l7-supply = <&vreg_bob1>;
+		vdd-l8-l9-supply = <&vreg_bob1>;
+		vdd-l11-supply = <&vreg_s4g_1p25>;
+		vdd-l12-supply = <&vreg_s6g_1p86>;
+		vdd-l15-supply = <&vreg_s6g_1p86>;
+		vdd-l17-supply = <&vreg_bob2>;
+
+		vreg_bob1: bob1 {
+			regulator-name = "vreg_bob1";
+			regulator-min-microvolt = <3296000>;
+			regulator-max-microvolt = <3960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_bob2: bob2 {
+			regulator-name = "vreg_bob2";
+			regulator-min-microvolt = <2720000>;
+			regulator-max-microvolt = <3960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1b_1p8: ldo1 {
+			regulator-name = "vreg_l1b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2b_3p0: ldo2 {
+			regulator-name = "vreg_l2b_3p0";
+			regulator-min-microvolt = <3008000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l5b_3p1: ldo5 {
+			regulator-name = "vreg_l5b_3p1";
+			regulator-min-microvolt = <3104000>;
+			regulator-max-microvolt = <3104000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6b_1p8: ldo6 {
+			regulator-name = "vreg_l6b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7b_1p8: ldo7 {
+			regulator-name = "vreg_l7b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8b_1p8: ldo8 {
+			regulator-name = "vreg_l8b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l9b_2p9: ldo9 {
+			regulator-name = "vreg_l9b_2p9";
+			regulator-min-microvolt = <2960000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l10b_1p8: ldo10 {
+			regulator-name = "vreg_l10b_1p8";
+			regulator-min-microvolt = <1620000>;
+			regulator-max-microvolt = <1980000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l11b_1p2: ldo11 {
+			regulator-name = "vreg_l11b_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1504000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l12b_1p8: ldo12 {
+			regulator-name = "vreg_l12b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l13b_3p0: ldo13 {
+			regulator-name = "vreg_l13b_3p0";
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l14b_3p2: ldo14 {
+			regulator-name = "vreg_l14b_3p2";
+			regulator-min-microvolt = <3200000>;
+			regulator-max-microvolt = <3200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l15b_1p8: ldo15 {
+			regulator-name = "vreg_l15b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l16b_2p8: ldo16 {
+			regulator-name = "vreg_l16b_2p8";
+			regulator-min-microvolt = <2800000>;
+			regulator-max-microvolt = <2800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l17b_2p5: ldo17 {
+			regulator-name = "vreg_l17b_2p5";
+			regulator-min-microvolt = <2504000>;
+			regulator-max-microvolt = <2504000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-1 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+		qcom,pmic-id = "c";
+
+		vdd-l1-supply = <&vreg_s4g_1p25>;
+		vdd-l3-supply = <&vreg_s4e_0p95>;
+
+		vreg_l1c_1p2: ldo1 {
+			regulator-name = "vreg_l1c_1p2";
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3c_0p9: ldo3 {
+			regulator-name = "vreg_l3c_0p9";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-2 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+		qcom,pmic-id = "d";
+
+		vdd-l1-supply = <&vreg_s4e_0p95>;
+		vdd-l2-supply = <&vreg_s4e_0p95>;
+
+		vreg_s4d_0p628: smps4 {
+			regulator-name = "vreg_s4d_0p628";
+			regulator-min-microvolt = <572000>;
+			regulator-max-microvolt = <800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5d_0p728: smps5 {
+			regulator-name = "vreg_s5d_0p728";
+			regulator-min-microvolt = <465000>;
+			regulator-max-microvolt = <815000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1d_0p88: ldo1 {
+			regulator-name = "vreg_l1d_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <920000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2d_0p752: ldo2 {
+			regulator-name = "vreg_l2d_0p752";
+			regulator-min-microvolt = <752000>;
+			regulator-max-microvolt = <800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-3 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+		qcom,pmic-id = "e";
+
+		vdd-l1-supply = <&vreg_s4e_0p95>;
+		vdd-l2-supply = <&vreg_s4e_0p95>;
+		vdd-l3-supply = <&vreg_s4g_1p25>;
+
+		vreg_l1e_0p88: ldo1 {
+			regulator-name = "vreg_l1e_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <880000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2e_0p9: ldo2 {
+			regulator-name = "vreg_l2e_0p9";
+			regulator-min-microvolt = <904000>;
+			regulator-max-microvolt = <970000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3e_1p2: ldo3 {
+			regulator-name = "vreg_l3e_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s1e_0p728: smps1 {
+			regulator-name = "vreg_s1e_0p728";
+			regulator-min-microvolt = <675000>;
+			regulator-max-microvolt = <832000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s3e_0p752: smps3 {
+			regulator-name = "vreg_s3e_0p752";
+			regulator-min-microvolt = <752000>;
+			regulator-max-microvolt = <795000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s4e_0p95: smps4 {
+			regulator-name = "vreg_s4e_0p95";
+			regulator-min-microvolt = <904000>;
+			regulator-max-microvolt = <984000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5e_1p08: smps5 {
+			regulator-name = "vreg_s5e_1p08";
+			regulator-min-microvolt = <1080000>;
+			regulator-max-microvolt = <1120000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s6e_0p728: smps6 {
+			regulator-name = "vreg_s6e_0p728";
+			regulator-min-microvolt = <675000>;
+			regulator-max-microvolt = <800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-4 {
+		compatible = "qcom,pm8550ve-rpmh-regulators";
+		qcom,pmic-id = "f";
+
+		vdd-l1-supply = <&vreg_s4e_0p95>;
+		vdd-l2-supply = <&vreg_s4e_0p95>;
+		vdd-l3-supply = <&vreg_s4e_0p95>;
+
+		vreg_l1f_0p9: ldo1 {
+			regulator-name = "vreg_l1f_0p9";
+			regulator-min-microvolt = <912000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2f_0p88: ldo2 {
+			regulator-name = "vreg_l2f_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3f_0p88: ldo3 {
+			regulator-name = "vreg_l3f_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s1f_0p728: smps1 {
+			regulator-name = "vreg_s1f_0p728";
+			regulator-min-microvolt = <584000>;
+			regulator-max-microvolt = <856000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s3f_0p825: smps3 {
+			regulator-name = "vreg_s3f_0p825";
+			regulator-min-microvolt = <640000>;
+			regulator-max-microvolt = <1000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s4f_0p5: smps4 {
+			regulator-name = "vreg_s4f_0p5";
+			regulator-min-microvolt = <500000>;
+			regulator-max-microvolt = <700000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5f_0p752: smps5 {
+			regulator-name = "vreg_s5f_0p752";
+			regulator-min-microvolt = <752000>;
+			regulator-max-microvolt = <800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s7f_0p628: smps7 {
+			regulator-name = "vreg_s7f_0p628";
+			regulator-min-microvolt = <465000>;
+			regulator-max-microvolt = <1050000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-5 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+		qcom,pmic-id = "g";
+
+		vdd-l1-supply = <&vreg_s4g_1p25>;
+		vdd-l2-supply = <&vreg_s4g_1p25>;
+		vdd-l3-supply = <&vreg_s4g_1p25>;
+
+		vreg_l1g_1p2: ldo1 {
+			regulator-name = "vreg_l1g_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2g_1p2: ldo2 {
+			regulator-name = "vreg_l2g_1p2";
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3g_1p2: ldo3 {
+			regulator-name = "vreg_l3g_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s1g_1p25: smps1 {
+			regulator-name = "vreg_s1g_1p25";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s2g_0p85: smps2 {
+			regulator-name = "vreg_s2g_0p85";
+			regulator-min-microvolt = <800000>;
+			regulator-max-microvolt = <1000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s3g_0p8: smps3 {
+			regulator-name = "vreg_s3g_0p8";
+			regulator-min-microvolt = <300000>;
+			regulator-max-microvolt = <1004000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s4g_1p25: smps4 {
+			regulator-name = "vreg_s4g_1p25";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1352000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5g_0p85: smps5 {
+			regulator-name = "vreg_s5g_0p85";
+			regulator-min-microvolt = <500000>;
+			regulator-max-microvolt = <1004000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s6g_1p86: smps6 {
+			regulator-name = "vreg_s6g_1p86";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <2000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+};
+
+&iris {
+	status = "okay";
+};
+
+&remoteproc_adsp {
+	firmware-name = "qcom/qcs8550/adsp.mdt",
+			"qcom/qcs8550/adsp_dtb.mdt";
+	status = "okay";
+};
+
+&remoteproc_cdsp {
+	firmware-name = "qcom/qcs8550/cdsp.mdt",
+			"qcom/qcs8550/cdsp_dtb.mdt";
+	status = "okay";
+};
+
+&remoteproc_mpss {
+	firmware-name = "qcom/qcs8550/modem.mdt",
+			"qcom/qcs8550/modem_dtb.mdt";
+	status = "okay";
+};
+
+&qupv3_id_0 {
+	status = "okay";
+};
+
+&sleep_clk {
+	clock-frequency = <32000>;
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 210 GPIO_ACTIVE_LOW>;
+	vcc-supply = <&vreg_l17b_2p5>;
+	vcc-max-microamp = <1300000>;
+	vccq-supply = <&vreg_l1g_1p2>;
+	vccq-max-microamp = <1200000>;
+
+	status = "okay";
+};
+
+&ufs_mem_phy {
+	vdda-phy-supply = <&vreg_l1d_0p88>;
+	vdda-pll-supply = <&vreg_l3e_1p2>;
+
+	status = "okay";
+};
+
+&xo_board {
+	clock-frequency = <76800000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs8550.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs8550.dtsi
@@ -0,0 +1,162 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "sm8550.dtsi"
+
+/delete-node/ &reserved_memory;
+
+/ {
+	reserved_memory: reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+
+		/* These are 3 types of reserved memory regions here:
+		 * 1. Firmware related regions which aren't shared with kernel.
+		 *     The device tree source in kernel doesn't need to have node to
+		 * indicate the firmware related reserved information. Bootloader
+		 * conveys the information by updating devicetree at runtime.
+		 *     This will be described as: UEFI saves the physical address of
+		 * the UEFI System Table to dts file's chosen node. Kernel read this
+		 * table and add reserved memory regions to efi config table. Current
+		 * reserved memory region may have reserved region which was not yet
+		 * used, release note of the firmware have such kind of information.
+		 * 2. Firmware related memory regions which are shared with Kernel
+		 *     The device tree source in the kernel needs to include nodes
+		 * that indicate fimware-related shared information. A label name
+		 * is suggested because this type of shared information needs to
+		 * be referenced by specific drivers for handling purposes.
+		 *     Unlike previous platforms, QCS8550 boots using EFI and describes
+		 * most reserved regions in the ESRT memory map. As a result, reserved
+		 * memory regions which aren't relevant to the kernel(like the hypervisor
+		 ( region) don't need to be described in DT.
+		 * 3. Remoteproc regions.
+		 *     Remoteproc regions will be reserved and then assigned to
+		 * subsystem firmware later.
+		 * Here is a reserved memory map for this platform:
+		 *  0x80000000 +-------------------+
+		 *             |                   |
+		 *             | Firmware Related  |
+		 *             |                   |
+		 *  0x8a800000 +-------------------+
+		 *             |                   |
+		 *             | Remoteproc Region |
+		 *             |                   |
+		 *  0xa7000000 +-------------------+
+		 *             |                   |
+		 *             | Kernel Available  |
+		 *             |                   |
+		 *  0xd4d00000 +-------------------+
+		 *             |                   |
+		 *             | Firmware Related  |
+		 *             |                   |
+		 * 0x100000000 +-------------------+
+		 */
+
+		aop_image_mem: aop-image-region@81c00000 {
+			reg = <0x0 0x81c00000 0x0 0x60000>;
+			no-map;
+		};
+
+		aop_cmd_db_mem: aop-cmd-db-region@81c60000 {
+			compatible = "qcom,cmd-db";
+			reg = <0x0 0x81c60000 0x0 0x20000>;
+			no-map;
+		};
+
+		aop_config_mem: aop-config-region@81c80000 {
+			no-map;
+			reg = <0x0 0x81c80000 0x0 0x20000>;
+		};
+
+		smem_mem: smem-region@81d00000 {
+			compatible = "qcom,smem";
+			reg = <0x0 0x81d00000 0x0 0x200000>;
+			hwlocks = <&tcsr_mutex 3>;
+			no-map;
+		};
+
+		adsp_mhi_mem: adsp-mhi-region@81f00000 {
+			reg = <0x0 0x81f00000 0x0 0x20000>;
+			no-map;
+		};
+
+		mpss_mem: mpss-region@8a800000 {
+			reg = <0x0 0x8a800000 0x0 0x10800000>;
+			no-map;
+		};
+
+		q6_mpss_dtb_mem: q6-mpss-dtb-region@9b000000 {
+			reg = <0x0 0x9b000000 0x0 0x80000>;
+			no-map;
+		};
+
+		ipa_fw_mem: ipa-fw-region@9b080000 {
+			reg = <0x0 0x9b080000 0x0 0x10000>;
+			no-map;
+		};
+
+		ipa_gsi_mem: ipa-gsi-region@9b090000 {
+			reg = <0x0 0x9b090000 0x0 0xa000>;
+			no-map;
+		};
+
+		gpu_micro_code_mem: gpu-micro-code-region@9b09a000 {
+			reg = <0x0 0x9b09a000 0x0 0x2000>;
+			no-map;
+		};
+
+		spss_region_mem: spss-region@9b100000 {
+			reg = <0x0 0x9b100000 0x0 0x180000>;
+			no-map;
+		};
+
+		spu_secure_shared_memory_mem: spu-secure-shared-memory-region@9b280000 {
+			reg = <0x0 0x9b280000 0x0 0x80000>;
+			no-map;
+		};
+
+		camera_mem: camera-region@9b300000 {
+			reg = <0x0 0x9b300000 0x0 0x800000>;
+			no-map;
+		};
+
+		video_mem: video-region@9bb00000 {
+			reg = <0x0 0x9bb00000 0x0 0x700000>;
+			no-map;
+		};
+
+		cvp_mem: cvp-region@9c200000 {
+			reg = <0x0 0x9c200000 0x0 0x700000>;
+			no-map;
+		};
+
+		cdsp_mem: cdsp-region@9c900000 {
+			reg = <0x0 0x9c900000 0x0 0x2000000>;
+			no-map;
+		};
+
+		q6_cdsp_dtb_mem: q6-cdsp-dtb-region@9e900000 {
+			reg = <0x0 0x9e900000 0x0 0x80000>;
+			no-map;
+		};
+
+		q6_adsp_dtb_mem: q6-adsp-dtb-region@9e980000 {
+			reg = <0x0 0x9e980000 0x0 0x80000>;
+			no-map;
+		};
+
+		adspslpi_mem: adspslpi-region@9ea00000 {
+			reg = <0x0 0x9ea00000 0x0 0x4080000>;
+			no-map;
+		};
+
+		mpss_dsm_mem: mpss_dsm_region@d4d00000 {
+			reg = <0x0 0xd4d00000 0x0 0x3300000>;
+			no-map;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-addons-iq-9075-evk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-addons-iq-9075-evk.dts
@@ -0,0 +1,445 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+
+#include "qcs9075-iq-9075-evk.dts"
+#include "sa8775p-addons.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. Addons IQ 9075 EVK";
+	compatible = "qcom,qcs9075-addons-iq-9075-evk", "qcom,qcs9075", "qcom,sa8775p";
+
+	sound {
+		compatible = "qcom,qcs9075-rb8-sndcard";
+		model = "qcs9075-rb8-snd-card";
+
+		clocks = <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+			    <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>;
+		clock-names = "macro", "dcodec";
+
+		pinctrl-names = "default", "mi2s_aud_out_active", "mi2s_aud_out_sleep";
+		pinctrl-0 = <&hs1_mi2s_data0_sleep>, <&mi2s_mclk_sleep>, <&hs0_mi2s_data0_sleep>,
+			    <&hs0_mi2s_sclk_sleep>, <&hs0_mi2s_data1_sleep>, <&hs0_mi2s_ws_sleep>,
+			    <&hs1_mi2s_sclk_sleep>, <&hs1_mi2s_data1_sleep>, <&hs1_mi2s_ws_sleep>,
+			    <&hs2_mi2s_data0_sleep>, <&hs2_mi2s_data1_sleep>, <&hs2_mi2s_sck_sleep>,
+			    <&hs2_mi2s_ws_sleep>, <&lpass_quad_clk_sleep>, <&lpass_quad_data_sleep>,
+			    <&lpass_quad_ws_sleep>;
+		pinctrl-1 = <&hs1_mi2s_data0>, <&mi2s_mclk>, <&hs0_mi2s_data0>,
+			    <&hs0_mi2s_sclk>, <&hs0_mi2s_data1>, <&hs0_mi2s_ws>,
+			    <&hs1_mi2s_sclk>, <&hs1_mi2s_data1>, <&hs1_mi2s_ws>,
+			    <&hs2_mi2s_data0>, <&hs2_mi2s_data1>, <&hs2_mi2s_sck>,
+			    <&hs2_mi2s_ws>, <&lpass_quad_clk>, <&lpass_quad_data>,
+			    <&lpass_quad_ws>;
+		pinctrl-2 = <&hs1_mi2s_data0_sleep>, <&mi2s_mclk_sleep>, <&hs0_mi2s_data0_sleep>,
+			    <&hs0_mi2s_sclk_sleep>, <&hs0_mi2s_data1_sleep>, <&hs0_mi2s_ws_sleep>,
+			    <&hs1_mi2s_sclk_sleep>, <&hs1_mi2s_data1_sleep>, <&hs1_mi2s_ws_sleep>,
+			    <&hs2_mi2s_data0_sleep>, <&hs2_mi2s_data1_sleep>, <&hs2_mi2s_sck_sleep>,
+			    <&hs2_mi2s_ws_sleep>, <&lpass_quad_clk_sleep>, <&lpass_quad_data_sleep>,
+			    <&lpass_quad_ws_sleep>;
+
+		hs0-mi2s-playback-dai-link {
+			link-name = "MI2S-LPAIF_SDR-RX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_SDR_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&max98357a>;
+			};
+		};
+
+		hs1-mi2s-playback-dai-link {
+			link-name = "MI2S-LPAIF_SDR-RX-SECONDARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai SECONDARY_SDR_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&max98357a>;
+			};
+		};
+
+		hs2-mi2s-capture-dai-link {
+			link-name = "MI2S-LPAIF_SDR-TX-TERTIARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai TERTIARY_SDR_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&dmic_codec>;
+			};
+		};
+
+		lpi-quad-capture-dai-link {
+			link-name = "MI2S-LPAIF_RXTX-TX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 1>;
+			};
+		};
+
+		lpi-quad-playback-dai-link {
+			link-name = "MI2S-LPAIF_RXTX-RX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 0>;
+			};
+		};
+
+		lpi-tdm-quad-capture-dai-link {
+			link-name = "TDM-LPAIF_RXTX-TX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 1>;
+			};
+		};
+
+		lpi-tdm-quad-playback-dai-link {
+			link-name = "TDM-LPAIF_RXTX-RX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 0>;
+			};
+		};
+
+	};
+};
+
+&lpass_tlmm {
+	lpass_i2s1_data: i2s1-data-state {
+			pins = "gpio8", "gpio9";
+			function = "i2s1_data";
+			drive-strength = <8>;
+			bias-disable;
+	};
+
+	lpass_i2s1_data_sleep: i2s1-data-sleep-state {
+			pins = "gpio8", "gpio9";
+			function = "i2s1_data";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+
+	lpass_i2s1_ws: i2s1-ws-state {
+			pins = "gpio7";
+			function = "i2s1_ws";
+			drive-strength = <8>;
+			output-high;
+	};
+
+	lpass_i2s1_ws_sleep: i2s1-ws-sleep-state {
+			pins = "gpio7";
+			function = "i2s1_ws";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+
+	lpass_quad_clk_sleep: quad-clk-sleep-state {
+			pins = "gpio0";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+
+	lpass_quad_clk: quad-clk-state {
+			pins = "gpio0";
+			function = "qua_mi2s_sclk";
+			drive-strength = <8>;
+			bias-disable;
+			output-high;
+	};
+
+	lpass_quad_data_sleep: quad-data-sleep-state {
+			pins = "gpio2", "gpio3", "gpio4", "gpio5";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+
+	lpass_quad_data: quad-data-state {
+			pins = "gpio2", "gpio3", "gpio4", "gpio5";
+			function = "qua_mi2s_data";
+			drive-strength = <8>;
+			bias-disable;
+	};
+
+	lpass_quad_ws_sleep: quad-ws-sleep-state {
+			pins = "gpio1";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+
+	lpass_quad_ws: quad-ws-state {
+			pins = "gpio1";
+			function = "qua_mi2s_ws";
+			drive-strength = <8>;
+			output-high;
+	};
+};
+
+&soc {
+	msm_stub_codec: msm-stub-codec {
+		compatible = "qcom,msm-stub-codec";
+		#sound-dai-cells = <1>;
+	};
+	max98357a: audio-codec-0 {
+		compatible = "maxim,max98357a";
+		#sound-dai-cells = <0>;
+	};
+
+	dmic_codec: dmic-codec {
+		compatible = "dmic-codec";
+		#sound-dai-cells = <0>;
+		num-channels = <1>;
+	};
+
+	spf_core_platform: spf-core-platform {
+		compatible = "qcom,spf-core-platform";
+
+		msm_audio_mem: msm-audio-mem {
+			compatible = "qcom,msm-audio-mem";
+			qcom,smmu-version = <2>;
+			qcom,smmu-enabled;
+			iommus = <&apps_smmu 0x3001 0x0>;
+			qcom,iommu-dma-addr-pool = <0x10000000 0x10000000>;
+			qcom,smmu-sid-mask = /bits/ 64 <0xf>;
+			dma-coherent;
+		};
+
+		msm_audio_mem_cma: msm-audio-mem-cma {
+			compatible = "qcom,msm-audio-mem";
+			memory-region = <&audio_cma_mem>;
+		};
+	};
+};
+
+&tlmm {
+	hs0_mi2s_data0_sleep: hs0-mi2s-data0-sleep-state {
+		pins = "gpio116";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs0_mi2s_data0: hs0-mi2s-data0-state {
+		pins = "gpio116";
+		function = "hs0_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	hs0_mi2s_data1_sleep: hs0-mi2s-data1-sleep-state {
+		pins = "gpio117";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs0_mi2s_data1: hs0-mi2s-data1-state {
+		pins = "gpio117";
+		function = "hs0_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	hs0_mi2s_sclk_sleep: hs0-mi2s-sclk-sleep-state {
+		pins = "gpio114";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs0_mi2s_sclk: hs0-mi2s-sclk-state {
+		pins = "gpio114";
+		function = "hs0_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	hs0_mi2s_ws_sleep: hs0-mi2s-ws-sleep-state {
+		pins = "gpio115";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs0_mi2s_ws: hs0-mi2s-ws-state {
+		pins = "gpio115";
+		function = "hs0_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs1_mi2s_data0: hs1-mi2s-data0-state {
+		pins = "gpio120";
+		function = "hs1_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	hs1_mi2s_data0_sleep: hs1-mi2s-data0-sleep-state {
+		pins = "gpio120";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs1_mi2s_data1: hs1-mi2s-data1-state {
+		pins = "gpio121";
+		function = "hs1_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	hs1_mi2s_data1_sleep: hs1-mi2s-data1-sleep-state {
+		pins = "gpio121";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs1_mi2s_sclk: hs1-mi2s-sclk-state {
+		pins = "gpio119";
+		function = "hs1_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	hs1_mi2s_sclk_sleep: hs1-mi2s-sclk-sleep-state {
+		pins = "gpio119";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs1_mi2s_ws: hs1-mi2s-ws-state {
+		pins = "gpio118";
+		function = "hs1_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs1_mi2s_ws_sleep: hs1-mi2s-ws-sleep-state {
+		pins = "gpio118";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs2_mi2s_data0: hs2-mi2s-data0-state {
+		pins = "gpio124";
+		function = "hs2_mi2s";
+		drive-strength = <8>;
+		input-enable;
+		bias-disable;
+	};
+
+	hs2_mi2s_data0_sleep: hs2-mi2s-data0-sleep-state {
+		pins = "gpio124";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs2_mi2s_data1: hs2-mi2s-data1-state {
+		pins = "gpio125";
+		function = "hs2_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	hs2_mi2s_data1_sleep: hs2-mi2s-data1-sleep-state {
+		pins = "gpio125";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs2_mi2s_sck: hs2-mi2s-sck-state {
+		pins = "gpio122";
+		function = "hs2_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs2_mi2s_sck_sleep: hs2-mi2s-sck-sleep-state {
+		pins = "gpio122";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs2_mi2s_ws: hs2-mi2s-ws-state {
+		pins = "gpio123";
+		function = "hs2_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs2_mi2s_ws_sleep: hs2-mi2s-ws-sleep-state {
+		pins = "gpio123";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s_mclk: mi2s-mclk-state {
+		pins = "gpio105";
+		function = "mi2s_mclk0";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	mi2s_mclk_sleep: mi2s-mclk-sleep-state {
+		pins = "gpio105";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-addons-ride-r3.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-addons-ride-r3.dts
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+
+#include "qcs9075-ride-r3.dts"
+#include "sa8775p-addons-ride.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS9075 Addons Ride Rev3";
+	compatible = "qcom,qcs9075-addons-ride-r3", "qcom,qcs9075", "qcom,sa8775p";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-addons-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-addons-ride.dts
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+
+#include "qcs9075-ride.dts"
+#include "sa8775p-addons-ride.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS9075 Addons Ride";
+	compatible = "qcom,qcs9075-addons-ride", "qcom,qcs9075", "qcom,sa8775p";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-camera-iq-9075-evk.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-camera-iq-9075-evk.dtsi
@@ -0,0 +1,2943 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&tlmm {
+	cci_i2c_sda0_active: cci_i2c_sda0_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio60";
+			function = "cci_i2c_sda0";
+		};
+
+		config {
+			pins = "gpio60";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda0_suspend: cci_i2c_sda0_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio60";
+			function = "cci_i2c_sda0";
+		};
+
+		config {
+			pins = "gpio60";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl0_active: cci_i2c_scl0_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio61";
+			function = "cci_i2c_scl0";
+		};
+
+		config {
+			pins = "gpio61";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl0_suspend: cci_i2c_scl0_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio61";
+			function = "cci_i2c_scl0";
+		};
+
+		config {
+			pins = "gpio61";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda1_active: cci_i2c_sda1_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio52";
+			function = "cci_i2c_sda1";
+		};
+
+		config {
+			pins = "gpio52";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda1_suspend: cci_i2c_sda1_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio52";
+			function = "cci_i2c_sda1";
+		};
+
+		config {
+			pins = "gpio52";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl1_active: cci_i2c_scl1_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio53";
+			function = "cci_i2c_scl1";
+		};
+
+		config {
+			pins = "gpio53";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl1_suspend: cci_i2c_scl1_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio53";
+			function = "cci_i2c_scl1";
+		};
+
+		config {
+			pins = "gpio53";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda2_active: cci_i2c_sda2_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio62";
+			function = "cci_i2c_sda2";
+		};
+
+		config {
+			pins = "gpio62";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda2_suspend: cci_i2c_sda2_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio62";
+			function = "cci_i2c_sda2";
+		};
+
+		config {
+			pins = "gpio62";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl2_active: cci_i2c_scl2_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio63";
+			function = "cci_i2c_scl2";
+		};
+
+		config {
+			pins = "gpio63";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl2_suspend: cci_i2c_scl2_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio63";
+			function = "cci_i2c_scl2";
+		};
+
+		config {
+			pins = "gpio63";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda3_active: cci_i2c_sda3_active {
+		mux {
+			pins = "gpio54";
+			function = "cci_i2c_sda3";
+		};
+
+		config {
+			pins = "gpio54";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda3_suspend: cci_i2c_sda3_suspend {
+		mux {
+			pins = "gpio54";
+			function = "cci_i2c_sda3";
+		};
+
+		config {
+			pins = "gpio54";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl3_active: cci_i2c_scl3_active {
+		mux {
+			pins = "gpio55";
+			function = "cci_i2c_scl3";
+		};
+
+		config {
+			pins = "gpio55";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl3_suspend: cci_i2c_scl3_suspend {
+		mux {
+			pins = "gpio55";
+			function = "cci_i2c_scl3";
+		};
+
+		config {
+			pins = "gpio55";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda4_active: cci_i2c_sda4_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio64";
+			function = "cci_i2c_sda4";
+		};
+
+		config {
+			pins = "gpio64";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda4_suspend: cci_i2c_sda4_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio64";
+			function = "cci_i2c_sda4";
+		};
+
+		config {
+			pins = "gpio64";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl4_active: cci_i2c_scl4_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio65";
+			function = "cci_i2c_scl4";
+		};
+
+		config {
+			pins = "gpio65";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl4_suspend: cci_i2c_scl4_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio65";
+			function = "cci_i2c_scl4";
+		};
+
+		config {
+			pins = "gpio65";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda5_active: cci_i2c_sda5_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio56";
+			function = "cci_i2c_sda5";
+		};
+
+		config {
+			pins = "gpio56";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda5_suspend: cci_i2c_sda5_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio56";
+			function = "cci_i2c_sda5";
+		};
+
+		config {
+			pins = "gpio56";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl5_active: cci_i2c_scl5_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio57";
+			function = "cci_i2c_scl5";
+		};
+
+		config {
+			pins = "gpio57";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl5_suspend: cci_i2c_scl5_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio57";
+			function = "cci_i2c_scl5";
+		};
+
+		config {
+			pins = "gpio57";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda6_active: cci_i2c_sda6_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio66";
+			function = "cci_i2c_sda6";
+		};
+
+		config {
+			pins = "gpio66";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda6_suspend: cci_i2c_sda6_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio66";
+			function = "cci_i2c_sda6";
+		};
+
+		config {
+			pins = "gpio66";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl6_active: cci_i2c_scl6_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio67";
+			function = "cci_i2c_scl6";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl6_suspend: cci_i2c_scl6_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio67";
+			function = "cci_i2c_scl6";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda7_active: cci_i2c_sda7_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio58";
+			function = "cci_i2c_sda7";
+		};
+
+		config {
+			pins = "gpio58";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda7_suspend: cci_i2c_sda7_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio58";
+			function = "cci_i2c_sda7";
+		};
+
+		config {
+			pins = "gpio58";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl7_active: cci_i2c_scl7_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio59";
+			function = "cci_i2c_scl7";
+		};
+
+		config {
+			pins = "gpio59";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl7_suspend: cci_i2c_scl7_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio59";
+			function = "cci_i2c_scl7";
+		};
+
+		config {
+			pins = "gpio59";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+		/* MCLK0 */
+		mux {
+			pins = "gpio72";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio72";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk0_suspend: cam_sensor_mclk0_suspend {
+		/* MCLK0 */
+		mux {
+			pins = "gpio72";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio72";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_active: cam_sensor_mclk1_active {
+		/* MCLK1 */
+		mux {
+			pins = "gpio73";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio73";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_suspend: cam_sensor_mclk1_suspend {
+		/* MCLK1 */
+		mux {
+			pins = "gpio73";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio73";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+		/* MCLK2 */
+		mux {
+			pins = "gpio74";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio74";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_suspend: cam_sensor_mclk2_suspend {
+		/* MCLK2 */
+		mux {
+			pins = "gpio74";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio74";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk3_active: cam_sensor_mclk3_active {
+		/* MCLK3 */
+		mux {
+			pins = "gpio75";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio75";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk3_suspend: cam_sensor_mclk3_suspend {
+		/* MCLK3 */
+		mux {
+			pins = "gpio75";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio75";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+	
+	cam_sensor_active_rst0: cam_sensor_active_rst0 {
+		/* RESET */
+		mux {
+			pins = "gpio132";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio132";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst0: cam_sensor_suspend_rst0 {
+		/* RESET */
+		mux {
+			pins = "gpio132";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio132";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst1: cam_sensor_active_rst1 {
+		/* RESET */
+		mux {
+			pins = "gpio133";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio133";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst1: cam_sensor_suspend_rst1 {
+		/* RESET */
+		mux {
+			pins = "gpio133";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio133";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst2: cam_sensor_active_rst2 {
+		/* RESET */
+		mux {
+			pins = "gpio134";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio134";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst2: cam_sensor_suspend_rst2 {
+		/* RESET */
+		mux {
+			pins = "gpio134";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio134";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+
+	cam_sensor_active_rst3: cam_sensor_active_rst3 {
+		/* RESET */
+		mux {
+			pins = "gpio135";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio135";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_suspend_rst3: cam_sensor_suspend_rst3 {
+		/* RESET */
+		mux {
+			pins = "gpio135";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio135";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+			output-low;
+		};
+	};
+};
+
+&soc {
+	qcom,cam-req-mgr {
+		compatible = "qcom,cam-req-mgr";
+		status = "ok";
+	};
+
+	qcom,cam-sync {
+		compatible = "qcom,cam-sync";
+		status = "ok";
+	};
+
+	qcom,cam-i3c-id-table {
+		i3c-sensor-id-table = <0x1B0 0x0766>;
+		i3c-eeprom-id-table = <>;
+		i3c-actuator-id-table = <>;
+		i3c-ois-id-table = <>;
+		status = "disabled";
+	};
+
+	cam_csiphy_tpg17: qcom,tpg17@acac000 {
+		cell-index = <17>;
+		phy-id = <0>;
+		compatible = "qcom,cam-tpg1031";
+		reg-names = "tpg0", "cam_cpas_top";
+		reg = <0x0 0xacac000 0x0 0x400>,
+			<0x0 0xac11000 0x0 0x1000>;
+		reg-cam-base = <0xac000 0x11000>;
+		operating-points-v2 = <&csiphy_tpg0_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		interrupt-names = "tpg0";
+		interrupts = <GIC_SPI 545 IRQ_TYPE_EDGE_RISING>;
+		shared-clks = <1 0>;
+		clock-names =
+			"cphy_rx_clk_src",
+			"csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cphy_rx_clk_src";
+		status = "ok";
+		csiphy_tpg0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy_tpg18: qcom,tpg18@acad000 {
+		cell-index = <18>;
+		phy-id = <1>;
+		compatible = "qcom,cam-tpg1031";
+		reg-names = "tpg1", "cam_cpas_top";
+		reg = <0x0 0xacad000 0x0 0x400>,
+			<0x0 0xac11000 0x0 0x1000>;
+		reg-cam-base = <0xad000 0x11000>;
+		operating-points-v2 = <&csiphy_tpg1_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		interrupt-names = "tpg1";
+		interrupts = <GIC_SPI 546 IRQ_TYPE_EDGE_RISING>;
+		shared-clks = <1 0>;
+		clock-names =
+			"cphy_rx_clk_src",
+			"csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cphy_rx_clk_src";
+		status = "ok";
+		csiphy_tpg1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy_tpg19: qcom,tpg19@acae000 {
+		cell-index = <19>;
+		phy-id = <2>;
+		compatible = "qcom,cam-tpg1031";
+		reg-names = "tpg2", "cam_cpas_top";
+		reg = <0x0 0xacae000 0x0 0x400>,
+			<0x0 0xac11000 0x0 0x1000>;
+		reg-cam-base = <0xae000 0x11000>;
+		operating-points-v2 = <&csiphy_tpg2_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		interrupt-names = "tpg2";
+		interrupts = <GIC_SPI 547 IRQ_TYPE_EDGE_RISING>;
+		shared-clks = <1 0>;
+		clock-names =
+			"cphy_rx_clk_src",
+			"csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cphy_rx_clk_src";
+		status = "ok";
+		csiphy_tpg2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy0: qcom,csiphy0@ac9c000 {
+		cell-index = <0>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0x0ac9c000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy0_opp_table>;
+		reg-cam-base = <0x9c000>;
+		interrupt-names = "CSIPHY0";
+		interrupts = <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l1c>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1140000 831000>;
+		rgltr-max-voltage = <1260000 920000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy0_clk",
+			"csi0phytimer_clk_src",
+			"csi0phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY0_CLK>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy1: qcom,csiphy1@ac9e000 {
+		cell-index = <1>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0xac9e000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy1_opp_table>;
+		reg-cam-base = <0x9e000>;
+		interrupt-names = "CSIPHY1";
+		interrupts = <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l1c>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1140000 831000>;
+		rgltr-max-voltage = <1260000 920000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy1_clk",
+			"csi1phytimer_clk_src",
+			"csi1phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY1_CLK>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy2: qcom,csiphy2@aca0000 {
+		cell-index = <2>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0xaca0000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy2_opp_table>;
+		reg-cam-base = <0xa0000>;
+		interrupt-names = "CSIPHY2";
+		interrupts = <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l1c>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1140000 831000>;
+		rgltr-max-voltage = <1260000 920000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy2_clk",
+			"csi2phytimer_clk_src",
+			"csi2phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY2_CLK>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy3: qcom,csiphy3@aca2000 {
+		cell-index = <3>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0xaca2000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy3_opp_table>;
+		reg-cam-base = <0xa2000>;
+		interrupt-names = "CSIPHY3";
+		interrupts = <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l1c>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1140000 831000>;
+		rgltr-max-voltage = <1260000 920000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy3_clk",
+			"csi3phytimer_clk_src",
+			"csi3phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY3_CLK>,
+			<&camcc CAM_CC_CSI3PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI3PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_cci0: qcom,cci0@ac13000 {
+		cell-index = <0>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac13000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x13000>;
+		interrupt-names = "CCI0";
+		interrupts = <GIC_SPI 460 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci0_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_0_clk_src",
+			"cci_0_clk";
+		clocks = <&camcc CAM_CC_CCI_0_CLK_SRC>,
+			<&camcc CAM_CC_CCI_0_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_0_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl0_active &cci_i2c_sda0_active>;
+		pinctrl-1 = <&cci_i2c_scl0_suspend &cci_i2c_sda0_suspend>;
+		pinctrl-2 = <&cci_i2c_scl1_active &cci_i2c_sda1_active>;
+		pinctrl-3 = <&cci_i2c_scl1_suspend &cci_i2c_sda1_suspend>;
+		status = "ok";
+		cci0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci0: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci0: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci0: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci0: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci1: qcom,cci1@ac14000 {
+		cell-index = <1>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac14000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x14000>;
+		interrupt-names = "CCI1";
+		interrupts = <GIC_SPI 271 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci1_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_1_clk_src",
+			"cci_1_clk";
+		clocks = <&camcc CAM_CC_CCI_1_CLK_SRC>,
+			<&camcc CAM_CC_CCI_1_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_1_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl2_active &cci_i2c_sda2_active>;
+		pinctrl-1 = <&cci_i2c_scl2_suspend &cci_i2c_sda2_suspend>;
+		pinctrl-2 = <&cci_i2c_scl3_active &cci_i2c_sda3_active>;
+		pinctrl-3 = <&cci_i2c_scl3_suspend &cci_i2c_sda3_suspend>;
+		status = "ok";
+		cci1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci1: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci1: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci1: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci1: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci2: qcom,cci2@ac15000 {
+		cell-index = <2>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac15000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x15000>;
+		interrupt-names = "CCI2";
+		interrupts = <GIC_SPI 651 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci2_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_2_clk_src",
+			"cci_2_clk";
+		clocks = <&camcc CAM_CC_CCI_2_CLK_SRC>,
+			<&camcc CAM_CC_CCI_2_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_2_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl4_active &cci_i2c_sda4_active>;
+		pinctrl-1 = <&cci_i2c_scl4_suspend &cci_i2c_sda4_suspend>;
+		pinctrl-2 = <&cci_i2c_scl5_active &cci_i2c_sda5_active>;
+		pinctrl-3 = <&cci_i2c_scl5_suspend &cci_i2c_sda5_suspend>;
+		status = "ok";
+		cci2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci2: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci2: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci2: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci2: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci3: qcom,cci3@ac16000 {
+		cell-index = <3>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac16000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x16000>;
+		interrupt-names = "CCI3";
+		interrupts = <GIC_SPI 771 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci3_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_3_clk_src",
+			"cci_3_clk";
+		clocks = <&camcc CAM_CC_CCI_3_CLK_SRC>,
+			<&camcc CAM_CC_CCI_3_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_3_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl6_active &cci_i2c_sda6_active>;
+		pinctrl-1 = <&cci_i2c_scl6_suspend &cci_i2c_sda6_suspend>;
+		pinctrl-2 = <&cci_i2c_scl7_active &cci_i2c_sda7_active>;
+		pinctrl-3 = <&cci_i2c_scl7_suspend &cci_i2c_sda7_suspend>;
+		status = "ok";
+		cci3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci3: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci3: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci3: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci3: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu", "simple-bus";
+		status = "ok";
+		force_cache_allocs;
+
+		msm_cam_smmu_ife {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x3400 0x0020>,
+				<&apps_smmu 0x3420 0x0020>;
+			cam-smmu-label = "ife", "sfe";
+			multiple-client-devices;
+			dma-coherent;
+			ife_iova_mem_map: iova-mem-map {
+				/* IO region is approximately 64 GB */
+				iova-mem-region-io {
+					iova-region-name = "io";
+					/* start address: 0x100000 */
+					/* leaving 1 MB pad at start  */
+					iova-region-start = <0x100000>;
+					/* Length: 0xfffe00000 */
+					/* leaving 1 MB pad at end */
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_icp {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus =
+				<&apps_smmu 0x0800 0x400>,
+				<&apps_smmu 0x0840 0x480>,
+				<&apps_smmu 0x08C0 0x480>,
+				<&apps_smmu 0x0C00 0x400>,
+				<&apps_smmu 0x0C40 0x480>,
+				<&apps_smmu 0x0CC0 0x480>;
+			cam-smmu-label = "icp";
+			qcom,iommu-faults = "stall-disable", "non-fatal";
+			dma-coherent;
+			icp_iova_mem_map: iova-mem-map {
+				iova-mem-region-shared {
+					/* Shared region is ~250MB long */
+					iova-region-name = "shared";
+					iova-region-start = <0x800000>;
+					iova-region-len = <0xfc00000>;
+					iova-region-id = <0x1>;
+					status = "ok";
+				};
+
+				iova-mem-region-fwuncached-region {
+					/* FW uncached region is 7MB long */
+					iova-region-name = "fw_uncached";
+					iova-region-start = <0x10400000>;
+					iova-region-len = <0x700000>;
+					iova-region-id = <0x6>;
+					subregion_support;
+					status = "ok";
+					/* Used for HFI queues/sec heap */
+					iova-mem-region-generic-region {
+						iova-region-name = "icp_hfi";
+						iova-region-start = <0x10400000>;
+						iova-region-len = <0x200000>;
+						iova-region-id = <0x0>;
+					};
+				};
+
+				iova-mem-region-io {
+					/* IO region is approximately 3.8 GB */
+					iova-region-name = "io";
+					iova-region-start = <0x10c00000>;
+					iova-region-len = <0xee300000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+
+				iova-mem-qdss-region {
+					/* QDSS region is appropriate 1MB */
+					iova-region-name = "qdss";
+					iova-region-start = <0x10b00000>;
+					iova-region-len = <0x100000>;
+					iova-region-id = <0x5>;
+					qdss-phy-addr = <0x16790000>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_cdm {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x0860 0x400>,
+				<&apps_smmu 0x0C60 0x400>;
+			cam-smmu-label = "rt-cdm";
+			dma-coherent;
+			multiple-client-devices;
+			rt_cdm_iova_mem_map: iova-mem-map {
+				iova-mem-region-io {
+					/* IO region is approximately 4.0 GB */
+					iova-region-name = "io";
+					/* 1 MB pad for start */
+					iova-region-start = <0x100000>;
+					/* 1 MB pad for end */
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_secure {
+			compatible = "qcom,msm-cam-smmu-cb";
+			cam-smmu-label = "cam-secure";
+			qcom,secure-cb;
+		};
+	};
+
+	qcom,cam-cdm-intf {
+		compatible = "qcom,cam-cdm-intf";
+		cell-index = <0>;
+		label = "cam-cdm-intf";
+		num-hw-cdm = <1>;
+		cdm-client-names = "vfe";
+		status = "ok";
+	};
+
+	qcom,rt-cdm0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac26000 0x0 0x1000>;
+		reg-names = "rt-cdm0";
+		reg-cam-base = <0x26000>;
+		interrupts = <GIC_SPI 543 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm0";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_fast_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_fast_ahb_clk_src";
+		clock-rates = <300000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table0>;
+		clock-cntl-level = "svs";
+		cdm-client-names = "ife0", "dualife0";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table0: opp-table {
+			compatible = "operating-points-v2";
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,rt-cdm1 {
+		cell-index = <1>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac27000 0x0 0x1000>;
+		reg-names = "rt-cdm1";
+		reg-cam-base = <0x27000>;
+		interrupts = <GIC_SPI 544 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm1";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_fast_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_fast_ahb_clk_src";
+		clock-rates = <300000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table1>;
+		clock-cntl-level = "svs_l1";
+		cdm-client-names = "ife1", "dualife1";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table1: opp-table {
+			compatible = "operating-points-v2";
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,rt-cdm2 {
+		cell-index = <2>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac28000 0x0 0x1000>;
+		reg-names = "rt-cdm2";
+		reg-cam-base = <0x28000>;
+		interrupts = <GIC_SPI 567 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm2";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_slow_ahb_clk_src";
+		clock-rates = <80000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table2>;
+		clock-cntl-level = "svs_l1";
+		cdm-client-names = "ife2", "ife3", "ife4", "ife5", "ife6";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table2: opp-table {
+			compatible = "operating-points-v2";
+			opp-80000000 {
+				opp-hz = /bits/ 64 <80000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,rt-cdm3 {
+		cell-index = <3>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac29000 0x0 0x1000>;
+		reg-names = "rt-cdm3";
+		reg-cam-base = <0x29000>;
+		interrupts = <GIC_SPI 566 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm3";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_slow_ahb_clk_src";
+		clock-rates = <80000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table3>;
+		clock-cntl-level = "svs";
+		cdm-client-names = "ife2", "ife3", "ife4", "ife5", "ife6";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table3: opp-table {
+			compatible = "operating-points-v2";
+			opp-80000000 {
+				opp-hz = /bits/ 64 <80000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,cam-isp {
+		compatible = "qcom,cam-isp";
+		arch-compat = "ife";
+		status = "ok";
+	};
+
+	cam_csid0: qcom,csid0 {
+		cell-index = <0>;
+		compatible = "qcom,csid690";
+		reg-names = "csid0", "csid_top";
+		reg = <0x0 0xac7a000 0x0 0xf01>,
+			<0x0 0xac78000 0x0 0x1000>;
+		reg-cam-base = <0x7a000 0x78000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "csid0";
+		interrupts = <GIC_SPI 565 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_csid_clk_src",
+			"cam_cc_csid_clk",
+			"cam_cc_csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CSID_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CLK>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0 0>;
+		clock-cntl-level = "svs_l1";
+		src-clock-name = "cam_cc_csid_clk_src";
+		operating-points-v2 = <&csid0_opp_table>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+		};
+	};
+
+	cam_vfe0: qcom,ife0 {
+		cell-index = <0>;
+		compatible = "qcom,vfe690";
+		reg-names = "ife0", "cam_camnoc";
+		reg = <0x0 0xac4d000 0x0 0xd000>,
+			<0x0 0xac1a000 0x0 0x9400>;
+		reg-cam-base = <0x4d000 0x1a000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "ife0";
+		interrupts = <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_0_clk",
+			"cam_cc_ife_0_clk",
+			"cam_cc_ife_0_clk_src",
+			"cam_cc_ife_0_fast_ahb_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_0_FAST_AHB_CLK>;
+		clock-rates =
+			<0 0 480000000 0>,
+			<0 0 600000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_0_clk_src";
+		operating-points-v2 = <&vfe0_opp_table>;
+		clock-control-debugfs = "true";
+		ubwc-static-cfg = <0x1026 0x1036>;
+		cam_hw_pid = <8 16>;
+		status = "ok";
+		vfe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid1: qcom,csid1 {
+		cell-index = <1>;
+		compatible = "qcom,csid690";
+		reg-names = "csid1", "csid_top";
+		reg = <0x0 0xac7c000 0x0 0xf01>,
+			<0x0 0xac78000 0x0 0x1000>;
+		reg-cam-base = <0x7c000 0x78000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "csid0";
+		interrupts = <GIC_SPI 564 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_csid_clk_src",
+			"cam_cc_csid_clk",
+			"cam_cc_csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CSID_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CLK>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0 0>;
+		clock-cntl-level = "svs_l1";
+		src-clock-name = "cam_cc_csid_clk_src";
+		operating-points-v2 = <&csid1_opp_table>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+		};
+	};
+
+	cam_vfe1: qcom,ife1 {
+		cell-index = <1>;
+		compatible = "qcom,vfe690";
+		reg-names = "ife1", "cam_camnoc";
+		reg = <0x0 0xac5a000 0x0 0xd000>,
+			<0x0 0xac1a000 0x0 0x9400>;
+		reg-cam-base = <0x5a000 0x1a000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "ife1";
+		interrupts = <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_1_clk",
+			"cam_cc_ife_1_clk",
+			"cam_cc_ife_1_clk_src",
+			"cam_cc_ife_1_fast_ahb_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_1_FAST_AHB_CLK>;
+		clock-rates =
+			<0 0 480000000 0>,
+			<0 0 600000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_1_clk_src";
+		operating-points-v2 = <&vfe1_opp_table>;
+		clock-control-debugfs = "true";
+		ubwc-static-cfg = <0x1026 0x1036>;
+		cam_hw_pid = <9 17>;
+		status = "ok";
+		vfe1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite0: qcom,csid-lite0 {
+		cell-index = <2>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite0";
+		reg = <0x0 0xac84000 0x0 0xf01>;
+		reg-cam-base = <0x84000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite0";
+		interrupts = <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite0_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite0: qcom,ife-lite0 {
+		cell-index = <2>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite0";
+		reg = <0x0 0xac84000 0x0 0x1d00>;
+		reg-cam-base = <0x84000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite0";
+		interrupts = <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite0_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite1: qcom,csid-lite1 {
+		cell-index = <3>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite1";
+		reg = <0x0 0xac88000 0x0 0xf01>;
+		reg-cam-base = <0x88000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite1";
+		interrupts = <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite1_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite1: qcom,ife-lite1 {
+		cell-index = <3>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite1";
+		reg = <0x0 0xac88000 0x0 0x1d00>;
+		reg-cam-base = <0x88000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite1";
+		interrupts = <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite1_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite2: qcom,csid-lite2 {
+		cell-index = <4>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite2";
+		reg = <0x0 0xac8c000 0x0 0xf01>;
+		reg-cam-base = <0x8c000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite2";
+		interrupts = <GIC_SPI 759 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite2_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite2: qcom,ife-lite2 {
+		cell-index = <4>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite2";
+		reg = <0x0 0xac8c000 0x0 0x1d00>;
+		reg-cam-base = <0x8c000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite2";
+		interrupts = <GIC_SPI 761 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite2_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite3: qcom,csid-lite3 {
+		cell-index = <5>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite3";
+		reg = <0x0 0xac90000 0x0 0xf01>;
+		reg-cam-base = <0x90000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite3";
+		interrupts = <GIC_SPI 758 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite3_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite3: qcom,ife-lite3 {
+		cell-index = <5>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite3";
+		reg = <0x0 0xac90000 0x0 0x1d00>;
+		reg-cam-base = <0x90000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite3";
+		interrupts = <GIC_SPI 760 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite3_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite4: qcom,csid-lite4 {
+		cell-index = <6>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite4";
+		reg = <0x0 0xac94000 0x0 0xf01>;
+		reg-cam-base = <0x94000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite4";
+		interrupts = <GIC_SPI 604 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite4_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite4_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite4: qcom,ife-lite4 {
+		cell-index = <6>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite4";
+		reg = <0x0 0xac94000 0x0 0x1d00>;
+		reg-cam-base = <0x94000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite4";
+		interrupts = <GIC_SPI 605 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite4_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite4_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_sfe_lite0: qcom,sfe-lite0 {
+		cell-index = <0>;
+		compatible = "qcom,sfe-lite690";
+		reg-names = "sfe-lite0";
+		reg = <0x0 0xac74000 0x0 0x1000>;
+		reg-cam-base = <0x74000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "sfe-lite0";
+		interrupts = <GIC_SPI 563 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_sfe_lite_0_fast_ahb_clk",
+			"cam_cc_sfe_lite_0_clk",
+			"cam_cc_cpas_sfe_lite_0_clk";
+		clocks =
+			<&camcc CAM_CC_SFE_LITE_0_FAST_AHB_CLK>,
+			<&camcc CAM_CC_SFE_LITE_0_CLK>,
+			<&camcc CAM_CC_CPAS_SFE_LITE_0_CLK>;
+		clock-rates =
+			<0 480000000 300000000>,
+			<0 600000000 400000000>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_sfe_lite_0_clk";
+		operating-points-v2 = <&cam_sfe_lite_opp_table0>;
+		cam_hw_pid = <4>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		cam_sfe_lite_opp_table0: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_sfe_lite1: qcom,sfe-lite1 {
+		cell-index = <1>;
+		compatible = "qcom,sfe-lite690";
+		reg-names = "sfe-lite1";
+		reg = <0x0 0xac75000 0x0 0x1000>;
+		reg-cam-base = <0x75000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "sfe-lite1";
+		interrupts = <GIC_SPI 562 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_sfe_lite_1_fast_ahb_clk",
+			"cam_cc_sfe_lite_1_clk",
+			"cam_cc_cpas_sfe_1_clk";
+		clocks =
+			<&camcc CAM_CC_SFE_LITE_1_FAST_AHB_CLK>,
+			<&camcc CAM_CC_SFE_LITE_1_CLK>,
+			<&camcc CAM_CC_CPAS_SFE_LITE_1_CLK>;
+		clock-rates =
+			<0 480000000 300000000>,
+			<0 600000000 400000000>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_sfe_lite_1_clk";
+		operating-points-v2 = <&cam_sfe_lite_opp_table1>;
+		cam_hw_pid = <5>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		cam_sfe_lite_opp_table1: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-icp {
+		compatible = "qcom,cam-icp";
+		compat-hw-name = "qcom,icp",
+			"qcom,ipe0";
+		num-icp = <1>;
+		num-ipe = <1>;
+		icp_use_pil;
+		status = "ok";
+	};
+
+	cam_icp: qcom,icp {
+		cell-index = <0>;
+		compatible = "qcom,cam-icp_v3_0";
+		icp-version = <0x0300>;
+
+		reg-names ="icp_csr", "icp_cirq", "icp_wd0";
+		reg = <0x0 0xac01000 0x0 0x400>,
+			<0x0 0xac01800 0x0 0x400>,
+			<0x0 0xac04000 0x0 0x1000>;
+		reg-cam-base = <0x1000 0x1800 0x4000>;
+		interrupt-names = "icp";
+		interrupts = <GIC_SPI 463 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		memory-region = <&pil_camera_mem>;
+		clock-names =
+			"cam_cc_soc_fast_ahb_clk_src",
+			"cam_cc_icp_ahb_clk",
+			"cam_cc_icp_clk_src",
+			"cam_cc_icp_clk";
+		src-clock-name = "cam_cc_icp_clk_src";
+		clocks =
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_ICP_AHB_CLK>,
+			<&camcc CAM_CC_ICP_CLK_SRC>,
+			<&camcc CAM_CC_ICP_CLK>;
+		clock-rates =
+			<300000000 0 480000000 0>,
+			<400000000 0 600000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		nrt-device;
+		fw_name = "CAMERA_ICP";
+		ubwc-ipe-fetch-cfg = <0x707b 0x7083>;
+		ubwc-ipe-write-cfg = <0x161ef 0x1620f>;
+		qos-val = <0xa0a>;
+		operating-points-v2 = <&icp_opp_table>;
+		cam_hw_pid = <12>;
+		status = "ok";
+		icp_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_ipe0: qcom,ipe0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-ipe";
+		reg-names = "ipe0_top";
+		reg = <0x0 0xac2d000 0x0 0x18000>;
+		reg-cam-base = <0x2d000>;
+
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+
+		clock-names =
+			"cam_cc_cpas_ipe_clk",
+			"cam_cc_ipe_ahb_clk",
+			"cam_cc_ipe_clk",
+			"cam_cc_ipe_clk_src",
+			"cam_cc_ipe_fast_ahb_clk",
+			"cam_cc_fast_ahb_clk_src";
+		src-clock-name = "cam_cc_ipe_clk_src";
+		clocks =
+			<&camcc CAM_CC_CPAS_IPE_CLK>,
+			<&camcc CAM_CC_IPE_AHB_CLK>,
+			<&camcc CAM_CC_IPE_CLK>,
+			<&camcc CAM_CC_IPE_CLK_SRC>,
+			<&camcc CAM_CC_IPE_FAST_AHB_CLK>,
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>;
+		clock-rates =
+			<0 0 0 480000000 0 300000000>,
+			<0 0 0 600000000 0 400000000>;
+		clock-cntl-level = "svs_l1", "nominal";
+
+		operating-points-v2 = <&ipe0_opp_table>;
+		nrt-device;
+		cam_hw_pid = <14 15>;
+		status = "ok";
+
+		ipe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+
+	};
+
+	qcom,cam-cpas {
+		cell-index = <0>;
+		compatible = "qcom,cam-cpas";
+		label = "cpas";
+		arch-compat = "cpas_top";
+		reg-names = "cam_cpas_top", "cam_camnoc", "cam_rpmh";
+		reg = <0x0 0xac11000 0x0 0x1000>,
+			<0x0 0xac1A000 0x0 0x9400>,
+			<0x0 0xbbf0000 0x0 0x1f00>;
+		reg-cam-base = <0x11000 0x1A000 0x0bbf0000>;
+		interrupt-names = "cpas_camnoc";
+		interrupts = <GIC_SPI 459 IRQ_TYPE_EDGE_RISING>;
+		camnoc-axi-min-ib-bw = <3000000000>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"gcc_camera_ahb_clk",
+			"gcc_camera_hf_axi_clk",
+			"gcc_camera_sf_axi_clk",
+			"cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk",
+			"cam_cc_core_ahb_clk",
+			"cam_cc_fast_ahb_clk_src",
+			"cam_cc_cpas_fast_ahb_clk",
+			"cam_cc_camnoc_axi_clk_src",
+			"cam_cc_camnoc_axi_clk",
+			"cam_cc_qdss_debug_xo_clk";
+		clocks =
+			<&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_HF_AXI_CLK>,
+			<&gcc GCC_CAMERA_SF_AXI_CLK>,
+			<&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>,
+			<&camcc CAM_CC_CORE_AHB_CLK>,
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_FAST_AHB_CLK>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK_SRC>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&camcc CAM_CC_QDSS_DEBUG_XO_CLK>;
+		src-clock-name = "cam_cc_fast_ahb_clk_src";
+		clock-rates =
+			<0 0 0 0 0 0 0 0 0 0 0>,
+			<0 0 0 80000000 0 0 300000000 0 400000000 0 0>,
+			<0 0 0 80000000 0 0 400000000 0 400000000 0 0>;
+		clock-cntl-level = "suspend", "svs_l1", "nominal";
+		clock-names-option = "cam_icp_clk";
+		clocks-option = <&camcc CAM_CC_ICP_CLK>;
+		clock-rates-option = <480000000>;
+		operating-points-v2 = <&cpas_opp_table>;
+		control-camnoc-axi-clk;
+		camnoc-bus-width = <32>;
+		camnoc-axi-clk-bw-margin-perc = <20>;
+		cam-icc-path-names = "cam_ahb";
+		interconnect-names = "cam_ahb", "cam_hf_0", "cam_sf_0", "cam_sf_icp";
+		interconnects =<&gem_noc MASTER_APPSS_PROC 0
+			&config_noc SLAVE_CAMERA_CFG 0>,
+				<&mmss_noc MASTER_CAMNOC_HF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_SF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_ICP 0
+			&mc_virt SLAVE_EBI1 0>;
+		cam-ahb-num-cases = <7>;
+		cam-ahb-bw-KBps =
+			<0 0>, <0 76800>, <0 150000>, <0 150000>,
+			<0 300000>, <0 300000>, <0 300000>;
+		vdd-corners = <RPMH_REGULATOR_LEVEL_RETENTION
+			RPMH_REGULATOR_LEVEL_MIN_SVS
+			RPMH_REGULATOR_LEVEL_LOW_SVS
+			RPMH_REGULATOR_LEVEL_SVS
+			RPMH_REGULATOR_LEVEL_SVS_L1
+			RPMH_REGULATOR_LEVEL_NOM
+			RPMH_REGULATOR_LEVEL_NOM_L1
+			RPMH_REGULATOR_LEVEL_NOM_L2
+			RPMH_REGULATOR_LEVEL_TURBO
+			RPMH_REGULATOR_LEVEL_TURBO_L1>;
+		vdd-corner-ahb-mapping = "suspend",
+			"lowsvs", "lowsvs", "svs", "svs_l1",
+			"nominal", "nominal", "nominal",
+			"turbo", "turbo";
+		client-id-based;
+		client-names =
+			"csiphy0", "csiphy1", "csiphy2", "csiphy3",
+			"cci0", "cci1", "cci2", "cci3","csid0", "csid1",
+			"csid2", "csid3", "csid4", "csid5", "csid6",
+			"ife0", "ife1",	"ife2", "ife3", "ife4",
+			"ife5",	"ife6", "ipe0", "sfe0", "sfe1",
+			"cam-cdm-intf0", "rt-cdm0", "rt-cdm1", "rt-cdm2",
+			"rt-cdm3", "icp0", "tpg17", "tpg18", "tpg19";
+
+		status = "ok";
+		enable-secure-qos-update;
+		cpas_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+
+		camera-bus-nodes {
+			level3-nodes {
+				level-index = <3>;
+				level3_rt_rd_wr_sum: level3-rt-rd-wr-sum {
+					cell-index = <0>;
+					node-name = "level3-rt-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					ib-bw-voting-needed;
+					qcom,axi-port-mnoc {
+						cam-icc-path-names = "cam_hf_0";
+					};
+				};
+
+				level3_nrt0_rd_wr_sum: level3-nrt0-rd-wr-sum {
+					cell-index = <1>;
+					node-name = "level3-nrt0-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						cam-icc-path-names = "cam_sf_0";
+					};
+				};
+
+				level3_nrt1_rd_wr_sum: level3-nrt1-rd-wr-sum {
+					cell-index = <2>;
+					node-name = "level3-nrt1-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						cam-icc-path-names = "cam_sf_icp";
+					};
+				};
+			};
+
+			level2-nodes {
+				level-index = <2>;
+				camnoc-max-needed;
+				level2_rt_wr0: level2-rt-wr0 {
+					cell-index = <3>;
+					node-name = "level2-rt-wr0";
+					parent-node = <&level3_rt_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_rt_wr1: level2-rt-wr1 {
+					cell-index = <4>;
+					node-name = "level2-rt-wr1";
+					parent-node = <&level3_rt_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt_wr2: level2-nrt-wr2 {
+					cell-index = <5>;
+					node-name = "level2-nrt-wr2";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_rt_rd0: level2-rt-read0 {
+					cell-index = <6>;
+					node-name = "level2-rt-rd0";
+					parent-node = <&level3_rt_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt_rd1: level2-nrt-rd1 {
+					cell-index = <7>;
+					node-name = "level2-nrt-rd1";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt_rd2: level2-nrt-rd2 {
+					cell-index = <8>;
+					node-name = "level2-nrt-rd2";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_icp_rd: level2-icp-rd {
+					cell-index = <9>;
+					node-name = "level2-icp-rd";
+					parent-node = <&level3_nrt1_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+			};
+
+			level1-nodes {
+				level-index = <1>;
+				camnoc-max-needed;
+				level1_rt_wr0: level1-rt-wr0 {
+					cell-index = <10>;
+					node-name = "level1-rt-wr0";
+					parent-node = <&level2_rt_wr0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt_wr1: level1-rt-wr1 {
+					cell-index = <11>;
+					node-name = "level1-rt-wr1";
+					parent-node = <&level2_rt_wr1>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt_rd0: level1-rt-read0 {
+					cell-index = <13>;
+					node-name = "level1-rt-rd0";
+					parent-node = <&level2_rt_rd0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt_rd2: level1-nrt-rd2 {
+					cell-index = <15>;
+					node-name = "level1-nrt-rd2";
+					parent-node = <&level2_nrt_rd2>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+			};
+
+			level0-nodes {
+				level-index = <0>;
+				ife_0_wr_0: ife-0-wr-0 {
+					cell-index = <16>;
+					node-name = "ife-0-wr-0";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_1_wr_0: ife-1-wr-0 {
+					cell-index = <17>;
+					node-name = "ife-1-wr-0";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_0_wr_0: ife-lite-0-wr-0 {
+					cell-index = <18>;
+					node-name = "ife-lite-0-wr-0";
+					client-name = "ife2";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_1_wr_0: ife-lite-1-wr-0 {
+					cell-index = <19>;
+					node-name = "ife-lite-1-wr-0";
+					client-name = "ife3";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_2_wr_0: ife-lite-2-wr-0 {
+					cell-index = <20>;
+					node-name = "ife-lite-2-wr-0";
+					client-name = "ife4";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_3_wr_0: ife-lite-3-wr-0 {
+					cell-index = <21>;
+					node-name = "ife-lite-3-wr-0";
+					client-name = "ife5";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_4_wr_0: ife-lite-4-wr-0 {
+					cell-index = <22>;
+					node-name = "ife-lite-4-wr-0";
+					client-name = "ife6";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_0_wr_1: ife-0-wr-1 {
+					cell-index = <23>;
+					node-name = "ife-0-wr-1";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_UBWC>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_DISP>;
+					parent-node = <&level1_rt_wr1>;
+				};
+				ife_1_wr_1: ife-1-wr-1 {
+					cell-index = <24>;
+					node-name = "ife-1-wr-1";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_UBWC>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_DISP>;
+					parent-node = <&level1_rt_wr1>;
+				};
+				sfe_0_rd_0: sfe-0-rd-0 {
+					cell-index = <25>;
+					node-name = "sfe-0-rd-0";
+					client-name = "sfe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_SFE_NRDI>;
+					parent-node = <&level1_rt_rd0>;
+				};
+				sfe_1_rd_0: sfe-1-rd-0 {
+					cell-index = <26>;
+					node-name = "sfe-1-rd-0";
+					client-name = "sfe1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_SFE_NRDI>;
+					parent-node = <&level1_rt_rd0>;
+				};
+				ipe_0_wr_2: ipe-0-wr-2 {
+					cell-index = <27>;
+					node-name = "ipe-0-wr-2";
+					client-name = "ipe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_WR_VID
+					CAM_CPAS_PATH_DATA_IPE_WR_DISP
+					CAM_CPAS_PATH_DATA_IPE_WR_REF
+					CAM_CPAS_PATH_DATA_IPE_WR_APP>;
+					parent-node = <&level2_nrt_wr2>;
+				};
+				ipe_0_rd_all: ipe-0-rd-all {
+					cell-index = <28>;
+					node-name = "ipe-0-rd-all";
+					client-name = "ipe0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_RD_IN
+					CAM_CPAS_PATH_DATA_IPE_RD_REF>;
+					parent-node = <&level2_nrt_rd1>;
+				};
+				rt_cdm0_all_rd_2: rt-cdm0-all-rd-2 {
+					cell-index = <29>;
+					node-name = "rt-cdm0-all-rd-2";
+					client-name = "rt-cdm0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				rt_cdm1_all_rd_2: rt-cdm1-all-rd-2 {
+					cell-index = <30>;
+					node-name = "rt-cdm1-all-rd-2";
+					client-name = "rt-cdm1";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				rt_cdm2_all_rd_2: rt-cdm2-all-rd-2 {
+					cell-index = <31>;
+					node-name = "rt-cdm2-all-rd-2";
+					client-name = "rt-cdm2";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				rt_cdm3_all_rd_2: rt-cdm3-all-rd-2 {
+					cell-index = <32>;
+					node-name = "rt-cdm3-all-rd-2";
+					client-name = "rt-cdm3";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				ipe_cdm0_all_rd: ipe-cdm0-all-rd {
+					cell-index = <33>;
+					node-name = "ipe-cdm0-all-rd";
+					client-name = "ipe0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				icp_all_rd: icp-all-rd {
+					cell-index = <34>;
+					node-name = "icp-all-rd";
+					client-name = "icp0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level2_icp_rd>;
+				};
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-camera-iq-9075-evk.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-camera-iq-9075-evk.dtso
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,sa8775p-gcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-camcc.h>
+#include <dt-bindings/interconnect/qcom,sa8775p-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+
+#include "qcs9075-camera-iq-9075-evk.dtsi"
+#include "qcs9075-camera-sensor-iq-9075-evk.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-camera-sensor-iq-9075-evk.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-camera-sensor-iq-9075-evk.dtsi
@@ -0,0 +1,638 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&soc {
+	qcom,cam-res-mgr {
+		compatible = "qcom,cam-res-mgr";
+		status = "ok";
+		gpios-shared = <518 519 520 521>;
+	};
+};
+
+&cam_cci0 {
+
+	/* GMSL deserializer 0 */
+	qcom,cam-gmsl-deserializer0 {
+		cell-index = <0>;
+		csiphy-sd-index = <0>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend>;
+		gpios = <&pmm8654au_0_gpios 7 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET0";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK0_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser0_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor0_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser0_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor1_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser0_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor2_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser0_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor3_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 0 */
+	qcom,cam-gmsl-sensor0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor0_ep: endpoint {
+				remote-endpoint = <&deser0_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 1 */
+	qcom,cam-gmsl-sensor1 {
+		cell-index = <1>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor1_ep: endpoint {
+				remote-endpoint = <&deser0_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 2 */
+	qcom,cam-gmsl-sensor2 {
+		cell-index = <2>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor2_ep: endpoint {
+				remote-endpoint = <&deser0_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 3 */
+	qcom,cam-gmsl-sensor3 {
+		cell-index = <3>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor3_ep: endpoint {
+				remote-endpoint = <&deser0_port3>;
+			};
+		};
+	};
+
+	/*cam0a-ov9282*/
+	qcom,cam-sensor1 {
+		cell-index = <20>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <0>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+		                &cam_sensor_active_rst0>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+		                &cam_sensor_suspend_rst0>;
+		gpios = <&tlmm 72 0>,
+			<&tlmm 132 0>,
+			<&pmm8654au_0_gpios 7 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags   	 = <1 0 0>;
+		gpio-req-tbl-label = "CAM_MCLK0",
+		                       "CAMIF_RESET0",
+		                         "CAM_CUSTOM1";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK0_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+	};
+
+};
+
+&cam_cci1 {
+
+	/* GMSL deserializer 1 */
+	qcom,cam-gmsl-deserializer1 {
+		cell-index = <1>;
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend>;
+		gpios = <&pmm8654au_0_gpios 8 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET1";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser1_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor4_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser1_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor5_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser1_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor6_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser1_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor7_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 0 */
+	qcom,cam-gmsl-sensor4 {
+		cell-index = <4>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor4_ep: endpoint {
+				remote-endpoint = <&deser1_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 1 */
+	qcom,cam-gmsl-sensor5 {
+		cell-index = <5>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor5_ep: endpoint {
+				remote-endpoint = <&deser1_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 2 */
+	qcom,cam-gmsl-sensor6 {
+		cell-index = <6>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor6_ep: endpoint {
+				remote-endpoint = <&deser1_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 3 */
+	qcom,cam-gmsl-sensor7 {
+		cell-index = <7>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor7_ep: endpoint {
+				remote-endpoint = <&deser1_port3>;
+			};
+		};
+	};
+
+	/*cam1-ov9282*/
+	qcom,cam-sensor21 {
+		cell-index = <21>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+		                &cam_sensor_active_rst1>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+		                &cam_sensor_suspend_rst1>;
+		gpios = <&tlmm 73 0>,
+			<&tlmm 133 0>,
+			<&pmm8654au_0_gpios 8 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags   	 = <1 0 0>;
+		gpio-req-tbl-label = "CAM_MCLK1",
+		                       "CAMIF_RESET1",
+		                         "CAM_CUSTOM1";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+	};
+
+};
+
+&cam_cci2 {
+
+	/* GMSL deserializer 2 */
+	qcom,cam-gmsl-deserializer2 {
+		cell-index = <2>;
+		csiphy-sd-index = <2>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend>;
+		gpios = <&pmm8654au_0_gpios 9 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET2";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser2_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor8_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser2_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor9_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser2_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor10_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser2_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor11_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 0 */
+	qcom,cam-gmsl-sensor8 {
+		cell-index = <8>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor8_ep: endpoint {
+				remote-endpoint = <&deser2_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 1 */
+	qcom,cam-gmsl-sensor9 {
+		cell-index = <9>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor9_ep: endpoint {
+				remote-endpoint = <&deser2_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 2 */
+	qcom,cam-gmsl-sensor10 {
+		cell-index = <10>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor10_ep: endpoint {
+				remote-endpoint = <&deser2_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 3 */
+	qcom,cam-gmsl-sensor11 {
+		cell-index = <11>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor11_ep: endpoint {
+				remote-endpoint = <&deser2_port3>;
+			};
+		};
+	};
+
+	/*cam2-ov9282*/
+	qcom,cam-sensor22 {
+		cell-index = <22>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <2>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+		                &cam_sensor_active_rst2>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+		                &cam_sensor_suspend_rst2>;
+		gpios = <&tlmm 74 0>,
+			<&tlmm 134 0>,
+			<&pmm8654au_0_gpios 9 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags   	 = <1 0 0>;
+		gpio-req-tbl-label = "CAM_MCLK2",
+		                       "CAMIF_RESET2",
+		                         "CAM_CUSTOM1";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+	};
+
+};
+
+&cam_cci3 {
+
+	/* GMSL deserializer 3 */
+	qcom,cam-gmsl-deserializer3 {
+		cell-index = <3>;
+		csiphy-sd-index = <3>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend>;
+		gpios = <&pmm8654au_0_gpios 10 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET3";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK3_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser3_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor12_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser3_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor13_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser3_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor14_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser3_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor15_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 3 sensor 0 */
+	qcom,cam-gmsl-sensor12 {
+		cell-index = <12>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <3>;
+		status = "ok";
+		port {
+			gmsl_sensor12_ep: endpoint {
+				remote-endpoint = <&deser3_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 3 sensor 1 */
+	qcom,cam-gmsl-sensor13 {
+		cell-index = <13>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <3>;
+		status = "ok";
+		port {
+			gmsl_sensor13_ep: endpoint {
+				remote-endpoint = <&deser3_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 3 sensor 2 */
+	qcom,cam-gmsl-sensor14 {
+		cell-index = <14>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <3>;
+		status = "ok";
+		port {
+			gmsl_sensor14_ep: endpoint {
+				remote-endpoint = <&deser3_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 3 sensor 3 */
+	qcom,cam-gmsl-sensor15 {
+		cell-index = <15>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <3>;
+		status = "ok";
+		port {
+			gmsl_sensor15_ep: endpoint {
+				remote-endpoint = <&deser3_port3>;
+			};
+		};
+	};
+
+	/*cam3-ov9282*/
+	qcom,cam-sensor23 {
+		cell-index = <23>;
+		compatible = "qcom,cam-sensor";
+		csiphy-sd-index = <3>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active
+		                &cam_sensor_active_rst3>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend
+		                &cam_sensor_suspend_rst3>;
+		gpios = <&tlmm 75 0>,
+			<&tlmm 135 0>,
+			<&pmm8654au_0_gpios 10 0>;
+		gpio-reset = <1>;
+		gpio-custom1 = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags   	 = <1 0 0>;
+		gpio-req-tbl-label = "CAM_MCLK3",
+		                       "CAMIF_RESET3",
+		                         "CAM_CUSTOM1";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK3_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+	};
+
+};
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-iq-9075-evk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-iq-9075-evk.dts
@@ -0,0 +1,1241 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/regulator/qcom,rpmh-regulator.h>
+
+#include "sa8775p.dtsi"
+#include "sa8775p-pmics.dtsi"
+#include "qcs9075-thermal.dtsi"
+#include "qcs9xxx-reserved-memory.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. IQ 9075 EVK";
+	compatible = "qcom,qcs9075-iq-9075-evk", "qcom,qcs9075", "qcom,sa8775p";
+	qcom,msm-id = <676 0x20000>;
+	qcom,board-id = <0x10020 0>, <0x10019 0>;
+
+	aliases {
+		ethernet0 = &ethernet0;
+		serial0 = &uart10;
+		serial1 = &uart17;
+		ufshc1 = &ufs_mem_hc;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	wcn6855-pmu {
+		compatible = "qcom,wcn6855-pmu";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&wlan_en_state>;
+		wlan-enable-gpios = <&pmm8654au_1_gpios 7 GPIO_ACTIVE_HIGH>;
+
+		regulators {
+			vreg_pmu_rfa_cmn: ldo0 {
+				regulator-name = "vreg_pmu_rfa_cmn";
+			};
+
+			vreg_pmu_aon_0p59: ldo1 {
+				regulator-name = "vreg_pmu_aon_0p59";
+			};
+
+			vreg_pmu_wlcx_0p8: ldo2 {
+				regulator-name = "vreg_pmu_wlcx_0p8";
+			};
+
+			vreg_pmu_wlmx_0p85: ldo3 {
+				regulator-name = "vreg_pmu_wlmx_0p85";
+			};
+
+			vreg_pmu_btcmx_0p85: ldo4 {
+				regulator-name = "vreg_pmu_btcmx_0p85";
+			};
+
+			vreg_pmu_rfa_0p8: ldo5 {
+				regulator-name = "vreg_pmu_rfa_0p8";
+			};
+
+			vreg_pmu_rfa_1p2: ldo6 {
+				regulator-name = "vreg_pmu_rfa_1p2";
+			};
+
+			vreg_pmu_rfa_1p7: ldo7 {
+				regulator-name = "vreg_pmu_rfa_1p7";
+			};
+
+			vreg_pmu_pcie_0p9: ldo8 {
+				regulator-name = "vreg_pmu_pcie_0p9";
+			};
+
+			vreg_pmu_pcie_1p8: ldo9 {
+				regulator-name = "vreg_pmu_pcie_1p8";
+			};
+		};
+	};
+};
+
+&apps_rsc {
+	regulators-0 {
+		compatible = "qcom,pmm8654au-rpmh-regulators";
+		qcom,pmic-id = "a";
+
+		vreg_s4a: smps4 {
+			regulator-name = "vreg_s4a";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1816000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5a: smps5 {
+			regulator-name = "vreg_s5a";
+			regulator-min-microvolt = <1850000>;
+			regulator-max-microvolt = <1996000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s9a: smps9 {
+			regulator-name = "vreg_s9a";
+			regulator-min-microvolt = <535000>;
+			regulator-max-microvolt = <1120000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l4a: ldo4 {
+			regulator-name = "vreg_l4a";
+			regulator-min-microvolt = <788000>;
+			regulator-max-microvolt = <1050000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l5a: ldo5 {
+			regulator-name = "vreg_l5a";
+			regulator-min-microvolt = <870000>;
+			regulator-max-microvolt = <950000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6a: ldo6 {
+			regulator-name = "vreg_l6a";
+			regulator-min-microvolt = <870000>;
+			regulator-max-microvolt = <970000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7a: ldo7 {
+			regulator-name = "vreg_l7a";
+			regulator-min-microvolt = <720000>;
+			regulator-max-microvolt = <950000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8a: ldo8 {
+			regulator-name = "vreg_l8a";
+			regulator-min-microvolt = <2504000>;
+			regulator-max-microvolt = <3300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l9a: ldo9 {
+			regulator-name = "vreg_l9a";
+			regulator-min-microvolt = <2970000>;
+			regulator-max-microvolt = <3544000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-1 {
+		compatible = "qcom,pmm8654au-rpmh-regulators";
+		qcom,pmic-id = "c";
+
+		vreg_l1c: ldo1 {
+			regulator-name = "vreg_l1c";
+			regulator-min-microvolt = <1140000>;
+			regulator-max-microvolt = <1260000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2c: ldo2 {
+			regulator-name = "vreg_l2c";
+			regulator-min-microvolt = <900000>;
+			regulator-max-microvolt = <1100000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3c: ldo3 {
+			regulator-name = "vreg_l3c";
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l4c: ldo4 {
+			regulator-name = "vreg_l4c";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			/*
+			 * FIXME: This should have regulator-allow-set-load but
+			 * we're getting an over-current fault from the PMIC
+			 * when switching to LPM.
+			 */
+		};
+
+		vreg_l5c: ldo5 {
+			regulator-name = "vreg_l5c";
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6c: ldo6 {
+			regulator-name = "vreg_l6c";
+			regulator-min-microvolt = <1620000>;
+			regulator-max-microvolt = <1980000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7c: ldo7 {
+			regulator-name = "vreg_l7c";
+			regulator-min-microvolt = <1620000>;
+			regulator-max-microvolt = <2000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8c: ldo8 {
+			regulator-name = "vreg_l8c";
+			regulator-min-microvolt = <2400000>;
+			regulator-max-microvolt = <3300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l9c: ldo9 {
+			regulator-name = "vreg_l9c";
+			regulator-min-microvolt = <1650000>;
+			regulator-max-microvolt = <2700000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-2 {
+		compatible = "qcom,pmm8654au-rpmh-regulators";
+		qcom,pmic-id = "e";
+
+		vreg_s4e: smps4 {
+			regulator-name = "vreg_s4e";
+			regulator-min-microvolt = <970000>;
+			regulator-max-microvolt = <1520000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s7e: smps7 {
+			regulator-name = "vreg_s7e";
+			regulator-min-microvolt = <1010000>;
+			regulator-max-microvolt = <1170000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s9e: smps9 {
+			regulator-name = "vreg_s9e";
+			regulator-min-microvolt = <300000>;
+			regulator-max-microvolt = <570000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6e: ldo6 {
+			regulator-name = "vreg_l6e";
+			regulator-min-microvolt = <1280000>;
+			regulator-max-microvolt = <1450000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8e: ldo8 {
+			regulator-name = "vreg_l8e";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1950000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+};
+
+&ethernet0 {
+	phy-handle = <&sgmii_phy0>;
+	phy-mode = "sgmii";
+
+	pinctrl-0 = <&ethernet0_default>;
+	pinctrl-names = "default";
+
+	snps,mtl-rx-config = <&mtl_rx_setup>;
+	snps,mtl-tx-config = <&mtl_tx_setup>;
+	snps,ps-speed = <1000>;
+
+	status = "okay";
+
+	mdio {
+		compatible = "snps,dwmac-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		sgmii_phy0: phy@1c {
+			compatible = "ethernet-phy-id004d.d101";
+			reg = <0x1c>;
+			device_type = "ethernet-phy";
+			reset-gpios = <&pmm8654au_2_gpios 8 GPIO_ACTIVE_LOW>;
+			reset-assert-us = <11000>;
+			reset-deassert-us = <70000>;
+		};
+	};
+
+	mtl_rx_setup: rx-queues-config {
+		snps,rx-queues-to-use = <4>;
+		snps,rx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x0>;
+			snps,route-up;
+			snps,priority = <0x1>;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x1>;
+			snps,route-ptp;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x2>;
+			snps,route-avcp;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x3>;
+			snps,priority = <0xc>;
+		};
+	};
+
+	mtl_tx_setup: tx-queues-config {
+		snps,tx-queues-to-use = <4>;
+		snps,tx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+	};
+};
+
+&eud {
+	status = "okay";
+};
+
+&i2c0 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c1 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c2 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c3 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c4 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c5 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c7 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c8 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c9 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c10 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c11 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+
+	pinctrl-0 = <&qup_i2c11_default>, <&usb0_intr_state>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	hd3ss3220@67 {
+		compatible = "ti,hd3ss3220";
+		reg = <0x67>;
+		interrupt-parent = <&pmm8654au_2_gpios>;
+		interrupts = < 5 IRQ_TYPE_EDGE_FALLING>;
+
+		connector@0 {
+			compatible = "usb-c-connector";
+			label = "USB-C";
+			data-role = "dual";
+			power-role = "dual";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					hd3ss3220_ep: endpoint {
+						remote-endpoint = <&usb_role_switch>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&i2c12 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c13 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c14 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c15 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c16 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c17 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&i2c18 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+	pinctrl-0 = <&qup_i2c18_default>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	expander0: pca953x@38 {
+		compatible = "ti,tca9538";
+		#gpio-cells = <2>;
+		gpio-controller;
+		reg = <0x38>;
+	};
+
+	expander1: pca953x@39 {
+		compatible = "ti,tca9538";
+		#gpio-cells = <2>;
+		gpio-controller;
+		reg = <0x39>;
+
+		io-exp-hog2 {
+			gpio-hog;
+			gpios = <2 GPIO_ACTIVE_HIGH>;
+			output-low;
+			line-name = "io_exp_gpio2";
+		};
+
+		io-exp-hog3 {
+			gpio-hog;
+			gpios = <3 GPIO_ACTIVE_HIGH>;
+			output-low;
+			line-name = "io_exp_gpio3";
+		};
+	};
+
+	expander2: pca953x@3a {
+		compatible = "ti,tca9538";
+		#gpio-cells = <2>;
+		gpio-controller;
+		reg = <0x3a>;
+	};
+
+	expander3: pca953x@3b {
+		compatible = "ti,tca9538";
+		#gpio-cells = <2>;
+		gpio-controller;
+		reg = <0x3b>;
+	};
+};
+
+&i2c19 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&llcc {
+	status = "okay";
+};
+
+&mdss0 {
+	status = "okay";
+};
+
+&mdss0_dp0 {
+	status = "okay";
+};
+
+&mdss0_dp0_out {
+	data-lanes = <0 1 2 3>;
+	link-frequencies = /bits/ 64 <1620000000 2700000000 5400000000 8100000000>;
+};
+
+&mdss0_dp1 {
+	status = "okay";
+};
+
+&mdss0_dp1_out {
+	data-lanes = <0 1 2 3>;
+	link-frequencies = /bits/ 64 <1620000000 2700000000 5400000000 8100000000>;
+};
+
+&mdss0_edp_phy {
+	status = "okay";
+};
+
+&mdss0_edp1_phy {
+	status = "okay";
+};
+
+&pmm8654au_1_gpios {
+	gpio-line-names = "PMIC_C_ID0",
+			  "PMIC_C_ID1",
+			  "UFS1_VER_ID",
+			  "IPA_PWR",
+			  "",
+			  "WLAN_DBU4_EN",
+			  "WLAN_EN",
+			  "BT_EN",
+			  "USB2_PWR_EN",
+			  "USB2_FAULT";
+
+	bt_en_state: bt-en-state {
+		pins = "gpio8";
+		function = "normal";
+		output-low;
+		bias-pull-down;
+	};
+
+	usb2_en_state: usb2-en-state {
+		pins = "gpio9";
+		function = "normal";
+		output-high;
+		power-source = <0>;
+	};
+
+	wlan_en_state: wlan-en-state {
+		pins = "gpio7";
+		function = "normal";
+		output-low;
+		bias-pull-down;
+	};
+};
+
+&pmm8654au_2_gpios {
+	usb0_intr_state: usb0-intr-state {
+		pins = "gpio5";
+		function = "normal";
+		input-enable;
+		bias-pull-up;
+		power-source = <0>;
+	};
+};
+
+&qupv3_id_1 {
+	status = "okay";
+};
+
+&qupv3_id_2 {
+	status = "okay";
+};
+
+&remoteproc_adsp {
+	firmware-name = "qcom/sa8775p/adsp.mbn";
+	status = "okay";
+};
+
+&remoteproc_cdsp0 {
+	firmware-name = "qcom/sa8775p/cdsp0.mbn";
+	status = "okay";
+};
+
+&remoteproc_cdsp1 {
+	firmware-name = "qcom/sa8775p/cdsp1.mbn";
+	status = "okay";
+};
+
+&remoteproc_gpdsp0 {
+	firmware-name = "qcom/sa8775p/gpdsp0.mbn";
+	status = "okay";
+};
+
+&remoteproc_gpdsp1 {
+	firmware-name = "qcom/sa8775p/gpdsp1.mbn";
+	status = "okay";
+};
+
+&serdes0 {
+	phy-supply = <&vreg_l5a>;
+	status = "okay";
+};
+
+&sleep_clk {
+	clock-frequency = <32768>;
+};
+
+&spi0 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi1 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi2 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi3 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi4 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi5 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi7 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi8 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi9 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi10 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi11 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi12 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi14 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi15 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi16 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi17 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi18 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&spi19 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&tlmm {
+	bt_bootstrap_default: bt_bootstrap_default {
+		pins = "gpio147";
+		function = "gpio";
+		input-enable;
+		bias-pull-up;
+		drive-strength = <2>;
+	};
+
+	dp_hot_plug_det: dp-hot-plug-det-state {
+		pins = "gpio101";
+		function = "edp0_hot";
+		bias-disable;
+	};
+
+	dp1_hot_plug_det: dp1-hot-plug-det-state {
+		pins = "gpio102";
+		function = "edp1_hot";
+		bias-disable;
+	};
+
+	ethernet0_default: ethernet0-default-state {
+		ethernet0_mdc: ethernet0-mdc-pins {
+			pins = "gpio8";
+			function = "emac0_mdc";
+			drive-strength = <16>;
+			bias-pull-up;
+		};
+
+		ethernet0_mdio: ethernet0-mdio-pins {
+			pins = "gpio9";
+			function = "emac0_mdio";
+			drive-strength = <16>;
+			bias-pull-up;
+		};
+	};
+
+	qup_uart10_default: qup-uart10-state {
+		pins = "gpio46", "gpio47";
+		function = "qup1_se3";
+	};
+
+	qup_uart17_default: qup-uart17-state {
+		qup_uart17_cts: qup-uart17-cts-pins {
+			pins = "gpio91";
+			function = "qup2_se3";
+			bias-disable;
+		};
+
+		qup_uart17_rts: qup0-uart17-rts-pins {
+			pins = "gpio92";
+			function = "qup2_se3";
+			bias-pull-down;
+		};
+
+		qup_uart17_tx: qup0-uart17-tx-pins {
+			pins = "gpio93";
+			function = "qup2_se3";
+			bias-pull-up;
+		};
+
+		qup_uart17_rx: qup0-uart17-rx-pins {
+			pins = "gpio94";
+			function = "qup2_se3";
+			bias-pull-down;
+		};
+	};
+
+	pcie0_default_state: pcie0-default-state {
+		perst-pins {
+			pins = "gpio2";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+
+		clkreq-pins {
+			pins = "gpio1";
+			function = "pcie0_clkreq";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+
+		wake-pins {
+			pins = "gpio0";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	pcie1_default_state: pcie1-default-state {
+		perst-pins {
+			pins = "gpio4";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+
+		clkreq-pins {
+			pins = "gpio3";
+			function = "pcie1_clkreq";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+
+		wake-pins {
+			pins = "gpio5";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	qup_i2c18_default: qup-i2c18-state {
+		pins = "gpio95", "gpio96";
+		function = "qup2_se4";
+		drive-strength = <2>;
+		bias-pull-up;
+	};
+
+	qup_i2c11_default: qup-i2c11-state {
+		pins = "gpio48", "gpio49";
+		function = "qup1_se4";
+		drive-strength = <2>;
+		bias-pull-up;
+	};
+};
+
+&pcie0 {
+	perst-gpios = <&tlmm 2 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_default_state>;
+
+	status = "okay";
+};
+
+&pcie1 {
+	perst-gpios = <&tlmm 4 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie1_default_state>;
+
+	status = "okay";
+};
+
+&pcie0_phy {
+	vdda-phy-supply = <&vreg_l5a>;
+	vdda-pll-supply = <&vreg_l1c>;
+
+	status = "okay";
+};
+
+&pcie1_phy {
+	vdda-phy-supply = <&vreg_l5a>;
+	vdda-pll-supply = <&vreg_l1c>;
+
+	status = "okay";
+};
+
+&pcieport0 {
+	wifi@0 {
+		compatible = "qcom,wcn6855-wifi";
+		reg = <0x10000 0x0 0x0 0x0 0x0>;
+
+		vddrfacmn-supply = <&vreg_pmu_rfa_cmn>;
+		vddaon-supply = <&vreg_pmu_aon_0p59>;
+		vddwlcx-supply = <&vreg_pmu_wlcx_0p8>;
+		vddwlmx-supply = <&vreg_pmu_wlmx_0p85>;
+		vddrfa0p8-supply = <&vreg_pmu_rfa_0p8>;
+		vddrfa1p2-supply = <&vreg_pmu_rfa_1p2>;
+		vddrfa1p7-supply = <&vreg_pmu_rfa_1p7>;
+		vddpcie0p9-supply = <&vreg_pmu_pcie_0p9>;
+		vddpcie1p8-supply = <&vreg_pmu_pcie_1p8>;
+	};
+};
+
+&pmm8654au_0_pon_resin {
+	linux,code = <KEY_VOLUMEDOWN>;
+	status = "okay";
+};
+
+&uart0 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart1 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart2 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart3 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart4 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart5 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart7 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart8 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart9 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart10 {
+	compatible = "qcom,geni-debug-uart";
+	pinctrl-0 = <&qup_uart10_default>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&uart11 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart12 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart14 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart15 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart16 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart17 {
+	pinctrl-0 = <&qup_uart17_default>;
+	pinctrl-names = "default";
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+	status = "okay";
+
+	/* HS UART Instance */
+	bluetooth: bluetooth {
+		compatible = "qcom,wcn6855-bt";
+		pinctrl-names = "default";
+		pinctrl-0 = <&bt_en_state>, <&bt_bootstrap_default>;
+		enable-gpios = <&pmm8654au_1_gpios 8 GPIO_ACTIVE_HIGH>; /* BT_EN */
+		max-speed = <3200000>;
+	};
+};
+
+&uart18 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&uart19 {
+	qcom,load-firmware;
+	qcom,xfer-mode = <1>;
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 149 GPIO_ACTIVE_LOW>;
+	vcc-supply = <&vreg_l8a>;
+	vcc-max-microamp = <1100000>;
+	vccq-supply = <&vreg_l4c>;
+	vccq-max-microamp = <1200000>;
+
+	status = "okay";
+};
+
+&ufs_mem_phy {
+	vdda-phy-supply = <&vreg_l4a>;
+	vdda-pll-supply = <&vreg_l1c>;
+
+	status = "okay";
+};
+
+&soc {
+	vbus_supply_regulator_0: vbus_supply_regulator_0 {
+		compatible = "regulator-fixed";
+		regulator-name = "vbus_supply_0";
+		gpio = <&expander1 2 GPIO_ACTIVE_HIGH>;
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		enable-active-high;
+	};
+
+	vbus_supply_regulator_1: vbus_supply_regulator_1 {
+		compatible = "regulator-fixed";
+		regulator-name = "vbus_supply_1";
+		gpio = <&expander1 3 GPIO_ACTIVE_HIGH>;
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		enable-active-high;
+		regulator-always-on;
+	};
+};
+
+/delete-node/ &usb_0_dwc3;
+
+&usb_0 {
+	reg = <0x0 0x0a600000 0x0 0x200000>;
+
+	interrupts-extended = <&intc GIC_SPI 292 IRQ_TYPE_LEVEL_HIGH>,
+			      <&intc GIC_SPI 287 IRQ_TYPE_LEVEL_HIGH>,
+			      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
+			      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
+			      <&pdc 12 IRQ_TYPE_LEVEL_HIGH>;
+	interrupt-names = "dwc_usb3",
+			  "pwr_event",
+			  "dp_hs_phy_irq",
+			  "dm_hs_phy_irq",
+			  "ss_phy_irq";
+
+	iommus = <&apps_smmu 0x080 0x0>;
+	phys = <&usb_0_hsphy>, <&usb_0_qmpphy>;
+	phy-names = "usb2-phy", "usb3-phy";
+
+	dr_mode = "otg";
+	usb-role-switch;
+	snps,dis_u2_susphy_quirk;
+	snps,dis_enblslpm_quirk;
+	maximum-speed = "super-speed";
+	qcom,enable-rt;
+	wakeup-source;
+	vbus_dwc3-supply = <&vbus_supply_regulator_0>;
+	status = "okay";
+
+	ports {
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			usb_role_switch: endpoint {
+				remote-endpoint = <&hd3ss3220_ep>;
+			};
+		};
+
+	};
+};
+
+&usb_0_hsphy {
+	vdda-pll-supply = <&vreg_l7a>;
+	vdda18-supply = <&vreg_l6c>;
+	vdda33-supply = <&vreg_l9a>;
+
+	status = "okay";
+};
+
+&usb_0_qmpphy {
+	vdda-phy-supply = <&vreg_l1c>;
+	vdda-pll-supply = <&vreg_l7a>;
+
+	status = "okay";
+};
+
+/delete-node/ &usb_1_dwc3;
+
+&usb_1 {
+	reg = <0x0 0x0a800000 0x0 0x200000>;
+	interrupts-extended = <&intc GIC_SPI 349 IRQ_TYPE_LEVEL_HIGH>,
+				<&intc GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>,
+				<&pdc 8 IRQ_TYPE_EDGE_BOTH>,
+				<&pdc 7 IRQ_TYPE_EDGE_BOTH>,
+				<&pdc 13 IRQ_TYPE_LEVEL_HIGH>;
+	interrupt-names = "dwc_usb3",
+			"pwr_event",
+			"dp_hs_phy_irq",
+			"dm_hs_phy_irq",
+			"ss_phy_irq";
+
+	iommus = <&apps_smmu 0x0a0 0x0>;
+	phys = <&usb_1_hsphy>, <&usb_1_qmpphy>;
+	phy-names = "usb2-phy", "usb3-phy";
+	snps,dis_u2_susphy_quirk;
+	snps,dis_enblslpm_quirk;
+	qcom,enable-rt;
+	wakeup-source;
+	maximum-speed = "super-speed";
+	dr_mode = "otg";
+	usb-role-switch;
+	role-switch-default-mode = "host";
+	vbus_dwc3-supply = <&vbus_supply_regulator_1>;
+	status = "okay";
+};
+
+&usb_1_hsphy {
+	vdda-pll-supply = <&vreg_l7a>;
+	vdda18-supply = <&vreg_l6c>;
+	vdda33-supply = <&vreg_l9a>;
+
+	status = "okay";
+};
+
+&usb_1_qmpphy {
+	vdda-phy-supply = <&vreg_l1c>;
+	vdda-pll-supply = <&vreg_l7a>;
+
+	status = "okay";
+};
+
+&usb_2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&usb2_en_state>;
+
+	status = "okay";
+};
+
+&usb_2_dwc3 {
+	dr_mode = "host";
+};
+
+&usb_2_hsphy {
+	vdda-pll-supply = <&vreg_l7a>;
+	vdda18-supply = <&vreg_l6c>;
+	vdda33-supply = <&vreg_l9a>;
+
+	status = "okay";
+};
+
+&xo_board_clk {
+	clock-frequency = <38400000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-ride-r3.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-ride-r3.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024,2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+
+#include "sa8775p-ride-r3.dts"
+#include "qcs9075-thermal.dtsi"
+#include "qcs9xxx-reserved-memory.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS9075 Ride Rev3";
+	compatible = "qcom,qcs9075-ride-r3", "qcom,qcs9075", "qcom,sa8775p";
+	qcom,msm-id = <676 0x20000>;
+	qcom,board-id = <0x20025 1>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-ride-sx-camera.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-ride-sx-camera.dtso
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,sa8775p-gcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-camcc.h>
+#include <dt-bindings/interconnect/qcom,sa8775p-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+
+#include "sa8775p-camera.dtsi"
+#include "qcs9100-camera-sensor-idp.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-ride.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024,2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+
+#include "sa8775p-ride.dts"
+#include "qcs9075-thermal.dtsi"
+#include "qcs9xxx-reserved-memory.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QCS9075 Ride";
+	compatible = "qcom,qcs9075-ride", "qcom,qcs9075", "qcom,sa8775p";
+	qcom,msm-id = <676 0x20000>;
+	qcom,board-id = <0x10025 1>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9075-thermal.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9075-thermal.dtsi
@@ -0,0 +1,283 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+&CPU0 {
+	#cooling-cells = <2>;
+};
+
+&CPU1 {
+	#cooling-cells = <2>;
+	CPU1_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU2 {
+	#cooling-cells = <2>;
+	CPU2_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU3 {
+	#cooling-cells = <2>;
+	CPU3_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU4 {
+	#cooling-cells = <2>;
+	CPU4_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU5 {
+	#cooling-cells = <2>;
+	CPU5_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU6 {
+	#cooling-cells = <2>;
+	CPU6_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU7 {
+	#cooling-cells = <2>;
+	CPU7_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&thermal_zones {
+	cpu-0-1-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_1_0_alert1>;
+				cooling-device = <&CPU1_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-2-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_2_0_alert1>;
+				cooling-device = <&CPU2_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-3-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_3_0_alert1>;
+				cooling-device = <&CPU3_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-1-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_1_1_alert1>;
+				cooling-device = <&CPU1_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-2-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_2_1_alert1>;
+				cooling-device = <&CPU2_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-3-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_3_1_alert1>;
+				cooling-device = <&CPU3_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-0-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_0_0_alert1>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-1-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_1_0_alert1>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-2-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_2_0_alert1>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-3-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_3_0_alert1>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-0-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_0_1_alert1>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-1-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_1_1_alert1>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-2-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_2_1_alert1>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-3-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_3_1_alert1>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9100-addons-ride-r3.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9100-addons-ride-r3.dts
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs9100-ride-r3.dts"
+#include "sa8775p-addons-ride.dtsi"
+
+/ {
+	model = "Qualcomm QCS9100 Ride Rev3";
+	compatible = "qcom,qcs9100-addons-ride-r3", "qcom,qcs9100", "qcom,sa8775p";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9100-addons-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9100-addons-ride.dts
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "qcs9100-ride.dts"
+#include "sa8775p-addons-ride.dtsi"
+
+/ {
+	model = "Qualcomm QCS9100 Ride";
+	compatible = "qcom,qcs9100-addons-ride", "qcom,qcs9100", "qcom,sa8775p";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9100-camera-sensor-idp.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9100-camera-sensor-idp.dtsi
@@ -0,0 +1,480 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&soc {
+	qcom,cam-res-mgr {
+		compatible = "qcom,cam-res-mgr";
+		status = "ok";
+		gpios-shared = <518 519 520 521>;
+	};
+};
+
+&cam_cci0 {
+
+	/* GMSL deserializer 0 */
+	qcom,cam-gmsl-deserializer0 {
+		cell-index = <0>;
+		csiphy-sd-index = <0>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend>;
+		gpios = <&pmm8654au_0_gpios 7 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET0";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK0_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser0_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor0_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser0_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor1_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser0_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor2_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser0_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor3_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 0 */
+	qcom,cam-gmsl-sensor0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor0_ep: endpoint {
+				remote-endpoint = <&deser0_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 1 */
+	qcom,cam-gmsl-sensor1 {
+		cell-index = <1>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor1_ep: endpoint {
+				remote-endpoint = <&deser0_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 2 */
+	qcom,cam-gmsl-sensor2 {
+		cell-index = <2>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor2_ep: endpoint {
+				remote-endpoint = <&deser0_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 0 sensor 3 */
+	qcom,cam-gmsl-sensor3 {
+		cell-index = <3>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <0>;
+		status = "ok";
+		port {
+			gmsl_sensor3_ep: endpoint {
+				remote-endpoint = <&deser0_port3>;
+			};
+		};
+	};
+
+};
+
+
+&cam_cci1 {
+
+	/* GMSL deserializer 1 */
+	qcom,cam-gmsl-deserializer1 {
+		cell-index = <1>;
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend>;
+		gpios = <&pmm8654au_0_gpios 8 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET1";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser1_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor4_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser1_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor5_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser1_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor6_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser1_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor7_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 0 */
+	qcom,cam-gmsl-sensor4 {
+		cell-index = <4>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor4_ep: endpoint {
+				remote-endpoint = <&deser1_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 1 */
+	qcom,cam-gmsl-sensor5 {
+		cell-index = <5>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor5_ep: endpoint {
+				remote-endpoint = <&deser1_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 2 */
+	qcom,cam-gmsl-sensor6 {
+		cell-index = <6>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor6_ep: endpoint {
+				remote-endpoint = <&deser1_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 1 sensor 3 */
+	qcom,cam-gmsl-sensor7 {
+		cell-index = <7>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <1>;
+		status = "ok";
+		port {
+			gmsl_sensor7_ep: endpoint {
+				remote-endpoint = <&deser1_port3>;
+			};
+		};
+	};
+
+};
+
+&cam_cci2 {
+
+	/* GMSL deserializer 2 */
+	qcom,cam-gmsl-deserializer2 {
+		cell-index = <2>;
+		csiphy-sd-index = <2>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend>;
+		gpios = <&pmm8654au_0_gpios 9 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET2";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser2_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor8_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser2_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor9_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser2_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor10_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser2_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor11_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 0 */
+	qcom,cam-gmsl-sensor8 {
+		cell-index = <8>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor8_ep: endpoint {
+				remote-endpoint = <&deser2_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 1 */
+	qcom,cam-gmsl-sensor9 {
+		cell-index = <9>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor9_ep: endpoint {
+				remote-endpoint = <&deser2_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 2 */
+	qcom,cam-gmsl-sensor10 {
+		cell-index = <10>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor10_ep: endpoint {
+				remote-endpoint = <&deser2_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 2 sensor 3 */
+	qcom,cam-gmsl-sensor11 {
+		cell-index = <11>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <2>;
+		status = "ok";
+		port {
+			gmsl_sensor11_ep: endpoint {
+				remote-endpoint = <&deser2_port3>;
+			};
+		};
+	};
+
+};
+
+
+&cam_cci3 {
+
+	/* GMSL deserializer 3 */
+	qcom,cam-gmsl-deserializer3 {
+		cell-index = <3>;
+		csiphy-sd-index = <3>;
+		sensor-position-roll = <0>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <180>;
+		cam_vio-supply = <&vreg_s4a>;
+		regulator-names = "cam_vio";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		pwm-switch;
+		rgltr-min-voltage = <1800000>;
+		rgltr-max-voltage = <1800000>;
+		rgltr-load-current = <120000>;
+		gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend>;
+		gpios = <&pmm8654au_0_gpios 10 0>;
+		gpio-reset = <0>;
+		gpio-req-tbl-num = <0>;
+		gpio-req-tbl-flags = <0>;
+		gpio-req-tbl-label = "CAM_RESET3";
+		cci-master = <0>;
+		clocks = <&camcc CAM_CC_MCLK3_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "nominal";
+		clock-rates = <24000000>;
+		status = "ok";
+
+		port@0 {
+			reg = <0>;
+			deser3_port0: endpoint {
+				remote-endpoint = <&gmsl_sensor12_ep>;
+			};
+		};
+
+		port@1 {
+			reg = <1>;
+			deser3_port1: endpoint {
+				remote-endpoint = <&gmsl_sensor13_ep>;
+			};
+		};
+
+		port@2 {
+			reg = <0>;
+			deser3_port2: endpoint {
+				remote-endpoint = <&gmsl_sensor14_ep>;
+			};
+		};
+
+		port@3 {
+			reg = <1>;
+			deser3_port3: endpoint {
+				remote-endpoint = <&gmsl_sensor15_ep>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 3 sensor 0 */
+	qcom,cam-gmsl-sensor12 {
+		cell-index = <12>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <3>;
+		status = "ok";
+		port {
+			gmsl_sensor12_ep: endpoint {
+				remote-endpoint = <&deser3_port0>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 3 sensor 1 */
+	qcom,cam-gmsl-sensor13 {
+		cell-index = <13>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <3>;
+		status = "ok";
+		port {
+			gmsl_sensor13_ep: endpoint {
+				remote-endpoint = <&deser3_port1>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 3 sensor 2 */
+	qcom,cam-gmsl-sensor14 {
+		cell-index = <14>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <3>;
+		status = "ok";
+		port {
+			gmsl_sensor14_ep: endpoint {
+				remote-endpoint = <&deser3_port2>;
+			};
+		};
+	};
+
+	/* GMSL deserializer 3 sensor 3 */
+	qcom,cam-gmsl-sensor15 {
+		cell-index = <15>;
+		compatible = "qcom,cam-gmsl-sensor";
+		csiphy-sd-index = <3>;
+		status = "ok";
+		port {
+			gmsl_sensor15_ep: endpoint {
+				remote-endpoint = <&deser3_port3>;
+			};
+		};
+	};
+
+};
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9100-graphics.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9100-graphics.dtsi
@@ -0,0 +1,216 @@
+/*
+ * Copyright (c) 2024-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+#define MHZ_TO_KBPS(mhz, w) ((mhz * 1000000 * w) / (1024))
+
+&soc {
+	msm_gpu: qcom,kgsl-3d0@3d00000 {
+		compatible = "qcom,kgsl";
+		status = "ok";
+		reg = <0 0x3d00000 0 0x40000>, <0 0x3d61000 0 0x800>,
+			<0 0x3de0000 0 0x10000>, <0 0x4900000 0 0x80000>,
+			<0 0x3dff000 0 0x1000>;
+		reg-names = "kgsl_3d0_reg_memory", "cx_dbgc", "rscc",
+			"qdss_gfx", "fusa";
+		interrupts = <0 300 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "kgsl_3d0_irq";
+
+		clocks = <&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+			<&gcc GCC_GPU_SNOC_DVM_GFX_CLK>,
+			<&gpucc GPU_CC_AHB_CLK>,
+			<&gpucc GPU_CC_CX_GMU_CLK>,
+			<&gpucc GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK>,
+			<&gpucc GPU_CC_HUB_AON_CLK>,
+			<&gpucc GPU_CC_HUB_CX_INT_CLK>;
+		clock-names = "gcc_gpu_memnoc_gfx",
+				"gcc_gpu_snoc_dvm_gfx",
+				"gpu_cc_ahb",
+				"gpu_cc_cx_gmu",
+				"gpu_cc_hlos1_vote_gpu_smmu",
+				"gpu_cc_hub_aon",
+				"gpu_cc_hub_cx_int";
+
+		qcom,chipid = <0x06060300>;
+		qcom,gpu-model = "Adreno663v1";
+
+		qcom,initial-pwrlevel = <3>;
+
+		qcom,highest-bank-bit = <16>;
+
+		qcom,min-access-length = <32>;
+
+		qcom,ubwc-mode = <4>;
+
+		qcom,gpu-qdss-stm = <0x161c0000 0x40000>; /* base addr, size */
+
+		qcom,tzone-names = "gpuss-0-usr", "gpuss-1-usr";
+
+		interconnect-names = "gpu_icc_path";
+		interconnects = <&gem_noc MASTER_GFX3D 0 &mc_virt SLAVE_EBI1 0>;
+
+		qcom,bus-table-ddr =
+			<MHZ_TO_KBPS(0, 4)>,    /* index=0  */
+			<MHZ_TO_KBPS(200, 4)>,  /* index=1  */
+			<MHZ_TO_KBPS(451, 4)>,  /* index=2  */
+			<MHZ_TO_KBPS(547, 4)>,  /* index=3  */
+			<MHZ_TO_KBPS(681, 4)>,  /* index=4  */
+			<MHZ_TO_KBPS(768, 4)>,  /* index=5  */
+			<MHZ_TO_KBPS(1017, 4)>, /* index=6  */
+			<MHZ_TO_KBPS(1353, 4)>, /* index=7  */
+			<MHZ_TO_KBPS(1555, 4)>, /* index=8  */
+			<MHZ_TO_KBPS(1708, 4)>, /* index=9  */
+			<MHZ_TO_KBPS(2092, 4)>, /* index=10  */
+			<MHZ_TO_KBPS(2736, 4)>, /* index=11  */
+			<MHZ_TO_KBPS(3196, 4)>; /* index=12  */
+
+		qcom,bus-table-cnoc =
+			<0>,   /* Off */
+			<100>; /* On */
+
+		zap-shader {
+			memory-region = <&pil_gpu_mem>;
+		};
+
+		qcom,gpu-mempools {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			compatible = "qcom,gpu-mempools";
+
+			/* 4K Page Pool configuration */
+			qcom,gpu-mempool@0 {
+				reg = <0>;
+				qcom,mempool-page-size = <4096>;
+				qcom,mempool-reserved = <2048>;
+			};
+			/* 8K Page Pool configuration */
+			qcom,gpu-mempool@1 {
+				reg = <1>;
+				qcom,mempool-page-size = <8192>;
+				qcom,mempool-reserved = <1024>;
+			};
+			/* 64K Page Pool configuration */
+			qcom,gpu-mempool@2 {
+				reg = <2>;
+				qcom,mempool-page-size = <65536>;
+				qcom,mempool-reserved = <256>;
+			};
+			/* 128K Page Pool configuration */
+			qcom,gpu-mempool@3 {
+				reg = <3>;
+				qcom,mempool-page-size = <131072>;
+				qcom,mempool-reserved = <128>;
+			};
+			/* 256K Page Pool configuration */
+			qcom,gpu-mempool@4 {
+				reg = <4>;
+				qcom,mempool-page-size = <262144>;
+				qcom,mempool-reserved = <80>;
+			};
+			/* 1M Page Pool configuration */
+			qcom,gpu-mempool@5 {
+				reg = <5>;
+				qcom,mempool-page-size = <1048576>;
+				qcom,mempool-reserved = <32>;
+			};
+		};
+
+		/* Power levels */
+		qcom,gpu-pwrlevels {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			compatible = "qcom,gpu-pwrlevels";
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <800000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_TURBO_L1>;
+
+				qcom,bus-freq = <12>;
+				qcom,bus-min = <12>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <778000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_TURBO>;
+
+				qcom,bus-freq = <11>;
+				qcom,bus-min = <11>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <676000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_NOM>;
+
+				qcom,bus-freq = <10>;
+				qcom,bus-min = <10>;
+				qcom,bus-max = <11>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <405000000>;
+				qcom,level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <10>;
+			};
+		};
+	};
+
+	kgsl_msm_iommu: qcom,kgsl-iommu@3da0000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		compatible = "qcom,kgsl-smmu-v2";
+
+		reg = <0x03da0000 0x20000>;
+
+		power-domains = <&gpucc GPU_CC_CX_GDSC>;
+
+		gfx3d_user: gfx3d_user {
+			compatible = "qcom,smmu-kgsl-cb", "qcom,adreno-gmu";
+			iommus = <&adreno_smmu 0x0 0xc00>, <&adreno_smmu 0x1 0xc00>;
+			qcom,iommu-dma = "disabled";
+		};
+	};
+
+	gmu: qcom,gmu@3d6a000 {
+		compatible = "qcom,gpu-gmu";
+
+		reg = <0 0x3d6a000 0 0x34000>,
+			<0 0xb290000 0 0x10000>;
+
+		reg-names = "kgsl_gmu_reg",
+			"kgsl_gmu_pdc_cfg";
+
+		interrupts = <0 304 IRQ_TYPE_LEVEL_HIGH>,
+			<0 305 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "kgsl_hfi_irq", "kgsl_gmu_irq";
+
+		iommus = <&adreno_smmu 0x5 0xc00>;
+		qcom,iommu-dma = "disabled";
+
+		power-domains = <&gpucc GPU_CC_CX_GDSC>, <&gpucc GPU_CC_GX_GDSC>;
+		power-domain-names = "cx", "gx";
+
+		clocks = <&gpucc GPU_CC_CX_GMU_CLK>,
+			<&gpucc GPU_CC_CXO_CLK>,
+			<&gcc GCC_DDRSS_GPU_AXI_CLK>,
+			<&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+			<&gpucc GPU_CC_AHB_CLK>,
+			<&gpucc GPU_CC_HUB_CX_INT_CLK>;
+
+		clock-names = "gmu_clk", "cxo_clk", "axi_clk",
+			"memnoc_clk", "ahb_clk", "hub_clk";
+
+		qcom,qmp = <&aoss_qmp>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9100-graphics.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9100-graphics.dtso
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+// SPDX-License-Identifier: BSD-3-Clause
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,sa8775p-gcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-gpucc.h>
+#include <dt-bindings/interconnect/qcom,sa8775p-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+
+#include "qcs9100-graphics.dtsi"
+
+/ {
+	model = "Qualcomm SA8775P Ride";
+	compatible = "qcom,sa8775p-ride", "qcom,sa8775p";
+	qcom,msm-id = <533 0x10000>, <534 0x10000>, <534 0x20000>;
+	qcom,board-id = <0x19 0>, <0x25 1>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9100-ride-r3.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9100-ride-r3.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024,2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+
+#include "sa8775p-ride-r3.dts"
+#include "qcs9100-thermal.dtsi"
+#include "qcs9xxx-reserved-memory.dtsi"
+
+/ {
+	model = "Qualcomm QCS9100 Ride Rev3";
+	compatible = "qcom,qcs9100-ride-r3", "qcom,qcs9100", "qcom,sa8775p";
+	qcom,msm-id = <667 0x10000>, <667 0x20000>;
+	qcom,board-id = <0x20025 1>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9100-ride-sx-camera.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9100-ride-sx-camera.dtso
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,sa8775p-gcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-camcc.h>
+#include <dt-bindings/interconnect/qcom,sa8775p-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+
+#include "sa8775p-camera.dtsi"
+#include "qcs9100-camera-sensor-idp.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9100-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9100-ride.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024,2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+
+#include "sa8775p-ride.dts"
+#include "qcs9100-thermal.dtsi"
+#include "qcs9xxx-reserved-memory.dtsi"
+
+/ {
+	model = "Qualcomm QCS9100 Ride";
+	compatible = "qcom,qcs9100-ride", "qcom,qcs9100", "qcom,sa8775p";
+	qcom,msm-id = <667 0x10000>, <667 0x20000>;
+	qcom,board-id = <0x10019 0>, <0x10025 1>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9100-thermal.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9100-thermal.dtsi
@@ -0,0 +1,283 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+&CPU0 {
+	#cooling-cells = <2>;
+};
+
+&CPU1 {
+	#cooling-cells = <2>;
+	CPU1_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU2 {
+	#cooling-cells = <2>;
+	CPU2_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU3 {
+	#cooling-cells = <2>;
+	CPU3_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU4 {
+	#cooling-cells = <2>;
+	CPU4_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU5 {
+	#cooling-cells = <2>;
+	CPU5_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU6 {
+	#cooling-cells = <2>;
+	CPU6_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&CPU7 {
+	#cooling-cells = <2>;
+	CPU7_idle: thermal-idle {
+		#cooling-cells = <2>;
+		duration-us = <800000>;
+		exit-latency-us = <10000>;
+	};
+};
+
+&thermal_zones {
+	cpu-0-1-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_1_0_alert1>;
+				cooling-device = <&CPU1_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-2-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_2_0_alert1>;
+				cooling-device = <&CPU2_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-3-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_3_0_alert1>;
+				cooling-device = <&CPU3_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-1-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_1_1_alert1>;
+				cooling-device = <&CPU1_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-2-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_2_1_alert1>;
+				cooling-device = <&CPU2_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-0-3-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_0_3_1_alert1>;
+				cooling-device = <&CPU3_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-0-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_0_0_alert1>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-1-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_1_0_alert1>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-2-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_2_0_alert1>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-3-0-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_3_0_alert1>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-0-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_0_1_alert1>;
+				cooling-device = <&CPU4_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-1-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_1_1_alert1>;
+				cooling-device = <&CPU5_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-2-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_2_1_alert1>;
+				cooling-device = <&CPU6_idle 100 100>;
+			};
+		};
+	};
+
+	cpu-1-3-1-thermal {
+		trips {
+			trip-point1 {
+				temperature = <116000>;
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&cpu_1_3_1_alert1>;
+				cooling-device = <&CPU7_idle 100 100>;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qcs9xxx-reserved-memory.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qcs9xxx-reserved-memory.dtsi
@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/delete-node/ &pil_adsp_mem;
+/delete-node/ &pil_gdsp0_mem;
+/delete-node/ &pil_gdsp1_mem;
+/delete-node/ &pil_cdsp0_mem;
+/delete-node/ &pil_gpu_mem;
+/delete-node/ &pil_cdsp1_mem;
+/delete-node/ &pil_cvp_mem;
+/delete-node/ &pil_video_mem;
+/delete-node/ &audio_mdf_mem;
+/delete-node/ &trusted_apps_mem;
+/delete-node/ &hyptz_reserved_mem;
+/delete-node/ &tz_ffi_mem;
+
+/ {
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		gunyah_md_mem: gunyah-md@91a80000 {
+			reg = <0x0 0x91a80000 0x0 0x80000>;
+			no-map;
+		};
+
+		pil_adsp_mem: pil-adsp@95900000 {
+			reg = <0x0 0x95900000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		q6_adsp_dtb_mem: q6-adsp-dtb@97700000 {
+			reg = <0x0 0x97700000 0x0 0x80000>;
+			no-map;
+		};
+
+		q6_gdsp0_dtb_mem: q6-gdsp0-dtb@97780000 {
+			reg = <0x0 0x97780000 0x0 0x80000>;
+			no-map;
+		};
+
+		pil_gdsp0_mem: pil-gdsp0@97800000 {
+			reg = <0x0 0x97800000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		pil_gdsp1_mem: pil-gdsp1@99600000 {
+			reg = <0x0 0x99600000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		q6_gdsp1_dtb_mem: q6-gdsp1-dtb@9b400000 {
+			reg = <0x0 0x9b400000 0x0 0x80000>;
+			no-map;
+		};
+
+		q6_cdsp0_dtb_mem: q6-cdsp0-dtb@9b480000 {
+			reg = <0x0 0x9b480000 0x0 0x80000>;
+			no-map;
+		};
+
+		pil_cdsp0_mem: pil-cdsp0@9b500000 {
+			reg = <0x0 0x9b500000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		pil_gpu_mem: pil-gpu@9d300000 {
+			reg = <0x0 0x9d300000 0x0 0x2000>;
+			no-map;
+		};
+
+		q6_cdsp1_dtb_mem: q6-cdsp1-dtb@9d380000 {
+			reg = <0x0 0x9d380000 0x0 0x80000>;
+			no-map;
+		};
+
+		pil_cdsp1_mem: pil-cdsp1@9d400000 {
+			reg = <0x0 0x9d400000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		pil_cvp_mem: pil-cvp@9f200000 {
+			reg = <0x0 0x9f200000 0x0 0x700000>;
+			no-map;
+		};
+
+		pil_video_mem: pil-video@9f900000 {
+			reg = <0x0 0x9f900000 0x0 0x1000000>;
+			no-map;
+		};
+
+		trusted_apps_mem: trusted-apps@d1900000 {
+			reg = <0x0 0xd1900000 0x0 0x1c00000>;
+			no-map;
+		};
+	};
+
+	firmware {
+		scm {
+			/delete-property/ memory-region;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qdu1000.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qdu1000.dtsi
@@ -1459,11 +1459,40 @@
 
 		system-cache-controller@19200000 {
 			compatible = "qcom,qdu1000-llcc";
-			reg = <0 0x19200000 0 0xd80000>,
+			reg = <0 0x19200000 0 0x80000>,
+			      <0 0x19300000 0 0x80000>,
+			      <0 0x19600000 0 0x80000>,
+			      <0 0x19700000 0 0x80000>,
+			      <0 0x19a00000 0 0x80000>,
+			      <0 0x19b00000 0 0x80000>,
+			      <0 0x19e00000 0 0x80000>,
+			      <0 0x19f00000 0 0x80000>,
 			      <0 0x1a200000 0 0x80000>;
 			reg-names = "llcc0_base",
+				    "llcc1_base",
+				    "llcc2_base",
+				    "llcc3_base",
+				    "llcc4_base",
+				    "llcc5_base",
+				    "llcc6_base",
+				    "llcc7_base",
 				    "llcc_broadcast_base";
 			interrupts = <GIC_SPI 266 IRQ_TYPE_LEVEL_HIGH>;
+
+			nvmem-cells = <&multi_chan_ddr>;
+			nvmem-cell-names = "multi-chan-ddr";
+		};
+
+		sec_qfprom: efuse@221c8000 {
+			compatible = "qcom,qdu1000-sec-qfprom", "qcom,sec-qfprom";
+			reg = <0 0x221c8000 0 0x1000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			multi_chan_ddr: multi-chan-ddr@12b {
+				reg = <0x12b 0x1>;
+				bits = <0 2>;
+			};
 		};
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
@@ -7,7 +7,7 @@
 
 #include <dt-bindings/leds/common.h>
 #include "qcm2290.dtsi"
-#include "pm2250.dtsi"
+#include "pm4125.dtsi"
 
 / {
 	model = "Qualcomm Technologies, Inc. Robotics RB1";
@@ -59,6 +59,17 @@
 		};
 	};
 
+	i2c2_gpio: i2c {
+		compatible = "i2c-gpio";
+
+		sda-gpios = <&tlmm 6 GPIO_ACTIVE_HIGH>;
+		scl-gpios = <&tlmm 7 GPIO_ACTIVE_HIGH>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+	};
+
 	leds {
 		compatible = "gpio-leds";
 
@@ -177,11 +188,29 @@
 	};
 };
 
+&CPU_PD0 {
+	/delete-property/ power-domains;
+};
+
+&CPU_PD1 {
+	/delete-property/ power-domains;
+};
+
+&CPU_PD2 {
+	/delete-property/ power-domains;
+};
+
+&CPU_PD3 {
+	/delete-property/ power-domains;
+};
+
+/delete-node/ &CLUSTER_PD;
+
 &gpi_dma0 {
 	status = "okay";
 };
 
-&i2c2 {
+&i2c2_gpio {
 	clock-frequency = <400000>;
 	status = "okay";
 
@@ -226,7 +255,7 @@
 };
 
 &mdss_dsi0 {
-	vdda-supply = <&pm2250_l5>;
+	vdda-supply = <&pm4125_l5>;
 	status = "okay";
 };
 
@@ -239,7 +268,7 @@
 	status = "okay";
 };
 
-&pm2250_resin {
+&pm4125_resin {
 	linux,code = <KEY_VOLUMEDOWN>;
 	status = "okay";
 };
@@ -263,23 +292,23 @@
 		compatible = "qcom,rpm-pm2250-regulators";
 		vdd_s3-supply = <&vph_pwr>;
 		vdd_s4-supply = <&vph_pwr>;
-		vdd_l1_l2_l3_l5_l6_l7_l8_l9_l10_l11_l12-supply = <&pm2250_s3>;
+		vdd_l1_l2_l3_l5_l6_l7_l8_l9_l10_l11_l12-supply = <&pm4125_s3>;
 		vdd_l4_l17_l18_l19_l20_l21_l22-supply = <&vph_pwr>;
-		vdd_l13_l14_l15_l16-supply = <&pm2250_s4>;
+		vdd_l13_l14_l15_l16-supply = <&pm4125_s4>;
 
 		/*
 		 * S1 - VDD_APC
 		 * S2 - VDD_CX
 		 */
 
-		pm2250_s3: s3 {
+		pm4125_s3: s3 {
 			/* 0.4V-1.6625V -> 1.3V (Power tree requirements) */
 			regulator-min-microvolt = <1352000>;
 			regulator-max-microvolt = <1352000>;
 			regulator-boot-on;
 		};
 
-		pm2250_s4: s4 {
+		pm4125_s4: s4 {
 			/* 1.2V-2.35V -> 2.05V (Power tree requirements) */
 			regulator-min-microvolt = <2072000>;
 			regulator-max-microvolt = <2072000>;
@@ -288,7 +317,7 @@
 
 		/* L1 - VDD_MX */
 
-		pm2250_l2: l2 {
+		pm4125_l2: l2 {
 			/* LPDDR4X VDD2 */
 			regulator-min-microvolt = <1136000>;
 			regulator-max-microvolt = <1136000>;
@@ -296,7 +325,7 @@
 			regulator-boot-on;
 		};
 
-		pm2250_l3: l3 {
+		pm4125_l3: l3 {
 			/* LPDDR4X VDDQ */
 			regulator-min-microvolt = <616000>;
 			regulator-max-microvolt = <616000>;
@@ -304,14 +333,14 @@
 			regulator-boot-on;
 		};
 
-		pm2250_l4: l4 {
+		pm4125_l4: l4 {
 			/* max = 3.05V -> max = 2.7 to disable 3V signaling (SDHCI2) */
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <2700000>;
 			regulator-allow-set-load;
 		};
 
-		pm2250_l5: l5 {
+		pm4125_l5: l5 {
 			/* CSI/DSI */
 			regulator-min-microvolt = <1232000>;
 			regulator-max-microvolt = <1232000>;
@@ -319,7 +348,7 @@
 			regulator-boot-on;
 		};
 
-		pm2250_l6: l6 {
+		pm4125_l6: l6 {
 			/* DRAM PLL */
 			regulator-min-microvolt = <928000>;
 			regulator-max-microvolt = <928000>;
@@ -327,7 +356,7 @@
 			regulator-boot-on;
 		};
 
-		pm2250_l7: l7 {
+		pm4125_l7: l7 {
 			/* Wi-Fi CX/MX */
 			regulator-min-microvolt = <664000>;
 			regulator-max-microvolt = <664000>;
@@ -338,20 +367,20 @@
 		 * L9 - VDD_LPI_MX
 		 */
 
-		pm2250_l10: l10 {
+		pm4125_l10: l10 {
 			/* Wi-Fi RFA */
 			regulator-min-microvolt = <1304000>;
 			regulator-max-microvolt = <1304000>;
 		};
 
-		pm2250_l11: l11 {
+		pm4125_l11: l11 {
 			/* GPS RF1 */
 			regulator-min-microvolt = <1000000>;
 			regulator-max-microvolt = <1000000>;
 			regulator-boot-on;
 		};
 
-		pm2250_l12: l12 {
+		pm4125_l12: l12 {
 			/* USB PHYs */
 			regulator-min-microvolt = <928000>;
 			regulator-max-microvolt = <928000>;
@@ -359,7 +388,7 @@
 			regulator-boot-on;
 		};
 
-		pm2250_l13: l13 {
+		pm4125_l13: l13 {
 			/* USB/QFPROM/PLLs */
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <1800000>;
@@ -367,7 +396,7 @@
 			regulator-boot-on;
 		};
 
-		pm2250_l14: l14 {
+		pm4125_l14: l14 {
 			/* SDHCI1 VQMMC */
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <1800000>;
@@ -376,7 +405,7 @@
 			regulator-always-on;
 		};
 
-		pm2250_l15: l15 {
+		pm4125_l15: l15 {
 			/* WCD/DSI/BT VDDIO */
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <1800000>;
@@ -385,38 +414,38 @@
 			regulator-boot-on;
 		};
 
-		pm2250_l16: l16 {
+		pm4125_l16: l16 {
 			/* GPS RF2 */
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <1800000>;
 			regulator-boot-on;
 		};
 
-		pm2250_l17: l17 {
+		pm4125_l17: l17 {
 			regulator-min-microvolt = <3000000>;
 			regulator-max-microvolt = <3000000>;
 		};
 
-		pm2250_l18: l18 {
+		pm4125_l18: l18 {
 			/* VDD_PXn */
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <1800000>;
 		};
 
-		pm2250_l19: l19 {
+		pm4125_l19: l19 {
 			/* VDD_PXn */
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <1800000>;
 		};
 
-		pm2250_l20: l20 {
+		pm4125_l20: l20 {
 			/* SDHCI1 VMMC */
 			regulator-min-microvolt = <2400000>;
 			regulator-max-microvolt = <3600000>;
 			regulator-allow-set-load;
 		};
 
-		pm2250_l21: l21 {
+		pm4125_l21: l21 {
 			/* SDHCI2 VMMC */
 			regulator-min-microvolt = <2960000>;
 			regulator-max-microvolt = <3300000>;
@@ -424,7 +453,7 @@
 			regulator-boot-on;
 		};
 
-		pm2250_l22: l22 {
+		pm4125_l22: l22 {
 			/* Wi-Fi */
 			regulator-min-microvolt = <3312000>;
 			regulator-max-microvolt = <3312000>;
@@ -433,8 +462,8 @@
 };
 
 &sdhc_1 {
-	vmmc-supply = <&pm2250_l20>;
-	vqmmc-supply = <&pm2250_l14>;
+	vmmc-supply = <&pm4125_l20>;
+	vqmmc-supply = <&pm4125_l14>;
 	pinctrl-0 = <&sdc1_state_on>;
 	pinctrl-1 = <&sdc1_state_off>;
 	pinctrl-names = "default", "sleep";
@@ -446,8 +475,8 @@
 };
 
 &sdhc_2 {
-	vmmc-supply = <&pm2250_l21>;
-	vqmmc-supply = <&pm2250_l4>;
+	vmmc-supply = <&pm4125_l21>;
+	vqmmc-supply = <&pm4125_l4>;
 	cd-gpios = <&tlmm 88 GPIO_ACTIVE_LOW>;
 	pinctrl-0 = <&sdc2_state_on &sd_det_in_on>;
 	pinctrl-1 = <&sdc2_state_off &sd_det_in_off>;
@@ -518,8 +547,8 @@
 };
 
 &usb_qmpphy {
-	vdda-phy-supply = <&pm2250_l12>;
-	vdda-pll-supply = <&pm2250_l13>;
+	vdda-phy-supply = <&pm4125_l12>;
+	vdda-pll-supply = <&pm4125_l13>;
 	status = "okay";
 };
 
@@ -528,17 +557,17 @@
 };
 
 &usb_hsphy {
-	vdd-supply = <&pm2250_l12>;
-	vdda-pll-supply = <&pm2250_l13>;
-	vdda-phy-dpdm-supply = <&pm2250_l21>;
+	vdd-supply = <&pm4125_l12>;
+	vdda-pll-supply = <&pm4125_l13>;
+	vdda-phy-dpdm-supply = <&pm4125_l21>;
 	status = "okay";
 };
 
 &wifi {
-	vdd-0.8-cx-mx-supply = <&pm2250_l7>;
-	vdd-1.8-xo-supply = <&pm2250_l13>;
-	vdd-1.3-rfa-supply = <&pm2250_l10>;
-	vdd-3.3-ch0-supply = <&pm2250_l22>;
+	vdd-0.8-cx-mx-supply = <&pm4125_l7>;
+	vdd-1.8-xo-supply = <&pm4125_l13>;
+	vdd-1.3-rfa-supply = <&pm4125_l10>;
+	vdd-3.3-ch0-supply = <&pm4125_l22>;
 	qcom,ath10k-calibration-variant = "Thundercomm_RB1";
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts
@@ -58,6 +58,17 @@
 		};
 	};
 
+	i2c2_gpio: i2c {
+		compatible = "i2c-gpio";
+
+		sda-gpios = <&tlmm 6 GPIO_ACTIVE_HIGH>;
+		scl-gpios = <&tlmm 7 GPIO_ACTIVE_HIGH>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+	};
+
 	leds {
 		compatible = "gpio-leds";
 
@@ -188,7 +199,7 @@
 	};
 };
 
-&i2c2 {
+&i2c2_gpio {
 	clock-frequency = <400000>;
 	status = "okay";
 
@@ -361,6 +372,8 @@
 			regulator-min-microvolt = <1800000>;
 			regulator-max-microvolt = <1800000>;
 			regulator-allow-set-load;
+			regulator-always-on;
+			regulator-boot-on;
 		};
 
 		vreg_l10a_1p8: l10 {
@@ -607,10 +620,6 @@
 	status = "okay";
 };
 
-&usb_dwc3 {
-	maximum-speed = "super-speed";
-};
-
 &usb_hsphy {
 	vdd-supply = <&vreg_l4a_0p9>;
 	vdda-pll-supply = <&vreg_l12a_1p8>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa7255p-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa7255p-ride.dts
@@ -0,0 +1,195 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+#include "sa7255p.dtsi"
+#include "sa7255p-scmi.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SA7255P Ride";
+	compatible = "qcom,sa7255p-ride","qcom,sa7255p";
+	qcom,msm-id = <606 0x10000>;
+	qcom,board-id = <0x10019 0>, <0x1010019 1>;
+
+	aliases {
+		i2c8 = &i2c8;
+		i2c15 = &i2c15;
+		serial0 = &uart7;
+		spi10 = &spi10;
+		scmichannels = &scmichannels;
+		ufshc1 = &ufs_mem_hc;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+};
+
+&adreno_smmu {
+	power-domains = <&scmi15_pd 0>;
+
+	status = "okay";
+};
+
+&gpll0_board_clk {
+	clock-frequency = <300000000>;
+};
+
+&i2c8 {
+	clock-frequency = <400000>;
+	power-domains = <&scmi9_pd 8>;
+
+	status = "okay";
+};
+
+&i2c15 {
+	clock-frequency = <400000>;
+	power-domains = <&scmi9_pd 15>;
+
+	status = "okay";
+};
+
+&pcie0 {
+	power-domains = <&scmi5_pd 0>;
+	power-domain-names = "power";
+	status = "okay";
+};
+
+&pcie1 {
+	power-domains = <&scmi6_pd 0>;
+	power-domain-names = "power";
+	status = "okay";
+};
+
+&qupv3_id_0 {
+	status = "okay";
+};
+
+&qupv3_id_1 {
+	status = "okay";
+};
+
+&qupv3_id_3 {
+	status = "okay";
+};
+
+&scmi0 {
+	status = "okay";
+};
+
+&scmi2 {
+	status = "okay";
+};
+
+&scmi3 {
+	status = "okay";
+};
+
+&scmi5 {
+	status = "okay";
+};
+
+&scmi6 {
+	status = "okay";
+};
+
+&scmi9 {
+	status = "okay";
+};
+
+&scmi10 {
+	status = "okay";
+};
+
+&scmi11 {
+	status = "okay";
+};
+
+&scmi12 {
+	status = "okay";
+};
+
+&scmi14 {
+	status = "okay";
+};
+
+&scmi15 {
+	status = "okay";
+};
+
+&sleep_clk {
+	clock-frequency = <32000>;
+};
+
+&spi10 {
+	power-domains = <&scmi10_pd 10>, <&scmi10_dvfs 10>;
+	power-domain-names = "power", "perf";
+
+	status = "okay";
+};
+
+&uart7 {
+	power-domains = <&scmi11_pd 7>, <&scmi11_dvfs 7>;
+	power-domain-names = "power", "perf";
+
+	status = "okay";
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 133 GPIO_ACTIVE_LOW>;
+	power-domains = <&scmi3_pd 0>;
+
+	status = "okay";
+};
+
+&usb_0 {
+	power-domains = <&scmi0_pd 0>, <&scmi0_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&usb_0_dwc3 {
+	dr_mode = "peripheral";
+};
+
+&usb_0_hsphy {
+	power-domains = <&scmi12_pd 0>, <&scmi12_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&usb_0_qmpphy {
+	power-domains = <&scmi12_pd 2>, <&scmi12_pd 3>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&usb_1 {
+	power-domains = <&scmi2_pd 0>, <&scmi2_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&usb_1_dwc3 {
+	dr_mode = "host";
+};
+
+&usb_1_hsphy {
+	power-domains = <&scmi14_pd 0>, <&scmi14_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&xo_board_clk {
+	clock-frequency = <38400000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa7255p-scmi.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa7255p-scmi.dtsi
@@ -0,0 +1,2184 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&firmware {
+	scmi0: scmi-0 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem0>;
+
+		interrupts = <GIC_SPI 963 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi0_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi0_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi0_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi1: scmi-1 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem1>;
+
+		interrupts = <GIC_SPI 964 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi1_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi1_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi1_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi2: scmi-2 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem2>;
+
+		interrupts = <GIC_SPI 965 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi2_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi2_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi2_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi3: scmi-3 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem3>;
+
+		interrupts = <GIC_SPI 966 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi3_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi3_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi3_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi4: scmi-4 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem4>;
+
+		interrupts = <GIC_SPI 967 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi4_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi4_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi4_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi5: scmi-5 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem5>;
+
+		interrupts = <GIC_SPI 968 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi5_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi5_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi5_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi6: scmi-6 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem6>;
+
+		interrupts = <GIC_SPI 969 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi6_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi6_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi6_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi7: scmi-7 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem7>;
+
+		interrupts = <GIC_SPI 970 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi7_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi7_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi7_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi8: scmi-8 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem8>;
+
+		interrupts = <GIC_SPI 971 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi8_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi8_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi8_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi9: scmi-9 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem9>;
+
+		interrupts = <GIC_SPI 972 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi9_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi9_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi9_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi10: scmi-10 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem10>;
+
+		interrupts = <GIC_SPI 973 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi10_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi10_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi10_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi11: scmi-11 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem11>;
+
+		interrupts = <GIC_SPI 974 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi11_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi11_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi11_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi12: scmi-12 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem12>;
+
+		interrupts = <GIC_SPI 975 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi12_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi12_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi12_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi13: scmi-13 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem13>;
+
+		interrupts = <GIC_SPI 976 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi13_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi13_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi13_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi14: scmi-14 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem14>;
+
+		interrupts = <GIC_SPI 977 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi14_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi14_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi14_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi15: scmi-15 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem15>;
+
+		interrupts = <GIC_SPI 978 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi15_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi15_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi15_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi16: scmi-16 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem16>;
+
+		interrupts = <GIC_SPI 979 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi16_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi16_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi16_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi17: scmi-17 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem17>;
+
+		interrupts = <GIC_SPI 980 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi17_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi17_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi17_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi18: scmi-18 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem18>;
+
+		interrupts = <GIC_SPI 981 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi18_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi18_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi18_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi19: scmi-19 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem19>;
+
+		interrupts = <GIC_SPI 982 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi19_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi19_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi19_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi20: scmi-20 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem20>;
+
+		interrupts = <GIC_SPI 983 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi20_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi20_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi20_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi21: scmi-21 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem21>;
+
+		interrupts = <GIC_SPI 984 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi21_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi21_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi21_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi22: scmi-22 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem22>;
+
+		interrupts = <GIC_SPI 985 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi22_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi22_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi22_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi23: scmi-23 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem23>;
+
+		interrupts = <GIC_SPI 986 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi23_sensor: protocol@15 {
+			reg = <0x15>;
+			#thermal-sensor-cells = <1>;
+		};
+	};
+
+	scmi24: scmi-24 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem24>;
+
+		interrupts = <GIC_SPI 987 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi24_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi24_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi24_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi25: scmi-25 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem25>;
+
+		interrupts = <GIC_ESPI 0 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi25_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi25_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi25_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi26: scmi-26 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem26>;
+
+		interrupts = <GIC_ESPI 1 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi26_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi26_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi26_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi27: scmi-27 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem27>;
+
+		interrupts = <GIC_ESPI 2 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi27_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi27_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi27_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi28: scmi-28 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem28>;
+
+		interrupts = <GIC_ESPI 3 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi28_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi28_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi28_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi29: scmi-29 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem29>;
+
+		interrupts = <GIC_ESPI 4 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi29_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi29_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi29_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi30: scmi-30 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem30>;
+
+		interrupts = <GIC_ESPI 5 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi30_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi30_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi30_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi31: scmi-31 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem31>;
+
+		interrupts = <GIC_ESPI 6 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi31_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi31_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi31_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi32: scmi-32 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem32>;
+
+		interrupts = <GIC_ESPI 7 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi32_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi32_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi32_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi33: scmi-33 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem33>;
+
+		interrupts = <GIC_ESPI 8 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi33_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi33_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi33_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi34: scmi-34 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem34>;
+
+		interrupts = <GIC_ESPI 9 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi34_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi34_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi34_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi35: scmi-35 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem35>;
+
+		interrupts = <GIC_ESPI 10 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi35_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi35_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi35_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi36: scmi-36 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem36>;
+
+		interrupts = <GIC_ESPI 11 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi36_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi36_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi36_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi37: scmi-37 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem37>;
+
+		interrupts = <GIC_ESPI 12 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi37_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi37_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi37_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi38: scmi-38 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem38>;
+
+		interrupts = <GIC_ESPI 13 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi38_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi38_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi38_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi39: scmi-39 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem39>;
+
+		interrupts = <GIC_ESPI 14 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi39_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi39_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi39_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi40: scmi-40 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem40>;
+
+		interrupts = <GIC_ESPI 15 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi40_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi40_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi40_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi41: scmi-41 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem41>;
+
+		interrupts = <GIC_ESPI 16 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi41_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi41_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi41_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi42: scmi-42 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem42>;
+
+		interrupts = <GIC_ESPI 17 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi42_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi42_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi42_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi43: scmi-43 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem43>;
+
+		interrupts = <GIC_ESPI 18 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi43_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi43_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi43_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi44: scmi-44 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem44>;
+
+		interrupts = <GIC_ESPI 19 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi44_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi44_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi44_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi45: scmi-45 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem45>;
+
+		interrupts = <GIC_ESPI 20 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi45_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi45_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi45_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi46: scmi-46 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem46>;
+
+		interrupts = <GIC_ESPI 21 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi46_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi46_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi46_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi47: scmi-47 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem47>;
+
+		interrupts = <GIC_ESPI 22 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi47_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi47_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi47_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi48: scmi-48 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem48>;
+
+		interrupts = <GIC_ESPI 23 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi48_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi48_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi48_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi49: scmi-49 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem49>;
+
+		interrupts = <GIC_ESPI 24 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi49_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi49_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi49_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi50: scmi-50 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem50>;
+
+		interrupts = <GIC_ESPI 25 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi50_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi50_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi50_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi51: scmi-51 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem51>;
+
+		interrupts = <GIC_ESPI 26 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi51_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi51_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi51_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi52: scmi-52 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem52>;
+
+		interrupts = <GIC_ESPI 27 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi52_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi52_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi52_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi53: scmi-53 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem53>;
+
+		interrupts = <GIC_ESPI 28 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi53_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi53_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi53_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi54: scmi-54 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem54>;
+
+		interrupts = <GIC_ESPI 29 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi54_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi54_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi54_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi55: scmi-55 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem55>;
+
+		interrupts = <GIC_ESPI 30 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi55_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi55_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi55_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi56: scmi-56 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem56>;
+
+		interrupts = <GIC_ESPI 31 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi56_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi56_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi56_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi57: scmi-57 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem57>;
+
+		interrupts = <GIC_ESPI 32 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi57_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi57_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi57_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi58: scmi-58 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem58>;
+
+		interrupts = <GIC_ESPI 33 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi58_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi58_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi58_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi59: scmi-59 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem59>;
+
+		interrupts = <GIC_ESPI 34 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi59_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi59_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi59_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi60: scmi-60 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem60>;
+
+		interrupts = <GIC_ESPI 35 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi60_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi60_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi60_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi61: scmi-61 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem61>;
+
+		interrupts = <GIC_ESPI 36 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi61_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi61_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi61_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi62: scmi-62 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem62>;
+
+		interrupts = <GIC_ESPI 37 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi62_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi62_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi62_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi63: scmi-63 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem63>;
+
+		interrupts = <GIC_ESPI 38 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		status = "disabled";
+
+		scmi63_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi63_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi63_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+};
+
+&soc {
+	scmichannels: sram@d0000000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "mmio-sram";
+		reg = <0x0 0xd0000000 0x0 0x40000>;
+		ranges = <0x0 0x0 0x0 0xffffffff>;
+
+		shmem0: scmi-sram@d0000000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0000000 0x1000>;
+		};
+
+		shmem1: scmi-sram@d0001000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0001000 0x1000>;
+		};
+
+		shmem2: scmi-sram@d0002000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0002000 0x1000>;
+		};
+
+		shmem3: scmi-sram@d0003000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0003000 0x1000>;
+		};
+
+		shmem4: scmi-sram@d0004000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0004000 0x1000>;
+		};
+
+		shmem5: scmi-sram@d0005000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0005000 0x1000>;
+		};
+
+		shmem6: scmi-sram@d0006000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0006000 0x1000>;
+		};
+
+		shmem7: scmi-sram@d0007000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0007000 0x1000>;
+		};
+
+		shmem8: scmi-sram@d0008000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0008000 0x1000>;
+		};
+
+		shmem9: scmi-sram@d0009000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0009000 0x1000>;
+		};
+
+		shmem10: scmi-sram@d000a000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000a000 0x1000>;
+		};
+
+		shmem11: scmi-sram@d000b000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000b000 0x1000>;
+		};
+
+		shmem12: scmi-sram@d000c000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000c000 0x1000>;
+		};
+
+		shmem13: scmi-sram@d000d000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000d000 0x1000>;
+		};
+
+		shmem14: scmi-sram@d000e000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000e000 0x1000>;
+		};
+
+		shmem15: scmi-sram@d000f000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000f000 0x1000>;
+		};
+
+		shmem16: scmi-sram@d0010000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0010000 0x1000>;
+		};
+
+		shmem17: scmi-sram@d0011000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0011000 0x1000>;
+		};
+
+		shmem18: scmi-sram@d0012000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0012000 0x1000>;
+		};
+
+		shmem19: scmi-sram@d0013000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0013000 0x1000>;
+		};
+
+		shmem20: scmi-sram@d0014000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0014000 0x1000>;
+		};
+
+		shmem21: scmi-sram@d0015000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0015000 0x1000>;
+		};
+
+		shmem22: scmi-sram@d0016000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0016000 0x1000>;
+		};
+
+		shmem23: scmi-sram@d0017000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0017000 0x1000>;
+		};
+
+		shmem24: scmi-sram@d0018000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0018000 0x1000>;
+		};
+
+		shmem25: scmi-sram@d0019000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0019000 0x1000>;
+		};
+
+		shmem26: scmi-sram@d001a000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001a000 0x1000>;
+		};
+
+		shmem27: scmi-sram@d001b000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001b000 0x1000>;
+		};
+
+		shmem28: scmi-sram@d001c000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001c000 0x1000>;
+		};
+
+		shmem29: scmi-sram@d001d000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001d000 0x1000>;
+		};
+
+		shmem30: scmi-sram@d001e000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001e000 0x1000>;
+		};
+
+		shmem31: scmi-sram@d001f000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001f000 0x1000>;
+		};
+
+		shmem32: scmi-sram@d0020000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0020000 0x1000>;
+		};
+
+		shmem33: scmi-sram@d0021000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0021000 0x1000>;
+		};
+
+		shmem34: scmi-sram@d0022000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0022000 0x1000>;
+		};
+
+		shmem35: scmi-sram@d0023000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0023000 0x1000>;
+		};
+
+		shmem36: scmi-sram@d0024000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0024000 0x1000>;
+		};
+
+		shmem37: scmi-sram@d0025000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0025000 0x1000>;
+		};
+
+		shmem38: scmi-sram@d0026000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0026000 0x1000>;
+		};
+
+		shmem39: scmi-sram@d0027000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0027000 0x1000>;
+		};
+
+		shmem40: scmi-sram@d0028000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0028000 0x1000>;
+		};
+
+		shmem41: scmi-sram@d0029000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0029000 0x1000>;
+		};
+
+		shmem42: scmi-sram@d002a000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002a000 0x1000>;
+		};
+
+		shmem43: scmi-sram@d002b000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002b000 0x1000>;
+		};
+
+		shmem44: scmi-sram@d002c000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002c000 0x1000>;
+		};
+
+		shmem45: scmi-sram@d002d000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002d000 0x1000>;
+		};
+
+		shmem46: scmi-sram@d002e000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002e000 0x1000>;
+		};
+
+		shmem47: scmi-sram@d002f000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002f000 0x1000>;
+		};
+
+		shmem48: scmi-sram@d0030000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0030000 0x1000>;
+		};
+
+		shmem49: scmi-sram@d0031000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0031000 0x1000>;
+		};
+
+		shmem50: scmi-sram@d0032000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0032000 0x1000>;
+		};
+
+		shmem51: scmi-sram@d0033000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0033000 0x1000>;
+		};
+
+		shmem52: scmi-sram@d0034000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0034000 0x1000>;
+		};
+
+		shmem53: scmi-sram@d0035000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0035000 0x1000>;
+		};
+
+		shmem54: scmi-sram@d0036000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0036000 0x1000>;
+		};
+
+		shmem55: scmi-sram@d0037000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0037000 0x1000>;
+		};
+
+		shmem56: scmi-sram@d0038000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0038000 0x1000>;
+		};
+
+		shmem57: scmi-sram@d0039000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0039000 0x1000>;
+		};
+
+		shmem58: scmi-sram@d003a000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003a000 0x1000>;
+		};
+
+		shmem59: scmi-sram@d003b000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003b000 0x1000>;
+		};
+
+		shmem60: scmi-sram@d003c000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003c000 0x1000>;
+		};
+
+		shmem61: scmi-sram@d003d000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003d000 0x1000>;
+		};
+
+		shmem62: scmi-sram@d003e000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003e000 0x1000>;
+		};
+
+		shmem63: scmi-sram@d003f000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003f000 0x1000>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa7255p.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa7255p.dtsi
@@ -0,0 +1,2268 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/mailbox/qcom-ipcc.h>
+
+/ {
+	interrupt-parent = <&intc>;
+
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	clocks {
+		bi_tcxo_div2: bi-tcxo-div2-clk {
+			compatible = "fixed-factor-clock";
+			clocks = <&xo_board_clk>;
+			clock-mult = <1>;
+			clock-div = <2>;
+			#clock-cells = <0>;
+		};
+
+		gpll0_board_clk: gpll0-board-clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+		};
+
+		sleep_clk: sleep-clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+		};
+
+		xo_board_clk: xo-board-clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+		};
+	};
+
+	cpus {
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		cpu0: cpu@0 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x0>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 0>;
+			next-level-cache = <&L2_0>;
+			L2_0: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      next-level-cache = <&L3_0>;
+
+				L3_0: l3-cache {
+				      compatible = "cache";
+				      cache-level = <3>;
+				};
+			};
+		};
+
+		cpu1: cpu@100 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x100>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 0>;
+			next-level-cache = <&L2_1>;
+			L2_1: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      next-level-cache = <&L3_0>;
+			};
+		};
+
+		cpu2: cpu@200 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x200>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 1>;
+			next-level-cache = <&L2_2>;
+			L2_2: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      next-level-cache = <&L3_0>;
+			};
+		};
+
+		cpu3: cpu@300 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x300>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 1>;
+			next-level-cache = <&L2_3>;
+			L2_3: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      next-level-cache = <&L3_0>;
+			};
+		};
+
+		cpu4: cpu@10000 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x10000>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 2>;
+			next-level-cache = <&L2_4>;
+			L2_4: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      next-level-cache = <&L3_1>;
+				L3_1: l3-cache {
+				      compatible = "cache";
+				      cache-level = <3>;
+				};
+			};
+		};
+
+		cpu5: cpu@10100 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x10100>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 2>;
+			next-level-cache = <&L2_5>;
+			L2_5: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      next-level-cache = <&L3_1>;
+			};
+		};
+
+		cpu6: cpu@10200 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x10200>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 2>;
+			next-level-cache = <&L2_6>;
+			L2_6: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      next-level-cache = <&L3_1>;
+			};
+		};
+
+		cpu7: cpu@10300 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x10300>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 2>;
+			next-level-cache = <&L2_7>;
+			L2_7: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      next-level-cache = <&L3_1>;
+			};
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&cpu0>;
+				};
+
+				core1 {
+					cpu = <&cpu1>;
+				};
+			};
+
+			cluster1 {
+				core0 {
+					cpu = <&cpu2>;
+				};
+
+				core1 {
+					cpu = <&cpu3>;
+				};
+			};
+
+			cluster2 {
+				core0 {
+					cpu = <&cpu4>;
+				};
+
+				core1 {
+					cpu = <&cpu5>;
+				};
+
+				core2 {
+					cpu = <&cpu6>;
+				};
+
+				core3 {
+					cpu = <&cpu7>;
+				};
+			};
+		};
+	};
+
+	firmware: firmware {
+		scm {
+			compatible = "qcom,scm-sa7255p", "qcom,scm";
+			memory-region = <&tz_ffi_mem>;
+		};
+	};
+
+	memory@80000000 {
+		device_type = "memory";
+		reg = <0x0 0x80000000 0x0 0x0>;
+	};
+
+	psci {
+		compatible = "arm,psci-1.0";
+		method = "smc";
+		mode-bootloader = <0x10001 0x2>;
+		mode-edl = <0 0x1>;
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		sail_ss_mem: sail-ss@80000000 {
+			reg = <0x0 0x80000000 0x0 0x10000000>;
+			no-map;
+		};
+
+		hyp_mem: hyp@90000000 {
+			reg = <0x0 0x90000000 0x0 0x600000>;
+			no-map;
+		};
+
+		xbl_boot_mem: xbl-boot@90600000 {
+			reg = <0x0 0x90600000 0x0 0x200000>;
+			no-map;
+		};
+
+		aop_image_mem: aop-image-region@90800000 {
+			no-map;
+			reg = <0x0 0x90800000 0x0 0x60000>;
+		};
+
+		aop_cmd_db_mem: aop-cmd-db-region@90860000 {
+			compatible = "qcom,cmd-db";
+			no-map;
+			reg = <0x0 0x90860000 0x0 0x20000>;
+		};
+
+		uefi_log: uefi-log@908b0000 {
+			reg = <0x0 0x908b0000 0x0 0x10000>;
+			no-map;
+		};
+
+		ddr_training_checksum: ddr-training-checksum@908c0000 {
+			reg = <0x0 0x908c0000 0x0 0x1000>;
+			no-map;
+		};
+
+		reserved_mem: reserved@908f0000 {
+			reg = <0x0 0x908f0000 0x0 0xe000>;
+			no-map;
+		};
+
+		secdata_apss_mem: secdata-apss@908fe000 {
+			reg = <0x0 0x908fe000 0x0 0x2000>;
+			no-map;
+		};
+
+		smem_mem: smem@90900000 {
+			compatible = "qcom,smem";
+			reg = <0x0 0x90900000 0x0 0x200000>;
+			no-map;
+			hwlocks = <&tcsr_mutex 3>;
+		};
+
+		tz_sail_mailbox_mem: tz-sail-mailbox@90c00000 {
+			reg = <0x0 0x90c00000 0x0 0x100000>;
+			no-map;
+		};
+
+		sail_mailbox_mem: sail-ss@90d00000 {
+			reg = <0x0 0x90d00000 0x0 0x100000>;
+			no-map;
+		};
+
+		sail_ota_mem: sail-ss@90e00000 {
+			reg = <0x0 0x90e00000 0x0 0x300000>;
+			no-map;
+		};
+
+		aoss_backup_mem: aoss-backup-region@91b00000 {
+			no-map;
+			reg = <0x0 0x91b00000 0x0 0x40000>;
+		};
+
+		cpucp_backup_mem: cpucp-backup@91b40000 {
+			reg = <0x0 0x91b40000 0x0 0x40000>;
+			no-map;
+		};
+
+		tz_config_backup_mem: tz-config-backup@91b80000 {
+			reg = <0x0 0x91b80000 0x0 0x10000>;
+			no-map;
+		};
+
+		ddr_training_data_mem: ddr-training-data@91b90000 {
+			reg = <0x0 0x91b90000 0x0 0x10000>;
+			no-map;
+		};
+
+		cdt_data_backup_mem: cdt-data-backup@91ba0000 {
+			reg = <0x0 0x91ba0000 0x0 0x1000>;
+			no-map;
+		};
+
+		tz_ffi_mem: tz-ffi@91c00000 {
+			compatible = "shared-dma-pool";
+			reg = <0x0 0x91c00000 0x0 0x1400000>;
+			no-map;
+		};
+
+		lpass_machine_learning_mem: lpass-machine-learning@93b00000 {
+			reg = <0x0 0x93b00000 0x0 0xf00000>;
+			no-map;
+		};
+
+		adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap-region@94a00000 {
+			no-map;
+			reg = <0x0 0x94a00000 0x0 0x800000>;
+		};
+
+		camera_mem: camera-region@95200000 {
+			no-map;
+			reg = <0x0 0x95200000 0x0 0x500000>;
+		};
+
+		mproc_umdpil_mem: mproc-umdpil-region@95700000 {
+			no-map;
+			reg = <0x0 0x95700000 0x0 0x500000>;
+		};
+
+		adsp_mem: adsp-region@95c00000 {
+			no-map;
+			reg = <0x0 0x95c00000 0x0 0x1e00000>;
+		};
+
+		gpdsp_mem: gpdsp-region@97b00000 {
+			no-map;
+			reg = <0x0 0x97b00000 0x0 0x1e00000>;
+		};
+
+		cdsp_mem: cdsp-region@99980000 {
+			no-map;
+			reg = <0x0 0x99980000 0x0 0x1e00000>;
+		};
+
+		gpu_microcode_mem: gpu-microcode-region@9b780000 {
+			no-map;
+			reg = <0x0 0x9b780000 0x0 0x2000>;
+		};
+
+		cvp_mem: cvp-region@9b782000 {
+			no-map;
+			reg = <0x0 0x9b782000 0x0 0x700000>;
+		};
+
+		video_mem: video-region@9be82000 {
+			no-map;
+			reg = <0x0 0x9be82000 0x0 0x700000>;
+		};
+
+		firmware_mem: firmware-region@b0000000 {
+			reg = <0x0 0xb0000000 0x0 0x800000>;
+			no-map;
+		};
+
+		hyptz_reserved_mem: hyptz-reserved@beb00000 {
+			reg = <0x0 0xbeb00000 0x0 0x11500000>;
+			no-map;
+		};
+
+		scmi_mem: scmi-region@d0000000 {
+			reg = <0x0 0xd0000000 0x0 0x40000>;
+			no-map;
+		};
+
+		firmware_logs_mem: firmware-logs@d0040000 {
+			reg = <0x0 0xd0040000 0x0 0x10000>;
+			no-map;
+		};
+
+		firmware_reserved_mem: firmware-reserved@d0054000 {
+			reg = <0x0 0xd0054000 0x0 0x9c000>;
+			no-map;
+		};
+
+		firmware_quantum_test_mem: firmware-quantum-test@d00f0000 {
+			reg = <0x0 0xd00f0000 0x0 0x10000>;
+			no-map;
+		};
+
+		tags_mem: tags@d0100000 {
+			reg = <0x0 0xd0100000 0x0 0x1200000>;
+			no-map;
+		};
+
+		qtee_mem: qtee@d1300000 {
+			reg = <0x0 0xd1300000 0x0 0x500000>;
+			no-map;
+		};
+
+		deep_sleep_back_up_mem: deep-sleep-back-up-region@d1800000 {
+			no-map;
+			reg = <0x0 0xd1800000 0x0 0x100000>;
+		};
+
+		trusted_apps_mem: trusted-apps@d1900000 {
+			reg = <0x0 0xd1900000 0x0 0x3800000>;
+			no-map;
+		};
+
+		tz_stat_mem: tz-stat@db100000 {
+			reg = <0x0 0xdb100000 0x0 0x100000>;
+			no-map;
+		};
+
+		cpucp_fw_mem: cpucp-fw@db200000 {
+			reg = <0x0 0xdb200000 0x0 0x100000>;
+			no-map;
+		};
+
+		cma: linux,cma {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xdfffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x2000000>;
+			linux,cma-default;
+		};
+	};
+
+	soc: soc@0 {
+		compatible = "simple-bus";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges = <0 0 0 0 0x10 0>;
+
+		dcc: dma@40ff000 {
+			compatible = "qcom,dcc-v3", "qcom,dcc";
+			reg = <0x0 0x040ff000 0x0 0x1000>,
+			      <0x0 0x040b8800 0x0 0x6000>;
+			qcom,dcc-offset = <0x38800>;
+		};
+
+		ipcc0: mailbox@408000 {
+			compatible = "qcom,sa7255p-ipcc", "qcom,ipcc";
+			reg = <0x0 0x408000 0x0 0x1000>;
+			interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			#mbox-cells = <2>;
+		};
+
+		ipcc1: mailbox@488000 {
+			compatible = "qcom,sa7255p-ipcc", "qcom,ipcc";
+			reg = <0x0 0x488000 0x0 0x1000>;
+			interrupts = <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			#mbox-cells = <2>;
+			status = "disabled";
+		};
+
+		qupv3_id_0: geniqup@9c0000 {
+			compatible = "qcom,sa7255p-geni-se-qup";
+			reg = <0x0 0x9c0000 0x0 0x2000>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+			iommus = <&apps_smmu 0x403 0x0>;
+			status = "disabled";
+
+			i2c0: i2c@980000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi0: spi@980000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart0: serial@980000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c1: i2c@984000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi1: spi@984000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart1: serial@984000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c2: i2c@988000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi2: spi@988000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart2: serial@988000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c3: i2c@98c000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi3: spi@98c000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart3: serial@98c000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c4: i2c@990000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi4: spi@990000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart4: serial@990000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c5: i2c@994000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0x994000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi5: spi@994000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0x994000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart5: serial@994000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0x994000 0x0 0x4000>;
+				interrupts = <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c6: i2c@998000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0x998000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 536 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi6: spi@998000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0x998000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 536 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart7: serial@99c000 {
+				compatible = "qcom,sa7255p-geni-debug-uart";
+				reg = <0x0 0x0099c000 0x0 0x4000>;
+				interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+		};
+
+		qupv3_id_1: geniqup@ac0000 {
+			compatible = "qcom,sa7255p-geni-se-qup";
+			reg = <0x0 0x00ac0000 0x0 0x2000>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+			iommus = <&apps_smmu 0x443 0x0>;
+			status = "disabled";
+
+			i2c8: i2c@a80000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi8: spi@a80000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c9: i2c@a84000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0xa84000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi9: spi@a84000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0xa84000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart9: serial@a84000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0x00a84000 0x0 0x4000>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c10: i2c@a88000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi10: spi@a88000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart10: serial@a88000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c11: i2c@a8c000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0xa8c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi11: spi@a8c000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0xa8c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart11: serial@a8c000 {
+				compatible = "qcom,sa7255p-geni-debug-uart";
+				reg = <0x0 0x00a8c000 0x0 0x4000>;
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c12: i2c@a90000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0xa90000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi12: spi@a90000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0xa90000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart12: serial@a90000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0x00a90000 0x0 0x4000>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c13: i2c@a94000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0xa94000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi13: spi@a94000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0xa94000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart13: serial@a94000 {
+				compatible = "qcom,sa7255p-geni-uart";
+				reg = <0x0 0x00a94000 0x0 0x4000>;
+				interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c14: i2c@a98000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0xa98000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 835 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c15: i2c@a9c000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0xa9c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+		};
+
+		qupv3_id_3: geniqup@bc0000 {
+			compatible = "qcom,sa7255p-geni-se-qup";
+			reg = <0x0 0xbc0000 0x0 0x2000>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+			iommus = <&apps_smmu 0x43 0x0>;
+			status = "disabled";
+
+			i2c16: i2c@b80000 {
+				compatible = "qcom,sa7255p-geni-i2c";
+				reg = <0x0 0xb80000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 830 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi16: spi@b80000 {
+				compatible = "qcom,sa7255p-geni-spi";
+				reg = <0x0 0xb80000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 830 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+		};
+
+		ufs_mem_hc: ufs@1d84000 {
+			compatible = "qcom,sa7255p-ufshc", "qcom,ufshc", "jedec,ufs-2.0";
+			reg = <0x0 0x01d84000 0x0 0x3000>;
+			interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>;
+			lanes-per-direction = <2>;
+			iommus = <&apps_smmu 0x100 0x0>;
+			dma-coherent;
+			qcom,ice = <&ice>;
+			status = "disabled";
+		};
+
+		ice: crypto@1d88000 {
+			compatible = "qcom,sa7255p-inline-crypto-engine",
+				     "qcom,inline-crypto-engine";
+			reg = <0x0 0x01d88000 0x0 0x10000>;
+			qcom,ice-use-hwkm;
+			qcom,ice-skip-clk;
+		};
+
+		tcsr_mutex: hwlock@1f40000 {
+			compatible = "qcom,tcsr-mutex";
+			reg = <0x0 0x01f40000 0x0 0x20000>;
+			#hwlock-cells = <1>;
+		};
+
+		tcsr: syscon@1fc0000 {
+			compatible = "qcom,sa7255p-tcsr", "syscon";
+			reg = <0x0 0x1fc0000 0x0 0x30000>;
+		};
+
+		adreno_smmu: iommu@3da0000 {
+			compatible = "qcom,sa7255p-smmu-500", "qcom,adreno-smmu",
+				     "qcom,smmu-500", "arm,mmu-500";
+			reg = <0x0 0x03da0000 0x0 0x20000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <2>;
+			dma-coherent;
+
+			interrupts = <GIC_SPI 672 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 673 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 678 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 679 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 680 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 681 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 682 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 683 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 684 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 685 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 686 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 687 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		usb_0_hsphy: phy@8904000 {
+			compatible = "qcom,sa7255p-usb-hs-phy",
+				     "qcom,usb-snps-hs-5nm-phy";
+			reg = <0x0 0x08904000 0x0 0x120>;
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_1_hsphy: phy@8906000 {
+			compatible = "qcom,sa7255p-usb-hs-phy",
+				     "qcom,usb-snps-hs-5nm-phy";
+			reg = <0x0 0x08906000 0x0 0x120>;
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_0_qmpphy: phy@8907000 {
+			compatible = "qcom,sa7255p-qmp-usb3-uni-phy";
+			reg = <0x0 0x08907000 0x0 0x2000>;
+
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_1: usb@a4f8800 {
+			compatible = "qcom,sa7255p-dwc3", "qcom,dwc3";
+			reg = <0x0 0x0a4f8800 0x0 0x400>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			interrupts-extended = <&intc GIC_SPI 444 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "pwr_event",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq";
+
+			status = "disabled";
+
+			usb_1_dwc3: usb@a400000 {
+				compatible = "snps,dwc3";
+				reg = <0x0 0x0a400000 0x0 0xe000>;
+				interrupts = <GIC_SPI 442 IRQ_TYPE_LEVEL_HIGH>;
+				iommus = <&apps_smmu 0x020 0x0>;
+				phys = <&usb_1_hsphy>;
+				phy-names = "usb2-phy";
+			};
+		};
+
+		usb_0: usb@a6f8800 {
+			compatible = "qcom,sa7255p-dwc3", "qcom,dwc3";
+			reg = <0x0 0x0a6f8800 0x0 0x400>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			interrupts-extended = <&intc GIC_SPI 287 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 12 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq",
+					  "ss_phy_irq";
+
+			status = "disabled";
+
+			usb_0_dwc3: usb@a600000 {
+				compatible = "snps,dwc3";
+				reg = <0x0 0x0a600000 0x0 0xe000>;
+				interrupts = <GIC_SPI 292 IRQ_TYPE_LEVEL_HIGH>;
+				iommus = <&apps_smmu 0x080 0x0>;
+				phys = <&usb_0_hsphy>, <&usb_0_qmpphy>;
+				phy-names = "usb2-phy", "usb3-phy";
+
+				snps,dis-u1-entry-quirk;
+				snps,dis-u2-entry-quirk;
+			};
+		};
+
+		pdc: interrupt-controller@b220000 {
+			compatible = "qcom,sa7255p-pdc", "qcom,pdc";
+			reg = <0x0 0x0b220000 0x0 0x30000>,
+			      <0x0 0x17c000f0 0x0 0x64>;
+			qcom,pdc-ranges = <0 480 40>,
+					  <40 140 14>,
+					  <54 263 1>,
+					  <55 306 4>,
+					  <59 312 3>,
+					  <62 374 2>,
+					  <64 434 2>,
+					  <66 438 2>,
+					  <70 520 1>,
+					  <73 523 1>,
+					  <118 568 6>,
+					  <124 609 3>,
+					  <159 638 1>,
+					  <160 720 3>,
+					  <169 728 30>,
+					  <199 416 2>,
+					  <201 449 1>,
+					  <202 89 1>,
+					  <203 451 1>,
+					  <204 462 1>,
+					  <205 264 1>,
+					  <206 579 1>,
+					  <207 653 1>,
+					  <208 656 1>,
+					  <209 659 1>,
+					  <210 122 1>,
+					  <211 699 1>,
+					  <212 705 1>,
+					  <213 450 1>,
+					  <214 643 2>,
+					  <216 646 5>,
+					  <221 390 5>,
+					  <226 700 2>,
+					  <228 440 1>,
+					  <229 663 1>,
+					  <230 524 2>,
+					  <232 612 3>,
+					  <235 723 5>;
+			#interrupt-cells = <2>;
+			interrupt-parent = <&intc>;
+			interrupt-controller;
+		};
+
+		tsens2: thermal-sensor@c251000 {
+			compatible = "qcom,sa7255p-tsens", "qcom,tsens-v2";
+			reg = <0x0 0x0c251000 0x0 0x1ff>,
+			      <0x0 0x0c224000 0x0 0x8>;
+			interrupts = <GIC_SPI 572 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 609 IRQ_TYPE_LEVEL_HIGH>;
+			#qcom,sensors = <10>;
+			interrupt-names = "uplow", "critical";
+			#thermal-sensor-cells = <1>;
+		};
+
+		tsens3: thermal-sensor@c252000 {
+			compatible = "qcom,sa7255p-tsens", "qcom,tsens-v2";
+			reg = <0x0 0x0c252000 0x0 0x1ff>,
+			      <0x0 0x0c225000 0x0 0x8>;
+			interrupts = <GIC_SPI 573 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 610 IRQ_TYPE_LEVEL_HIGH>;
+			#qcom,sensors = <10>;
+			interrupt-names = "uplow", "critical";
+			#thermal-sensor-cells = <1>;
+		};
+
+		tsens0: thermal-sensor@c263000 {
+			compatible = "qcom,sa7255p-tsens", "qcom,tsens-v2";
+			reg = <0x0 0x0c263000 0x0 0x1ff>,
+			      <0x0 0x0c222000 0x0 0x8>;
+			interrupts = <GIC_SPI 506 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 508 IRQ_TYPE_LEVEL_HIGH>;
+			#qcom,sensors = <10>;
+			interrupt-names = "uplow", "critical";
+			#thermal-sensor-cells = <1>;
+		};
+
+		tsens1: thermal-sensor@c265000 {
+			compatible = "qcom,sa7255p-tsens", "qcom,tsens-v2";
+			reg = <0x0 0x0c265000 0x0 0x1ff>,
+			      <0x0 0x0c223000 0x0 0x8>;
+			interrupts = <GIC_SPI 507 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 509 IRQ_TYPE_LEVEL_HIGH>;
+			#qcom,sensors = <10>;
+			interrupt-names = "uplow", "critical";
+			#thermal-sensor-cells = <1>;
+		};
+
+		tlmm: pinctrl@f000000 {
+			compatible = "qcom,sa7255p-tlmm";
+			reg = <0x0 0x0f000000 0x0 0x1000000>;
+			interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+			gpio-ranges = <&tlmm 0 0 133>;
+			wakeup-parent = <&pdc>;
+		};
+
+		apps_smmu: iommu@15000000 {
+			compatible = "qcom,sa7255p-smmu-500", "qcom,smmu-500", "arm,mmu-500";
+			reg = <0x0 0x15000000 0x0 0x100000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <2>;
+
+			interrupts = <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI  98 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI  99 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 109 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 183 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 185 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 315 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 316 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 336 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 337 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 338 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 340 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 342 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 343 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 344 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 345 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 396 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 397 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 398 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 399 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 401 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 402 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 403 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 404 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 409 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 418 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 419 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 412 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 421 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 706 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 423 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 424 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 425 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 689 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 690 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 691 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 692 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 693 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 694 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 695 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 696 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 410 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 411 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 420 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 413 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 422 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 707 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 708 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 709 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 710 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 711 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 414 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 712 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 713 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 714 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 715 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 912 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 911 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 910 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 909 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 908 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 907 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 906 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 905 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 904 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 903 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 902 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 901 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 900 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 899 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 898 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 897 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 896 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 895 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		pcie_smmu: iommu@15200000 {
+			compatible = "qcom,sa7255p-smmu-500", "qcom,smmu-500", "arm,mmu-500";
+			reg = <0x0 0x15200000 0x0 0x80000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <2>;
+			dma-coherent;
+
+			interrupts = <GIC_SPI 920 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 921 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 925 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 926 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 927 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 928 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 950 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 951 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 952 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 953 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 954 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 955 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 956 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 957 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 958 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 885 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 886 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 887 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 888 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 820 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 822 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 823 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 310 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 446 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 447 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 452 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 840 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 841 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 842 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 843 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 844 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 845 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 846 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 847 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 848 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 849 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 802 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 803 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 804 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 805 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 806 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 807 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 808 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 809 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 810 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 811 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 812 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 813 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 814 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 836 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 837 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 838 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 839 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 854 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 855 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 856 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 790 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 791 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 792 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 793 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 794 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 795 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 796 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 639 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 79 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 640 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		intc: interrupt-controller@17a00000 {
+			compatible = "arm,gic-v3";
+			reg = <0x0 0x17a00000 0x0 0x10000>,	/* GICD */
+			      <0x0 0x17a60000 0x0 0x100000>;	/* GICR * 8 */
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+			#redistributor-regions = <1>;
+			redistributor-stride = <0x0 0x20000>;
+		};
+
+		memtimer: timer@17c20000 {
+			compatible = "arm,armv7-timer-mem";
+			reg = <0x0 0x17c20000 0x0 0x1000>;
+			ranges = <0x0 0x0 0x0 0x20000000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			frame@17c21000 {
+				reg = <0x17c21000 0x1000>,
+				      <0x17c22000 0x1000>;
+				interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
+					     <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <0>;
+			};
+
+			frame@17c23000 {
+				reg = <0x17c23000 0x1000>;
+				interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <1>;
+				status = "disabled";
+			};
+
+			frame@17c25000 {
+				reg = <0x17c25000 0x1000>;
+				interrupts = <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <2>;
+				status = "disabled";
+			};
+
+			frame@17c27000 {
+				reg = <0x17c27000 0x1000>;
+				interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <3>;
+				status = "disabled";
+			};
+
+			frame@17c29000 {
+				reg = <0x17c29000 0x1000>;
+				interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <4>;
+				status = "disabled";
+			};
+
+			frame@17c2b000 {
+				reg = <0x17c2b000 0x1000>;
+				interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <5>;
+				status = "disabled";
+			};
+
+			frame@17c2d000 {
+				reg = <0x17c2d000 0x1000>;
+				interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <6>;
+				status = "disabled";
+			};
+		};
+
+		watchdog@17c10000 {
+			compatible = "qcom,apss-wdt-sa7255p", "qcom,kpss-wdt";
+			reg = <0x0 0x17c10000 0x0 0x1000>;
+			clocks = <&sleep_clk>;
+			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+		};
+
+		cpufreq_hw: cpufreq-hw@18591000 {
+			compatible = "qcom,cpufreq-epss",
+				     "qcom,qcs8300-cpufreq-epss";
+			reg = <0x0 0x18591000 0x0 0x1000>,
+			      <0x0 0x18594000 0x0 0x1000>,
+			      <0x0 0x18593000 0x0 0x1000>;
+			reg-names = "freq-domain0", "freq-domain1", "freq-domain2";
+			interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "dcvsh-irq-0", "dcvsh-irq-1", "dcvsh-irq-2";
+
+			clocks = <&bi_tcxo_div2>, <&gpll0_board_clk>;
+			clock-names = "xo", "alternate";
+
+			#freq-domain-cells = <1>;
+		};
+
+		pcie0: pci@400000000 {
+			compatible = "qcom,pcie-ecam-rc";
+			reg = <0x4 0x00000000 0x0 0x10000000>;
+
+			device_type = "pci";
+
+			#address-cells = <3>;
+			#size-cells = <2>;
+
+			ranges = <0x01000000 0x0 0x40000000 0x0 0x40000000 0x0 0x100000>,
+				 <0x02000000 0x0 0x40100000 0x0 0x40100000 0x0 0x1ff00000>,
+				 <0x43000000 0x4 0x10100000 0x4 0x10100000 0x0 0x100000>;
+			bus-range = <0x00 0xff>;
+
+			dma-coherent;
+
+			linux,pci-domain = <0>;
+
+			interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 308 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 309 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 312 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 313 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 314 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 374 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 375 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-parent = <&intc>;
+
+			iommus = <&pcie_smmu 0x00 0x7f>;
+			iommu-map = <0x0 &pcie_smmu 0x0000 0x1>,
+				    <0x100 &pcie_smmu 0x0001 0x1>,
+				    <0x200 &pcie_smmu 0x0002 0x1>,
+				    <0x300 &pcie_smmu 0x0003 0x1>;
+
+			status = "disabled";
+		};
+
+		pcie1: pci@600000000 {
+			compatible = "qcom,pcie-ecam-rc";
+			reg = <0x6 0x00000000 0x0 0x10000000>;
+
+			device_type = "pci";
+
+			#address-cells = <3>;
+			#size-cells = <2>;
+
+			ranges = <0x01000000 0x0 0x60000000 0x0 0x60000000 0x0 0x100000>,
+				 <0x02000000 0x0 0x60100000 0x0 0x60100000 0x0 0x1ff00000>,
+				 <0x43000000 0x6 0x10100000 0x6 0x10100000 0x0 0x100000>;
+			bus-range = <0x00 0xff>;
+
+			dma-coherent;
+
+			linux,pci-domain = <1>;
+
+			interrupts = <GIC_SPI 519 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 144 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 145 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 146 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-parent = <&intc>;
+
+			iommus = <&pcie_smmu 0x80 0x7f>;
+			iommu-map = <0x0 &pcie_smmu 0x0080 0x1>,
+				    <0x100 &pcie_smmu 0x0081 0x1>,
+				    <0x200 &pcie_smmu 0x0082 0x1>,
+				    <0x208 &pcie_smmu 0x0083 0x1>,
+				    <0x210 &pcie_smmu 0x0084 0x1>,
+				    <0x300 &pcie_smmu 0x0085 0x1>,
+				    <0xab00 &pcie_smmu 0x0086 0x1>;
+
+			status = "disabled";
+		};
+	};
+
+	thermal-zones {
+		aoss-0-thermal {
+			thermal-sensors = <&tsens0 0>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-0-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 1>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-1-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 2>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-2-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 3>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-3-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 4>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		gpuss-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 5>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		audio-thermal {
+			thermal-sensors = <&tsens0 6>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		camss-0-thermal {
+			thermal-sensors = <&tsens0 7>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pcie-0-thermal {
+			thermal-sensors = <&tsens0 8>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpuss-0-0-thermal {
+			thermal-sensors = <&tsens0 9>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		aoss-1-thermal {
+			thermal-sensors = <&tsens1 0>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-0-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 1>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-1-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 2>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-2-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 3>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-3-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 4>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		gpuss-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 5>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		video-thermal {
+			thermal-sensors = <&tsens1 6>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		camss-1-thermal {
+			thermal-sensors = <&tsens1 7>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pcie-1-thermal {
+			thermal-sensors = <&tsens1 8>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpuss-0-1-thermal {
+			thermal-sensors = <&tsens1 9>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		aoss-2-thermal {
+			thermal-sensors = <&tsens2 0>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-0-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 1>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-1-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 2>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-2-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 3>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-3-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 4>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-0-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 5>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-1-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 6>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-2-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 7>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		ddrss-0-thermal {
+			thermal-sensors = <&tsens2 8>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpuss-1-0-thermal {
+			thermal-sensors = <&tsens2 9>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		aoss-3-thermal {
+			thermal-sensors = <&tsens3 0>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-0-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 1>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-1-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 2>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-2-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 3>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-3-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 4>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-0-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 5>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-1-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 6>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-2-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 7>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		ddrss-1-thermal {
+			thermal-sensors = <&tsens3 8>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpuss-1-1-thermal {
+			thermal-sensors = <&tsens3 9>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+	};
+
+	arch_timer: timer {
+		compatible = "arm,armv8-timer";
+		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 12 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>;
+		clock-frequency = <19200000>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8155p-adp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8155p-adp.dts
@@ -367,6 +367,16 @@
 	};
 };
 
+&pmm8155au_1_gpios {
+	pmm8155au_1_sdc2_cd: sdc2-cd-default-state {
+		pins = "gpio4";
+		function = "normal";
+		input-enable;
+		bias-pull-up;
+		power-source = <0>;
+	};
+};
+
 &qupv3_id_1 {
 	status = "okay";
 };
@@ -384,10 +394,10 @@
 &sdhc_2 {
 	status = "okay";
 
-	cd-gpios = <&tlmm 4 GPIO_ACTIVE_LOW>;
+	cd-gpios = <&pmm8155au_1_gpios 4 GPIO_ACTIVE_LOW>;
 	pinctrl-names = "default", "sleep";
-	pinctrl-0 = <&sdc2_on>;
-	pinctrl-1 = <&sdc2_off>;
+	pinctrl-0 = <&sdc2_on &pmm8155au_1_sdc2_cd>;
+	pinctrl-1 = <&sdc2_off &pmm8155au_1_sdc2_cd>;
 	vqmmc-supply = <&vreg_l13c_2p96>; /* IO line power */
 	vmmc-supply = <&vreg_l17a_2p96>;  /* Card power line */
 	bus-width = <4>;
@@ -505,13 +515,6 @@
 			bias-pull-up;		/* pull up */
 			drive-strength = <16>;	/* 16 MA */
 		};
-
-		sd-cd-pins {
-			pins = "gpio96";
-			function = "gpio";
-			bias-pull-up;		/* pull up */
-			drive-strength = <2>;	/* 2 MA */
-		};
 	};
 
 	sdc2_off: sdc2-off-state {
@@ -532,13 +535,6 @@
 			bias-pull-up;		/* pull up */
 			drive-strength = <2>;	/* 2 MA */
 		};
-
-		sd-cd-pins {
-			pins = "gpio96";
-			function = "gpio";
-			bias-pull-up;		/* pull up */
-			drive-strength = <2>;	/* 2 MA */
-		};
 	};
 
 	usb2phy_ac_en1_default: usb2phy-ac-en1-default-state {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8255p-pmics.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8255p-pmics.dtsi
@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/ {
+	thermal-zones {
+		pmm8654au_0_thermal: pm8255-0-thermal {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+
+			trips {
+				trip0 {
+					temperature = <105000>;
+					hysteresis = <0>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <0>;
+					type = "critical";
+				};
+			};
+		};
+
+		pmm8654au_1_thermal: pm8255-1-thermal {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+
+			trips {
+				trip0 {
+					temperature = <105000>;
+					hysteresis = <0>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <0>;
+					type = "critical";
+				};
+			};
+		};
+
+		pmm8654au_2_thermal: pm8255-2-thermal {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+
+			trips {
+				trip0 {
+					temperature = <105000>;
+					hysteresis = <0>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <0>;
+					type = "critical";
+				};
+			};
+		};
+
+		pmm8654au_3_thermal: pm8255-3-thermal {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+
+			trips {
+				trip0 {
+					temperature = <105000>;
+					hysteresis = <0>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <0>;
+					type = "critical";
+				};
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8255p-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8255p-ride.dts
@@ -0,0 +1,540 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+#include "sa8255p.dtsi"
+#include "sa8255p-pmics.dtsi"
+#include "sa8255p-scmi.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SA8255P Ride";
+	compatible = "qcom,sa8255p-ride","qcom,sa8255p";
+
+	aliases {
+		ethernet0 = &ethernet0;
+		ethernet1 = &ethernet1;
+		i2c11 = &i2c11;
+		i2c18 = &i2c18;
+		serial0 = &uart10;
+		serial1 = &uart4;
+		spi16 = &spi16;
+		ufshc1 = &ufs_mem_hc;
+		scmichannels = &scmichannels;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+};
+
+&aoss_qmp {
+	status = "disabled";
+};
+
+&adreno_smmu {
+	power-domains = <&scmi15_pd 0>;
+
+	status = "okay";
+};
+
+&ethernet0 {
+	phy-mode = "sgmii";
+	phy-handle = <&sgmii_phy0>;
+
+	pinctrl-0 = <&ethernet0_default>;
+	pinctrl-names = "default";
+
+	snps,mtl-rx-config = <&mtl_rx_setup>;
+	snps,mtl-tx-config = <&mtl_tx_setup>;
+	snps,ps-speed = <1000>;
+
+	power-domains = <&scmi7_pd 0>, <&scmi7_pd 1>,<&scmi7_dvfs 0>;
+	power-domain-names = "power_core", "power_mdio","perf_serdes";
+
+	status = "okay";
+
+	mdio {
+		compatible = "snps,dwmac-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		sgmii_phy0: phy@8 {
+			compatible = "ethernet-phy-id0141.0dd4";
+			reg = <0x8>;
+			device_type = "ethernet-phy";
+			resets = <&scmi7_rst 0>;
+			reset-names = "phy";
+			reset-assert-us = <11000>;
+			reset-deassert-us = <70000>;
+		};
+
+		sgmii_phy1: phy@a {
+			compatible = "ethernet-phy-id0141.0dd4";
+			reg = <0xa>;
+			device_type = "ethernet-phy";
+			resets = <&scmi8_rst 0>;
+			reset-names = "phy";
+			reset-assert-us = <11000>;
+			reset-deassert-us = <70000>;
+		};
+	};
+
+	mtl_rx_setup: rx-queues-config {
+		snps,rx-queues-to-use = <4>;
+		snps,rx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x0>;
+			snps,route-up;
+			snps,priority = <0x1>;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x1>;
+			snps,route-ptp;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x2>;
+			snps,route-avcp;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x3>;
+			snps,priority = <0xc>;
+		};
+	};
+
+	mtl_tx_setup: tx-queues-config {
+		snps,tx-queues-to-use = <4>;
+		snps,tx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+	};
+};
+
+&ethernet1 {
+	phy-mode = "sgmii";
+	phy-handle = <&sgmii_phy1>;
+
+	snps,mtl-rx-config = <&mtl_rx_setup1>;
+	snps,mtl-tx-config = <&mtl_tx_setup1>;
+	snps,ps-speed = <1000>;
+
+	power-domains = <&scmi8_pd 0>, <&scmi8_pd 1>,<&scmi8_dvfs 0>;
+	power-domain-names = "power_core", "power_mdio","perf_serdes";
+
+	status = "okay";
+
+	mtl_rx_setup1: rx-queues-config {
+		snps,rx-queues-to-use = <4>;
+		snps,rx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x0>;
+			snps,route-up;
+			snps,priority = <0x1>;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x1>;
+			snps,route-ptp;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x2>;
+			snps,route-avcp;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x3>;
+			snps,priority = <0xc>;
+		};
+	};
+
+	mtl_tx_setup1: tx-queues-config {
+		snps,tx-queues-to-use = <4>;
+		snps,tx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+	};
+};
+
+&gpll0_board_clk {
+	clock-frequency = <300000000>;
+};
+
+&i2c11 {
+	clock-frequency = <400000>;
+	power-domains = <&scmi9_pd 11>;
+
+	status = "okay";
+};
+
+&i2c18 {
+	clock-frequency = <400000>;
+	power-domains = <&scmi9_pd 18>;
+
+	status = "okay";
+};
+
+&pcie0 {
+	power-domains = <&scmi5_pd 0>;
+	power-domain-names = "power";
+	status = "disabled";
+};
+
+&pcie0_ep {
+	#dma-cells = <1>;
+	dmas = <&pcie0_ep 0>, <&pcie0_ep 1>;
+	dma-names = "rx", "tx";
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_ep_clkreq_default &pcie0_ep_perst_default
+		    &pcie0_ep_wake_default>;
+	reset-gpio = <&tlmm 2 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+	power-domains = <&scmi5_pd 1>;
+	power-domain-names = "power";
+
+	status = "disabled";
+};
+
+&pcie1 {
+	power-domains = <&scmi6_pd 0>;
+	power-domain-names = "power";
+	status = "okay";
+};
+
+&pcie1_ep {
+	#dma-cells = <1>;
+	dmas = <&pcie1_ep 0>, <&pcie1_ep 1>;
+	dma-names = "rx", "tx";
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie1_ep_clkreq_default &pcie1_ep_perst_default
+		    &pcie1_ep_wake_default>;
+	reset-gpio = <&tlmm 4 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>;
+	power-domains = <&scmi6_pd 1>;
+	power-domain-names = "power";
+
+	status = "disabled";
+};
+
+&pmm8654au_0_thermal {
+	thermal-sensors = <&scmi23_sensor 0>;
+};
+
+&pmm8654au_1_thermal {
+	thermal-sensors = <&scmi23_sensor 1>;
+};
+
+&pmm8654au_2_thermal {
+	thermal-sensors = <&scmi23_sensor 2>;
+};
+
+&pmm8654au_3_thermal {
+	thermal-sensors = <&scmi23_sensor 3>;
+};
+
+&qupv3_id_0 {
+	status = "okay";
+};
+
+&qupv3_id_1 {
+	status = "okay";
+};
+
+&qupv3_id_2 {
+	status = "okay";
+};
+
+&scmi0 {
+	status = "okay";
+};
+
+&scmi1 {
+	status = "okay";
+};
+
+&scmi2 {
+	status = "okay";
+};
+
+&scmi3 {
+	status = "okay";
+};
+
+&scmi5 {
+	status = "okay";
+};
+
+&scmi6 {
+	status = "okay";
+};
+
+&scmi7 {
+	status = "okay";
+};
+
+&scmi8 {
+	status = "okay";
+};
+
+&scmi9 {
+	status = "okay";
+};
+
+&scmi10 {
+	status = "okay";
+};
+
+&scmi11 {
+	status = "okay";
+};
+
+&scmi12 {
+	status = "okay";
+};
+
+&scmi13 {
+	status = "okay";
+};
+
+&scmi14 {
+	status = "okay";
+};
+
+&scmi15 {
+	status = "okay";
+};
+
+&scmi23 {
+	status = "okay";
+};
+
+&sleep_clk {
+	clock-frequency = <32000>;
+};
+
+&spi16 {
+	power-domains = <&scmi10_pd 16>, <&scmi10_dvfs 16>;
+	power-domain-names = "power", "perf";
+
+	status = "okay";
+};
+
+&tlmm {
+	ethernet0_default: ethernet0-default-state {
+		ethernet0_mdc: ethernet0-mdc-pins {
+			pins = "gpio8";
+			function = "emac0_mdc";
+			drive-strength = <16>;
+			bias-pull-up;
+		};
+
+		ethernet0_mdio: ethernet0-mdio-pins {
+			pins = "gpio9";
+			function = "emac0_mdio";
+			drive-strength = <16>;
+			bias-pull-up;
+		};
+	};
+
+	pcie0_ep_clkreq_default: pcie-ep-clkreq-default-state {
+		pins = "gpio1";
+		function = "pcie0_clkreq";
+		drive-strength = <2>;
+		bias-disable;
+	};
+
+	pcie0_ep_perst_default: pcie-ep-perst-default-state {
+		pins = "gpio2";
+		function = "gpio";
+		drive-strength = <16>;
+		bias-pull-down;
+	};
+
+	pcie0_ep_wake_default: pcie-ep-wake-default-state {
+		pins = "gpio0";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-disable;
+	};
+
+	pcie1_ep_clkreq_default: pcie-ep-clkreq-default-state {
+		pins = "gpio3";
+		function = "pcie1_clkreq";
+		drive-strength = <2>;
+		bias-disable;
+	};
+
+	pcie1_ep_perst_default: pcie-ep-perst-default-state {
+		pins = "gpio4";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+	};
+
+	pcie1_ep_wake_default: pcie-ep-wake-default-state {
+		pins = "gpio5";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-disable;
+	};
+};
+
+&uart4 {
+	power-domains = <&scmi11_pd 4>, <&scmi11_dvfs 4>;
+	power-domain-names = "power", "perf";
+
+	status = "okay";
+};
+
+&uart10 {
+	power-domains = <&scmi11_pd 10>, <&scmi11_dvfs 10>;
+	power-domain-names = "power", "perf";
+
+	status = "okay";
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 149 GPIO_ACTIVE_LOW>;
+	power-domains = <&scmi3_pd 0>;
+
+	status = "okay";
+};
+
+&usb_0 {
+	power-domains = <&scmi0_pd 0>, <&scmi0_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	/delete-property/ wakeup-source;
+
+	status = "okay";
+};
+
+&usb_0_dwc3 {
+	dr_mode = "peripheral";
+};
+
+&usb_0_hsphy {
+	power-domains = <&scmi12_pd 0>, <&scmi12_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&usb_0_qmpphy {
+	power-domains = <&scmi12_pd 2>, <&scmi12_pd 3>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&usb_1 {
+	power-domains = <&scmi1_pd 0>, <&scmi1_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	/delete-property/ wakeup-source;
+
+	status = "okay";
+};
+
+&usb_1_dwc3 {
+	dr_mode = "host";
+};
+
+&usb_1_hsphy {
+	power-domains = <&scmi13_pd 0>, <&scmi13_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&usb_1_qmpphy {
+	power-domains = <&scmi13_pd 2>, <&scmi13_pd 3>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&usb_2 {
+	power-domains = <&scmi2_pd 0>, <&scmi2_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	/delete-property/ wakeup-source;
+
+	status = "okay";
+};
+
+&usb_2_dwc3 {
+	dr_mode = "host";
+};
+
+&usb_2_hsphy {
+	power-domains = <&scmi14_pd 0>, <&scmi14_pd 1>;
+	power-domain-names = "usb_transfer", "usb_core";
+
+	status = "okay";
+};
+
+&xo_board_clk {
+	clock-frequency = <38400000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8255p-scmi.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8255p-scmi.dtsi
@@ -0,0 +1,2184 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&firmware {
+	scmi0: scmi0 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem0>;
+
+		interrupts = <GIC_SPI 963 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi0_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi0_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi0_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi1: scmi1 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem1>;
+
+		interrupts = <GIC_SPI 964 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi1_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi1_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi1_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi2: scmi2 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem2>;
+
+		interrupts = <GIC_SPI 965 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi2_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi2_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi2_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi3: scmi3 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem3>;
+
+		interrupts = <GIC_SPI 966 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi3_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi3_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi3_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi4: scmi4 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem4>;
+
+		interrupts = <GIC_SPI 967 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi4_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi4_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi4_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi5: scmi5 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem5>;
+
+		interrupts = <GIC_SPI 968 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi5_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi5_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi5_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi6: scmi6 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem6>;
+
+		interrupts = <GIC_SPI 969 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi6_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi6_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi6_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi7: scmi7 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem7>;
+
+		interrupts = <GIC_SPI 970 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi7_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi7_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi7_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi8: scmi8 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem8>;
+
+		interrupts = <GIC_SPI 971 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi8_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi8_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi8_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi9: scmi9 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem9>;
+
+		interrupts = <GIC_SPI 972 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi9_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi9_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi9_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi10: scmi10 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem10>;
+
+		interrupts = <GIC_SPI 973 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi10_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi10_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi10_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi11: scmi11 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem11>;
+
+		interrupts = <GIC_SPI 974 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi11_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi11_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi11_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi12: scmi12 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem12>;
+
+		interrupts = <GIC_SPI 975 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi12_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi12_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi12_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi13: scmi13 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem13>;
+
+		interrupts = <GIC_SPI 976 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi13_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi13_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi13_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi14: scmi14 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem14>;
+
+		interrupts = <GIC_SPI 977 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi14_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi14_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi14_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi15: scmi15 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem15>;
+
+		interrupts = <GIC_SPI 978 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi15_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi15_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi15_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi16: scmi16 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem16>;
+
+		interrupts = <GIC_SPI 979 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi16_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi16_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi16_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi17: scmi17 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem17>;
+
+		interrupts = <GIC_SPI 980 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi17_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi17_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi17_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi18: scmi18 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem18>;
+
+		interrupts = <GIC_SPI 981 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi18_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi18_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi18_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi19: scmi19 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem19>;
+
+		interrupts = <GIC_SPI 982 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi19_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi19_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi19_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi20: scmi20 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem20>;
+
+		interrupts = <GIC_SPI 983 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi20_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi20_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi20_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi21: scmi21 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem21>;
+
+		interrupts = <GIC_SPI 984 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi21_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi21_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi21_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi22: scmi22 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem22>;
+
+		interrupts = <GIC_SPI 985 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi22_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi22_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi22_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi23: scmi23 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem23>;
+
+		interrupts = <GIC_SPI 986 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi23_sensor: protocol@15 {
+			reg = <0x15>;
+			#thermal-sensor-cells = <1>;
+		};
+	};
+
+	scmi24: scmi24 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem24>;
+
+		interrupts = <GIC_SPI 987 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi24_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi24_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi24_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi25: scmi25 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem25>;
+
+		interrupts = <GIC_ESPI 0 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi25_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi25_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi25_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi26: scmi26 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem26>;
+
+		interrupts = <GIC_ESPI 1 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi26_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi26_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi26_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi27: scmi27 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem27>;
+
+		interrupts = <GIC_ESPI 2 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi27_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi27_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi27_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi28: scmi28 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem28>;
+
+		interrupts = <GIC_ESPI 3 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi28_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi28_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi28_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi29: scmi29 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem29>;
+
+		interrupts = <GIC_ESPI 4 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi29_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi29_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi29_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi30: scmi30 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem30>;
+
+		interrupts = <GIC_ESPI 5 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi30_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi30_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi30_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi31: scmi31 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem31>;
+
+		interrupts = <GIC_ESPI 6 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi31_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi31_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi31_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi32: scmi32 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem32>;
+
+		interrupts = <GIC_ESPI 7 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi32_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi32_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi32_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi33: scmi33 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem33>;
+
+		interrupts = <GIC_ESPI 8 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi33_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi33_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi33_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi34: scmi34 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem34>;
+
+		interrupts = <GIC_ESPI 9 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi34_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi34_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi34_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi35: scmi35 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem35>;
+
+		interrupts = <GIC_ESPI 10 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi35_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi35_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi35_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi36: scmi36 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem36>;
+
+		interrupts = <GIC_ESPI 11 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi36_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi36_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi36_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi37: scmi37 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem37>;
+
+		interrupts = <GIC_ESPI 12 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi37_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi37_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi37_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi38: scmi38 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem38>;
+
+		interrupts = <GIC_ESPI 13 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi38_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi38_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi38_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi39: scmi39 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem39>;
+
+		interrupts = <GIC_ESPI 14 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi39_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi39_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi39_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi40: scmi40 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem40>;
+
+		interrupts = <GIC_ESPI 15 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi40_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi40_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi40_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi41: scmi41 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem41>;
+
+		interrupts = <GIC_ESPI 16 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi41_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi41_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi41_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi42: scmi42 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem42>;
+
+		interrupts = <GIC_ESPI 17 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi42_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi42_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi42_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi43: scmi43 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem43>;
+
+		interrupts = <GIC_ESPI 18 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi43_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi43_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi43_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi44: scmi44 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem44>;
+
+		interrupts = <GIC_ESPI 19 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi44_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi44_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi44_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi45: scmi45 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem45>;
+
+		interrupts = <GIC_ESPI 20 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi45_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi45_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi45_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi46: scmi46 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem46>;
+
+		interrupts = <GIC_ESPI 21 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi46_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi46_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi46_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi47: scmi47 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem47>;
+
+		interrupts = <GIC_ESPI 22 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi47_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi47_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi47_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi48: scmi48 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem48>;
+
+		interrupts = <GIC_ESPI 23 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi48_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi48_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi48_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi49: scmi49 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem49>;
+
+		interrupts = <GIC_ESPI 24 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi49_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi49_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi49_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi50: scmi50 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem50>;
+
+		interrupts = <GIC_ESPI 25 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi50_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi50_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi50_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi51: scmi51 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem51>;
+
+		interrupts = <GIC_ESPI 26 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi51_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi51_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi51_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi52: scmi52 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem52>;
+
+		interrupts = <GIC_ESPI 27 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi52_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi52_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi52_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi53: scmi53 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem53>;
+
+		interrupts = <GIC_ESPI 28 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi53_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi53_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi53_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi54: scmi54 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem54>;
+
+		interrupts = <GIC_ESPI 29 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi54_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi54_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi54_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi55: scmi55 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem55>;
+
+		interrupts = <GIC_ESPI 30 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi55_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi55_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi55_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi56: scmi56 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem56>;
+
+		interrupts = <GIC_ESPI 31 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi56_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi56_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi56_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi57: scmi57 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem57>;
+
+		interrupts = <GIC_ESPI 32 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi57_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi57_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi57_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi58: scmi58 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem58>;
+
+		interrupts = <GIC_ESPI 33 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi58_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi58_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi58_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi59: scmi59 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem59>;
+
+		interrupts = <GIC_ESPI 34 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi59_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi59_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi59_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi60: scmi60 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem60>;
+
+		interrupts = <GIC_ESPI 35 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi60_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi60_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi60_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi61: scmi61 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem61>;
+
+		interrupts = <GIC_ESPI 36 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi61_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi61_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi61_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi62: scmi62 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem62>;
+
+		interrupts = <GIC_ESPI 37 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi62_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi62_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi62_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+
+	scmi63: scmi63 {
+		compatible = "qcom,scmi-smc";
+		arm,smc-id = <0xc6008012>;
+		shmem = <&shmem63>;
+
+		interrupts = <GIC_ESPI 38 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a2p";
+
+		status = "disabled";
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		scmi63_pd: protocol@11 {
+			reg = <0x11>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi63_dvfs: protocol@13 {
+			reg = <0x13>;
+			#power-domain-cells = <1>;
+		};
+
+		scmi63_rst: protocol@16 {
+			reg = <0x16>;
+			#reset-cells = <1>;
+		};
+	};
+};
+
+&soc {
+	scmichannels: sram@d0000000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "mmio-sram";
+		reg = <0x0 0xd0000000 0x0 0x40000>;
+		ranges = <0x0 0x0 0x0 0xffffffff>;
+
+		shmem0: scmi-sram@d0000000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0000000 0x1000>;
+		};
+
+		shmem1: scmi-sram@d0001000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0001000 0x1000>;
+		};
+
+		shmem2: scmi-sram@d0002000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0002000 0x1000>;
+		};
+
+		shmem3: scmi-sram@d0003000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0003000 0x1000>;
+		};
+
+		shmem4: scmi-sram@d0004000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0004000 0x1000>;
+		};
+
+		shmem5: scmi-sram@d0005000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0005000 0x1000>;
+		};
+
+		shmem6: scmi-sram@d0006000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0006000 0x1000>;
+		};
+
+		shmem7: scmi-sram@d0007000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0007000 0x1000>;
+		};
+
+		shmem8: scmi-sram@d0008000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0008000 0x1000>;
+		};
+
+		shmem9: scmi-sram@d0009000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0009000 0x1000>;
+		};
+
+		shmem10: scmi-sram@d000a000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000a000 0x1000>;
+		};
+
+		shmem11: scmi-sram@d000b000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000b000 0x1000>;
+		};
+
+		shmem12: scmi-sram@d000c000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000c000 0x1000>;
+		};
+
+		shmem13: scmi-sram@d000d000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000d000 0x1000>;
+		};
+
+		shmem14: scmi-sram@d000e000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000e000 0x1000>;
+		};
+
+		shmem15: scmi-sram@d000f000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd000f000 0x1000>;
+		};
+
+		shmem16: scmi-sram@d0010000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0010000 0x1000>;
+		};
+
+		shmem17: scmi-sram@d0011000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0011000 0x1000>;
+		};
+
+		shmem18: scmi-sram@d0012000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0012000 0x1000>;
+		};
+
+		shmem19: scmi-sram@d0013000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0013000 0x1000>;
+		};
+
+		shmem20: scmi-sram@d0014000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0014000 0x1000>;
+		};
+
+		shmem21: scmi-sram@d0015000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0015000 0x1000>;
+		};
+
+		shmem22: scmi-sram@d0016000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0016000 0x1000>;
+		};
+
+		shmem23: scmi-sram@d0017000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0017000 0x1000>;
+		};
+
+		shmem24: scmi-sram@d0018000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0018000 0x1000>;
+		};
+
+		shmem25: scmi-sram@d0019000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0019000 0x1000>;
+		};
+
+		shmem26: scmi-sram@d001a000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001a000 0x1000>;
+		};
+
+		shmem27: scmi-sram@d001b000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001b000 0x1000>;
+		};
+
+		shmem28: scmi-sram@d001c000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001c000 0x1000>;
+		};
+
+		shmem29: scmi-sram@d001d000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001d000 0x1000>;
+		};
+
+		shmem30: scmi-sram@d001e000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001e000 0x1000>;
+		};
+
+		shmem31: scmi-sram@d001f000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd001f000 0x1000>;
+		};
+
+		shmem32: scmi-sram@d0020000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0020000 0x1000>;
+		};
+
+		shmem33: scmi-sram@d0021000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0021000 0x1000>;
+		};
+
+		shmem34: scmi-sram@d0022000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0022000 0x1000>;
+		};
+
+		shmem35: scmi-sram@d0023000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0023000 0x1000>;
+		};
+
+		shmem36: scmi-sram@d0024000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0024000 0x1000>;
+		};
+
+		shmem37: scmi-sram@d0025000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0025000 0x1000>;
+		};
+
+		shmem38: scmi-sram@d0026000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0026000 0x1000>;
+		};
+
+		shmem39: scmi-sram@d0027000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0027000 0x1000>;
+		};
+
+		shmem40: scmi-sram@d0028000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0028000 0x1000>;
+		};
+
+		shmem41: scmi-sram@d0029000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0029000 0x1000>;
+		};
+
+		shmem42: scmi-sram@d002a000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002a000 0x1000>;
+		};
+
+		shmem43: scmi-sram@d002b000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002b000 0x1000>;
+		};
+
+		shmem44: scmi-sram@d002c000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002c000 0x1000>;
+		};
+
+		shmem45: scmi-sram@d002d000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002d000 0x1000>;
+		};
+
+		shmem46: scmi-sram@d002e000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002e000 0x1000>;
+		};
+
+		shmem47: scmi-sram@d002f000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd002f000 0x1000>;
+		};
+
+		shmem48: scmi-sram@d0030000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0030000 0x1000>;
+		};
+
+		shmem49: scmi-sram@d0031000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0031000 0x1000>;
+		};
+
+		shmem50: scmi-sram@d0032000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0032000 0x1000>;
+		};
+
+		shmem51: scmi-sram@d0033000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0033000 0x1000>;
+		};
+
+		shmem52: scmi-sram@d0034000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0034000 0x1000>;
+		};
+
+		shmem53: scmi-sram@d0035000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0035000 0x1000>;
+		};
+
+		shmem54: scmi-sram@d0036000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0036000 0x1000>;
+		};
+
+		shmem55: scmi-sram@d0037000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0037000 0x1000>;
+		};
+
+		shmem56: scmi-sram@d0038000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0038000 0x1000>;
+		};
+
+		shmem57: scmi-sram@d0039000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd0039000 0x1000>;
+		};
+
+		shmem58: scmi-sram@d003a000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003a000 0x1000>;
+		};
+
+		shmem59: scmi-sram@d003b000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003b000 0x1000>;
+		};
+
+		shmem60: scmi-sram@d003c000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003c000 0x1000>;
+		};
+
+		shmem61: scmi-sram@d003d000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003d000 0x1000>;
+		};
+
+		shmem62: scmi-sram@d003e000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003e000 0x1000>;
+		};
+
+		shmem63: scmi-sram@d003f000 {
+			compatible = "arm,scmi-shmem";
+			reg = <0xd003f000 0x1000>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8255p.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8255p.dtsi
@@ -0,0 +1,2820 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/mailbox/qcom-ipcc.h>
+
+/ {
+	interrupt-parent = <&intc>;
+
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	clocks {
+		xo_board_clk: xo-board-clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+		};
+
+		sleep_clk: sleep-clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+		};
+
+		gpll0_board_clk: gpll0-board-clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+		};
+
+		bi_tcxo_div2: bi-tcxo-div2-clk {
+			compatible = "fixed-factor-clock";
+			clocks = <&xo_board_clk>;
+			clock-mult = <1>;
+			clock-div = <2>;
+			#clock-cells = <0>;
+		};
+	};
+
+	cpus {
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		CPU0: cpu@0 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x0>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 0>;
+			next-level-cache = <&L2_0>;
+			L2_0: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_0>;
+				L3_0: l3-cache {
+					compatible = "cache";
+					cache-level = <3>;
+					cache-unified;
+				};
+			};
+		};
+
+		CPU1: cpu@100 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x100>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 0>;
+			next-level-cache = <&L2_1>;
+			L2_1: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_0>;
+			};
+		};
+
+		CPU2: cpu@200 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x200>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 0>;
+			next-level-cache = <&L2_2>;
+			L2_2: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_0>;
+			};
+		};
+
+		CPU3: cpu@300 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x300>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 0>;
+			next-level-cache = <&L2_3>;
+			L2_3: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_0>;
+			};
+		};
+
+		CPU4: cpu@10000 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x10000>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 1>;
+			next-level-cache = <&L2_4>;
+			L2_4: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_1>;
+				L3_1: l3-cache {
+					compatible = "cache";
+					cache-level = <3>;
+					cache-unified;
+				};
+
+			};
+		};
+
+		CPU5: cpu@10100 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x10100>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 1>;
+			next-level-cache = <&L2_5>;
+			L2_5: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_1>;
+			};
+		};
+
+		CPU6: cpu@10200 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x10200>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 1>;
+			next-level-cache = <&L2_6>;
+			L2_6: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_1>;
+			};
+		};
+
+		CPU7: cpu@10300 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x10300>;
+			enable-method = "psci";
+			qcom,freq-domain = <&cpufreq_hw 1>;
+			next-level-cache = <&L2_7>;
+			L2_7: l2-cache {
+				compatible = "cache";
+				cache-level = <2>;
+				cache-unified;
+				next-level-cache = <&L3_1>;
+			};
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&CPU0>;
+				};
+
+				core1 {
+					cpu = <&CPU1>;
+				};
+
+				core2 {
+					cpu = <&CPU2>;
+				};
+
+				core3 {
+					cpu = <&CPU3>;
+				};
+			};
+
+			cluster1 {
+				core0 {
+					cpu = <&CPU4>;
+				};
+
+				core1 {
+					cpu = <&CPU5>;
+				};
+
+				core2 {
+					cpu = <&CPU6>;
+				};
+
+				core3 {
+					cpu = <&CPU7>;
+				};
+			};
+		};
+	};
+
+	firmware: firmware {
+		scm {
+			compatible = "qcom,scm-sa8255p", "qcom,scm";
+			memory-region = <&tz_ffi_mem>;
+			qcom,dload-mode = <&tcsr 0x13000>;
+		};
+	};
+
+	/* Will be updated by the bootloader. */
+	memory@80000000 {
+		device_type = "memory";
+		reg = <0x0 0x80000000 0x0 0x0>;
+	};
+
+	pmu {
+		compatible = "arm,armv8-pmuv3";
+		interrupts = <GIC_PPI 7 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	psci {
+		compatible = "arm,psci-1.0";
+		method = "smc";
+		mode-bootloader = <0x10001 0x2>;
+		mode-edl = <0 0x1>;
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		sail_ss_mem: sail-ss@80000000 {
+			reg = <0x0 0x80000000 0x0 0x10000000>;
+			no-map;
+		};
+
+		hyp_mem: hyp@90000000 {
+			reg = <0x0 0x90000000 0x0 0x600000>;
+			no-map;
+		};
+
+		xbl_boot_mem: xbl-boot@90600000 {
+			reg = <0x0 0x90600000 0x0 0x200000>;
+			no-map;
+		};
+
+		aop_image_mem: aop-image@90800000 {
+			reg = <0x0 0x90800000 0x0 0x60000>;
+			no-map;
+		};
+
+		aop_cmd_db_mem: aop-cmd-db@90860000 {
+			compatible = "qcom,cmd-db";
+			reg = <0x0 0x90860000 0x0 0x20000>;
+			no-map;
+		};
+
+		uefi_log: uefi-log@908b0000 {
+			reg = <0x0 0x908b0000 0x0 0x10000>;
+			no-map;
+		};
+
+		ddr_training_checksum: ddr-training-checksum@908c0000 {
+			reg = <0x0 0x908c0000 0x0 0x1000>;
+			no-map;
+		};
+
+		reserved_mem: reserved@908f0000 {
+			reg = <0x0 0x908f0000 0x0 0xe000>;
+			no-map;
+		};
+
+		secdata_apss_mem: secdata-apss@908fe000 {
+			reg = <0x0 0x908fe000 0x0 0x2000>;
+			no-map;
+		};
+
+		smem_mem: smem@90900000 {
+			compatible = "qcom,smem";
+			reg = <0x0 0x90900000 0x0 0x200000>;
+			no-map;
+			hwlocks = <&tcsr_mutex 3>;
+		};
+
+		tz_sail_mailbox_mem: tz-sail-mailbox@90c00000 {
+			reg = <0x0 0x90c00000 0x0 0x100000>;
+			no-map;
+		};
+
+		sail_mailbox_mem: sail-ss@90d00000 {
+			reg = <0x0 0x90d00000 0x0 0x100000>;
+			no-map;
+		};
+
+		sail_ota_mem: sail-ss@90e00000 {
+			reg = <0x0 0x90e00000 0x0 0x300000>;
+			no-map;
+		};
+
+		aoss_backup_mem: aoss-backup@91b00000 {
+			reg = <0x0 0x91b00000 0x0 0x40000>;
+			no-map;
+		};
+
+		cpucp_backup_mem: cpucp-backup@91b40000 {
+			reg = <0x0 0x91b40000 0x0 0x40000>;
+			no-map;
+		};
+
+		tz_config_backup_mem: tz-config-backup@91b80000 {
+			reg = <0x0 0x91b80000 0x0 0x10000>;
+			no-map;
+		};
+
+		ddr_training_data_mem: ddr-training-data@91b90000 {
+			reg = <0x0 0x91b90000 0x0 0x10000>;
+			no-map;
+		};
+
+		cdt_data_backup_mem: cdt-data-backup@91ba0000 {
+			reg = <0x0 0x91ba0000 0x0 0x1000>;
+			no-map;
+		};
+
+		tz_ffi_mem: tz-ffi@91c00000 {
+			compatible = "shared-dma-pool";
+			reg = <0x0 0x91c00000 0x0 0x1400000>;
+			no-map;
+		};
+
+		lpass_machine_learning_mem: lpass-machine-learning@93b00000 {
+			reg = <0x0 0x93b00000 0x0 0xf00000>;
+			no-map;
+		};
+
+		adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap@94a00000 {
+			reg = <0x0 0x94a00000 0x0 0x800000>;
+			no-map;
+		};
+
+		pil_camera_mem: pil-camera@95200000 {
+			reg = <0x0 0x95200000 0x0 0x500000>;
+			no-map;
+		};
+
+		pil_adsp_mem: pil-adsp@95c00000 {
+			reg = <0x0 0x95c00000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		pil_gdsp0_mem: pil-gdsp0@97b00000 {
+			reg = <0x0 0x97b00000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		pil_gdsp1_mem: pil-gdsp1@99900000 {
+			reg = <0x0 0x99900000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		pil_cdsp0_mem: pil-cdsp0@9b800000 {
+			reg = <0x0 0x9b800000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		pil_gpu_mem: pil-gpu@9d600000 {
+			reg = <0x0 0x9d600000 0x0 0x2000>;
+			no-map;
+		};
+
+		pil_cdsp1_mem: pil-cdsp1@9d700000 {
+			reg = <0x0 0x9d700000 0x0 0x1e00000>;
+			no-map;
+		};
+
+		pil_cvp_mem: pil-cvp@9f500000 {
+			reg = <0x0 0x9f500000 0x0 0x700000>;
+			no-map;
+		};
+
+		pil_video_mem: pil-video@9fc00000 {
+			reg = <0x0 0x9fc00000 0x0 0x700000>;
+			no-map;
+		};
+
+		audio_mdf_mem: audio-mdf-region@ae000000 {
+			reg = <0x0 0xae000000 0x0 0x1000000>;
+			no-map;
+		};
+
+		firmware_mem: firmware-region@b0000000 {
+			reg = <0x0 0xb0000000 0x0 0x800000>;
+			no-map;
+		};
+
+		hyptz_reserved_mem: hyptz-reserved@beb00000 {
+			reg = <0x0 0xbeb00000 0x0 0x11500000>;
+			no-map;
+		};
+
+		scmi_mem: scmi-region@d0000000 {
+			reg = <0x0 0xd0000000 0x0 0x40000>;
+			no-map;
+		};
+
+		firmware_logs_mem: firmware-logs@d0040000 {
+			reg = <0x0 0xd0040000 0x0 0x10000>;
+			no-map;
+		};
+
+		firmware_audio_mem: firmware-audio@d0050000 {
+			reg = <0x0 0xd0050000 0x0 0x4000>;
+			no-map;
+		};
+
+		firmware_reserved_mem: firmware-reserved@d0054000 {
+			reg = <0x0 0xd0054000 0x0 0x9c000>;
+			no-map;
+		};
+
+		firmware_quantum_test_mem: firmware-quantum-test@d00f0000 {
+			reg = <0x0 0xd00f0000 0x0 0x10000>;
+			no-map;
+		};
+
+		tags_mem: tags@d0100000 {
+			reg = <0x0 0xd0100000 0x0 0x1200000>;
+			no-map;
+		};
+
+		qtee_mem: qtee@d1300000 {
+			reg = <0x0 0xd1300000 0x0 0x500000>;
+			no-map;
+		};
+
+		deepsleep_backup_mem: deepsleep-backup@d1800000 {
+			reg = <0x0 0xd1800000 0x0 0x100000>;
+			no-map;
+		};
+
+		trusted_apps_mem: trusted-apps@d1900000 {
+			reg = <0x0 0xd1900000 0x0 0x3800000>;
+			no-map;
+		};
+
+		tz_stat_mem: tz-stat@db100000 {
+			reg = <0x0 0xdb100000 0x0 0x100000>;
+			no-map;
+		};
+
+		cpucp_fw_mem: cpucp-fw@db200000 {
+			reg = <0x0 0xdb200000 0x0 0x100000>;
+			no-map;
+		};
+
+		cma: linux,cma {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xdfffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x2000000>;
+			linux,cma-default;
+		};
+	};
+
+	soc: soc@0 {
+		compatible = "simple-bus";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges = <0 0 0 0 0x10 0>;
+
+		dcc: dma@40ff000 {
+			compatible = "qcom,dcc-v3", "qcom,dcc";
+			reg = <0x0 0x040ff000 0x0 0x1000>,
+			      <0x0 0x040b8800 0x0 0x6000>;
+			qcom,dcc-offset = <0x38800>;
+		};
+
+		ipcc0: mailbox@408000 {
+			compatible = "qcom,sa8255p-ipcc", "qcom,ipcc";
+			reg = <0x0 0x00408000 0x0 0x1000>;
+			interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			#mbox-cells = <2>;
+		};
+
+		ipcc1: mailbox@488000 {
+			compatible = "qcom,sa8255p-ipcc", "qcom,ipcc";
+			reg = <0x0 0x488000 0x0 0x1000>;
+			interrupts = <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			#mbox-cells = <2>;
+			status = "disabled";
+		};
+
+		qupv3_id_2: geniqup@8c0000 {
+			compatible = "qcom,sa8255p-geni-se-qup";
+			reg = <0x0 0x008c0000 0x0 0x6000>;
+			ranges;
+			iommus = <&apps_smmu 0x5a3 0x0>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			i2c14: i2c@880000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x880000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 373 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi14: spi@880000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x880000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 373 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart14: serial@880000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00880000 0x0 0x4000>;
+				interrupts = <GIC_SPI 373 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c15: i2c@884000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x884000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 583 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi15: spi@884000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x884000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 583 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart15: serial@884000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00884000 0x0 0x4000>;
+				interrupts = <GIC_SPI 583 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c16: i2c@888000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x888000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 584 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi16: spi@888000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x00888000 0x0 0x4000>;
+				interrupts = <GIC_SPI 584 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				status = "disabled";
+			};
+
+			uart16: serial@888000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00888000 0x0 0x4000>;
+				interrupts = <GIC_SPI 584 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c17: i2c@88c000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x88c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 585 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi17: spi@88c000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x88c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 585 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart17: serial@88c000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x0088c000 0x0 0x4000>;
+				interrupts = <GIC_SPI 585 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c18: i2c@890000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x00890000 0x0 0x4000>;
+				interrupts = <GIC_SPI 586 IRQ_TYPE_LEVEL_HIGH>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				status = "disabled";
+			};
+
+			spi18: spi@890000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x890000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 586 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart18: serial@890000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00890000 0x0 0x4000>;
+				interrupts = <GIC_SPI 586 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c19: i2c@894000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x894000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 587 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi19: spi@894000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x894000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 587 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart19: serial@894000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00894000 0x0 0x4000>;
+				interrupts = <GIC_SPI 587 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c20: i2c@898000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x898000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 834 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi20: spi@898000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x898000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 834 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart20: serial@898000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00898000 0x0 0x4000>;
+				interrupts = <GIC_SPI 834 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+		};
+
+		qupv3_id_0: geniqup@9c0000 {
+			compatible = "qcom,sa8255p-geni-se-qup";
+			reg = <0x0 0x9c0000 0x0 0x6000>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+			iommus = <&apps_smmu 0x403 0x0>;
+			status = "disabled";
+
+			i2c0: i2c@980000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi0: spi@980000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart0: serial@980000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c1: i2c@984000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi1: spi@984000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart1: serial@984000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c2: i2c@988000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi2: spi@988000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart2: serial@988000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c3: i2c@98c000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi3: spi@98c000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart3: serial@98c000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c4: i2c@990000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi4: spi@990000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart4: serial@990000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c5: i2c@994000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0x994000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi5: spi@994000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0x994000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart5: serial@994000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x994000 0x0 0x4000>;
+				interrupts = <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+		};
+
+		qupv3_id_1: geniqup@ac0000 {
+			compatible = "qcom,sa8255p-geni-se-qup";
+			reg = <0x0 0x00ac0000 0x0 0x6000>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+			iommus = <&apps_smmu 0x443 0x0>;
+			status = "disabled";
+
+			i2c7: i2c@a80000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi7: spi@a80000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0xa80000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart7: serial@a80000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00a80000 0x0 0x4000>;
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c8: i2c@a84000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0xa84000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi8: spi@a84000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0xa84000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart8: serial@a84000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00a84000 0x0 0x4000>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c9: i2c@a88000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi9: spi@a88000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart9: serial@a88000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0xa88000 0x0 0x4000>;
+				interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c10: i2c@a8c000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0xa8c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi10: spi@a8c000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0xa8c000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart10: serial@a8c000 {
+				compatible = "qcom,sa8255p-geni-debug-uart";
+				reg = <0x0 0x00a8c000 0x0 0x4000>;
+				interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c11: i2c@a90000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0xa90000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi11: spi@a90000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0xa90000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart11: serial@a90000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00a90000 0x0 0x4000>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c12: i2c@a94000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0xa94000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi12: spi@a94000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0xa94000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart12: serial@a94000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00a94000 0x0 0x4000>;
+				interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			i2c13: i2c@a98000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0xa98000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 836 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+		};
+
+		qupv3_id_3: geniqup@bc0000 {
+			compatible = "qcom,sa8255p-geni-se-qup";
+			reg = <0x0 0xbc0000 0x0 0x6000>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+			iommus = <&apps_smmu 0x43 0x0>;
+			status = "disabled";
+
+			i2c21: i2c@b80000 {
+				compatible = "qcom,sa8255p-geni-i2c";
+				reg = <0x0 0xb80000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 831 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			spi21: spi@b80000 {
+				compatible = "qcom,sa8255p-geni-spi";
+				reg = <0x0 0xb80000 0x0 0x4000>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				interrupts = <GIC_SPI 831 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+
+			uart21: serial@b80000 {
+				compatible = "qcom,sa8255p-geni-uart";
+				reg = <0x0 0x00b80000 0x0 0x4000>;
+				interrupts = <GIC_SPI 831 IRQ_TYPE_LEVEL_HIGH>;
+				status = "disabled";
+			};
+		};
+
+		rng: rng@10d2000 {
+			compatible = "qcom,sa8255p-trng", "qcom,trng";
+			reg = <0x0 0x010d2000 0x0 0x1000>;
+		};
+
+		pcie0_ep: pcie-ep@1c00000 {
+			compatible = "qcom,sa8775p-pcie-ep";
+			reg = <0x0 0x01c00000 0x0 0x3000>,
+			      <0x0 0x40000000 0x0 0xf20>,
+			      <0x0 0x40000f20 0x0 0xa8>,
+			      <0x0 0x40001000 0x0 0x4000>,
+			      <0x0 0x40200000 0x0 0x100000>,
+			      <0x0 0x01c03000 0x0 0x1000>,
+			      <0x0 0x40005000 0x0 0x2000>,
+			      <0x0 0x01c05200 0x0 0x1e8>;
+			reg-names = "parf", "dbi", "elbi", "atu", "addr_space",
+				    "mmio", "dma", "phy_pcs";
+
+			interrupts = <GIC_SPI 306 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 630 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "global", "doorbell", "dma";
+
+			dma-coherent;
+			iommus = <&pcie_smmu 0x0000 0x7f>;
+			max-link-speed = <4>;
+			num-lanes = <2>;
+
+			status = "disabled";
+		};
+
+		pcie1_ep: pcie-ep@1c10000 {
+			compatible = "qcom,sa8775p-pcie-ep";
+			reg = <0x0 0x01c10000 0x0 0x3000>,
+			      <0x0 0x60000000 0x0 0xf20>,
+			      <0x0 0x60000f20 0x0 0xa8>,
+			      <0x0 0x60001000 0x0 0x4000>,
+			      <0x0 0x60200000 0x0 0x100000>,
+			      <0x0 0x01c13000 0x0 0x1000>,
+			      <0x0 0x60005000 0x0 0x2000>,
+			      <0x0 0x01c16200 0x0 0x1e8>;
+			reg-names = "parf", "dbi", "elbi", "atu", "addr_space",
+				    "mmio", "dma", "phy_pcs";
+
+			interrupts = <GIC_SPI 518 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 152 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 474 IRQ_TYPE_LEVEL_HIGH>;
+
+			interrupt-names = "global", "doorbell", "dma";
+
+			dma-coherent;
+			iommus = <&pcie_smmu 0x80 0x7f>;
+			max-link-speed = <4>;
+			num-lanes = <4>;
+
+			status = "disabled";
+		};
+
+		ufs_mem_hc: ufs@1d84000 {
+			compatible = "qcom,sa8255p-ufshc", "qcom,ufshc", "jedec,ufs-2.0";
+			reg = <0x0 0x01d84000 0x0 0x3000>;
+			interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>;
+			lanes-per-direction = <2>;
+			iommus = <&apps_smmu 0x100 0x0>;
+			dma-coherent;
+			qcom,ice = <&ice>;
+			status = "disabled";
+		};
+
+		ice: crypto@1d88000 {
+			compatible = "qcom,sa8255p-inline-crypto-engine",
+				     "qcom,inline-crypto-engine";
+			reg = <0x0 0x01d88000 0x0 0x10000>;
+			qcom,ice-use-hwkm;
+			qcom,ice-skip-clk;
+		};
+
+		usb_0_hsphy: phy@88e4000 {
+			compatible = "qcom,sa8255p-usb-hs-phy",
+				     "qcom,usb-snps-hs-5nm-phy";
+			reg = <0x0 0x088e4000 0x0 0x120>;
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_0_qmpphy: phy@88e8000 {
+			compatible = "qcom,sa8255p-qmp-usb3-uni-phy";
+			reg = <0x0 0x088e8000 0x0 0x2000>;
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_0: usb@a6f8800 {
+			compatible = "qcom,sa8255p-dwc3", "qcom,dwc3";
+			reg = <0x0 0x0a6f8800 0x0 0x400>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			interrupts-extended = <&intc GIC_SPI 287 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 12 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq",
+					  "ss_phy_irq";
+
+			wakeup-source;
+
+			status = "disabled";
+
+			usb_0_dwc3: usb@a600000 {
+				compatible = "snps,dwc3";
+				reg = <0x0 0x0a600000 0x0 0xe000>;
+				interrupts = <GIC_SPI 292 IRQ_TYPE_LEVEL_HIGH>;
+				iommus = <&apps_smmu 0x080 0x0>;
+				phys = <&usb_0_hsphy>, <&usb_0_qmpphy>;
+				phy-names = "usb2-phy", "usb3-phy";
+			};
+		};
+
+		usb_1_hsphy: phy@88e6000 {
+			compatible = "qcom,sa8255p-usb-hs-phy",
+				     "qcom,usb-snps-hs-5nm-phy";
+			reg = <0x0 0x088e6000 0x0 0x120>;
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_1_qmpphy: phy@88ea000 {
+			compatible = "qcom,sa8255p-qmp-usb3-uni-phy";
+			reg = <0x0 0x088ea000 0x0 0x2000>;
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_1: usb@a8f8800 {
+			compatible = "qcom,sa8255p-dwc3", "qcom,dwc3";
+			reg = <0x0 0x0a8f8800 0x0 0x400>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			interrupts-extended = <&intc GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 8 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 7 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 13 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq",
+					  "ss_phy_irq";
+
+			wakeup-source;
+
+			status = "disabled";
+
+			usb_1_dwc3: usb@a800000 {
+				compatible = "snps,dwc3";
+				reg = <0x0 0x0a800000 0x0 0xe000>;
+				interrupts = <GIC_SPI 349 IRQ_TYPE_LEVEL_HIGH>;
+				iommus = <&apps_smmu 0x0a0 0x0>;
+				phys = <&usb_1_hsphy>, <&usb_1_qmpphy>;
+				phy-names = "usb2-phy", "usb3-phy";
+			};
+		};
+
+		usb_2_hsphy: phy@88e7000 {
+			compatible = "qcom,sa8255p-usb-hs-phy",
+				     "qcom,usb-snps-hs-5nm-phy";
+			reg = <0x0 0x088e7000 0x0 0x120>;
+			#phy-cells = <0>;
+
+			status = "disabled";
+		};
+
+		usb_2: usb@a4f8800 {
+			compatible = "qcom,sa8255p-dwc3", "qcom,dwc3";
+			reg = <0x0 0x0a4f8800 0x0 0x400>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			interrupts-extended = <&intc GIC_SPI 444 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "pwr_event",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq";
+
+			wakeup-source;
+
+			status = "disabled";
+
+			usb_2_dwc3: usb@a400000 {
+				compatible = "snps,dwc3";
+				reg = <0x0 0x0a400000 0x0 0xe000>;
+				interrupts = <GIC_SPI 442 IRQ_TYPE_LEVEL_HIGH>;
+				iommus = <&apps_smmu 0x020 0x0>;
+				phys = <&usb_2_hsphy>;
+				phy-names = "usb2-phy";
+			};
+		};
+
+		tcsr_mutex: hwlock@1f40000 {
+			compatible = "qcom,tcsr-mutex";
+			reg = <0x0 0x01f40000 0x0 0x20000>;
+			#hwlock-cells = <1>;
+		};
+
+		tcsr: syscon@1fc0000 {
+			compatible = "qcom,sa8255p-tcsr", "syscon";
+			reg = <0x0 0x1fc0000 0x0 0x30000>;
+		};
+
+		adreno_smmu: iommu@3da0000 {
+			compatible = "qcom,sa8255p-smmu-500", "qcom,adreno-smmu",
+				     "qcom,smmu-500", "arm,mmu-500";
+			reg = <0x0 0x03da0000 0x0 0x20000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <2>;
+			dma-coherent;
+			interrupts = <GIC_SPI 673 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 674 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 678 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 679 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 680 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 681 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 682 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 683 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 684 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 685 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 686 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 687 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		pdc: interrupt-controller@b220000 {
+			compatible = "qcom,sa8255p-pdc", "qcom,pdc";
+			reg = <0x0 0x0b220000 0x0 0x30000>,
+			      <0x0 0x17c000f0 0x0 0x64>;
+			qcom,pdc-ranges = <0 480 40>,
+					  <40 140 14>,
+					  <54 263 1>,
+					  <55 306 4>,
+					  <59 312 3>,
+					  <62 374 2>,
+					  <64 434 2>,
+					  <66 438 2>,
+					  <70 520 1>,
+					  <73 523 1>,
+					  <118 568 6>,
+					  <124 609 3>,
+					  <159 638 1>,
+					  <160 720 3>,
+					  <169 728 30>,
+					  <199 416 2>,
+					  <201 449 1>,
+					  <202 89 1>,
+					  <203 451 1>,
+					  <204 462 1>,
+					  <205 264 1>,
+					  <206 579 1>,
+					  <207 653 1>,
+					  <208 656 1>,
+					  <209 659 1>,
+					  <210 122 1>,
+					  <211 699 1>,
+					  <212 705 1>,
+					  <213 450 1>,
+					  <214 643 2>,
+					  <216 646 5>,
+					  <221 390 5>,
+					  <226 700 2>,
+					  <228 440 1>,
+					  <229 663 1>,
+					  <230 524 2>,
+					  <232 612 3>,
+					  <235 723 5>;
+			#interrupt-cells = <2>;
+			interrupt-parent = <&intc>;
+			interrupt-controller;
+		};
+
+		tsens2: thermal-sensor@c251000 {
+			compatible = "qcom,sa8255p-tsens", "qcom,tsens-v2";
+			reg = <0x0 0x0c251000 0x0 0x1ff>,
+			      <0x0 0x0c224000 0x0 0x8>;
+			interrupts = <GIC_SPI 572 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 609 IRQ_TYPE_LEVEL_HIGH>;
+			#qcom,sensors = <13>;
+			interrupt-names = "uplow", "critical";
+			#thermal-sensor-cells = <1>;
+		};
+
+		tsens3: thermal-sensor@c252000 {
+			compatible = "qcom,sa8255p-tsens", "qcom,tsens-v2";
+			reg = <0x0 0x0c252000 0x0 0x1ff>,
+			      <0x0 0x0c225000 0x0 0x8>;
+			interrupts = <GIC_SPI 573 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 610 IRQ_TYPE_LEVEL_HIGH>;
+			#qcom,sensors = <13>;
+			interrupt-names = "uplow", "critical";
+			#thermal-sensor-cells = <1>;
+		};
+
+		tsens0: thermal-sensor@c263000 {
+			compatible = "qcom,sa8255p-tsens", "qcom,tsens-v2";
+			reg = <0x0 0x0c263000 0x0 0x1ff>,
+			      <0x0 0x0c222000 0x0 0x8>;
+			interrupts = <GIC_SPI 506 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 508 IRQ_TYPE_LEVEL_HIGH>;
+			#qcom,sensors = <12>;
+			interrupt-names = "uplow", "critical";
+			#thermal-sensor-cells = <1>;
+		};
+
+		tsens1: thermal-sensor@c265000 {
+			compatible = "qcom,sa8255p-tsens", "qcom,tsens-v2";
+			reg = <0x0 0x0c265000 0x0 0x1ff>,
+			      <0x0 0x0c223000 0x0 0x8>;
+			interrupts = <GIC_SPI 507 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 509 IRQ_TYPE_LEVEL_HIGH>;
+			#qcom,sensors = <12>;
+			interrupt-names = "uplow", "critical";
+			#thermal-sensor-cells = <1>;
+		};
+
+		aoss_qmp: power-management@c300000 {
+			compatible = "qcom,sa8255p-aoss-qmp", "qcom,aoss-qmp";
+			reg = <0x0 0x0c300000 0x0 0x400>;
+			interrupts-extended = <&ipcc0 IPCC_CLIENT_AOP
+					       IPCC_MPROC_SIGNAL_GLINK_QMP
+					       IRQ_TYPE_EDGE_RISING>;
+			mboxes = <&ipcc0 IPCC_CLIENT_AOP IPCC_MPROC_SIGNAL_GLINK_QMP>;
+			#clock-cells = <0>;
+		};
+
+		sram@c3f0000 {
+			compatible = "qcom,rpmh-stats";
+			reg = <0x0 0x0c3f0000 0x0 0x400>;
+		};
+
+		tlmm: pinctrl@f000000 {
+			compatible = "qcom,sa8255p-tlmm";
+			reg = <0x0 0x0f000000 0x0 0x1000000>;
+			interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+			gpio-ranges = <&tlmm 0 0 149>;
+			wakeup-parent = <&pdc>;
+		};
+
+		apps_smmu: iommu@15000000 {
+			compatible = "qcom,sa8255p-smmu-500", "qcom,smmu-500", "arm,mmu-500";
+			reg = <0x0 0x15000000 0x0 0x100000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <2>;
+
+			interrupts = <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 109 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 183 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 185 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 315 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 316 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 336 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 337 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 338 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 340 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 342 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 343 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 344 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 345 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 396 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 397 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 398 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 399 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 401 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 402 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 403 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 404 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 409 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 418 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 419 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 412 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 421 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 706 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 423 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 424 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 425 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 689 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 690 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 691 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 692 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 693 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 694 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 695 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 696 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 410 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 411 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 420 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 413 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 422 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 707 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 708 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 709 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 710 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 711 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 414 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 712 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 713 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 714 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 715 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 912 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 911 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 910 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 909 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 908 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 907 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 906 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 905 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 904 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 903 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 902 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 901 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 900 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 899 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 898 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 897 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 896 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 895 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 894 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 893 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 892 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 891 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		pcie_smmu: iommu@15200000 {
+			compatible = "qcom,sa8255p-smmu-500", "qcom,smmu-500", "arm,mmu-500";
+			reg = <0x0 0x15200000 0x0 0x80000>;
+			#iommu-cells = <2>;
+			#global-interrupts = <2>;
+			dma-coherent;
+
+			interrupts = <GIC_SPI 920 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 921 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 925 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 926 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 927 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 928 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 950 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 951 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 952 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 953 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 954 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 955 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 956 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 957 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 958 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 885 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 886 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 887 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 888 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 820 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 822 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 823 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 310 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 446 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 447 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 452 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 840 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 841 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 842 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 843 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 844 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 845 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 846 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 847 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 848 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 849 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 802 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 803 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 804 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 805 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 806 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 807 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 808 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 809 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 810 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 811 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 812 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 813 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 814 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 836 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 837 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 838 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 839 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 854 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 855 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 856 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 790 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 791 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 792 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 793 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 794 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 795 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 796 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 639 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 79 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 640 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		intc: interrupt-controller@17a00000 {
+			compatible = "arm,gic-v3";
+			reg = <0x0 0x17a00000 0x0 0x10000>,	/* GICD */
+			      <0x0 0x17a60000 0x0 0x100000>;	/* GICR * 8 */
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+			#redistributor-regions = <1>;
+			redistributor-stride = <0x0 0x20000>;
+		};
+
+		watchdog@17c10000 {
+			compatible = "qcom,apss-wdt-sa8255p", "qcom,kpss-wdt";
+			reg = <0x0 0x17c10000 0x0 0x1000>;
+			clocks = <&sleep_clk>;
+			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+		};
+
+		memtimer: timer@17c20000 {
+			compatible = "arm,armv7-timer-mem";
+			reg = <0x0 0x17c20000 0x0 0x1000>;
+			ranges = <0x0 0x0 0x0 0x20000000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			frame@17c21000 {
+				reg = <0x17c21000 0x1000>,
+				      <0x17c22000 0x1000>;
+				interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
+					     <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <0>;
+			};
+
+			frame@17c23000 {
+				reg = <0x17c23000 0x1000>;
+				interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <1>;
+				status = "disabled";
+			};
+
+			frame@17c25000 {
+				reg = <0x17c25000 0x1000>;
+				interrupts = <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <2>;
+				status = "disabled";
+			};
+
+			frame@17c27000 {
+				reg = <0x17c27000 0x1000>;
+				interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <3>;
+				status = "disabled";
+			};
+
+			frame@17c29000 {
+				reg = <0x17c29000 0x1000>;
+				interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <4>;
+				status = "disabled";
+			};
+
+			frame@17c2b000 {
+				reg = <0x17c2b000 0x1000>;
+				interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <5>;
+				status = "disabled";
+			};
+
+			frame@17c2d000 {
+				reg = <0x17c2d000 0x1000>;
+				interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+				frame-number = <6>;
+				status = "disabled";
+			};
+		};
+
+		cpufreq_hw: cpufreq@18591000 {
+			compatible = "qcom,sa8255p-cpufreq-epss",
+				     "qcom,cpufreq-epss";
+			reg = <0x0 0x18591000 0x0 0x1000>,
+			      <0x0 0x18593000 0x0 0x1000>;
+			reg-names = "freq-domain0", "freq-domain1";
+			interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "dcvsh-irq-0", "dcvsh-irq-1";
+
+			clocks = <&bi_tcxo_div2>, <&gpll0_board_clk>;
+			clock-names = "xo", "alternate";
+
+			#freq-domain-cells = <1>;
+		};
+
+		ethernet1: ethernet@23000000 {
+			compatible = "qcom,sa8255p-ethqos";
+			reg = <0x0 0x23000000 0x0 0x10000>,
+			      <0x0 0x23016000 0x0 0x100>;
+			reg-names = "stmmaceth", "rgmii";
+
+			interrupts = <GIC_SPI 929 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 781 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "macirq", "sfty";
+
+			iommus = <&apps_smmu 0x140 0xf>;
+			dma-coherent;
+
+			snps,tso;
+			snps,pbl = <32>;
+			rx-fifo-depth = <16384>;
+			tx-fifo-depth = <16384>;
+
+			status = "disabled";
+		};
+
+		ethernet0: ethernet@23040000 {
+			compatible = "qcom,sa8255p-ethqos";
+			reg = <0x0 0x23040000 0x0 0x10000>,
+			      <0x0 0x23056000 0x0 0x100>;
+			reg-names = "stmmaceth", "rgmii";
+
+			interrupts = <GIC_SPI 946 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 782 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "macirq", "sfty";
+
+			iommus = <&apps_smmu 0x120 0xf>;
+			dma-coherent;
+
+			snps,tso;
+			snps,pbl = <32>;
+			rx-fifo-depth = <16384>;
+			tx-fifo-depth = <16384>;
+
+			status = "disabled";
+		};
+
+		pcie0: pci@400000000 {
+			compatible = "qcom,pcie-ecam-rc";
+			reg = <0x4 0x00000000 0x0 0x10000000>;
+
+			device_type = "pci";
+
+			#address-cells = <3>;
+			#size-cells = <2>;
+
+			ranges = <0x01000000 0x0 0x40000000 0x0 0x40000000 0x0 0x100000>,
+				 <0x02000000 0x0 0x40100000 0x0 0x40100000 0x0 0x1ff00000>,
+				 <0x43000000 0x4 0x10100000 0x4 0x10100000 0x0 0x100000>;
+			bus-range = <0x00 0xff>;
+
+			dma-coherent;
+
+			linux,pci-domain = <0>;
+
+			interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 308 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 309 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 312 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 313 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 314 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 374 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 375 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-parent = <&intc>;
+
+			iommus = <&pcie_smmu 0x00 0x7f>;
+			iommu-map = <0x0 &pcie_smmu 0x0000 0x1>,
+				    <0x100 &pcie_smmu 0x0001 0x1>,
+				    <0x200 &pcie_smmu 0x0002 0x1>,
+				    <0x300 &pcie_smmu 0x0003 0x1>;
+
+			status = "disabled";
+		};
+
+		pcie1: pci@600000000 {
+			compatible = "qcom,pcie-ecam-rc";
+			reg = <0x6 0x00000000 0x0 0x10000000>;
+
+			device_type = "pci";
+
+			#address-cells = <3>;
+			#size-cells = <2>;
+
+			ranges = <0x01000000 0x0 0x60000000 0x0 0x60000000 0x0 0x100000>,
+				 <0x02000000 0x0 0x60100000 0x0 0x60100000 0x0 0x1ff00000>,
+				 <0x43000000 0x6 0x10100000 0x6 0x10100000 0x0 0x100000>;
+			bus-range = <0x00 0xff>;
+
+			dma-coherent;
+
+			linux,pci-domain = <1>;
+
+			interrupts = <GIC_SPI 519 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 144 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 145 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 146 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-parent = <&intc>;
+
+			iommus = <&pcie_smmu 0x80 0x7f>;
+			iommu-map = <0x0 &pcie_smmu 0x0080 0x1>,
+				    <0x100 &pcie_smmu 0x0081 0x1>,
+				    <0x200 &pcie_smmu 0x0082 0x1>,
+				    <0x208 &pcie_smmu 0x0083 0x1>,
+				    <0x210 &pcie_smmu 0x0084 0x1>,
+				    <0x300 &pcie_smmu 0x0085 0x1>,
+				    <0xab00 &pcie_smmu 0x0086 0x1>;
+
+			status = "disabled";
+		};
+	};
+
+	thermal-zones {
+		aoss-0-thermal {
+			thermal-sensors = <&tsens0 0>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-0-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 1>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-1-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 2>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-2-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 3>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-3-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 4>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		gpuss-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 5>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		gpuss-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 6>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		gpuss-2-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens0 7>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		audio-thermal {
+			thermal-sensors = <&tsens0 8>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		camss-0-thermal {
+			thermal-sensors = <&tsens0 9>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pcie-0-thermal {
+			thermal-sensors = <&tsens0 10>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpuss-0-0-thermal {
+			thermal-sensors = <&tsens0 11>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		aoss-1-thermal {
+			thermal-sensors = <&tsens1 0>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-0-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 1>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-1-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 2>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-2-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 3>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-0-3-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 4>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		gpuss-3-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 5>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		gpuss-4-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 6>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		gpuss-5-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens1 7>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		video-thermal {
+			thermal-sensors = <&tsens1 8>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		camss-1-thermal {
+			thermal-sensors = <&tsens1 9>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pcie-1-thermal {
+			thermal-sensors = <&tsens1 10>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpuss-0-1-thermal {
+			thermal-sensors = <&tsens1 11>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		aoss-2-thermal {
+			thermal-sensors = <&tsens2 0>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-0-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 1>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-1-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 2>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-2-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 3>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-3-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 4>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-0-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 5>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-1-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 6>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-2-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 7>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-1-0-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 8>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-1-1-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 9>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-1-2-0-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens2 10>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		ddrss-0-thermal {
+			thermal-sensors = <&tsens2 11>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpuss-1-0-thermal {
+			thermal-sensors = <&tsens2 12>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		aoss-3-thermal {
+			thermal-sensors = <&tsens3 0>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-0-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 1>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-1-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 2>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-2-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 3>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpu-1-3-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 4>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-0-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 5>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-1-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 6>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-0-2-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 7>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-1-0-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 8>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-1-1-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 9>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		nsp-1-2-1-thermal {
+			polling-delay-passive = <10>;
+
+			thermal-sensors = <&tsens3 10>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		ddrss-1-thermal {
+			thermal-sensors = <&tsens3 11>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+
+		cpuss-1-1-thermal {
+			thermal-sensors = <&tsens3 12>;
+
+			trips {
+				trip-point0 {
+					temperature = <105000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+
+				trip-point1 {
+					temperature = <115000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+	};
+
+	arch_timer: timer {
+		compatible = "arm,armv8-timer";
+		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8540p.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8540p.dtsi
@@ -168,6 +168,9 @@
 };
 
 &gpucc {
+	/* SA8295P and SA8540P doesn't provide gfx.lvl */
+	/delete-property/ power-domains;
+
 	status = "disabled";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-addons-ride-r3.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-addons-ride-r3.dts
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "sa8775p-ride-r3.dts"
+#include "sa8775p-addons-ride.dtsi"
+
+/ {
+	model = "Qualcomm SA8775P Ride Rev3";
+	compatible = "qcom,sa8775p-addons-ride-r3", "qcom,sa8775p";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-addons-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-addons-ride.dts
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "sa8775p-ride.dts"
+#include "sa8775p-addons-ride.dtsi"
+
+/ {
+	model = "Qualcomm SA8775P Ride";
+	compatible = "qcom,sa8775p-addons-ride", "qcom,sa8775p";
+};
+
+
+&remoteproc_adsp {
+	firmware-name = "qcom/sa8775p/adsp.mdt";
+	status = "okay";
+};
+
+&remoteproc_cdsp0 {
+	firmware-name = "qcom/sa8775p/cdsp0.mdt";
+	status = "okay";
+};
+
+&remoteproc_cdsp1 {
+	firmware-name = "qcom/sa8775p/cdsp1.mdt";
+	status = "okay";
+};
+
+&remoteproc_gpdsp0 {
+	firmware-name = "qcom/sa8775p/gpdsp0.mdt";
+	status = "okay";
+};
+
+&remoteproc_gpdsp1 {
+	firmware-name = "qcom/sa8775p/gpdsp1.mdt";
+	status = "okay";
+};
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-addons-ride.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-addons-ride.dtsi
@@ -0,0 +1,501 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "sa8775p-addons.dtsi"
+
+/ {
+	sound {
+		compatible = "qcom,qcs9100-sndcard";
+		model = "qcs9100-ridesx-snd-card";
+
+		clocks = <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+			    <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>;
+		clock-names = "macro", "dcodec";
+
+		pinctrl-names = "default", "stub_aif0_active", "stub_aif0_sleep",
+				"stub_aif1_active", "stub_aif1_sleep", "stub_aif2_active",
+				"stub_aif2_sleep", "stub_aif3_active", "stub_aif3_sleep";
+		pinctrl-0 = <&mi2s1_data0_sleep>, <&mi2s1_data1_sleep>, <&mi2s1_sck_sleep>,
+			    <&mi2s1_ws_sleep>, <&lpass_i2s1_clk_sleep>, <&lpass_i2s1_data_sleep>,
+			    <&lpass_i2s1_ws_sleep>, <&hs2_mi2s_data0_sleep>, <&mi2s_mclk_sleep>,
+			    <&hs2_mi2s_sck_sleep>, <&hs2_mi2s_data1_sleep>,<&hs2_mi2s_ws_sleep>;
+		pinctrl-1 = <&lpass_i2s1_clk>, <&lpass_i2s1_data>, <&lpass_i2s1_ws>;
+		pinctrl-2 = <&lpass_i2s1_clk_sleep>, <&lpass_i2s1_data_sleep>,
+			    <&lpass_i2s1_ws_sleep>;
+		pinctrl-3 = <&mi2s1_data0>, <&mi2s1_data1>, <&mi2s1_sck>, <&mi2s1_ws>;
+		pinctrl-4 = <&mi2s1_data0_sleep>, <&mi2s1_data1_sleep>, <&mi2s1_sck_sleep>,
+			    <&mi2s1_ws_sleep>;
+		pinctrl-5 = <&hs2_mi2s_data0>, <&hs2_mi2s_data1>, <&hs2_mi2s_sck>, <&mi2s_mclk>,
+			    <&hs2_mi2s_ws>;
+		pinctrl-6 = <&hs2_mi2s_data0_sleep>, <&hs2_mi2s_data1_sleep>, <&hs2_mi2s_sck_sleep>,
+			    <&mi2s_mclk_sleep>,<&hs2_mi2s_ws_sleep>;
+		pinctrl-7 = <&mi2s1_data0>, <&mi2s1_data1>, <&mi2s1_sck>, <&mi2s_mclk>,
+			    <&mi2s1_ws>;
+		pinctrl-8 = <&mi2s1_data0_sleep>, <&mi2s1_data1_sleep>, <&mi2s1_sck_sleep>,
+			    <&mi2s1_ws_sleep>, <&mi2s_mclk_sleep>;
+
+		mi2s1-capture-dai-link {
+			link-name = "MI2S-LPAIF-TX-SECONDARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai SECONDARY_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 3>;
+			};
+		};
+
+		mi2s1-playback-dai-link {
+			link-name = "MI2S-LPAIF-RX-SECONDARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai SECONDARY_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 2>;
+			};
+		};
+
+		lpi-mi2s1-capture-dai-link {
+			link-name = "MI2S-LPAIF_VA-TX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 1>;
+			};
+		};
+
+		lpi-mi2s1-playback-dai-link {
+			link-name = "MI2S-LPAIF_VA-RX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 0>;
+			};
+		};
+
+		tdm1-capture-dai-link {
+			link-name = "TDM-LPAIF-TX-SECONDARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai SECONDARY_TDM_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 3>;
+			};
+		};
+
+		tdm1-playback-dai-link {
+			link-name = "TDM-LPAIF-RX-SECONDARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai SECONDARY_TDM_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 2>;
+			};
+		};
+
+		lpi-tdm1-capture-dai-link {
+			link-name = "TDM-LPAIF_VA-TX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_TDM_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 1>;
+			};
+		};
+
+		lpi-tdm1-playback-dai-link {
+			link-name = "TDM-LPAIF_VA-RX-PRIMARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai PRIMARY_TDM_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 0>;
+			};
+		};
+
+		hs2-mi2s-capture-dai-link {
+			link-name = "MI2S-LPAIF_SDR-TX-TERTIARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai TERTIARY_SDR_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 5>;
+			};
+		};
+
+		hs2-mi2s-playback-dai-link {
+			link-name = "MI2S-LPAIF_SDR-RX-TERTIARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai TERTIARY_SDR_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 4>;
+			};
+		};
+
+		tdm2-capture-dai-link {
+			link-name = "TDM-LPAIF_SDR-TX-TERTIARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai TERTIARY_SDR_TDM_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 5>;
+			};
+		};
+
+		tdm2-playback-dai-link {
+			link-name = "TDM-LPAIF_SDR-RX-TERTIARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai TERTIARY_SDR_TDM_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 4>;
+			};
+		};
+
+		hs3-mi2s-capture-dai-link {
+			link-name = "MI2S-LPAIF_SDR-TX-QUATERNARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai QUATERNARY_SDR_MI2S_TX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 7>;
+			};
+		};
+
+		hs3-mi2s-playback-dai-link {
+			link-name = "MI2S-LPAIF_SDR-RX-QUATERNARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai QUATERNARY_SDR_MI2S_RX>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 6>;
+			};
+		};
+
+		tdm3-capture-dai-link {
+			link-name = "TDM-LPAIF_SDR-TX-QUATERNARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai QUATERNARY_SDR_TDM_TX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 7>;
+			};
+		};
+
+		tdm3-playback-dai-link {
+			link-name = "TDM-LPAIF_SDR-RX-QUATERNARY";
+
+			cpu {
+				sound-dai = <&q6apmbedai QUATERNARY_SDR_TDM_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&msm_stub_codec 6>;
+			};
+		};
+
+		dp0-dai-link {
+
+			link-name = "DISPLAY_PORT-RX";
+
+			cpu {
+				sound-dai = <&q6apmbedai DISPLAY_PORT_RX_0>;
+			};
+
+			codec {
+				sound-dai = <&mdss0_dp0>;
+			};
+		};
+	};
+};
+
+&lpass_tlmm {
+	lpass_i2s1_clk: i2s1-clk-state {
+			pins = "gpio6";
+			function = "i2s1_clk";
+			drive-strength = <8>;
+			bias-disable;
+			output-high;
+	};
+
+	lpass_i2s1_clk_sleep: i2s1-clk-sleep-state {
+			pins = "gpio6";
+			function = "i2s1_clk";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+
+	lpass_i2s1_data: i2s1-data-state {
+			pins = "gpio8", "gpio9";
+			function = "i2s1_data";
+			drive-strength = <8>;
+			bias-disable;
+	};
+
+	lpass_i2s1_data_sleep: i2s1-data-sleep-state {
+			pins = "gpio8", "gpio9";
+			function = "i2s1_data";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+
+	lpass_i2s1_ws: i2s1-ws-state {
+			pins = "gpio7";
+			function = "i2s1_ws";
+			drive-strength = <8>;
+			output-high;
+	};
+
+	lpass_i2s1_ws_sleep: i2s1-ws-sleep-state {
+			pins = "gpio7";
+			function = "i2s1_ws";
+			drive-strength = <2>;
+			bias-pull-down;
+			input-enable;
+	};
+};
+
+&soc {
+	msm_stub_codec: msm-stub-codec {
+		compatible = "qcom,msm-stub-codec";
+		#sound-dai-cells = <1>;
+	};
+
+	spf_core_platform: spf-core-platform {
+		compatible = "qcom,spf-core-platform";
+
+		msm_audio_mem: msm-audio-mem {
+			compatible = "qcom,msm-audio-mem";
+			qcom,smmu-version = <2>;
+			qcom,smmu-enabled;
+			iommus = <&apps_smmu 0x3001 0x0>;
+			qcom,iommu-dma-addr-pool = <0x10000000 0x10000000>;
+			qcom,smmu-sid-mask = /bits/ 64 <0xf>;
+			dma-coherent;
+		};
+
+		msm_audio_mem_cma: msm-audio-mem-cma {
+			compatible = "qcom,msm-audio-mem";
+			memory-region = <&audio_cma_mem>;
+		};
+	};
+};
+
+&tlmm {
+	hs0_mi2s: hs0-mi2s-state {
+		pins = "gpio114", "gpio115", "gpio116", "gpio117";
+		function = "hs0_mi2s";
+	};
+
+	hs1_mi2s: hs1-mi2s-state {
+		pins = "gpio118", "gpio119", "gpio120", "gpio121";
+		function = "hs1_mi2s";
+	};
+
+	hs2_mi2s_data0: hs2-mi2s-data0-state {
+		pins = "gpio124";
+		function = "hs2_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	hs2_mi2s_data0_sleep: hs2-mi2s-data0-sleep-state {
+		pins = "gpio124";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs2_mi2s_data1: hs2-mi2s-data1-state {
+		pins = "gpio125";
+		function = "hs2_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs2_mi2s_data1_sleep: hs2-mi2s-data1-sleep-state {
+		pins = "gpio125";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs2_mi2s_sck: hs2-mi2s-sck-state {
+		pins = "gpio122";
+		function = "hs2_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs2_mi2s_sck_sleep: hs2-mi2s-sck-sleep-state {
+		pins = "gpio122";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s_mclk: mi2s-mclk-state {
+		pins = "gpio105";
+		function = "mi2s_mclk0";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	mi2s_mclk_sleep: mi2s-mclk-sleep-state {
+		pins = "gpio105";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	hs2_mi2s_ws: hs2-mi2s-ws-state {
+		pins = "gpio123";
+		function = "hs2_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	hs2_mi2s_ws_sleep: hs2-mi2s-ws-sleep-state {
+		pins = "gpio123";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s1_data0: mi2s1-data0-state {
+		pins = "gpio108";
+		function = "mi2s1_data0";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	mi2s1_data0_sleep: mi2s1-data0-sleep-state {
+		pins = "gpio108";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s1_data1: mi2s1-data1-state {
+		pins = "gpio109";
+		function = "mi2s1_data1";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	mi2s1_data1_sleep: mi2s1-data1-sleep-state {
+		pins = "gpio109";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s1_sck: mi2s1-sck-state {
+		pins = "gpio106";
+		function = "mi2s1_sck";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	mi2s1_sck_sleep: mi2s1-sck-sleep-state {
+		pins = "gpio106";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s1_ws: mi2s1-ws-state {
+		pins = "gpio107";
+		function = "mi2s1_ws";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	mi2s1_ws_sleep: mi2s1-ws-sleep-state {
+		pins = "gpio107";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+		input-enable;
+	};
+
+	mi2s2_data0: mi2s2-data0-state {
+		pins = "gpio112";
+		function = "mi2s2_data0";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	mi2s2_data1: mi2s2-data1-state {
+		pins = "gpio113";
+		function = "mi2s2_data1";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	mi2s2_sck: mi2s2-sck-state {
+		pins = "gpio110";
+		function = "mi2s2_sck";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+
+	mi2s2_ws: mi2s2-ws-state {
+		pins = "gpio111";
+		function = "mi2s2_ws";
+		drive-strength = <8>;
+		bias-disable;
+		output-high;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-addons.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-addons.dtsi
@@ -0,0 +1,821 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "sa8775p-dma-heaps.dtsi"
+#include <dt-bindings/thermal/thermal.h>
+
+/ {
+	reserved-memory {
+		audio_cma_mem: qcom,audio-ml {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1000000>;
+		};
+
+		dump_mem: mem-dump-region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			size = <0x0 0x3000000>;
+		};
+
+		qseecom_mem: qcom,qseecom {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1400000>; /* 20M */
+		};
+
+		qseecom_ta_mem: qcom,qseecom-ta {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1000000>; /* 16M */
+		};
+	};
+
+	firmware {
+		qtee_shmbridge {
+			compatible = "qcom,tee-shared-memory-bridge";
+		};
+
+		qcom_smcinvoke {
+			compatible = "qcom,smcinvoke";
+		};
+	};
+
+	mem-dump {
+		compatible = "qcom,mem-dump";
+		memory-region = <&dump_mem>;
+
+		c0-context {
+			qcom,dump-id = <0x0>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c0-scandump {
+			qcom,dump-id = <0x130>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c100-context {
+			qcom,dump-id = <0x1>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c100-scandump {
+			qcom,dump-id = <0x131>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c200-context {
+			qcom,dump-id = <0x2>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c200-scandump {
+			qcom,dump-id = <0x132>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c300-context {
+			qcom,dump-id = <0x3>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c300-scandump {
+			qcom,dump-id = <0x133>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c400-context {
+			qcom,dump-id = <0x4>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c500-context {
+			qcom,dump-id = <0x5>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c600-context {
+			qcom,dump-id = <0x6>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c700-context {
+			qcom,dump-id = <0x7>;
+			qcom,dump-size = <0x800>;
+		};
+
+		c10000-scandump {
+			qcom,dump-id = <0x134>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c10100-scandump {
+			qcom,dump-id = <0x135>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c10200-scandump {
+			qcom,dump-id = <0x136>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		c10300-scandump {
+			qcom,dump-id = <0x137>;
+			qcom,dump-size = <0x40000>;
+		};
+
+		cpuss-reg {
+			qcom,dump-id = <0xef>;
+			qcom,dump-size = <0x20000>;
+		};
+
+		etf-swao {
+			qcom,dump-id = <0xf1>;
+			qcom,dump-size = <0x10000>;
+		};
+
+		etfswao-reg {
+			qcom,dump-id = <0x102>;
+			qcom,dump-size = <0x1000>;
+		};
+
+		etr-reg {
+			qcom,dump-id = <0x100>;
+			qcom,dump-size = <0x1000>;
+		};
+
+		fcm {
+			qcom,dump-id = <0xee>;
+			qcom,dump-size = <0x8400>;
+		};
+
+		l1-dcache0 {
+			qcom,dump-id = <0x80>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache100 {
+			qcom,dump-id = <0x81>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache200 {
+			qcom,dump-id = <0x82>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache300 {
+			qcom,dump-id = <0x83>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache10000 {
+			qcom,dump-id = <0x84>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache10100 {
+			qcom,dump-id = <0x85>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache10200 {
+			qcom,dump-id = <0x86>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dcache10300 {
+			qcom,dump-id = <0x87>;
+			qcom,dump-size = <0x12100>;
+		};
+
+		l1-dtlb10000 {
+			qcom,dump-id = <0x44>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-dtlb10100 {
+			qcom,dump-id = <0x45>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-dtlb10200 {
+			qcom,dump-id = <0x46>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-dtlb10300 {
+			qcom,dump-id = <0x47>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-icache0 {
+			qcom,dump-id = <0x60>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache100 {
+			qcom,dump-id = <0x61>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache200 {
+			qcom,dump-id = <0x62>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache300 {
+			qcom,dump-id = <0x63>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache10000 {
+			qcom,dump-id = <0x64>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache10100 {
+			qcom,dump-id = <0x65>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache10200 {
+			qcom,dump-id = <0x66>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-icache10300 {
+			qcom,dump-id = <0x67>;
+			qcom,dump-size = <0x26100>;
+		};
+
+		l1-itlb10000 {
+			qcom,dump-id = <0x24>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-itlb10100 {
+			qcom,dump-id = <0x25>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-itlb10200 {
+			qcom,dump-id = <0x26>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l1-itlb10300 {
+			qcom,dump-id = <0x27>;
+			qcom,dump-size = <0x300>;
+		};
+
+		l2-cache10000 {
+			qcom,dump-id = <0xc4>;
+			qcom,dump-size = <0x90100>;
+		};
+
+		l2-cache10100 {
+			qcom,dump-id = <0xc5>;
+			qcom,dump-size = <0x90100>;
+		};
+
+		l2-cache10200 {
+			qcom,dump-id = <0xc6>;
+			qcom,dump-size = <0x90100>;
+		};
+
+		l2-cache10300 {
+			qcom,dump-id = <0xc7>;
+			qcom,dump-size = <0x90100>;
+		};
+
+		l2-tlb0 {
+			qcom,dump-id = <0x120>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb100 {
+			qcom,dump-id = <0x121>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb200 {
+			qcom,dump-id = <0x122>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb300 {
+			qcom,dump-id = <0x123>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb10000 {
+			qcom,dump-id = <0x124>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb10100 {
+			qcom,dump-id = <0x125>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb10200 {
+			qcom,dump-id = <0x126>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		l2-tlb10300 {
+			qcom,dump-id = <0x127>;
+			qcom,dump-size = <0x6100>;
+		};
+
+		misc-data {
+			qcom,dump-id = <0xe8>;
+			qcom,dump-size = <0x1000>;
+		};
+
+		pmic {
+			qcom,dump-id = <0xe4>;
+			qcom,dump-size = <0x80000>;
+		};
+
+		rpm-sw {
+			qcom,dump-id = <0xea>;
+			qcom,dump-size = <0x28000>;
+		};
+
+		rpmh {
+			qcom,dump-id = <0xec>;
+			qcom,dump-size = <0x2000000>;
+		};
+	};
+};
+
+&remoteproc_cdsp0 {
+	cooling {
+		compatible = "qcom,qmi-cooling-cdsp";
+
+		cdsp_sw0: cdsp_sw {
+			label = "cdsp_sw";
+			#cooling-cells = <2>;
+		};
+	};
+};
+
+&remoteproc_cdsp1 {
+	cooling {
+		compatible = "qcom,qmi-cooling-cdsp1";
+
+		cdsp_sw1: cdsp_sw {
+			label = "cdsp_sw";
+			#cooling-cells = <2>;
+		};
+	};
+};
+
+&soc {
+	qcom,mem-buf {
+		compatible = "qcom,mem-buf";
+		qcom,mem-buf-capabilities = "supplier";
+		qcom,vmid = <3>;
+	};
+
+	qcom,mem-buf-msgq {
+		compatible = "qcom,mem-buf-msgq";
+	};
+
+	qcom,secure-buffer {
+		compatible = "qcom,secure-buffer";
+		qcom,vmid-cp-camera-preview-ro;
+	};
+
+	qcom_tzlog: tz-log@146d8720 {
+		compatible = "qcom,tz-log";
+		reg = <0x0 0x146d8720 0x0 0x3000>;
+		qcom,hyplog-enabled;
+		hyplog-address-offset = <0x410>;
+		hyplog-size-offset = <0x414>;
+	};
+
+	lpass_tlmm: pinctrl@3440000 {
+		compatible = "qcom,qcs9100-lpass-lpi-pinctrl";
+		reg = <0x0 0x03440000 0x0 0x20000>,
+		      <0x0 0x034D0000 0x0 0x10000>;
+
+		clocks = <&q6prmcc LPASS_HW_MACRO_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+			 <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>;
+		clock-names = "core", "audio";
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&lpass_tlmm 0 0 23>;
+	};
+
+	csr: csr@4001000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x0 0x4001000 0x0 0x1000>;
+		reg-names = "csr-base";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		qcom,hwctrl-set-support;
+		qcom,set-byte-cntr-support;
+		qcom,blk-size = <1>;
+	};
+
+	msm_gpu: qcom,kgsl-3d0@3d00000 {
+		#cooling-cells = <2>;
+	};
+
+	tmc_etr: tmc@4048000 {
+		interrupts = <GIC_SPI 270 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "byte-cntr-irq";
+		qcom,sw-usb;
+		coresight-csr = <&csr>;
+		csr-atid-offset = <0xf8>;
+		csr-irqctrl-offset = <0x6c>;
+		byte-cntr-name = "byte-cntr";
+		byte-cntr-class-name = "coresight-tmc-etr-stream";
+	};
+
+	tmc_etr1: tmc@404f000 {
+		interrupts = <GIC_SPI 262 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "byte-cntr-irq";
+		coresight-csr = <&csr>;
+		csr-atid-offset = <0x108>;
+		csr-irqctrl-offset = <0x70>;
+		byte-cntr-name = "byte-cntr1";
+		byte-cntr-class-name = "coresight-tmc-etr1-stream";
+	};
+
+	dma@40ff000 {
+		compatible = "qcom,dcc-v3", "qcom,dcc";
+		reg = <0x0 0x040ff000 0x0 0x1000>,
+		      <0x0 0x040b8800 0x0 0x6000>;
+
+		qcom,dcc-offset = <0x38800>;
+	};
+
+	tgu@4b0e000 {
+		compatible = "arm,primecell", "qcom,coresight-tgu";
+		reg = <0x0 0x4b0e000 0x0 0x1000>;
+		reg-names = "tgu-base";
+		device-name = "tgu_ipcb";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		arm,primecell-periphid = <0x0003b999>;
+		tgu-conditions = <4>;
+		tgu-regs = <4>;
+		tgu-steps = <3>;
+		tgu-timer-counters = <8>;
+	};
+
+	tgu@4b0f000 {
+		compatible = "arm,primecell", "qcom,coresight-tgu";
+		reg = <0x0 0x4b0f000 0x0 0x1000>;
+		reg-names = "tgu-base";
+		device-name = "tgu_spmi0";
+
+		clocks = <&aoss_qmp>;
+		clock-names = "apb_pclk";
+
+		arm,primecell-periphid = <0x0003b999>;
+		tgu-conditions = <4>;
+		tgu-regs = <8>;
+		tgu-steps = <3>;
+		tgu-timer-counters = <8>;
+	};
+};
+
+&sram {
+	mem_dump_table@10 {
+		compatible = "qcom,msm-imem-mem-dump-table";
+		reg = <0x10 0x8>;
+	};
+
+	kaslr_offset@6d0 {
+		compatible = "qcom,msm-imem-kaslr_offset";
+		reg = <0x6d0 0xc>;
+	};
+};
+
+&thermal_zones {
+	gpuss-0-thermal {
+		trips {
+			gpuss_0_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&gpuss_0_passive>;
+				cooling-device = <&msm_gpu THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	gpuss-1-thermal {
+		trips {
+			gpuss_1_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&gpuss_1_passive>;
+				cooling-device = <&msm_gpu THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	gpuss-2-thermal {
+		trips {
+			gpuss_2_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&gpuss_2_passive>;
+				cooling-device = <&msm_gpu THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	gpuss-3-thermal {
+		trips {
+			gpuss_3_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&gpuss_3_passive>;
+				cooling-device = <&msm_gpu THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	gpuss-4-thermal {
+		trips {
+			gpuss_4_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&gpuss_4_passive>;
+				cooling-device = <&msm_gpu THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	gpuss-5-thermal {
+		trips {
+			gpuss_5_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&gpuss_5_passive>;
+				cooling-device = <&msm_gpu THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-0-0-0-thermal {
+		trips {
+			nsp_0_0_0_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_0_0_0_passive>;
+				cooling-device = <&cdsp_sw0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-0-1-0-thermal {
+		trips {
+			nsp_0_1_0_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_0_1_0_passive>;
+				cooling-device = <&cdsp_sw0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-0-2-0-thermal {
+		trips {
+			nsp_0_2_0_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_0_2_0_passive>;
+				cooling-device = <&cdsp_sw0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-1-0-0-thermal {
+		trips {
+			nsp_1_0_0_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_1_0_0_passive>;
+				cooling-device = <&cdsp_sw1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-1-1-0-thermal {
+		trips {
+			nsp_1_1_0_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_1_1_0_passive>;
+				cooling-device = <&cdsp_sw1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-1-2-0-thermal {
+		trips {
+			nsp_1_2_0_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_1_2_0_passive>;
+				cooling-device = <&cdsp_sw1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-0-0-1-thermal {
+		trips {
+			nsp_0_0_1_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_0_0_1_passive>;
+				cooling-device = <&cdsp_sw0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-0-1-1-thermal {
+		trips {
+			nsp_0_1_1_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_0_1_1_passive>;
+				cooling-device = <&cdsp_sw0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-0-2-1-thermal {
+		trips {
+			nsp_0_2_1_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_0_2_1_passive>;
+				cooling-device = <&cdsp_sw0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-1-0-1-thermal {
+		trips {
+			nsp_1_0_1_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_1_0_1_passive>;
+				cooling-device = <&cdsp_sw1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-1-1-1-thermal {
+		trips {
+			nsp_1_1_1_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_1_1_1_passive>;
+				cooling-device = <&cdsp_sw1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+
+	nsp-1-2-1-thermal {
+		trips {
+			nsp_1_2_1_passive: trip-point1 {
+				temperature = <105000>;
+				hysteresis = <5000>;
+				type = "passive";
+			};
+		};
+
+		cooling-maps {
+			map0 {
+				trip = <&nsp_1_2_1_passive>;
+				cooling-device = <&cdsp_sw1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-camera.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-camera.dtsi
@@ -0,0 +1,2827 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <dt-bindings/msm-camera.h>
+
+&tlmm {
+	cci_i2c_sda0_active: cci_i2c_sda0_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio60";
+			function = "cci_i2c_sda0";
+		};
+
+		config {
+			pins = "gpio60";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda0_suspend: cci_i2c_sda0_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio60";
+			function = "cci_i2c_sda0";
+		};
+
+		config {
+			pins = "gpio60";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl0_active: cci_i2c_scl0_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio61";
+			function = "cci_i2c_scl0";
+		};
+
+		config {
+			pins = "gpio61";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl0_suspend: cci_i2c_scl0_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio61";
+			function = "cci_i2c_scl0";
+		};
+
+		config {
+			pins = "gpio61";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda1_active: cci_i2c_sda1_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio52";
+			function = "cci_i2c_sda1";
+		};
+
+		config {
+			pins = "gpio52";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda1_suspend: cci_i2c_sda1_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio52";
+			function = "cci_i2c_sda1";
+		};
+
+		config {
+			pins = "gpio52";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl1_active: cci_i2c_scl1_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio53";
+			function = "cci_i2c_scl1";
+		};
+
+		config {
+			pins = "gpio53";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl1_suspend: cci_i2c_scl1_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio53";
+			function = "cci_i2c_scl1";
+		};
+
+		config {
+			pins = "gpio53";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda2_active: cci_i2c_sda2_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio62";
+			function = "cci_i2c_sda2";
+		};
+
+		config {
+			pins = "gpio62";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda2_suspend: cci_i2c_sda2_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio62";
+			function = "cci_i2c_sda2";
+		};
+
+		config {
+			pins = "gpio62";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl2_active: cci_i2c_scl2_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio63";
+			function = "cci_i2c_scl2";
+		};
+
+		config {
+			pins = "gpio63";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl2_suspend: cci_i2c_scl2_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio63";
+			function = "cci_i2c_scl2";
+		};
+
+		config {
+			pins = "gpio63";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda3_active: cci_i2c_sda3_active {
+		mux {
+			pins = "gpio54";
+			function = "cci_i2c_sda3";
+		};
+
+		config {
+			pins = "gpio54";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda3_suspend: cci_i2c_sda3_suspend {
+		mux {
+			pins = "gpio54";
+			function = "cci_i2c_sda3";
+		};
+
+		config {
+			pins = "gpio54";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl3_active: cci_i2c_scl3_active {
+		mux {
+			pins = "gpio55";
+			function = "cci_i2c_scl3";
+		};
+
+		config {
+			pins = "gpio55";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl3_suspend: cci_i2c_scl3_suspend {
+		mux {
+			pins = "gpio55";
+			function = "cci_i2c_scl3";
+		};
+
+		config {
+			pins = "gpio55";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda4_active: cci_i2c_sda4_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio64";
+			function = "cci_i2c_sda4";
+		};
+
+		config {
+			pins = "gpio64";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda4_suspend: cci_i2c_sda4_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio64";
+			function = "cci_i2c_sda4";
+		};
+
+		config {
+			pins = "gpio64";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl4_active: cci_i2c_scl4_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio65";
+			function = "cci_i2c_scl4";
+		};
+
+		config {
+			pins = "gpio65";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl4_suspend: cci_i2c_scl4_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio65";
+			function = "cci_i2c_scl4";
+		};
+
+		config {
+			pins = "gpio65";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda5_active: cci_i2c_sda5_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio56";
+			function = "cci_i2c_sda5";
+		};
+
+		config {
+			pins = "gpio56";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda5_suspend: cci_i2c_sda5_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio56";
+			function = "cci_i2c_sda5";
+		};
+
+		config {
+			pins = "gpio56";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl5_active: cci_i2c_scl5_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio57";
+			function = "cci_i2c_scl5";
+		};
+
+		config {
+			pins = "gpio57";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl5_suspend: cci_i2c_scl5_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio57";
+			function = "cci_i2c_scl5";
+		};
+
+		config {
+			pins = "gpio57";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda6_active: cci_i2c_sda6_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio66";
+			function = "cci_i2c_sda6";
+		};
+
+		config {
+			pins = "gpio66";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda6_suspend: cci_i2c_sda6_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio66";
+			function = "cci_i2c_sda6";
+		};
+
+		config {
+			pins = "gpio66";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl6_active: cci_i2c_scl6_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio67";
+			function = "cci_i2c_scl6";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl6_suspend: cci_i2c_scl6_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio67";
+			function = "cci_i2c_scl6";
+		};
+
+		config {
+			pins = "gpio67";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_sda7_active: cci_i2c_sda7_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio58";
+			function = "cci_i2c_sda7";
+		};
+
+		config {
+			pins = "gpio58";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_sda7_suspend: cci_i2c_sda7_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio58";
+			function = "cci_i2c_sda7";
+		};
+
+		config {
+			pins = "gpio58";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cci_i2c_scl7_active: cci_i2c_scl7_active {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio59";
+			function = "cci_i2c_scl7";
+		};
+
+		config {
+			pins = "gpio59";
+			bias-pull-up; /* PULL UP*/
+			drive-strength = <2>; /* 2 MA */
+			qcom,i2c_pull;
+		};
+	};
+
+	cci_i2c_scl7_suspend: cci_i2c_scl7_suspend {
+		mux {
+			/* CLK, DATA */
+			pins = "gpio59";
+			function = "cci_i2c_scl7";
+		};
+
+		config {
+			pins = "gpio59";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+		/* MCLK0 */
+		mux {
+			pins = "gpio72";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio72";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk0_suspend: cam_sensor_mclk0_suspend {
+		/* MCLK0 */
+		mux {
+			pins = "gpio72";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio72";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_active: cam_sensor_mclk1_active {
+		/* MCLK1 */
+		mux {
+			pins = "gpio73";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio73";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk1_suspend: cam_sensor_mclk1_suspend {
+		/* MCLK1 */
+		mux {
+			pins = "gpio73";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio73";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+		/* MCLK2 */
+		mux {
+			pins = "gpio74";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio74";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_suspend: cam_sensor_mclk2_suspend {
+		/* MCLK2 */
+		mux {
+			pins = "gpio74";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio74";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk3_active: cam_sensor_mclk3_active {
+		/* MCLK3 */
+		mux {
+			pins = "gpio75";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio75";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk3_suspend: cam_sensor_mclk3_suspend {
+		/* MCLK3 */
+		mux {
+			pins = "gpio75";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio75";
+			bias-pull-down; /* PULL DOWN */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+};
+
+&soc {
+	qcom,cam-req-mgr {
+		compatible = "qcom,cam-req-mgr";
+		status = "ok";
+	};
+
+	qcom,cam-sync {
+		compatible = "qcom,cam-sync";
+		status = "ok";
+	};
+
+	qcom,cam-i3c-id-table {
+		i3c-sensor-id-table = <0x1B0 0x0766>;
+		i3c-eeprom-id-table = <>;
+		i3c-actuator-id-table = <>;
+		i3c-ois-id-table = <>;
+		status = "disabled";
+	};
+
+	cam_csiphy_tpg17: qcom,tpg17@acac000 {
+		cell-index = <17>;
+		phy-id = <0>;
+		compatible = "qcom,cam-tpg1031";
+		reg-names = "tpg0", "cam_cpas_top";
+		reg = <0x0 0xacac000 0x0 0x400>,
+			<0x0 0xac11000 0x0 0x1000>;
+		reg-cam-base = <0xac000 0x11000>;
+		operating-points-v2 = <&csiphy_tpg0_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		interrupt-names = "tpg0";
+		interrupts = <GIC_SPI 545 IRQ_TYPE_EDGE_RISING>;
+		shared-clks = <1 0>;
+		clock-names =
+			"cphy_rx_clk_src",
+			"csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cphy_rx_clk_src";
+		status = "ok";
+		csiphy_tpg0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy_tpg18: qcom,tpg18@acad000 {
+		cell-index = <18>;
+		phy-id = <1>;
+		compatible = "qcom,cam-tpg1031";
+		reg-names = "tpg1", "cam_cpas_top";
+		reg = <0x0 0xacad000 0x0 0x400>,
+			<0x0 0xac11000 0x0 0x1000>;
+		reg-cam-base = <0xad000 0x11000>;
+		operating-points-v2 = <&csiphy_tpg1_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		interrupt-names = "tpg1";
+		interrupts = <GIC_SPI 546 IRQ_TYPE_EDGE_RISING>;
+		shared-clks = <1 0>;
+		clock-names =
+			"cphy_rx_clk_src",
+			"csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cphy_rx_clk_src";
+		status = "ok";
+		csiphy_tpg1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy_tpg19: qcom,tpg19@acae000 {
+		cell-index = <19>;
+		phy-id = <2>;
+		compatible = "qcom,cam-tpg1031";
+		reg-names = "tpg2", "cam_cpas_top";
+		reg = <0x0 0xacae000 0x0 0x400>,
+			<0x0 0xac11000 0x0 0x1000>;
+		reg-cam-base = <0xae000 0x11000>;
+		operating-points-v2 = <&csiphy_tpg2_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		interrupt-names = "tpg2";
+		interrupts = <GIC_SPI 547 IRQ_TYPE_EDGE_RISING>;
+		shared-clks = <1 0>;
+		clock-names =
+			"cphy_rx_clk_src",
+			"csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cphy_rx_clk_src";
+		status = "ok";
+		csiphy_tpg2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy0: qcom,csiphy0@ac9c000 {
+		cell-index = <0>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0x0ac9c000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy0_opp_table>;
+		reg-cam-base = <0x9c000>;
+		interrupt-names = "CSIPHY0";
+		interrupts = <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l1c>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1140000 831000>;
+		rgltr-max-voltage = <1260000 920000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy0_clk",
+			"csi0phytimer_clk_src",
+			"csi0phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY0_CLK>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI0PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy1: qcom,csiphy1@ac9e000 {
+		cell-index = <1>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0xac9e000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy1_opp_table>;
+		reg-cam-base = <0x9e000>;
+		interrupt-names = "CSIPHY1";
+		interrupts = <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l1c>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1140000 831000>;
+		rgltr-max-voltage = <1260000 920000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy1_clk",
+			"csi1phytimer_clk_src",
+			"csi1phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY1_CLK>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI1PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy2: qcom,csiphy2@aca0000 {
+		cell-index = <2>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0xaca0000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy2_opp_table>;
+		reg-cam-base = <0xa0000>;
+		interrupt-names = "CSIPHY2";
+		interrupts = <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l1c>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1140000 831000>;
+		rgltr-max-voltage = <1260000 920000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy2_clk",
+			"csi2phytimer_clk_src",
+			"csi2phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY2_CLK>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI2PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_csiphy3: qcom,csiphy3@aca2000 {
+		cell-index = <3>;
+		aggregator-rx;
+		compatible = "qcom,csiphy-v1.3.0", "qcom,csiphy";
+		reg = <0x0 0xaca2000 0x0 0x2000>;
+		reg-names = "csiphy";
+		operating-points-v2 = <&csiphy3_opp_table>;
+		reg-cam-base = <0xa2000>;
+		interrupt-names = "CSIPHY3";
+		interrupts = <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>;
+		csi-vdd-1p2-supply = <&vreg_l1c>;
+		csi-vdd-0p9-supply = <&vreg_l4a>;
+		regulator-names = "csi-vdd-1p2", "csi-vdd-0p9";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <1140000 831000>;
+		rgltr-max-voltage = <1260000 920000>;
+		rgltr-load-current = <8900 15900>;
+		shared-clks = <1 0 0 0>;
+		clock-names = "cphy_rx_clk_src",
+			"csiphy3_clk",
+			"csi3phytimer_clk_src",
+			"csi3phytimer_clk";
+		clocks = <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&camcc CAM_CC_CSIPHY3_CLK>,
+			<&camcc CAM_CC_CSI3PHYTIMER_CLK_SRC>,
+			<&camcc CAM_CC_CSI3PHYTIMER_CLK>;
+		src-clock-name = "cphy_rx_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates =
+			<400000000 0 400000000 0>;
+		status = "ok";
+		csiphy3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	cam_cci0: qcom,cci0@ac13000 {
+		cell-index = <0>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac13000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x13000>;
+		interrupt-names = "CCI0";
+		interrupts = <GIC_SPI 460 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci0_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_0_clk_src",
+			"cci_0_clk";
+		clocks = <&camcc CAM_CC_CCI_0_CLK_SRC>,
+			<&camcc CAM_CC_CCI_0_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_0_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl0_active &cci_i2c_sda0_active>;
+		pinctrl-1 = <&cci_i2c_scl0_suspend &cci_i2c_sda0_suspend>;
+		pinctrl-2 = <&cci_i2c_scl1_active &cci_i2c_sda1_active>;
+		pinctrl-3 = <&cci_i2c_scl1_suspend &cci_i2c_sda1_suspend>;
+		status = "ok";
+		cci0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci0: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci0: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci0: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci0: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci1: qcom,cci1@ac14000 {
+		cell-index = <1>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac14000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x14000>;
+		interrupt-names = "CCI1";
+		interrupts = <GIC_SPI 271 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci1_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_1_clk_src",
+			"cci_1_clk";
+		clocks = <&camcc CAM_CC_CCI_1_CLK_SRC>,
+			<&camcc CAM_CC_CCI_1_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_1_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl2_active &cci_i2c_sda2_active>;
+		pinctrl-1 = <&cci_i2c_scl2_suspend &cci_i2c_sda2_suspend>;
+		pinctrl-2 = <&cci_i2c_scl3_active &cci_i2c_sda3_active>;
+		pinctrl-3 = <&cci_i2c_scl3_suspend &cci_i2c_sda3_suspend>;
+		status = "ok";
+		cci1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci1: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci1: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci1: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci1: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci2: qcom,cci2@ac15000 {
+		cell-index = <2>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac15000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x15000>;
+		interrupt-names = "CCI2";
+		interrupts = <GIC_SPI 651 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci2_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_2_clk_src",
+			"cci_2_clk";
+		clocks = <&camcc CAM_CC_CCI_2_CLK_SRC>,
+			<&camcc CAM_CC_CCI_2_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_2_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl4_active &cci_i2c_sda4_active>;
+		pinctrl-1 = <&cci_i2c_scl4_suspend &cci_i2c_sda4_suspend>;
+		pinctrl-2 = <&cci_i2c_scl5_active &cci_i2c_sda5_active>;
+		pinctrl-3 = <&cci_i2c_scl5_suspend &cci_i2c_sda5_suspend>;
+		status = "ok";
+		cci2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci2: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci2: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci2: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci2: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	cam_cci3: qcom,cci3@ac16000 {
+		cell-index = <3>;
+		compatible = "qcom,cci", "simple-bus";
+		reg = <0x0 0xac16000 0x0 0x1000>;
+		reg-names = "cci";
+		reg-cam-base = <0x16000>;
+		interrupt-names = "CCI3";
+		interrupts = <GIC_SPI 771 IRQ_TYPE_EDGE_RISING>;
+		operating-points-v2 = <&cci3_opp_table>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cci_3_clk_src",
+			"cci_3_clk";
+		clocks = <&camcc CAM_CC_CCI_3_CLK_SRC>,
+			<&camcc CAM_CC_CCI_3_CLK>;
+		clock-rates = <37500000 0>;
+		clock-cntl-level = "lowsvs";
+		src-clock-name = "cci_3_clk_src";
+		pctrl-idx-mapping = <CCI_MASTER_0 CCI_MASTER_1>;
+		pctrl-map-names = "m0", "m1";
+		pinctrl-names = "m0_active", "m0_suspend",
+			"m1_active", "m1_suspend";
+		pinctrl-0 = <&cci_i2c_scl6_active &cci_i2c_sda6_active>;
+		pinctrl-1 = <&cci_i2c_scl6_suspend &cci_i2c_sda6_suspend>;
+		pinctrl-2 = <&cci_i2c_scl7_active &cci_i2c_sda7_active>;
+		pinctrl-3 = <&cci_i2c_scl7_suspend &cci_i2c_sda7_suspend>;
+		status = "ok";
+		cci3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+			opp-37500000 {
+				opp-hz = /bits/ 64 <37500000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+
+		i2c_freq_100Khz_cci3: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz_cci3: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom_cci3: qcom,i2c_custom_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz_cci3: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu", "simple-bus";
+		status = "ok";
+		force_cache_allocs;
+
+		msm_cam_smmu_ife {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x3400 0x0020>,
+				<&apps_smmu 0x3420 0x0020>;
+			cam-smmu-label = "ife", "sfe";
+			multiple-client-devices;
+			dma-coherent;
+			ife_iova_mem_map: iova-mem-map {
+				/* IO region is approximately 64 GB */
+				iova-mem-region-io {
+					iova-region-name = "io";
+					/* start address: 0x100000 */
+					/* leaving 1 MB pad at start  */
+					iova-region-start = <0x100000>;
+					/* Length: 0xfffe00000 */
+					/* leaving 1 MB pad at end */
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_icp {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus =
+				<&apps_smmu 0x0800 0x400>,
+				<&apps_smmu 0x0840 0x480>,
+				<&apps_smmu 0x08C0 0x480>,
+				<&apps_smmu 0x0C00 0x400>,
+				<&apps_smmu 0x0C40 0x480>,
+				<&apps_smmu 0x0CC0 0x480>;
+			cam-smmu-label = "icp";
+			qcom,iommu-faults = "stall-disable", "non-fatal";
+			dma-coherent;
+			icp_iova_mem_map: iova-mem-map {
+				iova-mem-region-shared {
+					/* Shared region is ~250MB long */
+					iova-region-name = "shared";
+					iova-region-start = <0x800000>;
+					iova-region-len = <0xfc00000>;
+					iova-region-id = <0x1>;
+					status = "ok";
+				};
+
+				iova-mem-region-fwuncached-region {
+					/* FW uncached region is 7MB long */
+					iova-region-name = "fw_uncached";
+					iova-region-start = <0x10400000>;
+					iova-region-len = <0x700000>;
+					iova-region-id = <0x6>;
+					subregion_support;
+					status = "ok";
+					/* Used for HFI queues/sec heap */
+					iova-mem-region-generic-region {
+						iova-region-name = "icp_hfi";
+						iova-region-start = <0x10400000>;
+						iova-region-len = <0x200000>;
+						iova-region-id = <0x0>;
+					};
+				};
+
+				iova-mem-region-io {
+					/* IO region is approximately 3.8 GB */
+					iova-region-name = "io";
+					iova-region-start = <0x10c00000>;
+					iova-region-len = <0xee300000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+
+				iova-mem-qdss-region {
+					/* QDSS region is appropriate 1MB */
+					iova-region-name = "qdss";
+					iova-region-start = <0x10b00000>;
+					iova-region-len = <0x100000>;
+					iova-region-id = <0x5>;
+					qdss-phy-addr = <0x16790000>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_cdm {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x0860 0x400>,
+				<&apps_smmu 0x0C60 0x400>;
+			cam-smmu-label = "rt-cdm";
+			dma-coherent;
+			multiple-client-devices;
+			rt_cdm_iova_mem_map: iova-mem-map {
+				iova-mem-region-io {
+					/* IO region is approximately 4.0 GB */
+					iova-region-name = "io";
+					/* 1 MB pad for start */
+					iova-region-start = <0x100000>;
+					/* 1 MB pad for end */
+					iova-region-len = <0xffe00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_secure {
+			compatible = "qcom,msm-cam-smmu-cb";
+			cam-smmu-label = "cam-secure";
+			qcom,secure-cb;
+		};
+	};
+
+	qcom,cam-cdm-intf {
+		compatible = "qcom,cam-cdm-intf";
+		cell-index = <0>;
+		label = "cam-cdm-intf";
+		num-hw-cdm = <1>;
+		cdm-client-names = "vfe";
+		status = "ok";
+	};
+
+	qcom,rt-cdm0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac26000 0x0 0x1000>;
+		reg-names = "rt-cdm0";
+		reg-cam-base = <0x26000>;
+		interrupts = <GIC_SPI 543 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm0";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_fast_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_fast_ahb_clk_src";
+		clock-rates = <300000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table0>;
+		clock-cntl-level = "svs";
+		cdm-client-names = "ife0", "dualife0";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table0: opp-table {
+			compatible = "operating-points-v2";
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,rt-cdm1 {
+		cell-index = <1>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac27000 0x0 0x1000>;
+		reg-names = "rt-cdm1";
+		reg-cam-base = <0x27000>;
+		interrupts = <GIC_SPI 544 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm1";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_fast_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_fast_ahb_clk_src";
+		clock-rates = <300000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table1>;
+		clock-cntl-level = "svs_l1";
+		cdm-client-names = "ife1", "dualife1";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table1: opp-table {
+			compatible = "operating-points-v2";
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,rt-cdm2 {
+		cell-index = <2>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac28000 0x0 0x1000>;
+		reg-names = "rt-cdm2";
+		reg-cam-base = <0x28000>;
+		interrupts = <GIC_SPI 567 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm2";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_slow_ahb_clk_src";
+		clock-rates = <80000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table2>;
+		clock-cntl-level = "svs_l1";
+		cdm-client-names = "ife2", "ife3", "ife4", "ife5", "ife6";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table2: opp-table {
+			compatible = "operating-points-v2";
+			opp-80000000 {
+				opp-hz = /bits/ 64 <80000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,rt-cdm3 {
+		cell-index = <3>;
+		compatible = "qcom,cam-rt-cdm2_1";
+		label = "rt-cdm";
+		reg = <0x0 0xac29000 0x0 0x1000>;
+		reg-names = "rt-cdm3";
+		reg-cam-base = <0x29000>;
+		interrupts = <GIC_SPI 566 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "rt-cdm3";
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names = "cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk";
+		clocks = <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>;
+		src-clock-name = "cam_cc_slow_ahb_clk_src";
+		clock-rates = <80000000 0>;
+		operating-points-v2 = <&cdm_cpas_opp_table3>;
+		clock-cntl-level = "svs";
+		cdm-client-names = "ife2", "ife3", "ife4", "ife5", "ife6";
+		single-context-cdm;
+		status = "ok";
+		cdm_cpas_opp_table3: opp-table {
+			compatible = "operating-points-v2";
+			opp-80000000 {
+				opp-hz = /bits/ 64 <80000000>;
+				required-opps = <&rpmhpd_opp_low_svs>;
+			};
+		};
+	};
+
+	qcom,cam-isp {
+		compatible = "qcom,cam-isp";
+		arch-compat = "ife";
+		status = "ok";
+	};
+
+	cam_csid0: qcom,csid0 {
+		cell-index = <0>;
+		compatible = "qcom,csid690";
+		reg-names = "csid0", "csid_top";
+		reg = <0x0 0xac7a000 0x0 0xf01>,
+			<0x0 0xac78000 0x0 0x1000>;
+		reg-cam-base = <0x7a000 0x78000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "csid0";
+		interrupts = <GIC_SPI 565 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_csid_clk_src",
+			"cam_cc_csid_clk",
+			"cam_cc_csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CSID_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CLK>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0 0>;
+		clock-cntl-level = "svs_l1";
+		src-clock-name = "cam_cc_csid_clk_src";
+		operating-points-v2 = <&csid0_opp_table>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+		};
+	};
+
+	cam_vfe0: qcom,ife0 {
+		cell-index = <0>;
+		compatible = "qcom,vfe690";
+		reg-names = "ife0", "cam_camnoc";
+		reg = <0x0 0xac4d000 0x0 0xd000>,
+			<0x0 0xac1a000 0x0 0x9400>;
+		reg-cam-base = <0x4d000 0x1a000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "ife0";
+		interrupts = <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_0_clk",
+			"cam_cc_ife_0_clk",
+			"cam_cc_ife_0_clk_src",
+			"cam_cc_ife_0_fast_ahb_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_CLK>,
+			<&camcc CAM_CC_IFE_0_CLK_SRC>,
+			<&camcc CAM_CC_IFE_0_FAST_AHB_CLK>;
+		clock-rates =
+			<0 0 480000000 0>,
+			<0 0 600000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_0_clk_src";
+		operating-points-v2 = <&vfe0_opp_table>;
+		clock-control-debugfs = "true";
+		ubwc-static-cfg = <0x1026 0x1036>;
+		cam_hw_pid = <8 16>;
+		status = "ok";
+		vfe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid1: qcom,csid1 {
+		cell-index = <1>;
+		compatible = "qcom,csid690";
+		reg-names = "csid1", "csid_top";
+		reg = <0x0 0xac7c000 0x0 0xf01>,
+			<0x0 0xac78000 0x0 0x1000>;
+		reg-cam-base = <0x7c000 0x78000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "csid0";
+		interrupts = <GIC_SPI 564 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_csid_clk_src",
+			"cam_cc_csid_clk",
+			"cam_cc_csid_csiphy_rx_clk";
+		clocks =
+			<&camcc CAM_CC_CSID_CLK_SRC>,
+			<&camcc CAM_CC_CSID_CLK>,
+			<&camcc CAM_CC_CSID_CSIPHY_RX_CLK>;
+		clock-rates =
+			<400000000 0 0>;
+		clock-cntl-level = "svs_l1";
+		src-clock-name = "cam_cc_csid_clk_src";
+		operating-points-v2 = <&csid1_opp_table>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+		};
+	};
+
+	cam_vfe1: qcom,ife1 {
+		cell-index = <1>;
+		compatible = "qcom,vfe690";
+		reg-names = "ife1", "cam_camnoc";
+		reg = <0x0 0xac5a000 0x0 0xd000>,
+			<0x0 0xac1a000 0x0 0x9400>;
+		reg-cam-base = <0x5a000 0x1a000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "ife1";
+		interrupts = <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_1_clk",
+			"cam_cc_ife_1_clk",
+			"cam_cc_ife_1_clk_src",
+			"cam_cc_ife_1_fast_ahb_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_CLK>,
+			<&camcc CAM_CC_IFE_1_CLK_SRC>,
+			<&camcc CAM_CC_IFE_1_FAST_AHB_CLK>;
+		clock-rates =
+			<0 0 480000000 0>,
+			<0 0 600000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_1_clk_src";
+		operating-points-v2 = <&vfe1_opp_table>;
+		clock-control-debugfs = "true";
+		ubwc-static-cfg = <0x1026 0x1036>;
+		cam_hw_pid = <9 17>;
+		status = "ok";
+		vfe1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite0: qcom,csid-lite0 {
+		cell-index = <2>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite0";
+		reg = <0x0 0xac84000 0x0 0xf01>;
+		reg-cam-base = <0x84000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite0";
+		interrupts = <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite0_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite0: qcom,ife-lite0 {
+		cell-index = <2>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite0";
+		reg = <0x0 0xac84000 0x0 0x1d00>;
+		reg-cam-base = <0x84000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite0";
+		interrupts = <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite0_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite1: qcom,csid-lite1 {
+		cell-index = <3>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite1";
+		reg = <0x0 0xac88000 0x0 0xf01>;
+		reg-cam-base = <0x88000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite1";
+		interrupts = <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite1_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite1: qcom,ife-lite1 {
+		cell-index = <3>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite1";
+		reg = <0x0 0xac88000 0x0 0x1d00>;
+		reg-cam-base = <0x88000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite1";
+		interrupts = <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite1_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite1_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite2: qcom,csid-lite2 {
+		cell-index = <4>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite2";
+		reg = <0x0 0xac8c000 0x0 0xf01>;
+		reg-cam-base = <0x8c000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite2";
+		interrupts = <GIC_SPI 759 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite2_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite2: qcom,ife-lite2 {
+		cell-index = <4>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite2";
+		reg = <0x0 0xac8c000 0x0 0x1d00>;
+		reg-cam-base = <0x8c000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite2";
+		interrupts = <GIC_SPI 761 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite2_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite2_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite3: qcom,csid-lite3 {
+		cell-index = <5>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite3";
+		reg = <0x0 0xac90000 0x0 0xf01>;
+		reg-cam-base = <0x90000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite3";
+		interrupts = <GIC_SPI 758 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite3_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite3: qcom,ife-lite3 {
+		cell-index = <5>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite3";
+		reg = <0x0 0xac90000 0x0 0x1d00>;
+		reg-cam-base = <0x90000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite3";
+		interrupts = <GIC_SPI 760 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite3_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite3_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_csid_lite4: qcom,csid-lite4 {
+		cell-index = <6>;
+		compatible = "qcom,csid-lite690";
+		reg-names = "csid-lite4";
+		reg = <0x0 0xac94000 0x0 0xf01>;
+		reg-cam-base = <0x94000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "csid-lite4";
+		interrupts = <GIC_SPI 604 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_csid_clk_src";
+		operating-points-v2 = <&csid_lite4_opp_table>;
+
+		clock-control-debugfs = "true";
+		status = "ok";
+		csid_lite4_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_vfe_lite4: qcom,ife-lite4 {
+		cell-index = <6>;
+		compatible = "qcom,vfe-lite690";
+		reg-names = "ife-lite4";
+		reg = <0x0 0xac94000 0x0 0x1d00>;
+		reg-cam-base = <0x94000>;
+		rt-wrapper-base = <0x83000>;
+		interrupt-names = "ife-lite4";
+		interrupts = <GIC_SPI 605 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_cpas_ife_lite_clk",
+			"cam_cc_ife_lite_ahb_clk",
+			"cam_cc_ife_lite_csid_clk_src",
+			"cam_cc_ife_lite_csid_clk",
+			"cam_cc_ife_lite_cphy_rx_clk",
+			"cam_cc_ife_lite_clk_src",
+			"cam_cc_ife_lite_clk";
+		clocks =
+			<&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+			<&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&camcc CAM_CC_IFE_LITE_CLK>;
+		clock-rates =
+			<0 0 400000000 0 0 400000000 0>,
+			<0 0 400000000 0 0 480000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_ife_lite_clk_src";
+		operating-points-v2 = <&vfe_lite4_opp_table>;
+		clock-control-debugfs = "true";
+		cam_hw_pid = <27>;
+		status = "ok";
+		vfe_lite4_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_sfe_lite0: qcom,sfe-lite0 {
+		cell-index = <0>;
+		compatible = "qcom,sfe-lite690";
+		reg-names = "sfe-lite0";
+		reg = <0x0 0xac74000 0x0 0x1000>;
+		reg-cam-base = <0x74000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "sfe-lite0";
+		interrupts = <GIC_SPI 563 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_sfe_lite_0_fast_ahb_clk",
+			"cam_cc_sfe_lite_0_clk",
+			"cam_cc_cpas_sfe_lite_0_clk";
+		clocks =
+			<&camcc CAM_CC_SFE_LITE_0_FAST_AHB_CLK>,
+			<&camcc CAM_CC_SFE_LITE_0_CLK>,
+			<&camcc CAM_CC_CPAS_SFE_LITE_0_CLK>;
+		clock-rates =
+			<0 480000000 300000000>,
+			<0 600000000 400000000>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_sfe_lite_0_clk";
+		operating-points-v2 = <&cam_sfe_lite_opp_table0>;
+		cam_hw_pid = <4>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		cam_sfe_lite_opp_table0: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_sfe_lite1: qcom,sfe-lite1 {
+		cell-index = <1>;
+		compatible = "qcom,sfe-lite690";
+		reg-names = "sfe-lite1";
+		reg = <0x0 0xac75000 0x0 0x1000>;
+		reg-cam-base = <0x75000>;
+		rt-wrapper-base = <0x4d000>;
+		interrupt-names = "sfe-lite1";
+		interrupts = <GIC_SPI 562 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"cam_cc_sfe_lite_1_fast_ahb_clk",
+			"cam_cc_sfe_lite_1_clk",
+			"cam_cc_cpas_sfe_1_clk";
+		clocks =
+			<&camcc CAM_CC_SFE_LITE_1_FAST_AHB_CLK>,
+			<&camcc CAM_CC_SFE_LITE_1_CLK>,
+			<&camcc CAM_CC_CPAS_SFE_LITE_1_CLK>;
+		clock-rates =
+			<0 480000000 300000000>,
+			<0 600000000 400000000>;
+		clock-cntl-level = "svs_l1", "nominal";
+		src-clock-name = "cam_cc_sfe_lite_1_clk";
+		operating-points-v2 = <&cam_sfe_lite_opp_table1>;
+		cam_hw_pid = <5>;
+		clock-control-debugfs = "true";
+		status = "ok";
+		cam_sfe_lite_opp_table1: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	qcom,cam-icp {
+		compatible = "qcom,cam-icp";
+		compat-hw-name = "qcom,icp",
+			"qcom,ipe0";
+		num-icp = <1>;
+		num-ipe = <1>;
+		icp_use_pil;
+		status = "ok";
+	};
+
+	cam_icp: qcom,icp {
+		cell-index = <0>;
+		compatible = "qcom,cam-icp_v3_0";
+		icp-version = <0x0300>;
+
+		reg-names ="icp_csr", "icp_cirq", "icp_wd0";
+		reg = <0x0 0xac01000 0x0 0x400>,
+			<0x0 0xac01800 0x0 0x400>,
+			<0x0 0xac04000 0x0 0x1000>;
+		reg-cam-base = <0x1000 0x1800 0x4000>;
+		interrupt-names = "icp";
+		interrupts = <GIC_SPI 463 IRQ_TYPE_EDGE_RISING>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		memory-region = <&pil_camera_mem>;
+		clock-names =
+			"cam_cc_soc_fast_ahb_clk_src",
+			"cam_cc_icp_ahb_clk",
+			"cam_cc_icp_clk_src",
+			"cam_cc_icp_clk";
+		src-clock-name = "cam_cc_icp_clk_src";
+		clocks =
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_ICP_AHB_CLK>,
+			<&camcc CAM_CC_ICP_CLK_SRC>,
+			<&camcc CAM_CC_ICP_CLK>;
+		clock-rates =
+			<300000000 0 480000000 0>,
+			<400000000 0 600000000 0>;
+		clock-cntl-level = "svs_l1", "nominal";
+		nrt-device;
+		fw_name = "CAMERA_ICP";
+		ubwc-ipe-fetch-cfg = <0x707b 0x7083>;
+		ubwc-ipe-write-cfg = <0x161ef 0x1620f>;
+		qos-val = <0xa0a>;
+		operating-points-v2 = <&icp_opp_table>;
+		cam_hw_pid = <12>;
+		status = "ok";
+		icp_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+	};
+
+	cam_ipe0: qcom,ipe0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-ipe";
+		reg-names = "ipe0_top";
+		reg = <0x0 0xac2d000 0x0 0x18000>;
+		reg-cam-base = <0x2d000>;
+
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+
+		clock-names =
+			"cam_cc_cpas_ipe_clk",
+			"cam_cc_ipe_ahb_clk",
+			"cam_cc_ipe_clk",
+			"cam_cc_ipe_clk_src",
+			"cam_cc_ipe_fast_ahb_clk",
+			"cam_cc_fast_ahb_clk_src";
+		src-clock-name = "cam_cc_ipe_clk_src";
+		clocks =
+			<&camcc CAM_CC_CPAS_IPE_CLK>,
+			<&camcc CAM_CC_IPE_AHB_CLK>,
+			<&camcc CAM_CC_IPE_CLK>,
+			<&camcc CAM_CC_IPE_CLK_SRC>,
+			<&camcc CAM_CC_IPE_FAST_AHB_CLK>,
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>;
+		clock-rates =
+			<0 0 0 480000000 0 300000000>,
+			<0 0 0 600000000 0 400000000>;
+		clock-cntl-level = "svs_l1", "nominal";
+
+		operating-points-v2 = <&ipe0_opp_table>;
+		nrt-device;
+		cam_hw_pid = <14 15>;
+		status = "ok";
+
+		ipe0_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-480000000 {
+				opp-hz = /bits/ 64 <480000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-600000000 {
+				opp-hz = /bits/ 64 <600000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+
+	};
+
+	qcom,cam-cpas {
+		cell-index = <0>;
+		compatible = "qcom,cam-cpas";
+		label = "cpas";
+		arch-compat = "cpas_top";
+		reg-names = "cam_cpas_top", "cam_camnoc", "cam_rpmh";
+		reg = <0x0 0xac11000 0x0 0x1000>,
+			<0x0 0xac1A000 0x0 0x9400>,
+			<0x0 0xbbf0000 0x0 0x1f00>;
+		reg-cam-base = <0x11000 0x1A000 0x0bbf0000>;
+		interrupt-names = "cpas_camnoc";
+		interrupts = <GIC_SPI 459 IRQ_TYPE_EDGE_RISING>;
+		camnoc-axi-min-ib-bw = <3000000000>;
+		power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+		clock-names =
+			"gcc_camera_ahb_clk",
+			"gcc_camera_hf_axi_clk",
+			"gcc_camera_sf_axi_clk",
+			"cam_cc_slow_ahb_clk_src",
+			"cam_cc_cpas_ahb_clk",
+			"cam_cc_core_ahb_clk",
+			"cam_cc_fast_ahb_clk_src",
+			"cam_cc_cpas_fast_ahb_clk",
+			"cam_cc_camnoc_axi_clk_src",
+			"cam_cc_camnoc_axi_clk",
+			"cam_cc_qdss_debug_xo_clk";
+		clocks =
+			<&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_HF_AXI_CLK>,
+			<&gcc GCC_CAMERA_SF_AXI_CLK>,
+			<&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_AHB_CLK>,
+			<&camcc CAM_CC_CORE_AHB_CLK>,
+			<&camcc CAM_CC_FAST_AHB_CLK_SRC>,
+			<&camcc CAM_CC_CPAS_FAST_AHB_CLK>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK_SRC>,
+			<&camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&camcc CAM_CC_QDSS_DEBUG_XO_CLK>;
+		src-clock-name = "cam_cc_fast_ahb_clk_src";
+		clock-rates =
+			<0 0 0 0 0 0 0 0 0 0 0>,
+			<0 0 0 80000000 0 0 300000000 0 400000000 0 0>,
+			<0 0 0 80000000 0 0 400000000 0 400000000 0 0>;
+		clock-cntl-level = "suspend", "svs_l1", "nominal";
+		clock-names-option = "cam_icp_clk";
+		clocks-option = <&camcc CAM_CC_ICP_CLK>;
+		clock-rates-option = <480000000>;
+		operating-points-v2 = <&cpas_opp_table>;
+		control-camnoc-axi-clk;
+		camnoc-bus-width = <32>;
+		camnoc-axi-clk-bw-margin-perc = <20>;
+		cam-icc-path-names = "cam_ahb";
+		interconnect-names = "cam_ahb", "cam_hf_0", "cam_sf_0", "cam_sf_icp";
+		interconnects =<&gem_noc MASTER_APPSS_PROC 0
+			&config_noc SLAVE_CAMERA_CFG 0>,
+				<&mmss_noc MASTER_CAMNOC_HF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_SF 0
+			&mc_virt SLAVE_EBI1 0>,
+				<&mmss_noc MASTER_CAMNOC_ICP 0
+			&mc_virt SLAVE_EBI1 0>;
+		cam-ahb-num-cases = <7>;
+		cam-ahb-bw-KBps =
+			<0 0>, <0 76800>, <0 150000>, <0 150000>,
+			<0 300000>, <0 300000>, <0 300000>;
+		vdd-corners = <RPMH_REGULATOR_LEVEL_RETENTION
+			RPMH_REGULATOR_LEVEL_MIN_SVS
+			RPMH_REGULATOR_LEVEL_LOW_SVS
+			RPMH_REGULATOR_LEVEL_SVS
+			RPMH_REGULATOR_LEVEL_SVS_L1
+			RPMH_REGULATOR_LEVEL_NOM
+			RPMH_REGULATOR_LEVEL_NOM_L1
+			RPMH_REGULATOR_LEVEL_NOM_L2
+			RPMH_REGULATOR_LEVEL_TURBO
+			RPMH_REGULATOR_LEVEL_TURBO_L1>;
+		vdd-corner-ahb-mapping = "suspend",
+			"lowsvs", "lowsvs", "svs", "svs_l1",
+			"nominal", "nominal", "nominal",
+			"turbo", "turbo";
+		client-id-based;
+		client-names =
+			"csiphy0", "csiphy1", "csiphy2", "csiphy3",
+			"cci0", "cci1", "cci2", "cci3","csid0", "csid1",
+			"csid2", "csid3", "csid4", "csid5", "csid6",
+			"ife0", "ife1",	"ife2", "ife3", "ife4",
+			"ife5",	"ife6", "ipe0", "sfe0", "sfe1",
+			"cam-cdm-intf0", "rt-cdm0", "rt-cdm1", "rt-cdm2",
+			"rt-cdm3", "icp0", "tpg17", "tpg18", "tpg19";
+
+		status = "ok";
+		enable-secure-qos-update;
+		cpas_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-300000000 {
+				opp-hz = /bits/ 64 <300000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>;
+			};
+			opp-400000000 {
+				opp-hz = /bits/ 64 <400000000>;
+				required-opps = <&rpmhpd_opp_nom>;
+			};
+		};
+
+		camera-bus-nodes {
+			level3-nodes {
+				level-index = <3>;
+				level3_rt_rd_wr_sum: level3-rt-rd-wr-sum {
+					cell-index = <0>;
+					node-name = "level3-rt-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					ib-bw-voting-needed;
+					qcom,axi-port-mnoc {
+						cam-icc-path-names = "cam_hf_0";
+					};
+				};
+
+				level3_nrt0_rd_wr_sum: level3-nrt0-rd-wr-sum {
+					cell-index = <1>;
+					node-name = "level3-nrt0-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						cam-icc-path-names = "cam_sf_0";
+					};
+				};
+
+				level3_nrt1_rd_wr_sum: level3-nrt1-rd-wr-sum {
+					cell-index = <2>;
+					node-name = "level3-nrt1-rd-wr-sum";
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+					qcom,axi-port-mnoc {
+						cam-icc-path-names = "cam_sf_icp";
+					};
+				};
+			};
+
+			level2-nodes {
+				level-index = <2>;
+				camnoc-max-needed;
+				level2_rt_wr0: level2-rt-wr0 {
+					cell-index = <3>;
+					node-name = "level2-rt-wr0";
+					parent-node = <&level3_rt_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_rt_wr1: level2-rt-wr1 {
+					cell-index = <4>;
+					node-name = "level2-rt-wr1";
+					parent-node = <&level3_rt_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt_wr2: level2-nrt-wr2 {
+					cell-index = <5>;
+					node-name = "level2-nrt-wr2";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_rt_rd0: level2-rt-read0 {
+					cell-index = <6>;
+					node-name = "level2-rt-rd0";
+					parent-node = <&level3_rt_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt_rd1: level2-nrt-rd1 {
+					cell-index = <7>;
+					node-name = "level2-nrt-rd1";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_nrt_rd2: level2-nrt-rd2 {
+					cell-index = <8>;
+					node-name = "level2-nrt-rd2";
+					parent-node = <&level3_nrt0_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level2_icp_rd: level2-icp-rd {
+					cell-index = <9>;
+					node-name = "level2-icp-rd";
+					parent-node = <&level3_nrt1_rd_wr_sum>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+			};
+
+			level1-nodes {
+				level-index = <1>;
+				camnoc-max-needed;
+				level1_rt_wr0: level1-rt-wr0 {
+					cell-index = <10>;
+					node-name = "level1-rt-wr0";
+					parent-node = <&level2_rt_wr0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt_wr1: level1-rt-wr1 {
+					cell-index = <11>;
+					node-name = "level1-rt-wr1";
+					parent-node = <&level2_rt_wr1>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_rt_rd0: level1-rt-read0 {
+					cell-index = <13>;
+					node-name = "level1-rt-rd0";
+					parent-node = <&level2_rt_rd0>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+
+				level1_nrt_rd2: level1-nrt-rd2 {
+					cell-index = <15>;
+					node-name = "level1-nrt-rd2";
+					parent-node = <&level2_nrt_rd2>;
+					traffic-merge-type =
+					<CAM_CPAS_TRAFFIC_MERGE_SUM>;
+				};
+			};
+
+			level0-nodes {
+				level-index = <0>;
+				ife_0_wr_0: ife-0-wr-0 {
+					cell-index = <16>;
+					node-name = "ife-0-wr-0";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_1_wr_0: ife-1-wr-0 {
+					cell-index = <17>;
+					node-name = "ife-1-wr-0";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_0_wr_0: ife-lite-0-wr-0 {
+					cell-index = <18>;
+					node-name = "ife-lite-0-wr-0";
+					client-name = "ife2";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_1_wr_0: ife-lite-1-wr-0 {
+					cell-index = <19>;
+					node-name = "ife-lite-1-wr-0";
+					client-name = "ife3";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_2_wr_0: ife-lite-2-wr-0 {
+					cell-index = <20>;
+					node-name = "ife-lite-2-wr-0";
+					client-name = "ife4";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_3_wr_0: ife-lite-3-wr-0 {
+					cell-index = <21>;
+					node-name = "ife-lite-3-wr-0";
+					client-name = "ife5";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_lite_4_wr_0: ife-lite-4-wr-0 {
+					cell-index = <22>;
+					node-name = "ife-lite-4-wr-0";
+					client-name = "ife6";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_RDI0
+					CAM_CPAS_PATH_DATA_IFE_RDI1
+					CAM_CPAS_PATH_DATA_IFE_RDI2
+					CAM_CPAS_PATH_DATA_IFE_RDI3
+					CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW>;
+					parent-node = <&level1_rt_wr0>;
+				};
+				ife_0_wr_1: ife-0-wr-1 {
+					cell-index = <23>;
+					node-name = "ife-0-wr-1";
+					client-name = "ife0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_UBWC>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_DISP>;
+					parent-node = <&level1_rt_wr1>;
+				};
+				ife_1_wr_1: ife-1-wr-1 {
+					cell-index = <24>;
+					node-name = "ife-1-wr-1";
+					client-name = "ife1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_IFE_UBWC>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IFE_VID
+					CAM_CPAS_PATH_DATA_IFE_LINEAR
+					CAM_CPAS_PATH_DATA_IFE_STATS
+					CAM_CPAS_PATH_DATA_IFE_PDAF
+					CAM_CPAS_PATH_DATA_IFE_DISP>;
+					parent-node = <&level1_rt_wr1>;
+				};
+				sfe_0_rd_0: sfe-0-rd-0 {
+					cell-index = <25>;
+					node-name = "sfe-0-rd-0";
+					client-name = "sfe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_SFE_NRDI>;
+					parent-node = <&level1_rt_rd0>;
+				};
+				sfe_1_rd_0: sfe-1-rd-0 {
+					cell-index = <26>;
+					node-name = "sfe-1-rd-0";
+					client-name = "sfe1";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_SFE_NRDI>;
+					parent-node = <&level1_rt_rd0>;
+				};
+				ipe_0_wr_2: ipe-0-wr-2 {
+					cell-index = <27>;
+					node-name = "ipe-0-wr-2";
+					client-name = "ipe0";
+					traffic-data =
+					<CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_WRITE>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_WR_VID
+					CAM_CPAS_PATH_DATA_IPE_WR_DISP
+					CAM_CPAS_PATH_DATA_IPE_WR_REF
+					CAM_CPAS_PATH_DATA_IPE_WR_APP>;
+					parent-node = <&level2_nrt_wr2>;
+				};
+				ipe_0_rd_all: ipe-0-rd-all {
+					cell-index = <28>;
+					node-name = "ipe-0-rd-all";
+					client-name = "ipe0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					constituent-paths =
+					<CAM_CPAS_PATH_DATA_IPE_RD_IN
+					CAM_CPAS_PATH_DATA_IPE_RD_REF>;
+					parent-node = <&level2_nrt_rd1>;
+				};
+				rt_cdm0_all_rd_2: rt-cdm0-all-rd-2 {
+					cell-index = <29>;
+					node-name = "rt-cdm0-all-rd-2";
+					client-name = "rt-cdm0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				rt_cdm1_all_rd_2: rt-cdm1-all-rd-2 {
+					cell-index = <30>;
+					node-name = "rt-cdm1-all-rd-2";
+					client-name = "rt-cdm1";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				rt_cdm2_all_rd_2: rt-cdm2-all-rd-2 {
+					cell-index = <31>;
+					node-name = "rt-cdm2-all-rd-2";
+					client-name = "rt-cdm2";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				rt_cdm3_all_rd_2: rt-cdm3-all-rd-2 {
+					cell-index = <32>;
+					node-name = "rt-cdm3-all-rd-2";
+					client-name = "rt-cdm3";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				ipe_cdm0_all_rd: ipe-cdm0-all-rd {
+					cell-index = <33>;
+					node-name = "ipe-cdm0-all-rd";
+					client-name = "ipe0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level1_nrt_rd2>;
+				};
+				icp_all_rd: icp-all-rd {
+					cell-index = <34>;
+					node-name = "icp-all-rd";
+					client-name = "icp0";
+					traffic-data = <CAM_CPAS_PATH_DATA_ALL>;
+					traffic-transaction-type =
+					<CAM_CPAS_TRANSACTION_READ>;
+					parent-node = <&level2_icp_rd>;
+				};
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-dma-heaps.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-dma-heaps.dtsi
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/arm/qcom_dma_heap_dt_constants.h>
+
+&soc {
+	qcom,dma-heaps {
+		compatible = "qcom,dma-heaps";
+
+		qcom,qseecom {
+			qcom,dma-heap-name = "qcom,qseecom";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&qseecom_mem>;
+		};
+
+		qcom,qseecom_ta {
+			qcom,dma-heap-name = "qcom,qseecom-ta";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&qseecom_ta_mem>;
+		};
+
+		qcom,secure_cdsp {
+			qcom,dma-heap-name = "qcom,cma-secure-cdsp";
+			qcom,dma-heap-type = <HEAP_TYPE_CMA>;
+			memory-region = <&cdsp_secure_heap>;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-el2.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-el2.dtso
@@ -0,0 +1,272 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+/plugin/;
+
+&remoteproc_adsp {
+	iommus = <&apps_smmu 0x3000 0x0>;
+	qcom,devmem = <0x00110000 0x00110000 0x4000 0x1>,
+			<0x00123000 0x00123000 0x1000 0x3>,
+			<0x00124000 0x00124000 0x3000 0x3>,
+			<0x00127000 0x00127000 0x2000 0x3>,
+			<0x0012a000 0x0012a000 0x3000 0x3>,
+			<0x0012e000 0x0012e000 0x1000 0x3>,
+			<0x0012f000 0x0012f000 0x1000 0x1>,
+			<0x00144000 0x00144000 0x1000 0x1>,
+			<0x00148000 0x00148000 0x1000 0x1>,
+			<0x00149000 0x00149000 0xe000 0x3>,
+			<0x00157000 0x00157000 0x1000 0x3>,
+			<0x00158000 0x00158000 0xd000 0x3>,
+			<0x00165000 0x00165000 0x1000 0x3>,
+			<0x00172000 0x00172000 0x1000 0x3>,
+			<0x00173000 0x00173000 0x8000 0x3>,
+			<0x0017b000 0x0017b000 0x2000 0x3>,
+			<0x0017f000 0x0017f000 0x1000 0x3>,
+			<0x00184000 0x00184000 0x1000 0x1>,
+			<0x00186000 0x00186000 0x1000 0x1>,
+			<0x0019c000 0x0019c000 0x3000 0x3>,
+			<0x0019f000 0x0019f000 0xe000 0x3>,
+			<0x001ad000 0x001ad000 0x2000 0x3>,
+			<0x001b0000 0x001b0000 0x1000 0x3>,
+			<0x001b2000 0x001b2000 0x1000 0x3>,
+			<0x001b4000 0x001b4000 0x1000 0x3>,
+			<0x001b6000 0x001b6000 0x1000 0x3>,
+			<0x001be000 0x001be000 0x1000 0x3>,
+			<0x001bf000 0x001bf000 0x10000 0x3>,
+			<0x001cf000 0x001cf000 0x1000 0x3>,
+			<0x00403000 0x00403000 0x1000 0x3>,
+			<0x00443000 0x00443000 0x1000 0x3>,
+			<0x00483000 0x00483000 0x1000 0x3>,
+			<0x004c3000 0x004c3000 0x1000 0x3>,
+			<0x004fc000 0x004fc000 0x1000 0x1>,
+			<0x00780000 0x00780000 0x7000 0x1>,
+			<0x010d0000 0x010d0000 0x1000 0x1>,
+			<0x010d4000 0x010d4000 0x1000 0x1>,
+			<0x01dc4000 0x01dc4000 0x1000 0x1>,
+			<0x01dc5000 0x01dc5000 0x1000 0x3>,
+			<0x01dc8000 0x01dc8000 0x1000 0x3>,
+			<0x01dfa000 0x01dfa000 0x1000 0x3>,
+			<0x01dfd000 0x01dfd000 0x1000 0x3>,
+			<0x01f40000 0x01f40000 0x40000 0x3>,
+			<0x01fc0000 0x01fc0000 0x29000 0x1>,
+			<0x01fe9000 0x01fe9000 0x1000 0x3>,
+			<0x01fea000 0x01fea000 0x1000 0x1>,
+			<0x01feb000 0x01feb000 0x1000 0x1>,
+			<0x01fec000 0x01fec000 0x4000 0x1>,
+			<0x03c41000 0x03c41000 0x3000 0x3>,
+			<0x03c4f000 0x03c4f000 0x1000 0x3>,
+			<0x04001000 0x04001000 0x1000 0x3>,
+			<0x04002000 0x04002000 0x1000 0x3>,
+			<0x04041000 0x04041000 0x1000 0x3>,
+			<0x04042000 0x04042000 0x1000 0x3>,
+			<0x04043000 0x04043000 0x1000 0x3>,
+			<0x04045000 0x04045000 0x1000 0x3>,
+			<0x04046000 0x04046000 0x1000 0x3>,
+			<0x0404e000 0x0404e000 0x1000 0x3>,
+			<0x0404f000 0x0404f000 0x1000 0x3>,
+			<0x04b04000 0x04b04000 0x1000 0x3>,
+			<0x04b05000 0x04b05000 0x1000 0x3>,
+			<0x04b11000 0x04b11000 0x1000 0x3>,
+			<0x04b40000 0x04b40000 0x20000 0x3>,
+			<0x09080000 0x09080000 0x1000 0x3>,
+			<0x09200000 0x09200000 0x28000 0x3>,
+			<0x09300000 0x09300000 0x28000 0x3>,
+			<0x09400000 0x09400000 0x28000 0x3>,
+			<0x09500000 0x09500000 0x28000 0x3>,
+			<0x09600000 0x09600000 0x28000 0x3>,
+			<0x09700000 0x09700000 0x28000 0x3>,
+			<0x0b250000 0x0b250000 0x10000 0x3>,
+			<0x0b450000 0x0b450000 0x10000 0x3>,
+			<0x0bbf0000 0x0bbf0000 0x2000 0x1>,
+			<0x0c210000 0x0c210000 0x80000 0x1>,
+			<0x0c340000 0x0c340000 0x1000 0x3>,
+			<0x0c370000 0x0c370000 0x1000 0x1>,
+			<0x0c380000 0x0c380000 0x1000 0x1>,
+			<0x0c390000 0x0c390000 0x1000 0x1>,
+			<0x0c3a0000 0x0c3a0000 0x1000 0x1>,
+			<0x0c3b0000 0x0c3b0000 0x1000 0x1>,
+			<0x0c3c0000 0x0c3c0000 0x1000 0x1>,
+			<0x0c3d0000 0x0c3d0000 0x1000 0x1>,
+			<0x0c3e0000 0x0c3e0000 0x1000 0x3>,
+			<0x0c3f0000 0x0c3f0000 0x1000 0x1>,
+			<0x0c400000 0x0c400000 0x30000 0x3>,
+			<0x0c440000 0x0c440000 0x10000 0x3>,
+			<0x0c460000 0x0c460000 0x81000 0x1>,
+			<0x0e600000 0x0e600000 0x100000 0x3>,
+			<0x0e700000 0x0e700000 0xa0000 0x1>,
+			<0x0f000000 0x0f000000 0x1000000 0x3>,
+			<0x146d8000 0x146d8000 0x1000 0x3>,
+			<0x16000000 0x16000000 0x1000000 0x2>,
+			<0x80b00000 0x80b00000 0x100000 0x3>,
+			<0x90860000 0x90860000 0x20000 0x3>,
+			<0x90900000 0x90900000 0x200000 0x3>;
+};
+
+&remoteproc_cdsp0 {
+	iommus = <&apps_smmu 0x21c0 0x0400>;
+	qcom,devmem = <0x00110000   0x00110000   0x4000     0x1>,
+			<0x00114000   0x00114000   0xf000     0x3>,
+			<0x00123000   0x00123000   0x1000     0x3>,
+			<0x00124000   0x00124000   0x3000     0x3>,
+			<0x00127000   0x00127000   0x3000     0x3>,
+			<0x0012a000   0x0012a000   0x3000     0x3>,
+			<0x0012e000   0x0012e000   0x1000     0x3>,
+			<0x0012f000   0x0012f000   0x1000     0x1>,
+			<0x00144000   0x00144000   0x1000     0x1>,
+			<0x00148000   0x00148000   0x1000     0x1>,
+			<0x00149000   0x00149000   0xc000     0x3>,
+			<0x00155000   0x00155000   0x1000     0x3>,
+			<0x0016b000   0x0016b000   0x1000     0x3>,
+			<0x00172000   0x00172000   0x1000     0x3>,
+			<0x00173000   0x00173000   0x11000    0x3>,
+			<0x00184000   0x00184000   0x1000     0x1>,
+			<0x00186000   0x00186000   0x1000     0x1>,
+			<0x00187000   0x00187000   0x45000    0x3>,
+			<0x001cc000   0x001cc000   0x1000     0x3>,
+			<0x00406000   0x00406000   0x1000     0x3>,
+			<0x00412000   0x00412000   0x1000     0x3>,
+			<0x00446000   0x00446000   0x1000     0x3>,
+			<0x00452000   0x00452000   0x1000     0x3>,
+			<0x00486000   0x00486000   0x1000     0x3>,
+			<0x00492000   0x00492000   0x1000     0x3>,
+			<0x004c6000   0x004c6000   0x1000     0x3>,
+			<0x004d2000   0x004d2000   0x1000     0x3>,
+			<0x004fc000   0x004fc000   0x1000     0x1>,
+			<0x0063a000   0x0063a000   0x4000     0x3>,
+			<0x0063e000   0x0063e000   0x4000     0x3>,
+			<0x00780000   0x00780000   0x10000    0x1>,
+			<0x010d0000   0x010d0000   0x1000     0x1>,
+			<0x010da000   0x010da000   0x1000     0x1>,
+			<0x016c2000   0x016c2000   0x9000     0x3>,
+			<0x01703000   0x01703000   0x5000     0x3>,
+			<0x01f40000   0x01f40000   0x40000    0x3>,
+			<0x01fc0000   0x01fc0000   0x2b000    0x1>,
+			<0x01feb000   0x01feb000   0x1000     0x3>,
+			<0x01fec000   0x01fec000   0x4000     0x1>,
+			<0x01fff000   0x01fff000   0x1000     0x1>,
+			<0x09080000   0x09080000   0x1000     0x3>,
+			<0x090b4000   0x090b4000   0x1000     0x3>,
+			<0x090b8000   0x090b8000   0x1000     0x3>,
+			<0x09200000   0x09200000   0x28000    0x3>,
+			<0x09300000   0x09300000   0x28000    0x3>,
+			<0x09400000   0x09400000   0x28000    0x3>,
+			<0x09500000   0x09500000   0x28000    0x3>,
+			<0x09600000   0x09600000   0x28000    0x3>,
+			<0x09700000   0x09700000   0x28000    0x3>,
+			<0x0b2c0000   0x0b2c0000   0x10000    0x3>,
+			<0x0b2f0000   0x0b2f0000   0x10000    0x3>,
+			<0x0b4c0000   0x0b4c0000   0x10000    0x3>,
+			<0x0b4f0000   0x0b4f0000   0x10000    0x3>,
+			<0x0bbf0000   0x0bbf0000   0x2000     0x1>,
+			<0x0c20a000   0x0c20a000   0x1000     0x3>,
+			<0x0c20b000   0x0c20b000   0x1000     0x3>,
+			<0x0c210000   0x0c210000   0x80000    0x1>,
+			<0x0c330000   0x0c330000   0x1000     0x3>,
+			<0x0c370000   0x0c370000   0x1000     0x1>,
+			<0x0c380000   0x0c380000   0x1000     0x3>,
+			<0x0c390000   0x0c390000   0x1000     0x1>,
+			<0x0c3a0000   0x0c3a0000   0x1000     0x1>,
+			<0x0c3b0000   0x0c3b0000   0x1000     0x1>,
+			<0x0c3c0000   0x0c3c0000   0x1000     0x1>,
+			<0x0c3d0000   0x0c3d0000   0x1000     0x1>,
+			<0x0c3e0000   0x0c3e0000   0x1000     0x1>,
+			<0x0c3f0000   0x0c3f0000   0x1000     0x1>,
+			<0x0c440000   0x0c440000   0x10000    0x3>,
+			<0x0c460000   0x0c460000   0x81000    0x1>,
+			<0x0e600000   0x0e600000   0x100000   0x3>,
+			<0x0e700000   0x0e700000   0xa0000    0x1>,
+			<0x0f000000   0x0f000000   0x1000000  0x3>,
+			<0x146d8000   0x146d8000   0x1000     0x3>,
+			<0x16000000   0x16000000   0x1000000  0x2>,
+			<0x23007000   0x23007000   0x1000     0x1>,
+			<0x23047000   0x23047000   0x1000     0x1>,
+			<0x2304e000   0x2304e000   0x2000     0x3>,
+			<0x90860000   0x90860000   0x20000    0x3>,
+			<0x90900000   0x90900000   0x200000   0x3>;
+};
+
+&remoteproc_cdsp1 {
+	iommus = <&apps_smmu 0x29c0 0x0400>;
+	qcom,devmem = <0x00110000   0x00110000   0x4000     0x1>,
+			<0x00114000   0x00114000   0xf000     0x3>,
+			<0x00123000   0x00123000   0x1000     0x3>,
+			<0x00124000   0x00124000   0x3000     0x3>,
+			<0x00127000   0x00127000   0x3000     0x3>,
+			<0x0012a000   0x0012a000   0x3000     0x3>,
+			<0x0012e000   0x0012e000   0x1000     0x3>,
+			<0x0012f000   0x0012f000   0x1000     0x1>,
+			<0x00144000   0x00144000   0x1000     0x1>,
+			<0x00148000   0x00148000   0x1000     0x1>,
+			<0x00149000   0x00149000   0xc000     0x3>,
+			<0x00155000   0x00155000   0x1000     0x3>,
+			<0x0016b000   0x0016b000   0x1000     0x3>,
+			<0x00172000   0x00172000   0x1000     0x3>,
+			<0x00173000   0x00173000   0x11000    0x3>,
+			<0x00184000   0x00184000   0x1000     0x1>,
+			<0x00186000   0x00186000   0x1000     0x1>,
+			<0x00187000   0x00187000   0x45000    0x3>,
+			<0x001cc000   0x001cc000   0x1000     0x3>,
+			<0x00406000   0x00406000   0x1000     0x3>,
+			<0x00412000   0x00412000   0x1000     0x3>,
+			<0x00446000   0x00446000   0x1000     0x3>,
+			<0x00452000   0x00452000   0x1000     0x3>,
+			<0x00486000   0x00486000   0x1000     0x3>,
+			<0x00492000   0x00492000   0x1000     0x3>,
+			<0x004c6000   0x004c6000   0x1000     0x3>,
+			<0x004d2000   0x004d2000   0x1000     0x3>,
+			<0x004fc000   0x004fc000   0x1000     0x1>,
+			<0x0063a000   0x0063a000   0x4000     0x3>,
+			<0x0063e000   0x0063e000   0x4000     0x3>,
+			<0x00780000   0x00780000   0x10000    0x1>,
+			<0x010d0000   0x010d0000   0x1000     0x1>,
+			<0x010da000   0x010da000   0x1000     0x1>,
+			<0x016c2000   0x016c2000   0x9000     0x3>,
+			<0x01703000   0x01703000   0x5000     0x3>,
+			<0x01f40000   0x01f40000   0x40000    0x3>,
+			<0x01fc0000   0x01fc0000   0x2b000    0x1>,
+			<0x01feb000   0x01feb000   0x1000     0x3>,
+			<0x01fec000   0x01fec000   0x4000     0x1>,
+			<0x01fff000   0x01fff000   0x1000     0x1>,
+			<0x09080000   0x09080000   0x1000     0x3>,
+			<0x090b4000   0x090b4000   0x1000     0x3>,
+			<0x090b8000   0x090b8000   0x1000     0x3>,
+			<0x09200000   0x09200000   0x28000    0x3>,
+			<0x09300000   0x09300000   0x28000    0x3>,
+			<0x09400000   0x09400000   0x28000    0x3>,
+			<0x09500000   0x09500000   0x28000    0x3>,
+			<0x09600000   0x09600000   0x28000    0x3>,
+			<0x09700000   0x09700000   0x28000    0x3>,
+			<0x0b2c0000   0x0b2c0000   0x10000    0x3>,
+			<0x0b2f0000   0x0b2f0000   0x10000    0x3>,
+			<0x0b4c0000   0x0b4c0000   0x10000    0x3>,
+			<0x0b4f0000   0x0b4f0000   0x10000    0x3>,
+			<0x0bbf0000   0x0bbf0000   0x2000     0x1>,
+			<0x0c20a000   0x0c20a000   0x1000     0x3>,
+			<0x0c20b000   0x0c20b000   0x1000     0x3>,
+			<0x0c210000   0x0c210000   0x80000    0x1>,
+			<0x0c330000   0x0c330000   0x1000     0x3>,
+			<0x0c370000   0x0c370000   0x1000     0x1>,
+			<0x0c380000   0x0c380000   0x1000     0x3>,
+			<0x0c390000   0x0c390000   0x1000     0x1>,
+			<0x0c3a0000   0x0c3a0000   0x1000     0x1>,
+			<0x0c3b0000   0x0c3b0000   0x1000     0x1>,
+			<0x0c3c0000   0x0c3c0000   0x1000     0x1>,
+			<0x0c3d0000   0x0c3d0000   0x1000     0x1>,
+			<0x0c3e0000   0x0c3e0000   0x1000     0x1>,
+			<0x0c3f0000   0x0c3f0000   0x1000     0x1>,
+			<0x0c440000   0x0c440000   0x10000    0x3>,
+			<0x0c460000   0x0c460000   0x81000    0x1>,
+			<0x0e600000   0x0e600000   0x100000   0x3>,
+			<0x0e700000   0x0e700000   0xa0000    0x1>,
+			<0x0f000000   0x0f000000   0x1000000  0x3>,
+			<0x146d8000   0x146d8000   0x1000     0x3>,
+			<0x16000000   0x16000000   0x1000000  0x2>,
+			<0x23007000   0x23007000   0x1000     0x1>,
+			<0x23047000   0x23047000   0x1000     0x1>,
+			<0x2304e000   0x2304e000   0x2000     0x3>,
+			<0x90860000   0x90860000   0x20000    0x3>,
+			<0x90900000   0x90900000   0x200000   0x3>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-pmics.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-pmics.dtsi
@@ -1,8 +1,10 @@
 // SPDX-License-Identifier: BSD-3-Clause
 /*
  * Copyright (c) 2023, Linaro Limited
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
+#include <dt-bindings/iio/qcom,spmi-adc5-gen3-pm8775.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/spmi/spmi.h>
 
@@ -10,7 +12,7 @@
 	thermal-zones {
 		pmm8654au_0_thermal: pm8775-0-thermal {
 			polling-delay-passive = <100>;
-			polling-delay = <0>;
+
 			thermal-sensors = <&pmm8654au_0_temp_alarm>;
 
 			trips {
@@ -30,7 +32,7 @@
 
 		pmm8654au_1_thermal: pm8775-1-thermal {
 			polling-delay-passive = <100>;
-			polling-delay = <0>;
+
 			thermal-sensors = <&pmm8654au_1_temp_alarm>;
 
 			trips {
@@ -50,7 +52,7 @@
 
 		pmm8654au_2_thermal: pm8775-2-thermal {
 			polling-delay-passive = <100>;
-			polling-delay = <0>;
+
 			thermal-sensors = <&pmm8654au_2_temp_alarm>;
 
 			trips {
@@ -70,7 +72,7 @@
 
 		pmm8654au_3_thermal: pm8775-3-thermal {
 			polling-delay-passive = <100>;
-			polling-delay = <0>;
+
 			thermal-sensors = <&pmm8654au_3_temp_alarm>;
 
 			trips {
@@ -87,6 +89,163 @@
 				};
 			};
 		};
+
+		pmm8654au_0_mbg_tm: pmm8654au_0_mbg_tz {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8654au_0_tz>;
+
+			trips {
+				trip0 {
+					temperature = <115000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <135000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pmm8654au_1_mbg_tm: pmm8654au_1_mbg_tz {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8654au_1_tz>;
+
+			trips {
+				trip0 {
+					temperature = <115000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <135000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pmm8654au_2_mbg_tm: pmm8654au_2_mbg_tz {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8654au_2_tz>;
+
+			trips {
+				trip0 {
+					temperature = <115000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <135000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pmm8654au_3_mbg_tm: pmm8654au_3_mbg_tz {
+			polling-delay-passive = <100>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8654au_3_tz>;
+
+			trips {
+				trip0 {
+					temperature = <115000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <135000>;
+					hysteresis = <5000>;
+					type = "passive";
+				};
+
+			};
+		};
+
+		sdram-therm {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8654au_2_adc PM8775_3_ADC5_GEN3_AMUX6_THM_100K_PU>;
+			trips {
+				trip0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		soc-therm {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8654au_0_adc PM8775_1_ADC5_GEN3_AMUX6_THM_100K_PU>;
+			trips {
+				trip0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		ufs0-therm {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8654au_0_adc PM8775_1_ADC5_GEN3_AMUX5_THM_100K_PU>;
+			trips {
+				trip0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		xo-therm {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pmm8654au_0_adc PM8775_1_ADC5_GEN3_AMUX1_THM_100K_PU>;
+			trips {
+				trip0 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+
+				trip1 {
+					temperature = <125000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
 	};
 
 	reboot-mode {
@@ -101,14 +260,79 @@
 &spmi_bus {
 	pmm8654au_0: pmic@0 {
 		compatible = "qcom,pmm8654au", "qcom,spmi-pmic";
-		reg = <0x0 SPMI_USID>;
+		reg = <0 SPMI_USID>;
 		#address-cells = <1>;
 		#size-cells = <0>;
 
+		pmm8654au_0_adc: vadc@8000 {
+			compatible = "qcom,spmi-adc5-gen3";
+			reg = <0x8000>;
+			reg-names = "adc5-gen3-base";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts-extended = <&spmi_bus 0x0 0x80 0x1 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "adc-sdam0";
+			#io-channel-cells = <1>;
+			#thermal-sensor-cells = <1>;
+
+			pmm8654au_0_ref_gnd {
+				reg = <PM8775_1_ADC5_GEN3_OFFSET_REF>;
+				label = "pm8775_1_ref_gnd";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_0_vref_1p25 {
+				reg = <PM8775_1_ADC5_GEN3_1P25VREF>;
+				label = "pm8775_1_vref_1p25";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_0_die_temp {
+				reg = <PM8775_1_ADC5_GEN3_DIE_TEMP>;
+				label = "pm8775_1_die_temp";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_0_vph_pwr {
+				reg = <PM8775_1_ADC5_GEN3_VPH_PWR>;
+				label = "pm8775_1_vph_pwr";
+				qcom,pre-scaling = <1 3>;
+			};
+
+			soc_therm {
+				reg = <PM8775_1_ADC5_GEN3_AMUX6_THM_100K_PU>;
+				label = "pmm8654au_0_soc_therm";
+				qcom,ratiometric;
+				qcom,hw-settle-time = <200>;
+				qcom,adc-tm;
+				qcom,pre-scaling = <1 1>;
+			};
+
+			ufs0_therm {
+				reg = <PM8775_1_ADC5_GEN3_AMUX5_THM_100K_PU>;
+				label = "pmm8654au_0_ufs0_therm";
+				qcom,ratiometric;
+				qcom,hw-settle-time = <200>;
+				qcom,adc-tm;
+				qcom,pre-scaling = <1 1>;
+			};
+
+			xo_therm {
+				reg = <PM8775_1_ADC5_GEN3_AMUX1_THM_100K_PU>;
+				label = "pmm8654au_0_xo_therm";
+				qcom,ratiometric;
+				qcom,hw-settle-time = <700>;
+				qcom,adc-tm;
+				qcom,pre-scaling = <1 1>;
+			};
+		};
+
 		pmm8654au_0_temp_alarm: temp-alarm@a00 {
 			compatible = "qcom,spmi-temp-alarm";
 			reg = <0xa00>;
 			interrupts-extended = <&spmi_bus 0x0 0xa 0x0 IRQ_TYPE_EDGE_BOTH>;
+			io-channels = <&pmm8654au_0_adc PM8775_1_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
 			#thermal-sensor-cells = <0>;
 		};
 
@@ -132,14 +356,11 @@
 			};
 		};
 
-		pmm8654au_0_gpios: gpio@8800 {
-			compatible = "qcom,pmm8654au-gpio", "qcom,spmi-gpio";
-			reg = <0x8800>;
-			gpio-controller;
-			gpio-ranges = <&pmm8654au_0_gpios 0 0 12>;
-			#gpio-cells = <2>;
-			interrupt-controller;
-			#interrupt-cells = <2>;
+		pmm8654au_0_rtc: rtc@6100 {
+			compatible = "qcom,pmk8350-rtc";
+			reg = <0x6100>, <0x6200>;
+			reg-names = "rtc", "alarm";
+			interrupts = <0x0 0x62 0x1 IRQ_TYPE_NONE>;
 		};
 
 		pmm8654au_0_sdam_0: nvram@7100 {
@@ -154,18 +375,82 @@
 				bits = <1 7>;
 			};
 		};
+
+		pmm8654au_0_gpios: gpio@8800 {
+			compatible = "qcom,pmm8654au-gpio", "qcom,spmi-gpio";
+			reg = <0x8800>;
+			gpio-controller;
+			gpio-ranges = <&pmm8654au_0_gpios 0 0 12>;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	pmm8654au_sail_0: pmic@1 {
+		compatible = "qcom,pmm8654au", "qcom,spmi-pmic";
+		reg = <1 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pmm8654au_0_tz: qcom,mbg-tm@d700 {
+			compatible = "qcom,spmi-mgb-tm";
+			reg = <0xd700>;
+			io-channels = <&pmm8654au_0_adc PM8775_1_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
+			interrupts-extended = <&spmi_bus 0x1 0xd7 0x0 IRQ_TYPE_EDGE_RISING>;
+			#thermal-sensor-cells = <0>;
+		};
 	};
 
 	pmm8654au_1: pmic@2 {
 		compatible = "qcom,pmm8654au", "qcom,spmi-pmic";
-		reg = <0x2 SPMI_USID>;
+		reg = <2 SPMI_USID>;
 		#address-cells = <1>;
 		#size-cells = <0>;
 
+		pmm8654au_1_adc: vadc@8000 {
+			compatible = "qcom,spmi-adc5-gen3";
+			reg = <0x8000>;
+			reg-names = "adc5-gen3-base";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts-extended = <&spmi_bus 0x2 0x80 0x1 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "adc-sdam0";
+			#io-channel-cells = <1>;
+			#thermal-sensor-cells = <1>;
+
+			pmm8654au_1_ref_gnd {
+				reg = <PM8775_2_ADC5_GEN3_OFFSET_REF>;
+				label = "pm8775_2_ref_gnd";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_1_vref_1p25 {
+				reg = <PM8775_2_ADC5_GEN3_1P25VREF>;
+				label = "pm8775_2_vref_1p25";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_1_die_temp {
+				reg = <PM8775_2_ADC5_GEN3_DIE_TEMP>;
+				label = "pm8775_2_die_temp";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_1_vph_pwr {
+				reg = <PM8775_2_ADC5_GEN3_VPH_PWR>;
+				label = "pm8775_2_vph_pwr";
+				qcom,pre-scaling = <1 3>;
+			};
+		};
+
 		pmm8654au_1_temp_alarm: temp-alarm@a00 {
 			compatible = "qcom,spmi-temp-alarm";
 			reg = <0xa00>;
 			interrupts-extended = <&spmi_bus 0x2 0xa 0x0 IRQ_TYPE_EDGE_BOTH>;
+			io-channels = <&pmm8654au_1_adc PM8775_2_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
 			#thermal-sensor-cells = <0>;
 		};
 
@@ -180,16 +465,79 @@
 		};
 	};
 
+	pmm8654au_sail_1: pmic@3 {
+		compatible = "qcom,pmm8654au", "qcom,spmi-pmic";
+		reg = <3 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pmm8654au_1_tz: qcom,mbg-tm@d700 {
+			compatible = "qcom,spmi-mgb-tm";
+			reg = <0xd700>;
+			io-channels = <&pmm8654au_1_adc PM8775_2_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
+			interrupts-extended = <&spmi_bus 0x3 0xd7 0x0 IRQ_TYPE_EDGE_RISING>;
+			#thermal-sensor-cells = <0>;
+		};
+	};
+
 	pmm8654au_2: pmic@4 {
 		compatible = "qcom,pmm8654au", "qcom,spmi-pmic";
-		reg = <0x4 SPMI_USID>;
+		reg = <4 SPMI_USID>;
 		#address-cells = <1>;
 		#size-cells = <0>;
 
+		pmm8654au_2_adc: vadc@8000 {
+			compatible = "qcom,spmi-adc5-gen3";
+			reg = <0x8000>;
+			reg-names = "adc5-gen3-base";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts-extended = <&spmi_bus 0x4 0x80 0x1 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "adc-sdam0";
+			#io-channel-cells = <1>;
+			#thermal-sensor-cells = <1>;
+
+			pmm8654au_2_ref_gnd {
+				reg = <PM8775_3_ADC5_GEN3_OFFSET_REF>;
+				label = "pm8775_3_ref_gnd";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_2_vref_1p25 {
+				reg = <PM8775_3_ADC5_GEN3_1P25VREF>;
+				label = "pm8775_3_vref_1p25";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_2_die_temp {
+				reg = <PM8775_3_ADC5_GEN3_DIE_TEMP>;
+				label = "pm8775_3_die_temp";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_2_vph_pwr {
+				reg = <PM8775_3_ADC5_GEN3_VPH_PWR>;
+				label = "pm8775_3_vph_pwr";
+				qcom,pre-scaling = <1 3>;
+			};
+
+			sdram_therm {
+				reg = <PM8775_3_ADC5_GEN3_AMUX6_THM_100K_PU>;
+				label = "pmm8654au_2_sdram_therm1";
+				qcom,ratiometric;
+				qcom,hw-settle-time = <200>;
+				qcom,adc-tm;
+				qcom,pre-scaling = <1 1>;
+			};
+		};
+
 		pmm8654au_2_temp_alarm: temp-alarm@a00 {
 			compatible = "qcom,spmi-temp-alarm";
 			reg = <0xa00>;
 			interrupts-extended = <&spmi_bus 0x4 0xa 0x0 IRQ_TYPE_EDGE_BOTH>;
+			io-channels = <&pmm8654au_2_adc PM8775_3_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
 			#thermal-sensor-cells = <0>;
 		};
 
@@ -204,16 +552,70 @@
 		};
 	};
 
+	pmm8654au_sail_2: pmic@5 {
+		compatible = "qcom,pmm8654au", "qcom,spmi-pmic";
+		reg = <5 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pmm8654au_2_tz: qcom,mbg-tm@d700 {
+			compatible = "qcom,spmi-mgb-tm";
+			reg = <0xd700>;
+			io-channels = <&pmm8654au_2_adc PM8775_3_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
+			interrupts-extended = <&spmi_bus 0x5 0xd7 0x0 IRQ_TYPE_EDGE_RISING>;
+			#thermal-sensor-cells = <0>;
+		};
+	};
+
 	pmm8654au_3: pmic@6 {
 		compatible = "qcom,pmm8654au", "qcom,spmi-pmic";
-		reg = <0x6 SPMI_USID>;
+		reg = <6 SPMI_USID>;
 		#address-cells = <1>;
 		#size-cells = <0>;
 
+		pmm8654au_3_adc: vadc@8000 {
+			compatible = "qcom,spmi-adc5-gen3";
+			reg = <0x8000>;
+			reg-names = "adc5-gen3-base";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts-extended = <&spmi_bus 0x6 0x80 0x1 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "adc-sdam0";
+			#io-channel-cells = <1>;
+			#thermal-sensor-cells = <1>;
+
+			pmm8654au_3_ref_gnd {
+				reg = <PM8775_4_ADC5_GEN3_OFFSET_REF>;
+				label = "pm8775_4_ref_gnd";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_3_vref_1p25 {
+				reg = <PM8775_4_ADC5_GEN3_1P25VREF>;
+				label = "pm8775_4_vref_1p25";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_3_die_temp {
+				reg = <PM8775_4_ADC5_GEN3_DIE_TEMP>;
+				label = "pm8775_4_die_temp";
+				qcom,pre-scaling = <1 1>;
+			};
+
+			pmm8654au_3_vph_pwr {
+				reg = <PM8775_4_ADC5_GEN3_VPH_PWR>;
+				label = "pm8775_4_vph_pwr";
+				qcom,pre-scaling = <1 3>;
+			};
+		};
+
 		pmm8654au_3_temp_alarm: temp-alarm@a00 {
 			compatible = "qcom,spmi-temp-alarm";
 			reg = <0xa00>;
 			interrupts-extended = <&spmi_bus 0x6 0xa 0x0 IRQ_TYPE_EDGE_BOTH>;
+			io-channels = <&pmm8654au_3_adc PM8775_4_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
 			#thermal-sensor-cells = <0>;
 		};
 
@@ -227,4 +629,20 @@
 			#interrupt-cells = <2>;
 		};
 	};
+
+	pmm8654au_sail_3: pmic@7 {
+		compatible = "qcom,pmm8654au", "qcom,spmi-pmic";
+		reg = <7 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		pmm8654au_3_tz: qcom,mbg-tm@d700 {
+			compatible = "qcom,spmi-mgb-tm";
+			reg = <0xd700>;
+			io-channels = <&pmm8654au_3_adc PM8775_4_ADC5_GEN3_DIE_TEMP>;
+			io-channel-names = "thermal";
+			interrupts-extended = <&spmi_bus 0x7 0xd7 0x0 IRQ_TYPE_EDGE_RISING>;
+			#thermal-sensor-cells = <0>;
+		};
+	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-ride-r3.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-ride-r3.dts
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023, Linaro Limited
+ */
+
+/dts-v1/;
+
+#include "sa8775p-ride.dtsi"
+
+/ {
+	model = "Qualcomm SA8775P Ride Rev3";
+	compatible = "qcom,sa8775p-ride-r3", "qcom,sa8775p";
+	qcom,msm-id = <533 0x10000>, <534 0x10000>, <534 0x20000>;
+	qcom,board-id = <0x20025 1>;
+};
+
+&ethernet0 {
+	phy-mode = "2500base-x";
+};
+
+&ethernet1 {
+	phy-mode = "2500base-x";
+};
+
+&mdio {
+	compatible = "snps,dwmac-mdio";
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	sgmii_phy0: phy@8 {
+		compatible = "ethernet-phy-id31c3.1c33";
+		reg = <0x8>;
+		device_type = "ethernet-phy";
+		interrupts-extended = <&tlmm 7 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&pmm8654au_2_gpios 8 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <11000>;
+		reset-deassert-us = <70000>;
+	};
+
+	sgmii_phy1: phy@0 {
+		compatible = "ethernet-phy-id31c3.1c33";
+		reg = <0x0>;
+		device_type = "ethernet-phy";
+		interrupts-extended = <&tlmm 26 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&pmm8654au_2_gpios 9 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <11000>;
+		reset-deassert-us = <70000>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-ride.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-ride.dts
@@ -1,839 +1,50 @@
 // SPDX-License-Identifier: BSD-3-Clause
 /*
  * Copyright (c) 2023, Linaro Limited
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 /dts-v1/;
 
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/regulator/qcom,rpmh-regulator.h>
-
-#include "sa8775p.dtsi"
-#include "sa8775p-pmics.dtsi"
+#include "sa8775p-ride.dtsi"
 
 / {
 	model = "Qualcomm SA8775P Ride";
 	compatible = "qcom,sa8775p-ride", "qcom,sa8775p";
-
-	aliases {
-		ethernet0 = &ethernet0;
-		ethernet1 = &ethernet1;
-		i2c11 = &i2c11;
-		i2c18 = &i2c18;
-		serial0 = &uart10;
-		serial1 = &uart12;
-		serial2 = &uart17;
-		spi16 = &spi16;
-		ufshc1 = &ufs_mem_hc;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-	};
-};
-
-&apps_rsc {
-	regulators-0 {
-		compatible = "qcom,pmm8654au-rpmh-regulators";
-		qcom,pmic-id = "a";
-
-		vreg_s4a: smps4 {
-			regulator-name = "vreg_s4a";
-			regulator-min-microvolt = <1800000>;
-			regulator-max-microvolt = <1816000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_s5a: smps5 {
-			regulator-name = "vreg_s5a";
-			regulator-min-microvolt = <1850000>;
-			regulator-max-microvolt = <1996000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_s9a: smps9 {
-			regulator-name = "vreg_s9a";
-			regulator-min-microvolt = <535000>;
-			regulator-max-microvolt = <1120000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l4a: ldo4 {
-			regulator-name = "vreg_l4a";
-			regulator-min-microvolt = <788000>;
-			regulator-max-microvolt = <1050000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l5a: ldo5 {
-			regulator-name = "vreg_l5a";
-			regulator-min-microvolt = <870000>;
-			regulator-max-microvolt = <950000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l6a: ldo6 {
-			regulator-name = "vreg_l6a";
-			regulator-min-microvolt = <870000>;
-			regulator-max-microvolt = <970000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l7a: ldo7 {
-			regulator-name = "vreg_l7a";
-			regulator-min-microvolt = <720000>;
-			regulator-max-microvolt = <950000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l8a: ldo8 {
-			regulator-name = "vreg_l8a";
-			regulator-min-microvolt = <2504000>;
-			regulator-max-microvolt = <3300000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l9a: ldo9 {
-			regulator-name = "vreg_l9a";
-			regulator-min-microvolt = <2970000>;
-			regulator-max-microvolt = <3544000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-	};
-
-	regulators-1 {
-		compatible = "qcom,pmm8654au-rpmh-regulators";
-		qcom,pmic-id = "c";
-
-		vreg_l1c: ldo1 {
-			regulator-name = "vreg_l1c";
-			regulator-min-microvolt = <1140000>;
-			regulator-max-microvolt = <1260000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l2c: ldo2 {
-			regulator-name = "vreg_l2c";
-			regulator-min-microvolt = <900000>;
-			regulator-max-microvolt = <1100000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l3c: ldo3 {
-			regulator-name = "vreg_l3c";
-			regulator-min-microvolt = <1100000>;
-			regulator-max-microvolt = <1300000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l4c: ldo4 {
-			regulator-name = "vreg_l4c";
-			regulator-min-microvolt = <1200000>;
-			regulator-max-microvolt = <1200000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			/*
-			 * FIXME: This should have regulator-allow-set-load but
-			 * we're getting an over-current fault from the PMIC
-			 * when switching to LPM.
-			 */
-		};
-
-		vreg_l5c: ldo5 {
-			regulator-name = "vreg_l5c";
-			regulator-min-microvolt = <1100000>;
-			regulator-max-microvolt = <1300000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l6c: ldo6 {
-			regulator-name = "vreg_l6c";
-			regulator-min-microvolt = <1620000>;
-			regulator-max-microvolt = <1980000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l7c: ldo7 {
-			regulator-name = "vreg_l7c";
-			regulator-min-microvolt = <1620000>;
-			regulator-max-microvolt = <2000000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l8c: ldo8 {
-			regulator-name = "vreg_l8c";
-			regulator-min-microvolt = <2400000>;
-			regulator-max-microvolt = <3300000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l9c: ldo9 {
-			regulator-name = "vreg_l9c";
-			regulator-min-microvolt = <1650000>;
-			regulator-max-microvolt = <2700000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-	};
-
-	regulators-2 {
-		compatible = "qcom,pmm8654au-rpmh-regulators";
-		qcom,pmic-id = "e";
-
-		vreg_s4e: smps4 {
-			regulator-name = "vreg_s4e";
-			regulator-min-microvolt = <970000>;
-			regulator-max-microvolt = <1520000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_s7e: smps7 {
-			regulator-name = "vreg_s7e";
-			regulator-min-microvolt = <1010000>;
-			regulator-max-microvolt = <1170000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_s9e: smps9 {
-			regulator-name = "vreg_s9e";
-			regulator-min-microvolt = <300000>;
-			regulator-max-microvolt = <570000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l6e: ldo6 {
-			regulator-name = "vreg_l6e";
-			regulator-min-microvolt = <1280000>;
-			regulator-max-microvolt = <1450000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-
-		vreg_l8e: ldo8 {
-			regulator-name = "vreg_l8e";
-			regulator-min-microvolt = <1800000>;
-			regulator-max-microvolt = <1950000>;
-			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
-			regulator-allow-set-load;
-			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
-						   RPMH_REGULATOR_MODE_HPM>;
-		};
-	};
+	qcom,msm-id = <533 0x10000>, <534 0x10000>, <534 0x20000>;
+	qcom,board-id = <0x10019 0>, <0x10025 1>;
 };
 
 &ethernet0 {
 	phy-mode = "sgmii";
-	phy-handle = <&sgmii_phy0>;
-
-	pinctrl-0 = <&ethernet0_default>;
-	pinctrl-names = "default";
-
-	snps,mtl-rx-config = <&mtl_rx_setup>;
-	snps,mtl-tx-config = <&mtl_tx_setup>;
-	snps,ps-speed = <1000>;
-
-	status = "okay";
-
-	mdio {
-		compatible = "snps,dwmac-mdio";
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		sgmii_phy0: phy@8 {
-			compatible = "ethernet-phy-id0141.0dd4";
-			reg = <0x8>;
-			device_type = "ethernet-phy";
-			interrupts-extended = <&tlmm 7 IRQ_TYPE_EDGE_FALLING>;
-			reset-gpios = <&pmm8654au_2_gpios 8 GPIO_ACTIVE_LOW>;
-			reset-assert-us = <11000>;
-			reset-deassert-us = <70000>;
-		};
-
-		sgmii_phy1: phy@a {
-			compatible = "ethernet-phy-id0141.0dd4";
-			reg = <0xa>;
-			device_type = "ethernet-phy";
-			interrupts-extended = <&tlmm 26 IRQ_TYPE_EDGE_FALLING>;
-			reset-gpios = <&pmm8654au_2_gpios 9 GPIO_ACTIVE_LOW>;
-			reset-assert-us = <11000>;
-			reset-deassert-us = <70000>;
-		};
-	};
-
-	mtl_rx_setup: rx-queues-config {
-		snps,rx-queues-to-use = <4>;
-		snps,rx-sched-sp;
-
-		queue0 {
-			snps,dcb-algorithm;
-			snps,map-to-dma-channel = <0x0>;
-			snps,route-up;
-			snps,priority = <0x1>;
-		};
-
-		queue1 {
-			snps,dcb-algorithm;
-			snps,map-to-dma-channel = <0x1>;
-			snps,route-ptp;
-		};
-
-		queue2 {
-			snps,avb-algorithm;
-			snps,map-to-dma-channel = <0x2>;
-			snps,route-avcp;
-		};
-
-		queue3 {
-			snps,avb-algorithm;
-			snps,map-to-dma-channel = <0x3>;
-			snps,priority = <0xc>;
-		};
-	};
-
-	mtl_tx_setup: tx-queues-config {
-		snps,tx-queues-to-use = <4>;
-		snps,tx-sched-sp;
-
-		queue0 {
-			snps,dcb-algorithm;
-		};
-
-		queue1 {
-			snps,dcb-algorithm;
-		};
-
-		queue2 {
-			snps,avb-algorithm;
-			snps,send_slope = <0x1000>;
-			snps,idle_slope = <0x1000>;
-			snps,high_credit = <0x3e800>;
-			snps,low_credit = <0xffc18000>;
-		};
-
-		queue3 {
-			snps,avb-algorithm;
-			snps,send_slope = <0x1000>;
-			snps,idle_slope = <0x1000>;
-			snps,high_credit = <0x3e800>;
-			snps,low_credit = <0xffc18000>;
-		};
-	};
 };
 
 &ethernet1 {
 	phy-mode = "sgmii";
-	phy-handle = <&sgmii_phy1>;
-
-	snps,mtl-rx-config = <&mtl_rx_setup1>;
-	snps,mtl-tx-config = <&mtl_tx_setup1>;
-	snps,ps-speed = <1000>;
-
-	status = "okay";
-
-	mtl_rx_setup1: rx-queues-config {
-		snps,rx-queues-to-use = <4>;
-		snps,rx-sched-sp;
-
-		queue0 {
-			snps,dcb-algorithm;
-			snps,map-to-dma-channel = <0x0>;
-			snps,route-up;
-			snps,priority = <0x1>;
-		};
-
-		queue1 {
-			snps,dcb-algorithm;
-			snps,map-to-dma-channel = <0x1>;
-			snps,route-ptp;
-		};
-
-		queue2 {
-			snps,avb-algorithm;
-			snps,map-to-dma-channel = <0x2>;
-			snps,route-avcp;
-		};
-
-		queue3 {
-			snps,avb-algorithm;
-			snps,map-to-dma-channel = <0x3>;
-			snps,priority = <0xc>;
-		};
-	};
-
-	mtl_tx_setup1: tx-queues-config {
-		snps,tx-queues-to-use = <4>;
-		snps,tx-sched-sp;
-
-		queue0 {
-			snps,dcb-algorithm;
-		};
-
-		queue1 {
-			snps,dcb-algorithm;
-		};
-
-		queue2 {
-			snps,avb-algorithm;
-			snps,send_slope = <0x1000>;
-			snps,idle_slope = <0x1000>;
-			snps,high_credit = <0x3e800>;
-			snps,low_credit = <0xffc18000>;
-		};
-
-		queue3 {
-			snps,avb-algorithm;
-			snps,send_slope = <0x1000>;
-			snps,idle_slope = <0x1000>;
-			snps,high_credit = <0x3e800>;
-			snps,low_credit = <0xffc18000>;
-		};
-	};
-};
-
-&i2c11 {
-	clock-frequency = <400000>;
-	pinctrl-0 = <&qup_i2c11_default>;
-	pinctrl-names = "default";
-	status = "okay";
 };
 
-&i2c18 {
-	clock-frequency = <400000>;
-	pinctrl-0 = <&qup_i2c18_default>;
-	pinctrl-names = "default";
-	status = "okay";
-};
-
-&pmm8654au_0_gpios {
-	gpio-line-names = "DS_EN",
-			  "POFF_COMPLETE",
-			  "UFS0_VER_ID",
-			  "FAST_POFF",
-			  "DBU1_PON_DONE",
-			  "AOSS_SLEEP",
-			  "CAM_DES0_EN",
-			  "CAM_DES1_EN",
-			  "CAM_DES2_EN",
-			  "CAM_DES3_EN",
-			  "UEFI",
-			  "ANALOG_PON_OPT";
-};
-
-&pmm8654au_0_pon_resin {
-	linux,code = <KEY_VOLUMEDOWN>;
-	status = "okay";
-};
-
-&pmm8654au_1_gpios {
-	gpio-line-names = "PMIC_C_ID0",
-			  "PMIC_C_ID1",
-			  "UFS1_VER_ID",
-			  "IPA_PWR",
-			  "",
-			  "WLAN_DBU4_EN",
-			  "WLAN_EN",
-			  "BT_EN",
-			  "USB2_PWR_EN",
-			  "USB2_FAULT";
-
-	usb2_en_state: usb2-en-state {
-		pins = "gpio9";
-		function = "normal";
-		output-high;
-		power-source = <0>;
-	};
-};
-
-&pmm8654au_2_gpios {
-	gpio-line-names = "PMIC_E_ID0",
-			  "PMIC_E_ID1",
-			  "USB0_PWR_EN",
-			  "USB0_FAULT",
-			  "SENSOR_IRQ_1",
-			  "SENSOR_IRQ_2",
-			  "SENSOR_RST",
-			  "SGMIIO0_RST",
-			  "SGMIIO1_RST",
-			  "USB1_PWR_ENABLE",
-			  "USB1_FAULT",
-			  "VMON_SPX8";
-
-	usb0_en_state: usb0-en-state {
-		pins = "gpio3";
-		function = "normal";
-		output-high;
-		power-source = <0>;
+&mdio {
+	compatible = "snps,dwmac-mdio";
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	sgmii_phy0: phy@8 {
+		compatible = "ethernet-phy-id0141.0dd4";
+		reg = <0x8>;
+		device_type = "ethernet-phy";
+		interrupts-extended = <&tlmm 7 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&pmm8654au_2_gpios 8 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <11000>;
+		reset-deassert-us = <70000>;
+	};
+
+	sgmii_phy1: phy@a {
+		compatible = "ethernet-phy-id0141.0dd4";
+		reg = <0xa>;
+		device_type = "ethernet-phy";
+		interrupts-extended = <&tlmm 26 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&pmm8654au_2_gpios 9 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <11000>;
+		reset-deassert-us = <70000>;
 	};
-
-	usb1_en_state: usb1-en-state {
-		pins = "gpio10";
-		function = "normal";
-		output-high;
-		power-source = <0>;
-	};
-};
-
-&pmm8654au_3_gpios {
-	gpio-line-names = "PMIC_G_ID0",
-			  "PMIC_G_ID1",
-			  "GNSS_RST",
-			  "GNSS_EN",
-			  "GNSS_BOOT_MODE";
-};
-
-&qupv3_id_1 {
-	status = "okay";
-};
-
-&qupv3_id_2 {
-	status = "okay";
-};
-
-&serdes0 {
-	phy-supply = <&vreg_l5a>;
-	status = "okay";
-};
-
-&serdes1 {
-	phy-supply = <&vreg_l5a>;
-	status = "okay";
-};
-
-&sleep_clk {
-	clock-frequency = <32764>;
-};
-
-&spi16 {
-	pinctrl-0 = <&qup_spi16_default>;
-	pinctrl-names = "default";
-	status = "okay";
-};
-
-&tlmm {
-	ethernet0_default: ethernet0-default-state {
-		ethernet0_mdc: ethernet0-mdc-pins {
-			pins = "gpio8";
-			function = "emac0_mdc";
-			drive-strength = <16>;
-			bias-pull-up;
-		};
-
-		ethernet0_mdio: ethernet0-mdio-pins {
-			pins = "gpio9";
-			function = "emac0_mdio";
-			drive-strength = <16>;
-			bias-pull-up;
-		};
-	};
-
-	qup_uart10_default: qup-uart10-state {
-		pins = "gpio46", "gpio47";
-		function = "qup1_se3";
-	};
-
-	qup_spi16_default: qup-spi16-state {
-		pins = "gpio86", "gpio87", "gpio88", "gpio89";
-		function = "qup2_se2";
-		drive-strength = <6>;
-		bias-disable;
-	};
-
-	qup_i2c11_default: qup-i2c11-state {
-		pins = "gpio48", "gpio49";
-		function = "qup1_se4";
-		drive-strength = <2>;
-		bias-pull-up;
-	};
-
-	qup_i2c18_default: qup-i2c18-state {
-		pins = "gpio95", "gpio96";
-		function = "qup2_se4";
-		drive-strength = <2>;
-		bias-pull-up;
-	};
-
-	qup_uart12_default: qup-uart12-state {
-		qup_uart12_cts: qup-uart12-cts-pins {
-			pins = "gpio52";
-			function = "qup1_se5";
-			bias-disable;
-		};
-
-		qup_uart12_rts: qup-uart12-rts-pins {
-			pins = "gpio53";
-			function = "qup1_se5";
-			bias-pull-down;
-		};
-
-		qup_uart12_tx: qup-uart12-tx-pins {
-			pins = "gpio54";
-			function = "qup1_se5";
-			bias-pull-up;
-		};
-
-		qup_uart12_rx: qup-uart12-rx-pins {
-			pins = "gpio55";
-			function = "qup1_se5";
-			bias-pull-down;
-		};
-	};
-
-	qup_uart17_default: qup-uart17-state {
-		qup_uart17_cts: qup-uart17-cts-pins {
-			pins = "gpio91";
-			function = "qup2_se3";
-			bias-disable;
-		};
-
-		qup_uart17_rts: qup0-uart17-rts-pins {
-			pins = "gpio92";
-			function = "qup2_se3";
-			bias-pull-down;
-		};
-
-		qup_uart17_tx: qup0-uart17-tx-pins {
-			pins = "gpio93";
-			function = "qup2_se3";
-			bias-pull-up;
-		};
-
-		qup_uart17_rx: qup0-uart17-rx-pins {
-			pins = "gpio94";
-			function = "qup2_se3";
-			bias-pull-down;
-		};
-	};
-
-	pcie0_default_state: pcie0-default-state {
-		perst-pins {
-			pins = "gpio2";
-			function = "gpio";
-			drive-strength = <2>;
-			bias-pull-down;
-		};
-
-		clkreq-pins {
-			pins = "gpio1";
-			function = "pcie0_clkreq";
-			drive-strength = <2>;
-			bias-pull-up;
-		};
-
-		wake-pins {
-			pins = "gpio0";
-			function = "gpio";
-			drive-strength = <2>;
-			bias-pull-up;
-		};
-	};
-
-	pcie1_default_state: pcie1-default-state {
-		perst-pins {
-			pins = "gpio4";
-			function = "gpio";
-			drive-strength = <2>;
-			bias-pull-down;
-		};
-
-		clkreq-pins {
-			pins = "gpio3";
-			function = "pcie1_clkreq";
-			drive-strength = <2>;
-			bias-pull-up;
-		};
-
-		wake-pins {
-			pins = "gpio5";
-			function = "gpio";
-			drive-strength = <2>;
-			bias-pull-up;
-		};
-	};
-};
-
-&pcie0 {
-	perst-gpios = <&tlmm 2 GPIO_ACTIVE_LOW>;
-	wake-gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
-
-	pinctrl-names = "default";
-	pinctrl-0 = <&pcie0_default_state>;
-
-	status = "okay";
-};
-
-&pcie1 {
-	perst-gpios = <&tlmm 4 GPIO_ACTIVE_LOW>;
-	wake-gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>;
-
-	pinctrl-names = "default";
-	pinctrl-0 = <&pcie1_default_state>;
-
-	status = "okay";
-};
-
-&pcie0_phy {
-	vdda-phy-supply = <&vreg_l5a>;
-	vdda-pll-supply = <&vreg_l1c>;
-
-	status = "okay";
-};
-
-&pcie1_phy {
-	vdda-phy-supply = <&vreg_l5a>;
-	vdda-pll-supply = <&vreg_l1c>;
-
-	status = "okay";
-};
-
-&uart10 {
-	compatible = "qcom,geni-debug-uart";
-	pinctrl-0 = <&qup_uart10_default>;
-	pinctrl-names = "default";
-	status = "okay";
-};
-
-&uart12 {
-	pinctrl-0 = <&qup_uart12_default>;
-	pinctrl-names = "default";
-	status = "okay";
-};
-
-&uart17 {
-	pinctrl-0 = <&qup_uart17_default>;
-	pinctrl-names = "default";
-	status = "okay";
-};
-
-&ufs_mem_hc {
-	reset-gpios = <&tlmm 149 GPIO_ACTIVE_LOW>;
-	vcc-supply = <&vreg_l8a>;
-	vcc-max-microamp = <1100000>;
-	vccq-supply = <&vreg_l4c>;
-	vccq-max-microamp = <1200000>;
-
-	status = "okay";
-};
-
-&ufs_mem_phy {
-	vdda-phy-supply = <&vreg_l4a>;
-	vdda-pll-supply = <&vreg_l1c>;
-
-	status = "okay";
-};
-
-&usb_0 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&usb0_en_state>;
-
-	status = "okay";
-};
-
-&usb_0_dwc3 {
-	dr_mode = "peripheral";
-};
-
-&usb_0_hsphy {
-	vdda-pll-supply = <&vreg_l7a>;
-	vdda18-supply = <&vreg_l6c>;
-	vdda33-supply = <&vreg_l9a>;
-
-	status = "okay";
-};
-
-&usb_0_qmpphy {
-	vdda-phy-supply = <&vreg_l1c>;
-	vdda-pll-supply = <&vreg_l7a>;
-
-	status = "okay";
-};
-
-&usb_1 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&usb1_en_state>;
-
-	status = "okay";
-};
-
-&usb_1_dwc3 {
-	dr_mode = "host";
-};
-
-&usb_1_hsphy {
-	vdda-pll-supply = <&vreg_l7a>;
-	vdda18-supply = <&vreg_l6c>;
-	vdda33-supply = <&vreg_l9a>;
-
-	status = "okay";
-};
-
-&usb_1_qmpphy {
-	vdda-phy-supply = <&vreg_l1c>;
-	vdda-pll-supply = <&vreg_l7a>;
-
-	status = "okay";
-};
-
-&usb_2 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&usb2_en_state>;
-
-	status = "okay";
-};
-
-&usb_2_dwc3 {
-	dr_mode = "host";
-};
-
-&usb_2_hsphy {
-	vdda-pll-supply = <&vreg_l7a>;
-	vdda18-supply = <&vreg_l6c>;
-	vdda33-supply = <&vreg_l9a>;
-
-	status = "okay";
-};
-
-&xo_board_clk {
-	clock-frequency = <38400000>;
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi
@@ -0,0 +1,1320 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2023, Linaro Limited
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/regulator/qcom,rpmh-regulator.h>
+
+#include "sa8775p.dtsi"
+#include "sa8775p-pmics.dtsi"
+
+/ {
+	aliases {
+		ethernet0 = &ethernet0;
+		ethernet1 = &ethernet1;
+		i2c11 = &i2c11;
+		i2c18 = &i2c18;
+		serial0 = &uart10;
+		serial1 = &uart12;
+		serial2 = &uart17;
+		spi16 = &spi16;
+		ufshc1 = &ufs_mem_hc;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	vreg_conn_1p8: vreg_conn_1p8 {
+		compatible = "regulator-fixed";
+		regulator-name = "vreg_conn_1p8";
+		startup-delay-us = <4000>;
+		enable-active-high;
+		gpio = <&pmm8654au_1_gpios 4 GPIO_ACTIVE_HIGH>;
+	};
+
+	dsi_dp1 {
+		compatible = "dp-connector";
+		type = "full-size";
+
+		port {
+			dsi_dp_1_in: endpoint {
+			};
+		};
+	};
+
+	dsi_dp2 {
+		compatible = "dp-connector";
+		type = "full-size";
+
+		port {
+			dsi_dp_2_in: endpoint {
+			};
+		};
+	};
+
+	vreg_conn_pa: vreg_conn_pa {
+		compatible = "regulator-fixed";
+		regulator-name = "vreg_conn_pa";
+		startup-delay-us = <4000>;
+		enable-active-high;
+		gpio = <&pmm8654au_1_gpios 6 GPIO_ACTIVE_HIGH>;
+	};
+
+	wcn6855-pmu {
+		compatible = "qcom,wcn6855-pmu";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&bt_en_state>, <&wlan_en_state>;
+
+		vddio-supply = <&vreg_conn_pa>;
+		vddaon-supply = <&vreg_l2c>;
+		vddpmu-supply = <&vreg_conn_1p8>;
+		vddrfa0p95-supply = <&vreg_l2c>;
+		vddrfa1p3-supply = <&vreg_l6e>;
+		vddrfa1p9-supply = <&vreg_s5a>;
+		vddpcie1p3-supply = <&vreg_l6e>;
+		vddpcie1p9-supply = <&vreg_s5a>;
+
+		bt-enable-gpios = <&pmm8654au_1_gpios 8 GPIO_ACTIVE_HIGH>;
+		wlan-enable-gpios = <&pmm8654au_1_gpios 7 GPIO_ACTIVE_HIGH>;
+
+		regulators {
+			vreg_pmu_rfa_cmn: ldo0 {
+				regulator-name = "vreg_pmu_rfa_cmn";
+			};
+
+			vreg_pmu_aon_0p59: ldo1 {
+				regulator-name = "vreg_pmu_aon_0p59";
+			};
+
+			vreg_pmu_wlcx_0p8: ldo2 {
+				regulator-name = "vreg_pmu_wlcx_0p8";
+			};
+
+			vreg_pmu_wlmx_0p85: ldo3 {
+				regulator-name = "vreg_pmu_wlmx_0p85";
+			};
+
+			vreg_pmu_btcmx_0p85: ldo4 {
+				regulator-name = "vreg_pmu_btcmx_0p85";
+			};
+
+			vreg_pmu_rfa_0p8: ldo5 {
+				regulator-name = "vreg_pmu_rfa_0p8";
+			};
+
+			vreg_pmu_rfa_1p2: ldo6 {
+				regulator-name = "vreg_pmu_rfa_1p2";
+			};
+
+			vreg_pmu_rfa_1p7: ldo7 {
+				regulator-name = "vreg_pmu_rfa_1p7";
+			};
+
+			vreg_pmu_pcie_0p9: ldo8 {
+				regulator-name = "vreg_pmu_pcie_0p9";
+			};
+
+			vreg_pmu_pcie_1p8: ldo9 {
+				regulator-name = "vreg_pmu_pcie_1p8";
+			};
+		};
+	};
+};
+
+&apps_rsc {
+	regulators-0 {
+		compatible = "qcom,pmm8654au-rpmh-regulators";
+		qcom,pmic-id = "a";
+
+		vreg_s4a: smps4 {
+			regulator-name = "vreg_s4a";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1816000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5a: smps5 {
+			regulator-name = "vreg_s5a";
+			regulator-min-microvolt = <1850000>;
+			regulator-max-microvolt = <1996000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s9a: smps9 {
+			regulator-name = "vreg_s9a";
+			regulator-min-microvolt = <535000>;
+			regulator-max-microvolt = <1120000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l4a: ldo4 {
+			regulator-name = "vreg_l4a";
+			regulator-min-microvolt = <788000>;
+			regulator-max-microvolt = <1050000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l5a: ldo5 {
+			regulator-name = "vreg_l5a";
+			regulator-min-microvolt = <870000>;
+			regulator-max-microvolt = <950000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6a: ldo6 {
+			regulator-name = "vreg_l6a";
+			regulator-min-microvolt = <870000>;
+			regulator-max-microvolt = <970000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7a: ldo7 {
+			regulator-name = "vreg_l7a";
+			regulator-min-microvolt = <720000>;
+			regulator-max-microvolt = <950000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8a: ldo8 {
+			regulator-name = "vreg_l8a";
+			regulator-min-microvolt = <2504000>;
+			regulator-max-microvolt = <3300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l9a: ldo9 {
+			regulator-name = "vreg_l9a";
+			regulator-min-microvolt = <2970000>;
+			regulator-max-microvolt = <3544000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-1 {
+		compatible = "qcom,pmm8654au-rpmh-regulators";
+		qcom,pmic-id = "c";
+
+		vreg_l1c: ldo1 {
+			regulator-name = "vreg_l1c";
+			regulator-min-microvolt = <1140000>;
+			regulator-max-microvolt = <1260000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2c: ldo2 {
+			regulator-name = "vreg_l2c";
+			regulator-min-microvolt = <900000>;
+			regulator-max-microvolt = <1100000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3c: ldo3 {
+			regulator-name = "vreg_l3c";
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l4c: ldo4 {
+			regulator-name = "vreg_l4c";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			/*
+			 * FIXME: This should have regulator-allow-set-load but
+			 * we're getting an over-current fault from the PMIC
+			 * when switching to LPM.
+			 */
+		};
+
+		vreg_l5c: ldo5 {
+			regulator-name = "vreg_l5c";
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6c: ldo6 {
+			regulator-name = "vreg_l6c";
+			regulator-min-microvolt = <1620000>;
+			regulator-max-microvolt = <1980000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7c: ldo7 {
+			regulator-name = "vreg_l7c";
+			regulator-min-microvolt = <1620000>;
+			regulator-max-microvolt = <2000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8c: ldo8 {
+			regulator-name = "vreg_l8c";
+			regulator-min-microvolt = <2400000>;
+			regulator-max-microvolt = <3300000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l9c: ldo9 {
+			regulator-name = "vreg_l9c";
+			regulator-min-microvolt = <1650000>;
+			regulator-max-microvolt = <2700000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-2 {
+		compatible = "qcom,pmm8654au-rpmh-regulators";
+		qcom,pmic-id = "e";
+
+		vreg_s4e: smps4 {
+			regulator-name = "vreg_s4e";
+			regulator-min-microvolt = <970000>;
+			regulator-max-microvolt = <1520000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s7e: smps7 {
+			regulator-name = "vreg_s7e";
+			regulator-min-microvolt = <1010000>;
+			regulator-max-microvolt = <1170000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s9e: smps9 {
+			regulator-name = "vreg_s9e";
+			regulator-min-microvolt = <300000>;
+			regulator-max-microvolt = <570000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6e: ldo6 {
+			regulator-name = "vreg_l6e";
+			regulator-min-microvolt = <1280000>;
+			regulator-max-microvolt = <1450000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8e: ldo8 {
+			regulator-name = "vreg_l8e";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1950000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+};
+
+&ethernet0 {
+	phy-handle = <&sgmii_phy0>;
+
+	pinctrl-0 = <&ethernet0_default>;
+	pinctrl-names = "default";
+
+	snps,mtl-rx-config = <&mtl_rx_setup>;
+	snps,mtl-tx-config = <&mtl_tx_setup>;
+	snps,ps-speed = <1000>;
+
+	status = "okay";
+
+	mdio: mdio {
+		compatible = "snps,dwmac-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	mtl_rx_setup: rx-queues-config {
+		snps,rx-queues-to-use = <4>;
+		snps,rx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x0>;
+			snps,route-up;
+			snps,priority = <0x1>;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x1>;
+			snps,route-ptp;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x2>;
+			snps,route-avcp;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x3>;
+			snps,priority = <0xc>;
+		};
+	};
+
+	mtl_tx_setup: tx-queues-config {
+		snps,tx-queues-to-use = <4>;
+		snps,tx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+	};
+};
+
+&ethernet1 {
+	phy-handle = <&sgmii_phy1>;
+
+	snps,mtl-rx-config = <&mtl_rx_setup1>;
+	snps,mtl-tx-config = <&mtl_tx_setup1>;
+	snps,ps-speed = <1000>;
+
+	status = "okay";
+
+	mtl_rx_setup1: rx-queues-config {
+		snps,rx-queues-to-use = <4>;
+		snps,rx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x0>;
+			snps,route-up;
+			snps,priority = <0x1>;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+			snps,map-to-dma-channel = <0x1>;
+			snps,route-ptp;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x2>;
+			snps,route-avcp;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,map-to-dma-channel = <0x3>;
+			snps,priority = <0xc>;
+		};
+	};
+
+	mtl_tx_setup1: tx-queues-config {
+		snps,tx-queues-to-use = <4>;
+		snps,tx-sched-sp;
+
+		queue0 {
+			snps,dcb-algorithm;
+		};
+
+		queue1 {
+			snps,dcb-algorithm;
+		};
+
+		queue2 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+
+		queue3 {
+			snps,avb-algorithm;
+			snps,send_slope = <0x1000>;
+			snps,idle_slope = <0x1000>;
+			snps,high_credit = <0x3e800>;
+			snps,low_credit = <0xffc18000>;
+		};
+	};
+};
+
+&eud {
+	status = "okay";
+};
+
+&gpi_dma0 {
+	status = "okay";
+};
+
+&gpi_dma1 {
+	status = "okay";
+};
+
+&gpi_dma2 {
+	status = "okay";
+};
+
+&gpi_dma3 {
+	status = "okay";
+};
+
+&i2c11 {
+	clock-frequency = <400000>;
+	pinctrl-0 = <&qup_i2c11_default>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&i2c18 {
+	clock-frequency = <400000>;
+	pinctrl-0 = <&qup_i2c18_default
+		    &ioexp_intr_active
+		    &ioexp_reset_active>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	ioexp: gpio@74 {
+		compatible = "ti,tca9539";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x74>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <98 IRQ_TYPE_EDGE_BOTH>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&dsi0_hpd_cfg_pins
+			    &dsi0_cdet_cfg_pins
+			    &dsi1_hpd_cfg_pins
+			    &dsi1_cdet_cfg_pins>;
+
+		dsi0_hpd_cfg_pins: gpio2-cfg {
+			pins = "gpio2";
+			input-enable;
+			bias-disable;
+		};
+
+		dsi0_cdet_cfg_pins: gpio3-cfg {
+			pins = "gpio3";
+			bias-pull-down;
+		};
+
+		dsi1_hpd_cfg_pins: gpio10-cfg {
+			pins = "gpio10";
+			input-enable;
+			bias-disable;
+		};
+
+		dsi1_cdet_cfg_pins: gpio11-cfg {
+			pins = "gpio11";
+			bias-pull-down;
+		};
+	};
+
+	i2c-mux@70 {
+		compatible = "nxp,pca9543";
+		#address-cells = <1>;
+
+		#size-cells = <0>;
+		reg = <0x70>;
+
+		i2c@0 {
+			reg = <0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			anx_7625_1: anx7625@58 {
+				compatible = "analogix,anx7625";
+				reg = <0x58>;
+				interrupt-parent = <&ioexp>;
+				interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
+				enable-gpios = <&ioexp 1 0>;
+				reset-gpios = <&ioexp 0 0>;
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					mipi2dp_bridge_1_in: port@0 {
+						reg = <0>;
+						anx7625_1_in: endpoint {
+							remote-endpoint = <&mdss0_dsi0_out>;
+						};
+					};
+
+					mipi2dp_bridge_1_out: port@1 {
+						reg = <1>;
+						anx7625_1_out: endpoint {
+							remote-endpoint = <&dsi_dp_1_in>;
+						};
+					};
+				};
+			};
+		};
+
+		i2c@1 {
+			reg = <1>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			anx_7625_2: anx7625@58 {
+				compatible = "analogix,anx7625";
+				reg = <0x58>;
+				interrupt-parent = <&ioexp>;
+				interrupts = <10 IRQ_TYPE_EDGE_FALLING>;
+				enable-gpios = <&ioexp 9 0>;
+				reset-gpios = <&ioexp 8 0>;
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					mipi2dp_bridge_2_in: port@0 {
+						reg = <0>;
+						anx7625_2_in: endpoint {
+							remote-endpoint = <&mdss0_dsi1_out>;
+						};
+					};
+
+					mipi2dp_bridge_2_out: port@1 {
+						reg = <1>;
+						anx7625_2_out: endpoint {
+							remote-endpoint = <&dsi_dp_2_in>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&mdss0 {
+	status = "okay";
+};
+
+&mdss0_dsi0 {
+	vdda-supply = <&vreg_l1c>;
+	status = "okay";
+};
+
+&mdss0_dsi1 {
+	vdda-supply = <&vreg_l1c>;
+	status = "okay";
+};
+
+&mdss0_dsi0_phy {
+	vdds-supply = <&vreg_l4a>;
+	status = "okay";
+};
+
+&mdss0_dsi1_phy {
+	vdds-supply = <&vreg_l4a>;
+	status = "okay";
+};
+
+&mdss0_dp0 {
+	status = "okay";
+};
+
+&mdss0_dp0_out {
+	data-lanes = <0 1 2 3>;
+	link-frequencies = /bits/ 64 <1620000000 2700000000 5400000000 8100000000>;
+};
+
+&mdss0_edp_phy {
+	status = "okay";
+};
+
+&mdss0_dp1 {
+	status = "okay";
+};
+
+&mdss0_dp1_out {
+	data-lanes = <0 1 2 3>;
+	link-frequencies = /bits/ 64 <1620000000 2700000000 5400000000 8100000000>;
+};
+
+&mdss0_edp1_phy {
+	status = "okay";
+};
+
+&mdss0_dsi0_out {
+	data-lanes = <0 1 2 3>;
+	remote-endpoint = <&anx7625_1_in>;
+};
+
+&mdss0_dsi1_out {
+	data-lanes = <0 1 2 3>;
+	remote-endpoint = <&anx7625_2_in>;
+};
+
+&dsi_dp_1_in {
+	remote-endpoint = <&anx7625_1_out>;
+};
+
+&dsi_dp_2_in {
+	remote-endpoints = <&anx7625_2_out>;
+};
+
+&pmm8654au_0_gpios {
+	gpio-line-names = "DS_EN",
+			  "POFF_COMPLETE",
+			  "UFS0_VER_ID",
+			  "FAST_POFF",
+			  "DBU1_PON_DONE",
+			  "AOSS_SLEEP",
+			  "CAM_DES0_EN",
+			  "CAM_DES1_EN",
+			  "CAM_DES2_EN",
+			  "CAM_DES3_EN",
+			  "UEFI",
+			  "ANALOG_PON_OPT";
+};
+
+&pmm8654au_0_pon_resin {
+	linux,code = <KEY_VOLUMEDOWN>;
+	status = "okay";
+};
+
+&pmm8654au_1_gpios {
+	gpio-line-names = "PMIC_C_ID0",
+			  "PMIC_C_ID1",
+			  "UFS1_VER_ID",
+			  "IPA_PWR",
+			  "",
+			  "WLAN_DBU4_EN",
+			  "WLAN_EN",
+			  "BT_EN",
+			  "USB2_PWR_EN",
+			  "USB2_FAULT";
+
+	wlan_en_state: wlan-en-state {
+		pins = "gpio7";
+		function = "normal";
+		output-low;
+		bias-pull-down;
+	};
+
+	bt_en_state: bt-en-state {
+		pins = "gpio8";
+		function = "normal";
+		output-low;
+		bias-pull-down;
+	};
+
+	usb2_en_state: usb2-en-state {
+		pins = "gpio9";
+		function = "normal";
+		output-high;
+		power-source = <0>;
+	};
+};
+
+&pmm8654au_2_gpios {
+	gpio-line-names = "PMIC_E_ID0",
+			  "PMIC_E_ID1",
+			  "USB0_PWR_EN",
+			  "USB0_FAULT",
+			  "SENSOR_IRQ_1",
+			  "SENSOR_IRQ_2",
+			  "SENSOR_RST",
+			  "SGMIIO0_RST",
+			  "SGMIIO1_RST",
+			  "USB1_PWR_ENABLE",
+			  "USB1_FAULT",
+			  "VMON_SPX8";
+
+	usb0_en_state: usb0-en-state {
+		pins = "gpio3";
+		function = "normal";
+		output-high;
+		power-source = <0>;
+	};
+
+	usb1_en_state: usb1-en-state {
+		pins = "gpio10";
+		function = "normal";
+		output-high;
+		power-source = <0>;
+	};
+};
+
+&pmm8654au_3_gpios {
+	gpio-line-names = "PMIC_G_ID0",
+			  "PMIC_G_ID1",
+			  "GNSS_RST",
+			  "GNSS_EN",
+			  "GNSS_BOOT_MODE";
+};
+
+&qupv3_id_0 {
+	status = "okay";
+};
+
+&qupv3_id_1 {
+	status = "okay";
+};
+
+&qupv3_id_2 {
+	status = "okay";
+};
+
+&qupv3_id_3 {
+	status = "okay";
+};
+
+&serdes0 {
+	phy-supply = <&vreg_l5a>;
+	status = "okay";
+};
+
+&serdes1 {
+	phy-supply = <&vreg_l5a>;
+	status = "okay";
+};
+
+&sleep_clk {
+	clock-frequency = <32000>;
+};
+
+&spi16 {
+	pinctrl-0 = <&qup_spi16_default>;
+	pinctrl-names = "default";
+	status = "okay";
+	spidev@0 {
+		compatible = "rohm,dh2228fv";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+		spi-cpha;
+	};
+};
+
+&tlmm {
+	dp_hot_plug_det: dp-hot-plug-det-state {
+		pins = "gpio101";
+		function = "edp0_hot";
+	};
+
+	dp1_hot_plug_det: dp1-hot-plug-det-state {
+		pins = "gpio102";
+		function = "edp1_hot";
+		bias-disable;
+	};
+
+	dp1_hot_plug_det: dp1-hot-plug-det-state {
+		pins = "gpio102";
+		function = "edp1_hot";
+		bias-disable;
+	};
+
+	ioexp_intr_active: ioexp_intr_active {
+		pins = "gpio98";
+		function = "gpio";
+		drive-strength = <2>;
+		input-enable;
+		bias-disable;
+	};
+
+	ioexp_reset_active: ioexp_reset_active {
+		pins = "gpio97";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-disable;
+		output-high;
+	};
+
+	ethernet0_default: ethernet0-default-state {
+		ethernet0_mdc: ethernet0-mdc-pins {
+			pins = "gpio8";
+			function = "emac0_mdc";
+			drive-strength = <16>;
+			bias-pull-up;
+		};
+
+		ethernet0_mdio: ethernet0-mdio-pins {
+			pins = "gpio9";
+			function = "emac0_mdio";
+			drive-strength = <16>;
+			bias-pull-up;
+		};
+	};
+
+	qup_uart10_default: qup-uart10-state {
+		pins = "gpio46", "gpio47";
+		function = "qup1_se3";
+	};
+
+	qup_spi16_default: qup-spi16-state {
+		pins = "gpio86", "gpio87", "gpio88", "gpio89";
+		function = "qup2_se2";
+		drive-strength = <6>;
+		bias-disable;
+	};
+
+	qup_i2c11_default: qup-i2c11-state {
+		pins = "gpio48", "gpio49";
+		function = "qup1_se4";
+		drive-strength = <2>;
+		bias-pull-up;
+	};
+
+	qup_i2c18_default: qup-i2c18-state {
+		pins = "gpio95", "gpio96";
+		function = "qup2_se4";
+		drive-strength = <2>;
+		bias-pull-up;
+	};
+
+	qup_uart12_default: qup-uart12-state {
+		qup_uart12_cts: qup-uart12-cts-pins {
+			pins = "gpio52";
+			function = "qup1_se5";
+			bias-disable;
+		};
+
+		qup_uart12_rts: qup-uart12-rts-pins {
+			pins = "gpio53";
+			function = "qup1_se5";
+			bias-pull-down;
+		};
+
+		qup_uart12_tx: qup-uart12-tx-pins {
+			pins = "gpio54";
+			function = "qup1_se5";
+			bias-pull-up;
+		};
+
+		qup_uart12_rx: qup-uart12-rx-pins {
+			pins = "gpio55";
+			function = "qup1_se5";
+			bias-pull-down;
+		};
+	};
+
+	qup_uart17_default: qup-uart17-state {
+		qup_uart17_cts: qup-uart17-cts-pins {
+			pins = "gpio91";
+			function = "qup2_se3";
+			bias-disable;
+		};
+
+		qup_uart17_rts: qup0-uart17-rts-pins {
+			pins = "gpio92";
+			function = "qup2_se3";
+			bias-pull-down;
+		};
+
+		qup_uart17_tx: qup0-uart17-tx-pins {
+			pins = "gpio93";
+			function = "qup2_se3";
+			bias-pull-up;
+		};
+
+		qup_uart17_rx: qup0-uart17-rx-pins {
+			pins = "gpio94";
+			function = "qup2_se3";
+			bias-pull-down;
+		};
+	};
+
+	pcie0_default_state: pcie0-default-state {
+		perst-pins {
+			pins = "gpio2";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+
+		clkreq-pins {
+			pins = "gpio1";
+			function = "pcie0_clkreq";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+
+		wake-pins {
+			pins = "gpio0";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+
+	pcie1_default_state: pcie1-default-state {
+		perst-pins {
+			pins = "gpio4";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+
+		clkreq-pins {
+			pins = "gpio3";
+			function = "pcie1_clkreq";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+
+		wake-pins {
+			pins = "gpio5";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+&pcie0 {
+	perst-gpios = <&tlmm 2 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_default_state>;
+
+	iommu-map = <0x0 &pcie_smmu 0x0000 0x1>,
+		    <0x100 &pcie_smmu 0x0001 0x1>,
+		    <0x101 &pcie_smmu 0x0002 0x1>,
+		    <0x208 &pcie_smmu 0x0003 0x1>,
+		    <0x210 &pcie_smmu 0x0004 0x1>,
+		    <0x218 &pcie_smmu 0x0005 0x1>,
+		    <0x280 &pcie_smmu 0x0006 0x1>,
+		    <0x281 &pcie_smmu 0x0007 0x1>,
+		    <0x282 &pcie_smmu 0x0008 0x1>,
+		    <0x283 &pcie_smmu 0x0009 0x1>,
+		    <0x284 &pcie_smmu 0x000a 0x1>,
+		    <0x285 &pcie_smmu 0x000b 0x1>,
+		    <0x286 &pcie_smmu 0x000c 0x1>,
+		    <0x287 &pcie_smmu 0x000d 0x1>,
+		    <0x288 &pcie_smmu 0x000e 0x1>,
+		    <0x289 &pcie_smmu 0x000f 0x1>,
+		    <0x28a &pcie_smmu 0x0010 0x1>,
+		    <0x28b &pcie_smmu 0x0011 0x1>,
+		    <0x28c &pcie_smmu 0x0012 0x1>,
+		    <0x28d &pcie_smmu 0x0013 0x1>,
+		    <0x28e &pcie_smmu 0x0014 0x1>,
+		    <0x28f &pcie_smmu 0x0015 0x1>,
+		    <0x290 &pcie_smmu 0x0016 0x1>,
+		    <0x291 &pcie_smmu 0x0017 0x1>,
+		    <0x292 &pcie_smmu 0x0018 0x1>,
+		    <0x293 &pcie_smmu 0x0019 0x1>,
+		    <0x300 &pcie_smmu 0x001a 0x1>,
+		    <0x400 &pcie_smmu 0x001b 0x1>,
+		    <0x500 &pcie_smmu 0x001c 0x1>,
+		    <0x501 &pcie_smmu 0x001d 0x1>;
+
+	status = "okay";
+};
+
+&pcie1 {
+	perst-gpios = <&tlmm 4 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie1_default_state>;
+
+	iommu-map = <0x0 &pcie_smmu 0x0080 0x1>,
+		    <0x100 &pcie_smmu 0x0081 0x1>,
+		    <0x101 &pcie_smmu 0x0082 0x1>,
+		    <0x208 &pcie_smmu 0x0083 0x1>,
+		    <0x210 &pcie_smmu 0x0084 0x1>,
+		    <0x218 &pcie_smmu 0x0085 0x1>,
+		    <0x280 &pcie_smmu 0x0086 0x1>,
+		    <0x281 &pcie_smmu 0x0087 0x1>,
+		    <0x282 &pcie_smmu 0x0088 0x1>,
+		    <0x283 &pcie_smmu 0x0089 0x1>,
+		    <0x284 &pcie_smmu 0x008a 0x1>,
+		    <0x285 &pcie_smmu 0x008b 0x1>,
+		    <0x286 &pcie_smmu 0x008c 0x1>,
+		    <0x287 &pcie_smmu 0x008d 0x1>,
+		    <0x288 &pcie_smmu 0x008e 0x1>,
+		    <0x289 &pcie_smmu 0x008f 0x1>,
+		    <0x28a &pcie_smmu 0x0090 0x1>,
+		    <0x28b &pcie_smmu 0x0091 0x1>,
+		    <0x28c &pcie_smmu 0x0092 0x1>,
+		    <0x28d &pcie_smmu 0x0093 0x1>,
+		    <0x28e &pcie_smmu 0x0094 0x1>,
+		    <0x28f &pcie_smmu 0x0095 0x1>,
+		    <0x290 &pcie_smmu 0x0096 0x1>,
+		    <0x291 &pcie_smmu 0x0097 0x1>,
+		    <0x292 &pcie_smmu 0x0098 0x1>,
+		    <0x29d &pcie_smmu 0x0099 0x1>,
+		    <0x300 &pcie_smmu 0x009a 0x1>,
+		    <0x400 &pcie_smmu 0x009b 0x1>,
+		    <0x500 &pcie_smmu 0x009c 0x1>,
+		    <0x501 &pcie_smmu 0x009d 0x1>;
+
+	status = "okay";
+};
+
+&pcie0_phy {
+	vdda-phy-supply = <&vreg_l5a>;
+	vdda-pll-supply = <&vreg_l1c>;
+
+	status = "okay";
+};
+
+&pcie1_phy {
+	vdda-phy-supply = <&vreg_l5a>;
+	vdda-pll-supply = <&vreg_l1c>;
+
+	status = "okay";
+};
+
+&pcieport0 {
+	wifi@0 {
+		compatible = "pci17cb,1101";
+		reg = <0x10000 0x0 0x0 0x0 0x0>;
+
+		qcom,ath11k-calibration-variant = "QC_SA8775P_Ride";
+
+		vddrfacmn-supply = <&vreg_pmu_rfa_cmn>;
+		vddaon-supply = <&vreg_pmu_aon_0p59>;
+		vddwlcx-supply = <&vreg_pmu_wlcx_0p8>;
+		vddwlmx-supply = <&vreg_pmu_wlmx_0p85>;
+		vddrfa0p8-supply = <&vreg_pmu_rfa_0p8>;
+		vddrfa1p2-supply = <&vreg_pmu_rfa_1p2>;
+		vddrfa1p7-supply = <&vreg_pmu_rfa_1p7>;
+		vddpcie0p9-supply = <&vreg_pmu_pcie_0p9>;
+		vddpcie1p8-supply = <&vreg_pmu_pcie_1p8>;
+	};
+};
+
+&remoteproc_adsp {
+	firmware-name = "qcom/sa8775p/adsp.mbn";
+	status = "okay";
+};
+
+&remoteproc_cdsp0 {
+	firmware-name = "qcom/sa8775p/cdsp0.mbn";
+	status = "okay";
+};
+
+&remoteproc_cdsp1 {
+	firmware-name = "qcom/sa8775p/cdsp1.mbn";
+	status = "okay";
+};
+
+&remoteproc_gpdsp0 {
+	firmware-name = "qcom/sa8775p/gpdsp0.mbn";
+	status = "okay";
+};
+
+&remoteproc_gpdsp1 {
+	firmware-name = "qcom/sa8775p/gpdsp1.mbn";
+	status = "okay";
+};
+
+&gpi_dma0 {
+	status = "okay";
+};
+
+&gpi_dma1 {
+	status = "okay";
+};
+
+&gpi_dma2 {
+	status = "okay";
+};
+
+&gpi_dma3 {
+	status = "okay";
+};
+
+&uart10 {
+	compatible = "qcom,geni-debug-uart";
+	pinctrl-0 = <&qup_uart10_default>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&uart12 {
+	pinctrl-0 = <&qup_uart12_default>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&uart17 {
+	pinctrl-0 = <&qup_uart17_default>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	bluetooth {
+		compatible = "qcom,wcn6855-bt";
+		firmware-name = "QCA6698/hpnv21", "QCA6698/hpbtfw21.tlv";
+
+		vddrfacmn-supply = <&vreg_pmu_rfa_cmn>;
+		vddaon-supply = <&vreg_pmu_aon_0p59>;
+		vddbtcmx-supply = <&vreg_pmu_btcmx_0p85>;
+		vddrfa0p8-supply = <&vreg_pmu_rfa_0p8>;
+		vddrfa1p2-supply = <&vreg_pmu_rfa_1p2>;
+		vddrfa1p7-supply = <&vreg_pmu_rfa_1p7>;
+	};
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 149 GPIO_ACTIVE_LOW>;
+	vcc-supply = <&vreg_l8a>;
+	vcc-max-microamp = <1100000>;
+	vccq-supply = <&vreg_l4c>;
+	vccq-max-microamp = <1200000>;
+
+	status = "okay";
+};
+
+&ufs_mem_phy {
+	vdda-phy-supply = <&vreg_l4a>;
+	vdda-pll-supply = <&vreg_l1c>;
+
+	status = "okay";
+};
+
+&usb_0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&usb0_en_state>;
+
+	status = "okay";
+};
+
+&usb_0_dwc3 {
+	snps,dis-u2-entry-quirk;
+	snps,dis-u1-entry-quirk;
+	snps,dis_u2_susphy_quirk;
+	snps,dis_u3_susphy_quirk;
+
+	dr_mode = "peripheral";
+};
+
+&usb_0_hsphy {
+	vdda-pll-supply = <&vreg_l7a>;
+	vdda18-supply = <&vreg_l6c>;
+	vdda33-supply = <&vreg_l9a>;
+
+	status = "okay";
+};
+
+&usb_0_qmpphy {
+	vdda-phy-supply = <&vreg_l1c>;
+	vdda-pll-supply = <&vreg_l7a>;
+
+	status = "okay";
+};
+
+&usb_1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&usb1_en_state>;
+
+	status = "okay";
+};
+
+&usb_1_dwc3 {
+	snps,dwc3_guctl_resbwhseps_quirk;
+	dr_mode = "host";
+};
+
+&usb_1_hsphy {
+	vdda-pll-supply = <&vreg_l7a>;
+	vdda18-supply = <&vreg_l6c>;
+	vdda33-supply = <&vreg_l9a>;
+
+	status = "okay";
+};
+
+&usb_1_qmpphy {
+	vdda-phy-supply = <&vreg_l1c>;
+	vdda-pll-supply = <&vreg_l7a>;
+
+	status = "okay";
+};
+
+&usb_2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&usb2_en_state>;
+
+	status = "okay";
+};
+
+&usb_2_dwc3 {
+	snps,dwc3_guctl_resbwhseps_quirk;
+	dr_mode = "host";
+};
+
+&usb_2_hsphy {
+	vdda-pll-supply = <&vreg_l7a>;
+	vdda18-supply = <&vreg_l6c>;
+	vdda33-supply = <&vreg_l9a>;
+
+	status = "okay";
+};
+
+&xo_board_clk {
+	clock-frequency = <38400000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-video.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-video.dtsi
@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+&soc {
+	iris: video-codec@aa00000 {
+		compatible = "qcom,sa8775p-iris";
+
+		reg = <0 0x0aa00000 0 0xf0000>;
+		interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>;
+
+		power-domains = <&videocc VIDEO_CC_MVS0C_GDSC>,
+			<&videocc VIDEO_CC_MVS0_GDSC>,
+			<&rpmhpd SA8775P_MX>,
+			<&rpmhpd SA8775P_MMCX>;
+
+		power-domain-names = "iris-ctl", "vcodec", "mx", "mmcx";
+		operating-points-v2 = <&iris_opp_table>;
+
+		clocks = <&gcc GCC_VIDEO_AXI0_CLK>,
+				<&videocc VIDEO_CC_MVS0C_CLK>,
+				<&videocc VIDEO_CC_MVS0_CLK>;
+		clock-names = "gcc_video_axi0", "core_clk", "vcodec_clk";
+
+		interconnects =
+			<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+				&config_noc SLAVE_VENUS_CFG QCOM_ICC_TAG_ALWAYS>,
+			<&mmss_noc MASTER_VIDEO_P0 QCOM_ICC_TAG_ALWAYS
+				&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+		interconnect-names = "iris-cnoc", "iris-ddr";
+
+		/* FW load region */
+		memory-region = <&pil_video_mem>;
+
+		resets = <&gcc GCC_VIDEO_AXI0_CLK_ARES>;
+		reset-names = "video_axi_reset";
+
+		status = "okay";
+
+		/* MMUs */
+		video_resv_region: video_resv_region {
+			iommu-addresses = <&non_secure_cb 0x0 0x0 0x0 0x25800000>,
+					<&non_secure_cb 0x0 0xe0000000 0x0 0x20000000>,
+					<&secure_non_pixel_cb 0x0 0x0 0x0 0x01000000>,
+					<&secure_non_pixel_cb 0x0 0x25800000 0x0 0xda800000>,
+					<&non_secure_pixel_cb 0x0 0x0 0x0 0x00100000>,
+					<&non_secure_pixel_cb 0x0 0xe0000000 0x0 0x20000000>;
+		};
+
+		non_secure_cb: non_secure_cb {
+			compatible = "qcom,vidc,cb-ns";
+			iommus = <&apps_smmu 0x0880 0x0400>;
+			memory-region = <&video_resv_region>;
+		};
+
+		secure_non_pixel_cb: secure_non_pixel_cb {
+			compatible = "qcom,vidc,cb-sec-non-pxl";
+			iommus = <&apps_smmu 0x0884 0x0400>;
+			memory-region = <&video_resv_region>;
+		};
+
+		non_secure_pixel_cb: non_secure_pixel_cb {
+			compatible = "qcom,vidc,cb-ns-pxl";
+			iommus = <&apps_smmu 0x0887 0x0400>;
+			memory-region = <&video_resv_region>;
+		};
+
+		iris_opp_table: opp-table {
+			compatible = "operating-points-v2";
+
+			opp-366000000 {
+				opp-hz = /bits/ 64 <366000000>;
+				required-opps = <&rpmhpd_opp_svs_l1>,
+						<&rpmhpd_opp_svs_l1>;
+			};
+
+			opp-444000000 {
+				opp-hz = /bits/ 64 <444000000>;
+				required-opps = <&rpmhpd_opp_nom>,
+						<&rpmhpd_opp_nom>;
+			};
+
+			opp-533000000 {
+				opp-hz = /bits/ 64 <533000000>;
+				required-opps = <&rpmhpd_opp_turbo>,
+						<&rpmhpd_opp_turbo>;
+			};
+
+			opp-560000000 {
+				opp-hz = /bits/ 64 <560000000>;
+				required-opps = <&rpmhpd_opp_turbo_l1>,
+						<&rpmhpd_opp_turbo_l1>;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p-video.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p-video.dtso
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <dt-bindings/interconnect/qcom,icc.h>
+#include <dt-bindings/clock/qcom,sa8775p-gcc.h>
+#include <dt-bindings/interconnect/qcom,sa8775p-rpmh.h>
+#include <dt-bindings/clock/qcom,sa8775p-dispcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-videocc.h>
+#include "sa8775p-video.dtsi"
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sa8775p.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sa8775p.dtsi
@@ -1,17 +1,27 @@
 // SPDX-License-Identifier: BSD-3-Clause
 /*
  * Copyright (c) 2023, Linaro Limited
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <dt-bindings/interconnect/qcom,icc.h>
+#include <dt-bindings/interconnect/qcom,osm-l3.h>
 #include <dt-bindings/interrupt-controller/arm-gic.h>
 #include <dt-bindings/clock/qcom,rpmh.h>
+#include <dt-bindings/clock/qcom,sa8775p-camcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-dispcc.h>
 #include <dt-bindings/clock/qcom,sa8775p-gcc.h>
 #include <dt-bindings/clock/qcom,sa8775p-gpucc.h>
+#include <dt-bindings/clock/qcom,sa8775p-videocc.h>
+#include <dt-bindings/dma/qcom-gpi.h>
 #include <dt-bindings/interconnect/qcom,sa8775p-rpmh.h>
 #include <dt-bindings/mailbox/qcom-ipcc.h>
+#include <dt-bindings/firmware/qcom,scm.h>
+#include <dt-bindings/power/qcom,rpmhpd.h>
 #include <dt-bindings/power/qcom-rpmpd.h>
 #include <dt-bindings/soc/qcom,rpmh-rsc.h>
+#include <dt-bindings/soc/qcom,gpr.h>
+#include <dt-bindings/sound/qcom,q6dsp-lpass-ports.h>
 
 / {
 	interrupt-parent = <&intc>;
@@ -19,6 +29,23 @@
 	#address-cells = <2>;
 	#size-cells = <2>;
 
+	audio-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+		device-name = "audio_etm0";
+
+		qcom,inst-id = <5>;
+		atid = <40>;
+
+		out-ports {
+			port {
+				audio_out: endpoint {
+					remote-endpoint =
+					<&lpi_funnel_in0>;
+				};
+			};
+		};
+	};
+
 	clocks {
 		xo_board_clk: xo-board-clk {
 			compatible = "fixed-clock";
@@ -42,6 +69,13 @@
 			enable-method = "psci";
 			qcom,freq-domain = <&cpufreq_hw 0>;
 			next-level-cache = <&L2_0>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			operating-points-v2 = <&cpu0_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl0 MASTER_EPSS_L3_APPS
+					&epss_l3_cl0 SLAVE_EPSS_L3_SHARED>;
 			L2_0: l2-cache {
 				compatible = "cache";
 				cache-level = <2>;
@@ -62,6 +96,13 @@
 			enable-method = "psci";
 			qcom,freq-domain = <&cpufreq_hw 0>;
 			next-level-cache = <&L2_1>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			operating-points-v2 = <&cpu0_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl0 MASTER_EPSS_L3_APPS
+					&epss_l3_cl0 SLAVE_EPSS_L3_SHARED>;
 			L2_1: l2-cache {
 				compatible = "cache";
 				cache-level = <2>;
@@ -77,6 +118,13 @@
 			enable-method = "psci";
 			qcom,freq-domain = <&cpufreq_hw 0>;
 			next-level-cache = <&L2_2>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			operating-points-v2 = <&cpu0_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl0 MASTER_EPSS_L3_APPS
+					&epss_l3_cl0 SLAVE_EPSS_L3_SHARED>;
 			L2_2: l2-cache {
 				compatible = "cache";
 				cache-level = <2>;
@@ -92,6 +140,13 @@
 			enable-method = "psci";
 			qcom,freq-domain = <&cpufreq_hw 0>;
 			next-level-cache = <&L2_3>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			operating-points-v2 = <&cpu0_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl0 MASTER_EPSS_L3_APPS
+					&epss_l3_cl0 SLAVE_EPSS_L3_SHARED>;
 			L2_3: l2-cache {
 				compatible = "cache";
 				cache-level = <2>;
@@ -107,6 +162,13 @@
 			enable-method = "psci";
 			qcom,freq-domain = <&cpufreq_hw 1>;
 			next-level-cache = <&L2_4>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			operating-points-v2 = <&cpu4_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl1 MASTER_EPSS_L3_APPS
+					&epss_l3_cl1 SLAVE_EPSS_L3_SHARED>;
 			L2_4: l2-cache {
 				compatible = "cache";
 				cache-level = <2>;
@@ -128,6 +190,13 @@
 			enable-method = "psci";
 			qcom,freq-domain = <&cpufreq_hw 1>;
 			next-level-cache = <&L2_5>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			operating-points-v2 = <&cpu4_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl1 MASTER_EPSS_L3_APPS
+					&epss_l3_cl1 SLAVE_EPSS_L3_SHARED>;
 			L2_5: l2-cache {
 				compatible = "cache";
 				cache-level = <2>;
@@ -143,6 +212,13 @@
 			enable-method = "psci";
 			qcom,freq-domain = <&cpufreq_hw 1>;
 			next-level-cache = <&L2_6>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			operating-points-v2 = <&cpu4_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl1 MASTER_EPSS_L3_APPS
+					&epss_l3_cl1 SLAVE_EPSS_L3_SHARED>;
 			L2_6: l2-cache {
 				compatible = "cache";
 				cache-level = <2>;
@@ -158,6 +234,13 @@
 			enable-method = "psci";
 			qcom,freq-domain = <&cpufreq_hw 1>;
 			next-level-cache = <&L2_7>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
+			operating-points-v2 = <&cpu4_opp_table>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>,
+					<&epss_l3_cl1 MASTER_EPSS_L3_APPS
+					&epss_l3_cl1 SLAVE_EPSS_L3_SHARED>;
 			L2_7: l2-cache {
 				compatible = "cache";
 				cache-level = <2>;
@@ -205,56 +288,199 @@
 		};
 	};
 
-	firmware {
-		scm {
-			compatible = "qcom,scm-sa8775p", "qcom,scm";
+	cpu0_opp_table: opp-table-cpu0 {
+		compatible = "operating-points-v2";
+		opp-shared;
+
+		cpu0_opp_1267mhz: opp-1267200000 {
+			opp-hz = /bits/ 64 <1267200000>;
+			opp-peak-kBps = <6220800 29491200>;
 		};
-	};
 
-	aggre1_noc: interconnect-aggre1-noc {
-		compatible = "qcom,sa8775p-aggre1-noc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
-	};
+		cpu0_opp_1363mhz: opp-1363200000 {
+			opp-hz = /bits/ 64 <1363200000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
 
-	aggre2_noc: interconnect-aggre2-noc {
-		compatible = "qcom,sa8775p-aggre2-noc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
-	};
+		cpu0_opp_1459mhz: opp-1459200000 {
+			opp-hz = /bits/ 64 <1459200000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
 
-	clk_virt: interconnect-clk-virt {
-		compatible = "qcom,sa8775p-clk-virt";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
-	};
+		cpu0_opp_1536mhz: opp-1536000000 {
+			opp-hz = /bits/ 64 <1536000000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
 
-	config_noc: interconnect-config-noc {
-		compatible = "qcom,sa8775p-config-noc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
+		cpu0_opp_1632mhz: opp-1632000000 {
+			opp-hz = /bits/ 64 <1632000000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_1708mhz: opp-1708800000 {
+			opp-hz = /bits/ 64 <1708800000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_1785mhz: opp-1785600000 {
+			opp-hz = /bits/ 64 <1785600000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_1862mhz: opp-1862400000 {
+			opp-hz = /bits/ 64 <1862400000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_1939mhz: opp-1939200000 {
+			opp-hz = /bits/ 64 <1939200000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_2016mhz: opp-2016000000 {
+			opp-hz = /bits/ 64 <2016000000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu0_opp_2112mhz: opp-2112000000 {
+			opp-hz = /bits/ 64 <2112000000>;
+			opp-peak-kBps = <8371200 49766400>;
+		};
+
+		cpu0_opp_2188mhz: opp-2188800000 {
+			opp-hz = /bits/ 64 <2188800000>;
+			opp-peak-kBps = <8371200 49766400>;
+		};
+
+		cpu0_opp_2265mhz: opp-2265600000 {
+			opp-hz = /bits/ 64 <2265600000>;
+			opp-peak-kBps = <8371200 49766400>;
+		};
+
+		cpu0_opp_2361mhz: opp-2361600000 {
+			opp-hz = /bits/ 64 <2361600000>;
+			opp-peak-kBps = <12787200 51609600>;
+		};
+
+		cpu0_opp_2457mhz: opp-2457600000 {
+			opp-hz = /bits/ 64 <2457600000>;
+			opp-peak-kBps = <12787200 51609600>;
+		};
+
+		cpu0_opp_2553mhz: opp-2553600000 {
+			opp-hz = /bits/ 64 <2553600000>;
+			opp-peak-kBps = <12787200 54681600>;
+		};
 	};
 
-	dc_noc: interconnect-dc-noc {
-		compatible = "qcom,sa8775p-dc-noc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
+	cpu4_opp_table: opp-table-cpu4 {
+		compatible = "operating-points-v2";
+		opp-shared;
+
+		cpu4_opp_1267mhz: opp-1267200000 {
+			opp-hz = /bits/ 64 <1267200000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu4_opp_1363mhz: opp-1363200000 {
+			opp-hz = /bits/ 64 <1363200000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu4_opp_1459mhz: opp-1459200000 {
+			opp-hz = /bits/ 64 <1459200000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu4_opp_1536mhz: opp-1536000000 {
+			opp-hz = /bits/ 64 <1536000000>;
+			opp-peak-kBps = <6220800 29491200>;
+		};
+
+		cpu4_opp_1632mhz: opp-1632000000 {
+			opp-hz = /bits/ 64 <1632000000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu4_opp_1708mhz: opp-1708800000 {
+			opp-hz = /bits/ 64 <1708800000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu4_opp_1785mhz: opp-1785600000 {
+			opp-hz = /bits/ 64 <1785600000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu4_opp_1862mhz: opp-1862400000 {
+			opp-hz = /bits/ 64 <1862400000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu4_opp_1939mhz: opp-1939200000 {
+			opp-hz = /bits/ 64 <1939200000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu4_opp_2016mhz: opp-2016000000 {
+			opp-hz = /bits/ 64 <2016000000>;
+			opp-peak-kBps = <6835200 39321600>;
+		};
+
+		cpu4_opp_2112mhz: opp-2112000000 {
+			opp-hz = /bits/ 64 <2112000000>;
+			opp-peak-kBps = <8371200 49766400>;
+		};
+
+		cpu4_opp_2188mhz: opp-2188800000 {
+			opp-hz = /bits/ 64 <2188800000>;
+			opp-peak-kBps = <8371200 49766400>;
+		};
+
+		cpu4_opp_2265mhz: opp-2265600000 {
+			opp-hz = /bits/ 64 <2265600000>;
+			opp-peak-kBps = <8371200 49766400>;
+		};
+
+		cpu4_opp_2361mhz: opp-2361600000 {
+			opp-hz = /bits/ 64 <2361600000>;
+			opp-peak-kBps = <12787200 51609600>;
+		};
+
+		cpu4_opp_2457mhz: opp-2457600000 {
+			opp-hz = /bits/ 64 <2457600000>;
+			opp-peak-kBps = <12787200 51609600>;
+		};
+
+		cpu4_opp_2553mhz: opp-2553600000 {
+			opp-hz = /bits/ 64 <2553600000>;
+			opp-peak-kBps = <12787200 54681600>;
+		};
 	};
 
-	gem_noc: interconnect-gem-noc {
-		compatible = "qcom,sa8775p-gem-noc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
+	dummy-sink {
+		compatible = "arm,coresight-dummy-sink";
+
+		in-ports {
+			port {
+				eud_in: endpoint {
+					remote-endpoint =
+					<&swao_rep_out1>;
+				};
+			};
+		};
 	};
 
-	gpdsp_anoc: interconnect-gpdsp-anoc {
-		compatible = "qcom,sa8775p-gpdsp-anoc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
+	firmware {
+		scm {
+			compatible = "qcom,scm-sa8775p", "qcom,scm";
+			qcom,dload-mode = <&tcsr 0x13000>;
+			memory-region = <&tz_ffi_mem>;
+		};
 	};
 
-	lpass_ag_noc: interconnect-lpass-ag-noc {
-		compatible = "qcom,sa8775p-lpass-ag-noc";
+	clk_virt: interconnect-clk-virt {
+		compatible = "qcom,sa8775p-clk-virt";
 		#interconnect-cells = <2>;
 		qcom,bcm-voters = <&apps_bcm_voter>;
 	};
@@ -265,34 +491,108 @@
 		qcom,bcm-voters = <&apps_bcm_voter>;
 	};
 
-	mmss_noc: interconnect-mmss-noc {
-		compatible = "qcom,sa8775p-mmss-noc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
-	};
+	lpass-funnel {
+		compatible = "arm,coresight-static-funnel";
 
-	nspa_noc: interconnect-nspa-noc {
-		compatible = "qcom,sa8775p-nspa-noc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
+		out-ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				lpass_funnel_out0: endpoint {
+					remote-endpoint =
+					<&dlct0_tpda_in0>;
+				};
+			};
+
+			port@1 {
+				reg = <1>;
+				lpass_funnel_out1: endpoint {
+					remote-endpoint =
+					<&dlct0_funnel_in1>;
+				};
+			};
+		};
+
+		in-ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				lpass_funnel_in0: endpoint {
+					remote-endpoint =
+					<&lpass_tpdm_out>;
+				};
+			};
+		};
 	};
 
-	nspb_noc: interconnect-nspb-noc {
-		compatible = "qcom,sa8775p-nspb-noc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
+	lpass-stm {
+		compatible = "arm,coresight-dummy-source";
+		device-name = "stm_lpass";
+
+		arm,trace-id = <25>;
+
+		out-ports {
+			port {
+				lpass_stm_out: endpoint {
+					remote-endpoint =
+					<&lpi_funnel_in1>;
+				};
+			};
+		};
 	};
 
-	pcie_anoc: interconnect-pcie-anoc {
-		compatible = "qcom,sa8775p-pcie-anoc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
+	lpi-funnel {
+		compatible = "arm,coresight-static-funnel";
+
+		out-ports {
+			port {
+				lpi_funnel_out: endpoint {
+					remote-endpoint =
+					<&aoss_funnel_in5>;
+				};
+			};
+		};
+
+		in-ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				lpi_funnel_in0: endpoint {
+					remote-endpoint =
+					<&audio_out>;
+				};
+			};
+
+			port@1 {
+				reg = <1>;
+				lpi_funnel_in1: endpoint {
+					remote-endpoint =
+					<&lpass_stm_out>;
+				};
+			};
+
+			port@5 {
+				reg = <5>;
+				lpi_funnel_in5: endpoint {
+					remote-endpoint =
+					<&lpi_tpdm_out>;
+				};
+			};
+		};
 	};
 
-	system_noc: interconnect-system-noc {
-		compatible = "qcom,sa8775p-system-noc";
-		#interconnect-cells = <2>;
-		qcom,bcm-voters = <&apps_bcm_voter>;
+	qcom,smp2p_sleepstate {
+		compatible = "qcom,smp2p-sleepstate";
+		qcom,smem-states = <&sleepstate_smp2p_out 0>;
+		interrupt-parent = <&sleepstate_smp2p_in>;
+		interrupts = <0 0>;
+		interrupt-names = "smp2p-sleepstate-in";
 	};
 
 	/* Will be updated by the bootloader. */
@@ -318,6 +618,8 @@
 	psci {
 		compatible = "arm,psci-1.0";
 		method = "smc";
+		mode-bootloader = <0x10001 0x2>;
+		mode-edl = <0 0x1>;
 	};
 
 	reserved-memory {
@@ -356,13 +658,18 @@
 			no-map;
 		};
 
+		ddr_training_checksum: ddr-training-checksum@908c0000 {
+			reg = <0x0 0x908c0000 0x0 0x1000>;
+			no-map;
+		};
+
 		reserved_mem: reserved@908f0000 {
-			reg = <0x0 0x908f0000 0x0 0xf000>;
+			reg = <0x0 0x908f0000 0x0 0xe000>;
 			no-map;
 		};
 
-		secdata_apss_mem: secdata-apss@908ff000 {
-			reg = <0x0 0x908ff000 0x0 0x1000>;
+		secdata_apss_mem: secdata-apss@908fe000 {
+			reg = <0x0 0x908fe000 0x0 0x2000>;
 			no-map;
 		};
 
@@ -373,8 +680,49 @@
 			hwlocks = <&tcsr_mutex 3>;
 		};
 
-		cpucp_fw_mem: cpucp-fw@90b00000 {
-			reg = <0x0 0x90b00000 0x0 0x100000>;
+		tz_sail_mailbox_mem: tz-sail-mailbox@90c00000 {
+			reg = <0x0 0x90c00000 0x0 0x100000>;
+			no-map;
+		};
+
+		sail_mailbox_mem: sail-ss@90d00000 {
+			reg = <0x0 0x90d00000 0x0 0x100000>;
+			no-map;
+		};
+
+		sail_ota_mem: sail-ss@90e00000 {
+			reg = <0x0 0x90e00000 0x0 0x300000>;
+			no-map;
+		};
+
+		aoss_backup_mem: aoss-backup@91b00000 {
+			reg = <0x0 0x91b00000 0x0 0x40000>;
+			no-map;
+		};
+
+		cpucp_backup_mem: cpucp-backup@91b40000 {
+			reg = <0x0 0x91b40000 0x0 0x40000>;
+			no-map;
+		};
+
+		tz_config_backup_mem: tz-config-backup@91b80000 {
+			reg = <0x0 0x91b80000 0x0 0x10000>;
+			no-map;
+		};
+
+		ddr_training_data_mem: ddr-training-data@91b90000 {
+			reg = <0x0 0x91b90000 0x0 0x10000>;
+			no-map;
+		};
+
+		cdt_data_backup_mem: cdt-data-backup@91ba0000 {
+			reg = <0x0 0x91ba0000 0x0 0x1000>;
+			no-map;
+		};
+
+		tz_ffi_mem: tz-ffi@91c00000 {
+			compatible = "shared-dma-pool";
+			reg = <0x0 0x91c00000 0x0 0x1400000>;
 			no-map;
 		};
 
@@ -389,7 +737,7 @@
 		};
 
 		pil_camera_mem: pil-camera@95200000 {
-			reg = <0x0 0x95200000 0x0 0x500000>;
+			reg = <0x0 0x95200000 0x0 0x700000>;
 			no-map;
 		};
 
@@ -433,13 +781,43 @@
 			no-map;
 		};
 
+		audio_mdf_mem: audio-mdf-region@ae000000 {
+			reg = <0x0 0xae000000 0x0 0x1000000>;
+			no-map;
+		};
+
+		firmware_mem: firmware-region@b0000000 {
+			reg = <0x0 0xb0000000 0x0 0x800000>;
+			no-map;
+		};
+
 		hyptz_reserved_mem: hyptz-reserved@beb00000 {
 			reg = <0x0 0xbeb00000 0x0 0x11500000>;
 			no-map;
 		};
 
-		tz_stat_mem: tz-stat@d0000000 {
-			reg = <0x0 0xd0000000 0x0 0x100000>;
+		scmi_mem: scmi-region@d0000000 {
+			reg = <0x0 0xd0000000 0x0 0x40000>;
+			no-map;
+		};
+
+		firmware_logs_mem: firmware-logs@d0040000 {
+			reg = <0x0 0xd0040000 0x0 0x10000>;
+			no-map;
+		};
+
+		firmware_audio_mem: firmware-audio@d0050000 {
+			reg = <0x0 0xd0050000 0x0 0x4000>;
+			no-map;
+		};
+
+		firmware_reserved_mem: firmware-reserved@d0054000 {
+			reg = <0x0 0xd0054000 0x0 0x9c000>;
+			no-map;
+		};
+
+		firmware_quantum_test_mem: firmware-quantum-test@d00f0000 {
+			reg = <0x0 0xd00f0000 0x0 0x10000>;
 			no-map;
 		};
 
@@ -453,10 +831,228 @@
 			no-map;
 		};
 
-		trusted_apps_mem: trusted-apps@d1800000 {
-			reg = <0x0 0xd1800000 0x0 0x3900000>;
+		deepsleep_backup_mem: deepsleep-backup@d1800000 {
+			reg = <0x0 0xd1800000 0x0 0x100000>;
+			no-map;
+		};
+
+		trusted_apps_mem: trusted-apps@d1900000 {
+			reg = <0x0 0xd1900000 0x0 0x3800000>;
+			no-map;
+		};
+
+		tz_stat_mem: tz-stat@db100000 {
+			reg = <0x0 0xdb100000 0x0 0x100000>;
+			no-map;
+		};
+
+		cpucp_fw_mem: cpucp-fw@db200000 {
+			reg = <0x0 0xdb200000 0x0 0x100000>;
 			no-map;
 		};
+
+		cdsp_secure_heap: secure-cdsp-region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x2000000>;
+		};
+	};
+
+	smp2p-adsp {
+		compatible = "qcom,smp2p";
+		qcom,smem = <443>, <429>;
+		interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+					     IPCC_MPROC_SIGNAL_SMP2P
+					     IRQ_TYPE_EDGE_RISING>;
+		mboxes = <&ipcc IPCC_CLIENT_LPASS IPCC_MPROC_SIGNAL_SMP2P>;
+
+		qcom,local-pid = <0>;
+		qcom,remote-pid = <2>;
+
+		smp2p_adsp_out: master-kernel {
+			qcom,entry-name = "master-kernel";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_adsp_in: slave-kernel {
+			qcom,entry-name = "slave-kernel";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		sleepstate_smp2p_in: sleepstate-in {
+			qcom,entry-name = "sleepstate_see";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		sleepstate_smp2p_out: sleepstate-out {
+			qcom,entry-name = "sleepstate";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_rdbg2_out: smp2p-rdbg2-out {
+			qcom,entry-name = "rdbg";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_rdbg2_in: smp2p-rdbg2-in {
+			qcom,entry-name = "rdbg";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	smp2p-cdsp0 {
+		compatible = "qcom,smp2p";
+		qcom,smem = <94>, <432>;
+		interrupts-extended = <&ipcc IPCC_CLIENT_CDSP
+					     IPCC_MPROC_SIGNAL_SMP2P
+					     IRQ_TYPE_EDGE_RISING>;
+		mboxes = <&ipcc IPCC_CLIENT_CDSP IPCC_MPROC_SIGNAL_SMP2P>;
+
+		qcom,local-pid = <0>;
+		qcom,remote-pid = <5>;
+
+		smp2p_cdsp0_out: master-kernel {
+			qcom,entry-name = "master-kernel";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_cdsp0_in: slave-kernel {
+			qcom,entry-name = "slave-kernel";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		smp2p_rdbg5_out: smp2p-rdbg5-out {
+			qcom,entry-name = "rdbg";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_rdbg5_in: smp2p-rdbg5-in {
+			qcom,entry-name = "rdbg";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	smp2p-cdsp1 {
+		compatible = "qcom,smp2p";
+		qcom,smem = <617>, <616>;
+		interrupts-extended = <&ipcc IPCC_CLIENT_NSP1
+					     IPCC_MPROC_SIGNAL_SMP2P
+					     IRQ_TYPE_EDGE_RISING>;
+		mboxes = <&ipcc IPCC_CLIENT_NSP1 IPCC_MPROC_SIGNAL_SMP2P>;
+
+		qcom,local-pid = <0>;
+		qcom,remote-pid = <12>;
+
+		smp2p_cdsp1_out: master-kernel {
+			qcom,entry-name = "master-kernel";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_cdsp1_in: slave-kernel {
+			qcom,entry-name = "slave-kernel";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		smp2p_rdbg12_out: smp2p-rdbg12-out {
+			qcom,entry-name = "rdbg";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_rdbg12_in: smp2p-rdbg12-in {
+			qcom,entry-name = "rdbg";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	smp2p-gpdsp0 {
+		compatible = "qcom,smp2p";
+		qcom,smem = <617>, <616>;
+		interrupts-extended = <&ipcc IPCC_CLIENT_GPDSP0
+					     IPCC_MPROC_SIGNAL_SMP2P
+					     IRQ_TYPE_EDGE_RISING>;
+		mboxes = <&ipcc IPCC_CLIENT_GPDSP0 IPCC_MPROC_SIGNAL_SMP2P>;
+
+		qcom,local-pid = <0>;
+		qcom,remote-pid = <17>;
+
+		smp2p_gpdsp0_out: master-kernel {
+			qcom,entry-name = "master-kernel";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_gpdsp0_in: slave-kernel {
+			qcom,entry-name = "slave-kernel";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	smp2p-gpdsp1 {
+		compatible = "qcom,smp2p";
+		qcom,smem = <617>, <616>;
+		interrupts-extended = <&ipcc IPCC_CLIENT_GPDSP1
+					     IPCC_MPROC_SIGNAL_SMP2P
+					     IRQ_TYPE_EDGE_RISING>;
+		mboxes = <&ipcc IPCC_CLIENT_GPDSP1 IPCC_MPROC_SIGNAL_SMP2P>;
+
+		qcom,local-pid = <0>;
+		qcom,remote-pid = <18>;
+
+		smp2p_gpdsp1_out: master-kernel {
+			qcom,entry-name = "master-kernel";
+			#qcom,smem-state-cells = <1>;
+		};
+
+		smp2p_gpdsp1_in: slave-kernel {
+			qcom,entry-name = "slave-kernel";
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+	};
+
+	qcom-smp2p-interrupt-rdbg-2-in {
+		compatible = "qcom,smp2p-interrupt-rdbg-2-in";
+		interrupts-extended = <&smp2p_rdbg2_in 0 IRQ_TYPE_NONE>;
+		interrupt-names = "rdbg-smp2p-in";
+	};
+
+	qcom-smp2p-interrupt-rdbg-2-out {
+		compatible = "qcom,smp2p-interrupt-rdbg-2-out";
+		qcom,smem-states = <&smp2p_rdbg2_out 0>;
+		qcom,smem-state-names = "rdbg-smp2p-out";
+	};
+
+	qcom-smp2p-interrupt-rdbg-5-in {
+		compatible = "qcom,smp2p-interrupt-rdbg-5-in";
+		interrupts-extended = <&smp2p_rdbg5_in 0 IRQ_TYPE_NONE>;
+		interrupt-names = "rdbg-smp2p-in";
+	};
+
+	qcom-smp2p-interrupt-rdbg-5-out {
+		compatible = "qcom,smp2p-interrupt-rdbg-5-out";
+		qcom,smem-states = <&smp2p_rdbg5_out 0>;
+		qcom,smem-state-names = "rdbg-smp2p-out";
+	};
+
+	qcom-smp2p-interrupt-rdbg-12-in {
+		compatible = "qcom,smp2p-interrupt-rdbg-12-in";
+		interrupts-extended = <&smp2p_rdbg12_in 0 IRQ_TYPE_NONE>;
+		interrupt-names = "rdbg-smp2p-in";
+	};
+
+	qcom-smp2p-interrupt-rdbg-12-out {
+		compatible = "qcom,smp2p-interrupt-rdbg-12-out";
+		qcom,smem-states = <&smp2p_rdbg12_out 0>;
+		qcom,smem-state-names = "rdbg-smp2p-out";
 	};
 
 	soc: soc@0 {
@@ -498,6 +1094,40 @@
 			#mbox-cells = <2>;
 		};
 
+		qfprom: efuse@784000 {
+			compatible = "qcom,qfprom";
+			reg = <0x0 0x00784000 0x0 0x11d0>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			gpu_speed_bin: gpu-speed-bin@15c {
+				reg = <0x15c 0x1>;
+				bits = <5 3>;
+			};
+		};
+
+		gpi_dma2: qcom,gpi-dma@800000  {
+			compatible = "qcom,sm6350-gpi-dma";
+			reg = <0x0 0x00800000 0x0 0x60000>;
+			#dma-cells = <3>;
+			interrupts = <GIC_SPI 588 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 589 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 590 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 591 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 592 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 593 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 594 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 595 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 596 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 597 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 598 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 599 IRQ_TYPE_LEVEL_HIGH>;
+			dma-channels = <12>;
+			dma-channel-mask = <0xfff>;
+			iommus = <&apps_smmu 0x5b6 0x0>;
+			status = "disabled";
+		};
+
 		qupv3_id_2: geniqup@8c0000 {
 			compatible = "qcom,geni-se-qup";
 			reg = <0x0 0x008c0000 0x0 0x6000>;
@@ -528,6 +1158,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 0 QCOM_GPI_I2C>,
+				       <&gpi_dma2 1 0 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -549,6 +1183,25 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 0 QCOM_GPI_SPI>,
+				       <&gpi_dma2 1 0 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart14: serial@880000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00880000 0x0 0x4000>;
+				interrupts = <GIC_SPI 373 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP2_S0_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
 				status = "disabled";
 			};
 
@@ -570,6 +1223,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 1 QCOM_GPI_I2C>,
+				       <&gpi_dma2 1 1 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -591,6 +1248,25 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 1 QCOM_GPI_SPI>,
+				       <&gpi_dma2 1 1 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart15: serial@884000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00884000 0x0 0x4000>;
+				interrupts = <GIC_SPI 583 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP2_S1_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
 				status = "disabled";
 			};
 
@@ -612,6 +1288,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 2 QCOM_GPI_I2C>,
+				       <&gpi_dma2 1 2 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -631,11 +1311,30 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 2 QCOM_GPI_SPI>,
+				       <&gpi_dma2 1 2 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
 				#address-cells = <1>;
 				#size-cells = <0>;
 				status = "disabled";
 			};
 
+			uart16: serial@888000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00888000 0x0 0x4000>;
+				interrupts = <GIC_SPI 584 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP2_S2_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
+				status = "disabled";
+			};
+
 			i2c17: i2c@88c000 {
 				compatible = "qcom,geni-i2c";
 				reg = <0x0 0x88c000 0x0 0x4000>;
@@ -654,6 +1353,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 3 QCOM_GPI_I2C>,
+				       <&gpi_dma2 1 3 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -675,6 +1378,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 3 QCOM_GPI_SPI>,
+				       <&gpi_dma2 1 3 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -709,6 +1416,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 4 QCOM_GPI_I2C>,
+				       <&gpi_dma2 1 4 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				#address-cells = <1>;
 				#size-cells = <0>;
 				status = "disabled";
@@ -732,6 +1443,25 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 4 QCOM_GPI_SPI>,
+				       <&gpi_dma2 1 4 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart18: serial@890000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00890000 0x0 0x4000>;
+				interrupts = <GIC_SPI 586 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP2_S4_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
 				status = "disabled";
 			};
 
@@ -753,6 +1483,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 5 QCOM_GPI_I2C>,
+				       <&gpi_dma2 1 5 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -774,6 +1508,25 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 5 QCOM_GPI_SPI>,
+				       <&gpi_dma2 1 5 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart19: serial@894000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00894000 0x0 0x4000>;
+				interrupts = <GIC_SPI 587 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP2_S5_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
 				status = "disabled";
 			};
 
@@ -795,6 +1548,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 6 QCOM_GPI_I2C>,
+				       <&gpi_dma2 1 6 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -816,8 +1573,71 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma2 0 6 QCOM_GPI_SPI>,
+				       <&gpi_dma2 1 6 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
+
+			uart20: serial@898000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00898000 0x0 0x4000>;
+				interrupts = <GIC_SPI 834 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP2_S6_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
+				status = "disabled";
+			};
+
+		};
+
+		gpi_dma0: qcom,gpi-dma@900000  {
+			compatible = "qcom,sm6350-gpi-dma";
+			reg = <0x0 0x00900000 0x0 0x60000>;
+			#dma-cells = <3>;
+			interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 246 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 247 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 248 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 250 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 251 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 252 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 253 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 254 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 255 IRQ_TYPE_LEVEL_HIGH>;
+			dma-channels = <12>;
+			dma-channel-mask = <0xfff>;
+			iommus = <&apps_smmu 0x416 0x0>;
+			status = "disabled";
+		};
+
+		eud: eud@88e1000 {
+			compatible = "qcom,secure-eud";
+			reg = <0x0 0x088E1000 0x0 0x2000>,
+			      <0x0 0x088E3000 0x0 0x1000>;
+			interrupts-extended = <&pdc 11 IRQ_TYPE_LEVEL_HIGH>;
+
+			status = "disabled";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					eud_ep: endpoint {
+					};
+				};
+			};
+
 		};
 
 		qupv3_id_0: geniqup@9c0000 {
@@ -850,6 +1670,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 0 QCOM_GPI_I2C>,
+				       <&gpi_dma0 1 0 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -871,6 +1695,25 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 0 QCOM_GPI_SPI>,
+				     <&gpi_dma0 1 0 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart0: serial@980000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x980000 0x0 0x4000>;
+				interrupts = <GIC_SPI 550 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S0_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
 				status = "disabled";
 			};
 
@@ -892,6 +1735,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 1 QCOM_GPI_I2C>,
+				       <&gpi_dma0 1 1 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -913,6 +1760,25 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 1 QCOM_GPI_SPI>,
+				       <&gpi_dma0 1 1 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart1: serial@984000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x984000 0x0 0x4000>;
+				interrupts = <GIC_SPI 551 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S1_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
 				status = "disabled";
 			};
 
@@ -934,6 +1800,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 2 QCOM_GPI_I2C>,
+				       <&gpi_dma0 1 2 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -955,6 +1825,25 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 2 QCOM_GPI_SPI>,
+				       <&gpi_dma0 1 2 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart2: serial@988000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x988000 0x0 0x4000>;
+				interrupts = <GIC_SPI 529 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S2_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
 				status = "disabled";
 			};
 
@@ -976,6 +1865,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 3 QCOM_GPI_I2C>,
+				       <&gpi_dma0 1 3 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -997,6 +1890,25 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 3 QCOM_GPI_SPI>,
+				       <&gpi_dma0 1 3 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart3: serial@98c000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x98c000 0x0 0x4000>;
+				interrupts = <GIC_SPI 530 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S3_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
 				status = "disabled";
 			};
 
@@ -1018,6 +1930,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 4 QCOM_GPI_I2C>,
+				       <&gpi_dma0 1 4 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1039,6 +1955,25 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 4 QCOM_GPI_SPI>,
+				       <&gpi_dma0 1 4 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart4: serial@990000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x990000 0x0 0x4000>;
+				interrupts = <GIC_SPI 531 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&gcc GCC_QUPV3_WRAP0_S4_CLK>;
+				clock-names = "se";
+				interconnects = <&clk_virt MASTER_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_0 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_0 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core", "qup-config";
+				power-domains = <&rpmhpd SA8775P_CX>;
 				status = "disabled";
 			};
 
@@ -1060,6 +1995,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 5 QCOM_GPI_I2C>,
+				       <&gpi_dma0 1 5 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1081,6 +2020,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma0 0 5 QCOM_GPI_SPI>,
+				       <&gpi_dma0 1 5 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1100,6 +2043,28 @@
 			};
 		};
 
+		gpi_dma1: qcom,gpi-dma@a00000  {
+			compatible = "qcom,sm6350-gpi-dma";
+			reg = <0x0 0x00a00000 0x0 0x60000>;
+			#dma-cells = <3>;
+			interrupts = <GIC_SPI 279 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 280 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 283 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 284 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 293 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 294 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 295 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 296 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 298 IRQ_TYPE_LEVEL_HIGH>;
+			iommus = <&apps_smmu 0x456 0x0>;
+			dma-channels = <12>;
+			dma-channel-mask = <0xfff>;
+			status = "disabled";
+		};
+
 		qupv3_id_1: geniqup@ac0000 {
 			compatible = "qcom,geni-se-qup";
 			reg = <0x0 0x00ac0000 0x0 0x6000>;
@@ -1130,6 +2095,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 0 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 0 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1151,6 +2120,26 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 0 QCOM_GPI_SPI>,
+				       <&gpi_dma1 1 0 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart7: serial@a80000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00a80000 0x0 0x4000>;
+				interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+				clock-names = "se";
+				clocks = <&gcc GCC_QUPV3_WRAP1_S0_CLK>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects = <&clk_virt MASTER_QUP_CORE_1 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>;
+				power-domains = <&rpmhpd SA8775P_CX>;
+				operating-points-v2 = <&qup_opp_table_100mhz>;
 				status = "disabled";
 			};
 
@@ -1172,6 +2161,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 1 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 1 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1193,6 +2186,26 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 1 QCOM_GPI_SPI>,
+				       <&gpi_dma1 1 1 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart8: serial@a84000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00a84000 0x0 0x4000>;
+				interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
+				clock-names = "se";
+				clocks = <&gcc GCC_QUPV3_WRAP1_S1_CLK>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects = <&clk_virt MASTER_QUP_CORE_1 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>;
+				power-domains = <&rpmhpd SA8775P_CX>;
+				operating-points-v2 = <&qup_opp_table_100mhz>;
 				status = "disabled";
 			};
 
@@ -1214,6 +2227,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 2 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 2 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1235,6 +2252,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 2 QCOM_GPI_SPI>,
+				       <&gpi_dma1 1 2 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1271,6 +2292,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 3 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 3 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1292,6 +2317,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 3 QCOM_GPI_SPI>,
+				       <&gpi_dma1 1 3 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1329,6 +2358,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 4 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 4 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1350,6 +2383,26 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 4 QCOM_GPI_SPI>,
+				       <&gpi_dma1 1 4 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart11: serial@a90000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00a90000 0x0 0x4000>;
+				interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+				clock-names = "se";
+				clocks = <&gcc GCC_QUPV3_WRAP1_S4_CLK>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects = <&clk_virt MASTER_QUP_CORE_1 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_1 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_1 QCOM_ICC_TAG_ALWAYS>;
+				power-domains = <&rpmhpd SA8775P_CX>;
+				operating-points-v2 = <&qup_opp_table_100mhz>;
 				status = "disabled";
 			};
 
@@ -1371,6 +2424,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 5 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 5 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1392,6 +2449,10 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 5 QCOM_GPI_SPI>,
+				       <&gpi_dma1 1 5 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1428,10 +2489,29 @@
 						     "qup-config",
 						     "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma1 0 6 QCOM_GPI_I2C>,
+				       <&gpi_dma1 1 6 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
+
 			};
 		};
 
+		gpi_dma3: qcom,gpi-dma@b00000  {
+			compatible = "qcom,sm6350-gpi-dma";
+			reg = <0x0 0x00b00000 0x0 0x58000>;
+			#dma-cells = <3>;
+			interrupts = <GIC_SPI 368 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 369 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 527 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 528 IRQ_TYPE_LEVEL_HIGH>;
+			iommus = <&apps_smmu 0x056 0x0>;
+			dma-channels = <4>;
+			dma-channel-mask = <0xf>;
+			status = "disabled";
+		};
+
 		qupv3_id_3: geniqup@bc0000 {
 			compatible = "qcom,geni-se-qup";
 			reg = <0x0 0xbc0000 0x0 0x6000>;
@@ -1462,6 +2542,10 @@
 							 "qup-config",
 							 "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma3 0 0 QCOM_GPI_I2C>,
+				       <&gpi_dma3 1 0 QCOM_GPI_I2C>;
+				dma-names = "tx",
+					    "rx";
 				status = "disabled";
 			};
 
@@ -1483,6 +2567,26 @@
 							 "qup-config",
 							 "qup-memory";
 				power-domains = <&rpmhpd SA8775P_CX>;
+				dmas = <&gpi_dma3 0 0 QCOM_GPI_SPI>,
+				       <&gpi_dma3 1 0 QCOM_GPI_SPI>;
+				dma-names = "tx",
+					    "rx";
+				status = "disabled";
+			};
+
+			uart21: serial@b80000 {
+				compatible = "qcom,geni-uart";
+				reg = <0x0 0x00b80000 0x0 0x4000>;
+				interrupts = <GIC_SPI 831 IRQ_TYPE_LEVEL_HIGH>;
+				clock-names = "se";
+				clocks = <&gcc GCC_QUPV3_WRAP3_S0_CLK>;
+				interconnect-names = "qup-core", "qup-config";
+				interconnects = <&clk_virt MASTER_QUP_CORE_3 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_3 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_3 QCOM_ICC_TAG_ALWAYS>;
+				power-domains = <&rpmhpd SA8775P_CX>;
+				operating-points-v2 = <&qup_opp_table_100mhz>;
 				status = "disabled";
 			};
 		};
@@ -1492,6 +2596,62 @@
 			reg = <0 0x010d2000 0 0x1000>;
 		};
 
+		config_noc: interconnect-config-noc@14c0000 {
+			compatible = "qcom,sa8775p-config-noc";
+			reg = <0x0 0x014c0000 0x0 0x13080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		system_noc: interconnect-system-noc@01680000 {
+			compatible = "qcom,sa8775p-system-noc";
+			reg = <0x0 0x01680000 0x0 0x15080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		aggre1_noc: interconnect-aggre1-noc@16c0000 {
+			compatible = "qcom,sa8775p-aggre1-noc";
+			reg = <0x0 0x016c0000 0x0 0x18080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+			clocks = <&gcc GCC_AGGRE_UFS_PHY_AXI_CLK>,
+				 <&gcc GCC_AGGRE_NOC_QUPV3_AXI_CLK>,
+				 <&gcc GCC_AGGRE_USB2_PRIM_AXI_CLK>,
+				 <&gcc GCC_AGGRE_USB3_PRIM_AXI_CLK>,
+				 <&gcc GCC_AGGRE_USB3_SEC_AXI_CLK>;
+		};
+
+		aggre2_noc: interconnect-aggre2-noc@1700000 {
+			compatible = "qcom,sa8775p-aggre2-noc";
+			reg = <0x0 0x01700000 0x0 0x1b080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+			clocks = <&gcc GCC_AGGRE_UFS_CARD_AXI_CLK>,
+				 <&rpmhcc RPMH_IPA_CLK>;
+		};
+
+		pcie_anoc: interconnect-pcie-anoc@1760000 {
+			compatible = "qcom,sa8775p-pcie-anoc";
+			reg = <0x0 0x01760000 0x0 0xc080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		gpdsp_anoc: interconnect-gpdsp-anoc@1780000 {
+			compatible = "qcom,sa8775p-gpdsp-anoc";
+			reg = <0x0 0x01780000 0x0 0xe080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		mmss_noc: interconnect-mmss-noc@17a0000 {
+			compatible = "qcom,sa8775p-mmss-noc";
+			reg = <0x0 0x017a0000 0x0 0x40000>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
 		ufs_mem_hc: ufs@1d84000 {
 			compatible = "qcom,sa8775p-ufshc", "qcom,ufshc", "jedec,ufs-2.0";
 			reg = <0x0 0x01d84000 0x0 0x3000>;
@@ -1555,10 +2715,2993 @@
 		ice: crypto@1d88000 {
 			compatible = "qcom,sa8775p-inline-crypto-engine",
 				     "qcom,inline-crypto-engine";
-			reg = <0x0 0x01d88000 0x0 0x8000>;
+			reg = <0x0 0x01d88000 0x0 0x18000>;
 			clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>;
 		};
 
+		cryptobam: dma-controller@1dc4000 {
+			compatible = "qcom,bam-v1.7.4", "qcom,bam-v1.7.0";
+			reg = <0x0 0x01dc4000 0x0 0x28000>;
+			interrupts = <GIC_SPI 272 IRQ_TYPE_LEVEL_HIGH>;
+			#dma-cells = <1>;
+			qcom,ee = <0>;
+			qcom,controlled-remotely;
+			iommus = <&apps_smmu 0x480 0x00>,
+				 <&apps_smmu 0x481 0x00>;
+		};
+
+		crypto: crypto@1dfa000 {
+			compatible = "qcom,sa8775p-qce", "qcom,qce";
+			reg = <0x0 0x01dfa000 0x0 0x6000>;
+			dmas = <&cryptobam 4>, <&cryptobam 5>;
+			dma-names = "rx", "tx";
+			iommus = <&apps_smmu 0x480 0x00>,
+				 <&apps_smmu 0x481 0x00>;
+			interconnects = <&aggre2_noc MASTER_CRYPTO_CORE0 0 &mc_virt SLAVE_EBI1 0>;
+			interconnect-names = "memory";
+			qcom,icc_bw = <12473>;
+		};
+
+		stm: stm@4002000 {
+			compatible = "arm,coresight-stm", "arm,primecell";
+			reg = <0x0 0x4002000 0x0 0x1000>,
+				  <0x0 0x16280000 0x0 0x180000>;
+			reg-names = "stm-base", "stm-stimulus-base";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					stm_out: endpoint {
+						remote-endpoint =
+						<&funnel0_in7>;
+					};
+				};
+			};
+		};
+
+		tpdm@4003000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4003000 0x0 0x1000>;
+			device-name = "tpdm_dcc";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					qdss_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&qdss_tpda_in0>;
+					};
+				};
+			};
+		};
+
+		tpda@4004000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4004000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					qdss_tpda_out: endpoint {
+						remote-endpoint =
+						<&funnel0_in6>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					qdss_tpda_in0: endpoint {
+						remote-endpoint =
+						<&qdss_tpdm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					qdss_tpda_in1: endpoint {
+						remote-endpoint =
+						<&qdss_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@400f000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x400f000 0x0 0x1000>;
+			device-name = "tpdm_spdm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					qdss_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&qdss_tpda_in1>;
+					};
+				};
+			};
+		};
+
+		cti@4010000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4010000 0x0 0x1000>;
+			device-name = "cti_qdss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4041000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4041000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					funnel0_out: endpoint {
+						remote-endpoint =
+						<&qdss_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@6 {
+					reg = <6>;
+					funnel0_in6: endpoint {
+						remote-endpoint =
+						<&qdss_tpda_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+					funnel0_in7: endpoint {
+						remote-endpoint =
+						<&stm_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4042000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4042000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					funnel1_out: endpoint {
+						remote-endpoint =
+						<&qdss_funnel_in1>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@4 {
+					reg = <4>;
+					funnel1_in4: endpoint {
+						remote-endpoint =
+						<&apss_funnel1_out>;
+					};
+				};
+				port@5 {
+					reg = <5>;
+					funnel1_in5: endpoint {
+						remote-endpoint =
+						<&dlct0_funnel_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					funnel1_in6: endpoint {
+						remote-endpoint =
+						<&dlhm_funnel_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+					funnel1_in7: endpoint {
+						remote-endpoint =
+						<&dlmm_funnel_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4045000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4045000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					qdss_funnel_out: endpoint {
+						remote-endpoint =
+						<&aoss_funnel_in7>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					qdss_funnel_in0: endpoint {
+						remote-endpoint =
+						<&funnel0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					qdss_funnel_in1: endpoint {
+						remote-endpoint =
+						<&funnel1_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@482c000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x482c000 0x0 0x1000>;
+			device-name = "tpdm_gcc";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					gcc_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in20>;
+					};
+				};
+			};
+		};
+
+		tpdm@4830000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4830000 0x0 0x1000>;
+			device-name = "tpdm_video";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					video_tpdm_out: endpoint {
+						remote-endpoint =
+						<&video_funnel_in0>;
+					};
+				};
+			};
+		};
+
+		funnel@4832000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4832000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					video_funnel_out0: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in2>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					video_funnel_in0: endpoint {
+						remote-endpoint =
+						<&video_tpdm_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4841000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4841000 0x0 0x1000>;
+			device-name = "tpdm_prng";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					prng_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in19>;
+					};
+				};
+			};
+		};
+
+		tpdm@4844000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4844000 0x0 0x1000>;
+			device-name = "tpdm_lpass";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					lpass_tpdm_out: endpoint {
+						remote-endpoint =
+						<&lpass_funnel_in0>;
+					};
+				};
+			};
+		};
+
+		cti@4845000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4845000 0x0 0x1000>;
+			device-name = "cti_lpass";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpdm@4850000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4850000 0x0 0x1000>;
+			device-name = "tpdm_pimem";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					pimem_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in25>;
+					};
+				};
+			};
+		};
+
+		tpdm@4860000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4860000 0x0 0x1000>;
+			device-name = "tpdm_gdsp";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					gdsp_tpdm_out: endpoint {
+						remote-endpoint =
+						<&gdsp_tpda_in31>;
+					};
+				};
+			};
+		};
+
+		cti@4861000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4861000 0x0 0x1000>;
+			device-name = "cti_gdsp_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		cti@4862000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4862000 0x0 0x1000>;
+			device-name = "cti_gdsp_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4863000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4863000 0x0 0x1000>;
+			device-name = "gdsp-tpda";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					gdsp_tpda_out: endpoint {
+						remote-endpoint =
+						<&gdsp_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@9 {
+					reg = <9>;
+					gdsp_tpda_in9: endpoint {
+						remote-endpoint =
+						<&turing2_funnel_out0>;
+					};
+				};
+
+				port@e {
+					reg = <14>;
+					gdsp_tpda_in14: endpoint {
+						remote-endpoint =
+						<&turing3_funnel_out0>;
+					};
+				};
+
+				port@13 {
+					reg = <19>;
+					gdsp_tpda_in19: endpoint {
+						remote-endpoint =
+						<&turing1_funnel_out>;
+					};
+				};
+
+				port@1f {
+					reg = <31>;
+					gdsp_tpda_in31: endpoint {
+						remote-endpoint =
+						<&gdsp_tpdm_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4864000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4864000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					gdsp_funnel_out: endpoint {
+						remote-endpoint =
+						<&dlhm_funnel_in5>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					gdsp_funnel_in0: endpoint {
+						remote-endpoint =
+						<&gdsp_tpda_out>;
+					};
+				};
+			};
+		};
+
+		cti@4901000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4901000 0x0 0x1000>;
+			device-name = "cti_gfx_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4902000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4902000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					gfx_funnel1_out0: endpoint {
+						remote-endpoint =
+						<&dlhm_tpda_in9>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@1 {
+					reg = <1>;
+					gfx_funnel1_in1: endpoint {
+						remote-endpoint =
+						<&gfx_funnel0_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4940000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4940000 0x0 0x1000>,
+			      <0x0 0x4b83000 0x0 0x1000>;
+			reg-names = "funnel-base-dummy", "funnel-base-real";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,duplicate-funnel;
+			arm,primecell-periphid = <0x000bb908>;
+
+			out-ports {
+				port {
+					turing0_dup_funnel_out: endpoint {
+						remote-endpoint =
+						<&turing0_funnel_in5>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@4 {
+					reg = <4>;
+					turing0_dup_funnel_in4: endpoint {
+						remote-endpoint =
+						<&turing0_etm0_out>;
+					};
+				};
+			};
+		};
+
+		cti@4961000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4961000 0x0 0x1000>;
+			device-name = "cti_gfx_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+		};
+
+		cti@4962000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4962000 0x0 0x1000>;
+			device-name = "cti_gfx_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+		};
+
+		funnel@4963000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4963000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+
+			out-ports {
+				port {
+					gfx_funnel0_out: endpoint {
+						remote-endpoint =
+						<&gfx_funnel1_in1>;
+					};
+				};
+			};
+		};
+
+		tpdm@4980000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4980000 0x0 0x1000>;
+			device-name = "tpdm_turing";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					turing2_tpdm_out: endpoint {
+						remote-endpoint =
+						<&turing2_funnel_in0>;
+					};
+				};
+			};
+		};
+
+		cti@4982000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4982000 0x0 0x1000>;
+			device-name = "cti_gdsp0_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4983000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4983000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					turing2_funnel_out0: endpoint {
+						remote-endpoint =
+						<&gdsp_tpda_in9>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					turing2_funnel_in0: endpoint {
+						remote-endpoint =
+						<&turing2_tpdm_out>;
+					};
+				};
+			};
+		};
+
+		cti@498b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x498b000 0x0 0x1000>;
+			reg-names = "cti-base";
+			device-name = "cti_gdsp0_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@49a0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x49a0000 0x0 0x1000>;
+			device-name = "tpdm_turing_gdsp_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					turing3_tpdm_out: endpoint {
+						remote-endpoint =
+						<&turing3_funnel_in0>;
+					};
+				};
+			};
+		};
+
+		cti@49a2000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x49a2000 0x0 0x1000>;
+			device-name = "cti_gdsp1_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@49a3000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x49a3000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					turing3_funnel_out0: endpoint {
+						remote-endpoint =
+						<&gdsp_tpda_in14>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					turing3_funnel_in0: endpoint {
+						remote-endpoint =
+						<&turing3_tpdm_out>;
+					};
+				};
+			};
+		};
+
+		cti@49ab000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x49ab000 0x0 0x1000>;
+			device-name = "cti_gdsp1_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@49c0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x49c0000 0x0 0x1000>;
+			device-name = "tpdm_rdpm_mxa";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					rdpm_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in23>;
+					};
+				};
+			};
+		};
+
+		tpdm@49ca000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x49ca000 0x0 0x1000>;
+			device-name = "tpdm_sdcc_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					sdcc_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlst_tpda_in0>;
+					};
+				};
+			};
+		};
+
+		tpdm@49d0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x49d0000 0x0 0x1000>;
+			device-name = "tpdm_qm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					qm_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in21>;
+					};
+				};
+			};
+		};
+
+		tpdm@4ac0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4ac0000 0x0 0x1000>;
+			device-name = "tpdm_dlmm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlmm_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&dlmm_tpda_in27>;
+					};
+				};
+			};
+		};
+
+		tpdm@4ac1000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4ac1000 0x0 0x1000>;
+			device-name = "tpdm_dlmm_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlmm_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&dlmm_tpda_in28>;
+					};
+				};
+			};
+		};
+
+		cti@4ac2000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4ac2000 0x0 0x1000>;
+			device-name = "cti_dlmm_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		cti@4ac3000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4ac3000 0x0 0x1000>;
+			device-name = "cti_dlmm_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4ac4000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4ac4000 0x0 0x1000>;
+			device-name = "dlmm-tpda";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlmm_tpda_out: endpoint {
+						remote-endpoint =
+						<&dlmm_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@5 {
+					reg = <5>;
+					dlmm_tpda_in5: endpoint {
+						remote-endpoint =
+						<&mdss0_tpdm_out>;
+					};
+				};
+
+				port@8 {
+					reg = <8>;
+					dlmm_tpda_in8: endpoint {
+						remote-endpoint =
+						<&mdss1_tpdm_out>;
+					};
+				};
+
+				port@1b {
+					reg = <27>;
+					dlmm_tpda_in27: endpoint {
+						remote-endpoint =
+						<&dlmm_tpdm0_out>;
+					};
+				};
+
+				port@1c {
+					reg = <28>;
+					dlmm_tpda_in28: endpoint {
+						remote-endpoint =
+						<&dlmm_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4ac5000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4ac5000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlmm_funnel_out: endpoint {
+						remote-endpoint =
+						<&funnel1_in7>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlmm_funnel_in0: endpoint {
+						remote-endpoint =
+						<&dlmm_tpda_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					dlmm_funnel_in1: endpoint {
+						remote-endpoint =
+						<&titan_funnel_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4ad0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4ad0000 0x0 0x1000>;
+			device-name = "tpdm_dlct";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					dlct0_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in26>;
+					};
+				};
+			};
+		};
+
+		tpdm@4ad1000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4ad1000 0x0 0x1000>;
+			device-name = "tpdm_ipcc";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlct0_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in27>;
+					};
+				};
+			};
+		};
+
+		cti0: cti@4ad2000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4ad2000 0x0 0x1000>;
+			reg-names = "cti-base";
+			device-name = "cti_dlct0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4ad3000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4ad3000 0x0 0x1000>;
+			device-name = "dlct0-tpda";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlct0_tpda_out: endpoint {
+						remote-endpoint =
+						<&dlct0_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlct0_tpda_in0: endpoint {
+						remote-endpoint =
+						<&lpass_funnel_out0>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					dlct0_tpda_in2: endpoint {
+						remote-endpoint =
+						<&video_funnel_out0>;
+					};
+				};
+
+				port@9 {
+					reg = <9>;
+					dlct0_tpda_in9: endpoint {
+						remote-endpoint =
+						<&dlct1_funnel_out0>;
+					};
+				};
+
+				port@13 {
+					reg = <19>;
+					dlct0_tpda_in19: endpoint {
+						remote-endpoint =
+						<&prng_tpdm_out>;
+					};
+				};
+
+				port@14 {
+					reg = <20>;
+					dlct0_tpda_in20: endpoint {
+						remote-endpoint =
+						<&gcc_tpdm_out>;
+					};
+				};
+
+				port@15 {
+					reg = <21>;
+					dlct0_tpda_in21: endpoint {
+						remote-endpoint =
+						<&qm_tpdm_out>;
+					};
+				};
+
+				port@17 {
+					reg = <23>;
+					dlct0_tpda_in23: endpoint {
+						remote-endpoint =
+						<&rdpm_tpdm_out>;
+					};
+				};
+
+				port@19 {
+					reg = <25>;
+					dlct0_tpda_in25: endpoint {
+						remote-endpoint =
+						<&pimem_tpdm_out>;
+					};
+				};
+
+				port@1a {
+					reg = <26>;
+					dlct0_tpda_in26: endpoint {
+						remote-endpoint =
+						<&dlct0_tpdm0_out>;
+					};
+				};
+
+				port@1b {
+					reg = <27>;
+					dlct0_tpda_in27: endpoint {
+						remote-endpoint =
+						<&dlct0_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4ad4000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4ad4000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlct0_funnel_out: endpoint {
+						remote-endpoint =
+						<&funnel1_in5>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlct0_funnel_in0: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					dlct0_funnel_in1: endpoint {
+						remote-endpoint =
+						<&lpass_funnel_out1>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					dlct0_funnel_in4: endpoint {
+						remote-endpoint =
+						<&ddr_funnel5_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					dlct0_funnel_in6: endpoint {
+						remote-endpoint =
+						<&turing0_funnel_out>;
+					};
+				};
+			};
+		};
+
+		cti@4b00000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b00000 0x0 0x1000>;
+			device-name = "cti_swao";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4b04000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4b04000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					aoss_funnel_out: endpoint {
+						remote-endpoint =
+						<&etf0_in>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@5 {
+					reg = <5>;
+					aoss_funnel_in5: endpoint {
+						remote-endpoint =
+						<&lpi_funnel_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					aoss_funnel_in6: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+					aoss_funnel_in7: endpoint {
+						remote-endpoint =
+						<&qdss_funnel_out>;
+					};
+				};
+			};
+		};
+
+		tmc_etf: tmc@4b05000 {
+			compatible = "arm,coresight-tmc", "arm,primecell";
+			reg = <0x0 0x4b05000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					etf0_out: endpoint {
+						remote-endpoint =
+						<&swao_rep_in>;
+					};
+				};
+			};
+
+			in-ports {
+				port {
+					etf0_in: endpoint {
+						remote-endpoint =
+						<&aoss_funnel_out>;
+					};
+				};
+			};
+		};
+
+		replicator@4b06000 {
+			compatible = "arm,coresight-dynamic-replicator", "arm,primecell";
+			reg = <0x0 0x4b06000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@1 {
+					reg = <1>;
+					swao_rep_out1: endpoint {
+						remote-endpoint =
+						<&eud_in>;
+					};
+				};
+			};
+
+			in-ports {
+				port {
+					swao_rep_in: endpoint {
+						remote-endpoint =
+						<&etf0_out>;
+					};
+				};
+			};
+		};
+
+		tpda@4b08000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4b08000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					aoss_tpda_out: endpoint {
+						remote-endpoint =
+						<&aoss_funnel_in6>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					aoss_tpda_in0: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					aoss_tpda_in1: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm1_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					aoss_tpda_in2: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm2_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					aoss_tpda_in3: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm3_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					aoss_tpda_in4: endpoint {
+						remote-endpoint =
+						<&aoss_tpdm4_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b09000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b09000 0x0 0x1000>;
+			device-name = "tpdm_swao_prio_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in0>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b0a000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b0a000 0x0 0x1000>;
+			device-name = "tpdm_swao_prio_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in1>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b0b000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b0b000 0x0 0x1000>;
+			device-name = "tpdm_swao_prio_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm2_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in2>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b0c000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b0c000 0x0 0x1000>;
+			device-name = "tpdm_swao_prio_3";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm3_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in3>;
+					};
+				};
+			};
+		};
+
+		tpdm@4b0d000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b0d000 0x0 0x1000>;
+			device-name = "tpdm_swao_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					aoss_tpdm4_out: endpoint {
+						remote-endpoint =
+						<&aoss_tpda_in4>;
+					};
+				};
+			};
+		};
+
+		aoss_cti: cti@4b13000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b13000 0x0 0x1000>;
+			device-name = "cti_aoss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@4b41000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b41000 0x0 0x1000>;
+			device-name = "cti_lpi_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+		};
+
+		tpdm@4b46000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4b46000 0x0 0x1000>;
+			device-name = "tpdm_lpass_lpi";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					lpi_tpdm_out: endpoint {
+						remote-endpoint =
+						<&lpi_funnel_in5>;
+					};
+				};
+			};
+		};
+
+		cti@4b4b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b4b000 0x0 0x1000>;
+			device-name = "cti_lpi_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+		};
+
+		cti@4b82000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b82000 0x0 0x1000>;
+			device-name = "cti_turing0_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4b83000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4b83000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					turing0_funnel_out: endpoint {
+						remote-endpoint =
+						<&dlct0_funnel_in6>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@5 {
+					reg = <5>;
+					turing0_funnel_in5: endpoint {
+						remote-endpoint =
+						<&turing0_dup_funnel_out>;
+					};
+				};
+			};
+		};
+
+		cti@4b8b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4b8b000 0x0 0x1000>;
+			device-name = "cti_turing0_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@4ba2000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4ba2000 0x0 0x1000>;
+			device-name = "cti_turing1_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpdm@4ba0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4ba0000 0x0 0x1000>;
+			device-name = "tpdm_turing_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					turing1_tpdm_out: endpoint {
+						remote-endpoint =
+						<&turing1_funnel_in0>;
+					};
+				};
+			};
+		};
+
+		funnel@4ba3000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4ba3000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					turing1_funnel_out: endpoint {
+						remote-endpoint =
+						<&gdsp_tpda_in19>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					turing1_funnel_in0: endpoint {
+						remote-endpoint =
+						<&turing1_tpdm_out>;
+					};
+				};
+			};
+		};
+
+		cti@4bab000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4bab000 0x0 0x1000>;
+			device-name = "cti_turing1_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@4c10000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c10000 0x0 0x1000>;
+			device-name = "tpdm_rdpm_mx";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlct1_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&dlct1_funnel_in0>;
+					};
+				};
+			};
+		};
+
+		tpdm@4c11000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c11000 0x0 0x1000>;
+			device-name = "tpdm_rdpm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlct1_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&dlct1_funnel_in1>;
+					};
+				};
+			};
+		};
+
+		funnel@4c12000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4c12000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlct1_funnel_out0: endpoint {
+						remote-endpoint =
+						<&dlct0_tpda_in9>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlct1_funnel_in0: endpoint {
+						remote-endpoint =
+						<&dlct1_tpdm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					dlct1_funnel_in1: endpoint {
+						remote-endpoint =
+						<&dlct1_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4c24000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4c24000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			status = "disabled";
+
+			out-ports {
+				port {
+					titan_funnel_out: endpoint {
+						remote-endpoint =
+						<&dlmm_funnel_in1>;
+					};
+				};
+			};
+		};
+
+		tpdm@4c40000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c40000 0x0 0x1000>;
+			device-name= "tpdm_dlhm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					dlhm_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlhm_tpda_in31>;
+					};
+				};
+			};
+		};
+
+		cti@4c41000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c41000 0x0 0x1000>;
+			device-name = "cti_dlhm_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		cti@4c42000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c42000 0x0 0x1000>;
+			device-name = "cti_dlhm_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4c43000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4c43000 0x0 0x1000>;
+			device-name = "dlhm-tpda";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlhm_tpda_out: endpoint {
+						remote-endpoint =
+						<&dlhm_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@9 {
+					reg = <9>;
+					dlhm_tpda_in9: endpoint {
+						remote-endpoint =
+						<&gfx_funnel1_out0>;
+					};
+				};
+
+				port@1f {
+					reg = <31>;
+					dlhm_tpda_in31: endpoint {
+						remote-endpoint =
+						<&dlhm_tpdm_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4c44000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4c44000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlhm_funnel_out: endpoint {
+						remote-endpoint =
+						<&funnel1_in6>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlhm_funnel_in0: endpoint {
+						remote-endpoint =
+						<&dlhm_tpda_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					dlhm_funnel_in4: endpoint {
+						remote-endpoint =
+						<&dlst_funnel_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+					dlhm_funnel_in5: endpoint {
+						remote-endpoint =
+						<&gdsp_funnel_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4c50000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c50000 0x0 0x1000>;
+			device-name = "tpdm_dl_south";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					dlst_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlst_tpda_in10>;
+					};
+				};
+			};
+		};
+
+		cti@4c51000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c51000 0x0 0x1000>;
+			device-name = "cti_dlst";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4c52000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4c52000 0x0 0x1000>;
+			device-name = "dlst-tpda";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlst_tpda_out: endpoint {
+						remote-endpoint =
+						<&dlst_funnel_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlst_tpda_in0: endpoint {
+						remote-endpoint =
+						<&sdcc_tpdm_out>;
+					};
+				};
+
+				port@a {
+					reg = <10>;
+					dlst_tpda_in10: endpoint {
+						remote-endpoint =
+						<&dlst_tpdm_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4c53000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4c53000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					dlst_funnel_out: endpoint {
+						remote-endpoint =
+						<&dlhm_funnel_in4>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					dlst_funnel_in0: endpoint {
+						remote-endpoint =
+						<&dlst_tpda_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4c60000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c60000 0x0 0x1000>;
+			device-name = "tpdm_mdss_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					mdss1_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlmm_tpda_in8>;
+					};
+				};
+			};
+		};
+
+		cti@4c61000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c61000 0x0 0x1000>;
+			device-name = "cti_mdss1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+			status = "disabled";
+		};
+
+		tpdm@4c70000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4c70000 0x0 0x1000>;
+			device-name = "tpdm_mdss_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					mdss0_tpdm_out: endpoint {
+						remote-endpoint =
+						<&dlmm_tpda_in5>;
+					};
+				};
+			};
+		};
+
+		cti@4c71000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4c71000 0x0 0x1000>;
+			device-name = "cti_mdss0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+			status = "disabled";
+		};
+
+		tpdm@4e00000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4e00000 0x0 0x1000>;
+			device-name = "tpdm_ddr";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					ddr_tpdm3_out: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_in4>;
+					};
+				};
+			};
+		};
+
+		tpdm@4e01000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4e01000 0x0 0x1000>;
+			device-name = "tpdm_shrm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					ddr_tpdm4_out: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_in5>;
+					};
+				};
+			};
+		};
+
+		cti@4e02000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e02000 0x0 0x1000>;
+			device-name = "cti_ddr_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@4e03000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x4e03000 0x0 0x1000>;
+			device-name = "ddr-tpda";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					ddr_tpda_out: endpoint {
+						remote-endpoint =
+						<&ddr_funnel5_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_tpda_in0: endpoint {
+						remote-endpoint =
+						<&ddr_funnel0_out0>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					ddr_tpda_in1: endpoint {
+						remote-endpoint =
+						<&ddr_funnel1_out0>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					ddr_tpda_in2: endpoint {
+						remote-endpoint =
+						<&ddr_funnel2_out0>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					ddr_tpda_in4: endpoint {
+						remote-endpoint =
+						<&ddr_tpdm3_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+					ddr_tpda_in5: endpoint {
+						remote-endpoint =
+						<&ddr_tpdm4_out>;
+					};
+				};
+			};
+		};
+
+		funnel@4e04000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4e04000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					ddr_funnel5_out: endpoint {
+						remote-endpoint =
+						<&dlct0_funnel_in4>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel5_in0: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+					ddr_funnel5_in5: endpoint {
+						remote-endpoint =
+						<&ddr_funnel3_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					ddr_funnel5_in6: endpoint {
+						remote-endpoint =
+						<&ddr_funnel4_out>;
+					};
+				};
+			};
+		};
+
+		cti@4e0c000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e0c000 0x0 0x1000>;
+			device-name = "cti_ddr_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4e0d000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4e0d000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					ddr_funnel3_out: endpoint {
+						remote-endpoint =
+						<&ddr_funnel5_in5>;
+					};
+				};
+			};
+		};
+
+		tpdm@4e10000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4e10000 0x0 0x1000>;
+			device-name = "tpdm_ddr_ch0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					ddr_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&ddr_funnel0_in0>;
+					};
+				};
+			};
+		};
+
+		cti@4e11000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e11000 0x0 0x1000>;
+			device-name = "cti_ddr_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4e12000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4e12000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel0_out0: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel0_in0: endpoint {
+						remote-endpoint =
+						<&ddr_tpdm0_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@4e20000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4e20000 0x0 0x1000>;
+			device-name = "tpdm_ddr_ch1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					ddr_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&ddr_funnel1_in0>;
+					};
+				};
+			};
+		};
+
+		cti@4e21000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e21000 0x0 0x1000>;
+			device-name = "cti_ddr_3";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4e22000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4e22000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel1_out0: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_in1>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel1_in0: endpoint {
+						remote-endpoint =
+						<&ddr_tpdm1_out>;
+					};
+				};
+			};
+		};
+
+		cti@4e34000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e34000 0x0 0x1000>;
+			device-name = "cti_ddr_4";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4e35000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4e35000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					ddr_funnel4_out: endpoint {
+						remote-endpoint =
+						<&ddr_funnel5_in6>;
+					};
+				};
+			};
+		};
+
+		tpdm@4e40000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x4e40000 0x0 0x1000>;
+			device-name = "tpdm_ddr_ch2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					ddr_tpdm2_out: endpoint {
+						remote-endpoint =
+						<&ddr_funnel2_in0>;
+					};
+				};
+			};
+		};
+
+		cti@4e41000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x4e41000 0x0 0x1000>;
+			device-name = "cti_ddr_5";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		funnel@4e42000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x4e42000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel2_out0: endpoint {
+						remote-endpoint =
+						<&ddr_tpda_in2>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					ddr_funnel2_in0: endpoint {
+						remote-endpoint =
+						<&ddr_tpdm2_out>;
+					};
+				};
+			};
+		};
+
+		etm@6040000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6040000 0x0 0x1000>;
+			cpu = <&CPU0>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm0_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in0>;
+					};
+				};
+			};
+		};
+
+		etm@6140000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6140000 0x0 0x1000>;
+			cpu = <&CPU1>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm1_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in1>;
+					};
+				};
+			};
+		};
+
+		etm@6240000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6240000 0x0 0x1000>;
+			cpu = <&CPU2>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm2_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in2>;
+					};
+				};
+			};
+		};
+
+		etm@6340000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6340000 0x0 0x1000>;
+			cpu = <&CPU3>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm3_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in3>;
+					};
+				};
+			};
+		};
+
+		etm@6440000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6440000 0x0 0x1000>;
+			cpu = <&CPU4>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm4_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in4>;
+					};
+				};
+			};
+		};
+
+		etm@6540000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6540000 0x0 0x1000>;
+			cpu = <&CPU5>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm5_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in5>;
+					};
+				};
+			};
+		};
+
+		etm@6640000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6640000 0x0 0x1000>;
+			cpu = <&CPU6>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm6_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in6>;
+					};
+				};
+			};
+		};
+
+		etm@6740000 {
+			compatible = "arm,primecell";
+			reg = <0x0 0x6740000 0x0 0x1000>;
+			cpu = <&CPU7>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			arm,coresight-loses-context-with-cpu;
+			qcom,skip-power-up;
+
+			out-ports {
+				port {
+					etm7_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_in7>;
+					};
+				};
+			};
+		};
+
+		funnel@6800000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x6800000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					apss_funnel0_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel1_in0>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					apss_funnel0_in0: endpoint {
+						remote-endpoint =
+						<&etm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					apss_funnel0_in1: endpoint {
+						remote-endpoint =
+						<&etm1_out>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					apss_funnel0_in2: endpoint {
+						remote-endpoint =
+						<&etm2_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					apss_funnel0_in3: endpoint {
+						remote-endpoint =
+						<&etm3_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					apss_funnel0_in4: endpoint {
+						remote-endpoint =
+						<&etm4_out>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+					apss_funnel0_in5: endpoint {
+						remote-endpoint =
+						<&etm5_out>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					apss_funnel0_in6: endpoint {
+						remote-endpoint =
+						<&etm6_out>;
+					};
+				};
+
+				port@7 {
+					reg = <7>;
+					apss_funnel0_in7: endpoint {
+						remote-endpoint =
+						<&etm7_out>;
+					};
+				};
+			};
+		};
+
+		funnel@6810000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x6810000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					apss_funnel1_out: endpoint {
+						remote-endpoint =
+						<&funnel1_in4>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					apss_funnel1_in0: endpoint {
+						remote-endpoint =
+						<&apss_funnel0_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					apss_funnel1_in3: endpoint {
+						remote-endpoint =
+						<&apss_tpda_out>;
+					};
+				};
+			};
+		};
+
+		cti@682b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x682b000 0x0 0x1000>;
+			device-name = "cti_apss_0";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@6860000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x6860000 0x0 0x1000>;
+			device-name = "tpdm_actpm";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					apss_tpdm3_out: endpoint {
+						remote-endpoint =
+						<&apss_tpda_in3>;
+					};
+				};
+			};
+		};
+
+		tpdm@6861000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x6861000 0x0 0x1000>;
+			device-name = "tpdm_apss";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					apss_tpdm4_out: endpoint {
+						remote-endpoint =
+						<&apss_tpda_in4>;
+					};
+				};
+			};
+		};
+
+		cti@6862000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x6862000 0x0 0x1000>;
+			device-name = "cti_apss_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,extended_cti;
+		};
+
+		tpda@6863000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x6863000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					apss_tpda_out: endpoint {
+						remote-endpoint =
+						<&apss_funnel1_in3>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					apss_tpda_in0: endpoint {
+						remote-endpoint =
+						<&apss_tpdm0_out>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					apss_tpda_in1: endpoint {
+						remote-endpoint =
+						<&apss_tpdm1_out>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					apss_tpda_in3: endpoint {
+						remote-endpoint =
+						<&apss_tpdm3_out>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					apss_tpda_in4: endpoint {
+						remote-endpoint =
+						<&apss_tpdm4_out>;
+					};
+				};
+			};
+		};
+
+		tpdm@68a0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x68a0000 0x0 0x1000>;
+			device-name = "tpdm_llm_silver";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					apss_tpdm0_out: endpoint {
+						remote-endpoint =
+						<&apss_tpda_in0>;
+					};
+				};
+			};
+		};
+
+		tpdm@68b0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x68b0000 0x0 0x1000>;
+			device-name = "tpdm_llm_gold";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					apss_tpdm1_out: endpoint {
+						remote-endpoint =
+						<&apss_tpda_in1>;
+					};
+				};
+			};
+		};
+
+		cti@68e0000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x68e0000 0x0 0x1000>;
+			device-name = "cti_apss_2";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@68f0000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x68f0000 0x0 0x1000>;
+			device-name = "cti_apss_3";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6900000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x6900000 0x0 0x1000>;
+			device-name = "cti_apss_4";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		lpass_ag_noc: interconnect-lpass-ag-noc@3c40000 {
+			compatible = "qcom,sa8775p-lpass-ag-noc";
+			reg = <0x0 0x03c40000 0x0 0x17200>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
 		usb_0_hsphy: phy@88e4000 {
 			compatible = "qcom,sa8775p-usb-hs-phy",
 				     "qcom,usb-snps-hs-5nm-phy";
@@ -1596,6 +5739,20 @@
 			status = "disabled";
 		};
 
+		dc_noc: interconnect-dc-noc@90e0000 {
+			compatible = "qcom,sa8775p-dc-noc";
+			reg = <0x0 0x090e0000 0x0 0x5080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		gem_noc: interconnect-gem-noc@9100000 {
+			compatible = "qcom,sa8775p-gem-noc";
+			reg = <0x0 0x09100000 0x0 0xf6080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
 		usb_0: usb@a6f8800 {
 			compatible = "qcom,sa8775p-dwc3", "qcom,dwc3";
 			reg = <0 0x0a6f8800 0 0x400>;
@@ -1615,10 +5772,12 @@
 			assigned-clock-rates = <19200000>, <200000000>;
 
 			interrupts-extended = <&intc GIC_SPI 287 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 261 IRQ_TYPE_LEVEL_HIGH>,
 					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 12 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
 					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
 					  "ss_phy_irq";
@@ -1643,6 +5802,15 @@
 				iommus = <&apps_smmu 0x080 0x0>;
 				phys = <&usb_0_hsphy>, <&usb_0_qmpphy>;
 				phy-names = "usb2-phy", "usb3-phy";
+				snps,dis-u1-entry-quirk;
+				snps,dis-u2-entry-quirk;
+				role-switch;
+
+				port {
+					usb0_role_switch: endpoint {
+						remote-endpoint = <&eud_ep>;
+					};
+				};
 			};
 		};
 
@@ -1702,10 +5870,12 @@
 			assigned-clock-rates = <19200000>, <200000000>;
 
 			interrupts-extended = <&intc GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 351 IRQ_TYPE_LEVEL_HIGH>,
 					      <&pdc 8 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 7 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 13 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
 					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
 					  "ss_phy_irq";
@@ -1730,6 +5900,8 @@
 				iommus = <&apps_smmu 0x0a0 0x0>;
 				phys = <&usb_1_hsphy>, <&usb_1_qmpphy>;
 				phy-names = "usb2-phy", "usb3-phy";
+				snps,dis-u1-entry-quirk;
+				snps,dis-u2-entry-quirk;
 			};
 		};
 
@@ -1765,9 +5937,11 @@
 			assigned-clock-rates = <19200000>, <200000000>;
 
 			interrupts-extended = <&intc GIC_SPI 444 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 443 IRQ_TYPE_LEVEL_HIGH>,
 					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>;
 			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
 					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq";
 
@@ -1791,6 +5965,8 @@
 				iommus = <&apps_smmu 0x020 0x0>;
 				phys = <&usb_2_hsphy>;
 				phy-names = "usb2-phy";
+				snps,dis-u1-entry-quirk;
+				snps,dis-u2-entry-quirk;
 			};
 		};
 
@@ -1800,6 +5976,103 @@
 			#hwlock-cells = <1>;
 		};
 
+		tcsr: syscon@1fc0000 {
+			compatible = "qcom,sa8775p-tcsr", "syscon";
+			reg = <0x0 0x1fc0000 0x0 0x30000>;
+		};
+
+		gpu: gpu@3d00000 {
+			compatible = "qcom,adreno-663.0", "qcom,adreno";
+			reg = <0x0 0x03d00000 0x0 0x40000>,
+			      <0x0 0x03d9e000 0x0 0x1000>,
+			      <0x0 0x03d61000 0x0 0x800>;
+			reg-names = "kgsl_3d0_reg_memory",
+				    "cx_mem",
+				    "cx_dbgc";
+			interrupts = <GIC_SPI 300 IRQ_TYPE_LEVEL_HIGH>;
+			iommus = <&adreno_smmu 0 0xc00>,
+				 <&adreno_smmu 1 0xc00>;
+			operating-points-v2 = <&gpu_opp_table>;
+			qcom,gmu = <&gmu>;
+			interconnects = <&gem_noc MASTER_GFX3D QCOM_ICC_TAG_ALWAYS
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+			interconnect-names = "gfx-mem";
+			#cooling-cells = <2>;
+
+			gpu_zap_shader: zap-shader {
+				memory-region = <&pil_gpu_mem>;
+				firmware-name = "qcom/sa8775p/a663_zap.mbn";
+			};
+
+			gpu_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-405000000 {
+					opp-hz = /bits/ 64 <405000000>;
+					opp-level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+					opp-peak-kBps = <5285156>;
+				};
+
+				opp-676000000 {
+					opp-hz = /bits/ 64 <676000000>;
+					opp-level = <RPMH_REGULATOR_LEVEL_NOM>;
+					opp-peak-kBps = <8171875>;
+				};
+
+				opp-778000000 {
+					opp-hz = /bits/ 64 <778000000>;
+					opp-level = <RPMH_REGULATOR_LEVEL_TURBO>;
+					opp-peak-kBps = <10687500>;
+				};
+
+				opp-800000000 {
+					opp-hz = /bits/ 64 <800000000>;
+					opp-level = <RPMH_REGULATOR_LEVEL_TURBO_L1>;
+					opp-peak-kBps = <12484375>;
+				};
+			};
+		};
+
+		gmu: gmu@3d6a000 {
+			compatible = "qcom,adreno-gmu-663.0", "qcom,adreno-gmu";
+			reg = <0x0 0x03d6a000 0x0 0x34000>,
+			      <0x0 0x03de0000 0x0 0x10000>,
+			      <0x0 0x0b290000 0x0 0x10000>;
+			reg-names = "gmu", "rscc", "gmu_pdc";
+			interrupts = <GIC_SPI 304 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "hfi", "gmu";
+			clocks = <&gpucc GPU_CC_CX_GMU_CLK>,
+				 <&gpucc GPU_CC_CXO_CLK>,
+				 <&gcc GCC_DDRSS_GPU_AXI_CLK>,
+				 <&gcc GCC_GPU_MEMNOC_GFX_CLK>,
+				 <&gpucc GPU_CC_AHB_CLK>,
+				 <&gpucc GPU_CC_HUB_CX_INT_CLK>,
+				 <&gpucc GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK>;
+			clock-names = "gmu",
+				      "cxo",
+				      "axi",
+				      "memnoc",
+				      "ahb",
+				      "hub",
+				      "smmu_vote";
+			power-domains = <&gpucc GPU_CC_CX_GDSC>,
+					<&gpucc GPU_CC_GX_GDSC>;
+			power-domain-names = "cx",
+					     "gx";
+			iommus = <&adreno_smmu 5 0xc00>;
+			operating-points-v2 = <&gmu_opp_table>;
+
+			gmu_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-200000000 {
+					opp-hz = /bits/ 64 <200000000>;
+					opp-level = <RPMH_REGULATOR_LEVEL_MIN_SVS>;
+				};
+			};
+		};
+
 		gpucc: clock-controller@3d90000 {
 			compatible = "qcom,sa8775p-gpucc";
 			reg = <0x0 0x03d90000 0x0 0xa000>;
@@ -1821,6 +6094,9 @@
 			#iommu-cells = <2>;
 			#global-interrupts = <2>;
 			dma-coherent;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
 			power-domains = <&gpucc GPU_CC_CX_GDSC>;
 			clocks = <&gcc GCC_GPU_MEMNOC_GFX_CLK>,
 				 <&gcc GCC_GPU_SNOC_DVM_GFX_CLK>,
@@ -1848,6 +6124,20 @@
 				     <GIC_SPI 685 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 686 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 687 IRQ_TYPE_LEVEL_HIGH>;
+
+			gfx_0_tbu: gfx_0_tbu@3dd1000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x3dd1000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x0 0x400>;
+			};
+
+			gfx_1_tbu: gfx_1_tbu@3dd9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x3dd9000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x400 0x400>;
+			};
 		};
 
 		serdes0: phy@8901000 {
@@ -1868,6 +6158,857 @@
 			status = "disabled";
 		};
 
+		pmu@9091000 {
+			compatible = "qcom,sa8775p-llcc-bwmon", "qcom,sc7280-llcc-bwmon";
+			reg = <0x0 0x9091000 0x0 0x1000>;
+			interrupts = <GIC_SPI 620 IRQ_TYPE_LEVEL_HIGH>;
+			interconnects = <&mc_virt MASTER_LLCC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ACTIVE_ONLY>;
+
+			operating-points-v2 = <&llcc_bwmon_opp_table>;
+
+			llcc_bwmon_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-0 {
+					opp-peak-kBps = <762000>;
+				};
+
+				opp-1 {
+					opp-peak-kBps = <1720000>;
+				};
+
+				opp-2 {
+					opp-peak-kBps = <2086000>;
+				};
+
+				opp-3 {
+					opp-peak-kBps = <2601000>;
+				};
+
+				opp-4 {
+					opp-peak-kBps = <2929000>;
+				};
+
+				opp-5 {
+					opp-peak-kBps = <5931000>;
+				};
+
+				opp-6 {
+					opp-peak-kBps = <6515000>;
+				};
+
+				opp-7 {
+					opp-peak-kBps = <7984000>;
+				};
+
+				opp-8 {
+					opp-peak-kBps = <10437000>;
+				};
+
+				opp-9 {
+					opp-peak-kBps = <12195000>;
+				};
+			};
+		};
+
+		pmu@90b5400 {
+			compatible = "qcom,sa8775p-cpu-bwmon", "qcom,sdm845-bwmon";
+			reg = <0x0 0x90b5400 0x0 0x600>;
+			interrupts = <GIC_SPI 581 IRQ_TYPE_LEVEL_HIGH>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &gem_noc SLAVE_LLCC QCOM_ICC_TAG_ACTIVE_ONLY>;
+
+			operating-points-v2 = <&cpu_bwmon_opp_table>;
+
+			cpu_bwmon_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-0 {
+					opp-peak-kBps = <9155000>;
+				};
+
+				opp-1 {
+					opp-peak-kBps = <12298000>;
+				};
+
+				opp-2 {
+					opp-peak-kBps = <14236000>;
+				};
+
+				opp-3 {
+					opp-peak-kBps = <16265000>;
+				};
+			};
+
+		};
+
+		pmu@90b6400 {
+			compatible = "qcom,sa8775p-cpu-bwmon", "qcom,sdm845-bwmon";
+			reg = <0x0 0x90b6400 0x0 0x600>;
+			interrupts = <GIC_SPI 581 IRQ_TYPE_LEVEL_HIGH>;
+			interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &gem_noc SLAVE_LLCC QCOM_ICC_TAG_ACTIVE_ONLY>;
+
+			operating-points-v2 = <&cpu_bwmon_opp_table>;
+		};
+
+		llcc: system-cache-controller@9200000 {
+			compatible = "qcom,sa8775p-llcc";
+			reg = <0x0 0x09200000 0x0 0x80000>,
+			      <0x0 0x09300000 0x0 0x80000>,
+			      <0x0 0x09400000 0x0 0x80000>,
+			      <0x0 0x09500000 0x0 0x80000>,
+			      <0x0 0x09600000 0x0 0x80000>,
+			      <0x0 0x09700000 0x0 0x80000>,
+			      <0x0 0x09a00000 0x0 0x80000>;
+			reg-names = "llcc0_base",
+				    "llcc1_base",
+				    "llcc2_base",
+				    "llcc3_base",
+				    "llcc4_base",
+				    "llcc5_base",
+				    "llcc_broadcast_base";
+			interrupts = <GIC_SPI 580 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		videocc: clock-controller@abf0000 {
+			compatible = "qcom,sa8775p-videocc";
+			reg = <0x0 0x0abf0000 0x0 0x10000>;
+			clocks = <&gcc GCC_VIDEO_AHB_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK_A>,
+				 <&sleep_clk>;
+			power-domains = <&rpmhpd SA8775P_MMCX>;
+			required-opps = <&rpmhpd_opp_low_svs>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		camss: isp@ac7a000 {
+			compatible = "qcom,sa8775p-camss";
+
+			reg = <0x0 0x0ac7a000 0x0 0x0f01>,
+			      <0x0 0x0ac7c000 0x0 0x0f01>,
+			      <0x0 0x0ac84000 0x0 0x0f01>,
+			      <0x0 0x0ac88000 0x0 0x0f01>,
+			      <0x0 0x0ac8c000 0x0 0x0f01>,
+			      <0x0 0x0ac90000 0x0 0x0f01>,
+			      <0x0 0x0ac94000 0x0 0x0f01>,
+			      <0x0 0x0ac78000 0x0 0x1000>,
+			      <0x0 0x0ac9c000 0x0 0x2000>,
+			      <0x0 0x0ac9e000 0x0 0x2000>,
+			      <0x0 0x0aca0000 0x0 0x2000>,
+			      <0x0 0x0aca2000 0x0 0x2000>,
+			      <0x0 0x0acac000 0x0 0x0400>,
+			      <0x0 0x0acad000 0x0 0x0400>,
+			      <0x0 0x0acae000 0x0 0x0400>,
+			      <0x0 0x0ac4d000 0x0 0xd000>,
+			      <0x0 0x0ac5a000 0x0 0xd000>,
+			      <0x0 0x0ac85000 0x0 0x0d00>,
+			      <0x0 0x0ac89000 0x0 0x0d00>,
+			      <0x0 0x0ac8d000 0x0 0x0d00>,
+			      <0x0 0x0ac91000 0x0 0x0d00>,
+			      <0x0 0x0ac95000 0x0 0x0d00>;
+			reg-names = "csid0",
+				    "csid1",
+				    "csid_lite0",
+				    "csid_lite1",
+				    "csid_lite2",
+				    "csid_lite3",
+				    "csid_lite4",
+				    "csid_top",
+				    "csiphy0",
+				    "csiphy1",
+				    "csiphy2",
+				    "csiphy3",
+				    "tpg0",
+				    "tpg1",
+				    "tpg2",
+				    "vfe0",
+				    "vfe1",
+				    "vfe_lite0",
+				    "vfe_lite1",
+				    "vfe_lite2",
+				    "vfe_lite3",
+				    "vfe_lite4";
+
+			clocks = <&camcc CAM_CC_CAMNOC_AXI_CLK>,
+				 <&camcc CAM_CC_CCI_0_CLK>,
+				 <&camcc CAM_CC_CCI_1_CLK>,
+				 <&camcc CAM_CC_CCI_2_CLK>,
+				 <&camcc CAM_CC_CCI_3_CLK>,
+				 <&camcc CAM_CC_CORE_AHB_CLK>,
+				 <&camcc CAM_CC_CPAS_AHB_CLK>,
+				 <&camcc CAM_CC_CPAS_FAST_AHB_CLK>,
+				 <&camcc CAM_CC_CPAS_IFE_0_CLK>,
+				 <&camcc CAM_CC_CPAS_IFE_1_CLK>,
+				 <&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+				 <&camcc CAM_CC_CPHY_RX_CLK_SRC>,
+				 <&camcc CAM_CC_CSID_CLK>,
+				 <&camcc CAM_CC_CSID_CSIPHY_RX_CLK>,
+				 <&camcc CAM_CC_CSIPHY0_CLK>,
+				 <&camcc CAM_CC_CSI0PHYTIMER_CLK>,
+				 <&camcc CAM_CC_CSIPHY1_CLK>,
+				 <&camcc CAM_CC_CSI1PHYTIMER_CLK>,
+				 <&camcc CAM_CC_CSIPHY2_CLK>,
+				 <&camcc CAM_CC_CSI2PHYTIMER_CLK>,
+				 <&camcc CAM_CC_CSIPHY3_CLK>,
+				 <&camcc CAM_CC_CSI3PHYTIMER_CLK>,
+				 <&gcc   GCC_CAMERA_HF_AXI_CLK>,
+				 <&gcc   GCC_CAMERA_SF_AXI_CLK>,
+				 <&gcc   GCC_CAMERA_AHB_CLK>,
+				 <&camcc CAM_CC_ICP_AHB_CLK>,
+				 <&camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+				 <&camcc CAM_CC_IFE_0_CLK>,
+				 <&camcc CAM_CC_IFE_0_FAST_AHB_CLK>,
+				 <&camcc CAM_CC_IFE_1_CLK>,
+				 <&camcc CAM_CC_IFE_1_FAST_AHB_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_CSID_CLK>;
+			clock-names = "camnoc_axi",
+				      "cci_0",
+				      "cci_1",
+				      "cci_2",
+				      "cci_3",
+				      "core_ahb",
+				      "cpas_ahb",
+				      "cpas_fast_ahb_clk",
+				      "cpas_vfe0",
+				      "cpas_vfe1",
+				      "cpas_vfe_lite",
+				      "cphy_rx_clk",
+				      "csid",
+				      "csid_csiphy_rx",
+				      "csiphy0",
+				      "csiphy0_timer",
+				      "csiphy1",
+				      "csiphy1_timer",
+				      "csiphy2",
+				      "csiphy2_timer",
+				      "csiphy3",
+				      "csiphy3_timer",
+				      "gcc_axi_hf",
+				      "gcc_axi_sf",
+				      "gcc_camera_ahb",
+				      "icp_ahb",
+				      "slow_ahb_src",
+				      "vfe0",
+				      "vfe0_fast_ahb",
+				      "vfe1",
+				      "vfe1_fast_ahb",
+				      "vfe_lite",
+				      "vfe_lite_ahb",
+				      "vfe_lite_cphy_rx",
+				      "vfe_lite_csid";
+
+			interconnects = <&gem_noc MASTER_APPSS_PROC 0
+					 &config_noc SLAVE_CAMERA_CFG 0>,
+					<&mmss_noc MASTER_CAMNOC_HF 0 &mc_virt SLAVE_EBI1 0>,
+					<&mmss_noc MASTER_CAMNOC_SF 0 &mc_virt SLAVE_EBI1 0>;
+			interconnect-names = "ahb", "hf_0", "sf_0";
+
+			interrupts = <GIC_SPI 565 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 564 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 759 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 758 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 604 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 545 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 546 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 547 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 761 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 760 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 605 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "csid0",
+					  "csid1",
+					  "csid-lite0",
+					  "csid-lite1",
+					  "csid-lite2",
+					  "csid-lite3",
+					  "csid-lite4",
+					  "csiphy0",
+					  "csiphy1",
+					  "csiphy2",
+					  "csiphy3",
+					  "tpg0",
+					  "tpg1",
+					  "tpg2",
+					  "vfe0",
+					  "vfe1",
+					  "vfe-lite0",
+					  "vfe-lite1",
+					  "vfe-lite2",
+					  "vfe-lite3",
+					  "vfe-lite4";
+
+			iommus = <&apps_smmu 0x3400 0x20>;
+
+			power-domains = <&camcc CAM_CC_TITAN_TOP_GDSC>;
+			power-domain-names = "top";
+			operating-points-v2 = <&camss_opp_table>;
+
+			status = "disabled";
+
+			camss_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-400000000 {
+					opp-hz = /bits/ 64 <400000000>;
+					required-opps = <&rpmhpd_opp_svs_l1>;
+				};
+
+				opp-480000000 {
+					opp-hz = /bits/ 64 <480000000>;
+					required-opps = <&rpmhpd_opp_svs_l1>;
+				};
+
+				opp-600000000 {
+					opp-hz = /bits/ 64 <600000000>;
+					required-opps = <&rpmhpd_opp_nom>;
+				};
+			};
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@0 {
+					reg = <0>;
+				};
+
+				port@1 {
+					reg = <1>;
+				};
+
+				port@2 {
+					reg = <2>;
+				};
+
+				port@3 {
+					reg = <3>;
+				};
+			};
+		};
+
+		camcc: clock-controller@ade0000 {
+			compatible = "qcom,sa8775p-camcc";
+			reg = <0x0 0x0ade0000 0x0 0x20000>;
+			clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK_A>,
+				 <&sleep_clk>;
+			power-domains = <&rpmhpd SA8775P_MMCX>,
+					<&rpmhpd SA8775P_MXC>;
+			required-opps = <&rpmhpd_opp_low_svs>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
+		mdss0: display-subsystem@ae00000 {
+			compatible = "qcom,sa8775p-mdss";
+			reg = <0x0 0x0ae00000 0x0 0x1000>;
+			reg-names = "mdss";
+
+			/* same path used twice */
+			interconnects = <&mmss_noc MASTER_MDP0 0 &mc_virt SLAVE_EBI1 0>,
+					<&mmss_noc MASTER_MDP1 0 &mc_virt SLAVE_EBI1 0>,
+					<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+					 &config_noc SLAVE_DISPLAY_CFG QCOM_ICC_TAG_ACTIVE_ONLY>;
+			interconnect-names = "mdp0-mem",
+					     "mdp1-mem",
+					     "cpu-cfg";
+
+			power-domains = <&dispcc0 MDSS_DISP_CC_MDSS_CORE_GDSC>;
+
+			clocks = <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+				 <&gcc GCC_DISP_HF_AXI_CLK>,
+				 <&dispcc0 MDSS_DISP_CC_MDSS_MDP_CLK>;
+
+			interrupts = <GIC_SPI 92 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+
+			iommus = <&apps_smmu 0x1000 0x402>;
+
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			status = "disabled";
+
+			mdss0_mdp: display-controller@ae01000 {
+				compatible = "qcom,sa8775p-dpu";
+				reg = <0x0 0x0ae01000 0x0 0x8f000>,
+				      <0x0 0x0aeb0000 0x0 0x2008>;
+				reg-names = "mdp", "vbif";
+
+				clocks = <&gcc GCC_DISP_HF_AXI_CLK>,
+					<&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					<&dispcc0 MDSS_DISP_CC_MDSS_MDP_LUT_CLK>,
+					<&dispcc0 MDSS_DISP_CC_MDSS_MDP_CLK>,
+					<&dispcc0 MDSS_DISP_CC_MDSS_VSYNC_CLK>;
+				clock-names = "bus",
+					      "iface",
+					      "lut",
+					      "core",
+					      "vsync";
+
+				assigned-clocks = <&dispcc0 MDSS_DISP_CC_MDSS_VSYNC_CLK>;
+				assigned-clock-rates = <19200000>;
+
+				operating-points-v2 = <&mdss0_mdp_opp_table>;
+				power-domains = <&rpmhpd SA8775P_MMCX>;
+
+				interrupt-parent = <&mdss0>;
+				interrupts = <0>;
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+						dpu_intf0_out: endpoint {
+							remote-endpoint = <&mdss0_dp0_in>;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+						dpu_intf4_out: endpoint {
+							remote-endpoint = <&mdss0_dp1_in>;
+						};
+					};
+
+					port@2 {
+						reg = <2>;
+						dpu_intf1_out: endpoint {
+							remote-endpoint = <&mdss0_dsi0_in>;
+						};
+					};
+
+					port@3 {
+						reg = <3>;
+						dpu_intf2_out: endpoint {
+							remote-endpoint = <&mdss0_dsi1_in>;
+						};
+					};
+				};
+
+				mdss0_mdp_opp_table: opp-table {
+					compatible = "operating-points-v2";
+
+					opp-375000000 {
+						opp-hz = /bits/ 64 <375000000>;
+						required-opps = <&rpmhpd_opp_svs_l1>;
+					};
+
+					opp-500000000 {
+						opp-hz = /bits/ 64 <500000000>;
+						required-opps = <&rpmhpd_opp_nom>;
+					};
+
+					opp-575000000 {
+						opp-hz = /bits/ 64 <575000000>;
+						required-opps = <&rpmhpd_opp_turbo>;
+					};
+
+					opp-650000000 {
+						opp-hz = /bits/ 64 <650000000>;
+						required-opps = <&rpmhpd_opp_turbo_l1>;
+					};
+				};
+			};
+
+			mdss0_dsi0: dsi@ae94000 {
+				compatible = "qcom,mdss-dsi-ctrl";
+				reg = <0x0 0x0ae94000 0x0 0x400>;
+				reg-names = "dsi_ctrl";
+
+				interrupt-parent = <&mdss0>;
+				interrupts = <4>;
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_BYTE0_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_BYTE0_INTF_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_PCLK0_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_ESC0_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					 <&gcc GCC_DISP_HF_AXI_CLK>;
+				clock-names = "byte",
+					      "byte_intf",
+					      "pixel",
+					      "core",
+					      "iface",
+					      "bus";
+
+				assigned-clocks = <&dispcc0 MDSS_DISP_CC_MDSS_BYTE0_CLK_SRC>,
+						  <&dispcc0 MDSS_DISP_CC_MDSS_PCLK0_CLK_SRC>;
+				assigned-clock-parents = <&mdss0_dsi0_phy 0>,
+							 <&mdss0_dsi0_phy 1>;
+
+				phys = <&mdss0_dsi0_phy>;
+
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				status = "disabled";
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+						mdss0_dsi0_in: endpoint {
+							remote-endpoint = <&dpu_intf1_out>;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+						mdss0_dsi0_out: endpoint {
+						};
+					};
+				};
+			};
+
+			mdss0_dsi0_phy: phy@ae94400 {
+				compatible = "qcom,sa8775p-dsi-phy-5nm";
+				reg = <0x0 0x0ae94400 0x0 0x200>,
+				      <0x0 0x0ae94600 0x0 0x280>,
+				      <0x0 0x0ae94900 0x0 0x27c>;
+				reg-names = "dsi_phy",
+					    "dsi_phy_lane",
+					    "dsi_pll";
+
+				#clock-cells = <1>;
+				#phy-cells = <0>;
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					 <&rpmhcc RPMH_CXO_CLK>;
+				clock-names = "iface", "ref";
+
+				status = "disabled";
+			};
+
+			mdss0_dsi1: dsi@ae96000 {
+				compatible = "qcom,mdss-dsi-ctrl";
+				reg = <0x0 0x0ae96000 0x0 0x400>;
+				reg-names = "dsi_ctrl";
+
+				interrupt-parent = <&mdss0>;
+				interrupts = <5>;
+
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_BYTE1_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_BYTE1_INTF_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_PCLK1_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_ESC1_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					 <&gcc GCC_DISP_HF_AXI_CLK>;
+				clock-names = "byte",
+					      "byte_intf",
+					      "pixel",
+					      "core",
+					      "iface",
+					      "bus";
+
+				assigned-clocks = <&dispcc0 MDSS_DISP_CC_MDSS_BYTE1_CLK_SRC>,
+						  <&dispcc0 MDSS_DISP_CC_MDSS_PCLK1_CLK_SRC>;
+				assigned-clock-parents = <&mdss0_dsi1_phy 0>,
+							 <&mdss0_dsi1_phy 1>;
+
+				phys = <&mdss0_dsi1_phy>;
+
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				status = "disabled";
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+						mdss0_dsi1_in: endpoint {
+							remote-endpoint = <&dpu_intf2_out>;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+						mdss0_dsi1_out: endpoint {
+						};
+					};
+				};
+			};
+
+			mdss0_dsi1_phy: phy@ae96400 {
+				compatible = "qcom,sa8775p-dsi-phy-5nm";
+				reg = <0x0 0x0ae96400 0x0 0x200>,
+				      <0x0 0x0ae96600 0x0 0x280>,
+				      <0x0 0x0ae96900 0x0 0x27c>;
+				reg-names = "dsi_phy",
+					    "dsi_phy_lane",
+					    "dsi_pll";
+
+				#clock-cells = <1>;
+				#phy-cells = <0>;
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					 <&rpmhcc RPMH_CXO_CLK>;
+				clock-names = "iface", "ref";
+
+				status = "disabled";
+			};
+
+			mdss0_edp_phy: phy@aec2a00 {
+				compatible = "qcom,sa8775p-edp-phy";
+
+				reg = <0x0 0xaec2a00 0x0 0x200>,
+					<0x0 0xaec2200 0x0 0xd0>,
+					<0x0 0xaec2600 0x0 0xd0>,
+					<0x0 0xaec2000 0x0 0x1c8>;
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_AUX_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>;
+				clock-names = "aux",
+					      "cfg_ahb";
+
+				vdda-phy-supply = <&vreg_l1c>;
+				vdda-pll-supply = <&vreg_l4a>;
+				#clock-cells = <1>;
+				#phy-cells = <0>;
+
+				status = "disabled";
+			};
+
+			mdss0_edp1_phy: phy@aec5a00 {
+				compatible = "qcom,sa8775p-edp-phy";
+
+				reg = <0x0 0xaec5a00 0x0 0x200>,
+				      <0x0 0xaec5200 0x0 0xd0>,
+				      <0x0 0xaec5600 0x0 0xd0>,
+				      <0x0 0xaec5000 0x0 0x1c8>;
+
+				clocks =<&dispcc0 MDSS_DISP_CC_MDSS_DPTX1_AUX_CLK>,
+					<&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>;
+				clock-names = "aux",
+					      "cfg_ahb";
+
+				vdda-phy-supply = <&vreg_l1c>;
+				vdda-pll-supply = <&vreg_l4a>;
+				#clock-cells = <1>;
+				#phy-cells = <0>;
+
+				status = "disabled";
+			};
+
+			mdss0_dp0: displayport-controller@af54000 {
+				compatible = "qcom,sa8775p-dp";
+
+				pinctrl-0 = <&dp_hot_plug_det>;
+				pinctrl-names = "default";
+
+				reg = <0x0 0xaf54000 0x0 0x104>,
+					<0x0 0xaf54200 0x0 0x0c0>,
+					<0x0 0xaf55000 0x0 0x770>,
+					<0x0 0xaf56000 0x0 0x09c>,
+					<0x0 0xaf57000 0x0 0x09c>;
+
+				interrupt-parent = <&mdss0>;
+				interrupts = <12>;
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_AUX_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_LINK_INTF_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK>;
+				clock-names = "core_iface",
+						"core_aux",
+						"ctrl_link",
+						"ctrl_link_iface",
+						"stream_pixel",
+						"stream_1_pixel";
+				assigned-clocks = <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK_SRC>,
+						  <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK_SRC>,
+						  <&dispcc0 MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK_SRC>;
+				assigned-clock-parents = <&mdss0_edp_phy 0>,
+							 <&mdss0_edp_phy 1>,
+							 <&mdss0_edp_phy 1>;
+				phys = <&mdss0_edp_phy>;
+				phy-names = "dp";
+
+				operating-points-v2 = <&dp_opp_table>;
+				power-domains = <&rpmhpd SA8775P_MMCX>;
+
+				#sound-dai-cells = <0>;
+
+				status = "disabled";
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+						mdss0_dp0_in: endpoint {
+							remote-endpoint = <&dpu_intf0_out>;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+						mdss0_dp0_out: endpoint { };
+					};
+				};
+
+				dp_opp_table: opp-table {
+					compatible = "operating-points-v2";
+
+					opp-160000000 {
+						opp-hz = /bits/ 64 <160000000>;
+						required-opps = <&rpmhpd_opp_low_svs>;
+					};
+
+					opp-270000000 {
+						opp-hz = /bits/ 64 <270000000>;
+						required-opps = <&rpmhpd_opp_svs>;
+					};
+
+					opp-540000000 {
+						opp-hz = /bits/ 64 <540000000>;
+						required-opps = <&rpmhpd_opp_svs_l1>;
+					};
+
+					opp-810000000 {
+						opp-hz = /bits/ 64 <810000000>;
+						required-opps = <&rpmhpd_opp_nom>;
+					};
+				};
+			};
+
+			mdss0_dp1: displayport-controller@af5c000 {
+				compatible = "qcom,sa8775p-dp";
+
+				pinctrl-0 = <&dp1_hot_plug_det>;
+				pinctrl-names = "default";
+
+				reg = <0x0 0xaf5c000 0x0 0x104>,
+				      <0x0 0xaf5c200 0x0 0x0c0>,
+				      <0x0 0xaf5d000 0x0 0x770>,
+				      <0x0 0xaf5e000 0x0 0x09c>,
+				      <0x0 0xaf5f000 0x0 0x09c>;
+
+				interrupt-parent = <&mdss0>;
+				interrupts = <13>;
+
+				clocks = <&dispcc0 MDSS_DISP_CC_MDSS_AHB_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX1_AUX_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX1_LINK_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX1_LINK_INTF_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX1_PIXEL0_CLK>,
+					 <&dispcc0 MDSS_DISP_CC_MDSS_DPTX1_PIXEL1_CLK>;
+				clock-names = "core_iface",
+					      "core_aux",
+					      "ctrl_link",
+					      "ctrl_link_iface",
+					      "stream_pixel",
+					      "stream_1_pixel";
+				assigned-clocks = <&dispcc0 MDSS_DISP_CC_MDSS_DPTX1_LINK_CLK_SRC>,
+						  <&dispcc0 MDSS_DISP_CC_MDSS_DPTX1_PIXEL0_CLK_SRC>,
+						  <&dispcc0 MDSS_DISP_CC_MDSS_DPTX1_PIXEL1_CLK_SRC>;
+				assigned-clock-parents = <&mdss0_edp1_phy 0>,
+							 <&mdss0_edp1_phy 1>,
+							 <&mdss0_edp1_phy 1>;
+				phys = <&mdss0_edp1_phy>;
+				phy-names = "dp";
+
+				operating-points-v2 = <&dp1_opp_table>;
+				power-domains = <&rpmhpd SA8775P_MMCX>;
+
+				#sound-dai-cells = <0>;
+
+				status = "disabled";
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+
+						mdss0_dp1_in: endpoint {
+							remote-endpoint = <&dpu_intf4_out>;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+
+						mdss0_dp1_out: endpoint { };
+					};
+				};
+
+				dp1_opp_table: opp-table {
+					compatible = "operating-points-v2";
+
+					opp-160000000 {
+						opp-hz = /bits/ 64 <160000000>;
+						required-opps = <&rpmhpd_opp_low_svs>;
+					};
+
+					opp-270000000 {
+						opp-hz = /bits/ 64 <270000000>;
+						required-opps = <&rpmhpd_opp_svs>;
+					};
+
+					opp-540000000 {
+						opp-hz = /bits/ 64 <540000000>;
+						required-opps = <&rpmhpd_opp_svs_l1>;
+					};
+
+					opp-810000000 {
+						opp-hz = /bits/ 64 <810000000>;
+						required-opps = <&rpmhpd_opp_nom>;
+					};
+				};
+			};
+		};
+
+		dispcc0: clock-controller@af00000 {
+			compatible = "qcom,sa8775p-dispcc0";
+			reg = <0x0 0x0af00000 0x0 0x20000>;
+			clocks = <&gcc GCC_DISP_AHB_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK_A>,
+				 <&sleep_clk>,
+				 <&mdss0_edp_phy 0>, <&mdss0_edp_phy 1>,
+				 <&mdss0_edp1_phy 0>, <&mdss0_edp1_phy 1>,
+				 <&mdss0_dsi0_phy 0>, <&mdss0_dsi0_phy 1>,
+				 <&mdss0_dsi1_phy 0>, <&mdss0_dsi1_phy 1>;
+			power-domains = <&rpmhpd SA8775P_MMCX>;
+			required-opps = <&rpmhpd_opp_low_svs>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
 		pdc: interrupt-controller@b220000 {
 			compatible = "qcom,sa8775p-pdc", "qcom,pdc";
 			reg = <0x0 0x0b220000 0x0 0x30000>,
@@ -2008,11 +7149,29 @@
 			wakeup-parent = <&pdc>;
 		};
 
+		sram: sram@146d8000 {
+			compatible = "qcom,sa8775p-imem", "syscon", "simple-mfd";
+			reg = <0x0 0x146d8000 0x0 0x1000>;
+			ranges = <0x0 0x0 0x146d8000 0x1000>;
+
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			pil-reloc@94c {
+				compatible = "qcom,pil-reloc-info";
+				reg = <0x94c 0xc8>;
+			};
+		};
+
 		apps_smmu: iommu@15000000 {
 			compatible = "qcom,sa8775p-smmu-500", "qcom,smmu-500", "arm,mmu-500";
 			reg = <0x0 0x15000000 0x0 0x100000>;
 			#iommu-cells = <2>;
 			#global-interrupts = <2>;
+			dma-coherent;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
 
 			interrupts = <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
@@ -2144,6 +7303,111 @@
 				     <GIC_SPI 893 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 892 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 891 IRQ_TYPE_LEVEL_HIGH>;
+
+			anoc_1_tbu: anoc_1_tbu@15189000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x15189000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x0 0x400>;
+			};
+
+			anoc_2_tbu: anoc_2_tbu@15191000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x15191000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x400 0x400>;
+			};
+
+			mmnoc_sf_0_tbu: mmnoc_sf_0_tbu@15199000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x15199000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x800 0x400>;
+			};
+
+			mmnoc_sf_1_tbu: mmnoc_sf_1_tbu@151a1000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151a1000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0xc00 0x400>;
+			};
+
+			mdp_00_tbu: mdp_00_tbu@151a9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151a9000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x1000 0x400>;
+			};
+
+			mdp_01_tbu: mdp_01_tbu@151b1000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151b1000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x1400 0x400>;
+			};
+
+			mdp_10_tbu: mdp_10_tbu@151b9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151b9000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x1800 0x400>;
+			};
+
+			mdp_11_tbu: mdp_11_tbu@151c1000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151c1000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x1c00 0x400>;
+			};
+
+			nsp_00_tbu: nsp_00_tbu@151c9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151c9000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x2000 0x400>;
+			};
+
+			nsp_01_tbu: nsp_01_tbu@151d1000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151d1000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x2400 0x400>;
+			};
+
+			nsp_10_tbu: nsp_10_tbu@151d9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151d9000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x2800 0x400>;
+			};
+
+			nsp_11_tbu: nsp_11_tbu@151e1000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151e1000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x2c00 0x400>;
+			};
+
+			lpass_tbu: lpass_tbu@151e9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151e9000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x3000 0x400>;
+			};
+
+			cam_tbu: cam_tbu@151f1000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151f1000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x3400 0x400>;
+			};
+
+			gpdsp_sail_ss_tbu: gpdsp_sail_ss_tbu@151f9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151f9000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x3800 0x400>;
+			};
 		};
 
 		pcie_smmu: iommu@15200000 {
@@ -2151,6 +7415,10 @@
 			reg = <0x0 0x15200000 0x0 0x80000>;
 			#iommu-cells = <2>;
 			#global-interrupts = <2>;
+			dma-coherent;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
 
 			interrupts = <GIC_SPI 920 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 921 IRQ_TYPE_LEVEL_HIGH>,
@@ -2218,6 +7486,13 @@
 				     <GIC_SPI 639 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 79 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 640 IRQ_TYPE_LEVEL_HIGH>;
+
+			pcie_0_tbu: pcie_0_tbu@152f9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x152f9000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x0 0x440>;
+			};
 		};
 
 		intc: interrupt-controller@17a00000 {
@@ -2375,12 +7650,23 @@
 			};
 		};
 
+		epss_l3_cl0: interconnect@18590000 {
+			compatible = "qcom,sa8775p-epss-l3-cl0";
+			reg = <0x0 0x18590000 0x0 0x1000>;
+			clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>;
+			clock-names = "xo", "alternate";
+			#interconnect-cells = <1>;
+		};
+
 		cpufreq_hw: cpufreq@18591000 {
 			compatible = "qcom,sa8775p-cpufreq-epss",
 				     "qcom,cpufreq-epss";
 			reg = <0x0 0x18591000 0x0 0x1000>,
 			      <0x0 0x18593000 0x0 0x1000>;
 			reg-names = "freq-domain0", "freq-domain1";
+			interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "dcvsh-irq-0", "dcvsh-irq-1";
 
 			clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>;
 			clock-names = "xo", "alternate";
@@ -2388,14 +7674,125 @@
 			#freq-domain-cells = <1>;
 		};
 
+		remoteproc_gpdsp0: remoteproc@20c00000 {
+			compatible = "qcom,sa8775p-gpdsp0-pas";
+			reg = <0x0 0x20c00000 0x0 0x10000>;
+
+			interrupts-extended = <&intc GIC_SPI 768 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_gpdsp0_in 0 0>,
+					      <&smp2p_gpdsp0_in 1 0>,
+					      <&smp2p_gpdsp0_in 2 0>,
+					      <&smp2p_gpdsp0_in 3 0>;
+			interrupt-names = "wdog", "fatal", "ready",
+					  "handover", "stop-ack";
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "xo";
+
+			power-domains = <&rpmhpd RPMHPD_CX>,
+					<&rpmhpd RPMHPD_MXC>;
+			power-domain-names = "cx", "mxc";
+
+			interconnects = <&gpdsp_anoc MASTER_DSP0 0
+					 &config_noc SLAVE_CLK_CTL 0>;
+
+			memory-region = <&pil_gdsp0_mem>;
+
+			qcom,qmp = <&aoss_qmp>;
+
+			qcom,smem-states = <&smp2p_gpdsp0_out 0>;
+			qcom,smem-state-names = "stop";
+
+			status = "disabled";
+
+			glink-edge {
+				interrupts-extended = <&ipcc IPCC_CLIENT_GPDSP0
+							     IPCC_MPROC_SIGNAL_GLINK_QMP
+							     IRQ_TYPE_EDGE_RISING>;
+				mboxes = <&ipcc IPCC_CLIENT_GPDSP0
+						IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+				label = "gpdsp0";
+				qcom,remote-pid = <17>;
+			};
+		};
+
+		remoteproc_gpdsp1: remoteproc@21c00000 {
+			compatible = "qcom,sa8775p-gpdsp1-pas";
+			reg = <0x0 0x21c00000 0x0 0x10000>;
+
+			interrupts-extended = <&intc GIC_SPI 624 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_gpdsp1_in 0 0>,
+					      <&smp2p_gpdsp1_in 1 0>,
+					      <&smp2p_gpdsp1_in 2 0>,
+					      <&smp2p_gpdsp1_in 3 0>;
+			interrupt-names = "wdog", "fatal", "ready",
+					  "handover", "stop-ack";
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "xo";
+
+			power-domains = <&rpmhpd RPMHPD_CX>,
+					<&rpmhpd RPMHPD_MXC>;
+			power-domain-names = "cx", "mxc";
+
+			interconnects = <&gpdsp_anoc MASTER_DSP1 0
+					 &config_noc SLAVE_CLK_CTL 0>;
+
+			memory-region = <&pil_gdsp1_mem>;
+
+			qcom,qmp = <&aoss_qmp>;
+
+			qcom,smem-states = <&smp2p_gpdsp1_out 0>;
+			qcom,smem-state-names = "stop";
+
+			status = "disabled";
+
+			glink-edge {
+				interrupts-extended = <&ipcc IPCC_CLIENT_GPDSP1
+							     IPCC_MPROC_SIGNAL_GLINK_QMP
+							     IRQ_TYPE_EDGE_RISING>;
+				mboxes = <&ipcc IPCC_CLIENT_GPDSP1
+						IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+				label = "gpdsp1";
+				qcom,remote-pid = <18>;
+			};
+		};
+
+		epss_l3_cl1: interconnect@18592000 {
+			compatible = "qcom,sa8775p-epss-l3-cl1";
+			reg = <0x0 0x18592000 0x0 0x1000>;
+			clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>;
+			clock-names = "xo", "alternate";
+			#interconnect-cells = <1>;
+		};
+
+		dispcc1: clock-controller@22100000 {
+			compatible = "qcom,sa8775p-dispcc1";
+			reg = <0x0 0x22100000 0x0 0x20000>;
+			clocks = <&gcc GCC_DISP_AHB_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&rpmhcc RPMH_CXO_CLK_A>,
+				 <&sleep_clk>,
+				 <0>, <0>, <0>, <0>,
+				 <0>, <0>, <0>, <0>;
+			power-domains = <&rpmhpd SA8775P_MMCX>;
+			required-opps = <&rpmhpd_opp_low_svs>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+		};
+
 		ethernet1: ethernet@23000000 {
 			compatible = "qcom,sa8775p-ethqos";
 			reg = <0x0 0x23000000 0x0 0x10000>,
 			      <0x0 0x23016000 0x0 0x100>;
 			reg-names = "stmmaceth", "rgmii";
 
-			interrupts = <GIC_SPI 929 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-names = "macirq";
+			interrupts = <GIC_SPI 929 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 781 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "macirq", "sfty";
 
 			clocks = <&gcc GCC_EMAC1_AXI_CLK>,
 				 <&gcc GCC_EMAC1_SLV_AHB_CLK>,
@@ -2406,12 +7803,19 @@
 				      "ptp_ref",
 				      "phyaux";
 
+			interconnects = <&aggre1_noc MASTER_EMAC_1 QCOM_ICC_TAG_ALWAYS
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+					<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+					 &config_noc SLAVE_EMAC1_CFG QCOM_ICC_TAG_ALWAYS>;
+			interconnect-names = "mac-mem", "cpu-mac";
+
 			power-domains = <&gcc EMAC1_GDSC>;
 
 			phys = <&serdes1>;
 			phy-names = "serdes";
 
 			iommus = <&apps_smmu 0x140 0xf>;
+			dma-coherent;
 
 			snps,tso;
 			snps,pbl = <32>;
@@ -2427,8 +7831,9 @@
 			      <0x0 0x23056000 0x0 0x100>;
 			reg-names = "stmmaceth", "rgmii";
 
-			interrupts = <GIC_SPI 946 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-names = "macirq";
+			interrupts = <GIC_SPI 946 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 782 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "macirq", "sfty";
 
 			clocks = <&gcc GCC_EMAC0_AXI_CLK>,
 				 <&gcc GCC_EMAC0_SLV_AHB_CLK>,
@@ -2439,12 +7844,19 @@
 				      "ptp_ref",
 				      "phyaux";
 
+			interconnects = <&aggre1_noc MASTER_EMAC QCOM_ICC_TAG_ALWAYS
+					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+					<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+					 &config_noc SLAVE_EMAC_CFG QCOM_ICC_TAG_ALWAYS>;
+			interconnect-names = "mac-mem", "cpu-mac";
+
 			power-domains = <&gcc EMAC0_GDSC>;
 
 			phys = <&serdes0>;
 			phy-names = "serdes";
 
 			iommus = <&apps_smmu 0x120 0xf>;
+			dma-coherent;
 
 			snps,tso;
 			snps,pbl = <32>;
@@ -2453,13 +7865,433 @@
 
 			status = "disabled";
 		};
+
+		remoteproc_cdsp0: remoteproc@26300000 {
+			compatible = "qcom,sa8775p-cdsp0-pas";
+			reg = <0x0 0x26300000 0x0 0x10000>;
+
+			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp0_in 0 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp0_in 1 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp0_in 2 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp0_in 3 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "wdog", "fatal", "ready",
+					  "handover", "stop-ack";
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "xo";
+
+			power-domains = <&rpmhpd RPMHPD_CX>,
+					<&rpmhpd RPMHPD_MXC>,
+					<&rpmhpd RPMHPD_NSP0>;
+			power-domain-names = "cx", "mxc", "nsp";
+
+			interconnects = <&nspa_noc MASTER_CDSP_PROC 0
+					 &mc_virt SLAVE_EBI1 0>;
+
+			memory-region = <&pil_cdsp0_mem>;
+
+			qcom,qmp = <&aoss_qmp>;
+
+			qcom,smem-states = <&smp2p_cdsp0_out 0>;
+			qcom,smem-state-names = "stop";
+
+			status = "disabled";
+
+			glink-edge {
+				interrupts-extended = <&ipcc IPCC_CLIENT_CDSP
+							     IPCC_MPROC_SIGNAL_GLINK_QMP
+							     IRQ_TYPE_EDGE_RISING>;
+				mboxes = <&ipcc IPCC_CLIENT_CDSP
+						IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+				label = "cdsp";
+				qcom,remote-pid = <5>;
+
+				fastrpc {
+					compatible = "qcom,fastrpc";
+					qcom,glink-channels = "fastrpcglink-apps-dsp";
+					label = "cdsp";
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					compute-cb@1 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <1>;
+						iommus = <&apps_smmu 0x2141 0x04a0>,
+							 <&apps_smmu 0x2181 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@2 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <2>;
+						iommus = <&apps_smmu 0x2142 0x04a0>,
+							 <&apps_smmu 0x2182 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@3 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <3>;
+						iommus = <&apps_smmu 0x2143 0x04a0>,
+							 <&apps_smmu 0x2183 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@4 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <4>;
+						iommus = <&apps_smmu 0x2144 0x04a0>,
+							 <&apps_smmu 0x2184 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@5 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <5>;
+						iommus = <&apps_smmu 0x2145 0x04a0>,
+							 <&apps_smmu 0x2185 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@6 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <6>;
+						iommus = <&apps_smmu 0x2146 0x04a0>,
+							 <&apps_smmu 0x2186 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@7 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <7>;
+						iommus = <&apps_smmu 0x2147 0x04a0>,
+							 <&apps_smmu 0x2187 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@8 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <8>;
+						iommus = <&apps_smmu 0x2148 0x04a0>,
+							 <&apps_smmu 0x2188 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@9 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <9>;
+						iommus = <&apps_smmu 0x2149 0x04a0>,
+							 <&apps_smmu 0x2189 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@11 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <11>;
+						iommus = <&apps_smmu 0x214b 0x04a0>,
+							 <&apps_smmu 0x218b 0x0400>;
+						dma-coherent;
+					};
+				};
+			};
+		};
+
+		remoteproc_cdsp1: remoteproc@2a300000 {
+			compatible = "qcom,sa8775p-cdsp1-pas";
+			reg = <0x0 0x2A300000 0x0 0x10000>;
+
+			interrupts-extended = <&intc GIC_SPI 798 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp1_in 0 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp1_in 1 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp1_in 2 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_cdsp1_in 3 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "wdog", "fatal", "ready",
+					  "handover", "stop-ack";
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "xo";
+
+			power-domains = <&rpmhpd RPMHPD_CX>,
+					<&rpmhpd RPMHPD_MXC>,
+					<&rpmhpd RPMHPD_NSP1>;
+			power-domain-names = "cx", "mxc", "nsp";
+
+			interconnects = <&nspb_noc MASTER_CDSP_PROC_B 0
+					 &mc_virt SLAVE_EBI1 0>;
+
+			memory-region = <&pil_cdsp1_mem>;
+
+			qcom,qmp = <&aoss_qmp>;
+
+			qcom,smem-states = <&smp2p_cdsp1_out 0>;
+			qcom,smem-state-names = "stop";
+
+			status = "disabled";
+
+			glink-edge {
+				interrupts-extended = <&ipcc IPCC_CLIENT_NSP1
+							     IPCC_MPROC_SIGNAL_GLINK_QMP
+							     IRQ_TYPE_EDGE_RISING>;
+				mboxes = <&ipcc IPCC_CLIENT_NSP1
+						IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+				label = "cdsp";
+				qcom,remote-pid = <12>;
+
+				fastrpc {
+					compatible = "qcom,fastrpc";
+					qcom,glink-channels = "fastrpcglink-apps-dsp";
+					label = "cdsp1";
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					compute-cb@1 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <1>;
+						iommus = <&apps_smmu 0x2941 0x04a0>,
+							 <&apps_smmu 0x2981 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@2 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <2>;
+						iommus = <&apps_smmu 0x2942 0x04a0>,
+							 <&apps_smmu 0x2982 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@3 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <3>;
+						iommus = <&apps_smmu 0x2943 0x04a0>,
+							 <&apps_smmu 0x2983 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@4 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <4>;
+						iommus = <&apps_smmu 0x2944 0x04a0>,
+							 <&apps_smmu 0x2984 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@5 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <5>;
+						iommus = <&apps_smmu 0x2945 0x04a0>,
+							 <&apps_smmu 0x2985 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@6 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <6>;
+						iommus = <&apps_smmu 0x2946 0x04a0>,
+							 <&apps_smmu 0x2986 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@7 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <7>;
+						iommus = <&apps_smmu 0x2947 0x04a0>,
+							 <&apps_smmu 0x2987 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@8 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <8>;
+						iommus = <&apps_smmu 0x2948 0x04a0>,
+							 <&apps_smmu 0x2988 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@9 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <9>;
+						iommus = <&apps_smmu 0x2949 0x04a0>,
+							 <&apps_smmu 0x2989 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@10 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <10>;
+						iommus = <&apps_smmu 0x294a 0x04a0>,
+							 <&apps_smmu 0x298a 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@11 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <11>;
+						iommus = <&apps_smmu 0x294b 0x04a0>,
+							 <&apps_smmu 0x298b 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@12 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <12>;
+						iommus = <&apps_smmu 0x294c 0x04a0>,
+							 <&apps_smmu 0x298c 0x0400>;
+						dma-coherent;
+					};
+
+					compute-cb@13 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <13>;
+						iommus = <&apps_smmu 0x294d 0x04a0>,
+							 <&apps_smmu 0x298d 0x0400>;
+						dma-coherent;
+					};
+				};
+			};
+		};
+
+		remoteproc_adsp: remoteproc@30000000 {
+			compatible = "qcom,sa8775p-adsp-pas";
+			reg = <0x0 0x30000000 0x0 0x100>;
+
+			interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
+					      <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "wdog", "fatal", "ready", "handover",
+					  "stop-ack";
+
+			clocks = <&rpmhcc RPMH_CXO_CLK>;
+			clock-names = "xo";
+
+			power-domains = <&rpmhpd RPMHPD_LCX>,
+					<&rpmhpd RPMHPD_LMX>;
+			power-domain-names = "lcx", "lmx";
+
+			interconnects = <&lpass_ag_noc MASTER_LPASS_PROC 0 &mc_virt SLAVE_EBI1 0>;
+
+			memory-region = <&pil_adsp_mem>;
+
+			qcom,qmp = <&aoss_qmp>;
+
+			qcom,smem-states = <&smp2p_adsp_out 0>;
+			qcom,smem-state-names = "stop";
+
+			status = "disabled";
+
+			remoteproc_adsp_glink: glink-edge {
+				interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+							     IPCC_MPROC_SIGNAL_GLINK_QMP
+							     IRQ_TYPE_EDGE_RISING>;
+				mboxes = <&ipcc IPCC_CLIENT_LPASS
+						IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+				label = "lpass";
+				qcom,remote-pid = <2>;
+
+				fastrpc {
+					compatible = "qcom,fastrpc";
+					qcom,glink-channels = "fastrpcglink-apps-dsp";
+					label = "adsp";
+					memory-region = <&adsp_rpc_remote_heap_mem>;
+					qcom,vmids = <QCOM_SCM_VMID_LPASS
+							  QCOM_SCM_VMID_ADSP_HEAP>;
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					compute-cb@3 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <3>;
+						iommus = <&apps_smmu 0x3003 0x0>;
+						dma-coherent;
+					};
+
+					compute-cb@4 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <4>;
+						iommus = <&apps_smmu 0x3004 0x0>;
+						dma-coherent;
+					};
+
+					compute-cb@5 {
+						compatible = "qcom,fastrpc-compute-cb";
+						reg = <5>;
+						iommus = <&apps_smmu 0x3005 0x0>;
+						qcom,nsessions = <5>;
+						dma-coherent;
+					};
+				};
+
+				gpr {
+					compatible = "qcom,gpr";
+					qcom,glink-channels = "adsp_apps";
+					qcom,domain = <GPR_DOMAIN_ID_ADSP>;
+					qcom,intents = <512 20>;
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					q6apm: service@1 {
+						compatible = "qcom,q6apm";
+						reg = <GPR_APM_MODULE_IID>;
+						#sound-dai-cells = <0>;
+						qcom,protection-domain = "avs/audio",
+									 "msm/adsp/audio_pd";
+
+						q6apmbedai: bedais {
+							compatible = "qcom,q6apm-lpass-dais";
+							q6apm-dai-uses-dummy-ops;
+							#sound-dai-cells = <1>;
+						};
+					};
+
+					q6prm: service@2 {
+						compatible = "qcom,q6prm";
+						reg = <GPR_PRM_MODULE_IID>;
+						qcom,protection-domain = "avs/audio",
+									 "msm/adsp/audio_pd";
+
+						q6prmcc: clock-controller {
+							compatible = "qcom,q6prm-lpass-clocks";
+							#clock-cells = <2>;
+						};
+					};
+
+					spf-core {
+						compatible = "qcom,spf_core";
+						reg = <GPR_AMDB_MODULE_IID>;
+					};
+
+					audio-pkt {
+						compatible = "qcom,audio-pkt";
+						reg = <GPR_VCPM_MODULE_IID>;
+						qcom,audiopkt-ch-name = "apr_audio_svc";
+					};
+				};
+			};
+		};
+
+		nspa_noc: interconnect-nspa-noc@260c0000 {
+			compatible = "qcom,sa8775p-nspa-noc";
+			reg = <0x0 0x260c0000 0x0 0x16080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
+
+		nspb_noc: interconnect-nspb-noc@2a0c0000 {
+			compatible = "qcom,sa8775p-nspb-noc";
+			reg = <0x0 0x2a0c0000 0x0 0x16080>;
+			#interconnect-cells = <2>;
+			qcom,bcm-voters = <&apps_bcm_voter>;
+		};
 	};
 
-	thermal-zones {
+	thermal_zones: thermal-zones {
 		aoss-0-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens0 0>;
 
 			trips {
@@ -2479,7 +8311,6 @@
 
 		cpu-0-0-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens0 1>;
 
@@ -2490,7 +8321,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_0_0_0_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -2500,7 +8331,6 @@
 
 		cpu-0-1-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens0 2>;
 
@@ -2511,7 +8341,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_0_1_0_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -2521,7 +8351,6 @@
 
 		cpu-0-2-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens0 3>;
 
@@ -2532,7 +8361,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_0_2_0_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -2542,7 +8371,6 @@
 
 		cpu-0-3-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens0 4>;
 
@@ -2553,7 +8381,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_0_3_0_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -2563,7 +8391,6 @@
 
 		gpuss-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens0 5>;
 
@@ -2584,7 +8411,6 @@
 
 		gpuss-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens0 6>;
 
@@ -2605,7 +8431,6 @@
 
 		gpuss-2-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens0 7>;
 
@@ -2625,9 +8450,6 @@
 		};
 
 		audio-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens0 8>;
 
 			trips {
@@ -2646,9 +8468,6 @@
 		};
 
 		camss-0-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens0 9>;
 
 			trips {
@@ -2667,9 +8486,6 @@
 		};
 
 		pcie-0-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens0 10>;
 
 			trips {
@@ -2688,9 +8504,6 @@
 		};
 
 		cpuss-0-0-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens0 11>;
 
 			trips {
@@ -2709,9 +8522,6 @@
 		};
 
 		aoss-1-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens1 0>;
 
 			trips {
@@ -2731,7 +8541,6 @@
 
 		cpu-0-0-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens1 1>;
 
@@ -2742,7 +8551,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_0_0_1_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -2752,7 +8561,6 @@
 
 		cpu-0-1-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens1 2>;
 
@@ -2763,7 +8571,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_0_1_1_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -2773,7 +8581,6 @@
 
 		cpu-0-2-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens1 3>;
 
@@ -2784,7 +8591,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_0_2_1_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -2794,7 +8601,6 @@
 
 		cpu-0-3-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens1 4>;
 
@@ -2805,7 +8611,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_0_3_1_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -2815,7 +8621,6 @@
 
 		gpuss-3-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens1 5>;
 
@@ -2836,7 +8641,6 @@
 
 		gpuss-4-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens1 6>;
 
@@ -2857,7 +8661,6 @@
 
 		gpuss-5-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens1 7>;
 
@@ -2877,9 +8680,6 @@
 		};
 
 		video-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens1 8>;
 
 			trips {
@@ -2898,9 +8698,6 @@
 		};
 
 		camss-1-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens1 9>;
 
 			trips {
@@ -2919,9 +8716,6 @@
 		};
 
 		pcie-1-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens1 10>;
 
 			trips {
@@ -2940,9 +8734,6 @@
 		};
 
 		cpuss-0-1-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens1 11>;
 
 			trips {
@@ -2961,9 +8752,6 @@
 		};
 
 		aoss-2-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens2 0>;
 
 			trips {
@@ -2983,7 +8771,6 @@
 
 		cpu-1-0-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 1>;
 
@@ -2994,7 +8781,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_1_0_0_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -3004,7 +8791,6 @@
 
 		cpu-1-1-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 2>;
 
@@ -3015,7 +8801,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_1_1_0_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -3025,7 +8811,6 @@
 
 		cpu-1-2-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 3>;
 
@@ -3036,7 +8821,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_1_2_0_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -3046,7 +8831,6 @@
 
 		cpu-1-3-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 4>;
 
@@ -3057,7 +8841,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_1_3_0_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -3067,7 +8851,6 @@
 
 		nsp-0-0-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 5>;
 
@@ -3088,7 +8871,6 @@
 
 		nsp-0-1-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 6>;
 
@@ -3109,7 +8891,6 @@
 
 		nsp-0-2-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 7>;
 
@@ -3130,7 +8911,6 @@
 
 		nsp-1-0-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 8>;
 
@@ -3151,7 +8931,6 @@
 
 		nsp-1-1-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 9>;
 
@@ -3172,7 +8951,6 @@
 
 		nsp-1-2-0-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens2 10>;
 
@@ -3192,9 +8970,6 @@
 		};
 
 		ddrss-0-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens2 11>;
 
 			trips {
@@ -3213,9 +8988,6 @@
 		};
 
 		cpuss-1-0-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens2 12>;
 
 			trips {
@@ -3234,9 +9006,6 @@
 		};
 
 		aoss-3-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens3 0>;
 
 			trips {
@@ -3256,7 +9025,6 @@
 
 		cpu-1-0-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 1>;
 
@@ -3267,7 +9035,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_1_0_1_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -3277,7 +9045,6 @@
 
 		cpu-1-1-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 2>;
 
@@ -3288,7 +9055,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_1_1_1_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -3298,7 +9065,6 @@
 
 		cpu-1-2-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 3>;
 
@@ -3309,7 +9075,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_1_2_1_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -3319,7 +9085,6 @@
 
 		cpu-1-3-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 4>;
 
@@ -3330,7 +9095,7 @@
 					type = "passive";
 				};
 
-				trip-point1 {
+				cpu_1_3_1_alert1: trip-point1 {
 					temperature = <115000>;
 					hysteresis = <5000>;
 					type = "passive";
@@ -3340,7 +9105,6 @@
 
 		nsp-0-0-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 5>;
 
@@ -3361,7 +9125,6 @@
 
 		nsp-0-1-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 6>;
 
@@ -3382,7 +9145,6 @@
 
 		nsp-0-2-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 7>;
 
@@ -3403,7 +9165,6 @@
 
 		nsp-1-0-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 8>;
 
@@ -3424,7 +9185,6 @@
 
 		nsp-1-1-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 9>;
 
@@ -3445,7 +9205,6 @@
 
 		nsp-1-2-1-thermal {
 			polling-delay-passive = <10>;
-			polling-delay = <0>;
 
 			thermal-sensors = <&tsens3 10>;
 
@@ -3465,9 +9224,6 @@
 		};
 
 		ddrss-1-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens3 11>;
 
 			trips {
@@ -3486,9 +9242,6 @@
 		};
 
 		cpuss-1-1-thermal {
-			polling-delay-passive = <0>;
-			polling-delay = <0>;
-
 			thermal-sensors = <&tsens3 12>;
 
 			trips {
@@ -3512,7 +9265,25 @@
 		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
 			     <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
 			     <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>,
-			     <GIC_PPI 12 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>;
+			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>;
+	};
+
+	turing0-etm0 {
+		compatible = "qcom,coresight-remote-etm";
+		device-name = "turing_etm0";
+
+		qcom,atid-num = <2>;
+		qcom,inst-id = <13>;
+		atid = <38 39>;
+
+		out-ports {
+			port {
+				turing0_etm0_out: endpoint {
+					remote-endpoint =
+					<&turing0_dup_funnel_in4>;
+				};
+			};
+		};
 	};
 
 	pcie0: pcie@1c00000 {
@@ -3584,6 +9355,64 @@
 		phy-names = "pciephy";
 
 		status = "disabled";
+
+		pcieport0: pcie@0 {
+			device_type = "pci";
+			reg = <0x0 0x0 0x0 0x0 0x0>;
+			bus-range = <0x01 0xff>;
+
+			#address-cells = <3>;
+			#size-cells = <2>;
+			ranges;
+		};
+	};
+
+	pcie0_ep: pcie-ep@1c00000 {
+		compatible = "qcom,sa8775p-pcie-ep";
+		reg = <0x0 0x01c00000 0x0 0x3000>,
+		      <0x0 0x40000000 0x0 0xf20>,
+		      <0x0 0x40000f20 0x0 0xa8>,
+		      <0x0 0x40001000 0x0 0x4000>,
+		      <0x0 0x40200000 0x0 0x100000>,
+		      <0x0 0x01c03000 0x0 0x1000>,
+		      <0x0 0x40005000 0x0 0x2000>;
+		reg-names = "parf", "dbi", "elbi", "atu", "addr_space",
+			    "mmio", "dma";
+
+		clocks = <&gcc GCC_PCIE_0_AUX_CLK>,
+			<&gcc GCC_PCIE_0_CFG_AHB_CLK>,
+			<&gcc GCC_PCIE_0_MSTR_AXI_CLK>,
+			<&gcc GCC_PCIE_0_SLV_AXI_CLK>,
+			<&gcc GCC_PCIE_0_SLV_Q2A_AXI_CLK>;
+
+		clock-names = "aux",
+			      "cfg",
+			      "bus_master",
+			      "bus_slave",
+			      "slave_q2a";
+
+		interrupts = <GIC_SPI 306 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 630 IRQ_TYPE_LEVEL_HIGH>;
+
+		interrupt-names = "global", "doorbell", "dma";
+
+		interconnects = <&pcie_anoc MASTER_PCIE_0 0 &mc_virt SLAVE_EBI1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_PCIE_0 0>;
+		interconnect-names = "pcie-mem", "cpu-pcie";
+
+		dma-coherent;
+		iommus = <&pcie_smmu 0x0000 0x7f>;
+		resets = <&gcc GCC_PCIE_0_BCR>;
+		reset-names = "core";
+		power-domains = <&gcc PCIE_0_GDSC>;
+		phys = <&pcie0_phy>;
+		phy-names = "pciephy";
+		max-link-speed = <3>; /* FIXME: Limiting the Gen speed due to stability issues */
+		num-lanes = <2>;
+		linux,pci-domain = <0>;
+
+		status = "disabled";
 	};
 
 	pcie0_phy: phy@1c04000 {
@@ -3684,6 +9513,64 @@
 		phy-names = "pciephy";
 
 		status = "disabled";
+
+		pcie@0 {
+			device_type = "pci";
+			reg = <0x0 0x0 0x0 0x0 0x0>;
+			bus-range = <0x01 0xff>;
+
+			#address-cells = <3>;
+			#size-cells = <2>;
+			ranges;
+		};
+	};
+
+	pcie1_ep: pcie-ep@1c10000 {
+		compatible = "qcom,sa8775p-pcie-ep";
+		reg = <0x0 0x01c10000 0x0 0x3000>,
+		      <0x0 0x60000000 0x0 0xf20>,
+		      <0x0 0x60000f20 0x0 0xa8>,
+		      <0x0 0x60001000 0x0 0x4000>,
+		      <0x0 0x60200000 0x0 0x100000>,
+		      <0x0 0x01c13000 0x0 0x1000>,
+		      <0x0 0x60005000 0x0 0x2000>;
+		reg-names = "parf", "dbi", "elbi", "atu", "addr_space",
+			    "mmio", "dma";
+
+		clocks = <&gcc GCC_PCIE_1_AUX_CLK>,
+			 <&gcc GCC_PCIE_1_CFG_AHB_CLK>,
+			 <&gcc GCC_PCIE_1_MSTR_AXI_CLK>,
+			 <&gcc GCC_PCIE_1_SLV_AXI_CLK>,
+			 <&gcc GCC_PCIE_1_SLV_Q2A_AXI_CLK>;
+
+		clock-names = "aux",
+			      "cfg",
+			      "bus_master",
+			      "bus_slave",
+			      "slave_q2a";
+
+		interrupts = <GIC_SPI 518 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 152 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 474 IRQ_TYPE_LEVEL_HIGH>;
+
+		interrupt-names = "global", "doorbell", "dma";
+
+		interconnects = <&pcie_anoc MASTER_PCIE_1 0 &mc_virt SLAVE_EBI1 0>,
+				<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_PCIE_1 0>;
+		interconnect-names = "pcie-mem", "cpu-pcie";
+
+		dma-coherent;
+		iommus = <&pcie_smmu 0x80 0x7f>;
+		resets = <&gcc GCC_PCIE_1_BCR>;
+		reset-names = "core";
+		power-domains = <&gcc PCIE_1_GDSC>;
+		phys = <&pcie1_phy>;
+		phy-names = "pciephy";
+		max-link-speed = <3>; /* FIXME: Limiting the Gen speed due to stability issues */
+		num-lanes = <4>;
+		linux,pci-domain = <1>;
+
+		status = "disabled";
 	};
 
 	pcie1_phy: phy@1c14000 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-kb.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-kb.dts
@@ -12,6 +12,6 @@
 	compatible = "google,lazor-rev1-sku2", "google,lazor-rev2-sku2", "qcom,sc7180";
 };
 
-&keyboard_backlight {
+&pwmleds {
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-lte.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-lte.dts
@@ -17,6 +17,6 @@
 	status = "okay";
 };
 
-&keyboard_backlight {
+&pwmleds {
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-kb.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-kb.dts
@@ -18,6 +18,6 @@
 	compatible = "google,lazor-sku2", "qcom,sc7180";
 };
 
-&keyboard_backlight {
+&pwmleds {
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-lte.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-lte.dts
@@ -22,6 +22,6 @@
 	status = "okay";
 };
 
-&keyboard_backlight {
+&pwmleds {
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-kb.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-kb.dts
@@ -21,6 +21,6 @@
 		"qcom,sc7180";
 };
 
-&keyboard_backlight {
+&pwmleds {
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-lte.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-lte.dts
@@ -25,6 +25,6 @@
 	status = "okay";
 };
 
-&keyboard_backlight {
+&pwmleds {
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-kb.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-kb.dts
@@ -18,6 +18,6 @@
 	compatible = "google,lazor-rev9-sku2", "qcom,sc7180";
 };
 
-&keyboard_backlight {
+&pwmleds {
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-lte.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-lte.dts
@@ -22,6 +22,6 @@
 	status = "okay";
 };
 
-&keyboard_backlight {
+&pwmleds {
 	status = "okay";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
@@ -359,10 +359,11 @@
 		#sound-dai-cells = <0>;
 	};
 
-	pwmleds {
+	pwmleds: pwmleds {
 		compatible = "pwm-leds";
+		status = "disabled";
+
 		keyboard_backlight: led-0 {
-			status = "disabled";
 			label = "cros_ec::kbd_backlight";
 			function = LED_FUNCTION_KBD_BACKLIGHT;
 			pwms = <&cros_ec_pwm 0>;
@@ -943,6 +944,8 @@
 		vddrf-supply = <&pp1300_l2c>;
 		vddch0-supply = <&pp3300_l10c>;
 		max-speed = <3200000>;
+
+		qcom,local-bd-address-broken;
 	};
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7180.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7180.dtsi
@@ -817,7 +817,7 @@
 				bits = <1 3>;
 			};
 
-			gpu_speed_bin: gpu_speed_bin@1d2 {
+			gpu_speed_bin: gpu-speed-bin@1d2 {
 				reg = <0x1d2 0x2>;
 				bits = <5 8>;
 			};
@@ -2964,12 +2964,16 @@
 					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <150000000>;
 
-			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 6 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 8 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq", "ss_phy_irq",
-					  "dm_hs_phy_irq", "dp_hs_phy_irq";
+					      <&pdc 6 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq",
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_PRIM_GDSC>;
 			required-opps = <&rpmhpd_opp_nom>;
@@ -2989,6 +2993,7 @@
 				iommus = <&apps_smmu 0x540 0>;
 				snps,dis_u2_susphy_quirk;
 				snps,dis_enblslpm_quirk;
+				snps,parkmode-disable-ss-quirk;
 				phys = <&usb_1_hsphy>, <&usb_1_qmpphy QMP_USB43DP_USB3_PHY>;
 				phy-names = "usb2-phy", "usb3-phy";
 				maximum-speed = "super-speed";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi
@@ -18,6 +18,7 @@
  */
 
 /delete-node/ &cdsp_mem;
+/delete-node/ &domain_idle_states;
 /delete-node/ &gpu_zap_mem;
 /delete-node/ &gpu_zap_shader;
 /delete-node/ &hyp_mem;
@@ -26,6 +27,18 @@
 /delete-node/ &sec_apps_mem;
 
 / {
+	cpus {
+		domain_idle_states: domain-idle-states {
+			CLUSTER_SLEEP_0: cluster-sleep-0 {
+				compatible = "domain-idle-state";
+				arm,psci-suspend-param = <0x40003444>;
+				entry-latency-us = <2752>;
+				exit-latency-us = <6562>;
+				min-residency-us = <9926>;
+			};
+		};
+	};
+
 	reserved-memory {
 		camera_mem: memory@8ad00000 {
 			reg = <0x0 0x8ad00000 0x0 0x500000>;
@@ -39,6 +52,14 @@
 	};
 };
 
+&CLUSTER_PD {
+	domain-idle-states = <&CLUSTER_SLEEP_0>;
+};
+
+&gpu {
+	status = "okay";
+};
+
 &lpass_aon {
 	status = "okay";
 };
@@ -123,6 +144,14 @@
 	status = "okay";
 };
 
+&venus {
+	status = "okay";
+
+	video-firmware {
+		iommus = <&apps_smmu 0x21a2 0x0>;
+	};
+};
+
 &wifi {
 	status = "okay";
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi
@@ -495,7 +495,6 @@
 };
 
 &uart5 {
-	compatible = "qcom,geni-debug-uart";
 	status = "okay";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi
@@ -427,7 +427,6 @@
 };
 
 uart_dbg: &uart5 {
-	compatible = "qcom,geni-debug-uart";
 	status = "okay";
 };
 
@@ -678,3 +677,11 @@
 		bias-disable;
 	};
 };
+
+&venus {
+	status = "okay";
+
+	video-firmware {
+		iommus = <&apps_smmu 0x21a2 0x0>;
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc7280.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc7280.dtsi
@@ -53,8 +53,8 @@
 		i2c13 = &i2c13;
 		i2c14 = &i2c14;
 		i2c15 = &i2c15;
-		mmc1 = &sdhc_1;
-		mmc2 = &sdhc_2;
+		mmc0 = &sdhc_1;
+		mmc1 = &sdhc_2;
 		spi0 = &spi0;
 		spi1 = &spi1;
 		spi2 = &spi2;
@@ -202,6 +202,8 @@
 			power-domain-names = "psci";
 			next-level-cache = <&L2_0>;
 			operating-points-v2 = <&cpu0_opp_table>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
 			interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>,
 					<&epss_l3 MASTER_EPSS_L3_APPS &epss_l3 SLAVE_EPSS_L3_SHARED>;
 			qcom,freq-domain = <&cpufreq_hw 0>;
@@ -229,6 +231,8 @@
 			power-domain-names = "psci";
 			next-level-cache = <&L2_100>;
 			operating-points-v2 = <&cpu0_opp_table>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
 			interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>,
 					<&epss_l3 MASTER_EPSS_L3_APPS &epss_l3 SLAVE_EPSS_L3_SHARED>;
 			qcom,freq-domain = <&cpufreq_hw 0>;
@@ -251,6 +255,8 @@
 			power-domain-names = "psci";
 			next-level-cache = <&L2_200>;
 			operating-points-v2 = <&cpu0_opp_table>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
 			interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>,
 					<&epss_l3 MASTER_EPSS_L3_APPS &epss_l3 SLAVE_EPSS_L3_SHARED>;
 			qcom,freq-domain = <&cpufreq_hw 0>;
@@ -273,6 +279,8 @@
 			power-domain-names = "psci";
 			next-level-cache = <&L2_300>;
 			operating-points-v2 = <&cpu0_opp_table>;
+			capacity-dmips-mhz = <1024>;
+			dynamic-power-coefficient = <100>;
 			interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>,
 					<&epss_l3 MASTER_EPSS_L3_APPS &epss_l3 SLAVE_EPSS_L3_SHARED>;
 			qcom,freq-domain = <&cpufreq_hw 0>;
@@ -295,6 +303,8 @@
 			power-domain-names = "psci";
 			next-level-cache = <&L2_400>;
 			operating-points-v2 = <&cpu4_opp_table>;
+			capacity-dmips-mhz = <1946>;
+			dynamic-power-coefficient = <520>;
 			interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>,
 					<&epss_l3 MASTER_EPSS_L3_APPS &epss_l3 SLAVE_EPSS_L3_SHARED>;
 			qcom,freq-domain = <&cpufreq_hw 1>;
@@ -317,6 +327,8 @@
 			power-domain-names = "psci";
 			next-level-cache = <&L2_500>;
 			operating-points-v2 = <&cpu4_opp_table>;
+			capacity-dmips-mhz = <1946>;
+			dynamic-power-coefficient = <520>;
 			interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>,
 					<&epss_l3 MASTER_EPSS_L3_APPS &epss_l3 SLAVE_EPSS_L3_SHARED>;
 			qcom,freq-domain = <&cpufreq_hw 1>;
@@ -339,6 +351,8 @@
 			power-domain-names = "psci";
 			next-level-cache = <&L2_600>;
 			operating-points-v2 = <&cpu4_opp_table>;
+			capacity-dmips-mhz = <1946>;
+			dynamic-power-coefficient = <520>;
 			interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>,
 					<&epss_l3 MASTER_EPSS_L3_APPS &epss_l3 SLAVE_EPSS_L3_SHARED>;
 			qcom,freq-domain = <&cpufreq_hw 1>;
@@ -361,6 +375,8 @@
 			power-domain-names = "psci";
 			next-level-cache = <&L2_700>;
 			operating-points-v2 = <&cpu7_opp_table>;
+			capacity-dmips-mhz = <1985>;
+			dynamic-power-coefficient = <552>;
 			interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>,
 					<&epss_l3 MASTER_EPSS_L3_APPS &epss_l3 SLAVE_EPSS_L3_SHARED>;
 			qcom,freq-domain = <&cpufreq_hw 2>;
@@ -453,15 +469,29 @@
 			};
 		};
 
-		domain-idle-states {
-			CLUSTER_SLEEP_0: cluster-sleep-0 {
+		domain_idle_states: domain-idle-states {
+			CLUSTER_SLEEP_APSS_OFF: cluster-sleep-0 {
 				compatible = "domain-idle-state";
-				idle-state-name = "cluster-power-down";
-				arm,psci-suspend-param = <0x40003444>;
+				arm,psci-suspend-param = <0x41000044>;
+				entry-latency-us = <2752>;
+				exit-latency-us = <3048>;
+				min-residency-us = <6118>;
+			};
+
+			CLUSTER_SLEEP_CX_RET: cluster-sleep-1 {
+				compatible = "domain-idle-state";
+				arm,psci-suspend-param = <0x41001344>;
 				entry-latency-us = <3263>;
+				exit-latency-us = <4562>;
+				min-residency-us = <8467>;
+			};
+
+			CLUSTER_SLEEP_LLCC_OFF: cluster-sleep-2 {
+				compatible = "domain-idle-state";
+				arm,psci-suspend-param = <0x4100b344>;
+				entry-latency-us = <3638>;
 				exit-latency-us = <6562>;
-				min-residency-us = <9926>;
-				local-timer-stop;
+				min-residency-us = <9826>;
 			};
 		};
 	};
@@ -587,12 +617,12 @@
 
 		cpu4_opp_2400mhz: opp-2400000000 {
 			opp-hz = /bits/ 64 <2400000000>;
-			opp-peak-kBps = <8532000 48537600>;
+			opp-peak-kBps = <12787200 48537600>;
 		};
 
 		cpu4_opp_2611mhz: opp-2611200000 {
 			opp-hz = /bits/ 64 <2611200000>;
-			opp-peak-kBps = <8532000 48537600>;
+			opp-peak-kBps = <12787200 48537600>;
 		};
 	};
 
@@ -652,22 +682,22 @@
 
 		cpu7_opp_2400mhz: opp-2400000000 {
 			opp-hz = /bits/ 64 <2400000000>;
-			opp-peak-kBps = <8532000 48537600>;
+			opp-peak-kBps = <12787200 48537600>;
 		};
 
 		cpu7_opp_2515mhz: opp-2515200000 {
 			opp-hz = /bits/ 64 <2515200000>;
-			opp-peak-kBps = <8532000 48537600>;
+			opp-peak-kBps = <12787200 48537600>;
 		};
 
 		cpu7_opp_2707mhz: opp-2707200000 {
 			opp-hz = /bits/ 64 <2707200000>;
-			opp-peak-kBps = <8532000 48537600>;
+			opp-peak-kBps = <12787200 48537600>;
 		};
 
 		cpu7_opp_3014mhz: opp-3014400000 {
 			opp-hz = /bits/ 64 <3014400000>;
-			opp-peak-kBps = <8532000 48537600>;
+			opp-peak-kBps = <12787200 48537600>;
 		};
 	};
 
@@ -872,7 +902,7 @@
 
 		CLUSTER_PD: power-domain-cluster {
 			#power-domain-cells = <0>;
-			domain-idle-states = <&CLUSTER_SLEEP_0>;
+			domain-idle-states = <&CLUSTER_SLEEP_APSS_OFF &CLUSTER_SLEEP_CX_RET &CLUSTER_SLEEP_LLCC_OFF>;
 		};
 	};
 
@@ -931,7 +961,7 @@
 			reg = <0 0x00100000 0 0x1f0000>;
 			clocks = <&rpmhcc RPMH_CXO_CLK>,
 				 <&rpmhcc RPMH_CXO_CLK_A>, <&sleep_clk>,
-				 <0>, <&pcie1_phy>,
+				 <&pcie0_phy>, <&pcie1_phy>,
 				 <&ufs_mem_phy 0>, <&ufs_mem_phy 1>, <&ufs_mem_phy 2>,
 				 <&usb_1_qmpphy QMP_USB43DP_USB3_PIPE_CLK>;
 			clock-names = "bi_tcxo", "bi_tcxo_ao", "sleep_clk",
@@ -966,7 +996,7 @@
 			#address-cells = <1>;
 			#size-cells = <1>;
 
-			gpu_speed_bin: gpu_speed_bin@1e9 {
+			gpu_speed_bin: gpu-speed-bin@1e9 {
 				reg = <0x1e9 0x2>;
 				bits = <5 8>;
 			};
@@ -998,6 +1028,7 @@
 			power-domains = <&rpmhpd SC7280_CX>;
 			operating-points-v2 = <&sdhc1_opp_table>;
 
+			qcom,ice = <&ice_mmc>;
 			bus-width = <8>;
 			supports-cqe;
 			dma-coherent;
@@ -1031,6 +1062,13 @@
 			};
 		};
 
+		ice_mmc: crypto@7c8000 {
+			compatible = "qcom,inline-crypto-engine";
+			reg = <0x0 0x7C8000 0x0 0x10000>;
+			qcom,ice-use-hwkm;
+			clocks = <&gcc GCC_SDCC1_ICE_CORE_CLK>;
+		};
+
 		gpi_dma0: dma-controller@900000 {
 			#dma-cells = <3>;
 			compatible = "qcom,sc7280-gpi-dma", "qcom,sm6350-gpi-dma";
@@ -1410,12 +1448,12 @@
 			};
 
 			uart5: serial@994000 {
-				compatible = "qcom,geni-uart";
+				compatible = "qcom,geni-debug-uart";
 				reg = <0 0x00994000 0 0x4000>;
 				clocks = <&gcc GCC_QUPV3_WRAP0_S5_CLK>;
 				clock-names = "se";
 				pinctrl-names = "default";
-				pinctrl-0 = <&qup_uart5_cts>, <&qup_uart5_rts>, <&qup_uart5_tx>, <&qup_uart5_rx>;
+				pinctrl-0 = <&qup_uart5_tx>, <&qup_uart5_rx>;
 				interrupts = <GIC_SPI 606 IRQ_TYPE_LEVEL_HIGH>;
 				power-domains = <&rpmhpd SC7280_CX>;
 				operating-points-v2 = <&qup_opp_table>;
@@ -2099,6 +2137,8 @@
 			reg = <0 0x016e0000 0 0x1c080>;
 			#interconnect-cells = <2>;
 			qcom,bcm-voters = <&apps_bcm_voter>;
+			clocks = <&gcc GCC_AGGRE_UFS_PHY_AXI_CLK>,
+				<&gcc GCC_AGGRE_USB3_PRIM_AXI_CLK>;
 		};
 
 		aggre2_noc: interconnect@1700000 {
@@ -2106,6 +2146,7 @@
 			compatible = "qcom,sc7280-aggre2-noc";
 			#interconnect-cells = <2>;
 			qcom,bcm-voters = <&apps_bcm_voter>;
+			clocks = <&rpmhcc RPMH_IPA_CLK>;
 		};
 
 		mmss_noc: interconnect@1740000 {
@@ -2158,6 +2199,114 @@
 			qcom,smem-state-names = "wlan-smp2p-out";
 		};
 
+		pcie0: pci@1c00000 {
+			compatible = "qcom,pcie-sc7280";
+			reg = <0x0 0x01c00000 0x0 0x3000>,
+				<0x0 0x60000000 0x0 0xf1d>,
+				<0x0 0x60000f20 0x0 0xa8>,
+				<0x0 0x60001000 0x0 0x1000>,
+				<0x0 0x60100000 0x0 0x100000>;
+
+			reg-names = "parf", "dbi", "elbi", "atu", "config";
+			device_type = "pci";
+			linux,pci-domain = <0>;
+			bus-range = <0x00 0xff>;
+			num-lanes = <1>;
+
+			#address-cells = <3>;
+			#size-cells = <2>;
+
+			ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
+				 <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>;
+
+			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "msi";
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &intc 0 0 0 149 IRQ_TYPE_LEVEL_HIGH>,
+					<0 0 0 2 &intc 0 0 0 150 IRQ_TYPE_LEVEL_HIGH>,
+					<0 0 0 3 &intc 0 0 0 151 IRQ_TYPE_LEVEL_HIGH>,
+					<0 0 0 4 &intc 0 0 0 152 IRQ_TYPE_LEVEL_HIGH>;
+
+			clocks = <&gcc GCC_PCIE_0_PIPE_CLK>,
+				 <&gcc GCC_PCIE_0_PIPE_CLK_SRC>,
+				 <&pcie0_phy>,
+				 <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GCC_PCIE_0_AUX_CLK>,
+				 <&gcc GCC_PCIE_0_CFG_AHB_CLK>,
+				 <&gcc GCC_PCIE_0_MSTR_AXI_CLK>,
+				 <&gcc GCC_PCIE_0_SLV_AXI_CLK>,
+				 <&gcc GCC_PCIE_0_SLV_Q2A_AXI_CLK>,
+				 <&gcc GCC_AGGRE_NOC_PCIE_TBU_CLK>,
+				 <&gcc GCC_DDRSS_PCIE_SF_CLK>,
+				 <&gcc GCC_AGGRE_NOC_PCIE_CENTER_SF_AXI_CLK>,
+				 <&gcc GCC_AGGRE_NOC_PCIE_0_AXI_CLK>;
+
+			clock-names = "pipe",
+					"pipe_mux",
+					"phy_pipe",
+					"ref",
+					"aux",
+					"cfg",
+					"bus_master",
+					"bus_slave",
+					"slave_q2a",
+					"tbu",
+					"ddrss_sf_tbu",
+					"aggre0",
+					"aggre1";
+
+			assigned-clocks = <&gcc GCC_PCIE_0_AUX_CLK>;
+			assigned-clock-rates = <19200000>;
+
+			resets = <&gcc GCC_PCIE_0_BCR>;
+			reset-names = "pci";
+
+			power-domains = <&gcc GCC_PCIE_0_GDSC>;
+
+			phys = <&pcie0_phy>;
+			phy-names = "pciephy";
+
+			perst-gpios = <&tlmm 87 GPIO_ACTIVE_LOW>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pcie0_clkreq_n>, <&pcie0_reset_n>, <&pcie0_wake_n>;
+
+			dma-coherent;
+
+			iommu-map = <0x0 &apps_smmu 0x1c00 0x1>,
+				   <0x100 &apps_smmu 0x1c01 0x1>;
+
+			status = "disabled";
+		};
+
+		pcie0_phy: phy@1c06000 {
+			compatible = "qcom,sm8250-qmp-gen3x1-pcie-phy";
+			reg = <0x0 0x01c06000 0x0 0x1000>;
+			clocks = <&gcc GCC_PCIE_0_AUX_CLK>,
+				<&gcc GCC_PCIE_0_CFG_AHB_CLK>,
+				<&gcc GCC_PCIE_CLKREF_EN>,
+				<&gcc GCC_PCIE0_PHY_RCHNG_CLK>,
+				<&gcc GCC_PCIE_0_PIPE_CLK>;
+			clock-names = "aux",
+				      "cfg_ahb",
+				      "ref",
+				      "refgen",
+				      "pipe";
+
+			clock-output-names = "pcie_0_pipe_clk";
+			#clock-cells = <0>;
+
+			#phy-cells = <0>;
+
+			resets = <&gcc GCC_PCIE_0_PHY_BCR>;
+			reset-names = "phy";
+
+			assigned-clocks = <&gcc GCC_PCIE0_PHY_RCHNG_CLK>;
+			assigned-clock-rates = <100000000>;
+
+			status = "disabled";
+		};
+
 		pcie1: pcie@1c08000 {
 			compatible = "qcom,pcie-sc7280";
 			reg = <0 0x01c08000 0 0x3000>,
@@ -2178,8 +2327,16 @@
 			ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
 				 <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
 
-			interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-names = "msi";
+			interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 308 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 309 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 312 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 313 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 314 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 374 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 375 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "msi0", "msi1", "msi2", "msi3",
+					  "msi4", "msi5", "msi6", "msi7";
 			#interrupt-cells = <1>;
 			interrupt-map-mask = <0 0 0 0x7>;
 			interrupt-map = <0 0 0 1 &intc 0 0 0 434 IRQ_TYPE_LEVEL_HIGH>,
@@ -2314,6 +2471,7 @@
 				<0 0>,
 				<0 0>,
 				<0 0>;
+			qcom,ice = <&ice>;
 			status = "disabled";
 		};
 
@@ -2345,6 +2503,8 @@
 				 <&apps_smmu 0x4e6 0x0011>;
 			qcom,ee = <0>;
 			qcom,controlled-remotely;
+			num-channels = <16>;
+			qcom,num-ees = <4>;
 		};
 
 		crypto: crypto@1dfa000 {
@@ -2356,6 +2516,7 @@
 				 <&apps_smmu 0x4e4 0x0011>;
 			interconnects = <&aggre2_noc MASTER_CRYPTO 0 &mc_virt SLAVE_EBI1 0>;
 			interconnect-names = "memory";
+			qcom,icc_bw = <12473>;
 		};
 
 		ipa: ipa@1e40000 {
@@ -2523,6 +2684,7 @@
 			qcom,ports-block-pack-mode =	/bits/ 8 <0xff 0xff 0xff>;
 			qcom,ports-block-group-count =	/bits/ 8 <0xff 0xff 0xff>;
 			qcom,ports-lane-control =	/bits/ 8 <0x00 0x01 0x00>;
+			qcom,ports-chmask =		/bits/ 8 <0x02 0x00 0x04>;
 
 			#sound-dai-cells = <1>;
 			#address-cells = <2>;
@@ -2531,6 +2693,64 @@
 			status = "disabled";
 		};
 
+		lpass_wsa_macro: codec@3240000 {
+			compatible = "qcom,sc7280-lpass-wsa-macro";
+			reg = <0x0 0x03240000 0x0 0x1000>;
+
+			pinctrl-names = "default";
+			pinctrl-0 = <&lpass_wsa_swr_clk>, <&lpass_wsa_swr_data>;
+
+			clocks = <&lpass_aon LPASS_AON_CC_TX_MCLK_CLK>,
+				 <&lpass_aon LPASS_AON_CC_TX_MCLK_2X_CLK>,
+				 <&lpass_va_macro>;
+			clock-names = "mclk", "npl", "fsgen";
+
+			power-domains = <&lpass_hm LPASS_CORE_CC_LPASS_CORE_HM_GDSC>,
+					<&lpass_aon LPASS_AON_CC_LPASS_AUDIO_HM_GDSC>;
+			power-domain-names = "macro", "dcodec";
+
+			#clock-cells = <0>;
+			clock-output-names = "mclk";
+			#sound-dai-cells = <1>;
+
+			status = "disabled";
+		};
+
+		swr2: soundwire@3250000 {
+			compatible = "qcom,soundwire-v1.6.0";
+			reg = <0x0 0x03250000 0x0 0x2000>;
+
+			interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&lpass_wsa_macro>;
+			clock-names = "iface";
+
+			qcom,din-ports = <2>;
+			qcom,dout-ports = <6>;
+
+			resets = <&lpass_audiocc LPASS_AUDIO_SWR_WSA_CGCR>;
+			reset-names = "swr_audio_cgcr";
+
+			qcom,ports-sinterval-low = /bits/ 8 <0x07 0x1f 0x3f 0x07
+								0x1f 0x3f 0x0f 0x0f>;
+			qcom,ports-offset1 = /bits/ 8 <0x01 0x02 0x0c 0x06 0x12 0x0d 0x07 0x0a>;
+			qcom,ports-offset2 = /bits/ 8 <0xff 0x00 0x1f 0xff 0x00 0x1f 0x00 0x00>;
+			qcom,ports-hstart = /bits/ 8 <0xff 0xff 0xff 0xff 0xff 0xff 0xff 0xff>;
+			qcom,ports-hstop = /bits/ 8 <0xff 0xff 0xff 0xff 0xff 0xff 0xff 0xff>;
+			qcom,ports-word-length = /bits/ 8 <0xff 0xff 0xff 0xff 0xff 0xff 0xff 0xff>;
+			qcom,ports-block-pack-mode = /bits/ 8 <0xff 0xff 0x01 0xff 0xff 0x01
+							       0xff 0xff>;
+			qcom,ports-block-group-count = /bits/ 8 <0xff 0xff 0xff 0xff 0xff 0xff
+								0xff 0xff>;
+			qcom,ports-lane-control = /bits/ 8 <0xff 0xff 0xff 0xff 0xff 0xff
+							    0xff 0xff>;
+
+			#address-cells = <2>;
+			#size-cells = <0>;
+			#sound-dai-cells = <1>;
+
+			status = "disabled";
+		};
+
 		lpass_audiocc: clock-controller@3300000 {
 			compatible = "qcom,sc7280-lpassaudiocc";
 			reg = <0 0x03300000 0 0x30000>,
@@ -2648,6 +2868,31 @@
 			status = "disabled";
 		};
 
+		slimbam: dma-controller@3a84000 {
+			compatible = "qcom,bam-v1.7.0";
+			reg = <0 0x03a84000 0 0x20000>;
+			interrupts = <GIC_SPI 164 IRQ_TYPE_LEVEL_HIGH>;
+			#dma-cells = <1>;
+			qcom,controlled-remotely;
+			num-channels  = <31>;
+			qcom,ee = <1>;
+			qcom,num-ees = <2>;
+			iommus = <&apps_smmu 0x1826 0x0>;
+			status = "disabled";
+		};
+
+		slim: slim-ngd@3ac0000 {
+			compatible = "qcom,slim-ngd-v1.5.0";
+			reg = <0 0x03ac0000 0 0x2c000>;
+			interrupts = <GIC_SPI 163 IRQ_TYPE_LEVEL_HIGH>;
+			dmas = <&slimbam 3>, <&slimbam 4>;
+			dma-names = "rx", "tx";
+			iommus = <&apps_smmu 0x1826 0x0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
 		lpass_hm: clock-controller@3c00000 {
 			compatible = "qcom,sc7280-lpasshm";
 			reg = <0 0x03c00000 0 0x28>;
@@ -2712,6 +2957,16 @@
 				pins = "gpio1", "gpio2", "gpio14";
 				function = "swr_tx_data";
 			};
+
+			lpass_wsa_swr_clk: wsa-swr-clk-state {
+				pins = "gpio10";
+				function = "wsa_swr_clk";
+			};
+
+			lpass_wsa_swr_data: wsa-swr-data-state {
+				pins = "gpio11";
+				function = "wsa_swr_data";
+			};
 		};
 
 		gpu: gpu@3d00000 {
@@ -2734,6 +2989,8 @@
 			nvmem-cells = <&gpu_speed_bin>;
 			nvmem-cell-names = "speed_bin";
 
+			status = "disabled";
+
 			gpu_zap_shader: zap-shader {
 				memory-region = <&gpu_zap_mem>;
 			};
@@ -2862,15 +3119,18 @@
 		};
 
 		dma@117f000 {
-			compatible = "qcom,sc7280-dcc", "qcom,dcc";
+			compatible = "qcom,dcc-v2", "qcom,dcc";
 			reg = <0x0 0x0117f000 0x0 0x1000>,
 			      <0x0 0x01112000 0x0 0x6000>;
+
+			qcom,dcc-offset = <0x12000>;
 		};
 
 		adreno_smmu: iommu@3da0000 {
 			compatible = "qcom,sc7280-smmu-500", "qcom,adreno-smmu",
 				     "qcom,smmu-500", "arm,mmu-500";
 			reg = <0 0x03da0000 0 0x20000>;
+			ranges;
 			#iommu-cells = <2>;
 			#global-interrupts = <2>;
 			interrupts = <GIC_SPI 673 IRQ_TYPE_LEVEL_HIGH>,
@@ -2903,6 +3163,23 @@
 
 			power-domains = <&gpucc GPU_CC_CX_GDSC>;
 			dma-coherent;
+
+			#address-cells = <2>;
+			#size-cells = <2>;
+
+			gfx_0_tbu: gfx_0_tbu@3dd9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x3dd9000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x0 0x400>;
+			};
+
+			gfx_1_tbu: gfx_1_tbu@3ddd000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x3ddd000 0x0 0x1000>;
+				reg-names = "base";
+				qcom,stream-id-range = <0x400 0x400>;
+			};
 		};
 
 		remoteproc_mpss: remoteproc@4080000 {
@@ -2963,6 +3240,306 @@
 			};
 		};
 
+		tpda@6004000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x06004000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					tpda_out_funnel_qatb: endpoint {
+						remote-endpoint =
+							<&funnel_qatb_in_tpda>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@15 {
+					reg = <21>;
+					tpda_in_funnel_wpss: endpoint {
+						remote-endpoint =
+							<&funnel_wpss_out_tpda>;
+					};
+				};
+
+				port@17 {
+					reg = <23>;
+					tpda_in_tpdm_dcc: endpoint {
+						remote-endpoint =
+							<&tpdm_dcc_out_tpda>;
+					};
+				};
+
+				port@18 {
+					reg = <24>;
+					tpda_in_tpdm_prng: endpoint {
+						remote-endpoint =
+							<&tpdm_prng_out_tpda>;
+					};
+				};
+
+				port@19 {
+					reg = <25>;
+					tpda_in_tpdm_qm: endpoint {
+						remote-endpoint =
+							<&tpdm_qm_out_tpda>;
+					};
+				};
+
+				port@1a {
+					reg = <26>;
+					tpda_in_tpdm_gcc: endpoint {
+						remote-endpoint =
+							<&tpdm_gcc_out_tpda>;
+					};
+				};
+
+				port@1b {
+					reg = <27>;
+					tpda_in_tpdm_vsense: endpoint {
+						remote-endpoint =
+							<&tpdm_vsense_out_tpda>;
+					};
+				};
+
+				port@1c {
+					reg = <28>;
+					tpda_in_tpdm_spdm: endpoint {
+						remote-endpoint =
+							<&tpdm_spdm_out_tpda>;
+					};
+				};
+
+				port@1d {
+					reg = <29>;
+					tpda_in_tpdm_sdcc_2: endpoint {
+						remote-endpoint =
+							<&tpdm_sdcc_2_out_tpda>;
+					};
+				};
+
+				port@1f {
+					reg = <31>;
+					tpda_in_tpdm_pimem: endpoint {
+						remote-endpoint =
+							<&tpdm_pimem_out_tpda>;
+					};
+				};
+			};
+		};
+
+		funnel@6005000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			arm,primecell-periphid = <0x000bb908>;
+
+			reg = <0x0 0x06005000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					funnel_qatb_out_funnel_in0: endpoint {
+						remote-endpoint =
+							<&funnel_in0_in_funnel_qatb>;
+					};
+				};
+			};
+
+			in-ports {
+
+				port {
+					funnel_qatb_in_tpda: endpoint {
+						remote-endpoint =
+							<&tpda_out_funnel_qatb>;
+					};
+				};
+			};
+		};
+
+		tpdm@600f000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x0600f000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_spdm";
+			qcom,cmb-element-bits = <32>;
+
+			out-ports {
+				port {
+					tpdm_spdm_out_tpda: endpoint {
+						remote-endpoint = <&tpda_in_tpdm_spdm>;
+					};
+				};
+			};
+		};
+
+		cti@6010000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06010000 0x0 0x1000>;
+
+			device-name = "cti0";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@6011000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06011000 0x0 0x1000>;
+
+			device-name = "cti1";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@6012000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06012000 0x0 0x1000>;
+
+			device-name = "cti2";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6013000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06013000 0x0 0x1000>;
+
+			device-name = "cti3";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@6014000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06014000 0x0 0x1000>;
+
+			device-name = "cti4";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@6015000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06015000 0x0 0x1000>;
+
+			device-name = "cti5";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@6016000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06016000 0x0 0x1000>;
+
+			device-name = "cti6";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@6017000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06017000 0x0 0x1000>;
+
+			device-name = "cti7";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@6018000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06018000 0x0 0x1000>;
+
+			device-name = "cti8";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@6019000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06019000 0x0 0x1000>;
+
+			device-name = "cti9";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@601a000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601a000 0x0 0x1000>;
+
+			device-name = "cti10";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@601b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601b000 0x0 0x1000>;
+
+			device-name = "cti11";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@601c000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601c000 0x0 0x1000>;
+
+			device-name = "cti12";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@601d000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601d000 0x0 0x1000>;
+
+			device-name = "cti13";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@601e000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601e000 0x0 0x1000>;
+
+			device-name = "cti14";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
+		cti@601f000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0601f000 0x0 0x1000>;
+
+			device-name = "cti15";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
 		funnel@6041000 {
 			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
 			reg = <0 0x06041000 0 0x1000>;
@@ -2982,6 +3559,14 @@
 				#address-cells = <1>;
 				#size-cells = <0>;
 
+				port@6 {
+					reg = <6>;
+					funnel_in0_in_funnel_qatb: endpoint {
+						remote-endpoint =
+							<&funnel_qatb_out_funnel_in0>;
+					};
+				};
+
 				port@7 {
 					reg = <7>;
 					funnel0_in7: endpoint {
@@ -3016,6 +3601,22 @@
 						remote-endpoint = <&apss_merge_funnel_out>;
 					};
 				};
+
+				port@5 {
+					reg = <5>;
+					funnel_in1_in_funnel_modem: endpoint {
+						remote-endpoint =
+						<&funnel_modem_out_funnel_in1>;
+					};
+				};
+
+				port@6 {
+					reg = <6>;
+					funnel_in1_in_funnel_dlct5: endpoint {
+						remote-endpoint =
+						<&funnel_dlct5_out_funnel_in1>;
+					};
+				};
 			};
 		};
 
@@ -3080,7 +3681,7 @@
 
 		etr@6048000 {
 			compatible = "arm,coresight-tmc", "arm,primecell";
-			reg = <0 0x06048000 0 0x1000>;
+			reg = <0x0 0x06048000 0x0 0x1000>;
 			iommus = <&apps_smmu 0x04c0 0>;
 
 			clocks = <&aoss_qmp>;
@@ -3096,9 +3697,387 @@
 			};
 		};
 
+		tpdm@6800000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x6800000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_modem_0";
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <16>;
+
+			out-ports {
+				port {
+					tpdm_modem_0_out_tpda_modem: endpoint {
+						remote-endpoint = <&tpda_modem_in_tpdm_modem_0>;
+					};
+				};
+			};
+		};
+
+		tpdm@6801000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06801000 0x0 0x1000>;
+
+			status = "disabled";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,cmb-element-bits = <64>;
+			device-name = "tpdm_modem_1";
+
+			out-ports {
+				port {
+					tpdm_modem_1_out_tpda_modem: endpoint {
+						remote-endpoint = <&tpda_modem_in_tpdm_modem_1>;
+					};
+				};
+			};
+		};
+
+		tpda@6803000	 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x06803000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					tpda_modem_out_funnel_modem: endpoint {
+						remote-endpoint =
+							<&funnel_modem_in_tpda_modem>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@0 {
+					reg = <0>;
+					tpda_modem_in_tpdm_modem_0: endpoint {
+						remote-endpoint =
+							<&tpdm_modem_0_out_tpda_modem>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					tpda_modem_in_tpdm_modem_1: endpoint {
+						remote-endpoint =
+							<&tpdm_modem_1_out_tpda_modem>;
+					};
+				};
+			};
+		};
+
+		funnel@6804000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+
+			reg = <0x0 0x06804000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					funnel_modem_out_funnel_in1: endpoint {
+						remote-endpoint =
+							<&funnel_in1_in_funnel_modem>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					funnel_modem_in_tpda_modem: endpoint {
+						remote-endpoint =
+							<&tpda_modem_out_funnel_modem>;
+					};
+				};
+			};
+		};
+
+		cti@680b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0680b000 0x0 0x1000>;
+
+			status = "disabled";
+
+			device-name = "cti_mss_q6";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6813000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06813000 0x0 0x1000>;
+
+			status = "disabled";
+
+			device-name = "cti_mss_vq6";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@682c000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x0682c000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			qcom,dsb-element-bits = <32>;
+			device-name = "tpdm_gcc";
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_gcc_out_tpda: endpoint {
+						remote-endpoint = <&tpda_in_tpdm_gcc>;
+					};
+				};
+			};
+		};
+
+		tpdm@6840000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06840000 0x0 0x1000>;
+
+			status = "disabled";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,cmb-element-bits = <32>;
+			device-name = "tpdm_vsense";
+
+			out-ports {
+				port {
+					tpdm_vsense_out_tpda: endpoint {
+						remote-endpoint =
+							<&tpda_in_tpdm_vsense>;
+					};
+				};
+			};
+		};
+
+		tpdm@6841000 {
+			ccompatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06841000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_prng";
+			qcom,cmb-element-bits = <32>;
+
+			out-ports {
+				port {
+					tpdm_prng_out_tpda: endpoint {
+						remote-endpoint = <&tpda_in_tpdm_prng>;
+					};
+				};
+			};
+		};
+
+		tpdm@6844000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06844000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_lpass";
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <16>;
+
+			out-ports {
+				port {
+					tpdm_lpass_out_funnel_lpass: endpoint {
+						remote-endpoint =
+							<&funnel_lpass_in_tpdm_lpass>;
+					};
+				};
+			};
+		};
+
+		cti@6845000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06845000 0x0 0x1000>;
+
+			device-name = "cti_lpass_dl";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		funnel@6846000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+			reg = <0x0 0x06846000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					funnel_lpass_out_tpda_dlct5: endpoint {
+						remote-endpoint =
+							<&tpda_dlct5_in_funnel_lpass>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@0 {
+					reg = <0>;
+					funnel_lpass_in_tpdm_lpass: endpoint {
+						remote-endpoint =
+							<&tpdm_lpass_out_funnel_lpass>;
+					};
+				};
+			};
+		};
+
+		tpdm@684f000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x0684f000 0x0 0x1000>;
+
+			status = "disabled";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_sdcc_2";
+			qcom,cmb-element-bits = <32>;
+
+			out-ports {
+				port {
+					tpdm_sdcc_2_out_tpda: endpoint {
+						remote-endpoint =
+						<&tpda_in_tpdm_sdcc_2>;
+					};
+				};
+			};
+		};
+
+		tpdm@6850000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06850000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_pimem";
+			qcom,cmb-element-bits = <64>;
+
+			out-ports {
+				port {
+					tpdm_pimem_out_tpda: endpoint {
+						remote-endpoint = <&tpda_in_tpdm_pimem>;
+					};
+				};
+			};
+		};
+
+		tpdm@6870000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06870000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_dcc";
+			qcom,cmb-element-bits = <32>;
+			status = "disabled";
+
+			out-ports {
+				port {
+					tpdm_dcc_out_tpda: endpoint {
+						remote-endpoint = <&tpda_in_tpdm_dcc>;
+					};
+				};
+			};
+		};
+
+		cti@6961000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06961000 0x0 0x1000>;
+
+			status = "disabled";
+
+			device-name = "cti_gpu_isdb";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6982000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06982000 0x0 0x1000>;
+
+			device-name = "cti_turing_dl";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@698b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x0698b000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "cti_turing_q6";
+		};
+
+		tpdm@69d0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x069d0000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			qcom,dsb-element-bits = <32>;
+			device-name = "tpdm_qm";
+
+			out-ports {
+				port {
+					tpdm_qm_out_tpda: endpoint {
+						remote-endpoint = <&tpda_in_tpdm_qm>;
+					};
+				};
+			};
+		};
+
+		cti@6b00000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b00000 0x0 0x1000>;
+
+			device-name = "cti_swao_0";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6b01000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b01000 0x0 0x1000>;
+
+			device-name = "cti_swao_1";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6b03000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b03000 0x0 0x1000>;
+
+			device-name = "cti_swao_3";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
 		funnel@6b04000 {
 			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
-			reg = <0 0x06b04000 0 0x1000>;
+			reg = <0x0 0x06b04000 0x0 0x1000>;
 
 			clocks = <&aoss_qmp>;
 			clock-names = "apb_pclk";
@@ -3115,6 +4094,14 @@
 				#address-cells = <1>;
 				#size-cells = <0>;
 
+				port@6 {
+					reg = <6>;
+					funnel_swao_in_tpda_swao: endpoint {
+						remote-endpoint =
+							<&tpda_swao_out_funnel_swao>;
+					};
+				};
+
 				port@7 {
 					reg = <7>;
 					swao_funnel_in: endpoint {
@@ -3126,7 +4113,7 @@
 
 		etf@6b05000 {
 			compatible = "arm,coresight-tmc", "arm,primecell";
-			reg = <0 0x06b05000 0 0x1000>;
+			reg = <0x0 0x06b05000 0x0 0x1000>;
 
 			clocks = <&aoss_qmp>;
 			clock-names = "apb_pclk";
@@ -3150,7 +4137,7 @@
 
 		replicator@6b06000 {
 			compatible = "arm,coresight-dynamic-replicator", "arm,primecell";
-			reg = <0 0x06b06000 0 0x1000>;
+			reg = <0x0 0x06b06000 0x0 0x1000>;
 
 			clocks = <&aoss_qmp>;
 			clock-names = "apb_pclk";
@@ -3173,6 +4160,485 @@
 			};
 		};
 
+		tpda@6b08000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x06b08000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@0 {
+					reg = <0>;
+					tpda_swao_in_tpdm_swao_p0: endpoint {
+						remote-endpoint =
+							<&tpdm_swao_p0_out_tpda_swao>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					tpda_swao_in_tpdm_swao_p1: endpoint {
+						remote-endpoint =
+							<&tpdm_swao_p1_out_tpda_swao>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					tpda_swao_in_tpdm_swao_p2: endpoint {
+						remote-endpoint =
+							<&tpdm_swao_p2_out_tpda_swao>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					tpda_swao_in_tpdm_swao_p3: endpoint {
+						remote-endpoint =
+							<&tpdm_swao_p3_out_tpda_swao>;
+					};
+				};
+
+				port@4 {
+					reg = <4>;
+					tpda_swao_in_tpdm_swao1: endpoint {
+						remote-endpoint =
+							<&tpdm_swao1_out_tpda_swao>;
+					};
+				};
+			};
+
+			out-ports {
+				port {
+					tpda_swao_out_funnel_swao: endpoint {
+						remote-endpoint =
+							<&funnel_swao_in_tpda_swao>;
+					};
+
+				};
+			};
+		};
+
+		tpdm@6b09000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06b09000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_swao_prio_0";
+			qcom,cmb-element-bits = <64>;
+
+			out-ports {
+				port {
+					tpdm_swao_p0_out_tpda_swao: endpoint {
+						remote-endpoint =
+							<&tpda_swao_in_tpdm_swao_p0>;
+					};
+				};
+			};
+		};
+
+		tpdm@6b0a000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06b0a000 0x0 0x1000>;
+
+			qcom,cmb-element-bits = <64>;
+			device-name = "tpdm_swao_prio_1";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					tpdm_swao_p1_out_tpda_swao: endpoint {
+						remote-endpoint =
+							<&tpda_swao_in_tpdm_swao_p1>;
+					};
+				};
+			};
+		};
+
+		tpdm@6b0b000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06b0b000 0x0 0x1000>;
+
+			qcom,cmb-element-bits = <64>;
+			device-name = "tpdm_swao_prio_2";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					tpdm_swao_p2_out_tpda_swao: endpoint {
+						remote-endpoint =
+							<&tpda_swao_in_tpdm_swao_p2>;
+					};
+				};
+			};
+		};
+
+		tpdm@6b0c000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06b0c000 0x0 0x1000>;
+
+			qcom,cmb-element-bits = <64>;
+			device-name = "tpdm_swao_prio_3";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					tpdm_swao_p3_out_tpda_swao: endpoint {
+						remote-endpoint =
+							<&tpda_swao_in_tpdm_swao_p3>;
+					};
+				};
+			};
+		};
+
+		tpdm@6b0d000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x6b0d000 0x0 0x1000>;
+
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+			device-name = "tpdm_swao_1";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					tpdm_swao1_out_tpda_swao: endpoint {
+						remote-endpoint =
+							<&tpda_swao_in_tpdm_swao1>;
+					};
+				};
+			};
+		};
+
+		cti@6b41000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b41000 0x0 0x1000>;
+
+			status = "disabled";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6b4b000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06b4b000 0x0 0x1000>;
+
+			status = "disabled";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@6c60000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06c60000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			device-name = "tpdm_mdss";
+			qcom,cmb-element-bits = <32>;
+			qcom,dsb-msrs-num = <16>;
+
+			out-ports {
+				port {
+					tpdm_mdss_out_tpda_dlct5: endpoint {
+						remote-endpoint =
+							<&tpda_dlct5_in_tpdm_mdss>;
+					};
+				};
+			};
+		};
+
+		tpdm@6c08000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06c08000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_dl_south";
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <16>;
+
+			out-ports {
+				port {
+					tpdm_dl_south_out_tpda_dlct5: endpoint {
+						remote-endpoint =
+							<&tpda_dlct5_in_tpdm_dl_south>;
+					};
+				};
+			};
+		};
+
+		cti@6c13000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06c13000 0x0 0x1000>;
+
+			status = "disabled";
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpdm@6c30000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06c30000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			device-name = "tpdm_dlct";
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <16>;
+
+			out-ports {
+				port {
+					tpdm_dlct_out_tpda_dlct5: endpoint {
+						remote-endpoint =
+							<&tpda_dlct5_in_tpdm_dlct>;
+					};
+				};
+			};
+		};
+
+		tpdm@6c31000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x06c31000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			device-name = "tpdm_ipcc";
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <1>;
+
+			out-ports {
+				port {
+					tpdm_ipcc_out_tpda_dlct5: endpoint {
+						remote-endpoint =
+							<&tpda_dlct5_in_tpdm_ipcc>;
+					};
+				};
+			};
+		};
+
+		tpda@6c37000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x06c37000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					tpda_dlct5_out_funnel_dlct5: endpoint {
+						remote-endpoint =
+							<&funnel_dlct5_in_tpda_dlct5>;
+					};
+
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@2 {
+					reg = <2>;
+					tpda_dlct5_in_funnel_lpass: endpoint {
+						remote-endpoint =
+							<&funnel_lpass_out_tpda_dlct5>;
+					};
+				};
+
+				port@5 {
+					reg = <5>;
+					tpda_dlct5_in_tpdm_dl_south: endpoint {
+						remote-endpoint =
+							<&tpdm_dl_south_out_tpda_dlct5>;
+					};
+				};
+
+				port@8 {
+					reg = <8>;
+					tpda_dlct5_in_tpdm_mdss: endpoint {
+						remote-endpoint =
+							<&tpdm_mdss_out_tpda_dlct5>;
+					};
+				};
+
+				port@1b {
+					reg = <27>;
+					tpda_dlct5_in_tpdm_dlct: endpoint {
+						remote-endpoint =
+							<&tpdm_dlct_out_tpda_dlct5>;
+					};
+				};
+
+				port@1c {
+					reg = <28>;
+					tpda_dlct5_in_tpdm_ipcc: endpoint {
+						remote-endpoint =
+							<&tpdm_ipcc_out_tpda_dlct5>;
+					};
+				};
+			};
+		};
+
+		funnel@6c38000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+
+			reg = <0x0 0x06c38000 0x0 0x1000>;
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					funnel_dlct5_out_funnel_in1: endpoint {
+						remote-endpoint =
+							<&funnel_in1_in_funnel_dlct5>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@0 {
+					reg = <0>;
+					funnel_dlct5_in_tpda_dlct5: endpoint {
+						remote-endpoint =
+						<&tpda_dlct5_out_funnel_dlct5>;
+					};
+				};
+
+			};
+		};
+
+		cti@6c61000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06c61000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "cti_mdss_dl";
+		};
+
+		tpdm@6c70000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+
+			reg = <0x0 0x06c70000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+			device-name = "tpdm_wpss";
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <16>;
+
+			out-ports {
+				port {
+					tpdm_wpss_out_funnel_wpss: endpoint {
+						remote-endpoint =
+							<&funnel_wpss_in_tpdm_wpss>;
+					};
+				};
+			};
+		};
+
+		funnel@6c73000 {
+			compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+
+			reg = <0x0 0x06c73000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			in-ports {
+				port {
+					funnel_wpss_in_tpdm_wpss: endpoint {
+						remote-endpoint =
+						<&tpdm_wpss_out_funnel_wpss>;
+					};
+				};
+
+			};
+
+			out-ports {
+				port {
+					funnel_wpss_out_tpda: endpoint {
+						remote-endpoint =
+							<&tpda_in_funnel_wpss>;
+					};
+				};
+			};
+		};
+
+		cti@6e02000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06e02000 0x0 0x1000>;
+
+			device-name = "cti_ddr_dl_0_cti_0";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6e0c000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06e0c000 0x0 0x1000>;
+
+			device-name = "cti_ddr_dl_1_cti_0";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6e0d000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06e0d000 0x0 0x1000>;
+
+			device-name = "cti_ddr_dl_1_cti_1";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6e0e000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06e0e000 0x0 0x1000>;
+
+			device-name = "cti_ddr_dl_1_cti_2";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@6e11000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x06e11000 0x0 0x1000>;
+
+			device-name = "cti_ddr_ch01_dl_cti_0";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@7020000 {
+			compatible = "arm,coresight-cti-v8-arch",
+					"arm,coresight-cti","arm,primecell";
+			reg = <0x0 0x07020000 0x0 0x1000>;
+			cpu = <&CPU0>;
+
+			device-name = "cti_cpu0";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+		};
+
 		etm@7040000 {
 			compatible = "arm,coresight-etm4x", "arm,primecell";
 			reg = <0 0x07040000 0 0x1000>;
@@ -3193,6 +4659,17 @@
 			};
 		};
 
+		cti@7120000 {
+			compatible = "arm,coresight-cti-v8-arch",
+					"arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07120000 0x0 0x1000>;
+			cpu = <&CPU1>;
+
+			device-name = "cti_cpu1";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
 		etm@7140000 {
 			compatible = "arm,coresight-etm4x", "arm,primecell";
 			reg = <0 0x07140000 0 0x1000>;
@@ -3213,6 +4690,17 @@
 			};
 		};
 
+		cti@7220000 {
+			compatible = "arm,coresight-cti-v8-arch",
+				"arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07220000 0x0 0x1000>;
+			cpu = <&CPU2>;
+
+			device-name = "cti_cpu2";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
 		etm@7240000 {
 			compatible = "arm,coresight-etm4x", "arm,primecell";
 			reg = <0 0x07240000 0 0x1000>;
@@ -3233,6 +4721,17 @@
 			};
 		};
 
+		cti@7320000 {
+			compatible = "arm,coresight-cti-v8-arch",
+					"arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07320000 0x0 0x1000>;
+			cpu = <&CPU3>;
+
+			device-name = "cti_cpu3";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
 		etm@7340000 {
 			compatible = "arm,coresight-etm4x", "arm,primecell";
 			reg = <0 0x07340000 0 0x1000>;
@@ -3253,6 +4752,17 @@
 			};
 		};
 
+		cti@7420000 {
+			compatible = "arm,coresight-cti-v8-arch",
+					"arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07420000 0x0 0x1000>;
+			cpu = <&CPU4>;
+
+			device-name = "cti_cpu4";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
 		etm@7440000 {
 			compatible = "arm,coresight-etm4x", "arm,primecell";
 			reg = <0 0x07440000 0 0x1000>;
@@ -3273,6 +4783,17 @@
 			};
 		};
 
+		cti@7520000 {
+			compatible = "arm,coresight-cti-v8-arch",
+					"arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07520000 0x0 0x1000>;
+			cpu = <&CPU5>;
+
+			device-name = "cti_cpu5";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
 		etm@7540000 {
 			compatible = "arm,coresight-etm4x", "arm,primecell";
 			reg = <0 0x07540000 0 0x1000>;
@@ -3293,6 +4814,17 @@
 			};
 		};
 
+		cti@7620000 {
+			compatible = "arm,coresight-cti-v8-arch",
+					"arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07620000 0x0 0x1000>;
+			cpu = <&CPU6>;
+
+			device-name = "cti_cpu6";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
 		etm@7640000 {
 			compatible = "arm,coresight-etm4x", "arm,primecell";
 			reg = <0 0x07640000 0 0x1000>;
@@ -3313,6 +4845,17 @@
 			};
 		};
 
+		cti@7720000 {
+			compatible = "arm,coresight-cti-v8-arch",
+					"arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07720000 0x0 0x1000>;
+			cpu = <&CPU7>;
+
+			device-name = "cti_cpu7";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
 		etm@7740000 {
 			compatible = "arm,coresight-etm4x", "arm,primecell";
 			reg = <0 0x07740000 0 0x1000>;
@@ -3426,14 +4969,199 @@
 			};
 
 			in-ports {
-				port {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
 					apss_merge_funnel_in: endpoint {
 						remote-endpoint = <&apss_funnel_out>;
 					};
 				};
+
+				port@3 {
+					reg = <3>;
+					funnel_apss_merg_in_tpda_apss: endpoint {
+						remote-endpoint =
+						  <&tpda_apss_out_funnel_apss_merg>;
+					};
+				};
+			};
+		};
+
+		tpdm@7860000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x07860000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			device-name = "tpdm_actpm";
+			qcom,cmb-element-bits = <64>;
+			qcom,cmb-msrs-num = <1>;
+
+			out-ports {
+				port {
+					tpdm_actpm_out_tpda_apss: endpoint {
+						remote-endpoint =
+							<&tpda_apss_in_tpdm_actpm>;
+					};
+				};
 			};
 		};
 
+		tpdm@7861000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x07861000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			device-name = "tpdm_apss";
+			qcom,dsb-element-bits = <32>;
+			qcom,dsb-msrs-num = <32>;
+
+			out-ports {
+				port {
+					tpdm_apss_out_tpda_apss: endpoint {
+						remote-endpoint =
+							<&tpda_apss_in_tpdm_apss>;
+					};
+				};
+			};
+		};
+
+		cti@7862000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07862000 0x0 0x1000>;
+
+			device-name = "cti_apss_dl_cti0";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		tpda@7863000 {
+			compatible = "qcom,coresight-tpda", "arm,primecell";
+			reg = <0x0 0x07863000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			out-ports {
+				port {
+					tpda_apss_out_funnel_apss_merg: endpoint {
+						remote-endpoint =
+							   <&funnel_apss_merg_in_tpda_apss>;
+					};
+				};
+			};
+
+			in-ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@0 {
+					reg = <0>;
+					tpda_apss_in_tpdm_llm_silver: endpoint {
+						remote-endpoint =
+							   <&tpdm_llm_silver_out_tpda_apss>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+					tpda_apss_in_tpdm_llm_gold: endpoint {
+						remote-endpoint =
+							   <&tpdm_llm_gold_out_tpda_apss>;
+					};
+				};
+
+				port@2 {
+					reg = <2>;
+					tpda_apss_in_tpdm_actpm: endpoint {
+						remote-endpoint =
+							   <&tpdm_actpm_out_tpda_apss>;
+					};
+				};
+
+				port@3 {
+					reg = <3>;
+					tpda_apss_in_tpdm_apss: endpoint {
+						remote-endpoint =
+							   <&tpdm_apss_out_tpda_apss>;
+					};
+				};
+			};
+		};
+
+		tpdm@78a0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x078a0000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			device-name = "tpdm_llm_silver";
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <12>;
+
+			out-ports {
+				port {
+					tpdm_llm_silver_out_tpda_apss: endpoint {
+						remote-endpoint =
+							<&tpda_apss_in_tpdm_llm_silver>;
+					};
+				};
+			};
+		};
+
+		tpdm@78b0000 {
+			compatible = "qcom,coresight-tpdm", "arm,primecell";
+			reg = <0x0 0x078b0000 0x0 0x1000>;
+
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+
+			device-name = "tpdm_llm_gold";
+			qcom,cmb-element-bits = <32>;
+			qcom,cmb-msrs-num = <12>;
+
+			out-ports {
+				port {
+					tpdm_llm_gold_out_tpda_apss: endpoint {
+						remote-endpoint =
+							<&tpda_apss_in_tpdm_llm_gold>;
+					};
+				};
+			};
+		};
+
+		cti@78e0000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x078e0000 0x0 0x1000>;
+
+			device-name = "cti_apss_cti0";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@78f0000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x078f0000 0x0 0x1000>;
+
+			device-name = "cti_apss_cti1";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
+		cti@7900000 {
+			compatible = "arm,coresight-cti", "arm,primecell";
+			reg = <0x0 0x07900000 0x0 0x1000>;
+
+			device-name = "cti_apss_cti2";
+			clocks = <&aoss_qmp>;
+			clock-names = "apb_pclk";
+		};
+
 		sdhc_2: mmc@8804000 {
 			compatible = "qcom,sc7280-sdhci", "qcom,sdhci-msm-v5";
 			pinctrl-names = "default", "sleep";
@@ -3484,6 +5212,13 @@
 			};
 		};
 
+		ice: crypto@1d88000 {
+			compatible = "qcom,inline-crypto-engine";
+			reg = <0x0 0x01d88000 0x0 0x10000>;
+			qcom,ice-use-hwkm;
+			clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>;
+		};
+
 		usb_1_hsphy: phy@88e3000 {
 			compatible = "qcom,sc7280-usb-hs-phy",
 				     "qcom,usb-snps-hs-7nm-phy";
@@ -3538,21 +5273,21 @@
 				port@0 {
 					reg = <0>;
 
-					usb_dp_qmpphy_out: endpoint {
+					usb_1_qmpphy_out: endpoint {
 					};
 				};
 
 				port@1 {
 					reg = <1>;
 
-					usb_dp_qmpphy_usb_ss_in: endpoint {
+					usb_1_qmpphy_usb_ss_in: endpoint {
 					};
 				};
 
 				port@2 {
 					reg = <2>;
 
-					usb_dp_qmpphy_dp_in: endpoint {
+					usb_1_qmpphy_dp_in: endpoint {
 					};
 				};
 			};
@@ -3582,10 +5317,12 @@
 					  <&gcc GCC_USB30_SEC_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 241 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
 					      <&pdc 12 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 13 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq",
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
 					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq";
 
@@ -3640,7 +5377,7 @@
 			compatible = "qcom,sc7280-adsp-pas";
 			reg = <0 0x03700000 0 0x100>;
 
-			interrupts-extended = <&pdc 6 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
 					      <&adsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&adsp_smp2p_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&adsp_smp2p_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -3784,6 +5521,12 @@
 				opp-7 {
 					opp-peak-kBps = <8532000>;
 				};
+				opp-8 {
+					opp-peak-kBps = <10944000>;
+				};
+				opp-9 {
+					opp-peak-kBps = <12787200>;
+				};
 			};
 		};
 
@@ -3846,7 +5589,7 @@
 		};
 
 		eud: eud@88e0000 {
-			compatible = "qcom,sc7280-eud", "qcom,eud";
+			compatible = "qcom,eud";
 			reg = <0 0x88e0000 0 0x2000>,
 			      <0 0x88e2000 0 0x1000>;
 			interrupts-extended = <&pdc 11 IRQ_TYPE_LEVEL_HIGH>;
@@ -3877,7 +5620,7 @@
 			compatible = "qcom,sc7280-cdsp-pas";
 			reg = <0 0x0a300000 0 0x10000>;
 
-			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
 					      <&cdsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&cdsp_smp2p_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&cdsp_smp2p_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -4035,11 +5778,13 @@
 					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
 					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-names = "hs_phy_irq",
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
 					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
 					  "ss_phy_irq";
@@ -4062,9 +5807,29 @@
 				iommus = <&apps_smmu 0xe0 0x0>;
 				snps,dis_u2_susphy_quirk;
 				snps,dis_enblslpm_quirk;
+				snps,parkmode-disable-ss-quirk;
 				phys = <&usb_1_hsphy>, <&usb_1_qmpphy QMP_USB43DP_USB3_PHY>;
 				phy-names = "usb2-phy", "usb3-phy";
 				maximum-speed = "super-speed";
+
+				ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					port@0 {
+						reg = <0>;
+
+						usb_1_dwc3_hs: endpoint {
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+
+						usb_1_dwc3_ss: endpoint {
+						};
+					};
+				};
 			};
 		};
 
@@ -4095,6 +5860,8 @@
 				 <&apps_smmu 0x2184 0x20>;
 			memory-region = <&video_mem>;
 
+			status = "disabled";
+
 			video-decoder {
 				compatible = "venus-decoder";
 			};
@@ -4103,10 +5870,6 @@
 				compatible = "venus-encoder";
 			};
 
-			video-firmware {
-				iommus = <&apps_smmu 0x21a2 0x0>;
-			};
-
 			venus_opp_table: opp-table {
 				compatible = "operating-points-v2";
 
@@ -4228,6 +5991,181 @@
 			};
 		};
 
+		camss: camss@acaf000 {
+			compatible = "qcom,sc7280-camss";
+
+			clocks = <&camcc CAM_CC_CAMNOC_AXI_CLK>,
+				 <&camcc CAM_CC_IFE_0_CSID_CLK>,
+				 <&camcc CAM_CC_IFE_1_CSID_CLK>,
+				 <&camcc CAM_CC_IFE_2_CSID_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_0_CSID_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_1_CSID_CLK>,
+				 <&camcc CAM_CC_CSIPHY0_CLK>,
+				 <&camcc CAM_CC_CSI0PHYTIMER_CLK>,
+				 <&camcc CAM_CC_CSIPHY1_CLK>,
+				 <&camcc CAM_CC_CSI1PHYTIMER_CLK>,
+				 <&camcc CAM_CC_CSIPHY2_CLK>,
+				 <&camcc CAM_CC_CSI2PHYTIMER_CLK>,
+				 <&camcc CAM_CC_CSIPHY3_CLK>,
+				 <&camcc CAM_CC_CSI3PHYTIMER_CLK>,
+				 <&camcc CAM_CC_CSIPHY4_CLK>,
+				 <&camcc CAM_CC_CSI4PHYTIMER_CLK>,
+				 <&gcc GCC_CAMERA_AHB_CLK>,
+				 <&gcc GCC_CAMERA_HF_AXI_CLK>,
+				 <&camcc CAM_CC_CPAS_AHB_CLK>,
+				 <&camcc CAM_CC_IFE_0_AXI_CLK>,
+				 <&camcc CAM_CC_IFE_0_CLK>,
+				 <&camcc CAM_CC_IFE_0_CPHY_RX_CLK>,
+				 <&camcc CAM_CC_IFE_1_AXI_CLK>,
+				 <&camcc CAM_CC_IFE_1_CLK>,
+				 <&camcc CAM_CC_IFE_1_CPHY_RX_CLK>,
+				 <&camcc CAM_CC_IFE_2_AXI_CLK>,
+				 <&camcc CAM_CC_IFE_2_CLK>,
+				 <&camcc CAM_CC_IFE_2_CPHY_RX_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_0_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_0_CPHY_RX_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_1_CLK>,
+				 <&camcc CAM_CC_IFE_LITE_1_CPHY_RX_CLK>;
+
+			clock-names = "camnoc_axi",
+				      "csi0",
+				      "csi1",
+				      "csi2",
+				      "csi3",
+				      "csi4",
+				      "csiphy0",
+				      "csiphy0_timer",
+				      "csiphy1",
+				      "csiphy1_timer",
+				      "csiphy2",
+				      "csiphy2_timer",
+				      "csiphy3",
+				      "csiphy3_timer",
+				      "csiphy4",
+				      "csiphy4_timer",
+				      "gcc_camera_ahb",
+				      "gcc_camera_axi",
+				      "soc_ahb",
+				      "vfe0_axi",
+				      "vfe0",
+				      "vfe0_cphy_rx",
+				      "vfe1_axi",
+				      "vfe1",
+				      "vfe1_cphy_rx",
+				      "vfe2_axi",
+				      "vfe2",
+				      "vfe2_cphy_rx",
+				      "vfe0_lite",
+				      "vfe0_lite_cphy_rx",
+				      "vfe1_lite",
+				      "vfe1_lite_cphy_rx";
+
+			interconnects = <&gem_noc  MASTER_APPSS_PROC 0 &cnoc2 SLAVE_CAMERA_CFG 0>,
+					<&mmss_noc MASTER_CAMNOC_HF  0 &mc_virt SLAVE_EBI1     0>;
+
+			interconnect-names = "ahb", "hf_0";
+
+			interrupts = <GIC_SPI 464 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 466 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 640 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 122 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 641 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>;
+
+			interrupt-names = "csid0",
+					  "csid1",
+					  "csid2",
+					  "csid_lite0",
+					  "csid_lite1",
+					  "csiphy0",
+					  "csiphy1",
+					  "csiphy2",
+					  "csiphy3",
+					  "csiphy4",
+					  "vfe0",
+					  "vfe1",
+					  "vfe2",
+					  "vfe_lite0",
+					  "vfe_lite1";
+
+			iommus = <&apps_smmu 0x800 0x4e0>;
+
+			power-domains = <&camcc CAM_CC_IFE_0_GDSC>,
+					<&camcc CAM_CC_IFE_1_GDSC>,
+					<&camcc CAM_CC_IFE_2_GDSC>,
+					<&camcc CAM_CC_TITAN_TOP_GDSC>;
+
+			power-domains-names = "ife0", "ife1", "ife2", "top";
+
+			reg = <0x0 0x0acb3000 0x0 0x1000>,
+			      <0x0 0x0acba000 0x0 0x1000>,
+			      <0x0 0x0acc1000 0x0 0x1000>,
+			      <0x0 0x0acc8000 0x0 0x1000>,
+			      <0x0 0x0accf000 0x0 0x1000>,
+			      <0x0 0x0ace0000 0x0 0x2000>,
+			      <0x0 0x0ace2000 0x0 0x2000>,
+			      <0x0 0x0ace4000 0x0 0x2000>,
+			      <0x0 0x0ace6000 0x0 0x2000>,
+			      <0x0 0x0ace8000 0x0 0x2000>,
+			      <0x0 0x0acaf000 0x0 0x4000>,
+			      <0x0 0x0acb6000 0x0 0x4000>,
+			      <0x0 0x0acbd000 0x0 0x4000>,
+			      <0x0 0x0acc4000 0x0 0x4000>,
+			      <0x0 0x0accb000 0x0 0x4000>;
+
+			reg-names = "csid0",
+				    "csid1",
+				    "csid2",
+				    "csid_lite0",
+				    "csid_lite1",
+				    "csiphy0",
+				    "csiphy1",
+				    "csiphy2",
+				    "csiphy3",
+				    "csiphy4",
+				    "vfe0",
+				    "vfe1",
+				    "vfe2",
+				    "vfe_lite0",
+				    "vfe_lite1";
+
+			status = "disabled";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+				};
+
+				port@1 {
+					reg = <1>;
+				};
+
+				port@2 {
+					reg = <2>;
+				};
+
+				port@3 {
+					reg = <3>;
+				};
+
+				port@4 {
+					reg = <4>;
+				};
+			};
+		};
+
 		camcc: clock-controller@ad00000 {
 			compatible = "qcom,sc7280-camcc";
 			reg = <0 0x0ad00000 0 0x10000>;
@@ -4793,6 +6731,39 @@
 				bias-pull-down;
 			};
 
+			cam2_default: cam2-default {
+				mclk {
+					pins = "gpio67";
+					function = "cam_mclk";
+					drive-strength = <2>;
+					bias-disable;
+				};
+
+				rst {
+					pins = "gpio78";
+					function = "gpio";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			cam2_suspend: cam2-suspend {
+				mclk {
+					pins = "gpio67";
+					function = "cam_mclk";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+
+				rst {
+					pins = "gpio78";
+					function = "gpio";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+
 			dp_hot_plug_det: dp-hot-plug-det-state {
 				pins = "gpio47";
 				function = "dp_hot";
@@ -4833,6 +6804,11 @@
 				function = "mi2s1_data0";
 			};
 
+			mi2s1_mclk: mi2s1-mclk-state {
+				pins = "gpio105";
+				function = "sec_mi2s";
+			};
+
 			mi2s1_sclk: mi2s1-sclk-state {
 				pins = "gpio106";
 				function = "mi2s1_sck";
@@ -4843,6 +6819,31 @@
 				function = "mi2s1_ws";
 			};
 
+			pcie0_reset_n: pcie0-reset-n-state {
+				pins = "gpio87";
+				function = "gpio";
+
+				drive-strength = <16>;
+				output-low;
+				bias-disable;
+			};
+
+			pcie0_wake_n: pcie0-wake-n-state {
+				pins = "gpio89";
+				function = "gpio";
+
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+
+			pcie0_clkreq_n: pcie0-clkreq-n-state {
+				pins = "gpio88";
+				function = "pcie0_clkreqn";
+
+				bias-pull-up;
+				drive-strength = <2>;
+			};
+
 			pcie1_clkreq_n: pcie1-clkreq-n-state {
 				pins = "gpio79";
 				function = "pcie1_clkreqn";
@@ -5298,16 +7299,6 @@
 				function = "qup04";
 			};
 
-			qup_uart5_cts: qup-uart5-cts-state {
-				pins = "gpio20";
-				function = "qup05";
-			};
-
-			qup_uart5_rts: qup-uart5-rts-state {
-				pins = "gpio21";
-				function = "qup05";
-			};
-
 			qup_uart5_tx: qup-uart5-tx-state {
 				pins = "gpio22";
 				function = "qup05";
@@ -5607,6 +7598,7 @@
 		apps_smmu: iommu@15000000 {
 			compatible = "qcom,sc7280-smmu-500", "arm,mmu-500";
 			reg = <0 0x15000000 0 0x100000>;
+			ranges;
 			#iommu-cells = <2>;
 			#global-interrupts = <1>;
 			dma-coherent;
@@ -5691,6 +7683,95 @@
 				     <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>;
+
+			#address-cells = <2>;
+			#size-cells = <2>;
+
+			anoc_1_tbu: anoc_1_tbu@151dd000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151dd000 0x0 0x1000>;
+				reg-names = "base";
+				interconnects = <&gem_noc MASTER_APPSS_PROC 0
+						 &cnoc3 SLAVE_TCU 0>;
+				qcom,stream-id-range = <0x0 0x400>;
+			};
+
+			anoc_2_tbu: anoc_2_tbu@151e1000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151e1000 0x0 0x1000>;
+				reg-names = "base";
+				interconnects = <&gem_noc MASTER_APPSS_PROC 0
+						 &cnoc3 SLAVE_TCU 0>;
+				qcom,stream-id-range = <0x400 0x400>;
+			};
+
+			mnoc_hf_0_tbu: mnoc_hf_0_tbu@151e5000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151e5000 0x0 0x1000>;
+				reg-names = "base";
+				interconnects = <&mmss_noc MASTER_MDP0 0
+						 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&gcc HLOS1_VOTE_MMNOC_MMU_TBU_HF0_GDSC>;
+				qcom,stream-id-range = <0x800 0x400>;
+			};
+
+			mnoc_hf_1_tbu: mnoc_hf_1_tbu@151e9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151e9000 0x0 0x1000>;
+				reg-names = "base";
+				interconnects = <&mmss_noc MASTER_MDP0 0
+						 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&gcc HLOS1_VOTE_MMNOC_MMU_TBU_HF1_GDSC>;
+				qcom,stream-id-range = <0xc00 0x400>;
+			};
+
+			compute_dsp_0_tbu: compute_dsp_0_tbu@151ed000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151ed000 0x0 0x1000>;
+				reg-names = "base";
+				interconnects = <&nsp_noc MASTER_CDSP_PROC 0
+						 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&gcc HLOS1_VOTE_TURING_MMU_TBU1_GDSC>;
+				qcom,stream-id-range = <0x1000 0x400>;
+			};
+
+			compute_dsp_1_tbu: compute_dsp_1_tbu@151f1000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151f1000 0x0 0x1000>;
+				reg-names = "base";
+				interconnects = <&nsp_noc MASTER_CDSP_PROC 0
+						 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&gcc HLOS1_VOTE_TURING_MMU_TBU0_GDSC>;
+				qcom,stream-id-range = <0x1400 0x400>;
+			};
+
+			adsp_tbu: adsp_tbu@151f5000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151f5000 0x0 0x1000>;
+				reg-names = "base";
+				interconnects = <&gem_noc MASTER_APPSS_PROC 0
+						 &lpass_ag_noc SLAVE_LPASS_CORE_CFG 0>;
+				qcom,stream-id-range = <0x1800 0x400>;
+			};
+
+			anoc_1_pcie_tbu: anoc_1_pcie_tbu@151f9000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151f9000 0x0 0x1000>;
+				reg-names = "base";
+				interconnects = <&gem_noc MASTER_APPSS_PROC 0
+						 &cnoc3 SLAVE_TCU 0>;
+				qcom,stream-id-range = <0x1c00 0x400>;
+			};
+
+			mnoc_sf_0_tbu: mnoc_sf_0_tbu@151fd000 {
+				compatible = "qcom,qsmmuv500-tbu";
+				reg = <0x0 0x151fd000 0x0 0x1000>;
+				reg-names = "base";
+				interconnects = <&mmss_noc MASTER_CAMNOC_SF 0
+						 &mc_virt SLAVE_EBI1 0>;
+				power-domains = <&gcc HLOS1_VOTE_MMNOC_MMU_TBU_SF0_GDSC>;
+				qcom,stream-id-range = <0x2000 0x400>;
+			};
 		};
 
 		intc: interrupt-controller@17a00000 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc8180x.dtsi
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
  * Copyright (c) 2020-2023, Linaro Limited
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <dt-bindings/clock/qcom,dispcc-sm8250.h>
@@ -290,7 +291,7 @@
 			BIG_CPU_SLEEP_0: cpu-sleep-1-0 {
 				compatible = "arm,idle-state";
 				arm,psci-suspend-param = <0x40000004>;
-				entry-latency-us = <241>;
+				entry-latency-us = <2411>;
 				exit-latency-us = <1461>;
 				min-residency-us = <4488>;
 				local-timer-stop;
@@ -298,7 +299,15 @@
 		};
 
 		domain-idle-states {
-			CLUSTER_SLEEP_0: cluster-sleep-0 {
+			CLUSTER_SLEEP_APSS_OFF: cluster-sleep-0 {
+				compatible = "domain-idle-state";
+				arm,psci-suspend-param = <0x41000044>;
+				entry-latency-us = <3300>;
+				exit-latency-us = <3300>;
+				min-residency-us = <6000>;
+			};
+
+			CLUSTER_SLEEP_AOSS_SLEEP: cluster-sleep-1 {
 				compatible = "domain-idle-state";
 				arm,psci-suspend-param = <0x4100a344>;
 				entry-latency-us = <3263>;
@@ -582,7 +591,7 @@
 
 		CLUSTER_PD: power-domain-cpu-cluster0 {
 			#power-domain-cells = <0>;
-			domain-idle-states = <&CLUSTER_SLEEP_0>;
+			domain-idle-states = <&CLUSTER_SLEEP_APSS_OFF &CLUSTER_SLEEP_AOSS_SLEEP>;
 		};
 	};
 
@@ -782,6 +791,7 @@
 			clock-names = "bi_tcxo",
 				      "bi_tcxo_ao",
 				      "sleep_clk";
+			power-domains = <&rpmhpd SC8180X_CX>;
 		};
 
 		qupv3_id_0: geniqup@8c0000 {
@@ -1843,7 +1853,7 @@
 			power-domains = <&gcc PCIE_3_GDSC>;
 
 			interconnects = <&aggre2_noc MASTER_PCIE_3 0 &mc_virt SLAVE_EBI_CH0 0>,
-					<&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_0 0>;
+					<&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_3 0>;
 			interconnect-names = "pcie-mem", "cpu-pcie";
 
 			phys = <&pcie3_phy>;
@@ -1941,7 +1951,7 @@
 			power-domains = <&gcc PCIE_1_GDSC>;
 
 			interconnects = <&aggre2_noc MASTER_PCIE_1 0 &mc_virt SLAVE_EBI_CH0 0>,
-					<&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_0 0>;
+					<&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_1 0>;
 			interconnect-names = "pcie-mem", "cpu-pcie";
 
 			phys = <&pcie1_phy>;
@@ -2039,7 +2049,7 @@
 			power-domains = <&gcc PCIE_2_GDSC>;
 
 			interconnects = <&aggre2_noc MASTER_PCIE_2 0 &mc_virt SLAVE_EBI_CH0 0>,
-					<&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_0 0>;
+					<&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_2 0>;
 			interconnect-names = "pcie-mem", "cpu-pcie";
 
 			phys = <&pcie2_phy>;
@@ -2138,6 +2148,8 @@
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
 
+			power-domains = <&gcc UFS_PHY_GDSC>;
+
 			#phy-cells = <0>;
 
 			status = "disabled";
@@ -2539,11 +2551,14 @@
 
 		system-cache-controller@9200000 {
 			compatible = "qcom,sc8180x-llcc";
-			reg = <0 0x09200000 0 0x50000>, <0 0x09280000 0 0x50000>,
-			      <0 0x09300000 0 0x50000>, <0 0x09380000 0 0x50000>,
-			      <0 0x09600000 0 0x50000>;
+			reg = <0 0x09200000 0 0x58000>, <0 0x09280000 0 0x58000>,
+			      <0 0x09300000 0 0x58000>, <0 0x09380000 0 0x58000>,
+			      <0 0x09400000 0 0x58000>, <0 0x09480000 0 0x58000>,
+			      <0 0x09500000 0 0x58000>, <0 0x09580000 0 0x58000>,
+			      <0 0x09600000 0 0x58000>;
 			reg-names = "llcc0_base", "llcc1_base", "llcc2_base",
-				    "llcc3_base", "llcc_broadcast_base";
+				    "llcc3_base", "llcc4_base", "llcc5_base",
+				    "llcc6_base", "llcc7_base",  "llcc_broadcast_base";
 			interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>;
 		};
 
@@ -2606,6 +2621,9 @@
 				phys = <&usb_prim_hsphy>, <&usb_prim_ssphy>;
 				phy-names = "usb2-phy", "usb3-phy";
 
+				snps,dis-u1-entry-quirk;
+				snps,dis-u2-entry-quirk;
+
 				port {
 					usb_prim_role_switch: endpoint {
 					};
@@ -2632,7 +2650,7 @@
 			resets = <&gcc GCC_USB30_SEC_BCR>;
 			power-domains = <&gcc USB30_SEC_GDSC>;
 			interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 7 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 40 IRQ_TYPE_LEVEL_HIGH>,
 					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 11 IRQ_TYPE_EDGE_BOTH>;
 			interrupt-names = "hs_phy_irq", "ss_phy_irq",
@@ -2663,6 +2681,9 @@
 				phys = <&usb_sec_hsphy>, <&usb_sec_ssphy>;
 				phy-names = "usb2-phy", "usb3-phy";
 
+				snps,dis-u1-entry-quirk;
+				snps,dis-u2-entry-quirk;
+
 				port {
 					usb_sec_role_switch: endpoint {
 					};
@@ -2692,9 +2713,15 @@
 			interrupt-controller;
 			#interrupt-cells = <1>;
 
-			interconnects = <&mmss_noc MASTER_MDP_PORT0 0 &mc_virt SLAVE_EBI_CH0 0>,
-					<&mmss_noc MASTER_MDP_PORT1 0 &mc_virt SLAVE_EBI_CH0 0>;
-			interconnect-names = "mdp0-mem", "mdp1-mem";
+			interconnects = <&mmss_noc MASTER_MDP_PORT0 QCOM_ICC_TAG_ALWAYS
+					 &mc_virt SLAVE_EBI_CH0 QCOM_ICC_TAG_ALWAYS>,
+					<&mmss_noc MASTER_MDP_PORT1 QCOM_ICC_TAG_ALWAYS
+					 &mc_virt SLAVE_EBI_CH0 QCOM_ICC_TAG_ALWAYS>,
+					<&gem_noc MASTER_AMPSS_M0 QCOM_ICC_TAG_ALWAYS
+					 &config_noc SLAVE_DISPLAY_CFG QCOM_ICC_TAG_ALWAYS>;
+			interconnect-names = "mdp0-mem",
+					     "mdp1-mem",
+					     "cpu-cfg";
 
 			iommus = <&apps_smmu 0x800 0x420>;
 
@@ -2723,10 +2750,8 @@
 					      "rot",
 					      "lut";
 
-				assigned-clocks = <&dispcc DISP_CC_MDSS_MDP_CLK>,
-						  <&dispcc DISP_CC_MDSS_VSYNC_CLK>;
-				assigned-clock-rates = <460000000>,
-						       <19200000>;
+				assigned-clocks = <&dispcc DISP_CC_MDSS_VSYNC_CLK>;
+				assigned-clock-rates = <19200000>;
 
 				operating-points-v2 = <&mdp_opp_table>;
 				power-domains = <&rpmhpd SC8180X_MMCX>;
@@ -3184,7 +3209,7 @@
 				 <&dispcc DISP_CC_MDSS_AHB_CLK>;
 			clock-names = "aux", "cfg_ahb";
 
-			power-domains = <&dispcc MDSS_GDSC>;
+			power-domains = <&rpmhpd SC8180X_MX>;
 
 			#clock-cells = <1>;
 			#phy-cells = <0>;
@@ -3210,6 +3235,7 @@
 				      "edp_phy_pll_link_clk",
 				      "edp_phy_pll_vco_div_clk";
 			power-domains = <&rpmhpd SC8180X_MMCX>;
+			required-opps = <&rpmhpd_opp_low_svs>;
 			#clock-cells = <1>;
 			#reset-cells = <1>;
 			#power-domain-cells = <1>;
@@ -3248,7 +3274,7 @@
 
 		aoss_qmp: power-controller@c300000 {
 			compatible = "qcom,sc8180x-aoss-qmp", "qcom,aoss-qmp";
-			reg = <0x0 0x0c300000 0x0 0x100000>;
+			reg = <0x0 0x0c300000 0x0 0x400>;
 			interrupts = <GIC_SPI 389 IRQ_TYPE_EDGE_RISING>;
 			mboxes = <&apss_shared 0>;
 
@@ -3613,7 +3639,7 @@
 		};
 
 		cpufreq_hw: cpufreq@18323000 {
-			compatible = "qcom,cpufreq-hw";
+			compatible = "qcom,sc8180x-cpufreq-hw", "qcom,cpufreq-hw";
 			reg = <0 0x18323000 0 0x1400>, <0 0x18325800 0 0x1400>;
 			reg-names = "freq-domain0", "freq-domain1";
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
@@ -299,7 +299,7 @@
 	thermal-zones {
 		skin-temp-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <0>;
+
 			thermal-sensors = <&pmk8280_adc_tm 5>;
 
 			trips {
@@ -416,6 +416,13 @@
 			regulator-always-on;
 		};
 
+		vreg_l1b: ldo1 {
+			regulator-name = "vreg_l1b";
+			regulator-min-microvolt = <912000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
 		vreg_l3b: ldo3 {
 			regulator-name = "vreg_l3b";
 			regulator-min-microvolt = <1200000>;
@@ -466,6 +473,13 @@
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
+		vreg_l8c: ldo8 {
+			regulator-name = "vreg_l8c";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
 		vreg_l12c: ldo12 {
 			regulator-name = "vreg_l12c";
 			regulator-min-microvolt = <1800000>;
@@ -499,6 +513,13 @@
 		vdd-l6-l9-l10-supply = <&vreg_s12b>;
 		vdd-l8-supply = <&vreg_s12b>;
 
+		vreg_l2d: ldo2 {
+			regulator-name = "vreg_l2d";
+			regulator-min-microvolt = <3072000>;
+			regulator-max-microvolt = <3072000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
 		vreg_l3d: ldo3 {
 			regulator-name = "vreg_l3d";
 			regulator-min-microvolt = <1200000>;
@@ -527,12 +548,26 @@
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
+		vreg_l8d: ldo8 {
+			regulator-name = "vreg_l8d";
+			regulator-min-microvolt = <912000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
 		vreg_l9d: ldo9 {
 			regulator-name = "vreg_l9d";
 			regulator-min-microvolt = <912000>;
 			regulator-max-microvolt = <912000>;
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
+
+		vreg_l10d: ldo10 {
+			regulator-name = "vreg_l10d";
+			regulator-min-microvolt = <912000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
 	};
 };
 
@@ -620,15 +655,16 @@
 
 	status = "okay";
 
-	/* FIXME: verify */
 	touchscreen@10 {
-		compatible = "hid-over-i2c";
+		compatible = "elan,ekth5015m", "elan,ekth6915";
 		reg = <0x10>;
 
-		hid-descr-addr = <0x1>;
 		interrupts-extended = <&tlmm 175 IRQ_TYPE_LEVEL_LOW>;
-		vdd-supply = <&vreg_misc_3p3>;
-		vddl-supply = <&vreg_s10b>;
+		reset-gpios = <&tlmm 99 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>;
+		no-reset-on-power-off;
+
+		vcc33-supply = <&vreg_misc_3p3>;
+		vccio-supply = <&vreg_misc_3p3>;
 
 		pinctrl-names = "default";
 		pinctrl-0 = <&ts0_default>;
@@ -1203,6 +1239,60 @@
 	remote-endpoint = <&pmic_glink_con1_hs>;
 };
 
+&usb_2 {
+	status = "okay";
+};
+
+&usb_2_dwc3 {
+	dr_mode = "host";
+};
+
+&usb_2_hsphy0 {
+	vdda-pll-supply = <&vreg_l1b>;
+	vdda18-supply = <&vreg_l1c>;
+	vdda33-supply = <&vreg_l7d>;
+
+	status = "okay";
+};
+
+&usb_2_hsphy1 {
+	vdda-pll-supply = <&vreg_l8d>;
+	vdda18-supply = <&vreg_l1c>;
+	vdda33-supply = <&vreg_l7d>;
+
+	status = "okay";
+};
+
+&usb_2_hsphy2 {
+	vdda-pll-supply = <&vreg_l10d>;
+	vdda18-supply = <&vreg_l8c>;
+	vdda33-supply = <&vreg_l2d>;
+
+	status = "okay";
+};
+
+&usb_2_hsphy3 {
+	vdda-pll-supply = <&vreg_l10d>;
+	vdda18-supply = <&vreg_l8c>;
+	vdda33-supply = <&vreg_l2d>;
+
+	status = "okay";
+};
+
+&usb_2_qmpphy0 {
+	vdda-phy-supply = <&vreg_l1b>;
+	vdda-pll-supply = <&vreg_l4d>;
+
+	status = "okay";
+};
+
+&usb_2_qmpphy1 {
+	vdda-phy-supply = <&vreg_l8d>;
+	vdda-pll-supply = <&vreg_l4d>;
+
+	status = "okay";
+};
+
 &vamacro {
 	pinctrl-0 = <&dmic01_default>, <&dmic02_default>;
 	pinctrl-names = "default";
@@ -1452,8 +1542,8 @@
 		reset-n-pins {
 			pins = "gpio99";
 			function = "gpio";
-			output-high;
-			drive-strength = <16>;
+			drive-strength = <2>;
+			bias-disable;
 		};
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc8280xp-pmics.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc8280xp-pmics.dtsi
@@ -11,7 +11,7 @@
 	thermal-zones {
 		pm8280_1_thermal: pm8280-1-thermal {
 			polling-delay-passive = <100>;
-			polling-delay = <0>;
+
 			thermal-sensors = <&pm8280_1_temp_alarm>;
 
 			trips {
@@ -31,7 +31,7 @@
 
 		pm8280_2_thermal: pm8280-2-thermal {
 			polling-delay-passive = <100>;
-			polling-delay = <0>;
+
 			thermal-sensors = <&pm8280_2_temp_alarm>;
 
 			trips {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
  * Copyright (c) 2022, Linaro Limited
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <dt-bindings/clock/qcom,dispcc-sc8280xp.h>
@@ -1774,6 +1775,7 @@
 			reset-names = "pci";
 
 			power-domains = <&gcc PCIE_4_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			phys = <&pcie4_phy>;
 			phy-names = "pciephy";
@@ -1798,6 +1800,7 @@
 			assigned-clock-rates = <100000000>;
 
 			power-domains = <&gcc PCIE_4_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			resets = <&gcc GCC_PCIE_4_PHY_BCR>;
 			reset-names = "phy";
@@ -1872,6 +1875,7 @@
 			reset-names = "pci";
 
 			power-domains = <&gcc PCIE_3B_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			phys = <&pcie3b_phy>;
 			phy-names = "pciephy";
@@ -1896,6 +1900,7 @@
 			assigned-clock-rates = <100000000>;
 
 			power-domains = <&gcc PCIE_3B_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			resets = <&gcc GCC_PCIE_3B_PHY_BCR>;
 			reset-names = "phy";
@@ -1970,6 +1975,7 @@
 			reset-names = "pci";
 
 			power-domains = <&gcc PCIE_3A_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			phys = <&pcie3a_phy>;
 			phy-names = "pciephy";
@@ -1995,6 +2001,7 @@
 			assigned-clock-rates = <100000000>;
 
 			power-domains = <&gcc PCIE_3A_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			resets = <&gcc GCC_PCIE_3A_PHY_BCR>;
 			reset-names = "phy";
@@ -2071,6 +2078,7 @@
 			reset-names = "pci";
 
 			power-domains = <&gcc PCIE_2B_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			phys = <&pcie2b_phy>;
 			phy-names = "pciephy";
@@ -2095,6 +2103,7 @@
 			assigned-clock-rates = <100000000>;
 
 			power-domains = <&gcc PCIE_2B_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			resets = <&gcc GCC_PCIE_2B_PHY_BCR>;
 			reset-names = "phy";
@@ -2169,6 +2178,7 @@
 			reset-names = "pci";
 
 			power-domains = <&gcc PCIE_2A_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			phys = <&pcie2a_phy>;
 			phy-names = "pciephy";
@@ -2194,6 +2204,7 @@
 			assigned-clock-rates = <100000000>;
 
 			power-domains = <&gcc PCIE_2A_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
 
 			resets = <&gcc GCC_PCIE_2A_PHY_BCR>;
 			reset-names = "phy";
@@ -2635,7 +2646,7 @@
 			compatible = "qcom,sc8280xp-adsp-pas";
 			reg = <0 0x03000000 0 0x100>;
 
-			interrupts-extended = <&intc GIC_SPI 162 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 162 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -3331,6 +3342,88 @@
 			interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>;
 		};
 
+		usb_2: usb@a4f8800 {
+			compatible = "qcom,sc8280xp-dwc3-mp", "qcom,dwc3";
+			reg = <0 0x0a4f8800 0 0x400>;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			ranges;
+
+			clocks = <&gcc GCC_CFG_NOC_USB3_MP_AXI_CLK>,
+				 <&gcc GCC_USB30_MP_MASTER_CLK>,
+				 <&gcc GCC_AGGRE_USB3_MP_AXI_CLK>,
+				 <&gcc GCC_USB30_MP_SLEEP_CLK>,
+				 <&gcc GCC_USB30_MP_MOCK_UTMI_CLK>,
+				 <&gcc GCC_AGGRE_USB_NOC_AXI_CLK>,
+				 <&gcc GCC_AGGRE_USB_NOC_NORTH_AXI_CLK>,
+				 <&gcc GCC_AGGRE_USB_NOC_SOUTH_AXI_CLK>,
+				 <&gcc GCC_SYS_NOC_USB_AXI_CLK>;
+			clock-names = "cfg_noc", "core", "iface", "sleep", "mock_utmi",
+				      "noc_aggr", "noc_aggr_north", "noc_aggr_south", "noc_sys";
+
+			assigned-clocks = <&gcc GCC_USB30_MP_MOCK_UTMI_CLK>,
+					  <&gcc GCC_USB30_MP_MASTER_CLK>;
+			assigned-clock-rates = <19200000>, <200000000>;
+
+			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 857 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 856 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 860 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 859 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 127 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 126 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 129 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 128 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 131 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 130 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 133 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 132 IRQ_TYPE_EDGE_BOTH>,
+					      <&pdc 16 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>;
+
+			interrupt-names = "pwr_event_1", "pwr_event_2",
+					  "pwr_event_3", "pwr_event_4",
+					  "hs_phy_1",	 "hs_phy_2",
+					  "hs_phy_3",	 "hs_phy_4",
+					  "dp_hs_phy_1", "dm_hs_phy_1",
+					  "dp_hs_phy_2", "dm_hs_phy_2",
+					  "dp_hs_phy_3", "dm_hs_phy_3",
+					  "dp_hs_phy_4", "dm_hs_phy_4",
+					  "ss_phy_1",	 "ss_phy_2";
+
+			power-domains = <&gcc USB30_MP_GDSC>;
+			required-opps = <&rpmhpd_opp_nom>;
+
+			resets = <&gcc GCC_USB30_MP_BCR>;
+
+			interconnects = <&aggre1_noc MASTER_USB3_MP 0 &mc_virt SLAVE_EBI1 0>,
+					<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_USB3_MP 0>;
+			interconnect-names = "usb-ddr", "apps-usb";
+
+			wakeup-source;
+
+			status = "disabled";
+
+			usb_2_dwc3: usb@a400000 {
+				compatible = "snps,dwc3";
+				reg = <0 0x0a400000 0 0xcd00>;
+				interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>;
+				iommus = <&apps_smmu 0x800 0x0>;
+				phys = <&usb_2_hsphy0>, <&usb_2_qmpphy0>,
+				       <&usb_2_hsphy1>, <&usb_2_qmpphy1>,
+				       <&usb_2_hsphy2>,
+				       <&usb_2_hsphy3>;
+				phy-names = "usb2-0", "usb3-0",
+					    "usb2-1", "usb3-1",
+					    "usb2-2",
+					    "usb2-3";
+				dr_mode = "host";
+			};
+		};
+
 		usb_0: usb@a6f8800 {
 			compatible = "qcom,sc8280xp-dwc3", "qcom,dwc3";
 			reg = <0 0x0a6f8800 0 0x400>;
@@ -3384,6 +3477,9 @@
 				phys = <&usb_0_hsphy>, <&usb_0_qmpphy QMP_USB43DP_USB3_PHY>;
 				phy-names = "usb2-phy", "usb3-phy";
 
+				snps,dis-u1-entry-quirk;
+				snps,dis-u2-entry-quirk;
+
 				port {
 					usb_0_role_switch: endpoint {
 					};
@@ -3444,6 +3540,9 @@
 				phys = <&usb_1_hsphy>, <&usb_1_qmpphy QMP_USB43DP_USB3_PHY>;
 				phy-names = "usb2-phy", "usb3-phy";
 
+				snps,dis-u1-entry-quirk;
+				snps,dis-u2-entry-quirk;
+
 				port {
 					usb_1_role_switch: endpoint {
 					};
@@ -4407,7 +4506,7 @@
 			compatible = "qcom,sc8280xp-nsp0-pas";
 			reg = <0 0x1b300000 0 0x100>;
 
-			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_nsp0_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_nsp0_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_nsp0_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -4538,7 +4637,7 @@
 			compatible = "qcom,sc8280xp-nsp1-pas";
 			reg = <0 0x21300000 0 0x100>;
 
-			interrupts-extended = <&intc GIC_SPI 887 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 887 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_nsp1_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_nsp1_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_nsp1_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -5079,7 +5178,6 @@
 	thermal-zones {
 		cpu0-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens0 1>;
 
@@ -5094,7 +5192,6 @@
 
 		cpu1-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens0 2>;
 
@@ -5109,7 +5206,6 @@
 
 		cpu2-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens0 3>;
 
@@ -5124,7 +5220,6 @@
 
 		cpu3-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens0 4>;
 
@@ -5139,7 +5234,6 @@
 
 		cpu4-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens0 5>;
 
@@ -5154,7 +5248,6 @@
 
 		cpu5-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens0 6>;
 
@@ -5169,7 +5262,6 @@
 
 		cpu6-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens0 7>;
 
@@ -5184,7 +5276,6 @@
 
 		cpu7-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens0 8>;
 
@@ -5199,7 +5290,6 @@
 
 		cluster0-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens0 9>;
 
@@ -5214,7 +5304,6 @@
 
 		mem-thermal {
 			polling-delay-passive = <250>;
-			polling-delay = <1000>;
 
 			thermal-sensors = <&tsens1 15>;
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sdm450-motorola-ali.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sdm450-motorola-ali.dts
@@ -248,5 +248,6 @@
 };
 
 &usb3_dwc3 {
+	/delete-property/ usb-role-switch;
 	dr_mode = "peripheral";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sdm630.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sdm630.dtsi
@@ -1296,6 +1296,7 @@
 				interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
 				snps,dis_u2_susphy_quirk;
 				snps,dis_enblslpm_quirk;
+				snps,parkmode-disable-ss-quirk;
 
 				/*
 				 * SDM630 technically supports USB3 but I
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts
@@ -287,5 +287,6 @@
 };
 
 &usb3_dwc3 {
+	/delete-property/ usb-role-switch;
 	dr_mode = "peripheral";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
@@ -580,7 +580,7 @@
 &pcie0 {
 	status = "okay";
 	perst-gpios = <&tlmm 35 GPIO_ACTIVE_LOW>;
-	enable-gpio = <&tlmm 134 GPIO_ACTIVE_HIGH>;
+	wake-gpios = <&tlmm 134 GPIO_ACTIVE_HIGH>;
 
 	vddpe-3v3-supply = <&pcie0_3p3v_dual>;
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
@@ -508,13 +508,13 @@
 };
 
 &q6afedai {
-	qi2s@22 {
-		reg = <22>;
+	dai@22 {
+		reg = <QUATERNARY_MI2S_RX>;
 		qcom,sd-lines = <1>;
 	};
 
-	qi2s@23 {
-		reg = <23>;
+	dai@23 {
+		reg = <QUATERNARY_MI2S_TX>;
 		qcom,sd-lines = <0>;
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts
@@ -60,7 +60,7 @@
 	};
 
 	reserved-memory {
-		framebuffer_region@9d400000 {
+		framebuffer@9d400000 {
 			reg = <0x0 0x9d400000 0x0 (1080 * 2160 * 4)>;
 			no-map;
 		};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -2644,6 +2644,8 @@
 			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
 				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
 
+			power-domains = <&gcc UFS_PHY_GDSC>;
+
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
 
@@ -3366,8 +3368,8 @@
 
 			qcom,qmp = <&aoss_qmp>;
 
-			power-domains = <&rpmhpd SDM845_CX>,
-					<&rpmhpd SDM845_MX>;
+			power-domains = <&rpmhpd SDM845_LCX>,
+					<&rpmhpd SDM845_LMX>;
 			power-domain-names = "lcx", "lmx";
 
 			memory-region = <&slpi_mem>;
@@ -4080,6 +4082,7 @@
 				iommus = <&apps_smmu 0x740 0>;
 				snps,dis_u2_susphy_quirk;
 				snps,dis_enblslpm_quirk;
+				snps,parkmode-disable-ss-quirk;
 				phys = <&usb_1_hsphy>, <&usb_1_qmpphy QMP_USB43DP_USB3_PHY>;
 				phy-names = "usb2-phy", "usb3-phy";
 			};
@@ -4131,6 +4134,7 @@
 				iommus = <&apps_smmu 0x760 0>;
 				snps,dis_u2_susphy_quirk;
 				snps,dis_enblslpm_quirk;
+				snps,parkmode-disable-ss-quirk;
 				phys = <&usb_2_hsphy>, <&usb_2_qmpphy>;
 				phy-names = "usb2-phy", "usb3-phy";
 			};
@@ -5568,7 +5572,7 @@
 					hysteresis = <2000>;
 					type = "hot";
 				};
-				cluster0_crit: cluster0_crit {
+				cluster0_crit: cluster0-crit {
 					temperature = <110000>;
 					hysteresis = <2000>;
 					type = "critical";
@@ -5588,7 +5592,7 @@
 					hysteresis = <2000>;
 					type = "hot";
 				};
-				cluster1_crit: cluster1_crit {
+				cluster1_crit: cluster1-crit {
 					temperature = <110000>;
 					hysteresis = <2000>;
 					type = "critical";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
@@ -494,6 +494,7 @@
 &ipa {
 	qcom,gsi-loader = "self";
 	memory-region = <&ipa_fw_mem>;
+	firmware-name = "qcom/sdm850/LENOVO/81JL/ipa_fws.elf";
 	status = "okay";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm4250-oneplus-billie2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm4250-oneplus-billie2.dts
@@ -240,6 +240,7 @@
 };
 
 &usb_dwc3 {
+	/delete-property/ usb-role-switch;
 	maximum-speed = "high-speed";
 	dr_mode = "peripheral";
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts
@@ -234,6 +234,7 @@
 };
 
 &usb_dwc3 {
+	/delete-property/ usb-role-switch;
 	maximum-speed = "high-speed";
 	dr_mode = "peripheral";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm6115.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm6115.dtsi
@@ -614,6 +614,11 @@
 			#hwlock-cells = <1>;
 		};
 
+		tcsr_regs: syscon@3c0000 {
+			compatible = "qcom,sm6115-tcsr", "syscon";
+			reg = <0x0 0x003c0000 0x0 0x40000>;
+		};
+
 		tlmm: pinctrl@500000 {
 			compatible = "qcom,sm6115-tlmm";
 			reg = <0x0 0x00500000 0x0 0x400000>,
@@ -879,6 +884,8 @@
 
 			#phy-cells = <0>;
 
+			qcom,tcsr-reg = <&tcsr_regs 0xb244>;
+
 			status = "disabled";
 		};
 
@@ -1061,6 +1068,7 @@
 
 			power-domains = <&rpmpd SM6115_VDDCX>;
 			operating-points-v2 = <&sdhc1_opp_table>;
+			iommus = <&apps_smmu 0x00c0 0x0>;
 			interconnects = <&system_noc MASTER_SDCC_1 RPM_ALWAYS_TAG
 					 &bimc SLAVE_EBI_CH0 RPM_ALWAYS_TAG>,
 					<&bimc MASTER_AMPSS_M0 RPM_ALWAYS_TAG
@@ -1197,6 +1205,8 @@
 			clocks = <&gcc GCC_UFS_CLKREF_CLK>, <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
 			clock-names = "ref", "ref_aux";
 
+			power-domains = <&gcc GCC_UFS_PHY_GDSC>;
+
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
 
@@ -1603,7 +1613,6 @@
 			interconnect-names = "usb-ddr",
 					     "apps-usb";
 
-			qcom,select-utmi-as-pipe-clk;
 			status = "disabled";
 
 			usb_dwc3: usb@4e00000 {
@@ -3088,7 +3097,7 @@
 					type = "passive";
 				};
 
-				cpu4_crit: cpu_crit {
+				cpu4_crit: cpu-crit {
 					temperature = <110000>;
 					hysteresis = <1000>;
 					type = "critical";
@@ -3114,7 +3123,7 @@
 					type = "passive";
 				};
 
-				cpu5_crit: cpu_crit {
+				cpu5_crit: cpu-crit {
 					temperature = <110000>;
 					hysteresis = <1000>;
 					type = "critical";
@@ -3140,7 +3149,7 @@
 					type = "passive";
 				};
 
-				cpu6_crit: cpu_crit {
+				cpu6_crit: cpu-crit {
 					temperature = <110000>;
 					hysteresis = <1000>;
 					type = "critical";
@@ -3166,7 +3175,7 @@
 					type = "passive";
 				};
 
-				cpu7_crit: cpu_crit {
+				cpu7_crit: cpu-crit {
 					temperature = <110000>;
 					hysteresis = <1000>;
 					type = "critical";
@@ -3192,7 +3201,7 @@
 					type = "passive";
 				};
 
-				cpu45_crit: cpu_crit {
+				cpu45_crit: cpu-crit {
 					temperature = <110000>;
 					hysteresis = <1000>;
 					type = "critical";
@@ -3218,7 +3227,7 @@
 					type = "passive";
 				};
 
-				cpu67_crit: cpu_crit {
+				cpu67_crit: cpu-crit {
 					temperature = <110000>;
 					hysteresis = <1000>;
 					type = "critical";
@@ -3244,7 +3253,7 @@
 					type = "passive";
 				};
 
-				cpu0123_crit: cpu_crit {
+				cpu0123_crit: cpu-crit {
 					temperature = <110000>;
 					hysteresis = <1000>;
 					type = "critical";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm6115p-lenovo-j606f.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm6115p-lenovo-j606f.dts
@@ -359,6 +359,7 @@
 };
 
 &usb_dwc3 {
+	/delete-property/ usb-role-switch;
 	maximum-speed = "high-speed";
 	dr_mode = "peripheral";
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm6350.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm6350.dtsi
@@ -1194,6 +1194,8 @@
 			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
 				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
 
+			power-domains = <&gcc UFS_PHY_GDSC>;
+
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
 
@@ -1249,7 +1251,7 @@
 			compatible = "qcom,sm6350-adsp-pas";
 			reg = <0 0x03000000 0 0x100>;
 
-			interrupts-extended = <&pdc 6 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -1287,6 +1289,7 @@
 					compatible = "qcom,fastrpc";
 					qcom,glink-channels = "fastrpcglink-apps-dsp";
 					label = "adsp";
+					qcom,non-secure-domain;
 					#address-cells = <1>;
 					#size-cells = <0>;
 
@@ -1338,43 +1341,43 @@
 				opp-850000000 {
 					opp-hz = /bits/ 64 <850000000>;
 					opp-level = <RPMH_REGULATOR_LEVEL_TURBO_L1>;
-					opp-supported-hw = <0x02>;
+					opp-supported-hw = <0x03>;
 				};
 
 				opp-800000000 {
 					opp-hz = /bits/ 64 <800000000>;
 					opp-level = <RPMH_REGULATOR_LEVEL_TURBO>;
-					opp-supported-hw = <0x04>;
+					opp-supported-hw = <0x07>;
 				};
 
 				opp-650000000 {
 					opp-hz = /bits/ 64 <650000000>;
 					opp-level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
-					opp-supported-hw = <0x08>;
+					opp-supported-hw = <0x0f>;
 				};
 
 				opp-565000000 {
 					opp-hz = /bits/ 64 <565000000>;
 					opp-level = <RPMH_REGULATOR_LEVEL_NOM>;
-					opp-supported-hw = <0x10>;
+					opp-supported-hw = <0x1f>;
 				};
 
 				opp-430000000 {
 					opp-hz = /bits/ 64 <430000000>;
 					opp-level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
-					opp-supported-hw = <0xff>;
+					opp-supported-hw = <0x1f>;
 				};
 
 				opp-355000000 {
 					opp-hz = /bits/ 64 <355000000>;
 					opp-level = <RPMH_REGULATOR_LEVEL_SVS>;
-					opp-supported-hw = <0xff>;
+					opp-supported-hw = <0x1f>;
 				};
 
 				opp-253000000 {
 					opp-hz = /bits/ 64 <253000000>;
 					opp-level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
-					opp-supported-hw = <0xff>;
+					opp-supported-hw = <0x1f>;
 				};
 			};
 		};
@@ -1509,7 +1512,7 @@
 			compatible = "qcom,sm6350-cdsp-pas";
 			reg = <0 0x08300000 0 0x10000>;
 
-			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -1547,6 +1550,7 @@
 					compatible = "qcom,fastrpc";
 					qcom,glink-channels = "fastrpcglink-apps-dsp";
 					label = "cdsp";
+					qcom,non-secure-domain;
 					#address-cells = <1>;
 					#size-cells = <0>;
 
@@ -1854,6 +1858,7 @@
 				snps,dis_enblslpm_quirk;
 				snps,has-lpm-erratum;
 				snps,hird-threshold = /bits/ 8 <0x10>;
+				snps,parkmode-disable-ss-quirk;
 				phys = <&usb_1_hsphy>, <&usb_1_qmpphy QMP_USB43DP_USB3_PHY>;
 				phy-names = "usb2-phy", "usb3-phy";
 			};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm6375.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm6375.dtsi
@@ -1431,13 +1431,15 @@
 			assigned-clock-rates = <19200000>, <133333333>;
 
 			interrupts-extended = <&intc GIC_SPI 302 IRQ_TYPE_LEVEL_HIGH>,
-					      <&mpm 12 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 254 IRQ_TYPE_LEVEL_HIGH>,
+					      <&mpm 94 IRQ_TYPE_EDGE_BOTH>,
 					      <&mpm 93 IRQ_TYPE_EDGE_BOTH>,
-					      <&mpm 94 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq",
-					  "ss_phy_irq",
+					      <&mpm 12 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
-					  "dp_hs_phy_irq";
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_PRIM_GDSC>;
 
@@ -1559,7 +1561,7 @@
 			compatible = "qcom,sm6375-adsp-pas";
 			reg = <0 0x0a400000 0 0x100>;
 
-			interrupts-extended = <&intc GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 282 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8150.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8150.dtsi
@@ -967,7 +967,7 @@
 			#address-cells = <1>;
 			#size-cells = <1>;
 
-			gpu_speed_bin: gpu_speed_bin@133 {
+			gpu_speed_bin: gpu-speed-bin@133 {
 				reg = <0x133 0x1>;
 				bits = <5 3>;
 			};
@@ -1879,7 +1879,7 @@
 			phy-names = "pciephy";
 
 			perst-gpios = <&tlmm 35 GPIO_ACTIVE_HIGH>;
-			enable-gpio = <&tlmm 37 GPIO_ACTIVE_HIGH>;
+			wake-gpios = <&tlmm 37 GPIO_ACTIVE_HIGH>;
 
 			pinctrl-names = "default";
 			pinctrl-0 = <&pcie0_default_state>;
@@ -2428,7 +2428,7 @@
 				bias-disable;
 			};
 
-			qup_spi6_default: qup-spi6_default-state {
+			qup_spi6_default: qup-spi6-default-state {
 				pins = "gpio4", "gpio5", "gpio6", "gpio7";
 				function = "qup6";
 				drive-strength = <6>;
@@ -2442,7 +2442,7 @@
 				bias-disable;
 			};
 
-			qup_spi7_default: qup-spi7_default-state {
+			qup_spi7_default: qup-spi7-default-state {
 				pins = "gpio98", "gpio99", "gpio100", "gpio101";
 				function = "qup7";
 				drive-strength = <6>;
@@ -3573,12 +3573,16 @@
 					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 6 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 8 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq", "ss_phy_irq",
-					  "dm_hs_phy_irq", "dp_hs_phy_irq";
+					      <&pdc 6 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq",
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_PRIM_GDSC>;
 
@@ -3645,12 +3649,16 @@
 					  <&gcc GCC_USB30_SEC_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 7 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 11 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 11 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq", "ss_phy_irq",
-					  "dm_hs_phy_irq", "dp_hs_phy_irq";
+					      <&pdc 7 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
+					  "dm_hs_phy_irq",
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_SEC_GDSC>;
 
@@ -5067,7 +5075,7 @@
 					hysteresis = <2000>;
 					type = "hot";
 				};
-				cluster0_crit: cluster0_crit {
+				cluster0_crit: cluster0-crit {
 					temperature = <110000>;
 					hysteresis = <2000>;
 					type = "critical";
@@ -5087,7 +5095,7 @@
 					hysteresis = <2000>;
 					type = "hot";
 				};
-				cluster1_crit: cluster1_crit {
+				cluster1_crit: cluster1-crit {
 					temperature = <110000>;
 					hysteresis = <2000>;
 					type = "critical";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8250.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8250.dtsi
@@ -975,7 +975,7 @@
 			#address-cells = <1>;
 			#size-cells = <1>;
 
-			gpu_speed_bin: gpu_speed_bin@19b {
+			gpu_speed_bin: gpu-speed-bin@19b {
 				reg = <0x19b 0x1>;
 				bits = <5 3>;
 			};
@@ -2514,6 +2514,8 @@
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
 
+			power-domains = <&gcc UFS_PHY_GDSC>;
+
 			#phy-cells = <0>;
 
 			status = "disabled";
@@ -3025,7 +3027,7 @@
 			compatible = "qcom,sm8250-slpi-pas";
 			reg = <0 0x05c00000 0 0x4000>;
 
-			interrupts-extended = <&pdc 9 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&pdc 9 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_slpi_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_slpi_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_slpi_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -3729,7 +3731,7 @@
 			compatible = "qcom,sm8250-cdsp-pas";
 			reg = <0 0x08300000 0 0x10000>;
 
-			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -4128,14 +4130,16 @@
 					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq",
-					  "ss_phy_irq",
+					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
-					  "dp_hs_phy_irq";
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_PRIM_GDSC>;
 			wakeup-source;
@@ -4197,14 +4201,16 @@
 					  <&gcc GCC_USB30_SEC_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 16 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 12 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 13 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 12 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq",
-					  "ss_phy_irq",
+					      <&pdc 16 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
-					  "dp_hs_phy_irq";
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_SEC_GDSC>;
 			wakeup-source;
@@ -5887,7 +5893,7 @@
 			compatible = "qcom,sm8250-adsp-pas";
 			reg = <0 0x17300000 0 0x100>;
 
-			interrupts-extended = <&pdc 6 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -6757,7 +6763,7 @@
 					hysteresis = <2000>;
 					type = "hot";
 				};
-				cluster0_crit: cluster0_crit {
+				cluster0_crit: cluster0-crit {
 					temperature = <110000>;
 					hysteresis = <2000>;
 					type = "critical";
@@ -6777,7 +6783,7 @@
 					hysteresis = <2000>;
 					type = "hot";
 				};
-				cluster1_crit: cluster1_crit {
+				cluster1_crit: cluster1-crit {
 					temperature = <110000>;
 					hysteresis = <2000>;
 					type = "critical";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -1731,6 +1731,8 @@
 			clocks = <&rpmhcc RPMH_CXO_CLK>,
 				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
 
+			power-domains = <&gcc UFS_PHY_GDSC>;
+
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
 
@@ -2312,14 +2314,16 @@
 					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq",
-					  "ss_phy_irq",
+					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
-					  "dp_hs_phy_irq";
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_PRIM_GDSC>;
 
@@ -2385,14 +2389,16 @@
 					  <&gcc GCC_USB30_SEC_MASTER_CLK>;
 			assigned-clock-rates = <19200000>, <200000000>;
 
-			interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 16 IRQ_TYPE_LEVEL_HIGH>,
+			interrupts-extended = <&intc GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 12 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 13 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 12 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq",
-					  "ss_phy_irq",
+					      <&pdc 16 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
-					  "dp_hs_phy_irq";
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_SEC_GDSC>;
 
@@ -4165,7 +4171,7 @@
 					hysteresis = <2000>;
 					type = "hot";
 				};
-				cluster0_crit: cluster0_crit {
+				cluster0_crit: cluster0-crit {
 					temperature = <110000>;
 					hysteresis = <2000>;
 					type = "critical";
@@ -4185,7 +4191,7 @@
 					hysteresis = <2000>;
 					type = "hot";
 				};
-				cluster1_crit: cluster1_crit {
+				cluster1_crit: cluster1-crit {
 					temperature = <110000>;
 					hysteresis = <2000>;
 					type = "critical";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8450-hdk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8450-hdk.dts
@@ -938,8 +938,8 @@
 			"TX DMIC3", "MIC BIAS1",
 			"TX SWR_INPUT0", "ADC1_OUTPUT",
 			"TX SWR_INPUT1", "ADC2_OUTPUT",
-			"TX SWR_INPUT2", "ADC3_OUTPUT",
-			"TX SWR_INPUT3", "ADC4_OUTPUT";
+			"TX SWR_INPUT0", "ADC3_OUTPUT",
+			"TX SWR_INPUT1", "ADC4_OUTPUT";
 
 	wcd-playback-dai-link {
 		link-name = "WCD Playback";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8450.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8450.dtsi
@@ -1028,6 +1028,12 @@
 				pinctrl-names = "default";
 				pinctrl-0 = <&qup_uart20_default>;
 				interrupts = <GIC_SPI 587 IRQ_TYPE_LEVEL_HIGH>;
+				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
 				status = "disabled";
 			};
 
@@ -1420,6 +1426,12 @@
 				pinctrl-names = "default";
 				pinctrl-0 = <&qup_uart7_tx>, <&qup_uart7_rx>;
 				interrupts = <GIC_SPI 608 IRQ_TYPE_LEVEL_HIGH>;
+				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
+						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
+						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
+				interconnect-names = "qup-core",
+						     "qup-config";
 				status = "disabled";
 			};
 		};
@@ -1765,12 +1777,8 @@
 			ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>,
 				 <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>;
 
-			/*
-			 * MSIs for BDF (1:0.0) only works with Device ID 0x5980.
-			 * Hence, the IDs are swapped.
-			 */
-			msi-map = <0x0 &gic_its 0x5981 0x1>,
-				  <0x100 &gic_its 0x5980 0x1>;
+			msi-map = <0x0 &gic_its 0x5980 0x1>,
+				  <0x100 &gic_its 0x5981 0x1>;
 			msi-map-mask = <0xff00>;
 			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "msi";
@@ -1874,12 +1882,8 @@
 			ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>,
 				 <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>;
 
-			/*
-			 * MSIs for BDF (1:0.0) only works with Device ID 0x5a00.
-			 * Hence, the IDs are swapped.
-			 */
-			msi-map = <0x0 &gic_its 0x5a01 0x1>,
-				  <0x100 &gic_its 0x5a00 0x1>;
+			msi-map = <0x0 &gic_its 0x5a00 0x1>,
+				  <0x100 &gic_its 0x5a01 0x1>;
 			msi-map-mask = <0xff00>;
 			interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "msi";
@@ -4373,6 +4377,8 @@
 				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
 				 <&gcc GCC_UFS_0_CLKREF_EN>;
 
+			power-domains = <&gcc UFS_PHY_GDSC>;
+
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
 
@@ -4485,13 +4491,15 @@
 			assigned-clock-rates = <19200000>, <200000000>;
 
 			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq",
-					  "ss_phy_irq",
+					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
-					  "dp_hs_phy_irq";
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_PRIM_GDSC>;
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8550-mtp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8550-mtp.dts
@@ -56,6 +56,10 @@
 		stdout-path = "serial0:115200n8";
 	};
 
+	iris {
+		status = "okay";
+	};
+
 	pmic-glink {
 		compatible = "qcom,sm8550-pmic-glink", "qcom,pmic-glink";
 		#address-cells = <1>;
@@ -874,7 +878,7 @@
 	wcd_tx: codec@0,3 {
 		compatible = "sdw20217010d00";
 		reg = <0 3>;
-		qcom,tx-port-mapping = <1 1 2 3>;
+		qcom,tx-port-mapping = <2 2 3 4>;
 	};
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8550-qrd.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8550-qrd.dts
@@ -978,7 +978,7 @@
 	wcd_tx: codec@0,3 {
 		compatible = "sdw20217010d00";
 		reg = <0 3>;
-		qcom,tx-port-mapping = <1 1 2 3>;
+		qcom,tx-port-mapping = <2 2 3 4>;
 	};
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8550.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8550.dtsi
@@ -6,22 +6,23 @@
 #include <dt-bindings/clock/qcom,rpmh.h>
 #include <dt-bindings/clock/qcom,sm8450-videocc.h>
 #include <dt-bindings/clock/qcom,sm8550-camcc.h>
+#include <dt-bindings/clock/qcom,sm8550-dispcc.h>
 #include <dt-bindings/clock/qcom,sm8550-gcc.h>
 #include <dt-bindings/clock/qcom,sm8550-gpucc.h>
 #include <dt-bindings/clock/qcom,sm8550-tcsr.h>
-#include <dt-bindings/clock/qcom,sm8550-dispcc.h>
 #include <dt-bindings/dma/qcom-gpi.h>
 #include <dt-bindings/firmware/qcom,scm.h>
 #include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/interconnect/qcom,icc.h>
 #include <dt-bindings/interconnect/qcom,sm8550-rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
 #include <dt-bindings/mailbox/qcom-ipcc.h>
-#include <dt-bindings/power/qcom-rpmpd.h>
+#include <dt-bindings/phy/phy-qcom-qmp.h>
 #include <dt-bindings/power/qcom,rpmhpd.h>
+#include <dt-bindings/power/qcom-rpmpd.h>
 #include <dt-bindings/soc/qcom,gpr.h>
 #include <dt-bindings/soc/qcom,rpmh-rsc.h>
 #include <dt-bindings/sound/qcom,q6dsp-lpass-ports.h>
-#include <dt-bindings/phy/phy-qcom-qmp.h>
 #include <dt-bindings/thermal/thermal.h>
 
 / {
@@ -1713,8 +1714,22 @@
 			linux,pci-domain = <0>;
 			num-lanes = <2>;
 
-			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-names = "msi";
+			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 144 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 145 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 146 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "msi0",
+					  "msi1",
+					  "msi2",
+					  "msi3",
+					  "msi4",
+					  "msi5",
+					  "msi6",
+					  "msi7";
 
 			#interrupt-cells = <1>;
 			interrupt-map-mask = <0 0 0 0x7>;
@@ -1804,8 +1819,22 @@
 			linux,pci-domain = <1>;
 			num-lanes = <2>;
 
-			interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-names = "msi";
+			interrupts = <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 308 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 309 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 312 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 313 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 314 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 374 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 375 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "msi0",
+					  "msi1",
+					  "msi2",
+					  "msi3",
+					  "msi4",
+					  "msi5",
+					  "msi6",
+					  "msi7";
 
 			#interrupt-cells = <1>;
 			interrupt-map-mask = <0 0 0 0x7>;
@@ -1977,7 +2006,8 @@
 		ice: crypto@1d88000 {
 			compatible = "qcom,sm8550-inline-crypto-engine",
 				     "qcom,inline-crypto-engine";
-			reg = <0 0x01d88000 0 0x8000>;
+			reg = <0x0 0x01d88000 0x0 0x10000>;
+			qcom,ice-use-hwkm;
 			clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>;
 		};
 
@@ -2399,6 +2429,31 @@
 			status = "disabled";
 		};
 
+		slimbam: dma-controller@6c04000 {
+			compatible = "qcom,bam-v1.7.0";
+			reg = <0x0 0x6c04000 0x0 0x20000>, <0x0 0x6c8b000 0x0 0x1000>;
+			reg-names = "bam", "bam_remote_mem";
+			interrupts = <GIC_SPI 164 IRQ_TYPE_LEVEL_HIGH>;
+			#dma-cells = <1>;
+			qcom,controlled-remotely;
+			num-channels  = <31>;
+			qcom,ee = <1>;
+			qcom,num-ees = <2>;
+			status = "disabled";
+		};
+
+		slim: slim-ngd@6c40000 {
+			compatible = "qcom,slim-ngd-v1.5.0";
+			reg = <0x0 0x6c40000 0x0 0x2c000>, <0x0 0x6c8a000 0x0 0x1000>;
+			reg-names = "ctrl", "slimbus_remote_mem";
+			interrupts = <GIC_SPI 163 IRQ_TYPE_LEVEL_HIGH>;
+			dmas = <&slimbam 3>, <&slimbam 4>;
+			dma-names = "rx", "tx";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
 		swr2: soundwire@6d30000 {
 			compatible = "qcom,soundwire-v2.0.0";
 			reg = <0 0x06d30000 0 0x10000>;
@@ -2635,6 +2690,79 @@
 			};
 		};
 
+		iris: video-codec@aa00000 {
+			compatible = "qcom,sm8550-iris";
+
+			reg = <0 0x0aa00000 0 0xf0000>;
+			interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>;
+
+			power-domains = <&videocc VIDEO_CC_MVS0C_GDSC>,
+					<&videocc VIDEO_CC_MVS0_GDSC>,
+					<&rpmhpd RPMHPD_MXC>,
+					<&rpmhpd RPMHPD_MMCX>;
+			power-domain-names = "iris-ctl", "vcodec", "mxc", "mmcx";
+			operating-points-v2 = <&iris_opp_table>;
+
+			clocks = <&gcc GCC_VIDEO_AXI0_CLK>,
+				 <&videocc VIDEO_CC_MVS0C_CLK>,
+				 <&videocc VIDEO_CC_MVS0_CLK>;
+			clock-names = "gcc_video_axi0", "core_clk", "vcodec_core";
+
+			interconnects =
+				<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
+				 &config_noc SLAVE_VENUS_CFG QCOM_ICC_TAG_ALWAYS>,
+				<&mmss_noc MASTER_VIDEO QCOM_ICC_TAG_ALWAYS
+				 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+			interconnect-names = "iris-cnoc", "iris-ddr";
+
+			/* FW load region */
+			memory-region = <&video_mem>;
+
+			resets = <&gcc GCC_VIDEO_AXI0_CLK_ARES>;
+			reset-names = "video_axi_reset";
+
+			iommus = <&apps_smmu 0x1940 0x0000>,
+				 <&apps_smmu 0x1947 0x0000>;
+			dma-coherent;
+
+			status = "disabled";
+
+			iris_opp_table: opp-table {
+				compatible = "operating-points-v2";
+
+				opp-240000000 {
+					opp-hz = /bits/ 64 <240000000>;
+					required-opps = <&rpmhpd_opp_svs>,
+							<&rpmhpd_opp_low_svs>;
+				};
+
+				opp-338000000 {
+					opp-hz = /bits/ 64 <338000000>;
+					required-opps = <&rpmhpd_opp_svs>,
+							<&rpmhpd_opp_svs>;
+				};
+
+				opp-366000000 {
+					opp-hz = /bits/ 64 <366000000>;
+					required-opps = <&rpmhpd_opp_svs_l1>,
+							<&rpmhpd_opp_svs_l1>;
+				};
+
+				opp-444000000 {
+					opp-hz = /bits/ 64 <444000000>;
+					required-opps = <&rpmhpd_opp_turbo>,
+							<&rpmhpd_opp_turbo>;
+				};
+
+				opp-533333334 {
+					opp-hz = /bits/ 64 <533333334>;
+					required-opps = <&rpmhpd_opp_turbo_l1>,
+							<&rpmhpd_opp_turbo_l1>;
+				};
+
+			};
+		};
+
 		videocc: clock-controller@aaf0000 {
 			compatible = "qcom,sm8550-videocc";
 			reg = <0 0x0aaf0000 0 0x10000>;
@@ -3133,13 +3261,15 @@
 			assigned-clock-rates = <19200000>, <200000000>;
 
 			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
-					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>,
+					      <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
 					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
-					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>;
-			interrupt-names = "hs_phy_irq",
-					  "ss_phy_irq",
+					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pwr_event",
+					  "hs_phy_irq",
+					  "dp_hs_phy_irq",
 					  "dm_hs_phy_irq",
-					  "dp_hs_phy_irq";
+					  "ss_phy_irq";
 
 			power-domains = <&gcc USB30_PRIM_GDSC>;
 			required-opps = <&rpmhpd_opp_nom>;
@@ -3248,7 +3378,7 @@
 		spmi_bus: spmi@c400000 {
 			compatible = "qcom,spmi-pmic-arb";
 			reg = <0 0x0c400000 0 0x3000>,
-			      <0 0x0c500000 0 0x4000000>,
+			      <0 0x0c500000 0 0x400000>,
 			      <0 0x0c440000 0 0x80000>,
 			      <0 0x0c4c0000 0 0x20000>,
 			      <0 0x0c42d000 0 0x4000>;
@@ -4254,6 +4384,7 @@
 						reg = <3>;
 						iommus = <&apps_smmu 0x1003 0x80>,
 							 <&apps_smmu 0x1063 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@4 {
@@ -4261,6 +4392,7 @@
 						reg = <4>;
 						iommus = <&apps_smmu 0x1004 0x80>,
 							 <&apps_smmu 0x1064 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@5 {
@@ -4268,6 +4400,7 @@
 						reg = <5>;
 						iommus = <&apps_smmu 0x1005 0x80>,
 							 <&apps_smmu 0x1065 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@6 {
@@ -4275,6 +4408,7 @@
 						reg = <6>;
 						iommus = <&apps_smmu 0x1006 0x80>,
 							 <&apps_smmu 0x1066 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@7 {
@@ -4282,6 +4416,7 @@
 						reg = <7>;
 						iommus = <&apps_smmu 0x1007 0x80>,
 							 <&apps_smmu 0x1067 0x0>;
+						dma-coherent;
 					};
 				};
 
@@ -4388,6 +4523,7 @@
 						iommus = <&apps_smmu 0x1961 0x0>,
 							 <&apps_smmu 0x0c01 0x20>,
 							 <&apps_smmu 0x19c1 0x10>;
+						dma-coherent;
 					};
 
 					compute-cb@2 {
@@ -4396,6 +4532,7 @@
 						iommus = <&apps_smmu 0x1962 0x0>,
 							 <&apps_smmu 0x0c02 0x20>,
 							 <&apps_smmu 0x19c2 0x10>;
+						dma-coherent;
 					};
 
 					compute-cb@3 {
@@ -4404,6 +4541,7 @@
 						iommus = <&apps_smmu 0x1963 0x0>,
 							 <&apps_smmu 0x0c03 0x20>,
 							 <&apps_smmu 0x19c3 0x10>;
+						dma-coherent;
 					};
 
 					compute-cb@4 {
@@ -4412,6 +4550,7 @@
 						iommus = <&apps_smmu 0x1964 0x0>,
 							 <&apps_smmu 0x0c04 0x20>,
 							 <&apps_smmu 0x19c4 0x10>;
+						dma-coherent;
 					};
 
 					compute-cb@5 {
@@ -4420,6 +4559,7 @@
 						iommus = <&apps_smmu 0x1965 0x0>,
 							 <&apps_smmu 0x0c05 0x20>,
 							 <&apps_smmu 0x19c5 0x10>;
+						dma-coherent;
 					};
 
 					compute-cb@6 {
@@ -4428,6 +4568,7 @@
 						iommus = <&apps_smmu 0x1966 0x0>,
 							 <&apps_smmu 0x0c06 0x20>,
 							 <&apps_smmu 0x19c6 0x10>;
+						dma-coherent;
 					};
 
 					compute-cb@7 {
@@ -4436,6 +4577,7 @@
 						iommus = <&apps_smmu 0x1967 0x0>,
 							 <&apps_smmu 0x0c07 0x20>,
 							 <&apps_smmu 0x19c7 0x10>;
+						dma-coherent;
 					};
 
 					compute-cb@8 {
@@ -4444,6 +4586,7 @@
 						iommus = <&apps_smmu 0x1968 0x0>,
 							 <&apps_smmu 0x0c08 0x20>,
 							 <&apps_smmu 0x19c8 0x10>;
+						dma-coherent;
 					};
 
 					/* note: secure cb9 in downstream */
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8650.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8650.dtsi
@@ -2448,10 +2448,12 @@
 			compatible = "qcom,sm8650-qmp-ufs-phy";
 			reg = <0 0x01d80000 0 0x2000>;
 
-			clocks = <&tcsr TCSR_UFS_CLKREF_EN>,
-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
+			clocks = <&rpmhcc RPMH_CXO_CLK>,
+				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
+				 <&tcsr TCSR_UFS_CLKREF_EN>;
 			clock-names = "ref",
-				      "ref_aux";
+				      "ref_aux",
+				      "qref";
 
 			resets = <&ufs_mem_hc 0>;
 			reset-names = "ufsphy";
@@ -3703,7 +3705,7 @@
 		spmi_bus: spmi@c400000 {
 			compatible = "qcom,spmi-pmic-arb";
 			reg = <0 0x0c400000 0 0x3000>,
-			      <0 0x0c500000 0 0x4000000>,
+			      <0 0x0c500000 0 0x400000>,
 			      <0 0x0c440000 0 0x80000>,
 			      <0 0x0c4c0000 0 0x20000>,
 			      <0 0x0c42d000 0 0x4000>;
@@ -4808,6 +4810,7 @@
 
 						iommus = <&apps_smmu 0x1003 0x80>,
 							 <&apps_smmu 0x1043 0x20>;
+						dma-coherent;
 					};
 
 					compute-cb@4 {
@@ -4816,6 +4819,7 @@
 
 						iommus = <&apps_smmu 0x1004 0x80>,
 							 <&apps_smmu 0x1044 0x20>;
+						dma-coherent;
 					};
 
 					compute-cb@5 {
@@ -4824,6 +4828,7 @@
 
 						iommus = <&apps_smmu 0x1005 0x80>,
 							 <&apps_smmu 0x1045 0x20>;
+						dma-coherent;
 					};
 
 					compute-cb@6 {
@@ -4832,6 +4837,7 @@
 
 						iommus = <&apps_smmu 0x1006 0x80>,
 							 <&apps_smmu 0x1046 0x20>;
+						dma-coherent;
 					};
 
 					compute-cb@7 {
@@ -4841,6 +4847,7 @@
 						iommus = <&apps_smmu 0x1007 0x40>,
 							 <&apps_smmu 0x1067 0x0>,
 							 <&apps_smmu 0x1087 0x0>;
+						dma-coherent;
 					};
 				};
 
@@ -4961,6 +4968,7 @@
 						iommus = <&apps_smmu 0x1961 0x0>,
 							 <&apps_smmu 0x0c01 0x20>,
 							 <&apps_smmu 0x19c1 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@2 {
@@ -4970,6 +4978,7 @@
 						iommus = <&apps_smmu 0x1962 0x0>,
 							 <&apps_smmu 0x0c02 0x20>,
 							 <&apps_smmu 0x19c2 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@3 {
@@ -4979,6 +4988,7 @@
 						iommus = <&apps_smmu 0x1963 0x0>,
 							 <&apps_smmu 0x0c03 0x20>,
 							 <&apps_smmu 0x19c3 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@4 {
@@ -4988,6 +4998,7 @@
 						iommus = <&apps_smmu 0x1964 0x0>,
 							 <&apps_smmu 0x0c04 0x20>,
 							 <&apps_smmu 0x19c4 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@5 {
@@ -4997,6 +5008,7 @@
 						iommus = <&apps_smmu 0x1965 0x0>,
 							 <&apps_smmu 0x0c05 0x20>,
 							 <&apps_smmu 0x19c5 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@6 {
@@ -5006,6 +5018,7 @@
 						iommus = <&apps_smmu 0x1966 0x0>,
 							 <&apps_smmu 0x0c06 0x20>,
 							 <&apps_smmu 0x19c6 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@7 {
@@ -5015,6 +5028,7 @@
 						iommus = <&apps_smmu 0x1967 0x0>,
 							 <&apps_smmu 0x0c07 0x20>,
 							 <&apps_smmu 0x19c7 0x0>;
+						dma-coherent;
 					};
 
 					compute-cb@8 {
@@ -5024,6 +5038,7 @@
 						iommus = <&apps_smmu 0x1968 0x0>,
 							 <&apps_smmu 0x0c08 0x20>,
 							 <&apps_smmu 0x19c8 0x0>;
+						dma-coherent;
 					};
 				};
 			};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8650p-addons-aim500-aiot.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8650p-addons-aim500-aiot.dts
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include "sm8650p-aim500-aiot.dts"
+#include "sm8650p-addons.dtsi"
+
+
+/ {
+	model = "Qualcomm Technologies, Inc. SM8650P-addons AIM500 AIOT";
+	compatible = "qcom,sm8650p-addons-aim500-aiot", "qcom,sm8650p-aim500", "qcom,sm8650p",
+		     "qcom,sm8650";
+
+	qps615_vreg: qps615-vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "qps615_vreg";
+		gpio = <&tlmm 21 GPIO_ACTIVE_HIGH>;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		enable-active-high;
+		regulator-enable-ramp-delay = <10000>;
+	};
+};
+
+&i2c_master_hub_0 {
+	status = "okay";
+};
+
+&i2c_hub_4 {
+	status = "okay";
+	qps615_switch: pcie-switch@77 {
+		compatible = "qcom,switch-i2c";
+		reg = <0x77>;
+		vdda-supply = <&qps615_vreg>;
+		status = "okay";
+	};
+};
+
+&pcie1 {
+	dummy-supply = <&qps615_switch>;
+};
+
+&pcie1_phy {
+	qcom,refclk-always-on;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8650p-addons.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8650p-addons.dtsi
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+&soc {
+	/* reserved */
+};
+
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8650p-aim500-aiot.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8650p-aim500-aiot.dts
@@ -0,0 +1,345 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/leds/common.h>
+#include "sm8650p-aim500.dtsi"
+#include "pm8010.dtsi"
+#include "pmr735d_a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. AIM500 AIOT";
+	compatible = "qcom,sm8650p-aim500-aiot", "qcom,sm8650p-aim500", "qcom,sm8650p",
+		     "qcom,sm8650";
+
+	qcom,msm-id = <577 0x20000>;
+	qcom,board-id = <0x1001f 0x1>;
+
+	aliases {
+		serial0 = &uart15;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		pinctrl-0 = <&volume_up_n>;
+		pinctrl-names = "default";
+
+		key-volume-up {
+			label = "Volume Up";
+			linux,code = <KEY_VOLUMEUP>;
+			gpios = <&pm8550_gpios 6 GPIO_ACTIVE_LOW>;
+			debounce-interval = <15>;
+			linux,can-disable;
+			wakeup-source;
+		};
+	};
+
+	pmic-glink {
+		compatible = "qcom,sm8650-pmic-glink",
+			     "qcom,sm8550-pmic-glink",
+			     "qcom,pmic-glink";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		orientation-gpios = <&tlmm 29 GPIO_ACTIVE_HIGH>;
+
+		connector@0 {
+			compatible = "usb-c-connector";
+			reg = <0>;
+
+			power-role = "dual";
+			data-role = "dual";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+
+					pmic_glink_hs_in: endpoint {
+						remote-endpoint = <&usb_1_dwc3_hs>;
+					};
+				};
+
+				port@1 {
+					reg = <1>;
+
+					pmic_glink_ss_in: endpoint {
+						remote-endpoint = <&usb_1_dwc3_ss>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&dispcc {
+	status = "okay";
+};
+
+&gpi_dma1 {
+	status = "okay";
+};
+
+&pcie_1_phy_aux_clk {
+	clock-frequency = <1000>;
+};
+
+&pcie0 {
+	perst-gpios = <&tlmm 94 GPIO_ACTIVE_LOW>;
+	wake-gpios = <&tlmm 96 GPIO_ACTIVE_HIGH>;
+
+	pinctrl-0 = <&pcie0_default_state>;
+	pinctrl-names = "default";
+
+	status = "okay";
+};
+
+&pcie0_phy {
+	vdda-phy-supply = <&vreg_l1i_0p88>;
+	vdda-pll-supply = <&vreg_l3i_1p2>;
+
+	status = "okay";
+};
+
+&pcie1 {
+	wake-gpios = <&tlmm 99 GPIO_ACTIVE_HIGH>;
+	perst-gpios = <&tlmm 97 GPIO_ACTIVE_LOW>;
+
+	pinctrl-0 = <&pcie1_default_state>;
+	pinctrl-names = "default";
+
+	iommu-map = <0x0 &apps_smmu 0x1480 0x1>,
+		<0x100 &apps_smmu 0x1481 0x1>,
+		<0x208 &apps_smmu 0x1482 0x1>,
+		<0x210 &apps_smmu 0x1483 0x1>,
+		<0x218 &apps_smmu 0x1484 0x1>,
+		<0x300 &apps_smmu 0x1487 0x1>,
+		<0x400 &apps_smmu 0x1488 0x1>,
+		<0x500 &apps_smmu 0x148c 0x1>,
+		<0x501 &apps_smmu 0x148e 0x1>;
+
+	status = "okay";
+};
+
+&pcie1_phy {
+	vdda-phy-supply = <&vreg_l3e_0p9>;
+	vdda-pll-supply = <&vreg_l3i_1p2>;
+	vdda-qref-supply = <&vreg_l1i_0p88>;
+
+	status = "okay";
+};
+
+&pm8550_flash {
+	status = "okay";
+
+	led-0 {
+		function = LED_FUNCTION_FLASH;
+		color = <LED_COLOR_ID_YELLOW>;
+		flash-max-microamp = <2000000>;
+		flash-max-timeout-us = <1280000>;
+		function-enumerator = <0>;
+		led-sources = <1>, <4>;
+		led-max-microamp = <500000>;
+	};
+
+	led-1 {
+		function = LED_FUNCTION_FLASH;
+		color = <LED_COLOR_ID_WHITE>;
+		flash-max-microamp = <2000000>;
+		flash-max-timeout-us = <1280000>;
+		function-enumerator = <1>;
+		led-sources = <2>, <3>;
+		led-max-microamp = <500000>;
+	};
+};
+
+&pm8550_gpios {
+	volume_up_n: volume-up-n-state {
+		pins = "gpio6";
+		function = "normal";
+		power-source = <1>;
+		bias-pull-up;
+		input-enable;
+	};
+};
+
+&pm8550_pwm {
+	status = "okay";
+
+	multi-led {
+		color = <LED_COLOR_ID_RGB>;
+		function = LED_FUNCTION_STATUS;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+	};
+};
+
+&pm8550b_eusb2_repeater {
+	vdd18-supply = <&vreg_l15b_1p8>;
+	vdd3-supply = <&vreg_l5b_3p1>;
+};
+
+&pmk8550_rtc {
+	status = "okay";
+};
+
+&pon_pwrkey {
+	status = "okay";
+};
+
+&pon_resin {
+	linux,code = <KEY_VOLUMEDOWN>;
+
+	status = "okay";
+};
+
+&qupv3_id_0 {
+	status = "okay";
+};
+
+&remoteproc_adsp {
+	firmware-name = "qcom/sm8650/adsp.mbn",
+			"qcom/sm8650/adsp_dtb.mbn";
+
+	status = "okay";
+};
+
+&remoteproc_cdsp {
+	firmware-name = "qcom/sm8650/cdsp.mbn",
+			"qcom/sm8650/cdsp_dtb.mbn";
+
+	status = "okay";
+};
+
+&sleep_clk {
+	clock-frequency = <32000>;
+};
+
+&tlmm {
+	gpio-reserved-ranges = <32 8>, <74 2>;
+
+	sde_dsi_active: sde-dsi-active-state {
+		pins = "gpio133";
+		function = "gpio";
+		drive-strength = <8>;
+		bias-disable;
+	};
+
+	sde_dsi_suspend: sde-dsi-suspend-state {
+		pins = "gpio133";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-pull-down;
+	};
+
+	sde_te_active: sde-te-active-state {
+		pins = "gpio86";
+		function = "mdp_vsync";
+		drive-strength = <2>;
+		bias-pull-down;
+	};
+
+	sde_te_suspend: sde-te-suspend-state {
+		pins = "gpio86";
+		function = "mdp_vsync";
+		drive-strength = <2>;
+		bias-pull-down;
+	};
+
+	ts_irq: ts-irq-state {
+		pins = "gpio161";
+		function = "gpio";
+		drive-strength = <8>;
+		bias-pull-up;
+		output-disable;
+	};
+
+	ts_reset: ts-reset-state {
+		pins = "gpio162";
+		function = "gpio";
+		drive-strength = <8>;
+		bias-pull-up;
+	};
+};
+
+&uart15 {
+	status = "okay";
+};
+
+/*
+ * DPAUX -> WCD9395 -> USB_SBU -> USB-C
+ * eUSB2 DP/DM -> PM85550HS -> eUSB2 DP/DM -> WCD9395 -> USB-C
+ * USB SS -> NB7VPQ904MMUTWG -> USB-C
+ */
+
+&usb_1 {
+	status = "okay";
+};
+
+&usb_1_dwc3 {
+	dr_mode = "otg";
+	usb-role-switch;
+};
+
+&usb_1_dwc3_hs {
+	remote-endpoint = <&pmic_glink_hs_in>;
+};
+
+&usb_1_dwc3_ss {
+	remote-endpoint = <&pmic_glink_ss_in>;
+};
+
+&usb_1_hsphy {
+	vdd-supply = <&vreg_l1i_0p88>;
+	vdda12-supply = <&vreg_l3i_1p2>;
+
+	phys = <&pm8550b_eusb2_repeater>;
+
+	status = "okay";
+};
+
+&usb_dp_qmpphy {
+	vdda-phy-supply = <&vreg_l3i_1p2>;
+	vdda-pll-supply = <&vreg_l3g_0p91>;
+
+	status = "okay";
+};
+
+&vph_pwr {
+	compatible = "regulator-fixed";
+	regulator-name = "vph_pwr";
+	regulator-min-microvolt = <3700000>;
+	regulator-max-microvolt = <3700000>;
+
+	regulator-always-on;
+	regulator-boot-on;
+};
+
+&xo_board {
+	clock-frequency = <76800000>;
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8650p-aim500.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8650p-aim500.dtsi
@@ -0,0 +1,409 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/regulator/qcom,rpmh-regulator.h>
+#include "sm8650p.dtsi"
+#include "pm8550.dtsi"
+#include "pm8550b.dtsi"
+#define PMK8550VE_SID 8
+#include "pm8550ve.dtsi"
+#include "pm8550vs.dtsi"
+#include "pmk8550.dtsi"
+
+/ {
+	aliases {
+		serial1 = &uart14;
+	};
+
+	vph_pwr: vph-pwr-regulator { };
+};
+
+&apps_rsc {
+	regulators-0 {
+		compatible = "qcom,pm8550-rpmh-regulators";
+
+		vdd-bob1-supply = <&vph_pwr>;
+		vdd-bob2-supply = <&vph_pwr>;
+		vdd-l2-l13-l14-supply = <&vreg_bob1>;
+		vdd-l3-supply = <&vreg_s1c_1p2>;
+		vdd-l5-l16-supply = <&vreg_bob1>;
+		vdd-l6-l7-supply = <&vreg_bob1>;
+		vdd-l8-l9-supply = <&vreg_bob1>;
+		vdd-l11-supply = <&vreg_s1c_1p2>;
+		vdd-l12-supply = <&vreg_s6c_1p8>;
+		vdd-l15-supply = <&vreg_s6c_1p8>;
+		vdd-l17-supply = <&vreg_bob2>;
+
+		qcom,pmic-id = "b";
+
+		vreg_bob1: bob1 {
+			regulator-name = "vreg_bob1";
+			regulator-min-microvolt = <3008000>;
+			regulator-max-microvolt = <3960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_bob2: bob2 {
+			regulator-name = "vreg_bob2";
+			regulator-min-microvolt = <2704000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2b_3p0: ldo2 {
+			regulator-name = "vreg_l2b_3p0";
+			regulator-min-microvolt = <3008000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l5b_3p1: ldo5 {
+			regulator-name = "vreg_l5b_3p1";
+			regulator-min-microvolt = <3104000>;
+			regulator-max-microvolt = <3104000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l6b_1p8: ldo6 {
+			regulator-name = "vreg_l6b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7b_1p8: ldo7 {
+			regulator-name = "vreg_l7b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8b_1p8: ldo8 {
+			regulator-name = "vreg_l8b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l11b_1p2: ldo11 {
+			regulator-name = "vreg_l11b_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l12b_1p8: ldo12 {
+			regulator-name = "vreg_l12b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l13b_3p0: ldo13 {
+			regulator-name = "vreg_l13b_3p0";
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l14b_3p2: ldo14 {
+			regulator-name = "vreg_l14b_3p2";
+			regulator-min-microvolt = <3200000>;
+			regulator-max-microvolt = <3200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l15b_1p8: ldo15 {
+			regulator-name = "vreg_l15b_1p8";
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l16b_2p8: ldo16 {
+			regulator-name = "vreg_l16b_2p8";
+			regulator-min-microvolt = <2800000>;
+			regulator-max-microvolt = <2800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l17b_2p5: ldo17 {
+			regulator-name = "vreg_l17b_2p5";
+			regulator-min-microvolt = <2504000>;
+			regulator-max-microvolt = <2504000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-1 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+
+		vdd-l1-supply = <&vreg_s1c_1p2>;
+		vdd-l2-supply = <&vreg_s1c_1p2>;
+		vdd-l3-supply = <&vreg_s1c_1p2>;
+		vdd-s1-supply = <&vph_pwr>;
+		vdd-s2-supply = <&vph_pwr>;
+		vdd-s3-supply = <&vph_pwr>;
+		vdd-s4-supply = <&vph_pwr>;
+		vdd-s5-supply = <&vph_pwr>;
+		vdd-s6-supply = <&vph_pwr>;
+
+		qcom,pmic-id = "c";
+
+		vreg_s1c_1p2: smps1 {
+			regulator-name = "vreg_s1c_1p2";
+			regulator-min-microvolt = <1224000>;
+			regulator-max-microvolt = <1348000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s2c_0p8: smps2 {
+			regulator-name = "vreg_s2c_0p8";
+			regulator-min-microvolt = <500000>;
+			regulator-max-microvolt = <1036000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s3c_0p9: smps3 {
+			regulator-name = "vreg_s3c_0p9";
+			regulator-min-microvolt = <904000>;
+			regulator-max-microvolt = <1068000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s4c_1p2: smps4 {
+			regulator-name = "vreg_s4c_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1280000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s5c_0p7: smps5 {
+			regulator-name = "vreg_s5c_0p7";
+			regulator-min-microvolt = <300000>;
+			regulator-max-microvolt = <900000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_s6c_1p8: smps6 {
+			regulator-name = "vreg_s6c_1p8";
+			regulator-min-microvolt = <1856000>;
+			regulator-max-microvolt = <2000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1c_1p2: ldo1 {
+			regulator-name = "vreg_l1c_1p2";
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3c_1p2: ldo3 {
+			regulator-name = "vreg_l3c_1p2";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-2 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+
+		vdd-l1-supply = <&vreg_s3c_0p9>;
+
+		qcom,pmic-id = "d";
+
+		vreg_l1d_0p88: ldo1 {
+			regulator-name = "vreg_l1d_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <920000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-3 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+
+		vdd-l3-supply = <&vreg_s3c_0p9>;
+
+		qcom,pmic-id = "e";
+
+		vreg_l3e_0p9: ldo3 {
+			regulator-name = "vreg_l3e_0p9";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <920000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-4 {
+		compatible = "qcom,pm8550vs-rpmh-regulators";
+
+		vdd-l1-supply = <&vreg_s3c_0p9>;
+		vdd-l3-supply = <&vreg_s3c_0p9>;
+
+		qcom,pmic-id = "g";
+
+		vreg_l1g_0p91: ldo1 {
+			regulator-name = "vreg_l1g_0p91";
+			regulator-min-microvolt = <912000>;
+			regulator-max-microvolt = <936000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3g_0p91: ldo3 {
+			regulator-name = "vreg_l3g_0p91";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+
+	regulators-5 {
+		compatible = "qcom,pm8550ve-rpmh-regulators";
+
+		vdd-l1-supply = <&vreg_s3c_0p9>;
+		vdd-l2-supply = <&vreg_s3c_0p9>;
+		vdd-l3-supply = <&vreg_s1c_1p2>;
+		vdd-s4-supply = <&vph_pwr>;
+
+		qcom,pmic-id = "i";
+
+		vreg_s4i_0p85: smps4 {
+			regulator-name = "vreg_s4i_0p85";
+			regulator-min-microvolt = <300000>;
+			regulator-max-microvolt = <1004000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l1i_0p88: ldo1 {
+			regulator-name = "vreg_l1i_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l2i_0p88: ldo2 {
+			regulator-name = "vreg_l2i_0p88";
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <912000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l3i_1p2: ldo3 {
+			regulator-name = "vreg_l3i_0p91";
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-allow-set-load;
+			regulator-allowed-modes = <RPMH_REGULATOR_MODE_LPM
+						   RPMH_REGULATOR_MODE_HPM>;
+		};
+	};
+};
+
+&qupv3_id_1 {
+	status = "okay";
+};
+
+&tlmm {
+	bt_default: bt-default-state {
+		bt-en-pins {
+			pins = "gpio17";
+			function = "gpio";
+			drive-strength = <16>;
+			bias-disable;
+		};
+
+		sw-ctrl-pins {
+			pins = "gpio18";
+			function = "gpio";
+			bias-pull-down;
+		};
+	};
+};
+
+&uart14 {
+	status = "okay";
+
+	bluetooth {
+		compatible = "qcom,wcn7850-bt";
+
+		clocks = <&rpmhcc RPMH_RF_CLK1>;
+
+		vddio-supply = <&vreg_l3c_1p2>;
+		vddaon-supply = <&vreg_l15b_1p8>;
+		vdddig-supply = <&vreg_s3c_0p9>;
+		vddrfa0p8-supply = <&vreg_s3c_0p9>;
+		vddrfa1p2-supply = <&vreg_s1c_1p2>;
+		vddrfa1p9-supply = <&vreg_s6c_1p8>;
+
+		max-speed = <3200000>;
+
+		enable-gpios = <&tlmm 17 GPIO_ACTIVE_HIGH>;
+		swctrl-gpios = <&tlmm 18 GPIO_ACTIVE_HIGH>;
+
+		pinctrl-0 = <&bt_default>;
+		pinctrl-names = "default";
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/sm8650p.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/sm8650p.dtsi
@@ -0,0 +1,180 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "sm8650.dtsi"
+
+/delete-node/ &reserved_memory;
+
+/ {
+	reserved_memory: reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		/*
+		 * There are 3 types of reserved memory regions here:
+		 * 1. Firmware related regions.
+		 *     This will be described as: reserved-region@address. Current
+		 * reserved-region may have reserved area which was not yet used,
+		 * release note of the firmware can have such kind of information.
+		 * 2. Firmware related which shared with kernel access.
+		 *     Each region will have a specific node with specific label
+		 * name for later phandle reference from other driver dt node. May
+		 * overlapping with above type regions.
+		 * 3. PIL regions.
+		 *     PIL regions are allocated by kernel and assigned to subsystem
+		 * firmware later.
+		 * Here is a map for this platform:
+		 * 0x100000000 +------------------+
+		 *             |                  |
+		 *             | Firmware Related |
+		 *             |                  |
+		 *  0xd8000000 +------------------+
+		 *             |                  |
+		 *             | Kernel Available |
+		 *             |                  |
+		 *  0xA7000000 +------------------+
+		 *             |                  |
+		 *             |    PIL Region    |
+		 *             |                  |
+		 *  0x8BC00000 +------------------+
+		 *             |                  |
+		 *             | Firmware Related |
+		 *             |                  |
+		 *  0x80000000 +------------------+
+		 * Note that:
+		 * 1. 0xA7000000 to 0xA8000000 was used by bootloader as well, not
+		 * suggest for other usage.
+		 * 2. Kernel start address was start at 0xA8000000.
+		 */
+
+		/* Firmware related regions */
+		reserved-region@80000000 {
+			reg = <0x0 0x80000000 0x0 0xbc00000>;
+			no-map;
+		};
+
+		aop_image_mem: aop-image-region@81c00000 {
+			reg = <0x0 0x81c00000 0x0 0x60000>;
+			no-map;
+		};
+
+		aop_cmd_db_mem: aop-cmd-db-region@81c60000 {
+			compatible = "qcom,cmd-db";
+			reg = <0x0 0x81c60000 0x0 0x20000>;
+			no-map;
+		};
+
+		aop_config_mem: aop-config-region@81c80000 {
+			no-map;
+			reg = <0x0 0x81c80000 0x0 0x20000>;
+		};
+
+		smem_mem: smem-region@81d00000 {
+			compatible = "qcom,smem";
+			reg = <0x0 0x81d00000 0x0 0x200000>;
+			hwlocks = <&tcsr_mutex 3>;
+			no-map;
+		};
+
+		adsp_mhi_mem: adsp-mhi-region@81f00000 {
+			reg = <0x0 0x81f00000 0x0 0x20000>;
+			no-map;
+		};
+
+		global_sync_mem: global-sync@82600000 {
+			reg = <0x0 0x82600000 0x0 0x100000>;
+			no-map;
+		};
+
+		mpss_dsm_mem: mpss-dsm@86b00000 {
+			reg = <0x0 0x86b00000 0x0 0x4900000>;
+			no-map;
+		};
+
+		mpss_dsm_mem_2: mpss-dsm-2@8b400000 {
+			reg = <0x0 0x8b400000 0x0 0x800000>;
+			no-map;
+		};
+
+		/* PIL region */
+		mpss_mem: mpss-region@8bc00000 {
+			reg = <0x0 0x8bc00000 0x0 0xf400000>;
+			no-map;
+		};
+
+		q6_mpss_dtb_mem: q6-mpss-dtb-region@9b000000 {
+			reg = <0x0 0x9b000000 0x0 0x80000>;
+			no-map;
+		};
+
+		ipa_fw_mem: ipa-fw-region@9b080000 {
+			reg = <0x0 0x9b080000 0x0 0x10000>;
+			no-map;
+		};
+
+		ipa_gsi_mem: ipa-gsi-region@9b090000 {
+			reg = <0x0 0x9b090000 0x0 0xa000>;
+			no-map;
+		};
+
+		gpu_micro_code_mem: gpu-micro-code-region@9b09a000 {
+			reg = <0x0 0x9b09a000 0x0 0x2000>;
+			no-map;
+		};
+
+		spss_region_mem: spss-region@9b0a0000 {
+			reg = <0x0 0x9b0a0000 0x0 0x1e0000>;
+			no-map;
+		};
+
+		spu_secure_shared_memory_mem: spu-secure-shared-memory-region@9b280000 {
+			reg = <0x0 0x9b280000 0x0 0x80000>;
+			no-map;
+		};
+
+		camera_mem: camera-region@9b300000 {
+			reg = <0x0 0x9b300000 0x0 0x800000>;
+			no-map;
+		};
+
+		video_mem: video-region@9bb00000 {
+			reg = <0x0 0x9bb00000 0x0 0x800000>;
+			no-map;
+		};
+
+		cvp_mem: cvp-region@9c300000 {
+			reg = <0x0 0x9c300000 0x0 0x700000>;
+			no-map;
+		};
+
+		cdsp_mem: cdsp-region@9ca00000 {
+			reg = <0x0 0x9ca00000 0x0 0x1400000>;
+			no-map;
+		};
+
+		q6_cdsp_dtb_mem: q6-cdsp-dtb-region@9de00000 {
+			reg = <0x0 0x9de00000 0x0 0x80000>;
+			no-map;
+		};
+
+		q6_adsp_dtb_mem: q6-adsp-dtb-region@9de80000 {
+			reg = <0x0 0x9de80000 0x0 0x80000>;
+			no-map;
+		};
+
+		adspslpi_mem: adspslpi-region@9df00000 {
+			reg = <0x0 0x9df00000 0x0 0x4080000>;
+			no-map;
+		};
+
+		/* Firmware related regions */
+		reserved-region@d8000000 {
+			reg = <0x0 0xd8000000 0x0 0x28000000>;
+			no-map;
+		};
+
+	};
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/x1e80100-addons-crd.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/x1e80100-addons-crd.dts
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * x1e80100-addons CRD device tree source
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+/dts-v1/;
+
+#include "x1e80100-crd.dts"
+#include "x1e80100-addons.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. X1E80100-addons CRD";
+	compatible = "qcom,x1e80100-addons-crd", "qcom,x1e80100";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/x1e80100-addons-qcp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/x1e80100-addons-qcp.dts
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * x1e80100-addons IDP device tree source
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+/dts-v1/;
+
+#include "x1e80100-qcp.dts"
+#include "x1e80100-addons.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. X1E80100-addons QCP";
+	compatible = "qcom,x1e80100-addons-qcp", "qcom,x1e80100";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/x1e80100-addons.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/x1e80100-addons.dtsi
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * x1e80100-addons device tree source
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/x1e80100-crd.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/x1e80100-crd.dts
@@ -22,6 +22,15 @@
 		stdout-path = "serial0:115200n8";
 	};
 
+	reserved-memory {
+		linux,cma {
+			compatible = "shared-dma-pool";
+			size = <0x0 0x8000000>;
+			reusable;
+			linux,cma-default;
+		};
+	};
+
 	vph_pwr: vph-pwr-regulator {
 		compatible = "regulator-fixed";
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts
@@ -21,6 +21,15 @@
 		stdout-path = "serial0:115200n8";
 	};
 
+	reserved-memory {
+		linux,cma {
+			compatible = "shared-dma-pool";
+			size = <0x0 0x8000000>;
+			reusable;
+			linux,cma-default;
+		};
+	};
+
 	vph_pwr: vph-pwr-regulator {
 		compatible = "regulator-fixed";
 
@@ -243,7 +252,7 @@
 		qcom,pmic-id = "e";
 
 		vdd-l2-supply = <&vreg_s1f_0p7>;
-		vdd-l3-supply = <&vph_pwr>;
+		vdd-l3-supply = <&vreg_s5j_1p2>;
 
 		vreg_l2e_0p8: ldo2 {
 			regulator-name = "vreg_l2e_0p8";
@@ -349,7 +358,7 @@
 		qcom,pmic-id = "j";
 
 		vdd-l1-supply = <&vreg_s1f_0p7>;
-		vdd-l2-supply = <&vph_pwr>;
+		vdd-l2-supply = <&vreg_s5j_1p2>;
 		vdd-l3-supply = <&vreg_s1f_0p7>;
 		vdd-s5-supply = <&vph_pwr>;
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/qcom/x1e80100.dtsi
@@ -271,14 +271,14 @@
 				idle-state-name = "ret";
 				arm,psci-suspend-param = <0x00000004>;
 				entry-latency-us = <180>;
-				exit-latency-us = <320>;
-				min-residency-us = <1000>;
+				exit-latency-us = <500>;
+				min-residency-us = <600>;
 			};
 		};
 
 		domain-idle-states {
 			CLUSTER_CL4: cluster-sleep-0 {
-				compatible = "arm,idle-state";
+				compatible = "domain-idle-state";
 				idle-state-name = "l2-ret";
 				arm,psci-suspend-param = <0x01000044>;
 				entry-latency-us = <350>;
@@ -287,11 +287,11 @@
 			};
 
 			CLUSTER_CL5: cluster-sleep-1 {
-				compatible = "arm,idle-state";
+				compatible = "domain-idle-state";
 				idle-state-name = "ret-pll-off";
 				arm,psci-suspend-param = <0x01000054>;
 				entry-latency-us = <2200>;
-				exit-latency-us = <2500>;
+				exit-latency-us = <4000>;
 				min-residency-us = <7000>;
 			};
 		};
@@ -3284,7 +3284,7 @@
 		intc: interrupt-controller@17000000 {
 			compatible = "arm,gic-v3";
 			reg = <0 0x17000000 0 0x10000>,     /* GICD */
-			      <0 0x17080000 0 0x480000>;    /* GICR * 12 */
+			      <0 0x17080000 0 0x300000>;    /* GICR * 12 */
 
 			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
 
@@ -3315,7 +3315,6 @@
 			      <0 0x17510000 0 0x10000>,
 			      <0 0x17520000 0 0x10000>;
 			reg-names = "drv-0", "drv-1", "drv-2";
-			qcom,drv-count = <3>;
 
 			interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/hihope-rev2.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/hihope-rev2.dtsi
@@ -69,9 +69,6 @@
 
 	status = "okay";
 
-	/* Single DAI */
-	#sound-dai-cells = <0>;
-
 	rsnd_port: port {
 		rsnd_endpoint: endpoint {
 			remote-endpoint = <&dw_hdmi0_snd_in>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/hihope-rev4.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/hihope-rev4.dtsi
@@ -84,9 +84,6 @@
 	pinctrl-names = "default";
 	status = "okay";
 
-	/* Single DAI */
-	#sound-dai-cells = <0>;
-
 	/* audio_clkout0/1/2/3 */
 	#clock-cells = <1>;
 	clock-frequency = <12288000 11289600>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
@@ -658,7 +658,7 @@
 		avb0: ethernet@e6800000 {
 			compatible = "renesas,etheravb-r8a779a0",
 				     "renesas,etheravb-rcar-gen4";
-			reg = <0 0xe6800000 0 0x800>;
+			reg = <0 0xe6800000 0 0x1000>;
 			interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 257 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 258 IRQ_TYPE_LEVEL_HIGH>,
@@ -706,7 +706,7 @@
 		avb1: ethernet@e6810000 {
 			compatible = "renesas,etheravb-r8a779a0",
 				     "renesas,etheravb-rcar-gen4";
-			reg = <0 0xe6810000 0 0x800>;
+			reg = <0 0xe6810000 0 0x1000>;
 			interrupts = <GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 283 IRQ_TYPE_LEVEL_HIGH>,
@@ -2910,6 +2910,9 @@
 		interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>,
+				      <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-names = "sec-phys", "phys", "virt", "hyp-phys",
+				  "hyp-virt";
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/r8a779f0.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/r8a779f0.dtsi
@@ -1315,7 +1315,10 @@
 		interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>,
+				      <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-names = "sec-phys", "phys", "virt", "hyp-phys",
+				  "hyp-virt";
 	};
 
 	ufs30_clk: ufs30-clk {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
@@ -161,11 +161,6 @@
 		};
 	};
 
-	psci {
-		compatible = "arm,psci-1.0", "arm,psci-0.2";
-		method = "smc";
-	};
-
 	extal_clk: extal {
 		compatible = "fixed-clock";
 		#clock-cells = <0>;
@@ -185,13 +180,24 @@
 		interrupts-extended = <&gic GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
 	};
 
-	/* External SCIF clock - to be overridden by boards that provide it */
+	psci {
+		compatible = "arm,psci-1.0", "arm,psci-0.2";
+		method = "smc";
+	};
+
+	/* External SCIF clocks - to be overridden by boards that provide them */
 	scif_clk: scif {
 		compatible = "fixed-clock";
 		#clock-cells = <0>;
 		clock-frequency = <0>;
 	};
 
+	scif_clk2: scif2 {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-frequency = <0>;
+	};
+
 	soc: soc {
 		compatible = "simple-bus";
 		interrupt-parent = <&gic>;
@@ -681,7 +687,7 @@
 			interrupts = <GIC_SPI 248 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 516>,
 				 <&cpg CPG_CORE R8A779G0_CLK_SASYNCPERD1>,
-				 <&scif_clk>;
+				 <&scif_clk2>;
 			clock-names = "fck", "brg_int", "scif_clk";
 			dmas = <&dmac0 0x35>, <&dmac0 0x34>,
 			       <&dmac1 0x35>, <&dmac1 0x34>;
@@ -761,7 +767,7 @@
 		avb0: ethernet@e6800000 {
 			compatible = "renesas,etheravb-r8a779g0",
 				     "renesas,etheravb-rcar-gen4";
-			reg = <0 0xe6800000 0 0x800>;
+			reg = <0 0xe6800000 0 0x1000>;
 			interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 336 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 337 IRQ_TYPE_LEVEL_HIGH>,
@@ -808,7 +814,7 @@
 		avb1: ethernet@e6810000 {
 			compatible = "renesas,etheravb-r8a779g0",
 				     "renesas,etheravb-rcar-gen4";
-			reg = <0 0xe6810000 0 0x800>;
+			reg = <0 0xe6810000 0 0x1000>;
 			interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 362 IRQ_TYPE_LEVEL_HIGH>,
@@ -1057,7 +1063,7 @@
 			interrupts = <GIC_SPI 254 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 705>,
 				 <&cpg CPG_CORE R8A779G0_CLK_SASYNCPERD1>,
-				 <&scif_clk>;
+				 <&scif_clk2>;
 			clock-names = "fck", "brg_int", "scif_clk";
 			dmas = <&dmac0 0x59>, <&dmac0 0x58>,
 			       <&dmac1 0x59>, <&dmac1 0x58>;
@@ -1777,6 +1783,37 @@
 			};
 		};
 
+		mmc0: mmc@ee140000 {
+			compatible = "renesas,sdhi-r8a779g0",
+				     "renesas,rcar-gen4-sdhi";
+			reg = <0 0xee140000 0 0x2000>;
+			interrupts = <GIC_SPI 440 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&cpg CPG_MOD 706>,
+				 <&cpg CPG_CORE R8A779G0_CLK_SD0H>;
+			clock-names = "core", "clkh";
+			power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>;
+			resets = <&cpg 706>;
+			max-frequency = <200000000>;
+			iommus = <&ipmmu_ds0 32>;
+			status = "disabled";
+		};
+
+		rpc: spi@ee200000 {
+			compatible = "renesas,r8a779g0-rpc-if",
+				     "renesas,rcar-gen4-rpc-if";
+			reg = <0 0xee200000 0 0x200>,
+			      <0 0x08000000 0 0x04000000>,
+			      <0 0xee208000 0 0x100>;
+			reg-names = "regs", "dirmap", "wbuf";
+			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&cpg CPG_MOD 629>;
+			power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>;
+			resets = <&cpg 629>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
 		ipmmu_rt0: iommu@ee480000 {
 			compatible = "renesas,ipmmu-r8a779g0",
 				     "renesas,rcar-gen4-ipmmu-vmsa";
@@ -1886,37 +1923,6 @@
 			#iommu-cells = <1>;
 		};
 
-		mmc0: mmc@ee140000 {
-			compatible = "renesas,sdhi-r8a779g0",
-				     "renesas,rcar-gen4-sdhi";
-			reg = <0 0xee140000 0 0x2000>;
-			interrupts = <GIC_SPI 440 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&cpg CPG_MOD 706>,
-				 <&cpg CPG_CORE R8A779G0_CLK_SD0H>;
-			clock-names = "core", "clkh";
-			power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>;
-			resets = <&cpg 706>;
-			max-frequency = <200000000>;
-			iommus = <&ipmmu_ds0 32>;
-			status = "disabled";
-		};
-
-		rpc: spi@ee200000 {
-			compatible = "renesas,r8a779g0-rpc-if",
-				     "renesas,rcar-gen4-rpc-if";
-			reg = <0 0xee200000 0 0x200>,
-			      <0 0x08000000 0 0x04000000>,
-			      <0 0xee208000 0 0x100>;
-			reg-names = "regs", "dirmap", "wbuf";
-			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&cpg CPG_MOD 629>;
-			power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>;
-			resets = <&cpg 629>;
-			#address-cells = <1>;
-			#size-cells = <0>;
-			status = "disabled";
-		};
-
 		gic: interrupt-controller@f1000000 {
 			compatible = "arm,gic-v3";
 			#interrupt-cells = <3>;
@@ -2344,6 +2350,9 @@
 		interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>,
+				      <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-names = "sec-phys", "phys", "virt", "hyp-phys",
+				  "hyp-virt";
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi
@@ -50,7 +50,10 @@
 		interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>,
+				      <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-names = "sec-phys", "phys", "virt", "hyp-phys",
+				  "hyp-virt";
 	};
 };
 
@@ -109,7 +112,13 @@
 			     <SOC_PERIPHERAL_IRQ(473) IRQ_TYPE_LEVEL_HIGH>,
 			     <SOC_PERIPHERAL_IRQ(474) IRQ_TYPE_LEVEL_HIGH>,
 			     <SOC_PERIPHERAL_IRQ(475) IRQ_TYPE_LEVEL_HIGH>,
-			     <SOC_PERIPHERAL_IRQ(25) IRQ_TYPE_EDGE_RISING>;
+			     <SOC_PERIPHERAL_IRQ(25) IRQ_TYPE_EDGE_RISING>,
+			     <SOC_PERIPHERAL_IRQ(34) IRQ_TYPE_EDGE_RISING>,
+			     <SOC_PERIPHERAL_IRQ(35) IRQ_TYPE_EDGE_RISING>,
+			     <SOC_PERIPHERAL_IRQ(36) IRQ_TYPE_EDGE_RISING>,
+			     <SOC_PERIPHERAL_IRQ(37) IRQ_TYPE_EDGE_RISING>,
+			     <SOC_PERIPHERAL_IRQ(38) IRQ_TYPE_EDGE_RISING>,
+			     <SOC_PERIPHERAL_IRQ(39) IRQ_TYPE_EDGE_RISING>;
 		interrupt-names = "nmi",
 				  "irq0", "irq1", "irq2", "irq3",
 				  "irq4", "irq5", "irq6", "irq7",
@@ -121,7 +130,9 @@
 				  "tint20", "tint21", "tint22", "tint23",
 				  "tint24", "tint25", "tint26", "tint27",
 				  "tint28", "tint29", "tint30", "tint31",
-				  "bus-err";
+				  "bus-err", "ec7tie1-0", "ec7tie2-0",
+				  "ec7tiovf-0", "ec7tie1-1", "ec7tie2-1",
+				  "ec7tiovf-1";
 		clocks = <&cpg CPG_MOD R9A07G043_IA55_CLK>,
 			<&cpg CPG_MOD R9A07G043_IA55_PCLK>;
 		clock-names = "clk", "pclk";
@@ -134,8 +145,8 @@
 		#interrupt-cells = <3>;
 		#address-cells = <0>;
 		interrupt-controller;
-		reg = <0x0 0x11900000 0 0x40000>,
-		      <0x0 0x11940000 0 0x60000>;
+		reg = <0x0 0x11900000 0 0x20000>,
+		      <0x0 0x11940000 0 0x40000>;
 		interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>;
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
@@ -905,7 +905,27 @@
 				     <GIC_SPI 472 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 473 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 474 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 475 IRQ_TYPE_LEVEL_HIGH>;
+				     <GIC_SPI 475 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 25 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 34 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 35 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 37 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 38 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 39 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "nmi", "irq0", "irq1", "irq2", "irq3",
+					  "irq4", "irq5", "irq6", "irq7",
+					  "tint0", "tint1", "tint2", "tint3",
+					  "tint4", "tint5", "tint6", "tint7",
+					  "tint8", "tint9", "tint10", "tint11",
+					  "tint12", "tint13", "tint14", "tint15",
+					  "tint16", "tint17", "tint18", "tint19",
+					  "tint20", "tint21", "tint22", "tint23",
+					  "tint24", "tint25", "tint26", "tint27",
+					  "tint28", "tint29", "tint30", "tint31",
+					  "bus-err", "ec7tie1-0", "ec7tie2-0",
+					  "ec7tiovf-0", "ec7tie1-1", "ec7tie2-1",
+					  "ec7tiovf-1";
 			clocks = <&cpg CPG_MOD R9A07G044_IA55_CLK>,
 				 <&cpg CPG_MOD R9A07G044_IA55_PCLK>;
 			clock-names = "clk", "pclk";
@@ -977,8 +997,8 @@
 			#interrupt-cells = <3>;
 			#address-cells = <0>;
 			interrupt-controller;
-			reg = <0x0 0x11900000 0 0x40000>,
-			      <0x0 0x11940000 0 0x60000>;
+			reg = <0x0 0x11900000 0 0x20000>,
+			      <0x0 0x11940000 0 0x40000>;
 			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>;
 		};
 
@@ -1268,6 +1288,9 @@
 		interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>,
+				      <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-names = "sec-phys", "phys", "virt", "hyp-phys",
+				  "hyp-virt";
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
@@ -912,7 +912,27 @@
 				     <GIC_SPI 472 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 473 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 474 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 475 IRQ_TYPE_LEVEL_HIGH>;
+				     <GIC_SPI 475 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 25 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 34 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 35 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 37 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 38 IRQ_TYPE_EDGE_RISING>,
+				     <GIC_SPI 39 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "nmi", "irq0", "irq1", "irq2", "irq3",
+					  "irq4", "irq5", "irq6", "irq7",
+					  "tint0", "tint1", "tint2", "tint3",
+					  "tint4", "tint5", "tint6", "tint7",
+					  "tint8", "tint9", "tint10", "tint11",
+					  "tint12", "tint13", "tint14", "tint15",
+					  "tint16", "tint17", "tint18", "tint19",
+					  "tint20", "tint21", "tint22", "tint23",
+					  "tint24", "tint25", "tint26", "tint27",
+					  "tint28", "tint29", "tint30", "tint31",
+					  "bus-err", "ec7tie1-0", "ec7tie2-0",
+					  "ec7tiovf-0", "ec7tie1-1", "ec7tie2-1",
+					  "ec7tiovf-1";
 			clocks = <&cpg CPG_MOD R9A07G054_IA55_CLK>,
 				 <&cpg CPG_MOD R9A07G054_IA55_PCLK>;
 			clock-names = "clk", "pclk";
@@ -984,8 +1004,8 @@
 			#interrupt-cells = <3>;
 			#address-cells = <0>;
 			interrupt-controller;
-			reg = <0x0 0x11900000 0 0x40000>,
-			      <0x0 0x11940000 0 0x60000>;
+			reg = <0x0 0x11900000 0 0x20000>,
+			      <0x0 0x11940000 0 0x40000>;
 			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>;
 		};
 
@@ -1275,6 +1295,9 @@
 		interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>,
+				      <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-names = "sec-phys", "phys", "virt", "hyp-phys",
+				  "hyp-virt";
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/r9a08g045.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/r9a08g045.dtsi
@@ -152,7 +152,10 @@
 				     <GIC_SPI 458 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 459 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 460 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>;
+				     <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "nmi",
 					  "irq0", "irq1", "irq2", "irq3",
 					  "irq4", "irq5", "irq6", "irq7",
@@ -164,7 +167,8 @@
 					  "tint20", "tint21", "tint22", "tint23",
 					  "tint24", "tint25", "tint26", "tint27",
 					  "tint28", "tint29", "tint30", "tint31",
-					  "bus-err";
+					  "bus-err", "ec7tie1-0", "ec7tie2-0",
+					  "ec7tiovf-0";
 			clocks = <&cpg CPG_MOD R9A08G045_IA55_CLK>,
 				 <&cpg CPG_MOD R9A08G045_IA55_PCLK>;
 			clock-names = "clk", "pclk";
@@ -260,8 +264,8 @@
 			#interrupt-cells = <3>;
 			#address-cells = <0>;
 			interrupt-controller;
-			reg = <0x0 0x12400000 0 0x40000>,
-			      <0x0 0x12440000 0 0x60000>;
+			reg = <0x0 0x12400000 0 0x20000>,
+			      <0x0 0x12440000 0 0x40000>;
 			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>;
 		};
 	};
@@ -271,6 +275,9 @@
 		interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
 				      <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+				      <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>,
+				      <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-names = "sec-phys", "phys", "virt", "hyp-phys",
+				  "hyp-virt";
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi
@@ -193,12 +193,14 @@
 #endif
 
 &pinctrl {
+#if SW_CONFIG3 == SW_ON
 	eth0-phy-irq-hog {
 		gpio-hog;
 		gpios = <RZG2L_GPIO(12, 0) GPIO_ACTIVE_LOW>;
 		input;
 		line-name = "eth0-phy-irq";
 	};
+#endif
 
 	eth0_pins: eth0 {
 		txc {
@@ -234,12 +236,14 @@
 		};
 	};
 
+#if SW_CONFIG3 == SW_ON
 	eth1-phy-irq-hog {
 		gpio-hog;
 		gpios = <RZG2L_GPIO(12, 1) GPIO_ACTIVE_LOW>;
 		input;
 		line-name = "eth1-phy-irq";
 	};
+#endif
 
 	eth1_pins: eth1 {
 		txc {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/Makefile
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/Makefile
@@ -18,6 +18,7 @@
 dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb
 dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c-plus.dtb
 dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb
+dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s-plus.dtb
 dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus.dtb
 dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus-lts.dtb
 dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
@@ -66,7 +66,6 @@
 	bus-width = <8>;
 	cap-mmc-highspeed;
 	mmc-hs200-1_8v;
-	supports-emmc;
 	mmc-pwrseq = <&emmc_pwrseq>;
 	non-removable;
 	vmmc-supply = <&vcc_3v3>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
@@ -36,14 +36,14 @@
 
 		power_led: led-0 {
 			label = "firefly:red:power";
-			linux,default-trigger = "ir-power-click";
+			linux,default-trigger = "default-on";
 			default-state = "on";
 			gpios = <&gpio0 RK_PA6 GPIO_ACTIVE_HIGH>;
 		};
 
 		user_led: led-1 {
 			label = "firefly:blue:user";
-			linux,default-trigger = "ir-user-click";
+			linux,default-trigger = "rc-feedback";
 			default-state = "off";
 			gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_HIGH>;
 		};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts
@@ -5,6 +5,8 @@
  */
 
 /dts-v1/;
+
+#include <dt-bindings/leds/common.h>
 #include "rk3308.dtsi"
 
 / {
@@ -15,6 +17,7 @@
 		ethernet0 = &gmac;
 		mmc0 = &emmc;
 		mmc1 = &sdmmc;
+		mmc2 = &sdio;
 	};
 
 	chosen {
@@ -24,17 +27,21 @@
 	leds {
 		compatible = "gpio-leds";
 		pinctrl-names = "default";
-		pinctrl-0 = <&green_led_gio>, <&heartbeat_led_gpio>;
+		pinctrl-0 = <&green_led>, <&heartbeat_led>;
 
 		green-led {
+			color = <LED_COLOR_ID_GREEN>;
 			default-state = "on";
+			function = LED_FUNCTION_POWER;
 			gpios = <&gpio0 RK_PA6 GPIO_ACTIVE_HIGH>;
 			label = "rockpis:green:power";
 			linux,default-trigger = "default-on";
 		};
 
 		blue-led {
+			color = <LED_COLOR_ID_BLUE>;
 			default-state = "on";
+			function = LED_FUNCTION_HEARTBEAT;
 			gpios = <&gpio0 RK_PA5 GPIO_ACTIVE_HIGH>;
 			label = "rockpis:blue:user";
 			linux,default-trigger = "heartbeat";
@@ -126,21 +133,37 @@
 };
 
 &emmc {
-	bus-width = <4>;
 	cap-mmc-highspeed;
-	mmc-hs200-1_8v;
+	cap-sd-highspeed;
+	no-sdio;
 	non-removable;
+	pinctrl-names = "default";
+	pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>;
 	vmmc-supply = <&vcc_io>;
 	status = "okay";
 };
 
 &gmac {
 	clock_in_out = "output";
+	phy-handle = <&rtl8201f>;
 	phy-supply = <&vcc_io>;
-	snps,reset-gpio = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>;
-	snps,reset-active-low;
-	snps,reset-delays-us = <0 50000 50000>;
 	status = "okay";
+
+	mdio {
+		compatible = "snps,dwmac-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		rtl8201f: ethernet-phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <1>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&mac_rst>;
+			reset-assert-us = <20000>;
+			reset-deassert-us = <50000>;
+			reset-gpios = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>;
+		};
+	};
 };
 
 &gpio0 {
@@ -213,12 +236,32 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&rtc_32k>;
 
+	bluetooth {
+		bt_reg_on: bt-reg-on {
+			rockchip,pins = <4 RK_PB3 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+
+		bt_wake_host: bt-wake-host {
+			rockchip,pins = <4 RK_PB4 RK_FUNC_GPIO &pcfg_pull_down>;
+		};
+
+		host_wake_bt: host-wake-bt {
+			rockchip,pins = <4 RK_PB2 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+	};
+
+	gmac {
+		mac_rst: mac-rst {
+			rockchip,pins = <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+	};
+
 	leds {
-		green_led_gio: green-led-gpio {
+		green_led: green-led {
 			rockchip,pins = <0 RK_PA6 RK_FUNC_GPIO &pcfg_pull_none>;
 		};
 
-		heartbeat_led_gpio: heartbeat-led-gpio {
+		heartbeat_led: heartbeat-led {
 			rockchip,pins = <0 RK_PA5 RK_FUNC_GPIO &pcfg_pull_none>;
 		};
 	};
@@ -256,15 +299,31 @@
 	cap-sd-highspeed;
 	cap-sdio-irq;
 	keep-power-in-suspend;
-	max-frequency = <1000000>;
+	max-frequency = <100000000>;
 	mmc-pwrseq = <&sdio_pwrseq>;
+	no-mmc;
+	no-sd;
 	non-removable;
-	sd-uhs-sdr104;
+	sd-uhs-sdr50;
+	vmmc-supply = <&vcc_io>;
+	vqmmc-supply = <&vcc_1v8>;
 	status = "okay";
+
+	rtl8723ds: wifi@1 {
+		reg = <1>;
+		interrupt-parent = <&gpio0>;
+		interrupts = <RK_PA0 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "host-wake";
+		pinctrl-names = "default";
+		pinctrl-0 = <&wifi_host_wake>;
+	};
 };
 
 &sdmmc {
+	cap-mmc-highspeed;
 	cap-sd-highspeed;
+	disable-wp;
+	vmmc-supply = <&vcc_io>;
 	status = "okay";
 };
 
@@ -283,16 +342,22 @@
 };
 
 &uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_xfer>;
 	status = "okay";
 };
 
 &uart4 {
+	uart-has-rtscts;
 	status = "okay";
 
 	bluetooth {
-		compatible = "realtek,rtl8723bs-bt";
-		device-wake-gpios = <&gpio4 RK_PB3 GPIO_ACTIVE_HIGH>;
+		compatible = "realtek,rtl8723ds-bt";
+		device-wake-gpios = <&gpio4 RK_PB2 GPIO_ACTIVE_HIGH>;
+		enable-gpios = <&gpio4 RK_PB3 GPIO_ACTIVE_HIGH>;
 		host-wake-gpios = <&gpio4 RK_PB4 GPIO_ACTIVE_HIGH>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&bt_reg_on &bt_wake_host &host_wake_bt>;
 	};
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * (C) Copyright 2018 FriendlyElec Computer Tech. Co., Ltd.
+ * (http://www.friendlyarm.com)
+ *
+ * (C) Copyright 2016 Rockchip Electronics Co., Ltd
+ */
+
+/dts-v1/;
+#include "rk3328-nanopi-r2s.dts"
+
+/ {
+	compatible = "friendlyarm,nanopi-r2s-plus", "rockchip,rk3328";
+	model = "FriendlyElec NanoPi R2S Plus";
+
+	aliases {
+		mmc1 = &emmc;
+	};
+};
+
+&emmc {
+	bus-width = <8>;
+	cap-mmc-highspeed;
+	disable-wp;
+	mmc-hs200-1_8v;
+	non-removable;
+	pinctrl-names = "default";
+	pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_bus8>;
+	status = "okay";
+};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts
@@ -241,8 +241,8 @@
 	rk805: pmic@18 {
 		compatible = "rockchip,rk805";
 		reg = <0x18>;
-		interrupt-parent = <&gpio2>;
-		interrupts = <6 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-parent = <&gpio0>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		#clock-cells = <1>;
 		clock-output-names = "xin32k", "rk805-clkout2";
 		gpio-controller;
@@ -387,7 +387,7 @@
 
 	pmic {
 		pmic_int_l: pmic-int-l {
-			rockchip,pins = <2 RK_PA6 RK_FUNC_GPIO &pcfg_pull_up>;
+			rockchip,pins = <0 RK_PA2 RK_FUNC_GPIO &pcfg_pull_up>;
 		};
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -306,6 +306,7 @@
 
 			power-domain@RK3328_PD_HEVC {
 				reg = <RK3328_PD_HEVC>;
+				clocks = <&cru SCLK_VENC_CORE>;
 				#power-domain-cells = <0>;
 			};
 			power-domain@RK3328_PD_VIDEO {
@@ -727,8 +728,7 @@
 		compatible = "rockchip,rk3328-dw-hdmi";
 		reg = <0x0 0xff3c0000 0x0 0x20000>;
 		reg-io-width = <4>;
-		interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>,
-			     <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&cru PCLK_HDMI>,
 			 <&cru SCLK_HDMI_SFC>,
 			 <&cru SCLK_RTC32K>;
@@ -744,11 +744,20 @@
 		status = "disabled";
 
 		ports {
-			hdmi_in: port {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hdmi_in: port@0 {
+				reg = <0>;
+
 				hdmi_in_vop: endpoint {
 					remote-endpoint = <&vop_out_hdmi>;
 				};
 			};
+
+			hdmi_out: port@1 {
+				reg = <1>;
+			};
 		};
 	};
 
@@ -814,8 +823,8 @@
 			<0>, <24000000>,
 			<24000000>, <24000000>,
 			<15000000>, <15000000>,
-			<100000000>, <100000000>,
-			<100000000>, <100000000>,
+			<300000000>, <100000000>,
+			<400000000>, <100000000>,
 			<50000000>, <100000000>,
 			<100000000>, <100000000>,
 			<50000000>, <50000000>,
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
@@ -61,7 +61,6 @@
 			fan: fan@18 {
 				compatible = "ti,amc6821";
 				reg = <0x18>;
-				#cooling-cells = <2>;
 			};
 
 			rtc_twi: rtc@6f {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3368.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3368.dtsi
@@ -793,6 +793,7 @@
 		dma-names = "tx";
 		pinctrl-names = "default";
 		pinctrl-0 = <&spdif_tx>;
+		#sound-dai-cells = <0>;
 		status = "disabled";
 	};
 
@@ -804,6 +805,7 @@
 		clocks = <&cru SCLK_I2S_2CH>, <&cru HCLK_I2S_2CH>;
 		dmas = <&dmac_bus 6>, <&dmac_bus 7>;
 		dma-names = "tx", "rx";
+		#sound-dai-cells = <0>;
 		status = "disabled";
 	};
 
@@ -817,6 +819,7 @@
 		dma-names = "tx", "rx";
 		pinctrl-names = "default";
 		pinctrl-0 = <&i2s_8ch_bus>;
+		#sound-dai-cells = <0>;
 		status = "disabled";
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts
@@ -542,7 +542,7 @@
 	status = "okay";
 
 	rt5651: audio-codec@1a {
-		compatible = "rockchip,rt5651";
+		compatible = "realtek,rt5651";
 		reg = <0x1a>;
 		clocks = <&cru SCLK_I2S_8CH_OUT>;
 		clock-names = "mclk";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
@@ -450,7 +450,7 @@
 			dlg,btn-cfg = <50>;
 			dlg,mic-det-thr = <500>;
 			dlg,jack-ins-deb = <20>;
-			dlg,jack-det-rate = "32ms_64ms";
+			dlg,jack-det-rate = "32_64";
 			dlg,jack-rem-deb = <1>;
 
 			dlg,a-d-btn-thr = <0xa>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts
@@ -32,12 +32,12 @@
 	backlight: edp-backlight {
 		compatible = "pwm-backlight";
 		power-supply = <&vcc_12v>;
-		pwms = <&pwm0 0 740740 0>;
+		pwms = <&pwm0 0 125000 0>;
 	};
 
 	bat: battery {
 		compatible = "simple-battery";
-		charge-full-design-microamp-hours = <9800000>;
+		charge-full-design-microamp-hours = <10000000>;
 		voltage-max-design-microvolt = <4350000>;
 		voltage-min-design-microvolt = <3000000>;
 	};
@@ -779,7 +779,6 @@
 };
 
 &pcie0 {
-	bus-scan-delay-ms = <1000>;
 	ep-gpios = <&gpio2 RK_PD4 GPIO_ACTIVE_HIGH>;
 	num-lanes = <4>;
 	pinctrl-names = "default";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
@@ -138,7 +138,6 @@
 		regulator-max-microvolt = <1800000>;
 		vin-supply = <&vcc3v3_sys>;
 		gpio = <&gpio3 RK_PA5 GPIO_ACTIVE_HIGH>;
-		pinctrl-names = "default";
 	};
 
 	/* MIPI DSI panel 2.8v supply */
@@ -150,7 +149,6 @@
 		regulator-max-microvolt = <2800000>;
 		vin-supply = <&vcc3v3_sys>;
 		gpio = <&gpio3 RK_PA1 GPIO_ACTIVE_HIGH>;
-		pinctrl-names = "default";
 	};
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
@@ -134,6 +134,22 @@
 	};
 };
 
+&gpio3 {
+	/*
+	 * The Qseven BIOS_DISABLE signal on the RK3399-Q7 keeps the on-module
+	 * eMMC and SPI flash powered-down initially (in fact it keeps the
+	 * reset signal asserted). BIOS_DISABLE_OVERRIDE pin allows to override
+	 * that signal so that eMMC and SPI can be used regardless of the state
+	 * of the signal.
+	 */
+	bios-disable-override-hog {
+		gpios = <RK_PD5 GPIO_ACTIVE_LOW>;
+		gpio-hog;
+		line-name = "bios_disable_override";
+		output-high;
+	};
+};
+
 &gmac {
 	assigned-clocks = <&cru SCLK_RMII_SRC>;
 	assigned-clock-parents = <&clkin_gmac>;
@@ -389,6 +405,7 @@
 
 &i2s0 {
 	pinctrl-0 = <&i2s0_2ch_bus>;
+	pinctrl-1 = <&i2s0_2ch_bus_bclk_off>;
 	rockchip,playback-channels = <2>;
 	rockchip,capture-channels = <2>;
 	status = "okay";
@@ -397,8 +414,8 @@
 /*
  * As Q7 does not specify neither a global nor a RX clock for I2S these
  * signals are not used. Furthermore I2S0_LRCK_RX is used as GPIO.
- * Therefore we have to redefine the i2s0_2ch_bus definition to prevent
- * conflicts.
+ * Therefore we have to redefine the i2s0_2ch_bus and i2s0_2ch_bus_bclk_off
+ * definitions to prevent conflicts.
  */
 &i2s0_2ch_bus {
 	rockchip,pins =
@@ -408,6 +425,14 @@
 		<3 RK_PD7 1 &pcfg_pull_none>;
 };
 
+&i2s0_2ch_bus_bclk_off {
+	rockchip,pins =
+		<3 RK_PD0 RK_FUNC_GPIO &pcfg_pull_none>,
+		<3 RK_PD2 1 &pcfg_pull_none>,
+		<3 RK_PD3 1 &pcfg_pull_none>,
+		<3 RK_PD7 1 &pcfg_pull_none>;
+};
+
 &io_domains {
 	status = "okay";
 	bt656-supply = <&vcc_1v8>;
@@ -416,16 +441,27 @@
 	gpio1830-supply = <&vcc_1v8>;
 };
 
-&pmu_io_domains {
-	status = "okay";
-	pmu1830-supply = <&vcc_1v8>;
-};
-
-&pwm2 {
-	status = "okay";
+&pcie_clkreqn_cpm {
+	rockchip,pins =
+		<2 RK_PD2 RK_FUNC_GPIO &pcfg_pull_up>;
 };
 
 &pinctrl {
+	pinctrl-names = "default";
+	pinctrl-0 = <&q7_thermal_pin &bios_disable_override_hog_pin>;
+
+	gpios {
+		bios_disable_override_hog_pin: bios-disable-override-hog-pin {
+			rockchip,pins =
+				<3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_down>;
+		};
+
+		q7_thermal_pin: q7-thermal-pin {
+			rockchip,pins =
+				<0 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>;
+		};
+	};
+
 	i2c8 {
 		i2c8_xfer_a: i2c8-xfer {
 			rockchip,pins =
@@ -458,11 +494,20 @@
 	usb3 {
 		usb3_id: usb3-id {
 			rockchip,pins =
-			  <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_none>;
+			  <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_up>;
 		};
 	};
 };
 
+&pmu_io_domains {
+	status = "okay";
+	pmu1830-supply = <&vcc_1v8>;
+};
+
+&pwm2 {
+	status = "okay";
+};
+
 &sdhci {
 	/*
 	 * Signal integrity isn't great at 200MHz but 100MHz has proven stable
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
@@ -577,7 +577,7 @@
 	bluetooth {
 		compatible = "brcm,bcm43438-bt";
 		clocks = <&rk808 1>;
-		clock-names = "ext_clock";
+		clock-names = "txco";
 		device-wakeup-gpios = <&gpio2 RK_PD3 GPIO_ACTIVE_HIGH>;
 		host-wakeup-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_HIGH>;
 		shutdown-gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
@@ -163,7 +163,7 @@
 	status = "okay";
 
 	rt5651: rt5651@1a {
-		compatible = "rockchip,rt5651";
+		compatible = "realtek,rt5651";
 		reg = <0x1a>;
 		clocks = <&cru SCLK_I2S_8CH_OUT>;
 		clock-names = "mclk";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -1956,6 +1956,7 @@
 	hdmi: hdmi@ff940000 {
 		compatible = "rockchip,rk3399-dw-hdmi";
 		reg = <0x0 0xff940000 0x0 0x20000>;
+		reg-io-width = <4>;
 		interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH 0>;
 		clocks = <&cru PCLK_HDMI_CTRL>,
 			 <&cru SCLK_HDMI_SFR>,
@@ -1964,13 +1965,16 @@
 			 <&cru PLL_VPLL>;
 		clock-names = "iahb", "isfr", "cec", "grf", "ref";
 		power-domains = <&power RK3399_PD_HDCP>;
-		reg-io-width = <4>;
 		rockchip,grf = <&grf>;
 		#sound-dai-cells = <0>;
 		status = "disabled";
 
 		ports {
-			hdmi_in: port {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hdmi_in: port@0 {
+				reg = <0>;
 				#address-cells = <1>;
 				#size-cells = <0>;
 
@@ -1983,6 +1987,10 @@
 					remote-endpoint = <&vopl_out_hdmi>;
 				};
 			};
+
+			hdmi_out: port@1 {
+				reg = <1>;
+			};
 		};
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts
@@ -92,7 +92,7 @@
 };
 
 &i2c2 {
-	pintctrl-names = "default";
+	pinctrl-names = "default";
 	pinctrl-0 = <&i2c2m1_xfer>;
 	status = "okay";
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts
@@ -79,7 +79,7 @@
 };
 
 &i2c2 {
-	pintctrl-names = "default";
+	pinctrl-names = "default";
 	pinctrl-0 = <&i2c2m1_xfer>;
 	status = "okay";
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts
@@ -449,9 +449,9 @@
 	bluetooth {
 		compatible = "brcm,bcm43438-bt";
 		clocks = <&pmucru CLK_RTC_32K>;
-		clock-names = "ext_clock";
-		device-wake-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>;
-		host-wake-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>;
+		clock-names = "txco";
+		device-wakeup-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>;
+		host-wakeup-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>;
 		shutdown-gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&bt_host_wake_l &bt_wake_l &bt_enable_h>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
@@ -508,7 +508,6 @@
 	non-removable;
 	pinctrl-names = "default";
 	pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>;
-	supports-emmc;
 	status = "okay";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
@@ -683,11 +683,11 @@
 		compatible = "brcm,bcm43438-bt";
 		clocks = <&rk817 1>;
 		clock-names = "lpo";
-		device-wake-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>;
-		host-wake-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>;
-		reset-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>;
+		device-wakeup-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>;
+		host-wakeup-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>;
 		pinctrl-0 = <&bt_enable_h>, <&bt_host_wake_l>, <&bt_wake_h>;
 		pinctrl-names = "default";
+		shutdown-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_HIGH>;
 		vbat-supply = <&vcc_wl>;
 		vddio-supply = <&vcca_1v8_pmu>;
 	};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts
@@ -289,7 +289,7 @@
 				regulator-name = "vdd_gpu";
 				regulator-always-on;
 				regulator-boot-on;
-				regulator-min-microvolt = <900000>;
+				regulator-min-microvolt = <500000>;
 				regulator-max-microvolt = <1350000>;
 				regulator-ramp-delay = <6001>;
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi
@@ -402,9 +402,9 @@
 		clock-names = "lpo";
 		device-wakeup-gpios = <&gpio2 RK_PB2 GPIO_ACTIVE_HIGH>;
 		host-wakeup-gpios = <&gpio2 RK_PB1 GPIO_ACTIVE_HIGH>;
-		reset-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&bt_host_wake_h &bt_reg_on_h &bt_wake_host_h>;
+		shutdown-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>;
 		vbat-supply = <&vcc_3v3>;
 		vddio-supply = <&vcc_1v8>;
 	};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
@@ -269,7 +269,7 @@
 		vcc9-supply = <&vcc3v3_sys>;
 
 		codec {
-			mic-in-differential;
+			rockchip,mic-in-differential;
 		};
 
 		regulators {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts
@@ -416,6 +416,8 @@
 
 			vccio_sd: LDO_REG5 {
 				regulator-name = "vccio_sd";
+				regulator-always-on;
+				regulator-boot-on;
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <3300000>;
 
@@ -525,9 +527,9 @@
 	#address-cells = <1>;
 	#size-cells = <0>;
 
-	switch@0 {
+	switch@1f {
 		compatible = "mediatek,mt7531";
-		reg = <0>;
+		reg = <0x1f>;
 
 		ports {
 			#address-cells = <1>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts
@@ -475,7 +475,7 @@
 		};
 
 		codec {
-			mic-in-differential;
+			rockchip,mic-in-differential;
 		};
 	};
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dts
@@ -11,6 +11,10 @@
 	};
 };
 
+&pmu_io_domains {
+	vccio3-supply = <&vccio_sd>;
+};
+
 &sdmmc0 {
 	bus-width = <4>;
 	cap-mmc-highspeed;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi
@@ -39,9 +39,9 @@
 		};
 	};
 
-	dc_12v: dc-12v-regulator {
+	vcc12v_dcin: vcc12v-dcin-regulator {
 		compatible = "regulator-fixed";
-		regulator-name = "dc_12v";
+		regulator-name = "vcc12v_dcin";
 		regulator-always-on;
 		regulator-boot-on;
 		regulator-min-microvolt = <12000000>;
@@ -65,7 +65,7 @@
 		regulator-boot-on;
 		regulator-min-microvolt = <3300000>;
 		regulator-max-microvolt = <3300000>;
-		vin-supply = <&dc_12v>;
+		vin-supply = <&vcc12v_dcin>;
 	};
 
 	vcc5v0_sys: vcc5v0-sys-regulator {
@@ -75,16 +75,7 @@
 		regulator-boot-on;
 		regulator-min-microvolt = <5000000>;
 		regulator-max-microvolt = <5000000>;
-		vin-supply = <&dc_12v>;
-	};
-
-	vcc5v0_usb_host: vcc5v0-usb-host-regulator {
-		compatible = "regulator-fixed";
-		regulator-name = "vcc5v0_usb_host";
-		regulator-always-on;
-		regulator-boot-on;
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
+		vin-supply = <&vcc12v_dcin>;
 	};
 
 	vcc5v0_usb_otg: vcc5v0-usb-otg-regulator {
@@ -94,8 +85,9 @@
 		pinctrl-names = "default";
 		pinctrl-0 = <&vcc5v0_usb_otg_en>;
 		regulator-name = "vcc5v0_usb_otg";
-		regulator-always-on;
-		regulator-boot-on;
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		vin-supply = <&vcc5v0_sys>;
 	};
 };
 
@@ -123,6 +115,10 @@
 	cpu-supply = <&vdd_cpu>;
 };
 
+&display_subsystem {
+	status = "disabled";
+};
+
 &gpu {
 	mali-supply = <&vdd_gpu>;
 	status = "okay";
@@ -405,8 +401,8 @@
 &pmu_io_domains {
 	pmuio1-supply = <&vcc3v3_pmu>;
 	pmuio2-supply = <&vcc3v3_pmu>;
-	vccio1-supply = <&vccio_acodec>;
-	vccio3-supply = <&vccio_sd>;
+	vccio1-supply = <&vcc_3v3>;
+	vccio2-supply = <&vcc_1v8>;
 	vccio4-supply = <&vcc_1v8>;
 	vccio5-supply = <&vcc_3v3>;
 	vccio6-supply = <&vcc_1v8>;
@@ -429,28 +425,12 @@
 	status = "okay";
 };
 
-&usb_host0_ehci {
-	status = "okay";
-};
-
-&usb_host0_ohci {
-	status = "okay";
-};
-
 &usb_host0_xhci {
 	dr_mode = "host";
 	extcon = <&usb2phy0>;
 	status = "okay";
 };
 
-&usb_host1_ehci {
-	status = "okay";
-};
-
-&usb_host1_ohci {
-	status = "okay";
-};
-
 &usb_host1_xhci {
 	status = "okay";
 };
@@ -460,7 +440,7 @@
 };
 
 &usb2phy0_host {
-	phy-supply = <&vcc5v0_usb_host>;
+	phy-supply = <&vcc5v0_sys>;
 	status = "okay";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts
@@ -39,7 +39,7 @@
 		     &gmac0_rx_bus2
 		     &gmac0_rgmii_clk
 		     &gmac0_rgmii_bus>;
-	snps,reset-gpio = <&gpio0 RK_PB0 GPIO_ACTIVE_LOW>;
+	snps,reset-gpio = <&gpio1 RK_PB0 GPIO_ACTIVE_LOW>;
 	snps,reset-active-low;
 	/* Reset time is 15ms, 50ms for rtl8211f */
 	snps,reset-delays-us = <0 15000 50000>;
@@ -61,7 +61,7 @@
 		     &gmac1m1_rx_bus2
 		     &gmac1m1_rgmii_clk
 		     &gmac1m1_rgmii_bus>;
-	snps,reset-gpio = <&gpio0 RK_PB1 GPIO_ACTIVE_LOW>;
+	snps,reset-gpio = <&gpio1 RK_PB1 GPIO_ACTIVE_LOW>;
 	snps,reset-active-low;
 	/* Reset time is 15ms, 50ms for rtl8211f */
 	snps,reset-delays-us = <0 15000 50000>;
@@ -71,18 +71,18 @@
 };
 
 &mdio0 {
-	rgmii_phy0: ethernet-phy@0 {
+	rgmii_phy0: ethernet-phy@1 {
 		compatible = "ethernet-phy-ieee802.3-c22";
-		reg = <0>;
+		reg = <0x1>;
 		pinctrl-0 = <&eth_phy0_reset_pin>;
 		pinctrl-names = "default";
 	};
 };
 
 &mdio1 {
-	rgmii_phy1: ethernet-phy@0 {
+	rgmii_phy1: ethernet-phy@1 {
 		compatible = "ethernet-phy-ieee802.3-c22";
-		reg = <0>;
+		reg = <0x1>;
 		pinctrl-0 = <&eth_phy1_reset_pin>;
 		pinctrl-names = "default";
 	};
@@ -102,6 +102,10 @@
 	};
 };
 
+&pmu_io_domains {
+	vccio3-supply = <&vcc_3v3>;
+};
+
 &sdhci {
 	bus-width = <8>;
 	max-frequency = <200000000>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts
@@ -590,7 +590,6 @@
 	non-removable;
 	pinctrl-names = "default";
 	pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>;
-	supports-emmc;
 	status = "okay";
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
@@ -13,7 +13,7 @@
 
 / {
 	model = "Hardkernel ODROID-M1";
-	compatible = "rockchip,rk3568-odroid-m1", "rockchip,rk3568";
+	compatible = "hardkernel,odroid-m1", "rockchip,rk3568";
 
 	aliases {
 		ethernet0 = &gmac0;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3568-roc-pc.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3568-roc-pc.dts
@@ -272,7 +272,6 @@
 				regulator-name = "vdd_logic";
 				regulator-always-on;
 				regulator-boot-on;
-				regulator-init-microvolt = <900000>;
 				regulator-initial-mode = <0x2>;
 				regulator-min-microvolt = <500000>;
 				regulator-max-microvolt = <1350000>;
@@ -285,7 +284,6 @@
 
 			vdd_gpu: DCDC_REG2 {
 				regulator-name = "vdd_gpu";
-				regulator-init-microvolt = <900000>;
 				regulator-initial-mode = <0x2>;
 				regulator-min-microvolt = <500000>;
 				regulator-max-microvolt = <1350000>;
@@ -309,7 +307,6 @@
 
 			vdd_npu: DCDC_REG4 {
 				regulator-name = "vdd_npu";
-				regulator-init-microvolt = <900000>;
 				regulator-initial-mode = <0x2>;
 				regulator-min-microvolt = <500000>;
 				regulator-max-microvolt = <1350000>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
@@ -531,10 +531,6 @@
 				};
 			};
 		};
-
-		codec {
-			mic-in-differential;
-		};
 	};
 };
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk356x.dtsi
@@ -597,6 +597,7 @@
 		compatible = "rockchip,rk3568-vpu";
 		reg = <0x0 0xfdea0000 0x0 0x800>;
 		interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "vdpu";
 		clocks = <&cru ACLK_VPU>, <&cru HCLK_VPU>;
 		clock-names = "aclk", "hclk";
 		iommus = <&vdpu_mmu>;
@@ -748,6 +749,7 @@
 		clocks = <&cru ACLK_VOP>, <&cru HCLK_VOP>;
 		clock-names = "aclk", "iface";
 		#iommu-cells = <0>;
+		power-domains = <&power RK3568_PD_VO>;
 		status = "disabled";
 	};
 
@@ -1123,7 +1125,7 @@
 		dmas = <&dmac1 4>, <&dmac1 5>;
 		dma-names = "tx", "rx";
 		resets = <&cru SRST_M_I2S2_2CH>;
-		reset-names = "m";
+		reset-names = "tx-m";
 		rockchip,grf = <&grf>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&i2s2m0_sclktx
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi
@@ -216,9 +216,9 @@
 	pinctrl-0 = <&i2c7m0_xfer>;
 	status = "okay";
 
-	es8316: audio-codec@11 {
+	es8316: audio-codec@10 {
 		compatible = "everest,es8316";
-		reg = <0x11>;
+		reg = <0x10>;
 		assigned-clocks = <&cru I2S0_8CH_MCLKOUT>;
 		assigned-clock-rates = <12288000>;
 		clocks = <&cru I2S0_8CH_MCLKOUT>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts
@@ -486,6 +486,7 @@
 		pinctrl-0 = <&pmic_pins>, <&rk806_dvs1_null>,
 			    <&rk806_dvs2_null>, <&rk806_dvs3_null>;
 		spi-max-frequency = <1000000>;
+		system-power-controller;
 
 		vcc1-supply = <&vcc5v0_sys>;
 		vcc2-supply = <&vcc5v0_sys>;
@@ -507,7 +508,7 @@
 		#gpio-cells = <2>;
 
 		rk806_dvs1_null: dvs1-null-pins {
-			pins = "gpio_pwrctrl2";
+			pins = "gpio_pwrctrl1";
 			function = "pin_fun0";
 		};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi
@@ -297,6 +297,7 @@
 		pinctrl-names = "default";
 		pinctrl-0 = <&pmic_pins>, <&rk806_dvs1_null>,
 			    <&rk806_dvs2_null>, <&rk806_dvs3_null>;
+		system-power-controller;
 
 		vcc1-supply = <&vcc5v0_sys>;
 		vcc2-supply = <&vcc5v0_sys>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts
@@ -283,9 +283,9 @@
 	pinctrl-0 = <&i2c7m0_xfer>;
 	status = "okay";
 
-	es8316: audio-codec@11 {
+	es8316: audio-codec@10 {
 		compatible = "everest,es8316";
-		reg = <0x11>;
+		reg = <0x10>;
 		assigned-clocks = <&cru I2S0_8CH_MCLKOUT>;
 		assigned-clock-rates = <12288000>;
 		clocks = <&cru I2S0_8CH_MCLKOUT>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3588s-indiedroid-nova.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3588s-indiedroid-nova.dts
@@ -62,7 +62,7 @@
 
 	sound {
 		compatible = "audio-graph-card";
-		label = "rockchip,es8388-codec";
+		label = "rockchip,es8388";
 		widgets = "Microphone", "Mic Jack",
 			  "Headphone", "Headphones";
 		routing = "LINPUT2", "Mic Jack",
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts
@@ -70,7 +70,6 @@
 
 	vcc_3v3_sd_s0: vcc-3v3-sd-s0-regulator {
 		compatible = "regulator-fixed";
-		enable-active-low;
 		gpios = <&gpio4 RK_PB5 GPIO_ACTIVE_LOW>;
 		regulator-name = "vcc_3v3_sd_s0";
 		regulator-boot-on;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts
@@ -394,6 +394,7 @@
 		pinctrl-0 = <&pmic_pins>, <&rk806_dvs1_null>,
 			    <&rk806_dvs2_null>, <&rk806_dvs3_null>;
 		spi-max-frequency = <1000000>;
+		system-power-controller;
 
 		vcc1-supply = <&vcc5v0_sys>;
 		vcc2-supply = <&vcc5v0_sys>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/rockchip/rk3588s.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/rockchip/rk3588s.dtsi
@@ -1704,7 +1704,6 @@
 		dmas = <&dmac1 0>, <&dmac1 1>;
 		dma-names = "tx", "rx";
 		power-domains = <&power RK3588_PD_AUDIO>;
-		rockchip,trcm-sync-tx-only;
 		pinctrl-names = "default";
 		pinctrl-0 = <&i2s2m1_lrck
 			     &i2s2m1_sclk
@@ -1725,7 +1724,6 @@
 		dmas = <&dmac1 2>, <&dmac1 3>;
 		dma-names = "tx", "rx";
 		power-domains = <&power RK3588_PD_AUDIO>;
-		rockchip,trcm-sync-tx-only;
 		pinctrl-names = "default";
 		pinctrl-0 = <&i2s3_lrck
 			     &i2s3_sclk
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/Makefile
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/Makefile
@@ -57,6 +57,7 @@
 dtb-$(CONFIG_ARCH_K3) += k3-am654-gp-evm.dtb
 dtb-$(CONFIG_ARCH_K3) += k3-am654-evm.dtb
 dtb-$(CONFIG_ARCH_K3) += k3-am654-idk.dtb
+dtb-$(CONFIG_ARCH_K3) += k3-am654-base-board-rocktech-rk101-panel.dtbo
 
 # Boards with J7200 SoC
 k3-j7200-evm-dtbs := k3-j7200-common-proc-board.dtb k3-j7200-evm-quad-port-eth-exp.dtbo
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
@@ -142,8 +142,8 @@
 			compatible = "ti,am64-dmss-pktdma";
 			reg = <0x00 0x485c0000 0x00 0x100>,
 			      <0x00 0x4a800000 0x00 0x20000>,
-			      <0x00 0x4aa00000 0x00 0x40000>,
-			      <0x00 0x4b800000 0x00 0x400000>,
+			      <0x00 0x4aa00000 0x00 0x20000>,
+			      <0x00 0x4b800000 0x00 0x200000>,
 			      <0x00 0x485e0000 0x00 0x10000>,
 			      <0x00 0x484a0000 0x00 0x2000>,
 			      <0x00 0x484c0000 0x00 0x2000>,
@@ -640,6 +640,8 @@
 			interrupt-names = "host", "peripheral";
 			maximum-speed = "high-speed";
 			dr_mode = "otg";
+			snps,usb2-gadget-lpm-disable;
+			snps,usb2-lpm-disable;
 		};
 	};
 
@@ -663,6 +665,8 @@
 			interrupt-names = "host", "peripheral";
 			maximum-speed = "high-speed";
 			dr_mode = "otg";
+			snps,usb2-gadget-lpm-disable;
+			snps,usb2-lpm-disable;
 		};
 	};
 
@@ -779,9 +783,10 @@
 		      <0x00 0x30207000 0x00 0x1000>, /* ovr1 */
 		      <0x00 0x30208000 0x00 0x1000>, /* ovr2 */
 		      <0x00 0x3020a000 0x00 0x1000>, /* vp1: Used for OLDI */
-		      <0x00 0x3020b000 0x00 0x1000>; /* vp2: Used as DPI Out */
+		      <0x00 0x3020b000 0x00 0x1000>, /* vp2: Used as DPI Out */
+		      <0x00 0x30201000 0x00 0x1000>; /* common1 */
 		reg-names = "common", "vidl1", "vid",
-			    "ovr1", "ovr2", "vp1", "vp2";
+			    "ovr1", "ovr2", "vp1", "vp2", "common1";
 		power-domains = <&k3_pds 186 TI_SCI_PD_EXCLUSIVE>;
 		clocks = <&k3_clks 186 6>,
 			 <&dss_vp1_clk>,
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
@@ -60,7 +60,7 @@
 
 	memory@80000000 {
 		device_type = "memory";
-		reg = <0x00000000 0x80000000 0x00000000 0x40000000>; /* 1G RAM */
+		reg = <0x00000000 0x80000000 0x00000000 0x80000000>; /* 2G RAM */
 	};
 
 	opp-table {
@@ -134,7 +134,7 @@
 		regulator-max-microvolt = <3300000>;
 		regulator-min-microvolt = <3300000>;
 		regulator-name = "+V3.3_SD";
-		startup-delay-us = <2000>;
+		startup-delay-us = <20000>;
 	};
 
 	reg_sdhc1_vqmmc: regulator-sdhci1-vqmmc {
@@ -1322,8 +1322,6 @@
 	       0 0 0 0
 	>;
 	tdm-slots = <2>;
-	rx-num-evt = <32>;
-	tx-num-evt = <32>;
 	#sound-dai-cells = <0>;
 	status = "disabled";
 };
@@ -1340,8 +1338,6 @@
 	       0 0 0 0
 	>;
 	tdm-slots = <2>;
-	rx-num-evt = <32>;
-	tx-num-evt = <32>;
 	#sound-dai-cells = <0>;
 	status = "disabled";
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
@@ -935,6 +935,4 @@
 	       0 0 0 0
 	       0 0 0 0
 	>;
-	tx-num-evt = <32>;
-	rx-num-evt = <32>;
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
@@ -121,8 +121,8 @@
 			compatible = "ti,am64-dmss-pktdma";
 			reg = <0x00 0x485c0000 0x00 0x100>,
 			      <0x00 0x4a800000 0x00 0x20000>,
-			      <0x00 0x4aa00000 0x00 0x40000>,
-			      <0x00 0x4b800000 0x00 0x400000>,
+			      <0x00 0x4aa00000 0x00 0x20000>,
+			      <0x00 0x4b800000 0x00 0x200000>,
 			      <0x00 0x485e0000 0x00 0x10000>,
 			      <0x00 0x484a0000 0x00 0x2000>,
 			      <0x00 0x484c0000 0x00 0x2000>,
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -580,6 +580,4 @@
 	       0 0 0 0
 	       0 0 0 0
 	>;
-	tx-num-evt = <32>;
-	rx-num-evt = <32>;
 };
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62p-main.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62p-main.dtsi
@@ -123,8 +123,8 @@
 			compatible = "ti,am64-dmss-pktdma";
 			reg = <0x00 0x485c0000 0x00 0x100>,
 			      <0x00 0x4a800000 0x00 0x20000>,
-			      <0x00 0x4aa00000 0x00 0x40000>,
-			      <0x00 0x4b800000 0x00 0x400000>,
+			      <0x00 0x4aa00000 0x00 0x20000>,
+			      <0x00 0x4b800000 0x00 0x200000>,
 			      <0x00 0x485e0000 0x00 0x10000>,
 			      <0x00 0x484a0000 0x00 0x2000>,
 			      <0x00 0x484c0000 0x00 0x2000>,
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi
@@ -187,6 +187,8 @@
 		ranges = <0x79000000 0x00 0x79000000 0x8000>,
 			 <0x79020000 0x00 0x79020000 0x8000>;
 		power-domains = <&k3_pds 7 TI_SCI_PD_EXCLUSIVE>;
+		status = "disabled";
+
 		mcu_r5fss0_core0: r5f@79000000 {
 			compatible = "ti,am62-r5f";
 			reg = <0x79000000 0x00008000>,
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi
@@ -78,6 +78,7 @@
 		ranges = <0x78000000 0x00 0x78000000 0x8000>,
 			 <0x78100000 0x00 0x78100000 0x8000>;
 		power-domains = <&k3_pds 119 TI_SCI_PD_EXCLUSIVE>;
+		status = "disabled";
 
 		wkup_r5fss0_core0: r5f@78000000 {
 			compatible = "ti,am62-r5f";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62p.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62p.dtsi
@@ -71,7 +71,7 @@
 			 <0x00 0x43600000 0x00 0x43600000 0x00 0x00010000>, /* SA3 sproxy data */
 			 <0x00 0x44043000 0x00 0x44043000 0x00 0x00000fe0>, /* TI SCI DEBUG */
 			 <0x00 0x44860000 0x00 0x44860000 0x00 0x00040000>, /* SA3 sproxy config */
-			 <0x00 0x48000000 0x00 0x48000000 0x00 0x06400000>, /* DMSS */
+			 <0x00 0x48000000 0x00 0x48000000 0x00 0x06408000>, /* DMSS */
 			 <0x00 0x60000000 0x00 0x60000000 0x00 0x08000000>, /* FSS0 DAT1 */
 			 <0x00 0x70000000 0x00 0x70000000 0x00 0x00010000>, /* OCSRAM */
 			 <0x01 0x00000000 0x01 0x00000000 0x00 0x00310000>, /* A53 PERIPHBASE */
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
@@ -205,7 +205,7 @@
 		pinctrl-single,pins = <
 			AM62PX_IOPAD(0x0090, PIN_INPUT, 2) /* (U24) GPMC0_BE0n_CLE.MCASP1_ACLKX */
 			AM62PX_IOPAD(0x0098, PIN_INPUT, 2) /* (AA24) GPMC0_WAIT0.MCASP1_AFSX */
-			AM62PX_IOPAD(0x008c, PIN_INPUT, 2) /* (T25) GPMC0_WEn.MCASP1_AXR0 */
+			AM62PX_IOPAD(0x008c, PIN_OUTPUT, 2) /* (T25) GPMC0_WEn.MCASP1_AXR0 */
 			AM62PX_IOPAD(0x0084, PIN_INPUT, 2) /* (R25) GPMC0_ADVn_ALE.MCASP1_AXR2 */
 		>;
 	};
@@ -445,6 +445,10 @@
 };
 
 &cpsw3g_mdio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&main_mdio1_pins_default>;
+	status = "okay";
+
 	cpsw3g_phy0: ethernet-phy@0 {
 		reg = <0>;
 		ti,rx-internal-delay = <DP83867_RGMIIDCTL_2_00_NS>;
@@ -476,8 +480,6 @@
 	       0 0 0 0
 	       0 0 0 0
 	>;
-	tx-num-evt = <32>;
-	rx-num-evt = <32>;
 };
 
 &fss {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
@@ -504,8 +504,6 @@
 	       0 0 0 0
 	       0 0 0 0
 	>;
-	tx-num-evt = <32>;
-	rx-num-evt = <32>;
 };
 
 &dss {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am64-main.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am64-main.dtsi
@@ -633,6 +633,9 @@
 		ti,otap-del-sel-mmc-hs = <0x0>;
 		ti,otap-del-sel-ddr52 = <0x6>;
 		ti,otap-del-sel-hs200 = <0x7>;
+		ti,itap-del-sel-legacy = <0x10>;
+		ti,itap-del-sel-mmc-hs = <0xa>;
+		ti,itap-del-sel-ddr52 = <0x3>;
 		status = "disabled";
 	};
 
@@ -645,12 +648,16 @@
 		clock-names = "clk_ahb", "clk_xin";
 		ti,trm-icp = <0x2>;
 		ti,otap-del-sel-legacy = <0x0>;
-		ti,otap-del-sel-sd-hs = <0xf>;
+		ti,otap-del-sel-sd-hs = <0x0>;
 		ti,otap-del-sel-sdr12 = <0xf>;
 		ti,otap-del-sel-sdr25 = <0xf>;
 		ti,otap-del-sel-sdr50 = <0xc>;
 		ti,otap-del-sel-sdr104 = <0x6>;
 		ti,otap-del-sel-ddr50 = <0x9>;
+		ti,itap-del-sel-legacy = <0x0>;
+		ti,itap-del-sel-sd-hs = <0x0>;
+		ti,itap-del-sel-sdr12 = <0x0>;
+		ti,itap-del-sel-sdr25 = <0x0>;
 		ti,clkbuf-sel = <0x7>;
 		status = "disabled";
 	};
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
@@ -1019,9 +1019,10 @@
 		      <0x0 0x04a07000 0x0 0x1000>, /* ovr1 */
 		      <0x0 0x04a08000 0x0 0x1000>, /* ovr2 */
 		      <0x0 0x04a0a000 0x0 0x1000>, /* vp1 */
-		      <0x0 0x04a0b000 0x0 0x1000>; /* vp2 */
+		      <0x0 0x04a0b000 0x0 0x1000>, /* vp2 */
+		      <0x0 0x04a01000 0x0 0x1000>; /* common1 */
 		reg-names = "common", "vidl1", "vid",
-			"ovr1", "ovr2", "vp1", "vp2";
+			"ovr1", "ovr2", "vp1", "vp2", "common1";
 
 		ti,am65x-oldi-io-ctrl = <&dss_oldi_io_ctrl>;
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am654-idk.dtso
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am654-idk.dtso
@@ -58,9 +58,7 @@
 		       <&main_udmap 0xc107>, /* egress slice 1 */
 
 		       <&main_udmap 0x4100>, /* ingress slice 0 */
-		       <&main_udmap 0x4101>, /* ingress slice 1 */
-		       <&main_udmap 0x4102>, /* mgmnt rsp slice 0 */
-		       <&main_udmap 0x4103>; /* mgmnt rsp slice 1 */
+		       <&main_udmap 0x4101>; /* ingress slice 1 */
 		dma-names = "tx0-0", "tx0-1", "tx0-2", "tx0-3",
 			    "tx1-0", "tx1-1", "tx1-2", "tx1-3",
 			    "rx0", "rx1";
@@ -126,9 +124,7 @@
 		       <&main_udmap 0xc207>, /* egress slice 1 */
 
 		       <&main_udmap 0x4200>, /* ingress slice 0 */
-		       <&main_udmap 0x4201>, /* ingress slice 1 */
-		       <&main_udmap 0x4202>, /* mgmnt rsp slice 0 */
-		       <&main_udmap 0x4203>; /* mgmnt rsp slice 1 */
+		       <&main_udmap 0x4201>; /* ingress slice 1 */
 		dma-names = "tx0-0", "tx0-1", "tx0-2", "tx0-3",
 			    "tx1-0", "tx1-1", "tx1-2", "tx1-3",
 			    "rx0", "rx1";
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-am69-sk.dts
@@ -646,7 +646,7 @@
 		pinctrl-names = "default";
 		pinctrl-0 = <&pmic_irq_pins_default>;
 		interrupt-parent = <&wkup_gpio0>;
-		interrupts = <39 IRQ_TYPE_EDGE_FALLING>;
+		interrupts = <83 IRQ_TYPE_EDGE_FALLING>;
 		gpio-controller;
 		#gpio-cells = <2>;
 		ti,primary-pmic;
@@ -918,13 +918,9 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&dss_vout0_pins_default>;
 	assigned-clocks = <&k3_clks 218 2>,
-			  <&k3_clks 218 5>,
-			  <&k3_clks 218 14>,
-			  <&k3_clks 218 18>;
+			  <&k3_clks 218 5>;
 	assigned-clock-parents = <&k3_clks 218 3>,
-				 <&k3_clks 218 7>,
-				 <&k3_clks 218 16>,
-				 <&k3_clks 218 22>;
+				 <&k3_clks 218 7>;
 };
 
 &serdes_wiz4 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
@@ -91,24 +91,25 @@
 };
 
 &wkup_pmx0 {
+};
+
+&wkup_pmx2 {
 	mcu_uart0_pins_default: mcu-uart0-default-pins {
 		pinctrl-single,pins = <
-			J721E_WKUP_IOPAD(0xf4, PIN_INPUT, 0) /* (D20) MCU_UART0_RXD */
-			J721E_WKUP_IOPAD(0xf0, PIN_OUTPUT, 0) /* (D19) MCU_UART0_TXD */
-			J721E_WKUP_IOPAD(0xf8, PIN_INPUT, 0) /* (E20) MCU_UART0_CTSn */
-			J721E_WKUP_IOPAD(0xfc, PIN_OUTPUT, 0) /* (E21) MCU_UART0_RTSn */
+			J721E_WKUP_IOPAD(0x90, PIN_INPUT, 0) /* (E20) MCU_UART0_CTSn */
+			J721E_WKUP_IOPAD(0x94, PIN_OUTPUT, 0) /* (E21) MCU_UART0_RTSn */
+			J721E_WKUP_IOPAD(0x8c, PIN_INPUT, 0) /* (D20) MCU_UART0_RXD */
+			J721E_WKUP_IOPAD(0x88, PIN_OUTPUT, 0) /* (D19) MCU_UART0_TXD */
 		>;
 	};
 
 	wkup_uart0_pins_default: wkup-uart0-default-pins {
 		pinctrl-single,pins = <
-			J721E_WKUP_IOPAD(0xb0, PIN_INPUT, 0) /* (B14) WKUP_UART0_RXD */
-			J721E_WKUP_IOPAD(0xb4, PIN_OUTPUT, 0) /* (A14) WKUP_UART0_TXD */
+			J721E_WKUP_IOPAD(0x48, PIN_INPUT, 0) /* (B14) WKUP_UART0_RXD */
+			J721E_WKUP_IOPAD(0x4c, PIN_OUTPUT, 0) /* (A14) WKUP_UART0_TXD */
 		>;
 	};
-};
 
-&wkup_pmx2 {
 	mcu_cpsw_pins_default: mcu-cpsw-default-pins {
 		pinctrl-single,pins = <
 			J721E_WKUP_IOPAD(0x0000, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */
@@ -191,7 +192,7 @@
 	};
 };
 
-&main_pmx1 {
+&main_pmx2 {
 	main_usbss0_pins_default: main-usbss0-default-pins {
 		pinctrl-single,pins = <
 			J721E_IOPAD(0x04, PIN_OUTPUT, 0) /* (T4) USB0_DRVVBUS */
@@ -210,7 +211,6 @@
 	status = "okay";
 	pinctrl-names = "default";
 	pinctrl-0 = <&mcu_uart0_pins_default>;
-	clock-frequency = <96000000>;
 };
 
 &main_uart0 {
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
@@ -399,7 +399,7 @@
 
 	/* TIMERIO pad input CTRLMMR_TIMER*_CTRL registers */
 	main_timerio_input: pinctrl@104200 {
-		compatible = "pinctrl-single";
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		reg = <0x0 0x104200 0x0 0x50>;
 		#pinctrl-cells = <1>;
 		pinctrl-single,register-width = <32>;
@@ -408,7 +408,7 @@
 
 	/* TIMERIO pad output CTCTRLMMR_TIMERIO*_CTRL registers */
 	main_timerio_output: pinctrl@104280 {
-		compatible = "pinctrl-single";
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		reg = <0x0 0x104280 0x0 0x20>;
 		#pinctrl-cells = <1>;
 		pinctrl-single,register-width = <32>;
@@ -416,7 +416,7 @@
 	};
 
 	main_pmx0: pinctrl@11c000 {
-		compatible = "pinctrl-single";
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		/* Proxy 0 addressing */
 		reg = <0x00 0x11c000 0x00 0x10c>;
 		#pinctrl-cells = <1>;
@@ -424,10 +424,28 @@
 		pinctrl-single,function-mask = <0xffffffff>;
 	};
 
-	main_pmx1: pinctrl@11c11c {
-		compatible = "pinctrl-single";
+	main_pmx1: pinctrl@11c110 {
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		/* Proxy 0 addressing */
-		reg = <0x00 0x11c11c 0x00 0xc>;
+		reg = <0x00 0x11c110 0x00 0x004>;
+		#pinctrl-cells = <1>;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0xffffffff>;
+	};
+
+	main_pmx2: pinctrl@11c11c {
+		compatible = "ti,j7200-padconf", "pinctrl-single";
+		/* Proxy 0 addressing */
+		reg = <0x00 0x11c11c 0x00 0x00c>;
+		#pinctrl-cells = <1>;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0xffffffff>;
+	};
+
+	main_pmx3: pinctrl@11c164 {
+		compatible = "ti,j7200-padconf", "pinctrl-single";
+		/* Proxy 0 addressing */
+		reg = <0x00 0x11c164 0x00 0x008>;
 		#pinctrl-cells = <1>;
 		pinctrl-single,register-width = <32>;
 		pinctrl-single,function-mask = <0xffffffff>;
@@ -902,7 +920,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 266 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 266 1>;
+		clocks = <&k3_clks 266 4>;
 		status = "disabled";
 	};
 
@@ -913,7 +931,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 267 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 267 1>;
+		clocks = <&k3_clks 267 4>;
 		status = "disabled";
 	};
 
@@ -924,7 +942,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 268 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 268 1>;
+		clocks = <&k3_clks 268 4>;
 		status = "disabled";
 	};
 
@@ -935,7 +953,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 269 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 269 1>;
+		clocks = <&k3_clks 269 4>;
 		status = "disabled";
 	};
 
@@ -946,7 +964,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 270 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 270 1>;
+		clocks = <&k3_clks 270 2>;
 		status = "disabled";
 	};
 
@@ -957,7 +975,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 271 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 271 1>;
+		clocks = <&k3_clks 271 4>;
 		status = "disabled";
 	};
 
@@ -968,7 +986,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 272 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 272 1>;
+		clocks = <&k3_clks 272 4>;
 		status = "disabled";
 	};
 
@@ -979,7 +997,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 273 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 273 1>;
+		clocks = <&k3_clks 273 4>;
 		status = "disabled";
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
@@ -192,7 +192,7 @@
 
 	/* MCU_TIMERIO pad input CTRLMMR_MCU_TIMER*_CTRL registers */
 	mcu_timerio_input: pinctrl@40f04200 {
-		compatible = "pinctrl-single";
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		reg = <0x0 0x40f04200 0x0 0x28>;
 		#pinctrl-cells = <1>;
 		pinctrl-single,register-width = <32>;
@@ -202,7 +202,7 @@
 
 	/* MCU_TIMERIO pad output CTRLMMR_MCU_TIMERIO*_CTRL registers */
 	mcu_timerio_output: pinctrl@40f04280 {
-		compatible = "pinctrl-single";
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		reg = <0x0 0x40f04280 0x0 0x28>;
 		#pinctrl-cells = <1>;
 		pinctrl-single,register-width = <32>;
@@ -211,7 +211,7 @@
 	};
 
 	wkup_pmx0: pinctrl@4301c000 {
-		compatible = "pinctrl-single";
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		/* Proxy 0 addressing */
 		reg = <0x00 0x4301c000 0x00 0x34>;
 		#pinctrl-cells = <1>;
@@ -220,7 +220,7 @@
 	};
 
 	wkup_pmx1: pinctrl@4301c038 {
-		compatible = "pinctrl-single";
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		/* Proxy 0 addressing */
 		reg = <0x00 0x4301c038 0x00 0x8>;
 		#pinctrl-cells = <1>;
@@ -229,7 +229,7 @@
 	};
 
 	wkup_pmx2: pinctrl@4301c068 {
-		compatible = "pinctrl-single";
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		/* Proxy 0 addressing */
 		reg = <0x00 0x4301c068 0x00 0xec>;
 		#pinctrl-cells = <1>;
@@ -238,7 +238,7 @@
 	};
 
 	wkup_pmx3: pinctrl@4301c174 {
-		compatible = "pinctrl-single";
+		compatible = "ti,j7200-padconf", "pinctrl-single";
 		/* Proxy 0 addressing */
 		reg = <0x00 0x4301c174 0x00 0x20>;
 		#pinctrl-cells = <1>;
@@ -492,7 +492,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 274 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 274 0>;
+		clocks = <&k3_clks 274 4>;
 		status = "disabled";
 	};
 
@@ -503,7 +503,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 275 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 275 0>;
+		clocks = <&k3_clks 275 4>;
 		status = "disabled";
 	};
 
@@ -514,7 +514,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 276 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 276 0>;
+		clocks = <&k3_clks 276 2>;
 		status = "disabled";
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
@@ -123,7 +123,7 @@
 			no-map;
 		};
 
-		c66_1_dma_memory_region: c66-dma-memory@a6000000 {
+		c66_0_dma_memory_region: c66-dma-memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
@@ -135,7 +135,7 @@
 			no-map;
 		};
 
-		c66_0_dma_memory_region: c66-dma-memory@a7000000 {
+		c66_1_dma_memory_region: c66-dma-memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi
@@ -353,9 +353,9 @@
 
 		hbmc_mux: mux-controller@47000004 {
 			compatible = "reg-mux";
-			reg = <0x00 0x47000004 0x00 0x2>;
+			reg = <0x00 0x47000004 0x00 0x4>;
 			#mux-control-cells = <1>;
-			mux-reg-masks = <0x4 0x2>; /* HBMC select */
+			mux-reg-masks = <0x0 0x2>; /* HBMC select */
 		};
 
 		hbmc: hyperbus@47034000 {
@@ -648,7 +648,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 274 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 274 0>;
+		clocks = <&k3_clks 274 1>;
 		status = "disabled";
 	};
 
@@ -659,7 +659,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 275 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 275 0>;
+		clocks = <&k3_clks 275 1>;
 		status = "disabled";
 	};
 
@@ -670,7 +670,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 276 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 276 0>;
+		clocks = <&k3_clks 276 1>;
 		status = "disabled";
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
@@ -119,7 +119,7 @@
 			no-map;
 		};
 
-		c66_1_dma_memory_region: c66-dma-memory@a6000000 {
+		c66_0_dma_memory_region: c66-dma-memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
@@ -131,7 +131,7 @@
 			no-map;
 		};
 
-		c66_0_dma_memory_region: c66-dma-memory@a7000000 {
+		c66_1_dma_memory_region: c66-dma-memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
@@ -574,7 +574,7 @@
 		pinctrl-names = "default";
 		pinctrl-0 = <&pmic_irq_pins_default>;
 		interrupt-parent = <&wkup_gpio0>;
-		interrupts = <9 IRQ_TYPE_EDGE_FALLING>;
+		interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
 		gpio-controller;
 		#gpio-cells = <2>;
 		ti,primary-pmic;
@@ -651,7 +651,7 @@
 		reg = <0x4c>;
 		system-power-controller;
 		interrupt-parent = <&wkup_gpio0>;
-		interrupts = <9 IRQ_TYPE_EDGE_FALLING>;
+		interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
 		gpio-controller;
 		#gpio-cells = <2>;
 		buck1234-supply = <&vsys_3v3>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts
@@ -190,8 +190,6 @@
 &wkup_pmx2 {
 	wkup_uart0_pins_default: wkup-uart0-default-pins {
 		pinctrl-single,pins = <
-			J721S2_WKUP_IOPAD(0x070, PIN_INPUT, 0) /* (E25) WKUP_GPIO0_6.WKUP_UART0_CTSn */
-			J721S2_WKUP_IOPAD(0x074, PIN_OUTPUT, 0) /* (F28) WKUP_GPIO0_7.WKUP_UART0_RTSn */
 			J721S2_WKUP_IOPAD(0x048, PIN_INPUT, 0) /* (D28) WKUP_UART0_RXD */
 			J721S2_WKUP_IOPAD(0x04c, PIN_OUTPUT, 0) /* (D27) WKUP_UART0_TXD */
 		>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi
@@ -1591,7 +1591,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 339 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 339 1>;
+		clocks = <&k3_clks 339 2>;
 		status = "disabled";
 	};
 
@@ -1602,7 +1602,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 340 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 340 1>;
+		clocks = <&k3_clks 340 2>;
 		status = "disabled";
 	};
 
@@ -1613,7 +1613,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 341 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 341 1>;
+		clocks = <&k3_clks 341 2>;
 		status = "disabled";
 	};
 
@@ -1624,7 +1624,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 342 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 342 1>;
+		clocks = <&k3_clks 342 2>;
 		status = "disabled";
 	};
 
@@ -1635,7 +1635,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 343 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 343 1>;
+		clocks = <&k3_clks 343 2>;
 		status = "disabled";
 	};
 
@@ -1646,7 +1646,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 344 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 344 1>;
+		clocks = <&k3_clks 344 2>;
 		status = "disabled";
 	};
 
@@ -1657,7 +1657,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 345 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 345 1>;
+		clocks = <&k3_clks 345 2>;
 		status = "disabled";
 	};
 
@@ -1668,7 +1668,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 346 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 346 1>;
+		clocks = <&k3_clks 346 2>;
 		status = "disabled";
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi
@@ -423,7 +423,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 347 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 347 0>;
+		clocks = <&k3_clks 347 2>;
 		status = "disabled";
 	};
 
@@ -434,7 +434,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 348 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 348 0>;
+		clocks = <&k3_clks 348 2>;
 		status = "disabled";
 	};
 
@@ -445,7 +445,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		power-domains = <&k3_pds 349 TI_SCI_PD_EXCLUSIVE>;
-		clocks = <&k3_clks 349 0>;
+		clocks = <&k3_clks 349 2>;
 		status = "disabled";
 	};
 
@@ -663,7 +663,7 @@
 		compatible = "ti,j7200-vtm";
 		reg = <0x00 0x42040000 0x0 0x350>,
 		      <0x00 0x42050000 0x0 0x350>;
-		power-domains = <&k3_pds 154 TI_SCI_PD_SHARED>;
+		power-domains = <&k3_pds 180 TI_SCI_PD_SHARED>;
 		#thermal-sensor-cells = <1>;
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
@@ -335,8 +335,6 @@
 	wkup_uart0_pins_default: wkup-uart0-default-pins {
 		bootph-all;
 		pinctrl-single,pins = <
-			J721S2_WKUP_IOPAD(0x070, PIN_INPUT, 0) /* (L37) WKUP_GPIO0_6.WKUP_UART0_CTSn */
-			J721S2_WKUP_IOPAD(0x074, PIN_INPUT, 0) /* (L36) WKUP_GPIO0_7.WKUP_UART0_RTSn */
 			J721S2_WKUP_IOPAD(0x048, PIN_INPUT, 0) /* (K35) WKUP_UART0_RXD */
 			J721S2_WKUP_IOPAD(0x04c, PIN_INPUT, 0) /* (K34) WKUP_UART0_TXD */
 		>;
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi
@@ -52,12 +52,12 @@
 			compatible = "reg-mux";
 			reg = <0x00004080 0x30>;
 			#mux-control-cells = <1>;
-			mux-reg-masks = <0x4080 0x3>, <0x4084 0x3>, /* SERDES0 lane0/1 select */
-					<0x4088 0x3>, <0x408c 0x3>, /* SERDES0 lane2/3 select */
-					<0x4090 0x3>, <0x4094 0x3>, /* SERDES1 lane0/1 select */
-					<0x4098 0x3>, <0x409c 0x3>, /* SERDES1 lane2/3 select */
-					<0x40a0 0x3>, <0x40a4 0x3>, /* SERDES2 lane0/1 select */
-					<0x40a8 0x3>, <0x40ac 0x3>; /* SERDES2 lane2/3 select */
+			mux-reg-masks = <0x0 0x3>, <0x4 0x3>, /* SERDES0 lane0/1 select */
+					<0x8 0x3>, <0xc 0x3>, /* SERDES0 lane2/3 select */
+					<0x10 0x3>, <0x14 0x3>, /* SERDES1 lane0/1 select */
+					<0x18 0x3>, <0x1c 0x3>, /* SERDES1 lane2/3 select */
+					<0x20 0x3>, <0x24 0x3>, /* SERDES2 lane0/1 select */
+					<0x28 0x3>, <0x2c 0x3>; /* SERDES2 lane2/3 select */
 			idle-states = <J784S4_SERDES0_LANE0_PCIE1_LANE0>,
 				      <J784S4_SERDES0_LANE1_PCIE1_LANE1>,
 				      <J784S4_SERDES0_LANE2_IP3_UNUSED>,
--- linux-qcom-6.8.0.orig/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi
+++ linux-qcom-6.8.0/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi
@@ -628,7 +628,7 @@
 		compatible = "ti,j7200-vtm";
 		reg = <0x00 0x42040000 0x00 0x350>,
 		      <0x00 0x42050000 0x00 0x350>;
-		power-domains = <&k3_pds 154 TI_SCI_PD_SHARED>;
+		power-domains = <&k3_pds 243 TI_SCI_PD_SHARED>;
 		#thermal-sensor-cells = <1>;
 	};
 
--- linux-qcom-6.8.0.orig/arch/arm64/configs/defconfig
+++ linux-qcom-6.8.0/arch/arm64/configs/defconfig
@@ -253,6 +253,7 @@
 CONFIG_MTK_ADSP_IPC=m
 CONFIG_EFI_CAPSULE_LOADER=y
 CONFIG_IMX_SCU=y
+CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE=y
 CONFIG_QCOM_QSEECOM=y
 CONFIG_QCOM_QSEECOM_UEFISECAPP=y
 CONFIG_GNSS=m
@@ -588,6 +589,7 @@
 CONFIG_PINCTRL_MSM8998=y
 CONFIG_PINCTRL_QCM2290=y
 CONFIG_PINCTRL_QCS404=y
+CONFIG_PINCTRL_QCS615=y
 CONFIG_PINCTRL_QDF2XXX=y
 CONFIG_PINCTRL_QDU1000=y
 CONFIG_PINCTRL_SA8775P=y
@@ -632,6 +634,7 @@
 CONFIG_GPIO_UNIPHIER=y
 CONFIG_GPIO_VISCONTI=y
 CONFIG_GPIO_WCD934X=m
+CONFIG_GPIO_VF610=y
 CONFIG_GPIO_XGENE=y
 CONFIG_GPIO_XGENE_SB=y
 CONFIG_GPIO_MAX732X=y
@@ -857,6 +860,7 @@
 CONFIG_DRM_PANEL_EDP=m
 CONFIG_DRM_PANEL_ILITEK_ILI9882T=m
 CONFIG_DRM_PANEL_MANTIX_MLAF057WE51=m
+CONFIG_DRM_PANEL_NOVATEK_NT36672E=m
 CONFIG_DRM_PANEL_RAYDIUM_RM67191=m
 CONFIG_DRM_PANEL_SITRONIX_ST7703=m
 CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA=m
@@ -1264,8 +1268,15 @@
 CONFIG_MSM_MMCC_8998=m
 CONFIG_QCM_GCC_2290=y
 CONFIG_QCM_DISPCC_2290=m
+CONFIG_QCS_DISPCC_615=m
+CONFIG_QCS_CAMCC_615=m
 CONFIG_QCS_GCC_404=y
+CONFIG_QCS_GCC_615=y
+CONFIG_SC_CAMCC_7280=m
+CONFIG_QDU_GCC_1000=y
 CONFIG_SC_CAMCC_8280XP=m
+CONFIG_QCS_GPUCC_615=m
+CONFIG_QCS_VIDEOCC_615=m
 CONFIG_SC_DISPCC_8280XP=m
 CONFIG_SA_GCC_8775P=y
 CONFIG_SA_GPUCC_8775P=m
@@ -1275,6 +1286,8 @@
 CONFIG_SC_GCC_8280XP=y
 CONFIG_SC_GPUCC_8280XP=m
 CONFIG_SC_LPASSCC_8280XP=m
+CONFIG_SC_LPASS_CORECC_7280=m
+CONFIG_SC_VIDEOCC_7280=m
 CONFIG_SDM_CAMCC_845=m
 CONFIG_SDM_GPUCC_845=y
 CONFIG_SDM_VIDEOCC_845=y
@@ -1552,6 +1565,8 @@
 CONFIG_INTERCONNECT_QCOM_OSM_L3=m
 CONFIG_INTERCONNECT_QCOM_QCM2290=m
 CONFIG_INTERCONNECT_QCOM_QCS404=m
+CONFIG_INTERCONNECT_QCOM_QCS615=y
+CONFIG_INTERCONNECT_QCOM_QDU1000=y
 CONFIG_INTERCONNECT_QCOM_SA8775P=y
 CONFIG_INTERCONNECT_QCOM_SC7180=y
 CONFIG_INTERCONNECT_QCOM_SC7280=y
@@ -1559,6 +1574,7 @@
 CONFIG_INTERCONNECT_QCOM_SC8280XP=y
 CONFIG_INTERCONNECT_QCOM_SDM845=y
 CONFIG_INTERCONNECT_QCOM_SDX75=y
+CONFIG_INTERCONNECT_QCOM_SM6115=y
 CONFIG_INTERCONNECT_QCOM_SM8150=m
 CONFIG_INTERCONNECT_QCOM_SM8250=m
 CONFIG_INTERCONNECT_QCOM_SM8350=m
--- linux-qcom-6.8.0.orig/arch/arm64/configs/qcom_addons.config
+++ linux-qcom-6.8.0/arch/arm64/configs/qcom_addons.config
@@ -0,0 +1,54 @@
+CONFIG_BACKLIGHT_QCOM_WLED=y
+CONFIG_CAN_GS_USB=m
+CONFIG_CORESIGHT_REMOTE_ETM=m
+CONFIG_CORESIGHT_TGU=m
+CONFIG_GH_VIRT_WATCHDOG=y
+CONFIG_GUNYAH=y
+CONFIG_GUNYAH_DRIVERS=y
+CONFIG_GUNYAH_IOEVENTFD=y
+CONFIG_GUNYAH_IRQFD=y
+CONFIG_GUNYAH_PLATFORM_HOOKS=y
+CONFIG_GUNYAH_QCOM_PLATFORM=y
+CONFIG_GUNYAH_VCPU=y
+CONFIG_MFD_I2C_PMIC=y
+CONFIG_MSM_RDBG=m
+CONFIG_PANIC_TIMEOUT=-1
+CONFIG_PINCTRL_QCS8300_LPASS_LPI=m
+CONFIG_PINCTRL_SA8775P_LPASS_LPI=m
+CONFIG_QCOM_DCC=y
+CONFIG_QCOM_DMABUF_HEAPS=y
+CONFIG_QCOM_DMABUF_HEAPS_CMA=y
+CONFIG_QCOM_DMABUF_HEAPS_SYSTEM=y
+CONFIG_QCOM_DMABUF_HEAPS_SYSTEM_SECURE=y
+# CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC=y
+CONFIG_QCOM_MEMORY_DUMP_V2=y
+CONFIG_QCOM_MEM_BUF=y
+CONFIG_QCOM_MEM_BUF_DEV=y
+CONFIG_QCOM_PANEL_EVENT_NOTIFIER=m
+CONFIG_QCOM_PMIC_PDCHARGER_ULOG=y
+CONFIG_QCOM_QMI_COOLING=m
+CONFIG_QCOM_QPS615_PCIE_SWITCH=y
+CONFIG_QCOM_SCM_ADDON=y
+CONFIG_QCOM_SECURE_BUFFER=y
+CONFIG_QCOM_SMCINVOKE=m
+CONFIG_QCOM_SMP2P_SLEEPSTATE=y
+CONFIG_QCOM_SOC_DEBUG=y
+CONFIG_QCOM_SPMI_ADC5_GEN3=m
+CONFIG_QCOM_SPMI_MBG_TM=m
+CONFIG_QCOM_WDT=y
+CONFIG_QCOM_WDT_CORE=y
+CONFIG_QTEE_SHM_BRIDGE=y
+CONFIG_QTI_BCL_PMIC5=y
+CONFIG_QTI_DEVFREQ_CDEV=m
+CONFIG_QTI_TZ_LOG=m
+CONFIG_REGULATOR_DEBUG_CONTROL=y
+CONFIG_REGULATOR_PROXY_CONSUMER=y
+CONFIG_REGULATOR_QCOM_PM8008=y
+CONFIG_REGULATOR_QPNP_LCDB=y
+CONFIG_SND_SOC_MSM_STUB=y
+CONFIG_STM_PROTO_OST=m
+CONFIG_USB_F_QDSS=m
+CONFIG_USB_HUB_USB5807=m
+CONFIG_VIRT_DRIVERS=y
+CONFIG_SENSORS_EMC2305=y
+CONFIG_SND_SOC_QCS9100=m
--- linux-qcom-6.8.0.orig/arch/arm64/configs/qcom_debug.config
+++ linux-qcom-6.8.0/arch/arm64/configs/qcom_debug.config
@@ -0,0 +1,26 @@
+CONFIG_CMA_DEBUGFS=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
+CONFIG_CORESIGHT_SOURCE_ETM4X=m
+CONFIG_DMABUF_SYSFS_STATS=y
+CONFIG_DYNAMIC_DEBUG=y
+# CONFIG_FW_LOADER_DEBUG is not set
+CONFIG_PAGE_POISONING=y
+CONFIG_PID_IN_CONTEXTIDR=y
+# CONFIG_TEST_DYNAMIC_DEBUG is not set
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
+CONFIG_BUG_ON_DATA_CORRUPTION=y
+CONFIG_CMA_DEBUG=y
+CONFIG_DEBUG_LIST=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_LOCALVERSION="-debug"
+CONFIG_ATH11K_COREDUMP=y
+CONFIG_ATH11K_DEBUG=y
+CONFIG_ATH11K_DEBUGFS=y
+CONFIG_ATH11K_TRACING=y
+CONFIG_MAC80211_DEBUGFS=y
--- linux-qcom-6.8.0.orig/arch/arm64/configs/qcom_defconfig
+++ linux-qcom-6.8.0/arch/arm64/configs/qcom_defconfig
@@ -0,0 +1,872 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOCALVERSION="-perf"
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_UCLAMP_TASK=y
+CONFIG_NUMA_BALANCING=y
+CONFIG_CGROUP_FAVOR_DYNMODS=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_UCLAMP_TASK_GROUP=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BOOT_CONFIG=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_ARCH_QCOM=y
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_SMT=y
+CONFIG_NUMA=y
+CONFIG_XEN=y
+CONFIG_ARM64_SW_TTBR0_PAN=y
+CONFIG_COMPAT=y
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_HIBERNATION=y
+CONFIG_PM_AUTOSLEEP=y
+CONFIG_PM_WAKELOCKS=y
+CONFIG_PM_WAKELOCKS_LIMIT=0
+CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
+CONFIG_ENERGY_MODEL=y
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_ACPI_CPPC_CPUFREQ=m
+CONFIG_ARM_SCPI_CPUFREQ=y
+CONFIG_ARM_QCOM_CPUFREQ_NVMEM=y
+CONFIG_ARM_QCOM_CPUFREQ_HW=y
+CONFIG_ARM_SCMI_CPUFREQ=y
+CONFIG_ACPI=y
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=y
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_BLK_INLINE_ENCRYPTION=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_SLAB_FREELIST_RANDOM=y
+CONFIG_SLAB_FREELIST_HARDENED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTREMOVE=y
+CONFIG_KSM=y
+CONFIG_MEMORY_FAILURE=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CMA=y
+CONFIG_CMA_DEBUG=y
+CONFIG_CMA_SYSFS=y
+CONFIG_CMA_AREAS=32
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IPV6=m
+CONFIG_NETFILTER=y
+CONFIG_BRIDGE_NETFILTER=m
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NETFILTER_XT_MARK=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_IP_VS=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_NET_DSA=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBS=m
+CONFIG_NET_SCH_ETF=m
+CONFIG_NET_SCH_TAPRIO=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_FLOWER=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_NET_CLS_BPF=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_NET_CLS_MATCHALL=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_GATE=m
+CONFIG_VSOCKETS=y
+CONFIG_QRTR_SMD=m
+CONFIG_QRTR_TUN=m
+CONFIG_CAN=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+# CONFIG_BT_LE is not set
+CONFIG_BT_LEDS=y
+# CONFIG_BT_DEBUGFS is not set
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_LL=y
+CONFIG_BT_HCIUART_QCA=y
+CONFIG_BT_QCOMSMD=m
+CONFIG_CFG80211=m
+CONFIG_NL80211_TESTMODE=y
+CONFIG_CFG80211_CERTIFICATION_ONUS=y
+CONFIG_MAC80211=m
+CONFIG_MAC80211_LEDS=y
+CONFIG_RFKILL=m
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_NFC=m
+CONFIG_NFC_NCI=m
+CONFIG_NFC_S3FWRN5_I2C=m
+CONFIG_PAGE_POOL_STATS=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIEAER=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_PASID=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_ACPI=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_DW_PLAT_HOST=y
+CONFIG_PCIE_QCOM=y
+CONFIG_PCI_ENDPOINT=y
+CONFIG_PCI_ENDPOINT_CONFIGFS=y
+CONFIG_PCI_EPF_TEST=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_MHI_BUS_PCI_GENERIC=m
+CONFIG_MHI_BUS_EP=y
+CONFIG_ARM_SCMI_PROTOCOL=y
+CONFIG_ARM_SCPI_PROTOCOL=y
+# CONFIG_EFI_DISABLE_RUNTIME is not set
+CONFIG_GNSS=m
+CONFIG_ZRAM=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=m
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=m
+CONFIG_QCOM_COINCELL=m
+CONFIG_QCOM_FASTRPC=m
+CONFIG_SRAM=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_BSG=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_HISI_SAS=y
+CONFIG_SCSI_HISI_SAS_PCI=y
+CONFIG_MEGARAID_SAS=y
+CONFIG_SCSI_MPT3SAS=m
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_CEVA=y
+CONFIG_SATA_SIL24=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_MD=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_ZERO=m
+CONFIG_NETDEVICES=y
+CONFIG_MACVLAN=y
+CONFIG_MACVTAP=y
+CONFIG_TUN=y
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=y
+CONFIG_MHI_NET=m
+CONFIG_ATL1C=m
+CONFIG_QCOM_EMAC=m
+CONFIG_RMNET=m
+CONFIG_QCOM_IPA=m
+CONFIG_AT803X_PHY=m
+CONFIG_REALTEK_PHY=m
+CONFIG_CAN_MCP251XFD=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_MDIO_GPIO=m
+CONFIG_MDIO_BUS_MUX_MULTIPLEXER=m
+CONFIG_MDIO_BUS_MUX_MMIOREG=m
+CONFIG_USB_USBNET=m
+CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS=y
+CONFIG_ATH10K=m
+CONFIG_ATH10K_PCI=m
+CONFIG_ATH10K_SDIO=m
+CONFIG_ATH10K_SNOC=m
+CONFIG_WCN36XX=m
+CONFIG_ATH11K=m
+CONFIG_ATH11K_AHB=m
+CONFIG_ATH11K_PCI=m
+CONFIG_WWAN=m
+CONFIG_MHI_WWAN_CTRL=m
+CONFIG_MHI_WWAN_MBIM=m
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_UINPUT=y
+CONFIG_KEYBOARD_ADC=m
+CONFIG_KEYBOARD_GPIO=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_PM8941_PWRKEY=y
+CONFIG_INPUT_PM8XXX_VIBRATOR=y
+CONFIG_INPUT_PWM_BEEPER=m
+CONFIG_INPUT_PWM_VIBRA=m
+# CONFIG_SERIO_SERPORT is not set
+CONFIG_SERIO_AMBAKMI=y
+CONFIG_LEGACY_PTY_COUNT=16
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_MSM=y
+CONFIG_SERIAL_MSM_CONSOLE=y
+CONFIG_SERIAL_QCOM_GENI=y
+CONFIG_SERIAL_QCOM_GENI_CONSOLE=y
+CONFIG_NULL_TTY=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_IPMI_HANDLER=m
+CONFIG_IPMI_DEVICE_INTERFACE=m
+CONFIG_IPMI_SI=m
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_VIRTIO=y
+# CONFIG_DEVMEM is not set
+CONFIG_TCG_TPM=y
+CONFIG_TCG_TIS=m
+CONFIG_TCG_TIS_SPI=m
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_QCOM_CCI=m
+CONFIG_I2C_QCOM_GENI=m
+CONFIG_I2C_QUP=y
+CONFIG_I2C_SLAVE=y
+CONFIG_I3C=y
+CONFIG_SPI=y
+CONFIG_SPI_PL022=y
+CONFIG_SPI_QCOM_QSPI=m
+CONFIG_SPI_QUP=y
+CONFIG_SPI_QCOM_GENI=m
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPMI=y
+CONFIG_PINCTRL_SINGLE=y
+CONFIG_PINCTRL_MSM=y
+CONFIG_PINCTRL_IPQ5332=y
+CONFIG_PINCTRL_IPQ8074=y
+CONFIG_PINCTRL_IPQ6018=y
+CONFIG_PINCTRL_IPQ9574=y
+CONFIG_PINCTRL_MSM8916=y
+CONFIG_PINCTRL_MSM8953=y
+CONFIG_PINCTRL_MSM8976=y
+CONFIG_PINCTRL_MSM8994=y
+CONFIG_PINCTRL_MSM8996=y
+CONFIG_PINCTRL_MSM8998=y
+CONFIG_PINCTRL_QCM2290=y
+CONFIG_PINCTRL_QCS404=y
+CONFIG_PINCTRL_QCS615=y
+CONFIG_PINCTRL_QCS8300=y
+CONFIG_PINCTRL_QDF2XXX=y
+CONFIG_PINCTRL_QDU1000=y
+CONFIG_PINCTRL_SA8775P=y
+CONFIG_PINCTRL_SC7180=y
+CONFIG_PINCTRL_SC7280=y
+CONFIG_PINCTRL_SC8180X=y
+CONFIG_PINCTRL_SC8280XP=y
+CONFIG_PINCTRL_SDM660=y
+CONFIG_PINCTRL_SDM670=y
+CONFIG_PINCTRL_SDM845=y
+CONFIG_PINCTRL_SM6115=y
+CONFIG_PINCTRL_SM6125=y
+CONFIG_PINCTRL_SM6350=y
+CONFIG_PINCTRL_SM6375=y
+CONFIG_PINCTRL_SM8150=y
+CONFIG_PINCTRL_SM8250=y
+CONFIG_PINCTRL_SM8350=y
+CONFIG_PINCTRL_SM8450=y
+CONFIG_PINCTRL_SM8550=y
+CONFIG_PINCTRL_SM8650=y
+CONFIG_PINCTRL_X1E80100=y
+CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+CONFIG_PINCTRL_LPASS_LPI=m
+CONFIG_PINCTRL_SC7280_LPASS_LPI=m
+CONFIG_PINCTRL_SM8250_LPASS_LPI=m
+CONFIG_PINCTRL_SM8450_LPASS_LPI=m
+CONFIG_PINCTRL_SC8280XP_LPASS_LPI=m
+CONFIG_PINCTRL_SM8550_LPASS_LPI=m
+CONFIG_GPIO_PCA953X=y
+CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_GPIO_PL061=y
+CONFIG_GPIO_WCD934X=m
+CONFIG_POWER_RESET_MSM=y
+CONFIG_POWER_RESET_QCOM_PON=m
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_SYSCON_REBOOT_MODE=y
+CONFIG_BATTERY_QCOM_BATTMGR=m
+CONFIG_SENSORS_ARM_SCMI=y
+CONFIG_SENSORS_ARM_SCPI=y
+CONFIG_SENSORS_GPIO_FAN=m
+CONFIG_SENSORS_PWM_FAN=m
+CONFIG_THERMAL_NETLINK=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=10000
+CONFIG_THERMAL_WRITABLE_TRIPS=y
+CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CPU_IDLE_THERMAL=y
+CONFIG_DEVFREQ_THERMAL=y
+CONFIG_THERMAL_EMULATION=y
+CONFIG_GENERIC_ADC_THERMAL=m
+CONFIG_QCOM_TSENS=y
+CONFIG_QCOM_SPMI_ADC_TM5=m
+CONFIG_QCOM_SPMI_TEMP_ALARM=y
+CONFIG_QCOM_LMH=m
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_SYSFS=y
+CONFIG_WATCHDOG_PRETIMEOUT_GOV=y
+CONFIG_WATCHDOG_PRETIMEOUT_DEFAULT_GOV_NOOP=y
+CONFIG_ARM_SBSA_WATCHDOG=y
+CONFIG_MFD_SPMI_PMIC=y
+CONFIG_MFD_WCD934X=m
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_REGULATOR_PWM=y
+CONFIG_REGULATOR_QCOM_REFGEN=y
+CONFIG_REGULATOR_QCOM_RPMH=y
+CONFIG_REGULATOR_QCOM_SMD_RPM=y
+CONFIG_REGULATOR_QCOM_SPMI=y
+CONFIG_REGULATOR_VCTRL=m
+CONFIG_RC_CORE=m
+CONFIG_RC_DECODERS=y
+CONFIG_RC_DEVICES=y
+CONFIG_MEDIA_CEC_SUPPORT=y
+CONFIG_CEC_GPIO=m
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_SDR_SUPPORT=y
+CONFIG_MEDIA_PLATFORM_SUPPORT=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_SDR_PLATFORM_DRIVERS=y
+CONFIG_V4L_MEM2MEM_DRIVERS=y
+CONFIG_VIDEO_IMX412=m
+CONFIG_VIDEO_QCOM_CAMSS=m
+CONFIG_VIDEO_QCOM_VENUS=m
+CONFIG_VIDEO_QCOM_IRIS=m
+CONFIG_DRM=m
+CONFIG_DRM_LONTIUM_LT9611UXC=m
+CONFIG_DRM_ANALOGIX_ANX7625=m
+CONFIG_DRM_LONTIUM_LT9611UXC=m
+# CONFIG_DRM_FBDEV_EMULATION is not set
+CONFIG_DRM_HDLCD=m
+CONFIG_DRM_MSM=m
+# CONFIG_DRM_MSM_MDP4 is not set
+# CONFIG_DRM_MSM_MDP5 is not set
+# CONFIG_DRM_MSM_HDMI is not set
+CONFIG_DRM_PANEL_LVDS=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_EDP=m
+CONFIG_DRM_PANEL_NOVATEK_NT36672E=m
+CONFIG_DRM_DISPLAY_CONNECTOR=m
+CONFIG_FB=y
+CONFIG_FB_EFI=y
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BACKLIGHT_PWM=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_ALOOP=m
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_AUDIO_MIDI_V2=y
+CONFIG_SND_SOC=y
+CONFIG_SND_SOC_QCOM=y
+CONFIG_SND_SOC_APQ8016_SBC=m
+CONFIG_SND_SOC_QDSP6=y
+CONFIG_SND_SOC_MSM8996=m
+CONFIG_SND_SOC_SDM845=m
+CONFIG_SND_SOC_SM8250=m
+CONFIG_SND_SOC_SC7180=m
+CONFIG_SND_SOC_SC7280=m
+CONFIG_SND_SOC_QCM6490=m
+CONFIG_SND_SOC_MSM8916_WCD_ANALOG=m
+CONFIG_SND_SOC_MSM8916_WCD_DIGITAL=m
+CONFIG_SND_SOC_WCD9335=m
+CONFIG_SND_SOC_WCD934X=m
+CONFIG_SND_SOC_WCD937X_SDW=y
+CONFIG_SND_SOC_WSA881X=m
+CONFIG_SND_SOC_WSA883X=y
+CONFIG_SND_SOC_LPASS_VA_MACRO=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_SND_AUDIO_GRAPH_CARD=m
+CONFIG_SND_AUDIO_GRAPH_CARD2=m
+CONFIG_UHID=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_USB_HID=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_I2C_HID_ACPI=m
+CONFIG_I2C_HID_OF=m
+CONFIG_USB_CONN_GPIO=y
+CONFIG_USB=y
+CONFIG_USB_OTG=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PCI_RENESAS=m
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_ACM=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_UAS=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC2=y
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_QCOM_EUD=m
+CONFIG_USB_ONBOARD_HUB=m
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_USB_ULPI=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_CONFIGFS=y
+CONFIG_USB_CONFIGFS_SERIAL=y
+CONFIG_USB_CONFIGFS_ACM=y
+CONFIG_USB_CONFIGFS_OBEX=y
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_ECM=y
+CONFIG_USB_CONFIGFS_ECM_SUBSET=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+CONFIG_USB_CONFIGFS_EEM=y
+CONFIG_USB_CONFIGFS_MASS_STORAGE=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_USB_CONFIGFS_F_UAC2=y
+CONFIG_USB_CONFIGFS_F_UVC=y
+CONFIG_TYPEC=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_UCSI=m
+CONFIG_UCSI_PMIC_GLINK=m
+CONFIG_TYPEC_MUX_FSA4480=m
+CONFIG_TYPEC_MUX_GPIO_SBU=m
+CONFIG_TYPEC_MUX_NB7VPQ904M=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_CRYPTO=y
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ACPI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_MSM=y
+CONFIG_MMC_SPI=y
+CONFIG_SCSI_UFSHCD=y
+CONFIG_SCSI_UFS_BSG=y
+CONFIG_SCSI_UFS_CRYPTO=y
+CONFIG_SCSI_UFSHCD_PLATFORM=y
+CONFIG_SCSI_UFS_QCOM=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_CLASS_FLASH=m
+CONFIG_LEDS_CLASS_MULTICOLOR=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_SYSCON=y
+CONFIG_LEDS_QCOM_FLASH=m
+CONFIG_LEDS_QCOM_LPG=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_DISK=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_LEDS_TRIGGER_PATTERN=y
+CONFIG_EDAC=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_PL031=y
+CONFIG_RTC_DRV_PM8XXX=m
+CONFIG_DMADEVICES=y
+CONFIG_PL330_DMA=y
+CONFIG_QCOM_BAM_DMA=y
+CONFIG_QCOM_GPI_DMA=m
+CONFIG_QCOM_HIDMA_MGMT=y
+CONFIG_QCOM_HIDMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_UIO=y
+CONFIG_VFIO=y
+CONFIG_VFIO_PCI=y
+CONFIG_VFIO_PLATFORM=m
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_XEN_GNTDEV=y
+CONFIG_XEN_GRANT_DEV_ALLOC=y
+CONFIG_VHOST_NET=y
+CONFIG_VHOST_VSOCK=y
+CONFIG_STAGING=y
+CONFIG_STAGING_MEDIA=y
+CONFIG_COMMON_CLK_SCMI=y
+CONFIG_COMMON_CLK_SCPI=y
+CONFIG_COMMON_CLK_PWM=y
+CONFIG_COMMON_CLK_QCOM=y
+CONFIG_CLK_X1E80100_GCC=y
+CONFIG_QCOM_A53PLL=y
+CONFIG_QCOM_CLK_APCS_MSM8916=y
+CONFIG_QCOM_CLK_APCC_MSM8996=y
+CONFIG_QCOM_CLK_SMD_RPM=y
+CONFIG_QCOM_CLK_RPMH=y
+CONFIG_IPQ_APSS_6018=y
+CONFIG_IPQ_GCC_5332=y
+CONFIG_IPQ_GCC_6018=y
+CONFIG_IPQ_GCC_8074=y
+CONFIG_IPQ_GCC_9574=y
+CONFIG_MSM_GCC_8916=y
+CONFIG_MSM_MMCC_8994=m
+CONFIG_MSM_GCC_8994=y
+CONFIG_MSM_MMCC_8996=m
+CONFIG_MSM_GCC_8998=y
+CONFIG_MSM_MMCC_8998=m
+CONFIG_QCM_GCC_2290=y
+CONFIG_QCM_DISPCC_2290=m
+CONFIG_QCS_DISPCC_615=m
+CONFIG_QCS_CAMCC_615=m
+CONFIG_QCS_GCC_404=y
+CONFIG_QCS_GCC_615=y
+CONFIG_QCS_GPUCC_615=m
+CONFIG_QCS_VIDEOCC_615=m
+CONFIG_QCS_GCC_8300=y
+CONFIG_SC_CAMCC_7280=y
+CONFIG_SC_DISPCC_7280=y
+CONFIG_SC_DISPCC_8280XP=m
+CONFIG_SA_GCC_8775P=y
+CONFIG_SA_CAMCC_8775P=m
+CONFIG_SA_DISPCC_8775P=m
+CONFIG_SA_VIDEOCC_8775P=m
+CONFIG_SA_GPUCC_8775P=y
+CONFIG_SC_GCC_7180=y
+CONFIG_SC_GCC_8180X=y
+CONFIG_SC_GCC_8280XP=y
+CONFIG_SC_GPUCC_7280=y
+CONFIG_SC_LPASSCC_8280XP=m
+CONFIG_SC_LPASS_CORECC_7280=y
+CONFIG_SC_VIDEOCC_7280=y
+CONFIG_SDM_CAMCC_845=m
+CONFIG_SDM_GPUCC_845=y
+CONFIG_SDM_VIDEOCC_845=y
+CONFIG_SDM_DISPCC_845=y
+CONFIG_SDM_LPASSCC_845=m
+CONFIG_SM_CAMCC_8250=m
+CONFIG_SM_CAMCC_8550=m
+CONFIG_SM_DISPCC_6115=m
+CONFIG_SM_DISPCC_8250=y
+CONFIG_SM_DISPCC_8450=m
+CONFIG_SM_DISPCC_8550=m
+CONFIG_SM_DISPCC_8650=y
+CONFIG_SM_GCC_6115=y
+CONFIG_SM_GCC_8350=y
+CONFIG_SM_GCC_8450=y
+CONFIG_SM_GCC_8650=y
+CONFIG_SM_GPUCC_6115=m
+CONFIG_SM_GPUCC_8150=y
+CONFIG_SM_GPUCC_8250=y
+CONFIG_SM_GPUCC_8550=y
+CONFIG_SM_GPUCC_8650=y
+CONFIG_SM_TCSRCC_8550=y
+CONFIG_SM_TCSRCC_8650=y
+CONFIG_SM_VIDEOCC_8250=y
+CONFIG_SM_VIDEOCC_8550=y
+CONFIG_QCOM_HFPLL=y
+CONFIG_CLK_GFM_LPASS_SM8250=m
+CONFIG_HWSPINLOCK=y
+CONFIG_HWSPINLOCK_QCOM=y
+CONFIG_ARM_MHU=y
+CONFIG_PLATFORM_MHU=y
+CONFIG_QCOM_APCS_IPC=y
+CONFIG_QCOM_IPCC=y
+CONFIG_IOMMU_IO_PGTABLE_ARMV7S=y
+CONFIG_IOMMU_IO_PGTABLE_DART=y
+CONFIG_ARM_SMMU=y
+CONFIG_ARM_SMMU_QCOM_TBU=y
+CONFIG_ARM_SMMU_V3=y
+CONFIG_QCOM_IOMMU=y
+CONFIG_REMOTEPROC=y
+CONFIG_QCOM_Q6V5_ADSP=m
+CONFIG_QCOM_Q6V5_MSS=m
+CONFIG_QCOM_Q6V5_PAS=m
+CONFIG_QCOM_SYSMON=m
+CONFIG_QCOM_WCNSS_PIL=m
+CONFIG_RPMSG_CHAR=m
+CONFIG_RPMSG_CTRL=m
+CONFIG_RPMSG_QCOM_GLINK_RPM=y
+CONFIG_RPMSG_QCOM_GLINK_SMEM=m
+CONFIG_RPMSG_QCOM_SMD=y
+CONFIG_SOUNDWIRE=y
+CONFIG_SOUNDWIRE_QCOM=y
+CONFIG_SOC_BRCMSTB=y
+CONFIG_FSL_RCPM=y
+CONFIG_QCOM_AOSS_QMP=y
+CONFIG_QCOM_COMMAND_DB=y
+CONFIG_QCOM_CPR=y
+CONFIG_QCOM_GENI_SE=y
+CONFIG_QCOM_LLCC=m
+CONFIG_QCOM_OCMEM=m
+CONFIG_QCOM_PMIC_GLINK=m
+CONFIG_QCOM_RMTFS_MEM=m
+CONFIG_QCOM_RPMH=y
+CONFIG_QCOM_RPMHPD=y
+CONFIG_QCOM_RPMPD=y
+CONFIG_QCOM_SMEM=y
+CONFIG_QCOM_SMD_RPM=y
+CONFIG_QCOM_SMP2P=y
+CONFIG_QCOM_SMSM=y
+CONFIG_QCOM_SOCINFO=m
+CONFIG_QCOM_SPM=m
+CONFIG_QCOM_STATS=m
+CONFIG_QCOM_WCNSS_CTRL=m
+CONFIG_QCOM_APR=y
+CONFIG_QCOM_ICC_BWMON=m
+CONFIG_DEVFREQ_GOV_USERSPACE=y
+CONFIG_DEVFREQ_GOV_PASSIVE=m
+CONFIG_EXTCON_USB_GPIO=y
+CONFIG_MEMORY=y
+CONFIG_IIO=y
+CONFIG_QCOM_SPMI_VADC=m
+CONFIG_QCOM_SPMI_ADC5=y
+CONFIG_PWM=y
+CONFIG_QCOM_PDC=y
+CONFIG_QCOM_MPM=y
+CONFIG_RESET_QCOM_AOSS=y
+CONFIG_RESET_QCOM_PDC=m
+CONFIG_PHY_CAN_TRANSCEIVER=m
+CONFIG_PHY_QCOM_EDP=m
+CONFIG_PHY_QCOM_PCIE2=m
+CONFIG_PHY_QCOM_QMP=y
+CONFIG_PHY_QCOM_QUSB2=m
+CONFIG_PHY_QCOM_SNPS_EUSB2=m
+CONFIG_PHY_QCOM_EUSB2_REPEATER=m
+CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2=y
+CONFIG_PHY_QCOM_USB_HS_28NM=m
+CONFIG_PHY_QCOM_USB_SS=m
+CONFIG_POWERCAP=y
+CONFIG_IDLE_INJECT=y
+CONFIG_ARM_CCI_PMU=m
+CONFIG_ARM_CCN=m
+CONFIG_ARM_CMN=m
+CONFIG_ARM_SMMU_V3_PMU=m
+CONFIG_ARM_DSU_PMU=m
+CONFIG_QCOM_L2_PMU=y
+CONFIG_QCOM_L3_PMU=y
+CONFIG_ARM_SPE_PMU=m
+CONFIG_ARM_DMC620_PMU=m
+CONFIG_HISI_PMU=y
+CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU=m
+CONFIG_NVMEM_QCOM_QFPROM=y
+CONFIG_NVMEM_RMEM=m
+CONFIG_NVMEM_SPMI_SDAM=m
+CONFIG_STM_SOURCE_CONSOLE=m
+CONFIG_STM_SOURCE_HEARTBEAT=m
+CONFIG_STM_SOURCE_FTRACE=m
+CONFIG_FPGA=y
+CONFIG_FPGA_MGR_ALTERA_CVP=m
+CONFIG_FPGA_BRIDGE=m
+CONFIG_ALTERA_FREEZE_BRIDGE=m
+CONFIG_FPGA_REGION=m
+CONFIG_OF_FPGA_REGION=m
+CONFIG_TEE=y
+CONFIG_OPTEE=y
+CONFIG_MUX_MMIO=m
+CONFIG_SLIMBUS=m
+CONFIG_SLIM_QCOM_CTRL=m
+CONFIG_SLIM_QCOM_NGD_CTRL=m
+CONFIG_INTERCONNECT=y
+CONFIG_INTERCONNECT_QCOM=y
+CONFIG_INTERCONNECT_QCOM_MSM8916=m
+CONFIG_INTERCONNECT_QCOM_MSM8996=m
+CONFIG_INTERCONNECT_QCOM_OSM_L3=m
+CONFIG_INTERCONNECT_QCOM_QCM2290=m
+CONFIG_INTERCONNECT_QCOM_QCS404=m
+CONFIG_INTERCONNECT_QCOM_QCS615=y
+CONFIG_INTERCONNECT_QCOM_QCS8300=y
+CONFIG_INTERCONNECT_QCOM_SA8775P=y
+CONFIG_INTERCONNECT_QCOM_SC7180=y
+CONFIG_INTERCONNECT_QCOM_SC7280=y
+CONFIG_INTERCONNECT_QCOM_SC8180X=y
+CONFIG_INTERCONNECT_QCOM_SC8280XP=y
+CONFIG_INTERCONNECT_QCOM_SDM845=y
+CONFIG_INTERCONNECT_QCOM_SM8150=m
+CONFIG_INTERCONNECT_QCOM_SM8250=m
+CONFIG_INTERCONNECT_QCOM_SM8350=m
+CONFIG_INTERCONNECT_QCOM_SM8450=y
+CONFIG_INTERCONNECT_QCOM_SM8550=y
+CONFIG_INTERCONNECT_QCOM_SM8650=y
+CONFIG_INTERCONNECT_QCOM_X1E80100=y
+CONFIG_COUNTER=m
+CONFIG_HTE=y
+# CONFIG_EXT2_FS is not set
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_EXT4_USE_FOR_EXT2=y
+CONFIG_FS_ENCRYPTION=y
+CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_AUTOFS_FS=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_HUGETLBFS=y
+CONFIG_EFIVAR_FS=y
+CONFIG_SQUASHFS=y
+CONFIG_EFI_PARTITION=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_V4_1=y
+CONFIG_NFS_V4_2=y
+CONFIG_ROOT_NFS=y
+CONFIG_9P_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
+CONFIG_FORTIFY_SOURCE=y
+CONFIG_SECURITY_SELINUX=y
+CONFIG_CRYPTO_USER=y
+CONFIG_CRYPTO_DES=m
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_LZ4=y
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
+CONFIG_CRYPTO_USER_API_RNG=m
+CONFIG_CRYPTO_USER_API_AEAD=y
+CONFIG_CRYPTO_CHACHA20_NEON=m
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512_ARM64_CE=m
+CONFIG_CRYPTO_SHA3_ARM64=m
+CONFIG_CRYPTO_SM3_ARM64_CE=m
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_BS=m
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_DEV_QCE=m
+CONFIG_CRYPTO_DEV_QCOM_RNG=m
+CONFIG_CRYPTO_DEV_CCREE=m
+# CONFIG_HW_RANDOM_ARM_SMCCC_TRNG is not set
+CONFIG_INDIRECT_PIO=y
+CONFIG_TRACE_MMIO_ACCESS=y
+CONFIG_CRC_CCITT=m
+CONFIG_DMA_RESTRICTED_POOL=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=32
+CONFIG_PRINTK_TIME=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=6
+CONFIG_DYNAMIC_DEBUG_CORE=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_PAGE_OWNER=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_SCHEDSTATS=y
+CONFIG_CORESIGHT=m
+CONFIG_CORESIGHT_LINK_AND_SINK_TMC=m
+CONFIG_CORESIGHT_CATU=m
+CONFIG_CORESIGHT_SINK_TPIU=m
+CONFIG_CORESIGHT_SINK_ETBV10=m
+CONFIG_CORESIGHT_STM=m
+CONFIG_CORESIGHT_CPU_DEBUG=m
+CONFIG_CORESIGHT_CTI=m
+CONFIG_CORESIGHT_TPDM=m
+CONFIG_CORESIGHT_DUMMY=m
+CONFIG_NFT_NAT=y
+CONFIG_NF_NAT=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_STMMAC_ETH=m
+CONFIG_MARVELL_PHY=m
+CONFIG_PHY_QCOM_SGMII_ETH=m
+CONFIG_ATH11K_DEBUGFS=y
+CONFIG_MAC80211_DEBUGFS=y
+CONFIG_ARM64_PMEM=y
+CONFIG_IXGBE=y
+CONFIG_IXGBEVF=y
+CONFIG_AQUANTIA_PHY=y
+CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE=y
+CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT=y
+CONFIG_TYPEC_HD3SS3220=m
+CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT=y
--- linux-qcom-6.8.0.orig/arch/arm64/configs/qcom_gen4auto.config
+++ linux-qcom-6.8.0/arch/arm64/configs/qcom_gen4auto.config
@@ -0,0 +1,78 @@
+
+# CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU is not set
+# CONFIG_ARM_SCMI_CPUFREQ is not set
+# CONFIG_ARM_SMMU_QCOM_TBU is not set
+# CONFIG_ATH11K is not set
+CONFIG_BACKLIGHT_QCOM_WLED=y
+CONFIG_BLK_DEV_DM=y
+# CONFIG_CORESIGHT is not set
+CONFIG_DM_INIT=y
+CONFIG_DM_VERITY=y
+CONFIG_DW_EDMA=y
+CONFIG_DW_EDMA_PCIE=y
+CONFIG_GH_VIRT_WATCHDOG=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_IOMMU_DEFAULT_DMA_LAZY=y
+CONFIG_MFD_I2C_PMIC=y
+CONFIG_MHI_BUS=y
+# CONFIG_MHI_BUS_DEBUG is not set
+CONFIG_MHI_BUS_PCI_GENERIC=y
+CONFIG_MHI_EP_NET=y
+CONFIG_MHI_NET=y
+# CONFIG_MHI_WWAN_CTRL is not set
+# CONFIG_MHI_WWAN_MBIM is not set
+# CONFIG_MODULE_SIG_FORCE is not set
+CONFIG_MHI_BUS_EP=y
+CONFIG_MSM_RDBG=m
+CONFIG_NET_KEY=m
+CONFIG_NO_HZ_FULL=y
+CONFIG_PANIC_TIMEOUT=0
+CONFIG_PHY_QCOM_QMP=m
+CONFIG_PHY_QCOM_QMP_PCIE=m
+CONFIG_PHY_QCOM_QMP_PCIE_8996=m
+CONFIG_PHY_QCOM_QMP_UFS=m
+CONFIG_PHY_QCOM_QMP_USB=m
+CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2=m
+CONFIG_PINCTRL_SA7255P=y
+CONFIG_PINCTRL_SA8775P_LPASS_LPI=m
+CONFIG_QCOM_DCC=m
+CONFIG_QCOM_DMABUF_HEAPS=y
+CONFIG_QCOM_DMABUF_HEAPS_CMA=y
+CONFIG_QCOM_DMABUF_HEAPS_SYSTEM=y
+CONFIG_QCOM_DMABUF_HEAPS_SYSTEM_SECURE=y
+CONFIG_QCOM_MEM_BUF=y
+CONFIG_QCOM_MEM_BUF_DEV=y
+# CONFIG_QCOM_PANEL_EVENT_NOTIFIER is not set
+CONFIG_PCI_EPF_MHI=y
+CONFIG_PCIE_QCOM_EP=m
+CONFIG_QCOM_PMIC_PDCHARGER_ULOG=y
+CONFIG_QCOM_QMI_COOLING=m
+CONFIG_QCOM_QPS615_PCIE_SWITCH=y
+CONFIG_QCOM_SCM_ADDON=y
+CONFIG_QCOM_SECURE_BUFFER=y
+CONFIG_QCOM_SMCINVOKE=m
+CONFIG_QCOM_SMP2P_SLEEPSTATE=y
+# CONFIG_QCOM_SOC_DEBUG is not set
+CONFIG_QCOM_SPMI_ADC5_GEN3=m
+CONFIG_QCOM_SPMI_MBG_TM=m
+CONFIG_QCOM_WDT=y
+CONFIG_QCOM_WDT_CORE=y
+CONFIG_QTEE_SHM_BRIDGE=y
+CONFIG_QTI_BCL_PMIC5=y
+CONFIG_QTI_DEVFREQ_CDEV=m
+CONFIG_QTI_TZ_LOG=m
+CONFIG_REGULATOR_DEBUG_CONTROL=y
+CONFIG_REGULATOR_PROXY_CONSUMER=y
+CONFIG_REGULATOR_QCOM_PM8008=y
+CONFIG_REGULATOR_QPNP_LCDB=y
+# CONFIG_SERIAL_QCOM_GENI_CONSOLE is not set
+CONFIG_SND_SOC_MSM_STUB=y
+CONFIG_STM_PROTO_OST=m
+CONFIG_USB_DWC3_QCOM=m
+# CONFIG_USB_F_QDSS is not set
+CONFIG_VIRT_DRIVERS=y
+CONFIG_XFRM=y
+CONFIG_XFRM_USER=y
+CONFIG_QCOM_DMABUF_HEAPS_CARVEOUT=y
--- linux-qcom-6.8.0.orig/arch/arm64/configs/qcom_gen4auto_debug.config
+++ linux-qcom-6.8.0/arch/arm64/configs/qcom_gen4auto_debug.config
@@ -0,0 +1,23 @@
+CONFIG_BUG_ON_DATA_CORRUPTION=y
+CONFIG_CMA_DEBUG=y
+CONFIG_CMA_DEBUGFS=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_LIST=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DMABUF_SYSFS_STATS=y
+CONFIG_DYNAMIC_DEBUG=y
+# CONFIG_FW_LOADER_DEBUG is not set
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_LOCALVERSION="-debug"
+CONFIG_MAC80211_DEBUGFS=y
+CONFIG_PAGE_POISONING=y
+CONFIG_PID_IN_CONTEXTIDR=y
+CONFIG_PM_DEBUG=y
+CONFIG_SERIAL_QCOM_GENI_CONSOLE=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+# CONFIG_TEST_DYNAMIC_DEBUG is not set
--- linux-qcom-6.8.0.orig/arch/arm64/configs/qcom_gen5auto.config
+++ linux-qcom-6.8.0/arch/arm64/configs/qcom_gen5auto.config
@@ -0,0 +1,8 @@
+CONFIG_PTP_QCOM_CLOCK_TSC=y
+CONFIG_SCSI_UFS_QCOM=y
+CONFIG_ARM_SCMI_CPUFREQ=y
+CONFIG_QCOM_CPUCP_MBOX=y
+CONFIG_MHI_BUS=y
+# CONFIG_MHI_BUS_DEBUG is not set
+CONFIG_MHI_BUS_PCI_GENERIC=y
+# CONFIG_ARM_SMMU_QCOM_TBU is not set
--- linux-qcom-6.8.0.orig/arch/arm64/configs/qcom_gen5auto_debug.config
+++ linux-qcom-6.8.0/arch/arm64/configs/qcom_gen5auto_debug.config
@@ -0,0 +1,78 @@
+CONFIG_BUG_ON_DATA_CORRUPTION=y
+CONFIG_CMA_DEBUG=y
+CONFIG_CMA_DEBUGFS=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
+CONFIG_DEBUG_ATOMIC_SLEEP=y
+CONFIG_DEBUG_IRQFLAGS=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_KMEMLEAK=y
+CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y
+# CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF is not set
+CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE=16000
+CONFIG_DEBUG_LIST=y
+CONFIG_DEBUG_LOCKDEP=y
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DEBUG_PREEMPT=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_DEBUG_RWSEMS=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DMABUF_SYSFS_STATS=y
+CONFIG_DYNAMIC_DEBUG=y
+CONFIG_DYNAMIC_FTRACE=y
+CONFIG_DYNAMIC_FTRACE_WITH_ARGS=y
+CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS=y
+CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
+CONFIG_FTRACE_MCOUNT_RECORD=y
+CONFIG_FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY=y
+CONFIG_FTRACE_SYSCALLS=y
+CONFIG_FUNCTION_ALIGNMENT=8
+CONFIG_FUNCTION_ALIGNMENT_8B=y
+CONFIG_FUNCTION_GRAPH_TRACER=y
+CONFIG_FUNCTION_TRACER=y
+# CONFIG_FW_LOADER_DEBUG is not set
+CONFIG_GENERIC_TRACER=y
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS=y
+CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
+CONFIG_HWLAT_TRACER=y
+CONFIG_KASAN_GENERIC=y
+# CONFIG_KASAN_HW_TAGS is not set
+CONFIG_KASAN_INLINE=y
+# CONFIG_KASAN_MODULE_TEST is not set
+# CONFIG_KASAN_OUTLINE is not set
+CONFIG_KASAN_SHADOW_OFFSET=0xdfffffc000000000
+CONFIG_KASAN_STACK=y
+CONFIG_LOCALVERSION="-debug"
+CONFIG_LOCKDEP=y
+CONFIG_LOCKDEP_BITS=15
+CONFIG_LOCKDEP_CHAINS_BITS=16
+CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
+CONFIG_LOCKDEP_STACK_TRACE_BITS=19
+CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
+CONFIG_LOCK_STAT=y
+CONFIG_MAC80211_DEBUGFS=y
+CONFIG_PAGE_POISONING=y
+CONFIG_PID_IN_CONTEXTIDR=y
+CONFIG_PREEMPTIRQ_TRACEPOINTS=y
+CONFIG_PROVE_LOCKING=y
+# CONFIG_PROVE_RAW_LOCK_NESTING is not set
+CONFIG_PROVE_RCU=y
+# CONFIG_PROVE_RCU_LIST is not set
+CONFIG_RCU_CPU_STALL_CPUTIME=y
+CONFIG_SCHED_TRACER=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+# CONFIG_TEST_DYNAMIC_DEBUG is not set
+CONFIG_TIMERLAT_TRACER=y
+CONFIG_TRACER_MAX_TRACE=y
+CONFIG_TRACER_SNAPSHOT=y
+# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set
+CONFIG_TRACE_IRQFLAGS=y
+CONFIG_TRACE_IRQFLAGS_NMI=y
+CONFIG_WQ_CPU_INTENSIVE_REPORT=y
+CONFIG_WQ_WATCHDOG=y
--- linux-qcom-6.8.0.orig/arch/arm64/configs/qcom_kvm.config
+++ linux-qcom-6.8.0/arch/arm64/configs/qcom_kvm.config
@@ -0,0 +1 @@
+CONFIG_QCOM_KVM_ENABLED=y
--- linux-qcom-6.8.0.orig/arch/arm64/configs/qcom_vm_defconfig
+++ linux-qcom-6.8.0/arch/arm64/configs/qcom_vm_defconfig
@@ -0,0 +1,769 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_UCLAMP_TASK=y
+CONFIG_NUMA_BALANCING=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_UCLAMP_TASK_GROUP=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BOOT_CONFIG=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_ARCH_QCOM=y
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_SMT=y
+CONFIG_NR_CPUS=16
+CONFIG_NUMA=y
+CONFIG_XEN=y
+CONFIG_ARM64_SW_TTBR0_PAN=y
+CONFIG_COMPAT=y
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_HIBERNATION=y
+CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
+CONFIG_ENERGY_MODEL=y
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+CONFIG_CPUFREQ_DT=y
+CONFIG_ACPI_CPPC_CPUFREQ=m
+CONFIG_ARM_SCPI_CPUFREQ=y
+CONFIG_ARM_QCOM_CPUFREQ_NVMEM=y
+CONFIG_ARM_QCOM_CPUFREQ_HW=y
+CONFIG_ARM_SCMI_CPUFREQ=y
+CONFIG_ACPI=y
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=y
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_BLK_INLINE_ENCRYPTION=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_SLAB_FREELIST_RANDOM=y
+CONFIG_SLAB_FREELIST_HARDENED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTREMOVE=y
+CONFIG_KSM=y
+CONFIG_MEMORY_FAILURE=y
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CMA=y
+CONFIG_CMA_DEBUG=y
+CONFIG_CMA_SYSFS=y
+CONFIG_CMA_AREAS=32
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IPV6=m
+CONFIG_NETFILTER=y
+CONFIG_BRIDGE_NETFILTER=m
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NETFILTER_XT_MARK=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_IP_VS=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_NET_DSA=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBS=m
+CONFIG_NET_SCH_ETF=m
+CONFIG_NET_SCH_TAPRIO=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_FLOWER=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_GACT=m
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_GATE=m
+CONFIG_VSOCKETS=y
+CONFIG_VIRTIO_VSOCKETS=y
+CONFIG_QRTR_SMD=m
+CONFIG_QRTR_TUN=m
+CONFIG_CAN=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_HIDP=m
+# CONFIG_BT_LE is not set
+CONFIG_BT_LEDS=y
+# CONFIG_BT_DEBUGFS is not set
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_LL=y
+CONFIG_BT_HCIUART_QCA=y
+CONFIG_BT_QCOMSMD=m
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_LEDS=y
+CONFIG_RFKILL=m
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_NFC=m
+CONFIG_NFC_NCI=m
+CONFIG_NFC_S3FWRN5_I2C=m
+CONFIG_PAGE_POOL_STATS=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIEAER=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_PASID=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_ACPI=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_QCOM=y
+CONFIG_PCI_ENDPOINT=y
+CONFIG_PCI_ENDPOINT_CONFIGFS=y
+CONFIG_PCI_EPF_TEST=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_MHI_BUS_PCI_GENERIC=m
+CONFIG_ARM_SCMI_PROTOCOL=y
+CONFIG_ARM_SCPI_PROTOCOL=y
+CONFIG_GNSS=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=m
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=m
+CONFIG_QCOM_COINCELL=m
+CONFIG_QCOM_FASTRPC=m
+CONFIG_SRAM=y
+CONFIG_VCPU_STALL_DETECTOR=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_HISI_SAS=y
+CONFIG_SCSI_HISI_SAS_PCI=y
+CONFIG_MEGARAID_SAS=y
+CONFIG_SCSI_MPT3SAS=m
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_CEVA=y
+CONFIG_SATA_SIL24=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_MD=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_ZERO=m
+CONFIG_NETDEVICES=y
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_TUN=y
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=y
+CONFIG_MHI_NET=m
+CONFIG_ATL1C=m
+CONFIG_QCOM_EMAC=m
+CONFIG_RMNET=m
+CONFIG_QCOM_IPA=m
+CONFIG_AT803X_PHY=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_MDIO_GPIO=m
+CONFIG_MDIO_BUS_MUX_MULTIPLEXER=m
+CONFIG_MDIO_BUS_MUX_MMIOREG=m
+CONFIG_USB_USBNET=m
+CONFIG_ATH10K=m
+CONFIG_ATH10K_PCI=m
+CONFIG_ATH10K_SDIO=m
+CONFIG_ATH10K_SNOC=m
+CONFIG_WCN36XX=m
+CONFIG_ATH11K=m
+CONFIG_ATH11K_AHB=m
+CONFIG_ATH11K_PCI=m
+CONFIG_WWAN=m
+CONFIG_MHI_WWAN_CTRL=m
+CONFIG_MHI_WWAN_MBIM=m
+CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_ADC=m
+CONFIG_KEYBOARD_GPIO=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_PM8941_PWRKEY=y
+CONFIG_INPUT_PM8XXX_VIBRATOR=y
+CONFIG_INPUT_PWM_BEEPER=m
+CONFIG_INPUT_PWM_VIBRA=m
+# CONFIG_SERIO_SERPORT is not set
+CONFIG_SERIO_AMBAKMI=y
+CONFIG_LEGACY_PTY_COUNT=16
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_MSM=y
+CONFIG_SERIAL_MSM_CONSOLE=y
+CONFIG_SERIAL_QCOM_GENI=y
+CONFIG_SERIAL_QCOM_GENI_CONSOLE=y
+CONFIG_NULL_TTY=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_IPMI_HANDLER=m
+CONFIG_IPMI_DEVICE_INTERFACE=m
+CONFIG_IPMI_SI=m
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_VIRTIO=y
+# CONFIG_DEVMEM is not set
+CONFIG_TCG_TPM=y
+CONFIG_TCG_TIS=m
+CONFIG_TCG_TIS_SPI=m
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_QCOM_CCI=m
+CONFIG_I2C_QCOM_GENI=m
+CONFIG_I2C_QUP=y
+CONFIG_I2C_VIRTIO=y
+CONFIG_I2C_SLAVE=y
+CONFIG_SPI=y
+CONFIG_SPI_PL022=y
+CONFIG_SPI_QCOM_QSPI=m
+CONFIG_SPI_QUP=y
+CONFIG_SPI_QCOM_GENI=m
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPMI=y
+CONFIG_PINCTRL_SINGLE=y
+CONFIG_PINCTRL_MSM=y
+CONFIG_PINCTRL_IPQ5332=y
+CONFIG_PINCTRL_IPQ8074=y
+CONFIG_PINCTRL_IPQ6018=y
+CONFIG_PINCTRL_IPQ9574=y
+CONFIG_PINCTRL_MSM8916=y
+CONFIG_PINCTRL_MSM8953=y
+CONFIG_PINCTRL_MSM8976=y
+CONFIG_PINCTRL_MSM8994=y
+CONFIG_PINCTRL_MSM8996=y
+CONFIG_PINCTRL_MSM8998=y
+CONFIG_PINCTRL_QCM2290=y
+CONFIG_PINCTRL_QCS404=y
+CONFIG_PINCTRL_QDF2XXX=y
+CONFIG_PINCTRL_QDU1000=y
+CONFIG_PINCTRL_SA8775P=y
+CONFIG_PINCTRL_SC7180=y
+CONFIG_PINCTRL_SC7280=y
+CONFIG_PINCTRL_SC8180X=y
+CONFIG_PINCTRL_SC8280XP=y
+CONFIG_PINCTRL_SDM660=y
+CONFIG_PINCTRL_SDM670=y
+CONFIG_PINCTRL_SDM845=y
+CONFIG_PINCTRL_SM6115=y
+CONFIG_PINCTRL_SM6125=y
+CONFIG_PINCTRL_SM6350=y
+CONFIG_PINCTRL_SM6375=y
+CONFIG_PINCTRL_SM8150=y
+CONFIG_PINCTRL_SM8250=y
+CONFIG_PINCTRL_SM8350=y
+CONFIG_PINCTRL_SM8450=y
+CONFIG_PINCTRL_SM8550=y
+CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+CONFIG_PINCTRL_LPASS_LPI=m
+CONFIG_PINCTRL_SC7280_LPASS_LPI=m
+CONFIG_PINCTRL_SM8250_LPASS_LPI=m
+CONFIG_PINCTRL_SM8450_LPASS_LPI=m
+CONFIG_PINCTRL_SC8280XP_LPASS_LPI=m
+CONFIG_PINCTRL_SM8550_LPASS_LPI=m
+CONFIG_GPIO_PL061=y
+CONFIG_GPIO_WCD934X=m
+CONFIG_GPIO_VIRTIO=y
+CONFIG_POWER_RESET_MSM=y
+CONFIG_POWER_RESET_QCOM_PON=m
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_SYSCON_REBOOT_MODE=y
+CONFIG_NVMEM_REBOOT_MODE=m
+CONFIG_BATTERY_QCOM_BATTMGR=m
+CONFIG_SENSORS_ARM_SCMI=y
+CONFIG_SENSORS_ARM_SCPI=y
+CONFIG_SENSORS_GPIO_FAN=m
+CONFIG_SENSORS_PWM_FAN=m
+CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CPU_IDLE_THERMAL=y
+CONFIG_DEVFREQ_THERMAL=y
+CONFIG_THERMAL_EMULATION=y
+CONFIG_GENERIC_ADC_THERMAL=m
+CONFIG_QCOM_TSENS=y
+CONFIG_QCOM_SPMI_ADC_TM5=m
+CONFIG_QCOM_SPMI_TEMP_ALARM=y
+CONFIG_QCOM_LMH=m
+CONFIG_WATCHDOG=y
+CONFIG_ARM_SBSA_WATCHDOG=y
+CONFIG_I6300ESB_WDT=y
+CONFIG_MFD_SPMI_PMIC=y
+CONFIG_MFD_WCD934X=m
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_REGULATOR_PWM=y
+CONFIG_REGULATOR_QCOM_REFGEN=y
+CONFIG_REGULATOR_QCOM_RPMH=y
+CONFIG_REGULATOR_QCOM_SMD_RPM=y
+CONFIG_REGULATOR_QCOM_SPMI=y
+CONFIG_REGULATOR_VCTRL=m
+CONFIG_RC_CORE=m
+CONFIG_RC_DECODERS=y
+CONFIG_RC_DEVICES=y
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_SDR_SUPPORT=y
+CONFIG_MEDIA_PLATFORM_SUPPORT=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_SDR_PLATFORM_DRIVERS=y
+CONFIG_V4L_MEM2MEM_DRIVERS=y
+CONFIG_VIDEO_QCOM_CAMSS=m
+CONFIG_VIDEO_QCOM_VENUS=m
+CONFIG_VIDEO_QCOM_IRIS=m
+CONFIG_DRM=m
+# CONFIG_DRM_FBDEV_EMULATION is not set
+CONFIG_DRM_HDLCD=m
+CONFIG_DRM_VIRTIO_GPU=m
+CONFIG_DRM_MSM=m
+# CONFIG_DRM_MSM_MDP4 is not set
+# CONFIG_DRM_MSM_MDP5 is not set
+# CONFIG_DRM_MSM_DP is not set
+# CONFIG_DRM_MSM_HDMI is not set
+CONFIG_DRM_PANEL_LVDS=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_EDP=m
+CONFIG_DRM_DISPLAY_CONNECTOR=m
+CONFIG_FB=y
+CONFIG_FB_EFI=y
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BACKLIGHT_PWM=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_ALOOP=m
+CONFIG_SND_SOC=y
+CONFIG_SND_SOC_QCOM=y
+CONFIG_SND_SOC_APQ8016_SBC=m
+CONFIG_SND_SOC_QDSP6=y
+CONFIG_SND_SOC_MSM8996=m
+CONFIG_SND_SOC_SDM845=m
+CONFIG_SND_SOC_SM8250=m
+CONFIG_SND_SOC_SC7180=m
+CONFIG_SND_SOC_SC7280=m
+CONFIG_SND_SOC_QCM6490=m
+CONFIG_SND_SOC_MSM8916_WCD_ANALOG=m
+CONFIG_SND_SOC_MSM8916_WCD_DIGITAL=m
+CONFIG_SND_SOC_WCD9335=m
+CONFIG_SND_SOC_WCD934X=m
+CONFIG_SND_SOC_WCD937X_SDW=y
+CONFIG_SND_SOC_WSA881X=m
+CONFIG_SND_SOC_WSA883X=y
+CONFIG_SND_SOC_LPASS_VA_MACRO=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_SND_AUDIO_GRAPH_CARD=m
+CONFIG_SND_AUDIO_GRAPH_CARD2=m
+CONFIG_SND_VIRTIO=y
+CONFIG_UHID=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_I2C_HID_ACPI=m
+CONFIG_I2C_HID_OF=m
+CONFIG_USB_CONN_GPIO=y
+CONFIG_USB=y
+CONFIG_USB_OTG=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_ACM=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC2=y
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_QCOM_EUD=m
+CONFIG_USB_ONBOARD_HUB=m
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_USB_ULPI=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_CONFIGFS=y
+CONFIG_USB_CONFIGFS_SERIAL=y
+CONFIG_USB_CONFIGFS_ACM=y
+CONFIG_USB_CONFIGFS_OBEX=y
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_ECM=y
+CONFIG_USB_CONFIGFS_ECM_SUBSET=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+CONFIG_USB_CONFIGFS_EEM=y
+CONFIG_USB_CONFIGFS_MASS_STORAGE=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_TYPEC=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_UCSI=m
+CONFIG_UCSI_PMIC_GLINK=m
+CONFIG_TYPEC_MUX_FSA4480=m
+CONFIG_TYPEC_MUX_GPIO_SBU=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ACPI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_MSM=y
+CONFIG_MMC_SPI=y
+CONFIG_SCSI_UFSHCD=y
+CONFIG_SCSI_UFS_BSG=y
+CONFIG_SCSI_UFS_CRYPTO=y
+CONFIG_SCSI_UFSHCD_PLATFORM=y
+CONFIG_SCSI_UFS_QCOM=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_CLASS_MULTICOLOR=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PWM=y
+CONFIG_LEDS_SYSCON=y
+CONFIG_LEDS_QCOM_LPG=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_DISK=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_LEDS_TRIGGER_PATTERN=y
+CONFIG_EDAC=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_PL031=y
+CONFIG_RTC_DRV_PM8XXX=m
+CONFIG_DMADEVICES=y
+CONFIG_PL330_DMA=y
+CONFIG_QCOM_BAM_DMA=y
+CONFIG_QCOM_GPI_DMA=m
+CONFIG_QCOM_HIDMA_MGMT=y
+CONFIG_QCOM_HIDMA=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_VFIO=y
+CONFIG_VFIO_PCI=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_MEM=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_XEN_GNTDEV=y
+CONFIG_XEN_GRANT_DEV_ALLOC=y
+CONFIG_STAGING=y
+CONFIG_STAGING_MEDIA=y
+CONFIG_COMMON_CLK_SCMI=y
+CONFIG_COMMON_CLK_SCPI=y
+CONFIG_COMMON_CLK_PWM=y
+CONFIG_COMMON_CLK_QCOM=y
+CONFIG_QCOM_A53PLL=y
+CONFIG_QCOM_CLK_APCS_MSM8916=y
+CONFIG_QCOM_CLK_APCC_MSM8996=y
+CONFIG_QCOM_CLK_SMD_RPM=y
+CONFIG_QCOM_CLK_RPMH=y
+CONFIG_IPQ_APSS_6018=y
+CONFIG_IPQ_GCC_5332=y
+CONFIG_IPQ_GCC_6018=y
+CONFIG_IPQ_GCC_8074=y
+CONFIG_IPQ_GCC_9574=y
+CONFIG_MSM_GCC_8916=y
+CONFIG_MSM_MMCC_8994=m
+CONFIG_MSM_GCC_8994=y
+CONFIG_MSM_MMCC_8996=m
+CONFIG_MSM_GCC_8998=y
+CONFIG_MSM_MMCC_8998=m
+CONFIG_QCM_GCC_2290=y
+CONFIG_QCM_DISPCC_2290=m
+CONFIG_QCS_GCC_404=y
+CONFIG_SC_CAMCC_7280=y
+CONFIG_SC_DISPCC_7280=y
+CONFIG_SC_DISPCC_8280XP=m
+CONFIG_SA_GCC_8775P=y
+CONFIG_SA_GPUCC_8775P=m
+CONFIG_SC_GCC_7180=y
+CONFIG_SC_GCC_8180X=y
+CONFIG_SC_GCC_8280XP=y
+CONFIG_SC_GPUCC_7280=y
+CONFIG_SC_LPASSCC_8280XP=m
+CONFIG_SC_LPASS_CORECC_7280=y
+CONFIG_SC_VIDEOCC_7280=y
+CONFIG_SDM_CAMCC_845=m
+CONFIG_SDM_GPUCC_845=y
+CONFIG_SDM_VIDEOCC_845=y
+CONFIG_SDM_DISPCC_845=y
+CONFIG_SDM_LPASSCC_845=m
+CONFIG_SM_CAMCC_8250=m
+CONFIG_SM_DISPCC_6115=m
+CONFIG_SM_DISPCC_8250=y
+CONFIG_SM_DISPCC_8450=m
+CONFIG_SM_DISPCC_8550=m
+CONFIG_SM_GCC_6115=y
+CONFIG_SM_GCC_8350=y
+CONFIG_SM_GCC_8450=y
+CONFIG_SM_GCC_8550=y
+CONFIG_SM_GPUCC_6115=m
+CONFIG_SM_GPUCC_8150=y
+CONFIG_SM_GPUCC_8250=y
+CONFIG_SM_TCSRCC_8550=y
+CONFIG_SM_VIDEOCC_8250=y
+CONFIG_QCOM_HFPLL=y
+CONFIG_CLK_GFM_LPASS_SM8250=m
+CONFIG_HWSPINLOCK=y
+CONFIG_HWSPINLOCK_QCOM=y
+CONFIG_ARM_MHU=y
+CONFIG_PLATFORM_MHU=y
+CONFIG_QCOM_APCS_IPC=y
+CONFIG_QCOM_IPCC=y
+CONFIG_IOMMU_IO_PGTABLE_ARMV7S=y
+CONFIG_IOMMU_IO_PGTABLE_DART=y
+CONFIG_ARM_SMMU=y
+CONFIG_ARM_SMMU_QCOM_TBU=y
+CONFIG_ARM_SMMU_V3=y
+CONFIG_QCOM_IOMMU=y
+CONFIG_VIRTIO_IOMMU=y
+CONFIG_REMOTEPROC=y
+CONFIG_QCOM_Q6V5_ADSP=m
+CONFIG_QCOM_Q6V5_MSS=m
+CONFIG_QCOM_Q6V5_PAS=m
+CONFIG_QCOM_SYSMON=m
+CONFIG_QCOM_WCNSS_PIL=m
+CONFIG_RPMSG_CHAR=m
+CONFIG_RPMSG_CTRL=m
+CONFIG_RPMSG_QCOM_GLINK_RPM=y
+CONFIG_RPMSG_QCOM_GLINK_SMEM=m
+CONFIG_RPMSG_QCOM_SMD=y
+CONFIG_SOUNDWIRE=y
+CONFIG_SOUNDWIRE_QCOM=y
+CONFIG_SOC_BRCMSTB=y
+CONFIG_FSL_RCPM=y
+CONFIG_QCOM_AOSS_QMP=y
+CONFIG_QCOM_COMMAND_DB=y
+CONFIG_QCOM_CPR=y
+CONFIG_QCOM_GENI_SE=y
+CONFIG_QCOM_LLCC=m
+CONFIG_QCOM_OCMEM=m
+CONFIG_QCOM_PMIC_GLINK=m
+CONFIG_QCOM_RMTFS_MEM=m
+CONFIG_QCOM_RPMH=y
+CONFIG_QCOM_RPMHPD=y
+CONFIG_QCOM_RPMPD=y
+CONFIG_QCOM_SMEM=y
+CONFIG_QCOM_SMD_RPM=y
+CONFIG_QCOM_SMP2P=y
+CONFIG_QCOM_SMSM=y
+CONFIG_QCOM_SOCINFO=m
+CONFIG_QCOM_SPM=m
+CONFIG_QCOM_STATS=m
+CONFIG_QCOM_WCNSS_CTRL=m
+CONFIG_QCOM_APR=y
+CONFIG_QCOM_ICC_BWMON=m
+CONFIG_DEVFREQ_GOV_USERSPACE=y
+CONFIG_DEVFREQ_GOV_PASSIVE=m
+CONFIG_EXTCON_USB_GPIO=y
+CONFIG_MEMORY=y
+CONFIG_IIO=y
+CONFIG_QCOM_SPMI_VADC=m
+CONFIG_QCOM_SPMI_ADC5=y
+CONFIG_PWM=y
+CONFIG_QCOM_PDC=y
+CONFIG_QCOM_MPM=y
+CONFIG_RESET_QCOM_AOSS=y
+CONFIG_RESET_QCOM_PDC=m
+CONFIG_PHY_CAN_TRANSCEIVER=m
+CONFIG_PHY_QCOM_EDP=m
+CONFIG_PHY_QCOM_PCIE2=m
+CONFIG_PHY_QCOM_QMP=y
+CONFIG_PHY_QCOM_QUSB2=m
+CONFIG_PHY_QCOM_SNPS_EUSB2=m
+CONFIG_PHY_QCOM_EUSB2_REPEATER=m
+CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2=y
+CONFIG_PHY_QCOM_USB_HS_28NM=m
+CONFIG_PHY_QCOM_USB_SS=m
+CONFIG_PHY_SAMSUNG_USB2=y
+CONFIG_POWERCAP=y
+CONFIG_IDLE_INJECT=y
+CONFIG_ARM_CCI_PMU=m
+CONFIG_ARM_CCN=m
+CONFIG_ARM_CMN=m
+CONFIG_ARM_SMMU_V3_PMU=m
+CONFIG_ARM_DSU_PMU=m
+CONFIG_QCOM_L2_PMU=y
+CONFIG_QCOM_L3_PMU=y
+CONFIG_ARM_SPE_PMU=m
+CONFIG_ARM_DMC620_PMU=m
+CONFIG_HISI_PMU=y
+CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU=m
+CONFIG_NVMEM_QCOM_QFPROM=y
+CONFIG_NVMEM_RMEM=m
+CONFIG_NVMEM_SPMI_SDAM=m
+CONFIG_STM_SOURCE_CONSOLE=m
+CONFIG_STM_SOURCE_HEARTBEAT=m
+CONFIG_STM_SOURCE_FTRACE=m
+CONFIG_FPGA=y
+CONFIG_FPGA_MGR_ALTERA_CVP=m
+CONFIG_FPGA_BRIDGE=m
+CONFIG_ALTERA_FREEZE_BRIDGE=m
+CONFIG_FPGA_REGION=m
+CONFIG_OF_FPGA_REGION=m
+CONFIG_TEE=y
+CONFIG_OPTEE=y
+CONFIG_MUX_MMIO=m
+CONFIG_SLIMBUS=m
+CONFIG_SLIM_QCOM_CTRL=m
+CONFIG_SLIM_QCOM_NGD_CTRL=m
+CONFIG_INTERCONNECT=y
+CONFIG_INTERCONNECT_QCOM=y
+CONFIG_INTERCONNECT_QCOM_MSM8916=m
+CONFIG_INTERCONNECT_QCOM_MSM8996=m
+CONFIG_INTERCONNECT_QCOM_OSM_L3=m
+CONFIG_INTERCONNECT_QCOM_QCM2290=m
+CONFIG_INTERCONNECT_QCOM_QCS404=m
+CONFIG_INTERCONNECT_QCOM_SA8775P=y
+CONFIG_INTERCONNECT_QCOM_SC7180=y
+CONFIG_INTERCONNECT_QCOM_SC7280=y
+CONFIG_INTERCONNECT_QCOM_SC8180X=y
+CONFIG_INTERCONNECT_QCOM_SC8280XP=y
+CONFIG_INTERCONNECT_QCOM_SDM845=y
+CONFIG_INTERCONNECT_QCOM_SM8150=m
+CONFIG_INTERCONNECT_QCOM_SM8250=m
+CONFIG_INTERCONNECT_QCOM_SM8350=m
+CONFIG_INTERCONNECT_QCOM_SM8450=y
+CONFIG_INTERCONNECT_QCOM_SM8550=y
+CONFIG_COUNTER=m
+CONFIG_HTE=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_FS_ENCRYPTION=y
+CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_AUTOFS_FS=y
+CONFIG_FUSE_FS=y
+CONFIG_CUSE=m
+CONFIG_VIRTIO_FS=y
+CONFIG_OVERLAY_FS=m
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_HUGETLBFS=y
+CONFIG_EFIVAR_FS=y
+CONFIG_SQUASHFS=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_V4_1=y
+CONFIG_NFS_V4_2=y
+CONFIG_ROOT_NFS=y
+CONFIG_9P_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
+CONFIG_FORTIFY_SOURCE=y
+CONFIG_SECURITY_SELINUX=y
+CONFIG_CRYPTO_USER=y
+CONFIG_CRYPTO_DES=m
+CONFIG_CRYPTO_ECHAINIV=y
+CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
+CONFIG_CRYPTO_USER_API_RNG=m
+CONFIG_CRYPTO_USER_API_AEAD=y
+CONFIG_CRYPTO_CHACHA20_NEON=m
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512_ARM64_CE=m
+CONFIG_CRYPTO_SHA3_ARM64=m
+CONFIG_CRYPTO_SM3_ARM64_CE=m
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_BS=m
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_DEV_QCE=m
+CONFIG_CRYPTO_DEV_QCOM_RNG=m
+CONFIG_CRYPTO_DEV_CCREE=m
+CONFIG_INDIRECT_PIO=y
+CONFIG_TRACE_MMIO_ACCESS=y
+CONFIG_CRC_CCITT=m
+CONFIG_DMA_RESTRICTED_POOL=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=32
+CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_PAGE_OWNER=y
+CONFIG_PANIC_ON_OOPS=y
+# CONFIG_SCHED_DEBUG is not set
+CONFIG_SCHEDSTATS=y
+CONFIG_CORESIGHT=m
+CONFIG_CORESIGHT_LINK_AND_SINK_TMC=m
+CONFIG_CORESIGHT_CATU=m
+CONFIG_CORESIGHT_SINK_TPIU=m
+CONFIG_CORESIGHT_SINK_ETBV10=m
+CONFIG_CORESIGHT_STM=m
+CONFIG_CORESIGHT_CPU_DEBUG=m
+CONFIG_CORESIGHT_CTI=m
+CONFIG_CORESIGHT_TPDM=m
+CONFIG_CORESIGHT_DUMMY=m
--- linux-qcom-6.8.0.orig/arch/arm64/gunyah/Makefile
+++ linux-qcom-6.8.0/arch/arm64/gunyah/Makefile
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0
+
+obj-$(CONFIG_GUNYAH) += gunyah_hypercall.o
--- linux-qcom-6.8.0.orig/arch/arm64/gunyah/gunyah_hypercall.c
+++ linux-qcom-6.8.0/arch/arm64/gunyah/gunyah_hypercall.c
@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/arm-smccc.h>
+#include <linux/module.h>
+#include <linux/gunyah.h>
+#include <linux/uuid.h>
+
+/* {c1d58fcd-a453-5fdb-9265-ce36673d5f14} */
+static const uuid_t GUNYAH_UUID =
+	UUID_INIT(0xc1d58fcd, 0xa453, 0x5fdb, 0x92, 0x65, 0xce, 0x36, 0x67, 0x3d, 0x5f, 0x14);
+
+bool arch_is_gh_guest(void)
+{
+	struct arm_smccc_res res;
+	uuid_t uuid;
+	u32 *up;
+
+	arm_smccc_1_1_hvc(ARM_SMCCC_VENDOR_HYP_CALL_UID_FUNC_ID, &res);
+
+	up = (u32 *)&uuid.b[0];
+	up[0] = lower_32_bits(res.a0);
+	up[1] = lower_32_bits(res.a1);
+	up[2] = lower_32_bits(res.a2);
+	up[3] = lower_32_bits(res.a3);
+
+	return uuid_equal(&uuid, &GUNYAH_UUID);
+}
+EXPORT_SYMBOL_GPL(arch_is_gh_guest);
+
+#define GH_HYPERCALL(fn)	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_64, \
+						   ARM_SMCCC_OWNER_VENDOR_HYP, \
+						   fn)
+
+#define GH_HYPERCALL_HYP_IDENTIFY		GH_HYPERCALL(0x8000)
+#define GH_HYPERCALL_BELL_SEND			GH_HYPERCALL(0x8012)
+#define GH_HYPERCALL_BELL_SET_MASK		GH_HYPERCALL(0x8015)
+#define GH_HYPERCALL_MSGQ_SEND			GH_HYPERCALL(0x801B)
+#define GH_HYPERCALL_MSGQ_RECV			GH_HYPERCALL(0x801C)
+#define GH_HYPERCALL_VCPU_RUN			GH_HYPERCALL(0x8065)
+
+/**
+ * gh_hypercall_hyp_identify() - Returns build information and feature flags
+ *                               supported by Gunyah.
+ * @hyp_identity: filled by the hypercall with the API info and feature flags.
+ */
+void gh_hypercall_hyp_identify(struct gh_hypercall_hyp_identify_resp *hyp_identity)
+{
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_hvc(GH_HYPERCALL_HYP_IDENTIFY, &res);
+
+	hyp_identity->api_info = res.a0;
+	hyp_identity->flags[0] = res.a1;
+	hyp_identity->flags[1] = res.a2;
+	hyp_identity->flags[2] = res.a3;
+}
+EXPORT_SYMBOL_GPL(gh_hypercall_hyp_identify);
+
+enum gh_error gh_hypercall_bell_send(u64 capid, u64 new_flags, u64 *old_flags)
+{
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_hvc(GH_HYPERCALL_BELL_SEND, capid, new_flags, 0, &res);
+
+	if (res.a0 == GH_ERROR_OK && old_flags)
+		*old_flags = res.a1;
+
+	return res.a0;
+}
+EXPORT_SYMBOL_GPL(gh_hypercall_bell_send);
+
+enum gh_error gh_hypercall_bell_set_mask(u64 capid, u64 enable_mask, u64 ack_mask)
+{
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_hvc(GH_HYPERCALL_BELL_SET_MASK, capid, enable_mask, ack_mask, 0, &res);
+
+	return res.a0;
+}
+EXPORT_SYMBOL_GPL(gh_hypercall_bell_set_mask);
+
+enum gh_error gh_hypercall_msgq_send(u64 capid, size_t size, void *buff, u64 tx_flags, bool *ready)
+{
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_hvc(GH_HYPERCALL_MSGQ_SEND, capid, size, (uintptr_t)buff, tx_flags, 0, &res);
+
+	if (res.a0 == GH_ERROR_OK)
+		*ready = !!res.a1;
+
+	return res.a0;
+}
+EXPORT_SYMBOL_GPL(gh_hypercall_msgq_send);
+
+enum gh_error gh_hypercall_msgq_recv(u64 capid, void *buff, size_t size, size_t *recv_size,
+					bool *ready)
+{
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_hvc(GH_HYPERCALL_MSGQ_RECV, capid, (uintptr_t)buff, size, 0, &res);
+
+	if (res.a0 == GH_ERROR_OK) {
+		*recv_size = res.a1;
+		*ready = !!res.a2;
+	}
+
+	return res.a0;
+}
+EXPORT_SYMBOL_GPL(gh_hypercall_msgq_recv);
+
+enum gh_error gh_hypercall_vcpu_run(u64 capid, u64 *resume_data,
+					struct gh_hypercall_vcpu_run_resp *resp)
+{
+	struct arm_smccc_1_2_regs args = {
+		.a0 = GH_HYPERCALL_VCPU_RUN,
+		.a1 = capid,
+		.a2 = resume_data[0],
+		.a3 = resume_data[1],
+		.a4 = resume_data[2],
+		/* C language says this will be implictly zero. Gunyah requires 0, so be explicit */
+		.a5 = 0,
+	};
+	struct arm_smccc_1_2_regs res;
+
+	arm_smccc_1_2_hvc(&args, &res);
+
+	if (res.a0 == GH_ERROR_OK) {
+		resp->sized_state = res.a1;
+		resp->state_data[0] = res.a2;
+		resp->state_data[1] = res.a3;
+		resp->state_data[2] = res.a4;
+	}
+
+	return res.a0;
+}
+EXPORT_SYMBOL_GPL(gh_hypercall_vcpu_run);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Gunyah Hypervisor Hypercalls");
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/acpi.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/acpi.h
@@ -119,6 +119,18 @@
 	return	acpi_cpu_get_madt_gicc(cpu)->uid;
 }
 
+static inline int get_cpu_for_acpi_id(u32 uid)
+{
+	int cpu;
+
+	for (cpu = 0; cpu < nr_cpu_ids; cpu++)
+		if (acpi_cpu_get_madt_gicc(cpu) &&
+		    uid == get_acpi_id_for_cpu(cpu))
+			return cpu;
+
+	return -EINVAL;
+}
+
 static inline void arch_fix_phys_package_id(int num, u32 slot) { }
 void __init acpi_init_cpus(void);
 int apei_claim_sea(struct pt_regs *regs);
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/asm-bug.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/asm-bug.h
@@ -28,6 +28,7 @@
 	14470:	.long 14471f - .;			\
 _BUGVERBOSE_LOCATION(__FILE__, __LINE__)		\
 		.short flags; 				\
+		.align 2;				\
 		.popsection;				\
 	14471:
 #else
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/barrier.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/barrier.h
@@ -40,6 +40,10 @@
  */
 #define dgh()		asm volatile("hint #6" : : : "memory")
 
+#define spec_bar()	asm volatile(ALTERNATIVE("dsb nsh\nisb\n",		\
+						 SB_BARRIER_INSN"nop\n",	\
+						 ARM64_HAS_SB))
+
 #ifdef CONFIG_ARM64_PSEUDO_NMI
 #define pmr_sync()						\
 	do {							\
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/cpucaps.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/cpucaps.h
@@ -58,6 +58,8 @@
 		return IS_ENABLED(CONFIG_NVIDIA_CARMEL_CNP_ERRATUM);
 	case ARM64_WORKAROUND_REPEAT_TLBI:
 		return IS_ENABLED(CONFIG_ARM64_WORKAROUND_REPEAT_TLBI);
+	case ARM64_WORKAROUND_SPECULATIVE_SSBS:
+		return IS_ENABLED(CONFIG_ARM64_WORKAROUND_SPECULATIVE_SSBS);
 	}
 
 	return true;
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/cputype.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/cputype.h
@@ -86,6 +86,15 @@
 #define ARM_CPU_PART_CORTEX_X2		0xD48
 #define ARM_CPU_PART_NEOVERSE_N2	0xD49
 #define ARM_CPU_PART_CORTEX_A78C	0xD4B
+#define ARM_CPU_PART_CORTEX_X1C		0xD4C
+#define ARM_CPU_PART_CORTEX_X3		0xD4E
+#define ARM_CPU_PART_NEOVERSE_V2	0xD4F
+#define ARM_CPU_PART_CORTEX_A720	0xD81
+#define ARM_CPU_PART_CORTEX_X4		0xD82
+#define ARM_CPU_PART_NEOVERSE_V3	0xD84
+#define ARM_CPU_PART_CORTEX_X925	0xD85
+#define ARM_CPU_PART_CORTEX_A725	0xD87
+#define ARM_CPU_PART_NEOVERSE_N3	0xD8E
 
 #define APM_CPU_PART_XGENE		0x000
 #define APM_CPU_VAR_POTENZA		0x00
@@ -135,6 +144,7 @@
 #define APPLE_CPU_PART_M2_AVALANCHE_MAX	0x039
 
 #define AMPERE_CPU_PART_AMPERE1		0xAC3
+#define AMPERE_CPU_PART_AMPERE1A	0xAC4
 
 #define MICROSOFT_CPU_PART_AZURE_COBALT_100	0xD49 /* Based on r0p0 of ARM Neoverse N2 */
 
@@ -159,6 +169,15 @@
 #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2)
 #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2)
 #define MIDR_CORTEX_A78C	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C)
+#define MIDR_CORTEX_X1C	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C)
+#define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3)
+#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2)
+#define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720)
+#define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4)
+#define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3)
+#define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925)
+#define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725)
+#define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3)
 #define MIDR_THUNDERX	MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
 #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
 #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
@@ -196,6 +215,7 @@
 #define MIDR_APPLE_M2_BLIZZARD_MAX MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_MAX)
 #define MIDR_APPLE_M2_AVALANCHE_MAX MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_MAX)
 #define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1)
+#define MIDR_AMPERE1A MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1A)
 #define MIDR_MICROSOFT_AZURE_COBALT_100 MIDR_CPU_MODEL(ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_AZURE_COBALT_100)
 
 /* Fujitsu Erratum 010001 affects A64FX 1.0 and 1.1, (v0r0 and v1r0) */
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/esr.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/esr.h
@@ -10,63 +10,63 @@
 #include <asm/memory.h>
 #include <asm/sysreg.h>
 
-#define ESR_ELx_EC_UNKNOWN	(0x00)
-#define ESR_ELx_EC_WFx		(0x01)
+#define ESR_ELx_EC_UNKNOWN	UL(0x00)
+#define ESR_ELx_EC_WFx		UL(0x01)
 /* Unallocated EC: 0x02 */
-#define ESR_ELx_EC_CP15_32	(0x03)
-#define ESR_ELx_EC_CP15_64	(0x04)
-#define ESR_ELx_EC_CP14_MR	(0x05)
-#define ESR_ELx_EC_CP14_LS	(0x06)
-#define ESR_ELx_EC_FP_ASIMD	(0x07)
-#define ESR_ELx_EC_CP10_ID	(0x08)	/* EL2 only */
-#define ESR_ELx_EC_PAC		(0x09)	/* EL2 and above */
+#define ESR_ELx_EC_CP15_32	UL(0x03)
+#define ESR_ELx_EC_CP15_64	UL(0x04)
+#define ESR_ELx_EC_CP14_MR	UL(0x05)
+#define ESR_ELx_EC_CP14_LS	UL(0x06)
+#define ESR_ELx_EC_FP_ASIMD	UL(0x07)
+#define ESR_ELx_EC_CP10_ID	UL(0x08)	/* EL2 only */
+#define ESR_ELx_EC_PAC		UL(0x09)	/* EL2 and above */
 /* Unallocated EC: 0x0A - 0x0B */
-#define ESR_ELx_EC_CP14_64	(0x0C)
-#define ESR_ELx_EC_BTI		(0x0D)
-#define ESR_ELx_EC_ILL		(0x0E)
+#define ESR_ELx_EC_CP14_64	UL(0x0C)
+#define ESR_ELx_EC_BTI		UL(0x0D)
+#define ESR_ELx_EC_ILL		UL(0x0E)
 /* Unallocated EC: 0x0F - 0x10 */
-#define ESR_ELx_EC_SVC32	(0x11)
-#define ESR_ELx_EC_HVC32	(0x12)	/* EL2 only */
-#define ESR_ELx_EC_SMC32	(0x13)	/* EL2 and above */
+#define ESR_ELx_EC_SVC32	UL(0x11)
+#define ESR_ELx_EC_HVC32	UL(0x12)	/* EL2 only */
+#define ESR_ELx_EC_SMC32	UL(0x13)	/* EL2 and above */
 /* Unallocated EC: 0x14 */
-#define ESR_ELx_EC_SVC64	(0x15)
-#define ESR_ELx_EC_HVC64	(0x16)	/* EL2 and above */
-#define ESR_ELx_EC_SMC64	(0x17)	/* EL2 and above */
-#define ESR_ELx_EC_SYS64	(0x18)
-#define ESR_ELx_EC_SVE		(0x19)
-#define ESR_ELx_EC_ERET		(0x1a)	/* EL2 only */
+#define ESR_ELx_EC_SVC64	UL(0x15)
+#define ESR_ELx_EC_HVC64	UL(0x16)	/* EL2 and above */
+#define ESR_ELx_EC_SMC64	UL(0x17)	/* EL2 and above */
+#define ESR_ELx_EC_SYS64	UL(0x18)
+#define ESR_ELx_EC_SVE		UL(0x19)
+#define ESR_ELx_EC_ERET		UL(0x1a)	/* EL2 only */
 /* Unallocated EC: 0x1B */
-#define ESR_ELx_EC_FPAC		(0x1C)	/* EL1 and above */
-#define ESR_ELx_EC_SME		(0x1D)
+#define ESR_ELx_EC_FPAC		UL(0x1C)	/* EL1 and above */
+#define ESR_ELx_EC_SME		UL(0x1D)
 /* Unallocated EC: 0x1E */
-#define ESR_ELx_EC_IMP_DEF	(0x1f)	/* EL3 only */
-#define ESR_ELx_EC_IABT_LOW	(0x20)
-#define ESR_ELx_EC_IABT_CUR	(0x21)
-#define ESR_ELx_EC_PC_ALIGN	(0x22)
+#define ESR_ELx_EC_IMP_DEF	UL(0x1f)	/* EL3 only */
+#define ESR_ELx_EC_IABT_LOW	UL(0x20)
+#define ESR_ELx_EC_IABT_CUR	UL(0x21)
+#define ESR_ELx_EC_PC_ALIGN	UL(0x22)
 /* Unallocated EC: 0x23 */
-#define ESR_ELx_EC_DABT_LOW	(0x24)
-#define ESR_ELx_EC_DABT_CUR	(0x25)
-#define ESR_ELx_EC_SP_ALIGN	(0x26)
-#define ESR_ELx_EC_MOPS		(0x27)
-#define ESR_ELx_EC_FP_EXC32	(0x28)
+#define ESR_ELx_EC_DABT_LOW	UL(0x24)
+#define ESR_ELx_EC_DABT_CUR	UL(0x25)
+#define ESR_ELx_EC_SP_ALIGN	UL(0x26)
+#define ESR_ELx_EC_MOPS		UL(0x27)
+#define ESR_ELx_EC_FP_EXC32	UL(0x28)
 /* Unallocated EC: 0x29 - 0x2B */
-#define ESR_ELx_EC_FP_EXC64	(0x2C)
+#define ESR_ELx_EC_FP_EXC64	UL(0x2C)
 /* Unallocated EC: 0x2D - 0x2E */
-#define ESR_ELx_EC_SERROR	(0x2F)
-#define ESR_ELx_EC_BREAKPT_LOW	(0x30)
-#define ESR_ELx_EC_BREAKPT_CUR	(0x31)
-#define ESR_ELx_EC_SOFTSTP_LOW	(0x32)
-#define ESR_ELx_EC_SOFTSTP_CUR	(0x33)
-#define ESR_ELx_EC_WATCHPT_LOW	(0x34)
-#define ESR_ELx_EC_WATCHPT_CUR	(0x35)
+#define ESR_ELx_EC_SERROR	UL(0x2F)
+#define ESR_ELx_EC_BREAKPT_LOW	UL(0x30)
+#define ESR_ELx_EC_BREAKPT_CUR	UL(0x31)
+#define ESR_ELx_EC_SOFTSTP_LOW	UL(0x32)
+#define ESR_ELx_EC_SOFTSTP_CUR	UL(0x33)
+#define ESR_ELx_EC_WATCHPT_LOW	UL(0x34)
+#define ESR_ELx_EC_WATCHPT_CUR	UL(0x35)
 /* Unallocated EC: 0x36 - 0x37 */
-#define ESR_ELx_EC_BKPT32	(0x38)
+#define ESR_ELx_EC_BKPT32	UL(0x38)
 /* Unallocated EC: 0x39 */
-#define ESR_ELx_EC_VECTOR32	(0x3A)	/* EL2 only */
+#define ESR_ELx_EC_VECTOR32	UL(0x3A)	/* EL2 only */
 /* Unallocated EC: 0x3B */
-#define ESR_ELx_EC_BRK64	(0x3C)
+#define ESR_ELx_EC_BRK64	UL(0x3C)
 /* Unallocated EC: 0x3D - 0x3F */
-#define ESR_ELx_EC_MAX		(0x3F)
+#define ESR_ELx_EC_MAX		UL(0x3F)
 
 #define ESR_ELx_EC_SHIFT	(26)
 #define ESR_ELx_EC_WIDTH	(6)
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/gunyah.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/gunyah.h
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _ASM_GUNYAH_H
+#define _ASM_GUNYAH_H
+
+#include <linux/irq.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+static inline int arch_gh_fill_irq_fwspec_params(u32 virq, struct irq_fwspec *fwspec)
+{
+	/* Assume that Gunyah gave us an SPI; defensively check it */
+	if (WARN_ON(virq < 32 || virq > 1019))
+		return -EINVAL;
+
+	fwspec->param_count = 3;
+	fwspec->param[0] = GIC_SPI;
+	fwspec->param[1] = virq - 32;
+	fwspec->param[2] = IRQ_TYPE_EDGE_RISING;
+	return 0;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/insn.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/insn.h
@@ -347,6 +347,7 @@
 __AARCH64_INSN_FUNCS(exclusive,	0x3F800000, 0x08000000)
 __AARCH64_INSN_FUNCS(load_ex,	0x3F400000, 0x08400000)
 __AARCH64_INSN_FUNCS(store_ex,	0x3F400000, 0x08000000)
+__AARCH64_INSN_FUNCS(mops,	0x3B200C00, 0x19000400)
 __AARCH64_INSN_FUNCS(stp,	0x7FC00000, 0x29000000)
 __AARCH64_INSN_FUNCS(ldp,	0x7FC00000, 0x29400000)
 __AARCH64_INSN_FUNCS(stp_post,	0x7FC00000, 0x28800000)
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/irqflags.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/irqflags.h
@@ -5,7 +5,6 @@
 #ifndef __ASM_IRQFLAGS_H
 #define __ASM_IRQFLAGS_H
 
-#include <asm/alternative.h>
 #include <asm/barrier.h>
 #include <asm/ptrace.h>
 #include <asm/sysreg.h>
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/jump_label.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/jump_label.h
@@ -13,6 +13,7 @@
 #include <linux/types.h>
 #include <asm/insn.h>
 
+#define HAVE_JUMP_LABEL_BATCH
 #define JUMP_LABEL_NOP_SIZE		AARCH64_INSN_SIZE
 
 static __always_inline bool arch_static_branch(struct static_key * const key,
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/kvm_host.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/kvm_host.h
@@ -73,8 +73,6 @@
 static inline enum kvm_mode kvm_get_mode(void) { return KVM_MODE_NONE; };
 #endif
 
-DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use);
-
 extern unsigned int __ro_after_init kvm_sve_max_vl;
 int __init kvm_arm_init_sve(void);
 
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/mman.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/mman.h
@@ -3,6 +3,8 @@
 #define __ASM_MMAN_H__
 
 #include <linux/compiler.h>
+#include <linux/fs.h>
+#include <linux/shmem_fs.h>
 #include <linux/types.h>
 #include <uapi/asm/mman.h>
 
@@ -21,19 +23,21 @@
 }
 #define arch_calc_vm_prot_bits(prot, pkey) arch_calc_vm_prot_bits(prot, pkey)
 
-static inline unsigned long arch_calc_vm_flag_bits(unsigned long flags)
+static inline unsigned long arch_calc_vm_flag_bits(struct file *file,
+						   unsigned long flags)
 {
 	/*
 	 * Only allow MTE on anonymous mappings as these are guaranteed to be
 	 * backed by tags-capable memory. The vm_flags may be overridden by a
 	 * filesystem supporting MTE (RAM-based).
 	 */
-	if (system_supports_mte() && (flags & MAP_ANONYMOUS))
+	if (system_supports_mte() &&
+	    ((flags & MAP_ANONYMOUS) || shmem_file(file)))
 		return VM_MTE_ALLOWED;
 
 	return 0;
 }
-#define arch_calc_vm_flag_bits(flags) arch_calc_vm_flag_bits(flags)
+#define arch_calc_vm_flag_bits(file, flags) arch_calc_vm_flag_bits(file, flags)
 
 static inline bool arch_validate_prot(unsigned long prot,
 	unsigned long addr __always_unused)
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/pgtable.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/pgtable.h
@@ -275,6 +275,11 @@
 	}
 }
 
+static inline void set_pte_nosync(pte_t *ptep, pte_t pte)
+{
+	WRITE_ONCE(*ptep, pte);
+}
+
 extern void __sync_icache_dcache(pte_t pteval);
 bool pgattr_change_is_safe(u64 old, u64 new);
 
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/sysreg.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/sysreg.h
@@ -1036,18 +1036,18 @@
  * Permission Indirection Extension (PIE) permission encodings.
  * Encodings with the _O suffix, have overlays applied (Permission Overlay Extension).
  */
-#define PIE_NONE_O	0x0
-#define PIE_R_O		0x1
-#define PIE_X_O		0x2
-#define PIE_RX_O	0x3
-#define PIE_RW_O	0x5
-#define PIE_RWnX_O	0x6
-#define PIE_RWX_O	0x7
-#define PIE_R		0x8
-#define PIE_GCS		0x9
-#define PIE_RX		0xa
-#define PIE_RW		0xc
-#define PIE_RWX		0xe
+#define PIE_NONE_O	UL(0x0)
+#define PIE_R_O		UL(0x1)
+#define PIE_X_O		UL(0x2)
+#define PIE_RX_O	UL(0x3)
+#define PIE_RW_O	UL(0x5)
+#define PIE_RWnX_O	UL(0x6)
+#define PIE_RWX_O	UL(0x7)
+#define PIE_R		UL(0x8)
+#define PIE_GCS		UL(0x9)
+#define PIE_RX		UL(0xa)
+#define PIE_RW		UL(0xc)
+#define PIE_RWX		UL(0xe)
 
 #define PIRx_ELx_PERM(idx, perm)	((perm) << ((idx) * 4))
 
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/tlbflush.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/tlbflush.h
@@ -161,12 +161,18 @@
 #define MAX_TLBI_RANGE_PAGES		__TLBI_RANGE_PAGES(31, 3)
 
 /*
- * Generate 'num' values from -1 to 30 with -1 rejected by the
- * __flush_tlb_range() loop below.
- */
-#define TLBI_RANGE_MASK			GENMASK_ULL(4, 0)
-#define __TLBI_RANGE_NUM(pages, scale)	\
-	((((pages) >> (5 * (scale) + 1)) & TLBI_RANGE_MASK) - 1)
+ * Generate 'num' values from -1 to 31 with -1 rejected by the
+ * __flush_tlb_range() loop below. Its return value is only
+ * significant for a maximum of MAX_TLBI_RANGE_PAGES pages. If
+ * 'pages' is more than that, you must iterate over the overall
+ * range.
+ */
+#define __TLBI_RANGE_NUM(pages, scale)					\
+	({								\
+		int __pages = min((pages),				\
+				  __TLBI_RANGE_PAGES(31, (scale)));	\
+		(__pages >> (5 * (scale) + 1)) - 1;			\
+	})
 
 /*
  *	TLB Invalidation
@@ -379,10 +385,6 @@
  * 3. If there is 1 page remaining, flush it through non-range operations. Range
  *    operations can only span an even number of pages. We save this for last to
  *    ensure 64KB start alignment is maintained for the LPA2 case.
- *
- * Note that certain ranges can be represented by either num = 31 and
- * scale or num = 0 and scale + 1. The loop below favours the latter
- * since num is limited to 30 by the __TLBI_RANGE_NUM() macro.
  */
 #define __flush_tlb_range_op(op, start, pages, stride,			\
 				asid, tlb_level, tlbi_user, lpa2)	\
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/unistd32.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/unistd32.h
@@ -840,7 +840,7 @@
 #define __NR_ppoll_time64 414
 __SYSCALL(__NR_ppoll_time64, compat_sys_ppoll_time64)
 #define __NR_io_pgetevents_time64 416
-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents)
+__SYSCALL(__NR_io_pgetevents_time64, compat_sys_io_pgetevents_time64)
 #define __NR_recvmmsg_time64 417
 __SYSCALL(__NR_recvmmsg_time64, compat_sys_recvmmsg_time64)
 #define __NR_mq_timedsend_time64 418
--- linux-qcom-6.8.0.orig/arch/arm64/include/asm/uprobes.h
+++ linux-qcom-6.8.0/arch/arm64/include/asm/uprobes.h
@@ -10,11 +10,9 @@
 #include <asm/insn.h>
 #include <asm/probes.h>
 
-#define MAX_UINSN_BYTES		AARCH64_INSN_SIZE
-
 #define UPROBE_SWBP_INSN	cpu_to_le32(BRK64_OPCODE_UPROBES)
 #define UPROBE_SWBP_INSN_SIZE	AARCH64_INSN_SIZE
-#define UPROBE_XOL_SLOT_BYTES	MAX_UINSN_BYTES
+#define UPROBE_XOL_SLOT_BYTES	AARCH64_INSN_SIZE
 
 typedef __le32 uprobe_opcode_t;
 
@@ -23,8 +21,8 @@
 
 struct arch_uprobe {
 	union {
-		u8 insn[MAX_UINSN_BYTES];
-		u8 ixol[MAX_UINSN_BYTES];
+		__le32 insn;
+		__le32 ixol;
 	};
 	struct arch_probe_insn api;
 	bool simulate;
--- linux-qcom-6.8.0.orig/arch/arm64/include/uapi/asm/sigcontext.h
+++ linux-qcom-6.8.0/arch/arm64/include/uapi/asm/sigcontext.h
@@ -312,10 +312,10 @@
 	((sizeof(struct za_context) + (__SVE_VQ_BYTES - 1))	\
 		/ __SVE_VQ_BYTES * __SVE_VQ_BYTES)
 
-#define ZA_SIG_REGS_SIZE(vq) ((vq * __SVE_VQ_BYTES) * (vq * __SVE_VQ_BYTES))
+#define ZA_SIG_REGS_SIZE(vq) (((vq) * __SVE_VQ_BYTES) * ((vq) * __SVE_VQ_BYTES))
 
 #define ZA_SIG_ZAV_OFFSET(vq, n) (ZA_SIG_REGS_OFFSET + \
-				  (SVE_SIG_ZREG_SIZE(vq) * n))
+				  (SVE_SIG_ZREG_SIZE(vq) * (n)))
 
 #define ZA_SIG_CONTEXT_SIZE(vq) \
 		(ZA_SIG_REGS_OFFSET + ZA_SIG_REGS_SIZE(vq))
@@ -326,7 +326,7 @@
 
 #define ZT_SIG_REGS_OFFSET sizeof(struct zt_context)
 
-#define ZT_SIG_REGS_SIZE(n) (ZT_SIG_REG_BYTES * n)
+#define ZT_SIG_REGS_SIZE(n) (ZT_SIG_REG_BYTES * (n))
 
 #define ZT_SIG_CONTEXT_SIZE(n) \
 	(sizeof(struct zt_context) + ZT_SIG_REGS_SIZE(n))
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/acpi_numa.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/acpi_numa.c
@@ -27,24 +27,13 @@
 
 #include <asm/numa.h>
 
-static int acpi_early_node_map[NR_CPUS] __initdata = { NUMA_NO_NODE };
+static int acpi_early_node_map[NR_CPUS] __initdata = { [0 ... NR_CPUS - 1] = NUMA_NO_NODE };
 
 int __init acpi_numa_get_nid(unsigned int cpu)
 {
 	return acpi_early_node_map[cpu];
 }
 
-static inline int get_cpu_for_acpi_id(u32 uid)
-{
-	int cpu;
-
-	for (cpu = 0; cpu < nr_cpu_ids; cpu++)
-		if (uid == get_acpi_id_for_cpu(cpu))
-			return cpu;
-
-	return -EINVAL;
-}
-
 static int __init acpi_parse_gicc_pxm(union acpi_subtable_headers *header,
 				      const unsigned long end)
 {
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/armv8_deprecated.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/armv8_deprecated.c
@@ -462,6 +462,9 @@
 	for (int i = 0; i < ARRAY_SIZE(insn_emulations); i++) {
 		struct insn_emulation *insn = insn_emulations[i];
 		bool enable = READ_ONCE(insn->current_mode) == INSN_HW;
+		if (insn->status == INSN_UNAVAILABLE)
+			continue;
+
 		if (insn->set_hw_mode && insn->set_hw_mode(enable)) {
 			pr_warn("CPU[%u] cannot support the emulation of %s",
 				cpu, insn->name);
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/cpu_errata.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/cpu_errata.c
@@ -432,6 +432,41 @@
 };
 #endif
 
+#ifdef CONFIG_ARM64_ERRATUM_3194386
+static const struct midr_range erratum_spec_ssbs_list[] = {
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A76),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A77),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A78),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A715),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A720),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_A725),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X3),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X4),
+	MIDR_ALL_VERSIONS(MIDR_CORTEX_X925),
+	MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N3),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+	{}
+};
+#endif
+
+#ifdef CONFIG_AMPERE_ERRATUM_AC03_CPU_38
+static const struct midr_range erratum_ac03_cpu_38_list[] = {
+	MIDR_ALL_VERSIONS(MIDR_AMPERE1),
+	MIDR_ALL_VERSIONS(MIDR_AMPERE1A),
+	{},
+};
+#endif
+
 const struct arm64_cpu_capabilities arm64_errata[] = {
 #ifdef CONFIG_ARM64_WORKAROUND_CLEAN_CACHE
 	{
@@ -729,6 +764,13 @@
 		MIDR_FIXED(MIDR_CPU_VAR_REV(1,1), BIT(25)),
 	},
 #endif
+#ifdef CONFIG_ARM64_ERRATUM_3194386
+	{
+		.desc = "SSBS not fully self-synchronizing",
+		.capability = ARM64_WORKAROUND_SPECULATIVE_SSBS,
+		ERRATA_MIDR_RANGE_LIST(erratum_spec_ssbs_list),
+	},
+#endif
 #ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
 	{
 		.desc = "ARM errata 2966298, 3117295",
@@ -741,7 +783,7 @@
 	{
 		.desc = "AmpereOne erratum AC03_CPU_38",
 		.capability = ARM64_WORKAROUND_AMPERE_AC03_CPU_38,
-		ERRATA_MIDR_ALL_VERSIONS(MIDR_AMPERE1),
+		ERRATA_MIDR_RANGE_LIST(erratum_ac03_cpu_38_list),
 	},
 #endif
 	{
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/cpufeature.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/cpufeature.c
@@ -2218,6 +2218,14 @@
 		if (regp)
 			regp->user_mask &= ~ID_AA64ISAR1_EL1_BF16_MASK;
 	}
+
+	if (cpus_have_cap(ARM64_WORKAROUND_SPECULATIVE_SSBS)) {
+		struct arm64_ftr_reg *regp;
+
+		regp = get_arm64_ftr_reg(SYS_ID_AA64PFR1_EL1);
+		if (regp)
+			regp->user_mask &= ~ID_AA64PFR1_EL1_SSBS_MASK;
+	}
 }
 
 static void elf_hwcap_fixup(void)
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/fpsimd.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/fpsimd.c
@@ -1350,6 +1350,7 @@
 	} else {
 		fpsimd_to_sve(current);
 		current->thread.fp_type = FP_STATE_SVE;
+		fpsimd_flush_task_state(current);
 	}
 }
 
@@ -1518,6 +1519,27 @@
 	task->thread.kernel_fpsimd_cpu = smp_processor_id();
 }
 
+/*
+ * Invalidate any task's FPSIMD state that is present on this cpu.
+ * The FPSIMD context should be acquired with get_cpu_fpsimd_context()
+ * before calling this function.
+ */
+static void fpsimd_flush_cpu_state(void)
+{
+	WARN_ON(!system_supports_fpsimd());
+	__this_cpu_write(fpsimd_last_state.st, NULL);
+
+	/*
+	 * Leaving streaming mode enabled will cause issues for any kernel
+	 * NEON and leaving streaming mode or ZA enabled may increase power
+	 * consumption.
+	 */
+	if (system_supports_sme())
+		sme_smstop();
+
+	set_thread_flag(TIF_FOREIGN_FPSTATE);
+}
+
 void fpsimd_thread_switch(struct task_struct *next)
 {
 	bool wrong_task, wrong_cpu;
@@ -1535,7 +1557,7 @@
 
 	if (test_tsk_thread_flag(next, TIF_KERNEL_FPSTATE)) {
 		fpsimd_load_kernel_state(next);
-		set_tsk_thread_flag(next, TIF_FOREIGN_FPSTATE);
+		fpsimd_flush_cpu_state();
 	} else {
 		/*
 		 * Fix up TIF_FOREIGN_FPSTATE to correctly describe next's
@@ -1825,27 +1847,6 @@
 }
 
 /*
- * Invalidate any task's FPSIMD state that is present on this cpu.
- * The FPSIMD context should be acquired with get_cpu_fpsimd_context()
- * before calling this function.
- */
-static void fpsimd_flush_cpu_state(void)
-{
-	WARN_ON(!system_supports_fpsimd());
-	__this_cpu_write(fpsimd_last_state.st, NULL);
-
-	/*
-	 * Leaving streaming mode enabled will cause issues for any kernel
-	 * NEON and leaving streaming mode or ZA enabled may increase power
-	 * consumption.
-	 */
-	if (system_supports_sme())
-		sme_smstop();
-
-	set_thread_flag(TIF_FOREIGN_FPSTATE);
-}
-
-/*
  * Save the FPSIMD state to memory and invalidate cpu view.
  * This function must be called with preemption disabled.
  */
@@ -1923,7 +1924,7 @@
 
 	put_cpu_fpsimd_context();
 }
-EXPORT_SYMBOL_GPL(kernel_neon_begin);
+EXPORT_SYMBOL(kernel_neon_begin);
 
 /*
  * kernel_neon_end(): give the CPU FPSIMD registers back to the current task
@@ -1950,7 +1951,7 @@
 	else
 		clear_thread_flag(TIF_KERNEL_FPSTATE);
 }
-EXPORT_SYMBOL_GPL(kernel_neon_end);
+EXPORT_SYMBOL(kernel_neon_end);
 
 #ifdef CONFIG_EFI
 
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/head.S
+++ linux-qcom-6.8.0/arch/arm64/kernel/head.S
@@ -569,6 +569,11 @@
 	adr_l	x1, __hyp_text_end
 	adr_l	x2, dcache_clean_poc
 	blr	x2
+
+	mov_q	x0, INIT_SCTLR_EL2_MMU_OFF
+	pre_disable_mmu_workaround
+	msr	sctlr_el2, x0
+	isb
 0:
 	mov_q	x0, HCR_HOST_NVHE_FLAGS
 	msr	hcr_el2, x0
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/idreg-override.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/idreg-override.c
@@ -308,7 +308,8 @@
 		match_options(buf);
 
 		for (i = 0; parse_aliases && i < ARRAY_SIZE(aliases); i++)
-			if (!memcmp(buf, aliases[i].alias, len + 1))
+			if (len == strlen(aliases[i].alias) &&
+			    !memcmp(buf, aliases[i].alias, len + 1))
 				__parse_cmdline(aliases[i].feature, false);
 	} while (1);
 }
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/jump_label.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/jump_label.c
@@ -7,11 +7,12 @@
  */
 #include <linux/kernel.h>
 #include <linux/jump_label.h>
+#include <linux/smp.h>
 #include <asm/insn.h>
 #include <asm/patching.h>
 
-void arch_jump_label_transform(struct jump_entry *entry,
-			       enum jump_label_type type)
+bool arch_jump_label_transform_queue(struct jump_entry *entry,
+				     enum jump_label_type type)
 {
 	void *addr = (void *)jump_entry_code(entry);
 	u32 insn;
@@ -25,4 +26,10 @@
 	}
 
 	aarch64_insn_patch_text_nosync(addr, insn);
+	return true;
+}
+
+void arch_jump_label_transform_apply(void)
+{
+	kick_all_cpus_sync();
 }
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/probes/decode-insn.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/probes/decode-insn.c
@@ -58,10 +58,13 @@
 	 * Instructions which load PC relative literals are not going to work
 	 * when executed from an XOL slot. Instructions doing an exclusive
 	 * load/store are not going to complete successfully when single-step
-	 * exception handling happens in the middle of the sequence.
+	 * exception handling happens in the middle of the sequence. Memory
+	 * copy/set instructions require that all three instructions be placed
+	 * consecutively in memory.
 	 */
 	if (aarch64_insn_uses_literal(insn) ||
-	    aarch64_insn_is_exclusive(insn))
+	    aarch64_insn_is_exclusive(insn) ||
+	    aarch64_insn_is_mops(insn))
 		return false;
 
 	return true;
@@ -99,10 +102,6 @@
 	    aarch64_insn_is_blr(insn) ||
 	    aarch64_insn_is_ret(insn)) {
 		api->handler = simulate_br_blr_ret;
-	} else if (aarch64_insn_is_ldr_lit(insn)) {
-		api->handler = simulate_ldr_literal;
-	} else if (aarch64_insn_is_ldrsw_lit(insn)) {
-		api->handler = simulate_ldrsw_literal;
 	} else {
 		/*
 		 * Instruction cannot be stepped out-of-line and we don't
@@ -140,6 +139,17 @@
 	probe_opcode_t insn = le32_to_cpu(*addr);
 	probe_opcode_t *scan_end = NULL;
 	unsigned long size = 0, offset = 0;
+	struct arch_probe_insn *api = &asi->api;
+
+	if (aarch64_insn_is_ldr_lit(insn)) {
+		api->handler = simulate_ldr_literal;
+		decoded = INSN_GOOD_NO_SLOT;
+	} else if (aarch64_insn_is_ldrsw_lit(insn)) {
+		api->handler = simulate_ldrsw_literal;
+		decoded = INSN_GOOD_NO_SLOT;
+	} else {
+		decoded = arm_probe_decode_insn(insn, &asi->api);
+	}
 
 	/*
 	 * If there's a symbol defined in front of and near enough to
@@ -157,7 +167,6 @@
 		else
 			scan_end = addr - MAX_ATOMIC_CONTEXT_SIZE;
 	}
-	decoded = arm_probe_decode_insn(insn, &asi->api);
 
 	if (decoded != INSN_REJECTED && scan_end)
 		if (is_probed_address_atomic(addr - 1, scan_end))
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/probes/simulate-insn.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/probes/simulate-insn.c
@@ -171,17 +171,15 @@
 void __kprobes
 simulate_ldr_literal(u32 opcode, long addr, struct pt_regs *regs)
 {
-	u64 *load_addr;
+	unsigned long load_addr;
 	int xn = opcode & 0x1f;
-	int disp;
 
-	disp = ldr_displacement(opcode);
-	load_addr = (u64 *) (addr + disp);
+	load_addr = addr + ldr_displacement(opcode);
 
 	if (opcode & (1 << 30))	/* x0-x30 */
-		set_x_reg(regs, xn, *load_addr);
+		set_x_reg(regs, xn, READ_ONCE(*(u64 *)load_addr));
 	else			/* w0-w30 */
-		set_w_reg(regs, xn, *load_addr);
+		set_w_reg(regs, xn, READ_ONCE(*(u32 *)load_addr));
 
 	instruction_pointer_set(regs, instruction_pointer(regs) + 4);
 }
@@ -189,14 +187,12 @@
 void __kprobes
 simulate_ldrsw_literal(u32 opcode, long addr, struct pt_regs *regs)
 {
-	s32 *load_addr;
+	unsigned long load_addr;
 	int xn = opcode & 0x1f;
-	int disp;
 
-	disp = ldr_displacement(opcode);
-	load_addr = (s32 *) (addr + disp);
+	load_addr = addr + ldr_displacement(opcode);
 
-	set_x_reg(regs, xn, *load_addr);
+	set_x_reg(regs, xn, READ_ONCE(*(s32 *)load_addr));
 
 	instruction_pointer_set(regs, instruction_pointer(regs) + 4);
 }
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/probes/uprobes.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/probes/uprobes.c
@@ -42,7 +42,7 @@
 	else if (!IS_ALIGNED(addr, AARCH64_INSN_SIZE))
 		return -EINVAL;
 
-	insn = *(probe_opcode_t *)(&auprobe->insn[0]);
+	insn = le32_to_cpu(auprobe->insn);
 
 	switch (arm_probe_decode_insn(insn, &auprobe->api)) {
 	case INSN_REJECTED:
@@ -108,7 +108,7 @@
 	if (!auprobe->simulate)
 		return false;
 
-	insn = *(probe_opcode_t *)(&auprobe->insn[0]);
+	insn = le32_to_cpu(auprobe->insn);
 	addr = instruction_pointer(regs);
 
 	if (auprobe->api.handler)
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/process.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/process.c
@@ -429,7 +429,7 @@
 
 	if (is_compat_thread(task_thread_info(next)))
 		write_sysreg(next->thread.uw.tp_value, tpidrro_el0);
-	else if (!arm64_kernel_unmapped_at_el0())
+	else
 		write_sysreg(0, tpidrro_el0);
 
 	write_sysreg(*task_user_tls(next), tpidr_el0);
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/proton-pack.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/proton-pack.c
@@ -558,6 +558,18 @@
 
 	/* SCTLR_EL1.DSSBS was initialised to 0 during boot */
 	set_pstate_ssbs(0);
+
+	/*
+	 * SSBS is self-synchronizing and is intended to affect subsequent
+	 * speculative instructions, but some CPUs can speculate with a stale
+	 * value of SSBS.
+	 *
+	 * Mitigate this with an unconditional speculation barrier, as CPUs
+	 * could mis-speculate branches and bypass a conditional barrier.
+	 */
+	if (IS_ENABLED(CONFIG_ARM64_ERRATUM_3194386))
+		spec_bar();
+
 	return SPECTRE_MITIGATED;
 }
 
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/ptrace.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/ptrace.c
@@ -729,7 +729,6 @@
 {
 	unsigned int vq;
 	bool active;
-	bool fpsimd_only;
 	enum vec_type task_type;
 
 	memset(header, 0, sizeof(*header));
@@ -745,12 +744,10 @@
 	case ARM64_VEC_SVE:
 		if (test_tsk_thread_flag(target, TIF_SVE_VL_INHERIT))
 			header->flags |= SVE_PT_VL_INHERIT;
-		fpsimd_only = !test_tsk_thread_flag(target, TIF_SVE);
 		break;
 	case ARM64_VEC_SME:
 		if (test_tsk_thread_flag(target, TIF_SME_VL_INHERIT))
 			header->flags |= SVE_PT_VL_INHERIT;
-		fpsimd_only = false;
 		break;
 	default:
 		WARN_ON_ONCE(1);
@@ -758,7 +755,7 @@
 	}
 
 	if (active) {
-		if (fpsimd_only) {
+		if (target->thread.fp_type == FP_STATE_FPSIMD) {
 			header->flags |= SVE_PT_REGS_FPSIMD;
 		} else {
 			header->flags |= SVE_PT_REGS_SVE;
@@ -1389,7 +1386,7 @@
 {
 	long ctrl = get_tagged_addr_ctrl(target);
 
-	if (IS_ERR_VALUE(ctrl))
+	if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl)))
 		return ctrl;
 
 	return membuf_write(&to, &ctrl, sizeof(ctrl));
@@ -1403,6 +1400,10 @@
 	int ret;
 	long ctrl;
 
+	ctrl = get_tagged_addr_ctrl(target);
+	if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl)))
+		return ctrl;
+
 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 0, -1);
 	if (ret)
 		return ret;
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/setup.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/setup.c
@@ -190,7 +190,11 @@
 	if (dt_virt)
 		memblock_reserve(dt_phys, size);
 
-	if (!dt_virt || !early_init_dt_scan(dt_virt)) {
+	/*
+	 * dt_virt is a fixmap address, hence __pa(dt_virt) can't be used.
+	 * Pass dt_phys directly.
+	 */
+	if (!early_init_dt_scan(dt_virt, dt_phys)) {
 		pr_crit("\n"
 			"Error: invalid device tree blob at physical address %pa (virtual address 0x%px)\n"
 			"The dtb must be 8-byte aligned and must not exceed 2 MB in size\n"
@@ -371,9 +375,6 @@
 	smp_init_cpus();
 	smp_build_mpidr_hash();
 
-	/* Init percpu seeds for random tags after cpus are set up. */
-	kasan_init_sw_tags();
-
 #ifdef CONFIG_ARM64_SW_TTBR0_PAN
 	/*
 	 * Make sure init_thread_info.ttbr0 always generates translation
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/smccc-call.S
+++ linux-qcom-6.8.0/arch/arm64/kernel/smccc-call.S
@@ -7,48 +7,19 @@
 
 #include <asm/asm-offsets.h>
 #include <asm/assembler.h>
-#include <asm/thread_info.h>
-
-/*
- * If we have SMCCC v1.3 and (as is likely) no SVE state in
- * the registers then set the SMCCC hint bit to say there's no
- * need to preserve it.  Do this by directly adjusting the SMCCC
- * function value which is already stored in x0 ready to be called.
- */
-SYM_FUNC_START(__arm_smccc_sve_check)
-
-	ldr_l	x16, smccc_has_sve_hint
-	cbz	x16, 2f
-
-	get_current_task x16
-	ldr	x16, [x16, #TSK_TI_FLAGS]
-	tbnz	x16, #TIF_FOREIGN_FPSTATE, 1f	// Any live FP state?
-	tbnz	x16, #TIF_SVE, 2f		// Does that state include SVE?
-
-1:	orr	x0, x0, ARM_SMCCC_1_3_SVE_HINT
-
-2:	ret
-SYM_FUNC_END(__arm_smccc_sve_check)
-EXPORT_SYMBOL(__arm_smccc_sve_check)
 
 	.macro SMCCC instr
-	stp     x29, x30, [sp, #-16]!
-	mov	x29, sp
-alternative_if ARM64_SVE
-	bl	__arm_smccc_sve_check
-alternative_else_nop_endif
 	\instr	#0
-	ldr	x4, [sp, #16]
+	ldr	x4, [sp]
 	stp	x0, x1, [x4, #ARM_SMCCC_RES_X0_OFFS]
 	stp	x2, x3, [x4, #ARM_SMCCC_RES_X2_OFFS]
-	ldr	x4, [sp, #24]
+	ldr	x4, [sp, #8]
 	cbz	x4, 1f /* no quirk structure */
 	ldr	x9, [x4, #ARM_SMCCC_QUIRK_ID_OFFS]
 	cmp	x9, #ARM_SMCCC_QUIRK_QCOM_A6
 	b.ne	1f
 	str	x6, [x4, ARM_SMCCC_QUIRK_STATE_OFFS]
-1:	ldp     x29, x30, [sp], #16
-	ret
+1:	ret
 	.endm
 
 /*
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/smp.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/smp.c
@@ -71,7 +71,7 @@
 	IPI_RESCHEDULE,
 	IPI_CALL_FUNC,
 	IPI_CPU_STOP,
-	IPI_CPU_CRASH_STOP,
+	IPI_CPU_STOP_NMI,
 	IPI_TIMER,
 	IPI_IRQ_WORK,
 	NR_IPI,
@@ -88,6 +88,8 @@
 static int nr_ipi __ro_after_init = NR_IPI;
 static struct irq_desc *ipi_desc[MAX_IPI] __ro_after_init;
 
+static bool crash_stop;
+
 static void ipi_setup(int cpu);
 
 #ifdef CONFIG_HOTPLUG_CPU
@@ -462,6 +464,8 @@
 		init_gic_priority_masking();
 
 	kasan_init_hw_tags();
+	/* Init percpu seeds for random tags after cpus are set up. */
+	kasan_init_sw_tags();
 }
 
 /*
@@ -760,13 +764,15 @@
 	}
 }
 
-static const char *ipi_types[NR_IPI] __tracepoint_string = {
+static const char *ipi_types[MAX_IPI] __tracepoint_string = {
 	[IPI_RESCHEDULE]	= "Rescheduling interrupts",
 	[IPI_CALL_FUNC]		= "Function call interrupts",
 	[IPI_CPU_STOP]		= "CPU stop interrupts",
-	[IPI_CPU_CRASH_STOP]	= "CPU stop (for crash dump) interrupts",
+	[IPI_CPU_STOP_NMI]	= "CPU stop NMIs",
 	[IPI_TIMER]		= "Timer broadcast interrupts",
 	[IPI_IRQ_WORK]		= "IRQ work interrupts",
+	[IPI_CPU_BACKTRACE]	= "CPU backtrace interrupts",
+	[IPI_KGDB_ROUNDUP]	= "KGDB roundup interrupts",
 };
 
 static void smp_cross_call(const struct cpumask *target, unsigned int ipinr);
@@ -777,7 +783,7 @@
 {
 	unsigned int cpu, i;
 
-	for (i = 0; i < NR_IPI; i++) {
+	for (i = 0; i < MAX_IPI; i++) {
 		seq_printf(p, "%*s%u:%s", prec - 1, "IPI", i,
 			   prec >= 4 ? " " : "");
 		for_each_online_cpu(cpu)
@@ -806,9 +812,9 @@
 }
 #endif
 
-static void __noreturn local_cpu_stop(void)
+static void __noreturn local_cpu_stop(unsigned int cpu)
 {
-	set_cpu_online(smp_processor_id(), false);
+	set_cpu_online(cpu, false);
 
 	local_daif_mask();
 	sdei_mask_local_cpu();
@@ -822,21 +828,26 @@
  */
 void __noreturn panic_smp_self_stop(void)
 {
-	local_cpu_stop();
+	local_cpu_stop(smp_processor_id());
 }
 
-#ifdef CONFIG_KEXEC_CORE
-static atomic_t waiting_for_crash_ipi = ATOMIC_INIT(0);
-#endif
-
 static void __noreturn ipi_cpu_crash_stop(unsigned int cpu, struct pt_regs *regs)
 {
 #ifdef CONFIG_KEXEC_CORE
+	/*
+	 * Use local_daif_mask() instead of local_irq_disable() to make sure
+	 * that pseudo-NMIs are disabled. The "crash stop" code starts with
+	 * an IRQ and falls back to NMI (which might be pseudo). If the IRQ
+	 * finally goes through right as we're timing out then the NMI could
+	 * interrupt us. It's better to prevent the NMI and let the IRQ
+	 * finish since the pt_regs will be better.
+	 */
+	local_daif_mask();
+
 	crash_save_cpu(regs, cpu);
 
-	atomic_dec(&waiting_for_crash_ipi);
+	set_cpu_online(cpu, false);
 
-	local_irq_disable();
 	sdei_mask_local_cpu();
 
 	if (IS_ENABLED(CONFIG_HOTPLUG_CPU))
@@ -901,14 +912,12 @@
 		break;
 
 	case IPI_CPU_STOP:
-		local_cpu_stop();
-		break;
-
-	case IPI_CPU_CRASH_STOP:
-		if (IS_ENABLED(CONFIG_KEXEC_CORE)) {
+	case IPI_CPU_STOP_NMI:
+		if (IS_ENABLED(CONFIG_KEXEC_CORE) && crash_stop) {
 			ipi_cpu_crash_stop(cpu, get_irq_regs());
-
 			unreachable();
+		} else {
+			local_cpu_stop(cpu);
 		}
 		break;
 
@@ -963,8 +972,7 @@
 		return false;
 
 	switch (ipi) {
-	case IPI_CPU_STOP:
-	case IPI_CPU_CRASH_STOP:
+	case IPI_CPU_STOP_NMI:
 	case IPI_CPU_BACKTRACE:
 	case IPI_KGDB_ROUNDUP:
 		return true;
@@ -1077,79 +1085,109 @@
 
 void smp_send_stop(void)
 {
+	static unsigned long stop_in_progress;
+	cpumask_t mask;
 	unsigned long timeout;
 
-	if (num_other_online_cpus()) {
-		cpumask_t mask;
+	/*
+	 * If this cpu is the only one alive at this point in time, online or
+	 * not, there are no stop messages to be sent around, so just back out.
+	 */
+	if (num_other_online_cpus() == 0)
+		goto skip_ipi;
 
-		cpumask_copy(&mask, cpu_online_mask);
-		cpumask_clear_cpu(smp_processor_id(), &mask);
+	/* Only proceed if this is the first CPU to reach this code */
+	if (test_and_set_bit(0, &stop_in_progress))
+		return;
 
-		if (system_state <= SYSTEM_RUNNING)
-			pr_crit("SMP: stopping secondary CPUs\n");
-		smp_cross_call(&mask, IPI_CPU_STOP);
-	}
+	/*
+	 * Send an IPI to all currently online CPUs except the CPU running
+	 * this code.
+	 *
+	 * NOTE: we don't do anything here to prevent other CPUs from coming
+	 * online after we snapshot `cpu_online_mask`. Ideally, the calling code
+	 * should do something to prevent other CPUs from coming up. This code
+	 * can be called in the panic path and thus it doesn't seem wise to
+	 * grab the CPU hotplug mutex ourselves. Worst case:
+	 * - If a CPU comes online as we're running, we'll likely notice it
+	 *   during the 1 second wait below and then we'll catch it when we try
+	 *   with an NMI (assuming NMIs are enabled) since we re-snapshot the
+	 *   mask before sending an NMI.
+	 * - If we leave the function and see that CPUs are still online we'll
+	 *   at least print a warning. Especially without NMIs this function
+	 *   isn't foolproof anyway so calling code will just have to accept
+	 *   the fact that there could be cases where a CPU can't be stopped.
+	 */
+	cpumask_copy(&mask, cpu_online_mask);
+	cpumask_clear_cpu(smp_processor_id(), &mask);
 
-	/* Wait up to one second for other CPUs to stop */
+	if (system_state <= SYSTEM_RUNNING)
+		pr_crit("SMP: stopping secondary CPUs\n");
+
+	/*
+	 * Start with a normal IPI and wait up to one second for other CPUs to
+	 * stop. We do this first because it gives other processors a chance
+	 * to exit critical sections / drop locks and makes the rest of the
+	 * stop process (especially console flush) more robust.
+	 */
+	smp_cross_call(&mask, IPI_CPU_STOP);
 	timeout = USEC_PER_SEC;
 	while (num_other_online_cpus() && timeout--)
 		udelay(1);
 
-	if (num_other_online_cpus())
+	/*
+	 * If CPUs are still online, try an NMI. There's no excuse for this to
+	 * be slow, so we only give them an extra 10 ms to respond.
+	 */
+	if (num_other_online_cpus() && ipi_should_be_nmi(IPI_CPU_STOP_NMI)) {
+		smp_rmb();
+		cpumask_copy(&mask, cpu_online_mask);
+		cpumask_clear_cpu(smp_processor_id(), &mask);
+
+		pr_info("SMP: retry stop with NMI for CPUs %*pbl\n",
+			cpumask_pr_args(&mask));
+
+		smp_cross_call(&mask, IPI_CPU_STOP_NMI);
+		timeout = USEC_PER_MSEC * 10;
+		while (num_other_online_cpus() && timeout--)
+			udelay(1);
+	}
+
+	if (num_other_online_cpus()) {
+		smp_rmb();
+		cpumask_copy(&mask, cpu_online_mask);
+		cpumask_clear_cpu(smp_processor_id(), &mask);
+
 		pr_warn("SMP: failed to stop secondary CPUs %*pbl\n",
-			cpumask_pr_args(cpu_online_mask));
+			cpumask_pr_args(&mask));
+	}
 
+skip_ipi:
 	sdei_mask_local_cpu();
 }
 
 #ifdef CONFIG_KEXEC_CORE
 void crash_smp_send_stop(void)
 {
-	static int cpus_stopped;
-	cpumask_t mask;
-	unsigned long timeout;
-
 	/*
 	 * This function can be called twice in panic path, but obviously
 	 * we execute this only once.
+	 *
+	 * We use this same boolean to tell whether the IPI we send was a
+	 * stop or a "crash stop".
 	 */
-	if (cpus_stopped)
+	if (crash_stop)
 		return;
+	crash_stop = 1;
 
-	cpus_stopped = 1;
+	smp_send_stop();
 
-	/*
-	 * If this cpu is the only one alive at this point in time, online or
-	 * not, there are no stop messages to be sent around, so just back out.
-	 */
-	if (num_other_online_cpus() == 0)
-		goto skip_ipi;
-
-	cpumask_copy(&mask, cpu_online_mask);
-	cpumask_clear_cpu(smp_processor_id(), &mask);
-
-	atomic_set(&waiting_for_crash_ipi, num_other_online_cpus());
-
-	pr_crit("SMP: stopping secondary CPUs\n");
-	smp_cross_call(&mask, IPI_CPU_CRASH_STOP);
-
-	/* Wait up to one second for other CPUs to stop */
-	timeout = USEC_PER_SEC;
-	while ((atomic_read(&waiting_for_crash_ipi) > 0) && timeout--)
-		udelay(1);
-
-	if (atomic_read(&waiting_for_crash_ipi) > 0)
-		pr_warn("SMP: failed to stop secondary CPUs %*pbl\n",
-			cpumask_pr_args(&mask));
-
-skip_ipi:
-	sdei_mask_local_cpu();
 	sdei_handler_abort();
 }
 
 bool smp_crash_stop_failed(void)
 {
-	return (atomic_read(&waiting_for_crash_ipi) > 0);
+	return num_other_online_cpus() != 0;
 }
 #endif
 
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/syscall.c
+++ linux-qcom-6.8.0/arch/arm64/kernel/syscall.c
@@ -56,17 +56,15 @@
 	syscall_set_return_value(current, regs, 0, ret);
 
 	/*
-	 * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(),
-	 * but not enough for arm64 stack utilization comfort. To keep
-	 * reasonable stack head room, reduce the maximum offset to 9 bits.
+	 * This value will get limited by KSTACK_OFFSET_MAX(), which is 10
+	 * bits. The actual entropy will be further reduced by the compiler
+	 * when applying stack alignment constraints: the AAPCS mandates a
+	 * 16-byte aligned SP at function boundaries, which will remove the
+	 * 4 low bits from any entropy chosen here.
 	 *
-	 * The actual entropy will be further reduced by the compiler when
-	 * applying stack alignment constraints: the AAPCS mandates a
-	 * 16-byte (i.e. 4-bit) aligned SP at function boundaries.
-	 *
-	 * The resulting 5 bits of entropy is seen in SP[8:4].
+	 * The resulting 6 bits of entropy is seen in SP[9:4].
 	 */
-	choose_random_kstack_offset(get_random_u16() & 0x1FF);
+	choose_random_kstack_offset(get_random_u16());
 }
 
 static inline bool has_syscall_work(unsigned long flags)
--- linux-qcom-6.8.0.orig/arch/arm64/kernel/vmlinux.lds.S
+++ linux-qcom-6.8.0/arch/arm64/kernel/vmlinux.lds.S
@@ -285,6 +285,9 @@
 	__initdata_end = .;
 	__init_end = .;
 
+	.data.rel.ro : { *(.data.rel.ro) }
+	ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!")
+
 	_data = .;
 	_sdata = .;
 	RW_DATA(L1_CACHE_BYTES, PAGE_SIZE, THREAD_ALIGN)
@@ -336,9 +339,6 @@
 		*(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt)
 	}
 	ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!")
-
-	.data.rel.ro : { *(.data.rel.ro) }
-	ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!")
 }
 
 #include "image-vars.h"
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/arch_timer.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/arch_timer.c
@@ -206,8 +206,7 @@
 
 static inline bool userspace_irqchip(struct kvm *kvm)
 {
-	return static_branch_unlikely(&userspace_irqchip_in_use) &&
-		unlikely(!irqchip_in_kernel(kvm));
+	return unlikely(!irqchip_in_kernel(kvm));
 }
 
 static void soft_timer_start(struct hrtimer *hrt, u64 ns)
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/arm.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/arm.c
@@ -57,7 +57,6 @@
 static bool vgic_present, kvm_arm_initialised;
 
 static DEFINE_PER_CPU(unsigned char, kvm_hyp_initialized);
-DEFINE_STATIC_KEY_FALSE(userspace_irqchip_in_use);
 
 bool is_kvm_arm_initialised(void)
 {
@@ -191,6 +190,23 @@
 }
 
 
+static void kvm_destroy_mpidr_data(struct kvm *kvm)
+{
+	struct kvm_mpidr_data *data;
+
+	mutex_lock(&kvm->arch.config_lock);
+
+	data = rcu_dereference_protected(kvm->arch.mpidr_data,
+					 lockdep_is_held(&kvm->arch.config_lock));
+	if (data) {
+		rcu_assign_pointer(kvm->arch.mpidr_data, NULL);
+		synchronize_rcu();
+		kfree(data);
+	}
+
+	mutex_unlock(&kvm->arch.config_lock);
+}
+
 /**
  * kvm_arch_destroy_vm - destroy the VM data structure
  * @kvm:	pointer to the KVM struct
@@ -205,7 +221,8 @@
 	if (is_protected_kvm_enabled())
 		pkvm_destroy_hyp_vm(kvm);
 
-	kfree(kvm->arch.mpidr_data);
+	kvm_destroy_mpidr_data(kvm);
+
 	kvm_destroy_vcpus(kvm);
 
 	kvm_unshare_hyp(kvm, kvm + 1);
@@ -390,6 +407,13 @@
 
 	vcpu->arch.hw_mmu = &vcpu->kvm->arch.mmu;
 
+	/*
+	 * This vCPU may have been created after mpidr_data was initialized.
+	 * Throw out the pre-computed mappings if that is the case which forces
+	 * KVM to fall back to iteratively searching the vCPUs.
+	 */
+	kvm_destroy_mpidr_data(vcpu->kvm);
+
 	err = kvm_vgic_vcpu_init(vcpu);
 	if (err)
 		return err;
@@ -403,9 +427,6 @@
 
 void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
 {
-	if (vcpu_has_run_once(vcpu) && unlikely(!irqchip_in_kernel(vcpu->kvm)))
-		static_branch_dec(&userspace_irqchip_in_use);
-
 	kvm_mmu_free_memory_cache(&vcpu->arch.mmu_page_cache);
 	kvm_timer_vcpu_terminate(vcpu);
 	kvm_pmu_vcpu_destroy(vcpu);
@@ -589,7 +610,8 @@
 
 	mutex_lock(&kvm->arch.config_lock);
 
-	if (kvm->arch.mpidr_data || atomic_read(&kvm->online_vcpus) == 1)
+	if (rcu_access_pointer(kvm->arch.mpidr_data) ||
+	    atomic_read(&kvm->online_vcpus) == 1)
 		goto out;
 
 	kvm_for_each_vcpu(c, vcpu, kvm) {
@@ -626,7 +648,7 @@
 		data->cmpidr_to_idx[index] = c;
 	}
 
-	kvm->arch.mpidr_data = data;
+	rcu_assign_pointer(kvm->arch.mpidr_data, data);
 out:
 	mutex_unlock(&kvm->arch.config_lock);
 }
@@ -688,14 +710,6 @@
 			return ret;
 	}
 
-	if (!irqchip_in_kernel(kvm)) {
-		/*
-		 * Tell the rest of the code that there are userspace irqchip
-		 * VMs in the wild.
-		 */
-		static_branch_inc(&userspace_irqchip_in_use);
-	}
-
 	/*
 	 * Initialize traps for protected VMs.
 	 * NOTE: Move to run in EL2 directly, rather than via a hypercall, once
@@ -838,6 +852,9 @@
 static int check_vcpu_requests(struct kvm_vcpu *vcpu)
 {
 	if (kvm_request_pending(vcpu)) {
+		if (kvm_check_request(KVM_REQ_VM_DEAD, vcpu))
+			return -EIO;
+
 		if (kvm_check_request(KVM_REQ_SLEEP, vcpu))
 			kvm_vcpu_sleep(vcpu);
 
@@ -913,7 +930,7 @@
 	 * state gets updated in kvm_timer_update_run and
 	 * kvm_pmu_update_run below).
 	 */
-	if (static_branch_unlikely(&userspace_irqchip_in_use)) {
+	if (unlikely(!irqchip_in_kernel(vcpu->kvm))) {
 		if (kvm_timer_should_notify_user(vcpu) ||
 		    kvm_pmu_should_notify_user(vcpu)) {
 			*ret = -EINTR;
@@ -969,7 +986,7 @@
 
 	if (run->exit_reason == KVM_EXIT_MMIO) {
 		ret = kvm_handle_mmio_return(vcpu);
-		if (ret)
+		if (ret <= 0)
 			return ret;
 	}
 
@@ -1035,7 +1052,7 @@
 			vcpu->mode = OUTSIDE_GUEST_MODE;
 			isb(); /* Ensure work in x_flush_hwstate is committed */
 			kvm_pmu_sync_hwstate(vcpu);
-			if (static_branch_unlikely(&userspace_irqchip_in_use))
+			if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
 				kvm_timer_sync_user(vcpu);
 			kvm_vgic_sync_hwstate(vcpu);
 			local_irq_enable();
@@ -1081,7 +1098,7 @@
 		 * we don't want vtimer interrupts to race with syncing the
 		 * timer virtual interrupt state.
 		 */
-		if (static_branch_unlikely(&userspace_irqchip_in_use))
+		if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
 			kvm_timer_sync_user(vcpu);
 
 		kvm_arch_vcpu_ctxsync_fp(vcpu);
@@ -2459,21 +2476,27 @@
 
 struct kvm_vcpu *kvm_mpidr_to_vcpu(struct kvm *kvm, unsigned long mpidr)
 {
-	struct kvm_vcpu *vcpu;
+	struct kvm_vcpu *vcpu = NULL;
+	struct kvm_mpidr_data *data;
 	unsigned long i;
 
 	mpidr &= MPIDR_HWID_BITMASK;
 
-	if (kvm->arch.mpidr_data) {
-		u16 idx = kvm_mpidr_index(kvm->arch.mpidr_data, mpidr);
+	rcu_read_lock();
+	data = rcu_dereference(kvm->arch.mpidr_data);
+
+	if (data) {
+		u16 idx = kvm_mpidr_index(data, mpidr);
 
-		vcpu = kvm_get_vcpu(kvm,
-				    kvm->arch.mpidr_data->cmpidr_to_idx[idx]);
+		vcpu = kvm_get_vcpu(kvm, data->cmpidr_to_idx[idx]);
 		if (mpidr != kvm_vcpu_get_mpidr_aff(vcpu))
 			vcpu = NULL;
+	}
+
+	rcu_read_unlock();
 
+	if (vcpu)
 		return vcpu;
-	}
 
 	kvm_for_each_vcpu(i, vcpu, kvm) {
 		if (mpidr == kvm_vcpu_get_mpidr_aff(vcpu))
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/guest.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/guest.c
@@ -251,6 +251,7 @@
 		case PSR_AA32_MODE_SVC:
 		case PSR_AA32_MODE_ABT:
 		case PSR_AA32_MODE_UND:
+		case PSR_AA32_MODE_SYS:
 			if (!vcpu_el1_is_32bit(vcpu))
 				return -EINVAL;
 			break;
@@ -276,7 +277,7 @@
 	if (*vcpu_cpsr(vcpu) & PSR_MODE32_BIT) {
 		int i, nr_reg;
 
-		switch (*vcpu_cpsr(vcpu)) {
+		switch (*vcpu_cpsr(vcpu) & PSR_AA32_MODE_MASK) {
 		/*
 		 * Either we are dealing with user mode, and only the
 		 * first 15 registers (+ PC) must be narrowed to 32bit.
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/hyp/aarch32.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/hyp/aarch32.c
@@ -50,9 +50,23 @@
 	u32 cpsr_cond;
 	int cond;
 
-	/* Top two bits non-zero?  Unconditional. */
-	if (kvm_vcpu_get_esr(vcpu) >> 30)
+	/*
+	 * These are the exception classes that could fire with a
+	 * conditional instruction.
+	 */
+	switch (kvm_vcpu_trap_get_class(vcpu)) {
+	case ESR_ELx_EC_CP15_32:
+	case ESR_ELx_EC_CP15_64:
+	case ESR_ELx_EC_CP14_MR:
+	case ESR_ELx_EC_CP14_LS:
+	case ESR_ELx_EC_FP_ASIMD:
+	case ESR_ELx_EC_CP10_ID:
+	case ESR_ELx_EC_CP14_64:
+	case ESR_ELx_EC_SVC32:
+		break;
+	default:
 		return true;
+	}
 
 	/* Is condition field valid? */
 	cond = kvm_vcpu_get_condition(vcpu);
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/hyp/nvhe/ffa.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/hyp/nvhe/ffa.c
@@ -415,9 +415,9 @@
 	return;
 }
 
-static __always_inline void do_ffa_mem_xfer(const u64 func_id,
-					    struct arm_smccc_res *res,
-					    struct kvm_cpu_context *ctxt)
+static void __do_ffa_mem_xfer(const u64 func_id,
+			      struct arm_smccc_res *res,
+			      struct kvm_cpu_context *ctxt)
 {
 	DECLARE_REG(u32, len, ctxt, 1);
 	DECLARE_REG(u32, fraglen, ctxt, 2);
@@ -429,9 +429,6 @@
 	u32 offset, nr_ranges;
 	int ret = 0;
 
-	BUILD_BUG_ON(func_id != FFA_FN64_MEM_SHARE &&
-		     func_id != FFA_FN64_MEM_LEND);
-
 	if (addr_mbz || npages_mbz || fraglen > len ||
 	    fraglen > KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) {
 		ret = FFA_RET_INVALID_PARAMETERS;
@@ -450,6 +447,11 @@
 		goto out_unlock;
 	}
 
+	if (len > ffa_desc_buf.len) {
+		ret = FFA_RET_NO_MEMORY;
+		goto out_unlock;
+	}
+
 	buf = hyp_buffers.tx;
 	memcpy(buf, host_buffers.tx, fraglen);
 
@@ -501,6 +503,13 @@
 	goto out_unlock;
 }
 
+#define do_ffa_mem_xfer(fid, res, ctxt)				\
+	do {							\
+		BUILD_BUG_ON((fid) != FFA_FN64_MEM_SHARE &&	\
+			     (fid) != FFA_FN64_MEM_LEND);	\
+		__do_ffa_mem_xfer((fid), (res), (ctxt));	\
+	} while (0);
+
 static void do_ffa_mem_reclaim(struct arm_smccc_res *res,
 			       struct kvm_cpu_context *ctxt)
 {
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/hyp/nvhe/tlb.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/hyp/nvhe/tlb.c
@@ -154,7 +154,8 @@
 	/* Switch to requested VMID */
 	__tlb_switch_to_guest(mmu, &cxt, false);
 
-	__flush_s2_tlb_range_op(ipas2e1is, start, pages, stride, 0);
+	__flush_s2_tlb_range_op(ipas2e1is, start, pages, stride,
+				TLBI_TTL_UNKNOWN);
 
 	dsb(ish);
 	__tlbi(vmalle1is);
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/hyp/pgtable.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/hyp/pgtable.c
@@ -528,7 +528,7 @@
 
 		kvm_clear_pte(ctx->ptep);
 		dsb(ishst);
-		__tlbi_level(vae2is, __TLBI_VADDR(ctx->addr, 0), ctx->level);
+		__tlbi_level(vae2is, __TLBI_VADDR(ctx->addr, 0), 0);
 	} else {
 		if (ctx->end - ctx->addr < granule)
 			return -EINVAL;
@@ -829,12 +829,15 @@
 		 * Perform the appropriate TLB invalidation based on the
 		 * evicted pte value (if any).
 		 */
-		if (kvm_pte_table(ctx->old, ctx->level))
-			kvm_tlb_flush_vmid_range(mmu, ctx->addr,
-						kvm_granule_size(ctx->level));
-		else if (kvm_pte_valid(ctx->old))
+		if (kvm_pte_table(ctx->old, ctx->level)) {
+			u64 size = kvm_granule_size(ctx->level);
+			u64 addr = ALIGN_DOWN(ctx->addr, size);
+
+			kvm_tlb_flush_vmid_range(mmu, addr, size);
+		} else if (kvm_pte_valid(ctx->old)) {
 			kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, mmu,
 				     ctx->addr, ctx->level);
+		}
 	}
 
 	if (stage2_pte_is_counted(ctx->old))
@@ -882,9 +885,13 @@
 	if (kvm_pte_valid(ctx->old)) {
 		kvm_clear_pte(ctx->ptep);
 
-		if (!stage2_unmap_defer_tlb_flush(pgt))
-			kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, mmu,
-					ctx->addr, ctx->level);
+		if (kvm_pte_table(ctx->old, ctx->level)) {
+			kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, mmu, ctx->addr,
+				     0);
+		} else if (!stage2_unmap_defer_tlb_flush(pgt)) {
+			kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, mmu, ctx->addr,
+				     ctx->level);
+		}
 	}
 
 	mm_ops->put_page(ctx->ptep);
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/hyp/vhe/tlb.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/hyp/vhe/tlb.c
@@ -171,7 +171,8 @@
 	/* Switch to requested VMID */
 	__tlb_switch_to_guest(mmu, &cxt);
 
-	__flush_s2_tlb_range_op(ipas2e1is, start, pages, stride, 0);
+	__flush_s2_tlb_range_op(ipas2e1is, start, pages, stride,
+				TLBI_TTL_UNKNOWN);
 
 	dsb(ish);
 	__tlbi(vmalle1is);
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/mmio.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/mmio.c
@@ -72,6 +72,31 @@
 	return data;
 }
 
+static bool kvm_pending_sync_exception(struct kvm_vcpu *vcpu)
+{
+	if (!vcpu_get_flag(vcpu, PENDING_EXCEPTION))
+		return false;
+
+	if (vcpu_el1_is_32bit(vcpu)) {
+		switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) {
+		case unpack_vcpu_flag(EXCEPT_AA32_UND):
+		case unpack_vcpu_flag(EXCEPT_AA32_IABT):
+		case unpack_vcpu_flag(EXCEPT_AA32_DABT):
+			return true;
+		default:
+			return false;
+		}
+	} else {
+		switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) {
+		case unpack_vcpu_flag(EXCEPT_AA64_EL1_SYNC):
+		case unpack_vcpu_flag(EXCEPT_AA64_EL2_SYNC):
+			return true;
+		default:
+			return false;
+		}
+	}
+}
+
 /**
  * kvm_handle_mmio_return -- Handle MMIO loads after user space emulation
  *			     or in-kernel IO emulation
@@ -84,9 +109,12 @@
 	unsigned int len;
 	int mask;
 
-	/* Detect an already handled MMIO return */
-	if (unlikely(!vcpu->mmio_needed))
-		return 0;
+	/*
+	 * Detect if the MMIO return was already handled or if userspace aborted
+	 * the MMIO access.
+	 */
+	if (unlikely(!vcpu->mmio_needed || kvm_pending_sync_exception(vcpu)))
+		return 1;
 
 	vcpu->mmio_needed = 0;
 
@@ -117,7 +145,7 @@
 	 */
 	kvm_incr_pc(vcpu);
 
-	return 0;
+	return 1;
 }
 
 int io_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa)
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/mmu.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/mmu.c
@@ -1631,7 +1631,7 @@
 	fault_ipa = kvm_vcpu_get_fault_ipa(vcpu);
 	is_iabt = kvm_vcpu_trap_is_iabt(vcpu);
 
-	if (esr_fsc_is_permission_fault(esr)) {
+	if (esr_fsc_is_translation_fault(esr)) {
 		/* Beyond sanitised PARange (which is the IPA limit) */
 		if (fault_ipa >= BIT_ULL(get_kvm_ipa_limit())) {
 			kvm_inject_size_fault(vcpu);
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/pmu-emul.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/pmu-emul.c
@@ -342,7 +342,6 @@
 
 	if ((kvm_vcpu_read_pmcr(vcpu) & ARMV8_PMU_PMCR_E)) {
 		reg = __vcpu_sys_reg(vcpu, PMOVSSET_EL0);
-		reg &= __vcpu_sys_reg(vcpu, PMCNTENSET_EL0);
 		reg &= __vcpu_sys_reg(vcpu, PMINTENSET_EL1);
 	}
 
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/sys_regs.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/sys_regs.c
@@ -32,6 +32,7 @@
 #include <trace/events/kvm.h>
 
 #include "sys_regs.h"
+#include "vgic/vgic.h"
 
 #include "trace.h"
 
@@ -427,6 +428,11 @@
 {
 	bool g1;
 
+	if (!kvm_has_gicv3(vcpu->kvm)) {
+		kvm_inject_undefined(vcpu);
+		return false;
+	}
+
 	if (!p->is_write)
 		return read_from_write_only(vcpu, p, r);
 
@@ -1531,6 +1537,7 @@
 			val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_MTE);
 
 		val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_SME);
+		val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_MPAM_frac);
 		break;
 	case SYS_ID_AA64ISAR1_EL1:
 		if (!vcpu_has_ptrauth(vcpu))
@@ -1677,6 +1684,13 @@
 
 	val &= ~ID_AA64PFR0_EL1_AMU_MASK;
 
+	/*
+	 * MPAM is disabled by default as KVM also needs a set of PARTID to
+	 * program the MPAMVPMx_EL2 PARTID remapping registers with. But some
+	 * older kernels let the guest see the ID bit.
+	 */
+	val &= ~ID_AA64PFR0_EL1_MPAM_MASK;
+
 	return val;
 }
 
@@ -1786,6 +1800,42 @@
 	return set_id_reg(vcpu, rd, val);
 }
 
+static int set_id_aa64pfr0_el1(struct kvm_vcpu *vcpu,
+			       const struct sys_reg_desc *rd, u64 user_val)
+{
+	u64 hw_val = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1);
+	u64 mpam_mask = ID_AA64PFR0_EL1_MPAM_MASK;
+
+	/*
+	 * Commit 011e5f5bf529f ("arm64/cpufeature: Add remaining feature bits
+	 * in ID_AA64PFR0 register") exposed the MPAM field of AA64PFR0_EL1 to
+	 * guests, but didn't add trap handling. KVM doesn't support MPAM and
+	 * always returns an UNDEF for these registers. The guest must see 0
+	 * for this field.
+	 *
+	 * But KVM must also accept values from user-space that were provided
+	 * by KVM. On CPUs that support MPAM, permit user-space to write
+	 * the sanitizied value to ID_AA64PFR0_EL1.MPAM, but ignore this field.
+	 */
+	if ((hw_val & mpam_mask) == (user_val & mpam_mask))
+		user_val &= ~ID_AA64PFR0_EL1_MPAM_MASK;
+
+	return set_id_reg(vcpu, rd, user_val);
+}
+
+static int set_id_aa64pfr1_el1(struct kvm_vcpu *vcpu,
+			       const struct sys_reg_desc *rd, u64 user_val)
+{
+	u64 hw_val = read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1);
+	u64 mpam_mask = ID_AA64PFR1_EL1_MPAM_frac_MASK;
+
+	/* See set_id_aa64pfr0_el1 for comment about MPAM */
+	if ((hw_val & mpam_mask) == (user_val & mpam_mask))
+		user_val &= ~ID_AA64PFR1_EL1_MPAM_frac_MASK;
+
+	return set_id_reg(vcpu, rd, user_val);
+}
+
 /*
  * cpufeature ID register user accessors
  *
@@ -1934,7 +1984,7 @@
 	 * one cache line.
 	 */
 	if (kvm_has_mte(vcpu->kvm))
-		clidr |= 2 << CLIDR_TTYPE_SHIFT(loc);
+		clidr |= 2ULL << CLIDR_TTYPE_SHIFT(loc);
 
 	__vcpu_sys_reg(vcpu, r->reg) = clidr;
 
@@ -2282,7 +2332,7 @@
 	{ SYS_DESC(SYS_ID_AA64PFR0_EL1),
 	  .access = access_id_reg,
 	  .get_user = get_id_reg,
-	  .set_user = set_id_reg,
+	  .set_user = set_id_aa64pfr0_el1,
 	  .reset = read_sanitised_id_aa64pfr0_el1,
 	  .val = ~(ID_AA64PFR0_EL1_AMU |
 		   ID_AA64PFR0_EL1_MPAM |
@@ -2291,7 +2341,11 @@
 		   ID_AA64PFR0_EL1_GIC |
 		   ID_AA64PFR0_EL1_AdvSIMD |
 		   ID_AA64PFR0_EL1_FP), },
-	ID_SANITISED(ID_AA64PFR1_EL1),
+	{ SYS_DESC(SYS_ID_AA64PFR1_EL1),
+	  .access = access_id_reg,
+	  .get_user = get_id_reg,
+	  .set_user = set_id_aa64pfr1_el1,
+	  .reset = kvm_read_sanitised_id_reg, },
 	ID_UNALLOCATED(4,2),
 	ID_UNALLOCATED(4,3),
 	ID_WRITABLE(ID_AA64ZFR0_EL1, ~ID_AA64ZFR0_EL1_RES0),
@@ -2334,7 +2388,8 @@
 	ID_WRITABLE(ID_AA64MMFR0_EL1, ~(ID_AA64MMFR0_EL1_RES0 |
 					ID_AA64MMFR0_EL1_TGRAN4_2 |
 					ID_AA64MMFR0_EL1_TGRAN64_2 |
-					ID_AA64MMFR0_EL1_TGRAN16_2)),
+					ID_AA64MMFR0_EL1_TGRAN16_2 |
+					ID_AA64MMFR0_EL1_ASIDBITS)),
 	ID_WRITABLE(ID_AA64MMFR1_EL1, ~(ID_AA64MMFR1_EL1_RES0 |
 					ID_AA64MMFR1_EL1_HCX |
 					ID_AA64MMFR1_EL1_XNX |
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/vgic/vgic-init.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/vgic/vgic-init.c
@@ -355,7 +355,7 @@
 
 	if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
 		list_for_each_entry_safe(rdreg, next, &dist->rd_regions, list)
-			vgic_v3_free_redist_region(rdreg);
+			vgic_v3_free_redist_region(kvm, rdreg);
 		INIT_LIST_HEAD(&dist->rd_regions);
 	} else {
 		dist->vgic_cpu_base = VGIC_ADDR_UNDEF;
@@ -494,10 +494,10 @@
 out:
 	mutex_unlock(&kvm->arch.config_lock);
 out_slots:
-	mutex_unlock(&kvm->slots_lock);
-
 	if (ret)
-		kvm_vgic_destroy(kvm);
+		kvm_vm_dead(kvm);
+
+	mutex_unlock(&kvm->slots_lock);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/vgic/vgic-its.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/vgic/vgic-its.c
@@ -861,6 +861,9 @@
 
 	ite = find_ite(its, device_id, event_id);
 	if (ite && its_is_collection_mapped(ite->collection)) {
+		struct its_device *device = find_its_device(its, device_id);
+		int ite_esz = vgic_its_get_abi(its)->ite_esz;
+		gpa_t gpa = device->itt_addr + ite->event_id * ite_esz;
 		/*
 		 * Though the spec talks about removing the pending state, we
 		 * don't bother here since we clear the ITTE anyway and the
@@ -869,7 +872,8 @@
 		vgic_its_invalidate_cache(kvm);
 
 		its_free_ite(kvm, ite);
-		return 0;
+
+		return vgic_its_write_entry_lock(its, gpa, 0, ite_esz);
 	}
 
 	return E_ITS_DISCARD_UNMAPPED_INTERRUPT;
@@ -1217,9 +1221,11 @@
 	bool valid = its_cmd_get_validbit(its_cmd);
 	u8 num_eventid_bits = its_cmd_get_size(its_cmd);
 	gpa_t itt_addr = its_cmd_get_ittaddr(its_cmd);
+	int dte_esz = vgic_its_get_abi(its)->dte_esz;
 	struct its_device *device;
+	gpa_t gpa;
 
-	if (!vgic_its_check_id(its, its->baser_device_table, device_id, NULL))
+	if (!vgic_its_check_id(its, its->baser_device_table, device_id, &gpa))
 		return E_ITS_MAPD_DEVICE_OOR;
 
 	if (valid && num_eventid_bits > VITS_TYPER_IDBITS)
@@ -1240,7 +1246,7 @@
 	 * is an error, so we are done in any case.
 	 */
 	if (!valid)
-		return 0;
+		return vgic_its_write_entry_lock(its, gpa, 0, dte_esz);
 
 	device = vgic_its_alloc_device(its, device_id, itt_addr,
 				       num_eventid_bits);
@@ -2212,7 +2218,6 @@
 static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
 			      struct its_ite *ite, gpa_t gpa, int ite_esz)
 {
-	struct kvm *kvm = its->dev->kvm;
 	u32 next_offset;
 	u64 val;
 
@@ -2221,7 +2226,8 @@
 	       ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) |
 		ite->collection->collection_id;
 	val = cpu_to_le64(val);
-	return vgic_write_guest_lock(kvm, gpa, &val, ite_esz);
+
+	return vgic_its_write_entry_lock(its, gpa, val, ite_esz);
 }
 
 /**
@@ -2362,7 +2368,6 @@
 static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
 			     gpa_t ptr, int dte_esz)
 {
-	struct kvm *kvm = its->dev->kvm;
 	u64 val, itt_addr_field;
 	u32 next_offset;
 
@@ -2373,7 +2378,8 @@
 	       (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) |
 		(dev->num_eventid_bits - 1));
 	val = cpu_to_le64(val);
-	return vgic_write_guest_lock(kvm, ptr, &val, dte_esz);
+
+	return vgic_its_write_entry_lock(its, ptr, val, dte_esz);
 }
 
 /**
@@ -2560,7 +2566,8 @@
 	       ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) |
 	       collection->collection_id);
 	val = cpu_to_le64(val);
-	return vgic_write_guest_lock(its->dev->kvm, gpa, &val, esz);
+
+	return vgic_its_write_entry_lock(its, gpa, val, esz);
 }
 
 /*
@@ -2576,8 +2583,7 @@
 	u64 val;
 	int ret;
 
-	BUG_ON(esz > sizeof(val));
-	ret = kvm_read_guest_lock(kvm, gpa, &val, esz);
+	ret = vgic_its_read_entry_lock(its, gpa, &val, esz);
 	if (ret)
 		return ret;
 	val = le64_to_cpu(val);
@@ -2615,7 +2621,6 @@
 	u64 baser = its->baser_coll_table;
 	gpa_t gpa = GITS_BASER_ADDR_48_to_52(baser);
 	struct its_collection *collection;
-	u64 val;
 	size_t max_size, filled = 0;
 	int ret, cte_esz = abi->cte_esz;
 
@@ -2639,10 +2644,7 @@
 	 * table is not fully filled, add a last dummy element
 	 * with valid bit unset
 	 */
-	val = 0;
-	BUG_ON(cte_esz > sizeof(val));
-	ret = vgic_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz);
-	return ret;
+	return vgic_its_write_entry_lock(its, gpa, 0, cte_esz);
 }
 
 /**
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/vgic/vgic-kvm-device.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/vgic/vgic-kvm-device.c
@@ -338,12 +338,12 @@
 int vgic_v2_parse_attr(struct kvm_device *dev, struct kvm_device_attr *attr,
 		       struct vgic_reg_attr *reg_attr)
 {
-	int cpuid;
+	int cpuid = FIELD_GET(KVM_DEV_ARM_VGIC_CPUID_MASK, attr->attr);
 
-	cpuid = FIELD_GET(KVM_DEV_ARM_VGIC_CPUID_MASK, attr->attr);
-
-	reg_attr->vcpu = kvm_get_vcpu_by_id(dev->kvm, cpuid);
 	reg_attr->addr = attr->attr & KVM_DEV_ARM_VGIC_OFFSET_MASK;
+	reg_attr->vcpu = kvm_get_vcpu_by_id(dev->kvm, cpuid);
+	if (!reg_attr->vcpu)
+		return -EINVAL;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ linux-qcom-6.8.0/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -530,6 +530,7 @@
 				   unsigned long val)
 {
 	struct vgic_irq *irq;
+	u32 intid;
 
 	/*
 	 * If the guest wrote only to the upper 32bit part of the
@@ -541,9 +542,13 @@
 	if ((addr & 4) || !vgic_lpis_enabled(vcpu))
 		return;
 
+	intid = lower_32_bits(val);
+	if (intid < VGIC_MIN_LPI)
+		return;
+
 	vgic_set_rdist_busy(vcpu, true);
 
-	irq = vgic_get_irq(vcpu->kvm, NULL, lower_32_bits(val));
+	irq = vgic_get_irq(vcpu->kvm, NULL, intid);
 	if (irq) {
 		vgic_its_inv_lpi(vcpu->kvm, irq);
 		vgic_put_irq(vcpu->kvm, irq);
@@ -919,8 +924,19 @@
 	return ret;
 }
 
-void vgic_v3_free_redist_region(struct vgic_redist_region *rdreg)
+void vgic_v3_free_redist_region(struct kvm *kvm, struct vgic_redist_region *rdreg)
 {
+	struct kvm_vcpu *vcpu;
+	unsigned long c;
+
+	lockdep_assert_held(&kvm->arch.config_lock);
+
+	/* Garbage collect the region */
+	kvm_for_each_vcpu(c, vcpu, kvm) {
+		if (vcpu->arch.vgic_cpu.rdreg == rdreg)
+			vcpu->arch.vgic_cpu.rdreg = NULL;
+	}
+
 	list_del(&rdreg->list);
 	kfree(rdreg);
 }
@@ -945,7 +961,7 @@
 
 		mutex_lock(&kvm->arch.config_lock);
 		rdreg = vgic_v3_rdist_region_from_index(kvm, index);
-		vgic_v3_free_redist_region(rdreg);
+		vgic_v3_free_redist_region(kvm, rdreg);
 		mutex_unlock(&kvm->arch.config_lock);
 		return ret;
 	}
--- linux-qcom-6.8.0.orig/arch/arm64/kvm/vgic/vgic.h
+++ linux-qcom-6.8.0/arch/arm64/kvm/vgic/vgic.h
@@ -145,6 +145,29 @@
 	return ret;
 }
 
+static inline int vgic_its_read_entry_lock(struct vgic_its *its, gpa_t eaddr,
+					   u64 *eval, unsigned long esize)
+{
+	struct kvm *kvm = its->dev->kvm;
+
+	if (KVM_BUG_ON(esize != sizeof(*eval), kvm))
+		return -EINVAL;
+
+	return kvm_read_guest_lock(kvm, eaddr, eval, esize);
+
+}
+
+static inline int vgic_its_write_entry_lock(struct vgic_its *its, gpa_t eaddr,
+					    u64 eval, unsigned long esize)
+{
+	struct kvm *kvm = its->dev->kvm;
+
+	if (KVM_BUG_ON(esize != sizeof(eval), kvm))
+		return -EINVAL;
+
+	return vgic_write_guest_lock(kvm, eaddr, &eval, esize);
+}
+
 /*
  * This struct provides an intermediate representation of the fields contained
  * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC
@@ -310,7 +333,7 @@
 
 struct vgic_redist_region *vgic_v3_rdist_region_from_index(struct kvm *kvm,
 							   u32 index);
-void vgic_v3_free_redist_region(struct vgic_redist_region *rdreg);
+void vgic_v3_free_redist_region(struct kvm *kvm, struct vgic_redist_region *rdreg);
 
 bool vgic_v3_rdist_overlap(struct kvm *kvm, gpa_t base, size_t size);
 
@@ -343,4 +366,11 @@
 void vgic_v4_get_vlpi_state(struct vgic_irq *irq, bool *val);
 int vgic_v4_request_vpe_irq(struct kvm_vcpu *vcpu, int irq);
 
+static inline bool kvm_has_gicv3(struct kvm *kvm)
+{
+	return (static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif) &&
+		irqchip_in_kernel(kvm) &&
+		kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3);
+}
+
 #endif
--- linux-qcom-6.8.0.orig/arch/arm64/mm/context.c
+++ linux-qcom-6.8.0/arch/arm64/mm/context.c
@@ -32,9 +32,9 @@
 static unsigned long *pinned_asid_map;
 
 #define ASID_MASK		(~GENMASK(asid_bits - 1, 0))
-#define ASID_FIRST_VERSION	(1UL << asid_bits)
+#define ASID_FIRST_VERSION	(1UL << 16)
 
-#define NUM_USER_ASIDS		ASID_FIRST_VERSION
+#define NUM_USER_ASIDS		(1UL << asid_bits)
 #define ctxid2asid(asid)	((asid) & ~ASID_MASK)
 #define asid2ctxid(asid, genid)	((asid) | (genid))
 
--- linux-qcom-6.8.0.orig/arch/arm64/mm/mmu.c
+++ linux-qcom-6.8.0/arch/arm64/mm/mmu.c
@@ -103,28 +103,12 @@
 static phys_addr_t __init early_pgtable_alloc(int shift)
 {
 	phys_addr_t phys;
-	void *ptr;
 
 	phys = memblock_phys_alloc_range(PAGE_SIZE, PAGE_SIZE, 0,
 					 MEMBLOCK_ALLOC_NOLEAKTRACE);
 	if (!phys)
 		panic("Failed to allocate page table page\n");
 
-	/*
-	 * The FIX_{PGD,PUD,PMD} slots may be in active use, but the FIX_PTE
-	 * slot will be free, so we can (ab)use the FIX_PTE slot to initialise
-	 * any level of table.
-	 */
-	ptr = pte_set_fixmap(phys);
-
-	memset(ptr, 0, PAGE_SIZE);
-
-	/*
-	 * Implicit barriers also ensure the zeroed page is visible to the page
-	 * table walker
-	 */
-	pte_clear_fixmap();
-
 	return phys;
 }
 
@@ -166,16 +150,25 @@
 	return ((old ^ new) & ~mask) == 0;
 }
 
-static void init_pte(pmd_t *pmdp, unsigned long addr, unsigned long end,
-		     phys_addr_t phys, pgprot_t prot)
+static void init_clear_pgtable(void *table)
 {
-	pte_t *ptep;
+	clear_page(table);
+
+	/* Ensure the zeroing is observed by page table walks. */
+	dsb(ishst);
+}
 
-	ptep = pte_set_fixmap_offset(pmdp, addr);
+static void init_pte(pte_t *ptep, unsigned long addr, unsigned long end,
+		     phys_addr_t phys, pgprot_t prot)
+{
 	do {
 		pte_t old_pte = READ_ONCE(*ptep);
 
-		set_pte(ptep, pfn_pte(__phys_to_pfn(phys), prot));
+		/*
+		 * Required barriers to make this visible to the table walker
+		 * are deferred to the end of alloc_init_cont_pte().
+		 */
+		set_pte_nosync(ptep, pfn_pte(__phys_to_pfn(phys), prot));
 
 		/*
 		 * After the PTE entry has been populated once, we
@@ -186,8 +179,6 @@
 
 		phys += PAGE_SIZE;
 	} while (ptep++, addr += PAGE_SIZE, addr != end);
-
-	pte_clear_fixmap();
 }
 
 static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
@@ -198,6 +189,7 @@
 {
 	unsigned long next;
 	pmd_t pmd = READ_ONCE(*pmdp);
+	pte_t *ptep;
 
 	BUG_ON(pmd_sect(pmd));
 	if (pmd_none(pmd)) {
@@ -208,10 +200,14 @@
 			pmdval |= PMD_TABLE_PXN;
 		BUG_ON(!pgtable_alloc);
 		pte_phys = pgtable_alloc(PAGE_SHIFT);
+		ptep = pte_set_fixmap(pte_phys);
+		init_clear_pgtable(ptep);
+		ptep += pte_index(addr);
 		__pmd_populate(pmdp, pte_phys, pmdval);
-		pmd = READ_ONCE(*pmdp);
+	} else {
+		BUG_ON(pmd_bad(pmd));
+		ptep = pte_set_fixmap_offset(pmdp, addr);
 	}
-	BUG_ON(pmd_bad(pmd));
 
 	do {
 		pgprot_t __prot = prot;
@@ -223,20 +219,26 @@
 		    (flags & NO_CONT_MAPPINGS) == 0)
 			__prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-		init_pte(pmdp, addr, next, phys, __prot);
+		init_pte(ptep, addr, next, phys, __prot);
 
+		ptep += pte_index(next) - pte_index(addr);
 		phys += next - addr;
 	} while (addr = next, addr != end);
+
+	/*
+	 * Note: barriers and maintenance necessary to clear the fixmap slot
+	 * ensure that all previous pgtable writes are visible to the table
+	 * walker.
+	 */
+	pte_clear_fixmap();
 }
 
-static void init_pmd(pud_t *pudp, unsigned long addr, unsigned long end,
+static void init_pmd(pmd_t *pmdp, unsigned long addr, unsigned long end,
 		     phys_addr_t phys, pgprot_t prot,
 		     phys_addr_t (*pgtable_alloc)(int), int flags)
 {
 	unsigned long next;
-	pmd_t *pmdp;
 
-	pmdp = pmd_set_fixmap_offset(pudp, addr);
 	do {
 		pmd_t old_pmd = READ_ONCE(*pmdp);
 
@@ -262,8 +264,6 @@
 		}
 		phys += next - addr;
 	} while (pmdp++, addr = next, addr != end);
-
-	pmd_clear_fixmap();
 }
 
 static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
@@ -273,6 +273,7 @@
 {
 	unsigned long next;
 	pud_t pud = READ_ONCE(*pudp);
+	pmd_t *pmdp;
 
 	/*
 	 * Check for initial section mappings in the pgd/pud.
@@ -286,10 +287,14 @@
 			pudval |= PUD_TABLE_PXN;
 		BUG_ON(!pgtable_alloc);
 		pmd_phys = pgtable_alloc(PMD_SHIFT);
+		pmdp = pmd_set_fixmap(pmd_phys);
+		init_clear_pgtable(pmdp);
+		pmdp += pmd_index(addr);
 		__pud_populate(pudp, pmd_phys, pudval);
-		pud = READ_ONCE(*pudp);
+	} else {
+		BUG_ON(pud_bad(pud));
+		pmdp = pmd_set_fixmap_offset(pudp, addr);
 	}
-	BUG_ON(pud_bad(pud));
 
 	do {
 		pgprot_t __prot = prot;
@@ -301,10 +306,13 @@
 		    (flags & NO_CONT_MAPPINGS) == 0)
 			__prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-		init_pmd(pudp, addr, next, phys, __prot, pgtable_alloc, flags);
+		init_pmd(pmdp, addr, next, phys, __prot, pgtable_alloc, flags);
 
+		pmdp += pmd_index(next) - pmd_index(addr);
 		phys += next - addr;
 	} while (addr = next, addr != end);
+
+	pmd_clear_fixmap();
 }
 
 static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end,
@@ -325,12 +333,15 @@
 			p4dval |= P4D_TABLE_PXN;
 		BUG_ON(!pgtable_alloc);
 		pud_phys = pgtable_alloc(PUD_SHIFT);
+		pudp = pud_set_fixmap(pud_phys);
+		init_clear_pgtable(pudp);
+		pudp += pud_index(addr);
 		__p4d_populate(p4dp, pud_phys, p4dval);
-		p4d = READ_ONCE(*p4dp);
+	} else {
+		BUG_ON(p4d_bad(p4d));
+		pudp = pud_set_fixmap_offset(p4dp, addr);
 	}
-	BUG_ON(p4d_bad(p4d));
 
-	pudp = pud_set_fixmap_offset(p4dp, addr);
 	do {
 		pud_t old_pud = READ_ONCE(*pudp);
 
@@ -412,11 +423,10 @@
 
 static phys_addr_t __pgd_pgtable_alloc(int shift)
 {
-	void *ptr = (void *)__get_free_page(GFP_PGTABLE_KERNEL);
-	BUG_ON(!ptr);
+	/* Page is zeroed by init_clear_pgtable() so don't duplicate effort. */
+	void *ptr = (void *)__get_free_page(GFP_PGTABLE_KERNEL & ~__GFP_ZERO);
 
-	/* Ensure the zeroed page is visible to the page table walker */
-	dsb(ishst);
+	BUG_ON(!ptr);
 	return __pa(ptr);
 }
 
--- linux-qcom-6.8.0.orig/arch/arm64/mm/pageattr.c
+++ linux-qcom-6.8.0/arch/arm64/mm/pageattr.c
@@ -219,9 +219,6 @@
 	pte_t *ptep;
 	unsigned long addr = (unsigned long)page_address(page);
 
-	if (!can_set_direct_map())
-		return true;
-
 	pgdp = pgd_offset_k(addr);
 	if (pgd_none(READ_ONCE(*pgdp)))
 		return false;
--- linux-qcom-6.8.0.orig/arch/arm64/mm/trans_pgd.c
+++ linux-qcom-6.8.0/arch/arm64/mm/trans_pgd.c
@@ -42,14 +42,16 @@
 		 * the temporary mappings we use during restore.
 		 */
 		set_pte(dst_ptep, pte_mkwrite_novma(pte));
-	} else if ((debug_pagealloc_enabled() ||
-		   is_kfence_address((void *)addr)) && !pte_none(pte)) {
+	} else if (!pte_none(pte)) {
 		/*
 		 * debug_pagealloc will removed the PTE_VALID bit if
 		 * the page isn't in use by the resume kernel. It may have
 		 * been in use by the original kernel, in which case we need
 		 * to put it back in our copy to do the restore.
 		 *
+		 * Other cases include kfence / vmalloc / memfd_secret which
+		 * may call `set_direct_map_invalid_noflush()`.
+		 *
 		 * Before marking this entry valid, check the pfn should
 		 * be mapped.
 		 */
--- linux-qcom-6.8.0.orig/arch/arm64/net/bpf_jit_comp.c
+++ linux-qcom-6.8.0/arch/arm64/net/bpf_jit_comp.c
@@ -26,7 +26,7 @@
 
 #define TMP_REG_1 (MAX_BPF_JIT_REG + 0)
 #define TMP_REG_2 (MAX_BPF_JIT_REG + 1)
-#define TCALL_CNT (MAX_BPF_JIT_REG + 2)
+#define TCCNT_PTR (MAX_BPF_JIT_REG + 2)
 #define TMP_REG_3 (MAX_BPF_JIT_REG + 3)
 #define FP_BOTTOM (MAX_BPF_JIT_REG + 4)
 
@@ -62,8 +62,8 @@
 	[TMP_REG_1] = A64_R(10),
 	[TMP_REG_2] = A64_R(11),
 	[TMP_REG_3] = A64_R(12),
-	/* tail_call_cnt */
-	[TCALL_CNT] = A64_R(26),
+	/* tail_call_cnt_ptr */
+	[TCCNT_PTR] = A64_R(26),
 	/* temporary register for blinding constants */
 	[BPF_REG_AX] = A64_R(9),
 	[FP_BOTTOM] = A64_R(27),
@@ -269,13 +269,35 @@
  *      mov x29, sp
  *      stp x19, x20, [sp, #-16]!
  *      stp x21, x22, [sp, #-16]!
- *      stp x25, x26, [sp, #-16]!
+ *      stp x26, x25, [sp, #-16]!
+ *      stp x26, x25, [sp, #-16]!
  *      stp x27, x28, [sp, #-16]!
  *      mov x25, sp
  *      mov tcc, #0
  *      // PROLOGUE_OFFSET
  */
 
+static void prepare_bpf_tail_call_cnt(struct jit_ctx *ctx)
+{
+	const struct bpf_prog *prog = ctx->prog;
+	const bool is_main_prog = !bpf_is_subprog(prog);
+	const u8 ptr = bpf2a64[TCCNT_PTR];
+	const u8 fp = bpf2a64[BPF_REG_FP];
+	const u8 tcc = ptr;
+
+	emit(A64_PUSH(ptr, fp, A64_SP), ctx);
+	if (is_main_prog) {
+		/* Initialize tail_call_cnt. */
+		emit(A64_MOVZ(1, tcc, 0, 0), ctx);
+		emit(A64_PUSH(tcc, fp, A64_SP), ctx);
+		emit(A64_MOV(1, ptr, A64_SP), ctx);
+	} else {
+		emit(A64_PUSH(ptr, fp, A64_SP), ctx);
+		emit(A64_NOP, ctx);
+		emit(A64_NOP, ctx);
+	}
+}
+
 #define BTI_INSNS (IS_ENABLED(CONFIG_ARM64_BTI_KERNEL) ? 1 : 0)
 #define PAC_INSNS (IS_ENABLED(CONFIG_ARM64_PTR_AUTH_KERNEL) ? 1 : 0)
 
@@ -283,7 +305,7 @@
 #define POKE_OFFSET (BTI_INSNS + 1)
 
 /* Tail call offset to jump into */
-#define PROLOGUE_OFFSET (BTI_INSNS + 2 + PAC_INSNS + 8)
+#define PROLOGUE_OFFSET (BTI_INSNS + 2 + PAC_INSNS + 10)
 
 static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf)
 {
@@ -294,7 +316,6 @@
 	const u8 r8 = bpf2a64[BPF_REG_8];
 	const u8 r9 = bpf2a64[BPF_REG_9];
 	const u8 fp = bpf2a64[BPF_REG_FP];
-	const u8 tcc = bpf2a64[TCALL_CNT];
 	const u8 fpb = bpf2a64[FP_BOTTOM];
 	const int idx0 = ctx->idx;
 	int cur_offset;
@@ -344,16 +365,13 @@
 	/* Save callee-saved registers */
 	emit(A64_PUSH(r6, r7, A64_SP), ctx);
 	emit(A64_PUSH(r8, r9, A64_SP), ctx);
-	emit(A64_PUSH(fp, tcc, A64_SP), ctx);
+	prepare_bpf_tail_call_cnt(ctx);
 	emit(A64_PUSH(fpb, A64_R(28), A64_SP), ctx);
 
 	/* Set up BPF prog stack base register */
 	emit(A64_MOV(1, fp, A64_SP), ctx);
 
 	if (!ebpf_from_cbpf && is_main_prog) {
-		/* Initialize tail_call_cnt */
-		emit(A64_MOVZ(1, tcc, 0, 0), ctx);
-
 		cur_offset = ctx->idx - idx0;
 		if (cur_offset != PROLOGUE_OFFSET) {
 			pr_err_once("PROLOGUE_OFFSET = %d, expected %d!\n",
@@ -384,7 +402,8 @@
 
 	const u8 tmp = bpf2a64[TMP_REG_1];
 	const u8 prg = bpf2a64[TMP_REG_2];
-	const u8 tcc = bpf2a64[TCALL_CNT];
+	const u8 tcc = bpf2a64[TMP_REG_3];
+	const u8 ptr = bpf2a64[TCCNT_PTR];
 	const int idx0 = ctx->idx;
 #define cur_offset (ctx->idx - idx0)
 #define jmp_offset (out_offset - (cur_offset))
@@ -401,11 +420,12 @@
 	emit(A64_B_(A64_COND_CS, jmp_offset), ctx);
 
 	/*
-	 * if (tail_call_cnt >= MAX_TAIL_CALL_CNT)
+	 * if ((*tail_call_cnt_ptr) >= MAX_TAIL_CALL_CNT)
 	 *     goto out;
-	 * tail_call_cnt++;
+	 * (*tail_call_cnt_ptr)++;
 	 */
 	emit_a64_mov_i64(tmp, MAX_TAIL_CALL_CNT, ctx);
+	emit(A64_LDR64I(tcc, ptr, 0), ctx);
 	emit(A64_CMP(1, tcc, tmp), ctx);
 	emit(A64_B_(A64_COND_CS, jmp_offset), ctx);
 	emit(A64_ADD_I(1, tcc, tcc, 1), ctx);
@@ -421,6 +441,9 @@
 	emit(A64_LDR64(prg, tmp, prg), ctx);
 	emit(A64_CBZ(1, prg, jmp_offset), ctx);
 
+	/* Update tail_call_cnt if the slot is populated. */
+	emit(A64_STR64I(tcc, ptr, 0), ctx);
+
 	/* goto *(prog->bpf_func + prologue_offset); */
 	off = offsetof(struct bpf_prog, bpf_func);
 	emit_a64_mov_i64(tmp, off, ctx);
@@ -661,6 +684,7 @@
 	const u8 r8 = bpf2a64[BPF_REG_8];
 	const u8 r9 = bpf2a64[BPF_REG_9];
 	const u8 fp = bpf2a64[BPF_REG_FP];
+	const u8 ptr = bpf2a64[TCCNT_PTR];
 	const u8 fpb = bpf2a64[FP_BOTTOM];
 
 	/* We're done with BPF stack */
@@ -669,7 +693,8 @@
 	/* Restore x27 and x28 */
 	emit(A64_POP(fpb, A64_R(28), A64_SP), ctx);
 	/* Restore fs (x25) and x26 */
-	emit(A64_POP(fp, A64_R(26), A64_SP), ctx);
+	emit(A64_POP(ptr, fp, A64_SP), ctx);
+	emit(A64_POP(ptr, fp, A64_SP), ctx);
 
 	/* Restore callee-saved register */
 	emit(A64_POP(r8, r9, A64_SP), ctx);
@@ -876,7 +901,7 @@
 			emit(A64_UXTH(is64, dst, dst), ctx);
 			break;
 		case 32:
-			emit(A64_REV32(is64, dst, dst), ctx);
+			emit(A64_REV32(0, dst, dst), ctx);
 			/* upper 32 bits already cleared */
 			break;
 		case 64:
@@ -1189,7 +1214,7 @@
 			} else {
 				emit_a64_mov_i(1, tmp, off, ctx);
 				if (sign_extend)
-					emit(A64_LDRSW(dst, src_adj, off_adj), ctx);
+					emit(A64_LDRSW(dst, src, tmp), ctx);
 				else
 					emit(A64_LDR32(dst, src, tmp), ctx);
 			}
@@ -1648,7 +1673,8 @@
 			prog->jited_len = 0;
 			goto out_off;
 		}
-		bpf_jit_binary_lock_ro(header);
+		if (bpf_jit_binary_lock_ro(header))
+			goto out_off;
 	} else {
 		jit_data->ctx = ctx;
 		jit_data->image = image_ptr;
@@ -1738,15 +1764,15 @@
 
 	emit_call(enter_prog, ctx);
 
+	/* save return value to callee saved register x20 */
+	emit(A64_MOV(1, A64_R(20), A64_R(0)), ctx);
+
 	/* if (__bpf_prog_enter(prog) == 0)
 	 *         goto skip_exec_of_prog;
 	 */
 	branch = ctx->image + ctx->idx;
 	emit(A64_NOP, ctx);
 
-	/* save return value to callee saved register x20 */
-	emit(A64_MOV(1, A64_R(20), A64_R(0)), ctx);
-
 	emit(A64_ADD_I(1, A64_R(0), A64_SP, args_off), ctx);
 	if (!p->jited)
 		emit_addr_mov_i64(A64_R(1), (const u64)p->insnsi, ctx);
@@ -1816,6 +1842,12 @@
 	}
 }
 
+static bool is_struct_ops_tramp(const struct bpf_tramp_links *fentry_links)
+{
+	return fentry_links->nr_links == 1 &&
+		fentry_links->links[0]->link.type == BPF_LINK_TYPE_STRUCT_OPS;
+}
+
 /* Based on the x86's implementation of arch_prepare_bpf_trampoline().
  *
  * bpf prog and function entry before bpf trampoline hooked:
@@ -1845,6 +1877,7 @@
 	struct bpf_tramp_links *fmod_ret = &tlinks[BPF_TRAMP_MODIFY_RETURN];
 	bool save_ret;
 	__le32 **branches = NULL;
+	bool is_struct_ops = is_struct_ops_tramp(fentry);
 
 	/* trampoline stack layout:
 	 *                  [ parent ip         ]
@@ -1913,11 +1946,14 @@
 	 */
 	emit_bti(A64_BTI_JC, ctx);
 
-	/* frame for parent function */
-	emit(A64_PUSH(A64_FP, A64_R(9), A64_SP), ctx);
-	emit(A64_MOV(1, A64_FP, A64_SP), ctx);
+	/* x9 is not set for struct_ops */
+	if (!is_struct_ops) {
+		/* frame for parent function */
+		emit(A64_PUSH(A64_FP, A64_R(9), A64_SP), ctx);
+		emit(A64_MOV(1, A64_FP, A64_SP), ctx);
+	}
 
-	/* frame for patched function */
+	/* frame for patched function for tracing, or caller for struct_ops */
 	emit(A64_PUSH(A64_FP, A64_LR, A64_SP), ctx);
 	emit(A64_MOV(1, A64_FP, A64_SP), ctx);
 
@@ -1942,7 +1978,11 @@
 	emit(A64_STR64I(A64_R(20), A64_SP, regs_off + 8), ctx);
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
-		emit_addr_mov_i64(A64_R(0), (const u64)im, ctx);
+		/* for the first pass, assume the worst case */
+		if (!ctx->image)
+			ctx->idx += 4;
+		else
+			emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
 		emit_call((const u64)__bpf_tramp_enter, ctx);
 	}
 
@@ -1986,7 +2026,11 @@
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
 		im->ip_epilogue = ctx->image + ctx->idx;
-		emit_addr_mov_i64(A64_R(0), (const u64)im, ctx);
+		/* for the first pass, assume the worst case */
+		if (!ctx->image)
+			ctx->idx += 4;
+		else
+			emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
 		emit_call((const u64)__bpf_tramp_exit, ctx);
 	}
 
@@ -2003,19 +2047,24 @@
 	/* reset SP  */
 	emit(A64_MOV(1, A64_SP, A64_FP), ctx);
 
-	/* pop frames  */
-	emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx);
-	emit(A64_POP(A64_FP, A64_R(9), A64_SP), ctx);
-
-	if (flags & BPF_TRAMP_F_SKIP_FRAME) {
-		/* skip patched function, return to parent */
-		emit(A64_MOV(1, A64_LR, A64_R(9)), ctx);
-		emit(A64_RET(A64_R(9)), ctx);
+	if (is_struct_ops) {
+		emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx);
+		emit(A64_RET(A64_LR), ctx);
 	} else {
-		/* return to patched function */
-		emit(A64_MOV(1, A64_R(10), A64_LR), ctx);
-		emit(A64_MOV(1, A64_LR, A64_R(9)), ctx);
-		emit(A64_RET(A64_R(10)), ctx);
+		/* pop frames */
+		emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx);
+		emit(A64_POP(A64_FP, A64_R(9), A64_SP), ctx);
+
+		if (flags & BPF_TRAMP_F_SKIP_FRAME) {
+			/* skip patched function, return to parent */
+			emit(A64_MOV(1, A64_LR, A64_R(9)), ctx);
+			emit(A64_RET(A64_R(9)), ctx);
+		} else {
+			/* return to patched function */
+			emit(A64_MOV(1, A64_R(10), A64_LR), ctx);
+			emit(A64_MOV(1, A64_LR, A64_R(9)), ctx);
+			emit(A64_RET(A64_R(10)), ctx);
+		}
 	}
 
 	if (ctx->image)
--- linux-qcom-6.8.0.orig/arch/arm64/tools/cpucaps
+++ linux-qcom-6.8.0/arch/arm64/tools/cpucaps
@@ -99,4 +99,5 @@
 WORKAROUND_QCOM_FALKOR_E1003
 WORKAROUND_REPEAT_TLBI
 WORKAROUND_SPECULATIVE_AT
+WORKAROUND_SPECULATIVE_SSBS
 WORKAROUND_SPECULATIVE_UNPRIV_LOAD
--- linux-qcom-6.8.0.orig/arch/csky/include/uapi/asm/unistd.h
+++ linux-qcom-6.8.0/arch/csky/include/uapi/asm/unistd.h
@@ -6,6 +6,7 @@
 #define __ARCH_WANT_SYS_CLONE3
 #define __ARCH_WANT_SET_GET_RLIMIT
 #define __ARCH_WANT_TIME32_SYSCALLS
+#define __ARCH_WANT_SYNC_FILE_RANGE2
 #include <asm-generic/unistd.h>
 
 #define __NR_set_thread_area	(__NR_arch_specific_syscall + 0)
--- linux-qcom-6.8.0.orig/arch/csky/kernel/probes/ftrace.c
+++ linux-qcom-6.8.0/arch/csky/kernel/probes/ftrace.c
@@ -12,6 +12,9 @@
 	struct kprobe_ctlblk *kcb;
 	struct pt_regs *regs;
 
+	if (unlikely(kprobe_ftrace_disabled))
+		return;
+
 	bit = ftrace_test_recursion_trylock(ip, parent_ip);
 	if (bit < 0)
 		return;
--- linux-qcom-6.8.0.orig/arch/csky/kernel/setup.c
+++ linux-qcom-6.8.0/arch/csky/kernel/setup.c
@@ -112,9 +112,9 @@
 	pre_trap_init();
 
 	if (dtb_start == NULL)
-		early_init_dt_scan(__dtb_start);
+		early_init_dt_scan(__dtb_start, __pa(dtb_start));
 	else
-		early_init_dt_scan(dtb_start);
+		early_init_dt_scan(dtb_start, __pa(dtb_start));
 
 	start_kernel();
 
--- linux-qcom-6.8.0.orig/arch/hexagon/Makefile
+++ linux-qcom-6.8.0/arch/hexagon/Makefile
@@ -32,3 +32,9 @@
 TIR_NAME := r19
 KBUILD_CFLAGS += -ffixed-$(TIR_NAME) -DTHREADINFO_REG=$(TIR_NAME) -D__linux__
 KBUILD_AFLAGS += -DTHREADINFO_REG=$(TIR_NAME)
+
+# Disable HexagonConstExtenders pass for LLVM versions prior to 19.1.0
+# https://github.com/llvm/llvm-project/issues/99714
+ifneq ($(call clang-min-version, 190100),y)
+KBUILD_CFLAGS += -mllvm -hexagon-cext=false
+endif
--- linux-qcom-6.8.0.orig/arch/hexagon/include/asm/syscalls.h
+++ linux-qcom-6.8.0/arch/hexagon/include/asm/syscalls.h
@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#include <asm-generic/syscalls.h>
+
+asmlinkage long sys_hexagon_fadvise64_64(int fd, int advice,
+	                                  u32 a2, u32 a3, u32 a4, u32 a5);
--- linux-qcom-6.8.0.orig/arch/hexagon/include/uapi/asm/unistd.h
+++ linux-qcom-6.8.0/arch/hexagon/include/uapi/asm/unistd.h
@@ -36,5 +36,6 @@
 #define __ARCH_WANT_SYS_VFORK
 #define __ARCH_WANT_SYS_FORK
 #define __ARCH_WANT_TIME32_SYSCALLS
+#define __ARCH_WANT_SYNC_FILE_RANGE2
 
 #include <asm-generic/unistd.h>
--- linux-qcom-6.8.0.orig/arch/hexagon/kernel/syscalltab.c
+++ linux-qcom-6.8.0/arch/hexagon/kernel/syscalltab.c
@@ -14,6 +14,13 @@
 #undef __SYSCALL
 #define __SYSCALL(nr, call) [nr] = (call),
 
+SYSCALL_DEFINE6(hexagon_fadvise64_64, int, fd, int, advice,
+		SC_ARG64(offset), SC_ARG64(len))
+{
+	return ksys_fadvise64_64(fd, SC_VAL64(loff_t, offset), SC_VAL64(loff_t, len), advice);
+}
+#define sys_fadvise64_64 sys_hexagon_fadvise64_64
+
 void *sys_call_table[__NR_syscalls] = {
 #include <asm/unistd.h>
 };
--- linux-qcom-6.8.0.orig/arch/hexagon/kernel/vmlinux.lds.S
+++ linux-qcom-6.8.0/arch/hexagon/kernel/vmlinux.lds.S
@@ -63,6 +63,7 @@
 	STABS_DEBUG
 	DWARF_DEBUG
 	ELF_DETAILS
+	.hexagon.attributes 0 : { *(.hexagon.attributes) }
 
 	DISCARDS
 }
--- linux-qcom-6.8.0.orig/arch/loongarch/boot/dts/loongson-2k0500-ref.dts
+++ linux-qcom-6.8.0/arch/loongarch/boot/dts/loongson-2k0500-ref.dts
@@ -44,14 +44,14 @@
 &gmac0 {
 	status = "okay";
 
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	bus_id = <0x0>;
 };
 
 &gmac1 {
 	status = "okay";
 
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	bus_id = <0x1>;
 };
 
--- linux-qcom-6.8.0.orig/arch/loongarch/boot/dts/loongson-2k1000-ref.dts
+++ linux-qcom-6.8.0/arch/loongarch/boot/dts/loongson-2k1000-ref.dts
@@ -43,7 +43,7 @@
 &gmac0 {
 	status = "okay";
 
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-handle = <&phy0>;
 	mdio {
 		compatible = "snps,dwmac-mdio";
@@ -58,7 +58,7 @@
 &gmac1 {
 	status = "okay";
 
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-handle = <&phy1>;
 	mdio {
 		compatible = "snps,dwmac-mdio";
--- linux-qcom-6.8.0.orig/arch/loongarch/configs/loongson3_defconfig
+++ linux-qcom-6.8.0/arch/loongarch/configs/loongson3_defconfig
@@ -93,7 +93,6 @@
 CONFIG_ZSWAP=y
 CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD=y
 CONFIG_ZBUD=y
-CONFIG_Z3FOLD=y
 CONFIG_ZSMALLOC=m
 # CONFIG_COMPAT_BRK is not set
 CONFIG_MEMORY_HOTPLUG=y
--- linux-qcom-6.8.0.orig/arch/loongarch/crypto/crc32-loongarch.c
+++ linux-qcom-6.8.0/arch/loongarch/crypto/crc32-loongarch.c
@@ -44,7 +44,6 @@
 
 		CRC32(crc, value, w);
 		p += sizeof(u32);
-		len -= sizeof(u32);
 	}
 
 	if (len & sizeof(u16)) {
@@ -80,7 +79,6 @@
 
 		CRC32C(crc, value, w);
 		p += sizeof(u32);
-		len -= sizeof(u32);
 	}
 
 	if (len & sizeof(u16)) {
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/Kbuild
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/Kbuild
@@ -4,6 +4,7 @@
 generic-y += parport.h
 generic-y += early_ioremap.h
 generic-y += qrwlock.h
+generic-y += qspinlock.h
 generic-y += rwsem.h
 generic-y += segment.h
 generic-y += user.h
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/bootinfo.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/bootinfo.h
@@ -26,6 +26,10 @@
 
 #define NR_WORDS DIV_ROUND_UP(NR_CPUS, BITS_PER_LONG)
 
+/*
+ * The "core" of cores_per_node and cores_per_package stands for a
+ * logical core, which means in a SMT system it stands for a thread.
+ */
 struct loongson_system_configuration {
 	int nr_cpus;
 	int nr_nodes;
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/hugetlb.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/hugetlb.h
@@ -29,12 +29,22 @@
 	return 0;
 }
 
+#define __HAVE_ARCH_HUGE_PTE_CLEAR
+static inline void huge_pte_clear(struct mm_struct *mm, unsigned long addr,
+				  pte_t *ptep, unsigned long sz)
+{
+	pte_t clear;
+
+	pte_val(clear) = (unsigned long)invalid_pte_table;
+	set_pte_at(mm, addr, ptep, clear);
+}
+
 #define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR
 static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
 					    unsigned long addr, pte_t *ptep)
 {
 	pte_t clear;
-	pte_t pte = *ptep;
+	pte_t pte = ptep_get(ptep);
 
 	pte_val(clear) = (unsigned long)invalid_pte_table;
 	set_pte_at(mm, addr, ptep, clear);
@@ -65,7 +75,7 @@
 					     pte_t *ptep, pte_t pte,
 					     int dirty)
 {
-	int changed = !pte_same(*ptep, pte);
+	int changed = !pte_same(ptep_get(ptep), pte);
 
 	if (changed) {
 		set_pte_at(vma->vm_mm, addr, ptep, pte);
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/hw_breakpoint.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/hw_breakpoint.h
@@ -75,6 +75,8 @@
 #define CSR_MWPC_NUM		0x3f
 
 #define CTRL_PLV_ENABLE		0x1e
+#define CTRL_PLV0_ENABLE	0x02
+#define CTRL_PLV3_ENABLE	0x10
 
 #define MWPnCFG3_LoadEn		8
 #define MWPnCFG3_StoreEn	9
@@ -101,7 +103,7 @@
 struct perf_event_attr;
 
 extern int arch_bp_generic_fields(struct arch_hw_breakpoint_ctrl ctrl,
-				  int *gen_len, int *gen_type, int *offset);
+				  int *gen_len, int *gen_type);
 extern int arch_check_bp_in_kernelspace(struct arch_hw_breakpoint *hw);
 extern int hw_breakpoint_arch_parse(struct perf_event *bp,
 				    const struct perf_event_attr *attr,
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/hw_irq.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/hw_irq.h
@@ -9,6 +9,8 @@
 
 extern atomic_t irq_err_count;
 
+#define ARCH_IRQ_INIT_FLAGS	IRQ_NOPROBE
+
 /*
  * interrupt-retrigger: NOP for now. This may not be appropriate for all
  * machines, we'll see ...
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/inst.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/inst.h
@@ -678,7 +678,17 @@
 DEF_EMIT_REG2I16_FORMAT(bge, bge_op)
 DEF_EMIT_REG2I16_FORMAT(bltu, bltu_op)
 DEF_EMIT_REG2I16_FORMAT(bgeu, bgeu_op)
-DEF_EMIT_REG2I16_FORMAT(jirl, jirl_op)
+
+static inline void emit_jirl(union loongarch_instruction *insn,
+			     enum loongarch_gpr rd,
+			     enum loongarch_gpr rj,
+			     int offset)
+{
+	insn->reg2i16_format.opcode = jirl_op;
+	insn->reg2i16_format.immediate = offset;
+	insn->reg2i16_format.rd = rd;
+	insn->reg2i16_format.rj = rj;
+}
 
 #define DEF_EMIT_REG2BSTRD_FORMAT(NAME, OP)				\
 static inline void emit_##NAME(union loongarch_instruction *insn,	\
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/io.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/io.h
@@ -71,6 +71,8 @@
 #define memcpy_fromio(a, c, l) __memcpy_fromio((a), (c), (l))
 #define memcpy_toio(c, a, l)   __memcpy_toio((c), (a), (l))
 
+#define __io_aw() mmiowb()
+
 #include <asm-generic/io.h>
 
 #define ARCH_HAS_VALID_PHYS_ADDR_RANGE
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/kasan.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/kasan.h
@@ -16,7 +16,7 @@
 #define XRANGE_SHIFT (48)
 
 /* Valid address length */
-#define XRANGE_SHADOW_SHIFT	(PGDIR_SHIFT + PAGE_SHIFT - 3)
+#define XRANGE_SHADOW_SHIFT	min(cpu_vabits, VA_BITS)
 /* Used for taking out the valid address */
 #define XRANGE_SHADOW_MASK	GENMASK_ULL(XRANGE_SHADOW_SHIFT - 1, 0)
 /* One segment whole address space size */
@@ -25,6 +25,7 @@
 /* 64-bit segment value. */
 #define XKPRANGE_UC_SEG		(0x8000)
 #define XKPRANGE_CC_SEG		(0x9000)
+#define XKPRANGE_WC_SEG		(0xa000)
 #define XKVRANGE_VC_SEG		(0xffff)
 
 /* Cached */
@@ -41,20 +42,28 @@
 #define XKPRANGE_UC_SHADOW_SIZE		(XKPRANGE_UC_SIZE >> KASAN_SHADOW_SCALE_SHIFT)
 #define XKPRANGE_UC_SHADOW_END		(XKPRANGE_UC_KASAN_OFFSET + XKPRANGE_UC_SHADOW_SIZE)
 
+/* WriteCombine */
+#define XKPRANGE_WC_START		WRITECOMBINE_BASE
+#define XKPRANGE_WC_SIZE		XRANGE_SIZE
+#define XKPRANGE_WC_KASAN_OFFSET	XKPRANGE_UC_SHADOW_END
+#define XKPRANGE_WC_SHADOW_SIZE		(XKPRANGE_WC_SIZE >> KASAN_SHADOW_SCALE_SHIFT)
+#define XKPRANGE_WC_SHADOW_END		(XKPRANGE_WC_KASAN_OFFSET + XKPRANGE_WC_SHADOW_SIZE)
+
 /* VMALLOC (Cached or UnCached)  */
 #define XKVRANGE_VC_START		MODULES_VADDR
 #define XKVRANGE_VC_SIZE		round_up(KFENCE_AREA_END - MODULES_VADDR + 1, PGDIR_SIZE)
-#define XKVRANGE_VC_KASAN_OFFSET	XKPRANGE_UC_SHADOW_END
+#define XKVRANGE_VC_KASAN_OFFSET	XKPRANGE_WC_SHADOW_END
 #define XKVRANGE_VC_SHADOW_SIZE		(XKVRANGE_VC_SIZE >> KASAN_SHADOW_SCALE_SHIFT)
 #define XKVRANGE_VC_SHADOW_END		(XKVRANGE_VC_KASAN_OFFSET + XKVRANGE_VC_SHADOW_SIZE)
 
 /* KAsan shadow memory start right after vmalloc. */
 #define KASAN_SHADOW_START		round_up(KFENCE_AREA_END, PGDIR_SIZE)
 #define KASAN_SHADOW_SIZE		(XKVRANGE_VC_SHADOW_END - XKPRANGE_CC_KASAN_OFFSET)
-#define KASAN_SHADOW_END		round_up(KASAN_SHADOW_START + KASAN_SHADOW_SIZE, PGDIR_SIZE)
+#define KASAN_SHADOW_END		(round_up(KASAN_SHADOW_START + KASAN_SHADOW_SIZE, PGDIR_SIZE) - 1)
 
 #define XKPRANGE_CC_SHADOW_OFFSET	(KASAN_SHADOW_START + XKPRANGE_CC_KASAN_OFFSET)
 #define XKPRANGE_UC_SHADOW_OFFSET	(KASAN_SHADOW_START + XKPRANGE_UC_KASAN_OFFSET)
+#define XKPRANGE_WC_SHADOW_OFFSET	(KASAN_SHADOW_START + XKPRANGE_WC_KASAN_OFFSET)
 #define XKVRANGE_VC_SHADOW_OFFSET	(KASAN_SHADOW_START + XKVRANGE_VC_KASAN_OFFSET)
 
 extern bool kasan_early_stage;
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/kfence.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/kfence.h
@@ -43,13 +43,13 @@
 {
 	pte_t *pte = virt_to_kpte(addr);
 
-	if (WARN_ON(!pte) || pte_none(*pte))
+	if (WARN_ON(!pte) || pte_none(ptep_get(pte)))
 		return false;
 
 	if (protect)
-		set_pte(pte, __pte(pte_val(*pte) & ~(_PAGE_VALID | _PAGE_PRESENT)));
+		set_pte(pte, __pte(pte_val(ptep_get(pte)) & ~(_PAGE_VALID | _PAGE_PRESENT)));
 	else
-		set_pte(pte, __pte(pte_val(*pte) | (_PAGE_VALID | _PAGE_PRESENT)));
+		set_pte(pte, __pte(pte_val(ptep_get(pte)) | (_PAGE_VALID | _PAGE_PRESENT)));
 
 	preempt_disable();
 	local_flush_tlb_one(addr);
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/loongarch.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/loongarch.h
@@ -243,7 +243,7 @@
 #define  CSR_ESTAT_IS_WIDTH		14
 #define  CSR_ESTAT_IS			(_ULCAST_(0x3fff) << CSR_ESTAT_IS_SHIFT)
 
-#define LOONGARCH_CSR_ERA		0x6	/* ERA */
+#define LOONGARCH_CSR_ERA		0x6	/* Exception return address */
 
 #define LOONGARCH_CSR_BADV		0x7	/* Bad virtual address */
 
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/numa.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/numa.h
@@ -56,6 +56,7 @@
 static inline void early_numa_add_cpu(int cpuid, s16 node)	{ }
 static inline void numa_add_cpu(unsigned int cpu)		{ }
 static inline void numa_remove_cpu(unsigned int cpu)		{ }
+static inline void set_cpuid_to_node(int cpuid, s16 node)	{ }
 
 static inline int early_cpu_to_node(int cpu)
 {
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/page.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/page.h
@@ -94,10 +94,7 @@
 extern int __virt_addr_valid(volatile void *kaddr);
 #define virt_addr_valid(kaddr)	__virt_addr_valid((volatile void *)(kaddr))
 
-#define VM_DATA_DEFAULT_FLAGS \
-	(VM_READ | VM_WRITE | \
-	 ((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-	 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+#define VM_DATA_DEFAULT_FLAGS	VM_DATA_FLAGS_TSK_EXEC
 
 #include <asm-generic/memory_model.h>
 #include <asm-generic/getorder.h>
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/percpu.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/percpu.h
@@ -29,7 +29,12 @@
 	__my_cpu_offset = off;
 	csr_write64(off, PERCPU_BASE_KS);
 }
-#define __my_cpu_offset __my_cpu_offset
+
+#define __my_cpu_offset					\
+({							\
+	__asm__ __volatile__("":"+r"(__my_cpu_offset));	\
+	__my_cpu_offset;				\
+})
 
 #define PERCPU_OP(op, asm_op, c_op)					\
 static __always_inline unsigned long __percpu_##op(void *ptr,		\
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/perf_event.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/perf_event.h
@@ -7,6 +7,13 @@
 #ifndef __LOONGARCH_PERF_EVENT_H__
 #define __LOONGARCH_PERF_EVENT_H__
 
+#include <asm/ptrace.h>
+
 #define perf_arch_bpf_user_pt_regs(regs) (struct user_pt_regs *)regs
 
+#define perf_arch_fetch_caller_regs(regs, __ip) { \
+	(regs)->csr_era = (__ip); \
+	(regs)->regs[3] = (unsigned long) __builtin_frame_address(0); \
+}
+
 #endif /* __LOONGARCH_PERF_EVENT_H__ */
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/pgtable.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/pgtable.h
@@ -106,6 +106,9 @@
 #define KFENCE_AREA_START	(VMEMMAP_END + 1)
 #define KFENCE_AREA_END		(KFENCE_AREA_START + KFENCE_AREA_SIZE - 1)
 
+#define ptep_get(ptep) READ_ONCE(*(ptep))
+#define pmdp_get(pmdp) READ_ONCE(*(pmdp))
+
 #define pte_ERROR(e) \
 	pr_err("%s:%d: bad pte %016lx.\n", __FILE__, __LINE__, pte_val(e))
 #ifndef __PAGETABLE_PMD_FOLDED
@@ -147,11 +150,6 @@
 	return p4d_val(p4d) != (unsigned long)invalid_pud_table;
 }
 
-static inline void p4d_clear(p4d_t *p4dp)
-{
-	p4d_val(*p4dp) = (unsigned long)invalid_pud_table;
-}
-
 static inline pud_t *p4d_pgtable(p4d_t p4d)
 {
 	return (pud_t *)p4d_val(p4d);
@@ -159,7 +157,12 @@
 
 static inline void set_p4d(p4d_t *p4d, p4d_t p4dval)
 {
-	*p4d = p4dval;
+	WRITE_ONCE(*p4d, p4dval);
+}
+
+static inline void p4d_clear(p4d_t *p4dp)
+{
+	set_p4d(p4dp, __p4d((unsigned long)invalid_pud_table));
 }
 
 #define p4d_phys(p4d)		PHYSADDR(p4d_val(p4d))
@@ -193,17 +196,20 @@
 	return pud_val(pud) != (unsigned long)invalid_pmd_table;
 }
 
-static inline void pud_clear(pud_t *pudp)
+static inline pmd_t *pud_pgtable(pud_t pud)
 {
-	pud_val(*pudp) = ((unsigned long)invalid_pmd_table);
+	return (pmd_t *)pud_val(pud);
 }
 
-static inline pmd_t *pud_pgtable(pud_t pud)
+static inline void set_pud(pud_t *pud, pud_t pudval)
 {
-	return (pmd_t *)pud_val(pud);
+	WRITE_ONCE(*pud, pudval);
 }
 
-#define set_pud(pudptr, pudval) do { *(pudptr) = (pudval); } while (0)
+static inline void pud_clear(pud_t *pudp)
+{
+	set_pud(pudp, __pud((unsigned long)invalid_pmd_table));
+}
 
 #define pud_phys(pud)		PHYSADDR(pud_val(pud))
 #define pud_page(pud)		(pfn_to_page(pud_phys(pud) >> PAGE_SHIFT))
@@ -231,12 +237,15 @@
 	return pmd_val(pmd) != (unsigned long)invalid_pte_table;
 }
 
-static inline void pmd_clear(pmd_t *pmdp)
+static inline void set_pmd(pmd_t *pmd, pmd_t pmdval)
 {
-	pmd_val(*pmdp) = ((unsigned long)invalid_pte_table);
+	WRITE_ONCE(*pmd, pmdval);
 }
 
-#define set_pmd(pmdptr, pmdval) do { *(pmdptr) = (pmdval); } while (0)
+static inline void pmd_clear(pmd_t *pmdp)
+{
+	set_pmd(pmdp, __pmd((unsigned long)invalid_pte_table));
+}
 
 #define pmd_phys(pmd)		PHYSADDR(pmd_val(pmd))
 
@@ -314,7 +323,8 @@
 
 static inline void set_pte(pte_t *ptep, pte_t pteval)
 {
-	*ptep = pteval;
+	WRITE_ONCE(*ptep, pteval);
+
 	if (pte_val(pteval) & _PAGE_GLOBAL) {
 		pte_t *buddy = ptep_buddy(ptep);
 		/*
@@ -341,8 +351,8 @@
 		: [buddy] "+m" (buddy->pte), [tmp] "=&r" (tmp)
 		: [global] "r" (page_global));
 #else /* !CONFIG_SMP */
-		if (pte_none(*buddy))
-			pte_val(*buddy) = pte_val(*buddy) | _PAGE_GLOBAL;
+		if (pte_none(ptep_get(buddy)))
+			WRITE_ONCE(*buddy, __pte(pte_val(ptep_get(buddy)) | _PAGE_GLOBAL));
 #endif /* CONFIG_SMP */
 	}
 }
@@ -350,7 +360,7 @@
 static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
 	/* Preserve global status for the pair */
-	if (pte_val(*ptep_buddy(ptep)) & _PAGE_GLOBAL)
+	if (pte_val(ptep_get(ptep_buddy(ptep))) & _PAGE_GLOBAL)
 		set_pte(ptep, __pte(_PAGE_GLOBAL));
 	else
 		set_pte(ptep, __pte(0));
@@ -592,7 +602,7 @@
 static inline pmd_t pmdp_huge_get_and_clear(struct mm_struct *mm,
 					    unsigned long address, pmd_t *pmdp)
 {
-	pmd_t old = *pmdp;
+	pmd_t old = pmdp_get(pmdp);
 
 	pmd_clear(pmdp);
 
--- linux-qcom-6.8.0.orig/arch/loongarch/include/asm/stackframe.h
+++ linux-qcom-6.8.0/arch/loongarch/include/asm/stackframe.h
@@ -41,7 +41,7 @@
 	.macro JUMP_VIRT_ADDR temp1 temp2
 	li.d	\temp1, CACHE_BASE
 	pcaddi	\temp2, 0
-	or	\temp1, \temp1, \temp2
+	bstrins.d  \temp1, \temp2, (DMW_PABITS - 1), 0
 	jirl	zero, \temp1, 0xc
 	.endm
 
--- linux-qcom-6.8.0.orig/arch/loongarch/include/uapi/asm/unistd.h
+++ linux-qcom-6.8.0/arch/loongarch/include/uapi/asm/unistd.h
@@ -1,4 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#define __ARCH_WANT_NEW_STAT
 #define __ARCH_WANT_SYS_CLONE
 #define __ARCH_WANT_SYS_CLONE3
 
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/efi.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/efi.c
@@ -66,6 +66,12 @@
 	set_bit(EFI_RUNTIME_SERVICES, &efi.flags);
 }
 
+bool efi_poweroff_required(void)
+{
+	return efi_enabled(EFI_RUNTIME_SERVICES) &&
+		(acpi_gbl_reduced_hardware || acpi_no_s5);
+}
+
 unsigned long __initdata screen_info_table = EFI_INVALID_TABLE_ADDR;
 
 #if defined(CONFIG_SYSFB) || defined(CONFIG_EFI_EARLYCON)
@@ -89,7 +95,7 @@
 	memset(si, 0, sizeof(*si));
 	early_memunmap(si, sizeof(*si));
 
-	memblock_reserve(screen_info.lfb_base, screen_info.lfb_size);
+	memblock_reserve(__screen_info_lfb_base(&screen_info), screen_info.lfb_size);
 }
 
 void __init efi_init(void)
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/ftrace_dyn.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/ftrace_dyn.c
@@ -287,6 +287,9 @@
 	struct kprobe *p;
 	struct kprobe_ctlblk *kcb;
 
+	if (unlikely(kprobe_ftrace_disabled))
+		return;
+
 	bit = ftrace_test_recursion_trylock(ip, parent_ip);
 	if (bit < 0)
 		return;
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/head.S
+++ linux-qcom-6.8.0/arch/loongarch/kernel/head.S
@@ -22,7 +22,7 @@
 _head:
 	.word	MZ_MAGIC		/* "MZ", MS-DOS header */
 	.org	0x8
-	.dword	kernel_entry		/* Kernel entry point */
+	.dword	_kernel_entry		/* Kernel entry point (physical address) */
 	.dword	_kernel_asize		/* Kernel image effective size */
 	.quad	PHYS_LINK_KADDR		/* Kernel image load offset from start of RAM */
 	.org	0x38			/* 0x20 ~ 0x37 reserved */
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/hw_breakpoint.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/hw_breakpoint.c
@@ -174,11 +174,21 @@
 static int hw_breakpoint_control(struct perf_event *bp,
 				 enum hw_breakpoint_ops ops)
 {
-	u32 ctrl;
+	u32 ctrl, privilege;
 	int i, max_slots, enable;
+	struct pt_regs *regs;
 	struct perf_event **slots;
 	struct arch_hw_breakpoint *info = counter_arch_bp(bp);
 
+	if (arch_check_bp_in_kernelspace(info))
+		privilege = CTRL_PLV0_ENABLE;
+	else
+		privilege = CTRL_PLV3_ENABLE;
+
+	/*  Whether bp belongs to a task. */
+	if (bp->hw.target)
+		regs = task_pt_regs(bp->hw.target);
+
 	if (info->ctrl.type == LOONGARCH_BREAKPOINT_EXECUTE) {
 		/* Breakpoint */
 		slots = this_cpu_ptr(bp_on_reg);
@@ -197,31 +207,38 @@
 	switch (ops) {
 	case HW_BREAKPOINT_INSTALL:
 		/* Set the FWPnCFG/MWPnCFG 1~4 register. */
-		write_wb_reg(CSR_CFG_ADDR, i, 0, info->address);
-		write_wb_reg(CSR_CFG_ADDR, i, 1, info->address);
-		write_wb_reg(CSR_CFG_MASK, i, 0, info->mask);
-		write_wb_reg(CSR_CFG_MASK, i, 1, info->mask);
-		write_wb_reg(CSR_CFG_ASID, i, 0, 0);
-		write_wb_reg(CSR_CFG_ASID, i, 1, 0);
 		if (info->ctrl.type == LOONGARCH_BREAKPOINT_EXECUTE) {
-			write_wb_reg(CSR_CFG_CTRL, i, 0, CTRL_PLV_ENABLE);
+			write_wb_reg(CSR_CFG_ADDR, i, 0, info->address);
+			write_wb_reg(CSR_CFG_MASK, i, 0, info->mask);
+			write_wb_reg(CSR_CFG_ASID, i, 0, 0);
+			write_wb_reg(CSR_CFG_CTRL, i, 0, privilege);
 		} else {
+			write_wb_reg(CSR_CFG_ADDR, i, 1, info->address);
+			write_wb_reg(CSR_CFG_MASK, i, 1, info->mask);
+			write_wb_reg(CSR_CFG_ASID, i, 1, 0);
 			ctrl = encode_ctrl_reg(info->ctrl);
-			write_wb_reg(CSR_CFG_CTRL, i, 1, ctrl | CTRL_PLV_ENABLE);
+			write_wb_reg(CSR_CFG_CTRL, i, 1, ctrl | privilege);
 		}
 		enable = csr_read64(LOONGARCH_CSR_CRMD);
 		csr_write64(CSR_CRMD_WE | enable, LOONGARCH_CSR_CRMD);
+		if (bp->hw.target && test_tsk_thread_flag(bp->hw.target, TIF_LOAD_WATCH))
+			regs->csr_prmd |= CSR_PRMD_PWE;
 		break;
 	case HW_BREAKPOINT_UNINSTALL:
 		/* Reset the FWPnCFG/MWPnCFG 1~4 register. */
-		write_wb_reg(CSR_CFG_ADDR, i, 0, 0);
-		write_wb_reg(CSR_CFG_ADDR, i, 1, 0);
-		write_wb_reg(CSR_CFG_MASK, i, 0, 0);
-		write_wb_reg(CSR_CFG_MASK, i, 1, 0);
-		write_wb_reg(CSR_CFG_CTRL, i, 0, 0);
-		write_wb_reg(CSR_CFG_CTRL, i, 1, 0);
-		write_wb_reg(CSR_CFG_ASID, i, 0, 0);
-		write_wb_reg(CSR_CFG_ASID, i, 1, 0);
+		if (info->ctrl.type == LOONGARCH_BREAKPOINT_EXECUTE) {
+			write_wb_reg(CSR_CFG_ADDR, i, 0, 0);
+			write_wb_reg(CSR_CFG_MASK, i, 0, 0);
+			write_wb_reg(CSR_CFG_CTRL, i, 0, 0);
+			write_wb_reg(CSR_CFG_ASID, i, 0, 0);
+		} else {
+			write_wb_reg(CSR_CFG_ADDR, i, 1, 0);
+			write_wb_reg(CSR_CFG_MASK, i, 1, 0);
+			write_wb_reg(CSR_CFG_CTRL, i, 1, 0);
+			write_wb_reg(CSR_CFG_ASID, i, 1, 0);
+		}
+		if (bp->hw.target)
+			regs->csr_prmd &= ~CSR_PRMD_PWE;
 		break;
 	}
 
@@ -283,7 +300,7 @@
  * to generic breakpoint descriptions.
  */
 int arch_bp_generic_fields(struct arch_hw_breakpoint_ctrl ctrl,
-			   int *gen_len, int *gen_type, int *offset)
+			   int *gen_len, int *gen_type)
 {
 	/* Type */
 	switch (ctrl.type) {
@@ -303,11 +320,6 @@
 		return -EINVAL;
 	}
 
-	if (!ctrl.len)
-		return -EINVAL;
-
-	*offset = __ffs(ctrl.len);
-
 	/* Len */
 	switch (ctrl.len) {
 	case LOONGARCH_BREAKPOINT_LEN_1:
@@ -386,21 +398,17 @@
 			     struct arch_hw_breakpoint *hw)
 {
 	int ret;
-	u64 alignment_mask, offset;
+	u64 alignment_mask;
 
 	/* Build the arch_hw_breakpoint. */
 	ret = arch_build_bp_info(bp, attr, hw);
 	if (ret)
 		return ret;
 
-	if (hw->ctrl.type != LOONGARCH_BREAKPOINT_EXECUTE)
-		alignment_mask = 0x7;
-	else
+	if (hw->ctrl.type == LOONGARCH_BREAKPOINT_EXECUTE) {
 		alignment_mask = 0x3;
-	offset = hw->address & alignment_mask;
-
-	hw->address &= ~alignment_mask;
-	hw->ctrl.len <<= offset;
+		hw->address &= ~alignment_mask;
+	}
 
 	return 0;
 }
@@ -471,12 +479,15 @@
 	slots = this_cpu_ptr(bp_on_reg);
 
 	for (i = 0; i < boot_cpu_data.watch_ireg_count; ++i) {
-		bp = slots[i];
-		if (bp == NULL)
-			continue;
-		perf_bp_event(bp, regs);
+		if ((csr_read32(LOONGARCH_CSR_FWPS) & (0x1 << i))) {
+			bp = slots[i];
+			if (bp == NULL)
+				continue;
+			perf_bp_event(bp, regs);
+			csr_write32(0x1 << i, LOONGARCH_CSR_FWPS);
+			update_bp_registers(regs, 0, 0);
+		}
 	}
-	update_bp_registers(regs, 0, 0);
 }
 NOKPROBE_SYMBOL(breakpoint_handler);
 
@@ -488,12 +499,15 @@
 	slots = this_cpu_ptr(wp_on_reg);
 
 	for (i = 0; i < boot_cpu_data.watch_dreg_count; ++i) {
-		wp = slots[i];
-		if (wp == NULL)
-			continue;
-		perf_bp_event(wp, regs);
+		if ((csr_read32(LOONGARCH_CSR_MWPS) & (0x1 << i))) {
+			wp = slots[i];
+			if (wp == NULL)
+				continue;
+			perf_bp_event(wp, regs);
+			csr_write32(0x1 << i, LOONGARCH_CSR_MWPS);
+			update_bp_registers(regs, 0, 1);
+		}
 	}
-	update_bp_registers(regs, 0, 1);
 }
 NOKPROBE_SYMBOL(watchpoint_handler);
 
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/inst.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/inst.c
@@ -332,7 +332,7 @@
 		return INSN_BREAK;
 	}
 
-	emit_jirl(&insn, rj, rd, imm >> 2);
+	emit_jirl(&insn, rd, rj, imm >> 2);
 
 	return insn.word;
 }
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/irq.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/irq.c
@@ -122,9 +122,6 @@
 		panic("IPI IRQ request failed\n");
 #endif
 
-	for (i = 0; i < NR_IRQS; i++)
-		irq_set_noprobe(i);
-
 	for_each_possible_cpu(i) {
 		page = alloc_pages_node(cpu_to_node(i), GFP_KERNEL, order);
 
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/perf_event.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/perf_event.c
@@ -884,4 +884,4 @@
 
 	return 0;
 }
-early_initcall(init_hw_perf_events);
+pure_initcall(init_hw_perf_events);
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/process.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/process.c
@@ -293,13 +293,15 @@
 {
 	unsigned long top = TASK_SIZE & PAGE_MASK;
 
-	/* Space for the VDSO & data page */
-	top -= PAGE_ALIGN(current->thread.vdso->size);
-	top -= VVAR_SIZE;
+	if (current->thread.vdso) {
+		/* Space for the VDSO & data page */
+		top -= PAGE_ALIGN(current->thread.vdso->size);
+		top -= VVAR_SIZE;
 
-	/* Space to randomize the VDSO base */
-	if (current->flags & PF_RANDOMIZE)
-		top -= VDSO_RANDOMIZE_SIZE;
+		/* Space to randomize the VDSO base */
+		if (current->flags & PF_RANDOMIZE)
+			top -= VDSO_RANDOMIZE_SIZE;
+	}
 
 	return top;
 }
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/ptrace.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/ptrace.c
@@ -494,28 +494,14 @@
 				     struct arch_hw_breakpoint_ctrl ctrl,
 				     struct perf_event_attr *attr)
 {
-	int err, len, type, offset;
+	int err, len, type;
 
-	err = arch_bp_generic_fields(ctrl, &len, &type, &offset);
+	err = arch_bp_generic_fields(ctrl, &len, &type);
 	if (err)
 		return err;
 
-	switch (note_type) {
-	case NT_LOONGARCH_HW_BREAK:
-		if ((type & HW_BREAKPOINT_X) != type)
-			return -EINVAL;
-		break;
-	case NT_LOONGARCH_HW_WATCH:
-		if ((type & HW_BREAKPOINT_RW) != type)
-			return -EINVAL;
-		break;
-	default:
-		return -EINVAL;
-	}
-
 	attr->bp_len	= len;
 	attr->bp_type	= type;
-	attr->bp_addr	+= offset;
 
 	return 0;
 }
@@ -603,16 +589,36 @@
 	struct perf_event *bp;
 	struct perf_event_attr attr;
 	struct arch_hw_breakpoint_ctrl ctrl;
+	struct thread_info *ti = task_thread_info(tsk);
 
 	bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx);
 	if (IS_ERR(bp))
 		return PTR_ERR(bp);
 
 	attr = bp->attr;
-	decode_ctrl_reg(uctrl, &ctrl);
-	err = ptrace_hbp_fill_attr_ctrl(note_type, ctrl, &attr);
-	if (err)
-		return err;
+
+	switch (note_type) {
+	case NT_LOONGARCH_HW_BREAK:
+		ctrl.type = LOONGARCH_BREAKPOINT_EXECUTE;
+		ctrl.len = LOONGARCH_BREAKPOINT_LEN_4;
+		break;
+	case NT_LOONGARCH_HW_WATCH:
+		decode_ctrl_reg(uctrl, &ctrl);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (uctrl & CTRL_PLV_ENABLE) {
+		err = ptrace_hbp_fill_attr_ctrl(note_type, ctrl, &attr);
+		if (err)
+			return err;
+		attr.disabled = 0;
+		set_ti_thread_flag(ti, TIF_LOAD_WATCH);
+	} else {
+		attr.disabled = 1;
+		clear_ti_thread_flag(ti, TIF_LOAD_WATCH);
+	}
 
 	return modify_user_hw_breakpoint(bp, &attr);
 }
@@ -643,6 +649,10 @@
 	struct perf_event *bp;
 	struct perf_event_attr attr;
 
+	/* Kernel-space address cannot be monitored by user-space */
+	if ((unsigned long)addr >= XKPRANGE)
+		return -EINVAL;
+
 	bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx);
 	if (IS_ERR(bp))
 		return PTR_ERR(bp);
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/relocate.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/relocate.c
@@ -13,6 +13,7 @@
 #include <asm/bootinfo.h>
 #include <asm/early_ioremap.h>
 #include <asm/inst.h>
+#include <asm/io.h>
 #include <asm/sections.h>
 #include <asm/setup.h>
 
@@ -170,7 +171,7 @@
 	unsigned long kernel_length;
 	unsigned long random_offset = 0;
 	void *location_new = _text; /* Default to original kernel start */
-	char *cmdline = early_ioremap(fw_arg1, COMMAND_LINE_SIZE); /* Boot command line is passed in fw_arg1 */
+	char *cmdline = early_memremap_ro(fw_arg1, COMMAND_LINE_SIZE); /* Boot command line is passed in fw_arg1 */
 
 	strscpy(boot_command_line, cmdline, COMMAND_LINE_SIZE);
 
@@ -182,6 +183,7 @@
 		random_offset = (unsigned long)location_new - (unsigned long)(_text);
 #endif
 	reloc_offset = (unsigned long)_text - VMLINUX_LOAD_ADDRESS;
+	early_memunmap(cmdline, COMMAND_LINE_SIZE);
 
 	if (random_offset) {
 		kernel_length = (long)(_end) - (long)(_text);
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/setup.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/setup.c
@@ -54,6 +54,7 @@
 #define SMBIOS_FREQHIGH_OFFSET		0x17
 #define SMBIOS_FREQLOW_MASK		0xFF
 #define SMBIOS_CORE_PACKAGE_OFFSET	0x23
+#define SMBIOS_THREAD_PACKAGE_OFFSET	0x25
 #define LOONGSON_EFI_ENABLE		(1 << 3)
 
 unsigned long fw_arg0, fw_arg1, fw_arg2;
@@ -124,7 +125,7 @@
 	cpu_clock_freq = freq_temp * 1000000;
 
 	loongson_sysconf.cpuname = (void *)dmi_string_parse(dm, dmi_data[16]);
-	loongson_sysconf.cores_per_package = *(dmi_data + SMBIOS_CORE_PACKAGE_OFFSET);
+	loongson_sysconf.cores_per_package = *(dmi_data + SMBIOS_THREAD_PACKAGE_OFFSET);
 
 	pr_info("CpuClock = %llu\n", cpu_clock_freq);
 }
@@ -281,7 +282,7 @@
 		return;
 
 	/* Prefer to use built-in dtb, checking its legality first. */
-	if (!fdt_check_header(__dtb_start))
+	if (IS_ENABLED(CONFIG_BUILTIN_DTB) && !fdt_check_header(__dtb_start))
 		fdt_pointer = __dtb_start;
 	else
 		fdt_pointer = efi_fdt_pointer(); /* Fallback to firmware dtb */
@@ -289,7 +290,7 @@
 	if (!fdt_pointer || fdt_check_header(fdt_pointer))
 		return;
 
-	early_init_dt_scan(fdt_pointer);
+	early_init_dt_scan(fdt_pointer, __pa(fdt_pointer));
 	early_init_fdt_reserve_self();
 
 	max_low_pfn = PFN_PHYS(memblock_end_of_DRAM());
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/smp.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/smp.c
@@ -262,7 +262,6 @@
 
 		if (cpuid == loongson_sysconf.boot_cpu_id) {
 			cpu = 0;
-			numa_add_cpu(cpu);
 		} else {
 			cpu = cpumask_next_zero(-1, cpu_present_mask);
 		}
@@ -272,6 +271,9 @@
 		set_cpu_present(cpu, true);
 		__cpu_number_map[cpuid] = cpu;
 		__cpu_logical_map[cpu] = cpuid;
+
+		early_numa_add_cpu(cpuid, 0);
+		set_cpuid_to_node(cpuid, 0);
 	}
 
 	loongson_sysconf.nr_cpus = num_processors;
@@ -456,6 +458,7 @@
 	set_cpu_possible(0, true);
 	set_cpu_online(0, true);
 	set_my_cpu_offset(per_cpu_offset(0));
+	numa_add_cpu(0);
 
 	rr_node = first_node(node_online_map);
 	for_each_possible_cpu(cpu) {
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/traps.c
+++ linux-qcom-6.8.0/arch/loongarch/kernel/traps.c
@@ -529,6 +529,9 @@
 #else
 	unsigned int *pc;
 
+	if (regs->csr_prmd & CSR_PRMD_PIE)
+		local_irq_enable();
+
 	perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, regs->csr_badvaddr);
 
 	/*
@@ -553,6 +556,8 @@
 	die_if_kernel("Kernel ale access", regs);
 	force_sig_fault(SIGBUS, BUS_ADRALN, (void __user *)regs->csr_badvaddr);
 out:
+	if (regs->csr_prmd & CSR_PRMD_PIE)
+		local_irq_disable();
 #endif
 	irqentry_exit(regs, state);
 }
--- linux-qcom-6.8.0.orig/arch/loongarch/kernel/vmlinux.lds.S
+++ linux-qcom-6.8.0/arch/loongarch/kernel/vmlinux.lds.S
@@ -5,6 +5,7 @@
 
 #define PAGE_SIZE _PAGE_SIZE
 #define RO_EXCEPTION_TABLE_ALIGN	4
+#define PHYSADDR_MASK			0xffffffffffff /* 48-bit */
 
 /*
  * Put .bss..swapper_pg_dir as the first thing in .bss. This will
@@ -139,10 +140,11 @@
 
 #ifdef CONFIG_EFI_STUB
 	/* header symbols */
-	_kernel_asize = _end - _text;
-	_kernel_fsize = _edata - _text;
-	_kernel_vsize = _end - __initdata_begin;
-	_kernel_rsize = _edata - __initdata_begin;
+	_kernel_entry = ABSOLUTE(kernel_entry & PHYSADDR_MASK);
+	_kernel_asize = ABSOLUTE(_end - _text);
+	_kernel_fsize = ABSOLUTE(_edata - _text);
+	_kernel_vsize = ABSOLUTE(_end - __initdata_begin);
+	_kernel_rsize = ABSOLUTE(_edata - __initdata_begin);
 #endif
 
 	.gptab.sdata : {
--- linux-qcom-6.8.0.orig/arch/loongarch/kvm/mmu.c
+++ linux-qcom-6.8.0/arch/loongarch/kvm/mmu.c
@@ -727,19 +727,19 @@
 	 * value) and then p*d_offset() walks into the target huge page instead
 	 * of the old page table (sees the new value).
 	 */
-	pgd = READ_ONCE(*pgd_offset(kvm->mm, hva));
+	pgd = pgdp_get(pgd_offset(kvm->mm, hva));
 	if (pgd_none(pgd))
 		goto out;
 
-	p4d = READ_ONCE(*p4d_offset(&pgd, hva));
+	p4d = p4dp_get(p4d_offset(&pgd, hva));
 	if (p4d_none(p4d) || !p4d_present(p4d))
 		goto out;
 
-	pud = READ_ONCE(*pud_offset(&p4d, hva));
+	pud = pudp_get(pud_offset(&p4d, hva));
 	if (pud_none(pud) || !pud_present(pud))
 		goto out;
 
-	pmd = READ_ONCE(*pmd_offset(&pud, hva));
+	pmd = pmdp_get(pmd_offset(&pud, hva));
 	if (pmd_none(pmd) || !pmd_present(pmd))
 		goto out;
 
--- linux-qcom-6.8.0.orig/arch/loongarch/kvm/timer.c
+++ linux-qcom-6.8.0/arch/loongarch/kvm/timer.c
@@ -174,10 +174,11 @@
 		vcpu->arch.expire = expire;
 
 		/*
-		 * HRTIMER_MODE_PINNED is suggested since vcpu may run in
-		 * the same physical cpu in next time
+		 * HRTIMER_MODE_PINNED_HARD is suggested since vcpu may run in
+		 * the same physical cpu in next time, and the timer should run
+		 * in hardirq context even in the PREEMPT_RT case.
 		 */
-		hrtimer_start(&vcpu->arch.swtimer, expire, HRTIMER_MODE_ABS_PINNED);
+		hrtimer_start(&vcpu->arch.swtimer, expire, HRTIMER_MODE_ABS_PINNED_HARD);
 	} else if (vcpu->stat.generic.blocking) {
 		/*
 		 * Inject timer interrupt so that halt polling can dectect and exit.
--- linux-qcom-6.8.0.orig/arch/loongarch/kvm/vcpu.c
+++ linux-qcom-6.8.0/arch/loongarch/kvm/vcpu.c
@@ -61,7 +61,7 @@
  */
 static int kvm_enter_guest_check(struct kvm_vcpu *vcpu)
 {
-	int ret;
+	int idx, ret;
 
 	/*
 	 * Check conditions before entering the guest
@@ -70,7 +70,9 @@
 	if (ret < 0)
 		return ret;
 
+	idx = srcu_read_lock(&vcpu->kvm->srcu);
 	ret = kvm_check_requests(vcpu);
+	srcu_read_unlock(&vcpu->kvm->srcu, idx);
 
 	return ret;
 }
@@ -875,7 +877,7 @@
 
 	vcpu->arch.vpid = 0;
 
-	hrtimer_init(&vcpu->arch.swtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED);
+	hrtimer_init(&vcpu->arch.swtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED_HARD);
 	vcpu->arch.swtimer.function = kvm_swtimer_wakeup;
 
 	vcpu->arch.handle_exit = kvm_handle_exit;
--- linux-qcom-6.8.0.orig/arch/loongarch/mm/fault.c
+++ linux-qcom-6.8.0/arch/loongarch/mm/fault.c
@@ -202,10 +202,10 @@
 		if (!(vma->vm_flags & VM_WRITE))
 			goto bad_area;
 	} else {
-		if (!(vma->vm_flags & VM_READ) && address != exception_era(regs))
-			goto bad_area;
 		if (!(vma->vm_flags & VM_EXEC) && address == exception_era(regs))
 			goto bad_area;
+		if (!(vma->vm_flags & (VM_READ | VM_WRITE)) && address != exception_era(regs))
+			goto bad_area;
 	}
 
 	/*
--- linux-qcom-6.8.0.orig/arch/loongarch/mm/hugetlbpage.c
+++ linux-qcom-6.8.0/arch/loongarch/mm/hugetlbpage.c
@@ -39,11 +39,11 @@
 	pmd_t *pmd = NULL;
 
 	pgd = pgd_offset(mm, addr);
-	if (pgd_present(*pgd)) {
+	if (pgd_present(pgdp_get(pgd))) {
 		p4d = p4d_offset(pgd, addr);
-		if (p4d_present(*p4d)) {
+		if (p4d_present(p4dp_get(p4d))) {
 			pud = pud_offset(p4d, addr);
-			if (pud_present(*pud))
+			if (pud_present(pudp_get(pud)))
 				pmd = pmd_offset(pud, addr);
 		}
 	}
--- linux-qcom-6.8.0.orig/arch/loongarch/mm/init.c
+++ linux-qcom-6.8.0/arch/loongarch/mm/init.c
@@ -140,7 +140,7 @@
 int __meminit vmemmap_check_pmd(pmd_t *pmd, int node,
 				unsigned long addr, unsigned long next)
 {
-	int huge = pmd_val(*pmd) & _PAGE_HUGE;
+	int huge = pmd_val(pmdp_get(pmd)) & _PAGE_HUGE;
 
 	if (huge)
 		vmemmap_verify((pte_t *)pmd, node, addr, next);
@@ -172,7 +172,7 @@
 	pud_t *pud;
 	pmd_t *pmd;
 
-	if (p4d_none(*p4d)) {
+	if (p4d_none(p4dp_get(p4d))) {
 		pud = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
 		if (!pud)
 			panic("%s: Failed to allocate memory\n", __func__);
@@ -183,7 +183,7 @@
 	}
 
 	pud = pud_offset(p4d, addr);
-	if (pud_none(*pud)) {
+	if (pud_none(pudp_get(pud))) {
 		pmd = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
 		if (!pmd)
 			panic("%s: Failed to allocate memory\n", __func__);
@@ -194,7 +194,7 @@
 	}
 
 	pmd = pmd_offset(pud, addr);
-	if (!pmd_present(*pmd)) {
+	if (!pmd_present(pmdp_get(pmd))) {
 		pte_t *pte;
 
 		pte = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
@@ -215,7 +215,7 @@
 	BUG_ON(idx <= FIX_HOLE || idx >= __end_of_fixed_addresses);
 
 	ptep = populate_kernel_pte(addr);
-	if (!pte_none(*ptep)) {
+	if (!pte_none(ptep_get(ptep))) {
 		pte_ERROR(*ptep);
 		return;
 	}
--- linux-qcom-6.8.0.orig/arch/loongarch/mm/kasan_init.c
+++ linux-qcom-6.8.0/arch/loongarch/mm/kasan_init.c
@@ -13,6 +13,13 @@
 
 static pgd_t kasan_pg_dir[PTRS_PER_PGD] __initdata __aligned(PAGE_SIZE);
 
+#ifdef __PAGETABLE_P4D_FOLDED
+#define __pgd_none(early, pgd) (0)
+#else
+#define __pgd_none(early, pgd) (early ? (pgd_val(pgd) == 0) : \
+(__pa(pgd_val(pgd)) == (unsigned long)__pa(kasan_early_shadow_p4d)))
+#endif
+
 #ifdef __PAGETABLE_PUD_FOLDED
 #define __p4d_none(early, p4d) (0)
 #else
@@ -55,6 +62,9 @@
 		case XKPRANGE_UC_SEG:
 			offset = XKPRANGE_UC_SHADOW_OFFSET;
 			break;
+		case XKPRANGE_WC_SEG:
+			offset = XKPRANGE_WC_SHADOW_OFFSET;
+			break;
 		case XKVRANGE_VC_SEG:
 			offset = XKVRANGE_VC_SHADOW_OFFSET;
 			break;
@@ -79,6 +89,8 @@
 
 	if (addr >= XKVRANGE_VC_SHADOW_OFFSET)
 		return (void *)(((addr - XKVRANGE_VC_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT) + XKVRANGE_VC_START);
+	else if (addr >= XKPRANGE_WC_SHADOW_OFFSET)
+		return (void *)(((addr - XKPRANGE_WC_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT) + XKPRANGE_WC_START);
 	else if (addr >= XKPRANGE_UC_SHADOW_OFFSET)
 		return (void *)(((addr - XKPRANGE_UC_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT) + XKPRANGE_UC_START);
 	else if (addr >= XKPRANGE_CC_SHADOW_OFFSET)
@@ -105,7 +117,7 @@
 
 static pte_t *__init kasan_pte_offset(pmd_t *pmdp, unsigned long addr, int node, bool early)
 {
-	if (__pmd_none(early, READ_ONCE(*pmdp))) {
+	if (__pmd_none(early, pmdp_get(pmdp))) {
 		phys_addr_t pte_phys = early ?
 				__pa_symbol(kasan_early_shadow_pte) : kasan_alloc_zeroed_page(node);
 		if (!early)
@@ -118,7 +130,7 @@
 
 static pmd_t *__init kasan_pmd_offset(pud_t *pudp, unsigned long addr, int node, bool early)
 {
-	if (__pud_none(early, READ_ONCE(*pudp))) {
+	if (__pud_none(early, pudp_get(pudp))) {
 		phys_addr_t pmd_phys = early ?
 				__pa_symbol(kasan_early_shadow_pmd) : kasan_alloc_zeroed_page(node);
 		if (!early)
@@ -131,7 +143,7 @@
 
 static pud_t *__init kasan_pud_offset(p4d_t *p4dp, unsigned long addr, int node, bool early)
 {
-	if (__p4d_none(early, READ_ONCE(*p4dp))) {
+	if (__p4d_none(early, p4dp_get(p4dp))) {
 		phys_addr_t pud_phys = early ?
 			__pa_symbol(kasan_early_shadow_pud) : kasan_alloc_zeroed_page(node);
 		if (!early)
@@ -142,6 +154,19 @@
 	return pud_offset(p4dp, addr);
 }
 
+static p4d_t *__init kasan_p4d_offset(pgd_t *pgdp, unsigned long addr, int node, bool early)
+{
+	if (__pgd_none(early, pgdp_get(pgdp))) {
+		phys_addr_t p4d_phys = early ?
+			__pa_symbol(kasan_early_shadow_p4d) : kasan_alloc_zeroed_page(node);
+		if (!early)
+			memcpy(__va(p4d_phys), kasan_early_shadow_p4d, sizeof(kasan_early_shadow_p4d));
+		pgd_populate(&init_mm, pgdp, (p4d_t *)__va(p4d_phys));
+	}
+
+	return p4d_offset(pgdp, addr);
+}
+
 static void __init kasan_pte_populate(pmd_t *pmdp, unsigned long addr,
 				      unsigned long end, int node, bool early)
 {
@@ -154,7 +179,7 @@
 					      : kasan_alloc_zeroed_page(node);
 		next = addr + PAGE_SIZE;
 		set_pte(ptep, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
-	} while (ptep++, addr = next, addr != end && __pte_none(early, READ_ONCE(*ptep)));
+	} while (ptep++, addr = next, addr != end && __pte_none(early, ptep_get(ptep)));
 }
 
 static void __init kasan_pmd_populate(pud_t *pudp, unsigned long addr,
@@ -166,7 +191,7 @@
 	do {
 		next = pmd_addr_end(addr, end);
 		kasan_pte_populate(pmdp, addr, next, node, early);
-	} while (pmdp++, addr = next, addr != end && __pmd_none(early, READ_ONCE(*pmdp)));
+	} while (pmdp++, addr = next, addr != end && __pmd_none(early, pmdp_get(pmdp)));
 }
 
 static void __init kasan_pud_populate(p4d_t *p4dp, unsigned long addr,
@@ -178,19 +203,19 @@
 	do {
 		next = pud_addr_end(addr, end);
 		kasan_pmd_populate(pudp, addr, next, node, early);
-	} while (pudp++, addr = next, addr != end);
+	} while (pudp++, addr = next, addr != end && __pud_none(early, READ_ONCE(*pudp)));
 }
 
 static void __init kasan_p4d_populate(pgd_t *pgdp, unsigned long addr,
 					    unsigned long end, int node, bool early)
 {
 	unsigned long next;
-	p4d_t *p4dp = p4d_offset(pgdp, addr);
+	p4d_t *p4dp = kasan_p4d_offset(pgdp, addr, node, early);
 
 	do {
 		next = p4d_addr_end(addr, end);
 		kasan_pud_populate(p4dp, addr, next, node, early);
-	} while (p4dp++, addr = next, addr != end);
+	} while (p4dp++, addr = next, addr != end && __p4d_none(early, READ_ONCE(*p4dp)));
 }
 
 static void __init kasan_pgd_populate(unsigned long addr, unsigned long end,
@@ -218,7 +243,7 @@
 asmlinkage void __init kasan_early_init(void)
 {
 	BUILD_BUG_ON(!IS_ALIGNED(KASAN_SHADOW_START, PGDIR_SIZE));
-	BUILD_BUG_ON(!IS_ALIGNED(KASAN_SHADOW_END, PGDIR_SIZE));
+	BUILD_BUG_ON(!IS_ALIGNED(KASAN_SHADOW_END + 1, PGDIR_SIZE));
 }
 
 static inline void kasan_set_pgd(pgd_t *pgdp, pgd_t pgdval)
@@ -233,7 +258,7 @@
 	 * swapper_pg_dir. pgd_clear() can't be used
 	 * here because it's nop on 2,3-level pagetable setups
 	 */
-	for (; start < end; start += PGDIR_SIZE)
+	for (; start < end; start = pgd_addr_end(start, end))
 		kasan_set_pgd((pgd_t *)pgd_offset_k(start), __pgd(0));
 }
 
@@ -243,6 +268,17 @@
 	phys_addr_t pa_start, pa_end;
 
 	/*
+	 * If PGDIR_SIZE is too large for cpu_vabits, KASAN_SHADOW_END will
+	 * overflow UINTPTR_MAX and then looks like a user space address.
+	 * For example, PGDIR_SIZE of CONFIG_4KB_4LEVEL is 2^39, which is too
+	 * large for Loongson-2K series whose cpu_vabits = 39.
+	 */
+	if (KASAN_SHADOW_END < vm_map_base) {
+		pr_warn("PGDIR_SIZE too large for cpu_vabits, KernelAddressSanitizer disabled.\n");
+		return;
+	}
+
+	/*
 	 * PGD was populated as invalid_pmd_table or invalid_pud_table
 	 * in pagetable_init() which depends on how many levels of page
 	 * table you are using, but we had to clean the gpd of kasan
--- linux-qcom-6.8.0.orig/arch/loongarch/mm/pgtable.c
+++ linux-qcom-6.8.0/arch/loongarch/mm/pgtable.c
@@ -128,7 +128,7 @@
 void set_pmd_at(struct mm_struct *mm, unsigned long addr,
 		pmd_t *pmdp, pmd_t pmd)
 {
-	*pmdp = pmd;
+	WRITE_ONCE(*pmdp, pmd);
 	flush_tlb_all();
 }
 
--- linux-qcom-6.8.0.orig/arch/loongarch/mm/tlb.c
+++ linux-qcom-6.8.0/arch/loongarch/mm/tlb.c
@@ -292,7 +292,7 @@
 		/* Avoid lockdep warning */
 		rcutree_report_cpu_starting(cpu);
 
-#ifdef CONFIG_NUMA
+#if defined(CONFIG_NUMA) && !defined(CONFIG_PREEMPT_RT)
 		vec_sz = sizeof(exception_handlers);
 
 		if (pcpu_handlers[cpu])
--- linux-qcom-6.8.0.orig/arch/loongarch/net/bpf_jit.c
+++ linux-qcom-6.8.0/arch/loongarch/net/bpf_jit.c
@@ -179,15 +179,15 @@
 
 	if (!is_tail_call) {
 		/* Set return value */
-		move_reg(ctx, LOONGARCH_GPR_A0, regmap[BPF_REG_0]);
+		emit_insn(ctx, addiw, LOONGARCH_GPR_A0, regmap[BPF_REG_0], 0);
 		/* Return to the caller */
-		emit_insn(ctx, jirl, LOONGARCH_GPR_RA, LOONGARCH_GPR_ZERO, 0);
+		emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_RA, 0);
 	} else {
 		/*
 		 * Call the next bpf prog and skip the first instruction
 		 * of TCC initialization.
 		 */
-		emit_insn(ctx, jirl, LOONGARCH_GPR_T3, LOONGARCH_GPR_ZERO, 1);
+		emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_T3, 1);
 	}
 }
 
@@ -904,7 +904,7 @@
 			return ret;
 
 		move_addr(ctx, t1, func_addr);
-		emit_insn(ctx, jirl, t1, LOONGARCH_GPR_RA, 0);
+		emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0);
 		move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0);
 		break;
 
@@ -1294,16 +1294,19 @@
 	flush_icache_range((unsigned long)header, (unsigned long)(ctx.image + ctx.idx));
 
 	if (!prog->is_func || extra_pass) {
+		int err;
+
 		if (extra_pass && ctx.idx != jit_data->ctx.idx) {
 			pr_err_once("multi-func JIT bug %d != %d\n",
 				    ctx.idx, jit_data->ctx.idx);
-			bpf_jit_binary_free(header);
-			prog->bpf_func = NULL;
-			prog->jited = 0;
-			prog->jited_len = 0;
-			goto out_offset;
+			goto out_free;
+		}
+		err = bpf_jit_binary_lock_ro(header);
+		if (err) {
+			pr_err_once("bpf_jit_binary_lock_ro() returned %d\n",
+				    err);
+			goto out_free;
 		}
-		bpf_jit_binary_lock_ro(header);
 	} else {
 		jit_data->ctx = ctx;
 		jit_data->image = image_ptr;
@@ -1334,6 +1337,13 @@
 	out_offset = -1;
 
 	return prog;
+
+out_free:
+	bpf_jit_binary_free(header);
+	prog->bpf_func = NULL;
+	prog->jited = 0;
+	prog->jited_len = 0;
+	goto out_offset;
 }
 
 /* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */
--- linux-qcom-6.8.0.orig/arch/loongarch/pci/acpi.c
+++ linux-qcom-6.8.0/arch/loongarch/pci/acpi.c
@@ -225,6 +225,7 @@
 	if (bus) {
 		memcpy(bus->sysdata, info->cfg, sizeof(struct pci_config_window));
 		kfree(info);
+		kfree(root_ops);
 	} else {
 		struct pci_bus *child;
 
--- linux-qcom-6.8.0.orig/arch/loongarch/vdso/Makefile
+++ linux-qcom-6.8.0/arch/loongarch/vdso/Makefile
@@ -22,7 +22,7 @@
 cflags-vdso := $(ccflags-vdso) \
 	-isystem $(shell $(CC) -print-file-name=include) \
 	$(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \
-	-O2 -g -fno-strict-aliasing -fno-common -fno-builtin \
+	-std=gnu11 -O2 -g -fno-strict-aliasing -fno-common -fno-builtin \
 	-fno-stack-protector -fno-jump-tables -DDISABLE_BRANCH_PROFILING \
 	$(call cc-option, -fno-asynchronous-unwind-tables) \
 	$(call cc-option, -fno-stack-protector)
--- linux-qcom-6.8.0.orig/arch/m68k/amiga/config.c
+++ linux-qcom-6.8.0/arch/m68k/amiga/config.c
@@ -180,6 +180,15 @@
 			dev->slotsize = be16_to_cpu(cd->cd_SlotSize);
 			dev->boardaddr = be32_to_cpu(cd->cd_BoardAddr);
 			dev->boardsize = be32_to_cpu(cd->cd_BoardSize);
+
+			/* CS-LAB Warp 1260 workaround */
+			if (be16_to_cpu(dev->rom.er_Manufacturer) == ZORRO_MANUF(ZORRO_PROD_CSLAB_WARP_1260) &&
+			    dev->rom.er_Product == ZORRO_PROD(ZORRO_PROD_CSLAB_WARP_1260)) {
+
+				/* turn off all interrupts */
+				pr_info("Warp 1260 card detected: applying interrupt storm workaround\n");
+				*(uint32_t *)(dev->boardaddr + 0x1000) = 0xfff;
+			}
 		} else
 			pr_warn("amiga_parse_bootinfo: too many AutoConfig devices\n");
 #endif /* CONFIG_ZORRO */
--- linux-qcom-6.8.0.orig/arch/m68k/atari/ataints.c
+++ linux-qcom-6.8.0/arch/m68k/atari/ataints.c
@@ -301,11 +301,7 @@
 
 	if (ATARIHW_PRESENT(SCU)) {
 		/* init the SCU if present */
-		tt_scu.sys_mask = 0x10;		/* enable VBL (for the cursor) and
-									 * disable HSYNC interrupts (who
-									 * needs them?)  MFP and SCC are
-									 * enabled in VME mask
-									 */
+		tt_scu.sys_mask = 0x0;		/* disable all interrupts */
 		tt_scu.vme_mask = 0x60;		/* enable MFP and SCC ints */
 	} else {
 		/* If no SCU and no Hades, the HSYNC interrupt needs to be
--- linux-qcom-6.8.0.orig/arch/m68k/coldfire/device.c
+++ linux-qcom-6.8.0/arch/m68k/coldfire/device.c
@@ -93,7 +93,7 @@
 	.dev.platform_data	= mcf_uart_platform_data,
 };
 
-#if IS_ENABLED(CONFIG_FEC)
+#ifdef MCFFEC_BASE0
 
 #ifdef CONFIG_M5441x
 #define FEC_NAME	"enet-fec"
@@ -145,6 +145,7 @@
 		.platform_data		= FEC_PDATA,
 	}
 };
+#endif /* MCFFEC_BASE0 */
 
 #ifdef MCFFEC_BASE1
 static struct resource mcf_fec1_resources[] = {
@@ -182,7 +183,6 @@
 	}
 };
 #endif /* MCFFEC_BASE1 */
-#endif /* CONFIG_FEC */
 
 #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 /*
@@ -624,12 +624,12 @@
 
 static struct platform_device *mcf_devices[] __initdata = {
 	&mcf_uart,
-#if IS_ENABLED(CONFIG_FEC)
+#ifdef MCFFEC_BASE0
 	&mcf_fec0,
+#endif
 #ifdef MCFFEC_BASE1
 	&mcf_fec1,
 #endif
-#endif
 #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 	&mcf_qspi,
 #endif
--- linux-qcom-6.8.0.orig/arch/m68k/include/asm/cmpxchg.h
+++ linux-qcom-6.8.0/arch/m68k/include/asm/cmpxchg.h
@@ -32,7 +32,7 @@
 		x = tmp;
 		break;
 	default:
-		tmp = __invalid_xchg_size(x, ptr, size);
+		x = __invalid_xchg_size(x, ptr, size);
 		break;
 	}
 
--- linux-qcom-6.8.0.orig/arch/m68k/include/asm/mcfgpio.h
+++ linux-qcom-6.8.0/arch/m68k/include/asm/mcfgpio.h
@@ -136,7 +136,7 @@
  * read-modify-write as well as those controlled by the EPORT and GPIO modules.
  */
 #define MCFGPIO_SCR_START		40
-#elif defined(CONFIGM5441x)
+#elif defined(CONFIG_M5441x)
 /* The m5441x EPORT doesn't have its own GPIO port, uses PORT C */
 #define MCFGPIO_SCR_START		0
 #else
--- linux-qcom-6.8.0.orig/arch/m68k/include/asm/mvme147hw.h
+++ linux-qcom-6.8.0/arch/m68k/include/asm/mvme147hw.h
@@ -93,8 +93,8 @@
 #define M147_SCC_B_ADDR		0xfffe3000
 #define M147_SCC_PCLK		5000000
 
-#define MVME147_IRQ_SCSI_PORT	(IRQ_USER+0x45)
-#define MVME147_IRQ_SCSI_DMA	(IRQ_USER+0x46)
+#define MVME147_IRQ_SCSI_PORT	(IRQ_USER + 5)
+#define MVME147_IRQ_SCSI_DMA	(IRQ_USER + 6)
 
 /* SCC interrupts, for MVME147 */
 
--- linux-qcom-6.8.0.orig/arch/m68k/kernel/early_printk.c
+++ linux-qcom-6.8.0/arch/m68k/kernel/early_printk.c
@@ -13,6 +13,7 @@
 #include <asm/setup.h>
 
 
+#include "../mvme147/mvme147.h"
 #include "../mvme16x/mvme16x.h"
 
 asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
@@ -22,7 +23,9 @@
 {
 #if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \
       defined(CONFIG_COLDFIRE))
-	if (MACH_IS_MVME16x)
+	if (MACH_IS_MVME147)
+		mvme147_scc_write(c, s, n);
+	else if (MACH_IS_MVME16x)
 		mvme16x_cons_write(c, s, n);
 	else
 		debug_cons_nputs(s, n);
--- linux-qcom-6.8.0.orig/arch/m68k/kernel/entry.S
+++ linux-qcom-6.8.0/arch/m68k/kernel/entry.S
@@ -430,7 +430,9 @@
 	movec	%a0,%dfc
 
 	/* restore status register */
-	movew	%a1@(TASK_THREAD+THREAD_SR),%sr
+	movew	%a1@(TASK_THREAD+THREAD_SR),%d0
+	oriw	#0x0700,%d0
+	movew	%d0,%sr
 
 	rts
 
--- linux-qcom-6.8.0.orig/arch/m68k/kernel/process.c
+++ linux-qcom-6.8.0/arch/m68k/kernel/process.c
@@ -117,7 +117,7 @@
 {
 	/* regs will be equal to current_pt_regs() */
 	struct kernel_clone_args args = {
-		.flags		= regs->d1 & ~CSIGNAL,
+		.flags		= (u32)(regs->d1) & ~CSIGNAL,
 		.pidfd		= (int __user *)regs->d3,
 		.child_tid	= (int __user *)regs->d4,
 		.parent_tid	= (int __user *)regs->d3,
--- linux-qcom-6.8.0.orig/arch/m68k/mac/misc.c
+++ linux-qcom-6.8.0/arch/m68k/mac/misc.c
@@ -453,30 +453,18 @@
 
 void mac_reset(void)
 {
-	if (macintosh_config->adb_type == MAC_ADB_II &&
-	    macintosh_config->ident != MAC_MODEL_SE30) {
-		/* need ROMBASE in booter */
-		/* indeed, plus need to MAP THE ROM !! */
-
-		if (mac_bi_data.rombase == 0)
-			mac_bi_data.rombase = 0x40800000;
-
-		/* works on some */
-		rom_reset = (void *) (mac_bi_data.rombase + 0xa);
-
-		local_irq_disable();
-		rom_reset();
 #ifdef CONFIG_ADB_CUDA
-	} else if (macintosh_config->adb_type == MAC_ADB_EGRET ||
-	           macintosh_config->adb_type == MAC_ADB_CUDA) {
+	if (macintosh_config->adb_type == MAC_ADB_EGRET ||
+	    macintosh_config->adb_type == MAC_ADB_CUDA) {
 		cuda_restart();
+	} else
 #endif
 #ifdef CONFIG_ADB_PMU
-	} else if (macintosh_config->adb_type == MAC_ADB_PB2) {
+	if (macintosh_config->adb_type == MAC_ADB_PB2) {
 		pmu_restart();
+	} else
 #endif
-	} else if (CPU_IS_030) {
-
+	if (CPU_IS_030) {
 		/* 030-specific reset routine.  The idea is general, but the
 		 * specific registers to reset are '030-specific.  Until I
 		 * have a non-030 machine, I can't test anything else.
@@ -524,6 +512,18 @@
 		    "jmp %/a0@\n\t" /* jump to the reset vector */
 		    ".chip 68k"
 		    : : "r" (offset), "a" (rombase) : "a0");
+	} else {
+		/* need ROMBASE in booter */
+		/* indeed, plus need to MAP THE ROM !! */
+
+		if (mac_bi_data.rombase == 0)
+			mac_bi_data.rombase = 0x40800000;
+
+		/* works on some */
+		rom_reset = (void *)(mac_bi_data.rombase + 0xa);
+
+		local_irq_disable();
+		rom_reset();
 	}
 
 	/* should never get here */
--- linux-qcom-6.8.0.orig/arch/m68k/mvme147/config.c
+++ linux-qcom-6.8.0/arch/m68k/mvme147/config.c
@@ -32,6 +32,7 @@
 #include <asm/mvme147hw.h>
 #include <asm/config.h>
 
+#include "mvme147.h"
 
 static void mvme147_get_model(char *model);
 extern void mvme147_sched_init(void);
@@ -185,3 +186,32 @@
 	}
 	return 0;
 }
+
+static void scc_delay(void)
+{
+	__asm__ __volatile__ ("nop; nop;");
+}
+
+static void scc_write(char ch)
+{
+	do {
+		scc_delay();
+	} while (!(in_8(M147_SCC_A_ADDR) & BIT(2)));
+	scc_delay();
+	out_8(M147_SCC_A_ADDR, 8);
+	scc_delay();
+	out_8(M147_SCC_A_ADDR, ch);
+}
+
+void mvme147_scc_write(struct console *co, const char *str, unsigned int count)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	while (count--)	{
+		if (*str == '\n')
+			scc_write('\r');
+		scc_write(*str++);
+	}
+	local_irq_restore(flags);
+}
--- linux-qcom-6.8.0.orig/arch/m68k/mvme147/mvme147.h
+++ linux-qcom-6.8.0/arch/m68k/mvme147/mvme147.h
@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+struct console;
+
+/* config.c */
+void mvme147_scc_write(struct console *co, const char *str, unsigned int count);
--- linux-qcom-6.8.0.orig/arch/microblaze/kernel/Makefile
+++ linux-qcom-6.8.0/arch/microblaze/kernel/Makefile
@@ -7,7 +7,6 @@
 # Do not trace early boot code and low level code
 CFLAGS_REMOVE_timer.o = -pg
 CFLAGS_REMOVE_intc.o = -pg
-CFLAGS_REMOVE_early_printk.o = -pg
 CFLAGS_REMOVE_ftrace.o = -pg
 CFLAGS_REMOVE_process.o = -pg
 endif
--- linux-qcom-6.8.0.orig/arch/microblaze/kernel/cpu/cpuinfo-static.c
+++ linux-qcom-6.8.0/arch/microblaze/kernel/cpu/cpuinfo-static.c
@@ -18,7 +18,7 @@
 static const char cpu_ver_string[] = CONFIG_XILINX_MICROBLAZE0_HW_VER;
 
 #define err_printk(x) \
-	early_printk("ERROR: Microblaze " x "-different for kernel and DTS\n");
+	pr_err("ERROR: Microblaze " x "-different for kernel and DTS\n");
 
 void __init set_cpuinfo_static(struct cpuinfo *ci, struct device_node *cpu)
 {
--- linux-qcom-6.8.0.orig/arch/microblaze/kernel/microblaze_ksyms.c
+++ linux-qcom-6.8.0/arch/microblaze/kernel/microblaze_ksyms.c
@@ -16,6 +16,7 @@
 #include <asm/page.h>
 #include <linux/ftrace.h>
 #include <linux/uaccess.h>
+#include <asm/xilinx_mb_manager.h>
 
 #ifdef CONFIG_FUNCTION_TRACER
 extern void _mcount(void);
@@ -46,3 +47,12 @@
 EXPORT_SYMBOL(__udivsi3);
 extern void __umodsi3(void);
 EXPORT_SYMBOL(__umodsi3);
+
+#ifdef CONFIG_MB_MANAGER
+extern void xmb_manager_register(uintptr_t phys_baseaddr, u32 cr_val,
+				 void (*callback)(void *data),
+				 void *priv, void (*reset_callback)(void *data));
+EXPORT_SYMBOL(xmb_manager_register);
+extern asmlinkage void xmb_inject_err(void);
+EXPORT_SYMBOL(xmb_inject_err);
+#endif
--- linux-qcom-6.8.0.orig/arch/microblaze/kernel/prom.c
+++ linux-qcom-6.8.0/arch/microblaze/kernel/prom.c
@@ -18,7 +18,7 @@
 {
 	pr_debug(" -> early_init_devtree(%p)\n", params);
 
-	early_init_dt_scan(params);
+	early_init_dt_scan(params, __pa(params));
 	if (!strlen(boot_command_line))
 		strscpy(boot_command_line, cmd_line, COMMAND_LINE_SIZE);
 
--- linux-qcom-6.8.0.orig/arch/microblaze/mm/init.c
+++ linux-qcom-6.8.0/arch/microblaze/mm/init.c
@@ -193,11 +193,6 @@
 {
 	unsigned int kstart, ksize;
 
-	if (!memblock.reserved.cnt) {
-		pr_emerg("Error memory count\n");
-		machine_restart(NULL);
-	}
-
 	if ((u32) memblock.memory.regions[0].size < 0x400000) {
 		pr_emerg("Memory must be greater than 4MB\n");
 		machine_restart(NULL);
--- linux-qcom-6.8.0.orig/arch/mips/Kconfig
+++ linux-qcom-6.8.0/arch/mips/Kconfig
@@ -14,7 +14,7 @@
 	select ARCH_HAS_STRNCPY_FROM_USER
 	select ARCH_HAS_STRNLEN_USER
 	select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
-	select ARCH_HAS_UBSAN_SANITIZE_ALL
+	select ARCH_HAS_UBSAN
 	select ARCH_HAS_GCOV_PROFILE_ALL
 	select ARCH_KEEP_MEMBLOCK
 	select ARCH_USE_BUILTIN_BSWAP
--- linux-qcom-6.8.0.orig/arch/mips/Makefile
+++ linux-qcom-6.8.0/arch/mips/Makefile
@@ -299,7 +299,7 @@
 ifdef CONFIG_64BIT
   ifndef KBUILD_SYM32
     ifeq ($(shell expr $(load-y) \< 0xffffffff80000000), 0)
-      KBUILD_SYM32 = y
+      KBUILD_SYM32 = $(call cc-option-yn, -msym32)
     endif
   endif
 
--- linux-qcom-6.8.0.orig/arch/mips/bmips/setup.c
+++ linux-qcom-6.8.0/arch/mips/bmips/setup.c
@@ -110,7 +110,8 @@
 	 * RAC flush causes kernel panics on BCM6358 when booting from TP1
 	 * because the bootloader is not initializing it properly.
 	 */
-	bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31));
+	bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31)) ||
+				  !!BMIPS_GET_CBR();
 }
 
 static void bcm6368_quirks(void)
--- linux-qcom-6.8.0.orig/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi
+++ linux-qcom-6.8.0/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi
@@ -23,14 +23,6 @@
 		};
 	};
 
-	memory@200000 {
-		compatible = "memory";
-		device_type = "memory";
-		reg = <0x00000000 0x00200000 0x00000000 0x0ee00000>, /* 238 MB at 2 MB */
-			<0x00000000 0x20000000 0x00000000 0x1f000000>, /* 496 MB at 512 MB */
-			<0x00000001 0x10000000 0x00000001 0xb0000000>; /* 6912 MB at 4352MB */
-	};
-
 	cpu_clk: cpu_clk {
 		#clock-cells = <0>;
 		compatible = "fixed-clock";
@@ -52,6 +44,13 @@
 			0 0x40000000 0 0x40000000 0 0x40000000
 			0xfe 0x00000000 0xfe 0x00000000 0 0x40000000>;
 
+		isa@18000000 {
+			compatible = "isa";
+			#size-cells = <1>;
+			#address-cells = <2>;
+			ranges = <1 0x0 0x0 0x18000000 0x4000>;
+		};
+
 		pm: reset-controller@1fe07000 {
 			compatible = "loongson,ls2k-pm";
 			reg = <0 0x1fe07000 0 0x422>;
@@ -100,8 +99,8 @@
 		rtc0: rtc@1fe07800 {
 			compatible = "loongson,ls2k1000-rtc";
 			reg = <0 0x1fe07800 0 0x78>;
-			interrupt-parent = <&liointc0>;
-			interrupts = <60 IRQ_TYPE_LEVEL_LOW>;
+			interrupt-parent = <&liointc1>;
+			interrupts = <8 IRQ_TYPE_LEVEL_HIGH>;
 		};
 
 		uart0: serial@1fe00000 {
@@ -109,7 +108,7 @@
 			reg = <0 0x1fe00000 0 0x8>;
 			clock-frequency = <125000000>;
 			interrupt-parent = <&liointc0>;
-			interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+			interrupts = <0 IRQ_TYPE_LEVEL_HIGH>;
 			no-loopback-test;
 		};
 
@@ -118,7 +117,6 @@
 			device_type = "pci";
 			#address-cells = <3>;
 			#size-cells = <2>;
-			#interrupt-cells = <2>;
 
 			reg = <0 0x1a000000 0 0x02000000>,
 				<0xfe 0x00000000 0 0x20000000>;
@@ -133,11 +131,12 @@
 						   "pciclass0c03";
 
 				reg = <0x1800 0x0 0x0 0x0 0x0>;
-				interrupts = <12 IRQ_TYPE_LEVEL_LOW>,
-					     <13 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <12 IRQ_TYPE_LEVEL_HIGH>,
+					     <13 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-names = "macirq", "eth_lpi";
 				interrupt-parent = <&liointc0>;
-				phy-mode = "rgmii";
+				phy-mode = "rgmii-id";
+				phy-handle = <&phy1>;
 				mdio {
 					#address-cells = <1>;
 					#size-cells = <0>;
@@ -156,11 +155,12 @@
 						   "loongson, pci-gmac";
 
 				reg = <0x1900 0x0 0x0 0x0 0x0>;
-				interrupts = <14 IRQ_TYPE_LEVEL_LOW>,
-					     <15 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <14 IRQ_TYPE_LEVEL_HIGH>,
+					     <15 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-names = "macirq", "eth_lpi";
 				interrupt-parent = <&liointc0>;
-				phy-mode = "rgmii";
+				phy-mode = "rgmii-id";
+				phy-handle = <&phy1>;
 				mdio {
 					#address-cells = <1>;
 					#size-cells = <0>;
@@ -178,7 +178,7 @@
 						   "pciclass0c03";
 
 				reg = <0x2100 0x0 0x0 0x0 0x0>;
-				interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <18 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&liointc1>;
 			};
 
@@ -189,7 +189,7 @@
 						   "pciclass0c03";
 
 				reg = <0x2200 0x0 0x0 0x0 0x0>;
-				interrupts = <19 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <19 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&liointc1>;
 			};
 
@@ -200,97 +200,121 @@
 						   "pciclass0106";
 
 				reg = <0x4000 0x0 0x0 0x0 0x0>;
-				interrupts = <19 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <19 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&liointc0>;
 			};
 
-			pci_bridge@9,0 {
+			pcie@9,0 {
 				compatible = "pci0014,7a19.0",
 						   "pci0014,7a19",
 						   "pciclass060400",
 						   "pciclass0604";
 
 				reg = <0x4800 0x0 0x0 0x0 0x0>;
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
-				interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <0 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&liointc1>;
 				interrupt-map-mask = <0 0 0 0>;
-				interrupt-map = <0 0 0 0 &liointc1 0 IRQ_TYPE_LEVEL_LOW>;
+				interrupt-map = <0 0 0 0 &liointc1 0 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 				external-facing;
 			};
 
-			pci_bridge@a,0 {
+			pcie@a,0 {
 				compatible = "pci0014,7a09.0",
 						   "pci0014,7a09",
 						   "pciclass060400",
 						   "pciclass0604";
 
 				reg = <0x5000 0x0 0x0 0x0 0x0>;
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
-				interrupts = <1 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <1 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&liointc1>;
 				interrupt-map-mask = <0 0 0 0>;
-				interrupt-map = <0 0 0 0 &liointc1 1 IRQ_TYPE_LEVEL_LOW>;
+				interrupt-map = <0 0 0 0 &liointc1 1 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 				external-facing;
 			};
 
-			pci_bridge@b,0 {
+			pcie@b,0 {
 				compatible = "pci0014,7a09.0",
 						   "pci0014,7a09",
 						   "pciclass060400",
 						   "pciclass0604";
 
 				reg = <0x5800 0x0 0x0 0x0 0x0>;
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
-				interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <2 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&liointc1>;
 				interrupt-map-mask = <0 0 0 0>;
-				interrupt-map = <0 0 0 0 &liointc1 2 IRQ_TYPE_LEVEL_LOW>;
+				interrupt-map = <0 0 0 0 &liointc1 2 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 				external-facing;
 			};
 
-			pci_bridge@c,0 {
+			pcie@c,0 {
 				compatible = "pci0014,7a09.0",
 						   "pci0014,7a09",
 						   "pciclass060400",
 						   "pciclass0604";
 
 				reg = <0x6000 0x0 0x0 0x0 0x0>;
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
-				interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <3 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&liointc1>;
 				interrupt-map-mask = <0 0 0 0>;
-				interrupt-map = <0 0 0 0 &liointc1 3 IRQ_TYPE_LEVEL_LOW>;
+				interrupt-map = <0 0 0 0 &liointc1 3 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 				external-facing;
 			};
 
-			pci_bridge@d,0 {
+			pcie@d,0 {
 				compatible = "pci0014,7a19.0",
 						   "pci0014,7a19",
 						   "pciclass060400",
 						   "pciclass0604";
 
 				reg = <0x6800 0x0 0x0 0x0 0x0>;
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
-				interrupts = <4 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <4 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&liointc1>;
 				interrupt-map-mask = <0 0 0 0>;
-				interrupt-map = <0 0 0 0 &liointc1 4 IRQ_TYPE_LEVEL_LOW>;
+				interrupt-map = <0 0 0 0 &liointc1 4 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 				external-facing;
 			};
 
-			pci_bridge@e,0 {
+			pcie@e,0 {
 				compatible = "pci0014,7a09.0",
 						   "pci0014,7a09",
 						   "pciclass060400",
 						   "pciclass0604";
 
 				reg = <0x7000 0x0 0x0 0x0 0x0>;
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
-				interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
+				interrupts = <5 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&liointc1>;
 				interrupt-map-mask = <0 0 0 0>;
-				interrupt-map = <0 0 0 0 &liointc1 5 IRQ_TYPE_LEVEL_LOW>;
+				interrupt-map = <0 0 0 0 &liointc1 5 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 				external-facing;
 			};
 
--- linux-qcom-6.8.0.orig/arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dts
+++ linux-qcom-6.8.0/arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dts
@@ -33,6 +33,7 @@
 		compatible = "loongson,pch-msi-1.0";
 		reg = <0 0x2ff00000 0 0x8>;
 		interrupt-controller;
+		#interrupt-cells = <1>;
 		msi-controller;
 		loongson,msi-base-vec = <64>;
 		loongson,msi-num-vecs = <192>;
--- linux-qcom-6.8.0.orig/arch/mips/boot/dts/loongson/ls7a-pch.dtsi
+++ linux-qcom-6.8.0/arch/mips/boot/dts/loongson/ls7a-pch.dtsi
@@ -70,7 +70,6 @@
 			device_type = "pci";
 			#address-cells = <3>;
 			#size-cells = <2>;
-			#interrupt-cells = <2>;
 			msi-parent = <&msi>;
 
 			reg = <0 0x1a000000 0 0x02000000>,
@@ -234,7 +233,7 @@
 				};
 			};
 
-			pci_bridge@9,0 {
+			pcie@9,0 {
 				compatible = "pci0014,7a19.1",
 						   "pci0014,7a19",
 						   "pciclass060400",
@@ -244,12 +243,16 @@
 				interrupts = <32 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 32 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@a,0 {
+			pcie@a,0 {
 				compatible = "pci0014,7a09.1",
 						   "pci0014,7a09",
 						   "pciclass060400",
@@ -259,12 +262,16 @@
 				interrupts = <33 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 33 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@b,0 {
+			pcie@b,0 {
 				compatible = "pci0014,7a09.1",
 						   "pci0014,7a09",
 						   "pciclass060400",
@@ -274,12 +281,16 @@
 				interrupts = <34 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 34 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@c,0 {
+			pcie@c,0 {
 				compatible = "pci0014,7a09.1",
 						   "pci0014,7a09",
 						   "pciclass060400",
@@ -289,12 +300,16 @@
 				interrupts = <35 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 35 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@d,0 {
+			pcie@d,0 {
 				compatible = "pci0014,7a19.1",
 						   "pci0014,7a19",
 						   "pciclass060400",
@@ -304,12 +319,16 @@
 				interrupts = <36 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 36 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@e,0 {
+			pcie@e,0 {
 				compatible = "pci0014,7a09.1",
 						   "pci0014,7a09",
 						   "pciclass060400",
@@ -319,12 +338,16 @@
 				interrupts = <37 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 37 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@f,0 {
+			pcie@f,0 {
 				compatible = "pci0014,7a29.1",
 						   "pci0014,7a29",
 						   "pciclass060400",
@@ -334,12 +357,16 @@
 				interrupts = <40 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 40 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@10,0 {
+			pcie@10,0 {
 				compatible = "pci0014,7a19.1",
 						   "pci0014,7a19",
 						   "pciclass060400",
@@ -349,12 +376,16 @@
 				interrupts = <41 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 41 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@11,0 {
+			pcie@11,0 {
 				compatible = "pci0014,7a29.1",
 						   "pci0014,7a29",
 						   "pciclass060400",
@@ -364,12 +395,16 @@
 				interrupts = <42 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 42 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@12,0 {
+			pcie@12,0 {
 				compatible = "pci0014,7a19.1",
 						   "pci0014,7a19",
 						   "pciclass060400",
@@ -379,12 +414,16 @@
 				interrupts = <43 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 43 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@13,0 {
+			pcie@13,0 {
 				compatible = "pci0014,7a29.1",
 						   "pci0014,7a29",
 						   "pciclass060400",
@@ -394,12 +433,16 @@
 				interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 38 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 
-			pci_bridge@14,0 {
+			pcie@14,0 {
 				compatible = "pci0014,7a19.1",
 						   "pci0014,7a19",
 						   "pciclass060400",
@@ -409,9 +452,13 @@
 				interrupts = <39 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&pic>;
 
+				#address-cells = <3>;
+				#size-cells = <2>;
+				device_type = "pci";
 				#interrupt-cells = <1>;
 				interrupt-map-mask = <0 0 0 0>;
 				interrupt-map = <0 0 0 0 &pic 39 IRQ_TYPE_LEVEL_HIGH>;
+				ranges;
 			};
 		};
 
--- linux-qcom-6.8.0.orig/arch/mips/include/asm/mach-loongson64/boot_param.h
+++ linux-qcom-6.8.0/arch/mips/include/asm/mach-loongson64/boot_param.h
@@ -42,12 +42,14 @@
 	Legacy_1B = 0x5,
 	Legacy_2G = 0x6,
 	Legacy_2H = 0x7,
+	Legacy_2K = 0x8,
 	Loongson_1A = 0x100,
 	Loongson_1B = 0x101,
 	Loongson_2E = 0x200,
 	Loongson_2F = 0x201,
 	Loongson_2G = 0x202,
 	Loongson_2H = 0x203,
+	Loongson_2K = 0x204,
 	Loongson_3A = 0x300,
 	Loongson_3B = 0x301
 };
--- linux-qcom-6.8.0.orig/arch/mips/include/asm/mips-cm.h
+++ linux-qcom-6.8.0/arch/mips/include/asm/mips-cm.h
@@ -33,6 +33,19 @@
  */
 extern phys_addr_t __mips_cm_phys_base(void);
 
+/**
+ * mips_cm_l2sync_phys_base - retrieve the physical base address of the CM
+ *                            L2-sync region
+ *
+ * This function returns the physical base address of the Coherence Manager
+ * L2-cache only region. It provides a default implementation which reads the
+ * CMGCRL2OnlySyncBase register where available or returns a 4K region just
+ * behind the CM GCR base address. It may be overridden by platforms which
+ * determine this address in a different way by defining a function with the
+ * same prototype.
+ */
+extern phys_addr_t mips_cm_l2sync_phys_base(void);
+
 /*
  * mips_cm_is64 - determine CM register width
  *
@@ -228,6 +241,10 @@
 GCR_ACCESSOR_RO(32, 0x0f0, cpc_status)
 #define CM_GCR_CPC_STATUS_EX			BIT(0)
 
+/* GCR_ACCESS - Controls core/IOCU access to GCRs */
+GCR_ACCESSOR_RW(32, 0x120, access_cm3)
+#define CM_GCR_ACCESS_ACCESSEN			GENMASK(7, 0)
+
 /* GCR_L2_CONFIG - Indicates L2 cache configuration when Config5.L2C=1 */
 GCR_ACCESSOR_RW(32, 0x130, l2_config)
 #define CM_GCR_L2_CONFIG_BYPASS			BIT(20)
--- linux-qcom-6.8.0.orig/arch/mips/include/asm/mipsregs.h
+++ linux-qcom-6.8.0/arch/mips/include/asm/mipsregs.h
@@ -2078,7 +2078,14 @@
 		_ASM_INSN_IF_MIPS(0x4200000c)				\
 		_ASM_INSN32_IF_MM(0x0000517c)
 #else	/* !TOOLCHAIN_SUPPORTS_VIRT */
-#define _ASM_SET_VIRT ".set\tvirt\n\t"
+#if MIPS_ISA_REV >= 5
+#define _ASM_SET_VIRT_ISA
+#elif defined(CONFIG_64BIT)
+#define _ASM_SET_VIRT_ISA ".set\tmips64r5\n\t"
+#else
+#define _ASM_SET_VIRT_ISA ".set\tmips32r5\n\t"
+#endif
+#define _ASM_SET_VIRT _ASM_SET_VIRT_ISA ".set\tvirt\n\t"
 #define _ASM_SET_MFGC0	_ASM_SET_VIRT
 #define _ASM_SET_DMFGC0	_ASM_SET_VIRT
 #define _ASM_SET_MTGC0	_ASM_SET_VIRT
@@ -2099,7 +2106,6 @@
 ({ int __res;								\
 	__asm__ __volatile__(						\
 		".set\tpush\n\t"					\
-		".set\tmips32r5\n\t"					\
 		_ASM_SET_MFGC0						\
 		"mfgc0\t%0, " #source ", %1\n\t"			\
 		_ASM_UNSET_MFGC0					\
@@ -2113,7 +2119,6 @@
 ({ unsigned long long __res;						\
 	__asm__ __volatile__(						\
 		".set\tpush\n\t"					\
-		".set\tmips64r5\n\t"					\
 		_ASM_SET_DMFGC0						\
 		"dmfgc0\t%0, " #source ", %1\n\t"			\
 		_ASM_UNSET_DMFGC0					\
@@ -2127,7 +2132,6 @@
 do {									\
 	__asm__ __volatile__(						\
 		".set\tpush\n\t"					\
-		".set\tmips32r5\n\t"					\
 		_ASM_SET_MTGC0						\
 		"mtgc0\t%z0, " #register ", %1\n\t"			\
 		_ASM_UNSET_MTGC0					\
@@ -2140,7 +2144,6 @@
 do {									\
 	__asm__ __volatile__(						\
 		".set\tpush\n\t"					\
-		".set\tmips64r5\n\t"					\
 		_ASM_SET_DMTGC0						\
 		"dmtgc0\t%z0, " #register ", %1\n\t"			\
 		_ASM_UNSET_DMTGC0					\
--- linux-qcom-6.8.0.orig/arch/mips/include/asm/ptrace.h
+++ linux-qcom-6.8.0/arch/mips/include/asm/ptrace.h
@@ -159,7 +159,7 @@
 #define exception_ip(regs) exception_ip(regs)
 #define profile_pc(regs) instruction_pointer(regs)
 
-extern asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall);
+extern asmlinkage long syscall_trace_enter(struct pt_regs *regs);
 extern asmlinkage void syscall_trace_leave(struct pt_regs *regs);
 
 extern void die(const char *, struct pt_regs *) __noreturn;
--- linux-qcom-6.8.0.orig/arch/mips/include/asm/switch_to.h
+++ linux-qcom-6.8.0/arch/mips/include/asm/switch_to.h
@@ -97,7 +97,7 @@
 	}								\
 } while (0)
 #else
-# define __sanitize_fcr31(next)
+# define __sanitize_fcr31(next) do { (void) (next); } while (0)
 #endif
 
 /*
--- linux-qcom-6.8.0.orig/arch/mips/kernel/asm-offsets.c
+++ linux-qcom-6.8.0/arch/mips/kernel/asm-offsets.c
@@ -101,6 +101,7 @@
 	OFFSET(TI_CPU, thread_info, cpu);
 	OFFSET(TI_PRE_COUNT, thread_info, preempt_count);
 	OFFSET(TI_REGS, thread_info, regs);
+	OFFSET(TI_SYSCALL, thread_info, syscall);
 	DEFINE(_THREAD_SIZE, THREAD_SIZE);
 	DEFINE(_THREAD_MASK, THREAD_MASK);
 	DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
--- linux-qcom-6.8.0.orig/arch/mips/kernel/cevt-r4k.c
+++ linux-qcom-6.8.0/arch/mips/kernel/cevt-r4k.c
@@ -303,13 +303,6 @@
 	if (!c0_compare_int_usable())
 		return -ENXIO;
 
-	/*
-	 * With vectored interrupts things are getting platform specific.
-	 * get_c0_compare_int is a hook to allow a platform to return the
-	 * interrupt number of its liking.
-	 */
-	irq = get_c0_compare_int();
-
 	cd = &per_cpu(mips_clockevent_device, cpu);
 
 	cd->name		= "MIPS";
@@ -320,7 +313,6 @@
 	min_delta		= calculate_min_delta();
 
 	cd->rating		= 300;
-	cd->irq			= irq;
 	cd->cpumask		= cpumask_of(cpu);
 	cd->set_next_event	= mips_next_event;
 	cd->event_handler	= mips_event_handler;
@@ -332,6 +324,13 @@
 
 	cp0_timer_irq_installed = 1;
 
+	/*
+	 * With vectored interrupts things are getting platform specific.
+	 * get_c0_compare_int is a hook to allow a platform to return the
+	 * interrupt number of its liking.
+	 */
+	irq = get_c0_compare_int();
+
 	if (request_irq(irq, c0_compare_interrupt, flags, "timer",
 			c0_compare_interrupt))
 		pr_err("Failed to request irq %d (timer)\n", irq);
--- linux-qcom-6.8.0.orig/arch/mips/kernel/cmpxchg.c
+++ linux-qcom-6.8.0/arch/mips/kernel/cmpxchg.c
@@ -102,3 +102,4 @@
 			return old;
 	}
 }
+EXPORT_SYMBOL(__cmpxchg_small);
--- linux-qcom-6.8.0.orig/arch/mips/kernel/cpu-probe.c
+++ linux-qcom-6.8.0/arch/mips/kernel/cpu-probe.c
@@ -1724,12 +1724,16 @@
 		c->ases |= (MIPS_ASE_LOONGSON_MMI | MIPS_ASE_LOONGSON_CAM |
 			MIPS_ASE_LOONGSON_EXT | MIPS_ASE_LOONGSON_EXT2);
 		c->ases &= ~MIPS_ASE_VZ; /* VZ of Loongson-3A2000/3000 is incomplete */
+		change_c0_config6(LOONGSON_CONF6_EXTIMER | LOONGSON_CONF6_INTIMER,
+				  LOONGSON_CONF6_INTIMER);
 		break;
 	case PRID_IMP_LOONGSON_64G:
 		__cpu_name[cpu] = "ICT Loongson-3";
 		set_elf_platform(cpu, "loongson3a");
 		set_isa(c, MIPS_CPU_ISA_M64R2);
 		decode_cpucfg(c);
+		change_c0_config6(LOONGSON_CONF6_EXTIMER | LOONGSON_CONF6_INTIMER,
+				  LOONGSON_CONF6_INTIMER);
 		break;
 	default:
 		panic("Unknown Loongson Processor ID!");
--- linux-qcom-6.8.0.orig/arch/mips/kernel/mips-cm.c
+++ linux-qcom-6.8.0/arch/mips/kernel/mips-cm.c
@@ -201,7 +201,7 @@
 phys_addr_t mips_cm_phys_base(void)
 	__attribute__((weak, alias("__mips_cm_phys_base")));
 
-static phys_addr_t __mips_cm_l2sync_phys_base(void)
+phys_addr_t __weak mips_cm_l2sync_phys_base(void)
 {
 	u32 base_reg;
 
@@ -217,9 +217,6 @@
 	return mips_cm_phys_base() + MIPS_CM_GCR_SIZE;
 }
 
-phys_addr_t mips_cm_l2sync_phys_base(void)
-	__attribute__((weak, alias("__mips_cm_l2sync_phys_base")));
-
 static void mips_cm_probe_l2sync(void)
 {
 	unsigned major_rev;
--- linux-qcom-6.8.0.orig/arch/mips/kernel/prom.c
+++ linux-qcom-6.8.0/arch/mips/kernel/prom.c
@@ -41,7 +41,7 @@
 
 void __init __dt_setup_arch(void *bph)
 {
-	if (!early_init_dt_scan(bph))
+	if (!early_init_dt_scan(bph, __pa(bph)))
 		return;
 
 	mips_set_machine_name(of_flat_dt_get_machine_name());
--- linux-qcom-6.8.0.orig/arch/mips/kernel/ptrace.c
+++ linux-qcom-6.8.0/arch/mips/kernel/ptrace.c
@@ -1317,16 +1317,13 @@
  * Notification of system call entry/exit
  * - triggered by current->work.syscall_trace
  */
-asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
+asmlinkage long syscall_trace_enter(struct pt_regs *regs)
 {
 	user_exit();
 
-	current_thread_info()->syscall = syscall;
-
 	if (test_thread_flag(TIF_SYSCALL_TRACE)) {
 		if (ptrace_report_syscall_entry(regs))
 			return -1;
-		syscall = current_thread_info()->syscall;
 	}
 
 #ifdef CONFIG_SECCOMP
@@ -1335,7 +1332,7 @@
 		struct seccomp_data sd;
 		unsigned long args[6];
 
-		sd.nr = syscall;
+		sd.nr = current_thread_info()->syscall;
 		sd.arch = syscall_get_arch(current);
 		syscall_get_arguments(current, regs, args);
 		for (i = 0; i < 6; i++)
@@ -1345,23 +1342,23 @@
 		ret = __secure_computing(&sd);
 		if (ret == -1)
 			return ret;
-		syscall = current_thread_info()->syscall;
 	}
 #endif
 
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(syscall, regs->regs[4], regs->regs[5],
+	audit_syscall_entry(current_thread_info()->syscall,
+			    regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 
 	/*
 	 * Negative syscall numbers are mistaken for rejected syscalls, but
 	 * won't have had the return value set appropriately, so we do so now.
 	 */
-	if (syscall < 0)
+	if (current_thread_info()->syscall < 0)
 		syscall_set_return_value(current, regs, -ENOSYS, 0);
-	return syscall;
+	return current_thread_info()->syscall;
 }
 
 /*
--- linux-qcom-6.8.0.orig/arch/mips/kernel/relocate.c
+++ linux-qcom-6.8.0/arch/mips/kernel/relocate.c
@@ -337,7 +337,7 @@
 #if defined(CONFIG_USE_OF)
 	/* Deal with the device tree */
 	fdt = plat_get_fdt();
-	early_init_dt_scan(fdt);
+	early_init_dt_scan(fdt, __pa(fdt));
 	if (boot_command_line[0]) {
 		/* Boot command line was passed in device tree */
 		strscpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE);
--- linux-qcom-6.8.0.orig/arch/mips/kernel/scall32-o32.S
+++ linux-qcom-6.8.0/arch/mips/kernel/scall32-o32.S
@@ -77,6 +77,18 @@
 	PTR_WD	load_a7, bad_stack_a7
 	.previous
 
+	/*
+	 * syscall number is in v0 unless we called syscall(__NR_###)
+	 * where the real syscall number is in a0
+	 */
+	subu	t2, v0,  __NR_O32_Linux
+	bnez	t2, 1f /* __NR_syscall at offset 0 */
+	LONG_S	a0, TI_SYSCALL($28)	# Save a0 as syscall number
+	b	2f
+1:
+	LONG_S	v0, TI_SYSCALL($28)	# Save v0 as syscall number
+2:
+
 	lw	t0, TI_FLAGS($28)	# syscall tracing enabled?
 	li	t1, _TIF_WORK_SYSCALL_ENTRY
 	and	t0, t1
@@ -114,16 +126,7 @@
 	SAVE_STATIC
 	move	a0, sp
 
-	/*
-	 * syscall number is in v0 unless we called syscall(__NR_###)
-	 * where the real syscall number is in a0
-	 */
-	move	a1, v0
-	subu	t2, v0,  __NR_O32_Linux
-	bnez	t2, 1f /* __NR_syscall at offset 0 */
-	lw	a1, PT_R4(sp)
-
-1:	jal	syscall_trace_enter
+	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
 
--- linux-qcom-6.8.0.orig/arch/mips/kernel/scall64-n32.S
+++ linux-qcom-6.8.0/arch/mips/kernel/scall64-n32.S
@@ -44,6 +44,8 @@
 
 	sd	a3, PT_R26(sp)		# save a3 for syscall restarting
 
+	LONG_S	v0, TI_SYSCALL($28)     # Store syscall number
+
 	li	t1, _TIF_WORK_SYSCALL_ENTRY
 	LONG_L	t0, TI_FLAGS($28)	# syscall tracing enabled?
 	and	t0, t1, t0
@@ -72,7 +74,6 @@
 n32_syscall_trace_entry:
 	SAVE_STATIC
 	move	a0, sp
-	move	a1, v0
 	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
--- linux-qcom-6.8.0.orig/arch/mips/kernel/scall64-n64.S
+++ linux-qcom-6.8.0/arch/mips/kernel/scall64-n64.S
@@ -46,6 +46,8 @@
 
 	sd	a3, PT_R26(sp)		# save a3 for syscall restarting
 
+	LONG_S	v0, TI_SYSCALL($28)     # Store syscall number
+
 	li	t1, _TIF_WORK_SYSCALL_ENTRY
 	LONG_L	t0, TI_FLAGS($28)	# syscall tracing enabled?
 	and	t0, t1, t0
@@ -82,7 +84,6 @@
 syscall_trace_entry:
 	SAVE_STATIC
 	move	a0, sp
-	move	a1, v0
 	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
--- linux-qcom-6.8.0.orig/arch/mips/kernel/scall64-o32.S
+++ linux-qcom-6.8.0/arch/mips/kernel/scall64-o32.S
@@ -79,6 +79,22 @@
 	PTR_WD	load_a7, bad_stack_a7
 	.previous
 
+	/*
+	 * absolute syscall number is in v0 unless we called syscall(__NR_###)
+	 * where the real syscall number is in a0
+	 * note: NR_syscall is the first O32 syscall but the macro is
+	 * only defined when compiling with -mabi=32 (CONFIG_32BIT)
+	 * therefore __NR_O32_Linux is used (4000)
+	 */
+
+	subu	t2, v0,  __NR_O32_Linux
+	bnez	t2, 1f /* __NR_syscall at offset 0 */
+	LONG_S	a0, TI_SYSCALL($28)	# Save a0 as syscall number
+	b	2f
+1:
+	LONG_S	v0, TI_SYSCALL($28)	# Save v0 as syscall number
+2:
+
 	li	t1, _TIF_WORK_SYSCALL_ENTRY
 	LONG_L	t0, TI_FLAGS($28)	# syscall tracing enabled?
 	and	t0, t1, t0
@@ -113,22 +129,7 @@
 	sd	a7, PT_R11(sp)		# For indirect syscalls
 
 	move	a0, sp
-	/*
-	 * absolute syscall number is in v0 unless we called syscall(__NR_###)
-	 * where the real syscall number is in a0
-	 * note: NR_syscall is the first O32 syscall but the macro is
-	 * only defined when compiling with -mabi=32 (CONFIG_32BIT)
-	 * therefore __NR_O32_Linux is used (4000)
-	 */
-	.set	push
-	.set	reorder
-	subu	t1, v0,  __NR_O32_Linux
-	move	a1, v0
-	bnez	t1, 1f /* __NR_syscall at offset 0 */
-	ld	a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
-	.set	pop
-
-1:	jal	syscall_trace_enter
+	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
 
--- linux-qcom-6.8.0.orig/arch/mips/kernel/smp-cps.c
+++ linux-qcom-6.8.0/arch/mips/kernel/smp-cps.c
@@ -222,7 +222,10 @@
 	write_gcr_co_reset_ext_base(CM_GCR_Cx_RESET_EXT_BASE_UEB);
 
 	/* Ensure the core can access the GCRs */
-	set_gcr_access(1 << core);
+	if (mips_cm_revision() < CM_REV_CM3)
+		set_gcr_access(1 << core);
+	else
+		set_gcr_access_cm3(1 << core);
 
 	if (mips_cpc_present()) {
 		/* Reset the core */
--- linux-qcom-6.8.0.orig/arch/mips/kernel/syscalls/syscall_n32.tbl
+++ linux-qcom-6.8.0/arch/mips/kernel/syscalls/syscall_n32.tbl
@@ -354,7 +354,7 @@
 412	n32	utimensat_time64		sys_utimensat
 413	n32	pselect6_time64			compat_sys_pselect6_time64
 414	n32	ppoll_time64			compat_sys_ppoll_time64
-416	n32	io_pgetevents_time64		sys_io_pgetevents
+416	n32	io_pgetevents_time64		compat_sys_io_pgetevents_time64
 417	n32	recvmmsg_time64			compat_sys_recvmmsg_time64
 418	n32	mq_timedsend_time64		sys_mq_timedsend
 419	n32	mq_timedreceive_time64		sys_mq_timedreceive
--- linux-qcom-6.8.0.orig/arch/mips/kernel/syscalls/syscall_o32.tbl
+++ linux-qcom-6.8.0/arch/mips/kernel/syscalls/syscall_o32.tbl
@@ -27,7 +27,7 @@
 17	o32	break				sys_ni_syscall
 # 18 was sys_stat
 18	o32	unused18			sys_ni_syscall
-19	o32	lseek				sys_lseek
+19	o32	lseek				sys_lseek			compat_sys_lseek
 20	o32	getpid				sys_getpid
 21	o32	mount				sys_mount
 22	o32	umount				sys_oldumount
@@ -403,7 +403,7 @@
 412	o32	utimensat_time64		sys_utimensat			sys_utimensat
 413	o32	pselect6_time64			sys_pselect6			compat_sys_pselect6_time64
 414	o32	ppoll_time64			sys_ppoll			compat_sys_ppoll_time64
-416	o32	io_pgetevents_time64		sys_io_pgetevents		sys_io_pgetevents
+416	o32	io_pgetevents_time64		sys_io_pgetevents		compat_sys_io_pgetevents_time64
 417	o32	recvmmsg_time64			sys_recvmmsg			compat_sys_recvmmsg_time64
 418	o32	mq_timedsend_time64		sys_mq_timedsend		sys_mq_timedsend
 419	o32	mq_timedreceive_time64		sys_mq_timedreceive		sys_mq_timedreceive
--- linux-qcom-6.8.0.orig/arch/mips/loongson64/env.c
+++ linux-qcom-6.8.0/arch/mips/loongson64/env.c
@@ -88,6 +88,12 @@
 	cpu_clock_freq = ecpu->cpu_clock_freq;
 	loongson_sysconf.cputype = ecpu->cputype;
 	switch (ecpu->cputype) {
+	case Legacy_2K:
+	case Loongson_2K:
+		smp_group[0] = 0x900000001fe11000;
+		loongson_sysconf.cores_per_node = 2;
+		loongson_sysconf.cores_per_package = 2;
+		break;
 	case Legacy_3A:
 	case Loongson_3A:
 		loongson_sysconf.cores_per_node = 4;
@@ -221,6 +227,8 @@
 		default:
 			break;
 		}
+	} else if ((read_c0_prid() & PRID_IMP_MASK) == PRID_IMP_LOONGSON_64R) {
+		loongson_fdt_blob = __dtb_loongson64_2core_2k1000_begin;
 	} else if ((read_c0_prid() & PRID_IMP_MASK) == PRID_IMP_LOONGSON_64G) {
 		if (loongson_sysconf.bridgetype == LS7A)
 			loongson_fdt_blob = __dtb_loongson64g_4core_ls7a_begin;
--- linux-qcom-6.8.0.orig/arch/mips/loongson64/reset.c
+++ linux-qcom-6.8.0/arch/mips/loongson64/reset.c
@@ -11,6 +11,7 @@
 #include <linux/init.h>
 #include <linux/kexec.h>
 #include <linux/pm.h>
+#include <linux/reboot.h>
 #include <linux/slab.h>
 
 #include <asm/bootinfo.h>
@@ -21,36 +22,21 @@
 #include <loongson.h>
 #include <boot_param.h>
 
-static void loongson_restart(char *command)
+static int firmware_restart(struct sys_off_data *unusedd)
 {
 
 	void (*fw_restart)(void) = (void *)loongson_sysconf.restart_addr;
 
 	fw_restart();
-	while (1) {
-		if (cpu_wait)
-			cpu_wait();
-	}
+	return NOTIFY_DONE;
 }
 
-static void loongson_poweroff(void)
+static int firmware_poweroff(struct sys_off_data *unused)
 {
 	void (*fw_poweroff)(void) = (void *)loongson_sysconf.poweroff_addr;
 
 	fw_poweroff();
-	while (1) {
-		if (cpu_wait)
-			cpu_wait();
-	}
-}
-
-static void loongson_halt(void)
-{
-	pr_notice("\n\n** You can safely turn off the power now **\n\n");
-	while (1) {
-		if (cpu_wait)
-			cpu_wait();
-	}
+	return NOTIFY_DONE;
 }
 
 #ifdef CONFIG_KEXEC_CORE
@@ -154,9 +140,17 @@
 
 static int __init mips_reboot_setup(void)
 {
-	_machine_restart = loongson_restart;
-	_machine_halt = loongson_halt;
-	pm_power_off = loongson_poweroff;
+	if (loongson_sysconf.restart_addr) {
+		register_sys_off_handler(SYS_OFF_MODE_RESTART,
+				 SYS_OFF_PRIO_FIRMWARE,
+				 firmware_restart, NULL);
+	}
+
+	if (loongson_sysconf.poweroff_addr) {
+		register_sys_off_handler(SYS_OFF_MODE_POWER_OFF,
+				 SYS_OFF_PRIO_FIRMWARE,
+				 firmware_poweroff, NULL);
+	}
 
 #ifdef CONFIG_KEXEC_CORE
 	kexec_argv = kmalloc(KEXEC_ARGV_SIZE, GFP_KERNEL);
--- linux-qcom-6.8.0.orig/arch/mips/loongson64/smp.c
+++ linux-qcom-6.8.0/arch/mips/loongson64/smp.c
@@ -466,12 +466,25 @@
 static void __init loongson3_smp_setup(void)
 {
 	int i = 0, num = 0; /* i: physical id, num: logical id */
+	int max_cpus = 0;
 
 	init_cpu_possible(cpu_none_mask);
 
+	for (i = 0; i < ARRAY_SIZE(smp_group); i++) {
+		if (!smp_group[i])
+			break;
+		max_cpus += loongson_sysconf.cores_per_node;
+	}
+
+	if (max_cpus < loongson_sysconf.nr_cpus) {
+		pr_err("SMP Groups are less than the number of CPUs\n");
+		loongson_sysconf.nr_cpus = max_cpus ? max_cpus : 1;
+	}
+
 	/* For unified kernel, NR_CPUS is the maximum possible value,
 	 * loongson_sysconf.nr_cpus is the really present value
 	 */
+	i = 0;
 	while (i < loongson_sysconf.nr_cpus) {
 		if (loongson_sysconf.reserved_cpus_mask & (1<<i)) {
 			/* Reserved physical CPU cores */
@@ -492,14 +505,14 @@
 		__cpu_logical_map[num] = -1;
 		num++;
 	}
-
 	csr_ipi_probe();
 	ipi_set0_regs_init();
 	ipi_clear0_regs_init();
 	ipi_status0_regs_init();
 	ipi_en0_regs_init();
 	ipi_mailbox_buf_init();
-	ipi_write_enable(0);
+	if (smp_group[0])
+		ipi_write_enable(0);
 
 	cpu_set_core(&cpu_data[0],
 		     cpu_logical_map(0) % loongson_sysconf.cores_per_package);
@@ -818,6 +831,9 @@
 	uint64_t core_id = cpu_core(&cpu_data[cpu]);
 	uint64_t package_id = cpu_data[cpu].package;
 
+	if (!loongson_chipcfg[package_id] || !loongson_freqctrl[package_id])
+		return 0;
+
 	if ((read_c0_prid() & PRID_REV_MASK) == PRID_REV_LOONGSON3A_R1) {
 		LOONGSON_CHIPCFG(package_id) &= ~(1 << (12 + core_id));
 	} else {
@@ -832,6 +848,9 @@
 	uint64_t core_id = cpu_core(&cpu_data[cpu]);
 	uint64_t package_id = cpu_data[cpu].package;
 
+	if (!loongson_chipcfg[package_id] || !loongson_freqctrl[package_id])
+		return 0;
+
 	if ((read_c0_prid() & PRID_REV_MASK) == PRID_REV_LOONGSON3A_R1) {
 		LOONGSON_CHIPCFG(package_id) |= 1 << (12 + core_id);
 	} else {
--- linux-qcom-6.8.0.orig/arch/mips/net/bpf_jit_comp.c
+++ linux-qcom-6.8.0/arch/mips/net/bpf_jit_comp.c
@@ -1012,7 +1012,8 @@
 	bpf_prog_fill_jited_linfo(prog, &ctx.descriptors[1]);
 
 	/* Set as read-only exec and flush instruction cache */
-	bpf_jit_binary_lock_ro(header);
+	if (bpf_jit_binary_lock_ro(header))
+		goto out_err;
 	flush_icache_range((unsigned long)header,
 			   (unsigned long)&ctx.target[ctx.jit_index]);
 
--- linux-qcom-6.8.0.orig/arch/mips/pci/ops-rc32434.c
+++ linux-qcom-6.8.0/arch/mips/pci/ops-rc32434.c
@@ -112,8 +112,8 @@
 	 * gives them time to settle
 	 */
 	if (where == PCI_VENDOR_ID) {
-		if (ret == 0xffffffff || ret == 0x00000000 ||
-		    ret == 0x0000ffff || ret == 0xffff0000) {
+		if (*val == 0xffffffff || *val == 0x00000000 ||
+		    *val == 0x0000ffff || *val == 0xffff0000) {
 			if (delay > 4)
 				return 0;
 			delay *= 2;
--- linux-qcom-6.8.0.orig/arch/mips/pci/pcie-octeon.c
+++ linux-qcom-6.8.0/arch/mips/pci/pcie-octeon.c
@@ -230,12 +230,18 @@
 {
 	union cvmx_pcie_address pcie_addr;
 	union cvmx_pciercx_cfg006 pciercx_cfg006;
+	union cvmx_pciercx_cfg032 pciercx_cfg032;
 
 	pciercx_cfg006.u32 =
 	    cvmx_pcie_cfgx_read(pcie_port, CVMX_PCIERCX_CFG006(pcie_port));
 	if ((bus <= pciercx_cfg006.s.pbnum) && (dev != 0))
 		return 0;
 
+	pciercx_cfg032.u32 =
+		cvmx_pcie_cfgx_read(pcie_port, CVMX_PCIERCX_CFG032(pcie_port));
+	if ((pciercx_cfg032.s.dlla == 0) || (pciercx_cfg032.s.lt == 1))
+		return 0;
+
 	pcie_addr.u64 = 0;
 	pcie_addr.config.upper = 2;
 	pcie_addr.config.io = 1;
--- linux-qcom-6.8.0.orig/arch/mips/sgi-ip30/ip30-console.c
+++ linux-qcom-6.8.0/arch/mips/sgi-ip30/ip30-console.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 
 #include <linux/io.h>
+#include <linux/processor.h>
 
 #include <asm/sn/ioc3.h>
 #include <asm/setup.h>
--- linux-qcom-6.8.0.orig/arch/nios2/kernel/prom.c
+++ linux-qcom-6.8.0/arch/nios2/kernel/prom.c
@@ -26,12 +26,12 @@
 	if (be32_to_cpup((__be32 *)CONFIG_NIOS2_DTB_PHYS_ADDR) ==
 		 OF_DT_HEADER) {
 		params = (void *)CONFIG_NIOS2_DTB_PHYS_ADDR;
-		early_init_dt_scan(params);
+		early_init_dt_scan(params, __pa(params));
 		return;
 	}
 #endif
 	if (be32_to_cpu((__be32) *dtb) == OF_DT_HEADER)
 		params = (void *)__dtb_start;
 
-	early_init_dt_scan(params);
+	early_init_dt_scan(params, __pa(params));
 }
--- linux-qcom-6.8.0.orig/arch/openrisc/Kconfig
+++ linux-qcom-6.8.0/arch/openrisc/Kconfig
@@ -64,6 +64,9 @@
 config LOCKDEP_SUPPORT
 	def_bool  y
 
+config FIX_EARLYCON_MEM
+	def_bool y
+
 menu "Processor type and features"
 
 choice
--- linux-qcom-6.8.0.orig/arch/openrisc/include/asm/fixmap.h
+++ linux-qcom-6.8.0/arch/openrisc/include/asm/fixmap.h
@@ -26,59 +26,19 @@
 #include <linux/bug.h>
 #include <asm/page.h>
 
-/*
- * On OpenRISC we use these special fixed_addresses for doing ioremap
- * early in the boot process before memory initialization is complete.
- * This is used, in particular, by the early serial console code.
- *
- * It's not really 'fixmap', per se, but fits loosely into the same
- * paradigm.
- */
 enum fixed_addresses {
-	/*
-	 * FIX_IOREMAP entries are useful for mapping physical address
-	 * space before ioremap() is useable, e.g. really early in boot
-	 * before kmalloc() is working.
-	 */
-#define FIX_N_IOREMAPS  32
-	FIX_IOREMAP_BEGIN,
-	FIX_IOREMAP_END = FIX_IOREMAP_BEGIN + FIX_N_IOREMAPS - 1,
+	FIX_EARLYCON_MEM_BASE,
 	__end_of_fixed_addresses
 };
 
 #define FIXADDR_SIZE		(__end_of_fixed_addresses << PAGE_SHIFT)
 /* FIXADDR_BOTTOM might be a better name here... */
 #define FIXADDR_START		(FIXADDR_TOP - FIXADDR_SIZE)
+#define FIXMAP_PAGE_IO		PAGE_KERNEL_NOCACHE
 
-#define __fix_to_virt(x)	(FIXADDR_TOP - ((x) << PAGE_SHIFT))
-#define __virt_to_fix(x)	((FIXADDR_TOP - ((x)&PAGE_MASK)) >> PAGE_SHIFT)
+extern void __set_fixmap(enum fixed_addresses idx,
+			 phys_addr_t phys, pgprot_t flags);
 
-/*
- * 'index to address' translation. If anyone tries to use the idx
- * directly without tranlation, we catch the bug with a NULL-deference
- * kernel oops. Illegal ranges of incoming indices are caught too.
- */
-static __always_inline unsigned long fix_to_virt(const unsigned int idx)
-{
-	/*
-	 * this branch gets completely eliminated after inlining,
-	 * except when someone tries to use fixaddr indices in an
-	 * illegal way. (such as mixing up address types or using
-	 * out-of-range indices).
-	 *
-	 * If it doesn't get removed, the linker will complain
-	 * loudly with a reasonably clear error message..
-	 */
-	if (idx >= __end_of_fixed_addresses)
-		BUG();
-
-	return __fix_to_virt(idx);
-}
-
-static inline unsigned long virt_to_fix(const unsigned long vaddr)
-{
-	BUG_ON(vaddr >= FIXADDR_TOP || vaddr < FIXADDR_START);
-	return __virt_to_fix(vaddr);
-}
+#include <asm-generic/fixmap.h>
 
 #endif
--- linux-qcom-6.8.0.orig/arch/openrisc/kernel/prom.c
+++ linux-qcom-6.8.0/arch/openrisc/kernel/prom.c
@@ -22,6 +22,6 @@
 
 void __init early_init_devtree(void *params)
 {
-	early_init_dt_scan(params);
+	early_init_dt_scan(params, __pa(params));
 	memblock_allow_resize();
 }
--- linux-qcom-6.8.0.orig/arch/openrisc/kernel/setup.c
+++ linux-qcom-6.8.0/arch/openrisc/kernel/setup.c
@@ -255,6 +255,9 @@
 
 void __init setup_arch(char **cmdline_p)
 {
+	/* setup memblock allocator */
+	setup_memory();
+
 	unflatten_and_copy_device_tree();
 
 	setup_cpuinfo();
@@ -278,9 +281,6 @@
 	}
 #endif
 
-	/* setup memblock allocator */
-	setup_memory();
-
 	/* paging_init() sets up the MMU and marks all pages as reserved */
 	paging_init();
 
--- linux-qcom-6.8.0.orig/arch/openrisc/kernel/traps.c
+++ linux-qcom-6.8.0/arch/openrisc/kernel/traps.c
@@ -180,29 +180,39 @@
 
 asmlinkage void do_fpe_trap(struct pt_regs *regs, unsigned long address)
 {
-	int code = FPE_FLTUNK;
-	unsigned long fpcsr = regs->fpcsr;
-
-	if (fpcsr & SPR_FPCSR_IVF)
-		code = FPE_FLTINV;
-	else if (fpcsr & SPR_FPCSR_OVF)
-		code = FPE_FLTOVF;
-	else if (fpcsr & SPR_FPCSR_UNF)
-		code = FPE_FLTUND;
-	else if (fpcsr & SPR_FPCSR_DZF)
-		code = FPE_FLTDIV;
-	else if (fpcsr & SPR_FPCSR_IXF)
-		code = FPE_FLTRES;
-
-	/* Clear all flags */
-	regs->fpcsr &= ~SPR_FPCSR_ALLF;
-
-	force_sig_fault(SIGFPE, code, (void __user *)regs->pc);
+	if (user_mode(regs)) {
+		int code = FPE_FLTUNK;
+		unsigned long fpcsr = regs->fpcsr;
+
+		if (fpcsr & SPR_FPCSR_IVF)
+			code = FPE_FLTINV;
+		else if (fpcsr & SPR_FPCSR_OVF)
+			code = FPE_FLTOVF;
+		else if (fpcsr & SPR_FPCSR_UNF)
+			code = FPE_FLTUND;
+		else if (fpcsr & SPR_FPCSR_DZF)
+			code = FPE_FLTDIV;
+		else if (fpcsr & SPR_FPCSR_IXF)
+			code = FPE_FLTRES;
+
+		/* Clear all flags */
+		regs->fpcsr &= ~SPR_FPCSR_ALLF;
+
+		force_sig_fault(SIGFPE, code, (void __user *)regs->pc);
+	} else {
+		pr_emerg("KERNEL: Illegal fpe exception 0x%.8lx\n", regs->pc);
+		die("Die:", regs, SIGFPE);
+	}
 }
 
 asmlinkage void do_trap(struct pt_regs *regs, unsigned long address)
 {
-	force_sig_fault(SIGTRAP, TRAP_BRKPT, (void __user *)regs->pc);
+	if (user_mode(regs)) {
+		force_sig_fault(SIGTRAP, TRAP_BRKPT, (void __user *)regs->pc);
+	} else {
+		pr_emerg("KERNEL: Illegal trap exception 0x%.8lx\n", regs->pc);
+		die("Die:", regs, SIGILL);
+	}
 }
 
 asmlinkage void do_unaligned_access(struct pt_regs *regs, unsigned long address)
--- linux-qcom-6.8.0.orig/arch/openrisc/mm/init.c
+++ linux-qcom-6.8.0/arch/openrisc/mm/init.c
@@ -207,6 +207,43 @@
 	return;
 }
 
+static int __init map_page(unsigned long va, phys_addr_t pa, pgprot_t prot)
+{
+	p4d_t *p4d;
+	pud_t *pud;
+	pmd_t *pmd;
+	pte_t *pte;
+
+	p4d = p4d_offset(pgd_offset_k(va), va);
+	pud = pud_offset(p4d, va);
+	pmd = pmd_offset(pud, va);
+	pte = pte_alloc_kernel(pmd, va);
+
+	if (pte == NULL)
+		return -ENOMEM;
+
+	if (pgprot_val(prot))
+		set_pte_at(&init_mm, va, pte, pfn_pte(pa >> PAGE_SHIFT, prot));
+	else
+		pte_clear(&init_mm, va, pte);
+
+	local_flush_tlb_page(NULL, va);
+	return 0;
+}
+
+void __init __set_fixmap(enum fixed_addresses idx,
+			 phys_addr_t phys, pgprot_t prot)
+{
+	unsigned long address = __fix_to_virt(idx);
+
+	if (idx >= __end_of_fixed_addresses) {
+		BUG();
+		return;
+	}
+
+	map_page(address, phys, prot);
+}
+
 static const pgprot_t protection_map[16] = {
 	[VM_NONE]					= PAGE_NONE,
 	[VM_READ]					= PAGE_READONLY_X,
--- linux-qcom-6.8.0.orig/arch/parisc/Kconfig
+++ linux-qcom-6.8.0/arch/parisc/Kconfig
@@ -12,12 +12,14 @@
 	select ARCH_HAS_ELF_RANDOMIZE
 	select ARCH_HAS_STRICT_KERNEL_RWX
 	select ARCH_HAS_STRICT_MODULE_RWX
-	select ARCH_HAS_UBSAN_SANITIZE_ALL
+	select ARCH_HAS_UBSAN
 	select ARCH_HAS_PTE_SPECIAL
 	select ARCH_NO_SG_CHAIN
+	select ARCH_SPLIT_ARG64 if !64BIT
 	select ARCH_SUPPORTS_HUGETLBFS if PA20
 	select ARCH_SUPPORTS_MEMORY_FAILURE
 	select ARCH_STACKWALK
+	select ARCH_HAS_CACHE_LINE_SIZE
 	select ARCH_HAS_DEBUG_VM_PGTABLE
 	select HAVE_RELIABLE_STACKTRACE
 	select DMA_OPS
@@ -84,6 +86,7 @@
 	select HAVE_SOFTIRQ_ON_OWN_STACK if IRQSTACKS
 	select TRACE_IRQFLAGS_SUPPORT
 	select HAVE_FUNCTION_DESCRIPTORS if 64BIT
+	select PCI_MSI_ARCH_FALLBACKS if PCI_MSI
 
 	help
 	  The PA-RISC microprocessor is designed by Hewlett-Packard and used
--- linux-qcom-6.8.0.orig/arch/parisc/include/asm/assembly.h
+++ linux-qcom-6.8.0/arch/parisc/include/asm/assembly.h
@@ -97,26 +97,28 @@
 	 * version takes two arguments: a src and destination register.
 	 * However, the source and destination registers can not be
 	 * the same register.
+	 *
+	 * We use add,l to avoid clobbering the C/B bits in the PSW.
 	 */
 
 	.macro  tophys  grvirt, grphys
-	ldil    L%(__PAGE_OFFSET), \grphys
-	sub     \grvirt, \grphys, \grphys
+	ldil    L%(-__PAGE_OFFSET), \grphys
+	addl    \grvirt, \grphys, \grphys
 	.endm
-	
+
 	.macro  tovirt  grphys, grvirt
 	ldil    L%(__PAGE_OFFSET), \grvirt
-	add     \grphys, \grvirt, \grvirt
+	addl    \grphys, \grvirt, \grvirt
 	.endm
 
 	.macro  tophys_r1  gr
-	ldil    L%(__PAGE_OFFSET), %r1
-	sub     \gr, %r1, \gr
+	ldil    L%(-__PAGE_OFFSET), %r1
+	addl    \gr, %r1, \gr
 	.endm
-	
+
 	.macro  tovirt_r1  gr
 	ldil    L%(__PAGE_OFFSET), %r1
-	add     \gr, %r1, \gr
+	addl    \gr, %r1, \gr
 	.endm
 
 	.macro delay value
--- linux-qcom-6.8.0.orig/arch/parisc/include/asm/cache.h
+++ linux-qcom-6.8.0/arch/parisc/include/asm/cache.h
@@ -20,7 +20,16 @@
 
 #define SMP_CACHE_BYTES L1_CACHE_BYTES
 
-#define ARCH_DMA_MINALIGN	L1_CACHE_BYTES
+#ifdef CONFIG_PA20
+#define ARCH_DMA_MINALIGN	128
+#else
+#define ARCH_DMA_MINALIGN	32
+#endif
+#define ARCH_KMALLOC_MINALIGN	16	/* ldcw requires 16-byte alignment */
+
+#define arch_slab_minalign()	((unsigned)dcache_stride)
+#define cache_line_size()	dcache_stride
+#define dma_get_cache_alignment cache_line_size
 
 #define __read_mostly __section(".data..read_mostly")
 
--- linux-qcom-6.8.0.orig/arch/parisc/include/asm/cacheflush.h
+++ linux-qcom-6.8.0/arch/parisc/include/asm/cacheflush.h
@@ -31,18 +31,17 @@
 void flush_cache_all(void);
 void flush_cache_mm(struct mm_struct *mm);
 
-void flush_kernel_dcache_page_addr(const void *addr);
-
 #define flush_kernel_dcache_range(start,size) \
 	flush_kernel_dcache_range_asm((start), (start)+(size));
 
+/* The only way to flush a vmap range is to flush whole cache */
 #define ARCH_IMPLEMENTS_FLUSH_KERNEL_VMAP_RANGE 1
 void flush_kernel_vmap_range(void *vaddr, int size);
 void invalidate_kernel_vmap_range(void *vaddr, int size);
 
-#define flush_cache_vmap(start, end)		flush_cache_all()
+void flush_cache_vmap(unsigned long start, unsigned long end);
 #define flush_cache_vmap_early(start, end)	do { } while (0)
-#define flush_cache_vunmap(start, end)		flush_cache_all()
+void flush_cache_vunmap(unsigned long start, unsigned long end);
 
 void flush_dcache_folio(struct folio *folio);
 #define flush_dcache_folio flush_dcache_folio
@@ -77,17 +76,11 @@
 void flush_cache_range(struct vm_area_struct *vma,
 		unsigned long start, unsigned long end);
 
-/* defined in pacache.S exported in cache.c used by flush_anon_page */
-void flush_dcache_page_asm(unsigned long phys_addr, unsigned long vaddr);
-
 #define ARCH_HAS_FLUSH_ANON_PAGE
 void flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr);
 
 #define ARCH_HAS_FLUSH_ON_KUNMAP
-static inline void kunmap_flush_on_unmap(const void *addr)
-{
-	flush_kernel_dcache_page_addr(addr);
-}
+void kunmap_flush_on_unmap(const void *addr);
 
 #endif /* _PARISC_CACHEFLUSH_H */
 
--- linux-qcom-6.8.0.orig/arch/parisc/include/asm/checksum.h
+++ linux-qcom-6.8.0/arch/parisc/include/asm/checksum.h
@@ -40,7 +40,7 @@
 "	addc		%0, %5, %0\n"
 "	addc		%0, %3, %0\n"
 "1:	ldws,ma		4(%1), %3\n"
-"	addib,<		0, %2, 1b\n"
+"	addib,>		-1, %2, 1b\n"
 "	addc		%0, %3, %0\n"
 "\n"
 "	extru		%0, 31, 16, %4\n"
@@ -126,6 +126,7 @@
 	** Try to keep 4 registers with "live" values ahead of the ALU.
 	*/
 
+"	depdi		0, 31, 32, %0\n"/* clear upper half of incoming checksum */
 "	ldd,ma		8(%1), %4\n"	/* get 1st saddr word */
 "	ldd,ma		8(%2), %5\n"	/* get 1st daddr word */
 "	add		%4, %0, %0\n"
@@ -137,8 +138,8 @@
 "	add,dc		%3, %0, %0\n"  /* fold in proto+len | carry bit */
 "	extrd,u		%0, 31, 32, %4\n"/* copy upper half down */
 "	depdi		0, 31, 32, %0\n"/* clear upper half */
-"	add		%4, %0, %0\n"	/* fold into 32-bits */
-"	addc		0, %0, %0\n"	/* add carry */
+"	add,dc		%4, %0, %0\n"	/* fold into 32-bits, plus carry */
+"	addc		0, %0, %0\n"	/* add final carry */
 
 #else
 
@@ -163,7 +164,8 @@
 "	ldw,ma		4(%2), %7\n"	/* 4th daddr */
 "	addc		%6, %0, %0\n"
 "	addc		%7, %0, %0\n"
-"	addc		%3, %0, %0\n"	/* fold in proto+len, catch carry */
+"	addc		%3, %0, %0\n"	/* fold in proto+len */
+"	addc		0, %0, %0\n"	/* add carry */
 
 #endif
 	: "=r" (sum), "=r" (saddr), "=r" (daddr), "=r" (len),
--- linux-qcom-6.8.0.orig/arch/parisc/include/asm/mman.h
+++ linux-qcom-6.8.0/arch/parisc/include/asm/mman.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __ASM_MMAN_H__
+#define __ASM_MMAN_H__
+
+#include <linux/fs.h>
+#include <uapi/asm/mman.h>
+
+/* PARISC cannot allow mdwe as it needs writable stacks */
+static inline bool arch_memory_deny_write_exec_supported(void)
+{
+	return false;
+}
+#define arch_memory_deny_write_exec_supported arch_memory_deny_write_exec_supported
+
+static inline unsigned long arch_calc_vm_flag_bits(struct file *file, unsigned long flags)
+{
+	/*
+	 * The stack on parisc grows upwards, so if userspace requests memory
+	 * for a stack, mark it with VM_GROWSUP so that the stack expansion in
+	 * the fault handler will work.
+	 */
+	if (flags & MAP_STACK)
+		return VM_GROWSUP;
+
+	return 0;
+}
+#define arch_calc_vm_flag_bits(file, flags) arch_calc_vm_flag_bits(file, flags)
+
+#endif /* __ASM_MMAN_H__ */
--- linux-qcom-6.8.0.orig/arch/parisc/include/asm/page.h
+++ linux-qcom-6.8.0/arch/parisc/include/asm/page.h
@@ -16,6 +16,7 @@
 #define PAGE_SIZE	(_AC(1,UL) << PAGE_SHIFT)
 #define PAGE_MASK	(~(PAGE_SIZE-1))
 
+#define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
 
 #ifndef __ASSEMBLY__
 
--- linux-qcom-6.8.0.orig/arch/parisc/include/asm/pgtable.h
+++ linux-qcom-6.8.0/arch/parisc/include/asm/pgtable.h
@@ -448,14 +448,17 @@
 	return pte;
 }
 
+static inline pte_t ptep_get(pte_t *ptep)
+{
+	return READ_ONCE(*ptep);
+}
+#define ptep_get ptep_get
+
 static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep)
 {
 	pte_t pte;
 
-	if (!pte_young(*ptep))
-		return 0;
-
-	pte = *ptep;
+	pte = ptep_get(ptep);
 	if (!pte_young(pte)) {
 		return 0;
 	}
@@ -463,17 +466,10 @@
 	return 1;
 }
 
-struct mm_struct;
-static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
-{
-	pte_t old_pte;
-
-	old_pte = *ptep;
-	set_pte(ptep, __pte(0));
-
-	return old_pte;
-}
+int ptep_clear_flush_young(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep);
+pte_t ptep_clear_flush(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep);
 
+struct mm_struct;
 static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
 	set_pte(ptep, pte_wrprotect(*ptep));
@@ -511,7 +507,8 @@
 #define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
 
 #define __HAVE_ARCH_PTEP_TEST_AND_CLEAR_YOUNG
-#define __HAVE_ARCH_PTEP_GET_AND_CLEAR
+#define __HAVE_ARCH_PTEP_CLEAR_YOUNG_FLUSH
+#define __HAVE_ARCH_PTEP_CLEAR_FLUSH
 #define __HAVE_ARCH_PTEP_SET_WRPROTECT
 #define __HAVE_ARCH_PTE_SAME
 
--- linux-qcom-6.8.0.orig/arch/parisc/include/asm/signal.h
+++ linux-qcom-6.8.0/arch/parisc/include/asm/signal.h
@@ -4,23 +4,11 @@
 
 #include <uapi/asm/signal.h>
 
-#define _NSIG		64
-/* bits-per-word, where word apparently means 'long' not 'int' */
-#define _NSIG_BPW	BITS_PER_LONG
-#define _NSIG_WORDS	(_NSIG / _NSIG_BPW)
-
 # ifndef __ASSEMBLY__
 
 /* Most things should be clean enough to redefine this at will, if care
    is taken to make libc match.  */
 
-typedef unsigned long old_sigset_t;		/* at least 32 bits */
-
-typedef struct {
-	/* next_signal() assumes this is a long - no choice */
-	unsigned long sig[_NSIG_WORDS];
-} sigset_t;
-
 #include <asm/sigcontext.h>
 
 #endif /* !__ASSEMBLY */
--- linux-qcom-6.8.0.orig/arch/parisc/include/uapi/asm/signal.h
+++ linux-qcom-6.8.0/arch/parisc/include/uapi/asm/signal.h
@@ -57,10 +57,20 @@
 
 #include <asm-generic/signal-defs.h>
 
+#define _NSIG		64
+#define _NSIG_BPW	(sizeof(unsigned long) * 8)
+#define _NSIG_WORDS	(_NSIG / _NSIG_BPW)
+
 # ifndef __ASSEMBLY__
 
 #  include <linux/types.h>
 
+typedef unsigned long old_sigset_t;	/* at least 32 bits */
+
+typedef struct {
+	unsigned long sig[_NSIG_WORDS];
+} sigset_t;
+
 /* Avoid too many header ordering problems.  */
 struct siginfo;
 
--- linux-qcom-6.8.0.orig/arch/parisc/kernel/cache.c
+++ linux-qcom-6.8.0/arch/parisc/kernel/cache.c
@@ -20,6 +20,7 @@
 #include <linux/sched.h>
 #include <linux/sched/mm.h>
 #include <linux/syscalls.h>
+#include <linux/vmalloc.h>
 #include <asm/pdc.h>
 #include <asm/cache.h>
 #include <asm/cacheflush.h>
@@ -31,20 +32,31 @@
 #include <asm/mmu_context.h>
 #include <asm/cachectl.h>
 
+#define PTR_PAGE_ALIGN_DOWN(addr) PTR_ALIGN_DOWN(addr, PAGE_SIZE)
+
+/*
+ * When nonzero, use _PAGE_ACCESSED bit to try to reduce the number
+ * of page flushes done flush_cache_page_if_present. There are some
+ * pros and cons in using this option. It may increase the risk of
+ * random segmentation faults.
+ */
+#define CONFIG_FLUSH_PAGE_ACCESSED	0
+
 int split_tlb __ro_after_init;
 int dcache_stride __ro_after_init;
 int icache_stride __ro_after_init;
 EXPORT_SYMBOL(dcache_stride);
 
+/* Internal implementation in arch/parisc/kernel/pacache.S */
 void flush_dcache_page_asm(unsigned long phys_addr, unsigned long vaddr);
 EXPORT_SYMBOL(flush_dcache_page_asm);
 void purge_dcache_page_asm(unsigned long phys_addr, unsigned long vaddr);
 void flush_icache_page_asm(unsigned long phys_addr, unsigned long vaddr);
-
-/* Internal implementation in arch/parisc/kernel/pacache.S */
 void flush_data_cache_local(void *);  /* flushes local data-cache only */
 void flush_instruction_cache_local(void); /* flushes local code-cache only */
 
+static void flush_kernel_dcache_page_addr(const void *addr);
+
 /* On some machines (i.e., ones with the Merced bus), there can be
  * only a single PxTLB broadcast at a time; this must be guaranteed
  * by software. We need a spinlock around all TLB flushes to ensure
@@ -321,6 +333,18 @@
 {
 	if (!static_branch_likely(&parisc_has_cache))
 		return;
+
+	/*
+	 * The TLB is the engine of coherence on parisc.  The CPU is
+	 * entitled to speculate any page with a TLB mapping, so here
+	 * we kill the mapping then flush the page along a special flush
+	 * only alias mapping. This guarantees that the page is no-longer
+	 * in the cache for any process and nor may it be speculatively
+	 * read in (until the user or kernel specifically accesses it,
+	 * of course).
+	 */
+	flush_tlb_page(vma, vmaddr);
+
 	preempt_disable();
 	flush_dcache_page_asm(physaddr, vmaddr);
 	if (vma->vm_flags & VM_EXEC)
@@ -328,46 +352,44 @@
 	preempt_enable();
 }
 
-static void flush_user_cache_page(struct vm_area_struct *vma, unsigned long vmaddr)
+static void flush_kernel_dcache_page_addr(const void *addr)
 {
-	unsigned long flags, space, pgd, prot;
-#ifdef CONFIG_TLB_PTLOCK
-	unsigned long pgd_lock;
-#endif
+	unsigned long vaddr = (unsigned long)addr;
+	unsigned long flags;
 
-	vmaddr &= PAGE_MASK;
+	/* Purge TLB entry to remove translation on all CPUs */
+	purge_tlb_start(flags);
+	pdtlb(SR_KERNEL, addr);
+	purge_tlb_end(flags);
 
+	/* Use tmpalias flush to prevent data cache move-in */
 	preempt_disable();
+	flush_dcache_page_asm(__pa(vaddr), vaddr);
+	preempt_enable();
+}
 
-	/* Set context for flush */
-	local_irq_save(flags);
-	prot = mfctl(8);
-	space = mfsp(SR_USER);
-	pgd = mfctl(25);
-#ifdef CONFIG_TLB_PTLOCK
-	pgd_lock = mfctl(28);
-#endif
-	switch_mm_irqs_off(NULL, vma->vm_mm, NULL);
-	local_irq_restore(flags);
-
-	flush_user_dcache_range_asm(vmaddr, vmaddr + PAGE_SIZE);
-	if (vma->vm_flags & VM_EXEC)
-		flush_user_icache_range_asm(vmaddr, vmaddr + PAGE_SIZE);
-	flush_tlb_page(vma, vmaddr);
+static void flush_kernel_icache_page_addr(const void *addr)
+{
+	unsigned long vaddr = (unsigned long)addr;
+	unsigned long flags;
 
-	/* Restore previous context */
-	local_irq_save(flags);
-#ifdef CONFIG_TLB_PTLOCK
-	mtctl(pgd_lock, 28);
-#endif
-	mtctl(pgd, 25);
-	mtsp(space, SR_USER);
-	mtctl(prot, 8);
-	local_irq_restore(flags);
+	/* Purge TLB entry to remove translation on all CPUs */
+	purge_tlb_start(flags);
+	pdtlb(SR_KERNEL, addr);
+	purge_tlb_end(flags);
 
+	/* Use tmpalias flush to prevent instruction cache move-in */
+	preempt_disable();
+	flush_icache_page_asm(__pa(vaddr), vaddr);
 	preempt_enable();
 }
 
+void kunmap_flush_on_unmap(const void *addr)
+{
+	flush_kernel_dcache_page_addr(addr);
+}
+EXPORT_SYMBOL(kunmap_flush_on_unmap);
+
 void flush_icache_pages(struct vm_area_struct *vma, struct page *page,
 		unsigned int nr)
 {
@@ -375,13 +397,16 @@
 
 	for (;;) {
 		flush_kernel_dcache_page_addr(kaddr);
-		flush_kernel_icache_page(kaddr);
+		flush_kernel_icache_page_addr(kaddr);
 		if (--nr == 0)
 			break;
 		kaddr += PAGE_SIZE;
 	}
 }
 
+/*
+ * Walk page directory for MM to find PTEP pointer for address ADDR.
+ */
 static inline pte_t *get_ptep(struct mm_struct *mm, unsigned long addr)
 {
 	pte_t *ptep = NULL;
@@ -410,6 +435,41 @@
 		== (_PAGE_PRESENT | _PAGE_ACCESSED);
 }
 
+/*
+ * Return user physical address. Returns 0 if page is not present.
+ */
+static inline unsigned long get_upa(struct mm_struct *mm, unsigned long addr)
+{
+	unsigned long flags, space, pgd, prot, pa;
+#ifdef CONFIG_TLB_PTLOCK
+	unsigned long pgd_lock;
+#endif
+
+	/* Save context */
+	local_irq_save(flags);
+	prot = mfctl(8);
+	space = mfsp(SR_USER);
+	pgd = mfctl(25);
+#ifdef CONFIG_TLB_PTLOCK
+	pgd_lock = mfctl(28);
+#endif
+
+	/* Set context for lpa_user */
+	switch_mm_irqs_off(NULL, mm, NULL);
+	pa = lpa_user(addr);
+
+	/* Restore previous context */
+#ifdef CONFIG_TLB_PTLOCK
+	mtctl(pgd_lock, 28);
+#endif
+	mtctl(pgd, 25);
+	mtsp(space, SR_USER);
+	mtctl(prot, 8);
+	local_irq_restore(flags);
+
+	return pa;
+}
+
 void flush_dcache_folio(struct folio *folio)
 {
 	struct address_space *mapping = folio_flush_mapping(folio);
@@ -458,50 +518,23 @@
 		if (addr + nr * PAGE_SIZE > vma->vm_end)
 			nr = (vma->vm_end - addr) / PAGE_SIZE;
 
-		if (parisc_requires_coherency()) {
-			for (i = 0; i < nr; i++) {
-				pte_t *ptep = get_ptep(vma->vm_mm,
-							addr + i * PAGE_SIZE);
-				if (!ptep)
-					continue;
-				if (pte_needs_flush(*ptep))
-					flush_user_cache_page(vma,
-							addr + i * PAGE_SIZE);
-				/* Optimise accesses to the same table? */
-				pte_unmap(ptep);
-			}
-		} else {
+		if (old_addr == 0 || (old_addr & (SHM_COLOUR - 1))
+					!= (addr & (SHM_COLOUR - 1))) {
+			for (i = 0; i < nr; i++)
+				__flush_cache_page(vma,
+					addr + i * PAGE_SIZE,
+					(pfn + i) * PAGE_SIZE);
 			/*
-			 * The TLB is the engine of coherence on parisc:
-			 * The CPU is entitled to speculate any page
-			 * with a TLB mapping, so here we kill the
-			 * mapping then flush the page along a special
-			 * flush only alias mapping. This guarantees that
-			 * the page is no-longer in the cache for any
-			 * process and nor may it be speculatively read
-			 * in (until the user or kernel specifically
-			 * accesses it, of course)
+			 * Software is allowed to have any number
+			 * of private mappings to a page.
 			 */
-			for (i = 0; i < nr; i++)
-				flush_tlb_page(vma, addr + i * PAGE_SIZE);
-			if (old_addr == 0 || (old_addr & (SHM_COLOUR - 1))
-					!= (addr & (SHM_COLOUR - 1))) {
-				for (i = 0; i < nr; i++)
-					__flush_cache_page(vma,
-						addr + i * PAGE_SIZE,
-						(pfn + i) * PAGE_SIZE);
-				/*
-				 * Software is allowed to have any number
-				 * of private mappings to a page.
-				 */
-				if (!(vma->vm_flags & VM_SHARED))
-					continue;
-				if (old_addr)
-					pr_err("INEQUIVALENT ALIASES 0x%lx and 0x%lx in file %pD\n",
-						old_addr, addr, vma->vm_file);
-				if (nr == folio_nr_pages(folio))
-					old_addr = addr;
-			}
+			if (!(vma->vm_flags & VM_SHARED))
+				continue;
+			if (old_addr)
+				pr_err("INEQUIVALENT ALIASES 0x%lx and 0x%lx in file %pD\n",
+					old_addr, addr, vma->vm_file);
+			if (nr == folio_nr_pages(folio))
+				old_addr = addr;
 		}
 		WARN_ON(++count == 4096);
 	}
@@ -591,35 +624,28 @@
 extern void clear_user_page_asm(void *, unsigned long);
 extern void copy_user_page_asm(void *, void *, unsigned long);
 
-void flush_kernel_dcache_page_addr(const void *addr)
-{
-	unsigned long flags;
-
-	flush_kernel_dcache_page_asm(addr);
-	purge_tlb_start(flags);
-	pdtlb(SR_KERNEL, addr);
-	purge_tlb_end(flags);
-}
-EXPORT_SYMBOL(flush_kernel_dcache_page_addr);
-
 static void flush_cache_page_if_present(struct vm_area_struct *vma,
-	unsigned long vmaddr, unsigned long pfn)
+	unsigned long vmaddr)
 {
+#if CONFIG_FLUSH_PAGE_ACCESSED
 	bool needs_flush = false;
-	pte_t *ptep;
+	pte_t *ptep, pte;
 
-	/*
-	 * The pte check is racy and sometimes the flush will trigger
-	 * a non-access TLB miss. Hopefully, the page has already been
-	 * flushed.
-	 */
 	ptep = get_ptep(vma->vm_mm, vmaddr);
 	if (ptep) {
-		needs_flush = pte_needs_flush(*ptep);
+		pte = ptep_get(ptep);
+		needs_flush = pte_needs_flush(pte);
 		pte_unmap(ptep);
 	}
 	if (needs_flush)
-		flush_cache_page(vma, vmaddr, pfn);
+		__flush_cache_page(vma, vmaddr, PFN_PHYS(pte_pfn(pte)));
+#else
+	struct mm_struct *mm = vma->vm_mm;
+	unsigned long physaddr = get_upa(mm, vmaddr);
+
+	if (physaddr)
+		__flush_cache_page(vma, vmaddr, PAGE_ALIGN_DOWN(physaddr));
+#endif
 }
 
 void copy_user_highpage(struct page *to, struct page *from,
@@ -629,7 +655,7 @@
 
 	kfrom = kmap_local_page(from);
 	kto = kmap_local_page(to);
-	flush_cache_page_if_present(vma, vaddr, page_to_pfn(from));
+	__flush_cache_page(vma, vaddr, PFN_PHYS(page_to_pfn(from)));
 	copy_page_asm(kto, kfrom);
 	kunmap_local(kto);
 	kunmap_local(kfrom);
@@ -638,16 +664,17 @@
 void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
 		unsigned long user_vaddr, void *dst, void *src, int len)
 {
-	flush_cache_page_if_present(vma, user_vaddr, page_to_pfn(page));
+	__flush_cache_page(vma, user_vaddr, PFN_PHYS(page_to_pfn(page)));
 	memcpy(dst, src, len);
-	flush_kernel_dcache_range_asm((unsigned long)dst, (unsigned long)dst + len);
+	flush_kernel_dcache_page_addr(PTR_PAGE_ALIGN_DOWN(dst));
 }
 
 void copy_from_user_page(struct vm_area_struct *vma, struct page *page,
 		unsigned long user_vaddr, void *dst, void *src, int len)
 {
-	flush_cache_page_if_present(vma, user_vaddr, page_to_pfn(page));
+	__flush_cache_page(vma, user_vaddr, PFN_PHYS(page_to_pfn(page)));
 	memcpy(dst, src, len);
+	flush_kernel_dcache_page_addr(PTR_PAGE_ALIGN_DOWN(src));
 }
 
 /* __flush_tlb_range()
@@ -681,32 +708,10 @@
 
 static void flush_cache_pages(struct vm_area_struct *vma, unsigned long start, unsigned long end)
 {
-	unsigned long addr, pfn;
-	pte_t *ptep;
+	unsigned long addr;
 
-	for (addr = start; addr < end; addr += PAGE_SIZE) {
-		bool needs_flush = false;
-		/*
-		 * The vma can contain pages that aren't present. Although
-		 * the pte search is expensive, we need the pte to find the
-		 * page pfn and to check whether the page should be flushed.
-		 */
-		ptep = get_ptep(vma->vm_mm, addr);
-		if (ptep) {
-			needs_flush = pte_needs_flush(*ptep);
-			pfn = pte_pfn(*ptep);
-			pte_unmap(ptep);
-		}
-		if (needs_flush) {
-			if (parisc_requires_coherency()) {
-				flush_user_cache_page(vma, addr);
-			} else {
-				if (WARN_ON(!pfn_valid(pfn)))
-					return;
-				__flush_cache_page(vma, addr, PFN_PHYS(pfn));
-			}
-		}
-	}
+	for (addr = start; addr < end; addr += PAGE_SIZE)
+		flush_cache_page_if_present(vma, addr);
 }
 
 static inline unsigned long mm_total_size(struct mm_struct *mm)
@@ -757,21 +762,19 @@
 		if (WARN_ON(IS_ENABLED(CONFIG_SMP) && arch_irqs_disabled()))
 			return;
 		flush_tlb_range(vma, start, end);
-		flush_cache_all();
+		if (vma->vm_flags & VM_EXEC)
+			flush_cache_all();
+		else
+			flush_data_cache();
 		return;
 	}
 
-	flush_cache_pages(vma, start, end);
+	flush_cache_pages(vma, start & PAGE_MASK, end);
 }
 
 void flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long pfn)
 {
-	if (WARN_ON(!pfn_valid(pfn)))
-		return;
-	if (parisc_requires_coherency())
-		flush_user_cache_page(vma, vmaddr);
-	else
-		__flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
+	__flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
 }
 
 void flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
@@ -779,34 +782,133 @@
 	if (!PageAnon(page))
 		return;
 
-	if (parisc_requires_coherency()) {
-		if (vma->vm_flags & VM_SHARED)
-			flush_data_cache();
-		else
-			flush_user_cache_page(vma, vmaddr);
+	__flush_cache_page(vma, vmaddr, PFN_PHYS(page_to_pfn(page)));
+}
+
+int ptep_clear_flush_young(struct vm_area_struct *vma, unsigned long addr,
+			   pte_t *ptep)
+{
+	pte_t pte = ptep_get(ptep);
+
+	if (!pte_young(pte))
+		return 0;
+	set_pte(ptep, pte_mkold(pte));
+#if CONFIG_FLUSH_PAGE_ACCESSED
+	__flush_cache_page(vma, addr, PFN_PHYS(pte_pfn(pte)));
+#endif
+	return 1;
+}
+
+/*
+ * After a PTE is cleared, we have no way to flush the cache for
+ * the physical page. On PA8800 and PA8900 processors, these lines
+ * can cause random cache corruption. Thus, we must flush the cache
+ * as well as the TLB when clearing a PTE that's valid.
+ */
+pte_t ptep_clear_flush(struct vm_area_struct *vma, unsigned long addr,
+		       pte_t *ptep)
+{
+	struct mm_struct *mm = (vma)->vm_mm;
+	pte_t pte = ptep_get_and_clear(mm, addr, ptep);
+	unsigned long pfn = pte_pfn(pte);
+
+	if (pfn_valid(pfn))
+		__flush_cache_page(vma, addr, PFN_PHYS(pfn));
+	else if (pte_accessible(mm, pte))
+		flush_tlb_page(vma, addr);
+
+	return pte;
+}
+
+/*
+ * The physical address for pages in the ioremap case can be obtained
+ * from the vm_struct struct. I wasn't able to successfully handle the
+ * vmalloc and vmap cases. We have an array of struct page pointers in
+ * the uninitialized vmalloc case but the flush failed using page_to_pfn.
+ */
+void flush_cache_vmap(unsigned long start, unsigned long end)
+{
+	unsigned long addr, physaddr;
+	struct vm_struct *vm;
+
+	/* Prevent cache move-in */
+	flush_tlb_kernel_range(start, end);
+
+	if (end - start >= parisc_cache_flush_threshold) {
+		flush_cache_all();
 		return;
 	}
 
-	flush_tlb_page(vma, vmaddr);
-	preempt_disable();
-	flush_dcache_page_asm(page_to_phys(page), vmaddr);
-	preempt_enable();
+	if (WARN_ON_ONCE(!is_vmalloc_addr((void *)start))) {
+		flush_cache_all();
+		return;
+	}
+
+	vm = find_vm_area((void *)start);
+	if (WARN_ON_ONCE(!vm)) {
+		flush_cache_all();
+		return;
+	}
+
+	/* The physical addresses of IOREMAP regions are contiguous */
+	if (vm->flags & VM_IOREMAP) {
+		physaddr = vm->phys_addr;
+		for (addr = start; addr < end; addr += PAGE_SIZE) {
+			preempt_disable();
+			flush_dcache_page_asm(physaddr, start);
+			flush_icache_page_asm(physaddr, start);
+			preempt_enable();
+			physaddr += PAGE_SIZE;
+		}
+		return;
+	}
+
+	flush_cache_all();
 }
+EXPORT_SYMBOL(flush_cache_vmap);
 
+/*
+ * The vm_struct has been retired and the page table is set up. The
+ * last page in the range is a guard page. Its physical address can't
+ * be determined using lpa, so there is no way to flush the range
+ * using flush_dcache_page_asm.
+ */
+void flush_cache_vunmap(unsigned long start, unsigned long end)
+{
+	/* Prevent cache move-in */
+	flush_tlb_kernel_range(start, end);
+	flush_data_cache();
+}
+EXPORT_SYMBOL(flush_cache_vunmap);
+
+/*
+ * On systems with PA8800/PA8900 processors, there is no way to flush
+ * a vmap range other than using the architected loop to flush the
+ * entire cache. The page directory is not set up, so we can't use
+ * fdc, etc. FDCE/FICE don't work to flush a portion of the cache.
+ * L2 is physically indexed but FDCE/FICE instructions in virtual
+ * mode output their virtual address on the core bus, not their
+ * real address. As a result, the L2 cache index formed from the
+ * virtual address will most likely not be the same as the L2 index
+ * formed from the real address.
+ */
 void flush_kernel_vmap_range(void *vaddr, int size)
 {
 	unsigned long start = (unsigned long)vaddr;
 	unsigned long end = start + size;
 
-	if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) &&
-	    (unsigned long)size >= parisc_cache_flush_threshold) {
-		flush_tlb_kernel_range(start, end);
-		flush_data_cache();
+	flush_tlb_kernel_range(start, end);
+
+	if (!static_branch_likely(&parisc_has_dcache))
+		return;
+
+	/* If interrupts are disabled, we can only do local flush */
+	if (WARN_ON(IS_ENABLED(CONFIG_SMP) && arch_irqs_disabled())) {
+		flush_data_cache_local(NULL);
 		return;
 	}
 
-	flush_kernel_dcache_range_asm(start, end);
-	flush_tlb_kernel_range(start, end);
+	flush_data_cache();
 }
 EXPORT_SYMBOL(flush_kernel_vmap_range);
 
@@ -818,15 +920,18 @@
 	/* Ensure DMA is complete */
 	asm_syncdma();
 
-	if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) &&
-	    (unsigned long)size >= parisc_cache_flush_threshold) {
-		flush_tlb_kernel_range(start, end);
-		flush_data_cache();
+	flush_tlb_kernel_range(start, end);
+
+	if (!static_branch_likely(&parisc_has_dcache))
+		return;
+
+	/* If interrupts are disabled, we can only do local flush */
+	if (WARN_ON(IS_ENABLED(CONFIG_SMP) && arch_irqs_disabled())) {
+		flush_data_cache_local(NULL);
 		return;
 	}
 
-	purge_kernel_dcache_range_asm(start, end);
-	flush_tlb_kernel_range(start, end);
+	flush_data_cache();
 }
 EXPORT_SYMBOL(invalidate_kernel_vmap_range);
 
--- linux-qcom-6.8.0.orig/arch/parisc/kernel/entry.S
+++ linux-qcom-6.8.0/arch/parisc/kernel/entry.S
@@ -1051,8 +1051,7 @@
 	STREG           %r16, PT_ISR(%r29)
 	STREG           %r17, PT_IOR(%r29)
 
-#if 0 && defined(CONFIG_64BIT)
-	/* Revisit when we have 64-bit code above 4Gb */
+#if defined(CONFIG_64BIT)
 	b,n		intr_save2
 
 skip_save_ior:
@@ -1060,8 +1059,7 @@
 	 * need to adjust iasq/iaoq here in the same way we adjusted isr/ior
 	 * above.
 	 */
-	extrd,u,*	%r8,PSW_W_BIT,1,%r1
-	cmpib,COND(=),n	1,%r1,intr_save2
+	bb,COND(>=),n	%r8,PSW_W_BIT,intr_save2
 	LDREG		PT_IASQ0(%r29), %r16
 	LDREG		PT_IAOQ0(%r29), %r17
 	/* adjust iasq/iaoq */
--- linux-qcom-6.8.0.orig/arch/parisc/kernel/ftrace.c
+++ linux-qcom-6.8.0/arch/parisc/kernel/ftrace.c
@@ -87,7 +87,7 @@
 
 int ftrace_disable_ftrace_graph_caller(void)
 {
-	static_key_enable(&ftrace_graph_enable.key);
+	static_key_disable(&ftrace_graph_enable.key);
 	return 0;
 }
 #endif
@@ -206,6 +206,9 @@
 	struct kprobe *p;
 	int bit;
 
+	if (unlikely(kprobe_ftrace_disabled))
+		return;
+
 	bit = ftrace_test_recursion_trylock(ip, parent_ip);
 	if (bit < 0)
 		return;
--- linux-qcom-6.8.0.orig/arch/parisc/kernel/irq.c
+++ linux-qcom-6.8.0/arch/parisc/kernel/irq.c
@@ -498,7 +498,7 @@
 
 	old_regs = set_irq_regs(regs);
 	local_irq_disable();
-	irq_enter();
+	irq_enter_rcu();
 
 	eirr_val = mfctl(23) & cpu_eiem & per_cpu(local_ack_eiem, cpu);
 	if (!eirr_val)
@@ -533,7 +533,7 @@
 #endif /* CONFIG_IRQSTACKS */
 
  out:
-	irq_exit();
+	irq_exit_rcu();
 	set_irq_regs(old_regs);
 	return;
 
--- linux-qcom-6.8.0.orig/arch/parisc/kernel/parisc_ksyms.c
+++ linux-qcom-6.8.0/arch/parisc/kernel/parisc_ksyms.c
@@ -22,6 +22,7 @@
 #include <linux/atomic.h>
 EXPORT_SYMBOL(__xchg8);
 EXPORT_SYMBOL(__xchg32);
+EXPORT_SYMBOL(__cmpxchg_u8);
 EXPORT_SYMBOL(__cmpxchg_u32);
 EXPORT_SYMBOL(__cmpxchg_u64);
 #ifdef CONFIG_SMP
--- linux-qcom-6.8.0.orig/arch/parisc/kernel/sys_parisc32.c
+++ linux-qcom-6.8.0/arch/parisc/kernel/sys_parisc32.c
@@ -23,12 +23,3 @@
     	current->comm, current->pid, r20);
     return -ENOSYS;
 }
-
-asmlinkage long sys32_fanotify_mark(compat_int_t fanotify_fd, compat_uint_t flags,
-	compat_uint_t mask0, compat_uint_t mask1, compat_int_t dfd,
-	const char  __user * pathname)
-{
-	return sys_fanotify_mark(fanotify_fd, flags,
-			((__u64)mask1 << 32) | mask0,
-			 dfd, pathname);
-}
--- linux-qcom-6.8.0.orig/arch/parisc/kernel/syscall.S
+++ linux-qcom-6.8.0/arch/parisc/kernel/syscall.S
@@ -243,10 +243,10 @@
 
 #ifdef CONFIG_64BIT
 	ldil	L%sys_call_table, %r1
-	or,=	%r2,%r2,%r2
-	addil	L%(sys_call_table64-sys_call_table), %r1
+	or,ev	%r2,%r2,%r2
+	ldil	L%sys_call_table64, %r1
 	ldo	R%sys_call_table(%r1), %r19
-	or,=	%r2,%r2,%r2
+	or,ev	%r2,%r2,%r2
 	ldo	R%sys_call_table64(%r1), %r19
 #else
 	load32	sys_call_table, %r19
@@ -379,10 +379,10 @@
 	extrd,u	%r19,63,1,%r2			/* W hidden in bottom bit */
 
 	ldil	L%sys_call_table, %r1
-	or,=	%r2,%r2,%r2
-	addil	L%(sys_call_table64-sys_call_table), %r1
+	or,ev	%r2,%r2,%r2
+	ldil	L%sys_call_table64, %r1
 	ldo	R%sys_call_table(%r1), %r19
-	or,=	%r2,%r2,%r2
+	or,ev	%r2,%r2,%r2
 	ldo	R%sys_call_table64(%r1), %r19
 #else
 	load32	sys_call_table, %r19
@@ -1327,6 +1327,8 @@
 END(sys_call_table)
 
 #ifdef CONFIG_64BIT
+#undef __SYSCALL_WITH_COMPAT
+#define __SYSCALL_WITH_COMPAT(nr, native, compat)	__SYSCALL(nr, native)
 	.align 8
 ENTRY(sys_call_table64)
 #include <asm/syscall_table_64.h>    /* 64-bit syscalls */
--- linux-qcom-6.8.0.orig/arch/parisc/kernel/syscalls/syscall.tbl
+++ linux-qcom-6.8.0/arch/parisc/kernel/syscalls/syscall.tbl
@@ -108,7 +108,7 @@
 95	common	fchown			sys_fchown
 96	common	getpriority		sys_getpriority
 97	common	setpriority		sys_setpriority
-98	common	recv			sys_recv
+98	common	recv			sys_recv			compat_sys_recv
 99	common	statfs			sys_statfs			compat_sys_statfs
 100	common	fstatfs			sys_fstatfs			compat_sys_fstatfs
 101	common	stat64			sys_stat64
@@ -135,7 +135,7 @@
 120	common	clone			sys_clone_wrapper
 121	common	setdomainname		sys_setdomainname
 122	common	sendfile		sys_sendfile			compat_sys_sendfile
-123	common	recvfrom		sys_recvfrom
+123	common	recvfrom		sys_recvfrom			compat_sys_recvfrom
 124	32	adjtimex		sys_adjtimex_time32
 124	64	adjtimex		sys_adjtimex
 125	common	mprotect		sys_mprotect
@@ -364,7 +364,7 @@
 320	common	accept4			sys_accept4
 321	common	prlimit64		sys_prlimit64
 322	common	fanotify_init		sys_fanotify_init
-323	common	fanotify_mark		sys_fanotify_mark		sys32_fanotify_mark
+323	common	fanotify_mark		sys_fanotify_mark		compat_sys_fanotify_mark
 324	32	clock_adjtime		sys_clock_adjtime32
 324	64	clock_adjtime		sys_clock_adjtime
 325	common	name_to_handle_at	sys_name_to_handle_at
--- linux-qcom-6.8.0.orig/arch/parisc/kernel/unaligned.c
+++ linux-qcom-6.8.0/arch/parisc/kernel/unaligned.c
@@ -169,6 +169,7 @@
 static int emulate_ldd(struct pt_regs *regs, int toreg, int flop)
 {
 	unsigned long saddr = regs->ior;
+	unsigned long shift, temp1;
 	__u64 val = 0;
 	ASM_EXCEPTIONTABLE_VAR(ret);
 
@@ -180,25 +181,22 @@
 
 #ifdef CONFIG_64BIT
 	__asm__ __volatile__  (
-"	depd,z	%3,60,3,%%r19\n"		/* r19=(ofs&7)*8 */
-"	mtsp	%4, %%sr1\n"
-"	depd	%%r0,63,3,%3\n"
-"1:	ldd	0(%%sr1,%3),%0\n"
-"2:	ldd	8(%%sr1,%3),%%r20\n"
-"	subi	64,%%r19,%%r19\n"
-"	mtsar	%%r19\n"
-"	shrpd	%0,%%r20,%%sar,%0\n"
+"	depd,z	%2,60,3,%3\n"		/* shift=(ofs&7)*8 */
+"	mtsp	%5, %%sr1\n"
+"	depd	%%r0,63,3,%2\n"
+"1:	ldd	0(%%sr1,%2),%0\n"
+"2:	ldd	8(%%sr1,%2),%4\n"
+"	subi	64,%3,%3\n"
+"	mtsar	%3\n"
+"	shrpd	%0,%4,%%sar,%0\n"
 "3:	\n"
 	ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 3b, "%1")
 	ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 3b, "%1")
-	: "=r" (val), "+r" (ret)
-	: "0" (val), "r" (saddr), "r" (regs->isr)
-	: "r19", "r20" );
+	: "+r" (val), "+r" (ret), "+r" (saddr), "=&r" (shift), "=&r" (temp1)
+	: "r" (regs->isr) );
 #else
-    {
-	unsigned long shift, temp1;
 	__asm__ __volatile__  (
-"	zdep	%2,29,2,%3\n"		/* r19=(ofs&3)*8 */
+"	zdep	%2,29,2,%3\n"		/* shift=(ofs&3)*8 */
 "	mtsp	%5, %%sr1\n"
 "	dep	%%r0,31,2,%2\n"
 "1:	ldw	0(%%sr1,%2),%0\n"
@@ -214,7 +212,6 @@
 	ASM_EXCEPTIONTABLE_ENTRY_EFAULT(3b, 4b, "%1")
 	: "+r" (val), "+r" (ret), "+r" (saddr), "=&r" (shift), "=&r" (temp1)
 	: "r" (regs->isr) );
-    }
 #endif
 
 	DPRINTF("val = 0x%llx\n", val);
--- linux-qcom-6.8.0.orig/arch/parisc/mm/init.c
+++ linux-qcom-6.8.0/arch/parisc/mm/init.c
@@ -458,7 +458,6 @@
 	unsigned long kernel_end  = (unsigned long)&_end;
 
 	/* Remap kernel text and data, but do not touch init section yet. */
-	kernel_set_to_readonly = true;
 	map_pages(init_end, __pa(init_end), kernel_end - init_end,
 		  PAGE_KERNEL, 0);
 
@@ -492,11 +491,18 @@
 #ifdef CONFIG_STRICT_KERNEL_RWX
 void mark_rodata_ro(void)
 {
-	/* rodata memory was already mapped with KERNEL_RO access rights by
-           pagetable_init() and map_pages(). No need to do additional stuff here */
-	unsigned long roai_size = __end_ro_after_init - __start_ro_after_init;
+	unsigned long start = (unsigned long) &__start_rodata;
+	unsigned long end = (unsigned long) &__end_rodata;
+
+	pr_info("Write protecting the kernel read-only data: %luk\n",
+	       (end - start) >> 10);
+
+	kernel_set_to_readonly = true;
+	map_pages(start, __pa(start), end - start, PAGE_KERNEL, 0);
 
-	pr_info("Write protected read-only-after-init data: %luk\n", roai_size >> 10);
+	/* force the kernel to see the new page table entries */
+	flush_cache_all();
+	flush_tlb_all();
 }
 #endif
 
--- linux-qcom-6.8.0.orig/arch/parisc/net/bpf_jit_core.c
+++ linux-qcom-6.8.0/arch/parisc/net/bpf_jit_core.c
@@ -114,7 +114,7 @@
 			jit_data->header =
 				bpf_jit_binary_alloc(prog_size + extable_size,
 						     &jit_data->image,
-						     sizeof(u32),
+						     sizeof(long),
 						     bpf_fill_ill_insns);
 			if (!jit_data->header) {
 				prog = orig_prog;
@@ -167,7 +167,13 @@
 	bpf_flush_icache(jit_data->header, ctx->insns + ctx->ninsns);
 
 	if (!prog->is_func || extra_pass) {
-		bpf_jit_binary_lock_ro(jit_data->header);
+		if (bpf_jit_binary_lock_ro(jit_data->header)) {
+			bpf_jit_binary_free(jit_data->header);
+			prog->bpf_func = NULL;
+			prog->jited = 0;
+			prog->jited_len = 0;
+			goto out_offset;
+		}
 		prologue_len = ctx->epilogue_offset - ctx->body_len;
 		for (i = 0; i < prog->len; i++)
 			ctx->offset[i] += prologue_len;
--- linux-qcom-6.8.0.orig/arch/powerpc/Kconfig
+++ linux-qcom-6.8.0/arch/powerpc/Kconfig
@@ -154,7 +154,7 @@
 	select ARCH_HAS_SYSCALL_WRAPPER		if !SPU_BASE && !COMPAT
 	select ARCH_HAS_TICK_BROADCAST		if GENERIC_CLOCKEVENTS_BROADCAST
 	select ARCH_HAS_UACCESS_FLUSHCACHE
-	select ARCH_HAS_UBSAN_SANITIZE_ALL
+	select ARCH_HAS_UBSAN
 	select ARCH_HAVE_NMI_SAFE_CMPXCHG
 	select ARCH_KEEP_MEMBLOCK
 	select ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE	if PPC_RADIX_MMU
@@ -273,8 +273,8 @@
 	select HAVE_RSEQ
 	select HAVE_SETUP_PER_CPU_AREA		if PPC64
 	select HAVE_SOFTIRQ_ON_OWN_STACK
-	select HAVE_STACKPROTECTOR		if PPC32 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r2)
-	select HAVE_STACKPROTECTOR		if PPC64 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r13)
+	select HAVE_STACKPROTECTOR		if PPC32 && $(cc-option,$(m32-flag) -mstack-protector-guard=tls -mstack-protector-guard-reg=r2 -mstack-protector-guard-offset=0)
+	select HAVE_STACKPROTECTOR		if PPC64 && $(cc-option,$(m64-flag) -mstack-protector-guard=tls -mstack-protector-guard-reg=r13 -mstack-protector-guard-offset=0)
 	select HAVE_STATIC_CALL			if PPC32
 	select HAVE_SYSCALL_TRACEPOINTS
 	select HAVE_VIRT_CPU_ACCOUNTING
--- linux-qcom-6.8.0.orig/arch/powerpc/Makefile
+++ linux-qcom-6.8.0/arch/powerpc/Makefile
@@ -100,13 +100,6 @@
 KBUILD_LDFLAGS	+= -m elf$(BITS)$(LDEMULATION)
 endif
 
-cflags-$(CONFIG_STACKPROTECTOR)	+= -mstack-protector-guard=tls
-ifdef CONFIG_PPC64
-cflags-$(CONFIG_STACKPROTECTOR)	+= -mstack-protector-guard-reg=r13
-else
-cflags-$(CONFIG_STACKPROTECTOR)	+= -mstack-protector-guard-reg=r2
-endif
-
 LDFLAGS_vmlinux-y := -Bstatic
 LDFLAGS_vmlinux-$(CONFIG_RELOCATABLE) := -pie
 LDFLAGS_vmlinux-$(CONFIG_RELOCATABLE) += -z notext
@@ -238,7 +231,7 @@
 all: zImage
 
 # With make 3.82 we cannot mix normal and wildcard targets
-BOOT_TARGETS1 := zImage zImage.initrd uImage
+BOOT_TARGETS1 := zImage zImage.initrd uImage vmlinux.strip
 BOOT_TARGETS2 := zImage% dtbImage% treeImage.% cuImage.% simpleImage.% uImage.%
 
 PHONY += $(BOOT_TARGETS1) $(BOOT_TARGETS2)
@@ -400,9 +393,11 @@
 PHONY += stack_protector_prepare
 stack_protector_prepare: prepare0
 ifdef CONFIG_PPC64
-	$(eval KBUILD_CFLAGS += -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "PACA_CANARY") print $$3;}' include/generated/asm-offsets.h))
+	$(eval KBUILD_CFLAGS += -mstack-protector-guard=tls -mstack-protector-guard-reg=r13 \
+				-mstack-protector-guard-offset=$(shell awk '{if ($$2 == "PACA_CANARY") print $$3;}' include/generated/asm-offsets.h))
 else
-	$(eval KBUILD_CFLAGS += -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "TASK_CANARY") print $$3;}' include/generated/asm-offsets.h))
+	$(eval KBUILD_CFLAGS += -mstack-protector-guard=tls -mstack-protector-guard-reg=r2 \
+				-mstack-protector-guard-offset=$(shell awk '{if ($$2 == "TASK_CANARY") print $$3;}' include/generated/asm-offsets.h))
 endif
 endif
 
--- linux-qcom-6.8.0.orig/arch/powerpc/boot/simple_alloc.c
+++ linux-qcom-6.8.0/arch/powerpc/boot/simple_alloc.c
@@ -112,8 +112,11 @@
 		return ptr;
 
 	new = simple_malloc(size);
-	memcpy(new, ptr, p->size);
-	simple_free(ptr);
+	if (new) {
+		memcpy(new, ptr, p->size);
+		simple_free(ptr);
+	}
+
 	return new;
 }
 
--- linux-qcom-6.8.0.orig/arch/powerpc/configs/85xx-hw.config
+++ linux-qcom-6.8.0/arch/powerpc/configs/85xx-hw.config
@@ -24,6 +24,7 @@
 CONFIG_FSL_CORENET_CF=y
 CONFIG_FSL_DMA=y
 CONFIG_FSL_HV_MANAGER=y
+CONFIG_FSL_IFC=y
 CONFIG_FSL_PQ_MDIO=y
 CONFIG_FSL_RIO=y
 CONFIG_FSL_XGMAC_MDIO=y
@@ -58,6 +59,7 @@
 CONFIG_MARVELL_PHY=y
 CONFIG_MDIO_BUS_MUX_GPIO=y
 CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_MEMORY=y
 CONFIG_MMC_SDHCI_OF_ESDHC=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI=y
--- linux-qcom-6.8.0.orig/arch/powerpc/configs/ppc64_defconfig
+++ linux-qcom-6.8.0/arch/powerpc/configs/ppc64_defconfig
@@ -81,7 +81,6 @@
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_BINFMT_MISC=m
 CONFIG_ZSWAP=y
-CONFIG_Z3FOLD=y
 CONFIG_ZSMALLOC=y
 # CONFIG_SLAB_MERGE_DEFAULT is not set
 CONFIG_SLAB_FREELIST_RANDOM=y
--- linux-qcom-6.8.0.orig/arch/powerpc/configs/ps3_defconfig
+++ linux-qcom-6.8.0/arch/powerpc/configs/ps3_defconfig
@@ -24,7 +24,6 @@
 CONFIG_PS3_LPM=m
 # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
 CONFIG_KEXEC=y
-# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set
 CONFIG_PPC_4K_PAGES=y
 CONFIG_SCHED_SMT=y
 CONFIG_PM=y
--- linux-qcom-6.8.0.orig/arch/powerpc/crypto/Kconfig
+++ linux-qcom-6.8.0/arch/powerpc/crypto/Kconfig
@@ -96,6 +96,7 @@
 
 config CRYPTO_AES_GCM_P10
 	tristate "Stitched AES/GCM acceleration support on P10 or later CPU (PPC)"
+	depends on BROKEN
 	depends on PPC64 && CPU_LITTLE_ENDIAN && VSX
 	select CRYPTO_LIB_AES
 	select CRYPTO_ALGAPI
--- linux-qcom-6.8.0.orig/arch/powerpc/crypto/chacha-p10-glue.c
+++ linux-qcom-6.8.0/arch/powerpc/crypto/chacha-p10-glue.c
@@ -197,6 +197,9 @@
 
 static int __init chacha_p10_init(void)
 {
+	if (!cpu_has_feature(CPU_FTR_ARCH_31))
+		return 0;
+
 	static_branch_enable(&have_p10);
 
 	return crypto_register_skciphers(algs, ARRAY_SIZE(algs));
@@ -204,10 +207,13 @@
 
 static void __exit chacha_p10_exit(void)
 {
+	if (!static_branch_likely(&have_p10))
+		return;
+
 	crypto_unregister_skciphers(algs, ARRAY_SIZE(algs));
 }
 
-module_cpu_feature_match(PPC_MODULE_FEATURE_P10, chacha_p10_init);
+module_init(chacha_p10_init);
 module_exit(chacha_p10_exit);
 
 MODULE_DESCRIPTION("ChaCha and XChaCha stream ciphers (P10 accelerated)");
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/asm-compat.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/asm-compat.h
@@ -39,6 +39,12 @@
 #define STDX_BE	stringify_in_c(stdbrx)
 #endif
 
+#ifdef CONFIG_CC_IS_CLANG
+#define DS_FORM_CONSTRAINT "Z<>"
+#else
+#define DS_FORM_CONSTRAINT "YZ<>"
+#endif
+
 #else /* 32-bit */
 
 /* operations for longs and pointers */
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/atomic.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/atomic.h
@@ -11,6 +11,7 @@
 #include <asm/cmpxchg.h>
 #include <asm/barrier.h>
 #include <asm/asm-const.h>
+#include <asm/asm-compat.h>
 
 /*
  * Since *_return_relaxed and {cmp}xchg_relaxed are implemented with
@@ -197,7 +198,7 @@
 	if (IS_ENABLED(CONFIG_PPC_KERNEL_PREFIXED))
 		__asm__ __volatile__("ld %0,0(%1)" : "=r"(t) : "b"(&v->counter));
 	else
-		__asm__ __volatile__("ld%U1%X1 %0,%1" : "=r"(t) : "m<>"(v->counter));
+		__asm__ __volatile__("ld%U1%X1 %0,%1" : "=r"(t) : DS_FORM_CONSTRAINT (v->counter));
 
 	return t;
 }
@@ -208,7 +209,7 @@
 	if (IS_ENABLED(CONFIG_PPC_KERNEL_PREFIXED))
 		__asm__ __volatile__("std %1,0(%2)" : "=m"(v->counter) : "r"(i), "b"(&v->counter));
 	else
-		__asm__ __volatile__("std%U0%X0 %1,%0" : "=m<>"(v->counter) : "r"(i));
+		__asm__ __volatile__("std%U0%X0 %1,%0" : "=" DS_FORM_CONSTRAINT (v->counter) : "r"(i));
 }
 
 #define ATOMIC64_OP(op, asm_op)						\
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/cputhreads.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/cputhreads.h
@@ -3,6 +3,7 @@
 #define _ASM_POWERPC_CPUTHREADS_H
 
 #ifndef __ASSEMBLY__
+#include <asm/cpu_has_feature.h>
 #include <linux/cpumask.h>
 #include <asm/cpu_has_feature.h>
 
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/dtl.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/dtl.h
@@ -1,8 +1,8 @@
 #ifndef _ASM_POWERPC_DTL_H
 #define _ASM_POWERPC_DTL_H
 
+#include <linux/rwsem.h>
 #include <asm/lppaca.h>
-#include <linux/spinlock_types.h>
 
 /*
  * Layout of entries in the hypervisor's dispatch trace log buffer.
@@ -35,7 +35,7 @@
 #define DTL_LOG_ALL		(DTL_LOG_CEDE | DTL_LOG_PREEMPT | DTL_LOG_FAULT)
 
 extern struct kmem_cache *dtl_cache;
-extern rwlock_t dtl_access_lock;
+extern struct rw_semaphore dtl_access_lock;
 
 extern void register_dtl_buffer(int cpu);
 extern void alloc_dtl_buffers(unsigned long *time_limit);
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/fadump.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/fadump.h
@@ -32,4 +32,11 @@
 				      int depth, void *data);
 extern int fadump_reserve_mem(void);
 #endif
+
+#if defined(CONFIG_FA_DUMP) && defined(CONFIG_CMA)
+void fadump_cma_init(void);
+#else
+static inline void fadump_cma_init(void) { }
+#endif
+
 #endif /* _ASM_POWERPC_FADUMP_H */
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/guest-state-buffer.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/guest-state-buffer.h
@@ -81,6 +81,7 @@
 #define KVMPPC_GSID_HASHKEYR			0x1050
 #define KVMPPC_GSID_HASHPKEYR			0x1051
 #define KVMPPC_GSID_CTRL			0x1052
+#define KVMPPC_GSID_DPDES			0x1053
 
 #define KVMPPC_GSID_CR				0x2000
 #define KVMPPC_GSID_PIDR			0x2001
@@ -110,7 +111,7 @@
 #define KVMPPC_GSE_META_COUNT (KVMPPC_GSE_META_END - KVMPPC_GSE_META_START + 1)
 
 #define KVMPPC_GSE_DW_REGS_START KVMPPC_GSID_GPR(0)
-#define KVMPPC_GSE_DW_REGS_END KVMPPC_GSID_CTRL
+#define KVMPPC_GSE_DW_REGS_END KVMPPC_GSID_DPDES
 #define KVMPPC_GSE_DW_REGS_COUNT \
 	(KVMPPC_GSE_DW_REGS_END - KVMPPC_GSE_DW_REGS_START + 1)
 
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/hvcall.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/hvcall.h
@@ -524,7 +524,7 @@
  * Used for all but the craziest of phyp interfaces (see plpar_hcall9)
  */
 #define PLPAR_HCALL_BUFSIZE 4
-long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...);
+long plpar_hcall(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...);
 
 /**
  * plpar_hcall_raw: - Make a hypervisor call without calculating hcall stats
@@ -538,7 +538,7 @@
  * plpar_hcall, but plpar_hcall_raw works in real mode and does not
  * calculate hypervisor call statistics.
  */
-long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...);
+long plpar_hcall_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...);
 
 /**
  * plpar_hcall9: - Make a pseries hypervisor call with up to 9 return arguments
@@ -549,8 +549,8 @@
  * PLPAR_HCALL9_BUFSIZE to size the return argument buffer.
  */
 #define PLPAR_HCALL9_BUFSIZE 9
-long plpar_hcall9(unsigned long opcode, unsigned long *retbuf, ...);
-long plpar_hcall9_raw(unsigned long opcode, unsigned long *retbuf, ...);
+long plpar_hcall9(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...);
+long plpar_hcall9_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...);
 
 /* pseries hcall tracing */
 extern struct static_key hcall_tracepoint_key;
@@ -570,7 +570,7 @@
 	unsigned long backing_mem;
 };
 
-int h_get_mpp(struct hvcall_mpp_data *);
+long h_get_mpp(struct hvcall_mpp_data *mpp_data);
 
 struct hvcall_mpp_x_data {
 	unsigned long coalesced_bytes;
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/interrupt.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/interrupt.h
@@ -336,6 +336,14 @@
 	if (IS_ENABLED(CONFIG_KASAN))
 		return;
 
+	/*
+	 * Likewise, do not use it in real mode if percpu first chunk is not
+	 * embedded. With CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK enabled there
+	 * are chances where percpu allocation can come from vmalloc area.
+	 */
+	if (percpu_first_chunk_is_paged)
+		return;
+
 	/* Otherwise, it should be safe to call it */
 	nmi_enter();
 }
@@ -351,6 +359,8 @@
 		// no nmi_exit for a pseries hash guest taking a real mode exception
 	} else if (IS_ENABLED(CONFIG_KASAN)) {
 		// no nmi_exit for KASAN in real mode
+	} else if (percpu_first_chunk_is_paged) {
+		// no nmi_exit if percpu first chunk is not embedded
 	} else {
 		nmi_exit();
 	}
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/io.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/io.h
@@ -37,7 +37,7 @@
  * define properly based on the platform
  */
 #ifndef CONFIG_PCI
-#define _IO_BASE	0
+#define _IO_BASE	POISON_POINTER_DELTA
 #define _ISA_MEM_BASE	0
 #define PCI_DRAM_OFFSET 0
 #elif defined(CONFIG_PPC32)
@@ -585,12 +585,12 @@
 #define __do_inw(port)		_rec_inw(port)
 #define __do_inl(port)		_rec_inl(port)
 #else /* CONFIG_PPC32 */
-#define __do_outb(val, port)	writeb(val,(PCI_IO_ADDR)_IO_BASE+port);
-#define __do_outw(val, port)	writew(val,(PCI_IO_ADDR)_IO_BASE+port);
-#define __do_outl(val, port)	writel(val,(PCI_IO_ADDR)_IO_BASE+port);
-#define __do_inb(port)		readb((PCI_IO_ADDR)_IO_BASE + port);
-#define __do_inw(port)		readw((PCI_IO_ADDR)_IO_BASE + port);
-#define __do_inl(port)		readl((PCI_IO_ADDR)_IO_BASE + port);
+#define __do_outb(val, port)	writeb(val,(PCI_IO_ADDR)(_IO_BASE+port));
+#define __do_outw(val, port)	writew(val,(PCI_IO_ADDR)(_IO_BASE+port));
+#define __do_outl(val, port)	writel(val,(PCI_IO_ADDR)(_IO_BASE+port));
+#define __do_inb(port)		readb((PCI_IO_ADDR)(_IO_BASE + port));
+#define __do_inw(port)		readw((PCI_IO_ADDR)(_IO_BASE + port));
+#define __do_inl(port)		readl((PCI_IO_ADDR)(_IO_BASE + port));
 #endif /* !CONFIG_PPC32 */
 
 #ifdef CONFIG_EEH
@@ -606,12 +606,12 @@
 #define __do_writesw(a, b, n)	_outsw(PCI_FIX_ADDR(a),(b),(n))
 #define __do_writesl(a, b, n)	_outsl(PCI_FIX_ADDR(a),(b),(n))
 
-#define __do_insb(p, b, n)	readsb((PCI_IO_ADDR)_IO_BASE+(p), (b), (n))
-#define __do_insw(p, b, n)	readsw((PCI_IO_ADDR)_IO_BASE+(p), (b), (n))
-#define __do_insl(p, b, n)	readsl((PCI_IO_ADDR)_IO_BASE+(p), (b), (n))
-#define __do_outsb(p, b, n)	writesb((PCI_IO_ADDR)_IO_BASE+(p),(b),(n))
-#define __do_outsw(p, b, n)	writesw((PCI_IO_ADDR)_IO_BASE+(p),(b),(n))
-#define __do_outsl(p, b, n)	writesl((PCI_IO_ADDR)_IO_BASE+(p),(b),(n))
+#define __do_insb(p, b, n)	readsb((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n))
+#define __do_insw(p, b, n)	readsw((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n))
+#define __do_insl(p, b, n)	readsl((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n))
+#define __do_outsb(p, b, n)	writesb((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n))
+#define __do_outsw(p, b, n)	writesw((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n))
+#define __do_outsl(p, b, n)	writesl((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n))
 
 #define __do_memset_io(addr, c, n)	\
 				_memset_io(PCI_FIX_ADDR(addr), c, n)
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/kfence.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/kfence.h
@@ -15,10 +15,19 @@
 #define ARCH_FUNC_PREFIX "."
 #endif
 
+#ifdef CONFIG_KFENCE
+extern bool kfence_disabled;
+
+static inline void disable_kfence(void)
+{
+	kfence_disabled = true;
+}
+
 static inline bool arch_kfence_init_pool(void)
 {
-	return true;
+	return !kfence_disabled;
 }
+#endif
 
 #ifdef CONFIG_PPC64
 static inline bool kfence_protect_page(unsigned long addr, bool protect)
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/kvm_book3s.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/kvm_book3s.h
@@ -594,6 +594,7 @@
 
 
 KVMPPC_BOOK3S_VCORE_ACCESSOR(vtb, 64, KVMPPC_GSID_VTB)
+KVMPPC_BOOK3S_VCORE_ACCESSOR(dpdes, 64, KVMPPC_GSID_DPDES)
 KVMPPC_BOOK3S_VCORE_ACCESSOR_GET(arch_compat, 32, KVMPPC_GSID_LOGICAL_PVR)
 KVMPPC_BOOK3S_VCORE_ACCESSOR_GET(lpcr, 64, KVMPPC_GSID_LPCR)
 KVMPPC_BOOK3S_VCORE_ACCESSOR_SET(tb_offset, 64, KVMPPC_GSID_TB_OFFSET)
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/kvm_host.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/kvm_host.h
@@ -599,6 +599,9 @@
 	ulong dawrx0;
 	ulong dawr1;
 	ulong dawrx1;
+	ulong dexcr;
+	ulong hashkeyr;
+	ulong hashpkeyr;
 	ulong ciabr;
 	ulong cfar;
 	ulong ppr;
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/nohash/mmu-e500.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/nohash/mmu-e500.h
@@ -303,8 +303,7 @@
 extern int book3e_htw_mode;
 
 #define PPC_HTW_NONE	0
-#define PPC_HTW_IBM	1
-#define PPC_HTW_E6500	2
+#define PPC_HTW_E6500	1
 
 /*
  * 64-bit booke platforms don't load the tlb in the tlb miss handler code.
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/percpu.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/percpu.h
@@ -15,6 +15,16 @@
 #endif /* CONFIG_SMP */
 #endif /* __powerpc64__ */
 
+#if defined(CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK) && defined(CONFIG_SMP)
+#include <linux/jump_label.h>
+DECLARE_STATIC_KEY_FALSE(__percpu_first_chunk_is_paged);
+
+#define percpu_first_chunk_is_paged	\
+		(static_key_enabled(&__percpu_first_chunk_is_paged.key))
+#else
+#define percpu_first_chunk_is_paged	false
+#endif /* CONFIG_PPC64 && CONFIG_SMP */
+
 #include <asm-generic/percpu.h>
 
 #include <asm/paca.h>
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/plpks.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/plpks.h
@@ -44,9 +44,8 @@
 #define PLPKS_MAX_DATA_SIZE		4000
 
 // Timeouts for PLPKS operations
-#define PLPKS_MAX_TIMEOUT		5000 // msec
-#define PLPKS_FLUSH_SLEEP		10 // msec
-#define PLPKS_FLUSH_SLEEP_RANGE		400
+#define PLPKS_MAX_TIMEOUT		(5 * USEC_PER_SEC)
+#define PLPKS_FLUSH_SLEEP		10000 // usec
 
 struct plpks_var {
 	char *component;
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/ppc-opcode.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/ppc-opcode.h
@@ -510,6 +510,7 @@
 #define PPC_RAW_STB(r, base, i)		(0x98000000 | ___PPC_RS(r) | ___PPC_RA(base) | IMM_L(i))
 #define PPC_RAW_LBZ(r, base, i)		(0x88000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i))
 #define PPC_RAW_LDX(r, base, b)		(0x7c00002a | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
+#define PPC_RAW_LHA(r, base, i)		(0xa8000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i))
 #define PPC_RAW_LHZ(r, base, i)		(0xa0000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i))
 #define PPC_RAW_LHBRX(r, base, b)	(0x7c00062c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
 #define PPC_RAW_LWBRX(r, base, b)	(0x7c00042c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
@@ -532,6 +533,7 @@
 #define PPC_RAW_MULW(d, a, b)		(0x7c0001d6 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
 #define PPC_RAW_MULHWU(d, a, b)		(0x7c000016 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
 #define PPC_RAW_MULI(d, a, i)		(0x1c000000 | ___PPC_RT(d) | ___PPC_RA(a) | IMM_L(i))
+#define PPC_RAW_DIVW(d, a, b)		(0x7c0003d6 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
 #define PPC_RAW_DIVWU(d, a, b)		(0x7c000396 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
 #define PPC_RAW_DIVDU(d, a, b)		(0x7c000392 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
 #define PPC_RAW_DIVDE(t, a, b)		(0x7c000352 | ___PPC_RT(t) | ___PPC_RA(a) | ___PPC_RB(b))
@@ -550,6 +552,8 @@
 #define PPC_RAW_XOR(d, a, b)		(0x7c000278 | ___PPC_RA(d) | ___PPC_RS(a) | ___PPC_RB(b))
 #define PPC_RAW_XORI(d, a, i)		(0x68000000 | ___PPC_RA(d) | ___PPC_RS(a) | IMM_L(i))
 #define PPC_RAW_XORIS(d, a, i)		(0x6c000000 | ___PPC_RA(d) | ___PPC_RS(a) | IMM_L(i))
+#define PPC_RAW_EXTSB(d, a)		(0x7c000774 | ___PPC_RA(d) | ___PPC_RS(a))
+#define PPC_RAW_EXTSH(d, a)		(0x7c000734 | ___PPC_RA(d) | ___PPC_RS(a))
 #define PPC_RAW_EXTSW(d, a)		(0x7c0007b4 | ___PPC_RA(d) | ___PPC_RS(a))
 #define PPC_RAW_SLW(d, a, s)		(0x7c000030 | ___PPC_RA(d) | ___PPC_RS(a) | ___PPC_RB(s))
 #define PPC_RAW_SLD(d, a, s)		(0x7c000036 | ___PPC_RA(d) | ___PPC_RS(a) | ___PPC_RB(s))
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/reg_fsl_emb.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/reg_fsl_emb.h
@@ -12,9 +12,16 @@
 #ifndef __ASSEMBLY__
 /* Performance Monitor Registers */
 #define mfpmr(rn)	({unsigned int rval; \
-			asm volatile("mfpmr %0," __stringify(rn) \
+			asm volatile(".machine push; " \
+				     ".machine e300; " \
+				     "mfpmr %0," __stringify(rn) ";" \
+				     ".machine pop; " \
 				     : "=r" (rval)); rval;})
-#define mtpmr(rn, v)	asm volatile("mtpmr " __stringify(rn) ",%0" : : "r" (v))
+#define mtpmr(rn, v)	asm volatile(".machine push; " \
+				     ".machine e300; " \
+				     "mtpmr " __stringify(rn) ",%0; " \
+				     ".machine pop; " \
+				     : : "r" (v))
 #endif /* __ASSEMBLY__ */
 
 /* Freescale Book E Performance Monitor APU Registers */
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/sstep.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/sstep.h
@@ -173,9 +173,4 @@
  */
 extern int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op);
 
-extern void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
-			     const void *mem, bool cross_endian);
-extern void emulate_vsx_store(struct instruction_op *op,
-			      const union vsx_reg *reg, void *mem,
-			      bool cross_endian);
 extern int emulate_dcbz(unsigned long ea, struct pt_regs *regs);
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/topology.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/topology.h
@@ -145,6 +145,7 @@
 
 #ifdef CONFIG_HOTPLUG_SMT
 #include <linux/cpu_smt.h>
+#include <linux/cpumask.h>
 #include <asm/cputhreads.h>
 
 static inline bool topology_is_primary_thread(unsigned int cpu)
@@ -156,6 +157,18 @@
 {
 	return cpu_thread_in_core(cpu) < cpu_smt_num_threads;
 }
+
+#define topology_is_core_online topology_is_core_online
+static inline bool topology_is_core_online(unsigned int cpu)
+{
+	int i, first_cpu = cpu_first_thread_sibling(cpu);
+
+	for (i = first_cpu; i < first_cpu + threads_per_core; ++i) {
+		if (cpu_online(i))
+			return true;
+	}
+	return false;
+}
 #endif
 
 #endif /* __KERNEL__ */
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/uaccess.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/uaccess.h
@@ -6,6 +6,7 @@
 #include <asm/page.h>
 #include <asm/extable.h>
 #include <asm/kup.h>
+#include <asm/asm-compat.h>
 
 #ifdef __powerpc64__
 /* We use TASK_SIZE_USER64 as TASK_SIZE is not constant */
@@ -93,8 +94,18 @@
 #endif
 
 #ifdef __powerpc64__
+#ifdef CONFIG_PPC_KERNEL_PREFIXED
 #define __put_user_asm2_goto(x, ptr, label)			\
 	__put_user_asm_goto(x, ptr, label, "std")
+#else
+#define __put_user_asm2_goto(x, addr, label)			\
+	asm goto ("1: std%U1%X1 %0,%1	# put_user\n"		\
+		EX_TABLE(1b, %l2)				\
+		:						\
+		: "r" (x), DS_FORM_CONSTRAINT (*addr)		\
+		:						\
+		: label)
+#endif // CONFIG_PPC_KERNEL_PREFIXED
 #else /* __powerpc64__ */
 #define __put_user_asm2_goto(x, addr, label)			\
 	asm goto(					\
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/vdso.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/vdso.h
@@ -25,6 +25,7 @@
 #ifdef __VDSO64__
 #define V_FUNCTION_BEGIN(name)		\
 	.globl name;			\
+	.type name,@function; 		\
 	name:				\
 
 #define V_FUNCTION_END(name)		\
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/vdso_datapage.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/vdso_datapage.h
@@ -111,6 +111,21 @@
 	addi	\ptr, \ptr, (_vdso_datapage - 999b)@l
 .endm
 
+#include <asm/asm-offsets.h>
+#include <asm/page.h>
+
+.macro get_realdatapage ptr scratch
+	get_datapage \ptr
+#ifdef CONFIG_TIME_NS
+	lwz	\scratch, VDSO_CLOCKMODE_OFFSET(\ptr)
+	xoris	\scratch, \scratch, VDSO_CLOCKMODE_TIMENS@h
+	xori	\scratch, \scratch, VDSO_CLOCKMODE_TIMENS@l
+	cntlzw	\scratch, \scratch
+	rlwinm	\scratch, \scratch, PAGE_SHIFT - 5, 1 << PAGE_SHIFT
+	add	\ptr, \ptr, \scratch
+#endif
+.endm
+
 #endif /* __ASSEMBLY__ */
 
 #endif /* __KERNEL__ */
--- linux-qcom-6.8.0.orig/arch/powerpc/include/asm/vmalloc.h
+++ linux-qcom-6.8.0/arch/powerpc/include/asm/vmalloc.h
@@ -7,14 +7,14 @@
 #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP
 
 #define arch_vmap_pud_supported arch_vmap_pud_supported
-static inline bool arch_vmap_pud_supported(pgprot_t prot)
+static __always_inline bool arch_vmap_pud_supported(pgprot_t prot)
 {
 	/* HPT does not cope with large pages in the vmalloc area */
 	return radix_enabled();
 }
 
 #define arch_vmap_pmd_supported arch_vmap_pmd_supported
-static inline bool arch_vmap_pmd_supported(pgprot_t prot)
+static __always_inline bool arch_vmap_pmd_supported(pgprot_t prot)
 {
 	return radix_enabled();
 }
--- linux-qcom-6.8.0.orig/arch/powerpc/include/uapi/asm/kvm.h
+++ linux-qcom-6.8.0/arch/powerpc/include/uapi/asm/kvm.h
@@ -646,6 +646,9 @@
 #define KVM_REG_PPC_SIER3	(KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xc3)
 #define KVM_REG_PPC_DAWR1	(KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xc4)
 #define KVM_REG_PPC_DAWRX1	(KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xc5)
+#define KVM_REG_PPC_DEXCR	(KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xc6)
+#define KVM_REG_PPC_HASHKEYR	(KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xc7)
+#define KVM_REG_PPC_HASHPKEYR	(KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xc8)
 
 /* Transactional Memory checkpointed state:
  * This is all GPRs, all VSX regs and a subset of SPRs
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/asm-offsets.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/asm-offsets.c
@@ -348,6 +348,8 @@
 #else
 	OFFSET(CFG_SYSCALL_MAP32, vdso_arch_data, syscall_map);
 #endif
+	OFFSET(VDSO_CLOCKMODE_OFFSET, vdso_arch_data, data[0].clock_mode);
+	DEFINE(VDSO_CLOCKMODE_TIMENS, VDSO_CLOCKMODE_TIMENS);
 
 #ifdef CONFIG_BUG
 	DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry));
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -857,7 +857,7 @@
 	using_dt_cpu_ftrs = false;
 
 	/* Setup and verify the FDT, if it fails we just bail */
-	if (!early_init_dt_verify(fdt))
+	if (!early_init_dt_verify(fdt, __pa(fdt)))
 		return false;
 
 	if (!of_scan_flat_dt(fdt_find_cpu_features, NULL))
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/eeh_pe.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/eeh_pe.c
@@ -849,6 +849,7 @@
 {
 	struct eeh_dev *edev;
 	struct pci_dev *pdev;
+	struct pci_bus *bus = NULL;
 
 	if (pe->type & EEH_PE_PHB)
 		return pe->phb->bus;
@@ -859,9 +860,11 @@
 
 	/* Retrieve the parent PCI bus of first (top) PCI device */
 	edev = list_first_entry_or_null(&pe->edevs, struct eeh_dev, entry);
+	pci_lock_rescan_remove();
 	pdev = eeh_dev_to_pci_dev(edev);
 	if (pdev)
-		return pdev->bus;
+		bus = pdev->bus;
+	pci_unlock_rescan_remove();
 
-	return NULL;
+	return bus;
 }
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/fadump.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/fadump.c
@@ -80,27 +80,23 @@
  * But for some reason even if it fails we still have the memory reservation
  * with us and we can still continue doing fadump.
  */
-static int __init fadump_cma_init(void)
+void __init fadump_cma_init(void)
 {
 	unsigned long long base, size;
 	int rc;
 
-	if (!fw_dump.fadump_enabled)
-		return 0;
-
+	if (!fw_dump.fadump_supported || !fw_dump.fadump_enabled ||
+			fw_dump.dump_active)
+		return;
 	/*
 	 * Do not use CMA if user has provided fadump=nocma kernel parameter.
-	 * Return 1 to continue with fadump old behaviour.
 	 */
-	if (fw_dump.nocma)
-		return 1;
+	if (fw_dump.nocma || !fw_dump.boot_memory_size)
+		return;
 
 	base = fw_dump.reserve_dump_area_start;
 	size = fw_dump.boot_memory_size;
 
-	if (!size)
-		return 0;
-
 	rc = cma_init_reserved_mem(base, size, 0, "fadump_cma", &fadump_cma);
 	if (rc) {
 		pr_err("Failed to init cma area for firmware-assisted dump,%d\n", rc);
@@ -110,7 +106,7 @@
 		 * blocked from production system usage.  Hence return 1,
 		 * so that we can continue with fadump.
 		 */
-		return 1;
+		return;
 	}
 
 	/*
@@ -127,10 +123,7 @@
 		cma_get_size(fadump_cma),
 		(unsigned long)cma_get_base(fadump_cma) >> 20,
 		fw_dump.reserve_dump_area_size);
-	return 1;
 }
-#else
-static int __init fadump_cma_init(void) { return 1; }
 #endif /* CONFIG_CMA */
 
 /* Scan the Firmware Assisted dump configuration details. */
@@ -647,8 +640,6 @@
 
 		pr_info("Reserved %lldMB of memory at %#016llx (System RAM: %lldMB)\n",
 			(size >> 20), base, (memblock_phys_mem_size() >> 20));
-
-		ret = fadump_cma_init();
 	}
 
 	return ret;
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/head_64.S
+++ linux-qcom-6.8.0/arch/powerpc/kernel/head_64.S
@@ -647,8 +647,9 @@
  * Note: This process overwrites the OF exception vectors.
  */
 	LOAD_REG_IMMEDIATE(r3, PAGE_OFFSET)
-	mr.	r4,r26			/* In some cases the loader may  */
-	beq	9f			/* have already put us at zero */
+	mr	r4,r26			/* Load the virtual source address into r4 */
+	cmpld	r3,r4			/* Check if source == dest */
+	beq	9f			/* If so skip the copy  */
 	li	r6,0x100		/* Start offset, the first 0x100 */
 					/* bytes were copied earlier.	 */
 
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/head_8xx.S
+++ linux-qcom-6.8.0/arch/powerpc/kernel/head_8xx.S
@@ -41,12 +41,12 @@
 #include "head_32.h"
 
 .macro compare_to_kernel_boundary scratch, addr
-#if CONFIG_TASK_SIZE <= 0x80000000 && CONFIG_PAGE_OFFSET >= 0x80000000
+#if CONFIG_TASK_SIZE <= 0x80000000 && MODULES_VADDR >= 0x80000000
 /* By simply checking Address >= 0x80000000, we know if its a kernel address */
 	not.	\scratch, \addr
 #else
 	rlwinm	\scratch, \addr, 16, 0xfff8
-	cmpli	cr0, \scratch, PAGE_OFFSET@h
+	cmpli	cr0, \scratch, TASK_SIZE@h
 #endif
 .endm
 
@@ -404,7 +404,7 @@
 	mfspr	r10, SPRN_SRR0
 	mtspr	SPRN_MD_EPN, r10
 	rlwinm	r11, r10, 16, 0xfff8
-	cmpli	cr1, r11, PAGE_OFFSET@h
+	cmpli	cr1, r11, TASK_SIZE@h
 	mfspr	r11, SPRN_M_TWB	/* Get level 1 table */
 	blt+	cr1, 3f
 
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/kprobes-ftrace.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/kprobes-ftrace.c
@@ -21,6 +21,9 @@
 	struct pt_regs *regs;
 	int bit;
 
+	if (unlikely(kprobe_ftrace_disabled))
+		return;
+
 	bit = ftrace_test_recursion_trylock(nip, parent_nip);
 	if (bit < 0)
 		return;
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/module_64.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/module_64.c
@@ -347,12 +347,13 @@
 static void dedotify_versions(struct modversion_info *vers,
 			      unsigned long size)
 {
-	struct modversion_info *end;
+	struct modversion_info *end = (void *)vers + size;
 
-	for (end = (void *)vers + size; vers < end; vers++)
+	for (; vers < end && vers->next; vers = (void *)vers + vers->next) {
 		if (vers->name[0] == '.') {
 			memmove(vers->name, vers->name+1, strlen(vers->name));
 		}
+	}
 }
 
 /*
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/pci-common.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/pci-common.c
@@ -360,6 +360,7 @@
 	}
 	return NULL;
 }
+EXPORT_SYMBOL(pci_find_hose_for_OF_device);
 
 struct pci_controller *pci_find_controller_for_domain(int domain_nr)
 {
@@ -1630,6 +1631,7 @@
 {
 	return pci_bus_find_capability(fake_pci_bus(hose, bus), devfn, cap);
 }
+EXPORT_SYMBOL_GPL(early_find_capability);
 
 struct device_node *pcibios_get_phb_of_node(struct pci_bus *bus)
 {
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/prom.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/prom.c
@@ -327,6 +327,7 @@
 					  void *data)
 {
 	const char *type = of_get_flat_dt_prop(node, "device_type", NULL);
+	const __be32 *cpu_version = NULL;
 	const __be32 *prop;
 	const __be32 *intserv;
 	int i, nthreads;
@@ -375,6 +376,18 @@
 	if (IS_ENABLED(CONFIG_PPC64))
 		boot_cpu_hwid = be32_to_cpu(intserv[found_thread]);
 
+	if (nr_cpu_ids % nthreads != 0) {
+		set_nr_cpu_ids(ALIGN(nr_cpu_ids, nthreads));
+		pr_warn("nr_cpu_ids was not a multiple of threads_per_core, adjusted to %d\n",
+			nr_cpu_ids);
+	}
+
+	if (boot_cpuid >= nr_cpu_ids) {
+		set_nr_cpu_ids(min(CONFIG_NR_CPUS, ALIGN(boot_cpuid + 1, nthreads)));
+		pr_warn("Boot CPU %d >= nr_cpu_ids, adjusted nr_cpu_ids to %d\n",
+			boot_cpuid, nr_cpu_ids);
+	}
+
 	/*
 	 * PAPR defines "logical" PVR values for cpus that
 	 * meet various levels of the architecture:
@@ -398,7 +411,7 @@
 		prop = of_get_flat_dt_prop(node, "cpu-version", NULL);
 		if (prop && (be32_to_cpup(prop) & 0xff000000) == 0x0f000000) {
 			identify_cpu(0, be32_to_cpup(prop));
-			seq_buf_printf(&ppc_hw_desc, "0x%04x ", be32_to_cpup(prop));
+			cpu_version = prop;
 		}
 
 		check_cpu_feature_properties(node);
@@ -409,6 +422,12 @@
 	}
 
 	identical_pvr_fixup(node);
+
+	// We can now add the CPU name & PVR to the hardware description
+	seq_buf_printf(&ppc_hw_desc, "%s 0x%04lx ", cur_cpu_spec->cpu_name, mfspr(SPRN_PVR));
+	if (cpu_version)
+		seq_buf_printf(&ppc_hw_desc, "0x%04x ", be32_to_cpup(cpu_version));
+
 	init_mmu_slb_size(node);
 
 #ifdef CONFIG_PPC64
@@ -762,7 +781,7 @@
 	DBG(" -> early_init_devtree(%px)\n", params);
 
 	/* Too early to BUG_ON(), do it by hand */
-	if (!early_init_dt_verify(params))
+	if (!early_init_dt_verify(params, __pa(params)))
 		panic("BUG: Failed verifying flat device tree, bad version?");
 
 	of_scan_flat_dt(early_init_dt_scan_model, NULL);
@@ -846,9 +865,6 @@
 
 	dt_cpu_ftrs_scan();
 
-	// We can now add the CPU name & PVR to the hardware description
-	seq_buf_printf(&ppc_hw_desc, "%s 0x%04lx ", cur_cpu_spec->cpu_name, mfspr(SPRN_PVR));
-
 	/* Retrieve CPU related informations from the flat tree
 	 * (altivec support, boot CPU ID, ...)
 	 */
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/prom_init.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/prom_init.c
@@ -2924,7 +2924,7 @@
 #endif
 
 #if defined(CONFIG_PPC64) && defined(CONFIG_PPC_PMAC)
-static void __init fixup_device_tree_pmac(void)
+static void __init fixup_device_tree_pmac64(void)
 {
 	phandle u3, i2c, mpic;
 	u32 u3_rev;
@@ -2964,7 +2964,31 @@
 		     &parent, sizeof(parent));
 }
 #else
-#define fixup_device_tree_pmac()
+#define fixup_device_tree_pmac64()
+#endif
+
+#ifdef CONFIG_PPC_PMAC
+static void __init fixup_device_tree_pmac(void)
+{
+	__be32 val = 1;
+	char type[8];
+	phandle node;
+
+	// Some pmacs are missing #size-cells on escc nodes
+	for (node = 0; prom_next_node(&node); ) {
+		type[0] = '\0';
+		prom_getprop(node, "device_type", type, sizeof(type));
+		if (prom_strcmp(type, "escc"))
+			continue;
+
+		if (prom_getproplen(node, "#size-cells") != PROM_ERROR)
+			continue;
+
+		prom_setprop(node, NULL, "#size-cells", &val, sizeof(val));
+	}
+}
+#else
+static inline void fixup_device_tree_pmac(void) { }
 #endif
 
 #ifdef CONFIG_PPC_EFIKA
@@ -3189,6 +3213,7 @@
 	fixup_device_tree_maple_memory_controller();
 	fixup_device_tree_chrp();
 	fixup_device_tree_pmac();
+	fixup_device_tree_pmac64();
 	fixup_device_tree_efika();
 	fixup_device_tree_pasemi();
 }
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/rtas.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/rtas.c
@@ -19,6 +19,7 @@
 #include <linux/lockdep.h>
 #include <linux/memblock.h>
 #include <linux/mutex.h>
+#include <linux/nospec.h>
 #include <linux/of.h>
 #include <linux/of_fdt.h>
 #include <linux/reboot.h>
@@ -1916,6 +1917,9 @@
 	    || nargs + nret > ARRAY_SIZE(args.args))
 		return -EINVAL;
 
+	nargs = array_index_nospec(nargs, ARRAY_SIZE(args.args));
+	nret = array_index_nospec(nret, ARRAY_SIZE(args.args) - nargs);
+
 	/* Copy in args. */
 	if (copy_from_user(args.args, uargs->args,
 			   nargs * sizeof(rtas_arg_t)) != 0)
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/setup-common.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/setup-common.c
@@ -35,6 +35,7 @@
 #include <linux/of_irq.h>
 #include <linux/hugetlb.h>
 #include <linux/pgtable.h>
+#include <linux/security.h>
 #include <asm/io.h>
 #include <asm/paca.h>
 #include <asm/processor.h>
@@ -67,6 +68,7 @@
 #include <asm/cpu_has_feature.h>
 #include <asm/kasan.h>
 #include <asm/mce.h>
+#include <asm/secure_boot.h>
 
 #include "setup.h"
 
@@ -896,6 +898,16 @@
 	 */
 	initialize_cache_info();
 
+	/*
+	 * Lock down the kernel if booted in secure mode. This is required to
+	 * maintain kernel integrity.
+	 */
+	if (IS_ENABLED(CONFIG_LOCK_DOWN_IN_SECURE_BOOT)) {
+		if (is_ppc_secureboot_enabled())
+			security_lock_kernel_down("PowerNV Secure Boot mode",
+						  LOCKDOWN_INTEGRITY_MAX);
+	}
+
 	/* Initialize RTAS if available. */
 	rtas_initialize();
 
@@ -933,6 +945,7 @@
 	mem_topology_setup();
 	/* Set max_mapnr before paging_init() */
 	set_max_mapnr(max_pfn);
+	high_memory = (void *)__va(max_low_pfn * PAGE_SIZE);
 
 	/*
 	 * Release secondary cpus out of their spinloops at 0x60 now that
@@ -970,9 +983,11 @@
 	initmem_init();
 
 	/*
-	 * Reserve large chunks of memory for use by CMA for KVM and hugetlb. These must
-	 * be called after initmem_init(), so that pageblock_order is initialised.
+	 * Reserve large chunks of memory for use by CMA for fadump, KVM and
+	 * hugetlb. These must be called after initmem_init(), so that
+	 * pageblock_order is initialised.
 	 */
+	fadump_cma_init();
 	kvm_cma_reserve();
 	gigantic_hugetlb_cma_reserve();
 
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/setup_64.c
+++ linux-qcom-6.8.0/arch/powerpc/kernel/setup_64.c
@@ -834,6 +834,7 @@
 
 unsigned long __per_cpu_offset[NR_CPUS] __read_mostly;
 EXPORT_SYMBOL(__per_cpu_offset);
+DEFINE_STATIC_KEY_FALSE(__percpu_first_chunk_is_paged);
 
 void __init setup_per_cpu_areas(void)
 {
@@ -876,6 +877,7 @@
 	if (rc < 0)
 		panic("cannot initialize percpu area (err=%d)", rc);
 
+	static_key_enable(&__percpu_first_chunk_is_paged.key);
 	delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
 	for_each_possible_cpu(cpu) {
                 __per_cpu_offset[cpu] = delta + pcpu_unit_offsets[cpu];
@@ -922,6 +924,7 @@
 	hardlockup_detector_disable();
 #else
 	if (firmware_has_feature(FW_FEATURE_LPAR)) {
+		check_kvm_guest();
 		if (is_kvm_guest())
 			hardlockup_detector_disable();
 	}
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/syscalls/syscall.tbl
+++ linux-qcom-6.8.0/arch/powerpc/kernel/syscalls/syscall.tbl
@@ -230,8 +230,10 @@
 178	nospu 	rt_sigsuspend			sys_rt_sigsuspend		compat_sys_rt_sigsuspend
 179	32	pread64				sys_ppc_pread64			compat_sys_ppc_pread64
 179	64	pread64				sys_pread64
+179	spu	pread64				sys_pread64
 180	32	pwrite64			sys_ppc_pwrite64		compat_sys_ppc_pwrite64
 180	64	pwrite64			sys_pwrite64
+180	spu	pwrite64			sys_pwrite64
 181	common	chown				sys_chown
 182	common	getcwd				sys_getcwd
 183	common	capget				sys_capget
@@ -246,6 +248,7 @@
 190	common	ugetrlimit			sys_getrlimit			compat_sys_getrlimit
 191	32	readahead			sys_ppc_readahead		compat_sys_ppc_readahead
 191	64	readahead			sys_readahead
+191	spu	readahead			sys_readahead
 192	32	mmap2				sys_mmap2			compat_sys_mmap2
 193	32	truncate64			sys_ppc_truncate64		compat_sys_ppc_truncate64
 194	32	ftruncate64			sys_ppc_ftruncate64		compat_sys_ppc_ftruncate64
@@ -293,6 +296,7 @@
 232	nospu	set_tid_address			sys_set_tid_address
 233	32	fadvise64			sys_ppc32_fadvise64		compat_sys_ppc32_fadvise64
 233	64	fadvise64			sys_fadvise64
+233	spu	fadvise64			sys_fadvise64
 234	nospu	exit_group			sys_exit_group
 235	nospu	lookup_dcookie			sys_ni_syscall
 236	common	epoll_create			sys_epoll_create
@@ -502,7 +506,7 @@
 412	32	utimensat_time64		sys_utimensat			sys_utimensat
 413	32	pselect6_time64			sys_pselect6			compat_sys_pselect6_time64
 414	32	ppoll_time64			sys_ppoll			compat_sys_ppoll_time64
-416	32	io_pgetevents_time64		sys_io_pgetevents		sys_io_pgetevents
+416	32	io_pgetevents_time64		sys_io_pgetevents		compat_sys_io_pgetevents_time64
 417	32	recvmmsg_time64			sys_recvmmsg			compat_sys_recvmmsg_time64
 418	32	mq_timedsend_time64		sys_mq_timedsend		sys_mq_timedsend
 419	32	mq_timedreceive_time64		sys_mq_timedreceive		sys_mq_timedreceive
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/vdso/Makefile
+++ linux-qcom-6.8.0/arch/powerpc/kernel/vdso/Makefile
@@ -10,28 +10,11 @@
 
 ifneq ($(c-gettimeofday-y),)
   CFLAGS_vgettimeofday-32.o += -include $(c-gettimeofday-y)
-  CFLAGS_vgettimeofday-32.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
-  CFLAGS_vgettimeofday-32.o += $(call cc-option, -fno-stack-protector)
-  CFLAGS_vgettimeofday-32.o += -DDISABLE_BRANCH_PROFILING
-  CFLAGS_vgettimeofday-32.o += -ffreestanding -fasynchronous-unwind-tables
-  CFLAGS_REMOVE_vgettimeofday-32.o = $(CC_FLAGS_FTRACE)
-  CFLAGS_REMOVE_vgettimeofday-32.o += -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc
-  # This flag is supported by clang for 64-bit but not 32-bit so it will cause
-  # an unused command line flag warning for this file.
-  ifdef CONFIG_CC_IS_CLANG
-  CFLAGS_REMOVE_vgettimeofday-32.o += -fno-stack-clash-protection
-  endif
-  CFLAGS_vgettimeofday-64.o += -include $(c-gettimeofday-y)
-  CFLAGS_vgettimeofday-64.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
-  CFLAGS_vgettimeofday-64.o += $(call cc-option, -fno-stack-protector)
-  CFLAGS_vgettimeofday-64.o += -DDISABLE_BRANCH_PROFILING
-  CFLAGS_vgettimeofday-64.o += -ffreestanding -fasynchronous-unwind-tables
-  CFLAGS_REMOVE_vgettimeofday-64.o = $(CC_FLAGS_FTRACE)
 # Go prior to 1.16.x assumes r30 is not clobbered by any VDSO code. That used to be true
 # by accident when the VDSO was hand-written asm code, but may not be now that the VDSO is
 # compiler generated. To avoid breaking Go tell GCC not to use r30. Impact on code
 # generation is minimal, it will just use r29 instead.
-  CFLAGS_vgettimeofday-64.o += $(call cc-option, -ffixed-r30)
+  CFLAGS_vgettimeofday-64.o += -include $(c-gettimeofday-y) $(call cc-option, -ffixed-r30)
 endif
 
 # Build rules
@@ -54,6 +37,11 @@
 KCSAN_SANITIZE := n
 
 ccflags-y := -fno-common -fno-builtin
+ccflags-y += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+ccflags-y += $(call cc-option, -fno-stack-protector)
+ccflags-y += -DDISABLE_BRANCH_PROFILING
+ccflags-y += -ffreestanding -fasynchronous-unwind-tables
+ccflags-remove-y := $(CC_FLAGS_FTRACE)
 ldflags-y := -Wl,--hash-style=both -nostdlib -shared -z noexecstack $(CLANG_FLAGS)
 ldflags-$(CONFIG_LD_IS_LLD) += $(call cc-option,--ld-path=$(LD),-fuse-ld=lld)
 ldflags-$(CONFIG_LD_ORPHAN_WARN) += -Wl,--orphan-handling=$(CONFIG_LD_ORPHAN_WARN_LEVEL)
@@ -62,6 +50,16 @@
 ldflags-y += $(filter-out $(CC_AUTO_VAR_INIT_ZERO_ENABLER) $(CC_FLAGS_FTRACE) -Wa$(comma)%, $(KBUILD_CFLAGS))
 
 CC32FLAGS := -m32
+CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc
+ifdef CONFIG_CC_IS_CLANG
+# This flag is supported by clang for 64-bit but not 32-bit so it will cause
+# an unused command line flag warning for this file.
+CC32FLAGSREMOVE += -fno-stack-clash-protection
+# -mstack-protector-guard values from the 64-bit build are not valid for the
+# 32-bit one. clang validates the values passed to these arguments during
+# parsing, even when -fno-stack-protector is passed afterwards.
+CC32FLAGSREMOVE += -mstack-protector-guard%
+endif
 LD32FLAGS := -Wl,-soname=linux-vdso32.so.1
 AS32FLAGS := -D__VDSO32__
 
@@ -108,7 +106,7 @@
 quiet_cmd_vdso32as = VDSO32A $@
       cmd_vdso32as = $(VDSOCC) $(a_flags) $(CC32FLAGS) $(AS32FLAGS) -c -o $@ $<
 quiet_cmd_vdso32cc = VDSO32C $@
-      cmd_vdso32cc = $(VDSOCC) $(c_flags) $(CC32FLAGS) -c -o $@ $<
+      cmd_vdso32cc = $(VDSOCC) $(filter-out $(CC32FLAGSREMOVE), $(c_flags)) $(CC32FLAGS) -c -o $@ $<
 
 quiet_cmd_vdso64ld_and_check = VDSO64L $@
       cmd_vdso64ld_and_check = $(VDSOCC) $(ldflags-y) $(LD64FLAGS) -o $@ -Wl,-T$(filter %.lds,$^) $(filter %.o,$^); $(cmd_vdso_check)
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/vdso/cacheflush.S
+++ linux-qcom-6.8.0/arch/powerpc/kernel/vdso/cacheflush.S
@@ -30,7 +30,7 @@
 #ifdef CONFIG_PPC64
 	mflr	r12
   .cfi_register lr,r12
-	get_datapage	r10
+	get_realdatapage	r10, r11
 	mtlr	r12
   .cfi_restore	lr
 #endif
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/vdso/datapage.S
+++ linux-qcom-6.8.0/arch/powerpc/kernel/vdso/datapage.S
@@ -28,7 +28,7 @@
 	mflr	r12
   .cfi_register lr,r12
 	mr.	r4,r3
-	get_datapage	r3
+	get_realdatapage	r3, r11
 	mtlr	r12
 #ifdef __powerpc64__
 	addi	r3,r3,CFG_SYSCALL_MAP64
@@ -52,7 +52,7 @@
   .cfi_startproc
 	mflr	r12
   .cfi_register lr,r12
-	get_datapage	r3
+	get_realdatapage	r3, r11
 #ifndef __powerpc64__
 	lwz	r4,(CFG_TB_TICKS_PER_SEC + 4)(r3)
 #endif
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/vdso/gettimeofday.S
+++ linux-qcom-6.8.0/arch/powerpc/kernel/vdso/gettimeofday.S
@@ -38,11 +38,7 @@
 	.else
 	addi		r4, r5, VDSO_DATA_OFFSET
 	.endif
-#ifdef __powerpc64__
 	bl		CFUNC(DOTSYM(\funct))
-#else
-	bl		\funct
-#endif
 	PPC_LL		r0, PPC_MIN_STKFRM + PPC_LR_STKOFF(r1)
 #ifdef __powerpc64__
 	PPC_LL		r2, PPC_MIN_STKFRM + STK_GOT(r1)
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/vdso/vdso32.lds.S
+++ linux-qcom-6.8.0/arch/powerpc/kernel/vdso/vdso32.lds.S
@@ -74,6 +74,8 @@
 	.got		: { *(.got) }			:text
 	.plt		: { *(.plt) }
 
+	.rela.dyn	: { *(.rela .rela*) }
+
 	_end = .;
 	__end = .;
 	PROVIDE(end = .);
@@ -87,7 +89,7 @@
 		*(.branch_lt)
 		*(.data .data.* .gnu.linkonce.d.* .sdata*)
 		*(.bss .sbss .dynbss .dynsbss)
-		*(.got1 .glink .iplt .rela*)
+		*(.got1 .glink .iplt)
 	}
 }
 
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/vdso/vdso64.lds.S
+++ linux-qcom-6.8.0/arch/powerpc/kernel/vdso/vdso64.lds.S
@@ -69,7 +69,7 @@
 	.eh_frame_hdr	: { *(.eh_frame_hdr) }		:text	:eh_frame_hdr
 	.eh_frame	: { KEEP (*(.eh_frame)) }	:text
 	.gcc_except_table : { *(.gcc_except_table) }
-	.rela.dyn ALIGN(8) : { *(.rela.dyn) }
+	.rela.dyn ALIGN(8) : { *(.rela .rela*) }
 
 	.got ALIGN(8)	: { *(.got .toc) }
 
@@ -86,7 +86,7 @@
 		*(.data .data.* .gnu.linkonce.d.* .sdata*)
 		*(.bss .sbss .dynbss .dynsbss)
 		*(.opd)
-		*(.glink .iplt .plt .rela*)
+		*(.glink .iplt .plt)
 	}
 }
 
--- linux-qcom-6.8.0.orig/arch/powerpc/kernel/vmlinux.lds.S
+++ linux-qcom-6.8.0/arch/powerpc/kernel/vmlinux.lds.S
@@ -123,8 +123,6 @@
 		 */
 		*(.sfpr);
 		*(.text.asan.* .text.tsan.*)
-		MEM_KEEP(init.text)
-		MEM_KEEP(exit.text)
 	} :text
 
 	. = ALIGN(PAGE_SIZE);
--- linux-qcom-6.8.0.orig/arch/powerpc/kexec/core_64.c
+++ linux-qcom-6.8.0/arch/powerpc/kexec/core_64.c
@@ -26,6 +26,7 @@
 #include <asm/paca.h>
 #include <asm/mmu.h>
 #include <asm/sections.h>	/* _end */
+#include <asm/setup.h>
 #include <asm/smp.h>
 #include <asm/hw_breakpoint.h>
 #include <asm/svm.h>
@@ -315,6 +316,16 @@
 	if (!kdump_in_progress())
 		kexec_prepare_cpus();
 
+#ifdef CONFIG_PPC_PSERIES
+	/*
+	 * This must be done after other CPUs have shut down, otherwise they
+	 * could execute the 'scv' instruction, which is not supported with
+	 * reloc disabled (see configure_exceptions()).
+	 */
+	if (firmware_has_feature(FW_FEATURE_SET_MODE))
+		pseries_disable_reloc_on_exc();
+#endif
+
 	printk("kexec: Starting switchover sequence.\n");
 
 	/* switch to a staticly allocated stack.  Based on irq stack code.
--- linux-qcom-6.8.0.orig/arch/powerpc/kexec/file_load_64.c
+++ linux-qcom-6.8.0/arch/powerpc/kexec/file_load_64.c
@@ -916,13 +916,18 @@
 	if (dn) {
 		u64 val;
 
-		of_property_read_u64(dn, "opal-base-address", &val);
+		ret = of_property_read_u64(dn, "opal-base-address", &val);
+		if (ret)
+			goto out;
+
 		ret = kexec_purgatory_get_set_symbol(image, "opal_base", &val,
 						     sizeof(val), false);
 		if (ret)
 			goto out;
 
-		of_property_read_u64(dn, "opal-entry-address", &val);
+		ret = of_property_read_u64(dn, "opal-entry-address", &val);
+		if (ret)
+			goto out;
 		ret = kexec_purgatory_get_set_symbol(image, "opal_entry", &val,
 						     sizeof(val), false);
 	}
--- linux-qcom-6.8.0.orig/arch/powerpc/kvm/book3s_64_vio.c
+++ linux-qcom-6.8.0/arch/powerpc/kvm/book3s_64_vio.c
@@ -130,14 +130,16 @@
 	}
 	rcu_read_unlock();
 
-	fdput(f);
-
-	if (!found)
+	if (!found) {
+		fdput(f);
 		return -EINVAL;
+	}
 
 	table_group = iommu_group_get_iommudata(grp);
-	if (WARN_ON(!table_group))
+	if (WARN_ON(!table_group)) {
+		fdput(f);
 		return -EFAULT;
+	}
 
 	for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) {
 		struct iommu_table *tbltmp = table_group->tables[i];
@@ -158,8 +160,10 @@
 			break;
 		}
 	}
-	if (!tbl)
+	if (!tbl) {
+		fdput(f);
 		return -EINVAL;
+	}
 
 	rcu_read_lock();
 	list_for_each_entry_rcu(stit, &stt->iommu_tables, next) {
@@ -170,6 +174,7 @@
 			/* stit is being destroyed */
 			iommu_tce_table_put(tbl);
 			rcu_read_unlock();
+			fdput(f);
 			return -ENOTTY;
 		}
 		/*
@@ -177,6 +182,7 @@
 		 * its KVM reference counter and can return.
 		 */
 		rcu_read_unlock();
+		fdput(f);
 		return 0;
 	}
 	rcu_read_unlock();
@@ -184,6 +190,7 @@
 	stit = kzalloc(sizeof(*stit), GFP_KERNEL);
 	if (!stit) {
 		iommu_tce_table_put(tbl);
+		fdput(f);
 		return -ENOMEM;
 	}
 
@@ -192,6 +199,7 @@
 
 	list_add_rcu(&stit->next, &stt->iommu_tables);
 
+	fdput(f);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/arch/powerpc/kvm/book3s_hv.c
+++ linux-qcom-6.8.0/arch/powerpc/kvm/book3s_hv.c
@@ -2304,7 +2304,7 @@
 		*val = get_reg_val(id, kvmppc_get_siar_hv(vcpu));
 		break;
 	case KVM_REG_PPC_SDAR:
-		*val = get_reg_val(id, kvmppc_get_siar_hv(vcpu));
+		*val = get_reg_val(id, kvmppc_get_sdar_hv(vcpu));
 		break;
 	case KVM_REG_PPC_SIER:
 		*val = get_reg_val(id, kvmppc_get_sier_hv(vcpu, 0));
@@ -2348,6 +2348,15 @@
 	case KVM_REG_PPC_DAWRX1:
 		*val = get_reg_val(id, kvmppc_get_dawrx1_hv(vcpu));
 		break;
+	case KVM_REG_PPC_DEXCR:
+		*val = get_reg_val(id, kvmppc_get_dexcr_hv(vcpu));
+		break;
+	case KVM_REG_PPC_HASHKEYR:
+		*val = get_reg_val(id, kvmppc_get_hashkeyr_hv(vcpu));
+		break;
+	case KVM_REG_PPC_HASHPKEYR:
+		*val = get_reg_val(id, kvmppc_get_hashpkeyr_hv(vcpu));
+		break;
 	case KVM_REG_PPC_CIABR:
 		*val = get_reg_val(id, kvmppc_get_ciabr_hv(vcpu));
 		break;
@@ -2539,7 +2548,7 @@
 		vcpu->arch.mmcrs = set_reg_val(id, *val);
 		break;
 	case KVM_REG_PPC_MMCR3:
-		*val = get_reg_val(id, vcpu->arch.mmcr[3]);
+		kvmppc_set_mmcr_hv(vcpu, 3, set_reg_val(id, *val));
 		break;
 	case KVM_REG_PPC_PMC1 ... KVM_REG_PPC_PMC8:
 		i = id - KVM_REG_PPC_PMC1;
@@ -2591,6 +2600,15 @@
 	case KVM_REG_PPC_DAWRX1:
 		kvmppc_set_dawrx1_hv(vcpu, set_reg_val(id, *val) & ~DAWRX_HYP);
 		break;
+	case KVM_REG_PPC_DEXCR:
+		kvmppc_set_dexcr_hv(vcpu, set_reg_val(id, *val));
+		break;
+	case KVM_REG_PPC_HASHKEYR:
+		kvmppc_set_hashkeyr_hv(vcpu, set_reg_val(id, *val));
+		break;
+	case KVM_REG_PPC_HASHPKEYR:
+		kvmppc_set_hashpkeyr_hv(vcpu, set_reg_val(id, *val));
+		break;
 	case KVM_REG_PPC_CIABR:
 		kvmppc_set_ciabr_hv(vcpu, set_reg_val(id, *val));
 		/* Don't allow setting breakpoints in hypervisor code */
@@ -4115,6 +4133,11 @@
 	int trap;
 	long rc;
 
+	if (vcpu->arch.doorbell_request) {
+		vcpu->arch.doorbell_request = 0;
+		kvmppc_set_dpdes(vcpu, 1);
+	}
+
 	io = &vcpu->arch.nestedv2_io;
 
 	msr = mfmsr();
@@ -4205,6 +4228,15 @@
 	hvregs.hdec_expiry = time_limit;
 
 	/*
+	 * hvregs has the doorbell status, so zero it here which
+	 * enables us to receive doorbells when H_ENTER_NESTED is
+	 * in progress for this vCPU
+	 */
+
+	if (vcpu->arch.doorbell_request)
+		vcpu->arch.doorbell_request = 0;
+
+	/*
 	 * When setting DEC, we must always deal with irq_work_raise
 	 * via NMI vs setting DEC. The problem occurs right as we
 	 * switch into guest mode if a NMI hits and sets pending work
@@ -4793,9 +4825,20 @@
 							   BOOK3S_INTERRUPT_EXTERNAL, 0);
 			else
 				lpcr |= LPCR_MER;
+		} else {
+			/*
+			 * L1's copy of L2's LPCR (vcpu->arch.vcore->lpcr) can get its MER bit
+			 * unexpectedly set - for e.g. during NMI handling when all register
+			 * states are synchronized from L0 to L1. L1 needs to inform L0 about
+			 * MER=1 only when there are pending external interrupts.
+			 * In the above if check, MER bit is set if there are pending
+			 * external interrupts. Hence, explicity mask off MER bit
+			 * here as otherwise it may generate spurious interrupts in L2 KVM
+			 * causing an endless loop, which results in L2 guest getting hung.
+			 */
+			lpcr &= ~LPCR_MER;
 		}
 	} else if (vcpu->arch.pending_exceptions ||
-		   vcpu->arch.doorbell_request ||
 		   xive_interrupt_pending(vcpu)) {
 		vcpu->arch.ret = RESUME_HOST;
 		goto out;
@@ -4856,7 +4899,7 @@
 	 * entering a nested guest in which case the decrementer is now owned
 	 * by L2 and the L1 decrementer is provided in hdec_expires
 	 */
-	if (!kvmhv_is_nestedv2() && kvmppc_core_pending_dec(vcpu) &&
+	if (kvmppc_core_pending_dec(vcpu) &&
 			((tb < kvmppc_dec_expires_host_tb(vcpu)) ||
 			 (trap == BOOK3S_INTERRUPT_SYSCALL &&
 			  kvmppc_get_gpr(vcpu, 3) == H_ENTER_NESTED)))
--- linux-qcom-6.8.0.orig/arch/powerpc/kvm/book3s_hv.h
+++ linux-qcom-6.8.0/arch/powerpc/kvm/book3s_hv.h
@@ -116,6 +116,9 @@
 KVMPPC_BOOK3S_HV_VCPU_ACCESSOR(dawr1, 64, KVMPPC_GSID_DAWR1)
 KVMPPC_BOOK3S_HV_VCPU_ACCESSOR(dawrx0, 64, KVMPPC_GSID_DAWRX0)
 KVMPPC_BOOK3S_HV_VCPU_ACCESSOR(dawrx1, 64, KVMPPC_GSID_DAWRX1)
+KVMPPC_BOOK3S_HV_VCPU_ACCESSOR(dexcr, 64, KVMPPC_GSID_DEXCR)
+KVMPPC_BOOK3S_HV_VCPU_ACCESSOR(hashkeyr, 64, KVMPPC_GSID_HASHKEYR)
+KVMPPC_BOOK3S_HV_VCPU_ACCESSOR(hashpkeyr, 64, KVMPPC_GSID_HASHPKEYR)
 KVMPPC_BOOK3S_HV_VCPU_ACCESSOR(ciabr, 64, KVMPPC_GSID_CIABR)
 KVMPPC_BOOK3S_HV_VCPU_ACCESSOR(wort, 64, KVMPPC_GSID_WORT)
 KVMPPC_BOOK3S_HV_VCPU_ACCESSOR(ppr, 64, KVMPPC_GSID_PPR)
--- linux-qcom-6.8.0.orig/arch/powerpc/kvm/book3s_hv_nested.c
+++ linux-qcom-6.8.0/arch/powerpc/kvm/book3s_hv_nested.c
@@ -32,7 +32,7 @@
 	struct kvmppc_vcore *vc = vcpu->arch.vcore;
 
 	hr->pcr = vc->pcr | PCR_MASK;
-	hr->dpdes = vc->dpdes;
+	hr->dpdes = vcpu->arch.doorbell_request;
 	hr->hfscr = vcpu->arch.hfscr;
 	hr->tb_offset = vc->tb_offset;
 	hr->dawr0 = vcpu->arch.dawr0;
@@ -105,7 +105,7 @@
 {
 	struct kvmppc_vcore *vc = vcpu->arch.vcore;
 
-	hr->dpdes = vc->dpdes;
+	hr->dpdes = vcpu->arch.doorbell_request;
 	hr->purr = vcpu->arch.purr;
 	hr->spurr = vcpu->arch.spurr;
 	hr->ic = vcpu->arch.ic;
@@ -143,7 +143,7 @@
 	struct kvmppc_vcore *vc = vcpu->arch.vcore;
 
 	vc->pcr = hr->pcr | PCR_MASK;
-	vc->dpdes = hr->dpdes;
+	vcpu->arch.doorbell_request = hr->dpdes;
 	vcpu->arch.hfscr = hr->hfscr;
 	vcpu->arch.dawr0 = hr->dawr0;
 	vcpu->arch.dawrx0 = hr->dawrx0;
@@ -170,7 +170,13 @@
 {
 	struct kvmppc_vcore *vc = vcpu->arch.vcore;
 
-	vc->dpdes = hr->dpdes;
+	/*
+	 * This L2 vCPU might have received a doorbell while H_ENTER_NESTED was being handled.
+	 * Make sure we preserve the doorbell if it was either:
+	 *   a) Sent after H_ENTER_NESTED was called on this vCPU (arch.doorbell_request would be 1)
+	 *   b) Doorbell was not handled and L2 exited for some other reason (hr->dpdes would be 1)
+	 */
+	vcpu->arch.doorbell_request = vcpu->arch.doorbell_request | hr->dpdes;
 	vcpu->arch.hfscr = hr->hfscr;
 	vcpu->arch.purr = hr->purr;
 	vcpu->arch.spurr = hr->spurr;
--- linux-qcom-6.8.0.orig/arch/powerpc/kvm/book3s_hv_nestedv2.c
+++ linux-qcom-6.8.0/arch/powerpc/kvm/book3s_hv_nestedv2.c
@@ -71,8 +71,8 @@
 	}
 
 	if (kvmppc_gsm_includes(gsm, KVMPPC_GSID_RUN_OUTPUT)) {
-		kvmppc_gse_put_buff_info(gsb, KVMPPC_GSID_RUN_OUTPUT,
-					 cfg->vcpu_run_output_cfg);
+		rc = kvmppc_gse_put_buff_info(gsb, KVMPPC_GSID_RUN_OUTPUT,
+					      cfg->vcpu_run_output_cfg);
 		if (rc < 0)
 			return rc;
 	}
@@ -193,6 +193,15 @@
 		case KVMPPC_GSID_DAWRX1:
 			rc = kvmppc_gse_put_u32(gsb, iden, vcpu->arch.dawrx1);
 			break;
+		case KVMPPC_GSID_DEXCR:
+			rc = kvmppc_gse_put_u64(gsb, iden, vcpu->arch.dexcr);
+			break;
+		case KVMPPC_GSID_HASHKEYR:
+			rc = kvmppc_gse_put_u64(gsb, iden, vcpu->arch.hashkeyr);
+			break;
+		case KVMPPC_GSID_HASHPKEYR:
+			rc = kvmppc_gse_put_u64(gsb, iden, vcpu->arch.hashpkeyr);
+			break;
 		case KVMPPC_GSID_CIABR:
 			rc = kvmppc_gse_put_u64(gsb, iden, vcpu->arch.ciabr);
 			break;
@@ -311,6 +320,10 @@
 			rc = kvmppc_gse_put_u64(gsb, iden,
 						vcpu->arch.vcore->vtb);
 			break;
+		case KVMPPC_GSID_DPDES:
+			rc = kvmppc_gse_put_u64(gsb, iden,
+						vcpu->arch.vcore->dpdes);
+			break;
 		case KVMPPC_GSID_LPCR:
 			rc = kvmppc_gse_put_u64(gsb, iden,
 						vcpu->arch.vcore->lpcr);
@@ -441,6 +454,15 @@
 		case KVMPPC_GSID_DAWRX1:
 			vcpu->arch.dawrx1 = kvmppc_gse_get_u32(gse);
 			break;
+		case KVMPPC_GSID_DEXCR:
+			vcpu->arch.dexcr = kvmppc_gse_get_u64(gse);
+			break;
+		case KVMPPC_GSID_HASHKEYR:
+			vcpu->arch.hashkeyr = kvmppc_gse_get_u64(gse);
+			break;
+		case KVMPPC_GSID_HASHPKEYR:
+			vcpu->arch.hashpkeyr = kvmppc_gse_get_u64(gse);
+			break;
 		case KVMPPC_GSID_CIABR:
 			vcpu->arch.ciabr = kvmppc_gse_get_u64(gse);
 			break;
@@ -543,6 +565,9 @@
 		case KVMPPC_GSID_VTB:
 			vcpu->arch.vcore->vtb = kvmppc_gse_get_u64(gse);
 			break;
+		case KVMPPC_GSID_DPDES:
+			vcpu->arch.vcore->dpdes = kvmppc_gse_get_u64(gse);
+			break;
 		case KVMPPC_GSID_LPCR:
 			vcpu->arch.vcore->lpcr = kvmppc_gse_get_u64(gse);
 			break;
--- linux-qcom-6.8.0.orig/arch/powerpc/kvm/powerpc.c
+++ linux-qcom-6.8.0/arch/powerpc/kvm/powerpc.c
@@ -1984,8 +1984,10 @@
 			break;
 
 		r = -ENXIO;
-		if (!xive_enabled())
+		if (!xive_enabled()) {
+			fdput(f);
 			break;
+		}
 
 		r = -EPERM;
 		dev = kvm_device_from_filp(f.file);
--- linux-qcom-6.8.0.orig/arch/powerpc/kvm/test-guest-state-buffer.c
+++ linux-qcom-6.8.0/arch/powerpc/kvm/test-guest-state-buffer.c
@@ -151,7 +151,7 @@
 		i++;
 	}
 
-	for (u16 iden = KVMPPC_GSID_GPR(0); iden <= KVMPPC_GSID_CTRL; iden++) {
+	for (u16 iden = KVMPPC_GSID_GPR(0); iden <= KVMPPC_GSE_DW_REGS_END; iden++) {
 		kvmppc_gsbm_set(&gsbm, iden);
 		kvmppc_gsbm_set(&gsbm1, iden);
 		KUNIT_EXPECT_TRUE(test, kvmppc_gsbm_test(&gsbm, iden));
--- linux-qcom-6.8.0.orig/arch/powerpc/lib/Makefile
+++ linux-qcom-6.8.0/arch/powerpc/lib/Makefile
@@ -76,7 +76,7 @@
 obj-$(CONFIG_FTR_FIXUP_SELFTEST) += feature-fixups-test.o
 
 obj-$(CONFIG_ALTIVEC)	+= xor_vmx.o xor_vmx_glue.o
-CFLAGS_xor_vmx.o += -maltivec $(call cc-option,-mabi=altivec)
+CFLAGS_xor_vmx.o += -mhard-float -maltivec $(call cc-option,-mabi=altivec)
 # Enable <altivec.h>
 CFLAGS_xor_vmx.o += -isystem $(shell $(CC) -print-file-name=include)
 
--- linux-qcom-6.8.0.orig/arch/powerpc/lib/qspinlock.c
+++ linux-qcom-6.8.0/arch/powerpc/lib/qspinlock.c
@@ -697,7 +697,15 @@
 	}
 
 release:
-	qnodesp->count--; /* release the node */
+	/*
+	 * Clear the lock before releasing the node, as another CPU might see stale
+	 * values if an interrupt occurs after we increment qnodesp->count
+	 * but before node->lock is initialized. The barrier ensures that
+	 * there are no further stores to the node after it has been released.
+	 */
+	node->lock = NULL;
+	barrier();
+	qnodesp->count--;
 }
 
 void queued_spin_lock_slowpath(struct qspinlock *lock)
--- linux-qcom-6.8.0.orig/arch/powerpc/lib/sstep.c
+++ linux-qcom-6.8.0/arch/powerpc/lib/sstep.c
@@ -8,6 +8,7 @@
 #include <linux/kprobes.h>
 #include <linux/ptrace.h>
 #include <linux/prefetch.h>
+#include <asm/cpu_has_feature.h>
 #include <asm/sstep.h>
 #include <asm/processor.h>
 #include <linux/uaccess.h>
@@ -780,8 +781,8 @@
 #endif /* __powerpc64 */
 
 #ifdef CONFIG_VSX
-void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
-		      const void *mem, bool rev)
+static nokprobe_inline void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
+					     const void *mem, bool rev)
 {
 	int size, read_size;
 	int i, j;
@@ -863,11 +864,9 @@
 		break;
 	}
 }
-EXPORT_SYMBOL_GPL(emulate_vsx_load);
-NOKPROBE_SYMBOL(emulate_vsx_load);
 
-void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
-		       void *mem, bool rev)
+static nokprobe_inline void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
+					      void *mem, bool rev)
 {
 	int size, write_size;
 	int i, j;
@@ -955,8 +954,6 @@
 		break;
 	}
 }
-EXPORT_SYMBOL_GPL(emulate_vsx_store);
-NOKPROBE_SYMBOL(emulate_vsx_store);
 
 static nokprobe_inline int do_vsx_load(struct instruction_op *op,
 				       unsigned long ea, struct pt_regs *regs,
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/book3s64/pgtable.c
+++ linux-qcom-6.8.0/arch/powerpc/mm/book3s64/pgtable.c
@@ -130,7 +130,7 @@
 
 	WARN_ON(pte_hw_valid(pud_pte(*pudp)));
 	assert_spin_locked(pud_lockptr(mm, pudp));
-	WARN_ON(!(pud_large(pud)));
+	WARN_ON(!(pud_leaf(pud)));
 #endif
 	trace_hugepage_set_pud(addr, pud_val(pud));
 	return set_pte_at(mm, addr, pudp_ptep(pudp), pud_pte(pud));
@@ -170,6 +170,7 @@
 {
 	unsigned long old_pmd;
 
+	VM_WARN_ON_ONCE(!pmd_present(*pmdp));
 	old_pmd = pmd_hugepage_update(vma->vm_mm, address, pmdp, _PAGE_PRESENT, _PAGE_INVALID);
 	flush_pmd_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
 	return __pmd(old_pmd);
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/book3s64/radix_pgtable.c
+++ linux-qcom-6.8.0/arch/powerpc/mm/book3s64/radix_pgtable.c
@@ -17,6 +17,7 @@
 #include <linux/hugetlb.h>
 #include <linux/string_helpers.h>
 #include <linux/memory.h>
+#include <linux/kfence.h>
 
 #include <asm/pgalloc.h>
 #include <asm/mmu_context.h>
@@ -31,6 +32,7 @@
 #include <asm/uaccess.h>
 #include <asm/ultravisor.h>
 #include <asm/set_memory.h>
+#include <asm/kfence.h>
 
 #include <trace/events/thp.h>
 
@@ -293,7 +295,8 @@
 
 static int __meminit create_physical_mapping(unsigned long start,
 					     unsigned long end,
-					     int nid, pgprot_t _prot)
+					     int nid, pgprot_t _prot,
+					     unsigned long mapping_sz_limit)
 {
 	unsigned long vaddr, addr, mapping_size = 0;
 	bool prev_exec, exec = false;
@@ -301,7 +304,10 @@
 	int psize;
 	unsigned long max_mapping_size = memory_block_size;
 
-	if (debug_pagealloc_enabled_or_kfence())
+	if (mapping_sz_limit < max_mapping_size)
+		max_mapping_size = mapping_sz_limit;
+
+	if (debug_pagealloc_enabled())
 		max_mapping_size = PAGE_SIZE;
 
 	start = ALIGN(start, PAGE_SIZE);
@@ -356,8 +362,74 @@
 	return 0;
 }
 
+#ifdef CONFIG_KFENCE
+static bool __ro_after_init kfence_early_init = !!CONFIG_KFENCE_SAMPLE_INTERVAL;
+
+static int __init parse_kfence_early_init(char *arg)
+{
+	int val;
+
+	if (get_option(&arg, &val))
+		kfence_early_init = !!val;
+	return 0;
+}
+early_param("kfence.sample_interval", parse_kfence_early_init);
+
+static inline phys_addr_t alloc_kfence_pool(void)
+{
+	phys_addr_t kfence_pool;
+
+	/*
+	 * TODO: Support to enable KFENCE after bootup depends on the ability to
+	 *       split page table mappings. As such support is not currently
+	 *       implemented for radix pagetables, support enabling KFENCE
+	 *       only at system startup for now.
+	 *
+	 *       After support for splitting mappings is available on radix,
+	 *       alloc_kfence_pool() & map_kfence_pool() can be dropped and
+	 *       mapping for __kfence_pool memory can be
+	 *       split during arch_kfence_init_pool().
+	 */
+	if (!kfence_early_init)
+		goto no_kfence;
+
+	kfence_pool = memblock_phys_alloc(KFENCE_POOL_SIZE, PAGE_SIZE);
+	if (!kfence_pool)
+		goto no_kfence;
+
+	memblock_mark_nomap(kfence_pool, KFENCE_POOL_SIZE);
+	return kfence_pool;
+
+no_kfence:
+	disable_kfence();
+	return 0;
+}
+
+static inline void map_kfence_pool(phys_addr_t kfence_pool)
+{
+	if (!kfence_pool)
+		return;
+
+	if (create_physical_mapping(kfence_pool, kfence_pool + KFENCE_POOL_SIZE,
+				    -1, PAGE_KERNEL, PAGE_SIZE))
+		goto err;
+
+	memblock_clear_nomap(kfence_pool, KFENCE_POOL_SIZE);
+	__kfence_pool = __va(kfence_pool);
+	return;
+
+err:
+	memblock_phys_free(kfence_pool, KFENCE_POOL_SIZE);
+	disable_kfence();
+}
+#else
+static inline phys_addr_t alloc_kfence_pool(void) { return 0; }
+static inline void map_kfence_pool(phys_addr_t kfence_pool) { }
+#endif
+
 static void __init radix_init_pgtable(void)
 {
+	phys_addr_t kfence_pool;
 	unsigned long rts_field;
 	phys_addr_t start, end;
 	u64 i;
@@ -365,6 +437,8 @@
 	/* We don't support slb for radix */
 	slb_set_size(0);
 
+	kfence_pool = alloc_kfence_pool();
+
 	/*
 	 * Create the linear mapping
 	 */
@@ -381,9 +455,11 @@
 		}
 
 		WARN_ON(create_physical_mapping(start, end,
-						-1, PAGE_KERNEL));
+						-1, PAGE_KERNEL, ~0UL));
 	}
 
+	map_kfence_pool(kfence_pool);
+
 	if (!cpu_has_feature(CPU_FTR_HVMODE) &&
 			cpu_has_feature(CPU_FTR_P9_RADIX_PREFETCH_BUG)) {
 		/*
@@ -875,7 +951,7 @@
 	}
 
 	return create_physical_mapping(__pa(start), __pa(end),
-				       nid, prot);
+				       nid, prot, ~0UL);
 }
 
 int __meminit radix__remove_section_mapping(unsigned long start, unsigned long end)
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/fault.c
+++ linux-qcom-6.8.0/arch/powerpc/mm/fault.c
@@ -432,10 +432,16 @@
 	/*
 	 * The kernel should never take an execute fault nor should it
 	 * take a page fault to a kernel address or a page fault to a user
-	 * address outside of dedicated places
+	 * address outside of dedicated places.
+	 *
+	 * Rather than kfence directly reporting false negatives, search whether
+	 * the NIP belongs to the fixup table for cases where fault could come
+	 * from functions like copy_from_kernel_nofault().
 	 */
 	if (unlikely(!is_user && bad_kernel_fault(regs, error_code, address, is_write))) {
-		if (kfence_handle_page_fault(address, is_write, regs))
+		if (is_kfence_address((void *)address) &&
+		    !search_exception_tables(instruction_pointer(regs)) &&
+		    kfence_handle_page_fault(address, is_write, regs))
 			return 0;
 
 		return SIGSEGV;
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/init-common.c
+++ linux-qcom-6.8.0/arch/powerpc/mm/init-common.c
@@ -31,6 +31,9 @@
 
 bool disable_kuep = !IS_ENABLED(CONFIG_PPC_KUEP);
 bool disable_kuap = !IS_ENABLED(CONFIG_PPC_KUAP);
+#ifdef CONFIG_KFENCE
+bool __ro_after_init kfence_disabled;
+#endif
 
 static int __init parse_nosmep(char *p)
 {
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/mem.c
+++ linux-qcom-6.8.0/arch/powerpc/mm/mem.c
@@ -288,8 +288,6 @@
 	swiotlb_init(ppc_swiotlb_enable, ppc_swiotlb_flags);
 #endif
 
-	high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
-
 	kasan_late_init();
 
 	memblock_free_all();
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/nohash/8xx.c
+++ linux-qcom-6.8.0/arch/powerpc/mm/nohash/8xx.c
@@ -94,7 +94,8 @@
 		return -EINVAL;
 
 	set_huge_pte_at(&init_mm, va, ptep,
-			pte_mkhuge(pfn_pte(pa >> PAGE_SHIFT, prot)), psize);
+			pte_mkhuge(pfn_pte(pa >> PAGE_SHIFT, prot)),
+			1UL << mmu_psize_to_shift(psize));
 
 	return 0;
 }
@@ -150,11 +151,11 @@
 
 	mmu_mapin_immr();
 
-	mmu_mapin_ram_chunk(0, boundary, PAGE_KERNEL_TEXT, true);
+	mmu_mapin_ram_chunk(0, boundary, PAGE_KERNEL_X, true);
 	if (debug_pagealloc_enabled_or_kfence()) {
 		top = boundary;
 	} else {
-		mmu_mapin_ram_chunk(boundary, einittext8, PAGE_KERNEL_TEXT, true);
+		mmu_mapin_ram_chunk(boundary, einittext8, PAGE_KERNEL_X, true);
 		mmu_mapin_ram_chunk(einittext8, top, PAGE_KERNEL, true);
 	}
 
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/nohash/Makefile
+++ linux-qcom-6.8.0/arch/powerpc/mm/nohash/Makefile
@@ -3,7 +3,7 @@
 ccflags-$(CONFIG_PPC64)	:= $(NO_MINIMAL_TOC)
 
 obj-y				+= mmu_context.o tlb.o tlb_low.o kup.o
-obj-$(CONFIG_PPC_BOOK3E_64)  	+= tlb_low_64e.o book3e_pgtable.o
+obj-$(CONFIG_PPC_BOOK3E_64)  	+= tlb_64e.o tlb_low_64e.o book3e_pgtable.o
 obj-$(CONFIG_40x)		+= 40x.o
 obj-$(CONFIG_44x)		+= 44x.o
 obj-$(CONFIG_PPC_8xx)		+= 8xx.o
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/nohash/tlb.c
+++ linux-qcom-6.8.0/arch/powerpc/mm/nohash/tlb.c
@@ -110,28 +110,6 @@
 };
 #endif
 
-/* The variables below are currently only used on 64-bit Book3E
- * though this will probably be made common with other nohash
- * implementations at some point
- */
-#ifdef CONFIG_PPC64
-
-int mmu_pte_psize;		/* Page size used for PTE pages */
-int mmu_vmemmap_psize;		/* Page size used for the virtual mem map */
-int book3e_htw_mode;		/* HW tablewalk?  Value is PPC_HTW_* */
-unsigned long linear_map_top;	/* Top of linear mapping */
-
-
-/*
- * Number of bytes to add to SPRN_SPRG_TLB_EXFRAME on crit/mcheck/debug
- * exceptions.  This is used for bolted and e6500 TLB miss handlers which
- * do not modify this SPRG in the TLB miss code; for other TLB miss handlers,
- * this is set to zero.
- */
-int extlb_level_exc;
-
-#endif /* CONFIG_PPC64 */
-
 #ifdef CONFIG_PPC_E500
 /* next_tlbcam_idx is used to round-robin tlbcam entry assignment */
 DEFINE_PER_CPU(int, next_tlbcam_idx);
@@ -358,381 +336,7 @@
 	flush_tlb_mm(tlb->mm);
 }
 
-/*
- * Below are functions specific to the 64-bit variant of Book3E though that
- * may change in the future
- */
-
-#ifdef CONFIG_PPC64
-
-/*
- * Handling of virtual linear page tables or indirect TLB entries
- * flushing when PTE pages are freed
- */
-void tlb_flush_pgtable(struct mmu_gather *tlb, unsigned long address)
-{
-	int tsize = mmu_psize_defs[mmu_pte_psize].enc;
-
-	if (book3e_htw_mode != PPC_HTW_NONE) {
-		unsigned long start = address & PMD_MASK;
-		unsigned long end = address + PMD_SIZE;
-		unsigned long size = 1UL << mmu_psize_defs[mmu_pte_psize].shift;
-
-		/* This isn't the most optimal, ideally we would factor out the
-		 * while preempt & CPU mask mucking around, or even the IPI but
-		 * it will do for now
-		 */
-		while (start < end) {
-			__flush_tlb_page(tlb->mm, start, tsize, 1);
-			start += size;
-		}
-	} else {
-		unsigned long rmask = 0xf000000000000000ul;
-		unsigned long rid = (address & rmask) | 0x1000000000000000ul;
-		unsigned long vpte = address & ~rmask;
-
-		vpte = (vpte >> (PAGE_SHIFT - 3)) & ~0xffful;
-		vpte |= rid;
-		__flush_tlb_page(tlb->mm, vpte, tsize, 0);
-	}
-}
-
-static void __init setup_page_sizes(void)
-{
-	unsigned int tlb0cfg;
-	unsigned int tlb0ps;
-	unsigned int eptcfg;
-	int i, psize;
-
-#ifdef CONFIG_PPC_E500
-	unsigned int mmucfg = mfspr(SPRN_MMUCFG);
-	int fsl_mmu = mmu_has_feature(MMU_FTR_TYPE_FSL_E);
-
-	if (fsl_mmu && (mmucfg & MMUCFG_MAVN) == MMUCFG_MAVN_V1) {
-		unsigned int tlb1cfg = mfspr(SPRN_TLB1CFG);
-		unsigned int min_pg, max_pg;
-
-		min_pg = (tlb1cfg & TLBnCFG_MINSIZE) >> TLBnCFG_MINSIZE_SHIFT;
-		max_pg = (tlb1cfg & TLBnCFG_MAXSIZE) >> TLBnCFG_MAXSIZE_SHIFT;
-
-		for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
-			struct mmu_psize_def *def;
-			unsigned int shift;
-
-			def = &mmu_psize_defs[psize];
-			shift = def->shift;
-
-			if (shift == 0 || shift & 1)
-				continue;
-
-			/* adjust to be in terms of 4^shift Kb */
-			shift = (shift - 10) >> 1;
-
-			if ((shift >= min_pg) && (shift <= max_pg))
-				def->flags |= MMU_PAGE_SIZE_DIRECT;
-		}
-
-		goto out;
-	}
-
-	if (fsl_mmu && (mmucfg & MMUCFG_MAVN) == MMUCFG_MAVN_V2) {
-		u32 tlb1cfg, tlb1ps;
-
-		tlb0cfg = mfspr(SPRN_TLB0CFG);
-		tlb1cfg = mfspr(SPRN_TLB1CFG);
-		tlb1ps = mfspr(SPRN_TLB1PS);
-		eptcfg = mfspr(SPRN_EPTCFG);
-
-		if ((tlb1cfg & TLBnCFG_IND) && (tlb0cfg & TLBnCFG_PT))
-			book3e_htw_mode = PPC_HTW_E6500;
-
-		/*
-		 * We expect 4K subpage size and unrestricted indirect size.
-		 * The lack of a restriction on indirect size is a Freescale
-		 * extension, indicated by PSn = 0 but SPSn != 0.
-		 */
-		if (eptcfg != 2)
-			book3e_htw_mode = PPC_HTW_NONE;
-
-		for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
-			struct mmu_psize_def *def = &mmu_psize_defs[psize];
-
-			if (!def->shift)
-				continue;
-
-			if (tlb1ps & (1U << (def->shift - 10))) {
-				def->flags |= MMU_PAGE_SIZE_DIRECT;
-
-				if (book3e_htw_mode && psize == MMU_PAGE_2M)
-					def->flags |= MMU_PAGE_SIZE_INDIRECT;
-			}
-		}
-
-		goto out;
-	}
-#endif
-
-	tlb0cfg = mfspr(SPRN_TLB0CFG);
-	tlb0ps = mfspr(SPRN_TLB0PS);
-	eptcfg = mfspr(SPRN_EPTCFG);
-
-	/* Look for supported direct sizes */
-	for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
-		struct mmu_psize_def *def = &mmu_psize_defs[psize];
-
-		if (tlb0ps & (1U << (def->shift - 10)))
-			def->flags |= MMU_PAGE_SIZE_DIRECT;
-	}
-
-	/* Indirect page sizes supported ? */
-	if ((tlb0cfg & TLBnCFG_IND) == 0 ||
-	    (tlb0cfg & TLBnCFG_PT) == 0)
-		goto out;
-
-	book3e_htw_mode = PPC_HTW_IBM;
-
-	/* Now, we only deal with one IND page size for each
-	 * direct size. Hopefully all implementations today are
-	 * unambiguous, but we might want to be careful in the
-	 * future.
-	 */
-	for (i = 0; i < 3; i++) {
-		unsigned int ps, sps;
-
-		sps = eptcfg & 0x1f;
-		eptcfg >>= 5;
-		ps = eptcfg & 0x1f;
-		eptcfg >>= 5;
-		if (!ps || !sps)
-			continue;
-		for (psize = 0; psize < MMU_PAGE_COUNT; psize++) {
-			struct mmu_psize_def *def = &mmu_psize_defs[psize];
-
-			if (ps == (def->shift - 10))
-				def->flags |= MMU_PAGE_SIZE_INDIRECT;
-			if (sps == (def->shift - 10))
-				def->ind = ps + 10;
-		}
-	}
-
-out:
-	/* Cleanup array and print summary */
-	pr_info("MMU: Supported page sizes\n");
-	for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
-		struct mmu_psize_def *def = &mmu_psize_defs[psize];
-		const char *__page_type_names[] = {
-			"unsupported",
-			"direct",
-			"indirect",
-			"direct & indirect"
-		};
-		if (def->flags == 0) {
-			def->shift = 0;	
-			continue;
-		}
-		pr_info("  %8ld KB as %s\n", 1ul << (def->shift - 10),
-			__page_type_names[def->flags & 0x3]);
-	}
-}
-
-static void __init setup_mmu_htw(void)
-{
-	/*
-	 * If we want to use HW tablewalk, enable it by patching the TLB miss
-	 * handlers to branch to the one dedicated to it.
-	 */
-
-	switch (book3e_htw_mode) {
-	case PPC_HTW_IBM:
-		patch_exception(0x1c0, exc_data_tlb_miss_htw_book3e);
-		patch_exception(0x1e0, exc_instruction_tlb_miss_htw_book3e);
-		break;
-#ifdef CONFIG_PPC_E500
-	case PPC_HTW_E6500:
-		extlb_level_exc = EX_TLB_SIZE;
-		patch_exception(0x1c0, exc_data_tlb_miss_e6500_book3e);
-		patch_exception(0x1e0, exc_instruction_tlb_miss_e6500_book3e);
-		break;
-#endif
-	}
-	pr_info("MMU: Book3E HW tablewalk %s\n",
-		book3e_htw_mode != PPC_HTW_NONE ? "enabled" : "not supported");
-}
-
-/*
- * Early initialization of the MMU TLB code
- */
-static void early_init_this_mmu(void)
-{
-	unsigned int mas4;
-
-	/* Set MAS4 based on page table setting */
-
-	mas4 = 0x4 << MAS4_WIMGED_SHIFT;
-	switch (book3e_htw_mode) {
-	case PPC_HTW_E6500:
-		mas4 |= MAS4_INDD;
-		mas4 |= BOOK3E_PAGESZ_2M << MAS4_TSIZED_SHIFT;
-		mas4 |= MAS4_TLBSELD(1);
-		mmu_pte_psize = MMU_PAGE_2M;
-		break;
-
-	case PPC_HTW_IBM:
-		mas4 |= MAS4_INDD;
-		mas4 |=	BOOK3E_PAGESZ_1M << MAS4_TSIZED_SHIFT;
-		mmu_pte_psize = MMU_PAGE_1M;
-		break;
-
-	case PPC_HTW_NONE:
-		mas4 |=	BOOK3E_PAGESZ_4K << MAS4_TSIZED_SHIFT;
-		mmu_pte_psize = mmu_virtual_psize;
-		break;
-	}
-	mtspr(SPRN_MAS4, mas4);
-
-#ifdef CONFIG_PPC_E500
-	if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
-		unsigned int num_cams;
-		bool map = true;
-
-		/* use a quarter of the TLBCAM for bolted linear map */
-		num_cams = (mfspr(SPRN_TLB1CFG) & TLBnCFG_N_ENTRY) / 4;
-
-		/*
-		 * Only do the mapping once per core, or else the
-		 * transient mapping would cause problems.
-		 */
-#ifdef CONFIG_SMP
-		if (hweight32(get_tensr()) > 1)
-			map = false;
-#endif
-
-		if (map)
-			linear_map_top = map_mem_in_cams(linear_map_top,
-							 num_cams, false, true);
-	}
-#endif
-
-	/* A sync won't hurt us after mucking around with
-	 * the MMU configuration
-	 */
-	mb();
-}
-
-static void __init early_init_mmu_global(void)
-{
-	/* XXX This should be decided at runtime based on supported
-	 * page sizes in the TLB, but for now let's assume 16M is
-	 * always there and a good fit (which it probably is)
-	 *
-	 * Freescale booke only supports 4K pages in TLB0, so use that.
-	 */
-	if (mmu_has_feature(MMU_FTR_TYPE_FSL_E))
-		mmu_vmemmap_psize = MMU_PAGE_4K;
-	else
-		mmu_vmemmap_psize = MMU_PAGE_16M;
-
-	/* XXX This code only checks for TLB 0 capabilities and doesn't
-	 *     check what page size combos are supported by the HW. It
-	 *     also doesn't handle the case where a separate array holds
-	 *     the IND entries from the array loaded by the PT.
-	 */
-	/* Look for supported page sizes */
-	setup_page_sizes();
-
-	/* Look for HW tablewalk support */
-	setup_mmu_htw();
-
-#ifdef CONFIG_PPC_E500
-	if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
-		if (book3e_htw_mode == PPC_HTW_NONE) {
-			extlb_level_exc = EX_TLB_SIZE;
-			patch_exception(0x1c0, exc_data_tlb_miss_bolted_book3e);
-			patch_exception(0x1e0,
-				exc_instruction_tlb_miss_bolted_book3e);
-		}
-	}
-#endif
-
-	/* Set the global containing the top of the linear mapping
-	 * for use by the TLB miss code
-	 */
-	linear_map_top = memblock_end_of_DRAM();
-
-	ioremap_bot = IOREMAP_BASE;
-}
-
-static void __init early_mmu_set_memory_limit(void)
-{
-#ifdef CONFIG_PPC_E500
-	if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
-		/*
-		 * Limit memory so we dont have linear faults.
-		 * Unlike memblock_set_current_limit, which limits
-		 * memory available during early boot, this permanently
-		 * reduces the memory available to Linux.  We need to
-		 * do this because highmem is not supported on 64-bit.
-		 */
-		memblock_enforce_memory_limit(linear_map_top);
-	}
-#endif
-
-	memblock_set_current_limit(linear_map_top);
-}
-
-/* boot cpu only */
-void __init early_init_mmu(void)
-{
-	early_init_mmu_global();
-	early_init_this_mmu();
-	early_mmu_set_memory_limit();
-}
-
-void early_init_mmu_secondary(void)
-{
-	early_init_this_mmu();
-}
-
-void setup_initial_memory_limit(phys_addr_t first_memblock_base,
-				phys_addr_t first_memblock_size)
-{
-	/* On non-FSL Embedded 64-bit, we adjust the RMA size to match
-	 * the bolted TLB entry. We know for now that only 1G
-	 * entries are supported though that may eventually
-	 * change.
-	 *
-	 * on FSL Embedded 64-bit, usually all RAM is bolted, but with
-	 * unusual memory sizes it's possible for some RAM to not be mapped
-	 * (such RAM is not used at all by Linux, since we don't support
-	 * highmem on 64-bit).  We limit ppc64_rma_size to what would be
-	 * mappable if this memblock is the only one.  Additional memblocks
-	 * can only increase, not decrease, the amount that ends up getting
-	 * mapped.  We still limit max to 1G even if we'll eventually map
-	 * more.  This is due to what the early init code is set up to do.
-	 *
-	 * We crop it to the size of the first MEMBLOCK to
-	 * avoid going over total available memory just in case...
-	 */
-#ifdef CONFIG_PPC_E500
-	if (early_mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
-		unsigned long linear_sz;
-		unsigned int num_cams;
-
-		/* use a quarter of the TLBCAM for bolted linear map */
-		num_cams = (mfspr(SPRN_TLB1CFG) & TLBnCFG_N_ENTRY) / 4;
-
-		linear_sz = map_mem_in_cams(first_memblock_size, num_cams,
-					    true, true);
-
-		ppc64_rma_size = min_t(u64, linear_sz, 0x40000000);
-	} else
-#endif
-		ppc64_rma_size = min_t(u64, first_memblock_size, 0x40000000);
-
-	/* Finally limit subsequent allocations */
-	memblock_set_current_limit(first_memblock_base + ppc64_rma_size);
-}
-#else /* ! CONFIG_PPC64 */
+#ifndef CONFIG_PPC64
 void __init early_init_mmu(void)
 {
 	unsigned long root = of_get_flat_dt_root();
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/nohash/tlb_64e.c
+++ linux-qcom-6.8.0/arch/powerpc/mm/nohash/tlb_64e.c
@@ -0,0 +1,361 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright 2008,2009 Ben Herrenschmidt <benh@kernel.crashing.org>
+ *                     IBM Corp.
+ *
+ *  Derived from arch/ppc/mm/init.c:
+ *    Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
+ *
+ *  Modifications by Paul Mackerras (PowerMac) (paulus@cs.anu.edu.au)
+ *  and Cort Dougan (PReP) (cort@cs.nmt.edu)
+ *    Copyright (C) 1996 Paul Mackerras
+ *
+ *  Derived from "arch/i386/mm/init.c"
+ *    Copyright (C) 1991, 1992, 1993, 1994  Linus Torvalds
+ */
+
+#include <linux/kernel.h>
+#include <linux/export.h>
+#include <linux/mm.h>
+#include <linux/init.h>
+#include <linux/pagemap.h>
+#include <linux/memblock.h>
+
+#include <asm/pgalloc.h>
+#include <asm/tlbflush.h>
+#include <asm/tlb.h>
+#include <asm/code-patching.h>
+#include <asm/cputhreads.h>
+
+#include <mm/mmu_decl.h>
+
+/* The variables below are currently only used on 64-bit Book3E
+ * though this will probably be made common with other nohash
+ * implementations at some point
+ */
+static int mmu_pte_psize;	/* Page size used for PTE pages */
+int mmu_vmemmap_psize;		/* Page size used for the virtual mem map */
+int book3e_htw_mode;		/* HW tablewalk?  Value is PPC_HTW_* */
+unsigned long linear_map_top;	/* Top of linear mapping */
+
+
+/*
+ * Number of bytes to add to SPRN_SPRG_TLB_EXFRAME on crit/mcheck/debug
+ * exceptions.  This is used for bolted and e6500 TLB miss handlers which
+ * do not modify this SPRG in the TLB miss code; for other TLB miss handlers,
+ * this is set to zero.
+ */
+int extlb_level_exc;
+
+/*
+ * Handling of virtual linear page tables or indirect TLB entries
+ * flushing when PTE pages are freed
+ */
+void tlb_flush_pgtable(struct mmu_gather *tlb, unsigned long address)
+{
+	int tsize = mmu_psize_defs[mmu_pte_psize].enc;
+
+	if (book3e_htw_mode != PPC_HTW_NONE) {
+		unsigned long start = address & PMD_MASK;
+		unsigned long end = address + PMD_SIZE;
+		unsigned long size = 1UL << mmu_psize_defs[mmu_pte_psize].shift;
+
+		/* This isn't the most optimal, ideally we would factor out the
+		 * while preempt & CPU mask mucking around, or even the IPI but
+		 * it will do for now
+		 */
+		while (start < end) {
+			__flush_tlb_page(tlb->mm, start, tsize, 1);
+			start += size;
+		}
+	} else {
+		unsigned long rmask = 0xf000000000000000ul;
+		unsigned long rid = (address & rmask) | 0x1000000000000000ul;
+		unsigned long vpte = address & ~rmask;
+
+		vpte = (vpte >> (PAGE_SHIFT - 3)) & ~0xffful;
+		vpte |= rid;
+		__flush_tlb_page(tlb->mm, vpte, tsize, 0);
+	}
+}
+
+static void __init setup_page_sizes(void)
+{
+	unsigned int tlb0cfg;
+	unsigned int eptcfg;
+	int psize;
+
+#ifdef CONFIG_PPC_E500
+	unsigned int mmucfg = mfspr(SPRN_MMUCFG);
+	int fsl_mmu = mmu_has_feature(MMU_FTR_TYPE_FSL_E);
+
+	if (fsl_mmu && (mmucfg & MMUCFG_MAVN) == MMUCFG_MAVN_V1) {
+		unsigned int tlb1cfg = mfspr(SPRN_TLB1CFG);
+		unsigned int min_pg, max_pg;
+
+		min_pg = (tlb1cfg & TLBnCFG_MINSIZE) >> TLBnCFG_MINSIZE_SHIFT;
+		max_pg = (tlb1cfg & TLBnCFG_MAXSIZE) >> TLBnCFG_MAXSIZE_SHIFT;
+
+		for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
+			struct mmu_psize_def *def;
+			unsigned int shift;
+
+			def = &mmu_psize_defs[psize];
+			shift = def->shift;
+
+			if (shift == 0 || shift & 1)
+				continue;
+
+			/* adjust to be in terms of 4^shift Kb */
+			shift = (shift - 10) >> 1;
+
+			if ((shift >= min_pg) && (shift <= max_pg))
+				def->flags |= MMU_PAGE_SIZE_DIRECT;
+		}
+
+		goto out;
+	}
+
+	if (fsl_mmu && (mmucfg & MMUCFG_MAVN) == MMUCFG_MAVN_V2) {
+		u32 tlb1cfg, tlb1ps;
+
+		tlb0cfg = mfspr(SPRN_TLB0CFG);
+		tlb1cfg = mfspr(SPRN_TLB1CFG);
+		tlb1ps = mfspr(SPRN_TLB1PS);
+		eptcfg = mfspr(SPRN_EPTCFG);
+
+		if ((tlb1cfg & TLBnCFG_IND) && (tlb0cfg & TLBnCFG_PT))
+			book3e_htw_mode = PPC_HTW_E6500;
+
+		/*
+		 * We expect 4K subpage size and unrestricted indirect size.
+		 * The lack of a restriction on indirect size is a Freescale
+		 * extension, indicated by PSn = 0 but SPSn != 0.
+		 */
+		if (eptcfg != 2)
+			book3e_htw_mode = PPC_HTW_NONE;
+
+		for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
+			struct mmu_psize_def *def = &mmu_psize_defs[psize];
+
+			if (!def->shift)
+				continue;
+
+			if (tlb1ps & (1U << (def->shift - 10))) {
+				def->flags |= MMU_PAGE_SIZE_DIRECT;
+
+				if (book3e_htw_mode && psize == MMU_PAGE_2M)
+					def->flags |= MMU_PAGE_SIZE_INDIRECT;
+			}
+		}
+
+		goto out;
+	}
+#endif
+out:
+	/* Cleanup array and print summary */
+	pr_info("MMU: Supported page sizes\n");
+	for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
+		struct mmu_psize_def *def = &mmu_psize_defs[psize];
+		const char *__page_type_names[] = {
+			"unsupported",
+			"direct",
+			"indirect",
+			"direct & indirect"
+		};
+		if (def->flags == 0) {
+			def->shift = 0;
+			continue;
+		}
+		pr_info("  %8ld KB as %s\n", 1ul << (def->shift - 10),
+			__page_type_names[def->flags & 0x3]);
+	}
+}
+
+static void __init setup_mmu_htw(void)
+{
+	/*
+	 * If we want to use HW tablewalk, enable it by patching the TLB miss
+	 * handlers to branch to the one dedicated to it.
+	 */
+
+	switch (book3e_htw_mode) {
+#ifdef CONFIG_PPC_E500
+	case PPC_HTW_E6500:
+		extlb_level_exc = EX_TLB_SIZE;
+		patch_exception(0x1c0, exc_data_tlb_miss_e6500_book3e);
+		patch_exception(0x1e0, exc_instruction_tlb_miss_e6500_book3e);
+		break;
+#endif
+	}
+	pr_info("MMU: Book3E HW tablewalk %s\n",
+		book3e_htw_mode != PPC_HTW_NONE ? "enabled" : "not supported");
+}
+
+/*
+ * Early initialization of the MMU TLB code
+ */
+static void early_init_this_mmu(void)
+{
+	unsigned int mas4;
+
+	/* Set MAS4 based on page table setting */
+
+	mas4 = 0x4 << MAS4_WIMGED_SHIFT;
+	switch (book3e_htw_mode) {
+	case PPC_HTW_E6500:
+		mas4 |= MAS4_INDD;
+		mas4 |= BOOK3E_PAGESZ_2M << MAS4_TSIZED_SHIFT;
+		mas4 |= MAS4_TLBSELD(1);
+		mmu_pte_psize = MMU_PAGE_2M;
+		break;
+
+	case PPC_HTW_NONE:
+		mas4 |=	BOOK3E_PAGESZ_4K << MAS4_TSIZED_SHIFT;
+		mmu_pte_psize = mmu_virtual_psize;
+		break;
+	}
+	mtspr(SPRN_MAS4, mas4);
+
+#ifdef CONFIG_PPC_E500
+	if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
+		unsigned int num_cams;
+		bool map = true;
+
+		/* use a quarter of the TLBCAM for bolted linear map */
+		num_cams = (mfspr(SPRN_TLB1CFG) & TLBnCFG_N_ENTRY) / 4;
+
+		/*
+		 * Only do the mapping once per core, or else the
+		 * transient mapping would cause problems.
+		 */
+#ifdef CONFIG_SMP
+		if (hweight32(get_tensr()) > 1)
+			map = false;
+#endif
+
+		if (map)
+			linear_map_top = map_mem_in_cams(linear_map_top,
+							 num_cams, false, true);
+	}
+#endif
+
+	/* A sync won't hurt us after mucking around with
+	 * the MMU configuration
+	 */
+	mb();
+}
+
+static void __init early_init_mmu_global(void)
+{
+	/* XXX This should be decided at runtime based on supported
+	 * page sizes in the TLB, but for now let's assume 16M is
+	 * always there and a good fit (which it probably is)
+	 *
+	 * Freescale booke only supports 4K pages in TLB0, so use that.
+	 */
+	if (mmu_has_feature(MMU_FTR_TYPE_FSL_E))
+		mmu_vmemmap_psize = MMU_PAGE_4K;
+	else
+		mmu_vmemmap_psize = MMU_PAGE_16M;
+
+	/* XXX This code only checks for TLB 0 capabilities and doesn't
+	 *     check what page size combos are supported by the HW. It
+	 *     also doesn't handle the case where a separate array holds
+	 *     the IND entries from the array loaded by the PT.
+	 */
+	/* Look for supported page sizes */
+	setup_page_sizes();
+
+	/* Look for HW tablewalk support */
+	setup_mmu_htw();
+
+#ifdef CONFIG_PPC_E500
+	if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
+		if (book3e_htw_mode == PPC_HTW_NONE) {
+			extlb_level_exc = EX_TLB_SIZE;
+			patch_exception(0x1c0, exc_data_tlb_miss_bolted_book3e);
+			patch_exception(0x1e0,
+				exc_instruction_tlb_miss_bolted_book3e);
+		}
+	}
+#endif
+
+	/* Set the global containing the top of the linear mapping
+	 * for use by the TLB miss code
+	 */
+	linear_map_top = memblock_end_of_DRAM();
+
+	ioremap_bot = IOREMAP_BASE;
+}
+
+static void __init early_mmu_set_memory_limit(void)
+{
+#ifdef CONFIG_PPC_E500
+	if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
+		/*
+		 * Limit memory so we dont have linear faults.
+		 * Unlike memblock_set_current_limit, which limits
+		 * memory available during early boot, this permanently
+		 * reduces the memory available to Linux.  We need to
+		 * do this because highmem is not supported on 64-bit.
+		 */
+		memblock_enforce_memory_limit(linear_map_top);
+	}
+#endif
+
+	memblock_set_current_limit(linear_map_top);
+}
+
+/* boot cpu only */
+void __init early_init_mmu(void)
+{
+	early_init_mmu_global();
+	early_init_this_mmu();
+	early_mmu_set_memory_limit();
+}
+
+void early_init_mmu_secondary(void)
+{
+	early_init_this_mmu();
+}
+
+void setup_initial_memory_limit(phys_addr_t first_memblock_base,
+				phys_addr_t first_memblock_size)
+{
+	/* On non-FSL Embedded 64-bit, we adjust the RMA size to match
+	 * the bolted TLB entry. We know for now that only 1G
+	 * entries are supported though that may eventually
+	 * change.
+	 *
+	 * on FSL Embedded 64-bit, usually all RAM is bolted, but with
+	 * unusual memory sizes it's possible for some RAM to not be mapped
+	 * (such RAM is not used at all by Linux, since we don't support
+	 * highmem on 64-bit).  We limit ppc64_rma_size to what would be
+	 * mappable if this memblock is the only one.  Additional memblocks
+	 * can only increase, not decrease, the amount that ends up getting
+	 * mapped.  We still limit max to 1G even if we'll eventually map
+	 * more.  This is due to what the early init code is set up to do.
+	 *
+	 * We crop it to the size of the first MEMBLOCK to
+	 * avoid going over total available memory just in case...
+	 */
+#ifdef CONFIG_PPC_E500
+	if (early_mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
+		unsigned long linear_sz;
+		unsigned int num_cams;
+
+		/* use a quarter of the TLBCAM for bolted linear map */
+		num_cams = (mfspr(SPRN_TLB1CFG) & TLBnCFG_N_ENTRY) / 4;
+
+		linear_sz = map_mem_in_cams(first_memblock_size, num_cams,
+					    true, true);
+
+		ppc64_rma_size = min_t(u64, linear_sz, 0x40000000);
+	} else
+#endif
+		ppc64_rma_size = min_t(u64, first_memblock_size, 0x40000000);
+
+	/* Finally limit subsequent allocations */
+	memblock_set_current_limit(first_memblock_base + ppc64_rma_size);
+}
--- linux-qcom-6.8.0.orig/arch/powerpc/mm/nohash/tlb_low_64e.S
+++ linux-qcom-6.8.0/arch/powerpc/mm/nohash/tlb_low_64e.S
@@ -893,201 +893,6 @@
 	TLB_MISS_EPILOG_ERROR
 	b	exc_data_storage_book3e
 
-
-/**************************************************************
- *                                                            *
- * TLB miss handling for Book3E with hw page table support    *
- *                                                            *
- **************************************************************/
-
-
-/* Data TLB miss */
-	START_EXCEPTION(data_tlb_miss_htw)
-	TLB_MISS_PROLOG
-
-	/* Now we handle the fault proper. We only save DEAR in normal
-	 * fault case since that's the only interesting values here.
-	 * We could probably also optimize by not saving SRR0/1 in the
-	 * linear mapping case but I'll leave that for later
-	 */
-	mfspr	r14,SPRN_ESR
-	mfspr	r16,SPRN_DEAR		/* get faulting address */
-	srdi	r11,r16,44		/* get region */
-	xoris	r11,r11,0xc
-	cmpldi	cr0,r11,0		/* linear mapping ? */
-	beq	tlb_load_linear		/* yes -> go to linear map load */
-	cmpldi	cr1,r11,1		/* vmalloc mapping ? */
-
-	/* We do the user/kernel test for the PID here along with the RW test
-	 */
-	srdi.	r11,r16,60		/* Check for user region */
-	ld	r15,PACAPGD(r13)	/* Load user pgdir */
-	beq	htw_tlb_miss
-
-	/* XXX replace the RMW cycles with immediate loads + writes */
-1:	mfspr	r10,SPRN_MAS1
-	rlwinm	r10,r10,0,16,1		/* Clear TID */
-	mtspr	SPRN_MAS1,r10
-	ld	r15,PACA_KERNELPGD(r13)	/* Load kernel pgdir */
-	beq+	cr1,htw_tlb_miss
-
-	/* We got a crappy address, just fault with whatever DEAR and ESR
-	 * are here
-	 */
-	TLB_MISS_EPILOG_ERROR
-	b	exc_data_storage_book3e
-
-/* Instruction TLB miss */
-	START_EXCEPTION(instruction_tlb_miss_htw)
-	TLB_MISS_PROLOG
-
-	/* If we take a recursive fault, the second level handler may need
-	 * to know whether we are handling a data or instruction fault in
-	 * order to get to the right store fault handler. We provide that
-	 * info by keeping a crazy value for ESR in r14
-	 */
-	li	r14,-1	/* store to exception frame is done later */
-
-	/* Now we handle the fault proper. We only save DEAR in the non
-	 * linear mapping case since we know the linear mapping case will
-	 * not re-enter. We could indeed optimize and also not save SRR0/1
-	 * in the linear mapping case but I'll leave that for later
-	 *
-	 * Faulting address is SRR0 which is already in r16
-	 */
-	srdi	r11,r16,44		/* get region */
-	xoris	r11,r11,0xc
-	cmpldi	cr0,r11,0		/* linear mapping ? */
-	beq	tlb_load_linear		/* yes -> go to linear map load */
-	cmpldi	cr1,r11,1		/* vmalloc mapping ? */
-
-	/* We do the user/kernel test for the PID here along with the RW test
-	 */
-	srdi.	r11,r16,60		/* Check for user region */
-	ld	r15,PACAPGD(r13)		/* Load user pgdir */
-	beq	htw_tlb_miss
-
-	/* XXX replace the RMW cycles with immediate loads + writes */
-1:	mfspr	r10,SPRN_MAS1
-	rlwinm	r10,r10,0,16,1			/* Clear TID */
-	mtspr	SPRN_MAS1,r10
-	ld	r15,PACA_KERNELPGD(r13)		/* Load kernel pgdir */
-	beq+	htw_tlb_miss
-
-	/* We got a crappy address, just fault */
-	TLB_MISS_EPILOG_ERROR
-	b	exc_instruction_storage_book3e
-
-
-/*
- * This is the guts of the second-level TLB miss handler for direct
- * misses. We are entered with:
- *
- * r16 = virtual page table faulting address
- * r15 = PGD pointer
- * r14 = ESR
- * r13 = PACA
- * r12 = TLB exception frame in PACA
- * r11 = crap (free to use)
- * r10 = crap (free to use)
- *
- * It can be re-entered by the linear mapping miss handler. However, to
- * avoid too much complication, it will save/restore things for us
- */
-htw_tlb_miss:
-#ifdef CONFIG_PPC_KUAP
-	mfspr	r10,SPRN_MAS1
-	rlwinm.	r10,r10,0,0x3fff0000
-	beq-	htw_tlb_miss_fault /* KUAP fault */
-#endif
-	/* Search if we already have a TLB entry for that virtual address, and
-	 * if we do, bail out.
-	 *
-	 * MAS1:IND should be already set based on MAS4
-	 */
-	PPC_TLBSRX_DOT(0,R16)
-	beq	htw_tlb_miss_done
-
-	/* Now, we need to walk the page tables. First check if we are in
-	 * range.
-	 */
-	rldicl.	r10,r16,64-PGTABLE_EADDR_SIZE,PGTABLE_EADDR_SIZE+4
-	bne-	htw_tlb_miss_fault
-
-	/* Get the PGD pointer */
-	cmpldi	cr0,r15,0
-	beq-	htw_tlb_miss_fault
-
-	/* Get to PGD entry */
-	rldicl	r11,r16,64-(PGDIR_SHIFT-3),64-PGD_INDEX_SIZE-3
-	clrrdi	r10,r11,3
-	ldx	r15,r10,r15
-	cmpdi	cr0,r15,0
-	bge	htw_tlb_miss_fault
-
-	/* Get to PUD entry */
-	rldicl	r11,r16,64-(PUD_SHIFT-3),64-PUD_INDEX_SIZE-3
-	clrrdi	r10,r11,3
-	ldx	r15,r10,r15
-	cmpdi	cr0,r15,0
-	bge	htw_tlb_miss_fault
-
-	/* Get to PMD entry */
-	rldicl	r11,r16,64-(PMD_SHIFT-3),64-PMD_INDEX_SIZE-3
-	clrrdi	r10,r11,3
-	ldx	r15,r10,r15
-	cmpdi	cr0,r15,0
-	bge	htw_tlb_miss_fault
-
-	/* Ok, we're all right, we can now create an indirect entry for
-	 * a 1M or 256M page.
-	 *
-	 * The last trick is now that because we use "half" pages for
-	 * the HTW (1M IND is 2K and 256M IND is 32K) we need to account
-	 * for an added LSB bit to the RPN. For 64K pages, there is no
-	 * problem as we already use 32K arrays (half PTE pages), but for
-	 * 4K page we need to extract a bit from the virtual address and
-	 * insert it into the "PA52" bit of the RPN.
-	 */
-	rlwimi	r15,r16,32-9,20,20
-	/* Now we build the MAS:
-	 *
-	 * MAS 0   :	Fully setup with defaults in MAS4 and TLBnCFG
-	 * MAS 1   :	Almost fully setup
-	 *               - PID already updated by caller if necessary
-	 *               - TSIZE for now is base ind page size always
-	 * MAS 2   :	Use defaults
-	 * MAS 3+7 :	Needs to be done
-	 */
-	ori	r10,r15,(BOOK3E_PAGESZ_4K << MAS3_SPSIZE_SHIFT)
-
-	srdi	r16,r10,32
-	mtspr	SPRN_MAS3,r10
-	mtspr	SPRN_MAS7,r16
-
-	tlbwe
-
-htw_tlb_miss_done:
-	/* We don't bother with restoring DEAR or ESR since we know we are
-	 * level 0 and just going back to userland. They are only needed
-	 * if you are going to take an access fault
-	 */
-	TLB_MISS_EPILOG_SUCCESS
-	rfi
-
-htw_tlb_miss_fault:
-	/* We need to check if it was an instruction miss. We know this
-	 * though because r14 would contain -1
-	 */
-	cmpdi	cr0,r14,-1
-	beq	1f
-	mtspr	SPRN_DEAR,r16
-	mtspr	SPRN_ESR,r14
-	TLB_MISS_EPILOG_ERROR
-	b	exc_data_storage_book3e
-1:	TLB_MISS_EPILOG_ERROR
-	b	exc_instruction_storage_book3e
-
 /*
  * This is the guts of "any" level TLB miss handler for kernel linear
  * mapping misses. We are entered with:
--- linux-qcom-6.8.0.orig/arch/powerpc/net/bpf_jit_comp32.c
+++ linux-qcom-6.8.0/arch/powerpc/net/bpf_jit_comp32.c
@@ -450,10 +450,16 @@
 			}
 			break;
 		case BPF_ALU | BPF_DIV | BPF_X: /* (u32) dst /= (u32) src */
-			EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, src_reg));
+			if (off)
+				EMIT(PPC_RAW_DIVW(dst_reg, src2_reg, src_reg));
+			else
+				EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, src_reg));
 			break;
 		case BPF_ALU | BPF_MOD | BPF_X: /* (u32) dst %= (u32) src */
-			EMIT(PPC_RAW_DIVWU(_R0, src2_reg, src_reg));
+			if (off)
+				EMIT(PPC_RAW_DIVW(_R0, src2_reg, src_reg));
+			else
+				EMIT(PPC_RAW_DIVWU(_R0, src2_reg, src_reg));
 			EMIT(PPC_RAW_MULW(_R0, src_reg, _R0));
 			EMIT(PPC_RAW_SUB(dst_reg, src2_reg, _R0));
 			break;
@@ -467,10 +473,16 @@
 			if (imm == 1) {
 				EMIT(PPC_RAW_MR(dst_reg, src2_reg));
 			} else if (is_power_of_2((u32)imm)) {
-				EMIT(PPC_RAW_SRWI(dst_reg, src2_reg, ilog2(imm)));
+				if (off)
+					EMIT(PPC_RAW_SRAWI(dst_reg, src2_reg, ilog2(imm)));
+				else
+					EMIT(PPC_RAW_SRWI(dst_reg, src2_reg, ilog2(imm)));
 			} else {
 				PPC_LI32(_R0, imm);
-				EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, _R0));
+				if (off)
+					EMIT(PPC_RAW_DIVW(dst_reg, src2_reg, _R0));
+				else
+					EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, _R0));
 			}
 			break;
 		case BPF_ALU | BPF_MOD | BPF_K: /* (u32) dst %= (u32) imm */
@@ -480,11 +492,19 @@
 			if (!is_power_of_2((u32)imm)) {
 				bpf_set_seen_register(ctx, tmp_reg);
 				PPC_LI32(tmp_reg, imm);
-				EMIT(PPC_RAW_DIVWU(_R0, src2_reg, tmp_reg));
+				if (off)
+					EMIT(PPC_RAW_DIVW(_R0, src2_reg, tmp_reg));
+				else
+					EMIT(PPC_RAW_DIVWU(_R0, src2_reg, tmp_reg));
 				EMIT(PPC_RAW_MULW(_R0, tmp_reg, _R0));
 				EMIT(PPC_RAW_SUB(dst_reg, src2_reg, _R0));
 			} else if (imm == 1) {
 				EMIT(PPC_RAW_LI(dst_reg, 0));
+			} else if (off) {
+				EMIT(PPC_RAW_SRAWI(_R0, src2_reg, ilog2(imm)));
+				EMIT(PPC_RAW_ADDZE(_R0, _R0));
+				EMIT(PPC_RAW_SLWI(_R0, _R0, ilog2(imm)));
+				EMIT(PPC_RAW_SUB(dst_reg, src2_reg, _R0));
 			} else {
 				imm = ilog2((u32)imm);
 				EMIT(PPC_RAW_RLWINM(dst_reg, src2_reg, 0, 32 - imm, 31));
@@ -497,11 +517,21 @@
 				imm = -imm;
 			if (!is_power_of_2(imm))
 				return -EOPNOTSUPP;
-			if (imm == 1)
+			if (imm == 1) {
 				EMIT(PPC_RAW_LI(dst_reg, 0));
-			else
+				EMIT(PPC_RAW_LI(dst_reg_h, 0));
+			} else if (off) {
+				EMIT(PPC_RAW_SRAWI(dst_reg_h, src2_reg_h, 31));
+				EMIT(PPC_RAW_XOR(dst_reg, src2_reg, dst_reg_h));
+				EMIT(PPC_RAW_SUBFC(dst_reg, dst_reg_h, dst_reg));
+				EMIT(PPC_RAW_RLWINM(dst_reg, dst_reg, 0, 32 - ilog2(imm), 31));
+				EMIT(PPC_RAW_XOR(dst_reg, dst_reg, dst_reg_h));
+				EMIT(PPC_RAW_SUBFC(dst_reg, dst_reg_h, dst_reg));
+				EMIT(PPC_RAW_SUBFE(dst_reg_h, dst_reg_h, dst_reg_h));
+			} else {
 				EMIT(PPC_RAW_RLWINM(dst_reg, src2_reg, 0, 32 - ilog2(imm), 31));
-			EMIT(PPC_RAW_LI(dst_reg_h, 0));
+				EMIT(PPC_RAW_LI(dst_reg_h, 0));
+			}
 			break;
 		case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */
 			if (!imm)
@@ -727,15 +757,30 @@
 		 * MOV
 		 */
 		case BPF_ALU64 | BPF_MOV | BPF_X: /* dst = src */
-			if (dst_reg == src_reg)
-				break;
-			EMIT(PPC_RAW_MR(dst_reg, src_reg));
-			EMIT(PPC_RAW_MR(dst_reg_h, src_reg_h));
+			if (off == 8) {
+				EMIT(PPC_RAW_EXTSB(dst_reg, src_reg));
+				EMIT(PPC_RAW_SRAWI(dst_reg_h, dst_reg, 31));
+			} else if (off == 16) {
+				EMIT(PPC_RAW_EXTSH(dst_reg, src_reg));
+				EMIT(PPC_RAW_SRAWI(dst_reg_h, dst_reg, 31));
+			} else if (off == 32 && dst_reg == src_reg) {
+				EMIT(PPC_RAW_SRAWI(dst_reg_h, src_reg, 31));
+			} else if (off == 32) {
+				EMIT(PPC_RAW_MR(dst_reg, src_reg));
+				EMIT(PPC_RAW_SRAWI(dst_reg_h, src_reg, 31));
+			} else if (dst_reg != src_reg) {
+				EMIT(PPC_RAW_MR(dst_reg, src_reg));
+				EMIT(PPC_RAW_MR(dst_reg_h, src_reg_h));
+			}
 			break;
 		case BPF_ALU | BPF_MOV | BPF_X: /* (u32) dst = src */
 			/* special mov32 for zext */
 			if (imm == 1)
 				EMIT(PPC_RAW_LI(dst_reg_h, 0));
+			else if (off == 8)
+				EMIT(PPC_RAW_EXTSB(dst_reg, src_reg));
+			else if (off == 16)
+				EMIT(PPC_RAW_EXTSH(dst_reg, src_reg));
 			else if (dst_reg != src_reg)
 				EMIT(PPC_RAW_MR(dst_reg, src_reg));
 			break;
@@ -751,6 +796,7 @@
 		 * BPF_FROM_BE/LE
 		 */
 		case BPF_ALU | BPF_END | BPF_FROM_LE:
+		case BPF_ALU64 | BPF_END | BPF_FROM_LE:
 			switch (imm) {
 			case 16:
 				/* Copy 16 bits to upper part */
@@ -785,6 +831,8 @@
 				EMIT(PPC_RAW_MR(dst_reg_h, tmp_reg));
 				break;
 			}
+			if (BPF_CLASS(code) == BPF_ALU64 && imm != 64)
+				EMIT(PPC_RAW_LI(dst_reg_h, 0));
 			break;
 		case BPF_ALU | BPF_END | BPF_FROM_BE:
 			switch (imm) {
@@ -852,6 +900,15 @@
 
 			/* Get offset into TMP_REG */
 			EMIT(PPC_RAW_LI(tmp_reg, off));
+			/*
+			 * Enforce full ordering for operations with BPF_FETCH by emitting a 'sync'
+			 * before and after the operation.
+			 *
+			 * This is a requirement in the Linux Kernel Memory Model.
+			 * See __cmpxchg_u32() in asm/cmpxchg.h as an example.
+			 */
+			if ((imm & BPF_FETCH) && IS_ENABLED(CONFIG_SMP))
+				EMIT(PPC_RAW_SYNC());
 			tmp_idx = ctx->idx * 4;
 			/* load value from memory into r0 */
 			EMIT(PPC_RAW_LWARX(_R0, tmp_reg, dst_reg, 0));
@@ -905,6 +962,9 @@
 
 			/* For the BPF_FETCH variant, get old data into src_reg */
 			if (imm & BPF_FETCH) {
+				/* Emit 'sync' to enforce full ordering */
+				if (IS_ENABLED(CONFIG_SMP))
+					EMIT(PPC_RAW_SYNC());
 				EMIT(PPC_RAW_MR(ret_reg, ax_reg));
 				if (!fp->aux->verifier_zext)
 					EMIT(PPC_RAW_LI(ret_reg - 1, 0)); /* higher 32-bit */
@@ -918,11 +978,17 @@
 		 * BPF_LDX
 		 */
 		case BPF_LDX | BPF_MEM | BPF_B: /* dst = *(u8 *)(ul) (src + off) */
+		case BPF_LDX | BPF_MEMSX | BPF_B:
 		case BPF_LDX | BPF_PROBE_MEM | BPF_B:
+		case BPF_LDX | BPF_PROBE_MEMSX | BPF_B:
 		case BPF_LDX | BPF_MEM | BPF_H: /* dst = *(u16 *)(ul) (src + off) */
+		case BPF_LDX | BPF_MEMSX | BPF_H:
 		case BPF_LDX | BPF_PROBE_MEM | BPF_H:
+		case BPF_LDX | BPF_PROBE_MEMSX | BPF_H:
 		case BPF_LDX | BPF_MEM | BPF_W: /* dst = *(u32 *)(ul) (src + off) */
+		case BPF_LDX | BPF_MEMSX | BPF_W:
 		case BPF_LDX | BPF_PROBE_MEM | BPF_W:
+		case BPF_LDX | BPF_PROBE_MEMSX | BPF_W:
 		case BPF_LDX | BPF_MEM | BPF_DW: /* dst = *(u64 *)(ul) (src + off) */
 		case BPF_LDX | BPF_PROBE_MEM | BPF_DW:
 			/*
@@ -931,7 +997,7 @@
 			 * load only if addr is kernel address (see is_kernel_addr()), otherwise
 			 * set dst_reg=0 and move on.
 			 */
-			if (BPF_MODE(code) == BPF_PROBE_MEM) {
+			if (BPF_MODE(code) == BPF_PROBE_MEM || BPF_MODE(code) == BPF_PROBE_MEMSX) {
 				PPC_LI32(_R0, TASK_SIZE - off);
 				EMIT(PPC_RAW_CMPLW(src_reg, _R0));
 				PPC_BCC_SHORT(COND_GT, (ctx->idx + 4) * 4);
@@ -953,30 +1019,48 @@
 				 * as there are two load instructions for dst_reg_h & dst_reg
 				 * respectively.
 				 */
-				if (size == BPF_DW)
+				if (size == BPF_DW ||
+				    (size == BPF_B && BPF_MODE(code) == BPF_PROBE_MEMSX))
 					PPC_JMP((ctx->idx + 3) * 4);
 				else
 					PPC_JMP((ctx->idx + 2) * 4);
 			}
 
-			switch (size) {
-			case BPF_B:
-				EMIT(PPC_RAW_LBZ(dst_reg, src_reg, off));
-				break;
-			case BPF_H:
-				EMIT(PPC_RAW_LHZ(dst_reg, src_reg, off));
-				break;
-			case BPF_W:
-				EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off));
-				break;
-			case BPF_DW:
-				EMIT(PPC_RAW_LWZ(dst_reg_h, src_reg, off));
-				EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off + 4));
-				break;
-			}
+			if (BPF_MODE(code) == BPF_MEMSX || BPF_MODE(code) == BPF_PROBE_MEMSX) {
+				switch (size) {
+				case BPF_B:
+					EMIT(PPC_RAW_LBZ(dst_reg, src_reg, off));
+					EMIT(PPC_RAW_EXTSB(dst_reg, dst_reg));
+					break;
+				case BPF_H:
+					EMIT(PPC_RAW_LHA(dst_reg, src_reg, off));
+					break;
+				case BPF_W:
+					EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off));
+					break;
+				}
+				if (!fp->aux->verifier_zext)
+					EMIT(PPC_RAW_SRAWI(dst_reg_h, dst_reg, 31));
 
-			if (size != BPF_DW && !fp->aux->verifier_zext)
-				EMIT(PPC_RAW_LI(dst_reg_h, 0));
+			} else {
+				switch (size) {
+				case BPF_B:
+					EMIT(PPC_RAW_LBZ(dst_reg, src_reg, off));
+					break;
+				case BPF_H:
+					EMIT(PPC_RAW_LHZ(dst_reg, src_reg, off));
+					break;
+				case BPF_W:
+					EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off));
+					break;
+				case BPF_DW:
+					EMIT(PPC_RAW_LWZ(dst_reg_h, src_reg, off));
+					EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off + 4));
+					break;
+				}
+				if (size != BPF_DW && !fp->aux->verifier_zext)
+					EMIT(PPC_RAW_LI(dst_reg_h, 0));
+			}
 
 			if (BPF_MODE(code) == BPF_PROBE_MEM) {
 				int insn_idx = ctx->idx - 1;
@@ -1068,6 +1152,9 @@
 		case BPF_JMP | BPF_JA:
 			PPC_JMP(addrs[i + 1 + off]);
 			break;
+		case BPF_JMP32 | BPF_JA:
+			PPC_JMP(addrs[i + 1 + imm]);
+			break;
 
 		case BPF_JMP | BPF_JGT | BPF_K:
 		case BPF_JMP | BPF_JGT | BPF_X:
--- linux-qcom-6.8.0.orig/arch/powerpc/net/bpf_jit_comp64.c
+++ linux-qcom-6.8.0/arch/powerpc/net/bpf_jit_comp64.c
@@ -202,7 +202,8 @@
 	EMIT(PPC_RAW_BLR());
 }
 
-static int bpf_jit_emit_func_call_hlp(u32 *image, struct codegen_context *ctx, u64 func)
+static int
+bpf_jit_emit_func_call_hlp(u32 *image, u32 *fimage, struct codegen_context *ctx, u64 func)
 {
 	unsigned long func_addr = func ? ppc_function_entry((void *)func) : 0;
 	long reladdr;
@@ -211,19 +212,20 @@
 		return -EINVAL;
 
 	if (IS_ENABLED(CONFIG_PPC_KERNEL_PCREL)) {
-		reladdr = func_addr - CTX_NIA(ctx);
+		reladdr = func_addr - local_paca->kernelbase;
 
 		if (reladdr >= (long)SZ_8G || reladdr < -(long)SZ_8G) {
-			pr_err("eBPF: address of %ps out of range of pcrel address.\n",
-				(void *)func);
+			pr_err("eBPF: address of %ps out of range of 34-bit relative address.\n",
+			       (void *)func);
 			return -ERANGE;
 		}
-		/* pla r12,addr */
-		EMIT(PPC_PREFIX_MLS | __PPC_PRFX_R(1) | IMM_H18(reladdr));
-		EMIT(PPC_INST_PADDI | ___PPC_RT(_R12) | IMM_L(reladdr));
-		EMIT(PPC_RAW_MTCTR(_R12));
-		EMIT(PPC_RAW_BCTR());
-
+		EMIT(PPC_RAW_LD(_R12, _R13, offsetof(struct paca_struct, kernelbase)));
+		/* Align for subsequent prefix instruction */
+		if (!IS_ALIGNED((unsigned long)fimage + CTX_NIA(ctx), 8))
+			EMIT(PPC_RAW_NOP());
+		/* paddi r12,r12,addr */
+		EMIT(PPC_PREFIX_MLS | __PPC_PRFX_R(0) | IMM_H18(reladdr));
+		EMIT(PPC_INST_PADDI | ___PPC_RT(_R12) | ___PPC_RA(_R12) | IMM_L(reladdr));
 	} else {
 		reladdr = func_addr - kernel_toc_addr();
 		if (reladdr > 0x7FFFFFFF || reladdr < -(0x80000000L)) {
@@ -233,9 +235,9 @@
 
 		EMIT(PPC_RAW_ADDIS(_R12, _R2, PPC_HA(reladdr)));
 		EMIT(PPC_RAW_ADDI(_R12, _R12, PPC_LO(reladdr)));
-		EMIT(PPC_RAW_MTCTR(_R12));
-		EMIT(PPC_RAW_BCTRL());
 	}
+	EMIT(PPC_RAW_MTCTR(_R12));
+	EMIT(PPC_RAW_BCTRL());
 
 	return 0;
 }
@@ -285,7 +287,7 @@
 	int b2p_index = bpf_to_ppc(BPF_REG_3);
 	int bpf_tailcall_prologue_size = 8;
 
-	if (IS_ENABLED(CONFIG_PPC64_ELF_ABI_V2))
+	if (!IS_ENABLED(CONFIG_PPC_KERNEL_PCREL) && IS_ENABLED(CONFIG_PPC64_ELF_ABI_V2))
 		bpf_tailcall_prologue_size += 4; /* skip past the toc load */
 
 	/*
@@ -803,6 +805,15 @@
 
 			/* Get offset into TMP_REG_1 */
 			EMIT(PPC_RAW_LI(tmp1_reg, off));
+			/*
+			 * Enforce full ordering for operations with BPF_FETCH by emitting a 'sync'
+			 * before and after the operation.
+			 *
+			 * This is a requirement in the Linux Kernel Memory Model.
+			 * See __cmpxchg_u64() in asm/cmpxchg.h as an example.
+			 */
+			if ((imm & BPF_FETCH) && IS_ENABLED(CONFIG_SMP))
+				EMIT(PPC_RAW_SYNC());
 			tmp_idx = ctx->idx * 4;
 			/* load value from memory into TMP_REG_2 */
 			if (size == BPF_DW)
@@ -865,6 +876,9 @@
 			PPC_BCC_SHORT(COND_NE, tmp_idx);
 
 			if (imm & BPF_FETCH) {
+				/* Emit 'sync' to enforce full ordering */
+				if (IS_ENABLED(CONFIG_SMP))
+					EMIT(PPC_RAW_SYNC());
 				EMIT(PPC_RAW_MR(ret_reg, _R0));
 				/*
 				 * Skip unnecessary zero-extension for 32-bit cmpxchg.
@@ -993,7 +1007,7 @@
 				return ret;
 
 			if (func_addr_fixed)
-				ret = bpf_jit_emit_func_call_hlp(image, ctx, func_addr);
+				ret = bpf_jit_emit_func_call_hlp(image, fimage, ctx, func_addr);
 			else
 				ret = bpf_jit_emit_func_call_rel(image, fimage, ctx, func_addr);
 
--- linux-qcom-6.8.0.orig/arch/powerpc/perf/hv-gpci.c
+++ linux-qcom-6.8.0/arch/powerpc/perf/hv-gpci.c
@@ -695,6 +695,20 @@
 
 	ret = plpar_hcall_norets(H_GET_PERF_COUNTER_INFO,
 			virt_to_phys(arg), HGPCI_REQ_BUFFER_SIZE);
+
+	/*
+	 * ret value as 'H_PARAMETER' with detail_rc as 'GEN_BUF_TOO_SMALL',
+	 * specifies that the current buffer size cannot accommodate
+	 * all the information and a partial buffer returned.
+	 * Since in this function we are only accessing data for a given starting index,
+	 * we don't need to accommodate whole data and can get required count by
+	 * accessing first entry data.
+	 * Hence hcall fails only incase the ret value is other than H_SUCCESS or
+	 * H_PARAMETER with detail_rc value as GEN_BUF_TOO_SMALL(0x1B).
+	 */
+	if (ret == H_PARAMETER && be32_to_cpu(arg->params.detail_rc) == 0x1B)
+		ret = 0;
+
 	if (ret) {
 		pr_devel("hcall failed: 0x%lx\n", ret);
 		goto out;
@@ -759,6 +773,7 @@
 {
 	u64 count;
 	u8 length;
+	unsigned long ret;
 
 	/* Not our event */
 	if (event->attr.type != event->pmu->type)
@@ -789,13 +804,23 @@
 	}
 
 	/* check if the request works... */
-	if (single_gpci_request(event_get_request(event),
+	ret = single_gpci_request(event_get_request(event),
 				event_get_starting_index(event),
 				event_get_secondary_index(event),
 				event_get_counter_info_version(event),
 				event_get_offset(event),
 				length,
-				&count)) {
+				&count);
+
+	/*
+	 * ret value as H_AUTHORITY implies that partition is not permitted to retrieve
+	 * performance information, and required to set
+	 * "Enable Performance Information Collection" option.
+	 */
+	if (ret == H_AUTHORITY)
+		return -EPERM;
+
+	if (ret) {
 		pr_devel("gpci hcall failed\n");
 		return -EINVAL;
 	}
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/44x/warp.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/44x/warp.c
@@ -8,6 +8,7 @@
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/of_platform.h>
+#include <linux/platform_device.h>
 #include <linux/kthread.h>
 #include <linux/leds.h>
 #include <linux/i2c.h>
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/85xx/smp.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/85xx/smp.c
@@ -398,6 +398,7 @@
 	hard_irq_disable();
 	mpic_teardown_this_cpu(secondary);
 
+#ifdef CONFIG_CRASH_DUMP
 	if (cpu == crashing_cpu && cpu_thread_in_core(cpu) != 0) {
 		/*
 		 * We enter the crash kernel on whatever cpu crashed,
@@ -406,9 +407,11 @@
 		 */
 		disable_threadbit = 1;
 		disable_cpu = cpu_first_thread_sibling(cpu);
-	} else if (sibling != crashing_cpu &&
-		   cpu_thread_in_core(cpu) == 0 &&
-		   cpu_thread_in_core(sibling) != 0) {
+	} else if (sibling == crashing_cpu) {
+		return;
+	}
+#endif
+	if (cpu_thread_in_core(cpu) == 0 && cpu_thread_in_core(sibling) != 0) {
 		disable_threadbit = 2;
 		disable_cpu = sibling;
 	}
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/book3s/vas-api.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/book3s/vas-api.c
@@ -464,7 +464,43 @@
 	return VM_FAULT_SIGBUS;
 }
 
+/*
+ * During mmap() paste address, mapping VMA is saved in VAS window
+ * struct which is used to unmap during migration if the window is
+ * still open. But the user space can remove this mapping with
+ * munmap() before closing the window and the VMA address will
+ * be invalid. Set VAS window VMA to NULL in this function which
+ * is called before VMA free.
+ */
+static void vas_mmap_close(struct vm_area_struct *vma)
+{
+	struct file *fp = vma->vm_file;
+	struct coproc_instance *cp_inst = fp->private_data;
+	struct vas_window *txwin;
+
+	/* Should not happen */
+	if (!cp_inst || !cp_inst->txwin) {
+		pr_err("No attached VAS window for the paste address mmap\n");
+		return;
+	}
+
+	txwin = cp_inst->txwin;
+	/*
+	 * task_ref.vma is set in coproc_mmap() during mmap paste
+	 * address. So it has to be the same VMA that is getting freed.
+	 */
+	if (WARN_ON(txwin->task_ref.vma != vma)) {
+		pr_err("Invalid paste address mmaping\n");
+		return;
+	}
+
+	mutex_lock(&txwin->task_ref.mmap_mutex);
+	txwin->task_ref.vma = NULL;
+	mutex_unlock(&txwin->task_ref.mmap_mutex);
+}
+
 static const struct vm_operations_struct vas_vm_ops = {
+	.close = vas_mmap_close,
 	.fault = vas_mmap_fault,
 };
 
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/embedded6xx/linkstation.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/embedded6xx/linkstation.c
@@ -99,9 +99,6 @@
 	mpic_init(mpic);
 }
 
-extern void avr_uart_configure(void);
-extern void avr_uart_send(const char);
-
 static void __noreturn linkstation_restart(char *cmd)
 {
 	local_irq_disable();
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/embedded6xx/mpc10x.h
+++ linux-qcom-6.8.0/arch/powerpc/platforms/embedded6xx/mpc10x.h
@@ -156,4 +156,7 @@
 /* For MPC107 boards that use the built-in openpic */
 void mpc10x_set_openpic(void);
 
+void avr_uart_configure(void);
+void avr_uart_send(const char c);
+
 #endif	/* __PPC_KERNEL_MPC10X_H */
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/powermac/Kconfig
+++ linux-qcom-6.8.0/arch/powerpc/platforms/powermac/Kconfig
@@ -2,7 +2,7 @@
 config PPC_PMAC
 	bool "Apple PowerMac based machines"
 	depends on PPC_BOOK3S && CPU_BIG_ENDIAN
-	select ADB_CUDA if POWER_RESET && PPC32
+	select ADB_CUDA if POWER_RESET && ADB
 	select MPIC
 	select FORCE_PCI
 	select PPC_INDIRECT_PCI if PPC32
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/powernv/opal-irqchip.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/powernv/opal-irqchip.c
@@ -282,6 +282,7 @@
 				 name, NULL);
 		if (rc) {
 			pr_warn("Error %d requesting OPAL irq %d\n", rc, (int)r->start);
+			kfree(name);
 			continue;
 		}
 	}
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/ps3/Kconfig
+++ linux-qcom-6.8.0/arch/powerpc/platforms/ps3/Kconfig
@@ -67,6 +67,7 @@
 config PS3_PS3AV
 	depends on PPC_PS3
 	tristate "PS3 AV settings driver" if PS3_ADVANCED
+	select VIDEO
 	select PS3_VUART
 	default y
 	help
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/dlpar.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/dlpar.c
@@ -334,23 +334,6 @@
 {
 	int rc;
 
-	/* pseries error logs are in BE format, convert to cpu type */
-	switch (hp_elog->id_type) {
-	case PSERIES_HP_ELOG_ID_DRC_COUNT:
-		hp_elog->_drc_u.drc_count =
-				be32_to_cpu(hp_elog->_drc_u.drc_count);
-		break;
-	case PSERIES_HP_ELOG_ID_DRC_INDEX:
-		hp_elog->_drc_u.drc_index =
-				be32_to_cpu(hp_elog->_drc_u.drc_index);
-		break;
-	case PSERIES_HP_ELOG_ID_DRC_IC:
-		hp_elog->_drc_u.ic.count =
-				be32_to_cpu(hp_elog->_drc_u.ic.count);
-		hp_elog->_drc_u.ic.index =
-				be32_to_cpu(hp_elog->_drc_u.ic.index);
-	}
-
 	switch (hp_elog->resource) {
 	case PSERIES_HP_ELOG_RESOURCE_MEM:
 		rc = dlpar_memory(hp_elog);
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/dtl.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/dtl.c
@@ -191,7 +191,7 @@
 		return -EBUSY;
 
 	/* ensure there are no other conflicting dtl users */
-	if (!read_trylock(&dtl_access_lock))
+	if (!down_read_trylock(&dtl_access_lock))
 		return -EBUSY;
 
 	n_entries = dtl_buf_entries;
@@ -199,7 +199,7 @@
 	if (!buf) {
 		printk(KERN_WARNING "%s: buffer alloc failed for cpu %d\n",
 				__func__, dtl->cpu);
-		read_unlock(&dtl_access_lock);
+		up_read(&dtl_access_lock);
 		return -ENOMEM;
 	}
 
@@ -217,7 +217,7 @@
 	spin_unlock(&dtl->lock);
 
 	if (rc) {
-		read_unlock(&dtl_access_lock);
+		up_read(&dtl_access_lock);
 		kmem_cache_free(dtl_cache, buf);
 	}
 
@@ -232,7 +232,7 @@
 	dtl->buf = NULL;
 	dtl->buf_entries = 0;
 	spin_unlock(&dtl->lock);
-	read_unlock(&dtl_access_lock);
+	up_read(&dtl_access_lock);
 }
 
 /* file interface */
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -757,7 +757,7 @@
 	u32 drc_index;
 	int rc;
 
-	drc_index = hp_elog->_drc_u.drc_index;
+	drc_index = be32_to_cpu(hp_elog->_drc_u.drc_index);
 
 	lock_device_hotplug();
 
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -817,16 +817,16 @@
 	case PSERIES_HP_ELOG_ACTION_ADD:
 		switch (hp_elog->id_type) {
 		case PSERIES_HP_ELOG_ID_DRC_COUNT:
-			count = hp_elog->_drc_u.drc_count;
+			count = be32_to_cpu(hp_elog->_drc_u.drc_count);
 			rc = dlpar_memory_add_by_count(count);
 			break;
 		case PSERIES_HP_ELOG_ID_DRC_INDEX:
-			drc_index = hp_elog->_drc_u.drc_index;
+			drc_index = be32_to_cpu(hp_elog->_drc_u.drc_index);
 			rc = dlpar_memory_add_by_index(drc_index);
 			break;
 		case PSERIES_HP_ELOG_ID_DRC_IC:
-			count = hp_elog->_drc_u.ic.count;
-			drc_index = hp_elog->_drc_u.ic.index;
+			count = be32_to_cpu(hp_elog->_drc_u.ic.count);
+			drc_index = be32_to_cpu(hp_elog->_drc_u.ic.index);
 			rc = dlpar_memory_add_by_ic(count, drc_index);
 			break;
 		default:
@@ -838,16 +838,16 @@
 	case PSERIES_HP_ELOG_ACTION_REMOVE:
 		switch (hp_elog->id_type) {
 		case PSERIES_HP_ELOG_ID_DRC_COUNT:
-			count = hp_elog->_drc_u.drc_count;
+			count = be32_to_cpu(hp_elog->_drc_u.drc_count);
 			rc = dlpar_memory_remove_by_count(count);
 			break;
 		case PSERIES_HP_ELOG_ID_DRC_INDEX:
-			drc_index = hp_elog->_drc_u.drc_index;
+			drc_index = be32_to_cpu(hp_elog->_drc_u.drc_index);
 			rc = dlpar_memory_remove_by_index(drc_index);
 			break;
 		case PSERIES_HP_ELOG_ID_DRC_IC:
-			count = hp_elog->_drc_u.ic.count;
-			drc_index = hp_elog->_drc_u.ic.index;
+			count = be32_to_cpu(hp_elog->_drc_u.ic.count);
+			drc_index = be32_to_cpu(hp_elog->_drc_u.ic.index);
 			rc = dlpar_memory_remove_by_ic(count, drc_index);
 			break;
 		default:
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/iommu.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/iommu.c
@@ -786,8 +786,16 @@
 	 * parent bus. During reboot, there will be ibm,dma-window property to
 	 * define DMA window. For kdump, there will at least be default window or DDW
 	 * or both.
+	 * There is an exception to the above. In case the PE goes into frozen
+	 * state, firmware may not provide ibm,dma-window property at the time
+	 * of LPAR boot up.
 	 */
 
+	if (!pdn) {
+		pr_debug("  no ibm,dma-window property !\n");
+		return;
+	}
+
 	ppci = PCI_DN(pdn);
 
 	pr_debug("  parent is %pOF, iommu_table: 0x%p\n",
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/kexec.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/kexec.c
@@ -61,11 +61,3 @@
 	} else
 		xics_kexec_teardown_cpu(secondary);
 }
-
-void pseries_machine_kexec(struct kimage *image)
-{
-	if (firmware_has_feature(FW_FEATURE_SET_MODE))
-		pseries_disable_reloc_on_exc();
-
-	default_machine_kexec(image);
-}
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/lpar.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/lpar.c
@@ -169,7 +169,7 @@
  */
 #define NR_CPUS_H	NR_CPUS
 
-DEFINE_RWLOCK(dtl_access_lock);
+DECLARE_RWSEM(dtl_access_lock);
 static DEFINE_PER_CPU(struct vcpu_dispatch_data, vcpu_disp_data);
 static DEFINE_PER_CPU(u64, dtl_entry_ridx);
 static DEFINE_PER_CPU(struct dtl_worker, dtl_workers);
@@ -463,7 +463,7 @@
 {
 	int rc = 0, state;
 
-	if (!write_trylock(&dtl_access_lock)) {
+	if (!down_write_trylock(&dtl_access_lock)) {
 		rc = -EBUSY;
 		goto out;
 	}
@@ -479,7 +479,7 @@
 		pr_err("vcpudispatch_stats: unable to setup workqueue for DTL processing\n");
 		free_dtl_buffers(time_limit);
 		reset_global_dtl_mask();
-		write_unlock(&dtl_access_lock);
+		up_write(&dtl_access_lock);
 		rc = -EINVAL;
 		goto out;
 	}
@@ -494,7 +494,7 @@
 	cpuhp_remove_state(dtl_worker_state);
 	free_dtl_buffers(time_limit);
 	reset_global_dtl_mask();
-	write_unlock(&dtl_access_lock);
+	up_write(&dtl_access_lock);
 }
 
 static ssize_t vcpudispatch_stats_write(struct file *file, const char __user *p,
@@ -1886,10 +1886,10 @@
  * h_get_mpp
  * H_GET_MPP hcall returns info in 7 parms
  */
-int h_get_mpp(struct hvcall_mpp_data *mpp_data)
+long h_get_mpp(struct hvcall_mpp_data *mpp_data)
 {
-	int rc;
-	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE];
+	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
+	long rc;
 
 	rc = plpar_hcall9(H_GET_MPP, retbuf);
 
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/lparcfg.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/lparcfg.c
@@ -113,8 +113,8 @@
  */
 static unsigned int h_get_ppp(struct hvcall_ppp_data *ppp_data)
 {
-	unsigned long rc;
-	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE];
+	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
+	long rc;
 
 	rc = plpar_hcall9(H_GET_PPP, retbuf);
 
@@ -193,7 +193,7 @@
 	struct hvcall_ppp_data ppp_data;
 	struct device_node *root;
 	const __be32 *perf_level;
-	int rc;
+	long rc;
 
 	rc = h_get_ppp(&ppp_data);
 	if (rc)
@@ -357,8 +357,8 @@
 
 static void read_lpar_name(struct seq_file *m)
 {
-	if (read_rtas_lpar_name(m) && read_dt_lpar_name(m))
-		pr_err_once("Error can't get the LPAR name");
+	if (read_rtas_lpar_name(m))
+		read_dt_lpar_name(m);
 }
 
 #define SPLPAR_MAXLENGTH 1026*(sizeof(char))
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/papr_platform_attributes.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/papr_platform_attributes.c
@@ -101,10 +101,12 @@
 		esi_buf_size = ESI_HDR_SIZE + (CURR_MAX_ESI_ATTRS * max_esi_attrs);
 
 		temp_buf = krealloc(buf, esi_buf_size, GFP_KERNEL);
-		if (temp_buf)
+		if (temp_buf) {
 			buf = temp_buf;
-		else
-			return -ENOMEM;
+		} else {
+			ret = -ENOMEM;
+			goto out_buf;
+		}
 
 		goto retry;
 	}
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/plpks.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/plpks.c
@@ -415,8 +415,7 @@
 			break;
 		}
 
-		usleep_range(PLPKS_FLUSH_SLEEP,
-			     PLPKS_FLUSH_SLEEP + PLPKS_FLUSH_SLEEP_RANGE);
+		fsleep(PLPKS_FLUSH_SLEEP);
 		timeout = timeout + PLPKS_FLUSH_SLEEP;
 	} while (timeout < PLPKS_MAX_TIMEOUT);
 
@@ -464,9 +463,10 @@
 
 		continuetoken = retbuf[0];
 		if (pseries_status_to_err(rc) == -EBUSY) {
-			int delay_ms = get_longbusy_msecs(rc);
-			mdelay(delay_ms);
-			timeout += delay_ms;
+			int delay_us = get_longbusy_msecs(rc) * 1000;
+
+			fsleep(delay_us);
+			timeout += delay_us;
 		}
 		rc = pseries_status_to_err(rc);
 	} while (rc == -EBUSY && timeout < PLPKS_MAX_TIMEOUT);
@@ -683,7 +683,7 @@
 out:
 	fdt_nop_property(fdt, chosen_node, "ibm,plpks-pw");
 	// Since we've cleared the password, we must update the FDT checksum
-	early_init_dt_verify(fdt);
+	early_init_dt_verify(fdt, __pa(fdt));
 }
 
 static __init int pseries_plpks_init(void)
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/pmem.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/pmem.c
@@ -121,7 +121,7 @@
 		return -EINVAL;
 	}
 
-	drc_index = hp_elog->_drc_u.drc_index;
+	drc_index = be32_to_cpu(hp_elog->_drc_u.drc_index);
 
 	lock_device_hotplug();
 
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/pseries.h
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/pseries.h
@@ -38,7 +38,6 @@
 #endif
 
 extern void pseries_kexec_cpu_down(int crash_shutdown, int secondary);
-void pseries_machine_kexec(struct kimage *image);
 
 extern void pSeries_final_fixup(void);
 
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/setup.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/setup.c
@@ -343,8 +343,8 @@
 {
 	void (*ctor)(void *) = get_dtl_cache_ctor();
 
-	dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES,
-						DISPATCH_LOG_BYTES, 0, ctor);
+	dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES,
+						DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, ctor);
 	if (!dtl_cache) {
 		pr_warn("Failed to create dispatch trace log buffer cache\n");
 		pr_warn("Stolen time statistics will be unreliable\n");
@@ -1153,7 +1153,6 @@
 	.machine_check_exception = pSeries_machine_check_exception,
 	.machine_check_log_err	= pSeries_machine_check_log_err,
 #ifdef CONFIG_KEXEC_CORE
-	.machine_kexec          = pseries_machine_kexec,
 	.kexec_cpu_down         = pseries_kexec_cpu_down,
 #endif
 #ifdef CONFIG_MEMORY_HOTPLUG
--- linux-qcom-6.8.0.orig/arch/powerpc/platforms/pseries/vio.c
+++ linux-qcom-6.8.0/arch/powerpc/platforms/pseries/vio.c
@@ -39,7 +39,6 @@
 	.name = "vio",
 	.type = "",
 	.dev.init_name = "vio",
-	.dev.bus = &vio_bus_type,
 };
 
 #ifdef CONFIG_PPC_SMLPAR
--- linux-qcom-6.8.0.orig/arch/powerpc/sysdev/fsl_msi.c
+++ linux-qcom-6.8.0/arch/powerpc/sysdev/fsl_msi.c
@@ -566,10 +566,12 @@
 	.msiir_offset = 0x38,
 };
 
+#ifdef CONFIG_EPAPR_PARAVIRT
 static const struct fsl_msi_feature vmpic_msi_feature = {
 	.fsl_pic_ip = FSL_PIC_IP_VMPIC,
 	.msiir_offset = 0,
 };
+#endif
 
 static const struct of_device_id fsl_of_msi_ids[] = {
 	{
--- linux-qcom-6.8.0.orig/arch/powerpc/xmon/ppc-dis.c
+++ linux-qcom-6.8.0/arch/powerpc/xmon/ppc-dis.c
@@ -122,32 +122,21 @@
   bool insn_is_short;
   ppc_cpu_t dialect;
 
-  dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON
-            | PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_ALTIVEC;
+  dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON;
 
-  if (cpu_has_feature(CPU_FTRS_POWER5))
-    dialect |= PPC_OPCODE_POWER5;
+  if (IS_ENABLED(CONFIG_PPC64))
+    dialect |= PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_CELL |
+	PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 | PPC_OPCODE_POWER8 |
+	PPC_OPCODE_POWER9;
 
-  if (cpu_has_feature(CPU_FTRS_CELL))
-    dialect |= (PPC_OPCODE_CELL | PPC_OPCODE_ALTIVEC);
+  if (cpu_has_feature(CPU_FTR_TM))
+    dialect |= PPC_OPCODE_HTM;
 
-  if (cpu_has_feature(CPU_FTRS_POWER6))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_ALTIVEC);
-
-  if (cpu_has_feature(CPU_FTRS_POWER7))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
-                | PPC_OPCODE_ALTIVEC | PPC_OPCODE_VSX);
-
-  if (cpu_has_feature(CPU_FTRS_POWER8))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
-		| PPC_OPCODE_POWER8 | PPC_OPCODE_HTM
-		| PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 | PPC_OPCODE_VSX);
-
-  if (cpu_has_feature(CPU_FTRS_POWER9))
-    dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
-		| PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM
-		| PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2
-		| PPC_OPCODE_VSX | PPC_OPCODE_VSX3);
+  if (cpu_has_feature(CPU_FTR_ALTIVEC))
+    dialect |= PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2;
+
+  if (cpu_has_feature(CPU_FTR_VSX))
+    dialect |= PPC_OPCODE_VSX | PPC_OPCODE_VSX3;
 
   /* Get the major opcode of the insn.  */
   opcode = NULL;
--- linux-qcom-6.8.0.orig/arch/powerpc/xmon/xmon.c
+++ linux-qcom-6.8.0/arch/powerpc/xmon/xmon.c
@@ -1352,7 +1352,7 @@
 	}
 	termch = cpu;
 
-	if (!scanhex(&cpu)) {
+	if (!scanhex(&cpu) || cpu >= num_possible_cpus()) {
 		/* print cpus waiting or in xmon */
 		printf("cpus stopped:");
 		last_cpu = first_cpu = NR_CPUS;
@@ -2774,7 +2774,7 @@
 
 	termch = c;	/* Put c back, it wasn't 'a' */
 
-	if (scanhex(&num))
+	if (scanhex(&num) && num < num_possible_cpus())
 		dump_one_paca(num);
 	else
 		dump_one_paca(xmon_owner);
@@ -2847,7 +2847,7 @@
 
 	termch = c;	/* Put c back, it wasn't 'a' */
 
-	if (scanhex(&num))
+	if (scanhex(&num) && num < num_possible_cpus())
 		dump_one_xive(num);
 	else
 		dump_one_xive(xmon_owner);
--- linux-qcom-6.8.0.orig/arch/riscv/Kconfig
+++ linux-qcom-6.8.0/arch/riscv/Kconfig
@@ -27,6 +27,7 @@
 	select ARCH_HAS_GCOV_PROFILE_ALL
 	select ARCH_HAS_GIGANTIC_PAGE
 	select ARCH_HAS_KCOV
+	select ARCH_HAS_MEMBARRIER_CALLBACKS
 	select ARCH_HAS_MMIOWB
 	select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
 	select ARCH_HAS_PMEM_API
@@ -37,7 +38,7 @@
 	select ARCH_HAS_STRICT_MODULE_RWX if MMU && !XIP_KERNEL
 	select ARCH_HAS_SYSCALL_WRAPPER
 	select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
-	select ARCH_HAS_UBSAN_SANITIZE_ALL
+	select ARCH_HAS_UBSAN
 	select ARCH_HAS_VDSO_DATA
 	select ARCH_KEEP_MEMBLOCK if ACPI
 	select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX
@@ -96,7 +97,7 @@
 	select HAS_IOPORT if MMU
 	select HAVE_ARCH_AUDITSYSCALL
 	select HAVE_ARCH_HUGE_VMALLOC if HAVE_ARCH_HUGE_VMAP
-	select HAVE_ARCH_HUGE_VMAP if MMU && 64BIT && !XIP_KERNEL
+	select HAVE_ARCH_HUGE_VMAP if MMU && 64BIT
 	select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL
 	select HAVE_ARCH_JUMP_LABEL_RELATIVE if !XIP_KERNEL
 	select HAVE_ARCH_KASAN if MMU && 64BIT
@@ -286,6 +287,11 @@
 config FIX_EARLYCON_MEM
 	def_bool MMU
 
+config ILLEGAL_POINTER_VALUE
+	hex
+	default 0 if 32BIT
+	default 0xdead000000000000 if 64BIT
+
 config PGTABLE_LEVELS
 	int
 	default 5 if 64BIT
@@ -519,8 +525,8 @@
 config TOOLCHAIN_HAS_V
 	bool
 	default y
-	depends on !64BIT || $(cc-option,-mabi=lp64 -march=rv64iv)
-	depends on !32BIT || $(cc-option,-mabi=ilp32 -march=rv32iv)
+	depends on !64BIT || $(cc-option,-mabi=lp64 -march=rv64imv)
+	depends on !32BIT || $(cc-option,-mabi=ilp32 -march=rv32imv)
 	depends on LLD_VERSION >= 140000 || LD_VERSION >= 23800
 	depends on AS_HAS_OPTION_ARCH
 
@@ -679,8 +685,7 @@
 config THREAD_SIZE_ORDER
 	int "Kernel stack size (in power-of-two numbers of page size)" if VMAP_STACK && EXPERT
 	range 0 4
-	default 1 if 32BIT && !KASAN
-	default 3 if 64BIT && KASAN
+	default 1 if 32BIT
 	default 2
 	help
 	  Specify the Pages of thread stack size (from 4KB to 64KB), which also
--- linux-qcom-6.8.0.orig/arch/riscv/Kconfig.errata
+++ linux-qcom-6.8.0/arch/riscv/Kconfig.errata
@@ -82,14 +82,14 @@
 
 	  Otherwise, please say "N" here to avoid unnecessary overhead.
 
-config ERRATA_THEAD_PBMT
-	bool "Apply T-Head memory type errata"
+config ERRATA_THEAD_MAE
+	bool "Apply T-Head's memory attribute extension (XTheadMae) errata"
 	depends on ERRATA_THEAD && 64BIT && MMU
 	select RISCV_ALTERNATIVE_EARLY
 	default y
 	help
-	  This will apply the memory type errata to handle the non-standard
-	  memory type bits in page-table-entries on T-Head SoCs.
+	  This will apply the memory attribute extension errata to handle the
+	  non-standard PTE utilization on T-Head SoCs (XTheadMae).
 
 	  If you don't know what to do here, say "Y".
 
--- linux-qcom-6.8.0.orig/arch/riscv/boot/dts/microchip/mpfs-icicle-kit.dts
+++ linux-qcom-6.8.0/arch/riscv/boot/dts/microchip/mpfs-icicle-kit.dts
@@ -160,9 +160,11 @@
 	status = "okay";
 };
 
+/* UBUNTU: PCIe support is not yet ready, so disable it for now
 &pcie {
 	status = "okay";
 };
+*/
 
 &qspi {
 	status = "okay";
--- linux-qcom-6.8.0.orig/arch/riscv/boot/dts/sifive/fu740-c000.dtsi
+++ linux-qcom-6.8.0/arch/riscv/boot/dts/sifive/fu740-c000.dtsi
@@ -42,7 +42,7 @@
 			};
 		};
 		cpu1: cpu@1 {
-			compatible = "sifive,bullet0", "riscv";
+			compatible = "sifive,u74-mc", "sifive,bullet0", "riscv";
 			d-cache-block-size = <64>;
 			d-cache-sets = <64>;
 			d-cache-size = <32768>;
@@ -69,7 +69,7 @@
 			};
 		};
 		cpu2: cpu@2 {
-			compatible = "sifive,bullet0", "riscv";
+			compatible = "sifive,u74-mc", "sifive,bullet0", "riscv";
 			d-cache-block-size = <64>;
 			d-cache-sets = <64>;
 			d-cache-size = <32768>;
@@ -96,7 +96,7 @@
 			};
 		};
 		cpu3: cpu@3 {
-			compatible = "sifive,bullet0", "riscv";
+			compatible = "sifive,u74-mc", "sifive,bullet0", "riscv";
 			d-cache-block-size = <64>;
 			d-cache-sets = <64>;
 			d-cache-size = <32768>;
@@ -123,7 +123,7 @@
 			};
 		};
 		cpu4: cpu@4 {
-			compatible = "sifive,bullet0", "riscv";
+			compatible = "sifive,u74-mc", "sifive,bullet0", "riscv";
 			d-cache-block-size = <64>;
 			d-cache-sets = <64>;
 			d-cache-size = <32768>;
--- linux-qcom-6.8.0.orig/arch/riscv/boot/dts/sifive/hifive-unleashed-a00-microsemi.dts
+++ linux-qcom-6.8.0/arch/riscv/boot/dts/sifive/hifive-unleashed-a00-microsemi.dts
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+#include "hifive-unleashed-a00.dts"
+
+/ {
+	soc {
+		pcie: pcie@2030000000 {
+			#address-cells = <0x3>;
+			#interrupt-cells = <0x1>;
+			#size-cells = <0x2>;
+			compatible = "microsemi,ms-pf-axi-pcie-host";
+			device_type = "pci";
+			bus-range = <0x01 0x7f>;
+			interrupt-map = <0 0 0 1 &ms_pcie_intc 0 0 0 0 2 &ms_pcie_intc 1 0 0 0 3 &ms_pcie_intc 2 0 0 0 4 &ms_pcie_intc 3>;
+			interrupt-map-mask = <0 0 0 7>;
+			interrupt-parent = <&plic0>;
+			interrupts = <32>;
+			ranges = <0x3000000 0x0 0x40000000 0x0 0x40000000 0x0 0x20000000>;
+			reg = <0x20 0x30000000 0x0 0x4000000 0x20 0x0 0x0 0x100000>;
+			reg-names = "control", "apb";
+			ms_pcie_intc: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/arch/riscv/boot/dts/starfive/jh7100.dtsi
+++ linux-qcom-6.8.0/arch/riscv/boot/dts/starfive/jh7100.dtsi
@@ -116,6 +116,7 @@
 	osc_sys: osc-sys {
 		compatible = "fixed-clock";
 		#clock-cells = <0>;
+		clock-output-names = "osc_sys";
 		/* This value must be overridden by the board */
 		clock-frequency = <0>;
 	};
@@ -123,6 +124,7 @@
 	osc_aud: osc-aud {
 		compatible = "fixed-clock";
 		#clock-cells = <0>;
+		clock-output-names = "osc_aud";
 		/* This value must be overridden by the board */
 		clock-frequency = <0>;
 	};
@@ -130,6 +132,7 @@
 	gmac_rmii_ref: gmac-rmii-ref {
 		compatible = "fixed-clock";
 		#clock-cells = <0>;
+		clock-output-names = "gmac_rmii_ref";
 		/* Should be overridden by the board when needed */
 		clock-frequency = <0>;
 	};
@@ -137,6 +140,7 @@
 	gmac_gr_mii_rxclk: gmac-gr-mii-rxclk {
 		compatible = "fixed-clock";
 		#clock-cells = <0>;
+		clock-output-names = "gmac_gr_mii_rxclk";
 		/* Should be overridden by the board when needed */
 		clock-frequency = <0>;
 	};
--- linux-qcom-6.8.0.orig/arch/riscv/boot/dts/starfive/jh7110-starfive-visionfive-2.dtsi
+++ linux-qcom-6.8.0/arch/riscv/boot/dts/starfive/jh7110-starfive-visionfive-2.dtsi
@@ -189,7 +189,6 @@
 	axp15060: pmic@36 {
 		compatible = "x-powers,axp15060";
 		reg = <0x36>;
-		interrupts = <0>;
 		interrupt-controller;
 		#interrupt-cells = <1>;
 
@@ -230,24 +229,6 @@
 	status = "okay";
 };
 
-&i2srx {
-	pinctrl-names = "default";
-	pinctrl-0 = <&i2srx_pins>;
-	status = "okay";
-};
-
-&i2stx0 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&mclk_ext_pins>;
-	status = "okay";
-};
-
-&i2stx1 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&i2stx1_pins>;
-	status = "okay";
-};
-
 &mmc0 {
 	max-frequency = <100000000>;
 	assigned-clocks = <&syscrg JH7110_SYSCLK_SDIO0_SDCARD>;
@@ -335,6 +316,12 @@
 	};
 };
 
+&syscrg {
+	assigned-clocks = <&syscrg JH7110_SYSCLK_CPU_CORE>,
+			  <&pllclk JH7110_PLLCLK_PLL0_OUT>;
+	assigned-clock-rates = <500000000>, <1500000000>;
+};
+
 &sysgpio {
 	i2c0_pins: i2c0-0 {
 		i2c-pins {
@@ -392,46 +379,6 @@
 		};
 	};
 
-	i2srx_pins: i2srx-0 {
-		clk-sd-pins {
-			pinmux = <GPIOMUX(38, GPOUT_LOW,
-					      GPOEN_DISABLE,
-					      GPI_SYS_I2SRX_BCLK)>,
-				 <GPIOMUX(63, GPOUT_LOW,
-					      GPOEN_DISABLE,
-					      GPI_SYS_I2SRX_LRCK)>,
-				 <GPIOMUX(38, GPOUT_LOW,
-					      GPOEN_DISABLE,
-					      GPI_SYS_I2STX1_BCLK)>,
-				 <GPIOMUX(63, GPOUT_LOW,
-					      GPOEN_DISABLE,
-					      GPI_SYS_I2STX1_LRCK)>,
-				 <GPIOMUX(61, GPOUT_LOW,
-					      GPOEN_DISABLE,
-					      GPI_SYS_I2SRX_SDIN0)>;
-			input-enable;
-		};
-	};
-
-	i2stx1_pins: i2stx1-0 {
-		sd-pins {
-			pinmux = <GPIOMUX(44, GPOUT_SYS_I2STX1_SDO0,
-					      GPOEN_ENABLE,
-					      GPI_NONE)>;
-			bias-disable;
-			input-disable;
-		};
-	};
-
-	mclk_ext_pins: mclk-ext-0 {
-		mclk-ext-pins {
-			pinmux = <GPIOMUX(4, GPOUT_LOW,
-					     GPOEN_DISABLE,
-					     GPI_SYS_MCLK_EXT)>;
-			input-enable;
-		};
-	};
-
 	mmc0_pins: mmc0-0 {
 		 rst-pins {
 			pinmux = <GPIOMUX(62, GPOUT_SYS_SDIO0_RST,
@@ -551,40 +498,6 @@
 		};
 	};
 
-	tdm_pins: tdm-0 {
-		tx-pins {
-			pinmux = <GPIOMUX(44, GPOUT_SYS_TDM_TXD,
-					      GPOEN_ENABLE,
-					      GPI_NONE)>;
-			bias-pull-up;
-			drive-strength = <2>;
-			input-disable;
-			input-schmitt-disable;
-			slew-rate = <0>;
-		};
-
-		rx-pins {
-			pinmux = <GPIOMUX(61, GPOUT_HIGH,
-					      GPOEN_DISABLE,
-					      GPI_SYS_TDM_RXD)>;
-			input-enable;
-		};
-
-		sync-pins {
-			pinmux = <GPIOMUX(63, GPOUT_HIGH,
-					      GPOEN_DISABLE,
-					      GPI_SYS_TDM_SYNC)>;
-			input-enable;
-		};
-
-		pcmclk-pins {
-			pinmux = <GPIOMUX(38, GPOUT_HIGH,
-					      GPOEN_DISABLE,
-					      GPI_SYS_TDM_CLK)>;
-			input-enable;
-		};
-	};
-
 	uart0_pins: uart0-0 {
 		tx-pins {
 			pinmux = <GPIOMUX(5, GPOUT_SYS_UART0_TX,
@@ -610,12 +523,6 @@
 	};
 };
 
-&tdm {
-	pinctrl-names = "default";
-	pinctrl-0 = <&tdm_pins>;
-	status = "okay";
-};
-
 &uart0 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&uart0_pins>;
--- linux-qcom-6.8.0.orig/arch/riscv/errata/thead/errata.c
+++ linux-qcom-6.8.0/arch/riscv/errata/thead/errata.c
@@ -19,20 +19,26 @@
 #include <asm/patch.h>
 #include <asm/vendorid_list.h>
 
-static bool errata_probe_pbmt(unsigned int stage,
-			      unsigned long arch_id, unsigned long impid)
+#define CSR_TH_SXSTATUS		0x5c0
+#define SXSTATUS_MAEE		_AC(0x200000, UL)
+
+static bool errata_probe_mae(unsigned int stage,
+			     unsigned long arch_id, unsigned long impid)
 {
-	if (!IS_ENABLED(CONFIG_ERRATA_THEAD_PBMT))
+	if (!IS_ENABLED(CONFIG_ERRATA_THEAD_MAE))
 		return false;
 
 	if (arch_id != 0 || impid != 0)
 		return false;
 
-	if (stage == RISCV_ALTERNATIVES_EARLY_BOOT ||
-	    stage == RISCV_ALTERNATIVES_MODULE)
-		return true;
+	if (stage != RISCV_ALTERNATIVES_EARLY_BOOT &&
+	    stage != RISCV_ALTERNATIVES_MODULE)
+		return false;
+
+	if (!(csr_read(CSR_TH_SXSTATUS) & SXSTATUS_MAEE))
+		return false;
 
-	return false;
+	return true;
 }
 
 /*
@@ -140,8 +146,8 @@
 {
 	u32 cpu_req_errata = 0;
 
-	if (errata_probe_pbmt(stage, archid, impid))
-		cpu_req_errata |= BIT(ERRATA_THEAD_PBMT);
+	if (errata_probe_mae(stage, archid, impid))
+		cpu_req_errata |= BIT(ERRATA_THEAD_MAE);
 
 	errata_probe_cmo(stage, archid, impid);
 
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/asm.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/asm.h
@@ -183,6 +183,16 @@
 	REG_L x31, PT_T6(sp)
 	.endm
 
+/* Annotate a function as being unsuitable for kprobes. */
+#ifdef CONFIG_KPROBES
+#define ASM_NOKPROBE(name)				\
+	.pushsection "_kprobe_blacklist", "aw";		\
+	RISCV_PTR name;					\
+	.popsection
+#else
+#define ASM_NOKPROBE(name)
+#endif
+
 #endif /* __ASSEMBLY__ */
 
 #endif /* _ASM_RISCV_ASM_H */
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/cacheflush.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/cacheflush.h
@@ -13,6 +13,12 @@
 	asm volatile ("fence.i" ::: "memory");
 }
 
+static inline void local_flush_icache_range(unsigned long start,
+					    unsigned long end)
+{
+	local_flush_icache_all();
+}
+
 #define PG_dcache_clean PG_arch_1
 
 static inline void flush_dcache_folio(struct folio *folio)
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/errata_list.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/errata_list.h
@@ -23,7 +23,7 @@
 #endif
 
 #ifdef CONFIG_ERRATA_THEAD
-#define	ERRATA_THEAD_PBMT 0
+#define	ERRATA_THEAD_MAE 0
 #define	ERRATA_THEAD_PMU 1
 #define	ERRATA_THEAD_NUMBER 2
 #endif
@@ -43,30 +43,40 @@
 	    CONFIG_ERRATA_SIFIVE_CIP_453)
 #else /* !__ASSEMBLY__ */
 
-#define ALT_FLUSH_TLB_PAGE(x)						\
+#define ALT_SFENCE_VMA_ASID(asid)					\
+asm(ALTERNATIVE("sfence.vma x0, %0", "sfence.vma", SIFIVE_VENDOR_ID,	\
+		ERRATA_SIFIVE_CIP_1200, CONFIG_ERRATA_SIFIVE_CIP_1200)	\
+		: : "r" (asid) : "memory")
+
+#define ALT_SFENCE_VMA_ADDR(addr)					\
 asm(ALTERNATIVE("sfence.vma %0", "sfence.vma", SIFIVE_VENDOR_ID,	\
 		ERRATA_SIFIVE_CIP_1200, CONFIG_ERRATA_SIFIVE_CIP_1200)	\
 		: : "r" (addr) : "memory")
 
+#define ALT_SFENCE_VMA_ADDR_ASID(addr, asid)				\
+asm(ALTERNATIVE("sfence.vma %0, %1", "sfence.vma", SIFIVE_VENDOR_ID,	\
+		ERRATA_SIFIVE_CIP_1200, CONFIG_ERRATA_SIFIVE_CIP_1200)	\
+		: : "r" (addr), "r" (asid) : "memory")
+
 /*
  * _val is marked as "will be overwritten", so need to set it to 0
  * in the default case.
  */
 #define ALT_SVPBMT_SHIFT 61
-#define ALT_THEAD_PBMT_SHIFT 59
+#define ALT_THEAD_MAE_SHIFT 59
 #define ALT_SVPBMT(_val, prot)						\
 asm(ALTERNATIVE_2("li %0, 0\t\nnop",					\
 		  "li %0, %1\t\nslli %0,%0,%3", 0,			\
 			RISCV_ISA_EXT_SVPBMT, CONFIG_RISCV_ISA_SVPBMT,	\
 		  "li %0, %2\t\nslli %0,%0,%4", THEAD_VENDOR_ID,	\
-			ERRATA_THEAD_PBMT, CONFIG_ERRATA_THEAD_PBMT)	\
+			ERRATA_THEAD_MAE, CONFIG_ERRATA_THEAD_MAE)	\
 		: "=r"(_val)						\
 		: "I"(prot##_SVPBMT >> ALT_SVPBMT_SHIFT),		\
-		  "I"(prot##_THEAD >> ALT_THEAD_PBMT_SHIFT),		\
+		  "I"(prot##_THEAD >> ALT_THEAD_MAE_SHIFT),		\
 		  "I"(ALT_SVPBMT_SHIFT),				\
-		  "I"(ALT_THEAD_PBMT_SHIFT))
+		  "I"(ALT_THEAD_MAE_SHIFT))
 
-#ifdef CONFIG_ERRATA_THEAD_PBMT
+#ifdef CONFIG_ERRATA_THEAD_MAE
 /*
  * IO/NOCACHE memory types are handled together with svpbmt,
  * so on T-Head chips, check if no other memory type is set,
@@ -83,11 +93,11 @@
 	"slli    t3, t3, %3\n\t"					\
 	"or      %0, %0, t3\n\t"					\
 	"2:",  THEAD_VENDOR_ID,						\
-		ERRATA_THEAD_PBMT, CONFIG_ERRATA_THEAD_PBMT)		\
+		ERRATA_THEAD_MAE, CONFIG_ERRATA_THEAD_MAE)		\
 	: "+r"(_val)							\
-	: "I"(_PAGE_MTMASK_THEAD >> ALT_THEAD_PBMT_SHIFT),		\
-	  "I"(_PAGE_PMA_THEAD >> ALT_THEAD_PBMT_SHIFT),			\
-	  "I"(ALT_THEAD_PBMT_SHIFT)					\
+	: "I"(_PAGE_MTMASK_THEAD >> ALT_THEAD_MAE_SHIFT),		\
+	  "I"(_PAGE_PMA_THEAD >> ALT_THEAD_MAE_SHIFT),			\
+	  "I"(ALT_THEAD_MAE_SHIFT)					\
 	: "t3")
 #else
 #define ALT_THEAD_PMA(_val)
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/insn.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/insn.h
@@ -145,7 +145,7 @@
 
 /* parts of opcode for RVF, RVD and RVQ */
 #define RVFDQ_FL_FS_WIDTH_OFF	12
-#define RVFDQ_FL_FS_WIDTH_MASK	GENMASK(3, 0)
+#define RVFDQ_FL_FS_WIDTH_MASK	GENMASK(2, 0)
 #define RVFDQ_FL_FS_WIDTH_W	2
 #define RVFDQ_FL_FS_WIDTH_D	3
 #define RVFDQ_LS_FS_WIDTH_Q	4
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/kfence.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/kfence.h
@@ -22,7 +22,9 @@
 	else
 		set_pte(pte, __pte(pte_val(ptep_get(pte)) | _PAGE_PRESENT));
 
-	flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
+	preempt_disable();
+	local_flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
+	preempt_enable();
 
 	return true;
 }
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/kvm_vcpu_pmu.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/kvm_vcpu_pmu.h
@@ -10,6 +10,7 @@
 #define __KVM_VCPU_RISCV_PMU_H
 
 #include <linux/perf/riscv_pmu.h>
+#include <asm/kvm_vcpu_insn.h>
 #include <asm/sbi.h>
 
 #ifdef CONFIG_RISCV_PMU_SBI
@@ -57,11 +58,11 @@
 
 #if defined(CONFIG_32BIT)
 #define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \
-{.base = CSR_CYCLEH,	.count = 31,	.func = kvm_riscv_vcpu_pmu_read_hpm }, \
-{.base = CSR_CYCLE,	.count = 31,	.func = kvm_riscv_vcpu_pmu_read_hpm },
+{.base = CSR_CYCLEH,	.count = 32,	.func = kvm_riscv_vcpu_pmu_read_hpm }, \
+{.base = CSR_CYCLE,	.count = 32,	.func = kvm_riscv_vcpu_pmu_read_hpm },
 #else
 #define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \
-{.base = CSR_CYCLE,	.count = 31,	.func = kvm_riscv_vcpu_pmu_read_hpm },
+{.base = CSR_CYCLE,	.count = 32,	.func = kvm_riscv_vcpu_pmu_read_hpm },
 #endif
 
 int kvm_riscv_vcpu_pmu_incr_fw(struct kvm_vcpu *vcpu, unsigned long fid);
@@ -92,8 +93,20 @@
 struct kvm_pmu {
 };
 
+static inline int kvm_riscv_vcpu_pmu_read_legacy(struct kvm_vcpu *vcpu, unsigned int csr_num,
+						 unsigned long *val, unsigned long new_val,
+						 unsigned long wr_mask)
+{
+	if (csr_num == CSR_CYCLE || csr_num == CSR_INSTRET) {
+		*val = 0;
+		return KVM_INSN_CONTINUE_NEXT_SEPC;
+	} else {
+		return KVM_INSN_ILLEGAL_TRAP;
+	}
+}
+
 #define KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS \
-{.base = 0,	.count = 0,	.func = NULL },
+{.base = CSR_CYCLE,	.count = 3,	.func = kvm_riscv_vcpu_pmu_read_legacy },
 
 static inline void kvm_riscv_vcpu_pmu_init(struct kvm_vcpu *vcpu) {}
 static inline int kvm_riscv_vcpu_pmu_incr_fw(struct kvm_vcpu *vcpu, unsigned long fid)
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/membarrier.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/membarrier.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef _ASM_RISCV_MEMBARRIER_H
+#define _ASM_RISCV_MEMBARRIER_H
+
+static inline void membarrier_arch_switch_mm(struct mm_struct *prev,
+					     struct mm_struct *next,
+					     struct task_struct *tsk)
+{
+	/*
+	 * Only need the full barrier when switching between processes.
+	 * Barrier when switching from kernel to userspace is not
+	 * required here, given that it is implied by mmdrop(). Barrier
+	 * when switching from userspace to kernel is not needed after
+	 * store to rq->curr.
+	 */
+	if (IS_ENABLED(CONFIG_SMP) &&
+	    likely(!(atomic_read(&next->membarrier_state) &
+		     (MEMBARRIER_STATE_PRIVATE_EXPEDITED |
+		      MEMBARRIER_STATE_GLOBAL_EXPEDITED)) || !prev))
+		return;
+
+	/*
+	 * The membarrier system call requires a full memory barrier
+	 * after storing to rq->curr, before going back to user-space.
+	 * Matches a full barrier in the proximity of the membarrier
+	 * system call entry.
+	 */
+	smp_mb();
+}
+
+#endif /* _ASM_RISCV_MEMBARRIER_H */
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/page.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/page.h
@@ -89,7 +89,7 @@
 #define PTE_FMT "%08lx"
 #endif
 
-#ifdef CONFIG_64BIT
+#if defined(CONFIG_64BIT) && defined(CONFIG_MMU)
 /*
  * We override this value as its generic definition uses __pa too early in
  * the boot process (before kernel_map.va_pa_offset is set).
@@ -122,6 +122,7 @@
 
 extern struct kernel_mapping kernel_map;
 extern phys_addr_t phys_ram_base;
+extern unsigned long vmemmap_start_pfn;
 
 #define is_kernel_mapping(x)	\
 	((x) >= kernel_map.virt_addr && (x) < (kernel_map.virt_addr + kernel_map.size))
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/patch.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/patch.h
@@ -6,6 +6,7 @@
 #ifndef _ASM_RISCV_PATCH_H
 #define _ASM_RISCV_PATCH_H
 
+int patch_insn_write(void *addr, const void *insn, size_t len);
 int patch_text_nosync(void *addr, const void *insns, size_t len);
 int patch_text_set_nosync(void *addr, u8 c, size_t len);
 int patch_text(void *addr, u32 *insns, int ninsns);
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/pgtable.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/pgtable.h
@@ -84,7 +84,7 @@
  * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel
  * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled.
  */
-#define vmemmap		((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT))
+#define vmemmap		((struct page *)VMEMMAP_START - vmemmap_start_pfn)
 
 #define PCI_IO_SIZE      SZ_16M
 #define PCI_IO_END       VMEMMAP_START
@@ -439,9 +439,11 @@
 	return pte;
 }
 
+#ifdef CONFIG_RISCV_ISA_SVNAPOT
 #define pte_leaf_size(pte)	(pte_napot(pte) ?				\
 					napot_cont_size(napot_cont_order(pte)) :\
 					PAGE_SIZE)
+#endif
 
 #ifdef CONFIG_NUMA_BALANCING
 /*
@@ -886,7 +888,7 @@
 #define PAGE_SHARED		__pgprot(0)
 #define PAGE_KERNEL		__pgprot(0)
 #define swapper_pg_dir		NULL
-#define TASK_SIZE		0xffffffffUL
+#define TASK_SIZE		_AC(-1, UL)
 #define VMALLOC_START		_AC(0, UL)
 #define VMALLOC_END		TASK_SIZE
 
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/sbi.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/sbi.h
@@ -9,6 +9,7 @@
 
 #include <linux/types.h>
 #include <linux/cpumask.h>
+#include <linux/jump_label.h>
 
 #ifdef CONFIG_RISCV_SBI
 enum sbi_ext_id {
@@ -292,10 +293,13 @@
 };
 
 void sbi_init(void);
-struct sbiret sbi_ecall(int ext, int fid, unsigned long arg0,
-			unsigned long arg1, unsigned long arg2,
-			unsigned long arg3, unsigned long arg4,
-			unsigned long arg5);
+long __sbi_base_ecall(int fid);
+struct sbiret __sbi_ecall(unsigned long arg0, unsigned long arg1,
+			  unsigned long arg2, unsigned long arg3,
+			  unsigned long arg4, unsigned long arg5,
+			  int fid, int ext);
+#define sbi_ecall(e, f, a0, a1, a2, a3, a4, a5)	\
+		__sbi_ecall(a0, a1, a2, a3, a4, a5, f, e)
 
 #ifdef CONFIG_RISCV_SBI_V01
 void sbi_console_putchar(int ch);
@@ -359,7 +363,23 @@
 		SBI_SPEC_VERSION_MAJOR_SHIFT) | minor;
 }
 
-int sbi_err_map_linux_errno(int err);
+static inline int sbi_err_map_linux_errno(int err)
+{
+	switch (err) {
+	case SBI_SUCCESS:
+		return 0;
+	case SBI_ERR_DENIED:
+		return -EPERM;
+	case SBI_ERR_INVALID_PARAM:
+		return -EINVAL;
+	case SBI_ERR_INVALID_ADDRESS:
+		return -EFAULT;
+	case SBI_ERR_NOT_SUPPORTED:
+	case SBI_ERR_FAILURE:
+	default:
+		return -ENOTSUPP;
+	};
+}
 
 extern bool sbi_debug_console_available;
 int sbi_debug_console_write(const char *bytes, unsigned int num_bytes);
@@ -370,6 +390,8 @@
 static inline void sbi_init(void) {}
 #endif /* CONFIG_RISCV_SBI */
 
+unsigned long riscv_get_mvendorid(void);
+unsigned long riscv_get_marchid(void);
 unsigned long riscv_cached_mvendorid(unsigned int cpu_id);
 unsigned long riscv_cached_marchid(unsigned int cpu_id);
 unsigned long riscv_cached_mimpid(unsigned int cpu_id);
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/sparsemem.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/sparsemem.h
@@ -7,7 +7,7 @@
 #ifdef CONFIG_64BIT
 #define MAX_PHYSMEM_BITS	56
 #else
-#define MAX_PHYSMEM_BITS	34
+#define MAX_PHYSMEM_BITS	32
 #endif /* CONFIG_64BIT */
 #define SECTION_SIZE_BITS	27
 #endif /* CONFIG_SPARSEMEM */
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/string.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/string.h
@@ -19,6 +19,7 @@
 extern asmlinkage void *memmove(void *, const void *, size_t);
 extern asmlinkage void *__memmove(void *, const void *, size_t);
 
+#if !(defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS))
 #define __HAVE_ARCH_STRCMP
 extern asmlinkage int strcmp(const char *cs, const char *ct);
 
@@ -27,6 +28,7 @@
 
 #define __HAVE_ARCH_STRNCMP
 extern asmlinkage int strncmp(const char *cs, const char *ct, size_t count);
+#endif
 
 /* For those files which don't want to check by kasan. */
 #if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__)
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/thread_info.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/thread_info.h
@@ -12,7 +12,12 @@
 #include <linux/const.h>
 
 /* thread information allocation */
-#define THREAD_SIZE_ORDER	CONFIG_THREAD_SIZE_ORDER
+#ifdef CONFIG_KASAN
+#define KASAN_STACK_ORDER	1
+#else
+#define KASAN_STACK_ORDER	0
+#endif
+#define THREAD_SIZE_ORDER	(CONFIG_THREAD_SIZE_ORDER + KASAN_STACK_ORDER)
 #define THREAD_SIZE		(PAGE_SIZE << THREAD_SIZE_ORDER)
 
 /*
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/tlbflush.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/tlbflush.h
@@ -22,10 +22,27 @@
 	__asm__ __volatile__ ("sfence.vma" : : : "memory");
 }
 
+static inline void local_flush_tlb_all_asid(unsigned long asid)
+{
+	if (asid != FLUSH_TLB_NO_ASID)
+		ALT_SFENCE_VMA_ASID(asid);
+	else
+		local_flush_tlb_all();
+}
+
 /* Flush one page from local TLB */
 static inline void local_flush_tlb_page(unsigned long addr)
 {
-	ALT_FLUSH_TLB_PAGE(__asm__ __volatile__ ("sfence.vma %0" : : "r" (addr) : "memory"));
+	ALT_SFENCE_VMA_ADDR(addr);
+}
+
+static inline void local_flush_tlb_page_asid(unsigned long addr,
+					     unsigned long asid)
+{
+	if (asid != FLUSH_TLB_NO_ASID)
+		ALT_SFENCE_VMA_ADDR_ASID(addr, asid);
+	else
+		local_flush_tlb_page(addr);
 }
 #else /* CONFIG_MMU */
 #define local_flush_tlb_all()			do { } while (0)
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/trace.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/trace.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM riscv
+
+#if !defined(_TRACE_RISCV_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_RISCV_H
+
+#include <linux/tracepoint.h>
+
+TRACE_EVENT_CONDITION(sbi_call,
+	TP_PROTO(int ext, int fid),
+	TP_ARGS(ext, fid),
+	TP_CONDITION(ext != SBI_EXT_HSM),
+
+	TP_STRUCT__entry(
+		__field(int, ext)
+		__field(int, fid)
+	),
+
+	TP_fast_assign(
+		__entry->ext = ext;
+		__entry->fid = fid;
+	),
+
+	TP_printk("ext=0x%x fid=%d", __entry->ext, __entry->fid)
+);
+
+TRACE_EVENT_CONDITION(sbi_return,
+	TP_PROTO(int ext, long error, long value),
+	TP_ARGS(ext, error, value),
+	TP_CONDITION(ext != SBI_EXT_HSM),
+
+	TP_STRUCT__entry(
+		__field(long, error)
+		__field(long, value)
+	),
+
+	TP_fast_assign(
+		__entry->error = error;
+		__entry->value = value;
+	),
+
+	TP_printk("error=%ld value=0x%lx", __entry->error, __entry->value)
+);
+
+#endif /* _TRACE_RISCV_H */
+
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+
+#define TRACE_INCLUDE_PATH asm
+#define TRACE_INCLUDE_FILE trace
+
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/arch/riscv/include/asm/uaccess.h
+++ linux-qcom-6.8.0/arch/riscv/include/asm/uaccess.h
@@ -319,7 +319,7 @@
 
 #define __get_kernel_nofault(dst, src, type, err_label)			\
 do {									\
-	long __kr_err;							\
+	long __kr_err = 0;						\
 									\
 	__get_user_nocheck(*((type *)(dst)), (type *)(src), __kr_err);	\
 	if (unlikely(__kr_err))						\
@@ -328,7 +328,7 @@
 
 #define __put_kernel_nofault(dst, src, type, err_label)			\
 do {									\
-	long __kr_err;							\
+	long __kr_err = 0;						\
 									\
 	__put_user_nocheck(*((type *)(src)), (type *)(dst), __kr_err);	\
 	if (unlikely(__kr_err))						\
--- linux-qcom-6.8.0.orig/arch/riscv/include/uapi/asm/auxvec.h
+++ linux-qcom-6.8.0/arch/riscv/include/uapi/asm/auxvec.h
@@ -34,7 +34,7 @@
 #define AT_L3_CACHEGEOMETRY	47
 
 /* entries in ARCH_DLINFO */
-#define AT_VECTOR_SIZE_ARCH	9
+#define AT_VECTOR_SIZE_ARCH	10
 #define AT_MINSIGSTKSZ		51
 
 #endif /* _UAPI_ASM_RISCV_AUXVEC_H */
--- linux-qcom-6.8.0.orig/arch/riscv/include/uapi/asm/hwprobe.h
+++ linux-qcom-6.8.0/arch/riscv/include/uapi/asm/hwprobe.h
@@ -54,7 +54,7 @@
 #define		RISCV_HWPROBE_EXT_ZFHMIN	(1 << 28)
 #define		RISCV_HWPROBE_EXT_ZIHINTNTL	(1 << 29)
 #define		RISCV_HWPROBE_EXT_ZVFH		(1 << 30)
-#define		RISCV_HWPROBE_EXT_ZVFHMIN	(1 << 31)
+#define		RISCV_HWPROBE_EXT_ZVFHMIN	(1ULL << 31)
 #define		RISCV_HWPROBE_EXT_ZFA		(1ULL << 32)
 #define		RISCV_HWPROBE_EXT_ZTSO		(1ULL << 33)
 #define		RISCV_HWPROBE_EXT_ZACAS		(1ULL << 34)
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/Makefile
+++ linux-qcom-6.8.0/arch/riscv/kernel/Makefile
@@ -20,17 +20,21 @@
 ifdef CONFIG_RISCV_ALTERNATIVE_EARLY
 CFLAGS_alternative.o := -mcmodel=medany
 CFLAGS_cpufeature.o := -mcmodel=medany
+CFLAGS_sbi_ecall.o := -mcmodel=medany
 ifdef CONFIG_FTRACE
 CFLAGS_REMOVE_alternative.o = $(CC_FLAGS_FTRACE)
 CFLAGS_REMOVE_cpufeature.o = $(CC_FLAGS_FTRACE)
+CFLAGS_REMOVE_sbi_ecall.o = $(CC_FLAGS_FTRACE)
 endif
 ifdef CONFIG_RELOCATABLE
 CFLAGS_alternative.o += -fno-pie
 CFLAGS_cpufeature.o += -fno-pie
+CFLAGS_sbi_ecall.o += -fno-pie
 endif
 ifdef CONFIG_KASAN
 KASAN_SANITIZE_alternative.o := n
 KASAN_SANITIZE_cpufeature.o := n
+KASAN_SANITIZE_sbi_ecall.o := n
 endif
 endif
 
@@ -83,7 +87,7 @@
 
 obj-$(CONFIG_PERF_EVENTS)	+= perf_callchain.o
 obj-$(CONFIG_HAVE_PERF_REGS)	+= perf_regs.o
-obj-$(CONFIG_RISCV_SBI)		+= sbi.o
+obj-$(CONFIG_RISCV_SBI)		+= sbi.o sbi_ecall.o
 ifeq ($(CONFIG_RISCV_SBI), y)
 obj-$(CONFIG_SMP)		+= sbi-ipi.o
 obj-$(CONFIG_SMP) += cpu_ops_sbi.o
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/acpi.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/acpi.c
@@ -205,7 +205,7 @@
 	if (!size)
 		return NULL;
 
-	return early_ioremap(phys, size);
+	return early_memremap(phys, size);
 }
 
 void __init __acpi_unmap_table(void __iomem *map, unsigned long size)
@@ -213,7 +213,7 @@
 	if (!map || !size)
 		return;
 
-	early_iounmap(map, size);
+	early_memunmap(map, size);
 }
 
 void __iomem *acpi_os_ioremap(acpi_physical_address phys, acpi_size size)
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/asm-offsets.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/asm-offsets.c
@@ -4,8 +4,6 @@
  * Copyright (C) 2017 SiFive
  */
 
-#define GENERATING_ASM_OFFSETS
-
 #include <linux/kbuild.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/cpu-hotplug.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/cpu-hotplug.c
@@ -58,7 +58,7 @@
 	if (cpu_ops->cpu_is_stopped)
 		ret = cpu_ops->cpu_is_stopped(cpu);
 	if (ret)
-		pr_warn("CPU%d may not have stopped: %d\n", cpu, ret);
+		pr_warn("CPU%u may not have stopped: %d\n", cpu, ret);
 }
 
 /*
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/cpu.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/cpu.c
@@ -139,6 +139,34 @@
 	return -1;
 }
 
+unsigned long __init riscv_get_marchid(void)
+{
+	struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
+
+#if IS_ENABLED(CONFIG_RISCV_SBI)
+	ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
+#elif IS_ENABLED(CONFIG_RISCV_M_MODE)
+	ci->marchid = csr_read(CSR_MARCHID);
+#else
+	ci->marchid = 0;
+#endif
+	return ci->marchid;
+}
+
+unsigned long __init riscv_get_mvendorid(void)
+{
+	struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
+
+#if IS_ENABLED(CONFIG_RISCV_SBI)
+	ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
+#elif IS_ENABLED(CONFIG_RISCV_M_MODE)
+	ci->mvendorid = csr_read(CSR_MVENDORID);
+#else
+	ci->mvendorid = 0;
+#endif
+	return ci->mvendorid;
+}
+
 DEFINE_PER_CPU(struct riscv_cpuinfo, riscv_cpuinfo);
 
 unsigned long riscv_cached_mvendorid(unsigned int cpu_id)
@@ -170,12 +198,16 @@
 	struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
 
 #if IS_ENABLED(CONFIG_RISCV_SBI)
-	ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
-	ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
+	if (!ci->mvendorid)
+		ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
+	if (!ci->marchid)
+		ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
 	ci->mimpid = sbi_spec_is_0_1() ? 0 : sbi_get_mimpid();
 #elif IS_ENABLED(CONFIG_RISCV_M_MODE)
-	ci->mvendorid = csr_read(CSR_MVENDORID);
-	ci->marchid = csr_read(CSR_MARCHID);
+	if (!ci->mvendorid)
+		ci->mvendorid = csr_read(CSR_MVENDORID);
+	if (!ci->marchid)
+		ci->marchid = csr_read(CSR_MARCHID);
 	ci->mimpid = csr_read(CSR_MIMPID);
 #else
 	ci->mvendorid = 0;
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/cpu_ops_sbi.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/cpu_ops_sbi.c
@@ -72,7 +72,7 @@
 	/* Make sure tidle is updated */
 	smp_mb();
 	bdata->task_ptr = tidle;
-	bdata->stack_ptr = task_stack_page(tidle) + THREAD_SIZE;
+	bdata->stack_ptr = task_pt_regs(tidle);
 	/* Make sure boot data is updated */
 	smp_mb();
 	hsm_data = __pa(bdata);
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/cpu_ops_spinwait.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/cpu_ops_spinwait.c
@@ -34,8 +34,7 @@
 
 	/* Make sure tidle is updated */
 	smp_mb();
-	WRITE_ONCE(__cpu_spinwait_stack_pointer[hartid],
-		   task_stack_page(tidle) + THREAD_SIZE);
+	WRITE_ONCE(__cpu_spinwait_stack_pointer[hartid], task_pt_regs(tidle));
 	WRITE_ONCE(__cpu_spinwait_task_pointer[hartid], tidle);
 }
 
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/cpufeature.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/cpufeature.c
@@ -503,6 +503,8 @@
 	struct acpi_table_header *rhct;
 	acpi_status status;
 	unsigned int cpu;
+	u64 boot_vendorid;
+	u64 boot_archid;
 
 	if (!acpi_disabled) {
 		status = acpi_get_table(ACPI_SIG_RHCT, 0, &rhct);
@@ -510,6 +512,9 @@
 			return;
 	}
 
+	boot_vendorid = riscv_get_mvendorid();
+	boot_archid = riscv_get_marchid();
+
 	for_each_possible_cpu(cpu) {
 		struct riscv_isainfo *isainfo = &hart_isa[cpu];
 		unsigned long this_hwcap = 0;
@@ -557,8 +562,7 @@
 		 * CPU cores with the ratified spec will contain non-zero
 		 * marchid.
 		 */
-		if (acpi_disabled && riscv_cached_mvendorid(cpu) == THEAD_VENDOR_ID &&
-		    riscv_cached_marchid(cpu) == 0x0) {
+		if (acpi_disabled && boot_vendorid == THEAD_VENDOR_ID && boot_archid == 0x0) {
 			this_hwcap &= ~isa2hwcap[RISCV_ISA_EXT_v];
 			clear_bit(RISCV_ISA_EXT_v, isainfo->isa);
 		}
@@ -612,7 +616,7 @@
 
 			if (ext->subset_ext_size) {
 				for (int j = 0; j < ext->subset_ext_size; j++) {
-					if (riscv_isa_extension_check(ext->subset_ext_ids[i]))
+					if (riscv_isa_extension_check(ext->subset_ext_ids[j]))
 						set_bit(ext->subset_ext_ids[j], isainfo->isa);
 				}
 			}
@@ -899,6 +903,7 @@
 	if (per_cpu(misaligned_access_speed, cpu) != RISCV_HWPROBE_MISALIGNED_UNKNOWN)
 		goto exit;
 
+	check_unaligned_access_emulated(NULL);
 	buf = alloc_pages(GFP_KERNEL, MISALIGNED_BUFFER_ORDER);
 	if (!buf) {
 		pr_warn("Allocation failure, not measuring misaligned performance\n");
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/efi-header.S
+++ linux-qcom-6.8.0/arch/riscv/kernel/efi-header.S
@@ -64,7 +64,7 @@
 	.long	efi_header_end - _start			// SizeOfHeaders
 	.long	0					// CheckSum
 	.short	IMAGE_SUBSYSTEM_EFI_APPLICATION		// Subsystem
-	.short	0					// DllCharacteristics
+	.short	IMAGE_DLL_CHARACTERISTICS_NX_COMPAT	// DllCharacteristics
 	.quad	0					// SizeOfStackReserve
 	.quad	0					// SizeOfStackCommit
 	.quad	0					// SizeOfHeapReserve
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/elf_kexec.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/elf_kexec.c
@@ -445,6 +445,12 @@
 			*(u32 *)loc = CLEAN_IMM(CJTYPE, *(u32 *)loc) |
 				 ENCODE_CJTYPE_IMM(val - addr);
 			break;
+		case R_RISCV_ADD16:
+			*(u16 *)loc += val;
+			break;
+		case R_RISCV_SUB16:
+			*(u16 *)loc -= val;
+			break;
 		case R_RISCV_ADD32:
 			*(u32 *)loc += val;
 			break;
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/entry.S
+++ linux-qcom-6.8.0/arch/riscv/kernel/entry.S
@@ -111,6 +111,7 @@
 1:
 	tail do_trap_unknown
 SYM_CODE_END(handle_exception)
+ASM_NOKPROBE(handle_exception)
 
 /*
  * The ret_from_exception must be called with interrupt disabled. Here is the
@@ -184,6 +185,7 @@
 	sret
 #endif
 SYM_CODE_END(ret_from_exception)
+ASM_NOKPROBE(ret_from_exception)
 
 #ifdef CONFIG_VMAP_STACK
 SYM_CODE_START_LOCAL(handle_kernel_stack_overflow)
@@ -219,6 +221,7 @@
 	move a0, sp
 	tail handle_bad_stack
 SYM_CODE_END(handle_kernel_stack_overflow)
+ASM_NOKPROBE(handle_kernel_stack_overflow)
 #endif
 
 SYM_CODE_START(ret_from_fork)
@@ -229,8 +232,8 @@
 	jalr s0
 1:
 	move a0, sp /* pt_regs */
-	la ra, ret_from_exception
-	tail syscall_exit_to_user_mode
+	call syscall_exit_to_user_mode
+	j ret_from_exception
 SYM_CODE_END(ret_from_fork)
 
 #ifdef CONFIG_IRQ_STACKS
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/ftrace.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/ftrace.c
@@ -8,6 +8,7 @@
 #include <linux/ftrace.h>
 #include <linux/uaccess.h>
 #include <linux/memory.h>
+#include <linux/stop_machine.h>
 #include <asm/cacheflush.h>
 #include <asm/patch.h>
 
@@ -75,8 +76,7 @@
 		make_call_t0(hook_pos, target, call);
 
 	/* Replace the auipc-jalr pair at once. Return -EPERM on write error. */
-	if (patch_text_nosync
-	    ((void *)hook_pos, enable ? call : nops, MCOUNT_INSN_SIZE))
+	if (patch_insn_write((void *)hook_pos, enable ? call : nops, MCOUNT_INSN_SIZE))
 		return -EPERM;
 
 	return 0;
@@ -88,7 +88,7 @@
 
 	make_call_t0(rec->ip, addr, call);
 
-	if (patch_text_nosync((void *)rec->ip, call, MCOUNT_INSN_SIZE))
+	if (patch_insn_write((void *)rec->ip, call, MCOUNT_INSN_SIZE))
 		return -EPERM;
 
 	return 0;
@@ -99,7 +99,7 @@
 {
 	unsigned int nops[2] = {NOP4, NOP4};
 
-	if (patch_text_nosync((void *)rec->ip, nops, MCOUNT_INSN_SIZE))
+	if (patch_insn_write((void *)rec->ip, nops, MCOUNT_INSN_SIZE))
 		return -EPERM;
 
 	return 0;
@@ -120,6 +120,9 @@
 	out = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
 	mutex_unlock(&text_mutex);
 
+	if (!mod)
+		local_flush_icache_range(rec->ip, rec->ip + MCOUNT_INSN_SIZE);
+
 	return out;
 }
 
@@ -134,6 +137,42 @@
 
 	return ret;
 }
+
+struct ftrace_modify_param {
+	int command;
+	atomic_t cpu_count;
+};
+
+static int __ftrace_modify_code(void *data)
+{
+	struct ftrace_modify_param *param = data;
+
+	if (atomic_inc_return(&param->cpu_count) == num_online_cpus()) {
+		ftrace_modify_all_code(param->command);
+		/*
+		 * Make sure the patching store is effective *before* we
+		 * increment the counter which releases all waiting CPUs
+		 * by using the release variant of atomic increment. The
+		 * release pairs with the call to local_flush_icache_all()
+		 * on the waiting CPU.
+		 */
+		atomic_inc_return_release(&param->cpu_count);
+	} else {
+		while (atomic_read(&param->cpu_count) <= num_online_cpus())
+			cpu_relax();
+	}
+
+	local_flush_icache_all();
+
+	return 0;
+}
+
+void arch_ftrace_update_code(int command)
+{
+	struct ftrace_modify_param param = { command, ATOMIC_INIT(0) };
+
+	stop_machine(__ftrace_modify_code, &param, cpu_online_mask);
+}
 #endif
 
 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/head.S
+++ linux-qcom-6.8.0/arch/riscv/kernel/head.S
@@ -165,10 +165,21 @@
 #endif
 	call .Lsetup_trap_vector
 	scs_load_current
-	tail smp_callin
+	call smp_callin
 #endif /* CONFIG_SMP */
 
 .align 2
+.Lsecondary_park:
+	/*
+	 * Park this hart if we:
+	 *  - have too many harts on CONFIG_RISCV_BOOT_SPINWAIT
+	 *  - receive an early trap, before setup_trap_vector finished
+	 *  - fail in smp_callin(), as a successful one wouldn't return
+	 */
+	wfi
+	j .Lsecondary_park
+
+.align 2
 .Lsetup_trap_vector:
 	/* Set trap vector to exception handler */
 	la a0, handle_exception
@@ -181,12 +192,6 @@
 	csrw CSR_SCRATCH, zero
 	ret
 
-.align 2
-.Lsecondary_park:
-	/* We lack SMP support or have too many harts, so park this hart */
-	wfi
-	j .Lsecondary_park
-
 SYM_CODE_END(_start)
 
 SYM_CODE_START(_start_kernel)
@@ -300,6 +305,9 @@
 #else
 	mv a0, a1
 #endif /* CONFIG_BUILTIN_DTB */
+	/* Set trap vector to spin forever to help debug */
+	la a3, .Lsecondary_park
+	csrw CSR_TVEC, a3
 	call setup_vm
 #ifdef CONFIG_MMU
 	la a0, early_pg_dir
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/machine_kexec.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/machine_kexec.c
@@ -121,20 +121,12 @@
 
 	for_each_irq_desc(i, desc) {
 		struct irq_chip *chip;
-		int ret;
 
 		chip = irq_desc_get_chip(desc);
 		if (!chip)
 			continue;
 
-		/*
-		 * First try to remove the active state. If this
-		 * fails, try to EOI the interrupt.
-		 */
-		ret = irq_set_irqchip_state(i, IRQCHIP_STATE_ACTIVE, false);
-
-		if (ret && irqd_irq_inprogress(&desc->irq_data) &&
-		    chip->irq_eoi)
+		if (chip->irq_eoi && irqd_irq_inprogress(&desc->irq_data))
 			chip->irq_eoi(&desc->irq_data);
 
 		if (chip->irq_mask)
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/module.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/module.c
@@ -24,7 +24,7 @@
 
 struct relocation_head {
 	struct hlist_node node;
-	struct list_head *rel_entry;
+	struct list_head rel_entry;
 	void *location;
 };
 
@@ -635,7 +635,7 @@
 			location = rel_head_iter->location;
 			list_for_each_entry_safe(rel_entry_iter,
 						 rel_entry_iter_tmp,
-						 rel_head_iter->rel_entry,
+						 &rel_head_iter->rel_entry,
 						 head) {
 				curr_type = rel_entry_iter->type;
 				reloc_handlers[curr_type].reloc_handler(
@@ -705,16 +705,7 @@
 			return -ENOMEM;
 		}
 
-		rel_head->rel_entry =
-			kmalloc(sizeof(struct list_head), GFP_KERNEL);
-
-		if (!rel_head->rel_entry) {
-			kfree(entry);
-			kfree(rel_head);
-			return -ENOMEM;
-		}
-
-		INIT_LIST_HEAD(rel_head->rel_entry);
+		INIT_LIST_HEAD(&rel_head->rel_entry);
 		rel_head->location = location;
 		INIT_HLIST_NODE(&rel_head->node);
 		if (!current_head->first) {
@@ -723,7 +714,6 @@
 
 			if (!bucket) {
 				kfree(entry);
-				kfree(rel_head->rel_entry);
 				kfree(rel_head);
 				return -ENOMEM;
 			}
@@ -736,7 +726,7 @@
 	}
 
 	/* Add relocation to head of discovered rel_head */
-	list_add_tail(&entry->head, rel_head->rel_entry);
+	list_add_tail(&entry->head, &rel_head->rel_entry);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/patch.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/patch.c
@@ -80,6 +80,8 @@
 	 */
 	lockdep_assert_held(&text_mutex);
 
+	preempt_disable();
+
 	if (across_pages)
 		patch_map(addr + PAGE_SIZE, FIX_TEXT_POKE1);
 
@@ -92,6 +94,8 @@
 	if (across_pages)
 		patch_unmap(FIX_TEXT_POKE1);
 
+	preempt_enable();
+
 	return 0;
 }
 NOKPROBE_SYMBOL(__patch_insn_set);
@@ -122,6 +126,8 @@
 	if (!riscv_patch_in_stop_machine)
 		lockdep_assert_held(&text_mutex);
 
+	preempt_disable();
+
 	if (across_pages)
 		patch_map(addr + PAGE_SIZE, FIX_TEXT_POKE1);
 
@@ -134,6 +140,8 @@
 	if (across_pages)
 		patch_unmap(FIX_TEXT_POKE1);
 
+	preempt_enable();
+
 	return ret;
 }
 NOKPROBE_SYMBOL(__patch_insn_write);
@@ -188,7 +196,7 @@
 }
 NOKPROBE_SYMBOL(patch_text_set_nosync);
 
-static int patch_insn_write(void *addr, const void *insn, size_t len)
+int patch_insn_write(void *addr, const void *insn, size_t len)
 {
 	size_t patched = 0;
 	size_t size;
@@ -232,16 +240,24 @@
 	if (atomic_inc_return(&patch->cpu_count) == num_online_cpus()) {
 		for (i = 0; ret == 0 && i < patch->ninsns; i++) {
 			len = GET_INSN_LENGTH(patch->insns[i]);
-			ret = patch_text_nosync(patch->addr + i * len,
-						&patch->insns[i], len);
+			ret = patch_insn_write(patch->addr + i * len, &patch->insns[i], len);
 		}
-		atomic_inc(&patch->cpu_count);
+		/*
+		 * Make sure the patching store is effective *before* we
+		 * increment the counter which releases all waiting CPUs
+		 * by using the release variant of atomic increment. The
+		 * release pairs with the call to local_flush_icache_all()
+		 * on the waiting CPU.
+		 */
+		atomic_inc_return_release(&patch->cpu_count);
 	} else {
 		while (atomic_read(&patch->cpu_count) <= num_online_cpus())
 			cpu_relax();
 		smp_mb();
 	}
 
+	local_flush_icache_all();
+
 	return ret;
 }
 NOKPROBE_SYMBOL(patch_text_cb);
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/perf_callchain.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/perf_callchain.c
@@ -62,7 +62,7 @@
 	perf_callchain_store(entry, regs->epc);
 
 	fp = user_backtrace(entry, fp, regs->ra);
-	while (fp && !(fp & 0x3) && entry->nr < entry->max_stack)
+	while (fp && !(fp & 0x7) && entry->nr < entry->max_stack)
 		fp = user_backtrace(entry, fp, 0);
 }
 
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/probes/ftrace.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/probes/ftrace.c
@@ -11,6 +11,9 @@
 	struct kprobe_ctlblk *kcb;
 	int bit;
 
+	if (unlikely(kprobe_ftrace_disabled))
+		return;
+
 	bit = ftrace_test_recursion_trylock(ip, parent_ip);
 	if (bit < 0)
 		return;
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/probes/kprobes.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/probes/kprobes.c
@@ -28,9 +28,8 @@
 
 	p->ainsn.api.restore = (unsigned long)p->addr + offset;
 
-	patch_text(p->ainsn.api.insn, &p->opcode, 1);
-	patch_text((void *)((unsigned long)(p->ainsn.api.insn) + offset),
-		   &insn, 1);
+	patch_text_nosync(p->ainsn.api.insn, &p->opcode, 1);
+	patch_text_nosync((void *)p->ainsn.api.insn + offset, &insn, 1);
 }
 
 static void __kprobes arch_prepare_simulate(struct kprobe *p)
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/process.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/process.c
@@ -27,8 +27,6 @@
 #include <asm/vector.h>
 #include <asm/cpufeature.h>
 
-register unsigned long gp_in_global __asm__("gp");
-
 #if defined(CONFIG_STACKPROTECTOR) && !defined(CONFIG_STACKPROTECTOR_PER_TASK)
 #include <linux/stackprotector.h>
 unsigned long __stack_chk_guard __read_mostly;
@@ -37,7 +35,7 @@
 
 extern asmlinkage void ret_from_fork(void);
 
-void arch_cpu_idle(void)
+void noinstr arch_cpu_idle(void)
 {
 	cpu_do_idle();
 }
@@ -207,7 +205,6 @@
 	if (unlikely(args->fn)) {
 		/* Kernel thread */
 		memset(childregs, 0, sizeof(struct pt_regs));
-		childregs->gp = gp_in_global;
 		/* Supervisor/Machine, irqs on: */
 		childregs->status = SR_PP | SR_PIE;
 
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/riscv_ksyms.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/riscv_ksyms.c
@@ -12,9 +12,6 @@
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strncmp);
 EXPORT_SYMBOL(__memset);
 EXPORT_SYMBOL(__memcpy);
 EXPORT_SYMBOL(__memmove);
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/sbi-ipi.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/sbi-ipi.c
@@ -68,7 +68,7 @@
 	 * the masking/unmasking of virtual IPIs is done
 	 * via generic IPI-Mux
 	 */
-	cpuhp_setup_state(CPUHP_AP_ONLINE_DYN,
+	cpuhp_setup_state(CPUHP_AP_IRQ_RISCV_SBI_IPI_STARTING,
 			  "irqchip/sbi-ipi:starting",
 			  sbi_ipi_starting_cpu, NULL);
 
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/sbi.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/sbi.c
@@ -24,51 +24,6 @@
 			   unsigned long start, unsigned long size,
 			   unsigned long arg4, unsigned long arg5) __ro_after_init;
 
-struct sbiret sbi_ecall(int ext, int fid, unsigned long arg0,
-			unsigned long arg1, unsigned long arg2,
-			unsigned long arg3, unsigned long arg4,
-			unsigned long arg5)
-{
-	struct sbiret ret;
-
-	register uintptr_t a0 asm ("a0") = (uintptr_t)(arg0);
-	register uintptr_t a1 asm ("a1") = (uintptr_t)(arg1);
-	register uintptr_t a2 asm ("a2") = (uintptr_t)(arg2);
-	register uintptr_t a3 asm ("a3") = (uintptr_t)(arg3);
-	register uintptr_t a4 asm ("a4") = (uintptr_t)(arg4);
-	register uintptr_t a5 asm ("a5") = (uintptr_t)(arg5);
-	register uintptr_t a6 asm ("a6") = (uintptr_t)(fid);
-	register uintptr_t a7 asm ("a7") = (uintptr_t)(ext);
-	asm volatile ("ecall"
-		      : "+r" (a0), "+r" (a1)
-		      : "r" (a2), "r" (a3), "r" (a4), "r" (a5), "r" (a6), "r" (a7)
-		      : "memory");
-	ret.error = a0;
-	ret.value = a1;
-
-	return ret;
-}
-EXPORT_SYMBOL(sbi_ecall);
-
-int sbi_err_map_linux_errno(int err)
-{
-	switch (err) {
-	case SBI_SUCCESS:
-		return 0;
-	case SBI_ERR_DENIED:
-		return -EPERM;
-	case SBI_ERR_INVALID_PARAM:
-		return -EINVAL;
-	case SBI_ERR_INVALID_ADDRESS:
-		return -EFAULT;
-	case SBI_ERR_NOT_SUPPORTED:
-	case SBI_ERR_FAILURE:
-	default:
-		return -ENOTSUPP;
-	};
-}
-EXPORT_SYMBOL(sbi_err_map_linux_errno);
-
 #ifdef CONFIG_RISCV_SBI_V01
 static unsigned long __sbi_v01_cpumask_to_hartmask(const struct cpumask *cpu_mask)
 {
@@ -528,17 +483,6 @@
 }
 EXPORT_SYMBOL(sbi_probe_extension);
 
-static long __sbi_base_ecall(int fid)
-{
-	struct sbiret ret;
-
-	ret = sbi_ecall(SBI_EXT_BASE, fid, 0, 0, 0, 0, 0, 0);
-	if (!ret.error)
-		return ret.value;
-	else
-		return sbi_err_map_linux_errno(ret.error);
-}
-
 static inline long sbi_get_spec_version(void)
 {
 	return __sbi_base_ecall(SBI_EXT_BASE_GET_SPEC_VERSION);
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/sbi_ecall.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/sbi_ecall.c
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2024 Rivos Inc. */
+
+#include <asm/sbi.h>
+#define CREATE_TRACE_POINTS
+#include <asm/trace.h>
+
+long __sbi_base_ecall(int fid)
+{
+	struct sbiret ret;
+
+	ret = sbi_ecall(SBI_EXT_BASE, fid, 0, 0, 0, 0, 0, 0);
+	if (!ret.error)
+		return ret.value;
+	else
+		return sbi_err_map_linux_errno(ret.error);
+}
+EXPORT_SYMBOL(__sbi_base_ecall);
+
+struct sbiret __sbi_ecall(unsigned long arg0, unsigned long arg1,
+			  unsigned long arg2, unsigned long arg3,
+			  unsigned long arg4, unsigned long arg5,
+			  int fid, int ext)
+{
+	struct sbiret ret;
+
+	trace_sbi_call(ext, fid);
+
+	register uintptr_t a0 asm ("a0") = (uintptr_t)(arg0);
+	register uintptr_t a1 asm ("a1") = (uintptr_t)(arg1);
+	register uintptr_t a2 asm ("a2") = (uintptr_t)(arg2);
+	register uintptr_t a3 asm ("a3") = (uintptr_t)(arg3);
+	register uintptr_t a4 asm ("a4") = (uintptr_t)(arg4);
+	register uintptr_t a5 asm ("a5") = (uintptr_t)(arg5);
+	register uintptr_t a6 asm ("a6") = (uintptr_t)(fid);
+	register uintptr_t a7 asm ("a7") = (uintptr_t)(ext);
+	asm volatile ("ecall"
+		       : "+r" (a0), "+r" (a1)
+		       : "r" (a2), "r" (a3), "r" (a4), "r" (a5), "r" (a6), "r" (a7)
+		       : "memory");
+	ret.error = a0;
+	ret.value = a1;
+
+	trace_sbi_return(ext, ret.error, ret.value);
+
+	return ret;
+}
+EXPORT_SYMBOL(__sbi_ecall);
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/setup.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/setup.c
@@ -227,7 +227,7 @@
 static void __init parse_dtb(void)
 {
 	/* Early scan of device tree from init memory */
-	if (early_init_dt_scan(dtb_early_va)) {
+	if (early_init_dt_scan(dtb_early_va, dtb_early_pa)) {
 		const char *name = of_flat_dt_get_machine_name();
 
 		if (name) {
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/signal.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/signal.c
@@ -119,6 +119,13 @@
 	struct __sc_riscv_v_state __user *state = sc_vec;
 	void __user *datap;
 
+	/*
+	 * Mark the vstate as clean prior performing the actual copy,
+	 * to avoid getting the vstate incorrectly clobbered by the
+	 *  discarded vector state.
+	 */
+	riscv_v_vstate_set_restore(current, regs);
+
 	/* Copy everything of __sc_riscv_v_state except datap. */
 	err = __copy_from_user(&current->thread.vstate, &state->v_state,
 			       offsetof(struct __riscv_v_ext_state, datap));
@@ -133,13 +140,7 @@
 	 * Copy the whole vector content from user space datap. Use
 	 * copy_from_user to prevent information leak.
 	 */
-	err = copy_from_user(current->thread.vstate.datap, datap, riscv_v_vsize);
-	if (unlikely(err))
-		return err;
-
-	riscv_v_vstate_set_restore(current, regs);
-
-	return err;
+	return copy_from_user(current->thread.vstate.datap, datap, riscv_v_vsize);
 }
 #else
 #define save_v_state(task, regs) (0)
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/smpboot.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/smpboot.c
@@ -26,7 +26,7 @@
 #include <linux/sched/task_stack.h>
 #include <linux/sched/mm.h>
 
-#include <asm/cpufeature.h>
+#include <asm/cacheflush.h>
 #include <asm/cpu_ops.h>
 #include <asm/cpufeature.h>
 #include <asm/irq.h>
@@ -219,6 +219,15 @@
 	struct mm_struct *mm = &init_mm;
 	unsigned int curr_cpuid = smp_processor_id();
 
+	if (has_vector()) {
+		/*
+		 * Return as early as possible so the hart with a mismatching
+		 * vlen won't boot.
+		 */
+		if (riscv_v_setup_vsize())
+			return;
+	}
+
 	/* All kernel threads share the same mm context.  */
 	mmgrab(mm);
 	current->active_mm = mm;
@@ -231,17 +240,13 @@
 	numa_add_cpu(curr_cpuid);
 	set_cpu_online(curr_cpuid, 1);
 
-	if (has_vector()) {
-		if (riscv_v_setup_vsize())
-			elf_hwcap &= ~COMPAT_HWCAP_ISA_V;
-	}
-
 	riscv_user_isa_enable();
 
 	/*
-	 * Remote TLB flushes are ignored while the CPU is offline, so emit
-	 * a local TLB flush right now just in case.
+	 * Remote cache and TLB flushes are ignored while the CPU is offline,
+	 * so flush them both right now just in case.
 	 */
+	local_flush_icache_all();
 	local_flush_tlb_all();
 	complete(&cpu_running);
 	/*
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/stacktrace.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/stacktrace.c
@@ -18,10 +18,21 @@
 
 extern asmlinkage void ret_from_exception(void);
 
+static inline int fp_is_valid(unsigned long fp, unsigned long sp)
+{
+	unsigned long low, high;
+
+	low = sp + sizeof(struct stackframe);
+	high = ALIGN(sp, THREAD_SIZE);
+
+	return !(fp < low || fp > high || fp & 0x07);
+}
+
 void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
 			     bool (*fn)(void *, unsigned long), void *arg)
 {
 	unsigned long fp, sp, pc;
+	int graph_idx = 0;
 	int level = 0;
 
 	if (regs) {
@@ -41,26 +52,24 @@
 	}
 
 	for (;;) {
-		unsigned long low, high;
 		struct stackframe *frame;
 
 		if (unlikely(!__kernel_text_address(pc) || (level++ >= 0 && !fn(arg, pc))))
 			break;
 
-		/* Validate frame pointer */
-		low = sp + sizeof(struct stackframe);
-		high = ALIGN(sp, THREAD_SIZE);
-		if (unlikely(fp < low || fp > high || fp & 0x7))
+		if (unlikely(!fp_is_valid(fp, sp)))
 			break;
+
 		/* Unwind stack frame */
 		frame = (struct stackframe *)fp - 1;
 		sp = fp;
-		if (regs && (regs->epc == pc) && (frame->fp & 0x7)) {
+		if (regs && (regs->epc == pc) && fp_is_valid(frame->ra, sp)) {
+			/* We hit function where ra is not saved on the stack */
 			fp = frame->ra;
 			pc = regs->ra;
 		} else {
 			fp = frame->fp;
-			pc = ftrace_graph_ret_addr(current, NULL, frame->ra,
+			pc = ftrace_graph_ret_addr(current, &graph_idx, frame->ra,
 						   &frame->ra);
 			if (pc == (unsigned long)ret_from_exception) {
 				if (unlikely(!__kernel_text_address(pc) || !fn(arg, pc)))
@@ -148,7 +157,7 @@
 	return pc;
 }
 
-noinline void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie,
+noinline noinstr void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie,
 		     struct task_struct *task, struct pt_regs *regs)
 {
 	walk_stackframe(task, regs, consume_entry, cookie);
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/traps.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/traps.c
@@ -34,7 +34,7 @@
 
 int show_unhandled_signals = 1;
 
-static DEFINE_SPINLOCK(die_lock);
+static DEFINE_RAW_SPINLOCK(die_lock);
 
 static int copy_code(struct pt_regs *regs, u16 *val, const u16 *insns)
 {
@@ -80,7 +80,7 @@
 
 	oops_enter();
 
-	spin_lock_irqsave(&die_lock, flags);
+	raw_spin_lock_irqsave(&die_lock, flags);
 	console_verbose();
 	bust_spinlocks(1);
 
@@ -99,7 +99,7 @@
 
 	bust_spinlocks(0);
 	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
-	spin_unlock_irqrestore(&die_lock, flags);
+	raw_spin_unlock_irqrestore(&die_lock, flags);
 	oops_exit();
 
 	if (in_interrupt())
@@ -121,7 +121,7 @@
 		print_vma_addr(KERN_CONT " in ", instruction_pointer(regs));
 		pr_cont("\n");
 		__show_regs(regs);
-		dump_instr(KERN_EMERG, regs);
+		dump_instr(KERN_INFO, regs);
 	}
 
 	force_sig_fault(signo, code, (void __user *)addr);
@@ -317,6 +317,7 @@
 
 		regs->epc += 4;
 		regs->orig_a0 = regs->a0;
+		regs->a0 = -ENOSYS;
 
 		riscv_v_vstate_discard(regs);
 
@@ -324,8 +325,6 @@
 
 		if (syscall >= 0 && syscall < NR_syscalls)
 			syscall_handler(regs, syscall);
-		else if (syscall != -1)
-			regs->a0 = -ENOSYS;
 
 		syscall_exit_to_user_mode(regs);
 	} else {
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/traps_misaligned.c
+++ linux-qcom-6.8.0/arch/riscv/kernel/traps_misaligned.c
@@ -136,8 +136,6 @@
 #define REG_PTR(insn, pos, regs)	\
 	(ulong *)((ulong)(regs) + REG_OFFSET(insn, pos))
 
-#define GET_RM(insn)			(((insn) >> 12) & 7)
-
 #define GET_RS1(insn, regs)		(*REG_PTR(insn, SH_RS1, regs))
 #define GET_RS2(insn, regs)		(*REG_PTR(insn, SH_RS2, regs))
 #define GET_RS1S(insn, regs)		(*REG_PTR(RVC_RS1S(insn), 0, regs))
@@ -264,86 +262,14 @@
 #define GET_F32_RS2C(insn, regs) (get_f32_rs(insn, 2, regs))
 #define GET_F32_RS2S(insn, regs) (get_f32_rs(RVC_RS2S(insn), 0, regs))
 
-#ifdef CONFIG_RISCV_M_MODE
-static inline int load_u8(struct pt_regs *regs, const u8 *addr, u8 *r_val)
-{
-	u8 val;
-
-	asm volatile("lbu %0, %1" : "=&r" (val) : "m" (*addr));
-	*r_val = val;
-
-	return 0;
-}
-
-static inline int store_u8(struct pt_regs *regs, u8 *addr, u8 val)
-{
-	asm volatile ("sb %0, %1\n" : : "r" (val), "m" (*addr));
-
-	return 0;
-}
-
-static inline int get_insn(struct pt_regs *regs, ulong mepc, ulong *r_insn)
-{
-	register ulong __mepc asm ("a2") = mepc;
-	ulong val, rvc_mask = 3, tmp;
-
-	asm ("and %[tmp], %[addr], 2\n"
-		"bnez %[tmp], 1f\n"
-#if defined(CONFIG_64BIT)
-		__stringify(LWU) " %[insn], (%[addr])\n"
-#else
-		__stringify(LW) " %[insn], (%[addr])\n"
-#endif
-		"and %[tmp], %[insn], %[rvc_mask]\n"
-		"beq %[tmp], %[rvc_mask], 2f\n"
-		"sll %[insn], %[insn], %[xlen_minus_16]\n"
-		"srl %[insn], %[insn], %[xlen_minus_16]\n"
-		"j 2f\n"
-		"1:\n"
-		"lhu %[insn], (%[addr])\n"
-		"and %[tmp], %[insn], %[rvc_mask]\n"
-		"bne %[tmp], %[rvc_mask], 2f\n"
-		"lhu %[tmp], 2(%[addr])\n"
-		"sll %[tmp], %[tmp], 16\n"
-		"add %[insn], %[insn], %[tmp]\n"
-		"2:"
-	: [insn] "=&r" (val), [tmp] "=&r" (tmp)
-	: [addr] "r" (__mepc), [rvc_mask] "r" (rvc_mask),
-	  [xlen_minus_16] "i" (XLEN_MINUS_16));
-
-	*r_insn = val;
-
-	return 0;
-}
-#else
-static inline int load_u8(struct pt_regs *regs, const u8 *addr, u8 *r_val)
-{
-	if (user_mode(regs)) {
-		return __get_user(*r_val, (u8 __user *)addr);
-	} else {
-		*r_val = *addr;
-		return 0;
-	}
-}
-
-static inline int store_u8(struct pt_regs *regs, u8 *addr, u8 val)
-{
-	if (user_mode(regs)) {
-		return __put_user(val, (u8 __user *)addr);
-	} else {
-		*addr = val;
-		return 0;
-	}
-}
-
-#define __read_insn(regs, insn, insn_addr)		\
+#define __read_insn(regs, insn, insn_addr, type)	\
 ({							\
 	int __ret;					\
 							\
 	if (user_mode(regs)) {				\
-		__ret = __get_user(insn, insn_addr);	\
+		__ret = __get_user(insn, (type __user *) insn_addr); \
 	} else {					\
-		insn = *(__force u16 *)insn_addr;	\
+		insn = *(type *)insn_addr;		\
 		__ret = 0;				\
 	}						\
 							\
@@ -356,9 +282,8 @@
 
 	if (epc & 0x2) {
 		ulong tmp = 0;
-		u16 __user *insn_addr = (u16 __user *)epc;
 
-		if (__read_insn(regs, insn, insn_addr))
+		if (__read_insn(regs, insn, epc, u16))
 			return -EFAULT;
 		/* __get_user() uses regular "lw" which sign extend the loaded
 		 * value make sure to clear higher order bits in case we "or" it
@@ -369,16 +294,14 @@
 			*r_insn = insn;
 			return 0;
 		}
-		insn_addr++;
-		if (__read_insn(regs, tmp, insn_addr))
+		epc += sizeof(u16);
+		if (__read_insn(regs, tmp, epc, u16))
 			return -EFAULT;
 		*r_insn = (tmp << 16) | insn;
 
 		return 0;
 	} else {
-		u32 __user *insn_addr = (u32 __user *)epc;
-
-		if (__read_insn(regs, insn, insn_addr))
+		if (__read_insn(regs, insn, epc, u32))
 			return -EFAULT;
 		if ((insn & __INSN_LENGTH_MASK) == __INSN_LENGTH_32) {
 			*r_insn = insn;
@@ -390,7 +313,6 @@
 		return 0;
 	}
 }
-#endif
 
 union reg_data {
 	u8 data_bytes[8];
@@ -409,7 +331,7 @@
 	unsigned long epc = regs->epc;
 	unsigned long insn;
 	unsigned long addr = regs->badaddr;
-	int i, fp = 0, shift = 0, len = 0;
+	int fp = 0, shift = 0, len = 0;
 
 	perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, addr);
 
@@ -490,9 +412,11 @@
 		return -EOPNOTSUPP;
 
 	val.data_u64 = 0;
-	for (i = 0; i < len; i++) {
-		if (load_u8(regs, (void *)(addr + i), &val.data_bytes[i]))
+	if (user_mode(regs)) {
+		if (copy_from_user(&val, (u8 __user *)addr, len))
 			return -1;
+	} else {
+		memcpy(&val, (u8 *)addr, len);
 	}
 
 	if (!fp)
@@ -513,7 +437,7 @@
 	unsigned long epc = regs->epc;
 	unsigned long insn;
 	unsigned long addr = regs->badaddr;
-	int i, len = 0, fp = 0;
+	int len = 0, fp = 0;
 
 	perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, addr);
 
@@ -586,9 +510,11 @@
 	if (!IS_ENABLED(CONFIG_FPU) && fp)
 		return -EOPNOTSUPP;
 
-	for (i = 0; i < len; i++) {
-		if (store_u8(regs, (void *)(addr + i), val.data_bytes[i]))
+	if (user_mode(regs)) {
+		if (copy_to_user((u8 __user *)addr, &val, len))
 			return -1;
+	} else {
+		memcpy((u8 *)addr, &val, len);
 	}
 
 	regs->epc = epc + INSN_LEN(insn);
@@ -632,7 +558,7 @@
 	 * accesses emulated since tasks requesting such control can run on any
 	 * CPU.
 	 */
-	for_each_present_cpu(cpu) {
+	for_each_online_cpu(cpu) {
 		if (per_cpu(misaligned_access_speed, cpu) !=
 					RISCV_HWPROBE_MISALIGNED_EMULATED) {
 			return;
--- linux-qcom-6.8.0.orig/arch/riscv/kernel/vdso/Makefile
+++ linux-qcom-6.8.0/arch/riscv/kernel/vdso/Makefile
@@ -18,6 +18,7 @@
 
 ccflags-y := -fno-stack-protector
 ccflags-y += -DDISABLE_BRANCH_PROFILING
+ccflags-y += -fno-builtin
 
 ifneq ($(c-gettimeofday-y),)
   CFLAGS_vgettimeofday.o += -fPIC -include $(c-gettimeofday-y)
@@ -37,6 +38,7 @@
 
 # Disable -pg to prevent insert call site
 CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS)
+CFLAGS_REMOVE_hwprobe.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS)
 
 # Disable profiling and instrumentation for VDSO code
 GCOV_PROFILE := n
--- linux-qcom-6.8.0.orig/arch/riscv/kvm/aia_aplic.c
+++ linux-qcom-6.8.0/arch/riscv/kvm/aia_aplic.c
@@ -137,11 +137,22 @@
 	raw_spin_lock_irqsave(&irqd->lock, flags);
 
 	sm = irqd->sourcecfg & APLIC_SOURCECFG_SM_MASK;
-	if (!pending &&
-	    ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
-	     (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)))
+	if (sm == APLIC_SOURCECFG_SM_INACTIVE)
 		goto skip_write_pending;
 
+	if (sm == APLIC_SOURCECFG_SM_LEVEL_HIGH ||
+	    sm == APLIC_SOURCECFG_SM_LEVEL_LOW) {
+		if (!pending)
+			goto noskip_write_pending;
+		if ((irqd->state & APLIC_IRQ_STATE_INPUT) &&
+		    sm == APLIC_SOURCECFG_SM_LEVEL_LOW)
+			goto skip_write_pending;
+		if (!(irqd->state & APLIC_IRQ_STATE_INPUT) &&
+		    sm == APLIC_SOURCECFG_SM_LEVEL_HIGH)
+			goto skip_write_pending;
+	}
+
+noskip_write_pending:
 	if (pending)
 		irqd->state |= APLIC_IRQ_STATE_PENDING;
 	else
@@ -187,16 +198,31 @@
 
 static bool aplic_read_input(struct aplic *aplic, u32 irq)
 {
-	bool ret;
-	unsigned long flags;
+	u32 sourcecfg, sm, raw_input, irq_inverted;
 	struct aplic_irq *irqd;
+	unsigned long flags;
+	bool ret = false;
 
 	if (!irq || aplic->nr_irqs <= irq)
 		return false;
 	irqd = &aplic->irqs[irq];
 
 	raw_spin_lock_irqsave(&irqd->lock, flags);
-	ret = (irqd->state & APLIC_IRQ_STATE_INPUT) ? true : false;
+
+	sourcecfg = irqd->sourcecfg;
+	if (sourcecfg & APLIC_SOURCECFG_D)
+		goto skip;
+
+	sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
+	if (sm == APLIC_SOURCECFG_SM_INACTIVE)
+		goto skip;
+
+	raw_input = (irqd->state & APLIC_IRQ_STATE_INPUT) ? 1 : 0;
+	irq_inverted = (sm == APLIC_SOURCECFG_SM_LEVEL_LOW ||
+			sm == APLIC_SOURCECFG_SM_EDGE_FALL) ? 1 : 0;
+	ret = !!(raw_input ^ irq_inverted);
+
+skip:
 	raw_spin_unlock_irqrestore(&irqd->lock, flags);
 
 	return ret;
--- linux-qcom-6.8.0.orig/arch/riscv/kvm/aia_device.c
+++ linux-qcom-6.8.0/arch/riscv/kvm/aia_device.c
@@ -237,10 +237,11 @@
 
 static u32 aia_imsic_hart_index(struct kvm_aia *aia, gpa_t addr)
 {
-	u32 hart, group = 0;
+	u32 hart = 0, group = 0;
 
-	hart = (addr >> (aia->nr_guest_bits + IMSIC_MMIO_PAGE_SHIFT)) &
-		GENMASK_ULL(aia->nr_hart_bits - 1, 0);
+	if (aia->nr_hart_bits)
+		hart = (addr >> (aia->nr_guest_bits + IMSIC_MMIO_PAGE_SHIFT)) &
+		       GENMASK_ULL(aia->nr_hart_bits - 1, 0);
 	if (aia->nr_group_bits)
 		group = (addr >> aia->nr_group_shift) &
 			GENMASK_ULL(aia->nr_group_bits - 1, 0);
--- linux-qcom-6.8.0.orig/arch/riscv/kvm/aia_imsic.c
+++ linux-qcom-6.8.0/arch/riscv/kvm/aia_imsic.c
@@ -55,7 +55,7 @@
 	/* IMSIC SW-file */
 	struct imsic_mrif *swfile;
 	phys_addr_t swfile_pa;
-	spinlock_t swfile_extirq_lock;
+	raw_spinlock_t swfile_extirq_lock;
 };
 
 #define imsic_vs_csr_read(__c)			\
@@ -622,7 +622,7 @@
 	 * interruptions between reading topei and updating pending status.
 	 */
 
-	spin_lock_irqsave(&imsic->swfile_extirq_lock, flags);
+	raw_spin_lock_irqsave(&imsic->swfile_extirq_lock, flags);
 
 	if (imsic_mrif_atomic_read(mrif, &mrif->eidelivery) &&
 	    imsic_mrif_topei(mrif, imsic->nr_eix, imsic->nr_msis))
@@ -630,7 +630,7 @@
 	else
 		kvm_riscv_vcpu_unset_interrupt(vcpu, IRQ_VS_EXT);
 
-	spin_unlock_irqrestore(&imsic->swfile_extirq_lock, flags);
+	raw_spin_unlock_irqrestore(&imsic->swfile_extirq_lock, flags);
 }
 
 static void imsic_swfile_read(struct kvm_vcpu *vcpu, bool clear,
@@ -1051,7 +1051,7 @@
 	}
 	imsic->swfile = page_to_virt(swfile_page);
 	imsic->swfile_pa = page_to_phys(swfile_page);
-	spin_lock_init(&imsic->swfile_extirq_lock);
+	raw_spin_lock_init(&imsic->swfile_extirq_lock);
 
 	/* Setup IO device */
 	kvm_iodevice_init(&imsic->iodev, &imsic_iodoev_ops);
--- linux-qcom-6.8.0.orig/arch/riscv/kvm/vcpu_insn.c
+++ linux-qcom-6.8.0/arch/riscv/kvm/vcpu_insn.c
@@ -7,6 +7,8 @@
 #include <linux/bitops.h>
 #include <linux/kvm_host.h>
 
+#include <asm/cpufeature.h>
+
 #define INSN_OPCODE_MASK	0x007c
 #define INSN_OPCODE_SHIFT	2
 #define INSN_OPCODE_SYSTEM	28
@@ -213,9 +215,20 @@
 		    unsigned long wr_mask);
 };
 
+static int seed_csr_rmw(struct kvm_vcpu *vcpu, unsigned int csr_num,
+			unsigned long *val, unsigned long new_val,
+			unsigned long wr_mask)
+{
+	if (!riscv_isa_extension_available(vcpu->arch.isa, ZKR))
+		return KVM_INSN_ILLEGAL_TRAP;
+
+	return KVM_INSN_EXIT_TO_USER_SPACE;
+}
+
 static const struct csr_func csr_funcs[] = {
 	KVM_RISCV_VCPU_AIA_CSR_FUNCS
 	KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS
+	{ .base = CSR_SEED, .count = 1, .func = seed_csr_rmw },
 };
 
 /**
--- linux-qcom-6.8.0.orig/arch/riscv/kvm/vcpu_onereg.c
+++ linux-qcom-6.8.0/arch/riscv/kvm/vcpu_onereg.c
@@ -714,9 +714,9 @@
 	switch (reg_subtype) {
 	case KVM_REG_RISCV_ISA_SINGLE:
 		return riscv_vcpu_set_isa_ext_single(vcpu, reg_num, reg_val);
-	case KVM_REG_RISCV_SBI_MULTI_EN:
+	case KVM_REG_RISCV_ISA_MULTI_EN:
 		return riscv_vcpu_set_isa_ext_multi(vcpu, reg_num, reg_val, true);
-	case KVM_REG_RISCV_SBI_MULTI_DIS:
+	case KVM_REG_RISCV_ISA_MULTI_DIS:
 		return riscv_vcpu_set_isa_ext_multi(vcpu, reg_num, reg_val, false);
 	default:
 		return -ENOENT;
--- linux-qcom-6.8.0.orig/arch/riscv/kvm/vcpu_pmu.c
+++ linux-qcom-6.8.0/arch/riscv/kvm/vcpu_pmu.c
@@ -39,7 +39,7 @@
 	u64 sample_period;
 
 	if (!pmc->counter_val)
-		sample_period = counter_val_mask + 1;
+		sample_period = counter_val_mask;
 	else
 		sample_period = (-pmc->counter_val) & counter_val_mask;
 
--- linux-qcom-6.8.0.orig/arch/riscv/kvm/vcpu_sbi.c
+++ linux-qcom-6.8.0/arch/riscv/kvm/vcpu_sbi.c
@@ -127,8 +127,8 @@
 	run->riscv_sbi.args[3] = cp->a3;
 	run->riscv_sbi.args[4] = cp->a4;
 	run->riscv_sbi.args[5] = cp->a5;
-	run->riscv_sbi.ret[0] = cp->a0;
-	run->riscv_sbi.ret[1] = cp->a1;
+	run->riscv_sbi.ret[0] = SBI_ERR_NOT_SUPPORTED;
+	run->riscv_sbi.ret[1] = 0;
 }
 
 void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu,
@@ -483,19 +483,22 @@
 	struct kvm_vcpu_sbi_context *scontext = &vcpu->arch.sbi_context;
 	const struct kvm_riscv_sbi_extension_entry *entry;
 	const struct kvm_vcpu_sbi_extension *ext;
-	int i;
+	int idx, i;
 
 	for (i = 0; i < ARRAY_SIZE(sbi_ext); i++) {
 		entry = &sbi_ext[i];
 		ext = entry->ext_ptr;
+		idx = entry->ext_idx;
+
+		if (idx < 0 || idx >= ARRAY_SIZE(scontext->ext_status))
+			continue;
 
 		if (ext->probe && !ext->probe(vcpu)) {
-			scontext->ext_status[entry->ext_idx] =
-				KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE;
+			scontext->ext_status[idx] = KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE;
 			continue;
 		}
 
-		scontext->ext_status[entry->ext_idx] = ext->default_disabled ?
+		scontext->ext_status[idx] = ext->default_disabled ?
 					KVM_RISCV_SBI_EXT_STATUS_DISABLED :
 					KVM_RISCV_SBI_EXT_STATUS_ENABLED;
 	}
--- linux-qcom-6.8.0.orig/arch/riscv/lib/Makefile
+++ linux-qcom-6.8.0/arch/riscv/lib/Makefile
@@ -3,9 +3,11 @@
 lib-y			+= memcpy.o
 lib-y			+= memset.o
 lib-y			+= memmove.o
+ifeq ($(CONFIG_KASAN_GENERIC)$(CONFIG_KASAN_SW_TAGS),)
 lib-y			+= strcmp.o
 lib-y			+= strlen.o
 lib-y			+= strncmp.o
+endif
 lib-y			+= csum.o
 ifeq ($(CONFIG_MMU), y)
 lib-$(CONFIG_RISCV_ISA_V)	+= uaccess_vector.o
--- linux-qcom-6.8.0.orig/arch/riscv/lib/strcmp.S
+++ linux-qcom-6.8.0/arch/riscv/lib/strcmp.S
@@ -120,3 +120,4 @@
 .option pop
 #endif
 SYM_FUNC_END(strcmp)
+EXPORT_SYMBOL(strcmp)
--- linux-qcom-6.8.0.orig/arch/riscv/lib/strlen.S
+++ linux-qcom-6.8.0/arch/riscv/lib/strlen.S
@@ -131,3 +131,4 @@
 #endif
 SYM_FUNC_END(strlen)
 SYM_FUNC_ALIAS(__pi_strlen, strlen)
+EXPORT_SYMBOL(strlen)
--- linux-qcom-6.8.0.orig/arch/riscv/lib/strncmp.S
+++ linux-qcom-6.8.0/arch/riscv/lib/strncmp.S
@@ -136,3 +136,4 @@
 .option pop
 #endif
 SYM_FUNC_END(strncmp)
+EXPORT_SYMBOL(strncmp)
--- linux-qcom-6.8.0.orig/arch/riscv/mm/context.c
+++ linux-qcom-6.8.0/arch/riscv/mm/context.c
@@ -323,6 +323,8 @@
 	if (unlikely(prev == next))
 		return;
 
+	membarrier_arch_switch_mm(prev, next, task);
+
 	/*
 	 * Mark the current MM context as inactive, and the next as
 	 * active.  This is at least used by the icache flushing
--- linux-qcom-6.8.0.orig/arch/riscv/mm/fault.c
+++ linux-qcom-6.8.0/arch/riscv/mm/fault.c
@@ -61,26 +61,27 @@
 
 static inline void mm_fault_error(struct pt_regs *regs, unsigned long addr, vm_fault_t fault)
 {
+	if (!user_mode(regs)) {
+		no_context(regs, addr);
+		return;
+	}
+
 	if (fault & VM_FAULT_OOM) {
 		/*
 		 * We ran out of memory, call the OOM killer, and return the userspace
 		 * (which will retry the fault, or kill us if we got oom-killed).
 		 */
-		if (!user_mode(regs)) {
-			no_context(regs, addr);
-			return;
-		}
 		pagefault_out_of_memory();
 		return;
 	} else if (fault & (VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE)) {
 		/* Kernel mode? Handle exceptions or die */
-		if (!user_mode(regs)) {
-			no_context(regs, addr);
-			return;
-		}
 		do_trap(regs, SIGBUS, BUS_ADRERR, addr);
 		return;
+	} else if (fault & VM_FAULT_SIGSEGV) {
+		do_trap(regs, SIGSEGV, SEGV_MAPERR, addr);
+		return;
 	}
+
 	BUG();
 }
 
--- linux-qcom-6.8.0.orig/arch/riscv/mm/init.c
+++ linux-qcom-6.8.0/arch/riscv/mm/init.c
@@ -32,6 +32,7 @@
 #include <asm/ptdump.h>
 #include <asm/sections.h>
 #include <asm/soc.h>
+#include <asm/sparsemem.h>
 #include <asm/tlbflush.h>
 
 #include "../kernel/head.h"
@@ -59,6 +60,13 @@
 phys_addr_t phys_ram_base __ro_after_init;
 EXPORT_SYMBOL(phys_ram_base);
 
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
+#define VMEMMAP_ADDR_ALIGN	(1ULL << SECTION_SIZE_BITS)
+
+unsigned long vmemmap_start_pfn __ro_after_init;
+EXPORT_SYMBOL(vmemmap_start_pfn);
+#endif
+
 unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
 							__page_aligned_bss;
 EXPORT_SYMBOL(empty_zero_page);
@@ -219,37 +227,51 @@
 	 */
 	memblock_reserve(vmlinux_start, vmlinux_end - vmlinux_start);
 
-	phys_ram_end = memblock_end_of_DRAM();
-
 	/*
 	 * Make sure we align the start of the memory on a PMD boundary so that
 	 * at worst, we map the linear mapping with PMD mappings.
 	 */
-	if (!IS_ENABLED(CONFIG_XIP_KERNEL))
+	if (!IS_ENABLED(CONFIG_XIP_KERNEL)) {
 		phys_ram_base = memblock_start_of_DRAM() & PMD_MASK;
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
+		vmemmap_start_pfn = round_down(phys_ram_base, VMEMMAP_ADDR_ALIGN) >> PAGE_SHIFT;
+#endif
+	}
 
 	/*
 	 * In 64-bit, any use of __va/__pa before this point is wrong as we
 	 * did not know the start of DRAM before.
 	 */
-	if (IS_ENABLED(CONFIG_64BIT))
+	if (IS_ENABLED(CONFIG_64BIT) && IS_ENABLED(CONFIG_MMU))
 		kernel_map.va_pa_offset = PAGE_OFFSET - phys_ram_base;
 
 	/*
-	 * memblock allocator is not aware of the fact that last 4K bytes of
-	 * the addressable memory can not be mapped because of IS_ERR_VALUE
-	 * macro. Make sure that last 4k bytes are not usable by memblock
-	 * if end of dram is equal to maximum addressable memory.  For 64-bit
-	 * kernel, this problem can't happen here as the end of the virtual
-	 * address space is occupied by the kernel mapping then this check must
-	 * be done as soon as the kernel mapping base address is determined.
+	 * The size of the linear page mapping may restrict the amount of
+	 * usable RAM.
+	 */
+	if (IS_ENABLED(CONFIG_64BIT) && IS_ENABLED(CONFIG_MMU)) {
+		max_mapped_addr = __pa(PAGE_OFFSET) + KERN_VIRT_SIZE;
+		memblock_cap_memory_range(phys_ram_base,
+					  max_mapped_addr - phys_ram_base);
+	}
+
+	/*
+	 * Reserve physical address space that would be mapped to virtual
+	 * addresses greater than (void *)(-PAGE_SIZE) because:
+	 *  - This memory would overlap with ERR_PTR
+	 *  - This memory belongs to high memory, which is not supported
+	 *
+	 * This is not applicable to 64-bit kernel, because virtual addresses
+	 * after (void *)(-PAGE_SIZE) are not linearly mapped: they are
+	 * occupied by kernel mapping. Also it is unrealistic for high memory
+	 * to exist on 64-bit platforms.
 	 */
 	if (!IS_ENABLED(CONFIG_64BIT)) {
-		max_mapped_addr = __pa(~(ulong)0);
-		if (max_mapped_addr == (phys_ram_end - 1))
-			memblock_set_current_limit(max_mapped_addr - 4096);
+		max_mapped_addr = __va_to_pa_nodebug(-PAGE_SIZE);
+		memblock_reserve(max_mapped_addr, (phys_addr_t)-max_mapped_addr);
 	}
 
+	phys_ram_end = memblock_end_of_DRAM();
 	min_low_pfn = PFN_UP(phys_ram_base);
 	max_low_pfn = max_pfn = PFN_DOWN(phys_ram_end);
 	high_memory = (void *)(__va(PFN_PHYS(max_low_pfn)));
@@ -669,6 +691,9 @@
 static uintptr_t __init best_map_size(phys_addr_t pa, uintptr_t va,
 				      phys_addr_t size)
 {
+	if (debug_pagealloc_enabled())
+		return PAGE_SIZE;
+
 	if (pgtable_l5_enabled &&
 	    !(pa & (P4D_SIZE - 1)) && !(va & (P4D_SIZE - 1)) && size >= P4D_SIZE)
 		return P4D_SIZE;
@@ -824,6 +849,10 @@
 		disable_pgtable_l4();
 	}
 
+	/* UBUNTU: Force disable sv57 and fallback to sv48 */
+	if (pgtable_l5_enabled)
+		disable_pgtable_l5();
+
 	memset(early_pg_dir, 0, PAGE_SIZE);
 	memset(early_p4d, 0, PAGE_SIZE);
 	memset(early_pud, 0, PAGE_SIZE);
@@ -901,7 +930,7 @@
 				   PMD_SIZE, PAGE_KERNEL_EXEC);
 
 	/* Map the data in RAM */
-	end_va = kernel_map.virt_addr + XIP_OFFSET + kernel_map.size;
+	end_va = kernel_map.virt_addr + kernel_map.size;
 	for (va = kernel_map.virt_addr + XIP_OFFSET; va < end_va; va += PMD_SIZE)
 		create_pgd_mapping(pgdir, va,
 				   kernel_map.phys_addr + (va - (kernel_map.virt_addr + XIP_OFFSET)),
@@ -1069,8 +1098,11 @@
 	kernel_map.xiprom_sz = (uintptr_t)(&_exiprom) - (uintptr_t)(&_xiprom);
 
 	phys_ram_base = CONFIG_PHYS_RAM_BASE;
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
+	vmemmap_start_pfn = round_down(phys_ram_base, VMEMMAP_ADDR_ALIGN) >> PAGE_SHIFT;
+#endif
 	kernel_map.phys_addr = (uintptr_t)CONFIG_PHYS_RAM_BASE;
-	kernel_map.size = (uintptr_t)(&_end) - (uintptr_t)(&_sdata);
+	kernel_map.size = (uintptr_t)(&_end) - (uintptr_t)(&_start);
 
 	kernel_map.va_kernel_xip_pa_offset = kernel_map.virt_addr - kernel_map.xiprom;
 #else
@@ -1267,8 +1299,6 @@
 		if (start <= __pa(PAGE_OFFSET) &&
 		    __pa(PAGE_OFFSET) < end)
 			start = __pa(PAGE_OFFSET);
-		if (end >= __pa(PAGE_OFFSET) + memory_limit)
-			end = __pa(PAGE_OFFSET) + memory_limit;
 
 		create_linear_mapping_range(start, end, 0);
 	}
--- linux-qcom-6.8.0.orig/arch/riscv/mm/pageattr.c
+++ linux-qcom-6.8.0/arch/riscv/mm/pageattr.c
@@ -387,17 +387,33 @@
 }
 
 #ifdef CONFIG_DEBUG_PAGEALLOC
+static int debug_pagealloc_set_page(pte_t *pte, unsigned long addr, void *data)
+{
+	int enable = *(int *)data;
+
+	unsigned long val = pte_val(ptep_get(pte));
+
+	if (enable)
+		val |= _PAGE_PRESENT;
+	else
+		val &= ~_PAGE_PRESENT;
+
+	set_pte(pte, __pte(val));
+
+	return 0;
+}
+
 void __kernel_map_pages(struct page *page, int numpages, int enable)
 {
 	if (!debug_pagealloc_enabled())
 		return;
 
-	if (enable)
-		__set_memory((unsigned long)page_address(page), numpages,
-			     __pgprot(_PAGE_PRESENT), __pgprot(0));
-	else
-		__set_memory((unsigned long)page_address(page), numpages,
-			     __pgprot(0), __pgprot(_PAGE_PRESENT));
+	unsigned long start = (unsigned long)page_address(page);
+	unsigned long size = PAGE_SIZE * numpages;
+
+	apply_to_existing_page_range(&init_mm, start, size, debug_pagealloc_set_page, &enable);
+
+	flush_tlb_kernel_range(start, start + size);
 }
 #endif
 
--- linux-qcom-6.8.0.orig/arch/riscv/mm/tlbflush.c
+++ linux-qcom-6.8.0/arch/riscv/mm/tlbflush.c
@@ -7,29 +7,6 @@
 #include <asm/sbi.h>
 #include <asm/mmu_context.h>
 
-static inline void local_flush_tlb_all_asid(unsigned long asid)
-{
-	if (asid != FLUSH_TLB_NO_ASID)
-		__asm__ __volatile__ ("sfence.vma x0, %0"
-				:
-				: "r" (asid)
-				: "memory");
-	else
-		local_flush_tlb_all();
-}
-
-static inline void local_flush_tlb_page_asid(unsigned long addr,
-		unsigned long asid)
-{
-	if (asid != FLUSH_TLB_NO_ASID)
-		__asm__ __volatile__ ("sfence.vma %0, %1"
-				:
-				: "r" (addr), "r" (asid)
-				: "memory");
-	else
-		local_flush_tlb_page(addr);
-}
-
 /*
  * Flush entire TLB if number of entries to be flushed is greater
  * than the threshold below.
@@ -99,7 +76,7 @@
 	local_flush_tlb_range_asid(d->start, d->size, d->stride, d->asid);
 }
 
-static void __flush_tlb_range(struct cpumask *cmask, unsigned long asid,
+static void __flush_tlb_range(const struct cpumask *cmask, unsigned long asid,
 			      unsigned long start, unsigned long size,
 			      unsigned long stride)
 {
@@ -200,7 +177,7 @@
 
 void flush_tlb_kernel_range(unsigned long start, unsigned long end)
 {
-	__flush_tlb_range((struct cpumask *)cpu_online_mask, FLUSH_TLB_NO_ASID,
+	__flush_tlb_range(cpu_online_mask, FLUSH_TLB_NO_ASID,
 			  start, end - start, PAGE_SIZE);
 }
 
--- linux-qcom-6.8.0.orig/arch/riscv/net/bpf_jit_comp64.c
+++ linux-qcom-6.8.0/arch/riscv/net/bpf_jit_comp64.c
@@ -14,6 +14,8 @@
 #include "bpf_jit.h"
 
 #define RV_FENTRY_NINSNS 2
+/* imm that allows emit_imm to emit max count insns */
+#define RV_MAX_COUNT_IMM 0x7FFF7FF7FF7FF7FF
 
 #define RV_REG_TCC RV_REG_A6
 #define RV_REG_TCC_SAVED RV_REG_S6 /* Store A6 in S6 if program do calls */
@@ -516,33 +518,33 @@
 		break;
 	/* src_reg = atomic_fetch_<op>(dst_reg + off16, src_reg) */
 	case BPF_ADD | BPF_FETCH:
-		emit(is64 ? rv_amoadd_d(rs, rs, rd, 0, 0) :
-		     rv_amoadd_w(rs, rs, rd, 0, 0), ctx);
+		emit(is64 ? rv_amoadd_d(rs, rs, rd, 1, 1) :
+		     rv_amoadd_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;
 	case BPF_AND | BPF_FETCH:
-		emit(is64 ? rv_amoand_d(rs, rs, rd, 0, 0) :
-		     rv_amoand_w(rs, rs, rd, 0, 0), ctx);
+		emit(is64 ? rv_amoand_d(rs, rs, rd, 1, 1) :
+		     rv_amoand_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;
 	case BPF_OR | BPF_FETCH:
-		emit(is64 ? rv_amoor_d(rs, rs, rd, 0, 0) :
-		     rv_amoor_w(rs, rs, rd, 0, 0), ctx);
+		emit(is64 ? rv_amoor_d(rs, rs, rd, 1, 1) :
+		     rv_amoor_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;
 	case BPF_XOR | BPF_FETCH:
-		emit(is64 ? rv_amoxor_d(rs, rs, rd, 0, 0) :
-		     rv_amoxor_w(rs, rs, rd, 0, 0), ctx);
+		emit(is64 ? rv_amoxor_d(rs, rs, rd, 1, 1) :
+		     rv_amoxor_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;
 	/* src_reg = atomic_xchg(dst_reg + off16, src_reg); */
 	case BPF_XCHG:
-		emit(is64 ? rv_amoswap_d(rs, rs, rd, 0, 0) :
-		     rv_amoswap_w(rs, rs, rd, 0, 0), ctx);
+		emit(is64 ? rv_amoswap_d(rs, rs, rd, 1, 1) :
+		     rv_amoswap_w(rs, rs, rd, 1, 1), ctx);
 		if (!is64)
 			emit_zext_32(rs, ctx);
 		break;
@@ -555,8 +557,8 @@
 		     rv_lr_w(r0, 0, rd, 0, 0), ctx);
 		jmp_offset = ninsns_rvoff(8);
 		emit(rv_bne(RV_REG_T2, r0, jmp_offset >> 1), ctx);
-		emit(is64 ? rv_sc_d(RV_REG_T3, rs, rd, 0, 0) :
-		     rv_sc_w(RV_REG_T3, rs, rd, 0, 0), ctx);
+		emit(is64 ? rv_sc_d(RV_REG_T3, rs, rd, 0, 1) :
+		     rv_sc_w(RV_REG_T3, rs, rd, 0, 1), ctx);
 		jmp_offset = ninsns_rvoff(-6);
 		emit(rv_bne(RV_REG_T3, 0, jmp_offset >> 1), ctx);
 		emit(rv_fence(0x3, 0x3), ctx);
@@ -740,6 +742,9 @@
 	if (ret)
 		return ret;
 
+	/* store prog start time */
+	emit_mv(RV_REG_S1, RV_REG_A0, ctx);
+
 	/* if (__bpf_prog_enter(prog) == 0)
 	 *	goto skip_exec_of_prog;
 	 */
@@ -747,9 +752,6 @@
 	/* nop reserved for conditional jump */
 	emit(rv_nop(), ctx);
 
-	/* store prog start time */
-	emit_mv(RV_REG_S1, RV_REG_A0, ctx);
-
 	/* arg1: &args_off */
 	emit_addi(RV_REG_A0, RV_REG_FP, -args_off, ctx);
 	if (!p->jited)
@@ -922,7 +924,7 @@
 		orig_call += RV_FENTRY_NINSNS * 4;
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
-		emit_imm(RV_REG_A0, (const s64)im, ctx);
+		emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx);
 		ret = emit_call((const u64)__bpf_tramp_enter, true, ctx);
 		if (ret)
 			return ret;
@@ -983,7 +985,7 @@
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
 		im->ip_epilogue = ctx->insns + ctx->ninsns;
-		emit_imm(RV_REG_A0, (const s64)im, ctx);
+		emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx);
 		ret = emit_call((const u64)__bpf_tramp_exit, true, ctx);
 		if (ret)
 			goto out;
@@ -1052,6 +1054,7 @@
 {
 	int ret;
 	struct rv_jit_context ctx;
+	u32 size = image_end - image;
 
 	ctx.ninsns = 0;
 	/*
@@ -1065,11 +1068,16 @@
 	ctx.ro_insns = image;
 	ret = __arch_prepare_bpf_trampoline(im, m, tlinks, func_addr, flags, &ctx);
 	if (ret < 0)
-		return ret;
+		goto out;
 
-	bpf_flush_icache(ctx.insns, ctx.insns + ctx.ninsns);
+	if (WARN_ON(size < ninsns_rvoff(ctx.ninsns))) {
+		ret = -E2BIG;
+		goto out;
+	}
 
-	return ninsns_rvoff(ret);
+	bpf_flush_icache(image, image_end);
+out:
+	return ret < 0 ? ret : size;
 }
 
 int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
--- linux-qcom-6.8.0.orig/arch/riscv/purgatory/Makefile
+++ linux-qcom-6.8.0/arch/riscv/purgatory/Makefile
@@ -2,7 +2,9 @@
 OBJECT_FILES_NON_STANDARD := y
 
 purgatory-y := purgatory.o sha256.o entry.o string.o ctype.o memcpy.o memset.o
+ifeq ($(CONFIG_KASAN_GENERIC)$(CONFIG_KASAN_SW_TAGS),)
 purgatory-y += strcmp.o strlen.o strncmp.o
+endif
 
 targets += $(purgatory-y)
 PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
--- linux-qcom-6.8.0.orig/arch/riscv/purgatory/entry.S
+++ linux-qcom-6.8.0/arch/riscv/purgatory/entry.S
@@ -7,6 +7,7 @@
  * Author: Li Zhengyu (lizhengyu3@huawei.com)
  *
  */
+#include <asm/asm.h>
 #include <linux/linkage.h>
 
 .text
@@ -34,6 +35,7 @@
 
 .data
 
+.align LGREG
 SYM_DATA(riscv_kernel_entry, .quad 0)
 
 .end
--- linux-qcom-6.8.0.orig/arch/s390/Kconfig
+++ linux-qcom-6.8.0/arch/s390/Kconfig
@@ -82,7 +82,7 @@
 	select ARCH_HAS_STRICT_KERNEL_RWX
 	select ARCH_HAS_STRICT_MODULE_RWX
 	select ARCH_HAS_SYSCALL_WRAPPER
-	select ARCH_HAS_UBSAN_SANITIZE_ALL
+	select ARCH_HAS_UBSAN
 	select ARCH_HAS_VDSO_DATA
 	select ARCH_HAVE_NMI_SAFE_CMPXCHG
 	select ARCH_INLINE_READ_LOCK
@@ -113,6 +113,7 @@
 	select ARCH_INLINE_WRITE_UNLOCK_BH
 	select ARCH_INLINE_WRITE_UNLOCK_IRQ
 	select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
+	select ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE
 	select ARCH_STACKWALK
 	select ARCH_SUPPORTS_ATOMIC_RMW
 	select ARCH_SUPPORTS_DEBUG_PAGEALLOC
--- linux-qcom-6.8.0.orig/arch/s390/boot/startup.c
+++ linux-qcom-6.8.0/arch/s390/boot/startup.c
@@ -32,7 +32,6 @@
 unsigned long __bootdata(ident_map_size);
 
 u64 __bootdata_preserved(stfle_fac_list[16]);
-u64 __bootdata_preserved(alt_stfle_fac_list[16]);
 struct oldmem_data __bootdata_preserved(oldmem_data);
 
 struct machine_info machine;
@@ -385,8 +384,12 @@
 
 	/* vmlinux decompression is done, shrink reserved low memory */
 	physmem_reserve(RR_DECOMPRESSOR, 0, (unsigned long)_decompressor_end);
-	if (kaslr_enabled())
-		amode31_lma = randomize_within_range(vmlinux.amode31_size, PAGE_SIZE, 0, SZ_2G);
+	if (kaslr_enabled()) {
+		unsigned long amode31_min;
+
+		amode31_min = (unsigned long)_decompressor_end;
+		amode31_lma = randomize_within_range(vmlinux.amode31_size, PAGE_SIZE, amode31_min, SZ_2G);
+	}
 	amode31_lma = amode31_lma ?: vmlinux.default_lma - vmlinux.amode31_size;
 	physmem_reserve(RR_AMODE31, amode31_lma, vmlinux.amode31_size);
 
--- linux-qcom-6.8.0.orig/arch/s390/boot/vmem.c
+++ linux-qcom-6.8.0/arch/s390/boot/vmem.c
@@ -366,7 +366,7 @@
 			}
 			pmd = boot_crst_alloc(_SEGMENT_ENTRY_EMPTY);
 			pud_populate(&init_mm, pud, pmd);
-		} else if (pud_large(*pud)) {
+		} else if (pud_leaf(*pud)) {
 			continue;
 		}
 		pgtable_pmd_populate(pud, addr, next, mode);
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/cpacf.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/cpacf.h
@@ -166,28 +166,86 @@
 
 typedef struct { unsigned char bytes[16]; } cpacf_mask_t;
 
-/**
- * cpacf_query() - check if a specific CPACF function is available
- * @opcode: the opcode of the crypto instruction
- * @func: the function code to test for
- *
- * Executes the query function for the given crypto instruction @opcode
- * and checks if @func is available
- *
- * Returns 1 if @func is available for @opcode, 0 otherwise
+/*
+ * Prototype for a not existing function to produce a link
+ * error if __cpacf_query() or __cpacf_check_opcode() is used
+ * with an invalid compile time const opcode.
  */
-static __always_inline void __cpacf_query(unsigned int opcode, cpacf_mask_t *mask)
+void __cpacf_bad_opcode(void);
+
+static __always_inline void __cpacf_query_rre(u32 opc, u8 r1, u8 r2,
+					      cpacf_mask_t *mask)
 {
 	asm volatile(
-		"	lghi	0,0\n" /* query function */
-		"	lgr	1,%[mask]\n"
-		"	spm	0\n" /* pckmo doesn't change the cc */
-		/* Parameter regs are ignored, but must be nonzero and unique */
-		"0:	.insn	rrf,%[opc] << 16,2,4,6,0\n"
-		"	brc	1,0b\n"	/* handle partial completion */
-		: "=m" (*mask)
-		: [mask] "d" ((unsigned long)mask), [opc] "i" (opcode)
-		: "cc", "0", "1");
+		"	la	%%r1,%[mask]\n"
+		"	xgr	%%r0,%%r0\n"
+		"	.insn	rre,%[opc] << 16,%[r1],%[r2]\n"
+		: [mask] "=R" (*mask)
+		: [opc] "i" (opc),
+		  [r1] "i" (r1), [r2] "i" (r2)
+		: "cc", "r0", "r1");
+}
+
+static __always_inline void __cpacf_query_rrf(u32 opc,
+					      u8 r1, u8 r2, u8 r3, u8 m4,
+					      cpacf_mask_t *mask)
+{
+	asm volatile(
+		"	la	%%r1,%[mask]\n"
+		"	xgr	%%r0,%%r0\n"
+		"	.insn	rrf,%[opc] << 16,%[r1],%[r2],%[r3],%[m4]\n"
+		: [mask] "=R" (*mask)
+		: [opc] "i" (opc), [r1] "i" (r1), [r2] "i" (r2),
+		  [r3] "i" (r3), [m4] "i" (m4)
+		: "cc", "r0", "r1");
+}
+
+static __always_inline void __cpacf_query(unsigned int opcode,
+					  cpacf_mask_t *mask)
+{
+	switch (opcode) {
+	case CPACF_KDSA:
+		__cpacf_query_rre(CPACF_KDSA, 0, 2, mask);
+		break;
+	case CPACF_KIMD:
+		__cpacf_query_rre(CPACF_KIMD, 0, 2, mask);
+		break;
+	case CPACF_KLMD:
+		__cpacf_query_rre(CPACF_KLMD, 0, 2, mask);
+		break;
+	case CPACF_KM:
+		__cpacf_query_rre(CPACF_KM, 2, 4, mask);
+		break;
+	case CPACF_KMA:
+		__cpacf_query_rrf(CPACF_KMA, 2, 4, 6, 0, mask);
+		break;
+	case CPACF_KMAC:
+		__cpacf_query_rre(CPACF_KMAC, 0, 2, mask);
+		break;
+	case CPACF_KMC:
+		__cpacf_query_rre(CPACF_KMC, 2, 4, mask);
+		break;
+	case CPACF_KMCTR:
+		__cpacf_query_rrf(CPACF_KMCTR, 2, 4, 6, 0, mask);
+		break;
+	case CPACF_KMF:
+		__cpacf_query_rre(CPACF_KMF, 2, 4, mask);
+		break;
+	case CPACF_KMO:
+		__cpacf_query_rre(CPACF_KMO, 2, 4, mask);
+		break;
+	case CPACF_PCC:
+		__cpacf_query_rre(CPACF_PCC, 0, 0, mask);
+		break;
+	case CPACF_PCKMO:
+		__cpacf_query_rre(CPACF_PCKMO, 0, 0, mask);
+		break;
+	case CPACF_PRNO:
+		__cpacf_query_rre(CPACF_PRNO, 2, 4, mask);
+		break;
+	default:
+		__cpacf_bad_opcode();
+	}
 }
 
 static __always_inline int __cpacf_check_opcode(unsigned int opcode)
@@ -211,10 +269,21 @@
 	case CPACF_KMA:
 		return test_facility(146);	/* check for MSA8 */
 	default:
-		BUG();
+		__cpacf_bad_opcode();
+		return 0;
 	}
 }
 
+/**
+ * cpacf_query() - check if a specific CPACF function is available
+ * @opcode: the opcode of the crypto instruction
+ * @func: the function code to test for
+ *
+ * Executes the query function for the given crypto instruction @opcode
+ * and checks if @func is available
+ *
+ * Returns 1 if @func is available for @opcode, 0 otherwise
+ */
 static __always_inline int cpacf_query(unsigned int opcode, cpacf_mask_t *mask)
 {
 	if (__cpacf_check_opcode(opcode)) {
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/dwarf.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/dwarf.h
@@ -9,6 +9,7 @@
 #define CFI_DEF_CFA_OFFSET	.cfi_def_cfa_offset
 #define CFI_ADJUST_CFA_OFFSET	.cfi_adjust_cfa_offset
 #define CFI_RESTORE		.cfi_restore
+#define CFI_REL_OFFSET		.cfi_rel_offset
 
 #ifdef CONFIG_AS_CFI_VAL_OFFSET
 #define CFI_VAL_OFFSET		.cfi_val_offset
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/entry-common.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/entry-common.h
@@ -55,7 +55,7 @@
 static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,
 						  unsigned long ti_work)
 {
-	choose_random_kstack_offset(get_tod_clock_fast() & 0xff);
+	choose_random_kstack_offset(get_tod_clock_fast());
 }
 
 #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/facility.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/facility.h
@@ -60,13 +60,15 @@
 	unsigned long facilities_als[] = { FACILITIES_ALS };
 
 	if (__builtin_constant_p(nr) && nr < sizeof(facilities_als) * 8) {
-		if (__test_facility(nr, &facilities_als))
-			return 1;
+		if (__test_facility(nr, &facilities_als)) {
+			if (!__is_defined(__DECOMPRESSOR))
+				return 1;
+		}
 	}
 	return __test_facility(nr, &stfle_fac_list);
 }
 
-static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size)
+static inline unsigned long __stfle_asm(u64 *fac_list, int size)
 {
 	unsigned long reg0 = size - 1;
 
@@ -74,7 +76,7 @@
 		"	lgr	0,%[reg0]\n"
 		"	.insn	s,0xb2b00000,%[list]\n" /* stfle */
 		"	lgr	%[reg0],0\n"
-		: [reg0] "+&d" (reg0), [list] "+Q" (*stfle_fac_list)
+		: [reg0] "+&d" (reg0), [list] "+Q" (*fac_list)
 		:
 		: "memory", "cc", "0");
 	return reg0;
@@ -82,10 +84,10 @@
 
 /**
  * stfle - Store facility list extended
- * @stfle_fac_list: array where facility list can be stored
+ * @fac_list: array where facility list can be stored
  * @size: size of passed in array in double words
  */
-static inline void __stfle(u64 *stfle_fac_list, int size)
+static inline void __stfle(u64 *fac_list, int size)
 {
 	unsigned long nr;
 	u32 stfl_fac_list;
@@ -94,20 +96,20 @@
 		"	stfl	0(0)\n"
 		: "=m" (S390_lowcore.stfl_fac_list));
 	stfl_fac_list = S390_lowcore.stfl_fac_list;
-	memcpy(stfle_fac_list, &stfl_fac_list, 4);
+	memcpy(fac_list, &stfl_fac_list, 4);
 	nr = 4; /* bytes stored by stfl */
 	if (stfl_fac_list & 0x01000000) {
 		/* More facility bits available with stfle */
-		nr = __stfle_asm(stfle_fac_list, size);
+		nr = __stfle_asm(fac_list, size);
 		nr = min_t(unsigned long, (nr + 1) * 8, size * 8);
 	}
-	memset((char *) stfle_fac_list + nr, 0, size * 8 - nr);
+	memset((char *)fac_list + nr, 0, size * 8 - nr);
 }
 
-static inline void stfle(u64 *stfle_fac_list, int size)
+static inline void stfle(u64 *fac_list, int size)
 {
 	preempt_disable();
-	__stfle(stfle_fac_list, size);
+	__stfle(fac_list, size);
 	preempt_enable();
 }
 
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/ftrace.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/ftrace.h
@@ -7,13 +7,24 @@
 #define MCOUNT_INSN_SIZE	6
 
 #ifndef __ASSEMBLY__
+#include <asm/stacktrace.h>
 
-#ifdef CONFIG_CC_IS_CLANG
-/* https://bugs.llvm.org/show_bug.cgi?id=41424 */
-#define ftrace_return_address(n) 0UL
-#else
-#define ftrace_return_address(n) __builtin_return_address(n)
-#endif
+static __always_inline unsigned long return_address(unsigned int n)
+{
+	struct stack_frame *sf;
+
+	if (!n)
+		return (unsigned long)__builtin_return_address(0);
+
+	sf = (struct stack_frame *)current_frame_address();
+	do {
+		sf = (struct stack_frame *)sf->back_chain;
+		if (!sf)
+			return 0;
+	} while (--n);
+	return sf->gprs[8];
+}
+#define ftrace_return_address(n) return_address(n)
 
 void ftrace_caller(void);
 
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/gmap.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/gmap.h
@@ -146,7 +146,7 @@
 
 void gmap_sync_dirty_log_pmd(struct gmap *gmap, unsigned long dirty_bitmap[4],
 			     unsigned long gaddr, unsigned long vmaddr);
-int gmap_mark_unmergeable(void);
+int s390_disable_cow_sharing(void);
 void s390_unlist_old_asce(struct gmap *gmap);
 int s390_replace_asce(struct gmap *gmap);
 void s390_uv_destroy_pfns(unsigned long count, unsigned long *pfns);
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/io.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/io.h
@@ -16,8 +16,10 @@
 #include <asm/pci_io.h>
 
 #define xlate_dev_mem_ptr xlate_dev_mem_ptr
+#define kc_xlate_dev_mem_ptr xlate_dev_mem_ptr
 void *xlate_dev_mem_ptr(phys_addr_t phys);
 #define unxlate_dev_mem_ptr unxlate_dev_mem_ptr
+#define kc_unxlate_dev_mem_ptr unxlate_dev_mem_ptr
 void unxlate_dev_mem_ptr(phys_addr_t phys, void *addr);
 
 #define IO_SPACE_LIMIT 0
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/ipl.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/ipl.h
@@ -139,6 +139,7 @@
 			     unsigned char flags, unsigned short cert);
 int ipl_report_add_certificate(struct ipl_report *report, void *key,
 			       unsigned long addr, unsigned long len);
+bool ipl_get_secureboot(void);
 
 /*
  * DIAG 308 support
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/kvm_host.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/kvm_host.h
@@ -427,6 +427,7 @@
 	u64 instruction_io_other;
 	u64 instruction_lpsw;
 	u64 instruction_lpswe;
+	u64 instruction_lpswey;
 	u64 instruction_pfmf;
 	u64 instruction_ptff;
 	u64 instruction_sck;
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/mmu.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/mmu.h
@@ -32,6 +32,11 @@
 	unsigned int uses_skeys:1;
 	/* The mmu context uses CMM. */
 	unsigned int uses_cmm:1;
+	/*
+	 * The mmu context allows COW-sharing of memory pages (KSM, zeropage).
+	 * Note that COW-sharing during fork() is currently always allowed.
+	 */
+	unsigned int allow_cow_sharing:1;
 	/* The gmaps associated with this context are allowed to use huge pages. */
 	unsigned int allow_gmap_hpage_1m:1;
 } mm_context_t;
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/mmu_context.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/mmu_context.h
@@ -35,6 +35,7 @@
 	mm->context.has_pgste = 0;
 	mm->context.uses_skeys = 0;
 	mm->context.uses_cmm = 0;
+	mm->context.allow_cow_sharing = 1;
 	mm->context.allow_gmap_hpage_1m = 0;
 #endif
 	switch (mm->context.asce_limit) {
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/pci.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/pci.h
@@ -96,7 +96,6 @@
 	u8		size;		/* order 2 exponent */
 };
 
-struct s390_domain;
 struct kvm_zdev;
 
 #define ZPCI_FUNCTIONS_PER_BUS 256
@@ -107,9 +106,10 @@
 	struct list_head	resources;
 	struct list_head	bus_next;
 	struct resource		bus_resource;
-	int			pchid;
+	int			topo;		/* TID if topo_is_tid, PCHID otherwise */
 	int			domain_nr;
-	bool			multifunction;
+	u8			multifunction	: 1;
+	u8			topo_is_tid	: 1;
 	enum pci_bus_speed	max_bus_speed;
 };
 
@@ -129,6 +129,8 @@
 	u16		vfn;		/* virtual function number */
 	u16		pchid;		/* physical channel ID */
 	u16		maxstbl;	/* Maximum store block size */
+	u16		rid;		/* RID as supplied by firmware */
+	u16		tid;		/* Topology for which RID is valid */
 	u8		pfgid;		/* function group ID */
 	u8		pft;		/* pci function type */
 	u8		port;
@@ -139,7 +141,8 @@
 	u8		is_physfn	: 1;
 	u8		util_str_avail	: 1;
 	u8		irqs_registered	: 1;
-	u8		reserved	: 2;
+	u8		tid_avail	: 1;
+	u8		reserved	: 1;
 	unsigned int	devfn;		/* DEVFN part of the RID*/
 
 	struct mutex lock;
@@ -180,9 +183,10 @@
 	struct dentry	*debugfs_dev;
 
 	/* IOMMU and passthrough */
-	struct s390_domain *s390_domain; /* s390 IOMMU domain data */
+	struct iommu_domain *s390_domain; /* attached IOMMU domain */
 	struct kvm_zdev *kzdev;
 	struct mutex kzdev_lock;
+	spinlock_t dom_lock;		/* protect s390_domain change */
 };
 
 static inline bool zdev_enabled(struct zpci_dev *zdev)
@@ -202,12 +206,14 @@
 ----------------------------------------------------------------------------- */
 /* Base stuff */
 struct zpci_dev *zpci_create_device(u32 fid, u32 fh, enum zpci_state state);
+int zpci_add_device(struct zpci_dev *zdev);
 int zpci_enable_device(struct zpci_dev *);
 int zpci_disable_device(struct zpci_dev *);
 int zpci_scan_configured_device(struct zpci_dev *zdev, u32 fh);
 int zpci_deconfigure_device(struct zpci_dev *zdev);
 void zpci_device_reserved(struct zpci_dev *zdev);
 bool zpci_is_device_configured(struct zpci_dev *zdev);
+int zpci_scan_devices(void);
 
 int zpci_hot_reset_device(struct zpci_dev *zdev);
 int zpci_register_ioat(struct zpci_dev *, u8, u64, u64, u64, u8 *);
@@ -217,7 +223,7 @@
 
 /* CLP */
 int clp_setup_writeback_mio(void);
-int clp_scan_pci_devices(void);
+int clp_scan_pci_devices(struct list_head *scan_list);
 int clp_query_pci_fn(struct zpci_dev *zdev);
 int clp_enable_fh(struct zpci_dev *zdev, u32 *fh, u8 nr_dma_as);
 int clp_disable_fh(struct zpci_dev *zdev, u32 *fh);
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/pci_clp.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/pci_clp.h
@@ -110,7 +110,8 @@
 struct clp_rsp_query_pci {
 	struct clp_rsp_hdr hdr;
 	u16 vfn;			/* virtual fn number */
-	u16			:  3;
+	u16			:  2;
+	u16 tid_avail		:  1;
 	u16 rid_avail		:  1;
 	u16 is_physfn		:  1;
 	u16 reserved1		:  1;
@@ -130,8 +131,9 @@
 	u64 edma;			/* end dma as */
 #define ZPCI_RID_MASK_DEVFN 0x00ff
 	u16 rid;			/* BUS/DEVFN PCI address */
-	u16 reserved0;
-	u32 reserved[10];
+	u32 reserved0;
+	u16 tid;
+	u32 reserved[9];
 	u32 uid;			/* user defined id */
 	u8 util_str[CLP_UTIL_STR_LEN];	/* utility string */
 	u32 reserved2[16];
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/perf_event.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/perf_event.h
@@ -73,6 +73,7 @@
 #define SAMPLE_FREQ_MODE(hwc)	(SAMPL_FLAGS(hwc) & PERF_CPUM_SF_FREQ_MODE)
 
 #define perf_arch_fetch_caller_regs(regs, __ip) do {			\
+	(regs)->psw.mask = 0;						\
 	(regs)->psw.addr = (__ip);					\
 	(regs)->gprs[15] = (unsigned long)__builtin_frame_address(0) -	\
 		offsetof(struct stack_frame, back_chain);		\
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/pgtable.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/pgtable.h
@@ -566,10 +566,20 @@
 }
 
 /*
- * In the case that a guest uses storage keys
- * faults should no longer be backed by zero pages
+ * As soon as the guest uses storage keys or enables PV, we deduplicate all
+ * mapped shared zeropages and prevent new shared zeropages from getting
+ * mapped.
  */
-#define mm_forbids_zeropage mm_has_pgste
+#define mm_forbids_zeropage mm_forbids_zeropage
+static inline int mm_forbids_zeropage(struct mm_struct *mm)
+{
+#ifdef CONFIG_PGSTE
+	if (!mm->context.allow_cow_sharing)
+		return 1;
+#endif
+	return 0;
+}
+
 static inline int mm_uses_skeys(struct mm_struct *mm)
 {
 #ifdef CONFIG_PGSTE
@@ -730,7 +740,7 @@
 {
 	unsigned long type = pud_val(pud) & _REGION_ENTRY_TYPE_MASK;
 
-	if (type > _REGION_ENTRY_TYPE_R3 || pud_large(pud))
+	if (type > _REGION_ENTRY_TYPE_R3 || pud_leaf(pud))
 		return 1;
 	if (type < _REGION_ENTRY_TYPE_R3)
 		return 0;
@@ -1398,7 +1408,7 @@
 	unsigned long origin_mask;
 
 	origin_mask = _REGION_ENTRY_ORIGIN;
-	if (pud_large(pud))
+	if (pud_leaf(pud))
 		origin_mask = _REGION3_ENTRY_ORIGIN_LARGE;
 	return (unsigned long)__va(pud_val(pud) & origin_mask);
 }
@@ -1766,8 +1776,10 @@
 static inline pmd_t pmdp_invalidate(struct vm_area_struct *vma,
 				   unsigned long addr, pmd_t *pmdp)
 {
-	pmd_t pmd = __pmd(pmd_val(*pmdp) | _SEGMENT_ENTRY_INVALID);
+	pmd_t pmd;
 
+	VM_WARN_ON_ONCE(!pmd_present(*pmdp));
+	pmd = __pmd(pmd_val(*pmdp) | _SEGMENT_ENTRY_INVALID);
 	return pmdp_xchg_direct(vma->vm_mm, addr, pmdp, pmd);
 }
 
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/processor.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/processor.h
@@ -99,6 +99,7 @@
 
 extern const struct seq_operations cpuinfo_op;
 extern void execve_tail(void);
+unsigned long vdso_text_size(void);
 unsigned long vdso_size(void);
 
 /*
@@ -303,8 +304,8 @@
  */
 static __always_inline void __load_psw_mask(unsigned long mask)
 {
+	psw_t psw __uninitialized;
 	unsigned long addr;
-	psw_t psw;
 
 	psw.mask = mask;
 
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/set_memory.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/set_memory.h
@@ -62,5 +62,6 @@
 
 int set_direct_map_invalid_noflush(struct page *page);
 int set_direct_map_default_noflush(struct page *page);
+bool kernel_page_present(struct page *page);
 
 #endif
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/stacktrace.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/stacktrace.h
@@ -2,6 +2,7 @@
 #ifndef _ASM_S390_STACKTRACE_H
 #define _ASM_S390_STACKTRACE_H
 
+#include <linux/stacktrace.h>
 #include <linux/uaccess.h>
 #include <linux/ptrace.h>
 #include <asm/switch_to.h>
@@ -13,6 +14,17 @@
 	unsigned long empty2[4];
 };
 
+struct stack_frame_vdso_wrapper {
+	struct stack_frame_user sf;
+	unsigned long return_address;
+};
+
+struct perf_callchain_entry_ctx;
+
+void arch_stack_walk_user_common(stack_trace_consume_fn consume_entry, void *cookie,
+				 struct perf_callchain_entry_ctx *entry,
+				 const struct pt_regs *regs, bool perf);
+
 enum stack_type {
 	STACK_TYPE_UNKNOWN,
 	STACK_TYPE_TASK,
--- linux-qcom-6.8.0.orig/arch/s390/include/asm/uv.h
+++ linux-qcom-6.8.0/arch/s390/include/asm/uv.h
@@ -442,7 +442,10 @@
 
 	if (!uv_call(0, (u64)&uvcb))
 		return 0;
-	return -EINVAL;
+	pr_err("%s UVC failed (rc: 0x%x, rrc: 0x%x), possible hypervisor bug.\n",
+	       uvcb.header.cmd == UVC_CMD_SET_SHARED_ACCESS ? "Share" : "Unshare",
+	       uvcb.header.rc, uvcb.header.rrc);
+	panic("System security cannot be guaranteed unless the system panics now.\n");
 }
 
 /*
--- linux-qcom-6.8.0.orig/arch/s390/kernel/Makefile
+++ linux-qcom-6.8.0/arch/s390/kernel/Makefile
@@ -11,6 +11,8 @@
 # Do not trace early setup code
 CFLAGS_REMOVE_early.o		= $(CC_FLAGS_FTRACE)
 CFLAGS_REMOVE_rethook.o		= $(CC_FLAGS_FTRACE)
+CFLAGS_REMOVE_stacktrace.o	= $(CC_FLAGS_FTRACE)
+CFLAGS_REMOVE_unwind_bc.o	= $(CC_FLAGS_FTRACE)
 
 endif
 
@@ -34,7 +36,7 @@
 CFLAGS_dumpstack.o	+= -fno-optimize-sibling-calls
 CFLAGS_unwind_bc.o	+= -fno-optimize-sibling-calls
 
-obj-y	:= head64.o traps.o time.o process.o earlypgm.o early.o setup.o idle.o vtime.o
+obj-y	:= head64.o traps.o time.o process.o early.o setup.o idle.o vtime.o
 obj-y	+= processor.o syscall.o ptrace.o signal.o cpcmd.o ebcdic.o nmi.o
 obj-y	+= debug.o irq.o ipl.o dis.o diag.o vdso.o cpufeature.o
 obj-y	+= sysinfo.o lgr.o os_info.o ctlreg.o
--- linux-qcom-6.8.0.orig/arch/s390/kernel/asm-offsets.c
+++ linux-qcom-6.8.0/arch/s390/kernel/asm-offsets.c
@@ -66,6 +66,11 @@
 	OFFSET(__SF_SIE_CONTROL_PHYS, stack_frame, sie_control_block_phys);
 	DEFINE(STACK_FRAME_OVERHEAD, sizeof(struct stack_frame));
 	BLANK();
+	OFFSET(__SFUSER_BACKCHAIN, stack_frame_user, back_chain);
+	DEFINE(STACK_FRAME_USER_OVERHEAD, sizeof(struct stack_frame_user));
+	OFFSET(__SFVDSO_RETURN_ADDRESS, stack_frame_vdso_wrapper, return_address);
+	DEFINE(STACK_FRAME_VDSO_OVERHEAD, sizeof(struct stack_frame_vdso_wrapper));
+	BLANK();
 	/* idle data offsets */
 	OFFSET(__CLOCK_IDLE_ENTER, s390_idle_data, clock_idle_enter);
 	OFFSET(__TIMER_IDLE_ENTER, s390_idle_data, timer_idle_enter);
--- linux-qcom-6.8.0.orig/arch/s390/kernel/cache.c
+++ linux-qcom-6.8.0/arch/s390/kernel/cache.c
@@ -166,5 +166,6 @@
 			ci_leaf_init(this_leaf++, pvt, ctype, level, cpu);
 		}
 	}
+	this_cpu_ci->cpu_map_populated = true;
 	return 0;
 }
--- linux-qcom-6.8.0.orig/arch/s390/kernel/entry.S
+++ linux-qcom-6.8.0/arch/s390/kernel/entry.S
@@ -458,9 +458,13 @@
 SYM_CODE_END(\name)
 .endm
 
+	.section .irqentry.text, "ax"
+
 INT_HANDLER ext_int_handler,__LC_EXT_OLD_PSW,do_ext_irq
 INT_HANDLER io_int_handler,__LC_IO_OLD_PSW,do_io_irq
 
+	.section .kprobes.text, "ax"
+
 /*
  * Load idle PSW.
  */
@@ -621,6 +625,21 @@
 3:	j	3b
 SYM_CODE_END(restart_int_handler)
 
+SYM_CODE_START(early_pgm_check_handler)
+	stmg	%r8,%r15,__LC_SAVE_AREA_SYNC
+	aghi	%r15,-(STACK_FRAME_OVERHEAD+__PT_SIZE)
+	la	%r11,STACK_FRAME_OVERHEAD(%r15)
+	xc	__SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
+	stmg	%r0,%r7,__PT_R0(%r11)
+	mvc	__PT_PSW(16,%r11),__LC_PGM_OLD_PSW
+	mvc	__PT_R8(64,%r11),__LC_SAVE_AREA_SYNC
+	lgr	%r2,%r11
+	brasl	%r14,__do_early_pgm_check
+	mvc	__LC_RETURN_PSW(16),STACK_FRAME_OVERHEAD+__PT_PSW(%r15)
+	lmg	%r0,%r15,STACK_FRAME_OVERHEAD+__PT_R0(%r15)
+	lpswe	__LC_RETURN_PSW
+SYM_CODE_END(early_pgm_check_handler)
+
 	.section .kprobes.text, "ax"
 
 #if defined(CONFIG_CHECK_STACK) || defined(CONFIG_VMAP_STACK)
@@ -653,6 +672,7 @@
 SYM_DATA_END(daton_psw)
 
 	.section .rodata, "a"
+	.balign	8
 #define SYSCALL(esame,emu)	.quad __s390x_ ## esame
 SYM_DATA_START(sys_call_table)
 #include "asm/syscall_table.h"
--- linux-qcom-6.8.0.orig/arch/s390/kernel/ftrace.c
+++ linux-qcom-6.8.0/arch/s390/kernel/ftrace.c
@@ -296,6 +296,9 @@
 	struct kprobe *p;
 	int bit;
 
+	if (unlikely(kprobe_ftrace_disabled))
+		return;
+
 	bit = ftrace_test_recursion_trylock(ip, parent_ip);
 	if (bit < 0)
 		return;
--- linux-qcom-6.8.0.orig/arch/s390/kernel/ipl.c
+++ linux-qcom-6.8.0/arch/s390/kernel/ipl.c
@@ -962,8 +962,8 @@
 		scpdata_len += padding;
 	}
 
-	reipl_block_nvme->hdr.len = IPL_BP_FCP_LEN + scpdata_len;
-	reipl_block_nvme->nvme.len = IPL_BP0_FCP_LEN + scpdata_len;
+	reipl_block_nvme->hdr.len = IPL_BP_NVME_LEN + scpdata_len;
+	reipl_block_nvme->nvme.len = IPL_BP0_NVME_LEN + scpdata_len;
 	reipl_block_nvme->nvme.scp_data_len = scpdata_len;
 
 	return count;
@@ -1858,9 +1858,9 @@
 	}
 	dump_block_nvme->hdr.len = IPL_BP_NVME_LEN;
 	dump_block_nvme->hdr.version = IPL_PARM_BLOCK_VERSION;
-	dump_block_nvme->fcp.len = IPL_BP0_NVME_LEN;
-	dump_block_nvme->fcp.pbt = IPL_PBT_NVME;
-	dump_block_nvme->fcp.opt = IPL_PB0_NVME_OPT_DUMP;
+	dump_block_nvme->nvme.len = IPL_BP0_NVME_LEN;
+	dump_block_nvme->nvme.pbt = IPL_PBT_NVME;
+	dump_block_nvme->nvme.opt = IPL_PB0_NVME_OPT_DUMP;
 	dump_capabilities |= DUMP_TYPE_NVME;
 	return 0;
 }
@@ -2520,3 +2520,8 @@
 }
 
 #endif
+
+bool ipl_get_secureboot(void)
+{
+	return !!ipl_secure_flag;
+}
--- linux-qcom-6.8.0.orig/arch/s390/kernel/kprobes.c
+++ linux-qcom-6.8.0/arch/s390/kernel/kprobes.c
@@ -525,6 +525,12 @@
 	return 0;
 }
 
+int __init arch_populate_kprobe_blacklist(void)
+{
+	return kprobe_add_area_blacklist((unsigned long)__irqentry_text_start,
+					 (unsigned long)__irqentry_text_end);
+}
+
 int arch_trampoline_kprobe(struct kprobe *p)
 {
 	return 0;
--- linux-qcom-6.8.0.orig/arch/s390/kernel/perf_cpum_cf.c
+++ linux-qcom-6.8.0/arch/s390/kernel/perf_cpum_cf.c
@@ -428,7 +428,7 @@
 	case CPUMF_CTR_SET_CRYPTO:
 		if (cpumf_ctr_info.csvn >= 1 && cpumf_ctr_info.csvn <= 5)
 			ctrset_size = 16;
-		else if (cpumf_ctr_info.csvn == 6 || cpumf_ctr_info.csvn == 7)
+		else if (cpumf_ctr_info.csvn >= 6)
 			ctrset_size = 20;
 		break;
 	case CPUMF_CTR_SET_EXT:
@@ -556,25 +556,31 @@
 	struct cf_trailer_entry *trailer_start, *trailer_stop;
 	struct cf_ctrset_entry *ctrstart, *ctrstop;
 	size_t offset = 0;
+	int i;
 
-	auth &= (1 << CPUMF_LCCTL_ENABLE_SHIFT) - 1;
-	do {
+	for (i = CPUMF_CTR_SET_BASIC; i < CPUMF_CTR_SET_MAX; ++i) {
 		ctrstart = (struct cf_ctrset_entry *)(cpuhw->start + offset);
 		ctrstop = (struct cf_ctrset_entry *)(cpuhw->stop + offset);
 
+		/* Counter set not authorized */
+		if (!(auth & cpumf_ctr_ctl[i]))
+			continue;
+		/* Counter set size zero was not saved */
+		if (!cpum_cf_read_setsize(i))
+			continue;
+
 		if (memcmp(ctrstop, ctrstart, sizeof(*ctrstop))) {
 			pr_err_once("cpum_cf_diag counter set compare error "
 				    "in set %i\n", ctrstart->set);
 			return 0;
 		}
-		auth &= ~cpumf_ctr_ctl[ctrstart->set];
 		if (ctrstart->def == CF_DIAG_CTRSET_DEF) {
 			cfdiag_diffctrset((u64 *)(ctrstart + 1),
 					  (u64 *)(ctrstop + 1), ctrstart->ctr);
 			offset += ctrstart->ctr * sizeof(u64) +
 							sizeof(*ctrstart);
 		}
-	} while (ctrstart->def && auth);
+	}
 
 	/* Save time_stamp from start of event in stop's trailer */
 	trailer_start = (struct cf_trailer_entry *)(cpuhw->start + offset);
--- linux-qcom-6.8.0.orig/arch/s390/kernel/perf_cpum_cf_events.c
+++ linux-qcom-6.8.0/arch/s390/kernel/perf_cpum_cf_events.c
@@ -855,16 +855,11 @@
 	}
 
 	/* Determine version specific crypto set */
-	switch (ci.csvn) {
-	case 1 ... 5:
+	csvn = none;
+	if (ci.csvn >= 1 && ci.csvn <= 5)
 		csvn = cpumcf_svn_12345_pmu_event_attr;
-		break;
-	case 6 ... 7:
+	else if (ci.csvn >= 6)
 		csvn = cpumcf_svn_67_pmu_event_attr;
-		break;
-	default:
-		csvn = none;
-	}
 
 	/* Determine model-specific counter set(s) */
 	get_cpu_id(&cpu_id);
--- linux-qcom-6.8.0.orig/arch/s390/kernel/perf_cpum_sf.c
+++ linux-qcom-6.8.0/arch/s390/kernel/perf_cpum_sf.c
@@ -1463,7 +1463,7 @@
 	unsigned long range, i, range_scan, idx, head, base, offset;
 	struct hws_trailer_entry *te;
 
-	if (WARN_ON_ONCE(handle->head & ~PAGE_MASK))
+	if (handle->head & ~PAGE_MASK)
 		return -EINVAL;
 
 	aux->head = handle->head >> PAGE_SHIFT;
@@ -1642,7 +1642,7 @@
 	unsigned long num_sdb;
 
 	aux = perf_get_aux(handle);
-	if (WARN_ON_ONCE(!aux))
+	if (!aux)
 		return;
 
 	/* Inform user space new data arrived */
@@ -1661,7 +1661,7 @@
 				num_sdb);
 			break;
 		}
-		if (WARN_ON_ONCE(!aux))
+		if (!aux)
 			return;
 
 		/* Update head and alert_mark to new position */
@@ -1896,12 +1896,8 @@
 {
 	struct cpu_hw_sf *cpuhw = this_cpu_ptr(&cpu_hw_sf);
 
-	if (WARN_ON_ONCE(!(event->hw.state & PERF_HES_STOPPED)))
+	if (!(event->hw.state & PERF_HES_STOPPED))
 		return;
-
-	if (flags & PERF_EF_RELOAD)
-		WARN_ON_ONCE(!(event->hw.state & PERF_HES_UPTODATE));
-
 	perf_pmu_disable(event->pmu);
 	event->hw.state = 0;
 	cpuhw->lsctl.cs = 1;
@@ -1926,7 +1922,9 @@
 	event->hw.state |= PERF_HES_STOPPED;
 
 	if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) {
-		hw_perf_event_update(event, 1);
+		/* CPU hotplug off removes SDBs. No samples to extract. */
+		if (cpuhw->flags & PMU_F_RESERVED)
+			hw_perf_event_update(event, 1);
 		event->hw.state |= PERF_HES_UPTODATE;
 	}
 	perf_pmu_enable(event->pmu);
--- linux-qcom-6.8.0.orig/arch/s390/kernel/perf_event.c
+++ linux-qcom-6.8.0/arch/s390/kernel/perf_event.c
@@ -218,39 +218,7 @@
 void perf_callchain_user(struct perf_callchain_entry_ctx *entry,
 			 struct pt_regs *regs)
 {
-	struct stack_frame_user __user *sf;
-	unsigned long ip, sp;
-	bool first = true;
-
-	if (is_compat_task())
-		return;
-	perf_callchain_store(entry, instruction_pointer(regs));
-	sf = (void __user *)user_stack_pointer(regs);
-	pagefault_disable();
-	while (entry->nr < entry->max_stack) {
-		if (__get_user(sp, &sf->back_chain))
-			break;
-		if (__get_user(ip, &sf->gprs[8]))
-			break;
-		if (ip & 0x1) {
-			/*
-			 * If the instruction address is invalid, and this
-			 * is the first stack frame, assume r14 has not
-			 * been written to the stack yet. Otherwise exit.
-			 */
-			if (first && !(regs->gprs[14] & 0x1))
-				ip = regs->gprs[14];
-			else
-				break;
-		}
-		perf_callchain_store(entry, ip);
-		/* Sanity check: ABI requires SP to be aligned 8 bytes. */
-		if (!sp || sp & 0x7)
-			break;
-		sf = (void __user *)sp;
-		first = false;
-	}
-	pagefault_enable();
+	arch_stack_walk_user_common(NULL, NULL, entry, regs, true);
 }
 
 /* Perf definitions for PMU event attributes in sysfs */
--- linux-qcom-6.8.0.orig/arch/s390/kernel/perf_pai_crypto.c
+++ linux-qcom-6.8.0/arch/s390/kernel/perf_pai_crypto.c
@@ -90,7 +90,6 @@
 						 event->cpu);
 	struct paicrypt_map *cpump = mp->mapptr;
 
-	cpump->event = NULL;
 	static_branch_dec(&pai_key);
 	mutex_lock(&pai_reserve_mutex);
 	debug_sprintf_event(cfm_dbg, 5, "%s event %#llx cpu %d users %d"
@@ -348,10 +347,15 @@
 
 static void paicrypt_stop(struct perf_event *event, int flags)
 {
-	if (!event->attr.sample_period)	/* Counting */
+	struct paicrypt_mapptr *mp = this_cpu_ptr(paicrypt_root.mapptr);
+	struct paicrypt_map *cpump = mp->mapptr;
+
+	if (!event->attr.sample_period) {	/* Counting */
 		paicrypt_read(event);
-	else				/* Sampling */
+	} else {				/* Sampling */
 		perf_sched_cb_dec(event->pmu);
+		cpump->event = NULL;
+	}
 	event->hw.state = PERF_HES_STOPPED;
 }
 
@@ -721,7 +725,7 @@
 	for (i = 0; i < ARRAY_SIZE(paicrypt_ctrnames); i++) {
 		ret = attr_event_init_one(attrs, i);
 		if (ret) {
-			attr_event_free(attrs, i - 1);
+			attr_event_free(attrs, i);
 			return ret;
 		}
 	}
--- linux-qcom-6.8.0.orig/arch/s390/kernel/perf_pai_ext.c
+++ linux-qcom-6.8.0/arch/s390/kernel/perf_pai_ext.c
@@ -121,7 +121,6 @@
 	struct paiext_map *cpump = mp->mapptr;
 
 	mutex_lock(&paiext_reserve_mutex);
-	cpump->event = NULL;
 	if (refcount_dec_and_test(&cpump->refcnt))	/* Last reference gone */
 		paiext_free(mp);
 	paiext_root_free();
@@ -355,10 +354,15 @@
 
 static void paiext_stop(struct perf_event *event, int flags)
 {
-	if (!event->attr.sample_period)	/* Counting */
+	struct paiext_mapptr *mp = this_cpu_ptr(paiext_root.mapptr);
+	struct paiext_map *cpump = mp->mapptr;
+
+	if (!event->attr.sample_period) {	/* Counting */
 		paiext_read(event);
-	else				/* Sampling */
+	} else {				/* Sampling */
 		perf_sched_cb_dec(event->pmu);
+		cpump->event = NULL;
+	}
 	event->hw.state = PERF_HES_STOPPED;
 }
 
@@ -611,7 +615,7 @@
 	for (i = 0; i < ARRAY_SIZE(paiext_ctrnames); i++) {
 		ret = attr_event_init_one(attrs, i);
 		if (ret) {
-			attr_event_free(attrs, i - 1);
+			attr_event_free(attrs, i);
 			return ret;
 		}
 	}
--- linux-qcom-6.8.0.orig/arch/s390/kernel/setup.c
+++ linux-qcom-6.8.0/arch/s390/kernel/setup.c
@@ -51,6 +51,7 @@
 #include <linux/start_kernel.h>
 #include <linux/hugetlb.h>
 #include <linux/kmemleak.h>
+#include <linux/security.h>
 
 #include <asm/archrandom.h>
 #include <asm/boot_data.h>
@@ -155,7 +156,7 @@
 EXPORT_SYMBOL(zlib_dfltcc_support);
 u64 __bootdata_preserved(stfle_fac_list[16]);
 EXPORT_SYMBOL(stfle_fac_list);
-u64 __bootdata_preserved(alt_stfle_fac_list[16]);
+u64 alt_stfle_fac_list[16];
 struct oldmem_data __bootdata_preserved(oldmem_data);
 
 unsigned long VMALLOC_START;
@@ -891,6 +892,9 @@
 
 	log_component_list();
 
+	if (ipl_get_secureboot())
+		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);
+
 	/* Have one command line that is parsed and saved in /proc/cmdline */
 	/* boot_command_line has been already set up in early.c */
 	*cmdline_p = boot_command_line;
--- linux-qcom-6.8.0.orig/arch/s390/kernel/stacktrace.c
+++ linux-qcom-6.8.0/arch/s390/kernel/stacktrace.c
@@ -5,6 +5,7 @@
  *  Copyright IBM Corp. 2006
  */
 
+#include <linux/perf_event.h>
 #include <linux/stacktrace.h>
 #include <linux/uaccess.h>
 #include <linux/compat.h>
@@ -62,42 +63,102 @@
 	return 0;
 }
 
-void arch_stack_walk_user(stack_trace_consume_fn consume_entry, void *cookie,
-			  const struct pt_regs *regs)
+static inline bool store_ip(stack_trace_consume_fn consume_entry, void *cookie,
+			    struct perf_callchain_entry_ctx *entry, bool perf,
+			    unsigned long ip)
+{
+#ifdef CONFIG_PERF_EVENTS
+	if (perf) {
+		if (perf_callchain_store(entry, ip))
+			return false;
+		return true;
+	}
+#endif
+	return consume_entry(cookie, ip);
+}
+
+static inline bool ip_invalid(unsigned long ip)
 {
+	/*
+	 * Perform some basic checks if an instruction address taken
+	 * from unreliable source is invalid.
+	 */
+	if (ip & 1)
+		return true;
+	if (ip < mmap_min_addr)
+		return true;
+	if (ip >= current->mm->context.asce_limit)
+		return true;
+	return false;
+}
+
+static inline bool ip_within_vdso(unsigned long ip)
+{
+	return in_range(ip, current->mm->context.vdso_base, vdso_text_size());
+}
+
+void arch_stack_walk_user_common(stack_trace_consume_fn consume_entry, void *cookie,
+				 struct perf_callchain_entry_ctx *entry,
+				 const struct pt_regs *regs, bool perf)
+{
+	struct stack_frame_vdso_wrapper __user *sf_vdso;
 	struct stack_frame_user __user *sf;
 	unsigned long ip, sp;
 	bool first = true;
 
 	if (is_compat_task())
 		return;
-	if (!consume_entry(cookie, instruction_pointer(regs)))
+	if (!current->mm)
+		return;
+	ip = instruction_pointer(regs);
+	if (!store_ip(consume_entry, cookie, entry, perf, ip))
 		return;
 	sf = (void __user *)user_stack_pointer(regs);
 	pagefault_disable();
 	while (1) {
 		if (__get_user(sp, &sf->back_chain))
 			break;
-		if (__get_user(ip, &sf->gprs[8]))
+		/*
+		 * VDSO entry code has a non-standard stack frame layout.
+		 * See VDSO user wrapper code for details.
+		 */
+		if (!sp && ip_within_vdso(ip)) {
+			sf_vdso = (void __user *)sf;
+			if (__get_user(ip, &sf_vdso->return_address))
+				break;
+			sp = (unsigned long)sf + STACK_FRAME_VDSO_OVERHEAD;
+			sf = (void __user *)sp;
+			if (__get_user(sp, &sf->back_chain))
+				break;
+		} else {
+			sf = (void __user *)sp;
+			if (__get_user(ip, &sf->gprs[8]))
+				break;
+		}
+		/* Sanity check: ABI requires SP to be 8 byte aligned. */
+		if (sp & 0x7)
 			break;
-		if (ip & 0x1) {
+		if (ip_invalid(ip)) {
 			/*
 			 * If the instruction address is invalid, and this
 			 * is the first stack frame, assume r14 has not
 			 * been written to the stack yet. Otherwise exit.
 			 */
-			if (first && !(regs->gprs[14] & 0x1))
-				ip = regs->gprs[14];
-			else
+			if (!first)
+				break;
+			ip = regs->gprs[14];
+			if (ip_invalid(ip))
 				break;
 		}
-		if (!consume_entry(cookie, ip))
+		if (!store_ip(consume_entry, cookie, entry, perf, ip))
 			break;
-		/* Sanity check: ABI requires SP to be aligned 8 bytes. */
-		if (!sp || sp & 0x7)
-			break;
-		sf = (void __user *)sp;
 		first = false;
 	}
 	pagefault_enable();
 }
+
+void arch_stack_walk_user(stack_trace_consume_fn consume_entry, void *cookie,
+			  const struct pt_regs *regs)
+{
+	arch_stack_walk_user_common(consume_entry, cookie, NULL, regs, false);
+}
--- linux-qcom-6.8.0.orig/arch/s390/kernel/syscalls/Makefile
+++ linux-qcom-6.8.0/arch/s390/kernel/syscalls/Makefile
@@ -12,7 +12,7 @@
 uapi-hdrs-y := $(uapi)/unistd_32.h
 uapi-hdrs-y += $(uapi)/unistd_64.h
 
-targets += $(addprefix ../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y))
+targets += $(addprefix ../../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y))
 
 PHONY += kapi uapi
 
--- linux-qcom-6.8.0.orig/arch/s390/kernel/syscalls/syscall.tbl
+++ linux-qcom-6.8.0/arch/s390/kernel/syscalls/syscall.tbl
@@ -418,7 +418,7 @@
 412	32	utimensat_time64	-				sys_utimensat
 413	32	pselect6_time64		-				compat_sys_pselect6_time64
 414	32	ppoll_time64		-				compat_sys_ppoll_time64
-416	32	io_pgetevents_time64	-				sys_io_pgetevents
+416	32	io_pgetevents_time64	-				compat_sys_io_pgetevents_time64
 417	32	recvmmsg_time64		-				compat_sys_recvmmsg_time64
 418	32	mq_timedsend_time64	-				sys_mq_timedsend
 419	32	mq_timedreceive_time64	-				sys_mq_timedreceive
--- linux-qcom-6.8.0.orig/arch/s390/kernel/uv.c
+++ linux-qcom-6.8.0/arch/s390/kernel/uv.c
@@ -181,36 +181,36 @@
 }
 
 /*
- * Calculate the expected ref_count for a page that would otherwise have no
+ * Calculate the expected ref_count for a folio that would otherwise have no
  * further pins. This was cribbed from similar functions in other places in
  * the kernel, but with some slight modifications. We know that a secure
- * page can not be a huge page for example.
+ * folio can not be a large folio, for example.
  */
-static int expected_page_refs(struct page *page)
+static int expected_folio_refs(struct folio *folio)
 {
 	int res;
 
-	res = page_mapcount(page);
-	if (PageSwapCache(page)) {
+	res = folio_mapcount(folio);
+	if (folio_test_swapcache(folio)) {
 		res++;
-	} else if (page_mapping(page)) {
+	} else if (folio_mapping(folio)) {
 		res++;
-		if (page_has_private(page))
+		if (folio->private)
 			res++;
 	}
 	return res;
 }
 
-static int make_page_secure(struct page *page, struct uv_cb_header *uvcb)
+static int make_folio_secure(struct folio *folio, struct uv_cb_header *uvcb)
 {
 	int expected, cc = 0;
 
-	if (PageWriteback(page))
+	if (folio_test_writeback(folio))
 		return -EAGAIN;
-	expected = expected_page_refs(page);
-	if (!page_ref_freeze(page, expected))
+	expected = expected_folio_refs(folio);
+	if (!folio_ref_freeze(folio, expected))
 		return -EBUSY;
-	set_bit(PG_arch_1, &page->flags);
+	set_bit(PG_arch_1, &folio->flags);
 	/*
 	 * If the UVC does not succeed or fail immediately, we don't want to
 	 * loop for long, or we might get stall notifications.
@@ -220,9 +220,9 @@
 	 * -EAGAIN and we let the callers deal with it.
 	 */
 	cc = __uv_call(0, (u64)uvcb);
-	page_ref_unfreeze(page, expected);
+	folio_ref_unfreeze(folio, expected);
 	/*
-	 * Return -ENXIO if the page was not mapped, -EINVAL for other errors.
+	 * Return -ENXIO if the folio was not mapped, -EINVAL for other errors.
 	 * If busy or partially completed, return -EAGAIN.
 	 */
 	if (cc == UVC_CC_OK)
@@ -277,7 +277,7 @@
 	bool local_drain = false;
 	spinlock_t *ptelock;
 	unsigned long uaddr;
-	struct page *page;
+	struct folio *folio;
 	pte_t *ptep;
 	int rc;
 
@@ -306,15 +306,26 @@
 	if (!ptep)
 		goto out;
 	if (pte_present(*ptep) && !(pte_val(*ptep) & _PAGE_INVALID) && pte_write(*ptep)) {
-		page = pte_page(*ptep);
+		folio = page_folio(pte_page(*ptep));
+		rc = -EINVAL;
+		if (folio_test_large(folio))
+			goto unlock;
 		rc = -EAGAIN;
-		if (trylock_page(page)) {
+		if (folio_trylock(folio)) {
 			if (should_export_before_import(uvcb, gmap->mm))
-				uv_convert_from_secure(page_to_phys(page));
-			rc = make_page_secure(page, uvcb);
-			unlock_page(page);
+				uv_convert_from_secure(PFN_PHYS(folio_pfn(folio)));
+			rc = make_folio_secure(folio, uvcb);
+			folio_unlock(folio);
 		}
+
+		/*
+		 * Once we drop the PTL, the folio may get unmapped and
+		 * freed immediately. We need a temporary reference.
+		 */
+		if (rc == -EAGAIN)
+			folio_get(folio);
 	}
+unlock:
 	pte_unmap_unlock(ptep, ptelock);
 out:
 	mmap_read_unlock(gmap->mm);
@@ -324,10 +335,11 @@
 		 * If we are here because the UVC returned busy or partial
 		 * completion, this is just a useless check, but it is safe.
 		 */
-		wait_on_page_writeback(page);
+		folio_wait_writeback(folio);
+		folio_put(folio);
 	} else if (rc == -EBUSY) {
 		/*
-		 * If we have tried a local drain and the page refcount
+		 * If we have tried a local drain and the folio refcount
 		 * still does not match our expected safe value, try with a
 		 * system wide drain. This is needed if the pagevecs holding
 		 * the page are on a different CPU.
@@ -338,7 +350,7 @@
 			return -EAGAIN;
 		}
 		/*
-		 * We are here if the page refcount does not match the
+		 * We are here if the folio refcount does not match the
 		 * expected safe value. The main culprits are usually
 		 * pagevecs. With lru_add_drain() we drain the pagevecs
 		 * on the local CPU so that hopefully the refcount will
--- linux-qcom-6.8.0.orig/arch/s390/kernel/vdso.c
+++ linux-qcom-6.8.0/arch/s390/kernel/vdso.c
@@ -213,17 +213,22 @@
 	return addr;
 }
 
-unsigned long vdso_size(void)
+unsigned long vdso_text_size(void)
 {
-	unsigned long size = VVAR_NR_PAGES * PAGE_SIZE;
+	unsigned long size;
 
 	if (is_compat_task())
-		size += vdso32_end - vdso32_start;
+		size = vdso32_end - vdso32_start;
 	else
-		size += vdso64_end - vdso64_start;
+		size = vdso64_end - vdso64_start;
 	return PAGE_ALIGN(size);
 }
 
+unsigned long vdso_size(void)
+{
+	return vdso_text_size() + VVAR_NR_PAGES * PAGE_SIZE;
+}
+
 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
 {
 	unsigned long addr = VDSO_BASE;
--- linux-qcom-6.8.0.orig/arch/s390/kernel/vdso32/Makefile
+++ linux-qcom-6.8.0/arch/s390/kernel/vdso32/Makefile
@@ -19,10 +19,12 @@
 KBUILD_AFLAGS_32 += -m31 -s
 
 KBUILD_CFLAGS_32 := $(filter-out -m64,$(KBUILD_CFLAGS))
+KBUILD_CFLAGS_32 := $(filter-out -mpacked-stack,$(KBUILD_CFLAGS))
 KBUILD_CFLAGS_32 := $(filter-out -mno-pic-data-is-text-relative,$(KBUILD_CFLAGS_32))
-KBUILD_CFLAGS_32 += -m31 -fPIC -shared -fno-common -fno-builtin
+KBUILD_CFLAGS_32 := $(filter-out -fno-asynchronous-unwind-tables,$(KBUILD_CFLAGS_32))
+KBUILD_CFLAGS_32 += -m31 -fPIC -shared -fno-common -fno-builtin -fasynchronous-unwind-tables
 
-LDFLAGS_vdso32.so.dbg += -fPIC -shared -soname=linux-vdso32.so.1 \
+LDFLAGS_vdso32.so.dbg += -shared -soname=linux-vdso32.so.1 \
 	--hash-style=both --build-id=sha1 -melf_s390 -T
 
 $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
--- linux-qcom-6.8.0.orig/arch/s390/kernel/vdso64/Makefile
+++ linux-qcom-6.8.0/arch/s390/kernel/vdso64/Makefile
@@ -24,9 +24,12 @@
 KBUILD_AFLAGS_64 += -m64
 
 KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS))
+KBUILD_CFLAGS_64 := $(filter-out -mpacked-stack,$(KBUILD_CFLAGS_64))
 KBUILD_CFLAGS_64 := $(filter-out -mno-pic-data-is-text-relative,$(KBUILD_CFLAGS_64))
-KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin
-ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \
+KBUILD_CFLAGS_64 := $(filter-out -munaligned-symbols,$(KBUILD_CFLAGS_64))
+KBUILD_CFLAGS_64 := $(filter-out -fno-asynchronous-unwind-tables,$(KBUILD_CFLAGS_64))
+KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin -fasynchronous-unwind-tables
+ldflags-y := -shared -soname=linux-vdso64.so.1 \
 	     --hash-style=both --build-id=sha1 -T
 
 $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_64)
--- linux-qcom-6.8.0.orig/arch/s390/kernel/vdso64/vdso_user_wrapper.S
+++ linux-qcom-6.8.0/arch/s390/kernel/vdso64/vdso_user_wrapper.S
@@ -6,8 +6,6 @@
 #include <asm/dwarf.h>
 #include <asm/ptrace.h>
 
-#define WRAPPER_FRAME_SIZE (STACK_FRAME_OVERHEAD+8)
-
 /*
  * Older glibc version called vdso without allocating a stackframe. This wrapper
  * is just used to allocate a stackframe. See
@@ -20,14 +18,17 @@
 	__ALIGN
 __kernel_\func:
 	CFI_STARTPROC
-	aghi	%r15,-WRAPPER_FRAME_SIZE
-	CFI_DEF_CFA_OFFSET (STACK_FRAME_OVERHEAD + WRAPPER_FRAME_SIZE)
-	CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
-	stg	%r14,STACK_FRAME_OVERHEAD(%r15)
+	aghi	%r15,-STACK_FRAME_VDSO_OVERHEAD
+	CFI_DEF_CFA_OFFSET (STACK_FRAME_USER_OVERHEAD + STACK_FRAME_VDSO_OVERHEAD)
+	CFI_VAL_OFFSET 15,-STACK_FRAME_USER_OVERHEAD
+	stg	%r14,__SFVDSO_RETURN_ADDRESS(%r15)
+	CFI_REL_OFFSET 14,__SFVDSO_RETURN_ADDRESS
+	xc	__SFUSER_BACKCHAIN(8,%r15),__SFUSER_BACKCHAIN(%r15)
 	brasl	%r14,__s390_vdso_\func
-	lg	%r14,STACK_FRAME_OVERHEAD(%r15)
-	aghi	%r15,WRAPPER_FRAME_SIZE
-	CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+	lg	%r14,__SFVDSO_RETURN_ADDRESS(%r15)
+	CFI_RESTORE 14
+	aghi	%r15,STACK_FRAME_VDSO_OVERHEAD
+	CFI_DEF_CFA_OFFSET STACK_FRAME_USER_OVERHEAD
 	CFI_RESTORE 15
 	br	%r14
 	CFI_ENDPROC
--- linux-qcom-6.8.0.orig/arch/s390/kernel/vmlinux.lds.S
+++ linux-qcom-6.8.0/arch/s390/kernel/vmlinux.lds.S
@@ -72,6 +72,15 @@
 	. = ALIGN(PAGE_SIZE);
 	__end_ro_after_init = .;
 
+	.data.rel.ro : {
+		*(.data.rel.ro .data.rel.ro.*)
+	}
+	.got : {
+		__got_start = .;
+		*(.got)
+		__got_end = .;
+	}
+
 	RW_DATA(0x100, PAGE_SIZE, THREAD_SIZE)
 	BOOT_DATA_PRESERVED
 
--- linux-qcom-6.8.0.orig/arch/s390/kernel/vtime.c
+++ linux-qcom-6.8.0/arch/s390/kernel/vtime.c
@@ -210,13 +210,13 @@
 		virt_timer_expire();
 
 	steal = S390_lowcore.steal_timer;
-	avg_steal = S390_lowcore.avg_steal_timer / 2;
+	avg_steal = S390_lowcore.avg_steal_timer;
 	if ((s64) steal > 0) {
 		S390_lowcore.steal_timer = 0;
 		account_steal_time(cputime_to_nsecs(steal));
 		avg_steal += steal;
 	}
-	S390_lowcore.avg_steal_timer = avg_steal;
+	S390_lowcore.avg_steal_timer = avg_steal / 2;
 }
 
 static u64 vtime_delta(void)
--- linux-qcom-6.8.0.orig/arch/s390/kvm/diag.c
+++ linux-qcom-6.8.0/arch/s390/kvm/diag.c
@@ -77,7 +77,7 @@
 	vcpu->stat.instruction_diagnose_258++;
 	if (vcpu->run->s.regs.gprs[rx] & 7)
 		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-	rc = read_guest(vcpu, vcpu->run->s.regs.gprs[rx], rx, &parm, sizeof(parm));
+	rc = read_guest_real(vcpu, vcpu->run->s.regs.gprs[rx], &parm, sizeof(parm));
 	if (rc)
 		return kvm_s390_inject_prog_cond(vcpu, rc);
 	if (parm.parm_version != 2 || parm.parm_len < 5 || parm.code != 0x258)
--- linux-qcom-6.8.0.orig/arch/s390/kvm/gaccess.c
+++ linux-qcom-6.8.0/arch/s390/kvm/gaccess.c
@@ -984,6 +984,8 @@
 	const gfn_t gfn = gpa_to_gfn(gpa);
 	int rc;
 
+	if (!gfn_to_memslot(kvm, gfn))
+		return PGM_ADDRESSING;
 	if (mode == GACC_STORE)
 		rc = kvm_write_guest_page(kvm, gfn, data, offset, len);
 	else
@@ -1141,6 +1143,8 @@
 		gra += fragment_len;
 		data += fragment_len;
 	}
+	if (rc > 0)
+		vcpu->arch.pgm.code = rc;
 	return rc;
 }
 
--- linux-qcom-6.8.0.orig/arch/s390/kvm/gaccess.h
+++ linux-qcom-6.8.0/arch/s390/kvm/gaccess.h
@@ -405,11 +405,12 @@
  * @len: number of bytes to copy
  *
  * Copy @len bytes from @data (kernel space) to @gra (guest real address).
- * It is up to the caller to ensure that the entire guest memory range is
- * valid memory before calling this function.
  * Guest low address and key protection are not checked.
  *
- * Returns zero on success or -EFAULT on error.
+ * Returns zero on success, -EFAULT when copying from @data failed, or
+ * PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info
+ * is also stored to allow injecting into the guest (if applicable) using
+ * kvm_s390_inject_prog_cond().
  *
  * If an error occurs data may have been copied partially to guest memory.
  */
@@ -428,11 +429,12 @@
  * @len: number of bytes to copy
  *
  * Copy @len bytes from @gra (guest real address) to @data (kernel space).
- * It is up to the caller to ensure that the entire guest memory range is
- * valid memory before calling this function.
  * Guest key protection is not checked.
  *
- * Returns zero on success or -EFAULT on error.
+ * Returns zero on success, -EFAULT when copying to @data failed, or
+ * PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info
+ * is also stored to allow injecting into the guest (if applicable) using
+ * kvm_s390_inject_prog_cond().
  *
  * If an error occurs data may have been copied partially to kernel space.
  */
--- linux-qcom-6.8.0.orig/arch/s390/kvm/kvm-s390.c
+++ linux-qcom-6.8.0/arch/s390/kvm/kvm-s390.c
@@ -132,6 +132,7 @@
 	STATS_DESC_COUNTER(VCPU, instruction_io_other),
 	STATS_DESC_COUNTER(VCPU, instruction_lpsw),
 	STATS_DESC_COUNTER(VCPU, instruction_lpswe),
+	STATS_DESC_COUNTER(VCPU, instruction_lpswey),
 	STATS_DESC_COUNTER(VCPU, instruction_pfmf),
 	STATS_DESC_COUNTER(VCPU, instruction_ptff),
 	STATS_DESC_COUNTER(VCPU, instruction_sck),
@@ -2631,9 +2632,7 @@
 		if (r)
 			break;
 
-		mmap_write_lock(current->mm);
-		r = gmap_mark_unmergeable();
-		mmap_write_unlock(current->mm);
+		r = s390_disable_cow_sharing();
 		if (r)
 			break;
 
@@ -5761,6 +5760,9 @@
 {
 	gpa_t size;
 
+	if (kvm_is_ucontrol(kvm))
+		return -EINVAL;
+
 	/* When we are protected, we should not change the memory slots */
 	if (kvm_s390_pv_get_handle(kvm))
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/arch/s390/kvm/kvm-s390.h
+++ linux-qcom-6.8.0/arch/s390/kvm/kvm-s390.h
@@ -120,6 +120,21 @@
 	return (base2 ? vcpu->run->s.regs.gprs[base2] : 0) + disp2;
 }
 
+static inline u64 kvm_s390_get_base_disp_siy(struct kvm_vcpu *vcpu, u8 *ar)
+{
+	u32 base1 = vcpu->arch.sie_block->ipb >> 28;
+	s64 disp1;
+
+	/* The displacement is a 20bit _SIGNED_ value */
+	disp1 = sign_extend64(((vcpu->arch.sie_block->ipb & 0x0fff0000) >> 16) +
+			      ((vcpu->arch.sie_block->ipb & 0xff00) << 4), 19);
+
+	if (ar)
+		*ar = base1;
+
+	return (base1 ? vcpu->run->s.regs.gprs[base1] : 0) + disp1;
+}
+
 static inline void kvm_s390_get_base_disp_sse(struct kvm_vcpu *vcpu,
 					      u64 *address1, u64 *address2,
 					      u8 *ar_b1, u8 *ar_b2)
@@ -234,7 +249,12 @@
 
 static inline u32 kvm_s390_get_gisa_desc(struct kvm *kvm)
 {
-	u32 gd = virt_to_phys(kvm->arch.gisa_int.origin);
+	u32 gd;
+
+	if (!kvm->arch.gisa_int.origin)
+		return 0;
+
+	gd = virt_to_phys(kvm->arch.gisa_int.origin);
 
 	if (gd && sclp.has_gisaf)
 		gd |= GISA_FORMAT1;
--- linux-qcom-6.8.0.orig/arch/s390/kvm/priv.c
+++ linux-qcom-6.8.0/arch/s390/kvm/priv.c
@@ -797,6 +797,36 @@
 	return 0;
 }
 
+static int handle_lpswey(struct kvm_vcpu *vcpu)
+{
+	psw_t new_psw;
+	u64 addr;
+	int rc;
+	u8 ar;
+
+	vcpu->stat.instruction_lpswey++;
+
+	if (!test_kvm_facility(vcpu->kvm, 193))
+		return kvm_s390_inject_program_int(vcpu, PGM_OPERATION);
+
+	if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
+		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
+
+	addr = kvm_s390_get_base_disp_siy(vcpu, &ar);
+	if (addr & 7)
+		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+
+	rc = read_guest(vcpu, addr, ar, &new_psw, sizeof(new_psw));
+	if (rc)
+		return kvm_s390_inject_prog_cond(vcpu, rc);
+
+	vcpu->arch.sie_block->gpsw = new_psw;
+	if (!is_valid_psw(&vcpu->arch.sie_block->gpsw))
+		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+
+	return 0;
+}
+
 static int handle_stidp(struct kvm_vcpu *vcpu)
 {
 	u64 stidp_data = vcpu->kvm->arch.model.cpuid;
@@ -1462,6 +1492,8 @@
 	case 0x61:
 	case 0x62:
 		return handle_ri(vcpu);
+	case 0x71:
+		return handle_lpswey(vcpu);
 	default:
 		return -EOPNOTSUPP;
 	}
--- linux-qcom-6.8.0.orig/arch/s390/mm/cmm.c
+++ linux-qcom-6.8.0/arch/s390/mm/cmm.c
@@ -95,11 +95,12 @@
 		(*counter)++;
 		spin_unlock(&cmm_lock);
 		nr--;
+		cond_resched();
 	}
 	return nr;
 }
 
-static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
+static long __cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
 {
 	struct cmm_page_array *pa;
 	unsigned long addr;
@@ -123,6 +124,21 @@
 	return nr;
 }
 
+static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
+{
+	long inc = 0;
+
+	while (nr) {
+		inc = min(256L, nr);
+		nr -= inc;
+		inc = __cmm_free_pages(inc, counter, list);
+		if (inc)
+			break;
+		cond_resched();
+	}
+	return nr + inc;
+}
+
 static int cmm_oom_notify(struct notifier_block *self,
 			  unsigned long dummy, void *parm)
 {
--- linux-qcom-6.8.0.orig/arch/s390/mm/fault.c
+++ linux-qcom-6.8.0/arch/s390/mm/fault.c
@@ -430,12 +430,13 @@
 			handle_fault_error_nolock(regs, 0);
 		else
 			do_sigsegv(regs, SEGV_MAPERR);
-	} else if (fault & VM_FAULT_SIGBUS) {
+	} else if (fault & (VM_FAULT_SIGBUS | VM_FAULT_HWPOISON)) {
 		if (!user_mode(regs))
 			handle_fault_error_nolock(regs, 0);
 		else
 			do_sigbus(regs);
 	} else {
+		pr_emerg("Unexpected fault flags: %08x\n", fault);
 		BUG();
 	}
 }
--- linux-qcom-6.8.0.orig/arch/s390/mm/gmap.c
+++ linux-qcom-6.8.0/arch/s390/mm/gmap.c
@@ -596,7 +596,7 @@
 	pud = pud_offset(p4d, vmaddr);
 	VM_BUG_ON(pud_none(*pud));
 	/* large puds cannot yet be handled */
-	if (pud_large(*pud))
+	if (pud_leaf(*pud))
 		return -EFAULT;
 	pmd = pmd_offset(pud, vmaddr);
 	VM_BUG_ON(pmd_none(*pmd));
@@ -2548,41 +2548,6 @@
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
 /*
- * Remove all empty zero pages from the mapping for lazy refaulting
- * - This must be called after mm->context.has_pgste is set, to avoid
- *   future creation of zero pages
- * - This must be called after THP was disabled.
- *
- * mm contracts with s390, that even if mm were to remove a page table,
- * racing with the loop below and so causing pte_offset_map_lock() to fail,
- * it will never insert a page table containing empty zero pages once
- * mm_forbids_zeropage(mm) i.e. mm->context.has_pgste is set.
- */
-static int __zap_zero_pages(pmd_t *pmd, unsigned long start,
-			   unsigned long end, struct mm_walk *walk)
-{
-	unsigned long addr;
-
-	for (addr = start; addr != end; addr += PAGE_SIZE) {
-		pte_t *ptep;
-		spinlock_t *ptl;
-
-		ptep = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
-		if (!ptep)
-			break;
-		if (is_zero_pfn(pte_pfn(*ptep)))
-			ptep_xchg_direct(walk->mm, addr, ptep, __pte(_PAGE_INVALID));
-		pte_unmap_unlock(ptep, ptl);
-	}
-	return 0;
-}
-
-static const struct mm_walk_ops zap_zero_walk_ops = {
-	.pmd_entry	= __zap_zero_pages,
-	.walk_lock	= PGWALK_WRLOCK,
-};
-
-/*
  * switch on pgstes for its userspace process (for kvm)
  */
 int s390_enable_sie(void)
@@ -2599,22 +2564,142 @@
 	mm->context.has_pgste = 1;
 	/* split thp mappings and disable thp for future mappings */
 	thp_split_mm(mm);
-	walk_page_range(mm, 0, TASK_SIZE, &zap_zero_walk_ops, NULL);
 	mmap_write_unlock(mm);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(s390_enable_sie);
 
-int gmap_mark_unmergeable(void)
+static int find_zeropage_pte_entry(pte_t *pte, unsigned long addr,
+				   unsigned long end, struct mm_walk *walk)
 {
+	unsigned long *found_addr = walk->private;
+
+	/* Return 1 of the page is a zeropage. */
+	if (is_zero_pfn(pte_pfn(*pte))) {
+		/*
+		 * Shared zeropage in e.g., a FS DAX mapping? We cannot do the
+		 * right thing and likely don't care: FAULT_FLAG_UNSHARE
+		 * currently only works in COW mappings, which is also where
+		 * mm_forbids_zeropage() is checked.
+		 */
+		if (!is_cow_mapping(walk->vma->vm_flags))
+			return -EFAULT;
+
+		*found_addr = addr;
+		return 1;
+	}
+	return 0;
+}
+
+static const struct mm_walk_ops find_zeropage_ops = {
+	.pte_entry	= find_zeropage_pte_entry,
+	.walk_lock	= PGWALK_WRLOCK,
+};
+
+/*
+ * Unshare all shared zeropages, replacing them by anonymous pages. Note that
+ * we cannot simply zap all shared zeropages, because this could later
+ * trigger unexpected userfaultfd missing events.
+ *
+ * This must be called after mm->context.allow_cow_sharing was
+ * set to 0, to avoid future mappings of shared zeropages.
+ *
+ * mm contracts with s390, that even if mm were to remove a page table,
+ * and racing with walk_page_range_vma() calling pte_offset_map_lock()
+ * would fail, it will never insert a page table containing empty zero
+ * pages once mm_forbids_zeropage(mm) i.e.
+ * mm->context.allow_cow_sharing is set to 0.
+ */
+static int __s390_unshare_zeropages(struct mm_struct *mm)
+{
+	struct vm_area_struct *vma;
+	VMA_ITERATOR(vmi, mm, 0);
+	unsigned long addr;
+	vm_fault_t fault;
+	int rc;
+
+	for_each_vma(vmi, vma) {
+		/*
+		 * We could only look at COW mappings, but it's more future
+		 * proof to catch unexpected zeropages in other mappings and
+		 * fail.
+		 */
+		if ((vma->vm_flags & VM_PFNMAP) || is_vm_hugetlb_page(vma))
+			continue;
+		addr = vma->vm_start;
+
+retry:
+		rc = walk_page_range_vma(vma, addr, vma->vm_end,
+					 &find_zeropage_ops, &addr);
+		if (rc < 0)
+			return rc;
+		else if (!rc)
+			continue;
+
+		/* addr was updated by find_zeropage_pte_entry() */
+		fault = handle_mm_fault(vma, addr,
+					FAULT_FLAG_UNSHARE | FAULT_FLAG_REMOTE,
+					NULL);
+		if (fault & VM_FAULT_OOM)
+			return -ENOMEM;
+		/*
+		 * See break_ksm(): even after handle_mm_fault() returned 0, we
+		 * must start the lookup from the current address, because
+		 * handle_mm_fault() may back out if there's any difficulty.
+		 *
+		 * VM_FAULT_SIGBUS and VM_FAULT_SIGSEGV are unexpected but
+		 * maybe they could trigger in the future on concurrent
+		 * truncation. In that case, the shared zeropage would be gone
+		 * and we can simply retry and make progress.
+		 */
+		cond_resched();
+		goto retry;
+	}
+
+	return 0;
+}
+
+static int __s390_disable_cow_sharing(struct mm_struct *mm)
+{
+	int rc;
+
+	if (!mm->context.allow_cow_sharing)
+		return 0;
+
+	mm->context.allow_cow_sharing = 0;
+
+	/* Replace all shared zeropages by anonymous pages. */
+	rc = __s390_unshare_zeropages(mm);
 	/*
 	 * Make sure to disable KSM (if enabled for the whole process or
 	 * individual VMAs). Note that nothing currently hinders user space
 	 * from re-enabling it.
 	 */
-	return ksm_disable(current->mm);
+	if (!rc)
+		rc = ksm_disable(mm);
+	if (rc)
+		mm->context.allow_cow_sharing = 1;
+	return rc;
+}
+
+/*
+ * Disable most COW-sharing of memory pages for the whole process:
+ * (1) Disable KSM and unmerge/unshare any KSM pages.
+ * (2) Disallow shared zeropages and unshare any zerpages that are mapped.
+ *
+ * Not that we currently don't bother with COW-shared pages that are shared
+ * with parent/child processes due to fork().
+ */
+int s390_disable_cow_sharing(void)
+{
+	int rc;
+
+	mmap_write_lock(current->mm);
+	rc = __s390_disable_cow_sharing(current->mm);
+	mmap_write_unlock(current->mm);
+	return rc;
 }
-EXPORT_SYMBOL_GPL(gmap_mark_unmergeable);
+EXPORT_SYMBOL_GPL(s390_disable_cow_sharing);
 
 /*
  * Enable storage key handling from now on and initialize the storage
@@ -2659,7 +2744,7 @@
 		return 0;
 
 	start = pmd_val(*pmd) & HPAGE_MASK;
-	end = start + HPAGE_SIZE - 1;
+	end = start + HPAGE_SIZE;
 	__storage_key_init_range(start, end);
 	set_bit(PG_arch_1, &page->flags);
 	cond_resched();
@@ -2683,7 +2768,7 @@
 		goto out_up;
 
 	mm->context.uses_skeys = 1;
-	rc = gmap_mark_unmergeable();
+	rc = __s390_disable_cow_sharing(mm);
 	if (rc) {
 		mm->context.uses_skeys = 0;
 		goto out_up;
--- linux-qcom-6.8.0.orig/arch/s390/mm/hugetlbpage.c
+++ linux-qcom-6.8.0/arch/s390/mm/hugetlbpage.c
@@ -139,7 +139,7 @@
 	}
 
 	if (!test_and_set_bit(PG_arch_1, &page->flags))
-		__storage_key_init_range(paddr, paddr + size - 1);
+		__storage_key_init_range(paddr, paddr + size);
 }
 
 void __set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
@@ -224,7 +224,7 @@
 		if (p4d_present(*p4dp)) {
 			pudp = pud_offset(p4dp, addr);
 			if (pud_present(*pudp)) {
-				if (pud_large(*pudp))
+				if (pud_leaf(*pudp))
 					return (pte_t *) pudp;
 				pmdp = pmd_offset(pudp, addr);
 			}
@@ -240,7 +240,7 @@
 
 int pud_huge(pud_t pud)
 {
-	return pud_large(pud);
+	return pud_leaf(pud);
 }
 
 bool __init arch_hugetlb_valid_size(unsigned long size)
--- linux-qcom-6.8.0.orig/arch/s390/mm/init.c
+++ linux-qcom-6.8.0/arch/s390/mm/init.c
@@ -281,9 +281,6 @@
 	unsigned long size_pages = PFN_DOWN(size);
 	int rc;
 
-	if (WARN_ON_ONCE(params->altmap))
-		return -EINVAL;
-
 	if (WARN_ON_ONCE(params->pgprot.pgprot != PAGE_KERNEL.pgprot))
 		return -EINVAL;
 
--- linux-qcom-6.8.0.orig/arch/s390/mm/pageattr.c
+++ linux-qcom-6.8.0/arch/s390/mm/pageattr.c
@@ -274,7 +274,7 @@
 		if (pud_none(*pudp))
 			return -EINVAL;
 		next = pud_addr_end(addr, end);
-		if (pud_large(*pudp)) {
+		if (pud_leaf(*pudp)) {
 			need_split  = !!(flags & SET_MEMORY_4K);
 			need_split |= !!(addr & ~PUD_MASK);
 			need_split |= !!(addr + PUD_SIZE > next);
@@ -406,6 +406,21 @@
 	return __set_memory((unsigned long)page_to_virt(page), 1, SET_MEMORY_DEF);
 }
 
+bool kernel_page_present(struct page *page)
+{
+	unsigned long addr;
+	unsigned int cc;
+
+	addr = (unsigned long)page_address(page);
+	asm volatile(
+		"	lra	%[addr],0(%[addr])\n"
+		"	ipm	%[cc]\n"
+		: [cc] "=d" (cc), [addr] "+a" (addr)
+		:
+		: "cc");
+	return (cc >> 28) == 0;
+}
+
 #if defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE)
 
 static void ipte_range(pte_t *pte, unsigned long address, int nr)
--- linux-qcom-6.8.0.orig/arch/s390/mm/pgalloc.c
+++ linux-qcom-6.8.0/arch/s390/mm/pgalloc.c
@@ -55,6 +55,8 @@
 
 void crst_table_free(struct mm_struct *mm, unsigned long *table)
 {
+	if (!table)
+		return;
 	pagetable_free(virt_to_ptdesc(table));
 }
 
@@ -262,6 +264,8 @@
 
 static void base_crst_free(unsigned long *table)
 {
+	if (!table)
+		return;
 	pagetable_free(virt_to_ptdesc(table));
 }
 
--- linux-qcom-6.8.0.orig/arch/s390/mm/pgtable.c
+++ linux-qcom-6.8.0/arch/s390/mm/pgtable.c
@@ -470,7 +470,7 @@
 		return -ENOENT;
 
 	/* Large PUDs are not supported yet. */
-	if (pud_large(*pud))
+	if (pud_leaf(*pud))
 		return -EFAULT;
 
 	*pmdp = pmd_offset(pud, addr);
--- linux-qcom-6.8.0.orig/arch/s390/mm/vmem.c
+++ linux-qcom-6.8.0/arch/s390/mm/vmem.c
@@ -33,8 +33,12 @@
 	return memblock_alloc(size, size);
 }
 
-static void vmem_free_pages(unsigned long addr, int order)
+static void vmem_free_pages(unsigned long addr, int order, struct vmem_altmap *altmap)
 {
+	if (altmap) {
+		vmem_altmap_free(altmap, 1 << order);
+		return;
+	}
 	/* We don't expect boot memory to be removed ever. */
 	if (!slab_is_available() ||
 	    WARN_ON_ONCE(PageReserved(virt_to_page((void *)addr))))
@@ -156,7 +160,8 @@
 
 /* __ref: we'll only call vmemmap_alloc_block() via vmemmap_populate() */
 static int __ref modify_pte_table(pmd_t *pmd, unsigned long addr,
-				  unsigned long end, bool add, bool direct)
+				  unsigned long end, bool add, bool direct,
+				  struct vmem_altmap *altmap)
 {
 	unsigned long prot, pages = 0;
 	int ret = -ENOMEM;
@@ -172,11 +177,11 @@
 			if (pte_none(*pte))
 				continue;
 			if (!direct)
-				vmem_free_pages((unsigned long) pfn_to_virt(pte_pfn(*pte)), 0);
+				vmem_free_pages((unsigned long)pfn_to_virt(pte_pfn(*pte)), get_order(PAGE_SIZE), altmap);
 			pte_clear(&init_mm, addr, pte);
 		} else if (pte_none(*pte)) {
 			if (!direct) {
-				void *new_page = vmemmap_alloc_block(PAGE_SIZE, NUMA_NO_NODE);
+				void *new_page = vmemmap_alloc_block_buf(PAGE_SIZE, NUMA_NO_NODE, altmap);
 
 				if (!new_page)
 					goto out;
@@ -213,7 +218,8 @@
 
 /* __ref: we'll only call vmemmap_alloc_block() via vmemmap_populate() */
 static int __ref modify_pmd_table(pud_t *pud, unsigned long addr,
-				  unsigned long end, bool add, bool direct)
+				  unsigned long end, bool add, bool direct,
+				  struct vmem_altmap *altmap)
 {
 	unsigned long next, prot, pages = 0;
 	int ret = -ENOMEM;
@@ -234,11 +240,11 @@
 				if (IS_ALIGNED(addr, PMD_SIZE) &&
 				    IS_ALIGNED(next, PMD_SIZE)) {
 					if (!direct)
-						vmem_free_pages(pmd_deref(*pmd), get_order(PMD_SIZE));
+						vmem_free_pages(pmd_deref(*pmd), get_order(PMD_SIZE), altmap);
 					pmd_clear(pmd);
 					pages++;
 				} else if (!direct && vmemmap_unuse_sub_pmd(addr, next)) {
-					vmem_free_pages(pmd_deref(*pmd), get_order(PMD_SIZE));
+					vmem_free_pages(pmd_deref(*pmd), get_order(PMD_SIZE), altmap);
 					pmd_clear(pmd);
 				}
 				continue;
@@ -261,7 +267,7 @@
 				 * page tables since vmemmap_populate gets
 				 * called for each section separately.
 				 */
-				new_page = vmemmap_alloc_block(PMD_SIZE, NUMA_NO_NODE);
+				new_page = vmemmap_alloc_block_buf(PMD_SIZE, NUMA_NO_NODE, altmap);
 				if (new_page) {
 					set_pmd(pmd, __pmd(__pa(new_page) | prot));
 					if (!IS_ALIGNED(addr, PMD_SIZE) ||
@@ -280,7 +286,7 @@
 				vmemmap_use_sub_pmd(addr, next);
 			continue;
 		}
-		ret = modify_pte_table(pmd, addr, next, add, direct);
+		ret = modify_pte_table(pmd, addr, next, add, direct, altmap);
 		if (ret)
 			goto out;
 		if (!add)
@@ -302,12 +308,12 @@
 	for (i = 0; i < PTRS_PER_PMD; i++, pmd++)
 		if (!pmd_none(*pmd))
 			return;
-	vmem_free_pages(pud_deref(*pud), CRST_ALLOC_ORDER);
+	vmem_free_pages(pud_deref(*pud), CRST_ALLOC_ORDER, NULL);
 	pud_clear(pud);
 }
 
 static int modify_pud_table(p4d_t *p4d, unsigned long addr, unsigned long end,
-			    bool add, bool direct)
+			    bool add, bool direct, struct vmem_altmap *altmap)
 {
 	unsigned long next, prot, pages = 0;
 	int ret = -ENOMEM;
@@ -323,7 +329,7 @@
 		if (!add) {
 			if (pud_none(*pud))
 				continue;
-			if (pud_large(*pud)) {
+			if (pud_leaf(*pud)) {
 				if (IS_ALIGNED(addr, PUD_SIZE) &&
 				    IS_ALIGNED(next, PUD_SIZE)) {
 					pud_clear(pud);
@@ -344,10 +350,10 @@
 			if (!pmd)
 				goto out;
 			pud_populate(&init_mm, pud, pmd);
-		} else if (pud_large(*pud)) {
+		} else if (pud_leaf(*pud)) {
 			continue;
 		}
-		ret = modify_pmd_table(pud, addr, next, add, direct);
+		ret = modify_pmd_table(pud, addr, next, add, direct, altmap);
 		if (ret)
 			goto out;
 		if (!add)
@@ -370,12 +376,12 @@
 		if (!pud_none(*pud))
 			return;
 	}
-	vmem_free_pages(p4d_deref(*p4d), CRST_ALLOC_ORDER);
+	vmem_free_pages(p4d_deref(*p4d), CRST_ALLOC_ORDER, NULL);
 	p4d_clear(p4d);
 }
 
 static int modify_p4d_table(pgd_t *pgd, unsigned long addr, unsigned long end,
-			    bool add, bool direct)
+			    bool add, bool direct, struct vmem_altmap *altmap)
 {
 	unsigned long next;
 	int ret = -ENOMEM;
@@ -394,7 +400,7 @@
 				goto out;
 			p4d_populate(&init_mm, p4d, pud);
 		}
-		ret = modify_pud_table(p4d, addr, next, add, direct);
+		ret = modify_pud_table(p4d, addr, next, add, direct, altmap);
 		if (ret)
 			goto out;
 		if (!add)
@@ -415,12 +421,12 @@
 		if (!p4d_none(*p4d))
 			return;
 	}
-	vmem_free_pages(pgd_deref(*pgd), CRST_ALLOC_ORDER);
+	vmem_free_pages(pgd_deref(*pgd), CRST_ALLOC_ORDER, NULL);
 	pgd_clear(pgd);
 }
 
 static int modify_pagetable(unsigned long start, unsigned long end, bool add,
-			    bool direct)
+			    bool direct, struct vmem_altmap *altmap)
 {
 	unsigned long addr, next;
 	int ret = -ENOMEM;
@@ -445,7 +451,7 @@
 				goto out;
 			pgd_populate(&init_mm, pgd, p4d);
 		}
-		ret = modify_p4d_table(pgd, addr, next, add, direct);
+		ret = modify_p4d_table(pgd, addr, next, add, direct, altmap);
 		if (ret)
 			goto out;
 		if (!add)
@@ -458,14 +464,16 @@
 	return ret;
 }
 
-static int add_pagetable(unsigned long start, unsigned long end, bool direct)
+static int add_pagetable(unsigned long start, unsigned long end, bool direct,
+			 struct vmem_altmap *altmap)
 {
-	return modify_pagetable(start, end, true, direct);
+	return modify_pagetable(start, end, true, direct, altmap);
 }
 
-static int remove_pagetable(unsigned long start, unsigned long end, bool direct)
+static int remove_pagetable(unsigned long start, unsigned long end, bool direct,
+			    struct vmem_altmap *altmap)
 {
-	return modify_pagetable(start, end, false, direct);
+	return modify_pagetable(start, end, false, direct, altmap);
 }
 
 /*
@@ -474,7 +482,7 @@
 static int vmem_add_range(unsigned long start, unsigned long size)
 {
 	start = (unsigned long)__va(start);
-	return add_pagetable(start, start + size, true);
+	return add_pagetable(start, start + size, true, NULL);
 }
 
 /*
@@ -483,7 +491,7 @@
 static void vmem_remove_range(unsigned long start, unsigned long size)
 {
 	start = (unsigned long)__va(start);
-	remove_pagetable(start, start + size, true);
+	remove_pagetable(start, start + size, true, NULL);
 }
 
 /*
@@ -496,9 +504,9 @@
 
 	mutex_lock(&vmem_mutex);
 	/* We don't care about the node, just use NUMA_NO_NODE on allocations */
-	ret = add_pagetable(start, end, false);
+	ret = add_pagetable(start, end, false, altmap);
 	if (ret)
-		remove_pagetable(start, end, false);
+		remove_pagetable(start, end, false, altmap);
 	mutex_unlock(&vmem_mutex);
 	return ret;
 }
@@ -509,7 +517,7 @@
 		  struct vmem_altmap *altmap)
 {
 	mutex_lock(&vmem_mutex);
-	remove_pagetable(start, end, false);
+	remove_pagetable(start, end, false, altmap);
 	mutex_unlock(&vmem_mutex);
 }
 
@@ -591,7 +599,7 @@
 		if (!pmd)
 			goto out;
 		pud_populate(&init_mm, pud, pmd);
-	} else if (WARN_ON_ONCE(pud_large(*pud))) {
+	} else if (WARN_ON_ONCE(pud_leaf(*pud))) {
 		goto out;
 	}
 	pmd = pmd_offset(pud, addr);
--- linux-qcom-6.8.0.orig/arch/s390/net/bpf_jit_comp.c
+++ linux-qcom-6.8.0/arch/s390/net/bpf_jit_comp.c
@@ -516,11 +516,12 @@
  * PLT for hotpatchable calls. The calling convention is the same as for the
  * ftrace hotpatch trampolines: %r0 is return address, %r1 is clobbered.
  */
-extern const char bpf_plt[];
-extern const char bpf_plt_ret[];
-extern const char bpf_plt_target[];
-extern const char bpf_plt_end[];
-#define BPF_PLT_SIZE 32
+struct bpf_plt {
+	char code[16];
+	void *ret;
+	void *target;
+} __packed;
+extern const struct bpf_plt bpf_plt;
 asm(
 	".pushsection .rodata\n"
 	"	.balign 8\n"
@@ -531,15 +532,14 @@
 	"	.balign 8\n"
 	"bpf_plt_ret: .quad 0\n"
 	"bpf_plt_target: .quad 0\n"
-	"bpf_plt_end:\n"
 	"	.popsection\n"
 );
 
-static void bpf_jit_plt(void *plt, void *ret, void *target)
+static void bpf_jit_plt(struct bpf_plt *plt, void *ret, void *target)
 {
-	memcpy(plt, bpf_plt, BPF_PLT_SIZE);
-	*(void **)((char *)plt + (bpf_plt_ret - bpf_plt)) = ret;
-	*(void **)((char *)plt + (bpf_plt_target - bpf_plt)) = target ?: ret;
+	memcpy(plt, &bpf_plt, sizeof(*plt));
+	plt->ret = ret;
+	plt->target = target;
 }
 
 /*
@@ -662,9 +662,9 @@
 	jit->prg = ALIGN(jit->prg, 8);
 	jit->prologue_plt = jit->prg;
 	if (jit->prg_buf)
-		bpf_jit_plt(jit->prg_buf + jit->prg,
+		bpf_jit_plt((struct bpf_plt *)(jit->prg_buf + jit->prg),
 			    jit->prg_buf + jit->prologue_plt_ret, NULL);
-	jit->prg += BPF_PLT_SIZE;
+	jit->prg += sizeof(struct bpf_plt);
 }
 
 static int get_probe_mem_regno(const u8 *insn)
@@ -1427,8 +1427,12 @@
 	EMIT6_DISP_LH(0xeb000000, is32 ? (op32) : (op64),		\
 		      (insn->imm & BPF_FETCH) ? src_reg : REG_W0,	\
 		      src_reg, dst_reg, off);				\
-	if (is32 && (insn->imm & BPF_FETCH))				\
-		EMIT_ZERO(src_reg);					\
+	if (insn->imm & BPF_FETCH) {					\
+		/* bcr 14,0 - see atomic_fetch_{add,and,or,xor}() */	\
+		_EMIT2(0x07e0);						\
+		if (is32)                                               \
+			EMIT_ZERO(src_reg);				\
+	}								\
 } while (0)
 		case BPF_ADD:
 		case BPF_ADD | BPF_FETCH:
@@ -2040,9 +2044,6 @@
 	struct bpf_jit jit;
 	int pass;
 
-	if (WARN_ON_ONCE(bpf_plt_end - bpf_plt != BPF_PLT_SIZE))
-		return orig_fp;
-
 	if (!fp->jit_requested)
 		return orig_fp;
 
@@ -2111,7 +2112,11 @@
 		print_fn_code(jit.prg_buf, jit.size_prg);
 	}
 	if (!fp->is_func || extra_pass) {
-		bpf_jit_binary_lock_ro(header);
+		if (bpf_jit_binary_lock_ro(header)) {
+			bpf_jit_binary_free(header);
+			fp = orig_fp;
+			goto free_addrs;
+		}
 	} else {
 		jit_data->header = header;
 		jit_data->ctx = jit;
@@ -2148,14 +2153,11 @@
 int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
 		       void *old_addr, void *new_addr)
 {
+	struct bpf_plt expected_plt, current_plt, new_plt, *plt;
 	struct {
 		u16 opc;
 		s32 disp;
 	} __packed insn;
-	char expected_plt[BPF_PLT_SIZE];
-	char current_plt[BPF_PLT_SIZE];
-	char new_plt[BPF_PLT_SIZE];
-	char *plt;
 	char *ret;
 	int err;
 
@@ -2174,18 +2176,18 @@
 		 */
 	} else {
 		/* Verify the PLT. */
-		plt = (char *)ip + (insn.disp << 1);
-		err = copy_from_kernel_nofault(current_plt, plt, BPF_PLT_SIZE);
+		plt = ip + (insn.disp << 1);
+		err = copy_from_kernel_nofault(&current_plt, plt,
+					       sizeof(current_plt));
 		if (err < 0)
 			return err;
 		ret = (char *)ip + 6;
-		bpf_jit_plt(expected_plt, ret, old_addr);
-		if (memcmp(current_plt, expected_plt, BPF_PLT_SIZE))
+		bpf_jit_plt(&expected_plt, ret, old_addr);
+		if (memcmp(&current_plt, &expected_plt, sizeof(current_plt)))
 			return -EINVAL;
 		/* Adjust the call address. */
-		bpf_jit_plt(new_plt, ret, new_addr);
-		s390_kernel_write(plt + (bpf_plt_target - bpf_plt),
-				  new_plt + (bpf_plt_target - bpf_plt),
+		bpf_jit_plt(&new_plt, ret, new_addr);
+		s390_kernel_write(&plt->target, &new_plt.target,
 				  sizeof(void *));
 	}
 
--- linux-qcom-6.8.0.orig/arch/s390/pci/pci.c
+++ linux-qcom-6.8.0/arch/s390/pci/pci.c
@@ -28,6 +28,7 @@
 #include <linux/jump_label.h>
 #include <linux/pci.h>
 #include <linux/printk.h>
+#include <linux/list_sort.h>
 
 #include <asm/isc.h>
 #include <asm/airq.h>
@@ -159,6 +160,7 @@
 	u64 req = ZPCI_CREATE_REQ(zdev->fh, 0, ZPCI_MOD_FC_SET_MEASURE);
 	struct zpci_iommu_ctrs *ctrs;
 	struct zpci_fib fib = {0};
+	unsigned long flags;
 	u8 cc, status;
 
 	if (zdev->fmb || sizeof(*zdev->fmb) < zdev->fmb_length)
@@ -170,6 +172,7 @@
 	WARN_ON((u64) zdev->fmb & 0xf);
 
 	/* reset software counters */
+	spin_lock_irqsave(&zdev->dom_lock, flags);
 	ctrs = zpci_get_iommu_ctrs(zdev);
 	if (ctrs) {
 		atomic64_set(&ctrs->mapped_pages, 0);
@@ -178,6 +181,7 @@
 		atomic64_set(&ctrs->sync_map_rpcits, 0);
 		atomic64_set(&ctrs->sync_rpcits, 0);
 	}
+	spin_unlock_irqrestore(&zdev->dom_lock, flags);
 
 
 	fib.fmb_addr = virt_to_phys(zdev->fmb);
@@ -780,8 +784,9 @@
  * @fh: Current Function Handle of the device to be created
  * @state: Initial state after creation either Standby or Configured
  *
- * Creates a new zpci device and adds it to its, possibly newly created, zbus
- * as well as zpci_list.
+ * Allocates a new struct zpci_dev and queries the platform for its details.
+ * If successful the device can subsequently be added to the zPCI subsystem
+ * using zpci_add_device().
  *
  * Returns: the zdev on success or an error pointer otherwise
  */
@@ -790,7 +795,6 @@
 	struct zpci_dev *zdev;
 	int rc;
 
-	zpci_dbg(1, "add fid:%x, fh:%x, c:%d\n", fid, fh, state);
 	zdev = kzalloc(sizeof(*zdev), GFP_KERNEL);
 	if (!zdev)
 		return ERR_PTR(-ENOMEM);
@@ -805,10 +809,33 @@
 		goto error;
 	zdev->state =  state;
 
-	kref_init(&zdev->kref);
 	mutex_init(&zdev->lock);
 	mutex_init(&zdev->kzdev_lock);
 
+	return zdev;
+
+error:
+	zpci_dbg(0, "crt fid:%x, rc:%d\n", fid, rc);
+	kfree(zdev);
+	return ERR_PTR(rc);
+}
+
+/**
+ * zpci_add_device() - Add a previously created zPCI device to the zPCI subsystem
+ * @zdev: The zPCI device to be added
+ *
+ * A struct zpci_dev is added to the zPCI subsystem and to a virtual PCI bus creating
+ * a new one as necessary. A hotplug slot is created and events start to be handled.
+ * If successful from this point on zpci_zdev_get() and zpci_zdev_put() must be used.
+ * If adding the struct zpci_dev fails the device was not added and should be freed.
+ *
+ * Return: 0 on success, or an error code otherwise
+ */
+int zpci_add_device(struct zpci_dev *zdev)
+{
+	int rc;
+
+	zpci_dbg(1, "add fid:%x, fh:%x, c:%d\n", zdev->fid, zdev->fh, zdev->state);
 	rc = zpci_init_iommu(zdev);
 	if (rc)
 		goto error;
@@ -817,18 +844,17 @@
 	if (rc)
 		goto error_destroy_iommu;
 
+	kref_init(&zdev->kref);
 	spin_lock(&zpci_list_lock);
 	list_add_tail(&zdev->entry, &zpci_list);
 	spin_unlock(&zpci_list_lock);
-
-	return zdev;
+	return 0;
 
 error_destroy_iommu:
 	zpci_destroy_iommu(zdev);
 error:
-	zpci_dbg(0, "add fid:%x, rc:%d\n", fid, rc);
-	kfree(zdev);
-	return ERR_PTR(rc);
+	zpci_dbg(0, "add fid:%x, rc:%d\n", zdev->fid, rc);
+	return rc;
 }
 
 bool zpci_is_device_configured(struct zpci_dev *zdev)
@@ -1081,6 +1107,50 @@
 	return s390_pci_initialized;
 }
 
+static int zpci_cmp_rid(void *priv, const struct list_head *a,
+			const struct list_head *b)
+{
+	struct zpci_dev *za = container_of(a, struct zpci_dev, entry);
+	struct zpci_dev *zb = container_of(b, struct zpci_dev, entry);
+
+	/*
+	 * PCI functions without RID available maintain original order
+	 * between themselves but sort before those with RID.
+	 */
+	if (za->rid == zb->rid)
+		return za->rid_available > zb->rid_available;
+	/*
+	 * PCI functions with RID sort by RID ascending.
+	 */
+	return za->rid > zb->rid;
+}
+
+static void zpci_add_devices(struct list_head *scan_list)
+{
+	struct zpci_dev *zdev, *tmp;
+
+	list_sort(NULL, scan_list, &zpci_cmp_rid);
+	list_for_each_entry_safe(zdev, tmp, scan_list, entry) {
+		list_del_init(&zdev->entry);
+		if (zpci_add_device(zdev))
+			kfree(zdev);
+	}
+}
+
+int zpci_scan_devices(void)
+{
+	LIST_HEAD(scan_list);
+	int rc;
+
+	rc = clp_scan_pci_devices(&scan_list);
+	if (rc)
+		return rc;
+
+	zpci_add_devices(&scan_list);
+	zpci_bus_scan_busses();
+	return 0;
+}
+
 static int __init pci_base_init(void)
 {
 	int rc;
@@ -1110,10 +1180,9 @@
 	if (rc)
 		goto out_irq;
 
-	rc = clp_scan_pci_devices();
+	rc = zpci_scan_devices();
 	if (rc)
 		goto out_find;
-	zpci_bus_scan_busses();
 
 	s390_pci_initialized = 1;
 	return 0;
--- linux-qcom-6.8.0.orig/arch/s390/pci/pci_bus.c
+++ linux-qcom-6.8.0/arch/s390/pci/pci_bus.c
@@ -168,9 +168,15 @@
 	mutex_unlock(&zbus_list_lock);
 }
 
+static bool zpci_bus_is_multifunction_root(struct zpci_dev *zdev)
+{
+	return !s390_pci_no_rid && zdev->rid_available &&
+		!zdev->vfn;
+}
+
 /* zpci_bus_create_pci_bus - Create the PCI bus associated with this zbus
  * @zbus: the zbus holding the zdevices
- * @fr: PCI root function that will determine the bus's domain, and bus speeed
+ * @fr: PCI root function that will determine the bus's domain, and bus speed
  * @ops: the pci operations
  *
  * The PCI function @fr determines the domain (its UID), multifunction property
@@ -188,7 +194,7 @@
 		return domain;
 
 	zbus->domain_nr = domain;
-	zbus->multifunction = fr->rid_available;
+	zbus->multifunction = zpci_bus_is_multifunction_root(fr);
 	zbus->max_bus_speed = fr->max_bus_speed;
 
 	/*
@@ -232,13 +238,15 @@
 	kref_put(&zbus->kref, zpci_bus_release);
 }
 
-static struct zpci_bus *zpci_bus_get(int pchid)
+static struct zpci_bus *zpci_bus_get(int topo, bool topo_is_tid)
 {
 	struct zpci_bus *zbus;
 
 	mutex_lock(&zbus_list_lock);
 	list_for_each_entry(zbus, &zbus_list, bus_next) {
-		if (pchid == zbus->pchid) {
+		if (!zbus->multifunction)
+			continue;
+		if (topo_is_tid == zbus->topo_is_tid && topo == zbus->topo) {
 			kref_get(&zbus->kref);
 			goto out_unlock;
 		}
@@ -249,7 +257,7 @@
 	return zbus;
 }
 
-static struct zpci_bus *zpci_bus_alloc(int pchid)
+static struct zpci_bus *zpci_bus_alloc(int topo, bool topo_is_tid)
 {
 	struct zpci_bus *zbus;
 
@@ -257,7 +265,8 @@
 	if (!zbus)
 		return NULL;
 
-	zbus->pchid = pchid;
+	zbus->topo = topo;
+	zbus->topo_is_tid = topo_is_tid;
 	INIT_LIST_HEAD(&zbus->bus_next);
 	mutex_lock(&zbus_list_lock);
 	list_add_tail(&zbus->bus_next, &zbus_list);
@@ -292,19 +301,22 @@
 {
 	int rc = -EINVAL;
 
+	if (zbus->multifunction) {
+		if (!zdev->rid_available) {
+			WARN_ONCE(1, "rid_available not set for multifunction\n");
+			return rc;
+		}
+		zdev->devfn = zdev->rid & ZPCI_RID_MASK_DEVFN;
+	}
+
 	if (zbus->function[zdev->devfn]) {
 		pr_err("devfn %04x is already assigned\n", zdev->devfn);
 		return rc;
 	}
-
 	zdev->zbus = zbus;
 	zbus->function[zdev->devfn] = zdev;
 	zpci_nb_devices++;
 
-	if (zbus->multifunction && !zdev->rid_available) {
-		WARN_ONCE(1, "rid_available not set for multifunction\n");
-		goto error;
-	}
 	rc = zpci_init_slot(zdev);
 	if (rc)
 		goto error;
@@ -319,10 +331,22 @@
 	return rc;
 }
 
+static bool zpci_bus_is_isolated_vf(struct zpci_bus *zbus, struct zpci_dev *zdev)
+{
+	struct pci_dev *pdev;
+
+	pdev = zpci_iov_find_parent_pf(zbus, zdev);
+	if (!pdev)
+		return true;
+	pci_dev_put(pdev);
+	return false;
+}
+
 int zpci_bus_device_register(struct zpci_dev *zdev, struct pci_ops *ops)
 {
+	bool topo_is_tid = zdev->tid_avail;
 	struct zpci_bus *zbus = NULL;
-	int rc = -EBADF;
+	int topo, rc = -EBADF;
 
 	if (zpci_nb_devices == ZPCI_NR_DEVICES) {
 		pr_warn("Adding PCI function %08x failed because the configured limit of %d is reached\n",
@@ -330,14 +354,19 @@
 		return -ENOSPC;
 	}
 
-	if (zdev->devfn >= ZPCI_FUNCTIONS_PER_BUS)
-		return -EINVAL;
-
-	if (!s390_pci_no_rid && zdev->rid_available)
-		zbus = zpci_bus_get(zdev->pchid);
+	topo = topo_is_tid ? zdev->tid : zdev->pchid;
+	zbus = zpci_bus_get(topo, topo_is_tid);
+	/*
+	 * An isolated VF gets its own domain/bus even if there exists
+	 * a matching domain/bus already
+	 */
+	if (zbus && zpci_bus_is_isolated_vf(zbus, zdev)) {
+		zpci_bus_put(zbus);
+		zbus = NULL;
+	}
 
 	if (!zbus) {
-		zbus = zpci_bus_alloc(zdev->pchid);
+		zbus = zpci_bus_alloc(topo, topo_is_tid);
 		if (!zbus)
 			return -ENOMEM;
 	}
--- linux-qcom-6.8.0.orig/arch/s390/pci/pci_clp.c
+++ linux-qcom-6.8.0/arch/s390/pci/pci_clp.c
@@ -164,10 +164,13 @@
 	zdev->port = response->port;
 	zdev->uid = response->uid;
 	zdev->fmb_length = sizeof(u32) * response->fmb_len;
-	zdev->rid_available = response->rid_avail;
 	zdev->is_physfn = response->is_physfn;
-	if (!s390_pci_no_rid && zdev->rid_available)
-		zdev->devfn = response->rid & ZPCI_RID_MASK_DEVFN;
+	zdev->rid_available = response->rid_avail;
+	if (zdev->rid_available)
+		zdev->rid = response->rid;
+	zdev->tid_avail = response->tid_avail;
+	if (zdev->tid_avail)
+		zdev->tid = response->tid;
 
 	memcpy(zdev->pfip, response->pfip, sizeof(zdev->pfip));
 	if (response->util_str_avail) {
@@ -407,6 +410,7 @@
 
 static void __clp_add(struct clp_fh_list_entry *entry, void *data)
 {
+	struct list_head *scan_list = data;
 	struct zpci_dev *zdev;
 
 	if (!entry->vendor_id)
@@ -417,10 +421,11 @@
 		zpci_zdev_put(zdev);
 		return;
 	}
-	zpci_create_device(entry->fid, entry->fh, entry->config_state);
+	zdev = zpci_create_device(entry->fid, entry->fh, entry->config_state);
+	list_add_tail(&zdev->entry, scan_list);
 }
 
-int clp_scan_pci_devices(void)
+int clp_scan_pci_devices(struct list_head *scan_list)
 {
 	struct clp_req_rsp_list_pci *rrb;
 	int rc;
@@ -429,7 +434,7 @@
 	if (!rrb)
 		return -ENOMEM;
 
-	rc = clp_list_pci(rrb, NULL, __clp_add);
+	rc = clp_list_pci(rrb, scan_list, __clp_add);
 
 	clp_free_block(rrb);
 	return rc;
--- linux-qcom-6.8.0.orig/arch/s390/pci/pci_debug.c
+++ linux-qcom-6.8.0/arch/s390/pci/pci_debug.c
@@ -71,17 +71,23 @@
 
 static void pci_sw_counter_show(struct seq_file *m)
 {
-	struct zpci_iommu_ctrs  *ctrs = zpci_get_iommu_ctrs(m->private);
+	struct zpci_dev *zdev = m->private;
+	struct zpci_iommu_ctrs *ctrs;
 	atomic64_t *counter;
+	unsigned long flags;
 	int i;
 
+	spin_lock_irqsave(&zdev->dom_lock, flags);
+	ctrs = zpci_get_iommu_ctrs(m->private);
 	if (!ctrs)
-		return;
+		goto unlock;
 
 	counter = &ctrs->mapped_pages;
 	for (i = 0; i < ARRAY_SIZE(pci_sw_names); i++, counter++)
 		seq_printf(m, "%26s:\t%llu\n", pci_sw_names[i],
 			   atomic64_read(counter));
+unlock:
+	spin_unlock_irqrestore(&zdev->dom_lock, flags);
 }
 
 static int pci_perf_show(struct seq_file *m, void *v)
--- linux-qcom-6.8.0.orig/arch/s390/pci/pci_event.c
+++ linux-qcom-6.8.0/arch/s390/pci/pci_event.c
@@ -279,18 +279,19 @@
 		goto no_pdev;
 
 	switch (ccdf->pec) {
-	case 0x003a: /* Service Action or Error Recovery Successful */
+	case 0x002a: /* Error event concerns FMB */
+	case 0x002b:
+	case 0x002c:
+		break;
+	case 0x0040: /* Service Action or Error Recovery Failed */
+	case 0x003b:
+		zpci_event_io_failure(pdev, pci_channel_io_perm_failure);
+		break;
+	default: /* PCI function left in the error state attempt to recover */
 		ers_res = zpci_event_attempt_error_recovery(pdev);
 		if (ers_res != PCI_ERS_RESULT_RECOVERED)
 			zpci_event_io_failure(pdev, pci_channel_io_perm_failure);
 		break;
-	default:
-		/*
-		 * Mark as frozen not permanently failed because the device
-		 * could be subsequently recovered by the platform.
-		 */
-		zpci_event_io_failure(pdev, pci_channel_io_frozen);
-		break;
 	}
 	pci_dev_put(pdev);
 no_pdev:
@@ -332,6 +333,10 @@
 			zdev = zpci_create_device(ccdf->fid, ccdf->fh, ZPCI_FN_STATE_CONFIGURED);
 			if (IS_ERR(zdev))
 				break;
+			if (zpci_add_device(zdev)) {
+				kfree(zdev);
+				break;
+			}
 		} else {
 			/* the configuration request may be stale */
 			if (zdev->state != ZPCI_FN_STATE_STANDBY)
@@ -341,10 +346,17 @@
 		zpci_scan_configured_device(zdev, ccdf->fh);
 		break;
 	case 0x0302: /* Reserved -> Standby */
-		if (!zdev)
-			zpci_create_device(ccdf->fid, ccdf->fh, ZPCI_FN_STATE_STANDBY);
-		else
+		if (!zdev) {
+			zdev = zpci_create_device(ccdf->fid, ccdf->fh, ZPCI_FN_STATE_STANDBY);
+			if (IS_ERR(zdev))
+				break;
+			if (zpci_add_device(zdev)) {
+				kfree(zdev);
+				break;
+			}
+		} else {
 			zpci_update_fh(zdev, ccdf->fh);
+		}
 		break;
 	case 0x0303: /* Deconfiguration requested */
 		if (zdev) {
@@ -373,7 +385,7 @@
 		break;
 	case 0x0306: /* 0x308 or 0x302 for multiple devices */
 		zpci_remove_reserved_devices();
-		clp_scan_pci_devices();
+		zpci_scan_devices();
 		break;
 	case 0x0308: /* Standby -> Reserved */
 		if (!zdev)
--- linux-qcom-6.8.0.orig/arch/s390/pci/pci_iov.c
+++ linux-qcom-6.8.0/arch/s390/pci/pci_iov.c
@@ -60,18 +60,35 @@
 	return 0;
 }
 
-int zpci_iov_setup_virtfn(struct zpci_bus *zbus, struct pci_dev *virtfn, int vfn)
+/**
+ * zpci_iov_find_parent_pf - Find the parent PF, if any, of the given function
+ * @zbus:	The bus that the PCI function is on, or would be added on
+ * @zdev:	The PCI function
+ *
+ * Finds the parent PF, if it exists and is configured, of the given PCI function
+ * and increments its refcount. Th PF is searched for on the provided bus so the
+ * caller has to ensure that this is the correct bus to search. This function may
+ * be used before adding the PCI function to a zbus.
+ *
+ * Return: Pointer to the struct pci_dev of the parent PF or NULL if it not
+ * found. If the function is not a VF or has no RequesterID information,
+ * NULL is returned as well.
+ */
+struct pci_dev *zpci_iov_find_parent_pf(struct zpci_bus *zbus, struct zpci_dev *zdev)
 {
-	int i, cand_devfn;
-	struct zpci_dev *zdev;
+	int i, vfid, devfn, cand_devfn;
 	struct pci_dev *pdev;
-	int vfid = vfn - 1; /* Linux' vfid's start at 0 vfn at 1*/
-	int rc = 0;
 
 	if (!zbus->multifunction)
-		return 0;
-
-	/* If the parent PF for the given VF is also configured in the
+		return NULL;
+	/* Non-VFs and VFs without RID available don't have a parent */
+	if (!zdev->vfn || !zdev->rid_available)
+		return NULL;
+	/* Linux vfid starts at 0 vfn at 1 */
+	vfid = zdev->vfn - 1;
+	devfn = zdev->rid & ZPCI_RID_MASK_DEVFN;
+	/*
+	 * If the parent PF for the given VF is also configured in the
 	 * instance, it must be on the same zbus.
 	 * We can then identify the parent PF by checking what
 	 * devfn the VF would have if it belonged to that PF using the PF's
@@ -85,15 +102,26 @@
 			if (!pdev)
 				continue;
 			cand_devfn = pci_iov_virtfn_devfn(pdev, vfid);
-			if (cand_devfn == virtfn->devfn) {
-				rc = zpci_iov_link_virtfn(pdev, virtfn, vfid);
-				/* balance pci_get_slot() */
-				pci_dev_put(pdev);
-				break;
-			}
+			if (cand_devfn == devfn)
+				return pdev;
 			/* balance pci_get_slot() */
 			pci_dev_put(pdev);
 		}
 	}
+	return NULL;
+}
+
+int zpci_iov_setup_virtfn(struct zpci_bus *zbus, struct pci_dev *virtfn, int vfn)
+{
+	struct zpci_dev *zdev = to_zpci(virtfn);
+	struct pci_dev *pdev_pf;
+	int rc = 0;
+
+	pdev_pf = zpci_iov_find_parent_pf(zbus, zdev);
+	if (pdev_pf) {
+		/* Linux' vfids start at 0 while zdev->vfn starts at 1 */
+		rc = zpci_iov_link_virtfn(pdev_pf, virtfn, zdev->vfn - 1);
+		pci_dev_put(pdev_pf);
+	}
 	return rc;
 }
--- linux-qcom-6.8.0.orig/arch/s390/pci/pci_iov.h
+++ linux-qcom-6.8.0/arch/s390/pci/pci_iov.h
@@ -17,6 +17,8 @@
 
 int zpci_iov_setup_virtfn(struct zpci_bus *zbus, struct pci_dev *virtfn, int vfn);
 
+struct pci_dev *zpci_iov_find_parent_pf(struct zpci_bus *zbus, struct zpci_dev *zdev);
+
 #else /* CONFIG_PCI_IOV */
 static inline void zpci_iov_remove_virtfn(struct pci_dev *pdev, int vfn) {}
 
@@ -26,5 +28,10 @@
 {
 	return 0;
 }
+
+static inline struct pci_dev *zpci_iov_find_parent_pf(struct zpci_bus *zbus, struct zpci_dev *zdev)
+{
+	return NULL;
+}
 #endif /* CONFIG_PCI_IOV */
 #endif /* __S390_PCI_IOV_h */
--- linux-qcom-6.8.0.orig/arch/s390/pci/pci_irq.c
+++ linux-qcom-6.8.0/arch/s390/pci/pci_irq.c
@@ -268,33 +268,20 @@
 	}
 }
 
-int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
+static int __alloc_airq(struct zpci_dev *zdev, int msi_vecs,
+			unsigned long *bit)
 {
-	struct zpci_dev *zdev = to_zpci(pdev);
-	unsigned int hwirq, msi_vecs, cpu;
-	unsigned long bit;
-	struct msi_desc *msi;
-	struct msi_msg msg;
-	int cpu_addr;
-	int rc, irq;
-
-	zdev->aisb = -1UL;
-	zdev->msi_first_bit = -1U;
-	if (type == PCI_CAP_ID_MSI && nvec > 1)
-		return 1;
-	msi_vecs = min_t(unsigned int, nvec, zdev->max_msi);
-
 	if (irq_delivery == DIRECTED) {
 		/* Allocate cpu vector bits */
-		bit = airq_iv_alloc(zpci_ibv[0], msi_vecs);
-		if (bit == -1UL)
+		*bit = airq_iv_alloc(zpci_ibv[0], msi_vecs);
+		if (*bit == -1UL)
 			return -EIO;
 	} else {
 		/* Allocate adapter summary indicator bit */
-		bit = airq_iv_alloc_bit(zpci_sbv);
-		if (bit == -1UL)
+		*bit = airq_iv_alloc_bit(zpci_sbv);
+		if (*bit == -1UL)
 			return -EIO;
-		zdev->aisb = bit;
+		zdev->aisb = *bit;
 
 		/* Create adapter interrupt vector */
 		zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK, NULL);
@@ -302,27 +289,66 @@
 			return -ENOMEM;
 
 		/* Wire up shortcut pointer */
-		zpci_ibv[bit] = zdev->aibv;
+		zpci_ibv[*bit] = zdev->aibv;
 		/* Each function has its own interrupt vector */
-		bit = 0;
+		*bit = 0;
+	}
+	return 0;
+}
+
+int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
+{
+	unsigned int hwirq, msi_vecs, irqs_per_msi, i, cpu;
+	struct zpci_dev *zdev = to_zpci(pdev);
+	struct msi_desc *msi;
+	struct msi_msg msg;
+	unsigned long bit;
+	int cpu_addr;
+	int rc, irq;
+
+	zdev->aisb = -1UL;
+	zdev->msi_first_bit = -1U;
+
+	msi_vecs = min_t(unsigned int, nvec, zdev->max_msi);
+	if (msi_vecs < nvec) {
+		pr_info("%s requested %d irqs, allocate system limit of %d",
+			pci_name(pdev), nvec, zdev->max_msi);
 	}
 
-	/* Request MSI interrupts */
+	rc = __alloc_airq(zdev, msi_vecs, &bit);
+	if (rc < 0)
+		return rc;
+
+	/*
+	 * Request MSI interrupts:
+	 * When using MSI, nvec_used interrupt sources and their irq
+	 * descriptors are controlled through one msi descriptor.
+	 * Thus the outer loop over msi descriptors shall run only once,
+	 * while two inner loops iterate over the interrupt vectors.
+	 * When using MSI-X, each interrupt vector/irq descriptor
+	 * is bound to exactly one msi descriptor (nvec_used is one).
+	 * So the inner loops are executed once, while the outer iterates
+	 * over the MSI-X descriptors.
+	 */
 	hwirq = bit;
 	msi_for_each_desc(msi, &pdev->dev, MSI_DESC_NOTASSOCIATED) {
-		rc = -EIO;
 		if (hwirq - bit >= msi_vecs)
 			break;
-		irq = __irq_alloc_descs(-1, 0, 1, 0, THIS_MODULE,
-				(irq_delivery == DIRECTED) ?
-				msi->affinity : NULL);
+		irqs_per_msi = min_t(unsigned int, msi_vecs, msi->nvec_used);
+		irq = __irq_alloc_descs(-1, 0, irqs_per_msi, 0, THIS_MODULE,
+					(irq_delivery == DIRECTED) ?
+					msi->affinity : NULL);
 		if (irq < 0)
 			return -ENOMEM;
-		rc = irq_set_msi_desc(irq, msi);
-		if (rc)
-			return rc;
-		irq_set_chip_and_handler(irq, &zpci_irq_chip,
-					 handle_percpu_irq);
+
+		for (i = 0; i < irqs_per_msi; i++) {
+			rc = irq_set_msi_desc_off(irq, i, msi);
+			if (rc)
+				return rc;
+			irq_set_chip_and_handler(irq + i, &zpci_irq_chip,
+						 handle_percpu_irq);
+		}
+
 		msg.data = hwirq - bit;
 		if (irq_delivery == DIRECTED) {
 			if (msi->affinity)
@@ -335,31 +361,35 @@
 			msg.address_lo |= (cpu_addr << 8);
 
 			for_each_possible_cpu(cpu) {
-				airq_iv_set_data(zpci_ibv[cpu], hwirq, irq);
+				for (i = 0; i < irqs_per_msi; i++)
+					airq_iv_set_data(zpci_ibv[cpu],
+							 hwirq + i, irq + i);
 			}
 		} else {
 			msg.address_lo = zdev->msi_addr & 0xffffffff;
-			airq_iv_set_data(zdev->aibv, hwirq, irq);
+			for (i = 0; i < irqs_per_msi; i++)
+				airq_iv_set_data(zdev->aibv, hwirq + i, irq + i);
 		}
 		msg.address_hi = zdev->msi_addr >> 32;
 		pci_write_msi_msg(irq, &msg);
-		hwirq++;
+		hwirq += irqs_per_msi;
 	}
 
 	zdev->msi_first_bit = bit;
-	zdev->msi_nr_irqs = msi_vecs;
+	zdev->msi_nr_irqs = hwirq - bit;
 
 	rc = zpci_set_irq(zdev);
 	if (rc)
 		return rc;
 
-	return (msi_vecs == nvec) ? 0 : msi_vecs;
+	return (zdev->msi_nr_irqs == nvec) ? 0 : zdev->msi_nr_irqs;
 }
 
 void arch_teardown_msi_irqs(struct pci_dev *pdev)
 {
 	struct zpci_dev *zdev = to_zpci(pdev);
 	struct msi_desc *msi;
+	unsigned int i;
 	int rc;
 
 	/* Disable interrupts */
@@ -369,8 +399,10 @@
 
 	/* Release MSI interrupts */
 	msi_for_each_desc(msi, &pdev->dev, MSI_DESC_ASSOCIATED) {
-		irq_set_msi_desc(msi->irq, NULL);
-		irq_free_desc(msi->irq);
+		for (i = 0; i < msi->nvec_used; i++) {
+			irq_set_msi_desc(msi->irq + i, NULL);
+			irq_free_desc(msi->irq + i);
+		}
 		msi->msg.address_lo = 0;
 		msi->msg.address_hi = 0;
 		msi->msg.data = 0;
@@ -410,7 +442,7 @@
 	union zpci_sic_iib iib = {{0}};
 	union zpci_sic_iib ziib = {{0}};
 
-	iib.cdiib.dibv_addr = (u64) zpci_ibv[smp_processor_id()]->vector;
+	iib.cdiib.dibv_addr = virt_to_phys(zpci_ibv[smp_processor_id()]->vector);
 
 	zpci_set_irq_ctrl(SIC_IRQ_MODE_SET_CPU, 0, &iib);
 	zpci_set_irq_ctrl(SIC_IRQ_MODE_D_SINGLE, PCI_ISC, &ziib);
--- linux-qcom-6.8.0.orig/arch/sh/kernel/cpu/proc.c
+++ linux-qcom-6.8.0/arch/sh/kernel/cpu/proc.c
@@ -132,7 +132,7 @@
 
 static void *c_start(struct seq_file *m, loff_t *pos)
 {
-	return *pos < NR_CPUS ? cpu_data + *pos : NULL;
+	return *pos < nr_cpu_ids ? cpu_data + *pos : NULL;
 }
 static void *c_next(struct seq_file *m, void *v, loff_t *pos)
 {
--- linux-qcom-6.8.0.orig/arch/sh/kernel/kprobes.c
+++ linux-qcom-6.8.0/arch/sh/kernel/kprobes.c
@@ -44,17 +44,12 @@
 	if (OPCODE_RTE(opcode))
 		return -EFAULT;	/* Bad breakpoint */
 
+	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
 	p->opcode = opcode;
 
 	return 0;
 }
 
-void __kprobes arch_copy_kprobe(struct kprobe *p)
-{
-	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-	p->opcode = *p->addr;
-}
-
 void __kprobes arch_arm_kprobe(struct kprobe *p)
 {
 	*p->addr = BREAKPOINT_INSTRUCTION;
--- linux-qcom-6.8.0.orig/arch/sh/kernel/setup.c
+++ linux-qcom-6.8.0/arch/sh/kernel/setup.c
@@ -255,7 +255,7 @@
 	dt_virt = phys_to_virt(dt_phys);
 #endif
 
-	if (!dt_virt || !early_init_dt_scan(dt_virt)) {
+	if (!dt_virt || !early_init_dt_scan(dt_virt, __pa(dt_virt))) {
 		pr_crit("Error: invalid device tree blob"
 			" at physical address %p\n", (void *)dt_phys);
 
--- linux-qcom-6.8.0.orig/arch/sh/kernel/sys_sh32.c
+++ linux-qcom-6.8.0/arch/sh/kernel/sys_sh32.c
@@ -59,3 +59,14 @@
 				 (u64)len0 << 32 | len1, advice);
 #endif
 }
+
+/*
+ * swap the arguments the way that libc wants them instead of
+ * moving flags ahead of the 64-bit nbytes argument
+ */
+SYSCALL_DEFINE6(sh_sync_file_range6, int, fd, SC_ARG64(offset),
+                SC_ARG64(nbytes), unsigned int, flags)
+{
+        return ksys_sync_file_range(fd, SC_VAL64(loff_t, offset),
+                                    SC_VAL64(loff_t, nbytes), flags);
+}
--- linux-qcom-6.8.0.orig/arch/sh/kernel/syscalls/syscall.tbl
+++ linux-qcom-6.8.0/arch/sh/kernel/syscalls/syscall.tbl
@@ -321,7 +321,7 @@
 311	common	set_robust_list			sys_set_robust_list
 312	common	get_robust_list			sys_get_robust_list
 313	common	splice				sys_splice
-314	common	sync_file_range			sys_sync_file_range
+314	common	sync_file_range			sys_sh_sync_file_range6
 315	common	tee				sys_tee
 316	common	vmsplice			sys_vmsplice
 317	common	move_pages			sys_move_pages
@@ -395,6 +395,7 @@
 385	common	pkey_alloc			sys_pkey_alloc
 386	common	pkey_free			sys_pkey_free
 387	common	rseq				sys_rseq
+388	common	sync_file_range2		sys_sync_file_range2
 # room for arch specific syscalls
 393	common	semget				sys_semget
 394	common	semctl				sys_semctl
--- linux-qcom-6.8.0.orig/arch/sh/lib/checksum.S
+++ linux-qcom-6.8.0/arch/sh/lib/checksum.S
@@ -33,7 +33,8 @@
  */
 
 /*	
- * asmlinkage __wsum csum_partial(const void *buf, int len, __wsum sum);
+ * unsigned int csum_partial(const unsigned char *buf, int len,
+ *                           unsigned int sum);
  */
 
 .text
@@ -45,31 +46,11 @@
 	   * Fortunately, it is easy to convert 2-byte alignment to 4-byte
 	   * alignment for the unrolled loop.
 	   */
+	mov	r5, r1
 	mov	r4, r0
-	tst	#3, r0		! Check alignment.
-	bt/s	2f		! Jump if alignment is ok.
-	 mov	r4, r7		! Keep a copy to check for alignment
+	tst	#2, r0		! Check alignment.
+	bt	2f		! Jump if alignment is ok.
 	!
-	tst	#1, r0		! Check alignment.
-	bt	21f		! Jump if alignment is boundary of 2bytes.
-
-	! buf is odd
-	tst	r5, r5
-	add	#-1, r5
-	bt	9f
-	mov.b	@r4+, r0
-	extu.b	r0, r0
-	addc	r0, r6		! t=0 from previous tst
-	mov	r6, r0
-	shll8	r6
-	shlr16	r0
-	shlr8	r0
-	or	r0, r6
-	mov	r4, r0
-	tst	#2, r0
-	bt	2f
-21:
-	! buf is 2 byte aligned (len could be 0)
 	add	#-2, r5		! Alignment uses up two bytes.
 	cmp/pz	r5		!
 	bt/s	1f		! Jump if we had at least two bytes.
@@ -77,17 +58,16 @@
 	bra	6f
 	 add	#2, r5		! r5 was < 2.  Deal with it.
 1:
+	mov	r5, r1		! Save new len for later use.
 	mov.w	@r4+, r0
 	extu.w	r0, r0
 	addc	r0, r6
 	bf	2f
 	add	#1, r6
 2:
-	! buf is 4 byte aligned (len could be 0)
-	mov	r5, r1
 	mov	#-5, r0
-	shld	r0, r1
-	tst	r1, r1
+	shld	r0, r5
+	tst	r5, r5
 	bt/s	4f		! if it's =0, go to 4f
 	 clrt
 	.align	2
@@ -109,31 +89,30 @@
 	addc	r0, r6
 	addc	r2, r6
 	movt	r0
-	dt	r1
+	dt	r5
 	bf/s	3b
 	 cmp/eq	#1, r0
-	! here, we know r1==0
-	addc	r1, r6			! add carry to r6
+	! here, we know r5==0
+	addc	r5, r6			! add carry to r6
 4:
-	mov	r5, r0
+	mov	r1, r0
 	and	#0x1c, r0
 	tst	r0, r0
-	bt	6f
-	! 4 bytes or more remaining
-	mov	r0, r1
-	shlr2	r1
+	bt/s	6f
+	 mov	r0, r5
+	shlr2	r5
 	mov	#0, r2
 5:
 	addc	r2, r6
 	mov.l	@r4+, r2
 	movt	r0
-	dt	r1
+	dt	r5
 	bf/s	5b
 	 cmp/eq	#1, r0
 	addc	r2, r6
-	addc	r1, r6		! r1==0 here, so it means add carry-bit
+	addc	r5, r6		! r5==0 here, so it means add carry-bit
 6:
-	! 3 bytes or less remaining
+	mov	r1, r5
 	mov	#3, r0
 	and	r0, r5
 	tst	r5, r5
@@ -159,16 +138,6 @@
 	mov	#0, r0
 	addc	r0, r6
 9:
-	! Check if the buffer was misaligned, if so realign sum
-	mov	r7, r0
-	tst	#1, r0
-	bt	10f
-	mov	r6, r0
-	shll8	r6
-	shlr16	r0
-	shlr8	r0
-	or	r0, r6
-10:
 	rts
 	 mov	r6, r0
 
--- linux-qcom-6.8.0.orig/arch/sparc/Kconfig
+++ linux-qcom-6.8.0/arch/sparc/Kconfig
@@ -57,6 +57,8 @@
 	select CLZ_TAB
 	select DMA_DIRECT_REMAP
 	select GENERIC_ATOMIC64
+	select GENERIC_LIB_CMPDI2
+	select GENERIC_LIB_UCMPDI2
 	select HAVE_UID16
 	select LOCK_MM_AND_FIND_VMA
 	select OLD_SIGACTION
@@ -140,10 +142,6 @@
 	default y if SPARC32
 	select KMAP_LOCAL
 
-config GENERIC_ISA_DMA
-	bool
-	default y if SPARC32
-
 config PGTABLE_LEVELS
 	default 4 if 64BIT
 	default 3
--- linux-qcom-6.8.0.orig/arch/sparc/include/asm/oplib_64.h
+++ linux-qcom-6.8.0/arch/sparc/include/asm/oplib_64.h
@@ -247,6 +247,7 @@
 int prom_ihandle2path(int handle, char *buffer, int bufsize);
 
 /* Client interface level routines. */
+void prom_cif_init(void *cif_handler);
 void p1275_cmd_direct(unsigned long *);
 
 #endif /* !(__SPARC64_OPLIB_H) */
--- linux-qcom-6.8.0.orig/arch/sparc/include/asm/parport.h
+++ linux-qcom-6.8.0/arch/sparc/include/asm/parport.h
@@ -1,256 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* parport.h: sparc64 specific parport initialization and dma.
- *
- * Copyright (C) 1999  Eddie C. Dost  (ecd@skynet.be)
- */
+#ifndef ___ASM_SPARC_PARPORT_H
+#define ___ASM_SPARC_PARPORT_H
 
-#ifndef _ASM_SPARC64_PARPORT_H
-#define _ASM_SPARC64_PARPORT_H 1
-
-#include <linux/of.h>
-#include <linux/platform_device.h>
-
-#include <asm/ebus_dma.h>
-#include <asm/ns87303.h>
-#include <asm/prom.h>
-
-#define PARPORT_PC_MAX_PORTS	PARPORT_MAX
-
-/*
- * While sparc64 doesn't have an ISA DMA API, we provide something that looks
- * close enough to make parport_pc happy
- */
-#define HAS_DMA
-
-#ifdef CONFIG_PARPORT_PC_FIFO
-static DEFINE_SPINLOCK(dma_spin_lock);
-
-#define claim_dma_lock() \
-({	unsigned long flags; \
-	spin_lock_irqsave(&dma_spin_lock, flags); \
-	flags; \
-})
-
-#define release_dma_lock(__flags) \
-	spin_unlock_irqrestore(&dma_spin_lock, __flags);
+#if defined(__sparc__) && defined(__arch64__)
+#include <asm/parport_64.h>
+#else
+#include <asm-generic/parport.h>
+#endif
 #endif
 
-static struct sparc_ebus_info {
-	struct ebus_dma_info info;
-	unsigned int addr;
-	unsigned int count;
-	int lock;
-
-	struct parport *port;
-} sparc_ebus_dmas[PARPORT_PC_MAX_PORTS];
-
-static DECLARE_BITMAP(dma_slot_map, PARPORT_PC_MAX_PORTS);
-
-static inline int request_dma(unsigned int dmanr, const char *device_id)
-{
-	if (dmanr >= PARPORT_PC_MAX_PORTS)
-		return -EINVAL;
-	if (xchg(&sparc_ebus_dmas[dmanr].lock, 1) != 0)
-		return -EBUSY;
-	return 0;
-}
-
-static inline void free_dma(unsigned int dmanr)
-{
-	if (dmanr >= PARPORT_PC_MAX_PORTS) {
-		printk(KERN_WARNING "Trying to free DMA%d\n", dmanr);
-		return;
-	}
-	if (xchg(&sparc_ebus_dmas[dmanr].lock, 0) == 0) {
-		printk(KERN_WARNING "Trying to free free DMA%d\n", dmanr);
-		return;
-	}
-}
-
-static inline void enable_dma(unsigned int dmanr)
-{
-	ebus_dma_enable(&sparc_ebus_dmas[dmanr].info, 1);
-
-	if (ebus_dma_request(&sparc_ebus_dmas[dmanr].info,
-			     sparc_ebus_dmas[dmanr].addr,
-			     sparc_ebus_dmas[dmanr].count))
-		BUG();
-}
-
-static inline void disable_dma(unsigned int dmanr)
-{
-	ebus_dma_enable(&sparc_ebus_dmas[dmanr].info, 0);
-}
-
-static inline void clear_dma_ff(unsigned int dmanr)
-{
-	/* nothing */
-}
-
-static inline void set_dma_mode(unsigned int dmanr, char mode)
-{
-	ebus_dma_prepare(&sparc_ebus_dmas[dmanr].info, (mode != DMA_MODE_WRITE));
-}
-
-static inline void set_dma_addr(unsigned int dmanr, unsigned int addr)
-{
-	sparc_ebus_dmas[dmanr].addr = addr;
-}
-
-static inline void set_dma_count(unsigned int dmanr, unsigned int count)
-{
-	sparc_ebus_dmas[dmanr].count = count;
-}
-
-static inline unsigned int get_dma_residue(unsigned int dmanr)
-{
-	return ebus_dma_residue(&sparc_ebus_dmas[dmanr].info);
-}
-
-static int ecpp_probe(struct platform_device *op)
-{
-	unsigned long base = op->resource[0].start;
-	unsigned long config = op->resource[1].start;
-	unsigned long d_base = op->resource[2].start;
-	unsigned long d_len;
-	struct device_node *parent;
-	struct parport *p;
-	int slot, err;
-
-	parent = op->dev.of_node->parent;
-	if (of_node_name_eq(parent, "dma")) {
-		p = parport_pc_probe_port(base, base + 0x400,
-					  op->archdata.irqs[0], PARPORT_DMA_NOFIFO,
-					  op->dev.parent->parent, 0);
-		if (!p)
-			return -ENOMEM;
-		dev_set_drvdata(&op->dev, p);
-		return 0;
-	}
-
-	for (slot = 0; slot < PARPORT_PC_MAX_PORTS; slot++) {
-		if (!test_and_set_bit(slot, dma_slot_map))
-			break;
-	}
-	err = -ENODEV;
-	if (slot >= PARPORT_PC_MAX_PORTS)
-		goto out_err;
-
-	spin_lock_init(&sparc_ebus_dmas[slot].info.lock);
-
-	d_len = (op->resource[2].end - d_base) + 1UL;
-	sparc_ebus_dmas[slot].info.regs =
-		of_ioremap(&op->resource[2], 0, d_len, "ECPP DMA");
-
-	if (!sparc_ebus_dmas[slot].info.regs)
-		goto out_clear_map;
-
-	sparc_ebus_dmas[slot].info.flags = 0;
-	sparc_ebus_dmas[slot].info.callback = NULL;
-	sparc_ebus_dmas[slot].info.client_cookie = NULL;
-	sparc_ebus_dmas[slot].info.irq = 0xdeadbeef;
-	strcpy(sparc_ebus_dmas[slot].info.name, "parport");
-	if (ebus_dma_register(&sparc_ebus_dmas[slot].info))
-		goto out_unmap_regs;
-
-	ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 1);
-
-	/* Configure IRQ to Push Pull, Level Low */
-	/* Enable ECP, set bit 2 of the CTR first */
-	outb(0x04, base + 0x02);
-	ns87303_modify(config, PCR,
-		       PCR_EPP_ENABLE |
-		       PCR_IRQ_ODRAIN,
-		       PCR_ECP_ENABLE |
-		       PCR_ECP_CLK_ENA |
-		       PCR_IRQ_POLAR);
-
-	/* CTR bit 5 controls direction of port */
-	ns87303_modify(config, PTR,
-		       0, PTR_LPT_REG_DIR);
-
-	p = parport_pc_probe_port(base, base + 0x400,
-				  op->archdata.irqs[0],
-				  slot,
-				  op->dev.parent,
-				  0);
-	err = -ENOMEM;
-	if (!p)
-		goto out_disable_irq;
-
-	dev_set_drvdata(&op->dev, p);
-
-	return 0;
-
-out_disable_irq:
-	ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 0);
-	ebus_dma_unregister(&sparc_ebus_dmas[slot].info);
-
-out_unmap_regs:
-	of_iounmap(&op->resource[2], sparc_ebus_dmas[slot].info.regs, d_len);
-
-out_clear_map:
-	clear_bit(slot, dma_slot_map);
-
-out_err:
-	return err;
-}
-
-static int ecpp_remove(struct platform_device *op)
-{
-	struct parport *p = dev_get_drvdata(&op->dev);
-	int slot = p->dma;
-
-	parport_pc_unregister_port(p);
-
-	if (slot != PARPORT_DMA_NOFIFO) {
-		unsigned long d_base = op->resource[2].start;
-		unsigned long d_len;
-
-		d_len = (op->resource[2].end - d_base) + 1UL;
-
-		ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 0);
-		ebus_dma_unregister(&sparc_ebus_dmas[slot].info);
-		of_iounmap(&op->resource[2],
-			   sparc_ebus_dmas[slot].info.regs,
-			   d_len);
-		clear_bit(slot, dma_slot_map);
-	}
-
-	return 0;
-}
-
-static const struct of_device_id ecpp_match[] = {
-	{
-		.name = "ecpp",
-	},
-	{
-		.name = "parallel",
-		.compatible = "ecpp",
-	},
-	{
-		.name = "parallel",
-		.compatible = "ns87317-ecpp",
-	},
-	{
-		.name = "parallel",
-		.compatible = "pnpALI,1533,3",
-	},
-	{},
-};
-
-static struct platform_driver ecpp_driver = {
-	.driver = {
-		.name = "ecpp",
-		.of_match_table = ecpp_match,
-	},
-	.probe			= ecpp_probe,
-	.remove			= ecpp_remove,
-};
-
-static int parport_pc_find_nonpci_ports(int autoirq, int autodma)
-{
-	return platform_driver_register(&ecpp_driver);
-}
-
-#endif /* !(_ASM_SPARC64_PARPORT_H */
--- linux-qcom-6.8.0.orig/arch/sparc/include/asm/parport_64.h
+++ linux-qcom-6.8.0/arch/sparc/include/asm/parport_64.h
@@ -0,0 +1,256 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* parport.h: sparc64 specific parport initialization and dma.
+ *
+ * Copyright (C) 1999  Eddie C. Dost  (ecd@skynet.be)
+ */
+
+#ifndef _ASM_SPARC64_PARPORT_H
+#define _ASM_SPARC64_PARPORT_H 1
+
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include <asm/ebus_dma.h>
+#include <asm/ns87303.h>
+#include <asm/prom.h>
+
+#define PARPORT_PC_MAX_PORTS	PARPORT_MAX
+
+/*
+ * While sparc64 doesn't have an ISA DMA API, we provide something that looks
+ * close enough to make parport_pc happy
+ */
+#define HAS_DMA
+
+#ifdef CONFIG_PARPORT_PC_FIFO
+static DEFINE_SPINLOCK(dma_spin_lock);
+
+#define claim_dma_lock() \
+({	unsigned long flags; \
+	spin_lock_irqsave(&dma_spin_lock, flags); \
+	flags; \
+})
+
+#define release_dma_lock(__flags) \
+	spin_unlock_irqrestore(&dma_spin_lock, __flags);
+#endif
+
+static struct sparc_ebus_info {
+	struct ebus_dma_info info;
+	unsigned int addr;
+	unsigned int count;
+	int lock;
+
+	struct parport *port;
+} sparc_ebus_dmas[PARPORT_PC_MAX_PORTS];
+
+static DECLARE_BITMAP(dma_slot_map, PARPORT_PC_MAX_PORTS);
+
+static inline int request_dma(unsigned int dmanr, const char *device_id)
+{
+	if (dmanr >= PARPORT_PC_MAX_PORTS)
+		return -EINVAL;
+	if (xchg(&sparc_ebus_dmas[dmanr].lock, 1) != 0)
+		return -EBUSY;
+	return 0;
+}
+
+static inline void free_dma(unsigned int dmanr)
+{
+	if (dmanr >= PARPORT_PC_MAX_PORTS) {
+		printk(KERN_WARNING "Trying to free DMA%d\n", dmanr);
+		return;
+	}
+	if (xchg(&sparc_ebus_dmas[dmanr].lock, 0) == 0) {
+		printk(KERN_WARNING "Trying to free free DMA%d\n", dmanr);
+		return;
+	}
+}
+
+static inline void enable_dma(unsigned int dmanr)
+{
+	ebus_dma_enable(&sparc_ebus_dmas[dmanr].info, 1);
+
+	if (ebus_dma_request(&sparc_ebus_dmas[dmanr].info,
+			     sparc_ebus_dmas[dmanr].addr,
+			     sparc_ebus_dmas[dmanr].count))
+		BUG();
+}
+
+static inline void disable_dma(unsigned int dmanr)
+{
+	ebus_dma_enable(&sparc_ebus_dmas[dmanr].info, 0);
+}
+
+static inline void clear_dma_ff(unsigned int dmanr)
+{
+	/* nothing */
+}
+
+static inline void set_dma_mode(unsigned int dmanr, char mode)
+{
+	ebus_dma_prepare(&sparc_ebus_dmas[dmanr].info, (mode != DMA_MODE_WRITE));
+}
+
+static inline void set_dma_addr(unsigned int dmanr, unsigned int addr)
+{
+	sparc_ebus_dmas[dmanr].addr = addr;
+}
+
+static inline void set_dma_count(unsigned int dmanr, unsigned int count)
+{
+	sparc_ebus_dmas[dmanr].count = count;
+}
+
+static inline unsigned int get_dma_residue(unsigned int dmanr)
+{
+	return ebus_dma_residue(&sparc_ebus_dmas[dmanr].info);
+}
+
+static int ecpp_probe(struct platform_device *op)
+{
+	unsigned long base = op->resource[0].start;
+	unsigned long config = op->resource[1].start;
+	unsigned long d_base = op->resource[2].start;
+	unsigned long d_len;
+	struct device_node *parent;
+	struct parport *p;
+	int slot, err;
+
+	parent = op->dev.of_node->parent;
+	if (of_node_name_eq(parent, "dma")) {
+		p = parport_pc_probe_port(base, base + 0x400,
+					  op->archdata.irqs[0], PARPORT_DMA_NOFIFO,
+					  op->dev.parent->parent, 0);
+		if (!p)
+			return -ENOMEM;
+		dev_set_drvdata(&op->dev, p);
+		return 0;
+	}
+
+	for (slot = 0; slot < PARPORT_PC_MAX_PORTS; slot++) {
+		if (!test_and_set_bit(slot, dma_slot_map))
+			break;
+	}
+	err = -ENODEV;
+	if (slot >= PARPORT_PC_MAX_PORTS)
+		goto out_err;
+
+	spin_lock_init(&sparc_ebus_dmas[slot].info.lock);
+
+	d_len = (op->resource[2].end - d_base) + 1UL;
+	sparc_ebus_dmas[slot].info.regs =
+		of_ioremap(&op->resource[2], 0, d_len, "ECPP DMA");
+
+	if (!sparc_ebus_dmas[slot].info.regs)
+		goto out_clear_map;
+
+	sparc_ebus_dmas[slot].info.flags = 0;
+	sparc_ebus_dmas[slot].info.callback = NULL;
+	sparc_ebus_dmas[slot].info.client_cookie = NULL;
+	sparc_ebus_dmas[slot].info.irq = 0xdeadbeef;
+	strcpy(sparc_ebus_dmas[slot].info.name, "parport");
+	if (ebus_dma_register(&sparc_ebus_dmas[slot].info))
+		goto out_unmap_regs;
+
+	ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 1);
+
+	/* Configure IRQ to Push Pull, Level Low */
+	/* Enable ECP, set bit 2 of the CTR first */
+	outb(0x04, base + 0x02);
+	ns87303_modify(config, PCR,
+		       PCR_EPP_ENABLE |
+		       PCR_IRQ_ODRAIN,
+		       PCR_ECP_ENABLE |
+		       PCR_ECP_CLK_ENA |
+		       PCR_IRQ_POLAR);
+
+	/* CTR bit 5 controls direction of port */
+	ns87303_modify(config, PTR,
+		       0, PTR_LPT_REG_DIR);
+
+	p = parport_pc_probe_port(base, base + 0x400,
+				  op->archdata.irqs[0],
+				  slot,
+				  op->dev.parent,
+				  0);
+	err = -ENOMEM;
+	if (!p)
+		goto out_disable_irq;
+
+	dev_set_drvdata(&op->dev, p);
+
+	return 0;
+
+out_disable_irq:
+	ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 0);
+	ebus_dma_unregister(&sparc_ebus_dmas[slot].info);
+
+out_unmap_regs:
+	of_iounmap(&op->resource[2], sparc_ebus_dmas[slot].info.regs, d_len);
+
+out_clear_map:
+	clear_bit(slot, dma_slot_map);
+
+out_err:
+	return err;
+}
+
+static int ecpp_remove(struct platform_device *op)
+{
+	struct parport *p = dev_get_drvdata(&op->dev);
+	int slot = p->dma;
+
+	parport_pc_unregister_port(p);
+
+	if (slot != PARPORT_DMA_NOFIFO) {
+		unsigned long d_base = op->resource[2].start;
+		unsigned long d_len;
+
+		d_len = (op->resource[2].end - d_base) + 1UL;
+
+		ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 0);
+		ebus_dma_unregister(&sparc_ebus_dmas[slot].info);
+		of_iounmap(&op->resource[2],
+			   sparc_ebus_dmas[slot].info.regs,
+			   d_len);
+		clear_bit(slot, dma_slot_map);
+	}
+
+	return 0;
+}
+
+static const struct of_device_id ecpp_match[] = {
+	{
+		.name = "ecpp",
+	},
+	{
+		.name = "parallel",
+		.compatible = "ecpp",
+	},
+	{
+		.name = "parallel",
+		.compatible = "ns87317-ecpp",
+	},
+	{
+		.name = "parallel",
+		.compatible = "pnpALI,1533,3",
+	},
+	{},
+};
+
+static struct platform_driver ecpp_driver = {
+	.driver = {
+		.name = "ecpp",
+		.of_match_table = ecpp_match,
+	},
+	.probe			= ecpp_probe,
+	.remove			= ecpp_remove,
+};
+
+static int parport_pc_find_nonpci_ports(int autoirq, int autodma)
+{
+	return platform_driver_register(&ecpp_driver);
+}
+
+#endif /* !(_ASM_SPARC64_PARPORT_H */
--- linux-qcom-6.8.0.orig/arch/sparc/include/asm/smp_64.h
+++ linux-qcom-6.8.0/arch/sparc/include/asm/smp_64.h
@@ -47,7 +47,6 @@
 int hard_smp_processor_id(void);
 #define raw_smp_processor_id() (current_thread_info()->cpu)
 
-void smp_fill_in_cpu_possible_map(void);
 void smp_fill_in_sib_core_maps(void);
 void __noreturn cpu_play_dead(void);
 
@@ -77,7 +76,6 @@
 #define smp_fill_in_sib_core_maps() do { } while (0)
 #define smp_fetch_global_regs() do { } while (0)
 #define smp_fetch_global_pmu() do { } while (0)
-#define smp_fill_in_cpu_possible_map() do { } while (0)
 #define smp_init_cpu_poke() do { } while (0)
 #define scheduler_poke() do { } while (0)
 
--- linux-qcom-6.8.0.orig/arch/sparc/include/uapi/asm/termbits.h
+++ linux-qcom-6.8.0/arch/sparc/include/uapi/asm/termbits.h
@@ -10,16 +10,6 @@
 typedef unsigned long	tcflag_t;
 #endif
 
-#define NCC 8
-struct termio {
-	unsigned short c_iflag;		/* input mode flags */
-	unsigned short c_oflag;		/* output mode flags */
-	unsigned short c_cflag;		/* control mode flags */
-	unsigned short c_lflag;		/* local mode flags */
-	unsigned char c_line;		/* line discipline */
-	unsigned char c_cc[NCC];	/* control characters */
-};
-
 #define NCCS 17
 struct termios {
 	tcflag_t c_iflag;		/* input mode flags */
--- linux-qcom-6.8.0.orig/arch/sparc/include/uapi/asm/termios.h
+++ linux-qcom-6.8.0/arch/sparc/include/uapi/asm/termios.h
@@ -40,5 +40,14 @@
 	unsigned short ws_ypixel;
 };
 
+#define NCC 8
+struct termio {
+	unsigned short c_iflag;		/* input mode flags */
+	unsigned short c_oflag;		/* output mode flags */
+	unsigned short c_cflag;		/* control mode flags */
+	unsigned short c_lflag;		/* local mode flags */
+	unsigned char c_line;		/* line discipline */
+	unsigned char c_cc[NCC];	/* control characters */
+};
 
 #endif /* _UAPI_SPARC_TERMIOS_H */
--- linux-qcom-6.8.0.orig/arch/sparc/kernel/leon_pci_grpci1.c
+++ linux-qcom-6.8.0/arch/sparc/kernel/leon_pci_grpci1.c
@@ -697,7 +697,7 @@
 	return err;
 }
 
-static const struct of_device_id grpci1_of_match[] __initconst = {
+static const struct of_device_id grpci1_of_match[] = {
 	{
 	 .name = "GAISLER_PCIFBRG",
 	 },
--- linux-qcom-6.8.0.orig/arch/sparc/kernel/leon_pci_grpci2.c
+++ linux-qcom-6.8.0/arch/sparc/kernel/leon_pci_grpci2.c
@@ -889,7 +889,7 @@
 	return err;
 }
 
-static const struct of_device_id grpci2_of_match[] __initconst = {
+static const struct of_device_id grpci2_of_match[] = {
 	{
 	 .name = "GAISLER_GRPCI2",
 	 },
--- linux-qcom-6.8.0.orig/arch/sparc/kernel/nmi.c
+++ linux-qcom-6.8.0/arch/sparc/kernel/nmi.c
@@ -279,7 +279,7 @@
 	if (!strncmp(str, "panic", 5))
 		panic_on_timeout = 1;
 
-	return 0;
+	return 1;
 }
 __setup("nmi_watchdog=", setup_nmi_watchdog);
 
--- linux-qcom-6.8.0.orig/arch/sparc/kernel/prom_64.c
+++ linux-qcom-6.8.0/arch/sparc/kernel/prom_64.c
@@ -483,7 +483,9 @@
 	ncpus_probed++;
 #ifdef CONFIG_SMP
 	set_cpu_present(cpuid, true);
-	set_cpu_possible(cpuid, true);
+
+	if (num_possible_cpus() < nr_cpu_ids)
+		set_cpu_possible(cpuid, true);
 #endif
 	return NULL;
 }
--- linux-qcom-6.8.0.orig/arch/sparc/kernel/setup_64.c
+++ linux-qcom-6.8.0/arch/sparc/kernel/setup_64.c
@@ -671,7 +671,6 @@
 
 	paging_init();
 	init_sparc64_elf_hwcap();
-	smp_fill_in_cpu_possible_map();
 	/*
 	 * Once the OF device tree and MDESC have been setup and nr_cpus has
 	 * been parsed, we know the list of possible cpus.  Therefore we can
--- linux-qcom-6.8.0.orig/arch/sparc/kernel/smp_64.c
+++ linux-qcom-6.8.0/arch/sparc/kernel/smp_64.c
@@ -1220,20 +1220,6 @@
 		xcall_deliver_impl = hypervisor_xcall_deliver;
 }
 
-void __init smp_fill_in_cpu_possible_map(void)
-{
-	int possible_cpus = num_possible_cpus();
-	int i;
-
-	if (possible_cpus > nr_cpu_ids)
-		possible_cpus = nr_cpu_ids;
-
-	for (i = 0; i < possible_cpus; i++)
-		set_cpu_possible(i, true);
-	for (; i < NR_CPUS; i++)
-		set_cpu_possible(i, false);
-}
-
 void smp_fill_in_sib_core_maps(void)
 {
 	unsigned int i;
--- linux-qcom-6.8.0.orig/arch/sparc/kernel/sys32.S
+++ linux-qcom-6.8.0/arch/sparc/kernel/sys32.S
@@ -18,224 +18,3 @@
 	sethi		%hi(sys_mmap), %g1
 	jmpl		%g1 + %lo(sys_mmap), %g0
 	 sllx		%o5, 12, %o5
-
-	.align		32
-	.globl		sys32_socketcall
-sys32_socketcall:	/* %o0=call, %o1=args */
-	cmp		%o0, 1
-	bl,pn		%xcc, do_einval
-	 cmp		%o0, 18
-	bg,pn		%xcc, do_einval
-	 sub		%o0, 1, %o0
-	sllx		%o0, 5, %o0
-	sethi		%hi(__socketcall_table_begin), %g2
-	or		%g2, %lo(__socketcall_table_begin), %g2
-	jmpl		%g2 + %o0, %g0
-	 nop
-do_einval:
-	retl
-	 mov		-EINVAL, %o0
-
-	.align		32
-__socketcall_table_begin:
-
-	/* Each entry is exactly 32 bytes. */
-do_sys_socket: /* sys_socket(int, int, int) */
-1:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_socket), %g1
-2:	ldswa		[%o1 + 0x8] %asi, %o2
-	jmpl		%g1 + %lo(sys_socket), %g0
-3:	 ldswa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-do_sys_bind: /* sys_bind(int fd, struct sockaddr *, int) */
-4:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_bind), %g1
-5:	ldswa		[%o1 + 0x8] %asi, %o2
-	jmpl		%g1 + %lo(sys_bind), %g0
-6:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-do_sys_connect: /* sys_connect(int, struct sockaddr *, int) */
-7:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_connect), %g1
-8:	ldswa		[%o1 + 0x8] %asi, %o2
-	jmpl		%g1 + %lo(sys_connect), %g0
-9:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-do_sys_listen: /* sys_listen(int, int) */
-10:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_listen), %g1
-	jmpl		%g1 + %lo(sys_listen), %g0
-11:	 ldswa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-	nop
-do_sys_accept: /* sys_accept(int, struct sockaddr *, int *) */
-12:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_accept), %g1
-13:	lduwa		[%o1 + 0x8] %asi, %o2
-	jmpl		%g1 + %lo(sys_accept), %g0
-14:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-do_sys_getsockname: /* sys_getsockname(int, struct sockaddr *, int *) */
-15:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_getsockname), %g1
-16:	lduwa		[%o1 + 0x8] %asi, %o2
-	jmpl		%g1 + %lo(sys_getsockname), %g0
-17:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-do_sys_getpeername: /* sys_getpeername(int, struct sockaddr *, int *) */
-18:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_getpeername), %g1
-19:	lduwa		[%o1 + 0x8] %asi, %o2
-	jmpl		%g1 + %lo(sys_getpeername), %g0
-20:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-do_sys_socketpair: /* sys_socketpair(int, int, int, int *) */
-21:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_socketpair), %g1
-22:	ldswa		[%o1 + 0x8] %asi, %o2
-23:	lduwa		[%o1 + 0xc] %asi, %o3
-	jmpl		%g1 + %lo(sys_socketpair), %g0
-24:	 ldswa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-do_sys_send: /* sys_send(int, void *, size_t, unsigned int) */
-25:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_send), %g1
-26:	lduwa		[%o1 + 0x8] %asi, %o2
-27:	lduwa		[%o1 + 0xc] %asi, %o3
-	jmpl		%g1 + %lo(sys_send), %g0
-28:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-do_sys_recv: /* sys_recv(int, void *, size_t, unsigned int) */
-29:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_recv), %g1
-30:	lduwa		[%o1 + 0x8] %asi, %o2
-31:	lduwa		[%o1 + 0xc] %asi, %o3
-	jmpl		%g1 + %lo(sys_recv), %g0
-32:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-do_sys_sendto: /* sys_sendto(int, u32, compat_size_t, unsigned int, u32, int) */
-33:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_sendto), %g1
-34:	lduwa		[%o1 + 0x8] %asi, %o2
-35:	lduwa		[%o1 + 0xc] %asi, %o3
-36:	lduwa		[%o1 + 0x10] %asi, %o4
-37:	ldswa		[%o1 + 0x14] %asi, %o5
-	jmpl		%g1 + %lo(sys_sendto), %g0
-38:	 lduwa		[%o1 + 0x4] %asi, %o1
-do_sys_recvfrom: /* sys_recvfrom(int, u32, compat_size_t, unsigned int, u32, u32) */
-39:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_recvfrom), %g1
-40:	lduwa		[%o1 + 0x8] %asi, %o2
-41:	lduwa		[%o1 + 0xc] %asi, %o3
-42:	lduwa		[%o1 + 0x10] %asi, %o4
-43:	lduwa		[%o1 + 0x14] %asi, %o5
-	jmpl		%g1 + %lo(sys_recvfrom), %g0
-44:	 lduwa		[%o1 + 0x4] %asi, %o1
-do_sys_shutdown: /* sys_shutdown(int, int) */
-45:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_shutdown), %g1
-	jmpl		%g1 + %lo(sys_shutdown), %g0
-46:	 ldswa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-	nop
-do_sys_setsockopt: /* sys_setsockopt(int, int, int, char *, int) */
-47:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_setsockopt), %g1
-48:	ldswa		[%o1 + 0x8] %asi, %o2
-49:	lduwa		[%o1 + 0xc] %asi, %o3
-50:	ldswa		[%o1 + 0x10] %asi, %o4
-	jmpl		%g1 + %lo(sys_setsockopt), %g0
-51:	 ldswa		[%o1 + 0x4] %asi, %o1
-	nop
-do_sys_getsockopt: /* sys_getsockopt(int, int, int, u32, u32) */
-52:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_getsockopt), %g1
-53:	ldswa		[%o1 + 0x8] %asi, %o2
-54:	lduwa		[%o1 + 0xc] %asi, %o3
-55:	lduwa		[%o1 + 0x10] %asi, %o4
-	jmpl		%g1 + %lo(sys_getsockopt), %g0
-56:	 ldswa		[%o1 + 0x4] %asi, %o1
-	nop
-do_sys_sendmsg: /* compat_sys_sendmsg(int, struct compat_msghdr *, unsigned int) */
-57:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(compat_sys_sendmsg), %g1
-58:	lduwa		[%o1 + 0x8] %asi, %o2
-	jmpl		%g1 + %lo(compat_sys_sendmsg), %g0
-59:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-do_sys_recvmsg: /* compat_sys_recvmsg(int, struct compat_msghdr *, unsigned int) */
-60:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(compat_sys_recvmsg), %g1
-61:	lduwa		[%o1 + 0x8] %asi, %o2
-	jmpl		%g1 + %lo(compat_sys_recvmsg), %g0
-62:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-	nop
-do_sys_accept4: /* sys_accept4(int, struct sockaddr *, int *, int) */
-63:	ldswa		[%o1 + 0x0] %asi, %o0
-	sethi		%hi(sys_accept4), %g1
-64:	lduwa		[%o1 + 0x8] %asi, %o2
-65:	ldswa		[%o1 + 0xc] %asi, %o3
-	jmpl		%g1 + %lo(sys_accept4), %g0
-66:	 lduwa		[%o1 + 0x4] %asi, %o1
-	nop
-	nop
-
-	.section	__ex_table,"a"
-	.align		4
-	.word		1b, __retl_efault, 2b, __retl_efault
-	.word		3b, __retl_efault, 4b, __retl_efault
-	.word		5b, __retl_efault, 6b, __retl_efault
-	.word		7b, __retl_efault, 8b, __retl_efault
-	.word		9b, __retl_efault, 10b, __retl_efault
-	.word		11b, __retl_efault, 12b, __retl_efault
-	.word		13b, __retl_efault, 14b, __retl_efault
-	.word		15b, __retl_efault, 16b, __retl_efault
-	.word		17b, __retl_efault, 18b, __retl_efault
-	.word		19b, __retl_efault, 20b, __retl_efault
-	.word		21b, __retl_efault, 22b, __retl_efault
-	.word		23b, __retl_efault, 24b, __retl_efault
-	.word		25b, __retl_efault, 26b, __retl_efault
-	.word		27b, __retl_efault, 28b, __retl_efault
-	.word		29b, __retl_efault, 30b, __retl_efault
-	.word		31b, __retl_efault, 32b, __retl_efault
-	.word		33b, __retl_efault, 34b, __retl_efault
-	.word		35b, __retl_efault, 36b, __retl_efault
-	.word		37b, __retl_efault, 38b, __retl_efault
-	.word		39b, __retl_efault, 40b, __retl_efault
-	.word		41b, __retl_efault, 42b, __retl_efault
-	.word		43b, __retl_efault, 44b, __retl_efault
-	.word		45b, __retl_efault, 46b, __retl_efault
-	.word		47b, __retl_efault, 48b, __retl_efault
-	.word		49b, __retl_efault, 50b, __retl_efault
-	.word		51b, __retl_efault, 52b, __retl_efault
-	.word		53b, __retl_efault, 54b, __retl_efault
-	.word		55b, __retl_efault, 56b, __retl_efault
-	.word		57b, __retl_efault, 58b, __retl_efault
-	.word		59b, __retl_efault, 60b, __retl_efault
-	.word		61b, __retl_efault, 62b, __retl_efault
-	.word		63b, __retl_efault, 64b, __retl_efault
-	.word		65b, __retl_efault, 66b, __retl_efault
-	.previous
--- linux-qcom-6.8.0.orig/arch/sparc/kernel/syscalls/syscall.tbl
+++ linux-qcom-6.8.0/arch/sparc/kernel/syscalls/syscall.tbl
@@ -117,7 +117,7 @@
 90	common	dup2			sys_dup2
 91	32	setfsuid32		sys_setfsuid
 92	common	fcntl			sys_fcntl			compat_sys_fcntl
-93	common	select			sys_select
+93	common	select			sys_select			compat_sys_select
 94	32	setfsgid32		sys_setfsgid
 95	common	fsync			sys_fsync
 96	common	setpriority		sys_setpriority
@@ -155,7 +155,7 @@
 123	32	fchown			sys_fchown16
 123	64	fchown			sys_fchown
 124	common	fchmod			sys_fchmod
-125	common	recvfrom		sys_recvfrom
+125	common	recvfrom		sys_recvfrom			compat_sys_recvfrom
 126	32	setreuid		sys_setreuid16
 126	64	setreuid		sys_setreuid
 127	32	setregid		sys_setregid16
@@ -247,7 +247,7 @@
 204	32	readdir			sys_old_readdir			compat_sys_old_readdir
 204	64	readdir			sys_nis_syscall
 205	common	readahead		sys_readahead			compat_sys_readahead
-206	common	socketcall		sys_socketcall			sys32_socketcall
+206	common	socketcall		sys_socketcall			compat_sys_socketcall
 207	common	syslog			sys_syslog
 208	common	lookup_dcookie		sys_ni_syscall
 209	common	fadvise64		sys_fadvise64			compat_sys_fadvise64
@@ -461,7 +461,7 @@
 412	32	utimensat_time64		sys_utimensat			sys_utimensat
 413	32	pselect6_time64			sys_pselect6			compat_sys_pselect6_time64
 414	32	ppoll_time64			sys_ppoll			compat_sys_ppoll_time64
-416	32	io_pgetevents_time64		sys_io_pgetevents		sys_io_pgetevents
+416	32	io_pgetevents_time64		sys_io_pgetevents		compat_sys_io_pgetevents_time64
 417	32	recvmmsg_time64			sys_recvmmsg			compat_sys_recvmmsg_time64
 418	32	mq_timedsend_time64		sys_mq_timedsend		sys_mq_timedsend
 419	32	mq_timedreceive_time64		sys_mq_timedreceive		sys_mq_timedreceive
--- linux-qcom-6.8.0.orig/arch/sparc/lib/Makefile
+++ linux-qcom-6.8.0/arch/sparc/lib/Makefile
@@ -14,7 +14,7 @@
 lib-$(CONFIG_SPARC32) += copy_user.o locks.o
 lib-$(CONFIG_SPARC64) += atomic_64.o
 lib-$(CONFIG_SPARC32) += lshrdi3.o ashldi3.o
-lib-$(CONFIG_SPARC32) += muldi3.o bitext.o cmpdi2.o
+lib-$(CONFIG_SPARC32) += muldi3.o bitext.o
 lib-$(CONFIG_SPARC64) += multi3.o
 lib-$(CONFIG_SPARC64) += fls.o
 lib-$(CONFIG_SPARC64) += fls64.o
@@ -51,5 +51,5 @@
 lib-$(CONFIG_SPARC64) += mcount.o ipcsum.o xor.o hweight.o ffs.o
 
 obj-$(CONFIG_SPARC64) += iomap.o
-obj-$(CONFIG_SPARC32) += atomic32.o ucmpdi2.o
+obj-$(CONFIG_SPARC32) += atomic32.o
 obj-$(CONFIG_SPARC64) += PeeCeeI.o
--- linux-qcom-6.8.0.orig/arch/sparc/mm/init_64.c
+++ linux-qcom-6.8.0/arch/sparc/mm/init_64.c
@@ -1665,7 +1665,7 @@
 	if (pud_none(*pud))
 		return false;
 
-	if (pud_large(*pud))
+	if (pud_leaf(*pud))
 		return pfn_valid(pud_pfn(*pud));
 
 	pmd = pmd_offset(pud, addr);
--- linux-qcom-6.8.0.orig/arch/sparc/mm/tlb.c
+++ linux-qcom-6.8.0/arch/sparc/mm/tlb.c
@@ -249,6 +249,7 @@
 {
 	pmd_t old, entry;
 
+	VM_WARN_ON_ONCE(!pmd_present(*pmdp));
 	entry = __pmd(pmd_val(*pmdp) & ~_PAGE_VALID);
 	old = pmdp_establish(vma, address, pmdp, entry);
 	flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
--- linux-qcom-6.8.0.orig/arch/sparc/net/bpf_jit_comp_64.c
+++ linux-qcom-6.8.0/arch/sparc/net/bpf_jit_comp_64.c
@@ -1602,7 +1602,11 @@
 	bpf_flush_icache(header, (u8 *)header + header->size);
 
 	if (!prog->is_func || extra_pass) {
-		bpf_jit_binary_lock_ro(header);
+		if (bpf_jit_binary_lock_ro(header)) {
+			bpf_jit_binary_free(header);
+			prog = orig_prog;
+			goto out_off;
+		}
 	} else {
 		jit_data->ctx = ctx;
 		jit_data->image = image_ptr;
--- linux-qcom-6.8.0.orig/arch/sparc/prom/init_64.c
+++ linux-qcom-6.8.0/arch/sparc/prom/init_64.c
@@ -26,9 +26,6 @@
  * routines in the prom library.
  * It gets passed the pointer to the PROM vector.
  */
-
-extern void prom_cif_init(void *);
-
 void __init prom_init(void *cif_handler)
 {
 	phandle node;
--- linux-qcom-6.8.0.orig/arch/sparc/prom/p1275.c
+++ linux-qcom-6.8.0/arch/sparc/prom/p1275.c
@@ -49,7 +49,7 @@
 	local_irq_restore(flags);
 }
 
-void prom_cif_init(void *cif_handler, void *cif_stack)
+void prom_cif_init(void *cif_handler)
 {
 	p1275buf.prom_cif_handler = (void (*)(long *))cif_handler;
 }
--- linux-qcom-6.8.0.orig/arch/sparc/vdso/vma.c
+++ linux-qcom-6.8.0/arch/sparc/vdso/vma.c
@@ -449,9 +449,8 @@
 	unsigned long val;
 
 	err = kstrtoul(s, 10, &val);
-	if (err)
-		return err;
-	vdso_enabled = val;
-	return 0;
+	if (!err)
+		vdso_enabled = val;
+	return 1;
 }
 __setup("vdso=", vdso_setup);
--- linux-qcom-6.8.0.orig/arch/um/drivers/line.c
+++ linux-qcom-6.8.0/arch/um/drivers/line.c
@@ -383,6 +383,7 @@
 			parse_chan_pair(NULL, line, n, opts, error_out);
 			err = 0;
 		}
+		*error_out = "configured as 'none'";
 	} else {
 		char *new = kstrdup(init, GFP_KERNEL);
 		if (!new) {
@@ -406,6 +407,7 @@
 			}
 		}
 		if (err) {
+			*error_out = "failed to parse channel pair";
 			line->init_str = NULL;
 			line->valid = 0;
 			kfree(new);
@@ -676,24 +678,26 @@
 		goto cleanup;
 	}
 
-	*winch = ((struct winch) { .list  	= LIST_HEAD_INIT(winch->list),
-				   .fd  	= fd,
+	*winch = ((struct winch) { .fd  	= fd,
 				   .tty_fd 	= tty_fd,
 				   .pid  	= pid,
 				   .port 	= port,
 				   .stack	= stack });
 
+	spin_lock(&winch_handler_lock);
+	list_add(&winch->list, &winch_handlers);
+	spin_unlock(&winch_handler_lock);
+
 	if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
 			   IRQF_SHARED, "winch", winch) < 0) {
 		printk(KERN_ERR "register_winch_irq - failed to register "
 		       "IRQ\n");
+		spin_lock(&winch_handler_lock);
+		list_del(&winch->list);
+		spin_unlock(&winch_handler_lock);
 		goto out_free;
 	}
 
-	spin_lock(&winch_handler_lock);
-	list_add(&winch->list, &winch_handlers);
-	spin_unlock(&winch_handler_lock);
-
 	return;
 
  out_free:
--- linux-qcom-6.8.0.orig/arch/um/drivers/net_kern.c
+++ linux-qcom-6.8.0/arch/um/drivers/net_kern.c
@@ -336,7 +336,7 @@
 
 static void net_device_release(struct device *dev)
 {
-	struct uml_net *device = dev_get_drvdata(dev);
+	struct uml_net *device = container_of(dev, struct uml_net, pdev.dev);
 	struct net_device *netdev = device->dev;
 	struct uml_net_private *lp = netdev_priv(netdev);
 
--- linux-qcom-6.8.0.orig/arch/um/drivers/ubd_kern.c
+++ linux-qcom-6.8.0/arch/um/drivers/ubd_kern.c
@@ -456,43 +456,31 @@
 	return n;
 }
 
-/* Called without dev->lock held, and only in interrupt context. */
-static void ubd_handler(void)
+static void ubd_end_request(struct io_thread_req *io_req)
 {
-	int n;
-	int count;
-
-	while(1){
-		n = bulk_req_safe_read(
-			thread_fd,
-			irq_req_buffer,
-			&irq_remainder,
-			&irq_remainder_size,
-			UBD_REQ_BUFFER_SIZE
-		);
-		if (n < 0) {
-			if(n == -EAGAIN)
-				break;
-			printk(KERN_ERR "spurious interrupt in ubd_handler, "
-			       "err = %d\n", -n);
-			return;
-		}
-		for (count = 0; count < n/sizeof(struct io_thread_req *); count++) {
-			struct io_thread_req *io_req = (*irq_req_buffer)[count];
-
-			if ((io_req->error == BLK_STS_NOTSUPP) && (req_op(io_req->req) == REQ_OP_DISCARD)) {
-				blk_queue_max_discard_sectors(io_req->req->q, 0);
-				blk_queue_max_write_zeroes_sectors(io_req->req->q, 0);
-			}
-			blk_mq_end_request(io_req->req, io_req->error);
-			kfree(io_req);
-		}
+	if (io_req->error == BLK_STS_NOTSUPP) {
+		if (req_op(io_req->req) == REQ_OP_DISCARD)
+			blk_queue_max_discard_sectors(io_req->req->q, 0);
+		else if (req_op(io_req->req) == REQ_OP_WRITE_ZEROES)
+			blk_queue_max_write_zeroes_sectors(io_req->req->q, 0);
 	}
+	blk_mq_end_request(io_req->req, io_req->error);
+	kfree(io_req);
 }
 
 static irqreturn_t ubd_intr(int irq, void *dev)
 {
-	ubd_handler();
+	int len, i;
+
+	while ((len = bulk_req_safe_read(thread_fd, irq_req_buffer,
+			&irq_remainder, &irq_remainder_size,
+			UBD_REQ_BUFFER_SIZE)) >= 0) {
+		for (i = 0; i < len / sizeof(struct io_thread_req *); i++)
+			ubd_end_request((*irq_req_buffer)[i]);
+	}
+
+	if (len < 0 && len != -EAGAIN)
+		pr_err("spurious interrupt in %s, err = %d\n", __func__, len);
 	return IRQ_HANDLED;
 }
 
@@ -810,7 +798,7 @@
 
 static void ubd_device_release(struct device *dev)
 {
-	struct ubd *ubd_dev = dev_get_drvdata(dev);
+	struct ubd *ubd_dev = container_of(dev, struct ubd, pdev.dev);
 
 	blk_mq_free_tag_set(&ubd_dev->tag_set);
 	*ubd_dev = ((struct ubd) DEFAULT_UBD);
@@ -1098,7 +1086,7 @@
 
 	if (irq_req_buffer == NULL) {
 		printk(KERN_ERR "Failed to initialize ubd buffering\n");
-		return -1;
+		return -ENOMEM;
 	}
 	io_req_buffer = kmalloc_array(UBD_REQ_BUFFER_SIZE,
 				      sizeof(struct io_thread_req *),
@@ -1109,7 +1097,7 @@
 
 	if (io_req_buffer == NULL) {
 		printk(KERN_ERR "Failed to initialize ubd buffering\n");
-		return -1;
+		return -ENOMEM;
 	}
 	platform_driver_register(&ubd_driver);
 	mutex_lock(&ubd_lock);
--- linux-qcom-6.8.0.orig/arch/um/drivers/vector_kern.c
+++ linux-qcom-6.8.0/arch/um/drivers/vector_kern.c
@@ -141,7 +141,7 @@
 
 	if (allow != NULL) {
 		if (kstrtoul(allow, 10, &result) == 0)
-			return (allow > 0);
+			return result > 0;
 	}
 	return false;
 }
@@ -823,7 +823,8 @@
 
 static void vector_device_release(struct device *dev)
 {
-	struct vector_device *device = dev_get_drvdata(dev);
+	struct vector_device *device =
+		container_of(dev, struct vector_device, pdev.dev);
 	struct net_device *netdev = device->dev;
 
 	list_del(&device->list);
--- linux-qcom-6.8.0.orig/arch/um/include/asm/kasan.h
+++ linux-qcom-6.8.0/arch/um/include/asm/kasan.h
@@ -24,7 +24,6 @@
 
 #ifdef CONFIG_KASAN
 void kasan_init(void);
-void kasan_map_memory(void *start, unsigned long len);
 extern int kasan_um_is_ready;
 
 #ifdef CONFIG_STATIC_LINK
--- linux-qcom-6.8.0.orig/arch/um/include/asm/mmu.h
+++ linux-qcom-6.8.0/arch/um/include/asm/mmu.h
@@ -14,8 +14,6 @@
 	struct uml_arch_mm_context arch;
 } mm_context_t;
 
-extern void __switch_mm(struct mm_id * mm_idp);
-
 /* Avoid tangled inclusion with asm/ldt.h */
 extern long init_new_ldt(struct mm_context *to_mm, struct mm_context *from_mm);
 extern void free_ldt(struct mm_context *mm);
--- linux-qcom-6.8.0.orig/arch/um/include/asm/processor-generic.h
+++ linux-qcom-6.8.0/arch/um/include/asm/processor-generic.h
@@ -94,7 +94,6 @@
 #define current_cpu_data boot_cpu_data
 #define cache_line_size()	(boot_cpu_data.cache_alignment)
 
-extern unsigned long get_thread_reg(int reg, jmp_buf *buf);
 #define KSTK_REG(tsk, reg) get_thread_reg(reg, &tsk->thread.switch_buf)
 extern unsigned long __get_wchan(struct task_struct *p);
 
--- linux-qcom-6.8.0.orig/arch/um/include/shared/kern_util.h
+++ linux-qcom-6.8.0/arch/um/include/shared/kern_util.h
@@ -66,4 +66,6 @@
 
 void um_idle_sleep(void);
 
+void kasan_map_memory(void *start, size_t len);
+
 #endif
--- linux-qcom-6.8.0.orig/arch/um/include/shared/skas/mm_id.h
+++ linux-qcom-6.8.0/arch/um/include/shared/skas/mm_id.h
@@ -15,4 +15,6 @@
 	int kill;
 };
 
+void __switch_mm(struct mm_id *mm_idp);
+
 #endif
--- linux-qcom-6.8.0.orig/arch/um/kernel/dtb.c
+++ linux-qcom-6.8.0/arch/um/kernel/dtb.c
@@ -16,16 +16,16 @@
 	void *area;
 
 	area = uml_load_file(dtb, &size);
-	if (!area)
-		return;
+	if (area) {
+		if (!early_init_dt_scan(area, __pa(area))) {
+			pr_err("invalid DTB %s\n", dtb);
+			memblock_free(area, size);
+			return;
+		}
 
-	if (!early_init_dt_scan(area)) {
-		pr_err("invalid DTB %s\n", dtb);
-		memblock_free(area, size);
-		return;
+		early_init_fdt_scan_reserved_mem();
 	}
 
-	early_init_fdt_scan_reserved_mem();
 	unflatten_device_tree();
 }
 
--- linux-qcom-6.8.0.orig/arch/um/kernel/physmem.c
+++ linux-qcom-6.8.0/arch/um/kernel/physmem.c
@@ -80,10 +80,10 @@
 			  unsigned long len, unsigned long long highmem)
 {
 	unsigned long reserve = reserve_end - start;
-	long map_size = len - reserve;
+	unsigned long map_size = len - reserve;
 	int err;
 
-	if(map_size <= 0) {
+	if (len <= reserve) {
 		os_warn("Too few physical memory! Needed=%lu, given=%lu\n",
 			reserve, len);
 		exit(1);
@@ -94,7 +94,7 @@
 	err = os_map_memory((void *) reserve_end, physmem_fd, reserve,
 			    map_size, 1, 1, 1);
 	if (err < 0) {
-		os_warn("setup_physmem - mapping %ld bytes of memory at 0x%p "
+		os_warn("setup_physmem - mapping %lu bytes of memory at 0x%p "
 			"failed - errno = %d\n", map_size,
 			(void *) reserve_end, err);
 		exit(1);
--- linux-qcom-6.8.0.orig/arch/um/kernel/process.c
+++ linux-qcom-6.8.0/arch/um/kernel/process.c
@@ -389,6 +389,6 @@
 {
 	int cpu = current_thread_info()->cpu;
 
-	return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu);
+	return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu) == 0;
 }
 
--- linux-qcom-6.8.0.orig/arch/um/kernel/sysrq.c
+++ linux-qcom-6.8.0/arch/um/kernel/sysrq.c
@@ -53,5 +53,5 @@
 	}
 
 	printk("%sCall Trace:\n", loglvl);
-	dump_trace(current, &stackops, (void *)loglvl);
+	dump_trace(task ?: current, &stackops, (void *)loglvl);
 }
--- linux-qcom-6.8.0.orig/arch/um/kernel/time.c
+++ linux-qcom-6.8.0/arch/um/kernel/time.c
@@ -874,9 +874,9 @@
 	return 1;
 }
 
-__setup("time-travel-start", setup_time_travel_start);
+__setup("time-travel-start=", setup_time_travel_start);
 __uml_help(setup_time_travel_start,
-"time-travel-start=<seconds>\n"
+"time-travel-start=<nanoseconds>\n"
 "Configure the UML instance's wall clock to start at this value rather than\n"
 "the host's wall clock at the time of UML boot.\n");
 #endif
--- linux-qcom-6.8.0.orig/arch/um/os-Linux/mem.c
+++ linux-qcom-6.8.0/arch/um/os-Linux/mem.c
@@ -15,6 +15,7 @@
 #include <sys/vfs.h>
 #include <linux/magic.h>
 #include <init.h>
+#include <kern_util.h>
 #include <os.h>
 
 /*
--- linux-qcom-6.8.0.orig/arch/um/os-Linux/signal.c
+++ linux-qcom-6.8.0/arch/um/os-Linux/signal.c
@@ -8,6 +8,7 @@
 
 #include <stdlib.h>
 #include <stdarg.h>
+#include <stdbool.h>
 #include <errno.h>
 #include <signal.h>
 #include <string.h>
@@ -65,9 +66,7 @@
 
 int signals_enabled;
 #ifdef UML_CONFIG_UML_TIME_TRAVEL_SUPPORT
-static int signals_blocked;
-#else
-#define signals_blocked 0
+static int signals_blocked, signals_blocked_pending;
 #endif
 static unsigned int signals_pending;
 static unsigned int signals_active = 0;
@@ -76,14 +75,27 @@
 {
 	int enabled = signals_enabled;
 
-	if ((signals_blocked || !enabled) && (sig == SIGIO)) {
+#ifdef UML_CONFIG_UML_TIME_TRAVEL_SUPPORT
+	if ((signals_blocked ||
+	     __atomic_load_n(&signals_blocked_pending, __ATOMIC_SEQ_CST)) &&
+	    (sig == SIGIO)) {
+		/* increment so unblock will do another round */
+		__atomic_add_fetch(&signals_blocked_pending, 1,
+				   __ATOMIC_SEQ_CST);
+		return;
+	}
+#endif
+
+	if (!enabled && (sig == SIGIO)) {
 		/*
 		 * In TT_MODE_EXTERNAL, need to still call time-travel
-		 * handlers unless signals are also blocked for the
-		 * external time message processing. This will mark
-		 * signals_pending by itself (only if necessary.)
+		 * handlers. This will mark signals_pending by itself
+		 * (only if necessary.)
+		 * Note we won't get here if signals are hard-blocked
+		 * (which is handled above), in that case the hard-
+		 * unblock will handle things.
 		 */
-		if (!signals_blocked && time_travel_mode == TT_MODE_EXTERNAL)
+		if (time_travel_mode == TT_MODE_EXTERNAL)
 			sigio_run_timetravel_handlers();
 		else
 			signals_pending |= SIGIO_MASK;
@@ -380,33 +392,99 @@
 #ifdef UML_CONFIG_UML_TIME_TRAVEL_SUPPORT
 void mark_sigio_pending(void)
 {
+	/*
+	 * It would seem that this should be atomic so
+	 * it isn't a read-modify-write with a signal
+	 * that could happen in the middle, losing the
+	 * value set by the signal.
+	 *
+	 * However, this function is only called when in
+	 * time-travel=ext simulation mode, in which case
+	 * the only signal ever pending is SIGIO, which
+	 * is blocked while this can be called, and the
+	 * timer signal (SIGALRM) cannot happen.
+	 */
 	signals_pending |= SIGIO_MASK;
 }
 
 void block_signals_hard(void)
 {
-	if (signals_blocked)
-		return;
-	signals_blocked = 1;
+	signals_blocked++;
 	barrier();
 }
 
 void unblock_signals_hard(void)
 {
+	static bool unblocking;
+
 	if (!signals_blocked)
+		panic("unblocking signals while not blocked");
+
+	if (--signals_blocked)
 		return;
-	/* Must be set to 0 before we check the pending bits etc. */
-	signals_blocked = 0;
+	/*
+	 * Must be set to 0 before we check pending so the
+	 * SIGIO handler will run as normal unless we're still
+	 * going to process signals_blocked_pending.
+	 */
 	barrier();
 
-	if (signals_pending && signals_enabled) {
-		/* this is a bit inefficient, but that's not really important */
-		block_signals();
-		unblock_signals();
-	} else if (signals_pending & SIGIO_MASK) {
-		/* we need to run time-travel handlers even if not enabled */
-		sigio_run_timetravel_handlers();
+	/*
+	 * Note that block_signals_hard()/unblock_signals_hard() can be called
+	 * within the unblock_signals()/sigio_run_timetravel_handlers() below.
+	 * This would still be prone to race conditions since it's actually a
+	 * call _within_ e.g. vu_req_read_message(), where we observed this
+	 * issue, which loops. Thus, if the inner call handles the recorded
+	 * pending signals, we can get out of the inner call with the real
+	 * signal hander no longer blocked, and still have a race. Thus don't
+	 * handle unblocking in the inner call, if it happens, but only in
+	 * the outermost call - 'unblocking' serves as an ownership for the
+	 * signals_blocked_pending decrement.
+	 */
+	if (unblocking)
+		return;
+	unblocking = true;
+
+	while (__atomic_load_n(&signals_blocked_pending, __ATOMIC_SEQ_CST)) {
+		if (signals_enabled) {
+			/* signals are enabled so we can touch this */
+			signals_pending |= SIGIO_MASK;
+			/*
+			 * this is a bit inefficient, but that's
+			 * not really important
+			 */
+			block_signals();
+			unblock_signals();
+		} else {
+			/*
+			 * we need to run time-travel handlers even
+			 * if not enabled
+			 */
+			sigio_run_timetravel_handlers();
+		}
+
+		/*
+		 * The decrement of signals_blocked_pending must be atomic so
+		 * that the signal handler will either happen before or after
+		 * the decrement, not during a read-modify-write:
+		 *  - If it happens before, it can increment it and we'll
+		 *    decrement it and do another round in the loop.
+		 *  - If it happens after it'll see 0 for both signals_blocked
+		 *    and signals_blocked_pending and thus run the handler as
+		 *    usual (subject to signals_enabled, but that's unrelated.)
+		 *
+		 * Note that a call to unblock_signals_hard() within the calls
+		 * to unblock_signals() or sigio_run_timetravel_handlers() above
+		 * will do nothing due to the 'unblocking' state, so this cannot
+		 * underflow as the only one decrementing will be the outermost
+		 * one.
+		 */
+		if (__atomic_sub_fetch(&signals_blocked_pending, 1,
+				       __ATOMIC_SEQ_CST) < 0)
+			panic("signals_blocked_pending underflow");
 	}
+
+	unblocking = false;
 }
 #endif
 
--- linux-qcom-6.8.0.orig/arch/x86/Kconfig
+++ linux-qcom-6.8.0/arch/x86/Kconfig
@@ -62,6 +62,7 @@
 	select ACPI_HOTPLUG_CPU			if ACPI_PROCESSOR && HOTPLUG_CPU
 	select ARCH_32BIT_OFF_T			if X86_32
 	select ARCH_CLOCKSOURCE_INIT
+	select ARCH_CONFIGURES_CPU_MITIGATIONS
 	select ARCH_CORRECT_STACKTRACE_ON_KRETPROBE
 	select ARCH_ENABLE_HUGEPAGE_MIGRATION if X86_64 && HUGETLB_PAGE && MIGRATION
 	select ARCH_ENABLE_MEMORY_HOTPLUG if X86_64
@@ -100,7 +101,7 @@
 	select ARCH_HAS_STRICT_MODULE_RWX
 	select ARCH_HAS_SYNC_CORE_BEFORE_USERMODE
 	select ARCH_HAS_SYSCALL_WRAPPER
-	select ARCH_HAS_UBSAN_SANITIZE_ALL
+	select ARCH_HAS_UBSAN
 	select ARCH_HAS_DEBUG_WX
 	select ARCH_HAS_ZONE_DMA_SET if EXPERT
 	select ARCH_HAVE_NMI_SAFE_CMPXCHG
@@ -1539,19 +1540,6 @@
 	  This requires an AMD processor that supports Secure Memory
 	  Encryption (SME).
 
-config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
-	bool "Activate AMD Secure Memory Encryption (SME) by default"
-	depends on AMD_MEM_ENCRYPT
-	help
-	  Say yes to have system memory encrypted by default if running on
-	  an AMD processor that supports Secure Memory Encryption (SME).
-
-	  If set to Y, then the encryption of system memory can be
-	  deactivated with the mem_encrypt=off command line option.
-
-	  If set to N, then the encryption of system memory can be
-	  activated with the mem_encrypt=on command line option.
-
 # Common NUMA Features
 config NUMA
 	bool "NUMA Memory Allocation and Scheduler Support"
@@ -2275,6 +2263,7 @@
 config ADDRESS_MASKING
 	bool "Linear Address Masking support"
 	depends on X86_64
+	depends on COMPILE_TEST || !CPU_MITIGATIONS # wait for LASS
 	help
 	  Linear Address Masking (LAM) modifies the checking that is applied
 	  to 64-bit linear addresses, allowing software to use of the
@@ -2480,17 +2469,21 @@
 	def_bool y
 	depends on CALL_PADDING && !CFI_CLANG
 
-menuconfig SPECULATION_MITIGATIONS
-	bool "Mitigations for speculative execution vulnerabilities"
+menuconfig CPU_MITIGATIONS
+	bool "Mitigations for CPU vulnerabilities"
 	default y
 	help
-	  Say Y here to enable options which enable mitigations for
-	  speculative execution hardware vulnerabilities.
+	  Say Y here to enable options which enable mitigations for hardware
+	  vulnerabilities (usually related to speculative execution).
+	  Mitigations can be disabled or restricted to SMT systems at runtime
+	  via the "mitigations" kernel parameter.
 
-	  If you say N, all mitigations will be disabled. You really
-	  should know what you are doing to say so.
+	  If you say N, all mitigations will be disabled.  This CANNOT be
+	  overridden at runtime.
 
-if SPECULATION_MITIGATIONS
+	  Say 'Y', unless you really know what you are doing.
+
+if CPU_MITIGATIONS
 
 config PAGE_TABLE_ISOLATION
 	bool "Remove the kernel mapping in user mode"
@@ -2614,6 +2607,27 @@
 
 	  If in doubt, say N.
 
+config MITIGATION_RFDS
+	bool "RFDS Mitigation"
+	depends on CPU_SUP_INTEL
+	default y
+	help
+	  Enable mitigation for Register File Data Sampling (RFDS) by default.
+	  RFDS is a hardware vulnerability which affects Intel Atom CPUs. It
+	  allows unprivileged speculative access to stale data previously
+	  stored in floating point, vector and integer registers.
+	  See also <file:Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst>
+
+config MITIGATION_SPECTRE_BHI
+	bool "Mitigate Spectre-BHB (Branch History Injection)"
+	depends on CPU_SUP_INTEL
+	default y
+	help
+	  Enable BHI mitigations. BHI attacks are a form of Spectre V2 attacks
+	  where the branch history buffer is poisoned to speculatively steer
+	  indirect branches.
+	  See <file:Documentation/admin-guide/hw-vuln/spectre.rst>
+
 endif
 
 config ARCH_HAS_ADD_PAGES
--- linux-qcom-6.8.0.orig/arch/x86/Kconfig.assembler
+++ linux-qcom-6.8.0/arch/x86/Kconfig.assembler
@@ -26,6 +26,6 @@
 	  Supported by binutils >= 2.30 and LLVM integrated assembler
 
 config AS_WRUSS
-	def_bool $(as-instr,wrussq %rax$(comma)(%rbx))
+	def_bool $(as-instr64,wrussq %rax$(comma)(%rbx))
 	help
 	  Supported by binutils >= 2.31 and LLVM integrated assembler
--- linux-qcom-6.8.0.orig/arch/x86/Kconfig.debug
+++ linux-qcom-6.8.0/arch/x86/Kconfig.debug
@@ -248,6 +248,7 @@
 
 config UNWINDER_FRAME_POINTER
 	bool "Frame pointer unwinder"
+	select ARCH_WANT_FRAME_POINTERS
 	select FRAME_POINTER
 	help
 	  This option enables the frame pointer unwinder for unwinding kernel
@@ -271,7 +272,3 @@
 	  overhead.
 
 endchoice
-
-config FRAME_POINTER
-	depends on !UNWINDER_ORC && !UNWINDER_GUESS
-	bool
--- linux-qcom-6.8.0.orig/arch/x86/Makefile
+++ linux-qcom-6.8.0/arch/x86/Makefile
@@ -114,9 +114,10 @@
 
     ifeq ($(CONFIG_STACKPROTECTOR),y)
         ifeq ($(CONFIG_SMP),y)
-			KBUILD_CFLAGS += -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard
+            KBUILD_CFLAGS += -mstack-protector-guard-reg=fs \
+                             -mstack-protector-guard-symbol=__ref_stack_chk_guard
         else
-			KBUILD_CFLAGS += -mstack-protector-guard=global
+            KBUILD_CFLAGS += -mstack-protector-guard=global
         endif
     endif
 else
--- linux-qcom-6.8.0.orig/arch/x86/Makefile.um
+++ linux-qcom-6.8.0/arch/x86/Makefile.um
@@ -9,6 +9,7 @@
 #
 ifeq ($(CONFIG_CC_IS_CLANG),y)
 KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx
+KBUILD_RUSTFLAGS += --target=$(objtree)/scripts/target.json
 KBUILD_RUSTFLAGS += -Ctarget-feature=-sse,-sse2,-sse3,-ssse3,-sse4.1,-sse4.2,-avx,-avx2
 endif
 
--- linux-qcom-6.8.0.orig/arch/x86/boot/compressed/Makefile
+++ linux-qcom-6.8.0/arch/x86/boot/compressed/Makefile
@@ -84,7 +84,7 @@
 hostprogs	:= mkpiggy
 HOST_EXTRACFLAGS += -I$(srctree)/tools/include
 
-sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p'
+sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__start_rodata\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p'
 
 quiet_cmd_voffset = VOFFSET $@
       cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@
@@ -116,9 +116,9 @@
 
 vmlinux-objs-$(CONFIG_EFI) += $(obj)/efi.o
 vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_mixed.o
-vmlinux-objs-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a
+vmlinux-libs-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a
 
-$(obj)/vmlinux: $(vmlinux-objs-y) FORCE
+$(obj)/vmlinux: $(vmlinux-objs-y) $(vmlinux-libs-y) FORCE
 	$(call if_changed,ld)
 
 OBJCOPYFLAGS_vmlinux.bin :=  -R .comment -S
--- linux-qcom-6.8.0.orig/arch/x86/boot/compressed/efi_mixed.S
+++ linux-qcom-6.8.0/arch/x86/boot/compressed/efi_mixed.S
@@ -15,10 +15,12 @@
  */
 
 #include <linux/linkage.h>
+#include <asm/asm-offsets.h>
 #include <asm/msr.h>
 #include <asm/page_types.h>
 #include <asm/processor-flags.h>
 #include <asm/segment.h>
+#include <asm/setup.h>
 
 	.code64
 	.text
@@ -49,6 +51,11 @@
 	lea	efi32_boot_args(%rip), %rdx
 	mov	0(%rdx), %edi
 	mov	4(%rdx), %esi
+
+	/* Switch to the firmware's stack */
+	movl	efi32_boot_sp(%rip), %esp
+	andl	$~7, %esp
+
 #ifdef CONFIG_EFI_HANDOVER_PROTOCOL
 	mov	8(%rdx), %edx		// saved bootparams pointer
 	test	%edx, %edx
@@ -144,6 +151,7 @@
 SYM_FUNC_START(efi32_stub_entry)
 	call	1f
 1:	popl	%ecx
+	leal	(efi32_boot_args - 1b)(%ecx), %ebx
 
 	/* Clear BSS */
 	xorl	%eax, %eax
@@ -158,6 +166,7 @@
 	popl	%ecx
 	popl	%edx
 	popl	%esi
+	movl	%esi, 8(%ebx)
 	jmp	efi32_entry
 SYM_FUNC_END(efi32_stub_entry)
 #endif
@@ -234,8 +243,6 @@
  *
  * Arguments:	%ecx	image handle
  * 		%edx	EFI system table pointer
- *		%esi	struct bootparams pointer (or NULL when not using
- *			the EFI handover protocol)
  *
  * Since this is the point of no return for ordinary execution, no registers
  * are considered live except for the function parameters. [Note that the EFI
@@ -254,13 +261,25 @@
 	/* Store firmware IDT descriptor */
 	sidtl	(efi32_boot_idt - 1b)(%ebx)
 
+	/* Store firmware stack pointer */
+	movl	%esp, (efi32_boot_sp - 1b)(%ebx)
+
 	/* Store boot arguments */
 	leal	(efi32_boot_args - 1b)(%ebx), %ebx
 	movl	%ecx, 0(%ebx)
 	movl	%edx, 4(%ebx)
-	movl	%esi, 8(%ebx)
 	movb	$0x0, 12(%ebx)          // efi_is64
 
+	/*
+	 * Allocate some memory for a temporary struct boot_params, which only
+	 * needs the minimal pieces that startup_32() relies on.
+	 */
+	subl	$PARAM_SIZE, %esp
+	movl	%esp, %esi
+	movl	$PAGE_SIZE, BP_kernel_alignment(%esi)
+	movl	$_end - 1b, BP_init_size(%esi)
+	subl	$startup_32 - 1b, BP_init_size(%esi)
+
 	/* Disable paging */
 	movl	%cr0, %eax
 	btrl	$X86_CR0_PG_BIT, %eax
@@ -286,8 +305,7 @@
 
 	movl	8(%ebp), %ecx			// image_handle
 	movl	12(%ebp), %edx			// sys_table
-	xorl	%esi, %esi
-	jmp	efi32_entry			// pass %ecx, %edx, %esi
+	jmp	efi32_entry			// pass %ecx, %edx
 						// no other registers remain live
 
 2:	popl	%edi				// restore callee-save registers
@@ -318,5 +336,6 @@
 
 SYM_DATA_LOCAL(efi32_boot_cs, .word 0)
 SYM_DATA_LOCAL(efi32_boot_ds, .word 0)
+SYM_DATA_LOCAL(efi32_boot_sp, .long 0)
 SYM_DATA_LOCAL(efi32_boot_args, .long 0, 0, 0)
 SYM_DATA(efi_is64, .byte 1)
--- linux-qcom-6.8.0.orig/arch/x86/boot/compressed/head_64.S
+++ linux-qcom-6.8.0/arch/x86/boot/compressed/head_64.S
@@ -398,6 +398,11 @@
 	call	sev_enable
 #endif
 
+	/* Preserve only the CR4 bits that must be preserved, and clear the rest */
+	movq	%cr4, %rax
+	andl	$(X86_CR4_PAE | X86_CR4_MCE | X86_CR4_LA57), %eax
+	movq	%rax, %cr4
+
 	/*
 	 * configure_5level_paging() updates the number of paging levels using
 	 * a trampoline in 32-bit addressable memory if the current number does
--- linux-qcom-6.8.0.orig/arch/x86/boot/compressed/misc.c
+++ linux-qcom-6.8.0/arch/x86/boot/compressed/misc.c
@@ -330,6 +330,7 @@
 	return ehdr.e_entry - LOAD_PHYSICAL_ADDR;
 }
 
+const unsigned long kernel_text_size = VO___start_rodata - VO__text;
 const unsigned long kernel_total_size = VO__end - VO__text;
 
 static u8 boot_heap[BOOT_HEAP_SIZE] __aligned(4);
@@ -358,6 +359,19 @@
 }
 
 /*
+ * Set the memory encryption xloadflag based on the mem_encrypt= command line
+ * parameter, if provided.
+ */
+static void parse_mem_encrypt(struct setup_header *hdr)
+{
+	int on = cmdline_find_option_bool("mem_encrypt=on");
+	int off = cmdline_find_option_bool("mem_encrypt=off");
+
+	if (on > off)
+		hdr->xloadflags |= XLF_MEM_ENCRYPTION;
+}
+
+/*
  * The compressed kernel image (ZO), has been moved so that its position
  * is against the end of the buffer used to hold the uncompressed kernel
  * image (VO) and the execution environment (.bss, .brk), which makes sure
@@ -387,6 +401,8 @@
 	/* Clear flags intended for solely in-kernel use. */
 	boot_params_ptr->hdr.loadflags &= ~KASLR_FLAG;
 
+	parse_mem_encrypt(&boot_params_ptr->hdr);
+
 	sanitize_boot_params(boot_params_ptr);
 
 	if (boot_params_ptr->screen_info.orig_video_mode == 7) {
--- linux-qcom-6.8.0.orig/arch/x86/boot/compressed/sev.c
+++ linux-qcom-6.8.0/arch/x86/boot/compressed/sev.c
@@ -116,6 +116,9 @@
 #undef __init
 #define __init
 
+#undef __head
+#define __head
+
 #define __BOOT_COMPRESSED
 
 /* Basic instruction decoding support needed */
@@ -304,6 +307,10 @@
 	if (result != ES_OK)
 		goto finish;
 
+	result = vc_check_opcode_bytes(&ctxt, exit_code);
+	if (result != ES_OK)
+		goto finish;
+
 	switch (exit_code) {
 	case SVM_EXIT_RDTSC:
 	case SVM_EXIT_RDTSCP:
--- linux-qcom-6.8.0.orig/arch/x86/boot/main.c
+++ linux-qcom-6.8.0/arch/x86/boot/main.c
@@ -119,8 +119,8 @@
 	char *stack_end;
 
 	if (boot_params.hdr.loadflags & CAN_USE_HEAP) {
-		asm("leal %P1(%%esp),%0"
-		    : "=r" (stack_end) : "i" (-STACK_SIZE));
+		asm("leal %n1(%%esp),%0"
+		    : "=r" (stack_end) : "i" (STACK_SIZE));
 
 		heap_end = (char *)
 			((size_t)boot_params.hdr.heap_end_ptr + 0x200);
--- linux-qcom-6.8.0.orig/arch/x86/coco/core.c
+++ linux-qcom-6.8.0/arch/x86/coco/core.c
@@ -3,18 +3,22 @@
  * Confidential Computing Platform Capability checks
  *
  * Copyright (C) 2021 Advanced Micro Devices, Inc.
+ * Copyright (C) 2024 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  *
  * Author: Tom Lendacky <thomas.lendacky@amd.com>
  */
 
 #include <linux/export.h>
 #include <linux/cc_platform.h>
+#include <linux/string.h>
+#include <linux/random.h>
 
+#include <asm/archrandom.h>
 #include <asm/coco.h>
 #include <asm/processor.h>
 
 enum cc_vendor cc_vendor __ro_after_init = CC_VENDOR_NONE;
-static u64 cc_mask __ro_after_init;
+u64 cc_mask __ro_after_init;
 
 static bool noinstr intel_cc_platform_has(enum cc_attr attr)
 {
@@ -149,7 +153,39 @@
 }
 EXPORT_SYMBOL_GPL(cc_mkdec);
 
-__init void cc_set_mask(u64 mask)
+__init void cc_random_init(void)
 {
-	cc_mask = mask;
+	/*
+	 * The seed is 32 bytes (in units of longs), which is 256 bits, which
+	 * is the security level that the RNG is targeting.
+	 */
+	unsigned long rng_seed[32 / sizeof(long)];
+	size_t i, longs;
+
+	if (!cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
+		return;
+
+	/*
+	 * Since the CoCo threat model includes the host, the only reliable
+	 * source of entropy that can be neither observed nor manipulated is
+	 * RDRAND. Usually, RDRAND failure is considered tolerable, but since
+	 * CoCo guests have no other unobservable source of entropy, it's
+	 * important to at least ensure the RNG gets some initial random seeds.
+	 */
+	for (i = 0; i < ARRAY_SIZE(rng_seed); i += longs) {
+		longs = arch_get_random_longs(&rng_seed[i], ARRAY_SIZE(rng_seed) - i);
+
+		/*
+		 * A zero return value means that the guest doesn't have RDRAND
+		 * or the CPU is physically broken, and in both cases that
+		 * means most crypto inside of the CoCo instance will be
+		 * broken, defeating the purpose of CoCo in the first place. So
+		 * just panic here because it's absolutely unsafe to continue
+		 * executing.
+		 */
+		if (longs == 0)
+			panic("RDRAND is defective.");
+	}
+	add_device_randomness(rng_seed, sizeof(rng_seed));
+	memzero_explicit(rng_seed, sizeof(rng_seed));
 }
--- linux-qcom-6.8.0.orig/arch/x86/coco/tdx/tdx.c
+++ linux-qcom-6.8.0/arch/x86/coco/tdx/tdx.c
@@ -7,6 +7,7 @@
 #include <linux/cpufeature.h>
 #include <linux/export.h>
 #include <linux/io.h>
+#include <linux/kexec.h>
 #include <asm/coco.h>
 #include <asm/tdx.h>
 #include <asm/vmx.h>
@@ -14,6 +15,8 @@
 #include <asm/insn.h>
 #include <asm/insn-eval.h>
 #include <asm/pgtable.h>
+#include <asm/set_memory.h>
+#include <asm/traps.h>
 
 /* MMIO direction */
 #define EPT_READ	0
@@ -38,6 +41,8 @@
 
 #define TDREPORT_SUBTYPE_0	0
 
+static atomic_long_t nr_shared;
+
 /* Called from __tdx_hypercall() for unrecoverable failure */
 noinstr void __noreturn __tdx_hypercall_failed(void)
 {
@@ -73,6 +78,32 @@
 		panic("TDCALL %lld failed (Buggy TDX module!)\n", fn);
 }
 
+/* Read TD-scoped metadata */
+static inline u64 tdg_vm_rd(u64 field, u64 *value)
+{
+	struct tdx_module_args args = {
+		.rdx = field,
+	};
+	u64 ret;
+
+	ret = __tdcall_ret(TDG_VM_RD, &args);
+	*value = args.r8;
+
+	return ret;
+}
+
+/* Write TD-scoped metadata */
+static inline u64 tdg_vm_wr(u64 field, u64 value, u64 mask)
+{
+	struct tdx_module_args args = {
+		.rdx = field,
+		.r8 = value,
+		.r9 = mask,
+	};
+
+	return __tdcall(TDG_VM_WR, &args);
+}
+
 /**
  * tdx_mcall_get_report0() - Wrapper to get TDREPORT0 (a.k.a. TDREPORT
  *                           subtype 0) using TDG.MR.REPORT TDCALL.
@@ -163,7 +194,61 @@
 		__tdx_hypercall(&args);
 }
 
-static void tdx_parse_tdinfo(u64 *cc_mask)
+/*
+ * The kernel cannot handle #VEs when accessing normal kernel memory. Ensure
+ * that no #VE will be delivered for accesses to TD-private memory.
+ *
+ * TDX 1.0 does not allow the guest to disable SEPT #VE on its own. The VMM
+ * controls if the guest will receive such #VE with TD attribute
+ * ATTR_SEPT_VE_DISABLE.
+ *
+ * Newer TDX modules allow the guest to control if it wants to receive SEPT
+ * violation #VEs.
+ *
+ * Check if the feature is available and disable SEPT #VE if possible.
+ *
+ * If the TD is allowed to disable/enable SEPT #VEs, the ATTR_SEPT_VE_DISABLE
+ * attribute is no longer reliable. It reflects the initial state of the
+ * control for the TD, but it will not be updated if someone (e.g. bootloader)
+ * changes it before the kernel starts. Kernel must check TDCS_TD_CTLS bit to
+ * determine if SEPT #VEs are enabled or disabled.
+ */
+static void disable_sept_ve(u64 td_attr)
+{
+	const char *msg = "TD misconfiguration: SEPT #VE has to be disabled";
+	bool debug = td_attr & ATTR_DEBUG;
+	u64 config, controls;
+
+	/* Is this TD allowed to disable SEPT #VE */
+	tdg_vm_rd(TDCS_CONFIG_FLAGS, &config);
+	if (!(config & TDCS_CONFIG_FLEXIBLE_PENDING_VE)) {
+		/* No SEPT #VE controls for the guest: check the attribute */
+		if (td_attr & ATTR_SEPT_VE_DISABLE)
+			return;
+
+		/* Relax SEPT_VE_DISABLE check for debug TD for backtraces */
+		if (debug)
+			pr_warn("%s\n", msg);
+		else
+			tdx_panic(msg);
+		return;
+	}
+
+	/* Check if SEPT #VE has been disabled before us */
+	tdg_vm_rd(TDCS_TD_CTLS, &controls);
+	if (controls & TD_CTLS_PENDING_VE_DISABLE)
+		return;
+
+	/* Keep #VEs enabled for splats in debugging environments */
+	if (debug)
+		return;
+
+	/* Disable SEPT #VEs */
+	tdg_vm_wr(TDCS_TD_CTLS, TD_CTLS_PENDING_VE_DISABLE,
+		  TD_CTLS_PENDING_VE_DISABLE);
+}
+
+static void tdx_setup(u64 *cc_mask)
 {
 	struct tdx_module_args args = {};
 	unsigned int gpa_width;
@@ -188,21 +273,12 @@
 	gpa_width = args.rcx & GENMASK(5, 0);
 	*cc_mask = BIT_ULL(gpa_width - 1);
 
-	/*
-	 * The kernel can not handle #VE's when accessing normal kernel
-	 * memory.  Ensure that no #VE will be delivered for accesses to
-	 * TD-private memory.  Only VMM-shared memory (MMIO) will #VE.
-	 */
 	td_attr = args.rdx;
-	if (!(td_attr & ATTR_SEPT_VE_DISABLE)) {
-		const char *msg = "TD misconfiguration: SEPT_VE_DISABLE attribute must be set.";
 
-		/* Relax SEPT_VE_DISABLE check for debug TD. */
-		if (td_attr & ATTR_DEBUG)
-			pr_warn("%s\n", msg);
-		else
-			tdx_panic(msg);
-	}
+	/* Kernel does not use NOTIFY_ENABLES and does not need random #VEs */
+	tdg_vm_wr(TDCS_NOTIFY_ENABLES, 0, -1ULL);
+
+	disable_sept_ve(td_attr);
 }
 
 /*
@@ -385,7 +461,6 @@
 		.r12 = size,
 		.r13 = EPT_READ,
 		.r14 = addr,
-		.r15 = *val,
 	};
 
 	if (__tdx_hypercall(&args))
@@ -430,6 +505,11 @@
 			return -EINVAL;
 	}
 
+	if (!fault_in_kernel_space(ve->gla)) {
+		WARN_ONCE(1, "Access to userspace address is not supported");
+		return -EINVAL;
+	}
+
 	/*
 	 * Reject EPT violation #VEs that split pages.
 	 *
@@ -798,36 +878,128 @@
 	return true;
 }
 
-static bool tdx_enc_status_change_prepare(unsigned long vaddr, int numpages,
-					  bool enc)
+static int tdx_enc_status_change_prepare(unsigned long vaddr, int numpages,
+					 bool enc)
 {
 	/*
 	 * Only handle shared->private conversion here.
 	 * See the comment in tdx_early_init().
 	 */
-	if (enc)
-		return tdx_enc_status_changed(vaddr, numpages, enc);
-	return true;
+	if (enc && !tdx_enc_status_changed(vaddr, numpages, enc))
+		return -EIO;
+
+	return 0;
 }
 
-static bool tdx_enc_status_change_finish(unsigned long vaddr, int numpages,
+static int tdx_enc_status_change_finish(unsigned long vaddr, int numpages,
 					 bool enc)
 {
 	/*
 	 * Only handle private->shared conversion here.
 	 * See the comment in tdx_early_init().
 	 */
-	if (!enc)
-		return tdx_enc_status_changed(vaddr, numpages, enc);
-	return true;
+	if (!enc && !tdx_enc_status_changed(vaddr, numpages, enc))
+		return -EIO;
+
+	if (enc)
+		atomic_long_sub(numpages, &nr_shared);
+	else
+		atomic_long_add(numpages, &nr_shared);
+
+	return 0;
+}
+
+/* Stop new private<->shared conversions */
+static void tdx_kexec_begin(void)
+{
+	if (!IS_ENABLED(CONFIG_KEXEC_CORE))
+		return;
+
+	/*
+	 * Crash kernel reaches here with interrupts disabled: can't wait for
+	 * conversions to finish.
+	 *
+	 * If race happened, just report and proceed.
+	 */
+	if (!set_memory_enc_stop_conversion())
+		pr_warn("Failed to stop shared<->private conversions\n");
+}
+
+/* Walk direct mapping and convert all shared memory back to private */
+static void tdx_kexec_finish(void)
+{
+	unsigned long addr, end;
+	long found = 0, shared;
+
+	if (!IS_ENABLED(CONFIG_KEXEC_CORE))
+		return;
+
+	lockdep_assert_irqs_disabled();
+
+	addr = PAGE_OFFSET;
+	end  = PAGE_OFFSET + get_max_mapped();
+
+	while (addr < end) {
+		unsigned long size;
+		unsigned int level;
+		pte_t *pte;
+
+		pte = lookup_address(addr, &level);
+		size = page_level_size(level);
+
+		if (pte && pte_decrypted(*pte)) {
+			int pages = size / PAGE_SIZE;
+
+			/*
+			 * Touching memory with shared bit set triggers implicit
+			 * conversion to shared.
+			 *
+			 * Make sure nobody touches the shared range from
+			 * now on.
+			 */
+			set_pte(pte, __pte(0));
+
+			/*
+			 * Memory encryption state persists across kexec.
+			 * If tdx_enc_status_changed() fails in the first
+			 * kernel, it leaves memory in an unknown state.
+			 *
+			 * If that memory remains shared, accessing it in the
+			 * *next* kernel through a private mapping will result
+			 * in an unrecoverable guest shutdown.
+			 *
+			 * The kdump kernel boot is not impacted as it uses
+			 * a pre-reserved memory range that is always private.
+			 * However, gathering crash information could lead to
+			 * a crash if it accesses unconverted memory through
+			 * a private mapping which is possible when accessing
+			 * that memory through /proc/vmcore, for example.
+			 *
+			 * In all cases, print error info in order to leave
+			 * enough bread crumbs for debugging.
+			 */
+			if (!tdx_enc_status_changed(addr, pages, true)) {
+				pr_err("Failed to unshare range %#lx-%#lx\n",
+				       addr, addr + size);
+			}
+
+			found += pages;
+		}
+
+		addr += size;
+	}
+
+	__flush_tlb_all();
+
+	shared = atomic_long_read(&nr_shared);
+	if (shared != found) {
+		pr_err("shared page accounting is off\n");
+		pr_err("nr_shared = %ld, nr_found = %ld\n", shared, found);
+	}
 }
 
 void __init tdx_early_init(void)
 {
-	struct tdx_module_args args = {
-		.rdx = TDCS_NOTIFY_ENABLES,
-		.r9 = -1ULL,
-	};
 	u64 cc_mask;
 	u32 eax, sig[3];
 
@@ -842,11 +1014,11 @@
 	setup_force_cpu_cap(X86_FEATURE_TSC_RELIABLE);
 
 	cc_vendor = CC_VENDOR_INTEL;
-	tdx_parse_tdinfo(&cc_mask);
-	cc_set_mask(cc_mask);
 
-	/* Kernel does not use NOTIFY_ENABLES and does not need random #VEs */
-	tdcall(TDG_VM_WR, &args);
+	/* Configure the TD */
+	tdx_setup(&cc_mask);
+
+	cc_set_mask(cc_mask);
 
 	/*
 	 * All bits above GPA width are reserved and kernel treats shared bit
@@ -881,6 +1053,9 @@
 	x86_platform.guest.enc_cache_flush_required  = tdx_cache_flush_required;
 	x86_platform.guest.enc_tlb_flush_required    = tdx_tlb_flush_required;
 
+	x86_platform.guest.enc_kexec_begin	     = tdx_kexec_begin;
+	x86_platform.guest.enc_kexec_finish	     = tdx_kexec_finish;
+
 	/*
 	 * TDX intercepts the RDMSR to read the X2APIC ID in the parallel
 	 * bringup low level code. That raises #VE which cannot be handled
--- linux-qcom-6.8.0.orig/arch/x86/crypto/aegis128-aesni-asm.S
+++ linux-qcom-6.8.0/arch/x86/crypto/aegis128-aesni-asm.S
@@ -21,7 +21,7 @@
 #define T1	%xmm7
 
 #define STATEP	%rdi
-#define LEN	%rsi
+#define LEN	%esi
 #define SRC	%rdx
 #define DST	%rcx
 
@@ -76,32 +76,32 @@
 	xor %r9d, %r9d
 	pxor MSG, MSG
 
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x1, %r8
 	jz .Lld_partial_1
 
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x1E, %r8
 	add SRC, %r8
 	mov (%r8), %r9b
 
 .Lld_partial_1:
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x2, %r8
 	jz .Lld_partial_2
 
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x1C, %r8
 	add SRC, %r8
 	shl $0x10, %r9
 	mov (%r8), %r9w
 
 .Lld_partial_2:
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x4, %r8
 	jz .Lld_partial_4
 
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x18, %r8
 	add SRC, %r8
 	shl $32, %r9
@@ -111,11 +111,11 @@
 .Lld_partial_4:
 	movq %r9, MSG
 
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x8, %r8
 	jz .Lld_partial_8
 
-	mov LEN, %r8
+	mov LEN, %r8d
 	and $0x10, %r8
 	add SRC, %r8
 	pslldq $8, MSG
@@ -139,7 +139,7 @@
  *   %r10
  */
 SYM_FUNC_START_LOCAL(__store_partial)
-	mov LEN, %r8
+	mov LEN, %r8d
 	mov DST, %r9
 
 	movq T0, %r10
@@ -677,7 +677,7 @@
 	call __store_partial
 
 	/* mask with byte count: */
-	movq LEN, T0
+	movd LEN, T0
 	punpcklbw T0, T0
 	punpcklbw T0, T0
 	punpcklbw T0, T0
@@ -702,7 +702,8 @@
 
 /*
  * void crypto_aegis128_aesni_final(void *state, void *tag_xor,
- *                                  u64 assoclen, u64 cryptlen);
+ *                                  unsigned int assoclen,
+ *                                  unsigned int cryptlen);
  */
 SYM_FUNC_START(crypto_aegis128_aesni_final)
 	FRAME_BEGIN
@@ -715,8 +716,8 @@
 	movdqu 0x40(STATEP), STATE4
 
 	/* prepare length block: */
-	movq %rdx, MSG
-	movq %rcx, T0
+	movd %edx, MSG
+	movd %ecx, T0
 	pslldq $8, T0
 	pxor T0, MSG
 	psllq $3, MSG /* multiply by 8 (to get bit count) */
--- linux-qcom-6.8.0.orig/arch/x86/crypto/nh-avx2-x86_64.S
+++ linux-qcom-6.8.0/arch/x86/crypto/nh-avx2-x86_64.S
@@ -154,5 +154,6 @@
 	vpaddq		T1, T0, T0
 	vpaddq		T4, T0, T0
 	vmovdqu		T0, (HASH)
+	vzeroupper
 	RET
 SYM_FUNC_END(nh_avx2)
--- linux-qcom-6.8.0.orig/arch/x86/crypto/sha256-avx2-asm.S
+++ linux-qcom-6.8.0/arch/x86/crypto/sha256-avx2-asm.S
@@ -592,22 +592,22 @@
 	leaq	K256+0*32(%rip), INP		## reuse INP as scratch reg
 	vpaddd	(INP, SRND), X0, XFER
 	vmovdqa XFER, 0*32+_XFER(%rsp, SRND)
-	FOUR_ROUNDS_AND_SCHED	_XFER + 0*32
+	FOUR_ROUNDS_AND_SCHED	(_XFER + 0*32)
 
 	leaq	K256+1*32(%rip), INP
 	vpaddd	(INP, SRND), X0, XFER
 	vmovdqa XFER, 1*32+_XFER(%rsp, SRND)
-	FOUR_ROUNDS_AND_SCHED	_XFER + 1*32
+	FOUR_ROUNDS_AND_SCHED	(_XFER + 1*32)
 
 	leaq	K256+2*32(%rip), INP
 	vpaddd	(INP, SRND), X0, XFER
 	vmovdqa XFER, 2*32+_XFER(%rsp, SRND)
-	FOUR_ROUNDS_AND_SCHED	_XFER + 2*32
+	FOUR_ROUNDS_AND_SCHED	(_XFER + 2*32)
 
 	leaq	K256+3*32(%rip), INP
 	vpaddd	(INP, SRND), X0, XFER
 	vmovdqa XFER, 3*32+_XFER(%rsp, SRND)
-	FOUR_ROUNDS_AND_SCHED	_XFER + 3*32
+	FOUR_ROUNDS_AND_SCHED	(_XFER + 3*32)
 
 	add	$4*32, SRND
 	cmp	$3*4*32, SRND
@@ -618,12 +618,12 @@
 	leaq	K256+0*32(%rip), INP
 	vpaddd	(INP, SRND), X0, XFER
 	vmovdqa XFER, 0*32+_XFER(%rsp, SRND)
-	DO_4ROUNDS	_XFER + 0*32
+	DO_4ROUNDS	(_XFER + 0*32)
 
 	leaq	K256+1*32(%rip), INP
 	vpaddd	(INP, SRND), X1, XFER
 	vmovdqa XFER, 1*32+_XFER(%rsp, SRND)
-	DO_4ROUNDS	_XFER + 1*32
+	DO_4ROUNDS	(_XFER + 1*32)
 	add	$2*32, SRND
 
 	vmovdqa	X2, X0
@@ -651,8 +651,8 @@
 	xor	SRND, SRND
 .align 16
 .Lloop3:
-	DO_4ROUNDS	 _XFER + 0*32 + 16
-	DO_4ROUNDS	 _XFER + 1*32 + 16
+	DO_4ROUNDS	(_XFER + 0*32 + 16)
+	DO_4ROUNDS	(_XFER + 1*32 + 16)
 	add	$2*32, SRND
 	cmp	$4*4*32, SRND
 	jb	.Lloop3
@@ -716,6 +716,7 @@
 	popq	%r13
 	popq	%r12
 	popq	%rbx
+	vzeroupper
 	RET
 SYM_FUNC_END(sha256_transform_rorx)
 
--- linux-qcom-6.8.0.orig/arch/x86/crypto/sha512-avx2-asm.S
+++ linux-qcom-6.8.0/arch/x86/crypto/sha512-avx2-asm.S
@@ -680,6 +680,7 @@
 	pop	%r12
 	pop	%rbx
 
+	vzeroupper
 	RET
 SYM_FUNC_END(sha512_transform_rorx)
 
--- linux-qcom-6.8.0.orig/arch/x86/entry/common.c
+++ linux-qcom-6.8.0/arch/x86/entry/common.c
@@ -49,7 +49,7 @@
 
 	if (likely(unr < NR_syscalls)) {
 		unr = array_index_nospec(unr, NR_syscalls);
-		regs->ax = sys_call_table[unr](regs);
+		regs->ax = x64_sys_call(regs, unr);
 		return true;
 	}
 	return false;
@@ -66,7 +66,7 @@
 
 	if (IS_ENABLED(CONFIG_X86_X32_ABI) && likely(xnr < X32_NR_syscalls)) {
 		xnr = array_index_nospec(xnr, X32_NR_syscalls);
-		regs->ax = x32_sys_call_table[xnr](regs);
+		regs->ax = x32_sys_call(regs, xnr);
 		return true;
 	}
 	return false;
@@ -162,7 +162,7 @@
 
 	if (likely(unr < IA32_NR_syscalls)) {
 		unr = array_index_nospec(unr, IA32_NR_syscalls);
-		regs->ax = ia32_sys_call_table[unr](regs);
+		regs->ax = ia32_sys_call(regs, unr);
 	} else if (nr != -1) {
 		regs->ax = __ia32_sys_ni_syscall(regs);
 	}
@@ -189,7 +189,7 @@
 }
 
 /**
- * int80_emulation - 32-bit legacy syscall entry
+ * do_int80_emulation - 32-bit legacy syscall C entry from asm
  *
  * This entry point can be used by 32-bit and 64-bit programs to perform
  * 32-bit system calls.  Instances of INT $0x80 can be found inline in
@@ -207,7 +207,7 @@
  *   eax:				system call number
  *   ebx, ecx, edx, esi, edi, ebp:	arg1 - arg 6
  */
-DEFINE_IDTENTRY_RAW(int80_emulation)
+__visible noinstr void do_int80_emulation(struct pt_regs *regs)
 {
 	int nr;
 
--- linux-qcom-6.8.0.orig/arch/x86/entry/entry.S
+++ linux-qcom-6.8.0/arch/x86/entry/entry.S
@@ -9,6 +9,8 @@
 #include <asm/unwind_hints.h>
 #include <asm/segment.h>
 #include <asm/cache.h>
+#include <asm/cpufeatures.h>
+#include <asm/nospec-branch.h>
 
 .pushsection .noinstr.text, "ax"
 
@@ -17,6 +19,9 @@
 	movl	$PRED_CMD_IBPB, %eax
 	xorl	%edx, %edx
 	wrmsr
+
+	/* Make sure IBPB clears return stack preductions too. */
+	FILL_RETURN_BUFFER %rax, RSB_CLEAR_LOOPS, X86_BUG_IBPB_NO_RET
 	RET
 SYM_FUNC_END(entry_ibpb)
 /* For KVM */
@@ -43,3 +48,18 @@
 
 .popsection
 
+#ifndef CONFIG_X86_64
+/*
+ * Clang's implementation of TLS stack cookies requires the variable in
+ * question to be a TLS variable. If the variable happens to be defined as an
+ * ordinary variable with external linkage in the same compilation unit (which
+ * amounts to the whole of vmlinux with LTO enabled), Clang will drop the
+ * segment register prefix from the references, resulting in broken code. Work
+ * around this by avoiding the symbol used in -mstack-protector-guard-symbol=
+ * entirely in the C code, and use an alias emitted by the linker script
+ * instead.
+ */
+#ifdef CONFIG_STACKPROTECTOR
+EXPORT_SYMBOL(__ref_stack_chk_guard);
+#endif
+#endif
--- linux-qcom-6.8.0.orig/arch/x86/entry/entry_32.S
+++ linux-qcom-6.8.0/arch/x86/entry/entry_32.S
@@ -875,6 +875,8 @@
 
 	/* Now ready to switch the cr3 */
 	SWITCH_TO_USER_CR3 scratch_reg=%eax
+	/* Clobbers ZF */
+	CLEAR_CPU_BUFFERS
 
 	/*
 	 * Restore all flags except IF. (We restore IF separately because
@@ -885,7 +887,6 @@
 	BUG_IF_WRONG_CR3 no_user_check=1
 	popfl
 	popl	%eax
-	CLEAR_CPU_BUFFERS
 
 	/*
 	 * Return back to the vDSO, which will pop ecx and edx.
@@ -1148,7 +1149,6 @@
 
 	/* Not on SYSENTER stack. */
 	call	exc_nmi
-	CLEAR_CPU_BUFFERS
 	jmp	.Lnmi_return
 
 .Lnmi_from_sysenter_stack:
@@ -1169,6 +1169,7 @@
 
 	CHECK_AND_APPLY_ESPFIX
 	RESTORE_ALL_NMI cr3_reg=%edi pop=4
+	CLEAR_CPU_BUFFERS
 	jmp	.Lirq_return
 
 #ifdef CONFIG_X86_ESPFIX32
@@ -1210,6 +1211,7 @@
 	 *  1 - orig_ax
 	 */
 	lss	(1+5+6)*4(%esp), %esp			# back to espfix stack
+	CLEAR_CPU_BUFFERS
 	jmp	.Lirq_return
 #endif
 SYM_CODE_END(asm_exc_nmi)
--- linux-qcom-6.8.0.orig/arch/x86/entry/entry_64.S
+++ linux-qcom-6.8.0/arch/x86/entry/entry_64.S
@@ -116,6 +116,7 @@
 	/* clobbers %rax, make sure it is after saving the syscall nr */
 	IBRS_ENTER
 	UNTRAIN_RET
+	CLEAR_BRANCH_HISTORY
 
 	call	do_syscall_64		/* returns with IRQs disabled */
 
@@ -1494,3 +1495,63 @@
 	call	make_task_dead
 SYM_CODE_END(rewind_stack_and_make_dead)
 .popsection
+
+/*
+ * This sequence executes branches in order to remove user branch information
+ * from the branch history tracker in the Branch Predictor, therefore removing
+ * user influence on subsequent BTB lookups.
+ *
+ * It should be used on parts prior to Alder Lake. Newer parts should use the
+ * BHI_DIS_S hardware control instead. If a pre-Alder Lake part is being
+ * virtualized on newer hardware the VMM should protect against BHI attacks by
+ * setting BHI_DIS_S for the guests.
+ *
+ * CALLs/RETs are necessary to prevent Loop Stream Detector(LSD) from engaging
+ * and not clearing the branch history. The call tree looks like:
+ *
+ * call 1
+ *    call 2
+ *      call 2
+ *        call 2
+ *          call 2
+ * 	      call 2
+ * 	      ret
+ * 	    ret
+ *        ret
+ *      ret
+ *    ret
+ * ret
+ *
+ * This means that the stack is non-constant and ORC can't unwind it with %rsp
+ * alone.  Therefore we unconditionally set up the frame pointer, which allows
+ * ORC to unwind properly.
+ *
+ * The alignment is for performance and not for safety, and may be safely
+ * refactored in the future if needed.
+ */
+SYM_FUNC_START(clear_bhb_loop)
+	push	%rbp
+	mov	%rsp, %rbp
+	movl	$5, %ecx
+	ANNOTATE_INTRA_FUNCTION_CALL
+	call	1f
+	jmp	5f
+	.align 64, 0xcc
+	ANNOTATE_INTRA_FUNCTION_CALL
+1:	call	2f
+	RET
+	.align 64, 0xcc
+2:	movl	$5, %eax
+3:	jmp	4f
+	nop
+4:	sub	$1, %eax
+	jnz	3b
+	sub	$1, %ecx
+	jnz	1b
+	RET
+5:	lfence
+	pop	%rbp
+	RET
+SYM_FUNC_END(clear_bhb_loop)
+EXPORT_SYMBOL_GPL(clear_bhb_loop)
+STACK_FRAME_NON_STANDARD(clear_bhb_loop)
--- linux-qcom-6.8.0.orig/arch/x86/entry/entry_64_compat.S
+++ linux-qcom-6.8.0/arch/x86/entry/entry_64_compat.S
@@ -90,9 +90,6 @@
 
 	cld
 
-	IBRS_ENTER
-	UNTRAIN_RET
-
 	/*
 	 * SYSENTER doesn't filter flags, so we need to clear NT and AC
 	 * ourselves.  To save a few cycles, we can check whether
@@ -116,6 +113,16 @@
 	jnz	.Lsysenter_fix_flags
 .Lsysenter_flags_fixed:
 
+	/*
+	 * CPU bugs mitigations mechanisms can call other functions. They
+	 * should be invoked after making sure TF is cleared because
+	 * single-step is ignored only for instructions inside the
+	 * entry_SYSENTER_compat function.
+	 */
+	IBRS_ENTER
+	UNTRAIN_RET
+	CLEAR_BRANCH_HISTORY
+
 	movq	%rsp, %rdi
 	call	do_SYSENTER_32
 	jmp	sysret32_from_system_call
@@ -206,6 +213,7 @@
 
 	IBRS_ENTER
 	UNTRAIN_RET
+	CLEAR_BRANCH_HISTORY
 
 	movq	%rsp, %rdi
 	call	do_fast_syscall_32
@@ -276,3 +284,17 @@
 	ANNOTATE_NOENDBR
 	int3
 SYM_CODE_END(entry_SYSCALL_compat)
+
+/*
+ * int 0x80 is used by 32 bit mode as a system call entry. Normally idt entries
+ * point to C routines, however since this is a system call interface the branch
+ * history needs to be scrubbed to protect against BHI attacks, and that
+ * scrubbing needs to take place in assembly code prior to entering any C
+ * routines.
+ */
+SYM_CODE_START(int80_emulation)
+	ANNOTATE_NOENDBR
+	UNWIND_HINT_FUNC
+	CLEAR_BRANCH_HISTORY
+	jmp do_int80_emulation
+SYM_CODE_END(int80_emulation)
--- linux-qcom-6.8.0.orig/arch/x86/entry/syscall_32.c
+++ linux-qcom-6.8.0/arch/x86/entry/syscall_32.c
@@ -14,12 +14,31 @@
 #endif
 
 #define __SYSCALL(nr, sym) extern long __ia32_##sym(const struct pt_regs *);
-
+#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __ia32_##sym(const struct pt_regs *);
 #include <asm/syscalls_32.h>
-#undef __SYSCALL
+#undef  __SYSCALL
 
-#define __SYSCALL(nr, sym) __ia32_##sym,
+#undef  __SYSCALL_NORETURN
+#define __SYSCALL_NORETURN __SYSCALL
 
-__visible const sys_call_ptr_t ia32_sys_call_table[] = {
+/*
+ * The sys_call_table[] is no longer used for system calls, but
+ * kernel/trace/trace_syscalls.c still wants to know the system
+ * call address.
+ */
+#ifdef CONFIG_X86_32
+#define __SYSCALL(nr, sym) __ia32_##sym,
+const sys_call_ptr_t sys_call_table[] = {
 #include <asm/syscalls_32.h>
 };
+#undef  __SYSCALL
+#endif
+
+#define __SYSCALL(nr, sym) case nr: return __ia32_##sym(regs);
+long ia32_sys_call(const struct pt_regs *regs, unsigned int nr)
+{
+	switch (nr) {
+	#include <asm/syscalls_32.h>
+	default: return __ia32_sys_ni_syscall(regs);
+	}
+};
--- linux-qcom-6.8.0.orig/arch/x86/entry/syscall_64.c
+++ linux-qcom-6.8.0/arch/x86/entry/syscall_64.c
@@ -8,11 +8,29 @@
 #include <asm/syscall.h>
 
 #define __SYSCALL(nr, sym) extern long __x64_##sym(const struct pt_regs *);
+#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __x64_##sym(const struct pt_regs *);
 #include <asm/syscalls_64.h>
-#undef __SYSCALL
+#undef  __SYSCALL
 
-#define __SYSCALL(nr, sym) __x64_##sym,
+#undef  __SYSCALL_NORETURN
+#define __SYSCALL_NORETURN __SYSCALL
 
-asmlinkage const sys_call_ptr_t sys_call_table[] = {
+/*
+ * The sys_call_table[] is no longer used for system calls, but
+ * kernel/trace/trace_syscalls.c still wants to know the system
+ * call address.
+ */
+#define __SYSCALL(nr, sym) __x64_##sym,
+const sys_call_ptr_t sys_call_table[] = {
 #include <asm/syscalls_64.h>
 };
+#undef  __SYSCALL
+
+#define __SYSCALL(nr, sym) case nr: return __x64_##sym(regs);
+long x64_sys_call(const struct pt_regs *regs, unsigned int nr)
+{
+	switch (nr) {
+	#include <asm/syscalls_64.h>
+	default: return __x64_sys_ni_syscall(regs);
+	}
+};
--- linux-qcom-6.8.0.orig/arch/x86/entry/syscall_x32.c
+++ linux-qcom-6.8.0/arch/x86/entry/syscall_x32.c
@@ -8,11 +8,18 @@
 #include <asm/syscall.h>
 
 #define __SYSCALL(nr, sym) extern long __x64_##sym(const struct pt_regs *);
+#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __x64_##sym(const struct pt_regs *);
 #include <asm/syscalls_x32.h>
-#undef __SYSCALL
+#undef  __SYSCALL
 
-#define __SYSCALL(nr, sym) __x64_##sym,
+#undef  __SYSCALL_NORETURN
+#define __SYSCALL_NORETURN __SYSCALL
 
-asmlinkage const sys_call_ptr_t x32_sys_call_table[] = {
-#include <asm/syscalls_x32.h>
+#define __SYSCALL(nr, sym) case nr: return __x64_##sym(regs);
+long x32_sys_call(const struct pt_regs *regs, unsigned int nr)
+{
+	switch (nr) {
+	#include <asm/syscalls_x32.h>
+	default: return __x64_sys_ni_syscall(regs);
+	}
 };
--- linux-qcom-6.8.0.orig/arch/x86/entry/syscalls/syscall_32.tbl
+++ linux-qcom-6.8.0/arch/x86/entry/syscalls/syscall_32.tbl
@@ -2,7 +2,7 @@
 # 32-bit system call numbers and entry vectors
 #
 # The format is:
-# <number> <abi> <name> <entry point> <compat entry point>
+# <number> <abi> <name> <entry point> [<compat entry point> [noreturn]]
 #
 # The __ia32_sys and __ia32_compat_sys stubs are created on-the-fly for
 # sys_*() system calls and compat_sys_*() compat system calls if
@@ -12,7 +12,7 @@
 # The abi is always "i386" for this file.
 #
 0	i386	restart_syscall		sys_restart_syscall
-1	i386	exit			sys_exit
+1	i386	exit			sys_exit			-			noreturn
 2	i386	fork			sys_fork
 3	i386	read			sys_read
 4	i386	write			sys_write
@@ -263,7 +263,7 @@
 249	i386	io_cancel		sys_io_cancel
 250	i386	fadvise64		sys_ia32_fadvise64
 # 251 is available for reuse (was briefly sys_set_zone_reclaim)
-252	i386	exit_group		sys_exit_group
+252	i386	exit_group		sys_exit_group			-			noreturn
 253	i386	lookup_dcookie
 254	i386	epoll_create		sys_epoll_create
 255	i386	epoll_ctl		sys_epoll_ctl
@@ -420,7 +420,7 @@
 412	i386	utimensat_time64	sys_utimensat
 413	i386	pselect6_time64		sys_pselect6			compat_sys_pselect6_time64
 414	i386	ppoll_time64		sys_ppoll			compat_sys_ppoll_time64
-416	i386	io_pgetevents_time64	sys_io_pgetevents
+416	i386	io_pgetevents_time64	sys_io_pgetevents		compat_sys_io_pgetevents_time64
 417	i386	recvmmsg_time64		sys_recvmmsg			compat_sys_recvmmsg_time64
 418	i386	mq_timedsend_time64	sys_mq_timedsend
 419	i386	mq_timedreceive_time64	sys_mq_timedreceive
--- linux-qcom-6.8.0.orig/arch/x86/entry/syscalls/syscall_64.tbl
+++ linux-qcom-6.8.0/arch/x86/entry/syscalls/syscall_64.tbl
@@ -2,7 +2,7 @@
 # 64-bit system call numbers and entry vectors
 #
 # The format is:
-# <number> <abi> <name> <entry point>
+# <number> <abi> <name> <entry point> [<compat entry point> [noreturn]]
 #
 # The __x64_sys_*() stubs are created on-the-fly for sys_*() system calls
 #
@@ -68,7 +68,7 @@
 57	common	fork			sys_fork
 58	common	vfork			sys_vfork
 59	64	execve			sys_execve
-60	common	exit			sys_exit
+60	common	exit			sys_exit			-			noreturn
 61	common	wait4			sys_wait4
 62	common	kill			sys_kill
 63	common	uname			sys_newuname
@@ -239,7 +239,7 @@
 228	common	clock_gettime		sys_clock_gettime
 229	common	clock_getres		sys_clock_getres
 230	common	clock_nanosleep		sys_clock_nanosleep
-231	common	exit_group		sys_exit_group
+231	common	exit_group		sys_exit_group			-			noreturn
 232	common	epoll_wait		sys_epoll_wait
 233	common	epoll_ctl		sys_epoll_ctl
 234	common	tgkill			sys_tgkill
--- linux-qcom-6.8.0.orig/arch/x86/entry/vdso/Makefile
+++ linux-qcom-6.8.0/arch/x86/entry/vdso/Makefile
@@ -34,8 +34,13 @@
 KASAN_SANITIZE_vma.o			:= y
 UBSAN_SANITIZE_vma.o			:= y
 KCSAN_SANITIZE_vma.o			:= y
-OBJECT_FILES_NON_STANDARD_vma.o		:= n
-OBJECT_FILES_NON_STANDARD_extable.o	:= n
+
+OBJECT_FILES_NON_STANDARD_extable.o		:= n
+OBJECT_FILES_NON_STANDARD_vdso-image-32.o 	:= n
+OBJECT_FILES_NON_STANDARD_vdso-image-x32.o	:= n
+OBJECT_FILES_NON_STANDARD_vdso-image-64.o 	:= n
+OBJECT_FILES_NON_STANDARD_vdso32-setup.o	:= n
+OBJECT_FILES_NON_STANDARD_vma.o			:= n
 
 # vDSO images to build
 vdso_img-$(VDSO64-y)		+= 64
@@ -43,7 +48,6 @@
 vdso_img-$(VDSO32-y)		+= 32
 
 obj-$(VDSO32-y)				 += vdso32-setup.o
-OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n
 
 vobjs := $(foreach F,$(vobjs-y),$(obj)/$F)
 vobjs32 := $(foreach F,$(vobjs32-y),$(obj)/$F)
--- linux-qcom-6.8.0.orig/arch/x86/entry/vsyscall/vsyscall_64.c
+++ linux-qcom-6.8.0/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -76,7 +76,7 @@
 	if (!show_unhandled_signals)
 		return;
 
-	printk_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
+	printk_ratelimited("%s%s[%d] %s ip:%lx cs:%x sp:%lx ax:%lx si:%lx di:%lx\n",
 			   level, current->comm, task_pid_nr(current),
 			   message, regs->ip, regs->cs,
 			   regs->sp, regs->ax, regs->si, regs->di);
@@ -98,11 +98,6 @@
 
 static bool write_ok_or_segv(unsigned long ptr, size_t size)
 {
-	/*
-	 * XXX: if access_ok, get_user, and put_user handled
-	 * sig_on_uaccess_err, this could go away.
-	 */
-
 	if (!access_ok((void __user *)ptr, size)) {
 		struct thread_struct *thread = &current->thread;
 
@@ -120,10 +115,8 @@
 bool emulate_vsyscall(unsigned long error_code,
 		      struct pt_regs *regs, unsigned long address)
 {
-	struct task_struct *tsk;
 	unsigned long caller;
 	int vsyscall_nr, syscall_nr, tmp;
-	int prev_sig_on_uaccess_err;
 	long ret;
 	unsigned long orig_dx;
 
@@ -172,8 +165,6 @@
 		goto sigsegv;
 	}
 
-	tsk = current;
-
 	/*
 	 * Check for access_ok violations and find the syscall nr.
 	 *
@@ -234,12 +225,8 @@
 		goto do_ret;  /* skip requested */
 
 	/*
-	 * With a real vsyscall, page faults cause SIGSEGV.  We want to
-	 * preserve that behavior to make writing exploits harder.
+	 * With a real vsyscall, page faults cause SIGSEGV.
 	 */
-	prev_sig_on_uaccess_err = current->thread.sig_on_uaccess_err;
-	current->thread.sig_on_uaccess_err = 1;
-
 	ret = -EFAULT;
 	switch (vsyscall_nr) {
 	case 0:
@@ -262,23 +249,12 @@
 		break;
 	}
 
-	current->thread.sig_on_uaccess_err = prev_sig_on_uaccess_err;
-
 check_fault:
 	if (ret == -EFAULT) {
 		/* Bad news -- userspace fed a bad pointer to a vsyscall. */
 		warn_bad_vsyscall(KERN_INFO, regs,
 				  "vsyscall fault (exploit attempt?)");
-
-		/*
-		 * If we failed to generate a signal for any reason,
-		 * generate one here.  (This should be impossible.)
-		 */
-		if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) &&
-				 !sigismember(&tsk->pending.signal, SIGSEGV)))
-			goto sigsegv;
-
-		return true;  /* Don't emulate the ret. */
+		goto sigsegv;
 	}
 
 	regs->ax = ret;
--- linux-qcom-6.8.0.orig/arch/x86/events/amd/core.c
+++ linux-qcom-6.8.0/arch/x86/events/amd/core.c
@@ -250,7 +250,7 @@
 /*
  * AMD Performance Monitor Family 17h and later:
  */
-static const u64 amd_f17h_perfmon_event_map[PERF_COUNT_HW_MAX] =
+static const u64 amd_zen1_perfmon_event_map[PERF_COUNT_HW_MAX] =
 {
 	[PERF_COUNT_HW_CPU_CYCLES]		= 0x0076,
 	[PERF_COUNT_HW_INSTRUCTIONS]		= 0x00c0,
@@ -262,10 +262,24 @@
 	[PERF_COUNT_HW_STALLED_CYCLES_BACKEND]	= 0x0187,
 };
 
+static const u64 amd_zen2_perfmon_event_map[PERF_COUNT_HW_MAX] =
+{
+	[PERF_COUNT_HW_CPU_CYCLES]		= 0x0076,
+	[PERF_COUNT_HW_INSTRUCTIONS]		= 0x00c0,
+	[PERF_COUNT_HW_CACHE_REFERENCES]	= 0xff60,
+	[PERF_COUNT_HW_CACHE_MISSES]		= 0x0964,
+	[PERF_COUNT_HW_BRANCH_INSTRUCTIONS]	= 0x00c2,
+	[PERF_COUNT_HW_BRANCH_MISSES]		= 0x00c3,
+	[PERF_COUNT_HW_STALLED_CYCLES_FRONTEND]	= 0x00a9,
+};
+
 static u64 amd_pmu_event_map(int hw_event)
 {
-	if (boot_cpu_data.x86 >= 0x17)
-		return amd_f17h_perfmon_event_map[hw_event];
+	if (cpu_feature_enabled(X86_FEATURE_ZEN2) || boot_cpu_data.x86 >= 0x19)
+		return amd_zen2_perfmon_event_map[hw_event];
+
+	if (cpu_feature_enabled(X86_FEATURE_ZEN1))
+		return amd_zen1_perfmon_event_map[hw_event];
 
 	return amd_perfmon_event_map[hw_event];
 }
@@ -403,8 +417,10 @@
 	 * be removed on one CPU at a time AND PMU is disabled
 	 * when we come here
 	 */
-	for (i = 0; i < x86_pmu.num_counters; i++) {
-		if (cmpxchg(nb->owners + i, event, NULL) == event)
+	for_each_set_bit(i, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
+		struct perf_event *tmp = event;
+
+		if (try_cmpxchg(nb->owners + i, &tmp, NULL))
 			break;
 	}
 }
@@ -470,7 +486,7 @@
 	 * because of successive calls to x86_schedule_events() from
 	 * hw_perf_group_sched_in() without hw_perf_enable()
 	 */
-	for_each_set_bit(idx, c->idxmsk, x86_pmu.num_counters) {
+	for_each_set_bit(idx, c->idxmsk, x86_pmu_max_num_counters(NULL)) {
 		if (new == -1 || hwc->idx == idx)
 			/* assign free slot, prefer hwc->idx */
 			old = cmpxchg(nb->owners + idx, NULL, event);
@@ -513,7 +529,7 @@
 	/*
 	 * initialize all possible NB constraints
 	 */
-	for (i = 0; i < x86_pmu.num_counters; i++) {
+	for_each_set_bit(i, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		__set_bit(i, nb->event_constraints[i].idxmsk);
 		nb->event_constraints[i].weight = 1;
 	}
@@ -604,7 +620,6 @@
 
 	kfree(cpuhw->lbr_sel);
 	cpuhw->lbr_sel = NULL;
-	amd_pmu_cpu_reset(cpu);
 
 	if (!x86_pmu.amd_nb_constraints)
 		return;
@@ -707,7 +722,7 @@
 	 * counters are always enabled when this function is called and
 	 * ARCH_PERFMON_EVENTSEL_INT is always set.
 	 */
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		if (!test_bit(idx, cpuc->active_mask))
 			continue;
 
@@ -727,7 +742,7 @@
 
 	amd_brs_enable_all();
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		/* only activate events which are marked as active */
 		if (!test_bit(idx, cpuc->active_mask))
 			continue;
@@ -882,11 +897,12 @@
 static int amd_pmu_v2_handle_irq(struct pt_regs *regs)
 {
 	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+	static atomic64_t status_warned = ATOMIC64_INIT(0);
+	u64 reserved, status, mask, new_bits, prev_bits;
 	struct perf_sample_data data;
 	struct hw_perf_event *hwc;
 	struct perf_event *event;
 	int handled = 0, idx;
-	u64 reserved, status, mask;
 	bool pmu_enabled;
 
 	/*
@@ -919,7 +935,7 @@
 	/* Clear any reserved bits set by buggy microcode */
 	status &= amd_pmu_global_cntr_mask;
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		if (!test_bit(idx, cpuc->active_mask))
 			continue;
 
@@ -951,7 +967,12 @@
 	 * the corresponding PMCs are expected to be inactive according to the
 	 * active_mask
 	 */
-	WARN_ON(status > 0);
+	if (status > 0) {
+		prev_bits = atomic64_fetch_or(status, &status_warned);
+		// A new bit was set for the very first time.
+		new_bits = status & ~prev_bits;
+		WARN(new_bits, "New overflows for inactive PMCs: %llx\n", new_bits);
+	}
 
 	/* Clear overflow and freeze bits */
 	amd_pmu_ack_global_status(~status);
@@ -1254,7 +1275,7 @@
 	.addr_offset            = amd_pmu_addr_offset,
 	.event_map		= amd_pmu_event_map,
 	.max_events		= ARRAY_SIZE(amd_perfmon_event_map),
-	.num_counters		= AMD64_NUM_COUNTERS,
+	.cntr_mask64		= GENMASK_ULL(AMD64_NUM_COUNTERS - 1, 0),
 	.add			= amd_pmu_add_event,
 	.del			= amd_pmu_del_event,
 	.cntval_bits		= 48,
@@ -1353,7 +1374,7 @@
 	 */
 	x86_pmu.eventsel	= MSR_F15H_PERF_CTL;
 	x86_pmu.perfctr		= MSR_F15H_PERF_CTR;
-	x86_pmu.num_counters	= AMD64_NUM_COUNTERS_CORE;
+	x86_pmu.cntr_mask64	= GENMASK_ULL(AMD64_NUM_COUNTERS_CORE - 1, 0);
 
 	/* Check for Performance Monitoring v2 support */
 	if (boot_cpu_has(X86_FEATURE_PERFMON_V2)) {
@@ -1363,9 +1384,9 @@
 		x86_pmu.version = 2;
 
 		/* Find the number of available Core PMCs */
-		x86_pmu.num_counters = ebx.split.num_core_pmc;
+		x86_pmu.cntr_mask64 = GENMASK_ULL(ebx.split.num_core_pmc - 1, 0);
 
-		amd_pmu_global_cntr_mask = (1ULL << x86_pmu.num_counters) - 1;
+		amd_pmu_global_cntr_mask = x86_pmu.cntr_mask64;
 
 		/* Update PMC handling functions */
 		x86_pmu.enable_all = amd_pmu_v2_enable_all;
@@ -1393,12 +1414,12 @@
 		 * even numbered counter that has a consecutive adjacent odd
 		 * numbered counter following it.
 		 */
-		for (i = 0; i < x86_pmu.num_counters - 1; i += 2)
+		for (i = 0; i < x86_pmu_max_num_counters(NULL) - 1; i += 2)
 			even_ctr_mask |= BIT_ULL(i);
 
 		pair_constraint = (struct event_constraint)
 				    __EVENT_CONSTRAINT(0, even_ctr_mask, 0,
-				    x86_pmu.num_counters / 2, 0,
+				    x86_pmu_max_num_counters(NULL) / 2, 0,
 				    PERF_X86_EVENT_PAIR);
 
 		x86_pmu.get_event_constraints = amd_get_event_constraints_f17h;
--- linux-qcom-6.8.0.orig/arch/x86/events/amd/lbr.c
+++ linux-qcom-6.8.0/arch/x86/events/amd/lbr.c
@@ -173,9 +173,11 @@
 
 		/*
 		 * Check if a branch has been logged; if valid = 0, spec = 0
-		 * then no branch was recorded
+		 * then no branch was recorded; if reserved = 1 then an
+		 * erroneous branch was recorded (see Erratum 1452)
 		 */
-		if (!entry.to.split.valid && !entry.to.split.spec)
+		if ((!entry.to.split.valid && !entry.to.split.spec) ||
+		    entry.to.split.reserved)
 			continue;
 
 		perf_clear_branch_entry_bitfields(br + out);
--- linux-qcom-6.8.0.orig/arch/x86/events/amd/uncore.c
+++ linux-qcom-6.8.0/arch/x86/events/amd/uncore.c
@@ -162,7 +162,9 @@
 	/* if not, take the first available counter */
 	hwc->idx = -1;
 	for (i = 0; i < pmu->num_counters; i++) {
-		if (cmpxchg(&ctx->events[i], NULL, event) == NULL) {
+		struct perf_event *tmp = NULL;
+
+		if (try_cmpxchg(&ctx->events[i], &tmp, event)) {
 			hwc->idx = i;
 			break;
 		}
@@ -196,7 +198,9 @@
 	event->pmu->stop(event, PERF_EF_UPDATE);
 
 	for (i = 0; i < pmu->num_counters; i++) {
-		if (cmpxchg(&ctx->events[i], event, NULL) == event)
+		struct perf_event *tmp = event;
+
+		if (try_cmpxchg(&ctx->events[i], &tmp, NULL))
 			break;
 	}
 
@@ -639,7 +643,7 @@
 	info.split.aux_data = 0;
 	info.split.num_pmcs = NUM_COUNTERS_NB;
 	info.split.gid = 0;
-	info.split.cid = topology_die_id(cpu);
+	info.split.cid = topology_logical_package_id(cpu);
 
 	if (pmu_version >= 2) {
 		ebx.full = cpuid_ebx(EXT_PERFMON_DEBUG_FEATURES);
@@ -654,17 +658,20 @@
 {
 	struct attribute **df_attr = amd_uncore_df_format_attr;
 	struct amd_uncore_pmu *pmu;
+	int num_counters;
 
 	/* Run just once */
 	if (uncore->init_done)
 		return amd_uncore_ctx_init(uncore, cpu);
 
+	num_counters = amd_uncore_ctx_num_pmcs(uncore, cpu);
+	if (!num_counters)
+		goto done;
+
 	/* No grouping, single instance for a system */
 	uncore->pmus = kzalloc(sizeof(*uncore->pmus), GFP_KERNEL);
-	if (!uncore->pmus) {
-		uncore->num_pmus = 0;
+	if (!uncore->pmus)
 		goto done;
-	}
 
 	/*
 	 * For Family 17h and above, the Northbridge counters are repurposed
@@ -674,7 +681,7 @@
 	pmu = &uncore->pmus[0];
 	strscpy(pmu->name, boot_cpu_data.x86 >= 0x17 ? "amd_df" : "amd_nb",
 		sizeof(pmu->name));
-	pmu->num_counters = amd_uncore_ctx_num_pmcs(uncore, cpu);
+	pmu->num_counters = num_counters;
 	pmu->msr_base = MSR_F15H_NB_PERF_CTL;
 	pmu->rdpmc_base = RDPMC_BASE_NB;
 	pmu->group = amd_uncore_ctx_gid(uncore, cpu);
@@ -785,17 +792,20 @@
 {
 	struct attribute **l3_attr = amd_uncore_l3_format_attr;
 	struct amd_uncore_pmu *pmu;
+	int num_counters;
 
 	/* Run just once */
 	if (uncore->init_done)
 		return amd_uncore_ctx_init(uncore, cpu);
 
+	num_counters = amd_uncore_ctx_num_pmcs(uncore, cpu);
+	if (!num_counters)
+		goto done;
+
 	/* No grouping, single instance for a system */
 	uncore->pmus = kzalloc(sizeof(*uncore->pmus), GFP_KERNEL);
-	if (!uncore->pmus) {
-		uncore->num_pmus = 0;
+	if (!uncore->pmus)
 		goto done;
-	}
 
 	/*
 	 * For Family 17h and above, L3 cache counters are available instead
@@ -805,7 +815,7 @@
 	pmu = &uncore->pmus[0];
 	strscpy(pmu->name, boot_cpu_data.x86 >= 0x17 ? "amd_l3" : "amd_l2",
 		sizeof(pmu->name));
-	pmu->num_counters = amd_uncore_ctx_num_pmcs(uncore, cpu);
+	pmu->num_counters = num_counters;
 	pmu->msr_base = MSR_F16H_L2I_PERF_CTL;
 	pmu->rdpmc_base = RDPMC_BASE_LLC;
 	pmu->group = amd_uncore_ctx_gid(uncore, cpu);
@@ -893,8 +903,8 @@
 	cpuid(EXT_PERFMON_DEBUG_FEATURES, &eax, &ebx.full, &ecx, &edx);
 	info.split.aux_data = ecx;	/* stash active mask */
 	info.split.num_pmcs = ebx.split.num_umc_pmc;
-	info.split.gid = topology_die_id(cpu);
-	info.split.cid = topology_die_id(cpu);
+	info.split.gid = topology_logical_package_id(cpu);
+	info.split.cid = topology_logical_package_id(cpu);
 	*per_cpu_ptr(uncore->info, cpu) = info;
 }
 
--- linux-qcom-6.8.0.orig/arch/x86/events/core.c
+++ linux-qcom-6.8.0/arch/x86/events/core.c
@@ -41,6 +41,8 @@
 #include <asm/desc.h>
 #include <asm/ldt.h>
 #include <asm/unwind.h>
+#include <asm/uprobes.h>
+#include <asm/ibt.h>
 
 #include "perf_event.h"
 
@@ -189,29 +191,31 @@
 
 #ifdef CONFIG_X86_LOCAL_APIC
 
-static inline int get_possible_num_counters(void)
+static inline u64 get_possible_counter_mask(void)
 {
-	int i, num_counters = x86_pmu.num_counters;
+	u64 cntr_mask = x86_pmu.cntr_mask64;
+	int i;
 
 	if (!is_hybrid())
-		return num_counters;
+		return cntr_mask;
 
 	for (i = 0; i < x86_pmu.num_hybrid_pmus; i++)
-		num_counters = max_t(int, num_counters, x86_pmu.hybrid_pmu[i].num_counters);
+		cntr_mask |= x86_pmu.hybrid_pmu[i].cntr_mask64;
 
-	return num_counters;
+	return cntr_mask;
 }
 
 static bool reserve_pmc_hardware(void)
 {
-	int i, num_counters = get_possible_num_counters();
+	u64 cntr_mask = get_possible_counter_mask();
+	int i, end;
 
-	for (i = 0; i < num_counters; i++) {
+	for_each_set_bit(i, (unsigned long *)&cntr_mask, X86_PMC_IDX_MAX) {
 		if (!reserve_perfctr_nmi(x86_pmu_event_addr(i)))
 			goto perfctr_fail;
 	}
 
-	for (i = 0; i < num_counters; i++) {
+	for_each_set_bit(i, (unsigned long *)&cntr_mask, X86_PMC_IDX_MAX) {
 		if (!reserve_evntsel_nmi(x86_pmu_config_addr(i)))
 			goto eventsel_fail;
 	}
@@ -219,13 +223,14 @@
 	return true;
 
 eventsel_fail:
-	for (i--; i >= 0; i--)
+	end = i;
+	for_each_set_bit(i, (unsigned long *)&cntr_mask, end)
 		release_evntsel_nmi(x86_pmu_config_addr(i));
-
-	i = num_counters;
+	i = X86_PMC_IDX_MAX;
 
 perfctr_fail:
-	for (i--; i >= 0; i--)
+	end = i;
+	for_each_set_bit(i, (unsigned long *)&cntr_mask, end)
 		release_perfctr_nmi(x86_pmu_event_addr(i));
 
 	return false;
@@ -233,9 +238,10 @@
 
 static void release_pmc_hardware(void)
 {
-	int i, num_counters = get_possible_num_counters();
+	u64 cntr_mask = get_possible_counter_mask();
+	int i;
 
-	for (i = 0; i < num_counters; i++) {
+	for_each_set_bit(i, (unsigned long *)&cntr_mask, X86_PMC_IDX_MAX) {
 		release_perfctr_nmi(x86_pmu_event_addr(i));
 		release_evntsel_nmi(x86_pmu_config_addr(i));
 	}
@@ -248,7 +254,8 @@
 
 #endif
 
-bool check_hw_exists(struct pmu *pmu, int num_counters, int num_counters_fixed)
+bool check_hw_exists(struct pmu *pmu, unsigned long *cntr_mask,
+		     unsigned long *fixed_cntr_mask)
 {
 	u64 val, val_fail = -1, val_new= ~0;
 	int i, reg, reg_fail = -1, ret = 0;
@@ -259,7 +266,7 @@
 	 * Check to see if the BIOS enabled any of the counters, if so
 	 * complain and bail.
 	 */
-	for (i = 0; i < num_counters; i++) {
+	for_each_set_bit(i, cntr_mask, X86_PMC_IDX_MAX) {
 		reg = x86_pmu_config_addr(i);
 		ret = rdmsrl_safe(reg, &val);
 		if (ret)
@@ -273,12 +280,12 @@
 		}
 	}
 
-	if (num_counters_fixed) {
+	if (*(u64 *)fixed_cntr_mask) {
 		reg = MSR_ARCH_PERFMON_FIXED_CTR_CTRL;
 		ret = rdmsrl_safe(reg, &val);
 		if (ret)
 			goto msr_fail;
-		for (i = 0; i < num_counters_fixed; i++) {
+		for_each_set_bit(i, fixed_cntr_mask, X86_PMC_IDX_MAX) {
 			if (fixed_counter_disabled(i, pmu))
 				continue;
 			if (val & (0x03ULL << i*4)) {
@@ -679,7 +686,7 @@
 	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
 	int idx;
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		struct hw_perf_event *hwc = &cpuc->events[idx]->hw;
 		u64 val;
 
@@ -736,7 +743,7 @@
 	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
 	int idx;
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		struct hw_perf_event *hwc = &cpuc->events[idx]->hw;
 
 		if (!test_bit(idx, cpuc->active_mask))
@@ -975,7 +982,6 @@
 
 int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign)
 {
-	int num_counters = hybrid(cpuc->pmu, num_counters);
 	struct event_constraint *c;
 	struct perf_event *e;
 	int n0, i, wmin, wmax, unsched = 0;
@@ -1051,7 +1057,7 @@
 
 	/* slow path */
 	if (i != n) {
-		int gpmax = num_counters;
+		int gpmax = x86_pmu_max_num_counters(cpuc->pmu);
 
 		/*
 		 * Do not allow scheduling of more than half the available
@@ -1072,7 +1078,7 @@
 		 * the extra Merge events needed by large increment events.
 		 */
 		if (x86_pmu.flags & PMU_FL_PAIR) {
-			gpmax = num_counters - cpuc->n_pair;
+			gpmax -= cpuc->n_pair;
 			WARN_ON(gpmax <= 0);
 		}
 
@@ -1157,12 +1163,10 @@
  */
 static int collect_events(struct cpu_hw_events *cpuc, struct perf_event *leader, bool dogrp)
 {
-	int num_counters = hybrid(cpuc->pmu, num_counters);
-	int num_counters_fixed = hybrid(cpuc->pmu, num_counters_fixed);
 	struct perf_event *event;
 	int n, max_count;
 
-	max_count = num_counters + num_counters_fixed;
+	max_count = x86_pmu_num_counters(cpuc->pmu) + x86_pmu_num_counters_fixed(cpuc->pmu);
 
 	/* current number of events already accepted */
 	n = cpuc->n_events;
@@ -1519,19 +1523,22 @@
 void perf_event_print_debug(void)
 {
 	u64 ctrl, status, overflow, pmc_ctrl, pmc_count, prev_left, fixed;
+	unsigned long *cntr_mask, *fixed_cntr_mask;
+	struct event_constraint *pebs_constraints;
+	struct cpu_hw_events *cpuc;
 	u64 pebs, debugctl;
-	int cpu = smp_processor_id();
-	struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu);
-	int num_counters = hybrid(cpuc->pmu, num_counters);
-	int num_counters_fixed = hybrid(cpuc->pmu, num_counters_fixed);
-	struct event_constraint *pebs_constraints = hybrid(cpuc->pmu, pebs_constraints);
-	unsigned long flags;
-	int idx;
+	int cpu, idx;
 
-	if (!num_counters)
-		return;
+	guard(irqsave)();
 
-	local_irq_save(flags);
+	cpu = smp_processor_id();
+	cpuc = &per_cpu(cpu_hw_events, cpu);
+	cntr_mask = hybrid(cpuc->pmu, cntr_mask);
+	fixed_cntr_mask = hybrid(cpuc->pmu, fixed_cntr_mask);
+	pebs_constraints = hybrid(cpuc->pmu, pebs_constraints);
+
+	if (!*(u64 *)cntr_mask)
+		return;
 
 	if (x86_pmu.version >= 2) {
 		rdmsrl(MSR_CORE_PERF_GLOBAL_CTRL, ctrl);
@@ -1555,7 +1562,7 @@
 	}
 	pr_info("CPU#%d: active:     %016llx\n", cpu, *(u64 *)cpuc->active_mask);
 
-	for (idx = 0; idx < num_counters; idx++) {
+	for_each_set_bit(idx, cntr_mask, X86_PMC_IDX_MAX) {
 		rdmsrl(x86_pmu_config_addr(idx), pmc_ctrl);
 		rdmsrl(x86_pmu_event_addr(idx), pmc_count);
 
@@ -1568,7 +1575,7 @@
 		pr_info("CPU#%d:   gen-PMC%d left:  %016llx\n",
 			cpu, idx, prev_left);
 	}
-	for (idx = 0; idx < num_counters_fixed; idx++) {
+	for_each_set_bit(idx, fixed_cntr_mask, X86_PMC_IDX_MAX) {
 		if (fixed_counter_disabled(idx, cpuc->pmu))
 			continue;
 		rdmsrl(MSR_ARCH_PERFMON_FIXED_CTR0 + idx, pmc_count);
@@ -1576,7 +1583,6 @@
 		pr_info("CPU#%d: fixed-PMC%d count: %016llx\n",
 			cpu, idx, pmc_count);
 	}
-	local_irq_restore(flags);
 }
 
 void x86_pmu_stop(struct perf_event *event, int flags)
@@ -1644,6 +1650,7 @@
 	while (++i < cpuc->n_events) {
 		cpuc->event_list[i-1] = cpuc->event_list[i];
 		cpuc->event_constraint[i-1] = cpuc->event_constraint[i];
+		cpuc->assign[i-1] = cpuc->assign[i];
 	}
 	cpuc->event_constraint[i-1] = NULL;
 	--cpuc->n_events;
@@ -1681,7 +1688,7 @@
 	 */
 	apic_write(APIC_LVTPC, APIC_DM_NMI);
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		if (!test_bit(idx, cpuc->active_mask))
 			continue;
 
@@ -2037,18 +2044,15 @@
 	static_call(x86_pmu_update)(event);
 }
 
-void x86_pmu_show_pmu_cap(int num_counters, int num_counters_fixed,
-			  u64 intel_ctrl)
+void x86_pmu_show_pmu_cap(struct pmu *pmu)
 {
 	pr_info("... version:                %d\n",     x86_pmu.version);
 	pr_info("... bit width:              %d\n",     x86_pmu.cntval_bits);
-	pr_info("... generic registers:      %d\n",     num_counters);
+	pr_info("... generic registers:      %d\n",     x86_pmu_num_counters(pmu));
 	pr_info("... value mask:             %016Lx\n", x86_pmu.cntval_mask);
 	pr_info("... max period:             %016Lx\n", x86_pmu.max_period);
-	pr_info("... fixed-purpose events:   %lu\n",
-			hweight64((((1ULL << num_counters_fixed) - 1)
-					<< INTEL_PMC_IDX_FIXED) & intel_ctrl));
-	pr_info("... event mask:             %016Lx\n", intel_ctrl);
+	pr_info("... fixed-purpose events:   %d\n",     x86_pmu_num_counters_fixed(pmu));
+	pr_info("... event mask:             %016Lx\n", hybrid(pmu, intel_ctrl));
 }
 
 static int __init init_hw_perf_events(void)
@@ -2085,7 +2089,7 @@
 	pmu_check_apic();
 
 	/* sanity check that the hardware exists or is emulated */
-	if (!check_hw_exists(&pmu, x86_pmu.num_counters, x86_pmu.num_counters_fixed))
+	if (!check_hw_exists(&pmu, x86_pmu.cntr_mask, x86_pmu.fixed_cntr_mask))
 		goto out_bad_pmu;
 
 	pr_cont("%s PMU driver.\n", x86_pmu.name);
@@ -2096,14 +2100,14 @@
 		quirk->func();
 
 	if (!x86_pmu.intel_ctrl)
-		x86_pmu.intel_ctrl = (1 << x86_pmu.num_counters) - 1;
+		x86_pmu.intel_ctrl = x86_pmu.cntr_mask64;
 
 	perf_events_lapic_init();
 	register_nmi_handler(NMI_LOCAL, perf_event_nmi_handler, 0, "PMI");
 
 	unconstrained = (struct event_constraint)
-		__EVENT_CONSTRAINT(0, (1ULL << x86_pmu.num_counters) - 1,
-				   0, x86_pmu.num_counters, 0, 0);
+		__EVENT_CONSTRAINT(0, x86_pmu.cntr_mask64,
+				   0, x86_pmu_num_counters(NULL), 0, 0);
 
 	x86_pmu_format_group.attrs = x86_pmu.format_attrs;
 
@@ -2112,11 +2116,8 @@
 
 	pmu.attr_update = x86_pmu.attr_update;
 
-	if (!is_hybrid()) {
-		x86_pmu_show_pmu_cap(x86_pmu.num_counters,
-				     x86_pmu.num_counters_fixed,
-				     x86_pmu.intel_ctrl);
-	}
+	if (!is_hybrid())
+		x86_pmu_show_pmu_cap(NULL);
 
 	if (!x86_pmu.read)
 		x86_pmu.read = _x86_pmu_read;
@@ -2480,7 +2481,7 @@
 	for_each_set_bit(i, cpuc->dirty, X86_PMC_IDX_MAX) {
 		if (i >= INTEL_PMC_IDX_FIXED) {
 			/* Metrics and fake events don't have corresponding HW counters. */
-			if ((i - INTEL_PMC_IDX_FIXED) >= hybrid(cpuc->pmu, num_counters_fixed))
+			if (!test_bit(i - INTEL_PMC_IDX_FIXED, hybrid(cpuc->pmu, fixed_cntr_mask)))
 				continue;
 
 			wrmsrl(MSR_ARCH_PERFMON_FIXED_CTR0 + (i - INTEL_PMC_IDX_FIXED), 0);
@@ -2546,6 +2547,7 @@
 			      struct device_attribute *attr,
 			      const char *buf, size_t count)
 {
+	static DEFINE_MUTEX(rdpmc_mutex);
 	unsigned long val;
 	ssize_t ret;
 
@@ -2559,6 +2561,8 @@
 	if (x86_pmu.attr_rdpmc_broken)
 		return -ENOTSUPP;
 
+	guard(mutex)(&rdpmc_mutex);
+
 	if (val != x86_pmu.attr_rdpmc) {
 		/*
 		 * Changing into or out of never available or always available,
@@ -2812,6 +2816,46 @@
 	return get_desc_base(desc);
 }
 
+#ifdef CONFIG_UPROBES
+/*
+ * Heuristic-based check if uprobe is installed at the function entry.
+ *
+ * Under assumption of user code being compiled with frame pointers,
+ * `push %rbp/%ebp` is a good indicator that we indeed are.
+ *
+ * Similarly, `endbr64` (assuming 64-bit mode) is also a common pattern.
+ * If we get this wrong, captured stack trace might have one extra bogus
+ * entry, but the rest of stack trace will still be meaningful.
+ */
+static bool is_uprobe_at_func_entry(struct pt_regs *regs)
+{
+	struct arch_uprobe *auprobe;
+
+	if (!current->utask)
+		return false;
+
+	auprobe = current->utask->auprobe;
+	if (!auprobe)
+		return false;
+
+	/* push %rbp/%ebp */
+	if (auprobe->insn[0] == 0x55)
+		return true;
+
+	/* endbr64 (64-bit only) */
+	if (user_64bit_mode(regs) && is_endbr(*(u32 *)auprobe->insn))
+		return true;
+
+	return false;
+}
+
+#else
+static bool is_uprobe_at_func_entry(struct pt_regs *regs)
+{
+	return false;
+}
+#endif /* CONFIG_UPROBES */
+
 #ifdef CONFIG_IA32_EMULATION
 
 #include <linux/compat.h>
@@ -2823,6 +2867,7 @@
 	unsigned long ss_base, cs_base;
 	struct stack_frame_ia32 frame;
 	const struct stack_frame_ia32 __user *fp;
+	u32 ret_addr;
 
 	if (user_64bit_mode(regs))
 		return 0;
@@ -2832,6 +2877,12 @@
 
 	fp = compat_ptr(ss_base + regs->bp);
 	pagefault_disable();
+
+	/* see perf_callchain_user() below for why we do this */
+	if (is_uprobe_at_func_entry(regs) &&
+	    !get_user(ret_addr, (const u32 __user *)regs->sp))
+		perf_callchain_store(entry, ret_addr);
+
 	while (entry->nr < entry->max_stack) {
 		if (!valid_user_frame(fp, sizeof(frame)))
 			break;
@@ -2860,6 +2911,7 @@
 {
 	struct stack_frame frame;
 	const struct stack_frame __user *fp;
+	unsigned long ret_addr;
 
 	if (perf_guest_state()) {
 		/* TODO: We don't support guest os callchain now */
@@ -2883,6 +2935,19 @@
 		return;
 
 	pagefault_disable();
+
+	/*
+	 * If we are called from uprobe handler, and we are indeed at the very
+	 * entry to user function (which is normally a `push %rbp` instruction,
+	 * under assumption of application being compiled with frame pointers),
+	 * we should read return address from *regs->sp before proceeding
+	 * to follow frame pointers, otherwise we'll skip immediate caller
+	 * as %rbp is not yet setup.
+	 */
+	if (is_uprobe_at_func_entry(regs) &&
+	    !get_user(ret_addr, (const unsigned long __user *)regs->sp))
+		perf_callchain_store(entry, ret_addr);
+
 	while (entry->nr < entry->max_stack) {
 		if (!valid_user_frame(fp, sizeof(frame)))
 			break;
@@ -2982,8 +3047,8 @@
 	 * base PMU holds the correct number of counters for P-cores.
 	 */
 	cap->version		= x86_pmu.version;
-	cap->num_counters_gp	= x86_pmu.num_counters;
-	cap->num_counters_fixed	= x86_pmu.num_counters_fixed;
+	cap->num_counters_gp	= x86_pmu_num_counters(NULL);
+	cap->num_counters_fixed	= x86_pmu_num_counters_fixed(NULL);
 	cap->bit_width_gp	= x86_pmu.cntval_bits;
 	cap->bit_width_fixed	= x86_pmu.cntval_bits;
 	cap->events_mask	= (unsigned int)x86_pmu.events_maskl;
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/core.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/core.c
@@ -2873,23 +2873,23 @@
 {
 	struct debug_store *ds = __this_cpu_read(cpu_hw_events.ds);
 	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
-	int num_counters_fixed = hybrid(cpuc->pmu, num_counters_fixed);
-	int num_counters = hybrid(cpuc->pmu, num_counters);
+	unsigned long *cntr_mask = hybrid(cpuc->pmu, cntr_mask);
+	unsigned long *fixed_cntr_mask = hybrid(cpuc->pmu, fixed_cntr_mask);
 	unsigned long flags;
 	int idx;
 
-	if (!num_counters)
+	if (!*(u64 *)cntr_mask)
 		return;
 
 	local_irq_save(flags);
 
 	pr_info("clearing PMU state on CPU#%d\n", smp_processor_id());
 
-	for (idx = 0; idx < num_counters; idx++) {
+	for_each_set_bit(idx, cntr_mask, INTEL_PMC_MAX_GENERIC) {
 		wrmsrl_safe(x86_pmu_config_addr(idx), 0ull);
 		wrmsrl_safe(x86_pmu_event_addr(idx),  0ull);
 	}
-	for (idx = 0; idx < num_counters_fixed; idx++) {
+	for_each_set_bit(idx, fixed_cntr_mask, INTEL_PMC_MAX_FIXED) {
 		if (fixed_counter_disabled(idx, cpuc->pmu))
 			continue;
 		wrmsrl_safe(MSR_ARCH_PERFMON_FIXED_CTR0 + idx, 0ull);
@@ -2939,8 +2939,7 @@
 	    !guest_pebs_idxs)
 		return;
 
-	for_each_set_bit(bit, (unsigned long *)&guest_pebs_idxs,
-			 INTEL_PMC_IDX_FIXED + x86_pmu.num_counters_fixed) {
+	for_each_set_bit(bit, (unsigned long *)&guest_pebs_idxs, X86_PMC_IDX_MAX) {
 		event = cpuc->events[bit];
 		if (!event->attr.precise_ip)
 			continue;
@@ -3912,8 +3911,12 @@
 			x86_pmu.pebs_aliases(event);
 	}
 
-	if (needs_branch_stack(event) && is_sampling_event(event))
-		event->hw.flags  |= PERF_X86_EVENT_NEEDS_BRANCH_STACK;
+	if (needs_branch_stack(event)) {
+		/* Avoid branch stack setup for counting events in SAMPLE READ */
+		if (is_sampling_event(event) ||
+		    !(event->attr.sample_type & PERF_SAMPLE_READ))
+			event->hw.flags |= PERF_X86_EVENT_NEEDS_BRANCH_STACK;
+	}
 
 	if (branch_sample_counters(event)) {
 		struct perf_event *leader, *sibling;
@@ -4198,7 +4201,7 @@
 	struct perf_guest_switch_msr *arr = cpuc->guest_switch_msrs;
 	int idx;
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++)  {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		struct perf_event *event = cpuc->events[idx];
 
 		arr[idx].msr = x86_pmu_config_addr(idx);
@@ -4216,7 +4219,7 @@
 			arr[idx].guest &= ~ARCH_PERFMON_EVENTSEL_ENABLE;
 	}
 
-	*nr = x86_pmu.num_counters;
+	*nr = x86_pmu_max_num_counters(cpuc->pmu);
 	return arr;
 }
 
@@ -4231,7 +4234,7 @@
 	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
 	int idx;
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		struct hw_perf_event *hwc = &cpuc->events[idx]->hw;
 
 		if (!test_bit(idx, cpuc->active_mask) ||
@@ -4529,6 +4532,25 @@
 	return HYBRID_INTEL_CORE;
 }
 
+static inline bool erratum_hsw11(struct perf_event *event)
+{
+	return (event->hw.config & INTEL_ARCH_EVENT_MASK) ==
+		X86_CONFIG(.event=0xc0, .umask=0x01);
+}
+
+/*
+ * The HSW11 requires a period larger than 100 which is the same as the BDM11.
+ * A minimum period of 128 is enforced as well for the INST_RETIRED.ALL.
+ *
+ * The message 'interrupt took too long' can be observed on any counter which
+ * was armed with a period < 32 and two events expired in the same NMI.
+ * A minimum period of 32 is enforced for the rest of the events.
+ */
+static void hsw_limit_period(struct perf_event *event, s64 *left)
+{
+	*left = max(*left, erratum_hsw11(event) ? 128 : 32);
+}
+
 /*
  * Broadwell:
  *
@@ -4546,8 +4568,7 @@
  */
 static void bdw_limit_period(struct perf_event *event, s64 *left)
 {
-	if ((event->hw.config & INTEL_ARCH_EVENT_MASK) ==
-			X86_CONFIG(.event=0xc0, .umask=0x01)) {
+	if (erratum_hsw11(event)) {
 		if (*left < 128)
 			*left = 128;
 		*left &= ~0x3fULL;
@@ -4683,13 +4704,33 @@
 	}
 }
 
-static void intel_pmu_check_num_counters(int *num_counters,
-					 int *num_counters_fixed,
-					 u64 *intel_ctrl, u64 fixed_mask);
+static void intel_pmu_check_counters_mask(u64 *cntr_mask,
+					  u64 *fixed_cntr_mask,
+					  u64 *intel_ctrl)
+{
+	unsigned int bit;
+
+	bit = fls64(*cntr_mask);
+	if (bit > INTEL_PMC_MAX_GENERIC) {
+		WARN(1, KERN_ERR "hw perf events %d > max(%d), clipping!",
+		     bit, INTEL_PMC_MAX_GENERIC);
+		*cntr_mask &= GENMASK_ULL(INTEL_PMC_MAX_GENERIC - 1, 0);
+	}
+	*intel_ctrl = *cntr_mask;
+
+	bit = fls64(*fixed_cntr_mask);
+	if (bit > INTEL_PMC_MAX_FIXED) {
+		WARN(1, KERN_ERR "hw perf events fixed %d > max(%d), clipping!",
+		     bit, INTEL_PMC_MAX_FIXED);
+		*fixed_cntr_mask &= GENMASK_ULL(INTEL_PMC_MAX_FIXED - 1, 0);
+	}
+
+	*intel_ctrl |= *fixed_cntr_mask << INTEL_PMC_IDX_FIXED;
+}
 
 static void intel_pmu_check_event_constraints(struct event_constraint *event_constraints,
-					      int num_counters,
-					      int num_counters_fixed,
+					      u64 cntr_mask,
+					      u64 fixed_cntr_mask,
 					      u64 intel_ctrl);
 
 static void intel_pmu_check_extra_regs(struct extra_reg *extra_regs);
@@ -4697,8 +4738,8 @@
 static inline bool intel_pmu_broken_perf_cap(void)
 {
 	/* The Perf Metric (Bit 15) is always cleared */
-	if ((boot_cpu_data.x86_model == INTEL_FAM6_METEORLAKE) ||
-	    (boot_cpu_data.x86_model == INTEL_FAM6_METEORLAKE_L))
+	if (boot_cpu_data.x86_vfm == INTEL_METEORLAKE ||
+	    boot_cpu_data.x86_vfm == INTEL_METEORLAKE_L)
 		return true;
 
 	return false;
@@ -4712,11 +4753,10 @@
 	if (sub_bitmaps & ARCH_PERFMON_NUM_COUNTER_LEAF_BIT) {
 		cpuid_count(ARCH_PERFMON_EXT_LEAF, ARCH_PERFMON_NUM_COUNTER_LEAF,
 			    &eax, &ebx, &ecx, &edx);
-		pmu->num_counters = fls(eax);
-		pmu->num_counters_fixed = fls(ebx);
+		pmu->cntr_mask64 = eax;
+		pmu->fixed_cntr_mask64 = ebx;
 	}
 
-
 	if (!intel_pmu_broken_perf_cap()) {
 		/* Perf Metric (Bit 15) and PEBS via PT (Bit 16) are hybrid enumeration */
 		rdmsrl(MSR_IA32_PERF_CAPABILITIES, pmu->intel_cap.capabilities);
@@ -4725,12 +4765,12 @@
 
 static void intel_pmu_check_hybrid_pmus(struct x86_hybrid_pmu *pmu)
 {
-	intel_pmu_check_num_counters(&pmu->num_counters, &pmu->num_counters_fixed,
-				     &pmu->intel_ctrl, (1ULL << pmu->num_counters_fixed) - 1);
-	pmu->max_pebs_events = min_t(unsigned, MAX_PEBS_EVENTS, pmu->num_counters);
+	intel_pmu_check_counters_mask(&pmu->cntr_mask64, &pmu->fixed_cntr_mask64,
+				      &pmu->intel_ctrl);
+	pmu->pebs_events_mask = intel_pmu_pebs_mask(pmu->cntr_mask64);
 	pmu->unconstrained = (struct event_constraint)
-			     __EVENT_CONSTRAINT(0, (1ULL << pmu->num_counters) - 1,
-						0, pmu->num_counters, 0, 0);
+			     __EVENT_CONSTRAINT(0, pmu->cntr_mask64,
+						0, x86_pmu_num_counters(&pmu->pmu), 0, 0);
 
 	if (pmu->intel_cap.perf_metrics)
 		pmu->intel_ctrl |= 1ULL << GLOBAL_CTRL_EN_PERF_METRICS;
@@ -4743,8 +4783,8 @@
 		pmu->pmu.capabilities &= ~PERF_PMU_CAP_AUX_OUTPUT;
 
 	intel_pmu_check_event_constraints(pmu->event_constraints,
-					  pmu->num_counters,
-					  pmu->num_counters_fixed,
+					  pmu->cntr_mask64,
+					  pmu->fixed_cntr_mask64,
 					  pmu->intel_ctrl);
 
 	intel_pmu_check_extra_regs(pmu->extra_regs);
@@ -4805,7 +4845,7 @@
 
 	intel_pmu_check_hybrid_pmus(pmu);
 
-	if (!check_hw_exists(&pmu->pmu, pmu->num_counters, pmu->num_counters_fixed))
+	if (!check_hw_exists(&pmu->pmu, pmu->cntr_mask, pmu->fixed_cntr_mask))
 		return false;
 
 	pr_info("%s PMU driver: ", pmu->name);
@@ -4815,8 +4855,7 @@
 
 	pr_cont("\n");
 
-	x86_pmu_show_pmu_cap(pmu->num_counters, pmu->num_counters_fixed,
-			     pmu->intel_ctrl);
+	x86_pmu_show_pmu_cap(&pmu->pmu);
 
 end:
 	cpumask_set_cpu(cpu, &pmu->supported_cpus);
@@ -5704,8 +5743,22 @@
 	return x86_pmu.version >= 2 ? attr->mode : 0;
 }
 
+static umode_t
+td_is_visible(struct kobject *kobj, struct attribute *attr, int i)
+{
+	/*
+	 * Hide the perf metrics topdown events
+	 * if the feature is not enumerated.
+	 */
+	if (x86_pmu.num_topdown_events)
+		return x86_pmu.intel_cap.perf_metrics ? attr->mode : 0;
+
+	return attr->mode;
+}
+
 static struct attribute_group group_events_td  = {
 	.name = "events",
+	.is_visible = td_is_visible,
 };
 
 static struct attribute_group group_events_mem = {
@@ -5907,9 +5960,27 @@
 	return (cpu >= 0) && (pmu->pmu_type & pmu_attr->pmu_type) ? attr->mode : 0;
 }
 
+static umode_t hybrid_td_is_visible(struct kobject *kobj,
+				    struct attribute *attr, int i)
+{
+	struct device *dev = kobj_to_dev(kobj);
+	struct x86_hybrid_pmu *pmu =
+		 container_of(dev_get_drvdata(dev), struct x86_hybrid_pmu, pmu);
+
+	if (!is_attr_for_this_pmu(kobj, attr))
+		return 0;
+
+
+	/* Only the big core supports perf metrics */
+	if (pmu->pmu_type == hybrid_big)
+		return pmu->intel_cap.perf_metrics ? attr->mode : 0;
+
+	return attr->mode;
+}
+
 static struct attribute_group hybrid_group_events_td  = {
 	.name		= "events",
-	.is_visible	= hybrid_events_is_visible,
+	.is_visible	= hybrid_td_is_visible,
 };
 
 static struct attribute_group hybrid_group_events_mem = {
@@ -5961,29 +6032,9 @@
 
 static struct attribute *empty_attrs;
 
-static void intel_pmu_check_num_counters(int *num_counters,
-					 int *num_counters_fixed,
-					 u64 *intel_ctrl, u64 fixed_mask)
-{
-	if (*num_counters > INTEL_PMC_MAX_GENERIC) {
-		WARN(1, KERN_ERR "hw perf events %d > max(%d), clipping!",
-		     *num_counters, INTEL_PMC_MAX_GENERIC);
-		*num_counters = INTEL_PMC_MAX_GENERIC;
-	}
-	*intel_ctrl = (1ULL << *num_counters) - 1;
-
-	if (*num_counters_fixed > INTEL_PMC_MAX_FIXED) {
-		WARN(1, KERN_ERR "hw perf events fixed %d > max(%d), clipping!",
-		     *num_counters_fixed, INTEL_PMC_MAX_FIXED);
-		*num_counters_fixed = INTEL_PMC_MAX_FIXED;
-	}
-
-	*intel_ctrl |= fixed_mask << INTEL_PMC_IDX_FIXED;
-}
-
 static void intel_pmu_check_event_constraints(struct event_constraint *event_constraints,
-					      int num_counters,
-					      int num_counters_fixed,
+					      u64 cntr_mask,
+					      u64 fixed_cntr_mask,
 					      u64 intel_ctrl)
 {
 	struct event_constraint *c;
@@ -6020,10 +6071,9 @@
 			 * generic counters
 			 */
 			if (!use_fixed_pseudo_encoding(c->code))
-				c->idxmsk64 |= (1ULL << num_counters) - 1;
+				c->idxmsk64 |= cntr_mask;
 		}
-		c->idxmsk64 &=
-			~(~0ULL << (INTEL_PMC_IDX_FIXED + num_counters_fixed));
+		c->idxmsk64 &= cntr_mask | (fixed_cntr_mask << INTEL_PMC_IDX_FIXED);
 		c->weight = hweight64(c->idxmsk64);
 	}
 }
@@ -6074,12 +6124,12 @@
 		pmu->pmu_type = intel_hybrid_pmu_type_map[bit].id;
 		pmu->name = intel_hybrid_pmu_type_map[bit].name;
 
-		pmu->num_counters = x86_pmu.num_counters;
-		pmu->num_counters_fixed = x86_pmu.num_counters_fixed;
-		pmu->max_pebs_events = min_t(unsigned, MAX_PEBS_EVENTS, pmu->num_counters);
+		pmu->cntr_mask64 = x86_pmu.cntr_mask64;
+		pmu->fixed_cntr_mask64 = x86_pmu.fixed_cntr_mask64;
+		pmu->pebs_events_mask = intel_pmu_pebs_mask(pmu->cntr_mask64);
 		pmu->unconstrained = (struct event_constraint)
-				     __EVENT_CONSTRAINT(0, (1ULL << pmu->num_counters) - 1,
-							0, pmu->num_counters, 0, 0);
+				     __EVENT_CONSTRAINT(0, pmu->cntr_mask64,
+							0, x86_pmu_num_counters(&pmu->pmu), 0, 0);
 
 		pmu->intel_cap.capabilities = x86_pmu.intel_cap.capabilities;
 		if (pmu->pmu_type & hybrid_small) {
@@ -6192,14 +6242,14 @@
 		x86_pmu = intel_pmu;
 
 	x86_pmu.version			= version;
-	x86_pmu.num_counters		= eax.split.num_counters;
+	x86_pmu.cntr_mask64		= GENMASK_ULL(eax.split.num_counters - 1, 0);
 	x86_pmu.cntval_bits		= eax.split.bit_width;
 	x86_pmu.cntval_mask		= (1ULL << eax.split.bit_width) - 1;
 
 	x86_pmu.events_maskl		= ebx.full;
 	x86_pmu.events_mask_len		= eax.split.mask_length;
 
-	x86_pmu.max_pebs_events		= min_t(unsigned, MAX_PEBS_EVENTS, x86_pmu.num_counters);
+	x86_pmu.pebs_events_mask	= intel_pmu_pebs_mask(x86_pmu.cntr_mask64);
 	x86_pmu.pebs_capable		= PEBS_COUNTER_MASK;
 
 	/*
@@ -6209,12 +6259,10 @@
 	if (version > 1 && version < 5) {
 		int assume = 3 * !boot_cpu_has(X86_FEATURE_HYPERVISOR);
 
-		x86_pmu.num_counters_fixed =
-			max((int)edx.split.num_counters_fixed, assume);
-
-		fixed_mask = (1L << x86_pmu.num_counters_fixed) - 1;
+		x86_pmu.fixed_cntr_mask64 =
+			GENMASK_ULL(max((int)edx.split.num_counters_fixed, assume) - 1, 0);
 	} else if (version >= 5)
-		x86_pmu.num_counters_fixed = fls(fixed_mask);
+		x86_pmu.fixed_cntr_mask64 = fixed_mask;
 
 	if (boot_cpu_has(X86_FEATURE_PDCM)) {
 		u64 capabilities;
@@ -6244,19 +6292,19 @@
 	/*
 	 * Install the hw-cache-events table:
 	 */
-	switch (boot_cpu_data.x86_model) {
-	case INTEL_FAM6_CORE_YONAH:
+	switch (boot_cpu_data.x86_vfm) {
+	case INTEL_CORE_YONAH:
 		pr_cont("Core events, ");
 		name = "core";
 		break;
 
-	case INTEL_FAM6_CORE2_MEROM:
+	case INTEL_CORE2_MEROM:
 		x86_add_quirk(intel_clovertown_quirk);
 		fallthrough;
 
-	case INTEL_FAM6_CORE2_MEROM_L:
-	case INTEL_FAM6_CORE2_PENRYN:
-	case INTEL_FAM6_CORE2_DUNNINGTON:
+	case INTEL_CORE2_MEROM_L:
+	case INTEL_CORE2_PENRYN:
+	case INTEL_CORE2_DUNNINGTON:
 		memcpy(hw_cache_event_ids, core2_hw_cache_event_ids,
 		       sizeof(hw_cache_event_ids));
 
@@ -6268,9 +6316,9 @@
 		name = "core2";
 		break;
 
-	case INTEL_FAM6_NEHALEM:
-	case INTEL_FAM6_NEHALEM_EP:
-	case INTEL_FAM6_NEHALEM_EX:
+	case INTEL_NEHALEM:
+	case INTEL_NEHALEM_EP:
+	case INTEL_NEHALEM_EX:
 		memcpy(hw_cache_event_ids, nehalem_hw_cache_event_ids,
 		       sizeof(hw_cache_event_ids));
 		memcpy(hw_cache_extra_regs, nehalem_hw_cache_extra_regs,
@@ -6302,11 +6350,11 @@
 		name = "nehalem";
 		break;
 
-	case INTEL_FAM6_ATOM_BONNELL:
-	case INTEL_FAM6_ATOM_BONNELL_MID:
-	case INTEL_FAM6_ATOM_SALTWELL:
-	case INTEL_FAM6_ATOM_SALTWELL_MID:
-	case INTEL_FAM6_ATOM_SALTWELL_TABLET:
+	case INTEL_ATOM_BONNELL:
+	case INTEL_ATOM_BONNELL_MID:
+	case INTEL_ATOM_SALTWELL:
+	case INTEL_ATOM_SALTWELL_MID:
+	case INTEL_ATOM_SALTWELL_TABLET:
 		memcpy(hw_cache_event_ids, atom_hw_cache_event_ids,
 		       sizeof(hw_cache_event_ids));
 
@@ -6319,11 +6367,11 @@
 		name = "bonnell";
 		break;
 
-	case INTEL_FAM6_ATOM_SILVERMONT:
-	case INTEL_FAM6_ATOM_SILVERMONT_D:
-	case INTEL_FAM6_ATOM_SILVERMONT_MID:
-	case INTEL_FAM6_ATOM_AIRMONT:
-	case INTEL_FAM6_ATOM_AIRMONT_MID:
+	case INTEL_ATOM_SILVERMONT:
+	case INTEL_ATOM_SILVERMONT_D:
+	case INTEL_ATOM_SILVERMONT_MID:
+	case INTEL_ATOM_AIRMONT:
+	case INTEL_ATOM_AIRMONT_MID:
 		memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
 			sizeof(hw_cache_event_ids));
 		memcpy(hw_cache_extra_regs, slm_hw_cache_extra_regs,
@@ -6341,8 +6389,8 @@
 		name = "silvermont";
 		break;
 
-	case INTEL_FAM6_ATOM_GOLDMONT:
-	case INTEL_FAM6_ATOM_GOLDMONT_D:
+	case INTEL_ATOM_GOLDMONT:
+	case INTEL_ATOM_GOLDMONT_D:
 		memcpy(hw_cache_event_ids, glm_hw_cache_event_ids,
 		       sizeof(hw_cache_event_ids));
 		memcpy(hw_cache_extra_regs, glm_hw_cache_extra_regs,
@@ -6368,7 +6416,7 @@
 		name = "goldmont";
 		break;
 
-	case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+	case INTEL_ATOM_GOLDMONT_PLUS:
 		memcpy(hw_cache_event_ids, glp_hw_cache_event_ids,
 		       sizeof(hw_cache_event_ids));
 		memcpy(hw_cache_extra_regs, glp_hw_cache_extra_regs,
@@ -6397,9 +6445,9 @@
 		name = "goldmont_plus";
 		break;
 
-	case INTEL_FAM6_ATOM_TREMONT_D:
-	case INTEL_FAM6_ATOM_TREMONT:
-	case INTEL_FAM6_ATOM_TREMONT_L:
+	case INTEL_ATOM_TREMONT_D:
+	case INTEL_ATOM_TREMONT:
+	case INTEL_ATOM_TREMONT_L:
 		x86_pmu.late_ack = true;
 		memcpy(hw_cache_event_ids, glp_hw_cache_event_ids,
 		       sizeof(hw_cache_event_ids));
@@ -6426,7 +6474,7 @@
 		name = "Tremont";
 		break;
 
-	case INTEL_FAM6_ATOM_GRACEMONT:
+	case INTEL_ATOM_GRACEMONT:
 		intel_pmu_init_grt(NULL);
 		intel_pmu_pebs_data_source_grt();
 		x86_pmu.pebs_latency_data = adl_latency_data_small;
@@ -6438,8 +6486,8 @@
 		name = "gracemont";
 		break;
 
-	case INTEL_FAM6_ATOM_CRESTMONT:
-	case INTEL_FAM6_ATOM_CRESTMONT_X:
+	case INTEL_ATOM_CRESTMONT:
+	case INTEL_ATOM_CRESTMONT_X:
 		intel_pmu_init_grt(NULL);
 		x86_pmu.extra_regs = intel_cmt_extra_regs;
 		intel_pmu_pebs_data_source_cmt();
@@ -6452,9 +6500,9 @@
 		name = "crestmont";
 		break;
 
-	case INTEL_FAM6_WESTMERE:
-	case INTEL_FAM6_WESTMERE_EP:
-	case INTEL_FAM6_WESTMERE_EX:
+	case INTEL_WESTMERE:
+	case INTEL_WESTMERE_EP:
+	case INTEL_WESTMERE_EX:
 		memcpy(hw_cache_event_ids, westmere_hw_cache_event_ids,
 		       sizeof(hw_cache_event_ids));
 		memcpy(hw_cache_extra_regs, nehalem_hw_cache_extra_regs,
@@ -6483,8 +6531,8 @@
 		name = "westmere";
 		break;
 
-	case INTEL_FAM6_SANDYBRIDGE:
-	case INTEL_FAM6_SANDYBRIDGE_X:
+	case INTEL_SANDYBRIDGE:
+	case INTEL_SANDYBRIDGE_X:
 		x86_add_quirk(intel_sandybridge_quirk);
 		x86_add_quirk(intel_ht_bug);
 		memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
@@ -6497,7 +6545,7 @@
 		x86_pmu.event_constraints = intel_snb_event_constraints;
 		x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints;
 		x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
-		if (boot_cpu_data.x86_model == INTEL_FAM6_SANDYBRIDGE_X)
+		if (boot_cpu_data.x86_vfm == INTEL_SANDYBRIDGE_X)
 			x86_pmu.extra_regs = intel_snbep_extra_regs;
 		else
 			x86_pmu.extra_regs = intel_snb_extra_regs;
@@ -6523,8 +6571,8 @@
 		name = "sandybridge";
 		break;
 
-	case INTEL_FAM6_IVYBRIDGE:
-	case INTEL_FAM6_IVYBRIDGE_X:
+	case INTEL_IVYBRIDGE:
+	case INTEL_IVYBRIDGE_X:
 		x86_add_quirk(intel_ht_bug);
 		memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
 		       sizeof(hw_cache_event_ids));
@@ -6540,7 +6588,7 @@
 		x86_pmu.pebs_constraints = intel_ivb_pebs_event_constraints;
 		x86_pmu.pebs_aliases = intel_pebs_aliases_ivb;
 		x86_pmu.pebs_prec_dist = true;
-		if (boot_cpu_data.x86_model == INTEL_FAM6_IVYBRIDGE_X)
+		if (boot_cpu_data.x86_vfm == INTEL_IVYBRIDGE_X)
 			x86_pmu.extra_regs = intel_snbep_extra_regs;
 		else
 			x86_pmu.extra_regs = intel_snb_extra_regs;
@@ -6562,10 +6610,10 @@
 		break;
 
 
-	case INTEL_FAM6_HASWELL:
-	case INTEL_FAM6_HASWELL_X:
-	case INTEL_FAM6_HASWELL_L:
-	case INTEL_FAM6_HASWELL_G:
+	case INTEL_HASWELL:
+	case INTEL_HASWELL_X:
+	case INTEL_HASWELL_L:
+	case INTEL_HASWELL_G:
 		x86_add_quirk(intel_ht_bug);
 		x86_add_quirk(intel_pebs_isolation_quirk);
 		x86_pmu.late_ack = true;
@@ -6585,6 +6633,7 @@
 
 		x86_pmu.hw_config = hsw_hw_config;
 		x86_pmu.get_event_constraints = hsw_get_event_constraints;
+		x86_pmu.limit_period = hsw_limit_period;
 		x86_pmu.lbr_double_abort = true;
 		extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
 			hsw_format_attr : nhm_format_attr;
@@ -6595,10 +6644,10 @@
 		name = "haswell";
 		break;
 
-	case INTEL_FAM6_BROADWELL:
-	case INTEL_FAM6_BROADWELL_D:
-	case INTEL_FAM6_BROADWELL_G:
-	case INTEL_FAM6_BROADWELL_X:
+	case INTEL_BROADWELL:
+	case INTEL_BROADWELL_D:
+	case INTEL_BROADWELL_G:
+	case INTEL_BROADWELL_X:
 		x86_add_quirk(intel_pebs_isolation_quirk);
 		x86_pmu.late_ack = true;
 		memcpy(hw_cache_event_ids, hsw_hw_cache_event_ids, sizeof(hw_cache_event_ids));
@@ -6637,8 +6686,8 @@
 		name = "broadwell";
 		break;
 
-	case INTEL_FAM6_XEON_PHI_KNL:
-	case INTEL_FAM6_XEON_PHI_KNM:
+	case INTEL_XEON_PHI_KNL:
+	case INTEL_XEON_PHI_KNM:
 		memcpy(hw_cache_event_ids,
 		       slm_hw_cache_event_ids, sizeof(hw_cache_event_ids));
 		memcpy(hw_cache_extra_regs,
@@ -6657,15 +6706,15 @@
 		name = "knights-landing";
 		break;
 
-	case INTEL_FAM6_SKYLAKE_X:
+	case INTEL_SKYLAKE_X:
 		pmem = true;
 		fallthrough;
-	case INTEL_FAM6_SKYLAKE_L:
-	case INTEL_FAM6_SKYLAKE:
-	case INTEL_FAM6_KABYLAKE_L:
-	case INTEL_FAM6_KABYLAKE:
-	case INTEL_FAM6_COMETLAKE_L:
-	case INTEL_FAM6_COMETLAKE:
+	case INTEL_SKYLAKE_L:
+	case INTEL_SKYLAKE:
+	case INTEL_KABYLAKE_L:
+	case INTEL_KABYLAKE:
+	case INTEL_COMETLAKE_L:
+	case INTEL_COMETLAKE:
 		x86_add_quirk(intel_pebs_isolation_quirk);
 		x86_pmu.late_ack = true;
 		memcpy(hw_cache_event_ids, skl_hw_cache_event_ids, sizeof(hw_cache_event_ids));
@@ -6714,16 +6763,16 @@
 		name = "skylake";
 		break;
 
-	case INTEL_FAM6_ICELAKE_X:
-	case INTEL_FAM6_ICELAKE_D:
+	case INTEL_ICELAKE_X:
+	case INTEL_ICELAKE_D:
 		x86_pmu.pebs_ept = 1;
 		pmem = true;
 		fallthrough;
-	case INTEL_FAM6_ICELAKE_L:
-	case INTEL_FAM6_ICELAKE:
-	case INTEL_FAM6_TIGERLAKE_L:
-	case INTEL_FAM6_TIGERLAKE:
-	case INTEL_FAM6_ROCKETLAKE:
+	case INTEL_ICELAKE_L:
+	case INTEL_ICELAKE:
+	case INTEL_TIGERLAKE_L:
+	case INTEL_TIGERLAKE:
+	case INTEL_ROCKETLAKE:
 		x86_pmu.late_ack = true;
 		memcpy(hw_cache_event_ids, skl_hw_cache_event_ids, sizeof(hw_cache_event_ids));
 		memcpy(hw_cache_extra_regs, skl_hw_cache_extra_regs, sizeof(hw_cache_extra_regs));
@@ -6758,16 +6807,22 @@
 		name = "icelake";
 		break;
 
-	case INTEL_FAM6_SAPPHIRERAPIDS_X:
-	case INTEL_FAM6_EMERALDRAPIDS_X:
+	case INTEL_SAPPHIRERAPIDS_X:
+	case INTEL_EMERALDRAPIDS_X:
 		x86_pmu.flags |= PMU_FL_MEM_LOADS_AUX;
 		x86_pmu.extra_regs = intel_glc_extra_regs;
-		fallthrough;
-	case INTEL_FAM6_GRANITERAPIDS_X:
-	case INTEL_FAM6_GRANITERAPIDS_D:
+		pr_cont("Sapphire Rapids events, ");
+		name = "sapphire_rapids";
+		goto glc_common;
+
+	case INTEL_GRANITERAPIDS_X:
+	case INTEL_GRANITERAPIDS_D:
+		x86_pmu.extra_regs = intel_rwc_extra_regs;
+		pr_cont("Granite Rapids events, ");
+		name = "granite_rapids";
+
+	glc_common:
 		intel_pmu_init_glc(NULL);
-		if (!x86_pmu.extra_regs)
-			x86_pmu.extra_regs = intel_rwc_extra_regs;
 		x86_pmu.pebs_ept = 1;
 		x86_pmu.hw_config = hsw_hw_config;
 		x86_pmu.get_event_constraints = glc_get_event_constraints;
@@ -6778,15 +6833,13 @@
 		td_attr = glc_td_events_attrs;
 		tsx_attr = glc_tsx_events_attrs;
 		intel_pmu_pebs_data_source_skl(true);
-		pr_cont("Sapphire Rapids events, ");
-		name = "sapphire_rapids";
 		break;
 
-	case INTEL_FAM6_ALDERLAKE:
-	case INTEL_FAM6_ALDERLAKE_L:
-	case INTEL_FAM6_RAPTORLAKE:
-	case INTEL_FAM6_RAPTORLAKE_P:
-	case INTEL_FAM6_RAPTORLAKE_S:
+	case INTEL_ALDERLAKE:
+	case INTEL_ALDERLAKE_L:
+	case INTEL_RAPTORLAKE:
+	case INTEL_RAPTORLAKE_P:
+	case INTEL_RAPTORLAKE_S:
 		/*
 		 * Alder Lake has 2 types of CPU, core and atom.
 		 *
@@ -6809,11 +6862,13 @@
 		pmu = &x86_pmu.hybrid_pmu[X86_HYBRID_PMU_CORE_IDX];
 		intel_pmu_init_glc(&pmu->pmu);
 		if (cpu_feature_enabled(X86_FEATURE_HYBRID_CPU)) {
-			pmu->num_counters = x86_pmu.num_counters + 2;
-			pmu->num_counters_fixed = x86_pmu.num_counters_fixed + 1;
+			pmu->cntr_mask64 <<= 2;
+			pmu->cntr_mask64 |= 0x3;
+			pmu->fixed_cntr_mask64 <<= 1;
+			pmu->fixed_cntr_mask64 |= 0x1;
 		} else {
-			pmu->num_counters = x86_pmu.num_counters;
-			pmu->num_counters_fixed = x86_pmu.num_counters_fixed;
+			pmu->cntr_mask64 = x86_pmu.cntr_mask64;
+			pmu->fixed_cntr_mask64 = x86_pmu.fixed_cntr_mask64;
 		}
 
 		/*
@@ -6823,15 +6878,16 @@
 		 * mistakenly add extra counters for P-cores. Correct the number of
 		 * counters here.
 		 */
-		if ((pmu->num_counters > 8) || (pmu->num_counters_fixed > 4)) {
-			pmu->num_counters = x86_pmu.num_counters;
-			pmu->num_counters_fixed = x86_pmu.num_counters_fixed;
+		if ((x86_pmu_num_counters(&pmu->pmu) > 8) || (x86_pmu_num_counters_fixed(&pmu->pmu) > 4)) {
+			pmu->cntr_mask64 = x86_pmu.cntr_mask64;
+			pmu->fixed_cntr_mask64 = x86_pmu.fixed_cntr_mask64;
 		}
 
-		pmu->max_pebs_events = min_t(unsigned, MAX_PEBS_EVENTS, pmu->num_counters);
+		pmu->pebs_events_mask = intel_pmu_pebs_mask(pmu->cntr_mask64);
 		pmu->unconstrained = (struct event_constraint)
-					__EVENT_CONSTRAINT(0, (1ULL << pmu->num_counters) - 1,
-							   0, pmu->num_counters, 0, 0);
+				     __EVENT_CONSTRAINT(0, pmu->cntr_mask64,
+				     0, x86_pmu_num_counters(&pmu->pmu), 0, 0);
+
 		pmu->extra_regs = intel_glc_extra_regs;
 
 		/* Initialize Atom core specific PerfMon capabilities.*/
@@ -6844,8 +6900,9 @@
 		name = "alderlake_hybrid";
 		break;
 
-	case INTEL_FAM6_METEORLAKE:
-	case INTEL_FAM6_METEORLAKE_L:
+	case INTEL_METEORLAKE:
+	case INTEL_METEORLAKE_L:
+	case INTEL_ARROWLAKE_U:
 		intel_pmu_init_hybrid(hybrid_big_small);
 
 		x86_pmu.pebs_latency_data = mtl_latency_data_small;
@@ -6898,9 +6955,9 @@
 			 * The constraints may be cut according to the CPUID enumeration
 			 * by inserting the EVENT_CONSTRAINT_END.
 			 */
-			if (x86_pmu.num_counters_fixed > INTEL_PMC_MAX_FIXED)
-				x86_pmu.num_counters_fixed = INTEL_PMC_MAX_FIXED;
-			intel_v5_gen_event_constraints[x86_pmu.num_counters_fixed].weight = -1;
+			if (fls64(x86_pmu.fixed_cntr_mask64) > INTEL_PMC_MAX_FIXED)
+				x86_pmu.fixed_cntr_mask64 &= GENMASK_ULL(INTEL_PMC_MAX_FIXED - 1, 0);
+			intel_v5_gen_event_constraints[fls64(x86_pmu.fixed_cntr_mask64)].weight = -1;
 			x86_pmu.event_constraints = intel_v5_gen_event_constraints;
 			pr_cont("generic architected perfmon, ");
 			name = "generic_arch_v5+";
@@ -6927,18 +6984,17 @@
 		x86_pmu.attr_update = hybrid_attr_update;
 	}
 
-	intel_pmu_check_num_counters(&x86_pmu.num_counters,
-				     &x86_pmu.num_counters_fixed,
-				     &x86_pmu.intel_ctrl,
-				     (u64)fixed_mask);
+	intel_pmu_check_counters_mask(&x86_pmu.cntr_mask64,
+				      &x86_pmu.fixed_cntr_mask64,
+				      &x86_pmu.intel_ctrl);
 
 	/* AnyThread may be deprecated on arch perfmon v5 or later */
 	if (x86_pmu.intel_cap.anythread_deprecated)
 		x86_pmu.format_attrs = intel_arch_formats_attr;
 
 	intel_pmu_check_event_constraints(x86_pmu.event_constraints,
-					  x86_pmu.num_counters,
-					  x86_pmu.num_counters_fixed,
+					  x86_pmu.cntr_mask64,
+					  x86_pmu.fixed_cntr_mask64,
 					  x86_pmu.intel_ctrl);
 	/*
 	 * Access LBR MSR may cause #GP under certain circumstances.
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/cstate.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/cstate.c
@@ -41,7 +41,7 @@
  *	MSR_CORE_C1_RES: CORE C1 Residency Counter
  *			 perf code: 0x00
  *			 Available model: SLM,AMT,GLM,CNL,ICX,TNT,ADL,RPL
- *					  MTL,SRF,GRR
+ *					  MTL,SRF,GRR,ARL,LNL
  *			 Scope: Core (each processor core has a MSR)
  *	MSR_CORE_C3_RESIDENCY: CORE C3 Residency Counter
  *			       perf code: 0x01
@@ -53,50 +53,50 @@
  *			       Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW,
  *						SKL,KNL,GLM,CNL,KBL,CML,ICL,ICX,
  *						TGL,TNT,RKL,ADL,RPL,SPR,MTL,SRF,
- *						GRR
+ *						GRR,ARL,LNL
  *			       Scope: Core
  *	MSR_CORE_C7_RESIDENCY: CORE C7 Residency Counter
  *			       perf code: 0x03
  *			       Available model: SNB,IVB,HSW,BDW,SKL,CNL,KBL,CML,
- *						ICL,TGL,RKL,ADL,RPL,MTL
+ *						ICL,TGL,RKL,ADL,RPL,MTL,ARL,LNL
  *			       Scope: Core
  *	MSR_PKG_C2_RESIDENCY:  Package C2 Residency Counter.
  *			       perf code: 0x00
  *			       Available model: SNB,IVB,HSW,BDW,SKL,KNL,GLM,CNL,
  *						KBL,CML,ICL,ICX,TGL,TNT,RKL,ADL,
- *						RPL,SPR,MTL
+ *						RPL,SPR,MTL,ARL,LNL,SRF
  *			       Scope: Package (physical package)
  *	MSR_PKG_C3_RESIDENCY:  Package C3 Residency Counter.
  *			       perf code: 0x01
  *			       Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,KNL,
  *						GLM,CNL,KBL,CML,ICL,TGL,TNT,RKL,
- *						ADL,RPL,MTL
+ *						ADL,RPL,MTL,ARL,LNL
  *			       Scope: Package (physical package)
  *	MSR_PKG_C6_RESIDENCY:  Package C6 Residency Counter.
  *			       perf code: 0x02
  *			       Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW,
  *						SKL,KNL,GLM,CNL,KBL,CML,ICL,ICX,
- *						TGL,TNT,RKL,ADL,RPL,SPR,MTL,SRF
+ *						TGL,TNT,RKL,ADL,RPL,SPR,MTL,SRF,
+ *						ARL,LNL
  *			       Scope: Package (physical package)
  *	MSR_PKG_C7_RESIDENCY:  Package C7 Residency Counter.
  *			       perf code: 0x03
  *			       Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,CNL,
- *						KBL,CML,ICL,TGL,RKL,ADL,RPL,MTL
+ *						KBL,CML,ICL,TGL,RKL
  *			       Scope: Package (physical package)
  *	MSR_PKG_C8_RESIDENCY:  Package C8 Residency Counter.
  *			       perf code: 0x04
  *			       Available model: HSW ULT,KBL,CNL,CML,ICL,TGL,RKL,
- *						ADL,RPL,MTL
+ *						ADL,RPL,MTL,ARL
  *			       Scope: Package (physical package)
  *	MSR_PKG_C9_RESIDENCY:  Package C9 Residency Counter.
  *			       perf code: 0x05
- *			       Available model: HSW ULT,KBL,CNL,CML,ICL,TGL,RKL,
- *						ADL,RPL,MTL
+ *			       Available model: HSW ULT,KBL,CNL,CML,ICL,TGL,RKL
  *			       Scope: Package (physical package)
  *	MSR_PKG_C10_RESIDENCY: Package C10 Residency Counter.
  *			       perf code: 0x06
  *			       Available model: HSW ULT,KBL,GLM,CNL,CML,ICL,TGL,
- *						TNT,RKL,ADL,RPL,MTL
+ *						TNT,RKL,ADL,RPL,MTL,ARL,LNL
  *			       Scope: Package (physical package)
  *	MSR_MODULE_C6_RES_MS:  Module C6 Residency Counter.
  *			       perf code: 0x00
@@ -592,9 +592,7 @@
 	.pkg_events		= BIT(PERF_CSTATE_PKG_C2_RES) |
 				  BIT(PERF_CSTATE_PKG_C3_RES) |
 				  BIT(PERF_CSTATE_PKG_C6_RES) |
-				  BIT(PERF_CSTATE_PKG_C7_RES) |
 				  BIT(PERF_CSTATE_PKG_C8_RES) |
-				  BIT(PERF_CSTATE_PKG_C9_RES) |
 				  BIT(PERF_CSTATE_PKG_C10_RES),
 };
 
@@ -648,6 +646,17 @@
 				  BIT(PERF_CSTATE_PKG_C10_RES),
 };
 
+static const struct cstate_model lnl_cstates __initconst = {
+	.core_events		= BIT(PERF_CSTATE_CORE_C1_RES) |
+				  BIT(PERF_CSTATE_CORE_C6_RES) |
+				  BIT(PERF_CSTATE_CORE_C7_RES),
+
+	.pkg_events		= BIT(PERF_CSTATE_PKG_C2_RES) |
+				  BIT(PERF_CSTATE_PKG_C3_RES) |
+				  BIT(PERF_CSTATE_PKG_C6_RES) |
+				  BIT(PERF_CSTATE_PKG_C10_RES),
+};
+
 static const struct cstate_model slm_cstates __initconst = {
 	.core_events		= BIT(PERF_CSTATE_CORE_C1_RES) |
 				  BIT(PERF_CSTATE_CORE_C6_RES),
@@ -689,85 +698,90 @@
 	.core_events		= BIT(PERF_CSTATE_CORE_C1_RES) |
 				  BIT(PERF_CSTATE_CORE_C6_RES),
 
-	.pkg_events		= BIT(PERF_CSTATE_PKG_C6_RES),
+	.pkg_events		= BIT(PERF_CSTATE_PKG_C2_RES) |
+				  BIT(PERF_CSTATE_PKG_C6_RES),
 
 	.module_events		= BIT(PERF_CSTATE_MODULE_C6_RES),
 };
 
 
 static const struct x86_cpu_id intel_cstates_match[] __initconst = {
-	X86_MATCH_INTEL_FAM6_MODEL(NEHALEM,		&nhm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(NEHALEM_EP,		&nhm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(NEHALEM_EX,		&nhm_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(WESTMERE,		&nhm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(WESTMERE_EP,		&nhm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(WESTMERE_EX,		&nhm_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(SANDYBRIDGE,		&snb_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(SANDYBRIDGE_X,	&snb_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(IVYBRIDGE,		&snb_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(IVYBRIDGE_X,		&snb_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(HASWELL,		&snb_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(HASWELL_X,		&snb_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(HASWELL_G,		&snb_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(HASWELL_L,		&hswult_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_SILVERMONT,	&slm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_SILVERMONT_D,	&slm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_AIRMONT,	&slm_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(BROADWELL,		&snb_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(BROADWELL_D,		&snb_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(BROADWELL_G,		&snb_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(BROADWELL_X,		&snb_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(SKYLAKE_L,		&snb_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(SKYLAKE,		&snb_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(SKYLAKE_X,		&snb_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(KABYLAKE_L,		&hswult_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(KABYLAKE,		&hswult_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(COMETLAKE_L,		&hswult_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(COMETLAKE,		&hswult_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(CANNONLAKE_L,	&cnl_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(XEON_PHI_KNL,	&knl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(XEON_PHI_KNM,	&knl_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_GOLDMONT,	&glm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_GOLDMONT_D,	&glm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_GOLDMONT_PLUS,	&glm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT_D,	&glm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT,	&glm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT_L,	&glm_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_GRACEMONT,	&adl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_CRESTMONT_X,	&srf_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ATOM_CRESTMONT,	&grr_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_L,		&icl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ICELAKE,		&icl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_X,		&icx_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_D,		&icx_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X,	&icx_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X,	&icx_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(GRANITERAPIDS_X,	&icx_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(GRANITERAPIDS_D,	&icx_cstates),
-
-	X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE_L,		&icl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE,		&icl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ROCKETLAKE,		&icl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE,		&adl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L,		&adl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE,		&adl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P,	&adl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S,	&adl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE,		&adl_cstates),
-	X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L,	&adl_cstates),
+	X86_MATCH_VFM(INTEL_NEHALEM,		&nhm_cstates),
+	X86_MATCH_VFM(INTEL_NEHALEM_EP,		&nhm_cstates),
+	X86_MATCH_VFM(INTEL_NEHALEM_EX,		&nhm_cstates),
+
+	X86_MATCH_VFM(INTEL_WESTMERE,		&nhm_cstates),
+	X86_MATCH_VFM(INTEL_WESTMERE_EP,	&nhm_cstates),
+	X86_MATCH_VFM(INTEL_WESTMERE_EX,	&nhm_cstates),
+
+	X86_MATCH_VFM(INTEL_SANDYBRIDGE,	&snb_cstates),
+	X86_MATCH_VFM(INTEL_SANDYBRIDGE_X,	&snb_cstates),
+
+	X86_MATCH_VFM(INTEL_IVYBRIDGE,		&snb_cstates),
+	X86_MATCH_VFM(INTEL_IVYBRIDGE_X,	&snb_cstates),
+
+	X86_MATCH_VFM(INTEL_HASWELL,		&snb_cstates),
+	X86_MATCH_VFM(INTEL_HASWELL_X,		&snb_cstates),
+	X86_MATCH_VFM(INTEL_HASWELL_G,		&snb_cstates),
+
+	X86_MATCH_VFM(INTEL_HASWELL_L,		&hswult_cstates),
+
+	X86_MATCH_VFM(INTEL_ATOM_SILVERMONT,	&slm_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_D,	&slm_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_AIRMONT,	&slm_cstates),
+
+	X86_MATCH_VFM(INTEL_BROADWELL,		&snb_cstates),
+	X86_MATCH_VFM(INTEL_BROADWELL_D,	&snb_cstates),
+	X86_MATCH_VFM(INTEL_BROADWELL_G,	&snb_cstates),
+	X86_MATCH_VFM(INTEL_BROADWELL_X,	&snb_cstates),
+
+	X86_MATCH_VFM(INTEL_SKYLAKE_L,		&snb_cstates),
+	X86_MATCH_VFM(INTEL_SKYLAKE,		&snb_cstates),
+	X86_MATCH_VFM(INTEL_SKYLAKE_X,		&snb_cstates),
+
+	X86_MATCH_VFM(INTEL_KABYLAKE_L,		&hswult_cstates),
+	X86_MATCH_VFM(INTEL_KABYLAKE,		&hswult_cstates),
+	X86_MATCH_VFM(INTEL_COMETLAKE_L,	&hswult_cstates),
+	X86_MATCH_VFM(INTEL_COMETLAKE,		&hswult_cstates),
+
+	X86_MATCH_VFM(INTEL_CANNONLAKE_L,	&cnl_cstates),
+
+	X86_MATCH_VFM(INTEL_XEON_PHI_KNL,	&knl_cstates),
+	X86_MATCH_VFM(INTEL_XEON_PHI_KNM,	&knl_cstates),
+
+	X86_MATCH_VFM(INTEL_ATOM_GOLDMONT,	&glm_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_GOLDMONT_D,	&glm_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_GOLDMONT_PLUS,	&glm_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_TREMONT_D,	&glm_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_TREMONT,	&glm_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_TREMONT_L,	&glm_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_GRACEMONT,	&adl_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_CRESTMONT_X,	&srf_cstates),
+	X86_MATCH_VFM(INTEL_ATOM_CRESTMONT,	&grr_cstates),
+
+	X86_MATCH_VFM(INTEL_ICELAKE_L,		&icl_cstates),
+	X86_MATCH_VFM(INTEL_ICELAKE,		&icl_cstates),
+	X86_MATCH_VFM(INTEL_ICELAKE_X,		&icx_cstates),
+	X86_MATCH_VFM(INTEL_ICELAKE_D,		&icx_cstates),
+	X86_MATCH_VFM(INTEL_SAPPHIRERAPIDS_X,	&icx_cstates),
+	X86_MATCH_VFM(INTEL_EMERALDRAPIDS_X,	&icx_cstates),
+	X86_MATCH_VFM(INTEL_GRANITERAPIDS_X,	&icx_cstates),
+	X86_MATCH_VFM(INTEL_GRANITERAPIDS_D,	&icx_cstates),
+
+	X86_MATCH_VFM(INTEL_TIGERLAKE_L,	&icl_cstates),
+	X86_MATCH_VFM(INTEL_TIGERLAKE,		&icl_cstates),
+	X86_MATCH_VFM(INTEL_ROCKETLAKE,		&icl_cstates),
+	X86_MATCH_VFM(INTEL_ALDERLAKE,		&adl_cstates),
+	X86_MATCH_VFM(INTEL_ALDERLAKE_L,	&adl_cstates),
+	X86_MATCH_VFM(INTEL_RAPTORLAKE,		&adl_cstates),
+	X86_MATCH_VFM(INTEL_RAPTORLAKE_P,	&adl_cstates),
+	X86_MATCH_VFM(INTEL_RAPTORLAKE_S,	&adl_cstates),
+	X86_MATCH_VFM(INTEL_METEORLAKE,		&adl_cstates),
+	X86_MATCH_VFM(INTEL_METEORLAKE_L,	&adl_cstates),
+	X86_MATCH_VFM(INTEL_ARROWLAKE,		&adl_cstates),
+	X86_MATCH_VFM(INTEL_ARROWLAKE_H,	&adl_cstates),
+	X86_MATCH_VFM(INTEL_ARROWLAKE_U,	&adl_cstates),
+	X86_MATCH_VFM(INTEL_LUNARLAKE_M,	&lnl_cstates),
 	{ },
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_cstates_match);
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/ds.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/ds.c
@@ -1136,8 +1136,7 @@
 static inline void pebs_update_threshold(struct cpu_hw_events *cpuc)
 {
 	struct debug_store *ds = cpuc->ds;
-	int max_pebs_events = hybrid(cpuc->pmu, max_pebs_events);
-	int num_counters_fixed = hybrid(cpuc->pmu, num_counters_fixed);
+	int max_pebs_events = intel_pmu_max_num_pebs(cpuc->pmu);
 	u64 threshold;
 	int reserved;
 
@@ -1145,7 +1144,7 @@
 		return;
 
 	if (x86_pmu.flags & PMU_FL_PEBS_ALL)
-		reserved = max_pebs_events + num_counters_fixed;
+		reserved = max_pebs_events + x86_pmu_max_num_counters_fixed(cpuc->pmu);
 	else
 		reserved = max_pebs_events;
 
@@ -1236,11 +1235,11 @@
 	struct pmu *pmu = event->pmu;
 
 	/*
-	 * Make sure we get updated with the first PEBS
-	 * event. It will trigger also during removal, but
-	 * that does not hurt:
+	 * Make sure we get updated with the first PEBS event.
+	 * During removal, ->pebs_data_cfg is still valid for
+	 * the last PEBS event. Don't clear it.
 	 */
-	if (cpuc->n_pebs == 1)
+	if ((cpuc->n_pebs == 1) && add)
 		cpuc->pebs_data_cfg = PEBS_UPDATE_DS_SW;
 
 	if (needed_cb != pebs_needs_sched_cb(cpuc)) {
@@ -1354,7 +1353,7 @@
 			 * hence we need to drain when changing said
 			 * size.
 			 */
-			intel_pmu_drain_large_pebs(cpuc);
+			intel_pmu_drain_pebs_buffer();
 			adaptive_pebs_record_size_update();
 			wrmsrl(MSR_PEBS_DATA_CFG, pebs_data_cfg);
 			cpuc->active_pebs_data_cfg = pebs_data_cfg;
@@ -1830,8 +1829,12 @@
 	set_linear_ip(regs, basic->ip);
 	regs->flags = PERF_EFLAGS_EXACT;
 
-	if ((sample_type & PERF_SAMPLE_WEIGHT_STRUCT) && (x86_pmu.flags & PMU_FL_RETIRE_LATENCY))
-		data->weight.var3_w = format_size >> PEBS_RETIRE_LATENCY_OFFSET & PEBS_LATENCY_MASK;
+	if (sample_type & PERF_SAMPLE_WEIGHT_STRUCT) {
+		if (x86_pmu.flags & PMU_FL_RETIRE_LATENCY)
+			data->weight.var3_w = format_size >> PEBS_RETIRE_LATENCY_OFFSET & PEBS_LATENCY_MASK;
+		else
+			data->weight.var3_w = 0;
+	}
 
 	/*
 	 * The record for MEMINFO is in front of GP
@@ -2156,6 +2159,7 @@
 	void *base, *at, *top;
 	short counts[INTEL_PMC_IDX_FIXED + MAX_FIXED_PEBS_EVENTS] = {};
 	short error[INTEL_PMC_IDX_FIXED + MAX_FIXED_PEBS_EVENTS] = {};
+	int max_pebs_events = intel_pmu_max_num_pebs(NULL);
 	int bit, i, size;
 	u64 mask;
 
@@ -2167,11 +2171,11 @@
 
 	ds->pebs_index = ds->pebs_buffer_base;
 
-	mask = (1ULL << x86_pmu.max_pebs_events) - 1;
-	size = x86_pmu.max_pebs_events;
+	mask = x86_pmu.pebs_events_mask;
+	size = max_pebs_events;
 	if (x86_pmu.flags & PMU_FL_PEBS_ALL) {
-		mask |= ((1ULL << x86_pmu.num_counters_fixed) - 1) << INTEL_PMC_IDX_FIXED;
-		size = INTEL_PMC_IDX_FIXED + x86_pmu.num_counters_fixed;
+		mask |= x86_pmu.fixed_cntr_mask64 << INTEL_PMC_IDX_FIXED;
+		size = INTEL_PMC_IDX_FIXED + x86_pmu_max_num_counters_fixed(NULL);
 	}
 
 	if (unlikely(base >= top)) {
@@ -2207,8 +2211,9 @@
 			pebs_status = p->status = cpuc->pebs_enabled;
 
 		bit = find_first_bit((unsigned long *)&pebs_status,
-					x86_pmu.max_pebs_events);
-		if (bit >= x86_pmu.max_pebs_events)
+				     max_pebs_events);
+
+		if (!(x86_pmu.pebs_events_mask & (1 << bit)))
 			continue;
 
 		/*
@@ -2266,12 +2271,10 @@
 {
 	short counts[INTEL_PMC_IDX_FIXED + MAX_FIXED_PEBS_EVENTS] = {};
 	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
-	int max_pebs_events = hybrid(cpuc->pmu, max_pebs_events);
-	int num_counters_fixed = hybrid(cpuc->pmu, num_counters_fixed);
 	struct debug_store *ds = cpuc->ds;
 	struct perf_event *event;
 	void *base, *at, *top;
-	int bit, size;
+	int bit;
 	u64 mask;
 
 	if (!x86_pmu.pebs_active)
@@ -2282,12 +2285,11 @@
 
 	ds->pebs_index = ds->pebs_buffer_base;
 
-	mask = ((1ULL << max_pebs_events) - 1) |
-	       (((1ULL << num_counters_fixed) - 1) << INTEL_PMC_IDX_FIXED);
-	size = INTEL_PMC_IDX_FIXED + num_counters_fixed;
+	mask = hybrid(cpuc->pmu, pebs_events_mask) |
+	       (hybrid(cpuc->pmu, fixed_cntr_mask64) << INTEL_PMC_IDX_FIXED);
 
 	if (unlikely(base >= top)) {
-		intel_pmu_pebs_event_update_no_drain(cpuc, size);
+		intel_pmu_pebs_event_update_no_drain(cpuc, X86_PMC_IDX_MAX);
 		return;
 	}
 
@@ -2297,11 +2299,11 @@
 		pebs_status = get_pebs_status(at) & cpuc->pebs_enabled;
 		pebs_status &= mask;
 
-		for_each_set_bit(bit, (unsigned long *)&pebs_status, size)
+		for_each_set_bit(bit, (unsigned long *)&pebs_status, X86_PMC_IDX_MAX)
 			counts[bit]++;
 	}
 
-	for_each_set_bit(bit, (unsigned long *)&mask, size) {
+	for_each_set_bit(bit, (unsigned long *)&mask, X86_PMC_IDX_MAX) {
 		if (counts[bit] == 0)
 			continue;
 
@@ -2379,6 +2381,7 @@
 			x86_pmu.large_pebs_flags |= PERF_SAMPLE_TIME;
 			break;
 
+		case 6:
 		case 5:
 			x86_pmu.pebs_ept = 1;
 			fallthrough;
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/knc.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/knc.c
@@ -303,7 +303,7 @@
 	.apic			= 1,
 	.max_period		= (1ULL << 39) - 1,
 	.version		= 0,
-	.num_counters		= 2,
+	.cntr_mask64		= 0x3,
 	.cntval_bits		= 40,
 	.cntval_mask		= (1ULL << 40) - 1,
 	.get_event_constraints	= x86_get_event_constraints,
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/p4.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/p4.c
@@ -919,7 +919,7 @@
 	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
 	int idx;
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		struct perf_event *event = cpuc->events[idx];
 		if (!test_bit(idx, cpuc->active_mask))
 			continue;
@@ -998,7 +998,7 @@
 	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
 	int idx;
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		struct perf_event *event = cpuc->events[idx];
 		if (!test_bit(idx, cpuc->active_mask))
 			continue;
@@ -1040,7 +1040,7 @@
 
 	cpuc = this_cpu_ptr(&cpu_hw_events);
 
-	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+	for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		int overflow;
 
 		if (!test_bit(idx, cpuc->active_mask)) {
@@ -1353,7 +1353,7 @@
 	 * though leave it restricted at moment assuming
 	 * HT is on
 	 */
-	.num_counters		= ARCH_P4_MAX_CCCR,
+	.cntr_mask64		= GENMASK_ULL(ARCH_P4_MAX_CCCR - 1, 0),
 	.apic			= 1,
 	.cntval_bits		= ARCH_P4_CNTRVAL_BITS,
 	.cntval_mask		= ARCH_P4_CNTRVAL_MASK,
@@ -1395,7 +1395,7 @@
 	 *
 	 * Solve this by zero'ing out the registers to mimic a reset.
 	 */
-	for (i = 0; i < x86_pmu.num_counters; i++) {
+	for_each_set_bit(i, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
 		reg = x86_pmu_config_addr(i);
 		wrmsrl_safe(reg, 0ULL);
 	}
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/p6.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/p6.c
@@ -214,7 +214,7 @@
 	.apic			= 1,
 	.max_period		= (1ULL << 31) - 1,
 	.version		= 0,
-	.num_counters		= 2,
+	.cntr_mask64		= 0x3,
 	/*
 	 * Events have 40 bits implemented. However they are designed such
 	 * that bits [32-39] are sign extensions of bit 31. As such the
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/pt.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/pt.c
@@ -828,11 +828,13 @@
 	buf->cur_idx++;
 
 	if (buf->cur_idx == buf->cur->last) {
-		if (buf->cur == buf->last)
+		if (buf->cur == buf->last) {
 			buf->cur = buf->first;
-		else
+			buf->wrapped = true;
+		} else {
 			buf->cur = list_entry(buf->cur->list.next, struct topa,
 					      list);
+		}
 		buf->cur_idx = 0;
 	}
 }
@@ -846,8 +848,11 @@
 static void pt_update_head(struct pt *pt)
 {
 	struct pt_buffer *buf = perf_get_aux(&pt->handle);
+	bool wrapped = buf->wrapped;
 	u64 topa_idx, base, old;
 
+	buf->wrapped = false;
+
 	if (buf->single) {
 		local_set(&buf->data_size, buf->output_off);
 		return;
@@ -865,7 +870,7 @@
 	} else {
 		old = (local64_xchg(&buf->head, base) &
 		       ((buf->nr_pages << PAGE_SHIFT) - 1));
-		if (base < old)
+		if (base < old || (base == old && wrapped))
 			base += buf->nr_pages << PAGE_SHIFT;
 
 		local_add(base - old, &buf->data_size);
@@ -878,7 +883,7 @@
  */
 static void *pt_buffer_region(struct pt_buffer *buf)
 {
-	return phys_to_virt(TOPA_ENTRY(buf->cur, buf->cur_idx)->base << TOPA_SHIFT);
+	return phys_to_virt((phys_addr_t)TOPA_ENTRY(buf->cur, buf->cur_idx)->base << TOPA_SHIFT);
 }
 
 /**
@@ -990,7 +995,7 @@
 	 * order allocations, there shouldn't be many of these.
 	 */
 	list_for_each_entry(topa, &buf->tables, list) {
-		if (topa->offset + topa->size > pg << PAGE_SHIFT)
+		if (topa->offset + topa->size > (unsigned long)pg << PAGE_SHIFT)
 			goto found;
 	}
 
@@ -1606,6 +1611,7 @@
 	 * see comment in intel_pt_interrupt().
 	 */
 	WRITE_ONCE(pt->handle_nmi, 0);
+	barrier();
 
 	pt_config_stop(event);
 
@@ -1657,11 +1663,10 @@
 		return 0;
 
 	/*
-	 * Here, handle_nmi tells us if the tracing is on
+	 * There is no PT interrupt in this mode, so stop the trace and it will
+	 * remain stopped while the buffer is copied.
 	 */
-	if (READ_ONCE(pt->handle_nmi))
-		pt_config_stop(event);
-
+	pt_config_stop(event);
 	pt_read_offset(buf);
 	pt_update_head(pt);
 
@@ -1673,11 +1678,10 @@
 	ret = perf_output_copy_aux(&pt->handle, handle, from, to);
 
 	/*
-	 * If the tracing was on when we turned up, restart it.
-	 * Compiler barrier not needed as we couldn't have been
-	 * preempted by anything that touches pt->handle_nmi.
+	 * Here, handle_nmi tells us if the tracing was on.
+	 * If the tracing was on, restart it.
 	 */
-	if (pt->handle_nmi)
+	if (READ_ONCE(pt->handle_nmi))
 		pt_config_start(event);
 
 	return ret;
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/pt.h
+++ linux-qcom-6.8.0/arch/x86/events/intel/pt.h
@@ -33,8 +33,8 @@
 	u64	rsvd2	: 1;
 	u64	size	: 4;
 	u64	rsvd3	: 2;
-	u64	base	: 36;
-	u64	rsvd4	: 16;
+	u64	base	: 40;
+	u64	rsvd4	: 12;
 };
 
 /* TSC to Core Crystal Clock Ratio */
@@ -65,6 +65,7 @@
  * @head:	logical write offset inside the buffer
  * @snapshot:	if this is for a snapshot/overwrite counter
  * @single:	use Single Range Output instead of ToPA
+ * @wrapped:	buffer advance wrapped back to the first topa table
  * @stop_pos:	STOP topa entry index
  * @intr_pos:	INT topa entry index
  * @stop_te:	STOP topa entry pointer
@@ -82,6 +83,7 @@
 	local64_t		head;
 	bool			snapshot;
 	bool			single;
+	bool			wrapped;
 	long			stop_pos, intr_pos;
 	struct topa_entry	*stop_te, *intr_te;
 	void			**data_pages;
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/uncore.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/uncore.c
@@ -263,6 +263,9 @@
 		return;
 	}
 
+	if (intel_generic_uncore_assign_hw_event(event, box))
+		return;
+
 	hwc->config_base = uncore_event_ctl(box, hwc->idx);
 	hwc->event_base  = uncore_perf_ctr(box, hwc->idx);
 }
@@ -843,7 +846,9 @@
 static ssize_t uncore_get_attr_cpumask(struct device *dev,
 				struct device_attribute *attr, char *buf)
 {
-	return cpumap_print_to_pagebuf(true, buf, &uncore_cpu_mask);
+	struct intel_uncore_pmu *pmu = container_of(dev_get_drvdata(dev), struct intel_uncore_pmu, pmu);
+
+	return cpumap_print_to_pagebuf(true, buf, &pmu->cpu_mask);
 }
 
 static DEVICE_ATTR(cpumask, S_IRUGO, uncore_get_attr_cpumask, NULL);
@@ -860,7 +865,10 @@
 static inline int uncore_get_box_id(struct intel_uncore_type *type,
 				    struct intel_uncore_pmu *pmu)
 {
-	return type->box_ids ? type->box_ids[pmu->pmu_idx] : pmu->pmu_idx;
+	if (type->boxes)
+		return intel_uncore_find_discovery_unit_id(type->boxes, -1, pmu->pmu_idx);
+
+	return pmu->pmu_idx;
 }
 
 void uncore_get_alias_name(char *pmu_name, struct intel_uncore_pmu *pmu)
@@ -961,6 +969,9 @@
 	if (type->cleanup_mapping)
 		type->cleanup_mapping(type);
 
+	if (type->cleanup_extra_boxes)
+		type->cleanup_extra_boxes(type);
+
 	if (pmu) {
 		for (i = 0; i < type->num_boxes; i++, pmu++) {
 			uncore_pmu_unregister(pmu);
@@ -969,10 +980,7 @@
 		kfree(type->pmus);
 		type->pmus = NULL;
 	}
-	if (type->box_ids) {
-		kfree(type->box_ids);
-		type->box_ids = NULL;
-	}
+
 	kfree(type->events_group);
 	type->events_group = NULL;
 }
@@ -1076,22 +1084,19 @@
 uncore_pci_find_dev_pmu_from_types(struct pci_dev *pdev)
 {
 	struct intel_uncore_type **types = uncore_pci_uncores;
+	struct intel_uncore_discovery_unit *unit;
 	struct intel_uncore_type *type;
-	u64 box_ctl;
-	int i, die;
+	struct rb_node *node;
 
 	for (; *types; types++) {
 		type = *types;
-		for (die = 0; die < __uncore_max_dies; die++) {
-			for (i = 0; i < type->num_boxes; i++) {
-				if (!type->box_ctls[die])
-					continue;
-				box_ctl = type->box_ctls[die] + type->pci_offsets[i];
-				if (pdev->devfn == UNCORE_DISCOVERY_PCI_DEVFN(box_ctl) &&
-				    pdev->bus->number == UNCORE_DISCOVERY_PCI_BUS(box_ctl) &&
-				    pci_domain_nr(pdev->bus) == UNCORE_DISCOVERY_PCI_DOMAIN(box_ctl))
-					return &type->pmus[i];
-			}
+
+		for (node = rb_first(type->boxes); node; node = rb_next(node)) {
+			unit = rb_entry(node, struct intel_uncore_discovery_unit, node);
+			if (pdev->devfn == UNCORE_DISCOVERY_PCI_DEVFN(unit->addr) &&
+			    pdev->bus->number == UNCORE_DISCOVERY_PCI_BUS(unit->addr) &&
+			    pci_domain_nr(pdev->bus) == UNCORE_DISCOVERY_PCI_DOMAIN(unit->addr))
+				return &type->pmus[unit->pmu_idx];
 		}
 	}
 
@@ -1367,28 +1372,25 @@
 static void uncore_pci_pmus_register(void)
 {
 	struct intel_uncore_type **types = uncore_pci_uncores;
+	struct intel_uncore_discovery_unit *unit;
 	struct intel_uncore_type *type;
 	struct intel_uncore_pmu *pmu;
+	struct rb_node *node;
 	struct pci_dev *pdev;
-	u64 box_ctl;
-	int i, die;
 
 	for (; *types; types++) {
 		type = *types;
-		for (die = 0; die < __uncore_max_dies; die++) {
-			for (i = 0; i < type->num_boxes; i++) {
-				if (!type->box_ctls[die])
-					continue;
-				box_ctl = type->box_ctls[die] + type->pci_offsets[i];
-				pdev = pci_get_domain_bus_and_slot(UNCORE_DISCOVERY_PCI_DOMAIN(box_ctl),
-								   UNCORE_DISCOVERY_PCI_BUS(box_ctl),
-								   UNCORE_DISCOVERY_PCI_DEVFN(box_ctl));
-				if (!pdev)
-					continue;
-				pmu = &type->pmus[i];
 
-				uncore_pci_pmu_register(pdev, type, pmu, die);
-			}
+		for (node = rb_first(type->boxes); node; node = rb_next(node)) {
+			unit = rb_entry(node, struct intel_uncore_discovery_unit, node);
+			pdev = pci_get_domain_bus_and_slot(UNCORE_DISCOVERY_PCI_DOMAIN(unit->addr),
+							   UNCORE_DISCOVERY_PCI_BUS(unit->addr),
+							   UNCORE_DISCOVERY_PCI_DEVFN(unit->addr));
+
+			if (!pdev)
+				continue;
+			pmu = &type->pmus[unit->pmu_idx];
+			uncore_pci_pmu_register(pdev, type, pmu, unit->die);
 		}
 	}
 
@@ -1453,6 +1455,18 @@
 	}
 }
 
+static bool uncore_die_has_box(struct intel_uncore_type *type,
+			       int die, unsigned int pmu_idx)
+{
+	if (!type->boxes)
+		return true;
+
+	if (intel_uncore_find_discovery_unit_id(type->boxes, die, pmu_idx) < 0)
+		return false;
+
+	return true;
+}
+
 static void uncore_change_type_ctx(struct intel_uncore_type *type, int old_cpu,
 				   int new_cpu)
 {
@@ -1468,18 +1482,25 @@
 
 		if (old_cpu < 0) {
 			WARN_ON_ONCE(box->cpu != -1);
-			box->cpu = new_cpu;
+			if (uncore_die_has_box(type, die, pmu->pmu_idx)) {
+				box->cpu = new_cpu;
+				cpumask_set_cpu(new_cpu, &pmu->cpu_mask);
+			}
 			continue;
 		}
 
-		WARN_ON_ONCE(box->cpu != old_cpu);
+		WARN_ON_ONCE(box->cpu != -1 && box->cpu != old_cpu);
 		box->cpu = -1;
+		cpumask_clear_cpu(old_cpu, &pmu->cpu_mask);
 		if (new_cpu < 0)
 			continue;
 
+		if (!uncore_die_has_box(type, die, pmu->pmu_idx))
+			continue;
 		uncore_pmu_cancel_hrtimer(box);
 		perf_pmu_migrate_context(&pmu->pmu, old_cpu, new_cpu);
 		box->cpu = new_cpu;
+		cpumask_set_cpu(new_cpu, &pmu->cpu_mask);
 	}
 }
 
@@ -1502,7 +1523,7 @@
 		pmu = type->pmus;
 		for (i = 0; i < type->num_boxes; i++, pmu++) {
 			box = pmu->boxes[id];
-			if (box && atomic_dec_return(&box->refcnt) == 0)
+			if (box && box->cpu >= 0 && atomic_dec_return(&box->refcnt) == 0)
 				uncore_box_exit(box);
 		}
 	}
@@ -1592,7 +1613,7 @@
 		pmu = type->pmus;
 		for (i = 0; i < type->num_boxes; i++, pmu++) {
 			box = pmu->boxes[id];
-			if (box && atomic_inc_return(&box->refcnt) == 1)
+			if (box && box->cpu >= 0 && atomic_inc_return(&box->refcnt) == 1)
 				uncore_box_init(box);
 		}
 	}
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/uncore.h
+++ linux-qcom-6.8.0/arch/x86/events/intel/uncore.h
@@ -62,7 +62,6 @@
 	unsigned fixed_ctr;
 	unsigned fixed_ctl;
 	unsigned box_ctl;
-	u64 *box_ctls;	/* Unit ctrl addr of the first box of each die */
 	union {
 		unsigned msr_offset;
 		unsigned mmio_offset;
@@ -76,7 +75,6 @@
 		u64 *pci_offsets;
 		u64 *mmio_offsets;
 	};
-	unsigned *box_ids;
 	struct event_constraint unconstrainted;
 	struct event_constraint *constraints;
 	struct intel_uncore_pmu *pmus;
@@ -86,6 +84,7 @@
 	const struct attribute_group *attr_groups[4];
 	const struct attribute_group **attr_update;
 	struct pmu *pmu; /* for custom pmu ops */
+	struct rb_root *boxes;
 	/*
 	 * Uncore PMU would store relevant platform topology configuration here
 	 * to identify which platform component each PMON block of that type is
@@ -98,6 +97,10 @@
 	int (*get_topology)(struct intel_uncore_type *type);
 	void (*set_mapping)(struct intel_uncore_type *type);
 	void (*cleanup_mapping)(struct intel_uncore_type *type);
+	/*
+	 * Optional callbacks for extra uncore units cleanup
+	 */
+	void (*cleanup_extra_boxes)(struct intel_uncore_type *type);
 };
 
 #define pmu_group attr_groups[0]
@@ -125,6 +128,7 @@
 	int				func_id;
 	bool				registered;
 	atomic_t			activeboxes;
+	cpumask_t			cpu_mask;
 	struct intel_uncore_type	*type;
 	struct intel_uncore_box		**boxes;
 };
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/uncore_discovery.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/uncore_discovery.c
@@ -89,9 +89,7 @@
 	if (!type)
 		return NULL;
 
-	type->box_ctrl_die = kcalloc(__uncore_max_dies, sizeof(u64), GFP_KERNEL);
-	if (!type->box_ctrl_die)
-		goto free_type;
+	type->units = RB_ROOT;
 
 	type->access_type = unit->access_type;
 	num_discovered_types[type->access_type]++;
@@ -100,12 +98,6 @@
 	rb_add(&type->node, &discovery_tables, __type_less);
 
 	return type;
-
-free_type:
-	kfree(type);
-
-	return NULL;
-
 }
 
 static struct intel_uncore_discovery_type *
@@ -120,14 +112,118 @@
 	return add_uncore_discovery_type(unit);
 }
 
+static inline int pmu_idx_cmp(const void *key, const struct rb_node *b)
+{
+	struct intel_uncore_discovery_unit *unit;
+	const unsigned int *id = key;
+
+	unit = rb_entry(b, struct intel_uncore_discovery_unit, node);
+
+	if (unit->pmu_idx > *id)
+		return -1;
+	else if (unit->pmu_idx < *id)
+		return 1;
+
+	return 0;
+}
+
+static struct intel_uncore_discovery_unit *
+intel_uncore_find_discovery_unit(struct rb_root *units, int die,
+				 unsigned int pmu_idx)
+{
+	struct intel_uncore_discovery_unit *unit;
+	struct rb_node *pos;
+
+	if (!units)
+		return NULL;
+
+	pos = rb_find_first(&pmu_idx, units, pmu_idx_cmp);
+	if (!pos)
+		return NULL;
+	unit = rb_entry(pos, struct intel_uncore_discovery_unit, node);
+
+	if (die < 0)
+		return unit;
+
+	for (; pos; pos = rb_next(pos)) {
+		unit = rb_entry(pos, struct intel_uncore_discovery_unit, node);
+
+		if (unit->pmu_idx != pmu_idx)
+			break;
+
+		if (unit->die == die)
+			return unit;
+	}
+
+	return NULL;
+}
+
+int intel_uncore_find_discovery_unit_id(struct rb_root *units, int die,
+					unsigned int pmu_idx)
+{
+	struct intel_uncore_discovery_unit *unit;
+
+	unit = intel_uncore_find_discovery_unit(units, die, pmu_idx);
+	if (unit)
+		return unit->id;
+
+	return -1;
+}
+
+static inline bool unit_less(struct rb_node *a, const struct rb_node *b)
+{
+	struct intel_uncore_discovery_unit *a_node, *b_node;
+
+	a_node = rb_entry(a, struct intel_uncore_discovery_unit, node);
+	b_node = rb_entry(b, struct intel_uncore_discovery_unit, node);
+
+	if (a_node->pmu_idx < b_node->pmu_idx)
+		return true;
+	if (a_node->pmu_idx > b_node->pmu_idx)
+		return false;
+
+	if (a_node->die < b_node->die)
+		return true;
+	if (a_node->die > b_node->die)
+		return false;
+
+	return 0;
+}
+
+static inline struct intel_uncore_discovery_unit *
+uncore_find_unit(struct rb_root *root, unsigned int id)
+{
+	struct intel_uncore_discovery_unit *unit;
+	struct rb_node *node;
+
+	for (node = rb_first(root); node; node = rb_next(node)) {
+		unit = rb_entry(node, struct intel_uncore_discovery_unit, node);
+		if (unit->id == id)
+			return unit;
+	}
+
+	return NULL;
+}
+
+void uncore_find_add_unit(struct intel_uncore_discovery_unit *node,
+			  struct rb_root *root, u16 *num_units)
+{
+	struct intel_uncore_discovery_unit *unit = uncore_find_unit(root, node->id);
+
+	if (unit)
+		node->pmu_idx = unit->pmu_idx;
+	else if (num_units)
+		node->pmu_idx = (*num_units)++;
+
+	rb_add(&node->node, root, unit_less);
+}
+
 static void
 uncore_insert_box_info(struct uncore_unit_discovery *unit,
-		       int die, bool parsed)
+		       int die)
 {
+	struct intel_uncore_discovery_unit *node;
 	struct intel_uncore_discovery_type *type;
-	unsigned int *ids;
-	u64 *box_offset;
-	int i;
 
 	if (!unit->ctl || !unit->ctl_offset || !unit->ctr_offset) {
 		pr_info("Invalid address is detected for uncore type %d box %d, "
@@ -136,71 +232,29 @@
 		return;
 	}
 
-	if (parsed) {
-		type = search_uncore_discovery_type(unit->box_type);
-		if (!type) {
-			pr_info("A spurious uncore type %d is detected, "
-				"Disable the uncore type.\n",
-				unit->box_type);
-			return;
-		}
-		/* Store the first box of each die */
-		if (!type->box_ctrl_die[die])
-			type->box_ctrl_die[die] = unit->ctl;
+	node = kzalloc(sizeof(*node), GFP_KERNEL);
+	if (!node)
 		return;
-	}
 
-	type = get_uncore_discovery_type(unit);
-	if (!type)
-		return;
+	node->die = die;
+	node->id = unit->box_id;
+	node->addr = unit->ctl;
 
-	box_offset = kcalloc(type->num_boxes + 1, sizeof(u64), GFP_KERNEL);
-	if (!box_offset)
+	type = get_uncore_discovery_type(unit);
+	if (!type) {
+		kfree(node);
 		return;
+	}
 
-	ids = kcalloc(type->num_boxes + 1, sizeof(unsigned int), GFP_KERNEL);
-	if (!ids)
-		goto free_box_offset;
+	uncore_find_add_unit(node, &type->units, &type->num_units);
 
 	/* Store generic information for the first box */
-	if (!type->num_boxes) {
-		type->box_ctrl = unit->ctl;
-		type->box_ctrl_die[die] = unit->ctl;
+	if (type->num_units == 1) {
 		type->num_counters = unit->num_regs;
 		type->counter_width = unit->bit_width;
 		type->ctl_offset = unit->ctl_offset;
 		type->ctr_offset = unit->ctr_offset;
-		*ids = unit->box_id;
-		goto end;
-	}
-
-	for (i = 0; i < type->num_boxes; i++) {
-		ids[i] = type->ids[i];
-		box_offset[i] = type->box_offset[i];
-
-		if (unit->box_id == ids[i]) {
-			pr_info("Duplicate uncore type %d box ID %d is detected, "
-				"Drop the duplicate uncore unit.\n",
-				unit->box_type, unit->box_id);
-			goto free_ids;
-		}
 	}
-	ids[i] = unit->box_id;
-	box_offset[i] = unit->ctl - type->box_ctrl;
-	kfree(type->ids);
-	kfree(type->box_offset);
-end:
-	type->ids = ids;
-	type->box_offset = box_offset;
-	type->num_boxes++;
-	return;
-
-free_ids:
-	kfree(ids);
-
-free_box_offset:
-	kfree(box_offset);
-
 }
 
 static bool
@@ -279,7 +333,7 @@
 		if (uncore_ignore_unit(&unit, ignore))
 			continue;
 
-		uncore_insert_box_info(&unit, die, *parsed);
+		uncore_insert_box_info(&unit, die);
 	}
 
 	*parsed = true;
@@ -339,9 +393,16 @@
 void intel_uncore_clear_discovery_tables(void)
 {
 	struct intel_uncore_discovery_type *type, *next;
+	struct intel_uncore_discovery_unit *pos;
+	struct rb_node *node;
 
 	rbtree_postorder_for_each_entry_safe(type, next, &discovery_tables, node) {
-		kfree(type->box_ctrl_die);
+		while (!RB_EMPTY_ROOT(&type->units)) {
+			node = rb_first(&type->units);
+			pos = rb_entry(node, struct intel_uncore_discovery_unit, node);
+			rb_erase(node, &type->units);
+			kfree(pos);
+		}
 		kfree(type);
 	}
 }
@@ -366,19 +427,31 @@
 	.attrs = generic_uncore_formats_attr,
 };
 
+static u64 intel_generic_uncore_box_ctl(struct intel_uncore_box *box)
+{
+	struct intel_uncore_discovery_unit *unit;
+
+	unit = intel_uncore_find_discovery_unit(box->pmu->type->boxes,
+						-1, box->pmu->pmu_idx);
+	if (WARN_ON_ONCE(!unit))
+		return 0;
+
+	return unit->addr;
+}
+
 void intel_generic_uncore_msr_init_box(struct intel_uncore_box *box)
 {
-	wrmsrl(uncore_msr_box_ctl(box), GENERIC_PMON_BOX_CTL_INT);
+	wrmsrl(intel_generic_uncore_box_ctl(box), GENERIC_PMON_BOX_CTL_INT);
 }
 
 void intel_generic_uncore_msr_disable_box(struct intel_uncore_box *box)
 {
-	wrmsrl(uncore_msr_box_ctl(box), GENERIC_PMON_BOX_CTL_FRZ);
+	wrmsrl(intel_generic_uncore_box_ctl(box), GENERIC_PMON_BOX_CTL_FRZ);
 }
 
 void intel_generic_uncore_msr_enable_box(struct intel_uncore_box *box)
 {
-	wrmsrl(uncore_msr_box_ctl(box), 0);
+	wrmsrl(intel_generic_uncore_box_ctl(box), 0);
 }
 
 static void intel_generic_uncore_msr_enable_event(struct intel_uncore_box *box,
@@ -406,10 +479,47 @@
 	.read_counter		= uncore_msr_read_counter,
 };
 
+bool intel_generic_uncore_assign_hw_event(struct perf_event *event,
+					  struct intel_uncore_box *box)
+{
+	struct hw_perf_event *hwc = &event->hw;
+	u64 box_ctl;
+
+	if (!box->pmu->type->boxes)
+		return false;
+
+	if (box->io_addr) {
+		hwc->config_base = uncore_pci_event_ctl(box, hwc->idx);
+		hwc->event_base  = uncore_pci_perf_ctr(box, hwc->idx);
+		return true;
+	}
+
+	box_ctl = intel_generic_uncore_box_ctl(box);
+	if (!box_ctl)
+		return false;
+
+	if (box->pci_dev) {
+		box_ctl = UNCORE_DISCOVERY_PCI_BOX_CTRL(box_ctl);
+		hwc->config_base = box_ctl + uncore_pci_event_ctl(box, hwc->idx);
+		hwc->event_base  = box_ctl + uncore_pci_perf_ctr(box, hwc->idx);
+		return true;
+	}
+
+	hwc->config_base = box_ctl + box->pmu->type->event_ctl + hwc->idx;
+	hwc->event_base  = box_ctl + box->pmu->type->perf_ctr + hwc->idx;
+
+	return true;
+}
+
+static inline int intel_pci_uncore_box_ctl(struct intel_uncore_box *box)
+{
+	return UNCORE_DISCOVERY_PCI_BOX_CTRL(intel_generic_uncore_box_ctl(box));
+}
+
 void intel_generic_uncore_pci_init_box(struct intel_uncore_box *box)
 {
 	struct pci_dev *pdev = box->pci_dev;
-	int box_ctl = uncore_pci_box_ctl(box);
+	int box_ctl = intel_pci_uncore_box_ctl(box);
 
 	__set_bit(UNCORE_BOX_FLAG_CTL_OFFS8, &box->flags);
 	pci_write_config_dword(pdev, box_ctl, GENERIC_PMON_BOX_CTL_INT);
@@ -418,7 +528,7 @@
 void intel_generic_uncore_pci_disable_box(struct intel_uncore_box *box)
 {
 	struct pci_dev *pdev = box->pci_dev;
-	int box_ctl = uncore_pci_box_ctl(box);
+	int box_ctl = intel_pci_uncore_box_ctl(box);
 
 	pci_write_config_dword(pdev, box_ctl, GENERIC_PMON_BOX_CTL_FRZ);
 }
@@ -426,7 +536,7 @@
 void intel_generic_uncore_pci_enable_box(struct intel_uncore_box *box)
 {
 	struct pci_dev *pdev = box->pci_dev;
-	int box_ctl = uncore_pci_box_ctl(box);
+	int box_ctl = intel_pci_uncore_box_ctl(box);
 
 	pci_write_config_dword(pdev, box_ctl, 0);
 }
@@ -473,34 +583,30 @@
 
 #define UNCORE_GENERIC_MMIO_SIZE		0x4000
 
-static u64 generic_uncore_mmio_box_ctl(struct intel_uncore_box *box)
-{
-	struct intel_uncore_type *type = box->pmu->type;
-
-	if (!type->box_ctls || !type->box_ctls[box->dieid] || !type->mmio_offsets)
-		return 0;
-
-	return type->box_ctls[box->dieid] + type->mmio_offsets[box->pmu->pmu_idx];
-}
-
 void intel_generic_uncore_mmio_init_box(struct intel_uncore_box *box)
 {
-	u64 box_ctl = generic_uncore_mmio_box_ctl(box);
+	static struct intel_uncore_discovery_unit *unit;
 	struct intel_uncore_type *type = box->pmu->type;
 	resource_size_t addr;
 
-	if (!box_ctl) {
+	unit = intel_uncore_find_discovery_unit(type->boxes, box->dieid, box->pmu->pmu_idx);
+	if (!unit) {
+		pr_warn("Uncore type %d id %d: Cannot find box control address.\n",
+			type->type_id, box->pmu->pmu_idx);
+		return;
+	}
+
+	if (!unit->addr) {
 		pr_warn("Uncore type %d box %d: Invalid box control address.\n",
-			type->type_id, type->box_ids[box->pmu->pmu_idx]);
+			type->type_id, unit->id);
 		return;
 	}
 
-	addr = box_ctl;
+	addr = unit->addr;
 	box->io_addr = ioremap(addr, UNCORE_GENERIC_MMIO_SIZE);
 	if (!box->io_addr) {
 		pr_warn("Uncore type %d box %d: ioremap error for 0x%llx.\n",
-			type->type_id, type->box_ids[box->pmu->pmu_idx],
-			(unsigned long long)addr);
+			type->type_id, unit->id, (unsigned long long)addr);
 		return;
 	}
 
@@ -560,34 +666,22 @@
 				      struct intel_uncore_discovery_type *type)
 {
 	uncore->type_id = type->type;
-	uncore->num_boxes = type->num_boxes;
 	uncore->num_counters = type->num_counters;
 	uncore->perf_ctr_bits = type->counter_width;
-	uncore->box_ids = type->ids;
+	uncore->perf_ctr = (unsigned int)type->ctr_offset;
+	uncore->event_ctl = (unsigned int)type->ctl_offset;
+	uncore->boxes = &type->units;
+	uncore->num_boxes = type->num_units;
 
 	switch (type_id) {
 	case UNCORE_ACCESS_MSR:
 		uncore->ops = &generic_uncore_msr_ops;
-		uncore->perf_ctr = (unsigned int)type->box_ctrl + type->ctr_offset;
-		uncore->event_ctl = (unsigned int)type->box_ctrl + type->ctl_offset;
-		uncore->box_ctl = (unsigned int)type->box_ctrl;
-		uncore->msr_offsets = type->box_offset;
 		break;
 	case UNCORE_ACCESS_PCI:
 		uncore->ops = &generic_uncore_pci_ops;
-		uncore->perf_ctr = (unsigned int)UNCORE_DISCOVERY_PCI_BOX_CTRL(type->box_ctrl) + type->ctr_offset;
-		uncore->event_ctl = (unsigned int)UNCORE_DISCOVERY_PCI_BOX_CTRL(type->box_ctrl) + type->ctl_offset;
-		uncore->box_ctl = (unsigned int)UNCORE_DISCOVERY_PCI_BOX_CTRL(type->box_ctrl);
-		uncore->box_ctls = type->box_ctrl_die;
-		uncore->pci_offsets = type->box_offset;
 		break;
 	case UNCORE_ACCESS_MMIO:
 		uncore->ops = &generic_uncore_mmio_ops;
-		uncore->perf_ctr = (unsigned int)type->ctr_offset;
-		uncore->event_ctl = (unsigned int)type->ctl_offset;
-		uncore->box_ctl = (unsigned int)type->box_ctrl;
-		uncore->box_ctls = type->box_ctrl_die;
-		uncore->mmio_offsets = type->box_offset;
 		uncore->mmio_map_size = UNCORE_GENERIC_MMIO_SIZE;
 		break;
 	default:
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/uncore_discovery.h
+++ linux-qcom-6.8.0/arch/x86/events/intel/uncore_discovery.h
@@ -113,19 +113,24 @@
 	};
 };
 
+struct intel_uncore_discovery_unit {
+	struct rb_node	node;
+	unsigned int	pmu_idx;	/* The idx of the corresponding PMU */
+	unsigned int	id;		/* Unit ID */
+	unsigned int	die;		/* Die ID */
+	u64		addr;		/* Unit Control Address */
+};
+
 struct intel_uncore_discovery_type {
 	struct rb_node	node;
 	enum uncore_access_type	access_type;
-	u64		box_ctrl;	/* Unit ctrl addr of the first box */
-	u64		*box_ctrl_die;	/* Unit ctrl addr of the first box of each die */
+	struct rb_root	units;		/* Unit ctrl addr for all units */
 	u16		type;		/* Type ID of the uncore block */
 	u8		num_counters;
 	u8		counter_width;
 	u8		ctl_offset;	/* Counter Control 0 offset */
 	u8		ctr_offset;	/* Counter 0 offset */
-	u16		num_boxes;	/* number of boxes for the uncore block */
-	unsigned int	*ids;		/* Box IDs */
-	u64		*box_offset;	/* Box offset */
+	u16		num_units;	/* number of units */
 };
 
 bool intel_uncore_has_discovery_tables(int *ignore);
@@ -156,3 +161,10 @@
 
 struct intel_uncore_type **
 intel_uncore_generic_init_uncores(enum uncore_access_type type_id, int num_extra);
+
+int intel_uncore_find_discovery_unit_id(struct rb_root *units, int die,
+					unsigned int pmu_idx);
+bool intel_generic_uncore_assign_hw_event(struct perf_event *event,
+					  struct intel_uncore_box *box);
+void uncore_find_add_unit(struct intel_uncore_discovery_unit *node,
+			  struct rb_root *root, u16 *num_units);
--- linux-qcom-6.8.0.orig/arch/x86/events/intel/uncore_snbep.c
+++ linux-qcom-6.8.0/arch/x86/events/intel/uncore_snbep.c
@@ -461,6 +461,7 @@
 #define SPR_UBOX_DID				0x3250
 
 /* SPR CHA */
+#define SPR_CHA_EVENT_MASK_EXT			0xffffffff
 #define SPR_CHA_PMON_CTL_TID_EN			(1 << 16)
 #define SPR_CHA_PMON_EVENT_MASK			(SNBEP_PMON_RAW_EVENT_MASK | \
 						 SPR_CHA_PMON_CTL_TID_EN)
@@ -477,6 +478,7 @@
 DEFINE_UNCORE_FORMAT_ATTR(umask_ext2, umask, "config:8-15,32-57");
 DEFINE_UNCORE_FORMAT_ATTR(umask_ext3, umask, "config:8-15,32-39");
 DEFINE_UNCORE_FORMAT_ATTR(umask_ext4, umask, "config:8-15,32-55");
+DEFINE_UNCORE_FORMAT_ATTR(umask_ext5, umask, "config:8-15,32-63");
 DEFINE_UNCORE_FORMAT_ATTR(qor, qor, "config:16");
 DEFINE_UNCORE_FORMAT_ATTR(edge, edge, "config:18");
 DEFINE_UNCORE_FORMAT_ATTR(tid_en, tid_en, "config:19");
@@ -5932,10 +5934,11 @@
 	struct hw_perf_event_extra *reg1 = &event->hw.extra_reg;
 	bool tie_en = !!(event->hw.config & SPR_CHA_PMON_CTL_TID_EN);
 	struct intel_uncore_type *type = box->pmu->type;
+	int id = intel_uncore_find_discovery_unit_id(type->boxes, -1, box->pmu->pmu_idx);
 
 	if (tie_en) {
 		reg1->reg = SPR_C0_MSR_PMON_BOX_FILTER0 +
-			    HSWEP_CBO_MSR_OFFSET * type->box_ids[box->pmu->pmu_idx];
+			    HSWEP_CBO_MSR_OFFSET * id;
 		reg1->config = event->attr.config1 & SPR_CHA_PMON_BOX_FILTER_TID;
 		reg1->idx = 0;
 	}
@@ -5957,7 +5960,7 @@
 
 static struct attribute *spr_uncore_cha_formats_attr[] = {
 	&format_attr_event.attr,
-	&format_attr_umask_ext4.attr,
+	&format_attr_umask_ext5.attr,
 	&format_attr_tid_en2.attr,
 	&format_attr_edge.attr,
 	&format_attr_inv.attr,
@@ -5993,7 +5996,7 @@
 static struct intel_uncore_type spr_uncore_chabox = {
 	.name			= "cha",
 	.event_mask		= SPR_CHA_PMON_EVENT_MASK,
-	.event_mask_ext		= SPR_RAW_EVENT_MASK_EXT,
+	.event_mask_ext		= SPR_CHA_EVENT_MASK_EXT,
 	.num_shared_regs	= 1,
 	.constraints		= skx_uncore_chabox_constraints,
 	.ops			= &spr_uncore_chabox_ops,
@@ -6161,7 +6164,55 @@
 	.name			= "mdf",
 };
 
-#define UNCORE_SPR_NUM_UNCORE_TYPES		12
+static void spr_uncore_mmio_offs8_init_box(struct intel_uncore_box *box)
+{
+	__set_bit(UNCORE_BOX_FLAG_CTL_OFFS8, &box->flags);
+	intel_generic_uncore_mmio_init_box(box);
+}
+
+static struct intel_uncore_ops spr_uncore_mmio_offs8_ops = {
+	.init_box		= spr_uncore_mmio_offs8_init_box,
+	.exit_box		= uncore_mmio_exit_box,
+	.disable_box		= intel_generic_uncore_mmio_disable_box,
+	.enable_box		= intel_generic_uncore_mmio_enable_box,
+	.disable_event		= intel_generic_uncore_mmio_disable_event,
+	.enable_event		= spr_uncore_mmio_enable_event,
+	.read_counter		= uncore_mmio_read_counter,
+};
+
+#define SPR_UNCORE_MMIO_OFFS8_COMMON_FORMAT()			\
+	SPR_UNCORE_COMMON_FORMAT(),				\
+	.ops			= &spr_uncore_mmio_offs8_ops
+
+static struct event_constraint spr_uncore_cxlcm_constraints[] = {
+	UNCORE_EVENT_CONSTRAINT(0x02, 0x0f),
+	UNCORE_EVENT_CONSTRAINT(0x05, 0x0f),
+	UNCORE_EVENT_CONSTRAINT(0x40, 0xf0),
+	UNCORE_EVENT_CONSTRAINT(0x41, 0xf0),
+	UNCORE_EVENT_CONSTRAINT(0x42, 0xf0),
+	UNCORE_EVENT_CONSTRAINT(0x43, 0xf0),
+	UNCORE_EVENT_CONSTRAINT(0x4b, 0xf0),
+	UNCORE_EVENT_CONSTRAINT(0x52, 0xf0),
+	EVENT_CONSTRAINT_END
+};
+
+static struct intel_uncore_type spr_uncore_cxlcm = {
+	SPR_UNCORE_MMIO_OFFS8_COMMON_FORMAT(),
+	.name			= "cxlcm",
+	.constraints		= spr_uncore_cxlcm_constraints,
+};
+
+static struct intel_uncore_type spr_uncore_cxldp = {
+	SPR_UNCORE_MMIO_OFFS8_COMMON_FORMAT(),
+	.name			= "cxldp",
+};
+
+static struct intel_uncore_type spr_uncore_hbm = {
+	SPR_UNCORE_COMMON_FORMAT(),
+	.name			= "hbm",
+};
+
+#define UNCORE_SPR_NUM_UNCORE_TYPES		15
 #define UNCORE_SPR_CHA				0
 #define UNCORE_SPR_IIO				1
 #define UNCORE_SPR_IMC				6
@@ -6185,6 +6236,9 @@
 	NULL,
 	NULL,
 	&spr_uncore_mdf,
+	&spr_uncore_cxlcm,
+	&spr_uncore_cxldp,
+	&spr_uncore_hbm,
 };
 
 /*
@@ -6197,6 +6251,24 @@
 	0, 0x8000, 0x10000, 0x18000
 };
 
+static void spr_extra_boxes_cleanup(struct intel_uncore_type *type)
+{
+	struct intel_uncore_discovery_unit *pos;
+	struct rb_node *node;
+
+	if (!type->boxes)
+		return;
+
+	while (!RB_EMPTY_ROOT(type->boxes)) {
+		node = rb_first(type->boxes);
+		pos = rb_entry(node, struct intel_uncore_discovery_unit, node);
+		rb_erase(node, type->boxes);
+		kfree(pos);
+	}
+	kfree(type->boxes);
+	type->boxes = NULL;
+}
+
 static struct intel_uncore_type spr_uncore_upi = {
 	.event_mask		= SNBEP_PMON_RAW_EVENT_MASK,
 	.event_mask_ext		= SPR_RAW_EVENT_MASK_EXT,
@@ -6211,10 +6283,11 @@
 	.num_counters		= 4,
 	.num_boxes		= SPR_UNCORE_UPI_NUM_BOXES,
 	.perf_ctr_bits		= 48,
-	.perf_ctr		= ICX_UPI_PCI_PMON_CTR0,
-	.event_ctl		= ICX_UPI_PCI_PMON_CTL0,
+	.perf_ctr		= ICX_UPI_PCI_PMON_CTR0 - ICX_UPI_PCI_PMON_BOX_CTL,
+	.event_ctl		= ICX_UPI_PCI_PMON_CTL0 - ICX_UPI_PCI_PMON_BOX_CTL,
 	.box_ctl		= ICX_UPI_PCI_PMON_BOX_CTL,
 	.pci_offsets		= spr_upi_pci_offsets,
+	.cleanup_extra_boxes	= spr_extra_boxes_cleanup,
 };
 
 static struct intel_uncore_type spr_uncore_m3upi = {
@@ -6224,11 +6297,12 @@
 	.num_counters		= 4,
 	.num_boxes		= SPR_UNCORE_UPI_NUM_BOXES,
 	.perf_ctr_bits		= 48,
-	.perf_ctr		= ICX_M3UPI_PCI_PMON_CTR0,
-	.event_ctl		= ICX_M3UPI_PCI_PMON_CTL0,
+	.perf_ctr		= ICX_M3UPI_PCI_PMON_CTR0 - ICX_M3UPI_PCI_PMON_BOX_CTL,
+	.event_ctl		= ICX_M3UPI_PCI_PMON_CTL0 - ICX_M3UPI_PCI_PMON_BOX_CTL,
 	.box_ctl		= ICX_M3UPI_PCI_PMON_BOX_CTL,
 	.pci_offsets		= spr_upi_pci_offsets,
 	.constraints		= icx_uncore_m3upi_constraints,
+	.cleanup_extra_boxes	= spr_extra_boxes_cleanup,
 };
 
 enum perf_uncore_spr_iio_freerunning_type_id {
@@ -6459,18 +6533,21 @@
 static int uncore_type_max_boxes(struct intel_uncore_type **types,
 				 int type_id)
 {
+	struct intel_uncore_discovery_unit *unit;
 	struct intel_uncore_type *type;
-	int i, max = 0;
+	struct rb_node *node;
+	int max = 0;
 
 	type = uncore_find_type_by_id(types, type_id);
 	if (!type)
 		return 0;
 
-	for (i = 0; i < type->num_boxes; i++) {
-		if (type->box_ids[i] > max)
-			max = type->box_ids[i];
-	}
+	for (node = rb_first(type->boxes); node; node = rb_next(node)) {
+		unit = rb_entry(node, struct intel_uncore_discovery_unit, node);
 
+		if (unit->id > max)
+			max = unit->id;
+	}
 	return max + 1;
 }
 
@@ -6512,10 +6589,11 @@
 
 static void spr_update_device_location(int type_id)
 {
+	struct intel_uncore_discovery_unit *unit;
 	struct intel_uncore_type *type;
 	struct pci_dev *dev = NULL;
+	struct rb_root *root;
 	u32 device, devfn;
-	u64 *ctls;
 	int die;
 
 	if (type_id == UNCORE_SPR_UPI) {
@@ -6529,27 +6607,35 @@
 	} else
 		return;
 
-	ctls = kcalloc(__uncore_max_dies, sizeof(u64), GFP_KERNEL);
-	if (!ctls) {
+	root = kzalloc(sizeof(struct rb_root), GFP_KERNEL);
+	if (!root) {
 		type->num_boxes = 0;
 		return;
 	}
+	*root = RB_ROOT;
 
 	while ((dev = pci_get_device(PCI_VENDOR_ID_INTEL, device, dev)) != NULL) {
-		if (devfn != dev->devfn)
-			continue;
 
 		die = uncore_device_to_die(dev);
 		if (die < 0)
 			continue;
 
-		ctls[die] = pci_domain_nr(dev->bus) << UNCORE_DISCOVERY_PCI_DOMAIN_OFFSET |
-			    dev->bus->number << UNCORE_DISCOVERY_PCI_BUS_OFFSET |
-			    devfn << UNCORE_DISCOVERY_PCI_DEVFN_OFFSET |
-			    type->box_ctl;
+		unit = kzalloc(sizeof(*unit), GFP_KERNEL);
+		if (!unit)
+			continue;
+		unit->die = die;
+		unit->id = PCI_SLOT(dev->devfn) - PCI_SLOT(devfn);
+		unit->addr = pci_domain_nr(dev->bus) << UNCORE_DISCOVERY_PCI_DOMAIN_OFFSET |
+			     dev->bus->number << UNCORE_DISCOVERY_PCI_BUS_OFFSET |
+			     devfn << UNCORE_DISCOVERY_PCI_DEVFN_OFFSET |
+			     type->box_ctl;
+
+		unit->pmu_idx = unit->id;
+
+		uncore_find_add_unit(unit, root, NULL);
 	}
 
-	type->box_ctls = ctls;
+	type->boxes = root;
 }
 
 int spr_uncore_pci_init(void)
@@ -6622,7 +6708,7 @@
 };
 
 static struct intel_uncore_type gnr_uncore_b2cxl = {
-	SPR_UNCORE_MMIO_COMMON_FORMAT(),
+	SPR_UNCORE_MMIO_OFFS8_COMMON_FORMAT(),
 	.name			= "b2cxl",
 };
 
--- linux-qcom-6.8.0.orig/arch/x86/events/perf_event.h
+++ linux-qcom-6.8.0/arch/x86/events/perf_event.h
@@ -684,9 +684,15 @@
 	cpumask_t			supported_cpus;
 	union perf_capabilities		intel_cap;
 	u64				intel_ctrl;
-	int				max_pebs_events;
-	int				num_counters;
-	int				num_counters_fixed;
+	u64				pebs_events_mask;
+	union {
+			u64		cntr_mask64;
+			unsigned long	cntr_mask[BITS_TO_LONGS(X86_PMC_IDX_MAX)];
+	};
+	union {
+			u64		fixed_cntr_mask64;
+			unsigned long	fixed_cntr_mask[BITS_TO_LONGS(X86_PMC_IDX_MAX)];
+	};
 	struct event_constraint		unconstrained;
 
 	u64				hw_cache_event_ids
@@ -774,8 +780,14 @@
 	int		(*rdpmc_index)(int index);
 	u64		(*event_map)(int);
 	int		max_events;
-	int		num_counters;
-	int		num_counters_fixed;
+	union {
+			u64		cntr_mask64;
+			unsigned long	cntr_mask[BITS_TO_LONGS(X86_PMC_IDX_MAX)];
+	};
+	union {
+			u64		fixed_cntr_mask64;
+			unsigned long	fixed_cntr_mask[BITS_TO_LONGS(X86_PMC_IDX_MAX)];
+	};
 	int		cntval_bits;
 	u64		cntval_mask;
 	union {
@@ -852,7 +864,7 @@
 			pebs_ept		:1;
 	int		pebs_record_size;
 	int		pebs_buffer_size;
-	int		max_pebs_events;
+	u64		pebs_events_mask;
 	void		(*drain_pebs)(struct pt_regs *regs, struct perf_sample_data *data);
 	struct event_constraint *pebs_constraints;
 	void		(*pebs_aliases)(struct perf_event *event);
@@ -1125,8 +1137,8 @@
 	return x86_pmu.rdpmc_index ? x86_pmu.rdpmc_index(index) : index;
 }
 
-bool check_hw_exists(struct pmu *pmu, int num_counters,
-		     int num_counters_fixed);
+bool check_hw_exists(struct pmu *pmu, unsigned long *cntr_mask,
+		     unsigned long *fixed_cntr_mask);
 
 int x86_add_exclusive(unsigned int what);
 
@@ -1197,8 +1209,27 @@
 
 int x86_pmu_handle_irq(struct pt_regs *regs);
 
-void x86_pmu_show_pmu_cap(int num_counters, int num_counters_fixed,
-			  u64 intel_ctrl);
+void x86_pmu_show_pmu_cap(struct pmu *pmu);
+
+static inline int x86_pmu_num_counters(struct pmu *pmu)
+{
+	return hweight64(hybrid(pmu, cntr_mask64));
+}
+
+static inline int x86_pmu_max_num_counters(struct pmu *pmu)
+{
+	return fls64(hybrid(pmu, cntr_mask64));
+}
+
+static inline int x86_pmu_num_counters_fixed(struct pmu *pmu)
+{
+	return hweight64(hybrid(pmu, fixed_cntr_mask64));
+}
+
+static inline int x86_pmu_max_num_counters_fixed(struct pmu *pmu)
+{
+	return fls64(hybrid(pmu, fixed_cntr_mask64));
+}
 
 extern struct event_constraint emptyconstraint;
 
@@ -1648,6 +1679,17 @@
 	return !!(x86_pmu.flags & PMU_FL_EXCL_ENABLED);
 }
 
+static inline u64 intel_pmu_pebs_mask(u64 cntr_mask)
+{
+	return MAX_PEBS_EVENTS_MASK & cntr_mask;
+}
+
+static inline int intel_pmu_max_num_pebs(struct pmu *pmu)
+{
+	static_assert(MAX_PEBS_EVENTS == 32);
+	return fls((u32)hybrid(pmu, pebs_events_mask));
+}
+
 #else /* CONFIG_CPU_SUP_INTEL */
 
 static inline void reserve_ds_buffers(void)
--- linux-qcom-6.8.0.orig/arch/x86/events/zhaoxin/core.c
+++ linux-qcom-6.8.0/arch/x86/events/zhaoxin/core.c
@@ -530,13 +530,13 @@
 	pr_info("Version check pass!\n");
 
 	x86_pmu.version			= version;
-	x86_pmu.num_counters		= eax.split.num_counters;
+	x86_pmu.cntr_mask64		= GENMASK_ULL(eax.split.num_counters - 1, 0);
 	x86_pmu.cntval_bits		= eax.split.bit_width;
 	x86_pmu.cntval_mask		= (1ULL << eax.split.bit_width) - 1;
 	x86_pmu.events_maskl		= ebx.full;
 	x86_pmu.events_mask_len		= eax.split.mask_length;
 
-	x86_pmu.num_counters_fixed = edx.split.num_counters_fixed;
+	x86_pmu.fixed_cntr_mask64	= GENMASK_ULL(edx.split.num_counters_fixed - 1, 0);
 	x86_add_quirk(zhaoxin_arch_events_quirk);
 
 	switch (boot_cpu_data.x86) {
@@ -604,13 +604,13 @@
 		return -ENODEV;
 	}
 
-	x86_pmu.intel_ctrl = (1 << (x86_pmu.num_counters)) - 1;
-	x86_pmu.intel_ctrl |= ((1LL << x86_pmu.num_counters_fixed)-1) << INTEL_PMC_IDX_FIXED;
+	x86_pmu.intel_ctrl = x86_pmu.cntr_mask64;
+	x86_pmu.intel_ctrl |= x86_pmu.fixed_cntr_mask64 << INTEL_PMC_IDX_FIXED;
 
 	if (x86_pmu.event_constraints) {
 		for_each_event_constraint(c, x86_pmu.event_constraints) {
-			c->idxmsk64 |= (1ULL << x86_pmu.num_counters) - 1;
-			c->weight += x86_pmu.num_counters;
+			c->idxmsk64 |= x86_pmu.cntr_mask64;
+			c->weight += x86_pmu_num_counters(NULL);
 		}
 	}
 
--- linux-qcom-6.8.0.orig/arch/x86/hyperv/hv_init.c
+++ linux-qcom-6.8.0/arch/x86/hyperv/hv_init.c
@@ -35,7 +35,6 @@
 #include <clocksource/hyperv_timer.h>
 #include <linux/highmem.h>
 
-int hyperv_init_cpuhp;
 u64 hv_current_partition_id = ~0ull;
 EXPORT_SYMBOL_GPL(hv_current_partition_id);
 
@@ -607,8 +606,6 @@
 
 	register_syscore_ops(&hv_syscore_ops);
 
-	hyperv_init_cpuhp = cpuhp;
-
 	if (cpuid_ebx(HYPERV_CPUID_FEATURES) & HV_ACCESS_PARTITION_ID)
 		hv_get_partition_id();
 
@@ -637,7 +634,7 @@
 clean_guest_os_id:
 	wrmsrl(HV_X64_MSR_GUEST_OS_ID, 0);
 	hv_ivm_msr_write(HV_X64_MSR_GUEST_OS_ID, 0);
-	cpuhp_remove_state(cpuhp);
+	cpuhp_remove_state(CPUHP_AP_HYPERV_ONLINE);
 free_ghcb_page:
 	free_percpu(hv_ghcb_pg);
 free_vp_assist_page:
--- linux-qcom-6.8.0.orig/arch/x86/hyperv/hv_vtl.c
+++ linux-qcom-6.8.0/arch/x86/hyperv/hv_vtl.c
@@ -12,6 +12,7 @@
 #include <asm/i8259.h>
 #include <asm/mshyperv.h>
 #include <asm/realmode.h>
+#include <../kernel/smpboot.h>
 
 extern struct boot_params boot_params;
 static struct real_mode_header hv_vtl_real_mode_header;
@@ -64,7 +65,7 @@
 	((secondary_startup_64_fn)secondary_startup_64)(&boot_params, &boot_params);
 }
 
-static int hv_vtl_bringup_vcpu(u32 target_vp_index, u64 eip_ignored)
+static int hv_vtl_bringup_vcpu(u32 target_vp_index, int cpu, u64 eip_ignored)
 {
 	u64 status;
 	int ret = 0;
@@ -78,7 +79,9 @@
 	struct ldttss_desc *ldt;
 	struct desc_struct *gdt;
 
-	u64 rsp = current->thread.sp;
+	struct task_struct *idle = idle_thread_get(cpu);
+	u64 rsp = (unsigned long)idle->thread.sp;
+
 	u64 rip = (u64)&hv_vtl_ap_entry;
 
 	native_store_gdt(&gdt_ptr);
@@ -205,7 +208,15 @@
 
 static int hv_vtl_wakeup_secondary_cpu(u32 apicid, unsigned long start_eip)
 {
-	int vp_id;
+	int vp_id, cpu;
+
+	/* Find the logical CPU for the APIC ID */
+	for_each_present_cpu(cpu) {
+		if (arch_match_cpu_phys_id(cpu, apicid))
+			break;
+	}
+	if (cpu >= nr_cpu_ids)
+		return -EINVAL;
 
 	pr_debug("Bringing up CPU with APIC ID %d in VTL2...\n", apicid);
 	vp_id = hv_vtl_apicid_to_vp_id(apicid);
@@ -219,7 +230,7 @@
 		return -EINVAL;
 	}
 
-	return hv_vtl_bringup_vcpu(vp_id, start_eip);
+	return hv_vtl_bringup_vcpu(vp_id, cpu, start_eip);
 }
 
 int __init hv_vtl_early_init(void)
--- linux-qcom-6.8.0.orig/arch/x86/hyperv/ivm.c
+++ linux-qcom-6.8.0/arch/x86/hyperv/ivm.c
@@ -523,9 +523,9 @@
  * transition is complete, hv_vtom_set_host_visibility() marks the pages
  * as "present" again.
  */
-static bool hv_vtom_clear_present(unsigned long kbuffer, int pagecount, bool enc)
+static int hv_vtom_clear_present(unsigned long kbuffer, int pagecount, bool enc)
 {
-	return !set_memory_np(kbuffer, pagecount);
+	return set_memory_np(kbuffer, pagecount);
 }
 
 /*
@@ -536,20 +536,19 @@
  * with host. This function works as wrap of hv_mark_gpa_visibility()
  * with memory base and size.
  */
-static bool hv_vtom_set_host_visibility(unsigned long kbuffer, int pagecount, bool enc)
+static int hv_vtom_set_host_visibility(unsigned long kbuffer, int pagecount, bool enc)
 {
 	enum hv_mem_host_visibility visibility = enc ?
 			VMBUS_PAGE_NOT_VISIBLE : VMBUS_PAGE_VISIBLE_READ_WRITE;
 	u64 *pfn_array;
 	phys_addr_t paddr;
+	int i, pfn, err;
 	void *vaddr;
 	int ret = 0;
-	bool result = true;
-	int i, pfn;
 
 	pfn_array = kmalloc(HV_HYP_PAGE_SIZE, GFP_KERNEL);
 	if (!pfn_array) {
-		result = false;
+		ret = -ENOMEM;
 		goto err_set_memory_p;
 	}
 
@@ -568,10 +567,8 @@
 		if (pfn == HV_MAX_MODIFY_GPA_REP_COUNT || i == pagecount - 1) {
 			ret = hv_mark_gpa_visibility(pfn, pfn_array,
 						     visibility);
-			if (ret) {
-				result = false;
+			if (ret)
 				goto err_free_pfn_array;
-			}
 			pfn = 0;
 		}
 	}
@@ -586,10 +583,11 @@
 	 * order to avoid leaving the memory range in a "broken" state. Setting
 	 * the PRESENT bits shouldn't fail, but return an error if it does.
 	 */
-	if (set_memory_p(kbuffer, pagecount))
-		result = false;
+	err = set_memory_p(kbuffer, pagecount);
+	if (err && !ret)
+		ret = err;
 
-	return result;
+	return ret;
 }
 
 static bool hv_vtom_tlb_flush_required(bool private)
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/acpi.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/acpi.h
@@ -165,6 +165,14 @@
 void x86_default_set_root_pointer(u64 addr);
 u64 x86_default_get_root_pointer(void);
 
+#ifdef CONFIG_XEN_PV
+/* A Xen PV domain needs a special acpi_os_ioremap() handling. */
+extern void __iomem * (*acpi_os_ioremap)(acpi_physical_address phys,
+					 acpi_size size);
+void __iomem *x86_acpi_os_ioremap(acpi_physical_address phys, acpi_size size);
+#define acpi_os_ioremap acpi_os_ioremap
+#endif
+
 #else /* !CONFIG_ACPI */
 
 #define acpi_lapic 0
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/alternative.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/alternative.h
@@ -294,10 +294,10 @@
  * Otherwise, if CPU has feature1, newinstr1 is used.
  * Otherwise, oldinstr is used.
  */
-#define alternative_input_2(oldinstr, newinstr1, ft_flags1, newinstr2,	     \
-			   ft_flags2, input...)				     \
-	asm_inline volatile(ALTERNATIVE_2(oldinstr, newinstr1, ft_flags1,     \
-		newinstr2, ft_flags2)					     \
+#define alternative_input_2(oldinstr, newinstr1, ft_flags1, newinstr2,	\
+			   ft_flags2, input...)				\
+	asm_inline volatile(ALTERNATIVE_2(oldinstr, newinstr1, ft_flags1, \
+		newinstr2, ft_flags2)					\
 		: : "i" (0), ## input)
 
 /* Like alternative_input, but with a single output argument */
@@ -307,7 +307,7 @@
 
 /* Like alternative_io, but for replacing a direct call with another one. */
 #define alternative_call(oldfunc, newfunc, ft_flags, output, input...)	\
-	asm_inline volatile (ALTERNATIVE("call %P[old]", "call %P[new]", ft_flags) \
+	asm_inline volatile (ALTERNATIVE("call %c[old]", "call %c[new]", ft_flags) \
 		: output : [old] "i" (oldfunc), [new] "i" (newfunc), ## input)
 
 /*
@@ -316,12 +316,12 @@
  * Otherwise, if CPU has feature1, function1 is used.
  * Otherwise, old function is used.
  */
-#define alternative_call_2(oldfunc, newfunc1, ft_flags1, newfunc2, ft_flags2,   \
-			   output, input...)				      \
-	asm_inline volatile (ALTERNATIVE_2("call %P[old]", "call %P[new1]", ft_flags1,\
-		"call %P[new2]", ft_flags2)				      \
-		: output, ASM_CALL_CONSTRAINT				      \
-		: [old] "i" (oldfunc), [new1] "i" (newfunc1),		      \
+#define alternative_call_2(oldfunc, newfunc1, ft_flags1, newfunc2, ft_flags2, \
+			   output, input...)				\
+	asm_inline volatile (ALTERNATIVE_2("call %c[old]", "call %c[new1]", ft_flags1, \
+		"call %c[new2]", ft_flags2)				\
+		: output, ASM_CALL_CONSTRAINT				\
+		: [old] "i" (oldfunc), [new1] "i" (newfunc1),		\
 		  [new2] "i" (newfunc2), ## input)
 
 /*
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/amd_nb.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/amd_nb.h
@@ -116,7 +116,10 @@
 
 #define amd_nb_num(x)		0
 #define amd_nb_has_feature(x)	false
-#define node_to_amd_nb(x)	NULL
+static inline struct amd_northbridge *node_to_amd_nb(int node)
+{
+	return NULL;
+}
 #define amd_gart_present(x)	false
 
 #endif
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/apic.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/apic.h
@@ -13,6 +13,7 @@
 #include <asm/mpspec.h>
 #include <asm/msr.h>
 #include <asm/hardirq.h>
+#include <asm/io.h>
 
 #define ARCH_APICTIMER_STOPS_ON_C3	1
 
@@ -96,7 +97,7 @@
 
 static inline u32 native_apic_mem_read(u32 reg)
 {
-	return *((volatile u32 *)(APIC_BASE + reg));
+	return readl((void __iomem *)(APIC_BASE + reg));
 }
 
 static inline void native_apic_mem_eoi(void)
@@ -336,20 +337,12 @@
  * APIC drivers are probed based on how they are listed in the .apicdrivers
  * section. So the order is important and enforced by the ordering
  * of different apic driver files in the Makefile.
- *
- * For the files having two apic drivers, we use apic_drivers()
- * to enforce the order with in them.
  */
 #define apic_driver(sym)					\
 	static const struct apic *__apicdrivers_##sym __used		\
 	__aligned(sizeof(struct apic *))			\
 	__section(".apicdrivers") = { &sym }
 
-#define apic_drivers(sym1, sym2)					\
-	static struct apic *__apicdrivers_##sym1##sym2[2] __used	\
-	__aligned(sizeof(struct apic *))				\
-	__section(".apicdrivers") = { &sym1, &sym2 }
-
 extern struct apic *__apicdrivers[], *__apicdrivers_end[];
 
 /*
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/asm-prototypes.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/asm-prototypes.h
@@ -13,8 +13,12 @@
 #include <asm/preempt.h>
 #include <asm/asm.h>
 #include <asm/gsseg.h>
+#include <asm/nospec-branch.h>
 
 #ifndef CONFIG_X86_CMPXCHG64
 extern void cmpxchg8b_emu(void);
 #endif
 
+#if defined(__GENKSYMS__) && defined(CONFIG_STACKPROTECTOR)
+extern unsigned long __ref_stack_chk_guard;
+#endif
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/asm.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/asm.h
@@ -113,6 +113,20 @@
 
 #endif
 
+#ifndef __ASSEMBLY__
+#ifndef __pic__
+static __always_inline __pure void *rip_rel_ptr(void *p)
+{
+	asm("leaq %c1(%%rip), %0" : "=r"(p) : "i"(p));
+
+	return p;
+}
+#define RIP_REL_REF(var)	(*(typeof(&(var)))rip_rel_ptr(&(var)))
+#else
+#define RIP_REL_REF(var)	(var)
+#endif
+#endif
+
 /*
  * Macros to generate condition code outputs from inline assembly,
  * The output operand must be type "bool".
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/atomic64_32.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/atomic64_32.h
@@ -24,7 +24,7 @@
 
 #ifdef CONFIG_X86_CMPXCHG64
 #define __alternative_atomic64(f, g, out, in...) \
-	asm volatile("call %P[func]" \
+	asm volatile("call %c[func]" \
 		     : out : [func] "i" (atomic64_##g##_cx8), ## in)
 
 #define ATOMIC64_DECL(sym) ATOMIC64_DECL_ONE(sym##_cx8)
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/barrier.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/barrier.h
@@ -79,6 +79,9 @@
 #define __smp_mb__before_atomic()	do { } while (0)
 #define __smp_mb__after_atomic()	do { } while (0)
 
+/* Writing to CR3 provides a full memory barrier in switch_mm(). */
+#define smp_mb__after_switch_mm()	do { } while (0)
+
 #include <asm-generic/barrier.h>
 
 #endif /* _ASM_X86_BARRIER_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/boot.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/boot.h
@@ -81,6 +81,7 @@
 
 #ifndef __ASSEMBLY__
 extern unsigned int output_len;
+extern const unsigned long kernel_text_size;
 extern const unsigned long kernel_total_size;
 
 unsigned long decompress_kernel(unsigned char *outbuf, unsigned long virt_addr,
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/bug.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/bug.h
@@ -13,6 +13,18 @@
 #define INSN_UD2	0x0b0f
 #define LEN_UD2		2
 
+/*
+ * In clang we have UD1s reporting UBSAN failures on X86, 64 and 32bit.
+ */
+#define INSN_ASOP		0x67
+#define OPCODE_ESCAPE		0x0f
+#define SECOND_BYTE_OPCODE_UD1	0xb9
+#define SECOND_BYTE_OPCODE_UD2	0x0b
+
+#define BUG_NONE		0xffff
+#define BUG_UD1			0xfffe
+#define BUG_UD2			0xfffd
+
 #ifdef CONFIG_GENERIC_BUG
 
 #ifdef CONFIG_X86_32
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/cmpxchg_64.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/cmpxchg_64.h
@@ -62,7 +62,7 @@
 	asm volatile(_lock "cmpxchg16b %[ptr]"				\
 		     CC_SET(e)						\
 		     : CC_OUT(e) (ret),					\
-		       [ptr] "+m" (*ptr),				\
+		       [ptr] "+m" (*(_ptr)),				\
 		       "+a" (o.low), "+d" (o.high)			\
 		     : "b" (n.low), "c" (n.high)			\
 		     : "memory");					\
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/coco.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/coco.h
@@ -2,6 +2,7 @@
 #ifndef _ASM_X86_COCO_H
 #define _ASM_X86_COCO_H
 
+#include <asm/asm.h>
 #include <asm/types.h>
 
 enum cc_vendor {
@@ -12,11 +13,18 @@
 
 #ifdef CONFIG_ARCH_HAS_CC_PLATFORM
 extern enum cc_vendor cc_vendor;
-void cc_set_mask(u64 mask);
+extern u64 cc_mask;
+static inline void cc_set_mask(u64 mask)
+{
+	RIP_REL_REF(cc_mask) = mask;
+}
+
 u64 cc_mkenc(u64 val);
 u64 cc_mkdec(u64 val);
+void cc_random_init(void);
 #else
 #define cc_vendor (CC_VENDOR_NONE)
+static const u64 cc_mask = 0;
 
 static inline u64 cc_mkenc(u64 val)
 {
@@ -27,6 +35,7 @@
 {
 	return val;
 }
+static inline void cc_random_init(void) { }
 #endif
 
 #endif /* _ASM_X86_COCO_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/cpu_device_id.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/cpu_device_id.h
@@ -3,6 +3,39 @@
 #define _ASM_X86_CPU_DEVICE_ID
 
 /*
+ * Can't use <linux/bitfield.h> because it generates expressions that
+ * cannot be used in structure initializers. Bitfield construction
+ * here must match the union in struct cpuinfo_86:
+ *	union {
+ *		struct {
+ *			__u8	x86_model;
+ *			__u8	x86;
+ *			__u8	x86_vendor;
+ *			__u8	x86_reserved;
+ *		};
+ *		__u32		x86_vfm;
+ *	};
+ */
+#define VFM_MODEL_BIT	0
+#define VFM_FAMILY_BIT	8
+#define VFM_VENDOR_BIT	16
+#define VFM_RSVD_BIT	24
+
+#define	VFM_MODEL_MASK	GENMASK(VFM_FAMILY_BIT - 1, VFM_MODEL_BIT)
+#define	VFM_FAMILY_MASK	GENMASK(VFM_VENDOR_BIT - 1, VFM_FAMILY_BIT)
+#define	VFM_VENDOR_MASK	GENMASK(VFM_RSVD_BIT - 1, VFM_VENDOR_BIT)
+
+#define VFM_MODEL(vfm)	(((vfm) & VFM_MODEL_MASK) >> VFM_MODEL_BIT)
+#define VFM_FAMILY(vfm)	(((vfm) & VFM_FAMILY_MASK) >> VFM_FAMILY_BIT)
+#define VFM_VENDOR(vfm)	(((vfm) & VFM_VENDOR_MASK) >> VFM_VENDOR_BIT)
+
+#define	VFM_MAKE(_vendor, _family, _model) (	\
+	((_model) << VFM_MODEL_BIT) |		\
+	((_family) << VFM_FAMILY_BIT) |		\
+	((_vendor) << VFM_VENDOR_BIT)		\
+)
+
+/*
  * Declare drivers belonging to specific x86 CPUs
  * Similar in spirit to pci_device_id and related PCI functions
  *
@@ -20,6 +53,9 @@
 #define X86_CENTAUR_FAM6_C7_D		0xd
 #define X86_CENTAUR_FAM6_NANO		0xf
 
+/* x86_cpu_id::flags */
+#define X86_CPU_ID_FLAG_ENTRY_VALID	BIT(0)
+
 #define X86_STEPPINGS(mins, maxs)    GENMASK(maxs, mins)
 /**
  * X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching
@@ -46,6 +82,18 @@
 	.model		= _model,					\
 	.steppings	= _steppings,					\
 	.feature	= _feature,					\
+	.flags		= X86_CPU_ID_FLAG_ENTRY_VALID,			\
+	.driver_data	= (unsigned long) _data				\
+}
+
+#define X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE(_vendor, _family, _model, \
+						    _steppings, _feature, _data) { \
+	.vendor		= _vendor,					\
+	.family		= _family,					\
+	.model		= _model,					\
+	.steppings	= _steppings,					\
+	.feature	= _feature,					\
+	.flags		= X86_CPU_ID_FLAG_ENTRY_VALID,			\
 	.driver_data	= (unsigned long) _data				\
 }
 
@@ -164,6 +212,56 @@
 	X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, INTEL_FAM6_##model, \
 						     steppings, X86_FEATURE_ANY, data)
 
+/**
+ * X86_MATCH_VFM - Match encoded vendor/family/model
+ * @vfm:	Encoded 8-bits each for vendor, family, model
+ * @data:	Driver specific data or NULL. The internal storage
+ *		format is unsigned long. The supplied value, pointer
+ *		etc. is cast to unsigned long internally.
+ *
+ * Stepping and feature are set to wildcards
+ */
+#define X86_MATCH_VFM(vfm, data)			\
+	X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE(	\
+		VFM_VENDOR(vfm),			\
+		VFM_FAMILY(vfm),			\
+		VFM_MODEL(vfm),				\
+		X86_STEPPING_ANY, X86_FEATURE_ANY, data)
+
+/**
+ * X86_MATCH_VFM_STEPPINGS - Match encoded vendor/family/model/stepping
+ * @vfm:	Encoded 8-bits each for vendor, family, model
+ * @steppings:	Bitmask of steppings to match
+ * @data:	Driver specific data or NULL. The internal storage
+ *		format is unsigned long. The supplied value, pointer
+ *		etc. is cast to unsigned long internally.
+ *
+ * feature is set to wildcard
+ */
+#define X86_MATCH_VFM_STEPPINGS(vfm, steppings, data)	\
+	X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE(	\
+		VFM_VENDOR(vfm),			\
+		VFM_FAMILY(vfm),			\
+		VFM_MODEL(vfm),				\
+		steppings, X86_FEATURE_ANY, data)
+
+/**
+ * X86_MATCH_VFM_FEATURE - Match encoded vendor/family/model/feature
+ * @vfm:	Encoded 8-bits each for vendor, family, model
+ * @feature:	A X86_FEATURE bit
+ * @data:	Driver specific data or NULL. The internal storage
+ *		format is unsigned long. The supplied value, pointer
+ *		etc. is cast to unsigned long internally.
+ *
+ * Steppings is set to wildcard
+ */
+#define X86_MATCH_VFM_FEATURE(vfm, feature, data)	\
+	X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE(	\
+		VFM_VENDOR(vfm),			\
+		VFM_FAMILY(vfm),			\
+		VFM_MODEL(vfm),				\
+		X86_STEPPING_ANY, feature, data)
+
 /*
  * Match specific microcode revisions.
  *
@@ -188,6 +286,14 @@
 	.x86_model		= (model),			\
 	.x86_stepping		= (stepping),			\
 	.x86_microcode_rev	= (revision),			\
+}
+
+#define AMD_CPU_DESC(fam, model, stepping, revision) {		\
+	.x86_family		= (fam),			\
+	.x86_vendor		= X86_VENDOR_AMD,		\
+	.x86_model		= (model),			\
+	.x86_stepping		= (stepping),			\
+	.x86_microcode_rev	= (revision),			\
 }
 
 extern const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match);
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/cpufeature.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/cpufeature.h
@@ -33,6 +33,8 @@
 	CPUID_7_EDX,
 	CPUID_8000_001F_EAX,
 	CPUID_8000_0021_EAX,
+	CPUID_LNX_5,
+	NR_CPUID_WORDS,
 };
 
 #define X86_CAP_FMT_NUM "%d:%d"
@@ -91,8 +93,9 @@
 	   CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 18, feature_bit) ||	\
 	   CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 19, feature_bit) ||	\
 	   CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 20, feature_bit) ||	\
+	   CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 21, feature_bit) ||	\
 	   REQUIRED_MASK_CHECK					  ||	\
-	   BUILD_BUG_ON_ZERO(NCAPINTS != 21))
+	   BUILD_BUG_ON_ZERO(NCAPINTS != 22))
 
 #define DISABLED_MASK_BIT_SET(feature_bit)				\
 	 ( CHECK_BIT_IN_MASK_WORD(DISABLED_MASK,  0, feature_bit) ||	\
@@ -116,8 +119,9 @@
 	   CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 18, feature_bit) ||	\
 	   CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 19, feature_bit) ||	\
 	   CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 20, feature_bit) ||	\
+	   CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 21, feature_bit) ||	\
 	   DISABLED_MASK_CHECK					  ||	\
-	   BUILD_BUG_ON_ZERO(NCAPINTS != 21))
+	   BUILD_BUG_ON_ZERO(NCAPINTS != 22))
 
 #define cpu_has(c, bit)							\
 	(__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 :	\
@@ -169,7 +173,7 @@
 static __always_inline bool _static_cpu_has(u16 bit)
 {
 	asm goto(
-		ALTERNATIVE_TERNARY("jmp 6f", %P[feature], "", "jmp %l[t_no]")
+		ALTERNATIVE_TERNARY("jmp 6f", %c[feature], "", "jmp %l[t_no]")
 		".pushsection .altinstr_aux,\"ax\"\n"
 		"6:\n"
 		" testb %[bitnum]," _ASM_RIP(%P[cap_byte]) "\n"
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/cpufeatures.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/cpufeatures.h
@@ -13,7 +13,7 @@
 /*
  * Defines x86 CPU feature bits
  */
-#define NCAPINTS			21	   /* N 32-bit words worth of info */
+#define NCAPINTS			22	   /* N 32-bit words worth of info */
 #define NBUGINTS			2	   /* N 32-bit bug flags */
 
 /*
@@ -215,7 +215,7 @@
 #define X86_FEATURE_SPEC_STORE_BYPASS_DISABLE	( 7*32+23) /* "" Disable Speculative Store Bypass. */
 #define X86_FEATURE_LS_CFG_SSBD		( 7*32+24)  /* "" AMD SSBD implementation via LS_CFG MSR */
 #define X86_FEATURE_IBRS		( 7*32+25) /* Indirect Branch Restricted Speculation */
-#define X86_FEATURE_IBPB		( 7*32+26) /* Indirect Branch Prediction Barrier */
+#define X86_FEATURE_IBPB		( 7*32+26) /* Indirect Branch Prediction Barrier without a guaranteed RSB flush */
 #define X86_FEATURE_STIBP		( 7*32+27) /* Single Thread Indirect Branch Predictors */
 #define X86_FEATURE_ZEN			( 7*32+28) /* "" Generic flag for all Zen and newer */
 #define X86_FEATURE_L1TF_PTEINV		( 7*32+29) /* "" L1TF workaround PTE inversion */
@@ -346,6 +346,7 @@
 #define X86_FEATURE_CPPC		(13*32+27) /* Collaborative Processor Performance Control */
 #define X86_FEATURE_AMD_PSFD            (13*32+28) /* "" Predictive Store Forwarding Disable */
 #define X86_FEATURE_BTC_NO		(13*32+29) /* "" Not vulnerable to Branch Type Confusion */
+#define X86_FEATURE_AMD_IBPB_RET	(13*32+30) /* IBPB clears return address predictor */
 #define X86_FEATURE_BRS			(13*32+31) /* Branch Sampling available */
 
 /* Thermal and Power Management Leaf, CPUID level 0x00000006 (EAX), word 14 */
@@ -359,6 +360,7 @@
 #define X86_FEATURE_HWP_ACT_WINDOW	(14*32+ 9) /* HWP Activity Window */
 #define X86_FEATURE_HWP_EPP		(14*32+10) /* HWP Energy Perf. Preference */
 #define X86_FEATURE_HWP_PKG_REQ		(14*32+11) /* HWP Package Level Request */
+#define X86_FEATURE_HWP_HIGHEST_PERF_CHANGE (14*32+15) /* "" HWP Highest perf change */
 #define X86_FEATURE_HFI			(14*32+19) /* Hardware Feedback Interface */
 
 /* AMD SVM Feature Identification, CPUID level 0x8000000a (EDX), word 15 */
@@ -457,6 +459,17 @@
 #define X86_FEATURE_SRSO_NO		(20*32+29) /* "" CPU is not affected by SRSO */
 
 /*
+ * Extended auxiliary flags: Linux defined - for features scattered in various
+ * CPUID levels like 0x80000022, etc and Linux defined features.
+ *
+ * Reuse free bits when adding new feature flags!
+ */
+#define X86_FEATURE_CLEAR_BHB_LOOP	(21*32+ 1) /* "" Clear branch history at syscall entry using SW loop */
+#define X86_FEATURE_BHI_CTRL		(21*32+ 2) /* "" BHI_DIS_S HW control available */
+#define X86_FEATURE_CLEAR_BHB_HW	(21*32+ 3) /* "" BHI_DIS_S HW control enabled */
+#define X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT (21*32+ 4) /* "" Clear branch history at vmexit using SW loop */
+
+/*
  * BUG word(s)
  */
 #define X86_BUG(x)			(NCAPINTS*32 + (x))
@@ -503,4 +516,7 @@
 /* BUG word 2 */
 #define X86_BUG_SRSO			X86_BUG(1*32 + 0) /* AMD SRSO bug */
 #define X86_BUG_DIV0			X86_BUG(1*32 + 1) /* AMD DIV0 speculation bug */
+#define X86_BUG_RFDS			X86_BUG(1*32 + 2) /* CPU is vulnerable to Register File Data Sampling */
+#define X86_BUG_BHI			X86_BUG(1*32 + 3) /* CPU is affected by Branch History Injection */
+#define X86_BUG_IBPB_NO_RET	   	X86_BUG(1*32 + 4) /* "ibpb_no_ret" IBPB omits return target predictions */
 #endif /* _ASM_X86_CPUFEATURES_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/crash_core.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/crash_core.h
@@ -39,4 +39,6 @@
 #endif
 }
 
+#define HAVE_ARCH_ADD_CRASH_RES_TO_IOMEM_EARLY
+
 #endif /* _X86_CRASH_CORE_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/disabled-features.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/disabled-features.h
@@ -143,6 +143,7 @@
 #define DISABLED_MASK18	(DISABLE_IBT)
 #define DISABLED_MASK19	0
 #define DISABLED_MASK20	0
-#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 21)
+#define DISABLED_MASK21	0
+#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 22)
 
 #endif /* _ASM_X86_DISABLED_FEATURES_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/efi.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/efi.h
@@ -410,7 +410,6 @@
 				   struct efi_memory_map_data *data);
 extern void __efi_memmap_free(u64 phys, unsigned long size,
 			      unsigned long flags);
-#define __efi_memmap_free __efi_memmap_free
 
 extern int __init efi_memmap_install(struct efi_memory_map_data *data);
 extern int __init efi_memmap_split_count(efi_memory_desc_t *md,
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/entry-common.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/entry-common.h
@@ -73,19 +73,16 @@
 #endif
 
 	/*
-	 * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(),
-	 * but not enough for x86 stack utilization comfort. To keep
-	 * reasonable stack head room, reduce the maximum offset to 8 bits.
-	 *
-	 * The actual entropy will be further reduced by the compiler when
-	 * applying stack alignment constraints (see cc_stack_align4/8 in
+	 * This value will get limited by KSTACK_OFFSET_MAX(), which is 10
+	 * bits. The actual entropy will be further reduced by the compiler
+	 * when applying stack alignment constraints (see cc_stack_align4/8 in
 	 * arch/x86/Makefile), which will remove the 3 (x86_64) or 2 (ia32)
 	 * low bits from any entropy chosen here.
 	 *
-	 * Therefore, final stack offset entropy will be 5 (x86_64) or
-	 * 6 (ia32) bits.
+	 * Therefore, final stack offset entropy will be 7 (x86_64) or
+	 * 8 (ia32) bits.
 	 */
-	choose_random_kstack_offset(rdtsc() & 0xFF);
+	choose_random_kstack_offset(rdtsc());
 }
 #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare
 
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/fpu/signal.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/fpu/signal.h
@@ -29,7 +29,7 @@
 
 unsigned long fpu__get_fpstate_size(void);
 
-extern bool copy_fpstate_to_sigframe(void __user *buf, void __user *fp, int size);
+extern bool copy_fpstate_to_sigframe(void __user *buf, void __user *fp, int size, u32 pkru);
 extern void fpu__clear_user_states(struct fpu *fpu);
 extern bool fpu__restore_sig(void __user *buf, int ia32_frame);
 
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/fpu/types.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/fpu/types.h
@@ -591,6 +591,13 @@
 	 * even without XSAVE support, i.e. legacy features FP + SSE
 	 */
 	u64 legacy_features;
+	/*
+	 * @independent_features:
+	 *
+	 * Features that are supported by XSAVES, but not managed as part of
+	 * the FPU core, such as LBR
+	 */
+	u64 independent_features;
 };
 
 /* FPU state configuration information */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/hardirq.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/hardirq.h
@@ -63,7 +63,11 @@
 #define local_softirq_pending_ref       pcpu_hot.softirq_pending
 
 #if IS_ENABLED(CONFIG_KVM_INTEL)
-static inline void kvm_set_cpu_l1tf_flush_l1d(void)
+/*
+ * This function is called from noinstr interrupt contexts
+ * and must be inlined to not get instrumentation.
+ */
+static __always_inline void kvm_set_cpu_l1tf_flush_l1d(void)
 {
 	__this_cpu_write(irq_stat.kvm_cpu_l1tf_flush_l1d, 1);
 }
@@ -78,7 +82,7 @@
 	return __this_cpu_read(irq_stat.kvm_cpu_l1tf_flush_l1d);
 }
 #else /* !IS_ENABLED(CONFIG_KVM_INTEL) */
-static inline void kvm_set_cpu_l1tf_flush_l1d(void) { }
+static __always_inline void kvm_set_cpu_l1tf_flush_l1d(void) { }
 #endif /* IS_ENABLED(CONFIG_KVM_INTEL) */
 
 #endif /* _ASM_X86_HARDIRQ_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/idtentry.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/idtentry.h
@@ -13,15 +13,18 @@
 
 #include <asm/irq_stack.h>
 
+typedef void (*idtentry_t)(struct pt_regs *regs);
+
 /**
  * DECLARE_IDTENTRY - Declare functions for simple IDT entry points
  *		      No error code pushed by hardware
  * @vector:	Vector number (ignored for C)
  * @func:	Function name of the entry point
  *
- * Declares three functions:
+ * Declares four functions:
  * - The ASM entry point: asm_##func
  * - The XEN PV trap entry point: xen_##func (maybe unused)
+ * - The C handler called from the FRED event dispatcher (maybe unused)
  * - The C handler called from the ASM entry point
  *
  * Note: This is the C variant of DECLARE_IDTENTRY(). As the name says it
@@ -31,6 +34,7 @@
 #define DECLARE_IDTENTRY(vector, func)					\
 	asmlinkage void asm_##func(void);				\
 	asmlinkage void xen_asm_##func(void);				\
+	void fred_##func(struct pt_regs *regs);				\
 	__visible void func(struct pt_regs *regs)
 
 /**
@@ -138,6 +142,17 @@
 __visible noinstr void func(struct pt_regs *regs)
 
 /**
+ * DEFINE_FREDENTRY_RAW - Emit code for raw FRED entry points
+ * @func:	Function name of the entry point
+ *
+ * @func is called from the FRED event dispatcher with interrupts disabled.
+ *
+ * See @DEFINE_IDTENTRY_RAW for further details.
+ */
+#define DEFINE_FREDENTRY_RAW(func)					\
+noinstr void fred_##func(struct pt_regs *regs)
+
+/**
  * DECLARE_IDTENTRY_RAW_ERRORCODE - Declare functions for raw IDT entry points
  *				    Error code pushed by hardware
  * @vector:	Vector number (ignored for C)
@@ -197,8 +212,8 @@
 	irqentry_state_t state = irqentry_enter(regs);			\
 	u32 vector = (u32)(u8)error_code;				\
 									\
+	kvm_set_cpu_l1tf_flush_l1d();                                   \
 	instrumentation_begin();					\
-	kvm_set_cpu_l1tf_flush_l1d();					\
 	run_irq_on_irqstack_cond(__##func, regs, vector);		\
 	instrumentation_end();						\
 	irqentry_exit(regs, state);					\
@@ -233,17 +248,27 @@
 #define DEFINE_IDTENTRY_SYSVEC(func)					\
 static void __##func(struct pt_regs *regs);				\
 									\
+static __always_inline void instr_##func(struct pt_regs *regs)		\
+{									\
+	run_sysvec_on_irqstack_cond(__##func, regs);			\
+}									\
+									\
 __visible noinstr void func(struct pt_regs *regs)			\
 {									\
 	irqentry_state_t state = irqentry_enter(regs);			\
 									\
+	kvm_set_cpu_l1tf_flush_l1d();                                   \
 	instrumentation_begin();					\
-	kvm_set_cpu_l1tf_flush_l1d();					\
-	run_sysvec_on_irqstack_cond(__##func, regs);			\
+	instr_##func (regs);						\
 	instrumentation_end();						\
 	irqentry_exit(regs, state);					\
 }									\
 									\
+void fred_##func(struct pt_regs *regs)					\
+{									\
+	instr_##func (regs);						\
+}									\
+									\
 static noinline void __##func(struct pt_regs *regs)
 
 /**
@@ -260,19 +285,29 @@
 #define DEFINE_IDTENTRY_SYSVEC_SIMPLE(func)				\
 static __always_inline void __##func(struct pt_regs *regs);		\
 									\
+static __always_inline void instr_##func(struct pt_regs *regs)		\
+{									\
+	__irq_enter_raw();						\
+	__##func (regs);						\
+	__irq_exit_raw();						\
+}									\
+									\
 __visible noinstr void func(struct pt_regs *regs)			\
 {									\
 	irqentry_state_t state = irqentry_enter(regs);			\
 									\
+	kvm_set_cpu_l1tf_flush_l1d();                                   \
 	instrumentation_begin();					\
-	__irq_enter_raw();						\
-	kvm_set_cpu_l1tf_flush_l1d();					\
-	__##func (regs);						\
-	__irq_exit_raw();						\
+	instr_##func (regs);						\
 	instrumentation_end();						\
 	irqentry_exit(regs, state);					\
 }									\
 									\
+void fred_##func(struct pt_regs *regs)					\
+{									\
+	instr_##func (regs);						\
+}									\
+									\
 static __always_inline void __##func(struct pt_regs *regs)
 
 /**
@@ -410,15 +445,18 @@
 /* C-Code mapping */
 #define DECLARE_IDTENTRY_NMI		DECLARE_IDTENTRY_RAW
 #define DEFINE_IDTENTRY_NMI		DEFINE_IDTENTRY_RAW
+#define DEFINE_FREDENTRY_NMI		DEFINE_FREDENTRY_RAW
 
 #ifdef CONFIG_X86_64
 #define DECLARE_IDTENTRY_MCE		DECLARE_IDTENTRY_IST
 #define DEFINE_IDTENTRY_MCE		DEFINE_IDTENTRY_IST
 #define DEFINE_IDTENTRY_MCE_USER	DEFINE_IDTENTRY_NOIST
+#define DEFINE_FREDENTRY_MCE		DEFINE_FREDENTRY_RAW
 
 #define DECLARE_IDTENTRY_DEBUG		DECLARE_IDTENTRY_IST
 #define DEFINE_IDTENTRY_DEBUG		DEFINE_IDTENTRY_IST
 #define DEFINE_IDTENTRY_DEBUG_USER	DEFINE_IDTENTRY_NOIST
+#define DEFINE_FREDENTRY_DEBUG		DEFINE_FREDENTRY_RAW
 #endif
 
 #else /* !__ASSEMBLY__ */
@@ -655,23 +693,36 @@
 DECLARE_IDTENTRY_SYSVEC(REBOOT_VECTOR,			sysvec_reboot);
 DECLARE_IDTENTRY_SYSVEC(CALL_FUNCTION_SINGLE_VECTOR,	sysvec_call_function_single);
 DECLARE_IDTENTRY_SYSVEC(CALL_FUNCTION_VECTOR,		sysvec_call_function);
+#else
+# define fred_sysvec_reschedule_ipi			NULL
+# define fred_sysvec_reboot				NULL
+# define fred_sysvec_call_function_single		NULL
+# define fred_sysvec_call_function			NULL
 #endif
 
 #ifdef CONFIG_X86_LOCAL_APIC
 # ifdef CONFIG_X86_MCE_THRESHOLD
 DECLARE_IDTENTRY_SYSVEC(THRESHOLD_APIC_VECTOR,		sysvec_threshold);
+# else
+# define fred_sysvec_threshold				NULL
 # endif
 
 # ifdef CONFIG_X86_MCE_AMD
 DECLARE_IDTENTRY_SYSVEC(DEFERRED_ERROR_VECTOR,		sysvec_deferred_error);
+# else
+# define fred_sysvec_deferred_error			NULL
 # endif
 
 # ifdef CONFIG_X86_THERMAL_VECTOR
 DECLARE_IDTENTRY_SYSVEC(THERMAL_APIC_VECTOR,		sysvec_thermal);
+# else
+# define fred_sysvec_thermal				NULL
 # endif
 
 # ifdef CONFIG_IRQ_WORK
 DECLARE_IDTENTRY_SYSVEC(IRQ_WORK_VECTOR,		sysvec_irq_work);
+# else
+# define fred_sysvec_irq_work				NULL
 # endif
 #endif
 
@@ -679,12 +730,16 @@
 DECLARE_IDTENTRY_SYSVEC(POSTED_INTR_VECTOR,		sysvec_kvm_posted_intr_ipi);
 DECLARE_IDTENTRY_SYSVEC(POSTED_INTR_WAKEUP_VECTOR,	sysvec_kvm_posted_intr_wakeup_ipi);
 DECLARE_IDTENTRY_SYSVEC(POSTED_INTR_NESTED_VECTOR,	sysvec_kvm_posted_intr_nested_ipi);
+#else
+# define fred_sysvec_kvm_posted_intr_ipi		NULL
+# define fred_sysvec_kvm_posted_intr_wakeup_ipi		NULL
+# define fred_sysvec_kvm_posted_intr_nested_ipi		NULL
 #endif
 
 #if IS_ENABLED(CONFIG_HYPERV)
 DECLARE_IDTENTRY_SYSVEC(HYPERVISOR_CALLBACK_VECTOR,	sysvec_hyperv_callback);
 DECLARE_IDTENTRY_SYSVEC(HYPERV_REENLIGHTENMENT_VECTOR,	sysvec_hyperv_reenlightenment);
-DECLARE_IDTENTRY_SYSVEC(HYPERV_STIMER0_VECTOR,	sysvec_hyperv_stimer0);
+DECLARE_IDTENTRY_SYSVEC(HYPERV_STIMER0_VECTOR,		sysvec_hyperv_stimer0);
 #endif
 
 #if IS_ENABLED(CONFIG_ACRN_GUEST)
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/intel-family.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/intel-family.h
@@ -40,136 +40,221 @@
  * their own names :-(
  */
 
+#define IFM(_fam, _model)	VFM_MAKE(X86_VENDOR_INTEL, _fam, _model)
+
 /* Wildcard match for FAM6 so X86_MATCH_INTEL_FAM6_MODEL(ANY) works */
 #define INTEL_FAM6_ANY			X86_MODEL_ANY
+/* Wildcard match for FAM6 so X86_MATCH_VFM(ANY) works */
+#define INTEL_ANY			IFM(X86_FAMILY_ANY, X86_MODEL_ANY)
 
 #define INTEL_FAM6_CORE_YONAH		0x0E
+#define INTEL_CORE_YONAH		IFM(6, 0x0E)
 
 #define INTEL_FAM6_CORE2_MEROM		0x0F
+#define INTEL_CORE2_MEROM		IFM(6, 0x0F)
 #define INTEL_FAM6_CORE2_MEROM_L	0x16
+#define INTEL_CORE2_MEROM_L		IFM(6, 0x16)
 #define INTEL_FAM6_CORE2_PENRYN		0x17
+#define INTEL_CORE2_PENRYN		IFM(6, 0x17)
 #define INTEL_FAM6_CORE2_DUNNINGTON	0x1D
+#define INTEL_CORE2_DUNNINGTON		IFM(6, 0x1D)
 
 #define INTEL_FAM6_NEHALEM		0x1E
+#define INTEL_NEHALEM			IFM(6, 0x1E)
 #define INTEL_FAM6_NEHALEM_G		0x1F /* Auburndale / Havendale */
+#define INTEL_NEHALEM_G			IFM(6, 0x1F) /* Auburndale / Havendale */
 #define INTEL_FAM6_NEHALEM_EP		0x1A
+#define INTEL_NEHALEM_EP		IFM(6, 0x1A)
 #define INTEL_FAM6_NEHALEM_EX		0x2E
+#define INTEL_NEHALEM_EX		IFM(6, 0x2E)
 
 #define INTEL_FAM6_WESTMERE		0x25
+#define INTEL_WESTMERE			IFM(6, 0x25)
 #define INTEL_FAM6_WESTMERE_EP		0x2C
+#define INTEL_WESTMERE_EP		IFM(6, 0x2C)
 #define INTEL_FAM6_WESTMERE_EX		0x2F
+#define INTEL_WESTMERE_EX		IFM(6, 0x2F)
 
 #define INTEL_FAM6_SANDYBRIDGE		0x2A
+#define INTEL_SANDYBRIDGE		IFM(6, 0x2A)
 #define INTEL_FAM6_SANDYBRIDGE_X	0x2D
+#define INTEL_SANDYBRIDGE_X		IFM(6, 0x2D)
 #define INTEL_FAM6_IVYBRIDGE		0x3A
+#define INTEL_IVYBRIDGE			IFM(6, 0x3A)
 #define INTEL_FAM6_IVYBRIDGE_X		0x3E
+#define INTEL_IVYBRIDGE_X		IFM(6, 0x3E)
 
 #define INTEL_FAM6_HASWELL		0x3C
+#define INTEL_HASWELL			IFM(6, 0x3C)
 #define INTEL_FAM6_HASWELL_X		0x3F
+#define INTEL_HASWELL_X			IFM(6, 0x3F)
 #define INTEL_FAM6_HASWELL_L		0x45
+#define INTEL_HASWELL_L			IFM(6, 0x45)
 #define INTEL_FAM6_HASWELL_G		0x46
+#define INTEL_HASWELL_G			IFM(6, 0x46)
 
 #define INTEL_FAM6_BROADWELL		0x3D
+#define INTEL_BROADWELL			IFM(6, 0x3D)
 #define INTEL_FAM6_BROADWELL_G		0x47
+#define INTEL_BROADWELL_G		IFM(6, 0x47)
 #define INTEL_FAM6_BROADWELL_X		0x4F
+#define INTEL_BROADWELL_X		IFM(6, 0x4F)
 #define INTEL_FAM6_BROADWELL_D		0x56
+#define INTEL_BROADWELL_D		IFM(6, 0x56)
 
 #define INTEL_FAM6_SKYLAKE_L		0x4E	/* Sky Lake             */
+#define INTEL_SKYLAKE_L			IFM(6, 0x4E) /* Sky Lake */
 #define INTEL_FAM6_SKYLAKE		0x5E	/* Sky Lake             */
+#define INTEL_SKYLAKE			IFM(6, 0x5E) /* Sky Lake */
 #define INTEL_FAM6_SKYLAKE_X		0x55	/* Sky Lake             */
+#define INTEL_SKYLAKE_X			IFM(6, 0x55) /* Sky Lake */
 /*                 CASCADELAKE_X	0x55	   Sky Lake -- s: 7     */
 /*                 COOPERLAKE_X		0x55	   Sky Lake -- s: 11    */
 
 #define INTEL_FAM6_KABYLAKE_L		0x8E	/* Sky Lake             */
+#define INTEL_KABYLAKE_L		IFM(6, 0x8E) /* Sky Lake */
 /*                 AMBERLAKE_L		0x8E	   Sky Lake -- s: 9     */
 /*                 COFFEELAKE_L		0x8E	   Sky Lake -- s: 10    */
 /*                 WHISKEYLAKE_L	0x8E       Sky Lake -- s: 11,12 */
 
 #define INTEL_FAM6_KABYLAKE		0x9E	/* Sky Lake             */
+#define INTEL_KABYLAKE			IFM(6, 0x9E) /* Sky Lake */
 /*                 COFFEELAKE		0x9E	   Sky Lake -- s: 10-13 */
 
 #define INTEL_FAM6_COMETLAKE		0xA5	/* Sky Lake             */
+#define INTEL_COMETLAKE			IFM(6, 0xA5) /* Sky Lake */
 #define INTEL_FAM6_COMETLAKE_L		0xA6	/* Sky Lake             */
+#define INTEL_COMETLAKE_L		IFM(6, 0xA6) /* Sky Lake */
 
 #define INTEL_FAM6_CANNONLAKE_L		0x66	/* Palm Cove */
+#define INTEL_CANNONLAKE_L		IFM(6, 0x66) /* Palm Cove */
 
 #define INTEL_FAM6_ICELAKE_X		0x6A	/* Sunny Cove */
+#define INTEL_ICELAKE_X			IFM(6, 0x6A) /* Sunny Cove */
 #define INTEL_FAM6_ICELAKE_D		0x6C	/* Sunny Cove */
+#define INTEL_ICELAKE_D			IFM(6, 0x6C) /* Sunny Cove */
 #define INTEL_FAM6_ICELAKE		0x7D	/* Sunny Cove */
+#define INTEL_ICELAKE			IFM(6, 0x7D) /* Sunny Cove */
 #define INTEL_FAM6_ICELAKE_L		0x7E	/* Sunny Cove */
+#define INTEL_ICELAKE_L			IFM(6, 0x7E) /* Sunny Cove */
 #define INTEL_FAM6_ICELAKE_NNPI		0x9D	/* Sunny Cove */
+#define INTEL_ICELAKE_NNPI		IFM(6, 0x9D) /* Sunny Cove */
 
 #define INTEL_FAM6_ROCKETLAKE		0xA7	/* Cypress Cove */
+#define INTEL_ROCKETLAKE		IFM(6, 0xA7) /* Cypress Cove */
 
 #define INTEL_FAM6_TIGERLAKE_L		0x8C	/* Willow Cove */
+#define INTEL_TIGERLAKE_L		IFM(6, 0x8C) /* Willow Cove */
 #define INTEL_FAM6_TIGERLAKE		0x8D	/* Willow Cove */
+#define INTEL_TIGERLAKE			IFM(6, 0x8D) /* Willow Cove */
 
 #define INTEL_FAM6_SAPPHIRERAPIDS_X	0x8F	/* Golden Cove */
+#define INTEL_SAPPHIRERAPIDS_X		IFM(6, 0x8F) /* Golden Cove */
 
 #define INTEL_FAM6_EMERALDRAPIDS_X	0xCF
+#define INTEL_EMERALDRAPIDS_X		IFM(6, 0xCF)
 
 #define INTEL_FAM6_GRANITERAPIDS_X	0xAD
+#define INTEL_GRANITERAPIDS_X		IFM(6, 0xAD)
 #define INTEL_FAM6_GRANITERAPIDS_D	0xAE
+#define INTEL_GRANITERAPIDS_D		IFM(6, 0xAE)
 
 /* "Hybrid" Processors (P-Core/E-Core) */
 
 #define INTEL_FAM6_LAKEFIELD		0x8A	/* Sunny Cove / Tremont */
+#define INTEL_LAKEFIELD			IFM(6, 0x8A) /* Sunny Cove / Tremont */
 
 #define INTEL_FAM6_ALDERLAKE		0x97	/* Golden Cove / Gracemont */
+#define INTEL_ALDERLAKE			IFM(6, 0x97) /* Golden Cove / Gracemont */
 #define INTEL_FAM6_ALDERLAKE_L		0x9A	/* Golden Cove / Gracemont */
+#define INTEL_ALDERLAKE_L		IFM(6, 0x9A) /* Golden Cove / Gracemont */
 
 #define INTEL_FAM6_RAPTORLAKE		0xB7	/* Raptor Cove / Enhanced Gracemont */
+#define INTEL_RAPTORLAKE		IFM(6, 0xB7) /* Raptor Cove / Enhanced Gracemont */
 #define INTEL_FAM6_RAPTORLAKE_P		0xBA
+#define INTEL_RAPTORLAKE_P		IFM(6, 0xBA)
 #define INTEL_FAM6_RAPTORLAKE_S		0xBF
+#define INTEL_RAPTORLAKE_S		IFM(6, 0xBF)
 
 #define INTEL_FAM6_METEORLAKE		0xAC
+#define INTEL_METEORLAKE		IFM(6, 0xAC)
 #define INTEL_FAM6_METEORLAKE_L		0xAA
+#define INTEL_METEORLAKE_L		IFM(6, 0xAA)
 
 #define INTEL_FAM6_ARROWLAKE_H		0xC5
+#define INTEL_ARROWLAKE_H		IFM(6, 0xC5)
 #define INTEL_FAM6_ARROWLAKE		0xC6
+#define INTEL_ARROWLAKE			IFM(6, 0xC6)
+#define INTEL_FAM6_ARROWLAKE_U		0xB5
+#define INTEL_ARROWLAKE_U		IFM(6, 0xB5)
 
 #define INTEL_FAM6_LUNARLAKE_M		0xBD
+#define INTEL_LUNARLAKE_M		IFM(6, 0xBD)
 
 /* "Small Core" Processors (Atom/E-Core) */
 
 #define INTEL_FAM6_ATOM_BONNELL		0x1C /* Diamondville, Pineview */
+#define INTEL_ATOM_BONNELL		IFM(6, 0x1C) /* Diamondville, Pineview */
 #define INTEL_FAM6_ATOM_BONNELL_MID	0x26 /* Silverthorne, Lincroft */
+#define INTEL_ATOM_BONNELL_MID		IFM(6, 0x26) /* Silverthorne, Lincroft */
 
 #define INTEL_FAM6_ATOM_SALTWELL	0x36 /* Cedarview */
+#define INTEL_ATOM_SALTWELL		IFM(6, 0x36) /* Cedarview */
 #define INTEL_FAM6_ATOM_SALTWELL_MID	0x27 /* Penwell */
+#define INTEL_ATOM_SALTWELL_MID		IFM(6, 0x27) /* Penwell */
 #define INTEL_FAM6_ATOM_SALTWELL_TABLET	0x35 /* Cloverview */
+#define INTEL_ATOM_SALTWELL_TABLET	IFM(6, 0x35) /* Cloverview */
 
 #define INTEL_FAM6_ATOM_SILVERMONT	0x37 /* Bay Trail, Valleyview */
+#define INTEL_ATOM_SILVERMONT		IFM(6, 0x37) /* Bay Trail, Valleyview */
 #define INTEL_FAM6_ATOM_SILVERMONT_D	0x4D /* Avaton, Rangely */
+#define INTEL_ATOM_SILVERMONT_D		IFM(6, 0x4D) /* Avaton, Rangely */
 #define INTEL_FAM6_ATOM_SILVERMONT_MID	0x4A /* Merriefield */
+#define INTEL_ATOM_SILVERMONT_MID	IFM(6, 0x4A) /* Merriefield */
 
 #define INTEL_FAM6_ATOM_AIRMONT		0x4C /* Cherry Trail, Braswell */
+#define INTEL_ATOM_AIRMONT		IFM(6, 0x4C) /* Cherry Trail, Braswell */
 #define INTEL_FAM6_ATOM_AIRMONT_MID	0x5A /* Moorefield */
+#define INTEL_ATOM_AIRMONT_MID		IFM(6, 0x5A) /* Moorefield */
 #define INTEL_FAM6_ATOM_AIRMONT_NP	0x75 /* Lightning Mountain */
+#define INTEL_ATOM_AIRMONT_NP		IFM(6, 0x75) /* Lightning Mountain */
 
 #define INTEL_FAM6_ATOM_GOLDMONT	0x5C /* Apollo Lake */
+#define INTEL_ATOM_GOLDMONT		IFM(6, 0x5C) /* Apollo Lake */
 #define INTEL_FAM6_ATOM_GOLDMONT_D	0x5F /* Denverton */
+#define INTEL_ATOM_GOLDMONT_D		IFM(6, 0x5F) /* Denverton */
 
 /* Note: the micro-architecture is "Goldmont Plus" */
 #define INTEL_FAM6_ATOM_GOLDMONT_PLUS	0x7A /* Gemini Lake */
+#define INTEL_ATOM_GOLDMONT_PLUS	IFM(6, 0x7A) /* Gemini Lake */
 
 #define INTEL_FAM6_ATOM_TREMONT_D	0x86 /* Jacobsville */
+#define INTEL_ATOM_TREMONT_D		IFM(6, 0x86) /* Jacobsville */
 #define INTEL_FAM6_ATOM_TREMONT		0x96 /* Elkhart Lake */
+#define INTEL_ATOM_TREMONT		IFM(6, 0x96) /* Elkhart Lake */
 #define INTEL_FAM6_ATOM_TREMONT_L	0x9C /* Jasper Lake */
+#define INTEL_ATOM_TREMONT_L		IFM(6, 0x9C) /* Jasper Lake */
 
 #define INTEL_FAM6_ATOM_GRACEMONT	0xBE /* Alderlake N */
+#define INTEL_ATOM_GRACEMONT		IFM(6, 0xBE) /* Alderlake N */
 
 #define INTEL_FAM6_ATOM_CRESTMONT_X	0xAF /* Sierra Forest */
+#define INTEL_ATOM_CRESTMONT_X		IFM(6, 0xAF) /* Sierra Forest */
 #define INTEL_FAM6_ATOM_CRESTMONT	0xB6 /* Grand Ridge */
+#define INTEL_ATOM_CRESTMONT		IFM(6, 0xB6) /* Grand Ridge */
 
 #define INTEL_FAM6_ATOM_DARKMONT_X	0xDD /* Clearwater Forest */
+#define INTEL_ATOM_DARKMONT_X		IFM(6, 0xDD) /* Clearwater Forest */
 
 /* Xeon Phi */
 
 #define INTEL_FAM6_XEON_PHI_KNL		0x57 /* Knights Landing */
+#define INTEL_XEON_PHI_KNL		IFM(6, 0x57) /* Knights Landing */
 #define INTEL_FAM6_XEON_PHI_KNM		0x85 /* Knights Mill */
+#define INTEL_XEON_PHI_KNM		IFM(6, 0x85) /* Knights Mill */
 
 /* Family 5 */
 #define INTEL_FAM5_QUARK_X1000		0x09 /* Quark X1000 SoC */
+#define INTEL_QUARK_X1000		IFM(5, 0x09) /* Quark X1000 SoC */
 
 #endif /* _ASM_X86_INTEL_FAMILY_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/intel_ds.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/intel_ds.h
@@ -9,6 +9,7 @@
 /* The maximal number of PEBS events: */
 #define MAX_PEBS_EVENTS_FMT4	8
 #define MAX_PEBS_EVENTS		32
+#define MAX_PEBS_EVENTS_MASK	GENMASK_ULL(MAX_PEBS_EVENTS - 1, 0)
 #define MAX_FIXED_PEBS_EVENTS	16
 
 /*
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/io.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/io.h
@@ -379,7 +379,7 @@
 	const u8 *end = from + count * 64;
 
 	while (from < end) {
-		movdir64b(dst, from);
+		movdir64b_io(dst, from);
 		from += 64;
 	}
 }
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/irq_stack.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/irq_stack.h
@@ -100,7 +100,7 @@
 }
 
 #define ASM_CALL_ARG0							\
-	"call %P[__func]				\n"		\
+	"call %c[__func]				\n"		\
 	ASM_REACHABLE
 
 #define ASM_CALL_ARG1							\
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/kvm_host.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/kvm_host.h
@@ -26,6 +26,8 @@
 #include <linux/irqbypass.h>
 #include <linux/hyperv.h>
 #include <linux/kfifo.h>
+#include <linux/sched/vhost_task.h>
+#include <linux/call_once.h>
 
 #include <asm/apic.h>
 #include <asm/pvclock-abi.h>
@@ -854,6 +856,7 @@
 	int cpuid_nent;
 	struct kvm_cpuid_entry2 *cpuid_entries;
 	struct kvm_hypervisor_cpuid kvm_cpuid;
+	bool is_amd_compatible;
 
 	/*
 	 * FIXME: Drop this macro and use KVM_NR_GOVERNED_FEATURES directly
@@ -1420,7 +1423,9 @@
 	bool sgx_provisioning_allowed;
 
 	struct kvm_x86_pmu_event_filter __rcu *pmu_event_filter;
-	struct task_struct *nx_huge_page_recovery_thread;
+	struct vhost_task *nx_huge_page_recovery_thread;
+	u64 nx_huge_page_last;
+	struct once nx_once;
 
 #ifdef CONFIG_X86_64
 	/* The number of TDP MMU pages across all roots. */
@@ -1693,6 +1698,8 @@
 	void (*enable_irq_window)(struct kvm_vcpu *vcpu);
 	void (*update_cr8_intercept)(struct kvm_vcpu *vcpu, int tpr, int irr);
 	bool (*check_apicv_inhibit_reasons)(enum kvm_apicv_inhibit reason);
+
+	const bool x2apic_icr_is_split;
 	const unsigned long required_apicv_inhibits;
 	bool allow_apicv_in_x2apic_without_x2apic_virtualization;
 	void (*refresh_apicv_exec_ctrl)(struct kvm_vcpu *vcpu);
@@ -1803,7 +1810,7 @@
 	bool (*is_exception_vmexit)(struct kvm_vcpu *vcpu, u8 vector,
 				    u32 error_code);
 	int (*check_events)(struct kvm_vcpu *vcpu);
-	bool (*has_events)(struct kvm_vcpu *vcpu);
+	bool (*has_events)(struct kvm_vcpu *vcpu, bool for_injection);
 	void (*triple_fault)(struct kvm_vcpu *vcpu);
 	int (*get_state)(struct kvm_vcpu *vcpu,
 			 struct kvm_nested_state __user *user_kvm_nested_state,
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/mem_encrypt.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/mem_encrypt.h
@@ -15,7 +15,8 @@
 #include <linux/init.h>
 #include <linux/cc_platform.h>
 
-#include <asm/bootparam.h>
+#include <asm/asm.h>
+struct boot_params;
 
 #ifdef CONFIG_X86_MEM_ENCRYPT
 void __init mem_encrypt_init(void);
@@ -46,8 +47,8 @@
 
 void __init sme_early_init(void);
 
-void __init sme_encrypt_kernel(struct boot_params *bp);
-void __init sme_enable(struct boot_params *bp);
+void sme_encrypt_kernel(struct boot_params *bp);
+void sme_enable(struct boot_params *bp);
 
 int __init early_set_memory_decrypted(unsigned long vaddr, unsigned long size);
 int __init early_set_memory_encrypted(unsigned long vaddr, unsigned long size);
@@ -58,6 +59,11 @@
 
 void __init sev_es_init_vc_handling(void);
 
+static inline u64 sme_get_me_mask(void)
+{
+	return RIP_REL_REF(sme_me_mask);
+}
+
 #define __bss_decrypted __section(".bss..decrypted")
 
 #else	/* !CONFIG_AMD_MEM_ENCRYPT */
@@ -75,8 +81,8 @@
 
 static inline void __init sme_early_init(void) { }
 
-static inline void __init sme_encrypt_kernel(struct boot_params *bp) { }
-static inline void __init sme_enable(struct boot_params *bp) { }
+static inline void sme_encrypt_kernel(struct boot_params *bp) { }
+static inline void sme_enable(struct boot_params *bp) { }
 
 static inline void sev_es_init_vc_handling(void) { }
 
@@ -89,6 +95,8 @@
 
 static inline void mem_encrypt_free_decrypted_mem(void) { }
 
+static inline u64 sme_get_me_mask(void) { return 0; }
+
 #define __bss_decrypted
 
 #endif	/* CONFIG_AMD_MEM_ENCRYPT */
@@ -106,11 +114,6 @@
 
 extern char __start_bss_decrypted[], __end_bss_decrypted[], __start_bss_decrypted_unused[];
 
-static inline u64 sme_get_me_mask(void)
-{
-	return sme_me_mask;
-}
-
 #endif	/* __ASSEMBLY__ */
 
 #endif	/* __X86_MEM_ENCRYPT_H__ */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/mshyperv.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/mshyperv.h
@@ -40,7 +40,6 @@
 }
 
 #if IS_ENABLED(CONFIG_HYPERV)
-extern int hyperv_init_cpuhp;
 extern bool hyperv_paravisor_present;
 
 extern void *hv_hypercall_pg;
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/msr-index.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/msr-index.h
@@ -50,10 +50,13 @@
 #define SPEC_CTRL_SSBD			BIT(SPEC_CTRL_SSBD_SHIFT)	/* Speculative Store Bypass Disable */
 #define SPEC_CTRL_RRSBA_DIS_S_SHIFT	6	   /* Disable RRSBA behavior */
 #define SPEC_CTRL_RRSBA_DIS_S		BIT(SPEC_CTRL_RRSBA_DIS_S_SHIFT)
+#define SPEC_CTRL_BHI_DIS_S_SHIFT	10	   /* Disable Branch History Injection behavior */
+#define SPEC_CTRL_BHI_DIS_S		BIT(SPEC_CTRL_BHI_DIS_S_SHIFT)
 
 /* A mask for bits which the kernel toggles when controlling mitigations */
 #define SPEC_CTRL_MITIGATIONS_MASK	(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD \
-							| SPEC_CTRL_RRSBA_DIS_S)
+							| SPEC_CTRL_RRSBA_DIS_S \
+							| SPEC_CTRL_BHI_DIS_S)
 
 #define MSR_IA32_PRED_CMD		0x00000049 /* Prediction Command */
 #define PRED_CMD_IBPB			BIT(0)	   /* Indirect Branch Prediction Barrier */
@@ -152,6 +155,10 @@
 						 * are restricted to targets in
 						 * kernel.
 						 */
+#define ARCH_CAP_BHI_NO			BIT(20)	/*
+						 * CPU is not affected by Branch
+						 * History Injection.
+						 */
 #define ARCH_CAP_PBRSB_NO		BIT(24)	/*
 						 * Not susceptible to Post-Barrier
 						 * Return Stack Buffer Predictions.
@@ -165,6 +172,14 @@
 						 * CPU is not vulnerable to Gather
 						 * Data Sampling (GDS).
 						 */
+#define ARCH_CAP_RFDS_NO		BIT(27)	/*
+						 * Not susceptible to Register
+						 * File Data Sampling.
+						 */
+#define ARCH_CAP_RFDS_CLEAR		BIT(28)	/*
+						 * VERW clears CPU Register
+						 * File.
+						 */
 
 #define ARCH_CAP_XAPIC_DISABLE		BIT(21)	/*
 						 * IA32_XAPIC_DISABLE_STATUS MSR
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/nospec-branch.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/nospec-branch.h
@@ -271,11 +271,20 @@
 .Lskip_rsb_\@:
 .endm
 
+/*
+ * The CALL to srso_alias_untrain_ret() must be patched in directly at
+ * the spot where untraining must be done, ie., srso_alias_untrain_ret()
+ * must be the target of a CALL instruction instead of indirectly
+ * jumping to a wrapper which then calls it. Therefore, this macro is
+ * called outside of __UNTRAIN_RET below, for the time being, before the
+ * kernel can support nested alternatives with arbitrary nesting.
+ */
+.macro CALL_UNTRAIN_RET
 #if defined(CONFIG_CPU_UNRET_ENTRY) || defined(CONFIG_CPU_SRSO)
-#define CALL_UNTRAIN_RET	"call entry_untrain_ret"
-#else
-#define CALL_UNTRAIN_RET	""
+	ALTERNATIVE_2 "", "call entry_untrain_ret", X86_FEATURE_UNRET, \
+		          "call srso_alias_untrain_ret", X86_FEATURE_SRSO_ALIAS
 #endif
+.endm
 
 /*
  * Mitigate RETBleed for AMD/Hygon Zen uarch. Requires KERNEL CR3 because the
@@ -291,8 +300,8 @@
 .macro __UNTRAIN_RET ibpb_feature, call_depth_insns
 #if defined(CONFIG_RETHUNK) || defined(CONFIG_CPU_IBPB_ENTRY)
 	VALIDATE_UNRET_END
-	ALTERNATIVE_3 "",						\
-		      CALL_UNTRAIN_RET, X86_FEATURE_UNRET,		\
+	CALL_UNTRAIN_RET
+	ALTERNATIVE_2 "",						\
 		      "call entry_ibpb", \ibpb_feature,			\
 		     __stringify(\call_depth_insns), X86_FEATURE_CALL_DEPTH
 #endif
@@ -323,9 +332,31 @@
  * Note: Only the memory operand variant of VERW clears the CPU buffers.
  */
 .macro CLEAR_CPU_BUFFERS
-	ALTERNATIVE "", __stringify(verw _ASM_RIP(mds_verw_sel)), X86_FEATURE_CLEAR_CPU_BUF
+#ifdef CONFIG_X86_64
+	ALTERNATIVE "", "verw mds_verw_sel(%rip)", X86_FEATURE_CLEAR_CPU_BUF
+#else
+	/*
+	 * In 32bit mode, the memory operand must be a %cs reference. The data
+	 * segments may not be usable (vm86 mode), and the stack segment may not
+	 * be flat (ESPFIX32).
+	 */
+	ALTERNATIVE "", "verw %cs:mds_verw_sel", X86_FEATURE_CLEAR_CPU_BUF
+#endif
+.endm
+
+#ifdef CONFIG_X86_64
+.macro CLEAR_BRANCH_HISTORY
+	ALTERNATIVE "", "call clear_bhb_loop", X86_FEATURE_CLEAR_BHB_LOOP
 .endm
 
+.macro CLEAR_BRANCH_HISTORY_VMEXIT
+	ALTERNATIVE "", "call clear_bhb_loop", X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT
+.endm
+#else
+#define CLEAR_BRANCH_HISTORY
+#define CLEAR_BRANCH_HISTORY_VMEXIT
+#endif
+
 #else /* __ASSEMBLY__ */
 
 #define ANNOTATE_RETPOLINE_SAFE					\
@@ -351,6 +382,8 @@
 static inline void retbleed_return_thunk(void) {}
 #endif
 
+extern void srso_alias_untrain_ret(void);
+
 #ifdef CONFIG_CPU_SRSO
 extern void srso_return_thunk(void);
 extern void srso_alias_return_thunk(void);
@@ -366,6 +399,10 @@
 extern void entry_untrain_ret(void);
 extern void entry_ibpb(void);
 
+#ifdef CONFIG_X86_64
+extern void clear_bhb_loop(void);
+#endif
+
 extern void (*x86_return_thunk)(void);
 
 #ifdef CONFIG_CALL_DEPTH_TRACKING
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/page.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/page.h
@@ -66,10 +66,14 @@
  * virt_addr_valid(kaddr) returns true.
  */
 #define virt_to_page(kaddr)	pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
-#define pfn_to_kaddr(pfn)      __va((pfn) << PAGE_SHIFT)
 extern bool __virt_addr_valid(unsigned long kaddr);
 #define virt_addr_valid(kaddr)	__virt_addr_valid((unsigned long) (kaddr))
 
+static __always_inline void *pfn_to_kaddr(unsigned long pfn)
+{
+	return __va(pfn << PAGE_SHIFT);
+}
+
 static __always_inline u64 __canonical_address(u64 vaddr, u8 vaddr_bits)
 {
 	return ((s64)vaddr << (64 - vaddr_bits)) >> (64 - vaddr_bits);
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/page_64.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/page_64.h
@@ -17,6 +17,7 @@
 extern unsigned long page_offset_base;
 extern unsigned long vmalloc_base;
 extern unsigned long vmemmap_base;
+extern unsigned long physmem_end;
 
 static __always_inline unsigned long __phys_addr_nodebug(unsigned long x)
 {
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/pci-direct.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/pci-direct.h
@@ -10,9 +10,11 @@
 extern u32 read_pci_config(u8 bus, u8 slot, u8 func, u8 offset);
 extern u8 read_pci_config_byte(u8 bus, u8 slot, u8 func, u8 offset);
 extern u16 read_pci_config_16(u8 bus, u8 slot, u8 func, u8 offset);
+extern u32 pci_early_find_cap(int bus, int slot, int func, int cap);
 extern void write_pci_config(u8 bus, u8 slot, u8 func, u8 offset, u32 val);
 extern void write_pci_config_byte(u8 bus, u8 slot, u8 func, u8 offset, u8 val);
 extern void write_pci_config_16(u8 bus, u8 slot, u8 func, u8 offset, u16 val);
 
+extern unsigned int pci_early_clear_msi;
 extern int early_pci_allowed(void);
 #endif /* _ASM_X86_PCI_DIRECT_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/pgtable.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/pgtable.h
@@ -141,6 +141,11 @@
 	return pte_flags(pte) & _PAGE_ACCESSED;
 }
 
+static inline bool pte_decrypted(pte_t pte)
+{
+	return cc_mkdec(pte_val(pte)) == pte_val(pte);
+}
+
 #define pmd_dirty pmd_dirty
 static inline bool pmd_dirty(pmd_t pmd)
 {
@@ -388,23 +393,7 @@
 #ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP
 static inline int pte_uffd_wp(pte_t pte)
 {
-	bool wp = pte_flags(pte) & _PAGE_UFFD_WP;
-
-#ifdef CONFIG_DEBUG_VM
-	/*
-	 * Having write bit for wr-protect-marked present ptes is fatal,
-	 * because it means the uffd-wp bit will be ignored and write will
-	 * just go through.
-	 *
-	 * Use any chance of pgtable walking to verify this (e.g., when
-	 * page swapped out or being migrated for all purposes). It means
-	 * something is already wrong.  Tell the admin even before the
-	 * process crashes. We also nail it with wrong pgtable setup.
-	 */
-	WARN_ON_ONCE(wp && pte_write(pte));
-#endif
-
-	return wp;
+	return pte_flags(pte) & _PAGE_UFFD_WP;
 }
 
 static inline pte_t pte_mkuffd_wp(pte_t pte)
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/pgtable_64_types.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/pgtable_64_types.h
@@ -140,6 +140,10 @@
 # define VMEMMAP_START		__VMEMMAP_BASE_L4
 #endif /* CONFIG_DYNAMIC_MEMORY_LAYOUT */
 
+#ifdef CONFIG_RANDOMIZE_MEMORY
+# define PHYSMEM_END		physmem_end
+#endif
+
 /*
  * End of the region for which vmalloc page tables are pre-allocated.
  * For non-KMSAN builds, this is the same as VMALLOC_END.
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/pgtable_types.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/pgtable_types.h
@@ -36,10 +36,12 @@
 #define _PAGE_BIT_DEVMAP	_PAGE_BIT_SOFTW4
 
 #ifdef CONFIG_X86_64
-#define _PAGE_BIT_SAVED_DIRTY	_PAGE_BIT_SOFTW5 /* Saved Dirty bit */
+#define _PAGE_BIT_SAVED_DIRTY	_PAGE_BIT_SOFTW5 /* Saved Dirty bit (leaf) */
+#define _PAGE_BIT_NOPTISHADOW	_PAGE_BIT_SOFTW5 /* No PTI shadow (root PGD) */
 #else
 /* Shared with _PAGE_BIT_UFFD_WP which is not supported on 32 bit */
-#define _PAGE_BIT_SAVED_DIRTY	_PAGE_BIT_SOFTW2 /* Saved Dirty bit */
+#define _PAGE_BIT_SAVED_DIRTY	_PAGE_BIT_SOFTW2 /* Saved Dirty bit (leaf) */
+#define _PAGE_BIT_NOPTISHADOW	_PAGE_BIT_SOFTW2 /* No PTI shadow (root PGD) */
 #endif
 
 /* If _PAGE_BIT_PRESENT is clear, we use these: */
@@ -139,6 +141,8 @@
 
 #define _PAGE_PROTNONE	(_AT(pteval_t, 1) << _PAGE_BIT_PROTNONE)
 
+#define _PAGE_NOPTISHADOW (_AT(pteval_t, 1) << _PAGE_BIT_NOPTISHADOW)
+
 /*
  * Set of bits not changed in pte_modify.  The pte's
  * protection key is treated like _PAGE_RW, for
@@ -148,7 +152,7 @@
 #define _COMMON_PAGE_CHG_MASK	(PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT |	\
 				 _PAGE_SPECIAL | _PAGE_ACCESSED |	\
 				 _PAGE_DIRTY_BITS | _PAGE_SOFT_DIRTY |	\
-				 _PAGE_DEVMAP | _PAGE_ENC | _PAGE_UFFD_WP)
+				 _PAGE_DEVMAP | _PAGE_CC | _PAGE_UFFD_WP)
 #define _PAGE_CHG_MASK	(_COMMON_PAGE_CHG_MASK | _PAGE_PAT)
 #define _HPAGE_CHG_MASK (_COMMON_PAGE_CHG_MASK | _PAGE_PSE | _PAGE_PAT_LARGE)
 
@@ -173,6 +177,7 @@
 };
 #endif
 
+#define _PAGE_CC		(_AT(pteval_t, cc_mask))
 #define _PAGE_ENC		(_AT(pteval_t, sme_me_mask))
 
 #define _PAGE_CACHE_MASK	(_PAGE_PWT | _PAGE_PCD | _PAGE_PAT)
@@ -566,6 +571,8 @@
 extern pte_t *lookup_address(unsigned long address, unsigned int *level);
 extern pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
 				    unsigned int *level);
+pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
+				  unsigned int *level, bool *nx, bool *rw);
 extern pmd_t *lookup_pmd_address(unsigned long address);
 extern phys_addr_t slow_virt_to_phys(void *__address);
 extern int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn,
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/posted_intr.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/posted_intr.h
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _X86_POSTED_INTR_H
+#define _X86_POSTED_INTR_H
+
+#define POSTED_INTR_ON  0
+#define POSTED_INTR_SN  1
+
+#define PID_TABLE_ENTRY_VALID 1
+
+/* Posted-Interrupt Descriptor */
+struct pi_desc {
+	u32 pir[8];     /* Posted interrupt requested */
+	union {
+		struct {
+				/* bit 256 - Outstanding Notification */
+			u16	on	: 1,
+				/* bit 257 - Suppress Notification */
+				sn	: 1,
+				/* bit 271:258 - Reserved */
+				rsvd_1	: 14;
+				/* bit 279:272 - Notification Vector */
+			u8	nv;
+				/* bit 287:280 - Reserved */
+			u8	rsvd_2;
+				/* bit 319:288 - Notification Destination */
+			u32	ndst;
+		};
+		u64 control;
+	};
+	u32 rsvd[6];
+} __aligned(64);
+
+static inline bool pi_test_and_set_on(struct pi_desc *pi_desc)
+{
+	return test_and_set_bit(POSTED_INTR_ON, (unsigned long *)&pi_desc->control);
+}
+
+static inline bool pi_test_and_clear_on(struct pi_desc *pi_desc)
+{
+	return test_and_clear_bit(POSTED_INTR_ON, (unsigned long *)&pi_desc->control);
+}
+
+static inline bool pi_test_and_clear_sn(struct pi_desc *pi_desc)
+{
+	return test_and_clear_bit(POSTED_INTR_SN, (unsigned long *)&pi_desc->control);
+}
+
+static inline bool pi_test_and_set_pir(int vector, struct pi_desc *pi_desc)
+{
+	return test_and_set_bit(vector, (unsigned long *)pi_desc->pir);
+}
+
+static inline bool pi_is_pir_empty(struct pi_desc *pi_desc)
+{
+	return bitmap_empty((unsigned long *)pi_desc->pir, NR_VECTORS);
+}
+
+static inline void pi_set_sn(struct pi_desc *pi_desc)
+{
+	set_bit(POSTED_INTR_SN, (unsigned long *)&pi_desc->control);
+}
+
+static inline void pi_set_on(struct pi_desc *pi_desc)
+{
+	set_bit(POSTED_INTR_ON, (unsigned long *)&pi_desc->control);
+}
+
+static inline void pi_clear_on(struct pi_desc *pi_desc)
+{
+	clear_bit(POSTED_INTR_ON, (unsigned long *)&pi_desc->control);
+}
+
+static inline void pi_clear_sn(struct pi_desc *pi_desc)
+{
+	clear_bit(POSTED_INTR_SN, (unsigned long *)&pi_desc->control);
+}
+
+static inline bool pi_test_on(struct pi_desc *pi_desc)
+{
+	return test_bit(POSTED_INTR_ON, (unsigned long *)&pi_desc->control);
+}
+
+static inline bool pi_test_sn(struct pi_desc *pi_desc)
+{
+	return test_bit(POSTED_INTR_SN, (unsigned long *)&pi_desc->control);
+}
+
+#endif /* _X86_POSTED_INTR_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/processor.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/processor.h
@@ -106,9 +106,23 @@
 };
 
 struct cpuinfo_x86 {
-	__u8			x86;		/* CPU family */
-	__u8			x86_vendor;	/* CPU vendor */
-	__u8			x86_model;
+	union {
+		/*
+		 * The particular ordering (low-to-high) of (vendor,
+		 * family, model) is done in case range of models, like
+		 * it is usually done on AMD, need to be compared.
+		 */
+		struct {
+			__u8	x86_model;
+			/* CPU family */
+			__u8	x86;
+			/* CPU vendor */
+			__u8	x86_vendor;
+			__u8	x86_reserved;
+		};
+		/* combined vendor, family, model */
+		__u32		x86_vfm;
+	};
 	__u8			x86_stepping;
 #ifdef CONFIG_X86_64
 	/* Number of 4K pages in DTLB/ITLB combined(in pages): */
@@ -205,6 +219,8 @@
 	return BIT_ULL(boot_cpu_data.x86_cache_bits - 1 - PAGE_SHIFT);
 }
 
+void init_cpu_devs(void);
+void get_cpu_vendor(struct cpuinfo_x86 *c);
 extern void early_cpu_init(void);
 extern void identify_secondary_cpu(struct cpuinfo_x86 *);
 extern void print_cpu_info(struct cpuinfo_x86 *);
@@ -479,7 +495,6 @@
 	unsigned long		iopl_emul;
 
 	unsigned int		iopl_warn:1;
-	unsigned int		sig_on_uaccess_err:1;
 
 	/*
 	 * Protection Keys Register for Userspace.  Loaded immediately on
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/ptrace.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/ptrace.h
@@ -56,18 +56,64 @@
 
 #else /* __i386__ */
 
+struct fred_cs {
+		/* CS selector */
+	u64	cs	: 16,
+		/* Stack level at event time */
+		sl	:  2,
+		/* IBT in WAIT_FOR_ENDBRANCH state */
+		wfe	:  1,
+			: 45;
+};
+
+struct fred_ss {
+		/* SS selector */
+	u64	ss	: 16,
+		/* STI state */
+		sti	:  1,
+		/* Set if syscall, sysenter or INT n */
+		swevent	:  1,
+		/* Event is NMI type */
+		nmi	:  1,
+			: 13,
+		/* Event vector */
+		vector	:  8,
+			:  8,
+		/* Event type */
+		type	:  4,
+			:  4,
+		/* Event was incident to enclave execution */
+		enclave	:  1,
+		/* CPU was in long mode */
+		lm	:  1,
+		/*
+		 * Nested exception during FRED delivery, not set
+		 * for #DF.
+		 */
+		nested	:  1,
+			:  1,
+		/*
+		 * The length of the instruction causing the event.
+		 * Only set for INTO, INT1, INT3, INT n, SYSCALL
+		 * and SYSENTER.  0 otherwise.
+		 */
+		insnlen	:  4;
+};
+
 struct pt_regs {
-/*
- * C ABI says these regs are callee-preserved. They aren't saved on kernel entry
- * unless syscall needs a complete, fully filled "struct pt_regs".
- */
+	/*
+	 * C ABI says these regs are callee-preserved. They aren't saved on
+	 * kernel entry unless syscall needs a complete, fully filled
+	 * "struct pt_regs".
+	 */
 	unsigned long r15;
 	unsigned long r14;
 	unsigned long r13;
 	unsigned long r12;
 	unsigned long bp;
 	unsigned long bx;
-/* These regs are callee-clobbered. Always saved on kernel entry. */
+
+	/* These regs are callee-clobbered. Always saved on kernel entry. */
 	unsigned long r11;
 	unsigned long r10;
 	unsigned long r9;
@@ -77,18 +123,50 @@
 	unsigned long dx;
 	unsigned long si;
 	unsigned long di;
-/*
- * On syscall entry, this is syscall#. On CPU exception, this is error code.
- * On hw interrupt, it's IRQ number:
- */
+
+	/*
+	 * orig_ax is used on entry for:
+	 * - the syscall number (syscall, sysenter, int80)
+	 * - error_code stored by the CPU on traps and exceptions
+	 * - the interrupt number for device interrupts
+	 *
+	 * A FRED stack frame starts here:
+	 *   1) It _always_ includes an error code;
+	 *
+	 *   2) The return frame for ERET[US] starts here, but
+	 *      the content of orig_ax is ignored.
+	 */
 	unsigned long orig_ax;
-/* Return frame for iretq */
+
+	/* The IRETQ return frame starts here */
 	unsigned long ip;
-	unsigned long cs;
+
+	union {
+		/* CS selector */
+		u16		cs;
+		/* The extended 64-bit data slot containing CS */
+		u64		csx;
+		/* The FRED CS extension */
+		struct fred_cs	fred_cs;
+	};
+
 	unsigned long flags;
 	unsigned long sp;
-	unsigned long ss;
-/* top of stack page */
+
+	union {
+		/* SS selector */
+		u16		ss;
+		/* The extended 64-bit data slot containing SS */
+		u64		ssx;
+		/* The FRED SS extension */
+		struct fred_ss	fred_ss;
+	};
+
+	/*
+	 * Top of stack on IDT systems, while FRED systems have extra fields
+	 * defined above for storing exception related information, e.g. CR2 or
+	 * DR6.
+	 */
 };
 
 #endif /* !__i386__ */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/qspinlock.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/qspinlock.h
@@ -66,13 +66,15 @@
 
 #ifdef CONFIG_PARAVIRT
 /*
- * virt_spin_lock_key - enables (by default) the virt_spin_lock() hijack.
+ * virt_spin_lock_key - disables by default the virt_spin_lock() hijack.
  *
- * Native (and PV wanting native due to vCPU pinning) should disable this key.
- * It is done in this backwards fashion to only have a single direction change,
- * which removes ordering between native_pv_spin_init() and HV setup.
+ * Native (and PV wanting native due to vCPU pinning) should keep this key
+ * disabled. Native does not touch the key.
+ *
+ * When in a guest then native_pv_lock_init() enables the key first and
+ * KVM/XEN might conditionally disable it later in the boot process again.
  */
-DECLARE_STATIC_KEY_TRUE(virt_spin_lock_key);
+DECLARE_STATIC_KEY_FALSE(virt_spin_lock_key);
 
 /*
  * Shortcut for the queued_spin_lock_slowpath() function that allows
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/required-features.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/required-features.h
@@ -99,6 +99,7 @@
 #define REQUIRED_MASK18	0
 #define REQUIRED_MASK19	0
 #define REQUIRED_MASK20	0
-#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 21)
+#define REQUIRED_MASK21	0
+#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 22)
 
 #endif /* _ASM_X86_REQUIRED_FEATURES_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/set_memory.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/set_memory.h
@@ -49,8 +49,11 @@
 int set_memory_np(unsigned long addr, int numpages);
 int set_memory_p(unsigned long addr, int numpages);
 int set_memory_4k(unsigned long addr, int numpages);
+
+bool set_memory_enc_stop_conversion(void);
 int set_memory_encrypted(unsigned long addr, int numpages);
 int set_memory_decrypted(unsigned long addr, int numpages);
+
 int set_memory_np_noalias(unsigned long addr, int numpages);
 int set_memory_nonglobal(unsigned long addr, int numpages);
 int set_memory_global(unsigned long addr, int numpages);
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/sev.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/sev.h
@@ -199,16 +199,16 @@
 struct snp_guest_request_ioctl;
 
 void setup_ghcb(void);
-void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr,
-					 unsigned long npages);
-void __init early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr,
-					unsigned long npages);
-void __init snp_prep_memory(unsigned long paddr, unsigned int sz, enum psc_op op);
+void early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr,
+				  unsigned long npages);
+void early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr,
+				 unsigned long npages);
 void snp_set_memory_shared(unsigned long vaddr, unsigned long npages);
 void snp_set_memory_private(unsigned long vaddr, unsigned long npages);
 void snp_set_wakeup_secondary_cpu(void);
 bool snp_init(struct boot_params *bp);
-void __init __noreturn snp_abort(void);
+void __noreturn snp_abort(void);
+void snp_dmi_setup(void);
 int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, struct snp_guest_request_ioctl *rio);
 void snp_accept_memory(phys_addr_t start, phys_addr_t end);
 u64 snp_get_unsupported_features(u64 status);
@@ -227,12 +227,12 @@
 early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, unsigned long npages) { }
 static inline void __init
 early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, unsigned long npages) { }
-static inline void __init snp_prep_memory(unsigned long paddr, unsigned int sz, enum psc_op op) { }
 static inline void snp_set_memory_shared(unsigned long vaddr, unsigned long npages) { }
 static inline void snp_set_memory_private(unsigned long vaddr, unsigned long npages) { }
 static inline void snp_set_wakeup_secondary_cpu(void) { }
 static inline bool snp_init(struct boot_params *bp) { return false; }
 static inline void snp_abort(void) { }
+static inline void snp_dmi_setup(void) { }
 static inline int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, struct snp_guest_request_ioctl *rio)
 {
 	return -ENOTTY;
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/shared/tdx.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/shared/tdx.h
@@ -16,11 +16,20 @@
 #define TDG_VP_VEINFO_GET		3
 #define TDG_MR_REPORT			4
 #define TDG_MEM_PAGE_ACCEPT		6
+#define TDG_VM_RD			7
 #define TDG_VM_WR			8
 
-/* TDCS fields. To be used by TDG.VM.WR and TDG.VM.RD module calls */
+/* TDX TD-Scope Metadata. To be used by TDG.VM.WR and TDG.VM.RD */
+#define TDCS_CONFIG_FLAGS		0x1110000300000016
+#define TDCS_TD_CTLS			0x1110000300000017
 #define TDCS_NOTIFY_ENABLES		0x9100000000000010
 
+/* TDCS_CONFIG_FLAGS bits */
+#define TDCS_CONFIG_FLEXIBLE_PENDING_VE	BIT_ULL(1)
+
+/* TDCS_TD_CTLS bits */
+#define TD_CTLS_PENDING_VE_DISABLE	BIT_ULL(0)
+
 /* TDX hypercall Leaf IDs */
 #define TDVMCALL_MAP_GPA		0x10001
 #define TDVMCALL_GET_QUOTE		0x10002
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/shstk.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/shstk.h
@@ -21,6 +21,7 @@
 void shstk_free(struct task_struct *p);
 int setup_signal_shadow_stack(struct ksignal *ksig);
 int restore_signal_shadow_stack(void);
+int shstk_update_last_frame(unsigned long val);
 #else
 static inline long shstk_prctl(struct task_struct *task, int option,
 			       unsigned long arg2) { return -EINVAL; }
@@ -31,6 +32,7 @@
 static inline void shstk_free(struct task_struct *p) {}
 static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; }
 static inline int restore_signal_shadow_stack(void) { return 0; }
+static inline int shstk_update_last_frame(unsigned long val) { return 0; }
 #endif /* CONFIG_X86_USER_SHADOW_STACK */
 
 #endif /* __ASSEMBLY__ */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/sparsemem.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/sparsemem.h
@@ -37,8 +37,6 @@
 #define phys_to_target_node phys_to_target_node
 extern int memory_add_physaddr_to_nid(u64 start);
 #define memory_add_physaddr_to_nid memory_add_physaddr_to_nid
-extern int numa_fill_memblks(u64 start, u64 end);
-#define numa_fill_memblks numa_fill_memblks
 #endif
 #endif /* __ASSEMBLY__ */
 
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/special_insns.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/special_insns.h
@@ -217,17 +217,17 @@
 
 #define nop() asm volatile ("nop")
 
-static inline void serialize(void)
+static __always_inline void serialize(void)
 {
 	/* Instruction opcode for SERIALIZE; supported in binutils >= 2.35. */
 	asm volatile(".byte 0xf, 0x1, 0xe8" ::: "memory");
 }
 
 /* The dst parameter must be 64-bytes aligned */
-static inline void movdir64b(void __iomem *dst, const void *src)
+static inline void movdir64b(void *dst, const void *src)
 {
 	const struct { char _[64]; } *__src = src;
-	struct { char _[64]; } __iomem *__dst = dst;
+	struct { char _[64]; } *__dst = dst;
 
 	/*
 	 * MOVDIR64B %(rdx), rax.
@@ -245,6 +245,11 @@
 		     :  "m" (*__src), "a" (__dst), "d" (__src));
 }
 
+static inline void movdir64b_io(void __iomem *dst, const void *src)
+{
+	movdir64b((void __force *)dst, src);
+}
+
 /**
  * enqcmds - Enqueue a command in supervisor (CPL0) mode
  * @dst: destination, in MMIO space (must be 512-bit aligned)
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/static_call.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/static_call.h
@@ -65,4 +65,19 @@
 
 extern bool __static_call_fixup(void *tramp, u8 op, void *dest);
 
+extern void __static_call_update_early(void *tramp, void *func);
+
+#define static_call_update_early(name, _func)				\
+({									\
+	typeof(&STATIC_CALL_TRAMP(name)) __F = (_func);			\
+	if (static_call_initialized) {					\
+		__static_call_update(&STATIC_CALL_KEY(name),		\
+				     STATIC_CALL_TRAMP_ADDR(name), __F);\
+	} else {							\
+		WRITE_ONCE(STATIC_CALL_KEY(name).func, _func);		\
+		__static_call_update_early(STATIC_CALL_TRAMP_ADDR(name),\
+					   __F);			\
+	}								\
+})
+
 #endif /* _ASM_STATIC_CALL_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/suspend_32.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/suspend_32.h
@@ -12,11 +12,6 @@
 
 /* image of the saved processor state */
 struct saved_context {
-	/*
-	 * On x86_32, all segment registers except gs are saved at kernel
-	 * entry in pt_regs.
-	 */
-	u16 gs;
 	unsigned long cr0, cr2, cr3, cr4;
 	u64 misc_enable;
 	struct saved_msrs saved_msrs;
@@ -27,6 +22,11 @@
 	unsigned long tr;
 	unsigned long safety;
 	unsigned long return_address;
+	/*
+	 * On x86_32, all segment registers except gs are saved at kernel
+	 * entry in pt_regs.
+	 */
+	u16 gs;
 	bool misc_enable_saved;
 } __attribute__((packed));
 
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/sync_core.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/sync_core.h
@@ -8,7 +8,7 @@
 #include <asm/special_insns.h>
 
 #ifdef CONFIG_X86_32
-static inline void iret_to_self(void)
+static __always_inline void iret_to_self(void)
 {
 	asm volatile (
 		"pushfl\n\t"
@@ -19,7 +19,7 @@
 		: ASM_CALL_CONSTRAINT : : "memory");
 }
 #else
-static inline void iret_to_self(void)
+static __always_inline void iret_to_self(void)
 {
 	unsigned int tmp;
 
@@ -55,7 +55,7 @@
  * Like all of Linux's memory ordering operations, this is a
  * compiler barrier as well.
  */
-static inline void sync_core(void)
+static __always_inline void sync_core(void)
 {
 	/*
 	 * The SERIALIZE instruction is the most straightforward way to
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/syscall.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/syscall.h
@@ -16,19 +16,17 @@
 #include <asm/thread_info.h>	/* for TS_COMPAT */
 #include <asm/unistd.h>
 
+/* This is used purely for kernel/trace/trace_syscalls.c */
 typedef long (*sys_call_ptr_t)(const struct pt_regs *);
 extern const sys_call_ptr_t sys_call_table[];
 
-#if defined(CONFIG_X86_32)
-#define ia32_sys_call_table sys_call_table
-#else
 /*
  * These may not exist, but still put the prototypes in so we
  * can use IS_ENABLED().
  */
-extern const sys_call_ptr_t ia32_sys_call_table[];
-extern const sys_call_ptr_t x32_sys_call_table[];
-#endif
+extern long ia32_sys_call(const struct pt_regs *, unsigned int nr);
+extern long x32_sys_call(const struct pt_regs *, unsigned int nr);
+extern long x64_sys_call(const struct pt_regs *, unsigned int nr);
 
 /*
  * Only the low 32 bits of orig_ax are meaningful, so we return int.
@@ -84,7 +82,12 @@
 					 struct pt_regs *regs,
 					 unsigned long *args)
 {
-	memcpy(args, &regs->bx, 6 * sizeof(args[0]));
+	args[0] = regs->bx;
+	args[1] = regs->cx;
+	args[2] = regs->dx;
+	args[3] = regs->si;
+	args[4] = regs->di;
+	args[5] = regs->bp;
 }
 
 static inline int syscall_get_arch(struct task_struct *task)
@@ -127,6 +130,7 @@
 }
 
 bool do_syscall_64(struct pt_regs *regs, int nr);
+void do_int80_emulation(struct pt_regs *regs);
 
 #endif	/* CONFIG_X86_32 */
 
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/tlb.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/tlb.h
@@ -34,4 +34,8 @@
 	free_page_and_swap_cache(table);
 }
 
+static inline void invlpg(unsigned long addr)
+{
+	asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
+}
 #endif /* _ASM_X86_TLB_H */
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/uaccess.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/uaccess.h
@@ -78,10 +78,10 @@
 	int __ret_gu;							\
 	register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX);		\
 	__chk_user_ptr(ptr);						\
-	asm volatile("call __" #fn "_%P4"				\
+	asm volatile("call __" #fn "_%c[size]"				\
 		     : "=a" (__ret_gu), "=r" (__val_gu),		\
 			ASM_CALL_CONSTRAINT				\
-		     : "0" (ptr), "i" (sizeof(*(ptr))));		\
+		     : "0" (ptr), [size] "i" (sizeof(*(ptr))));		\
 	instrument_get_user(__val_gu);					\
 	(x) = (__force __typeof__(*(ptr))) __val_gu;			\
 	__builtin_expect(__ret_gu, 0);					\
@@ -177,7 +177,7 @@
 	__chk_user_ptr(__ptr);						\
 	__ptr_pu = __ptr;						\
 	__val_pu = __x;							\
-	asm volatile("call __" #fn "_%P[size]"				\
+	asm volatile("call __" #fn "_%c[size]"				\
 		     : "=c" (__ret_pu),					\
 			ASM_CALL_CONSTRAINT				\
 		     : "0" (__ptr_pu),					\
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/uaccess_64.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/uaccess_64.h
@@ -57,6 +57,14 @@
 #define valid_user_address(x) ((long)(x) >= 0)
 
 /*
+ * Masking the user address is an alternative to a conditional
+ * user_access_begin that can avoid the fencing. This only works
+ * for dense accesses starting at the address.
+ */
+#define mask_user_address(x) ((typeof(x))((long)(x)|((long)(x)>>63)))
+#define masked_user_access_begin(x) ({ __uaccess_begin(); mask_user_address(x); })
+
+/*
  * User pointers can have tag bits on x86-64.  This scheme tolerates
  * arbitrary values in those bits rather then masking them off.
  *
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/vmware.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/vmware.h
@@ -7,51 +7,321 @@
 #include <linux/stringify.h>
 
 /*
- * The hypercall definitions differ in the low word of the %edx argument
- * in the following way: the old port base interface uses the port
- * number to distinguish between high- and low bandwidth versions.
+ * VMware hypercall ABI.
+ *
+ * - Low bandwidth (LB) hypercalls (I/O port based, vmcall and vmmcall)
+ * have up to 6 input and 6 output arguments passed and returned using
+ * registers: %eax (arg0), %ebx (arg1), %ecx (arg2), %edx (arg3),
+ * %esi (arg4), %edi (arg5).
+ * The following input arguments must be initialized by the caller:
+ * arg0 - VMWARE_HYPERVISOR_MAGIC
+ * arg2 - Hypercall command
+ * arg3 bits [15:0] - Port number, LB and direction flags
+ *
+ * - Low bandwidth TDX hypercalls (x86_64 only) are similar to LB
+ * hypercalls. They also have up to 6 input and 6 output on registers
+ * arguments, with different argument to register mapping:
+ * %r12 (arg0), %rbx (arg1), %r13 (arg2), %rdx (arg3),
+ * %rsi (arg4), %rdi (arg5).
+ *
+ * - High bandwidth (HB) hypercalls are I/O port based only. They have
+ * up to 7 input and 7 output arguments passed and returned using
+ * registers: %eax (arg0), %ebx (arg1), %ecx (arg2), %edx (arg3),
+ * %esi (arg4), %edi (arg5), %ebp (arg6).
+ * The following input arguments must be initialized by the caller:
+ * arg0 - VMWARE_HYPERVISOR_MAGIC
+ * arg1 - Hypercall command
+ * arg3 bits [15:0] - Port number, HB and direction flags
+ *
+ * For compatibility purposes, x86_64 systems use only lower 32 bits
+ * for input and output arguments.
+ *
+ * The hypercall definitions differ in the low word of the %edx (arg3)
+ * in the following way: the old I/O port based interface uses the port
+ * number to distinguish between high- and low bandwidth versions, and
+ * uses IN/OUT instructions to define transfer direction.
  *
  * The new vmcall interface instead uses a set of flags to select
  * bandwidth mode and transfer direction. The flags should be loaded
- * into %dx by any user and are automatically replaced by the port
- * number if the VMWARE_HYPERVISOR_PORT method is used.
- *
- * In short, new driver code should strictly use the new definition of
- * %dx content.
+ * into arg3 by any user and are automatically replaced by the port
+ * number if the I/O port method is used.
  */
 
-/* Old port-based version */
-#define VMWARE_HYPERVISOR_PORT    0x5658
-#define VMWARE_HYPERVISOR_PORT_HB 0x5659
-
-/* Current vmcall / vmmcall version */
-#define VMWARE_HYPERVISOR_HB   BIT(0)
-#define VMWARE_HYPERVISOR_OUT  BIT(1)
-
-/* The low bandwidth call. The low word of edx is presumed clear. */
-#define VMWARE_HYPERCALL						\
-	ALTERNATIVE_2("movw $" __stringify(VMWARE_HYPERVISOR_PORT) ", %%dx; " \
-		      "inl (%%dx), %%eax",				\
-		      "vmcall", X86_FEATURE_VMCALL,			\
-		      "vmmcall", X86_FEATURE_VMW_VMMCALL)
+#define VMWARE_HYPERVISOR_HB		BIT(0)
+#define VMWARE_HYPERVISOR_OUT		BIT(1)
+
+#define VMWARE_HYPERVISOR_PORT		0x5658
+#define VMWARE_HYPERVISOR_PORT_HB	(VMWARE_HYPERVISOR_PORT | \
+					 VMWARE_HYPERVISOR_HB)
+
+#define VMWARE_HYPERVISOR_MAGIC		0x564d5868U
 
+#define VMWARE_CMD_GETVERSION		10
+#define VMWARE_CMD_GETHZ		45
+#define VMWARE_CMD_GETVCPU_INFO		68
+#define VMWARE_CMD_STEALCLOCK		91
 /*
- * The high bandwidth out call. The low word of edx is presumed to have the
- * HB and OUT bits set.
+ * Hypercall command mask:
+ *   bits [6:0] command, range [0, 127]
+ *   bits [19:16] sub-command, range [0, 15]
  */
-#define VMWARE_HYPERCALL_HB_OUT						\
-	ALTERNATIVE_2("movw $" __stringify(VMWARE_HYPERVISOR_PORT_HB) ", %%dx; " \
-		      "rep outsb",					\
-		      "vmcall", X86_FEATURE_VMCALL,			\
-		      "vmmcall", X86_FEATURE_VMW_VMMCALL)
+#define VMWARE_CMD_MASK			0xf007fU
+
+#define CPUID_VMWARE_FEATURES_ECX_VMMCALL	BIT(0)
+#define CPUID_VMWARE_FEATURES_ECX_VMCALL	BIT(1)
+
+extern unsigned long vmware_hypercall_slow(unsigned long cmd,
+					   unsigned long in1, unsigned long in3,
+					   unsigned long in4, unsigned long in5,
+					   u32 *out1, u32 *out2, u32 *out3,
+					   u32 *out4, u32 *out5);
+
+#define VMWARE_TDX_VENDOR_LEAF 0x1af7e4909ULL
+#define VMWARE_TDX_HCALL_FUNC  1
+
+extern unsigned long vmware_tdx_hypercall(unsigned long cmd,
+					  unsigned long in1, unsigned long in3,
+					  unsigned long in4, unsigned long in5,
+					  u32 *out1, u32 *out2, u32 *out3,
+					  u32 *out4, u32 *out5);
 
 /*
- * The high bandwidth in call. The low word of edx is presumed to have the
- * HB bit set.
+ * The low bandwidth call. The low word of %edx is presumed to have OUT bit
+ * set. The high word of %edx may contain input data from the caller.
  */
-#define VMWARE_HYPERCALL_HB_IN						\
-	ALTERNATIVE_2("movw $" __stringify(VMWARE_HYPERVISOR_PORT_HB) ", %%dx; " \
-		      "rep insb",					\
-		      "vmcall", X86_FEATURE_VMCALL,			\
+#define VMWARE_HYPERCALL					\
+	ALTERNATIVE_2("movw %[port], %%dx\n\t"			\
+		      "inl (%%dx), %%eax",			\
+		      "vmcall", X86_FEATURE_VMCALL,		\
 		      "vmmcall", X86_FEATURE_VMW_VMMCALL)
+
+static inline
+unsigned long vmware_hypercall1(unsigned long cmd, unsigned long in1)
+{
+	unsigned long out0;
+
+	if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST))
+		return vmware_tdx_hypercall(cmd, in1, 0, 0, 0,
+					    NULL, NULL, NULL, NULL, NULL);
+
+	if (unlikely(!alternatives_patched) && !__is_defined(MODULE))
+		return vmware_hypercall_slow(cmd, in1, 0, 0, 0,
+					     NULL, NULL, NULL, NULL, NULL);
+
+	asm_inline volatile (VMWARE_HYPERCALL
+		: "=a" (out0)
+		: [port] "i" (VMWARE_HYPERVISOR_PORT),
+		  "a" (VMWARE_HYPERVISOR_MAGIC),
+		  "b" (in1),
+		  "c" (cmd),
+		  "d" (0)
+		: "cc", "memory");
+	return out0;
+}
+
+static inline
+unsigned long vmware_hypercall3(unsigned long cmd, unsigned long in1,
+				u32 *out1, u32 *out2)
+{
+	unsigned long out0;
+
+	if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST))
+		return vmware_tdx_hypercall(cmd, in1, 0, 0, 0,
+					    out1, out2, NULL, NULL, NULL);
+
+	if (unlikely(!alternatives_patched) && !__is_defined(MODULE))
+		return vmware_hypercall_slow(cmd, in1, 0, 0, 0,
+					     out1, out2, NULL, NULL, NULL);
+
+	asm_inline volatile (VMWARE_HYPERCALL
+		: "=a" (out0), "=b" (*out1), "=c" (*out2)
+		: [port] "i" (VMWARE_HYPERVISOR_PORT),
+		  "a" (VMWARE_HYPERVISOR_MAGIC),
+		  "b" (in1),
+		  "c" (cmd),
+		  "d" (0)
+		: "cc", "memory");
+	return out0;
+}
+
+static inline
+unsigned long vmware_hypercall4(unsigned long cmd, unsigned long in1,
+				u32 *out1, u32 *out2, u32 *out3)
+{
+	unsigned long out0;
+
+	if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST))
+		return vmware_tdx_hypercall(cmd, in1, 0, 0, 0,
+					    out1, out2, out3, NULL, NULL);
+
+	if (unlikely(!alternatives_patched) && !__is_defined(MODULE))
+		return vmware_hypercall_slow(cmd, in1, 0, 0, 0,
+					     out1, out2, out3, NULL, NULL);
+
+	asm_inline volatile (VMWARE_HYPERCALL
+		: "=a" (out0), "=b" (*out1), "=c" (*out2), "=d" (*out3)
+		: [port] "i" (VMWARE_HYPERVISOR_PORT),
+		  "a" (VMWARE_HYPERVISOR_MAGIC),
+		  "b" (in1),
+		  "c" (cmd),
+		  "d" (0)
+		: "cc", "memory");
+	return out0;
+}
+
+static inline
+unsigned long vmware_hypercall5(unsigned long cmd, unsigned long in1,
+				unsigned long in3, unsigned long in4,
+				unsigned long in5, u32 *out2)
+{
+	unsigned long out0;
+
+	if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST))
+		return vmware_tdx_hypercall(cmd, in1, in3, in4, in5,
+					    NULL, out2, NULL, NULL, NULL);
+
+	if (unlikely(!alternatives_patched) && !__is_defined(MODULE))
+		return vmware_hypercall_slow(cmd, in1, in3, in4, in5,
+					     NULL, out2, NULL, NULL, NULL);
+
+	asm_inline volatile (VMWARE_HYPERCALL
+		: "=a" (out0), "=c" (*out2)
+		: [port] "i" (VMWARE_HYPERVISOR_PORT),
+		  "a" (VMWARE_HYPERVISOR_MAGIC),
+		  "b" (in1),
+		  "c" (cmd),
+		  "d" (in3),
+		  "S" (in4),
+		  "D" (in5)
+		: "cc", "memory");
+	return out0;
+}
+
+static inline
+unsigned long vmware_hypercall6(unsigned long cmd, unsigned long in1,
+				unsigned long in3, u32 *out2,
+				u32 *out3, u32 *out4, u32 *out5)
+{
+	unsigned long out0;
+
+	if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST))
+		return vmware_tdx_hypercall(cmd, in1, in3, 0, 0,
+					    NULL, out2, out3, out4, out5);
+
+	if (unlikely(!alternatives_patched) && !__is_defined(MODULE))
+		return vmware_hypercall_slow(cmd, in1, in3, 0, 0,
+					     NULL, out2, out3, out4, out5);
+
+	asm_inline volatile (VMWARE_HYPERCALL
+		: "=a" (out0), "=c" (*out2), "=d" (*out3), "=S" (*out4),
+		  "=D" (*out5)
+		: [port] "i" (VMWARE_HYPERVISOR_PORT),
+		  "a" (VMWARE_HYPERVISOR_MAGIC),
+		  "b" (in1),
+		  "c" (cmd),
+		  "d" (in3)
+		: "cc", "memory");
+	return out0;
+}
+
+static inline
+unsigned long vmware_hypercall7(unsigned long cmd, unsigned long in1,
+				unsigned long in3, unsigned long in4,
+				unsigned long in5, u32 *out1,
+				u32 *out2, u32 *out3)
+{
+	unsigned long out0;
+
+	if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST))
+		return vmware_tdx_hypercall(cmd, in1, in3, in4, in5,
+					    out1, out2, out3, NULL, NULL);
+
+	if (unlikely(!alternatives_patched) && !__is_defined(MODULE))
+		return vmware_hypercall_slow(cmd, in1, in3, in4, in5,
+					     out1, out2, out3, NULL, NULL);
+
+	asm_inline volatile (VMWARE_HYPERCALL
+		: "=a" (out0), "=b" (*out1), "=c" (*out2), "=d" (*out3)
+		: [port] "i" (VMWARE_HYPERVISOR_PORT),
+		  "a" (VMWARE_HYPERVISOR_MAGIC),
+		  "b" (in1),
+		  "c" (cmd),
+		  "d" (in3),
+		  "S" (in4),
+		  "D" (in5)
+		: "cc", "memory");
+	return out0;
+}
+
+#ifdef CONFIG_X86_64
+#define VMW_BP_CONSTRAINT "r"
+#else
+#define VMW_BP_CONSTRAINT "m"
+#endif
+
+/*
+ * High bandwidth calls are not supported on encrypted memory guests.
+ * The caller should check cc_platform_has(CC_ATTR_MEM_ENCRYPT) and use
+ * low bandwidth hypercall if memory encryption is set.
+ * This assumption simplifies HB hypercall implementation to just I/O port
+ * based approach without alternative patching.
+ */
+static inline
+unsigned long vmware_hypercall_hb_out(unsigned long cmd, unsigned long in2,
+				      unsigned long in3, unsigned long in4,
+				      unsigned long in5, unsigned long in6,
+				      u32 *out1)
+{
+	unsigned long out0;
+
+	asm_inline volatile (
+		UNWIND_HINT_SAVE
+		"push %%" _ASM_BP "\n\t"
+		UNWIND_HINT_UNDEFINED
+		"mov %[in6], %%" _ASM_BP "\n\t"
+		"rep outsb\n\t"
+		"pop %%" _ASM_BP "\n\t"
+		UNWIND_HINT_RESTORE
+		: "=a" (out0), "=b" (*out1)
+		: "a" (VMWARE_HYPERVISOR_MAGIC),
+		  "b" (cmd),
+		  "c" (in2),
+		  "d" (in3 | VMWARE_HYPERVISOR_PORT_HB),
+		  "S" (in4),
+		  "D" (in5),
+		  [in6] VMW_BP_CONSTRAINT (in6)
+		: "cc", "memory");
+	return out0;
+}
+
+static inline
+unsigned long vmware_hypercall_hb_in(unsigned long cmd, unsigned long in2,
+				     unsigned long in3, unsigned long in4,
+				     unsigned long in5, unsigned long in6,
+				     u32 *out1)
+{
+	unsigned long out0;
+
+	asm_inline volatile (
+		UNWIND_HINT_SAVE
+		"push %%" _ASM_BP "\n\t"
+		UNWIND_HINT_UNDEFINED
+		"mov %[in6], %%" _ASM_BP "\n\t"
+		"rep insb\n\t"
+		"pop %%" _ASM_BP "\n\t"
+		UNWIND_HINT_RESTORE
+		: "=a" (out0), "=b" (*out1)
+		: "a" (VMWARE_HYPERVISOR_MAGIC),
+		  "b" (cmd),
+		  "c" (in2),
+		  "d" (in3 | VMWARE_HYPERVISOR_PORT_HB),
+		  "S" (in4),
+		  "D" (in5),
+		  [in6] VMW_BP_CONSTRAINT (in6)
+		: "cc", "memory");
+	return out0;
+}
+#undef VMW_BP_CONSTRAINT
+#undef VMWARE_HYPERCALL
+
 #endif
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/x86_init.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/x86_init.h
@@ -30,12 +30,13 @@
  * @reserve_resources:		reserve the standard resources for the
  *				platform
  * @memory_setup:		platform specific memory setup
- *
+ * @dmi_setup:			platform specific DMI setup
  */
 struct x86_init_resources {
 	void (*probe_roms)(void);
 	void (*reserve_resources)(void);
 	char *(*memory_setup)(void);
+	void (*dmi_setup)(void);
 };
 
 /**
@@ -148,12 +149,22 @@
  * @enc_status_change_finish	Notify HV after the encryption status of a range is changed
  * @enc_tlb_flush_required	Returns true if a TLB flush is needed before changing page encryption status
  * @enc_cache_flush_required	Returns true if a cache flush is needed before changing page encryption status
+ * @enc_kexec_begin		Begin the two-step process of converting shared memory back
+ *				to private. It stops the new conversions from being started
+ *				and waits in-flight conversions to finish, if possible.
+ * @enc_kexec_finish		Finish the two-step process of converting shared memory to
+ *				private. All memory is private after the call when
+ *				the function returns.
+ *				It is called on only one CPU while the others are shut down
+ *				and with interrupts disabled.
  */
 struct x86_guest {
-	bool (*enc_status_change_prepare)(unsigned long vaddr, int npages, bool enc);
-	bool (*enc_status_change_finish)(unsigned long vaddr, int npages, bool enc);
+	int (*enc_status_change_prepare)(unsigned long vaddr, int npages, bool enc);
+	int (*enc_status_change_finish)(unsigned long vaddr, int npages, bool enc);
 	bool (*enc_tlb_flush_required)(bool enc);
 	bool (*enc_cache_flush_required)(void);
+	void (*enc_kexec_begin)(void);
+	void (*enc_kexec_finish)(void);
 };
 
 /**
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/xen/hypercall.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/xen/hypercall.h
@@ -39,9 +39,11 @@
 #include <linux/string.h>
 #include <linux/types.h>
 #include <linux/pgtable.h>
+#include <linux/instrumentation.h>
 
 #include <trace/events/xen.h>
 
+#include <asm/alternative.h>
 #include <asm/page.h>
 #include <asm/smap.h>
 #include <asm/nospec-branch.h>
@@ -86,11 +88,20 @@
  * there aren't more than 5 arguments...)
  */
 
-extern struct { char _entry[32]; } hypercall_page[];
+void xen_hypercall_func(void);
+DECLARE_STATIC_CALL(xen_hypercall, xen_hypercall_func);
 
-#define __HYPERCALL		"call hypercall_page+%c[offset]"
-#define __HYPERCALL_ENTRY(x)						\
-	[offset] "i" (__HYPERVISOR_##x * sizeof(hypercall_page[0]))
+#ifdef MODULE
+#define __ADDRESSABLE_xen_hypercall
+#else
+#define __ADDRESSABLE_xen_hypercall __ADDRESSABLE_ASM_STR(__SCK__xen_hypercall)
+#endif
+
+#define __HYPERCALL					\
+	__ADDRESSABLE_xen_hypercall			\
+	"call __SCT__xen_hypercall"
+
+#define __HYPERCALL_ENTRY(x)	"a" (x)
 
 #ifdef CONFIG_X86_32
 #define __HYPERCALL_RETREG	"eax"
@@ -148,7 +159,7 @@
 	__HYPERCALL_0ARG();						\
 	asm volatile (__HYPERCALL					\
 		      : __HYPERCALL_0PARAM				\
-		      : __HYPERCALL_ENTRY(name)				\
+		      : __HYPERCALL_ENTRY(__HYPERVISOR_ ## name)	\
 		      : __HYPERCALL_CLOBBER0);				\
 	(type)__res;							\
 })
@@ -159,7 +170,7 @@
 	__HYPERCALL_1ARG(a1);						\
 	asm volatile (__HYPERCALL					\
 		      : __HYPERCALL_1PARAM				\
-		      : __HYPERCALL_ENTRY(name)				\
+		      : __HYPERCALL_ENTRY(__HYPERVISOR_ ## name)	\
 		      : __HYPERCALL_CLOBBER1);				\
 	(type)__res;							\
 })
@@ -170,7 +181,7 @@
 	__HYPERCALL_2ARG(a1, a2);					\
 	asm volatile (__HYPERCALL					\
 		      : __HYPERCALL_2PARAM				\
-		      : __HYPERCALL_ENTRY(name)				\
+		      : __HYPERCALL_ENTRY(__HYPERVISOR_ ## name)	\
 		      : __HYPERCALL_CLOBBER2);				\
 	(type)__res;							\
 })
@@ -181,7 +192,7 @@
 	__HYPERCALL_3ARG(a1, a2, a3);					\
 	asm volatile (__HYPERCALL					\
 		      : __HYPERCALL_3PARAM				\
-		      : __HYPERCALL_ENTRY(name)				\
+		      : __HYPERCALL_ENTRY(__HYPERVISOR_ ## name)	\
 		      : __HYPERCALL_CLOBBER3);				\
 	(type)__res;							\
 })
@@ -192,7 +203,7 @@
 	__HYPERCALL_4ARG(a1, a2, a3, a4);				\
 	asm volatile (__HYPERCALL					\
 		      : __HYPERCALL_4PARAM				\
-		      : __HYPERCALL_ENTRY(name)				\
+		      : __HYPERCALL_ENTRY(__HYPERVISOR_ ## name)	\
 		      : __HYPERCALL_CLOBBER4);				\
 	(type)__res;							\
 })
@@ -206,12 +217,9 @@
 	__HYPERCALL_DECLS;
 	__HYPERCALL_5ARG(a1, a2, a3, a4, a5);
 
-	if (call >= PAGE_SIZE / sizeof(hypercall_page[0]))
-		return -EINVAL;
-
-	asm volatile(CALL_NOSPEC
+	asm volatile(__HYPERCALL
 		     : __HYPERCALL_5PARAM
-		     : [thunk_target] "a" (&hypercall_page[call])
+		     : __HYPERCALL_ENTRY(call)
 		     : __HYPERCALL_CLOBBER5);
 
 	return (long)__res;
--- linux-qcom-6.8.0.orig/arch/x86/include/asm/xen/hypervisor.h
+++ linux-qcom-6.8.0/arch/x86/include/asm/xen/hypervisor.h
@@ -62,6 +62,11 @@
 #ifdef CONFIG_PVH
 void __init xen_pvh_init(struct boot_params *boot_params);
 void __init mem_map_via_hcall(struct boot_params *boot_params_p);
+#ifdef CONFIG_XEN_PVH
+void __init xen_reserve_extra_memory(struct boot_params *bootp);
+#else
+static inline void xen_reserve_extra_memory(struct boot_params *bootp) { }
+#endif
 #endif
 
 /* Lazy mode for batching updates / context switch */
--- linux-qcom-6.8.0.orig/arch/x86/include/uapi/asm/bootparam.h
+++ linux-qcom-6.8.0/arch/x86/include/uapi/asm/bootparam.h
@@ -38,6 +38,7 @@
 #define XLF_EFI_KEXEC			(1<<4)
 #define XLF_5LEVEL			(1<<5)
 #define XLF_5LEVEL_ENABLED		(1<<6)
+#define XLF_MEM_ENCRYPTION		(1<<7)
 
 #ifndef __ASSEMBLY__
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/acpi/boot.c
+++ linux-qcom-6.8.0/arch/x86/kernel/acpi/boot.c
@@ -263,6 +263,28 @@
 }
 
 static int __init
+acpi_check_lapic(union acpi_subtable_headers *header, const unsigned long end)
+{
+	struct acpi_madt_local_apic *processor = NULL;
+
+	processor = (struct acpi_madt_local_apic *)header;
+
+	if (BAD_MADT_ENTRY(processor, end))
+		return -EINVAL;
+
+	/* Ignore invalid ID */
+	if (processor->id == 0xff)
+		return 0;
+
+	/* Ignore processors that can not be onlined */
+	if (!acpi_is_processor_usable(processor->lapic_flags))
+		return 0;
+
+	has_lapic_cpus = true;
+	return 0;
+}
+
+static int __init
 acpi_parse_lapic(union acpi_subtable_headers * header, const unsigned long end)
 {
 	struct acpi_madt_local_apic *processor = NULL;
@@ -293,7 +315,6 @@
 			    processor->processor_id, /* ACPI ID */
 			    processor->lapic_flags & ACPI_MADT_ENABLED);
 
-	has_lapic_cpus = true;
 	return 0;
 }
 
@@ -1125,6 +1146,8 @@
 static int __init acpi_parse_madt_lapic_entries(void)
 {
 	int count, x2count = 0;
+	struct acpi_subtable_proc madt_proc[2];
+	int ret;
 
 	if (!boot_cpu_has(X86_FEATURE_APIC))
 		return -ENODEV;
@@ -1133,10 +1156,27 @@
 				      acpi_parse_sapic, MAX_LOCAL_APIC);
 
 	if (!count) {
-		count = acpi_table_parse_madt(ACPI_MADT_TYPE_LOCAL_APIC,
-					acpi_parse_lapic, MAX_LOCAL_APIC);
-		x2count = acpi_table_parse_madt(ACPI_MADT_TYPE_LOCAL_X2APIC,
-					acpi_parse_x2apic, MAX_LOCAL_APIC);
+		/* Check if there are valid LAPIC entries */
+		acpi_table_parse_madt(ACPI_MADT_TYPE_LOCAL_APIC, acpi_check_lapic, MAX_LOCAL_APIC);
+
+		/*
+		 * Enumerate the APIC IDs in the order that they appear in the
+		 * MADT, no matter LAPIC entry or x2APIC entry is used.
+		 */
+		memset(madt_proc, 0, sizeof(madt_proc));
+		madt_proc[0].id = ACPI_MADT_TYPE_LOCAL_APIC;
+		madt_proc[0].handler = acpi_parse_lapic;
+		madt_proc[1].id = ACPI_MADT_TYPE_LOCAL_X2APIC;
+		madt_proc[1].handler = acpi_parse_x2apic;
+		ret = acpi_table_parse_entries_array(ACPI_SIG_MADT,
+				sizeof(struct acpi_table_madt),
+				madt_proc, ARRAY_SIZE(madt_proc), MAX_LOCAL_APIC);
+		if (ret < 0) {
+			pr_err("Error parsing LAPIC/X2APIC entries\n");
+			return ret;
+		}
+		count = madt_proc[0].count;
+		x2count = madt_proc[1].count;
 	}
 	if (!count && !x2count) {
 		pr_err("No LAPIC entries present\n");
@@ -1897,3 +1937,14 @@
 {
 	return boot_params.acpi_rsdp_addr;
 }
+
+#ifdef CONFIG_XEN_PV
+void __iomem *x86_acpi_os_ioremap(acpi_physical_address phys, acpi_size size)
+{
+	return ioremap_cache(phys, size);
+}
+
+void __iomem * (*acpi_os_ioremap)(acpi_physical_address phys, acpi_size size) =
+	x86_acpi_os_ioremap;
+EXPORT_SYMBOL_GPL(acpi_os_ioremap);
+#endif
--- linux-qcom-6.8.0.orig/arch/x86/kernel/acpi/cppc.c
+++ linux-qcom-6.8.0/arch/x86/kernel/acpi/cppc.c
@@ -20,7 +20,7 @@
 		    (boot_cpu_data.x86_model >= 0x20 && boot_cpu_data.x86_model <= 0x2f)))
 			return true;
 		else if (boot_cpu_data.x86 == 0x17 &&
-			 boot_cpu_data.x86_model >= 0x70 && boot_cpu_data.x86_model <= 0x7f)
+			 boot_cpu_data.x86_model >= 0x30 && boot_cpu_data.x86_model <= 0x7f)
 			return true;
 		return boot_cpu_has(X86_FEATURE_CPPC);
 	}
--- linux-qcom-6.8.0.orig/arch/x86/kernel/amd_nb.c
+++ linux-qcom-6.8.0/arch/x86/kernel/amd_nb.c
@@ -26,6 +26,7 @@
 #define PCI_DEVICE_ID_AMD_19H_M70H_ROOT		0x14e8
 #define PCI_DEVICE_ID_AMD_1AH_M00H_ROOT		0x153a
 #define PCI_DEVICE_ID_AMD_1AH_M20H_ROOT		0x1507
+#define PCI_DEVICE_ID_AMD_1AH_M60H_ROOT		0x1122
 #define PCI_DEVICE_ID_AMD_MI200_ROOT		0x14bb
 #define PCI_DEVICE_ID_AMD_MI300_ROOT		0x14f8
 
@@ -43,6 +44,9 @@
 #define PCI_DEVICE_ID_AMD_19H_M70H_DF_F4	0x14f4
 #define PCI_DEVICE_ID_AMD_19H_M78H_DF_F4	0x12fc
 #define PCI_DEVICE_ID_AMD_1AH_M00H_DF_F4	0x12c4
+#define PCI_DEVICE_ID_AMD_1AH_M20H_DF_F4	0x16fc
+#define PCI_DEVICE_ID_AMD_1AH_M60H_DF_F4	0x124c
+#define PCI_DEVICE_ID_AMD_1AH_M70H_DF_F4	0x12bc
 #define PCI_DEVICE_ID_AMD_MI200_DF_F4		0x14d4
 #define PCI_DEVICE_ID_AMD_MI300_DF_F4		0x152c
 
@@ -63,6 +67,7 @@
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M70H_ROOT) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_ROOT) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_ROOT) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_ROOT) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_ROOT) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI300_ROOT) },
 	{}
@@ -95,6 +100,8 @@
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_DF_F3) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI300_DF_F3) },
 	{}
@@ -121,6 +128,9 @@
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F4) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F4) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F4) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F4) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F4) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F4) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_DF_F4) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI300_DF_F4) },
 	{}
@@ -214,7 +224,14 @@
 
 int amd_smn_read(u16 node, u32 address, u32 *value)
 {
-	return __amd_smn_rw(node, address, value, false);
+	int err = __amd_smn_rw(node, address, value, false);
+
+	if (PCI_POSSIBLE_ERROR(*value)) {
+		err = -ENODEV;
+		*value = 0;
+	}
+
+	return err;
 }
 EXPORT_SYMBOL_GPL(amd_smn_read);
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/aperture_64.c
+++ linux-qcom-6.8.0/arch/x86/kernel/aperture_64.c
@@ -136,32 +136,6 @@
 }
 
 
-/* Find a PCI capability */
-static u32 __init find_cap(int bus, int slot, int func, int cap)
-{
-	int bytes;
-	u8 pos;
-
-	if (!(read_pci_config_16(bus, slot, func, PCI_STATUS) &
-						PCI_STATUS_CAP_LIST))
-		return 0;
-
-	pos = read_pci_config_byte(bus, slot, func, PCI_CAPABILITY_LIST);
-	for (bytes = 0; bytes < 48 && pos >= 0x40; bytes++) {
-		u8 id;
-
-		pos &= ~3;
-		id = read_pci_config_byte(bus, slot, func, pos+PCI_CAP_LIST_ID);
-		if (id == 0xff)
-			break;
-		if (id == cap)
-			return pos;
-		pos = read_pci_config_byte(bus, slot, func,
-						pos+PCI_CAP_LIST_NEXT);
-	}
-	return 0;
-}
-
 /* Read a standard AGPv3 bridge header */
 static u32 __init read_agp(int bus, int slot, int func, int cap, u32 *order)
 {
@@ -250,8 +224,8 @@
 				case PCI_CLASS_BRIDGE_HOST:
 				case PCI_CLASS_BRIDGE_OTHER: /* needed? */
 					/* AGP bridge? */
-					cap = find_cap(bus, slot, func,
-							PCI_CAP_ID_AGP);
+					cap = pci_early_find_cap(bus, slot,
+						 func, PCI_CAP_ID_AGP);
 					if (!cap)
 						break;
 					*valid_agp = 1;
--- linux-qcom-6.8.0.orig/arch/x86/kernel/apic/apic.c
+++ linux-qcom-6.8.0/arch/x86/kernel/apic/apic.c
@@ -473,7 +473,19 @@
 	v = apic_read(APIC_LVTT);
 	v |= (APIC_LVT_MASKED | LOCAL_TIMER_VECTOR);
 	apic_write(APIC_LVTT, v);
-	apic_write(APIC_TMICT, 0);
+
+	/*
+	 * Setting APIC_LVT_MASKED (above) should be enough to tell
+	 * the hardware that this timer will never fire. But AMD
+	 * erratum 411 and some Intel CPU behavior circa 2024 say
+	 * otherwise.  Time for belt and suspenders programming: mask
+	 * the timer _and_ zero the counter registers:
+	 */
+	if (v & APIC_LVT_TIMER_TSCDEADLINE)
+		wrmsrl(MSR_IA32_TSC_DEADLINE, 0);
+	else
+		apic_write(APIC_TMICT, 0);
+
 	return 0;
 }
 
@@ -1724,11 +1736,11 @@
 
 static bool x2apic_hw_locked(void)
 {
-	u64 ia32_cap;
+	u64 x86_arch_cap_msr;
 	u64 msr;
 
-	ia32_cap = x86_read_arch_cap_msr();
-	if (ia32_cap & ARCH_CAP_XAPIC_DISABLE) {
+	x86_arch_cap_msr = x86_read_arch_cap_msr();
+	if (x86_arch_cap_msr & ARCH_CAP_XAPIC_DISABLE) {
 		rdmsrl(MSR_IA32_XAPIC_DISABLE_STATUS, msr);
 		return (msr & LEGACY_XAPIC_DISABLED);
 	}
@@ -1808,16 +1820,13 @@
 	__x2apic_enable();
 }
 
-static __init void apic_set_fixmap(void);
+static __init void apic_set_fixmap(bool read_apic);
 
 static __init void x2apic_disable(void)
 {
-	u32 x2apic_id, state = x2apic_state;
-
-	x2apic_mode = 0;
-	x2apic_state = X2APIC_DISABLED;
+	u32 x2apic_id;
 
-	if (state != X2APIC_ON)
+	if (x2apic_state < X2APIC_ON)
 		return;
 
 	x2apic_id = read_apic_id();
@@ -1830,7 +1839,16 @@
 	}
 
 	__x2apic_disable();
-	apic_set_fixmap();
+
+	x2apic_mode = 0;
+	x2apic_state = X2APIC_DISABLED;
+
+	/*
+	 * Don't reread the APIC ID as it was already done from
+	 * check_x2apic() and the APIC driver still is a x2APIC variant,
+	 * which fails to do the read after x2APIC was disabled.
+	 */
+	apic_set_fixmap(false);
 }
 
 static __init void x2apic_enable(void)
@@ -2095,13 +2113,14 @@
 	}
 }
 
-static __init void apic_set_fixmap(void)
+static __init void apic_set_fixmap(bool read_apic)
 {
 	set_fixmap_nocache(FIX_APIC_BASE, mp_lapic_addr);
 	apic_mmio_base = APIC_BASE;
 	apic_printk(APIC_VERBOSE, "mapped APIC to %16lx (%16lx)\n",
 		    apic_mmio_base, mp_lapic_addr);
-	apic_read_boot_cpu_id(false);
+	if (read_apic)
+		apic_read_boot_cpu_id(false);
 }
 
 void __init register_lapic_address(unsigned long address)
@@ -2111,7 +2130,7 @@
 	mp_lapic_addr = address;
 
 	if (!x2apic_mode)
-		apic_set_fixmap();
+		apic_set_fixmap(true);
 }
 
 /*
--- linux-qcom-6.8.0.orig/arch/x86/kernel/apic/apic_flat_64.c
+++ linux-qcom-6.8.0/arch/x86/kernel/apic/apic_flat_64.c
@@ -8,55 +8,13 @@
  * Martin Bligh, Andi Kleen, James Bottomley, John Stultz, and
  * James Cleverdon.
  */
-#include <linux/cpumask.h>
 #include <linux/export.h>
-#include <linux/acpi.h>
 
-#include <asm/jailhouse_para.h>
 #include <asm/apic.h>
 
 #include "local.h"
 
-static struct apic apic_physflat;
-static struct apic apic_flat;
-
-struct apic *apic __ro_after_init = &apic_flat;
-EXPORT_SYMBOL_GPL(apic);
-
-static int flat_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
-{
-	return 1;
-}
-
-static void _flat_send_IPI_mask(unsigned long mask, int vector)
-{
-	unsigned long flags;
-
-	local_irq_save(flags);
-	__default_send_IPI_dest_field(mask, vector, APIC_DEST_LOGICAL);
-	local_irq_restore(flags);
-}
-
-static void flat_send_IPI_mask(const struct cpumask *cpumask, int vector)
-{
-	unsigned long mask = cpumask_bits(cpumask)[0];
-
-	_flat_send_IPI_mask(mask, vector);
-}
-
-static void
-flat_send_IPI_mask_allbutself(const struct cpumask *cpumask, int vector)
-{
-	unsigned long mask = cpumask_bits(cpumask)[0];
-	int cpu = smp_processor_id();
-
-	if (cpu < BITS_PER_LONG)
-		__clear_bit(cpu, &mask);
-
-	_flat_send_IPI_mask(mask, vector);
-}
-
-static u32 flat_get_apic_id(u32 x)
+static u32 physflat_get_apic_id(u32 x)
 {
 	return (x >> 24) & 0xFF;
 }
@@ -71,79 +29,14 @@
 	return initial_apic_id >> index_msb;
 }
 
-static int flat_probe(void)
+static int physflat_probe(void)
 {
 	return 1;
 }
 
-static struct apic apic_flat __ro_after_init = {
-	.name				= "flat",
-	.probe				= flat_probe,
-	.acpi_madt_oem_check		= flat_acpi_madt_oem_check,
-	.apic_id_registered		= default_apic_id_registered,
-
-	.dest_mode_logical		= true,
-
-	.disable_esr			= 0,
-
-	.init_apic_ldr			= default_init_apic_ldr,
-	.cpu_present_to_apicid		= default_cpu_present_to_apicid,
-	.phys_pkg_id			= flat_phys_pkg_id,
-
-	.max_apic_id			= 0xFE,
-	.get_apic_id			= flat_get_apic_id,
-	.set_apic_id			= set_apic_id,
-
-	.calc_dest_apicid		= apic_flat_calc_apicid,
-
-	.send_IPI			= default_send_IPI_single,
-	.send_IPI_mask			= flat_send_IPI_mask,
-	.send_IPI_mask_allbutself	= flat_send_IPI_mask_allbutself,
-	.send_IPI_allbutself		= default_send_IPI_allbutself,
-	.send_IPI_all			= default_send_IPI_all,
-	.send_IPI_self			= default_send_IPI_self,
-	.nmi_to_offline_cpu		= true,
-
-	.read				= native_apic_mem_read,
-	.write				= native_apic_mem_write,
-	.eoi				= native_apic_mem_eoi,
-	.icr_read			= native_apic_icr_read,
-	.icr_write			= native_apic_icr_write,
-	.wait_icr_idle			= apic_mem_wait_icr_idle,
-	.safe_wait_icr_idle		= apic_mem_wait_icr_idle_timeout,
-};
-
-/*
- * Physflat mode is used when there are more than 8 CPUs on a system.
- * We cannot use logical delivery in this case because the mask
- * overflows, so use physical mode.
- */
 static int physflat_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
 {
-#ifdef CONFIG_ACPI
-	/*
-	 * Quirk: some x86_64 machines can only use physical APIC mode
-	 * regardless of how many processors are present (x86_64 ES7000
-	 * is an example).
-	 */
-	if (acpi_gbl_FADT.header.revision >= FADT2_REVISION_ID &&
-		(acpi_gbl_FADT.flags & ACPI_FADT_APIC_PHYSICAL)) {
-		printk(KERN_DEBUG "system APIC only can use physical flat");
-		return 1;
-	}
-
-	if (!strncmp(oem_id, "IBM", 3) && !strncmp(oem_table_id, "EXA", 3)) {
-		printk(KERN_DEBUG "IBM Summit detected, will use apic physical");
-		return 1;
-	}
-#endif
-
-	return 0;
-}
-
-static int physflat_probe(void)
-{
-	return apic == &apic_physflat || num_possible_cpus() > 8 || jailhouse_paravirt();
+	return 1;
 }
 
 static struct apic apic_physflat __ro_after_init = {
@@ -161,7 +54,7 @@
 	.phys_pkg_id			= flat_phys_pkg_id,
 
 	.max_apic_id			= 0xFE,
-	.get_apic_id			= flat_get_apic_id,
+	.get_apic_id			= physflat_get_apic_id,
 	.set_apic_id			= set_apic_id,
 
 	.calc_dest_apicid		= apic_default_calc_apicid,
@@ -182,8 +75,7 @@
 	.wait_icr_idle			= apic_mem_wait_icr_idle,
 	.safe_wait_icr_idle		= apic_mem_wait_icr_idle_timeout,
 };
+apic_driver(apic_physflat);
 
-/*
- * We need to check for physflat first, so this order is important.
- */
-apic_drivers(apic_physflat, apic_flat);
+struct apic *apic __ro_after_init = &apic_physflat;
+EXPORT_SYMBOL_GPL(apic);
--- linux-qcom-6.8.0.orig/arch/x86/kernel/apic/io_apic.c
+++ linux-qcom-6.8.0/arch/x86/kernel/apic/io_apic.c
@@ -352,27 +352,26 @@
  * shared ISA-space IRQs, so we have to support them. We are super
  * fast in the common case, and fast for shared ISA-space IRQs.
  */
-static int __add_pin_to_irq_node(struct mp_chip_data *data,
-				 int node, int apic, int pin)
+static bool add_pin_to_irq_node(struct mp_chip_data *data, int node, int apic, int pin)
 {
 	struct irq_pin_list *entry;
 
-	/* don't allow duplicates */
-	for_each_irq_pin(entry, data->irq_2_pin)
+	/* Don't allow duplicates */
+	for_each_irq_pin(entry, data->irq_2_pin) {
 		if (entry->apic == apic && entry->pin == pin)
-			return 0;
+			return true;
+	}
 
 	entry = kzalloc_node(sizeof(struct irq_pin_list), GFP_ATOMIC, node);
 	if (!entry) {
-		pr_err("can not alloc irq_pin_list (%d,%d,%d)\n",
-		       node, apic, pin);
-		return -ENOMEM;
+		pr_err("Cannot allocate irq_pin_list (%d,%d,%d)\n", node, apic, pin);
+		return false;
 	}
+
 	entry->apic = apic;
 	entry->pin = pin;
 	list_add_tail(&entry->list, &data->irq_2_pin);
-
-	return 0;
+	return true;
 }
 
 static void __remove_pin_from_irq(struct mp_chip_data *data, int apic, int pin)
@@ -387,13 +386,6 @@
 		}
 }
 
-static void add_pin_to_irq_node(struct mp_chip_data *data,
-				int node, int apic, int pin)
-{
-	if (__add_pin_to_irq_node(data, node, apic, pin))
-		panic("IO-APIC: failed to add irq-pin. Can not proceed\n");
-}
-
 /*
  * Reroute an IRQ to a different pin.
  */
@@ -1002,8 +994,7 @@
 	if (irq_data && irq_data->parent_data) {
 		if (!mp_check_pin_attr(irq, info))
 			return -EBUSY;
-		if (__add_pin_to_irq_node(irq_data->chip_data, node, ioapic,
-					  info->ioapic.pin))
+		if (!add_pin_to_irq_node(irq_data->chip_data, node, ioapic, info->ioapic.pin))
 			return -ENOMEM;
 	} else {
 		info->flags |= X86_IRQ_ALLOC_LEGACY;
@@ -3037,10 +3028,8 @@
 		return -ENOMEM;
 
 	ret = irq_domain_alloc_irqs_parent(domain, virq, nr_irqs, info);
-	if (ret < 0) {
-		kfree(data);
-		return ret;
-	}
+	if (ret < 0)
+		goto free_data;
 
 	INIT_LIST_HEAD(&data->irq_2_pin);
 	irq_data->hwirq = info->ioapic.pin;
@@ -3049,7 +3038,10 @@
 	irq_data->chip_data = data;
 	mp_irqdomain_get_attr(mp_pin_to_gsi(ioapic, pin), data, info);
 
-	add_pin_to_irq_node(data, ioapic_alloc_attr_node(info), ioapic, pin);
+	if (!add_pin_to_irq_node(data, ioapic_alloc_attr_node(info), ioapic, pin)) {
+		ret = -ENOMEM;
+		goto free_irqs;
+	}
 
 	mp_preconfigure_entry(data);
 	mp_register_handler(virq, data->is_level);
@@ -3064,6 +3056,12 @@
 		    ioapic, mpc_ioapic_id(ioapic), pin, virq,
 		    data->is_level, data->active_low);
 	return 0;
+
+free_irqs:
+	irq_domain_free_irqs_parent(domain, virq, nr_irqs);
+free_data:
+	kfree(data);
+	return ret;
 }
 
 void mp_irqdomain_free(struct irq_domain *domain, unsigned int virq,
--- linux-qcom-6.8.0.orig/arch/x86/kernel/apic/vector.c
+++ linux-qcom-6.8.0/arch/x86/kernel/apic/vector.c
@@ -1036,7 +1036,8 @@
 			add_timer_on(&cl->timer, cpu);
 		}
 	} else {
-		apicd->prev_vector = 0;
+		pr_warn("IRQ %u schedule cleanup for offline CPU %u\n", apicd->irq, cpu);
+		free_moved_vector(apicd);
 	}
 	raw_spin_unlock(&vector_lock);
 }
@@ -1073,6 +1074,7 @@
  */
 void irq_force_complete_move(struct irq_desc *desc)
 {
+	unsigned int cpu = smp_processor_id();
 	struct apic_chip_data *apicd;
 	struct irq_data *irqd;
 	unsigned int vector;
@@ -1097,10 +1099,11 @@
 		goto unlock;
 
 	/*
-	 * If prev_vector is empty, no action required.
+	 * If prev_vector is empty or the descriptor is neither currently
+	 * nor previously on the outgoing CPU no action required.
 	 */
 	vector = apicd->prev_vector;
-	if (!vector)
+	if (!vector || (apicd->cpu != cpu && apicd->prev_cpu != cpu))
 		goto unlock;
 
 	/*
--- linux-qcom-6.8.0.orig/arch/x86/kernel/callthunks.c
+++ linux-qcom-6.8.0/arch/x86/kernel/callthunks.c
@@ -141,11 +141,6 @@
 	    dest < (void*)relocate_kernel + KEXEC_CONTROL_CODE_MAX_SIZE)
 		return true;
 #endif
-#ifdef CONFIG_XEN
-	if (dest >= (void *)hypercall_page &&
-	    dest < (void*)hypercall_page + PAGE_SIZE)
-		return true;
-#endif
 	return false;
 }
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cet.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cet.c
@@ -81,6 +81,34 @@
 
 static __ro_after_init bool ibt_fatal = true;
 
+/*
+ * By definition, all missing-ENDBRANCH #CPs are a result of WFE && !ENDBR.
+ *
+ * For the kernel IBT no ENDBR selftest where #CPs are deliberately triggered,
+ * the WFE state of the interrupted context needs to be cleared to let execution
+ * continue.  Otherwise when the CPU resumes from the instruction that just
+ * caused the previous #CP, another missing-ENDBRANCH #CP is raised and the CPU
+ * enters a dead loop.
+ *
+ * This is not a problem with IDT because it doesn't preserve WFE and IRET doesn't
+ * set WFE.  But FRED provides space on the entry stack (in an expanded CS area)
+ * to save and restore the WFE state, thus the WFE state is no longer clobbered,
+ * so software must clear it.
+ */
+static void ibt_clear_fred_wfe(struct pt_regs *regs)
+{
+	/*
+	 * No need to do any FRED checks.
+	 *
+	 * For IDT event delivery, the high-order 48 bits of CS are pushed
+	 * as 0s into the stack, and later IRET ignores these bits.
+	 *
+	 * For FRED, a test to check if fred_cs.wfe is set would be dropped
+	 * by compilers.
+	 */
+	regs->fred_cs.wfe = 0;
+}
+
 static void do_kernel_cp_fault(struct pt_regs *regs, unsigned long error_code)
 {
 	if ((error_code & CP_EC) != CP_ENDBR) {
@@ -90,6 +118,7 @@
 
 	if (unlikely(regs->ip == (unsigned long)&ibt_selftest_noendbr)) {
 		regs->ax = 0;
+		ibt_clear_fred_wfe(regs);
 		return;
 	}
 
@@ -97,6 +126,7 @@
 	if (!ibt_fatal) {
 		printk(KERN_DEFAULT CUT_HERE);
 		__warn(__FILE__, __LINE__, (void *)regs->ip, TAINT_WARN, regs, NULL);
+		ibt_clear_fred_wfe(regs);
 		return;
 	}
 	BUG();
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/amd.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/amd.c
@@ -13,6 +13,7 @@
 #include <asm/apic.h>
 #include <asm/cacheinfo.h>
 #include <asm/cpu.h>
+#include <asm/cpu_device_id.h>
 #include <asm/spec-ctrl.h>
 #include <asm/smp.h>
 #include <asm/numa.h>
@@ -572,10 +573,9 @@
 
 	case 0x1a:
 		switch (c->x86_model) {
-		case 0x00 ... 0x0f:
-		case 0x20 ... 0x2f:
+		case 0x00 ... 0x2f:
 		case 0x40 ... 0x4f:
-		case 0x70 ... 0x7f:
+		case 0x60 ... 0x7f:
 			setup_force_cpu_cap(X86_FEATURE_ZEN5);
 			break;
 		default:
@@ -926,6 +926,12 @@
 	clear_rdrand_cpuid_bit(c);
 }
 
+static const struct x86_cpu_desc erratum_1386_microcode[] = {
+	AMD_CPU_DESC(0x17,  0x1, 0x2, 0x0800126e),
+	AMD_CPU_DESC(0x17, 0x31, 0x0, 0x08301052),
+	{},
+};
+
 static void fix_erratum_1386(struct cpuinfo_x86 *c)
 {
 	/*
@@ -935,7 +941,13 @@
 	 *
 	 * Affected parts all have no supervisor XSAVE states, meaning that
 	 * the XSAVEC instruction (which works fine) is equivalent.
+	 *
+	 * Clear the feature flag only on microcode revisions which
+	 * don't have the fix.
 	 */
+	if (x86_cpu_has_min_microcode_rev(erratum_1386_microcode))
+		return;
+
 	clear_cpu_cap(c, X86_FEATURE_XSAVES);
 }
 
@@ -989,11 +1001,11 @@
 	u32 good_rev = 0;
 
 	switch (boot_cpu_data.x86_model) {
-	case 0x30 ... 0x3f: good_rev = 0x0830107a; break;
-	case 0x60 ... 0x67: good_rev = 0x0860010b; break;
-	case 0x68 ... 0x6f: good_rev = 0x08608105; break;
-	case 0x70 ... 0x7f: good_rev = 0x08701032; break;
-	case 0xa0 ... 0xaf: good_rev = 0x08a00008; break;
+	case 0x30 ... 0x3f: good_rev = 0x0830107b; break;
+	case 0x60 ... 0x67: good_rev = 0x0860010c; break;
+	case 0x68 ... 0x6f: good_rev = 0x08608107; break;
+	case 0x70 ... 0x7f: good_rev = 0x08701033; break;
+	case 0xa0 ... 0xaf: good_rev = 0x08a00009; break;
 
 	default:
 		return false;
@@ -1050,6 +1062,17 @@
 
 	if (!cpu_has(c, X86_FEATURE_HYPERVISOR))
 		msr_set_bit(MSR_ZEN4_BP_CFG, MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT);
+
+	/*
+	 * These Zen4 SoCs advertise support for virtualized VMLOAD/VMSAVE
+	 * in some BIOS versions but they can lead to random host reboots.
+	 */
+	switch (c->x86_model) {
+	case 0x18 ... 0x1f:
+	case 0x60 ... 0x7f:
+		clear_cpu_cap(c, X86_FEATURE_V_VMSAVE_VMLOAD);
+		break;
+	}
 }
 
 static void init_amd_zen5(struct cpuinfo_x86 *c)
@@ -1178,7 +1201,7 @@
 	 */
 	if (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&
 	    cpu_has(c, X86_FEATURE_AUTOIBRS))
-		WARN_ON_ONCE(msr_set_bit(MSR_EFER, _EFER_AUTOIBRS));
+		WARN_ON_ONCE(msr_set_bit(MSR_EFER, _EFER_AUTOIBRS) < 0);
 
 	/* AMD CPUs don't need fencing after x2APIC/TSC_DEADLINE MSR writes. */
 	clear_cpu_cap(c, X86_FEATURE_APIC_MSRS_FENCE);
@@ -1343,7 +1366,8 @@
 	if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
 		return;
 
-	on_each_cpu(zenbleed_check_cpu, NULL, 1);
+	if (cpu_feature_enabled(X86_FEATURE_ZEN2))
+		on_each_cpu(zenbleed_check_cpu, NULL, 1);
 }
 
 /*
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/bugs.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/bugs.c
@@ -61,6 +61,8 @@
 u64 x86_pred_cmd __ro_after_init = PRED_CMD_IBPB;
 EXPORT_SYMBOL_GPL(x86_pred_cmd);
 
+static u64 __ro_after_init x86_arch_cap_msr;
+
 static DEFINE_MUTEX(spec_ctrl_mutex);
 
 void (*x86_return_thunk)(void) __ro_after_init = __x86_return_thunk;
@@ -144,6 +146,8 @@
 		x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK;
 	}
 
+	x86_arch_cap_msr = x86_read_arch_cap_msr();
+
 	/* Select the proper CPU mitigations before patching alternatives: */
 	spectre_v1_select_mitigation();
 	spectre_v2_select_mitigation();
@@ -301,8 +305,6 @@
 
 static void __init taa_select_mitigation(void)
 {
-	u64 ia32_cap;
-
 	if (!boot_cpu_has_bug(X86_BUG_TAA)) {
 		taa_mitigation = TAA_MITIGATION_OFF;
 		return;
@@ -341,9 +343,8 @@
 	 * On MDS_NO=1 CPUs if ARCH_CAP_TSX_CTRL_MSR is not set, microcode
 	 * update is required.
 	 */
-	ia32_cap = x86_read_arch_cap_msr();
-	if ( (ia32_cap & ARCH_CAP_MDS_NO) &&
-	    !(ia32_cap & ARCH_CAP_TSX_CTRL_MSR))
+	if ( (x86_arch_cap_msr & ARCH_CAP_MDS_NO) &&
+	    !(x86_arch_cap_msr & ARCH_CAP_TSX_CTRL_MSR))
 		taa_mitigation = TAA_MITIGATION_UCODE_NEEDED;
 
 	/*
@@ -401,8 +402,6 @@
 
 static void __init mmio_select_mitigation(void)
 {
-	u64 ia32_cap;
-
 	if (!boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA) ||
 	     boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN) ||
 	     cpu_mitigations_off()) {
@@ -413,8 +412,6 @@
 	if (mmio_mitigation == MMIO_MITIGATION_OFF)
 		return;
 
-	ia32_cap = x86_read_arch_cap_msr();
-
 	/*
 	 * Enable CPU buffer clear mitigation for host and VMM, if also affected
 	 * by MDS or TAA. Otherwise, enable mitigation for VMM only.
@@ -422,6 +419,13 @@
 	if (boot_cpu_has_bug(X86_BUG_MDS) || (boot_cpu_has_bug(X86_BUG_TAA) &&
 					      boot_cpu_has(X86_FEATURE_RTM)))
 		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
+
+	/*
+	 * X86_FEATURE_CLEAR_CPU_BUF could be enabled by other VERW based
+	 * mitigations, disable KVM-only mitigation in that case.
+	 */
+	if (boot_cpu_has(X86_FEATURE_CLEAR_CPU_BUF))
+		static_branch_disable(&mmio_stale_data_clear);
 	else
 		static_branch_enable(&mmio_stale_data_clear);
 
@@ -430,7 +434,7 @@
 	 * be propagated to uncore buffers, clearing the Fill buffers on idle
 	 * is required irrespective of SMT state.
 	 */
-	if (!(ia32_cap & ARCH_CAP_FBSDP_NO))
+	if (!(x86_arch_cap_msr & ARCH_CAP_FBSDP_NO))
 		static_branch_enable(&mds_idle_clear);
 
 	/*
@@ -440,10 +444,10 @@
 	 * FB_CLEAR or by the presence of both MD_CLEAR and L1D_FLUSH on MDS
 	 * affected systems.
 	 */
-	if ((ia32_cap & ARCH_CAP_FB_CLEAR) ||
+	if ((x86_arch_cap_msr & ARCH_CAP_FB_CLEAR) ||
 	    (boot_cpu_has(X86_FEATURE_MD_CLEAR) &&
 	     boot_cpu_has(X86_FEATURE_FLUSH_L1D) &&
-	     !(ia32_cap & ARCH_CAP_MDS_NO)))
+	     !(x86_arch_cap_msr & ARCH_CAP_MDS_NO)))
 		mmio_mitigation = MMIO_MITIGATION_VERW;
 	else
 		mmio_mitigation = MMIO_MITIGATION_UCODE_NEEDED;
@@ -474,6 +478,57 @@
 early_param("mmio_stale_data", mmio_stale_data_parse_cmdline);
 
 #undef pr_fmt
+#define pr_fmt(fmt)	"Register File Data Sampling: " fmt
+
+enum rfds_mitigations {
+	RFDS_MITIGATION_OFF,
+	RFDS_MITIGATION_VERW,
+	RFDS_MITIGATION_UCODE_NEEDED,
+};
+
+/* Default mitigation for Register File Data Sampling */
+static enum rfds_mitigations rfds_mitigation __ro_after_init =
+	IS_ENABLED(CONFIG_MITIGATION_RFDS) ? RFDS_MITIGATION_VERW : RFDS_MITIGATION_OFF;
+
+static const char * const rfds_strings[] = {
+	[RFDS_MITIGATION_OFF]			= "Vulnerable",
+	[RFDS_MITIGATION_VERW]			= "Mitigation: Clear Register File",
+	[RFDS_MITIGATION_UCODE_NEEDED]		= "Vulnerable: No microcode",
+};
+
+static void __init rfds_select_mitigation(void)
+{
+	if (!boot_cpu_has_bug(X86_BUG_RFDS) || cpu_mitigations_off()) {
+		rfds_mitigation = RFDS_MITIGATION_OFF;
+		return;
+	}
+	if (rfds_mitigation == RFDS_MITIGATION_OFF)
+		return;
+
+	if (x86_arch_cap_msr & ARCH_CAP_RFDS_CLEAR)
+		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
+	else
+		rfds_mitigation = RFDS_MITIGATION_UCODE_NEEDED;
+}
+
+static __init int rfds_parse_cmdline(char *str)
+{
+	if (!str)
+		return -EINVAL;
+
+	if (!boot_cpu_has_bug(X86_BUG_RFDS))
+		return 0;
+
+	if (!strcmp(str, "off"))
+		rfds_mitigation = RFDS_MITIGATION_OFF;
+	else if (!strcmp(str, "on"))
+		rfds_mitigation = RFDS_MITIGATION_VERW;
+
+	return 0;
+}
+early_param("reg_file_data_sampling", rfds_parse_cmdline);
+
+#undef pr_fmt
 #define pr_fmt(fmt)     "" fmt
 
 static void __init md_clear_update_mitigation(void)
@@ -498,11 +553,19 @@
 		taa_mitigation = TAA_MITIGATION_VERW;
 		taa_select_mitigation();
 	}
-	if (mmio_mitigation == MMIO_MITIGATION_OFF &&
-	    boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA)) {
+	/*
+	 * MMIO_MITIGATION_OFF is not checked here so that mmio_stale_data_clear
+	 * gets updated correctly as per X86_FEATURE_CLEAR_CPU_BUF state.
+	 */
+	if (boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA)) {
 		mmio_mitigation = MMIO_MITIGATION_VERW;
 		mmio_select_mitigation();
 	}
+	if (rfds_mitigation == RFDS_MITIGATION_OFF &&
+	    boot_cpu_has_bug(X86_BUG_RFDS)) {
+		rfds_mitigation = RFDS_MITIGATION_VERW;
+		rfds_select_mitigation();
+	}
 out:
 	if (boot_cpu_has_bug(X86_BUG_MDS))
 		pr_info("MDS: %s\n", mds_strings[mds_mitigation]);
@@ -512,6 +575,8 @@
 		pr_info("MMIO Stale Data: %s\n", mmio_strings[mmio_mitigation]);
 	else if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN))
 		pr_info("MMIO Stale Data: Unknown: No mitigations\n");
+	if (boot_cpu_has_bug(X86_BUG_RFDS))
+		pr_info("Register File Data Sampling: %s\n", rfds_strings[rfds_mitigation]);
 }
 
 static void __init md_clear_select_mitigation(void)
@@ -519,11 +584,12 @@
 	mds_select_mitigation();
 	taa_select_mitigation();
 	mmio_select_mitigation();
+	rfds_select_mitigation();
 
 	/*
-	 * As MDS, TAA and MMIO Stale Data mitigations are inter-related, update
-	 * and print their mitigation after MDS, TAA and MMIO Stale Data
-	 * mitigation selection is done.
+	 * As these mitigations are inter-related and rely on VERW instruction
+	 * to clear the microarchitural buffers, update and print their status
+	 * after mitigation selection is done for each of these vulnerabilities.
 	 */
 	md_clear_update_mitigation();
 }
@@ -590,8 +656,6 @@
 
 static void __init srbds_select_mitigation(void)
 {
-	u64 ia32_cap;
-
 	if (!boot_cpu_has_bug(X86_BUG_SRBDS))
 		return;
 
@@ -600,8 +664,7 @@
 	 * are only exposed to SRBDS when TSX is enabled or when CPU is affected
 	 * by Processor MMIO Stale Data vulnerability.
 	 */
-	ia32_cap = x86_read_arch_cap_msr();
-	if ((ia32_cap & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM) &&
+	if ((x86_arch_cap_msr & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM) &&
 	    !boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA))
 		srbds_mitigation = SRBDS_MITIGATION_TSX_OFF;
 	else if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
@@ -744,7 +807,7 @@
 	/* Will verify below that mitigation _can_ be disabled */
 
 	/* No microcode */
-	if (!(x86_read_arch_cap_msr() & ARCH_CAP_GDS_CTRL)) {
+	if (!(x86_arch_cap_msr & ARCH_CAP_GDS_CTRL)) {
 		if (gds_mitigation == GDS_MITIGATION_FORCE) {
 			/*
 			 * This only needs to be done on the boot CPU so do it
@@ -1049,8 +1112,25 @@
 
 	case RETBLEED_MITIGATION_IBPB:
 		setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+
+		/*
+		 * IBPB on entry already obviates the need for
+		 * software-based untraining so clear those in case some
+		 * other mitigation like SRSO has selected them.
+		 */
+		setup_clear_cpu_cap(X86_FEATURE_UNRET);
+		setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
+
 		setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 		mitigate_smt = true;
+
+		/*
+		 * There is no need for RSB filling: entry_ibpb() ensures
+		 * all predictions, including the RSB, are invalidated,
+		 * regardless of IBPB implementation.
+		 */
+		setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
+
 		break;
 
 	case RETBLEED_MITIGATION_STUFF:
@@ -1474,20 +1554,25 @@
 	return SPECTRE_V2_RETPOLINE;
 }
 
+static bool __ro_after_init rrsba_disabled;
+
 /* Disable in-kernel use of non-RSB RET predictors */
 static void __init spec_ctrl_disable_kernel_rrsba(void)
 {
-	u64 ia32_cap;
+	if (rrsba_disabled)
+		return;
 
-	if (!boot_cpu_has(X86_FEATURE_RRSBA_CTRL))
+	if (!(x86_arch_cap_msr & ARCH_CAP_RRSBA)) {
+		rrsba_disabled = true;
 		return;
+	}
 
-	ia32_cap = x86_read_arch_cap_msr();
+	if (!boot_cpu_has(X86_FEATURE_RRSBA_CTRL))
+		return;
 
-	if (ia32_cap & ARCH_CAP_RRSBA) {
-		x86_spec_ctrl_base |= SPEC_CTRL_RRSBA_DIS_S;
-		update_spec_ctrl(x86_spec_ctrl_base);
-	}
+	x86_spec_ctrl_base |= SPEC_CTRL_RRSBA_DIS_S;
+	update_spec_ctrl(x86_spec_ctrl_base);
+	rrsba_disabled = true;
 }
 
 static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_mitigation mode)
@@ -1537,6 +1622,74 @@
 	dump_stack();
 }
 
+/*
+ * Set BHI_DIS_S to prevent indirect branches in kernel to be influenced by
+ * branch history in userspace. Not needed if BHI_NO is set.
+ */
+static bool __init spec_ctrl_bhi_dis(void)
+{
+	if (!boot_cpu_has(X86_FEATURE_BHI_CTRL))
+		return false;
+
+	x86_spec_ctrl_base |= SPEC_CTRL_BHI_DIS_S;
+	update_spec_ctrl(x86_spec_ctrl_base);
+	setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_HW);
+
+	return true;
+}
+
+enum bhi_mitigations {
+	BHI_MITIGATION_OFF,
+	BHI_MITIGATION_ON,
+};
+
+static enum bhi_mitigations bhi_mitigation __ro_after_init =
+	IS_ENABLED(CONFIG_MITIGATION_SPECTRE_BHI) ? BHI_MITIGATION_ON : BHI_MITIGATION_OFF;
+
+static int __init spectre_bhi_parse_cmdline(char *str)
+{
+	if (!str)
+		return -EINVAL;
+
+	if (!strcmp(str, "off"))
+		bhi_mitigation = BHI_MITIGATION_OFF;
+	else if (!strcmp(str, "on"))
+		bhi_mitigation = BHI_MITIGATION_ON;
+	else
+		pr_err("Ignoring unknown spectre_bhi option (%s)", str);
+
+	return 0;
+}
+early_param("spectre_bhi", spectre_bhi_parse_cmdline);
+
+static void __init bhi_select_mitigation(void)
+{
+	if (bhi_mitigation == BHI_MITIGATION_OFF)
+		return;
+
+	/* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */
+	if (boot_cpu_has(X86_FEATURE_RETPOLINE) &&
+	    !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE)) {
+		spec_ctrl_disable_kernel_rrsba();
+		if (rrsba_disabled)
+			return;
+	}
+
+	if (spec_ctrl_bhi_dis())
+		return;
+
+	if (!IS_ENABLED(CONFIG_X86_64))
+		return;
+
+	/* Mitigate KVM by default */
+	setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT);
+	pr_info("Spectre BHI mitigation: SW BHB clearing on vm exit\n");
+
+	/* Mitigate syscalls when the mitigation is forced =on */
+	setup_force_cpu_cap(X86_FEATURE_CLEAR_BHB_LOOP);
+	pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n");
+}
+
 static void __init spectre_v2_select_mitigation(void)
 {
 	enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
@@ -1648,6 +1801,9 @@
 	    mode == SPECTRE_V2_RETPOLINE)
 		spec_ctrl_disable_kernel_rrsba();
 
+	if (boot_cpu_has(X86_BUG_BHI))
+		bhi_select_mitigation();
+
 	spectre_v2_enabled = mode;
 	pr_info("%s\n", spectre_v2_strings[mode]);
 
@@ -1762,8 +1918,6 @@
 /* Update the static key controlling the MDS CPU buffer clear in idle */
 static void update_mds_branch_idle(void)
 {
-	u64 ia32_cap = x86_read_arch_cap_msr();
-
 	/*
 	 * Enable the idle clearing if SMT is active on CPUs which are
 	 * affected only by MSBDS and not any other MDS variant.
@@ -1778,7 +1932,7 @@
 	if (sched_smt_active()) {
 		static_branch_enable(&mds_idle_clear);
 	} else if (mmio_mitigation == MMIO_MITIGATION_OFF ||
-		   (ia32_cap & ARCH_CAP_FBSDP_NO)) {
+		   (x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) {
 		static_branch_disable(&mds_idle_clear);
 	}
 }
@@ -2407,10 +2561,9 @@
 {
 	bool has_microcode = boot_cpu_has(X86_FEATURE_IBPB_BRTYPE);
 
-	if (cpu_mitigations_off())
-		return;
-
-	if (!boot_cpu_has_bug(X86_BUG_SRSO)) {
+	if (!boot_cpu_has_bug(X86_BUG_SRSO) ||
+	    cpu_mitigations_off() ||
+	    srso_cmd == SRSO_CMD_OFF) {
 		if (boot_cpu_has(X86_FEATURE_SBPB))
 			x86_pred_cmd = PRED_CMD_SBPB;
 		return;
@@ -2441,11 +2594,6 @@
 	}
 
 	switch (srso_cmd) {
-	case SRSO_CMD_OFF:
-		if (boot_cpu_has(X86_FEATURE_SBPB))
-			x86_pred_cmd = PRED_CMD_SBPB;
-		return;
-
 	case SRSO_CMD_MICROCODE:
 		if (has_microcode) {
 			srso_mitigation = SRSO_MITIGATION_MICROCODE;
@@ -2483,6 +2631,14 @@
 			if (has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
 				srso_mitigation = SRSO_MITIGATION_IBPB;
+
+				/*
+				 * IBPB on entry already obviates the need for
+				 * software-based untraining so clear those in case some
+				 * other mitigation like Retbleed has selected them.
+				 */
+				setup_clear_cpu_cap(X86_FEATURE_UNRET);
+				setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
 			}
 		} else {
 			pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n");
@@ -2494,11 +2650,20 @@
 			if (!boot_cpu_has(X86_FEATURE_ENTRY_IBPB) && has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 				srso_mitigation = SRSO_MITIGATION_IBPB_ON_VMEXIT;
+
+				/*
+				 * There is no need for RSB filling: entry_ibpb() ensures
+				 * all predictions, including the RSB, are invalidated,
+				 * regardless of IBPB implementation.
+				 */
+				setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
 			}
 		} else {
 			pr_err("WARNING: kernel not compiled with CPU_SRSO.\n");
                 }
 		break;
+	default:
+		break;
 	}
 
 out:
@@ -2612,6 +2777,11 @@
 			  sched_smt_active() ? "vulnerable" : "disabled");
 }
 
+static ssize_t rfds_show_state(char *buf)
+{
+	return sysfs_emit(buf, "%s\n", rfds_strings[rfds_mitigation]);
+}
+
 static char *stibp_state(void)
 {
 	if (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&
@@ -2620,15 +2790,15 @@
 
 	switch (spectre_v2_user_stibp) {
 	case SPECTRE_V2_USER_NONE:
-		return ", STIBP: disabled";
+		return "; STIBP: disabled";
 	case SPECTRE_V2_USER_STRICT:
-		return ", STIBP: forced";
+		return "; STIBP: forced";
 	case SPECTRE_V2_USER_STRICT_PREFERRED:
-		return ", STIBP: always-on";
+		return "; STIBP: always-on";
 	case SPECTRE_V2_USER_PRCTL:
 	case SPECTRE_V2_USER_SECCOMP:
 		if (static_key_enabled(&switch_to_cond_stibp))
-			return ", STIBP: conditional";
+			return "; STIBP: conditional";
 	}
 	return "";
 }
@@ -2637,10 +2807,10 @@
 {
 	if (boot_cpu_has(X86_FEATURE_IBPB)) {
 		if (static_key_enabled(&switch_mm_always_ibpb))
-			return ", IBPB: always-on";
+			return "; IBPB: always-on";
 		if (static_key_enabled(&switch_mm_cond_ibpb))
-			return ", IBPB: conditional";
-		return ", IBPB: disabled";
+			return "; IBPB: conditional";
+		return "; IBPB: disabled";
 	}
 	return "";
 }
@@ -2650,14 +2820,32 @@
 	if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) {
 		if (boot_cpu_has(X86_FEATURE_RSB_VMEXIT_LITE) ||
 		    boot_cpu_has(X86_FEATURE_RSB_VMEXIT))
-			return ", PBRSB-eIBRS: SW sequence";
+			return "; PBRSB-eIBRS: SW sequence";
 		else
-			return ", PBRSB-eIBRS: Vulnerable";
+			return "; PBRSB-eIBRS: Vulnerable";
 	} else {
-		return ", PBRSB-eIBRS: Not affected";
+		return "; PBRSB-eIBRS: Not affected";
 	}
 }
 
+static const char *spectre_bhi_state(void)
+{
+	if (!boot_cpu_has_bug(X86_BUG_BHI))
+		return "; BHI: Not affected";
+	else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_HW))
+		return "; BHI: BHI_DIS_S";
+	else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP))
+		return "; BHI: SW loop, KVM: SW loop";
+	else if (boot_cpu_has(X86_FEATURE_RETPOLINE) &&
+		 !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE) &&
+		 rrsba_disabled)
+		return "; BHI: Retpoline";
+	else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT))
+		return "; BHI: Vulnerable, KVM: SW loop";
+
+	return "; BHI: Vulnerable";
+}
+
 static ssize_t spectre_v2_show_state(char *buf)
 {
 	if (spectre_v2_enabled == SPECTRE_V2_LFENCE)
@@ -2670,13 +2858,15 @@
 	    spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
 		return sysfs_emit(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n");
 
-	return sysfs_emit(buf, "%s%s%s%s%s%s%s\n",
+	return sysfs_emit(buf, "%s%s%s%s%s%s%s%s\n",
 			  spectre_v2_strings[spectre_v2_enabled],
 			  ibpb_state(),
-			  boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
+			  boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? "; IBRS_FW" : "",
 			  stibp_state(),
-			  boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
+			  boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? "; RSB filling" : "",
 			  pbrsb_eibrs_state(),
+			  spectre_bhi_state(),
+			  /* this should always be at the end */
 			  spectre_v2_module_string());
 }
 
@@ -2771,6 +2961,9 @@
 	case X86_BUG_GDS:
 		return gds_show_state(buf);
 
+	case X86_BUG_RFDS:
+		return rfds_show_state(buf);
+
 	default:
 		break;
 	}
@@ -2845,4 +3038,9 @@
 {
 	return cpu_show_common(dev, attr, buf, X86_BUG_GDS);
 }
+
+ssize_t cpu_show_reg_file_data_sampling(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	return cpu_show_common(dev, attr, buf, X86_BUG_RFDS);
+}
 #endif
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/cacheinfo.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/cacheinfo.c
@@ -178,7 +178,16 @@
 	struct amd_northbridge *nb;
 };
 
-static unsigned short num_cache_leaves;
+static inline unsigned int get_num_cache_leaves(unsigned int cpu)
+{
+	return get_cpu_cacheinfo(cpu)->num_leaves;
+}
+
+static inline void
+set_num_cache_leaves(unsigned int nr_leaves, unsigned int cpu)
+{
+	get_cpu_cacheinfo(cpu)->num_leaves = nr_leaves;
+}
 
 /* AMD doesn't have CPUID4. Emulate it here to report the same
    information to the user.  This makes some assumptions about the machine:
@@ -718,19 +727,21 @@
 void init_amd_cacheinfo(struct cpuinfo_x86 *c)
 {
 
+	unsigned int cpu = c->cpu_index;
+
 	if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
-		num_cache_leaves = find_num_cache_leaves(c);
+		set_num_cache_leaves(find_num_cache_leaves(c), cpu);
 	} else if (c->extended_cpuid_level >= 0x80000006) {
 		if (cpuid_edx(0x80000006) & 0xf000)
-			num_cache_leaves = 4;
+			set_num_cache_leaves(4, cpu);
 		else
-			num_cache_leaves = 3;
+			set_num_cache_leaves(3, cpu);
 	}
 }
 
 void init_hygon_cacheinfo(struct cpuinfo_x86 *c)
 {
-	num_cache_leaves = find_num_cache_leaves(c);
+	set_num_cache_leaves(find_num_cache_leaves(c), c->cpu_index);
 }
 
 void init_intel_cacheinfo(struct cpuinfo_x86 *c)
@@ -742,19 +753,19 @@
 	unsigned int l2_id = 0, l3_id = 0, num_threads_sharing, index_msb;
 
 	if (c->cpuid_level > 3) {
-		static int is_initialized;
-
-		if (is_initialized == 0) {
-			/* Init num_cache_leaves from boot CPU */
-			num_cache_leaves = find_num_cache_leaves(c);
-			is_initialized++;
-		}
+		/*
+		 * There should be at least one leaf. A non-zero value means
+		 * that the number of leaves has been initialized.
+		 */
+		if (!get_num_cache_leaves(c->cpu_index))
+			set_num_cache_leaves(find_num_cache_leaves(c),
+					     c->cpu_index);
 
 		/*
 		 * Whenever possible use cpuid(4), deterministic cache
 		 * parameters cpuid leaf to find the cache details
 		 */
-		for (i = 0; i < num_cache_leaves; i++) {
+		for (i = 0; i < get_num_cache_leaves(c->cpu_index); i++) {
 			struct _cpuid4_info_regs this_leaf = {};
 			int retval;
 
@@ -790,14 +801,14 @@
 	 * Don't use cpuid2 if cpuid4 is supported. For P4, we use cpuid2 for
 	 * trace cache
 	 */
-	if ((num_cache_leaves == 0 || c->x86 == 15) && c->cpuid_level > 1) {
+	if ((!get_num_cache_leaves(c->cpu_index) || c->x86 == 15) && c->cpuid_level > 1) {
 		/* supports eax=2  call */
 		int j, n;
 		unsigned int regs[4];
 		unsigned char *dp = (unsigned char *)regs;
 		int only_trace = 0;
 
-		if (num_cache_leaves != 0 && c->x86 == 15)
+		if (get_num_cache_leaves(c->cpu_index) && c->x86 == 15)
 			only_trace = 1;
 
 		/* Number of times to iterate */
@@ -991,14 +1002,6 @@
 
 int init_cache_level(unsigned int cpu)
 {
-	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
-
-	if (!num_cache_leaves)
-		return -ENOENT;
-	if (!this_cpu_ci)
-		return -EINVAL;
-	this_cpu_ci->num_levels = 3;
-	this_cpu_ci->num_leaves = num_cache_leaves;
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/common.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/common.c
@@ -909,7 +909,7 @@
 #endif
 }
 
-static void get_cpu_vendor(struct cpuinfo_x86 *c)
+void get_cpu_vendor(struct cpuinfo_x86 *c)
 {
 	char *v = c->x86_vendor_id;
 	int i;
@@ -1096,18 +1096,9 @@
 void get_cpu_address_sizes(struct cpuinfo_x86 *c)
 {
 	u32 eax, ebx, ecx, edx;
-	bool vp_bits_from_cpuid = true;
 
 	if (!cpu_has(c, X86_FEATURE_CPUID) ||
-	    (c->extended_cpuid_level < 0x80000008))
-		vp_bits_from_cpuid = false;
-
-	if (vp_bits_from_cpuid) {
-		cpuid(0x80000008, &eax, &ebx, &ecx, &edx);
-
-		c->x86_virt_bits = (eax >> 8) & 0xff;
-		c->x86_phys_bits = eax & 0xff;
-	} else {
+	    (c->extended_cpuid_level < 0x80000008)) {
 		if (IS_ENABLED(CONFIG_X86_64)) {
 			c->x86_clflush_size = 64;
 			c->x86_phys_bits = 36;
@@ -1121,7 +1112,17 @@
 			    cpu_has(c, X86_FEATURE_PSE36))
 				c->x86_phys_bits = 36;
 		}
+	} else {
+		cpuid(0x80000008, &eax, &ebx, &ecx, &edx);
+
+		c->x86_virt_bits = (eax >> 8) & 0xff;
+		c->x86_phys_bits = eax & 0xff;
+
+		/* Provide a sane default if not enumerated: */
+		if (!c->x86_clflush_size)
+			c->x86_clflush_size = 32;
 	}
+
 	c->x86_cache_bits = c->x86_phys_bits;
 	c->x86_cache_alignment = c->x86_clflush_size;
 }
@@ -1163,6 +1164,7 @@
 #define NO_SPECTRE_V2		BIT(8)
 #define NO_MMIO			BIT(9)
 #define NO_EIBRS_PBRSB		BIT(10)
+#define NO_BHI			BIT(11)
 
 #define VULNWL(vendor, family, model, whitelist)	\
 	X86_MATCH_VENDOR_FAM_MODEL(vendor, family, model, whitelist)
@@ -1205,8 +1207,8 @@
 
 	VULNWL_INTEL(CORE_YONAH,		NO_SSB),
 
-	VULNWL_INTEL(ATOM_AIRMONT_MID,		NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT),
-	VULNWL_INTEL(ATOM_AIRMONT_NP,		NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
+	VULNWL_INTEL(ATOM_AIRMONT_MID,		NO_SSB | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | MSBDS_ONLY),
+	VULNWL_INTEL(ATOM_AIRMONT_NP,		NO_SSB | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
 
 	VULNWL_INTEL(ATOM_GOLDMONT,		NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
 	VULNWL_INTEL(ATOM_GOLDMONT_D,		NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
@@ -1225,18 +1227,18 @@
 	VULNWL_INTEL(ATOM_TREMONT_D,		NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB),
 
 	/* AMD Family 0xf - 0x12 */
-	VULNWL_AMD(0x0f,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
-	VULNWL_AMD(0x10,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
-	VULNWL_AMD(0x11,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
-	VULNWL_AMD(0x12,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
+	VULNWL_AMD(0x0f,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_BHI),
+	VULNWL_AMD(0x10,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_BHI),
+	VULNWL_AMD(0x11,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_BHI),
+	VULNWL_AMD(0x12,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_BHI),
 
 	/* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
-	VULNWL_AMD(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_EIBRS_PBRSB),
-	VULNWL_HYGON(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_EIBRS_PBRSB),
+	VULNWL_AMD(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_EIBRS_PBRSB | NO_BHI),
+	VULNWL_HYGON(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_EIBRS_PBRSB | NO_BHI),
 
 	/* Zhaoxin Family 7 */
-	VULNWL(CENTAUR,	7, X86_MODEL_ANY,	NO_SPECTRE_V2 | NO_SWAPGS | NO_MMIO),
-	VULNWL(ZHAOXIN,	7, X86_MODEL_ANY,	NO_SPECTRE_V2 | NO_SWAPGS | NO_MMIO),
+	VULNWL(CENTAUR,	7, X86_MODEL_ANY,	NO_SPECTRE_V2 | NO_SWAPGS | NO_MMIO | NO_BHI),
+	VULNWL(ZHAOXIN,	7, X86_MODEL_ANY,	NO_SPECTRE_V2 | NO_SWAPGS | NO_MMIO | NO_BHI),
 	{}
 };
 
@@ -1267,6 +1269,8 @@
 #define SRSO		BIT(5)
 /* CPU is affected by GDS */
 #define GDS		BIT(6)
+/* CPU is affected by Register File Data Sampling */
+#define RFDS		BIT(7)
 
 static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
 	VULNBL_INTEL_STEPPINGS(IVYBRIDGE,	X86_STEPPING_ANY,		SRBDS),
@@ -1294,9 +1298,18 @@
 	VULNBL_INTEL_STEPPINGS(TIGERLAKE,	X86_STEPPING_ANY,		GDS),
 	VULNBL_INTEL_STEPPINGS(LAKEFIELD,	X86_STEPPING_ANY,		MMIO | MMIO_SBDS | RETBLEED),
 	VULNBL_INTEL_STEPPINGS(ROCKETLAKE,	X86_STEPPING_ANY,		MMIO | RETBLEED | GDS),
-	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT,	X86_STEPPING_ANY,		MMIO | MMIO_SBDS),
-	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D,	X86_STEPPING_ANY,		MMIO),
-	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L,	X86_STEPPING_ANY,		MMIO | MMIO_SBDS),
+	VULNBL_INTEL_STEPPINGS(ALDERLAKE,	X86_STEPPING_ANY,		RFDS),
+	VULNBL_INTEL_STEPPINGS(ALDERLAKE_L,	X86_STEPPING_ANY,		RFDS),
+	VULNBL_INTEL_STEPPINGS(RAPTORLAKE,	X86_STEPPING_ANY,		RFDS),
+	VULNBL_INTEL_STEPPINGS(RAPTORLAKE_P,	X86_STEPPING_ANY,		RFDS),
+	VULNBL_INTEL_STEPPINGS(RAPTORLAKE_S,	X86_STEPPING_ANY,		RFDS),
+	VULNBL_INTEL_STEPPINGS(ATOM_GRACEMONT,	X86_STEPPING_ANY,		RFDS),
+	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT,	X86_STEPPING_ANY,		MMIO | MMIO_SBDS | RFDS),
+	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D,	X86_STEPPING_ANY,		MMIO | RFDS),
+	VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L,	X86_STEPPING_ANY,		MMIO | MMIO_SBDS | RFDS),
+	VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT,	X86_STEPPING_ANY,		RFDS),
+	VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT_D,	X86_STEPPING_ANY,		RFDS),
+	VULNBL_INTEL_STEPPINGS(ATOM_GOLDMONT_PLUS, X86_STEPPING_ANY,		RFDS),
 
 	VULNBL_AMD(0x15, RETBLEED),
 	VULNBL_AMD(0x16, RETBLEED),
@@ -1315,28 +1328,46 @@
 
 u64 x86_read_arch_cap_msr(void)
 {
-	u64 ia32_cap = 0;
+	u64 x86_arch_cap_msr = 0;
 
 	if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES))
-		rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
+		rdmsrl(MSR_IA32_ARCH_CAPABILITIES, x86_arch_cap_msr);
 
-	return ia32_cap;
+	return x86_arch_cap_msr;
 }
 
-static bool arch_cap_mmio_immune(u64 ia32_cap)
+static bool arch_cap_mmio_immune(u64 x86_arch_cap_msr)
 {
-	return (ia32_cap & ARCH_CAP_FBSDP_NO &&
-		ia32_cap & ARCH_CAP_PSDP_NO &&
-		ia32_cap & ARCH_CAP_SBDR_SSDP_NO);
+	return (x86_arch_cap_msr & ARCH_CAP_FBSDP_NO &&
+		x86_arch_cap_msr & ARCH_CAP_PSDP_NO &&
+		x86_arch_cap_msr & ARCH_CAP_SBDR_SSDP_NO);
+}
+
+static bool __init vulnerable_to_rfds(u64 x86_arch_cap_msr)
+{
+	/* The "immunity" bit trumps everything else: */
+	if (x86_arch_cap_msr & ARCH_CAP_RFDS_NO)
+		return false;
+
+	/*
+	 * VMMs set ARCH_CAP_RFDS_CLEAR for processors not in the blacklist to
+	 * indicate that mitigation is needed because guest is running on a
+	 * vulnerable hardware or may migrate to such hardware:
+	 */
+	if (x86_arch_cap_msr & ARCH_CAP_RFDS_CLEAR)
+		return true;
+
+	/* Only consult the blacklist when there is no enumeration: */
+	return cpu_matches(cpu_vuln_blacklist, RFDS);
 }
 
 static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 {
-	u64 ia32_cap = x86_read_arch_cap_msr();
+	u64 x86_arch_cap_msr = x86_read_arch_cap_msr();
 
 	/* Set ITLB_MULTIHIT bug if cpu is not in the whitelist and not mitigated */
 	if (!cpu_matches(cpu_vuln_whitelist, NO_ITLB_MULTIHIT) &&
-	    !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO))
+	    !(x86_arch_cap_msr & ARCH_CAP_PSCHANGE_MC_NO))
 		setup_force_cpu_bug(X86_BUG_ITLB_MULTIHIT);
 
 	if (cpu_matches(cpu_vuln_whitelist, NO_SPECULATION))
@@ -1348,7 +1379,7 @@
 		setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
 
 	if (!cpu_matches(cpu_vuln_whitelist, NO_SSB) &&
-	    !(ia32_cap & ARCH_CAP_SSB_NO) &&
+	    !(x86_arch_cap_msr & ARCH_CAP_SSB_NO) &&
 	   !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
 		setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
 
@@ -1356,15 +1387,15 @@
 	 * AMD's AutoIBRS is equivalent to Intel's eIBRS - use the Intel feature
 	 * flag and protect from vendor-specific bugs via the whitelist.
 	 */
-	if ((ia32_cap & ARCH_CAP_IBRS_ALL) || cpu_has(c, X86_FEATURE_AUTOIBRS)) {
+	if ((x86_arch_cap_msr & ARCH_CAP_IBRS_ALL) || cpu_has(c, X86_FEATURE_AUTOIBRS)) {
 		setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
 		if (!cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&
-		    !(ia32_cap & ARCH_CAP_PBRSB_NO))
+		    !(x86_arch_cap_msr & ARCH_CAP_PBRSB_NO))
 			setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB);
 	}
 
 	if (!cpu_matches(cpu_vuln_whitelist, NO_MDS) &&
-	    !(ia32_cap & ARCH_CAP_MDS_NO)) {
+	    !(x86_arch_cap_msr & ARCH_CAP_MDS_NO)) {
 		setup_force_cpu_bug(X86_BUG_MDS);
 		if (cpu_matches(cpu_vuln_whitelist, MSBDS_ONLY))
 			setup_force_cpu_bug(X86_BUG_MSBDS_ONLY);
@@ -1383,9 +1414,9 @@
 	 * TSX_CTRL check alone is not sufficient for cases when the microcode
 	 * update is not present or running as guest that don't get TSX_CTRL.
 	 */
-	if (!(ia32_cap & ARCH_CAP_TAA_NO) &&
+	if (!(x86_arch_cap_msr & ARCH_CAP_TAA_NO) &&
 	    (cpu_has(c, X86_FEATURE_RTM) ||
-	     (ia32_cap & ARCH_CAP_TSX_CTRL_MSR)))
+	     (x86_arch_cap_msr & ARCH_CAP_TSX_CTRL_MSR)))
 		setup_force_cpu_bug(X86_BUG_TAA);
 
 	/*
@@ -1411,7 +1442,7 @@
 	 * Set X86_BUG_MMIO_UNKNOWN for CPUs that are neither in the blacklist,
 	 * nor in the whitelist and also don't enumerate MSR ARCH_CAP MMIO bits.
 	 */
-	if (!arch_cap_mmio_immune(ia32_cap)) {
+	if (!arch_cap_mmio_immune(x86_arch_cap_msr)) {
 		if (cpu_matches(cpu_vuln_blacklist, MMIO))
 			setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
 		else if (!cpu_matches(cpu_vuln_whitelist, NO_MMIO))
@@ -1419,7 +1450,7 @@
 	}
 
 	if (!cpu_has(c, X86_FEATURE_BTC_NO)) {
-		if (cpu_matches(cpu_vuln_blacklist, RETBLEED) || (ia32_cap & ARCH_CAP_RSBA))
+		if (cpu_matches(cpu_vuln_blacklist, RETBLEED) || (x86_arch_cap_msr & ARCH_CAP_RSBA))
 			setup_force_cpu_bug(X86_BUG_RETBLEED);
 	}
 
@@ -1437,15 +1468,28 @@
 	 * disabling AVX2. The only way to do this in HW is to clear XCR0[2],
 	 * which means that AVX will be disabled.
 	 */
-	if (cpu_matches(cpu_vuln_blacklist, GDS) && !(ia32_cap & ARCH_CAP_GDS_NO) &&
+	if (cpu_matches(cpu_vuln_blacklist, GDS) && !(x86_arch_cap_msr & ARCH_CAP_GDS_NO) &&
 	    boot_cpu_has(X86_FEATURE_AVX))
 		setup_force_cpu_bug(X86_BUG_GDS);
 
+	if (vulnerable_to_rfds(x86_arch_cap_msr))
+		setup_force_cpu_bug(X86_BUG_RFDS);
+
+	/* When virtualized, eIBRS could be hidden, assume vulnerable */
+	if (!(x86_arch_cap_msr & ARCH_CAP_BHI_NO) &&
+	    !cpu_matches(cpu_vuln_whitelist, NO_BHI) &&
+	    (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED) ||
+	     boot_cpu_has(X86_FEATURE_HYPERVISOR)))
+		setup_force_cpu_bug(X86_BUG_BHI);
+
+	if (cpu_has(c, X86_FEATURE_AMD_IBPB) && !cpu_has(c, X86_FEATURE_AMD_IBPB_RET))
+		setup_force_cpu_bug(X86_BUG_IBPB_NO_RET);
+
 	if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
 		return;
 
 	/* Rogue Data Cache Load? No! */
-	if (ia32_cap & ARCH_CAP_RDCL_NO)
+	if (x86_arch_cap_msr & ARCH_CAP_RDCL_NO)
 		return;
 
 	setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
@@ -1587,6 +1631,7 @@
 	if (have_cpuid_p()) {
 		cpu_detect(c);
 		get_cpu_vendor(c);
+		intel_unlock_cpuid_leafs(c);
 		get_cpu_cap(c);
 		setup_force_cpu_cap(X86_FEATURE_CPUID);
 		get_cpu_address_sizes(c);
@@ -1637,15 +1682,11 @@
 	detect_nopl();
 }
 
-void __init early_cpu_init(void)
+void __init init_cpu_devs(void)
 {
 	const struct cpu_dev *const *cdev;
 	int count = 0;
 
-#ifdef CONFIG_PROCESSOR_SELECT
-	pr_info("KERNEL supported cpus:\n");
-#endif
-
 	for (cdev = __x86_cpu_dev_start; cdev < __x86_cpu_dev_end; cdev++) {
 		const struct cpu_dev *cpudev = *cdev;
 
@@ -1653,20 +1694,30 @@
 			break;
 		cpu_devs[count] = cpudev;
 		count++;
+	}
+}
 
+void __init early_cpu_init(void)
+{
 #ifdef CONFIG_PROCESSOR_SELECT
-		{
-			unsigned int j;
+	unsigned int i, j;
 
-			for (j = 0; j < 2; j++) {
-				if (!cpudev->c_ident[j])
-					continue;
-				pr_info("  %s %s\n", cpudev->c_vendor,
-					cpudev->c_ident[j]);
-			}
-		}
+	pr_info("KERNEL supported cpus:\n");
 #endif
+
+	init_cpu_devs();
+
+#ifdef CONFIG_PROCESSOR_SELECT
+	for (i = 0; i < X86_VENDOR_NUM && cpu_devs[i]; i++) {
+		for (j = 0; j < 2; j++) {
+			if (!cpu_devs[i]->c_ident[j])
+				continue;
+			pr_info("  %s %s\n", cpu_devs[i]->c_vendor,
+				cpu_devs[i]->c_ident[j]);
+		}
 	}
+#endif
+
 	early_identify_cpu(&boot_cpu_data);
 }
 
@@ -1743,7 +1794,7 @@
 	cpu_detect(c);
 
 	get_cpu_vendor(c);
-
+	intel_unlock_cpuid_leafs(c);
 	get_cpu_cap(c);
 
 	get_cpu_address_sizes(c);
@@ -2108,8 +2159,10 @@
 
 #ifdef CONFIG_STACKPROTECTOR
 DEFINE_PER_CPU(unsigned long, __stack_chk_guard);
+#ifndef CONFIG_SMP
 EXPORT_PER_CPU_SYMBOL(__stack_chk_guard);
 #endif
+#endif
 
 #endif	/* CONFIG_X86_64 */
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/cpu.h
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/cpu.h
@@ -56,9 +56,11 @@
 
 extern void __init tsx_init(void);
 void tsx_ap_init(void);
+void intel_unlock_cpuid_leafs(struct cpuinfo_x86 *c);
 #else
 static inline void tsx_init(void) { }
 static inline void tsx_ap_init(void) { }
+static inline void intel_unlock_cpuid_leafs(struct cpuinfo_x86 *c) { }
 #endif /* CONFIG_CPU_SUP_INTEL */
 
 extern void init_spectral_chicken(struct cpuinfo_x86 *c);
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/cpuid-deps.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/cpuid-deps.c
@@ -44,7 +44,10 @@
 	{ X86_FEATURE_F16C,			X86_FEATURE_XMM2,     },
 	{ X86_FEATURE_AES,			X86_FEATURE_XMM2      },
 	{ X86_FEATURE_SHA_NI,			X86_FEATURE_XMM2      },
+	{ X86_FEATURE_GFNI,			X86_FEATURE_XMM2      },
 	{ X86_FEATURE_FMA,			X86_FEATURE_AVX       },
+	{ X86_FEATURE_VAES,			X86_FEATURE_AVX       },
+	{ X86_FEATURE_VPCLMULQDQ,		X86_FEATURE_AVX       },
 	{ X86_FEATURE_AVX2,			X86_FEATURE_AVX,      },
 	{ X86_FEATURE_AVX512F,			X86_FEATURE_AVX,      },
 	{ X86_FEATURE_AVX512IFMA,		X86_FEATURE_AVX512F   },
@@ -56,9 +59,6 @@
 	{ X86_FEATURE_AVX512VL,			X86_FEATURE_AVX512F   },
 	{ X86_FEATURE_AVX512VBMI,		X86_FEATURE_AVX512F   },
 	{ X86_FEATURE_AVX512_VBMI2,		X86_FEATURE_AVX512VL  },
-	{ X86_FEATURE_GFNI,			X86_FEATURE_AVX512VL  },
-	{ X86_FEATURE_VAES,			X86_FEATURE_AVX512VL  },
-	{ X86_FEATURE_VPCLMULQDQ,		X86_FEATURE_AVX512VL  },
 	{ X86_FEATURE_AVX512_VNNI,		X86_FEATURE_AVX512VL  },
 	{ X86_FEATURE_AVX512_BITALG,		X86_FEATURE_AVX512VL  },
 	{ X86_FEATURE_AVX512_4VNNIW,		X86_FEATURE_AVX512F   },
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/intel.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/intel.c
@@ -72,19 +72,19 @@
  */
 static void check_memory_type_self_snoop_errata(struct cpuinfo_x86 *c)
 {
-	switch (c->x86_model) {
-	case INTEL_FAM6_CORE_YONAH:
-	case INTEL_FAM6_CORE2_MEROM:
-	case INTEL_FAM6_CORE2_MEROM_L:
-	case INTEL_FAM6_CORE2_PENRYN:
-	case INTEL_FAM6_CORE2_DUNNINGTON:
-	case INTEL_FAM6_NEHALEM:
-	case INTEL_FAM6_NEHALEM_G:
-	case INTEL_FAM6_NEHALEM_EP:
-	case INTEL_FAM6_NEHALEM_EX:
-	case INTEL_FAM6_WESTMERE:
-	case INTEL_FAM6_WESTMERE_EP:
-	case INTEL_FAM6_SANDYBRIDGE:
+	switch (c->x86_vfm) {
+	case INTEL_CORE_YONAH:
+	case INTEL_CORE2_MEROM:
+	case INTEL_CORE2_MEROM_L:
+	case INTEL_CORE2_PENRYN:
+	case INTEL_CORE2_DUNNINGTON:
+	case INTEL_NEHALEM:
+	case INTEL_NEHALEM_G:
+	case INTEL_NEHALEM_EP:
+	case INTEL_NEHALEM_EX:
+	case INTEL_WESTMERE:
+	case INTEL_WESTMERE_EP:
+	case INTEL_SANDYBRIDGE:
 		setup_clear_cpu_cap(X86_FEATURE_SELFSNOOP);
 	}
 }
@@ -106,9 +106,9 @@
 	 */
 	if (c->x86 != 6)
 		return;
-	switch (c->x86_model) {
-	case INTEL_FAM6_XEON_PHI_KNL:
-	case INTEL_FAM6_XEON_PHI_KNM:
+	switch (c->x86_vfm) {
+	case INTEL_XEON_PHI_KNL:
+	case INTEL_XEON_PHI_KNM:
 		break;
 	default:
 		return;
@@ -134,32 +134,32 @@
  * - Release note from 20180108 microcode release
  */
 struct sku_microcode {
-	u8 model;
+	u32 vfm;
 	u8 stepping;
 	u32 microcode;
 };
 static const struct sku_microcode spectre_bad_microcodes[] = {
-	{ INTEL_FAM6_KABYLAKE,		0x0B,	0x80 },
-	{ INTEL_FAM6_KABYLAKE,		0x0A,	0x80 },
-	{ INTEL_FAM6_KABYLAKE,		0x09,	0x80 },
-	{ INTEL_FAM6_KABYLAKE_L,	0x0A,	0x80 },
-	{ INTEL_FAM6_KABYLAKE_L,	0x09,	0x80 },
-	{ INTEL_FAM6_SKYLAKE_X,		0x03,	0x0100013e },
-	{ INTEL_FAM6_SKYLAKE_X,		0x04,	0x0200003c },
-	{ INTEL_FAM6_BROADWELL,		0x04,	0x28 },
-	{ INTEL_FAM6_BROADWELL_G,	0x01,	0x1b },
-	{ INTEL_FAM6_BROADWELL_D,	0x02,	0x14 },
-	{ INTEL_FAM6_BROADWELL_D,	0x03,	0x07000011 },
-	{ INTEL_FAM6_BROADWELL_X,	0x01,	0x0b000025 },
-	{ INTEL_FAM6_HASWELL_L,		0x01,	0x21 },
-	{ INTEL_FAM6_HASWELL_G,		0x01,	0x18 },
-	{ INTEL_FAM6_HASWELL,		0x03,	0x23 },
-	{ INTEL_FAM6_HASWELL_X,		0x02,	0x3b },
-	{ INTEL_FAM6_HASWELL_X,		0x04,	0x10 },
-	{ INTEL_FAM6_IVYBRIDGE_X,	0x04,	0x42a },
+	{ INTEL_KABYLAKE,	0x0B,	0x80 },
+	{ INTEL_KABYLAKE,	0x0A,	0x80 },
+	{ INTEL_KABYLAKE,	0x09,	0x80 },
+	{ INTEL_KABYLAKE_L,	0x0A,	0x80 },
+	{ INTEL_KABYLAKE_L,	0x09,	0x80 },
+	{ INTEL_SKYLAKE_X,	0x03,	0x0100013e },
+	{ INTEL_SKYLAKE_X,	0x04,	0x0200003c },
+	{ INTEL_BROADWELL,	0x04,	0x28 },
+	{ INTEL_BROADWELL_G,	0x01,	0x1b },
+	{ INTEL_BROADWELL_D,	0x02,	0x14 },
+	{ INTEL_BROADWELL_D,	0x03,	0x07000011 },
+	{ INTEL_BROADWELL_X,	0x01,	0x0b000025 },
+	{ INTEL_HASWELL_L,	0x01,	0x21 },
+	{ INTEL_HASWELL_G,	0x01,	0x18 },
+	{ INTEL_HASWELL,	0x03,	0x23 },
+	{ INTEL_HASWELL_X,	0x02,	0x3b },
+	{ INTEL_HASWELL_X,	0x04,	0x10 },
+	{ INTEL_IVYBRIDGE_X,	0x04,	0x42a },
 	/* Observed in the wild */
-	{ INTEL_FAM6_SANDYBRIDGE_X,	0x06,	0x61b },
-	{ INTEL_FAM6_SANDYBRIDGE_X,	0x07,	0x712 },
+	{ INTEL_SANDYBRIDGE_X,	0x06,	0x61b },
+	{ INTEL_SANDYBRIDGE_X,	0x07,	0x712 },
 };
 
 static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
@@ -173,11 +173,8 @@
 	if (cpu_has(c, X86_FEATURE_HYPERVISOR))
 		return false;
 
-	if (c->x86 != 6)
-		return false;
-
 	for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
-		if (c->x86_model == spectre_bad_microcodes[i].model &&
+		if (c->x86_vfm == spectre_bad_microcodes[i].vfm &&
 		    c->x86_stepping == spectre_bad_microcodes[i].stepping)
 			return (c->microcode <= spectre_bad_microcodes[i].microcode);
 	}
@@ -268,19 +265,26 @@
 	c->x86_phys_bits -= keyid_bits;
 }
 
+void intel_unlock_cpuid_leafs(struct cpuinfo_x86 *c)
+{
+	if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
+		return;
+
+	if (c->x86 < 6 || (c->x86 == 6 && c->x86_model < 0xd))
+		return;
+
+	/*
+	 * The BIOS can have limited CPUID to leaf 2, which breaks feature
+	 * enumeration. Unlock it and update the maximum leaf info.
+	 */
+	if (msr_clear_bit(MSR_IA32_MISC_ENABLE, MSR_IA32_MISC_ENABLE_LIMIT_CPUID_BIT) > 0)
+		c->cpuid_level = cpuid_eax(0);
+}
+
 static void early_init_intel(struct cpuinfo_x86 *c)
 {
 	u64 misc_enable;
 
-	/* Unmask CPUID levels if masked: */
-	if (c->x86 > 6 || (c->x86 == 6 && c->x86_model >= 0xd)) {
-		if (msr_clear_bit(MSR_IA32_MISC_ENABLE,
-				  MSR_IA32_MISC_ENABLE_LIMIT_CPUID_BIT) > 0) {
-			c->cpuid_level = cpuid_eax(0);
-			get_cpu_cap(c);
-		}
-	}
-
 	if ((c->x86 == 0xf && c->x86_model >= 0x03) ||
 		(c->x86 == 0x6 && c->x86_model >= 0x0e))
 		set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
@@ -312,7 +316,7 @@
 	 * need the microcode to have already been loaded... so if it is
 	 * not, recommend a BIOS update and disable large pages.
 	 */
-	if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_stepping <= 2 &&
+	if (c->x86_vfm == INTEL_ATOM_BONNELL && c->x86_stepping <= 2 &&
 	    c->microcode < 0x20e) {
 		pr_warn("Atom PSE erratum detected, BIOS microcode update recommended\n");
 		clear_cpu_cap(c, X86_FEATURE_PSE);
@@ -344,17 +348,13 @@
 	}
 
 	/* Penwell and Cloverview have the TSC which doesn't sleep on S3 */
-	if (c->x86 == 6) {
-		switch (c->x86_model) {
-		case INTEL_FAM6_ATOM_SALTWELL_MID:
-		case INTEL_FAM6_ATOM_SALTWELL_TABLET:
-		case INTEL_FAM6_ATOM_SILVERMONT_MID:
-		case INTEL_FAM6_ATOM_AIRMONT_NP:
-			set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC_S3);
-			break;
-		default:
-			break;
-		}
+	switch (c->x86_vfm) {
+	case INTEL_ATOM_SALTWELL_MID:
+	case INTEL_ATOM_SALTWELL_TABLET:
+	case INTEL_ATOM_SILVERMONT_MID:
+	case INTEL_ATOM_AIRMONT_NP:
+		set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC_S3);
+		break;
 	}
 
 	/*
@@ -393,7 +393,7 @@
 	 * should be false so that __flush_tlb_all() causes CR3 instead of CR4.PGE
 	 * to be modified.
 	 */
-	if (c->x86 == 5 && c->x86_model == 9) {
+	if (c->x86_vfm == INTEL_QUARK_X1000) {
 		pr_info("Disabling PGE capability bit\n");
 		setup_clear_cpu_cap(X86_FEATURE_PGE);
 	}
@@ -650,12 +650,15 @@
 			set_cpu_cap(c, X86_FEATURE_PEBS);
 	}
 
-	if (c->x86 == 6 && boot_cpu_has(X86_FEATURE_CLFLUSH) &&
-	    (c->x86_model == 29 || c->x86_model == 46 || c->x86_model == 47))
+	if (boot_cpu_has(X86_FEATURE_CLFLUSH) &&
+	    (c->x86_vfm == INTEL_CORE2_DUNNINGTON ||
+	     c->x86_vfm == INTEL_NEHALEM_EX ||
+	     c->x86_vfm == INTEL_WESTMERE_EX))
 		set_cpu_bug(c, X86_BUG_CLFLUSH_MONITOR);
 
-	if (c->x86 == 6 && boot_cpu_has(X86_FEATURE_MWAIT) &&
-		((c->x86_model == INTEL_FAM6_ATOM_GOLDMONT)))
+	if (boot_cpu_has(X86_FEATURE_MWAIT) &&
+	    (c->x86_vfm == INTEL_ATOM_GOLDMONT ||
+	     c->x86_vfm == INTEL_LUNARLAKE_M))
 		set_cpu_bug(c, X86_BUG_MONITOR);
 
 #ifdef CONFIG_X86_64
@@ -1271,9 +1274,9 @@
  * feature even though they do not enumerate IA32_CORE_CAPABILITIES.
  */
 static const struct x86_cpu_id split_lock_cpu_ids[] __initconst = {
-	X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_X,	0),
-	X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_L,	0),
-	X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_D,	0),
+	X86_MATCH_VFM(INTEL_ICELAKE_X,	0),
+	X86_MATCH_VFM(INTEL_ICELAKE_L,	0),
+	X86_MATCH_VFM(INTEL_ICELAKE_D,	0),
 	{}
 };
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/match.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/match.c
@@ -17,8 +17,7 @@
  *
  * A typical table entry would be to match a specific CPU
  *
- * X86_MATCH_VENDOR_FAM_MODEL_FEATURE(INTEL, 6, INTEL_FAM6_BROADWELL,
- *				      X86_FEATURE_ANY, NULL);
+ * X86_MATCH_VFM_FEATURE(INTEL_BROADWELL, X86_FEATURE_ANY, NULL);
  *
  * Fields can be wildcarded with %X86_VENDOR_ANY, %X86_FAMILY_ANY,
  * %X86_MODEL_ANY, %X86_FEATURE_ANY (except for vendor)
@@ -39,9 +38,7 @@
 	const struct x86_cpu_id *m;
 	struct cpuinfo_x86 *c = &boot_cpu_data;
 
-	for (m = match;
-	     m->vendor | m->family | m->model | m->steppings | m->feature;
-	     m++) {
+	for (m = match; m->flags & X86_CPU_ID_FLAG_ENTRY_VALID; m++) {
 		if (m->vendor != X86_VENDOR_ANY && c->x86_vendor != m->vendor)
 			continue;
 		if (m->family != X86_FAMILY_ANY && c->x86 != m->family)
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/mce/core.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/mce/core.c
@@ -2474,12 +2474,14 @@
 		return -EINVAL;
 
 	b = &per_cpu(mce_banks_array, s->id)[bank];
-
 	if (!b->init)
 		return -ENODEV;
 
 	b->ctl = new;
+
+	mutex_lock(&mce_sysfs_mutex);
 	mce_restart();
+	mutex_unlock(&mce_sysfs_mutex);
 
 	return size;
 }
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/microcode/amd.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/microcode/amd.c
@@ -465,7 +465,7 @@
 	return !__apply_microcode_amd(mc);
 }
 
-static bool get_builtin_microcode(struct cpio_data *cp, unsigned int family)
+static bool get_builtin_microcode(struct cpio_data *cp, u8 family)
 {
 	char fw_name[36] = "amd-ucode/microcode_amd.bin";
 	struct firmware fw;
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/mshyperv.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/mshyperv.c
@@ -199,8 +199,8 @@
 	 * Call hv_cpu_die() on all the CPUs, otherwise later the hypervisor
 	 * corrupts the old VP Assist Pages and can crash the kexec kernel.
 	 */
-	if (kexec_in_progress && hyperv_init_cpuhp > 0)
-		cpuhp_remove_state(hyperv_init_cpuhp);
+	if (kexec_in_progress)
+		cpuhp_remove_state(CPUHP_AP_HYPERV_ONLINE);
 
 	/* The function calls stop_other_cpus(). */
 	native_machine_shutdown();
@@ -222,6 +222,63 @@
 	hyperv_cleanup();
 }
 #endif /* CONFIG_KEXEC_CORE */
+
+static u64 hv_ref_counter_at_suspend;
+static void (*old_save_sched_clock_state)(void);
+static void (*old_restore_sched_clock_state)(void);
+
+/*
+ * Hyper-V clock counter resets during hibernation. Save and restore clock
+ * offset during suspend/resume, while also considering the time passed
+ * before suspend. This is to make sure that sched_clock using hv tsc page
+ * based clocksource, proceeds from where it left off during suspend and
+ * it shows correct time for the timestamps of kernel messages after resume.
+ */
+static void save_hv_clock_tsc_state(void)
+{
+	hv_ref_counter_at_suspend = hv_read_reference_counter();
+}
+
+static void restore_hv_clock_tsc_state(void)
+{
+	/*
+	 * Adjust the offsets used by hv tsc clocksource to
+	 * account for the time spent before hibernation.
+	 * adjusted value = reference counter (time) at suspend
+	 *                - reference counter (time) now.
+	 */
+	hv_adj_sched_clock_offset(hv_ref_counter_at_suspend - hv_read_reference_counter());
+}
+
+/*
+ * Functions to override save_sched_clock_state and restore_sched_clock_state
+ * functions of x86_platform. The Hyper-V clock counter is reset during
+ * suspend-resume and the offset used to measure time needs to be
+ * corrected, post resume.
+ */
+static void hv_save_sched_clock_state(void)
+{
+	old_save_sched_clock_state();
+	save_hv_clock_tsc_state();
+}
+
+static void hv_restore_sched_clock_state(void)
+{
+	restore_hv_clock_tsc_state();
+	old_restore_sched_clock_state();
+}
+
+static void __init x86_setup_ops_for_tsc_pg_clock(void)
+{
+	if (!(ms_hyperv.features & HV_MSR_REFERENCE_TSC_AVAILABLE))
+		return;
+
+	old_save_sched_clock_state = x86_platform.save_sched_clock_state;
+	x86_platform.save_sched_clock_state = hv_save_sched_clock_state;
+
+	old_restore_sched_clock_state = x86_platform.restore_sched_clock_state;
+	x86_platform.restore_sched_clock_state = hv_restore_sched_clock_state;
+}
 #endif /* CONFIG_HYPERV */
 
 static uint32_t  __init ms_hyperv_platform(void)
@@ -426,6 +483,7 @@
 	    ms_hyperv.misc_features & HV_FEATURE_FREQUENCY_MSRS_AVAILABLE) {
 		x86_platform.calibrate_tsc = hv_get_tsc_khz;
 		x86_platform.calibrate_cpu = hv_get_tsc_khz;
+		setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
 	}
 
 	if (ms_hyperv.priv_high & HV_ISOLATION) {
@@ -451,9 +509,23 @@
 			ms_hyperv.hints &= ~HV_X64_APIC_ACCESS_RECOMMENDED;
 
 			if (!ms_hyperv.paravisor_present) {
-				/* To be supported: more work is required.  */
+				/*
+				 * Mark the Hyper-V TSC page feature as disabled
+				 * in a TDX VM without paravisor so that the
+				 * Invariant TSC, which is a better clocksource
+				 * anyway, is used instead.
+				 */
 				ms_hyperv.features &= ~HV_MSR_REFERENCE_TSC_AVAILABLE;
 
+				/*
+				 * The Invariant TSC is expected to be available
+				 * in a TDX VM without paravisor, but if not,
+				 * print a warning message. The slower Hyper-V MSR-based
+				 * Ref Counter should end up being the clocksource.
+				 */
+				if (!(ms_hyperv.features & HV_ACCESS_TSC_INVARIANT))
+					pr_warn("Hyper-V: Invariant TSC is unavailable\n");
+
 				/* HV_REGISTER_CRASH_CTL is unsupported. */
 				ms_hyperv.misc_features &= ~HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE;
 
@@ -574,6 +646,7 @@
 
 	/* Register Hyper-V specific clocksource */
 	hv_init_clocksource();
+	x86_setup_ops_for_tsc_pg_clock();
 	hv_vtl_init_platform();
 #endif
 	/*
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/mtrr/mtrr.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/mtrr/mtrr.c
@@ -609,7 +609,7 @@
 {
 	int first_cpu;
 
-	if (!mtrr_enabled())
+	if (!mtrr_enabled() || !mtrr_state.have_fixed)
 		return;
 
 	first_cpu = cpumask_first(cpu_online_mask);
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/resctrl/core.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/resctrl/core.c
@@ -194,7 +194,7 @@
 	return false;
 }
 
-static bool __get_mem_config_intel(struct rdt_resource *r)
+static __init bool __get_mem_config_intel(struct rdt_resource *r)
 {
 	struct rdt_hw_resource *hw_res = resctrl_to_arch_res(r);
 	union cpuid_0x10_3_eax eax;
@@ -228,12 +228,10 @@
 	return true;
 }
 
-static bool __rdt_get_mem_config_amd(struct rdt_resource *r)
+static __init bool __rdt_get_mem_config_amd(struct rdt_resource *r)
 {
 	struct rdt_hw_resource *hw_res = resctrl_to_arch_res(r);
-	union cpuid_0x10_3_eax eax;
-	union cpuid_0x10_x_edx edx;
-	u32 ebx, ecx, subleaf;
+	u32 eax, ebx, ecx, edx, subleaf;
 
 	/*
 	 * Query CPUID_Fn80000020_EDX_x01 for MBA and
@@ -241,9 +239,9 @@
 	 */
 	subleaf = (r->rid == RDT_RESOURCE_SMBA) ? 2 :  1;
 
-	cpuid_count(0x80000020, subleaf, &eax.full, &ebx, &ecx, &edx.full);
-	hw_res->num_closid = edx.split.cos_max + 1;
-	r->default_ctrl = MAX_MBA_BW_AMD;
+	cpuid_count(0x80000020, subleaf, &eax, &ebx, &ecx, &edx);
+	hw_res->num_closid = edx + 1;
+	r->default_ctrl = 1 << eax;
 
 	/* AMD does not use delay */
 	r->membw.delay_linear = false;
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
@@ -27,10 +27,10 @@
  * hardware. The allocated bandwidth percentage is rounded to the next
  * control step available on the hardware.
  */
-static bool bw_validate(char *buf, unsigned long *data, struct rdt_resource *r)
+static bool bw_validate(char *buf, u32 *data, struct rdt_resource *r)
 {
-	unsigned long bw;
 	int ret;
+	u32 bw;
 
 	/*
 	 * Only linear delay values is supported for current Intel SKUs.
@@ -40,16 +40,21 @@
 		return false;
 	}
 
-	ret = kstrtoul(buf, 10, &bw);
+	ret = kstrtou32(buf, 10, &bw);
 	if (ret) {
-		rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf);
+		rdt_last_cmd_printf("Invalid MB value %s\n", buf);
 		return false;
 	}
 
-	if ((bw < r->membw.min_bw || bw > r->default_ctrl) &&
-	    !is_mba_sc(r)) {
-		rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", bw,
-				    r->membw.min_bw, r->default_ctrl);
+	/* Nothing else to do if software controller is enabled. */
+	if (is_mba_sc(r)) {
+		*data = bw;
+		return true;
+	}
+
+	if (bw < r->membw.min_bw || bw > r->default_ctrl) {
+		rdt_last_cmd_printf("MB value %u out of range [%d,%d]\n",
+				    bw, r->membw.min_bw, r->default_ctrl);
 		return false;
 	}
 
@@ -63,7 +68,7 @@
 	struct resctrl_staged_config *cfg;
 	u32 closid = data->rdtgrp->closid;
 	struct rdt_resource *r = s->res;
-	unsigned long bw_val;
+	u32 bw_val;
 
 	cfg = &d->staged_config[s->conf_type];
 	if (cfg->have_new_ctrl) {
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/resctrl/internal.h
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/resctrl/internal.h
@@ -18,7 +18,6 @@
 #define MBM_OVERFLOW_INTERVAL		1000
 #define MAX_MBA_BW			100u
 #define MBA_IS_LINEAR			0x4
-#define MAX_MBA_BW_AMD			0x800
 #define MBM_CNTR_WIDTH_OFFSET_AMD	20
 
 #define RMID_VAL_ERROR			BIT_ULL(63)
@@ -296,14 +295,10 @@
  * struct mbm_state - status for each MBM counter in each domain
  * @prev_bw_bytes: Previous bytes value read for bandwidth calculation
  * @prev_bw:	The most recent bandwidth in MBps
- * @delta_bw:	Difference between the current and previous bandwidth
- * @delta_comp:	Indicates whether to compute the delta_bw
  */
 struct mbm_state {
 	u64	prev_bw_bytes;
 	u32	prev_bw;
-	u32	delta_bw;
-	bool	delta_comp;
 };
 
 /**
@@ -395,6 +390,8 @@
  * @msr_update:		Function pointer to update QOS MSRs
  * @mon_scale:		cqm counter * mon_scale = occupancy in bytes
  * @mbm_width:		Monitor width, to detect and correct for overflow.
+ * @mbm_cfg_mask:	Bandwidth sources that can be tracked when Bandwidth
+ *			Monitoring Event Configuration (BMEC) is supported.
  * @cdp_enabled:	CDP state of this resource
  *
  * Members of this structure are either private to the architecture
@@ -409,6 +406,7 @@
 				 struct rdt_resource *r);
 	unsigned int		mon_scale;
 	unsigned int		mbm_width;
+	unsigned int		mbm_cfg_mask;
 	bool			cdp_enabled;
 };
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/resctrl/monitor.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/resctrl/monitor.c
@@ -440,9 +440,6 @@
 
 	cur_bw = bytes / SZ_1M;
 
-	if (m->delta_comp)
-		m->delta_bw = abs(cur_bw - m->prev_bw);
-	m->delta_comp = false;
 	m->prev_bw = cur_bw;
 }
 
@@ -520,11 +517,11 @@
 {
 	u32 closid, rmid, cur_msr_val, new_msr_val;
 	struct mbm_state *pmbm_data, *cmbm_data;
-	u32 cur_bw, delta_bw, user_bw;
 	struct rdt_resource *r_mba;
 	struct rdt_domain *dom_mba;
 	struct list_head *head;
 	struct rdtgroup *entry;
+	u32 cur_bw, user_bw;
 
 	if (!is_mbm_local_enabled())
 		return;
@@ -543,7 +540,6 @@
 
 	cur_bw = pmbm_data->prev_bw;
 	user_bw = dom_mba->mbps_val[closid];
-	delta_bw = pmbm_data->delta_bw;
 
 	/* MBA resource doesn't support CDP */
 	cur_msr_val = resctrl_arch_get_config(r_mba, dom_mba, closid, CDP_NONE);
@@ -555,49 +551,31 @@
 	list_for_each_entry(entry, head, mon.crdtgrp_list) {
 		cmbm_data = &dom_mbm->mbm_local[entry->mon.rmid];
 		cur_bw += cmbm_data->prev_bw;
-		delta_bw += cmbm_data->delta_bw;
 	}
 
 	/*
 	 * Scale up/down the bandwidth linearly for the ctrl group.  The
 	 * bandwidth step is the bandwidth granularity specified by the
 	 * hardware.
-	 *
-	 * The delta_bw is used when increasing the bandwidth so that we
-	 * dont alternately increase and decrease the control values
-	 * continuously.
-	 *
-	 * For ex: consider cur_bw = 90MBps, user_bw = 100MBps and if
-	 * bandwidth step is 20MBps(> user_bw - cur_bw), we would keep
-	 * switching between 90 and 110 continuously if we only check
-	 * cur_bw < user_bw.
+	 * Always increase throttling if current bandwidth is above the
+	 * target set by user.
+	 * But avoid thrashing up and down on every poll by checking
+	 * whether a decrease in throttling is likely to push the group
+	 * back over target. E.g. if currently throttling to 30% of bandwidth
+	 * on a system with 10% granularity steps, check whether moving to
+	 * 40% would go past the limit by multiplying current bandwidth by
+	 * "(30 + 10) / 30".
 	 */
 	if (cur_msr_val > r_mba->membw.min_bw && user_bw < cur_bw) {
 		new_msr_val = cur_msr_val - r_mba->membw.bw_gran;
 	} else if (cur_msr_val < MAX_MBA_BW &&
-		   (user_bw > (cur_bw + delta_bw))) {
+		   (user_bw > (cur_bw * (cur_msr_val + r_mba->membw.min_bw) / cur_msr_val))) {
 		new_msr_val = cur_msr_val + r_mba->membw.bw_gran;
 	} else {
 		return;
 	}
 
 	resctrl_arch_update_one(r_mba, dom_mba, closid, CDP_NONE, new_msr_val);
-
-	/*
-	 * Delta values are updated dynamically package wise for each
-	 * rdtgrp every time the throttle MSR changes value.
-	 *
-	 * This is because (1)the increase in bandwidth is not perfectly
-	 * linear and only "approximately" linear even when the hardware
-	 * says it is linear.(2)Also since MBA is a core specific
-	 * mechanism, the delta values vary based on number of cores used
-	 * by the rdtgrp.
-	 */
-	pmbm_data->delta_comp = true;
-	list_for_each_entry(entry, head, mon.crdtgrp_list) {
-		cmbm_data = &dom_mbm->mbm_local[entry->mon.rmid];
-		cmbm_data->delta_comp = true;
-	}
 }
 
 static void mbm_update(struct rdt_resource *r, struct rdt_domain *d, int rmid)
@@ -813,6 +791,12 @@
 		return ret;
 
 	if (rdt_cpu_has(X86_FEATURE_BMEC)) {
+		u32 eax, ebx, ecx, edx;
+
+		/* Detect list of bandwidth sources that can be tracked */
+		cpuid_count(0x80000020, 3, &eax, &ebx, &ecx, &edx);
+		hw_res->mbm_cfg_mask = ecx & MAX_EVT_CONFIG_BITS;
+
 		if (rdt_cpu_has(X86_FEATURE_CQM_MBM_TOTAL)) {
 			mbm_total_event.configurable = true;
 			mbm_config_rftype_init("mbm_total_bytes_config");
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/resctrl/rdtgroup.c
@@ -1620,12 +1620,6 @@
 	struct mon_config_info mon_info = {0};
 	int ret = 0;
 
-	/* mon_config cannot be more than the supported set of events */
-	if (val > MAX_EVT_CONFIG_BITS) {
-		rdt_last_cmd_puts("Invalid event configuration\n");
-		return -EINVAL;
-	}
-
 	/*
 	 * Read the current config value first. If both are the same then
 	 * no need to write it again.
@@ -1663,6 +1657,7 @@
 
 static int mon_config_write(struct rdt_resource *r, char *tok, u32 evtid)
 {
+	struct rdt_hw_resource *hw_res = resctrl_to_arch_res(r);
 	char *dom_str = NULL, *id_str;
 	unsigned long dom_id, val;
 	struct rdt_domain *d;
@@ -1686,6 +1681,13 @@
 		return -EINVAL;
 	}
 
+	/* Value from user cannot be more than the supported set of events */
+	if ((val & hw_res->mbm_cfg_mask) != val) {
+		rdt_last_cmd_printf("Invalid event configuration: max valid mask is 0x%02x\n",
+				    hw_res->mbm_cfg_mask);
+		return -EINVAL;
+	}
+
 	list_for_each_entry(d, &r->domains, list) {
 		if (d->id == dom_id) {
 			ret = mbm_config_write_domain(r, d, evtid, val);
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/scattered.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/scattered.c
@@ -28,6 +28,7 @@
 	{ X86_FEATURE_EPB,		CPUID_ECX,  3, 0x00000006, 0 },
 	{ X86_FEATURE_INTEL_PPIN,	CPUID_EBX,  0, 0x00000007, 1 },
 	{ X86_FEATURE_RRSBA_CTRL,	CPUID_EDX,  2, 0x00000007, 2 },
+	{ X86_FEATURE_BHI_CTRL,		CPUID_EDX,  4, 0x00000007, 2 },
 	{ X86_FEATURE_CQM_LLC,		CPUID_EDX,  1, 0x0000000f, 0 },
 	{ X86_FEATURE_CQM_OCCUP_LLC,	CPUID_EDX,  0, 0x0000000f, 1 },
 	{ X86_FEATURE_CQM_MBM_TOTAL,	CPUID_EDX,  1, 0x0000000f, 1 },
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/sgx/main.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/sgx/main.c
@@ -474,24 +474,25 @@
 {
 	struct sgx_epc_page *page;
 	int nid_of_current = numa_node_id();
-	int nid = nid_of_current;
+	int nid_start, nid;
 
-	if (node_isset(nid_of_current, sgx_numa_mask)) {
-		page = __sgx_alloc_epc_page_from_node(nid_of_current);
-		if (page)
-			return page;
-	}
-
-	/* Fall back to the non-local NUMA nodes: */
-	while (true) {
-		nid = next_node_in(nid, sgx_numa_mask);
-		if (nid == nid_of_current)
-			break;
+	/*
+	 * Try local node first. If it doesn't have an EPC section,
+	 * fall back to the non-local NUMA nodes.
+	 */
+	if (node_isset(nid_of_current, sgx_numa_mask))
+		nid_start = nid_of_current;
+	else
+		nid_start = next_node_in(nid_of_current, sgx_numa_mask);
 
+	nid = nid_start;
+	do {
 		page = __sgx_alloc_epc_page_from_node(nid);
 		if (page)
 			return page;
-	}
+
+		nid = next_node_in(nid, sgx_numa_mask);
+	} while (nid != nid_start);
 
 	return ERR_PTR(-ENOMEM);
 }
--- linux-qcom-6.8.0.orig/arch/x86/kernel/cpu/vmware.c
+++ linux-qcom-6.8.0/arch/x86/kernel/cpu/vmware.c
@@ -41,80 +41,97 @@
 
 #define CPUID_VMWARE_INFO_LEAF               0x40000000
 #define CPUID_VMWARE_FEATURES_LEAF           0x40000010
-#define CPUID_VMWARE_FEATURES_ECX_VMMCALL    BIT(0)
-#define CPUID_VMWARE_FEATURES_ECX_VMCALL     BIT(1)
 
-#define VMWARE_HYPERVISOR_MAGIC	0x564D5868
-
-#define VMWARE_CMD_GETVERSION    10
-#define VMWARE_CMD_GETHZ         45
-#define VMWARE_CMD_GETVCPU_INFO  68
-#define VMWARE_CMD_LEGACY_X2APIC  3
-#define VMWARE_CMD_VCPU_RESERVED 31
-#define VMWARE_CMD_STEALCLOCK    91
+#define GETVCPU_INFO_LEGACY_X2APIC           BIT(3)
+#define GETVCPU_INFO_VCPU_RESERVED           BIT(31)
 
 #define STEALCLOCK_NOT_AVAILABLE (-1)
 #define STEALCLOCK_DISABLED        0
 #define STEALCLOCK_ENABLED         1
 
-#define VMWARE_PORT(cmd, eax, ebx, ecx, edx)				\
-	__asm__("inl (%%dx), %%eax" :					\
-		"=a"(eax), "=c"(ecx), "=d"(edx), "=b"(ebx) :		\
-		"a"(VMWARE_HYPERVISOR_MAGIC),				\
-		"c"(VMWARE_CMD_##cmd),					\
-		"d"(VMWARE_HYPERVISOR_PORT), "b"(UINT_MAX) :		\
-		"memory")
-
-#define VMWARE_VMCALL(cmd, eax, ebx, ecx, edx)				\
-	__asm__("vmcall" :						\
-		"=a"(eax), "=c"(ecx), "=d"(edx), "=b"(ebx) :		\
-		"a"(VMWARE_HYPERVISOR_MAGIC),				\
-		"c"(VMWARE_CMD_##cmd),					\
-		"d"(0), "b"(UINT_MAX) :					\
-		"memory")
-
-#define VMWARE_VMMCALL(cmd, eax, ebx, ecx, edx)                         \
-	__asm__("vmmcall" :						\
-		"=a"(eax), "=c"(ecx), "=d"(edx), "=b"(ebx) :		\
-		"a"(VMWARE_HYPERVISOR_MAGIC),				\
-		"c"(VMWARE_CMD_##cmd),					\
-		"d"(0), "b"(UINT_MAX) :					\
-		"memory")
-
-#define VMWARE_CMD(cmd, eax, ebx, ecx, edx) do {		\
-	switch (vmware_hypercall_mode) {			\
-	case CPUID_VMWARE_FEATURES_ECX_VMCALL:			\
-		VMWARE_VMCALL(cmd, eax, ebx, ecx, edx);		\
-		break;						\
-	case CPUID_VMWARE_FEATURES_ECX_VMMCALL:			\
-		VMWARE_VMMCALL(cmd, eax, ebx, ecx, edx);	\
-		break;						\
-	default:						\
-		VMWARE_PORT(cmd, eax, ebx, ecx, edx);		\
-		break;						\
-	}							\
-	} while (0)
-
 struct vmware_steal_time {
 	union {
-		uint64_t clock;	/* stolen time counter in units of vtsc */
+		u64 clock;	/* stolen time counter in units of vtsc */
 		struct {
 			/* only for little-endian */
-			uint32_t clock_low;
-			uint32_t clock_high;
+			u32 clock_low;
+			u32 clock_high;
 		};
 	};
-	uint64_t reserved[7];
+	u64 reserved[7];
 };
 
 static unsigned long vmware_tsc_khz __ro_after_init;
 static u8 vmware_hypercall_mode     __ro_after_init;
 
+unsigned long vmware_hypercall_slow(unsigned long cmd,
+				    unsigned long in1, unsigned long in3,
+				    unsigned long in4, unsigned long in5,
+				    u32 *out1, u32 *out2, u32 *out3,
+				    u32 *out4, u32 *out5)
+{
+	unsigned long out0, rbx, rcx, rdx, rsi, rdi;
+
+	switch (vmware_hypercall_mode) {
+	case CPUID_VMWARE_FEATURES_ECX_VMCALL:
+		asm_inline volatile ("vmcall"
+				: "=a" (out0), "=b" (rbx), "=c" (rcx),
+				"=d" (rdx), "=S" (rsi), "=D" (rdi)
+				: "a" (VMWARE_HYPERVISOR_MAGIC),
+				"b" (in1),
+				"c" (cmd),
+				"d" (in3),
+				"S" (in4),
+				"D" (in5)
+				: "cc", "memory");
+		break;
+	case CPUID_VMWARE_FEATURES_ECX_VMMCALL:
+		asm_inline volatile ("vmmcall"
+				: "=a" (out0), "=b" (rbx), "=c" (rcx),
+				"=d" (rdx), "=S" (rsi), "=D" (rdi)
+				: "a" (VMWARE_HYPERVISOR_MAGIC),
+				"b" (in1),
+				"c" (cmd),
+				"d" (in3),
+				"S" (in4),
+				"D" (in5)
+				: "cc", "memory");
+		break;
+	default:
+		asm_inline volatile ("movw %[port], %%dx; inl (%%dx), %%eax"
+				: "=a" (out0), "=b" (rbx), "=c" (rcx),
+				"=d" (rdx), "=S" (rsi), "=D" (rdi)
+				: [port] "i" (VMWARE_HYPERVISOR_PORT),
+				"a" (VMWARE_HYPERVISOR_MAGIC),
+				"b" (in1),
+				"c" (cmd),
+				"d" (in3),
+				"S" (in4),
+				"D" (in5)
+				: "cc", "memory");
+		break;
+	}
+
+	if (out1)
+		*out1 = rbx;
+	if (out2)
+		*out2 = rcx;
+	if (out3)
+		*out3 = rdx;
+	if (out4)
+		*out4 = rsi;
+	if (out5)
+		*out5 = rdi;
+
+	return out0;
+}
+
 static inline int __vmware_platform(void)
 {
-	uint32_t eax, ebx, ecx, edx;
-	VMWARE_CMD(GETVERSION, eax, ebx, ecx, edx);
-	return eax != (uint32_t)-1 && ebx == VMWARE_HYPERVISOR_MAGIC;
+	u32 eax, ebx, ecx;
+
+	eax = vmware_hypercall3(VMWARE_CMD_GETVERSION, 0, &ebx, &ecx);
+	return eax != UINT_MAX && ebx == VMWARE_HYPERVISOR_MAGIC;
 }
 
 static unsigned long vmware_get_tsc_khz(void)
@@ -166,21 +183,12 @@
 	pr_info("using clock offset of %llu ns\n", d->cyc2ns_offset);
 }
 
-static int vmware_cmd_stealclock(uint32_t arg1, uint32_t arg2)
+static int vmware_cmd_stealclock(u32 addr_hi, u32 addr_lo)
 {
-	uint32_t result, info;
+	u32 info;
 
-	asm volatile (VMWARE_HYPERCALL :
-		"=a"(result),
-		"=c"(info) :
-		"a"(VMWARE_HYPERVISOR_MAGIC),
-		"b"(0),
-		"c"(VMWARE_CMD_STEALCLOCK),
-		"d"(0),
-		"S"(arg1),
-		"D"(arg2) :
-		"memory");
-	return result;
+	return vmware_hypercall5(VMWARE_CMD_STEALCLOCK, 0, 0, addr_hi, addr_lo,
+				 &info);
 }
 
 static bool stealclock_enable(phys_addr_t pa)
@@ -215,15 +223,15 @@
  * Return:
  *      The steal clock reading in ns.
  */
-static uint64_t vmware_steal_clock(int cpu)
+static u64 vmware_steal_clock(int cpu)
 {
 	struct vmware_steal_time *steal = &per_cpu(vmw_steal_time, cpu);
-	uint64_t clock;
+	u64 clock;
 
 	if (IS_ENABLED(CONFIG_64BIT))
 		clock = READ_ONCE(steal->clock);
 	else {
-		uint32_t initial_high, low, high;
+		u32 initial_high, low, high;
 
 		do {
 			initial_high = READ_ONCE(steal->clock_high);
@@ -235,7 +243,7 @@
 			high = READ_ONCE(steal->clock_high);
 		} while (initial_high != high);
 
-		clock = ((uint64_t)high << 32) | low;
+		clock = ((u64)high << 32) | low;
 	}
 
 	return mul_u64_u32_shr(clock, vmware_cyc2ns.cyc2ns_mul,
@@ -389,13 +397,13 @@
 
 static void __init vmware_platform_setup(void)
 {
-	uint32_t eax, ebx, ecx, edx;
-	uint64_t lpj, tsc_khz;
+	u32 eax, ebx, ecx;
+	u64 lpj, tsc_khz;
 
-	VMWARE_CMD(GETHZ, eax, ebx, ecx, edx);
+	eax = vmware_hypercall3(VMWARE_CMD_GETHZ, UINT_MAX, &ebx, &ecx);
 
 	if (ebx != UINT_MAX) {
-		lpj = tsc_khz = eax | (((uint64_t)ebx) << 32);
+		lpj = tsc_khz = eax | (((u64)ebx) << 32);
 		do_div(tsc_khz, 1000);
 		WARN_ON(tsc_khz >> 32);
 		pr_info("TSC freq read from hypervisor : %lu.%03lu MHz\n",
@@ -446,7 +454,7 @@
  * If !boot_cpu_has(X86_FEATURE_HYPERVISOR), vmware_hypercall_mode
  * intentionally defaults to 0.
  */
-static uint32_t __init vmware_platform(void)
+static u32 __init vmware_platform(void)
 {
 	if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
 		unsigned int eax;
@@ -474,12 +482,65 @@
 /* Checks if hypervisor supports x2apic without VT-D interrupt remapping. */
 static bool __init vmware_legacy_x2apic_available(void)
 {
-	uint32_t eax, ebx, ecx, edx;
-	VMWARE_CMD(GETVCPU_INFO, eax, ebx, ecx, edx);
-	return !(eax & BIT(VMWARE_CMD_VCPU_RESERVED)) &&
-		(eax & BIT(VMWARE_CMD_LEGACY_X2APIC));
+	u32 eax;
+
+	eax = vmware_hypercall1(VMWARE_CMD_GETVCPU_INFO, 0);
+	return !(eax & GETVCPU_INFO_VCPU_RESERVED) &&
+		(eax & GETVCPU_INFO_LEGACY_X2APIC);
 }
 
+#ifdef CONFIG_INTEL_TDX_GUEST
+/*
+ * TDCALL[TDG.VP.VMCALL] uses %rax (arg0) and %rcx (arg2). Therefore,
+ * we remap those registers to %r12 and %r13, respectively.
+ */
+unsigned long vmware_tdx_hypercall(unsigned long cmd,
+				   unsigned long in1, unsigned long in3,
+				   unsigned long in4, unsigned long in5,
+				   u32 *out1, u32 *out2, u32 *out3,
+				   u32 *out4, u32 *out5)
+{
+	struct tdx_module_args args = {};
+
+	if (!hypervisor_is_type(X86_HYPER_VMWARE)) {
+		pr_warn_once("Incorrect usage\n");
+		return ULONG_MAX;
+	}
+
+	if (cmd & ~VMWARE_CMD_MASK) {
+		pr_warn_once("Out of range command %lx\n", cmd);
+		return ULONG_MAX;
+	}
+
+	args.rbx = in1;
+	args.rdx = in3;
+	args.rsi = in4;
+	args.rdi = in5;
+	args.r10 = VMWARE_TDX_VENDOR_LEAF;
+	args.r11 = VMWARE_TDX_HCALL_FUNC;
+	args.r12 = VMWARE_HYPERVISOR_MAGIC;
+	args.r13 = cmd;
+	/* CPL */
+	args.r15 = 0;
+
+	__tdx_hypercall(&args);
+
+	if (out1)
+		*out1 = args.rbx;
+	if (out2)
+		*out2 = args.r13;
+	if (out3)
+		*out3 = args.rdx;
+	if (out4)
+		*out4 = args.rsi;
+	if (out5)
+		*out5 = args.rdi;
+
+	return args.r12;
+}
+EXPORT_SYMBOL_GPL(vmware_tdx_hypercall);
+#endif
+
 #ifdef CONFIG_AMD_MEM_ENCRYPT
 static void vmware_sev_es_hcall_prepare(struct ghcb *ghcb,
 					struct pt_regs *regs)
--- linux-qcom-6.8.0.orig/arch/x86/kernel/crash.c
+++ linux-qcom-6.8.0/arch/x86/kernel/crash.c
@@ -124,6 +124,18 @@
 #ifdef CONFIG_HPET_TIMER
 	hpet_disable();
 #endif
+
+	/*
+	 * Non-crash kexec calls enc_kexec_begin() while scheduling is still
+	 * active. This allows the callback to wait until all in-flight
+	 * shared<->private conversions are complete. In a crash scenario,
+	 * enc_kexec_begin() gets called after all but one CPU have been shut
+	 * down and interrupts have been disabled. This allows the callback to
+	 * detect a race with the conversion and report it.
+	 */
+	x86_platform.guest.enc_kexec_begin();
+	x86_platform.guest.enc_kexec_finish();
+
 	crash_save_cpu(regs, safe_smp_processor_id());
 }
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/devicetree.c
+++ linux-qcom-6.8.0/arch/x86/kernel/devicetree.c
@@ -82,7 +82,7 @@
 
 	ret = pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
 	if (ret)
-		return ret;
+		return pcibios_err_to_errno(ret);
 	if (!pin)
 		return 0;
 
@@ -283,22 +283,24 @@
 	u32 size, map_len;
 	void *dt;
 
-	if (!initial_dtb)
-		return;
+	if (initial_dtb) {
+		map_len = max(PAGE_SIZE - (initial_dtb & ~PAGE_MASK), (u64)128);
 
-	map_len = max(PAGE_SIZE - (initial_dtb & ~PAGE_MASK), (u64)128);
+		dt = early_memremap(initial_dtb, map_len);
+		size = fdt_totalsize(dt);
+		if (map_len < size) {
+			early_memunmap(dt, map_len);
+			dt = early_memremap(initial_dtb, size);
+			map_len = size;
+		}
 
-	dt = early_memremap(initial_dtb, map_len);
-	size = fdt_totalsize(dt);
-	if (map_len < size) {
-		early_memunmap(dt, map_len);
-		dt = early_memremap(initial_dtb, size);
-		map_len = size;
+		early_init_dt_verify(dt, __pa(dt));
 	}
 
-	early_init_dt_verify(dt);
 	unflatten_and_copy_device_tree();
-	early_memunmap(dt, map_len);
+
+	if (initial_dtb)
+		early_memunmap(dt, map_len);
 }
 #endif
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/early-quirks.c
+++ linux-qcom-6.8.0/arch/x86/kernel/early-quirks.c
@@ -29,6 +29,37 @@
 #include <asm/irq_remapping.h>
 #include <asm/early_ioremap.h>
 
+static void __init early_pci_clear_msi(int bus, int slot, int func)
+{
+	int pos;
+	u16 ctrl;
+
+	if (likely(!pci_early_clear_msi))
+		return;
+
+	pr_info_once("Clearing MSI/MSI-X enable bits early in boot (quirk)\n");
+
+	pos = pci_early_find_cap(bus, slot, func, PCI_CAP_ID_MSI);
+	if (pos) {
+		ctrl = read_pci_config_16(bus, slot, func, pos + PCI_MSI_FLAGS);
+		ctrl &= ~PCI_MSI_FLAGS_ENABLE;
+		write_pci_config_16(bus, slot, func, pos + PCI_MSI_FLAGS, ctrl);
+
+		/* Read again to flush previous write */
+		ctrl = read_pci_config_16(bus, slot, func, pos + PCI_MSI_FLAGS);
+	}
+
+	pos = pci_early_find_cap(bus, slot, func, PCI_CAP_ID_MSIX);
+	if (pos) {
+		ctrl = read_pci_config_16(bus, slot, func, pos + PCI_MSIX_FLAGS);
+		ctrl &= ~PCI_MSIX_FLAGS_ENABLE;
+		write_pci_config_16(bus, slot, func, pos + PCI_MSIX_FLAGS, ctrl);
+
+		/* Read again to flush previous write */
+		ctrl = read_pci_config_16(bus, slot, func, pos + PCI_MSIX_FLAGS);
+	}
+}
+
 static void __init fix_hypertransport_config(int num, int slot, int func)
 {
 	u32 htcfg;
@@ -728,6 +759,7 @@
 		PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
 	{ PCI_VENDOR_ID_BROADCOM, 0x4331,
 	  PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset},
+	{ PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, early_pci_clear_msi},
 	{}
 };
 
@@ -780,6 +812,10 @@
 				    PCI_HEADER_TYPE);
 
 	if ((type & PCI_HEADER_TYPE_MASK) == PCI_HEADER_TYPE_BRIDGE) {
+		/* pci_early_clear_msi scans the buses differently. */
+		if (pci_early_clear_msi)
+			return -1;
+
 		sec = read_pci_config_byte(num, slot, func, PCI_SECONDARY_BUS);
 		if (sec > num)
 			early_pci_scan_bus(sec);
@@ -806,8 +842,13 @@
 
 void __init early_quirks(void)
 {
+	int bus;
+
 	if (!early_pci_allowed())
 		return;
 
 	early_pci_scan_bus(0);
+	/* pci_early_clear_msi scans more buses. */
+	for (bus = 1; pci_early_clear_msi && bus < 256; bus++)
+		early_pci_scan_bus(bus);
 }
--- linux-qcom-6.8.0.orig/arch/x86/kernel/eisa.c
+++ linux-qcom-6.8.0/arch/x86/kernel/eisa.c
@@ -2,6 +2,7 @@
 /*
  * EISA specific code
  */
+#include <linux/cc_platform.h>
 #include <linux/ioport.h>
 #include <linux/eisa.h>
 #include <linux/io.h>
@@ -12,7 +13,7 @@
 {
 	void __iomem *p;
 
-	if (xen_pv_domain() && !xen_initial_domain())
+	if ((xen_pv_domain() && !xen_initial_domain()) || cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
 		return 0;
 
 	p = ioremap(0x0FFFD9, 4);
--- linux-qcom-6.8.0.orig/arch/x86/kernel/fpu/core.c
+++ linux-qcom-6.8.0/arch/x86/kernel/fpu/core.c
@@ -145,8 +145,8 @@
 		asm volatile(
 			"fnclex\n\t"
 			"emms\n\t"
-			"fildl %P[addr]"	/* set F?P to defined value */
-			: : [addr] "m" (fpstate));
+			"fildl %[addr]"	/* set F?P to defined value */
+			: : [addr] "m" (*fpstate));
 	}
 
 	if (use_xsave()) {
--- linux-qcom-6.8.0.orig/arch/x86/kernel/fpu/regset.c
+++ linux-qcom-6.8.0/arch/x86/kernel/fpu/regset.c
@@ -190,7 +190,8 @@
 	struct fpu *fpu = &target->thread.fpu;
 	struct cet_user_state *cetregs;
 
-	if (!cpu_feature_enabled(X86_FEATURE_USER_SHSTK))
+	if (!cpu_feature_enabled(X86_FEATURE_USER_SHSTK) ||
+	    !ssp_active(target, regset))
 		return -ENODEV;
 
 	sync_fpstate(fpu);
--- linux-qcom-6.8.0.orig/arch/x86/kernel/fpu/signal.c
+++ linux-qcom-6.8.0/arch/x86/kernel/fpu/signal.c
@@ -156,7 +156,7 @@
 	return !err;
 }
 
-static inline int copy_fpregs_to_sigframe(struct xregs_state __user *buf)
+static inline int copy_fpregs_to_sigframe(struct xregs_state __user *buf, u32 pkru)
 {
 	if (use_xsave())
 		return xsave_to_user_sigframe(buf);
@@ -185,7 +185,7 @@
  * For [f]xsave state, update the SW reserved fields in the [f]xsave frame
  * indicating the absence/presence of the extended state to the user.
  */
-bool copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)
+bool copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size, u32 pkru)
 {
 	struct task_struct *tsk = current;
 	struct fpstate *fpstate = tsk->thread.fpu.fpstate;
@@ -228,7 +228,7 @@
 		fpregs_restore_userregs();
 
 	pagefault_disable();
-	ret = copy_fpregs_to_sigframe(buf_fx);
+	ret = copy_fpregs_to_sigframe(buf_fx, pkru);
 	pagefault_enable();
 	fpregs_unlock();
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/fpu/xstate.c
+++ linux-qcom-6.8.0/arch/x86/kernel/fpu/xstate.c
@@ -178,10 +178,11 @@
 	 * Must happen after CR4 setup and before xsetbv() to allow KVM
 	 * lazy passthrough.  Write independent of the dynamic state static
 	 * key as that does not work on the boot CPU. This also ensures
-	 * that any stale state is wiped out from XFD.
+	 * that any stale state is wiped out from XFD. Reset the per CPU
+	 * xfd cache too.
 	 */
 	if (cpu_feature_enabled(X86_FEATURE_XFD))
-		wrmsrl(MSR_IA32_XFD, init_fpstate.xfd);
+		xfd_set_state(init_fpstate.xfd);
 
 	/*
 	 * XCR_XFEATURE_ENABLED_MASK (aka. XCR0) sets user features
@@ -787,6 +788,9 @@
 		goto out_disable;
 	}
 
+	fpu_kernel_cfg.independent_features = fpu_kernel_cfg.max_features &
+					      XFEATURE_MASK_INDEPENDENT;
+
 	/*
 	 * Clear XSAVE features that are disabled in the normal CPUID.
 	 */
--- linux-qcom-6.8.0.orig/arch/x86/kernel/fpu/xstate.h
+++ linux-qcom-6.8.0/arch/x86/kernel/fpu/xstate.h
@@ -64,9 +64,9 @@
 static inline u64 xfeatures_mask_independent(void)
 {
 	if (!cpu_feature_enabled(X86_FEATURE_ARCH_LBR))
-		return XFEATURE_MASK_INDEPENDENT & ~XFEATURE_MASK_LBR;
+		return fpu_kernel_cfg.independent_features & ~XFEATURE_MASK_LBR;
 
-	return XFEATURE_MASK_INDEPENDENT;
+	return fpu_kernel_cfg.independent_features;
 }
 
 /* XSAVE/XRSTOR wrapper functions */
@@ -148,20 +148,26 @@
 #endif
 
 #ifdef CONFIG_X86_64
+static inline void xfd_set_state(u64 xfd)
+{
+	wrmsrl(MSR_IA32_XFD, xfd);
+	__this_cpu_write(xfd_state, xfd);
+}
+
 static inline void xfd_update_state(struct fpstate *fpstate)
 {
 	if (fpu_state_size_dynamic()) {
 		u64 xfd = fpstate->xfd;
 
-		if (__this_cpu_read(xfd_state) != xfd) {
-			wrmsrl(MSR_IA32_XFD, xfd);
-			__this_cpu_write(xfd_state, xfd);
-		}
+		if (__this_cpu_read(xfd_state) != xfd)
+			xfd_set_state(xfd);
 	}
 }
 
 extern int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu);
 #else
+static inline void xfd_set_state(u64 xfd) { }
+
 static inline void xfd_update_state(struct fpstate *fpstate) { }
 
 static inline int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu) {
--- linux-qcom-6.8.0.orig/arch/x86/kernel/jailhouse.c
+++ linux-qcom-6.8.0/arch/x86/kernel/jailhouse.c
@@ -12,6 +12,7 @@
 #include <linux/kernel.h>
 #include <linux/reboot.h>
 #include <linux/serial_8250.h>
+#include <linux/acpi.h>
 #include <asm/apic.h>
 #include <asm/io_apic.h>
 #include <asm/acpi.h>
--- linux-qcom-6.8.0.orig/arch/x86/kernel/kprobes/core.c
+++ linux-qcom-6.8.0/arch/x86/kernel/kprobes/core.c
@@ -335,7 +335,16 @@
 kprobe_opcode_t *arch_adjust_kprobe_addr(unsigned long addr, unsigned long offset,
 					 bool *on_func_entry)
 {
-	if (is_endbr(*(u32 *)addr)) {
+	u32 insn;
+
+	/*
+	 * Since 'addr' is not guaranteed to be safe to access, use
+	 * copy_from_kernel_nofault() to read the instruction:
+	 */
+	if (copy_from_kernel_nofault(&insn, (void *)addr, sizeof(u32)))
+		return NULL;
+
+	if (is_endbr(insn)) {
 		*on_func_entry = !offset || offset == 4;
 		if (*on_func_entry)
 			offset = 4;
--- linux-qcom-6.8.0.orig/arch/x86/kernel/kprobes/ftrace.c
+++ linux-qcom-6.8.0/arch/x86/kernel/kprobes/ftrace.c
@@ -21,6 +21,9 @@
 	struct kprobe_ctlblk *kcb;
 	int bit;
 
+	if (unlikely(kprobe_ftrace_disabled))
+		return;
+
 	bit = ftrace_test_recursion_trylock(ip, parent_ip);
 	if (bit < 0)
 		return;
--- linux-qcom-6.8.0.orig/arch/x86/kernel/machine_kexec_64.c
+++ linux-qcom-6.8.0/arch/x86/kernel/machine_kexec_64.c
@@ -28,6 +28,7 @@
 #include <asm/setup.h>
 #include <asm/set_memory.h>
 #include <asm/cpu.h>
+#include <asm/efi.h>
 
 #ifdef CONFIG_ACPI
 /*
@@ -87,6 +88,8 @@
 {
 #ifdef CONFIG_EFI
 	unsigned long mstart, mend;
+	void *kaddr;
+	int ret;
 
 	if (!efi_enabled(EFI_BOOT))
 		return 0;
@@ -102,6 +105,30 @@
 	if (!mstart)
 		return 0;
 
+	ret = kernel_ident_mapping_init(info, level4p, mstart, mend);
+	if (ret)
+		return ret;
+
+	kaddr = memremap(mstart, mend - mstart, MEMREMAP_WB);
+	if (!kaddr) {
+		pr_err("Could not map UEFI system table\n");
+		return -ENOMEM;
+	}
+
+	mstart = efi_config_table;
+
+	if (efi_enabled(EFI_64BIT)) {
+		efi_system_table_64_t *stbl = (efi_system_table_64_t *)kaddr;
+
+		mend = mstart + sizeof(efi_config_table_64_t) * stbl->nr_tables;
+	} else {
+		efi_system_table_32_t *stbl = (efi_system_table_32_t *)kaddr;
+
+		mend = mstart + sizeof(efi_config_table_32_t) * stbl->nr_tables;
+	}
+
+	memunmap(kaddr);
+
 	return kernel_ident_mapping_init(info, level4p, mstart, mend);
 #endif
 	return 0;
@@ -295,8 +322,15 @@
 void machine_kexec(struct kimage *image)
 {
 	unsigned long page_list[PAGES_NR];
-	void *control_page;
+	unsigned int host_mem_enc_active;
 	int save_ftrace_enabled;
+	void *control_page;
+
+	/*
+	 * This must be done before load_segments() since if call depth tracking
+	 * is used then GS must be valid to make any function calls.
+	 */
+	host_mem_enc_active = cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT);
 
 #ifdef CONFIG_KEXEC_JUMP
 	if (image->preserve_context)
@@ -358,7 +392,7 @@
 				       (unsigned long)page_list,
 				       image->start,
 				       image->preserve_context,
-				       cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT));
+				       host_mem_enc_active);
 
 #ifdef CONFIG_KEXEC_JUMP
 	if (image->preserve_context)
--- linux-qcom-6.8.0.orig/arch/x86/kernel/mmconf-fam10h_64.c
+++ linux-qcom-6.8.0/arch/x86/kernel/mmconf-fam10h_64.c
@@ -9,6 +9,7 @@
 #include <linux/pci.h>
 #include <linux/dmi.h>
 #include <linux/range.h>
+#include <linux/acpi.h>
 
 #include <asm/pci-direct.h>
 #include <linux/sort.h>
--- linux-qcom-6.8.0.orig/arch/x86/kernel/nmi.c
+++ linux-qcom-6.8.0/arch/x86/kernel/nmi.c
@@ -636,7 +636,7 @@
 			msgp = nmi_check_stall_msg[idx];
 			if (nsp->idt_ignored_snap != READ_ONCE(nsp->idt_ignored) && (idx & 0x1))
 				modp = ", but OK because ignore_nmis was set";
-			if (nmi_seq & ~0x1)
+			if (nmi_seq & 0x1)
 				msghp = " (CPU currently in NMI handler function)";
 			else if (nsp->idt_nmi_seq_snap + 1 == nmi_seq)
 				msghp = " (CPU exited one NMI handler function)";
--- linux-qcom-6.8.0.orig/arch/x86/kernel/paravirt.c
+++ linux-qcom-6.8.0/arch/x86/kernel/paravirt.c
@@ -51,13 +51,12 @@
 DEFINE_ASM_FUNC(pv_native_read_cr2, "mov %cr2, %rax", .noinstr.text);
 #endif
 
-DEFINE_STATIC_KEY_TRUE(virt_spin_lock_key);
+DEFINE_STATIC_KEY_FALSE(virt_spin_lock_key);
 
 void __init native_pv_lock_init(void)
 {
-	if (IS_ENABLED(CONFIG_PARAVIRT_SPINLOCKS) &&
-	    !boot_cpu_has(X86_FEATURE_HYPERVISOR))
-		static_branch_disable(&virt_spin_lock_key);
+	if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
+		static_branch_enable(&virt_spin_lock_key);
 }
 
 static void native_tlb_remove_table(struct mmu_gather *tlb, void *table)
--- linux-qcom-6.8.0.orig/arch/x86/kernel/probe_roms.c
+++ linux-qcom-6.8.0/arch/x86/kernel/probe_roms.c
@@ -203,16 +203,6 @@
 	unsigned char c;
 	int i;
 
-	/*
-	 * The ROM memory range is not part of the e820 table and is therefore not
-	 * pre-validated by BIOS. The kernel page table maps the ROM region as encrypted
-	 * memory, and SNP requires encrypted memory to be validated before access.
-	 * Do that here.
-	 */
-	snp_prep_memory(video_rom_resource.start,
-			((system_rom_resource.end + 1) - video_rom_resource.start),
-			SNP_PAGE_STATE_PRIVATE);
-
 	/* video rom */
 	upper = adapter_rom_resources[0].start;
 	for (start = video_rom_resource.start; start < upper; start += 2048) {
--- linux-qcom-6.8.0.orig/arch/x86/kernel/process.c
+++ linux-qcom-6.8.0/arch/x86/kernel/process.c
@@ -1030,7 +1030,10 @@
 
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
-	return randomize_page(mm->brk, 0x02000000);
+	if (mmap_is_ia32())
+		return randomize_page(mm->brk, SZ_32M);
+
+	return randomize_page(mm->brk, SZ_1G);
 }
 
 /*
--- linux-qcom-6.8.0.orig/arch/x86/kernel/process_64.c
+++ linux-qcom-6.8.0/arch/x86/kernel/process_64.c
@@ -117,7 +117,7 @@
 
 	printk("%sFS:  %016lx(%04x) GS:%016lx(%04x) knlGS:%016lx\n",
 	       log_lvl, fs, fsindex, gs, gsindex, shadowgs);
-	printk("%sCS:  %04lx DS: %04x ES: %04x CR0: %016lx\n",
+	printk("%sCS:  %04x DS: %04x ES: %04x CR0: %016lx\n",
 		log_lvl, regs->cs, ds, es, cr0);
 	printk("%sCR2: %016lx CR3: %016lx CR4: %016lx\n",
 		log_lvl, cr2, cr3, cr4);
@@ -138,7 +138,7 @@
 		       log_lvl, d3, d6, d7);
 	}
 
-	if (cpu_feature_enabled(X86_FEATURE_OSPKE))
+	if (cr4 & X86_CR4_PKE)
 		printk("%sPKRU: %08x\n", log_lvl, read_pkru());
 }
 
@@ -750,6 +750,27 @@
 
 #define LAM_U57_BITS 6
 
+static void enable_lam_func(void *__mm)
+{
+	struct mm_struct *mm = __mm;
+
+	if (this_cpu_read(cpu_tlbstate.loaded_mm) == mm) {
+		write_cr3(__read_cr3() | mm->context.lam_cr3_mask);
+		set_tlbstate_lam_mode(mm);
+	}
+}
+
+static void mm_enable_lam(struct mm_struct *mm)
+{
+	/*
+	 * Even though the process must still be single-threaded at this
+	 * point, kernel threads may be using the mm.  IPI those kernel
+	 * threads if they exist.
+	 */
+	on_each_cpu_mask(mm_cpumask(mm), enable_lam_func, mm, true);
+	set_bit(MM_CONTEXT_LOCK_LAM, &mm->context.flags);
+}
+
 static int prctl_enable_tagged_addr(struct mm_struct *mm, unsigned long nr_bits)
 {
 	if (!cpu_feature_enabled(X86_FEATURE_LAM))
@@ -766,6 +787,10 @@
 	if (mmap_write_lock_killable(mm))
 		return -EINTR;
 
+	/*
+	 * MM_CONTEXT_LOCK_LAM is set on clone.  Prevent LAM from
+	 * being enabled unless the process is single threaded:
+	 */
 	if (test_bit(MM_CONTEXT_LOCK_LAM, &mm->context.flags)) {
 		mmap_write_unlock(mm);
 		return -EBUSY;
@@ -782,9 +807,7 @@
 		return -EINVAL;
 	}
 
-	write_cr3(__read_cr3() | mm->context.lam_cr3_mask);
-	set_tlbstate_lam_mode(mm);
-	set_bit(MM_CONTEXT_LOCK_LAM, &mm->context.flags);
+	mm_enable_lam(mm);
 
 	mmap_write_unlock(mm);
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/reboot.c
+++ linux-qcom-6.8.0/arch/x86/kernel/reboot.c
@@ -12,6 +12,7 @@
 #include <linux/delay.h>
 #include <linux/objtool.h>
 #include <linux/pgtable.h>
+#include <linux/kexec.h>
 #include <acpi/reboot.h>
 #include <asm/io.h>
 #include <asm/apic.h>
@@ -487,7 +488,46 @@
 			DMI_MATCH(DMI_PRODUCT_NAME, "VGN-Z540N"),
 		},
 	},
-
+	{	/* Handle problems with rebooting on the Latitude E6520. */
+		.callback = set_pci_reboot,
+		.ident = "Dell Latitude E6520",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6520"),
+		},
+	},
+	{       /* Handle problems with rebooting on the OptiPlex 790. */
+		.callback = set_pci_reboot,
+		.ident = "Dell OptiPlex 790",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 790"),
+		},
+	},
+	{	/* Handle problems with rebooting on the OptiPlex 990. */
+		.callback = set_pci_reboot,
+		.ident = "Dell OptiPlex 990",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"),
+		},
+	},
+	{       /* Handle problems with rebooting on the Latitude E6220. */
+		.callback = set_pci_reboot,
+		.ident = "Dell Latitude E6220",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6220"),
+		},
+	},
+	{	/* Handle problems with rebooting on the OptiPlex 390. */
+		.callback = set_pci_reboot,
+		.ident = "Dell OptiPlex 390",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 390"),
+		},
+	},
 	{ }
 };
 
@@ -716,6 +756,14 @@
 
 void native_machine_shutdown(void)
 {
+	/*
+	 * Call enc_kexec_begin() while all CPUs are still active and
+	 * interrupts are enabled. This will allow all in-flight memory
+	 * conversions to finish cleanly.
+	 */
+	if (kexec_in_progress)
+		x86_platform.guest.enc_kexec_begin();
+
 	/* Stop the cpus and apics */
 #ifdef CONFIG_X86_IO_APIC
 	/*
@@ -752,6 +800,9 @@
 #ifdef CONFIG_X86_64
 	x86_platform.iommu_shutdown();
 #endif
+
+	if (kexec_in_progress)
+		x86_platform.guest.enc_kexec_finish();
 }
 
 static void __machine_emergency_restart(int emergency)
--- linux-qcom-6.8.0.orig/arch/x86/kernel/relocate_kernel_64.S
+++ linux-qcom-6.8.0/arch/x86/kernel/relocate_kernel_64.S
@@ -11,6 +11,7 @@
 #include <asm/pgtable_types.h>
 #include <asm/nospec-branch.h>
 #include <asm/unwind_hints.h>
+#include <asm/asm-offsets.h>
 
 /*
  * Must be relocatable PIC code callable as a C function, in particular
@@ -240,6 +241,13 @@
 	movq	CR0(%r8), %r8
 	movq	%rax, %cr3
 	movq	%r8, %cr0
+
+#ifdef CONFIG_KEXEC_JUMP
+	/* Saved in save_processor_state. */
+	movq    $saved_context, %rax
+	lgdt    saved_context_gdt_desc(%rax)
+#endif
+
 	movq	%rbp, %rax
 
 	popf
--- linux-qcom-6.8.0.orig/arch/x86/kernel/setup.c
+++ linux-qcom-6.8.0/arch/x86/kernel/setup.c
@@ -9,7 +9,6 @@
 #include <linux/console.h>
 #include <linux/crash_dump.h>
 #include <linux/dma-map-ops.h>
-#include <linux/dmi.h>
 #include <linux/efi.h>
 #include <linux/ima.h>
 #include <linux/init_ohci1394_dma.h>
@@ -21,6 +20,7 @@
 #include <linux/root_dev.h>
 #include <linux/hugetlb.h>
 #include <linux/tboot.h>
+#include <linux/security.h>
 #include <linux/usb/xhci-dbgp.h>
 #include <linux/static_call.h>
 #include <linux/swiotlb.h>
@@ -36,6 +36,7 @@
 #include <asm/bios_ebda.h>
 #include <asm/bugs.h>
 #include <asm/cacheinfo.h>
+#include <asm/coco.h>
 #include <asm/cpu.h>
 #include <asm/efi.h>
 #include <asm/gart.h>
@@ -902,7 +903,15 @@
 		efi_init();
 
 	reserve_ibft_region();
-	dmi_setup();
+
+	efi_set_secure_boot(boot_params.secure_boot);
+
+#ifdef CONFIG_LOCK_DOWN_IN_SECURE_BOOT
+	if (efi_enabled(EFI_SECURE_BOOT))
+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);
+#endif
+
+	x86_init.resources.dmi_setup();
 
 	/*
 	 * VMware detection requires dmi to be available, so this
@@ -994,6 +1003,7 @@
 	 * memory size.
 	 */
 	mem_encrypt_setup_arch();
+	cc_random_init();
 
 	efi_fake_memmap();
 	efi_find_mirror();
@@ -1064,19 +1074,7 @@
 	/* Allocate bigger log buffer */
 	setup_log_buf(1);
 
-	if (efi_enabled(EFI_BOOT)) {
-		switch (boot_params.secure_boot) {
-		case efi_secureboot_mode_disabled:
-			pr_info("Secure boot disabled\n");
-			break;
-		case efi_secureboot_mode_enabled:
-			pr_info("Secure boot enabled\n");
-			break;
-		default:
-			pr_info("Secure boot could not be determined\n");
-			break;
-		}
-	}
+	efi_set_secure_boot(boot_params.secure_boot);
 
 	reserve_initrd();
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/sev-shared.c
+++ linux-qcom-6.8.0/arch/x86/kernel/sev-shared.c
@@ -10,11 +10,15 @@
  */
 
 #ifndef __BOOT_COMPRESSED
-#define error(v)	pr_err(v)
-#define has_cpuflag(f)	boot_cpu_has(f)
+#define error(v)			pr_err(v)
+#define has_cpuflag(f)			boot_cpu_has(f)
+#define sev_printk(fmt, ...)		printk(fmt, ##__VA_ARGS__)
+#define sev_printk_rtl(fmt, ...)	printk_ratelimited(fmt, ##__VA_ARGS__)
 #else
 #undef WARN
 #define WARN(condition, format...) (!!(condition))
+#define sev_printk(fmt, ...)
+#define sev_printk_rtl(fmt, ...)
 #endif
 
 /* I/O parameters for CPUID-related helpers */
@@ -89,7 +93,8 @@
 	return true;
 }
 
-static void __noreturn sev_es_terminate(unsigned int set, unsigned int reason)
+static void __head __noreturn
+sev_es_terminate(unsigned int set, unsigned int reason)
 {
 	u64 val = GHCB_MSR_TERM_REQ;
 
@@ -326,13 +331,7 @@
  */
 static const struct snp_cpuid_table *snp_cpuid_get_table(void)
 {
-	void *ptr;
-
-	asm ("lea cpuid_table_copy(%%rip), %0"
-	     : "=r" (ptr)
-	     : "p" (&cpuid_table_copy));
-
-	return ptr;
+	return &RIP_REL_REF(cpuid_table_copy);
 }
 
 /*
@@ -391,7 +390,7 @@
 	return xsave_size;
 }
 
-static bool
+static bool __head
 snp_cpuid_get_validated_func(struct cpuid_leaf *leaf)
 {
 	const struct snp_cpuid_table *cpuid_table = snp_cpuid_get_table();
@@ -528,7 +527,8 @@
  * Returns -EOPNOTSUPP if feature not enabled. Any other non-zero return value
  * should be treated as fatal by caller.
  */
-static int snp_cpuid(struct ghcb *ghcb, struct es_em_ctxt *ctxt, struct cpuid_leaf *leaf)
+static int __head
+snp_cpuid(struct ghcb *ghcb, struct es_em_ctxt *ctxt, struct cpuid_leaf *leaf)
 {
 	const struct snp_cpuid_table *cpuid_table = snp_cpuid_get_table();
 
@@ -556,9 +556,9 @@
 		leaf->eax = leaf->ebx = leaf->ecx = leaf->edx = 0;
 
 		/* Skip post-processing for out-of-range zero leafs. */
-		if (!(leaf->fn <= cpuid_std_range_max ||
-		      (leaf->fn >= 0x40000000 && leaf->fn <= cpuid_hyp_range_max) ||
-		      (leaf->fn >= 0x80000000 && leaf->fn <= cpuid_ext_range_max)))
+		if (!(leaf->fn <= RIP_REL_REF(cpuid_std_range_max) ||
+		      (leaf->fn >= 0x40000000 && leaf->fn <= RIP_REL_REF(cpuid_hyp_range_max)) ||
+		      (leaf->fn >= 0x80000000 && leaf->fn <= RIP_REL_REF(cpuid_ext_range_max))))
 			return 0;
 	}
 
@@ -570,10 +570,11 @@
  * page yet, so it only supports the MSR based communication with the
  * hypervisor and only the CPUID exit-code.
  */
-void __init do_vc_no_ghcb(struct pt_regs *regs, unsigned long exit_code)
+void __head do_vc_no_ghcb(struct pt_regs *regs, unsigned long exit_code)
 {
 	unsigned int subfn = lower_bits(regs->cx, 32);
 	unsigned int fn = lower_bits(regs->ax, 32);
+	u16 opcode = *(unsigned short *)regs->ip;
 	struct cpuid_leaf leaf;
 	int ret;
 
@@ -581,6 +582,10 @@
 	if (exit_code != SVM_EXIT_CPUID)
 		goto fail;
 
+	/* Is it really a CPUID insn? */
+	if (opcode != 0xa20f)
+		goto fail;
+
 	leaf.fn = fn;
 	leaf.subfn = subfn;
 
@@ -1016,7 +1021,8 @@
  * Search for a Confidential Computing blob passed in as a setup_data entry
  * via the Linux Boot Protocol.
  */
-static struct cc_blob_sev_info *find_cc_blob_setup_data(struct boot_params *bp)
+static __head
+struct cc_blob_sev_info *find_cc_blob_setup_data(struct boot_params *bp)
 {
 	struct cc_setup_data *sd = NULL;
 	struct setup_data *hdr;
@@ -1043,7 +1049,7 @@
  * mapping needs to be updated in sync with all the changes to virtual memory
  * layout and related mapping facilities throughout the boot process.
  */
-static void __init setup_cpuid_table(const struct cc_blob_sev_info *cc_info)
+static void __head setup_cpuid_table(const struct cc_blob_sev_info *cc_info)
 {
 	const struct snp_cpuid_table *cpuid_table_fw, *cpuid_table;
 	int i;
@@ -1063,11 +1069,11 @@
 		const struct snp_cpuid_fn *fn = &cpuid_table->fn[i];
 
 		if (fn->eax_in == 0x0)
-			cpuid_std_range_max = fn->eax;
+			RIP_REL_REF(cpuid_std_range_max) = fn->eax;
 		else if (fn->eax_in == 0x40000000)
-			cpuid_hyp_range_max = fn->eax;
+			RIP_REL_REF(cpuid_hyp_range_max) = fn->eax;
 		else if (fn->eax_in == 0x80000000)
-			cpuid_ext_range_max = fn->eax;
+			RIP_REL_REF(cpuid_ext_range_max) = fn->eax;
 	}
 }
 
@@ -1170,3 +1176,94 @@
 out:
 	return ret;
 }
+
+static enum es_result vc_check_opcode_bytes(struct es_em_ctxt *ctxt,
+					    unsigned long exit_code)
+{
+	unsigned int opcode = (unsigned int)ctxt->insn.opcode.value;
+	u8 modrm = ctxt->insn.modrm.value;
+
+	switch (exit_code) {
+
+	case SVM_EXIT_IOIO:
+	case SVM_EXIT_NPF:
+		/* handled separately */
+		return ES_OK;
+
+	case SVM_EXIT_CPUID:
+		if (opcode == 0xa20f)
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_INVD:
+		if (opcode == 0x080f)
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_MONITOR:
+		/* MONITOR and MONITORX instructions generate the same error code */
+		if (opcode == 0x010f && (modrm == 0xc8 || modrm == 0xfa))
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_MWAIT:
+		/* MWAIT and MWAITX instructions generate the same error code */
+		if (opcode == 0x010f && (modrm == 0xc9 || modrm == 0xfb))
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_MSR:
+		/* RDMSR */
+		if (opcode == 0x320f ||
+		/* WRMSR */
+		    opcode == 0x300f)
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_RDPMC:
+		if (opcode == 0x330f)
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_RDTSC:
+		if (opcode == 0x310f)
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_RDTSCP:
+		if (opcode == 0x010f && modrm == 0xf9)
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_READ_DR7:
+		if (opcode == 0x210f &&
+		    X86_MODRM_REG(ctxt->insn.modrm.value) == 7)
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_VMMCALL:
+		if (opcode == 0x010f && modrm == 0xd9)
+			return ES_OK;
+
+		break;
+
+	case SVM_EXIT_WRITE_DR7:
+		if (opcode == 0x230f &&
+		    X86_MODRM_REG(ctxt->insn.modrm.value) == 7)
+			return ES_OK;
+		break;
+
+	case SVM_EXIT_WBINVD:
+		if (opcode == 0x90f)
+			return ES_OK;
+		break;
+
+	default:
+		break;
+	}
+
+	sev_printk(KERN_ERR "Wrong/unhandled opcode bytes: 0x%x, exit_code: 0x%lx, rIP: 0x%lx\n",
+		   opcode, exit_code, ctxt->regs->ip);
+
+	return ES_UNSUPPORTED;
+}
--- linux-qcom-6.8.0.orig/arch/x86/kernel/sev.c
+++ linux-qcom-6.8.0/arch/x86/kernel/sev.c
@@ -23,8 +23,10 @@
 #include <linux/platform_device.h>
 #include <linux/io.h>
 #include <linux/psp-sev.h>
+#include <linux/dmi.h>
 #include <uapi/linux/sev-guest.h>
 
+#include <asm/init.h>
 #include <asm/cpu_entry_area.h>
 #include <asm/stacktrace.h>
 #include <asm/sev.h>
@@ -682,8 +684,9 @@
 	return ret;
 }
 
-static void early_set_pages_state(unsigned long vaddr, unsigned long paddr,
-				  unsigned long npages, enum psc_op op)
+static void __head
+early_set_pages_state(unsigned long vaddr, unsigned long paddr,
+		      unsigned long npages, enum psc_op op)
 {
 	unsigned long paddr_end;
 	u64 val;
@@ -739,7 +742,7 @@
 	sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PSC);
 }
 
-void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr,
+void __head early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr,
 					 unsigned long npages)
 {
 	/*
@@ -748,7 +751,7 @@
 	 * This eliminates worries about jump tables or checking boot_cpu_data
 	 * in the cc_platform_has() function.
 	 */
-	if (!(sev_status & MSR_AMD64_SEV_SNP_ENABLED))
+	if (!(RIP_REL_REF(sev_status) & MSR_AMD64_SEV_SNP_ENABLED))
 		return;
 
 	 /*
@@ -767,28 +770,13 @@
 	 * This eliminates worries about jump tables or checking boot_cpu_data
 	 * in the cc_platform_has() function.
 	 */
-	if (!(sev_status & MSR_AMD64_SEV_SNP_ENABLED))
+	if (!(RIP_REL_REF(sev_status) & MSR_AMD64_SEV_SNP_ENABLED))
 		return;
 
 	 /* Ask hypervisor to mark the memory pages shared in the RMP table. */
 	early_set_pages_state(vaddr, paddr, npages, SNP_PAGE_STATE_SHARED);
 }
 
-void __init snp_prep_memory(unsigned long paddr, unsigned int sz, enum psc_op op)
-{
-	unsigned long vaddr, npages;
-
-	vaddr = (unsigned long)__va(paddr);
-	npages = PAGE_ALIGN(sz) >> PAGE_SHIFT;
-
-	if (op == SNP_PAGE_STATE_PRIVATE)
-		early_snp_set_memory_private(vaddr, paddr, npages);
-	else if (op == SNP_PAGE_STATE_SHARED)
-		early_snp_set_memory_shared(vaddr, paddr, npages);
-	else
-		WARN(1, "invalid memory op %d\n", op);
-}
-
 static unsigned long __set_pages_state(struct snp_psc_desc *data, unsigned long vaddr,
 				       unsigned long vaddr_end, int op)
 {
@@ -1752,7 +1740,10 @@
 					 struct ghcb *ghcb,
 					 unsigned long exit_code)
 {
-	enum es_result result;
+	enum es_result result = vc_check_opcode_bytes(ctxt, exit_code);
+
+	if (result != ES_OK)
+		return result;
 
 	switch (exit_code) {
 	case SVM_EXIT_READ_DR7:
@@ -2059,7 +2050,7 @@
  *
  * Scan for the blob in that order.
  */
-static __init struct cc_blob_sev_info *find_cc_blob(struct boot_params *bp)
+static __head struct cc_blob_sev_info *find_cc_blob(struct boot_params *bp)
 {
 	struct cc_blob_sev_info *cc_info;
 
@@ -2085,7 +2076,7 @@
 	return cc_info;
 }
 
-bool __init snp_init(struct boot_params *bp)
+bool __head snp_init(struct boot_params *bp)
 {
 	struct cc_blob_sev_info *cc_info;
 
@@ -2107,11 +2098,22 @@
 	return true;
 }
 
-void __init __noreturn snp_abort(void)
+void __head __noreturn snp_abort(void)
 {
 	sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED);
 }
 
+/*
+ * SEV-SNP guests should only execute dmi_setup() if EFI_CONFIG_TABLES are
+ * enabled, as the alternative (fallback) logic for DMI probing in the legacy
+ * ROM region can cause a crash since this region is not pre-validated.
+ */
+void __init snp_dmi_setup(void)
+{
+	if (efi_enabled(EFI_CONFIG_TABLES))
+		dmi_setup();
+}
+
 static void dump_cpuid_table(void)
 {
 	const struct snp_cpuid_table *cpuid_table = snp_cpuid_get_table();
--- linux-qcom-6.8.0.orig/arch/x86/kernel/shstk.c
+++ linux-qcom-6.8.0/arch/x86/kernel/shstk.c
@@ -577,3 +577,14 @@
 		return wrss_control(true);
 	return -EINVAL;
 }
+
+int shstk_update_last_frame(unsigned long val)
+{
+	unsigned long ssp;
+
+	if (!features_enabled(ARCH_SHSTK_SHSTK))
+		return 0;
+
+	ssp = get_user_shstk_addr();
+	return write_user_shstk_64((u64 __user *)ssp, (u64)val);
+}
--- linux-qcom-6.8.0.orig/arch/x86/kernel/signal.c
+++ linux-qcom-6.8.0/arch/x86/kernel/signal.c
@@ -84,6 +84,7 @@
 	unsigned long math_size = 0;
 	unsigned long sp = regs->sp;
 	unsigned long buf_fx = 0;
+	u32 pkru = read_pkru();
 
 	/* redzone */
 	if (!ia32_frame)
@@ -139,7 +140,7 @@
 	}
 
 	/* save i387 and extended state */
-	if (!copy_fpstate_to_sigframe(*fpstate, (void __user *)buf_fx, math_size))
+	if (!copy_fpstate_to_sigframe(*fpstate, (void __user *)buf_fx, math_size, pkru))
 		return (void __user *)-1L;
 
 	return (void __user *)sp;
--- linux-qcom-6.8.0.orig/arch/x86/kernel/signal_64.c
+++ linux-qcom-6.8.0/arch/x86/kernel/signal_64.c
@@ -260,13 +260,13 @@
 
 	set_current_blocked(&set);
 
-	if (!restore_sigcontext(regs, &frame->uc.uc_mcontext, uc_flags))
+	if (restore_altstack(&frame->uc.uc_stack))
 		goto badframe;
 
-	if (restore_signal_shadow_stack())
+	if (!restore_sigcontext(regs, &frame->uc.uc_mcontext, uc_flags))
 		goto badframe;
 
-	if (restore_altstack(&frame->uc.uc_stack))
+	if (restore_signal_shadow_stack())
 		goto badframe;
 
 	return regs->ax;
--- linux-qcom-6.8.0.orig/arch/x86/kernel/smpboot.c
+++ linux-qcom-6.8.0/arch/x86/kernel/smpboot.c
@@ -60,6 +60,7 @@
 #include <linux/stackprotector.h>
 #include <linux/cpuhotplug.h>
 #include <linux/mc146818rtc.h>
+#include <linux/acpi.h>
 
 #include <asm/acpi.h>
 #include <asm/cacheinfo.h>
--- linux-qcom-6.8.0.orig/arch/x86/kernel/static_call.c
+++ linux-qcom-6.8.0/arch/x86/kernel/static_call.c
@@ -172,6 +172,14 @@
 }
 EXPORT_SYMBOL_GPL(arch_static_call_transform);
 
+noinstr void __static_call_update_early(void *tramp, void *func)
+{
+	BUG_ON(system_state != SYSTEM_BOOTING);
+	BUG_ON(static_call_initialized);
+	__text_gen_insn(tramp, JMP32_INSN_OPCODE, tramp, func, JMP32_INSN_SIZE);
+	sync_core();
+}
+
 #ifdef CONFIG_RETHUNK
 /*
  * This is called by apply_returns() to fix up static call trampolines,
--- linux-qcom-6.8.0.orig/arch/x86/kernel/time.c
+++ linux-qcom-6.8.0/arch/x86/kernel/time.c
@@ -27,25 +27,7 @@
 
 unsigned long profile_pc(struct pt_regs *regs)
 {
-	unsigned long pc = instruction_pointer(regs);
-
-	if (!user_mode(regs) && in_lock_functions(pc)) {
-#ifdef CONFIG_FRAME_POINTER
-		return *(unsigned long *)(regs->bp + sizeof(long));
-#else
-		unsigned long *sp = (unsigned long *)regs->sp;
-		/*
-		 * Return address is either directly at stack pointer
-		 * or above a saved flags. Eflags has bits 22-31 zero,
-		 * kernel addresses don't.
-		 */
-		if (sp[0] >> 22)
-			return sp[0];
-		if (sp[1] >> 22)
-			return sp[1];
-#endif
-	}
-	return pc;
+	return instruction_pointer(regs);
 }
 EXPORT_SYMBOL(profile_pc);
 
--- linux-qcom-6.8.0.orig/arch/x86/kernel/traps.c
+++ linux-qcom-6.8.0/arch/x86/kernel/traps.c
@@ -42,6 +42,7 @@
 #include <linux/hardirq.h>
 #include <linux/atomic.h>
 #include <linux/iommu.h>
+#include <linux/ubsan.h>
 
 #include <asm/stacktrace.h>
 #include <asm/processor.h>
@@ -90,6 +91,47 @@
 	return *(unsigned short *)addr == INSN_UD2;
 }
 
+/*
+ * Check for UD1 or UD2, accounting for Address Size Override Prefixes.
+ * If it's a UD1, get the ModRM byte to pass along to UBSan.
+ */
+__always_inline int decode_bug(unsigned long addr, u32 *imm)
+{
+	u8 v;
+
+	if (addr < TASK_SIZE_MAX)
+		return BUG_NONE;
+
+	v = *(u8 *)(addr++);
+	if (v == INSN_ASOP)
+		v = *(u8 *)(addr++);
+	if (v != OPCODE_ESCAPE)
+		return BUG_NONE;
+
+	v = *(u8 *)(addr++);
+	if (v == SECOND_BYTE_OPCODE_UD2)
+		return BUG_UD2;
+
+	if (!IS_ENABLED(CONFIG_UBSAN_TRAP) || v != SECOND_BYTE_OPCODE_UD1)
+		return BUG_NONE;
+
+	/* Retrieve the immediate (type value) for the UBSAN UD1 */
+	v = *(u8 *)(addr++);
+	if (X86_MODRM_RM(v) == 4)
+		addr++;
+
+	*imm = 0;
+	if (X86_MODRM_MOD(v) == 1)
+		*imm = *(u8 *)addr;
+	else if (X86_MODRM_MOD(v) == 2)
+		*imm = *(u32 *)addr;
+	else
+		WARN_ONCE(1, "Unexpected MODRM_MOD: %u\n", X86_MODRM_MOD(v));
+
+	return BUG_UD1;
+}
+
+
 static nokprobe_inline int
 do_trap_no_signal(struct task_struct *tsk, int trapnr, const char *str,
 		  struct pt_regs *regs,	long error_code)
@@ -215,14 +257,11 @@
 static noinstr bool handle_bug(struct pt_regs *regs)
 {
 	bool handled = false;
+	int ud_type;
+	u32 imm;
 
-	/*
-	 * Normally @regs are unpoisoned by irqentry_enter(), but handle_bug()
-	 * is a rare case that uses @regs without passing them to
-	 * irqentry_enter().
-	 */
-	kmsan_unpoison_entry_regs(regs);
-	if (!is_valid_bugaddr(regs->ip))
+	ud_type = decode_bug(regs->ip, &imm);
+	if (ud_type == BUG_NONE)
 		return handled;
 
 	/*
@@ -230,15 +269,25 @@
 	 */
 	instrumentation_begin();
 	/*
+	 * Normally @regs are unpoisoned by irqentry_enter(), but handle_bug()
+	 * is a rare case that uses @regs without passing them to
+	 * irqentry_enter().
+	 */
+	kmsan_unpoison_entry_regs(regs);
+	/*
 	 * Since we're emulating a CALL with exceptions, restore the interrupt
 	 * state to what it was at the exception site.
 	 */
 	if (regs->flags & X86_EFLAGS_IF)
 		raw_local_irq_enable();
-	if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN ||
-	    handle_cfi_failure(regs) == BUG_TRAP_TYPE_WARN) {
-		regs->ip += LEN_UD2;
-		handled = true;
+	if (ud_type == BUG_UD2) {
+		if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN ||
+		    handle_cfi_failure(regs) == BUG_TRAP_TYPE_WARN) {
+			regs->ip += LEN_UD2;
+			handled = true;
+		}
+	} else if (IS_ENABLED(CONFIG_UBSAN_TRAP)) {
+		pr_crit("%s at %pS\n", report_ubsan_failure(regs, imm), (void *)regs->ip);
 	}
 	if (regs->flags & X86_EFLAGS_IF)
 		raw_local_irq_disable();
--- linux-qcom-6.8.0.orig/arch/x86/kernel/tsc_sync.c
+++ linux-qcom-6.8.0/arch/x86/kernel/tsc_sync.c
@@ -193,11 +193,9 @@
 	cur->warned = false;
 
 	/*
-	 * If a non-zero TSC value for socket 0 may be valid then the default
-	 * adjusted value cannot assumed to be zero either.
+	 * The default adjust value cannot be assumed to be zero on any socket.
 	 */
-	if (tsc_async_resets)
-		cur->adjusted = bootval;
+	cur->adjusted = bootval;
 
 	/*
 	 * Check whether this CPU is the first in a package to come up. In
--- linux-qcom-6.8.0.orig/arch/x86/kernel/unwind_orc.c
+++ linux-qcom-6.8.0/arch/x86/kernel/unwind_orc.c
@@ -723,7 +723,7 @@
 		state->sp = task->thread.sp + sizeof(*frame);
 		state->bp = READ_ONCE_NOCHECK(frame->bp);
 		state->ip = READ_ONCE_NOCHECK(frame->ret_addr);
-		state->signal = (void *)state->ip == ret_from_fork;
+		state->signal = (void *)state->ip == ret_from_fork_asm;
 	}
 
 	if (get_stack_info((unsigned long *)state->sp, state->task,
--- linux-qcom-6.8.0.orig/arch/x86/kernel/uprobes.c
+++ linux-qcom-6.8.0/arch/x86/kernel/uprobes.c
@@ -1076,8 +1076,13 @@
 		return orig_ret_vaddr;
 
 	nleft = copy_to_user((void __user *)regs->sp, &trampoline_vaddr, rasize);
-	if (likely(!nleft))
+	if (likely(!nleft)) {
+		if (shstk_update_last_frame(trampoline_vaddr)) {
+			force_sig(SIGSEGV);
+			return -1;
+		}
 		return orig_ret_vaddr;
+	}
 
 	if (nleft != rasize) {
 		pr_err("return address clobbered: pid=%d, %%sp=%#lx, %%ip=%#lx\n",
--- linux-qcom-6.8.0.orig/arch/x86/kernel/vmlinux.lds.S
+++ linux-qcom-6.8.0/arch/x86/kernel/vmlinux.lds.S
@@ -489,6 +489,9 @@
 . = ASSERT((_end - LOAD_OFFSET <= KERNEL_IMAGE_SIZE),
 	   "kernel image bigger than KERNEL_IMAGE_SIZE");
 
+/* needed for Clang - see arch/x86/entry/entry.S */
+PROVIDE(__ref_stack_chk_guard = __stack_chk_guard);
+
 #ifdef CONFIG_X86_64
 /*
  * Per-cpu symbols which need to be offset from __per_cpu_load
--- linux-qcom-6.8.0.orig/arch/x86/kernel/x86_init.c
+++ linux-qcom-6.8.0/arch/x86/kernel/x86_init.c
@@ -3,10 +3,12 @@
  *
  *  For licencing details see kernel-base/COPYING
  */
+#include <linux/dmi.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
 #include <linux/export.h>
 #include <linux/pci.h>
+#include <linux/acpi.h>
 
 #include <asm/acpi.h>
 #include <asm/bios_ebda.h>
@@ -66,6 +68,7 @@
 		.probe_roms		= probe_roms,
 		.reserve_resources	= reserve_standard_io_resources,
 		.memory_setup		= e820__memory_setup_default,
+		.dmi_setup		= dmi_setup,
 	},
 
 	.mpparse = {
@@ -131,10 +134,12 @@
 
 static void default_nmi_init(void) { };
 
-static bool enc_status_change_prepare_noop(unsigned long vaddr, int npages, bool enc) { return true; }
-static bool enc_status_change_finish_noop(unsigned long vaddr, int npages, bool enc) { return true; }
+static int enc_status_change_prepare_noop(unsigned long vaddr, int npages, bool enc) { return 0; }
+static int enc_status_change_finish_noop(unsigned long vaddr, int npages, bool enc) { return 0; }
 static bool enc_tlb_flush_required_noop(bool enc) { return false; }
 static bool enc_cache_flush_required_noop(void) { return false; }
+static void enc_kexec_begin_noop(void) {}
+static void enc_kexec_finish_noop(void) {}
 static bool is_private_mmio_noop(u64 addr) {return false; }
 
 struct x86_platform_ops x86_platform __ro_after_init = {
@@ -158,6 +163,8 @@
 		.enc_status_change_finish  = enc_status_change_finish_noop,
 		.enc_tlb_flush_required	   = enc_tlb_flush_required_noop,
 		.enc_cache_flush_required  = enc_cache_flush_required_noop,
+		.enc_kexec_begin	   = enc_kexec_begin_noop,
+		.enc_kexec_finish	   = enc_kexec_finish_noop,
 	},
 };
 
--- linux-qcom-6.8.0.orig/arch/x86/kvm/Kconfig
+++ linux-qcom-6.8.0/arch/x86/kvm/Kconfig
@@ -32,6 +32,7 @@
 	select IRQ_BYPASS_MANAGER
 	select HAVE_KVM_IRQ_BYPASS
 	select HAVE_KVM_IRQ_ROUTING
+	select VHOST_TASK
 	select KVM_ASYNC_PF
 	select USER_RETURN_NOTIFIER
 	select KVM_MMIO
--- linux-qcom-6.8.0.orig/arch/x86/kvm/cpuid.c
+++ linux-qcom-6.8.0/arch/x86/kvm/cpuid.c
@@ -36,6 +36,26 @@
 u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly;
 EXPORT_SYMBOL_GPL(kvm_cpu_caps);
 
+struct cpuid_xstate_sizes {
+	u32 eax;
+	u32 ebx;
+	u32 ecx;
+};
+
+static struct cpuid_xstate_sizes xstate_sizes[XFEATURE_MAX] __ro_after_init;
+
+void __init kvm_init_xstate_sizes(void)
+{
+	u32 ign;
+	int i;
+
+	for (i = XFEATURE_YMM; i < ARRAY_SIZE(xstate_sizes); i++) {
+		struct cpuid_xstate_sizes *xs = &xstate_sizes[i];
+
+		cpuid_count(0xD, i, &xs->eax, &xs->ebx, &xs->ecx, &ign);
+	}
+}
+
 u32 xstate_required_size(u64 xstate_bv, bool compacted)
 {
 	int feature_bit = 0;
@@ -44,14 +64,15 @@
 	xstate_bv &= XFEATURE_MASK_EXTEND;
 	while (xstate_bv) {
 		if (xstate_bv & 0x1) {
-		        u32 eax, ebx, ecx, edx, offset;
-		        cpuid_count(0xD, feature_bit, &eax, &ebx, &ecx, &edx);
+			struct cpuid_xstate_sizes *xs = &xstate_sizes[feature_bit];
+			u32 offset;
+
 			/* ECX[1]: 64B alignment in compacted form */
 			if (compacted)
-				offset = (ecx & 0x2) ? ALIGN(ret, 64) : ret;
+				offset = (xs->ecx & 0x2) ? ALIGN(ret, 64) : ret;
 			else
-				offset = ebx;
-			ret = max(ret, offset + eax);
+				offset = xs->ebx;
+			ret = max(ret, offset + xs->eax);
 		}
 
 		xstate_bv >>= 1;
@@ -366,6 +387,7 @@
 
 	kvm_update_pv_runtime(vcpu);
 
+	vcpu->arch.is_amd_compatible = guest_cpuid_is_amd_or_hygon(vcpu);
 	vcpu->arch.maxphyaddr = cpuid_query_maxphyaddr(vcpu);
 	vcpu->arch.reserved_gpa_bits = kvm_vcpu_reserved_gpa_bits_raw(vcpu);
 
@@ -1221,9 +1243,8 @@
 		entry->eax = entry->ebx = entry->ecx = 0;
 		break;
 	case 0x80000008: {
-		unsigned g_phys_as = (entry->eax >> 16) & 0xff;
-		unsigned virt_as = max((entry->eax >> 8) & 0xff, 48U);
-		unsigned phys_as = entry->eax & 0xff;
+		unsigned int virt_as = max((entry->eax >> 8) & 0xff, 48U);
+		unsigned int phys_as;
 
 		/*
 		 * If TDP (NPT) is disabled use the adjusted host MAXPHYADDR as
@@ -1231,16 +1252,16 @@
 		 * reductions in MAXPHYADDR for memory encryption affect shadow
 		 * paging, too.
 		 *
-		 * If TDP is enabled but an explicit guest MAXPHYADDR is not
-		 * provided, use the raw bare metal MAXPHYADDR as reductions to
-		 * the HPAs do not affect GPAs.
+		 * If TDP is enabled, use the raw bare metal MAXPHYADDR as
+		 * reductions to the HPAs do not affect GPAs.
 		 */
-		if (!tdp_enabled)
-			g_phys_as = boot_cpu_data.x86_phys_bits;
-		else if (!g_phys_as)
-			g_phys_as = phys_as;
+		if (!tdp_enabled) {
+			phys_as = boot_cpu_data.x86_phys_bits;
+		} else {
+			phys_as = entry->eax & 0xff;
+		}
 
-		entry->eax = g_phys_as | (virt_as << 8);
+		entry->eax = phys_as | (virt_as << 8);
 		entry->ecx &= ~(GENMASK(31, 16) | GENMASK(11, 8));
 		entry->edx = 0;
 		cpuid_entry_override(entry, CPUID_8000_0008_EBX);
--- linux-qcom-6.8.0.orig/arch/x86/kvm/cpuid.h
+++ linux-qcom-6.8.0/arch/x86/kvm/cpuid.h
@@ -32,6 +32,7 @@
 bool kvm_cpuid(struct kvm_vcpu *vcpu, u32 *eax, u32 *ebx,
 	       u32 *ecx, u32 *edx, bool exact_only);
 
+void __init kvm_init_xstate_sizes(void);
 u32 xstate_required_size(u64 xstate_bv, bool compacted);
 
 int cpuid_query_maxphyaddr(struct kvm_vcpu *vcpu);
@@ -120,6 +121,16 @@
 	return best && is_guest_vendor_intel(best->ebx, best->ecx, best->edx);
 }
 
+static inline bool guest_cpuid_is_amd_compatible(struct kvm_vcpu *vcpu)
+{
+	return vcpu->arch.is_amd_compatible;
+}
+
+static inline bool guest_cpuid_is_intel_compatible(struct kvm_vcpu *vcpu)
+{
+	return !guest_cpuid_is_amd_compatible(vcpu);
+}
+
 static inline int guest_cpuid_family(struct kvm_vcpu *vcpu)
 {
 	struct kvm_cpuid_entry2 *best;
--- linux-qcom-6.8.0.orig/arch/x86/kvm/lapic.c
+++ linux-qcom-6.8.0/arch/x86/kvm/lapic.c
@@ -41,6 +41,7 @@
 #include "ioapic.h"
 #include "trace.h"
 #include "x86.h"
+#include "xen.h"
 #include "cpuid.h"
 #include "hyperv.h"
 #include "smm.h"
@@ -337,10 +338,8 @@
 	 * reversing the LDR calculation to get cluster of APICs, i.e. no
 	 * additional work is required.
 	 */
-	if (apic_x2apic_mode(apic)) {
-		WARN_ON_ONCE(ldr != kvm_apic_calc_x2apic_ldr(kvm_x2apic_id(apic)));
+	if (apic_x2apic_mode(apic))
 		return;
-	}
 
 	if (WARN_ON_ONCE(!kvm_apic_map_get_logical_dest(new, ldr,
 							&cluster, &mask))) {
@@ -499,8 +498,10 @@
 	}
 
 	/* Check if there are APF page ready requests pending */
-	if (enabled)
+	if (enabled) {
 		kvm_make_request(KVM_REQ_APF_READY, apic->vcpu);
+		kvm_xen_sw_enable_lapic(apic->vcpu);
+	}
 }
 
 static inline void kvm_apic_set_xapic_id(struct kvm_lapic *apic, u8 id)
@@ -2439,6 +2440,43 @@
 }
 EXPORT_SYMBOL_GPL(kvm_lapic_set_eoi);
 
+#define X2APIC_ICR_RESERVED_BITS (GENMASK_ULL(31, 20) | GENMASK_ULL(17, 16) | BIT(13))
+
+int kvm_x2apic_icr_write(struct kvm_lapic *apic, u64 data)
+{
+	if (data & X2APIC_ICR_RESERVED_BITS)
+		return 1;
+
+	/*
+	 * The BUSY bit is reserved on both Intel and AMD in x2APIC mode, but
+	 * only AMD requires it to be zero, Intel essentially just ignores the
+	 * bit.  And if IPI virtualization (Intel) or x2AVIC (AMD) is enabled,
+	 * the CPU performs the reserved bits checks, i.e. the underlying CPU
+	 * behavior will "win".  Arbitrarily clear the BUSY bit, as there is no
+	 * sane way to provide consistent behavior with respect to hardware.
+	 */
+	data &= ~APIC_ICR_BUSY;
+
+	kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32));
+	if (kvm_x86_ops.x2apic_icr_is_split) {
+		kvm_lapic_set_reg(apic, APIC_ICR, data);
+		kvm_lapic_set_reg(apic, APIC_ICR2, data >> 32);
+	} else {
+		kvm_lapic_set_reg64(apic, APIC_ICR, data);
+	}
+	trace_kvm_apic_write(APIC_ICR, data);
+	return 0;
+}
+
+static u64 kvm_x2apic_icr_read(struct kvm_lapic *apic)
+{
+	if (kvm_x86_ops.x2apic_icr_is_split)
+		return (u64)kvm_lapic_get_reg(apic, APIC_ICR) |
+		       (u64)kvm_lapic_get_reg(apic, APIC_ICR2) << 32;
+
+	return kvm_lapic_get_reg64(apic, APIC_ICR);
+}
+
 /* emulate APIC access in a trap manner */
 void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset)
 {
@@ -2456,7 +2494,7 @@
 	 * maybe-unecessary write, and both are in the noise anyways.
 	 */
 	if (apic_x2apic_mode(apic) && offset == APIC_ICR)
-		kvm_x2apic_icr_write(apic, kvm_lapic_get_reg64(apic, APIC_ICR));
+		WARN_ON_ONCE(kvm_x2apic_icr_write(apic, kvm_x2apic_icr_read(apic)));
 	else
 		kvm_lapic_reg_write(apic, offset, kvm_lapic_get_reg(apic, offset));
 }
@@ -2576,19 +2614,26 @@
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
 
-	if (apic->apicv_active) {
-		/* irr_pending is always true when apicv is activated. */
-		apic->irr_pending = true;
+	/*
+	 * When APICv is enabled, KVM must always search the IRR for a pending
+	 * IRQ, as other vCPUs and devices can set IRR bits even if the vCPU
+	 * isn't running.  If APICv is disabled, KVM _should_ search the IRR
+	 * for a pending IRQ.  But KVM currently doesn't ensure *all* hardware,
+	 * e.g. CPUs and IOMMUs, has seen the change in state, i.e. searching
+	 * the IRR at this time could race with IRQ delivery from hardware that
+	 * still sees APICv as being enabled.
+	 *
+	 * FIXME: Ensure other vCPUs and devices observe the change in APICv
+	 *        state prior to updating KVM's metadata caches, so that KVM
+	 *        can safely search the IRR and set irr_pending accordingly.
+	 */
+	apic->irr_pending = true;
+
+	if (apic->apicv_active)
 		apic->isr_count = 1;
-	} else {
-		/*
-		 * Don't clear irr_pending, searching the IRR can race with
-		 * updates from the CPU as APICv is still active from hardware's
-		 * perspective.  The flag will be cleared as appropriate when
-		 * KVM injects the interrupt.
-		 */
+	else
 		apic->isr_count = count_vectors(apic->regs + APIC_ISR);
-	}
+
 	apic->highest_isr_cache = -1;
 }
 
@@ -2768,7 +2813,8 @@
 		trig_mode = reg & APIC_LVT_LEVEL_TRIGGER;
 
 		r = __apic_accept_irq(apic, mode, vector, 1, trig_mode, NULL);
-		if (r && lvt_type == APIC_LVTPC)
+		if (r && lvt_type == APIC_LVTPC &&
+		    guest_cpuid_is_intel_compatible(apic->vcpu))
 			kvm_lapic_set_reg(apic, APIC_LVTPC, reg | APIC_LVT_MASKED);
 		return r;
 	}
@@ -2929,34 +2975,48 @@
 		struct kvm_lapic_state *s, bool set)
 {
 	if (apic_x2apic_mode(vcpu->arch.apic)) {
+		u32 x2apic_id = kvm_x2apic_id(vcpu->arch.apic);
 		u32 *id = (u32 *)(s->regs + APIC_ID);
 		u32 *ldr = (u32 *)(s->regs + APIC_LDR);
 		u64 icr;
 
 		if (vcpu->kvm->arch.x2apic_format) {
-			if (*id != vcpu->vcpu_id)
+			if (*id != x2apic_id)
 				return -EINVAL;
 		} else {
+			/*
+			 * Ignore the userspace value when setting APIC state.
+			 * KVM's model is that the x2APIC ID is readonly, e.g.
+			 * KVM only supports delivering interrupts to KVM's
+			 * version of the x2APIC ID.  However, for backwards
+			 * compatibility, don't reject attempts to set a
+			 * mismatched ID for userspace that hasn't opted into
+			 * x2apic_format.
+			 */
 			if (set)
-				*id >>= 24;
+				*id = x2apic_id;
 			else
-				*id <<= 24;
+				*id = x2apic_id << 24;
 		}
 
 		/*
 		 * In x2APIC mode, the LDR is fixed and based on the id.  And
-		 * ICR is internally a single 64-bit register, but needs to be
-		 * split to ICR+ICR2 in userspace for backwards compatibility.
+		 * if the ICR is _not_ split, ICR is internally a single 64-bit
+		 * register, but needs to be split to ICR+ICR2 in userspace for
+		 * backwards compatibility.
 		 */
-		if (set) {
-			*ldr = kvm_apic_calc_x2apic_ldr(*id);
+		if (set)
+			*ldr = kvm_apic_calc_x2apic_ldr(x2apic_id);
 
-			icr = __kvm_lapic_get_reg(s->regs, APIC_ICR) |
-			      (u64)__kvm_lapic_get_reg(s->regs, APIC_ICR2) << 32;
-			__kvm_lapic_set_reg64(s->regs, APIC_ICR, icr);
-		} else {
-			icr = __kvm_lapic_get_reg64(s->regs, APIC_ICR);
-			__kvm_lapic_set_reg(s->regs, APIC_ICR2, icr >> 32);
+		if (!kvm_x86_ops.x2apic_icr_is_split) {
+			if (set) {
+				icr = __kvm_lapic_get_reg(s->regs, APIC_ICR) |
+				      (u64)__kvm_lapic_get_reg(s->regs, APIC_ICR2) << 32;
+				__kvm_lapic_set_reg64(s->regs, APIC_ICR, icr);
+			} else {
+				icr = __kvm_lapic_get_reg64(s->regs, APIC_ICR);
+				__kvm_lapic_set_reg(s->regs, APIC_ICR2, icr >> 32);
+			}
 		}
 	}
 
@@ -3148,22 +3208,12 @@
 	return 0;
 }
 
-int kvm_x2apic_icr_write(struct kvm_lapic *apic, u64 data)
-{
-	data &= ~APIC_ICR_BUSY;
-
-	kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32));
-	kvm_lapic_set_reg64(apic, APIC_ICR, data);
-	trace_kvm_apic_write(APIC_ICR, data);
-	return 0;
-}
-
 static int kvm_lapic_msr_read(struct kvm_lapic *apic, u32 reg, u64 *data)
 {
 	u32 low;
 
 	if (reg == APIC_ICR) {
-		*data = kvm_lapic_get_reg64(apic, APIC_ICR);
+		*data = kvm_x2apic_icr_read(apic);
 		return 0;
 	}
 
--- linux-qcom-6.8.0.orig/arch/x86/kvm/mmu/mmu.c
+++ linux-qcom-6.8.0/arch/x86/kvm/mmu/mmu.c
@@ -3126,7 +3126,7 @@
 	if (pud_none(pud) || !pud_present(pud))
 		goto out;
 
-	if (pud_large(pud)) {
+	if (pud_leaf(pud)) {
 		level = PG_LEVEL_1G;
 		goto out;
 	}
@@ -4490,6 +4490,7 @@
 
 static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)
 {
+	kvm_pfn_t orig_pfn;
 	int r;
 
 	/* Dummy roots are used only for shadowing bad guest roots. */
@@ -4511,6 +4512,8 @@
 	if (r != RET_PF_CONTINUE)
 		return r;
 
+	orig_pfn = fault->pfn;
+
 	r = RET_PF_RETRY;
 	write_lock(&vcpu->kvm->mmu_lock);
 
@@ -4525,7 +4528,7 @@
 
 out_unlock:
 	write_unlock(&vcpu->kvm->mmu_lock);
-	kvm_release_pfn_clean(fault->pfn);
+	kvm_release_pfn_clean(orig_pfn);
 	return r;
 }
 
@@ -4574,6 +4577,7 @@
 static int kvm_tdp_mmu_page_fault(struct kvm_vcpu *vcpu,
 				  struct kvm_page_fault *fault)
 {
+	kvm_pfn_t orig_pfn;
 	int r;
 
 	if (page_fault_handle_page_track(vcpu, fault))
@@ -4591,6 +4595,8 @@
 	if (r != RET_PF_CONTINUE)
 		return r;
 
+	orig_pfn = fault->pfn;
+
 	r = RET_PF_RETRY;
 	read_lock(&vcpu->kvm->mmu_lock);
 
@@ -4601,7 +4607,7 @@
 
 out_unlock:
 	read_unlock(&vcpu->kvm->mmu_lock);
-	kvm_release_pfn_clean(fault->pfn);
+	kvm_release_pfn_clean(orig_pfn);
 	return r;
 }
 #endif
@@ -4922,7 +4928,7 @@
 				context->cpu_role.base.level, is_efer_nx(context),
 				guest_can_use(vcpu, X86_FEATURE_GBPAGES),
 				is_cr4_pse(context),
-				guest_cpuid_is_amd_or_hygon(vcpu));
+				guest_cpuid_is_amd_compatible(vcpu));
 }
 
 static void __reset_rsvds_bits_mask_ept(struct rsvd_bits_validate *rsvd_check,
@@ -6929,6 +6935,19 @@
 	kmem_cache_destroy(mmu_page_header_cache);
 }
 
+static void kvm_wake_nx_recovery_thread(struct kvm *kvm)
+{
+	/*
+	 * The NX recovery thread is spawned on-demand at the first KVM_RUN and
+	 * may not be valid even though the VM is globally visible.  Do nothing,
+	 * as such a VM can't have any possible NX huge pages.
+	 */
+	struct vhost_task *nx_thread = READ_ONCE(kvm->arch.nx_huge_page_recovery_thread);
+
+	if (nx_thread)
+		vhost_task_wake(nx_thread);
+}
+
 static int get_nx_huge_pages(char *buffer, const struct kernel_param *kp)
 {
 	if (nx_hugepage_mitigation_hard_disabled)
@@ -6989,7 +7008,7 @@
 			kvm_mmu_zap_all_fast(kvm);
 			mutex_unlock(&kvm->slots_lock);
 
-			wake_up_process(kvm->arch.nx_huge_page_recovery_thread);
+			kvm_wake_nx_recovery_thread(kvm);
 		}
 		mutex_unlock(&kvm_lock);
 	}
@@ -7137,7 +7156,7 @@
 		mutex_lock(&kvm_lock);
 
 		list_for_each_entry(kvm, &vm_list, vm_list)
-			wake_up_process(kvm->arch.nx_huge_page_recovery_thread);
+			kvm_wake_nx_recovery_thread(kvm);
 
 		mutex_unlock(&kvm_lock);
 	}
@@ -7240,62 +7259,68 @@
 	srcu_read_unlock(&kvm->srcu, rcu_idx);
 }
 
-static long get_nx_huge_page_recovery_timeout(u64 start_time)
+static void kvm_nx_huge_page_recovery_worker_kill(void *data)
+{
+}
+
+static bool kvm_nx_huge_page_recovery_worker(void *data)
 {
+	struct kvm *kvm = data;
 	bool enabled;
 	uint period;
+	long remaining_time;
 
 	enabled = calc_nx_huge_pages_recovery_period(&period);
+	if (!enabled)
+		return false;
 
-	return enabled ? start_time + msecs_to_jiffies(period) - get_jiffies_64()
-		       : MAX_SCHEDULE_TIMEOUT;
+	remaining_time = kvm->arch.nx_huge_page_last + msecs_to_jiffies(period)
+		- get_jiffies_64();
+	if (remaining_time > 0) {
+		schedule_timeout(remaining_time);
+		/* check for signals and come back */
+		return true;
+	}
+
+	__set_current_state(TASK_RUNNING);
+	kvm_recover_nx_huge_pages(kvm);
+	kvm->arch.nx_huge_page_last = get_jiffies_64();
+	return true;
 }
 
-static int kvm_nx_huge_page_recovery_worker(struct kvm *kvm, uintptr_t data)
+static int kvm_mmu_start_lpage_recovery(struct once *once)
 {
-	u64 start_time;
-	long remaining_time;
+	struct kvm_arch *ka = container_of(once, struct kvm_arch, nx_once);
+	struct kvm *kvm = container_of(ka, struct kvm, arch);
+	struct vhost_task *nx_thread;
 
-	while (true) {
-		start_time = get_jiffies_64();
-		remaining_time = get_nx_huge_page_recovery_timeout(start_time);
-
-		set_current_state(TASK_INTERRUPTIBLE);
-		while (!kthread_should_stop() && remaining_time > 0) {
-			schedule_timeout(remaining_time);
-			remaining_time = get_nx_huge_page_recovery_timeout(start_time);
-			set_current_state(TASK_INTERRUPTIBLE);
-		}
+	kvm->arch.nx_huge_page_last = get_jiffies_64();
+	nx_thread = vhost_task_create(kvm_nx_huge_page_recovery_worker,
+				      kvm_nx_huge_page_recovery_worker_kill,
+				      kvm, "kvm-nx-lpage-recovery");
 
-		set_current_state(TASK_RUNNING);
+	if (IS_ERR(nx_thread))
+		return PTR_ERR(nx_thread);
 
-		if (kthread_should_stop())
-			return 0;
+	vhost_task_start(nx_thread);
 
-		kvm_recover_nx_huge_pages(kvm);
-	}
+	/* Make the task visible only once it is fully started. */
+	WRITE_ONCE(kvm->arch.nx_huge_page_recovery_thread, nx_thread);
+	return 0;
 }
 
 int kvm_mmu_post_init_vm(struct kvm *kvm)
 {
-	int err;
-
 	if (nx_hugepage_mitigation_hard_disabled)
 		return 0;
 
-	err = kvm_vm_create_worker_thread(kvm, kvm_nx_huge_page_recovery_worker, 0,
-					  "kvm-nx-lpage-recovery",
-					  &kvm->arch.nx_huge_page_recovery_thread);
-	if (!err)
-		kthread_unpark(kvm->arch.nx_huge_page_recovery_thread);
-
-	return err;
+	return call_once(&kvm->arch.nx_once, kvm_mmu_start_lpage_recovery);
 }
 
 void kvm_mmu_pre_destroy_vm(struct kvm *kvm)
 {
 	if (kvm->arch.nx_huge_page_recovery_thread)
-		kthread_stop(kvm->arch.nx_huge_page_recovery_thread);
+		vhost_task_stop(kvm->arch.nx_huge_page_recovery_thread);
 }
 
 #ifdef CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES
@@ -7388,7 +7413,8 @@
 			 * by the memslot, KVM can't use a hugepage due to the
 			 * misaligned address regardless of memory attributes.
 			 */
-			if (gfn >= slot->base_gfn) {
+			if (gfn >= slot->base_gfn &&
+			    gfn + nr_pages <= slot->base_gfn + slot->npages) {
 				if (hugepage_has_attrs(kvm, slot, gfn, level, attrs))
 					hugepage_clear_mixed(slot, gfn, level);
 				else
--- linux-qcom-6.8.0.orig/arch/x86/kvm/mmu/paging_tmpl.h
+++ linux-qcom-6.8.0/arch/x86/kvm/mmu/paging_tmpl.h
@@ -777,6 +777,7 @@
 static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)
 {
 	struct guest_walker walker;
+	kvm_pfn_t orig_pfn;
 	int r;
 
 	WARN_ON_ONCE(fault->is_tdp);
@@ -835,6 +836,8 @@
 			walker.pte_access &= ~ACC_EXEC_MASK;
 	}
 
+	orig_pfn = fault->pfn;
+
 	r = RET_PF_RETRY;
 	write_lock(&vcpu->kvm->mmu_lock);
 
@@ -848,7 +851,7 @@
 
 out_unlock:
 	write_unlock(&vcpu->kvm->mmu_lock);
-	kvm_release_pfn_clean(fault->pfn);
+	kvm_release_pfn_clean(orig_pfn);
 	return r;
 }
 
--- linux-qcom-6.8.0.orig/arch/x86/kvm/mmu/spte.c
+++ linux-qcom-6.8.0/arch/x86/kvm/mmu/spte.c
@@ -206,12 +206,20 @@
 		spte |= PT_WRITABLE_MASK | shadow_mmu_writable_mask;
 
 		/*
-		 * Optimization: for pte sync, if spte was writable the hash
-		 * lookup is unnecessary (and expensive). Write protection
-		 * is responsibility of kvm_mmu_get_page / kvm_mmu_sync_roots.
-		 * Same reasoning can be applied to dirty page accounting.
+		 * When overwriting an existing leaf SPTE, and the old SPTE was
+		 * writable, skip trying to unsync shadow pages as any relevant
+		 * shadow pages must already be unsync, i.e. the hash lookup is
+		 * unnecessary (and expensive).
+		 *
+		 * The same reasoning applies to dirty page/folio accounting;
+		 * KVM will mark the folio dirty using the old SPTE, thus
+		 * there's no need to immediately mark the new SPTE as dirty.
+		 *
+		 * Note, both cases rely on KVM not changing PFNs without first
+		 * zapping the old SPTE, which is guaranteed by both the shadow
+		 * MMU and the TDP MMU.
 		 */
-		if (is_writable_pte(old_spte))
+		if (is_last_spte(old_spte, level) && is_writable_pte(old_spte))
 			goto out;
 
 		/*
--- linux-qcom-6.8.0.orig/arch/x86/kvm/mmu/tdp_mmu.c
+++ linux-qcom-6.8.0/arch/x86/kvm/mmu/tdp_mmu.c
@@ -1498,6 +1498,16 @@
 	}
 }
 
+static bool tdp_mmu_need_write_protect(struct kvm_mmu_page *sp)
+{
+	/*
+	 * All TDP MMU shadow pages share the same role as their root, aside
+	 * from level, so it is valid to key off any shadow page to determine if
+	 * write protection is needed for an entire tree.
+	 */
+	return kvm_mmu_page_ad_need_write_protect(sp) || !kvm_ad_enabled();
+}
+
 /*
  * Clear the dirty status of all the SPTEs mapping GFNs in the memslot. If
  * AD bits are enabled, this will involve clearing the dirty bit on each SPTE.
@@ -1508,7 +1518,8 @@
 static bool clear_dirty_gfn_range(struct kvm *kvm, struct kvm_mmu_page *root,
 			   gfn_t start, gfn_t end)
 {
-	u64 dbit = kvm_ad_enabled() ? shadow_dirty_mask : PT_WRITABLE_MASK;
+	const u64 dbit = tdp_mmu_need_write_protect(root) ? PT_WRITABLE_MASK :
+							    shadow_dirty_mask;
 	struct tdp_iter iter;
 	bool spte_set = false;
 
@@ -1523,7 +1534,7 @@
 		if (tdp_mmu_iter_cond_resched(kvm, &iter, false, true))
 			continue;
 
-		KVM_MMU_WARN_ON(kvm_ad_enabled() &&
+		KVM_MMU_WARN_ON(dbit == shadow_dirty_mask &&
 				spte_ad_need_write_protect(iter.old_spte));
 
 		if (!(iter.old_spte & dbit))
@@ -1570,8 +1581,8 @@
 static void clear_dirty_pt_masked(struct kvm *kvm, struct kvm_mmu_page *root,
 				  gfn_t gfn, unsigned long mask, bool wrprot)
 {
-	u64 dbit = (wrprot || !kvm_ad_enabled()) ? PT_WRITABLE_MASK :
-						   shadow_dirty_mask;
+	const u64 dbit = (wrprot || tdp_mmu_need_write_protect(root)) ? PT_WRITABLE_MASK :
+									shadow_dirty_mask;
 	struct tdp_iter iter;
 
 	lockdep_assert_held_write(&kvm->mmu_lock);
@@ -1583,7 +1594,7 @@
 		if (!mask)
 			break;
 
-		KVM_MMU_WARN_ON(kvm_ad_enabled() &&
+		KVM_MMU_WARN_ON(dbit == shadow_dirty_mask &&
 				spte_ad_need_write_protect(iter.old_spte));
 
 		if (iter.level > PG_LEVEL_4K ||
--- linux-qcom-6.8.0.orig/arch/x86/kvm/pmu.c
+++ linux-qcom-6.8.0/arch/x86/kvm/pmu.c
@@ -741,6 +741,8 @@
  */
 void kvm_pmu_refresh(struct kvm_vcpu *vcpu)
 {
+	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+
 	if (KVM_BUG_ON(kvm_vcpu_has_run(vcpu), vcpu->kvm))
 		return;
 
@@ -750,8 +752,34 @@
 	 */
 	kvm_pmu_reset(vcpu);
 
-	bitmap_zero(vcpu_to_pmu(vcpu)->all_valid_pmc_idx, X86_PMC_IDX_MAX);
+	pmu->version = 0;
+	pmu->nr_arch_gp_counters = 0;
+	pmu->nr_arch_fixed_counters = 0;
+	pmu->counter_bitmask[KVM_PMC_GP] = 0;
+	pmu->counter_bitmask[KVM_PMC_FIXED] = 0;
+	pmu->reserved_bits = 0xffffffff00200000ull;
+	pmu->raw_event_mask = X86_RAW_EVENT_MASK;
+	pmu->global_ctrl_mask = ~0ull;
+	pmu->global_status_mask = ~0ull;
+	pmu->fixed_ctr_ctrl_mask = ~0ull;
+	pmu->pebs_enable_mask = ~0ull;
+	pmu->pebs_data_cfg_mask = ~0ull;
+	bitmap_zero(pmu->all_valid_pmc_idx, X86_PMC_IDX_MAX);
+
+	if (!vcpu->kvm->arch.enable_pmu)
+		return;
+
 	static_call(kvm_x86_pmu_refresh)(vcpu);
+
+	/*
+	 * At RESET, both Intel and AMD CPUs set all enable bits for general
+	 * purpose counters in IA32_PERF_GLOBAL_CTRL (so that software that
+	 * was written for v1 PMUs don't unknowingly leave GP counters disabled
+	 * in the global controls).  Emulate that behavior when refreshing the
+	 * PMU so that userspace doesn't need to manually set PERF_GLOBAL_CTRL.
+	 */
+	if (kvm_pmu_has_perf_global_ctrl(pmu) && pmu->nr_arch_gp_counters)
+		pmu->global_ctrl = GENMASK_ULL(pmu->nr_arch_gp_counters - 1, 0);
 }
 
 void kvm_pmu_init(struct kvm_vcpu *vcpu)
--- linux-qcom-6.8.0.orig/arch/x86/kvm/reverse_cpuid.h
+++ linux-qcom-6.8.0/arch/x86/kvm/reverse_cpuid.h
@@ -52,7 +52,7 @@
 #define X86_FEATURE_IPRED_CTRL		KVM_X86_FEATURE(CPUID_7_2_EDX, 1)
 #define KVM_X86_FEATURE_RRSBA_CTRL	KVM_X86_FEATURE(CPUID_7_2_EDX, 2)
 #define X86_FEATURE_DDPD_U		KVM_X86_FEATURE(CPUID_7_2_EDX, 3)
-#define X86_FEATURE_BHI_CTRL		KVM_X86_FEATURE(CPUID_7_2_EDX, 4)
+#define KVM_X86_FEATURE_BHI_CTRL	KVM_X86_FEATURE(CPUID_7_2_EDX, 4)
 #define X86_FEATURE_MCDT_NO		KVM_X86_FEATURE(CPUID_7_2_EDX, 5)
 
 /* CPUID level 0x80000007 (EDX). */
@@ -102,10 +102,12 @@
  */
 static __always_inline void reverse_cpuid_check(unsigned int x86_leaf)
 {
+	BUILD_BUG_ON(NR_CPUID_WORDS != NCAPINTS);
 	BUILD_BUG_ON(x86_leaf == CPUID_LNX_1);
 	BUILD_BUG_ON(x86_leaf == CPUID_LNX_2);
 	BUILD_BUG_ON(x86_leaf == CPUID_LNX_3);
 	BUILD_BUG_ON(x86_leaf == CPUID_LNX_4);
+	BUILD_BUG_ON(x86_leaf == CPUID_LNX_5);
 	BUILD_BUG_ON(x86_leaf >= ARRAY_SIZE(reverse_cpuid));
 	BUILD_BUG_ON(reverse_cpuid[x86_leaf].function == 0);
 }
@@ -126,6 +128,7 @@
 	KVM_X86_TRANSLATE_FEATURE(CONSTANT_TSC);
 	KVM_X86_TRANSLATE_FEATURE(PERFMON_V2);
 	KVM_X86_TRANSLATE_FEATURE(RRSBA_CTRL);
+	KVM_X86_TRANSLATE_FEATURE(BHI_CTRL);
 	default:
 		return x86_feature;
 	}
--- linux-qcom-6.8.0.orig/arch/x86/kvm/svm/nested.c
+++ linux-qcom-6.8.0/arch/x86/kvm/svm/nested.c
@@ -63,8 +63,12 @@
 	u64 pdpte;
 	int ret;
 
+	/*
+	 * Note, nCR3 is "assumed" to be 32-byte aligned, i.e. the CPU ignores
+	 * nCR3[4:0] when loading PDPTEs from memory.
+	 */
 	ret = kvm_vcpu_read_guest_page(vcpu, gpa_to_gfn(cr3), &pdpte,
-				       offset_in_page(cr3) + index * 8, 8);
+				       (cr3 & GENMASK(11, 5)) + index * 8, 8);
 	if (ret)
 		return 0;
 	return pdpte;
--- linux-qcom-6.8.0.orig/arch/x86/kvm/svm/sev.c
+++ linux-qcom-6.8.0/arch/x86/kvm/svm/sev.c
@@ -84,9 +84,10 @@
 };
 
 /* Called with the sev_bitmap_lock held, or on shutdown  */
-static int sev_flush_asids(int min_asid, int max_asid)
+static int sev_flush_asids(unsigned int min_asid, unsigned int max_asid)
 {
-	int ret, asid, error = 0;
+	int ret, error = 0;
+	unsigned int asid;
 
 	/* Check if there are any ASIDs to reclaim before performing a flush */
 	asid = find_next_bit(sev_reclaim_asid_bitmap, nr_asids, min_asid);
@@ -116,7 +117,7 @@
 }
 
 /* Must be called with the sev_bitmap_lock held */
-static bool __sev_recycle_asids(int min_asid, int max_asid)
+static bool __sev_recycle_asids(unsigned int min_asid, unsigned int max_asid)
 {
 	if (sev_flush_asids(min_asid, max_asid))
 		return false;
@@ -143,8 +144,20 @@
 
 static int sev_asid_new(struct kvm_sev_info *sev)
 {
-	int asid, min_asid, max_asid, ret;
+	/*
+	 * SEV-enabled guests must use asid from min_sev_asid to max_sev_asid.
+	 * SEV-ES-enabled guest can use from 1 to min_sev_asid - 1.
+	 * Note: min ASID can end up larger than the max if basic SEV support is
+	 * effectively disabled by disallowing use of ASIDs for SEV guests.
+	 */
+	unsigned int min_asid = sev->es_active ? 1 : min_sev_asid;
+	unsigned int max_asid = sev->es_active ? min_sev_asid - 1 : max_sev_asid;
+	unsigned int asid;
 	bool retry = true;
+	int ret;
+
+	if (min_asid > max_asid)
+		return -ENOTTY;
 
 	WARN_ON(sev->misc_cg);
 	sev->misc_cg = get_current_misc_cg();
@@ -157,12 +170,6 @@
 
 	mutex_lock(&sev_bitmap_lock);
 
-	/*
-	 * SEV-enabled guests must use asid from min_sev_asid to max_sev_asid.
-	 * SEV-ES-enabled guest can use from 1 to min_sev_asid - 1.
-	 */
-	min_asid = sev->es_active ? 1 : min_sev_asid;
-	max_asid = sev->es_active ? min_sev_asid - 1 : max_sev_asid;
 again:
 	asid = find_next_zero_bit(sev_asid_bitmap, max_asid + 1, min_asid);
 	if (asid > max_asid) {
@@ -187,7 +194,7 @@
 	return ret;
 }
 
-static int sev_get_asid(struct kvm *kvm)
+static unsigned int sev_get_asid(struct kvm *kvm)
 {
 	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
 
@@ -284,8 +291,8 @@
 
 static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error)
 {
+	unsigned int asid = sev_get_asid(kvm);
 	struct sev_data_activate activate;
-	int asid = sev_get_asid(kvm);
 	int ret;
 
 	/* activate ASID on the given handle */
@@ -657,6 +664,14 @@
 	  return ret;
 
 	vcpu->arch.guest_state_protected = true;
+
+	/*
+	 * SEV-ES guest mandates LBR Virtualization to be _always_ ON. Enable it
+	 * only after setting guest_state_protected because KVM_SET_MSRS allows
+	 * dynamic toggling of LBRV (for performance reason) on write access to
+	 * MSR_IA32_DEBUGCTLMSR when guest_state_protected is not set.
+	 */
+	svm_enable_lbrv(vcpu);
 	return 0;
 }
 
@@ -2237,8 +2252,10 @@
 		goto out;
 	}
 
-	sev_asid_count = max_sev_asid - min_sev_asid + 1;
-	WARN_ON_ONCE(misc_cg_set_capacity(MISC_CG_RES_SEV, sev_asid_count));
+	if (min_sev_asid <= max_sev_asid) {
+		sev_asid_count = max_sev_asid - min_sev_asid + 1;
+		WARN_ON_ONCE(misc_cg_set_capacity(MISC_CG_RES_SEV, sev_asid_count));
+	}
 	sev_supported = true;
 
 	/* SEV-ES support requested? */
@@ -2258,6 +2275,12 @@
 	if (!boot_cpu_has(X86_FEATURE_SEV_ES))
 		goto out;
 
+	if (!lbrv) {
+		WARN_ONCE(!boot_cpu_has(X86_FEATURE_LBRV),
+			  "LBRV must be present for SEV-ES support");
+		goto out;
+	}
+
 	/* Has the system been allocated ASIDs for SEV-ES? */
 	if (min_sev_asid == 1)
 		goto out;
@@ -2269,7 +2292,9 @@
 out:
 	if (boot_cpu_has(X86_FEATURE_SEV))
 		pr_info("SEV %s (ASIDs %u - %u)\n",
-			sev_supported ? "enabled" : "disabled",
+			sev_supported ? min_sev_asid <= max_sev_asid ? "enabled" :
+								       "unusable" :
+								       "disabled",
 			min_sev_asid, max_sev_asid);
 	if (boot_cpu_has(X86_FEATURE_SEV_ES))
 		pr_info("SEV-ES %s (ASIDs %u - %u)\n",
@@ -2317,7 +2342,7 @@
  */
 static void sev_flush_encrypted_page(struct kvm_vcpu *vcpu, void *va)
 {
-	int asid = to_kvm_svm(vcpu->kvm)->sev_info.asid;
+	unsigned int asid = sev_get_asid(vcpu->kvm);
 
 	/*
 	 * Note!  The address must be a kernel address, as regular page walk
@@ -2635,7 +2660,7 @@
 void pre_sev_run(struct vcpu_svm *svm, int cpu)
 {
 	struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, cpu);
-	int asid = sev_get_asid(svm->vcpu.kvm);
+	unsigned int asid = sev_get_asid(svm->vcpu.kvm);
 
 	/* Assign the asid allocated with this SEV guest */
 	svm->asid = asid;
@@ -3021,7 +3046,6 @@
 	struct kvm_vcpu *vcpu = &svm->vcpu;
 
 	svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ES_ENABLE;
-	svm->vmcb->control.virt_ext |= LBR_CTL_ENABLE_MASK;
 
 	/*
 	 * An SEV-ES guest requires a VMSA area that is a separate from the
@@ -3073,10 +3097,6 @@
 	/* Clear intercepts on selected MSRs */
 	set_msr_interception(vcpu, svm->msrpm, MSR_EFER, 1, 1);
 	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_CR_PAT, 1, 1);
-	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHFROMIP, 1, 1);
-	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHTOIP, 1, 1);
-	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTINTFROMIP, 1, 1);
-	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTINTTOIP, 1, 1);
 }
 
 void sev_init_vmcb(struct vcpu_svm *svm)
--- linux-qcom-6.8.0.orig/arch/x86/kvm/svm/svm.c
+++ linux-qcom-6.8.0/arch/x86/kvm/svm/svm.c
@@ -99,6 +99,7 @@
 	{ .index = MSR_IA32_SPEC_CTRL,			.always = false },
 	{ .index = MSR_IA32_PRED_CMD,			.always = false },
 	{ .index = MSR_IA32_FLUSH_CMD,			.always = false },
+	{ .index = MSR_IA32_DEBUGCTLMSR,		.always = false },
 	{ .index = MSR_IA32_LASTBRANCHFROMIP,		.always = false },
 	{ .index = MSR_IA32_LASTBRANCHTOIP,		.always = false },
 	{ .index = MSR_IA32_LASTINTFROMIP,		.always = false },
@@ -215,7 +216,7 @@
 module_param(vgif, int, 0444);
 
 /* enable/disable LBR virtualization */
-static int lbrv = true;
+int lbrv = true;
 module_param(lbrv, int, 0444);
 
 static int tsc_scaling = true;
@@ -990,7 +991,7 @@
 	vmcb_mark_dirty(to_vmcb, VMCB_LBR);
 }
 
-static void svm_enable_lbrv(struct kvm_vcpu *vcpu)
+void svm_enable_lbrv(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 
@@ -1000,6 +1001,9 @@
 	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTINTFROMIP, 1, 1);
 	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTINTTOIP, 1, 1);
 
+	if (sev_es_guest(vcpu->kvm))
+		set_msr_interception(vcpu, svm->msrpm, MSR_IA32_DEBUGCTLMSR, 1, 1);
+
 	/* Move the LBR msrs to the vmcb02 so that the guest can see them. */
 	if (is_guest_mode(vcpu))
 		svm_copy_lbrs(svm->vmcb, svm->vmcb01.ptr);
@@ -1009,6 +1013,8 @@
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 
+	KVM_BUG_ON(sev_es_guest(vcpu->kvm), vcpu->kvm);
+
 	svm->vmcb->control.virt_ext &= ~LBR_CTL_ENABLE_MASK;
 	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHFROMIP, 0, 0);
 	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHTOIP, 0, 0);
@@ -2844,6 +2850,12 @@
 	case MSR_CSTAR:
 		msr_info->data = svm->vmcb01.ptr->save.cstar;
 		break;
+	case MSR_GS_BASE:
+		msr_info->data = svm->vmcb01.ptr->save.gs.base;
+		break;
+	case MSR_FS_BASE:
+		msr_info->data = svm->vmcb01.ptr->save.fs.base;
+		break;
 	case MSR_KERNEL_GS_BASE:
 		msr_info->data = svm->vmcb01.ptr->save.kernel_gs_base;
 		break;
@@ -3065,6 +3077,12 @@
 	case MSR_CSTAR:
 		svm->vmcb01.ptr->save.cstar = data;
 		break;
+	case MSR_GS_BASE:
+		svm->vmcb01.ptr->save.gs.base = data;
+		break;
+	case MSR_FS_BASE:
+		svm->vmcb01.ptr->save.fs.base = data;
+		break;
 	case MSR_KERNEL_GS_BASE:
 		svm->vmcb01.ptr->save.kernel_gs_base = data;
 		break;
@@ -3845,16 +3863,27 @@
 	struct vcpu_svm *svm = to_svm(vcpu);
 
 	/*
-	 * KVM should never request an NMI window when vNMI is enabled, as KVM
-	 * allows at most one to-be-injected NMI and one pending NMI, i.e. if
-	 * two NMIs arrive simultaneously, KVM will inject one and set
-	 * V_NMI_PENDING for the other.  WARN, but continue with the standard
-	 * single-step approach to try and salvage the pending NMI.
+	 * If NMIs are outright masked, i.e. the vCPU is already handling an
+	 * NMI, and KVM has not yet intercepted an IRET, then there is nothing
+	 * more to do at this time as KVM has already enabled IRET intercepts.
+	 * If KVM has already intercepted IRET, then single-step over the IRET,
+	 * as NMIs aren't architecturally unmasked until the IRET completes.
+	 *
+	 * If vNMI is enabled, KVM should never request an NMI window if NMIs
+	 * are masked, as KVM allows at most one to-be-injected NMI and one
+	 * pending NMI.  If two NMIs arrive simultaneously, KVM will inject one
+	 * NMI and set V_NMI_PENDING for the other, but if and only if NMIs are
+	 * unmasked.  KVM _will_ request an NMI window in some situations, e.g.
+	 * if the vCPU is in an STI shadow or if GIF=0, KVM can't immediately
+	 * inject the NMI.  In those situations, KVM needs to single-step over
+	 * the STI shadow or intercept STGI.
 	 */
-	WARN_ON_ONCE(is_vnmi_enabled(svm));
+	if (svm_get_nmi_mask(vcpu)) {
+		WARN_ON_ONCE(is_vnmi_enabled(svm));
 
-	if (svm_get_nmi_mask(vcpu) && !svm->awaiting_iret_completion)
-		return; /* IRET will cause a vm exit */
+		if (!svm->awaiting_iret_completion)
+			return; /* IRET will cause a vm exit */
+	}
 
 	/*
 	 * SEV-ES guests are responsible for signaling when a vCPU is ready to
@@ -4976,6 +5005,8 @@
 	.enable_nmi_window = svm_enable_nmi_window,
 	.enable_irq_window = svm_enable_irq_window,
 	.update_cr8_intercept = svm_update_cr8_intercept,
+
+	.x2apic_icr_is_split = true,
 	.set_virtual_apic_mode = avic_refresh_virtual_apic_mode,
 	.refresh_apicv_exec_ctrl = avic_refresh_apicv_exec_ctrl,
 	.apicv_post_state_restore = avic_apicv_post_state_restore,
@@ -5147,6 +5178,9 @@
 
 	/* CPUID 0x8000001F (SME/SEV features) */
 	sev_set_cpu_caps();
+
+	/* Don't advertise Bus Lock Detect to guest if SVM support is absent */
+	kvm_cpu_cap_clear(X86_FEATURE_BUS_LOCK_DETECT);
 }
 
 static __init int svm_hardware_setup(void)
@@ -5236,6 +5270,12 @@
 
 	nrips = nrips && boot_cpu_has(X86_FEATURE_NRIPS);
 
+	if (lbrv) {
+		if (!boot_cpu_has(X86_FEATURE_LBRV))
+			lbrv = false;
+		else
+			pr_info("LBR virtualization supported\n");
+	}
 	/*
 	 * Note, SEV setup consumes npt_enabled and enable_mmio_caching (which
 	 * may be modified by svm_adjust_mmio_mask()), as well as nrips.
@@ -5289,14 +5329,6 @@
 		svm_x86_ops.set_vnmi_pending = NULL;
 	}
 
-
-	if (lbrv) {
-		if (!boot_cpu_has(X86_FEATURE_LBRV))
-			lbrv = false;
-		else
-			pr_info("LBR virtualization supported\n");
-	}
-
 	if (!enable_pmu)
 		pr_info("PMU virtualization is disabled\n");
 
--- linux-qcom-6.8.0.orig/arch/x86/kvm/svm/svm.h
+++ linux-qcom-6.8.0/arch/x86/kvm/svm/svm.h
@@ -30,7 +30,7 @@
 #define	IOPM_SIZE PAGE_SIZE * 3
 #define	MSRPM_SIZE PAGE_SIZE * 2
 
-#define MAX_DIRECT_ACCESS_MSRS	47
+#define MAX_DIRECT_ACCESS_MSRS	48
 #define MSRPM_OFFSETS	32
 extern u32 msrpm_offsets[MSRPM_OFFSETS] __read_mostly;
 extern bool npt_enabled;
@@ -39,6 +39,7 @@
 extern bool intercept_smi;
 extern bool x2avic_enabled;
 extern bool vnmi;
+extern int lbrv;
 
 /*
  * Clean bits in VMCB.
@@ -543,6 +544,7 @@
 void svm_vcpu_init_msrpm(struct kvm_vcpu *vcpu, u32 *msrpm);
 void svm_vcpu_free_msrpm(u32 *msrpm);
 void svm_copy_lbrs(struct vmcb *to_vmcb, struct vmcb *from_vmcb);
+void svm_enable_lbrv(struct kvm_vcpu *vcpu);
 void svm_update_lbrv(struct kvm_vcpu *vcpu);
 
 int svm_set_efer(struct kvm_vcpu *vcpu, u64 efer);
--- linux-qcom-6.8.0.orig/arch/x86/kvm/trace.h
+++ linux-qcom-6.8.0/arch/x86/kvm/trace.h
@@ -732,13 +732,13 @@
  * Tracepoint for nested #vmexit because of interrupt pending
  */
 TRACE_EVENT(kvm_invlpga,
-	    TP_PROTO(__u64 rip, int asid, u64 address),
+	    TP_PROTO(__u64 rip, unsigned int asid, u64 address),
 	    TP_ARGS(rip, asid, address),
 
 	TP_STRUCT__entry(
-		__field(	__u64,	rip	)
-		__field(	int,	asid	)
-		__field(	__u64,	address	)
+		__field(	__u64,		rip	)
+		__field(	unsigned int,	asid	)
+		__field(	__u64,		address	)
 	),
 
 	TP_fast_assign(
@@ -747,7 +747,7 @@
 		__entry->address	=	address;
 	),
 
-	TP_printk("rip: 0x%016llx asid: %d address: 0x%016llx",
+	TP_printk("rip: 0x%016llx asid: %u address: 0x%016llx",
 		  __entry->rip, __entry->asid, __entry->address)
 );
 
--- linux-qcom-6.8.0.orig/arch/x86/kvm/vmx/nested.c
+++ linux-qcom-6.8.0/arch/x86/kvm/vmx/nested.c
@@ -12,6 +12,7 @@
 #include "mmu.h"
 #include "nested.h"
 #include "pmu.h"
+#include "posted_intr.h"
 #include "sgx.h"
 #include "trace.h"
 #include "vmx.h"
@@ -1174,11 +1175,14 @@
 	kvm_hv_nested_transtion_tlb_flush(vcpu, enable_ept);
 
 	/*
-	 * If vmcs12 doesn't use VPID, L1 expects linear and combined mappings
-	 * for *all* contexts to be flushed on VM-Enter/VM-Exit, i.e. it's a
-	 * full TLB flush from the guest's perspective.  This is required even
-	 * if VPID is disabled in the host as KVM may need to synchronize the
-	 * MMU in response to the guest TLB flush.
+	 * If VPID is disabled, then guest TLB accesses use VPID=0, i.e. the
+	 * same VPID as the host, and so architecturally, linear and combined
+	 * mappings for VPID=0 must be flushed at VM-Enter and VM-Exit.  KVM
+	 * emulates L2 sharing L1's VPID=0 by using vpid01 while running L2,
+	 * and so KVM must also emulate TLB flush of VPID=0, i.e. vpid01.  This
+	 * is required if VPID is disabled in KVM, as a TLB flush (there are no
+	 * VPIDs) still occurs from L1's perspective, and KVM may need to
+	 * synchronize the MMU in response to the guest TLB flush.
 	 *
 	 * Note, using TLB_FLUSH_GUEST is correct even if nested EPT is in use.
 	 * EPT is a special snowflake, as guest-physical mappings aren't
@@ -2265,6 +2269,17 @@
 
 	vmcs_write64(VMCS_LINK_POINTER, INVALID_GPA);
 
+	/*
+	 * If VPID is disabled, then guest TLB accesses use VPID=0, i.e. the
+	 * same VPID as the host.  Emulate this behavior by using vpid01 for L2
+	 * if VPID is disabled in vmcs12.  Note, if VPID is disabled, VM-Enter
+	 * and VM-Exit are architecturally required to flush VPID=0, but *only*
+	 * VPID=0.  I.e. using vpid02 would be ok (so long as KVM emulates the
+	 * required flushes), but doing so would cause KVM to over-flush.  E.g.
+	 * if L1 runs L2 X with VPID12=1, then runs L2 Y with VPID12 disabled,
+	 * and then runs L2 X again, then KVM can and should retain TLB entries
+	 * for VPID12=1.
+	 */
 	if (enable_vpid) {
 		if (nested_cpu_has_vpid(vmcs12) && vmx->nested.vpid02)
 			vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->nested.vpid02);
@@ -3874,8 +3889,8 @@
 	if (!pi_test_and_clear_on(vmx->nested.pi_desc))
 		return 0;
 
-	max_irr = find_last_bit((unsigned long *)vmx->nested.pi_desc->pir, 256);
-	if (max_irr != 256) {
+	max_irr = pi_find_highest_vector(vmx->nested.pi_desc);
+	if (max_irr > 0) {
 		vapic_page = vmx->nested.virtual_apic_map.hva;
 		if (!vapic_page)
 			goto mmio_needed;
@@ -4006,10 +4021,42 @@
 	       to_vmx(vcpu)->nested.preemption_timer_expired;
 }
 
-static bool vmx_has_nested_events(struct kvm_vcpu *vcpu)
+static bool vmx_has_nested_events(struct kvm_vcpu *vcpu, bool for_injection)
 {
-	return nested_vmx_preemption_timer_pending(vcpu) ||
-	       to_vmx(vcpu)->nested.mtf_pending;
+	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	void *vapic = vmx->nested.virtual_apic_map.hva;
+	int max_irr, vppr;
+
+	if (nested_vmx_preemption_timer_pending(vcpu) ||
+	    vmx->nested.mtf_pending)
+		return true;
+
+	/*
+	 * Virtual Interrupt Delivery doesn't require manual injection.  Either
+	 * the interrupt is already in GUEST_RVI and will be recognized by CPU
+	 * at VM-Entry, or there is a KVM_REQ_EVENT pending and KVM will move
+	 * the interrupt from the PIR to RVI prior to entering the guest.
+	 */
+	if (for_injection)
+		return false;
+
+	if (!nested_cpu_has_vid(get_vmcs12(vcpu)) ||
+	    __vmx_interrupt_blocked(vcpu))
+		return false;
+
+	if (!vapic)
+		return false;
+
+	vppr = *((u32 *)(vapic + APIC_PROCPRI));
+
+	if (vmx->nested.pi_pending && vmx->nested.pi_desc &&
+	    pi_test_on(vmx->nested.pi_desc)) {
+		max_irr = pi_find_highest_vector(vmx->nested.pi_desc);
+		if (max_irr > 0 && (max_irr & 0xf0) > (vppr & 0xf0))
+			return true;
+	}
+
+	return false;
 }
 
 /*
@@ -5828,6 +5875,12 @@
 		return nested_vmx_fail(vcpu,
 			VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
 
+	/*
+	 * Always flush the effective vpid02, i.e. never flush the current VPID
+	 * and never explicitly flush vpid01.  INVVPID targets a VPID, not a
+	 * VMCS, and so whether or not the current vmcs12 has VPID enabled is
+	 * irrelevant (and there may not be a loaded vmcs12).
+	 */
 	vpid02 = nested_get_vpid02(vcpu);
 	switch (type) {
 	case VMX_VPID_EXTENT_INDIVIDUAL_ADDR:
--- linux-qcom-6.8.0.orig/arch/x86/kvm/vmx/pmu_intel.c
+++ linux-qcom-6.8.0/arch/x86/kvm/vmx/pmu_intel.c
@@ -491,19 +491,6 @@
 	u64 counter_mask;
 	int i;
 
-	pmu->nr_arch_gp_counters = 0;
-	pmu->nr_arch_fixed_counters = 0;
-	pmu->counter_bitmask[KVM_PMC_GP] = 0;
-	pmu->counter_bitmask[KVM_PMC_FIXED] = 0;
-	pmu->version = 0;
-	pmu->reserved_bits = 0xffffffff00200000ull;
-	pmu->raw_event_mask = X86_RAW_EVENT_MASK;
-	pmu->global_ctrl_mask = ~0ull;
-	pmu->global_status_mask = ~0ull;
-	pmu->fixed_ctr_ctrl_mask = ~0ull;
-	pmu->pebs_enable_mask = ~0ull;
-	pmu->pebs_data_cfg_mask = ~0ull;
-
 	memset(&lbr_desc->records, 0, sizeof(lbr_desc->records));
 
 	/*
@@ -515,8 +502,9 @@
 		return;
 
 	entry = kvm_find_cpuid_entry(vcpu, 0xa);
-	if (!entry || !vcpu->kvm->arch.enable_pmu)
+	if (!entry)
 		return;
+
 	eax.full = entry->eax;
 	edx.full = entry->edx;
 
--- linux-qcom-6.8.0.orig/arch/x86/kvm/vmx/posted_intr.h
+++ linux-qcom-6.8.0/arch/x86/kvm/vmx/posted_intr.h
@@ -2,97 +2,8 @@
 #ifndef __KVM_X86_VMX_POSTED_INTR_H
 #define __KVM_X86_VMX_POSTED_INTR_H
 
-#define POSTED_INTR_ON  0
-#define POSTED_INTR_SN  1
-
-#define PID_TABLE_ENTRY_VALID 1
-
-/* Posted-Interrupt Descriptor */
-struct pi_desc {
-	u32 pir[8];     /* Posted interrupt requested */
-	union {
-		struct {
-				/* bit 256 - Outstanding Notification */
-			u16	on	: 1,
-				/* bit 257 - Suppress Notification */
-				sn	: 1,
-				/* bit 271:258 - Reserved */
-				rsvd_1	: 14;
-				/* bit 279:272 - Notification Vector */
-			u8	nv;
-				/* bit 287:280 - Reserved */
-			u8	rsvd_2;
-				/* bit 319:288 - Notification Destination */
-			u32	ndst;
-		};
-		u64 control;
-	};
-	u32 rsvd[6];
-} __aligned(64);
-
-static inline bool pi_test_and_set_on(struct pi_desc *pi_desc)
-{
-	return test_and_set_bit(POSTED_INTR_ON,
-			(unsigned long *)&pi_desc->control);
-}
-
-static inline bool pi_test_and_clear_on(struct pi_desc *pi_desc)
-{
-	return test_and_clear_bit(POSTED_INTR_ON,
-			(unsigned long *)&pi_desc->control);
-}
-
-static inline bool pi_test_and_clear_sn(struct pi_desc *pi_desc)
-{
-	return test_and_clear_bit(POSTED_INTR_SN,
-			(unsigned long *)&pi_desc->control);
-}
-
-static inline bool pi_test_and_set_pir(int vector, struct pi_desc *pi_desc)
-{
-	return test_and_set_bit(vector, (unsigned long *)pi_desc->pir);
-}
-
-static inline bool pi_is_pir_empty(struct pi_desc *pi_desc)
-{
-	return bitmap_empty((unsigned long *)pi_desc->pir, NR_VECTORS);
-}
-
-static inline void pi_set_sn(struct pi_desc *pi_desc)
-{
-	set_bit(POSTED_INTR_SN,
-		(unsigned long *)&pi_desc->control);
-}
-
-static inline void pi_set_on(struct pi_desc *pi_desc)
-{
-	set_bit(POSTED_INTR_ON,
-		(unsigned long *)&pi_desc->control);
-}
-
-static inline void pi_clear_on(struct pi_desc *pi_desc)
-{
-	clear_bit(POSTED_INTR_ON,
-		(unsigned long *)&pi_desc->control);
-}
-
-static inline void pi_clear_sn(struct pi_desc *pi_desc)
-{
-	clear_bit(POSTED_INTR_SN,
-		(unsigned long *)&pi_desc->control);
-}
-
-static inline bool pi_test_on(struct pi_desc *pi_desc)
-{
-	return test_bit(POSTED_INTR_ON,
-			(unsigned long *)&pi_desc->control);
-}
-
-static inline bool pi_test_sn(struct pi_desc *pi_desc)
-{
-	return test_bit(POSTED_INTR_SN,
-			(unsigned long *)&pi_desc->control);
-}
+#include <linux/find.h>
+#include <asm/posted_intr.h>
 
 void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu);
 void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu);
@@ -103,4 +14,12 @@
 		       uint32_t guest_irq, bool set);
 void vmx_pi_start_assignment(struct kvm *kvm);
 
+static inline int pi_find_highest_vector(struct pi_desc *pi_desc)
+{
+	int vec;
+
+	vec = find_last_bit((unsigned long *)pi_desc->pir, 256);
+	return vec < 256 ? vec : -1;
+}
+
 #endif /* __KVM_X86_VMX_POSTED_INTR_H */
--- linux-qcom-6.8.0.orig/arch/x86/kvm/vmx/vmenter.S
+++ linux-qcom-6.8.0/arch/x86/kvm/vmx/vmenter.S
@@ -275,6 +275,8 @@
 
 	call vmx_spec_ctrl_restore_host
 
+	CLEAR_BRANCH_HISTORY_VMEXIT
+
 	/* Put return value in AX */
 	mov %_ASM_BX, %_ASM_AX
 
--- linux-qcom-6.8.0.orig/arch/x86/kvm/vmx/vmx.c
+++ linux-qcom-6.8.0/arch/x86/kvm/vmx/vmx.c
@@ -67,6 +67,7 @@
 #include "x86.h"
 #include "smm.h"
 #include "vmx_onhyperv.h"
+#include "posted_intr.h"
 
 MODULE_AUTHOR("Qumranet");
 MODULE_LICENSE("GPL");
@@ -211,9 +212,11 @@
 static unsigned int ple_window_max        = KVM_VMX_DEFAULT_PLE_WINDOW_MAX;
 module_param(ple_window_max, uint, 0444);
 
-/* Default is SYSTEM mode, 1 for host-guest mode */
+/* Default is SYSTEM mode, 1 for host-guest mode (which is BROKEN) */
 int __read_mostly pt_mode = PT_MODE_SYSTEM;
+#ifdef CONFIG_BROKEN
 module_param(pt_mode, int, S_IRUGO);
+#endif
 
 static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
 static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_cond);
@@ -2518,30 +2521,6 @@
 	return cpuid_eax(0) >= 0x12 && (cpuid_eax(0x12) & BIT(0));
 }
 
-/*
- * Some cpus support VM_{ENTRY,EXIT}_IA32_PERF_GLOBAL_CTRL but they
- * can't be used due to errata where VM Exit may incorrectly clear
- * IA32_PERF_GLOBAL_CTRL[34:32]. Work around the errata by using the
- * MSR load mechanism to switch IA32_PERF_GLOBAL_CTRL.
- */
-static bool cpu_has_perf_global_ctrl_bug(void)
-{
-	if (boot_cpu_data.x86 == 0x6) {
-		switch (boot_cpu_data.x86_model) {
-		case INTEL_FAM6_NEHALEM_EP:	/* AAK155 */
-		case INTEL_FAM6_NEHALEM:	/* AAP115 */
-		case INTEL_FAM6_WESTMERE:	/* AAT100 */
-		case INTEL_FAM6_WESTMERE_EP:	/* BC86,AAY89,BD102 */
-		case INTEL_FAM6_NEHALEM_EX:	/* BA97 */
-			return true;
-		default:
-			break;
-		}
-	}
-
-	return false;
-}
-
 static int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt, u32 msr, u32 *result)
 {
 	u32 vmx_msr_low, vmx_msr_high;
@@ -2697,6 +2676,27 @@
 		_vmexit_control &= ~x_ctrl;
 	}
 
+	/*
+	 * Some cpus support VM_{ENTRY,EXIT}_IA32_PERF_GLOBAL_CTRL but they
+	 * can't be used due to an errata where VM Exit may incorrectly clear
+	 * IA32_PERF_GLOBAL_CTRL[34:32].  Workaround the errata by using the
+	 * MSR load mechanism to switch IA32_PERF_GLOBAL_CTRL.
+	 */
+	switch (boot_cpu_data.x86_vfm) {
+	case INTEL_NEHALEM_EP:	/* AAK155 */
+	case INTEL_NEHALEM:	/* AAP115 */
+	case INTEL_WESTMERE:	/* AAT100 */
+	case INTEL_WESTMERE_EP:	/* BC86,AAY89,BD102 */
+	case INTEL_NEHALEM_EX:	/* BA97 */
+		_vmentry_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+		_vmexit_control &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
+		pr_warn_once("VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
+			     "does not work properly. Using workaround\n");
+		break;
+	default:
+		break;
+	}
+
 	rdmsr(MSR_IA32_VMX_BASIC, vmx_msr_low, vmx_msr_high);
 
 	/* IA-32 SDM Vol 3B: VMCS size is never greater than 4kB. */
@@ -3186,7 +3186,7 @@
 
 static inline int vmx_get_current_vpid(struct kvm_vcpu *vcpu)
 {
-	if (is_guest_mode(vcpu))
+	if (is_guest_mode(vcpu) && nested_cpu_has_vpid(get_vmcs12(vcpu)))
 		return nested_get_vpid02(vcpu);
 	return to_vmx(vcpu)->vpid;
 }
@@ -4406,9 +4406,6 @@
 			  VM_ENTRY_LOAD_IA32_EFER |
 			  VM_ENTRY_IA32E_MODE);
 
-	if (cpu_has_perf_global_ctrl_bug())
-		vmentry_ctrl &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
-
 	return vmentry_ctrl;
 }
 
@@ -4426,10 +4423,6 @@
 	if (vmx_pt_mode_is_system())
 		vmexit_ctrl &= ~(VM_EXIT_PT_CONCEAL_PIP |
 				 VM_EXIT_CLEAR_IA32_RTIT_CTL);
-
-	if (cpu_has_perf_global_ctrl_bug())
-		vmexit_ctrl &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
-
 	/* Loading of EFER and PERF_GLOBAL_CTRL are toggled dynamically */
 	return vmexit_ctrl &
 		~(VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL | VM_EXIT_LOAD_IA32_EFER);
@@ -5047,14 +5040,19 @@
 	return !vmx_nmi_blocked(vcpu);
 }
 
+bool __vmx_interrupt_blocked(struct kvm_vcpu *vcpu)
+{
+	return !(vmx_get_rflags(vcpu) & X86_EFLAGS_IF) ||
+	       (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+		(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
+}
+
 bool vmx_interrupt_blocked(struct kvm_vcpu *vcpu)
 {
 	if (is_guest_mode(vcpu) && nested_exit_on_intr(vcpu))
 		return false;
 
-	return !(vmx_get_rflags(vcpu) & X86_EFLAGS_IF) ||
-	       (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
-		(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
+	return __vmx_interrupt_blocked(vcpu);
 }
 
 static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu, bool for_injection)
@@ -7857,8 +7855,28 @@
 
 	if (vmx_pebs_supported()) {
 		perf_cap |= host_perf_cap & PERF_CAP_PEBS_MASK;
-		if ((perf_cap & PERF_CAP_PEBS_FORMAT) < 4)
-			perf_cap &= ~PERF_CAP_PEBS_BASELINE;
+
+		/*
+		 * Disallow adaptive PEBS as it is functionally broken, can be
+		 * used by the guest to read *host* LBRs, and can be used to
+		 * bypass userspace event filters.  To correctly and safely
+		 * support adaptive PEBS, KVM needs to:
+		 *
+		 * 1. Account for the ADAPTIVE flag when (re)programming fixed
+		 *    counters.
+		 *
+		 * 2. Gain support from perf (or take direct control of counter
+		 *    programming) to support events without adaptive PEBS
+		 *    enabled for the hardware counter.
+		 *
+		 * 3. Ensure LBR MSRs cannot hold host data on VM-Entry with
+		 *    adaptive PEBS enabled and MSR_PEBS_DATA_CFG.LBRS=1.
+		 *
+		 * 4. Document which PMU events are effectively exposed to the
+		 *    guest via adaptive PEBS, and make adaptive PEBS mutually
+		 *    exclusive with KVM_SET_PMU_EVENT_FILTER if necessary.
+		 */
+		perf_cap &= ~PERF_CAP_PEBS_BASELINE;
 	}
 
 	return perf_cap;
@@ -8337,6 +8355,8 @@
 	.enable_nmi_window = vmx_enable_nmi_window,
 	.enable_irq_window = vmx_enable_irq_window,
 	.update_cr8_intercept = vmx_update_cr8_intercept,
+
+	.x2apic_icr_is_split = false,
 	.set_virtual_apic_mode = vmx_set_virtual_apic_mode,
 	.set_apic_access_page_addr = vmx_set_apic_access_page_addr,
 	.refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl,
@@ -8489,10 +8509,6 @@
 	if (setup_vmcs_config(&vmcs_config, &vmx_capability) < 0)
 		return -EIO;
 
-	if (cpu_has_perf_global_ctrl_bug())
-		pr_warn_once("VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
-			     "does not work properly. Using workaround\n");
-
 	if (boot_cpu_has(X86_FEATURE_NX))
 		kvm_enable_efer_bits(EFER_NX);
 
--- linux-qcom-6.8.0.orig/arch/x86/kvm/vmx/vmx.h
+++ linux-qcom-6.8.0/arch/x86/kvm/vmx/vmx.h
@@ -7,10 +7,10 @@
 #include <asm/kvm.h>
 #include <asm/intel_pt.h>
 #include <asm/perf_event.h>
+#include <asm/posted_intr.h>
 
 #include "capabilities.h"
 #include "../kvm_cache_regs.h"
-#include "posted_intr.h"
 #include "vmcs.h"
 #include "vmx_ops.h"
 #include "../cpuid.h"
@@ -402,6 +402,7 @@
 bool vmx_guest_inject_ac(struct kvm_vcpu *vcpu);
 void vmx_update_exception_bitmap(struct kvm_vcpu *vcpu);
 bool vmx_nmi_blocked(struct kvm_vcpu *vcpu);
+bool __vmx_interrupt_blocked(struct kvm_vcpu *vcpu);
 bool vmx_interrupt_blocked(struct kvm_vcpu *vcpu);
 bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu);
 void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);
--- linux-qcom-6.8.0.orig/arch/x86/kvm/x86.c
+++ linux-qcom-6.8.0/arch/x86/kvm/x86.c
@@ -1623,7 +1623,8 @@
 	 ARCH_CAP_SKIP_VMENTRY_L1DFLUSH | ARCH_CAP_SSB_NO | ARCH_CAP_MDS_NO | \
 	 ARCH_CAP_PSCHANGE_MC_NO | ARCH_CAP_TSX_CTRL_MSR | ARCH_CAP_TAA_NO | \
 	 ARCH_CAP_SBDR_SSDP_NO | ARCH_CAP_FBSDP_NO | ARCH_CAP_PSDP_NO | \
-	 ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO | ARCH_CAP_GDS_NO)
+	 ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO | ARCH_CAP_GDS_NO | \
+	 ARCH_CAP_RFDS_NO | ARCH_CAP_RFDS_CLEAR | ARCH_CAP_BHI_NO)
 
 static u64 kvm_get_arch_capabilities(void)
 {
@@ -1655,6 +1656,8 @@
 		data |= ARCH_CAP_SSB_NO;
 	if (!boot_cpu_has_bug(X86_BUG_MDS))
 		data |= ARCH_CAP_MDS_NO;
+	if (!boot_cpu_has_bug(X86_BUG_RFDS))
+		data |= ARCH_CAP_RFDS_NO;
 
 	if (!boot_cpu_has(X86_FEATURE_RTM)) {
 		/*
@@ -3419,7 +3422,7 @@
 static bool can_set_mci_status(struct kvm_vcpu *vcpu)
 {
 	/* McStatusWrEn enabled? */
-	if (guest_cpuid_is_amd_or_hygon(vcpu))
+	if (guest_cpuid_is_amd_compatible(vcpu))
 		return !!(vcpu->arch.msr_hwcr & BIT_ULL(18));
 
 	return false;
@@ -5984,7 +5987,9 @@
 		if (copy_from_user(&events, argp, sizeof(struct kvm_vcpu_events)))
 			break;
 
+		kvm_vcpu_srcu_read_lock(vcpu);
 		r = kvm_vcpu_ioctl_x86_set_vcpu_events(vcpu, &events);
+		kvm_vcpu_srcu_read_unlock(vcpu);
 		break;
 	}
 	case KVM_GET_DEBUGREGS: {
@@ -10006,7 +10011,7 @@
 {
 	u64 ret = vcpu->run->hypercall.ret;
 
-	if (!is_64_bit_mode(vcpu))
+	if (!is_64_bit_hypercall(vcpu))
 		ret = (u32)ret;
 	kvm_rax_write(vcpu, ret);
 	++vcpu->stat.hypercalls;
@@ -10437,7 +10442,7 @@
 
 	if (is_guest_mode(vcpu) &&
 	    kvm_x86_ops.nested_ops->has_events &&
-	    kvm_x86_ops.nested_ops->has_events(vcpu))
+	    kvm_x86_ops.nested_ops->has_events(vcpu, true))
 		*req_immediate_exit = true;
 
 	/*
@@ -10639,13 +10644,12 @@
 
 	bitmap_zero(vcpu->arch.ioapic_handled_vectors, 256);
 
+	static_call_cond(kvm_x86_sync_pir_to_irr)(vcpu);
+
 	if (irqchip_split(vcpu->kvm))
 		kvm_scan_ioapic_routes(vcpu, vcpu->arch.ioapic_handled_vectors);
-	else {
-		static_call_cond(kvm_x86_sync_pir_to_irr)(vcpu);
-		if (ioapic_in_kernel(vcpu->kvm))
-			kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
-	}
+	else if (ioapic_in_kernel(vcpu->kvm))
+		kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
 
 	if (is_guest_mode(vcpu))
 		vcpu->arch.load_eoi_exitmap_pending = true;
@@ -11310,6 +11314,10 @@
 	struct kvm_run *kvm_run = vcpu->run;
 	int r;
 
+	r = kvm_mmu_post_init_vm(vcpu->kvm);
+	if (r)
+		return r;
+
 	vcpu_load(vcpu);
 	kvm_sigset_activate(vcpu);
 	kvm_run->flags = 0;
@@ -12581,7 +12589,8 @@
 
 int kvm_arch_post_init_vm(struct kvm *kvm)
 {
-	return kvm_mmu_post_init_vm(kvm);
+	once_init(&kvm->arch.nx_once);
+	return 0;
 }
 
 static void kvm_unload_vcpu_mmu(struct kvm_vcpu *vcpu)
@@ -13081,7 +13090,7 @@
 
 	if (is_guest_mode(vcpu) &&
 	    kvm_x86_ops.nested_ops->has_events &&
-	    kvm_x86_ops.nested_ops->has_events(vcpu))
+	    kvm_x86_ops.nested_ops->has_events(vcpu, false))
 		return true;
 
 	if (kvm_xen_has_pending_events(vcpu))
@@ -13913,6 +13922,8 @@
 
 static int __init kvm_x86_init(void)
 {
+	kvm_init_xstate_sizes();
+
 	kvm_mmu_x86_module_init();
 	mitigate_smt_rsb &= boot_cpu_has_bug(X86_BUG_SMT_RSB) && cpu_smt_possible();
 	return 0;
--- linux-qcom-6.8.0.orig/arch/x86/kvm/xen.c
+++ linux-qcom-6.8.0/arch/x86/kvm/xen.c
@@ -493,7 +493,7 @@
 		kvm_xen_update_runstate_guest(v, state == RUNSTATE_runnable);
 }
 
-static void kvm_xen_inject_vcpu_vector(struct kvm_vcpu *v)
+void kvm_xen_inject_vcpu_vector(struct kvm_vcpu *v)
 {
 	struct kvm_lapic_irq irq = { };
 	int r;
--- linux-qcom-6.8.0.orig/arch/x86/kvm/xen.h
+++ linux-qcom-6.8.0/arch/x86/kvm/xen.h
@@ -18,6 +18,7 @@
 
 int __kvm_xen_has_interrupt(struct kvm_vcpu *vcpu);
 void kvm_xen_inject_pending_events(struct kvm_vcpu *vcpu);
+void kvm_xen_inject_vcpu_vector(struct kvm_vcpu *vcpu);
 int kvm_xen_vcpu_set_attr(struct kvm_vcpu *vcpu, struct kvm_xen_vcpu_attr *data);
 int kvm_xen_vcpu_get_attr(struct kvm_vcpu *vcpu, struct kvm_xen_vcpu_attr *data);
 int kvm_xen_hvm_set_attr(struct kvm *kvm, struct kvm_xen_hvm_attr *data);
@@ -36,6 +37,19 @@
 			 const struct kvm_irq_routing_entry *ue);
 void kvm_xen_update_tsc_info(struct kvm_vcpu *vcpu);
 
+static inline void kvm_xen_sw_enable_lapic(struct kvm_vcpu *vcpu)
+{
+	/*
+	 * The local APIC is being enabled. If the per-vCPU upcall vector is
+	 * set and the vCPU's evtchn_upcall_pending flag is set, inject the
+	 * interrupt.
+	 */
+	if (static_branch_unlikely(&kvm_xen_enabled.key) &&
+	    vcpu->arch.xen.vcpu_info_cache.active &&
+	    vcpu->arch.xen.upcall_vector && __kvm_xen_has_interrupt(vcpu))
+		kvm_xen_inject_vcpu_vector(vcpu);
+}
+
 static inline bool kvm_xen_msr_enabled(struct kvm *kvm)
 {
 	return static_branch_unlikely(&kvm_xen_enabled.key) &&
@@ -101,6 +115,10 @@
 {
 }
 
+static inline void kvm_xen_sw_enable_lapic(struct kvm_vcpu *vcpu)
+{
+}
+
 static inline bool kvm_xen_msr_enabled(struct kvm *kvm)
 {
 	return false;
--- linux-qcom-6.8.0.orig/arch/x86/lib/Makefile
+++ linux-qcom-6.8.0/arch/x86/lib/Makefile
@@ -14,19 +14,6 @@
 CFLAGS_REMOVE_delay.o = $(CC_FLAGS_FTRACE)
 endif
 
-# Early boot use of cmdline; don't instrument it
-ifdef CONFIG_AMD_MEM_ENCRYPT
-KCOV_INSTRUMENT_cmdline.o := n
-KASAN_SANITIZE_cmdline.o  := n
-KCSAN_SANITIZE_cmdline.o  := n
-
-ifdef CONFIG_FUNCTION_TRACER
-CFLAGS_REMOVE_cmdline.o = -pg
-endif
-
-CFLAGS_cmdline.o := -fno-stack-protector -fno-jump-tables
-endif
-
 inat_tables_script = $(srctree)/arch/x86/tools/gen-insn-attr-x86.awk
 inat_tables_maps = $(srctree)/arch/x86/lib/x86-opcode-map.txt
 quiet_cmd_inat_tables = GEN     $@
--- linux-qcom-6.8.0.orig/arch/x86/lib/getuser.S
+++ linux-qcom-6.8.0/arch/x86/lib/getuser.S
@@ -44,7 +44,11 @@
 	or %rdx, %rax
 .else
 	cmp $TASK_SIZE_MAX-\size+1, %eax
+.if \size != 8
 	jae .Lbad_get_user
+.else
+	jae .Lbad_get_user_8
+.endif
 	sbb %edx, %edx		/* array_index_mask_nospec() */
 	and %edx, %eax
 .endif
@@ -154,7 +158,7 @@
 #ifdef CONFIG_X86_32
 SYM_CODE_START_LOCAL(__get_user_8_handle_exception)
 	ASM_CLAC
-bad_get_user_8:
+.Lbad_get_user_8:
 	xor %edx,%edx
 	xor %ecx,%ecx
 	mov $(-EFAULT),%_ASM_AX
--- linux-qcom-6.8.0.orig/arch/x86/lib/iomem.c
+++ linux-qcom-6.8.0/arch/x86/lib/iomem.c
@@ -25,6 +25,9 @@
 
 static void string_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
 {
+	const void *orig_to = to;
+	const size_t orig_n = n;
+
 	if (unlikely(!n))
 		return;
 
@@ -39,7 +42,7 @@
 	}
 	rep_movs(to, (const void *)from, n);
 	/* KMSAN must treat values read from devices as initialized. */
-	kmsan_unpoison_memory(to, n);
+	kmsan_unpoison_memory(orig_to, orig_n);
 }
 
 static void string_memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
--- linux-qcom-6.8.0.orig/arch/x86/lib/retpoline.S
+++ linux-qcom-6.8.0/arch/x86/lib/retpoline.S
@@ -163,6 +163,7 @@
 	lfence
 	jmp srso_alias_return_thunk
 SYM_FUNC_END(srso_alias_untrain_ret)
+__EXPORT_THUNK(srso_alias_untrain_ret)
 	.popsection
 
 	.pushsection .text..__x86.rethunk_safe
@@ -224,10 +225,16 @@
 SYM_CODE_END(srso_return_thunk)
 
 #define JMP_SRSO_UNTRAIN_RET "jmp srso_untrain_ret"
-#define JMP_SRSO_ALIAS_UNTRAIN_RET "jmp srso_alias_untrain_ret"
 #else /* !CONFIG_CPU_SRSO */
 #define JMP_SRSO_UNTRAIN_RET "ud2"
-#define JMP_SRSO_ALIAS_UNTRAIN_RET "ud2"
+/* Dummy for the alternative in CALL_UNTRAIN_RET. */
+SYM_CODE_START(srso_alias_untrain_ret)
+	ANNOTATE_UNRET_SAFE
+	ANNOTATE_NOENDBR
+	ret
+	int3
+SYM_FUNC_END(srso_alias_untrain_ret)
+__EXPORT_THUNK(srso_alias_untrain_ret)
 #endif /* CONFIG_CPU_SRSO */
 
 #ifdef CONFIG_CPU_UNRET_ENTRY
@@ -319,9 +326,7 @@
 #if defined(CONFIG_CPU_UNRET_ENTRY) || defined(CONFIG_CPU_SRSO)
 
 SYM_FUNC_START(entry_untrain_ret)
-	ALTERNATIVE_2 JMP_RETBLEED_UNTRAIN_RET,				\
-		      JMP_SRSO_UNTRAIN_RET, X86_FEATURE_SRSO,		\
-		      JMP_SRSO_ALIAS_UNTRAIN_RET, X86_FEATURE_SRSO_ALIAS
+	ALTERNATIVE JMP_RETBLEED_UNTRAIN_RET, JMP_SRSO_UNTRAIN_RET, X86_FEATURE_SRSO
 SYM_FUNC_END(entry_untrain_ret)
 __EXPORT_THUNK(entry_untrain_ret)
 
--- linux-qcom-6.8.0.orig/arch/x86/lib/x86-opcode-map.txt
+++ linux-qcom-6.8.0/arch/x86/lib/x86-opcode-map.txt
@@ -148,7 +148,7 @@
 65: SEG=GS (Prefix)
 66: Operand-Size (Prefix)
 67: Address-Size (Prefix)
-68: PUSH Iz (d64)
+68: PUSH Iz
 69: IMUL Gv,Ev,Iz
 6a: PUSH Ib (d64)
 6b: IMUL Gv,Ev,Ib
@@ -698,10 +698,10 @@
 4d: vrcp14ss/d Vsd,Hpd,Wsd (66),(ev)
 4e: vrsqrt14ps/d Vpd,Wpd (66),(ev)
 4f: vrsqrt14ss/d Vsd,Hsd,Wsd (66),(ev)
-50: vpdpbusd Vx,Hx,Wx (66),(ev)
-51: vpdpbusds Vx,Hx,Wx (66),(ev)
-52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66),(ev) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev)
-53: vpdpwssds Vx,Hx,Wx (66),(ev) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev)
+50: vpdpbusd Vx,Hx,Wx (66)
+51: vpdpbusds Vx,Hx,Wx (66)
+52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev)
+53: vpdpwssds Vx,Hx,Wx (66) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev)
 54: vpopcntb/w Vx,Wx (66),(ev)
 55: vpopcntd/q Vx,Wx (66),(ev)
 58: vpbroadcastd Vx,Wx (66),(v)
--- linux-qcom-6.8.0.orig/arch/x86/mm/fault.c
+++ linux-qcom-6.8.0/arch/x86/mm/fault.c
@@ -376,7 +376,7 @@
 		goto bad;
 
 	pr_cont("PUD %lx ", pud_val(*pud));
-	if (!pud_present(*pud) || pud_large(*pud))
+	if (!pud_present(*pud) || pud_leaf(*pud))
 		goto out;
 
 	pmd = pmd_offset(pud, address);
@@ -717,39 +717,8 @@
 	WARN_ON_ONCE(user_mode(regs));
 
 	/* Are we prepared to handle this kernel fault? */
-	if (fixup_exception(regs, X86_TRAP_PF, error_code, address)) {
-		/*
-		 * Any interrupt that takes a fault gets the fixup. This makes
-		 * the below recursive fault logic only apply to a faults from
-		 * task context.
-		 */
-		if (in_interrupt())
-			return;
-
-		/*
-		 * Per the above we're !in_interrupt(), aka. task context.
-		 *
-		 * In this case we need to make sure we're not recursively
-		 * faulting through the emulate_vsyscall() logic.
-		 */
-		if (current->thread.sig_on_uaccess_err && signal) {
-			sanitize_error_code(address, &error_code);
-
-			set_signal_archinfo(address, error_code);
-
-			if (si_code == SEGV_PKUERR) {
-				force_sig_pkuerr((void __user *)address, pkey);
-			} else {
-				/* XXX: hwpoison faults will set the wrong code. */
-				force_sig_fault(signal, si_code, (void __user *)address);
-			}
-		}
-
-		/*
-		 * Barring that, we can do the fixup and be happy.
-		 */
+	if (fixup_exception(regs, X86_TRAP_PF, error_code, address))
 		return;
-	}
 
 	/*
 	 * AMD erratum #91 manifests as a spurious page fault on a PREFETCH
@@ -1037,7 +1006,7 @@
 	if (!pud_present(*pud))
 		return 0;
 
-	if (pud_large(*pud))
+	if (pud_leaf(*pud))
 		return spurious_kernel_fault_check(error_code, (pte_t *) pud);
 
 	pmd = pmd_offset(pud, address);
--- linux-qcom-6.8.0.orig/arch/x86/mm/ident_map.c
+++ linux-qcom-6.8.0/arch/x86/mm/ident_map.c
@@ -33,7 +33,7 @@
 			next = end;
 
 		/* if this is already a gbpage, this portion is already mapped */
-		if (pud_large(*pud))
+		if (pud_leaf(*pud))
 			continue;
 
 		/* Is using a gbpage allowed? */
@@ -101,7 +101,7 @@
 		if (result)
 			return result;
 
-		set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
+		set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag | _PAGE_NOPTISHADOW));
 	}
 
 	return 0;
@@ -145,14 +145,14 @@
 		if (result)
 			return result;
 		if (pgtable_l5_enabled()) {
-			set_pgd(pgd, __pgd(__pa(p4d) | info->kernpg_flag));
+			set_pgd(pgd, __pgd(__pa(p4d) | info->kernpg_flag | _PAGE_NOPTISHADOW));
 		} else {
 			/*
 			 * With p4d folded, pgd is equal to p4d.
 			 * The pgd entry has to point to the pud page table in this case.
 			 */
 			pud_t *pud = pud_offset(p4d, 0);
-			set_pgd(pgd, __pgd(__pa(pud) | info->kernpg_flag));
+			set_pgd(pgd, __pgd(__pa(pud) | info->kernpg_flag | _PAGE_NOPTISHADOW));
 		}
 	}
 
--- linux-qcom-6.8.0.orig/arch/x86/mm/init.c
+++ linux-qcom-6.8.0/arch/x86/mm/init.c
@@ -261,21 +261,17 @@
 	}
 }
 
-#define INTEL_MATCH(_model) { .vendor  = X86_VENDOR_INTEL,	\
-			      .family  = 6,			\
-			      .model = _model,			\
-			    }
 /*
  * INVLPG may not properly flush Global entries
  * on these CPUs when PCIDs are enabled.
  */
 static const struct x86_cpu_id invlpg_miss_ids[] = {
-	INTEL_MATCH(INTEL_FAM6_ALDERLAKE   ),
-	INTEL_MATCH(INTEL_FAM6_ALDERLAKE_L ),
-	INTEL_MATCH(INTEL_FAM6_ATOM_GRACEMONT ),
-	INTEL_MATCH(INTEL_FAM6_RAPTORLAKE  ),
-	INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_P),
-	INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_S),
+	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE,      0),
+	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L,    0),
+	X86_MATCH_INTEL_FAM6_MODEL(ATOM_GRACEMONT, 0),
+	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE,     0),
+	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P,   0),
+	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S,   0),
 	{}
 };
 
--- linux-qcom-6.8.0.orig/arch/x86/mm/init_64.c
+++ linux-qcom-6.8.0/arch/x86/mm/init_64.c
@@ -617,7 +617,7 @@
 		}
 
 		if (!pud_none(*pud)) {
-			if (!pud_large(*pud)) {
+			if (!pud_leaf(*pud)) {
 				pmd = pmd_offset(pud, 0);
 				paddr_last = phys_pmd_init(pmd, paddr,
 							   paddr_end,
@@ -950,8 +950,12 @@
 int add_pages(int nid, unsigned long start_pfn, unsigned long nr_pages,
 	      struct mhp_params *params)
 {
+	unsigned long end = ((start_pfn + nr_pages) << PAGE_SHIFT) - 1;
 	int ret;
 
+	if (WARN_ON_ONCE(end > PHYSMEM_END))
+		return -ERANGE;
+
 	ret = __add_pages(nid, start_pfn, nr_pages, params);
 	WARN_ON_ONCE(ret);
 
@@ -1163,7 +1167,7 @@
 		if (!pud_present(*pud))
 			continue;
 
-		if (pud_large(*pud) &&
+		if (pud_leaf(*pud) &&
 		    IS_ALIGNED(addr, PUD_SIZE) &&
 		    IS_ALIGNED(next, PUD_SIZE)) {
 			spin_lock(&init_mm.page_table_lock);
--- linux-qcom-6.8.0.orig/arch/x86/mm/ioremap.c
+++ linux-qcom-6.8.0/arch/x86/mm/ioremap.c
@@ -655,7 +655,8 @@
 		paddr_next = data->next;
 		len = data->len;
 
-		if ((phys_addr > paddr) && (phys_addr < (paddr + len))) {
+		if ((phys_addr > paddr) &&
+		    (phys_addr < (paddr + sizeof(struct setup_data) + len))) {
 			memunmap(data);
 			return true;
 		}
@@ -717,7 +718,8 @@
 		paddr_next = data->next;
 		len = data->len;
 
-		if ((phys_addr > paddr) && (phys_addr < (paddr + len))) {
+		if ((phys_addr > paddr) &&
+		    (phys_addr < (paddr + sizeof(struct setup_data) + len))) {
 			early_memunmap(data, sizeof(*data));
 			return true;
 		}
--- linux-qcom-6.8.0.orig/arch/x86/mm/kasan_init_64.c
+++ linux-qcom-6.8.0/arch/x86/mm/kasan_init_64.c
@@ -115,7 +115,7 @@
 	pud = pud_offset(p4d, addr);
 	do {
 		next = pud_addr_end(addr, end);
-		if (!pud_large(*pud))
+		if (!pud_leaf(*pud))
 			kasan_populate_pud(pud, addr, next, nid);
 	} while (pud++, addr = next, addr != end);
 }
--- linux-qcom-6.8.0.orig/arch/x86/mm/kaslr.c
+++ linux-qcom-6.8.0/arch/x86/mm/kaslr.c
@@ -47,13 +47,24 @@
  */
 static __initdata struct kaslr_memory_region {
 	unsigned long *base;
+	unsigned long *end;
 	unsigned long size_tb;
 } kaslr_regions[] = {
-	{ &page_offset_base, 0 },
-	{ &vmalloc_base, 0 },
-	{ &vmemmap_base, 0 },
+	{
+		.base	= &page_offset_base,
+		.end	= &physmem_end,
+	},
+	{
+		.base	= &vmalloc_base,
+	},
+	{
+		.base	= &vmemmap_base,
+	},
 };
 
+/* The end of the possible address space for physical memory */
+unsigned long physmem_end __ro_after_init;
+
 /* Get size in bytes used by the memory region */
 static inline unsigned long get_padding(struct kaslr_memory_region *region)
 {
@@ -82,6 +93,8 @@
 	BUILD_BUG_ON(vaddr_end != CPU_ENTRY_AREA_BASE);
 	BUILD_BUG_ON(vaddr_end > __START_KERNEL_map);
 
+	/* Preset the end of the possible address space for physical memory */
+	physmem_end = ((1ULL << MAX_PHYSMEM_BITS) - 1);
 	if (!kaslr_memory_enabled())
 		return;
 
@@ -128,11 +141,18 @@
 		vaddr += entropy;
 		*kaslr_regions[i].base = vaddr;
 
+		/* Calculate the end of the region */
+		vaddr += get_padding(&kaslr_regions[i]);
 		/*
-		 * Jump the region and add a minimum padding based on
-		 * randomization alignment.
+		 * KASLR trims the maximum possible size of the
+		 * direct-map. Update the physmem_end boundary.
+		 * No rounding required as the region starts
+		 * PUD aligned and size is in units of TB.
 		 */
-		vaddr += get_padding(&kaslr_regions[i]);
+		if (kaslr_regions[i].end)
+			*kaslr_regions[i].end = __pa_nodebug(vaddr - 1);
+
+		/* Add a minimum padding based on randomization alignment. */
 		vaddr = round_up(vaddr + 1, PUD_SIZE);
 		remain_entropy -= entropy;
 	}
--- linux-qcom-6.8.0.orig/arch/x86/mm/mem_encrypt_amd.c
+++ linux-qcom-6.8.0/arch/x86/mm/mem_encrypt_amd.c
@@ -283,7 +283,7 @@
 #endif
 }
 
-static bool amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool enc)
+static int amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool enc)
 {
 	/*
 	 * To maintain the security guarantees of SEV-SNP guests, make sure
@@ -292,11 +292,11 @@
 	if (cc_platform_has(CC_ATTR_GUEST_SEV_SNP) && !enc)
 		snp_set_memory_shared(vaddr, npages);
 
-	return true;
+	return 0;
 }
 
 /* Return true unconditionally: return value doesn't matter for the SEV side */
-static bool amd_enc_status_change_finish(unsigned long vaddr, int npages, bool enc)
+static int amd_enc_status_change_finish(unsigned long vaddr, int npages, bool enc)
 {
 	/*
 	 * After memory is mapped encrypted in the page table, validate it
@@ -308,7 +308,7 @@
 	if (!cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT))
 		enc_dec_hypercall(vaddr, npages << PAGE_SHIFT, enc);
 
-	return true;
+	return 0;
 }
 
 static void __init __set_clr_pte_enc(pte_t *kpte, int level, bool enc)
@@ -492,6 +492,24 @@
 	 */
 	if (sev_status & MSR_AMD64_SEV_ENABLED)
 		ia32_disable();
+
+	/*
+	 * Override init functions that scan the ROM region in SEV-SNP guests,
+	 * as this memory is not pre-validated and would thus cause a crash.
+	 */
+	if (sev_status & MSR_AMD64_SEV_SNP_ENABLED) {
+		x86_init.mpparse.find_smp_config = x86_init_noop;
+		x86_init.pci.init_irq = x86_init_noop;
+		x86_init.resources.probe_roms = x86_init_noop;
+
+		/*
+		 * DMI setup behavior for SEV-SNP guests depends on
+		 * efi_enabled(EFI_CONFIG_TABLES), which hasn't been
+		 * parsed yet. snp_dmi_setup() will run after that
+		 * parsing has happened.
+		 */
+		x86_init.resources.dmi_setup = snp_dmi_setup;
+	}
 }
 
 void __init mem_encrypt_free_decrypted_mem(void)
--- linux-qcom-6.8.0.orig/arch/x86/mm/mem_encrypt_identity.c
+++ linux-qcom-6.8.0/arch/x86/mm/mem_encrypt_identity.c
@@ -41,9 +41,9 @@
 #include <linux/mem_encrypt.h>
 #include <linux/cc_platform.h>
 
+#include <asm/init.h>
 #include <asm/setup.h>
 #include <asm/sections.h>
-#include <asm/cmdline.h>
 #include <asm/coco.h>
 #include <asm/sev.h>
 
@@ -95,11 +95,7 @@
  */
 static char sme_workarea[2 * PMD_SIZE] __section(".init.scratch");
 
-static char sme_cmdline_arg[] __initdata = "mem_encrypt";
-static char sme_cmdline_on[]  __initdata = "on";
-static char sme_cmdline_off[] __initdata = "off";
-
-static void __init sme_clear_pgd(struct sme_populate_pgd_data *ppd)
+static void __head sme_clear_pgd(struct sme_populate_pgd_data *ppd)
 {
 	unsigned long pgd_start, pgd_end, pgd_size;
 	pgd_t *pgd_p;
@@ -114,7 +110,7 @@
 	memset(pgd_p, 0, pgd_size);
 }
 
-static pud_t __init *sme_prepare_pgd(struct sme_populate_pgd_data *ppd)
+static pud_t __head *sme_prepare_pgd(struct sme_populate_pgd_data *ppd)
 {
 	pgd_t *pgd;
 	p4d_t *p4d;
@@ -145,13 +141,13 @@
 		set_pud(pud, __pud(PUD_FLAGS | __pa(pmd)));
 	}
 
-	if (pud_large(*pud))
+	if (pud_leaf(*pud))
 		return NULL;
 
 	return pud;
 }
 
-static void __init sme_populate_pgd_large(struct sme_populate_pgd_data *ppd)
+static void __head sme_populate_pgd_large(struct sme_populate_pgd_data *ppd)
 {
 	pud_t *pud;
 	pmd_t *pmd;
@@ -167,7 +163,7 @@
 	set_pmd(pmd, __pmd(ppd->paddr | ppd->pmd_flags));
 }
 
-static void __init sme_populate_pgd(struct sme_populate_pgd_data *ppd)
+static void __head sme_populate_pgd(struct sme_populate_pgd_data *ppd)
 {
 	pud_t *pud;
 	pmd_t *pmd;
@@ -193,7 +189,7 @@
 		set_pte(pte, __pte(ppd->paddr | ppd->pte_flags));
 }
 
-static void __init __sme_map_range_pmd(struct sme_populate_pgd_data *ppd)
+static void __head __sme_map_range_pmd(struct sme_populate_pgd_data *ppd)
 {
 	while (ppd->vaddr < ppd->vaddr_end) {
 		sme_populate_pgd_large(ppd);
@@ -203,7 +199,7 @@
 	}
 }
 
-static void __init __sme_map_range_pte(struct sme_populate_pgd_data *ppd)
+static void __head __sme_map_range_pte(struct sme_populate_pgd_data *ppd)
 {
 	while (ppd->vaddr < ppd->vaddr_end) {
 		sme_populate_pgd(ppd);
@@ -213,7 +209,7 @@
 	}
 }
 
-static void __init __sme_map_range(struct sme_populate_pgd_data *ppd,
+static void __head __sme_map_range(struct sme_populate_pgd_data *ppd,
 				   pmdval_t pmd_flags, pteval_t pte_flags)
 {
 	unsigned long vaddr_end;
@@ -237,22 +233,22 @@
 	__sme_map_range_pte(ppd);
 }
 
-static void __init sme_map_range_encrypted(struct sme_populate_pgd_data *ppd)
+static void __head sme_map_range_encrypted(struct sme_populate_pgd_data *ppd)
 {
 	__sme_map_range(ppd, PMD_FLAGS_ENC, PTE_FLAGS_ENC);
 }
 
-static void __init sme_map_range_decrypted(struct sme_populate_pgd_data *ppd)
+static void __head sme_map_range_decrypted(struct sme_populate_pgd_data *ppd)
 {
 	__sme_map_range(ppd, PMD_FLAGS_DEC, PTE_FLAGS_DEC);
 }
 
-static void __init sme_map_range_decrypted_wp(struct sme_populate_pgd_data *ppd)
+static void __head sme_map_range_decrypted_wp(struct sme_populate_pgd_data *ppd)
 {
 	__sme_map_range(ppd, PMD_FLAGS_DEC_WP, PTE_FLAGS_DEC_WP);
 }
 
-static unsigned long __init sme_pgtable_calc(unsigned long len)
+static unsigned long __head sme_pgtable_calc(unsigned long len)
 {
 	unsigned long entries = 0, tables = 0;
 
@@ -289,7 +285,7 @@
 	return entries + tables;
 }
 
-void __init sme_encrypt_kernel(struct boot_params *bp)
+void __head sme_encrypt_kernel(struct boot_params *bp)
 {
 	unsigned long workarea_start, workarea_end, workarea_len;
 	unsigned long execute_start, execute_end, execute_len;
@@ -305,7 +301,8 @@
 	 * instrumentation or checking boot_cpu_data in the cc_platform_has()
 	 * function.
 	 */
-	if (!sme_get_me_mask() || sev_status & MSR_AMD64_SEV_ENABLED)
+	if (!sme_get_me_mask() ||
+	    RIP_REL_REF(sev_status) & MSR_AMD64_SEV_ENABLED)
 		return;
 
 	/*
@@ -323,9 +320,8 @@
 	 *     memory from being cached.
 	 */
 
-	/* Physical addresses gives us the identity mapped virtual addresses */
-	kernel_start = __pa_symbol(_text);
-	kernel_end = ALIGN(__pa_symbol(_end), PMD_SIZE);
+	kernel_start = (unsigned long)RIP_REL_REF(_text);
+	kernel_end = ALIGN((unsigned long)RIP_REL_REF(_end), PMD_SIZE);
 	kernel_len = kernel_end - kernel_start;
 
 	initrd_start = 0;
@@ -343,14 +339,6 @@
 #endif
 
 	/*
-	 * We're running identity mapped, so we must obtain the address to the
-	 * SME encryption workarea using rip-relative addressing.
-	 */
-	asm ("lea sme_workarea(%%rip), %0"
-	     : "=r" (workarea_start)
-	     : "p" (sme_workarea));
-
-	/*
 	 * Calculate required number of workarea bytes needed:
 	 *   executable encryption area size:
 	 *     stack page (PAGE_SIZE)
@@ -359,7 +347,7 @@
 	 *   pagetable structures for the encryption of the kernel
 	 *   pagetable structures for workarea (in case not currently mapped)
 	 */
-	execute_start = workarea_start;
+	execute_start = workarea_start = (unsigned long)RIP_REL_REF(sme_workarea);
 	execute_end = execute_start + (PAGE_SIZE * 2) + PMD_SIZE;
 	execute_len = execute_end - execute_start;
 
@@ -502,14 +490,11 @@
 	native_write_cr3(__native_read_cr3());
 }
 
-void __init sme_enable(struct boot_params *bp)
+void __head sme_enable(struct boot_params *bp)
 {
-	const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off;
 	unsigned int eax, ebx, ecx, edx;
 	unsigned long feature_mask;
-	bool active_by_default;
 	unsigned long me_mask;
-	char buffer[16];
 	bool snp;
 	u64 msr;
 
@@ -543,15 +528,18 @@
 	me_mask = 1UL << (ebx & 0x3f);
 
 	/* Check the SEV MSR whether SEV or SME is enabled */
-	sev_status   = __rdmsr(MSR_AMD64_SEV);
-	feature_mask = (sev_status & MSR_AMD64_SEV_ENABLED) ? AMD_SEV_BIT : AMD_SME_BIT;
+	RIP_REL_REF(sev_status) = msr = __rdmsr(MSR_AMD64_SEV);
+	feature_mask = (msr & MSR_AMD64_SEV_ENABLED) ? AMD_SEV_BIT : AMD_SME_BIT;
 
 	/* The SEV-SNP CC blob should never be present unless SEV-SNP is enabled. */
-	if (snp && !(sev_status & MSR_AMD64_SEV_SNP_ENABLED))
+	if (snp && !(msr & MSR_AMD64_SEV_SNP_ENABLED))
 		snp_abort();
 
 	/* Check if memory encryption is enabled */
 	if (feature_mask == AMD_SME_BIT) {
+		if (!(bp->hdr.xloadflags & XLF_MEM_ENCRYPTION))
+			return;
+
 		/*
 		 * No SME if Hypervisor bit is set. This check is here to
 		 * prevent a guest from trying to enable SME. For running as a
@@ -571,48 +559,10 @@
 		msr = __rdmsr(MSR_AMD64_SYSCFG);
 		if (!(msr & MSR_AMD64_SYSCFG_MEM_ENCRYPT))
 			return;
-	} else {
-		/* SEV state cannot be controlled by a command line option */
-		sme_me_mask = me_mask;
-		goto out;
 	}
 
-	/*
-	 * Fixups have not been applied to phys_base yet and we're running
-	 * identity mapped, so we must obtain the address to the SME command
-	 * line argument data using rip-relative addressing.
-	 */
-	asm ("lea sme_cmdline_arg(%%rip), %0"
-	     : "=r" (cmdline_arg)
-	     : "p" (sme_cmdline_arg));
-	asm ("lea sme_cmdline_on(%%rip), %0"
-	     : "=r" (cmdline_on)
-	     : "p" (sme_cmdline_on));
-	asm ("lea sme_cmdline_off(%%rip), %0"
-	     : "=r" (cmdline_off)
-	     : "p" (sme_cmdline_off));
-
-	if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT))
-		active_by_default = true;
-	else
-		active_by_default = false;
-
-	cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr |
-				     ((u64)bp->ext_cmd_line_ptr << 32));
-
-	if (cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer)) < 0)
-		return;
-
-	if (!strncmp(buffer, cmdline_on, sizeof(buffer)))
-		sme_me_mask = me_mask;
-	else if (!strncmp(buffer, cmdline_off, sizeof(buffer)))
-		sme_me_mask = 0;
-	else
-		sme_me_mask = active_by_default ? me_mask : 0;
-out:
-	if (sme_me_mask) {
-		physical_mask &= ~sme_me_mask;
-		cc_vendor = CC_VENDOR_AMD;
-		cc_set_mask(sme_me_mask);
-	}
+	RIP_REL_REF(sme_me_mask) = me_mask;
+	physical_mask &= ~me_mask;
+	cc_vendor = CC_VENDOR_AMD;
+	cc_set_mask(me_mask);
 }
--- linux-qcom-6.8.0.orig/arch/x86/mm/numa.c
+++ linux-qcom-6.8.0/arch/x86/mm/numa.c
@@ -493,7 +493,7 @@
 	for_each_reserved_mem_region(mb_region) {
 		int nid = memblock_get_region_node(mb_region);
 
-		if (nid != MAX_NUMNODES)
+		if (nid != NUMA_NO_NODE)
 			node_set(nid, reserved_nodemask);
 	}
 
@@ -614,9 +614,9 @@
 	nodes_clear(node_online_map);
 	memset(&numa_meminfo, 0, sizeof(numa_meminfo));
 	WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.memory,
-				  MAX_NUMNODES));
+				  NUMA_NO_NODE));
 	WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.reserved,
-				  MAX_NUMNODES));
+				  NUMA_NO_NODE));
 	/* In case that parsing SRAT failed. */
 	WARN_ON(memblock_clear_hotplug(0, ULLONG_MAX));
 	numa_reset_distance();
@@ -929,6 +929,8 @@
 }
 EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid);
 
+#endif
+
 static int __init cmp_memblk(const void *a, const void *b)
 {
 	const struct numa_memblk *ma = *(const struct numa_memblk **)a;
@@ -1001,5 +1003,3 @@
 	}
 	return 0;
 }
-
-#endif
--- linux-qcom-6.8.0.orig/arch/x86/mm/pat/memtype.c
+++ linux-qcom-6.8.0/arch/x86/mm/pat/memtype.c
@@ -950,6 +950,38 @@
 		memtype_free(paddr, paddr + size);
 }
 
+static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr,
+		pgprot_t *pgprot)
+{
+	unsigned long prot;
+
+	VM_WARN_ON_ONCE(!(vma->vm_flags & VM_PAT));
+
+	/*
+	 * We need the starting PFN and cachemode used for track_pfn_remap()
+	 * that covered the whole VMA. For most mappings, we can obtain that
+	 * information from the page tables. For COW mappings, we might now
+	 * suddenly have anon folios mapped and follow_phys() will fail.
+	 *
+	 * Fallback to using vma->vm_pgoff, see remap_pfn_range_notrack(), to
+	 * detect the PFN. If we need the cachemode as well, we're out of luck
+	 * for now and have to fail fork().
+	 */
+	if (!follow_phys(vma, vma->vm_start, 0, &prot, paddr)) {
+		if (pgprot)
+			*pgprot = __pgprot(prot);
+		return 0;
+	}
+	if (is_cow_mapping(vma->vm_flags)) {
+		if (pgprot)
+			return -EINVAL;
+		*paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT;
+		return 0;
+	}
+	WARN_ON_ONCE(1);
+	return -EINVAL;
+}
+
 /*
  * track_pfn_copy is called when vma that is covering the pfnmap gets
  * copied through copy_page_range().
@@ -960,20 +992,13 @@
 int track_pfn_copy(struct vm_area_struct *vma)
 {
 	resource_size_t paddr;
-	unsigned long prot;
 	unsigned long vma_size = vma->vm_end - vma->vm_start;
 	pgprot_t pgprot;
 
 	if (vma->vm_flags & VM_PAT) {
-		/*
-		 * reserve the whole chunk covered by vma. We need the
-		 * starting address and protection from pte.
-		 */
-		if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
-			WARN_ON_ONCE(1);
+		if (get_pat_info(vma, &paddr, &pgprot))
 			return -EINVAL;
-		}
-		pgprot = __pgprot(prot);
+		/* reserve the whole chunk covered by vma. */
 		return reserve_pfn_range(paddr, vma_size, &pgprot, 1);
 	}
 
@@ -1048,7 +1073,6 @@
 		 unsigned long size, bool mm_wr_locked)
 {
 	resource_size_t paddr;
-	unsigned long prot;
 
 	if (vma && !(vma->vm_flags & VM_PAT))
 		return;
@@ -1056,11 +1080,8 @@
 	/* free the chunk starting from pfn or the whole chunk */
 	paddr = (resource_size_t)pfn << PAGE_SHIFT;
 	if (!paddr && !size) {
-		if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
-			WARN_ON_ONCE(1);
+		if (get_pat_info(vma, &paddr, NULL))
 			return;
-		}
-
 		size = vma->vm_end - vma->vm_start;
 	}
 	free_pfn_range(paddr, size);
--- linux-qcom-6.8.0.orig/arch/x86/mm/pat/set_memory.c
+++ linux-qcom-6.8.0/arch/x86/mm/pat/set_memory.c
@@ -619,7 +619,8 @@
  * Validate strict W^X semantics.
  */
 static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long start,
-				  unsigned long pfn, unsigned long npg)
+				  unsigned long pfn, unsigned long npg,
+				  bool nx, bool rw)
 {
 	unsigned long end;
 
@@ -641,6 +642,10 @@
 	if ((pgprot_val(new) & (_PAGE_RW | _PAGE_NX)) != _PAGE_RW)
 		return new;
 
+	/* Non-leaf translation entries can disable writing or execution. */
+	if (!rw || nx)
+		return new;
+
 	end = start + npg * PAGE_SIZE - 1;
 	WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
 		  (unsigned long long)pgprot_val(old),
@@ -657,20 +662,26 @@
 
 /*
  * Lookup the page table entry for a virtual address in a specific pgd.
- * Return a pointer to the entry and the level of the mapping.
+ * Return a pointer to the entry, the level of the mapping, and the effective
+ * NX and RW bits of all page table levels.
  */
-pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
-			     unsigned int *level)
+pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
+				  unsigned int *level, bool *nx, bool *rw)
 {
 	p4d_t *p4d;
 	pud_t *pud;
 	pmd_t *pmd;
 
 	*level = PG_LEVEL_NONE;
+	*nx = false;
+	*rw = true;
 
 	if (pgd_none(*pgd))
 		return NULL;
 
+	*nx |= pgd_flags(*pgd) & _PAGE_NX;
+	*rw &= pgd_flags(*pgd) & _PAGE_RW;
+
 	p4d = p4d_offset(pgd, address);
 	if (p4d_none(*p4d))
 		return NULL;
@@ -679,14 +690,20 @@
 	if (p4d_large(*p4d) || !p4d_present(*p4d))
 		return (pte_t *)p4d;
 
+	*nx |= p4d_flags(*p4d) & _PAGE_NX;
+	*rw &= p4d_flags(*p4d) & _PAGE_RW;
+
 	pud = pud_offset(p4d, address);
 	if (pud_none(*pud))
 		return NULL;
 
 	*level = PG_LEVEL_1G;
-	if (pud_large(*pud) || !pud_present(*pud))
+	if (pud_leaf(*pud) || !pud_present(*pud))
 		return (pte_t *)pud;
 
+	*nx |= pud_flags(*pud) & _PAGE_NX;
+	*rw &= pud_flags(*pud) & _PAGE_RW;
+
 	pmd = pmd_offset(pud, address);
 	if (pmd_none(*pmd))
 		return NULL;
@@ -695,12 +712,27 @@
 	if (pmd_large(*pmd) || !pmd_present(*pmd))
 		return (pte_t *)pmd;
 
+	*nx |= pmd_flags(*pmd) & _PAGE_NX;
+	*rw &= pmd_flags(*pmd) & _PAGE_RW;
+
 	*level = PG_LEVEL_4K;
 
 	return pte_offset_kernel(pmd, address);
 }
 
 /*
+ * Lookup the page table entry for a virtual address in a specific pgd.
+ * Return a pointer to the entry and the level of the mapping.
+ */
+pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
+			     unsigned int *level)
+{
+	bool nx, rw;
+
+	return lookup_address_in_pgd_attr(pgd, address, level, &nx, &rw);
+}
+
+/*
  * Lookup the page table entry for a virtual address. Return a pointer
  * to the entry and the level of the mapping.
  *
@@ -715,13 +747,16 @@
 EXPORT_SYMBOL_GPL(lookup_address);
 
 static pte_t *_lookup_address_cpa(struct cpa_data *cpa, unsigned long address,
-				  unsigned int *level)
+				  unsigned int *level, bool *nx, bool *rw)
 {
-	if (cpa->pgd)
-		return lookup_address_in_pgd(cpa->pgd + pgd_index(address),
-					       address, level);
+	pgd_t *pgd;
 
-	return lookup_address(address, level);
+	if (!cpa->pgd)
+		pgd = pgd_offset_k(address);
+	else
+		pgd = cpa->pgd + pgd_index(address);
+
+	return lookup_address_in_pgd_attr(pgd, address, level, nx, rw);
 }
 
 /*
@@ -743,7 +778,7 @@
 		return NULL;
 
 	pud = pud_offset(p4d, address);
-	if (pud_none(*pud) || pud_large(*pud) || !pud_present(*pud))
+	if (pud_none(*pud) || pud_leaf(*pud) || !pud_present(*pud))
 		return NULL;
 
 	return pmd_offset(pud, address);
@@ -849,12 +884,13 @@
 	pgprot_t old_prot, new_prot, req_prot, chk_prot;
 	pte_t new_pte, *tmp;
 	enum pg_level level;
+	bool nx, rw;
 
 	/*
 	 * Check for races, another CPU might have split this page
 	 * up already:
 	 */
-	tmp = _lookup_address_cpa(cpa, address, &level);
+	tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
 	if (tmp != kpte)
 		return 1;
 
@@ -965,7 +1001,8 @@
 	new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages,
 				      psize, CPA_DETECT);
 
-	new_prot = verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages);
+	new_prot = verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages,
+			      nx, rw);
 
 	/*
 	 * If there is a conflict, split the large page.
@@ -1046,6 +1083,7 @@
 	pte_t *pbase = (pte_t *)page_address(base);
 	unsigned int i, level;
 	pgprot_t ref_prot;
+	bool nx, rw;
 	pte_t *tmp;
 
 	spin_lock(&pgd_lock);
@@ -1053,7 +1091,7 @@
 	 * Check for races, another CPU might have split this page
 	 * up for us already:
 	 */
-	tmp = _lookup_address_cpa(cpa, address, &level);
+	tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
 	if (tmp != kpte) {
 		spin_unlock(&pgd_lock);
 		return 1;
@@ -1278,7 +1316,7 @@
 	 */
 	while (end - start >= PUD_SIZE) {
 
-		if (pud_large(*pud))
+		if (pud_leaf(*pud))
 			pud_clear(pud);
 		else
 			unmap_pmd_range(pud, start, start + PUD_SIZE);
@@ -1594,10 +1632,11 @@
 	int do_split, err;
 	unsigned int level;
 	pte_t *kpte, old_pte;
+	bool nx, rw;
 
 	address = __cpa_addr(cpa, cpa->curpage);
 repeat:
-	kpte = _lookup_address_cpa(cpa, address, &level);
+	kpte = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
 	if (!kpte)
 		return __cpa_process_fault(cpa, address, primary);
 
@@ -1619,7 +1658,8 @@
 		new_prot = static_protections(new_prot, address, pfn, 1, 0,
 					      CPA_PROTECT);
 
-		new_prot = verify_rwx(old_prot, new_prot, address, pfn, 1);
+		new_prot = verify_rwx(old_prot, new_prot, address, pfn, 1,
+				      nx, rw);
 
 		new_prot = pgprot_clear_protnone_bits(new_prot);
 
@@ -2156,8 +2196,9 @@
 		cpa_flush(&cpa, x86_platform.guest.enc_cache_flush_required());
 
 	/* Notify hypervisor that we are about to set/clr encryption attribute. */
-	if (!x86_platform.guest.enc_status_change_prepare(addr, numpages, enc))
-		return -EIO;
+	ret = x86_platform.guest.enc_status_change_prepare(addr, numpages, enc);
+	if (ret)
+		goto vmm_fail;
 
 	ret = __change_page_attr_set_clr(&cpa, 1);
 
@@ -2170,21 +2211,65 @@
 	 */
 	cpa_flush(&cpa, 0);
 
+	if (ret)
+		return ret;
+
 	/* Notify hypervisor that we have successfully set/clr encryption attribute. */
-	if (!ret) {
-		if (!x86_platform.guest.enc_status_change_finish(addr, numpages, enc))
-			ret = -EIO;
-	}
+	ret = x86_platform.guest.enc_status_change_finish(addr, numpages, enc);
+	if (ret)
+		goto vmm_fail;
+
+	return 0;
+
+vmm_fail:
+	WARN_ONCE(1, "CPA VMM failure to convert memory (addr=%p, numpages=%d) to %s: %d\n",
+		  (void *)addr, numpages, enc ? "private" : "shared", ret);
 
 	return ret;
 }
 
+/*
+ * The lock serializes conversions between private and shared memory.
+ *
+ * It is taken for read on conversion. A write lock guarantees that no
+ * concurrent conversions are in progress.
+ */
+static DECLARE_RWSEM(mem_enc_lock);
+
+/*
+ * Stop new private<->shared conversions.
+ *
+ * Taking the exclusive mem_enc_lock waits for in-flight conversions to complete.
+ * The lock is not released to prevent new conversions from being started.
+ */
+bool set_memory_enc_stop_conversion(void)
+{
+	/*
+	 * In a crash scenario, sleep is not allowed. Try to take the lock.
+	 * Failure indicates that there is a race with the conversion.
+	 */
+	if (oops_in_progress)
+		return down_write_trylock(&mem_enc_lock);
+
+	down_write(&mem_enc_lock);
+
+	return true;
+}
+
 static int __set_memory_enc_dec(unsigned long addr, int numpages, bool enc)
 {
-	if (cc_platform_has(CC_ATTR_MEM_ENCRYPT))
-		return __set_memory_enc_pgtable(addr, numpages, enc);
+	int ret = 0;
 
-	return 0;
+	if (cc_platform_has(CC_ATTR_MEM_ENCRYPT)) {
+		if (!down_read_trylock(&mem_enc_lock))
+			return -EBUSY;
+
+		ret = __set_memory_enc_pgtable(addr, numpages, enc);
+
+		up_read(&mem_enc_lock);
+	}
+
+	return ret;
 }
 
 int set_memory_encrypted(unsigned long addr, int numpages)
--- linux-qcom-6.8.0.orig/arch/x86/mm/pgtable.c
+++ linux-qcom-6.8.0/arch/x86/mm/pgtable.c
@@ -631,6 +631,8 @@
 pmd_t pmdp_invalidate_ad(struct vm_area_struct *vma, unsigned long address,
 			 pmd_t *pmdp)
 {
+	VM_WARN_ON_ONCE(!pmd_present(*pmdp));
+
 	/*
 	 * No flush is necessary. Once an invalid PTE is established, the PTE's
 	 * access and dirty bits cannot be updated.
@@ -777,7 +779,7 @@
  */
 int pud_clear_huge(pud_t *pud)
 {
-	if (pud_large(*pud)) {
+	if (pud_leaf(*pud)) {
 		pud_clear(pud);
 		return 1;
 	}
--- linux-qcom-6.8.0.orig/arch/x86/mm/pti.c
+++ linux-qcom-6.8.0/arch/x86/mm/pti.c
@@ -132,7 +132,7 @@
 	 * Top-level entries added to init_mm's usermode pgd after boot
 	 * will not be automatically propagated to other mms.
 	 */
-	if (!pgdp_maps_userspace(pgdp))
+	if (!pgdp_maps_userspace(pgdp) || (pgd.pgd & _PAGE_NOPTISHADOW))
 		return pgd;
 
 	/*
@@ -217,7 +217,7 @@
 
 	pud = pud_offset(p4d, address);
 	/* The user page tables do not use large mappings: */
-	if (pud_large(*pud)) {
+	if (pud_leaf(*pud)) {
 		WARN_ON(1);
 		return NULL;
 	}
@@ -241,7 +241,7 @@
  *
  * Returns a pointer to a PTE on success, or NULL on failure.
  */
-static pte_t *pti_user_pagetable_walk_pte(unsigned long address)
+static pte_t *pti_user_pagetable_walk_pte(unsigned long address, bool late_text)
 {
 	gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
 	pmd_t *pmd;
@@ -251,10 +251,15 @@
 	if (!pmd)
 		return NULL;
 
-	/* We can't do anything sensible if we hit a large mapping. */
+	/* Large PMD mapping found */
 	if (pmd_large(*pmd)) {
-		WARN_ON(1);
-		return NULL;
+		/* Clear the PMD if we hit a large mapping from the first round */
+		if (late_text) {
+			set_pmd(pmd, __pmd(0));
+		} else {
+			WARN_ON_ONCE(1);
+			return NULL;
+		}
 	}
 
 	if (pmd_none(*pmd)) {
@@ -283,7 +288,7 @@
 	if (!pte || WARN_ON(level != PG_LEVEL_4K) || pte_none(*pte))
 		return;
 
-	target_pte = pti_user_pagetable_walk_pte(VSYSCALL_ADDR);
+	target_pte = pti_user_pagetable_walk_pte(VSYSCALL_ADDR, false);
 	if (WARN_ON(!target_pte))
 		return;
 
@@ -301,7 +306,7 @@
 
 static void
 pti_clone_pgtable(unsigned long start, unsigned long end,
-		  enum pti_clone_level level)
+		  enum pti_clone_level level, bool late_text)
 {
 	unsigned long addr;
 
@@ -374,14 +379,14 @@
 			 */
 			*target_pmd = *pmd;
 
-			addr += PMD_SIZE;
+			addr = round_up(addr + 1, PMD_SIZE);
 
 		} else if (level == PTI_CLONE_PTE) {
 
 			/* Walk the page-table down to the pte level */
 			pte = pte_offset_kernel(pmd, addr);
 			if (pte_none(*pte)) {
-				addr += PAGE_SIZE;
+				addr = round_up(addr + 1, PAGE_SIZE);
 				continue;
 			}
 
@@ -390,7 +395,7 @@
 				return;
 
 			/* Allocate PTE in the user page-table */
-			target_pte = pti_user_pagetable_walk_pte(addr);
+			target_pte = pti_user_pagetable_walk_pte(addr, late_text);
 			if (WARN_ON(!target_pte))
 				return;
 
@@ -401,7 +406,7 @@
 			/* Clone the PTE */
 			*target_pte = *pte;
 
-			addr += PAGE_SIZE;
+			addr = round_up(addr + 1, PAGE_SIZE);
 
 		} else {
 			BUG();
@@ -452,7 +457,7 @@
 		phys_addr_t pa = per_cpu_ptr_to_phys((void *)va);
 		pte_t *target_pte;
 
-		target_pte = pti_user_pagetable_walk_pte(va);
+		target_pte = pti_user_pagetable_walk_pte(va, false);
 		if (WARN_ON(!target_pte))
 			return;
 
@@ -475,7 +480,7 @@
 	start = CPU_ENTRY_AREA_BASE;
 	end   = start + (PAGE_SIZE * CPU_ENTRY_AREA_PAGES);
 
-	pti_clone_pgtable(start, end, PTI_CLONE_PMD);
+	pti_clone_pgtable(start, end, PTI_CLONE_PMD, false);
 }
 #endif /* CONFIG_X86_64 */
 
@@ -492,11 +497,11 @@
 /*
  * Clone the populated PMDs of the entry text and force it RO.
  */
-static void pti_clone_entry_text(void)
+static void pti_clone_entry_text(bool late)
 {
 	pti_clone_pgtable((unsigned long) __entry_text_start,
 			  (unsigned long) __entry_text_end,
-			  PTI_CLONE_PMD);
+			  PTI_LEVEL_KERNEL_IMAGE, late);
 }
 
 /*
@@ -571,7 +576,7 @@
 	 * pti_set_kernel_image_nonglobal() did to clear the
 	 * global bit.
 	 */
-	pti_clone_pgtable(start, end_clone, PTI_LEVEL_KERNEL_IMAGE);
+	pti_clone_pgtable(start, end_clone, PTI_LEVEL_KERNEL_IMAGE, false);
 
 	/*
 	 * pti_clone_pgtable() will set the global bit in any PMDs
@@ -638,8 +643,15 @@
 
 	/* Undo all global bits from the init pagetables in head_64.S: */
 	pti_set_kernel_image_nonglobal();
+
 	/* Replace some of the global bits just for shared entry text: */
-	pti_clone_entry_text();
+	/*
+	 * This is very early in boot. Device and Late initcalls can do
+	 * modprobe before free_initmem() and mark_readonly(). This
+	 * pti_clone_entry_text() allows those user-mode-helpers to function,
+	 * but notably the text is still RW.
+	 */
+	pti_clone_entry_text(false);
 	pti_setup_espfix64();
 	pti_setup_vsyscall();
 }
@@ -656,10 +668,11 @@
 	if (!boot_cpu_has(X86_FEATURE_PTI))
 		return;
 	/*
-	 * We need to clone everything (again) that maps parts of the
-	 * kernel image.
+	 * This is after free_initmem() (all initcalls are done) and we've done
+	 * mark_readonly(). Text is now NX which might've split some PMDs
+	 * relative to the early clone.
 	 */
-	pti_clone_entry_text();
+	pti_clone_entry_text(true);
 	pti_clone_kernel_text();
 
 	debug_checkwx_user();
--- linux-qcom-6.8.0.orig/arch/x86/mm/tlb.c
+++ linux-qcom-6.8.0/arch/x86/mm/tlb.c
@@ -19,6 +19,7 @@
 #include <asm/cacheflush.h>
 #include <asm/apic.h>
 #include <asm/perf_event.h>
+#include <asm/tlb.h>
 
 #include "mm_internal.h"
 
@@ -497,9 +498,9 @@
 {
 	struct mm_struct *real_prev = this_cpu_read(cpu_tlbstate.loaded_mm);
 	u16 prev_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
-	unsigned long new_lam = mm_lam_cr3_mask(next);
 	bool was_lazy = this_cpu_read(cpu_tlbstate_shared.is_lazy);
 	unsigned cpu = smp_processor_id();
+	unsigned long new_lam;
 	u64 next_tlb_gen;
 	bool need_flush;
 	u16 new_asid;
@@ -622,9 +623,7 @@
 			cpumask_clear_cpu(cpu, mm_cpumask(real_prev));
 		}
 
-		/*
-		 * Start remote flushes and then read tlb_gen.
-		 */
+		/* Start receiving IPIs and then read tlb_gen (and LAM below) */
 		if (next != &init_mm)
 			cpumask_set_cpu(cpu, mm_cpumask(next));
 		next_tlb_gen = atomic64_read(&next->context.tlb_gen);
@@ -636,6 +635,7 @@
 		barrier();
 	}
 
+	new_lam = mm_lam_cr3_mask(next);
 	set_tlbstate_lam_mode(next);
 	if (need_flush) {
 		this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);
@@ -1146,7 +1146,7 @@
 	bool cpu_pcide;
 
 	/* Flush 'addr' from the kernel PCID: */
-	asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
+	invlpg(addr);
 
 	/* If PTI is off there is no user PCID and nothing to flush. */
 	if (!static_cpu_has(X86_FEATURE_PTI))
--- linux-qcom-6.8.0.orig/arch/x86/net/bpf_jit_comp.c
+++ linux-qcom-6.8.0/arch/x86/net/bpf_jit_comp.c
@@ -64,6 +64,56 @@
 	return value <= 127 && value >= -128;
 }
 
+/*
+ * Let us limit the positive offset to be <= 123.
+ * This is to ensure eventual jit convergence For the following patterns:
+ * ...
+ * pass4, final_proglen=4391:
+ *   ...
+ *   20e:    48 85 ff                test   rdi,rdi
+ *   211:    74 7d                   je     0x290
+ *   213:    48 8b 77 00             mov    rsi,QWORD PTR [rdi+0x0]
+ *   ...
+ *   289:    48 85 ff                test   rdi,rdi
+ *   28c:    74 17                   je     0x2a5
+ *   28e:    e9 7f ff ff ff          jmp    0x212
+ *   293:    bf 03 00 00 00          mov    edi,0x3
+ * Note that insn at 0x211 is 2-byte cond jump insn for offset 0x7d (-125)
+ * and insn at 0x28e is 5-byte jmp insn with offset -129.
+ *
+ * pass5, final_proglen=4392:
+ *   ...
+ *   20e:    48 85 ff                test   rdi,rdi
+ *   211:    0f 84 80 00 00 00       je     0x297
+ *   217:    48 8b 77 00             mov    rsi,QWORD PTR [rdi+0x0]
+ *   ...
+ *   28d:    48 85 ff                test   rdi,rdi
+ *   290:    74 1a                   je     0x2ac
+ *   292:    eb 84                   jmp    0x218
+ *   294:    bf 03 00 00 00          mov    edi,0x3
+ * Note that insn at 0x211 is 6-byte cond jump insn now since its offset
+ * becomes 0x80 based on previous round (0x293 - 0x213 = 0x80).
+ * At the same time, insn at 0x292 is a 2-byte insn since its offset is
+ * -124.
+ *
+ * pass6 will repeat the same code as in pass4 and this will prevent
+ * eventual convergence.
+ *
+ * To fix this issue, we need to break je (2->6 bytes) <-> jmp (5->2 bytes)
+ * cycle in the above. In the above example je offset <= 0x7c should work.
+ *
+ * For other cases, je <-> je needs offset <= 0x7b to avoid no convergence
+ * issue. For jmp <-> je and jmp <-> jmp cases, jmp offset <= 0x7c should
+ * avoid no convergence issue.
+ *
+ * Overall, let us limit the positive offset for 8bit cond/uncond jmp insn
+ * to maximum 123 (0x7b). This way, the jit pass can eventually converge.
+ */
+static bool is_imm8_jmp_offset(int value)
+{
+	return value <= 123 && value >= -128;
+}
+
 static bool is_simm32(s64 value)
 {
 	return value == (s64)(s32)value;
@@ -259,7 +309,7 @@
 /* Number of bytes emit_patch() needs to generate instructions */
 #define X86_PATCH_SIZE		5
 /* Number of bytes that will be skipped on tailcall */
-#define X86_TAIL_CALL_OFFSET	(11 + ENDBR_INSN_SIZE)
+#define X86_TAIL_CALL_OFFSET	(12 + ENDBR_INSN_SIZE)
 
 static void push_r12(u8 **pprog)
 {
@@ -389,6 +439,37 @@
 	*pprog = prog;
 }
 
+static void emit_prologue_tail_call(u8 **pprog, bool is_subprog)
+{
+	u8 *prog = *pprog;
+
+	if (!is_subprog) {
+		/* cmp rax, MAX_TAIL_CALL_CNT */
+		EMIT4(0x48, 0x83, 0xF8, MAX_TAIL_CALL_CNT);
+		EMIT2(X86_JA, 6);        /* ja 6 */
+		/* rax is tail_call_cnt if <= MAX_TAIL_CALL_CNT.
+		 * case1: entry of main prog.
+		 * case2: tail callee of main prog.
+		 */
+		EMIT1(0x50);             /* push rax */
+		/* Make rax as tail_call_cnt_ptr. */
+		EMIT3(0x48, 0x89, 0xE0); /* mov rax, rsp */
+		EMIT2(0xEB, 1);          /* jmp 1 */
+		/* rax is tail_call_cnt_ptr if > MAX_TAIL_CALL_CNT.
+		 * case: tail callee of subprog.
+		 */
+		EMIT1(0x50);             /* push rax */
+		/* push tail_call_cnt_ptr */
+		EMIT1(0x50);             /* push rax */
+	} else { /* is_subprog */
+		/* rax is tail_call_cnt_ptr. */
+		EMIT1(0x50);             /* push rax */
+		EMIT1(0x50);             /* push rax */
+	}
+
+	*pprog = prog;
+}
+
 /*
  * Emit x86-64 prologue code for BPF program.
  * bpf_tail_call helper will skip the first X86_TAIL_CALL_OFFSET bytes
@@ -410,10 +491,10 @@
 			/* When it's the entry of the whole tailcall context,
 			 * zeroing rax means initialising tail_call_cnt.
 			 */
-			EMIT2(0x31, 0xC0); /* xor eax, eax */
+			EMIT3(0x48, 0x31, 0xC0); /* xor rax, rax */
 		else
 			/* Keep the same instruction layout. */
-			EMIT2(0x66, 0x90); /* nop2 */
+			emit_nops(&prog, 3);     /* nop3 */
 	}
 	/* Exception callback receives FP as third parameter */
 	if (is_exception_cb) {
@@ -439,7 +520,7 @@
 	if (stack_depth)
 		EMIT3_off32(0x48, 0x81, 0xEC, round_up(stack_depth, 8));
 	if (tail_call_reachable)
-		EMIT1(0x50);         /* push rax */
+		emit_prologue_tail_call(&prog, is_subprog);
 	*pprog = prog;
 }
 
@@ -466,7 +547,7 @@
 static int emit_rsb_call(u8 **pprog, void *func, void *ip)
 {
 	OPTIMIZER_HIDE_VAR(func);
-	x86_call_depth_emit_accounting(pprog, func);
+	ip += x86_call_depth_emit_accounting(pprog, func);
 	return emit_patch(pprog, func, ip, 0xE8);
 }
 
@@ -575,13 +656,15 @@
 	*pprog = prog;
 }
 
+#define BPF_TAIL_CALL_CNT_PTR_STACK_OFF(stack)	(-16 - round_up(stack, 8))
+
 /*
  * Generate the following code:
  *
  * ... bpf_tail_call(void *ctx, struct bpf_array *array, u64 index) ...
  *   if (index >= array->map.max_entries)
  *     goto out;
- *   if (tail_call_cnt++ >= MAX_TAIL_CALL_CNT)
+ *   if ((*tcc_ptr)++ >= MAX_TAIL_CALL_CNT)
  *     goto out;
  *   prog = array->ptrs[index];
  *   if (prog == NULL)
@@ -594,7 +677,7 @@
 					u32 stack_depth, u8 *ip,
 					struct jit_context *ctx)
 {
-	int tcc_off = -4 - round_up(stack_depth, 8);
+	int tcc_ptr_off = BPF_TAIL_CALL_CNT_PTR_STACK_OFF(stack_depth);
 	u8 *prog = *pprog, *start = *pprog;
 	int offset;
 
@@ -616,16 +699,14 @@
 	EMIT2(X86_JBE, offset);                   /* jbe out */
 
 	/*
-	 * if (tail_call_cnt++ >= MAX_TAIL_CALL_CNT)
+	 * if ((*tcc_ptr)++ >= MAX_TAIL_CALL_CNT)
 	 *	goto out;
 	 */
-	EMIT2_off32(0x8B, 0x85, tcc_off);         /* mov eax, dword ptr [rbp - tcc_off] */
-	EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT);     /* cmp eax, MAX_TAIL_CALL_CNT */
+	EMIT3_off32(0x48, 0x8B, 0x85, tcc_ptr_off); /* mov rax, qword ptr [rbp - tcc_ptr_off] */
+	EMIT4(0x48, 0x83, 0x38, MAX_TAIL_CALL_CNT); /* cmp qword ptr [rax], MAX_TAIL_CALL_CNT */
 
 	offset = ctx->tail_call_indirect_label - (prog + 2 - start);
 	EMIT2(X86_JAE, offset);                   /* jae out */
-	EMIT3(0x83, 0xC0, 0x01);                  /* add eax, 1 */
-	EMIT2_off32(0x89, 0x85, tcc_off);         /* mov dword ptr [rbp - tcc_off], eax */
 
 	/* prog = array->ptrs[index]; */
 	EMIT4_off32(0x48, 0x8B, 0x8C, 0xD6,       /* mov rcx, [rsi + rdx * 8 + offsetof(...)] */
@@ -640,6 +721,9 @@
 	offset = ctx->tail_call_indirect_label - (prog + 2 - start);
 	EMIT2(X86_JE, offset);                    /* je out */
 
+	/* Inc tail_call_cnt if the slot is populated. */
+	EMIT4(0x48, 0x83, 0x00, 0x01);            /* add qword ptr [rax], 1 */
+
 	if (bpf_prog->aux->exception_boundary) {
 		pop_callee_regs(&prog, all_callee_regs_used);
 		pop_r12(&prog);
@@ -647,6 +731,11 @@
 		pop_callee_regs(&prog, callee_regs_used);
 	}
 
+	/* Pop tail_call_cnt_ptr. */
+	EMIT1(0x58);                              /* pop rax */
+	/* Pop tail_call_cnt, if it's main prog.
+	 * Pop tail_call_cnt_ptr, if it's subprog.
+	 */
 	EMIT1(0x58);                              /* pop rax */
 	if (stack_depth)
 		EMIT3_off32(0x48, 0x81, 0xC4,     /* add rsp, sd */
@@ -675,21 +764,19 @@
 				      bool *callee_regs_used, u32 stack_depth,
 				      struct jit_context *ctx)
 {
-	int tcc_off = -4 - round_up(stack_depth, 8);
+	int tcc_ptr_off = BPF_TAIL_CALL_CNT_PTR_STACK_OFF(stack_depth);
 	u8 *prog = *pprog, *start = *pprog;
 	int offset;
 
 	/*
-	 * if (tail_call_cnt++ >= MAX_TAIL_CALL_CNT)
+	 * if ((*tcc_ptr)++ >= MAX_TAIL_CALL_CNT)
 	 *	goto out;
 	 */
-	EMIT2_off32(0x8B, 0x85, tcc_off);             /* mov eax, dword ptr [rbp - tcc_off] */
-	EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT);         /* cmp eax, MAX_TAIL_CALL_CNT */
+	EMIT3_off32(0x48, 0x8B, 0x85, tcc_ptr_off);   /* mov rax, qword ptr [rbp - tcc_ptr_off] */
+	EMIT4(0x48, 0x83, 0x38, MAX_TAIL_CALL_CNT);   /* cmp qword ptr [rax], MAX_TAIL_CALL_CNT */
 
 	offset = ctx->tail_call_direct_label - (prog + 2 - start);
 	EMIT2(X86_JAE, offset);                       /* jae out */
-	EMIT3(0x83, 0xC0, 0x01);                      /* add eax, 1 */
-	EMIT2_off32(0x89, 0x85, tcc_off);             /* mov dword ptr [rbp - tcc_off], eax */
 
 	poke->tailcall_bypass = ip + (prog - start);
 	poke->adj_off = X86_TAIL_CALL_OFFSET;
@@ -699,6 +786,9 @@
 	emit_jump(&prog, (u8 *)poke->tailcall_target + X86_PATCH_SIZE,
 		  poke->tailcall_bypass);
 
+	/* Inc tail_call_cnt if the slot is populated. */
+	EMIT4(0x48, 0x83, 0x00, 0x01);                /* add qword ptr [rax], 1 */
+
 	if (bpf_prog->aux->exception_boundary) {
 		pop_callee_regs(&prog, all_callee_regs_used);
 		pop_r12(&prog);
@@ -706,6 +796,11 @@
 		pop_callee_regs(&prog, callee_regs_used);
 	}
 
+	/* Pop tail_call_cnt_ptr. */
+	EMIT1(0x58);                                  /* pop rax */
+	/* Pop tail_call_cnt, if it's main prog.
+	 * Pop tail_call_cnt_ptr, if it's subprog.
+	 */
 	EMIT1(0x58);                                  /* pop rax */
 	if (stack_depth)
 		EMIT3_off32(0x48, 0x81, 0xC4, round_up(stack_depth, 8));
@@ -1133,9 +1228,11 @@
 
 #define INSN_SZ_DIFF (((addrs[i] - addrs[i - 1]) - (prog - temp)))
 
-/* mov rax, qword ptr [rbp - rounded_stack_depth - 8] */
-#define RESTORE_TAIL_CALL_CNT(stack)				\
-	EMIT3_off32(0x48, 0x8B, 0x85, -round_up(stack, 8) - 8)
+#define __LOAD_TCC_PTR(off)			\
+	EMIT3_off32(0x48, 0x8B, 0x85, off)
+/* mov rax, qword ptr [rbp - rounded_stack_depth - 16] */
+#define LOAD_TAIL_CALL_CNT_PTR(stack)				\
+	__LOAD_TCC_PTR(BPF_TAIL_CALL_CNT_PTR_STACK_OFF(stack))
 
 static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, u8 *rw_image,
 		  int oldproglen, struct jit_context *ctx, bool jmp_padding)
@@ -1585,36 +1682,41 @@
 			if (BPF_MODE(insn->code) == BPF_PROBE_MEM ||
 			    BPF_MODE(insn->code) == BPF_PROBE_MEMSX) {
 				/* Conservatively check that src_reg + insn->off is a kernel address:
-				 *   src_reg + insn->off >= TASK_SIZE_MAX + PAGE_SIZE
-				 * src_reg is used as scratch for src_reg += insn->off and restored
-				 * after emit_ldx if necessary
+				 *   src_reg + insn->off > TASK_SIZE_MAX + PAGE_SIZE
+				 *   and
+				 *   src_reg + insn->off < VSYSCALL_ADDR
 				 */
 
-				u64 limit = TASK_SIZE_MAX + PAGE_SIZE;
+				u64 limit = TASK_SIZE_MAX + PAGE_SIZE - VSYSCALL_ADDR;
 				u8 *end_of_jmp;
 
-				/* At end of these emitted checks, insn->off will have been added
-				 * to src_reg, so no need to do relative load with insn->off offset
-				 */
-				insn_off = 0;
+				/* movabsq r10, VSYSCALL_ADDR */
+				emit_mov_imm64(&prog, BPF_REG_AX, (long)VSYSCALL_ADDR >> 32,
+					       (u32)(long)VSYSCALL_ADDR);
 
-				/* movabsq r11, limit */
-				EMIT2(add_1mod(0x48, AUX_REG), add_1reg(0xB8, AUX_REG));
-				EMIT((u32)limit, 4);
-				EMIT(limit >> 32, 4);
+				/* mov src_reg, r11 */
+				EMIT_mov(AUX_REG, src_reg);
 
 				if (insn->off) {
-					/* add src_reg, insn->off */
-					maybe_emit_1mod(&prog, src_reg, true);
-					EMIT2_off32(0x81, add_1reg(0xC0, src_reg), insn->off);
+					/* add r11, insn->off */
+					maybe_emit_1mod(&prog, AUX_REG, true);
+					EMIT2_off32(0x81, add_1reg(0xC0, AUX_REG), insn->off);
 				}
 
-				/* cmp src_reg, r11 */
-				maybe_emit_mod(&prog, src_reg, AUX_REG, true);
-				EMIT2(0x39, add_2reg(0xC0, src_reg, AUX_REG));
+				/* sub r11, r10 */
+				maybe_emit_mod(&prog, AUX_REG, BPF_REG_AX, true);
+				EMIT2(0x29, add_2reg(0xC0, AUX_REG, BPF_REG_AX));
+
+				/* movabsq r10, limit */
+				emit_mov_imm64(&prog, BPF_REG_AX, (long)limit >> 32,
+					       (u32)(long)limit);
+
+				/* cmp r10, r11 */
+				maybe_emit_mod(&prog, AUX_REG, BPF_REG_AX, true);
+				EMIT2(0x39, add_2reg(0xC0, AUX_REG, BPF_REG_AX));
 
-				/* if unsigned '>=', goto load */
-				EMIT2(X86_JAE, 0);
+				/* if unsigned '>', goto load */
+				EMIT2(X86_JA, 0);
 				end_of_jmp = prog;
 
 				/* xor dst_reg, dst_reg */
@@ -1640,18 +1742,6 @@
 				/* populate jmp_offset for JMP above */
 				start_of_ldx[-1] = prog - start_of_ldx;
 
-				if (insn->off && src_reg != dst_reg) {
-					/* sub src_reg, insn->off
-					 * Restore src_reg after "add src_reg, insn->off" in prev
-					 * if statement. But if src_reg == dst_reg, emit_ldx
-					 * above already clobbered src_reg, so no need to restore.
-					 * If add src_reg, insn->off was unnecessary, no need to
-					 * restore either.
-					 */
-					maybe_emit_1mod(&prog, src_reg, true);
-					EMIT2_off32(0x81, add_1reg(0xE8, src_reg), insn->off);
-				}
-
 				if (!bpf_prog->aux->extable)
 					break;
 
@@ -1754,7 +1844,7 @@
 
 			func = (u8 *) __bpf_call_base + imm32;
 			if (tail_call_reachable) {
-				RESTORE_TAIL_CALL_CNT(bpf_prog->aux->stack_depth);
+				LOAD_TAIL_CALL_CNT_PTR(bpf_prog->aux->stack_depth);
 				if (!imm32)
 					return -EINVAL;
 				offs = 7 + x86_call_depth_emit_accounting(&prog, func);
@@ -1910,7 +2000,7 @@
 				return -EFAULT;
 			}
 			jmp_offset = addrs[i + insn->off] - addrs[i];
-			if (is_imm8(jmp_offset)) {
+			if (is_imm8_jmp_offset(jmp_offset)) {
 				if (jmp_padding) {
 					/* To keep the jmp_offset valid, the extra bytes are
 					 * padded before the jump insn, so we subtract the
@@ -1992,7 +2082,7 @@
 				break;
 			}
 emit_jmp:
-			if (is_imm8(jmp_offset)) {
+			if (is_imm8_jmp_offset(jmp_offset)) {
 				if (jmp_padding) {
 					/* To avoid breaking jmp_offset, the extra bytes
 					 * are padded before the actual jmp insn, so
@@ -2430,6 +2520,10 @@
 	return 0;
 }
 
+/* mov rax, qword ptr [rbp - rounded_stack_depth - 8] */
+#define LOAD_TRAMP_TAIL_CALL_CNT_PTR(stack)	\
+	__LOAD_TCC_PTR(-round_up(stack, 8) - 8)
+
 /* Example:
  * __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev);
  * its 'struct btf_func_model' will be nr_args=2
@@ -2550,7 +2644,7 @@
 	 *                     [ ...        ]
 	 *                     [ stack_arg2 ]
 	 * RBP - arg_stack_off [ stack_arg1 ]
-	 * RSP                 [ tail_call_cnt ] BPF_TRAMP_F_TAIL_CALL_CTX
+	 * RSP                 [ tail_call_cnt_ptr ] BPF_TRAMP_F_TAIL_CALL_CTX
 	 */
 
 	/* room for return value of orig_call or fentry prog */
@@ -2679,10 +2773,10 @@
 		save_args(m, &prog, arg_stack_off, true);
 
 		if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) {
-			/* Before calling the original function, restore the
-			 * tail_call_cnt from stack to rax.
+			/* Before calling the original function, load the
+			 * tail_call_cnt_ptr from stack to rax.
 			 */
-			RESTORE_TAIL_CALL_CNT(stack_size);
+			LOAD_TRAMP_TAIL_CALL_CNT_PTR(stack_size);
 		}
 
 		if (flags & BPF_TRAMP_F_ORIG_STACK) {
@@ -2741,10 +2835,10 @@
 			goto cleanup;
 		}
 	} else if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) {
-		/* Before running the original function, restore the
-		 * tail_call_cnt from stack to rax.
+		/* Before running the original function, load the
+		 * tail_call_cnt_ptr from stack to rax.
 		 */
-		RESTORE_TAIL_CALL_CNT(stack_size);
+		LOAD_TRAMP_TAIL_CALL_CNT_PTR(stack_size);
 	}
 
 	/* restore return value of orig_call or fentry prog back into RAX */
--- linux-qcom-6.8.0.orig/arch/x86/net/bpf_jit_comp32.c
+++ linux-qcom-6.8.0/arch/x86/net/bpf_jit_comp32.c
@@ -2600,8 +2600,7 @@
 	if (bpf_jit_enable > 1)
 		bpf_jit_dump(prog->len, proglen, pass + 1, image);
 
-	if (image) {
-		bpf_jit_binary_lock_ro(header);
+	if (image && !bpf_jit_binary_lock_ro(header)) {
 		prog->bpf_func = (void *)image;
 		prog->jited = 1;
 		prog->jited_len = proglen;
--- linux-qcom-6.8.0.orig/arch/x86/pci/acpi.c
+++ linux-qcom-6.8.0/arch/x86/pci/acpi.c
@@ -250,6 +250,125 @@
 		pr_info("Please notify linux-pci@vger.kernel.org so future kernels can do this automatically\n");
 }
 
+/*
+ * Check if pdev is part of a PCIe switch that is directly below the
+ * specified bridge.
+ */
+static bool pcie_switch_directly_under(struct pci_dev *bridge,
+				       struct pci_dev *pdev)
+{
+	struct pci_dev *parent = pci_upstream_bridge(pdev);
+
+	/* If the device doesn't have a parent, it's not under anything */
+	if (!parent)
+		return false;
+
+	/*
+	 * If the device has a PCIe type, check if it is below the
+	 * corresponding PCIe switch components (if applicable). Then check
+	 * if its upstream port is directly beneath the specified bridge.
+	 */
+	switch (pci_pcie_type(pdev)) {
+	case PCI_EXP_TYPE_UPSTREAM:
+		return parent == bridge;
+
+	case PCI_EXP_TYPE_DOWNSTREAM:
+		if (pci_pcie_type(parent) != PCI_EXP_TYPE_UPSTREAM)
+			return false;
+		parent = pci_upstream_bridge(parent);
+		return parent == bridge;
+
+	case PCI_EXP_TYPE_ENDPOINT:
+		if (pci_pcie_type(parent) != PCI_EXP_TYPE_DOWNSTREAM)
+			return false;
+		parent = pci_upstream_bridge(parent);
+		if (!parent || pci_pcie_type(parent) != PCI_EXP_TYPE_UPSTREAM)
+			return false;
+		parent = pci_upstream_bridge(parent);
+		return parent == bridge;
+	}
+
+	return false;
+}
+
+static bool pcie_has_usb4_host_interface(struct pci_dev *pdev)
+{
+	struct fwnode_handle *fwnode;
+
+	/*
+	 * For USB4, the tunneled PCIe Root or Downstream Ports are marked
+	 * with the "usb4-host-interface" ACPI property, so we look for
+	 * that first. This should cover most cases.
+	 */
+	fwnode = fwnode_find_reference(dev_fwnode(&pdev->dev),
+				       "usb4-host-interface", 0);
+	if (!IS_ERR(fwnode)) {
+		fwnode_handle_put(fwnode);
+		return true;
+	}
+
+	/*
+	 * Any integrated Thunderbolt 3/4 PCIe Root Ports from Intel
+	 * before Alder Lake do not have the "usb4-host-interface"
+	 * property so we use their PCI IDs instead. All these are
+	 * tunneled. This list is not expected to grow.
+	 */
+	if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
+		switch (pdev->device) {
+		/* Ice Lake Thunderbolt 3 PCIe Root Ports */
+		case 0x8a1d:
+		case 0x8a1f:
+		case 0x8a21:
+		case 0x8a23:
+		/* Tiger Lake-LP Thunderbolt 4 PCIe Root Ports */
+		case 0x9a23:
+		case 0x9a25:
+		case 0x9a27:
+		case 0x9a29:
+		/* Tiger Lake-H Thunderbolt 4 PCIe Root Ports */
+		case 0x9a2b:
+		case 0x9a2d:
+		case 0x9a2f:
+		case 0x9a31:
+			return true;
+		}
+	}
+
+	return false;
+}
+
+bool arch_pci_dev_is_removable(struct pci_dev *pdev)
+{
+	struct pci_dev *parent, *root;
+
+	/* pdev without a parent or Root Port is never tunneled */
+	parent = pci_upstream_bridge(pdev);
+	if (!parent)
+		return false;
+	root = pcie_find_root_port(pdev);
+	if (!root)
+		return false;
+
+	/* Internal PCIe devices are not tunneled */
+	if (!root->external_facing)
+		return false;
+
+	/* Anything directly behind a "usb4-host-interface" is tunneled */
+	if (pcie_has_usb4_host_interface(parent))
+		return true;
+
+	/*
+	 * Check if this is a discrete Thunderbolt/USB4 controller that is
+	 * directly behind the non-USB4 PCIe Root Port marked as
+	 * "ExternalFacingPort". Those are not behind a PCIe tunnel.
+	 */
+	if (pcie_switch_directly_under(root, pdev))
+		return false;
+
+	/* PCIe devices after the discrete chip are tunneled */
+	return true;
+}
+
 #ifdef	CONFIG_PCI_MMCONFIG
 static int check_segment(u16 seg, struct device *dev, char *estr)
 {
--- linux-qcom-6.8.0.orig/arch/x86/pci/common.c
+++ linux-qcom-6.8.0/arch/x86/pci/common.c
@@ -34,6 +34,7 @@
 #endif
 int pcibios_last_bus = -1;
 unsigned long pirq_table_addr;
+unsigned int pci_early_clear_msi;
 const struct pci_raw_ops *__read_mostly raw_pci_ops;
 const struct pci_raw_ops *__read_mostly raw_pci_ext_ops;
 
@@ -614,6 +615,9 @@
 	} else if (!strcmp(str, "skip_isa_align")) {
 		pci_probe |= PCI_CAN_SKIP_ISA_ALIGN;
 		return NULL;
+	} else if (!strcmp(str, "clearmsi")) {
+		pci_early_clear_msi = 1;
+		return NULL;
 	} else if (!strcmp(str, "noioapicquirk")) {
 		noioapicquirk = 1;
 		return NULL;
--- linux-qcom-6.8.0.orig/arch/x86/pci/early.c
+++ linux-qcom-6.8.0/arch/x86/pci/early.c
@@ -51,6 +51,31 @@
 	outw(val, 0xcfc + (offset&2));
 }
 
+u32 pci_early_find_cap(int bus, int slot, int func, int cap)
+{
+	int bytes;
+	u8 pos;
+
+	if (!(read_pci_config_16(bus, slot, func, PCI_STATUS) &
+						PCI_STATUS_CAP_LIST))
+		return 0;
+
+	pos = read_pci_config_byte(bus, slot, func, PCI_CAPABILITY_LIST);
+	for (bytes = 0; bytes < 48 && pos >= 0x40; bytes++) {
+		u8 id;
+
+		pos &= ~3;
+		id = read_pci_config_byte(bus, slot, func, pos+PCI_CAP_LIST_ID);
+		if (id == 0xff)
+			break;
+		if (id == cap)
+			return pos;
+		pos = read_pci_config_byte(bus, slot, func,
+						pos+PCI_CAP_LIST_NEXT);
+	}
+	return 0;
+}
+
 int early_pci_allowed(void)
 {
 	return (pci_probe & (PCI_PROBE_CONF1|PCI_PROBE_NOEARLY)) ==
--- linux-qcom-6.8.0.orig/arch/x86/pci/fixup.c
+++ linux-qcom-6.8.0/arch/x86/pci/fixup.c
@@ -907,6 +907,54 @@
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x5ad6, chromeos_save_apl_pci_l1ss_capability);
 DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, 0x5ad6, chromeos_fixup_apl_pci_l1ss_capability);
 
+/*
+ * Disable D3cold on Asus B1400 PCI-NVMe bridge
+ *
+ * On this platform with VMD off, the NVMe device cannot successfully power
+ * back on from D3cold. This appears to be an untested transition by the
+ * vendor: Windows leaves the NVMe and parent bridge in D0 during suspend.
+ *
+ * We disable D3cold on the parent bridge for simplicity, and the fact that
+ * both parent bridge and NVMe device share the same power resource.
+ *
+ * This is only needed on BIOS versions before 308; the newer versions flip
+ * StorageD3Enable from 1 to 0.
+ */
+static const struct dmi_system_id asus_nvme_broken_d3cold_table[] = {
+	{
+		.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+				DMI_MATCH(DMI_BIOS_VERSION, "B1400CEAE.304"),
+		},
+	},
+	{
+		.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+				DMI_MATCH(DMI_BIOS_VERSION, "B1400CEAE.305"),
+		},
+	},
+	{
+		.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+				DMI_MATCH(DMI_BIOS_VERSION, "B1400CEAE.306"),
+		},
+	},
+	{
+		.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+				DMI_MATCH(DMI_BIOS_VERSION, "B1400CEAE.307"),
+		},
+	},
+	{}
+};
+
+static void asus_disable_nvme_d3cold(struct pci_dev *pdev)
+{
+	if (dmi_check_system(asus_nvme_broken_d3cold_table) > 0)
+		pci_d3cold_disable(pdev);
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x9a09, asus_disable_nvme_d3cold);
+
 #ifdef CONFIG_SUSPEND
 /*
  * Root Ports on some AMD SoCs advertise PME_Support for D3hot and D3cold, but
@@ -932,7 +980,7 @@
 		return;
 
 	rp = pcie_find_root_port(dev);
-	if (!rp->pm_cap)
+	if (!rp || !rp->pm_cap)
 		return;
 
 	rp->pme_support &= ~((PCI_PM_CAP_PME_D3hot|PCI_PM_CAP_PME_D3cold) >>
@@ -946,7 +994,7 @@
 	u16 pmc;
 
 	rp = pcie_find_root_port(dev);
-	if (!rp->pm_cap)
+	if (!rp || !rp->pm_cap)
 		return;
 
 	pci_read_config_word(rp, rp->pm_cap + PCI_PM_PMC, &pmc);
@@ -962,4 +1010,34 @@
 DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1668, amd_rp_pme_resume);
 DECLARE_PCI_FIXUP_SUSPEND(PCI_VENDOR_ID_AMD, 0x1669, amd_rp_pme_suspend);
 DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1669, amd_rp_pme_resume);
+
+/*
+ * Putting PCIe root ports on Ryzen SoCs with USB4 controllers into D3hot
+ * may cause problems when the system attempts wake up from s2idle.
+ *
+ * On the TUXEDO Sirius 16 Gen 1 with a specific old BIOS this manifests as
+ * a system hang.
+ */
+static const struct dmi_system_id quirk_tuxeo_rp_d3_dmi_table[] = {
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "APX958"),
+			DMI_EXACT_MATCH(DMI_BIOS_VERSION, "V1.00A00_20240108"),
+		},
+	},
+	{}
+};
+
+static void quirk_tuxeo_rp_d3(struct pci_dev *pdev)
+{
+	struct pci_dev *root_pdev;
+
+	if (dmi_check_system(quirk_tuxeo_rp_d3_dmi_table)) {
+		root_pdev = pcie_find_root_port(pdev);
+		if (root_pdev)
+			root_pdev->dev_flags |= PCI_DEV_FLAGS_NO_D3;
+	}
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1502, quirk_tuxeo_rp_d3);
 #endif /* CONFIG_SUSPEND */
--- linux-qcom-6.8.0.orig/arch/x86/pci/intel_mid_pci.c
+++ linux-qcom-6.8.0/arch/x86/pci/intel_mid_pci.c
@@ -233,9 +233,9 @@
 		return 0;
 
 	ret = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi);
-	if (ret < 0) {
+	if (ret) {
 		dev_warn(&dev->dev, "Failed to read interrupt line: %d\n", ret);
-		return ret;
+		return pcibios_err_to_errno(ret);
 	}
 
 	id = x86_match_cpu(intel_mid_cpu_ids);
--- linux-qcom-6.8.0.orig/arch/x86/pci/mmconfig-shared.c
+++ linux-qcom-6.8.0/arch/x86/pci/mmconfig-shared.c
@@ -518,7 +518,34 @@
 {
 	struct resource *conflict;
 
-	if (!early && !acpi_disabled) {
+	if (early) {
+
+		/*
+		 * Don't try to do this check unless configuration type 1
+		 * is available.  How about type 2?
+		 */
+
+		/*
+		 * 946f2ee5c731 ("Check that MCFG points to an e820
+		 * reserved area") added this E820 check in 2006 to work
+		 * around BIOS defects.
+		 *
+		 * Per PCI Firmware r3.3, sec 4.1.2, ECAM space must be
+		 * reserved by a PNP0C02 resource, but it need not be
+		 * mentioned in E820.  Before the ACPI interpreter is
+		 * available, we can't check for PNP0C02 resources, so
+		 * there's no reliable way to verify the region in this
+		 * early check.  Keep it only for the old machines that
+		 * motivated 946f2ee5c731.
+		 */
+		if (dmi_get_bios_year() < 2016 && raw_pci_ops)
+			return is_mmconf_reserved(e820__mapped_all, cfg, dev,
+						  "E820 entry");
+
+		return true;
+	}
+
+	if (!acpi_disabled) {
 		if (is_mmconf_reserved(is_acpi_reserved, cfg, dev,
 				       "ACPI motherboard resource"))
 			return true;
@@ -551,16 +578,7 @@
 	 * For MCFG information constructed from hotpluggable host bridge's
 	 * _CBA method, just assume it's reserved.
 	 */
-	if (pci_mmcfg_running_state)
-		return true;
-
-	/* Don't try to do this check unless configuration
-	   type 1 is available. how about type 2 ?*/
-	if (raw_pci_ops)
-		return is_mmconf_reserved(e820__mapped_all, cfg, dev,
-					  "E820 entry");
-
-	return false;
+	return pci_mmcfg_running_state;
 }
 
 static void __init pci_mmcfg_reject_broken(int early)
--- linux-qcom-6.8.0.orig/arch/x86/pci/xen.c
+++ linux-qcom-6.8.0/arch/x86/pci/xen.c
@@ -38,10 +38,10 @@
 	u8 gsi;
 
 	rc = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi);
-	if (rc < 0) {
+	if (rc) {
 		dev_warn(&dev->dev, "Xen PCI: failed to read interrupt line: %d\n",
 			 rc);
-		return rc;
+		return pcibios_err_to_errno(rc);
 	}
 	/* In PV DomU the Xen PCI backend puts the PIRQ in the interrupt line.*/
 	pirq = gsi;
--- linux-qcom-6.8.0.orig/arch/x86/platform/efi/memmap.c
+++ linux-qcom-6.8.0/arch/x86/platform/efi/memmap.c
@@ -92,12 +92,22 @@
  */
 int __init efi_memmap_install(struct efi_memory_map_data *data)
 {
+	unsigned long size = efi.memmap.desc_size * efi.memmap.nr_map;
+	unsigned long flags = efi.memmap.flags;
+	u64 phys = efi.memmap.phys_map;
+	int ret;
+
 	efi_memmap_unmap();
 
 	if (efi_enabled(EFI_PARAVIRT))
 		return 0;
 
-	return __efi_memmap_init(data);
+	ret = __efi_memmap_init(data);
+	if (ret)
+		return ret;
+
+	__efi_memmap_free(phys, size, flags);
+	return 0;
 }
 
 /**
--- linux-qcom-6.8.0.orig/arch/x86/platform/intel/iosf_mbi.c
+++ linux-qcom-6.8.0/arch/x86/platform/intel/iosf_mbi.c
@@ -62,7 +62,7 @@
 
 fail_read:
 	dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result);
-	return result;
+	return pcibios_err_to_errno(result);
 }
 
 static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr)
@@ -91,7 +91,7 @@
 
 fail_write:
 	dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result);
-	return result;
+	return pcibios_err_to_errno(result);
 }
 
 int iosf_mbi_read(u8 port, u8 opcode, u32 offset, u32 *mdr)
--- linux-qcom-6.8.0.orig/arch/x86/platform/pvh/enlighten.c
+++ linux-qcom-6.8.0/arch/x86/platform/pvh/enlighten.c
@@ -74,6 +74,9 @@
 	} else
 		xen_raw_printk("Warning: Can fit ISA range into e820\n");
 
+	if (xen_guest)
+		xen_reserve_extra_memory(&pvh_bootparams);
+
 	pvh_bootparams.hdr.cmd_line_ptr =
 		pvh_start_info.cmdline_paddr;
 
--- linux-qcom-6.8.0.orig/arch/x86/power/hibernate.c
+++ linux-qcom-6.8.0/arch/x86/power/hibernate.c
@@ -170,7 +170,7 @@
 		goto out;
 	}
 	pud = pud_offset(p4d, relocated_restore_code);
-	if (pud_large(*pud)) {
+	if (pud_leaf(*pud)) {
 		set_pud(pud, __pud(pud_val(*pud) & ~_PAGE_NX));
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/arch/x86/purgatory/Makefile
+++ linux-qcom-6.8.0/arch/x86/purgatory/Makefile
@@ -42,7 +42,8 @@
 # make up the standalone purgatory.ro
 
 PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel
-PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss -g0
+PURGATORY_CFLAGS := -mcmodel=small -ffreestanding -fno-zero-initialized-in-bss -g0
+PURGATORY_CFLAGS += -fpic -fvisibility=hidden
 PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN) -DDISABLE_BRANCH_PROFILING
 PURGATORY_CFLAGS += -fno-stack-protector
 
--- linux-qcom-6.8.0.orig/arch/x86/tools/relocs.c
+++ linux-qcom-6.8.0/arch/x86/tools/relocs.c
@@ -653,6 +653,14 @@
 		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
 			continue;
 		}
+		/*
+		 * Do not perform relocations in .notes section; any
+		 * values there are meant for pre-boot consumption (e.g.
+		 * startup_xen).
+		 */
+		if (sec_applies->shdr.sh_type == SHT_NOTE) {
+			continue;
+		}
 		sh_symtab  = sec_symtab->symtab;
 		sym_strtab = sec_symtab->link->strtab;
 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) {
@@ -738,6 +746,15 @@
 		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
 			continue;
 		}
+
+		/*
+		 * Do not perform relocations in .notes sections; any
+		 * values there are meant for pre-boot consumption (e.g.
+		 * startup_xen).
+		 */
+		if (sec_applies->shdr.sh_type == SHT_NOTE)
+			continue;
+
 		sh_symtab = sec_symtab->symtab;
 		sym_strtab = sec_symtab->link->strtab;
 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) {
--- linux-qcom-6.8.0.orig/arch/x86/um/shared/sysdep/archsetjmp.h
+++ linux-qcom-6.8.0/arch/x86/um/shared/sysdep/archsetjmp.h
@@ -1,6 +1,13 @@
 /* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __X86_UM_SYSDEP_ARCHSETJMP_H
+#define __X86_UM_SYSDEP_ARCHSETJMP_H
+
 #ifdef __i386__
 #include "archsetjmp_32.h"
 #else
 #include "archsetjmp_64.h"
 #endif
+
+unsigned long get_thread_reg(int reg, jmp_buf *buf);
+
+#endif /* __X86_UM_SYSDEP_ARCHSETJMP_H */
--- linux-qcom-6.8.0.orig/arch/x86/um/sys_call_table_32.c
+++ linux-qcom-6.8.0/arch/x86/um/sys_call_table_32.c
@@ -9,6 +9,10 @@
 #include <linux/cache.h>
 #include <asm/syscall.h>
 
+extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long,
+				      unsigned long, unsigned long,
+				      unsigned long, unsigned long);
+
 /*
  * Below you can see, in terms of #define's, the differences between the x86-64
  * and the UML syscall table.
@@ -22,15 +26,13 @@
 #define sys_vm86 sys_ni_syscall
 
 #define __SYSCALL_WITH_COMPAT(nr, native, compat)	__SYSCALL(nr, native)
+#define __SYSCALL_NORETURN __SYSCALL
 
 #define __SYSCALL(nr, sym) extern asmlinkage long sym(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
 #include <asm/syscalls_32.h>
+#undef  __SYSCALL
 
-#undef __SYSCALL
 #define __SYSCALL(nr, sym) sym,
-
-extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
-
 const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
 #include <asm/syscalls_32.h>
 };
--- linux-qcom-6.8.0.orig/arch/x86/um/sys_call_table_64.c
+++ linux-qcom-6.8.0/arch/x86/um/sys_call_table_64.c
@@ -9,6 +9,10 @@
 #include <linux/cache.h>
 #include <asm/syscall.h>
 
+extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long,
+				      unsigned long, unsigned long,
+				      unsigned long, unsigned long);
+
 /*
  * Below you can see, in terms of #define's, the differences between the x86-64
  * and the UML syscall table.
@@ -18,14 +22,13 @@
 #define sys_iopl sys_ni_syscall
 #define sys_ioperm sys_ni_syscall
 
+#define __SYSCALL_NORETURN __SYSCALL
+
 #define __SYSCALL(nr, sym) extern asmlinkage long sym(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
 #include <asm/syscalls_64.h>
+#undef  __SYSCALL
 
-#undef __SYSCALL
 #define __SYSCALL(nr, sym) sym,
-
-extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
-
 const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
 #include <asm/syscalls_64.h>
 };
--- linux-qcom-6.8.0.orig/arch/x86/xen/enlighten.c
+++ linux-qcom-6.8.0/arch/x86/xen/enlighten.c
@@ -5,7 +5,9 @@
 #endif
 #include <linux/console.h>
 #include <linux/cpu.h>
+#include <linux/instrumentation.h>
 #include <linux/kexec.h>
+#include <linux/memblock.h>
 #include <linux/slab.h>
 #include <linux/panic_notifier.h>
 
@@ -25,7 +27,8 @@
 #include "smp.h"
 #include "pmu.h"
 
-EXPORT_SYMBOL_GPL(hypercall_page);
+DEFINE_STATIC_CALL(xen_hypercall, xen_hypercall_hvm);
+EXPORT_STATIC_CALL_TRAMP(xen_hypercall);
 
 /*
  * Pointer to the xen_vcpu_info structure or
@@ -72,6 +75,67 @@
  */
 struct shared_info *HYPERVISOR_shared_info = &xen_dummy_shared_info;
 
+static __ref void xen_get_vendor(void)
+{
+	init_cpu_devs();
+	cpu_detect(&boot_cpu_data);
+	get_cpu_vendor(&boot_cpu_data);
+}
+
+void xen_hypercall_setfunc(void)
+{
+	if (static_call_query(xen_hypercall) != xen_hypercall_hvm)
+		return;
+
+	if ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||
+	     boot_cpu_data.x86_vendor == X86_VENDOR_HYGON))
+		static_call_update(xen_hypercall, xen_hypercall_amd);
+	else
+		static_call_update(xen_hypercall, xen_hypercall_intel);
+}
+
+/*
+ * Evaluate processor vendor in order to select the correct hypercall
+ * function for HVM/PVH guests.
+ * Might be called very early in boot before vendor has been set by
+ * early_cpu_init().
+ */
+noinstr void *__xen_hypercall_setfunc(void)
+{
+	void (*func)(void);
+
+	/*
+	 * Xen is supported only on CPUs with CPUID, so testing for
+	 * X86_FEATURE_CPUID is a test for early_cpu_init() having been
+	 * run.
+	 *
+	 * Note that __xen_hypercall_setfunc() is noinstr only due to a nasty
+	 * dependency chain: it is being called via the xen_hypercall static
+	 * call when running as a PVH or HVM guest. Hypercalls need to be
+	 * noinstr due to PV guests using hypercalls in noinstr code. So we
+	 * can safely tag the function body as "instrumentation ok", since
+	 * the PV guest requirement is not of interest here (xen_get_vendor()
+	 * calls noinstr functions, and static_call_update_early() might do
+	 * so, too).
+	 */
+	instrumentation_begin();
+
+	if (!boot_cpu_has(X86_FEATURE_CPUID))
+		xen_get_vendor();
+
+	if ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||
+	     boot_cpu_data.x86_vendor == X86_VENDOR_HYGON))
+		func = xen_hypercall_amd;
+	else
+		func = xen_hypercall_intel;
+
+	static_call_update_early(xen_hypercall, func);
+
+	instrumentation_end();
+
+	return func;
+}
+
 static int xen_cpu_up_online(unsigned int cpu)
 {
 	xen_init_lock_cpu(cpu);
@@ -350,3 +414,67 @@
 }
 EXPORT_SYMBOL(xen_arch_unregister_cpu);
 #endif
+
+/* Amount of extra memory space we add to the e820 ranges */
+struct xen_memory_region xen_extra_mem[XEN_EXTRA_MEM_MAX_REGIONS] __initdata;
+
+void __init xen_add_extra_mem(unsigned long start_pfn, unsigned long n_pfns)
+{
+	unsigned int i;
+
+	/*
+	 * No need to check for zero size, should happen rarely and will only
+	 * write a new entry regarded to be unused due to zero size.
+	 */
+	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
+		/* Add new region. */
+		if (xen_extra_mem[i].n_pfns == 0) {
+			xen_extra_mem[i].start_pfn = start_pfn;
+			xen_extra_mem[i].n_pfns = n_pfns;
+			break;
+		}
+		/* Append to existing region. */
+		if (xen_extra_mem[i].start_pfn + xen_extra_mem[i].n_pfns ==
+		    start_pfn) {
+			xen_extra_mem[i].n_pfns += n_pfns;
+			break;
+		}
+	}
+	if (i == XEN_EXTRA_MEM_MAX_REGIONS)
+		printk(KERN_WARNING "Warning: not enough extra memory regions\n");
+
+	memblock_reserve(PFN_PHYS(start_pfn), PFN_PHYS(n_pfns));
+}
+
+#ifdef CONFIG_XEN_UNPOPULATED_ALLOC
+int __init arch_xen_unpopulated_init(struct resource **res)
+{
+	unsigned int i;
+
+	if (!xen_domain())
+		return -ENODEV;
+
+	/* Must be set strictly before calling xen_free_unpopulated_pages(). */
+	*res = &iomem_resource;
+
+	/*
+	 * Initialize with pages from the extra memory regions (see
+	 * arch/x86/xen/setup.c).
+	 */
+	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
+		unsigned int j;
+
+		for (j = 0; j < xen_extra_mem[i].n_pfns; j++) {
+			struct page *pg =
+				pfn_to_page(xen_extra_mem[i].start_pfn + j);
+
+			xen_free_unpopulated_pages(1, &pg);
+		}
+
+		/* Zero so region is not also added to the balloon driver. */
+		xen_extra_mem[i].n_pfns = 0;
+	}
+
+	return 0;
+}
+#endif
--- linux-qcom-6.8.0.orig/arch/x86/xen/enlighten_hvm.c
+++ linux-qcom-6.8.0/arch/x86/xen/enlighten_hvm.c
@@ -108,15 +108,8 @@
 	/* PVH set up hypercall page in xen_prepare_pvh(). */
 	if (xen_pvh_domain())
 		pv_info.name = "Xen PVH";
-	else {
-		u64 pfn;
-		uint32_t msr;
-
+	else
 		pv_info.name = "Xen HVM";
-		msr = cpuid_ebx(base + 2);
-		pfn = __pa(hypercall_page);
-		wrmsr_safe(msr, (u32)pfn, (u32)(pfn >> 32));
-	}
 
 	xen_setup_features();
 
@@ -298,6 +291,10 @@
 	if (xen_pv_domain())
 		return 0;
 
+	/* Set correct hypercall function. */
+	if (xen_domain)
+		xen_hypercall_setfunc();
+
 	if (xen_pvh_domain() && nopv) {
 		/* Guest booting via the Xen-PVH boot entry goes here */
 		pr_info("\"nopv\" parameter is ignored in PVH guest\n");
--- linux-qcom-6.8.0.orig/arch/x86/xen/enlighten_pv.c
+++ linux-qcom-6.8.0/arch/x86/xen/enlighten_pv.c
@@ -1329,6 +1329,9 @@
 
 	xen_domain_type = XEN_PV_DOMAIN;
 	xen_start_flags = xen_start_info->flags;
+	/* Interrupts are guaranteed to be off initially. */
+	early_boot_irqs_disabled = true;
+	static_call_update_early(xen_hypercall, xen_hypercall_pv);
 
 	xen_setup_features();
 
@@ -1419,7 +1422,6 @@
 	WARN_ON(xen_cpuhp_setup(xen_cpu_up_prepare_pv, xen_cpu_dead_pv));
 
 	local_irq_disable();
-	early_boot_irqs_disabled = true;
 
 	xen_raw_console_write("mapping kernel into physical memory\n");
 	xen_setup_kernel_pagetable((pgd_t *)xen_start_info->pt_base,
--- linux-qcom-6.8.0.orig/arch/x86/xen/enlighten_pvh.c
+++ linux-qcom-6.8.0/arch/x86/xen/enlighten_pvh.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/acpi.h>
 #include <linux/export.h>
+#include <linux/mm.h>
 
 #include <xen/hvc-console.h>
 
@@ -27,17 +28,10 @@
 
 void __init xen_pvh_init(struct boot_params *boot_params)
 {
-	u32 msr;
-	u64 pfn;
-
 	xen_pvh = 1;
 	xen_domain_type = XEN_HVM_DOMAIN;
 	xen_start_flags = pvh_start_info.flags;
 
-	msr = cpuid_ebx(xen_cpuid_base() + 2);
-	pfn = __pa(hypercall_page);
-	wrmsr_safe(msr, (u32)pfn, (u32)(pfn >> 32));
-
 	if (xen_initial_domain())
 		x86_init.oem.arch_setup = xen_add_preferred_consoles;
 	x86_init.oem.banner = xen_banner;
@@ -72,3 +66,70 @@
 	}
 	boot_params_p->e820_entries = memmap.nr_entries;
 }
+
+/*
+ * Reserve e820 UNUSABLE regions to inflate the memory balloon.
+ *
+ * On PVH dom0 the host memory map is used, RAM regions available to dom0 are
+ * located as the same place as in the native memory map, but since dom0 gets
+ * less memory than the total amount of host RAM the ranges that can't be
+ * populated are converted from RAM -> UNUSABLE.  Use such regions (up to the
+ * ratio signaled in EXTRA_MEM_RATIO) in order to inflate the balloon driver at
+ * boot.  Doing so prevents the guest (even if just temporary) from using holes
+ * in the memory map in order to map grants or foreign addresses, and
+ * hopefully limits the risk of a clash with a device MMIO region.  Ideally the
+ * hypervisor should notify us which memory ranges are suitable for creating
+ * foreign mappings, but that's not yet implemented.
+ */
+void __init xen_reserve_extra_memory(struct boot_params *bootp)
+{
+	unsigned int i, ram_pages = 0, extra_pages;
+
+	for (i = 0; i < bootp->e820_entries; i++) {
+		struct boot_e820_entry *e = &bootp->e820_table[i];
+
+		if (e->type != E820_TYPE_RAM)
+			continue;
+		ram_pages += PFN_DOWN(e->addr + e->size) - PFN_UP(e->addr);
+	}
+
+	/* Max amount of extra memory. */
+	extra_pages = EXTRA_MEM_RATIO * ram_pages;
+
+	/*
+	 * Convert UNUSABLE ranges to RAM and reserve them for foreign mapping
+	 * purposes.
+	 */
+	for (i = 0; i < bootp->e820_entries && extra_pages; i++) {
+		struct boot_e820_entry *e = &bootp->e820_table[i];
+		unsigned long pages;
+
+		if (e->type != E820_TYPE_UNUSABLE)
+			continue;
+
+		pages = min(extra_pages,
+			PFN_DOWN(e->addr + e->size) - PFN_UP(e->addr));
+
+		if (pages != (PFN_DOWN(e->addr + e->size) - PFN_UP(e->addr))) {
+			struct boot_e820_entry *next;
+
+			if (bootp->e820_entries ==
+			    ARRAY_SIZE(bootp->e820_table))
+				/* No space left to split - skip region. */
+				continue;
+
+			/* Split entry. */
+			next = e + 1;
+			memmove(next, e,
+				(bootp->e820_entries - i) * sizeof(*e));
+			bootp->e820_entries++;
+			next->addr = PAGE_ALIGN(e->addr) + PFN_PHYS(pages);
+			e->size = next->addr - e->addr;
+			next->size -= e->size;
+		}
+		e->type = E820_TYPE_RAM;
+		extra_pages -= pages;
+
+		xen_add_extra_mem(PFN_UP(e->addr), pages);
+	}
+}
--- linux-qcom-6.8.0.orig/arch/x86/xen/mmu_pv.c
+++ linux-qcom-6.8.0/arch/x86/xen/mmu_pv.c
@@ -1082,7 +1082,7 @@
 	pmd_t *pmd_tbl;
 	int i;
 
-	if (pud_large(*pud)) {
+	if (pud_leaf(*pud)) {
 		pa = pud_val(*pud) & PHYSICAL_PAGE_MASK;
 		xen_free_ro_pages(pa, PUD_SIZE);
 		return;
@@ -1863,7 +1863,7 @@
 	if (!pud_present(pud))
 		return 0;
 	pa = pud_val(pud) & PTE_PFN_MASK;
-	if (pud_large(pud))
+	if (pud_leaf(pud))
 		return pa + (vaddr & ~PUD_MASK);
 
 	pmd = native_make_pmd(xen_read_phys_ulong(pa + pmd_index(vaddr) *
@@ -2019,10 +2019,7 @@
 
 void __init xen_pt_check_e820(void)
 {
-	if (xen_is_e820_reserved(xen_pt_base, xen_pt_size)) {
-		xen_raw_console_write("Xen hypervisor allocated page table memory conflicts with E820 map\n");
-		BUG();
-	}
+	xen_chk_is_e820_usable(xen_pt_base, xen_pt_size, "page table");
 }
 
 static unsigned char dummy_mapping[PAGE_SIZE] __page_aligned_bss;
--- linux-qcom-6.8.0.orig/arch/x86/xen/p2m.c
+++ linux-qcom-6.8.0/arch/x86/xen/p2m.c
@@ -70,6 +70,7 @@
 #include <linux/memblock.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
+#include <linux/acpi.h>
 
 #include <asm/cache.h>
 #include <asm/setup.h>
@@ -80,6 +81,7 @@
 #include <asm/xen/hypervisor.h>
 #include <xen/balloon.h>
 #include <xen/grant_table.h>
+#include <xen/hvc-console.h>
 
 #include "multicalls.h"
 #include "xen-ops.h"
@@ -731,7 +733,7 @@
 		 * immediate unmapping.
 		 */
 		map_ops[i].status = GNTST_general_error;
-		unmap[0].host_addr = map_ops[i].host_addr,
+		unmap[0].host_addr = map_ops[i].host_addr;
 		unmap[0].handle = map_ops[i].handle;
 		map_ops[i].handle = INVALID_GRANT_HANDLE;
 		if (map_ops[i].flags & GNTMAP_device_map)
@@ -741,7 +743,7 @@
 
 		if (kmap_ops) {
 			kmap_ops[i].status = GNTST_general_error;
-			unmap[1].host_addr = kmap_ops[i].host_addr,
+			unmap[1].host_addr = kmap_ops[i].host_addr;
 			unmap[1].handle = kmap_ops[i].handle;
 			kmap_ops[i].handle = INVALID_GRANT_HANDLE;
 			if (kmap_ops[i].flags & GNTMAP_device_map)
@@ -794,6 +796,102 @@
 	return ret;
 }
 
+/* Remapped non-RAM areas */
+#define NR_NONRAM_REMAP 4
+static struct nonram_remap {
+	phys_addr_t maddr;
+	phys_addr_t paddr;
+	size_t size;
+} xen_nonram_remap[NR_NONRAM_REMAP] __ro_after_init;
+static unsigned int nr_nonram_remap __ro_after_init;
+
+/*
+ * Do the real remapping of non-RAM regions as specified in the
+ * xen_nonram_remap[] array.
+ * In case of an error just crash the system.
+ */
+void __init xen_do_remap_nonram(void)
+{
+	unsigned int i;
+	unsigned int remapped = 0;
+	const struct nonram_remap *remap = xen_nonram_remap;
+	unsigned long pfn, mfn, end_pfn;
+
+	for (i = 0; i < nr_nonram_remap; i++) {
+		end_pfn = PFN_UP(remap->paddr + remap->size);
+		pfn = PFN_DOWN(remap->paddr);
+		mfn = PFN_DOWN(remap->maddr);
+		while (pfn < end_pfn) {
+			if (!set_phys_to_machine(pfn, mfn))
+				panic("Failed to set p2m mapping for pfn=%lx mfn=%lx\n",
+				       pfn, mfn);
+
+			pfn++;
+			mfn++;
+			remapped++;
+		}
+
+		remap++;
+	}
+
+	pr_info("Remapped %u non-RAM page(s)\n", remapped);
+}
+
+#ifdef CONFIG_ACPI
+/*
+ * Xen variant of acpi_os_ioremap() taking potentially remapped non-RAM
+ * regions into account.
+ * Any attempt to map an area crossing a remap boundary will produce a
+ * WARN() splat.
+ * phys is related to remap->maddr on input and will be rebased to remap->paddr.
+ */
+static void __iomem *xen_acpi_os_ioremap(acpi_physical_address phys,
+					 acpi_size size)
+{
+	unsigned int i;
+	const struct nonram_remap *remap = xen_nonram_remap;
+
+	for (i = 0; i < nr_nonram_remap; i++) {
+		if (phys + size > remap->maddr &&
+		    phys < remap->maddr + remap->size) {
+			WARN_ON(phys < remap->maddr ||
+				phys + size > remap->maddr + remap->size);
+			phys += remap->paddr - remap->maddr;
+			break;
+		}
+	}
+
+	return x86_acpi_os_ioremap(phys, size);
+}
+#endif /* CONFIG_ACPI */
+
+/*
+ * Add a new non-RAM remap entry.
+ * In case of no free entry found, just crash the system.
+ */
+void __init xen_add_remap_nonram(phys_addr_t maddr, phys_addr_t paddr,
+				 unsigned long size)
+{
+	BUG_ON((maddr & ~PAGE_MASK) != (paddr & ~PAGE_MASK));
+
+	if (nr_nonram_remap == NR_NONRAM_REMAP) {
+		xen_raw_console_write("Number of required E820 entry remapping actions exceed maximum value\n");
+		BUG();
+	}
+
+#ifdef CONFIG_ACPI
+	/* Switch to the Xen acpi_os_ioremap() variant. */
+	if (nr_nonram_remap == 0)
+		acpi_os_ioremap = xen_acpi_os_ioremap;
+#endif
+
+	xen_nonram_remap[nr_nonram_remap].maddr = maddr;
+	xen_nonram_remap[nr_nonram_remap].paddr = paddr;
+	xen_nonram_remap[nr_nonram_remap].size = size;
+
+	nr_nonram_remap++;
+}
+
 #ifdef CONFIG_XEN_DEBUG_FS
 #include <linux/debugfs.h>
 #include "debugfs.h"
--- linux-qcom-6.8.0.orig/arch/x86/xen/setup.c
+++ linux-qcom-6.8.0/arch/x86/xen/setup.c
@@ -15,12 +15,12 @@
 #include <linux/cpuidle.h>
 #include <linux/cpufreq.h>
 #include <linux/memory_hotplug.h>
+#include <linux/acpi.h>
 
 #include <asm/elf.h>
 #include <asm/vdso.h>
 #include <asm/e820/api.h>
 #include <asm/setup.h>
-#include <asm/acpi.h>
 #include <asm/numa.h>
 #include <asm/idtentry.h>
 #include <asm/xen/hypervisor.h>
@@ -38,9 +38,6 @@
 
 #define GB(x) ((uint64_t)(x) * 1024 * 1024 * 1024)
 
-/* Amount of extra memory space we add to the e820 ranges */
-struct xen_memory_region xen_extra_mem[XEN_EXTRA_MEM_MAX_REGIONS] __initdata;
-
 /* Number of pages released from the initial allocation. */
 unsigned long xen_released_pages;
 
@@ -50,6 +47,9 @@
 /* E820 map used during setting up memory. */
 static struct e820_table xen_e820_table __initdata;
 
+/* Number of initially usable memory pages. */
+static unsigned long ini_nr_pages __initdata;
+
 /*
  * Buffer used to remap identity mapped pages. We only need the virtual space.
  * The physical page behind this address is remapped as needed to different
@@ -64,18 +64,6 @@
 } xen_remap_buf __initdata __aligned(PAGE_SIZE);
 static unsigned long xen_remap_mfn __initdata = INVALID_P2M_ENTRY;
 
-/*
- * The maximum amount of extra memory compared to the base size.  The
- * main scaling factor is the size of struct page.  At extreme ratios
- * of base:extra, all the base memory can be filled with page
- * structures for the extra memory, leaving no space for anything
- * else.
- *
- * 10x seems like a reasonable balance between scaling flexibility and
- * leaving a practically usable system.
- */
-#define EXTRA_MEM_RATIO		(10)
-
 static bool xen_512gb_limit __initdata = IS_ENABLED(CONFIG_XEN_512GB);
 
 static void __init xen_parse_512gb(void)
@@ -96,35 +84,6 @@
 	xen_512gb_limit = val;
 }
 
-static void __init xen_add_extra_mem(unsigned long start_pfn,
-				     unsigned long n_pfns)
-{
-	int i;
-
-	/*
-	 * No need to check for zero size, should happen rarely and will only
-	 * write a new entry regarded to be unused due to zero size.
-	 */
-	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
-		/* Add new region. */
-		if (xen_extra_mem[i].n_pfns == 0) {
-			xen_extra_mem[i].start_pfn = start_pfn;
-			xen_extra_mem[i].n_pfns = n_pfns;
-			break;
-		}
-		/* Append to existing region. */
-		if (xen_extra_mem[i].start_pfn + xen_extra_mem[i].n_pfns ==
-		    start_pfn) {
-			xen_extra_mem[i].n_pfns += n_pfns;
-			break;
-		}
-	}
-	if (i == XEN_EXTRA_MEM_MAX_REGIONS)
-		printk(KERN_WARNING "Warning: not enough extra memory regions\n");
-
-	memblock_reserve(PFN_PHYS(start_pfn), PFN_PHYS(n_pfns));
-}
-
 static void __init xen_del_extra_mem(unsigned long start_pfn,
 				     unsigned long n_pfns)
 {
@@ -257,7 +216,7 @@
  * as a fallback if the remapping fails.
  */
 static void __init xen_set_identity_and_release_chunk(unsigned long start_pfn,
-			unsigned long end_pfn, unsigned long nr_pages)
+						      unsigned long end_pfn)
 {
 	unsigned long pfn, end;
 	int ret;
@@ -265,7 +224,7 @@
 	WARN_ON(start_pfn > end_pfn);
 
 	/* Release pages first. */
-	end = min(end_pfn, nr_pages);
+	end = min(end_pfn, ini_nr_pages);
 	for (pfn = start_pfn; pfn < end; pfn++) {
 		unsigned long mfn = pfn_to_mfn(pfn);
 
@@ -386,15 +345,14 @@
  * to Xen and not remapped.
  */
 static unsigned long __init xen_set_identity_and_remap_chunk(
-	unsigned long start_pfn, unsigned long end_pfn, unsigned long nr_pages,
-	unsigned long remap_pfn)
+	unsigned long start_pfn, unsigned long end_pfn, unsigned long remap_pfn)
 {
 	unsigned long pfn;
 	unsigned long i = 0;
 	unsigned long n = end_pfn - start_pfn;
 
 	if (remap_pfn == 0)
-		remap_pfn = nr_pages;
+		remap_pfn = ini_nr_pages;
 
 	while (i < n) {
 		unsigned long cur_pfn = start_pfn + i;
@@ -403,19 +361,19 @@
 		unsigned long remap_range_size;
 
 		/* Do not remap pages beyond the current allocation */
-		if (cur_pfn >= nr_pages) {
+		if (cur_pfn >= ini_nr_pages) {
 			/* Identity map remaining pages */
 			set_phys_range_identity(cur_pfn, cur_pfn + size);
 			break;
 		}
-		if (cur_pfn + size > nr_pages)
-			size = nr_pages - cur_pfn;
+		if (cur_pfn + size > ini_nr_pages)
+			size = ini_nr_pages - cur_pfn;
 
 		remap_range_size = xen_find_pfn_range(&remap_pfn);
 		if (!remap_range_size) {
 			pr_warn("Unable to find available pfn range, not remapping identity pages\n");
 			xen_set_identity_and_release_chunk(cur_pfn,
-						cur_pfn + left, nr_pages);
+							   cur_pfn + left);
 			break;
 		}
 		/* Adjust size to fit in current e820 RAM region */
@@ -442,18 +400,18 @@
 }
 
 static unsigned long __init xen_count_remap_pages(
-	unsigned long start_pfn, unsigned long end_pfn, unsigned long nr_pages,
+	unsigned long start_pfn, unsigned long end_pfn,
 	unsigned long remap_pages)
 {
-	if (start_pfn >= nr_pages)
+	if (start_pfn >= ini_nr_pages)
 		return remap_pages;
 
-	return remap_pages + min(end_pfn, nr_pages) - start_pfn;
+	return remap_pages + min(end_pfn, ini_nr_pages) - start_pfn;
 }
 
-static unsigned long __init xen_foreach_remap_area(unsigned long nr_pages,
+static unsigned long __init xen_foreach_remap_area(
 	unsigned long (*func)(unsigned long start_pfn, unsigned long end_pfn,
-			      unsigned long nr_pages, unsigned long last_val))
+			      unsigned long last_val))
 {
 	phys_addr_t start = 0;
 	unsigned long ret_val = 0;
@@ -481,8 +439,7 @@
 				end_pfn = PFN_UP(entry->addr);
 
 			if (start_pfn < end_pfn)
-				ret_val = func(start_pfn, end_pfn, nr_pages,
-					       ret_val);
+				ret_val = func(start_pfn, end_pfn, ret_val);
 			start = end;
 		}
 	}
@@ -539,6 +496,8 @@
 	set_pte_mfn(buf, mfn_save, PAGE_KERNEL);
 
 	pr_info("Remapped %ld page(s)\n", remapped);
+
+	xen_do_remap_nonram();
 }
 
 static unsigned long __init xen_get_pages_limit(void)
@@ -612,7 +571,7 @@
 	}
 }
 
-bool __init xen_is_e820_reserved(phys_addr_t start, phys_addr_t size)
+static bool __init xen_is_e820_reserved(phys_addr_t start, phys_addr_t size)
 {
 	struct e820_entry *entry;
 	unsigned mapcnt;
@@ -670,6 +629,111 @@
 }
 
 /*
+ * Swap a non-RAM E820 map entry with RAM above ini_nr_pages.
+ * Note that the E820 map is modified accordingly, but the P2M map isn't yet.
+ * The adaption of the P2M must be deferred until page allocation is possible.
+ */
+static void __init xen_e820_swap_entry_with_ram(struct e820_entry *swap_entry)
+{
+	struct e820_entry *entry;
+	unsigned int mapcnt;
+	phys_addr_t mem_end = PFN_PHYS(ini_nr_pages);
+	phys_addr_t swap_addr, swap_size, entry_end;
+
+	swap_addr = PAGE_ALIGN_DOWN(swap_entry->addr);
+	swap_size = PAGE_ALIGN(swap_entry->addr - swap_addr + swap_entry->size);
+	entry = xen_e820_table.entries;
+
+	for (mapcnt = 0; mapcnt < xen_e820_table.nr_entries; mapcnt++) {
+		entry_end = entry->addr + entry->size;
+		if (entry->type == E820_TYPE_RAM && entry->size >= swap_size &&
+		    entry_end - swap_size >= mem_end) {
+			/* Reduce RAM entry by needed space (whole pages). */
+			entry->size -= swap_size;
+
+			/* Add new entry at the end of E820 map. */
+			entry = xen_e820_table.entries +
+				xen_e820_table.nr_entries;
+			xen_e820_table.nr_entries++;
+
+			/* Fill new entry (keep size and page offset). */
+			entry->type = swap_entry->type;
+			entry->addr = entry_end - swap_size +
+				      swap_addr - swap_entry->addr;
+			entry->size = swap_entry->size;
+
+			/* Convert old entry to RAM, align to pages. */
+			swap_entry->type = E820_TYPE_RAM;
+			swap_entry->addr = swap_addr;
+			swap_entry->size = swap_size;
+
+			/* Remember PFN<->MFN relation for P2M update. */
+			xen_add_remap_nonram(swap_addr, entry_end - swap_size,
+					     swap_size);
+
+			/* Order E820 table and merge entries. */
+			e820__update_table(&xen_e820_table);
+
+			return;
+		}
+
+		entry++;
+	}
+
+	xen_raw_console_write("No suitable area found for required E820 entry remapping action\n");
+	BUG();
+}
+
+/*
+ * Look for non-RAM memory types in a specific guest physical area and move
+ * those away if possible (ACPI NVS only for now).
+ */
+static void __init xen_e820_resolve_conflicts(phys_addr_t start,
+					      phys_addr_t size)
+{
+	struct e820_entry *entry;
+	unsigned int mapcnt;
+	phys_addr_t end;
+
+	if (!size)
+		return;
+
+	end = start + size;
+	entry = xen_e820_table.entries;
+
+	for (mapcnt = 0; mapcnt < xen_e820_table.nr_entries; mapcnt++) {
+		if (entry->addr >= end)
+			return;
+
+		if (entry->addr + entry->size > start &&
+		    entry->type == E820_TYPE_NVS)
+			xen_e820_swap_entry_with_ram(entry);
+
+		entry++;
+	}
+}
+
+/*
+ * Check for an area in physical memory to be usable for non-movable purposes.
+ * An area is considered to usable if the used E820 map lists it to be RAM or
+ * some other type which can be moved to higher PFNs while keeping the MFNs.
+ * In case the area is not usable, crash the system with an error message.
+ */
+void __init xen_chk_is_e820_usable(phys_addr_t start, phys_addr_t size,
+				   const char *component)
+{
+	xen_e820_resolve_conflicts(start, size);
+
+	if (!xen_is_e820_reserved(start, size))
+		return;
+
+	xen_raw_console_write("Xen hypervisor allocated ");
+	xen_raw_console_write(component);
+	xen_raw_console_write(" memory conflicts with E820 map\n");
+	BUG();
+}
+
+/*
  * Like memcpy, but with physical addresses for dest and src.
  */
 static void __init xen_phys_memcpy(phys_addr_t dest, phys_addr_t src,
@@ -728,20 +792,20 @@
  **/
 char * __init xen_memory_setup(void)
 {
-	unsigned long max_pfn, pfn_s, n_pfns;
+	unsigned long pfn_s, n_pfns;
 	phys_addr_t mem_end, addr, size, chunk_size;
 	u32 type;
 	int rc;
 	struct xen_memory_map memmap;
 	unsigned long max_pages;
 	unsigned long extra_pages = 0;
+	unsigned long maxmem_pages;
 	int i;
 	int op;
 
 	xen_parse_512gb();
-	max_pfn = xen_get_pages_limit();
-	max_pfn = min(max_pfn, xen_start_info->nr_pages);
-	mem_end = PFN_PHYS(max_pfn);
+	ini_nr_pages = min(xen_get_pages_limit(), xen_start_info->nr_pages);
+	mem_end = PFN_PHYS(ini_nr_pages);
 
 	memmap.nr_entries = ARRAY_SIZE(xen_e820_table.entries);
 	set_xen_guest_handle(memmap.buffer, xen_e820_table.entries);
@@ -791,13 +855,35 @@
 	/* Make sure the Xen-supplied memory map is well-ordered. */
 	e820__update_table(&xen_e820_table);
 
+	/*
+	 * Check whether the kernel itself conflicts with the target E820 map.
+	 * Failing now is better than running into weird problems later due
+	 * to relocating (and even reusing) pages with kernel text or data.
+	 */
+	xen_chk_is_e820_usable(__pa_symbol(_text),
+			       __pa_symbol(_end) - __pa_symbol(_text),
+			       "kernel");
+
+	/*
+	 * Check for a conflict of the xen_start_info memory with the target
+	 * E820 map.
+	 */
+	xen_chk_is_e820_usable(__pa(xen_start_info), sizeof(*xen_start_info),
+			       "xen_start_info");
+
+	/*
+	 * Check for a conflict of the hypervisor supplied page tables with
+	 * the target E820 map.
+	 */
+	xen_pt_check_e820();
+
 	max_pages = xen_get_max_pages();
 
 	/* How many extra pages do we need due to remapping? */
-	max_pages += xen_foreach_remap_area(max_pfn, xen_count_remap_pages);
+	max_pages += xen_foreach_remap_area(xen_count_remap_pages);
 
-	if (max_pages > max_pfn)
-		extra_pages += max_pages - max_pfn;
+	if (max_pages > ini_nr_pages)
+		extra_pages += max_pages - ini_nr_pages;
 
 	/*
 	 * Clamp the amount of extra memory to a EXTRA_MEM_RATIO
@@ -806,8 +892,8 @@
 	 * Make sure we have no memory above max_pages, as this area
 	 * isn't handled by the p2m management.
 	 */
-	extra_pages = min3(EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)),
-			   extra_pages, max_pages - max_pfn);
+	maxmem_pages = EXTRA_MEM_RATIO * min(ini_nr_pages, PFN_DOWN(MAXMEM));
+	extra_pages = min3(maxmem_pages, extra_pages, max_pages - ini_nr_pages);
 	i = 0;
 	addr = xen_e820_table.entries[0].addr;
 	size = xen_e820_table.entries[0].size;
@@ -863,23 +949,6 @@
 
 	e820__update_table(e820_table);
 
-	/*
-	 * Check whether the kernel itself conflicts with the target E820 map.
-	 * Failing now is better than running into weird problems later due
-	 * to relocating (and even reusing) pages with kernel text or data.
-	 */
-	if (xen_is_e820_reserved(__pa_symbol(_text),
-			__pa_symbol(__bss_stop) - __pa_symbol(_text))) {
-		xen_raw_console_write("Xen hypervisor allocated kernel memory conflicts with E820 map\n");
-		BUG();
-	}
-
-	/*
-	 * Check for a conflict of the hypervisor supplied page tables with
-	 * the target E820 map.
-	 */
-	xen_pt_check_e820();
-
 	xen_reserve_xen_mfnlist();
 
 	/* Check for a conflict of the initrd with the target E820 map. */
@@ -907,7 +976,7 @@
 	 * Set identity map on non-RAM pages and prepare remapping the
 	 * underlying RAM.
 	 */
-	xen_foreach_remap_area(max_pfn, xen_set_identity_and_remap_chunk);
+	xen_foreach_remap_area(xen_set_identity_and_remap_chunk);
 
 	pr_info("Released %ld page(s)\n", xen_released_pages);
 
--- linux-qcom-6.8.0.orig/arch/x86/xen/xen-asm.S
+++ linux-qcom-6.8.0/arch/x86/xen/xen-asm.S
@@ -20,10 +20,33 @@
 
 #include <linux/init.h>
 #include <linux/linkage.h>
+#include <linux/objtool.h>
 #include <../entry/calling.h>
 
 .pushsection .noinstr.text, "ax"
 /*
+ * PV hypercall interface to the hypervisor.
+ *
+ * Called via inline asm(), so better preserve %rcx and %r11.
+ *
+ * Input:
+ *	%eax: hypercall number
+ *	%rdi, %rsi, %rdx, %r10, %r8: args 1..5 for the hypercall
+ * Output: %rax
+ */
+SYM_FUNC_START(xen_hypercall_pv)
+	ANNOTATE_NOENDBR
+	push %rcx
+	push %r11
+	UNWIND_HINT_SAVE
+	syscall
+	UNWIND_HINT_RESTORE
+	pop %r11
+	pop %rcx
+	RET
+SYM_FUNC_END(xen_hypercall_pv)
+
+/*
  * Disabling events is simply a matter of making the event mask
  * non-zero.
  */
@@ -176,7 +199,6 @@
 SYM_CODE_END(xen_early_idt_handler_array)
 	__FINIT
 
-hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32
 /*
  * Xen64 iret frame:
  *
@@ -186,17 +208,28 @@
  *	cs
  *	rip		<-- standard iret frame
  *
- *	flags
+ *	flags		<-- xen_iret must push from here on
  *
- *	rcx		}
- *	r11		}<-- pushed by hypercall page
- * rsp->rax		}
+ *	rcx
+ *	r11
+ * rsp->rax
  */
+.macro xen_hypercall_iret
+	pushq $0	/* Flags */
+	push %rcx
+	push %r11
+	push %rax
+	mov  $__HYPERVISOR_iret, %eax
+	syscall		/* Do the IRET. */
+#ifdef CONFIG_SLS
+	int3
+#endif
+.endm
+
 SYM_CODE_START(xen_iret)
 	UNWIND_HINT_UNDEFINED
 	ANNOTATE_NOENDBR
-	pushq $0
-	jmp hypercall_iret
+	xen_hypercall_iret
 SYM_CODE_END(xen_iret)
 
 /*
@@ -301,8 +334,7 @@
 	ENDBR
 	lea 16(%rsp), %rsp	/* strip %rcx, %r11 */
 	mov $-ENOSYS, %rax
-	pushq $0
-	jmp hypercall_iret
+	xen_hypercall_iret
 SYM_CODE_END(xen_entry_SYSENTER_compat)
 SYM_CODE_END(xen_entry_SYSCALL_compat)
 
--- linux-qcom-6.8.0.orig/arch/x86/xen/xen-head.S
+++ linux-qcom-6.8.0/arch/x86/xen/xen-head.S
@@ -6,9 +6,11 @@
 
 #include <linux/elfnote.h>
 #include <linux/init.h>
+#include <linux/instrumentation.h>
 
 #include <asm/boot.h>
 #include <asm/asm.h>
+#include <asm/frame.h>
 #include <asm/msr.h>
 #include <asm/page_types.h>
 #include <asm/percpu.h>
@@ -20,28 +22,6 @@
 #include <xen/interface/xen-mca.h>
 #include <asm/xen/interface.h>
 
-.pushsection .noinstr.text, "ax"
-	.balign PAGE_SIZE
-SYM_CODE_START(hypercall_page)
-	.rept (PAGE_SIZE / 32)
-		UNWIND_HINT_FUNC
-		ANNOTATE_NOENDBR
-		ANNOTATE_UNRET_SAFE
-		ret
-		/*
-		 * Xen will write the hypercall page, and sort out ENDBR.
-		 */
-		.skip 31, 0xcc
-	.endr
-
-#define HYPERCALL(n) \
-	.equ xen_hypercall_##n, hypercall_page + __HYPERVISOR_##n * 32; \
-	.type xen_hypercall_##n, @function; .size xen_hypercall_##n, 32
-#include <asm/xen-hypercalls.h>
-#undef HYPERCALL
-SYM_CODE_END(hypercall_page)
-.popsection
-
 #ifdef CONFIG_XEN_PV
 	__INIT
 SYM_CODE_START(startup_xen)
@@ -87,6 +67,88 @@
 #endif
 #endif
 
+	.pushsection .noinstr.text, "ax"
+/*
+ * Xen hypercall interface to the hypervisor.
+ *
+ * Input:
+ *     %eax: hypercall number
+ *   32-bit:
+ *     %ebx, %ecx, %edx, %esi, %edi: args 1..5 for the hypercall
+ *   64-bit:
+ *     %rdi, %rsi, %rdx, %r10, %r8: args 1..5 for the hypercall
+ * Output: %[er]ax
+ */
+SYM_FUNC_START(xen_hypercall_hvm)
+	ENDBR
+	FRAME_BEGIN
+	/* Save all relevant registers (caller save and arguments). */
+#ifdef CONFIG_X86_32
+	push %eax
+	push %ebx
+	push %ecx
+	push %edx
+	push %esi
+	push %edi
+#else
+	push %rax
+	push %rcx
+	push %rdx
+	push %rdi
+	push %rsi
+	push %r11
+	push %r10
+	push %r9
+	push %r8
+#ifdef CONFIG_FRAME_POINTER
+	pushq $0	/* Dummy push for stack alignment. */
+#endif
+#endif
+	/* Set the vendor specific function. */
+	call __xen_hypercall_setfunc
+	/* Set ZF = 1 if AMD, Restore saved registers. */
+#ifdef CONFIG_X86_32
+	lea xen_hypercall_amd, %ebx
+	cmp %eax, %ebx
+	pop %edi
+	pop %esi
+	pop %edx
+	pop %ecx
+	pop %ebx
+	pop %eax
+#else
+	lea xen_hypercall_amd(%rip), %rcx
+	cmp %rax, %rcx
+#ifdef CONFIG_FRAME_POINTER
+	pop %rax	/* Dummy pop. */
+#endif
+	pop %r8
+	pop %r9
+	pop %r10
+	pop %r11
+	pop %rsi
+	pop %rdi
+	pop %rdx
+	pop %rcx
+	pop %rax
+#endif
+	FRAME_END
+	/* Use correct hypercall function. */
+	jz xen_hypercall_amd
+	jmp xen_hypercall_intel
+SYM_FUNC_END(xen_hypercall_hvm)
+
+SYM_FUNC_START(xen_hypercall_amd)
+	vmmcall
+	RET
+SYM_FUNC_END(xen_hypercall_amd)
+
+SYM_FUNC_START(xen_hypercall_intel)
+	vmcall
+	RET
+SYM_FUNC_END(xen_hypercall_intel)
+	.popsection
+
 	ELFNOTE(Xen, XEN_ELFNOTE_GUEST_OS,       .asciz "linux")
 	ELFNOTE(Xen, XEN_ELFNOTE_GUEST_VERSION,  .asciz "2.6")
 	ELFNOTE(Xen, XEN_ELFNOTE_XEN_VERSION,    .asciz "xen-3.0")
@@ -115,7 +177,6 @@
 #else
 # define FEATURES_DOM0 0
 #endif
-	ELFNOTE(Xen, XEN_ELFNOTE_HYPERCALL_PAGE, _ASM_PTR hypercall_page)
 	ELFNOTE(Xen, XEN_ELFNOTE_SUPPORTED_FEATURES,
 		.long FEATURES_PV | FEATURES_PVH | FEATURES_DOM0)
 	ELFNOTE(Xen, XEN_ELFNOTE_LOADER,         .asciz "generic")
--- linux-qcom-6.8.0.orig/arch/x86/xen/xen-ops.h
+++ linux-qcom-6.8.0/arch/x86/xen/xen-ops.h
@@ -43,8 +43,12 @@
 #ifdef CONFIG_X86_64
 void __init xen_relocate_p2m(void);
 #endif
+void __init xen_do_remap_nonram(void);
+void __init xen_add_remap_nonram(phys_addr_t maddr, phys_addr_t paddr,
+				 unsigned long size);
 
-bool __init xen_is_e820_reserved(phys_addr_t start, phys_addr_t size);
+void __init xen_chk_is_e820_usable(phys_addr_t start, phys_addr_t size,
+				   const char *component);
 unsigned long __ref xen_chk_extra_mem(unsigned long pfn);
 void __init xen_inv_extra_mem(void);
 void __init xen_remap_memory(void);
@@ -163,4 +167,27 @@
 static inline void xen_hvm_post_suspend(int suspend_cancelled) {}
 #endif
 
+/*
+ * The maximum amount of extra memory compared to the base size.  The
+ * main scaling factor is the size of struct page.  At extreme ratios
+ * of base:extra, all the base memory can be filled with page
+ * structures for the extra memory, leaving no space for anything
+ * else.
+ *
+ * 10x seems like a reasonable balance between scaling flexibility and
+ * leaving a practically usable system.
+ */
+#define EXTRA_MEM_RATIO		(10)
+
+void xen_add_extra_mem(unsigned long start_pfn, unsigned long n_pfns);
+
+#ifdef CONFIG_XEN_PV
+void xen_hypercall_pv(void);
+#endif
+void xen_hypercall_hvm(void);
+void xen_hypercall_amd(void);
+void xen_hypercall_intel(void);
+void xen_hypercall_setfunc(void);
+void *__xen_hypercall_setfunc(void);
+
 #endif /* XEN_OPS_H */
--- linux-qcom-6.8.0.orig/arch/xtensa/Kconfig
+++ linux-qcom-6.8.0/arch/xtensa/Kconfig
@@ -13,6 +13,7 @@
 	select ARCH_HAS_DMA_SET_UNCACHED if MMU
 	select ARCH_HAS_STRNCPY_FROM_USER if !KASAN
 	select ARCH_HAS_STRNLEN_USER
+	select ARCH_NEED_CMPXCHG_1_EMU
 	select ARCH_USE_MEMTEST
 	select ARCH_USE_QUEUED_RWLOCKS
 	select ARCH_USE_QUEUED_SPINLOCKS
--- linux-qcom-6.8.0.orig/arch/xtensa/include/asm/cmpxchg.h
+++ linux-qcom-6.8.0/arch/xtensa/include/asm/cmpxchg.h
@@ -15,6 +15,7 @@
 
 #include <linux/bits.h>
 #include <linux/stringify.h>
+#include <linux/cmpxchg-emu.h>
 
 /*
  * cmpxchg
@@ -74,6 +75,7 @@
 __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
 {
 	switch (size) {
+	case 1:  return cmpxchg_emu_u8(ptr, old, new);
 	case 4:  return __cmpxchg_u32(ptr, old, new);
 	default: __cmpxchg_called_with_bad_pointer();
 		 return old;
--- linux-qcom-6.8.0.orig/arch/xtensa/include/asm/processor.h
+++ linux-qcom-6.8.0/arch/xtensa/include/asm/processor.h
@@ -115,9 +115,9 @@
 #define MAKE_RA_FOR_CALL(ra,ws)   (((ra) & 0x3fffffff) | (ws) << 30)
 
 /* Convert return address to a valid pc
- * Note: We assume that the stack pointer is in the same 1GB ranges as the ra
+ * Note: 'text' is the address within the same 1GB range as the ra
  */
-#define MAKE_PC_FROM_RA(ra,sp)    (((ra) & 0x3fffffff) | ((sp) & 0xc0000000))
+#define MAKE_PC_FROM_RA(ra, text) (((ra) & 0x3fffffff) | ((unsigned long)(text) & 0xc0000000))
 
 #elif defined(__XTENSA_CALL0_ABI__)
 
@@ -127,9 +127,9 @@
 #define MAKE_RA_FOR_CALL(ra, ws)   (ra)
 
 /* Convert return address to a valid pc
- * Note: We assume that the stack pointer is in the same 1GB ranges as the ra
+ * Note: 'text' is not used as 'ra' is always the full address
  */
-#define MAKE_PC_FROM_RA(ra, sp)    (ra)
+#define MAKE_PC_FROM_RA(ra, text)  (ra)
 
 #else
 #error Unsupported Xtensa ABI
--- linux-qcom-6.8.0.orig/arch/xtensa/include/asm/ptrace.h
+++ linux-qcom-6.8.0/arch/xtensa/include/asm/ptrace.h
@@ -87,7 +87,7 @@
 # define user_mode(regs) (((regs)->ps & 0x00000020)!=0)
 # define instruction_pointer(regs) ((regs)->pc)
 # define return_pointer(regs) (MAKE_PC_FROM_RA((regs)->areg[0], \
-					       (regs)->areg[1]))
+					       (regs)->pc))
 
 # ifndef CONFIG_SMP
 #  define profile_pc(regs) instruction_pointer(regs)
--- linux-qcom-6.8.0.orig/arch/xtensa/kernel/process.c
+++ linux-qcom-6.8.0/arch/xtensa/kernel/process.c
@@ -47,6 +47,7 @@
 #include <asm/asm-offsets.h>
 #include <asm/regs.h>
 #include <asm/hw_breakpoint.h>
+#include <asm/sections.h>
 #include <asm/traps.h>
 
 extern void ret_from_fork(void);
@@ -380,7 +381,7 @@
 	int count = 0;
 
 	sp = p->thread.sp;
-	pc = MAKE_PC_FROM_RA(p->thread.ra, p->thread.sp);
+	pc = MAKE_PC_FROM_RA(p->thread.ra, _text);
 
 	do {
 		if (sp < stack_page + sizeof(struct task_struct) ||
@@ -392,7 +393,7 @@
 
 		/* Stack layout: sp-4: ra, sp-3: sp' */
 
-		pc = MAKE_PC_FROM_RA(SPILL_SLOT(sp, 0), sp);
+		pc = MAKE_PC_FROM_RA(SPILL_SLOT(sp, 0), _text);
 		sp = SPILL_SLOT(sp, 1);
 	} while (count++ < 16);
 	return 0;
--- linux-qcom-6.8.0.orig/arch/xtensa/kernel/setup.c
+++ linux-qcom-6.8.0/arch/xtensa/kernel/setup.c
@@ -216,7 +216,7 @@
 
 void __init early_init_devtree(void *params)
 {
-	early_init_dt_scan(params);
+	early_init_dt_scan(params, __pa(params));
 	of_scan_flat_dt(xtensa_dt_io_area, NULL);
 
 	if (!command_line[0])
--- linux-qcom-6.8.0.orig/arch/xtensa/kernel/stacktrace.c
+++ linux-qcom-6.8.0/arch/xtensa/kernel/stacktrace.c
@@ -13,6 +13,7 @@
 #include <linux/stacktrace.h>
 
 #include <asm/ftrace.h>
+#include <asm/sections.h>
 #include <asm/stacktrace.h>
 #include <asm/traps.h>
 #include <linux/uaccess.h>
@@ -189,7 +190,7 @@
 		if (a1 <= (unsigned long)sp)
 			break;
 
-		frame.pc = MAKE_PC_FROM_RA(a0, a1);
+		frame.pc = MAKE_PC_FROM_RA(a0, _text);
 		frame.sp = a1;
 
 		if (fn(&frame, data))
--- linux-qcom-6.8.0.orig/block/bdev.c
+++ linux-qcom-6.8.0/block/bdev.c
@@ -639,6 +639,14 @@
 	bdev_write_inode(bdev);
 }
 
+static void blkdev_put_whole(struct block_device *bdev)
+{
+	if (atomic_dec_and_test(&bdev->bd_openers))
+		blkdev_flush_mapping(bdev);
+	if (bdev->bd_disk->fops->release)
+		bdev->bd_disk->fops->release(bdev->bd_disk);
+}
+
 static int blkdev_get_whole(struct block_device *bdev, blk_mode_t mode)
 {
 	struct gendisk *disk = bdev->bd_disk;
@@ -657,20 +665,21 @@
 
 	if (!atomic_read(&bdev->bd_openers))
 		set_init_blocksize(bdev);
-	if (test_bit(GD_NEED_PART_SCAN, &disk->state))
-		bdev_disk_changed(disk, false);
 	atomic_inc(&bdev->bd_openers);
+	if (test_bit(GD_NEED_PART_SCAN, &disk->state)) {
+		/*
+		 * Only return scanning errors if we are called from contexts
+		 * that explicitly want them, e.g. the BLKRRPART ioctl.
+		 */
+		ret = bdev_disk_changed(disk, false);
+		if (ret && (mode & BLK_OPEN_STRICT_SCAN)) {
+			blkdev_put_whole(bdev);
+			return ret;
+		}
+	}
 	return 0;
 }
 
-static void blkdev_put_whole(struct block_device *bdev)
-{
-	if (atomic_dec_and_test(&bdev->bd_openers))
-		blkdev_flush_mapping(bdev);
-	if (bdev->bd_disk->fops->release)
-		bdev->bd_disk->fops->release(bdev->bd_disk);
-}
-
 static int blkdev_get_part(struct block_device *part, blk_mode_t mode)
 {
 	struct gendisk *disk = part->bd_disk;
@@ -738,17 +747,17 @@
 
 static bool bdev_writes_blocked(struct block_device *bdev)
 {
-	return bdev->bd_writers == -1;
+	return bdev->bd_writers < 0;
 }
 
 static void bdev_block_writes(struct block_device *bdev)
 {
-	bdev->bd_writers = -1;
+	bdev->bd_writers--;
 }
 
 static void bdev_unblock_writes(struct block_device *bdev)
 {
-	bdev->bd_writers = 0;
+	bdev->bd_writers++;
 }
 
 static bool bdev_may_open(struct block_device *bdev, blk_mode_t mode)
@@ -864,7 +873,7 @@
 		goto abort_claiming;
 	ret = -EBUSY;
 	if (!bdev_may_open(bdev, mode))
-		goto abort_claiming;
+		goto put_module;
 	if (bdev_is_partition(bdev))
 		ret = blkdev_get_part(bdev, mode);
 	else
--- linux-qcom-6.8.0.orig/block/bfq-iosched.c
+++ linux-qcom-6.8.0/block/bfq-iosched.c
@@ -582,23 +582,31 @@
 #define BFQ_LIMIT_INLINE_DEPTH 16
 
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
-static bool bfqq_request_over_limit(struct bfq_queue *bfqq, int limit)
+static bool bfqq_request_over_limit(struct bfq_data *bfqd,
+				    struct bfq_io_cq *bic, blk_opf_t opf,
+				    unsigned int act_idx, int limit)
 {
-	struct bfq_data *bfqd = bfqq->bfqd;
-	struct bfq_entity *entity = &bfqq->entity;
 	struct bfq_entity *inline_entities[BFQ_LIMIT_INLINE_DEPTH];
 	struct bfq_entity **entities = inline_entities;
-	int depth, level, alloc_depth = BFQ_LIMIT_INLINE_DEPTH;
-	int class_idx = bfqq->ioprio_class - 1;
+	int alloc_depth = BFQ_LIMIT_INLINE_DEPTH;
 	struct bfq_sched_data *sched_data;
+	struct bfq_entity *entity;
+	struct bfq_queue *bfqq;
 	unsigned long wsum;
 	bool ret = false;
-
-	if (!entity->on_st_or_in_serv)
-		return false;
+	int depth;
+	int level;
 
 retry:
 	spin_lock_irq(&bfqd->lock);
+	bfqq = bic_to_bfqq(bic, op_is_sync(opf), act_idx);
+	if (!bfqq)
+		goto out;
+
+	entity = &bfqq->entity;
+	if (!entity->on_st_or_in_serv)
+		goto out;
+
 	/* +1 for bfqq entity, root cgroup not included */
 	depth = bfqg_to_blkg(bfqq_group(bfqq))->blkcg->css.cgroup->level + 1;
 	if (depth > alloc_depth) {
@@ -643,7 +651,7 @@
 			 * class.
 			 */
 			wsum = 0;
-			for (i = 0; i <= class_idx; i++) {
+			for (i = 0; i <= bfqq->ioprio_class - 1; i++) {
 				wsum = wsum * IOPRIO_BE_NR +
 					sched_data->service_tree[i].wsum;
 			}
@@ -666,7 +674,9 @@
 	return ret;
 }
 #else
-static bool bfqq_request_over_limit(struct bfq_queue *bfqq, int limit)
+static bool bfqq_request_over_limit(struct bfq_data *bfqd,
+				    struct bfq_io_cq *bic, blk_opf_t opf,
+				    unsigned int act_idx, int limit)
 {
 	return false;
 }
@@ -704,8 +714,9 @@
 	}
 
 	for (act_idx = 0; bic && act_idx < bfqd->num_actuators; act_idx++) {
-		struct bfq_queue *bfqq =
-			bic_to_bfqq(bic, op_is_sync(opf), act_idx);
+		/* Fast path to check if bfqq is already allocated. */
+		if (!bic_to_bfqq(bic, op_is_sync(opf), act_idx))
+			continue;
 
 		/*
 		 * Does queue (or any parent entity) exceed number of
@@ -713,7 +724,7 @@
 		 * limit depth so that it cannot consume more
 		 * available requests and thus starve other entities.
 		 */
-		if (bfqq && bfqq_request_over_limit(bfqq, limit)) {
+		if (bfqq_request_over_limit(bfqd, bic, opf, act_idx, limit)) {
 			depth = 1;
 			break;
 		}
@@ -2911,8 +2922,12 @@
 	struct bfq_iocq_bfqq_data *bfqq_data = &bic->bfqq_data[a_idx];
 
 	/* if a merge has already been setup, then proceed with that first */
-	if (bfqq->new_bfqq)
-		return bfqq->new_bfqq;
+	new_bfqq = bfqq->new_bfqq;
+	if (new_bfqq) {
+		while (new_bfqq->new_bfqq)
+			new_bfqq = new_bfqq->new_bfqq;
+		return new_bfqq;
+	}
 
 	/*
 	 * Check delayed stable merge for rotational or non-queueing
@@ -3125,10 +3140,12 @@
 	bfq_put_queue(bfqq);
 }
 
-static void
-bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,
-		struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
+static struct bfq_queue *bfq_merge_bfqqs(struct bfq_data *bfqd,
+					 struct bfq_io_cq *bic,
+					 struct bfq_queue *bfqq)
 {
+	struct bfq_queue *new_bfqq = bfqq->new_bfqq;
+
 	bfq_log_bfqq(bfqd, bfqq, "merging with queue %lu",
 		(unsigned long)new_bfqq->pid);
 	/* Save weight raising and idle window of the merged queues */
@@ -3222,6 +3239,8 @@
 	bfq_reassign_last_bfqq(bfqq, new_bfqq);
 
 	bfq_release_process_ref(bfqd, bfqq);
+
+	return new_bfqq;
 }
 
 static bool bfq_allow_bio_merge(struct request_queue *q, struct request *rq,
@@ -3257,14 +3276,8 @@
 		 * fulfilled, i.e., bic can be redirected to new_bfqq
 		 * and bfqq can be put.
 		 */
-		bfq_merge_bfqqs(bfqd, bfqd->bio_bic, bfqq,
-				new_bfqq);
-		/*
-		 * If we get here, bio will be queued into new_queue,
-		 * so use new_bfqq to decide whether bio and rq can be
-		 * merged.
-		 */
-		bfqq = new_bfqq;
+		while (bfqq != new_bfqq)
+			bfqq = bfq_merge_bfqqs(bfqd, bfqd->bio_bic, bfqq);
 
 		/*
 		 * Change also bqfd->bio_bfqq, as
@@ -5699,9 +5712,7 @@
 	 * state before killing it.
 	 */
 	bfqq->bic = bic;
-	bfq_merge_bfqqs(bfqd, bic, bfqq, new_bfqq);
-
-	return new_bfqq;
+	return bfq_merge_bfqqs(bfqd, bic, bfqq);
 }
 
 /*
@@ -6156,6 +6167,7 @@
 	bool waiting, idle_timer_disabled = false;
 
 	if (new_bfqq) {
+		struct bfq_queue *old_bfqq = bfqq;
 		/*
 		 * Release the request's reference to the old bfqq
 		 * and make sure one is taken to the shared queue.
@@ -6172,18 +6184,18 @@
 		 * new_bfqq.
 		 */
 		if (bic_to_bfqq(RQ_BIC(rq), true,
-				bfq_actuator_index(bfqd, rq->bio)) == bfqq)
-			bfq_merge_bfqqs(bfqd, RQ_BIC(rq),
-					bfqq, new_bfqq);
+				bfq_actuator_index(bfqd, rq->bio)) == bfqq) {
+			while (bfqq != new_bfqq)
+				bfqq = bfq_merge_bfqqs(bfqd, RQ_BIC(rq), bfqq);
+		}
 
-		bfq_clear_bfqq_just_created(bfqq);
+		bfq_clear_bfqq_just_created(old_bfqq);
 		/*
 		 * rq is about to be enqueued into new_bfqq,
 		 * release rq reference on bfqq
 		 */
-		bfq_put_queue(bfqq);
+		bfq_put_queue(old_bfqq);
 		rq->elv.priv[1] = new_bfqq;
-		bfqq = new_bfqq;
 	}
 
 	bfq_update_io_thinktime(bfqd, bfqq);
@@ -6721,7 +6733,7 @@
 {
 	bfq_log_bfqq(bfqq->bfqd, bfqq, "splitting queue");
 
-	if (bfqq_process_refs(bfqq) == 1) {
+	if (bfqq_process_refs(bfqq) == 1 && !bfqq->new_bfqq) {
 		bfqq->pid = current->pid;
 		bfq_clear_bfqq_coop(bfqq);
 		bfq_clear_bfqq_split_coop(bfqq);
@@ -6819,6 +6831,39 @@
 	rq->elv.priv[0] = rq->elv.priv[1] = NULL;
 }
 
+static struct bfq_queue *bfq_waker_bfqq(struct bfq_queue *bfqq)
+{
+	struct bfq_queue *new_bfqq = bfqq->new_bfqq;
+	struct bfq_queue *waker_bfqq = bfqq->waker_bfqq;
+
+	if (!waker_bfqq)
+		return NULL;
+
+	while (new_bfqq) {
+		if (new_bfqq == waker_bfqq) {
+			/*
+			 * If waker_bfqq is in the merge chain, and current
+			 * is the only process, waker_bfqq can be freed.
+			 */
+			if (bfqq_process_refs(waker_bfqq) == 1)
+				return NULL;
+
+			return waker_bfqq;
+		}
+
+		new_bfqq = new_bfqq->new_bfqq;
+	}
+
+	/*
+	 * If waker_bfqq is not in the merge chain, and it's procress reference
+	 * is 0, waker_bfqq can be freed.
+	 */
+	if (bfqq_process_refs(waker_bfqq) == 0)
+		return NULL;
+
+	return waker_bfqq;
+}
+
 /*
  * If needed, init rq, allocate bfq data structures associated with
  * rq, and increment reference counters in the destination bfq_queue
@@ -6880,7 +6925,7 @@
 		/* If the queue was seeky for too long, break it apart. */
 		if (bfq_bfqq_coop(bfqq) && bfq_bfqq_split_coop(bfqq) &&
 			!bic->bfqq_data[a_idx].stably_merged) {
-			struct bfq_queue *old_bfqq = bfqq;
+			struct bfq_queue *waker_bfqq = bfq_waker_bfqq(bfqq);
 
 			/* Update bic before losing reference to bfqq */
 			if (bfq_bfqq_in_large_burst(bfqq))
@@ -6900,7 +6945,7 @@
 				bfqq_already_existing = true;
 
 			if (!bfqq_already_existing) {
-				bfqq->waker_bfqq = old_bfqq->waker_bfqq;
+				bfqq->waker_bfqq = waker_bfqq;
 				bfqq->tentative_waker_bfqq = NULL;
 
 				/*
@@ -6910,7 +6955,7 @@
 				 * woken_list of the waker. See
 				 * bfq_check_waker for details.
 				 */
-				if (bfqq->waker_bfqq)
+				if (waker_bfqq)
 					hlist_add_head(&bfqq->woken_list_node,
 						       &bfqq->waker_bfqq->woken_list);
 			}
@@ -6932,7 +6977,8 @@
 	 * addition, if the queue has also just been split, we have to
 	 * resume its state.
 	 */
-	if (likely(bfqq != &bfqd->oom_bfqq) && bfqq_process_refs(bfqq) == 1) {
+	if (likely(bfqq != &bfqd->oom_bfqq) && !bfqq->new_bfqq &&
+	    bfqq_process_refs(bfqq) == 1) {
 		bfqq->bic = bic;
 		if (split) {
 			/*
--- linux-qcom-6.8.0.orig/block/bio-integrity.c
+++ linux-qcom-6.8.0/block/bio-integrity.c
@@ -431,6 +431,7 @@
 	unsigned long start, end;
 	unsigned int len, nr_pages;
 	unsigned int bytes, offset, i;
+	gfp_t gfp = GFP_NOIO;
 
 	if (!bi)
 		return true;
@@ -453,11 +454,19 @@
 		if (!bi->profile->generate_fn ||
 		    !(bi->flags & BLK_INTEGRITY_GENERATE))
 			return true;
+
+		/*
+		 * Zero the memory allocated to not leak uninitialized kernel
+		 * memory to disk.  For PI this only affects the app tag, but
+		 * for non-integrity metadata it affects the entire metadata
+		 * buffer.
+		 */
+		gfp |= __GFP_ZERO;
 	}
 
 	/* Allocate kernel buffer for protection data */
 	len = bio_integrity_bytes(bi, bio_sectors(bio));
-	buf = kmalloc(len, GFP_NOIO);
+	buf = kmalloc(len, gfp);
 	if (unlikely(buf == NULL)) {
 		printk(KERN_ERR "could not allocate integrity buffer\n");
 		goto err_end_io;
--- linux-qcom-6.8.0.orig/block/bio.c
+++ linux-qcom-6.8.0/block/bio.c
@@ -1152,7 +1152,7 @@
 
 	bio_for_each_folio_all(fi, bio) {
 		struct page *page;
-		size_t done = 0;
+		size_t nr_pages;
 
 		if (mark_dirty) {
 			folio_lock(fi.folio);
@@ -1160,10 +1160,11 @@
 			folio_unlock(fi.folio);
 		}
 		page = folio_page(fi.folio, fi.offset / PAGE_SIZE);
+		nr_pages = (fi.offset + fi.length - 1) / PAGE_SIZE -
+			   fi.offset / PAGE_SIZE + 1;
 		do {
 			bio_release_page(bio, page++);
-			done += PAGE_SIZE;
-		} while (done < fi.length);
+		} while (--nr_pages != 0);
 	}
 }
 EXPORT_SYMBOL_GPL(__bio_release_pages);
@@ -1602,8 +1603,18 @@
 	}
 
 	blk_throtl_bio_endio(bio);
-	/* release cgroup info */
-	bio_uninit(bio);
+#ifdef CONFIG_BLK_CGROUP
+	/*
+	 * Release cgroup info.  We shouldn't have to do this here, but quite
+	 * a few callers of bio_init fail to call bio_uninit, so we cover up
+	 * for that here at least for now.
+	 */
+	if (bio->bi_blkg) {
+		blkg_put(bio->bi_blkg);
+		bio->bi_blkg = NULL;
+	}
+#endif
+
 	if (bio->bi_end_io)
 		bio->bi_end_io(bio);
 }
--- linux-qcom-6.8.0.orig/block/blk-cgroup.c
+++ linux-qcom-6.8.0/block/blk-cgroup.c
@@ -323,6 +323,7 @@
 	blkg->q = disk->queue;
 	INIT_LIST_HEAD(&blkg->q_node);
 	blkg->blkcg = blkcg;
+	blkg->iostat.blkg = blkg;
 #ifdef CONFIG_BLK_CGROUP_PUNT_BIO
 	spin_lock_init(&blkg->async_bio_lock);
 	bio_list_init(&blkg->async_bios);
@@ -619,12 +620,45 @@
 	spin_unlock_irq(&q->queue_lock);
 }
 
+static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src)
+{
+	int i;
+
+	for (i = 0; i < BLKG_IOSTAT_NR; i++) {
+		dst->bytes[i] = src->bytes[i];
+		dst->ios[i] = src->ios[i];
+	}
+}
+
+static void __blkg_clear_stat(struct blkg_iostat_set *bis)
+{
+	struct blkg_iostat cur = {0};
+	unsigned long flags;
+
+	flags = u64_stats_update_begin_irqsave(&bis->sync);
+	blkg_iostat_set(&bis->cur, &cur);
+	blkg_iostat_set(&bis->last, &cur);
+	u64_stats_update_end_irqrestore(&bis->sync, flags);
+}
+
+static void blkg_clear_stat(struct blkcg_gq *blkg)
+{
+	int cpu;
+
+	for_each_possible_cpu(cpu) {
+		struct blkg_iostat_set *s = per_cpu_ptr(blkg->iostat_cpu, cpu);
+
+		__blkg_clear_stat(s);
+	}
+	__blkg_clear_stat(&blkg->iostat);
+}
+
 static int blkcg_reset_stats(struct cgroup_subsys_state *css,
 			     struct cftype *cftype, u64 val)
 {
 	struct blkcg *blkcg = css_to_blkcg(css);
 	struct blkcg_gq *blkg;
-	int i, cpu;
+	int i;
 
 	mutex_lock(&blkcg_pol_mutex);
 	spin_lock_irq(&blkcg->lock);
@@ -635,18 +669,7 @@
 	 * anyway.  If you get hit by a race, retry.
 	 */
 	hlist_for_each_entry(blkg, &blkcg->blkg_list, blkcg_node) {
-		for_each_possible_cpu(cpu) {
-			struct blkg_iostat_set *bis =
-				per_cpu_ptr(blkg->iostat_cpu, cpu);
-			memset(bis, 0, sizeof(*bis));
-
-			/* Re-initialize the cleared blkg_iostat_set */
-			u64_stats_init(&bis->sync);
-			bis->blkg = blkg;
-		}
-		memset(&blkg->iostat, 0, sizeof(blkg->iostat));
-		u64_stats_init(&blkg->iostat.sync);
-
+		blkg_clear_stat(blkg);
 		for (i = 0; i < BLKCG_MAX_POLS; i++) {
 			struct blkcg_policy *pol = blkcg_policy[i];
 
@@ -949,16 +972,6 @@
 }
 EXPORT_SYMBOL_GPL(blkg_conf_exit);
 
-static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src)
-{
-	int i;
-
-	for (i = 0; i < BLKG_IOSTAT_NR; i++) {
-		dst->bytes[i] = src->bytes[i];
-		dst->ios[i] = src->ios[i];
-	}
-}
-
 static void blkg_iostat_add(struct blkg_iostat *dst, struct blkg_iostat *src)
 {
 	int i;
@@ -1024,7 +1037,19 @@
 		struct blkg_iostat cur;
 		unsigned int seq;
 
+		/*
+		 * Order assignment of `next_bisc` from `bisc->lnode.next` in
+		 * llist_for_each_entry_safe and clearing `bisc->lqueued` for
+		 * avoiding to assign `next_bisc` with new next pointer added
+		 * in blk_cgroup_bio_start() in case of re-ordering.
+		 *
+		 * The pair barrier is implied in llist_add() in blk_cgroup_bio_start().
+		 */
+		smp_mb();
+
 		WRITE_ONCE(bisc->lqueued, false);
+		if (bisc == &blkg->iostat)
+			goto propagate_up; /* propagate up to parent only */
 
 		/* fetch the current per-cpu values */
 		do {
@@ -1034,10 +1059,24 @@
 
 		blkcg_iostat_update(blkg, &cur, &bisc->last);
 
+propagate_up:
 		/* propagate global delta to parent (unless that's root) */
-		if (parent && parent->parent)
+		if (parent && parent->parent) {
 			blkcg_iostat_update(parent, &blkg->iostat.cur,
 					    &blkg->iostat.last);
+			/*
+			 * Queue parent->iostat to its blkcg's lockless
+			 * list to propagate up to the grandparent if the
+			 * iostat hasn't been queued yet.
+			 */
+			if (!parent->iostat.lqueued) {
+				struct llist_head *plhead;
+
+				plhead = per_cpu_ptr(parent->blkcg->lhead, cpu);
+				llist_add(&parent->iostat.lnode, plhead);
+				parent->iostat.lqueued = true;
+			}
+		}
 	}
 	raw_spin_unlock_irqrestore(&blkg_stat_lock, flags);
 out:
@@ -1286,10 +1325,14 @@
 	struct blkcg *blkcg = css_to_blkcg(blkcg_css);
 
 	do {
+		struct blkcg *parent;
+
 		if (!refcount_dec_and_test(&blkcg->online_pin))
 			break;
+
+		parent = blkcg_parent(blkcg);
 		blkcg_destroy_blkgs(blkcg);
-		blkcg = blkcg_parent(blkcg);
+		blkcg = parent;
 	} while (blkcg);
 }
 
@@ -1409,6 +1452,12 @@
 	return 0;
 }
 
+void blkg_init_queue(struct request_queue *q)
+{
+	INIT_LIST_HEAD(&q->blkg_list);
+	mutex_init(&q->blkcg_mutex);
+}
+
 int blkcg_init_disk(struct gendisk *disk)
 {
 	struct request_queue *q = disk->queue;
@@ -1416,9 +1465,6 @@
 	bool preloaded;
 	int ret;
 
-	INIT_LIST_HEAD(&q->blkg_list);
-	mutex_init(&q->blkcg_mutex);
-
 	new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL);
 	if (!new_blkg)
 		return -ENOMEM;
--- linux-qcom-6.8.0.orig/block/blk-cgroup.h
+++ linux-qcom-6.8.0/block/blk-cgroup.h
@@ -188,6 +188,7 @@
 extern struct blkcg blkcg_root;
 extern bool blkcg_debug_stats;
 
+void blkg_init_queue(struct request_queue *q);
 int blkcg_init_disk(struct gendisk *disk);
 void blkcg_exit_disk(struct gendisk *disk);
 
@@ -481,6 +482,7 @@
 };
 
 static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg, void *key) { return NULL; }
+static inline void blkg_init_queue(struct request_queue *q) { }
 static inline int blkcg_init_disk(struct gendisk *disk) { return 0; }
 static inline void blkcg_exit_disk(struct gendisk *disk) { }
 static inline int blkcg_policy_register(struct blkcg_policy *pol) { return 0; }
--- linux-qcom-6.8.0.orig/block/blk-core.c
+++ linux-qcom-6.8.0/block/blk-core.c
@@ -273,6 +273,8 @@
 		blk_mq_release(q);
 
 	ida_free(&blk_queue_ida, q->id);
+	lockdep_unregister_key(&q->io_lock_cls_key);
+	lockdep_unregister_key(&q->q_lock_cls_key);
 	call_rcu(&q->rcu_head, blk_free_queue_rcu);
 }
 
@@ -290,18 +292,20 @@
 }
 EXPORT_SYMBOL(blk_put_queue);
 
-void blk_queue_start_drain(struct request_queue *q)
+bool blk_queue_start_drain(struct request_queue *q)
 {
 	/*
 	 * When queue DYING flag is set, we need to block new req
 	 * entering queue, so we call blk_freeze_queue_start() to
 	 * prevent I/O from crossing blk_queue_enter().
 	 */
-	blk_freeze_queue_start(q);
+	bool freeze = __blk_freeze_queue_start(q, current);
 	if (queue_is_mq(q))
 		blk_mq_wake_waiters(q);
 	/* Make blk_queue_enter() reexamine the DYING flag. */
 	wake_up_all(&q->mq_freeze_wq);
+
+	return freeze;
 }
 
 /**
@@ -333,6 +337,8 @@
 			return -ENODEV;
 	}
 
+	rwsem_acquire_read(&q->q_lockdep_map, 0, 0, _RET_IP_);
+	rwsem_release(&q->q_lockdep_map, _RET_IP_);
 	return 0;
 }
 
@@ -364,6 +370,8 @@
 			goto dead;
 	}
 
+	rwsem_acquire_read(&q->io_lockdep_map, 0, 0, _RET_IP_);
+	rwsem_release(&q->io_lockdep_map, _RET_IP_);
 	return 0;
 dead:
 	bio_io_error(bio);
@@ -431,6 +439,8 @@
 	init_waitqueue_head(&q->mq_freeze_wq);
 	mutex_init(&q->mq_freeze_lock);
 
+	blkg_init_queue(q);
+
 	/*
 	 * Init percpu_ref in atomic mode so that it's faster to shutdown.
 	 * See blk_register_queue() for details.
@@ -439,6 +449,12 @@
 				blk_queue_usage_counter_release,
 				PERCPU_REF_INIT_ATOMIC, GFP_KERNEL))
 		goto fail_stats;
+	lockdep_register_key(&q->io_lock_cls_key);
+	lockdep_register_key(&q->q_lock_cls_key);
+	lockdep_init_map(&q->io_lockdep_map, "&q->q_usage_counter(io)",
+			 &q->io_lock_cls_key, 0);
+	lockdep_init_map(&q->q_lockdep_map, "&q->q_usage_counter(queue)",
+			 &q->q_lock_cls_key, 0);
 
 	blk_set_default_limits(&q->limits);
 	q->nr_requests = BLKDEV_DEFAULT_RQ;
@@ -974,10 +990,11 @@
 	unsigned long stamp;
 again:
 	stamp = READ_ONCE(part->bd_stamp);
-	if (unlikely(time_after(now, stamp))) {
-		if (likely(try_cmpxchg(&part->bd_stamp, &stamp, now)))
-			__part_stat_add(part, io_ticks, end ? now - stamp : 1);
-	}
+	if (unlikely(time_after(now, stamp)) &&
+	    likely(try_cmpxchg(&part->bd_stamp, &stamp, now)) &&
+	    (end || part_in_flight(part)))
+		__part_stat_add(part, io_ticks, now - stamp);
+
 	if (part->bd_partno) {
 		part = bdev_whole(part);
 		goto again;
--- linux-qcom-6.8.0.orig/block/blk-crypto-fallback.c
+++ linux-qcom-6.8.0/block/blk-crypto-fallback.c
@@ -87,7 +87,7 @@
  * This is the key we set when evicting a keyslot. This *should* be the all 0's
  * key, but AES-XTS rejects that key, so we use some random bytes instead.
  */
-static u8 blank_key[BLK_CRYPTO_MAX_KEY_SIZE];
+static u8 blank_key[BLK_CRYPTO_MAX_STANDARD_KEY_SIZE];
 
 static void blk_crypto_fallback_evict_keyslot(unsigned int slot)
 {
@@ -538,7 +538,7 @@
 	if (blk_crypto_fallback_inited)
 		return 0;
 
-	get_random_bytes(blank_key, BLK_CRYPTO_MAX_KEY_SIZE);
+	get_random_bytes(blank_key, sizeof(blank_key));
 
 	err = bioset_init(&crypto_bio_split, 64, 0, 0);
 	if (err)
@@ -560,6 +560,7 @@
 
 	blk_crypto_fallback_profile->ll_ops = blk_crypto_fallback_ll_ops;
 	blk_crypto_fallback_profile->max_dun_bytes_supported = BLK_CRYPTO_MAX_IV_SIZE;
+	blk_crypto_fallback_profile->key_types_supported = BLK_CRYPTO_KEY_TYPE_STANDARD;
 
 	/* All blk-crypto modes have a crypto API fallback. */
 	for (i = 0; i < BLK_ENCRYPTION_MODE_MAX; i++)
--- linux-qcom-6.8.0.orig/block/blk-crypto-internal.h
+++ linux-qcom-6.8.0/block/blk-crypto-internal.h
@@ -14,6 +14,7 @@
 	const char *name; /* name of this mode, shown in sysfs */
 	const char *cipher_str; /* crypto API name (for fallback case) */
 	unsigned int keysize; /* key size in bytes */
+	unsigned int security_strength; /* security strength in bytes */
 	unsigned int ivsize; /* iv size in bytes */
 };
 
@@ -82,6 +83,9 @@
 bool __blk_crypto_cfg_supported(struct blk_crypto_profile *profile,
 				const struct blk_crypto_config *cfg);
 
+int blk_crypto_ioctl(struct block_device *bdev, unsigned int cmd,
+		     void __user *argp);
+
 #else /* CONFIG_BLK_INLINE_ENCRYPTION */
 
 static inline int blk_crypto_sysfs_register(struct gendisk *disk)
@@ -129,6 +133,12 @@
 	return false;
 }
 
+static inline int blk_crypto_ioctl(struct block_device *bdev, unsigned int cmd,
+				   void __user *argp)
+{
+	return -ENOTTY;
+}
+
 #endif /* CONFIG_BLK_INLINE_ENCRYPTION */
 
 void __bio_crypt_advance(struct bio *bio, unsigned int bytes);
--- linux-qcom-6.8.0.orig/block/blk-crypto-profile.c
+++ linux-qcom-6.8.0/block/blk-crypto-profile.c
@@ -352,6 +352,8 @@
 		return false;
 	if (profile->max_dun_bytes_supported < cfg->dun_bytes)
 		return false;
+	if (!(profile->key_types_supported & cfg->key_type))
+		return false;
 	return true;
 }
 
@@ -463,6 +465,117 @@
 EXPORT_SYMBOL_GPL(blk_crypto_register);
 
 /**
+ * blk_crypto_derive_sw_secret() - Derive software secret from wrapped key
+ * @bdev: a block device whose hardware-wrapped keys implementation is
+ *	  compatible (blk_crypto_hw_wrapped_keys_compatible()) with all block
+ *	  devices on which the key will be used.
+ * @eph_key: the hardware-wrapped key in ephemerally-wrapped form
+ * @eph_key_size: size of @eph_key in bytes
+ * @sw_secret: (output) the software secret
+ *
+ * Given a hardware-wrapped key in ephemerally-wrapped form (the same form that
+ * it is used for I/O), ask the hardware to derive the secret which software can
+ * use for cryptographic tasks other than inline encryption.  This secret is
+ * guaranteed to be cryptographically isolated from the inline encryption key,
+ * i.e. derived with a different KDF context.
+ *
+ * Return: 0 on success, -EOPNOTSUPP if the block device doesn't support
+ *	   hardware-wrapped keys, -EBADMSG if the key isn't a valid
+ *	   hardware-wrapped key, or another -errno code.
+ */
+int blk_crypto_derive_sw_secret(struct block_device *bdev,
+				const u8 *eph_key, size_t eph_key_size,
+				u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE])
+{
+	struct blk_crypto_profile *profile =
+		bdev_get_queue(bdev)->crypto_profile;
+	int err;
+
+	if (!profile)
+		return -EOPNOTSUPP;
+	if (!(profile->key_types_supported & BLK_CRYPTO_KEY_TYPE_HW_WRAPPED))
+		return -EOPNOTSUPP;
+	if (!profile->ll_ops.derive_sw_secret)
+		return -EOPNOTSUPP;
+	blk_crypto_hw_enter(profile);
+	err = profile->ll_ops.derive_sw_secret(profile, eph_key, eph_key_size,
+					       sw_secret);
+	blk_crypto_hw_exit(profile);
+	return err;
+}
+
+/**
+ * blk_crypto_hw_wrapped_keys_compatible() - Check HW-wrapped key compatibility
+ * @bdev1: the first block device
+ * @bdev2: the second block device
+ *
+ * Return: true if HW-wrapped keys used on @bdev1 can also be used on @bdev2.
+ */
+bool blk_crypto_hw_wrapped_keys_compatible(struct block_device *bdev1,
+					   struct block_device *bdev2)
+{
+	return bdev_get_queue(bdev1)->crypto_profile ==
+		bdev_get_queue(bdev2)->crypto_profile;
+}
+
+int blk_crypto_import_key(struct blk_crypto_profile *profile,
+			  const u8 *raw_key, size_t raw_key_size,
+			  u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	int ret;
+
+	if (!profile)
+		return -EOPNOTSUPP;
+	if (!(profile->key_types_supported & BLK_CRYPTO_KEY_TYPE_HW_WRAPPED))
+		return -EOPNOTSUPP;
+	if (!profile->ll_ops.import_key)
+		return -EOPNOTSUPP;
+	blk_crypto_hw_enter(profile);
+	ret = profile->ll_ops.import_key(profile, raw_key, raw_key_size,
+					 lt_key);
+	blk_crypto_hw_exit(profile);
+	return ret;
+}
+
+int blk_crypto_generate_key(struct blk_crypto_profile *profile,
+			    u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	int ret;
+
+	if (!profile)
+		return -EOPNOTSUPP;
+	if (!(profile->key_types_supported & BLK_CRYPTO_KEY_TYPE_HW_WRAPPED))
+		return -EOPNOTSUPP;
+	if (!profile->ll_ops.generate_key)
+		return -EOPNOTSUPP;
+
+	blk_crypto_hw_enter(profile);
+	ret = profile->ll_ops.generate_key(profile, lt_key);
+	blk_crypto_hw_exit(profile);
+	return ret;
+}
+
+int blk_crypto_prepare_key(struct blk_crypto_profile *profile,
+			   const u8 *lt_key, size_t lt_key_size,
+			   u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	int ret;
+
+	if (!profile)
+		return -EOPNOTSUPP;
+	if (!(profile->key_types_supported & BLK_CRYPTO_KEY_TYPE_HW_WRAPPED))
+		return -EOPNOTSUPP;
+	if (!profile->ll_ops.prepare_key)
+		return -EOPNOTSUPP;
+
+	blk_crypto_hw_enter(profile);
+	ret = profile->ll_ops.prepare_key(profile, lt_key, lt_key_size,
+					  eph_key);
+	blk_crypto_hw_exit(profile);
+	return ret;
+}
+
+/**
  * blk_crypto_intersect_capabilities() - restrict supported crypto capabilities
  *					 by child device
  * @parent: the crypto profile for the parent device
@@ -485,10 +598,12 @@
 			    child->max_dun_bytes_supported);
 		for (i = 0; i < ARRAY_SIZE(child->modes_supported); i++)
 			parent->modes_supported[i] &= child->modes_supported[i];
+		parent->key_types_supported &= child->key_types_supported;
 	} else {
 		parent->max_dun_bytes_supported = 0;
 		memset(parent->modes_supported, 0,
 		       sizeof(parent->modes_supported));
+		parent->key_types_supported = 0;
 	}
 }
 EXPORT_SYMBOL_GPL(blk_crypto_intersect_capabilities);
@@ -521,6 +636,9 @@
 	    target->max_dun_bytes_supported)
 		return false;
 
+	if (reference->key_types_supported & ~target->key_types_supported)
+		return false;
+
 	return true;
 }
 EXPORT_SYMBOL_GPL(blk_crypto_has_capabilities);
@@ -555,5 +673,6 @@
 	       sizeof(dst->modes_supported));
 
 	dst->max_dun_bytes_supported = src->max_dun_bytes_supported;
+	dst->key_types_supported = src->key_types_supported;
 }
 EXPORT_SYMBOL_GPL(blk_crypto_update_capabilities);
--- linux-qcom-6.8.0.orig/block/blk-crypto-sysfs.c
+++ linux-qcom-6.8.0/block/blk-crypto-sysfs.c
@@ -31,6 +31,13 @@
 	return container_of(attr, struct blk_crypto_attr, attr);
 }
 
+static ssize_t hw_wrapped_keys_show(struct blk_crypto_profile *profile,
+				    struct blk_crypto_attr *attr, char *page)
+{
+	/* Always show supported, since the file doesn't exist otherwise. */
+	return sysfs_emit(page, "supported\n");
+}
+
 static ssize_t max_dun_bits_show(struct blk_crypto_profile *profile,
 				 struct blk_crypto_attr *attr, char *page)
 {
@@ -43,20 +50,48 @@
 	return sysfs_emit(page, "%u\n", profile->num_slots);
 }
 
+static ssize_t standard_keys_show(struct blk_crypto_profile *profile,
+				  struct blk_crypto_attr *attr, char *page)
+{
+	/* Always show supported, since the file doesn't exist otherwise. */
+	return sysfs_emit(page, "supported\n");
+}
+
 #define BLK_CRYPTO_RO_ATTR(_name) \
 	static struct blk_crypto_attr _name##_attr = __ATTR_RO(_name)
 
+BLK_CRYPTO_RO_ATTR(hw_wrapped_keys);
 BLK_CRYPTO_RO_ATTR(max_dun_bits);
 BLK_CRYPTO_RO_ATTR(num_keyslots);
+BLK_CRYPTO_RO_ATTR(standard_keys);
+
+static umode_t blk_crypto_is_visible(struct kobject *kobj,
+				     struct attribute *attr, int n)
+{
+	struct blk_crypto_profile *profile = kobj_to_crypto_profile(kobj);
+	struct blk_crypto_attr *a = attr_to_crypto_attr(attr);
+
+	if (a == &hw_wrapped_keys_attr &&
+	    !(profile->key_types_supported & BLK_CRYPTO_KEY_TYPE_HW_WRAPPED))
+		return 0;
+	if (a == &standard_keys_attr &&
+	    !(profile->key_types_supported & BLK_CRYPTO_KEY_TYPE_STANDARD))
+		return 0;
+
+	return 0444;
+}
 
 static struct attribute *blk_crypto_attrs[] = {
+	&hw_wrapped_keys_attr.attr,
 	&max_dun_bits_attr.attr,
 	&num_keyslots_attr.attr,
+	&standard_keys_attr.attr,
 	NULL,
 };
 
 static const struct attribute_group blk_crypto_attr_group = {
 	.attrs = blk_crypto_attrs,
+	.is_visible = blk_crypto_is_visible,
 };
 
 /*
--- linux-qcom-6.8.0.orig/block/blk-crypto.c
+++ linux-qcom-6.8.0/block/blk-crypto.c
@@ -23,24 +23,28 @@
 		.name = "AES-256-XTS",
 		.cipher_str = "xts(aes)",
 		.keysize = 64,
+		.security_strength = 32,
 		.ivsize = 16,
 	},
 	[BLK_ENCRYPTION_MODE_AES_128_CBC_ESSIV] = {
 		.name = "AES-128-CBC-ESSIV",
 		.cipher_str = "essiv(cbc(aes),sha256)",
 		.keysize = 16,
+		.security_strength = 16,
 		.ivsize = 16,
 	},
 	[BLK_ENCRYPTION_MODE_ADIANTUM] = {
 		.name = "Adiantum",
 		.cipher_str = "adiantum(xchacha12,aes)",
 		.keysize = 32,
+		.security_strength = 32,
 		.ivsize = 32,
 	},
 	[BLK_ENCRYPTION_MODE_SM4_XTS] = {
 		.name = "SM4-XTS",
 		.cipher_str = "xts(sm4)",
 		.keysize = 32,
+		.security_strength = 16,
 		.ivsize = 16,
 	},
 };
@@ -76,9 +80,15 @@
 	/* This is assumed in various places. */
 	BUILD_BUG_ON(BLK_ENCRYPTION_MODE_INVALID != 0);
 
-	/* Sanity check that no algorithm exceeds the defined limits. */
+	/*
+	 * Validate the crypto mode properties.  This ideally would be done with
+	 * static assertions, but boot-time checks are the next best thing.
+	 */
 	for (i = 0; i < BLK_ENCRYPTION_MODE_MAX; i++) {
-		BUG_ON(blk_crypto_modes[i].keysize > BLK_CRYPTO_MAX_KEY_SIZE);
+		BUG_ON(blk_crypto_modes[i].keysize >
+		       BLK_CRYPTO_MAX_STANDARD_KEY_SIZE);
+		BUG_ON(blk_crypto_modes[i].security_strength >
+		       blk_crypto_modes[i].keysize);
 		BUG_ON(blk_crypto_modes[i].ivsize > BLK_CRYPTO_MAX_IV_SIZE);
 	}
 
@@ -315,8 +325,9 @@
 /**
  * blk_crypto_init_key() - Prepare a key for use with blk-crypto
  * @blk_key: Pointer to the blk_crypto_key to initialize.
- * @raw_key: Pointer to the raw key. Must be the correct length for the chosen
- *	     @crypto_mode; see blk_crypto_modes[].
+ * @raw_key: the raw bytes of the key
+ * @raw_key_size: size of the raw key in bytes
+ * @key_type: type of the key -- either standard or hardware-wrapped
  * @crypto_mode: identifier for the encryption algorithm to use
  * @dun_bytes: number of bytes that will be used to specify the DUN when this
  *	       key is used
@@ -325,7 +336,9 @@
  * Return: 0 on success, -errno on failure.  The caller is responsible for
  *	   zeroizing both blk_key and raw_key when done with them.
  */
-int blk_crypto_init_key(struct blk_crypto_key *blk_key, const u8 *raw_key,
+int blk_crypto_init_key(struct blk_crypto_key *blk_key,
+			const u8 *raw_key, size_t raw_key_size,
+			enum blk_crypto_key_type key_type,
 			enum blk_crypto_mode_num crypto_mode,
 			unsigned int dun_bytes,
 			unsigned int data_unit_size)
@@ -338,8 +351,19 @@
 		return -EINVAL;
 
 	mode = &blk_crypto_modes[crypto_mode];
-	if (mode->keysize == 0)
+	switch (key_type) {
+	case BLK_CRYPTO_KEY_TYPE_STANDARD:
+		if (raw_key_size != mode->keysize)
+			return -EINVAL;
+		break;
+	case BLK_CRYPTO_KEY_TYPE_HW_WRAPPED:
+		if (raw_key_size < mode->security_strength ||
+		    raw_key_size > BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE)
+			return -EINVAL;
+		break;
+	default:
 		return -EINVAL;
+	}
 
 	if (dun_bytes == 0 || dun_bytes > mode->ivsize)
 		return -EINVAL;
@@ -350,9 +374,10 @@
 	blk_key->crypto_cfg.crypto_mode = crypto_mode;
 	blk_key->crypto_cfg.dun_bytes = dun_bytes;
 	blk_key->crypto_cfg.data_unit_size = data_unit_size;
+	blk_key->crypto_cfg.key_type = key_type;
 	blk_key->data_unit_size_bits = ilog2(data_unit_size);
-	blk_key->size = mode->keysize;
-	memcpy(blk_key->raw, raw_key, mode->keysize);
+	blk_key->size = raw_key_size;
+	memcpy(blk_key->raw, raw_key, raw_key_size);
 
 	return 0;
 }
@@ -372,8 +397,10 @@
 bool blk_crypto_config_supported(struct block_device *bdev,
 				 const struct blk_crypto_config *cfg)
 {
-	return IS_ENABLED(CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK) ||
-	       blk_crypto_config_supported_natively(bdev, cfg);
+	if (IS_ENABLED(CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK) &&
+	    cfg->key_type == BLK_CRYPTO_KEY_TYPE_STANDARD)
+		return true;
+	return blk_crypto_config_supported_natively(bdev, cfg);
 }
 
 /**
@@ -396,6 +423,10 @@
 {
 	if (blk_crypto_config_supported_natively(bdev, &key->crypto_cfg))
 		return 0;
+	if (key->crypto_cfg.key_type != BLK_CRYPTO_KEY_TYPE_STANDARD) {
+		pr_warn_once("tried to use wrapped key, but hardware doesn't support it\n");
+		return -EOPNOTSUPP;
+	}
 	return blk_crypto_fallback_start_using_mode(key->crypto_cfg.crypto_mode);
 }
 
@@ -436,3 +467,146 @@
 		pr_warn_ratelimited("%pg: error %d evicting key\n", bdev, err);
 }
 EXPORT_SYMBOL_GPL(blk_crypto_evict_key);
+
+static int blk_crypto_ioctl_import_key(struct blk_crypto_profile *profile,
+				       void __user *argp)
+{
+	struct blk_crypto_import_key_arg arg;
+	u8 raw_key[BLK_CRYPTO_MAX_STANDARD_KEY_SIZE];
+	u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE];
+	int ret;
+
+	if (copy_from_user(&arg, argp, sizeof(arg)))
+		return -EFAULT;
+
+	if (memchr_inv(arg.reserved, 0, sizeof(arg.reserved)))
+		return -EINVAL;
+
+	if (arg.raw_key_size < 16 || arg.raw_key_size > sizeof(raw_key))
+		return -EINVAL;
+
+	if (copy_from_user(raw_key, u64_to_user_ptr(arg.raw_key_ptr),
+			   arg.raw_key_size)) {
+		ret = -EFAULT;
+		goto out;
+	}
+	ret = blk_crypto_import_key(profile, raw_key, arg.raw_key_size, lt_key);
+	if (ret < 0)
+		goto out;
+	if (ret > arg.lt_key_size) {
+		ret = -EOVERFLOW;
+		goto out;
+	}
+	arg.lt_key_size = ret;
+	if (copy_to_user(u64_to_user_ptr(arg.lt_key_ptr), lt_key,
+			 arg.lt_key_size) ||
+	    copy_to_user(argp, &arg, sizeof(arg))) {
+		ret = -EFAULT;
+		goto out;
+	}
+	ret = 0;
+
+out:
+	memzero_explicit(raw_key, sizeof(raw_key));
+	memzero_explicit(lt_key, sizeof(lt_key));
+	return ret;
+}
+
+static int blk_crypto_ioctl_generate_key(struct blk_crypto_profile *profile,
+					 void __user *argp)
+{
+	struct blk_crypto_generate_key_arg arg;
+	u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE];
+	int ret;
+
+	if (copy_from_user(&arg, argp, sizeof(arg)))
+		return -EFAULT;
+
+	if (memchr_inv(arg.reserved, 0, sizeof(arg.reserved)))
+		return -EINVAL;
+
+	ret = blk_crypto_generate_key(profile, lt_key);
+	if (ret < 0)
+		goto out;
+	if (ret > arg.lt_key_size) {
+		ret = -EOVERFLOW;
+		goto out;
+	}
+	arg.lt_key_size = ret;
+	if (copy_to_user(u64_to_user_ptr(arg.lt_key_ptr), lt_key,
+			 arg.lt_key_size) ||
+	    copy_to_user(argp, &arg, sizeof(arg))) {
+		ret = -EFAULT;
+		goto out;
+	}
+	ret = 0;
+
+out:
+	memzero_explicit(lt_key, sizeof(lt_key));
+	return ret;
+}
+
+static int blk_crypto_ioctl_prepare_key(struct blk_crypto_profile *profile,
+					void __user *argp)
+{
+	struct blk_crypto_prepare_key_arg arg;
+	u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE];
+	u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE];
+	int ret;
+
+	if (copy_from_user(&arg, argp, sizeof(arg)))
+		return -EFAULT;
+
+	if (memchr_inv(arg.reserved, 0, sizeof(arg.reserved)))
+		return -EINVAL;
+
+	if (arg.lt_key_size > sizeof(lt_key))
+		return -EINVAL;
+
+	if (copy_from_user(lt_key, u64_to_user_ptr(arg.lt_key_ptr),
+			   arg.lt_key_size)) {
+		ret = -EFAULT;
+		goto out;
+	}
+	ret = blk_crypto_prepare_key(profile, lt_key, arg.lt_key_size, eph_key);
+	if (ret < 0)
+		goto out;
+	if (ret > arg.eph_key_size) {
+		ret = -EOVERFLOW;
+		goto out;
+	}
+	arg.eph_key_size = ret;
+	if (copy_to_user(u64_to_user_ptr(arg.eph_key_ptr), eph_key,
+			 arg.eph_key_size) ||
+	    copy_to_user(argp, &arg, sizeof(arg))) {
+		ret = -EFAULT;
+		goto out;
+	}
+	ret = 0;
+
+out:
+	memzero_explicit(lt_key, sizeof(lt_key));
+	memzero_explicit(eph_key, sizeof(eph_key));
+	return ret;
+}
+
+int blk_crypto_ioctl(struct block_device *bdev, unsigned int cmd,
+		     void __user *argp)
+{
+	struct blk_crypto_profile *profile =
+		bdev_get_queue(bdev)->crypto_profile;
+
+	if (!profile)
+		return -EOPNOTSUPP;
+
+	switch (cmd) {
+	case BLKCRYPTOIMPORTKEY:
+		return blk_crypto_ioctl_import_key(profile, argp);
+	case BLKCRYPTOGENERATEKEY:
+		return blk_crypto_ioctl_generate_key(profile, argp);
+	case BLKCRYPTOPREPAREKEY:
+		return blk_crypto_ioctl_prepare_key(profile, argp);
+	default:
+		return -ENOTTY;
+	}
+}
--- linux-qcom-6.8.0.orig/block/blk-flush.c
+++ linux-qcom-6.8.0/block/blk-flush.c
@@ -183,7 +183,7 @@
 		/* queue for flush */
 		if (list_empty(pending))
 			fq->flush_pending_since = jiffies;
-		list_move_tail(&rq->queuelist, pending);
+		list_add_tail(&rq->queuelist, pending);
 		break;
 
 	case REQ_FSEQ_DATA:
@@ -261,6 +261,7 @@
 		unsigned int seq = blk_flush_cur_seq(rq);
 
 		BUG_ON(seq != REQ_FSEQ_PREFLUSH && seq != REQ_FSEQ_POSTFLUSH);
+		list_del_init(&rq->queuelist);
 		blk_flush_complete_seq(rq, fq, seq, error);
 	}
 
--- linux-qcom-6.8.0.orig/block/blk-integrity.c
+++ linux-qcom-6.8.0/block/blk-integrity.c
@@ -396,8 +396,6 @@
 	if (!bi->profile)
 		return;
 
-	/* ensure all bios are off the integrity workqueue */
-	blk_flush_integrity();
 	blk_queue_flag_clear(QUEUE_FLAG_STABLE_WRITES, disk->queue);
 	memset(bi, 0, sizeof(*bi));
 }
--- linux-qcom-6.8.0.orig/block/blk-iocost.c
+++ linux-qcom-6.8.0/block/blk-iocost.c
@@ -1098,7 +1098,14 @@
 		inuse = DIV64_U64_ROUND_UP(active * iocg->child_inuse_sum,
 					   iocg->child_active_sum);
 	} else {
-		inuse = clamp_t(u32, inuse, 1, active);
+		/*
+		 * It may be tempting to turn this into a clamp expression with
+		 * a lower limit of 1 but active may be 0, which cannot be used
+		 * as an upper limit in that situation. This expression allows
+		 * active to clamp inuse unless it is 0, in which case inuse
+		 * becomes 1.
+		 */
+		inuse = min(inuse, active) ?: 1;
 	}
 
 	iocg->last_inuse = iocg->inuse;
@@ -1347,7 +1354,7 @@
 {
 	struct ioc *ioc = iocg->ioc;
 	struct blkcg_gq *blkg = iocg_to_blkg(iocg);
-	u64 tdelta, delay, new_delay;
+	u64 tdelta, delay, new_delay, shift;
 	s64 vover, vover_pct;
 	u32 hwa;
 
@@ -1362,8 +1369,9 @@
 
 	/* calculate the current delay in effect - 1/2 every second */
 	tdelta = now->now - iocg->delay_at;
-	if (iocg->delay)
-		delay = iocg->delay >> div64_u64(tdelta, USEC_PER_SEC);
+	shift = div64_u64(tdelta, USEC_PER_SEC);
+	if (iocg->delay && shift < BITS_PER_LONG)
+		delay = iocg->delay >> shift;
 	else
 		delay = 0;
 
@@ -1438,8 +1446,11 @@
 	lockdep_assert_held(&iocg->ioc->lock);
 	lockdep_assert_held(&iocg->waitq.lock);
 
-	/* make sure that nobody messed with @iocg */
-	WARN_ON_ONCE(list_empty(&iocg->active_list));
+	/*
+	 * make sure that nobody messed with @iocg. Check iocg->pd.online
+	 * to avoid warn when removing blkcg or disk.
+	 */
+	WARN_ON_ONCE(list_empty(&iocg->active_list) && iocg->pd.online);
 	WARN_ON_ONCE(iocg->inuse > 1);
 
 	iocg->abs_vdebt -= min(abs_vpay, iocg->abs_vdebt);
@@ -2072,7 +2083,7 @@
 			      struct ioc_now *now)
 {
 	struct ioc_gq *iocg;
-	u64 dur, usage_pct, nr_cycles;
+	u64 dur, usage_pct, nr_cycles, nr_cycles_shift;
 
 	/* if no debtor, reset the cycle */
 	if (!nr_debtors) {
@@ -2134,10 +2145,12 @@
 		old_debt = iocg->abs_vdebt;
 		old_delay = iocg->delay;
 
+		nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1);
 		if (iocg->abs_vdebt)
-			iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1;
+			iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1;
+
 		if (iocg->delay)
-			iocg->delay = iocg->delay >> nr_cycles ?: 1;
+			iocg->delay = iocg->delay >> nr_cycles_shift ?: 1;
 
 		iocg_kick_waitq(iocg, true, now);
 
--- linux-qcom-6.8.0.orig/block/blk-map.c
+++ linux-qcom-6.8.0/block/blk-map.c
@@ -600,9 +600,7 @@
 		if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len)
 			goto put_bio;
 		if (bytes + bv->bv_len > nr_iter)
-			goto put_bio;
-		if (bv->bv_offset + bv->bv_len > PAGE_SIZE)
-			goto put_bio;
+			break;
 
 		nsegs++;
 		bytes += bv->bv_len;
--- linux-qcom-6.8.0.orig/block/blk-merge.c
+++ linux-qcom-6.8.0/block/blk-merge.c
@@ -252,6 +252,14 @@
 	return len > 0 || bv->bv_len > max_len;
 }
 
+static unsigned int bio_split_alignment(struct bio *bio,
+		const struct queue_limits *lim)
+{
+	if (op_is_write(bio_op(bio)) && lim->zone_write_granularity)
+		return lim->zone_write_granularity;
+	return lim->logical_block_size;
+}
+
 /**
  * bio_split_rw - split a bio in two bios
  * @bio:  [in] bio to be split
@@ -322,7 +330,7 @@
 	 * split size so that each bio is properly block size aligned, even if
 	 * we do not use the full hardware limits.
 	 */
-	bytes = ALIGN_DOWN(bytes, lim->logical_block_size);
+	bytes = ALIGN_DOWN(bytes, bio_split_alignment(bio, lim));
 
 	/*
 	 * Bio splitting may cause subtle trouble such as hang when doing sync
@@ -779,6 +787,8 @@
 	if (blk_do_io_stat(req)) {
 		part_stat_lock();
 		part_stat_inc(req->part, merges[op_stat_group(req_op(req))]);
+		part_stat_local_dec(req->part,
+				    in_flight[op_is_write(req_op(req))]);
 		part_stat_unlock();
 	}
 }
--- linux-qcom-6.8.0.orig/block/blk-mq-tag.c
+++ linux-qcom-6.8.0/block/blk-mq-tag.c
@@ -38,6 +38,7 @@
 void __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx)
 {
 	unsigned int users;
+	unsigned long flags;
 	struct blk_mq_tags *tags = hctx->tags;
 
 	/*
@@ -56,11 +57,11 @@
 			return;
 	}
 
-	spin_lock_irq(&tags->lock);
+	spin_lock_irqsave(&tags->lock, flags);
 	users = tags->active_queues + 1;
 	WRITE_ONCE(tags->active_queues, users);
 	blk_mq_update_wake_batch(tags, users);
-	spin_unlock_irq(&tags->lock);
+	spin_unlock_irqrestore(&tags->lock, flags);
 }
 
 /*
--- linux-qcom-6.8.0.orig/block/blk-mq.c
+++ linux-qcom-6.8.0/block/blk-mq.c
@@ -43,6 +43,7 @@
 
 static DEFINE_PER_CPU(struct llist_head, blk_cpu_done);
 static DEFINE_PER_CPU(call_single_data_t, blk_cpu_csd);
+static DEFINE_MUTEX(blk_mq_cpuhp_lock);
 
 static void blk_mq_insert_request(struct request *rq, blk_insert_t flags);
 static void blk_mq_request_bypass_insert(struct request *rq,
@@ -120,9 +121,59 @@
 	inflight[1] = mi.inflight[1];
 }
 
-void blk_freeze_queue_start(struct request_queue *q)
+#ifdef CONFIG_LOCKDEP
+static bool blk_freeze_set_owner(struct request_queue *q,
+				 struct task_struct *owner)
+{
+	if (!owner)
+		return false;
+
+	if (!q->mq_freeze_depth) {
+		q->mq_freeze_owner = owner;
+		q->mq_freeze_owner_depth = 1;
+		return true;
+	}
+
+	if (owner == q->mq_freeze_owner)
+		q->mq_freeze_owner_depth += 1;
+	return false;
+}
+
+/* verify the last unfreeze in owner context */
+static bool blk_unfreeze_check_owner(struct request_queue *q)
+{
+	if (!q->mq_freeze_owner)
+		return false;
+	if (q->mq_freeze_owner != current)
+		return false;
+	if (--q->mq_freeze_owner_depth == 0) {
+		q->mq_freeze_owner = NULL;
+		return true;
+	}
+	return false;
+}
+
+#else
+
+static bool blk_freeze_set_owner(struct request_queue *q,
+				 struct task_struct *owner)
+{
+	return false;
+}
+
+static bool blk_unfreeze_check_owner(struct request_queue *q)
 {
+	return false;
+}
+#endif
+
+bool __blk_freeze_queue_start(struct request_queue *q,
+			      struct task_struct *owner)
+{
+	bool freeze;
+
 	mutex_lock(&q->mq_freeze_lock);
+	freeze = blk_freeze_set_owner(q, owner);
 	if (++q->mq_freeze_depth == 1) {
 		percpu_ref_kill(&q->q_usage_counter);
 		mutex_unlock(&q->mq_freeze_lock);
@@ -131,6 +182,14 @@
 	} else {
 		mutex_unlock(&q->mq_freeze_lock);
 	}
+
+	return freeze;
+}
+
+void blk_freeze_queue_start(struct request_queue *q)
+{
+	if (__blk_freeze_queue_start(q, current))
+		blk_freeze_acquire_lock(q, false, false);
 }
 EXPORT_SYMBOL_GPL(blk_freeze_queue_start);
 
@@ -176,8 +235,10 @@
 }
 EXPORT_SYMBOL_GPL(blk_mq_freeze_queue);
 
-void __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic)
+bool __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic)
 {
+	bool unfreeze;
+
 	mutex_lock(&q->mq_freeze_lock);
 	if (force_atomic)
 		q->q_usage_counter.data->force_atomic = true;
@@ -187,16 +248,40 @@
 		percpu_ref_resurrect(&q->q_usage_counter);
 		wake_up_all(&q->mq_freeze_wq);
 	}
+	unfreeze = blk_unfreeze_check_owner(q);
 	mutex_unlock(&q->mq_freeze_lock);
+
+	return unfreeze;
 }
 
 void blk_mq_unfreeze_queue(struct request_queue *q)
 {
-	__blk_mq_unfreeze_queue(q, false);
+	if (__blk_mq_unfreeze_queue(q, false))
+		blk_unfreeze_release_lock(q, false, false);
 }
 EXPORT_SYMBOL_GPL(blk_mq_unfreeze_queue);
 
 /*
+ * non_owner variant of blk_freeze_queue_start
+ *
+ * Unlike blk_freeze_queue_start, the queue doesn't need to be unfrozen
+ * by the same task.  This is fragile and should not be used if at all
+ * possible.
+ */
+void blk_freeze_queue_start_non_owner(struct request_queue *q)
+{
+	__blk_freeze_queue_start(q, NULL);
+}
+EXPORT_SYMBOL_GPL(blk_freeze_queue_start_non_owner);
+
+/* non_owner variant of blk_mq_unfreeze_queue */
+void blk_mq_unfreeze_queue_non_owner(struct request_queue *q)
+{
+	__blk_mq_unfreeze_queue(q, false);
+}
+EXPORT_SYMBOL_GPL(blk_mq_unfreeze_queue_non_owner);
+
+/*
  * FIXME: replace the scsi_internal_device_*block_nowait() calls in the
  * mpt3sas driver such that this function can be removed.
  */
@@ -283,8 +368,9 @@
 		if (!blk_queue_skip_tagset_quiesce(q))
 			blk_mq_quiesce_queue_nowait(q);
 	}
-	blk_mq_wait_quiesce_done(set);
 	mutex_unlock(&set->tag_list_lock);
+
+	blk_mq_wait_quiesce_done(set);
 }
 EXPORT_SYMBOL_GPL(blk_mq_quiesce_tagset);
 
@@ -448,6 +534,10 @@
 	if (data->cmd_flags & REQ_NOWAIT)
 		data->flags |= BLK_MQ_REQ_NOWAIT;
 
+retry:
+	data->ctx = blk_mq_get_ctx(q);
+	data->hctx = blk_mq_map_queue(q, data->cmd_flags, data->ctx);
+
 	if (q->elevator) {
 		/*
 		 * All requests use scheduler tags when an I/O scheduler is
@@ -469,13 +559,9 @@
 			if (ops->limit_depth)
 				ops->limit_depth(data->cmd_flags, data);
 		}
-	}
-
-retry:
-	data->ctx = blk_mq_get_ctx(q);
-	data->hctx = blk_mq_map_queue(q, data->cmd_flags, data->ctx);
-	if (!(data->rq_flags & RQF_SCHED_TAGS))
+	} else {
 		blk_mq_tag_busy(data->hctx);
+	}
 
 	if (data->flags & BLK_MQ_REQ_RESERVED)
 		data->rq_flags |= RQF_RESV;
@@ -771,16 +857,11 @@
 		/*
 		 * Partial zone append completions cannot be supported as the
 		 * BIO fragments may end up not being written sequentially.
-		 * For such case, force the completed nbytes to be equal to
-		 * the BIO size so that bio_advance() sets the BIO remaining
-		 * size to 0 and we end up calling bio_endio() before returning.
 		 */
-		if (bio->bi_iter.bi_size != nbytes) {
+		if (bio->bi_iter.bi_size != nbytes)
 			bio->bi_status = BLK_STS_IOERR;
-			nbytes = bio->bi_iter.bi_size;
-		} else {
+		else
 			bio->bi_iter.bi_sector = rq->__sector;
-		}
 	}
 
 	bio_advance(bio, nbytes);
@@ -1003,6 +1084,8 @@
 		update_io_ticks(req->part, jiffies, true);
 		part_stat_inc(req->part, ios[sgrp]);
 		part_stat_add(req->part, nsecs[sgrp], now - req->start_time_ns);
+		part_stat_local_dec(req->part,
+				    in_flight[op_is_write(req_op(req))]);
 		part_stat_unlock();
 	}
 }
@@ -1025,6 +1108,8 @@
 
 		part_stat_lock();
 		update_io_ticks(req->part, jiffies, false);
+		part_stat_local_inc(req->part,
+				    in_flight[op_is_write(req_op(req))]);
 		part_stat_unlock();
 	}
 }
@@ -2242,6 +2327,24 @@
 }
 EXPORT_SYMBOL(blk_mq_delay_run_hw_queue);
 
+static inline bool blk_mq_hw_queue_need_run(struct blk_mq_hw_ctx *hctx)
+{
+	bool need_run;
+
+	/*
+	 * When queue is quiesced, we may be switching io scheduler, or
+	 * updating nr_hw_queues, or other things, and we can't run queue
+	 * any more, even blk_mq_hctx_has_pending() can't be called safely.
+	 *
+	 * And queue will be rerun in blk_mq_unquiesce_queue() if it is
+	 * quiesced.
+	 */
+	__blk_mq_run_dispatch_ops(hctx->queue, false,
+		need_run = !blk_queue_quiesced(hctx->queue) &&
+		blk_mq_hctx_has_pending(hctx));
+	return need_run;
+}
+
 /**
  * blk_mq_run_hw_queue - Start to run a hardware queue.
  * @hctx: Pointer to the hardware queue to run.
@@ -2262,20 +2365,23 @@
 
 	might_sleep_if(!async && hctx->flags & BLK_MQ_F_BLOCKING);
 
-	/*
-	 * When queue is quiesced, we may be switching io scheduler, or
-	 * updating nr_hw_queues, or other things, and we can't run queue
-	 * any more, even __blk_mq_hctx_has_pending() can't be called safely.
-	 *
-	 * And queue will be rerun in blk_mq_unquiesce_queue() if it is
-	 * quiesced.
-	 */
-	__blk_mq_run_dispatch_ops(hctx->queue, false,
-		need_run = !blk_queue_quiesced(hctx->queue) &&
-		blk_mq_hctx_has_pending(hctx));
+	need_run = blk_mq_hw_queue_need_run(hctx);
+	if (!need_run) {
+		unsigned long flags;
 
-	if (!need_run)
-		return;
+		/*
+		 * Synchronize with blk_mq_unquiesce_queue(), because we check
+		 * if hw queue is quiesced locklessly above, we need the use
+		 * ->queue_lock to make sure we see the up-to-date status to
+		 * not miss rerunning the hw queue.
+		 */
+		spin_lock_irqsave(&hctx->queue->queue_lock, flags);
+		need_run = blk_mq_hw_queue_need_run(hctx);
+		spin_unlock_irqrestore(&hctx->queue->queue_lock, flags);
+
+		if (!need_run)
+			return;
+	}
 
 	if (async || !cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask)) {
 		blk_mq_delay_run_hw_queue(hctx, 0);
@@ -2432,6 +2538,12 @@
 		return;
 
 	clear_bit(BLK_MQ_S_STOPPED, &hctx->state);
+	/*
+	 * Pairs with the smp_mb() in blk_mq_hctx_stopped() to order the
+	 * clearing of BLK_MQ_S_STOPPED above and the checking of dispatch
+	 * list in the subsequent routine.
+	 */
+	smp_mb__after_atomic();
 	blk_mq_run_hw_queue(hctx, async);
 }
 EXPORT_SYMBOL_GPL(blk_mq_start_stopped_hw_queue);
@@ -2658,6 +2770,7 @@
 
 	if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) {
 		blk_mq_insert_request(rq, 0);
+		blk_mq_run_hw_queue(hctx, false);
 		return;
 	}
 
@@ -2688,6 +2801,7 @@
 
 	if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(rq->q)) {
 		blk_mq_insert_request(rq, 0);
+		blk_mq_run_hw_queue(hctx, false);
 		return BLK_STS_OK;
 	}
 
@@ -3581,13 +3695,91 @@
 	return 0;
 }
 
-static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx)
+static void __blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx)
 {
-	if (!(hctx->flags & BLK_MQ_F_STACKING))
+	lockdep_assert_held(&blk_mq_cpuhp_lock);
+
+	if (!(hctx->flags & BLK_MQ_F_STACKING) &&
+	    !hlist_unhashed(&hctx->cpuhp_online)) {
 		cpuhp_state_remove_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE,
 						    &hctx->cpuhp_online);
-	cpuhp_state_remove_instance_nocalls(CPUHP_BLK_MQ_DEAD,
-					    &hctx->cpuhp_dead);
+		INIT_HLIST_NODE(&hctx->cpuhp_online);
+	}
+
+	if (!hlist_unhashed(&hctx->cpuhp_dead)) {
+		cpuhp_state_remove_instance_nocalls(CPUHP_BLK_MQ_DEAD,
+						    &hctx->cpuhp_dead);
+		INIT_HLIST_NODE(&hctx->cpuhp_dead);
+	}
+}
+
+static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx)
+{
+	mutex_lock(&blk_mq_cpuhp_lock);
+	__blk_mq_remove_cpuhp(hctx);
+	mutex_unlock(&blk_mq_cpuhp_lock);
+}
+
+static void __blk_mq_add_cpuhp(struct blk_mq_hw_ctx *hctx)
+{
+	lockdep_assert_held(&blk_mq_cpuhp_lock);
+
+	if (!(hctx->flags & BLK_MQ_F_STACKING) &&
+	    hlist_unhashed(&hctx->cpuhp_online))
+		cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE,
+				&hctx->cpuhp_online);
+
+	if (hlist_unhashed(&hctx->cpuhp_dead))
+		cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD,
+				&hctx->cpuhp_dead);
+}
+
+static void __blk_mq_remove_cpuhp_list(struct list_head *head)
+{
+	struct blk_mq_hw_ctx *hctx;
+
+	lockdep_assert_held(&blk_mq_cpuhp_lock);
+
+	list_for_each_entry(hctx, head, hctx_list)
+		__blk_mq_remove_cpuhp(hctx);
+}
+
+/*
+ * Unregister cpuhp callbacks from exited hw queues
+ *
+ * Safe to call if this `request_queue` is live
+ */
+static void blk_mq_remove_hw_queues_cpuhp(struct request_queue *q)
+{
+	LIST_HEAD(hctx_list);
+
+	spin_lock(&q->unused_hctx_lock);
+	list_splice_init(&q->unused_hctx_list, &hctx_list);
+	spin_unlock(&q->unused_hctx_lock);
+
+	mutex_lock(&blk_mq_cpuhp_lock);
+	__blk_mq_remove_cpuhp_list(&hctx_list);
+	mutex_unlock(&blk_mq_cpuhp_lock);
+
+	spin_lock(&q->unused_hctx_lock);
+	list_splice(&hctx_list, &q->unused_hctx_list);
+	spin_unlock(&q->unused_hctx_lock);
+}
+
+/*
+ * Register cpuhp callbacks from all hw queues
+ *
+ * Safe to call if this `request_queue` is live
+ */
+static void blk_mq_add_hw_queues_cpuhp(struct request_queue *q)
+{
+	struct blk_mq_hw_ctx *hctx;
+	unsigned long i;
+
+	mutex_lock(&blk_mq_cpuhp_lock);
+	queue_for_each_hw_ctx(q, hctx, i)
+		__blk_mq_add_cpuhp(hctx);
+	mutex_unlock(&blk_mq_cpuhp_lock);
 }
 
 /*
@@ -3638,8 +3830,6 @@
 	if (set->ops->exit_hctx)
 		set->ops->exit_hctx(hctx, hctx_idx);
 
-	blk_mq_remove_cpuhp(hctx);
-
 	xa_erase(&q->hctx_table, hctx_idx);
 
 	spin_lock(&q->unused_hctx_lock);
@@ -3656,6 +3846,7 @@
 	queue_for_each_hw_ctx(q, hctx, i) {
 		if (i == nr_queue)
 			break;
+		blk_mq_remove_cpuhp(hctx);
 		blk_mq_exit_hctx(q, set, hctx, i);
 	}
 }
@@ -3666,16 +3857,11 @@
 {
 	hctx->queue_num = hctx_idx;
 
-	if (!(hctx->flags & BLK_MQ_F_STACKING))
-		cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE,
-				&hctx->cpuhp_online);
-	cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead);
-
 	hctx->tags = set->tags[hctx_idx];
 
 	if (set->ops->init_hctx &&
 	    set->ops->init_hctx(hctx, set->driver_data, hctx_idx))
-		goto unregister_cpu_notifier;
+		goto fail;
 
 	if (blk_mq_init_request(set, hctx->fq->flush_rq, hctx_idx,
 				hctx->numa_node))
@@ -3692,8 +3878,7 @@
  exit_hctx:
 	if (set->ops->exit_hctx)
 		set->ops->exit_hctx(hctx, hctx_idx);
- unregister_cpu_notifier:
-	blk_mq_remove_cpuhp(hctx);
+ fail:
 	return -1;
 }
 
@@ -3719,6 +3904,8 @@
 	INIT_DELAYED_WORK(&hctx->run_work, blk_mq_run_work_fn);
 	spin_lock_init(&hctx->lock);
 	INIT_LIST_HEAD(&hctx->dispatch);
+	INIT_HLIST_NODE(&hctx->cpuhp_dead);
+	INIT_HLIST_NODE(&hctx->cpuhp_online);
 	hctx->queue = q;
 	hctx->flags = set->flags & ~BLK_MQ_F_TAG_QUEUE_SHARED;
 
@@ -4162,6 +4349,15 @@
 }
 EXPORT_SYMBOL(blk_mq_alloc_disk_for_queue);
 
+/*
+ * Only hctx removed from cpuhp list can be reused
+ */
+static bool blk_mq_hctx_is_reusable(struct blk_mq_hw_ctx *hctx)
+{
+	return hlist_unhashed(&hctx->cpuhp_online) &&
+		hlist_unhashed(&hctx->cpuhp_dead);
+}
+
 static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx(
 		struct blk_mq_tag_set *set, struct request_queue *q,
 		int hctx_idx, int node)
@@ -4171,7 +4367,7 @@
 	/* reuse dead hctx first */
 	spin_lock(&q->unused_hctx_lock);
 	list_for_each_entry(tmp, &q->unused_hctx_list, hctx_list) {
-		if (tmp->numa_node == node) {
+		if (tmp->numa_node == node && blk_mq_hctx_is_reusable(tmp)) {
 			hctx = tmp;
 			break;
 		}
@@ -4237,6 +4433,12 @@
 	xa_for_each_start(&q->hctx_table, j, hctx, j)
 		blk_mq_exit_hctx(q, set, hctx, j);
 	mutex_unlock(&q->sysfs_lock);
+
+	/* unregister cpuhp callbacks for exited hctxs */
+	blk_mq_remove_hw_queues_cpuhp(q);
+
+	/* register cpuhp for new initialized hctxs */
+	blk_mq_add_hw_queues_cpuhp(q);
 }
 
 static void blk_mq_update_poll_flag(struct request_queue *q)
@@ -4256,6 +4458,12 @@
 	/* mark the queue as mq asap */
 	q->mq_ops = set->ops;
 
+	/*
+	 * ->tag_set has to be setup before initialize hctx, which cpuphp
+	 * handler needs it for checking queue mapping
+	 */
+	q->tag_set = set;
+
 	if (blk_mq_alloc_ctxs(q))
 		goto err_exit;
 
@@ -4274,8 +4482,6 @@
 	INIT_WORK(&q->timeout_work, blk_mq_timeout_work);
 	blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
 
-	q->tag_set = set;
-
 	q->queue_flags |= QUEUE_FLAG_MQ_DEFAULT;
 	blk_mq_update_poll_flag(q);
 
--- linux-qcom-6.8.0.orig/block/blk-mq.h
+++ linux-qcom-6.8.0/block/blk-mq.h
@@ -228,6 +228,19 @@
 
 static inline bool blk_mq_hctx_stopped(struct blk_mq_hw_ctx *hctx)
 {
+	/* Fast path: hardware queue is not stopped most of the time. */
+	if (likely(!test_bit(BLK_MQ_S_STOPPED, &hctx->state)))
+		return false;
+
+	/*
+	 * This barrier is used to order adding of dispatch list before and
+	 * the test of BLK_MQ_S_STOPPED below. Pairs with the memory barrier
+	 * in blk_mq_start_stopped_hw_queue() so that dispatch code could
+	 * either see BLK_MQ_S_STOPPED is cleared or dispatch list is not
+	 * empty to avoid missing dispatching requests.
+	 */
+	smp_mb();
+
 	return test_bit(BLK_MQ_S_STOPPED, &hctx->state);
 }
 
--- linux-qcom-6.8.0.orig/block/blk-rq-qos.c
+++ linux-qcom-6.8.0/block/blk-rq-qos.c
@@ -219,8 +219,8 @@
 
 	data->got_token = true;
 	smp_wmb();
-	list_del_init(&curr->entry);
 	wake_up_process(data->task);
+	list_del_init_careful(&curr->entry);
 	return 1;
 }
 
--- linux-qcom-6.8.0.orig/block/blk-settings.c
+++ linux-qcom-6.8.0/block/blk-settings.c
@@ -559,6 +559,8 @@
 	unsigned int top, bottom, alignment, ret = 0;
 
 	t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors);
+	t->max_user_sectors = min_not_zero(t->max_user_sectors,
+			b->max_user_sectors);
 	t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors);
 	t->max_dev_sectors = min_not_zero(t->max_dev_sectors, b->max_dev_sectors);
 	t->max_write_zeroes_sectors = min(t->max_write_zeroes_sectors,
@@ -689,6 +691,10 @@
 	t->zone_write_granularity = max(t->zone_write_granularity,
 					b->zone_write_granularity);
 	t->zoned = max(t->zoned, b->zoned);
+	if (!t->zoned) {
+		t->zone_write_granularity = 0;
+		t->max_zone_append_sectors = 0;
+	}
 	return ret;
 }
 EXPORT_SYMBOL(blk_stack_limits);
--- linux-qcom-6.8.0.orig/block/blk-stat.c
+++ linux-qcom-6.8.0/block/blk-stat.c
@@ -27,7 +27,7 @@
 /* src is a per-cpu stat, mean isn't initialized */
 void blk_rq_stat_sum(struct blk_rq_stat *dst, struct blk_rq_stat *src)
 {
-	if (!src->nr_samples)
+	if (dst->nr_samples + src->nr_samples <= dst->nr_samples)
 		return;
 
 	dst->min = min(dst->min, src->min);
--- linux-qcom-6.8.0.orig/block/blk-sysfs.c
+++ linux-qcom-6.8.0/block/blk-sysfs.c
@@ -839,10 +839,8 @@
 	 * faster to shut down and is made fully functional here as
 	 * request_queues for non-existent devices never get registered.
 	 */
-	if (!blk_queue_init_done(q)) {
-		blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q);
-		percpu_ref_switch_to_percpu(&q->q_usage_counter);
-	}
+	blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q);
+	percpu_ref_switch_to_percpu(&q->q_usage_counter);
 
 	return ret;
 
--- linux-qcom-6.8.0.orig/block/blk.h
+++ linux-qcom-6.8.0/block/blk.h
@@ -3,6 +3,7 @@
 #define BLK_INTERNAL_H
 
 #include <linux/blk-crypto.h>
+#include <linux/lockdep.h>
 #include <linux/memblock.h>	/* for max_pfn/max_low_pfn */
 #include <xen/xen.h>
 #include "blk-crypto-internal.h"
@@ -32,8 +33,10 @@
 void blk_free_flush_queue(struct blk_flush_queue *q);
 
 void blk_freeze_queue(struct request_queue *q);
-void __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic);
-void blk_queue_start_drain(struct request_queue *q);
+bool __blk_mq_unfreeze_queue(struct request_queue *q, bool force_atomic);
+bool blk_queue_start_drain(struct request_queue *q);
+bool __blk_freeze_queue_start(struct request_queue *q,
+			      struct task_struct *owner);
 int __bio_queue_enter(struct request_queue *q, struct bio *bio);
 void submit_bio_noacct_nocheck(struct bio *bio);
 
@@ -65,8 +68,11 @@
 {
 	struct request_queue *q = bdev_get_queue(bio->bi_bdev);
 
-	if (blk_try_enter_queue(q, false))
+	if (blk_try_enter_queue(q, false)) {
+		rwsem_acquire_read(&q->io_lockdep_map, 0, 0, _RET_IP_);
+		rwsem_release(&q->io_lockdep_map, _RET_IP_);
 		return 0;
+	}
 	return __bio_queue_enter(q, bio);
 }
 
@@ -344,6 +350,7 @@
 }
 
 void update_io_ticks(struct block_device *part, unsigned long now, bool end);
+unsigned int part_in_flight(struct block_device *part);
 
 static inline void req_set_nomerge(struct request_queue *q, struct request *req)
 {
@@ -516,4 +523,22 @@
 	return atomic_read(&req->ref);
 }
 
+static inline void blk_freeze_acquire_lock(struct request_queue *q, bool
+		disk_dead, bool queue_dying)
+{
+	if (!disk_dead)
+		rwsem_acquire(&q->io_lockdep_map, 0, 1, _RET_IP_);
+	if (!queue_dying)
+		rwsem_acquire(&q->q_lockdep_map, 0, 1, _RET_IP_);
+}
+
+static inline void blk_unfreeze_release_lock(struct request_queue *q, bool
+		disk_dead, bool queue_dying)
+{
+	if (!queue_dying)
+		rwsem_release(&q->q_lockdep_map, _RET_IP_);
+	if (!disk_dead)
+		rwsem_release(&q->io_lockdep_map, _RET_IP_);
+}
+
 #endif /* BLK_INTERNAL_H */
--- linux-qcom-6.8.0.orig/block/elevator.c
+++ linux-qcom-6.8.0/block/elevator.c
@@ -558,7 +558,7 @@
 static inline bool elv_support_iosched(struct request_queue *q)
 {
 	if (!queue_is_mq(q) ||
-	    (q->tag_set && (q->tag_set->flags & BLK_MQ_F_NO_SCHED)))
+	    (q->tag_set->flags & BLK_MQ_F_NO_SCHED))
 		return false;
 	return true;
 }
@@ -569,7 +569,7 @@
  */
 static struct elevator_type *elevator_get_default(struct request_queue *q)
 {
-	if (q->tag_set && q->tag_set->flags & BLK_MQ_F_NO_SCHED_BY_DEFAULT)
+	if (q->tag_set->flags & BLK_MQ_F_NO_SCHED_BY_DEFAULT)
 		return NULL;
 
 	if (q->nr_hw_queues != 1 &&
@@ -635,13 +635,19 @@
 	 * drain any dispatch activities originated from passthrough
 	 * requests, then no need to quiesce queue which may add long boot
 	 * latency, especially when lots of disks are involved.
+	 *
+	 * Disk isn't added yet, so verifying queue lock only manually.
 	 */
-	blk_mq_freeze_queue(q);
+	blk_freeze_queue_start_non_owner(q);
+	blk_freeze_acquire_lock(q, true, false);
+	blk_mq_freeze_queue_wait(q);
+
 	blk_mq_cancel_work_sync(q);
 
 	err = blk_mq_init_sched(q, e);
 
-	blk_mq_unfreeze_queue(q);
+	blk_unfreeze_release_lock(q, true, false);
+	blk_mq_unfreeze_queue_non_owner(q);
 
 	if (err) {
 		pr_warn("\"%s\" elevator initialization failed, "
--- linux-qcom-6.8.0.orig/block/fops.c
+++ linux-qcom-6.8.0/block/fops.c
@@ -387,7 +387,7 @@
 
 	iomap->bdev = bdev;
 	iomap->offset = ALIGN_DOWN(offset, bdev_logical_block_size(bdev));
-	if (iomap->offset >= isize)
+	if (offset >= isize)
 		return -EIO;
 	iomap->type = IOMAP_MAPPED;
 	iomap->addr = iomap->offset;
--- linux-qcom-6.8.0.orig/block/genhd.c
+++ linux-qcom-6.8.0/block/genhd.c
@@ -118,7 +118,7 @@
 	}
 }
 
-static unsigned int part_in_flight(struct block_device *part)
+unsigned int part_in_flight(struct block_device *part)
 {
 	unsigned int inflight = 0;
 	int cpu;
@@ -345,9 +345,7 @@
 	struct bdev_handle *handle;
 	int ret = 0;
 
-	if (disk->flags & (GENHD_FL_NO_PART | GENHD_FL_HIDDEN))
-		return -EINVAL;
-	if (test_bit(GD_SUPPRESS_PART_SCAN, &disk->state))
+	if (!disk_has_partscan(disk))
 		return -EINVAL;
 	if (disk->open_partitions)
 		return -EBUSY;
@@ -503,8 +501,7 @@
 			goto out_unregister_bdi;
 
 		/* Make sure the first partition scan will be proceed */
-		if (get_capacity(disk) && !(disk->flags & GENHD_FL_NO_PART) &&
-		    !test_bit(GD_SUPPRESS_PART_SCAN, &disk->state))
+		if (get_capacity(disk) && disk_has_partscan(disk))
 			set_bit(GD_NEED_PART_SCAN, &disk->state);
 
 		bdev_add(disk->part0, ddev->devt);
@@ -583,13 +580,13 @@
 	rcu_read_unlock();
 }
 
-static void __blk_mark_disk_dead(struct gendisk *disk)
+static bool __blk_mark_disk_dead(struct gendisk *disk)
 {
 	/*
 	 * Fail any new I/O.
 	 */
 	if (test_and_set_bit(GD_DEAD, &disk->state))
-		return;
+		return false;
 
 	if (test_bit(GD_OWNS_QUEUE, &disk->state))
 		blk_queue_flag_set(QUEUE_FLAG_DYING, disk->queue);
@@ -602,7 +599,7 @@
 	/*
 	 * Prevent new I/O from crossing bio_queue_enter().
 	 */
-	blk_queue_start_drain(disk->queue);
+	return blk_queue_start_drain(disk->queue);
 }
 
 /**
@@ -643,6 +640,7 @@
 	struct request_queue *q = disk->queue;
 	struct block_device *part;
 	unsigned long idx;
+	bool start_drain, queue_dying;
 
 	might_sleep();
 
@@ -665,12 +663,15 @@
 	 */
 	if (!test_bit(GD_DEAD, &disk->state))
 		blk_report_disk_dead(disk, false);
-	__blk_mark_disk_dead(disk);
 
 	/*
 	 * Drop all partitions now that the disk is marked dead.
 	 */
 	mutex_lock(&disk->open_mutex);
+	start_drain = __blk_mark_disk_dead(disk);
+	queue_dying = blk_queue_dying(q);
+	if (start_drain)
+		blk_freeze_acquire_lock(q, true, queue_dying);
 	xa_for_each_start(&disk->part_tbl, idx, part, 1)
 		drop_partition(part);
 	mutex_unlock(&disk->open_mutex);
@@ -720,13 +721,13 @@
 	 * If the disk does not own the queue, allow using passthrough requests
 	 * again.  Else leave the queue frozen to fail all I/O.
 	 */
-	if (!test_bit(GD_OWNS_QUEUE, &disk->state)) {
-		blk_queue_flag_clear(QUEUE_FLAG_INIT_DONE, q);
+	if (!test_bit(GD_OWNS_QUEUE, &disk->state))
 		__blk_mq_unfreeze_queue(q, true);
-	} else {
-		if (queue_is_mq(q))
-			blk_mq_exit_queue(q);
-	}
+	else if (queue_is_mq(q))
+		blk_mq_exit_queue(q);
+
+	if (start_drain)
+		blk_unfreeze_release_lock(q, true, queue_dying);
 }
 EXPORT_SYMBOL(del_gendisk);
 
@@ -1047,6 +1048,12 @@
 	return sprintf(buf, "%llu\n", disk->diskseq);
 }
 
+static ssize_t partscan_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	return sprintf(buf, "%u\n", disk_has_partscan(dev_to_disk(dev)));
+}
+
 static DEVICE_ATTR(range, 0444, disk_range_show, NULL);
 static DEVICE_ATTR(ext_range, 0444, disk_ext_range_show, NULL);
 static DEVICE_ATTR(removable, 0444, disk_removable_show, NULL);
@@ -1060,6 +1067,7 @@
 static DEVICE_ATTR(inflight, 0444, part_inflight_show, NULL);
 static DEVICE_ATTR(badblocks, 0644, disk_badblocks_show, disk_badblocks_store);
 static DEVICE_ATTR(diskseq, 0444, diskseq_show, NULL);
+static DEVICE_ATTR(partscan, 0444, partscan_show, NULL);
 
 #ifdef CONFIG_FAIL_MAKE_REQUEST
 ssize_t part_fail_show(struct device *dev,
@@ -1106,6 +1114,7 @@
 	&dev_attr_events_async.attr,
 	&dev_attr_events_poll_msecs.attr,
 	&dev_attr_diskseq.attr,
+	&dev_attr_partscan.attr,
 #ifdef CONFIG_FAIL_MAKE_REQUEST
 	&dev_attr_fail.attr,
 #endif
--- linux-qcom-6.8.0.orig/block/holder.c
+++ linux-qcom-6.8.0/block/holder.c
@@ -8,6 +8,8 @@
 	int			refcnt;
 };
 
+static DEFINE_MUTEX(blk_holder_mutex);
+
 static struct bd_holder_disk *bd_find_holder_disk(struct block_device *bdev,
 						  struct gendisk *disk)
 {
@@ -80,7 +82,7 @@
 	kobject_get(bdev->bd_holder_dir);
 	mutex_unlock(&bdev->bd_disk->open_mutex);
 
-	mutex_lock(&disk->open_mutex);
+	mutex_lock(&blk_holder_mutex);
 	WARN_ON_ONCE(!bdev->bd_holder);
 
 	holder = bd_find_holder_disk(bdev, disk);
@@ -108,7 +110,7 @@
 		goto out_del_symlink;
 	list_add(&holder->list, &disk->slave_bdevs);
 
-	mutex_unlock(&disk->open_mutex);
+	mutex_unlock(&blk_holder_mutex);
 	return 0;
 
 out_del_symlink:
@@ -116,7 +118,7 @@
 out_free_holder:
 	kfree(holder);
 out_unlock:
-	mutex_unlock(&disk->open_mutex);
+	mutex_unlock(&blk_holder_mutex);
 	if (ret)
 		kobject_put(bdev->bd_holder_dir);
 	return ret;
@@ -140,7 +142,7 @@
 	if (WARN_ON_ONCE(!disk->slave_dir))
 		return;
 
-	mutex_lock(&disk->open_mutex);
+	mutex_lock(&blk_holder_mutex);
 	holder = bd_find_holder_disk(bdev, disk);
 	if (!WARN_ON_ONCE(holder == NULL) && !--holder->refcnt) {
 		del_symlink(disk->slave_dir, bdev_kobj(bdev));
@@ -149,6 +151,6 @@
 		list_del_init(&holder->list);
 		kfree(holder);
 	}
-	mutex_unlock(&disk->open_mutex);
+	mutex_unlock(&blk_holder_mutex);
 }
 EXPORT_SYMBOL_GPL(bd_unlink_disk_holder);
--- linux-qcom-6.8.0.orig/block/ioctl.c
+++ linux-qcom-6.8.0/block/ioctl.c
@@ -12,6 +12,7 @@
 #include <linux/pr.h>
 #include <linux/uaccess.h>
 #include "blk.h"
+#include "blk-crypto-internal.h"
 
 static int blkpg_do_ioctl(struct block_device *bdev,
 			  struct blkpg_partition __user *upart, int op)
@@ -33,7 +34,7 @@
 	if (op == BLKPG_DEL_PARTITION)
 		return bdev_del_partition(disk, p.pno);
 
-	if (p.start < 0 || p.length <= 0 || p.start + p.length < 0)
+	if (p.start < 0 || p.length <= 0 || LLONG_MAX - p.length < p.start)
 		return -EINVAL;
 	/* Check that the partition is aligned to the block size */
 	if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev)))
@@ -89,7 +90,7 @@
 		unsigned long arg)
 {
 	uint64_t range[2];
-	uint64_t start, len;
+	uint64_t start, len, end;
 	struct inode *inode = bdev->bd_inode;
 	int err;
 
@@ -110,11 +111,12 @@
 	if (len & 511)
 		return -EINVAL;
 
-	if (start + len > bdev_nr_bytes(bdev))
+	if (check_add_overflow(start, len, &end) ||
+	    end > bdev_nr_bytes(bdev))
 		return -EINVAL;
 
 	filemap_invalidate_lock(inode->i_mapping);
-	err = truncate_bdev_range(bdev, mode, start, start + len - 1);
+	err = truncate_bdev_range(bdev, mode, start, end - 1);
 	if (err)
 		goto fail;
 	err = blkdev_issue_discard(bdev, start >> 9, len >> 9, GFP_KERNEL);
@@ -126,7 +128,7 @@
 static int blk_ioctl_secure_erase(struct block_device *bdev, blk_mode_t mode,
 		void __user *argp)
 {
-	uint64_t start, len;
+	uint64_t start, len, end;
 	uint64_t range[2];
 	int err;
 
@@ -141,11 +143,12 @@
 	len = range[1];
 	if ((start & 511) || (len & 511))
 		return -EINVAL;
-	if (start + len > bdev_nr_bytes(bdev))
+	if (check_add_overflow(start, len, &end) ||
+	    end > bdev_nr_bytes(bdev))
 		return -EINVAL;
 
 	filemap_invalidate_lock(bdev->bd_inode->i_mapping);
-	err = truncate_bdev_range(bdev, mode, start, start + len - 1);
+	err = truncate_bdev_range(bdev, mode, start, end - 1);
 	if (!err)
 		err = blkdev_issue_secure_erase(bdev, start >> 9, len >> 9,
 						GFP_KERNEL);
@@ -556,11 +559,16 @@
 			return -EACCES;
 		if (bdev_is_partition(bdev))
 			return -EINVAL;
-		return disk_scan_partitions(bdev->bd_disk, mode);
+		return disk_scan_partitions(bdev->bd_disk,
+				mode | BLK_OPEN_STRICT_SCAN);
 	case BLKTRACESTART:
 	case BLKTRACESTOP:
 	case BLKTRACETEARDOWN:
 		return blk_trace_ioctl(bdev, cmd, argp);
+	case BLKCRYPTOIMPORTKEY:
+	case BLKCRYPTOGENERATEKEY:
+	case BLKCRYPTOPREPAREKEY:
+		return blk_crypto_ioctl(bdev, cmd, argp);
 	case IOC_PR_REGISTER:
 		return blkdev_pr_register(bdev, mode, argp);
 	case IOC_PR_RESERVE:
--- linux-qcom-6.8.0.orig/block/mq-deadline.c
+++ linux-qcom-6.8.0/block/mq-deadline.c
@@ -622,6 +622,20 @@
 }
 
 /*
+ * 'depth' is a number in the range 1..INT_MAX representing a number of
+ * requests. Scale it with a factor (1 << bt->sb.shift) / q->nr_requests since
+ * 1..(1 << bt->sb.shift) is the range expected by sbitmap_get_shallow().
+ * Values larger than q->nr_requests have the same effect as q->nr_requests.
+ */
+static int dd_to_word_depth(struct blk_mq_hw_ctx *hctx, unsigned int qdepth)
+{
+	struct sbitmap_queue *bt = &hctx->sched_tags->bitmap_tags;
+	const unsigned int nrr = hctx->queue->nr_requests;
+
+	return ((qdepth << bt->sb.shift) + nrr - 1) / nrr;
+}
+
+/*
  * Called by __blk_mq_alloc_request(). The shallow_depth value set by this
  * function is used by __blk_mq_get_tag().
  */
@@ -637,7 +651,7 @@
 	 * Throttle asynchronous requests and writes such that these requests
 	 * do not block the allocation of synchronous requests.
 	 */
-	data->shallow_depth = dd->async_depth;
+	data->shallow_depth = dd_to_word_depth(data->hctx, dd->async_depth);
 }
 
 /* Called by blk_mq_update_nr_requests(). */
@@ -646,11 +660,10 @@
 	struct request_queue *q = hctx->queue;
 	struct deadline_data *dd = q->elevator->elevator_data;
 	struct blk_mq_tags *tags = hctx->sched_tags;
-	unsigned int shift = tags->bitmap_tags.sb.shift;
 
-	dd->async_depth = max(1U, 3 * (1U << shift)  / 4);
+	dd->async_depth = q->nr_requests;
 
-	sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, dd->async_depth);
+	sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1);
 }
 
 /* Called by blk_mq_init_hctx() and blk_mq_init_sched(). */
--- linux-qcom-6.8.0.orig/block/partitions/cmdline.c
+++ linux-qcom-6.8.0/block/partitions/cmdline.c
@@ -70,8 +70,8 @@
 	}
 
 	if (*partdef == '(') {
-		int length;
-		char *next = strchr(++partdef, ')');
+		partdef++;
+		char *next = strsep(&partdef, ")");
 
 		if (!next) {
 			pr_warn("cmdline partition format is invalid.");
@@ -79,11 +79,7 @@
 			goto fail;
 		}
 
-		length = min_t(int, next - partdef,
-			       sizeof(new_subpart->name) - 1);
-		strscpy(new_subpart->name, partdef, length);
-
-		partdef = ++next;
+		strscpy(new_subpart->name, next, sizeof(new_subpart->name));
 	} else
 		new_subpart->name[0] = '\0';
 
@@ -117,14 +113,12 @@
 	}
 }
 
-static int parse_parts(struct cmdline_parts **parts, const char *bdevdef)
+static int parse_parts(struct cmdline_parts **parts, char *bdevdef)
 {
 	int ret = -EINVAL;
 	char *next;
-	int length;
 	struct cmdline_subpart **next_subpart;
 	struct cmdline_parts *newparts;
-	char buf[BDEVNAME_SIZE + 32 + 4];
 
 	*parts = NULL;
 
@@ -132,28 +126,19 @@
 	if (!newparts)
 		return -ENOMEM;
 
-	next = strchr(bdevdef, ':');
+	next = strsep(&bdevdef, ":");
 	if (!next) {
 		pr_warn("cmdline partition has no block device.");
 		goto fail;
 	}
 
-	length = min_t(int, next - bdevdef, sizeof(newparts->name) - 1);
-	strscpy(newparts->name, bdevdef, length);
+	strscpy(newparts->name, next, sizeof(newparts->name));
 	newparts->nr_subparts = 0;
 
 	next_subpart = &newparts->subpart;
 
-	while (next && *(++next)) {
-		bdevdef = next;
-		next = strchr(bdevdef, ',');
-
-		length = (!next) ? (sizeof(buf) - 1) :
-			min_t(int, next - bdevdef, sizeof(buf) - 1);
-
-		strscpy(buf, bdevdef, length);
-
-		ret = parse_subpart(next_subpart, buf);
+	while ((next = strsep(&bdevdef, ","))) {
+		ret = parse_subpart(next_subpart, next);
 		if (ret)
 			goto fail;
 
@@ -199,24 +184,17 @@
 
 	*parts = NULL;
 
-	next = pbuf = buf = kstrdup(cmdline, GFP_KERNEL);
+	pbuf = buf = kstrdup(cmdline, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 
 	next_parts = parts;
 
-	while (next && *pbuf) {
-		next = strchr(pbuf, ';');
-		if (next)
-			*next = '\0';
-
-		ret = parse_parts(next_parts, pbuf);
+	while ((next = strsep(&pbuf, ";"))) {
+		ret = parse_parts(next_parts, next);
 		if (ret)
 			goto fail;
 
-		if (next)
-			pbuf = ++next;
-
 		next_parts = &(*next_parts)->next_parts;
 	}
 
@@ -250,7 +228,6 @@
 static int add_part(int slot, struct cmdline_subpart *subpart,
 		struct parsed_partitions *state)
 {
-	int label_min;
 	struct partition_meta_info *info;
 	char tmp[sizeof(info->volname) + 4];
 
@@ -262,9 +239,7 @@
 
 	info = &state->parts[slot].info;
 
-	label_min = min_t(int, sizeof(info->volname) - 1,
-			  sizeof(subpart->name));
-	strscpy(info->volname, subpart->name, label_min);
+	strscpy(info->volname, subpart->name, sizeof(info->volname));
 
 	snprintf(tmp, sizeof(tmp), "(%s)", info->volname);
 	strlcat(state->pp_buf, tmp, PAGE_SIZE);
--- linux-qcom-6.8.0.orig/block/partitions/core.c
+++ linux-qcom-6.8.0/block/partitions/core.c
@@ -566,9 +566,11 @@
 
 	part = add_partition(disk, p, from, size, state->parts[p].flags,
 			     &state->parts[p].info);
-	if (IS_ERR(part) && PTR_ERR(part) != -ENXIO) {
-		printk(KERN_ERR " %s: p%d could not be added: %pe\n",
-		       disk->disk_name, p, part);
+	if (IS_ERR(part)) {
+		if (PTR_ERR(part) != -ENXIO) {
+			printk(KERN_ERR " %s: p%d could not be added: %pe\n",
+			       disk->disk_name, p, part);
+		}
 		return true;
 	}
 
@@ -584,10 +586,7 @@
 	struct parsed_partitions *state;
 	int ret = -EAGAIN, p;
 
-	if (disk->flags & GENHD_FL_NO_PART)
-		return 0;
-
-	if (test_bit(GD_SUPPRESS_PART_SCAN, &disk->state))
+	if (!disk_has_partscan(disk))
 		return 0;
 
 	state = check_partition(disk);
--- linux-qcom-6.8.0.orig/block/sed-opal.c
+++ linux-qcom-6.8.0/block/sed-opal.c
@@ -314,7 +314,7 @@
 			      &key_type_user, key_name, true);
 
 	if (IS_ERR(kref))
-		ret = PTR_ERR(kref);
+		return PTR_ERR(kref);
 
 	key = key_ref_to_ptr(kref);
 	down_read(&key->sem);
--- linux-qcom-6.8.0.orig/certs/blacklist.c
+++ linux-qcom-6.8.0/certs/blacklist.c
@@ -276,6 +276,9 @@
 	if (IS_ERR(key)) {
 		pr_err("Problem with revocation key (%ld)\n", PTR_ERR(key));
 		return PTR_ERR(key);
+	} else {
+		pr_notice("Revoked X.509 cert '%s'\n",
+			  key_ref_to_ptr(key)->description);
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/crypto/Kconfig
+++ linux-qcom-6.8.0/crypto/Kconfig
@@ -1269,10 +1269,11 @@
 
 	  A non-physical non-deterministic ("true") RNG (e.g., an entropy source
 	  compliant with NIST SP800-90B) intended to provide a seed to a
-	  deterministic RNG (e.g.  per NIST SP800-90C).
+	  deterministic RNG (e.g., per NIST SP800-90C).
 	  This RNG does not perform any cryptographic whitening of the generated
+	  random numbers.
 
-	  See https://www.chronox.de/jent.html
+	  See https://www.chronox.de/jent/
 
 if CRYPTO_JITTERENTROPY
 if CRYPTO_FIPS && EXPERT
--- linux-qcom-6.8.0.orig/crypto/aead.c
+++ linux-qcom-6.8.0/crypto/aead.c
@@ -45,8 +45,7 @@
 	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
 	memcpy(alignbuffer, key, keylen);
 	ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen);
-	memset(alignbuffer, 0, keylen);
-	kfree(buffer);
+	kfree_sensitive(buffer);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/crypto/aegis128-neon-inner.c
+++ linux-qcom-6.8.0/crypto/aegis128-neon-inner.c
@@ -148,8 +148,8 @@
 		kiv,
 		vld1q_u8(const1),
 		vld1q_u8(const0),
-		k ^ vld1q_u8(const0),
-		k ^ vld1q_u8(const1),
+		(uint8x16_t) (k ^ vld1q_u8(const0)),
+		(uint8x16_t) (k ^ vld1q_u8(const1)),
 	}};
 	int i;
 
--- linux-qcom-6.8.0.orig/crypto/algapi.c
+++ linux-qcom-6.8.0/crypto/algapi.c
@@ -396,7 +396,7 @@
 	q->cra_flags |= CRYPTO_ALG_DEAD;
 	alg = test->adult;
 
-	if (list_empty(&alg->cra_list))
+	if (crypto_is_dead(alg))
 		goto complete;
 
 	if (err == -ECANCELED)
--- linux-qcom-6.8.0.orig/crypto/asymmetric_keys/Kconfig
+++ linux-qcom-6.8.0/crypto/asymmetric_keys/Kconfig
@@ -15,6 +15,7 @@
 	select MPILIB
 	select CRYPTO_HASH_INFO
 	select CRYPTO_AKCIPHER
+	select CRYPTO_SIG
 	select CRYPTO_HASH
 	help
 	  This option provides support for asymmetric public key type handling.
@@ -85,5 +86,7 @@
 	depends on ASYMMETRIC_KEY_TYPE
 	depends on PKCS7_MESSAGE_PARSER=X509_CERTIFICATE_PARSER
 	depends on X509_CERTIFICATE_PARSER
+	depends on CRYPTO_RSA
+	depends on CRYPTO_SHA256
 
 endif # ASYMMETRIC_KEY_TYPE
--- linux-qcom-6.8.0.orig/crypto/asymmetric_keys/asymmetric_type.c
+++ linux-qcom-6.8.0/crypto/asymmetric_keys/asymmetric_type.c
@@ -60,17 +60,18 @@
 	char *req, *p;
 	int len;
 
-	WARN_ON(!id_0 && !id_1 && !id_2);
-
 	if (id_0) {
 		lookup = id_0->data;
 		len = id_0->len;
 	} else if (id_1) {
 		lookup = id_1->data;
 		len = id_1->len;
-	} else {
+	} else if (id_2) {
 		lookup = id_2->data;
 		len = id_2->len;
+	} else {
+		WARN_ON(1);
+		return ERR_PTR(-EINVAL);
 	}
 
 	/* Construct an identifier "id:<keyid>". */
--- linux-qcom-6.8.0.orig/crypto/asymmetric_keys/mscode_parser.c
+++ linux-qcom-6.8.0/crypto/asymmetric_keys/mscode_parser.c
@@ -75,6 +75,9 @@
 
 	oid = look_up_OID(value, vlen);
 	switch (oid) {
+	case OID_sha1:
+		ctx->digest_algo = "sha1";
+		break;
 	case OID_sha256:
 		ctx->digest_algo = "sha256";
 		break;
--- linux-qcom-6.8.0.orig/crypto/asymmetric_keys/pkcs7_parser.c
+++ linux-qcom-6.8.0/crypto/asymmetric_keys/pkcs7_parser.c
@@ -227,6 +227,9 @@
 	struct pkcs7_parse_context *ctx = context;
 
 	switch (ctx->last_oid) {
+	case OID_sha1:
+		ctx->sinfo->sig->hash_algo = "sha1";
+		break;
 	case OID_sha256:
 		ctx->sinfo->sig->hash_algo = "sha256";
 		break;
@@ -278,6 +281,7 @@
 		ctx->sinfo->sig->pkey_algo = "rsa";
 		ctx->sinfo->sig->encoding = "pkcs1";
 		break;
+	case OID_id_ecdsa_with_sha1:
 	case OID_id_ecdsa_with_sha224:
 	case OID_id_ecdsa_with_sha256:
 	case OID_id_ecdsa_with_sha384:
--- linux-qcom-6.8.0.orig/crypto/asymmetric_keys/public_key.c
+++ linux-qcom-6.8.0/crypto/asymmetric_keys/public_key.c
@@ -115,7 +115,8 @@
 		 */
 		if (!hash_algo)
 			return -EINVAL;
-		if (strcmp(hash_algo, "sha224") != 0 &&
+		if (strcmp(hash_algo, "sha1") != 0 &&
+		    strcmp(hash_algo, "sha224") != 0 &&
 		    strcmp(hash_algo, "sha256") != 0 &&
 		    strcmp(hash_algo, "sha384") != 0 &&
 		    strcmp(hash_algo, "sha512") != 0 &&
--- linux-qcom-6.8.0.orig/crypto/asymmetric_keys/signature.c
+++ linux-qcom-6.8.0/crypto/asymmetric_keys/signature.c
@@ -115,7 +115,7 @@
  * Sign the specified data blob using the private key specified by params->key.
  * The signature is wrapped in an encoding if params->encoding is specified
  * (eg. "pkcs1").  If the encoding needs to know the digest type, this can be
- * passed through params->hash_algo (eg. "sha512").
+ * passed through params->hash_algo (eg. "sha1").
  *
  * Returns the length of the data placed in the signature buffer or an error.
  */
--- linux-qcom-6.8.0.orig/crypto/asymmetric_keys/x509_cert_parser.c
+++ linux-qcom-6.8.0/crypto/asymmetric_keys/x509_cert_parser.c
@@ -198,6 +198,10 @@
 	default:
 		return -ENOPKG; /* Unsupported combination */
 
+	case OID_sha1WithRSAEncryption:
+		ctx->cert->sig->hash_algo = "sha1";
+		goto rsa_pkcs1;
+
 	case OID_sha256WithRSAEncryption:
 		ctx->cert->sig->hash_algo = "sha256";
 		goto rsa_pkcs1;
@@ -214,6 +218,10 @@
 		ctx->cert->sig->hash_algo = "sha224";
 		goto rsa_pkcs1;
 
+	case OID_id_ecdsa_with_sha1:
+		ctx->cert->sig->hash_algo = "sha1";
+		goto ecdsa;
+
 	case OID_id_rsassa_pkcs1_v1_5_with_sha3_256:
 		ctx->cert->sig->hash_algo = "sha3-256";
 		goto rsa_pkcs1;
--- linux-qcom-6.8.0.orig/crypto/asymmetric_keys/x509_loader.c
+++ linux-qcom-6.8.0/crypto/asymmetric_keys/x509_loader.c
@@ -41,6 +41,7 @@
 		if (IS_ERR(key)) {
 			pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
 			       PTR_ERR(key));
+			WARN_ON_ONCE(1);
 		} else {
 			pr_notice("Loaded X.509 cert '%s'\n",
 				  key_ref_to_ptr(key)->description);
--- linux-qcom-6.8.0.orig/crypto/cipher.c
+++ linux-qcom-6.8.0/crypto/cipher.c
@@ -34,8 +34,7 @@
 	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
 	memcpy(alignbuffer, key, keylen);
 	ret = cia->cia_setkey(crypto_cipher_tfm(tfm), alignbuffer, keylen);
-	memset(alignbuffer, 0, keylen);
-	kfree(buffer);
+	kfree_sensitive(buffer);
 	return ret;
 
 }
--- linux-qcom-6.8.0.orig/crypto/ecc.c
+++ linux-qcom-6.8.0/crypto/ecc.c
@@ -66,6 +66,28 @@
 }
 EXPORT_SYMBOL(ecc_get_curve);
 
+void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+			   u64 *out, unsigned int ndigits)
+{
+	int diff = ndigits - DIV_ROUND_UP(nbytes, sizeof(u64));
+	unsigned int o = nbytes & 7;
+	__be64 msd = 0;
+
+	/* diff > 0: not enough input bytes: set most significant digits to 0 */
+	if (diff > 0) {
+		ndigits -= diff;
+		memset(&out[ndigits - 1], 0, diff * sizeof(u64));
+	}
+
+	if (o) {
+		memcpy((u8 *)&msd + sizeof(msd) - o, in, o);
+		out[--ndigits] = be64_to_cpu(msd);
+		in += o;
+	}
+	ecc_swap_digits(in, out, ndigits);
+}
+EXPORT_SYMBOL(ecc_digits_from_bytes);
+
 static u64 *ecc_alloc_digits_space(unsigned int ndigits)
 {
 	size_t len = ndigits * sizeof(u64);
--- linux-qcom-6.8.0.orig/crypto/ecdh.c
+++ linux-qcom-6.8.0/crypto/ecdh.c
@@ -33,6 +33,8 @@
 	    params.key_size > sizeof(u64) * ctx->ndigits)
 		return -EINVAL;
 
+	memset(ctx->private_key, 0, sizeof(ctx->private_key));
+
 	if (!params.key || !params.key_size)
 		return ecc_gen_privkey(ctx->curve_id, ctx->ndigits,
 				       ctx->private_key);
--- linux-qcom-6.8.0.orig/crypto/ecdsa.c
+++ linux-qcom-6.8.0/crypto/ecdsa.c
@@ -35,40 +35,27 @@
 static int ecdsa_get_signature_rs(u64 *dest, size_t hdrlen, unsigned char tag,
 				  const void *value, size_t vlen, unsigned int ndigits)
 {
-	size_t keylen = ndigits * sizeof(u64);
-	ssize_t diff = vlen - keylen;
+	size_t bufsize = ndigits * sizeof(u64);
 	const char *d = value;
-	u8 rs[ECC_MAX_BYTES];
 
-	if (!value || !vlen)
+	if (!value || !vlen || vlen > bufsize + 1)
 		return -EINVAL;
 
-	/* diff = 0: 'value' has exacly the right size
-	 * diff > 0: 'value' has too many bytes; one leading zero is allowed that
-	 *           makes the value a positive integer; error on more
-	 * diff < 0: 'value' is missing leading zeros, which we add
+	/*
+	 * vlen may be 1 byte larger than bufsize due to a leading zero byte
+	 * (necessary if the most significant bit of the integer is set).
 	 */
-	if (diff > 0) {
+	if (vlen > bufsize) {
 		/* skip over leading zeros that make 'value' a positive int */
 		if (*d == 0) {
 			vlen -= 1;
-			diff--;
 			d++;
-		}
-		if (diff)
+		} else {
 			return -EINVAL;
+		}
 	}
-	if (-diff >= keylen)
-		return -EINVAL;
-
-	if (diff) {
-		/* leading zeros not given in 'value' */
-		memset(rs, 0, -diff);
-	}
-
-	memcpy(&rs[-diff], d, vlen);
 
-	ecc_swap_digits((u64 *)rs, dest, ndigits);
+	ecc_digits_from_bytes(d, vlen, dest, ndigits);
 
 	return 0;
 }
@@ -138,7 +125,7 @@
 {
 	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
 	struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
-	size_t keylen = ctx->curve->g.ndigits * sizeof(u64);
+	size_t bufsize = ctx->curve->g.ndigits * sizeof(u64);
 	struct ecdsa_signature_ctx sig_ctx = {
 		.curve = ctx->curve,
 	};
@@ -165,14 +152,14 @@
 		goto error;
 
 	/* if the hash is shorter then we will add leading zeros to fit to ndigits */
-	diff = keylen - req->dst_len;
+	diff = bufsize - req->dst_len;
 	if (diff >= 0) {
 		if (diff)
 			memset(rawhash, 0, diff);
 		memcpy(&rawhash[diff], buffer + req->src_len, req->dst_len);
 	} else if (diff < 0) {
 		/* given hash is longer, we take the left-most bytes */
-		memcpy(&rawhash, buffer + req->src_len, keylen);
+		memcpy(&rawhash, buffer + req->src_len, bufsize);
 	}
 
 	ecc_swap_digits((u64 *)rawhash, hash, ctx->curve->g.ndigits);
@@ -222,9 +209,8 @@
 static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsigned int keylen)
 {
 	struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
+	unsigned int digitlen, ndigits;
 	const unsigned char *d = key;
-	const u64 *digits = (const u64 *)&d[1];
-	unsigned int ndigits;
 	int ret;
 
 	ret = ecdsa_ecc_ctx_reset(ctx);
@@ -238,12 +224,17 @@
 		return -EINVAL;
 
 	keylen--;
-	ndigits = (keylen >> 1) / sizeof(u64);
+	digitlen = keylen >> 1;
+
+	ndigits = DIV_ROUND_UP(digitlen, sizeof(u64));
 	if (ndigits != ctx->curve->g.ndigits)
 		return -EINVAL;
 
-	ecc_swap_digits(digits, ctx->pub_key.x, ndigits);
-	ecc_swap_digits(&digits[ndigits], ctx->pub_key.y, ndigits);
+	d++;
+
+	ecc_digits_from_bytes(d, digitlen, ctx->pub_key.x, ndigits);
+	ecc_digits_from_bytes(&d[digitlen], digitlen, ctx->pub_key.y, ndigits);
+
 	ret = ecc_is_pubkey_valid_full(ctx->curve, &ctx->pub_key);
 
 	ctx->pub_key_set = ret == 0;
@@ -373,4 +364,7 @@
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Stefan Berger <stefanb@linux.ibm.com>");
 MODULE_DESCRIPTION("ECDSA generic algorithm");
+MODULE_ALIAS_CRYPTO("ecdsa-nist-p192");
+MODULE_ALIAS_CRYPTO("ecdsa-nist-p256");
+MODULE_ALIAS_CRYPTO("ecdsa-nist-p384");
 MODULE_ALIAS_CRYPTO("ecdsa-generic");
--- linux-qcom-6.8.0.orig/crypto/ecrdsa.c
+++ linux-qcom-6.8.0/crypto/ecrdsa.c
@@ -294,4 +294,5 @@
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Vitaly Chikunov <vt@altlinux.org>");
 MODULE_DESCRIPTION("EC-RDSA generic algorithm");
+MODULE_ALIAS_CRYPTO("ecrdsa");
 MODULE_ALIAS_CRYPTO("ecrdsa-generic");
--- linux-qcom-6.8.0.orig/crypto/fips.c
+++ linux-qcom-6.8.0/crypto/fips.c
@@ -14,7 +14,8 @@
 #include <linux/notifier.h>
 #include <generated/utsrelease.h>
 
-int fips_enabled;
+/* LP: #2049082 UBUNTU: SAUCE: FIPS kernels default to FIPS mode */
+int fips_enabled = 1;
 EXPORT_SYMBOL_GPL(fips_enabled);
 
 ATOMIC_NOTIFIER_HEAD(fips_fail_notif_chain);
--- linux-qcom-6.8.0.orig/crypto/pcrypt.c
+++ linux-qcom-6.8.0/crypto/pcrypt.c
@@ -117,8 +117,10 @@
 	err = padata_do_parallel(ictx->psenc, padata, &ctx->cb_cpu);
 	if (!err)
 		return -EINPROGRESS;
-	if (err == -EBUSY)
-		return -EAGAIN;
+	if (err == -EBUSY) {
+		/* try non-parallel mode */
+		return crypto_aead_encrypt(creq);
+	}
 
 	return err;
 }
@@ -166,8 +168,10 @@
 	err = padata_do_parallel(ictx->psdec, padata, &ctx->cb_cpu);
 	if (!err)
 		return -EINPROGRESS;
-	if (err == -EBUSY)
-		return -EAGAIN;
+	if (err == -EBUSY) {
+		/* try non-parallel mode */
+		return crypto_aead_decrypt(creq);
+	}
 
 	return err;
 }
--- linux-qcom-6.8.0.orig/crypto/simd.c
+++ linux-qcom-6.8.0/crypto/simd.c
@@ -136,27 +136,19 @@
 	return 0;
 }
 
-struct simd_skcipher_alg *simd_skcipher_create_compat(const char *algname,
+struct simd_skcipher_alg *simd_skcipher_create_compat(struct skcipher_alg *ialg,
+						      const char *algname,
 						      const char *drvname,
 						      const char *basename)
 {
 	struct simd_skcipher_alg *salg;
-	struct crypto_skcipher *tfm;
-	struct skcipher_alg *ialg;
 	struct skcipher_alg *alg;
 	int err;
 
-	tfm = crypto_alloc_skcipher(basename, CRYPTO_ALG_INTERNAL,
-				    CRYPTO_ALG_INTERNAL | CRYPTO_ALG_ASYNC);
-	if (IS_ERR(tfm))
-		return ERR_CAST(tfm);
-
-	ialg = crypto_skcipher_alg(tfm);
-
 	salg = kzalloc(sizeof(*salg), GFP_KERNEL);
 	if (!salg) {
 		salg = ERR_PTR(-ENOMEM);
-		goto out_put_tfm;
+		goto out;
 	}
 
 	salg->ialg_name = basename;
@@ -195,30 +187,16 @@
 	if (err)
 		goto out_free_salg;
 
-out_put_tfm:
-	crypto_free_skcipher(tfm);
+out:
 	return salg;
 
 out_free_salg:
 	kfree(salg);
 	salg = ERR_PTR(err);
-	goto out_put_tfm;
+	goto out;
 }
 EXPORT_SYMBOL_GPL(simd_skcipher_create_compat);
 
-struct simd_skcipher_alg *simd_skcipher_create(const char *algname,
-					       const char *basename)
-{
-	char drvname[CRYPTO_MAX_ALG_NAME];
-
-	if (snprintf(drvname, CRYPTO_MAX_ALG_NAME, "simd-%s", basename) >=
-	    CRYPTO_MAX_ALG_NAME)
-		return ERR_PTR(-ENAMETOOLONG);
-
-	return simd_skcipher_create_compat(algname, drvname, basename);
-}
-EXPORT_SYMBOL_GPL(simd_skcipher_create);
-
 void simd_skcipher_free(struct simd_skcipher_alg *salg)
 {
 	crypto_unregister_skcipher(&salg->alg);
@@ -246,7 +224,7 @@
 		algname = algs[i].base.cra_name + 2;
 		drvname = algs[i].base.cra_driver_name + 2;
 		basename = algs[i].base.cra_driver_name;
-		simd = simd_skcipher_create_compat(algname, drvname, basename);
+		simd = simd_skcipher_create_compat(algs + i, algname, drvname, basename);
 		err = PTR_ERR(simd);
 		if (IS_ERR(simd))
 			goto err_unregister;
@@ -383,27 +361,19 @@
 	return 0;
 }
 
-struct simd_aead_alg *simd_aead_create_compat(const char *algname,
-					      const char *drvname,
-					      const char *basename)
+static struct simd_aead_alg *simd_aead_create_compat(struct aead_alg *ialg,
+						     const char *algname,
+						     const char *drvname,
+						     const char *basename)
 {
 	struct simd_aead_alg *salg;
-	struct crypto_aead *tfm;
-	struct aead_alg *ialg;
 	struct aead_alg *alg;
 	int err;
 
-	tfm = crypto_alloc_aead(basename, CRYPTO_ALG_INTERNAL,
-				CRYPTO_ALG_INTERNAL | CRYPTO_ALG_ASYNC);
-	if (IS_ERR(tfm))
-		return ERR_CAST(tfm);
-
-	ialg = crypto_aead_alg(tfm);
-
 	salg = kzalloc(sizeof(*salg), GFP_KERNEL);
 	if (!salg) {
 		salg = ERR_PTR(-ENOMEM);
-		goto out_put_tfm;
+		goto out;
 	}
 
 	salg->ialg_name = basename;
@@ -442,36 +412,20 @@
 	if (err)
 		goto out_free_salg;
 
-out_put_tfm:
-	crypto_free_aead(tfm);
+out:
 	return salg;
 
 out_free_salg:
 	kfree(salg);
 	salg = ERR_PTR(err);
-	goto out_put_tfm;
-}
-EXPORT_SYMBOL_GPL(simd_aead_create_compat);
-
-struct simd_aead_alg *simd_aead_create(const char *algname,
-				       const char *basename)
-{
-	char drvname[CRYPTO_MAX_ALG_NAME];
-
-	if (snprintf(drvname, CRYPTO_MAX_ALG_NAME, "simd-%s", basename) >=
-	    CRYPTO_MAX_ALG_NAME)
-		return ERR_PTR(-ENAMETOOLONG);
-
-	return simd_aead_create_compat(algname, drvname, basename);
+	goto out;
 }
-EXPORT_SYMBOL_GPL(simd_aead_create);
 
-void simd_aead_free(struct simd_aead_alg *salg)
+static void simd_aead_free(struct simd_aead_alg *salg)
 {
 	crypto_unregister_aead(&salg->alg);
 	kfree(salg);
 }
-EXPORT_SYMBOL_GPL(simd_aead_free);
 
 int simd_register_aeads_compat(struct aead_alg *algs, int count,
 			       struct simd_aead_alg **simd_algs)
@@ -493,7 +447,7 @@
 		algname = algs[i].base.cra_name + 2;
 		drvname = algs[i].base.cra_driver_name + 2;
 		basename = algs[i].base.cra_driver_name;
-		simd = simd_aead_create_compat(algname, drvname, basename);
+		simd = simd_aead_create_compat(algs + i, algname, drvname, basename);
 		err = PTR_ERR(simd);
 		if (IS_ERR(simd))
 			goto err_unregister;
--- linux-qcom-6.8.0.orig/crypto/testmgr.h
+++ linux-qcom-6.8.0/crypto/testmgr.h
@@ -653,6 +653,30 @@
 static const struct akcipher_testvec ecdsa_nist_p192_tv_template[] = {
 	{
 	.key =
+	"\x04\xf7\x46\xf8\x2f\x15\xf6\x22\x8e\xd7\x57\x4f\xcc\xe7\xbb\xc1"
+	"\xd4\x09\x73\xcf\xea\xd0\x15\x07\x3d\xa5\x8a\x8a\x95\x43\xe4\x68"
+	"\xea\xc6\x25\xc1\xc1\x01\x25\x4c\x7e\xc3\x3c\xa6\x04\x0a\xe7\x08"
+	"\x98",
+	.key_len = 49,
+	.params =
+	"\x30\x13\x06\x07\x2a\x86\x48\xce\x3d\x02\x01\x06\x08\x2a\x86\x48"
+	"\xce\x3d\x03\x01\x01",
+	.param_len = 21,
+	.m =
+	"\xcd\xb9\xd2\x1c\xb7\x6f\xcd\x44\xb3\xfd\x63\xea\xa3\x66\x7f\xae"
+	"\x63\x85\xe7\x82",
+	.m_size = 20,
+	.algo = OID_id_ecdsa_with_sha1,
+	.c =
+	"\x30\x35\x02\x19\x00\xba\xe5\x93\x83\x6e\xb6\x3b\x63\xa0\x27\x91"
+	"\xc6\xf6\x7f\xc3\x09\xad\x59\xad\x88\x27\xd6\x92\x6b\x02\x18\x10"
+	"\x68\x01\x9d\xba\xce\x83\x08\xef\x95\x52\x7b\xa0\x0f\xe4\x18\x86"
+	"\x80\x6f\xa5\x79\x77\xda\xd0",
+	.c_size = 55,
+	.public_key_vec = true,
+	.siggen_sigver_test = true,
+	}, {
+	.key =
 	"\x04\xb6\x4b\xb1\xd1\xac\xba\x24\x8f\x65\xb2\x60\x00\x90\xbf\xbd"
 	"\x78\x05\x73\xe9\x79\x1d\x6f\x7c\x0b\xd2\xc3\x93\xa7\x28\xe1\x75"
 	"\xf7\xd5\x95\x1d\x28\x10\xc0\x75\x50\x5c\x1a\x4f\x3f\x8f\xa5\xee"
@@ -756,6 +780,32 @@
 static const struct akcipher_testvec ecdsa_nist_p256_tv_template[] = {
 	{
 	.key =
+	"\x04\xb9\x7b\xbb\xd7\x17\x64\xd2\x7e\xfc\x81\x5d\x87\x06\x83\x41"
+	"\x22\xd6\x9a\xaa\x87\x17\xec\x4f\x63\x55\x2f\x94\xba\xdd\x83\xe9"
+	"\x34\x4b\xf3\xe9\x91\x13\x50\xb6\xcb\xca\x62\x08\xe7\x3b\x09\xdc"
+	"\xc3\x63\x4b\x2d\xb9\x73\x53\xe4\x45\xe6\x7c\xad\xe7\x6b\xb0\xe8"
+	"\xaf",
+	.key_len = 65,
+	.params =
+	"\x30\x13\x06\x07\x2a\x86\x48\xce\x3d\x02\x01\x06\x08\x2a\x86\x48"
+	"\xce\x3d\x03\x01\x07",
+	.param_len = 21,
+	.m =
+	"\xc2\x2b\x5f\x91\x78\x34\x26\x09\x42\x8d\x6f\x51\xb2\xc5\xaf\x4c"
+	"\x0b\xde\x6a\x42",
+	.m_size = 20,
+	.algo = OID_id_ecdsa_with_sha1,
+	.c =
+	"\x30\x46\x02\x21\x00\xf9\x25\xce\x9f\x3a\xa6\x35\x81\xcf\xd4\xe7"
+	"\xb7\xf0\x82\x56\x41\xf7\xd4\xad\x8d\x94\x5a\x69\x89\xee\xca\x6a"
+	"\x52\x0e\x48\x4d\xcc\x02\x21\x00\xd7\xe4\xef\x52\x66\xd3\x5b\x9d"
+	"\x8a\xfa\x54\x93\x29\xa7\x70\x86\xf1\x03\x03\xf3\x3b\xe2\x73\xf7"
+	"\xfb\x9d\x8b\xde\xd4\x8d\x6f\xad",
+	.c_size = 72,
+	.public_key_vec = true,
+	.siggen_sigver_test = true,
+	}, {
+	.key =
 	"\x04\x8b\x6d\xc0\x33\x8e\x2d\x8b\x67\xf5\xeb\xc4\x7f\xa0\xf5\xd9"
 	"\x7b\x03\xa5\x78\x9a\xb5\xea\x14\xe4\x23\xd0\xaf\xd7\x0e\x2e\xa0"
 	"\xc9\x8b\xdb\x95\xf8\xb3\xaf\xac\x00\x2c\x2c\x1f\x7a\xfd\x95\x88"
@@ -866,6 +916,36 @@
 
 static const struct akcipher_testvec ecdsa_nist_p384_tv_template[] = {
 	{
+	.key = /* secp384r1(sha1) */
+	"\x04\x89\x25\xf3\x97\x88\xcb\xb0\x78\xc5\x72\x9a\x14\x6e\x7a\xb1"
+	"\x5a\xa5\x24\xf1\x95\x06\x9e\x28\xfb\xc4\xb9\xbe\x5a\x0d\xd9\x9f"
+	"\xf3\xd1\x4d\x2d\x07\x99\xbd\xda\xa7\x66\xec\xbb\xea\xba\x79\x42"
+	"\xc9\x34\x89\x6a\xe7\x0b\xc3\xf2\xfe\x32\x30\xbe\xba\xf9\xdf\x7e"
+	"\x4b\x6a\x07\x8e\x26\x66\x3f\x1d\xec\xa2\x57\x91\x51\xdd\x17\x0e"
+	"\x0b\x25\xd6\x80\x5c\x3b\xe6\x1a\x98\x48\x91\x45\x7a\x73\xb0\xc3"
+	"\xf1",
+	.key_len = 97,
+	.params =
+	"\x30\x10\x06\x07\x2a\x86\x48\xce\x3d\x02\x01\x06\x05\x2b\x81\x04"
+	"\x00\x22",
+	.param_len = 18,
+	.m =
+	"\x12\x55\x28\xf0\x77\xd5\xb6\x21\x71\x32\x48\xcd\x28\xa8\x25\x22"
+	"\x3a\x69\xc1\x93",
+	.m_size = 20,
+	.algo = OID_id_ecdsa_with_sha1,
+	.c =
+	"\x30\x66\x02\x31\x00\xf5\x0f\x24\x4c\x07\x93\x6f\x21\x57\x55\x07"
+	"\x20\x43\x30\xde\xa0\x8d\x26\x8e\xae\x63\x3f\xbc\x20\x3a\xc6\xf1"
+	"\x32\x3c\xce\x70\x2b\x78\xf1\x4c\x26\xe6\x5b\x86\xcf\xec\x7c\x7e"
+	"\xd0\x87\xd7\xd7\x6e\x02\x31\x00\xcd\xbb\x7e\x81\x5d\x8f\x63\xc0"
+	"\x5f\x63\xb1\xbe\x5e\x4c\x0e\xa1\xdf\x28\x8c\x1b\xfa\xf9\x95\x88"
+	"\x74\xa0\x0f\xbf\xaf\xc3\x36\x76\x4a\xa1\x59\xf1\x1c\xa4\x58\x26"
+	"\x79\x12\x2a\xb7\xc5\x15\x92\xc5",
+	.c_size = 104,
+	.public_key_vec = true,
+	.siggen_sigver_test = true,
+	}, {
 	.key = /* secp384r1(sha224) */
 	"\x04\x69\x6c\xcf\x62\xee\xd0\x0d\xe5\xb5\x2f\x70\x54\xcf\x26\xa0"
 	"\xd9\x98\x8d\x92\x2a\xab\x9b\x11\xcb\x48\x18\xa1\xa9\x0d\xd5\x18"
--- linux-qcom-6.8.0.orig/crypto/xor.c
+++ linux-qcom-6.8.0/crypto/xor.c
@@ -83,33 +83,30 @@
 do_xor_speed(struct xor_block_template *tmpl, void *b1, void *b2)
 {
 	int speed;
-	int i, j;
-	ktime_t min, start, diff;
+	unsigned long reps;
+	ktime_t min, start, t0;
 
 	tmpl->next = template_list;
 	template_list = tmpl;
 
 	preempt_disable();
 
-	min = (ktime_t)S64_MAX;
-	for (i = 0; i < 3; i++) {
-		start = ktime_get();
-		for (j = 0; j < REPS; j++) {
-			mb(); /* prevent loop optimization */
-			tmpl->do_2(BENCH_SIZE, b1, b2);
-			mb();
-		}
-		diff = ktime_sub(ktime_get(), start);
-		if (diff < min)
-			min = diff;
-	}
+	reps = 0;
+	t0 = ktime_get();
+	/* delay start until time has advanced */
+	while ((start = ktime_get()) == t0)
+		cpu_relax();
+	do {
+		mb(); /* prevent loop optimization */
+		tmpl->do_2(BENCH_SIZE, b1, b2);
+		mb();
+	} while (reps++ < REPS || (t0 = ktime_get()) == start);
+	min = ktime_sub(t0, start);
 
 	preempt_enable();
 
 	// bytes/ns == GB/s, multiply by 1000 to get MB/s [not MiB/s]
-	if (!min)
-		min = 1;
-	speed = (1000 * REPS * BENCH_SIZE) / (unsigned int)ktime_to_ns(min);
+	speed = (1000 * reps * BENCH_SIZE) / (unsigned int)ktime_to_ns(min);
 	tmpl->speed = speed;
 
 	pr_info("   %-16s: %5d MB/sec\n", tmpl->name, speed);
--- linux-qcom-6.8.0.orig/debian.master/changelog
+++ linux-qcom-6.8.0/debian.master/changelog
@@ -0,0 +1,36459 @@
+linux (6.8.0-62.65) noble; urgency=medium
+
+  * noble/linux: 6.8.0-62.65 -proposed tracker (LP: #2110737)
+
+  * Rotate the Canonical Livepatch key (LP: #2111244)
+    - [Config] Prepare for Canonical Livepatch key rotation
+
+  * KVM bug causes Firecracker crash when it runs the vCPU for the first time
+    (LP: #2109859)
+    - vhost: return task creation error instead of NULL
+    - kvm: retry nx_huge_page_recovery_thread creation
+
+  * CVE-2025-2312 cifs.upcall could access incorrect kerberos credentials cache
+    (LP: #2099914) // CVE-2025-2312
+    - CIFS: New mount option for cifs.upcall namespace resolution
+
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640)
+    - ASoC: wm8994: Add depends on MFD core
+    - ASoC: samsung: Add missing selects for MFD_WM8994
+    - seccomp: Stub for !CONFIG_SECCOMP
+    - scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
+    - of/unittest: Add test that of_address_to_resource() fails on non-
+      translatable address
+    - irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
+    - hwmon: (drivetemp) Set scsi command timeout to 10s
+    - ASoC: samsung: Add missing depends on I2C
+    - ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf()
+    - Revert "libfs: fix infinite directory reads for offset dir"
+    - libfs: Replace simple_offset end-of-directory detection
+    - Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
+    - ALSA: usb-audio: Add delay quirk for USB Audio Device
+    - Input: xpad - add support for Nacon Pro Compact
+    - Input: atkbd - map F23 key to support default copilot shortcut
+    - Input: xpad - add unofficial Xbox 360 wireless receiver clone
+    - Input: xpad - add QH Electronics VID/PID
+    - Input: xpad - improve name of 8BitDo controller 2dc8:3106
+    - Input: xpad - add support for Nacon Evol-X Xbox One Controller
+    - Input: xpad - add support for wooting two he (arm)
+    - ASoC: codecs: es8316: Fix HW rate calculation for 48Mhz MCLK
+    - ASoC: cs42l43: Add codec force suspend/resume ops
+    - ALSA: hda/realtek: Fix volume adjustment issue on Lenovo ThinkBook 16P Gen5
+    - libfs: Return ENOSPC when the directory offset range is exhausted
+    - Revert "libfs: Add simple_offset_empty()"
+    - libfs: Use d_children list to iterate simple_offset directories
+    - wifi: rtl8xxxu: add more missing rtl8192cu USB IDs
+    - HID: wacom: Initialize brightness of LED trigger
+    - Upstream stable to v6.6.75, v6.12.12
+
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21689
+    - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
+
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21690
+    - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
+
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21691
+    - cachestat: fix page cache statistics permission checking
+
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21692
+    - net: sched: fix ets qdisc OOB Indexing
+
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21699
+    - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
+
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2024-50157
+    - RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
+
+  * rtw89: Support hardware rfkill (LP: #2077384)
+    - wifi: rtw89: add support for hardware rfkill
+
+  * Introduce configfs-based interface for gpio-aggregator (LP: #2103496)
+    - gpio: introduce utilities for synchronous fake device creation
+    - bitmap: Define a cleanup function for bitmaps
+    - gpio: aggregator: simplify aggr_parse() with scoped bitmap
+    - gpio: aggregator: protect driver attr handlers against module unload
+    - gpio: aggregator: reorder functions to prepare for configfs introduction
+    - gpio: aggregator: unify function naming
+    - gpio: aggregator: add gpio_aggregator_{alloc, free}()
+    - gpio: aggregator: introduce basic configfs interface
+    - [Config] Enable DEV_SYNC_PROBE as module
+    - SAUCE: gpio: aggregator: Fix error code in gpio_aggregator_activate()
+    - gpio: aggregator: rename 'name' to 'key' in gpio_aggregator_parse()
+    - gpio: aggregator: expose aggregator created via legacy sysfs to configfs
+    - SAUCE: gpio: aggregator: fix "_sysfs" prefix check in
+      gpio_aggregator_make_group()
+    - SAUCE: gpio: aggregator: Fix gpio_aggregator_line_alloc() checking
+    - SAUCE: gpio: aggregator: Return an error if there are no GPIOs in
+      gpio_aggregator_parse()
+    - SAUCE: gpio: aggregator: Fix leak in gpio_aggregator_parse()
+    - gpio: aggregator: cancel deferred probe for devices created via configfs
+    - Documentation: gpio: document configfs interface for gpio-aggregator
+    - selftests: gpio: add test cases for gpio-aggregator
+    - SAUCE: selftests: gpio: gpio-aggregator: add a test case for _sysfs prefix
+      reservation
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449)
+    - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
+    - net: add exit_batch_rtnl() method
+    - gtp: use exit_batch_rtnl() method
+    - gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
+    - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
+    - nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
+    - net: xilinx: axienet: Fix IRQ coalescing packet count overflow
+    - net/mlx5: Fix RDMA TX steering prio
+    - net/mlx5e: Rely on reqid in IPsec tunnel mode
+    - net/mlx5e: Always start IPsec sequence number from 1
+    - drm/vmwgfx: Add new keep_resv BO param
+    - drm/v3d: Assign job pointer to NULL before signaling the fence
+    - soc: ti: pruss: Fix pruss APIs
+    - hwmon: (tmp513) Fix division of negative numbers
+    - i2c: mux: demux-pinctrl: check initial mux selection, too
+    - i2c: rcar: fix NACK handling when being a target
+    - hfs: Sanity check the root record
+    - fs: fix missing declaration of init_files
+    - kheaders: Ignore silly-rename files
+    - cachefiles: Parse the "secctx" immediately
+    - scsi: ufs: core: Honor runtime/system PM levels if set by host controller
+      drivers
+    - selftests: tc-testing: reduce rshift value
+    - ACPI: resource: acpi_dev_irq_override(): Check DMI match last
+    - poll_wait: add mb() to fix theoretical race between waitqueue_active() and
+      .poll()
+    - RDMA/bnxt_re: Fix to export port num to ib_query_qp
+    - nvmet: propagate npwg topology
+    - ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
+    - i2c: atr: Fix client detach
+    - mptcp: be sure to send ack when mptcp-level window re-opens
+    - mptcp: fix spurious wake-up on under memory pressure
+    - selftests: mptcp: avoid spurious errors on disconnect
+    - net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
+    - vsock/virtio: cancel close work in the destructor
+    - vsock: reset socket state when de-assigning the transport
+    - nouveau/fence: handle cross device fences properly
+    - irqchip: Plug a OF node reference leak in platform_irqchip_probe()
+    - irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
+    - drm/i915/fb: Relax clear color alignment to 64 bytes
+    - drm/amdgpu: always sync the GFX pipe on ctx switch
+    - ocfs2: fix deadlock in ocfs2_get_system_file_inode
+    - nfsd: add list_head nf_gc to struct nfsd_file
+    - x86/xen: fix SLS mitigation in xen_hypercall_iret()
+    - efi/zboot: Limit compression options to GZIP and ZSTD
+    - [Config] updateconfigs for HAVE_KERNEL_(LZ4|LZMA|LZO|XZ)
+    - net: ravb: Fix max TX frame size for RZ/V2M
+    - net/mlx5: SF, Fix add port error handling
+    - drm/vmwgfx: Unreserve BO on error
+    - i2c: testunit: on errors, repeat NACK until STOP
+    - hwmon: (ltc2991) Fix mixed signed/unsigned in DIV_ROUND_CLOSEST
+    - fs/qnx6: Fix building with GCC 15
+    - gpio: sim: lock up configfs that an instantiated device depends on
+    - gpio: sim: lock hog configfs items if present
+    - platform/x86: ISST: Add Clearwater Forest to support list
+    - drm/nouveau/disp: Fix missing backlight control on Macbook 5,1
+    - net/ncsi: fix locking in Get MAC Address handling
+    - drm/amd/display: Do not elevate mem_type change to full update
+    - drm/xe: Mark ComputeCS read mode as UC on iGPU
+    - drm/amdgpu/smu13: update powersave optimizations
+    - drm/amdgpu: fix fw attestation for MP0_14_0_{2/3}
+    - drm/amdgpu: disable gfxoff with the compute workload on gfx12
+    - drm/amd/display: Fix PSR-SU not support but still call the
+      amdgpu_dm_psr_enable
+    - Upstream stable to v6.6.73, v6.6.74, v6.12.11
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21672
+    - afs: Fix merge preference rule failure condition
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21682
+    - eth: bnxt: always recalculate features after XDP clearing, fix null-deref
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-53124
+    - net: fix data-races around sk->sk_forward_alloc
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57924
+    - fs: relax assertions on failure to encode file handles
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57951
+    - hrtimers: Handle CPU state correctly on hotplug
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57949
+    - irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21668
+    - pmdomain: imx8mp-blk-ctrl: add missing loop break condition
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21684
+    - gpio: xilinx: Convert gpio_lock to raw spinlock
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21694
+    - fs/proc: fix softlockup in __read_vmcore (part 2)
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21665
+    - filemap: avoid truncating 64-bit offset to 32 bits
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21666
+    - vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21669
+    - vsock/virtio: discard packets if the transport changes
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21670
+    - vsock/bpf: return early if transport is not assigned
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21667
+    - iomap: avoid avoid truncating 64-bit offset to 32 bits
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57948
+    - mac802154: check local interfaces before deleting sdata list
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21673
+    - smb: client: fix double free of TCP_Server_Info::hostname
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21697
+    - drm/v3d: Ensure job pointer is set to NULL after job completion
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21674
+    - net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21675
+    - net/mlx5: Clear port select structure when fail to create
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21676
+    - net: fec: handle page_pool_dev_alloc_pages error
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21678
+    - gtp: Destroy device along with udp socket's netns dismantle.
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21680
+    - pktgen: Avoid out-of-bounds access in get_imix_entries
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21681
+    - openvswitch: fix lockup on tx to unregistering netdev with carrier
+
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21683
+    - bpf: Fix bpf_sk_select_reuseport() memory leak
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update annotations scripts
+
+ -- Stefan Bader <stefan.bader@canonical.com>  Mon, 19 May 2025 12:55:33 +0200
+
+linux (6.8.0-60.63) noble; urgency=medium
+
+  * noble/linux: 6.8.0-60.63 -proposed tracker (LP: #2107138)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2025.04.14)
+
+  * Missing upstream commits for LP: #2102181 (LP: #2107336)
+    - libperf cpumap: Add any, empty and min helpers
+    - libperf cpumap: Ensure empty cpumap is NULL from alloc
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770)
+    - memblock: use numa_valid_node() helper to check for invalid node ID
+    - jbd2: increase IO priority for writing revoke records
+    - jbd2: flush filesystem device before updating tail sequence
+    - dm array: fix unreleased btree blocks on closing a faulty array cursor
+    - dm array: fix cursor index when skipping across block boundaries
+    - exfat: fix the infinite loop in __exfat_free_cluster()
+    - erofs: fix PSI memstall accounting
+    - ASoC: rt722: add delay time to wait for the calibration procedure
+    - ASoC: mediatek: disable buffer pre-allocation
+    - selftests/alsa: Fix circular dependency involving global-timer
+    - ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
+    - net: 802: LLC+SNAP OID:PID lookup on start of skb data
+    - tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
+    - tcp/dccp: allow a connection when sk_max_ack_backlog is zero
+    - net: libwx: fix firmware mailbox abnormal return
+    - pds_core: limit loop over fw name list
+    - bnxt_en: Fix possible memory leak when hwrm_req_replace fails
+    - cxgb4: Avoid removal of uninserted tid
+    - ice: fix incorrect PHY settings for 100 GB/s
+    - igc: return early when failing to read EECD register
+    - tls: Fix tls_sw_sendmsg error handling
+    - eth: gve: use appropriate helper to set xdp_features
+    - Bluetooth: hci_sync: Fix not setting Random Address when required
+    - Bluetooth: MGMT: Fix Add Device to responding before completing
+    - Bluetooth: btnxpuart: Fix driver sending truncated data
+    - tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
+    - riscv: Fix early ftrace nop patching
+    - memblock tests: fix implicit declaration of function 'numa_valid_node'
+    - iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
+    - netfilter: nf_tables: imbalance in flowtable binding
+    - drm/mediatek: stop selecting foreign drivers
+    - [Config] updateconfigs for MTK_SMI
+    - drm/mediatek: Fix YCbCr422 color format issue for DP
+    - drm/mediatek: Fix mode valid issue for dp
+    - drm/mediatek: Add return value check when reading DPCD
+    - cpuidle: riscv-sbi: fix device node release in early exit of
+      for_each_possible_cpu
+    - scsi: ufs: qcom: Power off the PHY if it was already powered on in
+      ufs_qcom_power_up_sequence()
+    - dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
+    - ksmbd: Implement new SMB3 POSIX type
+    - thermal: of: fix OF node leak in of_thermal_zone_find()
+    - smb: client: sync the root session and superblock context passwords before
+      automounting
+    - ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
+    - ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
+    - drm/amd/display: increase MAX_SURFACES to the value supported by hw
+    - io_uring/timeout: fix multishot updates
+    - dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
+    - USB: serial: option: add MeiG Smart SRM815
+    - USB: serial: option: add Neoway N723-EA support
+    - staging: iio: ad9834: Correct phase range check
+    - staging: iio: ad9832: Correct phase range check
+    - usb-storage: Add max sectors quirk for Nokia 208
+    - USB: serial: cp210x: add Phoenix Contact UPS Device
+    - usb: dwc3: gadget: fix writing NYET threshold
+    - misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set
+      config
+    - tty: serial: 8250: Fix another runtime PM usage counter underflow
+    - usb: dwc3-am62: Disable autosuspend during remove
+    - USB: usblp: return error when setting unsupported protocol
+    - USB: core: Disable LPM only for non-suspended ports
+    - usb: fix reference leak in usb_new_device()
+    - usb: gadget: midi2: Reverse-select at the right place
+    - usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in
+      the error path of .probe()
+    - usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
+    - usb: typec: tcpm/tcpci_maxim: fix error code in
+      max_contaminant_read_resistance_kohm()
+    - usb: gadget: configfs: Ignore trailing LF for user strings to cdev
+    - iio: gyro: fxas21002c: Fix missing data update in trigger handler
+    - iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
+    - iio: inkern: call iio_device_put() only on mapped devices
+    - iio: adc: ad7124: Disable all channels at probe time
+    - riscv: kprobes: Fix incorrect address calculation
+    - ARM: dts: imxrt1050: Fix clocks for mmc
+    - arm64: dts: rockchip: add hevc power domain clock to rk3328
+    - pmdomain: imx: gpcv2: Simplify with scoped for each OF child loop
+    - pmdomain: imx: gpcv2: fix an OF node reference leak in imx_gpcv2_probe()
+    - workqueue: Add rcu lock check at the end of work item execution
+    - workqueue: Update lock debugging code
+    - mm/hugetlb: enforce that PMD PT sharing has split PMD PT locks
+    - riscv: Fix text patching when IPI are used
+    - drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported
+    - ovl: pass realinode to ovl_encode_real_fh() instead of realdentry
+    - net: don't dump Tx and uninitialized NAPIs
+    - ice: fix max values for dpll pin phase adjust
+    - net: hns3: fixed reset failure issues caused by the incorrect reset type
+    - net: hns3: fix missing features due to dev->features configuration too early
+    - net: hns3: Resolved the issue that the debugfs query result is inconsistent.
+    - net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
+    - mctp i3c: fix MCTP I3C driver multi-thread issue
+    - drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb()
+    - drm/mediatek: Add support for 180-degree rotation in the display driver
+    - drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188
+    - platform/x86: intel/pmc: Fix ioremap() of bad address
+    - riscv: module: remove relocation_head rel_entry member allocation
+    - cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
+    - fs: kill MNT_ONRB
+    - gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset
+    - drm/amd/pm: fix BUG: scheduling while atomic
+    - drm/amdkfd: wq_release signals dma_fence only when available
+    - drm/amd/display: fix divide error in DM plane scale calcs
+    - drm/amd/display: fix page fault due to max surface definition mismatch
+    - serial: stm32: use port lock wrappers for break control
+    - usb: host: xhci-plat: set skip_phy_initialization if software node has
+      XHCI_SKIP_PHY_INIT property
+    - iio: imu: inv_icm42600: add register caching in the regmap
+    - iio: imu: inv_icm42600: fix spi burst write not supported
+    - Upstream stable to v6.6.71, v6.6.72, v6.12.10
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21659
+    - netdev: prevent accessing NAPI instances from another namespace
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21634
+    - cgroup/cpuset: remove kernfs active break
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21635
+    - rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21643
+    - netfs: Fix kernel async DIO
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21649
+    - net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21650
+    - net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21651
+    - net: hns3: don't auto enable misc vector
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21654
+    - ovl: support encoding fid from inode with no alias
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57883
+    - mm: hugetlb: independent PMD page table shared count
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57888
+    - workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from
+      !WQ_MEM_RECLAIM worker
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21631
+    - block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21656
+    - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21655
+    - io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57904
+    - iio: adc: at91: call input_free_device() on allocated iio_dev
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57906
+    - iio: adc: ti-ads8688: fix information leak in triggered buffer
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57907
+    - iio: adc: rockchip_saradc: fix information leak in triggered buffer
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57908
+    - iio: imu: kmx61: fix information leak in triggered buffer
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57910
+    - iio: light: vcnl4035: fix information leak in triggered buffer
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57911
+    - iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered
+      buffer
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57912
+    - iio: pressure: zpa2326: fix information leak in triggered buffer
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57913
+    - usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21632
+    - x86/fpu: Ensure shadow stack is active before "getting" registers
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57916
+    - misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57917
+    - topology: Keep the cpumask unchanged when printing cpumap
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57939
+    - riscv: Fix sleeping in invalid context in die()
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21636
+    - sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21637
+    - sctp: sysctl: udp_port: avoid using current->nsproxy
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21638
+    - sctp: sysctl: auth_enable: avoid using current->nsproxy
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21639
+    - sctp: sysctl: rto_min/max: avoid using current->nsproxy
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21640
+    - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21642
+    - mptcp: sysctl: sched: avoid using current->nsproxy
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21664
+    - dm thin: make get_first_thin use rcu-safe list first function
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57945
+    - riscv: mm: Fix the out of bound issue of vmemmap address
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21660
+    - ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21645
+    - platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled
+      it
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21646
+    - afs: Fix the maximum cell name length
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57925
+    - ksmbd: fix a missing return value check bug
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57926
+    - drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind
+      returns err
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21662
+    - net/mlx5: Fix variable not being completed when function returns
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21663
+    - net: stmmac: dwmac-tegra: Read iommu stream id from device tree
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21647
+    - sched: sch_cake: add bounds checks to host bulk flow fairness counts
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21648
+    - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21652
+    - ipvlan: Fix use-after-free in ipvlan_get_iflink().
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21658
+    - btrfs: avoid NULL pointer dereference if no valid extent tree
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21653
+    - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-47736
+    - erofs: handle overlapped pclusters out of crafted images properly
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57940
+    - exfat: fix the infinite loop in exfat_readdir()
+
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57929
+    - dm array: fix releasing a faulty array block twice in dm_array_cursor_end
+
+  * intel_idle: add Granite Rapids Xeon (D) support (LP: #2106638)
+    - intel_idle: add Granite Rapids Xeon support
+    - intel_idle: add Granite Rapids Xeon D support
+
+  * [SRU] Enable speaker/mic mute LEDs on Lenovo ideapad and thinkbook
+    (LP: #2106449)
+    - ALSA: hda: Support for Ideapad hotkey mute LEDs
+    - platform/x86:lenovo-wmi-hotkey-utilities.c: Support for mic and audio mute
+      LEDs
+    - [Config] Enable Lenovo wmi hotkey driver
+
+  * Backport "PCI: Wait for device readiness with Configuration RRS" to N/O
+    (LP: #2106251)
+    - PCI: Wait for device readiness with Configuration RRS
+    - PCI: Avoid FLR for Mediatek MT7922 WiFi
+
+  * Enable OOB P-state control for Intel Sierra Forest/Granite Rapids
+    (LP: #2106275)
+    - cpufreq: intel_pstate: Support Granite Rapids and Sierra Forest OOB mode
+
+  * mptcp BUG 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
+    (LP: #2101120)
+    - mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
+
+  * CVE-2025-21971
+    - net_sched: Prevent creation of classes with TC_H_ROOT
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632)
+    - smb/client: rename cifs_ntsd to smb_ntsd
+    - smb/client: rename cifs_sid to smb_sid
+    - smb/client: rename cifs_acl to smb_acl
+    - smb/client: rename cifs_ace to smb_ace
+    - fs/smb/client: implement chmod() for SMB3 POSIX Extensions
+    - smb: client: stop flooding dmesg in smb2_calc_signature()
+    - media: uvcvideo: Force UVC version to 1.0a for 0408:4033
+    - Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925
+    - watchdog: rzg2l_wdt: Remove reset de-assert from probe
+    - watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset
+    - watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler
+    - ALSA: ump: Use guard() for locking
+    - ALSA: ump: Don't open legacy substream for an inactive group
+    - scsi: mpi3mr: Use ida to manage mrioc ID
+    - scsi: mpi3mr: Start controller indexing from 0
+    - ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11
+    - ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A
+    - x86/ptrace: Cleanup the definition of the pt_regs structure
+    - x86/ptrace: Add FRED additional information to the pt_regs structure
+    - Bluetooth: btusb: add callback function in btusb suspend/resume
+    - Bluetooth: btusb: mediatek: add callback function in btusb_disconnect
+    - platform/x86: mlx-platform: call pci_dev_put() to balance the refcount
+    - mmc: sdhci-msm: fix crypto key eviction
+    - tracing: Handle old buffer mappings for event strings and functions
+    - tracing: Fix trace_check_vprintf() when tp_printk is used
+    - tracing: Check "%s" dereference via the field and not the TP_printk format
+    - RDMA/bnxt_re: Allow MSN table capability check
+    - RDMA/bnxt_re: Remove always true dattr validity check
+    - RDMA/mlx5: Enforce same type port association for multiport RoCE
+    - RDMA/bnxt_re: Avoid initializing the software queue for user queues
+    - RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters
+    - nvme-pci: 512 byte aligned dma pool segment quirk
+    - RDMA/bnxt_re: Fix the check for 9060 condition
+    - RDMA/bnxt_re: Add check for path mtu in modify_qp
+    - RDMA/bnxt_re: Fix reporting hw_ver in query_device
+    - RDMA/bnxt_re: Fix max_qp_wrs reported
+    - RDMA/bnxt_re: Add support for Variable WQE in Genp7 adapters
+    - RDMA/bnxt_re: Disable use of reserved wqes
+    - RDMA/bnxt_re: Add send queue size check for variable wqe
+    - RDMA/bnxt_re: Fix MSN table size for variable wqe mode
+    - drm/bridge: adv7511_audio: Update Audio InfoFrame properly
+    - net: dsa: microchip: Fix KSZ9477 set_ageing_time function
+    - net: dsa: microchip: Fix LAN937X set_ageing_time function
+    - RDMA/hns: Refactor mtr find
+    - RDMA/hns: Remove unused parameters and variables
+    - RDMA/hns: Fix mapping error of zero-hop WQE buffer
+    - RDMA/hns: Fix warning storm caused by invalid input in IO path
+    - RDMA/hns: Fix missing flush CQE for DWQE
+    - ip_tunnel: annotate data-races around t->parms.link
+    - ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()
+    - ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit()
+    - ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()
+    - net: Fix netns for ip_tunnel_init_flow()
+    - net/mlx5: DR, select MSIX vector 0 for completion queue creation
+    - net/mlx5e: macsec: Maintain TX SA from encoding_sa
+    - drm/i915/dg1: Fix power gate sequence.
+    - net: llc: reset skb->transport_header
+    - ALSA: usb-audio: US16x08: Initialize array before use
+    - eth: bcmsysport: fix call balance of priv->clk handling routines
+    - net: mv643xx_eth: fix an OF node reference leak
+    - net: sfc: Correct key_len for efx_tc_ct_zone_ht_params
+    - net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init()
+    - net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init
+    - wifi: mac80211: wake the queues in case of failure in resume
+    - ALSA: hda/ca0132: Use standard HD-audio quirk matching helpers
+    - ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model
+    - sound: usb: enable DSD output for ddHiFi TC44C
+    - sound: usb: format: don't warn that raw DSD is unsupported
+    - bpf: fix potential error return
+    - ksmbd: retry iterate_dir in smb2_query_dir
+    - smb: client: destroy cfid_put_wq on module exit
+    - net: usb: qmi_wwan: add Telit FE910C04 compositions
+    - irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
+    - ARC: build: Try to guess GCC variant of cross compiler
+    - RDMA/bnxt_re: Fix the max WQE size for static WQE support
+    - modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
+    - modpost: fix the missed iteration for the max bit in do_input()
+    - ALSA: seq: Check UMP support for midi_version change
+    - ALSA hda/realtek: Add quirk for Framework F111:000C
+    - kcov: mark in_softirq_really() as __always_inline
+    - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
+    - sky2: Add device ID 11ab:4373 for Marvell 88E8075
+    - drm: adv7511: Drop dsi single lane support
+    - dt-bindings: display: adi,adv7533: Drop single lane support
+    - fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit
+    - mm/readahead: fix large folio support in async readahead
+    - mptcp: fix recvbuffer adjust on sleeping rcvmsg
+    - mptcp: don't always assume copied data in mptcp_cleanup_rbuf()
+    - RDMA/bnxt_re: Fix max SGEs for the Work Request
+    - scsi: hisi_sas: Remove redundant checks for automatic debugfs dump
+    - platform/x86: hp-wmi: Add thermal profile support for 8BAD boards
+    - platform/x86: hp-wmi: Fix platform profile option switch bug on Omen and
+      Victus laptops
+    - platform/x86: hp-wmi: Fix implementation of the platform_profile_omen_get
+      function
+    - platform/x86: hp-wmi: mark 8A15 board for timed OMEN thermal profile
+    - RDMA/core: Fix ENODEV error for iWARP test over vlan
+    - net: phy: micrel: Dynamically control external clock of KSZ PHY
+    - netdev-genl: avoid empty messages in napi get
+    - net: stmmac: restructure the error path of stmmac_probe_config_dt()
+    - net/mlx5e: Fix netif state handling
+    - net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only
+    - drm/i915/cx0_phy: Fix C10 pll programming sequence
+    - RDMA/bnxt_re: Fix error recovery sequence
+    - btrfs: allow swap activation to be interruptible
+    - perf/x86/intel: Add Arrow Lake U support
+    - ALSA: hda: cs35l56: Remove calls to
+      cs35l56_force_sync_asp1_registers_from_cache()
+    - ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio
+    - spi: spi-cadence-qspi: Disable STIG mode for Altera SoCFPGA.
+    - ARC: build: disallow invalid PAE40 + 4K page config
+    - bpf: refactor bpf_helper_changes_pkt_data to use helper number
+    - bpf: consider that tail calls invalidate packet pointers
+    - maple_tree: reload mas before the second call for mas_empty_area
+    - io_uring/rw: fix downgraded mshot read
+    - wifi: iwlwifi: mvm: Fix __counted_by usage in cfg80211_wowlan_nd_*
+    - net: ethernet: ti: am65-cpsw: default to round-robin for host port receive
+    - gve: process XSK TX descriptors as part of RX NAPI
+    - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
+    - mm: reinstate ability to map write-sealed memfd mappings read-only
+    - Upstream stable to v6.6.70, v6.12.9
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57898
+    - wifi: cfg80211: clear link ID from bitmap during link delete after clean up
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57882
+    - mptcp: fix TCP options overflow.
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57884
+    - mm: vmscan: account for free pages to prevent infinite Loop in
+      throttle_direct_reclaim()
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57885
+    - mm/kmemleak: fix sleeping function called from invalid context at print
+      message
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57932
+    - gve: guard XDP xmit NDO on existence of xdp queues
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57933
+    - gve: guard XSK operations on the existence of queues
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57887
+    - drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57938
+    - net/sctp: Prevent autoclose integer overflow in sctp_association_init()
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57889
+    - pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57890
+    - RDMA/uverbs: Prevent integer overflow issue
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57892
+    - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57893
+    - ALSA: seq: oss: Fix races at processing SysEx messages
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57895
+    - ksmbd: set ATTR_CTIME flags when setting mtime
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57896
+    - btrfs: flush delalloc workers queue before stopping cleaner kthread during
+      unmount
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57897
+    - drm/amdkfd: Correct the migration DMA map direction
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57899
+    - wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57900
+    - ila: serialize calls to nf_register_net_hooks()
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57901
+    - af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57902
+    - af_packet: fix vlan_get_tci() vs MSG_PEEK
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57903
+    - net: restrict SO_REUSEPORT to inet sockets
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-36476
+    - RDMA/rtrs: Ensure 'ib_sge list' is accessible
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-39282
+    - net: wwan: t7xx: Fix FSM command timeout issue
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57801
+    - net/mlx5e: Skip restore TC rules for vport rep without loaded flag
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57802
+    - netrom: check buffer length before accessing it
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57841
+    - net: fix memory leak in tcp_conn_request()
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57931
+    - selinux: ignore unknown extended permissions
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-56761
+    - x86/fred: Clear WFE in missing-ENDBRANCH #CPs
+
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-53179
+    - smb: client: fix use-after-free of signing key
+
+  * uprobe-related panics during profiling (LP: #2104210)
+    - uprobes: Fix race in uprobe_free_utask
+
+  * ubuntu_bpf failed to build on Noble / Oracular (LP: #2069407)
+    - selftests/bpf: Fix compilation failure when CONFIG_NET_FOU!=y
+
+  * nfsd hangs and never recovers after NFS4ERR_DELAY and a connection loss
+    (LP: #2103564)
+    - NFSD: Reset cb_seq_status after NFS4ERR_DELAY
+
+  * thermal: Fix temperature readings on intel hardware (LP: #2103427)
+    - thermal: intel: intel_tcc: Add model checks for temperature registers
+    - thermal: intel: intel_tcc_cooling: Use a model-specific bitmask for TCC
+      offset
+    - hwmon: (coretemp) Extend the bitmask to read temperature to 0xff
+
+  * [SRU] Fix Lenovo M70/90 gen6 micmute key and led (LP: #2101811)
+    - ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
+    - ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869)
+    - ceph: allocate sparse_ext map only for sparse reads
+    - mm/vmstat: fix a W=1 clang compiler warning
+    - tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress()
+    - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
+    - bpf: Check negative offsets in __bpf_skb_min_len()
+    - mtd: diskonchip: Cast an operand to prevent potential overflow
+    - mtd: rawnand: arasan: Fix double assertion of chip-select
+    - mtd: rawnand: arasan: Fix missing de-registration of NAND
+    - phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP
+    - phy: core: Fix an OF node refcount leakage in _of_phy_get()
+    - phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
+    - phy: core: Fix that API devm_phy_put() fails to release the phy
+    - phy: core: Fix that API devm_of_phy_provider_unregister() fails to
+      unregister the phy provider
+    - phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
+    - phy: usb: Toggle the PHY power during init
+    - phy: rockchip: naneng-combphy: fix phy reset
+    - dmaengine: mv_xor: fix child node refcount handling in early exit
+    - dmaengine: dw: Select only supported masters for ACPI devices
+    - dmaengine: tegra: Return correct DMA status when paused
+    - dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd()
+    - dmaengine: apple-admac: Avoid accessing registers in probe
+    - stddef: make __struct_group() UAPI C++-friendly
+    - tracing/kprobe: Make trace_kprobe's module callback called after jump_label
+      update
+    - watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
+    - watchdog: mediatek: Add support for MT6735 TOPRGU/WDT
+    - scsi: qla1280: Fix hw revision numbering for ISP1020/1040
+    - udf: Skip parent dir link count update if corrupted
+    - ALSA: hda/conexant: fix Z60MR100 startup pop issue
+    - ALSA: sh: Use standard helper for buffer accesses
+    - smb: server: Fix building with GCC 15
+    - regmap: Use correct format specifier for logging range errors
+    - LoongArch: Fix reserving screen info memory for above-4G firmware
+    - LoongArch: BPF: Adjust the parameter of emit_jirl()
+    - platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
+    - spi: intel: Add Panther Lake SPI controller support
+    - scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load
+      time
+    - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN
+      as an error
+    - spi: omap2-mcspi: Fix the IS_ERR() bug for devm_clk_get_optional_enabled()
+    - blk-mq: register cpuhp callback after hctx is added to xarray table
+    - blk-mq: move cpuhp callback registering out of q->sysfs_lock
+    - MIPS: Probe toolchain support of -msym32
+    - MIPS: mipsregs: Set proper ISA level for virt extensions
+    - freezer, sched: Report frozen tasks as 'D' instead of 'R'
+    - tracing: Constify string literal data member in struct trace_event_call
+    - io_uring/sqpoll: fix sqpoll error handling races
+    - i2c: microchip-core: actually use repeated sends
+    - i2c: imx: add imx7d compatible string for applying erratum ERR007805
+    - i2c: microchip-core: fix "ghost" detections
+    - btrfs: sysfs: fix direct super block member reads
+    - ALSA: sh: Fix wrong argument order for copy_from_iter()
+    - block: avoid to reuse `hctx` not removed from cpuhp callback list
+    - fork: avoid inappropriate uprobe access to invalid mm
+    - ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
+    - power: supply: bq24190: Fix BQ24296 Vbus regulator support
+    - udf: Verify inode link counts before performing rename
+    - ALSA: ump: Indicate the inactive group in legacy substream names
+    - ALSA: ump: Update legacy substream names upon FB info update
+    - scsi: mpi3mr: Synchronize access to ioctl data buffer
+    - scsi: mpi3mr: Handling of fault code for insufficient power
+    - objtool: Add bch2_trans_unlocked_error() to bcachefs noreturns
+    - dmaengine: loongson2-apb: Change GENMASK to GENMASK_ULL
+    - perf/x86/intel/ds: Add PEBS format 6
+    - btrfs: add and use helper to verify the calling task has locked the inode
+    - btrfs: fix race with memory mapped writes when activating swap file
+    - btrfs: fix swap file activation failure due to extents that used to be
+      shared
+    - ALSA: ump: Shut up truncated string warning
+    - Upstream stable to v6.6.69, v6.12.8
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56758
+    - btrfs: check folio mapping after unlock in relocate_one_folio()
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56759
+    - btrfs: fix use-after-free when COWing tree bock and tracing is enabled
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57806
+    - btrfs: fix transaction atomicity bug when enabling simple quotas
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57793
+    - virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56764
+    - ublk: detach gendisk from ublk device if add_disk() fails
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57804
+    - scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57792
+    - power: supply: gpio-charger: Fix set charge current limits
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56760
+    - PCI/MSI: Handle lack of irqdomain gracefully
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56763
+    - tracing: Prevent bad count for tracing_cpumask_write
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57946
+    - virtio-blk: don't keep queue frozen during system suspend
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57807
+    - scsi: megaraid_sas: Fix for a potential deadlock
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56767
+    - dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
+
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56769
+    - media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266)
+    - usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with
+      iommu enabled
+    - PCI: vmd: Create domain symlink before pci_bus_add_devices()
+    - PCI: Add ACS quirk for Broadcom BCM5760X NIC
+    - usb: cdns3-ti: Add workaround for Errata i2409
+    - MIPS: Loongson64: DTS: Fix msi node for ls7a
+    - ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP
+    - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C
+    - usb: cdns3: Add quirk flag to enable suspend residency
+    - platform/x86: p2sb: Make p2sb_get_devfn() return void
+    - p2sb: Factor out p2sb_read_from_cache()
+    - p2sb: Introduce the global flag p2sb_hidden_by_bios
+    - p2sb: Move P2SB hide and unhide code to p2sb_scan_and_cache()
+    - p2sb: Do not scan and remove the P2SB device when it is unhidden
+    - i2c: pnx: Fix timeout in wait functions
+    - xfs: fix the contact address for the sysfs ABI documentation
+    - xfs: verify buffer, inode, and dquot items every tx commit
+    - xfs: use consistent uid/gid when grabbing dquots for inodes
+    - xfs: declare xfs_file.c symbols in xfs_file.h
+    - xfs: create a new helper to return a file's allocation unit
+    - xfs: Fix xfs_flush_unmap_range() range for RT
+    - xfs: Fix xfs_prepare_shift() range for RT
+    - xfs: convert comma to semicolon
+    - xfs: fix file_path handling in tracepoints
+    - xfs: remove unused parameter in macro XFS_DQUOT_LOGRES
+    - xfs: attr forks require attr, not attr2
+    - xfs: conditionally allow FS_XFLAG_REALTIME changes if S_DAX is set
+    - xfs: Fix the owner setting issue for rmap query in xfs fsmap
+    - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
+    - xfs: take m_growlock when running growfsrt
+    - xfs: reset rootdir extent size hint after growfsrt
+    - tools: hv: change permissions of NetworkManager configuration file
+    - cxl/pci: Fix potential bogus return value upon successful probing
+    - cxl/region: Fix region creation for greater than x2 switches
+    - net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
+    - ionic: use ee->offset when returning sprom data
+    - net: renesas: rswitch: rework ts tags management
+    - net: hinic: Fix cleanup in create_rxqs/txqs()
+    - net: ethernet: bgmac-platform: fix an OF node reference leak
+    - ipvs: Fix clamp() of ip_vs_conn_tab on small memory systems
+    - netfilter: ipset: Fix for recursive locking warning
+    - selftests: openvswitch: fix tcpdump execution
+    - net: mdiobus: fix an OF node reference leak
+    - mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
+    - mmc: mtk-sd: disable wakeup in .remove() and in the error path of .probe()
+    - EDAC/amd64: Simplify ECC check on unified memory controllers
+    - chelsio/chtls: prevent potential integer overflow on 32bit
+    - i2c: riic: Always round-up when calculating bus period
+    - efivarfs: Fix error on non-existent file
+    - hexagon: Disable constant extender optimization for LLVM prior to 19.1.0
+    - USB: serial: option: add TCL IK512 MBIM & ECM
+    - USB: serial: option: add MeiG Smart SLM770A
+    - USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
+    - USB: serial: option: add MediaTek T7XX compositions
+    - USB: serial: option: add Telit FE910C04 rmnet compositions
+    - thunderbolt: Improve redrive mode handling
+    - drm/panel: novatek-nt35950: fix return value check in nt35950_probe()
+    - i915/guc: Reset engine utilization buffer before registration
+    - i915/guc: Ensure busyness counter increases motonically
+    - i915/guc: Accumulate active runtime on gt reset
+    - hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit
+      Registers
+    - hwmon: (tmp513) Fix Current Register value interpretation
+    - hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit
+      Registers
+    - zram: refuse to use zero sized block device as backing device
+    - zram: fix uninitialized ZRAM not releasing backing device
+    - zram: fix potential UAF of zram table
+    - vmalloc: fix accounting with i915
+    - btrfs: tree-checker: reject inline extent items with 0 ref count
+    - smb: client: fix TCP timers deadlock after rmmod
+    - tracing: Fix test_event_printk() to process entire print argument
+    - tracing: Add missing helper functions in event pointer dereference check
+    - tracing: Add "%s" check in test_event_printk()
+    - tracing: Have process_string() also allow arrays
+    - selftests/memfd: run sysctl tests when PID namespace support is enabled
+    - selftests/bpf: Use asm constraint "m" for LoongArch
+    - io_uring: Fix registered ring file refcount leak
+    - NFS/pnfs: Fix a live lock between recalled layouts and layoutget
+    - of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent()
+    - of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
+    - nilfs2: fix buffer head leaks in calls to truncate_inode_pages()
+    - udmabuf: also check for F_SEAL_FUTURE_WRITE
+    - of: Fix error path in of_parse_phandle_with_args_map()
+    - of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
+    - ceph: validate snapdirname option length when mounting
+    - ceph: improve error handling and short/overflow-read logic in
+      __ceph_sync_read()
+    - ceph: fix memory leaks in __ceph_sync_read()
+    - epoll: Add synchronous wakeup support for ep_poll_callback
+    - io_uring/rw: avoid punting to io-wq directly
+    - drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update
+    - xfs: sb_spino_align is not verified
+    - xfs: fix sparse inode limits on runt AG
+    - xfs: fix sb_spino_align checks for large fsblock sizes
+    - xfs: fix zero byte checking in the superblock scrubber
+    - netdev: fix repeated netlink messages in queue dump
+    - team: Fix feature exposure when no ports are present
+    - can: m_can: fix missed interrupts with m_can_pci
+    - netdev-genl: avoid empty messages in queue dump
+    - KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden
+    - KVM: arm64: Fix set_id_regs selftest for ASIDBITS becoming unwritable
+    - net: mctp: handle skb cleanup on sock_queue failures
+    - xhci: retry Stop Endpoint on buggy NEC controllers
+    - usb: xhci: Limit Stop Endpoint retries
+    - usb: xhci: Avoid queuing redundant Stop Endpoint commands
+    - xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic
+    - thunderbolt: Add support for Intel Panther Lake-M/P
+    - thunderbolt: Don't display nvm_version unless upgrade supported
+    - drm/panel: st7701: Add prepare_prev_first flag to drm_panel
+    - drm/panel: synaptics-r63353: Fix regulator unbalance
+    - drm/amdgpu/nbio7.11: fix IP version check
+    - drm/amdgpu/nbio7.7: fix IP version check
+    - fgraph: Still initialize idle shadow stacks when starting
+    - x86/hyperv: Fix hv tsc page based sched_clock for hibernation
+    - ocfs2: fix the space leak in LA when releasing LA
+    - of: property: fw_devlink: Do not use interrupt-parent directly
+    - of: address: Preserve the flags portion on 1:1 dma-ranges mapping
+    - Upstream stable to v6.6.68, v6.12.7
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56710
+    - ceph: fix memory leak in ceph_direct_read_write()
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-53685
+    - ceph: give up on paths longer than PATH_MAX
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-54193
+    - accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-54455
+    - accel/ivpu: Fix general protection fault in ivpu_bo_list()
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-53690
+    - nilfs2: prevent use of deleted inode
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56709
+    - io_uring: check if iowq is killed before queuing
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-55881
+    - KVM: x86: Play nice with protected guests in complete_hypercall_exit()
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-55916
+    - Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56369
+    - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56372
+    - net: tun: fix tun_napi_alloc_frags()
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56715
+    - ionic: Fix netdev notifier unregister on failure
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56716
+    - netdevsim: prevent bad user input in nsim_dev_health_break_write()
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56717
+    - net: mscc: ocelot: fix incorrect IFH SRC_PORT field in
+      ocelot_ifh_set_basic()
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-57791
+    - net/smc: check return value of sock_recvmsg when draining clc data
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-47408
+    - net/smc: check smcd_v2_ext_offset when receiving proposal msg
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-49568
+    - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-49571
+    - net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal
+      msg
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56718
+    - net/smc: protect link down work from execute after lgr freed
+
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-41013
+    - xfs: don't walk off the end of a directory data block
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181)
+    - perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
+    - ksmbd: fix racy issue from session lookup and expire
+    - splice: do not checksum AF_UNIX sockets
+    - tcp: check space before adding MPTCP SYN options
+    - ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
+    - usb: host: max3421-hcd: Correctly abort a USB request.
+    - ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
+    - usb: dwc2: Fix HCD resume
+    - usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
+    - usb: dwc2: Fix HCD port connection race
+    - scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
+    - usb: gadget: midi2: Fix interpretation of is_midi1 bits
+    - usb: ehci-hcd: fix call balance of clocks handling routines
+    - usb: typec: anx7411: fix fwnode_handle reference leak
+    - usb: typec: anx7411: fix OF node reference leaks in
+      anx7411_typec_switch_probe()
+    - usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
+    - drm/i915: Fix memory leak by correcting cache object name in error handler
+    - xfs: update btree keys correctly when _insrec splits an inode root block
+    - xfs: don't drop errno values when we fail to ficlone the entire range
+    - xfs: return from xfs_symlink_verify early on V4 filesystems
+    - xfs: fix scrub tracepoints when inode-rooted btrees are involved
+    - xfs: only run precommits once per transaction object
+    - bpf: Check size for BTF-based ctx access of pointer members
+    - bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
+    - bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
+    - bpf, sockmap: Fix update element with same
+    - wifi: mac80211: init cnt before accessing elem in
+      ieee80211_copy_mbssid_beacon
+    - wifi: mac80211: clean up 'ret' in sta_link_apply_parameters()
+    - wifi: mac80211: fix station NSS capability initialization order
+    - batman-adv: Do not send uninitialized TT changes
+    - batman-adv: Remove uninitialized data in full table TT response
+    - batman-adv: Do not let TT changes list grows indefinitely
+    - wifi: cfg80211: sme: init n_channels before channels[] access
+    - selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
+    - selftests: mlxsw: sharedbuffer: Remove duplicate test cases
+    - selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
+    - ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
+    - net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
+    - net: mscc: ocelot: improve handling of TX timestamp for unknown skb
+    - net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-
+      safe
+    - net: mscc: ocelot: be resilient to loss of PTP packets during transmission
+    - net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
+    - spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
+    - net: sparx5: fix FDMA performance issue
+    - net: sparx5: fix the maximum frame length register
+    - ACPI: resource: Fix memory resource type union access
+    - cxgb4: use port number to set mac addr
+    - qca_spi: Fix clock speed for multiple QCA7000
+    - qca_spi: Make driver probing reliable
+    - ASoC: amd: yc: Fix the wrong return value
+    - Documentation: PM: Clarify pm_runtime_resume_and_get() return value
+    - net: renesas: rswitch: fix race window between tx start and complete
+    - net: renesas: rswitch: fix leaked pointer on error path
+    - net: renesas: rswitch: handle stop vs interrupt race
+    - net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
+    - netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
+    - bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
+    - team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
+    - ACPICA: events/evxfregn: don't release the ContextMutex that was never
+      acquired
+    - Bluetooth: iso: Fix recursive locking warning
+    - Bluetooth: SCO: Add support for 16 bits transparent voice setting
+    - net: renesas: rswitch: fix initial MPIC register setting
+    - net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
+    - blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
+    - kselftest/arm64: abi: fix SVCR detection
+    - KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
+    - selftests/bpf: remove use of __xlated()
+    - xen/netfront: fix crash when removing device
+    - x86: make get_cpu_vendor() accessible from Xen code
+    - objtool/x86: allow syscall instruction
+    - x86/static-call: provide a way to do very early static-call updates
+    - x86/xen: don't do PV iret hypercall through hypercall page
+    - x86/xen: add central hypercall functions
+    - x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
+    - x86/xen: add FRAME_END to xen_hypercall_hvm()
+    - x86/xen: use new hypercall functions instead of hypercall page
+    - x86/xen: remove hypercall page
+    - x86/static-call: fix 32-bit build
+    - x86/asm: Make serialize() always_inline
+    - x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0
+    - serial: sh-sci: Check if TX data was written to device in .tx_empty()
+    - gpio: ljca: Initialize num before accessing item in ljca_gpio_config
+    - ALSA: hda/realtek: Fix headset mic on Acer Nitro 5
+    - drm/amdkfd: Use device based logging for errors
+    - drm/amdkfd: pause autosuspend when creating pdd
+    - drm/amdkfd: fixed page fault when enable MES shader debugger
+    - drm/i915/color: Stop using non-posted DSB writes for legacy LUT
+    - drm/amd/pm: Set SMU v13.0.7 default workload type
+    - xfs: return a 64-bit block count from xfs_btree_count_blocks
+    - perf machine: Initialize machine->env to address a segfault
+    - bnxt_en: Fix GSO type for HW GRO packets on 5750X chips
+    - net: renesas: rswitch: fix possible early skb release
+    - Bluetooth: Improve setsockopt() handling of malformed user input
+    - libperf: evlist: Fix --cpu argument on hybrid platform
+    - selftests: netfilter: Stabilize rpath.sh
+    - net, team, bonding: Add netdev_base_features helper
+    - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
+    - team: Fix initial vlan_feature set in __team_compute_features
+    - drm/xe: fix the ERR_PTR() returned on failure to allocate tiny pt
+    - Upstream stable to v6.6.67, v6.12.6
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56652
+    - drm/xe/reg_sr: Remove register pool
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-54460
+    - Bluetooth: iso: Fix circular lock in iso_listen_bis
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-57879
+    - Bluetooth: iso: Always release hdev at the end of iso_listen_bis
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56656
+    - bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-53125
+    - bpf: sync_linked_regs() must preserve subreg_def
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56654
+    - Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56770
+    - net/sched: netem: account for backlog updates from child qdisc
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-54683
+    - netfilter: IDLETIMER: Fix for possible ABBA deadlock
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-55639
+    - net: renesas: rswitch: avoid use-after-put for a device tree node
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56657
+    - ALSA: control: Avoid WARN() for symlink errors
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56659
+    - net: lapb: increase LAPB_HEADER_LEN
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56660
+    - net/mlx5: DR, prevent potential error pointer dereference
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56662
+    - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56664
+    - bpf, sockmap: Fix race between element replace and close()
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56667
+    - drm/i915: Fix NULL pointer dereference in capture_engine
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56670
+    - usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to
+      accessing null pointer
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-53687
+    - riscv: Fix IPIs usage in kfence_protect_page()
+
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56675
+    - bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
+
+  * Noble update: upstream stable patchset 2025-02-04 (LP: #2097393)
+    - selftests: net: Remove executable bits from library scripts
+
+  * CVE-2024-56653
+    - Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
+
+ -- Mehmet Basaran <mehmet.basaran@canonical.com>  Tue, 15 Apr 2025 20:24:36 +0300
+
+linux (6.8.0-58.60) noble; urgency=medium
+
+  * noble/linux: 6.8.0-58.60 -proposed tracker (LP: #2102529)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2025.03.17)
+
+  * wdat_wdt.ko should be pulled in by linux-image-virtual (LP: #2098554)
+    - [Packaging]: wdat_wdt.ko is moved from "linux-modules-extra-*-generic" to
+      "linux-modules-*-generic"
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118)
+    - openrisc: Use asm-generic's version of fix_to_virt() & virt_to_fix()
+    - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
+    - watchdog: xilinx_wwdt: Calculate max_hw_heartbeat_ms using clock frequency
+    - watchdog: apple: Actually flush writes after requesting watchdog restart
+    - watchdog: mediatek: Make sure system reset gets asserted in
+      mtk_wdt_restart()
+    - can: gs_usb: add VID/PID for Xylanta SAINT3 product family
+    - can: gs_usb: add usb endpoint address detection at driver probe step
+    - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
+    - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics
+    - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics
+    - can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
+    - can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
+    - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
+    - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
+    - can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics
+    - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
+    - selftests: hid: fix typo and exit code
+    - ptp: Add error handling for adjfine callback in ptp_clock_adjtime
+    - net/sched: tbf: correct backlog statistic for GSO packets
+    - net: hsr: fix fill_frame_info() regression vs VLAN packets
+    - platform/x86: asus-wmi: add support for vivobook fan profiles
+    - platform/x86: asus-wmi: Fix inconsistent use of thermal policies
+    - platform/x86: asus-wmi: Ignore return value when writing thermal policy
+    - net/smc: mark optional smcd_ops and check for support when called
+    - net/smc: add operations to merge sndbuf with peer DMB
+    - net/smc: {at|de}tach sndbuf to peer DMB if supported
+    - net/smc: refactoring initialization of smc sock
+    - net/qed: allow old cards not supporting "num_images" to work
+    - ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5
+    - ixgbe: downgrade logging of unsupported VF API version to debug
+    - net: sched: fix erspan_opt settings in cls_flower
+    - netfilter: nft_set_hash: skip duplicated elements pending gc run
+    - netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
+    - ethtool: Fix wrong mod state in case of verbose and no_mask bitset
+    - mlxsw: spectrum_acl_flex_keys: Constify struct mlxsw_afk_element_inst
+    - mlxsw: spectrum_acl_flex_keys: Use correct key block on Spectrum-4
+    - net/mlx5e: Remove workaround to avoid syndrome for internal port
+    - xhci: Allow RPM on the USB controller (1022:43f7) by default
+    - gpio: grgpio: use a helper variable to store the address of ofdev->dev
+    - usb: dwc3: gadget: Rewrite endpoint allocation flow
+    - usb: dwc3: ep0: Don't reset resource alloc flag (including ep0)
+    - usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED
+    - mmc: mtk-sd: use devm_mmc_alloc_host
+    - mmc: mtk-sd: Fix error handle of probe function
+    - mmc: mtk-sd: fix devm_clk_get_optional usage
+    - mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting
+    - zram: do not mark idle slots that cannot be idle
+    - zram: clear IDLE flag in mark_idle()
+    - powerpc/vdso: Refactor CFLAGS for CVDSO build
+    - powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang
+    - ntp: Remove invalid cast in time offset math
+    - driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link
+    - driver core: fw_devlink: Stop trying to optimize cycle detection logic
+    - drivers: core: fix device leak in __fw_devlink_relax_cycles()
+    - i3c: master: support to adjust first broadcast address speed
+    - i3c: master: svc: use slow speed for first broadcast address
+    - i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter
+    - i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS
+    - i3c: master: Extend address status bit to 4 and add
+      I3C_ADDR_SLOT_EXT_DESIRED
+    - i3c: master: Fix dynamic address leak when 'assigned-address' is present
+    - i3c: master: Fix missing 'ret' assignment in set_speed()
+    - drm/bridge: it6505: update usleep_range for RC circuit charge time
+    - drm/bridge: it6505: Fix inverted reset polarity
+    - scsi: ufs: core: Always initialize the UIC done completion
+    - scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG
+    - bpf, vsock: Fix poll() missing a queue
+    - bpf, vsock: Invoke proto::close on close()
+    - xsk: always clear DMA mapping information when unmapping the pool
+    - bpftool: fix potential NULL pointer dereferencing in prog_dump()
+    - drm/sti: Add __iomem for mixer_dbg_mxn's parameter
+    - ALSA: seq: ump: Use automatic cleanup of kfree()
+    - ALSA: ump: Update substream name from assigned FB names
+    - ALSA: seq: ump: Fix seq port updates per FB info notify
+    - ALSA: usb-audio: Notify xrun for low-latency mode
+    - tools: Override makefile ARCH variable if defined, but empty
+    - ASoC: SOF: ipc3-topology: Convert the topology pin index to ALH dai index
+    - ASoC: SOF: ipc3-topology: fix resource leaks in
+      sof_ipc3_widget_setup_comp_dai()
+    - bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
+    - scsi: scsi_debug: Fix hrtimer support for ndelay
+    - ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
+    - drm/v3d: Enable Performance Counters before clearing them
+    - scatterlist: fix incorrect func name in kernel-doc
+    - iio: magnetometer: yas530: use signed integer type for clamp limits
+    - bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
+    - bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem
+    - bpf: Handle in-place update for full LPM trie correctly
+    - bpf: Fix exact match conditions in trie_get_next_key()
+    - x86/CPU/AMD: WARN when setting EFER.AUTOIBRS if and only if the WRMSR fails
+    - watchdog: rti: of: honor timeout-sec property
+    - can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6.
+    - tracing: Fix cmp_entries_dup() to respect sort() comparison rules
+    - arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit
+      ASIDs
+    - ALSA: usb-audio: add mixer mapping for Corsair HS80
+    - ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
+    - ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
+    - scsi: qla2xxx: Fix abort in bsg timeout
+    - scsi: qla2xxx: Fix NVMe and NPIV connect issue
+    - scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
+    - scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
+    - scsi: ufs: core: Add missing post notify for power mode change
+    - fs/smb/client: cifs_prime_dcache() for SMB3 POSIX reparse points
+    - drm/dp_mst: Verify request type in the corresponding down message reply
+    - drm/amdgpu/hdp5.2: do a posting read when flushing HDP
+    - modpost: Add .irqentry.text to OTHER_SECTIONS
+    - x86/kexec: Restore GDT on return from ::preserve_context kexec
+    - dma-buf: fix dma_fence_array_signaled v4
+    - dma-fence: Fix reference leak on fence merge failure path
+    - dma-fence: Use kernel's sort for merging fences
+    - regmap: detach regmap from dev on regmap_exit
+    - mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10
+      tablet
+    - mmc: core: Further prevent card detect during shutdown
+    - ocfs2: update seq_file index in ocfs2_dlm_seq_next
+    - lib: stackinit: hide never-taken branch from compiler
+    - kasan: make report_lock a raw spinlock
+    - x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables
+    - epoll: annotate racy check
+    - kselftest/arm64: Log fp-stress child startup errors to stdout
+    - btrfs: avoid unnecessary device path update for the same device
+    - btrfs: do not clear read-only when adding sprout device
+    - kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
+    - hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list
+    - ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID
+    - perf/x86/amd: Warn only on new bits set
+    - spi: spi-fsl-lpspi: Adjust type of scldiv
+    - HID: add per device quirk to force bind to hid-generic
+    - media: uvcvideo: RealSense D421 Depth module metadata
+    - media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
+    - media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
+    - mmc: core: Add SD card quirk for broken poweroff notification
+    - mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
+    - regmap: maple: Provide lockdep (sub)class for maple tree's internal lock
+    - selftests/resctrl: Protect against array overflow when reading strings
+    - drm/vc4: hdmi: Avoid log spam for audio start failure
+    - drm/vc4: hvs: Set AXI panic modes for the HVS
+    - drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
+    - drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
+    - drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
+    - drm/bridge: it6505: Enable module autoloading
+    - drm/mcde: Enable module autoloading
+    - drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
+    - drm/display: Fix building with GCC 15
+    - ALSA: hda: Use own quirk lookup helper
+    - ALSA: hda/conexant: Use the new codec SSID matching
+    - r8169: don't apply UDP padding quirk on RTL8126A
+    - samples/bpf: Fix a resource leak
+    - net: fec_mpc52xx_phy: Use %pa to format resource_size_t
+    - net: ethernet: fs_enet: Use %pa to format resource_size_t
+    - net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
+    - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
+    - wifi: ath5k: add PCI ID for SX76X
+    - wifi: ath5k: add PCI ID for Arcadyan devices
+    - fanotify: allow reporting errors on failure to open fd
+    - drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
+    - net: sfp: change quirks for Alcatel Lucent G-010S-P
+    - net: stmmac: Programming sequence for VLAN packets with split header
+    - drm/sched: memset() 'job' in drm_sched_job_init()
+    - amdgpu/uvd: get ring reference from rq scheduler
+    - drm/amdgpu: don't access invalid sched
+    - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
+    - drm/amdgpu: Dereference the ATCS ACPI buffer
+    - netlink: specs: Add missing bitset attrs to ethtool spec
+    - drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
+    - fsl/fman: Validate cell-index value obtained from Device Tree
+    - drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
+    - ALSA: usb-audio: Make mic volume workarounds globally applicable
+    - wifi: ipw2x00: libipw_rx_any(): fix bad alignment
+    - dsa: qca8k: Use nested lock to avoid splat
+    - Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
+    - Bluetooth: Add new quirks for ATS2851
+    - Bluetooth: Support new quirks for ATS2851
+    - Bluetooth: Set quirks for ATS2851
+    - ASoC: hdmi-codec: reorder channel allocation list
+    - rocker: fix link status detection in rocker_carrier_init()
+    - net/neighbor: clear error in case strict check is not set
+    - netpoll: Use rcu_access_pointer() in __netpoll_setup
+    - pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
+    - tracing/ftrace: disable preemption in syscall probe
+    - tracing: Use atomic64_inc_return() in trace_clock_counter()
+    - tools/rtla: fix collision with glibc sched_attr/sched_set_attr
+    - rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
+    - scsi: ufs: core: Make DMA mask configuration more flexible
+    - scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
+    - clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
+    - clk: qcom: rpmh: add support for SAR2130P
+    - clk: qcom: tcsrcc-sm8550: add SAR2130P support
+    - scsi: st: Don't modify unknown block number in MTIOCGET
+    - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
+    - pinctrl: qcom-pmic-gpio: add support for PM8937
+    - pinctrl: qcom: spmi-mpp: Add PM8937 compatible
+    - thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens
+    - nvdimm: rectify the illogical code within nd_dax_probe()
+    - smb: client: memcpy() with surrounding object base address
+    - verification/dot2: Improve dot parser robustness
+    - KMSAN: uninit-value in inode_go_dump (5)
+    - PCI: qcom: Add support for IPQ9574
+    - PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs
+    - PCI: vmd: Set devices to D0 before enabling PM L1 Substates
+    - PCI: Detect and trust built-in Thunderbolt chips
+    - PCI: Add 'reset_subordinate' to reset hierarchy below bridge
+    - PCI: Add ACS quirk for Wangxun FF5xxx NICs
+    - f2fs: print message if fscorrupted was found in f2fs_new_node_page()
+    - ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840
+    - ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[]
+    - fs/ntfs3: Fix case when unmarked clusters intersect with zone
+    - usb: chipidea: udc: handle USB Error Interrupt if IOC not set
+    - iio: light: ltr501: Add LTER0303 to the supported devices
+    - ASoC: amd: yc: fix internal mic on Redmi G 2022
+    - drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3
+    - drm/amdgpu/vcn: reset fw_shared under SRIOV
+    - ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6
+      21M1CTO1WW
+    - misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
+    - rtc: cmos: avoid taking rtc_lock for extended period of time
+    - serial: 8250_dw: Add Sophgo SG2044 quirk
+    - smb: client: don't try following DFS links in cifs_tree_connect()
+    - setlocalversion: work around "git describe" performance
+    - sched/core: Remove the unnecessary need_resched() check in nohz_csd_func()
+    - sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning
+      busy
+    - sched/core: Prevent wakeup of ksoftirqd during idle load balance
+    - btrfs: fix missing snapshot drew unlock when root is dead during swap
+      activation
+    - clk: en7523: Initialize num before accessing hws in en7523_register_clocks()
+    - tracing/eprobe: Fix to release eprobe when failed to add dyn_event
+    - x86: Fix build regression with CONFIG_KEXEC_JUMP enabled
+    - Revert "unicode: Don't special case ignorable code points"
+    - vfio/mlx5: Align the page tracking max message size with the device
+      capability
+    - selftests/ftrace: adjust offset for kprobe syntax error test
+    - KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from
+      kvm_faultin_pfn()
+    - jffs2: Fix rtime decompressor
+    - mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
+    - iio: invensense: fix multiple odr switch when FIFO is off
+    - ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
+    - ALSA: hda: Fix build error without CONFIG_SND_DEBUG
+    - usb: dwc3: ep0: Don't reset resource alloc flag
+    - ALSA: usb-audio: Update UMP group attributes for GTB blocks, too
+    - platform/x86: asus-wmi: Fix thermal profile initialization
+    - i3c: master: svc: fix possible assignment of the same address to two devices
+    - btrfs: drop unused parameter file_offset from
+      btrfs_encoded_read_regular_fill_pages()
+    - md/raid5: Wait sync io to finish before changing group cnt
+    - media: platform: rga: fix 32-bit DMA limitation
+    - net: phy: dp83869: fix status reporting for 1000base-x autonegotiation
+    - remoteproc: qcom_q6v5_pas: disable auto boot for wpss
+    - mtd: spinand: winbond: Fix 512GW and 02JW OOB layout
+    - PCI: Pass domain number to pci_bus_release_domain_nr() explicitly
+    - dt-bindings: net: fec: add pps channel property
+    - net: fec: refactor PPS channel configuration
+    - net: fec: make PPS channel configurable
+    - drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
+    - drm/xe/migrate: use XE_BO_FLAG_PAGETABLE
+    - drm/amd: Add some missing straps from NBIO 7.11.0
+    - drm/amd: Fix initialization mistake for NBIO 7.11 devices
+    - drm/amdgpu/pm: Don't use OD table on Arcturus
+    - drm/amd/pm: Remove arcturus min power limit
+    - drm/amd/display: update pipe selection policy to check head pipe
+    - drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto
+    - Revert "drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs"
+    - ipv6: avoid possible NULL deref in modify_prefix_route()
+    - net: phy: microchip: Reset LAN88xx PHY to ensure clean link state on
+      LAN7800/7850
+    - ice: fix PHY Clock Recovery availability check
+    - vsock/test: fix failures due to wrong SO_RCVLOWAT parameter
+    - vsock/test: fix parameter types in SO_VM_SOCKETS_* calls
+    - mmc: core Convert UNSTUFF_BITS macro to inline function
+    - mmc: sd: SDUC Support Recognition
+    - mmc: core: Adjust ACMD22 to SDUC
+    - mmc: core: Use GFP_NOIO in ACMD22
+    - f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK}
+    - f2fs: fix to adjust appropriate length for fiemap
+    - f2fs: fix to requery extent which cross boundary of inquiry
+    - drm/amd/display: calculate final viewport before TAP optimization
+    - drm/amd/display: Ignore scalar validation failure if pipe is phantom
+    - pmdomain: core: Add missing put_device()
+    - pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails
+    - pmdomain: core: add dummy release function to genpd device
+    - bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
+    - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
+    - LoongArch: KVM: Protect kvm_check_requests() with SRCU
+    - net :mana :Request a V2 response version for MANA_QUERY_GF_STAT
+    - ALSA: usb-audio: Add extra PID for RME Digiface USB
+    - ALSA: hda/realtek: fix micmute LEDs don't work on HP Laptops
+    - scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers
+    - io_uring/cmd: document some uring_cmd related helpers
+    - io_uring: Change res2 parameter type in io_uring_cmd_done
+    - selftests/damon: add _damon_sysfs.py to TEST_FILES
+    - drm/amd/display: Correct prefetch calculation
+    - drm/amd/amdgpu: allow use kiq to do hdp flush under sriov
+    - drm/amdgpu/hdp6.0: do a posting read when flushing HDP
+    - drm/amdgpu/hdp4.0: do a posting read when flushing HDP
+    - drm/amdgpu/hdp5.0: do a posting read when flushing HDP
+    - x86/cpu/intel: Switch to new Intel CPU model defines
+    - x86/cpu/intel: Drop stray FAM6 check with new Intel CPU model defines
+    - x86/cpu: Add Lunar Lake to list of CPUs with a broken MONITOR implementation
+    - mm/damon: fix order of arguments in damos_before_apply tracepoint
+    - mm: respect mmap hint address when aligning for THP
+    - scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove()
+    - memblock: allow zero threshold in validate_numa_converage()
+    - s390/pci: Sort PCI functions prior to creating virtual busses
+    - s390/pci: Use topology ID for multi-function devices
+    - s390/pci: Ignore RID for isolated VFs
+    - s390/pci: Fix SR-IOV for PFs initially in standby
+    - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
+    - s390/pci: Fix handling of isolated VFs
+    - ext4: partial zero eof block on unaligned inode size extension
+    - crypto: ecdsa - Convert byte arrays with key coordinates to digits
+    - crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes
+    - crypto: ecdsa - Rename keylen to bufsize where necessary
+    - crypto: ecdsa - Use ecc_digits_from_bytes to convert signature
+    - crypto: ecdsa - Avoid signed integer overflow on signature decoding
+    - ACPI: video: force native for Apple MacbookPro11,2 and Air7,2
+    - cleanup: Adjust scoped_guard() macros to avoid potential warning
+    - gpio: free irqs that are still requested when the chip is being removed
+    - media: uvcvideo: Force UVC version to 1.0a for 0408:4035
+    - media: uvcvideo: Force UVC version to 1.0a for 0408:4033
+    - wifi: mac80211: export ieee80211_purge_tx_queue() for drivers
+    - drm/amd/display: skip disable CRTC in seemless bootup case
+    - drm/amd/display: disable SG displays on cyan skillfish
+    - wifi: mac80211: Add non-atomic station iterator
+    - accel/qaic: Add AIC080 support
+    - mptcp: annotate data-races around subflow->fully_established
+    - net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
+    - drm/amd/display: Prune Invalid Modes For HDMI Output
+    - i2c: i801: Add support for Intel Arrow Lake-H
+    - i2c: i801: Add support for Intel Panther Lake
+    - Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
+    - Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925
+    - Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925
+    - Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925
+    - Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925
+    - Bluetooth: btusb: Add 3 HWIDs for MT7925
+    - rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
+    - ring-buffer: Correct stale comments related to non-consuming readers
+    - ring-buffer: Limit time with disabled interrupts in rb_check_pages()
+    - scsi: lpfc: Check SLI_ACTIVE flag in FDMI cmpl before submitting follow up
+      FDMI
+    - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback
+    - clk: qcom: clk-alpha-pll: Add support for zonda ole pll configure
+    - clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574
+    - mailbox: pcc: Check before sending MCTP PCC response ACK
+    - remoteproc: qcom: pas: Add support for SA8775p ADSP, CDSP and GPDSP
+    - remoteproc: qcom: pas: enable SAR2130P audio DSP support
+    - fs/ntfs3: Implement fallocate for compressed files
+    - fs/ntfs3: Fix warning in ni_fiemap
+    - regulator: qcom-rpmh: Update ranges for FTSMPS525
+    - usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag
+    - usb: chipidea: udc: limit usb request length to max 16KB
+    - usb: chipidea: udc: create bounce buffer for problem sglist entries if
+      possible
+    - iio: adc: ad7192: Convert from of specific to fwnode property handling
+    - iio: adc: ad7192: properly check spi_get_device_match_data()
+    - usb: typec: ucsi: add callback for connector status updates
+    - usb: typec: ucsi: glink: move GPIO reading into connector_status callback
+    - usb: typec: ucsi: add update_connector callback
+    - usb: typec: ucsi: glink: set orientation aware if supported
+    - usb: typec: ucsi: glink: be more precise on orientation-aware ports
+    - usb: typec: ucsi: glink: fix off-by-one in connector_status
+    - usb: typec: ucsi: Set orientation as none when connector is unplugged
+    - nvme: use helper nvme_ctrl_state in nvme_keep_alive_finish function
+    - Revert "nvme: make keep-alive synchronous operation"
+    - irqchip/gic-v3-its: Avoid explicit cpumask allocation on stack
+    - irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
+    - [Config] updateconfigs for HISILICON_ERRATUM_162100801
+    - drm/amd/display: Add option to retrieve detile buffer size
+    - btrfs: drop unused parameter options from open_ctree()
+    - btrfs: drop unused parameter data from btrfs_fill_super()
+    - btrfs: fix mount failure due to remount races
+    - net/mlx5: unique names for per device caches
+    - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails
+    - ALSA: hda/realtek: Fix spelling mistake "Firelfy" -> "Firefly"
+    - softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
+    - Upstream stable to v6.6.65, v6.6.66, v6.12.4, v6.12.5
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-41932
+    - sched: fix warning in sched_setaffinity
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57872
+    - scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56588
+    - scsi: hisi_sas: Create all dump files during debugfs initialization
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47794
+    - bpf: Prevent tailcall infinite loop caused by freplace
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56599
+    - wifi: ath10k: avoid NULL pointer error during sdio remove
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56607
+    - wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56608
+    - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56609
+    - wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56782
+    - ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48876
+    - stackdepot: fix stack_depot_save_flags() in NMI context
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56620
+    - scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56621
+    - scsi: ufs: core: Cancel RTC work during ufshcd_remove()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-49569
+    - nvme-rdma: unquiesce admin_q before destroy it
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56632
+    - nvme-tcp: fix the memleak while create new ctrl failed
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56647
+    - net: Fix icmp host relookup triggering ip_rt_bug
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56775
+    - drm/amd/display: Fix handling of plane refcount
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56561
+    - PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56550
+    - s390/stacktrace: Use break instead of return statement
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56771
+    - mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56568
+    - iommu/arm-smmu: Defer probe of clients after smmu device bound
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56772
+    - kunit: string-stream: Fix a UAF bug in kunit_init_suite()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56773
+    - kunit: Fix potential null dereference in kunit_device_driver_test()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56580
+    - media: qcom: camss: fix error path on configuration of power domains
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57850
+    - jffs2: Prevent rtime decompress memory corruption
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56583
+    - sched/deadline: Fix warning in migrate_enable for boosted tasks
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56611
+    - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a
+      MM
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56613
+    - sched/numa: fix memory leak due to the overwritten vma->numab_state
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56584
+    - io_uring/tctx: work around xa_store() allocation error issue
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56781
+    - powerpc/prom_init: Fixup missing powermac #size-cells
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56785
+    - MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56585
+    - LoongArch: Fix sleeping in atomic context for PREEMPT_RT
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-41935
+    - f2fs: fix to shrink read extent node in batches
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-43098
+    - i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to
+      avoid deadlock
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-45828
+    - i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56586
+    - f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56587
+    - leds: class: Protect brightness_show() with led_cdev->led_access mutex
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56786
+    - bpf: put bpf_link's program when link is safe to be deallocated
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47141
+    - pinmux: Use sequential access to access desc->pinmux data
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56589
+    - scsi: hisi_sas: Add cond_resched() for no forced preemption model
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56590
+    - Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56592
+    - bpf: Call free_htab_elem() after htab_unlock_bucket()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56593
+    - wifi: brcmfmac: Fix oops due to NULL pointer dereference in
+      brcmf_sdiod_sglist_rw()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56594
+    - drm/amdgpu: set the right AMDGPU sg segment limitation
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57843
+    - virtio-net: fix overflow inside virtnet_rq_alloc
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56596
+    - jfs: fix array-index-out-of-bounds in jfs_readdir
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56597
+    - jfs: fix shift-out-of-bounds in dbSplit
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47143
+    - dma-debug: fix a possible deadlock on radix_lock
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56601
+    - net: inet: do not leave a dangling sk pointer in inet_create()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56602
+    - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56603
+    - net: af_can: do not leave a dangling sk pointer in can_create()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56604
+    - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56605
+    - Bluetooth: L2CAP: do not leave dangling sk pointer on error in
+      l2cap_sock_create()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56606
+    - af_packet: avoid erroring out after sock_init_data() in packet_create()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47809
+    - dlm: fix possible lkb_resource null dereference
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48873
+    - wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
+
+  * Missing support for USB-C Apple Magic Trackpad (LP: #2098063) // Noble
+    update: upstream stable patchset 2025-03-12 (LP: #2102118)
+    - HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56787
+    - soc: imx8m: Probe the SoC driver as platform driver
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56610
+    - kcsan: Turn report_filterlist_lock into a raw_spinlock
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48875
+    - btrfs: don't take dev_replace rwsem on task already holding it
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57849
+    - s390/cpum_sf: Handle CPU hotplug remove during sampling
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57876
+    - drm/dp_mst: Fix resetting msg rx state after topology removal
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56616
+    - drm/dp_mst: Fix MST sideband message body length check
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48881
+    - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56619
+    - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56622
+    - scsi: ufs: core: sysfs: Prevent div by zero
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56623
+    - scsi: qla2xxx: Fix use after free on unload
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57874
+    - arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56625
+    - can: dev: can_set_termination(): allow sleeping GPIOs
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56626
+    - ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56628
+    - LoongArch: Add architecture specific huge_pte_clear()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56629
+    - HID: wacom: fix when get product name maybe null pointer
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56630
+    - ocfs2: free inode when ocfs2_get_init_inode() fails
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56631
+    - scsi: sg: Fix slab-use-after-free read in sg_release()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-50051
+    - spi: mpc52xx: Add cancel_work_sync before module remove
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56633
+    - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56565
+    - f2fs: fix to drop all discards after creating snapshot on lvm device
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56634
+    - gpio: grgpio: Add NULL check in grgpio_probe
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56635
+    - net: avoid potential UAF in default_operstate()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56636
+    - geneve: do not assume mac header is set in geneve_xmit_skb()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56637
+    - netfilter: ipset: Hold module reference while requesting a module
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56638
+    - netfilter: nft_inner: incorrect percpu area handling under softirq
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-52332
+    - igb: Fix potential invalid memory access in igb_init_module()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56640
+    - net/smc: fix LGR and link use-after-free issue
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56641
+    - net/smc: initialize close_work early to avoid warning
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56643
+    - dccp: Fix memory leak in dccp_feat_change_recv
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56644
+    - net/ipv6: release expired exception dst cached in socket
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56645
+    - can: j1939: j1939_session_new(): fix skb reference counting
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56648
+    - net: hsr: avoid potential out-of-bound access in fill_frame_info()
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56649
+    - net: enetc: Do not configure preemptible TCs if SIs do not support
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56783
+    - netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
+
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56650
+    - netfilter: x_tables: fix LED ID check in led_tg_check()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915)
+    - wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings
+    - ASoC: codecs: rt5640: Always disable IRQs from rt5640_cancel_work()
+    - ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec
+    - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
+    - ASoC: Intel: sst: Support LPE0F28 ACPI HID
+    - wifi: iwlwifi: mvm: Use the sync timepoint API in suspend
+    - mac80211: fix user-power when emulating chanctx
+    - usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver
+    - selftests/watchdog-test: Fix system accidentally reset after watchdog-test
+    - ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
+    - x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
+    - bpf: fix filed access without lock
+    - net: usb: qmi_wwan: add Quectel RG650V
+    - soc: qcom: Add check devm_kasprintf() returned value
+    - firmware: arm_scmi: Reject clear channel request on A2P
+    - regulator: rk808: Add apply_bit for BUCK3 on RK809
+    - platform/x86: dell-smbios-base: Extends support to Alienware products
+    - platform/x86: dell-wmi-base: Handle META key Lock/Unlock events
+    - ASoC: tas2781: Add new driver version for tas2563 & tas2781 qfn chip
+    - tools/lib/thermal: Remove the thermal.h soft link when doing make clean
+    - can: j1939: fix error in J1939 documentation.
+    - platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect
+      fan speed
+    - ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6
+    - ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
+    - ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
+    - drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less
+      strict
+    - proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
+    - ASoC: audio-graph-card2: Purge absent supplies for device tree nodes
+    - LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS
+    - ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
+    - ARM: 9420/1: smp: Fix SMP for xip kernels
+    - ipmr: Fix access to mfc_cache_list without lock held
+    - mptcp: fix possible integer overflow in mptcp_reset_tout_timer
+    - arm64: probes: Disable kprobes/uprobes on MOPS instructions
+    - kselftest/arm64: mte: fix printf type warnings about __u64
+    - kselftest/arm64: mte: fix printf type warnings about longs
+    - s390/cio: Do not unregister the subchannel based on DNV
+    - s390/pageattr: Implement missing kernel_page_present()
+    - ext4: avoid remount errors with 'abort' mount option
+    - mips: asm: fix warning when disabling MIPS_FP_SUPPORT
+    - m68k: mvme147: Fix SCSI controller IRQ numbers
+    - m68k: mvme147: Reinstate early console
+    - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
+    - acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
+    - cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter()
+    - block: fix bio_split_rw_at to take zone_write_granularity into account
+    - s390/syscalls: Avoid creation of arch/arch/ directory
+    - ext4: remove calls to to set/clear the folio error flag
+    - ext4: pipeline buffer reads in mext_page_mkuptodate()
+    - ext4: remove array of buffer_heads from mext_page_mkuptodate()
+    - ext4: fix race in buffer_head read fault injection
+    - nvme-pci: reverse request order in nvme_queue_rqs
+    - virtio_blk: reverse request order in virtio_queue_rqs
+    - crypto: qat - remove check after debugfs_create_dir()
+    - firmware: google: Unregister driver_info on failure
+    - crypto: qat - remove faulty arbiter config reset
+    - thermal: core: Initialize thermal zones before registering them
+    - EDAC/fsl_ddr: Fix bad bit shift operations
+    - EDAC/skx_common: Differentiate memory error sources
+    - EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator
+    - crypto: cavium - Fix the if condition to exit loop after timeout
+    - amd-pstate: Set min_perf to nominal_perf for active mode performance gov
+    - crypto: hisilicon/qm - disable same error report before resetting
+    - crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init()
+    - doc: rcu: update printed dynticks counter bits
+    - hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK
+    - hwmon: (pmbus/core) clear faults after setting smbalert mask
+    - hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
+    - ACPI: CPPC: Fix _CPC register setting issue
+    - crypto: caam - add error check to caam_rsa_set_priv_key_form
+    - crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
+    - rcuscale: Do a proper cleanup if kfree_scale_init() fails
+    - tools/lib/thermal: Make more generic the command encoding function
+    - thermal/lib: Fix memory leak on error in thermal_genl_auto()
+    - x86/unwind/orc: Fix unwind for newly forked tasks
+    - time: Partially revert cleanup on msecs_to_jiffies() documentation
+    - time: Fix references to _msecs_to_jiffies() handling of values
+    - kcsan, seqlock: Support seqcount_latch_t
+    - kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
+    - clocksource/drivers:sp804: Make user selectable
+    - clocksource/drivers/timer-ti-dm: Fix child node refcount handling
+    - spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
+    - microblaze: Export xmb_manager functions
+    - arm64: dts: mt8195: Fix dtbs_check error for mutex node
+    - arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node
+    - soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
+    - arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins
+    - ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode
+    - mmc: mmc_spi: drop buggy snprintf()
+    - openrisc: Implement fixmap to fix earlycon
+    - efi/libstub: fix efi_parse_options() ignoring the default command line
+    - tpm: fix signed/unsigned bug when checking event logs
+    - media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call
+    - arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
+    - arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
+    - arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source
+      trackpad
+    - Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
+    - cgroup/bpf: only cgroup v2 can be attached by bpf programs
+    - regulator: rk808: Restrict DVS GPIOs to the RK808 variant only
+    - arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns
+    - arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns
+    - arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns
+    - arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns
+    - pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
+    - ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
+    - arm64: dts: ti: k3-j7200: use ti,j7200-padconf compatible
+    - arm64: dts: ti: k3-j7200: Fix register map for main domain pmx
+    - arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances
+    - arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances
+    - arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances
+    - um: Unconditionally call unflatten_device_tree()
+    - x86/of: Unconditionally call unflatten_and_copy_device_tree()
+    - of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify
+    - riscv: Fix wrong usage of __pa() on a fixmap address
+    - pmdomain: ti-sci: Add missing of_node_put() for args.np
+    - spi: tegra210-quad: Avoid shift-out-of-bounds
+    - spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time​
+    - regmap: irq: Set lockdep class for hierarchical IRQ domains
+    - arm64: dts: renesas: hihope: Drop #sound-dai-cells
+    - arm64: dts: mediatek: Add ADC node on MT6357, MT6358, MT6359 PMICs
+    - arm64: dts: mediatek: mt6358: fix dtbs_check error
+    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names
+    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed
+      regulators
+    - selftests/resctrl: Split fill_buf to allow tests finer-grained control
+    - selftests/resctrl: Refactor fill_buf functions
+    - selftests/resctrl: Fix memory overflow due to unhandled wraparound
+    - selftests/resctrl: Protect against array overrun during iMC config parsing
+    - arm64: dts: rockchip: correct analog audio name on Indiedroid Nova
+    - platform/x86: panasonic-laptop: Return errno correctly in show callback
+    - drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
+    - drm/vc4: hvs: Don't write gamma luts on 2711
+    - drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer
+    - drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function
+    - drm/vc4: hvs: Correct logic on stopping an HVS channel
+    - drm/omap: Fix possible NULL dereference
+    - drm/omap: Fix locking in omap_gem_new_dmabuf()
+    - wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
+    - wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/v3d: Address race-condition in MMU flush
+    - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
+    - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
+    - dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
+    - ASoC: fsl_micfil: fix regmap_write_bits usage
+    - ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
+    - drm/bridge: anx7625: Drop EDID cache on bridge power off
+    - drm/bridge: it6505: Drop EDID cache on bridge power off
+    - libbpf: Fix expected_attach_type set handling in program load callback
+    - libbpf: Fix output .symtab byte-order during linking
+    - bpf: Fix the xdp_adjust_tail sample prog issue
+    - wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR
+    - ice: consistently use q_idx in ice_vc_cfg_qs_msg()
+    - drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush
+    - libbpf: fix sym_is_subprog() logic for weak global subprogs
+    - ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c
+    - libbpf: never interpret subprogs in .text as entry programs
+    - netdevsim: copy addresses for both in and out paths
+    - drm/bridge: tc358767: Fix link properties discovery
+    - selftests/bpf: Fix msg_verify_data in test_sockmap
+    - selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
+    - drm: fsl-dcu: enable PIXCLK on LS1021A
+    - drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
+    - drm/msm/dpu: drop LM_3 / LM_4 on SDM845
+    - drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
+    - selftests/bpf: fix test_spin_lock_fail.c's global vars usage
+    - drm/panfrost: Remove unused id_mask from struct panfrost_model
+    - bpf, arm64: Remove garbage frame for struct_ops trampoline
+    - drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/msm/gpu: Check the status of registration to PM QoS
+    - drm/etnaviv: Request pages from DMA32 zone on addressing_limited
+    - drm/etnaviv: hold GPU lock across perfmon sampling
+    - wifi: wfx: Fix error handling in wfx_core_init()
+    - drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
+    - bpf, bpftool: Fix incorrect disasm pc
+    - drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
+    - drm: use ATOMIC64_INIT() for atomic64_t
+    - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion
+    - netfilter: nf_tables: must hold rcu read lock while iterating expression
+      type list
+    - netfilter: nf_tables: skip transaction if update object is not implemented
+    - netfilter: nf_tables: must hold rcu read lock while iterating object type
+      list
+    - netlink: typographical error in nlmsg_type constants definition
+    - selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
+    - selftests/bpf: Fix SENDPAGE data logic in test_sockmap
+    - selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
+    - selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
+    - bpf, sockmap: Several fixes to bpf_msg_push_data
+    - bpf, sockmap: Fix sk_msg_reset_curr
+    - sock_diag: add module pointer to "struct sock_diag_handler"
+    - sock_diag: allow concurrent operations
+    - sock_diag: allow concurrent operation in sock_diag_rcv_msg()
+    - net: use unrcu_pointer() helper
+    - selftests: net: really check for bg process completion
+    - drm/amdkfd: Fix wrong usage of INIT_WORK()
+    - bpf: Force uprobe bpf program to always return 0
+    - net: rfkill: gpio: Add check for clk_enable()
+    - netpoll: Use rcu_access_pointer() in netpoll_poll_lock
+    - wireguard: selftests: load nf_conntrack if not present
+    - cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged
+    - clk: mediatek: drop two dead config options
+    - [Config] drop COMMON_CLK_MT8195_AUDSYS and COMMON_CLK_MT8195_MSDC
+    - trace/trace_event_perf: remove duplicate samples on the first tracepoint
+      event
+    - pinctrl: zynqmp: drop excess struct member description
+    - scsi: hisi_sas: Enable all PHYs that are not disabled by user during
+      controller reset
+    - mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
+    - mfd: da9052-spi: Change read-mask to write-mask
+    - cpufreq: loongson2: Unregister platform_driver on failure
+    - powerpc/fadump: Refactor and prepare fadump_cma_init for late init
+    - mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE
+    - mtd: rawnand: atmel: Fix possible memory leak
+    - mtd: rawnand: fix double free in atmel_pmecc_create_user()
+    - mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in
+      RD_ANY_REG_OP
+    - RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci
+    - RDMA/hns: Use dev_* printings in hem code instead of ibdev_*
+    - RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
+    - clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset
+    - clk: renesas: rzg2l: Fix FOUTPOSTDIV clk
+    - RDMA/rxe: Set queue pair cur_qp_state when being queried
+    - RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation
+    - clk: imx: lpcg-scu: SW workaround for errata (e10858)
+    - clk: imx: fracn-gppll: correct PLL initialization flow
+    - clk: imx: fracn-gppll: fix pll power up
+    - clk: imx: clk-scu: fix clk enable state save and restore
+    - clk: imx: imx8-acm: Fix return value check in
+      clk_imx_acm_attach_pm_domains()
+    - iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes()
+    - iommu/vt-d: Fix checks and print in pgtable_walk()
+    - checkpatch: check for missing Fixes tags
+    - checkpatch: always parse orig_commit in fixes tag
+    - mfd: rt5033: Fix missing regmap_del_irq_chip()
+    - fs/proc/kcore.c: fix coccinelle reported ERROR instances
+    - scsi: fusion: Remove unused variable 'rc'
+    - scsi: sg: Enable runtime power management
+    - x86/tdx: Introduce wrappers to read and write TD metadata
+    - x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup()
+    - x86/tdx: Dynamically disable SEPT violations from causing #VEs
+    - RDMA/hns: Fix out-of-order issue of requester when setting FENCE
+    - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()
+    - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()
+    - dax: delete a stale directory pmem
+    - KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests
+    - KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending
+      doorbells
+    - powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
+    - powerpc/kexec: Fix return of uninitialized variable
+    - IB/mlx5: Allocate resources just before first QP/SRQ is created
+    - clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
+    - clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC RT3883
+    - dt-bindings: clock: axi-clkgen: include AXI clk
+    - clk: clk-axi-clkgen: make sure to enable the AXI bus clock
+    - arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw
+    - pinctrl: k210: Undef K210_PC_DEFAULT
+    - smb: cached directories can be more than root file handle
+    - mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()
+    - perf cs-etm: Don't flush when packet_queue fills up
+    - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw
+    - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async
+    - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE
+    - gfs2: Allow immediate GLF_VERIFY_DELETE work
+    - gfs2: Fix unlinked inode cleanup
+    - perf stat: Close cork_fd when create_perf_stat_counter() failed
+    - perf stat: Fix affinity memory leaks on error path
+    - perf trace: Keep exited threads for summary
+    - perf test attr: Add back missing topdown events
+    - f2fs: compress: fix inconsistent update of i_blocks in
+      release_compress_blocks and reserve_compress_blocks
+    - perf probe: Fix libdw memory leak
+    - perf probe: Correct demangled symbols in C++ program
+    - rust: macros: fix documentation of the paste! macro
+    - PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
+    - PCI: cpqphp: Fix PCIBIOS_* return value confusion
+    - perf ftrace latency: Fix unit on histogram first entry when using --use-nsec
+    - f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
+    - f2fs: check curseg->inited before write_sum_page in change_curseg
+    - f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or
+      GC_URGENT_MID
+    - PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup()
+    - PCI: cadence: Set cdns_pcie_host_init() global
+    - PCI: j721e: Add reset GPIO to struct j721e_pcie
+    - PCI: j721e: Use T_PERST_CLK_US macro
+    - PCI: j721e: Add suspend and resume support
+    - PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds
+    - f2fs: fix to avoid forcing direct write to use buffered IO on inline_data
+      inode
+    - perf trace: avoid garbage when not printing a trace event's arguments
+    - m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
+    - m68k: coldfire/device.c: only build FEC when HW macros are defined
+    - perf list: Fix topic and pmu_name argument order
+    - perf trace: Fix tracing itself, creating feedback loops
+    - perf trace: Do not lose last events in a race
+    - perf trace: Avoid garbage when not printing a syscall's arguments
+    - remoteproc: qcom: pas: add minidump_id to SM8350 resources
+    - rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
+    - remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
+    - nfsd: restore callback functionality for NFSv4.0
+    - NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
+    - NFSD: Fix nfsd4_shutdown_copy()
+    - hwmon: (tps23861) Fix reporting of negative temperatures
+    - vdpa/mlx5: Fix suboptimal range on iotlb iteration
+    - selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels
+    - gpio: zevio: Add missed label initialisation
+    - fs_parser: update mount_api doc to match function signature
+    - LoongArch: Fix build failure with GCC 15 (-std=gnu23)
+    - LoongArch: BPF: Sign-extend return values
+    - power: supply: core: Remove might_sleep() from power_supply_put()
+    - power: supply: bq27xxx: Fix registers of bq27426
+    - power: supply: rt9471: Fix wrong WDT function regfield declaration
+    - power: supply: rt9471: Use IC status regfield to report real charger status
+    - net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
+    - tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
+    - net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL
+      configuration
+    - net: microchip: vcap: Add typegroup table terminators in kunit tests
+    - net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged
+    - net: mdio-ipq4019: add missing error check
+    - marvell: pxa168_eth: fix call balance of pep->clk handling routines
+    - net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
+    - octeontx2-af: RPM: Fix mismatch in lmac type
+    - octeontx2-af: RPM: Fix low network performance
+    - octeontx2-pf: Reset MAC stats during probe
+    - octeontx2-af: RPM: fix stale RSFEC counters
+    - octeontx2-af: RPM: fix stale FCFEC counters
+    - octeontx2-af: Quiesce traffic before NIX block reset
+    - spi: atmel-quadspi: Fix register name in verbose logging function
+    - net: hsr: fix hsr_init_sk() vs network/transport headers.
+    - bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
+    - bnxt_en: Refactor bnxt_ptp_init()
+    - bnxt_en: Unregister PTP during PCI shutdown and suspend
+    - llc: Improve setsockopt() handling of malformed user input
+    - rxrpc: Improve setsockopt() handling of malformed user input
+    - tcp: Fix use-after-free of nreq in reqsk_timer_handler().
+    - ip6mr: fix tables suspicious RCU usage
+    - ipmr: fix tables suspicious RCU usage
+    - iio: light: al3010: Fix an error handling path in al3010_probe()
+    - usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
+    - usb: yurex: make waiting on yurex_write interruptible
+    - USB: chaoskey: fail open after removal
+    - USB: chaoskey: Fix possible deadlock chaoskey_list_lock
+    - misc: apds990x: Fix missing pm_runtime_disable()
+    - counter: stm32-timer-cnt: Add check for clk_enable()
+    - counter: ti-ecap-capture: Add check for clk_enable()
+    - ALSA: hda/realtek: Update ALC256 depop procedure
+    - drm/radeon: add helper rdev_to_drm(rdev)
+    - drm/radeon: change rdev->ddev to rdev_to_drm(rdev)
+    - drm/radeon: Fix spurious unplug event on radeon HDMI
+    - apparmor: fix 'Do simple duplicate message elimination'
+    - ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry
+    - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru
+    - gfs2: Remove and replace gfs2_glock_queue_work
+    - f2fs: fix fiemap failure issue when page size is 16KB
+    - usb: ehci-spear: fix call balance of sehci clk handling routines
+    - ALSA: usb-audio: Fix a DMA to stack memory bug
+    - ASoC: Intel: sst: Fix used of uninitialized ctx to log an error
+    - soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
+    - ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
+    - ext4: fix FS_IOC_GETFSMAP handling
+    - jfs: xattr: check invalid xattr size more strictly
+    - ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5
+      21MES00B00
+    - ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
+    - perf/x86/intel/pt: Fix buffer full but size is 0 case
+    - crypto: x86/aegis128 - access 32-bit arguments as 32-bit
+    - KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE
+    - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector
+    - KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR
+    - KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
+    - KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
+    - KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
+    - KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
+    - fsnotify: fix sending inotify event with unexpected filename
+    - tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
+    - locking/lockdep: Avoid creating new name string literals in
+      lockdep_set_subclass()
+    - tools/nolibc: s390: include std.h
+    - pinctrl: qcom: spmi: fix debugfs drive strength
+    - dt-bindings: iio: dac: ad3552r: fix maximum spi speed
+    - exfat: fix uninit-value in __exfat_get_dentry_set
+    - Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
+    - Compiler Attributes: disable __counted_by for clang < 19.1.3
+    - usb: xhci: Fix TD invalidation under pending Set TR Dequeue
+    - ARM: dts: omap36xx: declare 1GHz OPP as turbo again
+    - wifi: brcmfmac: release 'root' node in all execution paths
+    - Revert "usb: gadget: composite: fix OS descriptors w_value logic"
+    - gpio: exar: set value when external pull-up or pull-down is present
+    - spi: Fix acpi deferred irq probe
+    - cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power()
+    - cifs: support mounting with alternate password to allow password rotation
+    - parisc/ftrace: Fix function graph tracing disablement
+    - platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
+    - ubi: wl: Put source PEB into correct list if trying locking LEB failed
+    - dt-bindings: serial: rs485: Fix rs485-rts-delay property
+    - serial: 8250_fintek: Add support for F81216E
+    - serial: 8250: omap: Move pm_runtime_get_sync
+    - iio: gts: Fix uninitialized symbol 'ret'
+    - ublk: fix ublk_ch_mmap() for 64K page size
+    - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
+    - block: fix missing dispatching request when queue is started or unquiesced
+    - block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding
+    - block: fix ordering between checking BLK_MQ_S_STOPPED request adding
+    - blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long
+    - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
+    - soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting()
+    - media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
+    - ALSA: ump: Fix evaluation of MIDI 1.0 FB info
+    - ALSA: hda/realtek: Update ALC225 depop procedure
+    - ALSA: hda/realtek: Fixup ALC225 depop procedure
+    - ALSA: hda/realtek: Set PCBeep to default value for ALC274
+    - ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
+    - ALSA: hda/realtek: Apply quirk for Medion E15433
+    - smb3: request handle caching when caching directories
+    - smb: client: handle max length for SMB symlinks
+    - cifs: Add tracing for the cifs_tcon struct refcounting
+    - usb: dwc3: gadget: Fix checking for number of TRBs left
+    - ublk: fix error code for unsupported command
+    - lib: string_helpers: silence snprintf() output truncation warning
+    - um: Fix the return value of elf_core_copy_task_fpregs
+    - um: Always dump trace for specified task in show_stack
+    - rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
+    - rtc: abx80x: Fix WDT bit position of the status register
+    - ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
+    - ubifs: Correct the total block count by deducting journal reservation
+    - jffs2: fix use of uninitialized variable
+    - rtc: rzn1: fix BCD to rtc_time conversion errors
+    - nvme-multipath: prepare for "queue-depth" iopolicy
+    - nvme-multipath: implement "queue-depth" iopolicy
+    - nvme-multipath: avoid hang on inaccessible namespaces
+    - nvme/multipath: Fix RCU list traversal to use SRCU primitive
+    - block: return unsigned int from bdev_io_min
+    - 9p/xen: fix init sequence
+    - perf/arm-smmuv3: Fix lockdep assert in ->event_init()
+    - perf/arm-cmn: Ensure port and device id bits are set properly
+    - smb: client: disable directory caching when dir_cache_timeout is zero
+    - cifs: Fix parsing native symlinks relative to the export
+    - cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE
+      session
+    - rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
+    - init/modpost: conditionally check section mismatch to __meminit*
+    - Rename .data.unlikely to .data..unlikely
+    - Rename .data.once to .data..once to fix resetting WARN*_ONCE
+    - modpost: remove incorrect code in do_eisa_entry()
+    - cifs: during remount, make sure passwords are in sync
+    - cifs: unlock on error in smb3_reconfigure()
+    - nfs: ignore SB_RDONLY when mounting nfs
+    - SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT
+    - xfs: remove unknown compat feature check in superblock write validation
+    - btrfs: don't loop for nowait writes when checking for cross references
+    - md/md-bitmap: Add missing destroy_work_on_stack()
+    - arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
+    - arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
+    - arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
+    - media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
+    - media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
+    - media: verisilicon: av1: Fix reference video buffer pointer assignment
+    - media: platform: exynos4-is: Fix an OF node reference leak in
+      fimc_md_is_isp_available
+    - media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
+    - media: uvcvideo: Stop stream during unregister
+    - maple_tree: refine mas_store_root() on storing NULL
+    - vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
+    - zram: clear IDLE flag after recompression
+    - iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
+    - leds: lp55xx: Remove redundant test for invalid channel number
+    - clk: qcom: gcc-qcs404: fix initial rate of GPLL3
+    - ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow
+    - ARM: 9430/1: entry: Do a dummy read from VMAP shadow
+    - ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()
+    - ceph: extract entity name from device id
+    - util_macros.h: fix/rework find_closest() macros
+    - scsi: ufs: exynos: Fix hibern8 notify callbacks
+    - i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible
+    - PCI: keystone: Add link up check to ks_pcie_other_map_bus()
+    - PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf()
+    - fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful
+      iov_iter_zero
+    - thermal: int3400: Fix reading of current_uuid for active policy
+    - leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error
+      paths
+    - ovl: properly handle large files in ovl_security_fileattr
+    - dm: Fix typo in error message
+    - dm thin: Add missing destroy_work_on_stack()
+    - PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes
+    - PCI: rockchip-ep: Fix address translation unit programming
+    - iio: accel: kx022a: Fix raw read format
+    - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
+    - iio: gts: fix infinite loop for gain_to_scaletables()
+    - powerpc: Fix stack protector Kconfig test for clang
+    - powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang
+    - udmabuf: use vmf_insert_pfn and VM_PFNMAP for handling mmap
+    - drm/mediatek: Fix child node refcount handling in early exit
+    - drm/etnaviv: flush shader L1 cache after user commandstream
+    - drm: xlnx: zynqmp_dpsub: fix hotplug detection
+    - drm/amdkfd: Use the correct wptr size
+    - drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu
+      v13.0.7
+    - posix-timers: Target group sigqueue to current task only if not exiting
+    - wifi: cfg80211: Add wiphy_delayed_work_pending()
+    - wifi: mac80211: Convert color collision detection to wiphy work
+    - spi: stm32: fix missing device mode capability in stm32mp25
+    - usb: typec: use cleanup facility for 'altmodes_node'
+    - platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys
+    - integrity: Avoid -Wflex-array-member-not-at-end warnings
+    - integrity: Use static_assert() to check struct sizes
+    - ASoC: max9768: Fix event generation for playback mute
+    - ARM: 9434/1: cfi: Fix compilation corner case
+    - drm/amd/display: Skip Invalid Streams from DSC Policy
+    - drm/amd/display: Fix DSC-re-computing
+    - drm/amd/display: Fix incorrect DSC recompute trigger
+    - s390/facilities: Fix warning about shadow of global variable
+    - cachefiles: Fix incorrect length return value in
+      cachefiles_ondemand_fd_write_iter()
+    - thermal: core: Drop thermal_zone_device_is_enabled()
+    - thermal: core: Synchronize suspend-prepare and post-suspend actions
+    - thermal: core: Rearrange PM notification code
+    - thermal: core: Represent suspend-related thermal zone flags as bits
+    - thermal: core: Mark thermal zones as initializing to start with
+    - thermal: core: Fix race between zone registration and system suspend
+    - crypto: qat - Fix missing destroy_workqueue in adf_init_aer()
+    - sched/cpufreq: Ensure sd is rebuilt for EAS check
+    - cleanup: Remove address space of returned pointer
+    - ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash
+    - arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy
+    - scripts/kernel-doc: Do not track section counter across processed files
+    - arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region
+    - scripts/kernel-doc: add modeline for vim users
+    - scripts/kernel-doc: simplify function printing
+    - scripts/kernel-doc: separate out function signature
+    - scripts/kernel-doc: simplify signature printing
+    - doc: kerneldoc.py: fix indentation
+    - kernel-doc: allow object-like macros in ReST output
+    - arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status
+    - arm64: dts: rockchip: Remove 'enable-active-low' from two boards
+    - arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers
+    - dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries
+    - pwm: Assume a disabled PWM to emit a constant inactive output
+    - drm/imagination: Convert to use time_before macro
+    - drm/imagination: Use pvr_vm_context_get()
+    - drm/v3d: Flush the MMU before we supply more memory to the binner
+    - drm/amdgpu: Fix JPEG v4.0.3 register write
+    - ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios
+    - wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled
+    - selftests/bpf: netns_new() and netns_free() helpers.
+    - selftests/bpf: Fix backtrace printing for selftests crashes
+    - selftests/bpf: add missing header include for htons
+    - drm/vc4: hdmi: Increase audio MAI fifo dreq threshold
+    - drm/vc4: Introduce generation number enum
+    - drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load
+    - drm/vc4: Correct generation check in vc4_hvs_lut_load
+    - bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable
+    - drm/panfrost: Add missing OPP table refcnt decremental
+    - selftests: netfilter: Fix missing return values in conntrack_dump_flush
+    - Bluetooth: btintel: Do no pass vendor events to stack
+    - Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name()
+    - Bluetooth: ISO: Use kref to track lifetime of iso_conn
+    - Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending
+    - Bluetooth: hci_conn: Use __counted_by() to avoid -Wfamnae warning
+    - Bluetooth: hci_conn: Use struct_size() in hci_le_big_create_sync()
+    - Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending
+    - Bluetooth: ISO: Send BIG Create Sync via hci_sync
+    - Bluetooth: iso: Fix circular lock in iso_conn_big_sync
+    - net: txgbe: remove GPIO interrupt controller
+    - net: txgbe: fix null pointer to pcs
+    - RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages
+    - RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset
+    - iommu/amd: Remove amd_iommu_domain_update() from page table freeing
+    - iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB
+    - RDMA/hns: Fix flush cqe error when racing with destroy qp
+    - RDMA/hns: Modify debugfs name
+    - leds: max5970: Fix unreleased fwnode_handle in probe function
+    - kasan: move checks to do_strncpy_from_user
+    - kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL
+    - RDMA/hns: Fix different dgids mapping to the same dip_idx
+    - RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
+    - rust: kernel: add srctree-relative doclinks
+    - rust: kernel: fix THIS_MODULE header path in ThisModule doc comment
+    - i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin
+    - remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe()
+    - remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe()
+    - nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
+    - f2fs: clean up val{>>,<<}F2FS_BLKSIZE_BITS
+    - f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow
+    - vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data()
+    - exfat: fix file being changed by unaligned direct write
+    - bnxt_en: Set backplane link modes correctly for ethtool
+    - devres: Fix page faults when tracing devres from unloaded modules
+    - usb: gadget: uvc: wake pump everytime we update the free list
+    - drm/xe/ufence: Wake up waiters after setting ufence->signalled
+    - net_sched: sch_fq: don't follow the fast path if Tx is behind now
+    - ASoC: da7213: Populate max_register to regmap_config
+    - KVM: x86: switch hugepage recovery thread to vhost_task
+    - kvm: defer huge page recovery vhost task to later
+    - KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking
+    - KVM: arm64: Change kvm_handle_mmio_return() return polarity
+    - dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with
+      fallbacks
+    - xhci: Fix control transfer error on Etron xHCI host
+    - xhci: Combine two if statements for Etron xHCI host
+    - xhci: Don't perform Soft Retry for Etron xHCI host
+    - xhci: Don't issue Reset Device command to Etron xHCI host
+    - mtd: spi-nor: core: replace dummy buswidth from addr to data
+    - Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
+    - RISC-V: Scalar unaligned access emulated on hotplug CPUs
+    - serial: amba-pl011: Fix RX stall when DMA is used
+    - serial: amba-pl011: fix build regression
+    - i40e: Fix handling changed priv flags
+    - netdev-genl: Hold rcu_read_lock in napi_get
+    - usb: misc: ljca: set small runtime autosuspend delay
+    - usb: misc: ljca: move usb_autopm_put_interface() after wait for response
+    - blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs
+    - block: model freeze & enter queue as lock for supporting lockdep
+    - block: always verify unfreeze lock on the owner task
+    - x86/Documentation: Update algo in init_size description of boot protocol
+    - kbuild: deb-pkg: Don't fail if modules.order is missing
+    - tools/power turbostat: Fix trailing '\n' parsing
+    - block: don't verify IO lock for freeze/unfreeze in elevator_init_mq()
+    - zram: permit only one post-processing operation at a time
+    - perf jevents: Don't stop at the first matched pmu when searching a events
+      table
+    - docs: media: update location of the media patches
+    - Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of
+      setup_vmcs_config()"
+    - soc: fsl: cpm1: qmc: Fix blank line and spaces
+    - soc: fsl: cpm1: qmc: Re-order probe() operations
+    - soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version
+    - soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version
+    - soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure
+    - x86/mm: Carve out INVLPG inline asm for use by others
+    - ALSA: hda/realtek: Enable mic on Vaio VJFH52
+    - ALSA: hda/realtek: Enable speaker pins for Medion E15443 platform
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i
+    - usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing
+      logic
+    - sched: Initialize idle tasks only once
+    - Upstream stable to v6.6.64, v6.11.11, v6.12.1, v6.12.2, v6.12.3
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53222
+    - zram: fix NULL pointer in comp_algorithm_show()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53169
+    - nvme-fabrics: fix kernel crash while shutting down controller
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56721
+    - x86/CPU/AMD: Terminate the erratum_1386_microcode array
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53187
+    - io_uring: check for overflows in io_pin_pages
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53147
+    - exfat: fix out-of-bounds access of directory entries
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53196
+    - KVM: arm64: Don't retire aborted MMIO instruction
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56685
+    - ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53201
+    - drm/amd/display: Fix null check for pipe_ctx->plane_state in
+      dcn20_program_pipe
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53203
+    - usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53209
+    - bnxt_en: Fix receive ring space parameters when XDP is active
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56742
+    - vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53216
+    - nfsd: release svc_expkey/svc_export with rcu_work
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53219
+    - virtiofs: use pages instead of pointer for kernel direct IO
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53221
+    - f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53228
+    - riscv: kvm: Fix out-of-bounds array access
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53232
+    - iommu/s390: Implement blocking domain
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53236
+    - xsk: Free skb when TX metadata options are invalid
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56703
+    - ipv6: Fix soft lockups in fib6_select_path under high next hop churn
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56540
+    - accel/ivpu: Prevent recovery invocation during probe and resume
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53163
+    - crypto: qat/qat_420xx - fix off by one in uof_get_name()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56755
+    - netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56549
+    - cachefiles: Fix NULL pointer dereference in object->file
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56551
+    - drm/amdgpu: fix usage slab after free
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56776
+    - drm/sti: avoid potential dereference of error pointers
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56777
+    - drm/sti: avoid potential dereference of error pointers in
+      sti_gdp_atomic_check
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56778
+    - drm/sti: avoid potential dereference of error pointers in
+      sti_hqvdp_atomic_check
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56557
+    - iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56779
+    - nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56558
+    - nfsd: make sure exp active before svc_export_show
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56562
+    - i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56566
+    - mm/slub: Avoid list corruption when removing a slab from the full list
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-57838
+    - s390/entry: Mark IRQ entries to fix stack depot warnings
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56567
+    - ad7780: fix division by zero in ad7780_write_raw()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56569
+    - ftrace: Fix regression with module command in stack_trace_filter
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56570
+    - ovl: Filter invalid inodes with missing lookup function
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56572
+    - media: platform: allegro-dvt: Fix possible memory leak in
+      allocate_buffers_internal()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56573
+    - efi/libstub: Free correct pointer on failure
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56574
+    - media: ts2020: fix null-ptr-deref in ts2020_probe()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56575
+    - media: imx-jpeg: Ensure power suppliers be suspended before detach them
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56576
+    - media: i2c: tc358743: Fix crash in the probe error path when using polling
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56577
+    - media: mtk-jpeg: Fix null-ptr-deref during unload module
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56578
+    - media: imx-jpeg: Set video drvdata before register video device
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56579
+    - media: amphion: Set video drvdata before register video device
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56581
+    - btrfs: ref-verify: fix use-after-free after invalid ref action
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56774
+    - btrfs: add a sanity check for btrfs root in btrfs_search_slot()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56780
+    - quota: flush quota_release_work upon quota writeback
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53168
+    - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56688
+    - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56729
+    - smb: Initialize cfid->tcon before performing network ops
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56704
+    - 9p/xen: fix release of IRQ
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53171
+    - ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53172
+    - ubi: fastmap: Fix duplicate slab cache names while attaching
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56739
+    - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53173
+    - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53145
+    - um: Fix potential integer overflow during physmem setup
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53174
+    - SUNRPC: make sure cache entry active before cache_show
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53146
+    - NFSD: Prevent a potential integer overflow
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53175
+    - ipc: fix memleak if msg_init_ns failed in create_ipc_ns
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56692
+    - f2fs: fix to do sanity check on node blkaddr in truncate_node()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56698
+    - usb: dwc3: gadget: Fix looping of queued SG entries
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56687
+    - usb: musb: Fix hardware lockup on first Rx endpoint request
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53176
+    - smb: During unmount, ensure all cached dir instances drop their dentry
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53177
+    - smb: prevent use-after-free due to open_cached_dir error paths
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53178
+    - smb: Don't leak cfid when reconnect races with open_cached_dir
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53180
+    - ALSA: pcm: Add sanity NULL check for the default mmap fault handler
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56700
+    - media: wl128x: Fix atomicity violation in fmc_send_cmd()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2022-49034
+    - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53181
+    - um: vector: Do not use drvdata in release
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53183
+    - um: net: Do not use drvdata in release
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53184
+    - um: ubd: Do not use drvdata in release
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53185
+    - smb: client: fix NULL ptr deref in crypto_aead_setkey()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53188
+    - wifi: ath12k: fix crash when unbinding
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53190
+    - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of
+      failures
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53191
+    - wifi: ath12k: fix warning when unbinding
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56741
+    - apparmor: test: Fix memory leak for aa_unpack_strdup()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53148
+    - comedi: Flush partial mappings in error case
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53194
+    - PCI: Fix use-after-free of slot->bus on hot remove
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53195
+    - KVM: arm64: Get rid of userspace_irqchip_in_use
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53197
+    - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox
+      devices
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-42122
+    - drm/amd/display: Add NULL pointer check for kzalloc
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-49906
+    - drm/amd/display: Check null pointer before try to access it
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53150
+    - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53198
+    - xen: Fix the issue of resource not being properly released in
+      xenbus_dev_probe()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-41014
+    - xfs: add bounds checking to xlog_recover_process_data
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53200
+    - drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53202
+    - firmware_loader: Fix possible resource leak in fw_log_firmware_info()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53208
+    - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53210
+    - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53213
+    - net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53214
+    - vfio/pci: Properly hide first-in-list PCIe extended capability
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53215
+    - svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53217
+    - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56689
+    - PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio'
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53151
+    - svcrdma: Address an integer overflow
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53218
+    - f2fs: fix race in concurrent f2fs_stop_gc_thread
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56744
+    - f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53220
+    - f2fs: fix to account dirty data in __get_secs_required()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56745
+    - PCI: Fix reset_method_store() memory leak
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53223
+    - clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53154
+    - clk: clk-apple-nco: Add NULL check in applnco_probe
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53224
+    - RDMA/mlx5: Move events notifier registration to be after device registration
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56746
+    - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53155
+    - ocfs2: fix uninitialized value in ocfs2_file_read_iter()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53226
+    - RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56747
+    - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56748
+    - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53229
+    - RDMA/rxe: Fix the qp flush warnings in req
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56722
+    - RDMA/hns: Fix cpu stuck caused by printings during reset
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53230
+    - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53231
+    - cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56701
+    - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56678
+    - powerpc/mm/fault: Fix kfence page fault reporting
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56677
+    - powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56723
+    - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56724
+    - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56691
+    - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53233
+    - unicode: Fix utf8_load() error path
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56694
+    - bpf: fix recursive lock when verdict program return SK_PASS
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53234
+    - erofs: handle NONHEAD !delta[1] lclusters gracefully
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53239
+    - ALSA: 6fire: Release resources at card release
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56531
+    - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56532
+    - ALSA: us122l: Use snd_card_free_when_closed() at disconnection
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56533
+    - ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56751
+    - ipv6: release nexthop on device removal
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56720
+    - bpf, sockmap: Several fixes to bpf_msg_pop_data
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56538
+    - drm: zynqmp_kms: Unplug DRM device before removal
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56752
+    - drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56725
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56707
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56726
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56727
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56728
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56679
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56539
+    - wifi: mwifiex: Fix memcpy() field-spanning write warning in
+      mwifiex_config_scan()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56543
+    - wifi: ath12k: Skip Rx TID cleanup for self peer
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56683
+    - drm/vc4: hdmi: Avoid hang with debug registers when suspended
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56545
+    - HID: hyperv: streamline driver probe to avoid devres issues
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56705
+    - media: atomisp: Add check for rgby_data memory allocation failure
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53157
+    - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53158
+    - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56546
+    - drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56681
+    - crypto: bcm - add error check in the ahash_hmac_init function
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53160
+    - rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56708
+    - EDAC/igen6: Avoid segmentation fault on module unload
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56690
+    - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return
+      -EBUSY
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53161
+    - EDAC/bluefield: Fix potential integer overflow
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53162
+    - crypto: qat/qat_4xxx - fix off by one in uof_get_name()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56754
+    - crypto: caam - Fix the pointer passed to caam_qi_shutdown()
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56548
+    - hfsplus: don't query the device logical block size multiple times
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56756
+    - nvme-pci: fix freeing of the HMB descriptor table
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53142
+    - initramfs: avoid filename buffer overrun
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56693
+    - brd: defer automatic disk creation until module initialization succeeds
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-44955
+    - drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute
+
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-49899
+    - drm/amd/display: Initialize denominators' default to 1
+
+  * Noble update: upstream stable patchset 2025-03-06 (LP: #2101042)
+    - sctp: fix possible UAF in sctp_v6_available()
+    - net: vertexcom: mse102x: Fix tx_bytes calculation
+    - drm/rockchip: vop: Fix a dereferenced before check warning
+    - mptcp: error out earlier on disconnect
+    - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
+    - net/mlx5: fs, lock FTE when checking if active
+    - net/mlx5e: kTLS, Fix incorrect page refcounting
+    - net/mlx5e: clear xdp features on non-uplink representors
+    - net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
+    - virtio/vsock: Fix accept_queue memory leak
+    - Bluetooth: btintel: Direct exception event to bluetooth stack
+    - net: sched: cls_u32: Fix u32's systematic failure to free IDR entries for
+      hnodes.
+    - samples: pktgen: correct dev to DEV
+    - net: stmmac: dwmac-mediatek: Fix inverted handling of mediatek,mac-wol
+    - net: Make copy_safe_from_sockptr() match documentation
+    - stmmac: dwmac-intel-plat: fix call balance of tx_clk handling routines
+    - net: ti: icssg-prueth: Fix 1 PPS sync
+    - bonding: add ns target multicast address to slave device
+    - ARM: 9419/1: mm: Fix kernel memory mapping for xip kernels
+    - x86/mm: Fix a kdump kernel failure on SME system when CONFIG_IMA_KEXEC=y
+    - mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
+    - ocfs2: uncache inode which has failed entering the group
+    - vdpa: solidrun: Fix UB bug with devres
+    - vdpa/mlx5: Fix PA offset with unaligned starting iotlb map
+    - vp_vdpa: fix id_table array not null terminated error
+    - ima: fix buffer overrun in ima_eventdigest_init_common
+    - KVM: nVMX: Treat vpid01 as current if L2 is active, but with VPID disabled
+    - KVM: x86: Unconditionally set irr_pending when updating APICv state
+    - KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind
+      CONFIG_BROKEN
+    - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
+    - nommu: pass NULL argument to vma_iter_prealloc()
+    - ALSA: hda/realtek - Fixed Clevo platform headset Mic issue
+    - ocfs2: fix UBSAN warning in ocfs2_verify_volume()
+    - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
+    - LoongArch: Fix early_numa_add_cpu() usage for FDT systems
+    - LoongArch: Disable KASAN if PGDIR_SIZE is too large for cpu_vabits
+    - LoongArch: Make KASAN work with 5-level page-tables
+    - Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
+    - mmc: sunxi-mmc: Fix A100 compatible description
+    - drm/bridge: tc358768: Fix DSI command tx
+    - pmdomain: imx93-blk-ctrl: correct remove path
+    - nouveau: fw: sync dma after setup is called.
+    - drm/amd: Fix initialization mistake for NBIO 7.7.0
+    - drm/amd/display: Adjust VSDB parser for replay feature
+    - lib/buildid: Fix build ID parsing logic
+    - media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
+    - mptcp: add userspace_pm_lookup_addr_by_id helper
+    - mptcp: update local address flags when setting it
+    - mptcp: hold pm lock when deleting entry
+    - mptcp: drop lookup_by_id in lookup_addr
+    - mptcp: pm: use _rcu variant under rcu_read_lock
+    - mm: avoid unsafe VMA hook invocation when error arises on mmap hook
+    - mm: unconditionally close VMAs on error
+    - mm: refactor map_deny_write_exec()
+    - mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling
+    - mm: resolve faulty mmap_region() error path behaviour
+    - net/mlx5: Fix msix vectors to respect platform limit
+    - vsock: Fix sk_error_queue memory leak
+    - virtio/vsock: Improve MSG_ZEROCOPY error handling
+    - net: phylink: ensure PHY momentary link-fails are handled
+    - drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle
+    - ARM: fix cacheflush with PAN
+    - drm/amd/display: Run idle optimizations at end of vblank handler
+    - drm/amd/display: Change some variable name of psr
+    - x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
+    - x86/stackprotector: Work around strict Clang TLS symbol requirements
+    - sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
+    - fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args()
+    - mm/mremap: fix address wraparound in move_page_tables()
+    - KVM: selftests: Disable strict aliasing
+    - mm: page_alloc: move mlocked flag clearance into free_pages_prepare()
+    - LoongArch: Add WriteCombine shadow mapping in KASAN
+    - drm/xe: handle flat ccs during hibernation on igpu
+    - pmdomain: arm: Use FLAG_DEV_NAME_FW to ensure unique names
+    - pmdomain: core: Add GENPD_FLAG_DEV_NAME_FW flag
+    - nouveau: handle EBUSY and EAGAIN for GSP aux errors.
+    - nouveau/dp: handle retries for AUX CH transfers with GSP.
+    - drm/amdgpu: fix check in gmc_v9_0_get_vm_pte()
+    - drm/amdgpu: Fix video caps for H264 and HEVC encode maximum size
+    - drm/amd/pm: print pp_dpm_mclk in ascending order on SMU v14.0.0
+    - drm/amd/display: Handle dml allocation failure to avoid crash
+    - drm/amd/display: Fix failure to read vram info due to static BP_RESULT
+    - drm/xe: Restore system memory GGTT mappings
+    - drm/xe: improve hibernation on igpu
+    - net: sched: u32: Add test case for systematic hnode IDR leaks
+    - Upstream stable to v6.6.63, v6.11.10
+
+  * Noble update: upstream stable patchset 2025-03-04 (LP: #2100894)
+    - 9p: v9fs_fid_find: also lookup by inode if not found dentry
+    - 9p: Avoid creating multiple slab caches with the same name
+    - selftests/bpf: Verify that sync_linked_regs preserves subreg_def
+    - irqchip/ocelot: Fix trigger register address
+    - nvme: tcp: avoid race between queue_lock lock and destroy
+    - block: Fix elevator_get_default() checking for NULL q->tag_set
+    - HID: multitouch: Add support for B2402FVA track point
+    - HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
+    - iommu/arm-smmu: Clarify MMU-500 CPRE workaround
+    - nvme: disable CC.CRIME (NVME_CC_CRIME)
+    - bpf: use kvzmalloc to allocate BPF verifier environment
+    - crypto: api - Fix liveliness check in crypto_alg_tested
+    - crypto: marvell/cesa - Disable hash algorithms
+    - sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
+    - drm/vmwgfx: Limit display layout ioctl array size to
+      VMWGFX_NUM_DISPLAY_UNITS
+    - RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES
+    - nvme-multipath: defer partition scanning
+    - drm/amdkfd: Accounting pdd vram_usage for svm
+    - powerpc/powernv: Free name on error in opal_event_init()
+    - net: phy: mdio-bcm-unimac: Add BCM6846 support
+    - nvme-loop: flush off pending I/O while shutting down loop controller
+    - smb: client: Fix use-after-free of network namespace.
+    - nvme/host: Fix RCU list traversal to use SRCU primitive
+    - vDPA/ifcvf: Fix pci_read_config_byte() return code handling
+    - bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx
+    - bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6
+    - ASoC: amd: yc: Add quirk for ASUS Vivobook S15 M3502RA
+    - ASoC: amd: yc: Fix non-functional mic on ASUS E1404FA
+    - fs: Fix uninitialized value issue in from_kuid and from_kgid
+    - HID: multitouch: Add quirk for Logitech Bolt receiver w/ Casa touchpad
+    - HID: lenovo: Add support for Thinkpad X1 Tablet Gen 3 keyboard
+    - RISCV: KVM: use raw_spinlock for critical section in imsic
+    - ASoC: rt722-sdca: increase clk_stop_timeout to fix clock stop issue
+    - LoongArch: Use "Exception return address" to comment ERA
+    - ASoC: fsl_micfil: Add sample rate constraint
+    - net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
+    - bpf: Check validity of link->type in bpf_link_show_fdinfo()
+    - mm: support order-1 folios in the page cache
+    - mm: always initialise folio->_deferred_list
+    - mm: refactor folio_undo_large_rmappable()
+    - mm/thp: fix deferred split unqueue naming and locking
+    - 9p: fix slab cache name creation for real
+    - nvmet-passthru: clear EUID/NGUID/UUID while using loop target
+    - pinctrl: intel: platform: Add Panther Lake to the list of supported
+    - s390/ap: Fix CCA crypto card behavior within protected execution environment
+    - selftests/bpf: Assert link info uprobe_multi count & path_size if unset
+    - ALSA: hda/tas2781: Add new quirk for Lenovo, ASUS, Dell projects
+    - drm/xe/query: Increase timestamp width
+    - nvme: make keep-alive synchronous operation
+    - samples/landlock: Fix port parsing in sandboxer
+    - ASoC: Intel: avs: Update stream status in a separate thread
+    - ASoC: codecs: Fix error handling in aw_dev_get_dsp_status function
+    - netfs: Downgrade i_rwsem for a buffered write
+    - afs: Fix lock recursion
+    - HID: i2c-hid: Delayed i2c resume wakeup for 0x0d42 Goodix touchpad
+    - LoongArch: KVM: Mark hrtimer to expire in hard interrupt context
+    - drm/xe: Don't restart parallel queues multiple times on GT reset
+    - Upstream stable to v6.6.62, v6.11.9
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292)
+    - arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610
+    - arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-
+      excavator
+    - arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
+    - arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node
+    - arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes
+    - arm64: dts: rockchip: fix i2c2 pinctrl-names property on anbernic-rg353p/v
+    - arm64: dts: rockchip: Fix bluetooth properties on rk3566 box demo
+    - arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
+    - arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus
+    - arm64: dts: rockchip: Remove undocumented supports-emmc property
+    - arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
+    - arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc
+    - arm64: dts: rockchip: remove num-slots property from rk3328-nanopi-r2s-plus
+    - arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs
+    - arm64: dts: imx8mp: correct sdhc ipg clk
+    - arm64: dts: rockchip: remove orphaned pinctrl-names from pinephone pro
+    - ARM: dts: rockchip: fix rk3036 acodec node
+    - ARM: dts: rockchip: drop grf reference from rk3036 hdmi
+    - ARM: dts: rockchip: Fix the spi controller on rk3036
+    - ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
+    - arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes
+    - sunrpc: handle -ENOTCONN in xs_tcp_setup_socket()
+    - NFSv3: only use NFS timeout for MOUNT when protocols are compatible
+    - nfs: avoid i_lock contention in nfs_clear_invalid_mapping
+    - net: enetc: set MAC address to the VF net_device
+    - dt-bindings: net: xlnx,axi-ethernet: Correct phy-mode property value
+    - can: c_can: fix {rx,tx}_errors statistics
+    - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation
+      fails
+    - ice: change q_index variable type to s16 to store -1 value
+    - e1000e: Remove Meteor Lake SMBUS workarounds
+    - net: phy: ti: add PHY_RST_AFTER_CLK_EN flag
+    - net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case
+    - netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
+    - netfilter: nf_tables: wait for rcu grace period on net_device removal
+    - netfilter: nf_tables: do not defer rule destruction via call_rcu
+    - net: arc: rockchip: fix emac mdio node support
+    - drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path
+    - Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
+    - media: stb0899_algo: initialize cfr before using it
+    - media: dvb_frontend: don't play tricks with underflow values
+    - media: adv7604: prevent underflow condition when reporting colorspace
+    - scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer
+    - ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
+    - tools/lib/thermal: Fix sampling handler context ptr
+    - thermal/of: support thermal zones w/o trips subnode
+    - ASoC: SOF: sof-client-probes-ipc4: Set param_size extension bits
+    - media: pulse8-cec: fix data timestamp at pulse8_setup()
+    - media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl()
+    - can: m_can: m_can_close(): don't call free_irq() for IRQ-less devices
+    - can: mcp251xfd: mcp251xfd_get_tef_len(): fix length calculation
+    - can: mcp251xfd: mcp251xfd_ring_alloc(): fix coalescing configuration when
+      switching CAN modes
+    - ksmbd: count all requests in req_running counter
+    - ksmbd: fix broken transfers when exceeding max simultaneous operations
+    - pwm: imx-tpm: Use correct MODULO value for EPWM mode
+    - rpmsg: glink: Handle rejected intent request better
+    - drm/amdgpu: Adjust debugfs eviction and IB access permissions
+    - drm/amdgpu: Adjust debugfs register access permissions
+    - drm/amdgpu: Fix DPX valid mode check on GC 9.4.3
+    - thermal/drivers/qcom/lmh: Remove false lockdep backtrace
+    - dm cache: correct the number of origin blocks to match the target length
+    - dm cache: optimize dirty bit checking with find_next_bit when resizing
+    - dm-unstriped: cast an operand to sector_t to prevent potential uint32_t
+      overflow
+    - ALSA: usb-audio: Add quirk for HP 320 FHD Webcam
+    - net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc()
+    - mptcp: use sock_kfree_s instead of kfree
+    - arm64: Kconfig: Make SME depend on BROKEN for now
+    - [Config] updateconfigs for ARM64_SME
+    - arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint
+    - Revert "wifi: mac80211: fix RCU list iterations"
+    - i2c: designware: do not hold SCL low when I2C_DYNAMIC_TAR_UPDATE is not set
+    - fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
+    - usb: dwc3: fix fault at system suspend if device was already runtime
+      suspended
+    - USB: serial: qcserial: add support for Sierra Wireless EM86xx
+    - USB: serial: option: add Fibocom FG132 0x0112 composition
+    - USB: serial: option: add Quectel RG650V
+    - irqchip/gic-v3: Force propagation of the active state with a read-back
+    - ucounts: fix counter leak in inc_rlimit_get_ucounts()
+    - ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022
+    - arm64: dts: rockchip: Designate Turing RK1's system power controller
+    - EDAC/qcom: Make irq configuration optional
+    - arm64: dts: rockchip: Drop regulator-init-microvolt from two boards
+    - net: dpaa_eth: print FD status in CPU endianness in dpaa_eth_fd tracepoint
+    - virtio_net: Sync rss config to device when virtnet_probe
+    - drm/xe: Set mask bits for CCS_MODE register
+    - drm/amd/display: Fix brightness level not retained over reboot
+    - drm/imagination: Add a per-file PVR context list
+    - mptcp: no admin perm to list endpoints
+    - btrfs: fix the length of reserved qgroup to free
+    - btrfs: fix per-subvolume RO/RW flags with new mount API
+    - clk: qcom: gcc-x1e80100: Fix USB MP SS1 PHY GDSC pwrsts flags
+    - clk: qcom: clk-alpha-pll: Fix pll post div mask when width is not set
+    - objpool: fix to make percpu slot allocation more robust
+    - mm/damon/core: handle zero {aggregation,ops_update} intervals
+    - mm/damon/core: handle zero schemes apply interval
+    - mm/mlock: set the correct prev on failure
+    - clk: qcom: gcc-x1e80100: Fix halt_check for pipediv2 clocks
+    - staging: vchiq_arm: Get the rid off struct vchiq_2835_state
+    - staging: vchiq_arm: Use devm_kzalloc() for vchiq_arm_state allocation
+    - drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
+    - drm/xe: Move LNL scheduling WA to xe_device.h
+    - drm/xe/ufence: Flush xe ordered_wq in case of ufence timeout
+    - drm/xe/guc/tlb: Flush g2h worker in case of tlb timeout
+    - xtensa: Emulate one-byte cmpxchg
+    - Upstream stable to v6.6.61, v6.11.8
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50270
+    - mm/damon/core: avoid overflow in damon_feed_loop_next_input()
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50274
+    - idpf: avoid vport access in idpf_get_link_ksettings
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53067
+    - scsi: ufs: core: Start the RTC update work later
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53084
+    - drm/imagination: Break an object reference loop
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53085
+    - tpm: Lock TPM chip in tpm_pm_suspend() first
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53086
+    - drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53087
+    - drm/xe: Fix possible exec queue leak in exec IOCTL
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50288
+    - media: vivid: fix buffer overwrite when using > 32 buffers
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50289
+    - media: av7110: fix a spectre vulnerability
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53062
+    - media: mgb4: protect driver against spectre
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50291
+    - media: dvb-core: add missing buffer index check
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50297
+    - net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50267
+    - USB: serial: io_edgeport: fix use after free in debug printk
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50268
+    - usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53083
+    - usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50269
+    - usb: musb: sunxi: Fix accessing an released usb phy
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50271
+    - signal: restore the override_rlimit logic
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50272
+    - filemap: Fix bounds checking in filemap_read()
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50273
+    - btrfs: reinitialize delayed ref list after deleting it from the list
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50275
+    - arm64/sve: Discard stale CPU state when handling SVE traps
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50276
+    - net: vertexcom: mse102x: Fix possible double free of TX skb
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53066
+    - nfs: Fix KMSAN warning in decode_getfattr_attrs()
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50278
+    - dm cache: fix potential out-of-bounds access on the first resume
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50279
+    - dm cache: fix out-of-bounds access to the dirty bitset when resizing
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50280
+    - dm cache: fix flushing uninitialized delayed_work on cache_ctr error
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53060
+    - drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50282
+    - drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50283
+    - ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50284
+    - ksmbd: Fix the missing xa_store error check
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50285
+    - ksmbd: check outstanding simultaneous SMB operations
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50286
+    - ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50287
+    - media: v4l2-tpg: prevent the risk of a division by zero
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50290
+    - media: cx24116: prevent overflows on SNR calculus
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53061
+    - media: s5p-jpeg: prevent buffer overflows
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53081
+    - media: ar0521: don't overflow when checking PLL values
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50292
+    - ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50294
+    - rxrpc: Fix missing locking causing hanging calls
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50295
+    - net: arc: fix the device for dma_map_single/dma_unmap_single
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53082
+    - virtio_net: Add hash_key_length check
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50296
+    - net: hns3: fix kernel crash when uninstalling driver
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53088
+    - i40e: fix race condition by adding filter's intermediate sync state
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50298
+    - net: enetc: allocate vf_state during PF probes
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50299
+    - sctp: properly validate chunk size in sctp_sf_ootb()
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50300
+    - regulator: rtq2208: Fix uninitialized use of regulator_config
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50301
+    - security/keys: fix slab-out-of-bounds in key_task_permission
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53072
+    - platform/x86/amd/pmc: Detect when STB is not available
+
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53068
+    - firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996)
+    - Input: xpad - sort xpad_device by vendor and product ID
+    - Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller
+    - cgroup: Fix potential overflow issue when checking max_depth
+    - spi: geni-qcom: Fix boot warning related to pm_runtime and devres
+    - wifi: iwlegacy: Fix "field-spanning write" warning in il_enqueue_hcmd()
+    - mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING
+    - wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
+    - wifi: ath11k: Fix invalid ring usage in full monitor mode
+    - wifi: brcm80211: BRCM_TRACING should depend on TRACING
+    - RDMA/cxgb4: Dump vendor specific QP details
+    - RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down
+    - RDMA/bnxt_re: Fix the usage of control path spin locks
+    - RDMA/bnxt_re: synchronize the qp-handle table array
+    - RDMA/bnxt_re: Fix the locking while accessing the QP table
+    - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
+    - wifi: iwlwifi: mvm: don't add default link in fw restart flow
+    - ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
+    - net: stmmac: dwmac4: Fix high address display by updating reg_space[] from
+      register values
+    - net: stmmac: fix TSO DMA API usage causing oops
+    - gtp: allow -1 to be specified as file description from userspace
+    - bpf: Force checkpoint when jmp history is too long
+    - net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
+    - net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets
+    - mlxsw: spectrum_ptp: Add missing verification before pushing Tx header
+    - bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled
+    - iomap: improve shared block detection in iomap_unshare_iter
+    - iomap: don't bother unsharing delalloc extents
+    - iomap: share iomap_unshare_iter predicate code with fsdax
+    - fsdax: remove zeroing code from dax_unshare_iter
+    - iomap: turn iomap_want_unshare_iter into an inline function
+    - kasan: Fix Software Tag-Based KASAN with GCC
+    - firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
+    - afs: Fix missing subdir edit when renamed between parent dirs
+    - smb: client: set correct device number on nfs reparse points
+    - cxl/events: Fix Trace DRAM Event Record
+    - fs/ntfs3: Fix warning possible deadlock in ntfs_set_state
+    - fs/ntfs3: Stale inode instead of bad
+    - scsi: scsi_transport_fc: Allow setting rport state to current state
+    - cifs: Fix creating native symlinks pointing to current or parent directory
+    - thermal: intel: int340x: processor: Remove MMIO RAPL CPU hotplug support
+    - thermal: intel: int340x: processor: Add MMIO RAPL PL4 support
+    - net: amd: mvme147: Fix probe banner message
+    - NFS: remove revoked delegation from server's delegation list
+    - misc: sgi-gru: Don't disable preemption in GRU driver
+    - usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler
+    - usb: gadget: dummy_hcd: Set transfer interval to 1 microframe
+    - usb: gadget: dummy_hcd: execute hrtimer callback in softirq context
+    - USB: gadget: dummy-hcd: Fix "task hung" problem
+    - ALSA: usb-audio: Add quirks for Dell WD19 dock
+    - usbip: tools: Fix detach_port() invalid port error path
+    - usb: phy: Fix API devm_usb_put_phy() can not release the phy
+    - usb: typec: fix unreleased fwnode_handle in typec_port_register_altmodes()
+    - usb: typec: qcom-pmic-typec: use fwnode_handle_put() to release fwnodes
+    - xhci: Fix Link TRB DMA in command ring stopped completion event
+    - xhci: Use pm_runtime_get to prevent RPM on unsupported systems
+    - Revert "driver core: Fix uevent_show() vs driver detach race"
+    - iio: light: veml6030: fix microlux value calculation
+    - RISC-V: ACPI: fix early_ioremap to early_memremap
+    - tools/mm: -Werror fixes in page-types/slabinfo
+    - tools/mm: fix compile error
+    - thunderbolt: Honor TMU requirements in the domain when setting TMU mode
+    - mmc: sdhci-pci-gli: GL9767: Fix low power mode on the set clock function
+    - mmc: sdhci-pci-gli: GL9767: Fix low power mode in the SD Express process
+    - block: fix sanity checks in blk_rq_map_user_bvec
+    - cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
+    - phy: freescale: imx8m-pcie: Do CMN_RST just before PHY PLL lock check
+    - riscv: vdso: Prevent the compiler from inserting calls to memset()
+    - Input: edt-ft5x06 - fix regmap leak when probe fails
+    - ALSA: hda/realtek: Limit internal Mic boost on Dell platform
+    - riscv: efi: Set NX compat flag in PE/COFF header
+    - riscv: Use '%u' to format the output of 'cpu'
+    - riscv: Remove unused GENERATING_ASM_OFFSETS
+    - riscv: Remove duplicated GET_RM
+    - cxl/port: Fix cxl_bus_rescan() vs bus_rescan_devices()
+    - cxl/acpi: Ensure ports ready at cxl_acpi_probe() return
+    - mei: use kvmalloc for read buffer
+    - mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves
+    - x86/traps: Enable UBSAN traps on x86
+    - x86/traps: move kmsan check after instrumentation_begin
+    - kasan: remove vmalloc_percpu test
+    - vmscan,migrate: fix page count imbalance on node stats when demoting pages
+    - io_uring: always lock __io_cqring_overflow_flush
+    - mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw()
+    - mm: don't install PMD mappings when THPs are disabled by the hw/process/vma
+    - perf trace: Fix non-listed archs in the syscalltbl routines
+    - dpll: add Embedded SYNC feature for a pin
+    - ice: add callbacks for Embedded SYNC enablement on dpll pins
+    - bpf: Add bpf_mem_alloc_check_size() helper
+    - net: ethernet: mtk_wed: fix path of MT7988 WO firmware
+    - drm/mediatek: ovl: Remove the color format comment for ovl_fmt_convert()
+    - drm/mediatek: Fix get efuse issue for MT8188 DPTX
+    - ACPI: resource: Fold Asus Vivobook Pro N6506M* DMI quirks together
+    - powercap: intel_rapl_msr: Add PL4 support for Arrowlake-U
+    - usb: typec: qcom-pmic-typec: fix missing fwnode removal in error path
+    - mm: shrinker: avoid memleak in alloc_shrinker_info
+    - firmware: microchip: auto-update: fix poll_complete() to not report spurious
+      timeout errors
+    - soc: qcom: pmic_glink: Handle GLINK intent allocation rejections
+    - cxl/port: Fix CXL port initialization order when the subsystem is built-in
+    - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io()
+    - posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone
+    - mm/ksm: remove redundant code in ksm_fork
+    - nvme: re-fix error-handling for io_uring nvme-passthrough
+    - btrfs: fix extent map merging not happening for adjacent extents
+    - btrfs: fix defrag not merging contiguous extents due to merged extent maps
+    - mm, mmap: limit THP alignment of anonymous mappings to PMD-aligned sizes
+    - mm: multi-gen LRU: ignore non-leaf pmd_young for force_scan=true
+    - mm: multi-gen LRU: remove MM_LEAF_OLD and MM_NONLEAF_TOTAL stats
+    - mm: shrink skip folio mapped by an exiting process
+    - mm: multi-gen LRU: use {ptep,pmdp}_clear_young_notify()
+    - drm/i915: Skip programming FIA link enable bits for MTL+
+    - drm/i915/display: WA for Re-initialize dispcnlunitt1 xosc clock
+    - drm/i915/dp: Clear VSC SDP during post ddi disable routine
+    - drm/i915/pps: Disable DPLS_GATING around pps sequence
+    - drm/i915: move rawclk from runtime to display runtime info
+    - drm/xe/display: drop unused rawclk_freq and RUNTIME_INFO()
+    - drm/xe: Support 'nomodeset' kernel command-line option
+    - drm/xe/xe2hpg: Introduce performance tuning changes for Xe2_HPG
+    - drm/amdgpu/swsmu: fix ordering for setting workload_mask
+    - drm/amdgpu/swsmu: default to fullscreen 3D profile for dGPUs
+    - drm/amdgpu: handle default profile on on devices without fullscreen 3D
+    - MIPS: export __cmpxchg_small()
+    - rcu/kvfree: Add kvfree_rcu_barrier() API
+    - rcu/kvfree: Refactor kvfree_rcu_queue_batch()
+    - Upstream stable to v6.6.60, v6.11.7
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53050
+    - drm/i915/hdcp: Add encoder check in hdcp2_get_capability
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53051
+    - drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50303
+    - resource,kexec: walk_system_ram_res_rev must retain resource flags
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50263
+    - fork: only invoke khugepaged, ksm hooks if no error
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50220
+    - fork: do not invoke uffd on fork if error occurs
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50221
+    - drm/amd/pm: Vangogh: Fix kernel memory out of bounds write
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53053
+    - scsi: ufs: core: Fix another deadlock during RTC update
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50225
+    - btrfs: fix error propagation of split bios
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50230
+    - nilfs2: fix kernel bug due to missing clearing of checked flag
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50238
+    - phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53044
+    - net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50304
+    - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53048
+    - ice: fix crash on probe for DPLL enabled E810 LOM
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53045
+    - ASoC: dapm: fix bounds checker error in dapm_widget_list_create
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53055
+    - wifi: iwlwifi: mvm: fix 6 GHz scan construction
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53046
+    - arm64: dts: imx8ulp: correct the flexspi compatible string
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53052
+    - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50215
+    - nvmet-auth: assign dh_key to NULL after kfree_sensitive
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50216
+    - xfs: fix finding a last resort AG in xfs_filestream_pick_ag
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53043
+    - mctp i2c: handle NULL header address
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50218
+    - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53047
+    - mptcp: init: protect sched with rcu_read_lock
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50222
+    - iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50223
+    - sched/numa: Fix the potential null pointer dereference in task_numa_work()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50224
+    - spi: spi-fsl-dspi: Fix crash when not using GPIO chip select
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50226
+    - cxl/port: Fix use-after-free, permit out-of-order decoder shutdown
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50231
+    - iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53076
+    - iio: gts-helper: Fix memory leaks for the error path of
+      iio_gts_build_avail_scale_table()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50232
+    - iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50234
+    - wifi: iwlegacy: Clear stale interrupts before resuming device
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50235
+    - wifi: cfg80211: clear wdev->cqm_config pointer on free
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50236
+    - wifi: ath10k: Fix memory leak in management tx
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50237
+    - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50239
+    - phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50240
+    - phy: qcom: qmp-usb: fix NULL-deref on runtime suspend
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50242
+    - fs/ntfs3: Additional check in ntfs_file_release
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50243
+    - fs/ntfs3: Fix general protection fault in run_is_mapped_full
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50244
+    - fs/ntfs3: Additional check in ni_clear()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50245
+    - fs/ntfs3: Fix possible deadlock in mi_read
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50246
+    - fs/ntfs3: Add rough attr alloc_size check
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50247
+    - fs/ntfs3: Check if more than chunk-size bytes are written
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50250
+    - fsdax: dax_unshare_iter needs to copy entire blocks
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50251
+    - netfilter: nft_payload: sanitize offset and length before calling
+      skb_checksum()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50252
+    - mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50255
+    - Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50257
+    - netfilter: Fix use-after-free in get_info()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50258
+    - net: fix crash when config small gso_max_size/gso_ipv4_max_size
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50262
+    - bpf: Fix out-of-bounds write in trie_get_next_key()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50259
+    - netdevsim: Add trailing zero to terminate the string in
+      nsim_nexthop_bucket_activity_write()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53042
+    - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53058
+    - net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50261
+    - macsec: Fix use-after-free while sending the offloading packet
+
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53059
+    - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
+
+  * Noble update: upstream stable patchset 2025-02-07 (LP: #2097575)
+    - irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1
+    - xfs: fix error returns from xfs_bmapi_write
+    - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions
+    - xfs: remove a racy if_bytes check in xfs_reflink_end_cow_extent
+    - xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item
+      recovery
+    - xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2
+    - xfs: fix missing check for invalid attr flags
+    - xfs: check shortform attr entry flags specifically
+    - xfs: validate recovered name buffers when recovering xattr items
+    - xfs: enforce one namespace per attribute
+    - xfs: revert commit 44af6c7e59b12
+    - xfs: use dontcache for grabbing inodes during scrub
+    - xfs: match lock mode in xfs_buffered_write_iomap_begin()
+    - xfs: make the seq argument to xfs_bmapi_convert_delalloc() optional
+    - xfs: make xfs_bmapi_convert_delalloc() to allocate the target offset
+    - xfs: convert delayed extents to unwritten when zeroing post eof blocks
+    - xfs: allow symlinks with short remote targets
+    - xfs: make sure sb_fdblocks is non-negative
+    - xfs: fix unlink vs cluster buffer instantiation race
+    - xfs: fix freeing speculative preallocations for preallocated files
+    - xfs: allow unlinked symlinks and dirs with zero size
+    - xfs: restrict when we try to align cow fork delalloc to cowextsz hints
+    - selftests: mptcp: join: change capture/checksum as bool
+    - selftests: mptcp: join: test for prohibited MPC to port-based endp
+    - selftests: mptcp: remove duplicated variables
+    - iio: accel: bma400: Fix uninitialized variable field_value in tap event
+      handling.
+    - bpf: Make sure internal and UAPI bpf_redirect flags don't overlap
+    - bpf: devmap: provide rxq after redirect
+    - cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory systems
+    - lib/Kconfig.debug: fix grammar in RUST_BUILD_ASSERT_ALLOW
+    - bpf: Fix memory leak in bpf_core_apply
+    - RDMA/bnxt_re: Fix a possible memory leak
+    - RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
+    - RDMA/bnxt_re: Add a check for memory allocation
+    - x86/resctrl: Avoid overflow in MB settings in bw_validate()
+    - ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
+    - bpf: Add cookie to perf_event bpf_link_info records
+    - bpf: fix unpopulated name_len field in perf_event link info
+    - selftests/bpf: Add cookies check for perf_event fill_link_info test
+    - selftests/bpf: fix perf_event link info name_len assertion
+    - s390/pci: Handle PCI error codes other than 0x3a
+    - bpf: fix kfunc btf caching for modules
+    - iio: frequency: {admv4420,adrf6780}: format Kconfig entries
+    - iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig
+    - drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check
+    - selftests/bpf: Fix cross-compiling urandom_read
+    - task_work: Add TWA_NMI_CURRENT as an additional notify mode.
+    - sched/core: Disable page allocation in task_tick_mm_cid()
+    - ALSA: hda/cs8409: Fix possible NULL dereference
+    - firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
+    - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
+    - RDMA/irdma: Fix misspelling of "accept*"
+    - RDMA/srpt: Make slab cache names unique
+    - ipv4: give an IPv4 dev to blackhole_netdev
+    - RDMA/bnxt_re: Fix the max CQ WQEs for older adapters
+    - RDMA/bnxt_re: Fix out of bound check
+    - RDMA/bnxt_re: Return more meaningful error
+    - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
+    - RDMA/bnxt_re: Fix the GID table length
+    - accel/qaic: Fix the for loop used to walk SG table
+    - drm/msm/dpu: make sure phys resources are properly initialized
+    - drm/msm/dpu: check for overflow in _dpu_crtc_setup_lm_bounds()
+    - drm/msm/dsi: improve/fix dsc pclk calculation
+    - drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
+    - drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()
+    - drm/msm: Allocate memory for disp snapshot with kvzalloc()
+    - firmware: arm_scmi: Queue in scmi layer for mailbox implementation
+    - net/smc: Fix memory leak when using percpu refs
+    - net: usb: usbnet: fix race in probe failure
+    - net: stmmac: dwmac-tegra: Fix link bring-up sequence
+    - octeontx2-af: Fix potential integer overflows on integer shifts
+    - drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring
+    - macsec: don't increment counters for an unrelated SA
+    - netdevsim: use cond_resched() in nsim_dev_trap_report_work()
+    - net: ethernet: aeroflex: fix potential memory leak in
+      greth_start_xmit_gbit()
+    - net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
+    - net: xilinx: axienet: fix potential memory leak in axienet_start_xmit()
+    - bpf: Fix truncation bug in coerce_reg_to_size_sx()
+    - irqchip/renesas-rzg2l: Fix missing put_device
+    - drm/msm/dpu: don't always program merge_3d block
+    - net: bcmasp: fix potential memory leak in bcmasp_xmit()
+    - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
+    - net: dsa: mv88e6xxx: Fix the max_vid definition for the MV88E6361
+    - genetlink: hold RCU in genlmsg_mcast()
+    - ravb: Remove setting of RX software timestamp
+    - net: ravb: Only advertise Rx/Tx timestamps if hardware supports it
+    - scsi: target: core: Fix null-ptr-deref in target_alloc_device()
+    - smb: client: fix possible double free in smb2_set_ea()
+    - smb: client: fix OOBs when building SMB2_IOCTL request
+    - usb: typec: altmode should keep reference to parent
+    - s390: Initialize psw mask in perf_arch_fetch_caller_regs()
+    - bpf: Fix link info netfilter flags to populate defrag flag
+    - vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame
+    - net/mlx5: Check for invalid vector index on EQ creation
+    - net/mlx5: Fix command bitmask initialization
+    - net/mlx5: Unregister notifier on eswitch init failure
+    - bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock
+    - vsock: Update rx_bytes on read_skb()
+    - vsock: Update msg_count on read_skb()
+    - bpf, vsock: Drop static vsock_bpf_prot initialization
+    - riscv, bpf: Make BPF_CMPXCHG fully ordered
+    - nvme-pci: fix race condition between reset and nvme_dev_disable()
+    - bpf: Fix iter/task tid filtering
+    - cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed()
+    - khugepaged: inline hpage_collapse_alloc_folio()
+    - khugepaged: convert alloc_charge_hpage to alloc_charge_folio
+    - khugepaged: remove hpage from collapse_file()
+    - mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace
+      point
+    - iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - xhci: dbgtty: remove kfifo_out() wrapper
+    - xhci: dbgtty: use kfifo from tty_port struct
+    - xhci: dbc: honor usb transfer size boundaries.
+    - usb: gadget: f_uac2: fix non-newline-terminated function name
+    - usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store
+    - XHCI: Separate PORT and CAPs macros into dedicated file
+    - usb: dwc3: core: Fix system suspend on TI AM62 platforms
+    - tracing/fprobe-event: cleanup: Fix a wrong comment in fprobe event
+    - tracing/probes: cleanup: Set trace_probe::nr_args at trace_probe_init
+    - tracing/probes: Support $argN in return probe (kprobe and fprobe)
+    - uprobes: encapsulate preparation of uprobe args buffer
+    - uprobes: prepare uprobe args buffer lazily
+    - uprobes: prevent mutex_lock() under rcu_read_lock()
+    - uprobe: avoid out-of-bounds memory access of fetching args
+    - exec: don't WARN for racy path_noexec check
+    - ASoC: amd: yc: Add quirk for HP Dragonfly pro one
+    - ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to
+      default regs values
+    - ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit
+    - arm64: Force position-independent veneers
+    - udf: refactor udf_current_aext() to handle error
+    - udf: refactor udf_next_aext() to handle error
+    - udf: refactor inode_bmap() to handle error
+    - udf: fix uninit-value use in udf_get_fileshortad
+    - ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string
+    - cifs: Validate content of NFS reparse point buffer
+    - platform/x86: dell-sysman: add support for alienware products
+    - LoongArch: Don't crash in stack_top() for tasks without vDSO
+    - jfs: Fix sanity check in dbMount
+    - tracing/probes: Fix MAX_TRACE_ARGS limit handling
+    - tracing: Consider the NULL character when validating the event length
+    - xfrm: extract dst lookup parameters into a struct
+    - xfrm: respect ip protocols rules criteria when performing dst lookups
+    - netfilter: bpf: must hold reference on net namespace
+    - net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
+    - net: plip: fix break; causing plip to never transmit
+    - octeon_ep: Implement helper for iterating packets in Rx queue
+    - octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()
+    - net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x
+    - fsl/fman: Save device references taken in mac_probe()
+    - fsl/fman: Fix refcount handling of fman-related devices
+    - netfilter: xtables: fix typo causing some targets not to load on IPv6
+    - net: wwan: fix global oob in wwan_rtnl_policy
+    - net/sched: adjust device watchdog timer to detect stopped queue at right
+      time
+    - net: fix races in netdev_tx_sent_queue()/dev_watchdog()
+    - net: usb: usbnet: fix name regression
+    - bpf: Add MEM_WRITE attribute
+    - bpf: Fix overloading of MEM_UNINIT's meaning
+    - bpf: Remove MEM_UNINIT from skb/xdp MTU helpers
+    - net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions
+      created by classifiers
+    - net: sched: fix use-after-free in taprio_change()
+    - net: sched: use RCU read-side critical section in taprio_dump()
+    - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
+    - Bluetooth: SCO: Fix UAF on sco_sock_timeout
+    - Bluetooth: ISO: Fix UAF on iso_sock_timeout
+    - bpf,perf: Fix perf_event_detach_bpf_prog error handling
+    - net: dsa: mv88e6xxx: group cycle counter coefficients
+    - net: dsa: mv88e6xxx: read cycle counter period from hardware
+    - net: dsa: mv88e6xxx: support 4000ps cycle counter period
+    - ASoC: dt-bindings: davinci-mcasp: Fix interrupts property
+    - ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties
+    - ASoC: loongson: Fix component check failed on FDT systems
+    - ASoC: max98388: Fix missing increment of variable slot_found
+    - ASoC: rsnd: Fix probe failure on HiHope boards due to endpoint parsing
+    - ASoC: fsl_micfil: Add a flag to distinguish with different volume control
+      types
+    - ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
+    - powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request()
+    - nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
+    - ALSA: hda/realtek: Update default depop procedure
+    - smb: client: Handle kstrdup failures for passwords
+    - cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception
+    - btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item()
+    - btrfs: zoned: fix zone unusable accounting for freed reserved extent
+    - ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
+    - ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context
+    - ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid
+      detection issue
+    - nilfs2: fix kernel bug due to missing clearing of buffer delay flag
+    - openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
+    - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
+    - KVM: arm64: Fix shift-out-of-bounds bug
+    - KVM: arm64: Don't eagerly teardown the vgic on init error
+    - x86/lam: Disable ADDRESS_MASKING in most cases
+    - [Config] disable ADDRESS_MASKING
+    - ALSA: hda/tas2781: select CRC32 instead of CRC32_SARWATE
+    - ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
+    - LoongArch: Get correct cores_per_package for SMT systems
+    - LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context
+    - LoongArch: Make KASAN usable for variable cpu_vabits
+    - xfrm: fix one more kernel-infoleak in algo dumping
+    - hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
+    - drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too
+    - selinux: improve error checking in sel_write_load()
+    - net: phy: dp83822: Fix reset pin definitions
+    - ata: libata: Set DID_TIME_OUT for commands that actually timed out
+    - ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
+    - platform/x86: dell-wmi: Ignore suspend notifications
+    - ACPI: PRM: Clean up guid type in struct prm_handler_info
+    - tracing: probes: Fix to zero initialize a local variable
+    - task_work: make TWA_NMI_CURRENT handling conditional on IRQ_WORK
+    - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
+    - bpf: Use raw_spinlock_t in ringbuf
+    - reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC
+    - bpf: Fix unpopulated path_size when uprobe_multi fields unset
+    - RDMA/bnxt_re: Fix incorrect dereference of srq in async event
+    - RDMA/bnxt_re: Get the toggle bits from SRQ events
+    - RDMA/bnxt_re: Change the sequence of updating the CQ toggle value
+    - drm/msm/dpu: move CRTC resource assignment to dpu_encoder_virt_atomic_check
+    - ring-buffer: Fix reader locking when changing the sub buffer order
+    - drm/msm/dpu: Don't always set merge_3d pending flush
+    - drm/msm/a6xx+: Insert a fence wait before SMMU table update
+    - drm/xe: Take job list lock in xe_sched_add_pending_job
+    - drm/xe: Use bookkeep slots for external BO's in exec IOCTL
+    - net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init
+    - net/mlx5e: Don't call cleanup on profile rollback failure
+    - bpf: Fix print_reg_state's constant scalar dump
+    - fsnotify: optimize the case of no parent watcher
+    - fsnotify: Avoid data race between fsnotify_recalc_mask() and
+      fsnotify_object_watched()
+    - drm/xe/mcr: Use Xe2_LPM steering tables for Xe2_HPM
+    - objpool: fix choosing allocation for percpu slots
+    - bnxt_en: replace ptp_lock with irqsave variant
+    - bpf, arm64: Fix address emission with tag-based KASAN enabled
+    - net: dsa: microchip: disable EEE for KSZ879x/KSZ877x/KSZ876x
+    - ASoC: topology: Bump minimal topology ABI version
+    - fbdev: wm8505fb: select CONFIG_FB_IOMEM_FOPS
+    - btrfs: qgroup: set a more sane default value for subtree drop threshold
+    - btrfs: clear force-compress on remount when compress mount option is given
+    - x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h-70h
+    - x86/amd_nb: Add new PCI ID for AMD family 1Ah model 20h
+    - btrfs: reject ro->rw reconfiguration if there are hard ro requirements
+    - xfs: don't fail repairs on metadata files with no attr fork
+    - drm/bridge: Fix assignment of the of_node of the parent to aux bridge
+    - platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid
+      addresses
+    - fgraph: Fix missing unlock in register_ftrace_graph()
+    - fgraph: Change the name of cpuhp state to "fgraph:online"
+    - ASoC: SOF: Intel: hda: Always clean up link DMA during stop
+    - ASoC: dapm: avoid container_of() to get component
+    - ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc
+    - ASoC: qcom: sdm845: add missing soundwire runtime stream alloc
+    - soundwire: intel_ace2x: Send PDI stream number during prepare
+    - x86: support user address masking instead of non-speculative conditional
+    - ASoC: qcom: Select missing common Soundwire module code on SDM845
+    - SAUCE: Revert "iio: adc: ti-lmp92064: add missing select
+      IIO_(TRIGGERED_)BUFFER in Kconfig"
+    - Upstream stable to v6.6.58, v6.6.59, v6.11.6
+
+  * CVE-2025-21756
+    - vsock: Keep the binding until socket destruction
+    - vsock: Orphan socket after transport release
+
+  * Fix NIC name changes for ice (LP: #2100264)
+    - ice: Remove ndo_get_phys_port_name
+
+  * CVE-2024-50256
+    - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
+
+  * CVE-2025-21702
+    - pfifo_tail_enqueue: Drop new packet when sch->limit == 0
+
+  * CVE-2024-50167
+    - be2net: fix potential memory leak in be_xmit()
+
+  * Fix line-out playback on some platforms with Cirrus Logic “Dolphin” hardware
+    (LP: #2099880)
+    - ALSA: hda/cirrus: Correct the full scale volume set logic
+
+  * Enable Large Language Model (LLM) workloads using Intel NPU (LP: #2098972)
+    - accel/ivpu: Increase DMA address range
+
+  * Patchset for TUXEDO devices (LP: #2098104)
+    - wifi: ath12k: add fallback board name without variant while searching
+      board-2.bin
+    - wifi: ath12k: remove unused ATH12K_BD_IE_BOARD_EXT
+    - wifi: ath12k: add support to search regdb data in board-2.bin for WCN7850
+    - wifi: ath12k: support default regdb while searching board-2.bin for WCN7850
+    - ACPI: resource: Use IRQ override on Maibenben X565
+    - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
+    - ALSA: hda/realtek: Fix headset mic on TUXEDO Gemini 17 Gen3
+    - ALSA: hda/realtek: Fix headset mic on TUXEDO Stellaris 16 Gen6 mb1
+    - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
+    - nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
+    - nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
+
+  * Introduce and use sendpages_ok() instead of sendpage_ok() in nvme-tcp and
+    drbd (LP: #2093871)
+    - net: introduce helper sendpages_ok()
+    - nvme-tcp: use sendpages_ok() instead of sendpage_ok()
+    - drbd: use sendpages_ok() instead of sendpage_ok()
+
+  * CVE-2024-56765
+    - powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
+
+  * CVE-2025-21700
+    - net: sched: Disallow replacing of child qdisc from one parent to another
+
+  * CVE-2024-56615
+    - bpf: fix OOB devmap writes when deleting elements
+
+  * CVE-2024-56651
+    - can: hi311x: hi3110_can_ist(): fix potential use-after-free
+
+  * CVE-2024-56627
+    - ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
+
+  * CVE-2024-56600
+    - net: inet6: do not leave a dangling sk pointer in inet6_create()
+
+  * CVE-2024-56661
+    - tipc: fix NULL deref in cleanup_bearer()
+
+  * CVE-2024-56642
+    - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
+
+  * CVE-2024-53227
+    - scsi: bfa: Fix use-after-free in bfad_im_module_exit()
+
+  * CVE-2024-53237
+    - Bluetooth: fix use-after-free in device_for_each_child()
+
+  * CVE-2024-53166
+    - block, bfq: fix bfqq uaf in bfq_limit_depth()
+
+  * CVE-2024-50265
+    - ocfs2: remove entry once instead of null-ptr-dereference in
+      ocfs2_xa_remove()
+
+  * CVE-2024-50249
+    - ACPI: CPPC: Make rmw_lock a raw_spin_lock
+
+  * iBFT iSCSI out-of-bounds shift UBSAN warning (LP: #2097824)
+    - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
+
+  * [Ubuntu 24.04] MultiVM - L2 guest(s) running stress-ng getting stuck at
+    booting after triggering crash (LP: #2077722)
+    - KVM: PPC: Book3S HV: Mask off LPCR_MER for a vCPU before running it to avoid
+      spurious interrupts
+
+  * btrfs will WARN_ON() in btrfs_remove_qgroup() unnecessarily (LP: #2091719)
+    - btrfs: improve the warning and error message for btrfs_remove_qgroup()
+
+  * CVE-2024-50248
+    - ntfs3: Add bounds checking to mi_enum_attr()
+    - fs/ntfs3: Sequential field availability check in mi_enum_attr()
+
+  * CVE-2025-21701
+    - net: avoid race between device unregistration and ethnl ops
+
+  * CVE-2024-57798
+    - drm/dp_mst: Ensure mst_primary pointer is valid in
+      drm_dp_mst_handle_up_req()
+
+  * CVE-2024-56672
+    - blk-cgroup: Fix UAF in blkcg_unpin_online()
+
+  * CVE-2024-56658
+    - net: defer final 'struct net' free in netns dismantle
+
+  * CVE-2024-56598
+    - jfs: array-index-out-of-bounds fix in dtReadFirst
+
+  * CVE-2024-56595
+    - jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
+
+  * CVE-2024-53140
+    - netlink: terminate outstanding dump on socket close
+
+  * CVE-2024-53063
+    - media: dvbdev: prevent the risk of out of memory access
+
+  * CVE-2024-50302
+    - HID: core: zero-initialize the report buffer
+
+ -- Stefan Bader <stefan.bader@canonical.com>  Fri, 14 Mar 2025 15:25:38 +0100
+
+linux (6.8.0-56.58) noble; urgency=medium
+
+  * noble/linux: 6.8.0-56.58 -proposed tracker (LP: #2098244)
+
+  * Noble update: upstream stable patchset 2024-07-19 (LP: #2073603)
+    - Revert "drm: Make drivers depends on DRM_DW_HDMI"
+    - Revert "UBUNTU: [Config] Drivers now depend on DRM_DW_HDMI"
+
+  * drm/amd/display: Add check for granularity in dml ceil/floor helpers
+    (LP: #2098080)
+    - drm/amd/display: Add check for granularity in dml ceil/floor helpers
+
+  * optimized default EPP for GNR family (LP: #2097554)
+    - cpufreq: intel_pstate: Update Balance-performance EPP for Granite Rapids
+
+  * Incorrect LAPIC/x2APIC parsing order (LP: #2097455)
+    - x86/acpi: Fix LAPIC/x2APIC parsing order
+
+  * MGLRU: page allocation failure on NUMA-enabled systems (LP: #2097214)
+    - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
+
+  * Upstream commit 65357e2c164a: "RDMA/mana_ib: set node_guid" applied
+    incorrectly (LP: #2096885)
+    - Revert "RDMA/mana_ib: set node_guid"
+
+  * AppArmor early policy load not funcitoning (LP: #2095370)
+    - SAUCE: Revert "UBUNTU: SAUCE: apparmor4.0.0 [67/90]: userns - add the
+      ability to reference a global variable for a feature value"
+
+  * apparmor unconfined profile blocks pivot_root (LP: #2067900)
+    - SAUCE: Revert "UBUNTU: SAUCE: apparmor4.0.0 [81/90]: apparmor: convert easy
+      uses of unconfined() to label_mediates()"
+
+  * CVE-2024-50117
+    - drm/amd: Guard against bad data for ATIF ACPI method
+
+  * CVE-2024-56582
+    - btrfs: fix use-after-free in btrfs_encoded_read_endio()
+
+  * CVE-2024-53165
+    - sh: intc: Fix use-after-free bug in register_intc_controller()
+
+  * CVE-2024-53156
+    - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
+
+  * CVE-2024-56663
+    - wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
+
+  * CVE-2024-56614
+    - xsk: fix OOB map writes when deleting elements
+
+  * VM boots slowly with large-BAR GPU Passthrough due to pci/probe.c redundancy
+    (LP: #2097389)
+    - PCI: Batch BAR sizing operations
+
+  * Noble update: upstream stable patchset 2025-02-04 (LP: #2097393)
+    - Revert "PCI/MSI: Provide stubs for IMS functions"
+    - gfs2: Revert "introduce qd_bh_get_or_undo"
+    - gfs2: qd_check_sync cleanups
+    - gfs2: Revert "ignore negated quota changes"
+    - Revert "powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2"
+    - tracing: Have saved_cmdlines arrays all in one allocation
+    - spi: spi-fsl-lpspi: remove redundant spi_controller_put call
+    - ata: ahci: Add mask_port_map module parameter
+    - ASoC: tas2781: mark dvc_tlv with __maybe_unused
+    - scsi: sd: Do not repeat the starting disk message
+    - bootconfig: Fix the kerneldoc of _xbc_exit()
+    - perf sched: Move start_work_mutex and work_done_wait_mutex initialization to
+      perf_sched__replay()
+    - perf sched: Fix memory leak in perf_sched__map()
+    - perf sched: Move curr_thread initialization to perf_sched__map()
+    - perf sched: Move curr_pid and cpu_last_switched initialization to
+      perf_sched__{lat|map|replay}()
+    - libsubcmd: Don't free the usage string
+    - selftests: Introduce Makefile variable to list shared bash scripts
+    - jbd2: fix kernel-doc for j_transaction_overhead_buffers
+    - lib/build_OID_registry: avoid non-destructive substitution for Perl < 5.13.2
+      compat
+    - drm/amd/display: Remove a redundant check in authenticated_dp
+    - drm/amd/display: Revert "Check HDCP returned status"
+    - zram: don't free statically defined names
+    - x86/amd_nb: Add new PCI IDs for AMD family 0x1a
+    - rtnetlink: change nlk->cb_mutex role
+    - rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag
+    - mpls: no longer hold RTNL in mpls_netconf_dump_devconf()
+    - phonet: no longer hold RTNL in route_dumpit()
+    - rcu/nocb: Make IRQs disablement symmetric
+    - HID: asus: add ROG Ally N-Key ID and keycodes
+    - HID: asus: add ROG Z13 lightbar
+    - hid-asus: add ROG Ally X prod ID to quirk list
+    - scsi: Revert "scsi: sd: Do not repeat the starting disk message"
+    - btrfs: fix uninitialized pointer free in add_inode_ref()
+    - btrfs: fix uninitialized pointer free on read_alloc_one_name() error
+    - ksmbd: fix user-after-free from session log off
+    - ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2
+    - mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow
+    - net: enetc: remove xdp_drops statistic from enetc_xdp_drop()
+    - net: enetc: block concurrent XDP transmissions during ring reconfiguration
+    - net: enetc: disable Tx BD rings after they are empty
+    - net: enetc: disable NAPI after all rings are disabled
+    - net: enetc: add missing static descriptor and inline keyword
+    - posix-clock: Fix missing timespec64 check in pc_clock_settime()
+    - udp: Compute L4 checksum as usual when not segmenting the skb
+    - arm64: probes: Remove broken LDR (literal) uprobe support
+    - arm64: probes: Fix simulate_ldr*_literal()
+    - arm64: probes: Fix uprobes for big-endian kernels
+    - net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-
+      link PHY
+    - net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()
+    - maple_tree: correct tree corruption on spanning store
+    - nilfs2: propagate directory read errors from nilfs_find_entry()
+    - fat: fix uninitialized variable
+    - mm/mremap: fix move_normal_pmd/retract_page_tables race
+    - mm/swapfile: skip HugeTLB pages for unuse_vma
+    - mm/damon/tests/sysfs-kunit.h: fix memory leak in
+      damon_sysfs_test_add_targets()
+    - tcp: fix mptcp DSS corruption due to large pmtu xmit
+    - net: fec: Move `fec_ptp_read()` to the top of the file
+    - net: fec: Remove duplicated code
+    - mptcp: prevent MPC handshake on port-based signal endpoints
+    - iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
+    - s390/sclp: Deactivate sclp after all its users
+    - s390/sclp_vt220: Convert newlines to CRLF instead of LFCR
+    - KVM: s390: gaccess: Check if guest address is in memslot
+    - KVM: s390: Change virtual to physical address access in diag 0x258 handler
+    - x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
+    - x86/cpufeatures: Add a IBPB_NO_RET BUG flag
+    - x86/entry: Have entry_ibpb() invalidate return predictions
+    - x86/bugs: Skip RSB fill at VMEXIT
+    - x86/bugs: Do not use UNTRAIN_RET with IBPB on entry
+    - fgraph: Use CPU hotplug mechanism to initialize idle shadow stacks
+    - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
+    - io_uring/sqpoll: close race on waiting for sqring entries
+    - blk-mq: setup queue ->tag_set before initializing hctx
+    - ublk: don't allow user copy for unprivileged device
+    - selftest: hid: add the missing tests directory
+    - Input: xpad - add support for MSI Claw A1M
+    - scsi: mpi3mr: Correct a test in mpi3mr_sas_port_add()
+    - scsi: mpi3mr: Validate SAS port assignments
+    - scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down
+    - scsi: ufs: core: Fix the issue of ICU failure
+    - scsi: ufs: core: Requeue aborted request
+    - drm/radeon: Fix encoder->possible_clones
+    - drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation
+    - drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible
+      mode
+    - drm/xe/xe_sync: initialise ufence.signalled
+    - drm/xe/ufence: ufence can be signaled right after wait_woken
+    - drm/vmwgfx: Cleanup kms setup without 3d
+    - drm/vmwgfx: Handle surface check failure correctly
+    - drm/amdgpu/pm: Fix code alignment issue
+    - drm/amdgpu/smu13: always apply the powersave optimization
+    - drm/amdgpu/swsmu: Only force workload setup on init
+    - iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig
+    - iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig
+    - iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig
+    - iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: hid-sensors: Fix an error handling path in
+      _hid_sensor_set_report_latency()
+    - iio: light: veml6030: fix ALS sensor resolution
+    - iio: light: veml6030: fix IIO device retrieval from embedded device
+    - iio: light: opt3001: add missing full-scale range value
+    - iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig
+    - iio: frequency: adf4377: add missing select REMAP_SPI in Kconfig
+    - iio: light: bu27008: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: resolver: ad2s1210 add missing select REGMAP in Kconfig
+    - iio: pressure: bm1390: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: adc: ti-lmp92064: add missing select REGMAP_SPI in Kconfig
+    - iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: resolver: ad2s1210: add missing select (TRIGGERED_)BUFFER in Kconfig
+    - iio: accel: kx022a: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - Bluetooth: Call iso_exit() on module unload
+    - Bluetooth: Remove debugfs directory on module init failure
+    - Bluetooth: ISO: Fix multiple init when debugfs is disabled
+    - Bluetooth: btusb: Fix not being able to reconnect after suspend
+    - Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
+    - vt: prevent kernel-infoleak in con_font_get()
+    - xhci: tegra: fix checked USB2 port number
+    - xhci: Fix incorrect stream context type macro
+    - xhci: Mitigate failed set dequeue pointer commands
+    - USB: serial: option: add support for Quectel EG916Q-GL
+    - USB: serial: option: add Telit FN920C04 MBIM compositions
+    - usb: typec: qcom-pmic-typec: fix sink status being overwritten with RP_DEF
+    - usb: dwc3: Wait for EndXfer completion before restoring GUSB2PHYCFG
+    - misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for EEPROM
+      device
+    - misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for OTP device
+    - serial: imx: Update mctrl old_status on RTSD interrupt
+    - parport: Proper fix for array out-of-bounds access
+    - x86/resctrl: Annotate get_mem_config() functions as __init
+    - x86/apic: Always explicitly disarm TSC-deadline timer
+    - x86/CPU/AMD: Only apply Zenbleed fix for Zen2 during late microcode load
+    - x86/entry_32: Do not clobber user EFLAGS.ZF
+    - x86/entry_32: Clear CPU buffers after register restore in NMI return
+    - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
+    - x86/bugs: Use code segment selector for VERW operand
+    - pinctrl: intel: platform: fix error path in device_for_each_child_node()
+    - pinctrl: ocelot: fix system hang on level based interrupts
+    - pinctrl: stm32: check devm_kasprintf() returned value
+    - pinctrl: apple: check devm_kasprintf() returned value
+    - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
+    - irqchip/sifive-plic: Unmask interrupt in plic_irq_enable()
+    - serial: qcom-geni: fix polled console initialisation
+    - serial: qcom-geni: revert broken hibernation support
+    - serial: qcom-geni: fix shutdown race
+    - serial: qcom-geni: fix dma rx cancellation
+    - serial: qcom-geni: fix receiver enable
+    - mm: vmscan.c: fix OOM on swap stress test
+    - ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne
+      1000 G2
+    - Upstream stable to v6.6.57, v6.11.5
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301)
+    - Revert "perf callchain: Fix stitch LBR memory leaks"
+    - ASoC: amd: acp: add ZSC control register programming sequence
+    - virtio: rename virtio_config_enabled to virtio_config_core_enabled
+    - virtio: allow driver to disable the configure change notification
+    - virtio-net: synchronize operstate with admin state on up/down
+    - virtio-net: synchronize probe with ndo_set_features
+    - wifi: rtw89: limit the PPDU length for VHT rate to 0x40000
+    - af_unix: Don't call skb_get() for OOB skb.
+    - af_unix: Remove single nest in manage_oob().
+    - af_unix: Rename unlinked_skb in manage_oob().
+    - af_unix: Move spin_lock() in manage_oob().
+    - iommu/amd: Move allocation of the top table into v1_alloc_pgtable
+    - iommu/amd: Set the pgsize_bitmap correctly
+    - drm/xe: Move and export xe_hw_engine lookup.
+    - drm/msm/dp: rename wide_bus_en to wide_bus_supported
+    - drm/msm/dp: enable widebus on all relevant chipsets
+    - bpf, arm64: Fix tailcall hierarchy
+    - libbpf: Don't take direct pointers into BTF data from st_ops
+    - s390/entry: Move early program check handler to entry.S
+    - selftests/bpf: fix to avoid __msg tag de-duplication by clang
+    - libbpf: Ensure new BTF objects inherit input endianness
+    - PCI: dwc: ep: Rename dw_pcie_ep_exit() to dw_pcie_ep_deinit()
+    - PCI: qcom-ep: Enable controller resources like PHY only after refclk is
+      available
+    - net: ravb: Fix maximum TX frame size for GbEth devices
+    - ravb: Make it clear the information relates to maximum frame size
+    - net: ravb: Fix R-Car RX frame size limit
+    - netfilter: nf_tables: missing objects with no memcg accounting
+    - PCI: dra7xx: Fix error handling when IRQ request fails in probe
+    - KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)
+    - intel_idle: fix ACPI _CST matching for newer Xeon platforms
+    - wifi: mt76: mt7925: fix a potential association failure upon resuming
+    - cifs: Remove intermediate object of failed create reparse call
+    - drm/amd/display: Disable replay if VRR capability is false
+    - drm/amd/display: Fix VRR cannot enable
+    - l2tp: free sessions using rcu
+    - net: skbuff: sprinkle more __GFP_NOWARN on ingress allocs
+    - nvme: fix metadata handling in nvme-passthrough
+    - wifi: wilc1000: Do not operate uninitialized hardware during suspend/resume
+    - x86/apic: Remove logical destination mode for 64-bit
+    - pmdomain: core: Use dev_name() instead of kobject_get_path() in debugfs
+    - drm/xe: Name and document Wa_14019789679
+    - drm/xe: Add timeout to preempt fences
+    - drm/amd/display: Fix possible overflow in integer multiplication
+    - ext4: fix error message when rejecting the default hash
+    - power: supply: Drop use_cnt check from power_supply_property_is_writeable()
+    - ALSA: hda/realtek: fix mute/micmute LED for HP mt645 G8
+    - drm/xe: Generate oob before compiling anything
+    - clk: qcom: gcc-sc8180x: Register QUPv3 RCGs for DFS on sc8180x
+    - drm/amd/display: Restore Optimized pbn Value if Failed to Disable DSC
+    - Revert "drm/amd/display: Skip Recompute DSC Params if no Stream on Link"
+    - pmdomain: core: Reduce debug summary table width
+    - fs/ntfs3: Do not call file_modified if collapse range failed
+    - fs/ntfs3: Optimize large writes into sparse file
+    - fs/ntfs3: Fix sparse warning in ni_fiemap
+    - fs/ntfs3: Refactor enum_rstbl to suppress static checker
+    - virtio_console: fix misc probe bugs
+    - ntfs3: Change to non-blocking allocation in ntfs_d_hash
+    - bpf: Call the missed btf_record_free() when map creation fails
+    - selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
+    - bpf: Check percpu map value size first
+    - s390/facility: Disable compile time optimization for decompressor code
+    - s390/mm: Add cond_resched() to cmm_alloc/free_pages()
+    - bpf, x64: Fix a jit convergence issue
+    - ext4: nested locking for xattr inode
+    - s390/cpum_sf: Remove WARN_ON_ONCE statements
+    - ktest.pl: Avoid false positives with grub2 skip regex
+    - soundwire: intel_bus_common: enable interrupts before exiting reset
+    - PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
+    - clk: bcm: bcm53573: fix OF node leak in init
+    - PCI: Add ACS quirk for Qualcomm SA8775P
+    - i2c: i801: Use a different adapter-name for IDF adapters
+    - PCI: Mark Creative Labs EMU20k2 INTx masking as broken
+    - RISC-V: Don't have MAX_PHYSMEM_BITS exceed phys_addr_t
+    - mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less strict
+    - mfd: intel-lpss: Add Intel Arrow Lake-H LPSS PCI IDs
+    - mfd: intel-lpss: Rename SPI intel_lpss_platform_info structs
+    - mfd: intel-lpss: Add Intel Panther Lake LPSS PCI IDs
+    - riscv: Omit optimized string routines when using KASAN
+    - riscv: avoid Imbalance in RAS
+    - RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
+    - PCI: qcom: Disable mirroring of DBI and iATU register space in BAR region
+    - PCI: endpoint: Assign PCI domain number for endpoint controllers
+    - soundwire: cadence: re-check Peripheral status with delayed_work
+    - riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16
+      unknown
+    - media: videobuf2-core: clear memory related fields in
+      __vb2_plane_dmabuf_put()
+    - remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
+    - usb: chipidea: udc: enable suspend interrupt after usb reset
+    - usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the
+      Crashkernel Scenario
+    - xhci: dbc: Fix STALL transfer event handling
+    - usb: host: xhci-plat: Parse xhci-missing_cas_quirk and apply quirk
+    - comedi: ni_routing: tools: Check when the file could not be opened
+    - LoongArch: Fix memleak in pci_acpi_scan_root()
+    - netfilter: nf_nat: don't try nat source port reallocation for reverse dir
+      clash
+    - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
+    - tools/iio: Add memory allocation failure check for trigger_name
+    - staging: vme_user: added bound check to geoid
+    - driver core: bus: Return -EIO instead of 0 when show/store invalid bus
+      attribute
+    - scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in
+      lpfc_els_flush_cmd()
+    - scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR to
+      KERN_WARNING
+    - NFSD: Mark filecache "down" if init fails
+    - nfsd: nfsd_destroy_serv() must call svc_destroy() even if nfsd_startup_net()
+      failed
+    - ice: set correct dst VSI in only LAN filters
+    - ice: clear port vlan config during reset
+    - ice: disallow DPLL_PIN_STATE_SELECTABLE for dpll output pins
+    - ice: fix VLAN replay after reset
+    - SUNRPC: Fix integer overflow in decode_rc_list()
+    - tcp: fix to allow timestamp undo if no retransmits were sent
+    - tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
+    - tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out
+    - rxrpc: Fix uninitialised variable in rxrpc_send_data()
+    - selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids()
+      test
+    - Bluetooth: btusb: Don't fail external suspend requests
+    - net: phy: bcm84881: Fix some error handling paths
+    - Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
+    - net: ethernet: adi: adin1110: Fix some error handling path in
+      adin1110_read_fifo()
+    - net: dsa: b53: fix jumbo frame mtu check
+    - net: dsa: b53: fix max MTU for 1g switches
+    - net: dsa: b53: fix max MTU for BCM5325/BCM5365
+    - net: dsa: b53: allow lower MTUs on BCM5325/5365
+    - net: dsa: b53: fix jumbo frames on 10/100 ports
+    - drm/nouveau: pass cli to nouveau_channel_new() instead of drm+device
+    - nouveau/dmem: Fix privileged error in copy engine channel
+    - gpio: aspeed: Add the flush write to ensure the write complete.
+    - gpio: aspeed: Use devm_clk api to manage clock source
+    - powercap: intel_rapl_tpmi: Ignore minor version change
+    - ice: Fix netif_is_ice() in Safe Mode
+    - ice: Flush FDB entries before reset
+    - e1000e: change I219 (19) devices to ADP
+    - net: ibm: emac: mal: fix wrong goto
+    - btrfs: zoned: fix missing RCU locking in error message when loading zone
+      info
+    - sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
+    - netfilter: fib: check correct rtable in vrf setups
+    - net: ibm: emac: mal: add dcr_unmap to _remove
+    - net: dsa: refuse cross-chip mirroring operations
+    - rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
+    - vxlan: Handle error of rtnl_register_module().
+    - bridge: Handle error of rtnl_register_module().
+    - mctp: Handle error of rtnl_register_module().
+    - mpls: Handle error of rtnl_register_module().
+    - phonet: Handle error of rtnl_register_module().
+    - rcu/nocb: Fix rcuog wake-up from offline softirq
+    - x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h
+    - HID: multitouch: Add support for lenovo Y9000P Touchpad
+    - hwmon: intel-m10-bmc-hwmon: relabel Columbiaville to CVL Die Temperature
+    - hwmon: (tmp513) Add missing dependency on REGMAP_I2C
+    - hwmon: (mc34vr500) Add missing dependency on REGMAP_I2C
+    - hwmon: (adm9240) Add missing dependency on REGMAP_I2C
+    - hwmon: (adt7470) Add missing dependency on REGMAP_I2C
+    - hwmon: (ltc2991) Add missing dependency on REGMAP_I2C
+    - HID: plantronics: Workaround for an unexcepted opposite volume key
+    - Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
+    - usb: dwc3: core: Stop processing of pending events if controller is halted
+    - usb: xhci: Fix problem with xhci resume from suspend
+    - usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
+    - usb: dwc3: re-enable runtime PM after failed resume
+    - usb: gadget: core: force synchronous registration
+    - hid: intel-ish-hid: Fix uninitialized variable 'rv' in
+      ish_fw_xfer_direct_dma
+    - ACPI: resource: Make Asus ExpertBook B2402 matches cover more models
+    - ACPI: resource: Make Asus ExpertBook B2502 matches cover more models
+    - drm/amdkfd: Fix an eviction fence leak
+    - drm/amd/display: fix hibernate entry for DCN35+
+    - drm/xe/guc_submit: fix xa_store() error checking
+    - drm/i915/hdcp: fix connector refcounting
+    - drm/xe/ct: fix xa_store() error checking
+    - scsi: ufs: Use pre-calculated offsets in ufshcd_init_lrb()
+    - mmc: sdhci-of-dwcmshc: Prevent stale command interrupt handling
+    - mptcp: fallback when MPTCP opts are dropped after 1st data
+    - ata: libata: avoid superfluous disk spin down + spin up during hibernation
+    - OPP: fix error code in dev_pm_opp_set_config()
+    - net: dsa: lan9303: ensure chip reset and wait for READY status
+    - mptcp: pm: do not remove closing subflows
+    - powercap: intel_rapl_tpmi: Fix bogus register reading
+    - selftests/mm: fix incorrect buffer->mirror size in hmm2 double_map test
+    - selftests/rseq: Fix mm_cid test failure
+    - btrfs: split remaining space to discard in chunks
+    - btrfs: add cancellation points to trim loops
+    - fs/proc/kcore.c: allow translation of physical memory addresses
+    - io_uring/rw: fix cflags posting for single issue multishot read
+    - Upstream stable to v6.6.56, v6.11.1, v6.11.2, v6.11.3, v6.11.4
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50182
+    - secretmem: disable memfd_secret() if arch cannot set direct map
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50019
+    - kthread: unpark only parked kthread
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50096
+    - nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50020
+    - ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50021
+    - ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins()
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50022
+    - device-dax: correct pgoff align in dax_set_mapping()
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50185
+    - mptcp: handle consistently DSS corruption
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50023
+    - net: phy: Remove LED entry from LEDs list on unregister
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50024
+    - net: Fix an unsafe loop on the list
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50186
+    - net: explicitly clear the sk pointer, when pf->create fails
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50025
+    - scsi: fnic: Move flush_work initialization out of if block
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50026
+    - scsi: wd33c93: Don't use stale scsi_pointer value
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50027
+    - thermal: core: Free tzp copy along with the thermal zone
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50028
+    - thermal: core: Reference count the zone in thermal_zone_get_by_id()
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50029
+    - Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50030
+    - drm/xe/ct: prevent UAF in send_recv()
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50187
+    - drm/vc4: Stop the active perfmon before being destroyed
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50031
+    - drm/v3d: Stop the active perfmon before being destroyed
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50189
+    - HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50033
+    - slip: make slhc_remember() more robust against malicious packets
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50035
+    - ppp: fix ppp_async_encode() illegal access
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50036
+    - net: do not delay dst_entries_add() in dst_release()
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50038
+    - netfilter: xtables: avoid NFPROTO_UNSPEC where needed
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50039
+    - net/sched: accept TCA_STAB only for root qdisc
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50040
+    - igb: Do not bring the device up after non-fatal error
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50041
+    - i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50042
+    - ice: Fix increasing MSI-X on VF
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50093
+    - thermal: intel: int340x: processor: Fix warning during module unload
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50044
+    - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50045
+    - netfilter: br_netfilter: fix panic with metadata_dst skb
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50188
+    - net: phy: dp83869: fix memory corruption when enabling fiber
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50046
+    - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50180
+    - fbdev: sisfb: Fix strbuf array overflow
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50047
+    - smb: client: fix UAF in async decryption
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50048
+    - fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50049
+    - drm/amd/display: Check null pointer before dereferencing se
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50090
+    - drm/xe/oa: Fix overflow in oa batch buffer
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50183
+    - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV
+      instance
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50055
+    - driver core: bus: Fix double free in driver API bus_register()
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50056
+    - usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50184
+    - virtio_pmem: Check device status before requesting flush
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50057
+    - usb: typec: tipd: Free IRQ only if it was requested before
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50058
+    - serial: protect uart_port_dtr_rts() in uart_shutdown() too
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50181
+    - clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50059
+    - ntb: ntb_hw_switchtec: Fix use after free vulnerability in
+      switchtec_ntb_remove due to race condition
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50060
+    - io_uring: check if we need to reschedule during overflow flush
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50061
+    - i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master
+      Driver Due to Race Condition
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50062
+    - RDMA/rtrs-srv: Avoid null pointer deref during path establishment
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50095
+    - RDMA/mad: Improve handling of timed out WRs of mad agent
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50063
+    - bpf: Prevent tail call between progs attached to different hooks
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50191
+    - ext4: don't set SB_RDONLY after filesystem errors
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50064
+    - zram: free secondary algorithms names
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50089
+    - unicode: Don't special case ignorable code points
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49865
+    - drm/xe/vm: move xa_alloc to prevent UAF
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49968
+    - ext4: filesystems without casefold feature cannot be mounted with siphash
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49893
+    - drm/amd/display: Check stream_status before it is used
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49972
+    - drm/amd/display: Deallocate DML memory if allocation fails
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49914
+    - drm/amd/display: Add null check for pipe_ctx->plane_state in
+      dcn20_program_pipe
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49920
+    - drm/amd/display: Check null pointers before multiple uses
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49921
+    - drm/amd/display: Check null pointers before used
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50009
+    - cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-47726
+    - f2fs: fix to wait dio completion
+
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-47711
+    - af_unix: Don't return OOB skb in manage_oob().
+
+  * CVE-2024-53170
+    - block: fix uaf for flush rq while iterating tags
+
+  * CVE-2024-50148
+    - Bluetooth: bnep: fix wild-memory-access in proto_unregister
+
+  * CVE-2024-50134
+    - drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real
+      VLA
+
+  * CVE-2024-50171
+    - net: systemport: fix potential memory leak in bcm_sysport_xmit()
+
+  * CVE-2024-50229
+    - nilfs2: fix potential deadlock with newly created symlinks
+
+  * CVE-2024-50233
+    - staging: iio: frequency: ad9832: fix division by zero in
+      ad9832_calc_freqreg()
+
+  * [Lenovo Ubuntu 24.04 Bug] dmesg show "spi-nor: probe of spi0.0 failed with
+    error -95" (LP: #2070339)
+    - mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported
+    - mtd: core: Align comment with an action in mtd_otp_nvmem_add()
+
+  * python perf module missing in realtime kernel (LP: #2089411)
+    - [Packaging] linux-tools: Add missing python perf symlink
+    - [Packaging] linux-tools: Fix python perf library packaging
+    - [Packaging] linux-tools: Fall back to old python perf path
+
+  * CVE-2024-53104
+    - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in
+      uvc_parse_format
+
+ -- Mehmet Basaran <mehmet.basaran@canonical.com>  Fri, 14 Feb 2025 16:04:25 +0300
+
+linux (6.8.0-54.56) noble; urgency=medium
+
+  * CVE-2025-0927
+    - SAUCE: fs: hfs/hfsplus: add key_len boundary check to hfs_bnode_read_key
+
+ -- Manuel Diewald <manuel.diewald@canonical.com>  Fri, 07 Feb 2025 22:09:50 +0100
+
+linux (6.8.0-53.55) noble; urgency=medium
+
+  * noble/linux: 6.8.0-53.55 -proposed tracker (LP: #2093677)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2025.01.13)
+
+  * generate and ship vmlinux.h to allow packages to build BPF CO-RE
+    (LP: #2050083)
+    - [Packaging] add linux-bpf-dev package
+    - [Packaging] do not attempt to generate BTF header on armhf
+
+  * Unable to boot as a guest on VMware ESX (LP: #2091941)
+    - ptp/vmware: Use VMware hypercall API
+    - input/vmmouse: Use VMware hypercall API
+    - drm/vmwgfx: Use VMware hypercall API
+    - x86/vmware: Use VMware hypercall API
+    - x86/vmware: Correct macro names
+    - x86/vmware: Remove legacy VMWARE_HYPERCALL* macros
+
+  * When /dev/vmbus/hv_kvp is not present, disable hv-kvp-daemon (LP: #2091744)
+    - [Packaging] disable hv-kvp-daemon if needed
+
+  * Backport "netkit: Add option for scrubbing skb meta data" to 6.8
+    (LP: #2091184)
+    - netkit: Add option for scrubbing skb meta data
+
+  * KVM: Cache CPUID at KVM.ko module init to reduce latency of VM-Enter and VM-
+    Exit (LP: #2093146)
+    - KVM: x86: Cache CPUID.0xD XSTATE offsets+sizes during module init
+
+  * [SRU] add support of QCA BT 0489:e0fc (LP: #2085406)
+    - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x
+
+  * ice driver RTNL assertion failed warning on shutdown/reboot (LP: #2091107)
+    - ice: Remove and readd netdev during devlink reload
+
+  * vfio_pci soft lockup on VM start while using PCIe passthrough (LP: #2089306)
+    - SAUCE: Revert "vfio/pci: Insert full vma on mmap'd MMIO fault"
+    - SAUCE: Revert "vfio/pci: Use unmap_mapping_range()"
+
+  * [SRU] Fix error of resume on rtl8168fp (LP: #2087507)
+    - r8169: avoid unsolicited interrupts
+
+  * [SRU] power: intel_pstate: HWP interrupt support for maximum ratio changed
+    (LP: #2090852)
+    - x86/cpufeatures: Add HWP highest perf change feature flag
+    - cpufreq: intel_pstate: Support highest performance change interrupt
+
+  * Noble update: upstream stable patchset 2024-11-29 (LP: #2089884)
+    - static_call: Handle module init failure correctly in
+      static_call_del_module()
+    - static_call: Replace pointless WARN_ON() in static_call_module_notify()
+    - jump_label: Simplify and clarify static_key_fast_inc_cpus_locked()
+    - jump_label: Fix static_key_slow_dec() yet again
+    - scsi: st: Fix input/output error on empty drive reset
+    - scsi: pm8001: Do not overwrite PCI queue mapping
+    - drm/amdgpu: Fix get each xcp macro
+    - mailbox: rockchip: fix a typo in module autoloading
+    - mailbox: bcm2835: Fix timeout during suspend mode
+    - ceph: remove the incorrect Fw reference check when dirtying pages
+    - ieee802154: Fix build error
+    - net: sparx5: Fix invalid timestamps
+    - net/mlx5: Fix error path in multi-packet WQE transmit
+    - net/mlx5: Added cond_resched() to crdump collection
+    - net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
+    - net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
+    - netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
+    - net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
+    - net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
+    - selftests: netfilter: Fix nft_audit.sh for newer nft binaries
+    - netfilter: nf_tables: prevent nf_skb_duplicated corruption
+    - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
+    - Bluetooth: MGMT: Fix possible deadlocks
+    - Bluetooth: L2CAP: Fix uaf in l2cap_connect
+    - Bluetooth: hci_core: Fix calling mgmt_device_connected
+    - Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
+    - net: Add netif_get_gro_max_size helper for GRO
+    - net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_size
+    - net: ethernet: lantiq_etop: fix memory disclosure
+    - net: fec: Restart PPS after link state change
+    - net: fec: Reload PTP registers after link-state change
+    - net: avoid potential underflow in qdisc_pkt_len_init() with UFO
+    - net: add more sanity checks to qdisc_pkt_len_init()
+    - net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
+    - ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
+    - net: test for not too small csum_start in virtio_net_hdr_to_skb()
+    - ppp: do not assume bh is held in ppp_channel_bridge_input()
+    - iomap: constrain the file range passed to iomap_file_unshare
+    - dt-bindings: net: xlnx,axi-ethernet: Add missing reg minItems
+    - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
+    - i2c: xiic: improve error message when transfer fails to start
+    - i2c: xiic: Try re-initialization on bus busy timeout
+    - loop: don't set QUEUE_FLAG_NOMERGES
+    - ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is
+      uninitialized
+    - ALSA: mixer_oss: Remove some incorrect kfree_const() usages
+    - ALSA: hda/realtek: Fix the push button function for the ALC257
+    - ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
+    - ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
+    - cifs: Fix buffer overflow when parsing NFS reparse points
+    - cifs: Do not convert delimiter when parsing NFS-style symlinks
+    - ALSA: gus: Fix some error handling paths related to get_bpos() usage
+    - ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
+    - wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
+    - wifi: rtw89: avoid to add interface to list twice when SER
+    - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
+    - crypto: x86/sha256 - Add parentheses around macros' single arguments
+    - crypto: octeontx - Fix authenc setkey
+    - crypto: octeontx2 - Fix authenc setkey
+    - ice: Adjust over allocation of memory in ice_sched_add_root_node() and
+      ice_sched_add_node()
+    - wifi: iwlwifi: mvm: Fix a race in scan abort flow
+    - wifi: iwlwifi: mvm: drop wrong STA selection in TX
+    - wifi: cfg80211: Set correct chandef when starting CAC
+    - net/xen-netback: prevent UAF in xenvif_flush_hash()
+    - net: hisilicon: hip04: fix OF node leak in probe()
+    - net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
+    - net: hisilicon: hns_mdio: fix OF node leak in probe()
+    - ACPI: PAD: fix crash in exit_round_robin()
+    - ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
+    - ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
+    - e1000e: avoid failing the system during pm_suspend
+    - wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
+    - net: sched: consistently use rcu_replace_pointer() in taprio_change()
+    - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
+    - Bluetooth: btrtl: Set msft ext address filter quirk for RTL8852B
+    - ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
+    - ACPI: CPPC: Add support for setting EPP register in FFH
+    - blk_iocost: fix more out of bound shifts
+    - wifi: ath12k: fix array out-of-bound access in SoC stats
+    - wifi: ath11k: fix array out-of-bound access in SoC stats
+    - wifi: rtw88: select WANT_DEV_COREDUMP
+    - ACPI: EC: Do not release locks during operation region accesses
+    - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in
+      acpi_db_convert_to_package()
+    - tipc: guard against string buffer overrun
+    - net: mvpp2: Increase size of queue_name buffer
+    - bnxt_en: Extend maximum length of version string by 1 byte
+    - ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
+    - wifi: rtw89: correct base HT rate mask for firmware
+    - ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
+    - net: atlantic: Avoid warning about potential string truncation
+    - crypto: simd - Do not call crypto_alloc_tfm during registration
+    - netpoll: Ensure clean state on setup failures
+    - tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
+    - wifi: iwlwifi: mvm: use correct key iteration
+    - wifi: iwlwifi: mvm: avoid NULL pointer dereference
+    - ACPICA: iasl: handle empty connection_node
+    - proc: add config & param to block forcing mem writes
+    - [Config] updateconfigs to select PROC_MEM_ALWAYS_FORCE
+    - drivers/perf: arm_spe: Use perf_allow_kernel() for permissions
+    - can: netlink: avoid call to do_set_data_bittiming callback with stale
+      can_priv::ctrlmode
+    - wifi: mt76: mt7915: add dummy HW offload of IEEE 802.11 fragmentation
+    - wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
+    - wifi: mwifiex: Fix memcpy() field-spanning write warning in
+      mwifiex_cmd_802_11_scan_ext()
+    - nfp: Use IRQF_NO_AUTOEN flag in request_irq()
+    - ALSA: usb-audio: Add input value sanity checks for standard types
+    - x86/ioapic: Handle allocation failures gracefully
+    - ALSA: usb-audio: Define macros for quirk table entries
+    - ALSA: usb-audio: Replace complex quirk lines with macros
+    - ALSA: usb-audio: Add logitech Audio profile quirk
+    - ASoC: codecs: wsa883x: Handle reading version failure
+    - tools/x86/kcpuid: Protect against faulty "max subleaf" values
+    - x86/pkeys: Add PKRU as a parameter in signal handling functions
+    - x86/pkeys: Restore altstack access in sigreturn()
+    - x86/kexec: Add EFI config table identity mapping for kexec kernel
+    - ALSA: asihpi: Fix potential OOB array access
+    - ALSA: hdsp: Break infinite MIDI input flush loop
+    - tools/nolibc: powerpc: limit stack-protector workaround to GCC
+    - selftests/nolibc: avoid passing NULL to printf("%s")
+    - x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
+    - hwmon: (nct6775) add G15CF to ASUS WMI monitoring list
+    - fbdev: efifb: Register sysfs groups through driver core
+    - fbdev: pxafb: Fix possible use after free in pxafb_task()
+    - rcuscale: Provide clear error when async specified without primitives
+    - power: reset: brcmstb: Do not go into infinite loop if reset fails
+    - iommu/vt-d: Always reserve a domain ID for identity setup
+    - iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
+    - drm/stm: Avoid use-after-free issues with crtc and plane
+    - drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
+    - drm/amdgpu: prevent BO_HANDLES error from being overwritten
+    - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
+    - drm/amd/display: Add null check for top_pipe_to_program in
+      commit_planes_for_stream
+    - ata: pata_serverworks: Do not use the term blacklist
+    - ata: sata_sil: Rename sil_blacklist to sil_quirks
+    - HID: Ignore battery for all ELAN I2C-HID devices
+    - drm/amd/display: Handle null 'stream_status' in
+      'planes_changed_for_existing_stream'
+    - drm/amd/display: Check null pointers before using dc->clk_mgr
+    - drm/amd/display: Add null check for 'afb' in
+      amdgpu_dm_plane_handle_cursor_update (v2)
+    - drm/amd/display: fix double free issue during amdgpu module unload
+    - jfs: UBSAN: shift-out-of-bounds in dbFindBits
+    - jfs: Fix uaf in dbFreeBits
+    - jfs: check if leafidx greater than num leaves per dmap tree
+    - scsi: smartpqi: correct stream detection
+    - drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
+    - jfs: Fix uninit-value access of new_ea in ea_buffer
+    - drm/amdgpu: add raven1 gfxoff quirk
+    - drm/amdgpu: enable gfxoff quirk on HP 705G4
+    - drm/amdkfd: Fix resource leak in criu restore queue
+    - HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
+    - platform/x86: touchscreen_dmi: add nanote-next quirk
+    - drm/stm: ltdc: reset plane transparency after plane disable
+    - drm/amd/display: Check stream before comparing them
+    - drm/amd/display: Check link_res->hpo_dp_link_enc before using it
+    - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format
+      translation
+    - drm/amd/display: Fix index out of bounds in degamma hardware format
+      translation
+    - drm/amd/display: Fix index out of bounds in DCN30 color transformation
+    - drm/amd/display: Avoid overflow assignment in link_dp_cts
+    - drm/amd/display: Initialize get_bytes_per_element's default to 1
+    - drm/printer: Allow NULL data in devcoredump printer
+    - perf,x86: avoid missing caller address in stack traces captured in uprobe
+    - scsi: lpfc: Update PRLO handling in direct attached topology
+    - drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
+    - perf: Fix event_function_call() locking
+    - scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
+    - drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
+    - drm/amdgpu: Block MMR_READ IOCTL in reset
+    - drm/amdgpu/gfx9: use rlc safe mode for soft recovery
+    - drm/amd/pm: ensure the fw_info is not null before using it
+    - of/irq: Refer to actual buffer size in of_irq_parse_one()
+    - powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
+    - drm/amdgpu/gfx11: use rlc safe mode for soft recovery
+    - drm/amdgpu/gfx10: use rlc safe mode for soft recovery
+    - platform/x86: lenovo-ymc: Ignore the 0x0 state
+    - ksmbd: add refcnt to ksmbd_conn struct
+    - ksmbd: fix use-after-free in SMB request handling
+    - bpf: Make the pointer returned by iter next method valid
+    - ext4: ext4_search_dir should return a proper error
+    - ext4: avoid use-after-free in ext4_ext_show_leaf()
+    - ext4: fix i_data_sem unlock order in ext4_ind_migrate()
+    - bpftool: Fix undefined behavior caused by shifting into the sign bit
+    - iomap: handle a post-direct I/O invalidate race in
+      iomap_write_delalloc_release
+    - bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
+    - spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - spi: spi-cadence: Fix missing spi_controller_is_target() check
+    - selftest: hid: add missing run-hid-tools-tests.sh
+    - spi: s3c64xx: fix timeout counters in flush_fifo
+    - selftests: breakpoints: use remaining time to check if suspend succeed
+    - accel/ivpu: Add missing MODULE_FIRMWARE metadata
+    - spi: rpc-if: Add missing MODULE_DEVICE_TABLE
+    - perf: Really fix event_function_call() locking
+    - selftests: vDSO: fix vDSO name for powerpc
+    - selftests: vDSO: fix vdso_config for powerpc
+    - selftests: vDSO: fix vDSO symbols lookup for powerpc64
+    - powerpc/vdso: Flag VDSO64 entry points as functions
+    - selftests/mm: fix charge_reserved_hugetlb.sh test
+    - powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
+    - selftests: vDSO: fix ELF hash table entry size for s390x
+    - selftests: vDSO: fix vdso_config for s390
+    - Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
+    - platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
+    - i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
+    - i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
+    - i2c: xiic: Wait for TX empty to avoid missed TX NAKs
+    - media: i2c: ar0521: Use cansleep version of gpiod_set_value()
+    - i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - i2c: designware: fix controller is holding SCL low while ENABLE bit is
+      disabled
+    - rust: sync: require `T: Sync` for `LockedBy::access`
+    - ovl: fail if trusted xattrs are needed but caller lacks permission
+    - firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
+    - memory: tegra186-emc: drop unused to_tegra186_emc()
+    - dt-bindings: clock: exynos7885: Fix duplicated binding
+    - spi: bcm63xx: Fix module autoloading
+    - spi: bcm63xx: Fix missing pm_runtime_disable()
+    - power: supply: hwmon: Fix missing temp1_max_alarm attribute
+    - perf/core: Fix small negative period being ignored
+    - parisc: Fix itlb miss handler for 64-bit programs
+    - drm/mediatek: ovl_adaptor: Add missing of_node_put()
+    - drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
+    - ALSA: hda/tas2781: Add new quirk for Lenovo Y990 Laptop
+    - ALSA: core: add isascii() check to card ID generator
+    - ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
+    - ALSA: usb-audio: Add native DSD support for Luxman D-08u
+    - ALSA: line6: add hw monitor volume control to POD HD500X
+    - ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
+    - ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
+    - ext4: correct encrypted dentry name hash when not casefolded
+    - ext4: fix slab-use-after-free in ext4_split_extent_at()
+    - ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
+    - ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible()
+    - ext4: dax: fix overflowing extents beyond inode size when partially writing
+    - ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
+    - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
+    - ext4: aovid use-after-free in ext4_ext_insert_extent()
+    - ext4: fix double brelse() the buffer of the extents path
+    - ext4: fix timer use-after-free on failed mount
+    - ext4: update orig_path in ext4_find_extent()
+    - ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
+    - ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list()
+    - ext4: fix fast commit inode enqueueing during a full journal commit
+    - ext4: use handle to mark fc as ineligible in __track_dentry_update()
+    - ext4: mark fc as ineligible using an handle in ext4_xattr_set()
+    - parisc: Fix 64-bit userspace syscall path
+    - parisc: Allow mmap(MAP_STACK) memory to automatically expand upwards
+    - parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
+    - drm/rockchip: vop: clear DMA stop bit on RK3066
+    - of: address: Report error on resource bounds overflow
+    - of/irq: Support #msi-cells=<0> in of_msi_get_domain
+    - drm: omapdrm: Add missing check for alloc_ordered_workqueue
+    - resource: fix region_intersects() vs add_memory_driver_managed()
+    - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
+    - jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
+    - mm: krealloc: consider spare memory for __GFP_ZERO
+    - mm: krealloc: Fix MTE false alarm in __do_krealloc
+    - ocfs2: fix the la space leak when unmounting an ocfs2 volume
+    - ocfs2: fix uninit-value in ocfs2_get_block()
+    - ocfs2: reserve space for inline xattr before attaching reflink tree
+    - ocfs2: cancel dqi_sync_work before freeing oinfo
+    - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
+    - ocfs2: fix null-ptr-deref when journal load failed.
+    - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
+    - arm64: fix selection of HAVE_DYNAMIC_FTRACE_WITH_ARGS
+    - arm64: Subscribe Microsoft Azure Cobalt 100 to erratum 3194386
+    - riscv: define ILLEGAL_POINTER_VALUE for 64bit
+    - [Config] updateconfigs to set ILLEGAL_POINTER_VALUE for riscv64
+    - exfat: fix memory leak in exfat_load_bitmap()
+    - perf python: Disable -Wno-cast-function-type-mismatch if present on clang
+    - perf hist: Update hist symbol when updating maps
+    - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
+    - nfsd: map the EBADMSG to nfserr_io to avoid warning
+    - NFSD: Fix NFSv4's PUTPUBFH operation
+    - i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver
+      Due to Race Condition
+    - RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page
+    - riscv: Fix kernel stack size when KASAN is enabled
+    - aoe: fix the potential use-after-free problem in more places
+    - media: ov5675: Fix power on/off delay timings
+    - clk: rockchip: fix error for unknown clocks
+    - remoteproc: k3-r5: Fix error handling when power-up failed
+    - clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
+    - media: sun4i_csi: Implement link validate for sun4i_csi subdev
+    - clk: qcom: gcc-sm8450: Do not turn off PCIe GDSCs during gdsc_disable()
+    - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
+    - clk: qcom: clk-rpmh: Fix overflow in BCM vote
+    - clk: samsung: exynos7885: Update CLKS_NR_FSYS after bindings fix
+    - clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src
+    - media: venus: fix use after free bug in venus_remove due to race condition
+    - clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
+    - media: qcom: camss: Remove use_count guard in stop_streaming
+    - media: qcom: camss: Fix ordering of pm_runtime_enable
+    - clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table
+    - clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL
+    - smb: client: use actual path when queryfs
+    - smb3: fix incorrect mode displayed for read-only files
+    - iio: magnetometer: ak8975: Fix reading for ak099xx sensors
+    - vrf: revert "vrf: Remove unnecessary RCU-bh critical section"
+    - gso: fix udp gso fraglist segmentation after pull from frag_list
+    - tomoyo: fallback to realpath if symlink's pathname does not exist
+    - net: stmmac: Fix zero-division error when disabling tc cbs
+    - rtc: at91sam9: fix OF node leak in probe() error path
+    - Input: adp5589-keys - fix NULL pointer dereference
+    - Input: adp5589-keys - fix adp5589_gpio_get_value()
+    - cachefiles: fix dentry leak in cachefiles_open_file()
+    - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
+    - btrfs: send: fix invalid clone operation for file that got its size
+      decreased
+    - btrfs: wait for fixup workers before stopping cleaner kthread during umount
+    - cpufreq: Avoid a bad reference count on CPU node
+    - gpio: davinci: fix lazy disable
+    - net: pcs: xpcs: fix the wrong register that was written back
+    - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
+    - mac802154: Fix potential RCU dereference issue in mac802154_scan_worker
+    - ceph: fix cap ref leak via netfs init_request
+    - tracing/hwlat: Fix a race during cpuhp processing
+    - tracing/timerlat: Drop interface_lock in stop_kthread()
+    - tracing/timerlat: Fix a race during cpuhp processing
+    - tracing/timerlat: Fix duplicated kthread creation due to CPU online/offline
+    - rtla: Fix the help text in osnoise and timerlat top tools
+    - drm/i915/gem: fix bitwise and logical AND mixup
+    - drm/sched: Add locking to drm_sched_entity_modify_sched
+    - drm/amd/display: Add HDR workaround for specific eDP
+    - cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock
+    - kconfig: qconf: fix buffer overflow in debug links
+    - platform/x86: x86-android-tablets: Fix use after free on
+      platform_device_register() errors
+    - i2c: core: Lock address during client device instantiation
+    - i2c: synquacer: Remove a clk reference from struct synquacer_i2c
+    - i2c: synquacer: Deal with optional PCLK correctly
+    - arm64: cputype: Add Neoverse-N3 definitions
+    - arm64: errata: Expand speculative SSBS workaround once more
+    - io_uring/net: harden multishot termination case for recv
+    - uprobes: fix kernel info leak via "[uprobes]" vma
+    - mm: z3fold: deprecate CONFIG_Z3FOLD
+    - [Config] updateconfigs for deprecated CONFIG_Z3FOLD
+    - drm/amd/display: Allow backlight to go below
+      `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT`
+    - build-id: require program headers to be right after ELF header
+    - lib/buildid: harden build ID parsing logic
+    - sched: psi: fix bogus pressure spikes from aggregation race
+    - net: mana: Enable MANA driver on ARM64 with 4K page size
+    - net: mana: Add support for page sizes other than 4KB on ARM64
+    - [Config] updateconfigs for MICROSOFT_MANA
+    - RDMA/mana_ib: use the correct page table index based on hardware page size
+    - media: imx335: Fix reset-gpio handling
+    - remoteproc: k3-r5: Acquire mailbox handle during probe routine
+    - remoteproc: k3-r5: Delay notification of wakeup event
+    - dt-bindings: clock: qcom: Add missing UFS QREF clocks
+    - dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
+    - iio: pressure: bmp280: Improve indentation and line wrapping
+    - iio: pressure: bmp280: Use BME prefix for BME280 specifics
+    - iio: pressure: bmp280: Fix regmap for BMP280 device
+    - iio: pressure: bmp280: Fix waiting time for BMP3xx configuration
+    - r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
+    - r8169: add tally counter fields added with RTL8125
+    - clk: qcom: gcc-sc8180x: Add GPLL9 support
+    - ACPI: battery: Simplify battery hook locking
+    - ACPI: battery: Fix possible crash when unregistering a battery hook
+    - btrfs: drop the backref cache during relocation if we commit
+    - drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
+    - rxrpc: Fix a race between socket set up and I/O thread creation
+    - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
+    - crypto: octeontx* - Select CRYPTO_AUTHENC
+    - drm/amd/display: Revert Avoid overflow assignment
+    - perf report: Fix segfault when 'sym' sort key is not used
+    - drm/amd/display: enable_hpo_dp_link_output: Check link_res->hpo_dp_link_enc
+      before using it
+    - Revert "ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path"
+    - perf python: Allow checking for the existence of warning options in clang
+    - drm/i915/dp: Fix AUX IO power enabling for eDP PSR
+    - drm/amd/display: handle nulled pipe context in DCE110's set_drr()
+    - selftests: netfilter: Add missing return value
+    - afs: Fix the setting of the server responding flag
+    - net: dsa: improve shutdown sequence
+    - bridge: mcast: Fail MDB get request on empty entry
+    - net/ncsi: Disable the ncsi work before freeing the associated structure
+    - drm/xe: Restore pci state upon resume
+    - drm/xe: Resume TDR after GT reset
+    - drm/xe: Prevent null pointer access in xe_migrate_copy
+    - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Go E1404GAB
+    - nvme-keyring: restrict match length for version '1' identifiers
+    - nvme-tcp: sanitize TLS key handling
+    - nvme-fabrics: typo in nvmf_parse_key()
+    - nvme-tcp: check for invalidated or revoked key
+    - net: fec: don't save PTP state if PTP is unsupported
+    - wifi: mac80211: fix RCU list iterations
+    - netdev-genl: Set extack and fix error on napi-get
+    - block: fix integer overflow in BLKSECDISCARD
+    - arm64: trans_pgd: mark PTEs entries as valid to avoid dead kexec()
+    - net: phy: Check for read errors in SIOCGMIIREG
+    - wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
+    - x86/bugs: Add missing NO_SSB flag
+    - x86/bugs: Fix handling when SRSO mitigation is disabled
+    - net: napi: Prevent overflow of napi_defer_hard_irqs
+    - crypto: hisilicon - fix missed error branch
+    - ALSA: usb-audio: Add quirk for RME Digiface USB
+    - ALSA: usb-audio: Add mixer quirk for RME Digiface USB
+    - ALSA: control: Use automatic cleanup of kfree()
+    - ALSA: control: Fix unannotated kfree() cleanup
+    - ALSA: control: Use guard() for locking
+    - ALSA: control: Take power_ref lock primarily
+    - x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
+    - ASoC: Intel: boards: always check the result of
+      acpi_dev_get_first_match_dev()
+    - rcu-tasks: Add data to eliminate RCU-tasks/do_exit() deadlocks
+    - rcu-tasks: Initialize data to eliminate RCU-tasks/do_exit() deadlocks
+    - rcu-tasks: Fix access non-existent percpu rtpcp variable in
+      rcu_tasks_need_gpcb()
+    - pmdomain: core: Don't hold the genpd-lock when calling dev_pm_domain_set()
+    - iommu/vt-d: Unconditionally flush device TLB for pasid table updates
+    - iommu/arm-smmu-v3: Do not use devm for the cd table allocations
+    - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
+    - drm/amd/display: Check null pointers before using them
+    - drm/amd/display: Add null check for head_pipe in
+      dcn201_acquire_free_pipe_for_layer
+    - drm/amd/display: Add null check for head_pipe in
+      dcn32_acquire_idle_pipe_for_head_pipe_in_layer
+    - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in
+      dcn30_init_hw
+    - drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
+    - drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces
+    - scsi: smartpqi: Add new controller PCI IDs
+    - drm/amd/display: Add NULL check for function pointer in
+      dcn20_set_output_transfer_func
+    - drm/amd/display: Add NULL check for function pointer in
+      dcn32_set_output_transfer_func
+    - scsi: smartpqi: add new controller PCI IDs
+    - drm/amd/display: Check null-initialized variables
+    - drm/amd/display: Check phantom_stream before it is used
+    - drm/amdgpu/gfx9: properly handle error ints on all pipes
+    - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata
+      paths
+    - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached
+      topology
+    - drm/amdgpu: check PS, WS index
+    - drm/amdgpu: fix wrong sizeof argument
+    - drm/amdgpu: fix unchecked return value warning for amdgpu_atombios
+    - drm/amdgpu/gfx11: enter safe mode before touching CP_INT_CNTL
+    - drm/xe: Invert page fault queue head / tail
+    - drm/xe: Add helper macro to loop each DSS
+    - drm/xe: fix multicast support for Xe_LP platforms
+    - drm/xe: Use topology to determine page fault queue size
+    - drm/xe: Drop warn on xe_guc_pc_gucrc_disable in guc pc fini
+    - ovl: fsync after metadata copy-up
+    - HID: i2c-hid: ensure various commands do not interfere with each other
+    - platform/mellanox: mlxbf-pmc: Replace uintN_t with kernel-style types
+    - platform/mellanox: mlxbf-pmc: Cleanup signed/unsigned mix-up
+    - platform/mellanox: mlxbf-pmc: fix signedness bugs
+    - platform/mellanox: mlxbf-pmc: fix lockdep warning
+    - bpf: Fix a sdiv overflow issue
+    - ALSA: control: Fix power_ref lock order for compat code, too
+    - perf callchain: Fix stitch LBR memory leaks
+    - drm/xe: fixup xe_alloc_pf_queue
+    - drm/xe: Fix memory leak on xe_alloc_pf_queue failure
+    - nvme-tcp: fix link failure for TCP auth
+    - f2fs: fix zoned block device information initialization
+    - f2fs: add write priority option based on zone UFS
+    - f2fs: make BG GC more aggressive for zoned devices
+    - f2fs: introduce migration_window_granularity
+    - f2fs: increase BG GC migration window granularity when boosted for zoned
+      devices
+    - f2fs: do FG_GC when GC boosting is required for zoned devices
+    - f2fs: forcibly migrate to secure space for zoned device file pinning
+    - mm, slub: avoid zeroing kmalloc redzone
+    - drm/v3d: Prevent out of bounds access in performance query extensions
+    - ext4: fix access to uninitialised lock in fc replay path
+    - ext4: fix off by one issue in alloc_flex_gd()
+    - scripts/gdb: add iteration function for rbtree
+    - scripts/gdb: fix lx-mounts command error
+    - sched/deadline: Comment sched_dl_entity::dl_server variable
+    - sched/core: Add clearing of ->dl_server in put_prev_task_balance()
+    - sched/core: Clear prev->dl_server in CFS pick fast path
+    - drivers/perf: riscv: Align errno for unsupported perf event
+    - ACPI: resource: Remove duplicate Asus E1504GAB IRQ override
+    - ACPI: resource: Loosen the Asus E1404GAB DMI match to also cover the E1404GA
+    - ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
+    - ACPI: resource: Add Asus ExpertBook B2502CVA to
+      irq1_level_low_skip_override[]
+    - firmware/sysfb: Disable sysfb for firmware buffers with unknown parent
+    - close_range(): fix the logics in descriptor table trimming
+    - drm/sched: Fix dynamic job-flow control race
+    - drm/sched: Always wake up correct scheduler in drm_sched_entity_push_job
+    - drm/sched: Always increment correct scheduler score
+    - drm/xe: Delete unused GuC submission_state.suspend
+    - drm/xe: Use ordered wq for preempt fence waiting
+    - drm/xe: fix UAF around queue destruction
+    - sunrpc: change sp_nrthreads from atomic_t to unsigned int.
+    - NFSD: Async COPY result needs to return a write verifier
+    - NFSD: Limit the number of concurrent async COPY operations
+    - NFSD: Initialize struct nfsd4_copy earlier
+    - NFSD: Never decrement pending_async_copies on error
+    - drm/sched: revert "Always increment correct scheduler score"
+    - ALSA: control: Fix leftover snd_power_unref()
+    - Upstream stable to v6.6.55, v6.10.14
+
+  * By always inlining _compound_head(), clone() sees 3%+ performance increase
+    (LP: #2089327)
+    - mm: always inline _compound_head() with
+      CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+
+  * Random flickering with Intel i915 (Comet Lake and Kaby Lake) on Linux 6.8+
+    (LP: #2086587)
+    - SAUCE: iommu/intel: disable DMAR for KBL and CML integrated gfx
+
+  * Add list of source files to linux-buildinfo (LP: #2086606)
+    - [Packaging] Sort build dependencies alphabetically
+    - [Packaging] Add list of used source files to buildinfo package
+
+  * UFS: uspi->s_3apb UBSAN: shift-out-of-bounds (LP: #2087853)
+    - ufs: ufs_sb_private_info: remove unused s_{2, 3}apb fields
+
+  * Mute/mic LEDs don't function on HP EliteBook 645 G10 (LP: #2087983)
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP EliteBook 645 G10
+
+  * Noble update: upstream stable patchset 2024-11-22 (LP: #2089340)
+    - EDAC/synopsys: Fix ECC status and IRQ control race condition
+    - EDAC/synopsys: Fix error injection on Zynq UltraScale+
+    - wifi: rtw88: always wait for both firmware loading attempts
+    - crypto: xor - fix template benchmarking
+    - ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
+    - wifi: brcmfmac: export firmware interface functions
+    - wifi: brcmfmac: introducing fwil query functions
+    - wifi: ath9k: Remove error checks when creating debugfs entries
+    - wifi: ath12k: fix BSS chan info request WMI command
+    - wifi: ath12k: match WMI BSS chan info structure with firmware definition
+    - wifi: ath12k: fix invalid AMPDU factor calculation in
+      ath12k_peer_assoc_h_he()
+    - net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
+    - arm64: signal: Fix some under-bracketed UAPI macros
+    - wifi: rtw88: remove CPT execution branch never used
+    - RISC-V: KVM: Fix sbiret init before forwarding to userspace
+    - RISC-V: KVM: Allow legacy PMU access from guest
+    - RISC-V: KVM: Fix to allow hpmcounter31 from the guest
+    - mount: handle OOM on mnt_warn_timestamp_expiry
+    - ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros
+    - powercap: intel_rapl: Fix off by one in get_rpi()
+    - kselftest/arm64: signal: fix/refactor SVE vector length enumeration
+    - drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
+    - wifi: mac80211: don't use rate mask for offchannel TX either
+    - wifi: iwlwifi: remove AX101, AX201 and AX203 support from LNL
+    - wifi: iwlwifi: config: label 'gl' devices as discrete
+    - wifi: iwlwifi: mvm: increase the time between ranging measurements
+    - padata: Honor the caller's alignment in case of chunk_size 0
+    - drivers/perf: hisi_pcie: Record hardware counts correctly
+    - drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting
+    - kselftest/arm64: Actually test SME vector length changes via sigreturn
+    - can: j1939: use correct function name in comment
+    - ACPI: CPPC: Fix MASK_VAL() usage
+    - netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
+    - netfilter: nf_tables: reject element expiration with no timeout
+    - netfilter: nf_tables: reject expiration higher than timeout
+    - netfilter: nf_tables: remove annotation to access set timeout while holding
+      lock
+    - perf/arm-cmn: Improve debugfs pretty-printing for large configs
+    - perf/arm-cmn: Refactor node ID handling. Again.
+    - perf/arm-cmn: Fix CCLA register offset
+    - perf/arm-cmn: Ensure dtm_idx is big enough
+    - cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
+    - wifi: mt76: mt7915: fix oops on non-dbdc mt7986
+    - wifi: mt76: mt7996: use hweight16 to get correct tx antenna
+    - wifi: mt76: mt7996: fix traffic delay when switching back to working channel
+    - wifi: mt76: mt7996: fix wmm set of station interface to 3
+    - wifi: mt76: mt7996: fix HE and EHT beamforming capabilities
+    - wifi: mt76: mt7996: fix EHT beamforming capability check
+    - x86/sgx: Fix deadlock in SGX NUMA node search
+    - pm:cpupower: Add missing powercap_set_enabled() stub function
+    - crypto: hisilicon/hpre - mask cluster timeout error
+    - crypto: hisilicon/qm - reset device before enabling it
+    - crypto: hisilicon/qm - inject error before stopping queue
+    - wifi: mt76: mt7603: fix mixed declarations and code
+    - wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
+    - wifi: mt76: mt7915: fix rx filter setting for bfee functionality
+    - wifi: mt76: mt7996: ensure 4-byte alignment for beacon commands
+    - wifi: mt76: mt7996: fix uninitialized TLV data
+    - wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
+    - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
+    - wifi: wilc1000: fix potential RCU dereference issue in
+      wilc_parse_join_bss_param
+    - Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
+    - Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
+    - sock_map: Add a cond_resched() in sock_hash_free()
+    - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
+    - can: m_can: enable NAPI before enabling interrupts
+    - can: m_can: m_can_close(): stop clocks after device has been shut down
+    - Bluetooth: btusb: Fix not handling ZPL/short-transfer
+    - bareudp: Pull inner IP header in bareudp_udp_encap_recv().
+    - bareudp: Pull inner IP header on xmit.
+    - net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
+    - net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
+    - net: tipc: avoid possible garbage value
+    - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
+    - ublk: move zone report data out of request pdu
+    - nbd: fix race between timeout and normal completion
+    - block, bfq: fix possible UAF for bfqq->bic with merge chain
+    - block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
+    - block, bfq: don't break merge chain in bfq_split_bfqq()
+    - cachefiles: Fix non-taking of sb_writers around set/removexattr
+    - erofs: fix incorrect symlink detection in fast symlink
+    - block, bfq: fix uaf for accessing waker_bfqq after splitting
+    - block, bfq: fix procress reference leakage for bfqq in merge chain
+    - io_uring/io-wq: do not allow pinning outside of cpuset
+    - io_uring/io-wq: inherit cpuset of cgroup in io worker
+    - block: fix potential invalid pointer dereference in blk_add_partition
+    - spi: ppc4xx: handle irq_of_parse_and_map() errors
+    - arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
+    - arm64: dts: mediatek: mt8186: Fix supported-hw mask for GPU OPPs
+    - firmware: arm_scmi: Fix double free in OPTEE transport
+    - spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
+    - regulator: Return actual error in of_regulator_bulk_get_all()
+    - arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
+    - arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
+    - arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
+    - ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
+    - arm64: dts: rockchip: Correct vendor prefix for Hardkernel ODROID-M1
+    - arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
+    - arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations
+    - spi: bcmbca-hsspi: Fix missing pm_runtime_disable()
+    - ARM: dts: microchip: sama7g5: Fix RTT clock
+    - ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
+    - ARM: versatile: fix OF node leak in CPUs prepare
+    - reset: berlin: fix OF node leak in probe() error path
+    - reset: k210: fix OF node leak in probe() error path
+    - clocksource/drivers/qcom: Add missing iounmap() on errors in
+      msm_dt_timer_init()
+    - arm64: dts: mediatek: mt8195: Correct clock order for dp_intf*
+    - x86/mm: Use IPIs to synchronize LAM enablement
+    - ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error
+    - ASoC: tas2781: remove unused acpi_subysystem_id
+    - ASoC: tas2781: Use of_property_read_reg()
+    - ASoC: tas2781-i2c: Drop weird GPIO code
+    - ASoC: tas2781-i2c: Get the right GPIO line
+    - selftests/ftrace: Add required dependency for kprobe tests
+    - ALSA: hda: cs35l41: fix module autoloading
+    - m68k: Fix kernel_clone_args.flags in m68k_clone()
+    - ASoC: loongson: fix error release
+    - hwmon: (max16065) Fix overflows seen when writing limits
+    - hwmon: (max16065) Remove use of i2c_match_id()
+    - hwmon: (max16065) Fix alarm attributes
+    - mtd: slram: insert break after errors in parsing the map
+    - hwmon: (ntc_thermistor) fix module autoloading
+    - power: supply: axp20x_battery: Remove design from min and max voltage
+    - power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
+    - fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
+    - iommu/amd: Do not set the D bit on AMD v2 table entries
+    - mtd: powernv: Add check devm_kasprintf() returned value
+    - rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
+    - mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
+    - mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
+    - mtd: rawnand: mtk: Fix init error path
+    - iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
+    - iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K pages
+    - iommu/arm-smmu-qcom: apply num_context_bank fixes for SDM630 / SDM660
+    - pmdomain: core: Harden inter-column space in debug summary
+    - drm/stm: Fix an error handling path in stm_drm_platform_probe()
+    - drm/stm: ltdc: check memory returned by devm_kzalloc()
+    - drm/amd/display: Add null check for set_output_gamma in
+      dcn30_set_output_transfer_func
+    - drm/amdgpu: properly handle vbios fake edid sizing
+    - drm/radeon: properly handle vbios fake edid sizing
+    - scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly
+    - scsi: NCR5380: Check for phase match during PDMA fixup
+    - drm/amd/amdgpu: Properly tune the size of struct
+    - drm/rockchip: vop: Allow 4096px width scaling
+    - drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
+    - drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
+    - drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()
+    - drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
+    - scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
+    - jfs: fix out-of-bounds in dbNextAG() and diAlloc()
+    - drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config()
+    - drm/mediatek: Use spin_lock_irqsave() for CRTC event lock
+    - powerpc/8xx: Fix initial memory mapping
+    - powerpc/8xx: Fix kernel vs user address comparison
+    - powerpc/vdso: Inconditionally use CFUNC macro
+    - drm/msm: Fix incorrect file name output in adreno_request_fw()
+    - drm/msm/a5xx: disable preemption in submits by default
+    - drm/msm/a5xx: properly clear preemption records on resume
+    - drm/msm/a5xx: fix races in preemption evaluation stage
+    - drm/msm/a5xx: workaround early ring-buffer emptiness check
+    - ipmi: docs: don't advertise deprecated sysfs entries
+    - drm/msm/dsi: correct programming sequence for SM8350 / SM8450
+    - drm/msm: fix %s null argument error
+    - drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
+    - xen: use correct end address of kernel for conflict checking
+    - HID: wacom: Support sequence numbers smaller than 16-bit
+    - HID: wacom: Do not warn about dropped packets for first packet
+    - ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data
+    - minmax: avoid overly complex min()/max() macro arguments in xen
+    - xen: introduce generic helper checking for memory map conflicts
+    - xen: move max_pfn in xen_memory_setup() out of function scope
+    - xen: add capability to remap non-RAM pages to different PFNs
+    - xen: tolerate ACPI NVS memory overlapping with Xen allocated memory
+    - xen/swiotlb: add alignment check for dma buffers
+    - xen/swiotlb: fix allocated size
+    - tpm: Clean up TPM space after command failure
+    - sched/fair: Make SCHED_IDLE entity be preempted in strict hierarchy
+    - selftests/bpf: Workaround strict bpf_lsm return value check.
+    - selftests/bpf: Fix error linking uprobe_multi on mips
+    - bpf: Use -Wno-error in certain tests when building with GCC
+    - bpf: Disable some `attribute ignored' warnings in GCC
+    - bpf: Temporarily define BPF_NO_PRESEVE_ACCESS_INDEX for GCC
+    - selftests/bpf: Add CFLAGS per source file and runner
+    - selftests/bpf: Fix wrong binary in Makefile log output
+    - tools/runqslower: Fix LDFLAGS and add LDLIBS support
+    - selftests/bpf: Use pid_t consistently in test_progs.c
+    - selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
+    - selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc
+    - selftests/bpf: Drop unneeded error.h includes
+    - selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
+    - selftests/bpf: Fix missing UINT_MAX definitions in benchmarks
+    - selftests/bpf: Fix missing BUILD_BUG_ON() declaration
+    - selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test
+    - selftests/bpf: Refactor out some functions in ns_current_pid_tgid test
+    - selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test
+    - selftests/bpf: Fix include of <sys/fcntl.h>
+    - selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc
+    - selftests/bpf: Fix compiling kfree_skb.c with musl-libc
+    - selftests/bpf: Fix compiling flow_dissector.c with musl-libc
+    - selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
+    - selftests/bpf: Fix compiling core_reloc.c with musl-libc
+    - selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc
+    - selftests/bpf: Fix errors compiling decap_sanity.c with musl libc
+    - selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
+    - selftests/bpf: Fix arg parsing in veristat, test_progs
+    - selftests/bpf: Fix error compiling test_lru_map.c
+    - selftests/bpf: Fix C++ compile error from missing _Bool type
+    - selftests/bpf: Fix flaky selftest lwt_redirect/lwt_reroute
+    - selftests/bpf: Fix redefinition errors compiling lwt_reroute.c
+    - selftests/bpf: Fix compile if backtrace support missing in libc
+    - selftests/bpf: Fix error compiling tc_redirect.c with musl libc
+    - samples/bpf: Fix compilation errors with cf-protection option
+    - bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
+    - xz: cleanup CRC32 edits from 2018
+    - kthread: fix task state in kthread worker if being frozen
+    - ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
+    - smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
+    - ext4: avoid buffer_head leak in ext4_mark_inode_used()
+    - ext4: avoid potential buffer_head leak in __ext4_new_inode()
+    - ext4: avoid negative min_clusters in find_group_orlov()
+    - ext4: return error on ext4_find_inline_entry
+    - ext4: avoid OOB when system.data xattr changes underneath the filesystem
+    - ext4: check stripe size compatibility on remount as well
+    - sched/numa: Fix the vma scan starving issue
+    - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
+    - nilfs2: determine empty node blocks as corrupted
+    - nilfs2: fix potential oob read in nilfs_btree_check_delete()
+    - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
+    - bpf: Fix helper writes to read-only maps
+    - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
+    - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
+    - perf mem: Free the allocated sort string, fixing a leak
+    - perf inject: Fix leader sampling inserting additional samples
+    - perf report: Fix --total-cycles --stdio output error
+    - perf sched timehist: Fix missing free of session in perf_sched__timehist()
+    - perf stat: Display iostat headers correctly
+    - perf sched timehist: Fixed timestamp error when unable to confirm event
+      sched_in time
+    - perf time-utils: Fix 32-bit nsec parsing
+    - clk: imx: clk-audiomix: Correct parent clock for earc_phy and audpll
+    - clk: imx: imx6ul: fix default parent for enet*_ref_sel
+    - clk: imx: composite-8m: Less function calls in __imx8m_clk_hw_composite()
+      after error detection
+    - clk: imx: composite-8m: Enable gate clk with mcore_booted
+    - clk: imx: composite-93: keep root clock on when mcore enabled
+    - clk: imx: composite-7ulp: Check the PCC present bit
+    - clk: imx: fracn-gppll: fix fractional part of PLL getting lost
+    - clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
+    - clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
+    - clk: imx: imx8qxp: Parent should be initialized earlier than the clock
+    - remoteproc: imx_rproc: Correct ddr alias for i.MX8M
+    - remoteproc: imx_rproc: Initialize workqueue earlier
+    - clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
+    - clk: qcom: dispcc-sm8550: fix several supposed typos
+    - clk: qcom: dispcc-sm8550: use rcg2_ops for mdss_dptx1_aux_clk_src
+    - clk: qcom: dispcc-sm8650: Update the GDSC flags
+    - clk: qcom: dispcc-sm8550: use rcg2_shared_ops for ESC RCGs
+    - leds: bd2606mvv: Fix device child node usage in bd2606mvv_probe()
+    - pinctrl: ti: iodelay: Use scope based of_node_put() cleanups
+    - pinctrl: ti: ti-iodelay: Fix some error handling paths
+    - Input: ilitek_ts_i2c - avoid wrong input subsystem sync
+    - Input: ilitek_ts_i2c - add report id message validation
+    - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
+    - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
+    - PCI: Wait for Link before restoring Downstream Buses
+    - firewire: core: correct range of block for case of switch statement
+    - PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
+    - clk: qcom: ipq5332: Register gcc_qdss_tsctr_clk_src
+    - clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL
+    - leds: leds-pca995x: Add support for NXP PCA9956B
+    - leds: pca995x: Use device_for_each_child_node() to access device child nodes
+    - leds: pca995x: Fix device child node usage in pca995x_probe()
+    - x86/PCI: Check pcie_find_root_port() return for NULL
+    - nvdimm: Fix devs leaks in scan_labels()
+    - PCI: xilinx-nwl: Fix register misspelling
+    - PCI: xilinx-nwl: Clean up clock on probe failure/removal
+    - media: platform: rzg2l-cru: rzg2l-csi2: Add missing MODULE_DEVICE_TABLE
+    - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
+    - pinctrl: single: fix missing error code in pcs_probe()
+    - clk: at91: sama7g5: Allocate only the needed amount of memory for PLLs
+    - media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
+    - media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
+    - media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
+    - RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer
+    - RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
+    - clk: ti: dra7-atl: Fix leak of of_nodes
+    - clk: starfive: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync()
+      usage
+    - clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p
+    - nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
+    - nfsd: fix refcount leak when file is unhashed after being found
+    - pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
+    - IB/core: Fix ib_cache_setup_one error flow cleanup
+    - PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
+    - RDMA/erdma: Return QP state in erdma_query_qp
+    - RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache
+    - watchdog: imx_sc_wdt: Don't disable WDT in suspend
+    - RDMA/hns: Don't modify rq next block addr in HIP09 QPC
+    - RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
+    - RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
+    - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
+    - RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
+    - RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
+    - RDMA/hns: Optimize hem allocation performance
+    - RDMA/hns: Fix restricted __le16 degrades to integer issue
+    - RDMA/mlx5: Obtain upper net device only when needed
+    - riscv: Fix fp alignment bug in perf_callchain_user()
+    - RDMA/cxgb4: Added NULL check for lookup_atid
+    - RDMA/irdma: fix error message in irdma_modify_qp_roce()
+    - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
+    - ntb_perf: Fix printk format
+    - ntb: Force physically contiguous allocation of rx ring buffers
+    - nfsd: call cache_put if xdr_reserve_space returns NULL
+    - nfsd: return -EINVAL when namelen is 0
+    - crypto: caam - Pad SG length when allocating hash edesc
+    - crypto: powerpc/p10-aes-gcm - Disable CRYPTO_AES_GCM_P10
+    - f2fs: atomic: fix to avoid racing w/ GC
+    - f2fs: reduce expensive checkpoint trigger frequency
+    - f2fs: fix to avoid racing in between read and OPU dio write
+    - f2fs: Create COW inode from parent dentry for atomic write
+    - f2fs: fix to wait page writeback before setting gcing flag
+    - f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation
+    - f2fs: support .shutdown in f2fs_sops
+    - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
+    - f2fs: compress: don't redirty sparse cluster during {,de}compress
+    - f2fs: prevent atomic file from being dirtied before commit
+    - f2fs: get rid of online repaire on corrupted directory
+    - f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()
+    - spi: atmel-quadspi: Undo runtime PM changes at driver exit time
+    - spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
+    - lib/sbitmap: define swap_lock as raw_spinlock_t
+    - spi: atmel-quadspi: Avoid overwriting delay register settings
+    - nvme-multipath: system fails to create generic nvme device
+    - iio: adc: ad7606: fix oversampling gpio array
+    - iio: adc: ad7606: fix standby gpio state to match the documentation
+    - driver core: Fix error handling in driver API device_rename()
+    - ABI: testing: fix admv8818 attr description
+    - iio: chemical: bme680: Fix read/write ops to device by adding mutexes
+    - iio: magnetometer: ak8975: drop incorrect AK09116 compatible
+    - dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible
+    - driver core: Fix a potential null-ptr-deref in module_add_driver()
+    - serial: 8250: omap: Cleanup on error in request_irq
+    - coresight: tmc: sg: Do not leak sg_table
+    - interconnect: icc-clk: Add missed num_nodes initialization
+    - cxl/pci: Fix to record only non-zero ranges
+    - vhost_vdpa: assign irq bypass producer token correctly
+    - ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
+    - Revert "dm: requeue IO if mapping table not yet available"
+    - net: xilinx: axienet: Schedule NAPI in two steps
+    - net: xilinx: axienet: Fix packet counting
+    - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
+    - net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race
+      Condition
+    - net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
+    - tcp: check skb is non-NULL in tcp_rto_delta_us()
+    - net: qrtr: Update packets cloning when broadcasting
+    - bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
+    - virtio_net: Fix mismatched buf address when unmapping for small packets
+    - netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
+    - netfilter: ctnetlink: compile ctnetlink_label_size with
+      CONFIG_NF_CONNTRACK_EVENTS
+    - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump
+      path
+    - io_uring/sqpoll: do not allow pinning outside of cpuset
+    - io_uring: check for presence of task_work rather than TIF_NOTIFY_SIGNAL
+    - mm: call the security_mmap_file() LSM hook in remap_file_pages()
+    - drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
+    - Revert "net: libwx: fix alloc msix vectors failed"
+    - xen: move checks for e820 conflicts further up
+    - xen: allow mapping ACPI data using a different physical address
+    - io_uring/sqpoll: retain test for whether the CPU is valid
+    - io_uring/sqpoll: do not put cpumask on stack
+    - Remove *.orig pattern from .gitignore
+    - PCI: Revert to the original speed after PCIe failed link retraining
+    - PCI: Clear the LBMS bit after a link retrain
+    - PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ
+    - PCI: imx6: Fix missing call to phy_power_off() in error handling
+    - PCI: Correct error reporting with PCIe failed link retraining
+    - PCI: Use an error code with PCIe failed link retraining
+    - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
+    - Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible"
+    - ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
+    - soc: fsl: cpm1: tsa: Fix tsa_write8()
+    - soc: versatile: integrator: fix OF node leak in probe() error path
+    - Revert "media: tuners: fix error return code of
+      hybrid_tuner_request_state()"
+    - iommufd: Protect against overflow of ALIGN() during iova allocation
+    - Input: adp5588-keys - fix check on return code
+    - Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
+    - Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
+    - Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
+    - KVM: arm64: Add memory length checks and remove inline in do_ffa_mem_xfer
+    - KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits
+    - KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode()
+    - KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock
+    - drm/amd/display: Add HDMI DSC native YCbCr422 support
+    - drm/amd/display: Round calculated vtotal
+    - drm/amd/display: Validate backlight caps are sane
+    - KEYS: prevent NULL pointer dereference in find_asymmetric_key()
+    - powerpc/atomic: Use YZ constraints for DS-form instructions
+    - fs: Create a generic is_dot_dotdot() utility
+    - ksmbd: make __dir_empty() compatible with POSIX
+    - ksmbd: allow write with FILE_APPEND_DATA
+    - ksmbd: handle caseless file creation
+    - ata: libata-scsi: Fix ata_msense_control() CDL page reporting
+    - scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
+    - scsi: ufs: qcom: Update MODE_MAX cfg_bw value
+    - scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages
+    - scsi: mac_scsi: Refactor polling loop
+    - scsi: mac_scsi: Disallow bus errors during PDMA send
+    - can: esd_usb: Remove CAN_CTRLMODE_3_SAMPLES for CAN-USB/3-FD
+    - wifi: rtw88: Fix USB/SDIO devices not transmitting beacons
+    - usbnet: fix cyclical race on disconnect with work queue
+    - USB: appledisplay: close race between probe and completion handler
+    - USB: misc: cypress_cy7c63: check for short transfer
+    - USB: class: CDC-ACM: fix race between get_serial and set_serial
+    - usb: cdnsp: Fix incorrect usb_request status
+    - usb: dwc2: drd: fix clock gating on USB role switch
+    - bus: integrator-lm: fix OF node leak in probe()
+    - bus: mhi: host: pci_generic: Fix the name for the Telit FE990A
+    - firmware_loader: Block path traversal
+    - tty: rp2: Fix reset with non forgiving PCIe host bridges
+    - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
+    - serial: qcom-geni: fix fifo polling timeout
+    - crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
+    - drbd: Fix atomicity violation in drbd_uuid_set_bm()
+    - drbd: Add NULL check for net_conf to prevent dereference in state validation
+    - ACPI: sysfs: validate return type of _STR method
+    - ACPI: resource: Add another DMI match for the TongFang GMxXGxx
+    - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
+    - perf/x86/intel/pt: Fix sampling synchronization
+    - wifi: mt76: mt7921: Check devm_kasprintf() returned value
+    - wifi: mt76: mt7915: check devm_kasprintf() returned value
+    - wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he
+    - wifi: rtw88: 8821cu: Remove VID/PID 0bda:c82c
+    - wifi: rtw88: 8822c: Fix reported RX band width
+    - wifi: mt76: mt7615: check devm_kasprintf() returned value
+    - debugobjects: Fix conditions in fill_pool()
+    - btrfs: tree-checker: fix the wrong output of data backref objectid
+    - btrfs: always update fstrim_range on failure in FITRIM ioctl
+    - f2fs: fix several potential integer overflows in file offsets
+    - f2fs: prevent possible int overflow in dir_block_index()
+    - f2fs: avoid potential int overflow in sanity_check_area_boundary()
+    - f2fs: Require FMODE_WRITE for atomic write ioctls
+    - f2fs: fix to check atomic_file in f2fs ioctl interfaces
+    - hwrng: mtk - Use devm_pm_runtime_enable
+    - hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init
+    - hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
+    - arm64: esr: Define ESR_ELx_EC_* constants as UL
+    - arm64: errata: Enable the AC03_CPU_38 workaround for ampere1a
+    - arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
+    - arm64: dts: qcom: sa8775p: Mark APPS and PCIe SMMUs as DMA coherent
+    - arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
+    - vfs: fix race between evice_inodes() and find_inode()&iput()
+    - fs: Fix file_set_fowner LSM hook inconsistencies
+    - nfs: fix memory leak in error path of nfs4_do_reclaim
+    - EDAC/igen6: Fix conversion of system address to physical memory address
+    - icmp: change the order of rate limits
+    - cpuidle: riscv-sbi: Use scoped device node handling to fix missing
+      of_node_put
+    - padata: use integer wrap around to prevent deadlock on seq_nr overflow
+    - spi: fspi: involve lut_num for struct nxp_fspi_devtype_data
+    - ARM: dts: imx6ul-geam: fix fsl,pins property in tscgrp pinctrl
+    - soc: versatile: realview: fix memory leak during device remove
+    - soc: versatile: realview: fix soc_dev leak during device remove
+    - USB: misc: yurex: fix race between read and write
+    - xhci: Add a quirk for writing ERST in high-low order
+    - usb: xhci: fix loss of data on Cadence xHC
+    - pps: remove usage of the deprecated ida_simple_xx() API
+    - pps: add an error check in parport_attach
+    - serial: don't use uninitialized value in uart_poll_init()
+    - x86/idtentry: Incorporate definitions/declarations of the FRED entries
+    - x86/entry: Remove unwanted instrumentation in common_interrupt()
+    - lib/bitmap: add bitmap_{read,write}()
+    - btrfs: subpage: fix the bitmap dump which can cause bitmap corruption
+    - btrfs: fix race setting file private on concurrent lseek using same fd
+    - dt-bindings: spi: nxp-fspi: support i.MX93 and i.MX95
+    - dt-bindings: spi: nxp-fspi: add imx8ulp support
+    - thunderbolt: Improve DisplayPort tunnel setup process to be more robust
+    - bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0
+    - dm-verity: restart or panic on an I/O error
+    - lockdep: fix deadlock issue between lockdep and rcu
+    - mm: only enforce minimum stack gap size if it's sensible
+    - spi: fspi: add support for imx8ulp
+    - module: Fix KCOV-ignored file name
+    - mm/damon/vaddr: protect vma traversal in __damon_va_thre_regions() with rcu
+      read lock
+    - i2c: aspeed: Update the stop sw state when the bus recovery occurs
+    - i2c: isch: Add missed 'else'
+    - Documentation: KVM: fix warning in "make htmldocs"
+    - bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
+    - wifi: brcmfmac: add linefeed at end of file
+    - x86/tdx: Fix "in-kernel MMIO" check
+    - spi: atmel-quadspi: Fix wrong register value written to MR
+    - Revert: "dm-verity: restart or panic on an I/O error"
+    - wifi: ath11k: use work queue to process beacon tx event
+    - crypto: qat - disable IOV in adf_dev_stop()
+    - crypto: qat - fix recovery flow for VFs
+    - crypto: qat - ensure correct order in VF restarting handler
+    - crypto: iaa - Fix potential use after free bug
+    - autofs: fix missing fput for FSCONFIG_SET_FD
+    - arm64: smp: smp_send_stop() and crash_smp_send_stop() should try non-NMI
+      first
+    - thermal: core: Fold two functions into their respective callers
+    - thermal: core: Fix rounding of delay jiffies
+    - perf/dwc_pcie: Fix registration issue in multi PCIe controller instances
+    - perf/dwc_pcie: Always register for PCIe bus notifier
+    - ACPI: video: force native for some T2 macbooks
+    - ACPI: video: force native for Apple MacbookPro9,2
+    - wifi: cfg80211: fix bug of mapping AF3x to incorrect User Priority
+    - wifi: mac80211: fix the comeback long retry times
+    - ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
+    - ACPICA: executer/exsystem: Don't nag user about every Stall() violating the
+      spec
+    - netfilter: nft_dynset: annotate data-races around set timeout
+    - wifi: mt76: mt7921: fix wrong UNII-4 freq range check for the channel usage
+    - crypto: ccp - do not request interrupt on cmd completion when irqs disabled
+    - wifi: mt76: connac: fix checksum offload fields of connac3 RXD
+    - net: hsr: Use the seqnr lock for frames received via interlink port.
+    - crypto: n2 - Set err to EINVAL if snprintf fails for hmac
+    - firmware: qcom: scm: Disable SDI and write no dump to dump mode
+    - arm64: dts: renesas: r9a08g045: Correct GICD and GICR sizes
+    - arm64: tegra: Correct location of power-sensors for IGX Orin
+    - arm64: dts: ti: k3-am654-idk: Fix dtbs_check warning in ICSSG dmas
+    - selftests/ftrace: Fix eventfs ownership testcase to find mount point
+    - iommu/amd: Introduce struct protection_domain.pd_mode
+    - iommu/amd: Allocate the page table root using GFP_KERNEL
+    - iommu/amd: Convert comma to semicolon
+    - platform/x86: ideapad-laptop: Make the scope_guard() clear of its scope
+    - kselftest: dt: Ignore nodes that have ancestors disabled
+    - bpf, x64: Fix tailcall hierarchy
+    - bpf, lsm: Add check for BPF LSM return value
+    - bpf: Fix compare error in function retval_range_within
+    - bpf: Fail verification for sign-extension of packet data/data_end/data_meta
+    - selftests/bpf: Support checks against a regular expression
+    - selftests/bpf: no need to track next_match_pos in struct test_loader
+    - selftests/bpf: extract test_loader->expect_msgs as a data structure
+    - selftests/bpf: allow checking xlated programs in verifier_* tests
+    - selftests/bpf: __arch_* macro to limit test cases to specific archs
+    - libbpf: Fix bpf_object__open_skeleton()'s mishandling of options
+    - s390/ap: Fix deadlock caused by recursive lock of the AP bus scan mutex
+    - sched/deadline: Fix schedstats vs deadline servers
+    - perf scripts python cs-etm: Restore first sample log in verbose mode
+    - perf lock contention: Change stack_id type to s32
+    - quota: avoid missing put_quota_format when DQUOT_SUSPENDED is passed
+    - media: staging: media: starfive: camss: Drop obsolete return value
+      documentation
+    - leds: gpio: Set num_leds after allocation
+    - iommufd/selftest: Fix buffer read overrrun in the dirty test
+    - iommufd: Check the domain owner of the parent before creating a nesting
+      domain
+    - RDMA/mlx5: Fix counter update on MR cache mkey creation
+    - RDMA/mlx5: Drop redundant work canceling from clean_keys()
+    - RDMA/mlx5: Fix MR cache temp entries cleanup
+    - RDMA/hns: Fix ah error counter in sw stat not increasing
+    - Coresight: Set correct cs_mode for TPDM to fix disable issue
+    - Coresight: Set correct cs_mode for dummy source to fix disable issue
+    - interconnect: qcom: sm8250: Enable sync_state
+    - vdpa/mlx5: Fix invalid mr resource destroy
+    - net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled
+    - selftests: netfilter: Avoid hanging ipvs.sh
+    - io_uring/rw: treat -EOPNOTSUPP for IOCB_NOWAIT like -EAGAIN
+    - mm: migrate: annotate data-race in migrate_folio_unmap()
+    - selftests/bpf: correctly move 'log' upon successful match
+    - soc: fsl: cpm1: qmc: Update TRNSYNC only in transparent mode
+    - drm/amdgpu/vcn: enable AV1 on both instances
+    - drm/amd/display: Clean up dsc blocks in accelerated mode
+    - drm/amd/display: Skip to enable dsc if it has been off
+    - arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled
+    - usb: xHCI: add XHCI_RESET_ON_RESUME quirk for Phytium xHCI host
+    - serial: qcom-geni: fix false console tx restart
+    - crypto: qcom-rng - fix support for ACPI-based systems
+    - ACPI: resource: Do IRQ override on MECHREV GM7XG0M
+    - perf/x86/intel: Allow to setup LBR for counting event for BPF
+    - f2fs: check discard support for conventional zones
+    - netfs: Delete subtree of 'fs/netfs' when netfs module exits
+    - md: Don't flush sync_work in md_write_start()
+    - tools/nolibc: include arch.h from string.h
+    - KVM: x86: Make x2APIC ID 100% readonly
+    - x86/mm/cpa: Warn for set_memory_XXcrypted() VMM fails
+    - x86/mm: Make x86_platform.guest.enc_status_change_*() return an error
+    - x86/tdx: Account shared memory
+    - x86/mm: Add callbacks to prepare encrypted memory for kexec
+    - x86/tdx: Convert shared memory back to private on kexec
+    - soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers
+    - serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit()
+    - serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield()
+    - idpf: stop using macros for accessing queue descriptors
+    - fs_parse: add uid & gid option option parsing helpers
+    - compiler.h: specify correct attribute for .rodata..c_jump_table
+    - exfat: resolve memory leak from exfat_create_upcase_table()
+    - s390/ftrace: Avoid calling unwinder in ftrace_return_address()
+    - fbdev: xen-fbfront: Assign fb_info->device
+    - [Config] update configs for CONFIG_CRYPTO_AES_GCM_P10
+    - Upstream stable to v6.6.54, v6.10.13
+
+  * Backport some AppArmor complain-mode profile bugfixes from Oracular
+    (LP: #2086210)
+    - SAUCE: apparmor4.0.0 [94/99]: apparmor: allocate xmatch for nullpdf inside
+      aa_alloc_null
+    - SAUCE: apparmor4.0.0 [95/99]: apparmor: properly handle cx/px lookup failure
+      for complain mode profiles
+
+  * Noble update: upstream stable patchset 2024-11-08 (LP: #2087519)
+    - ASoC: SOF: mediatek: Add missing board compatible
+    - ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile
+    - ASoC: allow module autoloading for table db1200_pids
+    - ASoC: allow module autoloading for table board_ids
+    - scsi: lpfc: Fix overflow build issue
+    - pinctrl: at91: make it work with current gpiolib
+    - hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
+    - microblaze: don't treat zero reserved memory regions as error
+    - platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F DMI match
+      less strict
+    - net: ftgmac100: Ensure tx descriptor updates are visible
+    - LoongArch: Define ARCH_IRQ_INIT_FLAGS as IRQ_NOPROBE
+    - wifi: iwlwifi: lower message level for FW buffer destination
+    - wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
+    - wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
+    - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
+    - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
+    - wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap()
+    - wifi: iwlwifi: clear trans->state earlier upon error
+    - can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing configuration
+    - ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict
+    - ASoC: intel: fix module autoloading
+    - ASoC: google: fix module autoloading
+    - ASoC: tda7419: fix module autoloading
+    - ASoC: fix module autoloading
+    - spi: spidev: Add an entry for elgin,jg10309-01
+    - ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
+    - ALSA: hda: add HDMI codec ID for Intel PTL
+    - drm: komeda: Fix an issue related to normalized zpos
+    - spi: bcm63xx: Enable module autoloading
+    - smb: client: fix hang in wait_for_response() for negproto
+    - x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
+    - tools: hv: rm .*.cmd when make clean
+    - spi: spidev: Add missing spi_device_id for jg10309-01
+    - ocfs2: add bounds checking to ocfs2_xattr_find_entry()
+    - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
+    - drm: Use XArray instead of IDR for minors
+    - accel: Use XArray instead of IDR for minors
+    - drm: Expand max DRM device number to full MINORBITS
+    - powercap/intel_rapl: Add support for AMD family 1Ah
+    - netfilter: nft_socket: make cgroupsv2 matching work with namespaces
+    - netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in
+      nft_socket_cgroup_subtree_level()
+    - nvme-pci: qdepth 1 quirk
+    - x86/mm: Switch to new Intel CPU model defines
+    - can: mcp251xfd: properly indent labels
+    - can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
+      mcp251xfd_chip_start/stop()
+    - USB: serial: pl2303: add device id for Macrosilicon MS3020
+    - USB: usbtmc: prevent kernel-usb-infoleak
+    - platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA
+    - ASoC: mediatek: mt8188-mt6359: Modify key
+    - clk: qcom: gcc-sm8650: Don't use shared clk_ops for QUPs
+    - ice: check for XDP rings instead of bpf program when unconfiguring
+    - powercap/intel_rapl: Fix the energy-pkg event for AMD CPUs
+    - powercap: intel_rapl: Change an error pointer to NULL
+    - Upstream stable to v6.6.53, v6.10.12
+
+ -- Mehmet Basaran <mehmet.basaran@canonical.com>  Fri, 17 Jan 2025 15:05:44 +0300
+
+linux (6.8.0-52.53) noble; urgency=medium
+
+  * noble/linux: 6.8.0-52.53 -proposed tracker (LP: #2093521)
+
+  * CVE-2024-53164
+    - net: sched: fix ordering of qlen adjustment
+
+  * CVE-2024-53141
+    - netfilter: ipset: add missing range check in bitmap_ip_uadt
+
+  * CVE-2024-53103
+    - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
+
+ -- Manuel Diewald <manuel.diewald@canonical.com>  Fri, 10 Jan 2025 18:18:33 +0100
+
+linux (6.8.0-51.52) noble; urgency=medium
+
+  * noble/linux: 6.8.0-51.52 -proposed tracker (LP: #2090369)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] update variants
+
+  * MGLRU: kswapd uses 100% CPU when MGLRU is enabled and under memory pressure
+    (LP: #2087886)
+    - mm/mglru: only clear kswapd_failures if reclaimable
+
+  * CVE-2024-50264
+    - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
+
+  * CVE-2024-53057
+    - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
+
+  * CVE-2024-49967
+    - ext4: no need to continue when the number of entries is 1
+
+ -- Manuel Diewald <manuel.diewald@canonical.com>  Sat, 30 Nov 2024 19:21:46 +0100
+
+linux (6.8.0-50.51) noble; urgency=medium
+
+  * noble/linux: 6.8.0-50.51 -proposed tracker (LP: #2086301)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.10.28)
+
+  * Noble update: upstream stable patchset 2024-10-31 (LP: #2086138)
+    - device property: Add cleanup.h based fwnode_handle_put() scope based
+      cleanup.
+    - device property: Introduce device_for_each_child_node_scoped()
+    - iio: adc: ad7124: Switch from of specific to fwnode based property handling
+    - ksmbd: override fsids for share path check
+    - ksmbd: override fsids for smb2_query_info()
+    - usbnet: ipheth: remove extraneous rx URB length check
+    - usbnet: ipheth: drop RX URBs with no payload
+    - usbnet: ipheth: do not stop RX on failing RX callback
+    - usbnet: ipheth: fix carrier detection in modes 1 and 4
+    - net: ethernet: use ip_hdrlen() instead of bit shift
+    - drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero
+    - drm: panel-orientation-quirks: Add quirk for Ayn Loki Max
+    - net: phy: vitesse: repair vsc73xx autonegotiation
+    - powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
+    - wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
+    - net: hns3: use correct release function during uninitialization
+    - btrfs: update target inode's ctime on unlink
+    - Input: ads7846 - ratelimit the spi_sync error message
+    - Input: synaptics - enable SMBus for HP Elitebook 840 G2
+    - HID: multitouch: Add support for GT7868Q
+    - scripts: kconfig: merge_config: config files: add a trailing newline
+    - platform/surface: aggregator_registry: Add Support for Surface Pro 10
+    - platform/surface: aggregator_registry: Add support for Surface Laptop Go 3
+    - drm/msm/adreno: Fix error return if missing firmware-name
+    - Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
+    - smb/server: fix return value of smb2_open()
+    - NFSv4: Fix clearing of layout segments in layoutreturn
+    - NFS: Avoid unnecessary rescanning of the per-server delegation list
+    - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
+    - platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array
+    - mptcp: pm: Fix uaf in __timer_delete_sync
+    - arm64: dts: rockchip: fix eMMC/SPI corruption when audio has been used on
+      RK3399 Puma
+    - arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399
+      Puma
+    - minmax: reduce min/max macro expansion in atomisp driver
+    - net: tighten bad gso csum offset check in virtio_net_hdr
+    - dm-integrity: fix a race condition when accessing recalc_sector
+    - x86/hyperv: fix kexec crash due to VP assist page corruption
+    - mm: avoid leaving partial pfn mappings around in error case
+    - arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E
+    - drm/amd/display: Disable error correction if it's not supported
+    - drm/amd/display: Fix FEC_READY write on DP LT
+    - eeprom: digsy_mtc: Fix 93xx46 driver probe failure
+    - cxl/core: Fix incorrect vendor debug UUID define
+    - selftests/bpf: Support SOCK_STREAM in unix_inet_redir_to_connected()
+    - hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >=
+      1.2
+    - ice: Fix lldp packets dropping after changing the number of channels
+    - ice: fix accounting for filters shared by multiple VSIs
+    - ice: fix VSI lists confusion when adding VLANs
+    - igb: Always call igb_xdp_ring_update_tail() under Tx lock
+    - net/mlx5: Update the list of the PCI supported devices
+    - net/mlx5e: Add missing link modes to ptys2ethtool_map
+    - net/mlx5e: Add missing link mode to ptys2ext_ethtool_map
+    - net/mlx5: Explicitly set scheduling element and TSAR type
+    - net/mlx5: Add missing masks and QoS bit masks for scheduling elements
+    - net/mlx5: Correct TASR typo into TSAR
+    - net/mlx5: Verify support for scheduling element and TSAR type
+    - net/mlx5: Fix bridge mode operations when there are no VFs
+    - fou: fix initialization of grc
+    - octeontx2-af: Modify SMQ flush sequence to drop packets
+    - net: ftgmac100: Enable TX interrupt to avoid TX timeout
+    - selftests: net: csum: Fix checksums for packets with non-zero padding
+    - netfilter: nft_socket: fix sk refcount leaks
+    - net: dsa: felix: ignore pending status of TAS module when it's disabled
+    - net: dpaa: Pad packets to ETH_ZLEN
+    - tracing/osnoise: Fix build when timerlat is not enabled
+    - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
+    - drm/syncobj: Fix syncobj leak in drm_syncobj_eventfd_ioctl
+    - dma-buf: heaps: Fix off-by-one in CMA heap fault handler
+    - drm/nouveau/fb: restore init() for ramgp102
+    - drm/amdgpu/atomfirmware: Silence UBSAN warning
+    - drm/amd/amdgpu: apply command submission parser for JPEG v1
+    - spi: geni-qcom: Undo runtime PM changes at driver exit time
+    - spi: geni-qcom: Fix incorrect free_irq() sequence
+    - drm/i915/guc: prevent a possible int overflow in wq offsets
+    - ASoC: codecs: avoid possible garbage value in peb2466_reg_read()
+    - cifs: Fix signature miscalculation
+    - pinctrl: meteorlake: Add Arrow Lake-H/U ACPI ID
+    - ASoC: meson: axg-card: fix 'use-after-free'
+    - drm/mediatek: Set sensible cursor width/height values to fix crash
+    - Input: edt-ft5x06 - add support for FocalTech FT5452 and FT8719
+    - Input: edt-ft5x06 - add support for FocalTech FT8201
+    - cgroup/cpuset: Eliminate unncessary sched domains rebuilds in hotplug
+    - spi: zynqmp-gqspi: Scale timeout by data size
+    - drm/xe: use devm instead of drmm for managed bo
+    - net: libwx: fix number of Rx and Tx descriptors
+    - clocksource: hyper-v: Use lapic timer in a TDX VM without paravisor
+    - bcachefs: Fix bch2_extents_match() false positive
+    - bcachefs: Don't delete open files in online fsck
+    - firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire()
+    - riscv: dts: starfive: jh7110-common: Fix lower rate of CPUfreq by setting
+      PLL0 rate to 1.5GHz
+    - cxl: Restore XOR'd position bits during address translation
+    - netlink: specs: mptcp: fix port endianness
+    - drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct()
+    - drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct()
+    - drm/amd/amdgpu: apply command submission parser for JPEG v2+
+    - drm/xe/client: fix deadlock in show_meminfo()
+    - drm/xe/client: remove bogus rcu list usage
+    - drm/xe/client: add missing bo locking in show_meminfo()
+    - tracing/kprobes: Fix build error when find_module() is not available
+    - drm/xe/display: fix compat IS_DISPLAY_STEP() range end
+    - Upstream stable to v6.6.52, v6.10.11
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849)
+    - KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
+    - KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing
+    - ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius
+      devices
+    - ALSA: hda/realtek: add patch for internal mic in Lenovo V145
+    - ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
+    - ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
+    - ata: libata: Fix memory leak for error path in ata_host_alloc()
+    - irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
+    - x86/kaslr: Expose and use the end of the physical memory address space
+    - nvme-pci: Add sleep quirk for Samsung 990 Evo
+    - rust: types: Make Opaque::get const
+    - rust: macros: provide correct provenance when constructing THIS_MODULE
+    - Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
+    - Bluetooth: MGMT: Ignore keys being loaded with invalid type
+    - mmc: core: apply SD quirks earlier during probe
+    - mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
+    - mmc: sdhci-of-aspeed: fix module autoloading
+    - mmc: cqhci: Fix checking of CQHCI_HALT state
+    - fuse: update stats for pages in dropped aux writeback list
+    - fuse: use unsigned type for getxattr/listxattr size truncation
+    - fuse: fix memory leak in fuse_create_open
+    - clk: starfive: jh7110-sys: Add notifier for PLL0 clock
+    - clk: qcom: clk-alpha-pll: Fix the pll post div mask
+    - clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
+    - kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y
+    - tracing: Avoid possible softlockup in tracing_iter_reset()
+    - tracing/timerlat: Add interface_lock around clearing of kthread in
+      stop_kthread()
+    - net: mctp-serial: Fix missing escapes on transmit
+    - x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported
+    - x86/apic: Make x2apic_disable() work correctly
+    - drm/i915: Do not attempt to load the GSC multiple times
+    - ALSA: control: Apply sanity check of input values for user elements
+    - ALSA: hda: Add input value sanity checks to HDMI channel map controls
+    - wifi: ath12k: fix uninitialize symbol error on ath12k_peer_assoc_h_he()
+    - smack: unix sockets: fix accept()ed socket label
+    - bpf, verifier: Correct tail_call_reachable for bpf prog
+    - accel/habanalabs/gaudi2: unsecure edma max outstanding register
+    - irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
+    - af_unix: Remove put_pid()/put_cred() in copy_peercred().
+    - x86/kmsan: Fix hook for unaligned accesses
+    - iommu: sun50i: clear bypass register
+    - netfilter: nf_conncount: fix wrong variable type
+    - fs/ntfs3: One more reason to mark inode bad
+    - riscv: kprobes: Use patch_text_nosync() for insn slots
+    - media: vivid: fix wrong sizeimage value for mplane
+    - leds: spi-byte: Call of_node_put() on error path
+    - wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
+    - usb: uas: set host status byte on data completion error
+    - drm/amd/display: Check HDCP returned status
+    - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts
+    - media: vivid: don't set HDMI TX controls if there are no HDMI outputs
+    - vfio/spapr: Always clear TCEs before unsetting the window
+    - ice: Check all ice_vsi_rebuild() errors in function
+    - Input: ili210x - use kvmalloc() to allocate buffer for firmware update
+    - media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
+    - pcmcia: Use resource_size function on resource object
+    - drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
+    - can: m_can: Release irq on error in m_can_open
+    - can: mcp251xfd: fix ring configuration when switching from CAN-CC to CAN-FD
+      mode
+    - rust: kbuild: fix export of bss symbols
+    - cifs: Fix FALLOC_FL_ZERO_RANGE to preflush buffered part of target region
+    - igb: Fix not clearing TimeSync interrupts for 82580
+    - platform/x86: dell-smbios: Fix error path in dell_smbios_init()
+    - regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR
+    - can: kvaser_pciefd: Skip redundant NULL pointer check in ISR
+    - can: kvaser_pciefd: Remove unnecessary comment
+    - can: kvaser_pciefd: Rename board_irq to pci_irq
+    - can: kvaser_pciefd: Move reset of DMA RX buffers to the end of the ISR
+    - can: kvaser_pciefd: Use a single write when releasing RX buffers
+    - Bluetooth: qca: If memdump doesn't work, re-enable IBS
+    - Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once
+    - Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT
+    - igc: Unlock on error in igc_io_resume()
+    - ice: do not bring the VSI up, if it was down before the XDP setup
+    - usbnet: modern method to get random MAC
+    - bpf, net: Fix a potential race in do_sock_getsockopt()
+    - bareudp: Fix device stats updates.
+    - r8152: fix the firmware doesn't work
+    - net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
+    - net: dsa: vsc73xx: fix possible subblocks range of CAPT block
+    - selftests: net: enable bind tests
+    - firmware: cs_dsp: Don't allow writes to read-only controls
+    - phy: zynqmp: Take the phy mutex in xlate
+    - ASoC: topology: Properly initialize soc_enum values
+    - dm init: Handle minors larger than 255
+    - iommu/vt-d: Handle volatile descriptor status read
+    - cgroup: Protect css->cgroup write under css_set_lock
+    - devres: Initialize an uninitialized struct member
+    - virtio_ring: fix KMSAN error for premapped mode
+    - crypto: qat - fix unintentional re-enabling of error interrupts
+    - ASoc: TAS2781: replace beXX_to_cpup with get_unaligned_beXX for potentially
+      broken alignment
+    - libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
+    - drm/amdgpu: Set no_hw_access when VF request full GPU fails
+    - ext4: fix possible tid_t sequence overflows
+    - jbd2: avoid mount failed when commit block is partial submitted
+    - dma-mapping: benchmark: Don't starve others when doing the test
+    - drm/amdgpu: reject gang submit on reserved VMIDs
+    - smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
+    - fs/ntfs3: Check more cases when directory is corrupted
+    - btrfs: replace BUG_ON with ASSERT in walk_down_proc()
+    - cxl/region: Verify target positions using the ordered target list
+    - riscv: set trap vector earlier
+    - tcp: Don't drop SYN+ACK for simultaneous connect().
+    - net: dpaa: avoid on-stack arrays of NR_CPUS elements
+    - LoongArch: Use correct API to map cmdline in relocate_kernel()
+    - regmap: maple: work around gcc-14.1 false-positive warning
+    - vfs: Fix potential circular locking through setxattr() and removexattr()
+    - i3c: master: svc: resend target address when get NACK
+    - kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
+    - btrfs: initialize location to fix -Wmaybe-uninitialized in
+      btrfs_lookup_dentry()
+    - s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
+    - usbnet: ipheth: race between ipheth_close and error handling
+    - spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register
+    - ata: pata_macio: Use WARN instead of BUG
+    - NFSv4: Add missing rescheduling points in
+      nfs_client_return_marked_delegations
+    - ACPI: CPPC: Add helper to get the highest performance value
+    - cpufreq: amd-pstate: Enable amd-pstate preferred core support
+    - cpufreq: amd-pstate: fix the highest frequency issue which limits
+      performance
+    - tcp: process the 3rd ACK with sk_socket for TFO/MPTCP
+    - iio: buffer-dmaengine: fix releasing dma channel on error
+    - iio: fix scale application in iio_convert_raw_to_processed_unlocked
+    - iio: adc: ad7124: fix config comparison
+    - iio: adc: ad7606: remove frstdata check for serial mode
+    - iio: adc: ad7124: fix chip ID mismatch
+    - usb: dwc3: core: update LC timer as per USB Spec V3.2
+    - usb: cdns2: Fix controller reset issue
+    - usb: dwc3: Avoid waking up gadget during startxfer
+    - nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
+    - Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
+    - clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
+    - clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
+    - clocksource/drivers/timer-of: Remove percpu irq related code
+    - uprobes: Use kzalloc to allocate xol area
+    - Revert "mm: skip CMA pages when they are not available"
+    - workqueue: wq_watchdog_touch is always called with valid CPU
+    - workqueue: Improve scalability of workqueue watchdog touch
+    - ACPI: processor: Return an error if acpi_processor_get_info() fails in
+      processor_add()
+    - ACPI: processor: Fix memory leaks in error paths of processor_add()
+    - arm64: acpi: Move get_cpu_for_acpi_id() to a header
+    - can: mcp251xfd: mcp251xfd_handle_rxif_ring_uinc(): factor out in separate
+      function
+    - can: mcp251xfd: rx: prepare to workaround broken RX FIFO head index erratum
+    - can: mcp251xfd: clarify the meaning of timestamp
+    - can: mcp251xfd: rx: add workaround for erratum DS80000789E 6 of mcp2518fd
+    - drm/amd: Add gfx12 swizzle mode defs
+    - drm/amdgpu: handle gfx12 in amdgpu_display_verify_sizes
+    - ata: libata-scsi: Remove redundant sense_buffer memsets
+    - ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf
+    - crypto: starfive - Align rsa input data to 32-bit
+    - crypto: starfive - Fix nent assignment in rsa dec
+    - clk: qcom: ipq9574: Update the alpha PLL type for GPLLs
+    - powerpc/64e: remove unused IBM HTW code
+    - powerpc/64e: split out nohash Book3E 64-bit code
+    - powerpc/64e: Define mmu_pte_psize static
+    - powerpc/vdso: Don't discard rela sections
+    - ASoC: tegra: Fix CBB error during probe()
+    - nvme-pci: allocate tagset on reset if necessary
+    - ASoc: SOF: topology: Clear SOF link platform name upon unload
+    - ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
+    - clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs
+    - clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time
+    - drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
+    - drm/i915/fence: Mark debug_fence_free() with __maybe_unused
+    - gpio: rockchip: fix OF node leak in probe()
+    - gpio: modepin: Enable module autoloading
+    - riscv: Fix toolchain vector detection
+    - riscv: Do not restrict memory size because of linear mapping on nommu
+    - membarrier: riscv: Add full memory barrier in switch_mm()
+    - [Config] updateconfigs for ARCH_HAS_MEMBARRIER_CALLBACKS
+    - x86/mm: Fix PTI for i386 some more
+    - btrfs: fix race between direct IO write and fsync when using same fd
+    - spi: spi-fsl-lpspi: Fix off-by-one in prescale max
+    - ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx
+    - ALSA: hda/realtek - Fix inactive headset mic jack for ASUS Vivobook 15
+      X1504VAP
+    - fuse: clear PG_uptodate when using a stolen page
+    - riscv: misaligned: remove CONFIG_RISCV_M_MODE specific code
+    - parisc: Delay write-protection until mark_rodata_ro() call
+    - pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now
+    - maple_tree: remove rcu_read_lock() from mt_validate()
+    - Revert "wifi: ath11k: restore country code during resume"
+    - btrfs: qgroup: don't use extent changeset when not needed
+    - btrfs: zoned: handle broken write pointer on zones
+    - drm/xe/gsc: Do not attempt to load the GSC multiple times
+    - drm/amdgpu: always allocate cleared VRAM for GEM allocations
+    - drm/amd/display: Lock DC and exit IPS when changing backlight
+    - ALSA: hda/realtek: extend quirks for Clevo V5[46]0
+    - cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition
+    - virt: sev-guest: Mark driver struct with __refdata to prevent section
+      mismatch
+    - media: b2c2: flexcop-usb: fix flexcop_usb_memory_req
+    - gve: Add adminq mutex lock
+    - wifi: rtw89: wow: prevent to send unexpected H2C during download Firmware
+    - drm/amdgpu: add missing error handling in function
+      amdgpu_gmc_flush_gpu_tlb_pasid
+    - crypto: qat - initialize user_input.lock for rate_limiting
+    - locking: Add rwsem_assert_held() and rwsem_assert_held_write()
+    - fs: don't copy to userspace under namespace semaphore
+    - fs: relax permissions for statmount()
+    - seccomp: release task filters when the task exits
+    - drm/amdgpu/display: handle gfx12 in amdgpu_dm_plane_format_mod_supported
+    - can: m_can: Remove m_can_rx_peripheral indirection
+    - can: m_can: Do not cancel timer from within timer
+    - mm: Provide a means of invalidation without using launder_folio
+    - cifs: Fix copy offload to flush destination region
+    - hwmon: ltc2991: fix register bits defines
+    - scripts: fix gfp-translate after ___GFP_*_BITS conversion to an enum
+    - ptp: ocp: convert serial ports to array
+    - ptp: ocp: adjust sysfs entries to expose tty information
+    - ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
+    - ice: remove ICE_CFG_BUSY locking from AF_XDP code
+    - net: xilinx: axienet: Fix race in axienet_stop
+    - iommu/vt-d: Remove control over Execute-Requested requests
+    - block: don't call bio_uninit from bio_endio
+    - tracing/kprobes: Add symbol counting check when module loads
+    - perf/x86/intel: Hide Topdown metrics events if the feature is not enumerated
+    - PCI: qcom: Override NO_SNOOP attribute for SA8775P RC
+    - staging: vchiq_core: Bubble up wait_event_interruptible() return value
+    - watchdog: imx7ulp_wdt: keep already running watchdog enabled
+    - btrfs: slightly loosen the requirement for qgroup removal
+    - drm/amdgpu: add PSP RAS address query command
+    - drm/amdgpu: add mutex to protect ras shared memory
+    - s390/boot: Do not assume the decompressor range is reserved
+    - drm/amdgpu: Fix two reset triggered in a row
+    - drm/amdgpu: Add reset_context flag for host FLR
+    - drm/amdgpu: Fix amdgpu_device_reset_sriov retry logic
+    - fs: only copy to userspace on success in listmount()
+    - iio: adc: ad7124: fix DT configuration parsing
+    - nvmem: u-boot-env: error if NVMEM device is too small
+    - mm: zswap: rename is_zswap_enabled() to zswap_is_enabled()
+    - mm/memcontrol: respect zswap.writeback setting from parent cg too
+    - path: add cleanup helper
+    - fs: simplify error handling
+    - fs: relax permissions for listmount()
+    - hid: bpf: add BPF_JIT dependency
+    - net/mlx5e: SHAMPO, Use KSMs instead of KLMs
+    - net/mlx5e: SHAMPO, Fix page leak
+    - drm/xe/xe2: Add workaround 14021402888
+    - drm/xe/xe2lpg: Extend workaround 14021402888
+    - clk: qcom: gcc-x1e80100: Fix USB 0 and 1 PHY GDSC pwrsts flags
+    - clk: qcom: gcc-x1e80100: Don't use parking clk_ops for QUPs
+    - nouveau: fix the fwsec sb verification register.
+    - riscv: Add tracepoints for SBI calls and returns
+    - riscv: Improve sbi_ecall() code generation by reordering arguments
+    - riscv: Fix RISCV_ALTERNATIVE_EARLY
+    - cifs: Fix zero_point init on inode initialisation
+    - nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err
+    - nvme: fix status magic numbers
+    - nvme: rename CDR/MORE/DNR to NVME_STATUS_*
+    - nvmet: Identify-Active Namespace ID List command should reject invalid nsid
+    - drm/i915/display: Add mechanism to use sink model when applying quirk
+    - drm/i915/display: Increase Fast Wake Sync length as a quirk
+    - LoongArch: Use accessors to page table entries instead of direct dereference
+    - Upstream stable to v6.6.51, v6.10.10
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46823
+    - kunit/overflow: Fix UB in overflow_allocation_test
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46834
+    - ethtool: fail closed if we can't get max channel used in indirection tables
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46751
+    - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46753
+    - btrfs: handle errors from btrfs_dec_ref() properly
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46841
+    - btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in
+      walk_down_proc()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46754
+    - bpf: Remove tst_run from lwt_seg6local_prog_ops.
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46824
+    - iommufd: Require drivers to supply the cache_invalidate_user ops
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46842
+    - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46766
+    - ice: move netif_queue_set_napi to rtnl-protected sections
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46772
+    - drm/amd/display: Check denominator crb_pipes before used
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46774
+    - powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46775
+    - drm/amd/display: Validate function returns
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46778
+    - drm/amd/display: Check UnboundedRequestEnabled's value
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46779
+    - drm/imagination: Free pvr_vm_gpuva after unlink
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46792
+    - riscv: misaligned: Restrict user access to kernel memory
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46793
+    - ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46735
+    - ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46737
+    - nvmet-tcp: fix kernel crash if commands allocation fails
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46822
+    - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46713
+    - perf/aux: Fix AUX buffer serialization
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46739
+    - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46740
+    - binder: fix UAF caused by offsets overwrite
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46741
+    - misc: fastrpc: Fix double free of 'buf' in error path
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47663
+    - staging: iio: frequency: ad9834: Validate frequency parameter value
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46832
+    - MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47668
+    - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46744
+    - Squashfs: sanity check symbolic link size
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46745
+    - Input: uinput - reject requests with unreasonable number of slots
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46746
+    - HID: amd_sfh: free driver_data after destroying hid device
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47664
+    - spi: hisi-kunpeng: Add verification for the max_frequency provided by the
+      firmware
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47665
+    - i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46749
+    - Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46750
+    - PCI: Add missing bridge lock to pci_bus_lock()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46752
+    - btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46840
+    - btrfs: clean up our handling of refs == 0 in snapshot delete
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46755
+    - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47666
+    - scsi: pm80xx: Set phy->enable_completion only when we wait for it
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46843
+    - scsi: ufs: core: Remove SCSI host only if added
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46760
+    - wifi: rtw88: usb: schedule rx work after everything is set up
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46761
+    - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46844
+    - um: line: always fill *error_out in setup_one_line()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46762
+    - xen: privcmd: Fix possible access to a freed kirqfd instance
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46763
+    - fou: Fix null-ptr-deref in GRO.
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46765
+    - ice: protect XDP configuration with a mutex
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46767
+    - net: phy: Fix missing of_node_put() for leds
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46768
+    - hwmon: (hp-wmi-sensors) Check if WMI event data exists
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46770
+    - ice: Add netif_device_attach/detach into PF reset flow
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46771
+    - can: bcm: Remove proc entry when dev is unregistered.
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46773
+    - drm/amd/display: Check denominator pbn_div before used
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47667
+    - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46835
+    - drm/amdgpu: Fix smatch static checker warning
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46776
+    - drm/amd/display: Run DC_LOG_DC after checking link->link_enc
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46836
+    - usb: gadget: aspeed_udc: validate endpoint index for ast udc
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46777
+    - udf: Avoid excessive partition lengths
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46825
+    - wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46826
+    - ELF: fix kernel.randomize_va_space double read
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46827
+    - wifi: ath12k: fix firmware crash due to invalid peer nss
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47669
+    - nilfs2: fix state management in error path of log writing function
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46780
+    - nilfs2: protect references to superblock parameters exposed in sysfs
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46781
+    - nilfs2: fix missing cleanup on rollforward recovery error
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46828
+    - sched: sch_cake: fix bulk flow accounting logic for host fairness
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46782
+    - ila: call nf_unregister_net_hooks() sooner
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46783
+    - tcp_bpf: fix return value of tcp_bpf_sendmsg()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46784
+    - net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46785
+    - eventfs: Use list_del_rcu() for SRCU protected list variable
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46786
+    - fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46787
+    - userfaultfd: fix checks for huge PMDs
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46838
+    - userfaultfd: don't BUG_ON() if khugepaged yanks our page table
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46845
+    - tracing/timerlat: Only clear timer if a kthread exists
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46788
+    - tracing/osnoise: Use a cpumask to know what threads are kthreads
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46846
+    - spi: rockchip: Resolve unbalanced runtime PM / system PM handling
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46847
+    - mm: vmalloc: ensure vmap_block is initialised before adding to queue
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46791
+    - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46829
+    - rtmutex: Drop rt_mutex::wait_lock before scheduling
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46848
+    - perf/x86/intel: Limit the period on Haswell
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46794
+    - x86/tdx: Fix data leak in mmio_read()
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46795
+    - ksmbd: unset the binding mark of a reused connection
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46797
+    - powerpc/qspinlock: Fix deadlock in MCS queue
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46830
+    - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46798
+    - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
+
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46831
+    - net: microchip: vcap: Fix use-after-free error in kunit test
+
+  * Navi24 RX6300 light up issue on 6.8 kernel (LP: #2084513)
+    - drm/amd/display: Ensure populate uclk in bb construction
+
+  * Noble update: upstream stable patchset 2024-10-18 (LP: #2084941)
+    - drm/fb-helper: Don't schedule_work() to flush frame buffer during panic()
+    - drm: panel-orientation-quirks: Add quirk for OrangePi Neo
+    - scsi: ufs: core: Check LSDBS cap when !mcq
+    - scsi: ufs: core: Bypass quick recovery if force reset is needed
+    - btrfs: tree-checker: validate dref root and objectid
+    - ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
+    - ALSA: hda/conexant: Mute speakers at suspend / shutdown
+    - ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
+    - ALSA: ump: Explicitly reset RPN with Null RPN
+    - ALSA: seq: ump: Use the common RPN/bank conversion context
+    - ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
+    - ALSA: seq: ump: Explicitly reset RPN with Null RPN
+    - net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule
+    - ASoC: amd: yc: Support mic on HP 14-em0002la
+    - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
+    - i2c: Fix conditional for substituting empty ACPI functions
+    - dma-debug: avoid deadlock between dma debug vs printk and netconsole
+    - net: usb: qmi_wwan: add MeiG Smart SRM825L
+    - ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
+    - ASoC: codecs: ES8326: button detect issue
+    - selftests: mptcp: userspace pm create id 0 subflow
+    - selftests: mptcp: dump userspace addrs list
+    - selftests: mptcp: userspace pm get addr tests
+    - selftests: mptcp: declare event macros in mptcp_lib
+    - selftests: mptcp: join: cannot rm sf if closed
+    - selftests: mptcp: add explicit test case for remove/readd
+    - selftests: mptcp: join: check re-using ID of unused ADD_ADDR
+    - selftests: mptcp: join: check re-adding init endp with != id
+    - selftests: mptcp: add mptcp_lib_events helper
+    - selftests: mptcp: join: validate event numbers
+    - selftests: mptcp: join: check re-re-adding ID 0 signal
+    - selftests: mptcp: join: test for flush/re-add endpoints
+    - selftests: mptcp: join: disable get and dump addr checks
+    - selftests: mptcp: join: stop transfer when check is done (part 2.2)
+    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
+    - drm/amd/display: Assign linear_pitch_alignment even for VM
+    - drm/amdgpu: fix overflowed array index read warning
+    - drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
+    - drm/amd/pm: fix uninitialized variable warning
+    - drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
+    - drm/amd/pm: fix warning using uninitialized value of max_vid_step
+    - drm/amd/pm: Fix negative array index read
+    - drm/amd/pm: fix the Out-of-bounds read warning
+    - drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
+    - drm/amdgpu: avoid reading vf2pf info size from FB
+    - drm/amd/display: Check gpio_id before used as array index
+    - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
+    - drm/amd/display: Check index for aux_rd_interval before using
+    - drm/amd/display: Add array index check for hdcp ddc access
+    - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
+    - drm/amd/display: Check msg_id before processing transcation
+    - drm/amd/display: Fix Coverity INTERGER_OVERFLOW within
+      construct_integrated_info
+    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
+      dal_gpio_service_create
+    - drm/amd/display: Spinlock before reading event
+    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
+      decide_fallback_link_setting_max_bw_policy
+    - drm/amd/display: Ensure index calculation will not overflow
+    - drm/amd/display: Skip inactive planes within
+      ModeSupportAndSystemConfiguration
+    - drm/amd/display: Fix index may exceed array range within
+      fpu_update_bw_bounding_box
+    - drm/amd/amdgpu: Check tbo resource pointer
+    - drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
+    - drm/amdgpu/pm: Fix uninitialized variable warning for smu10
+    - drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
+    - drm/amdgpu: Fix the uninitialized variable warning
+    - drm/amdkfd: Check debug trap enable before write dbg_ev_file
+    - drm/amdkfd: Reconcile the definition and use of oem_id in struct
+      kfd_topology_device
+    - apparmor: fix possible NULL pointer dereference
+    - wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem()
+    - wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem()
+    - drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy
+      SOCs
+    - drm/amdgpu: Fix the warning division or modulo by zero
+    - drm/amdgpu: fix dereference after null check
+    - drm/amdgpu: fix the waring dereferencing hive
+    - drm/amd/pm: check specific index for aldebaran
+    - drm/amd/pm: check specific index for smu13
+    - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
+    - drm/amd/pm: check negtive return for table entries
+    - wifi: rtw89: ser: avoid multiple deinit on same CAM
+    - drm/kfd: Correct pinned buffer handling at kfd restore and validate process
+    - drm/amdgpu: update type of buf size to u32 for eeprom functions
+    - wifi: iwlwifi: remove fw_running op
+    - cpufreq: scmi: Avoid overflow of target_freq in fast switch
+    - PCI: al: Check IORESOURCE_BUS existence during probe
+    - wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
+    - hwspinlock: Introduce hwspin_lock_bust()
+    - soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
+    - RDMA/efa: Properly handle unexpected AQ completions
+    - ionic: fix potential irq name truncation
+    - pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
+    - rcu/nocb: Remove buggy bypass lock contention mitigation
+    - media: v4l2-cci: Always assign *val
+    - usbip: Don't submit special requests twice
+    - usb: typec: ucsi: Fix null pointer dereference in trace
+    - fsnotify: clear PARENT_WATCHED flags lazily
+    - net: remove NULL-pointer net parameter in ip_metrics_convert
+    - drm/amdgu: fix Unintentional integer overflow for mall size
+    - regmap: spi: Fix potential off-by-one when calculating reserved size
+    - smack: tcp: ipv4, fix incorrect labeling
+    - platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
+    - net/mlx5e: SHAMPO, Fix incorrect page release
+    - drm/meson: plane: Add error handling
+    - crypto: stm32/cryp - call finalize with bh disabled
+    - gfs2: Revert "Add quota_change type"
+    - drm/bridge: tc358767: Check if fully initialized before signalling HPD event
+      via IRQ
+    - dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while invoking
+      callbacks
+    - dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
+    - hwmon: (k10temp) Check return value of amd_smn_read()
+    - wifi: cfg80211: make hash table duplicates more survivable
+    - f2fs: fix to do sanity check on blocks for inline_data inode
+    - driver: iio: add missing checks on iio_info's callback access
+    - block: remove the blk_flush_integrity call in blk_integrity_unregister
+    - drm/amdgpu: add skip_hw_access checks for sriov
+    - drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
+    - drm/amdgpu: add lock in kfd_process_dequeue_from_device
+    - drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay
+    - drm/amd/display: added NULL check at start of dc_validate_stream
+    - drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
+    - drm/amd/display: use preferred link settings for dp signal only
+    - drm/amd/display: Check BIOS images before it is used
+    - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
+    - media: uvcvideo: Enforce alignment of frame and interval
+    - virtio_net: Fix napi_skb_cache_put warning
+    - i2c: Use IS_REACHABLE() for substituting empty ACPI functions
+    - btrfs: factor out stripe length calculation into a helper
+    - btrfs: scrub: update last_physical after scrubbing one stripe
+    - btrfs: fix qgroup reserve leaks in cow_file_range
+    - virtio-net: check feature before configuring the vq coalescing command
+    - drm/amd/display: Handle the case which quad_part is equal 0
+    - drm/amdgpu: Handle sg size limit for contiguous allocation
+    - drm/amd/pm: fix uninitialized variable warning for smu_v13
+    - drm/amdgpu: fix uninitialized scalar variable warning
+    - drm/amd/display: Ensure array index tg_inst won't be -1
+    - drm/amd/display: handle invalid connector indices
+    - drm/amd/display: Increase MAX_LINKS by 2
+    - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than
+      max_links
+    - drm/amd/display: Fix incorrect size calculation for loop
+    - drm/amd/display: Use kcalloc() instead of kzalloc()
+    - drm/amd/display: Add missing NULL pointer check within
+      dpcd_extend_address_range
+    - drm/amd/display: Release state memory if amdgpu_dm_create_color_properties
+      fail
+    - drm/amd/display: Check link_index before accessing dc->links[]
+    - drm/amd/display: Add otg_master NULL check within
+      resource_log_pipe_topology_update
+    - drm/amd/display: Release clck_src memory if clk_src_construct fails
+    - drm/amd/display: Fix writeback job lock evasion within dm_crtc_high_irq
+    - drm/xe: Demote CCS_MODE info to debug only
+    - drm/drm-bridge: Drop conditionals around of_node pointers
+    - drm/amdgpu: fix uninitialized variable warning for amdgpu_xgmi
+    - drm/amdgpu: fix uninitialized variable warning for jpeg_v4
+    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_info_ioctl
+    - wifi: ath12k: initialize 'ret' in ath12k_dp_rxdma_ring_sel_config_wcn7850()
+    - drm/amdgpu/pm: Check input value for power profile setting on smu11, smu13
+      and smu14
+    - drm/xe: Fix the warning conditions
+    - drm/amd/display: Fix pipe addition logic in calc_blocks_to_ungate DCN35
+    - wifi: cfg80211: restrict operation during radar detection
+    - remoteproc: qcom_q6v5_pas: Add hwspinlock bust on stop
+    - tcp: annotate data-races around tw->tw_ts_recent and tw->tw_ts_recent_stamp
+    - drm/xe: Don't overmap identity VRAM mapping
+    - net: tcp/dccp: prepare for tw_timer un-pinning
+    - drm/xe: Ensure caller uses sole domain for xe_force_wake_assert_held
+    - drm/xe: Check valid domain is passed in xe_force_wake_ref
+    - thermal: trip: Use READ_ONCE() for lockless access to trip properties
+    - drm/xe: Add GuC state asserts to deregister_exec_queue
+    - drm/amdgpu: fix overflowed constant warning in mmhub_set_clockgating()
+    - drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection
+    - drm/amd/display: Disable DMCUB timeout for DCN35
+    - drm/amd/display: Avoid overflow from uint32_t to uint8_t
+    - pinctrl: core: reset gpio_device in loop in pinctrl_pins_show()
+    - Upstream stable to v6.6.50, v6.10.9
+
+  * CVE-2024-46747
+    - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
+
+  * CVE-2024-46725
+    - drm/amdgpu: Fix out-of-bounds write warning
+
+  * CVE-2024-46724
+    - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
+
+  * [SRU] Fix AST DP output after resume (LP: #2083022)
+    - drm/ast: Inline drm_simple_encoder_init()
+    - drm/ast: Implement atomic enable/disable for encoders
+    - drm/ast: Program mode for AST DP in atomic_mode_set
+    - drm/ast: Move mode-setting code into mode_set_nofb CRTC helper
+    - drm/ast: Handle primary-plane format setup in atomic_update
+    - drm/ast: Remove gamma LUT updates from DPMS code
+    - drm/ast: Only set VGA SCREEN_DISABLE bit in CRTC code
+    - drm/ast: Inline ast_crtc_dpms() into callers
+    - drm/ast: Use drm_atomic_helper_commit_tail() helper
+
+  * UBSAN array-index-out-of-bounds reported with N-6.8 on P9 node baltar
+    (LP: #2078038)
+    - scripts/kernel-doc: reindent
+    - compiler_types: add Endianness-dependent __counted_by_{le, be}
+    - scsi: aacraid: union aac_init: Replace 1-element array with flexible array
+    - scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array with
+      flexible array
+    - scsi: aacraid: Rearrange order of struct aac_srb_unit
+    - scsi: aacraid: struct {user, }sgmap{, 64, raw}: Replace 1-element arrays
+      with flexible arrays
+
+  * r8169: transmit queue 0 timed out error when re-plugging the Ethernet cable
+    (LP: #2084526)
+    - r8169: disable ALDPS per default for RTL8125
+
+  * [SRU] cpufreq: intel_pstate: Support Emerald Rapids OOB mode (LP: #2084834)
+    - cpufreq: intel_pstate: Support Emerald Rapids OOB mode
+
+  * CVE-2024-46723
+    - drm/amdgpu: fix ucode out-of-bounds read warning
+
+  * CVE-2024-46743
+    - of/irq: Prevent device address out-of-bounds read in interrupt map walk
+
+  * CVE-2024-46757
+    - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
+
+  * [SRU] Ubuntu 24.04 - GPU cannot be installed with DL380a Gen12 (2P, SRF-SP)
+    (LP: #2081079)
+    - perf/x86/uncore: Save the unit control address of all units
+    - perf/x86/uncore: Support per PMU cpumask
+    - perf/x86/uncore: Retrieve the unit ID from the unit control RB tree
+    - perf/x86/uncore: Apply the unit control RB tree to MMIO uncore units
+    - perf/x86/uncore: Apply the unit control RB tree to MSR uncore units
+    - perf/x86/uncore: Apply the unit control RB tree to PCI uncore units
+    - perf/x86/uncore: Cleanup unused unit structure
+    - perf/x86/intel/uncore: Support HBM and CXL PMON counters
+
+  * Noble update: upstream stable patchset 2024-10-11 (LP: #2084225)
+    - ALSA: seq: Skip event type filtering for UMP events
+    - LoongArch: Remove the unused dma-direct.h
+    - btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()
+    - btrfs: run delayed iputs when flushing delalloc
+    - smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
+    - pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
+    - pinctrl: single: fix potential NULL dereference in pcs_get_function()
+    - wifi: wfx: repair open network AP mode
+    - wifi: mwifiex: duplicate static structs used in driver instances
+    - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
+    - mptcp: close subflow when receiving TCP+FIN
+    - mptcp: sched: check both backup in retrans
+    - mptcp: pm: reuse ID 0 after delete and re-add
+    - mptcp: pm: skip connecting to already established sf
+    - mptcp: pm: reset MPC endp ID when re-added
+    - mptcp: pm: send ACK on an active subflow
+    - mptcp: pm: do not remove already closed subflows
+    - mptcp: pm: fix ID 0 endp usage after multiple re-creations
+    - mptcp: pm: ADD_ADDR 0 is not a new address
+    - selftests: mptcp: join: check removing ID 0 endpoint
+    - selftests: mptcp: join: no extra msg if no counter
+    - selftests: mptcp: join: check re-re-adding ID 0 endp
+    - drm/amdgpu/swsmu: always force a state reprogram on init
+    - drm/vmwgfx: Fix prime with external buffers
+    - usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister
+      existing source caps before re-registration"
+    - ASoC: amd: acp: fix module autoloading
+    - ASoC: SOF: amd: Fix for acp init sequence
+    - pinctrl: mediatek: common-v2: Fix broken bias-disable for
+      PULL_PU_PD_RSEL_TYPE
+    - pinctrl: starfive: jh7110: Correct the level trigger configuration of iev
+      register
+    - ovl: pass string to ovl_parse_layer()
+    - ovl: fix wrong lowerdir number check for parameter Opt_lowerdir
+    - ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err
+    - mm: Fix missing folio invalidation calls during truncation
+    - cifs: Fix FALLOC_FL_PUNCH_HOLE support
+    - selinux,smack: don't bypass permissions check in inode_setsecctx hook
+    - iommufd: Do not allow creating areas without READ or WRITE
+    - phy: fsl-imx8mq-usb: fix tuning parameter name
+    - dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA
+    - dmaengine: dw-edma: Do not enable watermark interrupts for HDMA
+    - phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
+    - dmaengine: dw: Add peripheral bus width verification
+    - dmaengine: dw: Add memory bus width verification
+    - Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test
+    - Bluetooth: btnxpuart: Handle FW Download Abort scenario
+    - Bluetooth: btnxpuart: Fix random crash seen while removing driver
+    - Bluetooth: hci_core: Fix not handling hibernation actions
+    - iommu: Do not return 0 from map_pages if it doesn't do anything
+    - netfilter: nf_tables: restore IP sanity checks for netdev/egress
+    - wifi: iwlwifi: fw: fix wgds rev 3 exact size
+    - ethtool: check device is present when getting link settings
+    - netfilter: nf_tables_ipv6: consider network offset in netdev/egress
+      validation
+    - selftests: forwarding: no_forwarding: Down ports on cleanup
+    - selftests: forwarding: local_termination: Down ports on cleanup
+    - bonding: implement xdo_dev_state_free and call it after deletion
+    - bonding: extract the use of real_device into local variable
+    - bonding: change ipsec_lock from spin lock to mutex
+    - gtp: fix a potential NULL pointer dereference
+    - sctp: fix association labeling in the duplicate COOKIE-ECHO case
+    - drm/amd/display: avoid using null object of framebuffer
+    - net: busy-poll: use ktime_get_ns() instead of local_clock()
+    - nfc: pn533: Add poll mod list filling check
+    - soc: qcom: cmd-db: Map shared memory as WC, not WB
+    - soc: qcom: pmic_glink: Actually communicate when remote goes down
+    - soc: qcom: pmic_glink: Fix race during initialization
+    - cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
+    - scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress
+    - USB: serial: option: add MeiG Smart SRM825L
+    - ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design
+    - usb: dwc3: omap: add missing depopulate in probe error path
+    - usb: dwc3: core: Prevent USB core invalid event buffer address access
+    - usb: dwc3: st: fix probed platform device ref count on probe error path
+    - usb: dwc3: st: add missing depopulate in probe error path
+    - usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
+      remove_power_attributes()
+    - usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
+    - usb: cdnsp: fix for Link TRB with TC
+    - ARM: dts: omap3-n900: correct the accelerometer orientation
+    - arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962
+    - arm64: dts: imx93: add nvmem property for fec1
+    - arm64: dts: imx93: add nvmem property for eqos
+    - arm64: dts: imx93: update default value for snps,clk-csr
+    - arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges
+    - arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo
+    - scsi: aacraid: Fix double-free on probe failure
+    - apparmor: fix policy_unpack_test on big endian systems
+    - mptcp: pr_debug: add missing \n at the end
+    - mptcp: make pm_remove_addrs_and_subflows static
+    - mptcp: pm: fix RM_ADDR ID for the initial subflow
+    - mptcp: avoid duplicated SUB_CLOSED events
+    - drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict
+    - drm/vmwgfx: Prevent unmapping active read buffers
+    - drm/vmwgfx: Disable coherent dumb buffers without 3d
+    - firmware/sysfb: Set firmware-framebuffer parent device
+    - firmware/sysfb: Create firmware device only for enabled PCI devices
+    - video/aperture: optionally match the device in sysfb_disable()
+    - drm/xe: Prepare display for D3Cold
+    - drm/xe/display: Make display suspend/resume work on discrete
+    - drm/xe/vm: Simplify if condition
+    - drm/xe/exec_queue: Rename xe_exec_queue::compute to xe_exec_queue::lr
+    - drm/xe: prevent UAF around preempt fence
+    - pinctrl: qcom: x1e80100: Update PDC hwirq map
+    - ASoC: SOF: amd: move iram-dram fence register programming sequence
+    - nfsd: ensure that nfsd4_fattr_args.context is zeroed out
+    - backing-file: convert to using fops->splice_write
+    - pinctrl: qcom: x1e80100: Fix special pin offsets
+    - afs: Fix post-setattr file edit to do truncation correctly
+    - netfs: Fix netfs_release_folio() to say no if folio dirty
+    - netfs: Fix missing iterator reset on retry of short read
+    - dmaengine: ti: omap-dma: Initialize sglen after allocation
+    - pktgen: use cpus_read_lock() in pg_net_init()
+    - net_sched: sch_fq: fix incorrect behavior for small weights
+    - tcp: fix forever orphan socket caused by tcp_abort
+    - drm/xe/hwmon: Fix WRITE_I1 param from u32 to u16
+    - usb: typec: fsa4480: Relax CHIP_ID check
+    - firmware: qcom: scm: Mark get_wq_ctx() as atomic call
+    - usb: gadget: uvc: queue pump work in uvcg_video_enable()
+    - usb: dwc3: xilinx: add missing depopulate in probe error path
+    - usb: typec: ucsi: Move unregister out of atomic section
+    - firmware: microchip: fix incorrect error report of programming:timeout on
+      success
+    - Upstream stable to v6.6.49, v6.10.8
+
+  * Fix blank screen on external display after reconnecting the USB type-C
+    (LP: #2081786) // Noble update: upstream stable patchset 2024-10-11
+    (LP: #2084225)
+    - drm/i915/display: add intel_display -> drm_device backpointer
+    - drm/i915/display: add generic to_intel_display() macro
+    - drm/i915/dp_mst: Fix MST state after a sink reset
+
+  * Noble update: upstream stable patchset 2024-10-09 (LP: #2084005)
+    - tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
+    - tty: atmel_serial: use the correct RTS flag.
+    - Revert "ACPI: EC: Evaluate orphan _REG under EC device"
+    - Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"
+    - Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET"
+    - selinux: revert our use of vma_is_initial_heap()
+    - fuse: Initialize beyond-EOF page contents before setting uptodate
+    - char: xillybus: Don't destroy workqueue from work item running on it
+    - char: xillybus: Refine workqueue handling
+    - char: xillybus: Check USB endpoints when probing device
+    - ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
+    - ALSA: usb-audio: Support Yamaha P-125 quirk entry
+    - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
+    - thunderbolt: Mark XDomain as unplugged when router is removed
+    - ALSA: hda/tas2781: fix wrong calibrated data order
+    - s390/dasd: fix error recovery leading to data corruption on ESE devices
+    - KVM: s390: fix validity interception issue when gisa is switched off
+    - riscv: change XIP's kernel_map.size to be size of the entire kernel
+    - i2c: tegra: Do not mark ACPI devices as irq safe
+    - ACPICA: Add a depth argument to acpi_execute_reg_methods()
+    - ACPI: EC: Evaluate _REG outside the EC scope more carefully
+    - arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to
+      NUMA_NO_NODE
+    - dm resume: don't return EINVAL when signalled
+    - dm persistent data: fix memory allocation failure
+    - fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
+    - s390/cio: rename bitmap_size() -> idset_bitmap_size()
+    - btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
+    - bitmap: introduce generic optimized bitmap_size()
+    - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
+    - i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
+    - rtla/osnoise: Prevent NULL dereference in error handling
+    - net: mana: Fix RX buf alloc_size alignment and atomic op panic
+    - net: mana: Fix doorbell out of order violation and avoid unnecessary
+      doorbell rings
+    - wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
+    - selinux: fix potential counting error in avc_add_xperms_decision()
+    - selinux: add the processing of the failure of avc_add_xperms_decision()
+    - mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu
+    - btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type
+    - btrfs: zoned: properly take lock to read/update block group's zoned
+      variables
+    - btrfs: tree-checker: add dev extent item checks
+    - drm/amdgpu: Actually check flags for all context ops.
+    - memcg_write_event_control(): fix a user-triggerable oops
+    - drm/amdgpu/jpeg2: properly set atomics vmid field
+    - drm/amdgpu/jpeg4: properly set atomics vmid field
+    - s390/uv: Panic for set and remove shared access UVC errors
+    - bpf: Fix updating attached freplace prog in prog_array map
+    - igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
+    - igc: Fix qbv_config_change_errors logics
+    - igc: Fix reset adapter logics when tx mode change
+    - net/mlx5e: Take state lock during tx timeout reporter
+    - net/mlx5e: Correctly report errors for ethtool rx flows
+    - net: axienet: Fix register defines comment description
+    - net: dsa: vsc73xx: pass value in phy_write operation
+    - net: dsa: vsc73xx: use read_poll_timeout instead delay loop
+    - net: dsa: vsc73xx: check busy flag in MDIO operations
+    - net: ethernet: mtk_wed: fix use-after-free panic in
+      mtk_wed_setup_tc_block_cb()
+    - mlxbf_gige: disable RX filters until RX path initialized
+    - mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
+    - tcp: Update window clamping condition
+    - netfilter: allow ipv6 fragments to arrive on different devices
+    - netfilter: flowtable: initialise extack before use
+    - netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
+    - netfilter: nf_tables: Audit log dump reset after the fact
+    - netfilter: nf_tables: Introduce nf_tables_getobj_single
+    - netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests
+    - vsock: fix recursive ->recvmsg calls
+    - selftests: net: lib: ignore possible errors
+    - selftests: net: lib: kill PIDs before del netns
+    - net: hns3: fix wrong use of semaphore up
+    - net: hns3: use the user's cfg after reset
+    - net: hns3: fix a deadlock problem when config TC during resetting
+    - gpio: mlxbf3: Support shutdown() function
+    - ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
+    - rust: work around `bindgen` 0.69.0 issue
+    - rust: suppress error messages from CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
+    - rust: fix the default format for CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
+    - cpu/SMT: Enable SMT only if a core is online
+    - powerpc/topology: Check if a core is online
+    - arm64: Fix KASAN random tag seed initialization
+    - block: Fix lockdep warning in blk_mq_mark_tag_wait
+    - wifi: ath12k: Add missing qmi_txn_cancel() calls
+    - quota: Remove BUG_ON from dqget()
+    - riscv: blacklist assembly symbols for kprobe
+    - kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
+    - media: pci: cx23885: check cx23885_vdev_init() return
+    - fs: binfmt_elf_efpic: don't use missing interpreter's properties
+    - scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
+    - media: drivers/media/dvb-core: copy user arrays safely
+    - wifi: iwlwifi: mvm: avoid garbage iPN
+    - net/sun3_82586: Avoid reading past buffer in debug output
+    - drm/lima: set gp bus_stop bit before hard reset
+    - gpio: sysfs: extend the critical section for unregistering sysfs devices
+    - hrtimer: Select housekeeping CPU during migration
+    - virtiofs: forbid newlines in tags
+    - accel/habanalabs: fix debugfs files permissions
+    - clocksource/drivers/arm_global_timer: Guard against division by zero
+    - tick: Move got_idle_tick away from common flags
+    - netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
+    - md: clean up invalid BUG_ON in md_ioctl
+    - x86: Increase brk randomness entropy for 64-bit systems
+    - memory: stm32-fmc2-ebi: check regmap_read return value
+    - parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
+    - rxrpc: Don't pick values out of the wire header when setting up security
+    - f2fs: stop checkpoint when get a out-of-bounds segment
+    - powerpc/boot: Handle allocation failure in simple_realloc()
+    - powerpc/boot: Only free if realloc() succeeds
+    - btrfs: delayed-inode: drop pointless BUG_ON in __btrfs_remove_delayed_item()
+    - btrfs: defrag: change BUG_ON to assertion in btrfs_defrag_leaves()
+    - btrfs: change BUG_ON to assertion when checking for delayed_node root
+    - btrfs: push errors up from add_async_extent()
+    - btrfs: handle invalid root reference found in may_destroy_subvol()
+    - btrfs: send: handle unexpected data in header buffer in begin_cmd()
+    - btrfs: send: handle unexpected inode in header process_recorded_refs()
+    - btrfs: change BUG_ON to assertion in tree_move_down()
+    - btrfs: delete pointless BUG_ON check on quota root in
+      btrfs_qgroup_account_extent()
+    - f2fs: fix to do sanity check in update_sit_entry
+    - usb: gadget: fsl: Increase size of name buffer for endpoints
+    - nvme: clear caller pointer on identify failure
+    - Bluetooth: bnep: Fix out-of-bound access
+    - firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid
+    - rtc: nct3018y: fix possible NULL dereference
+    - net: hns3: add checking for vf id of mailbox
+    - nvmet-tcp: do not continue for invalid icreq
+    - NFS: avoid infinite loop in pnfs_update_layout.
+    - openrisc: Call setup_memory() earlier in the init sequence
+    - s390/iucv: fix receive buffer virtual vs physical address confusion
+    - irqchip/renesas-rzg2l: Do not set TIEN and TINT source at the same time
+    - platform/x86: lg-laptop: fix %s null argument warning
+    - usb: dwc3: core: Skip setting event buffers for host only controllers
+    - irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
+    - ext4: set the type of max_zeroout to unsigned int to avoid overflow
+    - nvmet-rdma: fix possible bad dereference when freeing rsps
+    - selftests/bpf: Fix a few tests for GCC related warnings.
+    - Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
+    - nvme: use srcu for iterating namespace list
+    - drm/amdgpu: fix dereference null return value for the function
+      amdgpu_vm_pt_parent
+    - hrtimer: Prevent queuing of hrtimer without a function callback
+    - nvme: fix namespace removal list
+    - gtp: pull network headers in gtp_dev_xmit()
+    - riscv: entry: always initialize regs->a0 to -ENOSYS
+    - smb3: fix lock breakage for cached writes
+    - dm suspend: return -ERESTARTSYS instead of -EINTR
+    - selftests: memfd_secret: don't build memfd_secret test on unsupported arches
+    - mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order
+      fallback to order 0
+    - btrfs: send: allow cloning non-aligned extent if it ends at i_size
+    - drm/amd/amdgpu: command submission parser for JPEG
+    - platform/surface: aggregator: Fix warning when controller is destroyed in
+      probe
+    - ALSA: hda/tas2781: Use correct endian conversion
+    - Bluetooth: hci_core: Fix LE quote calculation
+    - Bluetooth: SMP: Fix assumption of Central always being Initiator
+    - net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and
+      register injection
+    - net: mscc: ocelot: fix QoS class for injected packets with "ocelot-8021q"
+    - net: mscc: ocelot: serialize access to the injection/extraction groups
+    - tc-testing: don't access non-existent variable on exception
+    - selftests: udpgro: report error when receive failed
+    - tcp/dccp: bypass empty buckets in inet_twsk_purge()
+    - tcp/dccp: do not care about families in inet_twsk_purge()
+    - tcp: prevent concurrent execution of tcp_sk_exit_batch
+    - net: mctp: test: Use correct skb for route input check
+    - kcm: Serialise kcm_sendmsg() for the same socket.
+    - netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
+    - netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
+    - ip6_tunnel: Fix broken GRO
+    - bonding: fix bond_ipsec_offload_ok return type
+    - bonding: fix null pointer deref in bond_ipsec_offload_ok
+    - bonding: fix xfrm real_dev null pointer dereference
+    - bonding: fix xfrm state handling when clearing active slave
+    - ice: fix page reuse when PAGE_SIZE is over 8k
+    - ice: fix ICE_LAST_OFFSET formula
+    - ice: fix truesize operations for PAGE_SIZE >= 8192
+    - dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
+    - igb: cope with large MAX_SKB_FRAGS
+    - net: dsa: mv88e6xxx: Fix out-of-bound access
+    - udp: fix receiving fraglist GSO packets
+    - ipv6: fix possible UAF in ip6_finish_output2()
+    - ipv6: prevent possible UAF in ip6_xmit()
+    - bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
+    - netfilter: flowtable: validate vlan header
+    - octeontx2-af: Fix CPT AF register offset calculation
+    - net: xilinx: axienet: Always disable promiscuous mode
+    - net: xilinx: axienet: Fix dangling multicast addresses
+    - net: ovs: fix ovs_drop_reasons error
+    - drm/msm/dpu: don't play tricks with debug macros
+    - drm/msm/dp: fix the max supported bpp logic
+    - drm/msm/dpu: split dpu_encoder_wait_for_event into two functions
+    - drm/msm/dpu: capture snapshot on the first commit_done timeout
+    - drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()
+    - drm/msm/dp: reset the link phy params before link training
+    - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
+    - drm/msm/dpu: take plane rotation into account for wide planes
+    - drm/msm: fix the highest_bank_bit for sc7180
+    - mmc: mmc_test: Fix NULL dereference on allocation failure
+    - Bluetooth: MGMT: Add error handling to pair_device()
+    - scsi: core: Fix the return value of scsi_logical_block_count()
+    - ksmbd: the buffer of smb2 query dir response has at least 1 byte
+    - drm/amdgpu: Validate TA binary size
+    - net: dsa: microchip: fix PTP config failure when using multiple ports
+    - MIPS: Loongson64: Set timer mode in cpu-probe
+    - HID: wacom: Defer calculation of resolution until resolution_code is known
+    - Input: i8042 - add forcenorestore quirk to leave controller untouched even
+      on s3
+    - Input: i8042 - use new forcenorestore quirk to replace old buggy quirk
+      combination
+    - cxgb4: add forgotten u64 ivlan cast before shift
+    - KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
+    - mmc: mtk-sd: receive cmd8 data when hs400 tuning fail
+    - mmc: dw_mmc: allow biu and ciu clocks to defer
+    - smb3: fix broken cached reads when posix locks
+    - pmdomain: imx: scu-pd: Remove duplicated clocks
+    - pmdomain: imx: wait SSAR when i.MX93 power domain on
+    - nouveau/firmware: use dma non-coherent allocator
+    - mptcp: pm: re-using ID of unused removed ADD_ADDR
+    - mptcp: pm: re-using ID of unused removed subflows
+    - mptcp: pm: re-using ID of unused flushed subflows
+    - mptcp: pm: remove mptcp_pm_remove_subflow()
+    - mptcp: pm: only mark 'subflow' endp as available
+    - mptcp: pm: only decrement add_addr_accepted for MPJ req
+    - mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
+    - mptcp: pm: only in-kernel cannot have entries with ID 0
+    - mptcp: pm: fullmesh: select the right ID later
+    - mptcp: pm: avoid possible UaF when selecting endp
+    - selftests: mptcp: join: validate fullmesh endp on 1st sf
+    - selftests: mptcp: join: restrict fullmesh endp on 1st sf
+    - selftests: mptcp: join: check re-using ID of closed subflow
+    - tcp: do not export tcp_twsk_purge()
+    - drm/msm/mdss: specify cfg bandwidth for SDM670
+    - drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels
+    - igc: Fix qbv tx latency by setting gtxoffset
+    - ALSA: timer: Relax start tick time check for slave timer elements
+    - bpf: Fix a kernel verifier crash in stacksafe()
+    - selftests/bpf: Add a test to verify previous stacksafe() fix
+    - Revert "s390/dasd: Establish DMA alignment"
+    - Input: MT - limit max slots
+    - tools: move alignment-related macros to new <linux/align.h>
+    - Revert "serial: 8250_omap: Set the console genpd always on if no console
+      suspend"
+    - usb: misc: ljca: Add Lunar Lake ljca GPIO HID to ljca_gpio_hids[]
+    - usb: xhci: Check for xhci->interrupters being allocated in
+      xhci_mem_clearup()
+    - vfs: Don't evict inode under the inode lru traversing context
+    - tracing: Return from tracing_buffers_read() if the file has been closed
+    - mm: fix endless reclaim on machines with unaccepted memory
+    - fs/netfs/fscache_cookie: add missing "n_accesses" check
+    - mm/numa: no task_numa_fault() call if PMD is changed
+    - mm/numa: no task_numa_fault() call if PTE is changed
+    - btrfs: check delayed refs when we're checking if a ref exists
+    - drm/amd/display: Adjust cursor position
+    - drm/amd/display: fix s2idle entry for DCN3.5+
+    - drm/amd/display: Enable otg synchronization logic for DCN321
+    - drm/amd/display: fix cursor offset on rotation 180
+    - netfs: Fault in smaller chunks for non-large folio mappings
+    - libfs: fix infinite directory reads for offset dir
+    - kallsyms: Avoid weak references for kallsyms symbols
+    - kbuild: avoid unneeded kallsyms step 3
+    - kbuild: refactor variables in scripts/link-vmlinux.sh
+    - kbuild: remove PROVIDE() for kallsyms symbols
+    - kallsyms: get rid of code for absolute kallsyms
+    - [Config] Remove CONFIG_KALLSYMS_BASE_RELATIVE
+    - kallsyms: Do not cleanup .llvm.<hash> suffix before sorting symbols
+    - bpf: Replace deprecated strncpy with strscpy
+    - kallsyms: replace deprecated strncpy with strscpy
+    - kallsyms: rework symbol lookup return codes
+    - kallsyms: Match symbols exactly with CONFIG_LTO_CLANG
+    - drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()`
+    - drm/amd/display: Don't register panel_power_savings on OLED panels
+    - wifi: ath12k: use 128 bytes aligned iova in transmit path for WCN7850
+    - kbuild: merge temporary vmlinux for BTF and kallsyms
+    - kbuild: avoid scripts/kallsyms parsing /dev/null
+    - Bluetooth: HCI: Invert LE State quirk to be opt-out rather then opt-in
+    - net/mlx5: Fix IPsec RoCE MPV trace call
+    - selftests: udpgro: no need to load xdp for gro
+    - ice: use internal pf id instead of function number
+    - drm/msm/dpu: limit QCM2290 to RGB formats only
+    - drm/msm/dpu: relax YUV requirements
+    - spi: spi-cadence-quadspi: Fix OSPI NOR failures during system resume
+    - drm/xe/display: stop calling domains_driver_remove twice
+    - drm/xe: Fix opregion leak
+    - drm/xe/mmio: move mmio_fini over to devm
+    - drm/xe: reset mmio mappings with devm
+    - drm/xe: Fix tile fini sequence
+    - drm/xe: Fix missing workqueue destroy in xe_gt_pagefault
+    - drm/xe: Free job before xe_exec_queue_put
+    - thermal/debugfs: Fix the NULL vs IS_ERR() confusion in debugfs_create_dir()
+    - nvme: move stopping keep-alive into nvme_uninit_ctrl()
+    - drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1
+    - s390/ap: Refine AP bus bindings complete processing
+    - net: ngbe: Fix phy mode set to external phy
+    - iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace()
+    - cgroup/cpuset: fix panic caused by partcmd_update
+    - cgroup/cpuset: Clear effective_xcpus on cpus_allowed clearing only if
+      cpus.exclusive not set
+    - of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put()
+      handling
+    - thermal: of: Fix OF node leak in thermal_of_trips_init() error path
+    - thermal: of: Fix OF node leak in thermal_of_zone_register()
+    - thermal: of: Fix OF node leak in of_thermal_zone_find() error paths
+    - Upstream stable to v6.6.48, v6.10.7
+
+  * Unable to list directories using CIFS on 6.8 kernel (LP: #2082423) // Noble
+    update: upstream stable patchset 2024-10-09 (LP: #2084005)
+    - smb: client: ignore unhandled reparse tags
+
+  * CVE-2024-46759
+    - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
+
+  * CVE-2024-46758
+    - hwmon: (lm95234) Fix underflows seen when writing limit attributes
+
+  * CVE-2024-46756
+    - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
+
+  * CVE-2024-46738
+    - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
+
+  * CVE-2024-46722
+    - drm/amdgpu: fix mc_data out-of-bounds read warning
+
+  * LXD fan bridge causes blocked tasks (LP: #2064176)
+    - SAUCE: fan: release rcu_read_lock on skb discard path
+    - SAUCE: fan: fix racy device stat update
+
+  * x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (LP: #2081863)
+    - x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
+
+  * UBSAN: array-index-out-of-bounds in module mt76 (LP: #2081785)
+    - wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc
+
+  * The system hangs after resume with thunderbolt monitor(AMD GPU [1002:1900])
+    (LP: #2083182)
+    - SAUCE: drm/amd/display: Fix system hang while resume with TBT monitor
+
+  * [SRU] GPU: support additional device ids for DG2 driver (LP: #2083701)
+    - drm/i915: Add new PCI IDs to DG2 platform in driver
+
+  * [SRU]Intel Arrow Lake IBECC feature backport request for ubuntu 22.04.5 and
+    24.04.1 server (LP: #2077861)
+    - EDAC/igen6: Add Intel Arrow Lake-U/H SoCs support
+
+  * Noble update: upstream stable patchset 2024-10-07 (LP: #2083794)
+    - ASoC: topology: Clean up route loading
+    - ASoC: topology: Fix route memory corruption
+    - LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h
+    - sunrpc: don't change ->sv_stats if it doesn't exist
+    - nfsd: stop setting ->pg_stats for unused stats
+    - sunrpc: pass in the sv_stats struct through svc_create_pooled
+    - sunrpc: remove ->pg_stats from svc_program
+    - nfsd: remove nfsd_stats, make th_cnt a global counter
+    - nfsd: make svc_stat per-network namespace instead of global
+    - mm: gup: stop abusing try_grab_folio
+    - nvme/pci: Add APST quirk for Lenovo N60z laptop
+    - genirq/cpuhotplug: Skip suspended interrupts when restoring affinity
+    - genirq/cpuhotplug: Retry with cpu_online_mask when migration fails
+    - quota: Detect loops in quota tree
+    - bpf: Replace bpf_lpm_trie_key 0-length array with flexible array
+    - fs: Annotate struct file_handle with __counted_by() and use struct_size()
+    - mISDN: fix MISDN_TIME_STAMP handling
+    - mm/page_table_check: support userfault wr-protect entries
+    - bpf, net: Use DEV_STAT_INC()
+    - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
+    - f2fs: fix to cover read extent cache access with lock
+    - fou: remove warn in gue_gro_receive on unsupported protocol
+    - jfs: fix null ptr deref in dtInsertEntry
+    - jfs: Fix shift-out-of-bounds in dbDiscardAG
+    - fs/ntfs3: Do copy_to_user out of run_lock
+    - ALSA: usb: Fix UBSAN warning in parse_audio_unit()
+    - binfmt_flat: Fix corruption when not offsetting data start
+    - mm/debug_vm_pgtable: drop RANDOM_ORVALUE trick
+    - KVM: arm64: Don't defer TLB invalidation when zapping table entries
+    - KVM: arm64: Don't pass a TLBI level hint when zapping table entries
+    - drm/amd/display: Defer handling mst up request in resume
+    - drm/amd/display: Guard cursor idle reallow by DC debug option
+    - drm/amd/display: Separate setting and programming of cursor
+    - drm/amd/display: Prevent IPX From Link Detect and Set Mode
+    - ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
+    - platform/x86/amd/pmf: Fix to Update HPD Data When ALS is Disabled
+    - platform/x86: ideapad-laptop: introduce a generic notification chain
+    - platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc
+    - platform/x86: ideapad-laptop: add a mutex to synchronize VPC commands
+    - drm/amd/display: Solve mst monitors blank out problem after resume
+    - drm/amdgpu/display: Fix null pointer dereference in
+      dc_stream_program_cursor_position
+    - Upstream stable to v6.6.47, v6.10.6
+
+  * Noble update: upstream stable patchset 2024-10-04 (LP: #2083656)
+    - irqchip/mbigen: Fix mbigen node address layout
+    - platform/x86/intel/ifs: Initialize union ifs_status to zero
+    - jump_label: Fix the fix, brown paper bags galore
+    - x86/mm: Fix pti_clone_pgtable() alignment assumption
+    - x86/mm: Fix pti_clone_entry_text() for i386
+    - smb: client: move most of reparse point handling code to common file
+    - smb: client: set correct d_type for reparse DFS/DFSR and mount point
+    - smb: client: handle lack of FSCTL_GET_REPARSE_POINT support
+    - sctp: Fix null-ptr-deref in reuseport_add_sock().
+    - net: usb: qmi_wwan: fix memory leak for not ip packets
+    - net: bridge: mcast: wait for previous gc cycles when removing port
+    - net: linkwatch: use system_unbound_wq
+    - ice: Fix reset handler
+    - Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
+    - Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv
+      monitor
+    - net/smc: add the max value of fallback reason count
+    - net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
+    - l2tp: fix lockdep splat
+    - net: bcmgenet: Properly overlay PHY and MAC Wake-on-LAN capabilities
+    - net: fec: Stop PPS on driver remove
+    - gpio: prevent potential speculation leaks in gpio_device_get_desc()
+    - hwmon: corsair-psu: add USB id of HX1200i Series 2023 psu
+    - rcutorture: Fix rcu_torture_fwd_cb_cr() data race
+    - md: do not delete safemode_timer in mddev_suspend
+    - md/raid5: avoid BUG_ON() while continue reshape after reassembling
+    - block: change rq_integrity_vec to respect the iterator
+    - rcu: Fix rcu_barrier() VS post CPUHP_TEARDOWN_CPU invocation
+    - clocksource/drivers/sh_cmt: Address race condition for clock events
+    - ACPI: battery: create alarm sysfs attribute atomically
+    - ACPI: SBS: manage alarm sysfs attribute through psy core
+    - xen: privcmd: Switch from mutex to spinlock for irqfds
+    - wifi: nl80211: disallow setting special AP channel widths
+    - wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup()
+    - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
+    - selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
+    - af_unix: Don't retry after unix_state_lock_nested() in
+      unix_stream_connect().
+    - PCI: Add Edimax Vendor ID to pci_ids.h
+    - udf: prevent integer overflow in udf_bitmap_free_blocks()
+    - wifi: nl80211: don't give key data to userspace
+    - can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index
+      erratum
+    - can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of
+      mcp2518fd
+    - net: stmmac: qcom-ethqos: enable SGMII loopback during DMA reset on
+      sa8775p-ride-r3
+    - btrfs: do not clear page dirty inside extent_write_locked_range()
+    - btrfs: fix invalid mapping of extent xarray state
+    - btrfs: fix bitmap leak when loading free space cache on duplicate entry
+    - Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver
+      unloading
+    - drm/amd/display: Add delay to improve LTTPR UHBR interop
+    - drm/amdgpu: fix potential resource leak warning
+    - drm/amdgpu/pm: Fix the param type of set_power_profile_mode
+    - drm/amdgpu/pm: Fix the null pointer dereference for smu7
+    - drm/amdgpu: Fix the null pointer dereference to ras_manager
+    - drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
+    - drm/admgpu: fix dereferencing null pointer context
+    - drm/amdgpu: Add lock around VF RLCG interface
+    - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
+    - media: amphion: Remove lock in s_ctrl callback
+    - drm/amd/display: Add null checker before passing variables
+    - media: uvcvideo: Ignore empty TS packets
+    - media: uvcvideo: Fix the bandwdith quirk on USB 3.x
+    - media: xc2028: avoid use-after-free in load_firmware_cb()
+    - ext4: fix uninitialized variable in ext4_inlinedir_to_tree
+    - jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
+    - s390/sclp: Prevent release of buffer in I/O
+    - SUNRPC: Fix a race to wake a sync task
+    - profiling: remove profile=sleep support
+    - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
+    - irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to
+      'raw_spinlock_t'
+    - irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq()
+    - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
+    - net: drop bad gso csum_start and offset in virtio_net_hdr
+    - arm64: Add Neoverse-V2 part
+    - arm64: barrier: Restore spec_bar() macro
+    - arm64: cputype: Add Cortex-X4 definitions
+    - arm64: cputype: Add Neoverse-V3 definitions
+    - arm64: errata: Add workaround for Arm errata 3194386 and 3312417
+    - arm64: cputype: Add Cortex-X3 definitions
+    - arm64: cputype: Add Cortex-A720 definitions
+    - arm64: cputype: Add Cortex-X925 definitions
+    - arm64: errata: Unify speculative SSBS errata logic
+    - [Config] Set ARM64_ERRATUM_3194386=y
+    - arm64: errata: Expand speculative SSBS workaround
+    - arm64: cputype: Add Cortex-X1C definitions
+    - arm64: cputype: Add Cortex-A725 definitions
+    - arm64: errata: Expand speculative SSBS workaround (again)
+    - i2c: smbus: Improve handling of stuck alerts
+    - ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
+    - ASoC: codecs: wsa881x: Correct Soundwire ports mask
+    - ASoC: codecs: wsa883x: parse port-mapping information
+    - ASoC: codecs: wsa883x: Correct Soundwire ports mask
+    - ASoC: codecs: wsa884x: parse port-mapping information
+    - ASoC: codecs: wsa884x: Correct Soundwire ports mask
+    - ASoC: sti: add missing probe entry for player and reader
+    - spi: spidev: Add missing spi_device_id for bh2228fv
+    - ASoC: SOF: Remove libraries from topology lookups
+    - i2c: smbus: Send alert notifications to all devices if source not found
+    - bpf: kprobe: remove unused declaring of bpf_kprobe_override
+    - kprobes: Fix to check symbol prefixes correctly
+    - i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume
+    - i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
+    - spi: spi-fsl-lpspi: Fix scldiv calculation
+    - ALSA: usb-audio: Re-add ScratchAmp quirk entries
+    - ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
+    - cifs: cifs_inval_name_dfs_link_error: correct the check for fullpath
+    - module: warn about excessively long module waits
+    - module: make waiting for a concurrent module loader interruptible
+    - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
+    - drm/amd/display: Skip Recompute DSC Params if no Stream on Link
+    - drm/amdgpu: Forward soft recovery errors to userspace
+    - drm/i915/gem: Adjust vma offset for framebuffer mmap offset
+    - drm/client: fix null pointer dereference in drm_client_modeset_probe
+    - ALSA: line6: Fix racy access to midibuf
+    - ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
+    - ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks
+    - ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
+    - usb: vhci-hcd: Do not drop references before new references are gained
+    - USB: serial: debug: do not echo input by default
+    - usb: gadget: core: Check for unset descriptor
+    - usb: gadget: midi2: Fix the response for FB info with block 0xff
+    - usb: gadget: u_serial: Set start_delayed during suspend
+    - usb: gadget: u_audio: Check return codes from usb_ep_enable and
+      config_ep_by_speed.
+    - scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES
+    - scsi: ufs: core: Do not set link to OFF state while waking up from
+      hibernation
+    - scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
+    - tick/broadcast: Move per CPU pointer access into the atomic section
+    - vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
+    - ntp: Clamp maxerror and esterror to operating range
+    - clocksource: Scale the watchdog read retries automatically
+    - clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
+    - driver core: Fix uevent_show() vs driver detach race
+    - tracefs: Fix inode allocation
+    - tracefs: Use generic inode RCU for synchronizing freeing
+    - ntp: Safeguard against time_constant overflow
+    - timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex()
+    - serial: core: check uartclk for zero to avoid divide by zero
+    - memcg: protect concurrent access to mem_cgroup_idr
+    - parisc: fix unaligned accesses in BPF
+    - parisc: fix a possible DMA corruption
+    - ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx
+    - kcov: properly check for softirq context
+    - irqchip/xilinx: Fix shift out of bounds
+    - genirq/irqdesc: Honor caller provided affinity in alloc_desc()
+    - LoongArch: Enable general EFI poweroff method
+    - power: supply: qcom_battmgr: return EAGAIN when firmware service is not up
+    - power: supply: axp288_charger: Fix constant_charge_voltage writes
+    - power: supply: axp288_charger: Round constant_charge_voltage writes down
+    - tracing: Fix overflow in get_free_elt()
+    - padata: Fix possible divide-by-0 panic in padata_mt_helper()
+    - smb3: fix setting SecurityFlags when encryption is required
+    - eventfs: Don't return NULL in eventfs_create_dir()
+    - eventfs: Use SRCU for freeing eventfs_inodes
+    - selftests: mm: add s390 to ARCH check
+    - btrfs: avoid using fixed char array size for tree names
+    - x86/paravirt: Fix incorrect virt spinlock setting on bare metal
+    - x86/mtrr: Check if fixed MTRRs exist before saving them
+    - sched/smt: Introduce sched_smt_present_inc/dec() helper
+    - sched/smt: Fix unbalance sched_smt_present dec/inc
+    - sched/core: Introduce sched_set_rq_on/offline() helper
+    - sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate()
+    - drm/bridge: analogix_dp: properly handle zero sized AUX transactions
+    - drm/dp_mst: Skip CSN if topology probing is not done yet
+    - drm/lima: Mark simple_ondemand governor as softdep
+    - drm/mgag200: Set DDC timeout in milliseconds
+    - drm/mgag200: Bind I2C lifetime to DRM device
+    - drm/radeon: Remove __counted_by from StateArray.states[]
+    - mptcp: fully established after ADD_ADDR echo on MPJ
+    - mptcp: pm: deny endp with signal + subflow + port
+    - block: use the right type for stub rq_integrity_vec()
+    - btrfs: fix corruption after buffer fault in during direct IO append write
+    - tools headers arm64: Sync arm64's cputype.h with the kernel sources
+    - mm/hugetlb: fix potential race in __update_and_free_hugetlb_folio()
+    - xfs: fix log recovery buffer allocation for the legacy h_size fixup
+    - mptcp: pm: reduce indentation blocks
+    - mptcp: pm: don't try to create sf if alloc failed
+    - mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set
+    - selftests: mptcp: join: ability to invert ADD_ADDR check
+    - selftests: mptcp: join: test both signal & subflow
+    - Revert "selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky"
+    - btrfs: fix double inode unlock for direct IO sync writes
+    - perf/x86/intel/cstate: Switch to new Intel CPU model defines
+    - perf/x86/intel/cstate: Add Arrowlake support
+    - perf/x86/intel/cstate: Add Lunarlake support
+    - perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest
+    - platform/x86: intel-vbtn: Protect ACPI notify handler against recursion
+    - perf/x86/amd: Use try_cmpxchg() in events/amd/{un,}core.c
+    - perf/x86/intel: Support the PEBS event mask
+    - perf/x86: Support counter mask
+    - perf/x86: Fix smp_processor_id()-in-preemptible warnings
+    - virtio-net: unbreak vq resizing when coalescing is not negotiated
+    - net: dsa: microchip: Fix Wake-on-LAN check to not return an error
+    - net: dsa: microchip: disable EEE for KSZ8567/KSZ9567/KSZ9896/KSZ9897.
+    - regmap: kunit: Use a KUnit action to call regmap_exit()
+    - regmap: kunit: Replace a kmalloc/kfree() pair with KUnit-managed alloc
+    - regmap: kunit: Fix memory leaks in gen_regmap() and gen_raw_regmap()
+    - debugobjects: Annotate racy debug variables
+    - nvme: apple: fix device reference counting
+    - cpufreq: amd-pstate: Allow users to write 'default' EPP string
+    - cpufreq: amd-pstate: auto-load pstate driver by default
+    - soc: qcom: icc-bwmon: Allow for interrupts to be shared across instances
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MU
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MJ
+    - thermal: intel: hfi: Give HFI instances package scope
+    - wifi: ath12k: fix race due to setting ATH12K_FLAG_EXT_IRQ_ENABLED too early
+    - wifi: rtlwifi: handle return value of usb init TX/RX
+    - wifi: rtw89: pci: fix RX tag race condition resulting in wrong RX length
+    - wifi: mac80211: fix NULL dereference at band check in starting tx ba session
+    - bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory
+      accesses
+    - mlxsw: pci: Lock configuration space of upstream bridge during reset
+    - btrfs: do not BUG_ON() when freeing tree block after error
+    - btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info()
+    - btrfs: fix data race when accessing the last_trans field of a root
+    - drm/xe/preempt_fence: enlarge the fence critical section
+    - drm/amd/display: Handle HPD_IRQ for internal link
+    - drm/amd/amdkfd: Fix a resource leak in svm_range_validate_and_map()
+    - drm/xe/xe_guc_submit: Fix exec queue stop race condition
+    - drm/amd/display: Add null checks for 'stream' and 'plane' before
+      dereferencing
+    - drm/amd/display: Wake DMCUB before sending a command for replay feature
+    - drm/amd/display: reduce ODM slice count to initial new dc state only when
+      needed
+    - of: Add cleanup.h based auto release via __free(device_node) markings
+    - media: i2c: ov5647: replacing of_node_put with __free(device_node)
+    - drm/amd/display: Fix null pointer deref in dcn20_resource.c
+    - ext4: sanity check for NULL pointer after ext4_force_shutdown
+    - mm, slub: do not call do_slab_free for kfence object
+    - ASoC: cs35l56: Revert support for dual-ownership of ASP registers
+    - drm/atomic: allow no-op FB_ID updates for async flips
+    - drm/amd/display: Replace dm_execute_dmub_cmd with
+      dc_wake_and_execute_dmub_cmd
+    - drm/xe/rtp: Fix off-by-one when processing rules
+    - drm/xe: Use dma_fence_chain_free in chain fence unused as a sync
+    - drm/xe/hwmon: Fix PL1 disable flow in xe_hwmon_power_max_write
+    - drm/xe: Move lrc snapshot capturing to xe_lrc.c
+    - drm/xe: Minor cleanup in LRC handling
+    - drm/test: fix the gem shmem test to map the sg table.
+    - usb: typec: pd: no opencoding of FIELD_GET
+    - usb: typec: fsa4480: Check if the chip is really there
+    - PM: runtime: Simplify pm_runtime_get_if_active() usage
+    - scsi: ufs: core: Fix deadlock during RTC update
+    - serial: sc16is7xx: fix invalid FIFO access with special register set
+    - tracing: Have format file honor EVENT_FILE_FL_FREED
+    - mm: list_lru: fix UAF for memory cgroup
+    - net/tcp: Disable TCP-AO static key after RCU grace period
+    - Revert "drm/amd/display: Handle HPD_IRQ for internal link"
+    - idpf: fix memleak in vport interrupt configuration
+    - drm/amd/display: Add null check in resource_log_pipe_topology_update
+    - Upstream stable to v6.6.46, v6.10.5
+
+  * Noble update: upstream stable patchset 2024-10-02 (LP: #2083488)
+    - sysctl: allow change system v ipc sysctls inside ipc namespace
+    - sysctl: allow to change limits for posix messages queues
+    - sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)
+    - ext4: factor out a common helper to query extent map
+    - ext4: check the extent status again before inserting delalloc block
+    - leds: trigger: Store brightness set by led_trigger_event()
+    - leds: trigger: Call synchronize_rcu() before calling trig->activate()
+    - KVM: VMX: Move posted interrupt descriptor out of VMX code
+    - fbdev/vesafb: Replace references to global screen_info by local pointer
+    - video: Add helpers for decoding screen_info
+    - [Config] Update CONFIG_SCREEN_INFO
+    - video: Provide screen_info_get_pci_dev() to find screen_info's PCI device
+    - firmware/sysfb: Update screen_info for relocated EFI framebuffers
+    - mm: page_alloc: control latency caused by zone PCP draining
+    - mm/page_alloc: fix pcp->count race between drain_pages_zone() vs
+      __rmqueue_pcplist()
+    - f2fs: fix to avoid use SSR allocate when do defragment
+    - f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid
+    - dmaengine: fsl-edma: add address for channel mux register in fsl_edma_chan
+    - dmaengine: fsl-edma: add i.MX8ULP edma support
+    - perf: imx_perf: fix counter start and config sequence
+    - MIPS: Loongson64: DTS: Fix PCIe port nodes for ls7a
+    - MIPS: dts: loongson: Fix liointc IRQ polarity
+    - MIPS: dts: loongson: Fix ls2k1000-rtc interrupt
+    - ARM: 9406/1: Fix callchain_trace() return value
+    - HID: amd_sfh: Move sensor discovery before HID device initialization
+    - perf tool: fix dereferencing NULL al->maps
+    - drm/nouveau: prime: fix refcount underflow
+    - drm/vmwgfx: Fix overlay when using Screen Targets
+    - drm/vmwgfx: Trigger a modeset when the screen moves
+    - sched: act_ct: take care of padding in struct zones_ht_key
+    - wifi: cfg80211: fix reporting failed MLO links status with
+      cfg80211_connect_done
+    - net: phy: realtek: add support for RTL8366S Gigabit PHY
+    - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode
+    - Bluetooth: btintel: Fail setup on error
+    - Bluetooth: hci_sync: Fix suspending with wrong filter policy
+    - tcp: annotate data-races around tp->window_clamp
+    - tcp: Adjust clamping window for applications specifying SO_RCVBUF
+    - net: axienet: start napi before enabling Rx/Tx
+    - rtnetlink: Don't ignore IFLA_TARGET_NETNSID when ifname is specified in
+      rtnl_dellink().
+    - i915/perf: Remove code to update PWR_CLK_STATE for gen12
+    - ice: respect netif readiness in AF_XDP ZC related ndo's
+    - ice: don't busy wait for Rx queue disable in ice_qp_dis()
+    - ice: replace synchronize_rcu with synchronize_net
+    - ice: add missing WRITE_ONCE when clearing ice_rx_ring::xdp_prog
+    - drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro
+    - net: mvpp2: Don't re-use loop iterator
+    - net: phy: micrel: Fix the KSZ9131 MDI-X status issue
+    - ALSA: hda: Conditionally use snooping for AMD HDMI
+    - netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().
+    - netfilter: iptables: Fix potential null-ptr-deref in
+      ip6table_nat_table_init().
+    - net/mlx5: Always drain health in shutdown callback
+    - net/mlx5: Fix error handling in irq_pool_request_irq
+    - net/mlx5: Lag, don't use the hardcoded value of the first port
+    - net/mlx5: Fix missing lock on sync reset reload
+    - net/mlx5e: Require mlx5 tc classifier action support for IPsec prio
+      capability
+    - net/mlx5e: Fix CT entry update leaks of modify header context
+    - net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
+    - igc: Fix double reset adapter triggered from a single taprio cmd
+    - ipv6: fix ndisc_is_useropt() handling for PIO
+    - perf: riscv: Fix selecting counters in legacy mode
+    - riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
+    - riscv: Fix linear mapping checks for non-contiguous memory regions
+    - arm64: jump_label: Ensure patched jump_labels are visible to all CPUs
+    - rust: SHADOW_CALL_STACK is incompatible with Rust
+    - platform/chrome: cros_ec_proto: Lock device when updating MKBP version
+    - HID: wacom: Modify pen IDs
+    - btrfs: zoned: fix zone_unusable accounting on making block group read-write
+      again
+    - btrfs: do not subtract delalloc from avail bytes
+    - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
+    - mptcp: sched: check both directions for backup
+    - ALSA: usb-audio: Correct surround channels in UAC1 channel map
+    - ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
+    - ALSA: seq: ump: Optimize conversions from SysEx to UMP
+    - Revert "ALSA: firewire-lib: obsolete workqueue for period update"
+    - Revert "ALSA: firewire-lib: operate for period elapse event in process
+      context"
+    - drm/vmwgfx: Fix a deadlock in dma buf fence polling
+    - drm/virtio: Fix type of dma-fence context variable
+    - drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll()
+    - net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
+    - r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
+    - mptcp: fix user-space PM announced address accounting
+    - mptcp: distinguish rcv vs sent backup flag in requests
+    - mptcp: fix NL PM announced address accounting
+    - mptcp: mib: count MPJ with backup flag
+    - mptcp: fix bad RCVPRUNED mib accounting
+    - mptcp: pm: only set request_bkup flag when sending MP_PRIO
+    - mptcp: fix duplicate data handling
+    - selftests: mptcp: always close input's FD if opened
+    - selftests: mptcp: join: validate backup in MPJ
+    - selftests: mptcp: join: check backup support in signal endp
+    - mm/huge_memory: mark racy access onhuge_anon_orders_always
+    - mm: fix khugepaged activation policy
+    - x86/cpu/vfm: Add/initialize x86_vfm field to struct cpuinfo_x86
+    - perf/x86/intel: Switch to new Intel CPU model defines
+    - perf/x86/intel: Add a distinct name for Granite Rapids
+    - drm/gpuvm: fix missing dependency to DRM_EXEC
+    - netlink: specs: correct the spec of ethtool
+    - ethtool: rss: echo the context number back
+    - wifi: cfg80211: correct S1G beacon length calculation
+    - ethtool: fix setting key and resetting indir at once
+    - ice: modify error handling when setting XSK pool in ndo_bpf
+    - ice: toggle netif_carrier when setting up XSK pool
+    - ice: improve updating ice_{t,r}x_ring::xsk_pool
+    - ice: xsk: fix txq interrupt mapping
+    - drm/atomic: Allow userspace to use explicit sync with atomic async flips
+    - drm/atomic: Allow userspace to use damage clips with async flips
+    - riscv/purgatory: align riscv_kernel_entry
+    - perf arch events: Fix duplicate RISC-V SBI firmware event name
+    - RISC-V: Enable the IPI before workqueue_online_cpu()
+    - ceph: force sending a cap update msg back to MDS for revoke op
+    - drm/vmwgfx: Remove unused code
+    - drm/vmwgfx: Fix handling of dumb buffers
+    - drm/v3d: Prevent out of bounds access in performance query extensions
+    - drm/v3d: Fix potential memory leak in the timestamp extension
+    - drm/v3d: Fix potential memory leak in the performance extension
+    - drm/v3d: Validate passed in drm syncobj handles in the timestamp extension
+    - drm/v3d: Validate passed in drm syncobj handles in the performance extension
+    - nouveau: set placement to original placement on uvmm validate.
+    - wifi: ath12k: fix soft lockup on suspend
+    - mptcp: pm: fix backup support in signal endpoints
+    - selftests: mptcp: fix error path
+    - Upstream stable to v6.6.45, v6.10.4
+
+  * [SRU] Fix AST DP output after resume (LP: #2083022) // Noble update:
+    upstream stable patchset 2024-10-02 (LP: #2083488)
+    - drm/ast: astdp: Wake up during connector status detection
+    - drm/ast: Fix black screen after resume
+
+  * [SRU]Fail to locate the LED of NVME disk behind  Intel VMD (LP: #2077287) //
+    Noble update: upstream stable patchset 2024-10-02 (LP: #2083488)
+    - PCI: pciehp: Retain Power Indicator bits for userspace indicators
+
+  * Noble update: upstream stable patchset 2024-09-30 (LP: #2083196)
+    - powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
+    - spi: spi-microchip-core: Fix the number of chip selects supported
+    - spi: atmel-quadspi: Add missing check for clk_prepare
+    - EDAC, i10nm: make skx_common.o a separate module
+    - rcu/tasks: Fix stale task snaphot for Tasks Trace
+    - platform/chrome: cros_ec_debugfs: fix wrong EC message version
+    - ubd: refactor the interrupt handler
+    - ubd: untagle discard vs write zeroes not support handling
+    - block: initialize integrity buffer to zero before writing it to media
+    - x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS
+    - hfsplus: fix to avoid false alarm of circular locking
+    - x86/of: Return consistent error type from x86_of_pci_irq_enable()
+    - x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
+    - x86/pci/xen: Fix PCIBIOS_* return code handling
+    - x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
+    - cgroup/cpuset: Prevent UAF in proc_cpuset_show()
+    - hwmon: (adt7475) Fix default duty on fan is disabled
+    - block: Call .limit_depth() after .hctx has been set
+    - block/mq-deadline: Fix the tag reservation code
+    - md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl
+    - pwm: stm32: Always do lazy disabling
+    - nvmet-auth: fix nvmet_auth hash error handling
+    - drm/meson: fix canvas release in bind function
+    - pwm: atmel-tcb: Fix race condition and convert to guards
+    - hwmon: (max6697) Fix underflow when writing limit attributes
+    - hwmon: (max6697) Fix swapped temp{1,8} critical alarms
+    - arm64: dts: qcom: sc8180x: Correct PCIe slave ports
+    - arm64: dts: qcom: sc8180x: add power-domain to UFS PHY
+    - arm64: dts: qcom: sdm845: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm6115: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm6350: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm8250: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm8350: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm8450: add power-domain to UFS PHY
+    - arm64: dts: qcom: msm8996-xiaomi-common: drop excton from the USB PHY
+    - arm64: dts: qcom: sdm850-lenovo-yoga-c630: fix IPA firmware path
+    - arm64: dts: qcom: msm8998: enable adreno_smmu by default
+    - soc: qcom: pmic_glink: Handle the return value of pmic_glink_init
+    - soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data()
+      callers
+    - arm64: dts: rockchip: Add sdmmc related properties on rk3308-rock-pi-s
+    - arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s
+    - arm64: dts: rockchip: Add mdio and ethernet-phy nodes to rk3308-rock-pi-s
+    - arm64: dts: rockchip: Update WIFi/BT related nodes on rk3308-rock-pi-s
+    - arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
+    - arm64: dts: qcom: sa8775p: mark ethernet devices as DMA-coherent
+    - soc: xilinx: rename cpu_number1 to dummy_cpu_number
+    - ARM: dts: sunxi: remove duplicated entries in makefile
+    - ARM: dts: stm32: Add arm,no-tick-in-suspend to STM32MP15xx STGEN timer
+    - arm64: dts: qcom: qrb4210-rb2: make L9A always-on
+    - cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe()
+    - OPP: ti: Fix ti_opp_supply_probe wrong return values
+    - memory: fsl_ifc: Make FSL_IFC config visible and selectable
+    - arm64: dts: ti: k3-am62x: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am625-beagleplay: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am62-verdin: Drop McASP AFIFOs
+    - arm64: dts: qcom: qdu1000: Add secure qfprom node
+    - soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove
+    - soc: qcom: pdr: protect locator_addr with the main mutex
+    - soc: qcom: pdr: fix parsing of domains lists
+    - arm64: dts: rockchip: Increase VOP clk rate on RK3328
+    - arm64: dts: amlogic: sm1: fix spdif compatibles
+    - ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
+    - ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
+    - ARM: dts: imx6qdl-kontron-samx6i: fix board reset
+    - ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
+    - ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
+    - arm64: dts: mediatek: mt8195: Fix GPU thermal zone name for SVS
+    - arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
+    - arm64: dts: mediatek: mt8192-asurada: Add off-on-delay-us for
+      pp3300_mipibrdg
+    - arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
+    - arm64: dts: mediatek: mt8183-kukui: Fix the value of `dlg,jack-det-rate`
+      mismatch
+    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add ports node for anx7625
+    - arm64: dts: amlogic: gx: correct hdmi clocks
+    - arm64: dts: amlogic: add power domain to hdmitx
+    - arm64: dts: amlogic: setup hdmi system clock
+    - arm64: dts: rockchip: Drop invalid mic-in-differential on rk3568-rock-3a
+    - arm64: dts: rockchip: Fix mic-in-differential usage on rk3566-roc-pc
+    - arm64: dts: rockchip: Fix mic-in-differential usage on rk3568-evb1-v10
+    - arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r8a779f0: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r8a779g0: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r9a07g043u: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r9a07g044: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r9a07g054: Add missing hypervisor virtual timer IRQ
+    - m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
+    - arm64: dts: imx8mp: Fix pgc_mlmix location
+    - arm64: dts: imx8mp: add HDMI power-domains
+    - arm64: dts: imx8mp: Fix pgc vpu locations
+    - x86/xen: Convert comma to semicolon
+    - arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu
+    - arm64: dts: rockchip: fix regulator name for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: fix usb regulator for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: fix pmu_io supply for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: remove unused usb2 nodes for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: disable display subsystem for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: fixes PHY reset for Lunzn Fastrhino R68S
+    - arm64: dts: qcom: sm6350: Add missing qcom,non-secure-domain property
+    - cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC
+      systems
+    - m68k: cmpxchg: Fix return value for default case in __arch_xchg()
+    - ARM: spitz: fix GPIO assignment for backlight
+    - vmlinux.lds.h: catch .bss..L* sections into BSS")
+    - firmware: turris-mox-rwtm: Do not complete if there are no waiters
+    - firmware: turris-mox-rwtm: Fix checking return value of
+      wait_for_completion_timeout()
+    - firmware: turris-mox-rwtm: Initialize completion before mailbox
+    - wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
+    - wifi: ath12k: Correct 6 GHz frequency value in rx status
+    - wifi: ath12k: Fix tx completion ring (WBM2SW) setup failure
+    - bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer
+    - selftests/bpf: Fix prog numbers in test_sockmap
+    - net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
+    - wifi: ath12k: change DMA direction while mapping reinjected packets
+    - wifi: ath12k: fix invalid memory access while processing fragmented packets
+    - wifi: ath12k: fix firmware crash during reo reinject
+    - wifi: ath11k: fix wrong definition of CE ring's base address
+    - wifi: ath12k: fix wrong definition of CE ring's base address
+    - tcp: add tcp_done_with_error() helper
+    - tcp: fix race in tcp_write_err()
+    - tcp: fix races in tcp_v[46]_err()
+    - net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when
+      CONFIG_ARCH_NO_SG_CHAIN is defined
+    - selftests/bpf: Check length of recv in test_sockmap
+    - udf: Fix lock ordering in udf_evict_inode()
+    - lib: objagg: Fix general protection fault
+    - mlxsw: spectrum_acl_erp: Fix object nesting warning
+    - mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
+    - perf/x86: Serialize set_attr_rdpmc()
+    - jump_label: Fix concurrency issues in static_key_slow_dec()
+    - wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
+    - wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
+    - wifi: cfg80211: handle 2x996 RU allocation in
+      cfg80211_calculate_bitrate_he()
+    - udf: Fix bogus checksum computation in udf_rename()
+    - net: fec: Refactor: #define magic constants
+    - net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
+    - libbpf: Checking the btf_type kind when fixing variable offsets
+    - xfrm: Fix unregister netdevice hang on hardware offload.
+    - ipvs: Avoid unnecessary calls to skb_is_gso_sctp
+    - netfilter: nf_tables: rise cap on SELinux secmark context
+    - wifi: rtw89: 8852b: fix definition of KIP register number
+    - wifi: rtl8xxxu: 8188f: Limit TX power index
+    - xfrm: Export symbol xfrm_dev_state_delete.
+    - bpftool: Mount bpffs when pinmaps path not under the bpffs
+    - perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
+    - perf: Fix perf_aux_size() for greater-than 32-bit size
+    - perf: Prevent passing zero nr_pages to rb_alloc_aux()
+    - perf: Fix default aux_watermark calculation
+    - perf/x86/intel/cstate: Fix Alderlake/Raptorlake/Meteorlake
+    - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()
+    - xfrm: fix netdev reference count imbalance
+    - xfrm: call xfrm_dev_policy_delete when kill policy
+    - wifi: virt_wifi: avoid reporting connection success with wrong SSID
+    - gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
+    - wifi: virt_wifi: don't use strlen() in const context
+    - locking/rwsem: Add __always_inline annotation to __down_write_common() and
+      inlined callers
+    - selftests/bpf: Close fd in error path in drop_on_reuseport
+    - selftests/bpf: Null checks for links in bpf_tcp_ca
+    - selftests/bpf: Close obj in error path in xdp_adjust_tail
+    - selftests/resctrl: Convert perror() to ksft_perror() or ksft_print_msg()
+    - selftests/resctrl: Fix closing IMC fds on error and open-code R+W instead of
+      loops
+    - bpf: annotate BTF show functions with __printf
+    - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
+    - bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
+    - bpf: Fix null pointer dereference in resolve_prog_type() for
+      BPF_PROG_TYPE_EXT
+    - selftests: forwarding: devlink_lib: Wait for udev events after reloading
+    - Bluetooth: hci_bcm4377: Use correct unit for timeouts
+    - Bluetooth: btintel: Refactor btintel_set_ppag()
+    - Bluetooth: btnxpuart: Add handling for boot-signature timeout errors
+    - xdp: fix invalid wait context of page_pool_destroy()
+    - net: bridge: mst: Check vlan state for egress decision
+    - drm/rockchip: vop2: Fix the port mux of VP2
+    - drm/arm/komeda: Fix komeda probe failing if there are no links in the
+      secondary pipeline
+    - drm/amdkfd: Fix CU Masking for GFX 9.4.3
+    - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq()
+    - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_generic_write_seq()
+    - drm/amd/pm: Fix aldebaran pcie speed reporting
+    - drm/amdgpu: Fix memory range calculation
+    - drm/amdgpu: Check if NBIO funcs are NULL in amdgpu_device_baco_exit
+    - drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1
+    - drm/panel: himax-hx8394: Handle errors from mipi_dsi_dcs_set_display_on()
+      better
+    - drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before
+      regulators
+    - drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
+    - drm/bridge: Fixed a DP link training bug
+    - drm/bridge: it6505: fix hibernate to resume no display issue
+    - media: pci: ivtv: Add check for DMA map result
+    - media: imon: Fix race getting ictx->lock
+    - media: i2c: Fix imx412 exposure control
+    - media: v4l: async: Fix NULL pointer dereference in adding ancillary links
+    - s390/mm: Convert make_page_secure to use a folio
+    - s390/mm: Convert gmap_make_secure to use a folio
+    - s390/uv: Don't call folio_wait_writeback() without a folio reference
+    - media: mediatek: vcodec: Handle invalid decoder vsi
+    - x86/shstk: Make return uprobe work with shadow stack
+    - ipmi: ssif_bmc: prevent integer overflow on 32bit systems
+    - saa7134: Unchecked i2c_transfer function result fixed
+    - media: i2c: imx219: fix msr access command sequence
+    - media: uvcvideo: Disable autosuspend for Insta360 Link
+    - media: uvcvideo: Quirk for invalid dev_sof in Logitech C922
+    - media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920
+    - media: uvcvideo: Override default flags
+    - drm: zynqmp_dpsub: Fix an error handling path in zynqmp_dpsub_probe()
+    - drm: zynqmp_kms: Fix AUX bus not getting unregistered
+    - media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2
+    - media: rcar-csi2: Disable runtime_pm in probe error
+    - media: rcar-csi2: Cleanup subdevice in remove()
+    - media: renesas: vsp1: Fix _irqsave and _irq mix
+    - media: renesas: vsp1: Store RPF partition configuration per RPF instance
+    - drm/mediatek: Add missing plane settings when async update
+    - drm/mediatek: Use 8-bit alpha in ETHDR
+    - drm/mediatek: Fix XRGB setting error in OVL
+    - drm/mediatek: Fix XRGB setting error in Mixer
+    - drm/mediatek: Fix destination alpha error in OVL
+    - drm/mediatek: Turn off the layers with zero width or height
+    - drm/mediatek: Add OVL compatible name for MT8195
+    - media: imx-jpeg: Drop initial source change event if capture has been setup
+    - leds: trigger: Unregister sysfs attributes before calling deactivate()
+    - drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC
+    - drm/msm/dpu: drop validity checks for clear_pending_flush() ctl op
+    - perf test: Make test_arm_callgraph_fp.sh more robust
+    - perf pmus: Fixes always false when compare duplicates aliases
+    - perf report: Fix condition in sort__sym_cmp()
+    - drm/etnaviv: fix DMA direction handling for cached RW buffers
+    - drm/qxl: Add check for drm_cvt_mode
+    - Revert "leds: led-core: Fix refcount leak in of_led_get()"
+    - drm/mediatek: Remove less-than-zero comparison of an unsigned value
+    - ext4: fix infinite loop when replaying fast_commit
+    - drm/mediatek/dp: switch to ->edid_read callback
+    - drm/mediatek/dp: Fix spurious kfree()
+    - media: venus: flush all buffers in output plane streamoff
+    - perf intel-pt: Fix aux_watermark calculation for 64-bit size
+    - perf intel-pt: Fix exclude_guest setting
+    - mfd: rsmu: Split core code into separate module
+    - mfd: omap-usb-tll: Use struct_size to allocate tll
+    - xprtrdma: Fix rpcrdma_reqs_reset()
+    - SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
+    - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server
+    - ext4: don't track ranges in fast_commit if inode has inlined data
+    - ext4: avoid writing unitialized memory to disk in EA inodes
+    - leds: flash: leds-qcom-flash: Test the correct variable in init
+    - sparc64: Fix incorrect function signature and add prototype for
+      prom_cif_init
+    - SUNRPC: Fixup gss_status tracepoint error output
+    - iio: Fix the sorting functionality in iio_gts_build_avail_time_table
+    - PCI: Fix resource double counting on remove & rescan
+    - PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode()
+    - PCI: keystone: Don't enable BAR 0 for AM654x
+    - PCI: keystone: Fix NULL pointer dereference in case of DT error in
+      ks_pcie_setup_rc_app_regs()
+    - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()
+    - scsi: ufs: mcq: Fix missing argument 'hba' in MCQ_OPR_OFFSET_n
+    - clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock
+    - clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs
+    - iio: frequency: adrf6780: rm clk provider include
+    - coresight: Fix ref leak when of_coresight_parse_endpoint() fails
+    - RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE
+    - ASoc: tas2781: Enable RCA-based playback without DSP firmware download
+    - ASoC: cs35l56: Accept values greater than 0 as IRQ numbers
+    - usb: typec-mux: nb7vpq904m: unregister typec switch on probe error and
+      remove
+    - RDMA/cache: Release GID table even if leak is detected
+    - clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable
+    - clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags
+    - clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags
+    - clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable
+    - clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's
+    - interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID
+    - Input: qt1050 - handle CHIP_ID reading error
+    - RDMA/mlx4: Fix truncated output warning in mad.c
+    - RDMA/mlx4: Fix truncated output warning in alias_GUID.c
+    - RDMA/mlx5: Use sq timestamp as QP timestamp when RoCE is disabled
+    - RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
+    - ASoC: qcom: Adjust issues in case of DT error in
+      asoc_qcom_lpass_cpu_platform_probe()
+    - scsi: lpfc: Fix a possible null pointer dereference
+    - hwrng: core - Fix wrong quality calculation at hw rng registration
+    - powerpc/prom: Add CPU info to hardware description string later
+    - ASoC: max98088: Check for clk_prepare_enable() error
+    - mtd: make mtd_test.c a separate module
+    - RDMA/device: Return error earlier if port in not valid
+    - Input: elan_i2c - do not leave interrupt disabled on suspend failure
+    - ASoC: amd: Adjust error handling in case of absent codec device
+    - PCI: endpoint: Clean up error handling in vpci_scan_bus()
+    - PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup()
+    - vhost/vsock: always initialize seqpacket_allow
+    - net: missing check virtio
+    - nvmem: rockchip-otp: set add_legacy_fixed_of_cells config option
+    - crypto: qat - extend scope of lock in adf_cfg_add_key_value_param()
+    - clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error
+    - clk: qcom: Park shared RCGs upon registration
+    - clk: en7523: fix rate divider for slic and spi clocks
+    - MIPS: Octeron: remove source file executable bit
+    - PCI: qcom-ep: Disable resources unconditionally during PERST# assert
+    - PCI: dwc: Fix index 0 incorrectly being interpreted as a free ATU slot
+    - powerpc/xmon: Fix disassembly CPU feature checks
+    - macintosh/therm_windtunnel: fix module unload.
+    - RDMA/hns: Check atomic wr length
+    - RDMA/hns: Fix unmatch exception handling when init eq table fails
+    - RDMA/hns: Fix missing pagesize and alignment check in FRMR
+    - RDMA/hns: Fix shift-out-bounds when max_inline_data is 0
+    - RDMA/hns: Fix undifined behavior caused by invalid max_sge
+    - RDMA/hns: Fix insufficient extend DB for VFs.
+    - iommu/vt-d: Fix identity map bounds in si_domain_init()
+    - RDMA/core: Remove NULL check before dev_{put, hold}
+    - RDMA: Fix netdev tracker in ib_device_set_netdev
+    - bnxt_re: Fix imm_data endianness
+    - netfilter: ctnetlink: use helper function to calculate expect ID
+    - netfilter: nf_set_pipapo: fix initial map fill
+    - ipvs: properly dereference pe in ip_vs_add_service
+    - gve: Fix XDP TX completion handling when counters overflow
+    - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
+    - ipv4: Fix incorrect TOS in route get reply
+    - ipv4: Fix incorrect TOS in fibmatch route get reply
+    - net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
+    - net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
+    - fs/ntfs3: Merge synonym COMPRESSION_UNIT and NTFS_LZNT_CUNIT
+    - fs/ntfs3: Fix transform resident to nonresident for compressed files
+    - fs/ntfs3: Deny getting attr data block in compressed frame
+    - fs/ntfs3: Missed NI_FLAG_UPDATE_PARENT setting
+    - fs/ntfs3: Fix getting file type
+    - fs/ntfs3: Add missing .dirty_folio in address_space_operations
+    - pinctrl: rockchip: update rk3308 iomux routes
+    - pinctrl: core: fix possible memory leak when pinctrl_enable() fails
+    - pinctrl: single: fix possible memory leak when pinctrl_enable() fails
+    - pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable()
+      fails
+    - pinctrl: freescale: mxs: Fix refcount of child
+    - fs/ntfs3: Replace inode_trylock with inode_lock
+    - fs/ntfs3: Correct undo if ntfs_create_inode failed
+    - fs/ntfs3: Drop stray '\' (backslash) in formatting string
+    - fs/ntfs3: Fix field-spanning write in INDEX_HDR
+    - pinctrl: renesas: r8a779g0: Fix CANFD5 suffix
+    - pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes
+    - pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes
+    - pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes
+    - pinctrl: renesas: r8a779g0: Fix IRQ suffixes
+    - pinctrl: renesas: r8a779g0: FIX PWM suffixes
+    - pinctrl: renesas: r8a779g0: Fix TCLK suffixes
+    - pinctrl: renesas: r8a779g0: Fix TPU suffixes
+    - fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
+    - fs/proc/task_mmu.c: add_to_pagemap: remove useless parameter addr
+    - fs/proc/task_mmu: don't indicate PM_MMAP_EXCLUSIVE without PM_PRESENT
+    - fs/proc/task_mmu: properly detect PM_MMAP_EXCLUSIVE per page of PMD-mapped
+      THPs
+    - nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
+    - rtc: interface: Add RTC offset to alarm after fix-up
+    - fs/ntfs3: Fix the format of the "nocase" mount option
+    - fs/ntfs3: Missed error return
+    - fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP
+    - powerpc/8xx: fix size given to set_huge_pte_at()
+    - s390/dasd: fix error checks in dasd_copy_pair_store()
+    - sbitmap: use READ_ONCE to access map->word
+    - sbitmap: fix io hung due to race on sbitmap_word::cleared
+    - LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint
+    - landlock: Don't lose track of restrictions on cred_transfer
+    - hugetlb: force allocating surplus hugepages on mempolicy allowed nodes
+    - mm/hugetlb: fix possible recursive locking detected warning
+    - mm/mglru: fix div-by-zero in vmpressure_calc_level()
+    - mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer
+    - mm/mglru: fix overshooting shrinker memory
+    - x86/efistub: Avoid returning EFI_SUCCESS on error
+    - x86/efistub: Revert to heap allocated boot_params for PE entrypoint
+    - exfat: fix potential deadlock on __exfat_get_dentry_set
+    - dt-bindings: thermal: correct thermal zone node name limit
+    - tick/broadcast: Make takeover of broadcast hrtimer reliable
+    - net: netconsole: Disable target before netpoll cleanup
+    - af_packet: Handle outgoing VLAN packets without hardware offloading
+    - btrfs: fix extent map use-after-free when adding pages to compressed bio
+    - kernel: rerun task_work while freezing in get_signal()
+    - ipv4: fix source address selection with route leak
+    - ipv6: take care of scope when choosing the src addr
+    - NFSD: Support write delegations in LAYOUTGET
+    - sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE
+      tasks
+    - fuse: verify {g,u}id mount options correctly
+    - ata: libata-scsi: Fix offsets for the fixed format sense data
+    - char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
+    - media: venus: fix use after free in vdec_close
+    - ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1
+    - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
+    - ext2: Verify bitmap and itable block numbers before using them
+    - io_uring/io-wq: limit retrying worker initialisation
+    - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
+    - drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
+    - scsi: qla2xxx: Fix optrom version displayed in FDMI
+    - drm/amd/display: Check for NULL pointer
+    - apparmor: use kvfree_sensitive to free data->data
+    - cifs: fix potential null pointer use in destroy_workqueue in init_cifs error
+      path
+    - cifs: fix reconnect with SMB1 UNIX Extensions
+    - cifs: mount with "unix" mount option for SMB1 incorrectly handled
+    - task_work: s/task_work_cancel()/task_work_cancel_func()/
+    - task_work: Introduce task_work_cancel() again
+    - udf: Avoid using corrupted block bitmap buffer
+    - m68k: amiga: Turn off Warp1260 interrupts during boot
+    - ext4: check dot and dotdot of dx_root before making dir indexed
+    - ext4: make sure the first directory block is not a hole
+    - io_uring: tighten task exit cancellations
+    - trace/pid_list: Change gfp flags in pid_list_fill_irq()
+    - selftests/landlock: Add cred_transfer test
+    - wifi: mwifiex: Fix interface type change
+    - wifi: rtw88: usb: Fix disconnection after beacon loss
+    - drivers: soc: xilinx: check return status of get_api_version()
+    - leds: ss4200: Convert PCIBIOS_* return codes to errnos
+    - leds: mt6360: Fix memory leak in mt6360_init_isnk_properties()
+    - media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
+    - jbd2: make jbd2_journal_get_max_txn_bufs() internal
+    - jbd2: precompute number of transaction descriptor blocks
+    - jbd2: avoid infinite transaction commit loop
+    - media: uvcvideo: Fix integer overflow calculating timestamp
+    - KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
+    - KVM: nVMX: Request immediate exit iff pending nested event needs injection
+    - ALSA: ump: Don't update FB name for static blocks
+    - ALSA: ump: Force 1 Group for MIDI1 FBs
+    - ALSA: usb-audio: Fix microphone sound on HD webcam.
+    - ALSA: usb-audio: Move HD Webcam quirk to the right place
+    - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
+    - tools/memory-model: Fix bug in lock.cat
+    - hwrng: amd - Convert PCIBIOS_* return codes to errnos
+    - parisc: Fix warning at drivers/pci/msi/msi.h:121
+    - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
+    - PCI: dw-rockchip: Fix initial PERST# GPIO value
+    - PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
+    - PCI: loongson: Enable MSI in LS7A Root Complex
+    - binder: fix hang of unregistered readers
+    - hostfs: fix dev_t handling
+    - efi/libstub: Zero initialize heap allocated struct screen_info
+    - fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
+    - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
+    - ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
+    - f2fs: fix to force buffered IO on inline_data inode
+    - f2fs: fix to don't dirty inode for readonly filesystem
+    - f2fs: fix return value of f2fs_convert_inline_inode()
+    - f2fs: use meta inode for GC of atomic file
+    - f2fs: use meta inode for GC of COW file
+    - clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
+    - ubi: eba: properly rollback inside self_check_eba
+    - block: fix deadlock between sd_remove & sd_release
+    - mm: fix old/young bit handling in the faulting path
+    - decompress_bunzip2: fix rare decompression failure
+    - kbuild: Fix '-S -c' in x86 stack protector scripts
+    - ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA on unprepare
+    - ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2
+    - kobject_uevent: Fix OOB access within zap_modalias_env()
+    - gve: Fix an edge case for TSO skb validity check
+    - ice: Add a per-VF limit on number of FDIR filters
+    - devres: Fix devm_krealloc() wasting memory
+    - devres: Fix memory leakage caused by driver API devm_free_percpu()
+    - irqdomain: Fixed unbalanced fwnode get and put
+    - irqchip/imx-irqsteer: Handle runtime power management correctly
+    - mm/numa_balancing: teach mpol_to_str about the balancing mode
+    - rtc: cmos: Fix return value of nvmem callbacks
+    - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE
+      state
+    - scsi: qla2xxx: During vport delete send async logout explicitly
+    - scsi: qla2xxx: Unable to act on RSCN for port online
+    - scsi: qla2xxx: Fix for possible memory corruption
+    - scsi: qla2xxx: Use QP lock to search for bsg
+    - scsi: qla2xxx: Reduce fabric scan duplicate code
+    - scsi: qla2xxx: Fix flash read failure
+    - scsi: qla2xxx: Complete command early within lock
+    - scsi: qla2xxx: validate nvme_local_port correctly
+    - perf: Fix event leak upon exit
+    - perf: Fix event leak upon exec and file release
+    - perf stat: Fix the hard-coded metrics calculation on the hybrid
+    - perf/x86/intel/uncore: Fix the bits of the CHA extended umask for SPR
+    - perf/x86/intel/ds: Fix non 0 retire latency on Raptorlake
+    - perf/x86/intel/pt: Fix topa_entry base length
+    - perf/x86/intel/pt: Fix a topa_entry base address calculation
+    - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8
+    - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell
+    - drm/udl: Remove DRM_CONNECTOR_POLL_HPD
+    - drm/dp_mst: Fix all mstb marked as not probed after suspend/resume
+    - drm/amdgpu: reset vm state machine after gpu reset(vram lost)
+    - drm/amd/amdgpu: Fix uninitialized variable warnings
+    - drm/i915/dp: Reset intel_dp->link_trained before retraining the link
+    - drm/i915/dp: Don't switch the LTTPR mode on an active link
+    - rtc: isl1208: Fix return value of nvmem callbacks
+    - rtc: abx80x: Fix return value of nvmem callback on read
+    - watchdog/perf: properly initialize the turbo mode timestamp and rearm
+      counter
+    - platform: mips: cpu_hwmon: Disable driver on unsupported hardware
+    - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
+    - selftests/sigaltstack: Fix ppc64 GCC build
+    - dm-verity: fix dm_is_verity_target() when dm-verity is builtin
+    - rbd: don't assume rbd_is_lock_owner() for exclusive mappings
+    - remoteproc: stm32_rproc: Fix mailbox interrupts queuing
+    - remoteproc: imx_rproc: Skip over memory region when node value is NULL
+    - remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init
+    - MIPS: dts: loongson: Add ISA node
+    - MIPS: ip30: ip30-console: Add missing include
+    - MIPS: dts: loongson: Fix GMAC phy node
+    - MIPS: Loongson64: env: Hook up Loongsson-2K
+    - MIPS: Loongson64: Remove memory node for builtin-dtb
+    - MIPS: Loongson64: reset: Prioritise firmware service
+    - MIPS: Loongson64: Test register availability before use
+    - drm/etnaviv: don't block scheduler when GPU is still active
+    - drm/panfrost: Mark simple_ondemand governor as softdep
+    - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
+    - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
+    - lib/build_OID_registry: don't mention the full path of the script in output
+    - video: logo: Drop full path of the input filename in generated file
+    - Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
+    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
+    - minmax: scsi: fix mis-use of 'clamp()' in sr.c
+    - mm/mglru: fix ineffective protection calculation
+    - PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
+    - f2fs: fix to truncate preallocated blocks in f2fs_file_open()
+    - kdb: address -Wformat-security warnings
+    - kdb: Use the passed prompt in kdb_position_cursor()
+    - dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels
+    - phy: cadence-torrent: Check return value on register read
+    - phy: zynqmp: Enable reference clock correctly
+    - um: time-travel: fix time-travel-start option
+    - um: time-travel: fix signal blocking race/hang
+    - f2fs: fix start segno of large section
+    - watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get()
+    - watchdog: rzg2l_wdt: Check return status of pm_runtime_put()
+    - f2fs: fix to update user block counts in block_operations()
+    - kbuild: avoid build error when single DTB is turned into composite DTB
+    - selftests/bpf: fexit_sleep: Fix stack allocation for arm64
+    - libbpf: Fix no-args func prototype BTF dumping syntax
+    - af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash
+    - dma: fix call order in dmam_free_coherent
+    - bpf, events: Use prog to emit ksymbol event for main program
+    - tools/resolve_btfids: Fix comparison of distinct pointer types warning in
+      resolve_btfids
+    - MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
+    - ipv4: Fix incorrect source address in Record Route option
+    - net: bonding: correctly annotate RCU in bond_should_notify_peers()
+    - ice: Fix recipe read procedure
+    - netfilter: nft_set_pipapo_avx2: disable softinterrupts
+    - net: stmmac: Correct byte order of perfect_match
+    - net: nexthop: Initialize all fields in dumped nexthops
+    - bpf: Fix a segment issue when downgrading gso_size
+    - apparmor: Fix null pointer deref when receiving skb during sock creation
+    - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
+    - lirc: rc_dev_get_from_fd(): fix file leak
+    - auxdisplay: ht16k33: Drop reference after LED registration
+    - ASoC: SOF: imx8m: Fix DSP control regmap retrieval
+    - spi: microchip-core: fix the issues in the isr
+    - spi: microchip-core: defer asserting chip select until just before write to
+      TX FIFO
+    - spi: microchip-core: only disable SPI controller when register value change
+      requires it
+    - spi: microchip-core: fix init function not setting the master and motorola
+      modes
+    - spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer
+    - nvme-pci: Fix the instructions for disabling power management
+    - ASoC: sof: amd: fix for firmware reload failure in Vangogh platform
+    - spi: spidev: add correct compatible for Rohm BH2228FV
+    - ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
+    - ASoC: TAS2781: Fix tasdev_load_calibrated_data()
+    - ceph: fix incorrect kmalloc size of pagevec mempool
+    - s390/pci: Refactor arch_setup_msi_irqs()
+    - s390/pci: Allow allocation of more than 1 MSI interrupt
+    - s390/cpum_cf: Fix endless loop in CF_DIAG event stop
+    - iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
+    - io_uring: fix io_match_task must_hold
+    - nvme-pci: add missing condition check for existence of mapped data
+    - fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
+    - md/raid0: don't free conf on raid0_run failure
+    - md/raid1: don't free conf on raid0_run failure
+    - io_uring: Fix probe of disabled operations
+    - cgroup/cpuset: Optimize isolated partition only generate_sched_domains()
+      calls
+    - cgroup/cpuset: Fix remote root partition creation problem
+    - x86/syscall: Mark exit[_group] syscall handlers __noreturn
+    - perf: arm_pmuv3: Avoid assigning fixed cycle counter with threshold
+    - md/raid5: recheck if reshape has finished with device_lock held
+    - hwmon: (ltc2991) re-order conditions to fix off by one bug
+    - arm64: smp: Fix missing IPI statistics
+    - arm64: dts: qcom: sc7280: Remove CTS/RTS configuration
+    - ARM: dts: qcom: msm8226-microsoft-common: Enable smbb explicitly
+    - OPP: Fix missing cleanup on error in _opp_attach_genpd()
+    - arm64: dts: qcom: sc8280xp-*: Remove thermal zone polling delays
+    - arm64: dts: ti: k3-am62-main: Fix the reg-range for main_pktdma
+    - arm64: dts: ti: k3-am62a-main: Fix the reg-range for main_pktdma
+    - arm64: dts: ti: k3-am62p-main: Fix the reg-range for main_pktdma
+    - arm64: dts: ti: k3-am62a7: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am62p5: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am62p5-sk: Fix pinmux for McASP1 TX
+    - arm64: dts: qcom: sc7180-trogdor: Disable pwmleds node where unused
+    - arm64: dts: mediatek: mt8192: Fix GPU thermal zone name for SVS
+    - arm64: dts: mediatek: mt8183-pico6: Fix wake-on-X event node names
+    - arm64: dts: renesas: r9a08g045: Add missing hypervisor virtual timer IRQ
+    - cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons
+    - wifi: mac80211: cancel multi-link reconf work on disconnect
+    - wifi: ath11k: refactor setting country code logic
+    - wifi: ath11k: restore country code during resume
+    - net: ethernet: cortina: Restore TSO support
+    - tcp: fix races in tcp_abort()
+    - hns3: avoid linking objects into multiple modules
+    - sched/core: Move preempt_model_*() helpers from sched.h to preempt.h
+    - sched/core: Drop spinlocks on contention iff kernel is preemptible
+    - net: dsa: ksz_common: Allow only up to two HSR HW offloaded ports for
+      KSZ9477
+    - libbpf: Skip base btf sanity checks
+    - wifi: mac80211: add ieee80211_tdls_sta_link_id()
+    - wifi: iwlwifi: fix iwl_mvm_get_valid_rx_ant()
+    - wifi: ath12k: advertise driver capabilities for MBSSID and EMA
+    - riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
+    - perf/x86/amd/uncore: Avoid PMU registration if counters are unavailable
+    - perf/x86/amd/uncore: Fix DF and UMC domain identification
+    - NFSD: Fix nfsdcld warning
+    - net: page_pool: fix warning code
+    - bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
+    - Bluetooth: hci_event: Set QoS encryption from BIGInfo report
+    - Bluetooth: hci_core, hci_sync: cleanup struct discovery_state
+    - Bluetooth: Fix usage of __hci_cmd_sync_status
+    - tcp: Don't access uninit tcp_rsk(req)->ao_keyid in
+      tcp_create_openreq_child().
+    - drm/panel: ilitek-ili9882t: If prepare fails, disable GPIO before regulators
+    - drm/panel: ilitek-ili9882t: Check for errors on the NOP in prepare()
+    - drm/amd/display: Move 'struct scaler_data' off stack
+    - media: i2c: hi846: Fix V4L2_SUBDEV_FORMAT_TRY get_selection()
+    - drm/msm/dpu: fix encoder irq wait skip
+    - drm/msm/dpu: drop duplicate drm formats from wb2_formats arrays
+    - drm/msm/dp: fix runtime_pm handling in dp_wait_hpd_asserted
+    - perf maps: Switch from rbtree to lazily sorted array for addresses
+    - perf maps: Fix use after free in __maps__fixup_overlap_and_insert
+    - drm/bridge: samsung-dsim: Set P divider based on min/max of fin pll
+    - drm/i915/psr: Print Panel Replay status instead of frame lock status
+    - drm/mediatek: Set DRM mode configs accordingly
+    - drm/msm/dsi: set video mode widebus enable bit when widebus is enabled
+    - tools/perf: Fix the string match for "/tmp/perf-$PID.map" files in dso__load
+    - drm/amd/display: Add null check before access structs
+    - nfs: pass explicit offset/count to trace events
+    - PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in
+      pci_epf_test_core_init()
+    - PCI: tegra194: Set EP alignment restriction for inbound ATU
+    - riscv: smp: fail booting up smp if inconsistent vlen is detected
+    - clk: meson: s4: fix fixed_pll_dco clock
+    - clk: meson: s4: fix pwm_j_div parent clock
+    - usb: typec-mux: ptn36502: unregister typec switch on probe error and remove
+    - mtd: spi-nor: winbond: fix w25q128 regression
+    - iommufd/selftest: Fix dirty bitmap tests with u8 bitmaps
+    - iommufd/selftest: Fix iommufd_test_dirty() to handle <u8 bitmaps
+    - iommufd/selftest: Add tests for <= u8 bitmap sizes
+    - iommufd/selftest: Fix tests to use MOCK_PAGE_SIZE based buffer sizes
+    - iommufd/iova_bitmap: Check iova_bitmap_done() after set ahead
+    - clk: qcom: gcc-x1e80100: Fix halt_check for all pipe clocks
+    - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
+    - kvm: s390: Reject memory region operations for ucontrol VMs
+    - eeprom: ee1004: Call i2c_new_scanned_device to instantiate thermal sensor
+    - clk: qcom: gcc-x1e80100: Set parent rate for USB3 sec and tert PHY pipe clks
+    - workqueue: Introduce from_work() helper for cleaner callback declarations
+    - RDMA/hns: Fix mbx timing out before CMD execution is completed
+    - crypto: mxs-dcp - Ensure payload is zero when using key slot
+    - RDMA/mana_ib: Enable RoCE on port 1
+    - RDMA/mana_ib: set node_guid
+    - rtc: tps6594: Fix memleak in probe
+    - selftests/damon/access_memory: use user-defined region size
+    - md-cluster: fix hanging issue while a new disk adding
+    - power: supply: ab8500: Fix error handling when calling
+      iio_read_channel_processed()
+    - power: supply: ingenic: Fix some error handling paths in
+      ingenic_battery_get_property()
+    - remoteproc: mediatek: Don't attempt to remap l1tcm memory if missing
+    - remoteproc: k3-r5: Fix IPC-only mode detection
+    - mailbox: imx: fix TXDB_V2 channel race condition
+    - mailbox: mtk-cmdq: Move devm_mbox_controller_register() after
+      devm_pm_runtime_enable()
+    - mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit
+      machines
+    - mm/huge_memory: avoid PMD-size page cache if needed
+    - thermal/drivers/broadcom: Fix race between removal and clock disable
+    - workqueue: Always queue work items to the newest PWQ for order workqueues
+    - ipv6: fix source address selection with route leak
+    - drm/xe: Use write-back caching mode for system memory on DGFX
+    - md/raid5: fix spares errors about rcu usage
+    - media: stm32: dcmipp: correct error handling in dcmipp_create_subdevs
+    - tpm_tis_spi: add missing attpm20p SPI device ID entry
+    - sysctl: always initialize i_uid/i_gid
+    - media: i2c: Kconfig: Fix missing firmware upload config select
+    - genirq: Set IRQF_COND_ONESHOT in request_irq()
+    - cpufreq: qcom-nvmem: fix memory leaks in probe error paths
+    - leds: triggers: Flush pending brightness before activating trigger
+    - media: i2c: alvium: Move V4L2_CID_GAIN to V4L2_CID_ANALOG_GAIN
+    - KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector
+    - KVM: nVMX: Check for pending posted interrupts when looking for nested
+      events
+    - ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
+    - fbdev: vesafb: Detect VGA compatibility from screen info's VESA attributes
+    - drm/fbdev-dma: Fix framebuffer mode for big endian devices
+    - xhci: Apply XHCI_RESET_TO_DEFAULT quirk to TGL
+    - dmaengine: fsl-edma: clean up unused "fsl,imx8qm-adma" compatible string
+    - dmaengine: fsl-edma: change the memory access from local into remote mode in
+      i.MX 8QM
+    - clk: samsung: fix getting Exynos4 fin_pll rate from external clocks
+    - bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone
+    - ASoC: SOF: ipc4-topology: Use correct queue_id for requesting input pin
+      format
+    - arch: um: rust: Use the generated target.json again
+    - f2fs: fix null reference error when checking end of zone
+    - selftests: forwarding: skip if kernel not support setting bridge fdb
+      learning limit
+    - xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len
+    - drm/xe/exec: Fix minor bug related to xe_sync_entry_cleanup
+    - thermal: trip: Split thermal_zone_device_set_mode()
+    - apparmor: unpack transition table if dfa is not present
+    - i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1
+    - selinux,smack: remove the capability checks in the removexattr hooks
+    - selftests/bpf: DENYLIST.aarch64: Skip fexit_sleep again
+    - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
+    - Upstream stable to v6.6.44, v6.10.3
+
+  * Noble update: upstream stable patchset 2024-09-30 (LP: #2083196) //
+    CVE-2024-42284
+    - tipc: Return non-zero value from tipc_udp_addr2str() on error
+
+  * CVE-2024-44987
+    - ipv6: prevent UAF in ip6_send_skb()
+
+  * CVE-2024-42301
+    - dev/parport: fix the array out-of-bounds risk
+
+  * CVE-2024-44998
+    - atm: idt77252: prevent use after free in dequeue_rx()
+
+ -- Mehmet Basaran <mehmet.basaran@canonical.com>  Sat, 09 Nov 2024 18:54:16 +0300
+
+linux (6.8.0-49.49) noble; urgency=medium
+
+  * noble/linux: 6.8.0-49.49 -proposed tracker (LP: #2085942)
+
+  * CVE-2024-46800
+    - sch/netem: fix use after free in netem_dequeue
+
+  * mm/folios: xfs hangs with hung task timeouts with corrupted folio pointer
+    lists (LP: #2085495)
+    - lib/xarray: introduce a new helper xas_get_order
+    - mm/filemap: return early if failed to allocate memory for split
+    - mm/filemap: optimize filemap folio adding
+
+  * CVE-2024-43882
+    - exec: Fix ToCToU between perm check and set-uid/gid usage
+
+ -- Manuel Diewald <manuel.diewald@canonical.com>  Fri, 01 Nov 2024 11:56:32 +0100
+
+linux (6.8.0-48.48) noble; urgency=medium
+
+  * noble/linux: 6.8.0-48.48 -proposed tracker (LP: #2082437)
+
+  * [SRU][Noble] Bad EPP defaults cause performance regressions on select Intel
+    CPUs (LP: #2077470)
+    - x86/cpu/vfm: Update arch/x86/include/asm/intel-family.h
+    - cpufreq: intel_pstate: Allow model specific EPPs
+    - cpufreq: intel_pstate: Update default EPPs for Meteor Lake
+    - cpufreq: intel_pstate: Switch to new Intel CPU model defines
+    - cpufreq: intel_pstate: Update Meteor Lake EPPs
+    - cpufreq: intel_pstate: Use Meteor Lake EPPs for Arrow Lake
+    - cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids
+
+  * power: Enable intel_rapl driver (LP: #2078834)
+    - powercap: intel_rapl: Add support for ArrowLake-H platform
+
+  * x86/vmware: Add TDX hypercall support (LP: #2077729)
+    - x86/vmware: Introduce VMware hypercall API
+    - x86/vmware: Add TDX hypercall support
+
+  * Guest crashes post migration with migrate_misplaced_folio+0x4cc/0x5d0
+    (LP: #2076866)
+    - mm/mempolicy: use numa_node_id() instead of cpu_to_node()
+    - mm/numa_balancing: allow migrate on protnone reference with
+      MPOL_PREFERRED_MANY policy
+    - mm: convert folio_estimated_sharers() to folio_likely_mapped_shared()
+    - mm: factor out the numa mapping rebuilding into a new helper
+    - mm: support multi-size THP numa balancing
+    - mm/migrate: make migrate_misplaced_folio() return 0 on success
+    - mm/migrate: move NUMA hinting fault folio isolation + checks under PTL
+    - mm: fix possible OOB in numa_rebuild_large_mapping()
+
+  * Add 'mm: hold PTL from the first PTE while reclaiming a large folio' to fix
+    L2 Guest hang during LTP Test (LP: #2076147)
+    - mm: hold PTL from the first PTE while reclaiming a large folio
+
+  * KOP L2 guest fails to boot with 1 core - SMT8 topology (LP: #2070329)
+    - KVM: PPC: Book3S HV nestedv2: Add DPDES support in helper library for Guest
+      state buffer
+    - KVM: PPC: Book3S HV nestedv2: Fix doorbell emulation
+
+  * L2 Guest migration: continuously dumping while running NFS guest migration
+    (LP: #2076406)
+    - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3
+    - KVM: PPC: Book3S HV: Fix the get_one_reg of SDAR
+    - KVM: PPC: Book3S HV: Add one-reg interface for DEXCR register
+    - KVM: PPC: Book3S HV nestedv2: Keep nested guest DEXCR in sync
+    - KVM: PPC: Book3S HV: Add one-reg interface for HASHKEYR register
+    - KVM: PPC: Book3S HV nestedv2: Keep nested guest HASHKEYR in sync
+    - KVM: PPC: Book3S HV: Add one-reg interface for HASHPKEYR register
+    - KVM: PPC: Book3S HV nestedv2: Keep nested guest HASHPKEYR in sync
+
+  * perf build disables tracepoint support (LP: #2076190)
+    - [Packaging] perf: reenable libtraceevent
+
+  * Please backport the more restrictive XSAVES deactivation for  Zen1/2 arch
+    (LP: #2077321)
+    - x86/CPU/AMD: Improve the erratum 1386 workaround
+
+  * Fix alsa scarlett2 driver in 6.8  (LP: #2076402)
+    - ALSA: scarlett2: Move initialisation code lower in the source
+    - ALSA: scarlett2: Implement handling of the ACK notification
+
+  * rtw89: reset IDMEM mode to prevent download firmware failure (LP: #2077396)
+    - wifi: rtw89: 885xb: reset IDMEM mode to prevent download firmware failure
+
+  * CVE-2024-43858
+    - jfs: Fix array-index-out-of-bounds in diFree
+
+  * CVE-2024-42280
+    - mISDN: Fix a use after free in hfcmulti_tx()
+
+  * CVE-2024-42271
+    - net/iucv: fix use after free in iucv_sock_close()
+
+  * [Ubuntu-24.04] FADump with recommended crash size is making the L1 hang
+    (LP: #2060039)
+    - powerpc/64s/radix/kfence: map __kfence_pool at page granularity
+
+  * Noble update: upstream stable patchset 2024-09-09 (LP: #2079945)
+    - ocfs2: add bounds checking to ocfs2_check_dir_entry()
+    - jfs: don't walk off the end of ealist
+    - fs/ntfs3: Add a check for attr_names and oatbl
+    - fs/ntfs3: Validate ff offset
+    - usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup
+    - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
+    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
+    - arm64: dts: qcom: qrb4210-rb2: switch I2C2 to i2c-gpio
+    - arm64: dts: qcom: msm8996: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: sm6350: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: ipq6018: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: sdm630: Disable SS instance in Parkmode for USB
+    - ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused
+    - ALSA: seq: ump: Skip useless ports for static blocks
+    - filelock: Fix fcntl/close race recovery compat path
+    - tun: add missing verification for short frame
+    - tap: add missing verification for short frame
+    - s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()
+    - ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop
+    - arm64: dts: qcom: sc7180: Disable SuperSpeed instances in park mode
+    - arm64: dts: qcom: sc7280: Disable SuperSpeed instances in park mode
+    - arm64: dts: qcom: qrb2210-rb1: switch I2C2 to i2c-gpio
+    - arm64: dts: qcom: msm8998: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: ipq8074: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: sdm845: Disable SS instance in Parkmode for USB
+    - Upstream stable to v6.6.43, v6.9.12
+
+  * Noble update: upstream stable patchset 2024-09-02 (LP: #2078304)
+    - filelock: Remove locks reliably when fcntl/close race is detected
+    - scsi: core: alua: I/O errors for ALUA state transitions
+    - scsi: sr: Fix unintentional arithmetic wraparound
+    - scsi: qedf: Don't process stag work during unload and recovery
+    - scsi: qedf: Wait for stag work during unload
+    - scsi: qedf: Set qed_slowpath_params to zero before use
+    - efi/libstub: zboot.lds: Discard .discard sections
+    - ACPI: EC: Abort address space access upon error
+    - ACPI: EC: Avoid returning AE_OK on errors in address space handler
+    - tools/power/cpupower: Fix Pstate frequency reporting on AMD Family 1Ah CPUs
+    - wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata
+    - wifi: mac80211: apply mcast rate only if interface is up
+    - wifi: mac80211: handle tasklet frames before stopping
+    - wifi: cfg80211: fix 6 GHz scan request building
+    - wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup
+    - wifi: iwlwifi: mvm: remove stale STA link data during restart
+    - wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd
+    - wifi: iwlwifi: mvm: handle BA session teardown in RF-kill
+    - wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe option
+    - wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill
+    - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
+    - selftests: cachestat: Fix build warnings on ppc64
+    - selftests/openat2: Fix build warnings on ppc64
+    - selftests/futex: pass _GNU_SOURCE without a value to the compiler
+    - of/irq: Factor out parsing of interrupt-map parent phandle+args from
+      of_irq_parse_raw()
+    - Input: silead - Always support 10 fingers
+    - net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
+    - ila: block BH in ila_output()
+    - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
+    - null_blk: fix validation of block size
+    - kconfig: gconf: give a proper initial state to the Save button
+    - kconfig: remove wrong expr_trans_bool()
+    - input: Add event code for accessibility key
+    - input: Add support for "Do Not Disturb"
+    - HID: Ignore battery for ELAN touchscreens 2F2C and 4116
+    - NFSv4: Fix memory leak in nfs4_set_security_label
+    - nfs: propagate readlink errors in nfs_symlink_filler
+    - nfs: Avoid flushing many pages with NFS_FILE_SYNC
+    - nfs: don't invalidate dentries on transient errors
+    - cachefiles: add consistency check for copen/cread
+    - cachefiles: Set object to close if ondemand_id < 0 in copen
+    - cachefiles: make on-demand read killable
+    - fs/file: fix the check in find_next_fd()
+    - mei: demote client disconnect warning on suspend to debug
+    - iomap: Fix iomap_adjust_read_range for plen calculation
+    - drm/exynos: dp: drop driver owner initialization
+    - drm: panel-orientation-quirks: Add quirk for Aya Neo KUN
+    - drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time
+    - nvme: avoid double free special payload
+    - nvmet: always initialize cqe.result
+    - ALSA: hda: cs35l56: Fix lifecycle of codec pointer
+    - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
+    - ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5
+    - KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
+    - drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency
+    - ALSA: hda/realtek: Add more codec ID to no shutup pins list
+    - spi: Fix OCTAL mode support
+    - cpumask: limit FORCE_NR_CPUS to just the UP case
+    - [Config] Remove FORCE_NR_CPUS
+    - selftests: openvswitch: Set value to nla flags.
+    - drm/amdgpu: Indicate CU havest info to CP
+    - ALSA: hda: cs35l56: Select SERIAL_MULTI_INSTANTIATE
+    - mips: fix compat_sys_lseek syscall
+    - Input: elantech - fix touchpad state on resume for Lenovo N24
+    - Input: i8042 - add Ayaneo Kun to i8042 quirk table
+    - ASoC: rt722-sdca-sdw: add silence detection register as volatile
+    - Input: xpad - add support for ASUS ROG RAIKIRI PRO
+    - ASoC: topology: Fix references to freed memory
+    - ASoC: topology: Do not assign fields that are already set
+    - bytcr_rt5640 : inverse jack detect for Archos 101 cesium
+    - ALSA: dmaengine: Synchronize dma channel after drop()
+    - ASoC: ti: davinci-mcasp: Set min period size using FIFO config
+    - ASoC: ti: omap-hdmi: Fix too long driver name
+    - ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on error rollback
+    - ASoC: rt722-sdca-sdw: add debounce time for type detection
+    - nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA.
+    - Input: ads7846 - use spi_device_id table
+    - can: kvaser_usb: fix return value for hif_usb_send_regout
+    - gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
+    - octeontx2-pf: Fix coverity and klockwork issues in octeon PF driver
+    - s390/sclp: Fix sclp_init() cleanup on failure
+    - platform/mellanox: nvsw-sn2201: Add check for platform_device_add_resources
+    - platform/x86: wireless-hotkey: Add support for LG Airplane Button
+    - platform/x86: lg-laptop: Remove LGEX0815 hotkey handling
+    - platform/x86: lg-laptop: Change ACPI device id
+    - platform/x86: lg-laptop: Use ACPI device handle when evaluating WMAB/WMBB
+    - btrfs: qgroup: fix quota root leak after quota disable failure
+    - ibmvnic: Add tx check to prevent skb leak
+    - ALSA: PCM: Allow resume only for suspended streams
+    - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
+    - ALSA: dmaengine_pcm: terminate dmaengine before synchronize
+    - ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA
+    - net: usb: qmi_wwan: add Telit FN912 compositions
+    - net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and
+      DEV_STATS_ADD()
+    - powerpc/pseries: Whitelist dtl slub object for copying to userspace
+    - powerpc/eeh: avoid possible crash when edev->pdev changes
+    - scsi: libsas: Fix exp-attached device scan after probe failure scanned in
+      again after probe failed
+    - tee: optee: ffa: Fix missing-field-initializers warning
+    - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
+    - Bluetooth: btnxpuart: Enable Power Save feature on startup
+    - bluetooth/l2cap: sync sock recv cb and release
+    - erofs: ensure m_llen is reset to 0 if metadata is invalid
+    - drm/amd/display: Add refresh rate range check
+    - drm/amd/display: Account for cursor prefetch BW in DML1 mode support
+    - drm/amd/display: Fix refresh rate range for some panel
+    - drm/radeon: check bo_va->bo is non-NULL before using it
+    - fs: better handle deep ancestor chains in is_subdir()
+    - wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK
+    - drivers/perf: riscv: Reset the counter to hpmevent mapping while starting
+      cpus
+    - riscv: stacktrace: fix usage of ftrace_graph_ret_addr()
+    - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
+    - ksmbd: return FILE_DEVICE_DISK instead of super magic
+    - ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods by
+      MAX_BDL_ENTRIES
+    - selftest/timerns: fix clang build failures for abs() calls
+    - selftests/vDSO: fix clang build errors and warnings
+    - hfsplus: fix uninit-value in copy_name
+    - selftests/bpf: Extend tcx tests to cover late tcx_entry release
+    - spi: mux: set ctlr->bits_per_word_mask
+    - ALSA: hda: Use imply for suggesting CONFIG_SERIAL_MULTI_INSTANTIATE
+    - [Config] Update CONFIG_SERIAL_MULTI_INSTANTIATE
+    - cifs: fix noisy message on copy_file_range
+    - Bluetooth: L2CAP: Fix deadlock
+    - of/irq: Disable "interrupt-map" parsing for PASEMI Nemo
+    - wifi: cfg80211: wext: set ssids=NULL for passive scans
+    - wifi: mac80211: disable softirqs for queued frame handling
+    - wifi: iwlwifi: mvm: don't wake up rx_sync_waitq upon RFKILL
+    - cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
+    - cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
+    - btrfs: ensure fast fsync waits for ordered extents after a write failure
+    - PNP: Hide pnp_bus_type from the non-PNP code
+    - ACPI: AC: Properly notify powermanagement core about changes
+    - selftests/overlayfs: Fix build error on ppc64
+    - nvme-fabrics: use reserved tag for reg read/write command
+    - LoongArch: Fix GMAC's phy-mode definitions in dts
+    - io_uring: fix possible deadlock in io_register_iowq_max_workers()
+    - vfio: Create vfio_fs_type with inode per device
+    - vfio/pci: Use unmap_mapping_range()
+    - parport: amiga: Mark driver struct with __refdata to prevent section
+      mismatch
+    - drm: renesas: shmobile: Call drm_atomic_helper_shutdown() at shutdown time
+    - vfio/pci: Insert full vma on mmap'd MMIO fault
+    - ALSA: hda: cs35l41: Support Lenovo Thinkbook 16P Gen 5
+    - ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 4
+    - ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 4
+    - wifi: mac80211: Avoid address calculations via out of bounds array indexing
+    - drm/amd/display: change dram_clock_latency to 34us for dcn35
+    - closures: Change BUG_ON() to WARN_ON()
+    - ASoC: codecs: ES8326: Solve headphone detection issue
+    - ASoC: Intel: avs: Fix route override
+    - net: mvpp2: fill-in dev_port attribute
+    - btrfs: scrub: handle RST lookup error correctly
+    - clk: qcom: apss-ipq-pll: remove 'config_ctl_hi_val' from Stromer pll configs
+    - drm/amd/display: Update efficiency bandwidth for dcn351
+    - drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport
+    - btrfs: fix uninitialized return value in the ref-verify tool
+    - spi: davinci: Unset POWERDOWN bit when releasing resources
+    - mm: page_ref: remove folio_try_get_rcu()
+    - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Lenovo ThinBook 13x
+      Gen4
+    - netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume()
+    - Upstream stable to v6.6.42, v6.9.11
+
+  * CVE-2024-27022
+    - Revert "Revert "fork: defer linking file vma until vma is fully
+      initialized""
+
+  * UBSAN: array-index-out-of-bounds in /build/linux-Z1RxaK/linux-
+    6.8.0/drivers/gpu/drm/amd/amdgpu/../pm/powerplay/hwmgr/processpptables.c:124
+    9:61 (LP: #2078041)
+    - drm/amdgpu/pptable: convert some variable sized arrays to [] style
+    - drm/amdgpu: convert some variable sized arrays to [] style
+    - drm/amdgpu/pptable: Fix UBSAN array-index-out-of-bounds
+
+  * alsa: Headphone and Speaker couldn't output sound intermittently
+    (LP: #2077690)
+    - ALSA: hda/realtek - Fixed ALC256 headphone no sound
+    - ALSA: hda/realtek - FIxed ALC285 headphone no sound
+
+  * Fix ethernet performance on JSL and EHL (LP: #2077858)
+    - intel_idle: Disable promotion to C1E on Jasper Lake and Elkhart Lake
+
+  * Noble update: upstream stable patchset 2024-08-29 (LP: #2078289)
+    - Revert "usb: xhci: prevent potential failure in handle_tx_event() for
+      Transfer events without TRB"
+    - Compiler Attributes: Add __uninitialized macro
+    - mm: prevent derefencing NULL ptr in pfn_section_valid()
+    - scsi: ufs: core: Fix ufshcd_clear_cmd racing issue
+    - scsi: ufs: core: Fix ufshcd_abort_one racing issue
+    - vfio/pci: Init the count variable in collecting hot-reset devices
+    - cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop
+    - cachefiles: stop sending new request when dropping object
+    - cachefiles: cancel all requests for the object that is being dropped
+    - cachefiles: wait for ondemand_object_worker to finish when dropping object
+    - cachefiles: cyclic allocation of msg_id to avoid reuse
+    - cachefiles: add missing lock protection when polling
+    - dsa: lan9303: Fix mapping between DSA port number and PHY address
+    - filelock: fix potential use-after-free in posix_lock_inode
+    - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
+    - vfs: don't mod negative dentry count when on shrinker list
+    - net: bcmasp: Fix error code in probe()
+    - tcp: fix incorrect undo caused by DSACK of TLP retransmit
+    - bpf: Fix too early release of tcx_entry
+    - net: phy: microchip: lan87xx: reinit PHY after cable test
+    - skmsg: Skip zero length skb in sk_msg_recvmsg
+    - octeontx2-af: Fix incorrect value output on error path in
+      rvu_check_rsrc_availability()
+    - net: fix rc7's __skb_datagram_iter()
+    - i40e: Fix XDP program unloading while removing the driver
+    - net: ethernet: lantiq_etop: fix double free in detach
+    - bpf: fix order of args in call to bpf_map_kvcalloc
+    - bpf: make timer data struct more generic
+    - bpf: replace bpf_timer_init with a generic helper
+    - bpf: Fail bpf_timer_cancel when callback is being cancelled
+    - net: ethernet: mtk-star-emac: set mac_managed_pm when probing
+    - ppp: reject claimed-as-LCP but actually malformed packets
+    - ethtool: netlink: do not return SQI value if link is down
+    - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
+    - net, sunrpc: Remap EPERM in case of connection failure in
+      xs_tcp_setup_socket
+    - s390: Mark psw in __load_psw_mask() as __unitialized
+    - arm64: dts: qcom: sc8180x: Fix LLCC reg property again
+    - firmware: cs_dsp: Fix overflow checking of wmfw header
+    - firmware: cs_dsp: Return error if block header overflows file
+    - firmware: cs_dsp: Validate payload length before processing block
+    - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
+    - ASoC: SOF: Intel: hda: fix null deref on system suspend entry
+    - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
+    - ARM: davinci: Convert comma to semicolon
+    - octeontx2-af: replace cpt slot with lf id on reg write
+    - octeontx2-af: fix a issue with cpt_lf_alloc mailbox
+    - octeontx2-af: fix detection of IP layer
+    - octeontx2-af: fix issue with IPv6 ext match for RSS
+    - octeontx2-af: fix issue with IPv4 match for RSS
+    - cifs: fix setting SecurityFlags to true
+    - Revert "sched/fair: Make sure to try to detach at least one movable task"
+    - tcp: avoid too many retransmit packets
+    - net: ks8851: Fix deadlock with the SPI chip variant
+    - net: ks8851: Fix potential TX stall after interface reopen
+    - USB: serial: option: add Telit generic core-dump composition
+    - USB: serial: option: add Telit FN912 rmnet compositions
+    - USB: serial: option: add Fibocom FM350-GL
+    - USB: serial: option: add support for Foxconn T99W651
+    - USB: serial: option: add Netprisma LCUK54 series modules
+    - USB: serial: option: add Rolling RW350-GL variants
+    - USB: serial: mos7840: fix crash on resume
+    - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
+    - usb: dwc3: pci: add support for the Intel Panther Lake
+    - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
+    - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the
+      descriptor
+    - misc: microchip: pci1xxxx: Fix return value of nvmem callbacks
+    - hpet: Support 32-bit userspace
+    - xhci: always resume roothubs if xHC was reset during resume
+    - s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()
+    - mm: vmalloc: check if a hash-index is in cpu_possible_mask
+    - mm/filemap: skip to create PMD-sized page cache if needed
+    - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
+    - ksmbd: discard write access to the directory open
+    - iio: trigger: Fix condition for own trigger
+    - arm64: dts: qcom: sa8775p: Correct IRQ number of EL2 non-secure physical
+      timer
+    - arm64: dts: qcom: sc8280xp-x13s: fix touchscreen power on
+    - nvmem: rmem: Fix return value of rmem_read()
+    - nvmem: meson-efuse: Fix return value of nvmem callbacks
+    - nvmem: core: only change name to fram for current attribute
+    - platform/x86: toshiba_acpi: Fix array out-of-bounds access
+    - tty: serial: ma35d1: Add a NULL check for of_node
+    - ALSA: hda/realtek: add quirk for Clevo V5[46]0TU
+    - ALSA: hda/realtek: Enable Mute LED on HP 250 G7
+    - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
+    - Fix userfaultfd_api to return EINVAL as expected
+    - pmdomain: qcom: rpmhpd: Skip retention level for Power Domains
+    - libceph: fix race between delayed_work() and ceph_monc_stop()
+    - ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
+    - cpufreq: ACPI: Mark boost policy as enabled when setting boost
+    - cpufreq: Allow drivers to advertise boost enabled
+    - wireguard: selftests: use acpi=off instead of -no-acpi for recent QEMU
+    - wireguard: allowedips: avoid unaligned 64-bit memory accesses
+    - wireguard: queueing: annotate intentional data race in cpu round robin
+    - wireguard: send: annotate intentional data race in checking empty queue
+    - misc: fastrpc: Fix DSP capabilities request
+    - misc: fastrpc: Avoid updating PD type for capability request
+    - misc: fastrpc: Copy the complete capability structure to user
+    - misc: fastrpc: Fix memory leak in audio daemon attach operation
+    - misc: fastrpc: Fix ownership reassignment of remote heap
+    - misc: fastrpc: Restrict untrusted app to attach to privileged PD
+    - mm/shmem: disable PMD-sized page cache if needed
+    - mm/damon/core: merge regions aggressively when max_nr_regions is unmet
+    - selftests/net: fix gro.c compilation failure due to non-existent
+      opt_ipproto_off
+    - ext4: avoid ptr null pointer dereference
+    - sched: Move psi_account_irqtime() out of update_rq_clock_task() hotpath
+    - i2c: rcar: bring hardware to known state when probing
+    - i2c: mark HostNotify target address as used
+    - i2c: rcar: ensure Gen3+ reset does not disturb local targets
+    - i2c: testunit: avoid re-issued work after read message
+    - i2c: rcar: clear NO_RXDMA flag after resetting
+    - x86/bhi: Avoid warning in #DB handler due to BHI mitigation
+    - kbuild: Make ld-version.sh more robust against version string changes
+    - spi: axi-spi-engine: fix sleep calculation
+    - minixfs: Fix minixfs_rename with HIGHMEM
+    - bpf: Defer work in bpf_timer_cancel_and_free
+    - netfilter: nf_tables: prefer nft_chain_validate
+    - arm64: dts: qcom: x1e80100-*: Allocate some CMA buffers
+    - arm64: dts: qcom: sm6115: add iommu for sdhc_1
+    - arm64: dts: qcom: qdu1000: Fix LLCC reg property
+    - net: ethtool: Fix RSS setting
+    - nilfs2: fix kernel bug on rename operation of broken directory
+    - cachestat: do not flush stats in recency check
+    - mm: fix crashes from deferred split racing folio migration
+    - nvmem: core: limit cell sysfs permissions to main attribute ones
+    - serial: imx: ensure RTS signal is not left active after shutdown
+    - mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE
+    - mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length
+    - mm/readahead: limit page cache size in page_cache_ra_order()
+    - Revert "dt-bindings: cache: qcom,llcc: correct QDU1000 reg entries"
+    - sched/deadline: Fix task_struct reference leak
+    - Upstream stable to v6.6.40, v6.6.41, v6.9.10
+
+  * [SRU][HPE 24.04] Intel FVL NIC FW flash fails with inbox driver, causing
+    driver not detected (LP: #2076675) // Noble update: upstream stable patchset
+    2024-08-29 (LP: #2078289)
+    - i40e: fix: remove needless retries of NVM update
+
+  * CVE-2024-41022
+    - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
+
+  *  Deadlock occurs while suspending md raid  (LP: #2073695)
+    - md: change the return value type of md_write_start to void
+    - md: fix deadlock between mddev_suspend and flush bio
+
+  * Lenovo X12 Detachable Gen 2 unresponsive under light load (LP: #2076361)
+    - drm/i915: Enable Wa_16019325821
+    - drm/i915/guc: Add support for w/a KLVs
+    - drm/i915/guc: Enable Wa_14019159160
+
+  * Regression: unable to reach low idle states on Tiger Lake (LP: #2072679)
+    - SAUCE: PCI: ASPM: Allow OS to configure ASPM where BIOS is incapable of
+    - SAUCE: PCI: vmd: Let OS control ASPM for devices under VMD domain
+
+  * Noble update: upstream stable patchset 2024-08-22 (LP: #2077600)
+    - locking/mutex: Introduce devm_mutex_init()
+    - leds: an30259a: Use devm_mutex_init() for mutex initialization
+    - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
+    - drm/lima: fix shared irq handling on driver remove
+    - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
+    - media: dvb: as102-fe: Fix as10x_register_addr packing
+    - media: dvb-usb: dib0700_devices: Add missing release_firmware()
+    - IB/core: Implement a limit on UMAD receive List
+    - scsi: qedf: Make qedf_execute_tmf() non-preemptible
+    - selftests/bpf: adjust dummy_st_ops_success to detect additional error
+    - selftests/bpf: do not pass NULL for non-nullable params in dummy_st_ops
+    - selftests/bpf: dummy_st_ops should reject 0 for non-nullable params
+    - RISC-V: KVM: Fix the initial sample period value
+    - crypto: aead,cipher - zeroize key buffer after use
+    - media: mediatek: vcodec: Only free buffer VA that is not NULL
+    - drm/amdgpu: Fix uninitialized variable warnings
+    - drm/amdgpu: Initialize timestamp for some legacy SOCs
+    - drm/amd/display: Check index msg_id before read or write
+    - drm/amd/display: Check pipe offset before setting vblank
+    - drm/amd/display: Skip finding free audio for unknown engine_id
+    - drm/amd/display: Fix uninitialized variables in DM
+    - drm/amdgpu: fix uninitialized scalar variable warning
+    - drm/amdgpu: fix the warning about the expression (int)size - len
+    - media: dw2102: Don't translate i2c read into write
+    - riscv: Apply SiFive CIP-1200 workaround to single-ASID sfence.vma
+    - sctp: prefer struct_size over open coded arithmetic
+    - firmware: dmi: Stop decoding on broken entry
+    - Input: ff-core - prefer struct_size over open coded arithmetic
+    - wifi: mt76: replace skb_put with skb_put_zero
+    - wifi: mt76: mt7996: add sanity checks for background radar trigger
+    - thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
+    - media: dvb-frontends: tda18271c2dd: Remove casting during div
+    - media: s2255: Use refcount_t instead of atomic_t for num_channels
+    - media: dvb-frontends: tda10048: Fix integer overflow
+    - i2c: i801: Annotate apanel_addr as __ro_after_init
+    - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
+    - orangefs: fix out-of-bounds fsid access
+    - kunit: Fix timeout message
+    - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
+    - selftests/net: fix uninitialized variables
+    - igc: fix a log entry using uninitialized netdev
+    - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
+    - serial: imx: Raise TX trigger level to 8
+    - jffs2: Fix potential illegal address access in jffs2_free_inode
+    - s390/pkey: Wipe sensitive data on failure
+    - btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation
+      warning
+    - cdrom: rearrange last_media_change check to avoid unintentional overflow
+    - tools/power turbostat: Remember global max_die_id
+    - vhost: Use virtqueue mutex for swapping worker
+    - vhost: Release worker mutex during flushes
+    - vhost_task: Handle SIGKILL by flushing work and exiting
+    - mac802154: fix time calculation in ieee802154_configure_durations()
+    - net: phy: phy_device: Fix PHY LED blinking code comment
+    - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
+    - net/mlx5: E-switch, Create ingress ACL when needed
+    - net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup()
+    - Bluetooth: hci_event: Fix setting of unicast qos interval
+    - Bluetooth: Ignore too large handle values in BIG
+    - Bluetooth: ISO: Check socket flag instead of hcon
+    - bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
+    - KVM: s390: fix LPSWEY handling
+    - e1000e: Fix S0ix residency on corporate systems
+    - gpiolib: of: fix lookup quirk for MIPS Lantiq
+    - net: allow skb_datagram_iter to be called from any context
+    - net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
+    - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from
+      __netif_rx()
+    - gpio: mmio: do not calculate bgpio_bits via "ngpios"
+    - wifi: wilc1000: fix ies_len type in connect path
+    - riscv: kexec: Avoid deadlock in kexec crash path
+    - netfilter: nf_tables: unconditionally flush pending work before notifier
+    - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
+    - selftests: fix OOM in msg_zerocopy selftest
+    - selftests: make order checking verbose in msg_zerocopy selftest
+    - inet_diag: Initialize pad field in struct inet_diag_req_v2
+    - mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI
+      file
+    - gpiolib: of: add polarity quirk for TSC2005
+    - cpu: Fix broken cmdline "nosmp" and "maxcpus=0"
+    - platform/x86: toshiba_acpi: Fix quickstart quirk handling
+    - Revert "igc: fix a log entry using uninitialized netdev"
+    - nilfs2: fix inode number range checks
+    - nilfs2: add missing check for inode numbers on directory entries
+    - mm: optimize the redundant loop of mm_update_owner_next()
+    - mm: avoid overflows in dirty throttling logic
+    - btrfs: fix adding block group to a reclaim list and the unused list during
+      reclaim
+    - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add()
+    - Bluetooth: hci_bcm4377: Fix msgid release
+    - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
+    - can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
+    - fsnotify: Do not generate events for O_PATH file descriptors
+    - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(),
+      again"
+    - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
+    - drm/amdgpu/atomfirmware: silence UBSAN warning
+    - drm: panel-orientation-quirks: Add quirk for Valve Galileo
+    - clk: qcom: gcc-ipq9574: Add BRANCH_HALT_VOTED flag
+    - clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common
+    - powerpc/pseries: Fix scv instruction crash with kexec
+    - powerpc/64s: Fix unnecessary copy to 0 when kernel is booted at address 0
+    - mtd: rawnand: Ensure ECC configuration is propagated to upper layers
+    - mtd: rawnand: Fix the nand_read_data_op() early check
+    - mtd: rawnand: Bypass a couple of sanity checks during NAND identification
+    - mtd: rawnand: rockchip: ensure NVDDR timings are rejected
+    - net: stmmac: dwmac-qcom-ethqos: fix error array size
+    - arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model B
+    - media: dw2102: fix a potential buffer overflow
+    - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents
+    - clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs
+    - clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
+    - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
+    - fs/ntfs3: Mark volume as dirty if xattr is broken
+    - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
+    - vhost-scsi: Handle vhost_vq_work_queue failures for events
+    - nvme-multipath: find NUMA path only for online numa-node
+    - dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails
+    - connector: Fix invalid conversion in cn_proc.h
+    - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
+    - regmap-i2c: Subtract reg size from max_write
+    - platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6"
+      tablet
+    - platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
+    - nvmet: fix a possible leak when destroy a ctrl during qp establishment
+    - kbuild: fix short log for AS in link-vmlinux.sh
+    - nfc/nci: Add the inconsistency check between the input data length and count
+    - spi: cadence: Ensure data lines set to low during dummy-cycle period
+    - ALSA: ump: Set default protocol when not given explicitly
+    - drm/amdgpu: silence UBSAN warning
+    - null_blk: Do not allow runt zone with zone capacity smaller then zone size
+    - nilfs2: fix incorrect inode allocation from reserved inodes
+    - leds: mlxreg: Use devm_mutex_init() for mutex initialization
+    - net: dql: Avoid calling BUG() when WARN() is enough
+    - drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf
+    - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
+    - drm/amdgpu: fix double free err_addr pointer warnings
+    - drm/amd/display: Fix overlapping copy within dml_core_mode_programming
+    - drm/amd/display: update pipe topology log to support subvp
+    - drm/amd/display: Do not return negative stream id for array
+    - drm/amd/display: ASSERT when failing to find index by plane/stream id
+    - usb: xhci: prevent potential failure in handle_tx_event() for Transfer
+      events without TRB
+    - media: i2c: st-mipid02: Use the correct div function
+    - media: tc358746: Use the correct div_ function
+    - crypto: hisilicon/sec2 - fix for register offset
+    - s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
+    - s390/pkey: Wipe copies of clear-key structures on failure
+    - s390/pkey: Wipe copies of protected- and secure-keys
+    - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
+    - wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
+    - net: txgbe: remove separate irq request for MSI and INTx
+    - net: txgbe: add extra handle for MSI/INTx into thread irq handle
+    - net: txgbe: free isb resources at the right time
+    - btrfs: always do the basic checks for btrfs_qgroup_inherit structure
+    - net: phy: aquantia: add missing include guards
+    - drm/fbdev-generic: Fix framebuffer on big endian devices
+    - net: stmmac: enable HW-accelerated VLAN stripping for gmac4 only
+    - net: rswitch: Avoid use-after-free in rswitch_poll()
+    - ice: use proper macro for testing bit
+    - drm/xe/mcr: Avoid clobbering DSS steering
+    - tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO.
+    - btrfs: zoned: fix calc_available_free_space() for zoned mode
+    - btrfs: fix folio refcount in __alloc_dummy_extent_buffer()
+    - Bluetooth: Add quirk to ignore reserved PHY bits in LE Extended Adv Report
+    - drm/xe: fix error handling in xe_migrate_update_pgtables
+    - drm/ttm: Always take the bo delayed cleanup path for imported bos
+    - fs: don't misleadingly warn during thaw operations
+    - drm/amdkfd: Let VRAM allocations go to GTT domain on small APUs
+    - drm/amdgpu: correct hbm field in boot status
+    - Upstream stable to v6.6.38, v6.6.39, v6.9.9
+
+  * Panels show garbage or flickering when i915.psr2 enabled (LP: #2069993)
+    - SAUCE: drm/i915/display/psr: add a psr2 disable quirk table
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x4d_0x10_0x93_0x15
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x30_0xe4_0x8b_0x07
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x30_0xe4_0x78_0x07
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x30_0xe4_0x8c_0x07
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x06_0xaf_0x9a_0xf9
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x4d_0x10_0x8f_0x15
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x06_0xaf_0xa3_0xc3
+
+  * Random flickering with Intel i915 (Gen9 GPUs in 6th-8th gen CPUs) on Linux
+    6.8 (LP: #2062951)
+    - SAUCE: iommu/intel: disable DMAR for SKL integrated gfx
+
+  * [SRU][22.04.5]: mpi3mr driver update (LP: #2073583)
+    - scsi: mpi3mr: HDB allocation and posting for hardware and firmware buffers
+    - scsi: mpi3mr: Trigger support
+    - scsi: mpi3mr: Add ioctl support for HDB
+    - scsi: mpi3mr: Support PCI Error Recovery callback handlers
+    - scsi: mpi3mr: Prevent PCI writes from driver during PCI error recovery
+    - scsi: mpi3mr: Driver version update
+
+  * Fix power consumption while using HW accelerated video decode on AMD
+    platforms (LP: #2073282)
+    - drm/amdgpu/vcn: identify unified queue in sw init
+    - drm/amdgpu/vcn: not pause dpg for unified queue
+
+  * Noble update: upstream stable patchset 2024-08-09 (LP: #2076435)
+    - usb: typec: ucsi: Never send a lone connector change ack
+    - usb: typec: ucsi: Ack also failed Get Error commands
+    - Input: ili210x - fix ili251x_read_touch_data() return value
+    - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
+    - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
+    - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
+    - pinctrl: rockchip: use dedicated pinctrl type for RK3328
+    - pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
+    - MIPS: pci: lantiq: restore reset gpio polarity
+    - ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right mclk
+    - ASoC: mediatek: mt8183-da7219-max98357: Fix kcontrol name collision
+    - ASoC: atmel: atmel-classd: Re-add dai_link->platform to fix card init
+    - workqueue: Increase worker desc's length to 32
+    - ASoC: q6apm-lpass-dai: close graph on prepare errors
+    - bpf: Add missed var_off setting in set_sext32_default_val()
+    - bpf: Add missed var_off setting in coerce_subreg_to_size_sx()
+    - s390/pci: Add missing virt_to_phys() for directed DIBV
+    - ASoC: amd: acp: add a null check for chip_pdev structure
+    - ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
+    - ASoC: fsl-asoc-card: set priv->pdev before using it
+    - net: dsa: microchip: fix initial port flush problem
+    - openvswitch: get related ct labels from its master if it is not confirmed
+    - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
+    - ibmvnic: Free any outstanding tx skbs during scrq reset
+    - net: phy: micrel: add Microchip KSZ 9477 to the device table
+    - net: dsa: microchip: use collision based back pressure mode
+    - ice: Rebuild TC queues on VSI queue reconfiguration
+    - xdp: Remove WARN() from __xdp_reg_mem_model()
+    - netfilter: fix undefined reference to 'netfilter_lwtunnel_*' when
+      CONFIG_SYSCTL=n
+    - btrfs: use NOFS context when getting inodes during logging and log replay
+    - Fix race for duplicate reqsk on identical SYN
+    - ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2 messages
+    - net: dsa: microchip: fix wrong register write when masking interrupt
+    - sparc: fix old compat_sys_select()
+    - sparc: fix compat recv/recvfrom syscalls
+    - parisc: use correct compat recv/recvfrom syscalls
+    - powerpc: restore some missing spu syscalls
+    - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
+    - ALSA: seq: Fix missing MSB in MIDI2 SPP conversion
+    - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data
+      registers
+    - net: mana: Fix possible double free in error handling path
+    - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
+    - vduse: validate block features only with block devices
+    - vduse: Temporarily fail if control queue feature requested
+    - x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
+    - mtd: partitions: redboot: Added conversion of operands to a larger type
+    - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
+    - bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
+    - RDMA/restrack: Fix potential invalid address access
+    - net/iucv: Avoid explicit cpumask var allocation on stack
+    - net/dpaa2: Avoid explicit cpumask var allocation on stack
+    - crypto: ecdh - explicitly zeroize private_key
+    - ALSA: emux: improve patch ioctl data validation
+    - media: dvbdev: Initialize sbuf
+    - irqchip/loongson: Select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP for
+      IRQ_LOONGARCH_CPU
+    - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
+    - gfs2: Fix NULL pointer dereference in gfs2_log_flush
+    - drm/radeon/radeon_display: Decrease the size of allocated memory
+    - nvme: fixup comment for nvme RDMA Provider Type
+    - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
+    - gpio: davinci: Validate the obtained number of IRQs
+    - RISC-V: fix vector insn load/store width mask
+    - drm/amdgpu: Fix pci state save during mode-1 reset
+    - riscv: stacktrace: convert arch_stack_walk() to noinstr
+    - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
+    - randomize_kstack: Remove non-functional per-arch entropy filtering
+    - x86: stop playing stack games in profile_pc()
+    - parisc: use generic sys_fanotify_mark implementation
+    - Revert "MIPS: pci: lantiq: restore reset gpio polarity"
+    - pinctrl: qcom: spmi-gpio: drop broken pm8008 support
+    - ocfs2: fix DIO failure due to insufficient transaction credits
+    - nfs: drop the incorrect assertion in nfs_swap_rw()
+    - mm: fix incorrect vbq reference in purge_fragmented_block
+    - mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos
+    - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
+    - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
+    - mmc: sdhci: Do not invert write-protect twice
+    - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
+    - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
+    - counter: ti-eqep: enable clock at probe
+    - kbuild: doc: Update default INSTALL_MOD_DIR from extra to updates
+    - kbuild: Fix build target deb-pkg: ln: failed to create hard link
+    - i2c: testunit: don't erase registers after STOP
+    - i2c: testunit: discard write requests while old command is running
+    - ata: libata-core: Fix null pointer dereference on error
+    - ata,scsi: libata-core: Do not leak memory for ata_port struct members
+    - iio: adc: ad7266: Fix variable checking bug
+    - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
+    - iio: chemical: bme680: Fix pressure value output
+    - iio: chemical: bme680: Fix calibration data variable
+    - iio: chemical: bme680: Fix overflows in compensate() functions
+    - iio: chemical: bme680: Fix sensor data read operation
+    - net: usb: ax88179_178a: improve link status logs
+    - usb: gadget: printer: SS+ support
+    - usb: gadget: printer: fix races against disable
+    - usb: musb: da8xx: fix a resource leak in probe()
+    - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
+    - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to
+      avoid deadlock
+    - usb: gadget: aspeed_udc: fix device address configuration
+    - usb: typec: ucsi: glink: fix child node release in probe function
+    - usb: ucsi: stm32: fix command completion handling
+    - usb: dwc3: core: Add DWC31 version 2.00a controller
+    - usb: dwc3: core: Workaround for CSR read timeout
+    - Revert "serial: core: only stop transmit when HW fifo is empty"
+    - serial: 8250_omap: Implementation of Errata i2310
+    - serial: imx: set receiver level before starting uart
+    - serial: core: introduce uart_port_tx_limited_flags()
+    - serial: bcm63xx-uart: fix tx after conversion to uart_port_tx_limited()
+    - tty: mcf: MCF54418 has 10 UARTS
+    - net: can: j1939: Initialize unused data in j1939_send_one()
+    - net: can: j1939: recover socket queue on CAN bus error during BAM
+      transmission
+    - net: can: j1939: enhanced error handling for tightly received RTS messages
+      in xtp_rx_rts_session_new
+    - PCI/MSI: Fix UAF in msi_capability_init
+    - cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
+    - irqchip/loongson-eiointc: Use early_cpu_to_node() instead of cpu_to_node()
+    - cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
+    - irqchip/loongson-liointc: Set different ISRs for different cores
+    - kbuild: Install dtb files as 0644 in Makefile.dtbinst
+    - sh: rework sync_file_range ABI
+    - btrfs: zoned: fix initial free space detection
+    - csky, hexagon: fix broken sys_sync_file_range
+    - hexagon: fix fadvise64_64 calling conventions
+    - drm/drm_file: Fix pid refcounting race
+    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
+    - drm/fbdev-dma: Only set smem_start is enable per module option
+    - drm/amdgpu: avoid using null object of framebuffer
+    - drm/i915/gt: Fix potential UAF by revoke of fence registers
+    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
+    - drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if LTTPR is
+      present
+    - drm/amdgpu/atomfirmware: fix parsing of vram_info
+    - batman-adv: Don't accept TT entries for out-of-spec VIDs
+    - can: mcp251xfd: fix infinite loop when xmit fails
+    - ata: ahci: Clean up sysfs file on error
+    - ata: libata-core: Fix double free on error
+    - ftruncate: pass a signed offset
+    - syscalls: fix compat_sys_io_pgetevents_time64 usage
+    - syscalls: fix sys_fanotify_mark prototype
+    - Revert "cpufreq: amd-pstate: Fix the inconsistency in max frequency units"
+    - mm/page_alloc: Separate THP PCP into movable and non-movable categories
+    - arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s
+    - arm64: dts: rockchip: Rename LED related pinctrl nodes on rk3308-rock-pi-s
+    - arm64: dts: rockchip: Fix the value of `dlg,jack-det-rate` mismatch on
+      rk3399-gru
+    - ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node
+    - arm64: dts: rockchip: make poweroff(8) work on Radxa ROCK 5A
+    - arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E
+    - arm64: dts: rockchip: Add sound-dai-cells for RK3368
+    - cxl/region: Move cxl_dpa_to_region() work to the region driver
+    - cxl/region: Avoid null pointer dereference in region lookup
+    - cxl/region: check interleave capability
+    - serial: imx: only set receiver level if it is zero
+    - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
+    - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
+    - pwm: stm32: Improve precision of calculation in .apply()
+    - pwm: stm32: Fix for settings using period > UINT32_MAX
+    - pwm: stm32: Calculate prescaler with a division instead of a loop
+    - pwm: stm32: Refuse too small period requests
+    - ASoC: cs42l43: Increase default type detect time and button delay
+    - ASoC: amd: acp: move chip->flag variable assignment
+    - bonding: fix incorrect software timestamping report
+    - mlxsw: pci: Fix driver initialization with Spectrum-4
+    - vxlan: Pull inner IP header in vxlan_xmit_one().
+    - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link
+    - af_unix: Stop recv(MSG_PEEK) at consumed OOB skb.
+    - af_unix: Don't stop recv(MSG_DONTWAIT) if consumed OOB skb is at the head.
+    - af_unix: Don't stop recv() at consumed ex-OOB skb.
+    - af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.
+    - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
+    - bpf: Take return from set_memory_rox() into account with
+      bpf_jit_binary_lock_ro()
+    - drm/xe: Fix potential integer overflow in page size calculation
+    - drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init
+    - drm/amd/display: correct hostvm flag
+    - drm/amd/display: Skip pipe if the pipe idx not set properly
+    - bpf: Add a check for struct bpf_fib_lookup size
+    - drm/xe/xe_devcoredump: Check NULL before assignments
+    - iommu/arm-smmu-v3: Do not allow a SVA domain to be set on the wrong PASID
+    - evm: Enforce signatures on unsupported filesystem for EVM_INIT_X509
+    - drm/xe: Check pat.ops before dumping PAT settings
+    - nvmet: do not return 'reserved' for empty TSAS values
+    - nvmet: make 'tsas' attribute idempotent for RDMA
+    - iommu/amd: Fix GT feature enablement again
+    - gpiolib: cdev: Ignore reconfiguration without direction
+    - kasan: fix bad call to unpoison_slab_object
+    - mm/memory: don't require head page for do_set_pmd()
+    - SUNRPC: Fix backchannel reply, again
+    - Revert "usb: gadget: u_ether: Re-attach netif device to mirror detachment"
+    - Revert "usb: gadget: u_ether: Replace netif_stop_queue with
+      netif_device_detach"
+    - tty: serial: 8250: Fix port count mismatch with the device
+    - tty: mxser: Remove __counted_by from mxser_board.ports[]
+    - nvmet-fc: Remove __counted_by from nvmet_fc_tgt_queue.fod[]
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for all Crucial BX SSD1 models
+    - bcachefs: Fix sb_field_downgrade validation
+    - bcachefs: Fix sb-downgrade validation
+    - bcachefs: Fix bch2_sb_downgrade_update()
+    - bcachefs: Fix setting of downgrade recovery passes/errors
+    - bcachefs: btree_gc can now handle unknown btrees
+    - pwm: stm32: Fix calculation of prescaler
+    - pwm: stm32: Fix error message to not describe the previous error path
+    - cxl/region: Convert cxl_pmem_region_alloc to scope-based resource management
+    - cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
+    - arm64: dts: rockchip: Fix the i2c address of es8316 on Cool Pi 4B
+    - netfs: Fix netfs_page_mkwrite() to check folio->mapping is valid
+    - netfs: Fix netfs_page_mkwrite() to flush conflicting data, not wait
+    - Upstream stable to v6.6.37, v6.9.8
+
+  * [UBUNTU 22.04] s390/cpum_cf: make crypto counters upward compatible
+    (LP: #2074380)
+    - s390/cpum_cf: make crypto counters upward compatible across machine types
+
+  * CVE-2024-45016
+    - netem: fix return value if duplicate enqueue fails
+
+ -- Stefan Bader <stefan.bader@canonical.com>  Fri, 27 Sep 2024 14:22:35 +0200
+
+linux (6.8.0-45.45) noble; urgency=medium
+
+  * noble/linux: 6.8.0-45.45 -proposed tracker (LP: #2078100)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/s2024.08.05)
+
+  * Noble update: upstream stable patchset 2024-08-09 (LP: #2076435) //
+    CVE-2024-41009
+    - bpf: Fix overrunning reservations in ringbuf
+
+  * CVE-2024-42160
+    - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
+    - f2fs: Add inline to f2fs_build_fault_attr() stub
+
+  * Noble update: upstream stable patchset 2024-08-22 (LP: #2077600) //
+    CVE-2024-42224
+    - net: dsa: mv88e6xxx: Correct check for empty list
+
+  * Noble update: upstream stable patchset 2024-08-22 (LP: #2077600) //
+    CVE-2024-42154
+    - tcp_metrics: validate source addr length
+
+  * CVE-2024-42228
+    - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
+
+  * CVE-2024-42159
+    - scsi: mpi3mr: Sanitise num_phys
+
+ -- Manuel Diewald <manuel.diewald@canonical.com>  Fri, 30 Aug 2024 10:32:37 +0200
+
+linux (6.8.0-44.44) noble; urgency=medium
+
+  * noble/linux: 6.8.0-44.44 -proposed tracker (LP: #2076647)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.08.05)
+
+  * Disable PCI_DYNAMIC_OF_NODES in Ubuntu (LP: #2074376)
+    - [Config] Disable PCI_DYNAMIC_OF_NODES
+
+  * [SRU] Turbostat support for Arrow Lake H (LP: #2074372)
+    - tools/power turbostat: Enhance ARL/LNL support
+    - x86/cpu: Add model number for another Intel Arrow Lake mobile processor
+    - tools/power turbostat: Add ARL-H support
+
+  * Noble update: upstream stable patchset 2024-07-30 (LP: #2075154)
+    - fs/writeback: bail out if there is no more inodes for IO and queued once
+    - padata: Disable BH when taking works lock on MT path
+    - crypto: hisilicon/sec - Fix memory leak for sec resource release
+    - crypto: hisilicon/qm - Add the err memory release process to qm uninit
+    - io_uring/sqpoll: work around a potential audit memory leak
+    - rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
+    - rcutorture: Make stall-tasks directly exit when rcutorture tests end
+    - rcutorture: Fix invalid context warning when enable srcu barrier testing
+    - block/ioctl: prefer different overflow check
+    - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
+    - selftests/bpf: Prevent client connect before server bind in
+      test_tc_tunnel.sh
+    - selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
+    - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
+    - wifi: ath9k: work around memset overflow warning
+    - af_packet: avoid a false positive warning in packet_setsockopt()
+    - ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
+    - drop_monitor: replace spin_lock by raw_spin_lock
+    - scsi: qedi: Fix crash while reading debugfs attribute
+    - net: sfp: add quirk for ATS SFP-GE-T 1000Base-TX module
+    - net/sched: fix false lockdep warning on qdisc root lock
+    - kselftest: arm64: Add a null pointer check
+    - net: dsa: realtek: keep default LED state in rtl8366rb
+    - netpoll: Fix race condition in netpoll_owner_active
+    - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
+    - HID: Add quirk for Logitech Casa touchpad
+    - HID: asus: fix more n-key report descriptors if n-key quirked
+    - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
+    - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
+    - drm/amd/display: Exit idle optimizations before HDCP execution
+    - platform/x86: toshiba_acpi: Add quirk for buttons on Z830
+    - ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
+    - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F
+    - drm/lima: add mask irq callback to gp and pp
+    - drm/lima: mask irqs in timeout path before hard reset
+    - ALSA: hda/realtek: Add quirks for Lenovo 13X
+    - powerpc/pseries: Enforce hcall result buffer validity and size
+    - media: intel/ipu6: Fix build with !ACPI
+    - media: mtk-vcodec: potential null pointer deference in SCP
+    - powerpc/io: Avoid clang null pointer arithmetic warnings
+    - platform/x86: p2sb: Don't init until unassigned resources have been assigned
+    - power: supply: cros_usbpd: provide ID table for avoiding fallback match
+    - iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
+    - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
+    - kprobe/ftrace: bail out if ftrace was killed
+    - usb: gadget: uvc: configfs: ensure guid to be valid before set
+    - f2fs: remove clear SB_INLINECRYPT flag in default_options
+    - usb: misc: uss720: check for incompatible versions of the Belkin F5U002
+    - Avoid hw_desc array overrun in dw-axi-dmac
+    - usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on Lenovo Yoga
+      Tab2 1380
+    - usb: typec: ucsi_glink: drop special handling for CCI_BUSY
+    - udf: udftime: prevent overflow in udf_disk_stamp_to_time()
+    - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
+    - f2fs: don't set RO when shutting down f2fs
+    - MIPS: Octeon: Add PCIe link status check
+    - serial: imx: Introduce timeout when waiting on transmitter empty
+    - serial: exar: adding missing CTI and Exar PCI ids
+    - usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
+    - tty: add the option to have a tty reject a new ldisc
+    - vfio/pci: Collect hot-reset devices to local buffer
+    - cpufreq: amd-pstate: fix memory leak on CPU EPP exit
+    - ACPI: EC: Install address space handler at the namespace root
+    - PCI: Do not wait for disconnected devices when resuming
+    - ALSA: hda: cs35l41: Possible null pointer dereference in
+      cs35l41_hda_unbind()
+    - ALSA: seq: ump: Fix missing System Reset message handling
+    - MIPS: Routerboard 532: Fix vendor retry check code
+    - mips: bmips: BCM6358: make sure CBR is correctly set
+    - tracing: Build event generation tests only as modules
+    - ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
+    - ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
+    - ice: avoid IRQ collision to fix init failure on ACPI S3 resume
+    - btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
+    - net: mvpp2: use slab_build_skb for oversized frames
+    - cipso: fix total option length computation
+    - ALSA: hda: cs35l56: Component should be unbound before deconstruction
+    - ALSA: hda: tas2781: Component should be unbound before deconstruction
+    - bpf: Avoid splat in pskb_pull_reason
+    - ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
+    - netrom: Fix a memory leak in nr_heartbeat_expiry()
+    - ipv6: prevent possible NULL deref in fib6_nh_init()
+    - ipv6: prevent possible NULL dereference in rt6_probe()
+    - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
+    - netns: Make get_net_ns() handle zero refcount net
+    - qca_spi: Make interrupt remembering atomic
+    - net: lan743x: disable WOL upon resume to restore full data path operation
+    - net: lan743x: Support WOL at both the PHY and MAC appropriately
+    - net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
+    - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
+    - tipc: force a dst refcount before doing decryption
+    - sched: act_ct: add netns into the key of tcf_ct_flow_table
+    - ptp: fix integer overflow in max_vclocks_store
+    - selftests: openvswitch: Use bash as interpreter
+    - net: stmmac: No need to calculate speed divider when offload is disabled
+    - virtio_net: checksum offloading handling fix
+    - virtio_net: fixing XDP for fully checksummed packets handling
+    - octeontx2-pf: Add error handling to VLAN unoffload handling
+    - octeontx2-pf: Fix linking objects into multiple modules
+    - netfilter: ipset: Fix suspicious rcu_dereference_protected()
+    - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6
+      behaviors
+    - netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core
+    - ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
+    - bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
+    - net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
+    - RDMA/bnxt_re: Fix the max msix vectors macro
+    - spi: cs42l43: Correct SPI root clock speed
+    - RDMA/rxe: Fix responder length checking for UD request packets
+    - regulator: core: Fix modpost error "regulator_get_regmap" undefined
+    - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
+    - dmaengine: ioatdma: Fix leaking on version mismatch
+    - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
+    - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
+    - dmaengine: fsl-edma: avoid linking both modules
+    - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
+    - regulator: bd71815: fix ramp values
+    - thermal/drivers/mediatek/lvts_thermal: Return error in case of invalid efuse
+      data
+    - arm64: dts: imx8mp: Fix TC9595 input clock on DH i.MX8M Plus DHCOM SoM
+    - arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix BT shutdown GPIO
+    - arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property
+    - arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
+    - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is
+      fine."
+    - spi: spi-imx: imx51: revert burst length calculation back to bits_per_word
+    - io_uring/rsrc: fix incorrect assignment of iter->nr_segs in io_import_fixed
+    - firmware: psci: Fix return value from psci_system_suspend()
+    - RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init
+    - RDMA/mlx5: Add check for srq max_sge attribute
+    - RDMA/mana_ib: Ignore optional access flags for MRs
+    - ACPI: EC: Evaluate orphan _REG under EC device
+    - arm64: defconfig: enable the vf610 gpio driver
+    - ext4: avoid overflow when setting values via sysfs
+    - ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
+    - net: stmmac: Assign configured channel value to EXTTS event
+    - net: usb: ax88179_178a: improve reset check
+    - net: do not leave a dangling sk pointer, when socket creation fails
+    - btrfs: retry block group reclaim without infinite loop
+    - scsi: ufs: core: Free memory allocated for model before reinit
+    - cifs: fix typo in module parameter enable_gcm_256
+    - LoongArch: Fix watchpoint setting error
+    - LoongArch: Trigger user-space watchpoints correctly
+    - LoongArch: Fix multiple hardware watchpoint issues
+    - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
+    - KVM: arm64: Disassociate vcpus from redistributor region on teardown
+    - KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
+    - RDMA/rxe: Fix data copy for IB_SEND_INLINE
+    - RDMA/mlx5: Remove extra unlock on error path
+    - RDMA/mlx5: Follow rb_key.ats when creating new mkeys
+    - ovl: fix encoding fid for lower only root
+    - ALSA: hda/realtek: Limit mic boost on N14AP7
+    - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9
+    - drm/i915/mso: using joiner is not possible with eDP MSO
+    - drm/radeon: fix UBSAN warning in kv_dpm.c
+    - drm/amdgpu: fix UBSAN warning in kv_dpm.c
+    - dt-bindings: dma: fsl-edma: fix dma-channels constraints
+    - ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()
+    - ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
+    - gcov: add support for GCC 14
+    - kcov: don't lose track of remote references during softirqs
+    - efi/x86: Free EFI memory map only when installing a new one.
+    - serial: 8250_dw: Revert "Move definitions to the shared header"
+    - mm: mmap: allow for the maximum number of bits for randomizing mmap_base by
+      default
+    - tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
+    - mm/page_table_check: fix crash on ZONE_DEVICE
+    - i2c: ocores: set IACK bit after core is enabled
+    - dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema
+    - dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller
+      schema
+    - spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup()
+    - arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
+    - spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4
+    - perf: script: add raw|disasm arguments to --insn-trace option
+    - nbd: Improve the documentation of the locking assumptions
+    - nbd: Fix signal handling
+    - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
+    - x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
+    - x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
+    - drm/amd/display: revert Exit idle optimizations before HDCP execution
+    - ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk
+    - net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path
+    - kprobe/ftrace: fix build error due to bad function definition
+    - hid: asus: asus_report_fixup: fix potential read out of bounds
+    - Revert "mm: mmap: allow for the maximum number of bits for randomizing
+      mmap_base by default"
+    - platform/chrome: cros_usbpd_logger: provide ID table for avoiding fallback
+      match
+    - platform/chrome: cros_usbpd_notify: provide ID table for avoiding fallback
+      match
+    - ubsan: Avoid i386 UBSAN handler crashes with Clang
+    - arm64: defconfig: select INTERCONNECT_QCOM_SM6115 as built-in
+    - bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.
+    - devlink: use kvzalloc() to allocate devlink instance resources
+    - wifi: rtw89: 8852c: add quirk to set PCI BER for certain platforms
+    - clocksource: Make watchdog and suspend-timing multiplication overflow safe
+    - ACPI: resource: Do IRQ override on GMxBGxx (XMG APEX 17 M23)
+    - wifi: ath12k: add string type to search board data in board-2.bin for
+      WCN7850
+    - wifi: ath12k: add firmware-2.bin support
+    - wifi: ath12k: fix kernel crash during resume
+    - arm64/sysreg: Update PIE permission encodings
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MV
+    - wifi: ath12k: fix the problem that down grade phy mode operation
+    - bpf: avoid uninitialized warnings in verifier_global_subprogs.c
+    - selftests: net: fix timestamp not arriving in cmsg_time.sh
+    - net: ena: Add validation for completion descriptors consistency
+    - drm/amd/display: Workaround register access in idle race with cursor
+    - cgroup/cpuset: Make cpuset hotplug processing synchronous
+    - platform/x86: x86-android-tablets: Unregister devices in reverse order
+    - platform/x86: x86-android-tablets: Add Lenovo Yoga Tablet 2 Pro 1380F/L data
+    - ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41
+    - ext4: fold quota accounting into ext4_xattr_inode_lookup_create()
+    - ext4: do not create EA inode under buffer lock
+    - f2fs: fix to detect inconsistent nat entry during truncation
+    - usb: typec: ucsi_glink: rework quirks implementation
+    - xhci: remove XHCI_TRUST_TX_LENGTH quirk
+    - clk: Add a devm variant of clk_rate_exclusive_get()
+    - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
+    - i2c: lpi2c: Avoid calling clk_get_rate during transfer
+    - cxl: Add post-reset warning if reset results in loss of previously committed
+      HDM decoders
+    - OPP: Fix required_opp_tables for multiple genpds using same table
+    - wifi: iwlwifi: mvm: fix ROC version check
+    - wifi: mac80211: Recalc offload when monitor stop
+    - ice: fix 200G link speed message log
+    - ice: implement AQ download pkg retry
+    - bpf: Fix reg_set_min_max corruption of fake_reg
+    - ALSA: hda: cs35l41: Component should be unbound before deconstruction
+    - netdev-genl: fix error codes when outputting XDP features
+    - arm64: dts: freescale: imx8mm-verdin: Fix GPU speed
+    - phy: qcom-qmp: qserdes-txrx: Add missing registers offsets
+    - phy: qcom-qmp: pcs: Add missing v6 N4 register offsets
+    - phy: qcom: qmp-combo: Switch from V6 to V6 N4 register offsets
+    - powerpc/crypto: Add generated P8 asm to .gitignore
+    - spi: Exctract spi_dev_check_cs() helper
+    - spi: Fix SPI slave probe failure
+    - net: phy: dp83tg720: wake up PHYs in managed mode
+    - net: phy: dp83tg720: get master/slave configuration in link down state
+    - RDMA/mlx5: Ensure created mkeys always have a populated rb_key
+    - drm/amdgpu: fix locking scope when flushing tlb
+    - drm/amd/display: Remove redundant idle optimization check
+    - drm/amd/display: Attempt to avoid empty TUs when endpoint is DPIA
+    - ata: ahci: Do not enable LPM if no LPM states are supported by the HBA
+    - dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()
+    - net/tcp_ao: Don't leak ao_info on error-path
+    - mm: shmem: fix getting incorrect lruvec when replacing a shmem folio
+    - selftests: mptcp: print_test out of verify_listener_events
+    - selftests: mptcp: userspace_pm: fixed subtest names
+    - ima: Avoid blocking in RCU read-side critical section
+    - virt: guest_memfd: fix reference leak on hwpoisoned page
+    - thermal: int340x: processor_thermal: Support shared interrupts
+    - thermal: core: Change PM notifier priority to the minimum
+    - wifi: ath12k: check M3 buffer size as well whey trying to reuse it
+    - Upstream stable to v6.6.36, v6.9.7
+
+  * [SRU] Add Dynamic Tuning Technology (DTT)  support for Lunar Lake
+    (LP: #2073961)
+    - thermal: int340x: processor_thermal: Add Lunar Lake-M PCI ID
+
+  * Kubuntu 24.04 freezes after plugging in ethernet cable (LP: #2073358)
+    - e1000e: move force SMBUS near the end of enable_ulp function
+    - e1000e: fix force smbus during suspend flow
+
+  * Noble update: upstream stable patchset 2024-07-25 (LP: #2074091)
+    - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
+    - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
+    - wifi: cfg80211: fully move wiphy work to unbound workqueue
+    - wifi: cfg80211: Lock wiphy in cfg80211_get_station
+    - wifi: cfg80211: pmsr: use correct nla_get_uX functions
+    - wifi: iwlwifi: mvm: don't initialize csa_work twice
+    - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
+    - wifi: iwlwifi: mvm: set properly mac header
+    - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
+    - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
+    - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
+    - wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
+    - scsi: ufs: mcq: Fix error output and clean up ufshcd_mcq_abort()
+    - RISC-V: KVM: No need to use mask when hart-index-bit is 0
+    - RISC-V: KVM: Fix incorrect reg_subtype labels in
+      kvm_riscv_vcpu_set_reg_isa_ext function
+    - ax25: Fix refcount imbalance on inbound connections
+    - ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()
+    - net/ncsi: Fix the multi thread manner of NCSI driver
+    - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume
+    - bpf: Fix a potential use-after-free in bpf_link_free()
+    - KVM: SEV-ES: Disallow SEV-ES guests when X86_FEATURE_LBRV is absent
+    - KVM: SEV-ES: Delegate LBR virtualization to the processor
+    - vmxnet3: disable rx data ring on dma allocation failure
+    - ipv6: ioam: block BH from ioam6_output()
+    - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
+    - net: tls: fix marking packets as decrypted
+    - bpf: Set run context for rawtp test_run callback
+    - octeontx2-af: Always allocate PF entries from low prioriy zone
+    - net/smc: avoid overwriting when adjusting sock bufsizes
+    - net: phy: Micrel KSZ8061: fix errata solution not taking effect problem
+    - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
+    - vxlan: Fix regression when dropping packets due to invalid src addresses
+    - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
+    - mptcp: count CLOSE-WAIT sockets for MPTCP_MIB_CURRESTAB
+    - net/mlx5: Stop waiting for PCI if pci channel is offline
+    - net/mlx5: Always stop health timer during driver removal
+    - net/mlx5: Fix tainted pointer delete is case of flow rules creation fail
+    - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
+    - ptp: Fix error message on failed pin verification
+    - ice: fix iteration of TLVs in Preserved Fields Area
+    - ice: remove af_xdp_zc_qps bitmap
+    - ice: add flag to distinguish reset from .ndo_bpf in XDP rings config
+    - net: wwan: iosm: Fix tainted pointer delete is case of region creation fail
+    - af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted
+      peer.
+    - af_unix: Annodate data-races around sk->sk_state for writers.
+    - af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
+    - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and
+      poll().
+    - af_unix: Annotate data-race of sk->sk_state in unix_stream_connect().
+    - af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
+    - af_unix: Annotate data-race of sk->sk_state in unix_stream_read_skb().
+    - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
+    - af_unix: Annotate data-races around sk->sk_sndbuf.
+    - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
+    - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
+    - af_unix: Use skb_queue_empty_lockless() in unix_release_sock().
+    - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
+    - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
+    - ipv6: fix possible race in __fib6_drop_pcpu_from()
+    - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
+    - selftests/mm: log a consistent test name for check_compaction
+    - irqchip/riscv-intc: Allow large non-standard interrupt number
+    - irqchip/riscv-intc: Introduce Andes hart-level interrupt controller
+    - eventfs: Update all the eventfs_inodes from the events descriptor
+    - io_uring/rsrc: don't lock while !TASK_RUNNING
+    - io_uring: check for non-NULL file pointer in io_file_can_poll()
+    - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
+    - USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected
+    - usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps
+    - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
+    - mei: me: release irq in mei_me_pci_resume error path
+    - tty: n_tty: Fix buffer offsets when lookahead is used
+    - serial: port: Don't block system suspend even if bytes are left to xmit
+    - landlock: Fix d_parent walk
+    - jfs: xattr: fix buffer overflow for invalid xattr
+    - xhci: Set correct transferred length for cancelled bulk transfers
+    - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
+    - xhci: Handle TD clearing for multiple streams case
+    - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
+    - thunderbolt: debugfs: Fix margin debugfs node creation condition
+    - scsi: core: Disable CDL by default
+    - scsi: mpi3mr: Fix ATA NCQ priority support
+    - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
+    - scsi: sd: Use READ(16) when reading block zero on large capacity disks
+    - gve: Clear napi->skb before dev_kfree_skb_any()
+    - powerpc/uaccess: Fix build errors seen with GCC 13/14
+    - HID: nvidia-shield: Add missing check for input_ff_create_memless
+    - cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c
+    - cxl/region: Fix memregion leaks in devm_cxl_add_region()
+    - cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd
+    - cachefiles: remove requests from xarray during flushing requests
+    - cachefiles: add spin_lock for cachefiles_ondemand_info
+    - cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()
+    - cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
+    - cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read()
+    - cachefiles: never get a new anonymous fd if ondemand_id is valid
+    - cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
+    - cachefiles: flush all requests after setting CACHEFILES_DEAD
+    - selftests/ftrace: Fix to check required event file
+    - clk: sifive: Do not register clkdevs for PRCI clocks
+    - NFSv4.1 enforce rootpath check in fs_location query
+    - SUNRPC: return proper error from gss_wrap_req_priv
+    - NFS: add barriers when testing for NFS_FSDATA_BLOCKED
+    - selftests/tracing: Fix event filter test to retry up to 10 times
+    - nvme: fix nvme_pr_* status code parsing
+    - drm/panel: sitronix-st7789v: Add check for of_drm_get_panel_orientation
+    - platform/x86: dell-smbios: Fix wrong token data in sysfs
+    - gpio: tqmx86: fix typo in Kconfig label
+    - gpio: tqmx86: introduce shadow register for GPIO output value
+    - gpio: tqmx86: store IRQ trigger type and unmask status separately
+    - gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type
+    - HID: core: remove unnecessary WARN_ON() in implement()
+    - iommu/amd: Fix sysfs leak in iommu init
+    - iommu: Return right value in iommu_sva_bind_device()
+    - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
+    - io_uring/io-wq: avoid garbage value of 'match' in io_wq_enqueue()
+    - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
+    - drm/vmwgfx: Refactor drm connector probing for display modes
+    - drm/vmwgfx: Filter modes which exceed graphics memory
+    - drm/vmwgfx: 3D disabled should not effect STDU memory limits
+    - drm/vmwgfx: Remove STDU logic from generic mode_valid function
+    - drm/vmwgfx: Don't memcmp equivalent pointers
+    - af_unix: Annotate data-race of sk->sk_state in unix_accept().
+    - modpost: do not warn about missing MODULE_DESCRIPTION() for vmlinux.o
+    - net: sfp: Always call `sfp_sm_mod_remove()` on remove
+    - net: hns3: fix kernel crash problem in concurrent scenario
+    - net: hns3: add cond_resched() to hns3 ring buffer init process
+    - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
+    - net: stmmac: dwmac-qcom-ethqos: Configure host DMA width
+    - drm/komeda: check for error-valued pointer
+    - drm/bridge/panel: Fix runtime warning on panel bridge release
+    - tcp: fix race in tcp_v6_syn_recv_sock()
+    - net dsa: qca8k: fix usages of device_get_named_child_node()
+    - geneve: Fix incorrect inner network header offset when innerprotoinherit is
+      set
+    - net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN)
+      packets
+    - Bluetooth: fix connection setup in l2cap_connect
+    - netfilter: nft_inner: validate mandatory meta and payload
+    - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set
+      type
+    - x86/asm: Use %c/%n instead of %P operand modifier in asm templates
+    - x86/uaccess: Fix missed zeroing of ia32 u64 get_user() range checking
+    - scsi: ufs: core: Quiesce request queues before checking pending cmds
+    - net: pse-pd: Use EOPNOTSUPP error code instead of ENOTSUPP
+    - gve: ignore nonrelevant GSO type bits when processing TSO headers
+    - net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs
+      parameters
+    - block: sed-opal: avoid possible wrong address reference in
+      read_sed_opal_key()
+    - block: fix request.queuelist usage in flush
+    - nvmet-passthru: propagate status from id override functions
+    - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
+    - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
+    - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
+    - ionic: fix use after netif_napi_del()
+    - af_unix: Read with MSG_PEEK loops if the first unread byte is OOB
+    - bnxt_en: Adjust logging of firmware messages in case of released token in
+      __hwrm_send()
+    - misc: microchip: pci1xxxx: fix double free in the error handling of
+      gp_aux_bus_probe()
+    - ksmbd: move leading slash check to smb2_get_name()
+    - ksmbd: fix missing use of get_write in in smb2_set_ea()
+    - x86/boot: Don't add the EFI stub to targets, again
+    - iio: adc: ad9467: fix scan type sign
+    - iio: dac: ad5592r: fix temperature channel scaling value
+    - iio: invensense: fix odr switching to same value
+    - iio: imu: inv_icm42600: delete unneeded update watermark call
+    - drivers: core: synchronize really_probe() and dev_uevent()
+    - parisc: Try to fix random segmentation faults in package builds
+    - ACPI: x86: Force StorageD3Enable on more products
+    - drm/exynos/vidi: fix memory leak in .get_modes()
+    - drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
+    - mptcp: ensure snd_una is properly initialized on connect
+    - mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
+    - mptcp: pm: update add_addr counters after connect
+    - clkdev: Update clkdev id usage to allow for longer names
+    - irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
+    - x86/kexec: Fix bug with call depth tracking
+    - x86/amd_nb: Check for invalid SMN reads
+    - perf/core: Fix missing wakeup when waiting for context reference
+    - perf auxtrace: Fix multiple use of --itrace option
+    - riscv: fix overlap of allocated page and PTR_ERR
+    - tracing/selftests: Fix kprobe event name test for .isra. functions
+    - kheaders: explicitly define file modes for archived headers
+    - null_blk: Print correct max open zones limit in null_init_zoned_dev()
+    - sock_map: avoid race between sock_map_close and sk_psock_put
+    - dma-buf: handle testing kthreads creation failure
+    - vmci: prevent speculation leaks by sanitizing event in event_deliver()
+    - spmi: hisi-spmi-controller: Do not override device identifier
+    - knfsd: LOOKUP can return an illegal error value
+    - fs/proc: fix softlockup in __read_vmcore
+    - ocfs2: use coarse time for new created files
+    - ocfs2: fix races between hole punching and AIO+DIO
+    - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
+    - dmaengine: axi-dmac: fix possible race in remove()
+    - remoteproc: k3-r5: Wait for core0 power-up before powering up core1
+    - remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs
+    - iio: adc: axi-adc: make sure AXI clock is enabled
+    - iio: invensense: fix interrupt timestamp alignment
+    - riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
+    - rtla/timerlat: Simplify "no value" printing on top
+    - rtla/auto-analysis: Replace \t with spaces
+    - drm/i915/gt: Disarm breadcrumbs if engines are already idle
+    - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
+    - drm/i915/dpt: Make DPT object unshrinkable
+    - drm/i915: Fix audio component initialization
+    - intel_th: pci: Add Meteor Lake-S support
+    - pmdomain: ti-sci: Fix duplicate PD referrals
+    - btrfs: zoned: fix use-after-free due to race with dev replace
+    - xfs: fix imprecise logic in xchk_btree_check_block_owner
+    - xfs: fix scrub stats file permissions
+    - xfs: fix SEEK_HOLE/DATA for regions with active COW extents
+    - xfs: shrink failure needs to hold AGI buffer
+    - xfs: ensure submit buffers on LSN boundaries in error handlers
+    - xfs: allow sunit mount option to repair bad primary sb stripe values
+    - xfs: don't use current->journal_info
+    - xfs: allow cross-linking special files without project quota
+    - swiotlb: Enforce page alignment in swiotlb_alloc()
+    - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE
+    - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary
+    - tick/nohz_full: Don't abuse smp_call_function_single() in
+      tick_setup_device()
+    - mm/huge_memory: don't unpoison huge_zero_folio
+    - serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
+    - Revert "fork: defer linking file vma until vma is fully initialized"
+    - remoteproc: k3-r5: Jump to error handling labels in start/stop errors
+    - greybus: Fix use-after-free bug in gb_interface_release due to race
+      condition.
+    - ima: Fix use-after-free on a dentry's dname.name
+    - serial: core: Add UPIO_UNKNOWN constant for unknown port type
+    - serial: port: Introduce a common helper to read properties
+    - serial: 8250_dw: Switch to use uart_read_port_properties()
+    - serial: 8250_dw: Replace ACPI device check by a quirk
+    - serial: 8250_dw: Don't use struct dw8250_data outside of 8250_dw
+    - usb-storage: alauda: Check whether the media is initialized
+    - misc: microchip: pci1xxxx: Fix a memory leak in the error handling of
+      gp_aux_bus_probe()
+    - i2c: at91: Fix the functionality flags of the slave-only interface
+    - i2c: designware: Fix the functionality flags of the slave-only interface
+    - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
+    - wifi: ath11k: fix WCN6750 firmware crash caused by 17 num_vdevs
+    - cpufreq: amd-pstate: Unify computation of
+      {max,min,nominal,lowest_nonlinear}_freq
+    - cpufreq: amd-pstate: Add quirk for the pstate CPPC capabilities missing
+    - cpufreq: amd-pstate: remove global header file
+    - virtio_net: fix possible dim status unrecoverable
+    - net: ethernet: mtk_eth_soc: handle dma buffer size soc specific
+    - ice: fix reads from NVM Shadow RAM on E830 and E825-C devices
+    - ice: map XDP queues to vectors in ice_vsi_map_rings_to_vectors()
+    - x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes()
+    - x86/cpu: Provide default cache line size if not enumerated
+    - selftests/mm: ksft_exit functions do not return
+    - selftests/mm: compaction_test: fix bogus test success and reduce probability
+      of OOM-killer invocation
+    - .editorconfig: remove trim_trailing_whitespace option
+    - kcov, usb: disable interrupts in kcov_remote_start_usb_softirq
+    - ata: libata-scsi: Set the RMB bit only for removable media devices
+    - powerpc/85xx: fix compile error without CONFIG_CRASH_DUMP
+    - kselftest/alsa: Ensure _GNU_SOURCE is defined
+    - thermal: core: Do not fail cdev registration because of invalid initial
+      state
+    - Bluetooth: hci_sync: Fix not using correct handle
+    - net/sched: initialize noop_qdisc owner
+    - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
+    - drm/nouveau: don't attempt to schedule hpd_work on headless cards
+    - drm/xe/xe_gt_idle: use GT forcewake domain assertion
+    - drm/xe: flush engine buffers before signalling user fence on all engines
+    - drm/xe: Remove mem_access from guc_pc calls
+    - drm/xe: move disable_c6 call
+    - bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response
+    - iio: imu: bmi323: Fix trigger notification in case of error
+    - iio: pressure: bmp280: Fix BMP580 temperature reading
+    - iio: temperature: mlx90635: Fix ERR_PTR dereference in mlx90635_probe()
+    - thermal: ACPI: Invalidate trip points with temperature of 0 or below
+    - x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
+    - memblock: make memblock_set_node() also warn about use of MAX_NUMNODES
+    - perf script: Show also errors for --insn-trace option
+    - wifi: cfg80211: validate HE operation element parsing
+    - wifi: rtlwifi: Ignore IEEE80211_CONF_CHANGE_RETRY_LIMITS
+    - locking/atomic: scripts: fix ${atomic}_sub_and_test() kerneldoc
+    - ata: ahci: Do not apply Intel PCS quirk on Intel Alder Lake
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for Apacer AS340
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for Crucial CT240BX500SSD1
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for AMD Radeon S3 SSD
+    - kexec: fix the unexpected kexec_dprintk() macro
+    - ocfs2: update inode fsync transaction id in ocfs2_unlink and ocfs2_link
+    - dm-integrity: set discard_granularity to logical block size
+    - drm/bridge: aux-hpd-bridge: correct devm_drm_dp_hpd_bridge_add() stub
+    - iio: temperature: mcp9600: Fix temperature reading for negative values
+    - drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2
+    - riscv: force PAGE_SIZE linear mapping if debug_pagealloc is enabled
+    - drm/xe: Properly handle alloc_guc_id() failure
+    - wifi: iwlwifi: mvm: support iwl_dev_tx_power_cmd_v8
+    - wifi: iwlwifi: mvm: fix a crash on 7265
+    - mei: vsc: Fix wrong invocation of ACPI SID method
+    - Upstream stable to v6.6.35, v6.9.6
+
+  * [SRU] Add support for intel trace hub for last platforms (LP: #2073926) //
+    Noble update: upstream stable patchset 2024-07-25 (LP: #2074091)
+    - intel_th: pci: Add Granite Rapids support
+    - intel_th: pci: Add Granite Rapids SOC support
+    - intel_th: pci: Add Sapphire Rapids SOC support
+    - intel_th: pci: Add Lunar Lake support
+
+  * Fix L2CAP/LE/CPU/BV-02-C bluetooth certification failure (LP: #2072858) //
+    Noble update: upstream stable patchset 2024-07-25 (LP: #2074091)
+    - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
+
+  * Noble update: upstream stable patchset 2024-07-22 (LP: #2073788)
+    - drm/i915/hwmon: Get rid of devm
+    - afs: Don't cross .backup mountpoint from backup volume
+    - erofs: avoid allocating DEFLATE streams before mounting
+    - vxlan: Fix regression when dropping packets due to invalid src addresses
+    - drm/sun4i: hdmi: Convert encoder to atomic
+    - drm/sun4i: hdmi: Move mode_set into enable
+    - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
+    - media: lgdt3306a: Add a check against null-pointer-def
+    - drm/amdgpu: add error handle to avoid out-of-bounds
+    - wifi: rtw89: correct aSIFSTime for 6GHz band
+    - ata: pata_legacy: make legacy_exit() work again
+    - fsverity: use register_sysctl_init() to avoid kmemleak warning
+    - proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission
+      operation
+    - platform/chrome: cros_ec: Handle events during suspend after resume
+      completion
+    - thermal/drivers/qcom/lmh: Check for SCM availability at probe
+    - soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request
+    - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
+    - arm64: tegra: Correct Tegra132 I2C alias
+    - arm64: dts: qcom: qcs404: fix bluetooth device address
+    - md/raid5: fix deadlock that raid5d() wait for itself to clear
+      MD_SB_CHANGE_PENDING
+    - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
+    - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
+    - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
+    - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
+    - arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP
+    - arm64: dts: hi3798cv200: fix the size of GICR
+    - arm64: dts: ti: verdin-am62: Set memory size to 2gb
+    - media: mc: Fix graph walk in media_pipeline_start
+    - media: mc: mark the media devnode as registered from the, start
+    - media: mxl5xx: Move xpt structures off stack
+    - media: v4l2-core: hold videodev_lock until dev reg, finishes
+    - media: v4l: async: Properly re-initialise notifier entry in unregister
+    - media: v4l: async: Don't set notifier's V4L2 device if registering fails
+    - media: v4l: async: Fix notifier list entry init
+    - mmc: core: Add mmc_gpiod_set_cd_config() function
+    - mmc: sdhci: Add support for "Tuning Error" interrupts
+    - mmc: sdhci-acpi: Sort DMI quirks alphabetically
+    - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working
+    - mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A
+    - mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect GPIO on Asus
+      T100TA
+    - drm/fbdev-generic: Do not set physical framebuffer address
+    - fbdev: savage: Handle err return when savagefb_check_var failed
+    - drm/amdgpu/atomfirmware: add intergrated info v2.3 table
+    - 9p: add missing locking around taking dentry fid list
+    - drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms
+    - Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices"
+    - KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
+    - KVM: arm64: Fix AArch32 register narrowing on userspace write
+    - KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
+    - KVM: arm64: AArch32: Fix spurious trapping of conditional instructions
+    - LoongArch: Add all CPUs enabled by fdt to NUMA node 0
+    - LoongArch: Override higher address bits in JUMP_VIRT_ADDR
+    - clk: bcm: dvp: Assign ->num before accessing ->hws
+    - clk: bcm: rpi: Assign ->num before accessing ->hws
+    - clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs
+    - crypto: ecdsa - Fix module auto-load on add-key
+    - crypto: ecrdsa - Fix module auto-load on add_key
+    - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
+    - kbuild: Remove support for Clang's ThinLTO caching
+    - mm: fix race between __split_huge_pmd_locked() and GUP-fast
+    - filemap: add helper mapping_max_folio_size()
+    - iomap: fault in smaller chunks for non-large folio mappings
+    - i2c: acpi: Unbind mux adapters before delete
+    - HID: i2c-hid: elan: fix reset suspend current leakage
+    - scsi: core: Handle devices which return an unusually large VPD page count
+    - net/ipv6: Fix route deleting failure when metric equals 0
+    - net/9p: fix uninit-value in p9_client_rpc()
+    - mm/ksm: fix ksm_pages_scanned accounting
+    - mm/ksm: fix ksm_zero_pages accounting
+    - kmsan: do not wipe out origin when doing partial unpoisoning
+    - tpm_tis: Do *not* flush uninitialized work
+    - intel_th: pci: Add Meteor Lake-S CPU support
+    - rtla/timerlat: Fix histogram report when a cpu count is 0
+    - sparc64: Fix number of online CPUs
+    - mm/cma: drop incorrect alignment check in cma_init_reserved_mem
+    - mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid
+    - mm: /proc/pid/smaps_rollup: avoid skipping vma after getting mmap_lock again
+    - mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL
+    - selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages
+    - selftests/mm: fix build warnings on ppc64
+    - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin
+    - bonding: fix oops during rmmod
+    - wifi: ath10k: fix QCOM_RPROC_COMMON dependency
+    - kdb: Fix buffer overflow during tab-complete
+    - kdb: Use format-strings rather than '\0' injection in kdb_read()
+    - kdb: Fix console handling when editing and tab-completing commands
+    - kdb: Merge identical case statements in kdb_read()
+    - kdb: Use format-specifiers rather than memset() for padding in kdb_read()
+    - sparc: move struct termio to asm/termios.h
+    - drm/amdkfd: handle duplicate BOs in reserve_bo_and_cond_vms
+    - ext4: Fixes len calculation in mpage_journal_page_buffers
+    - ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow
+    - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
+    - riscv: dts: starfive: Remove PMIC interrupt info for Visionfive 2 board
+    - ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
+    - ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
+    - ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
+    - parisc: Define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
+    - parisc: Define sigset_t in parisc uapi header
+    - s390/ap: Fix crash in AP internal function modify_bitmap()
+    - s390/cpacf: Split and rework cpacf query functions
+    - s390/cpacf: Make use of invalid opcode produce a link error
+    - i3c: master: svc: fix invalidate IBI type and miss call client IBI handler
+    - genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
+    - ASoC: SOF: ipc4-topology: Fix input format query of process modules without
+      base extension
+    - ALSA: ump: Don't clear bank selection after sending a program change
+    - ALSA: ump: Don't accept an invalid UMP protocol number
+    - EDAC/amd64: Convert PCIBIOS_* return codes to errnos
+    - EDAC/igen6: Convert PCIBIOS_* return codes to errnos
+    - nfs: fix undefined behavior in nfs_block_bits()
+    - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
+    - eventfs: Fix a possible null pointer dereference in eventfs_find_events()
+    - eventfs: Keep the directories from having the same inode number as files
+    - tracefs: Clear EVENT_INODE flag in tracefs_drop_inode()
+    - btrfs: fix crash on racing fsync and size-extending write into prealloc
+    - btrfs: fix leak of qgroup extent records after transaction abort
+    - ALSA: seq: Fix incorrect UMP type for system messages
+    - powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH
+    - smb: client: fix deadlock in smb2_find_smb_tcon()
+    - smp: Provide 'setup_max_cpus' definition on UP too
+    - drm/xe/bb: assert width in xe_bb_create_job()
+    - crypto: starfive - Do not free stack buffer
+    - btrfs: qgroup: fix initialization of auto inherit array
+    - wifi: rtl8xxxu: enable MFP support with security flag of RX descriptor
+    - media: mgb4: Fix double debugfs remove
+    - media: ov2740: Fix LINK_FREQ and PIXEL_RATE control value reporting
+    - firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails
+    - LoongArch: Fix built-in DTB detection
+    - LoongArch: Fix entry point in kernel image header
+    - clk: qcom: apss-ipq-pll: use stromer ops for IPQ5018 to fix boot failure
+    - net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED
+    - selftests: net: lib: support errexit with busywait
+    - selftests: net: lib: avoid error removing empty netns name
+    - cpufreq: amd-pstate: Fix the inconsistency in max frequency units
+    - mm/memory-failure: fix handling of dissolved but not taken off from buddy
+      pages
+    - selftests/mm: compaction_test: fix bogus test success on Aarch64
+    - irqchip/riscv-intc: Prevent memory leak when riscv_intc_init_common() fails
+    - Revert "perf record: Reduce memory for recording PERF_RECORD_LOST_SAMPLES
+      event"
+    - hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
+    - riscv: enable HAVE_ARCH_HUGE_VMAP for XIP kernel
+    - btrfs: qgroup: update rescan message levels and error codes
+    - btrfs: qgroup: fix qgroup id collision across mounts
+    - btrfs: cache folio size and shift in extent_buffer
+    - btrfs: protect folio::private when attaching extent buffer folios
+    - bpf: fix multi-uprobe PID filtering logic
+    - powerpc/64/bpf: fix tail calls for PCREL addressing
+    - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
+    - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
+    - Upstream stable to v6.6.34, v6.9.5
+
+  * Noble update: upstream stable patchset 2024-07-19 (LP: #2073603)
+    - perf record: Delete session after stopping sideband thread
+    - perf probe: Add missing libgen.h header needed for using basename()
+    - iio: core: Leave private pointer NULL when no private data supplied
+    - greybus: lights: check return of get_channel_from_mode
+    - phy: qcom: qmp-combo: fix duplicate return in qmp_v4_configure_dp_phy
+    - f2fs: multidev: fix to recognize valid zero block address
+    - f2fs: fix to wait on page writeback in __clone_blkaddrs()
+    - fpga: manager: add owner module and take its refcount
+    - fpga: bridge: add owner module and take its refcount
+    - counter: linux/counter.h: fix Excess kernel-doc description warning
+    - perf annotate: Get rid of duplicate --group option item
+    - usb: typec: ucsi: always register a link to USB PD device
+    - usb: typec: ucsi: simplify partner's PD caps registration
+    - perf stat: Do not fail on metrics on s390 z/VM systems
+    - soundwire: cadence: fix invalid PDI offset
+    - dmaengine: idma64: Add check for dma_set_max_seg_size
+    - firmware: dmi-id: add a release callback function
+    - perf annotate: Fix annotation_calc_lines() to pass correct address to
+      get_srcline()
+    - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
+    - serial: max3100: Update uart_driver_registered on driver removal
+    - serial: max3100: Fix bitwise types
+    - greybus: arche-ctrl: move device table to its right location
+    - PCI: tegra194: Fix probe path for Endpoint mode
+    - serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
+    - module: don't ignore sysfs_create_link() failures
+    - interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment
+    - arm64: dts: meson: fix S4 power-controller node
+    - perf tests: Make "test data symbol" more robust on Neoverse N1
+    - perf tests: Apply attributes to all events in object code reading test
+    - perf record: Fix debug message placement for test consumption
+    - dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties
+    - perf bench uprobe: Remove lib64 from libc.so.6 binary path
+    - f2fs: compress: fix to relocate check condition in
+      f2fs_{release,reserve}_compress_blocks()
+    - f2fs: compress: fix to relocate check condition in
+      f2fs_ioc_{,de}compress_file()
+    - f2fs: fix to relocate check condition in f2fs_fallocate()
+    - f2fs: fix to check pinfile flag in f2fs_move_file_range()
+    - iio: adc: stm32: Fixing err code to not indicate success
+    - riscv: dts: starfive: visionfive 2: Remove non-existing TDM hardware
+    - coresight: etm4x: Fix unbalanced pm_runtime_enable()
+    - perf docs: Document bpf event modifier
+    - perf test shell arm_coresight: Increase buffer size for Coresight basic
+      tests
+    - iio: pressure: dps310: support negative temperature values
+    - iio: buffer-dmaengine: export buffer alloc and free functions
+    - iio: add the IIO backend framework
+    - [CONFIG] Update CONFIG_IIO_BACKEND
+    - iio: adc: ad9467: convert to backend framework
+    - [Config] Update CONFIG_AD9467
+    - iio: adc: adi-axi-adc: move to backend framework
+    - [Config] Update CONFIG_ADI_AXI_ADC
+    - iio: adc: adi-axi-adc: only error out in major version mismatch
+    - coresight: etm4x: Do not hardcode IOMEM access for register restore
+    - coresight: etm4x: Do not save/restore Data trace control registers
+    - coresight: etm4x: Safe access for TRCQCLTR
+    - coresight: etm4x: Fix access to resource selector registers
+    - vfio/pci: fix potential memory leak in vfio_intx_enable()
+    - fpga: region: add owner module and take its refcount
+    - udf: Remove GFP_NOFS allocation in udf_expand_file_adinicb()
+    - udf: Convert udf_expand_file_adinicb() to use a folio
+    - microblaze: Remove gcc flag for non existing early_printk.c file
+    - microblaze: Remove early printk call from cpuinfo-static.c
+    - PCI: Wait for Link Training==0 before starting Link retrain
+    - perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer)
+    - leds: pwm: Disable PWM when going to suspend
+    - ovl: remove upper umask handling from ovl_create_upper()
+    - PCI: of_property: Return error for int_map allocation failure
+    - VMCI: Fix an error handling path in vmci_guest_probe_device()
+    - dt-bindings: pinctrl: mediatek: mt7622: fix array properties
+    - pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs
+    - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
+    - watchdog: bd9576: Drop "always-running" property
+    - watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe()
+    - dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains
+    - dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x
+    - dmaengine: idxd: Avoid unnecessary destruction of file_ida
+    - usb: gadget: u_audio: Fix race condition use of controls after free during
+      gadget unbind.
+    - usb: gadget: u_audio: Clear uac pointer when freed.
+    - stm class: Fix a double free in stm_register_device()
+    - ppdev: Add an error check in register_device
+    - i2c: cadence: Avoid fifo clear after start
+    - i2c: synquacer: Fix an error handling path in synquacer_i2c_probe()
+    - perf bench internals inject-build-id: Fix trap divide when collecting just
+      one DSO
+    - perf ui browser: Don't save pointer to stack memory
+    - extcon: max8997: select IRQ_DOMAIN instead of depending on it
+    - dt-bindings: spmi: hisilicon,hisi-spmi-controller: fix binding references
+    - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
+    - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
+    - f2fs: support printk_ratelimited() in f2fs_printk()
+    - f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC
+    - f2fs: separate f2fs_gc_range() to use GC for a range
+    - f2fs: kill heap-based allocation
+    - f2fs: support file pinning for zoned devices
+    - f2fs: fix block migration when section is not aligned to pow2
+    - perf ui browser: Avoid SEGV on title
+    - perf report: Avoid SEGV in report__setup_sample_type()
+    - perf thread: Fixes to thread__new() related to initializing comm
+    - perf symbols: Fix ownership of string in dso__load_vmlinux()
+    - f2fs: compress: fix to update i_compr_blocks correctly
+    - f2fs: deprecate io_bits
+    - f2fs: introduce get_available_block_count() for cleanup
+    - f2fs: compress: fix error path of inc_valid_block_count()
+    - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem
+      lock
+    - f2fs: fix to release node block count in error path of f2fs_new_node_page()
+    - f2fs: compress: don't allow unaligned truncation on released compress inode
+    - serial: sh-sci: protect invalidating RXDMA on shutdown
+    - libsubcmd: Fix parse-options memory leak
+    - perf daemon: Fix file leak in daemon_session__control
+    - f2fs: fix to add missing iput() in gc_data_segment()
+    - usb: fotg210: Add missing kernel doc description
+    - perf stat: Don't display metric header for non-leader uncore events
+    - perf tools: Use pmus to describe type from attribute
+    - perf tools: Add/use PMU reverse lookup from config to name
+    - perf pmu: Assume sysfs events are always the same case
+    - perf pmu: Count sys and cpuid JSON events separately
+    - LoongArch: Fix callchain parse error with kernel tracepoint events again
+    - s390/vdso64: filter out munaligned-symbols flag for vdso
+    - s390/vdso: Generate unwind information for C modules
+    - s390/vdso: Create .build-id links for unstripped vdso files
+    - s390/vdso: Use standard stack frame layout
+    - s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
+    - s390/ipl: Fix incorrect initialization of nvme dump block
+    - s390/boot: Remove alt_stfle_fac_list from decompressor
+    - dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios
+    - gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node
+      match
+    - eventfs: Do not differentiate the toplevel events directory
+    - eventfs: Create eventfs_root_inode to store dentry
+    - eventfs/tracing: Add callback for release of an eventfs_inode
+    - eventfs: Free all of the eventfs_inode after RCU
+    - eventfs: Have "events" directory get permissions from its parent
+    - dt-bindings: adc: axi-adc: update bindings for backend framework
+    - dt-bindings: adc: axi-adc: add clocks property
+    - Input: ims-pcu - fix printf string overflow
+    - mmc: sdhci_am654: Add tuning algorithm for delay chain
+    - mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
+    - mmc: sdhci_am654: Add OTAP/ITAP delay enable
+    - mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
+    - mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
+    - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
+    - media: v4l: Don't turn on privacy LED if streamon fails
+    - media: ov2680: Clear the 'ret' variable on success
+    - media: ov2680: Allow probing if link-frequencies is absent
+    - media: ov2680: Do not fail if data-lanes property is absent
+    - drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk
+    - drm/msm/dpu: Always flush the slave INTF on the CTL
+    - drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
+    - drm/meson: gate px_clk when setting rate
+    - um: Fix return value in ubd_init()
+    - um: vector: fix bpfflash parameter evaluation
+    - fs/ntfs3: Check 'folio' pointer for NULL
+    - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
+    - fs/ntfs3: Use variable length array instead of fixed size
+    - drm/msm/dpu: Add callback function pointer check before its call
+    - drm/bridge: tc358775: fix support for jeida-18 and jeida-24
+    - media: stk1160: fix bounds checking in stk1160_copy_video()
+    - Input: cyapa - add missing input core locking to suspend/resume functions
+    - drm/amdgpu: init microcode chip name from ip versions
+    - drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and
+      rlc_microcode()
+    - media: mediatek: vcodec: fix possible unbalanced PM counter
+    - tools/arch/x86/intel_sdsi: Fix maximum meter bundle length
+    - tools/arch/x86/intel_sdsi: Fix meter_show display
+    - tools/arch/x86/intel_sdsi: Fix meter_certificate decoding
+    - platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit()
+    - media: flexcop-usb: fix sanity check of bNumEndpoints
+    - powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
+    - um: Fix the -Wmissing-prototypes warning for __switch_mm
+    - um: Fix the -Wmissing-prototypes warning for get_thread_reg
+    - um: Fix the declaration of kasan_map_memory
+    - cxl/trace: Correct DPA field masks for general_media & dram events
+    - cxl/region: Fix cxlr_pmem leaks
+    - media: sunxi: a83-mips-csi2: also select GENERIC_PHY
+    - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
+    - media: cec: cec-api: add locking in cec_release()
+    - media: cec: core: avoid recursive cec_claim_log_addrs
+    - media: cec: core: avoid confusing "transmit timed out" message
+    - Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
+    - drm: zynqmp_dpsub: Always register bridge
+    - selftests/powerpc/dexcr: Add -no-pie to hashchk tests
+    - drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
+    - ASoC: tas2781: Fix a warning reported by robot kernel test
+    - null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
+    - ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
+    - ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance
+    - ASoC: mediatek: mt8192: fix register configuration for tdm
+    - drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations
+    - blk-cgroup: fix list corruption from resetting io stat
+    - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
+    - blk-cgroup: Properly propagate the iostat update up the hierarchy
+    - regulator: bd71828: Don't overwrite runtime voltages
+    - xen/x86: add extra pages to unpopulated-alloc if available
+    - perf/arm-dmc620: Fix lockdep assert in ->event_init()
+    - x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when
+      UNWINDER_FRAME_POINTER=y
+    - [Config] Update CONFIG_ARCH_WANT_FRAME_POINTERS
+    - net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
+    - ipv6: sr: fix missing sk_buff release in seg6_input_core
+    - selftests: net: kill smcrouted in the cleanup logic in amt.sh
+    - nfc: nci: Fix uninit-value in nci_rx_work
+    - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
+    - ASoC: tas2781: Fix wrong loading calibrated data sequence
+    - NFSv4: Fixup smatch warning for ambiguous return
+    - nfs: keep server info for remounts
+    - sunrpc: fix NFSACL RPC retry on soft mount
+    - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
+    - regulator: pickable ranges: don't always cache vsel
+    - regulator: tps6287x: Force writing VSEL bit
+    - af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
+    - ipv6: sr: fix memleak in seg6_hmac_init_algo
+    - regulator: tps6594-regulator: Correct multi-phase configuration
+    - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
+    - pNFS/filelayout: fixup pNfs allocation modes
+    - openvswitch: Set the skbuff pkt_type for proper pmtud support.
+    - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
+    - rv: Update rv_en(dis)able_monitor doc to match kernel-doc
+    - net: lan966x: Remove ptp traps in case the ptp is not enabled.
+    - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
+    - i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame
+    - Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI"
+    - net: fec: avoid lock evasion when reading pps_enable
+    - tls: fix missing memory barrier in tls_init
+    - net: relax socket state check at accept time.
+    - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
+    - drivers/xen: Improve the late XenStore init protocol
+    - ice: Interpret .set_channels() input differently
+    - kasan, fortify: properly rename memintrinsics
+    - tracing/probes: fix error check in parse_btf_field()
+    - tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
+    - netfilter: nfnetlink_queue: acquire rcu_read_lock() in
+      instance_destroy_rcu()
+    - netfilter: ipset: Add list flush to cancel_gc
+    - netfilter: nft_payload: restore vlan q-in-q match support
+    - spi: Don't mark message DMA mapped when no transfer in it is
+    - dma-mapping: benchmark: fix up kthread-related error handling
+    - dma-mapping: benchmark: fix node id validation
+    - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
+    - nvme-multipath: fix io accounting on failover
+    - nvmet: fix ns enable/disable possible hang
+    - drm/amd/display: Enable colorspace property for MST connectors
+    - net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061
+    - net/mlx5: Lag, do bond only if slaves agree on roce state
+    - net/mlx5: Fix MTMP register capability offset in MCAM register
+    - net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules
+    - net/mlx5e: Fix IPsec tunnel mode offload feature check
+    - net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer
+      exhaustion
+    - net/mlx5e: Fix UDP GSO for encapsulated packets
+    - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
+    - bpf: Fix potential integer overflow in resolve_btfids
+    - ALSA: jack: Use guard() for locking
+    - ALSA: core: Remove debugfs at disconnection
+    - ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
+    - enic: Validate length of nl attributes in enic_set_vf_port
+    - af_unix: Annotate data-race around unix_sk(sk)->addr.
+    - af_unix: Read sk->sk_hash under bindlock during bind().
+    - Octeontx2-pf: Free send queue buffers incase of leaf to inner
+    - net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
+    - ASoC: cs42l43: Only restrict 44.1kHz for the ASP
+    - bpf: Allow delete from sockmap/sockhash only if update is allowed
+    - net:fec: Add fec_enet_deinit()
+    - net: micrel: Fix lan8841_config_intr after getting out of sleep mode
+    - ice: fix accounting if a VLAN already exists
+    - selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky
+    - selftests: mptcp: add ms units for tc-netem delay
+    - selftests: mptcp: join: mark 'fail' tests as flaky
+    - ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion
+    - ALSA: seq: Don't clear bank selection at event -> UMP MIDI2 conversion
+    - net: ti: icssg-prueth: Fix start counter for ft1 filter
+    - netfilter: nft_payload: skbuff vlan metadata mangle support
+    - netfilter: tproxy: bail out if IP has been disabled on the device
+    - netfilter: nft_fib: allow from forward/input without iif selector
+    - net/sched: taprio: make q->picos_per_byte available to fill_sched_entry()
+    - net/sched: taprio: extend minimum interval restriction to entire cycle too
+    - kconfig: fix comparison to constant symbols, 'm', 'n'
+    - drm/i915/guc: avoid FIELD_PREP warning
+    - kheaders: use `command -v` to test for existence of `cpio`
+    - spi: stm32: Don't warn about spurious interrupts
+    - net: dsa: microchip: fix RGMII error in KSZ DSA driver
+    - net: ena: Reduce lines with longer column width boundary
+    - net: ena: Fix redundant device NUMA node override
+    - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
+    - ALSA: seq: Fix yet another spot for system message conversion
+    - powerpc/pseries/lparcfg: drop error message from guest name lookup
+    - drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel
+    - drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel
+    - drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel
+    - hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor
+    - hwmon: (shtc1) Fix property misspelling
+    - ALSA: seq: ump: Fix swapped song position pointer data
+    - ALSA: timer: Set lower bound of start tick time
+    - x86/efistub: Omit physical KASLR when memory reservations exist
+    - efi: libstub: only free priv.runtime_map when allocated
+    - x86/pci: Skip early E820 check for ECAM region
+    - KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID
+    - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
+    - platform/x86/intel/tpmi: Handle error from tpmi_process_info()
+    - platform/x86/intel-uncore-freq: Don't present root domain on error
+    - perf sched timehist: Fix -g/--call-graph option failure
+    - f2fs: write missing last sum blk of file pinning section
+    - f2fs: use f2fs_{err,info}_ratelimited() for cleanup
+    - SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
+    - riscv: prevent pt_regs corruption for secondary idle threads
+    - riscv: stacktrace: fixed walk_stackframe()
+    - perf build: Fix out of tree build related to installation of sysreg-defs
+    - dt-bindings: pinctrl: qcom: update functions to match with driver
+    - usb: typec: ucsi: allow non-partner GET_PDOS for Qualcomm devices
+    - perf report: Fix PAI counter names for s390 virtual machines
+    - PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host
+    - perf map: Remove kernel map before updating start and end addresses
+    - riscv: dts: starfive: visionfive 2: Remove non-existing I2S hardware
+    - pinctrl: renesas: rzg2l: Limit 2.5V power supply to Ethernet interfaces
+    - riscv: Flush the instruction cache during SMP bringup
+    - usb: xhci: check if 'requested segments' exceeds ERST capacity
+    - spmi: pmic-arb: Replace three IS_ERR() calls by null pointer checks in
+      spmi_pmic_arb_probe()
+    - perf symbols: Remove map from list before updating addresses
+    - perf symbols: Update kcore map before merging in remaining symbols
+    - s390/ftrace: Use unwinder instead of __builtin_return_address()
+    - s390/stacktrace: Merge perf_callchain_user() and arch_stack_walk_user()
+    - s390/stacktrace: Skip first user stack frame
+    - s390/stacktrace: Improve detection of invalid instruction pointers
+    - s390/vdso: Introduce and use struct stack_frame_vdso_wrapper
+    - s390/stackstrace: Detect vdso stack frames
+    - s390/ap: Fix bind complete udev event sent after each AP bus scan
+    - ocfs2: correctly use ocfs2_find_next_zero_bit()
+    - mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown
+    - Input: ioc3kbd - add device table
+    - phy: qcom: qmp-combo: fix sm8650 voltage swing table
+    - media: ti: j721e-csi2rx: Fix races while restarting DMA
+    - drm/msm/dpu: Allow configuring multiple active DSC blocks
+    - drm: Make drivers depends on DRM_DW_HDMI
+    - [Config] Drivers now depend on DRM_DW_HDMI
+    - string: Prepare to merge strscpy_kunit.c into string_kunit.c
+    - string: Prepare to merge strcat KUnit tests into string_kunit.c
+    - drm/msm/adreno: fix CP cycles stat retrieval on a7xx
+    - printk: Fix LOG_CPU_MAX_BUF_SHIFT when BASE_SMALL is enabled
+    - powerpc/bpf/32: Fix failing test_bpf tests
+    - KVM: PPC: Book3S HV nestedv2: Cancel pending DEC exception
+    - KVM: PPC: Book3S HV nestedv2: Fix an error handling path in
+      gs_msg_ops_kvmhv_nestedv2_config_fill_info()
+    - KVM: arm64: Destroy mpidr_data for 'late' vCPU creation
+    - Bluetooth: ISO: Handle PA sync when no BIGInfo reports are generated
+    - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
+    - ubsan: Restore dependency on ARCH_HAS_UBSAN
+    - selftests: forwarding: Have RET track kselftest framework constants
+    - selftests: forwarding: Convert log_test() to recognize RET values
+    - selftests: net: Unify code of busywait() and slowwait()
+    - selftests/net: use tc rule to filter the na packet
+    - virtio_balloon: Give the balloon its own wakeup source
+    - riscv: cpufeature: Fix thead vector hwcap removal
+    - riscv: cpufeature: Fix extension subset checking
+    - riscv: selftests: Add hwprobe binaries to .gitignore
+    - idpf: Interpret .set_channels() input differently
+    - null_blk: fix null-ptr-dereference while configuring 'power' and
+      'submit_queues'
+    - netfs: Fix setting of BDP_ASYNC from iocb flags
+    - cifs: Set zero_point in the copy_file_range() and remap_file_range()
+    - cifs: Fix missing set of remote_i_size
+    - selftests: net: lib: set 'i' as local
+    - nvme: fix multipath batched completion accounting
+    - netkit: Fix setting mac address in l2 mode
+    - netkit: Fix pkt_type override upon netkit pass verdict
+    - null_blk: Fix return value of nullb_device_power_store()
+    - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers
+    - selftests: mptcp: join: mark 'fastclose' tests as flaky
+    - drm/xe: Add dbg messages on the suspend resume functions.
+    - drm/xe: check pcode init status only on root gt of root tile
+    - drm/xe: Change pcode timeout to 50msec while polling again
+    - drm/xe: Only use reserved BCS instances for usm migrate exec queue
+    - sd: also set max_user_sectors when setting max_sectors
+    - block: stack max_user_sectors
+    - ipv6: introduce dst_rt6_info() helper
+    - inet: introduce dst_rtable() helper
+    - net: fix __dst_negative_advice() race
+    - ice: fix 200G PHY types to link speed mapping
+    - x86/topology/intel: Unlock CPUID before evaluating anything
+    - Upstream stable to v6.6.33, v6.9.4
+
+  * Reenable CONFIG_UBSAN for noble (LP: #2076650)
+    - ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL
+    - [Config] Remove CONFIG_UBSAN_SANITIZE_ALL
+
+  * Dangling symlink to linux-lib-rust when Rust is disabled (LP: #2072592)
+    - [Packaging] Check do_lib_rust before linking Rust lib files
+
+  * kdump doesn't work with UEFI secure boot and kernel lockdown enabled on
+    ARM64 (LP: #2033007)
+    - [Config]: Enable CONFIG_KEXEC_IMAGE_VERIFY_SIG on arm64
+
+  * net/sched: Fix conntrack use-after-free (LP: #2073092)
+    - net/sched: Fix UAF when resolving a clash
+
+  * No sound on Huawei Matebook D14  AMD since Linux 6.8.0-38 [regression]
+    (LP: #2073049)
+    - ASoC: amd: acp: fix for acp platform device creation failure
+
+  * i915: Fixup regressions introduced with enabling single CCS engine
+    (LP: #2072755)
+    - drm/i915/gt: Fix CCS id's calculation for CCS mode setting
+
+  * [Ubuntu 24.04] FW1060.00 (NH1060_026) sosreport is running to Kernel OOPS
+    crash (LP: #2070358)
+    - nfsd: initialise nfsd_info.mutex early.
+
+  * 6.8 generic & amdpgu / polaris (LP: #2072428)
+    - drm/amdgpu: Adjust logic in amdgpu_device_partner_bandwidth()
+
+  * md: nvme over tcp with a striped underlying md raid device leads to data
+    corruption (LP: #2075110)
+    - md/md-bitmap: fix writing non bitmap pages
+
+  * Linux 6.8 fails to boot on ARM64 if any param is more than 146 chars
+    (LP: #2069534)
+    - SAUCE: arm64: v6.8: cmdline param >= 146 chars kills kernel
+
+  * CVE-2024-39484
+    - mmc: davinci: Don't strip remove function when driver is builtin
+
+  * CVE-2024-39292
+    - um: Add winch to winch_handlers before registering winch IRQ
+
+  * Miscellaneous upstream changes
+    - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
+
+ -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Tue, 13 Aug 2024 12:20:36 +0200
+
+linux (6.8.0-40.40) noble; urgency=medium
+
+  * noble/linux: 6.8.0-40.40 -proposed tracker (LP: #2072201)
+
+  * FPS of glxgear with fullscreen is too low on MTL platform (LP: #2069380)
+    - drm/i915: Bypass LMEMBAR/GTTMMADR for MTL stolen memory access
+
+  * a critical typo in the code managing the ASPM  settings for PCI Express
+    devices (LP: #2071889)
+    - PCI/ASPM: Restore parent state to parent, child state to child
+
+  * [UBUNTU 24.04] IOMMU DMA mode changed in kernel config causes massive
+    throughput degradation for PCI-related network workloads (LP: #2071471)
+    - [Config] Set IOMMU_DEFAULT_DMA_STRICT=n and IOMMU_DEFAULT_DMA_LAZY=yes for
+      s390x
+
+  * UBSAN: array-index-out-of-bounds in
+    /build/linux-D15vQj/linux-6.5.0/drivers/md/bcache/bset.c:1098:3
+    (LP: #2039368)
+    - bcache: fix variable length array abuse in btree_iter
+
+  * Mute/mic LEDs and speaker no function on EliteBook 645/665 G11
+    (LP: #2071296)
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665
+      G11.
+
+  * failed to enable IPU6 camera sensor on kernel >= 6.8: ivsc_ace
+    intel_vsc-5db76cf6-0a68-4ed6-9b78-0361635e2447: switch camera to host
+    failed: -110 (LP: #2067364)
+    - mei: vsc: Don't stop/restart mei device during system suspend/resume
+    - SAUCE: media: ivsc: csi: don't count privacy on as error
+    - SAUCE: media: ivsc: csi: add separate lock for v4l2 control handler
+    - SAUCE: media: ivsc: csi: remove privacy status in struct mei_csi
+    - SAUCE: mei: vsc: Enhance IVSC chipset stability during warm reboot
+    - SAUCE: mei: vsc: Enhance SPI transfer of IVSC rom
+    - SAUCE: mei: vsc: Utilize the appropriate byte order swap function
+    - SAUCE: mei: vsc: Prevent timeout error with added delay post-firmware
+      download
+
+  * failed to probe camera sensor on Dell XPS 9315: ov01a10 i2c-OVTI01A0:00:
+    failed to check hwcfg: -22 (LP: #2070251)
+    - ACPI: utils: Make acpi_handle_path() not static
+    - ACPI: property: Ignore bad graph port nodes on Dell XPS 9315
+    - ACPI: property: Polish ignoring bad data nodes
+    - ACPI: scan: Ignore camera graph port nodes on all Dell Tiger, Alder and
+      Raptor Lake models
+
+  * Update amd_sfh for AMD strix series (LP: #2058331)
+    - HID: amd_sfh: Increase sensor command timeout
+    - HID: amd_sfh: Improve boot time when SFH is available
+    - HID: amd_sfh: Extend MP2 register access to SFH
+    - HID: amd_sfh: Set the AMD SFH driver to depend on x86
+
+  * RFIM and SAGV Linux Support for G10 models (LP: #2070158)
+    - drm/i915/display: Add meaningful traces for QGV point info error handling
+    - drm/i915/display: Extract code required to calculate max qgv/psf gv point
+    - drm/i915/display: extract code to prepare qgv points mask
+    - drm/i915/display: Disable SAGV on bw init, to force QGV point recalculation
+    - drm/i915/display: handle systems with duplicate psf gv points
+    - drm/i915/display: force qgv check after the hw state readout
+
+  * Update amd-pmf for AMD strix series (LP: #2058330)
+    - platform/x86/amd/pmf: Differentiate PMF ACPI versions
+    - platform/x86/amd/pmf: Disable debugfs support for querying power thermals
+    - platform/x86/amd/pmf: Add support to get sbios requests in PMF driver
+    - platform/x86/amd/pmf: Add support to notify sbios heart beat event
+    - platform/x86/amd/pmf: Add support to get APTS index numbers for static
+      slider
+    - platform/x86/amd/pmf: Add support to get sps default APTS index values
+    - platform/x86/amd/pmf: Update sps power thermals according to the platform-
+      profiles
+
+  * noble:linux: ADT ubuntu-regression-suite misses fakeroot dependency
+    (LP: #2070042)
+    - [DEP-8] Add missing fakeroot dependency
+
+  * Noble update: v6.8.12 upstream stable release (LP: #2071621)
+    - sunrpc: use the struct net as the svc proc private
+    - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
+    - selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly
+    - ftrace: Fix possible use-after-free issue in ftrace_location()
+    - Revert "arm64: fpsimd: Implement lazy restore for kernel mode FPSIMD"
+    - arm64/fpsimd: Avoid erroneous elide of user state reload
+    - Reapply "arm64: fpsimd: Implement lazy restore for kernel mode FPSIMD"
+    - tty: n_gsm: fix missing receive state reset after mode switch
+    - speakup: Fix sizeof() vs ARRAY_SIZE() bug
+    - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
+    - serial: 8250_bcm7271: use default_mux_rate if possible
+    - serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
+    - Input: try trimming too long modalias strings
+    - io_uring: fail NOP if non-zero op flags is passed in
+    - Revert "r8169: don't try to disable interrupts if NAPI is, scheduled
+      already"
+    - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
+    - ring-buffer: Fix a race between readers and resize checks
+    - net: mana: Fix the extra HZ in mana_hwc_send_request
+    - tools/latency-collector: Fix -Wformat-security compile warns
+    - tools/nolibc/stdlib: fix memory error in realloc()
+    - net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()
+    - net: lan966x: remove debugfs directory in probe() error path
+    - net: smc91x: Fix m68k kernel compilation for ColdFire CPU
+    - nilfs2: fix use-after-free of timer for log writer thread
+    - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
+    - nilfs2: fix potential hang in nilfs_detach_log_writer()
+    - fs/ntfs3: Remove max link count info display during driver init
+    - fs/ntfs3: Taking DOS names into account during link counting
+    - fs/ntfs3: Fix case when index is reused during tree transformation
+    - fs/ntfs3: Break dir enumeration if directory contents error
+    - ksmbd: avoid to send duplicate oplock break notifications
+    - ksmbd: ignore trailing slashes in share paths
+    - ALSA: core: Fix NULL module pointer assignment at card init
+    - ALSA: Fix deadlocks with kctl removals at disconnection
+    - KEYS: asymmetric: Add missing dependency on CRYPTO_SIG
+    - [Config] updateconfigs for CRYPTO_SIG
+    - KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST
+    - HID: nintendo: Fix N64 controller being identified as mouse
+    - dmaengine: xilinx: xdma: Clarify kdoc in XDMA driver
+    - wifi: mac80211: don't use rate mask for scanning
+    - wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon
+      timestamp field
+    - wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt
+      class
+    - dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
+    - HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled
+    - net: usb: qmi_wwan: add Telit FN920C04 compositions
+    - drm/amd/display: Set color_mgmt_changed to true on unsuspend
+    - drm/amdgpu: Update BO eviction priorities
+    - drm/amd/pm: Restore config space after reset
+    - drm/amdkfd: Add VRAM accounting for SVM migration
+    - drm/amdgpu: Fix the ring buffer size for queue VM flush
+    - Revert "net: txgbe: fix i2c dev name cannot match clkdev"
+    - Revert "net: txgbe: fix clk_name exceed MAX_DEV_ID limits"
+    - cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n
+    - LoongArch: Lately init pmu after smp is online
+    - drm/etnaviv: fix tx clock gating on some GC7000 variants
+    - selftests: sud_test: return correct emulated syscall value on RISC-V
+    - riscv: thead: Rename T-Head PBMT to MAE
+    - [Config] updateconfigs for ERRATA_THEAD_MAE
+    - riscv: T-Head: Test availability bit before enabling MAE errata
+    - sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU
+    - ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too
+    - regulator: irq_helpers: duplicate IRQ name
+    - ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot()
+    - ASoC: SOF: ipc4-pcm: Use consistent name for snd_sof_pcm_stream pointer
+    - ASoC: SOF: ipc4-pcm: Use consistent name for sof_ipc4_timestamp_info pointer
+    - ASoC: SOF: ipc4-pcm: Introduce generic sof_ipc4_pcm_stream_priv
+    - ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3
+    - ASoC: acp: Support microphone from device Acer 315-24p
+    - ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
+    - ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
+    - ASoC: rt722-sdca: modify channel number to support 4 channels
+    - ASoC: rt722-sdca: add headset microphone vrefo setting
+    - regulator: qcom-refgen: fix module autoloading
+    - regulator: vqmmc-ipq4019: fix module autoloading
+    - ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config
+    - ASoC: rt715: add vendor clear control register
+    - ASoC: rt715-sdca: volume step modification
+    - KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF
+    - Input: xpad - add support for ASUS ROG RAIKIRI
+    - btrfs: take the cleaner_mutex earlier in qgroup disable
+    - EDAC/versal: Do not register for NOC errors
+    - fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
+    - bpf, x86: Fix PROBE_MEM runtime load check
+    - ALSA: emu10k1: make E-MU FPGA writes potentially more reliable
+    - softirq: Fix suspicious RCU usage in __do_softirq()
+    - platform/x86: ISST: Add Grand Ridge to HPM CPU list
+    - ASoC: da7219-aad: fix usage of device_get_named_child_node()
+    - ASoC: cs35l56: fix usages of device_get_named_child_node()
+    - ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection
+    - Input: amimouse - mark driver struct with __refdata to prevent section
+      mismatch
+    - drm/amdgpu: Fix VRAM memory accounting
+    - drm/amd/display: Ensure that dmcub support flag is set for DCN20
+    - drm/amd/display: Add dtbclk access to dcn315
+    - drm/amd/display: Allocate zero bw after bw alloc enable
+    - drm/amd/display: Add VCO speed parameter for DCN31 FPU
+    - drm/amd/display: Fix DC mode screen flickering on DCN321
+    - drm/amd/display: Disable seamless boot on 128b/132b encoding
+    - drm/amdkfd: Flush the process wq before creating a kfd_process
+    - x86/mm: Remove broken vsyscall emulation code from the page fault code
+    - nvme: find numa distance only if controller has valid numa id
+    - nvmet-auth: return the error code to the nvmet_auth_host_hash() callers
+    - nvmet-auth: replace pr_debug() with pr_err() to report an error.
+    - nvme: cancel pending I/O if nvme controller is in terminal state
+    - nvmet-tcp: fix possible memory leak when tearing down a controller
+    - nvmet: fix nvme status code when namespace is disabled
+    - nvme-tcp: strict pdu pacing to avoid send stalls on TLS
+    - epoll: be better about file lifetimes
+    - nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
+    - openpromfs: finish conversion to the new mount API
+    - crypto: bcm - Fix pointer arithmetic
+    - firmware: qcom: qcm: fix unused qcom_scm_qseecom_allowlist
+    - mm/slub, kunit: Use inverted data to corrupt kmem cache
+    - firmware: raspberrypi: Use correct device for DMA mappings
+    - ecryptfs: Fix buffer size for tag 66 packet
+    - nilfs2: fix out-of-range warning
+    - parisc: add missing export of __cmpxchg_u8()
+    - crypto: ccp - drop platform ifdef checks
+    - crypto: x86/nh-avx2 - add missing vzeroupper
+    - crypto: x86/sha256-avx2 - add missing vzeroupper
+    - crypto: x86/sha512-avx2 - add missing vzeroupper
+    - s390/cio: fix tracepoint subchannel type field
+    - io_uring: use the right type for work_llist empty check
+    - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
+    - rcu: Fix buffer overflow in print_cpu_stall_info()
+    - ARM: configs: sunxi: Enable DRM_DW_HDMI
+    - jffs2: prevent xattr node from overflowing the eraseblock
+    - libfs: Re-arrange locking in offset_iterate_dir()
+    - libfs: Define a minimum directory offset
+    - libfs: Add simple_offset_empty()
+    - maple_tree: Add mtree_alloc_cyclic()
+    - libfs: Convert simple directory offsets to use a Maple Tree
+    - libfs: Fix simple_offset_rename_exchange()
+    - libfs: Add simple_offset_rename() API
+    - shmem: Fix shmem_rename2()
+    - io-wq: write next_work before dropping acct_lock
+    - mm/userfaultfd: Do not place zeropages when zeropages are disallowed
+    - s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests
+    - crypto: octeontx2 - add missing check for dma_map_single
+    - crypto: qat - improve error message in adf_get_arbiter_mapping()
+    - crypto: qat - improve error logging to be consistent across features
+    - soc: qcom: pmic_glink: don't traverse clients list without a lock
+    - soc: qcom: pmic_glink: notify clients about the current state
+    - firmware: qcom: scm: Fix __scm and waitq completion variable initialization
+    - soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
+    - null_blk: Fix missing mutex_destroy() at module removal
+    - crypto: qat - validate slices count returned by FW
+    - hwrng: stm32 - use logical OR in conditional
+    - hwrng: stm32 - put IP into RPM suspend on failure
+    - hwrng: stm32 - repair clock handling
+    - kunit/fortify: Fix mismatched kvalloc()/vfree() usage
+    - io_uring/net: remove dependency on REQ_F_PARTIAL_IO for sr->done_io
+    - io_uring/net: fix sendzc lazy wake polling
+    - soc: qcom: pmic_glink: Make client-lock non-sleeping
+    - lkdtm: Disable CFI checking for perms functions
+    - md: fix resync softlockup when bitmap size is less than array size
+    - crypto: qat - specify firmware files for 402xx
+    - block: refine the EOF check in blkdev_iomap_begin
+    - block: fix and simplify blkdevparts= cmdline parsing
+    - block: support to account io_ticks precisely
+    - wifi: ath10k: poll service ready message before failing
+    - wifi: brcmfmac: pcie: handle randbuf allocation failure
+    - wifi: ath11k: don't force enable power save on non-running vdevs
+    - bpftool: Fix missing pids during link show
+    - libbpf: Prevent null-pointer dereference when prog to load has no BTF
+    - wifi: ath12k: use correct flag field for 320 MHz channels
+    - wifi: mt76: mt7915: workaround too long expansion sparse warnings
+    - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
+    - wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok()
+    - wifi: iwlwifi: mvm: Do not warn on invalid link on scan complete
+    - wifi: iwlwifi: mvm: allocate STA links only for active links
+    - wifi: mac80211: don't select link ID if not provided in scan request
+    - wifi: iwlwifi: implement can_activate_links callback
+    - wifi: iwlwifi: mvm: fix active link counting during recovery
+    - wifi: iwlwifi: mvm: select STA mask only for active links
+    - wifi: iwlwifi: reconfigure TLC during HW restart
+    - wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask
+    - sched/fair: Add EAS checks before updating root_domain::overutilized
+    - ACPI: bus: Indicate support for _TFP thru _OSC
+    - ACPI: bus: Indicate support for more than 16 p-states thru _OSC
+    - ACPI: bus: Indicate support for the Generic Event Device thru _OSC
+    - ACPI: Fix Generic Initiator Affinity _OSC bit
+    - ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC
+    - enetc: avoid truncating error message
+    - qed: avoid truncating work queue length
+    - mlx5: avoid truncating error message
+    - mlx5: stop warning for 64KB pages
+    - bitops: add missing prototype check
+    - dlm: fix user space lock decision to copy lvb
+    - wifi: carl9170: re-fix fortified-memset warning
+    - bpftool: Mount bpffs on provided dir instead of parent dir
+    - bpf: Pack struct bpf_fib_lookup
+    - bpf: prevent r10 register from being marked as precise
+    - x86/microcode/AMD: Avoid -Wformat warning with clang-15
+    - scsi: ufs: qcom: Perform read back after writing reset bit
+    - scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
+    - scsi: ufs: qcom: Perform read back after writing unipro mode
+    - scsi: ufs: qcom: Perform read back after writing CGC enable
+    - scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
+    - scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H
+    - scsi: ufs: core: Perform read back after disabling interrupts
+    - scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
+    - ACPI: LPSS: Advertise number of chip selects via property
+    - EDAC/skx_common: Allow decoding of SGX addresses
+    - locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128()
+    - irqchip/alpine-msi: Fix off-by-one in allocation error path
+    - irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
+    - ACPI: disable -Wstringop-truncation
+    - gfs2: Don't forget to complete delayed withdraw
+    - gfs2: Fix "ignore unlock failures after withdraw"
+    - arm64: Remove unnecessary irqflags alternative.h include
+    - x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57
+    - selftests/bpf: Fix umount cgroup2 error in test_sockmap
+    - tcp: increase the default TCP scaling ratio
+    - cpufreq: exit() callback is optional
+    - x86/pat: Introduce lookup_address_in_pgd_attr()
+    - x86/pat: Restructure _lookup_address_cpa()
+    - x86/pat: Fix W^X violation false-positives when running as Xen PV guest
+    - udp: Avoid call to compute_score on multiple sites
+    - openrisc: traps: Don't send signals to kernel mode threads
+    - cppc_cpufreq: Fix possible null pointer dereference
+    - wifi: iwlwifi: mvm: init vif works only once
+    - scsi: libsas: Fix the failure of adding phy with zero-address to port
+    - scsi: hpsa: Fix allocation size for Scsi_Host private data
+    - x86/purgatory: Switch to the position-independent small code model
+    - wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
+    - thermal/drivers/mediatek/lvts_thermal: Add coeff for mt8192
+    - thermal/drivers/tsens: Fix null pointer dereference
+    - dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 compatible
+    - dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible
+      definition
+    - wifi: ath10k: Fix an error code problem in
+      ath10k_dbg_sta_write_peer_debug_trigger()
+    - gfs2: Remove ill-placed consistency check
+    - gfs2: Fix potential glock use-after-free on unmount
+    - gfs2: finish_xmote cleanup
+    - gfs2: do_xmote fixes
+    - thermal/debugfs: Avoid excessive updates of trip point statistics
+    - selftests/bpf: Fix a fd leak in error paths in open_netns
+    - scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search()
+    - cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations
+    - wifi: ath10k: populate board data for WCN3990
+    - net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset
+      handlers
+    - net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family
+      switches
+    - tcp: avoid premature drops in tcp_add_backlog()
+    - thermal/debugfs: Create records for cdev states as they get used
+    - thermal/debugfs: Pass cooling device state to thermal_debug_cdev_add()
+    - pwm: sti: Prepare removing pwm_chip from driver data
+    - pwm: sti: Simplify probe function using devm functions
+    - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
+    - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
+    - drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
+    - net: give more chances to rcu in netdev_wait_allrefs_any()
+    - macintosh/via-macii: Fix "BUG: sleeping function called from invalid
+      context"
+    - wifi: carl9170: add a proper sanity check for endpoints
+    - bpf: Fix verifier assumptions about socket->sk
+    - selftests/bpf: Run cgroup1_hierarchy test in own mount namespace
+    - wifi: ar5523: enable proper endpoint verification
+    - pwm: Drop useless member .of_pwm_n_cells of struct pwm_chip
+    - pwm: Let the of_xlate callbacks accept references without period
+    - pwm: Drop duplicate check against chip->npwm in of_pwm_xlate_with_flags()
+    - pwm: Reorder symbols in core.c
+    - pwm: Provide an inline function to get the parent device of a given chip
+    - pwm: meson: Change prototype of a few helpers to prepare further changes
+    - pwm: meson: Make use of pwmchip_parent() accessor
+    - pwm: meson: Add check for error from clk_round_rate()
+    - pwm: meson: Use mul_u64_u64_div_u64() for frequency calculating
+    - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
+    - sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
+    - Revert "sh: Handle calling csum_partial with misaligned data"
+    - wifi: mt76: mt7603: fix tx queue of loopback packets
+    - wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
+    - wifi: mt76: mt7996: fix size of txpower MCU command
+    - wifi: mt76: mt7925: ensure 4-byte alignment for suspend & wow command
+    - wifi: mt76: mt7996: fix uninitialized variable in mt7996_irq_tasklet()
+    - wifi: mt76: mt7996: fix potential memory leakage when reading chip
+      temperature
+    - libbpf: Fix error message in attach_kprobe_multi
+    - wifi: nl80211: Avoid address calculations via out of bounds array indexing
+    - wifi: rtw89: wow: refine WoWLAN flows of HCI interrupts and low power mode
+    - selftests/binderfs: use the Makefile's rules, not Make's implicit rules
+    - selftests/resctrl: fix clang build failure: use LOCAL_HDRS
+    - selftests: default to host arch for LLVM builds
+    - kunit: Fix kthread reference
+    - kunit: unregister the device on error
+    - kunit: bail out early in __kunit_test_suites_init() if there are no suites
+      to test
+    - selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect
+    - HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
+    - scsi: bfa: Ensure the copied buf is NUL terminated
+    - scsi: qedf: Ensure the copied buf is NUL terminated
+    - scsi: qla2xxx: Fix debugfs output for fw_resource_count
+    - gpio: nuvoton: Fix sgpio irq handle error
+    - x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks()
+    - wifi: mwl8k: initialize cmd->addr[] properly
+    - HID: amd_sfh: Handle "no sensors" in PM operations
+    - usb: aqc111: stop lying about skb->truesize
+    - net: usb: sr9700: stop lying about skb->truesize
+    - m68k: Fix spinlock race in kernel thread creation
+    - m68k: mac: Fix reboot hang on Mac IIci
+    - dm-delay: fix workqueue delay_timer race
+    - dm-delay: fix hung task introduced by kthread mode
+    - dm-delay: fix max_delay calculations
+    - ptp: ocp: fix DPLL functions
+    - net: ipv6: fix wrong start position when receive hop-by-hop fragment
+    - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
+    - selftests: net: add missing config for amt.sh
+    - selftests: net: move amt to socat for better compatibility
+    - net: ethernet: mediatek: split tx and rx fields in mtk_soc_data struct
+    - net: ethernet: mediatek: use ADMAv1 instead of ADMAv2.0 on MT7981 and MT7986
+    - ice: Fix package download algorithm
+    - net: ethernet: cortina: Locking fixes
+    - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
+    - net: usb: smsc95xx: stop lying about skb->truesize
+    - net: openvswitch: fix overwriting ct original tuple for ICMPv6
+    - ipv6: sr: add missing seg6_local_exit
+    - ipv6: sr: fix incorrect unregister order
+    - ipv6: sr: fix invalid unregister error path
+    - net/mlx5: Fix peer devlink set for SF representor devlink port
+    - net/mlx5: Reload only IB representors upon lag disable/enable
+    - net/mlx5: Add a timeout to acquire the command queue semaphore
+    - net/mlx5: Discard command completions in internal error
+    - s390/bpf: Emit a barrier for BPF_FETCH instructions
+    - riscv, bpf: make some atomic operations fully ordered
+    - ax25: Use kernel universal linked list to implement ax25_dev_list
+    - ax25: Fix reference count leak issues of ax25_dev
+    - ax25: Fix reference count leak issue of net_device
+    - dpll: fix return value check for kmemdup
+    - net: fec: remove .ndo_poll_controller to avoid deadlocks
+    - mptcp: SO_KEEPALIVE: fix getsockopt support
+    - mptcp: cleanup writer wake-up
+    - mptcp: avoid some duplicate code in socket option handling
+    - mptcp: implement TCP_NOTSENT_LOWAT support
+    - mptcp: cleanup SOL_TCP handling
+    - mptcp: fix full TCP keep-alive support
+    - net: stmmac: Offload queueMaxSDU from tc-taprio
+    - net: stmmac: est: Per Tx-queue error count for HLBF
+    - net: stmmac: Report taprio offload status
+    - net: stmmac: move the EST lock to struct stmmac_priv
+    - net: micrel: Fix receiving the timestamp in the frame for lan8841
+    - Bluetooth: compute LE flow credits based on recvbuf space
+    - Bluetooth: qca: Fix error code in qca_read_fw_build_info()
+    - Bluetooth: ISO: Add hcon for listening bis sk
+    - Bluetooth: ISO: Clean up returns values in iso_connect_ind()
+    - Bluetooth: ISO: Make iso_get_sock_listen generic
+    - Bluetooth: Remove usage of the deprecated ida_simple_xx() API
+    - Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS
+    - Bluetooth: HCI: Remove HCI_AMP support
+    - ice: make ice_vsi_cfg_rxq() static
+    - ice: make ice_vsi_cfg_txq() static
+    - overflow: Change DEFINE_FLEX to take __counted_by member
+    - Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings
+    - Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1
+    - drm/bridge: Fix improper bridge init order with pre_enable_prev_first
+    - drm/ci: update device type for volteer devices
+    - drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer()
+    - drm/omapdrm: Fix console by implementing fb_dirty
+    - drm/omapdrm: Fix console with deferred ops
+    - printk: Let no_printk() use _printk()
+    - dev_printk: Add and use dev_no_printk()
+    - drm/lcdif: Do not disable clocks on already suspended hardware
+    - drm/dp: Don't attempt AUX transfers when eDP panels are not powered
+    - drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't
+      assert
+    - drm/amd/display: Fix potential index out of bounds in color transformation
+      function
+    - drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate()
+    - ASoC: Intel: Disable route checks for Skylake boards
+    - ASoC: Intel: avs: ssm4567: Do not ignore route checks
+    - mtd: core: Report error if first mtd_otp_size() call fails in
+      mtd_otp_nvmem_add()
+    - mtd: rawnand: hynix: fixed typo
+    - drm/imagination: avoid -Woverflow warning
+    - ASoC: mediatek: Assign dummy when codec not specified for a DAI link
+    - drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W flags
+    - drm/panel: ltk050h3146w: drop duplicate commands from LTK050H3148W init
+    - fbdev: shmobile: fix snprintf truncation
+    - ASoC: kirkwood: Fix potential NULL dereference
+    - drm/meson: vclk: fix calculation of 59.94 fractional rates
+    - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
+    - drm/mediatek: Init `ddp_comp` with devm_kcalloc()
+    - ASoC: SOF: Intel: hda-dai: fix channel map configuration for aggregated
+      dailink
+    - powerpc/fsl-soc: hide unused const variable
+    - ASoC: SOF: Intel: mtl: Correct rom_status_reg
+    - ASoC: SOF: Intel: lnl: Correct rom_status_reg
+    - ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed
+    - ASoC: SOF: Intel: mtl: Implement firmware boot state check
+    - fbdev: sisfb: hide unused variables
+    - selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 mounted
+      without nsdelegate
+    - ASoC: Intel: avs: Restore stream decoupling on prepare
+    - ASoC: Intel: avs: Fix ASRC module initialization
+    - ASoC: Intel: avs: Fix potential integer overflow
+    - ASoC: Intel: avs: Test result of avs_get_module_entry()
+    - media: ngene: Add dvb_ca_en50221_init return value check
+    - staging: media: starfive: Remove links when unregistering devices
+    - media: rcar-vin: work around -Wenum-compare-conditional warning
+    - media: radio-shark2: Avoid led_names truncations
+    - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
+    - platform/x86: xiaomi-wmi: Fix race condition when reporting key events
+    - drm/msm/dp: allow voltage swing / pre emphasis of 3
+    - drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected
+    - media: ipu3-cio2: Request IRQ earlier
+    - media: dt-bindings: ovti,ov2680: Fix the power supply names
+    - media: i2c: et8ek8: Don't strip remove function when driver is builtin
+    - media: v4l2-subdev: Fix stream handling for crop API
+    - fbdev: sh7760fb: allow modular build
+    - media: atomisp: ssh_css: Fix a null-pointer dereference in
+      load_video_binaries
+    - drm/arm/malidp: fix a possible null pointer dereference
+    - drm: vc4: Fix possible null pointer dereference
+    - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
+    - drm/bridge: anx7625: Don't log an error when DSI host can't be found
+    - drm/bridge: icn6211: Don't log an error when DSI host can't be found
+    - drm/bridge: lt8912b: Don't log an error when DSI host can't be found
+    - drm/bridge: lt9611: Don't log an error when DSI host can't be found
+    - drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found
+    - drm/bridge: tc358775: Don't log an error when DSI host can't be found
+    - drm/bridge: dpc3433: Don't log an error when DSI host can't be found
+    - drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found
+    - drm/bridge: anx7625: Update audio status while detecting
+    - drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
+    - ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim 7 16ARHA7
+    - drm/mipi-dsi: use correct return type for the DSC functions
+    - media: uvcvideo: Add quirk for Logitech Rally Bar
+    - drm/rockchip: vop2: Do not divide height twice for YUV
+    - drm/edid: Parse topology block for all DispID structure v1.x
+    - media: cadence: csi2rx: configure DPHY before starting source stream
+    - clk: samsung: exynosautov9: fix wrong pll clock id value
+    - RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent
+    - RDMA/mlx5: Change check for cacheable mkeys
+    - RDMA/mlx5: Adding remote atomic access flag to updatable flags
+    - clk: mediatek: pllfh: Don't log error for missing fhctl node
+    - iommu: Undo pasid attachment only for the devices that have succeeded
+    - RDMA/hns: Fix return value in hns_roce_map_mr_sg
+    - RDMA/hns: Fix deadlock on SRQ async events.
+    - RDMA/hns: Fix UAF for cq async event
+    - RDMA/hns: Fix GMV table pagesize
+    - RDMA/hns: Use complete parentheses in macros
+    - RDMA/hns: Modify the print level of CQE error
+    - clk: mediatek: mt8365-mm: fix DPI0 parent
+    - clk: rs9: fix wrong default value for clock amplitude
+    - clk: qcom: clk-alpha-pll: remove invalid Stromer register offset
+    - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
+    - RDMA/rxe: Allow good work requests to be executed
+    - RDMA/rxe: Fix incorrect rxe_put in error path
+    - IB/mlx5: Use __iowrite64_copy() for write combining stores
+    - clk: renesas: r8a779a0: Fix CANFD parent clock
+    - clk: renesas: r9a07g043: Add clock and reset entry for PLIC
+    - lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
+    - mm/ksm: fix ksm exec support for prctl
+    - clk: qcom: dispcc-sm8450: fix DisplayPort clocks
+    - clk: qcom: dispcc-sm6350: fix DisplayPort clocks
+    - clk: qcom: dispcc-sm8550: fix DisplayPort clocks
+    - clk: qcom: dispcc-sm8650: fix DisplayPort clocks
+    - clk: qcom: mmcc-msm8998: fix venus clock issue
+    - x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
+    - x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS
+    - ext4: avoid excessive credit estimate in ext4_tmpfile()
+    - RDMA/mana_ib: Introduce helpers to create and destroy mana queues
+    - RDMA/mana_ib: Use struct mana_ib_queue for CQs
+    - RDMA/mana_ib: boundary check before installing cq callbacks
+    - virt: acrn: stop using follow_pfn
+    - drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
+    - sunrpc: removed redundant procp check
+    - nfsd: don't create nfsv4recoverydir in nfsdfs when not used.
+    - ext4: fix potential unnitialized variable
+    - ext4: remove the redundant folio_wait_stable()
+    - clk: qcom: Fix SC_CAMCC_8280XP dependencies
+    - [Config] updateconfigs for SC_CAMCC_8280XP
+    - clk: qcom: Fix SM_GPUCC_8650 dependencies
+    - [Config] updateconfigs for SM_GPUCC_8650
+    - clk: qcom: apss-ipq-pll: fix PLL rate for IPQ5018
+    - of: module: add buffer overflow check in of_modalias()
+    - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
+    - SUNRPC: Fix gss_free_in_token_pages()
+    - selftests/damon/_damon_sysfs: check errors from nr_schemes file reads
+    - selftests/kcmp: remove unused open mode
+    - RDMA/IPoIB: Fix format truncation compilation errors
+    - RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use
+      siw
+    - samples/landlock: Fix incorrect free in populate_ruleset_net
+    - tracing/user_events: Prepare find/delete for same name events
+    - tracing/user_events: Fix non-spaced field matching
+    - modules: Drop the .export_symbol section from the final modules
+    - net: bridge: xmit: make sure we have at least eth header len bytes
+    - selftests: net: bridge: increase IGMP/MLD exclude timeout membership
+      interval
+    - net: bridge: mst: fix vlan use-after-free
+    - net: qrtr: ns: Fix module refcnt
+    - selftests/net/lib: no need to record ns name if it already exist
+    - idpf: don't skip over ethtool tcp-data-split setting
+    - netrom: fix possible dead-lock in nr_rt_ioctl()
+    - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
+    - sched/fair: Allow disabling sched_balance_newidle with
+      sched_relax_domain_level
+    - sched/core: Fix incorrect initialization of the 'burst' parameter in
+      cpu_max_write()
+    - net: wangxun: fix to change Rx features
+    - net: wangxun: match VLAN CTAG and STAG features
+    - net: txgbe: move interrupt codes to a separate file
+    - net: txgbe: use irq_domain for interrupt controller
+    - net: txgbe: fix to control VLAN strip
+    - l2tp: fix ICMP error handling for UDP-encap sockets
+    - io_uring/net: ensure async prep handlers always initialize ->done_io
+    - pwm: Fix setting period with #pwm-cells = <1> and of_pwm_single_xlate()
+    - net: txgbe: fix to clear interrupt status after handling IRQ
+    - net: txgbe: fix GPIO interrupt blocking
+    - Linux 6.8.12
+
+  * Noble update: v6.8.11 upstream stable release (LP: #2070355)
+    - drm/amd/display: Fix division by zero in setup_dsc_config
+    - net: ks8851: Fix another TX stall caused by wrong ISR flag handling
+    - ice: pass VSI pointer into ice_vc_isvalid_q_id
+    - ice: remove unnecessary duplicate checks for VF VSI ID
+    - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
+    - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
+    - KEYS: trusted: Fix memory leak in tpm2_key_encode()
+    - erofs: get rid of erofs_fs_context
+    - erofs: reliably distinguish block based and fscache mode
+    - binder: fix max_thread type inconsistency
+    - usb: dwc3: Wait unconditionally after issuing EndXfer command
+    - net: usb: ax88179_178a: fix link status when link is set to down/up
+    - usb: typec: ucsi: displayport: Fix potential deadlock
+    - usb: typec: tipd: fix event checking for tps25750
+    - usb: typec: tipd: fix event checking for tps6598x
+    - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
+    - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
+    - KEYS: trusted: Do not use WARN when encode fails
+    - admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
+    - docs: kernel_include.py: Cope with docutils 0.21
+    - Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching
+      sysfs file
+    - block: add a disk_has_partscan helper
+    - block: add a partscan sysfs attribute for disks
+    - Linux 6.8.11
+
+  * Noble update: v6.8.10 upstream stable release (LP: #2070349)
+    - rust: module: place generated init_module() function in .init.text
+    - rust: macros: fix soundness issue in `module!` macro
+    - wifi: nl80211: don't free NULL coalescing rule
+    - pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
+    - pinctrl/meson: fix typo in PDM's pin name
+    - pinctrl: core: delete incorrect free in pinctrl_enable()
+    - pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
+    - pinctrl: mediatek: paris: Rework support for
+      PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
+    - sunrpc: add a struct rpc_stats arg to rpc_create_args
+    - nfs: expose /proc/net/sunrpc/nfs in net namespaces
+    - nfs: make the rpc_stat per net namespace
+    - nfs: Handle error of rpc_proc_register() in nfs_net_init().
+    - pinctrl: baytrail: Fix selecting gpio pinctrl state
+    - power: rt9455: hide unused rt9455_boost_voltage_values
+    - power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
+    - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
+    - nfsd: rename NFSD_NET_* to NFSD_STATS_*
+    - nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
+    - nfsd: make all of the nfsd stats per-network namespace
+    - NFSD: add support for CB_GETATTR callback
+    - NFSD: Fix nfsd4_encode_fattr4() crasher
+    - regulator: mt6360: De-capitalize devicetree regulator subnodes
+    - regulator: change stubbed devm_regulator_get_enable to return Ok
+    - regulator: change devm_regulator_get_enable_optional() stub to return Ok
+    - bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
+    - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
+    - regmap: Add regmap_read_bypassed()
+    - ASoC: SOF: Intel: add default firmware library path for LNL
+    - nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
+    - bpf: Fix a verifier verbose message
+    - spi: axi-spi-engine: use common AXI macros
+    - spi: axi-spi-engine: fix version format string
+    - spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
+    - bpf, arm64: Fix incorrect runtime stats
+    - riscv, bpf: Fix incorrect runtime stats
+    - ASoC: Intel: avs: Set name of control as in topology
+    - ASoC: codecs: wsa881x: set clk_stop_mode1 flag
+    - s390/mm: Fix storage key clearing for guest huge pages
+    - s390/mm: Fix clearing storage keys for huge pages
+    - arm32, bpf: Reimplement sign-extension mov instruction
+    - xdp: use flags field to disambiguate broadcast redirect
+    - efi/unaccepted: touch soft lockup during memory accept
+    - ice: ensure the copied buf is NUL terminated
+    - bna: ensure the copied buf is NUL terminated
+    - octeontx2-af: avoid off-by-one read from userspace
+    - thermal/debugfs: Free all thermal zone debug memory on zone removal
+    - thermal/debugfs: Fix two locking issues with thermal zone debug
+    - nsh: Restore skb->{protocol,data,mac_header} for outer header in
+      nsh_gso_segment().
+    - net l2tp: drop flow hash on forward
+    - thermal/debugfs: Prevent use-after-free from occurring after cdev removal
+    - s390/vdso: Add CFI for RA register to asm macro vdso_func
+    - Fix a potential infinite loop in extract_user_to_sg()
+    - ALSA: emu10k1: fix E-MU card dock presence monitoring
+    - ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()
+    - ALSA: emu10k1: move the whole GPIO event handling to the workqueue
+    - ALSA: emu10k1: fix E-MU dock initialization
+    - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
+    - net: qede: use return from qede_parse_flow_attr() for flower
+    - net: qede: use return from qede_parse_flow_attr() for flow_spec
+    - net: qede: use return from qede_parse_actions()
+    - vxlan: Fix racy device stats updates.
+    - vxlan: Add missing VNI filter counter update in arp_reduce().
+    - ASoC: meson: axg-fifo: use FIELD helpers
+    - ASoC: meson: axg-fifo: use threaded irq to check periods
+    - ASoC: meson: axg-card: make links nonatomic
+    - ASoC: meson: axg-tdm-interface: manage formatters in trigger
+    - ASoC: meson: cards: select SND_DYNAMIC_MINORS
+    - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
+    - s390/cio: Ensure the copied buf is NUL terminated
+    - cxgb4: Properly lock TX queue for the selftest.
+    - net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
+    - drm/amdgpu: fix doorbell regression
+    - spi: fix null pointer dereference within spi_sync
+    - net: bridge: fix multicast-to-unicast with fraglist GSO
+    - net: core: reject skb_copy(_expand) for fraglist GSO skbs
+    - rxrpc: Clients must accept conn from any address
+    - tipc: fix a possible memleak in tipc_buf_append
+    - vxlan: Pull inner IP header in vxlan_rcv().
+    - s390/qeth: Fix kernel panic after setting hsuid
+    - drm/panel: ili9341: Correct use of device property APIs
+    - [Config] updateconfigs for DRM_PANEL_ILITEK_ILI9341
+    - drm/panel: ili9341: Respect deferred probe
+    - drm/panel: ili9341: Use predefined error codes
+    - ipv4: Fix uninit-value access in __ip_make_skb()
+    - net: gro: fix udp bad offset in socket lookup by adding
+      {inner_}network_offset to napi_gro_cb
+    - net: gro: add flush check in udp_gro_receive_segment
+    - drm/xe/display: Fix ADL-N detection
+    - clk: qcom: smd-rpm: Restore msm8976 num_clk
+    - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
+    - powerpc/pseries: make max polling consistent for longer H_CALLs
+    - powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
+    - EDAC/versal: Do not log total error counts
+    - swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
+    - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
+    - exfat: fix timing of synchronizing bitmap and inode
+    - firmware: microchip: don't unconditionally print validation success
+    - scsi: ufs: core: Fix MCQ MAC configuration
+    - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
+    - scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling
+    - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
+    - scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
+    - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
+    - scsi: lpfc: Use a dedicated lock for ras_fwlog state
+    - gfs2: Fix invalid metadata access in punch_hole
+    - fs/9p: fix uninitialized values during inode evict
+    - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
+    - wifi: cfg80211: fix rdev_dump_mpp() arguments order
+    - wifi: mac80211: fix prep_connection error path
+    - wifi: iwlwifi: read txq->read_ptr under lock
+    - wifi: iwlwifi: mvm: guard against invalid STA ID on removal
+    - net: mark racy access on sk->sk_rcvbuf
+    - drm/xe: Fix END redefinition
+    - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
+    - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
+    - btrfs: return accurate error code on open failure in open_fs_devices()
+    - drm/amdkfd: Check cgroup when returning DMABuf info
+    - drm/amdkfd: range check cp bad op exception interrupts
+    - bpf: Check bloom filter map value size
+    - selftests/ftrace: Fix event filter target_func selection
+    - kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
+    - ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3
+      suspend
+    - regulator: tps65132: Add of_match table
+    - OSS: dmasound/paula: Mark driver struct with __refdata to prevent section
+      mismatch
+    - scsi: ufs: core: WLUN suspend dev/link state error recovery
+    - scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN
+    - scsi: ufs: core: Fix MCQ mode dev command timeout
+    - ALSA: line6: Zero-initialize message buffers
+    - block: fix overflow in blk_ioctl_discard()
+    - ASoC: codecs: ES8326: Solve error interruption issue
+    - ASoC: codecs: ES8326: modify clock table
+    - net: bcmgenet: Reset RBUF on first open
+    - vboxsf: explicitly deny setlease attempts
+    - ata: sata_gemini: Check clk_enable() result
+    - firewire: ohci: mask bus reset interrupts between ISR and bottom half
+    - tools/power turbostat: Fix added raw MSR output
+    - tools/power turbostat: Increase the limit for fd opened
+    - tools/power turbostat: Fix Bzy_MHz documentation typo
+    - tools/power turbostat: Do not print negative LPI residency
+    - tools/power turbostat: Expand probe_intel_uncore_frequency()
+    - tools/power turbostat: Print ucode revision only if valid
+    - tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read
+    - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
+    - btrfs: always clear PERTRANS metadata during commit
+    - memblock tests: fix undefined reference to `early_pfn_to_nid'
+    - memblock tests: fix undefined reference to `panic'
+    - memblock tests: fix undefined reference to `BIT'
+    - nouveau/gsp: Avoid addressing beyond end of rpc->entries
+    - scsi: target: Fix SELinux error when systemd-modules loads the target module
+    - scsi: hisi_sas: Handle the NCQ error returned by D2H frame
+    - blk-iocost: avoid out of bounds shift
+    - accel/ivpu: Remove d3hot_after_power_off WA
+    - accel/ivpu: Improve clarity of MMU error messages
+    - accel/ivpu: Fix missed error message after VPU rename
+    - platform/x86: acer-wmi: Add support for Acer PH18-71
+    - gpu: host1x: Do not setup DMA for virtual devices
+    - MIPS: scall: Save thread_info.syscall unconditionally on entry
+    - tools/power/turbostat: Fix uncore frequency file string
+    - net: add copy_safe_from_sockptr() helper
+    - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
+    - drm/amdgpu: Refine IB schedule error logging
+    - drm/amd/display: add DCN 351 version for microcode load
+    - drm/amdgpu: add smu 14.0.1 discovery support
+    - drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
+    - drm/amd/display: Skip on writeback when it's not applicable
+    - drm/amd/pm: fix the high voltage issue after unload
+    - drm/amdgpu: Fix VCN allocation in CPX partition
+    - amd/amdkfd: sync all devices to wait all processes being evicted
+    - selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
+    - Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
+    - Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
+    - hv_netvsc: Don't free decrypted memory
+    - uio_hv_generic: Don't free decrypted memory
+    - Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
+    - drm/xe/xe_migrate: Cast to output precision before multiplying operands
+    - drm/xe: Label RING_CONTEXT_CONTROL as masked
+    - smb3: fix broken reconnect when password changing on the server by allowing
+      password rotation
+    - iommu: mtk: fix module autoloading
+    - fs/9p: only translate RWX permissions for plain 9P2000
+    - fs/9p: translate O_TRUNC into OTRUNC
+    - fs/9p: fix the cache always being enabled on files with qid flags
+    - 9p: explicitly deny setlease attempts
+    - powerpc/crypto/chacha-p10: Fix failure on non Power10
+    - gpio: wcove: Use -ENOTSUPP consistently
+    - gpio: crystalcove: Use -ENOTSUPP consistently
+    - clk: Don't hold prepare_lock when calling kref_put()
+    - fs/9p: remove erroneous nlink init from legacy stat2inode
+    - fs/9p: drop inodes immediately on non-.L too
+    - gpio: lpc32xx: fix module autoloading
+    - drm/nouveau/dp: Don't probe eDP ports twice harder
+    - platform/x86/amd: pmf: Decrease error message to debug
+    - platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
+    - drm/radeon: silence UBSAN warning (v3)
+    - net:usb:qmi_wwan: support Rolling modules
+    - blk-iocost: do not WARN if iocg was already offlined
+    - SUNRPC: add a missing rpc_stat for TCP TLS
+    - qibfs: fix dentry leak
+    - xfrm: Preserve vlan tags for transport mode software GRO
+    - ARM: 9381/1: kasan: clear stale stack poison
+    - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
+    - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
+    - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
+    - Bluetooth: msft: fix slab-use-after-free in msft_do_close()
+    - arm64: dts: mediatek: mt8183-pico6: Fix bluetooth node
+    - Bluetooth: HCI: Fix potential null-ptr-deref
+    - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
+    - net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
+    - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
+    - hwmon: (corsair-cpro) Use a separate buffer for sending commands
+    - hwmon: (corsair-cpro) Use complete_all() instead of complete() in
+      ccp_raw_event()
+    - hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
+    - phonet: fix rtm_phonet_notify() skb allocation
+    - netlink: specs: Add missing bridge linkinfo attrs
+    - nfc: nci: Fix kcov check in nci_rx_work()
+    - net: bridge: fix corrupted ethernet header on multicast-to-unicast
+    - ipv6: Fix potential uninit-value access in __ip6_make_skb()
+    - selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC
+    - rxrpc: Fix the names of the fields in the ACK trailer struct
+    - rxrpc: Fix congestion control algorithm
+    - rxrpc: Only transmit one ACK per jumbo packet received
+    - dt-bindings: net: mediatek: remove wrongly added clocks and SerDes
+    - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
+    - net-sysfs: convert dev->operstate reads to lockless ones
+    - hsr: Simplify code for announcing HSR nodes timer setup
+    - ipv6: annotate data-races around cnf.disable_ipv6
+    - ipv6: prevent NULL dereference in ip6_output()
+    - net/smc: fix neighbour and rtable leak in smc_ib_find_route()
+    - net: hns3: using user configure after hardware reset
+    - net: hns3: direct return when receive a unknown mailbox message
+    - net: hns3: change type of numa_node_mask as nodemask_t
+    - net: hns3: release PTP resources if pf initialization failed
+    - net: hns3: use appropriate barrier function after setting a bit value
+    - net: hns3: fix port vlan filter not disabled issue
+    - net: hns3: fix kernel crash when devlink reload during initialization
+    - net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family
+    - drm/meson: dw-hdmi: power up phy on device init
+    - drm/meson: dw-hdmi: add bandgap setting for g12
+    - drm/connector: Add \n to message about demoting connector force-probes
+    - dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11
+      users
+    - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
+    - gpiolib: cdev: fix uninitialised kfifo
+    - drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible
+    - drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
+    - firewire: nosy: ensure user_length is taken into account when fetching
+      packet contents
+    - Reapply "drm/qxl: simplify qxl_fence_wait"
+    - usb: typec: ucsi: Check for notifications after init
+    - usb: typec: ucsi: Fix connector check on init
+    - usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed
+      device
+    - usb: ohci: Prevent missed ohci interrupts
+    - USB: core: Fix access violation during port device removal
+    - usb: gadget: composite: fix OS descriptors w_value logic
+    - usb: gadget: uvc: use correct buffer size when parsing configfs lists
+    - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
+    - usb: gadget: f_fs: Fix a race condition when processing setup packets.
+    - usb: xhci-plat: Don't include xhci.h
+    - usb: dwc3: core: Prevent phy suspend during init
+    - usb: typec: tcpm: clear pd_event queue in PORT_RESET
+    - usb: typec: tcpm: unregister existing source caps before re-registration
+    - usb: typec: tcpm: Check for port partner validity before consuming it
+    - ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
+    - ALSA: hda/realtek: Fix conflicting PCI SSID 17aa:386f for Lenovo Legion
+      models
+    - firewire: ohci: fulfill timestamp for some local asynchronous transaction
+    - mm/slub: avoid zeroing outside-object freepointer for single free
+    - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
+    - btrfs: set correct ram_bytes when splitting ordered extent
+    - btrfs: qgroup: do not check qgroup inherit if qgroup is disabled
+    - btrfs: make sure that WRITTEN is set on all metadata blocks
+    - maple_tree: fix mas_empty_area_rev() null pointer dereference
+    - mm/slab: make __free(kfree) accept error pointers
+    - mptcp: ensure snd_nxt is properly initialized on connect
+    - mptcp: only allow set existing scheduler for net.mptcp.scheduler
+    - workqueue: Fix selection of wake_cpu in kick_pool()
+    - dt-bindings: iio: health: maxim,max30102: fix compatible check
+    - iio:imu: adis16475: Fix sync mode setting
+    - iio: pressure: Fixes BME280 SPI driver data
+    - iio: pressure: Fixes SPI support for BMP3xx devices
+    - iio: accel: mxc4005: Interrupt handling fixes
+    - iio: accel: mxc4005: Reset chip on probe() and resume()
+    - kmsan: compiler_types: declare __no_sanitize_or_inline
+    - e1000e: change usleep_range to udelay in PHY mdic access
+    - tipc: fix UAF in error path
+    - xtensa: fix MAKE_PC_FROM_RA second argument
+    - net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
+    - net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
+    - net: bcmgenet: synchronize UMAC_CMD access
+    - ASoC: tegra: Fix DSPK 16-bit playback
+    - ASoC: ti: davinci-mcasp: Fix race condition during probe
+    - dyndbg: fix old BUG_ON in >control parser
+    - slimbus: qcom-ngd-ctrl: Add timeout for wait operation
+    - clk: samsung: Revert "clk: Use device_get_match_data()"
+    - clk: sunxi-ng: common: Support minimum and maximum rate
+    - clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI
+    - mei: me: add lunar lake point M DID
+    - drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()
+    - Revert "drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()"
+    - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
+    - drm/ttm: Print the memory decryption status just once
+    - drm/vmwgfx: Fix Legacy Display Unit
+    - drm/vmwgfx: Fix invalid reads in fence signaled events
+    - drm/imagination: Ensure PVR_MIPS_PT_PAGE_COUNT is never zero
+    - drm/amd/display: Fix idle optimization checks for multi-display and dual eDP
+    - drm/nouveau/gsp: Use the sg allocator for level 2 of radix3
+    - drm/i915/gt: Automate CCS Mode setting during engine resets
+    - drm/i915/bios: Fix parsing backlight BDB data
+    - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
+    - drm/amd/display: Fix incorrect DSC instance for MST
+    - arm64: dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration
+    - iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()
+    - net: fix out-of-bounds access in ops_init
+    - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
+    - misc/pvpanic-pci: register attributes via pci_driver
+    - x86/apic: Don't access the APIC when disabling x2APIC
+    - selftests/mm: fix powerpc ARCH check
+    - mm: use memalloc_nofs_save() in page_cache_ra_order()
+    - mm/userfaultfd: reset ptes when close() for wr-protected ones
+    - iommu/amd: Enhance def_domain_type to handle untrusted device
+    - fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan
+    - fs/proc/task_mmu: fix uffd-wp confusion in pagemap_scan_pmd_entry()
+    - nvme-pci: Add quirk for broken MSIs
+    - regulator: core: fix debugfs creation regression
+    - spi: microchip-core-qspi: fix setting spi bus clock rate
+    - ksmbd: off ipv6only for both ipv4/ipv6 binding
+    - ksmbd: avoid to send duplicate lease break notifications
+    - ksmbd: do not grant v2 lease if parent lease key and epoch are not set
+    - tracefs: Reset permissions on remount if permissions are options
+    - tracefs: Still use mount point as default permissions for instances
+    - eventfs: Do not treat events directory different than other directories
+    - Bluetooth: qca: fix invalid device address check
+    - Bluetooth: qca: fix wcn3991 device address check
+    - Bluetooth: qca: add missing firmware sanity checks
+    - Bluetooth: qca: fix NVM configuration parsing
+    - Bluetooth: qca: generalise device address check
+    - Bluetooth: qca: fix info leak when fetching board id
+    - Bluetooth: qca: fix info leak when fetching fw build id
+    - Bluetooth: qca: fix firmware check error path
+    - keys: Fix overwrite of key expiration on instantiation
+    - Linux 6.8.10
+
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337)
+    - cifs: Fix reacquisition of volume cookie on still-live connection
+    - smb: client: fix rename(2) regression against samba
+    - cifs: reinstate original behavior again for forceuid/forcegid
+    - HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc
+    - HID: logitech-dj: allow mice to use all types of reports
+    - arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f
+    - arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 Puma
+    - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
+    - arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
+    - arm64: dts: rockchip: Fix the i2c address of es8316 on Cool Pi CM5
+    - arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts
+    - arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
+    - arm64: dts: mediatek: mt8192: Add missing gce-client-reg to mutex
+    - arm64: dts: mediatek: mt8195: Add missing gce-client-reg to vpp/vdosys
+    - arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex
+    - arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex1
+    - arm64: dts: mediatek: cherry: Describe CPU supplies
+    - arm64: dts: mediatek: mt8192-asurada: Update min voltage constraint for
+      MT6315
+    - arm64: dts: mediatek: mt8195-cherry: Update min voltage constraint for
+      MT6315
+    - arm64: dts: mediatek: mt8183-kukui: Use default min voltage for MT6358
+    - arm64: dts: mediatek: mt7622: fix clock controllers
+    - arm64: dts: mediatek: mt7622: fix IR nodename
+    - arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
+    - arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
+    - arm64: dts: mediatek: mt7986: reorder properties
+    - arm64: dts: mediatek: mt7986: drop invalid properties from ethsys
+    - arm64: dts: mediatek: mt7986: drop "#reset-cells" from Ethernet controller
+    - arm64: dts: mediatek: mt7986: reorder nodes
+    - arm64: dts: mediatek: mt7986: drop invalid thermal block clock
+    - arm64: dts: mediatek: mt7986: prefix BPI-R3 cooling maps with "map-"
+    - arm64: dts: mediatek: mt2712: fix validation errors
+    - arm64: dts: rockchip: mark system power controller and fix typo on
+      orangepi-5-plus
+    - arm64: dts: rockchip: regulator for sd needs to be always on for BPI-R2Pro
+    - block: fix module reference leakage from bdev_open_by_dev error path
+    - arm64: dts: qcom: Fix type of "wdog" IRQs for remoteprocs
+    - arm64: dts: qcom: x1e80100: Fix the compatible for cluster idle states
+    - arm64: dts: qcom: sc8180x: Fix ss_phy_irq for secondary USB controller
+    - gpio: tangier: Use correct type for the IRQ chip data
+    - ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
+    - wifi: mac80211: clean up assignments to pointer cache.
+    - wifi: mac80211: split mesh fast tx cache into local/proxied/forwarded
+    - wifi: iwlwifi: mvm: remove old PASN station when adding a new one
+    - wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd
+    - drm/gma500: Remove lid code
+    - wifi: mac80211_hwsim: init peer measurement result
+    - wifi: mac80211: remove link before AP
+    - wifi: mac80211: fix unaligned le16 access
+    - net: libwx: fix alloc msix vectors failed
+    - vxlan: drop packets from invalid src-address
+    - net: bcmasp: fix memory leak when bringing down interface
+    - mlxsw: core: Unregister EMAD trap using FORWARD action
+    - mlxsw: core_env: Fix driver initialization with old firmware
+    - mlxsw: pci: Fix driver initialization with old firmware
+    - ARM: dts: microchip: at91-sama7g5ek: Replace regulator-suspend-voltage with
+      the valid property
+    - icmp: prevent possible NULL dereferences from icmp_build_probe()
+    - bridge/br_netlink.c: no need to return void function
+    - bnxt_en: refactor reset close code
+    - bnxt_en: Fix the PCI-AER routines
+    - bnxt_en: Fix error recovery for 5760X (P7) chips
+    - cxl/core: Fix potential payload size confusion in cxl_mem_get_poison()
+    - net: dsa: mv88e6xx: fix supported_interfaces setup in
+      mv88e6250_phylink_get_caps()
+    - NFC: trf7970a: disable all regulators on removal
+    - netfs: Fix writethrough-mode error handling
+    - ax25: Fix netdev refcount issue
+    - soc: mediatek: mtk-svs: Append "-thermal" to thermal zone names
+    - tools: ynl: don't ignore errors in NLMSG_DONE messages
+    - net: usb: ax88179_178a: stop lying about skb->truesize
+    - tcp: Fix Use-After-Free in tcp_ao_connect_init
+    - net: gtp: Fix Use-After-Free in gtp_dellink
+    - net: phy: mediatek-ge-soc: follow netdev LED trigger semantics
+    - gpio: tegra186: Fix tegra186_gpio_is_accessible() check
+    - drm/xe: Remove sysfs only once on action add failure
+    - drm/xe: call free_gsc_pkt only once on action add failure
+    - Bluetooth: hci_event: Use HCI error defines instead of magic values
+    - Bluetooth: hci_conn: Only do ACL connections sequentially
+    - Bluetooth: Remove pending ACL connection attempts
+    - Bluetooth: hci_conn: Always use sk_timeo as conn_timeout
+    - Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync
+    - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue
+    - Bluetooth: hci_sync: Attempt to dequeue connection attempt
+    - Bluetooth: ISO: Reassemble PA data for bcast sink
+    - Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync
+    - Bluetooth: btusb: Fix triggering coredump implementation for QCA
+    - Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE
+    - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID
+    - Bluetooth: btusb: mediatek: Fix double free of skb in coredump
+    - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor
+    - Bluetooth: qca: set power_ctrl_enabled on NULL returned by
+      gpiod_get_optional()
+    - ipvs: Fix checksumming on GSO of SCTP packets
+    - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
+    - mlxsw: Use refcount_t for reference counting
+    - mlxsw: spectrum_acl_tcam: Fix race in region ID allocation
+    - mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
+    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
+    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
+    - mlxsw: spectrum_acl_tcam: Rate limit error message
+    - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
+    - mlxsw: spectrum_acl_tcam: Fix warning during rehash
+    - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
+    - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
+    - eth: bnxt: fix counting packets discarded due to OOM and netpoll
+    - ARM: dts: imx6ull-tarragon: fix USB over-current polarity
+    - netfilter: nf_tables: honor table dormant flag from netdev release event
+      path
+    - net: phy: dp83869: Fix MII mode failure
+    - net: ti: icssg-prueth: Fix signedness bug in prueth_init_rx_chns()
+    - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
+    - i40e: Report MFS in decimal base instead of hex
+    - iavf: Fix TC config comparison with existing adapter TC config
+    - ice: fix LAG and VF lock dependency in ice_reset_vf()
+    - net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
+    - octeontx2-af: fix the double free in rvu_npc_freemem()
+    - dpll: check that pin is registered in __dpll_pin_unregister()
+    - dpll: fix dpll_pin_on_pin_register() for multiple parent pins
+    - tls: fix lockless read of strp->msg_ready in ->poll
+    - af_unix: Suppress false-positive lockdep splat for spin_lock() in
+      __unix_gc().
+    - netfs: Fix the pre-flush when appending to a file in writethrough mode
+    - drm/amd/display: Check DP Alt mode DPCS state via DMUB
+    - Revert "drm/amd/display: fix USB-C flag update after enc10 feature init"
+    - xhci: move event processing for one interrupter to a separate function
+    - usb: xhci: correct return value in case of STS_HCE
+    - KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled
+    - KVM: x86/pmu: Set enable bits for GP counters in PERF_GLOBAL_CTRL at "RESET"
+    - drm: add drm_gem_object_is_shared_for_memory_stats() helper
+    - drm/amdgpu: add shared fdinfo stats
+    - drm/amdgpu: fix visible VRAM handling during faults
+    - Revert "UBUNTU: SAUCE: selftests/seccomp: fix check of fds being assigned"
+    - selftests/seccomp: user_notification_addfd check nextfd is available
+    - selftests/seccomp: Change the syscall used in KILL_THREAD test
+    - selftests/seccomp: Handle EINVAL on unshare(CLONE_NEWPID)
+    - x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range
+    - x86/cpu: Fix check for RDPKRU in __show_regs()
+    - rust: phy: implement `Send` for `Registration`
+    - rust: kernel: require `Send` for `Module` implementations
+    - rust: don't select CONSTRUCTORS
+    - [Config] updateconfigs to drop CONSTRUCTORS for rust
+    - rust: init: remove impl Zeroable for Infallible
+    - rust: make mutually exclusive with CFI_CLANG
+    - kbuild: rust: remove unneeded `@rustc_cfg` to avoid ICE
+    - kbuild: rust: force `alloc` extern to allow "empty" Rust files
+    - rust: remove `params` from `module` macro example
+    - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
+    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
+    - Bluetooth: qca: fix NULL-deref on non-serdev suspend
+    - Bluetooth: qca: fix NULL-deref on non-serdev setup
+    - mtd: rawnand: qcom: Fix broken OP_RESET_DEVICE command in
+      qcom_misc_cmd_type_exec()
+    - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
+    - mmc: sdhci-msm: pervent access to suspended controller
+    - mmc: sdhci-of-dwcmshc: th1520: Increase tuning loop count to 128
+    - mm: create FOLIO_FLAG_FALSE and FOLIO_TYPE_OPS macros
+    - mm: support page_mapcount() on page_has_type() pages
+    - mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
+    - smb: client: Fix struct_group() usage in __packed structs
+    - smb3: missing lock when picking channel
+    - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result
+    - btrfs: fallback if compressed IO fails for ENOSPC
+    - btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range()
+    - btrfs: scrub: run relocation repair when/only needed
+    - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
+    - x86/tdx: Preserve shared bit on mprotect()
+    - cpu: Re-enable CPU mitigations by default for !X86 architectures
+    - [Config] updateconfigs for CPU_MITIGATIONS
+    - eeprom: at24: fix memory corruption race condition
+    - LoongArch: Fix callchain parse error with kernel tracepoint events
+    - LoongArch: Fix access error when read fault on a write-only VMA
+    - arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP
+    - arm64: dts: qcom: sm8450: Fix the msi-map entries
+    - arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
+    - dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
+    - dmaengine: xilinx: xdma: Fix wrong offsets in the buffers addresses in dma
+      descriptor
+    - dmaengine: xilinx: xdma: Fix synchronization issue
+    - drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
+    - drm/amdgpu: Assign correct bits for SDMA HDP flush
+    - drm/atomic-helper: fix parameter order in drm_format_conv_state_copy() call
+    - drm/amdgpu/pm: Remove gpu_od if it's an empty directory
+    - drm/amdgpu/umsch: don't execute umsch test when GPU is in reset/suspend
+    - drm/amdgpu: Fix leak when GPU memory allocation fails
+    - drm/amdkfd: Fix rescheduling of restore worker
+    - drm/amdkfd: Fix eviction fence handling
+    - irqchip/gic-v3-its: Prevent double free on error
+    - ACPI: CPPC: Use access_width over bit_width for system memory accesses
+    - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
+    - ACPI: CPPC: Fix access width used for PCC registers
+    - net/mlx5e: Advertise mlx5 ethernet driver updates sk_buff md_dst for MACsec
+    - ethernet: Add helper for assigning packet type when dest address does not
+      match device address
+    - net: b44: set pause params only when interface is up
+    - macsec: Enable devices to advertise whether they update sk_buff md_dst
+      during offloads
+    - macsec: Detect if Rx skb is macsec-related for offloading devices that
+      update md_dst
+    - stackdepot: respect __GFP_NOLOCKDEP allocation flag
+    - fbdev: fix incorrect address computation in deferred IO
+    - udp: preserve the connected status if only UDP cmsg
+    - mtd: limit OTP NVMEM cell parse to non-NAND devices
+    - mtd: diskonchip: work around ubsan link failure
+    - firmware: qcom: uefisecapp: Fix memory related IO errors and crashes
+    - phy: qcom: qmp-combo: Fix register base for QSERDES_DP_PHY_MODE
+    - phy: qcom: qmp-combo: Fix VCO div offset on v3
+    - mm: turn folio_test_hugetlb into a PageType
+    - mm: zswap: fix shrinker NULL crash with cgroup_disable=memory
+    - dmaengine: owl: fix register access functions
+    - dmaengine: tegra186: Fix residual calculation
+    - idma64: Don't try to serve interrupts when device is powered off
+    - soundwire: amd: fix for wake interrupt handling for clockstop mode
+    - phy: marvell: a3700-comphy: Fix hardcoded array size
+    - phy: freescale: imx8m-pcie: fix pcie link-up instability
+    - phy: rockchip-snps-pcie3: fix bifurcation on rk3588
+    - phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits
+    - phy: rockchip: naneng-combphy: Fix mux on rk3588
+    - phy: qcom: m31: match requested regulator name with dt schema
+    - dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue
+    - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
+    - riscv: Fix TASK_SIZE on 64-bit NOMMU
+    - riscv: Fix loading 64-bit NOMMU kernels past the start of RAM
+    - phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered
+    - dt-bindings: eeprom: at24: Fix ST M24C64-D compatible schema
+    - sched/eevdf: Always update V if se->on_rq when reweighting
+    - sched/eevdf: Fix miscalculation in reweight_entity() when se is not curr
+    - riscv: hwprobe: fix invalid sign extension for RISCV_HWPROBE_EXT_ZVFHMIN
+    - RISC-V: selftests: cbo: Ensure asm operands match constraints, take 2
+    - phy: qcom: qmp-combo: fix VCO div offset on v5_5nm and v6
+    - bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
+    - Bluetooth: hci_sync: Fix UAF in hci_acl_create_conn_sync
+    - Bluetooth: hci_sync: Fix UAF on create_le_conn_complete
+    - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync
+    - Linux 6.8.9
+
+  * amdgpu hangs on DCN 3.5 at bootup: RIP:
+    0010:dcn35_clk_mgr_construct+0x183/0x2210 [amdgpu] (LP: #2066233)
+    - drm/amd/display: Atom Integrated System Info v2_2 for DCN35
+
+  * [MTL] ACPI: PM: s2idle: Backport Linux ACPI s2idle patches to fix
+    suspend/resume issue (LP: #2069231)
+    - ACPI: PM: s2idle: Enable Low-Power S0 Idle MSFT UUID for non-AMD systems
+    - ACPI: PM: s2idle: Evaluate all Low-Power S0 Idle _DSM functions
+
+  * Removing legacy virtio-pci devices causes kernel panic (LP: #2067862)
+    - virtio-pci: Check if is_avq is NULL
+
+  * Mute/mic LEDs no function on ProBook 445/465 G11 (LP: #2069664)
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465 G11.
+
+  * Mute/mic LEDs no function on  ProBook 440/460 G11 (LP: #2067669)
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11.
+
+  * rtw89_8852ce - Lost WIFI connection after suspend  (LP: #2065128)
+    - wifi: rtw89: reset AFEDIG register in power off sequence
+    - wifi: rtw89: 8852c: refine power sequence to imporve power consumption
+
+  * CVE-2024-25742
+    - x86/sev: Harden #VC instruction emulation somewhat
+    - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler
+
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337) //
+    CVE-2024-35984
+    - i2c: smbus: fix NULL function pointer dereference
+
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337) //
+    CVE-2024-35990
+    - dma: xilinx_dpdma: Fix locking
+
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337) //
+    CVE-2024-35997
+    - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
+
+  * CVE-2024-36016
+    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
+
+  * CVE-2024-36008
+    - ipv4: check for NULL idev in ip_route_use_hint()
+
+  * CVE-2024-35992
+    - phy: marvell: a3700-comphy: Fix out of bounds read
+
+ -- Stefan Bader <stefan.bader@canonical.com>  Fri, 05 Jul 2024 10:31:38 +0200
+
+linux (6.8.0-38.38) noble; urgency=medium
+
+  * noble/linux: 6.8.0-38.38 -proposed tracker (LP: #2068318)
+
+  * race_sched in ubuntu_stress_smoke_test will cause kernel panic on 6.8 with
+    Azure Standard_A2_v2 instance (LP: #2068024)
+    - sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()
+
+  * Noble: btrfs: re-introduce 'norecovery' mount option (LP: #2068591)
+    - btrfs: re-introduce 'norecovery' mount option
+
+  * Fix system hang while entering suspend with AMD Navi3x graphics
+    (LP: #2063417)
+    - drm/amdgpu/mes: fix use-after-free issue
+
+  * Noble update: v6.8.8 upstream stable release (LP: #2068087)
+    - io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64()
+      failure
+    - drm/i915/cdclk: Fix voltage_level programming edge case
+    - Revert "vmgenid: emit uevent when VMGENID updates"
+    - SUNRPC: Fix rpcgss_context trace event acceptor field
+    - selftests/ftrace: Limit length in subsystem-enable tests
+    - random: handle creditable entropy from atomic process context
+    - scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING
+    - net: usb: ax88179_178a: avoid writing the mac address before first reading
+    - btrfs: do not wait for short bulk allocation
+    - btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
+    - r8169: fix LED-related deadlock on module removal
+    - r8169: add missing conditional compiling for call to r8169_remove_leds
+    - scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5
+    - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
+    - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
+    - netfilter: br_netfilter: skip conntrack input hook for promisc packets
+    - netfilter: nft_set_pipapo: constify lookup fn args where possible
+    - netfilter: nft_set_pipapo: walk over current view on netlink dump
+    - netfilter: flowtable: validate pppoe header
+    - netfilter: flowtable: incorrect pppoe tuple
+    - af_unix: Call manage_oob() for every skb in unix_stream_read_generic().
+    - af_unix: Don't peek OOB data without MSG_OOB.
+    - net: sparx5: flower: fix fragment flags handling
+    - net/mlx5: Lag, restore buckets number to default after hash LAG deactivation
+    - net/mlx5: Restore mistakenly dropped parts in register devlink flow
+    - net/mlx5e: Prevent deadlock while disabling aRFS
+    - net: change maximum number of UDP segments to 128
+    - octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation
+    - selftests/tcp_ao: Make RST tests less flaky
+    - selftests/tcp_ao: Zero-init tcp_ao_info_opt
+    - selftests/tcp_ao: Fix fscanf() call for format-security
+    - selftests/tcp_ao: Printing fixes to confirm with format-security
+    - net: stmmac: Apply half-duplex-less constraint for DW QoS Eth only
+    - net: stmmac: Fix max-speed being ignored on queue re-init
+    - net: stmmac: Fix IP-cores specific MAC capabilities
+    - ice: tc: check src_vsi in case of traffic from VF
+    - ice: tc: allow zero flags in parsing tc flower
+    - ice: Fix checking for unsupported keys on non-tunnel device
+    - tun: limit printing rate when illegal packet received by tun dev
+    - net: dsa: mt7530: fix mirroring frames received on local port
+    - net: dsa: mt7530: fix port mirroring for MT7988 SoC switch
+    - s390/ism: Properly fix receive message buffer allocation
+    - netfilter: nf_tables: missing iterator type in lookup walk
+    - netfilter: nf_tables: restore set elements when delete set fails
+    - gpiolib: swnode: Remove wrong header inclusion
+    - netfilter: nf_tables: fix memleak in map from abort path
+    - net/sched: Fix mirred deadlock on device recursion
+    - net: ethernet: mtk_eth_soc: fix WED + wifi reset
+    - ravb: Group descriptor types used in Rx ring
+    - net: ravb: Count packets instead of descriptors in R-Car RX path
+    - net: ravb: Allow RX loop to move past DMA mapping errors
+    - net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them
+    - NFSD: fix endianness issue in nfsd4_encode_fattr4
+    - RDMA/rxe: Fix the problem "mutex_destroy missing"
+    - RDMA/cm: Print the old state when cm_destroy_id gets timeout
+    - RDMA/mlx5: Fix port number for counter query in multi-port configuration
+    - perf annotate: Make sure to call symbol__annotate2() in TUI
+    - perf lock contention: Add a missing NULL check
+    - s390/qdio: handle deferred cc1
+    - s390/cio: fix race condition during online processing
+    - iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest
+    - iommufd: Add config needed for iommufd_fail_nth
+    - drm: nv04: Fix out of bounds access
+    - drm/v3d: Don't increment `enabled_ns` twice
+    - userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE
+    - thunderbolt: Introduce tb_port_reset()
+    - thunderbolt: Introduce tb_path_deactivate_hop()
+    - thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4
+      routers
+    - thunderbolt: Reset topology created by the boot firmware
+    - drm/panel: visionox-rm69299: don't unregister DSI device
+    - drm/radeon: make -fstrict-flex-arrays=3 happy
+    - ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4
+    - thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()
+    - platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes
+    - interconnect: qcom: x1e80100: Remove inexistent ACV_PERF BCM
+    - interconnect: Don't access req_list while it's being manipulated
+    - clk: Remove prepare_lock hold assertion in __clk_release()
+    - clk: Initialize struct clk_core kref earlier
+    - clk: Get runtime PM before walking tree during disable_unused
+    - clk: Get runtime PM before walking tree for clk_summary
+    - clk: mediatek: Do a runtime PM get on controllers during probe
+    - clk: mediatek: mt7988-infracfg: fix clocks for 2nd PCIe port
+    - selftests/powerpc/papr-vpd: Fix missing variable initialization
+    - x86/bugs: Fix BHI retpoline check
+    - x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
+    - block: propagate partition scanning errors to the BLKRRPART ioctl
+    - net/mlx5: E-switch, store eswitch pointer before registering devlink_param
+    - ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages
+    - ALSA: hda/tas2781: correct the register for pow calibrated data
+    - ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N
+    - ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC
+    - usb: misc: onboard_usb_hub: Disable the USB hub clock on failure
+    - misc: rtsx: Fix rts5264 driver status incorrect when card removed
+    - thunderbolt: Avoid notify PM core about runtime PM resume
+    - thunderbolt: Fix wake configurations after device unplug
+    - thunderbolt: Do not create DisplayPort tunnels on adapters of the same
+      router
+    - comedi: vmk80xx: fix incomplete endpoint checking
+    - serial: mxs-auart: add spinlock around changing cts state
+    - serial/pmac_zilog: Remove flawed mitigation for rx irq flood
+    - serial: 8250_dw: Revert: Do not reclock if already at correct rate
+    - serial: stm32: Return IRQ_NONE in the ISR if no handling happend
+    - serial: stm32: Reset .throttled state in .startup()
+    - serial: core: Fix regression when runtime PM is not enabled
+    - serial: core: Clearing the circular buffer before NULLifying it
+    - serial: core: Fix missing shutdown and startup for serial base port
+    - USB: serial: option: add Fibocom FM135-GL variants
+    - USB: serial: option: add support for Fibocom FM650/FG650
+    - USB: serial: option: add Lonsung U8300/U9300 product
+    - USB: serial: option: support Quectel EM060K sub-models
+    - USB: serial: option: add Rolling RW101-GL and RW135-GL support
+    - USB: serial: option: add Telit FN920C04 rmnet compositions
+    - Revert "usb: cdc-wdm: close race between read and workqueue"
+    - usb: dwc2: host: Fix dereference issue in DDMA completion flow.
+    - usb: Disable USB3 LPM at shutdown
+    - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport
+      error
+    - usb: typec: tcpm: Correct the PDO counting in pd_set
+    - mei: me: disable RPL-S on SPS and IGN firmwares
+    - speakup: Avoid crash on very long word
+    - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
+    - sched: Add missing memory barrier in switch_mm_cid
+    - KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible
+    - KVM: x86/pmu: Disable support for adaptive PEBS
+    - KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms
+    - KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes
+    - KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
+    - arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H
+    - arm64: hibernate: Fix level3 translation fault in swsusp_save()
+    - init/main.c: Fix potential static_command_line memory overflow
+    - mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly
+    - mm/userfaultfd: allow hugetlb change protection upon poison entry
+    - mm,swapops: update check in is_pfn_swap_entry for hwpoison entries
+    - mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled
+    - mm/shmem: inline shmem_is_huge() for disabled transparent hugepages
+    - fuse: fix leaked ENOSYS error on first statx call
+    - drm/amdkfd: Fix memory leak in create_process failure
+    - drm/amdgpu: remove invalid resource->start check v2
+    - drm/ttm: stop pooling cached NUMA pages v2
+    - drm/xe: Fix bo leak in intel_fb_bo_framebuffer_init
+    - drm/vmwgfx: Fix prime import/export
+    - drm/vmwgfx: Sort primary plane formats by order of preference
+    - drm/vmwgfx: Fix crtc's atomic check conditional
+    - nouveau: fix instmem race condition around ptr stores
+    - bootconfig: use memblock_free_late to free xbc memory to buddy
+    - Squashfs: check the inode number is not the invalid value of zero
+    - nilfs2: fix OOB in nilfs_set_de_type
+    - fork: defer linking file vma until vma is fully initialized
+    - net: dsa: mt7530: fix improper frames on all 25MHz and 40MHz XTAL MT7530
+    - net: dsa: mt7530: fix enabling EEE on MT7531 switch on all boards
+    - ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
+    - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
+    - ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
+    - ksmbd: common: use struct_group_attr instead of struct_group for
+      network_open_info
+    - thunderbolt: Reset only non-USB4 host routers in resume
+    - Linux 6.8.8
+
+  * Fix inaudible HDMI/DP audio on USB-C MST dock (LP: #2064689)
+    - drm/i915/audio: Fix audio time stamp programming for DP
+
+  * Add Cirrus Logic CS35L56 amplifier support (LP: #2062135)
+    - ALSA: hda: realtek: Re-work CS35L41 fixups to re-use for other amps
+    - ALSA: hda/realtek: Add quirks for HP G11 Laptops using CS35L56
+
+  * net:fib_rule_tests.sh in ubuntu_kselftests_net fails on Noble (LP: #2066332)
+    - Revert "UBUNTU: SAUCE: selftests: net: fix "from" match test in
+      fib_rule_tests.sh"
+
+  * mtk_t7xx WWAN module fails to probe with: Invalid device status 0x1
+    (LP: #2049358)
+    - Revert "UBUNTU: SAUCE: net: wwan: t7xx: PCIe reset rescan"
+    - Revert "UBUNTU: SAUCE: net: wwan: t7xx: Add AP CLDMA"
+    - net: wwan: t7xx: Add AP CLDMA
+    - wwan: core: Add WWAN fastboot port type
+    - net: wwan: t7xx: Add sysfs attribute for device state machine
+    - net: wwan: t7xx: Infrastructure for early port configuration
+    - net: wwan: t7xx: Add fastboot WWAN port
+
+  * Pull-request to address TPM bypass issue (LP: #2037688)
+    - [Config]: Configure TPM drivers as builtins for arm64 in annotations
+
+  * re-enable Ubuntu FAN in the Noble kernel (LP: #2064508)
+    - SAUCE: fan: add VXLAN implementation
+    - SAUCE: fan: Fix NULL pointer dereference
+    - SAUCE: fan: support vxlan strict length validation
+
+  * update for V3 kernel bits and improved multiple fan slice support
+    (LP: #1470091) // re-enable Ubuntu FAN in the Noble kernel (LP: #2064508)
+    - SAUCE: fan: tunnel multiple mapping mode (v3)
+
+  * TCP memory  leak, slow network (arm64) (LP: #2045560)
+    - net: make SK_MEMORY_PCPU_RESERV tunable
+    - net: fix sk_memory_allocated_{add|sub} vs softirqs
+
+  * panel flickering after the i915.psr2 is enabled (LP: #2046315)
+    - drm/i915/alpm: Add ALPM register definitions
+    - drm/i915/psr: Add alpm_parameters struct
+    - drm/i915/alpm: Calculate ALPM Entry check
+    - drm/i915/alpm: Alpm aux wake configuration for lnl
+    - drm/i915/display: Make intel_dp_aux_fw_sync_len available for PSR code
+    - drm/i915/psr: Improve fast and IO wake lines calculation
+    - drm/i915/psr: Calculate IO wake and fast wake lines for DISPLAY_VER < 12
+    - drm/i915/display: Increase number of fast wake precharge pulses
+
+  * I2C HID device sometimes fails to initialize causing touchpad to not work
+    (LP: #2061040)
+    - HID: i2c-hid: Revert to await reset ACK before reading report descriptor
+
+  * Fix the RTL8852CE BT FW Crash based on SER false alarm (LP: #2060904)
+    - wifi: rtw89: disable txptctrl IMR to avoid flase alarm
+    - wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of
+      firmware command
+
+  * [X13s] Fingerprint reader is not working (LP: #2065376)
+    - SAUCE: arm64: dts: qcom: sc8280xp: Add USB DWC3 Multiport controller
+    - SAUCE: arm64: dts: qcom: sc8280xp-x13s: enable USB MP and fingerprint reader
+
+  * Fix random HuC/GuC initialization failure of Intel i915 driver
+    (LP: #2061049)
+    - drm/i915/huc: Allow for very slow HuC loading
+
+  * Add support of TAS2781 amp of audio (LP: #2064064)
+    - ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad
+      ICE-1
+
+  * Noble update: v6.8.7 upstream stable release (LP: #2065912)
+    - smb3: fix Open files on server counter going negative
+    - ata: libata-core: Allow command duration limits detection for ACS-4 drives
+    - ata: libata-scsi: Fix ata_scsi_dev_rescan() error path
+    - drm/amdgpu/vpe: power on vpe when hw_init
+    - batman-adv: Avoid infinite loop trying to resize local TT
+    - ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE
+    - ceph: switch to use cap_delay_lock for the unlink delay list
+    - virtio_net: Do not send RSS key if it is not supported
+    - arm64: tlb: Fix TLBI RANGE operand
+    - ARM: dts: imx7s-warp: Pass OV2680 link-frequencies
+    - raid1: fix use-after-free for original bio in raid1_write_request()
+    - ring-buffer: Only update pages_touched when a new page is touched
+    - Bluetooth: Fix memory leak in hci_req_sync_complete()
+    - drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11
+    - platform/chrome: cros_ec_uart: properly fix race condition
+    - ACPI: scan: Do not increase dep_unmet for already met dependencies
+    - PM: s2idle: Make sure CPUs will wakeup directly on resume
+    - media: cec: core: remove length check of Timer Status
+    - btrfs: tests: allocate dummy fs_info and root in test_find_delalloc()
+    - ARM: OMAP2+: fix bogus MMC GPIO labels on Nokia N8x0
+    - ARM: OMAP2+: fix N810 MMC gpiod table
+    - mmc: omap: fix broken slot switch lookup
+    - mmc: omap: fix deferred probe
+    - mmc: omap: restore original power up/down steps
+    - ARM: OMAP2+: fix USB regression on Nokia N8x0
+    - firmware: arm_ffa: Fix the partition ID check in ffa_notification_info_get()
+    - firmware: arm_scmi: Make raw debugfs entries non-seekable
+    - cxl/mem: Fix for the index of Clear Event Record Handle
+    - cxl/core/regs: Fix usage of map->reg_type in cxl_decode_regblock() before
+      assigned
+    - arm64: dts: freescale: imx8mp-venice-gw72xx-2x: fix USB vbus regulator
+    - arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix USB vbus regulator
+    - drm/msm: Add newlines to some debug prints
+    - drm/msm/dpu: don't allow overriding data from catalog
+    - drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more
+      sensible
+    - dt-bindings: display/msm: sm8150-mdss: add DP node
+    - arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order
+    - cxl/core: Fix initialization of mbox_cmd.size_out in get event
+    - Revert "drm/qxl: simplify qxl_fence_wait"
+    - nouveau: fix function cast warning
+    - drm/msm/adreno: Set highest_bank_bit for A619
+    - scsi: hisi_sas: Modify the deadline for ata_wait_after_reset()
+    - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
+    - net: openvswitch: fix unwanted error log on timeout policy probing
+    - u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
+    - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
+    - octeontx2-pf: Fix transmit scheduler resource leak
+    - block: fix q->blkg_list corruption during disk rebind
+    - lib: checksum: hide unused expected_csum_ipv6_magic[]
+    - geneve: fix header validation in geneve[6]_xmit_skb
+    - s390/ism: fix receive message buffer allocation
+    - bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()
+    - bnxt_en: Fix error recovery for RoCE ulp client
+    - bnxt_en: Reset PTP tx_avail after possible firmware reset
+    - ACPI: bus: allow _UID matching for integer zero
+    - base/node / ACPI: Enumerate node access class for 'struct access_coordinate'
+    - ACPI: HMAT: Introduce 2 levels of generic port access class
+    - ACPI: HMAT / cxl: Add retrieval of generic port coordinates for both access
+      classes
+    - cxl: Split out combine_coordinates() for common shared usage
+    - cxl: Split out host bridge access coordinates
+    - cxl: Remove checking of iter in cxl_endpoint_get_perf_coordinates()
+    - cxl: Fix retrieving of access_coordinates in PCIe path
+    - net: ks8851: Inline ks8851_rx_skb()
+    - net: ks8851: Handle softirqs at the end of IRQ thread to fix hang
+    - af_unix: Clear stale u->oob_skb.
+    - octeontx2-af: Fix NIX SQ mode and BP config
+    - ipv6: fib: hide unused 'pn' variable
+    - ipv4/route: avoid unused-but-set-variable warning
+    - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
+    - pds_core: use pci_reset_function for health reset
+    - pds_core: Fix pdsc_check_pci_health function to use work thread
+    - Bluetooth: ISO: Align broadcast sync_timeout with connection timeout
+    - Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters are unset
+    - Bluetooth: hci_sync: Use QoS to determine which PHY to scan
+    - Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY
+    - Bluetooth: SCO: Fix not validating setsockopt user input
+    - Bluetooth: RFCOMM: Fix not validating setsockopt user input
+    - Bluetooth: L2CAP: Fix not validating setsockopt user input
+    - Bluetooth: ISO: Fix not validating setsockopt user input
+    - Bluetooth: hci_sock: Fix not validating setsockopt user input
+    - Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit
+    - netfilter: complete validation of user input
+    - net/mlx5: SF, Stop waiting for FW as teardown was called
+    - net/mlx5: Register devlink first under devlink lock
+    - net/mlx5: offset comp irq index in name by one
+    - net/mlx5: Properly link new fs rules into the tree
+    - net/mlx5: Correctly compare pkt reformat ids
+    - net/mlx5e: RSS, Block changing channels number when RXFH is configured
+    - net/mlx5e: Fix mlx5e_priv_init() cleanup flow
+    - net/mlx5e: HTB, Fix inconsistencies with QoS SQs number
+    - net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit
+    - net: sparx5: fix wrong config being used when reconfiguring PCS
+    - Revert "s390/ism: fix receive message buffer allocation"
+    - net: dsa: mt7530: trap link-local frames regardless of ST Port State
+    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
+    - af_unix: Fix garbage collector racing against connect()
+    - net: ena: Fix potential sign extension issue
+    - net: ena: Wrong missing IO completions check order
+    - net: ena: Fix incorrect descriptor free behavior
+    - net: ena: Set tx_info->xdpf value to NULL
+    - drm/xe/display: Fix double mutex initialization
+    - drm/xe/hwmon: Cast result to output precision on left shift of operand
+    - tracing: hide unused ftrace_event_id_fops
+    - iommu/vt-d: Fix wrong use of pasid config
+    - iommu/vt-d: Allocate local memory for page request queue
+    - iommu/vt-d: Fix WARN_ON in iommu probe path
+    - io_uring: refactor DEFER_TASKRUN multishot checks
+    - io_uring: disable io-wq execution of multishot NOWAIT requests
+    - btrfs: qgroup: correctly model root qgroup rsv in convert
+    - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
+    - btrfs: record delayed inode root in transaction
+    - btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans
+    - io_uring/net: restore msg_control on sendzc retry
+    - kprobes: Fix possible use-after-free issue on kprobe registration
+    - fs/proc: remove redundant comments from /proc/bootconfig
+    - fs/proc: Skip bootloader comment if no embedded kernel parameters
+    - scsi: sg: Avoid sg device teardown race
+    - scsi: sg: Avoid race in error handling & drop bogus warn
+    - accel/ivpu: Check return code of ipc->lock init
+    - accel/ivpu: Fix PCI D0 state entry in resume
+    - accel/ivpu: Put NPU back to D3hot after failed resume
+    - accel/ivpu: Return max freq for DRM_IVPU_PARAM_CORE_CLOCK_RATE
+    - accel/ivpu: Fix deadlock in context_xa
+    - drm/vmwgfx: Enable DMA mappings with SEV
+    - drm/i915/vrr: Disable VRR when using bigjoiner
+    - drm/amdkfd: Reset GPU on queue preemption failure
+    - drm/ast: Fix soft lockup
+    - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
+    - drm/client: Fully protect modes[] with dev->mode_config.mutex
+    - drm/msm/dp: fix runtime PM leak on disconnect
+    - drm/msm/dp: fix runtime PM leak on connect failure
+    - drm/amdgpu/umsch: reinitialize write pointer in hw init
+    - arm64: dts: imx8qm-ss-dma: fix can lpcg indices
+    - arm64: dts: imx8-ss-dma: fix can lpcg indices
+    - arm64: dts: imx8-ss-dma: fix adc lpcg indices
+    - arm64: dts: imx8-ss-conn: fix usb lpcg indices
+    - arm64: dts: imx8-ss-dma: fix pwm lpcg indices
+    - arm64: dts: imx8-ss-lsio: fix pwm lpcg indices
+    - arm64: dts: imx8-ss-dma: fix spi lpcg indices
+    - vhost: Add smp_rmb() in vhost_vq_avail_empty()
+    - vhost: Add smp_rmb() in vhost_enable_notify()
+    - perf/x86: Fix out of range data
+    - x86/cpu: Actually turn off mitigations by default for
+      SPECULATION_MITIGATIONS=n
+    - selftests/timers/posix_timers: Reimplement check_timer_distribution()
+    - selftests: timers: Fix posix_timers ksft_print_msg() warning
+    - selftests: timers: Fix abs() warning in posix_timers test
+    - selftests: kselftest: Mark functions that unconditionally call exit() as
+      __noreturn
+    - x86/apic: Force native_apic_mem_read() to use the MOV instruction
+    - irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
+    - selftests: kselftest: Fix build failure with NOLIBC
+    - kernfs: annotate different lockdep class for of->mutex of writable files
+    - x86/bugs: Fix return type of spectre_bhi_state()
+    - x86/bugs: Fix BHI documentation
+    - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
+    - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
+    - x86/bugs: Fix BHI handling of RRSBA
+    - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
+    - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto
+    - [Config] updateconfigs to remove obsolete SPECTRE_BHI_AUTO
+    - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with
+      CONFIG_MITIGATION_SPECTRE_BHI
+    - [Config] updateconfigs to enable new MITIGATION_SPECTRE_BHI
+    - drm/i915/cdclk: Fix CDCLK programming order when pipes are active
+    - drm/i915/psr: Disable PSR when bigjoiner is used
+    - drm/i915: Disable port sync when bigjoiner is used
+    - drm/i915: Disable live M/N updates when using bigjoiner
+    - drm/amdgpu: Reset dGPU if suspend got aborted
+    - drm/amdgpu: always force full reset for SOC21
+    - drm/amdgpu: fix incorrect number of active RBs for gfx11
+    - drm/amdgpu: differentiate external rev id for gfx 11.5.0
+    - drm/amd/display: Program VSC SDP colorimetry for all DP sinks >= 1.4
+    - drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST
+    - drm/amd/display: Do not recursively call manual trigger programming
+    - drm/amd/display: Return max resolution supported by DWB
+    - drm/amd/display: always reset ODM mode in context when adding first plane
+    - drm/amd/display: fix disable otg wa logic in DCN316
+    - Linux 6.8.7
+
+  * Noble update: v6.8.6 upstream stable release (LP: #2065899)
+    - amdkfd: use calloc instead of kzalloc to avoid integer overflow
+    - wifi: ath9k: fix LNA selection in ath_ant_try_scan()
+    - wifi: rtw89: fix null pointer access when abort scan
+    - bnx2x: Fix firmware version string character counts
+    - net: stmmac: dwmac-starfive: Add support for JH7100 SoC
+    - net: phy: phy_device: Prevent nullptr exceptions on ISR
+    - wifi: rtw89: pci: validate RX tag for RXQ and RPQ
+    - wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor
+    - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
+    - wifi: iwlwifi: pcie: Add the PCI device id for new hardware
+    - arm64: dts: qcom: qcm6490-idp: Add definition for three LEDs
+    - net: dsa: qca8k: put MDIO controller OF node if unavailable
+    - arm64: dts: qcom: qrb2210-rb1: disable cluster power domains
+    - printk: For @suppress_panic_printk check for other CPU in panic
+    - panic: Flush kernel log buffer at the end
+    - dump_stack: Do not get cpu_sync for panic CPU
+    - wifi: iwlwifi: pcie: Add new PCI device id and CNVI
+    - cpuidle: Avoid potential overflow in integer multiplication
+    - ARM: dts: rockchip: fix rk3288 hdmi ports node
+    - ARM: dts: rockchip: fix rk322x hdmi ports node
+    - arm64: dts: rockchip: fix rk3328 hdmi ports node
+    - arm64: dts: rockchip: fix rk3399 hdmi ports node
+    - net: add netdev_lockdep_set_classes() to virtual drivers
+    - arm64: dts: qcom: qcs6490-rb3gen2: Declare GCC clocks protected
+    - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
+    - pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain
+    - ACPI: resource: Add IRQ override quirk for ASUS ExpertBook B2502FBA
+    - ionic: set adminq irq affinity
+    - net: skbuff: add overflow debug check to pull/push helpers
+    - firmware: tegra: bpmp: Return directly after a failed kzalloc() in
+      get_filename()
+    - wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro
+    - wifi: mt76: mt7915: add locking for accessing mapped registers
+    - wifi: mt76: mt7996: disable AMSDU for non-data frames
+    - wifi: mt76: mt7996: add locking for accessing mapped registers
+    - ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of
+      CONFIG_X86_ANDROID_TABLETS
+    - ACPI: x86: Add DELL0501 handling to acpi_quirk_skip_serdev_enumeration()
+    - pstore/zone: Add a null pointer check to the psz_kmsg_read
+    - tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
+    - net: pcs: xpcs: Return EINVAL in the internal methods
+    - dma-direct: Leak pages on dma_set_decrypted() failure
+    - wifi: ath11k: decrease MHI channel buffer length to 8KB
+    - iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev
+    - cpufreq: Don't unregister cpufreq cooling on CPU hotplug
+    - overflow: Allow non-type arg to type_max() and type_min()
+    - wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm
+    - wifi: cfg80211: check A-MSDU format more carefully
+    - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
+    - btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
+    - btrfs: send: handle path ref underflow in header iterate_inode_ref()
+    - ice: use relative VSI index for VFs instead of PF VSI number
+    - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
+    - netdev: let netlink core handle -EMSGSIZE errors
+    - Bluetooth: btintel: Fix null ptr deref in btintel_read_version
+    - Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922
+    - Bluetooth: Add new quirk for broken read key length on ATS2851
+    - drm/vc4: don't check if plane->state->fb == state->fb
+    - drm/ci: uprev mesa version: fix kdl commit fetch
+    - drm/amdgpu: Skip do PCI error slot reset during RAS recovery
+    - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
+    - drm: panel-orientation-quirks: Add quirk for GPD Win Mini
+    - ASoC: SOF: amd: Optimize quirk for Valve Galileo
+    - drm/ttm: return ENOSPC from ttm_bo_mem_space v3
+    - scsi: ufs: qcom: Avoid re-init quirk when gears match
+    - drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz
+    - pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
+    - sysv: don't call sb_bread() with pointers_lock held
+    - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
+    - drm/amd/display: Disable idle reallow as part of command/gpint execution
+    - isofs: handle CDs with bad root inode but good Joliet root directory
+    - ASoC: Intel: sof_rt5682: dmi quirk cleanup for mtl boards
+    - ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710)
+      laptops
+    - rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()
+    - rcu-tasks: Repair RCU Tasks Trace quiescence check
+    - Julia Lawall reported this null pointer dereference, this should fix it.
+    - media: sta2x11: fix irq handler cast
+    - ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block
+      counter
+    - drm/panel: simple: Add BOE BP082WX1-100 8.2" panel
+    - x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o
+    - ASoC: Intel: avs: Populate board selection with new I2S entries
+    - ext4: add a hint for block bitmap corrupt state in mb_groups
+    - ext4: forbid commit inconsistent quota data when errors=remount-ro
+    - drm/amd/display: Fix nanosec stat overflow
+    - accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings
+    - i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC
+    - HID: input: avoid polling stylus battery on Chromebook Pompom
+    - drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
+    - drm: Check output polling initialized before disabling
+    - drm: Check polling initialized before enabling in
+      drm_helper_probe_single_connector_modes
+    - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned
+      int
+    - PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge
+    - Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
+    - libperf evlist: Avoid out-of-bounds access
+    - crypto: iaa - Fix async_disable descriptor leak
+    - input/touchscreen: imagis: Correct the maximum touch area value
+    - drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09
+    - block: prevent division by zero in blk_rq_stat_sum()
+    - RDMA/cm: add timeout to cm_destroy_id wait
+    - Input: imagis - use FIELD_GET where applicable
+    - Input: allocate keycode for Display refresh rate toggle
+    - platform/x86: acer-wmi: Add support for Acer PH16-71
+    - platform/x86: acer-wmi: Add predator_v4 module parameter
+    - platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi
+      Vi8 tablet
+    - perf/x86/amd/lbr: Discard erroneous branch entries
+    - ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9
+    - ktest: force $buildonly = 1 for 'make_warnings_file' test type
+    - Input: xpad - add support for Snakebyte GAMEPADs
+    - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent
+      environment
+    - tools: iio: replace seekdir() in iio_generic_buffer
+    - bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state
+    - kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in
+      kernfs_find_and_get_node_by_id()
+    - usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk
+    - thunderbolt: Calculate DisplayPort tunnel bandwidth after DPRX capabilities
+      read
+    - usb: gadget: uvc: refactor the check for a valid buffer in the pump worker
+    - usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR
+    - usb: typec: ucsi: Limit read size on v1.2
+    - serial: 8250_of: Drop quirk fot NPCM from 8250_port
+    - thunderbolt: Keep the domain powered when USB4 port is in redrive mode
+    - usb: typec: tcpci: add generic tcpci fallback compatible
+    - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
+    - ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE
+    - thermal/of: Assume polling-delay(-passive) 0 when absent
+    - ASoC: soc-core.c: Skip dummy codec when adding platforms
+    - x86/xen: attempt to inflate the memory balloon on PVH
+    - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
+    - io_uring: clear opcode specific data for an early failure
+    - modpost: fix null pointer dereference
+    - drivers/nvme: Add quirks for device 126f:2262
+    - fbmon: prevent division by zero in fb_videomode_from_videomode()
+    - ALSA: hda/realtek: Add quirks for some Clevo laptops
+    - drm/amdgpu: Init zone device and drm client after mode-1 reset on reload
+    - gcc-plugins/stackleak: Avoid .head.text section
+    - media: mediatek: vcodec: Fix oops when HEVC init fails
+    - media: mediatek: vcodec: adding lock to protect decoder context list
+    - media: mediatek: vcodec: adding lock to protect encoder context list
+    - randomize_kstack: Improve entropy diffusion
+    - platform/x86/intel/hid: Don't wake on 5-button releases
+    - platform/x86: intel-vbtn: Update tablet mode switch at end of probe
+    - nouveau: fix devinit paths to only handle display on GSP.
+    - Bluetooth: btintel: Fixe build regression
+    - net: mpls: error out if inner headers are not set
+    - VMCI: Fix possible memcpy() run-time warning in
+      vmci_datagram_invoke_guest_handler()
+    - x86/vdso: Fix rethunk patching for vdso-image-x32.o too
+    - Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in
+      amdgpu_device_init()"
+    - Linux 6.8.6
+
+  * Noble update: v6.8.5 upstream stable release (LP: #2065400)
+    - scripts/bpf_doc: Use silent mode when exec make cmd
+    - xsk: Don't assume metadata is always requested in TX completion
+    - s390/bpf: Fix bpf_plt pointer arithmetic
+    - bpf, arm64: fix bug in BPF_LDX_MEMSX
+    - dma-buf: Fix NULL pointer dereference in sanitycheck()
+    - arm64: bpf: fix 32bit unconditional bswap
+    - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
+    - nfsd: Fix error cleanup path in nfsd_rename()
+    - tools: ynl: fix setting presence bits in simple nests
+    - mlxbf_gige: stop PHY during open() error paths
+    - wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
+    - wifi: iwlwifi: mvm: rfi: fix potential response leaks
+    - wifi: iwlwifi: mvm: include link ID when releasing frames
+    - ALSA: hda: cs35l56: Set the init_done flag before component_add()
+    - ice: Refactor FW data type and fix bitmap casting issue
+    - ice: fix memory corruption bug with suspend and rebuild
+    - ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
+    - igc: Remove stale comment about Tx timestamping
+    - drm/xe: Remove unused xe_bo->props struct
+    - drm/xe: Add exec_queue.sched_props.job_timeout_ms
+    - drm/xe/guc_submit: use jiffies for job timeout
+    - drm/xe/queue: fix engine_class bounds check
+    - drm/xe/device: fix XE_MAX_GT_PER_TILE check
+    - drm/xe/device: fix XE_MAX_TILES_PER_DEVICE check
+    - dpll: indent DPLL option type by a tab
+    - s390/qeth: handle deferred cc1
+    - net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
+    - tcp: properly terminate timers for kernel sockets
+    - net: wwan: t7xx: Split 64bit accesses to fix alignment issues
+    - drm/rockchip: vop2: Remove AR30 and AB30 format support
+    - selftests: vxlan_mdb: Fix failures with old libnet
+    - gpiolib: Fix debug messaging in gpiod_find_and_request()
+    - ACPICA: debugger: check status of acpi_evaluate_object() in
+      acpi_db_walk_for_fields()
+    - net: hns3: fix index limit to support all queue stats
+    - net: hns3: fix kernel crash when devlink reload during pf initialization
+    - net: hns3: mark unexcuted loopback test result as UNEXECUTED
+    - tls: recv: process_rx_list shouldn't use an offset with kvec
+    - tls: adjust recv return with async crypto and failed copy to userspace
+    - tls: get psock ref after taking rxlock to avoid leak
+    - mlxbf_gige: call request_irq() after NAPI initialized
+    - drm/amd/display: Update P010 scaling cap
+    - drm/amd/display: Send DTBCLK disable message on first commit
+    - bpf: Protect against int overflow for stack access size
+    - cifs: Fix duplicate fscache cookie warnings
+    - netfilter: nf_tables: reject destroy command to remove basechain hooks
+    - netfilter: nf_tables: reject table flag and netdev basechain updates
+    - netfilter: nf_tables: skip netdev hook unregistration if table is dormant
+    - iommu: Validate the PASID in iommu_attach_device_pasid()
+    - net: bcmasp: Bring up unimac after PHY link up
+    - net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips
+    - Octeontx2-af: fix pause frame configuration in GMP mode
+    - inet: inet_defrag: prevent sk release while still in use
+    - drm/i915: Stop doing double audio enable/disable on SDVO and g4x+ DP
+    - drm/i915/display: Disable AuxCCS framebuffers if built for Xe
+    - drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74
+    - drm/i915/mtl: Update workaround 14018575942
+    - drm/i915: Do not print 'pxp init failed with 0' when it succeed
+    - dm integrity: fix out-of-range warning
+    - modpost: do not make find_tosym() return NULL
+    - kbuild: make -Woverride-init warnings more consistent
+    - mm/treewide: replace pud_large() with pud_leaf()
+    - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be
+      mapped."
+    - gpio: cdev: sanitize the label before requesting the interrupt
+    - RISC-V: KVM: Fix APLIC setipnum_le/be write emulation
+    - RISC-V: KVM: Fix APLIC in_clrip[x] read emulation
+    - KVM: arm64: Fix host-programmed guest events in nVHE
+    - KVM: arm64: Fix out-of-IPA space translation fault handling
+    - selinux: avoid dereference of garbage after mount failure
+    - r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
+    - x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
+    - x86/bpf: Fix IP after emitting call depth accounting
+    - Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
+    - arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
+    - Bluetooth: qca: fix device-address endianness
+    - Bluetooth: add quirk for broken address properties
+    - Bluetooth: hci_event: set the conn encrypted before conn establishes
+    - Bluetooth: Fix TOCTOU in HCI debugfs implementation
+    - netfilter: nf_tables: release batch on table validation from abort path
+    - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
+    - selftests: mptcp: join: fix dev in check_endpoint
+    - net/rds: fix possible cp null dereference
+    - net: usb: ax88179_178a: avoid the interface always configured as random
+      address
+    - net: mana: Fix Rx DMA datasize and skb_over_panic
+    - vsock/virtio: fix packet delivery to tap device
+    - netfilter: nf_tables: reject new basechain after table flag update
+    - netfilter: nf_tables: flush pending destroy work before exit_net release
+    - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
+    - netfilter: nf_tables: discard table flag update with pending basechain
+      deletion
+    - netfilter: validate user input for expected length
+    - vboxsf: Avoid an spurious warning if load_nls_xxx() fails
+    - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
+    - mptcp: prevent BPF accessing lowat from a subflow socket.
+    - x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for
+      !SRSO
+    - KVM: arm64: Use TLBI_TTL_UNKNOWN in __kvm_tlb_flush_vmid_range()
+    - KVM: arm64: Ensure target address is granule-aligned for range TLBI
+    - net/sched: act_skbmod: prevent kernel-infoleak
+    - net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45()
+    - net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
+    - net: stmmac: fix rx queue priority assignment
+    - net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping
+    - net: txgbe: fix i2c dev name cannot match clkdev
+    - net: fec: Set mac_managed_pm during probe
+    - net: phy: micrel: Fix potential null pointer dereference
+    - net: dsa: mv88e6xxx: fix usable ports on 88e6020
+    - selftests: net: gro fwd: update vxlan GRO test expectations
+    - gro: fix ownership transfer
+    - idpf: fix kernel panic on unknown packet types
+    - ice: fix enabling RX VLAN filtering
+    - i40e: Fix VF MAC filter removal
+    - tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-
+      wildcard addresses.
+    - erspan: make sure erspan_base_hdr is present in skb->head
+    - selftests: reuseaddr_conflict: add missing new line at the end of the output
+    - tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6) non-
+      wildcard addresses.
+    - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
+    - e1000e: Workaround for sporadic MDI error on Meteor Lake systems
+    - ipv6: Fix infinite recursion in fib6_dump_done().
+    - mlxbf_gige: stop interface during shutdown
+    - r8169: skip DASH fw status checks when DASH is disabled
+    - udp: do not accept non-tunnel GSO skbs landing in a tunnel
+    - udp: do not transition UDP GRO fraglist partial checksums to unnecessary
+    - udp: prevent local UDP tunnel packets from being GROed
+    - octeontx2-af: Fix issue with loading coalesced KPU profiles
+    - octeontx2-pf: check negative error code in otx2_open()
+    - octeontx2-af: Add array index check
+    - i40e: fix i40e_count_filters() to count only active/new filters
+    - i40e: fix vf may be used uninitialized in this function warning
+    - i40e: Enforce software interrupt during busy-poll exit
+    - drm/amd: Flush GFXOFF requests in prepare stage
+    - e1000e: Minor flow correction in e1000_shutdown function
+    - e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue
+    - mean_and_variance: Drop always failing tests
+    - net: ravb: Let IP-specific receive function to interrogate descriptors
+    - net: ravb: Always process TX descriptor ring
+    - net: ravb: Always update error counters
+    - KVM: SVM: Use unsigned integers when dealing with ASIDs
+    - KVM: SVM: Add support for allowing zero SEV ASIDs
+    - selftests: mptcp: connect: fix shellcheck warnings
+    - selftests: mptcp: use += operator to append strings
+    - mptcp: don't account accept() of non-MPC client as fallback to TCP
+    - 9p: Fix read/write debug statements to report server reply
+    - ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl()
+    - ASoC: cs42l43: Correct extraction of data pointer in suspend/resume
+    - riscv: mm: Fix prototype to avoid discarding const
+    - riscv: hwprobe: do not produce frtace relocation
+    - drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported
+    - block: count BLK_OPEN_RESTRICT_WRITES openers
+    - RISC-V: Update AT_VECTOR_SIZE_ARCH for new AT_MINSIGSTKSZ
+    - ASoC: amd: acp: fix for acp pdm configuration check
+    - regmap: maple: Fix cache corruption in regcache_maple_drop()
+    - ALSA: hda: cs35l56: Add ACPI device match tables
+    - drm/panfrost: fix power transition timeout warnings
+    - nouveau/uvmm: fix addr/range calcs for remap operations
+    - drm/prime: Unbreak virtgpu dma-buf export
+    - ASoC: rt5682-sdw: fix locking sequence
+    - ASoC: rt711-sdca: fix locking sequence
+    - ASoC: rt711-sdw: fix locking sequence
+    - ASoC: rt712-sdca-sdw: fix locking sequence
+    - ASoC: rt722-sdca-sdw: fix locking sequence
+    - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
+    - spi: s3c64xx: Extract FIFO depth calculation to a dedicated macro
+    - spi: s3c64xx: sort headers alphabetically
+    - spi: s3c64xx: explicitly include <linux/bits.h>
+    - spi: s3c64xx: remove else after return
+    - spi: s3c64xx: define a magic value
+    - spi: s3c64xx: allow full FIFO masks
+    - spi: s3c64xx: determine the fifo depth only once
+    - spi: s3c64xx: Use DMA mode from fifo size
+    - ASoC: amd: acp: fix for acp_init function error handling
+    - regmap: maple: Fix uninitialized symbol 'ret' warnings
+    - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
+    - scsi: mylex: Fix sysfs buffer lengths
+    - scsi: sd: Unregister device if device_add_disk() failed in sd_probe()
+    - Revert "ALSA: emu10k1: fix synthesizer sample playback position and caching"
+    - drm/i915/dp: Fix DSC state HW readout for SST connectors
+    - cifs: Fix caching to try to do open O_WRONLY as rdwr on server
+    - spi: mchp-pci1xxx: Fix a possible null pointer dereference in
+      pci1xxx_spi_probe
+    - s390/pai: fix sampling event removal for PMU device driver
+    - thermal: gov_power_allocator: Allow binding without cooling devices
+    - thermal: gov_power_allocator: Allow binding without trip points
+    - drm/i915/gt: Limit the reserved VM space to only the platforms that need it
+    - ata: sata_mv: Fix PCI device ID table declaration compilation warning
+    - ASoC: SOF: amd: fix for false dsp interrupts
+    - SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
+    - riscv: use KERN_INFO in do_trap
+    - riscv: Fix warning by declaring arch_cpu_idle() as noinstr
+    - riscv: Disable preemption when using patch_map()
+    - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
+    - lib/stackdepot: move stack_record struct definition into the header
+    - stackdepot: rename pool_index to pool_index_plus_1
+    - x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk
+    - Revert "drm/amd/display: Send DTBCLK disable message on first commit"
+    - gpio: cdev: check for NULL labels when sanitizing them for irqs
+    - gpio: cdev: fix missed label sanitizing in debounce_setup()
+    - ksmbd: don't send oplock break if rename fails
+    - ksmbd: validate payload size in ipc response
+    - ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
+    - ALSA: hda: Add pplcllpl/u members to hdac_ext_stream
+    - ALSA: hda/realtek - Fix inactive headset mic jack
+    - ALSA: hda/realtek: Add sound quirks for Lenovo Legion slim 7 16ARHA7 models
+    - ALSA: hda/realtek: cs35l41: Support ASUS ROG G634JYR
+    - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with
+      microphone
+    - io_uring/kbuf: get rid of lower BGID lists
+    - io_uring/kbuf: get rid of bl->is_ready
+    - io_uring/kbuf: protect io_buffer_list teardown with a reference
+    - io_uring/rw: don't allow multishot reads without NOWAIT support
+    - io_uring: use private workqueue for exit work
+    - io_uring/kbuf: hold io_buffer_list reference over mmap
+    - ASoC: SOF: Add dsp_max_burst_size_in_ms member to snd_sof_pcm_stream
+    - ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs
+    - ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint
+    - ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)
+    - ASoC: SOF: Intel: mtl/lnl: Use the generic get_stream_position callback
+    - ASoC: SOF: Introduce a new callback pair to be used for PCM delay reporting
+    - ASoC: SOF: Intel: Set the dai/host get frame/byte counter callbacks
+    - ASoC: SOF: Intel: hda-common-ops: Do not set the get_stream_position
+      callback
+    - ASoC: SOF: ipc4-pcm: Use the snd_sof_pcm_get_dai_frame_counter() for
+      pcm_delay
+    - ASoC: SOF: Remove the get_stream_position callback
+    - ASoC: SOF: ipc4-pcm: Move struct sof_ipc4_timestamp_info definition locally
+    - ASoC: SOF: ipc4-pcm: Combine the SOF_IPC4_PIPE_PAUSED cases in pcm_trigger
+    - ASoC: SOF: ipc4-pcm: Invalidate the stream_start_offset in PAUSED state
+    - ASoC: SOF: sof-pcm: Add pointer callback to sof_ipc_pcm_ops
+    - ASoC: SOF: ipc4-pcm: Correct the delay calculation
+    - ASoC: SOF: Intel: hda: Compensate LLP in case it is not reset
+    - driver core: Introduce device_link_wait_removal()
+    - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
+    - of: module: prevent NULL pointer dereference in vsnprintf()
+    - x86/mm/pat: fix VM_PAT handling in COW mappings
+    - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
+    - x86/coco: Require seeding RNG with RDRAND on CoCo systems
+    - perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last PEBS event
+    - riscv: Fix vector state restore in rt_sigreturn()
+    - arm64/ptrace: Use saved floating point state type to determine SVE layout
+    - mm/secretmem: fix GUP-fast succeeding on secretmem folios
+    - selftests/mm: include strings.h for ffsl
+    - s390/entry: align system call table on 8 bytes
+    - riscv: Fix spurious errors from __get/put_kernel_nofault
+    - riscv: process: Fix kernel gp leakage
+    - smb: client: fix UAF in smb2_reconnect_server()
+    - smb: client: guarantee refcounted children from parent session
+    - smb: client: refresh referral without acquiring refpath_lock
+    - smb: client: handle DFS tcons in cifs_construct_tcon()
+    - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex
+    - smb3: retrying on failed server close
+    - smb: client: fix potential UAF in cifs_debug_files_proc_show()
+    - smb: client: fix potential UAF in cifs_stats_proc_write()
+    - smb: client: fix potential UAF in cifs_stats_proc_show()
+    - smb: client: fix potential UAF in cifs_dump_full_key()
+    - smb: client: fix potential UAF in smb2_is_valid_oplock_break()
+    - smb: client: fix potential UAF in smb2_is_valid_lease_break()
+    - smb: client: fix potential UAF in is_valid_oplock_break()
+    - smb: client: fix potential UAF in smb2_is_network_name_deleted()
+    - smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
+    - drm/i915/mst: Limit MST+DSC to TGL+
+    - drm/i915/mst: Reject FEC+MST on ICL
+    - drm/i915/dp: Fix the computation for compressed_bpp for DISPLAY < 13
+    - drm/i915/gt: Disable HW load balancing for CCS
+    - drm/i915/gt: Do not generate the command streamer for all the CCS
+    - drm/i915/gt: Enable only one CCS for compute workload
+    - drm/xe: Use ring ops TLB invalidation for rebinds
+    - drm/xe: Rework rebinding
+    - Revert "x86/mpparse: Register APIC address only once"
+    - bpf: put uprobe link's path and task in release callback
+    - bpf: support deferring bpf_link dealloc to after RCU grace period
+    - efi/libstub: Add generic support for parsing mem_encrypt=
+    - x86/boot: Move mem_encrypt= parsing to the decompressor
+    - x86/sme: Move early SME kernel encryption handling into .head.text
+    - x86/sev: Move early startup code into .head.text section
+    - Linux 6.8.5
+
+  * CVE-2024-26926
+    - binder: check offset alignment in binder_get_object()
+
+  * CVE-2024-26922
+    - drm/amdgpu: validate the parameters of bo mapping operations more clearly
+
+  * CVE-2024-26924
+    - netfilter: nft_set_pipapo: do not free live element
+
+ -- Stefan Bader <stefan.bader@canonical.com>  Fri, 07 Jun 2024 14:51:17 +0200
+
+linux (6.8.0-35.35) noble; urgency=medium
+
+  * noble/linux: 6.8.0-35.35 -proposed tracker (LP: #2065886)
+
+  * CVE-2024-21823
+    - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
+    - dmaengine: idxd: add a new security check to deal with a hardware erratum
+    - dmaengine: idxd: add a write() method for applications to submit work
+
+ -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Mon, 20 May 2024 16:26:15 +0200
+
+linux (6.8.0-34.34) noble; urgency=medium
+
+  * noble/linux: 6.8.0-34.34 -proposed tracker (LP: #2065167)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.04.29)
+
+ -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Wed, 08 May 2024 13:14:41 +0200
+
+linux (6.8.0-32.32) noble; urgency=medium
+
+  * noble/linux: 6.8.0-32.32 -proposed tracker (LP: #2064344)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] drop getabis data
+    - [Packaging] update variants
+    - [Packaging] update annotations scripts
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.04.29)
+
+  * Enable Nezha board (LP: #1975592)
+    - [Config] Enable CONFIG_REGULATOR_FIXED_VOLTAGE on riscv64
+
+  * Enable Nezha board (LP: #1975592) // Enable StarFive VisionFive 2 board
+    (LP: #2013232)
+    - [Config] Enable CONFIG_SERIAL_8250_DW on riscv64
+
+  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
+    - [Config] Sync riscv64 config with other architectures
+
+  * obsolete out-of-tree ivsc dkms in favor of in-tree one (LP: #2061747)
+    - ACPI: scan: Defer enumeration of devices with a _DEP pointing to IVSC device
+    - Revert "mei: vsc: Call wake_up() in the threaded IRQ handler"
+    - mei: vsc: Unregister interrupt handler for system suspend
+    - media: ipu-bridge: Add ov01a10 in Dell XPS 9315
+    - SAUCE: media: ipu-bridge: Support more sensors
+
+  * Fix after-suspend-mediacard/sdhc-insert test failed (LP: #2042500)
+    - PCI/ASPM: Move pci_configure_ltr() to aspm.c
+    - PCI/ASPM: Always build aspm.c
+    - PCI/ASPM: Move pci_save_ltr_state() to aspm.c
+    - PCI/ASPM: Save L1 PM Substates Capability for suspend/resume
+    - PCI/ASPM: Call pci_save_ltr_state() from pci_save_pcie_state()
+    - PCI/ASPM: Disable L1 before configuring L1 Substates
+    - PCI/ASPM: Update save_state when configuration changes
+
+  * RTL8852BE fw security fail then lost WIFI function during suspend/resume
+    cycle (LP: #2063096)
+    - wifi: rtw89: download firmware with five times retry
+
+  * intel_rapl_common: Add support for ARL and LNL (LP: #2061953)
+    - powercap: intel_rapl: Add support for Lunar Lake-M paltform
+    - powercap: intel_rapl: Add support for Arrow Lake
+
+  * Kernel panic during checkbox stress_ng_test on Grace running noble 6.8
+    (arm64+largemem) kernel (LP: #2058557)
+    - aio: Fix null ptr deref in aio_complete() wakeup
+
+  * Avoid creating non-working backlight sysfs knob from ASUS board
+    (LP: #2060422)
+    - platform/x86: asus-wmi: Consider device is absent when the read is ~0
+
+  * Include cifs.ko in linux-modules package (LP: #2042546)
+    - [Packaging] Replace fs/cifs with fs/smb/client in inclusion list
+
+  * Add Real-time Linux Analysis tool (rtla) to linux-tools (LP: #2059080)
+    - SAUCE: rtla: fix deb build
+    - [Packaging] add Real-time Linux Analysis tool (rtla) to linux-tools
+    - [Packaging] update dependencies for rtla
+
+  * Noble update: v6.8.4 upstream stable release (LP: #2060533)
+    - Revert "workqueue: Shorten events_freezable_power_efficient name"
+    - Revert "workqueue: Don't call cpumask_test_cpu() with -1 CPU in
+      wq_update_node_max_active()"
+    - Revert "workqueue: Implement system-wide nr_active enforcement for unbound
+      workqueues"
+    - Revert "workqueue: Introduce struct wq_node_nr_active"
+    - Revert "workqueue: RCU protect wq->dfl_pwq and implement accessors for it"
+    - Revert "workqueue: Make wq_adjust_max_active() round-robin pwqs while
+      activating"
+    - Revert "workqueue: Move nr_active handling into helpers"
+    - Revert "workqueue: Replace pwq_activate_inactive_work() with
+      [__]pwq_activate_work()"
+    - Revert "workqueue: Factor out pwq_is_empty()"
+    - Revert "workqueue: Move pwq->max_active to wq->max_active"
+    - Revert "workqueue.c: Increase workqueue name length"
+    - Linux 6.8.4
+
+  * Noble update: v6.8.3 upstream stable release (LP: #2060531)
+    - drm/vmwgfx: Unmap the surface before resetting it on a plane state
+    - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
+    - wifi: brcmfmac: avoid invalid list operation when vendor attach fails
+    - media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
+    - arm64: dts: qcom: sc7280: Add additional MSI interrupts
+    - remoteproc: virtio: Fix wdg cannot recovery remote processor
+    - clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
+    - smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
+    - smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
+    - arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
+    - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
+    - arm64: dts: qcom: sm8450-hdk: correct AMIC4 and AMIC5 microphones
+    - serial: max310x: fix NULL pointer dereference in I2C instantiation
+    - drm/vmwgfx: Fix the lifetime of the bo cursor memory
+    - pci_iounmap(): Fix MMIO mapping leak
+    - media: xc4000: Fix atomicity violation in xc4000_get_frequency
+    - media: mc: Add local pad to pipeline regardless of the link state
+    - media: mc: Fix flags handling when creating pad links
+    - media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access
+    - media: mc: Add num_links flag to media_pad
+    - media: mc: Rename pad variable to clarify intent
+    - media: mc: Expand MUST_CONNECT flag to always require an enabled link
+    - media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT
+    - md: use RCU lock to protect traversal in md_spares_need_change()
+    - KVM: Always flush async #PF workqueue when vCPU is being destroyed
+    - arm64: dts: qcom: sm8550-qrd: correct WCD9385 TX port mapping
+    - arm64: dts: qcom: sm8550-mtp: correct WCD9385 TX port mapping
+    - cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf()
+    - thermal/intel: Fix intel_tcc_get_temp() to support negative CPU temperature
+    - powercap: intel_rapl: Fix a NULL pointer dereference
+    - powercap: intel_rapl: Fix locking in TPMI RAPL
+    - powercap: intel_rapl_tpmi: Fix a register bug
+    - powercap: intel_rapl_tpmi: Fix System Domain probing
+    - powerpc/smp: Adjust nr_cpu_ids to cover all threads of a core
+    - powerpc/smp: Increase nr_cpu_ids to include the boot CPU
+    - sparc64: NMI watchdog: fix return value of __setup handler
+    - sparc: vDSO: fix return value of __setup handler
+    - selftests/mqueue: Set timeout to 180 seconds
+    - pinctrl: qcom: sm8650-lpass-lpi: correct Kconfig name
+    - ext4: correct best extent lstart adjustment logic
+    - drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects'
+    - block: Clear zone limits for a non-zoned stacked queue
+    - kasan/test: avoid gcc warning for intentional overflow
+    - bounds: support non-power-of-two CONFIG_NR_CPUS
+    - fat: fix uninitialized field in nostale filehandles
+    - fuse: fix VM_MAYSHARE and direct_io_allow_mmap
+    - mfd: twl: Select MFD_CORE
+    - ubifs: Set page uptodate in the correct place
+    - ubi: Check for too small LEB size in VTBL code
+    - ubi: correct the calculation of fastmap size
+    - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
+    - mtd: rawnand: meson: fix scrambling mode value in command macro
+    - md/md-bitmap: fix incorrect usage for sb_index
+    - x86/nmi: Fix the inverse "in NMI handler" check
+    - parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
+    - parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt
+      macros
+    - parisc: Fix ip_fast_csum
+    - parisc: Fix csum_ipv6_magic on 32-bit systems
+    - parisc: Fix csum_ipv6_magic on 64-bit systems
+    - parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
+    - md/raid5: fix atomicity violation in raid5_cache_count
+    - iio: adc: rockchip_saradc: fix bitmask for channels on SARADCv2
+    - iio: adc: rockchip_saradc: use mask for write_enable bitfield
+    - docs: Restore "smart quotes" for quotes
+    - cpufreq: Limit resolving a frequency to policy min/max
+    - PM: suspend: Set mem_sleep_current during kernel command line setup
+    - vfio/pds: Always clear the save/restore FDs on reset
+    - clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays
+    - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
+    - clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
+    - clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays
+    - clk: qcom: camcc-sc8280xp: fix terminating of frequency table arrays
+    - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
+    - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
+    - usb: xhci: Add error handling in xhci_map_urb_for_dma
+    - powerpc/fsl: Fix mfpmr build errors with newer binutils
+    - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
+    - USB: serial: add device ID for VeriFone adapter
+    - USB: serial: cp210x: add ID for MGP Instruments PDS100
+    - wifi: mac80211: track capability/opmode NSS separately
+    - USB: serial: option: add MeiG Smart SLM320 product
+    - KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled
+    - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
+    - PM: sleep: wakeirq: fix wake irq warning in system suspend
+    - mmc: tmio: avoid concurrent runs of mmc_request_done()
+    - fuse: replace remaining make_bad_inode() with fuse_make_bad()
+    - fuse: fix root lookup with nonzero generation
+    - fuse: don't unhash root
+    - usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
+    - usb: dwc3-am62: fix module unload/reload behavior
+    - usb: dwc3-am62: Disable wakeup at remove
+    - serial: core: only stop transmit when HW fifo is empty
+    - serial: Lock console when calling into driver before registration
+    - btrfs: qgroup: always free reserved space for extent records
+    - btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
+    - wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU
+    - docs: Makefile: Add dependency to $(YNL_INDEX) for targets other than
+      htmldocs
+    - PCI/PM: Drain runtime-idle callbacks before driver removal
+    - PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
+    - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
+    - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume
+    - md: export helpers to stop sync_thread
+    - md: export helper md_is_rdwr()
+    - md: add a new helper reshape_interrupted()
+    - dm-raid: really frozen sync_thread during suspend
+    - md/dm-raid: don't call md_reap_sync_thread() directly
+    - dm-raid: add a new helper prepare_suspend() in md_personality
+    - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent
+      with reshape
+    - dm-raid: fix lockdep waring in "pers->hot_add_disk"
+    - powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
+    - mac802154: fix llsec key resources release in mac802154_llsec_key_del
+    - mm: swap: fix race between free_swap_and_cache() and swapoff()
+    - mmc: core: Fix switch on gp3 partition
+    - Bluetooth: btnxpuart: Fix btnxpuart_close
+    - leds: trigger: netdev: Fix kernel panic on interface rename trig notify
+    - drm/etnaviv: Restore some id values
+    - landlock: Warn once if a Landlock action is requested while disabled
+    - io_uring: fix mshot read defer taskrun cqe posting
+    - hwmon: (amc6821) add of_match table
+    - io_uring: fix io_queue_proc modifying req->flags
+    - ext4: fix corruption during on-line resize
+    - nvmem: meson-efuse: fix function pointer type mismatch
+    - slimbus: core: Remove usage of the deprecated ida_simple_xx() API
+    - phy: tegra: xusb: Add API to retrieve the port number of phy
+    - usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
+    - speakup: Fix 8bit characters from direct synth
+    - debugfs: fix wait/cancellation handling during remove
+    - PCI/AER: Block runtime suspend when handling errors
+    - io_uring/net: correctly handle multishot recvmsg retry setup
+    - io_uring: fix mshot io-wq checks
+    - PCI: qcom: Disable ASPM L0s for sc8280xp, sa8540p and sa8295p
+    - sparc32: Fix parport build with sparc32
+    - nfs: fix UAF in direct writes
+    - NFS: Read unlock folio on nfs_page_create_from_folio() error
+    - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
+    - PCI: qcom: Enable BDF to SID translation properly
+    - PCI: dwc: endpoint: Fix advertised resizable BAR size
+    - PCI: hv: Fix ring buffer size calculation
+    - cifs: prevent updating file size from server if we have a read/write lease
+    - cifs: allow changing password during remount
+    - thermal/drivers/mediatek: Fix control buffer enablement on MT7896
+    - vfio/pci: Disable auto-enable of exclusive INTx IRQ
+    - vfio/pci: Lock external INTx masking ops
+    - vfio/platform: Disable virqfds on cleanup
+    - vfio/platform: Create persistent IRQ handlers
+    - vfio/fsl-mc: Block calling interrupt handler without trigger
+    - tpm,tpm_tis: Avoid warning splat at shutdown
+    - ksmbd: replace generic_fillattr with vfs_getattr
+    - ksmbd: retrieve number of blocks using vfs_getattr in
+      set_file_allocation_info
+    - platform/x86/intel/tpmi: Change vsec offset to u64
+    - io_uring/rw: return IOU_ISSUE_SKIP_COMPLETE for multishot retry
+    - io_uring: clean rings on NO_MMAP alloc fail
+    - ring-buffer: Do not set shortest_full when full target is hit
+    - ring-buffer: Fix full_waiters_pending in poll
+    - ring-buffer: Use wait_event_interruptible() in ring_buffer_wait()
+    - tracing/ring-buffer: Fix wait_on_pipe() race
+    - dlm: fix user space lkb refcounting
+    - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
+    - soc: fsl: qbman: Use raw spinlock for cgr_lock
+    - s390/zcrypt: fix reference counting on zcrypt card objects
+    - drm/probe-helper: warn about negative .get_modes()
+    - drm/panel: do not return negative error codes from drm_panel_get_modes()
+    - drm/exynos: do not return negative values from .get_modes()
+    - drm/imx/ipuv3: do not return negative values from .get_modes()
+    - drm/vc4: hdmi: do not return negative values from .get_modes()
+    - clocksource/drivers/timer-riscv: Clear timer interrupt on timer
+      initialization
+    - memtest: use {READ,WRITE}_ONCE in memory scanning
+    - Revert "block/mq-deadline: use correct way to throttling write requests"
+    - lsm: use 32-bit compatible data types in LSM syscalls
+    - lsm: handle the NULL buffer case in lsm_fill_user_ctx()
+    - f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag
+    - f2fs: truncate page cache before clearing flags when aborting atomic write
+    - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
+    - nilfs2: prevent kernel bug at submit_bh_wbc()
+    - cifs: make sure server interfaces are requested only for SMB3+
+    - cifs: reduce warning log level for server not advertising interfaces
+    - cifs: open_cached_dir(): add FILE_READ_EA to desired access
+    - mtd: rawnand: Fix and simplify again the continuous read derivations
+    - mtd: rawnand: Add a helper for calculating a page index
+    - mtd: rawnand: Ensure all continuous terms are always in sync
+    - mtd: rawnand: Constrain even more when continuous reads are enabled
+    - cpufreq: dt: always allocate zeroed cpumask
+    - io_uring/futex: always remove futex entry for cancel all
+    - io_uring/waitid: always remove waitid entry for cancel all
+    - x86/CPU/AMD: Update the Zenbleed microcode revisions
+    - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
+    - net: esp: fix bad handling of pages from page_pool
+    - NFSD: Fix nfsd_clid_class use of __string_len() macro
+    - drm/i915: Add missing ; to __assign_str() macros in tracepoint code
+    - net: hns3: tracing: fix hclgevf trace event strings
+    - cxl/trace: Properly initialize cxl_poison region name
+    - ksmbd: fix potencial out-of-bounds when buffer offset is invalid
+    - virtio: reenable config if freezing device failed
+    - LoongArch: Change __my_cpu_offset definition to avoid mis-optimization
+    - LoongArch: Define the __io_aw() hook as mmiowb()
+    - LoongArch/crypto: Clean up useless assignment operations
+    - wireguard: netlink: check for dangling peer via is_dead instead of empty
+      list
+    - wireguard: netlink: access device through ctx instead of peer
+    - wireguard: selftests: set RISCV_ISA_FALLBACK on riscv{32,64}
+    - ahci: asm1064: asm1166: don't limit reported ports
+    - drm/amd/display: Change default size for dummy plane in DML2
+    - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
+    - drm/amdgpu/pm: Fix NULL pointer dereference when get power limit
+    - drm/amdgpu/pm: Check the validity of overdiver power limit
+    - drm/amd/display: Override min required DCFCLK in dml1_validate
+    - drm/amd/display: Allow dirty rects to be sent to dmub when abm is active
+    - drm/amd/display: Init DPPCLK from SMU on dcn32
+    - drm/amd/display: Update odm when ODM combine is changed on an otg master
+      pipe with no plane
+    - drm/amd/display: Fix idle check for shared firmware state
+    - drm/amd/display: Amend coasting vtotal for replay low hz
+    - drm/amd/display: Lock all enabled otg pipes even with no planes
+    - drm/amd/display: Implement wait_for_odm_update_pending_complete
+    - drm/amd/display: Return the correct HDCP error code
+    - drm/amd/display: Add a dc_state NULL check in dc_state_release
+    - drm/amd/display: Fix noise issue on HDMI AV mute
+    - dm snapshot: fix lockup in dm_exception_table_exit
+    - x86/pm: Work around false positive kmemleak report in msr_build_context()
+    - wifi: brcmfmac: add per-vendor feature detection callback
+    - wifi: brcmfmac: cfg80211: Use WSEC to set SAE password
+    - wifi: brcmfmac: Demote vendor-specific attach/detach messages to info
+    - drm/ttm: Make sure the mapped tt pages are decrypted when needed
+    - drm/amd/display: Unify optimize_required flags and VRR adjustments
+    - drm/amd/display: Add more checks for exiting idle in DC
+    - btrfs: add set_folio_extent_mapped() helper
+    - btrfs: replace sb::s_blocksize by fs_info::sectorsize
+    - btrfs: add helpers to get inode from page/folio pointers
+    - btrfs: add helpers to get fs_info from page/folio pointers
+    - btrfs: add helper to get fs_info from struct inode pointer
+    - btrfs: qgroup: validate btrfs_qgroup_inherit parameter
+    - vfio: Introduce interface to flush virqfd inject workqueue
+    - vfio/pci: Create persistent INTx handler
+    - drm/bridge: add ->edid_read hook and drm_bridge_edid_read()
+    - drm/bridge: lt8912b: use drm_bridge_edid_read()
+    - drm/bridge: lt8912b: clear the EDID property on failures
+    - drm/bridge: lt8912b: do not return negative values from .get_modes()
+    - drm/amd/display: Remove pixle rate limit for subvp
+    - drm/amd/display: Revert Remove pixle rate limit for subvp
+    - workqueue: Shorten events_freezable_power_efficient name
+    - drm/amd/display: Use freesync when `DRM_EDID_FEATURE_CONTINUOUS_FREQ` found
+    - netfilter: nf_tables: reject constant set with timeout
+    - Revert "crypto: pkcs7 - remove sha1 support"
+    - x86/efistub: Call mixed mode boot services on the firmware's stack
+    - ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2"
+    - ASoC: amd: yc: Revert "add new YC platform variant (0x63) support"
+    - Fix memory leak in posix_clock_open()
+    - wifi: rtw88: 8821cu: Fix connection failure
+    - x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
+    - x86/sev: Fix position dependent variable references in startup code
+    - clocksource/drivers/arm_global_timer: Fix maximum prescaler value
+    - ARM: 9352/1: iwmmxt: Remove support for PJ4/PJ4B cores
+    - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
+    - entry: Respect changes to system call number by trace_sys_enter()
+    - swiotlb: Fix double-allocation of slots due to broken alignment handling
+    - swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc()
+    - swiotlb: Fix alignment checks when both allocation and DMA masks are present
+    - iommu/dma: Force swiotlb_max_mapping_size on an untrusted device
+    - printk: Update @console_may_schedule in console_trylock_spinning()
+    - irqchip/renesas-rzg2l: Flush posted write in irq_eoi()
+    - irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi()
+    - irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi()
+    - irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type
+    - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
+    - efi/libstub: fix efi_random_alloc() to allocate memory at alloc_min or
+      higher address
+    - x86/mpparse: Register APIC address only once
+    - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
+    - efi: fix panic in kdump kernel
+    - pwm: img: fix pwm clock lookup
+    - selftests/mm: Fix build with _FORTIFY_SOURCE
+    - btrfs: handle errors returned from unpin_extent_cache()
+    - btrfs: fix warning messages not printing interval at unpin_extent_range()
+    - btrfs: do not skip re-registration for the mounted device
+    - mfd: intel-lpss: Switch to generalized quirk table
+    - mfd: intel-lpss: Introduce QUIRK_CLOCK_DIVIDER_UNITY for XPS 9530
+    - drm/i915: Replace a memset() with zero initialization
+    - drm/i915: Try to preserve the current shared_dpll for fastset on type-c
+      ports
+    - drm/i915: Include the PLL name in the debug messages
+    - drm/i915: Suppress old PLL pipe_mask checks for MG/TC/TBT PLLs
+    - crypto: iaa - Fix nr_cpus < nr_iaa case
+    - drm/amd/display: Prevent crash when disable stream
+    - ALSA: hda/tas2781: remove digital gain kcontrol
+    - ALSA: hda/tas2781: add locks to kcontrols
+    - mm: zswap: fix writeback shinker GFP_NOIO/GFP_NOFS recursion
+    - init: open /initrd.image with O_LARGEFILE
+    - x86/efistub: Add missing boot_params for mixed mode compat entry
+    - efi/libstub: Cast away type warning in use of max()
+    - x86/efistub: Reinstate soft limit for initrd loading
+    - prctl: generalize PR_SET_MDWE support check to be per-arch
+    - ARM: prctl: reject PR_SET_MDWE on pre-ARMv6
+    - tmpfs: fix race on handling dquot rbtree
+    - btrfs: validate device maj:min during open
+    - btrfs: fix race in read_extent_buffer_pages()
+    - btrfs: zoned: don't skip block groups with 100% zone unusable
+    - btrfs: zoned: use zone aware sb location for scrub
+    - btrfs: zoned: fix use-after-free in do_zone_finish()
+    - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
+    - wifi: cfg80211: add a flag to disable wireless extensions
+    - wifi: iwlwifi: mvm: disable MLO for the time being
+    - wifi: iwlwifi: fw: don't always use FW dump trig
+    - wifi: iwlwifi: mvm: handle debugfs names more carefully
+    - Revert "drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP
+      displays without PSR"
+    - fbdev: Select I/O-memory framebuffer ops for SBus
+    - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
+    - hexagon: vmlinux.lds.S: handle attributes section
+    - mm: cachestat: fix two shmem bugs
+    - selftests/mm: sigbus-wp test requires UFFD_FEATURE_WP_HUGETLBFS_SHMEM
+    - selftests/mm: fix ARM related issue with fork after pthread_create
+    - mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc
+      HS200 mode
+    - mmc: core: Initialize mmc_blk_ioc_data
+    - mmc: core: Avoid negative index with array access
+    - sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove()
+    - block: Do not force full zone append completion in req_bio_endio()
+    - thermal: devfreq_cooling: Fix perf state when calculate dfc res_util
+    - Revert "thermal: core: Don't update trip points inside the hysteresis range"
+    - nouveau/dmem: handle kcalloc() allocation failure
+    - net: ll_temac: platform_get_resource replaced by wrong function
+    - net: wan: framer: Add missing static inline qualifiers
+    - net: phy: qcom: at803x: fix kernel panic with at8031_probe
+    - drm/xe/query: fix gt_id bounds check
+    - drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau
+    - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
+    - drm/amdkfd: fix TLB flush after unmap for GFX9.4.2
+    - drm/amdgpu: fix deadlock while reading mqd from debugfs
+    - drm/amd/display: Remove MPC rate control logic from DCN30 and above
+    - drm/amd/display: Set DCN351 BB and IP the same as DCN35
+    - drm/i915/hwmon: Fix locking inversion in sysfs getter
+    - drm/i915/vma: Fix UAF on destroy against retire race
+    - drm/i915/bios: Tolerate devdata==NULL in
+      intel_bios_encoder_supports_dp_dual_mode()
+    - drm/i915/vrr: Generate VRR "safe window" for DSB
+    - drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly
+    - drm/i915/dsb: Fix DSB vblank waits when using VRR
+    - drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed()
+    - drm/i915: Pre-populate the cursor physical dma address
+    - drm/i915/gt: Reset queue_priority_hint on parking
+    - drm/amd/display: Fix bounds check for dcn35 DcfClocks
+    - Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
+    - mtd: spinand: Add support for 5-byte IDs
+    - Revert "usb: phy: generic: Get the vbus supply"
+    - usb: cdc-wdm: close race between read and workqueue
+    - usb: misc: ljca: Fix double free in error handling path
+    - USB: UAS: return ENODEV when submit urbs fail with device not attached
+    - vfio/pds: Make sure migration file isn't accessed after reset
+    - ring-buffer: Make wake once of ring_buffer_wait() more robust
+    - btrfs: fix extent map leak in unexpected scenario at unpin_extent_cache()
+    - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
+    - scsi: ufs: qcom: Provide default cycles_in_1us value
+    - scsi: sd: Fix TCG OPAL unlock on system resume
+    - scsi: core: Fix unremoved procfs host directory regression
+    - staging: vc04_services: changen strncpy() to strscpy_pad()
+    - staging: vc04_services: fix information leak in create_component()
+    - genirq: Introduce IRQF_COND_ONESHOT and use it in pinctrl-amd
+    - usb: dwc3: Properly set system wakeup
+    - USB: core: Fix deadlock in usb_deauthorize_interface()
+    - USB: core: Add hub_get() and hub_put() routines
+    - USB: core: Fix deadlock in port "disable" sysfs attribute
+    - usb: dwc2: host: Fix remote wakeup from hibernation
+    - usb: dwc2: host: Fix hibernation flow
+    - usb: dwc2: host: Fix ISOC flow in DDMA mode
+    - usb: dwc2: gadget: Fix exiting from clock gating
+    - usb: dwc2: gadget: LPM flow fix
+    - usb: udc: remove warning when queue disabled ep
+    - usb: typec: ucsi: Fix race between typec_switch and role_switch
+    - usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()
+    - usb: typec: tcpm: Correct port source pdo array in pd_set callback
+    - usb: typec: tcpm: Update PD of Type-C port upon pd_set
+    - usb: typec: Return size of buffer if pd_set operation succeeds
+    - usb: typec: ucsi: Clear EVENT_PENDING under PPM lock
+    - usb: typec: ucsi: Ack unsupported commands
+    - usb: typec: ucsi_acpi: Refactor and fix DELL quirk
+    - usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
+    - scsi: qla2xxx: Prevent command send on chip reset
+    - scsi: qla2xxx: Fix N2N stuck connection
+    - scsi: qla2xxx: Split FCE|EFT trace control
+    - scsi: qla2xxx: Update manufacturer detail
+    - scsi: qla2xxx: NVME|FCP prefer flag not being honored
+    - scsi: qla2xxx: Fix command flush on cable pull
+    - scsi: qla2xxx: Fix double free of the ha->vp_map pointer
+    - scsi: qla2xxx: Fix double free of fcport
+    - scsi: qla2xxx: Change debug message during driver unload
+    - scsi: qla2xxx: Delay I/O Abort on PCI error
+    - x86/bugs: Fix the SRSO mitigation on Zen3/4
+    - crash: use macro to add crashk_res into iomem early for specific arch
+    - drm/amd/display: fix IPX enablement
+    - x86/bugs: Use fixed addressing for VERW operand
+    - Revert "x86/bugs: Use fixed addressing for VERW operand"
+    - usb: dwc3: pci: Drop duplicate ID
+    - scsi: lpfc: Correct size for cmdwqe/rspwqe for memset()
+    - scsi: lpfc: Correct size for wqe for memset()
+    - scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
+    - scsi: libsas: Fix disk not being scanned in after being removed
+    - perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and
+      later
+    - x86/sev: Skip ROM range scans and validation for SEV-SNP guests
+    - tools/resolve_btfids: fix build with musl libc
+    - drm/amdgpu: fix use-after-free bug
+    - drm/sched: fix null-ptr-deref in init entity
+    - Linux 6.8.3
+    - [Config] updateconfigs following v6.8.3 import
+
+  * Noble update: v6.8.3 upstream stable release (LP: #2060531) //
+    [Ubuntu-24.04] Hugepage memory is not getting released even after destroying
+    the guest! (LP: #2062556)
+    - block: Fix page refcounts for unaligned buffers in __bio_release_pages()
+
+  *  [SPR][EMR][GNR] TDX: efi: TD Measurement support for kernel cmdline/initrd
+    sections from EFI stub  (LP: #2060130)
+    - efi/libstub: Use TPM event typedefs from the TCG PC Client spec
+    - efi/tpm: Use symbolic GUID name from spec for final events table
+    - efi/libstub: Add Confidential Computing (CC) measurement typedefs
+    - efi/libstub: Measure into CC protocol if TCG2 protocol is absent
+    - efi/libstub: Add get_event_log() support for CC platforms
+    - x86/efistub: Remap kernel text read-only before dropping NX attribute
+
+  * Fix acpi_power_meter accessing IPMI region before it's ready (LP: #2059263)
+    - ACPI: IPMI: Add helper to wait for when SMI is selected
+    - hwmon: (acpi_power_meter) Ensure IPMI space handler is ready on Dell systems
+
+  * Drop fips-checks script from trees (LP: #2055083)
+    - [Packaging] Remove fips-checks script
+
+  * alsa/realtek: adjust max output valume for headphone on 2 LG machines
+    (LP: #2058573)
+    - ALSA: hda/realtek: fix the hp playback volume issue for LG machines
+
+  * Noble update: v6.8.2 upstream stable release (LP: #2060097)
+    - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
+    - workqueue.c: Increase workqueue name length
+    - workqueue: Move pwq->max_active to wq->max_active
+    - workqueue: Factor out pwq_is_empty()
+    - workqueue: Replace pwq_activate_inactive_work() with [__]pwq_activate_work()
+    - workqueue: Move nr_active handling into helpers
+    - workqueue: Make wq_adjust_max_active() round-robin pwqs while activating
+    - workqueue: RCU protect wq->dfl_pwq and implement accessors for it
+    - workqueue: Introduce struct wq_node_nr_active
+    - workqueue: Implement system-wide nr_active enforcement for unbound
+      workqueues
+    - workqueue: Don't call cpumask_test_cpu() with -1 CPU in
+      wq_update_node_max_active()
+    - iomap: clear the per-folio dirty bits on all writeback failures
+    - fs: Fix rw_hint validation
+    - io_uring: remove looping around handling traditional task_work
+    - io_uring: remove unconditional looping in local task_work handling
+    - s390/dasd: Use dev_*() for device log messages
+    - s390/dasd: fix double module refcount decrement
+    - fs/hfsplus: use better @opf description
+    - md: fix kmemleak of rdev->serial
+    - rcu/exp: Fix RCU expedited parallel grace period kworker allocation failure
+      recovery
+    - rcu/exp: Handle RCU expedited grace period kworker allocation failure
+    - fs/select: rework stack allocation hack for clang
+    - block: fix deadlock between bd_link_disk_holder and partition scan
+    - md: Don't clear MD_CLOSING when the raid is about to stop
+    - kunit: Setup DMA masks on the kunit device
+    - ovl: Always reject mounting over case-insensitive directories
+    - kunit: test: Log the correct filter string in executor_test
+    - lib/cmdline: Fix an invalid format specifier in an assertion msg
+    - lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg
+    - time: test: Fix incorrect format specifier
+    - rtc: test: Fix invalid format specifier.
+    - net: test: Fix printf format specifier in skb_segment kunit test
+    - drm/xe/tests: Fix printf format specifiers in xe_migrate test
+    - drm: tests: Fix invalid printf format specifiers in KUnit tests
+    - md/raid1: factor out helpers to add rdev to conf
+    - md/raid1: record nonrot rdevs while adding/removing rdevs to conf
+    - md/raid1: fix choose next idle in read_balance()
+    - io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
+    - io_uring/net: move receive multishot out of the generic msghdr path
+    - io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
+    - nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()
+    - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
+    - x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type
+    - x86/resctrl: Remove hard-coded memory bandwidth limit
+    - x86/resctrl: Read supported bandwidth sources from CPUID
+    - x86/resctrl: Implement new mba_MBps throttling heuristic
+    - x86/sme: Fix memory encryption setting if enabled by default and not
+      overridden
+    - timekeeping: Fix cross-timestamp interpolation on counter wrap
+    - timekeeping: Fix cross-timestamp interpolation corner case decision
+    - timekeeping: Fix cross-timestamp interpolation for non-x86
+    - x86/asm: Remove the __iomem annotation of movdir64b()'s dst argument
+    - sched/fair: Take the scheduling domain into account in select_idle_smt()
+    - sched/fair: Take the scheduling domain into account in select_idle_core()
+    - wifi: ath10k: fix NULL pointer dereference in
+      ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
+    - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
+    - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
+    - wifi: b43: Stop correct queue in DMA worker when QoS is disabled
+    - wifi: b43: Disable QoS for bcm4331
+    - wifi: wilc1000: fix declarations ordering
+    - wifi: wilc1000: fix RCU usage in connect path
+    - wifi: ath11k: add support to select 6 GHz regulatory type
+    - wifi: ath11k: store cur_regulatory_info for each radio
+    - wifi: ath11k: fix a possible dead lock caused by ab->base_lock
+    - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
+    - wifi: wilc1000: do not realloc workqueue everytime an interface is added
+    - wifi: wilc1000: fix multi-vif management when deleting a vif
+    - wifi: mwifiex: debugfs: Drop unnecessary error check for
+      debugfs_create_dir()
+    - ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate
+    - arm64: dts: qcom: x1e80100: drop qcom,drv-count
+    - arm64: dts: qcom: sc8180x: Hook up VDD_CX as GCC parent domain
+    - arm64: dts: qcom: sc8180x: Fix up big CPU idle state entry latency
+    - arm64: dts: qcom: sc8180x: Add missing CPU off state
+    - arm64: dts: qcom: sc8180x: Fix eDP PHY power-domains
+    - arm64: dts: qcom: sc8180x: Don't hold MDP core clock at FMAX
+    - arm64: dts: qcom: sc8180x: Require LOW_SVS vote for MMCX if DISPCC is on
+    - arm64: dts: qcom: sc8180x: Add missing CPU<->MDP_CFG path
+    - arm64: dts: qcom: sc8180x: Shrink aoss_qmp register space size
+    - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
+    - cpufreq: mediatek-hw: Wait for CPU supplies before probing
+    - sock_diag: annotate data-races around sock_diag_handlers[family]
+    - inet_diag: annotate data-races around inet_diag_table[]
+    - bpftool: Silence build warning about calloc()
+    - selftests/bpf: Fix potential premature unload in bpf_testmod
+    - libbpf: Apply map_set_def_max_entries() for inner_maps on creation
+    - selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values
+    - bpftool: Fix wrong free call in do_show_link
+    - wifi: ath12k: Fix issues in channel list update
+    - selftests/bpf: Fix the flaky tc_redirect_dtime test
+    - selftests/bpf: Wait for the netstamp_needed_key static key to be turned on
+    - wifi: cfg80211: add RNR with reporting AP information
+    - wifi: mac80211: use deflink and fix typo in link ID check
+    - wifi: iwlwifi: change link id in time event to s8
+    - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
+    - arm64: dts: qcom: sm8450: Add missing interconnects to serial
+    - soc: qcom: socinfo: rename PM2250 to PM4125
+    - arm64: dts: qcom: sc7280: Add static properties to cryptobam
+    - arm64: dts: qcom: qcm6490-fairphone-fp5: Add missing reserved-memory
+    - arm64: dts: qcom: sdm845-oneplus-common: improve DAI node naming
+    - arm64: dts: qcom: rename PM2250 to PM4125
+    - cpufreq: mediatek-hw: Don't error out if supply is not found
+    - libbpf: Fix faccessat() usage on Android
+    - libbpf: fix __arg_ctx type enforcement for perf_event programs
+    - pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl
+    - arm64: dts: qcom: sa8540p: Drop gfx.lvl as power-domain for gpucc
+    - arm64: dts: renesas: r8a779g0: Restore sort order
+    - arm64: dts: renesas: r8a779g0: Add missing SCIF_CLK2
+    - selftests/bpf: Disable IPv6 for lwt_redirect test
+    - arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S i.MX8MM
+    - arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM
+    - arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL
+      OSM-S board
+    - arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL
+      board
+    - arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL
+      OSM-S board
+    - arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL
+      board
+    - arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module
+    - arm64: dts: imx8qm: Align edma3 power-domains resources indentation
+    - arm64: dts: imx8qm: Correct edma3 power-domains and interrupt numbers
+    - libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API
+    - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
+    - wifi: ath11k: change to move WMI_VDEV_PARAM_SET_HEMU_MODE before
+      WMI_PEER_ASSOC_CMDID
+    - wifi: ath12k: fix fetching MCBC flag for QCN9274
+    - wifi: iwlwifi: mvm: report beacon protection failures
+    - wifi: iwlwifi: dbg-tlv: ensure NUL termination
+    - wifi: iwlwifi: acpi: fix WPFC reading
+    - wifi: iwlwifi: mvm: initialize rates in FW earlier
+    - wifi: iwlwifi: fix EWRD table validity check
+    - wifi: iwlwifi: mvm: d3: fix IPN byte order
+    - wifi: iwlwifi: always have 'uats_enabled'
+    - wifi: iwlwifi: mvm: fix the TLC command after ADD_STA
+    - wifi: iwlwifi: read BIOS PNVM only for non-Intel SKU
+    - gpio: vf610: allow disabling the vf610 driver
+    - selftests/bpf: trace_helpers.c: do not use poisoned type
+    - bpf: make sure scalar args don't accept __arg_nonnull tag
+    - bpf: don't emit warnings intended for global subprogs for static subprogs
+    - arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
+    - pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
+    - net: blackhole_dev: fix build warning for ethh set but not used
+    - spi: consolidate setting message->spi
+    - spi: move split xfers for CS_WORD emulation
+    - arm64: dts: ti: k3-am62p5-sk: Enable CPSW MDIO node
+    - arm64: dts: ti: k3-j721s2: Fix power domain for VTM node
+    - arm64: dts: ti: k3-j784s4: Fix power domain for VTM node
+    - wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use
+    - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
+    - arm64: dts: ti: k3-am69-sk: remove assigned-clock-parents for unused VP
+    - libbpf: fix return value for PERF_EVENT __arg_ctx type fix up check
+    - arm64: dts: ti: k3-am62p-mcu/wakeup: Disable MCU and wakeup R5FSS nodes
+    - arm64: dts: qcom: x1e80100-qcp: Fix supplies for LDOs 3E and 2J
+    - libbpf: Use OPTS_SET() macro in bpf_xdp_query()
+    - wifi: wfx: fix memory leak when starting AP
+    - arm64: dts: qcom: qcm2290: declare VLS CLAMP register for USB3 PHY
+    - arm64: dts: qcom: sm6115: declare VLS CLAMP register for USB3 PHY
+    - arm64: dts: qcom: sm8650: Fix UFS PHY clocks
+    - wifi: ath12k: fix incorrect logic of calculating vdev_stats_id
+    - printk: nbcon: Relocate 32bit seq macros
+    - printk: ringbuffer: Do not skip non-finalized records with prb_next_seq()
+    - printk: Wait for all reserved records with pr_flush()
+    - printk: Add this_cpu_in_panic()
+    - printk: ringbuffer: Cleanup reader terminology
+    - printk: ringbuffer: Skip non-finalized records in panic
+    - printk: Disable passing console lock owner completely during panic()
+    - pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
+    - tools/resolve_btfids: Refactor set sorting with types from btf_ids.h
+    - tools/resolve_btfids: Fix cross-compilation to non-host endianness
+    - wifi: iwlwifi: support EHT for WH
+    - wifi: iwlwifi: properly check if link is active
+    - wifi: iwlwifi: mvm: fix erroneous queue index mask
+    - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK
+    - wifi: iwlwifi: mvm: don't set replay counters to 0xff
+    - s390/pai: fix attr_event_free upper limit for pai device drivers
+    - s390/vdso: drop '-fPIC' from LDFLAGS
+    - arm64: dts: qcom: qcm6490-idp: Correct the voltage setting for vph_pwr
+    - arm64: dts: qcom: qcs6490-rb3gen2: Correct the voltage setting for vph_pwr
+    - selftests: forwarding: Add missing config entries
+    - selftests: forwarding: Add missing multicast routing config entries
+    - arm64: dts: qcom: sm6115: drop pipe clock selection
+    - ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
+    - arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs
+    - arm64: dts: mediatek: mt7986: fix reference to PWM in fan node
+    - arm64: dts: mediatek: mt7986: drop crypto's unneeded/invalid clock name
+    - arm64: dts: mediatek: mt7986: fix SPI bus width properties
+    - arm64: dts: mediatek: mt7986: fix SPI nodename
+    - arm64: dts: mediatek: mt7986: drop "#clock-cells" from PWM
+    - arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg
+    - arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection node
+    - arm64: dts: mediatek: mt8192: fix vencoder clock name
+    - arm64: dts: mediatek: mt8186: fix VENC power domain clocks
+    - arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
+    - can: m_can: Start/Cancel polling timer together with interrupts
+    - wifi: iwlwifi: mvm: Fix the listener MAC filter flags
+    - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
+    - arm64: dts: qcom: sdm845: Use the Low Power Island CX/MX for SLPI
+    - soc: qcom: llcc: Check return value on Broadcast_OR reg read
+    - ARM: dts: qcom: msm8974: correct qfprom node size
+    - arm64: dts: mediatek: mt8186: Add missing clocks to ssusb power domains
+    - arm64: dts: mediatek: mt8186: Add missing xhci clock to usb controllers
+    - arm64: dts: ti: am65x: Fix dtbs_install for Rocktech OLDI overlay
+    - cpufreq: qcom-hw: add CONFIG_COMMON_CLK dependency
+    - wifi: wilc1000: prevent use-after-free on vif when cleaning up all
+      interfaces
+    - pwm: dwc: use pm_sleep_ptr() macro
+    - arm64: dts: ti: k3-am69-sk: fix PMIC interrupt number
+    - arm64: dts: ti: k3-j721e-sk: fix PMIC interrupt number
+    - arm64: dts: ti: k3-am62-main: disable usb lpm
+    - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
+    - bus: tegra-aconnect: Update dependency to ARCH_TEGRA
+    - iommu/amd: Mark interrupt as managed
+    - wifi: brcmsmac: avoid function pointer casts
+    - arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios
+    - arm64: dts: qcom: sm8150: correct PCIe wake-gpios
+    - powercap: dtpm_cpu: Fix error check against freq_qos_add_request()
+    - net: ena: Remove ena_select_queue
+    - arm64: dts: ti: k3-j7200-common-proc-board: Modify Pinmux for wkup_uart0 and
+      mcu_uart0
+    - arm64: dts: ti: k3-j7200-common-proc-board: Remove clock-frequency from
+      mcu_uart0
+    - arm64: dts: ti: k3-j721s2-common-proc-board: Remove Pinmux for CTS and RTS
+      in wkup_uart0
+    - arm64: dts: ti: k3-j784s4-evm: Remove Pinmux for CTS and RTS in wkup_uart0
+    - arm64: dts: ti: k3-am64-main: Fix ITAP/OTAP values for MMC
+    - arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow
+    - arm64: dts: ti: Add common1 register space for AM65x SoC
+    - arm64: dts: ti: Add common1 register space for AM62x SoC
+    - firmware: arm_scmi: Fix double free in SMC transport cleanup path
+    - wifi: cfg80211: set correct param change count in ML element
+    - arm64: dts: ti: k3-j721e: Fix mux-reg-masks in hbmc_mux
+    - arm64: dts: ti: k3-j784s4-main: Fix mux-reg-masks in serdes_ln_ctrl
+    - arm64: dts: ti: k3-am62p: Fix memory ranges for DMSS
+    - wifi: wilc1000: revert reset line logic flip
+    - ARM: dts: arm: realview: Fix development chip ROM compatible value
+    - memory: tegra: Correct DLA client names
+    - wifi: mt76: mt7996: fix fw loading timeout
+    - wifi: mt76: mt7925: fix connect to 80211b mode fail in 2Ghz band
+    - wifi: mt76: mt7925: fix SAP no beacon issue in 5Ghz and 6Ghz band
+    - wifi: mt76: mt7925: fix mcu query command fail
+    - wifi: mt76: mt7925: fix wmm queue mapping
+    - wifi: mt76: mt7925: fix fw download fail
+    - wifi: mt76: mt7925: fix WoW failed in encrypted mode
+    - wifi: mt76: mt7925: fix the wrong header translation config
+    - wifi: mt76: mt7925: add flow to avoid chip bt function fail
+    - wifi: mt76: mt7925: add support to set ifs time by mcu command
+    - wifi: mt76: mt7925: update PCIe DMA settings
+    - wifi: mt76: mt7996: check txs format before getting skb by pid
+    - wifi: mt76: mt7996: fix TWT issues
+    - wifi: mt76: mt7996: fix incorrect interpretation of EHT MCS caps
+    - wifi: mt76: mt7996: fix HE beamformer phy cap for station vif
+    - wifi: mt76: mt7996: fix efuse reading issue
+    - wifi: mt76: mt7996: fix HIF_TXD_V2_1 value
+    - wifi: mt76: mt792x: fix ethtool warning
+    - wifi: mt76: mt7921e: fix use-after-free in free_irq()
+    - wifi: mt76: mt7925e: fix use-after-free in free_irq()
+    - wifi: mt76: mt7921: fix incorrect type conversion for CLC command
+    - wifi: mt76: mt792x: fix a potential loading failure of the 6Ghz channel
+      config from ACPI
+    - wifi: mt76: fix the issue of missing txpwr settings from ch153 to ch177
+    - arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes
+    - arm64: dts: renesas: r9a08g045: Add missing interrupts to IRQC node
+    - arm64: dts: renesas: rzg3s-smarc-som: Guard Ethernet IRQ GPIO hogs
+    - arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
+    - arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes
+    - net: mctp: copy skb ext data when fragmenting
+    - pstore: inode: Only d_invalidate() is needed
+    - arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF
+    - ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
+    - ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
+    - arm64: dts: imx8mp: Set SPI NOR to max 40 MHz on Data Modul i.MX8M Plus eDM
+      SBC
+    - arm64: dts: imx8mp-evk: Fix hdmi@3d node
+    - regulator: userspace-consumer: add module device table
+    - gpiolib: Pass consumer device through to core in
+      devm_fwnode_gpiod_get_index()
+    - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
+    - ACPI: resource: Do IRQ override on Lunnen Ground laptops
+    - ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
+    - ACPI: scan: Fix device check notification handling
+    - arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu
+    - arm64: dts: rockchip: fix reset-names for rk356x i2s2 controller
+    - arm64: dts: rockchip: drop rockchip,trcm-sync-tx-only from rk3588 i2s
+    - objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks
+    - x86, relocs: Ignore relocations in .notes section
+    - SUNRPC: fix a memleak in gss_import_v2_context
+    - SUNRPC: fix some memleaks in gssx_dec_option_array
+    - arm64: dts: qcom: sm8550: Fix SPMI channels size
+    - arm64: dts: qcom: sm8650: Fix SPMI channels size
+    - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove
+      function
+    - ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors
+    - btrfs: fix race when detecting delalloc ranges during fiemap
+    - wifi: rtw88: 8821cu: Fix firmware upload fail
+    - wifi: rtw88: 8821c: Fix beacon loss and disconnect
+    - wifi: rtw88: 8821c: Fix false alarm count
+    - wifi: brcm80211: handle pmk_op allocation failure
+    - riscv: dts: starfive: jh7100: fix root clock names
+    - PCI: Make pci_dev_is_disconnected() helper public for other drivers
+    - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
+    - iommu/vt-d: Use rbtree to track iommu probed devices
+    - iommu/vt-d: Improve ITE fault handling if target device isn't present
+    - iommu/vt-d: Use device rbtree in iopf reporting path
+    - iommu: Add static iommu_ops->release_domain
+    - iommu/vt-d: Fix NULL domain on device release
+    - igc: Fix missing time sync events
+    - igb: Fix missing time sync events
+    - ice: fix stats being updated by way too large values
+    - Bluetooth: Remove HCI_POWER_OFF_TIMEOUT
+    - Bluetooth: mgmt: Remove leftover queuing of power_off work
+    - Bluetooth: Remove superfluous call to hci_conn_check_pending()
+    - Bluetooth: Remove BT_HS
+    - Bluetooth: hci_event: Fix not indicating new connection for BIG Sync
+    - Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
+    - Bluetooth: hci_core: Cancel request on command timeout
+    - Bluetooth: hci_sync: Fix overwriting request callback
+    - Bluetooth: hci_h5: Add ability to allocate memory for private data
+    - Bluetooth: btrtl: fix out of bounds memory access
+    - Bluetooth: hci_core: Fix possible buffer overflow
+    - Bluetooth: msft: Fix memory leak
+    - Bluetooth: btusb: Fix memory leak
+    - Bluetooth: af_bluetooth: Fix deadlock
+    - Bluetooth: fix use-after-free in accessing skb after sending it
+    - sr9800: Add check for usbnet_get_endpoints
+    - s390/cache: prevent rebuild of shared_cpu_list
+    - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
+    - bpf: Fix hashtab overflow check on 32-bit arches
+    - bpf: Fix stackmap overflow check on 32-bit arches
+    - net: dsa: microchip: make sure drive strength configuration is not lost by
+      soft reset
+    - dpll: spec: use proper enum for pin capabilities attribute
+    - iommu: Fix compilation without CONFIG_IOMMU_INTEL
+    - ipv6: fib6_rules: flush route cache when rule is changed
+    - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
+    - octeontx2-af: Fix devlink params
+    - net: phy: fix phy_get_internal_delay accessing an empty array
+    - dpll: fix dpll_xa_ref_*_del() for multiple registrations
+    - net: hns3: fix wrong judgment condition issue
+    - net: hns3: fix kernel crash when 1588 is received on HIP08 devices
+    - net: hns3: fix port duplex configure error in IMP reset
+    - Bluetooth: Fix eir name length
+    - net: phy: dp83822: Fix RGMII TX delay configuration
+    - erofs: fix lockdep false positives on initializing erofs_pseudo_mnt
+    - OPP: debugfs: Fix warning around icc_get_name()
+    - tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
+    - ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt()
+      function
+    - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
+      function
+    - udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
+    - net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
+    - net/x25: fix incorrect parameter validation in the x25_getsockopt() function
+    - devlink: Fix length of eswitch inline-mode
+    - r8152: fix unknown device for choose_configuration
+    - nfp: flower: handle acti_netdevs allocation failure
+    - bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
+    - dm raid: fix false positive for requeue needed during reshape
+    - dm: call the resume method on internal suspend
+    - fbdev/simplefb: change loglevel when the power domains cannot be parsed
+    - drm/tegra: dsi: Add missing check for of_find_device_by_node
+    - drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
+    - drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
+    - drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path
+      of tegra_dsi_probe()
+    - drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe()
+    - drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
+    - drm/tegra: rgb: Fix missing clk_put() in the error handling paths of
+      tegra_dc_rgb_probe()
+    - drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths
+      of tegra_output_probe()
+    - drm/rockchip: inno_hdmi: Fix video timing
+    - drm: Don't treat 0 as -1 in drm_fixp2int_ceil
+    - drm/vkms: Avoid reading beyond LUT array
+    - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
+    - drm/rockchip: lvds: do not overwrite error code
+    - drm/rockchip: lvds: do not print scary message when probing defer
+    - drm/panel-edp: use put_sync in unprepare
+    - drm/lima: fix a memleak in lima_heap_alloc
+    - ASoC: amd: acp: Add missing error handling in sof-mach
+    - ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe()
+    - ASoC: SOF: core: Skip firmware test for custom loaders
+    - ASoC: SOF: amd: Compute file paths on firmware load
+    - soundwire: stream: add missing const to Documentation
+    - dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
+    - media: tc358743: register v4l2 async device only after successful setup
+    - media: cadence: csi2rx: use match fwnode for media link
+    - PCI/DPC: Print all TLP Prefixes, not just the first
+    - perf record: Fix possible incorrect free in record__switch_output()
+    - perf record: Check conflict between '--timestamp-filename' option and pipe
+      mode before recording
+    - HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
+    - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
+    - perf pmu: Treat the msr pmu as software
+    - crypto: qat - avoid memcpy() overflow warning
+    - ALSA: hda: cs35l41: Set Channel Index correctly when system is missing _DSD
+    - drm/amd/display: Fix potential NULL pointer dereferences in
+      'dcn10_set_output_transfer_func()'
+    - ASoC: sh: rz-ssi: Fix error message print
+    - drm/vmwgfx: Fix vmw_du_get_cursor_mob fencing of newly-created MOBs
+    - clk: renesas: r8a779g0: Fix PCIe clock name
+    - pinctrl: renesas: rzg2l: Fix locking in rzg2l_dt_subnode_to_map()
+    - pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function
+    - clk: samsung: exynos850: Propagate SPI IPCLK rate change
+    - media: v4l2: cci: print leading 0 on error
+    - perf evsel: Fix duplicate initialization of data->id in
+      evsel__parse_sample()
+    - perf bpf: Clean up the generated/copied vmlinux.h
+    - clk: meson: Add missing clocks to axg_clk_regmaps
+    - media: em28xx: annotate unchecked call to media_device_register()
+    - media: v4l2-tpg: fix some memleaks in tpg_alloc
+    - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
+    - media: dt-bindings: techwell,tw9900: Fix port schema ref
+    - mtd: spinand: esmt: Extend IDs to 5 bytes
+    - media: edia: dvbdev: fix a use-after-free
+    - pinctrl: mediatek: Drop bogus slew rate register range for MT8186
+    - pinctrl: mediatek: Drop bogus slew rate register range for MT8192
+    - drm/amdgpu: Fix potential out-of-bounds access in
+      'amdgpu_discovery_reg_base_init()'
+    - clk: qcom: reset: Commonize the de/assert functions
+    - clk: qcom: reset: Ensure write completion on reset de/assertion
+    - quota: Fix potential NULL pointer dereference
+    - quota: Fix rcu annotations of inode dquot pointers
+    - quota: Properly annotate i_dquot arrays with __rcu
+    - ASoC: Intel: ssp-common: Add stub for sof_ssp_get_codec_name
+    - PCI/P2PDMA: Fix a sleeping issue in a RCU read section
+    - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
+    - crypto: xilinx - call finalize with bh disabled
+    - drivers/ps3: select VIDEO to provide cmdline functions
+    - perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
+    - perf srcline: Add missed addr2line closes
+    - dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible
+    - drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN
+    - drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled
+    - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
+    - drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
+    - clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks
+    - clk: renesas: r8a779f0: Correct PFC/GPIO parent clock
+    - clk: renesas: r9a07g04[34]: Use SEL_SDHI1_STS status configuration for SD1
+      mux
+    - ALSA: seq: fix function cast warnings
+    - perf expr: Fix "has_event" function for metric style events
+    - perf stat: Avoid metric-only segv
+    - perf metric: Don't remove scale from counts
+    - ASoC: meson: aiu: fix function pointer type mismatch
+    - ASoC: meson: t9015: fix function pointer type mismatch
+    - powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
+    - ASoC: SOF: Add some bounds checking to firmware data
+    - drm: ci: use clk_ignore_unused for apq8016
+    - NTB: fix possible name leak in ntb_register_device()
+    - media: cedrus: h265: Fix configuring bitstream size
+    - media: sun8i-di: Fix coefficient writes
+    - media: sun8i-di: Fix power on/off sequences
+    - media: sun8i-di: Fix chroma difference threshold
+    - staging: media: starfive: Set 16 bpp for capture_raw device
+    - media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
+    - media: go7007: add check of return value of go7007_read_addr()
+    - media: pvrusb2: remove redundant NULL check
+    - media: videobuf2: Add missing doc comment for waiting_in_dqbuf
+    - media: pvrusb2: fix pvr2_stream_callback casts
+    - clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
+    - drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'
+    - drm/panel: boe-tv101wum-nl6: make use of prepare_prev_first
+    - drm/msm/dpu: finalise global state object
+    - drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
+    - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
+    - drm/bridge: adv7511: fix crash on irq during probe
+    - pinctrl: renesas: Allow the compiler to optimize away sh_pfc_pm
+    - clk: hisilicon: hi3519: Release the correct number of gates in
+      hi3519_clk_unregister()
+    - clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
+    - clk: mediatek: mt8135: Fix an error handling path in
+      clk_mt8135_apmixed_probe()
+    - clk: mediatek: mt7622-apmixedsys: Fix an error handling path in
+      clk_mt8135_apmixed_probe()
+    - clk: mediatek: mt8183: Correct parent of CLK_INFRA_SSPM_32K_SELF
+    - clk: mediatek: mt7981-topckgen: flag SGM_REG_SEL as critical
+    - drm/tegra: put drm_gem_object ref on error in tegra_fb_create
+    - tty: mips_ejtag_fdc: Fix passing incompatible pointer type warning
+    - media: ivsc: csi: Swap SINK and SOURCE pads
+    - media: i2c: imx290: Fix IMX920 typo
+    - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
+    - mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a
+      ref
+    - perf print-events: make is_event_supported() more robust
+    - crypto: arm/sha - fix function cast warnings
+    - crypto: ccp - Avoid discarding errors in psp_send_platform_access_msg()
+    - crypto: qat - remove unused macros in qat_comp_alg.c
+    - crypto: qat - removed unused macro in adf_cnv_dbgfs.c
+    - crypto: qat - avoid division by zero
+    - crypto: qat - remove double initialization of value
+    - crypto: qat - fix ring to service map for dcc in 4xxx
+    - crypto: qat - fix ring to service map for dcc in 420xx
+    - crypto: jitter - fix CRYPTO_JITTERENTROPY help text
+    - drm/tidss: Fix initial plane zpos values
+    - drm/tidss: Fix sync-lost issue with two displays
+    - clk: imx: imx8mp: Fix SAI_MCLK_SEL definition
+    - mtd: maps: physmap-core: fix flash size larger than 32-bit
+    - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
+    - mtd: rawnand: brcmnand: exec_op helper functions return type fixes
+    - ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
+    - ASoC: meson: axg-tdm-interface: add frame rate constraint
+    - drm/msm/a6xx: specify UBWC config for sc7180
+    - drm/msm/a7xx: Fix LLC typo
+    - dt-bindings: arm-smmu: fix SM8[45]50 GPU SMMU if condition
+    - perf pmu: Fix a potential memory leak in perf_pmu__lookup()
+    - HID: amd_sfh: Update HPD sensor structure elements
+    - HID: amd_sfh: Avoid disabling the interrupt
+    - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
+    - media: pvrusb2: fix uaf in pvr2_context_set_notify
+    - media: dvb-frontends: avoid stack overflow warnings with clang
+    - media: go7007: fix a memleak in go7007_load_encoder
+    - media: ttpci: fix two memleaks in budget_av_attach
+    - media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
+    - arm64: ftrace: Don't forbid CALL_OPS+CC_OPTIMIZE_FOR_SIZE with Clang
+    - drm/tests: helpers: Include missing drm_drv header
+    - drm/amd/pm: Fix esm reg mask use to get pcie speed
+    - gpio: nomadik: fix offset bug in nmk_pmx_set()
+    - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
+    - mfd: cs42l43: Fix wrong register defaults
+    - powerpc/32: fix ADB_CUDA kconfig warning
+    - powerpc/pseries: Fix potential memleak in papr_get_attr()
+    - powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
+    - clk: qcom: gcc-ipq5018: fix 'enable_reg' offset of 'gcc_gmac0_sys_clk'
+    - clk: qcom: gcc-ipq5018: fix 'halt_reg' offset of 'gcc_pcie1_pipe_clk'
+    - clk: qcom: gcc-ipq5018: fix register offset for GCC_UBI0_AXI_ARES reset
+    - perf vendor events amd: Fix Zen 4 cache latency events
+    - drm/msm/dpu: allow certain formats for CDM for DP
+    - drm/msm/dpu: add division of drm_display_mode's hskew parameter
+    - media: usbtv: Remove useless locks in usbtv_video_free()
+    - drm/xe: Fix ref counting leak on page fault
+    - drm/xe: Replace 'grouped target' in Makefile with pattern rule
+    - lib/stackdepot: fix first entry having a 0-handle
+    - lib/stackdepot: off by one in depot_fetch_stack()
+    - modules: wait do_free_init correctly
+    - mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults
+    - power: supply: mm8013: fix "not charging" detection
+    - powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
+    - powerpc/4xx: Fix warp_gpio_leds build failure
+    - RISC-V: KVM: Forward SEED CSR access to user space
+    - leds: aw2013: Unlock mutex before destroying it
+    - leds: sgm3140: Add missing timer cleanup and flash gpio control
+    - backlight: hx8357: Fix potential NULL pointer dereference
+    - backlight: ktz8866: Correct the check for of_property_read_u32
+    - backlight: lm3630a: Initialize backlight_properties on init
+    - backlight: lm3630a: Don't set bl->props.brightness in get_brightness
+    - backlight: da9052: Fully initialize backlight_properties during probe
+    - backlight: lm3639: Fully initialize backlight_properties during probe
+    - backlight: lp8788: Fully initialize backlight_properties during probe
+    - sparc32: Use generic cmpdi2/ucmpdi2 variants
+    - mtd: maps: sun_uflash: Declare uflash_devinit static
+    - sparc32: Do not select GENERIC_ISA_DMA
+    - sparc32: Fix section mismatch in leon_pci_grpci
+    - clk: Fix clk_core_get NULL dereference
+    - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
+    - PCI: brcmstb: Fix broken brcm_pcie_mdio_write() polling
+    - cifs: Fix writeback data corruption
+    - ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
+    - ALSA: hda/tas2781: use dev_dbg in system_resume
+    - ALSA: hda/tas2781: add lock to system_suspend
+    - ALSA: hda/tas2781: do not reset cur_* values in runtime_suspend
+    - ALSA: hda/tas2781: do not call pm_runtime_force_* in system_resume/suspend
+    - ALSA: hda/tas2781: restore power state after system_resume
+    - ALSA: scarlett2: Fix Scarlett 4th Gen 4i4 low-voltage detection
+    - ALSA: scarlett2: Fix Scarlett 4th Gen autogain status values
+    - ALSA: scarlett2: Fix Scarlett 4th Gen input gain range
+    - ALSA: scarlett2: Fix Scarlett 4th Gen input gain range again
+    - mips: cm: Convert __mips_cm_l2sync_phys_base() to weak function
+    - platform/x86/intel/pmc/lnl: Remove SSRAM support
+    - platform/x86/intel/pmc/arl: Put GNA device in D3
+    - platform/x86/amd/pmf: Do not use readl() for policy buffer access
+    - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
+    - phy: qcom: qmp-usb: split USB-C PHY driver
+    - phy: qcom: qmp-usbc: add support for the Type-C handling
+    - phy: qcom: qmp-usbc: handle CLAMP register in a correct way
+    - scsi: hisi_sas: Fix a deadlock issue related to automatic dump
+    - RDMA/irdma: Remove duplicate assignment
+    - RDMA/srpt: Do not register event handler until srpt device is fully setup
+    - f2fs: compress: fix to guarantee persisting compressed blocks by CP
+    - f2fs: compress: fix to cover normal cluster write with cp_rwsem
+    - f2fs: compress: fix to check unreleased compressed cluster
+    - f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode
+    - f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic
+    - f2fs: zone: fix to wait completion of last bio in zone correctly
+    - f2fs: fix NULL pointer dereference in f2fs_submit_page_write()
+    - f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem
+    - f2fs: fix to avoid potential panic during recovery
+    - scsi: csiostor: Avoid function pointer casts
+    - i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling
+    - RDMA/hns: Fix mis-modifying default congestion control algorithm
+    - RDMA/device: Fix a race between mad_client and cm_client init
+    - RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
+    - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
+    - f2fs: fix to create selinux label during whiteout initialization
+    - f2fs: compress: fix to check zstd compress level correctly in mount option
+    - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
+    - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
+    - NFSv4.2: fix listxattr maximum XDR buffer size
+    - f2fs: compress: fix to check compress flag w/ .i_sem lock
+    - f2fs: check number of blocks in a current section
+    - watchdog: starfive: Check pm_runtime_enabled() before decrementing usage
+      counter
+    - watchdog: stm32_iwdg: initialize default timeout
+    - f2fs: fix to use correct segment type in f2fs_allocate_data_block()
+    - f2fs: ro: compress: fix to avoid caching unaligned extent
+    - RDMA/mana_ib: Fix bug in creation of dma regions
+    - RDMA/mana_ib: Introduce mdev_to_gc helper function
+    - RDMA/mana_ib: Introduce mana_ib_get_netdev helper function
+    - RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function
+    - RDMA/mana_ib: Use virtual address in dma regions for MRs
+    - Input: iqs7222 - add support for IQS7222D v1.1 and v1.2
+    - NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt
+    - NFS: Fix an off by one in root_nfs_cat()
+    - NFSv4.1/pnfs: fix NFS with TLS in pnfs
+    - ACPI: HMAT: Remove register of memory node for generic target
+    - f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks
+    - f2fs: compress: fix reserve_cblocks counting error when out of space
+    - f2fs: fix to truncate meta inode pages forcely
+    - f2fs: zone: fix to remove pow2 check condition for zoned block device
+    - cxl: Fix the incorrect assignment of SSLBIS entry pointer initial location
+    - perf/x86/amd/core: Avoid register reset when CPU is dead
+    - afs: Revert "afs: Hide silly-rename files from userspace"
+    - afs: Don't cache preferred address
+    - afs: Fix occasional rmdir-then-VNOVNODE with generic/011
+    - f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
+    - nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
+    - ovl: relax WARN_ON in ovl_verify_area()
+    - io_uring/net: correct the type of variable
+    - remoteproc: stm32: Fix incorrect type in assignment for va
+    - remoteproc: stm32: Fix incorrect type assignment returned by
+      stm32_rproc_get_loaded_rsc_tablef
+    - iio: pressure: mprls0025pa fix off-by-one enum
+    - usb: phy: generic: Get the vbus supply
+    - tty: vt: fix 20 vs 0x20 typo in EScsiignore
+    - serial: max310x: fix syntax error in IRQ error message
+    - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
+    - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
+    - coresight: Fix issue where a source device's helpers aren't disabled
+    - coresight: etm4x: Set skip_power_up in etm4_init_arch_data function
+    - xhci: Add interrupt pending autoclear flag to each interrupter
+    - xhci: make isoc_bei_interval variable interrupter specific.
+    - xhci: remove unnecessary event_ring_deq parameter from xhci_handle_event()
+    - xhci: update event ring dequeue pointer position to controller correctly
+    - coccinelle: device_attr_show: Remove useless expression STR
+    - kconfig: fix infinite loop when expanding a macro at the end of file
+    - iio: gts-helper: Fix division loop
+    - bus: mhi: ep: check the correct variable in mhi_ep_register_controller()
+    - hwtracing: hisi_ptt: Move type check to the beginning of
+      hisi_ptt_pmu_event_init()
+    - rtc: mt6397: select IRQ_DOMAIN instead of depending on it
+    - rtc: max31335: fix interrupt status reg
+    - serial: 8250_exar: Don't remove GPIO device on suspend
+    - staging: greybus: fix get_channel_from_mode() failure path
+    - mei: vsc: Call wake_up() in the threaded IRQ handler
+    - mei: vsc: Don't use sleeping condition in wait_event_timeout()
+    - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
+    - char: xilinx_hwicap: Fix NULL vs IS_ERR() bug
+    - x86/hyperv: Use per cpu initial stack for vtl context
+    - ASoC: tlv320adc3xxx: Don't strip remove function when driver is builtin
+    - thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error
+      handling path
+    - thermal/drivers/qoriq: Fix getting tmu range
+    - io_uring: don't save/restore iowait state
+    - spi: lpspi: Avoid potential use-after-free in probe()
+    - spi: Restore delays for non-GPIO chip select
+    - ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates
+    - nouveau: reset the bo resource bus info after an eviction
+    - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
+    - rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
+    - octeontx2-af: Use matching wake_up API variant in CGX command interface
+    - s390/vtime: fix average steal time calculation
+    - net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
+    - devlink: Fix devlink parallel commands processing
+    - riscv: Only check online cpus for emulated accesses
+    - soc: fsl: dpio: fix kcalloc() argument order
+    - cpufreq: Fix per-policy boost behavior on SoCs using cpufreq_boost_set_sw()
+    - io_uring: Fix release of pinned pages when __io_uaddr_map fails
+    - tcp: Fix refcnt handling in __inet_hash_connect().
+    - vmxnet3: Fix missing reserved tailroom
+    - hsr: Fix uninit-value access in hsr_get_node()
+    - net: txgbe: fix clk_name exceed MAX_DEV_ID limits
+    - spi: spi-mem: add statistics support to ->exec_op() calls
+    - spi: Fix error code checking in spi_mem_exec_op()
+    - nvme: fix reconnection fail due to reserved tag allocation
+    - drm/xe: Invalidate userptr VMA on page pin fault
+    - drm/xe: Skip VMAs pin when requesting signal to the last XE_EXEC
+    - net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
+    - net: ethernet: mtk_eth_soc: fix PPE hanging issue
+    - io_uring: fix poll_remove stalled req completion
+    - ASoC: SOF: amd: Move signed_fw_image to struct acp_quirk_entry
+    - ASoC: SOF: amd: Skip IRAM/DRAM size modification for Steam Deck OLED
+    - riscv: Fix compilation error with FAST_GUP and rv32
+    - xen/evtchn: avoid WARN() when unbinding an event channel
+    - xen/events: increment refcnt only if event channel is refcounted
+    - packet: annotate data-races around ignore_outgoing
+    - xfrm: Allow UDP encapsulation only in offload modes
+    - net: veth: do not manipulate GRO when using XDP
+    - net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
+    - spi: spi-imx: fix off-by-one in mx51 CPU mode burst length
+    - drm: Fix drm_fixp2int_round() making it add 0.5
+    - virtio: uapi: Drop __packed attribute in linux/virtio_pci.h
+    - vdpa_sim: reset must not run
+    - vdpa/mlx5: Allow CVQ size changes
+    - virtio: packed: fix unmap leak for indirect desc table
+    - net: move dev->state into net_device_read_txrx group
+    - wireguard: receive: annotate data-race around receiving_counter.counter
+    - rds: introduce acquire/release ordering in acquire/release_in_xmit()
+    - hsr: Handle failures in module init
+    - ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels
+    - nouveau/gsp: don't check devinit disable on GSP.
+    - ceph: stop copying to iter at EOF on sync reads
+    - net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
+    - dm-integrity: fix a memory leak when rechecking the data
+    - net/bnx2x: Prevent access to a freed page in page_pool
+    - devlink: fix port new reply cmd type
+    - octeontx2: Detect the mbox up or down message via register
+    - octeontx2-pf: Wait till detach_resources msg is complete
+    - octeontx2-pf: Use default max_active works instead of one
+    - octeontx2-pf: Send UP messages to VF only when VF is up.
+    - octeontx2-af: Use separate handlers for interrupts
+    - drm/amdgpu: add MMHUB 3.3.1 support
+    - drm/amdgpu: fix mmhub client id out-of-bounds access
+    - drm/amdgpu: drop setting buffer funcs in sdma442
+    - netfilter: nft_set_pipapo: release elements in clone only from destroy path
+    - netfilter: nf_tables: do not compare internal table flags on updates
+    - rcu: add a helper to report consolidated flavor QS
+    - net: report RCU QS on threaded NAPI repolling
+    - bpf: report RCU QS in cpumap kthread
+    - net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
+    - net: dsa: mt7530: fix handling of all link-local frames
+    - netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
+    - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
+    - selftests: forwarding: Fix ping failure due to short timeout
+    - dm io: Support IO priority
+    - dm-integrity: align the outgoing bio in integrity_recheck
+    - x86/efistub: Clear decompressor BSS in native EFI entrypoint
+    - x86/efistub: Don't clear BSS twice in mixed mode
+    - printk: Adjust mapping for 32bit seq macros
+    - printk: Use prb_first_seq() as base for 32bit seq macros
+    - Linux 6.8.2
+    - [Config] updateconfig following v6.8.2 import
+
+  * Provide python perf module (LP: #2051560)
+    - [Packaging] enable perf python module
+    - [Packaging] provide a wrapper module for python-perf
+
+  * To support AMD Adaptive Backlight Management (ABM) for power profiles daemon
+    >= 2.0 (LP: #2056716)
+    - drm/amd/display: add panel_power_savings sysfs entry to eDP connectors
+    - drm/amdgpu: respect the abmlevel module parameter value if it is set
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable StarFive JH7100 support
+    - [Config] Disable Renesas RZ/Five support
+    - [Config] Disable BINFMT_FLAT for riscv64
+
+ -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Wed, 01 May 2024 16:02:05 +0200
+
+linux (6.8.0-31.31) noble; urgency=medium
+
+  * noble/linux: 6.8.0-31.31 -proposed tracker (LP: #2062933)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.04.04)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 19 Apr 2024 23:46:38 +0200
+
+linux (6.8.0-30.30) noble; urgency=medium
+
+  * noble/linux: 6.8.0-30.30 -proposed tracker (LP: #2061893)
+
+  * System unstable, kernel ring buffer flooded with "BUG: Bad page state in
+    process swapper/0" (LP: #2056706)
+    - xen-netfront: Add missing skb_mark_for_recycle
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 16 Apr 2024 21:17:11 +0200
+
+linux (6.8.0-29.29) noble; urgency=medium
+
+  * noble/linux: 6.8.0-29.29 -proposed tracker (LP: #2061888)
+
+  * [24.04 FEAT] [SEC2353] zcrypt: extend error recovery to deal with device
+    scans (LP: #2050019)
+    - s390/zcrypt: harmonize debug feature calls and defines
+    - s390/zcrypt: introduce dynamic debugging for AP and zcrypt code
+    - s390/pkey: harmonize pkey s390 debug feature calls
+    - s390/pkey: introduce dynamic debugging for pkey
+    - s390/ap: add debug possibility for AP messages
+    - s390/zcrypt: add debug possibility for CCA and EP11 messages
+    - s390/ap: rearm APQNs bindings complete completion
+    - s390/ap: clarify AP scan bus related functions and variables
+    - s390/ap: rework ap_scan_bus() to return true on config change
+    - s390/ap: introduce mutex to lock the AP bus scan
+    - s390/zcrypt: introduce retries on in-kernel send CPRB functions
+    - s390/zcrypt: improve zcrypt retry behavior
+    - s390/pkey: improve pkey retry behavior
+
+  * [24.04 FEAT] Memory hotplug vmem pages (s390x) (LP: #2051835)
+    - mm/memory_hotplug: introduce MEM_PREPARE_ONLINE/MEM_FINISH_OFFLINE notifiers
+    - s390/mm: allocate vmemmap pages from self-contained memory range
+    - s390/sclp: remove unhandled memory notifier type
+    - s390/mm: implement MEM_PREPARE_ONLINE/MEM_FINISH_OFFLINE notifiers
+    - s390: enable MHP_MEMMAP_ON_MEMORY
+    - [Config] enable CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE and
+      CONFIG_MHP_MEMMAP_ON_MEMORY for s390x
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 16 Apr 2024 20:32:09 +0200
+
+linux (6.8.0-28.28) noble; urgency=medium
+
+  * noble/linux: 6.8.0-28.28 -proposed tracker (LP: #2061867)
+
+  * linux-gcp 6.8.0-1005.5 (+ others) Noble kernel regression iwth new apparmor
+    profiles/features (LP: #2061851)
+    - SAUCE: apparmor4.0.0 [92/90]: fix address mapping for recvfrom
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 16 Apr 2024 18:29:17 +0200
+
+linux (6.8.0-25.25) noble; urgency=medium
+
+  * noble/linux: 6.8.0-25.25 -proposed tracker (LP: #2061083)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.04.04)
+
+  * Apply mitigations for the native BHI hardware vulnerabilty (LP: #2060909)
+    - x86/cpufeatures: Add new word for scattered features
+    - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file
+    - x86/syscall: Don't force use of indirect calls for system calls
+    - x86/bhi: Add support for clearing branch history at syscall entry
+    - x86/bhi: Define SPEC_CTRL_BHI_DIS_S
+    - x86/bhi: Enumerate Branch History Injection (BHI) bug
+    - x86/bhi: Add BHI mitigation knob
+    - x86/bhi: Mitigate KVM by default
+    - KVM: x86: Add BHI_NO
+    - x86: set SPECTRE_BHI_ON as default
+    - [Config] enable spectre_bhi=auto by default
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/90]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/90]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/90]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/90]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/90]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/90]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/90]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/90]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/90]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/90]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/90]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/90]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/90]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/90]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/90]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/90]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/90]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/90]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/90]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/90]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/90]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [31/90]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/90]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/90]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/90]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/90]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/90]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/90]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/90]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/90]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/90]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/90]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/90]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [43/90]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/90]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/90]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/90]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/90]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/90]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/90]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/90]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/90]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/90]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/90]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/90]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/90]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/90]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/90]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/90]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/90]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/90]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/90]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/90]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/90]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/90]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [65/90] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [69/90]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [70/90]: apparmor: fix oops when racing to retrieve
+      notification
+    - SAUCE: apparmor4.0.0 [71/90]: apparmor: fix notification header size
+    - SAUCE: apparmor4.0.0 [72/90]: apparmor: fix request field from a prompt
+      reply that denies all access
+    - SAUCE: apparmor4.0.0 [73/90]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+    - SAUCE: apparmor4.0.0 [74/90]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/90]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/90]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/90]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/90]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/90]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/90]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/90]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/90]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/90]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/90]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/90]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/90]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/90]: fixup notify
+    - SAUCE: apparmor4.0.0 [88/90]: apparmor: add fine grained ipv4/ipv6 mediation
+    - SAUCE: apparmor4.0.0 [89/90]:apparmor: disable tailglob responses for now
+    - SAUCE: apparmor4.0.0 [90/90]: apparmor: Fix notify build warnings
+    - SAUCE: apparmor4.0.0: fix reserved mem for when we save ipv6 addresses
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/90]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/90]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/90]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+
+  * [MTL] x86: Fix Cache info sysfs is not populated (LP: #2049793)
+    - SAUCE: cacheinfo: Check for null last-level cache info
+    - SAUCE: cacheinfo: Allocate memory for memory if not done from the primary
+      CPU
+    - SAUCE: x86/cacheinfo: Delete global num_cache_leaves
+    - SAUCE: x86/cacheinfo: Clean out init_cache_level()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor4.0.0: LSM stacking v39: fix build error with
+      CONFIG_SECURITY=n
+    - [Config] toolchain version update
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 12 Apr 2024 10:42:33 +0200
+
+linux (6.8.0-22.22) noble; urgency=medium
+
+  * noble/linux: 6.8.0-22.22 -proposed tracker (LP: #2060238)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 04 Apr 2024 23:00:49 +0200
+
+linux (6.8.0-21.21) noble; urgency=medium
+
+  * noble/linux: 6.8.0-21.21 -proposed tracker (LP: #2060225)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain version in annotations
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 04 Apr 2024 22:20:27 +0200
+
+linux (6.8.0-20.20) noble; urgency=medium
+
+  * noble/linux: 6.8.0-20.20 -proposed tracker (LP: #2058221)
+
+  * Noble update: v6.8.1 upstream stable release (LP: #2058224)
+    - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
+    - Documentation/hw-vuln: Add documentation for RFDS
+    - x86/rfds: Mitigate Register File Data Sampling (RFDS)
+    - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
+    - Linux 6.8.1
+
+  * Autopkgtest failures on amd64 (LP: #2048768)
+    - [Packaging] update to clang-18
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor4.0.0: LSM stacking v39: fix build error with
+      CONFIG_SECURITY=n
+    - [Config] amd64: MITIGATION_RFDS=y
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 Mar 2024 11:08:14 +0100
+
+linux (6.8.0-19.19) noble; urgency=medium
+
+  * noble/linux: 6.8.0-19.19 -proposed tracker (LP: #2057910)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-introduce linux-doc as an empty package
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 14 Mar 2024 14:36:14 +0100
+
+linux (6.8.0-18.18) noble; urgency=medium
+
+  * noble/linux: 6.8.0-18.18 -proposed tracker (LP: #2057456)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] drop dependency on libclang-17
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 12 Mar 2024 14:44:13 +0100
+
+linux (6.8.0-17.17) noble; urgency=medium
+
+  * noble/linux: 6.8.0-17.17 -proposed tracker (LP: #2056745)
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Add debian/control sanity check"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 11 Mar 2024 12:46:38 +0100
+
+linux (6.8.0-16.16) noble; urgency=medium
+
+  * noble/linux: 6.8.0-16.16 -proposed tracker (LP: #2056738)
+
+  * left-over ceph debugging printks (LP: #2056616)
+    - Revert "UBUNTU: SAUCE: ceph: make sure all the files successfully put before
+      unmounting"
+
+  * qat: Improve error recovery flows (LP: #2056354)
+    - crypto: qat - add heartbeat error simulator
+    - crypto: qat - disable arbitration before reset
+    - crypto: qat - update PFVF protocol for recovery
+    - crypto: qat - re-enable sriov after pf reset
+    - crypto: qat - add fatal error notification
+    - crypto: qat - add auto reset on error
+    - crypto: qat - limit heartbeat notifications
+    - crypto: qat - improve aer error reset handling
+    - crypto: qat - change SLAs cleanup flow at shutdown
+    - crypto: qat - resolve race condition during AER recovery
+    - Documentation: qat: fix auto_reset section
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/87]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/87]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/87]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/87]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/87]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/87]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/87]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/87]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/87]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/87]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/87]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/87]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/87]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/87]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/87]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/87]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/87]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/87]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/87]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/87]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/87]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [31/87]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/87]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/87]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/87]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/87]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/87]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/87]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/87]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/87]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/87]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/87]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/87]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [43/87]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/87]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/87]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/87]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/87]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/87]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/87]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/87]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/87]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/87]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/87]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/87]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/87]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/87]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/87]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/87]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/87]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/87]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/87]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/87]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/87]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/87]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [65/87] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [69/87]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [70/87]: apparmor: fix oops when racing to retrieve
+      notification
+    - SAUCE: apparmor4.0.0 [71/87]: apparmor: fix notification header size
+    - SAUCE: apparmor4.0.0 [72/87]: apparmor: fix request field from a prompt
+      reply that denies all access
+    - SAUCE: apparmor4.0.0 [73/87]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+    - SAUCE: apparmor4.0.0 [74/87]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/87]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/87]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/87]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/87]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/87]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/87]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/87]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/87]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/87]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/87]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/87]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/87]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/87]: fixup notify
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/87]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/87]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/87]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+
+  * Enable lowlatency settings in the generic kernel (LP: #2051342)
+    - [Config] enable low-latency settings
+
+  * hwmon: (coretemp) Fix core count limitation (LP: #2056126)
+    - hwmon: (coretemp) Introduce enum for attr index
+    - hwmon: (coretemp) Remove unnecessary dependency of array index
+    - hwmon: (coretemp) Replace sensor_device_attribute with device_attribute
+    - hwmon: (coretemp) Remove redundant pdata->cpu_map[]
+    - hwmon: (coretemp) Abstract core_temp helpers
+    - hwmon: (coretemp) Split package temp_data and core temp_data
+    - hwmon: (coretemp) Remove redundant temp_data->is_pkg_data
+    - hwmon: (coretemp) Use dynamic allocated memory for core temp_data
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION
+    - [Packaging] remove debian/scripts/misc/arch-has-odm-enabled.sh
+    - rebase on v6.8
+    - [Config] toolchain version update
+
+  * Miscellaneous upstream changes
+    - crypto: qat - add fatal error notify method
+
+  * Rebase on v6.8
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 11 Mar 2024 10:14:10 +0100
+
+linux (6.8.0-15.15) noble; urgency=medium
+
+  * noble/linux: 6.8.0-15.15 -proposed tracker (LP: #2055871)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.8-rc7
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Transition laptop-23.10 to generic"
+
+  * Rebase on v6.8-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 04 Mar 2024 11:50:51 +0100
+
+linux (6.8.0-14.14) noble; urgency=medium
+
+  * noble/linux: 6.8.0-14.14 -proposed tracker (LP: #2055551)
+
+  * Please change CONFIG_CONSOLE_LOGLEVEL_QUIET to 3 (LP: #2049390)
+    - [Config] reduce verbosity when booting in quiet mode
+
+  * linux: please move erofs.ko (CONFIG_EROFS for EROFS support) from linux-
+    modules-extra to linux-modules (LP: #2054809)
+    - UBUNTU [Packaging]: Include erofs in linux-modules instead of linux-modules-
+      extra
+
+  * linux: please move dmi-sysfs.ko (CONFIG_DMI_SYSFS for SMBIOS support) from
+    linux-modules-extra to linux-modules (LP: #2045561)
+    - [Packaging] Move dmi-sysfs.ko into linux-modules
+
+  * Enable CONFIG_INTEL_IOMMU_DEFAULT_ON and
+    CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON (LP: #1951440)
+    - [Config] enable Intel DMA remapping by default
+
+  * disable Intel DMA remapping by default (LP: #1971699)
+    - [Config] update tracking bug for CONFIG_INTEL_IOMMU_DEFAULT_ON
+
+  * Packaging resync (LP: #1786013)
+    - debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.02.29)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: modpost: Replace 0-length array with flex-array member
+    - [packaging] do not include debian/ directory in a binary package
+    - [packaging] remove debian/stamps/keep-dir
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 01 Mar 2024 11:45:12 +0100
+
+linux (6.8.0-13.13) noble; urgency=medium
+
+  * noble/linux: 6.8.0-13.13 -proposed tracker (LP: #2055421)
+
+  * Packaging resync (LP: #1786013)
+    - debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.02.29)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.8-rc6
+    - [Config] updateconfifs following v6.8-rc6 rebase
+
+  * Rebase on v6.8-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 29 Feb 2024 15:02:24 +0100
+
+linux (6.8.0-12.12) noble; urgency=medium
+
+  * linux-tools-common: man page of usbip[d] is misplaced (LP: #2054094)
+    - [Packaging] rules: Put usbip manpages in the correct directory
+
+  * Validate connection interval to pass Bluetooth Test Suite (LP: #2052005)
+    - Bluetooth: Enforce validation on max value of connection interval
+
+  * Turning COMPAT_32BIT_TIME off on s390x (LP: #2038583)
+    - [Config] Turn off 31-bit COMPAT on s390x
+
+  * Don't produce linux-source binary package (LP: #2043994)
+    - [Packaging] Add debian/control sanity check
+
+  * Don't produce linux-*-source-<version> package (LP: #2052439)
+    - [Packaging] Move linux-source package stub to debian/control.d
+    - [Packaging] Build linux-source package only for the main kernel
+
+  * Don't produce linux-*-cloud-tools-common, linux-*-tools-common and
+    linux-*-tools-host binary packages (LP: #2048183)
+    - [Packaging] Move indep tools package stubs to debian/control.d
+    - [Packaging] Build indep tools packages only for the main kernel
+
+  * Enable CONFIG_INTEL_IOMMU_DEFAULT_ON and
+    CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON (LP: #1951440)
+    - [Config] enable Intel DMA remapping by default
+
+  * disable Intel DMA remapping by default (LP: #1971699)
+    - [Config] update tracking bug for CONFIG_INTEL_IOMMU_DEFAULT_ON
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Transition laptop-23.10 to generic
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 22 Feb 2024 14:31:00 +0100
+
+linux (6.8.0-11.11) noble; urgency=medium
+
+  * noble/linux: 6.8.0-11.11 -proposed tracker (LP: #2053094)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] riscv64: disable building unnecessary binary debs
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 14 Feb 2024 00:04:31 +0100
+
+linux (6.8.0-10.10) noble; urgency=medium
+
+  * noble/linux: 6.8.0-10.10 -proposed tracker (LP: #2053015)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] add Rust build-deps for riscv64
+
+  * Miscellaneous upstream changes
+    - Revert "Revert "UBUNTU: [Packaging] temporarily disable Rust dependencies on
+      riscv64""
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 13 Feb 2024 13:23:47 +0100
+
+linux (6.8.0-9.9) noble; urgency=medium
+
+  * noble/linux: 6.8.0-9.9 -proposed tracker (LP: #2052945)
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable Rust dependencies on
+      riscv64"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 12 Feb 2024 15:49:20 +0100
+
+linux (6.8.0-8.8) noble; urgency=medium
+
+  * noble/linux: 6.8.0-8.8 -proposed tracker (LP: #2052918)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] riscv64: enable linux-libc-dev build
+    - v6.8-rc4 rebase
+
+  * Rebase on v6.8-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 12 Feb 2024 10:13:34 +0100
+
+linux (6.8.0-7.7) noble; urgency=medium
+
+  * noble/linux: 6.8.0-7.7 -proposed tracker (LP: #2052691)
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/87]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/87]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/87]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/87]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/87]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/87]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/87]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/87]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/87]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/87]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/87]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/87]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/87]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/87]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/87]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/87]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/87]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/87]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/87]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/87]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/87]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [31/87]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/87]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/87]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/87]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/87]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/87]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/87]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/87]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/87]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/87]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/87]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/87]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [43/87]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/87]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/87]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/87]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/87]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/87]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/87]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/87]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/87]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/87]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/87]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/87]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/87]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/87]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/87]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/87]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/87]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/87]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/87]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/87]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/87]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/87]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [65/87] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [69/87]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [70/87]: apparmor: fix oops when racing to retrieve
+      notification
+    - SAUCE: apparmor4.0.0 [71/87]: apparmor: fix notification header size
+    - SAUCE: apparmor4.0.0 [72/87]: apparmor: fix request field from a prompt
+      reply that denies all access
+    - SAUCE: apparmor4.0.0 [73/87]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+    - SAUCE: apparmor4.0.0 [74/87]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/87]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/87]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/87]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/87]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/87]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/87]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/87]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/87]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/87]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/87]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/87]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/87]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/87]: fixup notify
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/87]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/87]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/87]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 08 Feb 2024 12:05:44 +0100
+
+linux (6.8.0-6.6) noble; urgency=medium
+
+  * noble/linux: 6.8.0-6.6 -proposed tracker (LP: #2052592)
+
+  * Packaging resync (LP: #1786013)
+    - debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.02.07)
+    - [Packaging] update variants
+
+  * FIPS kernels should default to fips mode (LP: #2049082)
+    - SAUCE: Enable fips mode by default, in FIPS kernels only
+
+  * Fix snapcraftyaml.yaml for jammy:linux-raspi (LP: #2051468)
+    - [Packaging] Remove old snapcraft.yaml
+
+  * Azure: Fix regression introduced in LP: #2045069 (LP: #2052453)
+    - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove in-tree abi checks
+    - [Packaging] drop abi files with clean
+    - [Packaging] Remove do_full_source variable (fixup)
+    - [Packaging] Remove update-dkms-versions and move dkms-versions
+    - [Config] updateconfigs following v6.8-rc3 rebase
+    - [packaging] rename to linux
+    - [packaging] rebase on v6.8-rc3
+    - [packaging] disable signing for ppc64el
+
+  * Rebase on v6.8-rc3
+ 
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 07 Feb 2024 15:13:52 +0100
+
+linux (6.8.0-5.5) noble; urgency=medium
+
+  * noble/linux-unstable: 6.8.0-5.5 -proposed tracker (LP: #2052136)
+
+  * Miscellaneous upstream changes
+    - Revert "mm/sparsemem: fix race in accessing memory_section->usage"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 02 Feb 2024 12:59:09 +0100
+
+linux-unstable (6.8.0-4.4) noble; urgency=medium
+
+  * noble/linux-unstable: 6.8.0-4.4 -proposed tracker (LP: #2051502)
+
+  * Migrate from fbdev drivers to simpledrm and DRM fbdev emulation layer
+    (LP: #1965303)
+    - [Config] enable simpledrm and DRM fbdev emulation layer
+
+  * Miscellaneous Ubuntu changes
+    - [Config] toolchain update
+
+  * Miscellaneous upstream changes
+    - rust: upgrade to Rust 1.75.0
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 29 Jan 2024 14:49:49 +0100
+
+linux-unstable (6.8.0-3.3) noble; urgency=medium
+
+  * noble/linux-unstable: 6.8.0-3.3 -proposed tracker (LP: #2051488)
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [43/87]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/87]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/87]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/87]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/87]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/87]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/87]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/87]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/87]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/87]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/87]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/87]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/87]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/87]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/87]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/87]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/87]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/87]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/87]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/87]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/87]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/87]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [69/87]: add io_uring mediation
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * apparmor restricts read access of user namespace mediation sysctls to root
+    (LP: #2040194)
+    - SAUCE: apparmor4.0.0 [73/87]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+
+  * AppArmor spams kernel log with assert when auditing (LP: #2040192)
+    - SAUCE: apparmor4.0.0 [72/87]: apparmor: fix request field from a prompt
+      reply that denies all access
+
+  * apparmor notification files verification (LP: #2040250)
+    - SAUCE: apparmor4.0.0 [71/87]: apparmor: fix notification header size
+
+  * apparmor oops when racing to retrieve a notification (LP: #2040245)
+    - SAUCE: apparmor4.0.0 [70/87]: apparmor: fix oops when racing to retrieve
+      notification
+
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/87]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/87]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/87]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor4.0.0 [01/87]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/87]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/87]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/87]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/87]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/87]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/87]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/87]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/87]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/87]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/87]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/87]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/87]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/87]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/87]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/87]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/87]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/87]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/87]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/87]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/87]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [30/87]: LSM stacking v39: LSM: Single calls in
+      socket_getpeersec hooks
+    - SAUCE: apparmor4.0.0 [31/87]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/87]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/87]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/87]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/87]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/87]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/87]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/87]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/87]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/87]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/87]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/87]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [65/87] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [74/87]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/87]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/87]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/87]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/87]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/87]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/87]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/87]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/87]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/87]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/87]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/87]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/87]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/87]: fixup notify
+    - [Config] updateconfigs following v6.8-rc2 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 29 Jan 2024 08:59:32 +0100
+
+linux-unstable (6.8.0-2.2) noble; urgency=medium
+
+  * noble/linux-unstable: 6.8.0-2.2 -proposed tracker (LP: #2051110)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] toolchain update
+    - [Config] enable Rust
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 24 Jan 2024 13:10:07 +0100
+
+linux-unstable (6.8.0-1.1) noble; urgency=medium
+
+  * noble/linux-unstable: 6.8.0-1.1 -proposed tracker (LP: #2051102)
+
+  * Miscellaneous Ubuntu changes
+    - [packaging] move to v6.8-rc1
+    - [Config] updateconfigs following v6.8-rc1 rebase
+    - SAUCE: export file_close_fd() instead of close_fd_get_file()
+    - SAUCE: cpufreq: s/strlcpy/strscpy/
+    - debian/dkms-versions -- temporarily disable zfs dkms
+    - debian/dkms-versions -- temporarily disable ipu6 and isvsc dkms
+    - debian/dkms-versions -- temporarily disable v4l2loopback
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 24 Jan 2024 10:48:37 +0100
+
+linux-unstable (6.8.0-0.0) noble; urgency=medium
+
+  * Empty entry.
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 23 Jan 2024 11:36:40 +0100
+
+linux-unstable (6.7.0-7.7) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-7.7 -proposed tracker (LP: #2049357)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable signing for s390x and ppc64el
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 15 Jan 2024 08:41:11 +0100
+
+linux-unstable (6.7.0-6.6) noble; urgency=medium
+
+  * Empty entry.
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 15 Jan 2024 08:30:50 +0100
+
+linux (6.7.0-2.2) noble; urgency=medium
+
+  * noble/linux: 6.7.0-2.2 -proposed tracker (LP: #2049182)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+
+  * Enforce RETPOLINE and SLS mitigrations (LP: #2046440)
+    - SAUCE: objtool: Make objtool check actually fatal upon fatal errors
+    - SAUCE: objtool: make objtool SLS validation fatal when building with
+      CONFIG_SLS=y
+    - SAUCE: objtool: make objtool RETPOLINE validation fatal when building with
+      CONFIG_RETPOLINE=y
+    - SAUCE: scripts: remove generating .o-ur objects
+    - [Packaging] Remove all custom retpoline-extract code
+    - Revert "UBUNTU: SAUCE: vga_set_mode -- avoid jump tables"
+    - Revert "UBUNTU: SAUCE: early/late -- annotate indirect calls in early/late
+      initialisation code"
+    - Revert "UBUNTU: SAUCE: apm -- annotate indirect calls within
+      firmware_restrict_branch_speculation_{start,end}"
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable riscv64 builds
+    - [Packaging] temporarily disable Rust dependencies on riscv64
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 12 Jan 2024 09:21:57 +0100
+
+linux (6.7.0-1.1) noble; urgency=medium
+
+  * noble/linux: 6.7.0-1.1 -proposed tracker (LP: #2048859)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/d2024.01.02)
+
+  * [UBUNTU 23.04] Regression: Ubuntu 23.04/23.10 do not include uvdevice
+    anymore (LP: #2048919)
+    - [Config] Enable S390_UV_UAPI (built-in)
+
+  * Support mipi camera on Intel Meteor Lake platform (LP: #2031412)
+    - SAUCE: iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs on Meteor
+      Lake
+    - SAUCE: platform/x86: int3472: Add handshake GPIO function
+
+  * [SRU][J/L/M] UBUNTU: [Packaging] Make WWAN driver a loadable module
+    (LP: #2033406)
+    - [Packaging] Make WWAN driver loadable modules
+
+  * usbip: error: failed to open /usr/share/hwdata//usb.ids (LP: #2039439)
+    - [Packaging] Make linux-tools-common depend on hwdata
+
+  * [Mediatek] mt8195-demo: enable CONFIG_MTK_IOMMU as module for multimedia and
+    PCIE peripherals (LP: #2036587)
+    - [Config] Enable CONFIG_MTK_IOMMU on arm64
+
+  * linux-*: please enable dm-verity kconfigs to allow MoK/db verified root
+    images (LP: #2019040)
+    - [Config] CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING=y
+
+  * kexec enable to load/kdump zstd compressed zimg (LP: #2037398)
+    - [Packaging] Revert arm64 image format to Image.gz
+
+  * Mantic minimized/minimal cloud images do not receive IP address during
+    provisioning; systemd regression with wait-online (LP: #2036968)
+    - [Config] Enable virtio-net as built-in to avoid race
+
+  * Make backlight module auto detect dell_uart_backlight (LP: #2008882)
+    - SAUCE: ACPI: video: Dell AIO UART backlight detection
+
+  * Linux 6.2 fails to reboot with current u-boot-nezha (LP: #2021364)
+    - [Config] Default to performance CPUFreq governor on riscv64
+
+  * Enable Nezha board (LP: #1975592)
+    - [Config] Build in D1 clock drivers on riscv64
+    - [Config] Enable CONFIG_SUN6I_RTC_CCU on riscv64
+    - [Config] Enable CONFIG_SUNXI_WATCHDOG on riscv64
+    - [Config] Disable SUN50I_DE2_BUS on riscv64
+    - [Config] Disable unneeded sunxi pinctrl drivers on riscv64
+
+  * Enable StarFive VisionFive 2 board (LP: #2013232)
+    - [Config] Enable CONFIG_PINCTRL_STARFIVE_JH7110_SYS on riscv64
+    - [Config] Enable CONFIG_STARFIVE_WATCHDOG on riscv64
+
+  * rcu_sched detected stalls on CPUs/tasks (LP: #1967130)
+    - [Config] Enable virtually mapped stacks on riscv64
+
+  * Check for changes relevant for security certifications (LP: #1945989)
+    - [Packaging] Add a new fips-checks script
+
+  * Installation support for SMARC RZ/G2L platform (LP: #2030525)
+    - [Config] build Renesas RZ/G2L USBPHY control driver statically
+
+  * Add support for kernels compiled with CONFIG_EFI_ZBOOT (LP: #2002226)
+    - [Config]: Turn on CONFIG_EFI_ZBOOT on ARM64
+
+  * Default module signing algo should be accelerated (LP: #2034061)
+    - [Config] Default module signing algo should be accelerated
+
+  * Miscellaneous Ubuntu changes
+    - [Config] annotations clean-up
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 11 Jan 2024 11:49:07 +0100
+
+linux (6.7.0-0.0) noble; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 09 Jan 2024 09:27:23 +0100
+
+linux-unstable (6.7.0-5.5) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-5.5 -proposed tracker (LP: #2048118)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/d2024.01.02)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable Rust support
+    - [Packaging] temporarily disable riscv64 builds
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 05 Jan 2024 12:33:10 +0100
+
+linux-unstable (6.7.0-4.4) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-4.4 -proposed tracker (LP: #2047807)
+
+  * unconfined profile denies userns_create for chromium based processes
+    (LP: #1990064)
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * apparmor restricts read access of user namespace mediation sysctls to root
+    (LP: #2040194)
+    - SAUCE: apparmor4.0.0 [69/69]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+
+  * AppArmor spams kernel log with assert when auditing (LP: #2040192)
+    - SAUCE: apparmor4.0.0 [68/69]: apparmor: fix request field from a prompt
+      reply that denies all access
+
+  * apparmor notification files verification (LP: #2040250)
+    - SAUCE: apparmor4.0.0 [67/69]: apparmor: fix notification header size
+
+  * apparmor oops when racing to retrieve a notification (LP: #2040245)
+    - SAUCE: apparmor4.0.0 [66/69]: apparmor: fix oops when racing to retrieve
+      notification
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/69]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [02/69]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [03/69]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [04/69]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [05/69]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [06/69]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [07/69]: Stacking v38: LSM: Identify modules by more
+      than name
+    - SAUCE: apparmor4.0.0 [08/69]: Stacking v38: LSM: Add an LSM identifier for
+      external use
+    - SAUCE: apparmor4.0.0 [09/69]: Stacking v38: LSM: Identify the process
+      attributes for each module
+    - SAUCE: apparmor4.0.0 [10/69]: Stacking v38: LSM: Maintain a table of LSM
+      attribute data
+    - SAUCE: apparmor4.0.0 [11/69]: Stacking v38: proc: Use lsmids instead of lsm
+      names for attrs
+    - SAUCE: apparmor4.0.0 [12/69]: Stacking v38: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [13/69]: Stacking v38: LSM: Infrastructure management
+      of the sock security
+    - SAUCE: apparmor4.0.0 [14/69]: Stacking v38: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [15/69]: Stacking v38: LSM: provide lsm name and id
+      slot mappings
+    - SAUCE: apparmor4.0.0 [16/69]: Stacking v38: IMA: avoid label collisions with
+      stacked LSMs
+    - SAUCE: apparmor4.0.0 [17/69]: Stacking v38: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [18/69]: Stacking v38: LSM: Use lsmblob in
+      security_kernel_act_as
+    - SAUCE: apparmor4.0.0 [19/69]: Stacking v38: LSM: Use lsmblob in
+      security_secctx_to_secid
+    - SAUCE: apparmor4.0.0 [20/69]: Stacking v38: LSM: Use lsmblob in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [21/69]: Stacking v38: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [22/69]: Stacking v38: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [23/69]: Stacking v38: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [24/69]: Stacking v38: LSM: Use lsmblob in
+      security_cred_getsecid
+    - SAUCE: apparmor4.0.0 [25/69]: Stacking v38: LSM: Specify which LSM to
+      display
+    - SAUCE: apparmor4.0.0 [27/69]: Stacking v38: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [28/69]: Stacking v38: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [29/69]: Stacking v38: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [30/69]: Stacking v38: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [31/69]: Stacking v38: LSM: security_secid_to_secctx in
+      netlink netfilter
+    - SAUCE: apparmor4.0.0 [32/69]: Stacking v38: NET: Store LSM netlabel data in
+      a lsmblob
+    - SAUCE: apparmor4.0.0 [33/69]: Stacking v38: binder: Pass LSM identifier for
+      confirmation
+    - SAUCE: apparmor4.0.0 [34/69]: Stacking v38: LSM: security_secid_to_secctx
+      module selection
+    - SAUCE: apparmor4.0.0 [35/69]: Stacking v38: Audit: Keep multiple LSM data in
+      audit_names
+    - SAUCE: apparmor4.0.0 [36/69]: Stacking v38: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [37/69]: Stacking v38: LSM: Add a function to report
+      multiple LSMs
+    - SAUCE: apparmor4.0.0 [38/69]: Stacking v38: Audit: Allow multiple records in
+      an audit_buffer
+    - SAUCE: apparmor4.0.0 [39/69]: Stacking v38: Audit: Add record for multiple
+      task security contexts
+    - SAUCE: apparmor4.0.0 [40/69]: Stacking v38: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [41/69]: Stacking v38: Audit: Add record for multiple
+      object contexts
+    - SAUCE: apparmor4.0.0 [42/69]: Stacking v38: netlabel: Use a struct lsmblob
+      in audit data
+    - SAUCE: apparmor4.0.0 [43/69]: Stacking v38: LSM: Removed scaffolding
+      function lsmcontext_init
+    - SAUCE: apparmor4.0.0 [44/69]: Stacking v38: AppArmor: Remove the exclusive
+      flag
+    - SAUCE: apparmor4.0.0 [45/69]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [46/69]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [47/69]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [48/69]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [49/69]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [50/69]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [51/69]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [52/69]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [53/69]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [54/69]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [55/69]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [56/69]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [57/69]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [58/69]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [59/69]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [60/69]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [64/69]: advertise disconnected.path is available
+    - SAUCE: apparmor4.0.0 [65/69]: add io_uring mediation
+
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [61/69]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [62/69]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [63/69]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+
+  * udev fails to make prctl() syscall with apparmor=0 (as used by maas by
+    default) (LP: #2016908) // update apparmor and LSM stacking patch set
+    (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [26/69]: Stacking v38: Fix prctl() syscall with
+      apparmor=0
+
+  * Fix RPL-U CPU C-state always keep at C3 when system run PHM with idle screen
+    on (LP: #2042385)
+    - SAUCE: r8169: Add quirks to enable ASPM on Dell platforms
+
+  * [Debian] autoreconstruct - Do not generate chmod -x for deleted  files
+    (LP: #2045562)
+    - [Debian] autoreconstruct - Do not generate chmod -x for deleted files
+
+  * Disable Legacy TIOCSTI (LP: #2046192)
+    - [Config]: disable CONFIG_LEGACY_TIOCSTI
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] remove helper scripts
+    - [Packaging] update annotations scripts
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] rules: Remove unused dkms make variables
+    - [Config] update annotations after rebase to v6.7-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 02 Jan 2024 14:57:21 +0100
+
+linux-unstable (6.7.0-3.3) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-3.3 -proposed tracker (LP: #2046060)
+
+  * enable CONFIG_INTEL_TDX_HOST in linux >= 6.7 for noble (LP: #2046040)
+    - [Config] enable CONFIG_INTEL_TDX_HOST
+
+  * linux tools packages for derived kernels refuse to install simultaneously
+    due to libcpupower name collision (LP: #2035971)
+    - [Packaging] Statically link libcpupower into cpupower tool
+
+  * make lazy RCU a boot time option (LP: #2045492)
+    - SAUCE: rcu: Provide a boot time parameter to control lazy RCU
+
+  * Build failure if run in a console (LP: #2044512)
+    - [Packaging] Fix kernel module compression failures
+
+  * Turning COMPAT_32BIT_TIME off on arm64 (64k & derivatives) (LP: #2038582)
+    - [Config] y2038: Turn off COMPAT and COMPAT_32BIT_TIME on arm64 64k
+
+  * Turning COMPAT_32BIT_TIME off on riscv64 (LP: #2038584)
+    - [Config] y2038: Disable COMPAT_32BIT_TIME on riscv64
+
+  * Turning COMPAT_32BIT_TIME off on ppc64el (LP: #2038587)
+    - [Config] y2038: Disable COMPAT and COMPAT_32BIT_TIME on ppc64le
+
+  * [UBUNTU 23.04] Kernel config option missing for s390x PCI passthrough
+    (LP: #2042853)
+    - [Config] CONFIG_VFIO_PCI_ZDEV_KVM=y
+
+  * back-out zstd module compression automatic for backports (LP: #2045593)
+    - [Packaging] make ZSTD module compression conditional
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove do_full_source variable
+    - [Packaging] Remove obsolete config handling
+    - [Packaging] Remove support for sub-flavors
+    - [Packaging] Remove old linux-libc-dev version hack
+    - [Packaging] Remove obsolete scripts
+    - [Packaging] Remove README.inclusion-list
+    - [Packaging] make $(stampdir)/stamp-build-perarch depend on build-arch
+    - [Packaging] Enable rootless builds
+    - [Packaging] Allow to run debian/rules without (fake)root
+    - [Packaging] remove unneeded trailing slash for INSTALL_MOD_PATH
+    - [Packaging] override KERNELRELEASE instead of KERNELVERSION
+    - [Config] update toolchain versions in annotations
+    - [Packaging] drop useless linux-doc
+    - [Packaging] scripts: Rewrite insert-ubuntu-changes in Python
+    - [Packaging] enable riscv64 builds
+    - [Packaging] remove the last sub-flavours bit
+    - [Packaging] check debian.env to determine do_libc_dev_package
+    - [Packaging] remove debian.*/variants
+    - [Packaging] remove do_libc_dev_package variable
+    - [Packaging] move linux-libc-dev.stub to debian/control.d/
+    - [Packaging] Update check to build linux-libc-dev to the source package name
+    - [Packaging] rules: Remove startnewrelease target
+    - [Packaging] Remove debian/commit-templates
+    - [Config] update annotations after rebase to v6.7-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 11 Dec 2023 15:56:11 +0100
+
+linux-unstable (6.7.0-2.2) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-2.2 -proposed tracker (LP: #2045107)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable Rust
+    - [Config] enable Rust in annotations
+    - [Packaging] Remove do_enforce_all variable
+    - [Config] disable Softlogic 6x10 capture card driver on armhf
+    - [Packaging] disable Rust support
+    - [Config] update annotations after rebase to v6.7-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 29 Nov 2023 07:51:17 +0100
+
+linux-unstable (6.7.0-1.1) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-1.1 -proposed tracker (LP: #2044069)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update annotations scripts
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations after rebase to v6.7-rc2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 21 Nov 2023 10:45:24 +0100
+
+linux-unstable (6.7.0-0.0) noble; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 21 Nov 2023 07:26:46 +0100
+
+linux-unstable (6.6.0-12.12) noble; urgency=medium
+
+  * noble/linux-unstable: 6.6.0-12.12 -proposed tracker (LP: #2043664)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable zfs dkms
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 16 Nov 2023 10:20:26 +0100
+
+linux-unstable (6.6.0-11.11) noble; urgency=medium
+
+  * noble/linux-unstable: 6.6.0-11.11 -proposed tracker (LP: #2043480)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] resync update-dkms-versions helper
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.11.14)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move to Noble
+    - [Config] toolchain version update
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 15 Nov 2023 14:50:40 +0100
+
+linux-unstable (6.6.0-10.10) noble; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-10.10 -proposed tracker (LP: #2043088)
+
+  * Bump arm64's CONFIG_NR_CPUS to 512 (LP: #2042897)
+    - [Config] Bump CONFIG_NR_CPUS to 512 for arm64
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Include a note for the NR_CPUS setting on riscv64
+    - SAUCE: apparmor4.0.0 [83/83]: Fix inode_init for changed prototype
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 09 Nov 2023 12:05:11 +0200
+
+linux-unstable (6.6.0-9.9) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-9.9 -proposed tracker (LP: #2041852)
+
+  * Switch IMA default hash to sha256 (LP: #2041735)
+    - [Config] Switch IMA_DEFAULT_HASH from sha1 to sha256
+
+  * apparmor restricts read access of user namespace mediation sysctls to root
+    (LP: #2040194)
+    - SAUCE: apparmor4.0.0 [82/82]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+
+  * AppArmor spams kernel log with assert when auditing (LP: #2040192)
+    - SAUCE: apparmor4.0.0 [81/82]: apparmor: fix request field from a prompt
+      reply that denies all access
+
+  * apparmor notification files verification (LP: #2040250)
+    - SAUCE: apparmor4.0.0 [80/82]: apparmor: fix notification header size
+
+  * apparmor oops when racing to retrieve a notification (LP: #2040245)
+    - SAUCE: apparmor4.0.0 [79/82]: apparmor: fix oops when racing to retrieve
+      notification
+
+  * Disable restricting unprivileged change_profile by default, due to LXD
+    latest/stable not yet compatible with this new apparmor feature
+    (LP: #2038567)
+    - SAUCE: apparmor4.0.0 [78/82]: apparmor: Make
+      apparmor_restrict_unprivileged_unconfined opt-in
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/82]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [02/82]: rename SK_CTX() to aa_sock and make it an
+      inline fn
+    - SAUCE: apparmor4.0.0 [03/82]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [04/82]: add user namespace creation mediation
+    - SAUCE: apparmor4.0.0 [05/82]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [06/82]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [07/82]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [08/82]: Stacking v38: LSM: Identify modules by more
+      than name
+    - SAUCE: apparmor4.0.0 [09/82]: Stacking v38: LSM: Add an LSM identifier for
+      external use
+    - SAUCE: apparmor4.0.0 [10/82]: Stacking v38: LSM: Identify the process
+      attributes for each module
+    - SAUCE: apparmor4.0.0 [11/82]: Stacking v38: LSM: Maintain a table of LSM
+      attribute data
+    - SAUCE: apparmor4.0.0 [12/82]: Stacking v38: proc: Use lsmids instead of lsm
+      names for attrs
+    - SAUCE: apparmor4.0.0 [13/82]: Stacking v38: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [14/82]: Stacking v38: LSM: Infrastructure management
+      of the sock security
+    - SAUCE: apparmor4.0.0 [15/82]: Stacking v38: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [16/82]: Stacking v38: LSM: provide lsm name and id
+      slot mappings
+    - SAUCE: apparmor4.0.0 [17/82]: Stacking v38: IMA: avoid label collisions with
+      stacked LSMs
+    - SAUCE: apparmor4.0.0 [18/82]: Stacking v38: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [19/82]: Stacking v38: LSM: Use lsmblob in
+      security_kernel_act_as
+    - SAUCE: apparmor4.0.0 [20/82]: Stacking v38: LSM: Use lsmblob in
+      security_secctx_to_secid
+    - SAUCE: apparmor4.0.0 [21/82]: Stacking v38: LSM: Use lsmblob in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [22/82]: Stacking v38: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [23/82]: Stacking v38: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [24/82]: Stacking v38: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [25/82]: Stacking v38: LSM: Use lsmblob in
+      security_cred_getsecid
+    - SAUCE: apparmor4.0.0 [26/82]: Stacking v38: LSM: Specify which LSM to
+      display
+    - SAUCE: apparmor4.0.0 [28/82]: Stacking v38: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [29/82]: Stacking v38: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [30/82]: Stacking v38: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [31/82]: Stacking v38: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [32/82]: Stacking v38: LSM: security_secid_to_secctx in
+      netlink netfilter
+    - SAUCE: apparmor4.0.0 [33/82]: Stacking v38: NET: Store LSM netlabel data in
+      a lsmblob
+    - SAUCE: apparmor4.0.0 [34/82]: Stacking v38: binder: Pass LSM identifier for
+      confirmation
+    - SAUCE: apparmor4.0.0 [35/82]: Stacking v38: LSM: security_secid_to_secctx
+      module selection
+    - SAUCE: apparmor4.0.0 [36/82]: Stacking v38: Audit: Keep multiple LSM data in
+      audit_names
+    - SAUCE: apparmor4.0.0 [37/82]: Stacking v38: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [38/82]: Stacking v38: LSM: Add a function to report
+      multiple LSMs
+    - SAUCE: apparmor4.0.0 [39/82]: Stacking v38: Audit: Allow multiple records in
+      an audit_buffer
+    - SAUCE: apparmor4.0.0 [40/82]: Stacking v38: Audit: Add record for multiple
+      task security contexts
+    - SAUCE: apparmor4.0.0 [41/82]: Stacking v38: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [42/82]: Stacking v38: Audit: Add record for multiple
+      object contexts
+    - SAUCE: apparmor4.0.0 [43/82]: Stacking v38: netlabel: Use a struct lsmblob
+      in audit data
+    - SAUCE: apparmor4.0.0 [44/82]: Stacking v38: LSM: Removed scaffolding
+      function lsmcontext_init
+    - SAUCE: apparmor4.0.0 [45/82]: Stacking v38: AppArmor: Remove the exclusive
+      flag
+    - SAUCE: apparmor4.0.0 [46/82]: combine common_audit_data and
+      apparmor_audit_data
+    - SAUCE: apparmor4.0.0 [47/82]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [48/82]: rename audit_data->label to
+      audit_data->subj_label
+    - SAUCE: apparmor4.0.0 [49/82]: pass cred through to audit info.
+    - SAUCE: apparmor4.0.0 [50/82]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/82]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/82]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/82]: cache buffers on percpu list if there is lock
+      contention
+    - SAUCE: apparmor4.0.0 [54/82]: advertise availability of exended perms
+    - SAUCE: apparmor4.0.0 [56/82]: cleanup: provide separate audit messages for
+      file and policy checks
+    - SAUCE: apparmor4.0.0 [57/82]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [58/82]: prompt - ref count pdb
+    - SAUCE: apparmor4.0.0 [59/82]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [60/82]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [61/82]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [62/82]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [63/82]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [64/82]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [65/82]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [66/82]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [67/82]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [68/82]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [69/82]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [74/82]: advertise disconnected.path is available
+    - SAUCE: apparmor4.0.0 [75/82]: fix invalid reference on profile->disconnected
+    - SAUCE: apparmor4.0.0 [76/82]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [77/82]: apparmor: Fix regression in mount mediation
+
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [70/82]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [71/82]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [72/82]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+    - SAUCE: apparmor4.0.0 [73/82]: userns - allow restricting unprivileged
+      change_profile
+
+  * LSM stacking and AppArmor for 6.2: additional fixes (LP: #2017903) // update
+    apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [55/82]: fix profile verification and enable it
+
+  * udev fails to make prctl() syscall with apparmor=0 (as used by maas by
+    default) (LP: #2016908) // update apparmor and LSM stacking patch set
+    (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [27/82]: Stacking v38: Fix prctl() syscall with
+      apparmor=0
+
+  * Miscellaneous Ubuntu changes
+    - [Config] SECURITY_APPARMOR_RESTRICT_USERNS=y
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 03 Nov 2023 11:59:12 +0100
+
+linux-unstable (6.6.0-8.8) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-8.8 -proposed tracker (LP: #2040243)
+
+  * Miscellaneous Ubuntu changes
+    - abi: gc reference to phy-rtk-usb2/phy-rtk-usb3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 24 Oct 2023 10:55:34 +0200
+
+linux-unstable (6.6.0-7.7) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-7.7 -proposed tracker (LP: #2040147)
+
+  * test_021_aslr_dapper_libs from ubuntu_qrt_kernel_security failed on K-5.19 /
+    J-OEM-6.1 / J-6.2 AMD64 (LP: #1983357)
+    - [Config]: set ARCH_MMAP_RND_{COMPAT_, }BITS to the maximum
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs following v6.6-rc7 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 23 Oct 2023 11:51:14 +0200
+
+linux-unstable (6.6.0-6.6) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-6.6 -proposed tracker (LP: #2039780)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.6-rc6
+    - [Config] updateconfigs following v6.6-rc6 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 19 Oct 2023 12:09:16 +0200
+
+linux-unstable (6.6.0-5.5) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-5.5 -proposed tracker (LP: #2038899)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.6-rc5
+    - [Config] updateconfigs following v6.6-rc5 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 10 Oct 2023 11:18:41 +0200
+
+linux-unstable (6.6.0-4.4) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-4.4 -proposed tracker (LP: #2038423)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.6-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 04 Oct 2023 11:16:25 +0200
+
+linux-unstable (6.6.0-3.3) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-3.3 -proposed tracker (LP: #2037622)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs following v6.6-rc3 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: enforce rust availability only on x86_64"
+    - arm64: rust: Enable Rust support for AArch64
+    - arm64: rust: Enable PAC support for Rust.
+    - arm64: Restrict Rust support to little endian only.
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 28 Sep 2023 10:45:38 +0200
+
+linux-unstable (6.6.0-2.2) mantic; urgency=medium
+
+  * Miscellaneous upstream changes
+    - UBUBNTU: [Config] build all COMEDI drivers as modules
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 Sep 2023 14:42:56 +0200
+
+linux-unstable (6.6.0-1.1) mantic; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move linux to linux-unstable
+    - [Packaging] rebase on v6.6-rc1
+    - [Config] updateconfigs following v6.6-rc1 rebase
+    - [packaging] skip ABI, modules and retpoline checks
+    - update dropped.txt
+    - [Config] SHIFT_FS FTBFS with Linux 6.6, disable it
+    - [Config] DELL_UART_BACKLIGHT FTBFS with Linux 6.6, disable it
+    - [Packaging] debian/dkms-versions: temporarily disable dkms
+    - [Packaging] temporarily disable signing for s390x
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 15 Sep 2023 14:42:18 +0200
+
+linux-unstable (6.6.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 14 Sep 2023 15:03:19 +0200
+
+linux (6.5.0-5.5) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-5.5 -proposed tracker (LP: #2034546)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.08.23)
+
+
+linux (6.5.0-4.4) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-4.4 -proposed tracker (LP: #2034042)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.08.23)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Sep 2023 16:55:44 +0200
+
+linux (6.5.0-3.3) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-3.3 -proposed tracker (LP: #2033904)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.08.23)
+
+  * [23.10] Please test secure-boot and lockdown on the early 6.5 kernel (s390x)
+    (LP: #2026833)
+    - [Packaging] re-enable signing for s390x
+
+  * Miscellaneous upstream changes
+    - module/decompress: use vmalloc() for zstd decompression workspace
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 01 Sep 2023 16:15:33 +0200
+
+linux (6.5.0-2.2) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-2.2 -proposed tracker (LP: #2033240)
+
+  * Soundwire support for Dell SKU0C87 devices (LP: #2029281)
+    - SAUCE: ASoC: Intel: soc-acpi: add support for Dell SKU0C87 devices
+
+  * Fix numerous AER related issues (LP: #2033025)
+    - SAUCE: PCI/AER: Disable AER service during suspend, again
+    - SAUCE: PCI/DPC: Disable DPC service during suspend, again
+
+  * Support Realtek RTL8852CE WiFi 6E/BT Combo (LP: #2025672)
+    - wifi: rtw89: debug: Fix error handling in rtw89_debug_priv_btc_manual_set()
+    - Bluetooth: btrtl: Load FW v2 otherwise FW v1 for RTL8852C
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Aug 2023 08:53:19 +0200
+
+linux (6.5.0-1.1) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-1.1 -proposed tracker (LP: #2032750)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.07.26)
+
+  * ceph: support idmapped mounts (LP: #2032959)
+    - SAUCE: libceph: add spinlock around osd->o_requests
+    - SAUCE: libceph: define struct ceph_sparse_extent and add some helpers
+    - SAUCE: libceph: new sparse_read op, support sparse reads on msgr2 crc
+      codepath
+    - SAUCE: libceph: support sparse reads on msgr2 secure codepath
+    - SAUCE: libceph: add sparse read support to msgr1
+    - SAUCE: libceph: add sparse read support to OSD client
+    - SAUCE: ceph: add new mount option to enable sparse reads
+    - SAUCE: ceph: preallocate inode for ops that may create one
+    - SAUCE: ceph: make ceph_msdc_build_path use ref-walk
+    - SAUCE: libceph: add new iov_iter-based ceph_msg_data_type and
+      ceph_osd_data_type
+    - SAUCE: ceph: use osd_req_op_extent_osd_iter for netfs reads
+    - SAUCE: ceph: fscrypt_auth handling for ceph
+    - SAUCE: ceph: implement -o test_dummy_encryption mount option
+    - SAUCE: ceph: add fscrypt ioctls and ceph.fscrypt.auth vxattr
+    - SAUCE: ceph: make ioctl cmds more readable in debug log
+    - SAUCE: ceph: add base64 endcoding routines for encrypted names
+    - SAUCE: ceph: encode encrypted name in ceph_mdsc_build_path and dentry
+      release
+    - SAUCE: ceph: send alternate_name in MClientRequest
+    - SAUCE: ceph: decode alternate_name in lease info
+    - SAUCE: ceph: set DCACHE_NOKEY_NAME flag in ceph_lookup/atomic_open()
+    - SAUCE: ceph: make d_revalidate call fscrypt revalidator for encrypted
+      dentries
+    - SAUCE: ceph: add helpers for converting names for userland presentation
+    - SAUCE: ceph: make ceph_fill_trace and ceph_get_name decrypt names
+    - SAUCE: ceph: pass the request to parse_reply_info_readdir()
+    - SAUCE: ceph: add support to readdir for encrypted names
+    - SAUCE: ceph: create symlinks with encrypted and base64-encoded targets
+    - SAUCE: ceph: add some fscrypt guardrails
+    - SAUCE: ceph: allow encrypting a directory while not having Ax caps
+    - SAUCE: ceph: mark directory as non-complete after loading key
+    - SAUCE: ceph: size handling in MClientRequest, cap updates and inode traces
+    - SAUCE: ceph: handle fscrypt fields in cap messages from MDS
+    - SAUCE: ceph: add infrastructure for file encryption and decryption
+    - SAUCE: libceph: add CEPH_OSD_OP_ASSERT_VER support
+    - SAUCE: libceph: allow ceph_osdc_new_request to accept a multi-op read
+    - SAUCE: ceph: add object version support for sync read
+    - SAUCE: ceph: add truncate size handling support for fscrypt
+    - SAUCE: ceph: don't use special DIO path for encrypted inodes
+    - SAUCE: ceph: align data in pages in ceph_sync_write
+    - SAUCE: ceph: add read/modify/write to ceph_sync_write
+    - SAUCE: ceph: add encryption support to writepage and writepages
+    - SAUCE: ceph: plumb in decryption during reads
+    - SAUCE: ceph: invalidate pages when doing direct/sync writes
+    - SAUCE: ceph: add support for encrypted snapshot names
+    - SAUCE: ceph: prevent snapshot creation in encrypted locked directories
+    - SAUCE: ceph: update documentation regarding snapshot naming limitations
+    - SAUCE: ceph: drop messages from MDS when unmounting
+    - SAUCE: ceph: wait for OSD requests' callbacks to finish when unmounting
+    - SAUCE: ceph: fix updating i_truncate_pagecache_size for fscrypt
+    - SAUCE: ceph: switch ceph_lookup/atomic_open() to use new fscrypt helper
+    - SAUCE: libceph: do not include crypto/algapi.h
+    - SAUCE: rbd: bump RBD_MAX_PARENT_CHAIN_LEN to 128
+    - SAUCE: ceph: dump info about cap flushes when we're waiting too long for
+      them
+    - SAUCE: mm: BUG if filemap_alloc_folio gives us a folio with a non-NULL
+      ->private
+    - SAUCE: ceph: make sure all the files successfully put before unmounting
+    - SAUCE: ceph: BUG if MDS changed truncate_seq with client caps still
+      outstanding
+    - SAUCE: ceph: add the *_client debug macros support
+    - SAUCE: ceph: pass the mdsc to several helpers
+    - SAUCE: ceph: rename _to_client() to _to_fs_client()
+    - SAUCE: ceph: move mdsmap.h to fs/ceph/
+    - SAUCE: ceph: add ceph_inode_to_client() helper support
+    - SAUCE: ceph: print the client global_id in all the debug logs
+    - SAUCE: ceph: make the members in struct ceph_mds_request_args_ext an union
+    - SAUCE: ceph: make num_fwd and num_retry to __u32
+    - SAUCE: fs: export mnt_idmap_get/mnt_idmap_put
+    - SAUCE: ceph: stash idmapping in mdsc request
+    - SAUCE: ceph: handle idmapped mounts in create_request_message()
+    - SAUCE: ceph: add enable_unsafe_idmap module parameter
+    - SAUCE: ceph: pass an idmapping to mknod/symlink/mkdir
+    - SAUCE: ceph: allow idmapped getattr inode op
+    - SAUCE: ceph: allow idmapped permission inode op
+    - SAUCE: ceph: pass idmap to __ceph_setattr
+    - SAUCE: ceph: allow idmapped setattr inode op
+    - SAUCE: ceph/acl: allow idmapped set_acl inode op
+    - SAUCE: ceph/file: allow idmapped atomic_open inode op
+    - SAUCE: ceph: allow idmapped mounts
+
+  * Got soft lockup CPU if dell_uart_backlight is probed (LP: #2032174)
+    - SAUCE: platform/x86: dell-uart-backlight: replace chars_in_buffer() with
+      flush_chars()
+
+  * Fix ACPI TAD  on some Intel based systems (LP: #2032767)
+    - ACPI: TAD: Install SystemCMOS address space handler for ACPI000E
+
+  * Fix unreliable ethernet cable detection on I219 NIC (LP: #2028122)
+    - e1000e: Use PME poll to circumvent unreliable ACPI wake
+
+  * Fix panel brightness issues on HP laptops (LP: #2032704)
+    - ACPI: video: Put ACPI video and its child devices into D0 on boot
+
+  * FATAL:credentials.cc(127)] Check failed: . : Permission denied (13)
+    (LP: #2017980)
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * Support initrdless boot on default qemu virt models and openstack
+    (LP: #2030745)
+    - [Config] set VIRTIO_BLK=y for default qemu/openstack boot
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] rust: use Rust 1.68.2
+    - [Packaging] depend on clang/libclang-15 for Rust
+    - [Config] update toolchain versions in annotations
+    - [Config] update annotations after rebase to v6.5-rc6
+    - [Config] update toolchain version in annotations
+    - [Packaging] temporarily disable Rust support
+    - [Packaging] temporarily disable signing for ppc64el
+    - [Packaging] temporarily disable signing for s390x
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 24 Aug 2023 17:47:10 +0200
+
+linux (6.5.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 23 Aug 2023 08:14:48 +0200
+
+linux-unstable (6.5.0-4.4) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-4.4 -proposed tracker (LP: #2029086)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Add .NOTPARALLEL
+    - [Packaging] Remove meaningless $(header_arch)
+    - [Packaging] Fix File exists error in install-arch-headers
+    - [Packaging] clean debian/linux-* directories
+    - [Packaging] remove hmake
+    - [Packaging] install headers to debian/linux-libc-dev directly
+    - [Config] define CONFIG options for arm64 instead of arm64-generic
+    - [Config] update annotations after rebase to v6.5-rc4
+    - [Packaging] temporarily disable Rust support
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 31 Jul 2023 08:41:59 +0200
+
+linux-unstable (6.5.0-3.3) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-3.3 -proposed tracker (LP: #2028779)
+
+  * enable Rust support in the kernel (LP: #2007654)
+    - SAUCE: rust: support rustc-1.69.0
+    - [Packaging] depend on rustc-1.69.0
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+    - [Packaging] resync getabis
+
+  * Fix UBSAN in Intel EDAC driver (LP: #2028746)
+    - EDAC/i10nm: Skip the absent memory controllers
+
+  * Ship kernel modules Zstd compressed (LP: #2028568)
+    - SAUCE: Support but do not require compressed modules
+    - [Config] Enable support for ZSTD compressed modules
+    - [Packaging] ZSTD compress modules
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [02/60]: rename SK_CTX() to aa_sock and make it an
+      inline fn
+    - SAUCE: apparmor3.2.0 [05/60]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor3.2.0 [08/60]: Stacking v38: LSM: Identify modules by more
+      than name
+    - SAUCE: apparmor3.2.0 [09/60]: Stacking v38: LSM: Add an LSM identifier for
+      external use
+    - SAUCE: apparmor3.2.0 [10/60]: Stacking v38: LSM: Identify the process
+      attributes for each module
+    - SAUCE: apparmor3.2.0 [11/60]: Stacking v38: LSM: Maintain a table of LSM
+      attribute data
+    - SAUCE: apparmor3.2.0 [12/60]: Stacking v38: proc: Use lsmids instead of lsm
+      names for attrs
+    - SAUCE: apparmor3.2.0 [13/60]: Stacking v38: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor3.2.0 [14/60]: Stacking v38: LSM: Infrastructure management
+      of the sock security
+    - SAUCE: apparmor3.2.0 [15/60]: Stacking v38: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor3.2.0 [16/60]: Stacking v38: LSM: provide lsm name and id
+      slot mappings
+    - SAUCE: apparmor3.2.0 [17/60]: Stacking v38: IMA: avoid label collisions with
+      stacked LSMs
+    - SAUCE: apparmor3.2.0 [18/60]: Stacking v38: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor3.2.0 [19/60]: Stacking v38: LSM: Use lsmblob in
+      security_kernel_act_as
+    - SAUCE: apparmor3.2.0 [20/60]: Stacking v38: LSM: Use lsmblob in
+      security_secctx_to_secid
+    - SAUCE: apparmor3.2.0 [21/60]: Stacking v38: LSM: Use lsmblob in
+      security_secid_to_secctx
+    - SAUCE: apparmor3.2.0 [22/60]: Stacking v38: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor3.2.0 [23/60]: Stacking v38: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor3.2.0 [24/60]: Stacking v38: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor3.2.0 [25/60]: Stacking v38: LSM: Use lsmblob in
+      security_cred_getsecid
+    - SAUCE: apparmor3.2.0 [26/60]: Stacking v38: LSM: Specify which LSM to
+      display
+    - SAUCE: apparmor3.2.0 [28/60]: Stacking v38: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor3.2.0 [29/60]: Stacking v38: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor3.2.0 [30/60]: Stacking v38: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor3.2.0 [31/60]: Stacking v38: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor3.2.0 [32/60]: Stacking v38: LSM: security_secid_to_secctx in
+      netlink netfilter
+    - SAUCE: apparmor3.2.0 [33/60]: Stacking v38: NET: Store LSM netlabel data in
+      a lsmblob
+    - SAUCE: apparmor3.2.0 [34/60]: Stacking v38: binder: Pass LSM identifier for
+      confirmation
+    - SAUCE: apparmor3.2.0 [35/60]: Stacking v38: LSM: security_secid_to_secctx
+      module selection
+    - SAUCE: apparmor3.2.0 [36/60]: Stacking v38: Audit: Keep multiple LSM data in
+      audit_names
+    - SAUCE: apparmor3.2.0 [37/60]: Stacking v38: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor3.2.0 [38/60]: Stacking v38: LSM: Add a function to report
+      multiple LSMs
+    - SAUCE: apparmor3.2.0 [39/60]: Stacking v38: Audit: Allow multiple records in
+      an audit_buffer
+    - SAUCE: apparmor3.2.0 [40/60]: Stacking v38: Audit: Add record for multiple
+      task security contexts
+    - SAUCE: apparmor3.2.0 [41/60]: Stacking v38: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor3.2.0 [42/60]: Stacking v38: Audit: Add record for multiple
+      object contexts
+    - SAUCE: apparmor3.2.0 [43/60]: Stacking v38: netlabel: Use a struct lsmblob
+      in audit data
+    - SAUCE: apparmor3.2.0 [44/60]: Stacking v38: LSM: Removed scaffolding
+      function lsmcontext_init
+    - SAUCE: apparmor3.2.0 [45/60]: Stacking v38: AppArmor: Remove the exclusive
+      flag
+    - SAUCE: apparmor3.2.0 [46/60]: combine common_audit_data and
+      apparmor_audit_data
+    - SAUCE: apparmor3.2.0 [47/60]: setup slab cache for audit data
+    - SAUCE: apparmor3.2.0 [48/60]: rename audit_data->label to
+      audit_data->subj_label
+    - SAUCE: apparmor3.2.0 [49/60]: pass cred through to audit info.
+    - SAUCE: apparmor3.2.0 [50/60]: Improve debug print infrastructure
+    - SAUCE: apparmor3.2.0 [51/60]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor3.2.0 [52/60]: enable userspace upcall for mediation
+    - SAUCE: apparmor3.2.0 [53/60]: cache buffers on percpu list if there is lock
+      contention
+    - SAUCE: apparmor3.2.0 [55/60]: advertise availability of exended perms
+    - SAUCE: apparmor3.2.0 [60/60]: [Config] enable
+      CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * LSM stacking and AppArmor for 6.2: additional fixes (LP: #2017903) // update
+    apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [57/60]: fix profile verification and enable it
+
+  * udev fails to make prctl() syscall with apparmor=0 (as used by maas by
+    default) (LP: #2016908) // update apparmor and LSM stacking patch set
+    (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [27/60]: Stacking v38: Fix prctl() syscall with
+      apparmor=0
+
+  * kinetic: apply new apparmor and LSM stacking patch set (LP: #1989983) //
+    update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [01/60]: add/use fns to print hash string hex value
+    - SAUCE: apparmor3.2.0 [03/60]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor3.2.0 [04/60]: add user namespace creation mediation
+    - SAUCE: apparmor3.2.0 [06/60]: af_unix mediation
+    - SAUCE: apparmor3.2.0 [07/60]: Add fine grained mediation of posix mqueues
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Use consistent llvm/clang for rust
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 28 Jul 2023 07:44:20 +0200
+
+linux-unstable (6.5.0-2.2) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-2.2 -proposed tracker (LP: #2027953)
+
+  * Remove non-LPAE kernel flavor (LP: #2025265)
+    - [Packaging] Rename armhf generic-lpae flavor to generic
+
+  * Please enable Renesas RZ platform serial installer (LP: #2022361)
+    - [Config] enable hihope RZ/G2M serial console
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] snap: Remove old configs handling
+    - [Packaging] checks/final-checks: Remove old configs handling
+    - [Packaging] checks/final-checks: check existance of Makefile first
+    - [Packaging] checks/final-checks: Fix shellcheck issues
+    - [Packaging] add libstdc++-dev to the build dependencies
+    - [Config] update annotations after rebase to v6.5-rc2
+
+  * Miscellaneous upstream changes
+    - kbuild: rust: avoid creating temporary files
+    - rust: fix bindgen build error with UBSAN_BOUNDS_STRICT
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 18 Jul 2023 10:14:14 +0200
+
+linux-unstable (6.5.0-1.1) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-1.1 -proposed tracker (LP: #2026689)
+
+  * CVE-2023-31248
+    - netfilter: nf_tables: do not ignore genmask when looking up chain by id
+
+  * CVE-2023-35001
+    - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
+
+  * HDMI output with More than one child device for port B in VBT error
+    (LP: #2025195)
+    - SAUCE: drm/i915/quirks: Add multiple VBT quirk for HP ZBook Power G10
+
+  * CVE-2023-2640 // CVE-2023-32629
+    - SAUCE: overlayfs: default to userxattr when mounted from non initial user
+      namespace
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+
+  * enable Rust support in the kernel (LP: #2007654)
+    - SAUCE: btf, scripts: rust: drop is_rust_module.sh
+    - [Packaging] add rust dependencies
+
+  * CVE-2023-2612
+    - SAUCE: shiftfs: prevent lock unbalance in shiftfs_create_object()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: shiftfs: support linux 6.5
+    - [Config] update annotations after rebase to v6.5-rc1
+    - [Config] temporarily disable Rust
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 10 Jul 2023 09:15:26 +0200
+
+linux-unstable (6.5.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 05 Jul 2023 12:48:39 +0200
+
+linux-unstable (6.4.0-8.8) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-8.8 -proposed tracker (LP: #2025018)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain version (gcc) in annotations
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 26 Jun 2023 09:14:02 +0200
+
+linux-unstable (6.4.0-7.7) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-7.7 -proposed tracker (LP: #2024338)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 19 Jun 2023 08:51:27 +0200
+
+linux-unstable (6.4.0-6.6) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-6.6 -proposed tracker (LP: #2023966)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update annotations scripts
+
+  * enable multi-gen LRU by default (LP: #2023629)
+    - [Config] enable multi-gen LRU by default
+
+  * Fix Monitor lost after replug WD19TBS to SUT port with VGA/DVI to type-C
+    dongle (LP: #2021949)
+    - thunderbolt: Do not touch CL state configuration during discovery
+    - thunderbolt: Increase DisplayPort Connection Manager handshake timeout
+
+  * Neuter signing tarballs (LP: #2012776)
+    - [Packaging] remove the signing tarball support
+
+  * Enable Tracing Configs for OSNOISE and TIMERLAT (LP: #2018591)
+    - [Config] Enable OSNOISE_TRACER and TIMERLAT_TRACER configs
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Add CONFIG_AS_HAS_NON_CONST_LEB128 on riscv64
+    - [Packaging] introduce do_lib_rust and enable it only on generic amd64
+    - [Config] update annotations after rebase to v6.4-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 15 Jun 2023 20:11:07 +0200
+
+linux-unstable (6.4.0-5.5) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-5.5 -proposed tracker (LP: #2022886)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] update getabis to support linux-unstable
+    - UBUNTU [Config]: disable hibernation on riscv64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 06 Jun 2023 08:18:01 +0200
+
+linux-unstable (6.4.0-4.4) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-4.4 -proposed tracker (LP: #2021597)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] udpate annotations after rebase to v6.4-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 30 May 2023 11:55:41 +0200
+
+linux-unstable (6.4.0-3.3) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-3.3 -proposed tracker (LP: #2021497)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] resync getabis
+
+  * support python < 3.9 with annotations (LP: #2020531)
+    - [Packaging] kconfig/annotations.py: support older way of merging dicts
+
+  * generate linux-lib-rust only on amd64 (LP: #2020356)
+    - [Packaging] generate linux-lib-rust only on amd64
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: never drop configs that have notes different than
+      the parent
+    - [Config] drop CONFIG_SMBFS_COMMON from annotations
+    - [Packaging] perf: build without libtraceevent
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 30 May 2023 08:38:10 +0200
+
+linux-unstable (6.4.0-2.2) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-2.2 -proposed tracker (LP: #2020330)
+
+  * Computer with Intel Atom CPU will  not boot with Kernel 6.2.0-20
+    (LP: #2017444)
+    - [Config]: Disable CONFIG_INTEL_ATOMISP
+
+  * Fix NVME storage with RAID ON disappeared under Dell factory WINPE
+    environment (LP: #2011768)
+    - SAUCE: PCI: vmd: Reset VMD config register between soft reboots
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Drop support of old config handling
+    - [Config] update annotations after rebase to v6.4-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 May 2023 11:22:14 +0200
+
+linux-unstable (6.4.0-1.1) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-1.1 -proposed tracker (LP: #2019965)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] update helper scripts
+
+  * Kernel 6.1 bumped the disk consumption on default images by 15%
+    (LP: #2015867)
+    - [Packaging] introduce a separate linux-lib-rust package
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable CONFIG_BLK_DEV_UBLK on amd64
+    - [Packaging] annotations: use python3 in the shebang
+    - SAUCE: blk-throttle: Fix io statistics for cgroup v1
+    - [Packaging] move to v6.4 and rename to linux-unstable
+    - [Config] update annotations after rebase to v6.4-rc1
+    - [Packaging] temporarily disable perf
+    - [Packaging] temporarily disable bpftool
+    - [Config] ppc64el: reduce CONFIG_ARCH_FORCE_MAX_ORDER from 9 to 8
+    - SAUCE: perf: explicitly disable libtraceevent
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 18 May 2023 07:34:09 +0200
+
+linux-unstable (6.4.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 May 2023 15:29:25 +0200
+
+linux-unstable (6.3.0-2.2) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.3.0-2.2 -proposed tracker (LP: #2017788)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move python3-dev to build-depends
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 26 Apr 2023 21:52:12 +0200
+
+linux-unstable (6.3.0-1.1) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.3.0-1.1 -proposed tracker (LP: #2017776)
+
+  * RFC: virtio and virtio-scsi should be built in (LP: #1685291)
+    - [Config] Mark CONFIG_SCSI_VIRTIO built-in
+
+  * Debian autoreconstruct Fix restoration of execute permissions (LP: #2015498)
+    - [Debian] autoreconstruct - fix restoration of execute permissions
+
+  * [SRU][Jammy] CONFIG_PCI_MESON is not enabled (LP: #2007745)
+    - [Config] arm64: Enable PCI_MESON module
+
+  * vmd may fail to create sysfs entry while `pci_rescan_bus()` called in some
+    other drivers like wwan (LP: #2011389)
+    - SAUCE: PCI: vmd: guard device addition and removal
+
+  * Lunar update: v6.2.9 upstream stable release (LP: #2016877)
+    - [Config] ppc64: updateconfigs following v6.2.9 stable updates
+
+  * Lunar update: v6.2.8 upstream stable release (LP: #2016876)
+    - [Config] ppc64: updateconfigs following v6.2.8 stable updates
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Move final-checks script to debian/scripts/checks
+    - [Packaging] checks/final-checks: Honor 'do_skip_checks'
+    - [Packaging] Drop wireguard DKMS
+    - [Packaging] Remove update-version-dkms
+    - [Packaging] debian/rules: Add DKMS info to 'printenv' output
+    - [Packaging] ignore KBUILD_VERBOSE in arch-has-odm-enabled.sh
+    - SAUCE: shiftfs: support linux 6.3
+    - [Packaging] move to v6.3 and rename to linux-unstable
+    - [Config] latency-related optimizations
+    - [Config] update annotations after rebase to v6.3
+    - [Packaging] temporarily disable dkms
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 26 Apr 2023 14:53:52 +0200
+
+linux-unstable (6.3.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 25 Apr 2023 10:24:12 +0200
+
+linux (6.2.0-21.21) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-21.21 -proposed tracker (LP: #2016249)
+
+  * efivarfs:efivarfs.sh in ubuntu_kernel_selftests crash L-6.2 ARM64 node
+    dazzle (rcu_preempt detected stalls) (LP: #2015741)
+    - efi/libstub: smbios: Use length member instead of record struct size
+    - arm64: efi: Use SMBIOS processor version to key off Ampere quirk
+    - efi/libstub: smbios: Drop unused 'recsize' parameter
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/bpf: ignore pointer types check with clang
+    - SAUCE: selftests/bpf: avoid conflicting data types in profiler.inc.h
+    - [Packaging] get rid of unnecessary artifacts in linux-headers
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: Revert "efi: random: refresh non-volatile random seed
+      when RNG is initialized""
+    - Revert "UBUNTU: SAUCE: Revert "efi: random: fix NULL-deref when refreshing
+      seed""
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 14 Apr 2023 12:11:49 +0200
+
+linux (6.2.0-20.20) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-20.20 -proposed tracker (LP: #2015429)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * FTBFS with different dkms or when makeflags are set (LP: #2015361)
+    - [Packaging] FTBFS with different dkms or when makeflags are set
+
+  * expoline.o is packaged unconditionally for s390x (LP: #2013209)
+    - [Packaging] Copy expoline.o only when produced by the build
+
+  * net:l2tp.sh failure with lunar:linux 6.2 (LP: #2013014)
+    - SAUCE: l2tp: generate correct module alias strings
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: prevent duplicate include lines
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 06 Apr 2023 08:33:14 +0200
+
+linux (6.2.0-19.19) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-19.19 -proposed tracker (LP: #2012488)
+
+  * Neuter signing tarballs (LP: #2012776)
+    - [Packaging] neuter the signing tarball
+
+  * LSM stacking and AppArmor refresh for 6.2 kernel (LP: #2012136)
+    - Revert "UBUNTU: [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS"
+    - Revert "UBUNTU: SAUCE: apparmor: add user namespace creation mediation"
+    - Revert "UBUNTU: SAUCE: apparmor: Add fine grained mediation of posix
+      mqueues"
+    - Revert "UBUNTU: SAUCE: Revert "apparmor: make __aa_path_perm() static""
+    - Revert "UBUNTU: SAUCE: LSM: Specify which LSM to display (using struct cred
+      as input)"
+    - Revert "UBUNTU: SAUCE: apparmor: Fix build error, make sk parameter const"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in smk_netlbl_mls()"
+    - Revert "UBUNTU: SAUCE: LSM: change ima_read_file() to use lsmblob"
+    - Revert "UBUNTU: SAUCE: apparmor: rename kzfree() to kfree_sensitive()"
+    - Revert "UBUNTU: SAUCE: AppArmor: Remove the exclusive flag"
+    - Revert "UBUNTU: SAUCE: LSM: Add /proc attr entry for full LSM context"
+    - Revert "UBUNTU: SAUCE: Audit: Fix incorrect static inline function
+      declration."
+    - Revert "UBUNTU: SAUCE: Audit: Fix for missing NULL check"
+    - Revert "UBUNTU: SAUCE: Audit: Add a new record for multiple object LSM
+      attributes"
+    - Revert "UBUNTU: SAUCE: Audit: Add new record for multiple process LSM
+      attributes"
+    - Revert "UBUNTU: SAUCE: NET: Store LSM netlabel data in a lsmblob"
+    - Revert "UBUNTU: SAUCE: LSM: security_secid_to_secctx in netlink netfilter"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmcontext in security_inode_getsecctx"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmcontext in security_secid_to_secctx"
+    - Revert "UBUNTU: SAUCE: LSM: Ensure the correct LSM context releaser"
+    - Revert "UBUNTU: SAUCE: LSM: Specify which LSM to display"
+    - Revert "UBUNTU: SAUCE: IMA: Change internal interfaces to use lsmblobs"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_cred_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_inode_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_task_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_ipc_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_secid_to_secctx"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_secctx_to_secid"
+    - Revert "UBUNTU: SAUCE: net: Prepare UDS for security module stacking"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_kernel_act_as"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_audit_rule_match"
+    - Revert "UBUNTU: SAUCE: LSM: Create and manage the lsmblob data structure."
+    - Revert "UBUNTU: SAUCE: LSM: Infrastructure management of the sock security"
+    - Revert "UBUNTU: SAUCE: apparmor: LSM stacking: switch from SK_CTX() to
+      aa_sock()"
+    - Revert "UBUNTU: SAUCE: apparmor: rename aa_sock() to aa_unix_sk()"
+    - Revert "UBUNTU: SAUCE: apparmor: disable showing the mode as part of a secid
+      to secctx"
+    - Revert "UBUNTU: SAUCE: apparmor: fix use after free in sk_peer_label"
+    - Revert "UBUNTU: SAUCE: apparmor: af_unix mediation"
+    - Revert "UBUNTU: SAUCE: apparmor: patch to provide compatibility with v2.x
+      net rules"
+    - Revert "UBUNTU: SAUCE: apparmor: add/use fns to print hash string hex value"
+    - SAUCE: apparmor: rename SK_CTX() to aa_sock and make it an inline fn
+    - SAUCE: apparmor: Add sysctls for additional controls of unpriv userns
+      restrictions
+    - SAUCE: Stacking v38: LSM: Identify modules by more than name
+    - SAUCE: Stacking v38: LSM: Add an LSM identifier for external use
+    - SAUCE: Stacking v38: LSM: Identify the process attributes for each module
+    - SAUCE: Stacking v38: LSM: Maintain a table of LSM attribute data
+    - SAUCE: Stacking v38: proc: Use lsmids instead of lsm names for attrs
+    - SAUCE: Stacking v38: integrity: disassociate ima_filter_rule from
+      security_audit_rule
+    - SAUCE: Stacking v38: LSM: Infrastructure management of the sock security
+    - SAUCE: Stacking v38: LSM: Add the lsmblob data structure.
+    - SAUCE: Stacking v38: LSM: provide lsm name and id slot mappings
+    - SAUCE: Stacking v38: IMA: avoid label collisions with stacked LSMs
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_audit_rule_match
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_kernel_act_as
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_secctx_to_secid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_secid_to_secctx
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_ipc_getsecid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_current_getsecid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_inode_getsecid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_cred_getsecid
+    - SAUCE: Stacking v38: LSM: Specify which LSM to display
+    - SAUCE: Stacking v38: LSM: Ensure the correct LSM context releaser
+    - SAUCE: Stacking v38: LSM: Use lsmcontext in security_secid_to_secctx
+    - SAUCE: Stacking v38: LSM: Use lsmcontext in security_inode_getsecctx
+    - SAUCE: Stacking v38: Use lsmcontext in security_dentry_init_security
+    - SAUCE: Stacking v38: LSM: security_secid_to_secctx in netlink netfilter
+    - SAUCE: Stacking v38: NET: Store LSM netlabel data in a lsmblob
+    - SAUCE: Stacking v38: binder: Pass LSM identifier for confirmation
+    - SAUCE: Stacking v38: LSM: security_secid_to_secctx module selection
+    - SAUCE: Stacking v38: Audit: Keep multiple LSM data in audit_names
+    - SAUCE: Stacking v38: Audit: Create audit_stamp structure
+    - SAUCE: Stacking v38: LSM: Add a function to report multiple LSMs
+    - SAUCE: Stacking v38: Audit: Allow multiple records in an audit_buffer
+    - SAUCE: Stacking v38: Audit: Add record for multiple task security contexts
+    - SAUCE: Stacking v38: audit: multiple subject lsm values for netlabel
+    - SAUCE: Stacking v38: Audit: Add record for multiple object contexts
+    - SAUCE: Stacking v38: netlabel: Use a struct lsmblob in audit data
+    - SAUCE: Stacking v38: LSM: Removed scaffolding function lsmcontext_init
+    - SAUCE: Stacking v38: AppArmor: Remove the exclusive flag
+    - SAUCE: apparmor: combine common_audit_data and apparmor_audit_data
+    - SAUCE: apparmor: setup slab cache for audit data
+    - SAUCE: apparmor: rename audit_data->label to audit_data->subj_label
+    - SAUCE: apparmor: pass cred through to audit info.
+    - SAUCE: apparmor: Improve debug print infrastructure
+    - SAUCE: apparmor: add the ability for profiles to have a learning cache
+    - SAUCE: apparmor: enable userspace upcall for mediation
+    - SAUCE: apparmor: cache buffers on percpu list if there is lock contention
+    - SAUCE: apparmor: fix policy_compat permission remap with extended
+      permissions
+    - SAUCE: apparmor: advertise availability of exended perms
+    - [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * kinetic: apply new apparmor and LSM stacking patch set (LP: #1989983) // LSM
+    stacking and AppArmor refresh for 6.2 kernel (LP: #2012136)
+    - SAUCE: apparmor: add/use fns to print hash string hex value
+    - SAUCE: apparmor: patch to provide compatibility with v2.x net rules
+    - SAUCE: apparmor: add user namespace creation mediation
+    - SAUCE: apparmor: af_unix mediation
+    - SAUCE: apparmor: Add fine grained mediation of posix mqueues
+
+  * devlink_port_split from ubuntu_kernel_selftests.net fails on hirsute
+    (KeyError: 'flavour') (LP: #1937133)
+    - selftests: net: devlink_port_split.py: skip test if no suitable device
+      available
+
+  * NFS deathlock with last Kernel 5.4.0-144.161 and 5.15.0-67.74 (LP: #2009325)
+    - NFS: Correct timing for assigning access cache timestamp
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Sat, 25 Mar 2023 07:37:30 +0100
+
+linux (6.2.0-18.18) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-18.18 -proposed tracker (LP: #2011750)
+
+  * lunar/linux 6.2 fails to boot on arm64 (LP: #2011748)
+    - SAUCE: Revert "efi: random: fix NULL-deref when refreshing seed"
+    - SAUCE: Revert "efi: random: refresh non-volatile random seed when RNG is
+      initialized"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 15 Mar 2023 23:54:18 +0100
+
+linux (6.2.0-17.17) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-17.17 -proposed tracker (LP: #2011593)
+
+  * lunar/linux 6.2 fails to boot on ppc64el (LP: #2011413)
+    - SAUCE: Revert "powerpc: remove STACK_FRAME_OVERHEAD"
+    - SAUCE: Revert "powerpc/pseries: hvcall stack frame overhead"
+
+  * Speaker / Audio/Mic mute LED don't work on a HP platform (LP: #2011379)
+    - SAUCE: ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP
+      platform
+
+  * Some QHD panels fail to refresh when PSR2 enabled (LP: #2009014)
+    - SAUCE: drm/i915/psr: Use calculated io and fast wake lines
+
+  * Lunar update: v6.2.6 upstream stable release (LP: #2011431)
+    - tpm: disable hwrng for fTPM on some AMD designs
+    - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
+    - staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script
+    - staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh
+    - Linux 6.2.6
+
+  * Lunar update: v6.2.5 upstream stable release (LP: #2011430)
+    - net/sched: Retire tcindex classifier
+    - auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
+    - fs/jfs: fix shift exponent db_agl2size negative
+    - driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()
+    - f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin
+    - f2fs: fix to avoid potential deadlock
+    - objtool: Fix memory leak in create_static_call_sections()
+    - soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on
+    - soc: qcom: socinfo: Fix soc_id order
+    - memory: renesas-rpc-if: Split-off private data from struct rpcif
+    - memory: renesas-rpc-if: Move resource acquisition to .probe()
+    - soc: mediatek: mtk-svs: Enable the IRQ later
+    - pwm: sifive: Always let the first pwm_apply_state succeed
+    - pwm: stm32-lp: fix the check on arr and cmp registers update
+    - f2fs: introduce trace_f2fs_replace_atomic_write_block
+    - f2fs: clear atomic_write_task in f2fs_abort_atomic_write()
+    - soc: mediatek: mtk-svs: restore default voltages when svs_init02() fail
+    - soc: mediatek: mtk-svs: reset svs when svs_resume() fail
+    - soc: mediatek: mtk-svs: Use pm_runtime_resume_and_get() in svs_init01()
+    - f2fs: fix to do sanity check on extent cache correctly
+    - fs: f2fs: initialize fsdata in pagecache_write()
+    - f2fs: allow set compression option of files without blocks
+    - f2fs: fix to abort atomic write only during do_exist()
+    - um: vector: Fix memory leak in vector_config
+    - ubi: ensure that VID header offset + VID header size <= alloc, size
+    - ubifs: Fix build errors as symbol undefined
+    - ubifs: Fix memory leak in ubifs_sysfs_init()
+    - ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
+    - ubifs: Rectify space budget for ubifs_xrename()
+    - ubifs: Fix wrong dirty space budget for dirty inode
+    - ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
+    - ubifs: Reserve one leb for each journal head while doing budget
+    - ubi: Fix use-after-free when volume resizing failed
+    - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
+    - ubifs: Fix memory leak in alloc_wbufs()
+    - ubi: Fix possible null-ptr-deref in ubi_free_volume()
+    - ubifs: Re-statistic cleaned znode count if commit failed
+    - ubifs: dirty_cow_znode: Fix memleak in error handling path
+    - ubifs: ubifs_writepage: Mark page dirty after writing inode failed
+    - ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
+    - ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling
+      fastmap
+    - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
+    - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
+    - f2fs: fix to handle F2FS_IOC_START_ATOMIC_REPLACE in f2fs_compat_ioctl()
+    - f2fs: fix to avoid potential memory corruption in __update_iostat_latency()
+    - f2fs: fix to update age extent correctly during truncation
+    - f2fs: fix to update age extent in f2fs_do_zero_range()
+    - soc: qcom: stats: Populate all subsystem debugfs files
+    - f2fs: introduce IS_F2FS_IPU_* macro
+    - f2fs: fix to set ipu policy
+    - ext4: use ext4_fc_tl_mem in fast-commit replay path
+    - ext4: don't show commit interval if it is zero
+    - netfilter: nf_tables: allow to fetch set elements when table has an owner
+    - x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
+    - um: virtio_uml: free command if adding to virtqueue failed
+    - um: virtio_uml: mark device as unregistered when breaking it
+    - um: virtio_uml: move device breaking into workqueue
+    - um: virt-pci: properly remove PCI device from bus
+    - f2fs: synchronize atomic write aborts
+    - watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks
+    - watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M
+    - watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in
+      error path
+    - watchdog: Fix kmemleak in watchdog_cdev_register
+    - watchdog: pcwd_usb: Fix attempting to access uninitialized memory
+    - watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
+    - netfilter: ctnetlink: fix possible refcount leak in
+      ctnetlink_create_conntrack()
+    - netfilter: conntrack: fix rmmod double-free race
+    - netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
+    - netfilter: ebtables: fix table blob use-after-free
+    - netfilter: xt_length: use skb len to match in length_mt6
+    - netfilter: ctnetlink: make event listener tracking global
+    - netfilter: x_tables: fix percpu counter block leak on error path when
+      creating new netns
+    - swiotlb: mark swiotlb_memblock_alloc() as __init
+    - ptp: vclock: use mutex to fix "sleep on atomic" bug
+    - drm/i915: move a Kconfig symbol to unbreak the menu presentation
+    - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
+    - drm/i915/xelpmp: Consider GSI offset when doing MCR lookups
+    - octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet
+    - net: sunhme: Fix region request
+    - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
+    - octeontx2-pf: Use correct struct reference in test condition
+    - net: fix __dev_kfree_skb_any() vs drop monitor
+    - 9p/xen: fix version parsing
+    - 9p/xen: fix connection sequence
+    - 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
+    - spi: tegra210-quad: Fix validate combined sequence
+    - mlx5: fix skb leak while fifo resync and push
+    - mlx5: fix possible ptp queue fifo use-after-free
+    - net/mlx5: ECPF, wait for VF pages only after disabling host PFs
+    - net/mlx5e: Verify flow_source cap before using it
+    - net/mlx5: Geneve, Fix handling of Geneve object id as error code
+    - ext4: fix incorrect options show of original mount_opt and extend mount_opt2
+    - nfc: fix memory leak of se_io context in nfc_genl_se_io
+    - net/sched: transition act_pedit to rcu and percpu stats
+    - net/sched: act_pedit: fix action bind logic
+    - net/sched: act_mpls: fix action bind logic
+    - net/sched: act_sample: fix action bind logic
+    - net: dsa: seville: ignore mscc-miim read errors from Lynx PCS
+    - net: dsa: felix: fix internal MDIO controller resource length
+    - ARM: dts: aspeed: p10bmc: Update battery node name
+    - ARM: dts: spear320-hmi: correct STMPE GPIO compatible
+    - tcp: tcp_check_req() can be called from process context
+    - vc_screen: modify vcs_size() handling in vcs_read()
+    - spi: tegra210-quad: Fix iterator outside loop
+    - rtc: sun6i: Always export the internal oscillator
+    - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
+    - scsi: ipr: Work around fortify-string warning
+    - scsi: mpi3mr: Fix an issue found by KASAN
+    - scsi: mpi3mr: Use number of bits to manage bitmap sizes
+    - rtc: allow rtc_read_alarm without read_alarm callback
+    - io_uring: fix size calculation when registering buf ring
+    - loop: loop_set_status_from_info() check before assignment
+    - ASoC: adau7118: don't disable regulators on device unbind
+    - ASoC: apple: mca: Fix final status read on SERDES reset
+    - ASoC: apple: mca: Fix SERDES reset sequence
+    - ASoC: apple: mca: Improve handling of unavailable DMA channels
+    - nvme: bring back auto-removal of deleted namespaces during sequential scan
+    - nvme-tcp: don't access released socket during error recovery
+    - nvme-fabrics: show well known discovery name
+    - ASoC: zl38060 add gpiolib dependency
+    - ASoC: mediatek: mt8195: add missing initialization
+    - thermal: intel: quark_dts: fix error pointer dereference
+    - thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
+    - cpufreq: apple-soc: Fix an IS_ERR() vs NULL check
+    - tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
+    - kernel/printk/index.c: fix memory leak with using debugfs_lookup()
+    - firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
+    - bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC
+      support
+    - mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
+    - IB/hfi1: Update RMT size calculation
+    - iommu: Remove deferred attach check from __iommu_detach_device()
+    - PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3()
+    - media: uvcvideo: Remove format descriptions
+    - media: uvcvideo: Handle cameras with invalid descriptors
+    - media: uvcvideo: Handle errors from calls to usb_string
+    - media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
+    - media: uvcvideo: Silence memcpy() run-time false positive warnings
+    - USB: fix memory leak with using debugfs_lookup()
+    - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
+    - usb: fotg210: List different variants
+    - dt-bindings: usb: Add device id for Genesys Logic hub controller
+    - staging: emxx_udc: Add checks for dma_alloc_coherent()
+    - tty: fix out-of-bounds access in tty_driver_lookup_tty()
+    - tty: serial: fsl_lpuart: disable the CTS when send break signal
+    - serial: sc16is7xx: setup GPIO controller later in probe
+    - mei: bus-fixup:upon error print return values of send and receive
+    - tools/iio/iio_utils:fix memory leak
+    - bus: mhi: ep: Fix the debug message for MHI_PKT_TYPE_RESET_CHAN_CMD cmd
+    - iio: accel: mma9551_core: Prevent uninitialized variable in
+      mma9551_read_status_word()
+    - iio: accel: mma9551_core: Prevent uninitialized variable in
+      mma9551_read_config_word()
+    - media: uvcvideo: Add GUID for BGRA/X 8:8:8:8
+    - soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
+    - PCI/portdrv: Prevent LS7A Bus Master clearing on shutdown
+    - PCI: loongson: Prevent LS7A MRRS increases
+    - staging: pi433: fix memory leak with using debugfs_lookup()
+    - USB: dwc3: fix memory leak with using debugfs_lookup()
+    - USB: chipidea: fix memory leak with using debugfs_lookup()
+    - USB: ULPI: fix memory leak with using debugfs_lookup()
+    - USB: uhci: fix memory leak with using debugfs_lookup()
+    - USB: sl811: fix memory leak with using debugfs_lookup()
+    - USB: fotg210: fix memory leak with using debugfs_lookup()
+    - USB: isp116x: fix memory leak with using debugfs_lookup()
+    - USB: isp1362: fix memory leak with using debugfs_lookup()
+    - USB: gadget: gr_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()
+    - usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer
+      math
+    - USB: ene_usb6250: Allocate enough memory for full object
+    - usb: uvc: Enumerate valid values for color matching
+    - usb: gadget: uvc: Make bSourceID read/write
+    - PCI: Align extra resources for hotplug bridges properly
+    - PCI: Take other bus devices into account when distributing resources
+    - PCI: Distribute available resources for root buses, too
+    - tty: pcn_uart: fix memory leak with using debugfs_lookup()
+    - misc: vmw_balloon: fix memory leak with using debugfs_lookup()
+    - drivers: base: component: fix memory leak with using debugfs_lookup()
+    - drivers: base: dd: fix memory leak with using debugfs_lookup()
+    - kernel/fail_function: fix memory leak with using debugfs_lookup()
+    - PCI: loongson: Add more devices that need MRRS quirk
+    - PCI: Add ACS quirk for Wangxun NICs
+    - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
+    - phy: rockchip-typec: Fix unsigned comparison with less than zero
+    - RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size
+    - soundwire: cadence: Remove wasted space in response_buf
+    - soundwire: cadence: Drain the RX FIFO after an IO timeout
+    - eth: fealnx: bring back this old driver
+    - net: tls: avoid hanging tasks on the tx_lock
+    - x86/resctl: fix scheduler confusion with 'current'
+    - vDPA/ifcvf: decouple hw features manipulators from the adapter
+    - vDPA/ifcvf: decouple config space ops from the adapter
+    - vDPA/ifcvf: alloc the mgmt_dev before the adapter
+    - vDPA/ifcvf: decouple vq IRQ releasers from the adapter
+    - vDPA/ifcvf: decouple config IRQ releaser from the adapter
+    - vDPA/ifcvf: decouple vq irq requester from the adapter
+    - vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the
+      adapter
+    - vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw
+    - vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev
+    - vDPA/ifcvf: allocate the adapter in dev_add()
+    - drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state()
+    - drm/display/dp_mst: Fix down/up message handling after sink disconnect
+    - drm/display/dp_mst: Fix down message handling after a packet reception error
+    - drm/display/dp_mst: Fix payload addition on a disconnected sink
+    - drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs
+    - drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload()
+    - drm/i915/dp_mst: Fix payload removal during output disabling
+    - drm/i915: Fix system suspend without fbdev being initialized
+    - media: uvcvideo: Fix race condition with usb_kill_urb
+    - arm64: efi: Make efi_rt_lock a raw_spinlock
+    - usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
+    - Linux 6.2.5
+
+  * Lunar update: v6.2.4 upstream stable release (LP: #2011428)
+    - Revert "blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and
+      blkcg_deactivate_policy()"
+    - Revert "blk-cgroup: dropping parent refcount after pd_free_fn() is done"
+    - Linux 6.2.4
+
+  * Lunar update: v6.2.3 upstream stable release (LP: #2011425)
+    - HID: asus: use spinlock to protect concurrent accesses
+    - HID: asus: use spinlock to safely schedule workers
+    - iommu/amd: Fix error handling for pdev_pri_ats_enable()
+    - iommu/amd: Skip attach device domain is same as new domain
+    - iommu/amd: Improve page fault error reporting
+    - iommu: Attach device group to old domain in error path
+    - powerpc/mm: Rearrange if-else block to avoid clang warning
+    - ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller"
+    - ARM: OMAP2+: Fix memory leak in realtime_counter_init()
+    - arm64: dts: qcom: qcs404: use symbol names for PCIe resets
+    - arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
+    - arm64: dts: qcom: sm6115: Fix UFS node
+    - arm64: dts: qcom: sm6115: Provide xo clk to rpmcc
+    - arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k
+    - arm64: dts: qcom: pmi8950: Correct rev_1250v channel label to mv
+    - arm64: dts: qcom: sm6350: Fix up the ramoops node
+    - arm64: dts: qcom: sdm670-google-sargo: keep pm660 ldo8 on
+    - arm64: dts: qcom: Re-enable resin on MSM8998 and SDM845 boards
+    - arm64: dts: qcom: sm8350-sagami: Configure SLG51000 PMIC on PDX215
+    - arm64: dts: qcom: sm8350-sagami: Add GPIO line names for PMIC GPIOs
+    - arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys
+    - arm64: dts: qcom: sm6350-lena: Flatten gpio-keys pinctrl state
+    - arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
+    - arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume down)
+    - arm64: dts: imx8m: Align SoC unique ID node unit address
+    - ARM: zynq: Fix refcount leak in zynq_early_slcr_init
+    - fs: dlm: fix return value check in dlm_memory_init()
+    - arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 T-PHY
+    - arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
+    - arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock description
+    - arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock description
+    - arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock description
+    - arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
+    - arm64: dts: qcom: sdm845-xiaomi-beryllium: fix audio codec interrupt pin
+      name
+    - x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC
+    - arm64: dts: qcom: sc7180: correct SPMI bus address cells
+    - arm64: dts: qcom: sc7280: correct SPMI bus address cells
+    - arm64: dts: qcom: sc8280xp: correct SPMI bus address cells
+    - arm64: dts: qcom: sm8450: correct Soundwire wakeup interrupt name
+    - arm64: dts: qcom: sdm845: make DP node follow the schema
+    - arm64: dts: qcom: msm8996-oneplus-common: drop vdda-supply from DSI PHY
+    - arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers
+    - arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node
+    - arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name
+    - arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node names
+    - arm64: dts: meson-gx: Fix Ethernet MAC address unit name
+    - arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
+    - arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
+    - cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*
+    - arm64: dts: ti: k3-am62-main: Fix clocks for McSPI
+    - arm64: tegra: Fix duplicate regulator on Jetson TX1
+    - arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size
+    - arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem
+    - arm64: dts: qcom: msm8956: use SoC-specific compat for tsens
+    - arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
+    - arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
+    - arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
+    - arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
+    - arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
+    - arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
+    - arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
+    - ARM: OMAP1: call platform_device_put() in error case in
+      omap1_dm_timer_init()
+    - arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken
+    - ARM: bcm2835_defconfig: Enable the framebuffer
+    - ARM: s3c: fix s3c64xx_set_timer_source prototype
+    - arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
+    - ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
+    - ARM: imx: Call ida_simple_remove() for ida_simple_get
+    - arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
+    - arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
+    - arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
+    - arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix supply name of USB
+      controller node
+    - arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names
+      property
+    - arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
+    - arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix invalid rtc
+      node name
+    - arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix invalid rtc node
+      name
+    - arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node
+      name
+    - arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
+    - arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names
+    - arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
+    - arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
+    - arm64: dts: amlogic: meson-g12b-odroid-go-ultra: fix rk818 pmic properties
+    - arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip
+    - locking/rwsem: Disable preemption in all down_read*() and up_read() code
+      paths
+    - arm64: tegra: Mark host1x as dma-coherent on Tegra194/234
+    - arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
+    - arm64: dts: meson: radxa-zero: allow usb otg mode
+    - arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
+    - ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
+    - ublk_drv: remove nr_aborted_queues from ublk_device
+    - ublk_drv: don't probe partitions if the ubq daemon isn't trusted
+    - ARM: dts: imx7s: correct iomuxc gpr mux controller cells
+    - sbitmap: remove redundant check in __sbitmap_queue_get_batch
+    - sbitmap: correct wake_batch recalculation to avoid potential IO hung
+    - arm64: dts: mt8195: Fix CPU map for single-cluster SoC
+    - arm64: dts: mt8192: Fix CPU map for single-cluster SoC
+    - arm64: dts: mt8186: Fix CPU map for single-cluster SoC
+    - arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
+    - arm64: dts: mediatek: mt8186: Fix watchdog compatible
+    - arm64: dts: mediatek: mt8195: Fix watchdog compatible
+    - arm64: dts: mediatek: mt7986: Fix watchdog compatible
+    - ARM: dts: stm32: Update part number NVMEM description on stm32mp131
+    - arm64: dts: qcom: sm8450-nagara: Correct firmware paths
+    - blk-mq: avoid sleep in blk_mq_alloc_request_hctx
+    - blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
+    - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
+    - blk-mq: Fix potential io hung for shared sbitmap per tagset
+    - blk-mq: correct stale comment of .get_budget
+    - arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input
+    - arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC
+    - arm64: dts: qcom: sm8350: drop incorrect cells from serial
+    - arm64: dts: qcom: sm8450: drop incorrect cells from serial
+    - arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM
+      and MPSS memory regions
+    - arm64: dts: qcom: msm8953: correct TLMM gpio-ranges
+    - arm64: dts: qcom: sm6115: correct TLMM gpio-ranges
+    - arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators
+    - s390/dasd: Fix potential memleak in dasd_eckd_init()
+    - io_uring,audit: don't log IORING_OP_MADVISE
+    - sched/rt: pick_next_rt_entity(): check list_entry
+    - perf/x86/intel/ds: Fix the conversion from TSC to perf time
+    - x86/perf/zhaoxin: Add stepping check for ZXC
+    - KEYS: asymmetric: Fix ECDSA use via keyctl uapi
+    - block: ublk: check IO buffer based on flag need_get_data
+    - arm64: dts: qcom: pmk8350: Use the correct PON compatible
+    - erofs: relinquish volume with mutex held
+    - block: sync mixed merged request's failfast with 1st bio's
+    - block: Fix io statistics for cgroup in throttle path
+    - block: bio-integrity: Copy flags when bio_integrity_payload is cloned
+    - block: use proper return value from bio_failfast()
+    - wifi: mt76: mt7915: add missing of_node_put()
+    - wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host
+    - wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks
+    - wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_ie_countdown()
+    - wifi: mt76: mt7996: fix insecure data handling of
+      mt7996_mcu_rx_radar_detected()
+    - wifi: mt76: mt7996: fix integer handling issue of mt7996_rf_regval_set()
+    - wifi: mt76: mt7915: check return value before accessing free_block_num
+    - wifi: mt76: mt7996: check return value before accessing free_block_num
+    - wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr()
+    - wifi: mt76: mt7996: drop always true condition of __mt7996_reg_addr()
+    - wifi: mt76: mt7996: fix endianness warning in mt7996_mcu_sta_he_tlv
+    - wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
+    - wifi: mt76: mt7996: fix unintended sign extension of mt7996_hw_queue_read()
+    - wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read()
+    - wifi: mt76: fix coverity uninit_use_in_call in
+      mt76_connac2_reverse_frag0_hdr_trans()
+    - wifi: mt76: mt7921: resource leaks at mt7921_check_offload_capability()
+    - wifi: rsi: Fix memory leak in rsi_coex_attach()
+    - wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: fix memory leak in lbs_init_adapter()
+    - wifi: rtl8xxxu: Fix assignment to bit field priv->pi_enabled
+    - wifi: rtl8xxxu: Fix assignment to bit field priv->cck_agc_report_type
+    - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
+    - wifi: rtw89: 8852c: rfk: correct DACK setting
+    - wifi: rtw89: 8852c: rfk: correct DPK settings
+    - wifi: rtlwifi: Fix global-out-of-bounds bug in
+      _rtl8812ae_phy_set_txpower_limit()
+    - libbpf: Fix single-line struct definition output in btf_dump
+    - libbpf: Fix btf__align_of() by taking into account field offsets
+    - wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
+    - wifi: ipw2200: fix memory leak in ipw_wdev_init()
+    - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
+    - wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()
+    - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
+    - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
+    - wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
+    - libbpf: Fix invalid return address register in s390
+    - crypto: x86/ghash - fix unaligned access in ghash_setkey()
+    - crypto: ux500 - update debug config after ux500 cryp driver removal
+    - ACPICA: Drop port I/O validation for some regions
+    - genirq: Fix the return type of kstat_cpu_irqs_sum()
+    - rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
+    - rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
+    - rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
+    - lib/mpi: Fix buffer overrun when SG is too long
+    - crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
+    - platform/chrome: cros_ec_typec: Update port DP VDO
+    - ACPICA: nsrepair: handle cases without a return value correctly
+    - libbpf: Fix map creation flags sanitization
+    - bpf_doc: Fix build error with older python versions
+    - selftests/xsk: print correct payload for packet dump
+    - selftests/xsk: print correct error codes when exiting
+    - arm64/cpufeature: Fix field sign for DIT hwcap detection
+    - arm64/sysreg: Fix errors in 32 bit enumeration values
+    - kselftest/arm64: Fix syscall-abi for systems without 128 bit SME
+    - workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex
+    - s390/early: fix sclp_early_sccb variable lifetime
+    - s390/vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue()
+    - x86/signal: Fix the value returned by strict_sas_size()
+    - thermal/drivers/tsens: Drop msm8976-specific defines
+    - thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
+    - thermal/drivers/tsens: fix slope values for msm8939
+    - thermal/drivers/tsens: limit num_sensors to 9 for msm8939
+    - wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()
+    - wifi: rtw89: Add missing check for alloc_workqueue
+    - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
+    - wifi: orinoco: check return value of hermes_write_wordrec()
+    - wifi: rtw88: Use rtw_iterate_vifs() for rtw_vif_watch_dog_iter()
+    - wifi: rtw88: Use non-atomic sta iterator in rtw_ra_mask_info_update()
+    - thermal/drivers/imx_sc_thermal: Fix the loop condition
+    - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback
+      function
+    - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
+    - wifi: ath9k: Fix potential stack-out-of-bounds write in
+      ath9k_wmi_rsp_callback()
+    - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
+    - wifi: cfg80211: Fix extended KCK key length check in
+      nl80211_set_rekey_data()
+    - ACPI: battery: Fix missing NUL-termination with large strings
+    - selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m
+    - crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
+    - crypto: essiv - Handle EBUSY correctly
+    - crypto: seqiv - Handle EBUSY correctly
+    - powercap: fix possible name leak in powercap_register_zone()
+    - bpf: Fix state pruning for STACK_DYNPTR stack slots
+    - bpf: Fix missing var_off check for ARG_PTR_TO_DYNPTR
+    - bpf: Fix partial dynptr stack slot reads/writes
+    - x86/microcode: Add a parameter to microcode_check() to store CPU
+      capabilities
+    - x86/microcode: Check CPU capabilities after late microcode update correctly
+    - x86/microcode: Adjust late loading result reporting message
+    - net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action
+    - selftests/bpf: Fix vmtest static compilation error
+    - crypto: xts - Handle EBUSY correctly
+    - leds: led-class: Add missing put_device() to led_put()
+    - drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size
+    - s390/bpf: Add expoline to tail calls
+    - wifi: iwlwifi: mei: fix compilation errors in rfkill()
+    - kselftest/arm64: Fix enumeration of systems without 128 bit SME
+    - can: rcar_canfd: Fix R-Car V3U CAN mode selection
+    - can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses
+    - selftests/bpf: Initialize tc in xdp_synproxy
+    - crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
+    - bpftool: profile online CPUs instead of possible
+    - wifi: mt76: mt7921: fix deadlock in mt7921_abort_roc
+    - wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after
+      init_work
+    - wifi: mt76: mt7915: rework mt7915_mcu_set_thermal_throttling
+    - wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
+    - wifi: mt76: mt7921: fix channel switch fail in monitor mode
+    - wifi: mt76: mt7996: fix chainmask calculation in mt7996_set_antenna()
+    - wifi: mt76: mt7996: update register for CFEND_RATE
+    - wifi: mt76: connac: fix POWER_CTRL command name typo
+    - wifi: mt76: mt7921: fix invalid remain_on_channel duration
+    - wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit
+    - wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit
+    - wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup
+    - wifi: mt76: fix switch default case in mt7996_reverse_frag0_hdr_trans
+    - wifi: mt76: mt7915: fix WED TxS reporting
+    - wifi: mt76: add memory barrier to SDIO queue kick
+    - wifi: mt76: mt7996: rely on mt76_connac2_mac_tx_rate_val
+    - net/mlx5: Enhance debug print in page allocation failure
+    - irqchip: Fix refcount leak in platform_irqchip_probe
+    - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
+    - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
+    - irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
+    - s390/mem_detect: fix detect_memory() error handling
+    - s390/vmem: fix empty page tables cleanup under KASAN
+    - s390/boot: cleanup decompressor header files
+    - s390/mem_detect: rely on diag260() if sclp_early_get_memsize() fails
+    - s390/boot: fix mem_detect extended area allocation
+    - net: add sock_init_data_uid()
+    - tun: tun_chr_open(): correctly initialize socket uid
+    - tap: tap_open(): correctly initialize socket uid
+    - rxrpc: Fix overwaking on call poking
+    - OPP: fix error checking in opp_migrate_dentry()
+    - cpufreq: davinci: Fix clk use after free
+    - Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds
+    - Bluetooth: L2CAP: Fix potential user-after-free
+    - Bluetooth: hci_qca: get wakeup status from serdev device handle
+    - net: ipa: generic command param fix
+    - s390: vfio-ap: tighten the NIB validity check
+    - s390/ap: fix status returned by ap_aqic()
+    - s390/ap: fix status returned by ap_qact()
+    - libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
+    - xen/grant-dma-iommu: Implement a dummy probe_device() callback
+    - rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
+    - crypto: rsa-pkcs1pad - Use akcipher_request_complete
+    - m68k: /proc/hardware should depend on PROC_FS
+    - RISC-V: time: initialize hrtimer based broadcast clock event device
+    - clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first
+      use
+    - wifi: iwl3945: Add missing check for create_singlethread_workqueue
+    - wifi: iwl4965: Add missing check for create_singlethread_workqueue()
+    - wifi: brcmfmac: Rename Cypress 89459 to BCM4355
+    - wifi: brcmfmac: pcie: Add IDs/properties for BCM4355
+    - wifi: brcmfmac: pcie: Add IDs/properties for BCM4377
+    - wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection
+    - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
+    - wifi: rtw89: fix parsing offset for MCC C2H
+    - selftests/bpf: Fix out-of-srctree build
+    - ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
+    - ACPI: resource: Do IRQ override on all TongFang GMxRGxx
+    - crypto: octeontx2 - Fix objects shared between several modules
+    - crypto: crypto4xx - Call dma_unmap_page when done
+    - vfio/ccw: remove WARN_ON during shutdown
+    - wifi: mac80211: move color collision detection report in a delayed work
+    - wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
+    - wifi: mac80211: fix non-MLO station association
+    - wifi: mac80211: Don't translate MLD addresses for multicast
+    - wifi: mac80211: avoid u32_encode_bits() warning
+    - wifi: mac80211: fix off-by-one link setting
+    - tools/lib/thermal: Fix thermal_sampling_exit()
+    - thermal/drivers/hisi: Drop second sensor hi3660
+    - selftests/bpf: Fix map_kptr test.
+    - wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta()
+    - bpf: Zeroing allocated object from slab in bpf memory allocator
+    - selftests/bpf: Fix xdp_do_redirect on s390x
+    - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a
+      bus error
+    - can: esd_usb: Make use of can_change_state() and relocate checking skb for
+      NULL
+    - xsk: check IFF_UP earlier in Tx path
+    - LoongArch, bpf: Use 4 instructions for function address in JIT
+    - bpf: Fix global subprog context argument resolution logic
+    - irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
+    - irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
+    - net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
+    - net/smc: fix application data exception
+    - selftests/net: Interpret UDP_GRO cmsg data as an int value
+    - l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
+    - net: bcmgenet: fix MoCA LED control
+    - net: lan966x: Fix possible deadlock inside PTP
+    - net/mlx4_en: Introduce flexible array to silence overflow warning
+    - net/mlx5e: Align IPsec ASO result memory to be as required by hardware
+    - selftest: fib_tests: Always cleanup before exit
+    - sefltests: netdevsim: wait for devlink instance after netns removal
+    - drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
+    - drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
+    - drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec
+    - drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC
+    - drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
+    - drm/bridge: megachips: Fix error handling in i2c_register_driver()
+    - drm/vkms: Fix memory leak in vkms_init()
+    - drm/vkms: Fix null-ptr-deref in vkms_release()
+    - drm/modes: Use strscpy() to copy command-line mode name
+    - drm/vc4: dpi: Fix format mapping for RGB565
+    - drm/bridge: it6505: Guard bridge power in IRQ handler
+    - drm: tidss: Fix pixel format definition
+    - gpu: ipu-v3: common: Add of_node_put() for reference returned by
+      of_graph_get_port_by_id()
+    - drm/ast: Init iosys_map pointer as I/O memory for damage handling
+    - drm/vc4: drop all currently held locks if deadlock happens
+    - hwmon: (ftsteutates) Fix scaling of measurements
+    - drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()
+    - drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
+    - pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
+    - pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
+    - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
+    - drm/vc4: hvs: Configure the HVS COB allocations
+    - drm/vc4: hvs: Set AXI panic modes
+    - drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4
+    - drm/vc4: hvs: Correct interrupt masking bit assignment for HVS5
+    - drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
+    - drm/vc4: hdmi: Correct interlaced timings again
+    - drm/msm: clean event_thread->worker in case of an error
+    - drm/panel-edp: fix name for IVO product id 854b
+    - scsi: qla2xxx: Fix exchange oversubscription
+    - scsi: qla2xxx: Fix exchange oversubscription for management commands
+    - scsi: qla2xxx: edif: Fix clang warning
+    - ASoC: fsl_sai: initialize is_dsp_mode flag
+    - drm/bridge: tc358767: Set default CLRSIPO count
+    - drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
+    - ALSA: hda/ca0132: minor fix for allocation size
+    - drm/amdgpu: Use the sched from entity for amdgpu_cs trace
+    - drm/msm/gem: Add check for kmalloc
+    - drm/msm/dpu: Disallow unallocated resources to be returned
+    - drm/bridge: lt9611: fix sleep mode setup
+    - drm/bridge: lt9611: fix HPD reenablement
+    - drm/bridge: lt9611: fix polarity programming
+    - drm/bridge: lt9611: fix programming of video modes
+    - drm/bridge: lt9611: fix clock calculation
+    - drm/bridge: lt9611: pass a pointer to the of node
+    - regulator: tps65219: use IS_ERR() to detect an error pointer
+    - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
+    - drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
+    - drm/msm/dsi: Allow 2 CTRLs on v2.5.0
+    - scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096
+    - drm/msm/dpu: sc7180: add missing WB2 clock control
+    - drm/msm: use strscpy instead of strncpy
+    - drm/msm/dpu: Add check for cstate
+    - drm/msm/dpu: Add check for pstates
+    - drm/msm/mdp5: Add check for kzalloc
+    - habanalabs: bugs fixes in timestamps buff alloc
+    - pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
+    - pinctrl: mediatek: Initialize variable pullen and pullup to zero
+    - pinctrl: mediatek: Initialize variable *buf to zero
+    - gpu: host1x: Fix mask for syncpoint increment register
+    - gpu: host1x: Don't skip assigning syncpoints to channels
+    - drm/tegra: firewall: Check for is_addr_reg existence in IMM check
+    - drm/i915/mtl: Add initial gt workarounds
+    - drm/i915/xehp: GAM registers don't need to be re-applied on engine resets
+    - pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as interrupts
+    - drm/i915/xehp: Annotate a couple more workaround registers as MCR
+    - drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update()
+    - drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
+    - drm/mediatek: Use NULL instead of 0 for NULL pointer
+    - drm/mediatek: Drop unbalanced obj unref
+    - drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
+    - drm/mediatek: Clean dangling pointer on bind error path
+    - ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
+    - dt-bindings: display: mediatek: Fix the fallback for mediatek,mt8186-disp-
+      ccorr
+    - gpio: pca9570: rename platform_data to chip_data
+    - gpio: vf610: connect GPIO label to dev name
+    - ASoC: topology: Properly access value coming from topology file
+    - spi: dw_bt1: fix MUX_MMIO dependencies
+    - ASoC: mchp-spdifrx: fix controls which rely on rsr register
+    - ASoC: mchp-spdifrx: fix return value in case completion times out
+    - ASoC: mchp-spdifrx: fix controls that works with completion mechanism
+    - ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
+    - dm: improve shrinker debug names
+    - regmap: apply reg_base and reg_downshift for single register ops
+    - accel: fix CONFIG_DRM dependencies
+    - ASoC: rsnd: fixup #endif position
+    - ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
+    - ASoC: dt-bindings: meson: fix gx-card codec node regex
+    - regulator: tps65219: use generic set_bypass()
+    - hwmon: (asus-ec-sensors) add missing mutex path
+    - hwmon: (ltc2945) Handle error case in ltc2945_value_store
+    - ALSA: hda: Fix the control element identification for multiple codecs
+    - drm/amdgpu: fix enum odm_combine_mode mismatch
+    - scsi: mpt3sas: Fix a memory leak
+    - scsi: aic94xx: Add missing check for dma_map_single()
+    - HID: multitouch: Add quirks for flipped axes
+    - HID: retain initial quirks set up when creating HID devices
+    - ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared
+    - ASoC: qcom: q6apm-dai: fix race condition while updating the position
+      pointer
+    - ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag
+    - ASoC: codecs: lpass: register mclk after runtime pm
+    - ASoC: codecs: lpass: fix incorrect mclk rate
+    - drm/amd/display: don't call dc_interrupt_set() for disabled crtcs
+    - HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support
+    - spi: bcm63xx-hsspi: Fix multi-bit mode setting
+    - hwmon: (mlxreg-fan) Return zero speed for broken fan
+    - ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
+    - dm: remove flush_scheduled_work() during local_exit()
+    - nfs4trace: fix state manager flag printing
+    - NFS: fix disabling of swap
+    - drm/i915/pvc: Implement recommended caching policy
+    - drm/i915/pvc: Annotate two more workaround/tuning registers as MCR
+    - drm/i915: Fix GEN8_MISCCPCTL
+    - spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
+    - ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
+    - HID: bigben: use spinlock to protect concurrent accesses
+    - HID: bigben_worker() remove unneeded check on report_field
+    - HID: bigben: use spinlock to safely schedule workers
+    - hid: bigben_probe(): validate report count
+    - ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks
+    - drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
+    - NFSD: enhance inter-server copy cleanup
+    - NFSD: fix leaked reference count of nfsd4_ssc_umount_item
+    - nfsd: fix race to check ls_layouts
+    - nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
+    - NFSD: fix problems with cleanup on errors in nfsd4_copy
+    - nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open
+    - nfsd: don't fsync nfsd_files on last close
+    - NFSD: copy the whole verifier in nfsd_copy_write_verifier
+    - cifs: Fix lost destroy smbd connection when MR allocate failed
+    - cifs: Fix warning and UAF when destroy the MR list
+    - cifs: use tcon allocation functions even for dummy tcon
+    - gfs2: jdata writepage fix
+    - perf llvm: Fix inadvertent file creation
+    - leds: led-core: Fix refcount leak in of_led_get()
+    - leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest()
+    - leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing driver
+    - tools/tracing/rtla: osnoise_hist: use total duration for average calculation
+    - perf inject: Use perf_data__read() for auxtrace
+    - perf intel-pt: Do not try to queue auxtrace data on pipe
+    - perf stat: Hide invalid uncore event output for aggr mode
+    - perf jevents: Correct bad character encoding
+    - perf test bpf: Skip test if kernel-debuginfo is not present
+    - perf tools: Fix auto-complete on aarch64
+    - perf stat: Avoid merging/aggregating metric counts twice
+    - sparc: allow PM configs for sparc32 COMPILE_TEST
+    - selftests: find echo binary to use -ne options
+    - selftests/ftrace: Fix bash specific "==" operator
+    - selftests: use printf instead of echo -ne
+    - perf record: Fix segfault with --overwrite and --max-size
+    - printf: fix errname.c list
+    - perf tests stat_all_metrics: Change true workload to sleep workload for
+      system wide check
+    - objtool: add UACCESS exceptions for __tsan_volatile_read/write
+    - selftests/ftrace: Fix probepoint testcase to ignore __pfx_* symbols
+    - sysctl: fix proc_dobool() usability
+    - mfd: rk808: Re-add rk808-clkout to RK818
+    - mfd: cs5535: Don't build on UML
+    - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
+    - dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
+    - RDMA/erdma: Fix refcount leak in erdma_mmap
+    - dmaengine: HISI_DMA should depend on ARCH_HISI
+    - RDMA/hns: Fix refcount leak in hns_roce_mmap
+    - iio: light: tsl2563: Do not hardcode interrupt trigger type
+    - usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe()
+    - i2c: designware: fix i2c_dw_clk_rate() return size to be u32
+    - i2c: qcom-geni: change i2c_master_hub to static
+    - soundwire: cadence: Don't overflow the command FIFOs
+    - driver core: fix potential null-ptr-deref in device_add()
+    - kobject: Fix slab-out-of-bounds in fill_kobj_path()
+    - alpha/boot/tools/objstrip: fix the check for ELF header
+    - media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
+    - media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU
+    - media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX
+    - media: uvcvideo: Refactor power_line_frequency_controls_limited
+    - coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
+    - coresight: cti: Prevent negative values of enable count
+    - coresight: cti: Add PM runtime call in enable_store
+    - usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count
+    - PCI/IOV: Enlarge virtfn sysfs name buffer
+    - PCI: switchtec: Return -EFAULT for copy_to_user() errors
+    - PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws kernel-doc
+    - hwtracing: hisi_ptt: Only add the supported devices to the filters list
+    - tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
+    - tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown()
+    - serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init()
+    - Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in
+      set_protocol"
+    - eeprom: idt_89hpesx: Fix error handling in idt_init()
+    - applicom: Fix PCI device refcount leak in applicom_init()
+    - firmware: stratix10-svc: add missing gen_pool_destroy() in
+      stratix10_svc_drv_probe()
+    - firmware: stratix10-svc: fix error handle while alloc/add device failed
+    - VMCI: check context->notify_page after call to get_user_pages_fast() to
+      avoid GPF
+    - mei: pxp: Use correct macros to initialize uuid_le
+    - misc/mei/hdcp: Use correct macros to initialize uuid_le
+    - misc: fastrpc: Fix an error handling path in fastrpc_rpmsg_probe()
+    - iommu/exynos: Fix error handling in exynos_iommu_init()
+    - driver core: fix resource leak in device_add()
+    - driver core: location: Free struct acpi_pld_info *pld before return false
+    - drivers: base: transport_class: fix possible memory leak
+    - drivers: base: transport_class: fix resource leak when
+      transport_add_device() fails
+    - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
+    - selftests: iommu: Fix test_cmd_destroy_access() call in user_copy
+    - iommufd: Add three missing structures in ucmd_buffer
+    - fotg210-udc: Add missing completion handler
+    - dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers
+    - fpga: microchip-spi: move SPI I/O buffers out of stack
+    - fpga: microchip-spi: rewrite status polling in a time measurable way
+    - usb: early: xhci-dbc: Fix a potential out-of-bound memory access
+    - tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case
+    - RDMA/cxgb4: add null-ptr-check after ip_dev_find()
+    - usb: musb: mediatek: don't unregister something that wasn't registered
+    - usb: gadget: configfs: Restrict symlink creation is UDC already binded
+    - phy: mediatek: remove temporary variable @mask_
+    - PCI: mt7621: Delay phy ports initialization
+    - iommu/vt-d: Set No Execute Enable bit in PASID table entry
+    - power: supply: remove faulty cooling logic
+    - RDMA/siw: Fix user page pinning accounting
+    - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
+    - usb: max-3421: Fix setting of I/O pins
+    - RDMA/irdma: Cap MSIX used to online CPUs + 1
+    - serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
+    - tty: serial: imx: disable Ageing Timer interrupt request irq
+    - driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
+    - driver core: fw_devlink: Don't purge child fwnode's consumer links
+    - driver core: fw_devlink: Allow marking a fwnode link as being part of a
+      cycle
+    - driver core: fw_devlink: Consolidate device link flag computation
+    - driver core: fw_devlink: Improve check for fwnode with no device/driver
+    - driver core: fw_devlink: Make cycle detection more robust
+    - mtd: mtdpart: Don't create platform device that'll never probe
+    - usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev
+    - dmaengine: dw-edma: Fix readq_ch() return value truncation
+    - PCI: Fix dropping valid root bus resources with .end = zero
+    - phy: rockchip-typec: fix tcphy_get_mode error case
+    - PCI: qcom: Fix host-init error handling
+    - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
+    - iommu: Fix error unwind in iommu_group_alloc()
+    - iommu/amd: Do not identity map v2 capable device when snp is enabled
+    - dmaengine: sf-pdma: pdma_desc memory leak fix
+    - dmaengine: dw-axi-dmac: Do not dereference NULL structure
+    - dmaengine: ptdma: check for null desc before calling pt_cmd_callback
+    - iommu/vt-d: Fix error handling in sva enable/disable paths
+    - iommu/vt-d: Allow to use flush-queue when first level is default
+    - RDMA/rxe: Cleanup mr_check_range
+    - RDMA/rxe: Move rxe_map_mr_sg to rxe_mr.c
+    - RDMA-rxe: Isolate mr code from atomic_reply()
+    - RDMA-rxe: Isolate mr code from atomic_write_reply()
+    - RDMA/rxe: Cleanup page variables in rxe_mr.c
+    - RDMA/rxe: Replace rxe_map and rxe_phys_buf by xarray
+    - Subject: RDMA/rxe: Handle zero length rdma
+    - RDMA/mana_ib: Fix a bug when the PF indicates more entries for registering
+      memory on first packet
+    - RDMA/rxe: Fix missing memory barriers in rxe_queue.h
+    - IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
+    - IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
+    - Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after
+      use"
+    - remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
+    - media: ti: cal: fix possible memory leak in cal_ctx_create()
+    - media: platform: ti: Add missing check for devm_regulator_get
+    - media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in
+      imx7_csi_init()
+    - powerpc: Remove linker flag from KBUILD_AFLAGS
+    - s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64
+    - builddeb: clean generated package content
+    - media: max9286: Fix memleak in max9286_v4l2_register()
+    - media: ov2740: Fix memleak in ov2740_init_controls()
+    - media: ov5675: Fix memleak in ov5675_init_controls()
+    - media: i2c: tc358746: fix missing return assignment
+    - media: i2c: tc358746: fix ignoring read error in g_register callback
+    - media: i2c: tc358746: fix possible endianness issue
+    - media: ov5640: Fix soft reset sequence and timings
+    - media: ov5640: Handle delays when no reset_gpio set
+    - media: mc: Get media_device directly from pad
+    - media: i2c: ov772x: Fix memleak in ov772x_probe()
+    - media: i2c: imx219: Split common registers from mode tables
+    - media: i2c: imx219: Fix binning for RAW8 capture
+    - media: platform: mtk-mdp3: Fix return value check in mdp_probe()
+    - media: camss: csiphy-3ph: avoid undefined behavior
+    - media: platform: mtk-mdp3: fix Kconfig dependencies
+    - media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
+    - media: v4l2-jpeg: ignore the unknown APP14 marker
+    - media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399
+    - media: imx-jpeg: Apply clk_bulk api instead of operating specific clk
+    - media: amphion: correct the unspecified color space
+    - media: drivers/media/v4l2-core/v4l2-h264 : add detection of null pointers
+    - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
+    - media: atomisp: fix videobuf2 Kconfig depenendency
+    - media: atomisp: Only set default_run_mode on first open of a stream/asd
+    - media: i2c: ov7670: 0 instead of -EINVAL was returned
+    - media: usb: siano: Fix use after free bugs caused by do_submit_urb
+    - media: saa7134: Use video_unregister_device for radio_dev
+    - rpmsg: glink: Avoid infinite loop on intent for missing channel
+    - rpmsg: glink: Release driver_override
+    - ARM: OMAP2+: omap4-common: Fix refcount leak bug
+    - arm64: dts: qcom: msm8996: Add additional A2NoC clocks
+    - udf: Define EFSCORRUPTED error code
+    - context_tracking: Fix noinstr vs KASAN
+    - exit: Detect and fix irq disabled state in oops
+    - ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
+    - fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
+    - blk-iocost: fix divide by 0 error in calc_lcoefs()
+    - blk-cgroup: dropping parent refcount after pd_free_fn() is done
+    - blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and
+      blkcg_deactivate_policy()
+    - trace/blktrace: fix memory leak with using debugfs_lookup()
+    - btrfs: scrub: improve tree block error reporting
+    - arm64: zynqmp: Enable hs termination flag for USB dwc3 controller
+    - cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE
+    - x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads
+    - cpuidle: drivers: firmware: psci: Dont instrument suspend code
+    - cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG
+    - perf/x86/intel/uncore: Add Meteor Lake support
+    - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
+    - wifi: ath11k: fix monitor mode bringup crash
+    - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
+    - rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
+    - rcu: Suppress smp_processor_id() complaint in
+      synchronize_rcu_expedited_wait()
+    - srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
+    - rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
+    - rcu-tasks: Handle queue-shrink/callback-enqueue race condition
+    - wifi: ath11k: debugfs: fix to work with multiple PCI devices
+    - thermal: intel: Fix unsigned comparison with less than zero
+    - timers: Prevent union confusion from unexpected restart_syscall()
+    - x86/bugs: Reset speculation control settings on init
+    - bpftool: Always disable stack protection for BPF objects
+    - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-
+      of-bounds
+    - wifi: rtw89: fix assignation of TX BD RAM table
+    - wifi: mt7601u: fix an integer underflow
+    - inet: fix fast path in __inet_hash_connect()
+    - ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
+    - ice: add missing checks for PF vsi type
+    - Compiler attributes: GCC cold function alignment workarounds
+    - ACPI: Don't build ACPICA with '-Os'
+    - bpf, docs: Fix modulo zero, division by zero, overflow, and underflow
+    - thermal: intel: intel_pch: Add support for Wellsburg PCH
+    - clocksource: Suspend the watchdog temporarily when high read latency
+      detected
+    - crypto: hisilicon: Wipe entire pool on error
+    - net: bcmgenet: Add a check for oversized packets
+    - m68k: Check syscall_trace_enter() return code
+    - s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping
+    - netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
+    - can: isotp: check CAN address family in isotp_bind()
+    - gcc-plugins: drop -std=gnu++11 to fix GCC 13 build
+    - tools/power/x86/intel-speed-select: Add Emerald Rapid quirk
+    - platform/x86: dell-ddv: Add support for interface version 3
+    - wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
+    - ACPI: video: Fix Lenovo Ideapad Z570 DMI match
+    - net/mlx5: fw_tracer: Fix debug print
+    - coda: Avoid partial allocation of sig_inputArgs
+    - uaccess: Add minimum bounds check on kernel buffer size
+    - s390/idle: mark arch_cpu_idle() noinstr
+    - time/debug: Fix memory leak with using debugfs_lookup()
+    - PM: domains: fix memory leak with using debugfs_lookup()
+    - PM: EM: fix memory leak with using debugfs_lookup()
+    - Bluetooth: Fix issue with Actions Semi ATS2851 based devices
+    - Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921
+    - Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
+    - wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30
+    - hv_netvsc: Check status in SEND_RNDIS_PKT completion message
+    - s390/kfence: fix page fault reporting
+    - devlink: Fix TP_STRUCT_entry in trace of devlink health report
+    - scm: add user copy checks to put_cmsg()
+    - drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F
+    - drm: panel-orientation-quirks: Add quirk for DynaBook K50
+    - drm/amd/display: Reduce expected sdp bandwidth for dcn321
+    - drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h
+      write
+    - drm/amd/display: Fix potential null-deref in dm_resume
+    - drm/omap: dsi: Fix excessive stack usage
+    - HID: Add Mapping for System Microphone Mute
+    - drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
+    - drm/amd/display: Defer DIG FIFO disable after VID stream enable
+    - drm/radeon: free iio for atombios when driver shutdown
+    - drm/amd: Avoid BUG() for case of SRIOV missing IP version
+    - drm/amdkfd: Page aligned memory reserve size
+    - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
+    - Revert "fbcon: don't lose the console font across generic->chip driver
+      switch"
+    - drm/amd: Avoid ASSERT for some message failures
+    - drm: amd: display: Fix memory leakage
+    - drm/amd/display: fix mapping to non-allocated address
+    - HID: uclogic: Add frame type quirk
+    - HID: uclogic: Add battery quirk
+    - HID: uclogic: Add support for XP-PEN Deco Pro SW
+    - HID: uclogic: Add support for XP-PEN Deco Pro MW
+    - drm/msm/dsi: Add missing check for alloc_ordered_workqueue
+    - drm: rcar-du: Add quirk for H3 ES1.x pclk workaround
+    - drm: rcar-du: Fix setting a reserved bit in DPLLCR
+    - drm/drm_print: correct format problem
+    - drm/amd/display: Set hvm_enabled flag for S/G mode
+    - drm/client: Test for connectors before sending hotplug event
+    - habanalabs: extend fatal messages to contain PCI info
+    - habanalabs: fix bug in timestamps registration code
+    - docs/scripts/gdb: add necessary make scripts_gdb step
+    - drm/msm/dpu: Add DSC hardware blocks to register snapshot
+    - ASoC: soc-compress: Reposition and add pcm_mutex
+    - ASoC: kirkwood: Iterate over array indexes instead of using pointer math
+    - regulator: max77802: Bounds check regulator id against opmode
+    - regulator: s5m8767: Bounds check id indexing into arrays
+    - Revert "drm/amdgpu: TA unload messages are not actually sent to psp when
+      amdgpu is uninstalled"
+    - drm/amd/display: fix FCLK pstate change underflow
+    - gfs2: Improve gfs2_make_fs_rw error handling
+    - hwmon: (coretemp) Simplify platform device handling
+    - hwmon: (nct6775) Directly call ASUS ACPI WMI method
+    - hwmon: (nct6775) B650/B660/X670 ASUS boards support
+    - pinctrl: at91: use devm_kasprintf() to avoid potential leaks
+    - drm/amd/display: Do not commit pipe when updating DRR
+    - scsi: snic: Fix memory leak with using debugfs_lookup()
+    - scsi: ufs: core: Fix device management cmd timeout flow
+    - HID: logitech-hidpp: Don't restart communication if not necessary
+    - drm/amd/display: Enable P-state validation checks for DCN314
+    - drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
+    - drm/amd/display: Disable HUBP/DPP PG on DCN314 for now
+    - drm/amd/display: disable SubVP + DRR to prevent underflow
+    - dm thin: add cond_resched() to various workqueue loops
+    - dm cache: add cond_resched() to various workqueue loops
+    - nfsd: zero out pointers after putting nfsd_files on COPY setup error
+    - nfsd: don't hand out delegation on setuid files being opened for write
+    - cifs: prevent data race in smb2_reconnect()
+    - drm/i915/mtl: Correct implementation of Wa_18018781329
+    - drm/shmem-helper: Revert accidental non-GPL export
+    - driver core: fw_devlink: Avoid spurious error message
+    - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
+    - firmware: coreboot: framebuffer: Ignore reserved pixel color bits
+    - block: don't allow multiple bios for IOCB_NOWAIT issue
+    - block: clear bio->bi_bdev when putting a bio back in the cache
+    - block: be a bit more careful in checking for NULL bdev while polling
+    - rtc: pm8xxx: fix set-alarm race
+    - ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms'
+    - ipmi:ssif: resend_msg() cannot fail
+    - ipmi_ssif: Rename idle state and check
+    - ipmi:ssif: Add a timer between request retries
+    - io_uring: Replace 0-length array with flexible array
+    - io_uring: use user visible tail in io_uring_poll()
+    - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
+    - io_uring: add a conditional reschedule to the IOPOLL cancelation loop
+    - io_uring: add reschedule point to handle_tw_list()
+    - io_uring/rsrc: disallow multi-source reg buffers
+    - io_uring: remove MSG_NOSIGNAL from recvmsg
+    - io_uring/poll: allow some retries for poll triggering spuriously
+    - io_uring: fix fget leak when fs don't support nowait buffered read
+    - s390/extmem: return correct segment type in __segment_load()
+    - s390: discard .interp section
+    - s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
+    - s390/kprobes: fix current_kprobe never cleared after kprobes reenter
+    - KVM: s390: disable migration mode when dirty tracking is disabled
+    - cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID
+    - cifs: Fix uninitialized memory read in smb3_qfs_tcon()
+    - cifs: Fix uninitialized memory reads for oparms.mode
+    - cifs: fix mount on old smb servers
+    - cifs: introduce cifs_io_parms in smb2_async_writev()
+    - cifs: split out smb3_use_rdma_offload() helper
+    - cifs: don't try to use rdma offload on encrypted connections
+    - cifs: Check the lease context if we actually got a lease
+    - cifs: return a single-use cfid if we did not get a lease
+    - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization
+    - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()
+    - scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi
+    - btrfs: hold block group refcount during async discard
+    - btrfs: sysfs: update fs features directory asynchronously
+    - locking/rwsem: Prevent non-first waiter from spinning in down_write()
+      slowpath
+    - ksmbd: fix wrong data area length for smb2 lock request
+    - ksmbd: do not allow the actual frame length to be smaller than the rfc1002
+      length
+    - ksmbd: fix possible memory leak in smb2_lock()
+    - torture: Fix hang during kthread shutdown phase
+    - ARM: dts: exynos: correct HDMI phy compatible in Exynos4
+    - io_uring: mark task TASK_RUNNING before handling resume/task work
+    - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
+    - fs: hfsplus: fix UAF issue in hfsplus_put_super
+    - exfat: fix reporting fs error when reading dir beyond EOF
+    - exfat: fix unexpected EOF while reading dir
+    - exfat: redefine DIR_DELETED as the bad cluster number
+    - exfat: fix inode->i_blocks for non-512 byte sector size device
+    - fs: dlm: start midcomms before scand
+    - fs: dlm: fix use after free in midcomms commit
+    - fs: dlm: be sure to call dlm_send_queue_flush()
+    - fs: dlm: fix race setting stop tx flag
+    - fs: dlm: don't set stop rx flag after node reset
+    - fs: dlm: move sending fin message into state change handling
+    - fs: dlm: send FIN ack back in right cases
+    - f2fs: fix information leak in f2fs_move_inline_dirents()
+    - f2fs: retry to update the inode page given data corruption
+    - f2fs: fix cgroup writeback accounting with fs-layer encryption
+    - f2fs: fix kernel crash due to null io->bio
+    - f2fs: Revert "f2fs: truncate blocks in batch in __complete_revoke_list()"
+    - ocfs2: fix defrag path triggering jbd2 ASSERT
+    - ocfs2: fix non-auto defrag path not working issue
+    - fs/cramfs/inode.c: initialize file_ra_state
+    - selftests/landlock: Skip overlayfs tests when not supported
+    - selftests/landlock: Test ptrace as much as possible with Yama
+    - udf: Truncate added extents on failed expansion
+    - udf: Do not bother merging very long extents
+    - udf: Do not update file length for failed writes to inline files
+    - udf: Preserve link count of system files
+    - udf: Detect system inodes linked into directory hierarchy
+    - udf: Fix file corruption when appending just after end of preallocated
+      extent
+    - md: don't update recovery_cp when curr_resync is ACTIVE
+    - KVM: Destroy target device if coalesced MMIO unregistration fails
+    - KVM: VMX: Fix crash due to uninitialized current_vmcs
+    - KVM: Register /dev/kvm as the _very_ last thing during initialization
+    - KVM: x86: Purge "highest ISR" cache when updating APICv state
+    - KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps
+    - KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is disabled
+    - KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID
+    - KVM: SVM: Flush the "current" TLB when activating AVIC
+    - KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target
+    - KVM: SVM: Don't put/load AVIC when setting virtual APIC mode
+    - KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
+    - KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32
+    - KVM: SVM: Fix potential overflow in SEV's send|receive_update_data()
+    - KVM: SVM: hyper-v: placate modpost section mismatch error
+    - selftests: x86: Fix incorrect kernel headers search path
+    - x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
+    - x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
+    - x86/reboot: Disable virtualization in an emergency if SVM is supported
+    - x86/reboot: Disable SVM, not just VMX, when stopping CPUs
+    - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
+    - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe
+      range
+    - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
+    - x86/microcode/AMD: Add a @cpu parameter to the reloading functions
+    - x86/microcode/AMD: Fix mixed steppings support
+    - x86/speculation: Allow enabling STIBP with legacy IBRS
+    - Documentation/hw-vuln: Document the interaction between IBRS and STIBP
+    - virt/sev-guest: Return -EIO if certificate buffer is not large enough
+    - brd: mark as nowait compatible
+    - brd: return 0/-error from brd_insert_page()
+    - brd: check for REQ_NOWAIT and set correct page allocation mask
+    - ima: fix error handling logic when file measurement failed
+    - ima: Align ima_file_mmap() parameters with mmap_file LSM hook
+    - selftests/powerpc: Fix incorrect kernel headers search path
+    - selftests/ftrace: Fix eprobe syntax test case to check filter support
+    - selftests: sched: Fix incorrect kernel headers search path
+    - selftests: core: Fix incorrect kernel headers search path
+    - selftests: pid_namespace: Fix incorrect kernel headers search path
+    - selftests: arm64: Fix incorrect kernel headers search path
+    - selftests: clone3: Fix incorrect kernel headers search path
+    - selftests: pidfd: Fix incorrect kernel headers search path
+    - selftests: membarrier: Fix incorrect kernel headers search path
+    - selftests: kcmp: Fix incorrect kernel headers search path
+    - selftests: media_tests: Fix incorrect kernel headers search path
+    - selftests: gpio: Fix incorrect kernel headers search path
+    - selftests: filesystems: Fix incorrect kernel headers search path
+    - selftests: user_events: Fix incorrect kernel headers search path
+    - selftests: ptp: Fix incorrect kernel headers search path
+    - selftests: sync: Fix incorrect kernel headers search path
+    - selftests: rseq: Fix incorrect kernel headers search path
+    - selftests: move_mount_set_group: Fix incorrect kernel headers search path
+    - selftests: mount_setattr: Fix incorrect kernel headers search path
+    - selftests: perf_events: Fix incorrect kernel headers search path
+    - selftests: ipc: Fix incorrect kernel headers search path
+    - selftests: futex: Fix incorrect kernel headers search path
+    - selftests: drivers: Fix incorrect kernel headers search path
+    - selftests: dmabuf-heaps: Fix incorrect kernel headers search path
+    - selftests: vm: Fix incorrect kernel headers search path
+    - selftests: seccomp: Fix incorrect kernel headers search path
+    - irqdomain: Fix association race
+    - irqdomain: Fix disassociation race
+    - irqdomain: Look for existing mapping only once
+    - irqdomain: Drop bogus fwspec-mapping error handling
+    - irqdomain: Refactor __irq_domain_alloc_irqs()
+    - irqdomain: Fix mapping-creation race
+    - irqdomain: Fix domain registration race
+    - crypto: qat - fix out-of-bounds read
+    - mm/damon/paddr: fix missing folio_put()
+    - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
+    - ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
+    - jbd2: fix data missing when reusing bh which is ready to be checkpointed
+    - ext4: optimize ea_inode block expansion
+    - ext4: refuse to create ea block when umounted
+    - cxl/pmem: Fix nvdimm registration races
+    - Input: exc3000 - properly stop timer on shutdown
+    - mtd: spi-nor: sfdp: Fix index value for SCCR dwords
+    - mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
+    - dm: send just one event on resize, not two
+    - dm: add cond_resched() to dm_wq_work()
+    - dm: add cond_resched() to dm_wq_requeue_work()
+    - wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice
+    - wifi: rtl8xxxu: Use a longer retry limit of 48
+    - wifi: ath11k: allow system suspend to survive ath11k
+    - wifi: cfg80211: Fix use after free for wext
+    - wifi: cfg80211: Set SSID if it is not already set
+    - cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies
+    - qede: fix interrupt coalescing configuration
+    - thermal: intel: powerclamp: Fix cur_state for multi package system
+    - dm flakey: fix logic when corrupting a bio
+    - dm cache: free background tracker's queued work in btracker_destroy
+    - dm flakey: don't corrupt the zero page
+    - dm flakey: fix a bug with 32-bit highmem systems
+    - hwmon: (peci/cputemp) Fix off-by-one in coretemp_label allocation
+    - hwmon: (nct6775) Fix incorrect parenthesization in nct6775_write_fan_div()
+    - spi: intel: Check number of chip selects after reading the descriptor
+    - ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for IOMMU node
+    - ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node
+    - ARM: dts: exynos: correct TMU phandle in Exynos4210
+    - ARM: dts: exynos: correct TMU phandle in Exynos4
+    - ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
+    - ARM: dts: exynos: correct TMU phandle in Exynos5250
+    - ARM: dts: exynos: correct TMU phandle in Odroid XU
+    - ARM: dts: exynos: correct TMU phandle in Odroid HC1
+    - arm64: acpi: Fix possible memory leak of ffh_ctxt
+    - arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP
+    - arm64: Reset KASAN tag in copy_highpage with HW tags only
+    - fuse: add inode/permission checks to fileattr_get/fileattr_set
+    - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
+    - ceph: update the time stamps and try to drop the suid/sgid
+    - regulator: core: Use ktime_get_boottime() to determine how long a regulator
+      was off
+    - panic: fix the panic_print NMI backtrace setting
+    - mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON
+    - genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced
+    - genirq/msi: Take the per-device MSI lock before validating the control
+      structure
+    - spi: spi-sn-f-ospi: fix duplicate flag while assigning to mode_bits
+    - alpha: fix FEN fault handling
+    - dax/kmem: Fix leak of memory-hotplug resources
+    - mips: fix syscall_get_nr
+    - media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
+    - remoteproc/mtk_scp: Move clk ops outside send_lock
+    - vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd
+    - docs: gdbmacros: print newest record
+    - mm: memcontrol: deprecate charge moving
+    - mm/thp: check and bail out if page in deferred queue already
+    - ktest.pl: Give back console on Ctrt^C on monitor
+    - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
+    - ktest.pl: Fix missing "end_monitor" when machine check fails
+    - ktest.pl: Add RUN_TIMEOUT option with default unlimited
+    - memory tier: release the new_memtier in find_create_memory_tier()
+    - ring-buffer: Handle race between rb_move_tail and rb_check_pages
+    - tools/bootconfig: fix single & used for logical condition
+    - tracing/eprobe: Fix to add filter on eprobe description in README file
+    - iommu/amd: Add a length limitation for the ivrs_acpihid command-line
+      parameter
+    - scsi: aacraid: Allocate cmd_priv with scsicmd
+    - scsi: qla2xxx: Fix link failure in NPIV environment
+    - scsi: qla2xxx: Check if port is online before sending ELS
+    - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
+    - scsi: qla2xxx: Remove unintended flag clearing
+    - scsi: qla2xxx: Fix erroneous link down
+    - scsi: qla2xxx: Remove increment of interface err cnt
+    - scsi: ses: Don't attach if enclosure has no components
+    - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
+    - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
+    - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
+    - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
+    - RISC-V: add a spin_shadow_stack declaration
+    - riscv: Avoid enabling interrupts in die()
+    - riscv: mm: fix regression due to update_mmu_cache change
+    - riscv: jump_label: Fixup unaligned arch_static_branch function
+    - riscv: ftrace: Fixup panic by disabling preemption
+    - riscv, mm: Perform BPF exhandler fixup on page fault
+    - riscv: ftrace: Remove wasted nops for !RISCV_ISA_C
+    - riscv: ftrace: Reduce the detour code size to half
+    - MIPS: DTS: CI20: fix otg power gpio
+    - PCI/PM: Observe reset delay irrespective of bridge_d3
+    - PCI: Unify delay handling for reset and resume
+    - PCI: hotplug: Allow marking devices as disconnected during bind/unbind
+    - PCI: Avoid FLR for AMD FCH AHCI adapters
+    - PCI/DPC: Await readiness of secondary bus after reset
+    - bus: mhi: ep: Only send -ENOTCONN status if client driver is available
+    - bus: mhi: ep: Move chan->lock to the start of processing queued ch ring
+    - bus: mhi: ep: Save channel state locally during suspend and resume
+    - iommufd: Make sure to zero vfio_iommu_type1_info before copying to user
+    - iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
+    - iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode
+    - iommu/vt-d: Fix PASID directory pointer coherency
+    - vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR
+    - vfio/type1: prevent underflow of locked_vm via exec()
+    - vfio/type1: track locked_vm per dma
+    - vfio/type1: restore locked_vm
+    - drm/amd: Fix initialization for nbio 7.5.1
+    - drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
+    - drm/radeon: Fix eDP for single-display iMac11,2
+    - drm/i915: Don't use stolen memory for ring buffers with LLC
+    - drm/i915: Don't use BAR mappings for ring buffers with LLC
+    - drm/gud: Fix UBSAN warning
+    - drm/edid: fix AVI infoframe aspect ratio handling
+    - drm/edid: fix parsing of 3D modes from HDMI VSDB
+    - qede: avoid uninitialized entries in coal_entry array
+    - brd: use radix_tree_maybe_preload instead of radix_tree_preload
+    - net: avoid double iput when sock_alloc_file fails
+    - Linux 6.2.3
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations after applying 6.2.3 stable patches
+    - [Config] update annotations after applying 6.2.6 stable patches
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 14 Mar 2023 16:43:44 +0100
+
+linux (6.2.0-16.16) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-16.16 -proposed tracker (LP: #2009914)
+
+  * linux-libc-dev is no longer multi-arch safe (LP: #2009355)
+    - Revert "UBUNTU: [Packaging] install headers to debian/linux-libc-dev
+      directly"
+
+  * linux: CONFIG_SERIAL_8250_MID=y (LP: #2009283)
+    - [Config] enable CONFIG_SERIAL_8250_MID=y
+
+  * cpufreq: intel_pstate: Update Balance performance EPP for Sapphire Rapids
+    (LP: #2008519)
+    - cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Mar 2023 18:34:28 +0100
+
+linux (6.2.0-15.15) lunar; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: document annotations headers
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Mar 2023 07:36:59 +0100
+
+linux (6.2.0-14.14) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-14.14 -proposed tracker (LP: #2009856)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] rust: add rust build dependencies to all arches
+    - [Packaging] Support skipped dkms modules
+    - [Packaging] actually enforce set -e in dkms-build--nvidia-N
+    - [Packaging] Preserve the correct log file variable value
+    - [Packaging] update getabis
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 09 Mar 2023 16:40:36 +0100
+
+linux (6.2.0-13.13) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-13.13 -proposed tracker (LP: #2009704)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * mt7921: add support of MTFG table (LP: #2009642)
+    - wifi: mt76: mt7921: add support to update fw capability with MTFG table
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 14:40:25 +0100
+
+linux (6.2.0-12.12) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-12.12 -proposed tracker (LP: #2009698)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: enforce rust availability only on x86_64
+    - [Config] update CONFIG_RUST_IS_AVAILABLE
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 12:50:15 +0100
+
+linux (6.2.0-11.11) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-11.11 -proposed tracker (LP: #2009697)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] do not stop the build if rust is not available
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 12:24:55 +0100
+
+linux (6.2.0-10.10) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-10.10 -proposed tracker (LP: #2009673)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * enable Rust support in the kernel (LP: #2007654)
+    - [Packaging] propagate makefile variables to kernelconfig
+    - SAUCE: rust: fix regexp in scripts/is_rust_module.sh
+    - SAUCE: scripts: rust: drop is_rust_module.sh
+    - SAUCE: rust: allow to use INIT_STACK_ALL_ZERO
+    - SAUCE: scripts: Exclude Rust CUs with pahole
+    - SAUCE: modpost: support arbitrary symbol length in modversion
+    - SAUCE: allows to enable Rust with modversions
+    - SAUCE: rust: properly detect the version of libclang used by bindgen
+    - [Packaging] rust: add the proper make flags to enable rust support
+    - [Packaging] add rust dependencies
+    - [Packaging] bpftool: always use vmlinux to generate headers
+    - [Packaging] run rustavailable target as debugging before build
+    - [Config] enable Rust support
+
+  * Fail to output sound to external monitor which connects via docking station
+    (LP: #2009024)
+    - [Config] Enable CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Makefile: replace rsync with tar
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 12:01:56 +0100
+
+linux (6.2.0-1.1) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-1.1 -proposed tracker (LP: #2009621)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * kinetic: apply new apparmor and LSM stacking patch set (LP: #1989983)
+    - SAUCE: apparmor: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor: add user namespace creation mediation
+
+  * Lunar update: v6.2.2 upstream stable release (LP: #2009358)
+    - ALSA: hda: cs35l41: Correct error condition handling
+    - crypto: arm64/sm4-gcm - Fix possible crash in GCM cryption
+    - bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
+    - vc_screen: don't clobber return value in vcs_read
+    - drm/amd/display: Move DCN314 DOMAIN power control to DMCUB
+    - drm/amd/display: Properly reuse completion structure
+    - scripts/tags.sh: fix incompatibility with PCRE2
+    - wifi: rtw88: usb: Set qsel correctly
+    - wifi: rtw88: usb: send Zero length packets if necessary
+    - wifi: rtw88: usb: drop now unnecessary URB size check
+    - usb: dwc3: pci: add support for the Intel Meteor Lake-M
+    - USB: serial: option: add support for VW/Skoda "Carstick LTE"
+    - usb: gadget: u_serial: Add null pointer check in gserial_resume
+    - arm64: dts: uniphier: Fix property name in PXs3 USB node
+    - usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO
+    - USB: core: Don't hold device lock while reading the "descriptors" sysfs file
+    - Linux 6.2.2
+
+  * Lunar update: v6.2.1 upstream stable release (LP: #2009127)
+    - uaccess: Add speculation barrier to copy_from_user()
+    - x86/alternatives: Introduce int3_emulate_jcc()
+    - x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions
+    - x86/static_call: Add support for Jcc tail-calls
+    - HID: mcp-2221: prevent UAF in delayed work
+    - wifi: mwifiex: Add missing compatible string for SD8787
+    - audit: update the mailing list in MAINTAINERS
+    - platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY
+    - platform/x86: nvidia-wmi-ec-backlight: Add force module parameter
+    - ext4: Fix function prototype mismatch for ext4_feat_ktype
+    - randstruct: disable Clang 15 support
+    - bpf: add missing header file include
+    - Linux 6.2.1
+
+  * Fix mediatek wifi driver crash when loading wrong SAR table (LP: #2009118)
+    - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read
+
+  * overlayfs mounts as R/O over idmapped mount (LP: #2009065)
+    - SAUCE: overlayfs: handle idmapped mounts in ovl_do_(set|remove)xattr
+
+  * RaptorLake: Fix the Screen is shaking by onboard HDMI port in mirror mode
+    (LP: #1993561)
+    - drm/i915/display: Drop check for doublescan mode in modevalid
+    - drm/i915/display: Prune Interlace modes for Display >=12
+
+  * screen flicker after PSR2 enabled (LP: #2007516)
+    - SAUCE: drm/i915/display/psr: Disable PSR2 sel fetch on panel SHP 5457
+
+  * [23.04 FEAT] Support for new IBM Z Hardware (IBM z16) - Reset DAT-Protection
+    facility support (LP: #1982378)
+    - s390/mm: add support for RDP (Reset DAT-Protection)
+
+  * [23.04 FEAT] zcrypt DD: AP command filtering (LP: #2003637)
+    - s390/zcrypt: introduce ctfm field in struct CPRBX
+
+  * rtcpie in timers from ubuntu_kernel_selftests randomly failing
+    (LP: #1814234)
+    - SAUCE: selftest: rtcpie: Force passing unreliable subtest
+
+  * [23.04 FEAT] Support for List-Directed IPL and re-IPL from ECKD DASD
+    (LP: #2003394)
+    - s390/ipl: add DEFINE_GENERIC_LOADPARM()
+    - s390/ipl: add loadparm parameter to eckd ipl/reipl data
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: drm/i915/sseu: fix max_subslices array-index-out-of-bounds access
+    - SAUCE: mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
+    - SAUCE: Revert "fbdev: Make registered_fb[] private to fbmem.c"
+    - [Packaging] disable signing for ppc64el
+    - [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+    - SAUCE: Revert "arm64/fpsimd: Make kernel_neon_ API _GPL"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 07 Mar 2023 18:45:31 +0100
+
+linux (6.2.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 03 Mar 2023 08:42:43 +0100
+
+linux-unstable (6.2.0-10.10) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-10.10 -proposed tracker (LP: #2007818)
+
+  * Built-in camera device dies after runtime suspended (LP: #2007530)
+    - SAUCE: usb: xhci: Workaround for runpm issue on AMD xHC
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations after rebase to v6.2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Feb 2023 10:36:20 +0100
+
+linux-unstable (6.2.0-9.9) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-9.9 -proposed tracker (LP: #2007069)
+
+  * Move kernel ADT tests to python3 (LP: #2004429)
+    - [Debian] Use a python3 compatable kernel-testing repo
+
+  * Mediatek FM350-GL wwan module failed to init: Invalid device status 0x1
+    (LP: #2002089)
+    - SAUCE: Revert "net: wwan: t7xx: Add AP CLDMA"
+    - SAUCE: net: wwan: t7xx: Add AP CLDMA
+    - SAUCE: net: wwan: t7xx: Infrastructure for early port configuration
+    - SAUCE: net: wwan: t7xx: PCIe reset rescan
+    - SAUCE: net: wwan: t7xx: Enable devlink based fw flashing and coredump
+      collection
+    - SAUCE: net: wwan: t7xx: Devlink documentation
+
+  * LXD containers using shiftfs on ZFS or TMPFS broken on 5.15.0-48.54
+    (LP: #1990849)
+    - SAUCE: shiftfs: fix -EOVERFLOW inside the container
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: do not drop undefined configs in derivatives
+    - [Packaging]: annotations: fix _remove_entry() logic
+    - [Packaging] rsync no longer available on lunar
+    - [Packaging] annotations: Handle single-line annoation rules
+    - [Packaging] annotations: Preserve single-line annotation rules
+    - [Packaging] annotations: Fix linter errors
+    - [Packaging] annotations: Clean up policy writes
+    - [Packaging] annotations: Handle tabs in annotations file
+    - [Packaging] annotations: Fail on invalid lines
+    - [Packaging] annotations: Write out annotations with notes first
+    - [Packaging] annotations: Check validity of FLAVOUR_DEP
+    - [Config] update annotations to split configs with/without notes
+    - [Packaging] annotations: various code cleanups
+    - [Config] update annotations after rebase to v6.2-rc8
+
+  * Miscellaneous upstream changes
+    - selftests/net: mv bpf/nat6to4.c to net folder
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Feb 2023 09:32:18 +0100
+
+linux-unstable (6.2.0-8.8) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-8.8 -proposed tracker (LP: #2004229)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable signing for ppc64el and s390x
+    - SAUCE: s390/decompressor: specify __decompress() buf len to avoid overflow
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 31 Jan 2023 08:21:21 +0100
+
+linux-unstable (6.2.0-7.7) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-7.7 -proposed tracker (LP: #2004142)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 30 Jan 2023 10:23:15 +0100
+
+linux-unstable (6.2.0-6.6) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-6.6 -proposed tracker (LP: #2004138)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] debian/rules: Bring back 'editconfigs'
+    - [Packaging] debian/rules: 1-maintainer.mk -- Use make's if-else
+    - [Packaging] annotations: make sure to always drop undefined configs
+    - [Config] update annotations after rebase to v6.2-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 30 Jan 2023 09:20:26 +0100
+
+linux-unstable (6.2.0-5.5) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-5.5 -proposed tracker (LP: #2003682)
+
+  * [23.04] Kernel 6.2 does not boot on s390x (LP: #2003348)
+    - SAUCE Revert "zstd: import usptream v1.5.2"
+    - SAUCE: Revert "zstd: Move zstd-common module exports to
+      zstd_common_module.c"
+
+  * Revoke & rotate to new signing key (LP: #2002812)
+    - [Packaging] Revoke and rotate to new signing key
+
+  * CVE-2023-0179
+    - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
+
+  * [23.04] net/smc: Alibaba patches about tunable buffer sizes may cause errors
+    and need to be removed (kernel 6.2) (LP: #2003547)
+    - SAUCE: Revert "net/smc: Unbind r/w buffer size from clcsock and make them
+      tunable"
+    - SAUCE: Revert "net/smc: Introduce a specific sysctl for TEST_LINK time"
+
+  * 5.15 stuck at boot on c4.large (LP: #1956780)
+    - SAUCE: Revert "PCI/MSI: Mask MSI-X vectors only on success"
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] scripts/misc/kernelconfig: Disable config checks for mainline
+      builds
+    - [Packaging] annotations: add CONFIG_GCC_VERSION to the list of ignored
+      configs
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 Jan 2023 08:20:26 +0100
+
+linux-unstable (6.2.0-4.4) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-4.4 -proposed tracker (LP: #2003051)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] add python3 as a build dependency
+    - [Packaging] scripts/misc/kernelconfig: Rewrite
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 17 Jan 2023 09:18:54 +0100
+
+linux-unstable (6.2.0-3.3) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-3.3 -proposed tracker (LP: #2002939)
+
+  * Enable kernel config for P2PDMA (LP: #1987394)
+    - [Config] Enable CONFIG_HSA_AMD_P2P
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (no-up) Remove obj- += foo.o hack
+    - SAUCE: (no-up) re-add ubuntu/ directory
+    - [Config] enable EFI handover protocol
+    - [Packaging] Fix module-check error when modules are compressed
+    - SAUCE: (no-up) do not remove debian directory by 'make mrproper'
+    - [Packaging] debian/rules: Drop AUTOBUILD
+    - [Packaging] debian/rules: Drop NOKERNLOG and PRINTSHAS env variables
+    - [Packaging] debian/rules: Replace skip<foo> variables with skip_checks
+    - [Packaging] checks/retpoline-check: Make 'skipretpoline' argument optional
+    - [Packaging] checks/module-signature-check: Add 'skip_checks' argument
+    - [Packaging] debian/rules: Rename 'skip_dbg' to 'do_dbgsym_package'
+    - [Packaging] debian/rules: Rename 'skip_checks' to 'do_skip_checks'
+    - [Packaging] debian/rules: Rename 'full_build' to 'do_full_build'
+    - [Packaging] debian/rules: Fix PPA debug package builds
+    - [Packaging] debian/rules: Remove debug package install directory earlier
+    - [Packaging] debian/rules: Remove unnecessary 'lockme_<foo>' variables
+    - [Packaging] debian/rules: Remove unused target 'diffupstream'
+    - [Packaging] debian/rules: Mark PHONY targets individually
+    - [Packaging] debian/rules: Clean up 'help' target output
+    - [Packaging] debian/rules: Clean up 'printenv' target output
+    - [Packaging] debian/rules: Add missing 'do_<foo>' variables to 'printenv'
+    - [Config] update annotations after rebase to v6.2-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 16 Jan 2023 16:01:40 +0100
+
+linux-unstable (6.2.0-2.2) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-2.2 -proposed tracker (LP: #2001892)
+
+  * Soundwire support for the Intel RPL Gen 0C40/0C11 platforms (LP: #2000030)
+    - SAUCE: ASoC: Intel: soc-acpi: add configuration for variant of 0C40 product
+    - SAUCE: ASoC: Intel: soc-acpi: add configuration for variant of 0C11 product
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain version in annotations
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Support skipped dkms modules"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 05 Jan 2023 09:19:55 +0100
+
+linux-unstable (6.2.0-1.1) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-1.1 -proposed tracker (LP: #2000904)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: remove configs that are undefined across all
+      arches/flavours
+    - SAUCE: Revert "apparmor: make __aa_path_perm() static"
+    - [Packaging] abi-check: ignore failures when abi check is skipped
+    - [Packaging] temporarily disable zfs dkms
+    - [Config] update annotations after rebase to 6.2-rc1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 04 Jan 2023 12:08:32 +0100
+
+linux-unstable (6.2.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Sun, 01 Jan 2023 10:16:00 +0100
+
+linux (6.1.0-11.11) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-11.11 -proposed tracker (LP: #2000704)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Lunar update: v6.1.1 upstream stable release (LP: #2000706)
+    - x86/vdso: Conditionally export __vdso_sgx_enter_enclave()
+    - libbpf: Fix uninitialized warning in btf_dump_dump_type_data
+    - PCI: mt7621: Add sentinel to quirks table
+    - mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem
+    - mips: ralink: mt7621: soc queries and tests as functions
+    - mips: ralink: mt7621: do not use kzalloc too early
+    - irqchip/ls-extirq: Fix endianness detection
+    - udf: Discard preallocation before extending file with a hole
+    - udf: Fix preallocation discarding at indirect extent boundary
+    - udf: Do not bother looking for prealloc extents if i_lenExtents matches
+      i_size
+    - udf: Fix extending file within last block
+    - usb: gadget: uvc: Prevent buffer overflow in setup handler
+    - USB: serial: option: add Quectel EM05-G modem
+    - USB: serial: cp210x: add Kamstrup RF sniffer PIDs
+    - USB: serial: f81232: fix division by zero on line-speed change
+    - USB: serial: f81534: fix division by zero on line-speed change
+    - xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N
+    - staging: r8188eu: fix led register settings
+    - igb: Initialize mailbox message for VF reset
+    - usb: typec: ucsi: Resume in separate work
+    - usb: dwc3: pci: Update PCIe device ID for USB3 controller on CPU sub-system
+      for Raptor Lake
+    - cifs: fix oops during encryption
+    - KEYS: encrypted: fix key instantiation with user-provided data
+    - Linux 6.1.1
+
+  * Expose built-in trusted and revoked certificates (LP: #1996892)
+    - [Packaging] Expose built-in trusted and revoked certificates
+
+  * Fix System cannot detect bluetooth after running suspend stress test
+    (LP: #1998727)
+    - wifi: rtw88: 8821c: enable BT device recovery mechanism
+
+  * Gnome doesn't run smooth when performing normal usage with RPL-P CPU
+    (LP: #1998419)
+    - drm/i915/rpl-p: Add stepping info
+
+  * Mute/mic LEDs no function on a HP platfrom (LP: #1998882)
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
+
+  * Add additional Mediatek MT7922 BT device ID (LP: #1998885)
+    - Bluetooth: btusb: Add a new VID/PID 0489/e0f2 for MT7922
+
+  * Support Icicle Kit reference design v2022.10 (LP: #1993148)
+    - SAUCE: riscv: dts: microchip: Disable PCIe on the Icicle Kit
+
+  * Add iommu passthrough quirk for Intel IPU6 on RaptorLake (LP: #1989041)
+    - SAUCE: iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs on Raptor
+      Lake
+
+  * Enable Intel FM350 wwan CCCI driver port logging (LP: #1997686)
+    - net: wwan: t7xx: use union to group port type specific data
+    - net: wwan: t7xx: Add port for modem logging
+
+  * TEE Support for CCP driver (LP: #1991608)
+    - crypto: ccp - Add support for TEE for PCI ID 0x14CA
+
+  * Kinetic update: v5.19.17 upstream stable release (LP: #1994179)
+    - Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
+    - kbuild: Add skip_encoding_btf_enum64 option to pahole
+
+  * Kinetic update: v5.19.15 upstream stable release (LP: #1994078)
+    - Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5"
+
+  * support independent clock and LED GPIOs for Intel IPU6 platforms
+    (LP: #1989046)
+    - SAUCE: platform/x86: int3472: support independent clock and LED GPIOs
+
+  * Kernel livepatch support for for s390x (LP: #1639924)
+    - [Config] Enable EXPOLINE_EXTERN on s390x
+
+  * Kinetic update: v5.19.7 upstream stable release (LP: #1988733)
+    - Revert "PCI/portdrv: Don't disable AER reporting in
+      get_port_device_capability()"
+
+  * Kinetic update: v5.19.3 upstream stable release (LP: #1987345)
+    - Revert "mm: kfence: apply kmemleak_ignore_phys on early allocated pool"
+
+  * Fix non-working e1000e device after resume (LP: #1951861)
+    - SAUCE: Revert "e1000e: Add polling mechanism to indicate CSME DPG exit"
+
+  * Add additional Mediatek MT7921 WiFi/BT device IDs (LP: #1937004)
+    - SAUCE: Bluetooth: btusb: Add support for Foxconn Mediatek Chip
+
+  * Fix system sleep on TGL systems with Intel ME (LP: #1919321)
+    - SAUCE: PCI: Serialize TGL e1000e PM ops
+
+  * Fix broken e1000e device after S3 (LP: #1897755)
+    - SAUCE: e1000e: Increase polling timeout on MDIC ready bit
+
+  * Fix unusable USB hub on Dell TB16 after S3 (LP: #1855312)
+    - SAUCE: USB: core: Make port power cycle a seperate helper function
+    - SAUCE: USB: core: Attempt power cycle port when it's in eSS.Disabled state
+
+  * Set explicit CC in the headers package (LP: #1999750)
+    - [Packaging] Set explicit CC in the headers package
+
+  * commit cf58599cded35cf4affed1e659c0e2c742d3fda7 seems to be missing in
+    kinetic master to remove "hio" reference from Makefile (LP: #1999556)
+    - SAUCE: remove leftover reference to ubuntu/hio driver
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] kernelconfig: always complete all config checks
+    - [Packaging] annotations: unify same rule across all flavour within the same
+      arch
+    - [Config] annotations: compact annotations file
+    - [Config] disable EFI_ZBOOT
+    - SAUCE: input: i8042: fix section mismatch warning
+    - debian/dkms-versions -- re-enable zfs
+    - [Packaging] old-kernelconfig: update config-check path
+    - [Packaging] update getabis
+    - [Packaging] update Ubuntu.md
+
+  * Miscellaneous upstream changes
+    - Revert "drm/i915/opregion: check port number bounds for SWSCI display power
+      state"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 30 Dec 2022 11:23:16 +0100
+
+linux (6.1.0-10.10) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-10.10 -proposed tracker (LP: #1999569)
+
+  * Soundwire support for the Intel RPL Gen platforms (LP: #1997944)
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C10 product
+    - ASoC: Intel: soc-acpi: add SKU 0C10 SoundWire configuration
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C40 product
+    - ASoC: Intel: soc-acpi: add SKU 0C40 SoundWire configuration
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C4F product
+    - ASoC: rt1318: Add RT1318 SDCA vendor-specific driver
+    - ASoC: intel: sof_sdw: add rt1318 codec support.
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C11 product
+    - ASoC: Intel: soc-acpi: add SKU 0C11 SoundWire configuration
+    - SAUCE: ASoC: Intel: soc-acpi: update codec addr on 0C11/0C4F product
+    - [Config] enable CONFIG_SND_SOC_RT1318_SDW
+
+  * Virtual GPU driver packaging regression (LP: #1996112)
+    - [Packaging] Reintroduce VM DRM drivers into modules
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 13 Dec 2022 22:14:08 +0100
+
+linux (6.1.0-9.9) lunar; urgency=medium
+
+  * Empty entry (ABI bump)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 13 Dec 2022 21:31:08 +0100
+
+linux (6.1.0-3.3) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-3.3 -proposed tracker (LP: #1999534)
+
+  * [DEP-8] Run ADT regression suite for lowlatency kernels Jammy and later
+    (LP: #1999528)
+    - [DEP-8] Fix regression suite to run on lowlatency
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: do not add constraints on toolchain versions
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 13 Dec 2022 16:45:59 +0100
+
+linux (6.1.0-2.2) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-2.2 -proposed tracker (LP: #1999411)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: do not enforce toolchain versions
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Dec 2022 17:05:59 +0100
+
+linux (6.1.0-1.1) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-1.1 -proposed tracker (LP: #1999373)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: set and delete configs from command line
+    - [Packaging] migrateconfigs: ignore README.rst if it doesn't exist
+    - [Packaging] migrate-annotations: properly determine arches in derivatives
+    - [Packaging] annotations: allow to set note to config options directly
+    - [Packaging] annotations: assume --query as default command
+    - [Packaging] annotations: allow to query using CONFIG_<option> or <option>
+    - [Packaging] annotations: support flavour inheritance
+    - [Packaging] annotations: properly merge configs with includes
+    - [Packaging] annotations: accept config options with or without CONFIG_
+      prefix
+    - [Packaging] annotations: clarify error message with --import
+    - [Packaging] annotations: properly support multiple levels of inclusion
+    - [Packaging] annotations: catch syntax errors in annotations
+    - [Packaging] kernelconfig: report arch and flavour in config-check log
+    - [Packaging] annotations: prevent generating .pyc files on import
+    - [Packaging] annotations: prevent python broken pipe errors
+    - [Packaging] annotations: allow to specify --write and --note at the same
+      time
+    - [Packaging] annotations: add an option to enable config autocompletion in
+      bash
+    - [Packaging] annotations: introduce --source
+    - [Packaging] annotations: add missing CONFIG_ prefix in main()
+    - [Packaging] Remove obsolete etc/kernelconfig
+    - [Packaging] Rewrite debian/scripts/abi-check in Python
+    - [Packaging] Simplify debian/scripts/module-check
+    - [Packaging] Clean up debian/scripts/module-check
+    - [Packaging] Move checker scripts to debian/scripts/checks
+    - [Packaging] mark phony targets
+    - [Packaging] Make the compiler for fix-filenames explicit
+    - [Packaging] add -rR MAKEFLAGS to clear implicit rules
+    - [Packaging] use dpkg-parsechangelog to get package name and series
+    - [Packaging] simplify revision/release
+    - [Packaging] simplify custom_override
+    - [Packaging] Remove meaningless code in install-arch-headers
+    - [Packaging] use olddefconfig in stamp-prepare-tree
+    - [Packaging] use parralel builds in more places
+    - [Packaging] install headers to debian/linux-libc-dev directly
+    - [Packaging] simplify abinum and uploadnum definitions
+    - [Packaging] Remove unused INSTALL_FW_PATH
+    - [Packaging] Merge install commands
+    - [Config] clean up deprecated notes in annotations
+    - [Packaging] automatically apply changes to annotations and drop
+      importconfigs
+    - [Packaging] kernelconfig: drop listnewconfigs
+    - [Packaging] annotations: do not hijack CONFIGS/* to update annotations
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Dec 2022 10:05:03 +0100
+
+linux (6.1.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Dec 2022 09:42:01 +0100
+
+linux-unstable (6.1.0-9.9) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-9.9 -proposed tracker (LP: #1998078)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Set ARM64_ERRATUM_2077057=y
+    - SAUCE: add python cached bytecode to .gitignore
+    - [Packaging] config-check: ignore values that are not defined in annotations
+    - [Packaging] config-check: do not strictly enforce CONFIG_CC_VERSION_TEXT
+    - [Packaging] config-check: support annotations format 4
+    - [Packaging] introduce annotations script
+    - [Packaging] add a README.rst to document the new annotations schema
+    - [Packaging] kernelconfig: automatically generate configs from annotations
+    - [Packaging] drop deprecated script tristate.sh
+    - [Packaging] use annotations to generate initial configs check them
+    - [Packaging] simplify kernelconfig
+    - [Packaging] kernelconfig: always keep configs
+    - [Packaging] kernelconfig: provide listnewconfigs
+    - [Packaging] kernelconfig: introduce importconfigs
+    - [Packaging] snap: support new annotations with snapcraft
+    - [Packaging] final-checks: support new annotations
+    - [Packaging] introduce migrate-annotations
+    - [Packaging] re-introduce previous kernelconfig as old-kernelconfig
+    - [Packaging] provide migrateconfigs debian/rules target
+    - [Packaging] correctly propagate errors during updateconfigs
+    - [Packaging] annotations: report failed config checks in alphabetic order
+    - [Config] merge configs into annotations
+    - [Config] udpate annotations after rebase to v6.1-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Nov 2022 11:25:44 +0100
+
+linux-unstable (6.1.0-8.8) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-8.8 -proposed tracker (LP: #1997357)
+
+  *  Fibocom WWAN FM350-GL suspend error (notebook not suspend) (LP: #1990700)
+    - net: wwan: t7xx: Add AP CLDMA
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v6.1-rc6
+    - [Config] update configs following v6.1-rc6 rebase
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs following v6.1-rc6 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 22 Nov 2022 11:56:26 +0100
+
+linux-unstable (6.1.0-7.7) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-7.7 -proposed tracker (LP: #1996731)
+
+  * Miscellaneous Ubuntu changes
+    - ppc64el: remove missing module
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 16 Nov 2022 11:37:05 +0100
+
+linux-unstable (6.1.0-6.6) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-6.6 -proposed tracker (LP: #1996616)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs following v6.1-rc5 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 15 Nov 2022 15:55:33 +0100
+
+linux-unstable (6.1.0-5.5) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-5.5 -proposed tracker (LP: #1995875)
+
+  * Please have linux-tools-common Provide: bpftool (LP: #1981089)
+    - [Packaging] let linux-tools-common provides bpftool
+
+  * Miscellaneous Ubuntu changes
+    - packaging: switch to lunar series
+    - Rebase to v6.1-rc4
+    - [Config] toolchian update
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 07 Nov 2022 16:43:21 +0100
+
+linux-unstable (6.1.0-4.4) lunar; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-4.4 -proposed tracker (LP: #1995500)
+
+  * Fix ath11k deadlock on WCN6855 (LP: #1995041)
+    - SAUCE: wifi: ath11k: avoid deadlock during regulatory update in
+      ath11k_regd_update()
+
+  * Bump (kernel) '-mtune' to z16 / arch14 with 23.04 (LP: #1982833)
+    - [Config] Enable mtune z16
+
+  * armhf kernel compiled with gcc-12 fails to boot on pi 3/2 (LP: #1993120)
+    - [Packaging] Support arch-specific compilers in updateconfigs
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs after rebase to 6.1-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 03 Nov 2022 14:00:41 +0100
+
+linux-unstable (6.1.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-3.3 -proposed tracker (LP: #1994037)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Support skipped dkms modules
+    - [Config] update configs after rebase to 6.1-rc2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 24 Oct 2022 15:53:11 +0200
+
+linux-unstable (6.1.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-2.2 -proposed tracker (LP: #1993350)
+
+  * Populating Hyper-V MSR for Ubuntu 13.10 (LP: #1193172)
+    - SAUCE: (no-up) hv: Supply vendor ID and package ABI
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: perf tools: Fix man page build wrt perf-arm-coresight.txt
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 18 Oct 2022 23:02:31 +0200
+
+linux-unstable (6.1.0-1.1) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-1.1 -proposed tracker (LP: #1993118)
+
+  * Raise CONFIG_NR_CPUS (LP: #1967889)
+    - [Config] Raise riscv64 CONFIG_NR_CPUS to 32
+
+  * rcu_sched detected stalls on CPUs/tasks (LP: #1967130)
+    - [Config] Disable VMAP_STACK on riscv64
+
+  * Disable sv57 as the userspace is not ready (LP: #1991790)
+    - SAUCE: riscv: mm: Force disable sv57
+
+  * earlyconsole prints question marks on 5.19.0-1002-generic (LP: #1988984)
+    - [Config] Set CONFIG_PWM_SIFIVE=m for riscv64
+
+  * RCU stalls (LP: #1991951)
+    - [Config] Harmonize RCU_CPU_STALL_TIMEOUT
+
+  * backport dkms fixes to build modules correctly for hwe-5.19+ kernels with
+    custom compiler (LP: #1991664)
+    - [Packaging] use versioned gcc-12
+    - [Packaging] Update configs with versioned compiler version
+
+  * FTBFS on kinetic (LP: #1990964)
+    - SAUCE: uapi: Fixup strace compile error
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] sameport -- add support for sameport versioning
+    - [Packaging] move to kernel 6.1
+    - SAUCE: platform/x86: dell-uart-backlight: remove
+      acpi_video_set_dmi_backlight_type()
+    - SAUCE: shiftfs: support kernel 6.1
+    - [Config] update configs and annotations after rebase to 6.1-rc1
+    - debian/dkms-versions -- temporarily disable dkms builds
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 18 Oct 2022 17:21:43 +0200
+
+linux-unstable (6.1.0-0.0) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 17 Oct 2022 08:57:58 +0200
+
+linux-unstable (6.0.0-9.9) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-9.9 -proposed tracker (LP: #1991521)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain configs after rebase to 6.0
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 03 Oct 2022 15:51:57 +0200
+
+linux-unstable (6.0.0-8.8) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-8.8 -proposed tracker (LP: #1990101)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 20 Sep 2022 10:22:14 +0200
+
+linux-unstable (6.0.0-7.7) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-7.7 -proposed tracker (LP: #1989331)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+    - [Packaging] resync getabis
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Please enable CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU (LP: #1980861)
+    - [Config] Switch from DECOMP_SINGLE to DECOMP_MULTI_PERCPU
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Pass kernel build_arch to dkms
+    - [Packaging[ get rid of unnecessary 'set -x'
+    - [Config] update configs and annotations after rebase to 6.0-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Sep 2022 14:03:55 +0200
+
+linux-unstable (6.0.0-6.6) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-6.6 -proposed tracker (LP: #1988706)
+
+  * Support Intel TDX guest attestation driver (LP: #1988120)
+    - SAUCE: x86/tdx: Add TDX Guest attestation interface driver
+    - SAUCE: selftests: tdx: Test GetReport TDX attestation feature
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable signing for ppc64el and s390x
+    - [Config] enable security-related configs
+    - [Config] update toolchain versions
+    - [Packaging] fix URLs used to retrieve kernel ABI
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 05 Sep 2022 16:59:40 +0200
+
+linux-unstable (6.0.0-5.5) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-5.5 -proposed tracker (LP: #1988019)
+
+  * LSM: Configuring Too Many LSMs Causes Kernel Panic on Boot (LP: #1987998)
+    - SAUCE: LSM: Change Landlock from LSMBLOB_NEEDED to LSMBLOB_NOT_NEEDED
+
+  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
+    - [Config] Align riscv64 CONFIG_LSM with other architectures
+    - [Config] Enable CONFIG_DRM_RCAR_USE_LVDS for riscv64
+    - [Config] Enable CONFIG_DTPM for riscv64
+    - [Config] Set CONFIG_MTD_RAW_NAND=m for riscv64
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging]: always use fully qualified <triplet>-gcc-VER toolchain
+    - [Packaging] use unversioned default gcc
+    - [Packaging] Remove circular dependency between image & modules
+    - [Config] update configs after rebase to 6.0-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 29 Aug 2022 09:18:39 +0200
+
+linux-unstable (6.0.0-4.4) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-4.4 -proposed tracker (LP: #1987517)
+
+  * Fix invalid MAC address after hotplug tbt dock (LP: #1942999)
+    - SAUCE: igc: wait for the MAC copy when enabled MAC passthrough
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] getabis: Add modules.builtin to the ABI
+
+  * Miscellaneous upstream changes
+    - perf tools: Fix compile error for x86
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 24 Aug 2022 15:10:24 +0200
+
+linux-unstable (6.0.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-3.3 -proposed tracker (LP: #1987241)
+
+  * [22.04 FEAT] Deactivitate  CONFIG_QETH_OSX kernel config option
+    (LP: #1959890)
+    - [Config] disable CONFIG_QETH_OSX on s390x
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Make stamp-install-<flavor> target reentrant
+    - [Config] update toolchain version
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 Aug 2022 09:09:26 +0200
+
+linux-unstable (6.0.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-2.2 -proposed tracker (LP: #1986844)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "perf tools: Use Python devtools for version autodetection
+      rather than runtime"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 Aug 2022 19:40:07 +0200
+
+linux-unstable (6.0.0-1.1) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-1.1 -proposed tracker (LP: #1986784)
+
+  * refactoring of overlayfs fix to properly support shiftfs (LP: #1983640)
+    - SAUCE: for aufs mmap: print the virtual file path
+    - SAUCE: overlayfs: fix incorrect mnt_id of files opened from map_files
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move to kernel 6.0
+    - [Config] update configs and annotations after rebase to 6.0-rc1
+    - [Packaging] temporarily disable dkms
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 Aug 2022 16:56:18 +0200
+
+linux-unstable (6.0.0-0.0) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 Aug 2022 10:23:42 +0200
+
+linux (5.19.0-15.15) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-15.15 -proposed tracker (LP: #1983335)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations to support both gcc-11 and gcc-12
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 02 Aug 2022 09:23:01 +0200
+
+linux (5.19.0-14.14) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-14.14 -proposed tracker (LP: #1983273)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] module-signature-check: Check debian.<foo>/signature-inclusion
+    - [Packaging] Introduce debian/scripts/sign-module
+    - SAUCE: Switch to using debian/scripts/sign-module
+    - [Config] update configs/annotations after rebase to 5.19
+    - [Config] update configs after moving to gcc-12
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging]: always use fully qualified <triplet>-gcc-VER
+      toolchain"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 01 Aug 2022 17:19:01 +0200
+
+linux (5.19.0-13.13) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-13.13 -proposed tracker (LP: #1983033)
+
+  * network-manager/1.36.4-2ubuntu1 ADT test failure with linux/5.15.0-28.29
+    (LP: #1971418)
+    - Revert "rfkill: make new event layout opt-in"
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Tighten up LP bug links in annotations
+    - [Config] Use mark<ENFORCED> for CONFIG_DEVTMPFS
+    - [Config] Use flag<DEPRECATED> for CONFIG_HIPPI
+    - [Config] Use note<> for CONFIG_XEN_ACPI_PROCESSOR
+    - [Config] Fix DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING annotation
+    - [Config] Fix CONFIG_CPU_LITTLE_ENDIAN annotation
+    - SAUCE: x86/bugs: Do not enable IBPB at firmware entry when IBPB is not
+      available
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 28 Jul 2022 17:04:33 +0200
+
+linux (5.19.0-12.12) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-12.12 -proposed tracker (LP: #1982741)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging]: always use fully qualified <triplet>-gcc-VER toolchain
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 26 Jul 2022 15:07:13 +0200
+
+linux (5.19.0-11.11) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-11.11 -proposed tracker (LP: #1982726)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * GPIO character device v1 API not enabled in kernel (LP: #1953613)
+    - [Config] Enable CONFIG_GPIO_CDEV_V1
+
+  * Use kernel-testing repo from launchpad for ADT tests (LP: #1968016)
+    - [Debian] Use kernel-testing repo from launchpad
+
+  * Support AMD P-State cpufreq control mechanism (LP: #1956509)
+    - [Config] enable X86_AMD_PSTATE as built-in on amd64
+
+  * PCIE LnkCtl ASPM not enabled under VMD mode for Alder Lake platforms
+    (LP: #1942160)
+    - SAUCE: PCI/ASPM: Enable ASPM for links under VMD domain
+    - SAUCE: PCI/ASPM: Enable LTR for endpoints behind VMD
+    - SAUCE: vmd: fixup bridge ASPM by driver name instead
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Double the speed of updateconfigs
+    - Remove ubuntu/hio driver
+    - [Config] update config after rebase to 5.19-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 25 Jul 2022 08:54:21 +0200
+
+linux (5.19.0-10.10) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-10.10 -proposed tracker (LP: #1982013)
+
+  * enable config for fixing 5.17 kernel won't load mok (LP: #1972802)
+    - [Config] enable configs for fixing kernel won't load mok
+
+  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
+    - [Config] Disable CONFIG_CXL_MEM_RAW_COMMANDS on riscv64
+    - [Config] Disable CONFIG_EROFS_FS_ZIP_LZMA on riscv64
+    - [Config] Disable CONFIG_FONT_6x8 on riscv64
+    - [Config] Disable CONFIG_NTFS3_64BIT_CLUSTER on riscv64
+    - [Config] Disable CONFIG_SCSI_IZIP_EPP16 on riscv64
+    - [Config] Disable CONFIG_SCSI_UFS_HWMON on riscv64
+    - [Config] Disable CONFIG_SPI_AX88796C_COMPRESSION on riscv64
+    - [Config] Disable CONFIG_VIDEO_ZORAN on riscv64
+    - [Config] Enable CONFIG_BPF_KPROBE_OVERRIDE on riscv64
+    - [Config] Enable CONFIG_CACHEFILES_ERROR_INJECTION on riscv64
+    - [Config] Enable CONFIG_DRM_AMD_DC_SI on riscv64
+    - [Config] Enable CONFIG_NUMA_BALANCING on riscv64
+    - [Config] Enable CONFIG_PROC_VMCORE_DEVICE_DUMP on riscv64
+    - [Config] Enable CONFIG_WLAN_VENDOR_MICROCHIP on riscv64
+    - [Config] Set CONFIG_MHI_WWAN_CTRL=m on riscv64
+    - [Config] Set CONFIG_NFC_S3FWRN82_UART=m on riscv64
+    - [Config] Enable CONFIG_EFIVAR_FS on riscv64
+    - [Config] Enable CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES on riscv64
+    - [Config] Enable CONFIG_STRICT_DEVMEM on riscv64
+    - [Config] Enable CONFIG_VMAP_STACK on riscv64
+    - [Config] Enable CONFIG_KEXEC_FILE on riscv64
+    - [Config] Set CONFIG_MTD_PSTORE=m on riscv64
+    - [Config] Set CONFIG_KFENCE_SAMPLE_INTERVAL=0 on riscv64
+    - [Config] Enable CONFIG_KEXEC_FILE on s390x
+
+  * Ubuntu 22.04 and 20.04 DPC Fixes for Failure Cases of DownPort Containment
+    events (LP: #1965241)
+    - Enable config option CONFIG_PCIE_EDR
+    - Correct CONFIG_PCIE_EDR annotation on arm64
+
+  * config CONFIG_HISI_PMU for  kunpeng920 (LP: #1956086)
+    - [Config] CONFIG_HISI_PMU=m
+
+  * Skip setting ethernet LED on Dell EMC board (LP: #1971667)
+    - SAUCE: net: phy: marvell: Skip setting LED on Dell EMC board
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] ignore warnings from the output of ld.bfd
+    - [Packaging] Fix bashism in dkms-build script
+    - [Packaging] Always catch errors in dkms-build scripts
+    - [Packaging] Fix dkms builds with linker @module.mod files
+    - [Packaging] mark dkms-build-configure--zfs executable
+    - [Config] update configs and annotations after rebase to 5.19-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 18 Jul 2022 23:45:28 +0200
+
+linux (5.19.0-9.9) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-9.9 -proposed tracker (LP: #1980622)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update config after rebase to 5.19-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Jul 2022 12:05:04 +0200
+
+linux (5.19.0-8.8) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-8.8 -proposed tracker (LP: #1980482)
+
+  * temporarily disable CONFIG_X86_KERNEL_IBT (LP: #1980484)
+    - [Config] temporarily disable CONFIG_X86_KERNEL_IBT
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 01 Jul 2022 11:58:56 +0200
+
+linux (5.19.0-7.7) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-7.7 -proposed tracker (LP: #1980056)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * RISC-V enables CONFIG_COMPAT in the unstable branch (LP: #1980061)
+    - [Config] Disable CONFIG_COMPAT on RISC-V
+
+  * No RISC-V configuration in the unstable tree (LP: #1979647)
+    - [Config] Merge riscv64 config and annotations
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 28 Jun 2022 12:25:48 +0200
+
+linux (5.19.0-6.6) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 28 Jun 2022 07:50:17 +0200
+
+linux-unstable (5.19.0-6.6) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-6.6 -proposed tracker (LP: #1979948)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove 'family=ubuntu' concept
+    - [Packaging] final-checks: Remove useless sourcing of kernelconfig
+    - [Config] update config after rebase to 5.19-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 27 Jun 2022 09:16:40 +0200
+
+linux-unstable (5.19.0-5.5) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-5.5 -proposed tracker (LP: #1979611)
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable signing for ppc64el and
+      s390x"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 23 Jun 2022 11:13:32 +0200
+
+linux-unstable (5.19.0-4.4) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-4.4 -proposed tracker (LP: #1979177)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs after rebase to 5.19-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Jun 2022 09:02:58 +0200
+
+linux-unstable (5.19.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-3.3 -proposed tracker (LP: #1978439)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations for 5.19
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Jun 2022 07:16:32 +0200
+
+linux-unstable (5.19.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-2.2 -proposed tracker (LP: #1978313)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Jun 2022 15:17:20 +0200
+
+linux-unstable (5.19.0-1.1) kinetic; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * linux: Staging modules should be unsigned (LP: #1642368)
+    - [Packaging] Move and update signature inclusion list
+    - [Packaging] Strip signatures from untrusted staging modules
+    - [Packaging] Add module-signature-check
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to 5.19-rc1
+    - [Packaging] move to kernel 5.19
+    - [Packaging] workaround missing python3-dev dependency
+    - SAUCE: Revert "perf tools: Use Python devtools for version autodetection
+      rather than runtime"
+    - SAUCE: watchdog: gxp: Add missing MODULE_LICENSE
+    - [Packaging] add python3-dev as build dependency
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Jun 2022 14:43:46 +0200
+
+linux-unstable (5.19.0-0.0) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 09 Jun 2022 12:13:06 +0200
+
+linux (5.18.0-6.6) kinetic; urgency=medium
+
+  * kinetic/linux: 5.18.0-6.6 -proposed tracker (LP: #1976327)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable signing for ppc64el and s390x
+    - [Config] update toolchain versions
+    - [Config] enable CONFIG_X86_KERNEL_IBT
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 31 May 2022 11:05:51 +0200
+
+linux (5.18.0-5.5) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 May 2022 16:59:47 +0200
+
+linux-unstable (5.18.0-5.5) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-5.5 -proposed tracker (LP: #1975458)
+
+  * enable CONFIG_DEVTMPFS_SAFE (LP: #1974442)
+    - [Config] enable CONFIG_DEVTMPFS_SAFE
+
+  * build backport-iwlwifi-dkms as linux-modules-iwlwifi-ABI (LP: #1969434)
+    - [Packaging] drop do_<mod> arch specific configs
+
+  * prevent kernel panic with overlayfs + shiftfs (LP: #1973620)
+    - SAUCE: overlayfs: prevent dereferencing struct file in ovl_vm_prfile_set()
+
+  * linux-image-5.0.0-35-generic breaks checkpointing of container
+    (LP: #1857257) // re-apply missing overlayfs SAUCE patch (LP: #1967924)
+    - SAUCE: overlayfs: fix incorrect mnt_id of files opened from map_files
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 May 2022 11:21:38 +0200
+
+linux-unstable (5.18.0-4.4) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-4.4 -proposed tracker (LP: #1973587)
+
+  * build backport-iwlwifi-dkms as linux-modules-iwlwifi-ABI (LP: #1969434)
+    - [Packaging] support standalone dkms module builds
+
+  * Enable speakup kernel modules to allow the speakup screen reader to function
+    (LP: #1967702)
+    - [Config] CONFIG_SPEAKUP=m for all but s390x
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable v4l2loopback"
+    - Revert "UBUNTU: [Packaging] temporarily disable zfs"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 16 May 2022 14:15:35 +0200
+
+linux-unstable (5.18.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-3.3 -proposed tracker (LP: #1972162)
+
+  * disable Intel DMA remapping by default (LP: #1971699)
+    - Revert "UBUNTU: [Config] enable Intel DMA remapping options by default"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 May 2022 12:15:39 +0200
+
+linux-unstable (5.18.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-2.2 -proposed tracker (LP: #1971340)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs after rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 03 May 2022 12:24:49 +0200
+
+linux-unstable (5.18.0-1.1) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 03 May 2022 09:38:06 +0200
+
+linux-unstable (5.18.0-1.1) jammy; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-1.1 -proposed tracker (LP: #1969476)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to 5.18
+    - [Packaging] temporarily disable zfs
+    - [Packaging] temporarily disable v4l2loopback
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 27 Apr 2022 20:26:42 +0200
+
+linux-unstable (5.18.0-0.0) jammy; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 19 Apr 2022 16:20:00 +0200
+
+linux-unstable (5.17.0-8.8) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-8.8 -proposed tracker (LP: #1969016)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Apr 2022 10:30:39 +0200
+
+linux-unstable (5.17.0-7.7) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-7.7 -proposed tracker (LP: #1968988)
+
+  * zfcpdump-kernel update to v5.15 (LP: #1965766)
+    - SAUCE: Audit: Fix incorrect static inline function declration.
+
+  * intel_iommu breaks Intel IPU6 camera: isys port open ready failed -16
+    (LP: #1958004)
+    - SAUCE: iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs
+
+  * Jammy update: v5.17.3 upstream stable release (LP: #1968986)
+    - lib/logic_iomem: correct fallback config references
+    - um: fix and optimize xor select template for CONFIG64 and timetravel mode
+    - rtc: wm8350: Handle error for wm8350_register_irq
+    - net: dsa: felix: fix possible NULL pointer dereference
+    - mm: kfence: fix objcgs vector allocation
+    - KVM: x86/pmu: Use different raw event masks for AMD and Intel
+    - KVM: SVM: Fix kvm_cache_regs.h inclusions for is_guest_mode()
+    - KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
+    - KVM: x86/pmu: Fix and isolate TSX-specific performance event logic
+    - KVM: x86/emulator: Emulate RDPID only if it is enabled in guest
+    - drm: Add orientation quirk for GPD Win Max
+    - Bluetooth: hci_sync: Fix compilation warning
+    - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
+    - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
+    - drm/amd/display: Add signal type check when verify stream backends same
+    - drm/amdkfd: enable heavy-weight TLB flush on Arcturus
+    - drm/edid: remove non_desktop quirk for HPN-3515 and LEN-B800.
+    - drm/edid: improve non-desktop quirk logging
+    - Bluetooth: hci_event: Ignore multiple conn complete events
+    - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
+    - drm/amd/display: Fix memory leak
+    - drm/amd/display: Use PSR version selected during set_psr_caps
+    - usb: gadget: tegra-xudc: Do not program SPARAM
+    - usb: gadget: tegra-xudc: Fix control endpoint's definitions
+    - usb: cdnsp: fix cdnsp_decode_trb function to properly handle ret value
+    - ptp: replace snprintf with sysfs_emit
+    - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set
+    - selftests, xsk: Fix bpf_res cleanup test
+    - net/mlx5e: TC, Hold sample_attr on stack instead of pointer
+    - drm/amdkfd: Don't take process mutex for svm ioctls
+    - drm/amdkfd: Ensure mm remain valid in svm deferred_list work
+    - drm/amdkfd: svm range restore work deadlock when process exit
+    - drm/amdgpu: Fix an error message in rmmod
+    - mlxsw: spectrum: Guard against invalid local ports
+    - RDMA/rtrs-clt: Do stop and failover outside reconnect work.
+    - powerpc/xive: Export XIVE IPI information for online-only processors.
+    - powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
+    - ath11k: fix kernel panic during unload/load ath11k modules
+    - ath11k: pci: fix crash on suspend if board file is not found
+    - ath11k: mhi: use mhi_sync_power_up()
+    - net/smc: Send directly when TCP_CORK is cleared
+    - drm/bridge: Add missing pm_runtime_put_sync
+    - bpf: Make dst_port field in struct bpf_sock 16-bit wide
+    - scsi: mvsas: Replace snprintf() with sysfs_emit()
+    - scsi: bfa: Replace snprintf() with sysfs_emit()
+    - drm/v3d: fix missing unlock
+    - power: supply: axp20x_battery: properly report current when discharging
+    - mt76: mt7921: fix crash when startup fails.
+    - mt76: dma: initialize skip_unmap in mt76_dma_rx_fill
+    - i40e: Add sending commands in atomic context
+    - cfg80211: don't add non transmitted BSS to 6GHz scanned channels
+    - libbpf: Fix build issue with llvm-readelf
+    - ipv6: make mc_forwarding atomic
+    - ref_tracker: implement use-after-free detection
+    - net: initialize init_net earlier
+    - powerpc: Set crashkernel offset to mid of RMA region
+    - drm/amdgpu: Fix recursive locking warning
+    - scsi: smartpqi: Fix rmmod stack trace
+    - scsi: smartpqi: Fix kdump issue when controller is locked up
+    - PCI: aardvark: Fix support for MSI interrupts
+    - kvm: selftests: aarch64: fix assert in gicv3_access_reg
+    - kvm: selftests: aarch64: pass vgic_irq guest args as a pointer
+    - kvm: selftests: aarch64: fix the failure check in
+      kvm_set_gsi_routing_irqchip_check
+    - kvm: selftests: aarch64: fix some vgic related comments
+    - kvm: selftests: aarch64: use a tighter assert in vgic_poke_irq()
+    - iommu/arm-smmu-v3: fix event handling soft lockup
+    - usb: ehci: add pci device support for Aspeed platforms
+    - KVM: arm64: Do not change the PMU event filter after a VCPU has run
+    - libbpf: Fix accessing syscall arguments on powerpc
+    - libbpf: Fix accessing the first syscall argument on arm64
+    - libbpf: Fix accessing the first syscall argument on s390
+    - PCI: endpoint: Fix alignment fault error in copy tests
+    - tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH.
+    - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
+    - scsi: mpi3mr: Fix deadlock while canceling the fw event
+    - scsi: mpi3mr: Fix reporting of actual data transfer size
+    - scsi: mpi3mr: Fix memory leaks
+    - powerpc/set_memory: Avoid spinlock recursion in change_page_attr()
+    - power: supply: axp288-charger: Set Vhold to 4.4V
+    - drm/sprd: fix potential NULL dereference
+    - drm/sprd: check the platform_get_resource() return value
+    - drm/amd/display: reset lane settings after each PHY repeater LT
+    - net/mlx5e: Disable TX queues before registering the netdev
+    - HID: apple: Report Magic Keyboard 2021 battery over USB
+    - HID: apple: Report Magic Keyboard 2021 with fingerprint reader battery over
+      USB
+    - usb: dwc3: pci: Set the swnode from inside dwc3_pci_quirks()
+    - iwlwifi: mvm: Correctly set fragmented EBS
+    - iwlwifi: fix small doc mistake for iwl_fw_ini_addr_val
+    - iwlwifi: mvm: move only to an enabled channel
+    - ipv6: annotate some data-races around sk->sk_prot
+    - drm/msm/dsi: Remove spurious IRQF_ONESHOT flag
+    - x86/mce: Work around an erratum on fast string copy instructions
+    - rtw89: fix RCU usage in rtw89_core_txq_push()
+    - ath11k: Fix frames flush failure caused by deadlock
+    - ipv4: Invalidate neighbour for broadcast address upon address addition
+    - rtw88: change rtw_info() to proper message level
+    - dm ioctl: prevent potential spectre v1 gadget
+    - dm: requeue IO if mapping table not yet available
+    - drm/amdkfd: make CRAT table missing message informational only
+    - vfio/pci: Stub vfio_pci_vga_rw when !CONFIG_VFIO_PCI_VGA
+    - scsi: pm8001: Fix pm80xx_pci_mem_copy() interface
+    - scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
+    - scsi: pm8001: Fix tag values handling
+    - scsi: pm8001: Fix task leak in pm8001_send_abort_all()
+    - scsi: pm8001: Fix tag leaks on error
+    - scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req()
+    - mt76: mt7915: fix injected MPDU transmission to not use HW A-MSDU
+    - mctp: make __mctp_dev_get() take a refcount hold
+    - powerpc/64s/hash: Make hash faults work in NMI context
+    - mt76: mt7615: Fix assigning negative values to unsigned variable
+    - power: supply: axp288_charger: Use acpi_quirk_skip_acpi_ac_and_battery()
+    - power: supply: axp288_fuel_gauge: Use acpi_quirk_skip_acpi_ac_and_battery()
+    - scsi: aha152x: Fix aha152x_setup() __setup handler return value
+    - scsi: hisi_sas: Free irq vectors in order for v3 HW
+    - scsi: hisi_sas: Limit users changing debugfs BIST count value
+    - net/smc: correct settings of RMB window update limit
+    - mips: ralink: fix a refcount leak in ill_acc_of_setup()
+    - iavf: stop leaking iavf_status as "errno" values
+    - macvtap: advertise link netns via netlink
+    - platform/x86: thinkpad_acpi: Add dual fan probe
+    - tuntap: add sanity checks about msg_controllen in sendmsg
+    - Bluetooth: mediatek: fix the conflict between mtk and msft vendor event
+    - Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg}
+    - Bluetooth: use memset avoid memory leaks
+    - bnxt_en: Eliminate unintended link toggle during FW reset
+    - PCI: endpoint: Fix misused goto label
+    - MIPS: fix fortify panic when copying asm exception handlers
+    - powerpc/code-patching: Pre-map patch area
+    - powerpc/64e: Tie PPC_BOOK3E_64 to PPC_FSL_BOOK3E
+    - powerpc/secvar: fix refcount leak in format_show()
+    - scsi: libfc: Fix use after free in fc_exch_abts_resp()
+    - platform/x86: x86-android-tablets: Depend on EFI and SPI
+    - can: isotp: set default value for N_As to 50 micro seconds
+    - can: etas_es58x: es58x_fd_rx_event_msg(): initialize rx_event_msg before
+      calling es58x_check_msg_len()
+    - riscv: Fixed misaligned memory access. Fixed pointer comparison.
+    - net: account alternate interface name memory
+    - net: limit altnames to 64k total
+    - net/mlx5e: Remove overzealous validations in netlink EEPROM query
+    - platform/x86: hp-wmi: Fix SW_TABLET_MODE detection method
+    - platform/x86: hp-wmi: Fix 0x05 error code reported by several WMI calls
+    - net: sfp: add 2500base-X quirk for Lantech SFP module
+    - usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
+    - xen/usb: harden xen_hcd against malicious backends
+    - mt76: fix monitor mode crash with sdio driver
+    - xtensa: fix DTC warning unit_address_format
+    - iwlwifi: mei: fix building iwlmei
+    - MIPS: ingenic: correct unit node address
+    - Bluetooth: Fix use after free in hci_send_acl
+    - netfilter: conntrack: revisit gc autotuning
+    - netlabel: fix out-of-bounds memory accesses
+    - ceph: fix inode reference leakage in ceph_get_snapdir()
+    - ceph: fix memory leak in ceph_readdir when note_last_dentry returns error
+    - lib/Kconfig.debug: add ARCH dependency for FUNCTION_ALIGN option
+    - init/main.c: return 1 from handled __setup() functions
+    - minix: fix bug when opening a file with O_DIRECT
+    - clk: si5341: fix reported clk_rate when output divider is 2
+    - clk: mediatek: Fix memory leaks on probe
+    - staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances
+    - staging: vchiq_core: handle NULL result of find_service_by_handle
+    - phy: amlogic: phy-meson-gxl-usb2: fix shared reset controller use
+    - phy: amlogic: meson8b-usb2: Use dev_err_probe()
+    - phy: amlogic: meson8b-usb2: fix shared reset control use
+    - clk: rockchip: drop CLK_SET_RATE_PARENT from dclk_vop* on rk3568
+    - cpufreq: CPPC: Fix performance/frequency conversion
+    - opp: Expose of-node's name in debugfs
+    - staging: wfx: apply the necessary SDIO quirks for the Silabs WF200
+    - staging: wfx: fix an error handling in wfx_init_common()
+    - w1: w1_therm: fixes w1_seq for ds28ea00 sensors
+    - NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify()
+    - NFSv4: Protect the state recovery thread against direct reclaim
+    - habanalabs: fix possible memory leak in MMU DR fini
+    - habanalabs: reject host map with mmu disabled
+    - habanalabs/gaudi: handle axi errors from NIC engines
+    - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32
+    - clk: ti: Preserve node in ti_dt_clocks_register()
+    - clk: Enforce that disjoints limits are invalid
+    - SUNRPC/xprt: async tasks mustn't block waiting for memory
+    - SUNRPC: remove scheduling boost for "SWAPPER" tasks.
+    - NFS: swap IO handling is slightly different for O_DIRECT IO
+    - NFS: swap-out must always use STABLE writes.
+    - x86: Annotate call_on_stack()
+    - x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy
+    - serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
+    - virtio_console: eliminate anonymous module_init & module_exit
+    - jfs: prevent NULL deref in diFree
+    - SUNRPC: Fix socket waits for write buffer space
+    - NFS: nfsiod should not block forever in mempool_alloc()
+    - NFS: Avoid writeback threads getting stuck in mempool_alloc()
+    - selftests: net: Add tls config dependency for tls selftests
+    - parisc: Fix CPU affinity for Lasi, WAX and Dino chips
+    - parisc: Fix patch code locking and flushing
+    - mm: fix race between MADV_FREE reclaim and blkdev direct IO read
+    - drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire()
+    - Drivers: hv: vmbus: Fix initialization of device object in
+      vmbus_device_register()
+    - Drivers: hv: vmbus: Fix potential crash on module unload
+    - netfilter: bitwise: fix reduce comparisons
+    - Revert "NFSv4: Handle the special Linux file open access mode"
+    - NFSv4: fix open failure with O_ACCMODE flag
+    - scsi: core: scsi_logging: Fix a BUG
+    - scsi: sr: Fix typo in CDROM(CLOSETRAY|EJECT) handling
+    - scsi: core: Fix sbitmap depth in scsi_realloc_sdev_budget_map()
+    - scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
+    - vdpa: mlx5: prevent cvq work from hogging CPU
+    - net: sfc: add missing xdp queue reinitialization
+    - net/tls: fix slab-out-of-bounds bug in decrypt_internal
+    - vrf: fix packet sniffing for traffic originating from ip tunnels
+    - skbuff: fix coalescing for page_pool fragment recycling
+    - Revert "net: dsa: stop updating master MTU from master.c"
+    - ice: Clear default forwarding VSI during VSI release
+    - ice: Fix MAC address setting
+    - mctp: Fix check for dev_hard_header() result
+    - mctp: Use output netdev to allocate skb headroom
+    - net: ipv4: fix route with nexthop object delete warning
+    - net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
+    - drm/imx: imx-ldb: Check for null pointer after calling kmemdup
+    - drm/imx: Fix memory leak in imx_pd_connector_get_modes
+    - drm/imx: dw_hdmi-imx: Fix bailout in error cases of probe
+    - regulator: rtq2134: Fix missing active_discharge_on setting
+    - spi: rpc-if: Fix RPM imbalance in probe error path
+    - regulator: atc260x: Fix missing active_discharge_on setting
+    - arch/arm64: Fix topology initialization for core scheduling
+    - bnxt_en: Synchronize tx when xdp redirects happen on same ring
+    - bnxt_en: reserve space inside receive page for skb_shared_info
+    - bnxt_en: Prevent XDP redirect from running when stopping TX queue
+    - sfc: Do not free an empty page_ring
+    - RDMA/mlx5: Don't remove cache MRs when a delay is needed
+    - RDMA/mlx5: Add a missing update of cache->last_add
+    - IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD
+    - cifs: fix potential race with cifsd thread
+    - IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition
+    - sctp: count singleton chunks in assoc user stats
+    - dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe
+    - ice: Set txq_teid to ICE_INVAL_TEID on ring creation
+    - ice: Do not skip not enabled queues in ice_vc_dis_qs_msg
+    - ipv6: Fix stats accounting in ip6_pkt_drop
+    - ice: synchronize_rcu() when terminating rings
+    - ice: xsk: fix VSI state check in ice_xsk_wakeup()
+    - ice: clear cmd_type_offset_bsz for TX rings
+    - net: openvswitch: don't send internal clone attribute to the userspace.
+    - net: ethernet: mv643xx: Fix over zealous checking of_get_mac_address()
+    - net: openvswitch: fix leak of nested actions
+    - rxrpc: fix a race in rxrpc_exit_net()
+    - net: sfc: fix using uninitialized xdp tx_queue
+    - net: phy: mscc-miim: reject clause 45 register accesses
+    - qede: confirm skb is allocated before using
+    - spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op()
+    - drm/amd/display: Fix for dmub outbox notification enable
+    - drm/amd/display: Remove redundant dsc power gating from init_hw
+    - bpf: Support dual-stack sockets in bpf_tcp_check_syncookie
+    - drbd: Fix five use after free bugs in get_initial_state
+    - scsi: sd: sd_read_cpr() requires VPD pages
+    - scsi: ufs: ufshpb: Fix a NULL check on list iterator
+    - io_uring: nospec index for tags on files update
+    - io_uring: don't touch scm_fp_list after queueing skb
+    - SUNRPC: Handle ENOMEM in call_transmit_status()
+    - SUNRPC: Handle low memory situations in call_status()
+    - SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec()
+    - iommu/omap: Fix regression in probe for NULL pointer dereference
+    - perf unwind: Don't show unwind error messages when augmenting frame pointer
+      stack
+    - perf: arm-spe: Fix perf report --mem-mode
+    - perf tools: Fix perf's libperf_print callback
+    - perf session: Remap buf if there is no space for event
+    - arm64: Add part number for Arm Cortex-A78AE
+    - scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove()
+    - scsi: ufs: ufs-pci: Add support for Intel MTL
+    - Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
+    - mmc: block: Check for errors after write on SPI
+    - mmc: mmci: stm32: correctly check all elements of sg list
+    - mmc: renesas_sdhi: special 4tap settings only apply to HS400
+    - mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is
+      complete
+    - mmc: core: Fixup support for writeback-cache for eMMC and SD
+    - lz4: fix LZ4_decompress_safe_partial read out of bound
+    - highmem: fix checks in __kmap_local_sched_{in,out}
+    - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
+    - mm/mempolicy: fix mpol_new leak in shared_policy_replace
+    - io_uring: don't check req->file in io_fsync_prep()
+    - io_uring: defer splice/tee file validity check until command issue
+    - io_uring: implement compat handling for IORING_REGISTER_IOWQ_AFF
+    - io_uring: fix race between timeout flush and removal
+    - x86/pm: Save the MSR validity status at context setup
+    - x86/speculation: Restore speculation related MSRs during S3 resume
+    - perf/x86/intel: Update the FRONTEND MSR mask on Sapphire Rapids
+    - btrfs: fix qgroup reserve overflow the qgroup limit
+    - btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone
+    - btrfs: remove device item and update super block in the same transaction
+    - btrfs: avoid defragging extents whose next extents are not targets
+    - btrfs: prevent subvol with swapfile from being deleted
+    - spi: core: add dma_map_dev for __spi_unmap_msg()
+    - cifs: force new session setup and tcon for dfs
+    - qed: fix ethtool register dump
+    - arm64: patch_text: Fixup last cpu should be master
+    - RDMA/hfi1: Fix use-after-free bug for mm struct
+    - drbd: fix an invalid memory access caused by incorrect use of list iterator
+    - gpio: Restrict usage of GPIO chip irq members before initialization
+    - x86/msi: Fix msi message data shadow struct
+    - x86/mm/tlb: Revert retpoline avoidance approach
+    - perf/x86/intel: Don't extend the pseudo-encoding to GP counters
+    - ata: sata_dwc_460ex: Fix crash due to OOB write
+    - perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
+    - perf/core: Inherit event_caps
+    - irqchip/gic-v3: Fix GICR_CTLR.RWP polling
+    - fbdev: Fix unregistering of framebuffers without device
+    - amd/display: set backlight only if required
+    - drm/panel: ili9341: fix optional regulator handling
+    - drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw
+    - drm/amdgpu/display: change pipe policy for DCN 2.1
+    - drm/amdgpu/smu10: fix SoC/fclk units in auto mode
+    - drm/amdgpu/vcn: Fix the register setting for vcn1
+    - drm/nouveau/pmu: Add missing callbacks for Tegra devices
+    - drm/amdkfd: Create file descriptor after client is added to smi_clients list
+    - drm/amdgpu: don't use BACO for reset in S3
+    - SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
+    - Revert "ACPI: processor: idle: Only flush cache on entering C3"
+    - drm/amdkfd: Fix variable set but not used warning
+    - net/smc: send directly on setting TCP_NODELAY
+    - Revert "selftests: net: Add tls config dependency for tls selftests"
+    - bpf: Make remote_port field in struct bpf_sk_lookup 16-bit wide
+    - selftests/bpf: Fix u8 narrow load checks for bpf_sk_lookup remote_port
+    - bpf: Treat bpf_sk_lookup remote_port as a 2-byte field
+    - perf build: Don't use -ffat-lto-objects in the python feature test when
+      building with clang-13
+    - perf python: Fix probing for some clang command line options
+    - tools build: Filter out options and warnings not supported by clang
+    - tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
+    - dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
+    - KVM: avoid NULL pointer dereference in kvm_dirty_ring_push
+    - Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb()
+    - powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit
+    - Revert "powerpc: Set max_mapnr correctly"
+    - x86/bug: Prevent shadowing in __WARN_FLAGS
+    - objtool: Fix SLS validation for kcov tail-call replacement
+    - sched/core: Fix forceidle balancing
+    - sched: Teach the forced-newidle balancer about CPU affinity limitation.
+    - x86,static_call: Fix __static_call_return0 for i386
+    - x86/extable: Prefer local labels in .set directives
+    - irqchip/gic-v4: Wait for GICR_VPENDBASER.Dirty to clear before descheduling
+    - powerpc/64: Fix build failure with allyesconfig in book3s_64_entry.S
+    - irqchip/gic, gic-v3: Prevent GSI to SGI translations
+    - mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
+    - static_call: Don't make __static_call_return0 static
+    - io_uring: move read/write file prep state into actual opcode handler
+    - io_uring: propagate issue_flags state down to file assignment
+    - io_uring: defer file assignment
+    - io_uring: drop the old style inflight file tracking
+    - Linux 5.17.3
+
+  * Jammy update: v5.17.2 upstream stable release Edit (LP: #1968984)
+    - Revert "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
+    - USB: serial: pl2303: add IBM device IDs
+    - dt-bindings: usb: hcd: correct usb-device path
+    - USB: serial: pl2303: fix GS type detection
+    - USB: serial: simple: add Nokia phone driver
+    - mm: kfence: fix missing objcg housekeeping for SLAB
+    - locking/lockdep: Avoid potential access of invalid memory in lock_class
+    - drm/amdgpu: move PX checking into amdgpu_device_ip_early_init
+    - drm/amdgpu: only check for _PR3 on dGPUs
+    - iommu/iova: Improve 32-bit free space estimate
+    - block: flush plug based on hardware and software queue order
+    - block: ensure plug merging checks the correct queue at least once
+    - usb: typec: tipd: Forward plug orientation to typec subsystem
+    - USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
+    - xhci: fix garbage USBSTS being logged in some cases
+    - xhci: fix runtime PM imbalance in USB2 resume
+    - xhci: make xhci_handshake timeout for xhci_reset() adjustable
+    - xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx()
+    - mei: me: disable driver on the ign firmware
+    - mei: me: add Alder Lake N device id.
+    - mei: avoid iterator usage outside of list_for_each_entry
+    - bus: mhi: pci_generic: Add mru_default for Quectel EM1xx series
+    - bus: mhi: Fix pm_state conversion to string
+    - bus: mhi: Fix MHI DMA structure endianness
+    - docs: sphinx/requirements: Limit jinja2<3.1
+    - coresight: Fix TRCCONFIGR.QE sysfs interface
+    - coresight: syscfg: Fix memleak on registration failure in
+      cscfg_create_device
+    - dt-bindings: iio: adc: zynqmp_ams: Add clock entry
+    - iio: adc: xilinx-ams: Fix single channel switching sequence
+    - iio: accel: mma8452: use the correct logic to get mma8452_data
+    - iio: adc: aspeed: Add divider flag to fix incorrect voltage reading.
+    - iio: imu: st_lsm6dsx: use dev_to_iio_dev() to get iio_dev struct
+    - iio: afe: rescale: use s64 for temporary scale calculations
+    - iio: adc: xilinx-ams: Fixed missing PS channels
+    - iio: adc: xilinx-ams: Fixed wrong sequencer register settings
+    - iio: inkern: apply consumer scale on IIO_VAL_INT cases
+    - iio: inkern: apply consumer scale when no channel scale is available
+    - iio: inkern: make a best effort on offset calculation
+    - greybus: svc: fix an error handling bug in gb_svc_hello()
+    - clk: rockchip: re-add rational best approximation algorithm to the
+      fractional divider
+    - clk: uniphier: Fix fixed-rate initialization
+    - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
+    - cifs: truncate the inode and mapping when we simulate fcollapse
+    - cifs: fix handlecache and multiuser
+    - cifs: we do not need a spinlock around the tree access during umount
+    - KEYS: fix length validation in keyctl_pkey_params_get_2()
+    - KEYS: asymmetric: enforce that sig algo matches key algo
+    - KEYS: asymmetric: properly validate hash_algo and encoding
+    - Documentation: add link to stable release candidate tree
+    - Documentation: update stable tree link
+    - firmware: stratix10-svc: add missing callback parameter on RSU
+    - firmware: sysfb: fix platform-device leak in error path
+    - HID: intel-ish-hid: Use dma_alloc_coherent for firmware update
+    - SUNRPC: avoid race between mod_timer() and del_timer_sync()
+    - SUNRPC: Do not dereference non-socket transports in sysfs
+    - NFS: NFSv2/v3 clients should never be setting NFS_CAP_XATTR
+    - NFSD: prevent underflow in nfssvc_decode_writeargs()
+    - NFSD: prevent integer overflow on 32 bit systems
+    - f2fs: fix to unlock page correctly in error path of is_alive()
+    - f2fs: quota: fix loop condition at f2fs_quota_sync()
+    - f2fs: fix to do sanity check on .cp_pack_total_block_count
+    - remoteproc: Fix count check in rproc_coredump_write()
+    - mm/mlock: fix two bugs in user_shm_lock()
+    - pinctrl: ingenic: Fix regmap on X series SoCs
+    - pinctrl: samsung: drop pin banks references on error paths
+    - net: bnxt_ptp: fix compilation error
+    - spi: mxic: Fix the transmit path
+    - mtd: spi-nor: Skip erase logic when SPI_NOR_NO_ERASE is set
+    - mtd: rawnand: protect access to rawnand devices while in suspend
+    - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
+    - can: m_can: m_can_tx_handler(): fix use after free of skb
+    - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error
+      path
+    - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
+    - jffs2: fix memory leak in jffs2_do_mount_fs
+    - jffs2: fix memory leak in jffs2_scan_medium
+    - mm: fs: fix lru_cache_disabled race in bh_lru
+    - mm: don't skip swap entry even if zap_details specified
+    - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
+    - mm: invalidate hwpoison page cache page in fault path
+    - mempolicy: mbind_range() set_policy() after vma_merge()
+    - scsi: core: sd: Add silence_suspend flag to suppress some PM messages
+    - scsi: ufs: Fix runtime PM messages never-ending cycle
+    - scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters
+    - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
+    - qed: display VF trust config
+    - qed: validate and restrict untrusted VFs vlan promisc mode
+    - riscv: dts: canaan: Fix SPI3 bus width
+    - riscv: Fix fill_callchain return value
+    - riscv: Increase stack size under KASAN
+    - RISC-V: Declare per cpu boot data as static
+    - Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
+    - cifs: do not skip link targets when an I/O fails
+    - cifs: fix incorrect use of list iterator after the loop
+    - cifs: prevent bad output lengths in smb2_ioctl_query_info()
+    - cifs: fix NULL ptr dereference in smb2_ioctl_query_info()
+    - ALSA: cs4236: fix an incorrect NULL check on list iterator
+    - ALSA: hda: Avoid unsol event during RPM suspending
+    - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
+    - ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020
+    - rtc: mc146818-lib: fix locking in mc146818_set_time
+    - rtc: pl031: fix rtc features null pointer dereference
+    - io_uring: ensure that fsnotify is always called
+    - ocfs2: fix crash when mount with quota enabled
+    - drm/simpledrm: Add "panel orientation" property on non-upright mounted LCD
+      panels
+    - mm: madvise: skip unmapped vma holes passed to process_madvise
+    - mm: madvise: return correct bytes advised with process_madvise
+    - Revert "mm: madvise: skip unmapped vma holes passed to process_madvise"
+    - mm,hwpoison: unmap poisoned page before invalidation
+    - mm: only re-generate demotion targets when a numa node changes its N_CPU
+      state
+    - mm/kmemleak: reset tag when compare object pointer
+    - dm stats: fix too short end duration_ns when using precise_timestamps
+    - dm: fix use-after-free in dm_cleanup_zoned_dev()
+    - dm: interlock pending dm_io and dm_wait_for_bios_completion
+    - dm: fix double accounting of flush with data
+    - dm integrity: set journal entry unused when shrinking device
+    - tracing: Have trace event string test handle zero length strings
+    - drbd: fix potential silent data corruption
+    - can: isotp: sanitize CAN ID checks in isotp_bind()
+    - PCI: fu740: Force 2.5GT/s for initial device probe
+    - arm64: signal: nofpsimd: Do not allocate fp/simd context when not available
+    - arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory
+      zones
+    - arm64: dts: qcom: sm8250: Fix MSI IRQ for PCIe1 and PCIe2
+    - arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-am64: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-j721s2: Fix gic-v3 compatible regs
+    - ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
+    - mmc: core: use sysfs_emit() instead of sprintf()
+    - Revert "ACPI: Pass the same capabilities to the _OSC regardless of the query
+      flag"
+    - ACPI: properties: Consistently return -ENOENT if there are no more
+      references
+    - coredump: Also dump first pages of non-executable ELF libraries
+    - ext4: fix ext4_fc_stats trace point
+    - ext4: fix fs corruption when tring to remove a non-empty directory with IO
+      error
+    - ext4: make mb_optimize_scan option work with set/unset mount cmd
+    - ext4: make mb_optimize_scan performance mount option work with extents
+    - samples/landlock: Fix path_list memory leak
+    - landlock: Use square brackets around "landlock-ruleset"
+    - mailbox: tegra-hsp: Flush whole channel
+    - btrfs: zoned: put block group after final usage
+    - block: fix rq-qos breakage from skipping rq_qos_done_bio()
+    - block: limit request dispatch loop duration
+    - block: don't merge across cgroup boundaries if blkcg is enabled
+    - drm/edid: check basic audio support on CEA extension block
+    - fbdev: Hot-unplug firmware fb devices on forced removal
+    - video: fbdev: sm712fb: Fix crash in smtcfb_read()
+    - video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
+    - rfkill: make new event layout opt-in
+    - ARM: dts: at91: sama7g5: Remove unused properties in i2c nodes
+    - ARM: dts: at91: sama5d2: Fix PMERRLOC resource size
+    - ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
+    - ARM: dts: exynos: add missing HDMI supplies on SMDK5250
+    - ARM: dts: exynos: add missing HDMI supplies on SMDK5420
+    - mgag200 fix memmapsl configuration in GCTL6 register
+    - carl9170: fix missing bit-wise or operator for tx_params
+    - pstore: Don't use semaphores in always-atomic-context code
+    - thermal: int340x: Increase bitmap size
+    - lib/raid6/test: fix multiple definition linking error
+    - exec: Force single empty string when argv is empty
+    - crypto: rsa-pkcs1pad - only allow with rsa
+    - crypto: rsa-pkcs1pad - correctly get hash from source scatterlist
+    - crypto: rsa-pkcs1pad - restore signature length check
+    - crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete()
+    - bcache: fixup multiple threads crash
+    - PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove()
+    - DEC: Limit PMAX memory probing to R3k systems
+    - media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC
+    - media: omap3isp: Use struct_group() for memcpy() region
+    - media: venus: vdec: fixed possible memory leak issue
+    - media: venus: hfi_cmds: List HDR10 property as unsupported for v1 and v3
+    - media: venus: venc: Fix h264 8x8 transform control
+    - media: davinci: vpif: fix unbalanced runtime PM get
+    - media: davinci: vpif: fix unbalanced runtime PM enable
+    - media: davinci: vpif: fix use-after-free on driver unbind
+    - mips: Always permit to build u-boot images
+    - btrfs: zoned: mark relocation as writing
+    - btrfs: extend locking to all space_info members accesses
+    - btrfs: verify the tranisd of the to-be-written dirty extent buffer
+    - xtensa: define update_mmu_tlb function
+    - xtensa: fix stop_machine_cpuslocked call in patch_text
+    - xtensa: fix xtensa_wsr always writing 0
+    - KVM: s390x: fix SCK locking
+    - drm/syncobj: flatten dma_fence_chains on transfer
+    - drm/nouveau/backlight: Fix LVDS backlight detection on some laptops
+    - drm/nouveau/backlight: Just set all backlight types as RAW
+    - drm/fb-helper: Mark screen buffers in system memory with FBINFO_VIRTFB
+    - brcmfmac: firmware: Allocate space for default boardrev in nvram
+    - brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path
+    - brcmfmac: pcie: Declare missing firmware files in pcie.c
+    - brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
+    - brcmfmac: pcie: Fix crashes due to early IRQs
+    - drm/i915/opregion: check port number bounds for SWSCI display power state
+    - drm/i915/gem: add missing boundary check in vm_access
+    - PCI: imx6: Allow to probe when dw_pcie_wait_for_link() fails
+    - PCI: pciehp: Clear cmd_busy bit in polling mode
+    - PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup"
+    - PCI: xgene: Revert "PCI: xgene: Fix IB window setup"
+    - regulator: qcom_smd: fix for_each_child.cocci warnings
+    - selinux: access superblock_security_struct in LSM blob way
+    - selinux: check return value of sel_make_avc_files
+    - crypto: ccp - Ensure psp_ret is always init'd in
+      __sev_platform_init_locked()
+    - crypto: qat - fix a signedness bug in get_service_enabled()
+    - hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER
+    - crypto: sun8i-ss - really disable hash on A80
+    - crypto: kdf - Select hmac in addition to sha256
+    - crypto: qat - fix access to PFVF interrupt registers for GEN4
+    - crypto: authenc - Fix sleep in atomic context in decrypt_tail
+    - crypto: octeontx2 - select CONFIG_NET_DEVLINK
+    - crypto: mxs-dcp - Fix scatterlist processing
+    - selinux: Fix selinux_sb_mnt_opts_compat()
+    - thermal: int340x: Check for NULL after calling kmemdup()
+    - crypto: octeontx2 - remove CONFIG_DM_CRYPT check
+    - spi: tegra114: Add missing IRQ check in tegra_spi_probe
+    - spi: tegra210-quad: Fix missin IRQ check in tegra_qspi_probe
+    - perf: MARVELL_CN10K_TAD_PMU should depend on ARCH_THUNDER
+    - selftests/sgx: Fix NULL-pointer-dereference upon early test failure
+    - selftests/sgx: Do not attempt enclave build without valid enclave
+    - selftests/sgx: Ensure enclave data available during debug print
+    - stack: Constrain and fix stack offset randomization with Clang builds
+    - arm64/mm: avoid fixmap race condition when create pud mapping
+    - security: add sctp_assoc_established hook
+    - blk-cgroup: set blkg iostat after percpu stat aggregation
+    - selftests/x86: Add validity check and allow field splitting
+    - selftests/sgx: Treat CC as one argument
+    - crypto: rockchip - ECB does not need IV
+    - block: update io_ticks when io hang
+    - audit: log AUDIT_TIME_* records only from rules
+    - EVM: fix the evm= __setup handler return value
+    - crypto: ccree - don't attempt 0 len DMA mappings
+    - crypto: hisilicon/sec - fix the aead software fallback for engine
+    - spi: pxa2xx-pci: Balance reference count for PCI DMA device
+    - hwmon: (pmbus) Add mutex to regulator ops
+    - hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
+    - nvme: cleanup __nvme_check_ids
+    - nvme: fix the check for duplicate unique identifiers
+    - block: don't delete queue kobject before its children
+    - PM: hibernate: fix __setup handler error handling
+    - PM: suspend: fix return value of __setup handler
+    - spi: spi-zynqmp-gqspi: Handle error for dma_set_mask
+    - hwrng: atmel - disable trng on failure path
+    - crypto: sun8i-ss - call finalize with bh disabled
+    - crypto: sun8i-ce - call finalize with bh disabled
+    - crypto: amlogic - call finalize with bh disabled
+    - crypto: gemini - call finalize with bh disabled
+    - crypto: vmx - add missing dependencies
+    - clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix
+    - clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts
+    - clocksource/drivers/timer-microchip-pit64b: Use notrace
+    - clocksource/drivers/timer-of: Check return value of of_iomap in
+      timer_of_base_init()
+    - arm64: prevent instrumentation of bp hardening callbacks
+    - perf/arm-cmn: Hide XP PUB events for CMN-600
+    - perf/arm-cmn: Update watchpoint format
+    - KEYS: trusted: Fix trusted key backends when building as module
+    - KEYS: trusted: Avoid calling null function trusted_key_exit
+    - ACPI: APEI: fix return value of __setup handlers
+    - crypto: ccp - ccp_dmaengine_unregister release dma channels
+    - crypto: ccree - Fix use after free in cc_cipher_exit()
+    - crypto: qat - fix initialization of pfvf cap_msg structures
+    - crypto: qat - fix initialization of pfvf rts_map_msg structures
+    - hwrng: nomadik - Change clk_disable to clk_disable_unprepare
+    - hwmon: (pmbus) Add Vin unit off handling
+    - clocksource: acpi_pm: fix return value of __setup handler
+    - io_uring: don't check unrelated req->open.how in accept request
+    - io_uring: terminate manual loop iterator loop correctly for non-vecs
+    - watch_queue: Fix NULL dereference in error cleanup
+    - watch_queue: Actually free the watch
+    - f2fs: fix to enable ATGC correctly via gc_idle sysfs interface
+    - sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
+    - sched/core: Export pelt_thermal_tp
+    - sched/sugov: Ignore 'busy' filter when rq is capped by uclamp_max
+    - sched/uclamp: Fix iowait boost escaping uclamp restriction
+    - rseq: Remove broken uapi field layout on 32-bit little endian
+    - perf/core: Fix address filter parser for multiple filters
+    - perf/x86/intel/pt: Fix address filter config for 32-bit kernel
+    - sched/fair: Improve consistency of allowed NUMA balance calculations
+    - f2fs: fix missing free nid in f2fs_handle_failed_inode
+    - ext4: fix remount with 'abort' option
+    - nfsd: more robust allocation failure handling in nfsd_file_cache_init
+    - sched/cpuacct: Fix charge percpu cpuusage
+    - sched/rt: Plug rt_mutex_setprio() vs push_rt_task() race
+    - f2fs: fix to avoid potential deadlock
+    - btrfs: fix unexpected error path when reflinking an inline extent
+    - iomap: Fix iomap_invalidatepage tracepoint
+    - fs: erofs: add sanity check for kobject in erofs_unregister_sysfs
+    - f2fs: fix compressed file start atomic write may cause data corruption
+    - cifs: use a different reconnect helper for non-cifsd threads
+    - selftests, x86: fix how check_cc.sh is being invoked
+    - drivers/base/memory: add memory block to memory group after registration
+      succeeded
+    - kunit: make kunit_test_timeout compatible with comment
+    - pinctrl: samsung: Remove EINT handler for Exynos850 ALIVE and CMGP gpios
+    - media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size
+    - media: camss: csid-170: fix non-10bit formats
+    - media: camss: csid-170: don't enable unused irqs
+    - media: camss: csid-170: set the right HALT_CMD when disabled
+    - media: camss: vfe-170: fix "VFE halt timeout" error
+    - media: staging: media: imx: imx7-mipi-csis: Make subdev name unique
+    - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
+    - media: mtk-vcodec: potential dereference of null pointer
+    - media: imx: imx8mq-mipi-csi2: remove wrong irq config write operation
+    - media: imx: imx8mq-mipi_csi2: fix system resume
+    - media: bttv: fix WARNING regression on tunerless devices
+    - media: atmel: atmel-sama7g5-isc: fix ispck leftover
+    - ASoC: sh: rz-ssi: Drop calling rz_ssi_pio_recv() recursively
+    - ASoC: codecs: Check for error pointer after calling devm_regmap_init_mmio
+    - ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting
+    - ASoC: simple-card-utils: Set sysclk on all components
+    - memory: tegra20-emc: Correct memory device mask
+    - media: coda: Fix missing put_device() call in coda_get_vdoa_data
+    - media: meson: vdec: potential dereference of null pointer
+    - media: hantro: Fix overfill bottom register field name
+    - media: ov6650: Fix set format try processing path
+    - media: v4l: Avoid unaligned access warnings when printing 4cc modifiers
+    - media: ov5648: Don't pack controls struct
+    - media: ov2740: identify module after subdev initialisation
+    - media: aspeed: Correct value for h-total-pixels
+    - video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to
+      avoid black screen
+    - video: fbdev: controlfb: Fix COMPILE_TEST build
+    - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
+    - video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe()
+    - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
+    - ARM: dts: Fix OpenBMC flash layout label addresses
+    - ASoC: max98927: add missing header file
+    - arm64: dts: qcom: sc7280: Fix gmu unit address
+    - firmware: qcom: scm: Remove reassignment to desc following initializer
+    - ARM: dts: qcom: ipq4019: fix sleep clock
+    - soc: qcom: rpmpd: Check for null return of devm_kcalloc
+    - soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem
+    - soc: qcom: aoss: Fix missing put_device call in qmp_get
+    - soc: qcom: aoss: remove spurious IRQF_ONESHOT flags
+    - arm64: dts: qcom: sdm845: fix microphone bias properties and values
+    - arm64: dts: qcom: sm8250: fix PCIe bindings to follow schema
+    - arm64: dts: qcom: msm8916-j5: Fix typo
+    - arm64: dts: broadcom: bcm4908: use proper TWD binding
+    - arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc
+    - arm64: dts: qcom: sm8350: Correct TCS configuration for apps rsc
+    - arm64: dts: qcom: sm8450: Update cpuidle states parameters
+    - arm64: dts: qcom: msm8994: Provide missing "xo_board" and "sleep_clk" to GCC
+    - arm64: dts: qcom: ipq6018: fix usb reference period
+    - firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not
+      defined
+    - soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
+    - cpuidle: qcom-spm: Check if any CPU is managed by SPM
+    - ARM: dts: sun8i: v3s: Move the csi1 block to follow address order
+    - ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
+    - vsprintf: Fix potential unaligned access
+    - ARM: dts: qcom: sdx55: Fix the address used for PCIe EP local addr space
+    - ARM: dts: imx: Add missing LVDS decoder on M53Menlo
+    - media: mexon-ge2d: fixup frames size in registers
+    - media: video/hdmi: handle short reads of hdmi info frame.
+    - media: ti-vpe: cal: Fix a NULL pointer dereference in
+      cal_ctx_v4l2_init_formats()
+    - media: em28xx: initialize refcount before kref_get
+    - media: uapi: Init VP9 stateless decode params
+    - media: usb: go7007: s2250-board: fix leak in probe()
+    - media: cedrus: H265: Fix neighbour info buffer size
+    - media: cedrus: h264: Fix neighbour info buffer size
+    - arm64: dts: ti: k3-j721s2-mcu-wakeup: Fix the interrupt-parent for
+      wkup_gpioX instances
+    - ASoC: codecs: rx-macro: fix accessing compander for aux
+    - ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type
+    - ASoC: codecs: va-macro: fix accessing array out of bounds for enum type
+    - ASoC: codecs: wc938x: fix accessing array out of bounds for enum type
+    - ASoC: codecs: wcd938x: fix kcontrol max values
+    - ASoC: codecs: wcd934x: fix kcontrol max values
+    - ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put
+    - media: v4l2-core: Initialize h264 scaling matrix
+    - media: hantro: sunxi: Fix VP9 steps
+    - media: ov5640: Fix set format, v4l2_mbus_pixelcode not updated
+    - selftests: vm: remove dependecy from internal kernel macros
+    - selftests/lkdtm: Add UBSAN config
+    - vsprintf: Fix %pK with kptr_restrict == 0
+    - uaccess: fix nios2 and microblaze get_user_8()
+    - ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp()
+    - ASoC: acp: check the return value of devm_kzalloc() in
+      acp_legacy_dai_links_create()
+    - soc: mediatek: pm-domains: Add wakeup capacity support in power domain
+    - mmc: sdhci_am654: Fix the driver data of AM64 SoC
+    - ASoC: ti: davinci-i2s: Add check for clk_enable()
+    - ALSA: spi: Add check for clk_enable()
+    - arm64: dts: ns2: Fix spi-cpol and spi-cpha property
+    - arm64: dts: broadcom: Fix sata nodename
+    - printk: fix return value of printk.devkmsg __setup handler
+    - ASoC: mxs-saif: Handle errors for clk_enable
+    - ASoC: atmel_ssc_dai: Handle errors for clk_enable
+    - ASoC: dwc-i2s: Handle errors for clk_enable
+    - ASoC: soc-compress: prevent the potentially use of null pointer
+    - media: i2c: Fix pixel array positions in ov8865
+    - memory: emif: Add check for setup_interrupts
+    - memory: emif: check the pointer temp in get_device_details()
+    - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
+    - arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly
+    - m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined
+    - media: stk1160: If start stream fails, return buffers with
+      VB2_BUF_STATE_QUEUED
+    - media: vidtv: Check for null return of vzalloc
+    - ASoC: cs35l41: Fix GPIO2 configuration
+    - ASoC: cs35l41: Fix max number of TX channels
+    - ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
+    - ASoC: wm8350: Handle error for wm8350_register_irq
+    - ASoC: fsi: Add check for clk_enable
+    - video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
+    - media: saa7134: fix incorrect use to determine if list is empty
+    - ivtv: fix incorrect device_caps for ivtvfb
+    - ASoC: atmel: Fix error handling in snd_proto_probe
+    - ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in
+      rockchip_i2s_probe
+    - ASoC: SOF: Add missing of_node_put() in imx8m_probe
+    - ASoC: mediatek: mt8192-mt6359: Fix error handling in mt8192_mt6359_dev_probe
+    - ASoC: rk817: Fix missing clk_disable_unprepare() in rk817_platform_probe
+    - ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
+    - ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
+    - ASoC: fsl_spdif: Disable TX clock when stop
+    - ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
+    - ASoC: SOF: Intel: enable DMI L1 for playback streams
+    - ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in
+      msm8916_wcd_digital_probe
+    - mmc: davinci_mmc: Handle error for clk_enable
+    - rtla/osnoise: Fix osnoise hist stop tracing message
+    - ASoC: rockchip: Fix PM usage reference of rockchip_i2s_tdm_resume
+    - ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe
+    - ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe
+    - ASoC: mediatek: mt8195: Fix error handling in
+      mt8195_mt6359_rt1019_rt5682_dev_probe
+    - ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data
+    - ASoC: amd: Fix reference to PCM buffer address
+    - ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS
+    - ARM: configs: multi_v5_defconfig: re-enable DRM_PANEL and FB_xxx
+    - drm/bridge: sn65dsi83: Fix an error handling path in sn65dsi83_probe()
+    - drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops
+    - drm/meson: Fix error handling when afbcd.ops->init fails
+    - drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
+    - drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe
+    - drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe
+    - drm: bridge: adv7511: Fix ADV7535 HPD enablement
+    - ath11k: add missing of_node_put() to avoid leak
+    - ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
+    - drm/v3d/v3d_drv: Check for error num after setting mask
+    - Bluetooth: hci_sync: unlock on error in hci_inquiry_result_with_rssi_evt()
+    - ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855
+    - drm/panfrost: Check for error num after setting mask
+    - bpftool: Fix error check when calling hashmap__new()
+    - libbpf: Fix possible NULL pointer dereference when destroying skeleton
+    - bpftool: Only set obj->skeleton on complete success
+    - ath11k: fix error code in ath11k_qmi_assign_target_mem_chunk()
+    - udmabuf: validate ubuf->pagecount
+    - bpf: Fix UAF due to race between btf_try_get_module and load_module
+    - drm/selftests/test-drm_dp_mst_helper: Fix memory leak in
+      sideband_msg_req_encode_decode
+    - drm/locking: fix drm_modeset_acquire_ctx kernel-doc
+    - selftests: bpf: Fix bind on used port
+    - Bluetooth: btintel: Fix WBS setting for Intel legacy ROM products
+    - Bluetooth: hci_serdev: call init_rwsem() before p->open()
+    - Bluetooth: mt7921s: fix firmware coredump retrieve
+    - Bluetooth: mt7921s: fix bus hang with wrong privilege
+    - Bluetooth: btmtksdio: refactor btmtksdio_runtime_[suspend|resume]()
+    - Bluetooth: mt7921s: fix btmtksdio_[drv|fw]_pmctrl()
+    - Bluetooth: btmtksdio: mask out interrupt status
+    - mtd: onenand: Check for error irq
+    - mtd: rawnand: gpmi: fix controller timings setting
+    - selftests, xsk: Fix rx_full stats test
+    - drm/edid: Don't clear formats if using deep color
+    - drm/edid: Split deep color modes between RGB and YUV444
+    - ionic: fix type complaint in ionic_dev_cmd_clean()
+    - ionic: start watchdog after all is setup
+    - ionic: Don't send reset commands if FW isn't running
+    - ionic: fix up printing of timeout error
+    - ionic: Correctly print AQ errors if completions aren't received
+    - net: dsa: Move VLAN filtering syncing out of dsa_switch_bridge_leave
+    - net: dsa: Avoid cross-chip syncing of VLAN filtering
+    - Bluetooth: hci_event: Fix HCI_EV_VENDOR max_len
+    - drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl()
+    - drm/amd/display: Call dc_stream_release for remove link enc assignment
+    - drm/amd/display: Fix a NULL pointer dereference in
+      amdgpu_dm_connector_add_common_modes()
+    - drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function
+    - net: phy: at803x: move page selection fix to config_init
+    - selftests/bpf/test_xdp_redirect_multi: use temp netns for testing
+    - ath9k_htc: fix uninit value bugs
+    - ath11k: set WMI_PEER_40MHZ while peer assoc for 6 GHz
+    - RDMA/core: Set MR type in ib_reg_user_mr
+    - KVM: PPC: Fix vmx/vsx mixup in mmio emulation
+    - selftests/net: timestamping: Fix bind_phc check
+    - rtw88: check for validity before using a pointer
+    - rtw88: fix idle mode flow for hw scan
+    - rtw88: fix memory overrun and memory leak during hw_scan
+    - drm/bridge: lt9611: Fix an error handling path in lt9611_probe()
+    - i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - i40e: respect metadata on XSK Rx to skb
+    - ice: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - ice: respect metadata on XSK Rx to skb
+    - igc: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - ixgbe: pass bi->xdp to ixgbe_construct_skb_zc() directly
+    - ixgbe: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - ixgbe: respect metadata on XSK Rx to skb
+    - power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
+    - ray_cs: Check ioremap return value
+    - powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch
+    - KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init
+    - powerpc/perf: Don't use perf_hw_context for trace IMC PMU
+    - mt76: connac: fix sta_rec_wtbl tag len
+    - mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta
+      mode
+    - mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv
+    - mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error
+    - mt76: mt7921: set EDCA parameters with the MCU CE command
+    - mt76: mt7921: do not always disable fw runtime-pm
+    - mt76: mt7921: fix a leftover race in runtime-pm
+    - mt76: mt7615: fix a leftover race in runtime-pm
+    - mt76: mt7915: fix ht mcs in mt7915_mac_add_txs_skb()
+    - mt76: mt7921: fix ht mcs in mt7921_mac_add_txs_skb()
+    - mt76: mt7921s: fix mt7921s_mcu_[fw|drv]_pmctrl
+    - mt76: mt7921e: fix possible probe failure after reboot
+    - mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update
+    - mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update
+    - mt76: mt7915: fix possible memory leak in mt7915_mcu_add_sta
+    - mt76: mt7921s: fix a possible memory leak in mt7921_load_patch
+    - mt76: mt7915: fix mcs_map in mt7915_mcu_set_sta_he_mcs()
+    - mt76: mt7915: fix the nss setting in bitrates
+    - ptp: unregister virtual clocks when unregistering physical clock.
+    - net: dsa: mv88e6xxx: Enable port policy support on 6097
+    - bpf: Fix a btf decl_tag bug when tagging a function
+    - mac80211: limit bandwidth in HE capabilities
+    - scripts/dtc: Call pkg-config POSIXly correct
+    - livepatch: Fix build failure on 32 bits processors
+    - net: asix: add proper error handling of usb read errors
+    - i2c: bcm2835: Fix the error handling in 'bcm2835_i2c_probe()'
+    - mtd: mchp23k256: Add SPI ID table
+    - mtd: mchp48l640: Add SPI ID table
+    - selftests/bpf: Extract syscall wrapper
+    - selftests/bpf: Use "__se_" prefix on architectures without syscall wrapper
+    - igc: avoid kernel warning when changing RX ring parameters
+    - igb: refactor XDP registration
+    - drm/amdgpu: Don't offset by 2 in FRU EEPROM
+    - PCI: aardvark: Fix reading MSI interrupt number
+    - PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge
+    - RDMA/rxe: Check the last packet by RXE_END_MASK
+    - libbpf: Fix signedness bug in btf_dump_array_data()
+    - libbpf: Fix riscv register names
+    - cxl/core: Fix cxl_probe_component_regs() error message
+    - tools/testing/cxl: Fix root port to host bridge assignment
+    - cxl/regs: Fix size of CXL Capability Header Register
+    - Netvsc: Call hv_unmap_memory() in the netvsc_device_remove()
+    - net:enetc: allocate CBD ring data memory using DMA coherent methods
+    - libbpf: Fix compilation warning due to mismatched printf format
+    - rtw88: fix use after free in rtw_hw_scan_update_probe_req()
+    - drm/bridge: dw-hdmi: use safe format when first in bridge chain
+    - power: supply: ab8500: Swap max and overvoltage
+    - libbpf: Fix libbpf.map inheritance chain for LIBBPF_0.7.0
+    - libbpf: Use dynamically allocated buffer when receiving netlink messages
+    - power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
+    - HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
+    - iommu/ipmmu-vmsa: Check for error num after setting mask
+    - drm/bridge: anx7625: Fix overflow issue on reading EDID
+    - ath11k: fix uninitialized rate_idx in ath11k_dp_tx_update_txcompl()
+    - i2c: pasemi: Drop I2C classes from platform driver variant
+    - bpftool: Fix the error when lookup in no-btf maps
+    - drm/amd/pm: enable pm sysfs write for one VF mode
+    - drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug
+    - bpftool: Fix pretty print dump for maps without BTF loaded
+    - libbpf: Fix memleak in libbpf_netlink_recv()
+    - IB/cma: Allow XRC INI QPs to set their local ACK timeout
+    - cxl/core/port: Rename bus.c to port.c
+    - cxl/port: Hold port reference until decoder release
+    - dax: make sure inodes are flushed before destroy cache
+    - selftests: mptcp: add csum mib check for mptcp_connect
+    - iwlwifi: mvm: Don't call iwl_mvm_sta_from_mac80211() with NULL sta
+    - iwlwifi: mvm: don't iterate unadded vifs when handling FW SMPS req
+    - iwlwifi: mvm: align locking in D3 test debugfs
+    - iwlwifi: yoyo: remove DBGI_SRAM address reset writing
+    - iwlwifi: yoyo: Avoid using dram data if allocation failed
+    - iwlwifi: mvm: fix off by one in iwl_mvm_stat_iterator_all_macs()
+    - iwlwifi: Fix -EIO error code that is never returned
+    - iwlwifi: mvm: Fix an error code in iwl_mvm_up()
+    - mtd: rawnand: pl353: Set the nand chip node as the flash node
+    - drm/msm/dp: do not initialize phy until plugin interrupt received
+    - drm/msm/dp: populate connector of struct dp_panel
+    - drm/msm/dp: stop link training after link training 2 failed
+    - drm/msm/dp: always add fail-safe mode into connector mode list
+    - drm/msm/dsi: Use "ref" fw clock instead of global name for VCO parent
+    - drm/msm/dsi/phy: fix 7nm v4.0 settings for C-PHY mode
+    - drm/msm/dpu: add DSPP blocks teardown
+    - drm/msm/dpu: fix dp audio condition
+    - drm/msm/dpu: remove msm_dp cached in dpu_encoder_virt
+    - drm/msm/dp: fix panel bridge attachment
+    - i40e: remove dead stores on XSK hotpath
+    - ath11k: Invalidate cached reo ring entry before accessing it
+    - mips: Enable KCSAN
+    - dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
+    - vfio/pci: fix memory leak during D3hot to D0 transition
+    - vfio/pci: wake-up devices around reset functions
+    - scsi: fnic: Fix a tracing statement
+    - scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
+    - scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
+    - scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
+    - scsi: pm8001: Fix le32 values handling in
+      pm80xx_set_sas_protocol_timer_config()
+    - scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update()
+    - scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req()
+    - scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req()
+    - scsi: pm8001: Fix NCQ NON DATA command task initialization
+    - scsi: pm8001: Fix NCQ NON DATA command completion handling
+    - scsi: pm8001: Fix abort all task initialization
+    - mt76: do not always copy ethhdr in reverse_frag0_hdr_trans
+    - mt76: fix endianness errors in reverse_frag0_hdr_trans
+    - mt76: mt7921s: fix missing fc type/sub-type for 802.11 pkts
+    - net: dsa: realtek-smi: fix kdoc warnings
+    - net: dsa: realtek-smi: move to subdirectory
+    - RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR
+    - drm/amd/display: Remove vupdate_int_entry definition
+    - TOMOYO: fix __setup handlers return values
+    - power: supply: sbs-charger: Don't cancel work that is not initialized
+    - mt76: mt7915: enlarge wcid size to 544
+    - mt76: mt7915: fix the muru tlv issue
+    - drm/dp: Fix OOB read when handling Post Cursor2 register
+    - ext2: correct max file size computing
+    - drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
+    - power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false
+      return
+    - scsi: hisi_sas: Change permission of parameter prot_mask
+    - drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt
+    - bpf, arm64: Call build_prologue() first in first JIT pass
+    - bpf, arm64: Feed byte-offset into bpf line info
+    - xsk: Fix race at socket teardown
+    - RDMA/irdma: Fix netdev notifications for vlan's
+    - RDMA/irdma: Fix Passthrough mode in VM
+    - RDMA/irdma: Remove incorrect masking of PD
+    - libbpf: Fix BPF_MAP_TYPE_PERF_EVENT_ARRAY auto-pinning
+    - gpu: host1x: Fix an error handling path in 'host1x_probe()'
+    - gpu: host1x: Fix a memory leak in 'host1x_remove()'
+    - libbpf: Skip forward declaration when counting duplicated type names
+    - powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties()
+    - powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit
+    - KVM: x86: Fix emulation in writing cr8
+    - KVM: x86/emulator: Defer not-present segment check in
+      __load_segment_descriptor()
+    - KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors
+    - hv_balloon: rate-limit "Unhandled message" warning
+    - KVM: arm64: Enable Cortex-A510 erratum 2077057 by default
+    - i2c: xiic: Make bus names unique
+    - net: phy: micrel: Fix concurrent register access
+    - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync()
+    - Bluetooth: Fix skb allocation in mgmt_remote_name() &
+      mgmt_device_connected()
+    - power: supply: wm8350-power: Handle error for wm8350_register_irq
+    - power: supply: wm8350-power: Add missing free in free_charger_irq
+    - IB/hfi1: Allow larger MTU without AIP
+    - RDMA/core: Fix ib_qp_usecnt_dec() called when error
+    - PCI: Reduce warnings on possible RW1C corruption
+    - net: axienet: fix RX ring refill allocation failure handling
+    - drm/msm/a6xx: Fix missing ARRAY_SIZE() check
+    - mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n
+    - MIPS: Sanitise Cavium switch cases in TLB handler synthesizers
+    - powerpc/sysdev: fix incorrect use to determine if list is empty
+    - powerpc/64s: Don't use DSISR for SLB faults
+    - mfd: mc13xxx: Add check for mc13xxx_irq_request
+    - libbpf: Unmap rings when umem deleted
+    - selftests/bpf: Make test_lwt_ip_encap more stable and faster
+    - platform/x86: huawei-wmi: check the return value of device_create_file()
+    - scsi: mpt3sas: Fix incorrect 4GB boundary check
+    - powerpc: 8xx: fix a return value error in mpc8xx_pic_init
+    - xtensa: add missing XCHAL_HAVE_WINDOWED check
+    - iwlwifi: pcie: fix SW error MSI-X mapping
+    - vxcan: enable local echo for sent CAN frames
+    - ath10k: Fix error handling in ath10k_setup_msa_resources
+    - mips: cdmm: Fix refcount leak in mips_cdmm_phys_base
+    - MIPS: RB532: fix return value of __setup handler
+    - MIPS: pgalloc: fix memory leak caused by pgd_free()
+    - mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
+    - power: ab8500_chargalg: Use CLOCK_MONOTONIC
+    - RDMA/irdma: Prevent some integer underflows
+    - Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error"
+    - RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
+    - bpf, sockmap: Fix memleak in sk_psock_queue_msg
+    - bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
+    - bpf, sockmap: Fix more uncharged while msg has more_data
+    - bpf, sockmap: Fix double uncharge the mem of sk_msg
+    - samples/bpf, xdpsock: Fix race when running for fix duration of time
+    - USB: storage: ums-realtek: fix error code in rts51x_read_mem()
+    - drm/amd/display: Fix double free during GPU reset on DC streams
+    - RDMA/rxe: Change variable and function argument to proper type
+    - RDMA/rxe: Fix ref error in rxe_av.c
+    - powerpc/xive: fix return value of __setup handler
+    - powerpc/time: Fix KVM host re-arming a timer beyond decrementer range
+    - drm/i915/display: Fix HPD short pulse handling for eDP
+    - drm/i915/display: Do not re-enable PSR after it was marked as not reliable
+    - netfilter: flowtable: Fix QinQ and pppoe support for inet table
+    - mt76: mt7921: fix mt7921_queues_acq implementation
+    - can: isotp: return -EADDRNOTAVAIL when reading from unbound socket
+    - can: isotp: support MSG_TRUNC flag when reading from socket
+    - bareudp: use ipv6_mod_enabled to check if IPv6 enabled
+    - PCI: imx6: Invoke the PHY exit function after PHY power off
+    - PCI: imx6: Assert i.MX8MM CLKREQ# even if no device present
+    - ibmvnic: fix race between xmit and reset
+    - af_unix: Fix some data-races around unix_sk(sk)->oob_skb.
+    - selftests/bpf: Fix error reporting from sock_fields programs
+    - Bluetooth: hci_uart: add missing NULL check in h5_enqueue
+    - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed
+    - Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
+    - RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit()
+    - ipv4: Fix route lookups when handling ICMP redirects and PMTU updates
+    - mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release
+      skb
+    - af_netlink: Fix shift out of bounds in group mask calculation
+    - i2c: meson: Fix wrong speed use from probe
+    - netfilter: conntrack: Add and use nf_ct_set_auto_assign_helper_warned()
+    - i2c: mux: demux-pinctrl: do not deactivate a master that is not active
+    - powerpc/pseries: Fix use after free in remove_phb_dynamic()
+    - ax25: Fix refcount leaks caused by ax25_cb_del()
+    - ax25: Fix NULL pointer dereferences in ax25 timers
+    - drm/i915: Fix renamed struct field
+    - selftests/bpf/test_lirc_mode2.sh: Exit with proper code
+    - bpftool: Fix print error when show bpf map
+    - PCI: Avoid broken MSI on SB600 USB devices
+    - net: bcmgenet: Use stronger register read/writes to assure ordering
+    - tcp: ensure PMTU updates are processed during fastopen
+    - openvswitch: always update flow key after nat
+    - net: dsa: fix panic on shutdown if multi-chip tree failed to probe
+    - net: wwan: qcom_bam_dmux: fix wrong pointer passed to IS_ERR()
+    - tipc: fix the timer expires after interval 100ms
+    - mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
+    - ice: fix 'scheduling while atomic' on aux critical err interrupt
+    - ice: don't allow to run ice_send_event_to_aux() in atomic ctx
+    - drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via
+      ethtool
+    - kernel/resource: fix kfree() of bootmem memory again
+    - clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3
+    - staging: r8188eu: release_firmware is not called if allocation fails
+    - mxser: fix xmit_buf leak in activate when LSR == 0xff
+    - fsi: scom: Fix error handling
+    - fsi: scom: Remove retries in indirect scoms
+    - pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
+    - pps: clients: gpio: Propagate return value from pps_gpio_probe
+    - fsi: Aspeed: Fix a potential double free
+    - misc: alcor_pci: Fix an error handling path
+    - cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse
+    - soundwire: intel: fix wrong register name in intel_shim_wake
+    - clk: qcom: ipq8074: fix PCI-E clock oops
+    - dmaengine: idxd: restore traffic class defaults after wq reset
+    - iio: mma8452: Fix probe failing when an i2c_device_id is used
+    - staging: qlge: add unregister_netdev in qlge_probe
+    - serial: 8250_aspeed_vuart: add PORT_ASPEED_VUART port type
+    - staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
+    - clk: renesas: r8a779f0: Fix RSW2 clock divider
+    - pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel
+    - pinctrl: renesas: checker: Fix miscalculation of number of states
+    - clk: qcom: ipq8074: Use floor ops for SDCC1 clock
+    - phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure})
+    - phy: phy-brcm-usb: fixup BCM4908 support
+    - serial: 8250_mid: Balance reference count for PCI DMA device
+    - serial: 8250_lpss: Balance reference count for PCI DMA device
+    - NFS: Use of mapping_set_error() results in spurious errors
+    - serial: 8250: Fix race condition in RTS-after-send handling
+    - iio: adc: Add check for devm_request_threaded_irq
+    - habanalabs: Add check for pci_enable_device
+    - NFS: Return valid errors from nfs2/3_decode_dirent()
+    - staging: r8188eu: fix endless loop in recv_func
+    - dma-debug: fix return value of __setup handlers
+    - clk: imx7d: Remove audio_mclk_root_clk
+    - clk: imx: off by one in imx_lpcg_parse_clks_from_dt()
+    - clk: at91: sama7g5: fix parents of PDMCs' GCLK
+    - clk: qcom: clk-rcg2: Update logic to calculate D value for RCG
+    - clk: qcom: clk-rcg2: Update the frac table for pixel clock
+    - clk: starfive: jh7100: Don't round divisor up twice
+    - clk: starfive: jh7100: Handle audio_div clock properly
+    - dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma
+    - remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region
+    - remoteproc: qcom_wcnss: Add missing of_node_put() in
+      wcnss_alloc_memory_region
+    - remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region
+    - nvdimm/region: Fix default alignment for small regions
+    - clk: actions: Terminate clk_div_table with sentinel element
+    - clk: loongson1: Terminate clk_div_table with sentinel element
+    - clk: hisilicon: Terminate clk_div_table with sentinel element
+    - clk: clps711x: Terminate clk_div_table with sentinel element
+    - clk: Fix clk_hw_get_clk() when dev is NULL
+    - clk: tegra: tegra124-emc: Fix missing put_device() call in
+      emc_ensure_emc_driver
+    - mailbox: imx: fix crash in resume on i.mx8ulp
+    - NFS: remove unneeded check in decode_devicenotify_args()
+    - staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
+    - staging: mt7621-dts: fix formatting
+    - staging: mt7621-dts: fix pinctrl properties for ethernet
+    - staging: mt7621-dts: fix GB-PC2 devicetree
+    - pinctrl: ocelot: fix confops resource index
+    - pinctrl: ocelot: fix duplicate debugfs entry
+    - pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
+    - pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback
+    - pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get()
+    - pinctrl: mediatek: paris: Fix pingroup pin config state readback
+    - pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual
+      GPIOs
+    - pinctrl: ocelot: Fix interrupt parsing
+    - pinctrl: microchip-sgpio: lock RMW access
+    - pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
+    - pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
+    - clk: visconti: prevent array overflow in visconti_clk_register_gates()
+    - tty: hvc: fix return value of __setup handler
+    - kgdboc: fix return value of __setup handler
+    - serial: 8250: fix XOFF/XON sending when DMA is used
+    - virt: acrn: obtain pa from VMA with PFNMAP flag
+    - virt: acrn: fix a memory leak in acrn_dev_ioctl()
+    - kgdbts: fix return value of __setup handler
+    - firmware: google: Properly state IOMEM dependency
+    - driver core: dd: fix return value of __setup handler
+    - perf test arm64: Test unwinding using fame-pointer (fp) mode
+    - jfs: fix divide error in dbNextAG
+    - SUNRPC/call_alloc: async tasks mustn't block waiting for memory
+    - SUNRPC: improve 'swap' handling: scheduling and PF_MEMALLOC
+    - SUNRPC: Don't call connect() more than once on a TCP socket
+    - perf parse-events: Move slots only with topdown
+    - netfilter: egress: Report interface as outgoing
+    - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
+    - SUNRPC don't resend a task on an offlined transport
+    - NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error
+    - kdb: Fix the putarea helper function
+    - perf stat: Fix forked applications enablement of counters
+    - net: stmmac: dwmac-qcom-ethqos: Enable RGMII functional clock on resume
+    - clk: qcom: gcc-msm8994: Fix gpll4 width
+    - vsock/virtio: initialize vdev->priv before using VQs
+    - vsock/virtio: read the negotiated features before using VQs
+    - vsock/virtio: enable VQs early on probe
+    - clk: Initialize orphan req_rate
+    - xen: fix is_xen_pmu()
+    - net: enetc: report software timestamping via SO_TIMESTAMPING
+    - net: hns3: fix bug when PF set the duplicate MAC address for VFs
+    - net: hns3: fix port base vlan add fail when concurrent with reset
+    - net: hns3: add vlan list lock to protect vlan list
+    - net: hns3: refine the process when PF set VF VLAN
+    - net: phy: broadcom: Fix brcm_fet_config_init()
+    - selftests: test_vxlan_under_vrf: Fix broken test case
+    - NFS: Don't loop forever in nfs_do_recoalesce()
+    - libperf tests: Fix typo in perf_evlist__open() failure error messages
+    - net: hns3: fix ethtool tx copybreak buf size indicating not aligned issue
+    - net: hns3: add max order judgement for tx spare buffer
+    - net: hns3: clean residual vf config after disable sriov
+    - net: hns3: add netdev reset check for hns3_set_tunable()
+    - net: hns3: add NULL pointer check for hns3_set/get_ringparam()
+    - net: hns3: fix phy can not link up when autoneg off and reset
+    - net: sparx5: depends on PTP_1588_CLOCK_OPTIONAL
+    - qlcnic: dcb: default to returning -EOPNOTSUPP
+    - net/x25: Fix null-ptr-deref caused by x25_disconnect
+    - net: sparx5: switchdev: fix possible NULL pointer dereference
+    - octeontx2-af: initialize action variable
+    - selftests: tls: skip cmsg_to_pipe tests with TLS=n
+    - net/sched: act_ct: fix ref leak when switching zones
+    - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
+    - net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator
+    - fs: fd tables have to be multiples of BITS_PER_LONG
+    - lib/test: use after free in register_test_dev_kmod()
+    - fs: fix fd table size alignment properly
+    - LSM: general protection fault in legacy_parse_param
+    - regulator: rpi-panel: Handle I2C errors/timing to the Atmel
+    - crypto: hisilicon/qm - cleanup warning in qm_vf_read_qos
+    - crypto: octeontx2 - CN10K CPT to RNM workaround
+    - gcc-plugins/stackleak: Exactly match strings instead of prefixes
+    - rcu: Kill rnp->ofl_seq and use only rcu_state.ofl_lock for exclusion
+    - pinctrl: npcm: Fix broken references to chip->parent_device
+    - rcu: Mark writes to the rcu_segcblist structure's ->flags field
+    - block: throttle split bio in case of iops limit
+    - memstick/mspro_block: fix handling of read-only devices
+    - block/bfq_wf2q: correct weight to ioprio
+    - crypto: xts - Add softdep on ecb
+    - crypto: hisilicon/sec - not need to enable sm4 extra mode at HW V3
+    - block, bfq: don't move oom_bfqq
+    - selinux: use correct type for context length
+    - powercap/dtpm_cpu: Reset per_cpu variable in the release function
+    - arm64: module: remove (NOLOAD) from linker script
+    - selinux: allow FIOCLEX and FIONCLEX with policy capability
+    - loop: use sysfs_emit() in the sysfs xxx show()
+    - Fix incorrect type in assignment of ipv6 port for audit
+    - irqchip/qcom-pdc: Fix broken locking
+    - irqchip/nvic: Release nvic_base upon failure
+    - fs/binfmt_elf: Fix AT_PHDR for unusual ELF files
+    - hwrng: cavium - fix NULL but dereferenced coccicheck error
+    - bfq: fix use-after-free in bfq_dispatch_request
+    - ACPICA: Avoid walking the ACPI Namespace if it is not there
+    - ACPI / x86: Add skip i2c clients quirk for Nextbook Ares 8
+    - ACPI / x86: Add skip i2c clients quirk for Lenovo Yoga Tablet 1050F/L
+    - lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3
+    - Revert "Revert "block, bfq: honor already-setup queue merges""
+    - ACPI/APEI: Limit printable size of BERT table data
+    - PM: core: keep irq flags in device_pm_check_callbacks()
+    - parisc: Fix non-access data TLB cache flush faults
+    - parisc: Fix handling off probe non-access faults
+    - nvme-tcp: lockdep: annotate in-kernel sockets
+    - spi: tegra20: Use of_device_get_match_data()
+    - spi: fsi: Implement a timeout for polling status
+    - atomics: Fix atomic64_{read_acquire,set_release} fallbacks
+    - locking/lockdep: Iterate lock_classes directly when reading lockdep files
+    - ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb
+    - ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit
+    - sched/tracing: Report TASK_RTLOCK_WAIT tasks as TASK_UNINTERRUPTIBLE
+    - ext4: don't BUG if someone dirty pages without asking ext4 first
+    - f2fs: fix to do sanity check on curseg->alloc_type
+    - NFSD: Fix nfsd_breaker_owns_lease() return values
+    - f2fs: don't get FREEZE lock in f2fs_evict_inode in frozen fs
+    - btrfs: harden identification of a stale device
+    - btrfs: make search_csum_tree return 0 if we get -EFBIG
+    - btrfs: handle csum lookup errors properly on reads
+    - btrfs: do not double complete bio on errors during compressed reads
+    - btrfs: do not clean up repair bio if submit fails
+    - f2fs: use spin_lock to avoid hang
+    - f2fs: compress: fix to print raw data size in error path of lz4
+      decompression
+    - Adjust cifssb maximum read size
+    - ntfs: add sanity check on allocation size
+    - media: staging: media: zoran: move videodev alloc
+    - media: staging: media: zoran: calculate the right buffer number for
+      zoran_reap_stat_com
+    - media: staging: media: zoran: fix various V4L2 compliance errors
+    - media: atmel: atmel-isc-base: report frame sizes as full supported range
+    - media: ir_toy: free before error exiting
+    - ASoC: sh: rz-ssi: Make the data structures available before registering the
+      handlers
+    - ASoC: cs42l42: Report full jack status when plug is detected
+    - ASoC: SOF: Intel: match sdw version on link_slaves_found
+    - media: imx-jpeg: Prevent decoding NV12M jpegs into single-planar buffers
+    - ASoC: SOF: Intel: hda: Remove link assignment limitation
+    - media: iommu/mediatek-v1: Free the existed fwspec if the master dev already
+      has
+    - media: iommu/mediatek: Return ENODEV if the device is NULL
+    - media: iommu/mediatek: Add device_link between the consumer and the larb
+      devices
+    - video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
+    - video: fbdev: w100fb: Reset global state
+    - video: fbdev: cirrusfb: check pixclock to avoid divide by zero
+    - video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
+    - ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
+    - ARM: dts: bcm2837: Add the missing L1/L2 cache information
+    - ASoC: madera: Add dependencies on MFD
+    - media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator
+      off on some boards
+    - media: atomisp: fix dummy_ptr check to avoid duplicate active_bo
+    - ARM: ftrace: avoid redundant loads or clobbering IP
+    - ALSA: hda: Fix driver index handling at re-binding
+    - ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk
+    - arm64: defconfig: build imx-sdma as a module
+    - video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
+    - video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of
+      snprintf()
+    - video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit
+    - ARM: dts: bcm2711: Add the missing L1/L2 cache information
+    - ASoC: soc-core: skip zero num_dai component in searching dai name
+    - ASoC: Intel: sof_es8336: add quirk for Huawei D15 2021
+    - media: imx-jpeg: fix a bug of accessing array out of bounds
+    - media: cx88-mpeg: clear interrupt status register before streaming video
+    - ASoC: rt5682s: Fix the wrong jack type detected
+    - ARM: tegra: transformer: Drop reg-shift for Tegra HS UART
+    - uaccess: fix type mismatch warnings from access_ok()
+    - lib/test_lockup: fix kernel pointer check for separate address spaces
+    - ARM: tegra: tamonten: Fix I2C3 pad setting
+    - ARM: mmp: Fix failure to remove sram device
+    - ASoC: amd: vg: fix for pm resume callback sequence
+    - ASoC: amd: vangogh: fix uninitialized symbol warning in machine driver
+    - video: fbdev: sm712fb: Fix crash in smtcfb_write()
+    - media: i2c: ov5648: Fix lockdep error
+    - media: Revert "media: em28xx: add missing em28xx_close_extension"
+    - media: hdpvr: initialize dev->worker at hdpvr_register_videodev
+    - ASoC: SOF: debug: clarify operator precedence
+    - ASoC: Intel: sof_sdw: fix quirks for 2022 HP Spectre x360 13"
+    - ASoC: SOF: Intel: hda: retrieve DMIC number for I2S boards
+    - ALSA: intel-nhlt: add helper to detect SSP link mask
+    - ALSA: intel-dsp-config: add more ACPI HIDs for ES83x6 devices
+    - ASoC: Intel: soc-acpi: add more ACPI HIDs for ES83x6 devices
+    - ALSA: intel-dspconfig: add ES8336 support for CNL
+    - ASoC: Intel: Revert "ASoC: Intel: sof_es8336: add quirk for Huawei D15 2021"
+    - ASoC: Intel: sof_es8336: log all quirks
+    - tracing: Have TRACE_DEFINE_ENUM affect trace event types as well
+    - mmc: host: Return an error when ->enable_sdio_irq() ops is missing
+    - ASoC: mediatek: Fix error handling in mt8183_da7219_max98357_dev_probe
+    - media: atomisp: fix bad usage at error handling logic
+    - ALSA: hda/realtek: Add alc256-samsung-headphone fixup
+    - KVM: SVM: Allow AVIC support on system w/ physical APIC ID > 255
+    - KVM: x86: Reinitialize context if host userspace toggles EFER.LME
+    - KVM: x86/mmu: Use common TDP MMU zap helper for MMU notifier unmap hook
+    - KVM: x86/mmu: Move "invalid" check out of kvm_tdp_mmu_get_root()
+    - KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU
+    - KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU
+    - KVM: x86: hyper-v: Drop redundant 'ex' parameter from kvm_hv_send_ipi()
+    - KVM: x86: hyper-v: Drop redundant 'ex' parameter from kvm_hv_flush_tlb()
+    - KVM: x86: hyper-v: Fix the maximum number of sparse banks for XMM fast TLB
+      flush hypercalls
+    - KVM: x86: hyper-v: HVCALL_SEND_IPI_EX is an XMM fast hypercall
+    - powerpc/kasan: Fix early region not updated correctly
+    - powerpc/tm: Fix more userspace r13 corruption
+    - powerpc/lib/sstep: Fix 'sthcx' instruction
+    - powerpc/lib/sstep: Fix build errors with newer binutils
+    - powerpc: Add set_memory_{p/np}() and remove set_memory_attr()
+    - powerpc: Fix build errors with newer binutils
+    - drm/dp: Fix off-by-one in register cache size
+    - drm/i915: Treat SAGV block time 0 as SAGV disabled
+    - drm/i915: Fix PSF GV point mask when SAGV is not possible
+    - drm/i915: Reject unsupported TMDS rates on ICL+
+    - scsi: qla2xxx: Refactor asynchronous command initialization
+    - scsi: qla2xxx: Implement ref count for SRB
+    - scsi: qla2xxx: Fix stuck session in gpdb
+    - scsi: qla2xxx: Fix warning message due to adisc being flushed
+    - scsi: qla2xxx: Fix scheduling while atomic
+    - scsi: qla2xxx: Fix premature hw access after PCI error
+    - scsi: qla2xxx: Fix wrong FDMI data for 64G adapter
+    - scsi: qla2xxx: Fix warning for missing error code
+    - scsi: qla2xxx: Fix device reconnect in loop topology
+    - scsi: qla2xxx: edif: Fix clang warning
+    - scsi: qla2xxx: Fix T10 PI tag escape and IP guard options for 28XX adapters
+    - scsi: qla2xxx: Add devids and conditionals for 28xx
+    - scsi: qla2xxx: Check for firmware dump already collected
+    - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
+    - scsi: qla2xxx: Fix disk failure to rediscover
+    - scsi: qla2xxx: Fix incorrect reporting of task management failure
+    - scsi: qla2xxx: Fix hang due to session stuck
+    - scsi: qla2xxx: Fix laggy FC remote port session recovery
+    - scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests
+    - scsi: qla2xxx: Fix crash during module load unload test
+    - scsi: qla2xxx: Fix N2N inconsistent PLOGI
+    - scsi: qla2xxx: Fix stuck session of PRLI reject
+    - scsi: qla2xxx: Reduce false trigger to login
+    - scsi: qla2xxx: Use correct feature type field during RFF_ID processing
+    - platform: chrome: Split trace include file
+    - MIPS: crypto: Fix CRC32 code
+    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
+    - KVM: x86: Avoid theoretical NULL pointer dereference in
+      kvm_irq_delivery_to_apic_fast()
+    - KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
+    - KVM: x86/mmu: do compare-and-exchange of gPTE via the user address
+    - KVM: Prevent module exit until all VMs are freed
+    - KVM: x86: fix sending PV IPI
+    - KVM: SVM: fix panic on out-of-bounds guest IRQ
+    - KVM: avoid double put_page with gfn-to-pfn cache
+    - ubifs: rename_whiteout: Fix double free for whiteout_ui->data
+    - ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
+    - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
+    - ubifs: Rename whiteout atomically
+    - ubifs: Fix 'ui->dirty' race between do_tmpfile() and writeback work
+    - ubifs: Rectify space amount budget for mkdir/tmpfile operations
+    - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
+    - ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
+    - ubifs: Fix to add refcount once page is set private
+    - ubifs: rename_whiteout: correct old_dir size computing
+    - nvme: allow duplicate NSIDs for private namespaces
+    - nvme: fix the read-only state for zoned namespaces with unsupposed features
+    - wireguard: queueing: use CFI-safe ptr_ring cleanup function
+    - wireguard: socket: free skb in send6 when ipv6 is disabled
+    - wireguard: socket: ignore v6 endpoints when ipv6 is disabled
+    - XArray: Fix xas_create_range() when multi-order entry present
+    - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
+    - can: mcba_usb: properly check endpoint type
+    - can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value
+    - XArray: Include bitmap.h from xarray.h
+    - XArray: Update the LRU list in xas_split()
+    - modpost: restore the warning message for missing symbol versions
+    - rtc: gamecube: Fix refcount leak in gamecube_rtc_read_offset_from_sram
+    - rtc: check if __rtc_read_time was successful
+    - loop: fix ioctl calls using compat_loop_info
+    - gfs2: gfs2_setattr_size error path fix
+    - gfs2: Fix gfs2_file_buffered_write endless loop workaround
+    - gfs2: Make sure FITRIM minlen is rounded up to fs block size
+    - net: hns3: fix the concurrency between functions reading debugfs
+    - net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware
+    - rxrpc: fix some null-ptr-deref bugs in server_key.c
+    - rxrpc: Fix call timer start racing with call destruction
+    - mailbox: imx: fix wakeup failure from freeze mode
+    - crypto: x86/poly1305 - Fixup SLS
+    - crypto: arm/aes-neonbs-cbc - Select generic cbc and aes
+    - watch_queue: Free the page array when watch_queue is dismantled
+    - pinctrl: pinconf-generic: Print arguments for bias-pull-*
+    - watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function
+    - net: sparx5: uses, depends on BRIDGE or !BRIDGE
+    - pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR()
+    - pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE()
+    - ASoC: rockchip: i2s_tdm: Fixup config for SND_SOC_DAIFMT_DSP_A/B
+    - ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs
+    - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
+    - ARM: iop32x: offset IRQ numbers by 1
+    - block: Fix the maximum minor value is blk_alloc_ext_minor()
+    - block: restore the old set_task_ioprio() behaviour wrt PF_EXITING
+    - Revert "virtio-pci: harden INTX interrupts"
+    - Revert "virtio_pci: harden MSI-X interrupts"
+    - virtio: use virtio_device_ready() in virtio_device_restore()
+    - io_uring: remove poll entry from list when canceling all
+    - io_uring: bump poll refs to full 31-bits
+    - io_uring: fix memory leak of uid in files registration
+    - riscv module: remove (NOLOAD)
+    - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
+    - vhost: handle error while adding split ranges to iotlb
+    - spi: Fix Tegra QSPI example
+    - platform/chrome: cros_ec_typec: Check for EC device
+    - platform/x86: asus-wmi: Fix regression when probing for fan curve control
+    - can: isotp: restore accidentally removed MSG_PEEK feature
+    - proc: bootconfig: Add null pointer check
+    - x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation
+    - x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO
+    - drm/connector: Fix typo in documentation
+    - scsi: qla2xxx: Add qla2x00_async_done() for async routines
+    - staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet
+    - docs: fix 'make htmldocs' warning in SCTP.rst
+    - arm64: mm: Drop 'const' from conditional arm64_dma_phys_limit definition
+    - ASoC: soc-compress: Change the check for codec_dai
+    - KVM: x86: SVM: fix avic spec based definitions again
+    - ax25: fix UAF bug in ax25_send_control()
+    - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
+    - tracing: Have type enum modifications copy the strings
+    - mips: Enable KCSAN - take 2
+    - net: add skb_set_end_offset() helper
+    - mm/mmap: return 1 from stack_guard_gap __setup() handler
+    - ARM: 9187/1: JIVE: fix return value of __setup handler
+    - mm/memcontrol: return 1 from cgroup.memory __setup() handler
+    - mm/usercopy: return 1 from hardened_usercopy __setup() handler
+    - af_unix: Support POLLPRI for OOB.
+    - libbpf: Define BTF_KIND_* constants in btf.h to avoid compilation errors
+    - bpf: Adjust BPF stack helper functions to accommodate skip > 0
+    - bpf: Fix comment for helper bpf_current_task_under_cgroup()
+    - nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
+    - mmc: rtsx: Use pm_runtime_{get,put}() to handle runtime PM
+    - dt-bindings: mtd: nand-controller: Fix the reg property description
+    - dt-bindings: mtd: nand-controller: Fix a comment in the examples
+    - dt-bindings: spi: mxic: The interrupt property is not mandatory
+    - media: dt-binding: media: hynix,hi846: use $defs/port-base port description
+    - media: dt-bindings: media: hynix,hi846: add link-frequencies description
+    - dt-bindings: memory: mtk-smi: Rename clock to clocks
+    - dt-bindings: memory: mtk-smi: No need mediatek,larb-id for mt8167
+    - dt-bindings: memory: mtk-smi: Correct minItems to 2 for the gals clocks
+    - dt-bindings: pinctrl: mt8195: fix bias-pull-{up,down} checks
+    - dt-bindings: pinctrl: pinctrl-microchip-sgpio: Fix example
+    - ubi: fastmap: Return error code if memory allocation fails in add_aeb()
+    - net: preserve skb_end_offset() in skb_unclone_keeptruesize()
+    - ASoC: SOF: Intel: Fix build error without SND_SOC_SOF_PCI_DEV
+    - ASoC: topology: Allow TLV control to be either read or write
+    - perf vendor events: Update metrics for SkyLake Server
+    - media: ov6650: Add try support to selection API operations
+    - media: ov6650: Fix crop rectangle affected by set format
+    - pinctrl: canonical rsel resistance selection property
+    - spi: mediatek: support tick_delay without enhance_timing
+    - ARM: dts: spear1340: Update serial node properties
+    - ARM: dts: spear13xx: Update SPI dma properties
+    - arm64: dts: ls1043a: Update i2c dma properties
+    - arm64: dts: ls1046a: Update i2c node dma properties
+    - um: Fix uml_mconsole stop/go
+    - docs: sysctl/kernel: add missing bit to panic_print
+    - xsk: Do not write NULL in SW ring at allocation failure
+    - ice: xsk: Fix indexing in ice_tx_xsk_pool()
+    - vdpa/mlx5: Avoid processing works if workqueue was destroyed
+    - openvswitch: Fixed nd target mask field in the flow dump.
+    - torture: Make torture.sh help message match reality
+    - n64cart: convert bi_disk to bi_bdev->bd_disk fix build
+    - Revert "nbd: fix possible overflow on 'first_minor' in nbd_dev_add()"
+    - mmc: rtsx: Let MMC core handle runtime PM
+    - mmc: rtsx: Fix build errors/warnings for unused variable
+    - coredump: Snapshot the vmas in do_coredump
+    - coredump: Remove the WARN_ON in dump_vma_snapshot
+    - coredump/elf: Pass coredump_params into fill_note_info
+    - coredump: Use the vma snapshot in fill_files_note
+    - Linux 5.17.2
+
+  * Jammy update: v5.17.1 upstream stable release (LP: #1968982)
+    - tpm: Fix error handling in async work
+    - Bluetooth: btusb: Add another Realtek 8761BU
+    - llc: fix netdevice reference leaks in llc_ui_bind()
+    - ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call
+    - ALSA: oss: Fix PCM OSS buffer allocation overflow
+    - ALSA: usb-audio: add mapping for new Corsair Virtuoso SE
+    - ALSA: hda/realtek: Add quirk for Clevo NP70PNJ
+    - ALSA: hda/realtek: Add quirk for Clevo NP50PNJ
+    - ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671
+    - ALSA: hda/realtek: Add quirk for ASUS GA402
+    - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
+    - ALSA: pcm: Fix races among concurrent read/write and buffer changes
+    - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
+    - ALSA: pcm: Fix races among concurrent prealloc proc writes
+    - ALSA: pcm: Add stream lock during PCM reset ioctl operations
+    - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
+    - ALSA: cmipci: Restore aux vol on suspend/resume
+    - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
+    - drivers: net: xgene: Fix regression in CRC stripping
+    - netfilter: nf_tables: initialize registers in nft_do_chain()
+    - netfilter: nf_tables: validate registers coming from userspace.
+    - ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
+    - ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
+    - ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
+    - crypto: qat - disable registration of algorithms
+    - Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE
+    - Bluetooth: hci_sync: Add a new quirk to skip HCI_FLT_CLEAR_ALL
+    - Bluetooth: btusb: Use quirk to skip HCI_FLT_CLEAR_ALL on fake CSR
+      controllers
+    - Revert "ath: add support for special 0x0 regulatory domain"
+    - drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()
+    - jbd2: fix use-after-free of transaction_t race
+    - rcu: Don't deboost before reporting expedited quiescent state
+    - uaccess: fix integer overflow on access_ok()
+    - mac80211: fix potential double free on mesh join
+    - tpm: fix reference counting for struct tpm_chip
+    - tpm: use try_get_ops() in tpm-space.c
+    - wcn36xx: Differentiate wcn3660 from wcn3620
+    - m68k: fix access_ok for coldfire
+    - nds32: fix access_ok() checks in get/put_user
+    - drm/msm/gpu: Fix crash on devices without devfreq support (v2)
+    - llc: only change llc->dev when bind() succeeds
+    - Linux 5.17.1
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: shiftfs: always rely on init_user_ns
+    - [Config] update configs and annotations after stable updates
+    - SAUCE: sfc: The size of the RX recycle ring should be more flexible
+    - [Packaging] remove references to lowlatency flavor
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Apr 2022 08:45:40 +0200
+
+linux-unstable (5.17.0-6.6) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-6.6 -proposed tracker (LP: #1965731)
+
+  * dependency on crda obsolete according to Debian (LP: #1958918)
+    - [Packaging] switch dependency from crda to wireless-regdb
+
+  * Miscellaneous Ubuntu changes
+    - [Config] disable CONFIG_SYSFB_SIMPLEFB on amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Mar 2022 09:46:03 +0100
+
+linux-unstable (5.17.0-5.5) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-5.5 -proposed tracker (LP: #1964766)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync dkms-build{,--nvidia-N} from LRMv5
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to v5.17-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Mar 2022 13:15:50 +0100
+
+linux-unstable (5.17.0-4.4) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-4.4 -proposed tracker (LP: #1963880)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 07 Mar 2022 10:20:48 +0100
+
+linux-unstable (5.17.0-3.3) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-3.3 -proposed tracker (LP: #1962450)
+
+  * 5.15 stuck at boot on c4.large (LP: #1956780)
+    - Revert "PCI/MSI: Mask MSI-X vectors only on success"
+
+  * [22.04 FEAT] KVM: Enable storage key checking for intercepted instruction
+    handled by userspace (LP: #1933179)
+    - s390/uaccess: Add copy_from/to_user_key functions
+    - KVM: s390: Honor storage keys when accessing guest memory
+    - KVM: s390: handle_tprot: Honor storage keys
+    - KVM: s390: Add optional storage key checking to MEMOP IOCTL
+    - KVM: s390: Add vm IOCTL for key checked guest absolute memory access
+    - KVM: s390: Rename existing vcpu memop functions
+    - KVM: s390: Update api documentation for memop ioctl
+    - KVM: s390: Clarify key argument for MEM_OP in api docs
+    - KVM: s390: Add missing vm MEM_OP size check
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Feb 2022 09:42:32 +0100
+
+linux-unstable (5.17.0-2.2) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-2.2 -proposed tracker (LP: #1962137)
+
+  * CVE-2022-25636
+    - netfilter: nf_tables_offload: incorrect flow offload action array size
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+    - [Packaging] update Ubuntu.md
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Jammy update: v5.15.22 upstream stable release (LP: #1960516)
+    - Revert "ASoC: mediatek: Check for error clk pointer"
+    - [Config] disable FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION
+
+  * Jammy update: v5.15.20 upstream stable release (LP: #1960509)
+    - Revert "UBUNTU: SAUCE: Revert "e1000e: Additional PHY power saving in S0ix""
+
+  * Jammy update: v5.15.19 upstream stable release (LP: #1959879)
+    - drm/etnaviv: relax submit size limits
+
+  * Jammy update: v5.15.17 upstream stable release (LP: #1959376)
+    - net: dsa: hellcreek: Allow PTP P2P measurements on blocked ports
+    - rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC
+    - ASoC: mediatek: Check for error clk pointer
+    - regulator: da9121: Prevent current limit change when enabled
+    - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
+    - drm/etnaviv: limit submit sizes
+    - Bluetooth: hci_sync: Fix not setting adv set duration
+    - net: axienet: Wait for PhyRstCmplt after core reset
+
+  * rtw88_8821ce causes freeze (LP: #1927808) // Jammy update: v5.15.17 upstream
+    stable release (LP: #1959376)
+    - rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
+
+  * Jammy update: v5.15.15 upstream stable release (LP: #1958418)
+    - Bluetooth: btusb: Add support for Foxconn MT7922A
+    - Bluetooth: btbcm: disable read tx power for MacBook Air 8,1 and 8,2
+    - platform/x86/intel: hid: add quirk to support Surface Go 3
+
+  * Support USB4 DP alt mode for AMD Yellow Carp graphics card (LP: #1953008)
+    - SAUCE: drm/amd/display: Fixup previous PSR policy commit
+
+  * alsa/sdw: add sdw audio machine driver for several ADL machines
+    (LP: #1951563)
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B11 product
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B13 product
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B29 product
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B12 product
+
+  * Improve performance and idle power consumption (LP: #1941893)
+    - x86: ACPI: cstate: Optimize C3 entry on AMD CPUs
+
+  * Fix spurious wakeup caused by Intel 7560 WWAN (LP: #1956443)
+    - net: wwan: iosm: Keep device at D0 for s2idle case
+
+  * Jammy update: v5.15.13 upstream stable release (LP: #1956926)
+    - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
+    - net/mlx5: Fix tc max supported prio for nic mode
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Update dependency of pahole / dwarves
+    - [packaging] unhook lowlatency flavours from the build
+    - [Packaging] use default zstd compression
+    - [Packaging] do not use compression for image packages
+    - [Packaging] use xz compression for ddebs
+    - SAUCE: Makefile: Remove inclusion of lbm header files
+    - SAUCE: Makefile: Fix compiler warnings
+    - [Config] drop unused lowlatency configs
+    - [Config] update configs and annotations after rebase to v5.17-rc5
+
+  * Miscellaneous upstream changes
+    - Revert "rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE"
+    - MAINTAINERS: Add scripts/pahole-flags.sh to BPF section
+    - kbuild: Add CONFIG_PAHOLE_VERSION
+    - lib/Kconfig.debug: Use CONFIG_PAHOLE_VERSION
+    - lib/Kconfig.debug: Allow BTF + DWARF5 with pahole 1.21+
+    - Revert "UBUNTU: [Packaging] temporarily disable zfs"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 24 Feb 2022 09:41:40 +0100
+
+linux-unstable (5.17.0-1.1) jammy; urgency=medium
+
+  * Rebase to 5.17-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Feb 2022 08:22:18 +0100
+
+linux-unstable (5.17.0-0.0) jammy; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 28 Jan 2022 17:14:13 +0100
+
+linux (5.15.0-18.18) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-18.18 -proposed tracker (LP: #1958638)
+
+  * CVE-2021-4155
+    - xfs: map unwritten blocks in XFS_IOC_{ALLOC, FREE}SP just like fallocate
+
+  * CVE-2022-0185
+    - SAUCE: vfs: test that one given mount param is not larger than PAGE_SIZE
+
+  * [UBUNTU 20.04] KVM hardware diagnose data improvements for guest kernel -
+    kernel part (LP: #1953334)
+    - KVM: s390: add debug statement for diag 318 CPNC data
+
+  * OOB write on BPF_RINGBUF (LP: #1956585)
+    - SAUCE: bpf: prevent helper argument PTR_TO_ALLOC_MEM to have offset other
+      than 0
+
+  * Miscellaneous Ubuntu changes
+    - [Config] re-enable shiftfs
+    - [SAUCE] shiftfs: support kernel 5.15
+    - [Config] update toolchain versions
+
+  * Miscellaneous upstream changes
+    - vfs: fs_context: fix up param length parsing in legacy_parse_param
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 21 Jan 2022 13:32:27 +0100
+
+linux (5.15.0-17.17) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-17.17 -proposed tracker (LP: #1957809)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 13 Jan 2022 17:11:21 +0100
+
+linux (5.15.0-16.16) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-16.16 -proposed tracker (LP: #1956820)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * 5.15 stuck at boot on c4.large (LP: #1956780)
+    - Revert "PCI/MSI: Mask MSI-X vectors only on success"
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable signed v4l2loopback"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Sat, 08 Jan 2022 10:57:58 +0100
+
+linux (5.15.0-15.15) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-15.15 -proposed tracker (LP: #1956314)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * rtw88_8821ce causes freeze (LP: #1927808)
+    - rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
+
+  * alsa/sdw: fix the  audio sdw codec parsing logic in the acpi table
+    (LP: #1955686)
+    - ALSA: hda: intel-sdw-acpi: go through HDAS ACPI at max depth of 2
+    - ALSA: hda: intel-sdw-acpi: harden detection of controller
+
+  * Got black screen when resume from s2idle with AMD dGPU (LP: #1955790)
+    - SAUCE: drm/amdgpu: put SMU into proper state on runpm suspending for BOCO
+      capable platform
+    - SAUCE: drm/amdgpu: always reset the asic in suspend (v2)
+
+  *  Fix USB3 detection on HP dock (LP: #1955443)
+    - usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
+
+  * support signed v4l2loopback dkms build (LP: #1938531)
+    - enable v4l2loopback builds on amd64 kernels
+    - support v4l2loopback dkms build
+
+  * Jammy update: v5.15.12 upstream stable release (LP: #1956305)
+    - arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd
+    - net: usb: lan78xx: add Allied Telesis AT29M2-AF
+    - ext4: prevent partial update of the extent blocks
+    - ext4: check for out-of-order index extents in ext4_valid_extent_entries()
+    - ext4: check for inconsistent extents between index and leaf block
+    - selftests: KVM: Fix non-x86 compiling
+    - HID: holtek: fix mouse probing
+    - HID: potential dereference of null pointer
+    - NFSD: Fix READDIR buffer overflow
+    - PM: sleep: Fix error handling in dpm_prepare()
+    - arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode
+    - bus: sunxi-rsb: Fix shutdown
+    - spi: change clk_disable_unprepare to clk_unprepare
+    - ucounts: Fix rlimit max values check
+    - drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf
+    - ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent()
+    - RDMA/hns: Fix RNR retransmission issue for HIP08
+    - IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
+    - RDMA/hns: Replace kfree() with kvfree()
+    - netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
+    - netfilter: fix regression in looped (broad|multi)cast's MAC handling
+    - ARM: dts: imx6qdl-wandboard: Fix Ethernet support
+    - ice: Use xdp_buf instead of rx_buf for xsk zero-copy
+    - ice: xsk: return xsk buffers back to pool when cleaning the ring
+    - net: marvell: prestera: fix incorrect return of port_find
+    - net: marvell: prestera: fix incorrect structure access
+    - qlcnic: potential dereference null pointer of rx_queue->page_ring
+    - tcp: move inet->rx_dst_ifindex to sk->sk_rx_dst_ifindex
+    - ipv6: move inet6_sk(sk)->rx_dst_cookie to sk->sk_rx_dst_cookie
+    - inet: fully convert sk->sk_rx_dst to RCU rules
+    - net: accept UFOv6 packages in virtio_net_hdr_to_skb
+    - net: skip virtio_net_hdr_set_proto if protocol already set
+    - igb: fix deadlock caused by taking RTNL in RPM resume path
+    - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
+    - gpio: virtio: remove timeout
+    - bonding: fix ad_actor_system option setting to default
+    - fjes: Check for error irq
+    - drivers: net: smc911x: Check for error irq
+    - net: ks8851: Check for error irq
+    - sfc: Check null pointer of rx_queue->page_ring
+    - sfc: falcon: Check null pointer of rx_queue->page_ring
+    - asix: fix uninit-value in asix_mdio_read()
+    - asix: fix wrong return value in asix_check_host_enable()
+    - io_uring: zero iocb->ki_pos for stream file types
+    - veth: ensure skb entering GRO are not cloned.
+    - net: stmmac: ptp: fix potentially overflowing expression
+    - net: bridge: Use array_size() helper in copy_to_user()
+    - net: bridge: fix ioctl old_deviceless bridge argument
+    - r8152: fix the force speed doesn't work for RTL8156
+    - net: stmmac: dwmac-visconti: Fix value of ETHER_CLK_SEL_FREQ_SEL_2P5M
+    - pinctrl: bcm2835: Change init order for gpio hogs
+    - hwmon: (lm90) Fix usage of CONFIG2 register in detect function
+    - hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations
+    - hwmon: (lm90) Introduce flag indicating extended temperature support
+    - hwmon: (lm90) Add basic support for TI TMP461
+    - hwmon: (lm90) Drop critical attribute support for MAX6654
+    - ARM: 9160/1: NOMMU: Reload __secondary_data after PROCINFO_INITFUNC
+    - uapi: Fix undefined __always_inline on non-glibc systems
+    - compiler.h: Fix annotation macro misplacement with Clang
+    - platform/x86/intel: Remove X86_PLATFORM_DRIVERS_INTEL
+    - kernel/crash_core: suppress unknown crashkernel parameter warning
+    - Revert "x86/boot: Pull up cmdline preparation and early param parsing"
+    - x86/boot: Move EFI range reservation after cmdline parsing
+    - ALSA: jack: Check the return value of kstrdup()
+    - ALSA: drivers: opl3: Fix incorrect use of vp->state
+    - ALSA: rawmidi - fix the uninitalized user_pversion
+    - ALSA: hda/hdmi: Disable silent stream on GLK
+    - ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
+    - ALSA: hda/realtek: Add new alc285-hp-amp-init model
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
+    - ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
+    - ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s
+    - ASoC: tegra: Add DAPM switches for headphones and mic jack
+    - ASoC: tegra: Restore headphones jack name on Nyan Big
+    - Input: atmel_mxt_ts - fix double free in mxt_read_info_block
+    - ipmi: bail out if init_srcu_struct fails
+    - ipmi: ssif: initialize ssif_info->client early
+    - ipmi: fix initialization when workqueue allocation fails
+    - parisc: Correct completer in lws start
+    - parisc: Fix mask used to select futex spinlock
+    - tee: handle lookup of shm with reference count 0
+    - x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
+    - platform/x86: amd-pmc: only use callbacks for suspend
+    - platform/x86: intel_pmc_core: fix memleak on registration failure
+    - KVM: x86: Always set kvm_run->if_flag
+    - KVM: x86/mmu: Don't advance iterator after restart due to yielding
+    - KVM: nVMX: Synthesize TRIPLE_FAULT for L2 if emulation is required
+    - KVM: VMX: Always clear vmx->fail on emulation_required
+    - KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU
+    - pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines
+    - gpio: dln2: Fix interrupts when replugging the device
+    - mmc: sdhci-tegra: Fix switch to HS400ES mode
+    - mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands
+    - mmc: core: Disable card detect during shutdown
+    - mmc: mmci: stm32: clear DLYB_CR after sending tuning command
+    - ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
+    - ksmbd: fix error code in ndr_read_int32()
+    - ksmbd: fix uninitialized symbol 'pntsd_size'
+    - ksmbd: disable SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
+    - mac80211: fix locking in ieee80211_start_ap error path
+    - mm: mempolicy: fix THP allocations escaping mempolicy restrictions
+    - mm, hwpoison: fix condition in free hugetlb page path
+    - mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
+    - mm/damon/dbgfs: protect targets destructions with kdamond_lock
+    - tee: optee: Fix incorrect page free bug
+    - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
+    - netfs: fix parameter of cleanup()
+    - KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
+    - arm64: dts: lx2160a: fix scl-gpios property name
+    - kfence: fix memory leak when cat kfence objects
+    - Input: iqs626a - prohibit inlining of channel parsing functions
+    - Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
+    - Input: goodix - add id->model mapping for the "9111" model
+    - ASoC: tas2770: Fix setting of high sample rates
+    - ASoC: SOF: Intel: pci-tgl: add new ADL-P variant
+    - ASoC: SOF: Intel: pci-tgl: add ADL-N support
+    - ASoC: rt5682: fix the wrong jack type detected
+    - pinctrl: mediatek: fix global-out-of-bounds issue
+    - hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
+    - hwmon: (lm90) Do not report 'busy' status bit as alarm
+    - r8152: sync ocp base
+    - ax25: NPD bug when detaching AX25 device
+    - hamradio: defer ax25 kfree after unregister_netdev
+    - hamradio: improve the incomplete fix to avoid NPD
+    - tun: avoid double free in tun_free_netdev
+    - phonet/pep: refuse to enable an unbound pipe
+    - Linux 5.15.12
+
+  * Thinkpad E14 Gen2: Kernel panic with trackpad and trackpoint enabled
+    (LP: #1945590) // Jammy update: v5.15.12 upstream stable release
+    (LP: #1956305)
+    - Input: elantech - fix stack out of bound access in
+      elantech_change_report_id()
+
+  * Jammy update: v5.15.11 upstream stable release (LP: #1956302)
+    - reset: tegra-bpmp: Revert Handle errors in BPMP response
+    - KVM: VMX: clear vmx_x86_ops.sync_pir_to_irr if APICv is disabled
+    - KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE
+    - KVM: downgrade two BUG_ONs to WARN_ON_ONCE
+    - x86/kvm: remove unused ack_notifier callbacks
+    - KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid()
+    - mac80211: fix rate control for retransmitted frames
+    - mac80211: fix regression in SSN handling of addba tx
+    - mac80211: mark TX-during-stop for TX in in_reconfig
+    - mac80211: send ADDBA requests using the tid/queue of the aggregation session
+    - mac80211: validate extended element ID is present
+    - firmware: arm_scpi: Fix string overflow in SCPI genpd driver
+    - bpf: Fix kernel address leakage in atomic fetch
+    - bpf, selftests: Add test case for atomic fetch on spilled pointer
+    - bpf: Fix signed bounds propagation after mov32
+    - bpf: Make 32->64 bounds propagation slightly more robust
+    - bpf, selftests: Add test case trying to taint map value pointer
+    - bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg
+    - bpf, selftests: Update test case for atomic cmpxchg on r0 with pointer
+    - vduse: fix memory corruption in vduse_dev_ioctl()
+    - vduse: check that offset is within bounds in get_config()
+    - virtio_ring: Fix querying of maximum DMA mapping size for virtio device
+    - vdpa: check that offsets are within bounds
+    - s390/entry: fix duplicate tracking of irq nesting level
+    - recordmcount.pl: look for jgnop instruction as well as bcrl on s390
+    - arm64: dts: ten64: remove redundant interrupt declaration for gpio-keys
+    - ceph: fix up non-directory creation in SGID directories
+    - dm btree remove: fix use after free in rebalance_children()
+    - audit: improve robustness of the audit queue handling
+    - btrfs: convert latest_bdev type to btrfs_device and rename
+    - btrfs: use latest_dev in btrfs_show_devname
+    - btrfs: update latest_dev when we create a sprout device
+    - btrfs: remove stale comment about the btrfs_show_devname
+    - scsi: ufs: core: Retry START_STOP on UNIT_ATTENTION
+    - arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-
+      edge
+    - arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply
+    - arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
+    - arm64: dts: rockchip: fix audio-supply for Rock Pi 4
+    - arm64: dts: rockchip: fix poweroff on helios64
+    - dmaengine: idxd: add halt interrupt support
+    - dmaengine: idxd: fix calling wq quiesce inside spinlock
+    - mac80211: track only QoS data frames for admission control
+    - tee: amdtee: fix an IS_ERR() vs NULL bug
+    - ceph: fix duplicate increment of opened_inodes metric
+    - ceph: initialize pathlen variable in reconnect_caps_cb
+    - ARM: socfpga: dts: fix qspi node compatible
+    - arm64: dts: imx8mq: remove interconnect property from lcdif
+    - clk: Don't parent clks until the parent is fully registered
+    - soc: imx: Register SoC device only on i.MX boards
+    - iwlwifi: mvm: don't crash on invalid rate w/o STA
+    - virtio: always enter drivers/virtio/
+    - virtio/vsock: fix the transport to work with VMADDR_CID_ANY
+    - vdpa: Consider device id larger than 31
+    - Revert "drm/fb-helper: improve DRM fbdev emulation device names"
+    - selftests: net: Correct ping6 expected rc from 2 to 1
+    - s390/kexec_file: fix error handling when applying relocations
+    - sch_cake: do not call cake_destroy() from cake_init()
+    - inet_diag: fix kernel-infoleak for UDP sockets
+    - netdevsim: don't overwrite read only ethtool parms
+    - selftests: icmp_redirect: pass xfail=0 to log_test()
+    - net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
+    - net: hns3: fix race condition in debugfs
+    - selftests: Add duplicate config only for MD5 VRF tests
+    - selftests: Fix raw socket bind tests with VRF
+    - selftests: Fix IPv6 address bind tests
+    - dmaengine: idxd: fix missed completion on abort path
+    - dmaengine: st_fdma: fix MODULE_ALIAS
+    - drm: simpledrm: fix wrong unit with pixel clock
+    - net/sched: sch_ets: don't remove idle classes from the round-robin list
+    - selftests/net: toeplitz: fix udp option
+    - net: dsa: mv88e6xxx: Unforce speed & duplex in mac_link_down()
+    - selftest/net/forwarding: declare NETIFS p9 p10
+    - mptcp: never allow the PM to close a listener subflow
+    - drm/ast: potential dereference of null pointer
+    - drm/i915/display: Fix an unsigned subtraction which can never be negative.
+    - mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
+    - cfg80211: Acquire wiphy mutex on regulatory work
+    - mac80211: fix lookup when adding AddBA extension element
+    - net: stmmac: fix tc flower deletion for VLAN priority Rx steering
+    - flow_offload: return EOPNOTSUPP for the unsupported mpls action type
+    - rds: memory leak in __rds_conn_create()
+    - ice: Use div64_u64 instead of div_u64 in adjfine
+    - ice: Don't put stale timestamps in the skb
+    - drm/amd/display: Set exit_optimized_pwr_state for DCN31
+    - drm/amd/pm: fix a potential gpu_metrics_table memory leak
+    - mptcp: remove tcp ulp setsockopt support
+    - mptcp: clear 'kern' flag from fallback sockets
+    - mptcp: fix deadlock in __mptcp_push_pending()
+    - soc/tegra: fuse: Fix bitwise vs. logical OR warning
+    - igb: Fix removal of unicast MAC filters of VFs
+    - igbvf: fix double free in `igbvf_probe`
+    - igc: Fix typo in i225 LTR functions
+    - ixgbe: Document how to enable NBASE-T support
+    - ixgbe: set X550 MDIO speed before talking to PHY
+    - netdevsim: Zero-initialize memory for new map's value in function
+      nsim_bpf_map_alloc
+    - net/packet: rx_owner_map depends on pg_vec
+    - net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup
+    - sfc_ef100: potential dereference of null pointer
+    - dsa: mv88e6xxx: fix debug print for SPEED_UNFORCED
+    - net: Fix double 0x prefix print in SKB dump
+    - net/smc: Prevent smc_release() from long blocking
+    - net: systemport: Add global locking for descriptor lifecycle
+    - sit: do not call ipip6_dev_free() from sit_init_net()
+    - afs: Fix mmap
+    - arm64: kexec: Fix missing error code 'ret' warning in load_other_segments()
+    - bpf: Fix extable fixup offset.
+    - bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
+    - powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n
+    - USB: gadget: bRequestType is a bitfield, not a enum
+    - Revert "usb: early: convert to readl_poll_timeout_atomic()"
+    - KVM: x86: Drop guest CPUID check for host initiated writes to
+      MSR_IA32_PERF_CAPABILITIES
+    - tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
+    - USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
+    - usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe
+    - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
+    - PCI/MSI: Mask MSI-X vectors only on success
+    - usb: xhci-mtk: fix list_del warning when enable list debug
+    - usb: xhci: Extend support for runtime power management for AMD's Yellow
+      carp.
+    - usb: cdnsp: Fix incorrect status for control request
+    - usb: cdnsp: Fix incorrect calling of cdnsp_died function
+    - usb: cdnsp: Fix issue in cdnsp_log_ep trace event
+    - usb: cdnsp: Fix lack of spin_lock_irqsave/spin_lock_restore
+    - usb: typec: tcpm: fix tcpm unregister port but leave a pending timer
+    - usb: gadget: u_ether: fix race in setting MAC address in setup phase
+    - USB: serial: cp210x: fix CP2105 GPIO registration
+    - USB: serial: option: add Telit FN990 compositions
+    - selinux: fix sleeping function called from invalid context
+    - btrfs: fix memory leak in __add_inode_ref()
+    - btrfs: fix double free of anon_dev after failure to create subvolume
+    - btrfs: check WRITE_ERR when trying to read an extent buffer
+    - btrfs: fix missing blkdev_put() call in btrfs_scan_one_device()
+    - zonefs: add MODULE_ALIAS_FS
+    - iocost: Fix divide-by-zero on donation from low hweight cgroup
+    - serial: 8250_fintek: Fix garbled text for console
+    - timekeeping: Really make sure wall_to_monotonic isn't positive
+    - cifs: sanitize multiple delimiters in prepath
+    - locking/rtmutex: Fix incorrect condition in rtmutex_spin_on_owner()
+    - riscv: dts: unleashed: Add gpio card detect to mmc-spi-slot
+    - riscv: dts: unmatched: Add gpio card detect to mmc-spi-slot
+    - perf inject: Fix segfault due to close without open
+    - perf inject: Fix segfault due to perf_data__fd() without open
+    - libata: if T_LENGTH is zero, dma direction should be DMA_NONE
+    - powerpc/module_64: Fix livepatching for RO modules
+    - drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
+    - drm/amdgpu: don't override default ECO_BITs setting
+    - drm/amd/pm: fix reading SMU FW version from amdgpu_firmware_info on YC
+    - Revert "can: m_can: remove support for custom bit timing"
+    - can: m_can: make custom bittiming fields const
+    - can: m_can: pci: use custom bit timings for Elkhart Lake
+    - ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
+    - xsk: Do not sleep in poll() when need_wakeup set
+    - mptcp: add missing documented NL params
+    - bpf, x64: Factor out emission of REX byte in more cases
+    - bpf: Fix extable address check.
+    - USB: core: Make do_proc_control() and do_proc_bulk() killable
+    - media: mxl111sf: change mutex_init() location
+    - fuse: annotate lock in fuse_reverse_inval_entry()
+    - ovl: fix warning in ovl_create_real()
+    - scsi: scsi_debug: Don't call kcalloc() if size arg is zero
+    - scsi: scsi_debug: Fix type in min_t to avoid stack OOB
+    - scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
+    - io-wq: remove spurious bit clear on task_work addition
+    - io-wq: check for wq exit after adding new worker task_work
+    - rcu: Mark accesses to rcu_state.n_force_qs
+    - io-wq: drop wqe lock before creating new worker
+    - bus: ti-sysc: Fix variable set but not used warning for reinit_modules
+    - selftests/damon: test debugfs file reads/writes with huge count
+    - Revert "xsk: Do not sleep in poll() when need_wakeup set"
+    - xen/blkfront: harden blkfront against event channel storms
+    - xen/netfront: harden netfront against event channel storms
+    - xen/console: harden hvc_xen against event channel storms
+    - xen/netback: fix rx queue stall detection
+    - xen/netback: don't queue unlimited number of packages
+    - Linux 5.15.11
+
+  * Jammy update: v5.15.10 upstream stable release (LP: #1956301)
+    - nfc: fix segfault in nfc_genl_dump_devices_done
+    - hwmon: (corsair-psu) fix plain integer used as NULL pointer
+    - RDMA: Fix use-after-free in rxe_queue_cleanup
+    - RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow
+    - mtd: rawnand: Fix nand_erase_op delay
+    - mtd: rawnand: Fix nand_choose_best_timings() on unsupported interface
+    - inet: use #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING consistently
+    - dt-bindings: media: nxp,imx7-mipi-csi2: Drop bad if/then schema
+    - clk: qcom: sm6125-gcc: Swap ops of ice and apps on sdcc1
+    - perf bpf_skel: Do not use typedef to avoid error on old clang
+    - netfs: Fix lockdep warning from taking sb_writers whilst holding mmap_lock
+    - RDMA/irdma: Fix a user-after-free in add_pble_prm
+    - RDMA/irdma: Fix a potential memory allocation issue in
+      'irdma_prm_add_pble_mem()'
+    - RDMA/irdma: Report correct WC errors
+    - RDMA/irdma: Don't arm the CQ more than two times if no CE for this CQ
+    - ice: fix FDIR init missing when reset VF
+    - vmxnet3: fix minimum vectors alloc issue
+    - i2c: virtio: fix completion handling
+    - drm/msm: Fix null ptr access msm_ioctl_gem_submit()
+    - drm/msm/a6xx: Fix uinitialized use of gpu_scid
+    - drm/msm/dsi: set default num_data_lanes
+    - drm/msm/dp: Avoid unpowered AUX xfers that caused crashes
+    - KVM: arm64: Save PSTATE early on exit
+    - s390/test_unwind: use raw opcode instead of invalid instruction
+    - Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
+    - net/mlx4_en: Update reported link modes for 1/10G
+    - loop: Use pr_warn_once() for loop_control_remove() warning
+    - ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
+    - ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
+    - parisc/agp: Annotate parisc agp init functions with __init
+    - i2c: rk3x: Handle a spurious start completion interrupt flag
+    - net: netlink: af_netlink: Prevent empty skb by adding a check on len.
+    - drm/amdgpu: cancel the correct hrtimer on exit
+    - drm/amdgpu: check atomic flag to differeniate with legacy path
+    - drm/amd/display: Fix for the no Audio bug with Tiled Displays
+    - drm/amdkfd: fix double free mem structure
+    - drm/amd/display: add connector type check for CRC source set
+    - drm/amdkfd: process_info lock not needed for svm
+    - tracing: Fix a kmemleak false positive in tracing_map
+    - staging: most: dim2: use device release method
+    - fuse: make sure reclaim doesn't write the inode
+    - perf inject: Fix itrace space allowed for new attributes
+    - Linux 5.15.10
+
+  * Jammy update: v5.15.9 upstream stable release (LP: #1955161)
+    - netfilter: selftest: conntrack_vrf.sh: fix file permission
+    - Linux 5.15.9
+
+  * [SRU][I/J/OEM-5.13/OEM-5.14] Fix pci port lost when hotplug dock
+    (LP: #1954646)
+    - PCI: Re-enable Downstream Port LTR after reset or hotplug
+
+  * Add support for NVIDIA EC backlight (LP: #1953286)
+    - platform/x86: Add driver for ACPI WMAA EC-based backlight control
+    - platform/x86: Remove "WMAA" from identifier names in wmaa-backlight-wmi.c
+    - platform/x86: Rename wmaa-backlight-wmi to nvidia-wmi-ec-backlight
+    - [Config] NVIDIA_WMI_EC_BACKLIGHT=m
+
+  * Improve USB Type-C support (LP: #1950974)
+    - usb: typec: ucsi: Always cancel the command if PPM reports BUSY condition
+    - usb: typec: ucsi: Don't stop alt mode registration on busy condition
+    - usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode
+      checking
+    - usb: typec: ucsi: acpi: Reduce the command completion timeout
+    - usb: typec: ucsi: Check the partner alt modes always if there is PD contract
+    - usb: typec: ucsi: Read the PDOs in separate work
+    - usb: typec: ucsi: Better fix for missing unplug events issue
+
+  *  Fix power button wakeup with shared IRQs on AMD platforms (LP: #1953540)
+    - pinctrl: amd: Fix wakeups when IRQ is shared with SCI
+
+  * AMD: Suspend not working when some cores are disabled through cpufreq
+    (LP: #1954930)
+    - ACPI: processor idle: Allow playing dead in C3 state
+
+  * Jammy update: v5.15.8 upstream stable release (LP: #1954931)
+    - Revert "UBUNTU: SAUCE: selftests: fib_tests: assign address to dummy1 for
+      rp_filter tests"
+    - usb: gadget: uvc: fix multiple opens
+    - HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
+    - HID: google: add eel USB id
+    - HID: intel-ish-hid: ipc: only enable IRQ wakeup when requested
+    - HID: add hid_is_usb() function to make it simpler for USB detection
+    - HID: add USB_HID dependancy to hid-prodikeys
+    - HID: add USB_HID dependancy to hid-chicony
+    - HID: add USB_HID dependancy on some USB HID drivers
+    - HID: bigbenff: prevent null pointer dereference
+    - HID: wacom: fix problems when device is not a valid USB device
+    - HID: check for valid USB device for many HID drivers
+    - mtd: dataflash: Add device-tree SPI IDs
+    - mmc: spi: Add device-tree SPI IDs
+    - HID: sony: fix error path in probe
+    - HID: Ignore battery for Elan touchscreen on Asus UX550VE
+    - platform/x86/intel: hid: add quirk to support Surface Go 3
+    - nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups
+    - IB/hfi1: Insure use of smp_processor_id() is preempt disabled
+    - IB/hfi1: Fix early init panic
+    - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
+    - can: kvaser_usb: get CAN clock frequency from device
+    - can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct
+      stats->{rx,tx}_errors counter
+    - can: sja1000: fix use after free in ems_pcmcia_add_card()
+    - can: pch_can: pch_can_rx_normal: fix use after free
+    - can: m_can: m_can_read_fifo: fix memory leak in error branch
+    - can: m_can: pci: fix incorrect reference clock rate
+    - can: m_can: pci: fix iomap_read_fifo() and iomap_write_fifo()
+    - can: m_can: Disable and ignore ELO interrupt
+    - net: dsa: mv88e6xxx: fix "don't use PHY_DETECT on internal PHY's"
+    - net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
+    - x86/sme: Explicitly map new EFI memmap table as encrypted
+    - platform/x86: amd-pmc: Fix s2idle failures on certain AMD laptops
+    - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
+    - selftests: netfilter: add a vrf+conntrack testcase
+    - vrf: don't run conntrack on vrf with !dflt qdisc
+    - bpf, x86: Fix "no previous prototype" warning
+    - bpf, sockmap: Attach map progs to psock early for feature probes
+    - bpf: Make sure bpf_disable_instrumentation() is safe vs preemption.
+    - bpf: Fix the off-by-two error in range markings
+    - ice: ignore dropped packets during init
+    - ethtool: do not perform operations on net devices being unregistered
+    - bonding: make tx_rebalance_counter an atomic
+    - nfp: Fix memory leak in nfp_cpp_area_cache_add()
+    - udp: using datalen to cap max gso segments
+    - netfilter: nft_exthdr: break evaluation if setting TCP option fails
+    - netfilter: conntrack: annotate data-races around ct->timeout
+    - iavf: restore MSI state on reset
+    - iavf: Fix reporting when setting descriptor count
+    - IB/hfi1: Correct guard on eager buffer deallocation
+    - devlink: fix netns refcount leak in devlink_nl_cmd_reload()
+    - net: bcm4908: Handle dma_set_coherent_mask error codes
+    - net: dsa: mv88e6xxx: error handling for serdes_power functions
+    - net: dsa: felix: Fix memory leak in felix_setup_mmio_filtering
+    - net/sched: fq_pie: prevent dismantle issue
+    - net: mvpp2: fix XDP rx queues registering
+    - KVM: x86: Don't WARN if userspace mucks with RCX during string I/O exit
+    - KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI req
+    - KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush
+      hypercall
+    - timers: implement usleep_idle_range()
+    - mm/damon/core: fix fake load reports due to uninterruptible sleeps
+    - mm/slub: fix endianness bug for alloc/free_traces attributes
+    - mm: bdi: initialize bdi_min_ratio when bdi is unregistered
+    - ALSA: ctl: Fix copy of updated id with element read/write
+    - ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
+    - ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
+    - ALSA: pcm: oss: Fix negative period/buffer sizes
+    - ALSA: pcm: oss: Limit the period size to 16MB
+    - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
+    - cifs: Fix crash on unload of cifs_arc4.ko
+    - scsi: qla2xxx: Format log strings only if needed
+    - btrfs: clear extent buffer uptodate when we fail to write it
+    - btrfs: fix re-dirty process of tree-log nodes
+    - btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
+    - btrfs: free exchange changeset on failures
+    - perf intel-pt: Fix some PGE (packet generation enable/control flow packets)
+      usage
+    - perf intel-pt: Fix sync state when a PSB (synchronization) packet is found
+    - perf intel-pt: Fix intel_pt_fup_event() assumptions about setting state type
+    - perf intel-pt: Fix state setting when receiving overflow (OVF) packet
+    - perf intel-pt: Fix next 'err' value, walking trace
+    - perf intel-pt: Fix missing 'instruction' events with 'q' option
+    - perf intel-pt: Fix error timestamp setting on the decoder error path
+    - md: fix update super 1.0 on rdev size change
+    - nfsd: fix use-after-free due to delegation race
+    - nfsd: Fix nsfd startup race (again)
+    - tracefs: Have new files inherit the ownership of their parent
+    - selftests: KVM: avoid failures due to reserved HyperTransport region
+    - hwmon: (pwm-fan) Ensure the fan going on in .probe()
+    - mmc: renesas_sdhi: initialize variable properly when tuning
+    - clk: qcom: regmap-mux: fix parent clock lookup
+    - thermal: int340x: Fix VCoRefLow MMIO bit offset for TGL
+    - drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
+    - libata: add horkage for ASMedia 1092
+    - io_uring: ensure task_work gets run as part of cancelations
+    - wait: add wake_up_pollfree()
+    - binder: use wake_up_pollfree()
+    - signalfd: use wake_up_pollfree()
+    - aio: keep poll requests on waitqueue until completed
+    - aio: fix use-after-free due to missing POLLFREE handling
+    - tracefs: Set all files to the same group ownership as the mount option
+    - i2c: mpc: Use atomic read and fix break condition
+    - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
+    - scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
+    - scsi: scsi_debug: Fix buffer size of REPORT ZONES command
+    - ALSA: usb-audio: Reorder snd_djm_devices[] entries
+    - qede: validate non LSO skb length
+    - PM: runtime: Fix pm_runtime_active() kerneldoc comment
+    - ASoC: rt5682: Fix crash due to out of scope stack vars
+    - ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer
+    - ASoC: codecs: wsa881x: fix return values from kcontrol put
+    - ASoC: codecs: wcd934x: handle channel mappping list correctly
+    - ASoC: codecs: wcd934x: return correct value from mixer put
+    - RDMA/hns: Do not halt commands during reset until later
+    - RDMA/hns: Do not destroy QP resources in the hw resetting phase
+    - hwmon: (dell-smm) Fix warning on /proc/i8k creation error
+    - clk: imx: use module_platform_driver
+    - clk: qcom: clk-alpha-pll: Don't reconfigure running Trion
+    - i40e: Fix failed opcode appearing if handling messages from VF
+    - i40e: Fix pre-set max number of queues for VF
+    - mtd: rawnand: fsmc: Take instruction delay into account
+    - mtd: rawnand: fsmc: Fix timing computation
+    - bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap
+    - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
+    - Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge"
+    - drm/amd/display: Fix DPIA outbox timeout after S3/S4/reset
+    - perf tools: Fix SMT detection fast read path
+    - Documentation/locking/locktypes: Update migrate_disable() bits.
+    - dt-bindings: net: Reintroduce PHY no lane swap binding
+    - tools build: Remove needless libpython-version feature check that breaks
+      test-all fast path
+    - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
+    - net: altera: set a couple error code in probe()
+    - net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
+    - net, neigh: clear whole pneigh_entry at alloc time
+    - net/qla3xxx: fix an error code in ql_adapter_up()
+    - selftests/fib_tests: Rework fib_rp_filter_test()
+    - USB: gadget: detect too-big endpoint 0 requests
+    - USB: gadget: zero allocate endpoint 0 buffers
+    - Revert "usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by default"
+    - usb: core: config: fix validation of wMaxPacketValue entries
+    - usb: core: config: using bit mask instead of individual bits
+    - xhci: avoid race between disable slot command and host runtime suspend
+    - iio: gyro: adxrs290: fix data signedness
+    - iio: trigger: Fix reference counting
+    - iio: trigger: stm32-timer: fix MODULE_ALIAS
+    - iio: stk3310: Don't return error code in interrupt handler
+    - iio: mma8452: Fix trigger reference couting
+    - iio: ltr501: Don't return error code in trigger handler
+    - iio: kxsd9: Don't return error code in trigger handler
+    - iio: itg3200: Call iio_trigger_notify_done() on error
+    - iio: dln2-adc: Fix lockdep complaint
+    - iio: dln2: Check return value of devm_iio_trigger_register()
+    - iio: at91-sama5d2: Fix incorrect sign extension
+    - iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
+    - iio: adc: axp20x_adc: fix charging current reporting on AXP22x
+    - iio: ad7768-1: Call iio_trigger_notify_done() on error
+    - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
+    - nvmem: eeprom: at25: fix FRAM byte_len
+    - bus: mhi: pci_generic: Fix device recovery failed issue
+    - bus: mhi: core: Add support for forced PM resume
+    - csky: fix typo of fpu config macro
+    - irqchip/aspeed-scu: Replace update_bits with write_bits.
+    - irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
+    - irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
+    - aio: Fix incorrect usage of eventfd_signal_allowed()
+    - irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
+    - irqchip: nvic: Fix offset for Interrupt Priority Offsets
+    - misc: fastrpc: fix improper packet size calculation
+    - clocksource/drivers/dw_apb_timer_of: Fix probe failure
+    - bpf: Add selftests to cover packet access corner cases
+    - Linux 5.15.8
+
+  * Can't read/write SD card after running CPU offline test in 5.11.0 and 5.13.0
+    (LP: #1951784) // Jammy update: v5.15.8 upstream stable release
+    (LP: #1954931)
+    - misc: rtsx: Avoid mangling IRQ during runtime PM
+
+  * Enable Landlock by default (LP: #1953192)
+    - [Config] Enable Landlock by default
+
+  * Add s0i3 RTC wake up for AMD systems (LP: #1950013)
+    - platform/x86: amd-pmc: Export Idlemask values based on the APU
+    - platform/x86: amd-pmc: adjust arguments for `amd_pmc_send_cmd`
+    - platform/x86: amd-pmc: Add special handling for timer based S0i3 wakeup
+
+  * Fix runtime power management on USB controller with XHCI_RESET_ON_RESUME
+    flag (LP: #1954369)
+    - SAUCE: xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime
+      suspending
+
+  * Fix System hangs on black screen when reboot (LP: #1949321)
+    - drm/i915/hdmi: convert intel_hdmi_to_dev to intel_hdmi_to_i915
+    - drm/i915: Don't request GMBUS to generate irqs when called while irqs are
+      off
+    - drm/i915/hdmi: Turn DP++ TMDS output buffers back on in encoder->shutdown()
+
+  * require CAP_NET_ADMIN to attach N_HCI ldisc (LP: #1949516)
+    - Bluetooth: hci_ldisc: require CAP_NET_ADMIN to attach N_HCI ldisc
+
+  * mt7921e: Failed to start WM firmware (LP: #1954300)
+    - SAUCE: Bluetooth: btusb: Handle download_firmware failure cases
+    - SAUCE: Bluetooth: btusb: Return error code when getting patch status failed
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Add list of built-in modules to the ABI
+    - [Packaging] abi-check: Process modules.builtin
+    - SAUCE: allow to use __wake_up_pollfree() from GPL modules
+    - [Packaging] enforce xz compression for debs
+    - [Config] update config after v5.15.12
+    - [Packaging] temporarily disable signed v4l2loopback
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 04 Jan 2022 11:22:10 +0100
+
+linux (5.15.0-14.14) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-14.14 -proposed tracker (LP: #1954627)
+
+  * Jammy update: v5.15.7 upstream stable release (LP: #1953731)
+    - ALSA: usb-audio: Restrict rates for the shared clocks
+    - ALSA: usb-audio: Rename early_playback_start flag with lowlatency_playback
+    - ALSA: usb-audio: Disable low-latency playback for free-wheel mode
+    - ALSA: usb-audio: Disable low-latency mode for implicit feedback sync
+    - ALSA: usb-audio: Check available frames for the next packet size
+    - ALSA: usb-audio: Add spinlock to stop_urbs()
+    - ALSA: usb-audio: Improved lowlatency playback support
+    - ALSA: usb-audio: Avoid killing in-flight URBs during draining
+    - ALSA: usb-audio: Fix packet size calculation regression
+    - ALSA: usb-audio: Less restriction for low-latency playback mode
+    - ALSA: usb-audio: Switch back to non-latency mode at a later point
+    - ALSA: usb-audio: Don't start stream for capture at prepare
+    - gfs2: release iopen glock early in evict
+    - gfs2: Fix length of holes reported at end-of-file
+    - powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for
+      persistent memory"
+    - powerpc/pseries/ddw: Do not try direct mapping with persistent memory and
+      one window
+    - drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY
+    - mac80211: do not access the IV when it was stripped
+    - mac80211: fix throughput LED trigger
+    - x86/hyperv: Move required MSRs check to initial platform probing
+    - net/smc: Transfer remaining wait queue entries during fallback
+    - atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
+    - net: return correct error code
+    - pinctrl: qcom: fix unmet dependencies on GPIOLIB for GPIOLIB_IRQCHIP
+    - platform/x86: dell-wmi-descriptor: disable by default
+    - platform/x86: thinkpad_acpi: Add support for dual fan control
+    - platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
+    - s390/setup: avoid using memblock_enforce_memory_limit
+    - btrfs: silence lockdep when reading chunk tree during mount
+    - btrfs: check-integrity: fix a warning on write caching disabled disk
+    - thermal: core: Reset previous low and high trip during thermal zone init
+    - scsi: iscsi: Unblock session then wake up error handler
+    - drm/amd/pm: Remove artificial freq level on Navi1x
+    - drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
+    - drm/amd/amdgpu: fix potential memleak
+    - ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
+    - ata: libahci: Adjust behavior when StorageD3Enable _DSD is set
+    - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in
+      hns_dsaf_ge_srst_by_port()
+    - ipv6: check return value of ipv6_skip_exthdr
+    - net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of
+      bound
+    - net: ethernet: dec: tulip: de4x5: fix possible array overflows in
+      type3_infoblock()
+    - perf sort: Fix the 'weight' sort key behavior
+    - perf sort: Fix the 'ins_lat' sort key behavior
+    - perf sort: Fix the 'p_stage_cyc' sort key behavior
+    - perf inject: Fix ARM SPE handling
+    - perf hist: Fix memory leak of a perf_hpp_fmt
+    - perf report: Fix memory leaks around perf_tip()
+    - tracing: Don't use out-of-sync va_list in event printing
+    - net/smc: Avoid warning of possible recursive locking
+    - ACPI: Add stubs for wakeup handler functions
+    - net/tls: Fix authentication failure in CCM mode
+    - vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
+    - kprobes: Limit max data_size of the kretprobe instances
+    - ALSA: hda/cs8409: Set PMSG_ON earlier inside cs8409 driver
+    - rt2x00: do not mark device gone on EPROTO errors during start
+    - ipmi: Move remove_work to dedicated workqueue
+    - cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
+    - iwlwifi: mvm: retry init flow if failed
+    - dma-buf: system_heap: Use 'for_each_sgtable_sg' in pages free flow
+    - s390/pci: move pseudo-MMIO to prevent MIO overlap
+    - fget: check that the fd still exists after getting a ref to it
+    - sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
+    - sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
+    - scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO
+    - scsi: ufs: ufs-pci: Add support for Intel ADL
+    - ipv6: fix memory leak in fib6_rule_suppress
+    - drm/amd/display: Allow DSC on supported MST branch devices
+    - drm/i915/dp: Perform 30ms delay after source OUI write
+    - KVM: fix avic_set_running for preemptable kernels
+    - KVM: Disallow user memslot with size that exceeds "unsigned long"
+    - KVM: x86/mmu: Fix TLB flush range when handling disconnected pt
+    - KVM: Ensure local memslot copies operate on up-to-date arch-specific data
+    - KVM: x86: ignore APICv if LAPIC is not enabled
+    - KVM: nVMX: Emulate guest TLB flush on nested VM-Enter with new vpid12
+    - KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST
+    - KVM: nVMX: Abide to KVM_REQ_TLB_FLUSH_GUEST request on nested vmentry/vmexit
+    - KVM: VMX: prepare sync_pir_to_irr for running with APICv disabled
+    - KVM: x86: Use a stable condition around all VT-d PI paths
+    - KVM: MMU: shadow nested paging does not have PKU
+    - KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1
+    - KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
+    - KVM: x86: check PIR even for vCPUs with disabled APICv
+    - tracing/histograms: String compares should not care about signed values
+    - net: dsa: mv88e6xxx: Fix application of erratum 4.8 for 88E6393X
+    - net: dsa: mv88e6xxx: Drop unnecessary check in
+      mv88e6393x_serdes_erratum_4_6()
+    - net: dsa: mv88e6xxx: Save power by disabling SerDes trasmitter and receiver
+    - net: dsa: mv88e6xxx: Add fix for erratum 5.2 of 88E6393X family
+    - net: dsa: mv88e6xxx: Fix inband AN for 2500base-x on 88E6393X family
+    - net: dsa: mv88e6xxx: Link in pcs_get_state() if AN is bypassed
+    - wireguard: selftests: increase default dmesg log size
+    - wireguard: allowedips: add missing __rcu annotation to satisfy sparse
+    - wireguard: selftests: actually test for routing loops
+    - wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST
+    - wireguard: device: reset peer src endpoint when netns exits
+    - wireguard: receive: use ring buffer for incoming handshakes
+    - wireguard: receive: drop handshakes if queue lock is contended
+    - wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
+    - i2c: stm32f7: flush TX FIFO upon transfer errors
+    - i2c: stm32f7: recover the bus on access timeout
+    - i2c: stm32f7: stop dma transfer in case of NACK
+    - i2c: cbus-gpio: set atomic transfer callback
+    - natsemi: xtensa: fix section mismatch warnings
+    - tcp: fix page frag corruption on page fault
+    - net: qlogic: qlcnic: Fix a NULL pointer dereference in
+      qlcnic_83xx_add_rings()
+    - net: mpls: Fix notifications when deleting a device
+    - siphash: use _unaligned version by default
+    - arm64: ftrace: add missing BTIs
+    - iwlwifi: fix warnings produced by kernel debug options
+    - net/mlx5e: IPsec: Fix Software parser inner l3 type setting in case of
+      encapsulation
+    - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
+    - selftests: net: Correct case name
+    - net: dsa: b53: Add SPI ID table
+    - mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
+    - ASoC: tegra: Fix wrong value type in ADMAIF
+    - ASoC: tegra: Fix wrong value type in I2S
+    - ASoC: tegra: Fix wrong value type in DMIC
+    - ASoC: tegra: Fix wrong value type in DSPK
+    - ASoC: tegra: Fix kcontrol put callback in ADMAIF
+    - ASoC: tegra: Fix kcontrol put callback in I2S
+    - ASoC: tegra: Fix kcontrol put callback in DMIC
+    - ASoC: tegra: Fix kcontrol put callback in DSPK
+    - ASoC: tegra: Fix kcontrol put callback in AHUB
+    - rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
+    - rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
+    - ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec
+    - net: stmmac: Avoid DMA_CHAN_CONTROL write if no Split Header support
+    - net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ
+      is available
+    - net: marvell: mvpp2: Fix the computation of shared CPUs
+    - dpaa2-eth: destroy workqueue at the end of remove function
+    - octeontx2-af: Fix a memleak bug in rvu_mbox_init()
+    - net: annotate data-races on txq->xmit_lock_owner
+    - ipv4: convert fib_num_tclassid_users to atomic_t
+    - net/smc: fix wrong list_del in smc_lgr_cleanup_early
+    - net/rds: correct socket tunable error in rds_tcp_tune()
+    - net/smc: Keep smc_close_final rc during active close
+    - drm/msm/a6xx: Allocate enough space for GMU registers
+    - drm/msm: Do hw_init() before capturing GPU state
+    - drm/vc4: kms: Wait for the commit before increasing our clock rate
+    - drm/vc4: kms: Fix return code check
+    - drm/vc4: kms: Add missing drm_crtc_commit_put
+    - drm/vc4: kms: Clear the HVS FIFO commit pointer once done
+    - drm/vc4: kms: Don't duplicate pending commit
+    - drm/vc4: kms: Fix previous HVS commit wait
+    - atlantic: Increase delay for fw transactions
+    - atlatnic: enable Nbase-t speeds with base-t
+    - atlantic: Fix to display FW bundle version instead of FW mac version.
+    - atlantic: Add missing DIDs and fix 115c.
+    - Remove Half duplex mode speed capabilities.
+    - atlantic: Fix statistics logic for production hardware
+    - atlantic: Remove warn trace message.
+    - KVM: x86/mmu: Skip tlb flush if it has been done in zap_gfn_range()
+    - KVM: x86/mmu: Pass parameter flush as false in
+      kvm_tdp_mmu_zap_collapsible_sptes()
+    - drm/msm/devfreq: Fix OPP refcnt leak
+    - drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP
+    - drm/msm: Fix wait_fence submitqueue leak
+    - drm/msm: Restore error return on invalid fence
+    - ASoC: rk817: Add module alias for rk817-codec
+    - iwlwifi: Fix memory leaks in error handling path
+    - KVM: X86: Fix when shadow_root_level=5 && guest root_level<4
+    - KVM: SEV: initialize regions_list of a mirror VM
+    - net/mlx5e: Fix missing IPsec statistics on uplink representor
+    - net/mlx5: Move MODIFY_RQT command to ignore list in internal error state
+    - net/mlx5: E-switch, Respect BW share of the new group
+    - net/mlx5: E-Switch, fix single FDB creation on BlueField
+    - net/mlx5: E-Switch, Check group pointer before reading bw_share value
+    - KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
+    - KVM: VMX: Set failure code in prepare_vmcs02()
+    - mctp: Don't let RTM_DELROUTE delete local routes
+    - Revert "drm/i915: Implement Wa_1508744258"
+    - io-wq: don't retry task_work creation failure on fatal conditions
+    - x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
+    - x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
+    - x86/entry: Use the correct fence macro after swapgs in kernel CR3
+    - x86/xen: Add xenpv_restore_regs_and_return_to_usermode()
+    - preempt/dynamic: Fix setup_preempt_mode() return value
+    - sched/uclamp: Fix rq->uclamp_max not set on first enqueue
+    - KVM: SEV: Return appropriate error codes if SEV-ES scratch setup fails
+    - KVM: x86/mmu: Rename slot_handle_leaf to slot_handle_level_4k
+    - KVM: x86/mmu: Remove spurious TLB flushes in TDP MMU zap collapsible path
+    - net/mlx5e: Rename lro_timeout to packet_merge_timeout
+    - net/mlx5e: Rename TIR lro functions to TIR packet merge functions
+    - net/mlx5e: Sync TIR params updates against concurrent create/modify
+    - serial: 8250_bcm7271: UART errors after resuming from S2
+    - parisc: Fix KBUILD_IMAGE for self-extracting kernel
+    - parisc: Fix "make install" on newer debian releases
+    - parisc: Mark cr16 CPU clocksource unstable on all SMP machines
+    - vgacon: Propagate console boot parameters before calling `vc_resize'
+    - xhci: Fix commad ring abort, write all 64 bits to CRCR register.
+    - USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
+    - usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
+    - usb: cdns3: gadget: fix new urb never complete if ep cancel previous
+      requests
+    - usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()
+    - x86/tsc: Add a timer to make sure TSC_adjust is always checked
+    - x86/tsc: Disable clocksource watchdog for TSC on qualified platorms
+    - x86/64/mm: Map all kernel memory into trampoline_pgd
+    - tty: serial: msm_serial: Deactivate RX DMA for polling support
+    - serial: pl011: Add ACPI SBSA UART match id
+    - serial: tegra: Change lower tolerance baud rate limit for tegra20 and
+      tegra30
+    - serial: core: fix transmit-buffer reset and memleak
+    - serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
+    - serial: 8250_pci: rewrite pericom_do_set_divisor()
+    - serial: 8250: Fix RTS modem control while in rs485 mode
+    - serial: liteuart: Fix NULL pointer dereference in ->remove()
+    - serial: liteuart: fix use-after-free and memleak on unbind
+    - serial: liteuart: fix minor-number leak on probe errors
+    - ipmi: msghandler: Make symbol 'remove_work_wq' static
+    - Linux 5.15.7
+
+  * Updates to ib_peer_memory requested by Nvidia (LP: #1947206)
+    - SAUCE: RDMA/core: Updated ib_peer_memory
+    - SAUCE: RDMA/core: ib_peer_memory fix build errors
+
+  * Jammy update: v5.15.6 upstream stable release (LP: #1953370)
+    - scsi: sd: Fix sd_do_mode_sense() buffer length handling
+    - ACPI: Get acpi_device's parent from the parent field
+    - ACPI: CPPC: Add NULL pointer check to cppc_get_perf()
+    - USB: serial: pl2303: fix GC type detection
+    - USB: serial: option: add Telit LE910S1 0x9200 composition
+    - USB: serial: option: add Fibocom FM101-GL variants
+    - usb: dwc2: gadget: Fix ISOC flow for elapsed frames
+    - usb: dwc2: hcd_queue: Fix use of floating point literal
+    - usb: dwc3: leave default DMA for PCI devices
+    - usb: dwc3: core: Revise GHWPARAMS9 offset
+    - usb: dwc3: gadget: Ignore NoStream after End Transfer
+    - usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer
+    - usb: dwc3: gadget: Fix null pointer exception
+    - net: usb: Correct PHY handling of smsc95xx
+    - net: nexthop: fix null pointer dereference when IPv6 is not enabled
+    - usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe
+    - usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts
+    - usb: xhci: tegra: Check padctrl interrupt presence in device tree
+    - usb: hub: Fix usb enumeration issue due to address0 race
+    - usb: hub: Fix locking issues with address0_mutex
+    - binder: fix test regression due to sender_euid change
+    - ALSA: ctxfi: Fix out-of-range access
+    - ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100
+    - ALSA: hda/realtek: Fix LED on HP ProBook 435 G7
+    - media: cec: copy sequence field for the reply
+    - Revert "parisc: Fix backtrace to always include init funtion names"
+    - HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts
+    - staging/fbtft: Fix backlight
+    - staging: greybus: Add missing rwsem around snd_ctl_remove() calls
+    - staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
+    - staging: r8188eu: Use kzalloc() with GFP_ATOMIC in atomic context
+    - staging: r8188eu: Fix breakage introduced when 5G code was removed
+    - staging: r8188eu: use GFP_ATOMIC under spinlock
+    - staging: r8188eu: fix a memory leak in rtw_wx_read32()
+    - fuse: release pipe buf after last use
+    - xen: don't continue xenstore initialization in case of errors
+    - xen: detect uninitialized xenbus in xenbus_init
+    - io_uring: correct link-list traversal locking
+    - io_uring: fail cancellation for EXITING tasks
+    - io_uring: fix link traversal locking
+    - drm/amdgpu: IH process reset count when restart
+    - drm/amdgpu/pm: fix powerplay OD interface
+    - drm/nouveau: recognise GA106
+    - ksmbd: downgrade addition info error msg to debug in smb2_get_info_sec()
+    - ksmbd: contain default data stream even if xattr is empty
+    - ksmbd: fix memleak in get_file_stream_info()
+    - KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB
+    - tracing/uprobe: Fix uprobe_perf_open probes iteration
+    - tracing: Fix pid filtering when triggers are attached
+    - mmc: sdhci-esdhc-imx: disable CMDQ support
+    - mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB
+    - mdio: aspeed: Fix "Link is Down" issue
+    - arm64: mm: Fix VM_BUG_ON(mm != &init_mm) for trans_pgd
+    - cpufreq: intel_pstate: Fix active mode offline/online EPP handling
+    - powerpc/32: Fix hardlockup on vmap stack overflow
+    - iomap: Fix inline extent handling in iomap_readpage
+    - NFSv42: Fix pagecache invalidation after COPY/CLONE
+    - PCI: aardvark: Deduplicate code in advk_pcie_rd_conf()
+    - PCI: aardvark: Implement re-issuing config requests on CRS response
+    - PCI: aardvark: Simplify initialization of rootcap on virtual bridge
+    - PCI: aardvark: Fix link training
+    - drm/amd/display: Fix OLED brightness control on eDP
+    - proc/vmcore: fix clearing user buffer by properly using clear_user()
+    - ASoC: SOF: Intel: hda: fix hotplug when only codec is suspended
+    - netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY
+    - netfilter: ctnetlink: do not erase error code with EINVAL
+    - netfilter: ipvs: Fix reuse connection if RS weight is 0
+    - netfilter: flowtable: fix IPv6 tunnel addr match
+    - media: v4l2-core: fix VIDIOC_DQEVENT handling on non-x86
+    - firmware: arm_scmi: Fix null de-reference on error path
+    - ARM: dts: BCM5301X: Fix I2C controller interrupt
+    - ARM: dts: BCM5301X: Add interrupt properties to GPIO node
+    - ARM: dts: bcm2711: Fix PCIe interrupts
+    - ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer
+    - ASoC: qdsp6: q6asm: fix q6asm_dai_prepare error handling
+    - ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
+    - ASoC: codecs: wcd938x: fix volatile register range
+    - ASoC: codecs: wcd934x: return error code correctly from hw_params
+    - ASoC: codecs: lpass-rx-macro: fix HPHR setting CLSH mask
+    - net: ieee802154: handle iftypes as u32
+    - firmware: arm_scmi: Fix base agent discover response
+    - firmware: arm_scmi: pm: Propagate return value to caller
+    - ASoC: stm32: i2s: fix 32 bits channel length without mclk
+    - NFSv42: Don't fail clone() unless the OP_CLONE operation failed
+    - ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
+    - drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks
+    - scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo()
+    - scsi: mpt3sas: Fix kernel panic during drive powercycle test
+    - scsi: mpt3sas: Fix system going into read-only mode
+    - scsi: mpt3sas: Fix incorrect system timestamp
+    - drm/vc4: fix error code in vc4_create_object()
+    - drm/aspeed: Fix vga_pw sysfs output
+    - net: marvell: prestera: fix brige port operation
+    - net: marvell: prestera: fix double free issue on err path
+    - HID: input: Fix parsing of HID_CP_CONSUMER_CONTROL fields
+    - HID: input: set usage type to key on keycode remap
+    - HID: magicmouse: prevent division by 0 on scroll
+    - iavf: Prevent changing static ITR values if adaptive moderation is on
+    - iavf: Fix refreshing iavf adapter stats on ethtool request
+    - iavf: Fix VLAN feature flags after VFR
+    - x86/pvh: add prototype for xen_pvh_init()
+    - xen/pvh: add missing prototype to header
+    - ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec
+    - mptcp: fix delack timer
+    - mptcp: use delegate action to schedule 3rd ack retrans
+    - af_unix: fix regression in read after shutdown
+    - firmware: smccc: Fix check for ARCH_SOC_ID not implemented
+    - ipv6: fix typos in __ip6_finish_output()
+    - nfp: checking parameter process for rx-usecs/tx-usecs is invalid
+    - net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls
+    - net: ipv6: add fib6_nh_release_dsts stub
+    - net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group
+    - ice: fix vsi->txq_map sizing
+    - ice: avoid bpf_prog refcount underflow
+    - scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
+    - scsi: scsi_debug: Zero clear zones at reset write pointer
+    - erofs: fix deadlock when shrink erofs slab
+    - i2c: virtio: disable timeout handling
+    - net/smc: Ensure the active closing peer first closes clcsock
+    - mlxsw: spectrum: Protect driver from buggy firmware
+    - net: ipa: directly disable ipa-setup-ready interrupt
+    - net: ipa: separate disabling setup from modem stop
+    - net: ipa: kill ipa_cmd_pipeline_clear()
+    - net: marvell: mvpp2: increase MTU limit when XDP enabled
+    - cpufreq: intel_pstate: Add Ice Lake server to out-of-band IDs
+    - nvmet-tcp: fix incomplete data digest send
+    - drm/hyperv: Fix device removal on Gen1 VMs
+    - arm64: uaccess: avoid blocking within critical sections
+    - net/ncsi : Add payload to be 32-bit aligned to fix dropped packets
+    - PM: hibernate: use correct mode for swsusp_close()
+    - drm/amd/display: Fix DPIA outbox timeout after GPU reset
+    - drm/amd/display: Set plane update flags for all planes in reset
+    - tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited
+      flows
+    - lan743x: fix deadlock in lan743x_phy_link_status_change()
+    - net: phylink: Force link down and retrigger resolve on interface change
+    - net: phylink: Force retrigger in case of latched link-fail indicator
+    - net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
+    - net/smc: Fix loop in smc_listen
+    - nvmet: use IOCB_NOWAIT only if the filesystem supports it
+    - igb: fix netpoll exit with traffic
+    - MIPS: loongson64: fix FTLB configuration
+    - MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
+    - tls: splice_read: fix record type check
+    - tls: splice_read: fix accessing pre-processed records
+    - tls: fix replacing proto_ops
+    - net: stmmac: Disable Tx queues when reconfiguring the interface
+    - net/sched: sch_ets: don't peek at classes beyond 'nbands'
+    - ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
+    - net: vlan: fix underflow for the real_dev refcnt
+    - net/smc: Don't call clcsock shutdown twice when smc shutdown
+    - net: hns3: fix VF RSS failed problem after PF enable multi-TCs
+    - net: hns3: fix incorrect components info of ethtool --reset command
+    - net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP
+    - net: mscc: ocelot: correctly report the timestamping RX filters in ethtool
+    - locking/rwsem: Make handoff bit handling more consistent
+    - perf: Ignore sigtrap for tracepoints destined for other tasks
+    - sched/scs: Reset task stack state in bringup_cpu()
+    - iommu/rockchip: Fix PAGE_DESC_HI_MASKs for RK3568
+    - iommu/vt-d: Fix unmap_pages support
+    - f2fs: quota: fix potential deadlock
+    - f2fs: set SBI_NEED_FSCK flag when inconsistent node block found
+    - riscv: dts: microchip: fix board compatible
+    - riscv: dts: microchip: drop duplicated MMC/SDHC node
+    - cifs: nosharesock should not share socket with future sessions
+    - ceph: properly handle statfs on multifs setups
+    - iommu/amd: Clarify AMD IOMMUv2 initialization messages
+    - vdpa_sim: avoid putting an uninitialized iova_domain
+    - vhost/vsock: fix incorrect used length reported to the guest
+    - ksmbd: Fix an error handling path in 'smb2_sess_setup()'
+    - tracing: Check pid filtering when creating events
+    - cifs: nosharesock should be set on new server
+    - io_uring: fix soft lockup when call __io_remove_buffers
+    - firmware: arm_scmi: Fix type error assignment in voltage protocol
+    - firmware: arm_scmi: Fix type error in sensor protocol
+    - docs: accounting: update delay-accounting.rst reference
+    - blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and
+      disk_release()
+    - block: avoid to quiesce queue in elevator_init_mq
+    - drm/amdgpu/gfx10: add wraparound gpu counter check for APUs as well
+    - drm/amdgpu/gfx9: switch to golden tsc registers for renoir+
+    - Linux 5.15.6
+
+  * Fix bogus HDMI audio interface  (LP: #1953208)
+    - ALSA: hda/hdmi: Consider ELD is invalid when no SAD is present
+
+  * Miscellaneous Ubuntu changes
+    - [Config] re-enabled UBSAN without TRAP
+    - SAUCE: ipv6: fix NULL pointer dereference in ip6_output()
+    - SAUCE: RDMA/core: Introduce peer memory interface
+    - [Config] toolchain version update
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] Temporarily disable signing for ppc64el and s390x"
+    - Revert "UBUNTU: SAUCE: vt -- maintain bootloader screen mode and content
+      until vt switch"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 13 Dec 2021 12:13:17 +0100
+
+linux (5.15.0-13.13) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-13.13 -proposed tracker (LP: #1952583)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Jammy update: v5.15.5 upstream stable release (LP: #1952579)
+    - arm64: zynqmp: Do not duplicate flash partition label property
+    - arm64: zynqmp: Fix serial compatible string
+    - clk: sunxi-ng: Unregister clocks/resets when unbinding
+    - ARM: dts: sunxi: Fix OPPs node name
+    - arm64: dts: allwinner: h5: Fix GPU thermal zone node name
+    - arm64: dts: allwinner: a100: Fix thermal zone node name
+    - staging: wfx: ensure IRQ is ready before enabling it
+    - ARM: dts: BCM5301X: Fix nodes names
+    - ARM: dts: BCM5301X: Fix MDIO mux binding
+    - ARM: dts: NSP: Fix mpcore, mmc node names
+    - arm64: dts: broadcom: bcm4908: Move reboot syscon out of bus
+    - scsi: pm80xx: Fix memory leak during rmmod
+    - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
+    - ASoC: mediatek: mt8195: Add missing of_node_put()
+    - arm64: dts: rockchip: Disable CDN DP on Pinebook Pro
+    - arm64: dts: hisilicon: fix arm,sp805 compatible string
+    - RDMA/bnxt_re: Check if the vlan is valid before reporting
+    - bus: ti-sysc: Add quirk handling for reinit on context lost
+    - bus: ti-sysc: Use context lost quirk for otg
+    - usb: musb: tusb6010: check return value after calling
+      platform_get_resource()
+    - usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
+    - ARM: dts: ux500: Skomer regulator fixes
+    - staging: rtl8723bs: remove possible deadlock when disconnect (v2)
+    - staging: rtl8723bs: remove a second possible deadlock
+    - staging: rtl8723bs: remove a third possible deadlock
+    - ARM: BCM53016: Specify switch ports for Meraki MR32
+    - arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency
+    - arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property
+    - arm64: dts: qcom: ipq8074: Fix qcom,controlled-remotely property
+    - arm64: dts: qcom: sdm845: Fix qcom,controlled-remotely property
+    - arm64: dts: freescale: fix arm,sp805 compatible string
+    - arm64: dts: ls1012a: Add serial alias for ls1012a-rdb
+    - RDMA/rxe: Separate HW and SW l/rkeys
+    - ASoC: SOF: Intel: hda-dai: fix potential locking issue
+    - scsi: core: Fix scsi_mode_sense() buffer length handling
+    - ALSA: usb-audio: disable implicit feedback sync for Behringer UFX1204 and
+      UFX1604
+    - clk: imx: imx6ul: Move csi_sel mux to correct base register
+    - ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
+    - ASoC: rt5651: Use IRQF_NO_AUTOEN when requesting the IRQ
+    - ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect
+    - scsi: advansys: Fix kernel pointer leak
+    - scsi: smartpqi: Add controller handshake during kdump
+    - arm64: dts: imx8mm-kontron: Fix reset delays for ethernet PHY
+    - ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336
+      codec
+    - ASoC: Intel: soc-acpi: add missing quirk for TGL SDCA single amp
+    - ASoC: Intel: sof_sdw: add missing quirk for Dell SKU 0A45
+    - firmware_loader: fix pre-allocated buf built-in firmware use
+    - HID: multitouch: disable sticky fingers for UPERFECT Y
+    - ALSA: usb-audio: Add support for the Pioneer DJM 750MK2 Mixer/Soundcard
+    - ARM: dts: omap: fix gpmc,mux-add-data type
+    - usb: host: ohci-tmio: check return value after calling
+      platform_get_resource()
+    - ASoC: rt5682: fix a little pop while playback
+    - ARM: dts: ls1021a: move thermal-zones node out of soc/
+    - ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash
+    - ALSA: ISA: not for M68K
+    - iommu/vt-d: Do not falsely log intel_iommu is unsupported kernel option
+    - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
+    - MIPS: sni: Fix the build
+    - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
+    - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
+    - scsi: target: Fix ordered tag handling
+    - scsi: target: Fix alua_tg_pt_gps_count tracking
+    - iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr()
+    - RDMA/core: Use kvzalloc when allocating the struct ib_port
+    - scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
+    - scsi: lpfc: Fix link down processing to address NULL pointer dereference
+    - scsi: lpfc: Allow fabric node recovery if recovery is in progress before
+      devloss
+    - memory: tegra20-emc: Add runtime dependency on devfreq governor module
+    - powerpc/5200: dts: fix memory node unit name
+    - ARM: dts: qcom: fix memory and mdio nodes naming for RB3011
+    - arm64: dts: qcom: Fix node name of rpm-msg-ram device nodes
+    - ALSA: gus: fix null pointer dereference on pointer block
+    - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
+    - clk: at91: sama7g5: remove prescaler part of master clock
+    - iommu/dart: Initialize DART_STREAMS_ENABLE
+    - powerpc/dcr: Use cmplwi instead of 3-argument cmpli
+    - powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST
+    - sh: check return code of request_irq
+    - maple: fix wrong return value of maple_bus_init().
+    - f2fs: fix up f2fs_lookup tracepoints
+    - f2fs: fix to use WHINT_MODE
+    - f2fs: fix wrong condition to trigger background checkpoint correctly
+    - sh: fix kconfig unmet dependency warning for FRAME_POINTER
+    - sh: math-emu: drop unused functions
+    - sh: define __BIG_ENDIAN for math-emu
+    - f2fs: compress: disallow disabling compress on non-empty compressed file
+    - f2fs: fix incorrect return value in f2fs_sanity_check_ckpt()
+    - clk: ingenic: Fix bugs with divided dividers
+    - clk/ast2600: Fix soc revision for AHB
+    - clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk
+    - KVM: arm64: Fix host stage-2 finalization
+    - mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
+    - MIPS: boot/compressed/: add __bswapdi2() to target for ZSTD decompression
+    - sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
+    - sched/fair: Prevent dead task groups from regaining cfs_rq's
+    - perf/x86/vlbr: Add c->flags to vlbr event constraints
+    - blkcg: Remove extra blkcg_bio_issue_init
+    - tracing/histogram: Do not copy the fixed-size char array field over the
+      field size
+    - perf bpf: Avoid memory leak from perf_env__insert_btf()
+    - perf bench futex: Fix memory leak of perf_cpu_map__new()
+    - perf tests: Remove bash construct from record+zstd_comp_decomp.sh
+    - drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame
+    - bpf: Fix inner map state pruning regression.
+    - samples/bpf: Fix summary per-sec stats in xdp_sample_user
+    - samples/bpf: Fix incorrect use of strlen in xdp_redirect_cpu
+    - selftests: net: switch to socat in the GSO GRE test
+    - net/ipa: ipa_resource: Fix wrong for loop range
+    - tcp: Fix uninitialized access in skb frags array for Rx 0cp.
+    - tracing: Add length protection to histogram string copies
+    - nl80211: fix radio statistics in survey dump
+    - mac80211: fix monitor_sdata RCU/locking assertions
+    - net: ipa: HOLB register sometimes must be written twice
+    - net: ipa: disable HOLB drop when updating timer
+    - selftests: gpio: fix gpio compiling error
+    - net: bnx2x: fix variable dereferenced before check
+    - bnxt_en: reject indirect blk offload when hw-tc-offload is off
+    - tipc: only accept encrypted MSG_CRYPTO msgs
+    - sock: fix /proc/net/sockstat underflow in sk_clone_lock()
+    - net/smc: Make sure the link_id is unique
+    - NFSD: Fix exposure in nfsd4_decode_bitmap()
+    - iavf: Fix return of set the new channel count
+    - iavf: check for null in iavf_fix_features
+    - iavf: free q_vectors before queues in iavf_disable_vf
+    - iavf: don't clear a lock we don't hold
+    - iavf: Fix failure to exit out from last all-multicast mode
+    - iavf: prevent accidental free of filter structure
+    - iavf: validate pointers
+    - iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
+    - iavf: Fix for setting queues to 0
+    - iavf: Restore VLAN filters after link down
+    - bpf: Fix toctou on read-only map's constant scalar tracking
+    - MIPS: generic/yamon-dt: fix uninitialized variable error
+    - mips: bcm63xx: add support for clk_get_parent()
+    - mips: lantiq: add support for clk_get_parent()
+    - gpio: rockchip: needs GENERIC_IRQ_CHIP to fix build errors
+    - platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
+    - platform/x86: think-lmi: Abort probe on analyze failure
+    - udp: Validate checksum in udp_read_sock()
+    - btrfs: make 1-bit bit-fields of scrub_page unsigned int
+    - RDMA/core: Set send and receive CQ before forwarding to the driver
+    - net/mlx5e: kTLS, Fix crash in RX resync flow
+    - net/mlx5e: Wait for concurrent flow deletion during neigh/fib events
+    - net/mlx5: E-Switch, Fix resetting of encap mode when entering switchdev
+    - net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
+    - net/mlx5: Update error handler for UCTX and UMEM
+    - net/mlx5: E-Switch, rebuild lag only when needed
+    - net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
+    - net/mlx5: Lag, update tracker when state change event received
+    - net/mlx5: E-Switch, return error if encap isn't supported
+    - scsi: ufs: core: Improve SCSI abort handling
+    - scsi: core: sysfs: Fix hang when device state is set via sysfs
+    - scsi: ufs: core: Fix task management completion timeout race
+    - scsi: ufs: core: Fix another task management completion race
+    - net: mvmdio: fix compilation warning
+    - net: sched: act_mirred: drop dst for the direction from egress to ingress
+    - net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
+    - net: virtio_net_hdr_to_skb: count transport header in UFO
+    - i40e: Fix correct max_pkt_size on VF RX queue
+    - i40e: Fix NULL ptr dereference on VSI filter sync
+    - i40e: Fix changing previously set num_queue_pairs for PFs
+    - i40e: Fix ping is lost after configuring ADq on VF
+    - RDMA/mlx4: Do not fail the registration on port stats
+    - i40e: Fix warning message and call stack during rmmod i40e driver
+    - i40e: Fix creation of first queue by omitting it if is not power of two
+    - i40e: Fix display error code in dmesg
+    - NFC: reorganize the functions in nci_request
+    - NFC: reorder the logic in nfc_{un,}register_device
+    - NFC: add NCI_UNREG flag to eliminate the race
+    - e100: fix device suspend/resume
+    - ptp: ocp: Fix a couple NULL vs IS_ERR() checks
+    - tools build: Fix removal of feature-sync-compare-and-swap feature detection
+    - riscv: fix building external modules
+    - KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr()
+    - powerpc: clean vdso32 and vdso64 directories
+    - powerpc/pseries: rename numa_dist_table to form2_distances
+    - powerpc/pseries: Fix numa FORM2 parsing fallback code
+    - pinctrl: qcom: sdm845: Enable dual edge errata
+    - pinctrl: qcom: sm8350: Correct UFS and SDC offsets
+    - perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
+    - perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
+    - perf/x86/intel/uncore: Fix IIO event constraints for Snowridge
+    - s390/kexec: fix return code handling
+    - blk-cgroup: fix missing put device in error path from blkg_conf_pref()
+    - dmaengine: remove debugfs #ifdef
+    - tun: fix bonding active backup with arp monitoring
+    - Revert "mark pstore-blk as broken"
+    - pstore/blk: Use "%lu" to format unsigned long
+    - hexagon: export raw I/O routines for modules
+    - hexagon: clean up timer-regs.h
+    - tipc: check for null after calling kmemdup
+    - ipc: WARN if trying to remove ipc object which is absent
+    - shm: extend forced shm destroy to support objects from several IPC nses
+    - mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
+    - hugetlb, userfaultfd: fix reservation restore on userfaultfd error
+    - kmap_local: don't assume kmap PTEs are linear arrays in memory
+    - mm/damon/dbgfs: use '__GFP_NOWARN' for user-specified size buffer allocation
+    - mm/damon/dbgfs: fix missed use of damon_dbgfs_lock
+    - x86/boot: Pull up cmdline preparation and early param parsing
+    - x86/sgx: Fix free page accounting
+    - x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
+    - KVM: x86: Assume a 64-bit hypercall for guests with protected state
+    - KVM: x86: Fix uninitialized eoi_exit_bitmap usage in vcpu_load_eoi_exitmap()
+    - KVM: x86/mmu: include EFER.LMA in extended mmu role
+    - KVM: x86/xen: Fix get_attr of KVM_XEN_ATTR_TYPE_SHARED_INFO
+    - powerpc/signal32: Fix sigset_t copy
+    - powerpc/xive: Change IRQ domain to a tree domain
+    - powerpc/8xx: Fix pinned TLBs with CONFIG_STRICT_KERNEL_RWX
+    - Revert "drm/i915/tgl/dsi: Gate the ddi clocks after pll mapping"
+    - Revert "parisc: Reduce sigreturn trampoline to 3 instructions"
+    - ata: libata: improve ata_read_log_page() error message
+    - ata: libata: add missing ata_identify_page_supported() calls
+    - scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id()
+    - pinctrl: ralink: include 'ralink_regs.h' in 'pinctrl-mt7620.c'
+    - s390/setup: avoid reserving memory above identity mapping
+    - s390/boot: simplify and fix kernel memory layout setup
+    - s390/vdso: filter out -mstack-guard and -mstack-size
+    - s390/kexec: fix memory leak of ipl report buffer
+    - s390/dump: fix copying to user-space of swapped kdump oldmem
+    - block: Check ADMIN before NICE for IOPRIO_CLASS_RT
+    - fbdev: Prevent probing generic drivers if a FB is already registered
+    - KVM: SEV: Disallow COPY_ENC_CONTEXT_FROM if target has created vCPUs
+    - KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested
+      state load
+    - drm/cma-helper: Release non-coherent memory with dma_free_noncoherent()
+    - printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces
+    - udf: Fix crash after seekdir
+    - spi: fix use-after-free of the add_lock mutex
+    - net: stmmac: socfpga: add runtime suspend/resume callback for stratix10
+      platform
+    - Drivers: hv: balloon: Use VMBUS_RING_SIZE() wrapper for dm_ring_size
+    - btrfs: fix memory ordering between normal and ordered work functions
+    - fs: handle circular mappings correctly
+    - net: stmmac: Fix signed/unsigned wreckage
+    - parisc/sticon: fix reverse colors
+    - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
+    - mac80211: fix radiotap header generation
+    - mac80211: drop check for DONT_REORDER in __ieee80211_select_queue
+    - drm/amd/display: Update swizzle mode enums
+    - drm/amd/display: Limit max DSC target bpp for specific monitors
+    - drm/i915/guc: Fix outstanding G2H accounting
+    - drm/i915/guc: Don't enable scheduling on a banned context, guc_id invalid,
+      not registered
+    - drm/i915/guc: Workaround reset G2H is received after schedule done G2H
+    - drm/i915/guc: Don't drop ce->guc_active.lock when unwinding context
+    - drm/i915/guc: Unwind context requests in reverse order
+    - drm/udl: fix control-message timeout
+    - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
+    - drm/nouveau: Add a dedicated mutex for the clients list
+    - drm/nouveau: use drm_dev_unplug() during device removal
+    - drm/nouveau: clean up all clients on device removal
+    - drm/i915/dp: Ensure sink rate values are always valid
+    - drm/i915/dp: Ensure max link params are always valid
+    - drm/i915: Fix type1 DVI DP dual mode adapter heuristic for modern platforms
+    - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga
+      and dvi connectors
+    - drm/amd/pm: avoid duplicate powergate/ungate setting
+    - signal: Implement force_fatal_sig
+    - exit/syscall_user_dispatch: Send ordinary signals on failure
+    - signal/powerpc: On swapcontext failure force SIGSEGV
+    - signal/s390: Use force_sigsegv in default_trap_handler
+    - signal/sparc32: Exit with a fatal signal when try_to_clear_window_buffer
+      fails
+    - signal/sparc32: In setup_rt_frame and setup_fram use force_fatal_sig
+    - signal/vm86_32: Properly send SIGSEGV when the vm86 state cannot be saved.
+    - signal/x86: In emulate_vsyscall force a signal instead of calling do_exit
+    - signal: Replace force_sigsegv(SIGSEGV) with force_fatal_sig(SIGSEGV)
+    - signal: Don't always set SA_IMMUTABLE for forced signals
+    - signal: Replace force_fatal_sig with force_exit_sig when in doubt
+    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare
+    - RDMA/netlink: Add __maybe_unused to static inline in C file
+    - bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs
+    - selinux: fix NULL-pointer dereference when hashtab allocation fails
+    - ASoC: DAPM: Cover regression by kctl change notification fix
+    - ASoC: rsnd: fixup DMAEngine API
+    - usb: max-3421: Use driver data instead of maintaining a list of bound
+      devices
+    - ice: Fix VF true promiscuous mode
+    - ice: Delete always true check of PF pointer
+    - fs: export an inode_update_time helper
+    - btrfs: update device path inode time instead of bd_inode
+    - net: add and use skb_unclone_keeptruesize() helper
+    - x86/Kconfig: Fix an unused variable error in dell-smm-hwmon
+    - ALSA: hda: hdac_ext_stream: fix potential locking issues
+    - ALSA: hda: hdac_stream: fix potential locking issue in
+      snd_hdac_stream_assign()
+    - Linux 5.15.5
+
+  * Fix non-working e1000e device after resume (LP: #1951861)
+    - SAUCE: Revert "e1000e: Additional PHY power saving in S0ix"
+    - SAUCE: Revert "e1000e: Add polling mechanism to indicate CSME DPG exit"
+    - SAUCE: Revert "e1000e: Add handshake with the CSME to support S0ix"
+
+  * [SRU][I/OEM-5.13/OEM-5.14] Add MAC passthrough support for more Lenovo docks
+    (LP: #1951767)
+    - net: usb: r8152: Add MAC passthrough support for more Lenovo Docks
+
+  * [amdgpu] USB4 support for DP tunneling (LP: #1951868)
+    - drm/amd/display: Support for DMUB HPD interrupt handling
+    - drm/amd/display: Update link encoder object creation.
+    - drm/amd/display: USB4 DPIA enumeration and AUX Tunneling
+    - drm/amd/display: Support for DMUB HPD and HPD RX interrupt handling
+    - drm/amd/display: Set DPIA link endpoint type
+    - drm/amd/display: Stub out DPIA link training call
+    - drm/amd/display: Add stub to get DPIA tunneling device data
+    - drm/amd/display: Skip DPCD read for DPTX-to-DPIA hop
+    - drm/amd/display: Train DPIA links with fallback
+    - drm/amd/display: Implement DPIA training loop
+    - drm/amd/display: Implement DPIA link configuration
+    - drm/amd/display: Implement DPIA clock recovery phase
+    - drm/amd/display: Implement DPIA equalisation phase
+    - drm/amd/display: Implement end of training for hop in DPIA display path
+    - drm/amd/display: Support for SET_CONFIG processing with DMUB
+    - drm/amd/display: isolate link training setting override to its own function
+    - drm/amd/display: Read USB4 DP tunneling data from DPCD.
+    - drm/amd/display: Add dpia debug options
+    - drm/amd/display: Support for SET_CONFIG processing with DMUB
+    - drm/amd/display: Add DPCD writes at key points
+    - drm/amd/display: Fix DIG_HPD_SELECT for USB4 display endpoints.
+    - drm/amd/display: Add helper for blanking all dp displays
+    - drm/amd/display: Fix link training fallback logic
+    - drm/amd/display: Add debug flags for USB4 DP link training.
+    - drm/amd/display: Fix dynamic link encoder access.
+    - drm/amd/display: Fix concurrent dynamic encoder assignment
+    - drm/amd/display: Fix dynamic encoder reassignment
+    - drm/amd/display: Fix for access for ddc pin and aux engine.
+    - drm/amd/display: Deadlock/HPD Status/Crash Bug Fix
+    - drm/amd/display: Fix USB4 Aux via DMUB terminate unexpectedly
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Rewrite debian/scripts/module-check in Python
+    - [Config] update config and annotations after applying v5.15.5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 29 Nov 2021 09:25:37 +0100
+
+linux (5.15.0-12.12) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-12.12 -proposed tracker (LP: #1951810)
+
+  * Jammy update: v5.15.4 upstream stable release (LP: #1951820)
+    - string: uninline memcpy_and_pad
+    - Revert "drm: fb_helper: improve CONFIG_FB dependency"
+    - Revert "drm: fb_helper: fix CONFIG_FB dependency"
+    - KVM: Fix steal time asm constraints
+    - btrfs: introduce btrfs_is_data_reloc_root
+    - btrfs: zoned: add a dedicated data relocation block group
+    - btrfs: zoned: only allow one process to add pages to a relocation inode
+    - btrfs: zoned: use regular writes for relocation
+    - btrfs: check for relocation inodes on zoned btrfs in should_nocow
+    - btrfs: zoned: allow preallocation for relocation inodes
+    - fortify: Explicitly disable Clang support
+    - block: Add a helper to validate the block size
+    - loop: Use blk_validate_block_size() to validate block size
+    - Bluetooth: btusb: Add support for TP-Link UB500 Adapter
+    - parisc/entry: fix trace test in syscall exit path
+    - PCI/MSI: Deal with devices lying about their MSI mask capability
+    - PCI: Add MSI masking quirk for Nvidia ION AHCI
+    - perf/core: Avoid put_page() when GUP fails
+    - thermal: Fix NULL pointer dereferences in of_thermal_ functions
+    - Revert "ACPI: scan: Release PM resources blocked by unused objects"
+    - Linux 5.15.4
+
+  * Jammy update: v5.15.3 upstream stable release (LP: #1951822)
+    - xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good
+      delay
+    - usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform
+    - Input: iforce - fix control-message timeout
+    - Input: elantench - fix misreporting trackpoint coordinates
+    - Input: i8042 - Add quirk for Fujitsu Lifebook T725
+    - libata: fix read log timeout value
+    - ocfs2: fix data corruption on truncate
+    - scsi: scsi_ioctl: Validate command size
+    - scsi: core: Avoid leaving shost->last_reset with stale value if EH does not
+      run
+    - scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd()
+    - scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding
+    - scsi: lpfc: Fix FCP I/O flush functionality for TMF routines
+    - scsi: qla2xxx: Fix crash in NVMe abort path
+    - scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file
+    - scsi: qla2xxx: Fix use after free in eh_abort path
+    - ce/gf100: fix incorrect CE0 address calculation on some GPUs
+    - char: xillybus: fix msg_ep UAF in xillyusb_probe()
+    - mmc: mtk-sd: Add wait dma stop done flow
+    - mmc: dw_mmc: Dont wait for DRTO on Write RSP error
+    - exfat: fix incorrect loading of i_blocks for large files
+    - io-wq: remove worker to owner tw dependency
+    - parisc: Fix set_fixmap() on PA1.x CPUs
+    - parisc: Fix ptrace check on syscall return
+    - tpm: Check for integer overflow in tpm2_map_response_body()
+    - firmware/psci: fix application of sizeof to pointer
+    - crypto: s5p-sss - Add error handling in s5p_aes_probe()
+    - media: rkvdec: Do not override sizeimage for output format
+    - media: ite-cir: IR receiver stop working after receive overflow
+    - media: rkvdec: Support dynamic resolution changes
+    - media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
+    - media: v4l2-ioctl: Fix check_ext_ctrls
+    - ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14
+    - ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED
+    - ALSA: hda/realtek: Add quirk for Clevo PC70HS
+    - ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ
+    - ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N
+    - ALSA: hda/realtek: Add quirk for ASUS UX550VE
+    - ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED
+    - ALSA: ua101: fix division by zero at probe
+    - ALSA: 6fire: fix control and bulk message timeouts
+    - ALSA: line6: fix control and interrupt message timeouts
+    - ALSA: mixer: oss: Fix racy access to slots
+    - ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
+    - ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk
+    - ALSA: usb-audio: Add registration quirk for JBL Quantum 400
+    - ALSA: hda: Free card instance properly at probe errors
+    - ALSA: synth: missing check for possible NULL after the call to kstrdup
+    - ALSA: pci: rme: Fix unaligned buffer addresses
+    - ALSA: PCM: Fix NULL dereference at mmap checks
+    - ALSA: timer: Fix use-after-free problem
+    - ALSA: timer: Unconditionally unlink slave instances, too
+    - Revert "ext4: enforce buffer head state assertion in ext4_da_map_blocks"
+    - ext4: fix lazy initialization next schedule time computation in more
+      granular unit
+    - ext4: ensure enough credits in ext4_ext_shift_path_extents
+    - ext4: refresh the ext4_ext_path struct after dropping i_data_sem.
+    - fuse: fix page stealing
+    - x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
+    - x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
+    - x86/irq: Ensure PI wakeup handler is unregistered before module unload
+    - x86/iopl: Fake iopl(3) CLI/STI usage
+    - btrfs: clear MISSING device status bit in btrfs_close_one_device
+    - btrfs: fix lost error handling when replaying directory deletes
+    - btrfs: call btrfs_check_rw_degradable only if there is a missing device
+    - KVM: x86/mmu: Drop a redundant, broken remote TLB flush
+    - KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup
+    - KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ
+      handling
+    - ia64: kprobes: Fix to pass correct trampoline address to the handler
+    - selinux: fix race condition when computing ocontext SIDs
+    - ipmi:watchdog: Set panic count to proper value on a panic
+    - md/raid1: only allocate write behind bio for WriteMostly device
+    - hwmon: (pmbus/lm25066) Add offset coefficients
+    - regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is
+      disabled
+    - regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-
+      dvs-idx property
+    - EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
+    - mwifiex: fix division by zero in fw download path
+    - ath6kl: fix division by zero in send path
+    - ath6kl: fix control-message timeout
+    - ath10k: fix control-message timeout
+    - ath10k: fix division by zero in send path
+    - PCI: Mark Atheros QCA6174 to avoid bus reset
+    - rtl8187: fix control-message timeouts
+    - evm: mark evm_fixmode as __ro_after_init
+    - ifb: Depend on netfilter alternatively to tc
+    - platform/surface: aggregator_registry: Add support for Surface Laptop Studio
+    - mt76: mt7615: fix skb use-after-free on mac reset
+    - HID: surface-hid: Use correct event registry for managing HID events
+    - HID: surface-hid: Allow driver matching for target ID 1 devices
+    - wcn36xx: Fix HT40 capability for 2Ghz band
+    - wcn36xx: Fix tx_status mechanism
+    - wcn36xx: Fix (QoS) null data frame bitrate/modulation
+    - PM: sleep: Do not let "syscore" devices runtime-suspend during system
+      transitions
+    - mwifiex: Read a PCI register after writing the TX ring write pointer
+    - mwifiex: Try waking the firmware until we get an interrupt
+    - libata: fix checking of DMA state
+    - dma-buf: fix and rework dma_buf_poll v7
+    - wcn36xx: handle connection loss indication
+    - rsi: fix occasional initialisation failure with BT coex
+    - rsi: fix key enabled check causing unwanted encryption for vap_id > 0
+    - rsi: fix rate mask set leading to P2P failure
+    - rsi: Fix module dev_oper_mode parameter description
+    - perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server
+    - perf/x86/intel/uncore: Fix invalid unit check
+    - perf/x86/intel/uncore: Fix Intel ICX IIO event constraints
+    - RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
+    - ASoC: tegra: Set default card name for Trimslice
+    - ASoC: tegra: Restore AC97 support
+    - signal: Remove the bogus sigkill_pending in ptrace_stop
+    - memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode
+    - signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
+    - soc: samsung: exynos-pmu: Fix compilation when nothing selects
+      CONFIG_MFD_CORE
+    - soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
+    - soc: fsl: dpio: use the combined functions to protect critical zone
+    - mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines
+    - mctp: handle the struct sockaddr_mctp padding fields
+    - power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
+    - power: supply: max17042_battery: use VFSOC for capacity when no rsns
+    - iio: core: fix double free in iio_device_unregister_sysfs()
+    - iio: core: check return value when calling dev_set_name()
+    - KVM: arm64: Extract ESR_ELx.EC only
+    - KVM: x86: Fix recording of guest steal time / preempted status
+    - KVM: x86: Add helper to consolidate core logic of SET_CPUID{2} flows
+    - KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use
+    - KVM: nVMX: Handle dynamic MSR intercept toggling
+    - can: peak_usb: always ask for BERR reporting for PCAN-USB devices
+    - can: mcp251xfd: mcp251xfd_irq(): add missing
+      can_rx_offload_threaded_irq_finish() in case of bus off
+    - can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport
+    - can: j1939: j1939_can_recv(): ignore messages with invalid source address
+    - can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
+    - iio: adc: tsc2046: fix scan interval warning
+    - powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
+    - io_uring: honour zeroes as io-wq worker limits
+    - ring-buffer: Protect ring_buffer_reset() from reentrancy
+    - serial: core: Fix initializing and restoring termios speed
+    - ifb: fix building without CONFIG_NET_CLS_ACT
+    - xen/balloon: add late_initcall_sync() for initial ballooning done
+    - ovl: fix use after free in struct ovl_aio_req
+    - ovl: fix filattr copy-up failure
+    - PCI: pci-bridge-emul: Fix emulation of W1C bits
+    - PCI: cadence: Add cdns_plat_pcie_probe() missing return
+    - cxl/pci: Fix NULL vs ERR_PTR confusion
+    - PCI: aardvark: Do not clear status bits of masked interrupts
+    - PCI: aardvark: Fix checking for link up via LTSSM state
+    - PCI: aardvark: Do not unmask unused interrupts
+    - PCI: aardvark: Fix reporting Data Link Layer Link Active
+    - PCI: aardvark: Fix configuring Reference clock
+    - PCI: aardvark: Fix return value of MSI domain .alloc() method
+    - PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
+    - PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated
+      bridge
+    - PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge
+    - PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge
+    - PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge
+    - quota: check block number when reading the block in quota file
+    - quota: correct error number in free_dqentry()
+    - cifs: To match file servers, make sure the server hostname matches
+    - cifs: set a minimum of 120s for next dns resolution
+    - mfd: simple-mfd-i2c: Select MFD_CORE to fix build error
+    - pinctrl: core: fix possible memory leak in pinctrl_enable()
+    - coresight: cti: Correct the parameter for pm_runtime_put
+    - coresight: trbe: Fix incorrect access of the sink specific data
+    - coresight: trbe: Defer the probe on offline CPUs
+    - iio: buffer: check return value of kstrdup_const()
+    - iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask()
+    - iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
+    - iio: buffer: Fix memory leak in iio_buffer_register_legacy_sysfs_groups()
+    - drivers: iio: dac: ad5766: Fix dt property name
+    - iio: dac: ad5446: Fix ad5622_write() return value
+    - iio: ad5770r: make devicetree property reading consistent
+    - Documentation:devicetree:bindings:iio:dac: Fix val
+    - USB: serial: keyspan: fix memleak on probe errors
+    - serial: 8250: fix racy uartclk update
+    - ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION
+    - io-wq: serialize hash clear with wakeup
+    - serial: 8250: Fix reporting real baudrate value in c_ospeed field
+    - Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
+    - most: fix control-message timeouts
+    - USB: iowarrior: fix control-message timeouts
+    - USB: chipidea: fix interrupt deadlock
+    - power: supply: max17042_battery: Clear status bits in interrupt handler
+    - component: do not leave master devres group open after bind
+    - dma-buf: WARN on dmabuf release with pending attachments
+    - drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)
+    - drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
+    - drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6
+    - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
+    - Bluetooth: fix use-after-free error in lock_sock_nested()
+    - Bluetooth: call sock_hold earlier in sco_conn_del
+    - drm/panel-orientation-quirks: add Valve Steam Deck
+    - rcutorture: Avoid problematic critical section nesting on PREEMPT_RT
+    - platform/x86: wmi: do not fail if disabling fails
+    - drm/amdgpu: move iommu_resume before ip init/resume
+    - MIPS: lantiq: dma: add small delay after reset
+    - MIPS: lantiq: dma: reset correct number of channel
+    - locking/lockdep: Avoid RCU-induced noinstr fail
+    - net: sched: update default qdisc visibility after Tx queue cnt changes
+    - rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop
+    - smackfs: Fix use-after-free in netlbl_catmap_walk()
+    - ath11k: Align bss_chan_info structure with firmware
+    - crypto: aesni - check walk.nbytes instead of err
+    - x86/mm/64: Improve stack overflow warnings
+    - x86: Increase exception stack sizes
+    - mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
+    - mwifiex: Properly initialize private structure on interface type changes
+    - spi: Check we have a spi_device_id for each DT compatible
+    - fscrypt: allow 256-bit master keys with AES-256-XTS
+    - drm/amdgpu: Fix MMIO access page fault
+    - drm/amd/display: Fix null pointer dereference for encoders
+    - selftests: net: fib_nexthops: Wait before checking reported idle time
+    - ath11k: Avoid reg rules update during firmware recovery
+    - ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
+    - ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets
+    - ath10k: high latency fixes for beacon buffer
+    - octeontx2-pf: Enable promisc/allmulti match MCAM entries.
+    - media: mt9p031: Fix corrupted frame after restarting stream
+    - media: netup_unidvb: handle interrupt properly according to the firmware
+    - media: atomisp: Fix error handling in probe
+    - media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()
+    - media: uvcvideo: Set capability in s_param
+    - media: uvcvideo: Return -EIO for control errors
+    - media: uvcvideo: Set unique vdev name based in type
+    - media: vidtv: Fix memory leak in remove
+    - media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
+    - media: s5p-mfc: Add checking to s5p_mfc_probe().
+    - media: videobuf2: rework vb2_mem_ops API
+    - media: imx: set a media_device bus_info string
+    - media: rcar-vin: Use user provided buffers when starting
+    - media: mceusb: return without resubmitting URB in case of -EPROTO error.
+    - ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
+    - rtw88: fix RX clock gate setting while fifo dump
+    - brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet
+    - media: rcar-csi2: Add checking to rcsi2_start_receiver()
+    - ipmi: Disable some operations during a panic
+    - fs/proc/uptime.c: Fix idle time reporting in /proc/uptime
+    - kselftests/sched: cleanup the child processes
+    - ACPICA: Avoid evaluating methods too early during system resume
+    - cpufreq: Make policy min/max hard requirements
+    - ice: Move devlink port to PF/VF struct
+    - media: imx-jpeg: Fix possible null pointer dereference
+    - media: ipu3-imgu: imgu_fmt: Handle properly try
+    - media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info
+    - media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
+    - net-sysfs: try not to restart the syscall if it will fail eventually
+    - drm/amdkfd: rm BO resv on validation to avoid deadlock
+    - tracefs: Have tracefs directories not set OTH permission bits by default
+    - tracing: Disable "other" permission bits in the tracefs files
+    - ath: dfs_pattern_detector: Fix possible null-pointer dereference in
+      channel_detector_create()
+    - KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall
+    - mmc: moxart: Fix reference count leaks in moxart_probe
+    - iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value
+    - ACPI: battery: Accept charges over the design capacity as full
+    - ACPI: scan: Release PM resources blocked by unused objects
+    - drm/amd/display: fix null pointer deref when plugging in display
+    - drm/amdkfd: fix resume error when iommu disabled in Picasso
+    - net: phy: micrel: make *-skew-ps check more lenient
+    - leaking_addresses: Always print a trailing newline
+    - thermal/core: Fix null pointer dereference in thermal_release()
+    - drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture()
+    - thermal/drivers/tsens: Add timeout to get_temp_tsens_valid
+    - block: bump max plugged deferred size from 16 to 32
+    - floppy: fix calling platform_device_unregister() on invalid drives
+    - md: update superblock after changing rdev flags in state_store
+    - memstick: r592: Fix a UAF bug when removing the driver
+    - locking/rwsem: Disable preemption for spinning region
+    - lib/xz: Avoid overlapping memcpy() with invalid input with in-place
+      decompression
+    - lib/xz: Validate the value before assigning it to an enum variable
+    - workqueue: make sysfs of unbound kworker cpumask more clever
+    - tracing/cfi: Fix cmp_entries_* functions signature mismatch
+    - mt76: mt7915: fix an off-by-one bound check
+    - mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
+    - iwlwifi: change all JnP to NO-160 configuration
+    - block: remove inaccurate requeue check
+    - media: allegro: ignore interrupt if mailbox is not initialized
+    - drm/amdgpu/pm: properly handle sclk for profiling modes on vangogh
+    - nvmet: fix use-after-free when a port is removed
+    - nvmet-rdma: fix use-after-free when a port is removed
+    - nvmet-tcp: fix use-after-free when a port is removed
+    - nvme: drop scan_lock and always kick requeue list when removing namespaces
+    - samples/bpf: Fix application of sizeof to pointer
+    - arm64: vdso32: suppress error message for 'make mrproper'
+    - PM: hibernate: Get block device exclusively in swsusp_check()
+    - selftests: kvm: fix mismatched fclose() after popen()
+    - selftests/bpf: Fix perf_buffer test on system with offline cpus
+    - iwlwifi: mvm: disable RX-diversity in powersave
+    - smackfs: use __GFP_NOFAIL for smk_cipso_doi()
+    - ARM: clang: Do not rely on lr register for stacktrace
+    - gre/sit: Don't generate link-local addr if addr_gen_mode is
+      IN6_ADDR_GEN_MODE_NONE
+    - can: bittiming: can_fixup_bittiming(): change type of tseg1 and alltseg to
+      unsigned int
+    - gfs2: Cancel remote delete work asynchronously
+    - gfs2: Fix glock_hash_walk bugs
+    - ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
+    - tools/latency-collector: Use correct size when writing queue_full_warning
+    - vrf: run conntrack only in context of lower/physdev for locally generated
+      packets
+    - net: annotate data-race in neigh_output()
+    - ACPI: AC: Quirk GK45 to skip reading _PSR
+    - ACPI: resources: Add one more Medion model in IRQ override quirk
+    - btrfs: reflink: initialize return value to 0 in btrfs_extent_same()
+    - btrfs: do not take the uuid_mutex in btrfs_rm_device
+    - spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in
+      bcm_qspi_probe()
+    - wcn36xx: Correct band/freq reporting on RX
+    - wcn36xx: Fix packet drop on resume
+    - Revert "wcn36xx: Enable firmware link monitoring"
+    - ftrace: do CPU checking after preemption disabled
+    - inet: remove races in inet{6}_getname()
+    - x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
+    - drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled
+    - perf/x86/intel: Fix ICL/SPR INST_RETIRED.PREC_DIST encodings
+    - parisc: fix warning in flush_tlb_all
+    - task_stack: Fix end_of_stack() for architectures with upwards-growing stack
+    - erofs: don't trigger WARN() when decompression fails
+    - parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
+    - parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
+    - netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream
+      state
+    - selftests/bpf: Fix strobemeta selftest regression
+    - fbdev/efifb: Release PCI device's runtime PM ref during FB destroy
+    - drm/bridge: anx7625: Propagate errors from sp_tx_rst_aux()
+    - perf/x86/intel/uncore: Fix Intel SPR CHA event constraints
+    - perf/x86/intel/uncore: Fix Intel SPR IIO event constraints
+    - perf/x86/intel/uncore: Fix Intel SPR M2PCIE event constraints
+    - perf/x86/intel/uncore: Fix Intel SPR M3UPI event constraints
+    - drm/bridge: it66121: Initialize {device,vendor}_ids
+    - drm/bridge: it66121: Wait for next bridge to be probed
+    - Bluetooth: fix init and cleanup of sco_conn.timeout_work
+    - libbpf: Don't crash on object files with no symbol tables
+    - Bluetooth: hci_uart: fix GPF in h5_recv
+    - rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()
+    - MIPS: lantiq: dma: fix burst length for DEU
+    - x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
+    - objtool: Handle __sanitize_cov*() tail calls
+    - net/mlx5: Publish and unpublish all devlink parameters at once
+    - drm/v3d: fix wait for TMU write combiner flush
+    - crypto: sm4 - Do not change section of ck and sbox
+    - virtio-gpu: fix possible memory allocation failure
+    - lockdep: Let lock_is_held_type() detect recursive read as read
+    - net: net_namespace: Fix undefined member in key_remove_domain()
+    - net: phylink: don't call netif_carrier_off() with NULL netdev
+    - drm: bridge: it66121: Fix return value it66121_probe
+    - spi: Fixed division by zero warning
+    - cgroup: Make rebind_subsystems() disable v2 controllers all at once
+    - wcn36xx: Fix Antenna Diversity Switching
+    - wilc1000: fix possible memory leak in cfg_scan_result()
+    - Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
+    - drm/amdgpu: Fix crash on device remove/driver unload
+    - drm/amd/display: Pass display_pipe_params_st as const in DML
+    - drm/amdgpu: move amdgpu_virt_release_full_gpu to fini_early stage
+    - crypto: caam - disable pkc for non-E SoCs
+    - crypto: qat - power up 4xxx device
+    - Bluetooth: hci_h5: Fix (runtime)suspend issues on RTL8723BS HCIs
+    - bnxt_en: Check devlink allocation and registration status
+    - qed: Don't ignore devlink allocation failures
+    - rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()
+    - mptcp: do not shrink snd_nxt when recovering
+    - fortify: Fix dropped strcpy() compile-time write overflow check
+    - mac80211: twt: don't use potentially unaligned pointer
+    - cfg80211: always free wiphy specific regdomain
+    - net/mlx5: Accept devlink user input after driver initialization complete
+    - net: dsa: rtl8366rb: Fix off-by-one bug
+    - net: dsa: rtl8366: Fix a bug in deleting VLANs
+    - bpf/tests: Fix error in tail call limit tests
+    - ath11k: fix some sleeping in atomic bugs
+    - ath11k: Avoid race during regd updates
+    - ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status
+    - ath11k: Fix memory leak in ath11k_qmi_driver_event_work
+    - gve: DQO: avoid unused variable warnings
+    - ath10k: Fix missing frame timestamp for beacon/probe-resp
+    - ath10k: sdio: Add missing BH locking around napi_schdule()
+    - drm/ttm: stop calling tt_swapin in vm_access
+    - arm64: mm: update max_pfn after memory hotplug
+    - drm/amdgpu: fix warning for overflow check
+    - libbpf: Fix skel_internal.h to set errno on loader retval < 0
+    - media: em28xx: add missing em28xx_close_extension
+    - media: meson-ge2d: Fix rotation parameter changes detection in
+      'ge2d_s_ctrl()'
+    - media: cxd2880-spi: Fix a null pointer dereference on error handling path
+    - media: ttusb-dec: avoid release of non-acquired mutex
+    - media: dvb-usb: fix ununit-value in az6027_rc_query
+    - media: imx258: Fix getting clock frequency
+    - media: v4l2-ioctl: S_CTRL output the right value
+    - media: mtk-vcodec: venc: fix return value when start_streaming fails
+    - media: TDA1997x: handle short reads of hdmi info frame.
+    - media: mtk-vpu: Fix a resource leak in the error handling path of
+      'mtk_vpu_probe()'
+    - media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()'
+    - media: i2c: ths8200 needs V4L2_ASYNC
+    - media: sun6i-csi: Allow the video device to be open multiple times
+    - media: radio-wl1273: Avoid card name truncation
+    - media: si470x: Avoid card name truncation
+    - media: tm6000: Avoid card name truncation
+    - media: cx23885: Fix snd_card_free call on null card pointer
+    - media: atmel: fix the ispck initialization
+    - scs: Release kasan vmalloc poison in scs_free process
+    - kprobes: Do not use local variable when creating debugfs file
+    - crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency
+    - drm: fb_helper: fix CONFIG_FB dependency
+    - cpuidle: Fix kobject memory leaks in error paths
+    - media: em28xx: Don't use ops->suspend if it is NULL
+    - ath10k: Don't always treat modem stop events as crashes
+    - ath9k: Fix potential interrupt storm on queue reset
+    - PM: EM: Fix inefficient states detection
+    - x86/insn: Use get_unaligned() instead of memcpy()
+    - EDAC/amd64: Handle three rank interleaving mode
+    - rcu: Always inline rcu_dynticks_task*_{enter,exit}()
+    - rcu: Fix rcu_dynticks_curr_cpu_in_eqs() vs noinstr
+    - netfilter: nft_dynset: relax superfluous check on set updates
+    - media: venus: fix vpp frequency calculation for decoder
+    - media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
+    - crypto: ccree - avoid out-of-range warnings from clang
+    - crypto: qat - detect PFVF collision after ACK
+    - crypto: qat - disregard spurious PFVF interrupts
+    - hwrng: mtk - Force runtime pm ops for sleep ops
+    - ima: fix deadlock when traversing "ima_default_rules".
+    - b43legacy: fix a lower bounds test
+    - b43: fix a lower bounds test
+    - gve: Recover from queue stall due to missed IRQ
+    - gve: Track RX buffer allocation failures
+    - mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
+    - mmc: sdhci-omap: Fix context restore
+    - memstick: avoid out-of-range warning
+    - memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
+    - net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE
+    - hwmon: Fix possible memleak in __hwmon_device_register()
+    - hwmon: (pmbus/lm25066) Let compiler determine outer dimension of
+      lm25066_coeff
+    - ath10k: fix max antenna gain unit
+    - kernel/sched: Fix sched_fork() access an invalid sched_task_group
+    - net: fealnx: fix build for UML
+    - net: intel: igc_ptp: fix build for UML
+    - net: tulip: winbond-840: fix build for UML
+    - tcp: switch orphan_count to bare per-cpu counters
+    - crypto: octeontx2 - set assoclen in aead_do_fallback()
+    - thermal/core: fix a UAF bug in __thermal_cooling_device_register()
+    - drm/msm/dsi: do not enable irq handler before powering up the host
+    - drm/msm: Fix potential Oops in a6xx_gmu_rpmh_init()
+    - drm/msm: potential error pointer dereference in init()
+    - drm/msm: unlock on error in get_sched_entity()
+    - drm/msm: fix potential NULL dereference in cleanup
+    - drm/msm: uninitialized variable in msm_gem_import()
+    - net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
+    - thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM
+    - mailbox: Remove WARN_ON for async_cb.cb in cmdq_exec_done
+    - media: ivtv: fix build for UML
+    - media: ir_toy: assignment to be16 should be of correct type
+    - mmc: mxs-mmc: disable regulator on error and in the remove function
+    - io-wq: Remove duplicate code in io_workqueue_create()
+    - block: ataflop: fix breakage introduced at blk-mq refactoring
+    - platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
+    - mailbox: mtk-cmdq: Validate alias_id on probe
+    - mailbox: mtk-cmdq: Fix local clock ID usage
+    - ACPI: PM: Turn off unused wakeup power resources
+    - ACPI: PM: Fix sharing of wakeup power resources
+    - drm/amdkfd: Fix an inappropriate error handling in allloc memory of gpu
+    - mt76: mt7921: fix endianness in mt7921_mcu_tx_done_event
+    - mt76: mt7915: fix endianness warning in mt7915_mac_add_txs_skb
+    - mt76: mt7921: fix endianness warning in mt7921_update_txs
+    - mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi
+    - mt76: mt7915: fix info leak in mt7915_mcu_set_pre_cal()
+    - mt76: connac: fix mt76_connac_gtk_rekey_tlv usage
+    - mt76: fix build error implicit enumeration conversion
+    - mt76: mt7921: fix survey-dump reporting
+    - mt76: mt76x02: fix endianness warnings in mt76x02_mac.c
+    - mt76: mt7921: Fix out of order process by invalid event pkt
+    - mt76: mt7915: fix potential overflow of eeprom page index
+    - mt76: mt7915: fix bit fields for HT rate idx
+    - mt76: mt7921: fix dma hang in rmmod
+    - mt76: connac: fix GTK rekey offload failure on WPA mixed mode
+    - mt76: overwrite default reg_ops if necessary
+    - mt76: mt7921: report HE MU radiotap
+    - mt76: mt7921: fix firmware usage of RA info using legacy rates
+    - mt76: mt7921: fix kernel warning from cfg80211_calculate_bitrate
+    - mt76: mt7921: always wake device if necessary in debugfs
+    - mt76: mt7915: fix hwmon temp sensor mem use-after-free
+    - mt76: mt7615: fix hwmon temp sensor mem use-after-free
+    - mt76: mt7915: fix possible infinite loop release semaphore
+    - mt76: mt7921: fix retrying release semaphore without end
+    - mt76: mt7615: fix monitor mode tear down crash
+    - mt76: connac: fix possible NULL pointer dereference in
+      mt76_connac_get_phy_mode_v2
+    - mt76: mt7915: fix sta_rec_wtbl tag len
+    - mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req()
+    - rsi: stop thread firstly in rsi_91x_init() error handling
+    - mwifiex: Send DELBA requests according to spec
+    - iwlwifi: mvm: reset PM state on unsuccessful resume
+    - iwlwifi: pnvm: don't kmemdup() more than we have
+    - iwlwifi: pnvm: read EFI data only if long enough
+    - net: enetc: unmap DMA in enetc_send_cmd()
+    - phy: micrel: ksz8041nl: do not use power down mode
+    - nbd: Fix use-after-free in pid_show
+    - nvme-rdma: fix error code in nvme_rdma_setup_ctrl
+    - PM: hibernate: fix sparse warnings
+    - clocksource/drivers/timer-ti-dm: Select TIMER_OF
+    - x86/sev: Fix stack type check in vc_switch_off_ist()
+    - drm/msm: Fix potential NULL dereference in DPU SSPP
+    - drm/msm/dsi: fix wrong type in msm_dsi_host
+    - crypto: tcrypt - fix skcipher multi-buffer tests for 1420B blocks
+    - smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
+    - KVM: selftests: Fix nested SVM tests when built with clang
+    - libbpf: Fix memory leak in btf__dedup()
+    - bpftool: Avoid leaking the JSON writer prepared for program metadata
+    - libbpf: Fix overflow in BTF sanity checks
+    - libbpf: Fix BTF header parsing checks
+    - mt76: mt7615: mt7622: fix ibss and meshpoint
+    - s390/gmap: validate VMA in __gmap_zap()
+    - s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
+    - s390/mm: validate VMA in PGSTE manipulation functions
+    - s390/mm: fix VMA and page table handling code in storage key handling
+      functions
+    - s390/uv: fully validate the VMA before calling follow_page()
+    - KVM: s390: pv: avoid double free of sida page
+    - KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm
+    - irq: mips: avoid nested irq_enter()
+    - net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error
+    - ARM: 9142/1: kasan: work around LPAE build warning
+    - ath10k: fix module load regression with iram-recovery feature
+    - block: ataflop: more blk-mq refactoring fixes
+    - blk-cgroup: synchronize blkg creation against policy deactivation
+    - libbpf: Fix off-by-one bug in bpf_core_apply_relo()
+    - tpm: fix Atmel TPM crash caused by too frequent queries
+    - tpm_tis_spi: Add missing SPI ID
+    - libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED()
+    - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
+    - tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks
+    - cpufreq: intel_pstate: Fix cpu->pstate.turbo_freq initialization
+    - spi: spi-rpc-if: Check return value of rpcif_sw_init()
+    - samples/kretprobes: Fix return value if register_kretprobe() failed
+    - KVM: s390: Fix handle_sske page fault handling
+    - libertas_tf: Fix possible memory leak in probe and disconnect
+    - libertas: Fix possible memory leak in probe and disconnect
+    - wcn36xx: add proper DMA memory barriers in rx path
+    - wcn36xx: Fix discarded frames due to wrong sequence number
+    - bpf: Avoid races in __bpf_prog_run() for 32bit arches
+    - bpf: Fixes possible race in update_prog_stats() for 32bit arches
+    - wcn36xx: Channel list update before hardware scan
+    - drm/amdgpu: fix a potential memory leak in amdgpu_device_fini_sw()
+    - drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
+    - selftests/bpf: Fix fd cleanup in sk_lookup test
+    - selftests/bpf: Fix memory leak in test_ima
+    - sctp: allow IP fragmentation when PLPMTUD enters Error state
+    - sctp: reset probe_timer in sctp_transport_pl_update
+    - sctp: subtract sctphdr len in sctp_transport_pl_hlen
+    - sctp: return true only for pathmtu update in sctp_transport_pl_toobig
+    - net: amd-xgbe: Toggle PLL settings during rate change
+    - ipmi: kcs_bmc: Fix a memory leak in the error handling path of
+      'kcs_bmc_serio_add_device()'
+    - nfp: fix NULL pointer access when scheduling dim work
+    - nfp: fix potential deadlock when canceling dim work
+    - net: phylink: avoid mvneta warning when setting pause parameters
+    - net: bridge: fix uninitialized variables when BRIDGE_CFM is disabled
+    - selftests: net: bridge: update IGMP/MLD membership interval value
+    - crypto: pcrypt - Delay write to padata->info
+    - selftests/bpf: Fix fclose/pclose mismatch in test_progs
+    - udp6: allow SO_MARK ctrl msg to affect routing
+    - ibmvnic: don't stop queue in xmit
+    - ibmvnic: Process crqs after enabling interrupts
+    - ibmvnic: delay complete()
+    - selftests: mptcp: fix proto type in link_failure tests
+    - skmsg: Lose offset info in sk_psock_skb_ingress
+    - cgroup: Fix rootcg cpu.stat guest double counting
+    - bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.
+    - bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.
+    - of: unittest: fix EXPECT text for gpio hog errors
+    - cpufreq: Fix parameter in parse_perf_domain()
+    - staging: r8188eu: fix memory leak in rtw_set_key
+    - arm64: dts: meson: sm1: add Ethernet PHY reset line for ODROID-C4/HC4
+    - iio: st_sensors: disable regulators after device unregistration
+    - RDMA/rxe: Fix wrong port_cap_flags
+    - ARM: dts: BCM5301X: Fix memory nodes names
+    - arm64: dts: broadcom: bcm4908: Fix UART clock name
+    - clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths
+    - scsi: pm80xx: Fix lockup in outbound queue management
+    - scsi: qla2xxx: edif: Use link event to wake up app
+    - scsi: lpfc: Fix NVMe I/O failover to non-optimized path
+    - ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
+    - arm64: dts: rockchip: Fix GPU register width for RK3328
+    - ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY
+    - RDMA/bnxt_re: Fix query SRQ failure
+    - arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes
+    - arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe
+    - arm64: dts: ti: j7200-main: Fix "vendor-id"/"device-id" properties of pcie
+      node
+    - arm64: dts: ti: j7200-main: Fix "bus-range" upto 256 bus number for PCIe
+    - arm64: dts: meson-g12a: Fix the pwm regulator supply properties
+    - arm64: dts: meson-g12b: Fix the pwm regulator supply properties
+    - arm64: dts: meson-sm1: Fix the pwm regulator supply properties
+    - bus: ti-sysc: Fix timekeeping_suspended warning on resume
+    - ARM: dts: at91: tse850: the emac<->phy interface is rmii
+    - arm64: dts: qcom: sc7180: Base dynamic CPU power coefficients in reality
+    - soc: qcom: llcc: Disable MMUHWT retention
+    - arm64: dts: qcom: sc7280: fix display port phy reg property
+    - scsi: dc395: Fix error case unwinding
+    - MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
+    - JFS: fix memleak in jfs_mount
+    - pinctrl: renesas: rzg2l: Fix missing port register 21h
+    - ASoC: wcd9335: Use correct version to initialize Class H
+    - arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock
+    - arm64: dts: renesas: beacon: Fix Ethernet PHY mode
+    - iommu/mediatek: Fix out-of-range warning with clang
+    - arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000
+    - iommu/dma: Fix sync_sg with swiotlb
+    - iommu/dma: Fix arch_sync_dma for map
+    - ALSA: hda: Reduce udelay() at SKL+ position reporting
+    - ALSA: hda: Use position buffer for SKL+ again
+    - ALSA: usb-audio: Fix possible race at sync of urb completions
+    - soundwire: debugfs: use controller id and link_id for debugfs
+    - power: reset: at91-reset: check properly the return value of devm_of_iomap
+    - scsi: ufs: core: Fix ufshcd_probe_hba() prototype to match the definition
+    - scsi: ufs: core: Stop clearing UNIT ATTENTIONS
+    - scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and
+      real interrupt
+    - scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp()
+    - driver core: Fix possible memory leak in device_link_add()
+    - arm: dts: omap3-gta04a4: accelerometer irq fix
+    - ASoC: SOF: topology: do not power down primary core during topology removal
+    - iio: st_pressure_spi: Add missing entries SPI to device ID table
+    - soc/tegra: Fix an error handling path in tegra_powergate_power_up()
+    - memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
+    - clk: at91: check pmc node status before registering syscore ops
+    - powerpc/mem: Fix arch/powerpc/mm/mem.c:53:12: error: no previous prototype
+      for 'create_section_mapping'
+    - video: fbdev: chipsfb: use memset_io() instead of memset()
+    - powerpc: fix unbalanced node refcount in check_kvm_guest()
+    - powerpc/paravirt: correct preempt debug splat in vcpu_is_preempted()
+    - serial: 8250_dw: Drop wrong use of ACPI_PTR()
+    - usb: gadget: hid: fix error code in do_config()
+    - power: supply: rt5033_battery: Change voltage values to µV
+    - power: supply: max17040: fix null-ptr-deref in max17040_probe()
+    - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
+    - RDMA/mlx4: Return missed an error if device doesn't support steering
+    - usb: musb: select GENERIC_PHY instead of depending on it
+    - staging: most: dim2: do not double-register the same device
+    - staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC
+    - RDMA/core: Set sgtable nents when using ib_dma_virt_map_sg()
+    - dyndbg: make dyndbg a known cli param
+    - powerpc/perf: Fix cycles/instructions as PM_CYC/PM_INST_CMPL in power10
+    - pinctrl: renesas: checker: Fix off-by-one bug in drive register check
+    - ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz
+    - ARM: dts: stm32: fix STUSB1600 Type-C irq level on stm32mp15xx-dkx
+    - ARM: dts: stm32: fix SAI sub nodes register range
+    - ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
+    - ASoC: cs42l42: Always configure both ASP TX channels
+    - ASoC: cs42l42: Correct some register default values
+    - ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
+    - soc: qcom: rpmhpd: Make power_on actually enable the domain
+    - soc: qcom: socinfo: add two missing PMIC IDs
+    - iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask()
+    - usb: typec: STUSB160X should select REGMAP_I2C
+    - iio: adis: do not disabe IRQs in 'adis_init()'
+    - soundwire: bus: stop dereferencing invalid slave pointer
+    - scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer
+    - scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset
+    - serial: imx: fix detach/attach of serial console
+    - usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init
+    - usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled
+    - usb: dwc2: drd: reset current session before setting the new one
+    - powerpc/booke: Disable STRICT_KERNEL_RWX, DEBUG_PAGEALLOC and KFENCE
+    - usb: dwc3: gadget: Skip resizing EP's TX FIFO if already resized
+    - firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()
+    - soc: qcom: rpmhpd: fix sm8350_mxc's peer domain
+    - soc: qcom: apr: Add of_node_put() before return
+    - arm64: dts: qcom: pmi8994: Fix "eternal"->"external" typo in WLED node
+    - arm64: dts: qcom: sdm845: Use RPMH_CE_CLK macro directly
+    - arm64: dts: qcom: sdm845: Fix Qualcomm crypto engine bus clock
+    - pinctrl: equilibrium: Fix function addition in multiple groups
+    - ASoC: topology: Fix stub for snd_soc_tplg_component_remove()
+    - phy: qcom-qusb2: Fix a memory leak on probe
+    - phy: ti: gmii-sel: check of_get_address() for failure
+    - phy: qcom-qmp: another fix for the sc8180x PCIe definition
+    - phy: qcom-snps: Correct the FSEL_MASK
+    - phy: Sparx5 Eth SerDes: Fix return value check in sparx5_serdes_probe()
+    - serial: xilinx_uartps: Fix race condition causing stuck TX
+    - clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL
+    - clk: at91: clk-master: check if div or pres is zero
+    - clk: at91: clk-master: fix prescaler logic
+    - HID: u2fzero: clarify error check and length calculations
+    - HID: u2fzero: properly handle timeouts in usb_submit_urb
+    - powerpc/nohash: Fix __ptep_set_access_flags() and ptep_set_wrprotect()
+    - powerpc/book3e: Fix set_memory_x() and set_memory_nx()
+    - powerpc/44x/fsp2: add missing of_node_put
+    - powerpc/xmon: fix task state output
+    - ALSA: oxfw: fix functional regression for Mackie Onyx 1640i in v5.14 or
+      later
+    - iommu/dma: Fix incorrect error return on iommu deferred attach
+    - powerpc: Don't provide __kernel_map_pages() without
+      ARCH_SUPPORTS_DEBUG_PAGEALLOC
+    - ASoC: cs42l42: Correct configuring of switch inversion from ts-inv
+    - RDMA/hns: Fix initial arm_st of CQ
+    - RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility
+    - ASoC: rsnd: Fix an error handling path in 'rsnd_node_count()'
+    - serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE
+    - virtio_ring: check desc == NULL when using indirect with packed
+    - vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit
+    - mips: cm: Convert to bitfield API to fix out-of-bounds access
+    - power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
+    - RDMA/core: Require the driver to set the IOVA correctly during rereg_mr
+    - apparmor: fix error check
+    - rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
+    - mtd: rawnand: intel: Fix potential buffer overflow in probe
+    - nfsd: don't alloc under spinlock in rpc_parse_scope_id
+    - rtc: ds1302: Add SPI ID table
+    - rtc: ds1390: Add SPI ID table
+    - rtc: pcf2123: Add SPI ID table
+    - remoteproc: imx_rproc: Fix TCM io memory type
+    - i2c: i801: Use PCI bus rescan mutex to protect P2SB access
+    - dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside
+      submission
+    - rtc: mcp795: Add SPI ID table
+    - Input: ariel-pwrbutton - add SPI device ID table
+    - i2c: mediatek: fixing the incorrect register offset
+    - NFS: Default change_attr_type to NFS4_CHANGE_TYPE_IS_UNDEFINED
+    - NFS: Don't set NFS_INO_DATA_INVAL_DEFER and NFS_INO_INVALID_DATA
+    - NFS: Ignore the directory size when marking for revalidation
+    - NFS: Fix dentry verifier races
+    - pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
+    - drm/bridge/lontium-lt9611uxc: fix provided connector suport
+    - drm/plane-helper: fix uninitialized variable reference
+    - PCI: aardvark: Don't spam about PIO Response Status
+    - PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge
+    - opp: Fix return in _opp_add_static_v2()
+    - NFS: Fix deadlocks in nfs_scan_commit_list()
+    - sparc: Add missing "FORCE" target when using if_changed
+    - fs: orangefs: fix error return code of orangefs_revalidate_lookup()
+    - Input: st1232 - increase "wait ready" timeout
+    - drm/bridge: nwl-dsi: Add atomic_get_input_bus_fmts
+    - mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
+    - PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation
+    - mtd: rawnand: arasan: Prevent an unsupported configuration
+    - mtd: core: don't remove debugfs directory if device is in use
+    - remoteproc: Fix a memory leak in an error handling path in
+      'rproc_handle_vdev()'
+    - rtc: rv3032: fix error handling in rv3032_clkout_set_rate()
+    - dmaengine: at_xdmac: call at_xdmac_axi_config() on resume path
+    - dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
+    - dmaengine: stm32-dma: fix stm32_dma_get_max_width
+    - NFS: Fix up commit deadlocks
+    - NFS: Fix an Oops in pnfs_mark_request_commit()
+    - Fix user namespace leak
+    - auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
+    - auxdisplay: ht16k33: Connect backlight to fbdev
+    - auxdisplay: ht16k33: Fix frame buffer device blanking
+    - soc: fsl: dpaa2-console: free buffer before returning from
+      dpaa2_console_read
+    - netfilter: nfnetlink_queue: fix OOB when mac header was cleared
+    - dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
+    - dmaengine: tegra210-adma: fix pm runtime unbalance
+    - dmanegine: idxd: fix resource free ordering on driver removal
+    - dmaengine: idxd: reconfig device after device reset command
+    - signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)
+    - m68k: set a default value for MEMORY_RESERVE
+    - watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
+    - ar7: fix kernel builds for compiler test
+    - scsi: target: core: Remove from tmr_list during LUN unlink
+    - scsi: qla2xxx: Relogin during fabric disturbance
+    - scsi: qla2xxx: Fix gnl list corruption
+    - scsi: qla2xxx: Turn off target reset during issue_lip
+    - scsi: qla2xxx: edif: Fix app start fail
+    - scsi: qla2xxx: edif: Fix app start delay
+    - scsi: qla2xxx: edif: Flush stale events and msgs on session down
+    - scsi: qla2xxx: edif: Increase ELS payload
+    - scsi: qla2xxx: edif: Fix EDIF bsg
+    - NFSv4: Fix a regression in nfs_set_open_stateid_locked()
+    - dmaengine: idxd: fix resource leak on dmaengine driver disable
+    - i2c: xlr: Fix a resource leak in the error handling path of
+      'xlr_i2c_probe()'
+    - gpio: realtek-otto: fix GPIO line IRQ offset
+    - xen-pciback: Fix return in pm_ctrl_init()
+    - nbd: fix max value for 'first_minor'
+    - nbd: fix possible overflow for 'first_minor' in nbd_dev_add()
+    - io-wq: fix max-workers not correctly set on multi-node system
+    - net: davinci_emac: Fix interrupt pacing disable
+    - kselftests/net: add missed icmp.sh test to Makefile
+    - kselftests/net: add missed setup_loopback.sh/setup_veth.sh to Makefile
+    - kselftests/net: add missed SRv6 tests
+    - kselftests/net: add missed vrf_strict_mode_test.sh test to Makefile
+    - kselftests/net: add missed toeplitz.sh/toeplitz_client.sh to Makefile
+    - ethtool: fix ethtool msg len calculation for pause stats
+    - openrisc: fix SMP tlb flush NULL pointer dereference
+    - net: vlan: fix a UAF in vlan_dev_real_dev()
+    - net: dsa: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge
+    - ice: Fix replacing VF hardware MAC to existing MAC filter
+    - ice: Fix not stopping Tx queues for VFs
+    - kdb: Adopt scheduler's task classification
+    - ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
+    - PCI: j721e: Fix j721e_pcie_probe() error path
+    - nvdimm/btt: do not call del_gendisk() if not needed
+    - scsi: bsg: Fix errno when scsi_bsg_register_queue() fails
+    - scsi: ufs: ufshpb: Use proper power management API
+    - scsi: ufs: core: Fix NULL pointer dereference
+    - scsi: ufs: ufshpb: Properly handle max-single-cmd
+    - drm/nouveau/svm: Fix refcount leak bug and missing check against null bug
+    - nvdimm/pmem: cleanup the disk if pmem_release_disk() is yet assigned
+    - block/ataflop: use the blk_cleanup_disk() helper
+    - block/ataflop: add registration bool before calling del_gendisk()
+    - block/ataflop: provide a helper for cleanup up an atari disk
+    - ataflop: remove ataflop_probe_lock mutex
+    - PCI: Do not enable AtomicOps on VFs
+    - cpufreq: intel_pstate: Clear HWP desired on suspend/shutdown and offline
+    - net: phy: fix duplex out of sync problem while changing settings
+    - block: fix device_add_disk() kobject_create_and_add() error handling
+    - drm/ttm: remove ttm_bo_vm_insert_huge()
+    - bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
+    - octeontx2-pf: select CONFIG_NET_DEVLINK
+    - ALSA: memalloc: Catch call with NULL snd_dma_buffer pointer
+    - mfd: core: Add missing of_node_put for loop iteration
+    - mfd: cpcap: Add SPI device ID table
+    - mfd: sprd: Add SPI device ID table
+    - mfd: altera-sysmgr: Fix a mistake caused by resource_size conversion
+    - ACPI: PM: Fix device wakeup power reference counting error
+    - libbpf: Fix lookup_and_delete_elem_flags error reporting
+    - selftests/bpf/xdp_redirect_multi: Put the logs to tmp folder
+    - selftests/bpf/xdp_redirect_multi: Use arping to accurate the arp number
+    - selftests/bpf/xdp_redirect_multi: Give tcpdump a chance to terminate cleanly
+    - selftests/bpf/xdp_redirect_multi: Limit the tests in netns
+    - drm: fb_helper: improve CONFIG_FB dependency
+    - Revert "drm/imx: Annotate dma-fence critical section in commit path"
+    - drm/amdgpu/powerplay: fix sysfs_emit/sysfs_emit_at handling
+    - can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path
+    - can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for
+      mcp251xfd_chip_rx_int_enable()
+    - mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and
+      zs_unregister_migration()
+    - zram: off by one in read_block_state()
+    - perf bpf: Add missing free to bpf_event__print_bpf_prog_info()
+    - llc: fix out-of-bound array index in llc_sk_dev_hash()
+    - nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
+    - litex_liteeth: Fix a double free in the remove function
+    - arm64: arm64_ftr_reg->name may not be a human-readable string
+    - arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
+    - bpf, sockmap: Remove unhash handler for BPF sockmap usage
+    - bpf, sockmap: Fix race in ingress receive verdict with redirect to self
+    - bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
+    - bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg
+    - dmaengine: stm32-dma: fix burst in case of unaligned memory address
+    - dmaengine: stm32-dma: avoid 64-bit division in stm32_dma_get_max_width
+    - gve: Fix off by one in gve_tx_timeout()
+    - drm/i915/fb: Fix rounding error in subsampled plane size calculation
+    - init: make unknown command line param message clearer
+    - seq_file: fix passing wrong private data
+    - drm/amdgpu: fix uvd crash on Polaris12 during driver unloading
+    - net: dsa: mv88e6xxx: Don't support >1G speeds on 6191X on ports other than
+      10
+    - net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any
+    - net: hns3: fix ROCE base interrupt vector initialization bug
+    - net: hns3: fix pfc packet number incorrect after querying pfc parameters
+    - net: hns3: fix kernel crash when unload VF while it is being reset
+    - net: hns3: allow configure ETS bandwidth of all TCs
+    - net: stmmac: allow a tc-taprio base-time of zero
+    - net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory
+    - net: marvell: mvpp2: Fix wrong SerDes reconfiguration order
+    - vsock: prevent unnecessary refcnt inc for nonblocking connect
+    - net/smc: fix sk_refcnt underflow on linkdown and fallback
+    - cxgb4: fix eeprom len when diagnostics not implemented
+    - selftests/net: udpgso_bench_rx: fix port argument
+    - thermal: int340x: fix build on 32-bit targets
+    - smb3: do not error on fsync when readonly
+    - ARM: 9155/1: fix early early_iounmap()
+    - ARM: 9156/1: drop cc-option fallbacks for architecture selection
+    - parisc: Fix backtrace to always include init funtion names
+    - parisc: Flush kernel data mapping in set_pte_at() when installing pte for
+      user page
+    - MIPS: fix duplicated slashes for Platform file path
+    - MIPS: fix *-pkg builds for loongson2ef platform
+    - MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL
+    - x86/mce: Add errata workaround for Skylake SKX37
+    - PCI/MSI: Move non-mask check back into low level accessors
+    - PCI/MSI: Destroy sysfs before freeing entries
+    - KVM: x86: move guest_pv_has out of user_access section
+    - posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()
+    - irqchip/sifive-plic: Fixup EOI failed when masked
+    - f2fs: should use GFP_NOFS for directory inodes
+    - f2fs: include non-compressed blocks in compr_written_block
+    - f2fs: fix UAF in f2fs_available_free_memory
+    - ceph: fix mdsmap decode when there are MDS's beyond max_mds
+    - erofs: fix unsafe pagevec reuse of hooked pclusters
+    - drm/i915/guc: Fix blocked context accounting
+    - block: Hold invalidate_lock in BLKDISCARD ioctl
+    - block: Hold invalidate_lock in BLKZEROOUT ioctl
+    - block: Hold invalidate_lock in BLKRESETZONE ioctl
+    - ksmbd: Fix buffer length check in fsctl_validate_negotiate_info()
+    - ksmbd: don't need 8byte alignment for request length in ksmbd_check_message
+    - dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail
+    - dmaengine: ti: k3-udma: Set r/tchan or rflow to NULL if request fail
+    - dmaengine: bestcomm: fix system boot lockups
+    - net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
+    - 9p/net: fix missing error check in p9_check_errors
+    - mm/filemap.c: remove bogus VM_BUG_ON
+    - memcg: prohibit unconditional exceeding the limit of dying tasks
+    - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
+    - mm, oom: do not trigger out_of_memory from the #PF
+    - mm, thp: lock filemap when truncating page cache
+    - mm, thp: fix incorrect unmap behavior for private pages
+    - mfd: dln2: Add cell for initializing DLN2 ADC
+    - video: backlight: Drop maximum brightness override for brightness zero
+    - bcache: fix use-after-free problem in bcache_device_free()
+    - bcache: Revert "bcache: use bvec_virt"
+    - PM: sleep: Avoid calling put_device() under dpm_list_mtx
+    - s390/cpumf: cpum_cf PMU displays invalid value after hotplug remove
+    - s390/cio: check the subchannel validity for dev_busid
+    - s390/tape: fix timer initialization in tape_std_assign()
+    - s390/ap: Fix hanging ioctl caused by orphaned replies
+    - s390/cio: make ccw_device_dma_* more robust
+    - remoteproc: elf_loader: Fix loading segment when is_iomem true
+    - remoteproc: Fix the wrong default value of is_iomem
+    - remoteproc: imx_rproc: Fix ignoring mapping vdev regions
+    - remoteproc: imx_rproc: Fix rsc-table name
+    - mtd: rawnand: fsmc: Fix use of SM ORDER
+    - mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines
+    - powerpc/vas: Fix potential NULL pointer dereference
+    - powerpc/bpf: Fix write protecting JIT code
+    - powerpc/32e: Ignore ESR in instruction storage interrupt handler
+    - powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload
+    - powerpc/security: Use a mutex for interrupt exit code patching
+    - powerpc/64s/interrupt: Fix check_return_regs_valid() false positive
+    - powerpc/pseries/mobility: ignore ibm, platform-facilities updates
+    - powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n
+    - drm/sun4i: Fix macros in sun8i_csc.h
+    - PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
+    - PCI: aardvark: Fix PCIe Max Payload Size setting
+    - SUNRPC: Partial revert of commit 6f9f17287e78
+    - drm/amd/display: Look at firmware version to determine using dmub on dcn21
+    - media: vidtv: move kfree(dvb) to vidtv_bridge_dev_release()
+    - cifs: fix memory leak of smb3_fs_context_dup::server_hostname
+    - ath10k: fix invalid dma_addr_t token assignment
+    - mmc: moxart: Fix null pointer dereference on pointer host
+    - selftests/x86/iopl: Adjust to the faked iopl CLI/STI usage
+    - selftests/bpf: Fix also no-alu32 strobemeta selftest
+    - arch/cc: Introduce a function to check for confidential computing features
+    - x86/sev: Add an x86 version of cc_platform_has()
+    - x86/sev: Make the #VC exception stacks part of the default stacks storage
+    - media: videobuf2: always set buffer vb2 pointer
+    - media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference
+    - Linux 5.15.3
+
+  * kernel panic: NULL pointer dereference in wb_timer_f() (LP: #1947557) //
+    Jammy update: v5.15.3 upstream stable release (LP: #1951822)
+    - blk-wbt: prevent NULL pointer dereference in wb_timer_fn
+
+  * Medion Notebook Keyboard not working (LP: #1909814) // Jammy update: v5.15.3
+    upstream stable release (LP: #1951822)
+    - ACPI: resources: Add DMI-based legacy IRQ override quirk
+
+  * Enable CONFIG_INTEL_IOMMU_DEFAULT_ON and
+    CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON on jammy 5.15 (LP: #1951440)
+    - [Config] enable Intel DMA remapping options by default
+
+  * Thinkpad E14 Gen2: Kernel panic with trackpad and trackpoint enabled
+    (LP: #1945590)
+    - SAUCE: Input: elantech - Fix stack out of bound access in
+      elantech_change_report_id()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: LSM: Specify which LSM to display (using struct cred as input)
+    - SAUCE: selftests/seccomp: fix check of fds being assigned
+    - [Config] enable SUNRPC_DISABLE_INSECURE_ENCTYPES
+    - [Config] updateconfigs following v5.15.3, v5.15.4 import
+
+  * Miscellaneous upstream changes
+    - binder: use cred instead of task for selinux checks
+    - binder: use cred instead of task for getsecid
+    - Revert "UBUNTU: SAUCE: storvsc: use small sg_tablesize on x86"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 22 Nov 2021 13:14:15 +0100
+
+linux (5.15.0-11.11) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-11.11 -proposed tracker (LP: #1950948)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * OOPs on boot: invalid opcode: 0000 [#1] SMP NOPTI (LP: #1942215)
+    - SAUCE: ACPICA: prevent out-of-bound access with buggy DSDT
+    - [Config] disable UBSAN
+    - SAUCE: ACPICA: avoid accessing operands out-of-bounds
+
+  * Jammy update: v5.15.2 upstream stable release (LP: #1950949)
+    - KVM: x86: avoid warning with -Wbitwise-instead-of-logical
+    - Revert "x86/kvm: fix vcpu-id indexed array sizes"
+    - usb: ehci: handshake CMD_RUN instead of STS_HALT
+    - usb: gadget: Mark USB_FSL_QE broken on 64-bit
+    - usb: musb: Balance list entry in musb_gadget_queue
+    - usb-storage: Add compatibility quirk flags for iODD 2531/2541
+    - Revert "proc/wchan: use printk format instead of lookup_symbol_name()"
+    - binder: use euid from cred instead of using task
+    - binder: don't detect sender/target during buffer cleanup
+    - kfence: always use static branches to guard kfence_alloc()
+    - kfence: default to dynamic branch instead of static keys mode
+    - btrfs: fix lzo_decompress_bio() kmap leakage
+    - staging: rtl8712: fix use-after-free in rtl8712_dl_fw
+    - isofs: Fix out of bound access for corrupted isofs image
+    - comedi: dt9812: fix DMA buffers on stack
+    - comedi: ni_usb6501: fix NULL-deref in command paths
+    - comedi: vmk80xx: fix transfer-buffer overflows
+    - comedi: vmk80xx: fix bulk-buffer overflow
+    - comedi: vmk80xx: fix bulk and interrupt message timeouts
+    - staging: r8712u: fix control-message timeout
+    - staging: rtl8192u: fix control-message timeouts
+    - staging: r8188eu: fix memleak in rtw_wx_set_enc_ext
+    - media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
+    - rsi: fix control-message timeout
+    - Linux 5.15.2
+
+  * reuseport_bpf_numa in net from ubuntu_kernel_selftests fails on ppc64le
+    (LP: #1867570)
+    - selftests/net: Fix reuseport_bpf_numa by skipping unavailable nodes
+
+  * Miscellaneous Ubuntu changes
+    - packaging: switch getabis to the linux package name
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (no-up) rename the adv7511 drm driver to adv7511_drm"
+    - Revert "UBUNTU: SAUCE: drm/i915/dp: Use max params for older panels"
+    - Revert "UBUNTU: SAUCE: i915: Fix build error due to missing struct
+      definition"
+    - selftests/core: fix conflicting types compile error for close_range()
+    - selftests: net: test_vxlan_under_vrf: fix HV connectivity test
+    - Revert "UBUNTU: SAUCE: ACPICA: prevent out-of-bound access with buggy DSDT"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 15 Nov 2021 10:12:47 +0100
+
+linux (5.15.0-10.10) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-10.10 -proposed tracker (LP: #1950133)
+
+  * Jammy update: v5.15.1 upstream stable release (LP: #1950131)
+    - sfc: Fix reading non-legacy supported link modes
+    - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
+    - Revert "xhci: Set HCD flag to defer primary roothub registration"
+    - Revert "usb: core: hcd: Add support for deferring roothub registration"
+    - drm/amdkfd: fix boot failure when iommu is disabled in Picasso.
+    - Revert "soc: imx: gpcv2: move reset assert after requesting domain power up"
+    - ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
+    - Revert "wcn36xx: Disable bmps when encryption is disabled"
+    - drm/amdgpu: revert "Add autodump debugfs node for gpu reset v8"
+    - drm/amd/display: Revert "Directly retrain link from debugfs"
+    - Revert "drm/i915/gt: Propagate change in error status to children on unhold"
+    - ALSA: usb-audio: Add quirk for Audient iD14
+    - Linux 5.15.1
+
+  * Miscellaneous Ubuntu changes
+    - packaging: fixup previous ABI/spin to -9.9
+    - [Packaging] Drop unused d-i build-deps and packaging
+    - [Packaging] Drop now unsupported d-i/ input files
+
+  * Miscellaneous upstream changes
+    - selftests: net: properly support IPv6 in GSO GRE test
+    - signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 08 Nov 2021 14:43:24 +0100
+
+linux (5.15.0-9.9) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-1.1 -proposed tracker (LP: #1949876)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] update Ubuntu.md
+
+  * Add F81966 watchdog support (LP: #1949063)
+    - SAUCE: ODM: watchdog: f71808e_wdt: Add F81966 support
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Rewrite debian/scripts/misc/insert-changes.pl in Python
+    - [Packaging] change source package name to linux
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 04 Nov 2021 18:47:19 +0100
+
+linux (5.15.0-0.0) jammy; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 04 Nov 2021 16:47:16 +0100
+
+linux-unstable (5.15.0-8.8) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.15.0-8.8 -proposed tracker (LP: #1949436)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Drop "UBUNTU: SAUCE: cachefiles: Page leaking in
+    cachefiles_read_backing_file while vmscan is active" (LP: #1947709)
+    - Revert "UBUNTU: SAUCE: cachefiles: Page leaking in
+      cachefiles_read_backing_file while vmscan is active"
+
+  * Add l2tp.sh in net from ubuntu_kernel_selftests back (LP: #1934293)
+    - Revert "UBUNTU: SAUCE: selftests/net -- disable l2tp.sh test"
+
+  * Check for changes relevant for security certifications (LP: #1945989)
+    - [Packaging] Add fips-checks as part of finalchecks
+
+  * Add final-checks to check certificates (LP: #1947174)
+    - [Packaging] Add system trusted and revocation keys final check
+
+  * Can only reach PC3 when ethernet is plugged r8169 (LP: #1946433)
+    - r8169: Enable chip-specific ASPM regardless of PCIe ASPM status
+    - PCI/ASPM: Introduce a new helper to report ASPM capability
+    - r8169: Implement dynamic ASPM mechanism
+
+  * rtw89 kernel module for Realtek 8852 wifi is missing (LP: #1945967)
+    - rtw89: add Realtek 802.11ax driver
+    - rtw89: Remove redundant check of ret after call to rtw89_mac_enable_bb_rf
+    - rtw89: fix return value check in rtw89_cam_send_sec_key_cmd()
+    - rtw89: remove unneeded semicolon
+    - [Config] RTW89=m
+
+  * Fix A yellow screen pops up in an instant (< 1 second) and then disappears
+    before loading the system (LP: #1945932)
+    - drm/i915: Stop force enabling pipe bottom color gammma/csc
+
+  * disable CONFIG_KFENCE_STATIC_KEYS in linux 5.15 (LP: #1948038)
+    - [Config] disable CONFIG_KFENCE_STATIC_KEYS
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Remove old and unused firmware helper scripts
+    - [Packaging] Replace Perl oneliner with Bash statements
+    - rebase to v5.15
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 02 Nov 2021 08:29:45 +0100
+
+linux-unstable (5.15.0-7.7) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.15.0-7.7 -proposed tracker (LP: #1948770)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Temporarily disable signing for ppc64el and s390x
+    - packaging: switch release to Jammy
+    - rebase to v5.15-rc7
+    - [Config] GCC version update
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 26 Oct 2021 11:38:14 +0200
+
+linux-unstable (5.15.0-6.6) jammy; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-6.6 -proposed tracker (LP: #1947565)
+
+  * [impish] Remove the downstream xr-usb-uart driver (LP: #1945938)
+    - SAUCE: xr-usb-serial: remove driver
+    - [Config] update modules list
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc6
+    - [Config] update config & annotations following v5.15-rc6 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: xr-usb-serial: switch to tty_alloc_driver() and
+      tty_driver_kref_put()"
+    - Revert "UBUNTU: SAUCE: xr-usb-serial: update return code for
+      xr_usb_serial_tty_write_room() and xr_usb_serial_tty_chars_in_buffer()"
+    - Revert "UBUNTU: [Packaging] FTBFS: disable zfs"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 Oct 2021 12:24:45 +0200
+
+linux-unstable (5.15.0-5.5) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-5.5 -proposed tracker (LP: #1946338)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc5
+    - [Config] FB_SIMPLE=m
+    - [Config] update annotations
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 11 Oct 2021 12:14:02 +0200
+
+linux-unstable (5.15.0-4.4) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-4.4 -proposed tracker (LP: #1945953)
+
+  * Fix missing HDMI audio on Intel RKL (LP: #1945556)
+    - drm/i915/audio: Use BIOS provided value for RKL HDA link
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: media: atomisp: add missing return type (fix -Werror=return-type)
+    - SAUCE: xr-usb-serial: switch to tty_alloc_driver() and tty_driver_kref_put()
+    - rebase to v5.15-rc4
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] FTBFS: disable INTEL_ATOMISP"
+    - Revert "UBUNTU: [Config] FTBFS: disable xr-usb-serial"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 04 Oct 2021 10:52:41 +0200
+
+linux-unstable (5.15.0-3.3) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-3.3 -proposed tracker (LP: #1944944)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc3
+    - [Config] updateconfigs following v5.15-rc3 rebase
+    - [Packaging] correctly evaluate release in update-dkms-versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 27 Sep 2021 16:48:03 +0200
+
+linux-unstable (5.15.0-2.2) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-2.2 -proposed tracker (LP: #1944423)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc2
+    - [Config] updateconfigs following v5.15-rc2 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 21 Sep 2021 11:46:59 +0200
+
+linux-unstable (5.15.0-1.1) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  *  LRMv5: switch primary version handling to kernel-versions data set
+    (LP: #1928921)
+    - [Packaging] switch to kernel-versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] remove remaining references to ports
+    - [Packaging] drop x32 architecture configs
+    - [Config] mark CONFIG_BPF_UNPRIV_DEFAULT_OFF enforced
+    - [Packaging] bump kernel version to 5.15
+    - rebase to v5.15-rc1
+    - [Config] updateconfigs following v5.15-rc1 rebase
+    - [Config] FTBFS: disable INTEL_ATOMISP
+    - [Config] FTBFS: disable xr-usb-serial
+    - [Packaging] FTBFS: disable zfs
+
+  * Miscellaneous upstream changes
+    - Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables
+      ASPM"
+    - Revert "UBUNTU: SAUCE: RDMA/core: Introduce peer memory interface"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 17 Sep 2021 11:42:25 +0200
+
+linux-unstable (5.15.0-0.0) impish; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 15 Sep 2021 11:54:10 +0200
+
+linux-unstable (5.14.0-9.9) impish; urgency=medium
+
+  * impish/linux-unstable: 5.14.0-9.9 -proposed tracker (LP: #1943022)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] NVIDIA -- Add the NVIDIA 470 driver
+    - [Packaging] NVIDIA: transition -460 and -465 to -470, transition -460-server
+      to -470-server
+
+  * Miscellaneous upstream changes
+    - vt_kdsetmode: extend console locking
+    - Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
+    - net: dsa: mt7530: fix VLAN traffic leaks again
+    - btrfs: fix NULL pointer dereference when deleting device by invalid id
+    - Revert "floppy: reintroduce O_NDELAY fix"
+    - fscrypt: add fscrypt_symlink_getattr() for computing st_size
+    - ext4: report correct st_size for encrypted symlinks
+    - f2fs: report correct st_size for encrypted symlinks
+    - ubifs: report correct st_size for encrypted symlinks
+    - net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
+    - audit: move put_tree() to avoid trim_trees refcount underflow and UAF
+    - Linux 5.14.1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 08 Sep 2021 12:20:18 +0200
+
+linux-unstable (5.14.0-8.8) impish; urgency=medium
+
+  * impish/linux-unstable: 5.14.0-8.8 -proposed tracker (LP: #1941887)
+
+  * Fix  Intel AC9560 BT function cannot turn on if BT turn off before S3 entry
+    (LP: #1941696)
+    - SAUCE: Bluetooth: btusb: add a reject table to disable msft
+
+  *  Add USB4 support for AMD SoC (LP: #1941036)
+    - thunderbolt: Add vendor specific NHI quirk for auto-clearing interrupt
+      status
+    - thunderbolt: Handle ring interrupt by reading interrupt status register
+    - thunderbolt: Do not read control adapter config space
+    - thunderbolt: Fix port linking by checking all adapters
+
+  * Support builtin revoked certificates (LP: #1932029)
+    - [Config] Enforce SYSTEM_TRUSTED_KEYS and SYSTEM_REVOCATION_KEYS
+
+  * GPIO error logs in start and dmesg after update of kernel (LP: #1937897)
+    - ODM: mfd: Check AAEON BFPI version before adding device
+
+  * initramfs-tools & kernel: use zstd as the default compression method
+    (LP: #1931725)
+    - [Config] enforce ZSTD compression
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.14
+    - [Config] RESET_MCHP_SPARX5 depends on ARCH_SPARX5
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] FTBFS: disable zfs"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 30 Aug 2021 12:57:19 +0200
+
+linux-unstable (5.14.0-7.7) impish; urgency=medium
+
+  * Please enable CONFIG_UBSAN_BOUNDS (LP: #1914685)
+    - [Config] Enable CONFIG_UBSAN_BOUNDS
+
+  * CONFIG_HARDENED_USERCOPY_FALLBACK should be disabled (LP: #1855340)
+    - [Config] Disable CONFIG_HARDENED_USERCOPY_FALLBACK
+
+  * fs: removing mandatory locks (LP: #1940392)
+    - [Config] Disable CONFIG_MANDATORY_FILE_LOCKING
+
+  * Fix kernel panic caused by legacy devices on AMD platforms (LP: #1936682)
+    - SAUCE: iommu/amd: Keep swiotlb enabled to ensure devices with 32bit DMA
+      still work
+
+  * ALSA: hda/cs8409: Add support for dolphin (LP: #1939541)
+    - ALSA: hda/cirrus: Move CS8409 HDA bridge to separate module
+    - ALSA: hda/cs8409: Move arrays of configuration to a new file
+    - ALSA: hda/cs8409: Use enums for register names and coefficients
+    - ALSA: hda/cs8409: Mask all CS42L42 interrupts on initialization
+    - ALSA: hda/cs8409: Reduce HS pops/clicks for Cyborg
+    - ALSA: hda/cs8409: Disable unnecessary Ring Sense for Cyborg/Warlock/Bullseye
+    - ALSA: hda/cs8409: Disable unsolicited responses during suspend
+    - ALSA: hda/cs8409: Disable unsolicited response for the first boot
+    - ALSA: hda/cs8409: Mask CS42L42 wake events
+    - ALSA: hda/cs8409: Simplify CS42L42 jack detect.
+    - ALSA: hda/cs8409: Prevent I2C access during suspend time
+    - ALSA: hda/cs8409: Generalize volume controls
+    - ALSA: hda/cs8409: Dont disable I2C clock between consecutive accesses
+    - ALSA: hda/cs8409: Avoid setting the same I2C address for every access
+    - ALSA: hda/cs8409: Avoid re-setting the same page as the last access
+    - ALSA: hda/cs8409: Support i2c bulk read/write functions
+    - ALSA: hda/cs8409: Separate CS8409, CS42L42 and project functions
+    - ALSA: hda/cs8409: Move codec properties to its own struct
+    - ALSA: hda/cs8409: Support multiple sub_codecs for Suspend/Resume/Unsol
+      events
+    - ALSA: hda/cs8409: Add Support to disable jack type detection for CS42L42
+    - ALSA: hda/cs8409: Add support for dolphin
+    - ALSA: hda/cs8409: Enable Full Scale Volume for Line Out Codec on Dolphin
+    - ALSA: hda/cs8409: Set fixed sample rate of 48kHz for CS42L42
+    - ALSA: hda/cs8409: Use timeout rather than retries for I2C transaction waits
+    - ALSA: hda/cs8409: Remove unnecessary delays
+    - ALSA: hda/cs8409: Follow correct CS42L42 power down sequence for suspend
+    - ALSA: hda/cs8409: Unmute/Mute codec when stream starts/stops
+    - ALSA: hda/cs8409: Prevent pops and clicks during suspend
+    - SAUCE: ALSA: hda/cs8409: Prevent pops and clicks during reboot
+    - [Config] Enable Cirrus Logic HDA bridge support
+
+  * e1000e: add handshake with the Intel CSME to support S0ix (LP: #1937252)
+    - SAUCE: e1000e: Add handshake with the CSME to support S0ix
+    - SAUCE: e1000e: Add polling mechanism to indicate CSME DPG exit
+    - SAUCE: e1000e: Additional PHY power saving in S0ix
+
+  * AMDGPU: Fix System hang after resume from suspend (LP: #1940204)
+    - SAUCE: drm/amdgpu: disable BACO support for 699F:C7 polaris12 SKU
+      temporarily
+
+  * [Regression] Audio card [8086:9d71] not detected after upgrade from linux
+    5.4 to 5.8 (LP: #1915117)
+    - [Config] set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.14-rc7
+    - [Config] updateconfigs following 5.14-rc7 rebase
+    - [Config] Enable CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT
+    - [Config] annotations: set CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT to y
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] annotations: set
+      CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y"
+    - Revert "UBUNTU: [Config] set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to
+      y"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 24 Aug 2021 10:32:31 +0200
+
+linux-unstable (5.14.0-6.6) impish; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - no changes upload (to avoid picking up libc6 from -proposed)
+
+  * No changes upload (to avoid picking up libc6 from -proposed)
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 18 Aug 2021 13:41:16 +0200
+
+linux-unstable (5.14.0-5.5) impish; urgency=medium
+
+  * disable “CONFIG_HISI_DMA” config for ubuntu version (LP: #1936771)
+    - [Config] Disable CONFIG_HISI_DMA
+
+  * Dell XPS 17 (9710) PCI/internal sound card not detected  (LP: #1935850)
+    - ASoC: Intel: sof_sdw: include rt711.h for RT711 JD mode
+    - ASoC: Intel: sof_sdw: add quirk for Dell XPS 9710
+
+  * [regression] USB device is not detected during boot (LP: #1939638)
+    - SAUCE: Revert "usb: core: reduce power-on-good delay time of root hub"
+
+  * armhf build failure (LP: #1939308)
+    - SAUCE: arm: Fix instruction set selection for GCC 11
+
+  * REGRESSION: shiftfs lets sendfile fail with EINVAL (LP: #1939301)
+    - SAUCE: shiftfs: fix sendfile() invocations
+
+  * Wobbly graphics on built-in display since linux-image-5.11.0-22-generic
+    (LP: #1936708)
+    - SAUCE: drm/i915/dp: Use max params for older panels
+
+  * [SRU][H/OEM-5.10/OEM-5.13/U] Fix system hang after unplug tbt dock
+    (LP: #1938689)
+    - SAUCE: igc: fix page fault when thunderbolt is unplugged
+
+  * e1000e blocks the boot process when it tried to write checksum to its NVM
+    (LP: #1936998)
+    - SAUCE: e1000e: Do not take care about recovery NVM checksum
+
+  * [Regression] Audio card [8086:9d71] not detected after upgrade from linux
+    5.4 to 5.8 (LP: #1915117)
+    - [Config] set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y
+    - [Config] annotations: set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs following 5.14-rc6 rebase
+    - rebase to v5.14-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 17 Aug 2021 17:49:15 +0200
+
+linux-unstable (5.14.0-4.4) impish; urgency=medium
+
+  * impish/linux-unstable: 5.14.0-4.4 -proposed tracker (LP: #1938566)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous upstream changes
+    - Revert "riscv: Get CPU manufacturer information"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 03 Aug 2021 14:50:27 +0200
+
+linux-unstable (5.14.0-3.3) impish; urgency=medium
+
+  * Add additional Mediatek MT7921 WiFi/BT device IDs (LP: #1937004)
+    - SAUCE: Bluetooth: btusb: Add Mediatek MT7921 support for Foxconn
+    - SAUCE: Bluetooth: btusb: Add Mediatek MT7921 support for IMC Network
+    - SAUCE: Bluetooth: btusb: Add support for Foxconn Mediatek Chip
+
+  * Fix display output on HP hybrid GFX laptops (LP: #1936296)
+    - drm/i915: Invoke another _DSM to enable MUX on HP Workstation laptops
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.14-rc3
+    - [Config] updateconfigs following 5.14-rc3 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 26 Jul 2021 12:52:38 +0200
+
+linux-unstable (5.14.0-2.2) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: xr-usb-serial: update return code for xr_usb_serial_tty_write_room()
+      and xr_usb_serial_tty_chars_in_buffer()
+    - SAUCE: platform/x86: dell-uart-backlight: update return code for
+      uart_chars_in_buffer(()
+    - [Config] updateconfigs following 5.14-rc2 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] FTBFS: disable ubuntu/xr-usb-serial"
+    - Revert "UBUNTU: [Config] FTBFS: disable DELL_UART_BACKLIGHT"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 22 Jul 2021 11:03:28 +0200
+
+linux-unstable (5.14.0-1.1) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] bump kernel version to 5.14
+    - [Config] updateconfigs following 5.14-rc1 rebase
+    - [Config] update annotations
+    - [Packaging] FTBFS: disable zfs
+    - [Config] FTBFS: disable DELL_UART_BACKLIGHT
+    - [Config] FTBFS: disable ubuntu/xr-usb-serial
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] update variants"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 16 Jul 2021 15:20:04 +0200
+
+linux-unstable (5.14.0-0.0) impish; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 13 Jul 2021 12:15:35 +0200
+
+linux (5.13.0-11.11) impish; urgency=medium
+
+  * impish/linux: 5.13.0-11.11 -proposed tracker (LP: #1933854)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Support builtin revoked certificates (LP: #1932029)
+    - [Packaging] build canonical-revoked-certs.pem from branch/arch certs
+    - [Packaging] Revoke 2012 UEFI signing certificate as built-in
+    - [Config] Configure CONFIG_SYSTEM_REVOCATION_KEYS with revoked keys
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Change source package name to linux
+
+  * Miscellaneous upstream changes
+    - mm/page_alloc: Correct return value of populated elements if bulk array is
+      populated
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 29 Jun 2021 07:50:25 +0200
+
+linux (5.13.0-10.10) impish; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Jun 2021 08:40:05 +0200
+
+linux-unstable (5.13.0-10.10) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-10.10 -proposed tracker (LP: #1933795)
+
+  * Pixel format change broken for Elgato Cam Link 4K (LP: #1932367)
+    - media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
+
+  * initramfs-tools & kernel: use zstd as the default compression method
+    (LP: #1931725)
+    - s390/decompressor: correct BOOT_HEAP_SIZE condition
+    - s390/boot: add zstd support
+    - [Packaging] use ZSTD to compress s390 kernels
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: tls: fix chacha+bidir tests
+    - SAUCE: selftests: icmp_redirect: support expected failures
+    - [Config] update configs and annotations after rebase to 5.13
+
+  * Miscellaneous upstream changes
+    - tls: prevent oversized sendfile() hangs by ignoring MSG_MORE
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Jun 2021 08:40:05 +0200
+
+linux-unstable (5.13.0-9.9) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-9.9 -proposed tracker (LP: #1933070)
+
+  * Add support for selective build of special drivers (LP: #1912789)
+    - [Packaging] Add support for ODM drivers
+    - [Packaging] Turn on ODM support for amd64
+    - [Packaging] Fix ODM support in actual build
+    - [Packaging] Fix ODM DRIVERS Kconfig
+
+  * Add support for IO functions of AAEON devices (LP: #1929504)
+    - ODM: [Config] update config for AAEON devices
+    - ODM: hwmon: add driver for AAEON devices
+    - ODM: leds: add driver for AAEON devices
+    - ODM: watchdog: add driver for AAEON devices
+    - ODM: gpio: add driver for AAEON devices
+    - ODM: mfd: Add support for IO functions of AAEON devices
+
+  * Disable hv-kvp-daemon.service on certain instance types (LP: #1932081)
+    - [Packaging]: Add kernel command line condition to hv-kvp-daemon service
+
+  * Fix non-working GPU on Some HP desktops (LP: #1931147)
+    - PCI: Coalesce host bridge contiguous apertures
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: seccomp: bump up timeout to 5min
+    - SAUCE: Revert "net/tls(TLS_SW): Add selftest for 'chunked' sendfile test"
+    - [Config] update annotations after rebase to 5.13-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Jun 2021 10:55:36 +0200
+
+linux-unstable (5.13.0-8.8) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-8.8 -proposed tracker (LP: #1932018)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * initramfs-tools & kernel: use zstd as the default compression method
+    (LP: #1931725)
+    - [Config] use ZSTD to compress amd64 kernels
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable signing for ppc64el
+    - SAUCE: powerpc: Fix initrd corruption with relative jump labels
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 15 Jun 2021 15:07:34 +0200
+
+linux-unstable (5.13.0-7.7) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-7.7 -proposed tracker (LP: #1931840)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+    - [Packaging] resync getabis
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  * Intel ADL-S graphics feature enabling (LP: #1931240)
+    - SAUCE: drm/i915/adl_s: ADL-S platform Update PCI ids for Mobile BGA
+
+  * Kernel package builds running out of space on builders (LP: #1930713)
+    - [Config] CONFIG_DEBUG_INFO_COMPRESSED=n
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] remove nvidia dkms build support
+    - [Config] remove now unsued do_dkms_nvidia* build variables
+    - [Config] enable signing for s390x
+    - [Config] update annotations after configs review
+    - [Config] update toolchain versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Jun 2021 11:53:08 +0200
+
+linux-unstable (5.13.0-6.6) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-6.6 -proposed tracker (LP: #1931071)
+
+  * Kernel package builds running out of space on builders (LP: #1930713)
+    - [Debian] use stamps for flavour install targets
+    - [Debian] run install-$(flavour) targets during build phase
+    - [Debian] remove dh_testroot from install targets
+    - [Debian] dkms-build -- use fakeroot if not running as root
+    - [Debian] exclude $(DEBIAN)/__abi.current from linux-source
+
+  * [UBUNTU 21.04] tools/kvm_stat: Add restart delay (LP: #1921870)
+    - [Debian] install kvm_stat systemd service
+
+  * Debugging symbols (dbgsym) packages are missing GDB kernel scripts
+    (LP: #1928715)
+    - [Packaging] Build and include GDB Python scripts into debug packages
+
+  * Can't detect intel wifi 6235 (LP: #1920180)
+    - SAUCE: iwlwifi: add new pci id for 6235
+
+  * Select correct boot VGA when BIOS doesn't do it properly (LP: #1929217)
+    - vgaarb: Use ACPI HID name to find integrated GPU
+
+  * Fix kernel panic on Intel Bluetooth (LP: #1928838)
+    - Bluetooth: Shutdown controller after workqueues are flushed or cancelled
+
+  * build module CONFIG_SND_SOC_INTEL_SOUNDWIRE_SOF_MACH=m for 5.11,  5.13-rc2
+    and later (LP: #1921632)
+    - [Config] enable soundwire audio mach driver
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_SND_SOC_RT1308 can only be enabled on amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 07 Jun 2021 10:45:13 +0200
+
+linux-unstable (5.13.0-5.5) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-5.5 -proposed tracker (LP: #1930205)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] set CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 31 May 2021 12:32:38 +0200
+
+linux-unstable (5.13.0-4.4) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-4.4 -proposed tracker (LP: #1929404)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Support importing mokx keys into revocation list from the mok table
+    (LP: #1928679)
+    - SAUCE: integrity: add informational messages when revoking certs
+
+  * Support importing mokx keys into revocation list from the mok table
+    (LP: #1928679) // CVE-2020-26541 when certificates are revoked via
+    MokListXRT.
+    - SAUCE: integrity: Load mokx certs from the EFI MOK config table
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Temporarily disable signing for ppc64el and s390x
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Be more careful about copying up
+      sxid files"
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Propogate nosuid from lower and
+      upper mounts"
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Enable user namespace mounts"
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: ensure mounter privileges when
+      reading directories"
+    - SAUCE: Revert "UBUNTU: SAUCE: fs: Move SB_I_NOSUID to the top of s_iflags"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 24 May 2021 13:06:17 +0200
+
+linux-unstable (5.13.0-3.3) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-3.3 -proposed tracker (LP: #1928655)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 17 May 2021 11:55:02 +0200
+
+linux-unstable (5.13.0-2.2) impish; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable CONFIG_DEBUG_INFO_COMPRESSED
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] temporarily disable BPF JIT"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 14 May 2021 09:19:02 +0200
+
+linux-unstable (5.13.0-1.1) impish; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 12 May 2021 11:35:23 +0200
+
+linux-unstable (5.13.0-0.0) impish; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 11 May 2021 08:40:09 +0200
+
+linux-unstable (5.12.0-11.11) impish; urgency=medium
+
+  * Impish update: v5.12.1 upstream stable release (LP: #1927094)
+    - net: hso: fix NULL-deref on disconnect regression
+    - USB: CDC-ACM: fix poison/unpoison imbalance
+    - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
+    - cfg80211: fix locking in netlink owner interface destruction
+    - mei: me: add Alder Lake P device id.
+    - Linux 5.12.1
+
+  * Packaging resync (LP: #1786013) // Impish update: v5.12.1 upstream stable
+    release (LP: #1927094)
+    - update dkms package versions
+
+  * Gigabyte R120-T33 (ARM ThunderX SoC) fails to boot in ACPI mode
+    (LP: #1925075) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure
+
+  * Fix kernel panic at boot on dual GFX systems (LP: #1926792) // Impish
+    update: v5.12.1 upstream stable release (LP: #1927094)
+    - drm/amdgpu: Register VGA clients after init can no longer fail
+
+  * On TGL platforms screen shows garbage when browsing website by scrolling
+    mouse (LP: #1926579) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - SAUCE: drm/i915/display: Disable PSR2 if TGL Display stepping is B1 from A0
+
+  * CirrusLogic: Cracking noises appears in built-in speaker when output volume
+    is set >80% (LP: #1924997) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - SAUCE: ALSA: hda/cirrus: Use CS8409 Equalizer to fix abnormal sounds on
+      Bullseye
+
+  * Enable mute/micmute LEDs and limit mic boost on EliteBook 845 G8
+    (LP: #1925415) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook
+      845 G8
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: PCI: Disable broken RTIT_BAR of Intel TH"
+    - Revert "UBUNTU: [Config] temporarily disable ZFS"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 04 May 2021 18:35:54 +0200
+
+linux-unstable (5.12.0-10.10) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Drop versioned ABI directory names
+    - [Packaging] getabis: Download ABIs into an unversioned directory
+    - [Packaging] final-checks: Handle unversioned ABI directories
+    - bump to impish
+    - [Config] GCC version update
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 29 Apr 2021 12:27:20 +0200
+
+linux-unstable (5.12.0-9.9) impish; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Apr 2021 11:14:16 -0500
+
+linux-unstable (5.12.0-8.8) hirsute; urgency=medium
+
+  * CVE-2021-3492
+    - SAUCE: shiftfs: free allocated memory in shiftfs_btrfs_ioctl_fd_replace()
+      error paths
+    - SAUCE: shiftfs: handle copy_to_user() return values correctly
+
+  * Fix no picture from HDMI when it's plugged after boot (LP: #1924238)
+    - drm/i915/display: Handle lane polarity for DDI port
+
+  * hirsute beta desktop AMD64 ISO kernel panic on boot when booting using UEFI
+    (LP: #1922403)
+    - SAUCE: efifb: Check efifb_pci_dev before using it
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.12-rc8
+    - [Config] updateconfigs following 5.12-rc8 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc8
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 19 Apr 2021 11:37:27 +0200
+
+linux-unstable (5.12.0-7.7) hirsute; urgency=medium
+
+  * drm/i915: Drop force_probe requirement for Rocket Lake (LP: #1905466)
+    - drm/i915/rkl: Remove require_force_probe protection
+
+  * HP m400 cartridges fail to find NIC when deploying hirsute (LP: #1918793)
+    - PCI: xgene: Fix cfg resource mapping
+
+  * Update - Fix no screen show on display after S3 on CML-R  (LP: #1922768)
+    - drm/i915/gen9bc: Handle TGP PCH during suspend/resume
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: RDMA/core: Introduce peer memory interface
+    - Rebase to v5.12-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 12 Apr 2021 11:48:07 +0200
+
+linux-unstable (5.12.0-6.6) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * i915 doesn't support some high pixel clock 4k * 60Hz monitors (LP: #1922372)
+    - drm/i915/vbt: update DP max link rate table
+
+  * Tegra "mmc0: Timeout waiting for hardware interrupt" (LP: #1921140)
+    - SAUCE: mmc: host: Add required callbacks to set/clear CQE_EN bit
+
+  * Enable ath11k debugfs/tracing (LP: #1922033)
+    - [Config] enable ath11k debugfs/tracing
+
+  * Fix mic on P620 after S3 resume (LP: #1921757)
+    - ALSA: usb-audio: Carve out connector value checking into a helper
+    - ALSA: usb-audio: Check connector value on resume
+
+  * Miscellaneous Ubuntu changes
+    - [Config] amd64,arm64: build KFENCE support but disable it by default
+      (KFENCE_SAMPLE_INTERVAL=0)
+    - Rebase to v5.12-rc6
+
+  * Miscellaneous upstream changes
+    - drm/dp: add MSO related DPCD registers
+    - drm/i915/edp: reject modes with dimensions other than fixed mode
+    - drm/i915/edp: always add fixed mode to probed modes in ->get_modes()
+    - drm/i915/edp: read sink MSO configuration for eDP 1.4+
+    - drm/i915/reg: add stream splitter configuration definitions
+    - drm/i915/mso: add splitter state readout for platforms that support it
+    - drm/i915/mso: add splitter state check
+    - drm/i915/edp: modify fixed and downclock modes for MSO
+    - drm/i915/edp: enable eDP MSO during link training
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 07 Apr 2021 11:42:55 +0200
+
+linux-unstable (5.12.0-5.5) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * alsa/realtek: extend the delay time in the  determine_headset_type for a
+    Dell AIO (LP: #1920747)
+    - SAUCE: ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO
+
+  * power off stress test will hang on the TGL machines (LP: #1919930)
+    - SAUCE: ASoC: SOF: Intel: TGL: set shutdown callback to hda_dsp_shutdown
+    - [Config] set SND_SOC_SOF_HDA_ALWAYS_ENABLE_DMI_L1 to n
+
+  * lockdown on power (LP: #1855668)
+    - SAUCE: (lockdown) powerpc: lock down kernel in secure boot mode
+
+  * Miscellaneous Ubuntu changes
+    - [Config] arm64 -- unify build_image and kernel_file values
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: xr-usb-serial: clean up indentation
+    - SAUCE: xr-usb-serial: clean up build warnings
+    - SAUCE: apparmor: Fix build error, make sk parameter const
+    - Rebase to v5.12-rc5
+    - [Config] updateconfigs following v5.12-rc5 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (lockdown) s390: Lock down the kernel when the IPL
+      secure flag is set"
+    - Revert "UBUNTU: SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to
+      indicate secure boot mode"
+    - Revert "UBUNTU: SAUCE: (lockdown) powerpc: lock down kernel in secure boot
+      mode"
+    - Revert "UBUNTU: SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic"
+    - Revert "UBUNTU: SAUCE: (lockdown) arm64: Allow locking down the kernel under
+      EFI secure boot"
+    - Revert "UBUNTU: SAUCE: (lockdown) KEYS: Make use of platform keyring for
+      module signature verify"
+    - Revert "UBUNTU: SAUCE: (lockdown) efi: Lock down the kernel if booted in
+      secure boot mode"
+    - Revert "UBUNTU: SAUCE: (lockdown) security: lockdown: expose a hook to lock
+      the kernel down"
+    - Revert "UBUNTU: SAUCE: (lockdown) Make get_cert_list() use
+      efi_status_to_str() to print error messages."
+    - Revert "UBUNTU: SAUCE: (lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err()."
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 29 Mar 2021 12:59:38 +0200
+
+linux-unstable (5.12.0-4.4) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Fix broken efifb on graphics device without driver (LP: #1914411)
+    - SAUCE: efifb: Ensure graphics device for efifb stays at PCI D0
+
+  * Fix system sleep on TGL systems with Intel ME (LP: #1919321)
+    - SAUCE: PCI: Serialize TGL e1000e PM ops
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.12-rc4
+    - [Config] updateconfigs following v5.12-rc4 rebase
+
+  * Miscellaneous upstream changes
+    - riscv: dts: fu740: fix cache-controller interrupts
+    - riscv: sifive: fu740: cpu{1, 2, 3, 4} set compatible to sifive, u74-mc
+    - riscv: sifive: unmatched: update for 16GB rev3
+    - riscv: Add 3 SBI wrapper functions to get cpu manufacturer information
+    - riscv: Get CPU manufacturer information
+    - riscv: Introduce alternative mechanism to apply errata solution
+    - riscv: sifive: apply errata "cip-453" patch
+    - clk: sifive: Add pcie_aux clock in prci driver for PCIe driver
+    - clk: sifive: Use reset-simple in prci driver for PCIe driver
+    - MAINTAINERS: Add maintainers for SiFive FU740 PCIe driver
+    - dt-bindings: PCI: Add SiFive FU740 PCIe host controller
+    - PCI: designware: Add SiFive FU740 PCIe host controller driver
+    - riscv: dts: Add PCIe support for the SiFive FU740-C000 SoC
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 22 Mar 2021 12:43:14 +0100
+
+linux-unstable (5.12.0-3.3) hirsute; urgency=medium
+
+  *  riscv: revert SiFive Unleashed CPUFreq (LP: #1917433)
+    - SAUCE: Revert "SiFive Unleashed CPUFreq"
+
+  * Dell Precision 5550 takes up to 10 seconds to respond when coming out of
+    sleep (LP: #1919123)
+    - SAUCE: Input: i8042 - add dmi quirk
+
+  * LRMv4: switch to signing nvidia modules via the Ubuntu Modules signing key
+    (LP: #1918134)
+    - [Packaging] sync dkms-build et al from LRMv4
+
+  * curtin: install flash-kernel in arm64 UEFI unexpected (LP: #1918427)
+    - [Packaging] Allow grub-efi-arm* to satisfy recommends on ARM
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Enable Tegra support in arm64 for NVIDIA Jetson (LP: #1918471)
+    - [Config] enable ARCH_TEGRA and all Tegra SOC's
+    - [Packaging] include modern Tegra modules
+
+  * Cirrus Audio Codec CS8409/CS42L42: Input Device does not switch to headset
+    Mic when a headset is inserted (LP: #1918378)
+    - SAUCE: ALSA: hda/cirrus: Fix Headset Mic volume control name
+
+  * Cirrus Audio Codec CS8409/CS42L42 support (LP: #1916554)
+    - ALSA: hda/cirrus: Increase AUTO_CFG_MAX_INS from 8 to 18
+    - ALSA: hda/cirrus: Add support for CS8409 HDA bridge and CS42L42 companion
+      codec.
+    - ALSA: hda/cirrus: Add jack detect interrupt support from CS42L42 companion
+      codec.
+    - ALSA: hda/cirrus: Add Headphone and Headset MIC Volume Control
+
+  * drm/i915: Drop force_probe requirement for JSL (LP: #1917843)
+    - SAUCE: drm/i915: Drop require_force_probe from JSL
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Skip d-i code if udebs are disabled
+    - [Packaging] Disable udebs if $DEBIAN/d-i doesn't exist
+    - [Packaging] remove dh-systemd build dependency
+    - [Config] fix several annotaions with enforcement typos
+    - [Config] refresh annotations
+    - [Config] updateconfigs following v5.12-rc3 rebase
+    - annotations: fixup after v5.12-rc3 rebase
+    - Rebase to v5.12-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 16 Mar 2021 18:43:03 +0100
+
+linux-unstable (5.12.0-2.2) hirsute; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.12-rc2
+    - [Config] updateconfigs following v5.12-rc2 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 08 Mar 2021 11:22:04 +0100
+
+linux-unstable (5.12.0-1.1) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Support no udeb profile (LP: #1916095)
+    - [Packaging] replace custom filter script with dctrl-tools
+    - [Packaging] correctly implement noudeb build profiles.
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] dkms-versions -- remove nvidia-graphics-drivers-440-server
+    - [Debian] run ubuntu-regression-suite for linux-unstable
+    - [Packaging] remove Provides: aufs-dkms
+    - [Config] update config and annotations following v5.12-rc1 rebase
+    - [Config] disable nvidia and nvidia_server builds
+    - [Config] temporarily disable ZFS
+    - temporarily disable modules check
+    - annotations: s390: temporarily remove CONFIG_KMSG_IDS
+    - [Config] amd64: FTBFS: disable HIO
+    - [Config] FTBFS: disable SHIFT_FS
+    - [Config] s390: temporarily remove CONFIG_KMSG_IDS
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] disable nvidia and nvidia_server builds"
+    - Revert "UBUNTU: SAUCE: s390: kernel message catalog"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 04 Mar 2021 18:26:12 +0100
+
+linux-unstable (5.12.0-0.0) hirsute; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 04 Mar 2021 18:17:32 +0100
+
+linux-unstable (5.11.0-10.11) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Support CML-S CPU + TGP PCH (LP: #1909457)
+    - drm/i915/rkl: new rkl ddc map for different PCH
+    - SAUCE: drm/i915/gen9_bc : Add TGP PCH support
+
+  * Use DCPD to control HP DreamColor panel (LP: #1911001)
+    - SAUCE: drm/dp: Another HP DreamColor panel brigntness fix
+
+  * Update nvidia dkms build for module linker script changes
+    - [Packaging] build-dkms--nvidia-N -- Update for preprocessed module linker
+      script
+
+  * Please trust Canonical Livepatch Service kmod signing key (LP: #1898716)
+    - [Config] enable CONFIG_MODVERSIONS=y
+    - [Packaging] build canonical-certs.pem from branch/arch certs
+    - [Config] add Canonical Livepatch Service key to SYSTEM_TRUSTED_KEYS
+    - [Config] add ubuntu-drivers key to SYSTEM_TRUSTED_KEYS
+
+  * Miscellaneous Ubuntu changes
+    - [Config] re-enable nvidia dkms
+    - SAUCE: selftests: memory-hotplug: bump timeout to 10min
+    - [Debian] update-aufs.sh -- Don't apply tmpfs-idr.patch
+    - [Config] Update configs
+    - [Config] disable nvidia and nvidia_server builds
+    - SAUCE: Import aufs driver
+    - [Config] CONFIG_AUFS_FS=n
+    - [Config] refresh annotations file
+    - [Config] set CONFIG_MIPI_I3C_HCI=m consistently
+    - [Config] set CONFIG_PINCTRL_MSM8953=m on armhf generic-lpae
+    - [Packaging] Change source package name to linux-unstable
+    - [Config] update LD_VERSION in config due to toolchain update
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: tmpfs: Don't use 64-bit inodes by defulat with 32-bit
+      ino_t"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 Feb 2021 07:18:07 +0100
+
+linux-unstable (5.11.0-9.10) hirsute; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 Feb 2021 07:02:45 +0100
+
+linux (5.11.0-9.10) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs/annotations after rebase to 5.11
+    - zfs-modules.ignore: add zzstd
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 15 Feb 2021 16:29:36 +0100
+
+linux (5.11.0-8.9) hirsute; urgency=medium
+
+  * Missing device id for Intel TGL-H ISH [8086:43fc] in intel-ish-hid driver
+    (LP: #1914543)
+    - SAUCE: HID: intel-ish-hid: ipc: Add Tiger Lake H PCI device ID
+
+  *  Add support for new Realtek ethernet NIC (LP: #1914604)
+    - r8169: Add support for another RTL8168FP
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: tmpfs: Don't use 64-bit inodes by defulat with 32-bit ino_t
+    - [Config] Set CONFIG_TMPFS_INODE64=n for s390x
+    - [Config] re-enable ZFS
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 08 Feb 2021 11:56:23 +0100
+
+linux (5.11.0-7.8) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  *  Boot fails: failed to validate module [nls_iso8859_1] BTF: -22
+    (LP: #1911359)
+    - SAUCE: x86/entry: build thunk_$(BITS) only if CONFIG_PREEMPTION=y
+
+  * Remove scary stack trace from Realtek WiFi driver (LP: #1913263)
+    - rtw88: reduce the log level for failure of tx report
+
+  * Fix unexpected AER/DPC on PCH400 and PCH500 (LP: #1913691)
+    - Revert "UBUNTU: SAUCE: PCI: Enable ACS quirk on all CML root ports"
+    - Revert "UBUNTU: SAUCE: PCI: Enable ACS quirk on CML root port"
+    - SAUCE: PCI/AER: Disable AER interrupt during suspend
+    - SAUCE: PCI/DPC: Disable DPC interrupt during suspend
+
+  * switch to an autogenerated nvidia series based core via dkms-versions
+    (LP: #1912803)
+    - [Packaging] nvidia -- use dkms-versions to define versions built
+    - [Packaging] update-version-dkms -- maintain flags fields
+
+  * Introduce the new NVIDIA 460-server series and update the 460 series
+    (LP: #1913200)
+    - [Config] dkms-versions -- add the 460-server nvidia driver
+
+  * Fix the video can't output through WD19TB connected with TGL platform during
+    cold-boot (LP: #1910211)
+    - SAUCE: drm/i915/dp: Prevent setting LTTPR mode if no LTTPR is detected
+
+  * Stop using get_scalar_status command in Dell AIO uart backlight driver
+    (LP: #1865402)
+    - SAUCE: platform/x86: dell-uart-backlight: add get_display_mode command
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/seccomp: Accept any valid fd in user_notification_addfd
+    - [Packaging] Don't disable CONFIG_DEBUG_INFO in headers packages
+    - [Config] update configs/annotations after rebase to 5.11-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 01 Feb 2021 10:27:52 +0100
+
+linux (5.11.0-6.7) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Prevent thermal shutdown during boot process (LP: #1906168)
+    - thermal/drivers/acpi: Use hot and critical ops
+    - thermal/core: Remove notify ops
+    - thermal: int340x: Fix unexpected shutdown at critical temperature
+    - thermal: intel: pch: Fix unexpected shutdown at critical temperature
+
+  * riscv: backport support for SiFive Unmatched (LP: #1910965)
+    - RISC-V: Update l2 cache DT documentation to add support for SiFive FU740
+    - RISC-V: sifive_l2_cache: Update L2 cache driver to support SiFive FU740
+    - dt-bindings: riscv: Update DT binding docs to support SiFive FU740 SoC
+    - riscv: dts: add initial support for the SiFive FU740-C000 SoC
+    - dt-bindings: riscv: Update YAML doc to support SiFive HiFive Unmatched board
+    - riscv: dts: add initial board data for the SiFive HiFive Unmatched
+    - PCI: microsemi: Add host driver for Microsemi PCIe controller
+    - Microsemi PCIe expansion board DT entry.
+    - SiFive Unleashed CPUFreq
+    - SiFive HiFive Unleashed: Add PWM LEDs (D1, D2, D3, D4)
+
+  * initramfs unpacking failed (LP: #1835660)
+    - lib/decompress_unlz4.c: correctly handle zero-padding around initrds.
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to 5.11-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 25 Jan 2021 09:31:31 +0100
+
+linux (5.11.0-5.6) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update config and annotations after rebase to 5.11-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 18 Jan 2021 10:46:10 +0100
+
+linux (5.11.0-4.5) hirsute; urgency=medium
+
+  *  Boot fails: failed to validate module [nls_iso8859_1] BTF: -22
+    (LP: #1911359)
+    - SAUCE: x86/entry: build thunk_$(BITS) only if CONFIG_PREEMPTION=y
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Jan 2021 12:53:26 +0100
+
+linux (5.11.0-3.4) hirsute; urgency=medium
+
+  *  Boot fails: failed to validate module [nls_iso8859_1] BTF: -22
+    (LP: #1911359)
+    - bpf: Allow empty module BTFs
+    - libbpf: Allow loading empty BTFs
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Jan 2021 07:43:45 +0100
+
+linux (5.11.0-2.3) hirsute; urgency=medium
+
+  * DMI entry syntax fix for Pegatron / ByteSpeed C15B (LP: #1910639)
+    - Input: i8042 - unbreak Pegatron C15B
+
+  * SYNA30B4:00 06CB:CE09 Mouse  on HP EliteBook 850 G7 not working at all
+    (LP: #1908992)
+    - HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device
+
+  * debian/scripts/file-downloader does not handle positive failures correctly
+    (LP: #1878897)
+    - [Packaging] file-downloader not handling positive failures correctly
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * CVE-2021-1052 // CVE-2021-1053
+    - [Packaging] NVIDIA -- Add the NVIDIA 460 driver
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove nvidia-455 dkms build
+    - SAUCE: ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP
+      machines
+    - [Config] update configs and annotations after rebase to 5.11-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 11 Jan 2021 09:52:27 +0100
+
+linux (5.11.0-1.2) hirsute; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 07 Jan 2021 16:57:01 +0100
+
+linux (5.11.0-0.1) hirsute; urgency=medium
+
+  * dep-8 ubuntu-regression-suite tests are not run for all linux-hwe-* kernels
+    (LP: #1908529)
+    - [dep-8] Allow all hwe kernels
+
+  * Fix reading speed and duplex sysfs on igc device (LP: #1906851)
+    - igc: Report speed and duplex as unknown when device is runtime suspended
+
+  * rtwpci driver blocks the system to enter PC10, stuck at PC3 (LP: #1907200)
+    - SAUCE: rtw88: 8723de: let cpu enter c10
+
+  * [21.04 FEAT] Deactivate CONFIG_QETH_OSN kernel config option (LP: #1906370)
+    - [Config] Deactivate CONFIG_QETH_OSN kernel config option
+
+  * Add dpcd backlight control for 0x4c83 0x4f41 (LP: #1905663)
+    - SAUCE: drm/dp: Add dpcd backlight control for 0x4c83 0x4f41
+
+  * disable building bpf selftests (LP: #1908144)
+    - SAUCE: selftests/bpf: Clarify build error if no vmlinux
+    - SAUCE: selftests: Skip BPF selftests by default
+    - disable building bpf selftests (no VMLINUX_BTF)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - [Config] update configs and annotations after rebase to v5.11-rc1
+    - hio: fix build error with kernel 5.11
+    - SAUCE: shiftfs: fix build error with 5.11
+    - [Config] temporarily disable ZFS
+    - check-aliases: do not error if modules.alias does not exist
+    - ppc64el: don't build stripped vdso
+
+  * Miscellaneous upstream changes
+    - irq: export irq_check_status_bit
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Jan 2021 09:17:48 +0100
+
+linux (5.11.0-0.0) hirsute; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 30 Dec 2020 09:04:41 +0100
+
+linux (5.10.0-9.10) hirsute; urgency=medium
+
+  * Use INTx for Pericom USB controllers (LP: #1906839)
+    - PCI: Disable MSI for Pericom PCIe-USB adapter
+
+  * disable building bpf selftests (LP: #1908144)
+    - SAUCE: selftests/bpf: clarify build error if no vmlinux
+    - SAUCE: selftests: Skip BPF seftests by default
+    - disable building bpf selftests (no VMLINUX_BTF)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Enable CONFIG_BPF_LSM
+
+  * Miscellaneous upstream changes
+    - Revert "md: change mddev 'chunk_sectors' from int to unsigned"
+    - Revert "dm raid: fix discard limits for raid1 and raid10"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 15 Dec 2020 10:16:14 +0100
+
+linux (5.10.0-8.9) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Fix bpf selftest compilation with clang 11
+    - bpf: Fix selftest compilation on clang 11
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to v5.10
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Dec 2020 08:57:57 +0100
+
+linux (5.10.0-7.8) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Fix linux-libc-dev build for hirsute forward port kernels (LP: #1904067)
+    - [Debian] Build linux-libc-dev for debian.master* branches
+
+  * Update kernel packaging to support forward porting kernels (LP: #1902957)
+    - [Debian] Update for leader included in BACKPORT_SUFFIX
+
+  * Introduce the new NVIDIA 455 series (LP: #1897751)
+    - [Packaging] NVIDIA -- Add signed modules for the 455 driver
+
+  * 5.10 kernel fails to boot with secure boot disabled (LP: #1904906)
+    - [Config] CONFIG_RCU_SCALE_TEST=n
+
+  * Miscellaneous Ubuntu changes
+    - [Config] s390x: disable GPIO_CDEV
+    - [Config] ARM_CMN=m
+    - [Config] disable GPIO_CDEV_V1
+    - [Config] Reorder annotations after 5.10-rc6 rebase
+    - [Packaging] Remove nvidia-435 dkms build
+    - [Packaging] Change source package name to linux
+    - [Config] Update configs and annotations after rebase to v5.10-rc7
+    - SAUCE: Revert "mm/filemap: add static for function
+      __add_to_page_cache_locked"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 07 Dec 2020 00:15:20 -0600
+
+linux (5.10.0-6.7) hirsute; urgency=medium
+
+  * Empty entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 06 Dec 2020 22:13:46 -0600
+
+linux-5.10 (5.10.0-6.7) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Avoid double newline when running insertchanges (LP: #1903293)
+    - [Packaging] insertchanges: avoid double newline
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging]: linux-modules should depend on linux-image
+    - [Packaging]: linux-image should suggest linux-modules-extra
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 30 Nov 2020 07:47:34 +0100
+
+linux-5.10 (5.10.0-5.6) hirsute; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] add CONFIG_INFINIBAND_VIRT_DMA
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 Nov 2020 13:17:44 +0100
+
+linux-5.10 (5.10.0-4.5) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] reduce the size required to build packages
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 16 Nov 2020 08:33:54 +0100
+
+linux-5.10 (5.10.0-3.4) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * e1000e: fix issues with S0ix (LP: #1902687)
+    - SAUCE: e1000e: fix S0ix flow to allow S0i3.2 subset entry
+    - SAUCE: e1000e: allow turning s0ix flows on for systems with ME
+    - SAUCE: e1000e: Add Dell's Comet Lake systems into s0ix heuristics
+    - SAUCE: e1000e: Add more Dell CML systems into s0ix heuristics
+    - [Config] Update CONFIG_E1000E for ppc64el in annotations
+
+  * perf: Add support for Rocket Lake (LP: #1902004)
+    - SAUCE: perf/x86/intel: Add Rocket Lake CPU support
+    - SAUCE: perf/x86/cstate: Add Rocket Lake CPU support
+    - SAUCE: perf/x86/msr: Add Rocket Lake CPU support
+    - SAUCE: perf/x86/intel/uncore: Add Rocket Lake support
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE
+    - [Config] update CONFIG_MST_IRQ after rebase to 5.10-rc3
+    - [Config] drop obsolete SND_SST_IPC options
+    - [Config] re-enable ZFS
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Nov 2020 09:37:08 +0100
+
+linux-5.10 (5.10.0-2.3) hirsute; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Switch arm64 default cpufreq governor to ondemand
+    - [Debian] Include scripts/module.lds from builddir in headers package
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 03 Nov 2020 21:01:52 -0600
+
+linux-5.10 (5.10.0-1.2) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Fix non-working Intel NVMe after S3 (LP: #1900847)
+    - SAUCE: PCI: Enable ACS quirk on all CML root ports
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move to hirsute
+    - [Config] Update configs and annotations after rebase to 5.10-rc2
+    - [Config] Update numerous configs to conform with policy
+    - [Config] Switch default CPUFreq governer for arm64/armhf to schedultil
+    - [Config] Temporarily disable DEBUG_INFO_BTF for armhf
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 02 Nov 2020 13:18:27 -0600
+
+linux-5.10 (5.10.0-0.1) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update configs and annotations for v5.10-rc1
+    - SAUCE: platform/x86: dell-uart-backlight: rename kzfree() to
+      kfree_sensitive()
+    - SAUCE: apparmor: rename kzfree() to kfree_sensitive()
+    - SAUCE: LSM: change ima_read_file() to use lsmblob
+    - SAUCE: LSM: Use lsmblob in smk_netlbl_mls()
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Change source package name to linux-5.10"
+    - s390: correct __bootdata / __bootdata_preserved macros
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 27 Oct 2020 16:57:07 +0100
+
+linux-5.10 (5.10.0-0.0) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 26 Oct 2020 14:55:48 +0100
+
+linux-5.9 (5.9.0-2.3) groovy; urgency=medium
+
+  * Fix system reboot when disconnecting WiFi (LP: #1899726)
+    - iwlwifi: msix: limit max RX queues for 9000 family
+
+  * booting linux-generic-lpae armhf kernel under qemu results in relocation out
+    of range, and thus no modules can be loaded (LP: #1899519)
+    - [Config] armhf: ARM_MODULE_PLTS=y
+
+  * Fix broken MSI interrupt after HDA controller was suspended (LP: #1899586)
+    - ALSA: hda: fix jack detection with Realtek codecs when in D3
+
+  * CVE-2020-16119
+    - SAUCE: dccp: avoid double free of ccid on child socket
+
+  * python3-venv is gone (LP: #1896801)
+    - SAUCE: doc: remove python3-venv dependency
+
+  * *-tools-common packages descriptions have typo "PGKVER" (LP: #1898903)
+    - [Packaging] Fix typo in -tools template s/PGKVER/PKGVER/
+
+  * Enable brightness control on HP DreamColor panel (LP: #1898865)
+    - SAUCE: drm/i915/dpcd_bl: Skip testing control capability with force DPCD
+      quirk
+    - SAUCE: drm/dp: HP DreamColor panel brigntness fix
+
+  * HP Zbook Studio G7 boots into corrupted screen with PSR featured panel
+    (LP: #1897501)
+    - SAUCE: drm/i915/psr: allow overriding PSR disable param by quirk
+    - SAUCE: drm/dp: add DP_QUIRK_FORCE_PSR_CHIP_DEFAULT quirk to CMN prod-ID
+      19-15
+
+  * Fix broken e1000e device after S3 (LP: #1897755)
+    - SAUCE: e1000e: Increase polling timeout on MDIC ready bit
+
+  * Wakeup the system by touching the touchpad (LP: #1888331)
+    - HID: i2c-hid: Enable wakeup capability from Suspend-to-Idle
+
+  * Enable LTR for endpoints behind VMD (LP: #1896598)
+    - SAUCE: PCI/ASPM: Enable LTR for endpoints behind VMD
+
+  * [SRU] [Focal/OEM-5.6/Groovy]Fix AMD usb host controller lost after stress S3
+    (LP: #1893914)
+    - SAUCE: xhci: workaround for S3 issue on AMD SNPS 3.0 xHC
+
+  * debian/rules editconfigs does not work on s390x to change s390x only configs
+    (LP: #1863116)
+    - [Packaging] kernelconfig -- only update/edit configurations on architectures
+      we have compiler support
+
+  * Fix non-working NVMe after S3 (LP: #1895718)
+    - SAUCE: PCI: Enable ACS quirk on CML root port
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: bpf: Check CONFIG_BPF option for resolve_btfids
+    - SAUCE: tools resolve_btfids: Always force HOSTARCH
+    - packaging: arm64: add a 64KB mem pages flavour called 'generic-64k'
+    - packaging: arm64: generic-64k: skip ABI, modules and retpoline checks
+    - SAUCE: drm/i915/display: Fix null deref in intel_psr_atomic_check()
+    - [Config] Update toolchain versions
+    - [Config] Refresh annotations
+    - Add ubuntu-host module
+    - CONFIG_UBUNTU_HOST=m
+    - SAUCE: apparmor: drop prefixing abs root labels with '='
+    - SAUCE: apparmor: disable showing the mode as part of a secid to secctx
+    - SAUCE: apparmor: rename aa_sock() to aa_unix_sk()
+    - SAUCE: apparmor: LSM stacking: switch from SK_CTX() to aa_sock()
+    - SAUCE: LSM: Infrastructure management of the sock security
+    - SAUCE: LSM: Create and manage the lsmblob data structure.
+    - SAUCE: LSM: Use lsmblob in security_audit_rule_match
+    - SAUCE: LSM: Use lsmblob in security_kernel_act_as
+    - SAUCE: net: Prepare UDS for security module stacking
+    - SAUCE: LSM: Use lsmblob in security_secctx_to_secid
+    - SAUCE: LSM: Use lsmblob in security_secid_to_secctx
+    - SAUCE: LSM: Use lsmblob in security_ipc_getsecid
+    - SAUCE: LSM: Use lsmblob in security_task_getsecid
+    - SAUCE: LSM: Use lsmblob in security_inode_getsecid
+    - SAUCE: LSM: Use lsmblob in security_cred_getsecid
+    - SAUCE: IMA: Change internal interfaces to use lsmblobs
+    - SAUCE: LSM: Specify which LSM to display
+    - SAUCE: LSM: Ensure the correct LSM context releaser
+    - SAUCE: LSM: Use lsmcontext in security_secid_to_secctx
+    - SAUCE: LSM: Use lsmcontext in security_inode_getsecctx
+    - SAUCE: LSM: security_secid_to_secctx in netlink netfilter
+    - SAUCE: NET: Store LSM netlabel data in a lsmblob
+    - SAUCE: LSM: Verify LSM display sanity in binder
+    - SAUCE: Audit: Add new record for multiple process LSM attributes
+    - SAUCE: Audit: Add a new record for multiple object LSM
+    - SAUCE: LSM: Add /proc attr entry for full LSM context
+    - SAUCE: AppArmor: Remove the exclusive flag
+    - SAUCE: Audit: Fix for missing NULL check
+
+  * Miscellaneous upstream changes
+    - tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup()
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.9
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 14 Oct 2020 13:31:18 -0500
+
+linux-5.9 (5.9.0-1.2) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update configs after rebase to 5.9-rc6
+    - SAUCE: dax: Fix compilation for CONFIG_DAX && !CONFIG_FS_DAX
+    - SAUCE: bpf: Use --no-fail option if CONFIG_BPF is not enabled
+    - SAUCE: tools resolve_btfids: Always force HOSTARCH
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.9-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 21 Sep 2020 14:39:34 -0500
+
+linux-5.9 (5.9.0-0.1) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update configs and annotations for v5.9-rc1
+    - SAUCE: i915: Fix build error due to missing struct definition
+    - hio -- Update blk_queue_split() calls for changes in 5.9-rc1
+    - hio -- Updates for move of make_request_fn to struct block_device_operations
+    - [Config] Disable zfs dkms build
+    - [Config] Disable nvidia dkms build
+    - [Config] Disable nvidia server dkms builds
+    - SAUCE: remoteproc: qcom: Use div_u64() for 64-bit division
+    - SAUCE: PCI/ASPM: Enable ASPM for links under VMD domain
+    - [Packaging] Bind hv_vss_daemon startup to hv_vss device
+    - [Packaging] bind hv_fcopy_daemon startup to hv_fcopy device
+    - [Config] Re-enable UEFI signing for arm64
+    - SAUCE: Revert "UBUNTU: SAUCE: export __get_vm_area_caller() and map_kernel_range()"
+    - [Config] Set the default CPU governor to ONDEMAND
+    - [Packaging] update variants
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.9-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 17 Sep 2020 15:01:21 -0500
+
+linux-5.9 (5.9.0-0.0) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 18 Aug 2020 16:48:03 -0500
+
+linux (5.8.0-16.17) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-16.17 -proposed tracker (LP: #1891233)
+
+  * Miscellaneous Ubuntu changes
+    - hio -- Update to use bio_{start,end}_io_acct with 5.8+
+    - Enable hio driver
+    - [Packaging] Temporarily disable building doc package contents
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 11 Aug 2020 15:32:58 -0500
+
+linux (5.8.0-15.16) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-15.16 -proposed tracker (LP: #1891177)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Documentation: import error c_funcptr_sig_re, c_sig_re (sphinx-
+      doc/sphinx@0f49e30c)
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 11 Aug 2020 09:29:58 -0500
+
+linux (5.8.0-14.15) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-14.15 -proposed tracker (LP: #1891085)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * msg_zerocopy.sh in net from ubuntu_kernel_selftests failed (LP: #1812620)
+    - selftests/net: relax cpu affinity requirement in msg_zerocopy test
+
+  * Fix missing HDMI/DP Audio on an HP Desktop (LP: #1890441)
+    - ALSA: hda/hdmi: Add quirk to force connectivity
+
+  * Add initial audio support for Lenovo ThinkStation P620 (LP: #1890317)
+    - ALSA: usb-audio: Add support for Lenovo ThinkStation P620
+
+  * Fix IOMMU error on AMD Radeon Pro W5700 (LP: #1890306)
+    - PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
+
+  * Enlarge hisi_sec2 capability (LP: #1890222)
+    - crypto: hisilicon - update SEC driver module parameter
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Re-enable signing for ppc64el
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 10 Aug 2020 15:26:46 -0500
+
+linux (5.8.0-13.14) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Remove i386 configs
+    - SAUCE: apply a workaround to re-enable CONFIG_CRYPTO_AEGIS128_SIMD
+    - SAUCE: export __get_vm_area_caller() and map_kernel_range()
+    - [Config] drop CONFIG_BINFMT_AOUT enforcement
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] disable CONFIG_CRYPTO_AEGIS128_SIMD"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 04 Aug 2020 09:51:50 +0200
+
+linux (5.8.0-12.13) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-12.13 -proposed tracker (LP: #1889481)
+
+  * Fix right speaker of HP laptop (LP: #1889375)
+    - SAUCE: hda/realtek: Fix right speaker of HP laptop
+
+  * blk_update_request error when mount nvme partition (LP: #1872383)
+    - SAUCE: nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
+
+  * Add support for Atlantic NIC firmware v4 (LP: #1886908)
+    - Revert "UBUNTU: SAUCE: net: atlantic: Add support for firmware v4"
+    - net: atlantic: align return value of ver_match function with function name
+    - net: atlantic: add support for FW 4.x
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Fix debian/tests for linux-5.8 -> linux rename
+    - SAUCE: selftests/powerpc: return skip code for spectre_v2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 29 Jul 2020 16:58:47 -0500
+
+linux (5.8.0-11.12) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-11.12 -proposed tracker (LP: #1889336)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] dwarves is not required for linux-libc-dev or stage1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Jul 2020 22:33:24 -0500
+
+linux (5.8.0-10.11) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-10.11 -proposed tracker (LP: #1889316)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Add more packages to Build-Depends-Indep for docs
+    - [Debian] Specify python executable in kmake
+    - [Debian] Don't treat warnings as errors during perf builds
+    - [Config] Disable signing for ppc64el
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Jul 2020 17:09:52 -0500
+
+linux (5.8.0-9.10) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-9.10 -proposed tracker (LP: #1889140)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Fix s390x compile error on F32 utils/stat-display.c
+    - [Packaging] Add python3-venv to Build-Depends-Indep
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Jul 2020 21:01:46 -0500
+
+linux (5.8.0-8.9) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-8.9 -proposed tracker (LP: #1889104)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+    - [Packaging] update variants
+
+  * Introduce the new NVIDIA 450-server and the 450 UDA series (LP: #1887674)
+    - [Packaging] NVIDIA -- Add signed modules for 450 450-server
+
+  * Introduce the new NVIDIA 418-server and 440-server series, and update the
+    current NVIDIA drivers (LP: #1881137)
+    - [packaging] add signed modules for the 418-server and the 440-server
+      flavours
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "radix-tree: Use local_lock for protection"
+    - [Config] CONFIG_DEBUG_INFO_COMPRESSED=n
+    - [Config] disable CONFIG_CRYPTO_AEGIS128_SIMD
+    - [Config] Enable nvidia dkms build
+
+  * Miscellaneous upstream changes
+    - usbip: tools: fix build error for multiple definition
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Jul 2020 11:18:12 -0500
+
+linux (5.8.0-7.8) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Jul 2020 09:22:19 +0200
+
+linux-5.8 (5.8.0-7.8) groovy; urgency=medium
+
+  * soc/amd/renoir: detect dmic from acpi table (LP: #1887734)
+    - ASoC: amd: add logic to check dmic hardware runtime
+    - ASoC: amd: add ACPI dependency check
+    - ASoC: amd: fixed kernel warnings
+
+  * linux 4.15.0-109-generic network DoS regression vs -108 (LP: #1886668)
+    - SAUCE: Revert "netprio_cgroup: Fix unlimited memory leak of v2 cgroups"
+
+  * Add support for Atlantic NIC firmware v4 (LP: #1886908)
+    - SAUCE: net: atlantic: Add support for firmware v4
+
+  * MGA G200e doesn't work under GDM Wayland (LP: #1886140)
+    - drm/mgag200: Remove HW cursor
+    - drm/mgag200: Clean up mga_set_start_address()
+    - drm/mgag200: Clean up mga_crtc_do_set_base()
+    - drm/mgag200: Move mode-setting code into separate helper function
+    - drm/mgag200: Split MISC register update into PLL selection, SYNC and I/O
+    - drm/mgag200: Update mode registers after plane registers
+    - drm/mgag200: Set pitch in a separate helper function
+    - drm/mgag200: Set primary plane's format in separate helper function
+    - drm/mgag200: Move TAGFIFO reset into separate function
+    - drm/mgag200: Move hiprilvl setting into separate functions
+    - drm/mgag200: Move register initialization into separate function
+    - drm/mgag200: Remove out-commented suspend/resume helpers
+    - drm/mgag200: Use simple-display data structures
+    - drm/mgag200: Convert to simple KMS helper
+    - drm/mgag200: Replace VRAM helpers with SHMEM helpers
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: s390/bpf: fix sign extension in branch_ku
+    - SAUCE: selftests: net: ip_defrag: modprobe missing nf_defrag_ipv6 support
+    - SAUCE: selftests: fib_nexthop_multiprefix: fix cleanup() netns deletion
+    - [packaging] debhelper-compat (= 10) (and retire debian/compat)
+    - [Config] Update configs after rebase to 5.8-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Jul 2020 09:55:47 +0200
+
+linux-5.8 (5.8.0-6.7) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * perf build broken after updating to bintuils 2.34.90.20200706-1ubuntu1
+    (LP: #1887397)
+    - SAUCE: libtraceevent: Strip symbol version from nm output
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 13 Jul 2020 14:07:53 -0500
+
+linux-5.8 (5.8.0-5.6) groovy; urgency=medium
+
+  * linux-libc-dev broken for crossbuilding, Multi-Arch:same violation
+    (LP: #1886188)
+    - [Packaging] Produce linux-libc-deb package for riscv64
+    - [Debian] Disallow building linux-libc-dev from linux-riscv
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "UBUNTU: SAUCE: test_bpf: remove expected fail for Ctx heavy
+      transformations test on s390"
+    - SAUCE: Revert "test_bpf: flag tests that cannot be jited on s390"
+    - [Config] Update configs (gcc update)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Jul 2020 08:42:14 +0200
+
+linux-5.8 (5.8.0-4.5) groovy; urgency=medium
+
+  * Add generic LED class support for audio LED (LP: #1885896)
+    - ALSA: hda: generic: Always call led-trigger for mic mute LED
+    - ALSA: hda: generic: Add a helper for mic-mute LED with LED classdev
+    - ALSA: hda/realtek: Convert to cdev-variant of mic-mute LED controls
+    - ALSA: hda/conexant: Convert to cdev-variant of mic-mute LED controls
+    - ALSA: hda/sigmatel: Convert to cdev-variant of mic-mute LED controls
+    - ALSA: hda: generic: Drop unused snd_hda_gen_fixup_micmute_led()
+    - ALSA: hda: generic: Drop the old mic-mute LED hook
+    - ALSA: hda: generic: Add vmaster mute LED helper
+    - ALSA: hda/realtek: Use the new vmaster mute LED helper
+    - ALSA: hda/conexant: Use the new vmaster mute LED helper
+    - ALSA: hda/sigmatel: Use the new vmaster mute LED helper
+    - ALSA: hda/realtek: Unify LED helper code
+    - ALSA: hda: Let LED cdev handling suspend/resume
+
+  * seccomp_bpf fails on powerpc (LP: #1885757)
+    - SAUCE: selftests/seccomp: fix ptrace tests on powerpc
+
+  * CVE-2020-11935
+    - SAUCE: aufs: do not call i_readcount_inc()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Update aufs to 5.x-rcN 20200622
+    - [Config] Update configs to set CONFIG_SND_HDA_GENERIC_LEDS value
+    - [Config] CONFIG_SECURITY_DMESG_RESTRICT=y
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Jul 2020 08:14:28 -0500
+
+linux-5.8 (5.8.0-3.4) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  * lxc 1:4.0.2-0ubuntu1 ADT test failure with linux-5.8 5.8.0-1.2
+    (LP: #1884635)
+    - SAUCE: overlayfs: fix faulty rebase
+
+  * shiftfs: O_TMPFILE reports ESTALE (LP: #1872757)
+    - SAUCE: shiftfs: prevent ESTALE for LOOKUP_JUMP lookups
+
+  * shiftfs: fix btrfs regression (LP: #1884767)
+    - SAUCE: Revert "UBUNTU: SAUCE: shiftfs: fix dentry revalidation"
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_DEBUG_INFO_COMPRESSED=y
+    - SAUCE: regulator: rename da903x to da903x-regulator
+    - [Config] Add da903x to modules.ignore
+    - [Config] Update configs for rebase to 5.8-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jun 2020 08:48:25 -0500
+
+linux-5.8 (5.8.0-2.3) groovy; urgency=medium
+
+  * Support Audio Mute LED for two new HP laptops (LP: #1884251)
+    - ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems
+
+  * CVE-2019-16089
+    - SAUCE: nbd_genl_status: null check for nla_nest_start
+
+  * tpm: fix TIS locality timeout problems (LP: #1881710)
+    - SAUCE: tpm: fix TIS locality timeout problems
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: security,perf: Allow further restriction of perf_event_open
+    - [Config] CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
+    - [Config] Update configs and annotations for 5.8-rc2
+    - [Config] Enable zfs
+    - [Config] Enable CONFIG_DEBUG_INFO_BTF
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jun 2020 15:05:54 -0500
+
+linux-5.8 (5.8.0-1.2) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Support linux-x.y in udeb package names
+    - [Packaging] Use SRCPKGNAME for udeb packages
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 17 Jun 2020 19:34:32 -0500
+
+linux-5.8 (5.8.0-0.1) groovy; urgency=medium
+
+  * Docker registry doesn't stay up and keeps restarting (LP: #1879690)
+    - Revert "UBUNTU: SAUCE: overlayfs: use shiftfs hacks only with shiftfs as underlay"
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Update source package name to linux-5.8
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: (lockdown) powerpc: lock down kernel in secure boot mode
+    - SAUCE: Import aufs driver
+    - [Config] Update configs for v5.8-rc1
+    - [Config] Update annotations for v5.8-rc1 config changes
+    - SAUCE: shiftfs -- Fix build errors from missing fiemap definitions
+    - Disable hio driver
+
+  * Miscellaneous upstream changes
+    - acpi: disallow loading configfs acpi tables when locked down
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 17 Jun 2020 11:54:24 -0500
+
+linux-5.8 (5.8.0-0.0) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 14 Jun 2020 22:40:35 -0500
+
+linux-5.7 (5.7.0-8.9) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Enforce all config annotations (LP: #1879327)
+    - [Config]: do not enforce CONFIG_VERSION_SIGNATURE
+    - [Config]: prepare to enforce all
+    - [Config]: enforce all config options
+
+  * Miscellaneous Ubuntu changes
+    - [Config]: annotations review after 5.7 rebase
+    - [Config] annotations: IXP4XX* depends on ARCH_IXP4XX
+    - [Config] THERMAL_GOV_POWER_ALLOCATOR=y
+    - [Config] annotations: SOC_CAMERA is marked as BROKEN
+    - [Config] annotations: NFSD_V4_2_INTER_SSC depends on NFS_FS=y
+    - [Config] annotations: CRYPTO_DEV_CHELSIO_TLS depends on legacy (and largely
+      unmantained) TLS_TOE
+    - [Config] annotations: SERIO_OLPC_APSP depends on ARCH_MMP
+    - [Config] RTW88_DEBUG=y
+    - [Config] annotations: ISDN_CAPI is a bool, and BT_CMTP depends on  it
+    - [Config] annotations SND_SOC_SOF_DEVELOPER_SUPPORT depends on
+      SND_SOC_SOF_DEVELOPER_SUPPORT
+    - [Config] annotations: SND_SOC_SOF_BAYTRAIL_SUPPORT is mutually exclusive
+      with SND_SST_ATOM_HIFI2_PLATFORM_ACPI
+    - [Config] annotations: DEBUG_IMX_UART_PORT is defined only any
+      DEBUG_IMX*_UART is enabled
+    - [Config] annotations: HW_RANDOM_IMX_RNGC depends on SOC_IMX25
+    - [Config] annotations: armhf: VIRTUALIZATION support was removed for arm32
+    - [Config] annotations: arm64: remove DEBUG_ALIGN_RODATA
+    - [Config] annotations: ppc64: DATA_SHIFT defaults to PPC_PAGE_SHIFT
+    - [Config] arm64: enforce ARM64_USE_LSE_ATOMICS
+    - [Config] s390x: MOST is not set
+    - [Config] s390x: BCM84881_PHY is not set
+    - [Config] s390x: XILINX_LL_TEMAC is not set
+    - [Config] s390x: PHY_INTEL_EMMC requires GENERIC_PHY (off by default on
+      s390x)
+    - [Config] s390x: CHECK_STACK conflicts with VMAP_STACK
+    - [Config] annotations: s390x: NODES_SHIFT=1
+    - [Config] annotations: import new symbols
+    - [Config] annotations: remove unmatched menu and options
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 12 Jun 2020 12:03:01 +0200
+
+linux-5.7 (5.7.0-7.8) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+    - [Packaging] update helper scripts
+
+  * [UBUNTU 20.04] s390x/pci: fix linking between PF and VF for multifunction
+    devices (LP: #1879704)
+    - PCI/IOV: Introduce pci_iov_sysfs_link() function
+    - s390/pci: create links between PFs and VFs
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable UEFI signing for arm64
+    - Rebase to v5.7.1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7.1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 08 Jun 2020 11:16:58 +0200
+
+linux-5.7 (5.7.0-6.7) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  * shiftfs: fix btrfs snapshot deletion (LP: #1879688)
+    - SAUCE: shiftfs: let userns root destroy subvolumes from other users
+
+  * seccomp_benchmark times out on eoan (LP: #1881576)
+    - SAUCE: selftests/seccomp: use 90s as timeout
+
+  * Realtek 8723DE [10ec:d723] subsystem [10ec:d738]  disconnects unsolicitedly
+    when Bluetooth is paired: Reason: 23=IEEE8021X_FAILED (LP: #1878147)
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: Move driver IQK to set channel before
+      association for 11N chip"
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: fix rate for a while after being
+      connected"
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: No retry and report for auth and assoc"
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: 8723d: Add coex support"
+    - rtw88: 8723d: Add coex support
+    - SAUCE: rtw88: coex: 8723d: set antanna control owner
+    - SAUCE: rtw88: coex: 8723d: handle BT inquiry cases
+    - SAUCE: rtw88: fix EAPOL 4-way failure by finish IQK earlier
+
+  * ASoC/amd: add audio driver for amd renoir (LP: #1881046)
+    - ASoC: amd: add Renoir ACP3x IP register header
+    - ASoC: amd: add Renoir ACP PCI driver
+    - ASoC: amd: add acp init/de-init functions
+    - ASoC: amd: create acp3x pdm platform device
+    - ASoC: amd: add ACP3x PDM platform driver
+    - ASoC: amd: irq handler changes for ACP3x PDM dma driver
+    - ASoC: amd: add acp3x pdm driver dma ops
+    - ASoC: amd: add ACP PDM DMA driver dai ops
+    - ASoC: amd: add Renoir ACP PCI driver PM ops
+    - ASoC: amd: add ACP PDM DMA driver pm ops
+    - ASoC: amd: enable Renoir acp3x drivers build
+    - ASoC: amd: create platform devices for Renoir
+    - ASoC: amd: RN machine driver using dmic
+    - ASoC: amd: enable build for RN machine driver
+    - ASoC: amd: fix kernel warning
+    - ASoC: amd: refactoring dai_hw_params() callback
+    - ASoC: amd: return error when acp de-init fails
+    - [Config]: enable amd renoir ASoC audio
+
+  * Slow send speed with Intel I219-V on Ubuntu 18.04.1 (LP: #1802691)
+    - e1000e: Disable TSO for buffer overrun workaround
+
+  * Fix incorrect speed/duplex when I210 device is runtime suspended
+    (LP: #1880656)
+    - igb: Report speed and duplex as unknown when device is runtime suspended
+
+  * Fix Pericom USB controller OHCI/EHCI PME# defect (LP: #1879321)
+    - serial: 8250_pci: Move Pericom IDs to pci_ids.h
+    - PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect
+
+  * [UBUNTU 20.04] s390x/pci: enumerate pci functions per physical adapter
+    (LP: #1874056)
+    - s390/pci: Expose new port attribute for PCIe functions
+    - s390/pci: adaptation of iommu to multifunction
+    - s390/pci: define kernel parameters for PCI multifunction
+    - s390/pci: define RID and RID available
+    - s390/pci: create zPCI bus
+    - s390/pci: adapt events for zbus
+    - s390/pci: Handling multifunctions
+    - s390/pci: Do not disable PF when VFs exist
+    - s390/pci: Documentation for zPCI
+    - s390/pci: removes wrong PCI multifunction assignment
+
+  * add 16-bit width registers support for EEPROM at24 device (LP: #1876699)
+    - regmap-i2c: add 16-bit width registers support
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Enable virtualbox guest and shared-folder modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 01 Jun 2020 16:11:24 -0500
+
+linux-5.7 (5.7.0-5.6) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * [UBUNTU 20.04] PSI generates overhead on s390x (LP: #1876044)
+    - Ubuntu: [Config] CONFIG_PSI is enabled by default, but creates additional
+      overhead on s390x, hence should be disabled by default on s390x only.
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.7-rc7
+    - [Config] ppc64el: disable STRICT_KERNEL_RWX
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 25 May 2020 11:44:09 +0200
+
+linux-5.7 (5.7.0-4.5) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * update-initramfs complains of missing amdgpu firmware files (LP: #1873325)
+    - SAUCE: drm/amdgpu: Remove unreleased arcturus and navi12 firmware from
+      modinfo
+
+  * Support DMIC micmute LED on HP platforms (LP: #1876859)
+    - ALSA: hda/realtek - Introduce polarity for micmute LED GPIO
+    - ALSA: hda/realtek - Enable micmute LED on and HP system
+    - ALSA: hda/realtek - Add LED class support for micmute LED
+    - ALSA: hda/realtek - Fix unused variable warning w/o
+      CONFIG_LEDS_TRIGGER_AUDIO
+    - ASoC: SOF: Update correct LED status at the first time usage of
+      update_mute_led()
+
+  * Killer(R) Wi-Fi 6 AX1650i 160MHz Wireless Network Adapter (201NGW),
+    REV=0x354 [8086:a0f0] subsystem id [1a56:1651] wireless adapter not found
+    due to firmware crash (LP: #1874685)
+    - SAUCE: iwlwifi: pcie: handle QuZ configs with killer NICs as well
+
+  * rtkit-daemon[*]: Failed to make ourselves RT: Operation not permitted after
+    upgrade to 20.04 (LP: #1875665)
+    - [Config] Turn off CONFIG_RT_GROUP_SCHED everywhere
+
+  * Unable to handle kernel pointer dereference in virtual kernel address space
+    on Eoan (LP: #1876645)
+    - SAUCE: overlayfs: fix shitfs special-casing
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: skip building selftest 'runqslower' if kernel not built
+    - Rebase to v5.7-rc6
+    - [Config] updateconfigs after 5.7-rc6 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 May 2020 11:27:25 +0200
+
+linux-5.7 (5.7.0-3.4) groovy; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc5
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * getitimer returns it_value=0 erroneously (LP: #1349028)
+    - [Config] CONTEXT_TRACKING_FORCE policy should be unset
+
+  * lockdown on power (LP: #1855668) // Ubuntu Kernel Support for OpenPOWER NV
+    Secure & Trusted Boot (LP: #1866909)
+    - [Config] Enable configs for OpenPOWER NV Secure & Trusted Boot
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - [Config] Enable aufs
+    - [Config] annotations: remove SND_SOC_SOF_HDA_COMMON_HDMI_CODEC
+    - [Config] Remove CONFIG_SND_HDA_INTEL_DETECT_DMIC from annotations
+    - [Debian] final-checks -- Do not remove ~* from abi
+    - [Config] Enable 5-level page table support for x86
+    - [Config] updateconfigs after 5.7-rc5 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 11 May 2020 10:25:42 +0200
+
+linux-5.7 (5.7.0-2.3) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+    - [Packaging] update helper scripts
+
+  * ASUS T100HAN boots to a blank screen with a cursor [i965: Failed to submit
+    batchbuffer: Input/output error] (LP: #1860754)
+    - [Config] CONFIG_PMIC_OPREGION=y and CONFIG_GPIO_CRYSTAL_COVE=y for amd64
+
+  * ubuntu/focal64 fails to mount Vagrant shared folders  (LP: #1873506)
+    - [Packaging] Move virtualbox modules to linux-modules
+    - [Packaging] Remove vbox and zfs modules from generic.inclusion-list
+
+  * built-using constraints preventing uploads (LP: #1875601)
+    - temporarily drop Built-Using data
+
+  * dkms artifacts may expire from the pool (LP: #1850958)
+    - [Packaging] autoreconstruct -- manage executable debian files
+    - [packaging] handle downloads from the librarian better
+
+  * Add signed modules for the 435 NVIDIA driver (LP: #1875888)
+    - [Packaging] NVIDIA -- add signed modules for the 435 NVIDIA driver
+
+  * [Selftests] Apply various fixes and improvements (LP: #1870543)
+    - SAUCE: selftests/seccomp -- Disable timeout for seccomp tests
+
+  * [17.04 FEAT] Integrate kernel message catalogue for s390x into Ubuntu
+    distribution (LP: #1628889)
+    - SAUCE: s390: kernel message catalog
+
+  * Overlayfs in user namespace leaks directory content of inaccessible
+    directories (LP: #1793458) // CVE-2018-6559
+    - SAUCE: overlayfs: ensure mounter privileges when reading directories
+
+  * suspend only works once on ThinkPad X1 Carbon gen 7 (LP: #1865570)
+    - SAUCE: e1000e: Disable s0ix flow for X1 Carbon 7th
+
+  * [ICL] TC port in legacy/static mode can't be detected due TCCOLD
+    (LP: #1868936)
+    - drm/i915/display: Move out code to return the digital_port of the aux ch
+    - drm/i915/display: Add intel_legacy_aux_to_power_domain()
+    - drm/i915/display: Split hsw_power_well_enable() into two
+    - drm/i915/tc/icl: Implement TC cold sequences
+    - drm/i915/tc: Skip ref held check for TC legacy aux power wells
+    - drm/i915/tc/tgl: Implement TC cold sequences
+    - drm/i915/tc: Catch TC users accessing FIA registers without enable aux
+    - drm/i915/tc: Do not warn when aux power well of static TC ports timeout
+
+  * Touchpad doesn't work on Dell Inspiron 7000 2-in-1 (LP: #1851901)
+    - Revert "UBUNTU: SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390
+      2-in-1"
+
+  * 'Elan touchpad' not detected on 'Lenovo ThinkBook 15 IIL' (LP: #1861610)
+    - SAUCE: Input: elan_i2c - add more hardware ID for Lenovo laptop
+
+  * linux-image-5.0.0-35-generic breaks checkpointing of container
+    (LP: #1857257)
+    - SAUCE: overlayfs: use shiftfs hacks only with shiftfs as underlay
+
+  * alsa/sof: kernel oops on the machine without Intel hdmi audio codec (a
+    regression in the  asoc machine driver) (LP: #1874359)
+    - ASoC: intel/skl/hda - fix oops on systems without i915 audio codec
+
+  * Add debian/rules targets to compile/run kernel selftests (LP: #1874286)
+    - [Packaging] add support to compile/run selftests
+
+  * 5.4.0-24.28 does not seem to apply rtprio, whereas -21 does. (LP: #1873315)
+    - [Config] lowlatency: turn off RT_GROUP_SCHED
+
+  * alsa/sof: external mic can't be deteced on Lenovo and HP laptops
+    (LP: #1872569)
+    - SAUCE: ASoC: intel/skl/hda - set autosuspend timeout for hda codecs
+
+  * shiftfs: O_TMPFILE reports ESTALE (LP: #1872757)
+    - SAUCE: shiftfs: fix dentry revalidation
+
+  * shiftfs: broken shiftfs nesting (LP: #1872094)
+    - SAUCE: shiftfs: record correct creator credentials
+
+  * lockdown on power (LP: #1855668)
+    - SAUCE: (lockdown) powerpc: lock down kernel in secure boot mode
+
+  * Add support for Realtek 8723DE wireless adapter (LP: #1780590)
+    - SAUCE: rtw88: add adaptivity support for EU/JP regulatory
+    - SAUCE: rtw88: update tx descriptor of mgmt and rsvd page packets
+    - SAUCE: rtw88: sar: dump sar information via debugfs
+    - SAUCE: rtw88: 8723d: add IQ calibration
+    - SAUCE: rtw88: 8723d: Add power tracking
+    - SAUCE: rtw88: 8723d: implement flush queue
+    - SAUCE: rtw88: 8723d: set ltecoex register address in chip_info
+    - SAUCE: rtw88: 8723d: Add coex support
+    - SAUCE: rtw88: 8723d: Add shutdown callback to disable BT USB suspend
+
+  * Fix authentication fail on Realtek WiFi 8723de (LP: #1871300)
+    - SAUCE: rtw88: No retry and report for auth and assoc
+    - SAUCE: rtw88: fix rate for a while after being connected
+    - SAUCE: rtw88: Move driver IQK to set channel before association for 11N chip
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: rtw88: fix 'const' mismatch in power suequence hooks
+    - SAUCE: rtw88: fix 'const' mismatch in
+      __priority_queue_cfg_legacy()/__priority_queue_cfg()
+    - [Config] RTW88=m
+    - SAUCE: (lockdown) Revert carried-forward lockdown patches
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - [Config] Add back CONFIG_LOCK_DOWN_IN_SECURE_BOOT annotation for ppc64el
+    - [Config] CONFIG_RT_GROUP_SCHED=y
+    - [Packaging] Include modules.builtin.modinfo in linux-modules
+    - SAUCE: LSM: Infrastructure management of the sock security
+    - SAUCE: Fix-up af_unix mediation for sock infrastructure management
+    - SAUCE: Revert "apparmor: Allow filtering based on secmark policy"
+    - SAUCE: Revert "apparmor: Parse secmark policy"
+    - SAUCE: Revert "apparmor: Add a wildcard secid"
+    - SAUCE: Revert "apparmor: fixup secid map conversion to using IDR"
+    - SAUCE: Revert "apparmor: Use an IDR to allocate apparmor secids"
+    - SAUCE: Revert "apparmor: add support for mapping secids and using secctxes"
+    - Update dropped.txt for restored apparmor patches
+    - Remove lockdown patches from dropped.txt
+    - SAUCE: powerpc/ima: require IMA module signatures only if MODULE_SIG is not
+      enabled
+    - SAUCE: selftests/ftrace: Use printf instead of echo in kprobe syntax error
+      tests
+    - SAUCE: selftests/net -- disable l2tp.sh test
+    - SAUCE: selftests/net -- disable timeout
+    - SAUCE: tools: hv: Update shebang to use python3 instead of python
+    - Remove dropped.txt
+    - [Packaging] move linux-doc and linux-libc-dev stubs to debian.master
+    - [Debian] Support generating configs for riscv64
+    - [Config] CONFIG_KMSG_IDS=y for s390x
+    - [Packaging] add libcap-dev dependency
+    - [Config] CONFIG_AD5770R=m
+    - [Config] CONFIG_AL3010=m
+    - [Config] CONFIG_APPLE_MFI_FASTCHARGE=m
+    - [Config] CONFIG_BAREUDP=m
+    - [Config] CONFIG_CRYPTO_DEV_OCTEONTX_CPT=m
+    - [Config] CONFIG_CRYPTO_DEV_ZYNQMP_AES=m
+    - [Config] CONFIG_DRM_DISPLAY_CONNECTOR=m
+    - [Config] CONFIG_DRM_PANEL_BOE_TV101WUM_NL6=m
+    - [Config] CONFIG_DRM_PANEL_ELIDA_KD35T133=m
+    - [Config] CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02=m
+    - [Config] CONFIG_DRM_PANEL_NOVATEK_NT35510=m
+    - [Config] CONFIG_DRM_PANEL_SAMSUNG_S6E88A0_AMS452EF01=m
+    - [Config] CONFIG_DRM_PARADE_PS8640=m
+    - [Config] CONFIG_DRM_SIMPLE_BRIDGE=m
+    - [Config] CONFIG_DRM_TIDSS=m
+    - [Config] CONFIG_DRM_TI_TPD12S015=m
+    - [Config] CONFIG_DRM_TOSHIBA_TC358768=m
+    - [Config] CONFIG_EDAC_DMC520=m
+    - [Config] CONFIG_EXFAT_FS=m
+    - [Config] CONFIG_GP2AP002=m
+    - [Config] CONFIG_GPIO_MLXBF2=m
+    - [Config] CONFIG_HID_GLORIOUS=m
+    - [Config] CONFIG_HID_MCP2221=m
+    - [Config] CONFIG_HMC425=m
+    - [Config] CONFIG_ICP10100=m
+    - [Config] CONFIG_IMX8MM_THERMAL=m
+    - [Config] CONFIG_IMX_SC_THERMAL=m
+    - [Config] CONFIG_INTERCONNECT_QCOM_OSM_L3=m
+    - [Config] CONFIG_INTERCONNECT_QCOM_SC7180=m
+    - [Config] CONFIG_K3_RTI_WATCHDOG=m
+    - [Config] CONFIG_MDIO_IPQ8064=m
+    - [Config] CONFIG_MDIO_MVUSB=m
+    - [Config] CONFIG_MHI_BUS=m
+    - [Config] CONFIG_OCTEONTX2_VF=m
+    - [Config] CONFIG_PHY_CADENCE_TORRENT=m
+    - [Config] CONFIG_PHY_QCOM_USB_HS_28NM=m
+    - [Config] CONFIG_PHY_QCOM_USB_SS=m
+    - [Config] CONFIG_PINCTRL_DA9062=m
+    - [Config] CONFIG_PINCTRL_IPQ6018=m
+    - [Config] CONFIG_PTP_1588_CLOCK_IDT82P33=m
+    - [Config] CONFIG_PTP_1588_CLOCK_VMW=m
+    - [Config] CONFIG_QCOM_IPA=m
+    - [Config] CONFIG_REGULATOR_MP5416=m
+    - [Config] CONFIG_REGULATOR_MP886X=m
+    - [Config] CONFIG_RN5T618_ADC=m
+    - [Config] CONFIG_RTC_DRV_MT2712=m
+    - [Config] CONFIG_RTC_DRV_RC5T619=m
+    - [Config] CONFIG_SC_MSS_7180=m
+    - [Config] CONFIG_SENSORS_AXI_FAN_CONTROL=m
+    - [Config] CONFIG_SM_GCC_8250=m
+    - [Config] CONFIG_SND_BCM63XX_I2S_WHISTLER=m
+    - [Config] CONFIG_SND_MESON_AIU=m
+    - [Config] CONFIG_SND_MESON_G12A_TOACODEC=m
+    - [Config] CONFIG_SND_MESON_GX_SOUND_CARD=m
+    - [Config] CONFIG_SND_SOC_AMD_RV_RT5682_MACH=m
+    - [Config] CONFIG_SND_SOC_INTEL_SOF_PCM512x_MACH=m
+    - [Config] CONFIG_SND_SOC_MESON_T9015=m
+    - [Config] CONFIG_SND_SOC_RT5682_SDW=m
+    - [Config] CONFIG_SND_SOC_TLV320ADCX140=m
+    - [Config] CONFIG_SPI_FSI=m
+    - [Config] CONFIG_SPI_MTK_NOR=m
+    - [Config] CONFIG_SPI_MUX=m
+    - [Config] CONFIG_SPRD_THERMAL=m
+    - [Config] CONFIG_SURFACE_3_POWER_OPREGION=m
+    - [Config] CONFIG_TINYDRM_ILI9486=m
+    - [Config] CONFIG_TI_K3_AM65_CPSW_NUSS=m
+    - [Config] CONFIG_TYPEC_MUX_INTEL_PMC=m
+    - [Config] CONFIG_UACCE=m
+    - [Config] CONFIG_UNIPHIER_XDMAC=m
+    - [Config] CONFIG_USB_MAX3420_UDC=m
+    - [Config] CONFIG_USB_RAW_GADGET=m
+    - [Config] CONFIG_VHOST_VDPA=m
+    - [Config] CONFIG_VIDEO_IMX219=m
+    - [Config] CONFIG_VIDEO_SUN8I_ROTATE=m
+    - [Config] CONFIG_VIRTIO_VDPA=m
+    - [Config] CONFIG_MOST_COMPONENTS=m
+    - [Config] CONFIG_MFD_IQS62X=m
+    - packaging: getabis: switch to ckt-ppa:bootstrap/linux-5.7
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: rtw88: add rtw_read8_mask and rtw_read16_mask"
+    - Revert "UBUNTU: SAUCE: drm/i915/fbc: disable framebuffer compression on
+      IceLake"
+    - Revert "UBUNTU: SAUCE: platform/x86: dell-uart-backlight: move retry block"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 04 May 2020 10:48:48 +0200
+
+linux-5.7 (5.7.0-1.2) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: hio: pass make_request ptr directly to blk_alloc_queue()
+    - SAUCE: hio: locally define disk_map_sector_rcu()
+    - SAUCE: hio: Revert "block: unexport disk_map_sector_rcu"
+    - SAUCE: hio: include <linux/part_stat.h>
+    - [Config] amd64: i386: HIO=m
+    - [Config] updateconfigs after 5.7-rc3 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 27 Apr 2020 11:31:38 +0200
+
+linux-5.7 (5.7.0-0.1) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.7-rc1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc1
+  * Rebase to v5.7-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 16 Apr 2020 11:53:58 +0200
+
+linux-5.7 (5.7.0-0.0) focal; urgency=medium
+
+  * Dummy entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 16 Apr 2020 11:53:58 +0200
+
+linux-5.6 (5.6.0-7.7) focal; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Kernel Oops - general protection fault: 0000 [#1] SMP PTI after
+    disconnecting thunderbolt docking station (LP: #1864754)
+    - SAUCE: ptp: free ptp clock properly
+
+  * swap storms kills interactive use (LP: #1861359)
+    - SAUCE: mm/page_alloc.c: disable memory reclaim watermark boosting by default
+
+  * sysfs: incorrect network device permissions on network namespace change
+    (LP: #1865359)
+    - sysfs: add sysfs_file_change_owner()
+    - sysfs: add sysfs_link_change_owner()
+    - sysfs: add sysfs_group{s}_change_owner()
+    - sysfs: add sysfs_change_owner()
+    - device: add device_change_owner()
+    - drivers/base/power: add dpm_sysfs_change_owner()
+    - net-sysfs: add netdev_change_owner()
+    - net-sysfs: add queue_change_owner()
+    - net: fix sysfs permssions when device changes network namespace
+    - sysfs: fix static inline declaration of sysfs_groups_change_owner()
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 31 Mar 2020 10:45:09 +0200
+
+linux-5.6 (5.6.0-6.6) focal; urgency=medium
+
+  * suspend only works once on ThinkPad X1 Carbon gen 7 (LP: #1865570)
+    - SAUCE: e1000e: Disable s0ix flow for X1 Carbon 7th
+
+  *  Make Dell WD19 dock more reliable after suspend (LP: #1868217)
+    - xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3
+    - xhci: Wait until link state trainsits to U0 after setting USB_SS_PORT_LS_U0
+    - xhci: Finetune host initiated USB3 rootport link suspend and resume
+
+  * update-version-dkms doesn't add a BugLink (LP: #1867790)
+    - [Packaging] Add BugLink to update-version-dkms commit
+
+  * Add support for Realtek 8723DE wireless adapter (LP: #1780590)
+    - SAUCE: rtw88: add regulatory process strategy for different chipset
+    - SAUCE: rtw88: support dynamic user regulatory setting
+    - SAUCE: rtw88: Use secondary channel offset enumeration
+    - SAUCE: rtw88: 8822c: modify rf protection setting
+    - SAUCE: rtw88: disable TX-AMSDU on 2.4G band
+    - SAUCE: Revert "rtw88: disable TX-AMSDU on 2.4G band"
+    - SAUCE: rtw88: disable TX-AMSDU on 2.4G band
+    - SAUCE: rtw88: remove unused parameter vif in rtw_lps_pg_info_get()
+    - SAUCE: rtw88: add rtw_read8_mask and rtw_read16_mask
+    - SAUCE: rtw88: pci: 8822c should set clock delay to zero
+    - SAUCE: rtw88: move rtw_enter_ips() to the last when config
+    - SAUCE: rtw88: avoid holding mutex for cancel_delayed_work_sync()
+    - SAUCE: rtw88: add ciphers to suppress error message
+    - SAUCE: rtw88: 8822c: update power sequence to v16
+    - SAUCE: rtw88: Fix incorrect beamformee role setting
+    - SAUCE: rtw88: don't hold all IRQs disabled for PS operations
+    - SAUCE: rtw88: extract alloc rsvd_page and h2c skb routines
+    - SAUCE: rtw88: associate reserved pages with each vif
+    - SAUCE: rtw88: add adaptivity support for EU/JP regulatory
+    - SAUCE: rtw88: 8723d: Add basic chip capabilities
+    - SAUCE: rtw88: 8723d: add beamform wrapper functions
+    - SAUCE: rtw88: 8723d: Add power sequence
+    - SAUCE: rtw88: 8723d: Add RF read/write ops
+    - SAUCE: rtw88: 8723d: Add mac/bb/rf/agc/power_limit tables
+    - SAUCE: rtw88: 8723d: Add cfg_ldo25 to control LDO25
+    - SAUCE: rtw88: 8723d: Add new chip op efuse_grant() to control efuse access
+    - SAUCE: rtw88: 8723d: Add read_efuse to recognize efuse info from map
+    - SAUCE: rtw88: add legacy firmware download for 8723D devices
+    - SAUCE: rtw88: no need to send additional information to legacy firmware
+    - SAUCE: rtw88: 8723d: Add mac power-on/-off function
+    - SAUCE: rtw88: decompose while(1) loop of power sequence polling command
+    - SAUCE: rtw88: 8723d: 11N chips don't support H2C queue
+    - SAUCE: rtw88: 8723d: implement set_tx_power_index ops
+    - SAUCE: rtw88: 8723d: Organize chip TX/RX FIFO
+    - SAUCE: rtw88: 8723d: initialize mac/bb/rf basic functions
+    - SAUCE: rtw88: 8723d: Add DIG parameter
+    - SAUCE: rtw88: 8723d: Add query_rx_desc
+    - SAUCE: rtw88: 8723d: Add set_channel
+    - SAUCE: rtw88: handle C2H_CCX_TX_RPT to know if packet TX'ed successfully
+    - SAUCE: rtw88: 8723d: 11N chips don't support LDPC
+    - SAUCE: rtw88: set default port to firmware
+    - SAUCE: rtw88: update tx descriptor of mgmt and rsvd page packets
+    - SAUCE: rtw88: sar: add SAR of TX power limit
+    - SAUCE: rtw88: sar: Load static SAR table from ACPI WRDS method
+    - SAUCE: rtw88: sar: Load dynamic SAR table from ACPI methods
+    - SAUCE: rtw88: sar: apply dynamic SAR table to tx power limit
+    - SAUCE: rtw88: sar: add sar_work to poll if dynamic SAR table is changed
+    - SAUCE: rtw88: sar: dump sar information via debugfs
+    - SAUCE: rtw88: 8723d: Add chip_ops::false_alarm_statistics
+    - SAUCE: rtw88: 8723d: Set IG register for CCK rate
+    - SAUCE: rtw88: 8723d: add interface configurations table
+    - SAUCE: rtw88: 8723d: Add LC calibration
+    - SAUCE: rtw88: 8723d: add IQ calibration
+    - SAUCE: rtw88: 8723d: Add power tracking
+    - SAUCE: rtw88: 8723d: Add shutdown callback to disable BT USB suspend
+    - SAUCE: rtw88: 8723d: implement flush queue
+    - SAUCE: rtw88: 8723d: set ltecoex register address in chip_info
+    - SAUCE: rtw88: 8723d: Add coex support
+    - SAUCE: rtw88: fill zeros to words 0x06 and 0x07 of security cam entry
+    - SAUCE: rtw88: 8723d: Add 8723DE to Kconfig and Makefile
+    - [Config] CONFIG_RTW88_8723DE=y
+
+  * [Ubuntu 20.04] Unset HIBERNATION and PM kernel config options for focal
+    (LP: #1867753)
+    - [Config] CONFIG_HIBERNATION=n and CONFIG_PM=n for s390x
+
+  * [20.04 FEAT] Base KVM setup for secure guests - kernel part (LP: #1835531)
+    - s390/protvirt: introduce host side setup
+    - s390/protvirt: add ultravisor initialization
+    - s390/mm: provide memory management functions for protected KVM guests
+    - s390/mm: add (non)secure page access exceptions handlers
+    - s390/protvirt: Add sysfs firmware interface for Ultravisor information
+    - KVM: s390/interrupt: do not pin adapter interrupt pages
+    - KVM: s390: protvirt: Add UV debug trace
+    - KVM: s390: add new variants of UV CALL
+    - KVM: s390: protvirt: Add initial vm and cpu lifecycle handling
+    - KVM: s390: protvirt: Secure memory is not mergeable
+    - KVM: s390/mm: Make pages accessible before destroying the guest
+    - KVM: s390: protvirt: Handle SE notification interceptions
+    - KVM: s390: protvirt: Instruction emulation
+    - KVM: s390: protvirt: Implement interrupt injection
+    - KVM: s390: protvirt: Add SCLP interrupt handling
+    - KVM: s390: protvirt: Handle spec exception loops
+    - KVM: s390: protvirt: Add new gprs location handling
+    - KVM: S390: protvirt: Introduce instruction data area bounce buffer
+    - KVM: s390: protvirt: handle secure guest prefix pages
+    - KVM: s390/mm: handle guest unpin events
+    - KVM: s390: protvirt: Write sthyi data to instruction data area
+    - KVM: s390: protvirt: STSI handling
+    - KVM: s390: protvirt: disallow one_reg
+    - KVM: s390: protvirt: Do only reset registers that are accessible
+    - KVM: s390: protvirt: Only sync fmt4 registers
+    - KVM: s390: protvirt: Add program exception injection
+    - KVM: s390: protvirt: UV calls in support of diag308 0, 1
+    - KVM: s390: protvirt: Report CPU state to Ultravisor
+    - KVM: s390: protvirt: Support cmd 5 operation state
+    - KVM: s390: protvirt: Mask PSW interrupt bits for interception 104 and 112
+    - KVM: s390: protvirt: do not inject interrupts after start
+    - KVM: s390: protvirt: Add UV cpu reset calls
+    - DOCUMENTATION: Protected virtual machine introduction and IPL
+    - KVM: s390: protvirt: introduce and enable KVM_CAP_S390_PROTECTED
+    - KVM: s390: protvirt: Add KVM api documentation
+    - mm/gup/writeback: add callbacks for inaccessible pages
+
+  * All PS/2 ports on PS/2 Serial add-in bracket are not working after S3
+    (LP: #1866734)
+    - SAUCE: Input: i8042 - fix the selftest retry logic
+
+  * Sys oopsed with sysfs test in ubuntu_stress_smoke_test on X-hwe ARM64
+    (LP: #1866772)
+    - ACPI: sysfs: copy ACPI data using io memory copying
+
+  * Miscellaneous Ubuntu changes
+    - hio -- remove duplicated MODULE_DEVICE_TABLE declaration
+    - SAUCE: r8169: disable ASPM L1.1
+    - [Config] update annotations from configs
+    - [Config] update configs after annotation file review
+    - SAUCE: Revert "tools/power turbostat: Fix 32-bit capabilities warning"
+
+  * Miscellaneous upstream changes
+    - drm/i915: Fix eDP DPCD aux max backlight calculations
+    - drm/dp: Introduce EDID-based quirks
+    - drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED panel
+    - drm/i915: Force DPCD backlight mode for some Dell CML 2020 panels
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 25 Mar 2020 18:09:13 +0100
+
+linux-5.6 (5.6.0-5.5) focal; urgency=medium
+
+  * please help enable CONFIG_EROFS_FS_ZIP (LP: #1867099)
+    - [Config] CONFIG_EROFS_FS_ZIP=y
+    - [Config] CONFIG_EROFS_FS_CLUSTER_PAGE_LIMIT=1
+
+  * Miscellaneous Ubuntu changes
+    - Config: Fix SND_HDA_PREALLOC_SIZE annotations
+    - Config: Fix DATA_SHIFT annotations
+    - Config: remove ANDROID_VSOC from annotations
+    - Config: remove arm arch from annotations
+    - Config: Update SOC_R8A7796X annotations
+    - Config: Update CLK_R8A7796X annotations
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 18 Mar 2020 17:25:30 +0100
+
+linux-5.6 (5.6.0-4.4) focal; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+    - [Packaging] update helper scripts
+
+  * Add sysfs attribute to show remapped NVMe (LP: #1863621)
+    - SAUCE: ata: ahci: Add sysfs attribute to show remapped NVMe device count
+
+  * [20.04 FEAT] Compression improvements in Linux kernel (LP: #1830208)
+    - [Config] Introducing s390x specific kernel config option CONFIG_ZLIB_DFLTCC
+
+  * [UBUNTU 20.04] s390x/pci: increase CONFIG_PCI_NR_FUNCTIONS to 512 in kernel
+    config (LP: #1866056)
+    - [Config] Increase CONFIG_PCI_NR_FUNCTIONS from 64 to 512 starting with focal
+      on s390x
+
+  * CONFIG_IP_MROUTE_MULTIPLE_TABLES is not set (LP: #1865332)
+    - [Config] CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+
+  * [UBUNTU 20.04] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x
+    starting with focal (LP: #1865452)
+    - [Config] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x starting
+      with focal
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "UBUNTU: SAUCE: blk/core: Gracefully handle unset
+      make_request_fn"
+    - [Packaging] prevent duplicated entries in modules.ignore
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Mar 2020 09:42:06 +0100
+
+linux-5.6 (5.6.0-3.3) focal; urgency=medium
+
+  * nsleep-lat / set-timer-lat / inconsistency-check / raw_skew from timer in
+    ubuntu_kernel_selftests timeout on 5.3 / 5.4 (LP: #1864626)
+    - selftests/timers: Turn off timeout setting
+
+  * Update kernel options CONFIG_NR_CPUS and CONFIG_NUMA_EMU for focal
+    (LP: #1864198)
+    - Ubuntu: [Config] Update kernel options CONFIG_NR_CPUS and CONFIG_NUMA_EMU
+
+  * alsa/hda/realtek: fix a mute led regression on Lenovo X1 Carbon
+    (LP: #1864576)
+    - SAUCE: ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1
+
+  * r8152 init may take up to 40 seconds at initialization with Dell WD19/WD19DC
+    during hotplug (LP: #1864284)
+    - UBUNTU SAUCE: r8151: check disconnect status after long sleep
+
+  * Another Dell AIO backlight issue (LP: #1863880)
+    - SAUCE: platform/x86: dell-uart-backlight: move retry block
+
+  * Backport GetFB2 ioctl (LP: #1863874)
+    - SAUCE: drm: Add getfb2 ioctl
+
+  * Focal Fossa (20.04) feature request - Enable CONFIG_X86_UV (LP: #1863810)
+    - [Config] CONFIG_X86_UV=y
+
+  * Miscellaneous Ubuntu changes
+    - debian: remove snapdragon config, rules and flavour
+    - remove snapdragon abi files
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc4
+
+  * Miscellaneous upstream changes
+    - updateconfigs following snapdragon removal
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 04 Mar 2020 08:21:10 +0100
+
+linux-5.6 (5.6.0-2.2) focal; urgency=medium
+
+  * Sometimes can't adjust brightness on Dell AIO (LP: #1862885)
+    - SAUCE: platform/x86: dell-uart-backlight: increase retry times
+
+  * Dell XPS 13 (7390) Display Flickering - 19.10  (LP: #1849947)
+    - SAUCE: drm/i915: Disable PSR by default on all platforms
+
+  * Miscellaneous Ubuntu changes
+    - [debian] ignore missing wireguard module
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - [Config] CONFIG_LOCK_DOWN_IN_SECURE_BOOT=y
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc3
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (lockdown) s390/ipl: lockdown kernel when booted
+      secure"
+    - Revert "UBUNTU: SAUCE: (lockdown) KEYS: Make use of platform keyring for
+      module signature verify"
+    - Revert "UBUNTU: SAUCE: (lockdown) Add a SysRq option to lift kernel
+      lockdown"
+    - Revert "UBUNTU: SAUCE: (lockdown) security: lockdown: expose a hook to lock
+      the kernel down"
+    - Revert "UBUNTU: SAUCE: (lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err()."
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 24 Feb 2020 18:57:22 +0100
+
+linux-5.6 (5.6.0-1.1) focal; urgency=medium
+
+  *  Integrate Intel SGX driver into linux-azure (LP: #1844245)
+    - [Packaging] Add systemd service to load intel_sgx
+
+  * QAT drivers for C3XXX and C62X not included as modules (LP: #1845959)
+    - [Config] CRYPTO_DEV_QAT_C3XXX=m, CRYPTO_DEV_QAT_C62X=m and
+      CRYPTO_DEV_QAT_DH895xCC=m
+
+  * 5.4.0-11 crash on cryptsetup open (LP: #1860231)
+    - SAUCE: blk/core: Gracefully handle unset make_request_fn
+
+  * multi-zone raid0 corruption (LP: #1850540)
+    - SAUCE: md/raid0: Use kernel specific layout
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - update dropped.txt after rebase to v5.6-rc1
+    - [Config] updateconfigs after rebase to 5.6-rc1
+    - hio -- proc_create() requires a "struct proc_ops" in 5.6
+    - SAUCE: arm: fix build error in kvm tracepoint
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] Disable the uselib system call"
+    - Revert "UBUNTU: [Config] Disable legacy PTY naming"
+    - Revert "UBUNTU: [Config] Enforce filtered access to iomem"
+    - Revert "UBUNTU: [Config] Enable notifier call chain validations"
+    - Revert "UBUNTU: [Config] Enable scatterlist validation"
+    - Revert "UBUNTU: [Config] Enable cred sanity checks"
+    - Revert "UBUNTU: [Config] Enable linked list manipulation checks"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 13 Feb 2020 17:20:27 +0100
+
+linux-5.6 (5.6.0-0.0) focal; urgency=medium
+
+  * Dummy entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 10 Feb 2020 11:06:18 +0100
+
+linux-5.5 (5.5.0-7.8) focal; urgency=medium
+
+  * CONFIG_USELIB should be disabled (LP: #1855341)
+    - [Config] Disable the uselib system call
+
+  * CONFIG_LEGACY_PTYS should be disabled (LP: #1855339)
+    - [Config] Disable legacy PTY naming
+
+  * CONFIG_IO_STRICT_DEVMEM should be enabled (LP: #1855338)
+    - [Config] Enforce filtered access to iomem
+
+  * CONFIG_DEBUG_NOTIFIERS should be enabled (LP: #1855337)
+    - [Config] Enable notifier call chain validations
+
+  * CONFIG_DEBUG_SG should be enabled (LP: #1855336)
+    - [Config] Enable scatterlist validation
+
+  * CONFIG_DEBUG_CREDENTIALS should be enabled (LP: #1855335)
+    - [Config] Enable cred sanity checks
+
+  * CONFIG_DEBUG_LIST should be enabled (LP: #1855334)
+    - [Config] Enable linked list manipulation checks
+
+  * shiftfs: prevent lower dentries from going negative during unlink
+    (LP: #1860041)
+    - SAUCE: shiftfs: prevent lower dentries from going negative during unlink
+
+  * [SRU][B/OEM-B/OEM-OSP1/D/E/Unstable] UBUNTU: SAUCE: Use native backlight on
+    Lenovo E41-25/45 (LP: #1859561)
+    - SAUCE: ACPI: video: Use native backlight on Lenovo E41-25/45
+
+  * USB key cannot be detected by hotplug on Sunix USB Type-A 3.1 Gen 2 card
+    [1b21:2142]  (LP: #1858988)
+    - SAUCE: PCI: Avoid ASMedia XHCI USB PME# from D0 defect
+
+  * Dell AIO can't adjust brightness (LP: #1858761)
+    - SAUCE: platform/x86: dell-uart-backlight: add retry for get scalar status
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Fix typo in annotations file
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 27 Jan 2020 11:39:38 +0100
+
+linux-5.5 (5.5.0-6.7) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Update ubuntu-regression-suite dependency to python2
+    - [Packaging] Fix ubuntu-regression-suite python dependency for hwe kernel
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Jan 2020 10:16:01 +0100
+
+linux-5.5 (5.5.0-5.6) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Jan 2020 15:50:12 +0100
+
+linux-5.5 (5.5.0-4.5) focal; urgency=medium
+
+  * linux build and autopkg tests need to use python2 instead of python
+    (LP: #1858487)
+    - [Packaging] Remove python-dev build dependency
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Jan 2020 16:00:26 +0100
+
+linux-5.5 (5.5.0-3.4) focal; urgency=medium
+
+  * [SRU][B/OEM-B/OEM-OSP1/D/E/F] Add LG I2C touchscreen multitouch support
+    (LP: #1857541)
+    - SAUCE: HID: multitouch: Add LG MELF0410 I2C touchscreen support
+
+  * Make vfio-pci built-in or xhci_hcd optional (LP: #1770845)
+    - [Config]: built-in VFIO_PCI for amd64
+
+  * multi-zone raid0 corruption (LP: #1850540)
+    - SAUCE: md/raid0: Link to wiki with guidance on multi-zone RAID0 layout
+      migration
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Change source package to linux-5.5
+    - [Packaging] Don't use SRCPKGNAME for linux-libc-dev
+    - [Packaging] Remove linux-source-3 Provides: from linux-source
+    - [Packaging] Fix linux-doc in linux-image Suggests:
+    - [Debian] Read variants list into a variable
+    - [Packaging] Generate linux-libc-dev package only for primary variant
+    - [Packaging] Generate linux-doc for only the primary variant
+    - [Debian] Update linux source package name in debian/tests/*
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.5-rc3
+    - [Config] disable PCI_MESON
+    - [Config] Add pinctrl-equilibrium to modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Jan 2020 11:28:43 +0100
+
+linux-5.5 (5.5.0-2.3) focal; urgency=medium
+
+  * Empty entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 17 Dec 2019 22:33:59 -0600
+
+linux (5.5.0-2.3) focal; urgency=medium
+
+  * Support DPCD aux brightness control (LP: #1856134)
+    - SAUCE: drm/i915: Fix eDP DPCD aux max backlight calculations
+    - SAUCE: drm/i915: Assume 100% brightness when not in DPCD control mode
+    - SAUCE: drm/i915: Fix DPCD register order in intel_dp_aux_enable_backlight()
+    - SAUCE: drm/i915: Auto detect DPCD backlight support by default
+    - SAUCE: drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED
+      panel
+    - USUNTU: SAUCE: drm/i915: Force DPCD backlight mode on Dell Precision 4K sku
+
+  * change kconfig of the soundwire bus driver from y to m (LP: #1855685)
+    - [Config]: SOUNDWIRE=m
+
+  * Fix unusable USB hub on Dell TB16 after S3 (LP: #1855312)
+    - SAUCE: USB: core: Make port power cycle a seperate helper function
+    - SAUCE: USB: core: Attempt power cycle port when it's in eSS.Disabled state
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] add python depends to ubuntu-regression-suite
+    - SAUCE: selftests: net: tls: remove recv_rcvbuf test
+    - update dkms package versions
+
+  * Miscellaneous upstream changes
+    - [Config] updateconfigs after rebase to 5.5-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 17 Dec 2019 16:02:43 +0100
+
+linux (5.5.0-1.2) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] disable nvidia dkms build
+    - [Config] disable virtualbox dkms build
+    - [Config] disable zfs dkms build
+    - update dropped.txt after rebase to v5.5-rc1
+    - SAUCE: (lockdown) Make get_cert_list() not complain about cert lists that
+      aren't present.
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: (lockdown) s390/ipl: lockdown kernel when booted secure
+    - [Config] Enable lockdown under secure boot
+    - update dkms package versions
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 12 Dec 2019 16:54:41 +0100
+
+linux (5.5.0-0.1) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.5-rc1
+
+   [ Upstream Kernel Changes ]
+
+   * Rebase to v5.5-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Dec 2019 19:03:35 +0100
+
+linux (5.5.0-0.0) focal; urgency=medium
+
+  * Dummy entry.
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Dec 2019 15:14:37 +0100
+
+linux (5.4.0-8.11) focal; urgency=medium
+
+  * focal/linux: 5.4.0-8.9 -proposed tracker (LP: #1855448)
+
+  * update ENA driver for DIMLIB dynamic interrupt moderation (LP: #1853180)
+    - SAUCE: net: ena: fix issues in setting interrupt moderation params in
+      ethtool
+    - SAUCE: net: ena: fix too long default tx interrupt moderation interval
+
+  * Kernel build log filled with "/bin/bash: line 5: warning: command
+    substitution: ignored null byte in input" (LP: #1853843)
+    - [Debian] Fix warnings when checking for modules signatures
+
+  * hwe-edge kernel 5.3.0-23.25 kernel does not boot on Precision 5720 AIO
+    (LP: #1852581)
+    - [Packaging] Fix module signing with older modinfo
+
+  * Fix MST support on Ice Lake (LP: #1854432)
+    - drm/i915: fix port checks for MST support on gen >= 11
+
+  * headphone has noise as not mute on dell machines with alc236/256
+    (LP: #1854401)
+    - SAUCE: ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236
+
+  * [CML-S62] Need enable intel_pmc_core driver patch for Comet lake- S 6+2
+    (LP: #1847450)
+    - SAUCE: platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support
+      to intel_pmc_core driver
+
+  * CVE-2019-14901
+    - SAUCE: mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
+
+  * CVE-2019-14896 // CVE-2019-14897
+    - SAUCE: libertas: Fix two buffer overflows at parsing bss descriptor
+
+  * CVE-2019-14895
+    - SAUCE: mwifiex: fix possible heap overflow in mwifiex_process_country_ie()
+
+  * [CML-S62] Need enable intel_rapl patch support for Comet lake- S 6+2
+    (LP: #1847454)
+    - powercap/intel_rapl: add support for CometLake Mobile
+    - powercap/intel_rapl: add support for Cometlake desktop
+
+  * External microphone can't work on some dell machines with the codec alc256
+    or alc236 (LP: #1853791)
+    - SAUCE: ALSA: hda/realtek - Move some alc256 pintbls to fallback table
+    - SAUCE: ALSA: hda/realtek - Move some alc236 pintbls to fallback table
+
+  * remount of multilower moved pivoted-root overlayfs root, results in I/O
+    errors on some modified files (LP: #1824407)
+    - SAUCE: ovl: fix lookup failure on multi lower squashfs
+
+  * [CML-S62] Need enable turbostat patch support for Comet lake- S 6+2
+    (LP: #1847451)
+    - SAUCE: tools/power turbostat: Add Cometlake support
+
+  * CONFIG_ARCH_ROCKCHIP is not set in ubuntu 18.04 aarch64,arm64 (LP: #1825222)
+    - [Config] Enable ROCKCHIP support for arm64
+
+  * [broadwell-rt286, playback] Since Linux 5.2rc2 audio playback no longer
+    works on Dell Venue 11 Pro 7140 (LP: #1846539)
+    - SAUCE: ASoC: SOF: Intel: Broadwell: clarify mutual exclusion with legacy
+      driver
+
+  * i40e: general protection fault in i40e_config_vf_promiscuous_mode
+    (LP: #1852663)
+    - SAUCE: i40e Fix GPF when deleting VMs
+
+  * libbpf check_abi fails on ppc64el (LP: #1854974)
+    - libbpf: Fix readelf output parsing on powerpc with recent binutils
+
+  * CVE-2019-19050
+    - crypto: user - fix memory leak in crypto_reportstat
+
+  * Make hotplugging docking station to Thunderbolt port more reliable
+    (LP: #1853991)
+    - PCI/PM: Add pcie_wait_for_link_delay()
+    - PCI/PM: Add missing link delays required by the PCIe spec
+
+  * i915: Display flickers (monitor loses signal briefly) during "flickerfree"
+    boot, while showing the BIOS logo on a black background (LP: #1836858)
+    - [Config] FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER=y
+
+  * [CML] New device id's for CMP-H (LP: #1846335)
+    - i2c: i801: Add support for Intel Comet Lake PCH-H
+    - mtd: spi-nor: intel-spi: Add support for Intel Comet Lake-H SPI serial flash
+    - mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs
+
+  * Focal update: v5.4.2 upstream stable release (LP: #1855326)
+    - io_uring: async workers should inherit the user creds
+    - net: separate out the msghdr copy from ___sys_{send,recv}msg()
+    - net: disallow ancillary data for __sys_{send,recv}msg_file()
+    - crypto: inside-secure - Fix stability issue with Macchiatobin
+    - driver core: platform: use the correct callback type for bus_find_device
+    - usb: dwc2: use a longer core rest timeout in dwc2_core_reset()
+    - staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param()
+    - staging: rtl8192e: fix potential use after free
+    - staging: rtl8723bs: Drop ACPI device ids
+    - staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
+    - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
+    - mei: bus: prefix device names on bus with the bus name
+    - mei: me: add comet point V device id
+    - thunderbolt: Power cycle the router if NVM authentication fails
+    - x86/fpu: Don't cache access to fpu_fpregs_owner_ctx
+    - gve: Fix the queue page list allocated pages count
+    - macvlan: schedule bc_work even if error
+    - mdio_bus: don't use managed reset-controller
+    - net: dsa: sja1105: fix sja1105_parse_rgmii_delays()
+    - net: macb: add missed tasklet_kill
+    - net: psample: fix skb_over_panic
+    - net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
+    - openvswitch: fix flow command message size
+    - sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
+    - slip: Fix use-after-free Read in slip_open
+    - sctp: cache netns in sctp_ep_common
+    - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
+    - openvswitch: remove another BUG_ON()
+    - net/tls: take into account that bpf_exec_tx_verdict() may free the record
+    - net/tls: free the record on encryption error
+    - net: skmsg: fix TLS 1.3 crash with full sk_msg
+    - selftests/tls: add a test for fragmented messages
+    - net/tls: remove the dead inplace_crypto code
+    - net/tls: use sg_next() to walk sg entries
+    - selftests: bpf: test_sockmap: handle file creation failures gracefully
+    - selftests: bpf: correct perror strings
+    - tipc: fix link name length check
+    - selftests: pmtu: use -oneline for ip route list cache
+    - r8169: fix jumbo configuration for RTL8168evl
+    - r8169: fix resume on cable plug-in
+    - ext4: add more paranoia checking in ext4_expand_extra_isize handling
+    - Revert "jffs2: Fix possible null-pointer dereferences in
+      jffs2_add_frag_to_fragtree()"
+    - crypto: talitos - Fix build error by selecting LIB_DES
+    - HID: core: check whether Usage Page item is after Usage ID items
+    - platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
+    - platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size
+    - Linux 5.4.2
+
+  * no HDMI video output since GDM greeter after linux-oem-osp1 version
+    5.0.0-1026 (LP: #1852386)
+    - drm/i915: Add new CNL PCH ID seen on a CML platform
+    - SAUCE: drm/i915: Fix detection for a CMP-V PCH
+
+  * Please add patch fixing RK818 ID detection (LP: #1853192)
+    - SAUCE: mfd: rk808: Fix RK818 ID template
+
+  * Raydium Touchscreen on ThinkPad L390 does not work (LP: #1849721)
+    - HID: i2c-hid: fix no irq after reset on raydium 3118
+
+  * Touchpad doesn't work on Dell Inspiron 7000 2-in-1 (LP: #1851901)
+    - Revert "UBUNTU: SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390
+      2-in-1"
+    - lib: devres: add a helper function for ioremap_uc
+    - mfd: intel-lpss: Use devm_ioremap_uc for MMIO
+
+  * Lenovo dock MAC Address pass through doesn't work in Ubuntu  (LP: #1827961)
+    - r8152: Add macpassthru support for ThinkPad Thunderbolt 3 Dock Gen 2
+
+  * Disable unreliable HPET on CFL-H system (LP: #1852216)
+    - SAUCE: x86/intel: Disable HPET on Intel Coffe Lake H platforms
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] Enable virtualbox dkms build
+    - [Config] update annotations to match current configs
+    - SAUCE: Add exfat module to signature inclusion list
+
+  * Miscellaneous upstream changes
+    - Bluetooth: Fix invalid-free in bcsp_close()
+    - ath9k_hw: fix uninitialized variable data
+    - ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe
+    - ath10k: Fix HOST capability QMI incompatibility
+    - ath10k: restore QCA9880-AR1A (v1) detection
+    - Revert "Bluetooth: hci_ll: set operational frequency earlier"
+    - Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues"
+    - md/raid10: prevent access of uninitialized resync_pages offset
+    - x86/insn: Fix awk regexp warnings
+    - x86/speculation: Fix incorrect MDS/TAA mitigation status
+    - x86/speculation: Fix redundant MDS mitigation message
+    - nbd: prevent memory leak
+    - x86/stackframe/32: Repair 32-bit Xen PV
+    - x86/xen/32: Make xen_iret_crit_fixup() independent of frame layout
+    - x86/xen/32: Simplify ring check in xen_iret_crit_fixup()
+    - x86/doublefault/32: Fix stack canaries in the double fault handler
+    - x86/pti/32: Size initial_page_table correctly
+    - x86/cpu_entry_area: Add guard page for entry stack on 32bit
+    - x86/entry/32: Fix IRET exception
+    - x86/entry/32: Use %ss segment where required
+    - x86/entry/32: Move FIXUP_FRAME after pushing %fs in SAVE_ALL
+    - x86/entry/32: Unwind the ESPFIX stack earlier on exception entry
+    - x86/entry/32: Fix NMI vs ESPFIX
+    - selftests/x86/mov_ss_trap: Fix the SYSENTER test
+    - selftests/x86/sigreturn/32: Invalidate DS and ES when abusing the kernel
+    - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make
+      the CPU_ENTRY_AREA_PAGES assert precise
+    - x86/entry/32: Fix FIXUP_ESPFIX_STACK with user CR3
+    - futex: Prevent robust futex exit race
+    - ALSA: usb-audio: Fix NULL dereference at parsing BADD
+    - ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data
+    - media: vivid: Set vid_cap_streaming and vid_out_streaming to true
+    - media: vivid: Fix wrong locking that causes race conditions on streaming
+      stop
+    - media: usbvision: Fix invalid accesses after device disconnect
+    - media: usbvision: Fix races among open, close, and disconnect
+    - cpufreq: Add NULL checks to show() and store() methods of cpufreq
+    - futex: Move futex exit handling into futex code
+    - futex: Replace PF_EXITPIDONE with a state
+    - exit/exec: Seperate mm_release()
+    - futex: Split futex_mm_release() for exit/exec
+    - futex: Set task::futex_state to DEAD right after handling futex exit
+    - futex: Mark the begin of futex exit explicitly
+    - futex: Sanitize exit state handling
+    - futex: Provide state handling for exec() as well
+    - futex: Add mutex around futex exit
+    - futex: Provide distinct return value when owner is exiting
+    - futex: Prevent exit livelock
+    - media: uvcvideo: Fix error path in control parsing failure
+    - media: b2c2-flexcop-usb: add sanity checking
+    - media: cxusb: detect cxusb_ctrl_msg error in query
+    - media: imon: invalid dereference in imon_touch_event
+    - media: mceusb: fix out of bounds read in MCE receiver buffer
+    - ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs
+    - USBIP: add config dependency for SGL_ALLOC
+    - usbip: tools: fix fd leakage in the function of read_attr_usbip_status
+    - usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit()
+    - usb-serial: cp201x: support Mark-10 digital force gauge
+    - USB: chaoskey: fix error case of a timeout
+    - appledisplay: fix error handling in the scheduled work
+    - USB: serial: mos7840: add USB ID to support Moxa UPort 2210
+    - USB: serial: mos7720: fix remote wakeup
+    - USB: serial: mos7840: fix remote wakeup
+    - USB: serial: option: add support for DW5821e with eSIM support
+    - USB: serial: option: add support for Foxconn T77W968 LTE modules
+    - staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
+    - powerpc/book3s64: Fix link stack flush on context switch
+    - KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel
+    - Linux 5.4.1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 06 Dec 2019 15:53:53 -0600
+
+linux (5.4.0-7.8) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/bpf: Comment out BPF_CORE_READ's which cause clang to
+      segfault
+    - Update nvidia-430 to nvidia-440
+    - [Config] Enable nvidia dkms build
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 25 Nov 2019 15:02:30 +0100
+
+linux (5.4.0-6.7) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.4-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 18 Nov 2019 12:08:01 +0100
+
+linux (5.4.0-5.6) focal; urgency=medium
+
+  * refcount underflow and type confusion in shiftfs (LP: #1850867) //
+    CVE-2019-15793
+    - SAUCE: shiftfs: Correct id translation for lower fs operations
+
+  * refcount underflow and type confusion in shiftfs (LP: #1850867) //
+    CVE-2019-15792
+    - SAUCE: shiftfs: prevent type confusion
+
+  * refcount underflow and type confusion in shiftfs (LP: #1850867) //
+    CVE-2019-15791
+    - SAUCE: shiftfs: Fix refcount underflow in btrfs ioctl handling
+
+  * Some EFI systems fail to boot in efi_init() when booted via maas
+    (LP: #1851810)
+    - SAUCE: efi: efi_get_memory_map -- increase map headroom
+
+  * seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test (LP: #1849281)
+    - SAUCE: seccomp: rework define for SECCOMP_USER_NOTIF_FLAG_CONTINUE
+    - SAUCE: seccomp: avoid overflow in implicit constant conversion
+
+  * dkms artifacts may expire from the pool (LP: #1850958)
+    - [Packaging] dkms -- try launchpad librarian for pool downloads
+    - [Packaging] dkms -- dkms-build quieten wget verbiage
+
+  * tsc marked unstable after entered PC10 on Intel CoffeeLake (LP: #1840239)
+    - SAUCE: x86/intel: Disable HPET on Intel Coffe Lake platforms
+    - SAUCE: x86/intel: Disable HPET on Intel Ice Lake platforms
+
+  * shiftfs: prevent exceeding project quotas (LP: #1849483)
+    - SAUCE: shiftfs: drop CAP_SYS_RESOURCE from effective capabilities
+
+  * shiftfs: fix fallocate() (LP: #1849482)
+    - SAUCE: shiftfs: setup correct s_maxbytes limit
+
+  * The alsa hda driver is not loaded due to the missing of PCIID for Comet
+    Lake-S [8086:a3f0] (LP: #1852070)
+    - SAUCE: ALSA: hda: Add Cometlake-S PCI ID
+
+  * Can't adjust brightness on DELL UHD dGPU AIO (LP: #1813877)
+    - SAUCE: platform/x86: dell-uart-backlight: add missing status command
+    - SAUCE: platform/x86: dell-uart-backlight: load driver by scalar status
+    - SAUCE: platform/x86: dell-uart-backlight: add force parameter
+    - SAUCE: platform/x86: dell-uart-backlight: add quirk for old platforms
+
+  * s_iflags overlap prevents unprivileged overlayfs mounts (LP: #1851677)
+    - SAUCE: fs: Move SB_I_NOSUID to the top of s_iflags
+
+  * ubuntu-aufs-modified mmap_region() breaks refcounting in overlayfs/shiftfs
+    error path (LP: #1850994) // CVE-2019-15794
+    - SAUCE: shiftfs: Restore vm_file value when lower fs mmap fails
+    - SAUCE: ovl: Restore vm_file value when lower fs mmap fails
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Convert update-aufs.sh to use aufs5
+    - SAUCE: import aufs driver
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 13 Nov 2019 11:56:35 -0800
+
+linux (5.4.0-4.5) focal; urgency=medium
+
+  * High power consumption using 5.0.0-25-generic (LP: #1840835)
+    - PCI: Add a helper to check Power Resource Requirements _PR3 existence
+    - ALSA: hda: Allow HDA to be runtime suspended when dGPU is not bound to a
+      driver
+    - PCI: Fix missing inline for pci_pr3_present()
+
+  * Fix signing of staging modules in eoan (LP: #1850234)
+    - [Packaging] Leave unsigned modules unsigned after adding .gnu_debuglink
+
+  * [20.04 FEAT] Set Architecture Level (ALS) to z13 (LP: #1837525)
+    - [Config] s390x bump march to z13, with tune to z15
+
+  * Miscellaneous Ubuntu changes
+    - [Debian]: do not skip tests for linux-hwe-edge
+    - update dkms package versions
+    - [Config] re-enable zfs
+    - [Config] rename module virtio_fs to virtiofs
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Nov 2019 15:12:02 +0100
+
+linux (5.4.0-3.4) focal; urgency=medium
+
+  * seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test (LP: #1849281)
+    - SAUCE: seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test
+
+  * cloudimg: no iavf/i40evf module so no network available with SR-IOV enabled
+    cloud (LP: #1848481)
+    - [Packaging] include iavf/i40evf in generic
+
+  * CVE-2019-17666
+    - SAUCE: rtlwifi: Fix potential overflow on P2P code
+
+  * Change Config Option CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE for s390x from yes
+    to no (LP: #1848492)
+    - [Config] Change Config Option CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE for s390x
+      from yes to no
+
+  * Add Intel Comet Lake ethernet support (LP: #1848555)
+    - SAUCE: e1000e: Add support for Comet Lake
+
+  * seccomp: add SECCOMP_USER_NOTIF_FLAG_CONTINUE    (LP: #1847744)
+    - SAUCE: seccomp: add SECCOMP_USER_NOTIF_FLAG_CONTINUE
+    - SAUCE: seccomp: test SECCOMP_USER_NOTIF_FLAG_CONTINUE
+
+  * drm/i915: Fix the issue of "azx_get_response timeout" for hdmi audio on ICL
+    platforms (LP: #1847192)
+    - SAUCE: drm/i915: Fix audio power up sequence for gen10+ display
+    - SAUCE: drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms
+
+  * PM / hibernate: fix potential memory corruption (LP: #1847118)
+    - SAUCE: PM / hibernate: memory_bm_find_bit -- tighten node optimisation
+
+  * [regression] NoNewPrivileges incompatible with Apparmor (LP: #1844186)
+    - SAUCE: apparmor: fix nnp subset test for unconfined
+
+  * overlayfs: allow with shiftfs as underlay (LP: #1846272)
+    - SAUCE: overlayfs: allow with shiftfs as underlay
+
+  * eoan: alsa/sof: Enable SOF_HDA link and codec (LP: #1848490)
+    - [Config] Fix SOF Kconfig options
+
+  * linux won't build when new virtualbox version is present on the archive
+    (LP: #1848788)
+    - [Packaging]: download virtualbox from sources
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations from configs
+    - [Config] updateconfigs after rebase to 5.4-rc5
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 29 Oct 2019 12:01:27 -0500
+
+linux (5.4.0-2.3) eoan; urgency=medium
+
+  * Add installer support for iwlmvm adapters (LP: #1848236)
+    - d-i: Add iwlmvm to nic-modules
+
+  * shiftfs: rework how shiftfs opens files (LP: #1846265)
+    - SAUCE: shiftfs: rework how shiftfs opens files
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.4-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Oct 2019 17:31:26 +0200
+
+linux (5.4.0-1.2) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.4-rc3
+    - [Config] add flexfb, fbtft_device and rio500 to modules.ignore
+    - [Config] amd64: ignore fbtft and all dependent modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Oct 2019 19:48:52 +0200
+
+linux (5.4.0-0.1) eoan; urgency=medium
+
+  * Enable the Dragonboards out of Eoan/master arm64 kernel (LP: #1846704)
+    - [Packaging] arm64: snapdragon: introduce a snapdragon flavour
+    - [Packaging] arm64: snapdragon: switch kernel format to Image
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8916=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8994=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8996=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8998=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_RPMH=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_BAM_DMA=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_HIDMA_MGMT=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_HIDMA=y
+    - [Config] arm64: snapdragon: CONFIG_COMMON_CLK_QCOM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_RPMH=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8916=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8994=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_MMCC_8996=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8998=y
+    - [Config] arm64: snapdragon: CONFIG_HWSPINLOCK_QCOM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_APCS_IPC=y
+    - [Config] arm64: snapdragon: CONFIG_RPMSG_QCOM_GLINK_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_GENI_SE=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMEM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMD_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMP2P=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMSM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_QFPROM=y
+    - [Config] arm64: snapdragon: CONFIG_SERIAL_QCOM_GENI=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_TSENS=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_SMD_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_SMD_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_RPMSG_QCOM_SMD=y
+    - [Config] arm64: snapdragon: CONFIG_MFD_QCOM_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_SCSI_UFSHCD=y
+    - [Config] arm64: snapdragon: CONFIG_SCSI_UFSHCD_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_SCSI_UFS_HISI=y
+    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI=y
+    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI_PLTFM=y
+    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI_MSM=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_SPMI=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_USB_HS=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_QMP=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_UFS=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_USB_HSIC=y
+    - [Config] arm64: snapdragon: CONFIG_USB_CHIPIDEA_OF=y
+    - [Config] arm64: snapdragon: CONFIG_USB_EHCI_HCD_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_EXTCON_USB_GPIO=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_FIXED_VOLTAGE=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_GPIO=y
+    - [Config] arm64: snapdragon: CONFIG_USB_HSIC_USB3503=y
+    - [Config] arm64: snapdragon: CONFIG_USB_NET_DRIVERS=y
+    - [Config] arm64: snapdragon: CONFIG_USB_OTG=y
+    - [Config] arm64: snapdragon: CONFIG_USB_XHCI_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_USB_OHCI_HCD_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_USB_MUSB_HDRC=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3_PCI=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3_OF_SIMPLE=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3_QCOM=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_PWM=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_A53PLL=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_APCS_MSM8916=y
+    - [Config] arm64: snapdragon: CONFIG_NLS_ISO8859_1=y
+    - [Config] arm64: snapdragon: CONFIG_USB_USBNET=y
+    - [Config] arm64: snapdragon: CONFIG_CRYPTO_DEV_QCOM_RNG=y
+    - [Config] arm64: snapdragon: CONFIG_POWER_RESET_QCOM_PON=y
+    - [Config] arm64: snapdragon: CONFIG_INPUT_PM8941_PWRKEY=y
+    - [Config] arm64: snapdragon: CONFIG_KEYBOARD_GPIO=y
+    - [Config] arm64: snapdragon: CONFIG_RTC_DRV_PM8XXX=y
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.4-rc2
+    - SAUCE: (lockdown) Make get_cert_list() not complain about cert lists that
+      aren't present.
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: (lockdown) s390/ipl: lockdown kernel when booted secure
+    - [Config] Enable lockdown under secure boot
+    - SAUCE: import aufs driver
+    - SAUCE: aufs: rwsem owner changed to atmoic_long_t in 5.3
+    - SAUCE: aufs: add "WITH Linux-syscall-note" to SPDX tag of uapi headers
+    - [Config] enable aufs
+    - update dkms package versions
+    - [Config] disable zfs
+    - [Config] disable nvidia dkms build
+    - [Config] disable virtualbox dkms build
+    - [Debian] Generate stub reconstruct for -rc kernels
+    - Revert "UBUNTU: SAUCE: (namespace) block_dev: Forbid unprivileged mounting
+      when device is opened for writing"
+    - Revert "UBUNTU: SAUCE: (namespace) ext4: Add module parameter to enable user
+      namespace mounts"
+    - Revert "UBUNTU: SAUCE: (namespace) ext4: Add support for unprivileged mounts
+      from user namespaces"
+    - Revert "UBUNTU: SAUCE: (namespace) mtd: Check permissions towards mtd block
+      device inode when mounting"
+    - Revert "UBUNTU: SAUCE: (namespace) block_dev: Check permissions towards
+      block device inode when mounting"
+    - Revert "UBUNTU: SAUCE: (namespace) block_dev: Support checking inode
+      permissions in lookup_bdev()"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 11 Oct 2019 16:42:41 -0500
+
+linux (5.4.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 08 Oct 2019 09:59:00 -0500
+
+linux (5.3.0-17.18) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-17.18 -proposed tracker (LP: #1846641)
+
+  * CVE-2019-17056
+    - nfc: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17055
+    - mISDN: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17054
+    - appletalk: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17053
+    - ieee802154: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17052
+    - ax25: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-15098
+    - ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()
+
+  * xHCI on AMD Stoney Ridge cannot detect USB 2.0 or 1.1 devices.
+    (LP: #1846470)
+    - x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect
+
+  * Re-enable linux-libc-dev build on i386 (LP: #1846508)
+    - [Packaging] Build only linux-libc-dev for i386
+    - [Debian] final-checks -- ignore archtictures with no binaries
+
+  * arm64: loop on boot after installing linux-generic-hwe-18.04-edge/bionic-
+    proposed (LP: #1845820)
+    - [Config] Disable CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT
+
+  * Revert ESE DASD discard support (LP: #1846219)
+    - SAUCE: Revert "s390/dasd: Add discard support for ESE volumes"
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 03 Oct 2019 16:57:05 -0500
+
+linux (5.3.0-16.17) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-16.17 -proposed tracker (LP: #1846204)
+
+  * zfs fails to build on s390x  with debug symbols enabled (LP: #1846143)
+    - SAUCE: s390: Mark atomic const ops always inline
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 01 Oct 2019 07:46:43 -0500
+
+linux (5.3.0-15.16) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-15.16 -proposed tracker (LP: #1845987)
+
+  * Drop i386 build for 19.10 (LP: #1845714)
+    - [Packaging] Remove x32 arch references from control files
+    - [Debian] final-checks -- Get arch list from debian/control
+
+  * ZFS kernel modules lack debug symbols (LP: #1840704)
+    - [Debian] Fix conditional for setting zfs debug package path
+
+  * Use pyhon3-sphinx instead of python-sphinx for building html docs
+    (LP: #1845808)
+    - [Packaging] Update sphinx build dependencies to python3 packages
+
+  * Kernel panic with 19.10 beta image (LP: #1845454)
+    - efi/tpm: Don't access event->count when it isn't mapped.
+    - efi/tpm: don't traverse an event log with no events
+    - efi/tpm: only set efi_tpm_final_log_size after successful event log parsing
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 30 Sep 2019 11:57:20 -0500
+
+linux (5.3.0-14.15) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-14.15 -proposed tracker (LP: #1845728)
+
+  * Drop i386 build for 19.10 (LP: #1845714)
+    - [Debian] Remove support for producing i386 kernels
+    - [Debian] Don't use CROSS_COMPILE for i386 configs
+
+  * udevadm trigger will fail when trying to add /sys/devices/vio/
+    (LP: #1845572)
+    - SAUCE: powerpc/vio: drop bus_type from parent device
+
+  * Trying to online dasd drive results in invalid input/output from the kernel
+    on z/VM (LP: #1845323)
+    - SAUCE: s390/dasd: Fix error handling during online processing
+
+  * intel-lpss driver conflicts with write-combining MTRR region (LP: #1845584)
+    - SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390 2-in-1
+
+  * Support Hi1620 zip hw accelerator (LP: #1845355)
+    - [Config] Enable HiSilicon QM/ZIP as modules
+    - crypto: hisilicon - add queue management driver for HiSilicon QM module
+    - crypto: hisilicon - add hardware SGL support
+    - crypto: hisilicon - add HiSilicon ZIP accelerator support
+    - crypto: hisilicon - add SRIOV support for ZIP
+    - Documentation: Add debugfs doc for hisi_zip
+    - crypto: hisilicon - add debugfs for ZIP and QM
+    - MAINTAINERS: add maintainer for HiSilicon QM and ZIP controller driver
+    - crypto: hisilicon - fix kbuild warnings
+    - crypto: hisilicon - add dependency for CRYPTO_DEV_HISI_ZIP
+    - crypto: hisilicon - init curr_sgl_dma to fix compile warning
+    - crypto: hisilicon - add missing single_release
+    - crypto: hisilicon - fix error handle in hisi_zip_create_req_q
+    - crypto: hisilicon - Fix warning on printing %p with dma_addr_t
+    - crypto: hisilicon - Fix return value check in hisi_zip_acompress()
+    - crypto: hisilicon - avoid unused function warning
+
+  * SafeSetID LSM should be built but disabled by default (LP: #1845391)
+    - LSM: SafeSetID: Stop releasing uninitialized ruleset
+    - [Config] Build SafeSetID LSM but don't enable it by default
+
+  * CONFIG_LSM should not specify loadpin since it is not built (LP: #1845383)
+    - [Config] loadpin shouldn't be in CONFIG_LSM
+
+  * Add new pci-id's for CML-S, ICL (LP: #1845317)
+    - drm/i915/icl: Add missing device ID
+    - drm/i915/cml: Add Missing PCI IDs
+
+  * Thunderbolt support for ICL (LP: #1844680)
+    - thunderbolt: Correct path indices for PCIe tunnel
+    - thunderbolt: Move NVM upgrade support flag to struct icm
+    - thunderbolt: Use 32-bit writes when writing ring producer/consumer
+    - thunderbolt: Do not fail adding switch if some port is not implemented
+    - thunderbolt: Hide switch attributes that are not set
+    - thunderbolt: Expose active parts of NVM even if upgrade is not supported
+    - thunderbolt: Add support for Intel Ice Lake
+    - ACPI / property: Add two new Thunderbolt property GUIDs to the list
+
+  * Ubuntu 19.10 -  Additional PCI patch and fix (LP: #1844668)
+    - s390/pci: fix MSI message data
+
+  * Enhanced Hardware Support - Finalize Naming (LP: #1842774)
+    - s390: add support for IBM z15 machines
+    - [Config] CONFIG_MARCH_Z15=n, CONFIG_TUNE_Z15=n
+
+  * Eoan update: v5.3.1 upstream stable release (LP: #1845642)
+    - USB: usbcore: Fix slab-out-of-bounds bug during device reset
+    - media: tm6000: double free if usb disconnect while streaming
+    - phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
+    - ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit
+    - net/sched: fix race between deactivation and dequeue for NOLOCK qdisc
+    - net_sched: let qdisc_put() accept NULL pointer
+    - udp: correct reuseport selection with connected sockets
+    - xen-netfront: do not assume sk_buff_head list is empty in error handling
+    - net: dsa: Fix load order between DSA drivers and taggers
+    - net: stmmac: Hold rtnl lock in suspend/resume callbacks
+    - KVM: coalesced_mmio: add bounds checking
+    - Documentation: sphinx: Add missing comma to list of strings
+    - firmware: google: check if size is valid when decoding VPD data
+    - serial: sprd: correct the wrong sequence of arguments
+    - tty/serial: atmel: reschedule TX after RX was started
+    - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
+    - Revert "arm64: Remove unnecessary ISBs from set_{pte,pmd,pud}"
+    - ovl: fix regression caused by overlapping layers detection
+    - phy: qcom-qmp: Correct ready status, again
+    - floppy: fix usercopy direction
+    - media: technisat-usb2: break out of loop at end of buffer
+    - Linux 5.3.1
+
+  * ZFS kernel modules lack debug symbols (LP: #1840704)
+    - [Debian]: Remove hardcoded $(pkgdir) in debug symbols handling
+    - [Debian]: Handle debug symbols for modules in extras too
+    - [Debian]: Check/link modules with debug symbols after DKMS modules
+    - [Debian]: Warn about modules without debug symbols
+    - [Debian]: dkms-build: new parameter for debug package directory
+    - [Debian]: dkms-build: zfs: support for debug symbols
+    - [Debian]: dkms-build: Avoid executing post-processor scripts twice
+    - [Debian]: dkms-build: Move zfs special-casing into configure script
+
+  * /proc/self/maps paths missing on live session (was vlc won't start; eoan
+    19.10 & bionic 18.04 ubuntu/lubuntu/kubuntu/xubuntu/ubuntu-mate dailies)
+    (LP: #1842382)
+    - SAUCE: Revert "UBUNTU: SAUCE: shiftfs: enable overlayfs on shiftfs"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 27 Sep 2019 16:08:06 -0500
+
+linux (5.3.0-13.14) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-13.14 -proposed tracker (LP: #1845105)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Remove binutils-dev build dependency
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 23 Sep 2019 19:26:43 -0500
+
+linux (5.3.0-12.13) eoan; urgency=medium
+
+  * Change kernel compression method to improve boot speed (LP: #1840934)
+    - [Packaging] Add lz4 build dependency for s390x
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Remove spl and zfs source
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 17 Sep 2019 13:36:26 +0200
+
+linux (5.3.0-11.12) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-11.12 -proposed tracker (LP: #1844144)
+
+  *  Suspend to RAM(S3) does not wake up for latest megaraid and mpt3sas
+    adapters(SAS3.5 onwards) (LP: #1838751)
+    - PCI: Restore Resizable BAR size bits correctly for 1MB BARs
+
+  * s390/setup: Actually init kernel lock down (LP: #1843961)
+    - SAUCE: (lockdown) s390/setup: Actually init kernel lock down
+
+  * cherrypick has_sipl fix (LP: #1843960)
+    - SAUCE: s390/sclp: Fix bit checked for has_sipl
+
+  * Change kernel compression method to improve boot speed (LP: #1840934)
+    - [Config]: Switch kernel compression from LZO to LZ4 on s390x
+
+  * Installation fails on eoan/PowerVM : missing /dev/nvram (LP: #1837726)
+    - [Config] CONFIG_NVRAM=y for ppc64el
+
+  * Miscellaneous Ubuntu changes
+    - [Config]: remove nvram from ppc64el modules ABI
+    - [Config] Update annotations for recent config changes
+    - SAUCE: sched: Add __ASSEMBLY__ guards around struct clone_args
+    - SAUCE: i2c: qcom-geni: Disable DMA processing on the Lenovo Yoga C630
+    - SAUCE: arm64: dts: qcom: Add Lenovo Yoga C630
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 16 Sep 2019 16:18:27 +0200
+
+linux (5.3.0-10.11) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-10.11 -proposed tracker (LP: #1843232)
+
+  * No sound inputs from the external microphone and headset on a Dell machine
+    (LP: #1842265)
+    - SAUCE: ALSA: hda - Expand pin_match function to match upcoming new tbls
+    - SAUCE: ALSA: hda - Define a fallback_pin_fixup_tbl for alc269 family
+
+  * Horizontal corrupted line at top of screen caused by framebuffer compression
+    (LP: #1840236)
+    - SAUCE: drm/i915/fbc: disable framebuffer compression on IceLake
+
+  * Add bpftool to linux-tools-common (LP: #1774815)
+    - [Debian] package bpftool in linux-tools-common
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc8
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 09 Sep 2019 10:00:41 +0200
+
+linux (5.3.0-9.10) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-9.10 -proposed tracker (LP: #1842393)
+
+  * shiftfs: mark kmem_cache as reclaimable (LP: #1842059)
+    - SAUCE: shiftfs: mark slab objects SLAB_RECLAIM_ACCOUNT
+
+  * shiftfs: drop entries from cache on unlink (LP: #1841977)
+    - SAUCE: shiftfs: fix buggy unlink logic
+
+  * Fix touchpad IRQ storm after S3 (LP: #1841396)
+    - pinctrl: intel: remap the pin number to gpio offset for irq enabled pin
+
+  * Please include DTBs for arm64 laptops (LP: #1842050)
+    - arm64: dts: qcom: Add Lenovo Miix 630
+    - arm64: dts: qcom: Add HP Envy x2
+    - arm64: dts: qcom: Add Asus NovaGo TP370QL
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import aufs driver
+    - [Packaging]: ignore vbox modules when vbox is disabled
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 03 Sep 2019 10:27:33 +0200
+
+linux (5.3.0-8.9) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+
+  * Change kernel compression method to improve boot speed (LP: #1840934)
+    - [Config] change kernel compression method to improve boot speed
+    - [Packaging] add build dependencies for compression algorithms
+
+  * realtek r8822be kernel module fails after update to linux kernel-headers
+    5.0.0-21 (LP: #1838133)
+    - rtw88: Fix misuse of GENMASK macro
+    - rtw88: pci: Rearrange the memory usage for skb in RX ISR
+    - rtw88: pci: Use DMA sync instead of remapping in RX ISR
+    - rtw88: debug: dump tx power indexes in use
+    - rtw88: use txpwr_lmt_cfg_pair struct, not arrays
+    - rtw88: pci: remove set but not used variable 'ip_sel'
+    - rtw88: allow c2h operation in irq context
+    - rtw88: enclose c2h cmd handle with mutex
+    - rtw88: add BT co-existence support
+    - SAUCE: rtw88: pci: enable MSI interrupt
+
+  * VIMC module not available (CONFIG_VIDEO_VIMC not set) (LP: #1831482)
+    - [Config] Enable VIMC module
+
+  * Goodix touchpad may drop first input event (LP: #1840075)
+    - Revert "UBUNTU: SAUCE: i2c: designware: add G3 3590 into i2c quirk"
+    - Revert "UBUNTU: SAUCE: i2c: designware: add Inpiron 7591 into i2c quirk"
+    - Revert "UBUNTU: SAUCE: i2c: designware: add Inpiron/Vostro 7590 into i2c
+      quirk"
+    - Revert "UBUNTU: SAUCE: i2c: designware: Add disable runtime pm quirk"
+    - mfd: intel-lpss: Remove D3cold delay
+
+  * Include Sunix serial/parallel driver (LP: #1826716)
+    - serial: 8250_pci: Add support for Sunix serial boards
+    - parport: parport_serial: Add support for Sunix Multi I/O boards
+
+  * enable lockdown on s390x when Secure IPL is performed (LP: #1839622)
+    - SAUCE: (lockdown) s390/ipl: lockdown kernel when booted secure
+    - Ubuntu: [Config] Enable CONFIG_LOCK_DOWN_KERNEL on s390x.
+
+  * UBUNTU: SAUCE: shiftfs: pass correct point down (LP: #1837231)
+    - SAUCE: shiftfs: pass correct point down
+
+  * shiftfs: add O_DIRECT support (LP: #1837223)
+    - SAUCE: shiftfs: add O_DIRECT support
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable secureboot signing on s390x
+    - [Config] CONFIG_TEST_BLACKHOLE_DEV=m
+    - SAUCE: selftests: fib_tests: assign address to dummy1 for rp_filter tests
+    - [Debian] disable dkms builds for autopktest rebuilds
+    - update dkms package versions
+    - [Config] updateconfigs after v5.3-rc6 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 26 Aug 2019 10:09:42 +0200
+
+linux (5.3.0-7.8) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after v5.3-rc5 rebase
+    - remove missing module after updateconfigs
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 19 Aug 2019 15:31:24 +0200
+
+linux (5.3.0-6.7) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/bpf: prevent headers to be compiled as C code
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 14 Aug 2019 13:25:01 -0500
+
+linux (5.3.0-5.6) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] enable zfs build
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 13 Aug 2019 09:16:06 -0500
+
+linux (5.3.0-4.5) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+    - [Packaging] update helper scripts
+
+  * bcache: bch_allocator_thread(): hung task timeout (LP: #1784665) // Tight
+    timeout for bcache removal causes spurious failures (LP: #1796292)
+    - SAUCE: bcache: fix deadlock in bcache_allocator
+
+  * shiftfs: allow overlayfs (LP: #1838677)
+    - SAUCE: shiftfs: enable overlayfs on shiftfs
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "kbuild: modpost: do not parse unnecessary rules for vmlinux
+      modpost"
+    - update dkms package versions
+    - enable nvidia dkms build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 12 Aug 2019 10:41:27 -0500
+
+linux (5.3.0-3.4) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - SAUCE: aufs: add "WITH Linux-syscall-note" to SPDX tag of uapi headers
+    - [Config] add mux-* to modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 05 Aug 2019 18:17:09 +0200
+
+linux (5.3.0-2.3) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] add build dependincy on fontconfig
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jul 2019 12:18:46 -0400
+
+linux (5.3.0-1.2) eoan; urgency=medium
+
+  * System does not auto detect disconnection of external monitor (LP: #1835001)
+    - SAUCE: drm/i915: Add support for retrying hotplug
+    - SAUCE: drm/i915: Enable hotplug retry
+
+  * Please enable CONFIG_SCSI_UFS_QCOM as a module on arm64 (LP: #1837332)
+    - [Config] Enable CONFIG_SCSI_UFS_QCOM as a module on arm64.
+
+  * Add arm64 CONFIG_ARCH_MESON=y and related configs Edit (LP: #1820530)
+    - [Config] enable ARCH_MESON
+    - remove missing module
+    - [Config] update annotations after enabling ARCH_MESON for arm64
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: KVM: PPC: comment implicit fallthrough
+    - update dkms package versions
+    - [Config] enable vbox dkms build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 28 Jul 2019 23:10:16 -0400
+
+linux (5.3.0-0.1) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and
+      KEXEC_SIG_FORCE
+    - SAUCE: (efi-lockdown) kexec_file: Restrict at runtime if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) lockdown: Print current->comm in restriction messages
+    - SAUCE: (efi-lockdown) kexec: Allow kexec_file() with appropriate IMA policy
+      when locked down
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) KEYS: Make use of platform keyring for module
+      signature verify
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) furter KEXEC_VERIFY_SIG -> KEXEC_SIG updates
+    - SAUCE: (efi-lockdown) arm64: add kernel config option to lock down when in
+      Secure Boot mode
+    - SAUCE: import aufs driver
+    - SAUCE: aufs: rwsem owner changed to atmoic_long_t in 5.3
+    - [Config] disable zfs dkms build
+    - [Config] disable nvidia dkms build
+    - [Config] disable vbox dkms build
+    - SAUCE: perf diff: use llabs for s64 vaules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 23 Jul 2019 21:45:44 -0500
+
+linux (5.3.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jul 2019 10:19:04 -0500
+
+linux (5.2.0-9.10) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * input/mouse: alps trackpoint-only device doesn't work (LP: #1836752)
+    - SAUCE: Input: alps - don't handle ALPS cs19 trackpoint-only device
+    - SAUCE: Input: alps - fix a mismatch between a condition check and its
+      comment
+
+  * System does not auto detect disconnection of external monitor (LP: #1835001)
+    - SAUCE: drm/i915: Add support for retrying hotplug
+    - SAUCE: drm/i915: Enable hotplug retry
+
+  * alsa/hdmi: add icelake hdmi audio support for a Dell machine (LP: #1836916)
+    - SAUCE: ALSA: hda/hdmi - Remove duplicated define
+    - SAUCE: ALSA: hda/hdmi - Fix i915 reverse port/pin mapping
+
+  * First click on Goodix touchpad doesn't be recognized after runtime suspended
+    (LP: #1836836)
+    - SAUCE: i2c: designware: add G3 3590 into i2c quirk
+
+  * ixgbe{vf} - Physical Function gets IRQ when VF checks link state
+    (LP: #1836760)
+    - ixgbevf: Use cached link state instead of re-reading the value for ethtool
+
+  * Doing multiple squashfs (and other loop?) mounts in parallel breaks
+    (LP: #1836914)
+    - SAUCE: Revert "loop: Don't change loop device under exclusive opener"
+
+  * hibmc-drm Causes Unreadable Display for Huawei amd64 Servers (LP: #1762940)
+    - SAUCE: Make CONFIG_DRM_HISI_HIBMC depend on ARM64
+    - [Config] Set CONFIG_DRM_HISI_HIBMC to arm64 only
+    - [Config] add hibmc-drm to modules.ignore
+
+  * hda/realtek: can't detect external mic on a Dell machine (LP: #1836755)
+    - ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine
+
+  * Enable Armada SOCs and MVPP2 NIC driver for disco/generic arm64
+    (LP: #1835054)
+    - [Config] Enable Armada SOCs and MVPP2 NIC driver for disco/generic arm64
+
+  * Unhide Nvidia HDA audio controller (LP: #1836308)
+    - PCI: Enable NVIDIA HDA controllers
+
+  * Intel ethernet I219 may wrongly detect connection speed as 10Mbps
+    (LP: #1836177)
+    - e1000e: Make watchdog use delayed work
+
+  * Sometimes touchpad(goodix) can't use tap function (LP: #1836020)
+    - SAUCE: i2c: designware: add Inpiron/Vostro 7590 into i2c quirk
+    - SAUCE: i2c: designware: add Inpiron 7591 into i2c quirk
+
+  * Intel ethernet I219 has slow RX speed (LP: #1836152)
+    - e1000e: add workaround for possible stalled packet
+    - e1000e: disable force K1-off feature
+
+  * bcache: risk of data loss on I/O errors in backing or caching devices
+    (LP: #1829563)
+    - Revert "bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()"
+
+  * bnx2x driver causes 100% CPU load (LP: #1832082)
+    - bnx2x: Prevent ptp_task to be rescheduled indefinitely
+
+  * fcf-protection=none patch with new version
+    - Revert "UBUNTU: SAUCE: kbuild: add -fcf-protection=none to retpoline flags"
+    - SAUCE: kbuild: add -fcf-protection=none when using retpoline flags
+
+  * CVE-2019-12614
+    - powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property()
+
+  * Eoan update: v5.2.1 upstream stable release (LP: #1836622)
+    - crypto: lrw - use correct alignmask
+    - crypto: talitos - rename alternative AEAD algos.
+    - fscrypt: don't set policy for a dead directory
+    - udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
+    - media: stv0297: fix frequency range limit
+    - ALSA: usb-audio: Fix parse of UAC2 Extension Units
+    - ALSA: hda/realtek - Headphone Mic can't record after S3
+    - tpm: Actually fail on TPM errors during "get random"
+    - tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations
+    - block: fix .bi_size overflow
+    - block, bfq: NULL out the bic when it's no longer valid
+    - perf intel-pt: Fix itrace defaults for perf script
+    - perf auxtrace: Fix itrace defaults for perf script
+    - perf intel-pt: Fix itrace defaults for perf script intel-pt documentation
+    - perf pmu: Fix uncore PMU alias list for ARM64
+    - perf thread-stack: Fix thread stack return from kernel for kernel-only case
+    - perf header: Assign proper ff->ph in perf_event__synthesize_features()
+    - x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
+    - x86/tls: Fix possible spectre-v1 in do_get_thread_area()
+    - Documentation: Add section about CPU vulnerabilities for Spectre
+    - Documentation/admin: Remove the vsyscall=native documentation
+    - mwifiex: Don't abort on small, spec-compliant vendor IEs
+    - USB: serial: ftdi_sio: add ID for isodebug v1
+    - USB: serial: option: add support for GosunCn ME3630 RNDIS mode
+    - Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
+    - p54usb: Fix race between disconnect and firmware loading
+    - usb: gadget: f_fs: data_len used before properly set
+    - usb: gadget: ether: Fix race between gether_disconnect and rx_submit
+    - usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset()
+    - usb: renesas_usbhs: add a workaround for a race condition of workqueue
+    - drivers/usb/typec/tps6598x.c: fix portinfo width
+    - drivers/usb/typec/tps6598x.c: fix 4CC cmd write
+    - p54: fix crash during initialization
+    - staging: comedi: dt282x: fix a null pointer deref on interrupt
+    - staging: wilc1000: fix error path cleanup in wilc_wlan_initialize()
+    - staging: bcm2835-camera: Restore return behavior of ctrl_set_bitrate()
+    - staging: comedi: amplc_pci230: fix null pointer deref on interrupt
+    - staging: mt7621-pci: fix PCIE_FTS_NUM_LO macro
+    - HID: Add another Primax PIXART OEM mouse quirk
+    - lkdtm: support llvm-objcopy
+    - binder: fix memory leak in error path
+    - binder: return errors from buffer copy functions
+    - iio: adc: stm32-adc: add missing vdda-supply
+    - coresight: Potential uninitialized variable in probe()
+    - coresight: etb10: Do not call smp_processor_id from preemptible
+    - coresight: tmc-etr: Do not call smp_processor_id() from preemptible
+    - coresight: tmc-etr: alloc_perf_buf: Do not call smp_processor_id from
+      preemptible
+    - coresight: tmc-etf: Do not call smp_processor_id from preemptible
+    - carl9170: fix misuse of device driver API
+    - Revert "x86/build: Move _etext to actual end of .text"
+    - VMCI: Fix integer overflow in VMCI handle arrays
+    - staging: vchiq_2835_arm: revert "quit using custom down_interruptible()"
+    - staging: vchiq: make wait events interruptible
+    - staging: vchiq: revert "switch to wait_for_completion_killable"
+    - staging: fsl-dpaa2/ethsw: fix memory leak of switchdev_work
+    - staging: bcm2835-camera: Replace spinlock protecting context_map with mutex
+    - staging: bcm2835-camera: Ensure all buffers are returned on disable
+    - staging: bcm2835-camera: Remove check of the number of buffers supplied
+    - staging: bcm2835-camera: Handle empty EOS buffers whilst streaming
+    - staging: rtl8712: reduce stack usage, again
+    - Linux 5.2.1
+    - [Config] updateconfigs after v5.2.1 stable update
+
+  * fcf-protection=none patch with upstream version
+    - Revert "UBUNTU: SAUCE: add -fcf-protection=none to retpoline flags"
+    - SAUCE: kbuild: add -fcf-protection=none to retpoline flags
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/ftrace: avoid failure when trying to probe a notrace
+      function
+    - SAUCE: selftests/powerpc/ptrace: fix build failure
+    - update dkms package versions
+    - [Packaging] add zlua to zfs-modules.ignore
+    - update dkms package versions
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 19 Jul 2019 15:04:45 -0500
+
+linux (5.2.0-8.9) eoan; urgency=medium
+
+  * linux: 5.2.0-8.9 -proposed tracker (LP: #1835700)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] replace zfs and spl build with zfs 0.8.1-1ubuntu1
+    - SAUCE: test_bpf: remove expected fail for Ctx heavy transformations test on
+      s390
+    - SAUCE: add -fcf-protection=none to retpoline flags
+    - SAUCE: usbip: ensure strings copied using strncpy are null-terminated
+    - SAUCE: usbip: add -Wno-address-of-packed-member to EXTRA_CFLAGS
+    - SAUCE: perf jvmti: ensure strncpy result is null-terminated
+    - update dkms package versions
+    - add removed zfs modules to modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 08 Jul 2019 07:13:41 -0500
+
+linux (5.2.0-7.8) eoan; urgency=medium
+
+  * Kernel panic upon resetting ixgbe SR-IOV VFIO virtual function using 5.0
+    kernel (LP: #1829652)
+    - SAUCE: ixgbe: Avoid NULL pointer dereference with VF on non-IPsec hw
+
+  * Hi1620 driver updates from upstream 5.2 merge window (LP: #1830815)
+    - net: hns3: initialize CPU reverse mapping
+    - net: hns3: refine the flow director handle
+    - net: hns3: add aRFS support for PF
+    - net: hns3: fix for FEC configuration
+    - RDMA/hns: Remove unnecessary print message in aeq
+    - RDMA/hns: Update CQE specifications
+    - RDMA/hns: Move spin_lock_irqsave to the correct place
+    - RDMA/hns: Remove jiffies operation in disable interrupt context
+    - RDMA/hns: Replace magic numbers with #defines
+    - net: hns3: fix compile warning without CONFIG_RFS_ACCEL
+    - net: hns3: fix for HNS3_RXD_GRO_SIZE_M macro
+    - net: hns3: add support for dump firmware statistics by debugfs
+    - net: hns3: use HCLGE_STATE_NIC_REGISTERED to indicate PF NIC client has
+      registered
+    - net: hns3: use HCLGE_STATE_ROCE_REGISTERED to indicate PF ROCE client has
+      registered
+    - net: hns3: use HCLGEVF_STATE_NIC_REGISTERED to indicate VF NIC client has
+      registered
+    - net: hns3: modify hclge_init_client_instance()
+    - net: hns3: modify hclgevf_init_client_instance()
+    - net: hns3: add handshake with hardware while doing reset
+    - net: hns3: stop schedule reset service while unloading driver
+    - net: hns3: adjust hns3_uninit_phy()'s location in the hns3_client_uninit()
+    - net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector
+    - RDMA/hns: Bugfix for posting multiple srq work request
+    - net: hns3: remove redundant core reset
+    - net: hns3: don't configure new VLAN ID into VF VLAN table when it's full
+    - net: hns3: fix VLAN filter restore issue after reset
+    - net: hns3: set the port shaper according to MAC speed
+    - net: hns3: add a check to pointer in error_detected and slot_reset
+    - net: hns3: set ops to null when unregister ad_dev
+    - net: hns3: add handling of two bits in MAC tunnel interrupts
+    - net: hns3: remove setting bit of reset_requests when handling mac tunnel
+      interrupts
+    - net: hns3: add opcode about query and clear RAS & MSI-X to special opcode
+    - net: hns3: delay and separate enabling of NIC and ROCE HW errors
+    - RDMA/hns: fix inverted logic of readl read and shift
+    - RDMA/hns: Bugfix for filling the sge of srq
+    - net: hns3: log detail error info of ROCEE ECC and AXI errors
+    - net: hns3: fix wrong size of mailbox responding data
+    - net: hns3: make HW GRO handling compliant with SW GRO
+    - net: hns3: replace numa_node_id with numa_mem_id for buffer reusing
+    - net: hns3: refactor hns3_get_new_int_gl function
+    - net: hns3: trigger VF reset if a VF has an over_8bd_nfe_err
+    - net: hns3: delete the redundant user NIC codes
+    - net: hns3: small changes for magic numbers
+    - net: hns3: use macros instead of magic numbers
+    - net: hns3: refactor PF/VF RSS hash key configuration
+    - net: hns3: some modifications to simplify and optimize code
+    - net: hns3: fix some coding style issues
+    - net: hns3: delay setting of reset level for hw errors until slot_reset is
+      called
+    - net: hns3: fix avoid unnecessary resetting for the H/W errors which do not
+      require reset
+    - net: hns3: process H/W errors occurred before HNS dev initialization
+    - net: hns3: add recovery for the H/W errors occurred before the HNS dev
+      initialization
+    - net: hns3: some changes of MSI-X bits in PPU(RCB)
+    - net: hns3: extract handling of mpf/pf msi-x errors into functions
+    - net: hns3: clear restting state when initializing HW device
+    - net: hns3: free irq when exit from abnormal branch
+    - net: hns3: fix for dereferencing before null checking
+    - net: hns3: fix for skb leak when doing selftest
+    - net: hns3: delay ring buffer clearing during reset
+    - net: hns3: some variable modification
+    - net: hns3: fix dereference of ae_dev before it is null checked
+    - scsi: hisi_sas: Delete PHY timers when rmmod or probe failed
+    - scsi: hisi_sas: Fix the issue of argument mismatch of printing ecc errors
+    - scsi: hisi_sas: Reduce HISI_SAS_SGE_PAGE_CNT in size
+    - scsi: hisi_sas: Change the type of some numbers to unsigned
+    - scsi: hisi_sas: Ignore the error code between phy down to phy up
+    - scsi: hisi_sas: Disable stash for v3 hw
+    - net: hns3: Add missing newline at end of file
+    - RDMa/hns: Don't stuck in endless timeout loop
+
+  * Sometimes touchpad automatically trigger double click (LP: #1833484)
+    - SAUCE: i2c: designware: Add disable runtime pm quirk
+
+  * Add pointstick support on HP ZBook 17 G5 (LP: #1833387)
+    - Revert "HID: multitouch: Support ALPS PTP stick with pid 0x120A"
+
+  * depmod may prefer unsigned l-r-m nvidia modules to signed modules
+    (LP: #1834479)
+    - [Packaging] dkms-build--nvidia-N -- clean up unsigned ko files
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/powerpc: disable signal_fuzzer test
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 01 Jul 2019 07:22:18 -0500
+
+linux (5.2.0-6.7) eoan; urgency=medium
+
+  * hinic: fix oops due to race in set_rx_mode (LP: #1832048)
+    - hinic: fix a bug in set rx mode
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.2-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 23 Jun 2019 23:36:11 -0500
+
+linux (5.2.0-5.6) eoan; urgency=medium
+
+  * QCA9377 isn't being recognized sometimes (LP: #1757218)
+    - SAUCE: USB: Disable USB2 LPM at shutdown
+
+  * shiftfs: allow changing ro/rw for subvolumes (LP: #1832316)
+    - SAUCE: shiftfs: allow changing ro/rw for subvolumes
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Packaging] replace nvidia-418 dkms build with nvidia-430
+    - SAUCE: import aufs driver
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 17 Jun 2019 15:04:12 -0500
+
+linux (5.2.0-4.5) eoan; urgency=medium
+
+  * arm64: cma_alloc errors at boot (LP: #1823753)
+    - [Config] Bump CMA_SIZE_MBYTES to 32 on arm64
+    - dma-contiguous: add dma_{alloc,free}_contiguous() helpers
+    - dma-contiguous: use fallback alloc_pages for single pages
+    - dma-contiguous: fix !CONFIG_DMA_CMA version of dma_{alloc,
+      free}_contiguous()
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_MFD_TQMX86=n for s390x
+    - [Config] CONFIG_GPIO_AMD_FCH=n for s390x
+    - [Config] CONFIG_BACKLIGHT_CLASS_DEVICE=n on s390x
+    - [Config] CONFIG_LCD_CLASS_DEVICE=n for s390x
+    - [Config] CONFIG_DRM_ETNAVIV=m for armhf generic-lpae
+    - [Config] CONFIG_DRM_NOUVEAU_SVM=n
+    - [Config] CONFIG_HWMON=n for s390x
+    - [Config] CONFIG_NEW_LEDS=n for s390x
+    - [Config] CONFIG_MTD_NAND_OMAP2=y for armhf
+    - [Config] CONFIG_VOP_BUS=n for non-amd64 arches
+    - [Config] CONFIG_TI_CPSW_PHY_SEL=n
+    - [Config] CONFIG_INTERCONNECT=n for s390x
+    - [Config] CONFIG_SCSI_GDTH=n for s390x
+    - [Config] CONFIG_PACKING=n for s390x
+    - [Config] CONFIG_ARCH_MILBEAUT=y for armhf
+    - [Config] update annotations following config review
+    - update dkms package versions
+    - [Config] enable nvidia dkms build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 10 Jun 2019 07:00:11 -0500
+
+linux (5.2.0-3.4) eoan; urgency=medium
+
+  * [18.04/18.10] File libperf-jvmti.so is missing in linux-tools-common deb on
+    Ubuntu (LP: #1761379)
+    - [Packaging] Support building libperf-jvmti.so
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "bpf, selftest: test global data/bss/rodata sections"
+    - update dkms package versions
+    - [Config] enable zfs
+    - rebase to v5.2-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 02 Jun 2019 21:48:50 -0500
+
+linux (5.2.0-2.3) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: perf arm64: Fix mksyscalltbl when system kernel headers are ahead of
+      the kernel
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 May 2019 07:12:39 -0500
+
+linux (5.2.0-1.2) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_INTEGRITY_PLATFORM_KEYRING=y
+    - update dkms package versions
+    - [Config] enable vbox dkms build
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 May 2019 21:11:27 -0500
+
+linux (5.2.0-0.1) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import aufs driver
+    - [Packaging] disable ZFS
+    - [Packaging] disable nvidia
+    - [Packaging] dkms-build -- expand paths searched for make.log files
+    - add virtualbox-guest-dkms dkms package build
+    - enable vbox dkms build for amd64 and i386
+    - update dkms package versions
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and
+      KEXEC_SIG_FORCE
+    - SAUCE: (efi-lockdown) kexec_file: Restrict at runtime if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) lockdown: Print current->comm in restriction messages
+    - SAUCE: (efi-lockdown) kexec: Allow kexec_file() with appropriate IMA policy
+      when locked down
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) KEYS: Make use of platform keyring for module
+      signature verify
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) furter KEXEC_VERIFY_SIG -> KEXEC_SIG updates
+    - SAUCE: (efi-lockdown) arm64: add kernel config option to lock down when in
+      Secure Boot mode
+    - update dkms package versions
+    - [Config] disable vbox build
+    - SAUCE: s390: mark __cpacf_check_opcode() and cpacf_query_func() as
+      __always_inline
+    - SAUCE: IB/mlx5: use size_t instead of u64 when dividing
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 21 May 2019 11:18:43 -0500
+
+linux (5.2.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 21 May 2019 07:34:43 -0500
+
+linux (5.1.0-2.2) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+
+  * Eoan update: v5.1.2 upstream stable release (LP: #1829050)
+    - x86/msr-index: Cleanup bit defines
+    - x86/speculation: Consolidate CPU whitelists
+    - x86/speculation/mds: Add basic bug infrastructure for MDS
+    - x86/speculation/mds: Add BUG_MSBDS_ONLY
+    - x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
+    - x86/speculation/mds: Add mds_clear_cpu_buffers()
+    - x86/speculation/mds: Clear CPU buffers on exit to user
+    - x86/kvm/vmx: Add MDS protection when L1D Flush is not active
+    - x86/speculation/mds: Conditionally clear CPU buffers on idle entry
+    - x86/speculation/mds: Add mitigation control for MDS
+    - x86/speculation/mds: Add sysfs reporting for MDS
+    - x86/speculation/mds: Add mitigation mode VMWERV
+    - Documentation: Move L1TF to separate directory
+    - Documentation: Add MDS vulnerability documentation
+    - x86/speculation/mds: Add mds=full,nosmt cmdline option
+    - x86/speculation: Move arch_smt_update() call to after mitigation decisions
+    - x86/speculation/mds: Add SMT warning message
+    - x86/speculation/mds: Fix comment
+    - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
+    - cpu/speculation: Add 'mitigations=' cmdline option
+    - x86/speculation: Support 'mitigations=' cmdline option
+    - powerpc/speculation: Support 'mitigations=' cmdline option
+    - s390/speculation: Support 'mitigations=' cmdline option
+    - x86/speculation/mds: Add 'mitigations=' support for MDS
+    - x86/mds: Add MDSUM variant to the MDS documentation
+    - Documentation: Correct the possible MDS sysfs values
+    - x86/speculation/mds: Fix documentation typo
+    - Linux 5.1.2
+
+  * Eoan update: v5.1.1 upstream stable release (LP: #1829046)
+    - Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in hv_synic_cleanup()
+    - ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings
+    - staging: greybus: power_supply: fix prop-descriptor request size
+    - staging: wilc1000: Avoid GFP_KERNEL allocation from atomic context.
+    - staging: most: cdev: fix chrdev_region leak in mod_exit
+    - staging: most: sound: pass correct device when creating a sound card
+    - usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON
+    - usb: dwc3: Fix default lpm_nyet_threshold value
+    - USB: serial: f81232: fix interrupt worker not stop
+    - USB: cdc-acm: fix unthrottle races
+    - usb-storage: Set virt_boundary_mask to avoid SG overflows
+    - genirq: Prevent use-after-free and work list corruption
+    - intel_th: pci: Add Comet Lake support
+    - iio: adc: qcom-spmi-adc5: Fix of-based module autoloading
+    - cpufreq: armada-37xx: fix frequency calculation for opp
+    - ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for
+      hibernate
+    - soc: sunxi: Fix missing dependency on REGMAP_MMIO
+    - scsi: lpfc: change snprintf to scnprintf for possible overflow
+    - scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines
+    - scsi: qla2xxx: Set remote port devloss timeout to 0
+    - scsi: qla2xxx: Fix device staying in blocked state
+    - Bluetooth: hidp: fix buffer overflow
+    - Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
+    - Bluetooth: Fix not initializing L2CAP tx_credits
+    - Bluetooth: hci_bcm: Fix empty regulator supplies for Intel Macs
+    - UAS: fix alignment of scatter/gather segments
+    - ASoC: Intel: avoid Oops if DMA setup fails
+    - i3c: Fix a shift wrap bug in i3c_bus_set_addr_slot_status()
+    - locking/futex: Allow low-level atomic operations to return -EAGAIN
+    - arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP
+    - Linux 5.1.1
+
+  * shiftfs: lock security sensitive superblock flags (LP: #1827122)
+    - SAUCE: shiftfs: lock down certain superblock flags
+
+  * Please package libbpf (which is done out of the kernel src) in Debian [for
+    19.10] (LP: #1826410)
+    - SAUCE: tools -- fix add ability to disable libbfd
+
+  * ratelimit cma_alloc messages (LP: #1828092)
+    - SAUCE: cma: ratelimit cma_alloc error messages
+
+  * Headphone jack switch sense is inverted: plugging in headphones disables
+    headphone output (LP: #1824259)
+    - ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board
+
+  * There are 4 HDMI/Displayport audio output listed in sound setting without
+    attach any HDMI/DP monitor (LP: #1827967)
+    - ALSA: hda/hdmi - Read the pin sense from register when repolling
+    - ALSA: hda/hdmi - Consider eld_valid when reporting jack event
+
+  * CONFIG_LOG_BUF_SHIFT set to 14 is too low on arm64 (LP: #1824864)
+    - [Config] CONFIG_LOG_BUF_SHIFT=18 on all 64bit arches
+
+  * CTAUTO:DevOps:860.50:devops4fp1:Error occurred during LINUX Dmesg error
+    Checking for all LINUX clients for devops4p10 (LP: #1766201)
+    - SAUCE: integrity: downgrade error to warning
+
+  * linux-buildinfo: pull out ABI information into its own package
+    (LP: #1806380)
+    - [Packaging] autoreconstruct -- base tag is always primary mainline version
+
+  * [SRU] Please sync vbox modules from virtualbox 6.0.6 on next kernel update
+    (LP: #1825210)
+    - vbox-update: updates for renamed makefiles
+    - ubuntu: vbox -- update to 6.0.6-dfsg-1
+
+  * autofs kernel module missing (LP: #1824333)
+    - [Config] Update autofs4 path in inclusion list
+
+  * The Realtek card reader does not enter PCIe 1.1/1.2 (LP: #1825487)
+    - SAUCE: misc: rtsx: Fixed rts5260 power saving parameter and sd glitch
+
+  * CVE-2019-3874
+    - sctp: implement memory accounting on tx path
+    - sctp: implement memory accounting on rx path
+
+  * apparmor does not start in Disco LXD containers (LP: #1824812)
+    - SAUCE: shiftfs: use separate llseek method for directories
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] autoreconstruct -- remove for -rc kernels
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) furter KEXEC_VERIFY_SIG -> KEXEC_SIG updates
+    - [Config] (efi-lockdown): update configs after efi lockdown patch refresh
+    - [Packaging] don't delete efi_parser.c
+    - vbox-update -- do not fix up KERN_DIR or KBUILD_EXTMOD
+    - ubuntu: vbox -- update to 6.0.6-dfsg-2
+    - add nvidia-418 dkms build
+    - remove virtualbox guest drivers
+    - [Packaging] dkms-build -- expand paths searched for make.log files
+    - add virtualbox-guest-dkms dkms package build
+    - enable vbox dkms build for amd64 and i386
+    - [Config] update configs for v5.1(-rc7)? rebase
+    - update dkms package versions
+    - Add the ability to lock down access to the running kernel image
+    - Enforce module signatures if the kernel is locked down
+    - Restrict /dev/{mem,kmem,port} when the kernel is locked down
+    - kexec_load: Disable at runtime if the kernel is locked down
+    - Copy secure_boot flag in boot params across kexec reboot
+    - kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE
+    - kexec_file: Restrict at runtime if the kernel is locked down
+    - hibernate: Disable when the kernel is locked down
+    - uswsusp: Disable when the kernel is locked down
+    - PCI: Lock down BAR access when the kernel is locked down
+    - x86: Lock down IO port access when the kernel is locked down
+    - x86/msr: Restrict MSR access when the kernel is locked down
+    - ACPI: Limit access to custom_method when the kernel is locked down
+    - acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down
+    - acpi: Disable ACPI table override if the kernel is locked down
+    - acpi: Disable APEI error injection if the kernel is locked down
+    - Prohibit PCMCIA CIS storage when the kernel is locked down
+    - Lock down TIOCSSERIAL
+    - Lock down module params that specify hardware parameters (eg. ioport)
+    - x86/mmiotrace: Lock down the testmmiotrace module
+    - Lock down /proc/kcore
+    - Lock down kprobes
+    - bpf: Restrict kernel image access functions when the kernel is locked down
+    - Lock down perf
+    - debugfs: Restrict debugfs when the kernel is locked down
+    - lockdown: Print current->comm in restriction messages
+    - kexec: Allow kexec_file() with appropriate IMA policy when locked down
+    - Make get_cert_list() not complain about cert lists that aren't present.
+    - Add efi_status_to_str() and rework efi_status_to_err().
+    - Make get_cert_list() use efi_status_to_str() to print error messages.
+    - efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
+    - efi: Lock down the kernel if booted in secure boot mode
+    - KEYS: Make use of platform keyring for module signature verify
+
+  * Miscellaneous upstream changes
+    - ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14)
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 14 May 2019 12:32:56 -0500
+
+linux (5.1.0-1.1) eoan; urgency=medium
+
+  * bionic: fork out linux-snapdragon into its own topic kernel (LP: #1820868)
+    - [Packaging]: really drop snapdragon
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: fix vbox use of MAP_SHARED
+    - SAUCE: fix vbox use of vm_fault_t
+    - [Packaging] disable ZFS
+    - [Packaging] disable nvidia
+    - SAUCE: perf annotate: Fix build on 32 bit for BPF annotation
+    - [Config]: updateconfig after rebase to v5.1-rc
+    - [Config]: build ETNAVIV only on arm platforms
+    - [Config]: Disable CMA on non-arm platforms
+    - [Config]: MMC_CQHCI is needed by some built-in drivers
+    - [Config]: a.out support has been deprecated
+    - [Config]: R3964 was marked as BROKEN
+    - [Config]: Add SENSIRION_SGP30 module
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: tools: lib/bpf -- add generated headers to search
+      path"
+    - Revert "UBUNTU: SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK"
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 25 Apr 2019 10:03:25 -0300
+
+linux (5.1.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 25 Apr 2019 09:49:47 -0300
+
+linux (5.0.0-13.14) disco; urgency=medium
+
+  * linux: 5.0.0-13.14 -proposed tracker (LP: #1824819)
+
+  * Display only has 640x480 (LP: #1824677)
+    - Revert "UBUNTU: SAUCE: drm/nouveau: Disable nouveau driver by default"
+
+  * shiftfs: use after free when checking mount options (LP: #1824735)
+    - SAUCE: shiftfs: prevent use-after-free when verifying mount options
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 15 Apr 2019 09:11:23 -0500
+
+linux (5.0.0-12.13) disco; urgency=medium
+
+  * linux: 5.0.0-12.13 -proposed tracker (LP: #1824726)
+
+  * Linux 5.0 black screen on boot, display flickers (i915 regression with
+    certain laptop panels) (LP: #1824216)
+    - drm/i915/dp: revert back to max link rate and lane count on eDP
+
+  * kernel BUG at fs/attr.c:287 when using shiftfs (LP: #1824717)
+    - SAUCE: shiftfs: fix passing of attrs to underaly for setattr
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 14 Apr 2019 13:38:05 -0500
+
+linux (5.0.0-11.12) disco; urgency=medium
+
+  * linux: 5.0.0-11.12 -proposed tracker (LP: #1824383)
+
+  * hns3: PPU_PF_ABNORMAL_INT_ST over_8bd_no_fe found [error status=0x1]
+    (LP: #1824194)
+    - net: hns3: fix for not calculating tx bd num correctly
+
+  * disco: unable to use iptables/enable ufw under -virtual kernel
+    (LP: #1823862)
+    - [Packaging] add bpfilter to linux-modules
+
+  * Make shiftfs a module rather than built-in (LP: #1824354)
+    - [Config] CONFIG_SHIFT_FS=m
+
+  * shiftfs: chown sets untranslated ids in lower fs (LP: #1824350)
+    - SAUCE: shiftfs: use translated ids when chaning lower fs attrs
+
+  * [Hyper-V] KVP daemon fails to start on first boot of disco VM (LP: #1820063)
+    - [Packaging] bind hv_kvp_daemon startup to hv_kvp device
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 11 Apr 2019 10:17:19 -0500
+
+linux (5.0.0-10.11) disco; urgency=medium
+
+  * linux: 5.0.0-10.11 -proposed tracker (LP: #1823936)
+
+  * Apparmor enforcement failure in lxc selftests (LP: #1823379)
+    - SAUCE: apparmor: Restore Y/N in /sys for apparmor's "enabled"
+
+  * systemd cause kernel trace "BUG: unable to handle kernel paging request at
+    6db23a14" on Cosmic i386 (LP: #1813244)
+    - openvswitch: fix flow actions reallocation
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 09 Apr 2019 08:30:38 -0500
+
+linux (5.0.0-9.10) disco; urgency=medium
+
+  * linux: 5.0.0-9.10 -proposed tracker (LP: #1823228)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] update helper scripts
+    - [Packaging] resync retpoline extraction
+
+  * Huawei Hi1822 NIC has poor performance (LP: #1820187)
+    - net-next/hinic: replace disable_irq_nosync/enable_irq
+
+  * Add uid shifting overlay filesystem (shiftfs) (LP: #1823186)
+    - shiftfs: uid/gid shifting bind mount
+    - shiftfs: rework and extend
+    - shiftfs: support some btrfs ioctls
+    - [Config] enable shiftfs
+
+  * Cannot boot or install - have to use nomodeset (LP: #1821820)
+    - Revert "drm/i915/fbdev: Actually configure untiled displays"
+
+  * Disco update: v5.0.6 upstream stable release (LP: #1823060)
+    - netfilter: nf_tables: fix set double-free in abort path
+    - dccp: do not use ipv6 header for ipv4 flow
+    - genetlink: Fix a memory leak on error path
+    - gtp: change NET_UDP_TUNNEL dependency to select
+    - ipv6: make ip6_create_rt_rcu return ip6_null_entry instead of NULL
+    - mac8390: Fix mmio access size probe
+    - mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
+    - net: aquantia: fix rx checksum offload for UDP/TCP over IPv6
+    - net: datagram: fix unbounded loop in __skb_try_recv_datagram()
+    - net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec
+    - net: phy: meson-gxl: fix interrupt support
+    - net: rose: fix a possible stack overflow
+    - net: stmmac: fix memory corruption with large MTUs
+    - net-sysfs: call dev_hold if kobject_init_and_add success
+    - net: usb: aqc111: Extend HWID table by QNAP device
+    - packets: Always register packet sk in the same order
+    - rhashtable: Still do rehash when we get EEXIST
+    - sctp: get sctphdr by offset in sctp_compute_cksum
+    - sctp: use memdup_user instead of vmemdup_user
+    - tcp: do not use ipv6 header for ipv4 flow
+    - tipc: allow service ranges to be connect()'ed on RDM/DGRAM
+    - tipc: change to check tipc_own_id to return in tipc_net_stop
+    - tipc: fix cancellation of topology subscriptions
+    - tun: properly test for IFF_UP
+    - vrf: prevent adding upper devices
+    - vxlan: Don't call gro_cells_destroy() before device is unregistered
+    - thunderx: enable page recycling for non-XDP case
+    - thunderx: eliminate extra calls to put_page() for pages held for recycling
+    - net: dsa: mv88e6xxx: fix few issues in mv88e6390x_port_set_cmode
+    - net: mii: Fix PAUSE cap advertisement from linkmode_adv_to_lcl_adv_t()
+      helper
+    - net: phy: don't clear BMCR in genphy_soft_reset
+    - r8169: fix cable re-plugging issue
+    - ila: Fix rhashtable walker list corruption
+    - tun: add a missing rcu_read_unlock() in error path
+    - powerpc/fsl: Fix the flush of branch predictor.
+    - Btrfs: fix incorrect file size after shrinking truncate and fsync
+    - btrfs: remove WARN_ON in log_dir_items
+    - btrfs: don't report readahead errors and don't update statistics
+    - btrfs: Fix bound checking in qgroup_trace_new_subtree_blocks
+    - btrfs: Avoid possible qgroup_rsv_size overflow in
+      btrfs_calculate_inode_block_rsv_size
+    - Btrfs: fix assertion failure on fsync with NO_HOLES enabled
+    - locks: wake any locks blocked on request before deadlock check
+    - tracing: initialize variable in create_dyn_event()
+    - ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time
+    - powerpc: bpf: Fix generation of load/store DW instructions
+    - vfio: ccw: only free cp on final interrupt
+    - NFS: Fix nfs4_lock_state refcounting in nfs4_alloc_{lock,unlock}data()
+    - NFS: fix mount/umount race in nlmclnt.
+    - NFSv4.1 don't free interrupted slot on open
+    - net: dsa: qca8k: remove leftover phy accessors
+    - ALSA: rawmidi: Fix potential Spectre v1 vulnerability
+    - ALSA: seq: oss: Fix Spectre v1 vulnerability
+    - ALSA: pcm: Fix possible OOB access in PCM oss plugins
+    - ALSA: pcm: Don't suspend stream in unrecoverable PCM state
+    - ALSA: hda/realtek - Fixed Headset Mic JD not stable
+    - ALSA: hda/realtek: merge alc_fixup_headset_jack to alc295_fixup_chromebook
+    - ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO
+    - ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB
+    - ALSA: hda/realtek: Enable headset MIC of Acer AIO with ALC286
+    - ALSA: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286
+    - ALSA: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic
+    - ALSA: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256
+    - ALSA: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256
+    - ALSA: hda/realtek: Enable headset MIC of ASUS X430UN and X512DK with ALC256
+    - ALSA: hda/realtek - Fix speakers on Acer Predator Helios 500 Ryzen laptops
+    - kbuild: modversions: Fix relative CRC byte order interpretation
+    - fs/open.c: allow opening only regular files during execve()
+    - ocfs2: fix inode bh swapping mixup in ocfs2_reflink_inodes_lock
+    - scsi: sd: Fix a race between closing an sd device and sd I/O
+    - scsi: sd: Quiesce warning if device does not report optimal I/O size
+    - scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host
+    - scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP
+      devices
+    - drm/rockchip: vop: reset scale mode when win is disabled
+    - tty/serial: atmel: Add is_half_duplex helper
+    - tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
+    - tty: mxs-auart: fix a potential NULL pointer dereference
+    - tty: atmel_serial: fix a potential NULL pointer dereference
+    - tty: serial: qcom_geni_serial: Initialize baud in qcom_geni_console_setup
+    - staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest
+    - staging: olpc_dcon_xo_1: add missing 'const' qualifier
+    - staging: speakup_soft: Fix alternate speech with other synths
+    - staging: vt6655: Remove vif check from vnt_interrupt
+    - staging: vt6655: Fix interrupt race condition on device start up.
+    - staging: erofs: fix to handle error path of erofs_vmap()
+    - staging: erofs: fix error handling when failed to read compresssed data
+    - staging: erofs: keep corrupted fs from crashing kernel in erofs_readdir()
+    - serial: max310x: Fix to avoid potential NULL pointer dereference
+    - serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference
+    - serial: sh-sci: Fix setting SCSCR_TIE while transferring data
+    - USB: serial: cp210x: add new device id
+    - USB: serial: ftdi_sio: add additional NovaTech products
+    - USB: serial: mos7720: fix mos_parport refcount imbalance on error path
+    - USB: serial: option: set driver_info for SIM5218 and compatibles
+    - USB: serial: option: add support for Quectel EM12
+    - USB: serial: option: add Olicard 600
+    - ACPI / CPPC: Fix guaranteed performance handling
+    - Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc
+    - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
+    - drivers/block/zram/zram_drv.c: fix idle/writeback string compare
+    - blk-mq: fix sbitmap ws_active for shared tags
+    - cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency
+    - cpufreq: scpi: Fix use after free
+    - drm/vgem: fix use-after-free when drm_gem_handle_create() fails
+    - drm/vkms: fix use-after-free when drm_gem_handle_create() fails
+    - drm/i915: Mark AML 0x87CA as ULX
+    - drm/i915/gvt: Fix MI_FLUSH_DW parsing with correct index check
+    - drm/i915/icl: Fix the TRANS_DDI_FUNC_CTL2 bitfield macro
+    - gpio: exar: add a check for the return value of ida_simple_get fails
+    - gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
+    - phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs
+    - usb: mtu3: fix EXTCON dependency
+    - USB: gadget: f_hid: fix deadlock in f_hidg_write()
+    - usb: common: Consider only available nodes for dr_mode
+    - mm/memory.c: fix modifying of page protection by insert_pfn()
+    - usb: host: xhci-rcar: Add XHCI_TRUST_TX_LENGTH quirk
+    - xhci: Fix port resume done detection for SS ports with LPM enabled
+    - usb: xhci: dbc: Don't free all memory with spinlock held
+    - xhci: Don't let USB3 ports stuck in polling state prevent suspend
+    - usb: cdc-acm: fix race during wakeup blocking TX traffic
+    - usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 source-caps
+    - usb: typec: Fix unchecked return value
+    - mm/hotplug: fix offline undo_isolate_page_range()
+    - mm: add support for kmem caches in DMA32 zone
+    - iommu/io-pgtable-arm-v7s: request DMA32 memory, and improve debugging
+    - mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
+    - mm/debug.c: fix __dump_page when mapping->host is not set
+    - mm/memory_hotplug.c: fix notification in offline error path
+    - mm/page_isolation.c: fix a wrong flag in set_migratetype_isolate()
+    - mm/migrate.c: add missing flush_dcache_page for non-mapped page migrate
+    - perf pmu: Fix parser error for uncore event alias
+    - perf intel-pt: Fix TSC slip
+    - objtool: Query pkg-config for libelf location
+    - powerpc/pseries/energy: Use OF accessor functions to read ibm,drc-indexes
+    - powerpc/64: Fix memcmp reading past the end of src/dest
+    - powerpc/pseries/mce: Fix misleading print for TLB mutlihit
+    - watchdog: Respect watchdog cpumask on CPU hotplug
+    - cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n
+    - x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y
+    - KVM: Reject device ioctls from processes other than the VM's creator
+    - KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts
+    - KVM: x86: update %rip after emulating IO
+    - bpf: do not restore dst_reg when cur_state is freed
+    - mt76x02u: use usb_bulk_msg to upload firmware
+    - Linux 5.0.6
+
+  * RDMA/hns updates for disco (LP: #1822897)
+    - RDMA/hns: Fix the bug with updating rq head pointer when flush cqe
+    - RDMA/hns: Bugfix for the scene without receiver queue
+    - RDMA/hns: Add constraint on the setting of local ACK timeout
+    - RDMA/hns: Modify the pbl ba page size for hip08
+    - RDMA/hns: RDMA/hns: Assign rq head pointer when enable rq record db
+    - RDMA/hns: Add the process of AEQ overflow for hip08
+    - RDMA/hns: Add SCC context allocation support for hip08
+    - RDMA/hns: Add SCC context clr support for hip08
+    - RDMA/hns: Add timer allocation support for hip08
+    - RDMA/hns: Remove set but not used variable 'rst'
+    - RDMA/hns: Make some function static
+    - RDMA/hns: Fix the Oops during rmmod or insmod ko when reset occurs
+    - RDMA/hns: Fix the chip hanging caused by sending mailbox&CMQ during reset
+    - RDMA/hns: Fix the chip hanging caused by sending doorbell during reset
+    - RDMA/hns: Limit minimum ROCE CQ depth to 64
+    - RDMA/hns: Fix the state of rereg mr
+    - RDMA/hns: Set allocated memory to zero for wrid
+    - RDMA/hns: Delete useful prints for aeq subtype event
+    - RDMA/hns: Configure capacity of hns device
+    - RDMA/hns: Modify qp&cq&pd specification according to UM
+    - RDMA/hns: Bugfix for set hem of SCC
+    - RDMA/hns: Use GFP_ATOMIC in hns_roce_v2_modify_qp
+
+  * autopkgtests run too often, too much and don't skip enough (LP: #1823056)
+    - Set +x on rebuild testcase.
+    - Skip rebuild test, for regression-suite deps.
+    - Make ubuntu-regression-suite skippable on unbootable kernels.
+    - make rebuild use skippable error codes when skipping.
+    - Only run regression-suite, if requested to.
+
+  * touchpad not working on lenovo yoga 530 (LP: #1787775)
+    - Revert "UBUNTU: SAUCE: i2c:amd Depends on ACPI"
+    - Revert "UBUNTU: SAUCE: i2c:amd move out pointer in union i2c_event_base"
+    - i2c: add extra check to safe DMA buffer helper
+    - i2c: Add drivers for the AMD PCIe MP2 I2C controller
+    - [Config] Update config for AMD MP2 I2C driver
+
+  * Detect SMP PHY control command errors (LP: #1822680)
+    - scsi: libsas: Check SMP PHY control function result
+
+  * disable a.out support (LP: #1818552)
+    - [Config] Disable a.out support
+    - [Config] remove binfmt_aout from abi for i386 lowlatency
+
+  * bionic: fork out linux-snapdragon into its own topic kernel (LP: #1820868)
+    - [Packaging] remove snapdragon flavour support
+    - Revert "UBUNTU: SAUCE: (snapdragon) drm/msm/adv7511: wrap hacks under
+      CONFIG_ADV7511_SNAPDRAGON_HACKS #ifdefs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) media: ov5645: skip address change if dt
+      addr == default addr"
+    - Revert "UBUNTU: SAUCE: (snapdragon) DT: leds: Add Qualcomm Light Pulse
+      Generator binding"
+    - Revert "UBUNTU: SAUCE: (snapdragon) MAINTAINERS: Add Qualcomm Camera Control
+      Interface driver"
+    - Revert "UBUNTU: SAUCE: (snapdragon) dt-bindings: media: Binding document for
+      Qualcomm Camera Control Interface driver"
+    - Revert "UBUNTU: SAUCE: (snapdragon) leds: Add driver for Qualcomm LPG"
+    - Revert "UBUNTU: SAUCE: (snapdragon) HACK: drm/msm/adv7511: Don't rely on
+      interrupts for EDID parsing"
+    - Revert "UBUNTU: SAUCE: (snapdragon) drm/bridge/adv7511: Delay clearing of
+      HPD interrupt status"
+    - Revert "UBUNTU: SAUCE: (snapdragon) media: ov5645: Fix I2C address"
+    - Revert "UBUNTU: SAUCE: (snapdragon) i2c-qcom-cci: Fix I2C address bug"
+    - Revert "UBUNTU: SAUCE: (snapdragon) i2c-qcom-cci: Fix run queue completion
+      timeout"
+    - Revert "UBUNTU: SAUCE: (snapdragon) camss: Do not register if no cameras are
+      present"
+    - Revert "UBUNTU: SAUCE: (snapdragon) i2c: Add Qualcomm Camera Control
+      Interface driver"
+    - Revert "UBUNTU: SAUCE: (snapdragon) ov5645: I2C address change"
+    - Revert "UBUNTU: SAUCE: (snapdragon) regulator: smd: Allow
+      REGULATOR_QCOM_SMD_RPM=m"
+    - Revert "UBUNTU: SAUCE: (snapdragon) cpufreq: Add apq8016 to cpufreq-dt-
+      platdev blacklist"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: Add a helper to get an opp
+      regulator for device"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: HACK: Allow to set regulator
+      without opp_list"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: Drop RCU usage in
+      dev_pm_opp_adjust_voltage()"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: Support adjusting OPP voltages
+      at runtime"
+    - Revert "UBUNTU: SAUCE: (snapdragon) regulator: smd: Add floor and corner
+      operations"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: cpr: Register with cpufreq-
+      dt"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: cpr: fix with new
+      reg_sequence structures"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: cpr: Use raw mem access for
+      qfprom"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: Add support for CPR (Core
+      Power Reduction)"
+    - Revert "UBUNTU: SAUCE: (snapdragon) HACK: drm/msm/iommu: Remove runtime_put
+      calls in map/unmap"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable LEDS_QCOM_LPG"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable 'BBR' TCP
+      congestion algorithm"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable 'fq' and
+      'fq_codel' qdiscs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable
+      'schedutil' CPUfreq governor"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: set USB_CONFIG_F_FS in
+      distro.config"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable
+      CONFIG_USB_CONFIGFS_F_FS by default"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: add freq stat to sysfs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: Enable camera drivers"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: disable ANALOG_TV and
+      DIGITAL_TV"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: add more USB net
+      drivers"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: enable BT_QCOMSMD"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable
+      CFG80211_DEFAULT_PS by default"
+    - Revert "UBUNTU: SAUCE: (snapdragon) Force the SMD regulator driver to be
+      compiled-in"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: enable dm_mod and
+      dm_crypt"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: Enable a53/apcs and
+      avs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: enable QCOM Venus"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable debug
+      friendly USB network adpater"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: enable WCN36xx"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs; add distro.config"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable QCOM audio
+      drivers for APQ8016 and DB410c"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable REMOTEPROC"
+    - [Config] fix abi for remove i2c-qcom-cci module
+    - [Config] update annotations
+    - [Config] update configs following snapdragon removal
+
+  * Disco update: v5.0.5 upstream stable release (LP: #1822671)
+    - Revert "ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec"
+    - ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist
+    - ALSA: firewire-motu: use 'version' field of unit directory to identify model
+    - mmc: pxamci: fix enum type confusion
+    - mmc: alcor: fix DMA reads
+    - mmc: mxcmmc: "Revert mmc: mxcmmc: handle highmem pages"
+    - mmc: renesas_sdhi: limit block count to 16 bit for old revisions
+    - drm/amdgpu: fix invalid use of change_bit
+    - drm/vmwgfx: Don't double-free the mode stored in par->set_mode
+    - drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's
+    - iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
+    - iommu/iova: Fix tracking of recently failed iova address
+    - libceph: wait for latest osdmap in ceph_monc_blacklist_add()
+    - udf: Fix crash on IO error during truncate
+    - mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction.
+    - MIPS: Ensure ELF appended dtb is relocated
+    - MIPS: Fix kernel crash for R6 in jump label branch function
+    - powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038
+    - powerpc/security: Fix spectre_v2 reporting
+    - net/mlx5: Fix DCT creation bad flow
+    - scsi: core: Avoid that a kernel warning appears during system resume
+    - scsi: qla2xxx: Fix FC-AL connection target discovery
+    - scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton
+    - scsi: ibmvscsi: Fix empty event pool access during host removal
+    - futex: Ensure that futex address is aligned in handle_futex_death()
+    - perf probe: Fix getting the kernel map
+    - objtool: Move objtool_file struct off the stack
+    - irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp
+    - clocksource/drivers/riscv: Fix clocksource mask
+    - ALSA: ac97: Fix of-node refcount unbalance
+    - ext4: fix NULL pointer dereference while journal is aborted
+    - ext4: fix data corruption caused by unaligned direct AIO
+    - ext4: brelse all indirect buffer in ext4_ind_remove_space()
+    - media: v4l2-ctrls.c/uvc: zero v4l2_event
+    - Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf()
+    - Bluetooth: Fix decrementing reference count twice in releasing socket
+    - Bluetooth: hci_ldisc: Initialize hci_dev before open()
+    - Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in
+      hci_uart_set_proto()
+    - drm/vkms: Fix flush_work() without INIT_WORK().
+    - RDMA/cma: Rollback source IP address if failing to acquire device
+    - f2fs: fix to avoid deadlock of atomic file operations
+    - aio: simplify - and fix - fget/fput for io_submit()
+    - netfilter: ebtables: remove BUGPRINT messages
+    - loop: access lo_backing_file only when the loop device is Lo_bound
+    - x86/unwind: Handle NULL pointer calls better in frame unwinder
+    - x86/unwind: Add hardcoded ORC entry for NULL
+    - locking/lockdep: Add debug_locks check in __lock_downgrade()
+    - ALSA: hda - Record the current power state before suspend/resume calls
+    - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec
+    - Linux 5.0.5
+
+  * hisi_sas updates for disco (LP: #1822385)
+    - scsi: hisi_sas: send primitive NOTIFY to SSP situation only
+    - scsi: hisi_sas: shutdown axi bus to avoid exception CQ returned
+    - scsi: hisi_sas: remove the check of sas_dev status in
+      hisi_sas_I_T_nexus_reset()
+    - scsi: hisi_sas: Remove unused parameter of function hisi_sas_alloc()
+    - scsi: hisi_sas: Reject setting programmed minimum linkrate > 1.5G
+    - scsi: hisi_sas: Fix losing directly attached disk when hot-plug
+    - scsi: hisi_sas: Correct memory allocation size for DQ debugfs
+    - scsi: hisi_sas: Some misc tidy-up
+    - scsi: hisi_sas: Fix to only call scsi_get_prot_op() for non-NULL scsi_cmnd
+    - scsi: hisi_sas: Add missing seq_printf() call in hisi_sas_show_row_32()
+    - scsi: hisi_sas: Add support for DIX feature for v3 hw
+    - scsi: hisi_sas: Add manual trigger for debugfs dump
+    - scsi: hisi_sas: change queue depth from 512 to 4096
+    - scsi: hisi_sas: Issue internal abort on all relevant queues
+    - scsi: hisi_sas: Use pci_irq_get_affinity() for v3 hw as experimental
+    - scsi: hisi_sas: Do some more tidy-up
+    - scsi: hisi_sas: Change return variable type in phy_up_v3_hw()
+    - scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO
+    - scsi: hisi_sas: print PHY RX errors count for later revision of v3 hw
+    - scsi: hisi_sas: Set PHY linkrate when disconnected
+    - scsi: hisi_sas: Send HARD RESET to clear the previous affiliation of STP
+      target port
+    - scsi: hisi_sas: Change SERDES_CFG init value to increase reliability of
+      HiLink
+    - scsi: hisi_sas: Add softreset in hisi_sas_I_T_nexus_reset()
+
+  * [Patch][Raven 2] kernel 5.0.0 cannot boot because of psp response
+    (LP: #1822267)
+    - drm/amdgpu/psp: Fix can't detect psp INVOKE command failed
+    - drm/amdgpu/psp: ignore psp response status
+
+  * 3b080b2564287be91605bfd1d5ee985696e61d3c in ubuntu_btrfs_kernel_fixes
+    triggers system hang on i386 (LP: #1812845)
+    - btrfs: raid56: properly unmap parity page in finish_parity_scrub()
+
+  * enable CONFIG_DRM_BOCHS (LP: #1795857)
+    - [Config] Reenable DRM_BOCHS as module
+
+  * [Dell Precision 7530/5530 with Nvidia Quadro P1000] Live USB freezes or
+    cannot complete install when nouveau driver is loaded (crashing in GP100
+    code) (LP: #1822026)
+    - SAUCE: drm/nouveau: Disable nouveau driver by default
+
+  * Need to add Intel CML related pci-id's (LP: #1821863)
+    - drm/i915/cml: Add CML PCI IDS
+    - drm/i915/cml: Introduce Comet Lake PCH
+
+  * ARM: Add support for the SDEI interface (LP: #1822005)
+    - ACPI / APEI: Don't wait to serialise with oops messages when panic()ing
+    - ACPI / APEI: Remove silent flag from ghes_read_estatus()
+    - ACPI / APEI: Switch estatus pool to use vmalloc memory
+    - ACPI / APEI: Make hest.c manage the estatus memory pool
+    - ACPI / APEI: Make estatus pool allocation a static size
+    - ACPI / APEI: Don't store CPER records physical address in struct ghes
+    - ACPI / APEI: Remove spurious GHES_TO_CLEAR check
+    - ACPI / APEI: Don't update struct ghes' flags in read/clear estatus
+    - ACPI / APEI: Generalise the estatus queue's notify code
+    - ACPI / APEI: Don't allow ghes_ack_error() to mask earlier errors
+    - ACPI / APEI: Move NOTIFY_SEA between the estatus-queue and NOTIFY_NMI
+    - ACPI / APEI: Switch NOTIFY_SEA to use the estatus queue
+    - KVM: arm/arm64: Add kvm_ras.h to collect kvm specific RAS plumbing
+    - arm64: KVM/mm: Move SEA handling behind a single 'claim' interface
+    - ACPI / APEI: Move locking to the notification helper
+    - ACPI / APEI: Let the notification helper specify the fixmap slot
+    - ACPI / APEI: Pass ghes and estatus separately to avoid a later copy
+    - ACPI / APEI: Make GHES estatus header validation more user friendly
+    - ACPI / APEI: Split ghes_read_estatus() to allow a peek at the CPER length
+    - ACPI / APEI: Only use queued estatus entry during in_nmi_queue_one_entry()
+    - ACPI / APEI: Use separate fixmap pages for arm64 NMI-like notifications
+    - firmware: arm_sdei: Add ACPI GHES registration helper
+    - ACPI / APEI: Add support for the SDEI GHES Notification type
+
+  * CVE-2019-9857
+    - inotify: Fix fsnotify_mark refcount leak in inotify_update_existing_watch()
+
+  * scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+    discovery (LP: #1821408)
+    - scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+      discovery
+
+  * Qualcomm Atheros QCA9377 wireless does not work (LP: #1818204)
+    - platform/x86: ideapad-laptop: Add Ideapad 530S-14ARR to no_hw_rfkill list
+
+  * Lenovo ideapad 330-15ICH Wifi rfkill hard blocked (LP: #1811815)
+    - platform/x86: ideapad: Add ideapad 330-15ICH to no_hw_rfkill
+
+  * hid-sensor-hub spamming dmesg in 4.20 (LP: #1818547)
+    - HID: Increase maximum report size allowed by hid_field_extract()
+
+  * [disco] [5.0.0-7.8] can't mount guest cifs share (LP: #1821053)
+    - cifs: allow guest mounts to work for smb3.11
+    - SMB3: Fix SMB3.1.1 guest mounts to Samba
+
+  * Add HiSilicon SoC quirk for cpufreq (LP: #1821620)
+    - ACPI / CPPC: Add a helper to get desired performance
+    - cpufreq / cppc: Work around for Hisilicon CPPC cpufreq
+
+  * Disco update: v5.0.4 upstream stable release (LP: #1821607)
+    - 9p: use inode->i_lock to protect i_size_write() under 32-bit
+    - 9p/net: fix memory leak in p9_client_create
+    - ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
+    - ASoC: codecs: pcm186x: fix wrong usage of DECLARE_TLV_DB_SCALE()
+    - ASoC: codecs: pcm186x: Fix energysense SLEEP bit
+    - iio: adc: exynos-adc: Fix NULL pointer exception on unbind
+    - iio: adc: exynos-adc: Use proper number of channels for Exynos4x12
+    - mei: hbm: clean the feature flags on link reset
+    - mei: bus: move hw module get/put to probe/release
+    - stm class: Prevent division by zero
+    - stm class: Fix an endless loop in channel allocation
+    - crypto: caam - fix hash context DMA unmap size
+    - crypto: ccree - fix missing break in switch statement
+    - crypto: caam - fixed handling of sg list
+    - crypto: caam - fix DMA mapping of stack memory
+    - crypto: ccree - fix free of unallocated mlli buffer
+    - crypto: ccree - unmap buffer before copying IV
+    - crypto: ccree - don't copy zero size ciphertext
+    - crypto: cfb - add missing 'chunksize' property
+    - crypto: cfb - remove bogus memcpy() with src == dest
+    - crypto: ofb - fix handling partial blocks and make thread-safe
+    - crypto: ahash - fix another early termination in hash walk
+    - crypto: rockchip - fix scatterlist nents error
+    - crypto: rockchip - update new iv to device in multiple operations
+    - dax: Flush partial PMDs correctly
+    - nfit: Fix nfit_intel_shutdown_status() command submission
+    - nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
+    - acpi/nfit: Fix bus command validation
+    - nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot
+    - nfit/ars: Attempt short-ARS even in the no_init_ars case
+    - libnvdimm/label: Clear 'updating' flag after label-set update
+    - libnvdimm, pfn: Fix over-trim in trim_pfn_device()
+    - libnvdimm/pmem: Honor force_raw for legacy pmem regions
+    - libnvdimm: Fix altmap reservation size calculation
+    - fix cgroup_do_mount() handling of failure exits
+    - crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
+    - crypto: aegis - fix handling chunked inputs
+    - crypto: arm/crct10dif - revert to C code for short inputs
+    - crypto: arm64/aes-neonbs - fix returning final keystream block
+    - crypto: arm64/crct10dif - revert to C code for short inputs
+    - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
+    - crypto: morus - fix handling chunked inputs
+    - crypto: pcbc - remove bogus memcpy()s with src == dest
+    - crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
+    - crypto: testmgr - skip crc32c context test for ahash algorithms
+    - crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP
+    - crypto: x86/aesni-gcm - fix crash on empty plaintext
+    - crypto: x86/morus - fix handling chunked inputs and MAY_SLEEP
+    - crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
+    - crypto: arm64/aes-ccm - fix bugs in non-NEON fallback routine
+    - CIFS: Fix leaking locked VFS cache pages in writeback retry
+    - CIFS: Do not reset lease state to NONE on lease break
+    - CIFS: Do not skip SMB2 message IDs on send failures
+    - CIFS: Fix read after write for files with read caching
+    - smb3: make default i/o size for smb3 mounts larger
+    - tracing: Use strncpy instead of memcpy for string keys in hist triggers
+    - tracing: Do not free iter->trace in fail path of tracing_open_pipe()
+    - tracing/perf: Use strndup_user() instead of buggy open-coded version
+    - vmw_balloon: release lock on error in vmballoon_reset()
+    - xen: fix dom0 boot on huge systems
+    - ACPI / device_sysfs: Avoid OF modalias creation for removed device
+    - mmc: sdhci-esdhc-imx: fix HS400 timing issue
+    - mmc: renesas_sdhi: Fix card initialization failure in high speed mode
+    - mmc:fix a bug when max_discard is 0
+    - spi: ti-qspi: Fix mmap read when more than one CS in use
+    - spi: pxa2xx: Setup maximum supported DMA transfer length
+    - spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
+    - spi: spi-gpio: fix SPI_CS_HIGH capability
+    - regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
+    - regulator: max77620: Initialize values for DT properties
+    - regulator: s2mpa01: Fix step values for some LDOs
+    - mt76: fix corrupted software generated tx CCMP PN
+    - clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
+    - clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
+    - clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer
+      instability
+    - s390: vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem
+    - s390/setup: fix early warning messages
+    - s390/virtio: handle find on invalid queue gracefully
+    - scsi: virtio_scsi: don't send sc payload with tmfs
+    - scsi: aacraid: Fix performance issue on logical drives
+    - scsi: sd: Optimal I/O size should be a multiple of physical block size
+    - scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
+    - scsi: qla2xxx: Fix LUN discovery if loop id is not assigned yet by firmware
+    - scsi: qla2xxx: Avoid PCI IRQ affinity mapping when multiqueue is not
+      supported
+    - scsi: qla2xxx: Use complete switch scan for RSCN events
+    - fs/devpts: always delete dcache dentry-s in dput()
+    - splice: don't merge into linked buffers
+    - ovl: During copy up, first copy up data and then xattrs
+    - ovl: Do not lose security.capability xattr over metadata file copy-up
+    - m68k: Add -ffreestanding to CFLAGS
+    - Btrfs: setup a nofs context for memory allocation at btrfs_create_tree()
+    - Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl
+    - btrfs: scrub: fix circular locking dependency warning
+    - btrfs: drop the lock on error in btrfs_dev_replace_cancel
+    - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
+    - btrfs: init csum_list before possible free
+    - Btrfs: fix corruption reading shared and compressed extents after hole
+      punching
+    - Btrfs: fix deadlock between clone/dedupe and rename
+    - soc: qcom: rpmh: Avoid accessing freed memory from batch API
+    - libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer
+    - irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table
+    - irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code
+    - x86/kprobes: Prohibit probing on optprobe template code
+    - cpufreq: kryo: Release OPP tables on module removal
+    - cpufreq: tegra124: add missing of_node_put()
+    - cpufreq: pxa2xx: remove incorrect __init annotation
+    - ext4: fix check of inode in swap_inode_boot_loader
+    - ext4: cleanup pagecache before swap i_data
+    - mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
+    - mm/vmalloc: fix size check for remap_vmalloc_range_partial()
+    - mm/memory.c: do_fault: avoid usage of stale vm_area_struct
+    - kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
+    - nvmem: core: don't check the return value of notifier chain call
+    - device property: Fix the length used in PROPERTY_ENTRY_STRING()
+    - intel_th: Don't reference unassigned outputs
+    - parport_pc: fix find_superio io compare code, should use equal test.
+    - i2c: tegra: fix maximum transfer size
+    - i2c: tegra: update maximum transfer size
+    - media: i2c: ov5640: Fix post-reset delay
+    - gpio: pca953x: Fix dereference of irq data in shutdown
+    - ext4: update quota information while swapping boot loader inode
+    - ext4: add mask of ext4 flags to swap
+    - ext4: fix crash during online resizing
+    - dma: Introduce dma_max_mapping_size()
+    - swiotlb: Introduce swiotlb_max_mapping_size()
+    - swiotlb: Add is_swiotlb_active() function
+    - PCI/ASPM: Use LTR if already enabled by platform
+    - PCI/DPC: Fix print AER status in DPC event handling
+    - PCI: qcom: Don't deassert reset GPIO during probe
+    - PCI: dwc: skip MSI init if MSIs have been explicitly disabled
+    - PCI: pci-bridge-emul: Create per-bridge copy of register behavior
+    - PCI: pci-bridge-emul: Extend pci_bridge_emul_init() with flags
+    - IB/hfi1: Close race condition on user context disable and close
+    - IB/rdmavt: Fix loopback send with invalidate ordering
+    - IB/rdmavt: Fix concurrency panics in QP post_send and modify to error
+    - cxl: Wrap iterations over afu slices inside 'afu_list_lock'
+    - ext2: Fix underflow in ext2_max_size()
+    - clk: uniphier: Fix update register for CPU-gear
+    - clk: clk-twl6040: Fix imprecise external abort for pdmclk
+    - clk: samsung: exynos5: Fix possible NULL pointer exception on
+      platform_device_alloc() failure
+    - clk: samsung: exynos5: Fix kfree() of const memory on setting
+      driver_override
+    - clk: ingenic: Fix round_rate misbehaving with non-integer dividers
+    - clk: ingenic: Fix doc of ingenic_cgu_div_info
+    - usb: chipidea: tegra: Fix missed ci_hdrc_remove_device()
+    - usb: typec: tps6598x: handle block writes separately with plain-I2C adapters
+    - dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
+    - serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO
+    - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
+    - serial: 8250_pci: Fix number of ports for ACCES serial cards
+    - serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954
+      chip use the pci_pericom_setup()
+    - jbd2: clear dirty flag when revoking a buffer from an older transaction
+    - jbd2: fix compile warning when using JBUFFER_TRACE
+    - selinux: add the missing walk_size + len check in selinux_sctp_bind_connect
+    - security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock
+    - powerpc/32: Clear on-stack exception marker upon exception return
+    - powerpc/wii: properly disable use of BATs when requested.
+    - powerpc/powernv: Make opal log only readable by root
+    - powerpc/83xx: Also save/restore SPRG4-7 during suspend
+    - powerpc/kvm: Save and restore host AMR/IAMR/UAMOR
+    - powerpc/powernv: Don't reprogram SLW image on every KVM guest entry/exit
+    - powerpc/64s/hash: Fix assert_slb_presence() use of the slbfee. instruction
+    - powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
+    - powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
+    - powerpc/hugetlb: Don't do runtime allocation of 16G pages in LPAR
+      configuration
+    - powerpc/smp: Fix NMI IPI timeout
+    - powerpc/smp: Fix NMI IPI xmon timeout
+    - powerpc/traps: fix recoverability of machine check handling on book3s/32
+    - powerpc/traps: Fix the message printed when stack overflows
+    - ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
+    - arm64: Fix HCR.TGE status for NMI contexts
+    - arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
+    - arm64: debug: Ensure debug handlers check triggering exception level
+    - arm64: KVM: Fix architecturally invalid reset value for FPEXC32_EL2
+    - Revert "KVM/MMU: Flush tlb directly in the kvm_zap_gfn_range()"
+    - ipmi_si: Fix crash when using hard-coded device
+    - ipmi_si: fix use-after-free of resource->name
+    - dm: fix to_sector() for 32bit
+    - dm integrity: limit the rate of error messages
+    - media: cx25840: mark pad sig_types to fix cx231xx init
+    - mfd: sm501: Fix potential NULL pointer dereference
+    - cpcap-charger: generate events for userspace
+    - cpuidle: governor: Add new governors to cpuidle_governors again
+    - NFS: Fix I/O request leakages
+    - NFS: Fix an I/O request leakage in nfs_do_recoalesce
+    - NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
+    - nfsd: fix performance-limiting session calculation
+    - nfsd: fix memory corruption caused by readdir
+    - nfsd: fix wrong check in write_v4_end_grace()
+    - NFSv4.1: Reinitialise sequence results before retransmitting a request
+    - svcrpc: fix UDP on servers with lots of threads
+    - PM / wakeup: Rework wakeup source timer cancellation
+    - PM / OPP: Update performance state when freq == old_freq
+    - bcache: treat stale && dirty keys as bad keys
+    - bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata
+    - stable-kernel-rules.rst: add link to networking patch queue
+    - vt: perform safe console erase in the right order
+    - x86/unwind/orc: Fix ORC unwind table alignment
+    - perf intel-pt: Fix CYC timestamp calculation after OVF
+    - perf tools: Fix split_kallsyms_for_kcore() for trampoline symbols
+    - perf auxtrace: Define auxtrace record alignment
+    - perf intel-pt: Fix overlap calculation for padding
+    - perf/x86/intel/uncore: Fix client IMC events return huge result
+    - perf intel-pt: Fix divide by zero when TSC is not available
+    - md: Fix failed allocation of md_register_thread
+    - x86/kvmclock: set offset for kvm unstable clock
+    - x86/ftrace: Fix warning and considate ftrace_jmp_replace() and
+      ftrace_call_replace()
+    - tpm/tpm_crb: Avoid unaligned reads in crb_recv()
+    - tpm: Unify the send callback behaviour
+    - rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
+    - media: imx: prpencvf: Stop upstream before disabling IDMA channel
+    - media: lgdt330x: fix lock status reporting
+    - media: sun6i: Fix CSI regmap's max_register
+    - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
+    - media: vimc: Add vimc-streamer for stream control
+    - media: imx-csi: Input connections to CSI should be optional
+    - media: imx: csi: Disable CSI immediately after last EOF
+    - media: imx: csi: Stop upstream before disabling IDMA channel
+    - drm/fb-helper: generic: Fix drm_fbdev_client_restore()
+    - drm/radeon/evergreen_cs: fix missing break in switch statement
+    - drm/amd/powerplay: correct power reading on fiji
+    - drm/amd/display: don't call dm_pp_ function from an fpu block
+    - KVM: Call kvm_arch_memslots_updated() before updating memslots
+    - KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run
+    - KVM: VMX: Zero out *all* general purpose registers after VM-Exit
+    - KVM: x86/mmu: Detect MMIO generation wrap in any address space
+    - KVM: x86/mmu: Do not cache MMIO accesses while memslots are in flux
+    - KVM: nVMX: Sign extend displacements of VMX instr's mem operands
+    - KVM: nVMX: Apply addr size mask to effective address for VMX instructions
+    - KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
+    - KVM: nVMX: Check a single byte for VMCS "launched" in nested early checks
+    - net: dsa: lantiq_gswip: fix use-after-free on failed probe
+    - net: dsa: lantiq_gswip: fix OF child-node lookups
+    - s390/setup: fix boot crash for machine without EDAT-1
+    - SUNRPC: Prevent thundering herd when the socket is not connected
+    - SUNRPC: Fix up RPC back channel transmission
+    - SUNRPC: Respect RPC call timeouts when retrying transmission
+    - Linux 5.0.4
+    - [Config] update configs for 5.0.4 stable update
+
+  * New Intel Wireless-AC 9260 [8086:2526] card not correctly probed in Ubuntu
+    system (LP: #1821271)
+    - iwlwifi: add new card for 9260 series
+
+  * [CONFIG] please enable highdpi font FONT_TER16x32 (LP: #1819881)
+    - [Config]: enable highdpi Terminus 16x32 font support
+
+  * [SRU][B/B-OEM/C/D] Fix AMD IOMMU NULL dereference (LP: #1820990)
+    - iommu/amd: Fix NULL dereference bug in match_hid_uid
+
+  * some codecs stop working after S3 (LP: #1820930)
+    - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec
+    - ALSA: hda - Don't trigger jackpoll_work in azx_resume
+
+  * tcm_loop.ko: move from modules-extra into main modules package
+    (LP: #1817786)
+    - [Packaging] move tcm_loop.lo to main linux-modules package
+
+  * C++ demangling support missing from perf (LP: #1396654)
+    - [Packaging] fix a mistype
+
+  * r8169 doesn't get woken up by ethernet cable plugging, no PME generated
+    (LP: #1817676)
+    - PCI: pciehp: Disable Data Link Layer State Changed event on suspend
+
+  * Disco update: v5.0.3 upstream stable release (LP: #1821074)
+    - connector: fix unsafe usage of ->real_parent
+    - fou, fou6: avoid uninit-value in gue_err() and gue6_err()
+    - gro_cells: make sure device is up in gro_cells_receive()
+    - ipv4/route: fail early when inet dev is missing
+    - l2tp: fix infoleak in l2tp_ip6_recvmsg()
+    - lan743x: Fix RX Kernel Panic
+    - lan743x: Fix TX Stall Issue
+    - net: hsr: fix memory leak in hsr_dev_finalize()
+    - net/hsr: fix possible crash in add_timer()
+    - net: sit: fix UBSAN Undefined behaviour in check_6rd
+    - net/x25: fix use-after-free in x25_device_event()
+    - net/x25: reset state in x25_connect()
+    - pptp: dst_release sk_dst_cache in pptp_sock_destruct
+    - ravb: Decrease TxFIFO depth of Q3 and Q2 to one
+    - route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
+    - rxrpc: Fix client call queueing, waiting for channel
+    - sctp: remove sched init from sctp_stream_init
+    - tcp: do not report TCP_CM_INQ of 0 for closed connections
+    - tcp: Don't access TCP_SKB_CB before initializing it
+    - tcp: handle inet_csk_reqsk_queue_add() failures
+    - vxlan: Fix GRO cells race condition between receive and link delete
+    - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
+    - net/mlx4_core: Fix reset flow when in command polling mode
+    - net/mlx4_core: Fix locking in SRIOV mode when switching between events and
+      polling
+    - net/mlx4_core: Fix qp mtt size calculation
+    - net: dsa: mv88e6xxx: Set correct interface mode for CPU/DSA ports
+    - vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock
+    - net: sched: flower: insert new filter to idr after setting its mask
+    - f2fs: wait on atomic writes to count F2FS_CP_WB_DATA
+    - perf/x86: Fixup typo in stub functions
+    - ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against
+      Liquid Saffire 56
+    - ALSA: firewire-motu: fix construction of PCM frame for capture direction
+    - ALSA: hda: Extend i915 component bind timeout
+    - ALSA: hda - add more quirks for HP Z2 G4 and HP Z240
+    - ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294
+    - ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone
+    - ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with
+      ALC255
+    - perf/x86/intel: Fix memory corruption
+    - perf/x86/intel: Make dev_attr_allow_tsx_force_abort static
+    - It's wrong to add len to sector_nr in raid10 reshape twice
+    - drm: Block fb changes for async plane updates
+    - Linux 5.0.3
+
+  * Disco update: v5.0.2 upstream stable release (LP: #1820318)
+    - media: uvcvideo: Fix 'type' check leading to overflow
+    - Input: wacom_serial4 - add support for Wacom ArtPad II tablet
+    - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
+    - iscsi_ibft: Fix missing break in switch statement
+    - scsi: aacraid: Fix missing break in switch statement
+    - x86/PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub
+    - arm64: dts: zcu100-revC: Give wifi some time after power-on
+    - arm64: dts: hikey: Give wifi some time after power-on
+    - arm64: dts: hikey: Revert "Enable HS200 mode on eMMC"
+    - ARM: dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3
+    - ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
+    - ARM: dts: exynos: Fix max voltage for buck8 regulator on Odroid XU3/XU4
+    - drm: disable uncached DMA optimization for ARM and arm64
+    - media: Revert "media: rc: some events are dropped by userspace"
+    - Revert "PCI/PME: Implement runtime PM callbacks"
+    - bpf: Stop the psock parser before canceling its work
+    - gfs2: Fix missed wakeups in find_insert_glock
+    - staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()
+    - staging: erofs: compressed_pages should not be accessed again after freed
+    - scripts/gdb: replace flags (MS_xyz -> SB_xyz)
+    - ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom
+    - perf/x86/intel: Make cpuc allocations consistent
+    - perf/x86/intel: Generalize dynamic constraint creation
+    - x86: Add TSX Force Abort CPUID/MSR
+    - perf/x86/intel: Implement support for TSX Force Abort
+    - Linux 5.0.2
+
+  * Linux security module stacking support
+    - LSM: Introduce LSM_FLAG_LEGACY_MAJOR
+    - LSM: Provide separate ordered initialization
+    - LSM: Plumb visibility into optional "enabled" state
+    - LSM: Lift LSM selection out of individual LSMs
+    - LSM: Build ordered list of LSMs to initialize
+    - LSM: Introduce CONFIG_LSM
+    - LSM: Introduce "lsm=" for boottime LSM selection
+    - LSM: Tie enabling logic to presence in ordered list
+    - LSM: Prepare for reorganizing "security=" logic
+    - LSM: Refactor "security=" in terms of enable/disable
+    - LSM: Separate idea of "major" LSM from "exclusive" LSM
+    - apparmor: Remove SECURITY_APPARMOR_BOOTPARAM_VALUE
+    - selinux: Remove SECURITY_SELINUX_BOOTPARAM_VALUE
+    - LSM: Add all exclusive LSMs to ordered initialization
+    - LSM: Split LSM preparation from initialization
+    - LoadPin: Initialize as ordered LSM
+    - Yama: Initialize as ordered LSM
+    - LSM: Introduce enum lsm_order
+    - capability: Initialize as LSM_ORDER_FIRST
+    - procfs: add smack subdir to attrs
+    - Smack: Abstract use of cred security blob
+    - SELinux: Abstract use of cred security blob
+    - SELinux: Remove cred security blob poisoning
+    - SELinux: Remove unused selinux_is_enabled
+    - AppArmor: Abstract use of cred security blob
+    - TOMOYO: Abstract use of cred security blob
+    - Infrastructure management of the cred security blob
+    - SELinux: Abstract use of file security blob
+    - Smack: Abstract use of file security blob
+    - LSM: Infrastructure management of the file security
+    - SELinux: Abstract use of inode security blob
+    - Smack: Abstract use of inode security blob
+    - LSM: Infrastructure management of the inode security
+    - LSM: Infrastructure management of the task security
+    - SELinux: Abstract use of ipc security blobs
+    - Smack: Abstract use of ipc security blobs
+    - LSM: Infrastructure management of the ipc security blob
+    - TOMOYO: Update LSM flags to no longer be exclusive
+    - LSM: generalize flag passing to security_capable
+    - LSM: Make lsm_early_cred() and lsm_early_task() local functions.
+    - LSM: Make some functions static
+    - apparmor: Adjust offset when accessing task blob.
+    - LSM: Ignore "security=" when "lsm=" is specified
+    - LSM: Update list of SECURITYFS users in Kconfig
+    - apparmor: delete the dentry in aafs_remove() to avoid a leak
+    - apparmor: fix double free when unpack of secmark rules fails
+    - SAUCE: LSM: Infrastructure management of the sock security
+    - SAUCE: LSM: Limit calls to certain module hooks
+    - SAUCE: LSM: Special handling for secctx lsm hooks
+    - SAUCE: LSM: Specify which LSM to display with /proc/self/attr/display
+    - SAUCE: Fix-up af_unix mediation for sock infrastructure management
+    - SAUCE: Revert "apparmor: Fix warning about unused function
+      apparmor_ipv6_postroute"
+    - SAUCE: Revert "apparmor: fix checkpatch error in Parse secmark policy"
+    - SAUCE: Revert "apparmor: add #ifdef checks for secmark filtering"
+    - SAUCE: Revert "apparmor: Allow filtering based on secmark policy"
+    - SAUCE: Revert "apparmor: Parse secmark policy"
+    - SAUCE: Revert "apparmor: Add a wildcard secid"
+    - SAUCE: Revert "apparmor: fix bad debug check in apparmor_secid_to_secctx()"
+    - SAUCE: Revert "apparmor: fixup secid map conversion to using IDR"
+    - SAUCE: Revert "apparmor: Use an IDR to allocate apparmor secids"
+    - SAUCE: Revert "apparmor: Fix memory leak of rule on error exit path"
+    - SAUCE: Revert "apparmor: modify audit rule support to support profile
+      stacks"
+    - SAUCE: Revert "apparmor: Add support for audit rule filtering"
+    - SAUCE: Revert "apparmor: add the ability to get a task's secid"
+    - SAUCE: Revert "apparmor: add support for mapping secids and using secctxes"
+    - SAUCE: apparmor: add proc subdir to attrs
+    - SAUCE: apparmor: add an apparmorfs entry to access current attrs
+    - SAUCE: apparmor: update flags to no longer be exclusive
+    - SAUCE: update configs and annotations for LSM stacking
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_EARLY_PRINTK_USB_XDBC=y
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - [Config] CONFIG_RANDOM_TRUST_CPU=y
+    - [Config] refresh annotations for recent config changes
+    - ubuntu: vbox -- update to 6.0.4-dfsg-7
+    - Revert "UBUNTU: SAUCE: i2c:amd I2C Driver based on PCI Interface for
+      upcoming platform"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 04 Apr 2019 14:49:59 -0500
+
+linux (5.0.0-8.9) disco; urgency=medium
+
+  * linux: 5.0.0-8.9 -proposed tracker (LP: #1819759)
+
+  * hisi_sas: add debugfs support (LP: #1819500)
+    - scsi: hisi_sas: Create root and device debugfs directories
+    - scsi: hisi_sas: Alloc debugfs snapshot buffer memory for all registers
+    - scsi: hisi_sas: Take debugfs snapshot for all regs
+    - scsi: hisi_sas: Debugfs global register create file and add file operations
+    - scsi: hisi_sas: Add debugfs for port registers
+    - scsi: hisi_sas: Add debugfs CQ file and add file operations
+    - scsi: hisi_sas: Add debugfs DQ file and add file operations
+    - scsi: hisi_sas: Add debugfs IOST file and add file operations
+    - scsi: hisi_sas: No need to check return value of debugfs_create functions
+    - scsi: hisi_sas: Fix type casting and missing static qualifier in debugfs
+      code
+    - scsi: hisi_sas: Add debugfs ITCT file and add file operations
+
+  * [disco] hns driver updates from 5.1 merge window (LP: #1819535)
+    - net: hns: Use struct_size() in devm_kzalloc()
+    - net: hns3: modify enet reinitialization interface
+    - net: hns3: remove unused member in struct hns3_enet_ring
+    - net: hns3: remove unnecessary hns3_adjust_tqps_num
+    - net: hns3: reuse reinitialization interface in the hns3_set_channels
+    - net: hns3: add interface hclge_tm_bp_setup
+    - net: hns3: modify parameter checks in the hns3_set_channels
+    - net: hns3: remove redundant codes in hclge_knic_setup
+    - net: hns3: fix user configuration loss for ethtool -L
+    - net: hns3: adjust the use of alloc_tqps and num_tqps
+    - net: hns3: fix wrong combined count returned by ethtool -l
+    - net: hns3: do reinitialization while ETS configuration changed
+    - net: hns3: add HNAE3_RESTORE_CLIENT interface in enet module
+    - net: hns3: add calling roce callback function when link status change
+    - net: hns3: add rx multicast packets statistic
+    - net: hns3: refactor the statistics updating for netdev
+    - net: hns3: fix rss configuration lost problem when setting channel
+    - net: hns3: fix for shaper not setting when TC num changes
+    - net: hns3: fix bug of ethtool_ops.get_channels for VF
+    - net: hns3: clear param in ring when free ring
+    - net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED
+    - net: hns3: do not return GE PFC setting err when initializing
+    - net: hns3: add ETS TC weight setting in SSU module
+    - net: hns3: add statistics for PFC frames and MAC control frames
+    - net: hns3: fix PFC not setting problem for DCB module
+    - net: hns3: don't update packet statistics for packets dropped by hardware
+    - net: hns3: clear pci private data when unload hns3 driver
+    - net: hns3: add error handling in hclge_ieee_setets
+    - net: hns3: fix return value handle issue for hclge_set_loopback()
+    - net: hns3: fix broadcast promisc issue for revision 0x20
+    - net: hns3: After setting the loopback, add the status of getting MAC
+    - net: hns3: do reinitialization while mqprio configuration changed
+    - net: hns3: remove dcb_ops->map_update in hclge_dcb
+    - net: hns3: call hns3_nic_set_real_num_queue with netdev down
+    - net: hns3: add 8 BD limit for tx flow
+    - net: hns3: add initialization for nic state
+    - net: hns3: don't allow vf to enable promisc mode
+    - net: hns3: reuse the definition of l3 and l4 header info union
+    - net: hns3: fix VF dump register issue
+    - net: hns3: use the correct interface to stop|open port
+    - net: hns3: change hnae3_register_ae_dev() to int
+    - net: hns3: only support tc 0 for VF
+    - net: hns3: Fix NULL deref when unloading driver
+    - net: hns3: fix netif_napi_del() not do problem when unloading
+    - net: hns3: fix for rss result nonuniform
+    - net: hns3: fix improper error handling in the hclge_init_ae_dev()
+    - net: hns3: fix an issue for hclgevf_ae_get_hdev
+    - net: hns3: stop sending keep alive msg to PF when VF is resetting
+    - net: hns3: keep flow director state unchanged when reset
+    - net: hns3: Check for allocation failure
+    - net: hns3: fix a code style issue for hns3_update_new_int_gl()
+    - net: hns3: fix an issue for hns3_update_new_int_gl
+    - net: hns3: Modify parameter type from int to bool in set_gro_en
+    - net: hns3: code optimization for hclge_rx_buffer_calc
+    - net: hns3: add hclge_cmd_check_retval() to parse comman's return value
+    - net: hns3: move some set_bit statement into hclge_prepare_mac_addr
+    - net: hns3: fix a wrong checking in the hclge_tx_buffer_calc()
+    - net: hns3: fix the problem that the supported port is empty
+    - net: hns3: optimize the maximum TC macro
+    - net: hns3: don't allow user to change vlan filter state
+    - net: hns3: modify the upper limit judgment condition
+    - net: hns3: MAC table entry count function increases operation 0 value
+      protection measures
+    - net: hns3: make function hclge_set_all_vf_rst() static
+    - net: hns3: add pointer checking at the beginning of the exported functions.
+    - net: hns3: Check variable is valid before assigning it to another
+    - net: hns3: convert mac advertize and supported from u32 to link mode
+    - net: hns3: fix port info query issue for copper port
+    - net: hns3: modify print message of ssu common ecc errors
+    - net: hns3: some bugfix of ppu(rcb) ras errors
+    - net: hns3: enable 8~11th bit of mac common msi-x error
+    - net: hns3: fix 6th bit of ppp mpf abnormal errors
+    - net: hns3: Record VF unicast and multicast tables
+    - net: hns3: Record VF vlan tables
+    - net: hns3: uninitialize command queue while unloading PF driver
+    - net: hns3: clear command queue's registers when unloading VF driver
+    - net: hns3: add xps setting support for hns3 driver
+    - net: hns3: avoid mult + div op in critical data path
+    - net: hns3: limit some variable scope in critical data path
+    - net: hns3: remove some ops in struct hns3_nic_ops
+    - net: hns3: add unlikely for error handling in data path
+    - net: hns3: replace hnae3_set_bit and hnae3_set_field in data path
+    - net: hns3: remove hnae3_get_bit in data path
+    - net: hns3: add support to config depth for tx|rx ring separately
+    - net: hns3: enable VF VLAN filter for each VF when initializing
+    - net: hns3: fix get VF RSS issue
+    - net: hns3: fix setting of the hns reset_type for rdma hw errors
+    - net: hns3: fix improper error handling for hns3_client_start
+    - net: hns: use struct_size() in devm_kzalloc()
+    - net: hns3: Fix a logical vs bitwise typo
+    - net: hns3: add dma_rmb() for rx description
+    - net: hns3: fix to stop multiple HNS reset due to the AER changes
+
+  * Build Nvidia drivers in conjunction with kernel (LP: #1764792)
+    - [Packaging] dkms-build -- support building against packages in PPAs
+    - [Packaging] dkms-build: do not redownload files on subsequent passes
+    - [Packaging] dkms-build -- elide partial Built-Using information
+    - [Packaging] dkms-build -- remove retpoline data from final binary packages
+    - [Packaging] dkms-build--nvidia* -- check gcc version against primary build
+    - [Packaging] dkms-build -- add support for unversioned overrides
+    - [Packaging] dkms-build--nvidia-* -- convert to generic -N form
+    - [Packaging] fix-filenames -- handle exact string removal
+    - [Packaging] dkms-build--nvidia-N -- remove GCC versions
+
+  * Disco update: v5.0.1 upstream stable release (LP: #1819515)
+    - cpufreq: Use struct kobj_attribute instead of struct global_attr
+    - staging: erofs: fix mis-acted TAIL merging behavior
+    - binder: create node flag to request sender's security context
+    - USB: serial: option: add Telit ME910 ECM composition
+    - USB: serial: cp210x: add ID for Ingenico 3070
+    - USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
+    - driver core: Postpone DMA tear-down until after devres release
+    - staging: erofs: fix fast symlink w/o xattr when fs xattr is on
+    - staging: erofs: fix memleak of inode's shared xattr array
+    - staging: erofs: fix race of initializing xattrs of a inode at the same time
+    - staging: erofs: fix illegal address access under memory pressure
+    - staging: comedi: ni_660x: fix missing break in switch statement
+    - staging: wilc1000: fix to set correct value for 'vif_num'
+    - staging: android: ion: fix sys heap pool's gfp_flags
+    - staging: android: ashmem: Don't call fallocate() with ashmem_mutex held.
+    - staging: android: ashmem: Avoid range_alloc() allocation with ashmem_mutex
+      held.
+    - ip6mr: Do not call __IP6_INC_STATS() from preemptible context
+    - net: dsa: mv88e6xxx: add call to mv88e6xxx_ports_cmode_init to probe for new
+      DSA framework
+    - net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in
+      mv88e6xxx_port_set_duplex
+    - net: dsa: mv8e6xxx: fix number of internal PHYs for 88E6x90 family
+    - net: mscc: Enable all ports in QSGMII
+    - net: sched: put back q.qlen into a single location
+    - net-sysfs: Fix mem leak in netdev_register_kobject
+    - qmi_wwan: Add support for Quectel EG12/EM12
+    - sctp: call iov_iter_revert() after sending ABORT
+    - team: Free BPF filter when unregistering netdev
+    - tipc: fix RDM/DGRAM connect() regression
+    - x86/CPU/AMD: Set the CPB bit unconditionally on F17h
+    - x86/boot/compressed/64: Do not read legacy ROM on EFI system
+    - tracing: Fix event filters and triggers to handle negative numbers
+    - xhci: tegra: Prevent error pointer dereference
+    - usb: xhci: Fix for Enabling USB ROLE SWITCH QUIRK on
+      INTEL_SUNRISEPOINT_LP_XHCI
+    - applicom: Fix potential Spectre v1 vulnerabilities
+    - alpha: wire up io_pgetevents system call
+    - MIPS: irq: Allocate accurate order pages for irq stack
+    - aio: Fix locking in aio_poll()
+    - xtensa: fix get_wchan
+    - gnss: sirf: fix premature wakeup interrupt enable
+    - USB: serial: cp210x: fix GPIO in autosuspend
+    - Revert "selftests: firmware: add CONFIG_FW_LOADER_USER_HELPER_FALLBACK to
+      config"
+    - Revert "selftests: firmware: remove use of non-standard diff -Z option"
+    - selftests: firmware: fix verify_reqs() return value
+    - Bluetooth: btrtl: Restore old logic to assume firmware is already loaded
+    - Bluetooth: Fix locking in bt_accept_enqueue() for BH context
+    - Linux 5.0.1
+
+  * sky2 ethernet card doesn't work after returning from suspend
+    (LP: #1807259) // sky2 ethernet card link not up after suspend
+    (LP: #1809843) // Disco update: v5.0.1 upstream stable release
+    (LP: #1819515)
+    - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
+
+  * tls selftest failures/hangs on i386 (LP: #1813607)
+    - [Config] CONFIG_TLS=n for i386
+
+  * CVE-2019-8980
+    - exec: Fix mem leak in kernel_read_file
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: net: Use 'ipproto ipv6-icmp' to match ICMPv6 headers
+    - [Config] enable nvidia build
+    - [Config] update gcc version to 8.3
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: selftests: pmtu: disable accept_dad for tests"
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 12 Mar 2019 16:15:44 -0300
+
+linux (5.0.0-7.8) disco; urgency=medium
+
+  * linux: 5.0.0-7.8 -proposed tracker (LP: #1818519)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * unnecessary request_queue freeze (LP: #1815733)
+    - block: avoid setting nr_requests to current value
+    - block: avoid setting none scheduler if it's already none
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: net: Don't fail test_vxlan_under_vrf on xfail
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 04 Mar 2019 08:46:10 -0600
+
+linux (5.0.0-6.7) disco; urgency=medium
+
+  * linux: 5.0.0-6.7 -proposed tracker (LP: #1817585)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - [Packaging] resync getabis
+
+  * installer does not support iSCSI iBFT (LP: #1817321)
+    - d-i: add iscsi_ibft to scsi-modules
+
+  * Silent "Unknown key" message when pressing keyboard backlight hotkey
+    (LP: #1817063)
+    - platform/x86: dell-wmi: Ignore new keyboard backlight change event
+
+  * Fix I219 doesn't get woken up after plugging ethernet cable (LP: #1817058)
+    - e1000e: Disable runtime PM on CNP+
+
+  * efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted (LP: #1814982)
+    - efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted
+
+  * CVE-2019-3460
+    - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt
+
+  * CVE-2019-3459
+    - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer
+
+  * kernel net tls selftest fails on 5.0 (LP: #1816716)
+    - SAUCE: Revert "selftests/tls: Add test for recv(PEEK) spanning across
+      multiple records"
+
+  * Please enable CONFIG_DMA_CMA=y on arm64 (LP: #1803206)
+    - [Config] annotations -- enforce CONFIG_DMA_CMA and update notes
+
+  * [19.04 FEAT] [LS1801] PCI Virtual function enablement (LP: #1814684)
+    - s390/pci: map IOV resources
+    - s390/pci: improve bar check
+
+  * glibc 2.28-0ubuntu1 ADT test failure with linux 5.0.0-1.2 (LP: #1813060)
+    - SAUCE: prevent a glibc test failure when looking for obsolete types on
+      headers
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Enforce CONFIG_ZCRYPT_MULTIDEVNODES in annotations
+    - SAUCE: selftests: pmtu: disable accept_dad for tests
+    - SAUCE: arm64: add kernel config option to lock down when in Secure Boot mode
+    - SAUCE: selftests: net: Make test for VXLAN underlay in non-default VRF an
+      expected failure
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 25 Feb 2019 09:37:36 -0600
+
+linux (5.0.0-5.6) disco; urgency=medium
+
+  * [ALSA] [PATCH] System76 darp5 and oryp5 fixups (LP: #1815831)
+    - ALSA: hda/realtek - Headset microphone and internal speaker support for
+      System76 oryp5
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Fix aufs menus in annotations file
+    - [Config] CONFIG_SAMPLE_TRACE_PRINTK=m
+    - [Config] Update annotations based on configs
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 18 Feb 2019 10:04:11 +0100
+
+linux (5.0.0-4.5) disco; urgency=medium
+
+  * linux-buildinfo: pull out ABI information into its own package
+    (LP: #1806380)
+    - [Packaging] autoreconstruct -- base tag is always primary mainline version
+
+  * [Packaging] Allow overlay of config annotations (LP: #1752072)
+    - [Packaging] config-check: Add an include directive
+
+  * Miscellaneous Ubuntu changes
+    - hio -- stub out BIOVEC_PHYS_MERGEABLE for 4.20+
+    - hio -- replace use of do_gettimeofday()
+    - hio -- part_round_stats() removed in 5.0
+    - hio -- device_add_disk() grew a 'groups' argument in 4.20
+    - enable hio build
+    - Revert "UBUNTU: [Packaging] autoreconstruct -- base tag is always primary
+      mainline version"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 12 Feb 2019 08:15:32 -0600
+
+linux (5.0.0-3.4) disco; urgency=medium
+
+  * CONFIG_TEST_BPF is disabled (LP: #1813955)
+    - [Config]: Reenable TEST_BPF
+
+  * Ignore "incomplete report" from Elan touchpanels (LP: #1813733)
+    - HID: i2c-hid: Ignore input report if there's no data present on Elan
+      touchpanels
+
+  * SecureBoot support for arm64 (LP: #1804481)
+    - Build signed kernels for arm64
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: net: fix "from" match test in fib_rule_tests.sh
+    - [Config] CONFIG_PCMCIA=n for arm64 and s390x
+    - [Config] CONFIG_SERIAL_SC16IS7XX=n for s390x
+    - [Config] disable I2C TPM drivers for s390x
+    - [Config] CONFIG_RAPIDIO=n for s390x
+    - [Config] CONFIG_DMADEVICES=n for s390x
+    - [Config] disable gpio drivers for s390x
+    - [Config] CONFIG_SENSORS_OCC_P8_I2C=m for ppc64el
+    - [Config] disable I2C hardware drivers for s390x
+    - [Config] CONFIG_I3C=n for s390x
+    - [Config] CONFIG_SERIO=n for s390x
+    - [Config] disable misc drivers for s390x
+    - [Config] disable EEPROM drivers for s390x
+    - [Config] disable MFD drivers for s390x
+    - [Config] CONFIG_NVMEM=n for s390x
+    - [Config] CONFIG_MLXSW_I2C=n for s390x
+    - [Config] CONFIG_NET_VENDOR_MICROCHIP=n for s390x
+    - [Config] CONFIG_PPP=n for s390x
+    - [Config] CONFIG_PCCARD=n for s390x
+    - [Config] CONFIG_PCI_MESON=y
+    - [Config] CONFIG_SCSI_MYRB=n for s390x
+    - [Config] CONFIG_REGULATOR=n for s390x
+    - [Config] CONFIG_ZIIRAVE_WATCHDOG=n for s390x
+    - [Config] CONFIG_NCSI_OEM_CMD_GET_MAC=y
+    - [Config] update annotations following config review
+    - [Packaging] remove handoff check for uefi signing
+    - [Packaging] decompress gzipped efi images in signing tarball
+    - vbox-update: allow leading whitespace when fixing up KERN_DIR
+    - ubuntu: vbox -- update to 6.0.4-dfsg-3
+    - vbox: remove remount check in sf_read_super_aux()
+    - enable vbox build
+    - [Config] CONFIG_ANDROID_BINDER_DEVICES=""
+    - SAUCE: import aufs driver
+    - [Config]: Enable aufs
+    - [Config] relocate aufs annotations to menu
+    - [Config] remove unmatched configs from annotations
+    - [Config] fix up abi for removed modules
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) module: remove support for having IMA validate modules
+    - SAUCE: (efi-lockdown) Move EFI signature blob parser to shared location
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - [Config] (efi-lockdown) enable importing of efi certificates for module sig
+      verification
+
+  * Miscellaneous upstream changes
+    - binder: fix CONFIG_ANDROID_BINDER_DEVICES
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 05 Feb 2019 14:26:12 -0600
+
+linux (5.0.0-2.3) disco; urgency=medium
+
+  * kernel oops in bcache module (LP: #1793901)
+    - SAUCE: bcache: never writeback a discard operation
+
+  * Enable sound card power saving by default (LP: #1804265)
+    - [Config] CONFIG_SND_HDA_POWER_SAVE_DEFAULT=1
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: selftests: disable some failing networking tests"
+    - SAUCE: ashmem: turn into module
+    - SAUCE: binder: turn into module
+    - SAUCE: binder: give binder_alloc its own debug mask file
+    - [Config] enable binder and ashmem as modules
+    - SAUCE: selftests: net: replace AF_MAX with INT_MAX in socket.c
+    - SAUCE: selftests/ftrace: Fix tab expansion in trace_marker snapshot trigger
+      test
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 29 Jan 2019 06:57:32 -0600
+
+linux (5.0.0-1.2) disco; urgency=medium
+
+  * Fix non-working QCA Rome Bluetooth after S3 (LP: #1812812)
+    - USB: Add new USB LPM helpers
+    - USB: Consolidate LPM checks to avoid enabling LPM twice
+
+  * bluetooth controller not detected with 4.15 kernel (LP: #1810797)
+    - SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK
+    - [Config] arm64: snapdragon: BT_QCOMSMD_HACK=y
+
+  * [19.04 FEAT| Enable virtio-gpu for s390x (LP: #1799467)
+    - [Config] enable virtio-gpu for s390x
+
+  * Crash on "ip link add foo type ipip" (LP: #1811803)
+    - SAUCE: fan: Fix NULL pointer dereference
+
+  * Fix not working Goodix touchpad (LP: #1811929)
+    - HID: i2c-hid: Disable runtime PM on Goodix touchpad
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - enable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 22 Jan 2019 13:56:17 -0600
+
+linux (5.0.0-0.1) disco; urgency=medium
+
+  * Build Nvidia drivers in conjunction with kernel (LP: #1764792)
+    - [Packaging] dkms -- add per package post-process step
+    - [Packaging] dkms -- switch to a consistent build prefix length and strip
+    - [Packaging] nvidia -- build and sign nvidia packages and ship signatures
+    - [Packaging] nvidia -- make nvidia package version explicit
+
+  * Add support for ALC3277 codec on new Dell edge gateways (LP: #1807334)
+    - [Config] CONFIG_SND_SOC_INTEL_KBL_RT5660_MACH=m
+
+  * RTL8822BE WiFi Disabled in Kernel 4.18.0-12 (LP: #1806472)
+    - [Config] CONFIG_RTLWIFI_DEBUG_ST=n
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu -- disable vbox build
+    - ubuntu -- disable hio build
+    - Disable zfs build
+    - SAUCE: import aufs driver
+    - update dkms package versions
+    - [Config] disable aufs config options
+    - [Config] disable nvidia build
+    - update dropped.txt
+    - [Packaging] disable nvidia dkms builds for mainline
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - [Config] set config options for efi lockdown
+    - Revert "UBUNTU: SAUCE: import aufs driver"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 17 Jan 2019 12:31:29 -0600
+
+linux (5.0.0-0.0) disco; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 16 Jan 2019 14:48:05 -0600
+
+linux (4.20.0-2.3) disco; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.20
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 03 Jan 2019 12:11:43 -0600
+
+linux (4.20.0-1.2) disco; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Power leakage at S5 with Qualcomm Atheros QCA9377 802.11ac Wireless Network
+    Adapter (LP: #1805607)
+    - SAUCE: ath10k: provide reset function for QCA9377 chip
+
+  * zfs/spl build in conjunction with the kernel from DKMS source (LP: #1807378)
+    - [Packaging] dkms -- dkms package build packaging support
+    - [Packaging] dkms -- save build objects artifacts for validation
+    - [Packaging] dkms -- add general Built-Using: support
+    - [Packaging] simplify Provides comma handling
+    - [Packaging] zfs/spl -- remove packaging support for incorporated source
+    - [Packaging] zfs/spl -- remove incorporated source
+    - [Packaging] zfs/spl -- build via dkms
+    - [Packaging] zfs/spl -- make zfs package version explicit
+    - [Packaging] update-version-dkms -- sync archive versions to package
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] update-version-dkms -- fix getting distrbution from changelog
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.20-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 11 Dec 2018 11:33:08 -0600
+
+linux (4.20.0-0.1) disco; urgency=medium
+
+  * Overlayfs in user namespace leaks directory content of inaccessible
+    directories (LP: #1793458) // CVE-2018-6559
+    - Revert "ovl: relax permission checking on underlying layers"
+    - SAUCE: overlayfs: ensure mounter privileges when reading directories
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) Fix for module sig verification
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: Import aufs driver
+    - ubuntu: vbox -- update to 5.2.22-dfsg-2
+    - ubuntu -- disable vbox build
+    - ubuntu -- disable hio build
+    - Disable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.20-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 07 Dec 2018 07:13:42 -0600
+
+linux (4.20.0-0.0) disco; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 06 Dec 2018 10:20:19 -0600
+
+linux (4.19.0-8.9) disco; urgency=medium
+
+  * linux: 4.19.0-8.9 -proposed tracker (LP: #1806952)
+
+  * Workaround CSS timeout on AMD SNPS 3.0 xHC (LP: #1806838)
+    - xhci: workaround CSS timeout on AMD SNPS 3.0 xHC
+
+  * Fix Intel I210 doesn't work when ethernet cable gets plugged (LP: #1806818)
+    - igb: Fix an issue that PME is not enabled during runtime suspend
+
+  * The line-out on the Dell Dock station can't work (LP: #1806532)
+    - ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock
+
+  * CVE-2018-19407
+    - KVM: X86: Fix scan ioapic use-before-initialization
+
+  * PC SN720 NVMe WDC 256GB consumes more power in S2Idle than during long idle
+    (LP: #1805775)
+    - SAUCE: pci/nvme: prevent WDC PC SN720 NVMe from entering D3 and being
+      disabled
+
+  * Disco update: 4.19.6 upstream stable release (LP: #1806909)
+    - HID: steam: remove input device when a hid client is running.
+    - efi/libstub: arm: support building with clang
+    - usb: core: Fix hub port connection events lost
+    - usb: dwc3: gadget: fix ISOC TRB type on unaligned transfers
+    - usb: dwc3: gadget: Properly check last unaligned/zero chain TRB
+    - usb: dwc3: core: Clean up ULPI device
+    - usb: dwc3: Fix NULL pointer exception in dwc3_pci_remove()
+    - xhci: Fix leaking USB3 shared_hcd at xhci removal
+    - xhci: handle port status events for removed USB3 hcd
+    - xhci: Add check for invalid byte size error when UAS devices are connected.
+    - usb: xhci: fix uninitialized completion when USB3 port got wrong status
+    - usb: xhci: fix timeout for transition from RExit to U0
+    - xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc
+    - usb: xhci: Prevent bus suspend if a port connect change or polling state is
+      detected
+    - ALSA: oss: Use kvzalloc() for local buffer allocations
+    - MAINTAINERS: Add Sasha as a stable branch maintainer
+    - Documentation/security-bugs: Clarify treatment of embargoed information
+    - Documentation/security-bugs: Postpone fix publication in exceptional cases
+    - mmc: sdhci-pci: Try "cd" for card-detect lookup before using NULL
+    - mmc: sdhci-pci: Workaround GLK firmware failing to restore the tuning value
+    - gpio: don't free unallocated ida on gpiochip_add_data_with_key() error path
+    - iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE
+    - iwlwifi: mvm: support sta_statistics() even on older firmware
+    - iwlwifi: mvm: fix regulatory domain update when the firmware starts
+    - iwlwifi: mvm: don't use SAR Geo if basic SAR is not used
+    - brcmfmac: fix reporting support for 160 MHz channels
+    - opp: ti-opp-supply: Dynamically update u_volt_min
+    - opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call
+    - tools/power/cpupower: fix compilation with STATIC=true
+    - v9fs_dir_readdir: fix double-free on p9stat_read error
+    - selinux: Add __GFP_NOWARN to allocation at str_read()
+    - Input: synaptics - avoid using uninitialized variable when probing
+    - bfs: add sanity check at bfs_fill_super()
+    - sctp: clear the transport of some out_chunk_list chunks in
+      sctp_assoc_rm_peer
+    - gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
+    - llc: do not use sk_eat_skb()
+    - mm: don't warn about large allocations for slab
+    - mm/memory.c: recheck page table entry with page table lock held
+    - tcp: do not release socket ownership in tcp_close()
+    - drm/fb-helper: Blacklist writeback when adding connectors to fbdev
+    - drm/amdgpu: Add missing firmware entry for HAINAN
+    - drm/vc4: Set ->legacy_cursor_update to false when doing non-async updates
+    - drm/amdgpu: Fix oops when pp_funcs->switch_power_profile is unset
+    - drm/i915: Disable LP3 watermarks on all SNB machines
+    - drm/ast: change resolution may cause screen blurred
+    - drm/ast: fixed cursor may disappear sometimes
+    - drm/ast: Remove existing framebuffers before loading driver
+    - can: flexcan: Unlock the MB unconditionally
+    - can: dev: can_get_echo_skb(): factor out non sending code to
+      __can_get_echo_skb()
+    - can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to
+      access frame length
+    - can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb
+      is accessed out of bounds
+    - can: dev: __can_get_echo_skb(): print error message, if trying to echo non
+      existing skb
+    - can: rx-offload: introduce can_rx_offload_get_echo_skb() and
+      can_rx_offload_queue_sorted() functions
+    - can: rx-offload: rename can_rx_offload_irq_queue_err_skb() to
+      can_rx_offload_queue_tail()
+    - can: flexcan: use can_rx_offload_queue_sorted() for flexcan_irq_bus_*()
+    - can: flexcan: handle tx-complete CAN frames via rx-offload infrastructure
+    - can: raw: check for CAN FD capable netdev in raw_sendmsg()
+    - can: hi311x: Use level-triggered interrupt
+    - can: flexcan: Always use last mailbox for TX
+    - can: flexcan: remove not needed struct flexcan_priv::tx_mb and struct
+      flexcan_priv::tx_mb_idx
+    - ACPICA: AML interpreter: add region addresses in global list during
+      initialization
+    - IB/hfi1: Eliminate races in the SDMA send error path
+    - fsnotify: generalize handling of extra event flags
+    - fanotify: fix handling of events on child sub-directory
+    - pinctrl: meson: fix pinconf bias disable
+    - pinctrl: meson: fix gxbb ao pull register bits
+    - pinctrl: meson: fix gxl ao pull register bits
+    - pinctrl: meson: fix meson8 ao pull register bits
+    - pinctrl: meson: fix meson8b ao pull register bits
+    - tools/testing/nvdimm: Fix the array size for dimm devices.
+    - scsi: lpfc: fix remoteport access
+    - scsi: hisi_sas: Remove set but not used variable 'dq_list'
+    - KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
+    - cpufreq: imx6q: add return value check for voltage scale
+    - rtc: cmos: Do not export alarm rtc_ops when we do not support alarms
+    - rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write
+    - crypto: simd - correctly take reqsize of wrapped skcipher into account
+    - floppy: fix race condition in __floppy_read_block_0()
+    - powerpc/io: Fix the IO workarounds code to work with Radix
+    - sched/fair: Fix cpu_util_wake() for 'execl' type workloads
+    - perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs
+    - block: copy ioprio in __bio_clone_fast() and bounce
+    - SUNRPC: Fix a bogus get/put in generic_key_to_expire()
+    - riscv: add missing vdso_install target
+    - RISC-V: Silence some module warnings on 32-bit
+    - drm/amdgpu: fix bug with IH ring setup
+    - kdb: Use strscpy with destination buffer size
+    - NFSv4: Fix an Oops during delegation callbacks
+    - powerpc/numa: Suppress "VPHN is not supported" messages
+    - efi/arm: Revert deferred unmap of early memmap mapping
+    - z3fold: fix possible reclaim races
+    - mm, memory_hotplug: check zone_movable in has_unmovable_pages
+    - tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
+    - mm, page_alloc: check for max order in hot path
+    - dax: Avoid losing wakeup in dax_lock_mapping_entry
+    - include/linux/pfn_t.h: force '~' to be parsed as an unary operator
+    - tty: wipe buffer.
+    - tty: wipe buffer if not echoing data
+    - gfs2: Fix iomap buffer head reference counting bug
+    - rcu: Make need_resched() respond to urgent RCU-QS needs
+    - media: ov5640: Re-work MIPI startup sequence
+    - media: ov5640: Fix timings setup code
+    - media: ov5640: fix exposure regression
+    - media: ov5640: fix auto gain & exposure when changing mode
+    - media: ov5640: fix wrong binning value in exposure calculation
+    - media: ov5640: fix auto controls values when switching to manual mode
+    - Linux 4.19.6
+
+  * linux-buildinfo: pull out ABI information into its own package
+    (LP: #1806380)
+    - [Packaging] limit preparation to linux-libc-dev in headers
+    - [Packaging] commonise debhelper invocation
+    - [Packaging] ABI -- accumulate abi information at the end of the build
+    - [Packaging] buildinfo -- add basic build information
+    - [Packaging] buildinfo -- add firmware information to the flavour ABI
+    - [Packaging] buildinfo -- add compiler information to the flavour ABI
+    - [Packaging] buildinfo -- add buildinfo support to getabis
+    - [Packaging] getabis -- handle all known package combinations
+    - [Packaging] getabis -- support parsing a simple version
+
+  * linux packages should own /usr/lib/linux/triggers (LP: #1770256)
+    - [Packaging] own /usr/lib/linux/triggers
+
+  * Miscellaneous upstream changes
+    - blk-mq: fix corruption with direct issue
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 05 Dec 2018 09:18:30 -0600
+
+linux (4.19.0-7.8) disco; urgency=medium
+
+  * linux: 4.19.0-7.8 -proposed tracker (LP: #1805465)
+
+  * Fix and issue that LG I2C touchscreen stops working after reboot
+    (LP: #1805085)
+    - HID: i2c-hid: Disable runtime PM for LG touchscreen
+
+  * click/pop noise in the headphone on several lenovo laptops (LP: #1805079) //
+    click/pop noise in the headphone on several lenovo laptops (LP: #1805079)
+    - ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops
+
+  * Regression: hinic performance degrades over time (LP: #1805248)
+    - Revert "net-next/hinic: add checksum offload and TSO support"
+
+  * Disco update: 4.19.5 upstream stable release (LP: #1805461)
+    - drm/i915: Replace some PAGE_SIZE with I915_GTT_PAGE_SIZE
+    - cifs: don't dereference smb_file_target before null check
+    - cifs: fix return value for cifs_listxattr
+    - arm64: kprobe: make page to RO mode when allocate it
+    - block: brd: associate with queue until adding disk
+    - net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset()
+    - net: hns3: bugfix for rtnl_lock's range in the hclge_reset()
+    - net: hns3: bugfix for handling mailbox while the command queue reinitialized
+    - net: hns3: bugfix for the initialization of command queue's spin lock
+    - ixgbe: fix MAC anti-spoofing filter after VFLR
+    - reiserfs: propagate errors from fill_with_dentries() properly
+    - hfs: prevent btree data loss on root split
+    - hfsplus: prevent btree data loss on root split
+    - perf unwind: Take pgoff into account when reporting elf to libdwfl
+    - um: Give start_idle_thread() a return code
+    - drm/edid: Add 6 bpc quirk for BOE panel.
+    - afs: Handle EIO from delivery function
+    - platform/x86: intel_telemetry: report debugfs failure
+    - clk: fixed-rate: fix of_node_get-put imbalance
+    - perf symbols: Set PLT entry/header sizes properly on Sparc
+    - fs/exofs: fix potential memory leak in mount option parsing
+    - clk: samsung: exynos5420: Enable PERIS clocks for suspend
+    - apparmor: Fix uninitialized value in aa_split_fqname
+    - x86/earlyprintk: Add a force option for pciserial device
+    - platform/x86: acerhdf: Add BIOS entry for Gateway LT31 v1.3307
+    - clk: meson-axg: pcie: drop the mpll3 clock parent
+    - arm64: percpu: Initialize ret in the default case
+    - clk: meson: clk-pll: drop CLK_GET_RATE_NOCACHE where unnecessary
+    - clk: renesas: r9a06g032: Fix UART34567 clock rate
+    - clk: ti: fix OF child-node lookup
+    - serial: sh-sci: Fix receive on SCIFA/SCIFB variants with DMA
+    - netfilter: ipv6: fix oops when defragmenting locally generated fragments
+    - netfilter: bridge: define INT_MIN & INT_MAX in userspace
+    - s390/decompressor: add missing FORCE to build targets
+    - s390/vdso: add missing FORCE to build targets
+    - HID: i2c-hid: Add a small delay after sleep command for Raydium touchpanel
+    - Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS"
+    - HID: alps: allow incoming reports when only the trackstick is opened
+    - Revert "netfilter: nft_numgen: add map lookups for numgen random operations"
+    - netfilter: ipset: list:set: Decrease refcount synchronously on deletion and
+      replace
+    - netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net
+    - netfilter: ipset: fix ip_set_list allocation failure
+    - s390/mm: fix mis-accounting of pgtable_bytes
+    - s390/mm: Fix ERROR: "__node_distance" undefined!
+    - bpf: fix bpf_prog_get_info_by_fd to return 0 func_lens for unpriv
+    - netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment()
+    - netfilter: xt_IDLETIMER: add sysfs filename checking routine
+    - netfilter: ipset: Fix calling ip_set() macro at dumping
+    - netfilter: nft_compat: ebtables 'nat' table is normal chain type
+    - s390/qeth: fix HiperSockets sniffer
+    - s390/qeth: unregister netdevice only when registered
+    - net: hns3: Fix for out-of-bounds access when setting pfc back pressure
+    - hwmon: (ibmpowernv) Remove bogus __init annotations
+    - ARM: dts: imx6sll: fix typo for fsl,imx6sll-i2c node
+    - ARM: dts: fsl: Fix improperly quoted stdout-path values
+    - Revert "drm/exynos/decon5433: implement frame counter"
+    - arm64: dts: renesas: r8a7795: add missing dma-names on hscif2
+    - arm64: dts: renesas: condor: switch from EtherAVB to GEther
+    - xen/grant-table: Fix incorrect gnttab_dma_free_pages() pr_debug message
+    - clk: fixed-factor: fix of_node_get-put imbalance
+    - mtd: nand: Fix nanddev_pos_next_page() kernel-doc header
+    - lib/raid6: Fix arm64 test build
+    - drm/amd/display: Stop leaking planes
+    - block: Clear kernel memory before copying to user
+    - drm/amd/display: Drop reusing drm connector for MST
+    - drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder()
+    - s390/perf: Change CPUM_CF return code in event init function
+    - ceph: quota: fix null pointer dereference in quota check
+    - of/device: Really only set bus DMA mask when appropriate
+    - nvme: make sure ns head inherits underlying device limits
+    - i2c: omap: Enable for ARCH_K3
+    - i2c: qcom-geni: Fix runtime PM mismatch with child devices
+    - sched/core: Take the hotplug lock in sched_init_smp()
+    - perf tools: Fix undefined symbol scnprintf in libperf-jvmti.so
+    - perf tools: Do not zero sample_id_all for group members
+    - ice: Fix dead device link issue with flow control
+    - ice: Fix the bytecount sent to netdev_tx_sent_queue
+    - ice: Change req_speeds to be u16
+    - i40e: restore NETIF_F_GSO_IPXIP[46] to netdev features
+    - qed: Fix memory/entry leak in qed_init_sp_request()
+    - qed: Fix blocking/unlimited SPQ entries leak
+    - qed: Fix SPQ entries not returned to pool in error flows
+    - qed: Fix potential memory corruption
+    - net: stmmac: Fix RX packet size > 8191
+    - net: aquantia: fix potential IOMMU fault after driver unbind
+    - net: aquantia: fixed enable unicast on 32 macvlan
+    - net: aquantia: invalid checksumm offload implementation
+    - kbuild: deb-pkg: fix too low build version number
+    - Revert "scripts/setlocalversion: git: Make -dirty check more robust"
+    - SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer()
+    - x86/mm: Move LDT remap out of KASLR region on 5-level paging
+    - x86/ldt: Unmap PTEs for the slot before freeing LDT pages
+    - x86/ldt: Remove unused variable in map_ldt_struct()
+    - media: v4l: event: Add subscription to list before calling "add" operation
+    - MIPS: OCTEON: cavium_octeon_defconfig: re-enable OCTEON USB driver
+    - RISC-V: Fix raw_copy_{to,from}_user()
+    - uio: Fix an Oops on load
+    - ALSA: hda/realtek - Add quirk entry for HP Pavilion 15
+    - ALSA: hda/ca0132 - Call pci_iounmap() instead of iounmap()
+    - can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit()
+    - can: kvaser_usb: Fix potential uninitialized variable use
+    - usb: cdc-acm: add entry for Hiro (Conexant) modem
+    - USB: Wait for extra delay time after USB_PORT_FEAT_RESET for quirky hub
+    - usb: quirks: Add delay-init quirk for Corsair K70 LUX RGB
+    - misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
+    - USB: misc: appledisplay: add 20" Apple Cinema Display
+    - gnss: serial: fix synchronous write timeout
+    - gnss: sirf: fix synchronous write timeout
+    - mtd: rawnand: atmel: fix OF child-node lookup
+    - drivers/misc/sgi-gru: fix Spectre v1 vulnerability
+    - ACPI / platform: Add SMB0001 HID to forbidden_id_list
+    - HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges
+    - HID: Add quirk for Primax PIXART OEM mice
+    - HID: Add quirk for Microsoft PIXART OEM mouse
+    - libceph: fall back to sendmsg for slab pages
+    - mt76x0: run vco calibration for each channel configuration
+    - Linux 4.19.5
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: Build signed kernels for arm64"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 27 Nov 2018 10:38:34 -0600
+
+linux (4.19.0-6.7) disco; urgency=medium
+
+  * linux: 4.19.0-6.7 -proposed tracker (LP: #1805195)
+
+  * SecureBoot support for arm64 (LP: #1804481)
+    - Build signed kernels for arm64
+
+  * Add pointstick support for Cirque Touchpad (LP: #1805081)
+    - HID: multitouch: Add pointstick support for Cirque Touchpad
+
+  * Power consumption during s2idle is higher than long idle (Intel SSDPEKKF)
+    (LP: #1804588)
+    - SAUCE: pci: prevent Intel NVMe SSDPEKKF from entering D3
+    - SAUCE: nvme: add quirk to not call disable function when suspending
+
+  * Disco update: 4.19.4 upstream stable release (LP: #1805159)
+    - flow_dissector: do not dissect l4 ports for fragments
+    - ibmvnic: fix accelerated VLAN handling
+    - ip_tunnel: don't force DF when MTU is locked
+    - ipv6: fix a dst leak when removing its exception
+    - ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF
+    - net: bcmgenet: protect stop from timeout
+    - net-gro: reset skb->pkt_type in napi_reuse_skb()
+    - sctp: not allow to set asoc prsctp_enable by sockopt
+    - tcp: Fix SOF_TIMESTAMPING_RX_HARDWARE to use the latest timestamp during TCP
+      coalescing
+    - tg3: Add PHY reset for 5717/5719/5720 in change ring and flow control paths
+    - tipc: don't assume linear buffer when reading ancillary data
+    - tipc: fix lockdep warning when reinitilaizing sockets
+    - tuntap: fix multiqueue rx
+    - net: systemport: Protect stop from timeout
+    - net/sched: act_pedit: fix memory leak when IDR allocation fails
+    - net: sched: cls_flower: validate nested enc_opts_policy to avoid warning
+    - tipc: fix link re-establish failure
+    - net/mlx5e: Don't match on vlan non-existence if ethertype is wildcarded
+    - net/mlx5e: Claim TC hw offloads support only under a proper build config
+    - net/mlx5e: Adjust to max number of channles when re-attaching
+    - net/mlx5e: RX, verify received packet size in Linear Striding RQ
+    - Revert "sctp: remove sctp_transport_pmtu_check"
+    - net/mlx5e: Always use the match level enum when parsing TC rule match
+    - net/mlx5e: Fix selftest for small MTUs
+    - net/mlx5e: Removed unnecessary warnings in FEC caps query
+    - inet: frags: better deal with smp races
+    - l2tp: fix a sock refcnt leak in l2tp_tunnel_register
+    - net/mlx5: IPSec, Fix the SA context hash key
+    - net/mlx5e: IPoIB, Reset QP after channels are closed
+    - net: dsa: mv88e6xxx: Fix clearing of stats counters
+    - net: phy: realtek: fix RTL8201F sysfs name
+    - sctp: define SCTP_SS_DEFAULT for Stream schedulers
+    - net: qualcomm: rmnet: Fix incorrect assignment of real_dev
+    - net: dsa: microchip: initialize mutex before use
+    - sctp: fix strchange_flags name for Stream Change Event
+    - net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs
+    - sctp: not increase stream's incnt before sending addstrm_in request
+    - mlxsw: spectrum: Fix IP2ME CPU policer configuration
+    - net: smsc95xx: Fix MTU range
+    - rxrpc: Fix lockup due to no error backoff after ack transmit error
+    - usbnet: smsc95xx: disable carrier check while suspending
+    - Revert "x86/speculation: Enable cross-hyperthread spectre v2 STIBP
+      mitigation"
+    - Linux 4.19.4
+
+  * Disco update: 4.19.3 upstream stable release (LP: #1805158)
+    - powerpc/traps: restore recoverability of machine_check interrupts
+    - powerpc/64/module: REL32 relocation range check
+    - powerpc/mm: Fix page table dump to work on Radix
+    - powerpc/mm: fix always true/false warning in slice.c
+    - drm/amd/display: fix bug of accessing invalid memory
+    - Input: wm97xx-ts - fix exit path
+    - powerpc/Makefile: Fix PPC_BOOK3S_64 ASFLAGS
+    - powerpc/eeh: Fix possible null deref in eeh_dump_dev_log()
+    - tty: check name length in tty_find_polling_driver()
+    - tracing/kprobes: Check the probe on unloaded module correctly
+    - drm/nouveau/secboot/acr: fix memory leak
+    - drm/amdgpu/powerplay: fix missing break in switch statements
+    - ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL
+    - powerpc/nohash: fix undefined behaviour when testing page size support
+    - drm/msm/gpu: fix parameters in function msm_gpu_crashstate_capture
+    - drm/msm/disp/dpu: Use proper define for drm_encoder_init() 'encoder_type'
+    - drm/msm: dpu: Allow planes to extend past active display
+    - powerpc/mm: Don't report hugepage tables as memory leaks when using kmemleak
+    - drm/omap: fix memory barrier bug in DMM driver
+    - drm/amd/display: Raise dispclk value for dce120 by 15%
+    - drm/amd/display: fix gamma not being applied
+    - drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer
+    - media: pci: cx23885: handle adding to list failure
+    - media: coda: don't overwrite h.264 profile_idc on decoder instance
+    - MIPS: kexec: Mark CPU offline before disabling local IRQ
+    - powerpc/boot: Ensure _zimage_start is a weak symbol
+    - powerpc/memtrace: Remove memory in chunks
+    - MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS
+    - staging: erofs: fix a missing endian conversion
+    - serial: 8250_of: Fix for lack of interrupt support
+    - sc16is7xx: Fix for multi-channel stall
+    - media: tvp5150: fix width alignment during set_selection()
+    - powerpc/selftests: Wait all threads to join
+    - staging:iio:ad7606: fix voltage scales
+    - drm: rcar-du: Update Gen3 output limitations
+    - drm/amdgpu: Fix SDMA TO after GPU reset v3
+    - staging: most: video: fix registration of an empty comp core_component
+    - 9p locks: fix glock.client_id leak in do_lock
+    - udf: Prevent write-unsupported filesystem to be remounted read-write
+    - ARM: dts: imx6ull: keep IMX6UL_ prefix for signals on both i.MX6UL and
+      i.MX6ULL
+    - media: ov5640: fix mode change regression
+    - 9p: clear dangling pointers in p9stat_free
+    - drm/amdgpu: fix integer overflow test in amdgpu_bo_list_create()
+    - media: ov5640: fix restore of last mode set
+    - cdrom: fix improper type cast, which can leat to information leak.
+    - ovl: fix error handling in ovl_verify_set_fh()
+    - ovl: fix recursive oi->lock in ovl_link()
+    - ovl: check whiteout in ovl_create_over_whiteout()
+    - ovl: automatically enable redirect_dir on metacopy=on
+    - serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout
+    - scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
+    - scsi: qla2xxx: Fix process response queue for ISP26XX and above
+    - scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx
+    - scsi: qla2xxx: Fix early srb free on abort
+    - scsi: qla2xxx: shutdown chip if reset fail
+    - scsi: qla2xxx: Reject bsg request if chip is down.
+    - scsi: qla2xxx: Fix re-using LoopID when handle is in use
+    - scsi: qla2xxx: Fix for double free of SRB structure
+    - scsi: qla2xxx: Fix NVMe session hang on unload
+    - scsi: qla2xxx: Fix NVMe Target discovery
+    - scsi: qla2xxx: Fix duplicate switch database entries
+    - scsi: qla2xxx: Fix driver hang when FC-NVMe LUNs are configured
+    - vfs: fix FIGETBSZ ioctl on an overlayfs file
+    - fuse: Fix use-after-free in fuse_dev_do_read()
+    - fuse: Fix use-after-free in fuse_dev_do_write()
+    - fuse: fix blocked_waitq wakeup
+    - fuse: set FR_SENT while locked
+    - drm/msm: fix OF child-node lookup
+    - arm64: dts: stratix10: Support Ethernet Jumbo frame
+    - arm64: dts: stratix10: fix multicast filtering
+    - clk: meson-gxbb: set fclk_div3 as CLK_IS_CRITICAL
+    - clk: meson: axg: mark fdiv2 and fdiv3 as critical
+    - zram: close udev startup race condition as default groups
+    - MIPS: Loongson-3: Fix CPU UART irq delivery problem
+    - MIPS: Loongson-3: Fix BRIDGE irq delivery problem
+    - xtensa: add NOTES section to the linker script
+    - xtensa: make sure bFLT stack is 16 byte aligned
+    - xtensa: fix boot parameters address translation
+    - um: Drop own definition of PTRACE_SYSEMU/_SINGLESTEP
+    - clk: s2mps11: Fix matching when built as module and DT node contains
+      compatible
+    - clk: at91: Fix division by zero in PLL recalc_rate()
+    - clk: sunxi-ng: h6: fix bus clocks' divider position
+    - clk: rockchip: fix wrong mmc sample phase shift for rk3328
+    - clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call
+    - libceph: bump CEPH_MSG_MAX_DATA_LEN
+    - Revert "ceph: fix dentry leak in splice_dentry()"
+    - thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs
+    - mach64: fix display corruption on big endian machines
+    - mach64: fix image corruption due to reading accelerator registers
+    - acpi/nfit, x86/mce: Handle only uncorrectable machine checks
+    - acpi/nfit, x86/mce: Validate a MCE's address before using it
+    - acpi, nfit: Fix ARS overflow continuation
+    - reset: hisilicon: fix potential NULL pointer dereference
+    - crypto: hisilicon - Fix NULL dereference for same dst and src
+    - crypto: hisilicon - Fix reference after free of memories on error path
+    - vhost/scsi: truncate T10 PI iov_iter to prot_bytes
+    - scsi: qla2xxx: Initialize port speed to avoid setting lower speed
+    - SCSI: fix queue cleanup race before queue initialization is done
+    - Revert "powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED for
+      CONFIG_SWAP"
+    - soc: ti: QMSS: Fix usage of irq_set_affinity_hint
+    - ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry
+    - ocfs2: free up write context when direct IO failed
+    - mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
+    - memory_hotplug: cond_resched in __remove_pages
+    - netfilter: conntrack: fix calculation of next bucket number in early_drop
+    - ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm
+    - bonding/802.3ad: fix link_failure_count tracking
+    - mtd: spi-nor: cadence-quadspi: Return error code in
+      cqspi_direct_read_execute()
+    - mtd: nand: Fix nanddev_neraseblocks()
+    - mtd: docg3: don't set conflicting BCH_CONST_PARAMS option
+    - hwmon: (core) Fix double-free in __hwmon_device_register()
+    - perf cs-etm: Correct CPU mode for samples
+    - perf stat: Handle different PMU names with common prefix
+    - perf callchain: Honour the ordering of PERF_CONTEXT_{USER,KERNEL,etc}
+    - perf intel-pt/bts: Calculate cpumode for synthesized samples
+    - perf intel-pt: Insert callchain context into synthesized callchains
+    - of, numa: Validate some distance map rules
+    - x86/cpu/vmware: Do not trace vmware_sched_clock()
+    - x86/hyper-v: Enable PIT shutdown quirk
+    - termios, tty/tty_baudrate.c: fix buffer overrun
+    - arch/alpha, termios: implement BOTHER, IBSHIFT and termios2
+    - watchdog/core: Add missing prototypes for weak functions
+    - btrfs: fix pinned underflow after transaction aborted
+    - Btrfs: fix missing data checksums after a ranged fsync (msync)
+    - Btrfs: fix cur_offset in the error case for nocow
+    - Btrfs: fix infinite loop on inode eviction after deduplication of eof block
+    - Btrfs: fix data corruption due to cloning of eof block
+    - btrfs: tree-checker: Fix misleading group system information
+    - clockevents/drivers/i8253: Add support for PIT shutdown quirk
+    - ext4: add missing brelse() update_backups()'s error path
+    - ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path
+    - ext4: add missing brelse() add_new_gdb_meta_bg()'s error path
+    - ext4: avoid potential extra brelse in setup_new_flex_group_blocks()
+    - ext4: missing !bh check in ext4_xattr_inode_write()
+    - ext4: fix possible inode leak in the retry loop of ext4_resize_fs()
+    - ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty()
+    - ext4: avoid buffer leak in ext4_orphan_add() after prior errors
+    - ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing
+    - ext4: avoid possible double brelse() in add_new_gdb() on error path
+    - ext4: fix possible leak of sbi->s_group_desc_leak in error path
+    - ext4: fix possible leak of s_journal_flag_rwsem in error path
+    - ext4: fix buffer leak in ext4_xattr_get_block() on error path
+    - ext4: release bs.bh before re-using in ext4_xattr_block_find()
+    - ext4: fix buffer leak in ext4_xattr_move_to_block() on error path
+    - ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path
+    - ext4: fix buffer leak in __ext4_read_dirblock() on error path
+    - mount: Prevent MNT_DETACH from disconnecting locked mounts
+    - mnt: fix __detach_mounts infinite loop
+    - uapi: fix linux/kfd_ioctl.h userspace compilation errors
+    - ARM: cpuidle: Don't register the driver when back-end init returns -ENXIO
+    - kdb: use correct pointer when 'btc' calls 'btt'
+    - kdb: print real address of pointers instead of hashed addresses
+    - sunrpc: correct the computation for page_ptr when truncating
+    - NFSv4: Don't exit the state manager without clearing
+      NFS4CLNT_MANAGER_RUNNING
+    - nfsd: COPY and CLONE operations require the saved filehandle to be set
+    - rtc: hctosys: Add missing range error reporting
+    - fuse: fix use-after-free in fuse_direct_IO()
+    - fuse: fix leaked notify reply
+    - fuse: fix possibly missed wake-up after abort
+    - selinux: check length properly in SCTP bind hook
+    - gfs2: Put bitmap buffers in put_super
+    - gfs2: Fix metadata read-ahead during truncate (2)
+    - libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD
+    - crypto: user - fix leaking uninitialized memory to userspace
+    - lib/ubsan.c: don't mark __ubsan_handle_builtin_unreachable as noreturn
+    - hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444!
+    - mm/swapfile.c: use kvzalloc for swap_info_struct allocation
+    - efi/arm/libstub: Pack FDT after populating it
+    - mm: don't reclaim inodes with many attached pages
+    - scripts/spdxcheck.py: make python3 compliant
+    - drm/rockchip: Allow driver to be shutdown on reboot/kexec
+    - drm/amdgpu: Fix typo in amdgpu_vmid_mgr_init
+    - drm/amdgpu: add missing CHIP_HAINAN in amdgpu_ucode_get_load_type
+    - drm/amdgpu: Suppress keypresses from ACPI_VIDEO events
+    - drm/nouveau: Check backlight IDs are >= 0, not > 0
+    - drm/nouveau: Fix nv50_mstc->best_encoder()
+    - drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD
+    - drm/etnaviv: fix bogus fence complete check in timeout handler
+    - drm/dp_mst: Check if primary mstb is null
+    - drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003)
+    - drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit
+      panel's native mode
+    - drm/i915: Use the correct crtc when sanitizing plane mapping
+    - drm/i915: Restore vblank interrupts earlier
+    - drm/i915: Don't unset intel_connector->mst_port
+    - drm/i915: Skip vcpi allocation for MSTB ports that are gone
+    - drm/i915: Large page offsets for pread/pwrite
+    - drm/i915/dp: Fix link retraining comment in intel_dp_long_pulse()
+    - drm/i915/dp: Restrict link retrain workaround to external monitors
+    - drm/i915/icl: Fix the macros for DFLEXDPMLE register bits
+    - drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values
+    - drm/i915: Mark up GTT sizes as u64
+    - drm/i915: Fix error handling for the NV12 fb dimensions check
+    - drm/i915: Fix ilk+ watermarks when disabling pipes
+    - drm/i915: Compare user's 64b GTT offset even on 32b
+    - drm/i915: Don't oops during modeset shutdown after lpe audio deinit
+    - drm/i915: Mark pin flags as u64
+    - drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5
+    - drm/i915/execlists: Force write serialisation into context image vs
+      execution
+    - drm/i915: Fix possible race in intel_dp_add_mst_connector()
+    - drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST
+    - drm/i915: Fix hpd handling for pins with two encoders
+    - CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM
+    - Revert "ACPICA: AML interpreter: add region addresses in global list during
+      initialization"
+    - Linux 4.19.3
+
+  * glibc 2.28-0ubuntu1 ADT test failure with linux 4.19.0-5.6 (LP: #1805154)
+    - SAUCE: Revert "x86: vdso: Use $LD instead of $CC to link"
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.12-1ubuntu1, zfs to 0.7.12-1ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Nov 2018 11:44:00 -0600
+
+linux (4.19.0-5.6) disco; urgency=medium
+
+  * crash in ENA driver on removing an interface (LP: #1802341)
+    - SAUCE: net: ena: fix crash during ena_remove()
+
+  * Ubuntu 18.04.1 - [s390x] Kernel panic while stressing network bonding
+    (LP: #1797367)
+    - s390/qeth: sanitize strings in debug messages
+
+  * Disco update: 4.19.2 upstream stable release (LP: #1803410)
+    - bpf: fix partial copy of map_ptr when dst is scalar
+    - MIPS: VDSO: Reduce VDSO_RANDOMIZE_SIZE to 64MB for 64bit
+    - gpio: mxs: Get rid of external API call
+    - mtd: rawnand: marvell: fix the IRQ handler complete() condition
+    - mtd: maps: gpio-addr-flash: Fix ioremapped size
+    - mtd: spi-nor: fsl-quadspi: fix read error for flash size larger than 16MB
+    - mtd: spi-nor: intel-spi: Add support for Intel Ice Lake SPI serial flash
+    - mtd: spi-nor: fsl-quadspi: Don't let -EINVAL on the bus
+    - spi: spi-mem: Adjust op len based on message/transfer size limitations
+    - spi: bcm-qspi: switch back to reading flash using smaller chunks
+    - spi: bcm-qspi: fix calculation of address length
+    - bcache: trace missed reading by cache_missed
+    - bcache: fix ioctl in flash device
+    - bcache: correct dirty data statistics
+    - bcache: fix miss key refill->end in writeback
+    - hwmon: (pmbus) Fix page count auto-detection.
+    - jffs2: free jffs2_sb_info through jffs2_kill_sb()
+    - block: setup bounce bio_sets properly
+    - block: make sure discard bio is aligned with logical block size
+    - block: make sure writesame bio is aligned with logical block size
+    - cpufreq: conservative: Take limits changes into account properly
+    - dma-mapping: fix panic caused by passing empty cma command line argument
+    - pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
+    - ACPI / OSL: Use 'jiffies' as the time bassis for acpi_os_get_timer()
+    - ACPICA: AML interpreter: add region addresses in global list during
+      initialization
+    - ACPICA: AML Parser: fix parse loop to correctly skip erroneous extended
+      opcodes
+    - acpi, nfit: Fix Address Range Scrub completion tracking
+    - kprobes/x86: Use preempt_enable() in optimized_callback()
+    - mailbox: PCC: handle parse error
+    - parisc: Fix address in HPMC IVA
+    - parisc: Fix map_pages() to not overwrite existing pte entries
+    - parisc: Fix exported address of os_hpmc handler
+    - ALSA: hda - Add quirk for ASUS G751 laptop
+    - ALSA: hda - Fix headphone pin config for ASUS G751
+    - ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905)
+    - ALSA: hda: Add 2 more models to the power_save blacklist
+    - ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops
+    - ALSA: hda - Fix incorrect clearance of thinkpad_acpi hooks
+    - x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
+    - x86/xen: Fix boot loader version reported for PVH guests
+    - x86/corruption-check: Fix panic in memory_corruption_check() when boot
+      option without value is provided
+    - x86/kvm/nVMX: allow bare VMXON state migration
+    - x86/mm/pat: Disable preemption around __flush_tlb_all()
+    - x86/numa_emulation: Fix uniform-split numa emulation
+    - ARM: dts: exynos: Disable pull control for MAX8997 interrupts on Origen
+    - net: socionext: Reset tx queue in ndo_stop
+    - net: loopback: clear skb->tstamp before netif_rx()
+    - locking/lockdep: Fix debug_locks off performance problem
+    - netfilter: xt_nat: fix DNAT target for shifted portmap ranges
+    - ataflop: fix error handling during setup
+    - swim: fix cleanup on setup error
+    - arm64: cpufeature: ctr: Fix cpu capability check for late CPUs
+    - hv_netvsc: fix vf serial matching with pci slot info
+    - nfp: devlink port split support for 1x100G CXP NIC
+    - tun: Consistently configure generic netdev params via rtnetlink
+    - s390/sthyi: Fix machine name validity indication
+    - hwmon: (pwm-fan) Set fan speed to 0 on suspend
+    - lightnvm: pblk: fix race on sysfs line state
+    - lightnvm: pblk: fix two sleep-in-atomic-context bugs
+    - lightnvm: pblk: fix race condition on metadata I/O
+    - spi: spi-ep93xx: Use dma_data_direction for ep93xx_spi_dma_{finish,prepare}
+    - perf tools: Free temporary 'sys' string in read_event_files()
+    - perf tools: Cleanup trace-event-info 'tdata' leak
+    - perf tools: Free 'printk' string in parse_ftrace_printk()
+    - perf strbuf: Match va_{add,copy} with va_end
+    - cpupower: Fix coredump on VMWare
+    - bcache: Populate writeback_rate_minimum attribute
+    - mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01
+    - sdhci: acpi: add free_slot callback
+    - mtd: rawnand: denali: set SPARE_AREA_SKIP_BYTES register to 8 if unset
+    - iwlwifi: pcie: avoid empty free RB queue
+    - iwlwifi: mvm: clear HW_RESTART_REQUESTED when stopping the interface
+    - iwlwifi: mvm: check for n_profiles validity in EWRD ACPI
+    - x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC
+    - wlcore: Fix BUG with clear completion on timeout
+    - ACPI/PPTT: Handle architecturally unknown cache types
+    - ACPI / PM: LPIT: Register sysfs attributes based on FADT
+    - ACPI / processor: Fix the return value of acpi_processor_ids_walk()
+    - cpufreq: dt: Try freeing static OPPs only if we have added them
+    - x86/intel_rdt: Show missing resctrl mount options
+    - mtd: rawnand: atmel: Fix potential NULL pointer dereference
+    - nvme: call nvme_complete_rq when nvmf_check_ready fails for mpath I/O
+    - ath10k: fix tx status flag setting for management frames
+    - signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
+    - ice: fix changing of ring descriptor size (ethtool -G)
+    - ice: update fw version check logic
+    - net: hns3: Fix for packet buffer setting bug
+    - Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth
+    - Bluetooth: hci_qca: Remove hdev dereference in qca_close().
+    - x86: boot: Fix EFI stub alignment
+    - net: hns3: Add nic state check before calling netif_tx_wake_queue
+    - net: hns3: Fix ets validate issue
+    - pinctrl: sunxi: fix 'pctrl->functions' allocation in
+      sunxi_pinctrl_build_state
+    - pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux
+    - brcmfmac: fix for proper support of 160MHz bandwidth
+    - net: hns3: Check hdev state when getting link status
+    - net: hns3: Set STATE_DOWN bit of hdev state when stopping net
+    - net: phy: phylink: ensure the carrier is off when starting phylink
+    - block, bfq: correctly charge and reset entity service in all cases
+    - arm64: entry: Allow handling of undefined instructions from EL1
+    - kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
+    - spi: gpio: No MISO does not imply no RX
+    - ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers
+    - pinctrl: qcom: spmi-mpp: Fix drive strength setting
+    - bpf/verifier: fix verifier instability
+    - failover: Add missing check to validate 'slave_dev' in
+      net_failover_slave_unregister
+    - perf tests: Fix record+probe_libc_inet_pton.sh without ping's debuginfo
+    - pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant
+    - pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant
+    - net: hns3: Preserve vlan 0 in hardware table
+    - net: hns3: Fix ping exited problem when doing lp selftest
+    - net: hns3: Fix for vf vlan delete failed problem
+    - net: dsa: mv88e6xxx: Fix writing to a PHY page.
+    - mt76x2u: run device cleanup routine if resume fails
+    - rsi: fix memory alignment issue in ARM32 platforms
+    - libertas_tf: prevent underflow in process_cmdrequest()
+    - iwlwifi: mvm: fix BAR seq ctrl reporting
+    - gpio: brcmstb: allow 0 width GPIO banks
+    - ixgbe: disallow IPsec Tx offload when in SR-IOV mode
+    - ixgbevf: VF2VF TCP RSS
+    - wil6210: fix RX buffers release and unmap
+    - ath10k: schedule hardware restart if WMI command times out
+    - libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9
+    - thermal: rcar_thermal: Prevent doing work after unbind
+    - thermal: da9062/61: Prevent hardware access during system suspend
+    - cifs: fix a credits leak for compund commands
+    - cgroup, netclassid: add a preemption point to write_classid
+    - net: stmmac: dwmac-sun8i: fix OF child-node lookup
+    - f2fs: fix to account IO correctly for cgroup writeback
+    - MD: Memory leak when flush bio size is zero
+    - md: fix memleak for mempool
+    - of: Add missing exports of node name compare functions
+    - scsi: esp_scsi: Track residual for PIO transfers
+    - scsi: ufs: Schedule clk gating work on correct queue
+    - UAPI: ndctl: Fix g++-unsupported initialisation in headers
+    - KVM: nVMX: Clear reserved bits of #DB exit qualification
+    - scsi: megaraid_sas: fix a missing-check bug
+    - RDMA/core: Do not expose unsupported counters
+    - RDMA/cm: Respect returned status of cm_init_av_by_path
+    - IB/ipoib: Clear IPCB before icmp_send
+    - RDMA/bnxt_re: Avoid accessing nq->bar_reg_iomem in failure case
+    - RDMA/bnxt_re: Fix recursive lock warning in debug kernel
+    - usb: host: ohci-at91: fix request of irq for optional gpio
+    - PCI: mediatek: Fix mtk_pcie_find_port() endpoint/port matching logic
+    - PCI: cadence: Use AXI region 0 to signal interrupts from EP
+    - usb: typec: tcpm: Report back negotiated PPS voltage and current
+    - tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated
+    - f2fs: clear PageError on the read path
+    - Drivers: hv: vmbus: Use cpumask_var_t for on-stack cpu mask
+    - VMCI: Resource wildcard match fixed
+    - PCI / ACPI: Enable wake automatically for power managed bridges
+    - xprtrdma: Reset credit grant properly after a disconnect
+    - irqchip/pdc: Setup all edge interrupts as rising edge at GIC
+    - usb: dwc2: fix call to vbus supply exit routine, call it unlocked
+    - usb: dwc2: fix a race with external vbus supply
+    - usb: gadget: udc: atmel: handle at91sam9rl PMC
+    - ext4: fix argument checking in EXT4_IOC_MOVE_EXT
+    - MD: fix invalid stored role for a disk
+    - PCI: cadence: Correct probe behaviour when failing to get PHY
+    - nvmem: check the return value of nvmem_add_cells()
+    - xhci: Avoid USB autosuspend when resuming USB2 ports.
+    - scsi: qla2xxx: Fix recursive mailbox timeout
+    - f2fs: fix to recover inode's crtime during POR
+    - f2fs: fix to recover inode's i_flags during POR
+    - PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice
+    - coresight: etb10: Fix handling of perf mode
+    - PCI: dwc: pci-dra7xx: Enable errata i870 for both EP and RC mode
+    - crypto: caam - fix implicit casts in endianness helpers
+    - usb: chipidea: Prevent unbalanced IRQ disable
+    - Smack: ptrace capability use fixes
+    - driver/dma/ioat: Call del_timer_sync() without holding prep_lock
+    - ASoC: AMD: Fix capture unstable in beginning for some runs
+    - firmware: coreboot: Unmap ioregion after device population
+    - IB/ipoib: Use dev_port to expose network interface port numbers
+    - IB/mlx5: Allow transition of DCI QP to reset
+    - uio: ensure class is registered before devices
+    - scsi: lpfc: Correct soft lockup when running mds diagnostics
+    - scsi: lpfc: Correct race with abort on completion path
+    - f2fs: avoid sleeping under spin_lock
+    - f2fs: report error if quota off error during umount
+    - signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace
+      init
+    - f2fs: fix to flush all dirty inodes recovered in readonly fs
+    - mfd: menelaus: Fix possible race condition and leak
+    - dmaengine: dma-jz4780: Return error if not probed from DT
+    - IB/rxe: fix for duplicate request processing and ack psns
+    - ALSA: hda: Check the non-cached stream buffers more explicitly
+    - cpupower: Fix AMD Family 0x17 msr_pstate size
+    - Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()"
+    - f2fs: fix missing up_read
+    - f2fs: fix to recover cold bit of inode block during POR
+    - f2fs: fix to account IO correctly
+    - OPP: Free OPP table properly on performance state irregularities
+    - ARM: dts: exynos: Convert exynos5250.dtsi to opp-v2 bindings
+    - ARM: dts: exynos: Mark 1 GHz CPU OPP as suspend OPP on Exynos5250
+    - xen-swiotlb: use actually allocated size on check physical continuous
+    - tpm: Restore functionality to xen vtpm driver.
+    - xen/blkfront: avoid NULL blkfront_info dereference on device removal
+    - xen/balloon: Support xend-based toolstack
+    - xen: fix race in xen_qlock_wait()
+    - xen: make xen_qlock_wait() nestable
+    - xen/pvh: increase early stack size
+    - xen/pvh: don't try to unplug emulated devices
+    - libertas: don't set URB_ZERO_PACKET on IN USB transfer
+    - usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten
+    - usb: typec: tcpm: Fix APDO PPS order checking to be based on voltage
+    - usb: gadget: udc: renesas_usb3: Fix b-device mode for "workaround"
+    - mt76: mt76x2: fix multi-interface beacon configuration
+    - iwlwifi: mvm: check return value of rs_rate_from_ucode_rate()
+    - net/ipv4: defensive cipso option parsing
+    - dmaengine: ppc4xx: fix off-by-one build failure
+    - scsi: sched/wait: Add wait_event_lock_irq_timeout for TASK_UNINTERRUPTIBLE
+      usage
+    - scsi: target: Fix target_wait_for_sess_cmds breakage with active signals
+    - libnvdimm: Hold reference on parent while scheduling async init
+    - libnvdimm, region: Fail badblocks listing for inactive regions
+    - libnvdimm, pmem: Fix badblocks population for 'raw' namespaces
+    - ASoC: intel: skylake: Add missing break in skl_tplg_get_token()
+    - ASoC: sta32x: set ->component pointer in private struct
+    - IB/mlx5: Fix MR cache initialization
+    - IB/rxe: Revise the ib_wr_opcode enum
+    - jbd2: fix use after free in jbd2_log_do_checkpoint()
+    - gfs2_meta: ->mount() can get NULL dev_name
+    - ext4: fix EXT4_IOC_SWAP_BOOT
+    - ext4: initialize retries variable in ext4_da_write_inline_data_begin()
+    - ext4: fix setattr project check in fssetxattr ioctl
+    - ext4: propagate error from dquot_initialize() in EXT4_IOC_FSSETXATTR
+    - ext4: fix use-after-free race in ext4_remount()'s error path
+    - selinux: fix mounting of cgroup2 under older policies
+    - HID: wacom: Work around HID descriptor bug in DTK-2451 and DTH-2452
+    - HID: hiddev: fix potential Spectre v1
+    - EDAC, amd64: Add Family 17h, models 10h-2fh support
+    - EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting
+    - EDAC, skx_edac: Fix logical channel intermediate decoding
+    - ARM: dts: dra7: Fix up unaligned access setting for PCIe EP
+    - PCI/ASPM: Fix link_state teardown on device removal
+    - PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk
+    - signal/GenWQE: Fix sending of SIGKILL
+    - signal: Guard against negative signal numbers in copy_siginfo_from_user32
+    - crypto: lrw - Fix out-of bounds access on counter overflow
+    - crypto: tcrypt - fix ghash-generic speed test
+    - crypto: aesni - don't use GFP_ATOMIC allocation if the request doesn't cross
+      a page in gcm
+    - crypto: morus/generic - fix for big endian systems
+    - crypto: aegis/generic - fix for big endian systems
+    - crypto: speck - remove Speck
+    - mm: /proc/pid/smaps_rollup: fix NULL pointer deref in smaps_pte_range()
+    - userfaultfd: disable irqs when taking the waitqueue lock
+    - ima: fix showing large 'violations' or 'runtime_measurements_count'
+    - ima: open a new file instance if no read permissions
+    - hugetlbfs: dirty pages as they are added to pagecache
+    - mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly
+    - mm/hmm: fix race between hmm_mirror_unregister() and mmu_notifier callback
+    - KVM: arm/arm64: Ensure only THP is candidate for adjustment
+    - KVM: arm64: Fix caching of host MDCR_EL2 value
+    - kbuild: fix kernel/bounds.c 'W=1' warning
+    - iio: ad5064: Fix regulator handling
+    - iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs()
+    - iio: adc: at91: fix acking DRDY irq on simple conversions
+    - iio: adc: at91: fix wrong channel number in triggered buffer mode
+    - w1: omap-hdq: fix missing bus unregister at removal
+    - smb3: allow stats which track session and share reconnects to be reset
+    - smb3: do not attempt cifs operation in smb3 query info error path
+    - smb3: on kerberos mount if server doesn't specify auth type use krb5
+    - printk: Fix panic caused by passing log_buf_len to command line
+    - genirq: Fix race on spurious interrupt detection
+    - tpm: fix response size validation in tpm_get_random()
+    - NFC: nfcmrvl_uart: fix OF child-node lookup
+    - NFSv4.1: Fix the r/wsize checking
+    - nfs: Fix a missed page unlock after pg_doio()
+    - nfsd: correctly decrement odstate refcount in error path
+    - nfsd: Fix an Oops in free_session()
+    - lockd: fix access beyond unterminated strings in prints
+    - dm ioctl: harden copy_params()'s copy_from_user() from malicious users
+    - dm zoned: fix metadata block ref counting
+    - dm zoned: fix various dmz_get_mblock() issues
+    - media: ov7670: make "xclk" clock optional
+    - fsnotify: Fix busy inodes during unmount
+    - powerpc64/module elfv1: Set opd addresses after module relocation
+    - powerpc/msi: Fix compile error on mpc83xx
+    - powerpc/tm: Fix HFSCR bit for no suspend case
+    - powerpc/64s/hash: Do not use PPC_INVALIDATE_ERAT on CPUs before POWER9
+    - MIPS: OCTEON: fix out of bounds array access on CN68XX
+    - rtc: ds1307: fix ds1339 wakealarm support
+    - rtc: cmos: Fix non-ACPI undefined reference to `hpet_rtc_interrupt'
+    - rtc: cmos: Remove the `use_acpi_alarm' module parameter for !ACPI
+    - power: supply: twl4030-charger: fix OF sibling-node lookup
+    - ocxl: Fix access to the AFU Descriptor Data
+    - iommu/arm-smmu: Ensure that page-table updates are visible before TLBI
+    - TC: Set DMA masks for devices
+    - net: bcmgenet: fix OF child-node lookup
+    - media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
+    - Revert "media: dvbsky: use just one mutex for serializing device R/W ops"
+    - kgdboc: Passing ekgdboc to command line causes panic
+    - remoteproc: qcom: q6v5: Propagate EPROBE_DEFER
+    - media: cec: make cec_get_edid_spa_location() an inline function
+    - media: cec: integrate cec_validate_phys_addr() in cec-api.c
+    - xen: fix xen_qlock_wait()
+    - xen: remove size limit of privcmd-buf mapping interface
+    - xen-blkfront: fix kernel panic with negotiate_mq error path
+    - media: cec: add new tx/rx status bits to detect aborts/timeouts
+    - media: cec: fix the Signal Free Time calculation
+    - media: cec: forgot to cancel delayed work
+    - media: em28xx: use a default format if TRY_FMT fails
+    - media: tvp5150: avoid going past array on v4l2_querymenu()
+    - media: em28xx: fix input name for Terratec AV 350
+    - media: em28xx: make v4l2-compliance happier by starting sequence on zero
+    - media: em28xx: fix handler for vidioc_s_input()
+    - media: adv7604: when the EDID is cleared, unconfigure CEC as well
+    - media: adv7842: when the EDID is cleared, unconfigure CEC as well
+    - drm/mediatek: fix OF sibling-node lookup
+    - media: media colorspaces*.rst: rename AdobeRGB to opRGB
+    - media: replace ADOBERGB by OPRGB
+    - media: hdmi.h: rename ADOBE_RGB to OPRGB and ADOBE_YCC to OPYCC
+    - arm64: lse: remove -fcall-used-x0 flag
+    - rpmsg: smd: fix memory leak on channel create
+    - Cramfs: fix abad comparison when wrap-arounds occur
+    - ARM: dts: socfpga: Fix SDRAM node address for Arria10
+    - arm64: dts: stratix10: Correct System Manager register size
+    - soc: qcom: rmtfs-mem: Validate that scm is available
+    - soc/tegra: pmc: Fix child-node lookup
+    - selftests/ftrace: Fix synthetic event test to delete event correctly
+    - selftests/powerpc: Fix ptrace tm failure
+    - tracing: Return -ENOENT if there is no target synthetic event
+    - btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled
+    - btrfs: Handle owner mismatch gracefully when walking up tree
+    - btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock
+    - btrfs: fix error handling in free_log_tree
+    - btrfs: fix error handling in btrfs_dev_replace_start
+    - btrfs: Enhance btrfs_trim_fs function to handle error better
+    - btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
+    - btrfs: iterate all devices during trim, instead of fs_devices::alloc_list
+    - btrfs: don't attempt to trim devices that don't support it
+    - btrfs: keep trim from interfering with transaction commits
+    - btrfs: wait on caching when putting the bg cache
+    - Btrfs: don't clean dirty pages during buffered writes
+    - btrfs: release metadata before running delayed refs
+    - btrfs: protect space cache inode alloc with GFP_NOFS
+    - btrfs: reset max_extent_size on clear in a bitmap
+    - btrfs: make sure we create all new block groups
+    - Btrfs: fix warning when replaying log after fsync of a tmpfile
+    - Btrfs: fix wrong dentries after fsync of file that got its parent replaced
+    - btrfs: qgroup: Dirty all qgroups before rescan
+    - Btrfs: fix null pointer dereference on compressed write path error
+    - Btrfs: fix assertion on fsync of regular file when using no-holes feature
+    - Btrfs: fix deadlock when writing out free space caches
+    - btrfs: reset max_extent_size properly
+    - btrfs: set max_extent_size properly
+    - btrfs: don't use ctl->free_space for max_extent_size
+    - btrfs: only free reserved extent if we didn't insert it
+    - btrfs: fix insert_reserved error handling
+    - btrfs: don't run delayed_iputs in commit
+    - btrfs: move the dio_sem higher up the callchain
+    - Btrfs: fix use-after-free during inode eviction
+    - Btrfs: fix use-after-free when dumping free space
+    - net: sched: Remove TCA_OPTIONS from policy
+    - vt: fix broken display when running aptitude
+    - bpf: wait for running BPF programs when updating map-in-map
+    - vga_switcheroo: Fix missing gpu_bound call at audio client registration
+    - MD: fix invalid stored role for a disk - try2
+    - Linux 4.19.2
+
+  * [FEAT] Guest-dedicated Crypto Adapters (LP: #1787405)
+    - KVM: s390: vsie: simulate VCPU SIE entry/exit
+    - KVM: s390: introduce and use KVM_REQ_VSIE_RESTART
+    - KVM: s390: refactor crypto initialization
+    - s390: vfio-ap: base implementation of VFIO AP device driver
+    - s390: vfio-ap: register matrix device with VFIO mdev framework
+    - s390: vfio-ap: sysfs interfaces to configure adapters
+    - s390: vfio-ap: sysfs interfaces to configure domains
+    - s390: vfio-ap: sysfs interfaces to configure control domains
+    - s390: vfio-ap: sysfs interface to view matrix mdev matrix
+    - KVM: s390: interface to clear CRYCB masks
+    - s390: vfio-ap: implement mediated device open callback
+    - s390: vfio-ap: implement VFIO_DEVICE_GET_INFO ioctl
+    - s390: vfio-ap: zeroize the AP queues
+    - s390: vfio-ap: implement VFIO_DEVICE_RESET ioctl
+    - KVM: s390: Clear Crypto Control Block when using vSIE
+    - KVM: s390: vsie: Do the CRYCB validation first
+    - KVM: s390: vsie: Make use of CRYCB FORMAT2 clear
+    - KVM: s390: vsie: Allow CRYCB FORMAT-2
+    - KVM: s390: vsie: allow CRYCB FORMAT-1
+    - KVM: s390: vsie: allow CRYCB FORMAT-0
+    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-1
+    - KVM: s390: vsie: allow guest FORMAT-1 CRYCB on host FORMAT-2
+    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-2
+    - KVM: s390: device attrs to enable/disable AP interpretation
+    - KVM: s390: CPU model support for AP virtualization
+    - s390: doc: detailed specifications for AP virtualization
+    - KVM: s390: fix locking for crypto setting error path
+    - KVM: s390: Tracing APCB changes
+    - s390: vfio-ap: setup APCB mask using KVM dedicated function
+    - [Config:] Enable CONFIG_S390_AP_IOMMU and set CONFIG_VFIO_AP to module.
+
+  * Bypass of mount visibility through userns + mount propagation (LP: #1789161)
+    - mount: Retest MNT_LOCKED in do_umount
+    - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts
+
+  *  CVE-2018-18955: nested user namespaces with more than five extents
+    incorrectly grant privileges over inode (LP: #1801924) // CVE-2018-18955
+    - userns: also map extents in the reverse map to kernel IDs
+
+  * kdump fail due to an IRQ storm (LP: #1797990)
+    - SAUCE: x86/PCI: Export find_cap() to be used in early PCI code
+    - SAUCE: x86/quirks: Add parameter to clear MSIs early on boot
+    - SAUCE: x86/quirks: Scan all busses for early PCI quirks
+
+  * Disable LPM for Raydium Touchscreens (LP: #1802248)
+    - USB: quirks: Add no-lpm quirk for Raydium touchscreens
+
+  * Power consumption during s2idle is higher than long idle(sk hynix)
+    (LP: #1801875)
+    - SAUCE: pci: prevent sk hynix nvme from entering D3
+    - SAUCE: nvme: add quirk to not call disable function when suspending
+
+  * Disco update: v4.19.1 upstream stable release (LP: #1801739)
+    - bridge: do not add port to router list when receives query with source
+      0.0.0.0
+    - ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are
+      called
+    - net/mlx5e: fix csum adjustments caused by RXFCS
+    - net: sched: gred: pass the right attribute to gred_change_table_def()
+    - net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
+    - net: udp: fix handling of CHECKSUM_COMPLETE packets
+    - Revert "net: simplify sock_poll_wait"
+    - rtnetlink: Disallow FDB configuration for non-Ethernet device
+    - vhost: Fix Spectre V1 vulnerability
+    - bonding: fix length of actor system
+    - openvswitch: Fix push/pop ethernet validation
+    - net/ipv6: Allow onlink routes to have a device mismatch if it is the default
+      route
+    - net/smc: fix smc_buf_unuse to use the lgr pointer
+    - mlxsw: spectrum_switchdev: Don't ignore deletions of learned MACs
+    - mlxsw: core: Fix devlink unregister flow
+    - net: drop skb on failure in ip_check_defrag()
+    - net: Properly unlink GRO packets on overflow.
+    - r8169: fix broken Wake-on-LAN from S5 (poweroff)
+    - Revert "be2net: remove desc field from be_eq_obj"
+    - sctp: check policy more carefully when getting pr status
+    - sparc64: Export __node_distance.
+    - sparc64: Make corrupted user stacks more debuggable.
+    - sparc64: Wire up compat getpeername and getsockname.
+    - net: bridge: remove ipv6 zero address check in mcast queries
+    - Linux 4.19.1
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.11-1ubuntu1, zfs to 0.7.11-3ubuntu1
+    - [Config] updateconfigs after 4.19.2 stable update
+    - [Config] Disable unneded options for s390
+    - [Config] Update annotations for 4.19
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 15 Nov 2018 09:55:37 -0800
+
+linux (4.19.0-4.5) disco; urgency=medium
+
+  * Add checksum offload and TSO support for HiNIC adapters (LP: #1800664)
+    - net-next/hinic: add checksum offload and TSO support
+
+  * [Bionic][Cosmic] Fix to ipmi to support vendor specific messages greater
+    than 255 bytes (LP: #1799794)
+    - ipmi:ssif: Add support for multi-part transmit messages > 2 parts
+
+  * Packaging resync (LP: #1786013)
+    - [Package] add support for specifying the primary makefile
+
+  * Update ENA driver to version 2.0.1K (LP: #1798182)
+    - net: ena: minor performance improvement
+    - net: ena: complete host info to match latest ENA spec
+    - net: ena: introduce Low Latency Queues data structures according to ENA spec
+    - net: ena: add functions for handling Low Latency Queues in ena_com
+    - net: ena: add functions for handling Low Latency Queues in ena_netdev
+    - net: ena: use CSUM_CHECKED device indication to report skb's checksum status
+    - net: ena: explicit casting and initialization, and clearer error handling
+    - net: ena: limit refill Rx threshold to 256 to avoid latency issues
+    - net: ena: change rx copybreak default to reduce kernel memory pressure
+    - net: ena: remove redundant parameter in ena_com_admin_init()
+    - net: ena: update driver version to 2.0.1
+    - net: ena: fix indentations in ena_defs for better readability
+    - net: ena: Fix Kconfig dependency on X86
+    - net: ena: enable Low Latency Queues
+    - net: ena: fix compilation error in xtensa architecture
+
+  * [Bionic][Cosmic]  ipmi: Fix timer race with module unload (LP: #1799281)
+    - ipmi: Fix timer race with module unload
+
+  * Overlayfs in user namespace leaks directory content of inaccessible
+    directories (LP: #1793458) // CVE-2018-6559
+    - SAUCE: overlayfs: ensure mounter privileges when reading directories
+
+  * not able to unwind the stack from within __kernel_clock_gettime in the Linux
+    vDSO (LP: #1797963)
+    - powerpc/vdso: Correct call frame information
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Don't print secure boot state
+      from the efi stub"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Make get_cert_list() use
+      efi_status_to_str() to print error messages."
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err()."
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Make get_cert_list() not complain
+      about cert lists that aren't present."
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable
+      to be suppressed"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI
+      Secure Boot"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add EFI signature data types"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time
+      addition of keys to secondary keyring"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in
+      secure boot mode"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to
+      indicate secure boot mode"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Copy secure_boot flag in boot params
+      across kexec reboot"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down perf"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) bpf: Restrict kernel image access
+      functions when the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down kprobes"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down /proc/kcore"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the
+      testmmiotrace module"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down module params that specify
+      hardware parameters (eg. ioport)"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down TIOCSSERIAL"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) acpi: Disable APEI error injection if
+      the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) acpi: Disable ACPI table override if
+      the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param
+      when the kernel has been locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) ACPI: Limit access to custom_method
+      when the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) x86: Lock down IO port access when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) PCI: Lock down BAR access when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is
+      locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) hibernate: Disable when the kernel is
+      locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Enforce module signatures if the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add a SysRq option to lift kernel
+      lockdown"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add the ability to lock down access to
+      the running kernel image"
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) efi/x86: Call efi_parse_options() from efi_main()
+    - SAUCE: (efi-lockdown) Fix for module sig verification
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) module: remove support for having IMA validate modules
+    - [Packaging] generate Vcs-Git url from changelog
+    - [Config] CONFIG_SCSI_MQ_DEFAULT=y
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 02 Nov 2018 14:22:55 -0500
+
+linux (4.19.0-3.4) cosmic; urgency=medium
+
+  * Support Edge Gateway's Bluetooth LED (LP: #1798332)
+    - SAUCE: Bluetooth: Support for LED on Edge Gateways
+
+  * Support Edge Gateway's WIFI LED (LP: #1798330)
+    - SAUCE: mwifiex: Switch WiFi LED state according to the device status
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Oct 2018 09:13:39 -0500
+
+linux (4.19.0-2.3) cosmic; urgency=medium
+
+  * fscache: bad refcounting in fscache_op_complete leads to OOPS (LP: #1797314)
+    - SAUCE: fscache: Fix race in decrementing refcount of op->npages
+
+  * Provide mode where all vCPUs on a core must be the same VM (LP: #1792957)
+    - KVM: PPC: Book3S HV: Provide mode where all vCPUs on a core must be the same
+      VM
+
+  * The front MIC can't work on the Lenovo M715 (LP: #1797292)
+    - ALSA: hda/realtek - Fix the problem of the front MIC on the Lenovo M715
+
+  * arm64: snapdragon: WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1016
+    gic_irq_domain_translate (LP: #1797143)
+    - SAUCE: arm64: dts: msm8916: camms: fix gic_irq_domain_translate warnings
+
+  * Dell new AIO requires a new uart backlight driver (LP: #1727235)
+    - SAUCE: platform/x86: dell-uart-backlight: new backlight driver for DELL AIO
+    - updateconfigs for Dell UART backlight driver
+
+  * Please make CONFIG_PWM_LPSS_PCI and CONFIG_PWM_LPSS_PLATFORM built in to
+    make brightness adjustment working on various BayTrail/CherryTrail-based
+    devices (LP: #1783964)
+    - [Config]: Make PWM_LPSS_* built-in
+
+  * check and fix zkey required kernel modules locations in debs, udebs, and
+    initramfs (LP: #1794346)
+    - [Config] add s390 crypto modules to crypt-modules udeb
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_VBOXGUEST=n
+    - ubuntu: vbox -- update to 5.2.18-dfsg-2
+    - ubuntu: enable vbox build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 15 Oct 2018 10:52:04 -0500
+
+linux (4.19.0-1.2) cosmic; urgency=medium
+
+  * Page leaking in cachefiles_read_backing_file while vmscan is active
+    (LP: #1793430)
+    - SAUCE: cachefiles: Page leaking in cachefiles_read_backing_file while vmscan
+      is active
+
+  * SRU: Enable middle button of touchpad on ThinkPad P72 (LP: #1793463)
+    - Input: elantech - enable middle button of touchpad on ThinkPad P72
+
+  * Improvements to the kernel source package preparation (LP: #1793461)
+    - [Packaging] startnewrelease: add support for backport kernels
+
+  * Fix unusable NVIDIA GPU after S3 (LP: #1793338)
+    - SAUCE: PCI: Reprogram bridge prefetch registers on resume
+
+  * Error reported when creating ZFS pool with "-t" option, despite successful
+    pool creation (LP: #1769937)
+    - SAUCE: (noup) Update zfs to 0.7.9-3ubuntu6
+
+  * device hotplug of vfio devices can lead to deadlock in vfio_pci_release
+    (LP: #1792099)
+    - SAUCE: vfio -- release device lock before userspace requests
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] retpoline -- fix temporary filenaming
+    - CONFIG_BCH_CONST_PARAMS=n
+    - Packaging: final-checks: remove trailing backport suffix
+    - SAUCE: import aufs driver
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 25 Sep 2018 16:32:24 -0500
+
+linux (4.19.0-0.1) cosmic; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu -- disable vbox build
+    - Disable zfs build
+    - SAUCE: Import aufs driver
+    - Update dropped.txt
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 13 Sep 2018 07:54:47 -0500
+
+linux (4.19.0-0.0) cosmic; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 13 Sep 2018 06:44:09 -0500
+
+linux (4.18.0-8.9) cosmic; urgency=medium
+
+  * linux: 4.18.0-8.9 -proposed tracker (LP: #1791663)
+
+  * Cosmic update to v4.18.7 stable release (LP: #1791660)
+    - rcu: Make expedited GPs handle CPU 0 being offline
+    - net: 6lowpan: fix reserved space for single frames
+    - net: mac802154: tx: expand tailroom if necessary
+    - 9p/net: Fix zero-copy path in the 9p virtio transport
+    - spi: davinci: fix a NULL pointer dereference
+    - spi: pxa2xx: Add support for Intel Ice Lake
+    - spi: spi-fsl-dspi: Fix imprecise abort on VF500 during probe
+    - spi: cadence: Change usleep_range() to udelay(), for atomic context
+    - mmc: block: Fix unsupported parallel dispatch of requests
+    - mmc: renesas_sdhi_internal_dmac: mask DMAC interrupts
+    - mmc: renesas_sdhi_internal_dmac: fix #define RST_RESERVED_BITS
+    - readahead: stricter check for bdi io_pages
+    - block: fix infinite loop if the device loses discard capability
+    - block: blk_init_allocated_queue() set q->fq as NULL in the fail case
+    - block: really disable runtime-pm for blk-mq
+    - blkcg: Introduce blkg_root_lookup()
+    - block: Introduce blk_exit_queue()
+    - block: Ensure that a request queue is dissociated from the cgroup controller
+    - apparmor: fix bad debug check in apparmor_secid_to_secctx()
+    - dma-buf: Move BUG_ON from _add_shared_fence to _add_shared_inplace
+    - libertas: fix suspend and resume for SDIO connected cards
+    - media: Revert "[media] tvp5150: fix pad format frame height"
+    - mailbox: xgene-slimpro: Fix potential NULL pointer dereference
+    - Replace magic for trusting the secondary keyring with #define
+    - Fix kexec forbidding kernels signed with keys in the secondary keyring to
+      boot
+    - powerpc/fadump: handle crash memory ranges array index overflow
+    - powerpc/64s: Fix page table fragment refcount race vs speculative references
+    - powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.
+    - powerpc/pkeys: Give all threads control of their key permissions
+    - powerpc/pkeys: Deny read/write/execute by default
+    - powerpc/pkeys: key allocation/deallocation must not change pkey registers
+    - powerpc/pkeys: Save the pkey registers before fork
+    - powerpc/pkeys: Fix calculation of total pkeys.
+    - powerpc/pkeys: Preallocate execute-only key
+    - powerpc/nohash: fix pte_access_permitted()
+    - powerpc64/ftrace: Include ftrace.h needed for enable/disable calls
+    - powerpc/powernv/pci: Work around races in PCI bridge enabling
+    - cxl: Fix wrong comparison in cxl_adapter_context_get()
+    - IB/mlx5: Honor cnt_set_id_valid flag instead of set_id
+    - IB/mlx5: Fix leaking stack memory to userspace
+    - IB/srpt: Fix srpt_cm_req_recv() error path (1/2)
+    - IB/srpt: Fix srpt_cm_req_recv() error path (2/2)
+    - IB/srpt: Support HCAs with more than two ports
+    - overflow.h: Add arithmetic shift helper
+    - RDMA/mlx5: Fix shift overflow in mlx5_ib_create_wq
+    - ib_srpt: Fix a use-after-free in srpt_close_ch()
+    - ib_srpt: Fix a use-after-free in __srpt_close_all_ch()
+    - RDMA/rxe: Set wqe->status correctly if an unexpected response is received
+    - 9p: fix multiple NULL-pointer-dereferences
+    - fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr failed
+    - 9p/virtio: fix off-by-one error in sg list bounds check
+    - net/9p/client.c: version pointer uninitialized
+    - net/9p/trans_fd.c: fix race-condition by flushing workqueue before the
+      kfree()
+    - dm integrity: change 'suspending' variable from bool to int
+    - dm thin: stop no_space_timeout worker when switching to write-mode
+    - dm cache metadata: save in-core policy_hint_size to on-disk superblock
+    - dm cache metadata: set dirty on all cache blocks after a crash
+    - dm crypt: don't decrease device limits
+    - dm writecache: fix a crash due to reading past end of dirty_bitmap
+    - uart: fix race between uart_put_char() and uart_shutdown()
+    - Drivers: hv: vmbus: Fix the offer_in_progress in vmbus_process_offer()
+    - Drivers: hv: vmbus: Reset the channel callback in vmbus_onoffer_rescind()
+    - iio: sca3000: Fix missing return in switch
+    - iio: ad9523: Fix displayed phase
+    - iio: ad9523: Fix return value for ad952x_store()
+    - extcon: Release locking when sending the notification of connector state
+    - eventpoll.h: wrap casts in () properly
+    - vmw_balloon: fix inflation of 64-bit GFNs
+    - vmw_balloon: do not use 2MB without batching
+    - vmw_balloon: VMCI_DOORBELL_SET does not check status
+    - vmw_balloon: fix VMCI use when balloon built into kernel
+    - rtc: omap: fix resource leak in registration error path
+    - rtc: omap: fix potential crash on power off
+    - tracing: Do not call start/stop() functions when tracing_on does not change
+    - tracing/blktrace: Fix to allow setting same value
+    - printk/tracing: Do not trace printk_nmi_enter()
+    - livepatch: Validate module/old func name length
+    - uprobes: Use synchronize_rcu() not synchronize_sched()
+    - mfd: hi655x: Fix regmap area declared size for hi655x
+    - ovl: fix wrong use of impure dir cache in ovl_iterate()
+    - ACPICA: AML Parser: skip opcodes that open a scope upon parse failure
+    - ACPICA: Clear status of all events when entering sleep states
+    - drivers/block/zram/zram_drv.c: fix bug storing backing_dev
+    - sched: idle: Avoid retaining the tick when it has been stopped
+    - cpuidle: menu: Handle stopped tick more aggressively
+    - cpufreq: governor: Avoid accessing invalid governor_data
+    - PM / sleep: wakeup: Fix build error caused by missing SRCU support
+    - ALSA: ac97: fix device initialization in the compat layer
+    - ALSA: ac97: fix check of pm_runtime_get_sync failure
+    - ALSA: ac97: fix unbalanced pm_runtime_enable
+    - i2c: designware: Re-init controllers with pm_disabled set on resume
+    - KVM: VMX: fixes for vmentry_l1d_flush module parameter
+    - KVM: PPC: Book3S: Fix guest DMA when guest partially backed by THP pages
+    - xtensa: limit offsets in __loop_cache_{all,page}
+    - xtensa: increase ranges in ___invalidate_{i,d}cache_all
+    - block, bfq: return nbytes and not zero from struct cftype .write() method
+    - pnfs/blocklayout: off by one in bl_map_stripe()
+    - nfsd: fix leaked file lock with nfs exported overlayfs
+    - NFSv4 client live hangs after live data migration recovery
+    - NFSv4: Fix locking in pnfs_generic_recover_commit_reqs
+    - NFSv4: Fix a sleep in atomic context in nfs4_callback_sequence()
+    - ARM: tegra: Fix Tegra30 Cardhu PCA954x reset
+    - ARM: dts: am57xx-idk: Enable dual role for USB2 port
+    - pwm: omap-dmtimer: Return -EPROBE_DEFER if no dmtimer platform data
+    - mm/tlb: Remove tlb_remove_table() non-concurrent condition
+    - iommu/ipmmu-vmsa: Don't register as BUS IOMMU if machine doesn't have IPMMU-
+      VMSA
+    - iommu/vt-d: Add definitions for PFSID
+    - iommu/vt-d: Fix dev iotlb pfsid use
+    - sys: don't hold uts_sem while accessing userspace memory
+    - userns: move user access out of the mutex
+    - ubifs: Fix memory leak in lprobs self-check
+    - Revert "UBIFS: Fix potential integer overflow in allocation"
+    - ubifs: Check data node size before truncate
+    - ubifs: xattr: Don't operate on deleted inodes
+    - ubifs: Fix directory size calculation for symlinks
+    - ubifs: Fix synced_i_size calculation for xattr inodes
+    - pwm: tiehrpwm: Don't use emulation mode bits to control PWM output
+    - pwm: tiehrpwm: Fix disabling of output of PWMs
+    - fb: fix lost console when the user unplugs a USB adapter
+    - udlfb: fix semaphore value leak
+    - udlfb: fix display corruption of the last line
+    - udlfb: don't switch if we are switching to the same videomode
+    - udlfb: set optimal write delay
+    - udlfb: make a local copy of fb_ops
+    - udlfb: handle allocation failure
+    - udlfb: set line_length in dlfb_ops_set_par
+    - getxattr: use correct xattr length
+    - libnvdimm: Use max contiguous area for namespace size
+    - libnvdimm: fix ars_status output length calculation
+    - bcache: release dc->writeback_lock properly in bch_writeback_thread()
+    - kconfig: fix "Can't open ..." in parallel build
+    - perf auxtrace: Fix queue resize
+    - crypto: vmx - Fix sleep-in-atomic bugs
+    - crypto: aesni - Use unaligned loads from gcm_context_data
+    - crypto: arm64/sm4-ce - check for the right CPU feature bit
+    - crypto: caam - fix DMA mapping direction for RSA forms 2 & 3
+    - crypto: caam/jr - fix descriptor DMA unmapping
+    - crypto: caam/qi - fix error path in xts setkey
+    - fs/quota: Fix spectre gadget in do_quotactl
+    - udf: Fix mounting of Win7 created UDF filesystems
+    - cpuidle: menu: Retain tick when shallow state is selected
+    - arm64: mm: always enable CONFIG_HOLES_IN_ZONE
+    - Linux 4.18.7
+
+  * CVE-2017-5715
+    - s390: detect etoken facility
+    - KVM: s390: add etoken support for guests
+
+  * Missing Intel GPU pci-id's (LP: #1789924)
+    - drm/i915/whl: Introducing Whiskey Lake platform
+    - drm/i915/aml: Introducing Amber Lake platform
+    - drm/i915/cfl: Add a new CFL PCI ID.
+
+  * [18.10 FEAT] Add kernel config options for SMC-R/D (LP: #1789934)
+    - s390/ism: add device driver for internal shared memory
+    - CONFIG_ISM=y for s390
+
+  * Cosmic update to v4.18.6 stable release (LP: #1791105)
+    - PATCH scripts/kernel-doc
+    - scripts/kernel-doc: Escape all literal braces in regexes
+    - scsi: libsas: dynamically allocate and free ata host
+    - xprtrdma: Fix disconnect regression
+    - mei: don't update offset in write
+    - cifs: add missing support for ACLs in SMB 3.11
+    - CIFS: fix uninitialized ptr deref in smb2 signing
+    - cifs: add missing debug entries for kconfig options
+    - cifs: use a refcount to protect open/closing the cached file handle
+    - cifs: check kmalloc before use
+    - smb3: enumerating snapshots was leaving part of the data off end
+    - smb3: Do not send SMB3 SET_INFO if nothing changed
+    - smb3: don't request leases in symlink creation and query
+    - smb3: fill in statfs fsid and correct namelen
+    - btrfs: use correct compare function of dirty_metadata_bytes
+    - btrfs: don't leak ret from do_chunk_alloc
+    - Btrfs: fix mount failure after fsync due to hard link recreation
+    - Btrfs: fix btrfs_write_inode vs delayed iput deadlock
+    - Btrfs: fix send failure when root has deleted files still open
+    - Btrfs: send, fix incorrect file layout after hole punching beyond eof
+    - hwmon: (k10temp) 27C Offset needed for Threadripper2
+    - bpf, arm32: fix stack var offset in jit
+    - regulator: arizona-ldo1: Use correct device to get enable GPIO
+    - iommu/arm-smmu: Error out only if not enough context interrupts
+    - printk: Split the code for storing a message into the log buffer
+    - printk: Create helper function to queue deferred console handling
+    - printk/nmi: Prevent deadlock when accessing the main log buffer in NMI
+    - kprobes/arm64: Fix %p uses in error messages
+    - arm64: Fix mismatched cache line size detection
+    - arm64: Handle mismatched cache type
+    - arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid()
+    - arm64: dts: rockchip: corrected uart1 clock-names for rk3328
+    - KVM: arm/arm64: Fix potential loss of ptimer interrupts
+    - KVM: arm/arm64: Fix lost IRQs from emulated physcial timer when blocked
+    - KVM: arm/arm64: Skip updating PMD entry if no change
+    - KVM: arm/arm64: Skip updating PTE entry if no change
+    - s390/kvm: fix deadlock when killed by oom
+    - perf kvm: Fix subcommands on s390
+    - stop_machine: Reflow cpu_stop_queue_two_works()
+    - stop_machine: Atomically queue and wake stopper threads
+    - ext4: check for NUL characters in extended attribute's name
+    - ext4: use ext4_warning() for sb_getblk failure
+    - ext4: sysfs: print ext4_super_block fields as little-endian
+    - ext4: reset error code in ext4_find_entry in fallback
+    - ext4: fix race when setting the bitmap corrupted flag
+    - x86/gpu: reserve ICL's graphics stolen memory
+    - platform/x86: wmi: Do not mix pages and kmalloc
+    - platform/x86: ideapad-laptop: Apply no_hw_rfkill to Y20-15IKBM, too
+    - mm: move tlb_table_flush to tlb_flush_mmu_free
+    - mm/tlb, x86/mm: Support invalidating TLB caches for RCU_TABLE_FREE
+    - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
+    - x86/speculation/l1tf: Fix off-by-one error when warning that system has too
+      much RAM
+    - x86/speculation/l1tf: Suggest what to do on systems with too much RAM
+    - x86/vdso: Fix vDSO build if a retpoline is emitted
+    - x86/process: Re-export start_thread()
+    - KVM: x86: ensure all MSRs can always be KVM_GET/SET_MSR'd
+    - KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled
+    - fuse: Don't access pipe->buffers without pipe_lock()
+    - fuse: fix initial parallel dirops
+    - fuse: fix double request_end()
+    - fuse: fix unlocked access to processing queue
+    - fuse: umount should wait for all requests
+    - fuse: Fix oops at process_init_reply()
+    - fuse: Add missed unlock_page() to fuse_readpages_fill()
+    - lib/vsprintf: Do not handle %pO[^F] as %px
+    - udl-kms: change down_interruptible to down
+    - udl-kms: handle allocation failure
+    - udl-kms: fix crash due to uninitialized memory
+    - udl-kms: avoid division
+    - b43legacy/leds: Ensure NUL-termination of LED name string
+    - b43/leds: Ensure NUL-termination of LED name string
+    - ASoC: dpcm: don't merge format from invalid codec dai
+    - ASoC: zte: Fix incorrect PCM format bit usages
+    - ASoC: sirf: Fix potential NULL pointer dereference
+    - ASoC: wm_adsp: Correct DSP pointer for preloader control
+    - soc: qcom: rmtfs-mem: fix memleak in probe error paths
+    - pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show()
+    - scsi: qla2xxx: Fix stalled relogin
+    - x86/vdso: Fix lsl operand order
+    - x86/nmi: Fix NMI uaccess race against CR3 switching
+    - x86/irqflags: Mark native_restore_fl extern inline
+    - x86/spectre: Add missing family 6 check to microcode check
+    - x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
+    - hwmon: (nct6775) Fix potential Spectre v1
+    - x86/entry/64: Wipe KASAN stack shadow before rewind_stack_do_exit()
+    - x86: Allow generating user-space headers without a compiler
+    - s390/mm: fix addressing exception after suspend/resume
+    - s390/lib: use expoline for all bcr instructions
+    - s390: fix br_r1_trampoline for machines without exrl
+    - s390/qdio: reset old sbal_state flags
+    - s390/numa: move initial setup of node_to_cpumask_map
+    - s390/purgatory: Fix crash with expoline enabled
+    - s390/purgatory: Add missing FORCE to Makefile targets
+    - kprobes: Show blacklist addresses as same as kallsyms does
+    - kprobes: Replace %p with other pointer types
+    - kprobes/arm: Fix %p uses in error messages
+    - kprobes: Make list and blacklist root user read only
+    - MIPS: Correct the 64-bit DSP accumulator register size
+    - MIPS: memset.S: Fix byte_fixup for MIPSr6
+    - MIPS: Always use -march=<arch>, not -<arch> shortcuts
+    - MIPS: Change definition of cpu_relax() for Loongson-3
+    - MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7
+    - tpm: Return the actual size when receiving an unsupported command
+    - tpm: separate cmd_ready/go_idle from runtime_pm
+    - scsi: mpt3sas: Fix calltrace observed while running IO & reset
+    - scsi: mpt3sas: Fix _transport_smp_handler() error path
+    - scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
+    - scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock
+    - iscsi target: fix session creation failure handling
+    - mtd: rawnand: hynix: Use ->exec_op() in hynix_nand_reg_write_op()
+    - mtd: rawnand: fsmc: Stop using chip->read_buf()
+    - mtd: rawnand: marvell: add suspend and resume hooks
+    - mtd: rawnand: qcom: wait for desc completion in all BAM channels
+    - clk: rockchip: fix clk_i2sout parent selection bits on rk3399
+    - clk: npcm7xx: fix memory allocation
+    - PM / clk: signedness bug in of_pm_clk_add_clks()
+    - power: generic-adc-battery: fix out-of-bounds write when copying channel
+      properties
+    - power: generic-adc-battery: check for duplicate properties copied from iio
+      channels
+    - watchdog: Mark watchdog touch functions as notrace
+    - cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status
+    - x86/dumpstack: Don't dump kernel memory based on usermode RIP
+    - Linux 4.18.6
+    - updateconfigs after v4.18.6 stable update
+
+  * random oopses on s390 systems using NVMe devices (LP: #1790480)
+    - s390/pci: fix out of bounds access during irq setup
+
+  * [18.10 FEAT] zcrypt DD: introduce APQN tags to support deterministic driver
+    binding (LP: #1784331)
+    - s390/zcrypt: code beautify
+    - s390/zcrypt: AP bus support for alternate driver(s)
+    - s390/zcrypt: hex string mask improvements for apmask and aqmask.
+
+  * performance drop with ATS enabled (LP: #1788097)
+    - powerpc/powernv: Fix concurrency issue with npu->mmio_atsd_usage
+
+  * Fix MCE handling for user access of poisoned device-dax mapping
+    (LP: #1774366)
+    - device-dax: Convert to vmf_insert_mixed and vm_fault_t
+    - device-dax: Enable page_mapping()
+    - device-dax: Set page->index
+    - filesystem-dax: Set page->index
+    - mm, madvise_inject_error: Disable MADV_SOFT_OFFLINE for ZONE_DEVICE pages
+    - mm, dev_pagemap: Do not clear ->mapping on final put
+    - mm, madvise_inject_error: Let memory_failure() optionally take a page
+      reference
+    - mm, memory_failure: Collect mapping size in collect_procs()
+    - filesystem-dax: Introduce dax_lock_mapping_entry()
+    - mm, memory_failure: Teach memory_failure() about dev_pagemap pages
+    - x86/mm/pat: Prepare {reserve, free}_memtype() for "decoy" addresses
+    - x86/memory_failure: Introduce {set, clear}_mce_nospec()
+    - libnvdimm, pmem: Restore page attributes when clearing errors
+
+  * Reconcile hns3 SAUCE patches with upstream (LP: #1787477)
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix comments for
+      hclge_get_ring_chain_from_mbx"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for using wrong mask and
+      shift in hclge_get_ring_chain_from_mbx"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for reset_level default
+      assignment probelm"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unnecessary ring
+      configuration operation while resetting"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix return value error in
+      hns3_reset_notify_down_enet"
+    - Revert "UBUNTU: SAUCE: net: hns3: Fix for phy link issue when using marvell
+      phy driver"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: separate roce from nic when
+      resetting"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: correct reset event status
+      register"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: prevent to request reset
+      frequently"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: reset net device with rtnl_lock"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify the order of initializeing
+      command queue register"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: prevent sending command during
+      global or core reset"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Use roce handle when calling roce
+      callback function"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove the warning when clear
+      reset cause"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix get_vector ops in
+      hclgevf_main module"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix warning bug when doing lp
+      selftest"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add configure for mac minimal
+      frame size"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for mailbox message truncated
+      problem"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for l4 checksum offload bug"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for waterline not setting
+      correctly"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for mac pause not disable in
+      pfc mode"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix tc setup when netdev is first
+      up"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add calling roce callback
+      function when link status change"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: optimize the process of notifying
+      roce client"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add pf reset for hip08 RoCE"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add SPDX tags to hns3 driver"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused struct member and
+      definition"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix mislead parameter name"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify inconsistent bit mask
+      macros"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use decimal for bit offset
+      macros"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix unreasonable code comments"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove extra space and brackets"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: standardize the handle of return
+      value"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some redundant
+      assignments"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify hnae_ to hnae3_"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use dma_zalloc_coherent instead
+      of kzalloc/dma_map_single"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: give default option while
+      dependency HNS3 set"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some unused members of
+      some structures"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove a redundant
+      hclge_cmd_csq_done"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: using modulo for cyclic counters
+      in hclge_cmd_send"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: simplify hclge_cmd_csq_clean"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some redundant
+      assignments"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove useless code in
+      hclge_cmd_send"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused
+      hclge_ring_to_dma_dir"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use lower_32_bits and
+      upper_32_bits"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove back in struct hclge_hw"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add unlikely for error check"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove the Redundant put_vector
+      in hns3_client_uninit"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: print the ret value in error
+      information"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: extraction an interface for state
+      state init|uninit"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused head file in
+      hnae3.c"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add l4_type check for both ipv4
+      and ipv6"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add vector status check before
+      free vector"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: rename the interface for
+      init_client_instance and uninit_client_instance"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove hclge_get_vector_index
+      from hclge_bind_ring_with_vector"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: RX BD information valid only in
+      last BD except VLD bit and buffer size"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add support for serdes loopback
+      selftest"
+    - net: hns3: Updates RX packet info fetch in case of multi BD
+    - net: hns3: remove hclge_get_vector_index from hclge_bind_ring_with_vector
+    - net: hns3: rename the interface for init_client_instance and
+      uninit_client_instance
+    - net: hns3: add vector status check before free vector
+    - net: hns3: add l4_type check for both ipv4 and ipv6
+    - net: hns3: add unlikely for error check
+    - net: hns3: remove unused head file in hnae3.c
+    - net: hns3: extraction an interface for state init|uninit
+    - net: hns3: print the ret value in error information
+    - net: hns3: remove the Redundant put_vector in hns3_client_uninit
+    - net: hns3: remove back in struct hclge_hw
+    - net: hns3: use lower_32_bits and upper_32_bits
+    - net: hns3: remove unused hclge_ring_to_dma_dir
+    - net: hns3: remove useless code in hclge_cmd_send
+    - net: hns3: remove some redundant assignments
+    - net: hns3: simplify hclge_cmd_csq_clean
+    - net: hns3: remove a redundant hclge_cmd_csq_done
+    - net: hns3: remove some unused members of some structures
+    - net: hns3: give default option while dependency HNS3 set
+    - net: hns3: use dma_zalloc_coherent instead of kzalloc/dma_map_single
+    - net: hns3: modify hnae_ to hnae3_
+    - net: hns3: Fix tc setup when netdev is first up
+    - net: hns3: Fix for mac pause not disable in pfc mode
+    - net: hns3: Fix for waterline not setting correctly
+    - net: hns3: Fix for l4 checksum offload bug
+    - net: hns3: Fix for mailbox message truncated problem
+    - net: hns3: Add configure for mac minimal frame size
+    - net: hns3: Fix warning bug when doing lp selftest
+    - net: hns3: Fix get_vector ops in hclgevf_main module
+    - net: hns3: Remove the warning when clear reset cause
+    - net: hns3: Prevent sending command during global or core reset
+    - net: hns3: Modify the order of initializing command queue register
+    - net: hns3: Reset net device with rtnl_lock
+    - net: hns3: Prevent to request reset frequently
+    - net: hns3: Correct reset event status register
+    - net: hns3: Fix return value error in hns3_reset_notify_down_enet
+    - net: hns3: remove unnecessary ring configuration operation while resetting
+    - net: hns3: Fix for reset_level default assignment probelm
+    - net: hns3: Fix for using wrong mask and shift in
+      hclge_get_ring_chain_from_mbx
+    - net: hns3: Fix comments for hclge_get_ring_chain_from_mbx
+    - net: hns3: Remove some redundant assignments
+    - net: hns3: Standardize the handle of return value
+    - net: hns3: Remove extra space and brackets
+    - net: hns3: Correct unreasonable code comments
+    - net: hns3: Use decimal for bit offset macros
+    - net: hns3: Modify inconsistent bit mask macros
+    - net: hns3: Fix misleading parameter name
+    - net: hns3: Remove unused struct member and definition
+    - net: hns3: Add SPDX tags to HNS3 PF driver
+    - net: hns3: Add support for serdes loopback selftest
+    - net: hns3: Fix for phy link issue when using marvell phy driver
+
+  * [Regression] kernel crashdump fails on arm64 (LP: #1786878)
+    - arm64: export memblock_reserve()d regions via /proc/iomem
+    - drivers: acpi: add dependency of EFI for arm64
+    - efi/arm: preserve early mapping of UEFI memory map longer for BGRT
+    - efi/arm: map UEFI memory map even w/o runtime services enabled
+    - arm64: acpi: fix alignment fault in accessing ACPI
+    - [Config] CONFIG_ARCH_SUPPORTS_ACPI=y
+    - arm64: fix ACPI dependencies
+    - ACPI: fix menuconfig presentation of ACPI submenu
+
+  * TB 16 issue on Dell Lattitude 7490 with large amount of data (LP: #1785780)
+    - r8152: disable RX aggregation on new Dell TB16 dock
+
+  * Support Power Management for Thunderbolt Controller  (LP: #1789358)
+    - thunderbolt: Use 64-bit DMA mask if supported by the platform
+    - thunderbolt: Do not unnecessarily call ICM get route
+    - thunderbolt: No need to take tb->lock in domain suspend/complete
+    - thunderbolt: Use correct ICM commands in system suspend
+    - thunderbolt: Add support for runtime PM
+
+  * Enable AMD PCIe MP2 for AMDI0011 (LP: #1773940)
+    - SAUCE: i2c:amd I2C Driver based on PCI Interface for upcoming platform
+    - SAUCE: i2c:amd move out pointer in union i2c_event_base
+    - SAUCE: i2c:amd Depends on ACPI
+    - [Config] i2c: CONFIG_I2C_AMD_MP2=y on x86
+
+  * Microphone cannot be detected with front panel audio combo jack on HP Z8-G4
+    machine (LP: #1789145)
+    - ALSA: hda/realtek - Fix HP Headset Mic can't record
+
+  * Please enable CONFIG_PAGE_POISONING (LP: #1783651)
+    - [Config] Enable CONFIG_PAGE_POISONING configs
+
+  * Tango platform uses __initcall without further checks (LP: #1787945)
+    - [Config] disable ARCH_TANGO
+
+  * [18.10 FEAT] SMC-Direct (LP: #1786902)
+    - net/smc: determine port attributes independent from pnet table
+    - net/smc: add pnetid support
+    - net/smc: add base infrastructure for SMC-D and ISM
+    - net/smc: add pnetid support for SMC-D and ISM
+    - net/smc: add SMC-D support in CLC messages
+    - net/smc: add SMC-D support in data transfer
+    - net/smc: add SMC-D support in af_smc
+    - net/smc: add SMC-D diag support
+    - net/smc: provide smc mode in smc_diag.c
+    - net/smc: eliminate cursor read and write calls
+    - net/smc: add function to get link group from link
+    - net/smc: use DECLARE_BITMAP for rtokens_used_mask
+    - net/smc: remove local variable page in smc_rx_splice()
+    - net/smc: Remove a WARN_ON() statement
+    - net/smc: Simplify ib_post_(send|recv|srq_recv)() calls
+    - net/smc: fewer parameters for smc_llc_send_confirm_link()
+    - net/smc: use correct vlan gid of RoCE device
+    - net/smc: provide fallback reason code
+    - net/smc: improve delete link processing
+    - net: simplify sock_poll_wait
+    - net/smc: send response to test link signal
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations for CONFIG_CRYPTO_SPECK_NEON
+    - [Config] fix up annotatios for CONFIG_CRYPTO_SPECK
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 10 Sep 2018 07:08:38 -0500
+
+linux (4.18.0-7.8) cosmic; urgency=medium
+
+  * linux: 4.18.0-7.8 -proposed tracker (LP: #1789459)
+
+  * pmtu.sh fails on 4.18 kernel (LP: #1789436)
+    - SAUCE: Revert "vti6: fix PMTU caching and reporting on xmit"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Aug 2018 11:08:51 -0500
+
+linux (4.18.0-6.7) cosmic; urgency=medium
+
+  * linux: 4.18.0-6.7 -proposed tracker (LP: #1788881)
+
+  * systemd 237-3ubuntu10 ADT test failure with linux 4.18.0-5.6 (LP: #1787440)
+    - Config: Disable BPF_JIT_ALWAYS_ON on i386
+
+  * execveat03 in ubuntu_ltp_syscalls failed on X/B (LP: #1786729)
+    - cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()
+
+  * Cosmic update to v4.18.5 stable release (LP: #1788874)
+    - EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[]
+    - pty: fix O_CLOEXEC for TIOCGPTPEER
+    - mm: Allow non-direct-map arguments to free_reserved_area()
+    - x86/mm/init: Pass unconverted symbol addresses to free_init_pages()
+    - x86/mm/init: Add helper for freeing kernel image pages
+    - x86/mm/init: Remove freed kernel image areas from alias mapping
+    - powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2
+    - ext4: fix spectre gadget in ext4_mb_regular_allocator()
+    - drm/i915/kvmgt: Fix potential Spectre v1
+    - drm/amdgpu/pm: Fix potential Spectre v1
+    - parisc: Remove unnecessary barriers from spinlock.h
+    - parisc: Remove ordered stores from syscall.S
+    - PCI: Restore resized BAR state on resume
+    - PCI / ACPI / PM: Resume all bridges on suspend-to-RAM
+    - PCI: hotplug: Don't leak pci_slot on registration failure
+    - PCI: aardvark: Size bridges before resources allocation
+    - PCI: Skip MPS logic for Virtual Functions (VFs)
+    - PCI: pciehp: Fix use-after-free on unplug
+    - PCI: pciehp: Fix unprotected list iteration in IRQ handler
+    - i2c: core: ACPI: Properly set status byte to 0 for multi-byte writes
+    - i2c: imx: Fix race condition in dma read
+    - reiserfs: fix broken xattr handling (heap corruption, bad retval)
+    - Linux 4.18.5
+
+  * [18.10 FEAT] Add kernel config option "CONFIG_SCLP_OFB" (LP: #1787898)
+    - [Config] CONFIG_SCLP_OFB=y for s390x
+
+  * errors when scanning partition table of corrupted AIX disk (LP: #1787281)
+    - partitions/aix: fix usage of uninitialized lv_info and lvname structures
+    - partitions/aix: append null character to print data from disk
+
+  * Apply NVMe bugfix from Google that bjf asked for (LP: #1787635)
+    - nvme-pci: add a memory barrier to nvme_dbbuf_update_and_check_event
+
+  * ThinkPad systems have no HDMI sound when using the nvidia GPU (LP: #1787058)
+    - ACPI / OSI: Add OEM _OSI string to enable NVidia HDMI audio
+
+  * Cosmic update to v4.18.4 stable release (LP: #1788454)
+    - l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache
+    - net_sched: fix NULL pointer dereference when delete tcindex filter
+    - net_sched: Fix missing res info when create new tc_index filter
+    - r8169: don't use MSI-X on RTL8168g
+    - ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs
+    - ALSA: hda - Turn CX8200 into D3 as well upon reboot
+    - ALSA: vx222: Fix invalid endian conversions
+    - ALSA: virmidi: Fix too long output trigger loop
+    - ALSA: cs5535audio: Fix invalid endian conversion
+    - ALSA: dice: fix wrong copy to rx parameters for Alesis iO26
+    - ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry
+    - ALSA: memalloc: Don't exceed over the requested size
+    - ALSA: vxpocket: Fix invalid endian conversions
+    - ALSA: seq: Fix poll() error return
+    - media: gl861: fix probe of dvb_usb_gl861
+    - USB: serial: sierra: fix potential deadlock at close
+    - USB: serial: pl2303: add a new device id for ATEN
+    - USB: option: add support for DW5821e
+    - ACPI / PM: save NVS memory for ASUS 1025C laptop
+    - tty: serial: 8250: Revert NXP SC16C2552 workaround
+    - serial: 8250_exar: Read INT0 from slave device, too
+    - serial: 8250_dw: always set baud rate in dw8250_set_termios
+    - serial: 8250_dw: Add ACPI support for uart on Broadcom SoC
+    - uio: fix wrong return value from uio_mmap()
+    - misc: sram: fix resource leaks in probe error path
+    - Revert "uio: use request_threaded_irq instead"
+    - Bluetooth: avoid killing an already killed socket
+    - isdn: Disable IIOCDBGVAR
+    - net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd()
+    - hv/netvsc: Fix NULL dereference at single queue mode fallback
+    - r8169: don't use MSI-X on RTL8106e
+    - ip_vti: fix a null pointer deferrence when create vti fallback tunnel
+    - net: ethernet: mvneta: Fix napi structure mixup on armada 3700
+    - net: mvneta: fix mvneta_config_rss on armada 3700
+    - cls_matchall: fix tcf_unbind_filter missing
+    - Linux 4.18.4
+
+  * Cosmic update to v4.18.3 stable release (LP: #1788453)
+    - x86/speculation/l1tf: Exempt zeroed PTEs from inversion
+    - Linux 4.18.3
+
+  * Cosmic update to v4.18.2 stable release (LP: #1788452)
+    - x86/l1tf: Fix build error seen if CONFIG_KVM_INTEL is disabled
+    - x86: i8259: Add missing include file
+    - x86/hyper-v: Check for VP_INVAL in hyperv_flush_tlb_others()
+    - x86/platform/UV: Mark memblock related init code and data correctly
+    - x86/mm/pti: Clear Global bit more aggressively
+    - xen/pv: Call get_cpu_address_sizes to set x86_virt/phys_bits
+    - x86/mm: Disable ioremap free page handling on x86-PAE
+    - kbuild: verify that $DEPMOD is installed
+    - crypto: ccree - fix finup
+    - crypto: ccree - fix iv handling
+    - crypto: ccp - Check for NULL PSP pointer at module unload
+    - crypto: ccp - Fix command completion detection race
+    - crypto: x86/sha256-mb - fix digest copy in sha256_mb_mgr_get_comp_job_avx2()
+    - crypto: vmac - require a block cipher with 128-bit block size
+    - crypto: vmac - separate tfm and request context
+    - crypto: blkcipher - fix crash flushing dcache in error path
+    - crypto: ablkcipher - fix crash flushing dcache in error path
+    - crypto: skcipher - fix aligning block size in skcipher_copy_iv()
+    - crypto: skcipher - fix crash flushing dcache in error path
+    - ioremap: Update pgtable free interfaces with addr
+    - x86/mm: Add TLB purge to free pmd/pte page interfaces
+    - Linux 4.18.2
+
+  * Cosmic update to v4.18.2 stable release (LP: #1788452) // CVE-2018-9363
+    - Bluetooth: hidp: buffer overflow in hidp_process_report
+
+  * linux-cloud-tools-common: Ensure hv-kvp-daemon.service starts before
+    walinuxagent.service (LP: #1739107)
+    - [Debian] hyper-v -- Ensure that hv-kvp-daemon.service starts before
+      walinuxagent.service
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: ipvs: remove nbsp characters from Kconfig
+    - [Config] CONFIG_MPROFILE_KERNEL=y for ppc64el
+    - [Config] CONFIG_DRM_RCAR_LVDS=m for snapdragon
+    - [Config] CONFIG_MDIO_MSCC_MIIM=n for s390x
+    - [Config] CONFIG_NET_VENDOR_MICROSEMI=n, CONFIG_NET_VENDOR_NI=n for s390x
+    - [Config] update annotations following config review
+    - [Debian] set CROSS_COMPILE when generating kernel configs
+    - [Config] Disable the Speck cipher
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 24 Aug 2018 14:18:15 -0500
+
+linux (4.18.0-5.6) cosmic; urgency=medium
+
+  * Cosmic update to v4.18.1 stable release (LP: #1787264)
+    - x86/paravirt: Fix spectre-v2 mitigations for paravirt guests
+    - x86/speculation: Protect against userspace-userspace spectreRSB
+    - kprobes/x86: Fix %p uses in error messages
+    - x86/irqflags: Provide a declaration for native_save_fl
+    - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
+    - x86/speculation/l1tf: Change order of offset/type in swap entry
+    - x86/speculation/l1tf: Protect swap entries against L1TF
+    - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
+    - x86/speculation/l1tf: Make sure the first page is always reserved
+    - x86/speculation/l1tf: Add sysfs reporting for l1tf
+    - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
+    - x86/speculation/l1tf: Limit swap file size to MAX_PA/2
+    - x86/bugs: Move the l1tf function and define pr_fmt properly
+    - sched/smt: Update sched_smt_present at runtime
+    - x86/smp: Provide topology_is_primary_thread()
+    - x86/topology: Provide topology_smt_supported()
+    - cpu/hotplug: Make bringup/teardown of smp threads symmetric
+    - cpu/hotplug: Split do_cpu_down()
+    - cpu/hotplug: Provide knobs to control SMT
+    - x86/cpu: Remove the pointless CPU printout
+    - x86/cpu/AMD: Remove the pointless detect_ht() call
+    - x86/cpu/common: Provide detect_ht_early()
+    - x86/cpu/topology: Provide detect_extended_topology_early()
+    - x86/cpu/intel: Evaluate smp_num_siblings early
+    - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info
+    - x86/cpu/AMD: Evaluate smp_num_siblings early
+    - x86/apic: Ignore secondary threads if nosmt=force
+    - x86/speculation/l1tf: Extend 64bit swap file size limit
+    - x86/cpufeatures: Add detection of L1D cache flush support.
+    - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings
+    - x86/speculation/l1tf: Protect PAE swap entries against L1TF
+    - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
+    - Revert "x86/apic: Ignore secondary threads if nosmt=force"
+    - cpu/hotplug: Boot HT siblings at least once
+    - x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present
+    - x86/KVM/VMX: Add module argument for L1TF mitigation
+    - x86/KVM/VMX: Add L1D flush algorithm
+    - x86/KVM/VMX: Add L1D MSR based flush
+    - x86/KVM/VMX: Add L1D flush logic
+    - x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers
+    - x86/KVM/VMX: Add find_msr() helper function
+    - x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting
+    - x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
+    - x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
+    - cpu/hotplug: Online siblings when SMT control is turned on
+    - x86/litf: Introduce vmx status variable
+    - x86/kvm: Drop L1TF MSR list approach
+    - x86/l1tf: Handle EPT disabled state proper
+    - x86/kvm: Move l1tf setup function
+    - x86/kvm: Add static key for flush always
+    - x86/kvm: Serialize L1D flush parameter setter
+    - x86/kvm: Allow runtime control of L1D flush
+    - cpu/hotplug: Expose SMT control init function
+    - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early
+    - x86/bugs, kvm: Introduce boot-time control of L1TF mitigations
+    - Documentation: Add section about CPU vulnerabilities
+    - x86/speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures
+    - x86/KVM/VMX: Initialize the vmx_l1d_flush_pages' content
+    - Documentation/l1tf: Fix typos
+    - cpu/hotplug: detect SMT disabled by BIOS
+    - x86/KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush()
+    - x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond'
+    - x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()
+    - x86/irq: Demote irq_cpustat_t::__softirq_pending to u16
+    - x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d
+    - x86: Don't include linux/irq.h from asm/hardirq.h
+    - x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d
+    - x86/KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr()
+    - Documentation/l1tf: Remove Yonah processors from not vulnerable list
+    - x86/speculation: Simplify sysfs report of VMX L1TF vulnerability
+    - x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry
+    - KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry
+    - cpu/hotplug: Fix SMT supported evaluation
+    - x86/speculation/l1tf: Invert all not present mappings
+    - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
+    - x86/mm/pat: Make set_memory_np() L1TF safe
+    - x86/mm/kmmio: Make the tracer robust against L1TF
+    - tools headers: Synchronise x86 cpufeatures.h for L1TF additions
+    - x86/microcode: Allow late microcode loading with SMT disabled
+    - x86/smp: fix non-SMP broken build due to redefinition of
+      apic_id_is_primary_thread
+    - cpu/hotplug: Non-SMP machines do not make use of booted_once
+    - x86/init: fix build with CONFIG_SWAP=n
+    - Linux 4.18.1
+    - [Config] updateconfigs after v4.18.1 stable update
+
+  * Consider enabling CONFIG_NETWORK_PHY_TIMESTAMPING (LP: #1785816)
+    - [Config] Enable timestamping in network PHY devices
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_SYSCTL_SYSCALL=n
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 15 Aug 2018 14:20:59 -0500
+
+linux (4.18.0-4.5) cosmic; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Aug 2018 13:54:02 -0500
+
+linux (4.18.0-3.4) cosmic; urgency=medium
+
+  * Suspend fails in Ubuntu and Kubuntu 18.04 but works fine in Ubuntu and
+    Kubuntu 17.10 (and on Kubuntu 18.04 using kernel 4.14.47) (LP: #1774950)
+    - ACPI / LPSS: Avoid PM quirks on suspend and resume from hibernation
+
+  * hinic interfaces aren't getting predictable names (LP: #1783138)
+    - hinic: Link the logical network device to the pci device in sysfs
+
+  * libvirtd is unable to configure bridge devices inside of LXD containers
+    (LP: #1784501)
+    - kernfs: allow creating kernfs objects with arbitrary uid/gid
+    - sysfs, kobject: allow creating kobject belonging to arbitrary users
+    - kobject: kset_create_and_add() - fetch ownership info from parent
+    - driver core: set up ownership of class devices in sysfs
+    - net-sysfs: require net admin in the init ns for setting tx_maxrate
+    - net-sysfs: make sure objects belong to container's owner
+    - net: create reusable function for getting ownership info of sysfs inodes
+    - bridge: make sure objects belong to container's owner
+    - sysfs: Fix regression when adding a file to an existing group
+
+  * locking sockets broken due to missing AppArmor socket mediation patches
+    (LP: #1780227)
+    - UBUNTU SAUCE: apparmor: fix apparmor mediating locking non-fs, unix sockets
+
+  * Update2 for ocxl driver (LP: #1781436)
+    - ocxl: Fix page fault handler in case of fault on dying process
+
+  * HDMI/DP audio can't work on the laptop of Dell Latitude 5495 (LP: #1782689)
+    - ALSA: hda: use PCI_BASE_CLASS_DISPLAY to replace PCI_CLASS_DISPLAY_VGA
+    - vga_switcheroo: set audio client id according to bound GPU id
+
+  * Allow Raven Ridge's audio controller to be runtime suspended (LP: #1782540)
+    - ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge
+
+  * Invoking obsolete 'firmware_install' target breaks snap build (LP: #1782166)
+    - snapcraft.yaml: stop invoking the obsolete (and non-existing)
+      'firmware_install' target
+
+  * snapcraft.yaml: missing ubuntu-retpoline-extract-one script breaks the build
+    (LP: #1782116)
+    - snapcraft.yaml: copy retpoline-extract-one to scripts before build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 01 Aug 2018 08:49:40 -0500
+
+linux (4.18.0-2.3) cosmic; urgency=medium
+
+  * Kernel error "task zfs:pid blocked for more than 120 seconds" (LP: #1781364)
+    - SAUCE: (noup) zfs to 0.7.9-3ubuntu4
+
+  * [Regression] EXT4-fs error (device sda1): ext4_validate_inode_bitmap:99:
+    comm stress-ng: Corrupt inode bitmap (LP: #1780137)
+    - SAUCE: ext4: fix ext4_validate_inode_bitmap: comm stress-ng: Corrupt inode
+      bitmap
+
+  * Cloud-init causes potentially huge boot delays with 4.15 kernels
+    (LP: #1780062)
+    - random: Make getrandom() ready earlier
+
+  * hisi_sas_v3_hw: internal task abort: timeout and not done. (LP: #1777736)
+    - scsi: hisi_sas: Update a couple of register settings for v3 hw
+
+  * hisi_sas: Add missing PHY spinlock init (LP: #1777734)
+    - scsi: hisi_sas: Add missing PHY spinlock init
+
+  * hisi_sas: improve read performance by pre-allocating slot DMA buffers
+    (LP: #1777727)
+    - scsi: hisi_sas: Use dmam_alloc_coherent()
+    - scsi: hisi_sas: Pre-allocate slot DMA buffers
+
+  * hisi_sas: Failures during host reset (LP: #1777696)
+    - scsi: hisi_sas: Only process broadcast change in phy_bcast_v3_hw()
+    - scsi: hisi_sas: Fix the conflict between dev gone and host reset
+    - scsi: hisi_sas: Adjust task reject period during host reset
+    - scsi: hisi_sas: Add a flag to filter PHY events during reset
+    - scsi: hisi_sas: Release all remaining resources in clear nexus ha
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.9-3ubuntu2, zfs to 0.7.9-3ubuntu3
+    - SAUCE: mm: Fix exports that inadvertently make put_page() EXPORT_SYMBOL_GPL
+    - Enable zfs build
+    - SAUCE: Import aufs driver
+    - Revert "UBUNTU: [Config]: set CONFIG_EDAC_DEBUG=y for ARM64"
+    - [Config] retpoline -- review and accept retpoline changes
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc5
+  * Rebase to v4.18-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 24 Jul 2018 08:41:22 -0500
+
+linux (4.18.0-1.2) cosmic; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 09 Jul 2018 07:36:31 -0500
+
+linux (4.18.0-0.1) cosmic; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu -- disable vbox build
+    - Disable zfs build
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) ima: require secure_boot rules in lockdown mode
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) lockdown: fix coordination of kernel module signature
+      verification
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Don't print secure boot state from the efi stub
+    - SAUCE: (namespace) block_dev: Support checking inode permissions in
+      lookup_bdev()
+    - SAUCE: (namespace) block_dev: Check permissions towards block device inode
+      when mounting
+    - SAUCE: (namespace) mtd: Check permissions towards mtd block device inode
+      when mounting
+    - SAUCE: (namespace) ext4: Add support for unprivileged mounts from user
+      namespaces
+    - SAUCE: (namespace) ext4: Add module parameter to enable user namespace
+      mounts
+    - SAUCE: (namespace) block_dev: Forbid unprivileged mounting when device is
+      opened for writing
+    - SAUCE: Import aufs driver
+    - Update dropped.txt
+    - [Config] updateconfigs after 4.18-rc3 rebase
+    - SAUCE: (no-up): ASoC: Intel: bytcr-rt5660: Remove snd_soc_codec use for 4.18
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 06 Jul 2018 10:46:37 -0500
+
+linux (4.18.0-0.0) cosmic; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 03 Jul 2018 11:10:33 -0500
+
+linux (4.17.0-4.5) cosmic; urgency=medium
+
+  * linux: 4.17.0-4.5 -proposed tracker (LP: #1779399)
+
+  * Update to ocxl driver for 18.04.1 (LP: #1775786)
+    - powerpc: Add TIDR CPU feature for POWER9
+    - powerpc: Use TIDR CPU feature to control TIDR allocation
+    - powerpc: use task_pid_nr() for TID allocation
+    - ocxl: Rename pnv_ocxl_spa_remove_pe to clarify it's action
+    - ocxl: Expose the thread_id needed for wait on POWER9
+    - ocxl: Add an IOCTL so userspace knows what OCXL features are available
+    - ocxl: Document new OCXL IOCTLs
+    - ocxl: Fix missing unlock on error in afu_ioctl_enable_p9_wait()
+
+  * Please include ax88179_178a and r8152 modules in d-i udeb (LP: #1771823)
+    - [Config:] d-i: Add ax88179_178a and r8152 to nic-modules
+
+  * glibc pkeys test fail on powerpc (LP: #1776967)
+    - [Config] Temporarily disable CONFIG_PPC_MEM_KEYS
+
+  * After update to 4.13-43 Intel Graphics are Laggy (LP: #1773520)
+    - Revert "drm/i915/edp: Allow alternate fixed mode for eDP if available."
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.9-3ubuntu1, zfs to 0.7.9-3ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 29 Jun 2018 13:37:52 -0500
+
+linux (4.17.0-3.4) cosmic; urgency=medium
+
+  * linux: 4.17.0-3.4 -proposed tracker (LP: #1779124)
+
+  * Cosmic update to v4.17.3 stable release (LP: #1778997)
+    - net: aquantia: fix unsigned numvecs comparison with less than zero
+    - bonding: re-evaluate force_primary when the primary slave name changes
+    - cdc_ncm: avoid padding beyond end of skb
+    - ipv6: allow PMTU exceptions to local routes
+    - net: dsa: add error handling for pskb_trim_rcsum
+    - net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620
+    - net/sched: act_simple: fix parsing of TCA_DEF_DATA
+    - tcp: verify the checksum of the first data segment in a new connection
+    - tls: fix use-after-free in tls_push_record
+    - tls: fix waitall behavior in tls_sw_recvmsg
+    - socket: close race condition between sock_close() and sockfs_setattr()
+    - udp: fix rx queue len reported by diag and proc interface
+    - net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds
+      vlan
+    - hv_netvsc: Fix a network regression after ifdown/ifup
+    - ACPICA: AML parser: attempt to continue loading table after error
+    - ext4: fix hole length detection in ext4_ind_map_blocks()
+    - ext4: update mtime in ext4_punch_hole even if no blocks are released
+    - ext4: do not allow external inodes for inline data
+    - ext4: bubble errors from ext4_find_inline_data_nolock() up to ext4_iget()
+    - ext4: correctly handle a zero-length xattr with a non-zero e_value_offs
+    - ext4: fix fencepost error in check for inode count overflow during resize
+    - driver core: Don't ignore class_dir_create_and_add() failure.
+    - Btrfs: allow empty subvol= again
+    - Btrfs: fix clone vs chattr NODATASUM race
+    - Btrfs: fix memory and mount leak in btrfs_ioctl_rm_dev_v2()
+    - btrfs: return error value if create_io_em failed in cow_file_range
+    - btrfs: scrub: Don't use inode pages for device replace
+    - ALSA: usb-audio: Disable the quirk for Nura headset
+    - ALSA: hda/conexant - Add fixup for HP Z2 G4 workstation
+    - ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
+    - ALSA: hda: add dock and led support for HP EliteBook 830 G5
+    - ALSA: hda: add dock and led support for HP ProBook 640 G4
+    - x86/MCE: Fix stack out-of-bounds write in mce-inject.c: Flags_read()
+    - smb3: fix various xid leaks
+    - smb3: on reconnect set PreviousSessionId field
+    - CIFS: 511c54a2f69195b28afb9dd119f03787b1625bb4 adds a check for session
+      expiry
+    - cifs: For SMB2 security informaion query, check for minimum sized security
+      descriptor instead of sizeof FileAllInformation class
+    - nbd: fix nbd device deletion
+    - nbd: update size when connected
+    - nbd: use bd_set_size when updating disk size
+    - blk-mq: reinit q->tag_set_list entry only after grace period
+    - bdi: Move cgroup bdi_writeback to a dedicated low concurrency workqueue
+    - cpufreq: Fix new policy initialization during limits updates via sysfs
+    - cpufreq: ti-cpufreq: Fix an incorrect error return value
+    - cpufreq: governors: Fix long idle detection logic in load calculation
+    - libata: zpodd: small read overflow in eject_tray()
+    - libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
+    - nvme/pci: Sync controller reset for AER slot_reset
+    - w1: mxc_w1: Enable clock before calling clk_get_rate() on it
+    - x86/vector: Fix the args of vector_alloc tracepoint
+    - x86/apic/vector: Prevent hlist corruption and leaks
+    - x86/apic: Provide apic_ack_irq()
+    - x86/ioapic: Use apic_ack_irq()
+    - x86/platform/uv: Use apic_ack_irq()
+    - irq_remapping: Use apic_ack_irq()
+    - genirq/generic_pending: Do not lose pending affinity update
+    - genirq/affinity: Defer affinity setting if irq chip is busy
+    - genirq/migration: Avoid out of line call if pending is not set
+    - x86/intel_rdt: Enable CMT and MBM on new Skylake stepping
+    - media: uvcvideo: Prevent setting unavailable flags
+    - media: rc: ensure input/lirc device can be opened after register
+    - iwlwifi: fw: harden page loading code
+    - orangefs: set i_size on new symlink
+    - orangefs: report attributes_mask and attributes for statx
+    - HID: intel_ish-hid: ipc: register more pm callbacks to support hibernation
+    - HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large
+    - vhost: fix info leak due to uninitialized memory
+    - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
+    - Linux 4.17.3
+
+  * Use-after-free in sk_peer_label (LP: #1778646)
+    - SAUCE: apparmor: fix use after free in sk_peer_label
+
+  * kernel: Fix memory leak on CCA and EP11 CPRB processing. (LP: #1775390)
+    - s390/zcrypt: Fix CCA and EP11 CPRB processing failure memory leak.
+
+  * Various fixes for CXL kernel module (LP: #1774471)
+    - cxl: Configure PSL to not use APC virtual machines
+    - cxl: Disable prefault_mode in Radix mode
+
+  * Bluetooth not working (LP: #1764645)
+    - Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
+
+  * Fake SAS addresses for SATA disks on HiSilicon D05 are non-unique
+    (LP: #1776750)
+    - scsi: hisi_sas: make SAS address of SATA disks unique
+
+  * linux-snapdragon: wcn36xx: mac address generation on boot (LP: #1776491)
+    - [Config] arm64: snapdragon: WCN36XX_SNAPDRAGON_HACKS=y
+    - SAUCE: wcn36xx: read MAC from file or randomly generate one
+
+  * Lenovo V330 needs patch in ideapad_laptop module for rfkill (LP: #1774636)
+    - SAUCE: Add Lenovo V330 to the ideapad_laptop rfkill blacklist
+
+  * register on binfmt_misc may overflow and crash the system (LP: #1775856)
+    - fs/binfmt_misc.c: do not allow offset overflow
+
+  * Network installs fail on SocioNext board (LP: #1775884)
+    - net: socionext: reset hardware in ndo_stop
+    - net: netsec: enable tx-irq during open callback
+
+  * Fix several bugs in RDMA/hns driver (LP: #1770974)
+    - RDMA/hns: Drop local zgid in favor of core defined variable
+    - RDMA/hns: Add 64KB page size support for hip08
+    - RDMA/hns: Rename the idx field of db
+    - RDMA/hns: Modify uar allocation algorithm to avoid bitmap exhaust
+    - RDMA/hns: Increase checking CMQ status timeout value
+    - RDMA/hns: Add reset process for RoCE in hip08
+    - RDMA/hns: Fix the illegal memory operation when cross page
+    - RDMA/hns: Implement the disassociate_ucontext API
+
+  * powerpc/livepatch: Implement reliable stack tracing for the consistency
+    model (LP: #1771844)
+    - powerpc/livepatch: Implement reliable stack tracing for the consistency
+      model
+
+  * Adding back alx WoL feature (LP: #1772610)
+    - SAUCE: Revert "alx: remove WoL support"
+    - SAUCE: alx: add enable_wol paramenter
+
+  * Lancer A0 Asic HBA's won't boot with 18.04 (LP: #1768103)
+    - scsi: lpfc: Fix WQ/CQ creation for older asic's.
+    - scsi: lpfc: Fix 16gb hbas failing cq create.
+
+  * [LTCTest][OPAL][OP920] cpupower idle-info is not listing stop4 and stop5
+    idle states when all CORES are guarded (LP: #1771780)
+    - powerpc/powernv/cpuidle: Init all present cpus for deep states
+
+  * Huawei 25G/100G Network Adapters Unsupported (LP: #1770970)
+    - net-next/hinic: add pci device ids for 25ge and 100ge card
+
+  * Expose arm64 CPU topology to userspace (LP: #1770231)
+    - drivers: base: cacheinfo: move cache_setup_of_node()
+    - drivers: base: cacheinfo: setup DT cache properties early
+    - cacheinfo: rename of_node to fw_token
+    - arm64/acpi: Create arch specific cpu to acpi id helper
+    - ACPI/PPTT: Add Processor Properties Topology Table parsing
+    - [Config] CONFIG_ACPI_PPTT=y
+    - ACPI: Enable PPTT support on ARM64
+    - drivers: base cacheinfo: Add support for ACPI based firmware tables
+    - arm64: Add support for ACPI based firmware tables
+    - arm64: topology: rename cluster_id
+    - arm64: topology: enable ACPI/PPTT based CPU topology
+    - ACPI: Add PPTT to injectable table list
+    - arm64: topology: divorce MC scheduling domain from core_siblings
+
+  * Vcs-Git header on bionic linux source package points to zesty git tree
+    (LP: #1766055)
+    - [Packaging]: Update Vcs-Git
+
+  * Request to revert SAUCE patches in the 18.04 SRU and update with upstream
+    version (LP: #1768431)
+    - scsi: cxlflash: Handle spurious interrupts
+    - scsi: cxlflash: Remove commmands from pending list on timeout
+    - scsi: cxlflash: Synchronize reset and remove ops
+    - SAUCE: (no-up) cxlflash: OCXL diff between v2 and v3
+
+  * hisi_sas robustness fixes (LP: #1774466)
+    - scsi: hisi_sas: delete timer when removing hisi_sas driver
+    - scsi: hisi_sas: print device id for errors
+    - scsi: hisi_sas: Add some checks to avoid free'ing a sas_task twice
+    - scsi: hisi_sas: check host frozen before calling "done" function
+    - scsi: hisi_sas: check sas_dev gone earlier in hisi_sas_abort_task()
+    - scsi: hisi_sas: stop controller timer for reset
+    - scsi: hisi_sas: update PHY linkrate after a controller reset
+    - scsi: hisi_sas: change slot index allocation mode
+    - scsi: hisi_sas: Change common allocation mode of device id
+    - scsi: hisi_sas: Reset disks when discovered
+    - scsi: hisi_sas: Create a scsi_host_template per HW module
+    - scsi: hisi_sas: Init disks after controller reset
+    - scsi: hisi_sas: Try wait commands before before controller reset
+    - scsi: hisi_sas: Include TMF elements in struct hisi_sas_slot
+    - scsi: hisi_sas: Add v2 hw force PHY function for internal ATA command
+    - scsi: hisi_sas: Terminate STP reject quickly for v2 hw
+    - scsi: hisi_sas: Fix return value when get_free_slot() failed
+    - scsi: hisi_sas: Mark PHY as in reset for nexus reset
+
+  * hisi_sas: Support newer v3 hardware (LP: #1774467)
+    - scsi: hisi_sas: update RAS feature for later revision of v3 HW
+    - scsi: hisi_sas: check IPTT is valid before using it for v3 hw
+    - scsi: hisi_sas: fix PI memory size
+    - scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw
+    - scsi: hisi_sas: remove redundant handling to event95 for v3
+    - scsi: hisi_sas: add readl poll timeout helper wrappers
+    - scsi: hisi_sas: workaround a v3 hw hilink bug
+    - scsi: hisi_sas: Add LED feature for v3 hw
+
+  * hisi_sas: improve performance by optimizing DQ locking (LP: #1774472)
+    - scsi: hisi_sas: optimise the usage of DQ locking
+    - scsi: hisi_sas: relocate smp sg map
+    - scsi: hisi_sas: make return type of prep functions void
+    - scsi: hisi_sas: allocate slot buffer earlier
+    - scsi: hisi_sas: Don't lock DQ for complete task sending
+    - scsi: hisi_sas: Use device lock to protect slot alloc/free
+    - scsi: hisi_sas: add check of device in hisi_sas_task_exec()
+    - scsi: hisi_sas: fix a typo in hisi_sas_task_prep()
+
+  * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336)
+    - SAUCE: CacheFiles: fix a read_waiter/read_copier race
+
+  * enable mic-mute hotkey and led on Lenovo M820z and M920z (LP: #1774306)
+    - ALSA: hda/realtek - Enable mic-mute hotkey for several Lenovo AIOs
+
+  * hns3 driver updates (LP: #1768670)
+    - net: hns3: Remove error log when getting pfc stats fails
+    - net: hns3: fix to correctly fetch l4 protocol outer header
+    - net: hns3: Fixes the out of bounds access in hclge_map_tqp
+    - net: hns3: Fixes the error legs in hclge_init_ae_dev function
+    - net: hns3: fix for phy_addr error in hclge_mac_mdio_config
+    - net: hns3: Fix to support autoneg only for port attached with phy
+    - net: hns3: fix a dead loop in hclge_cmd_csq_clean
+    - net: hns3: Fix for packet loss due wrong filter config in VLAN tbls
+    - net: hns3: Remove packet statistics in the range of 8192~12287
+    - net: hns3: Add support of hardware rx-vlan-offload to HNS3 VF driver
+    - net: hns3: Fix for setting mac address when resetting
+    - net: hns3: remove add/del_tunnel_udp in hns3_enet module
+    - net: hns3: fix for cleaning ring problem
+    - net: hns3: refactor the loopback related function
+    - net: hns3: Fix for deadlock problem occurring when unregistering ae_algo
+    - net: hns3: Fix for the null pointer problem occurring when initializing
+      ae_dev failed
+    - net: hns3: Add a check for client instance init state
+    - net: hns3: Change return type of hnae3_register_ae_dev
+    - net: hns3: Change return type of hnae3_register_ae_algo
+    - net: hns3: Change return value in hnae3_register_client
+    - net: hns3: Fixes the back pressure setting when sriov is enabled
+    - net: hns3: Fix for fiber link up problem
+    - net: hns3: Add support of .sriov_configure in HNS3 driver
+    - net: hns3: Fixes the missing PCI iounmap for various legs
+    - net: hns3: Fixes error reported by Kbuild and internal review
+    - net: hns3: Fixes API to fetch ethernet header length with kernel default
+    - net: hns3: cleanup of return values in hclge_init_client_instance()
+    - net: hns3: Fix the missing client list node initialization
+    - net: hns3: Fix for hns3 module is loaded multiple times problem
+    - net: hns3: Use enums instead of magic number in hclge_is_special_opcode
+    - net: hns3: Fix for netdev not running problem after calling net_stop and
+      net_open
+    - net: hns3: Fixes kernel panic issue during rmmod hns3 driver
+    - net: hns3: Fix for CMDQ and Misc. interrupt init order problem
+    - net: hns3: Updates RX packet info fetch in case of multi BD
+    - net: hns3: Add support for tx_accept_tag2 and tx_accept_untag2 config
+    - net: hns3: Add STRP_TAGP field support for hardware revision 0x21
+    - net: hns3: Add support to enable TX/RX promisc mode for H/W rev(0x21)
+    - net: hns3: Fix for PF mailbox receving unknown message
+    - net: hns3: Fixes the state to indicate client-type initialization
+    - net: hns3: Fixes the init of the VALID BD info in the descriptor
+    - net: hns3: Removes unnecessary check when clearing TX/RX rings
+    - net: hns3: Clear TX/RX rings when stopping port & un-initializing client
+    - net: hns3: Remove unused led control code
+    - net: hns3: Adds support for led locate command for copper port
+    - net: hns3: Fixes initalization of RoCE handle and makes it conditional
+    - net: hns3: Disable vf vlan filter when vf vlan table is full
+    - net: hns3: Add support for IFF_ALLMULTI flag
+    - net: hns3: Add repeat address checking for setting mac address
+    - net: hns3: Fix setting mac address error
+    - net: hns3: Fix for service_task not running problem after resetting
+    - net: hns3: Fix for hclge_reset running repeatly problem
+    - net: hns3: Fix for phy not link up problem after resetting
+    - net: hns3: Add missing break in misc_irq_handle
+    - net: hns3: Fix for vxlan tx checksum bug
+    - net: hns3: Optimize the PF's process of updating multicast MAC
+    - net: hns3: Optimize the VF's process of updating multicast MAC
+    - SAUCE: {topost} net: hns3: add support for serdes loopback selftest
+    - SAUCE: {topost} net: hns3: RX BD information valid only in last BD except
+      VLD bit and buffer size
+    - SAUCE: {topost} net: hns3: remove hclge_get_vector_index from
+      hclge_bind_ring_with_vector
+    - SAUCE: {topost} net: hns3: rename the interface for init_client_instance and
+      uninit_client_instance
+    - SAUCE: {topost} net: hns3: add vector status check before free vector
+    - SAUCE: {topost} net: hns3: add l4_type check for both ipv4 and ipv6
+    - SAUCE: {topost} net: hns3: remove unused head file in hnae3.c
+    - SAUCE: {topost} net: hns3: extraction an interface for state state
+      init|uninit
+    - SAUCE: {topost} net: hns3: print the ret value in error information
+    - SAUCE: {topost} net: hns3: remove the Redundant put_vector in
+      hns3_client_uninit
+    - SAUCE: {topost} net: hns3: add unlikely for error check
+    - SAUCE: {topost} net: hns3: remove back in struct hclge_hw
+    - SAUCE: {topost} net: hns3: use lower_32_bits and upper_32_bits
+    - SAUCE: {topost} net: hns3: remove unused hclge_ring_to_dma_dir
+    - SAUCE: {topost} net: hns3: remove useless code in hclge_cmd_send
+    - SAUCE: {topost} net: hns3: remove some redundant assignments
+    - SAUCE: {topost} net: hns3: simplify hclge_cmd_csq_clean
+    - SAUCE: {topost} net: hns3: using modulo for cyclic counters in
+      hclge_cmd_send
+    - SAUCE: {topost} net: hns3: remove a redundant hclge_cmd_csq_done
+    - SAUCE: {topost} net: hns3: remove some unused members of some structures
+    - SAUCE: {topost} net: hns3: give default option while dependency HNS3 set
+    - SAUCE: {topost} net: hns3: use dma_zalloc_coherent instead of
+      kzalloc/dma_map_single
+    - SAUCE: {topost} net: hns3: modify hnae_ to hnae3_
+    - SAUCE: {topost} net: hns3: fix unused function warning in VF driver
+    - SAUCE: {topost} net: hns3: remove some redundant assignments
+    - SAUCE: {topost} net: hns3: standardize the handle of return value
+    - SAUCE: {topost} net: hns3: remove extra space and brackets
+    - SAUCE: {topost} net: hns3: fix unreasonable code comments
+    - SAUCE: {topost} net: hns3: use decimal for bit offset macros
+    - SAUCE: {topost} net: hns3: modify inconsistent bit mask macros
+    - SAUCE: {topost} net: hns3: fix mislead parameter name
+    - SAUCE: {topost} net: hns3: remove unused struct member and definition
+    - SAUCE: {topost} net: hns3: Add SPDX tags to hns3 driver
+    - SAUCE: {topost} net: hns3: Add pf reset for hip08 RoCE
+    - SAUCE: {topost} net: hns3: optimize the process of notifying roce client
+    - SAUCE: {topost} net: hns3: Add calling roce callback function when link
+      status change
+    - SAUCE: {topost} net: hns3: fix tc setup when netdev is first up
+    - SAUCE: {topost} net: hns3: fix for mac pause not disable in pfc mode
+    - SAUCE: {topost} net: hns3: fix for waterline not setting correctly
+    - SAUCE: {topost} net: hns3: fix for l4 checksum offload bug
+    - SAUCE: {topost} net: hns3: fix for mailbox message truncated problem
+    - SAUCE: {topost} net: hns3: Add configure for mac minimal frame size
+    - SAUCE: {topost} net: hns3: fix warning bug when doing lp selftest
+    - SAUCE: {topost} net: hns3: fix get_vector ops in hclgevf_main module
+    - SAUCE: {topost} net: hns3: remove the warning when clear reset cause
+    - SAUCE: {topost} net: hns3: Use roce handle when calling roce callback
+      function
+    - SAUCE: {topost} net: hns3: prevent sending command during global or core
+      reset
+    - SAUCE: {topost} net: hns3: modify the order of initializeing command queue
+      register
+    - SAUCE: {topost} net: hns3: reset net device with rtnl_lock
+    - SAUCE: {topost} net: hns3: prevent to request reset frequently
+    - SAUCE: {topost} net: hns3: correct reset event status register
+    - SAUCE: {topost} net: hns3: separate roce from nic when resetting
+    - SAUCE: net: hns3: Fix for phy link issue when using marvell phy driver
+    - SAUCE: {topost} net: hns3: fix return value error in
+      hns3_reset_notify_down_enet
+    - SAUCE: {topost} net: hns3: remove unnecessary ring configuration operation
+      while resetting
+    - SAUCE: {topost} net: hns3: fix for reset_level default assignment probelm
+    - SAUCE: {topost} net: hns3: fix for using wrong mask and shift in
+      hclge_get_ring_chain_from_mbx
+    - SAUCE: {topost} net: hns3: fix comments for hclge_get_ring_chain_from_mbx
+    - SAUCE: net: hns3: Fix for VF mailbox cannot receiving PF response
+    - SAUCE: net: hns3: Fix for VF mailbox receiving unknown message
+    - SAUCE: net: hns3: Optimize PF CMDQ interrupt switching process
+
+  * CVE-2018-7755
+    - SAUCE: floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
+
+  * Incorrect blacklist of bcm2835_wdt (LP: #1766052)
+    - [Packaging] Fix missing watchdog for Raspberry Pi
+
+  * kernel: Fix arch random implementation (LP: #1775391)
+    - s390/archrandom: Rework arch random implementation.
+
+  * [Ubuntu 1804][boston][ixgbe] EEH causes kernel BUG at /build/linux-
+    jWa1Fv/linux-4.15.0/drivers/pci/msi.c:352 (i2S) (LP: #1776389)
+    - ixgbe/ixgbevf: Free IRQ when PCI error recovery removes the device
+
+  * Cosmic update to v4.17.2 stable release (LP: #1779117)
+    - crypto: chelsio - request to HW should wrap
+    - blkdev_report_zones_ioctl(): Use vmalloc() to allocate large buffers
+    - KVM: X86: Fix reserved bits check for MOV to CR3
+    - KVM: x86: introduce linear_{read,write}_system
+    - kvm: fix typo in flag name
+    - kvm: nVMX: Enforce cpl=0 for VMX instructions
+    - KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and
+      kvm_write_guest_virt_system
+    - kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access
+    - staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy
+    - NFC: pn533: don't send USB data off of the stack
+    - usbip: vhci_sysfs: fix potential Spectre v1
+    - usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver
+    - usb-storage: Add compatibility quirk flags for G-Technologies G-Drive
+    - Input: xpad - add GPD Win 2 Controller USB IDs
+    - phy: qcom-qusb2: Fix crash if nvmem cell not specified
+    - usb: core: message: remove extra endianness conversion in
+      usb_set_isoch_delay
+    - usb: typec: wcove: Remove dependency on HW FSM
+    - usb: gadget: function: printer: avoid wrong list handling in printer_write()
+    - usb: gadget: udc: renesas_usb3: fix double phy_put()
+    - usb: gadget: udc: renesas_usb3: should remove debugfs
+    - usb: gadget: udc: renesas_usb3: should call pm_runtime_enable() before add
+      udc
+    - usb: gadget: udc: renesas_usb3: should call devm_phy_get() before add udc
+    - usb: gadget: udc: renesas_usb3: should fail if devm_phy_get() returns error
+    - usb: gadget: udc: renesas_usb3: disable the controller's irqs for
+      reconnecting
+    - serial: sh-sci: Stop using printk format %pCr
+    - tty/serial: atmel: use port->name as name in request_irq()
+    - serial: samsung: fix maxburst parameter for DMA transactions
+    - serial: 8250: omap: Fix idling of clocks for unused uarts
+    - vmw_balloon: fixing double free when batching mode is off
+    - doc: fix sysfs ABI documentation
+    - arm64: defconfig: Enable CONFIG_PINCTRL_MT7622 by default
+    - tty: pl011: Avoid spuriously stuck-off interrupts
+    - crypto: ccree - correct host regs offset
+    - Input: goodix - add new ACPI id for GPD Win 2 touch screen
+    - Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID
+    - crypto: caam - strip input zeros from RSA input buffer
+    - crypto: caam - fix DMA mapping dir for generated IV
+    - crypto: caam - fix IV DMA mapping and updating
+    - crypto: caam/qi - fix IV DMA mapping and updating
+    - crypto: caam - fix size of RSA prime factor q
+    - crypto: cavium - Fix fallout from CONFIG_VMAP_STACK
+    - crypto: cavium - Limit result reading attempts
+    - crypto: vmx - Remove overly verbose printk from AES init routines
+    - crypto: vmx - Remove overly verbose printk from AES XTS init
+    - crypto: omap-sham - fix memleak
+    - Linux 4.17.2
+
+  * Cosmic update to v4.17.1 stable release (LP: #1779116)
+    - netfilter: nf_flow_table: attach dst to skbs
+    - bnx2x: use the right constant
+    - ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds
+    - ipv6: omit traffic class when calculating flow hash
+    - l2tp: fix refcount leakage on PPPoL2TP sockets
+    - netdev-FAQ: clarify DaveM's position for stable backports
+    - net: metrics: add proper netlink validation
+    - net/packet: refine check for priv area size
+    - rtnetlink: validate attributes in do_setlink()
+    - sctp: not allow transport timeout value less than HZ/5 for hb_timer
+    - team: use netdev_features_t instead of u32
+    - vrf: check the original netdevice for generating redirect
+    - net: dsa: b53: Fix for brcm tag issue in Cygnus SoC
+    - ipmr: fix error path when ipmr_new_table fails
+    - PCI: hv: Do not wait forever on a device that has disappeared
+    - Linux 4.17.1
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: crypto: thunderx_zip: Fix fallout from
+      CONFIG_VMAP_STACK"
+    - Revert "UBUNTU: SAUCE: cred: Add clone_cred() interface"
+    - SAUCE: apparmor: userspace queries
+    - SAUCE: apparmor: patch to provide compatibility with v2.x net rules
+    - SAUCE: apparmor: af_unix mediation
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 28 Jun 2018 08:03:32 -0500
+
+linux (4.17.0-2.3) cosmic; urgency=medium
+
+  * linux: 4.17.0-2.3 -proposed tracker (LP: #1776276)
+
+  * Miscellaneous Ubuntu changes
+    - Config: remove IrDA from annotations
+    - Config: remove scsi drivers from annotations
+    - Config: remove BT_HCIBTUART from annotations
+    - Config: pstore zlib support was renamed
+    - Config: disable NVRAM for armhf on annotations
+    - Config: Disable VT on s390x
+    - Config: Update SSB and B43/B44 options
+    - Config: some options not supported on some arches anymore
+    - Config: renamed and removed options
+    - Config: TCG_CRB is required for IMA on ACPI systems
+    - Config: EXTCON_AXP288 depends on X86
+    - Config: CONFIG_FSI depends on OF
+    - Config: DRM_RCAR_LVDS now depends on DRM
+    - CONFIG: Allow CONFIG_LEDS_MLXCPLD for i386
+    - Config: Enable HINIC on arm64
+    - Config: Set PPS and PTP_1588_CLOCK as y
+    - Config: Some NF_TABLES options are built-in now
+    - Config: GENERIC_CPU for ppc64el
+    - Config: KEXEC_FILE=n for s390x
+    - Config: CRYPTO_DEFLATE is needed by PSTORE_DEFLATE_COMPRESS
+    - Config: Disable STM32 support
+    - Config: Enable FORTIFY_SOURCE for armhf
+    - Config: use STRONG instead of AUTO for CC_STACKPROTECTOR
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.17
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 11 Jun 2018 15:22:10 -0300
+
+linux (4.17.0-1.2) cosmic; urgency=medium
+
+  [ Seth Forshee ]
+  * [Config] enable EDAC_DEBUG on ARM64 (LP: #1772516)
+    - [Config]: set CONFIG_EDAC_DEBUG=y for ARM64
+
+  * Ubuntu 18.04 kernel crashed while in degraded mode (LP: #1770849)
+    - SAUCE: powerpc/perf: Fix memory allocation for core-imc based on
+      num_possible_cpus()
+
+  * Integrated Webcam Realtek Integrated_Webcam_HD (0bda:58f4) not working in
+    DELL XPS 13 9370 with firmware 1.50 (LP: #1763748)
+    - SAUCE: media: uvcvideo: Support realtek's UVC 1.5 device
+
+  * Switch Build-Depends: transfig to fig2dev (LP: #1770770)
+    - [Config] update Build-Depends: transfig to fig2dev
+
+  * update-initramfs not adding i915 GuC firmware for Kaby Lake, firmware fails
+    to load (LP: #1728238)
+    - Revert "UBUNTU: SAUCE: (no-up) i915: Remove MODULE_FIRMWARE statements for
+      unreleased firmware"
+
+  * No driver for Huawei network adapters on arm64 (LP: #1769899)
+    - net-next/hinic: add arm64 support
+
+  * linux-snapdragon: reduce EPROBEDEFER noise during boot (LP: #1768761)
+    - [Config] snapdragon: DRM_I2C_ADV7511=y
+
+  * Add d-i support for Huawei NICs (LP: #1767490)
+    - d-i: add hinic to nic-modules udeb
+
+  * Acer Swift sf314-52 power button not managed  (LP: #1766054)
+    - SAUCE: platform/x86: acer-wmi: add another KEY_POWER keycode
+
+  * Include nfp driver in linux-modules (LP: #1768526)
+    - [Config] Add nfp.ko to generic inclusion list
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - [Config] Enable AUFS config options
+    - SAUCE: (efi-lockdown) Fix for module sig verification
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Don't print secure boot state from the efi stub
+    - [Config] CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
+    - SAUCE: (efi-lockdown) really lock down kernel under EFI secure boot
+    - SAUCE: (noup) Update spl to 0.7.5-1ubuntu3, zfs to 0.7.5-1ubuntu17
+    - enable zfs build
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) ima: require secure_boot rules in
+      lockdown mode"
+    - Rebased to v4.17-rc6
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 22 May 2018 14:48:13 -0300
+
+linux (4.17.0-0.1) bionic; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.17-rc4
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 08 May 2018 16:38:51 -0300
+
+linux (4.17.0-0.0) bionic; urgency=medium
+
+  * Dummy entry.
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 27 Apr 2018 11:01:13 -0300
+
+linux (4.16.0-4.5) bionic; urgency=medium
+
+  * [18.04 FEAT] Add kvm_stat from kernel tree (LP: #1734130)
+    - tools/kvm_stat: Fix python3 syntax
+    - tools/kvm_stat: Don't use deprecated file()
+    - tools/kvm_stat: Remove unused function
+    - [Packaging] Add linux-tools-host package for VM host tools
+    - [Config] do_tools_host=true for amd64
+
+  * [Featire] CNL: Enable RAPL support (LP: #1685712)
+    - powercap: RAPL: Add support for Cannon Lake
+
+  * Bionic update to v4.16.2 stable release (LP: #1763388)
+    - sparc64: Oracle DAX driver depends on SPARC64
+    - arp: fix arp_filter on l3slave devices
+    - net: dsa: Discard frames from unused ports
+    - net/ipv6: Increment OUTxxx counters after netfilter hook
+    - net/sched: fix NULL dereference in the error path of tcf_bpf_init()
+    - pptp: remove a buggy dst release in pptp_connect()
+    - sctp: do not leak kernel memory to user space
+    - sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
+    - vlan: also check phy_driver ts_info for vlan's real device
+    - net: fool proof dev_valid_name()
+    - ip_tunnel: better validate user provided tunnel names
+    - ipv6: sit: better validate user provided tunnel names
+    - ip6_gre: better validate user provided tunnel names
+    - ip6_tunnel: better validate user provided tunnel names
+    - vti6: better validate user provided tunnel names
+    - net_sched: fix a missing idr_remove() in u32_delete_key()
+    - nfp: use full 40 bits of the NSP buffer address
+    - Linux 4.16.2
+
+  * sky2 gigabit ethernet driver sometimes stops working after lid-open resume
+    from sleep (88E8055) (LP: #1758507) // Bionic update to v4.16.2 stable
+    release (LP: #1763388)
+    - sky2: Increase D3 delay to sky2 stops working after suspend
+
+  * Merge the linux-snapdragon kernel into bionic master/snapdragon
+    (LP: #1763040)
+    - arm64: defconfig: enable REMOTEPROC
+    - arm64: defconfig: enable QCOM audio drivers for APQ8016 and DB410c
+    - kernel: configs; add distro.config
+    - arm64: configs: enable WCN36xx
+    - kernel: distro.config: enable debug friendly USB network adpater
+    - arm64: configs: enable QCOM Venus
+    - arm64: defconfig: Enable a53/apcs and avs
+    - arm64: defconfig: enable ondemand governor as default
+    - arm64: defconfig: enable QCOM_TSENS
+    - kernel: configs: enable dm_mod and dm_crypt
+    - Force the SMD regulator driver to be compiled-in
+    - arm64: defconfig: enable CFG80211_DEFAULT_PS by default
+    - arm64: configs: enable BT_QCOMSMD
+    - kernel: configs: add more USB net drivers
+    - arm64: defconfig: disable ANALOG_TV and DIGITAL_TV
+    - arm64: configs: Enable camera drivers
+    - kernel: configs: add freq stat to sysfs
+    - arm64: defconfig: enable CONFIG_USB_CONFIGFS_F_FS by default
+    - arm64: defconfig: Enable QRTR features
+    - kernel: configs: set USB_CONFIG_F_FS in distro.config
+    - kernel: distro.config: enable 'schedutil' CPUfreq governor
+    - kernel: distro.config: enable 'fq' and 'fq_codel' qdiscs
+    - kernel: distro.config: enable 'BBR' TCP congestion algorithm
+    - arm64: defconfig: enable LEDS_QCOM_LPG
+    - HACK: drm/msm/iommu: Remove runtime_put calls in map/unmap
+    - power: avs: Add support for CPR (Core Power Reduction)
+    - power: avs: cpr: Use raw mem access for qfprom
+    - power: avs: cpr: fix with new reg_sequence structures
+    - power: avs: cpr: Register with cpufreq-dt
+    - regulator: smd: Add floor and corner operations
+    - PM / OPP: Support adjusting OPP voltages at runtime
+    - PM / OPP: Drop RCU usage in dev_pm_opp_adjust_voltage()
+    - PM / OPP: HACK: Allow to set regulator without opp_list
+    - PM / OPP: Add a helper to get an opp regulator for device
+    - cpufreq: Add apq8016 to cpufreq-dt-platdev blacklist
+    - regulator: smd: Allow REGULATOR_QCOM_SMD_RPM=m
+    - ov5645: I2C address change
+    - i2c: Add Qualcomm Camera Control Interface driver
+    - camss: vfe: Skip first four frames from sensor
+    - camss: Do not register if no cameras are present
+    - i2c-qcom-cci: Fix run queue completion timeout
+    - i2c-qcom-cci: Fix I2C address bug
+    - media: ov5645: Fix I2C address
+    - drm/bridge/adv7511: Delay clearing of HPD interrupt status
+    - HACK: drm/msm/adv7511: Don't rely on interrupts for EDID parsing
+    - leds: Add driver for Qualcomm LPG
+    - wcn36xx: Fix warning due to duplicate scan_completed notification
+    - arm64: dts: Add CPR DT node for msm8916
+    - arm64: dts: add spmi-regulator nodes
+    - arm64: dts: msm8916: Add cpufreq support
+    - arm64: dts: msm8916: Add a shared CPU opp table
+    - arm64: dts: msm8916: Add cpu cooling maps
+    - arm64: dts: pm8916: Mark the s2 regulator as always-on
+    - arm64: dts: qcom: msm8916: Add msm8916 A53 PLL DT node
+    - arm64: dts: qcom: msm8916: Use the new APCS mailbox driver
+    - arm64: dts: qcom: msm8916: Add clock properties to the APCS node
+    - dt-bindings: media: Binding document for Qualcomm Camera Control Interface
+      driver
+    - MAINTAINERS: Add Qualcomm Camera Control Interface driver
+    - DT: leds: Add Qualcomm Light Pulse Generator binding
+    - arm64: dts: qcom: msm8996: Add mpp and lpg blocks
+    - arm64: dts: qcom: Add pwm node for pm8916
+    - arm64: dts: qcom: Add user LEDs on db820c
+    - arm64: dts: qcom: Add WiFI/BT LEDs on db820c
+    - ARM: dts: qcom: Add LPG node to pm8941
+    - ARM: dts: qcom: honami: Add LPG node and RGB LED
+    - arm64: dts: qcom: Add Camera Control Interface support
+    - arm64: dts: qcom: Add apps_iommu vfe child node
+    - arm64: dts: qcom: Add camss device node
+    - arm64: dts: qcom: Add ov5645 device nodes
+    - arm64: dts: msm8916: Fix camera sensors I2C addresses
+    - arm: dts: qcom: db410c: Enable PWM signal on MPP4
+    - packaging: arm64: add a uboot flavour - part1
+    - packaging: arm64: add a uboot flavour - part2
+    - packaging: arm64: add a uboot flavour - part3
+    - packaging: arm64: add a uboot flavour - part4
+    - packaging: arm64: add a uboot flavour - part5
+    - packaging: arm64: rename uboot flavour to snapdragon
+    - [Config] updateconfigs after qcomlt import
+    - [Config] arm64: snapdragon: COMMON_CLK_QCOM=y
+    - [Config] arm64: snapdragon: MSM_GCC_8916=y
+    - [Config] arm64: snapdragon: REGULATOR_FIXED_VOLTAGE=y
+    - [Config] arm64: snapdragon: PINCTRL_MSM8916=y
+    - [Config] arm64: snapdragon: HWSPINLOCK_QCOM=y
+    - [Config] arm64: snapdragon: SPMI=y, SPMI_MSM_PMIC_ARB=y
+    - [Config] arm64: snapdragon: REGMAP_SPMI=y, PINCTRL_QCOM_SPMI_PMIC=y
+    - [Config] arm64: snapdragon: REGULATOR_QCOM_SPMI=y
+    - [Config] arm64: snapdragon: MFD_SPMI_PMIC=y
+    - [Config] arm64: snapdragon: QCOM_SMEM=y
+    - [Config] arm64: snapdragon: RPMSG=y, RPMSG_QCOM_SMD=y
+    - [Config] arm64: snapdragon: QCOM_SMD_RPM=y, REGULATOR_QCOM_SMD_RPM=y
+    - [Config] arm64: snapdragon: QCOM_CLK_SMD_RPM=y
+    - [Config] arm64: snapdragon: QCOM_BAM_DMA=y
+    - [Config] arm64: snapdragon: QCOM_HIDMA=y, QCOM_HIDMA_MGMT=y
+    - [Config] arm64: snapdragon: QCOM_CPR=y
+    - [Config] arm64: snapdragon: QCOM_QFPROM=y, QCOM_TSENS=y
+    - [Config] arm64: snapdragon: MMC_SDHCI=y, MMC_SDHCI_PLTFM=y, MMC_SDHCI_MSM=y
+    - [Config] turn off DRM_MSM_REGISTER_LOGGING
+    - [Config] arm64: snapdragon: I2C_QUP=y
+    - [Config] arm64: snapdragon: SPI_QUP=y
+    - [Config] arm64: snapdragon: USB_ULPI_BUS=y, PHY_QCOM_USB_HS=y
+    - [Config] arm64: snapdragon: QCOM_APCS_IPC=y
+    - [Config] arm64: snapdragon: QCOM_WCNSS_CTRL=y
+    - [Config] arm64: snapdragon: QCOM_SMSM=y
+    - [Config] arm64: snapdragon: QCOM_SMP2P=y
+    - [Config] arm64: snapdragon: DRM_MSM=y
+    - [Config] arm64: snapdragon: SND_SOC=y
+    - [Config] arm64: snapdragon: QCOM_WCNSS_PIL=m
+    - [Config] arm64: snapdragon: INPUT_PM8941_PWRKEY=y
+    - [Config] arm64: snapdragon: MEDIA_SUBDRV_AUTOSELECT=y, VIDEO_OV5645=m
+    - [Config] arm64: snapdragon: SND_SOC_APQ8016_SBC=y, SND_SOC_LPASS_APQ8016=y
+    - [Config] arm64: snapdragon: SND_SOC_MSM8916_WCD_ANALOG=y,
+      SND_SOC_MSM8916_WCD_DIGITAL=y
+    - SAUCE: media: ov5645: skip address change if dt addr == default addr
+    - SAUCE: drm/msm/adv7511: wrap hacks under CONFIG_ADV7511_SNAPDRAGON_HACKS
+      #ifdefs
+    - [Config] arm64: snapdragon: ADV7511_SNAPDRAGON_HACKS=y
+    - [Packaging] fix up snapdragon abi paths
+
+  * LSM stacking patches for bionic (LP: #1763062)
+    - SAUCE: LSM stacking: procfs: add smack subdir to attrs
+    - SAUCE: LSM stacking: LSM: Manage credential security blobs
+    - SAUCE: LSM stacking: LSM: Manage file security blobs
+    - SAUCE: LSM stacking: LSM: Manage task security blobs
+    - SAUCE: LSM stacking: LSM: Manage remaining security blobs
+    - SAUCE: LSM stacking: LSM: General stacking
+    - SAUCE: LSM stacking: fixup initialize task->security
+    - SAUCE: LSM stacking: fixup: alloc_task_ctx is dead code
+    - SAUCE: LSM stacking: add support for stacking getpeersec_stream
+    - SAUCE: LSM stacking: add stacking support to apparmor network hooks
+    - SAUCE: LSM stacking: fixup apparmor stacking enablement
+    - SAUCE: LSM stacking: fixup stacking kconfig
+    - SAUCE: LSM stacking: allow selecting multiple LSMs using kernel boot params
+    - SAUCE: LSM stacking: provide prctl interface for setting context
+    - SAUCE: LSM stacking: inherit current display LSM
+    - SAUCE: LSM stacking: keep an index for each registered LSM
+    - SAUCE: LSM stacking: verify display LSM
+    - SAUCE: LSM stacking: provide a way to specify the default display lsm
+    - SAUCE: LSM stacking: make sure LSM blob align on 64 bit boundaries
+    - SAUCE: LSM stacking: add /proc/<pid>/attr/display_lsm
+    - SAUCE: LSM stacking: add Kconfig to set default display LSM
+    - SAUCE: LSM stacking: add configs for LSM stacking
+    - SAUCE: LSM stacking: add apparmor and selinux proc dirs
+    - SAUCE: LSM stacking: remove procfs context interface
+
+  * linux 4.13.0-13.14 ADT test failure with linux 4.13.0-13.14
+    (LP: #1720779) // LSM stacking patches for bionic (LP: #1763062)
+    - SAUCE: LSM stacking: check for invalid zero sized writes
+
+  * Support cq/rq record doorbell for RDMA on HSilicon hip08 systems
+    (LP: #1762755)
+    - RDMA/hns: Support rq record doorbell for the user space
+    - RDMA/hns: Support cq record doorbell for the user space
+    - RDMA/hns: Support rq record doorbell for kernel space
+    - RDMA/hns: Support cq record doorbell for kernel space
+    - RDMA/hns: Fix cqn type and init resp
+    - RDMA/hns: Fix init resp when alloc ucontext
+    - RDMA/hns: Fix cq record doorbell enable in kernel
+
+  * Replace LPC patchset with upstream version (LP: #1762758)
+    - Revert "UBUNTU: SAUCE: MAINTAINERS: Add maintainer for HiSilicon LPC driver"
+    - Revert "UBUNTU: SAUCE: HISI LPC: Add ACPI support"
+    - Revert "UBUNTU: SAUCE: ACPI / scan: do not enumerate Indirect IO host
+      children"
+    - Revert "UBUNTU: SAUCE: HISI LPC: Support the LPC host on Hip06/Hip07 with DT
+      bindings"
+    - Revert "UBUNTU: SAUCE: OF: Add missing I/O range exception for indirect-IO
+      devices"
+    - Revert "UBUNTU: SAUCE: PCI: Apply the new generic I/O management on PCI IO
+      hosts"
+    - Revert "UBUNTU: SAUCE: PCI: Add fwnode handler as input param of
+      pci_register_io_range()"
+    - Revert "UBUNTU: SAUCE: PCI: Remove unused __weak attribute in
+      pci_register_io_range()"
+    - Revert "UBUNTU: SAUCE: LIB: Introduce a generic PIO mapping method"
+    - lib: Add generic PIO mapping method
+    - PCI: Remove __weak tag from pci_register_io_range()
+    - PCI: Add fwnode handler as input param of pci_register_io_range()
+    - PCI: Apply the new generic I/O management on PCI IO hosts
+    - of: Add missing I/O range exception for indirect-IO devices
+    - HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings
+    - ACPI / scan: Rename acpi_is_serial_bus_slave() for more general use
+    - ACPI / scan: Do not enumerate Indirect IO host children
+    - HISI LPC: Add ACPI support
+    - MAINTAINERS: Add John Garry as maintainer for HiSilicon LPC driver
+
+  * Enable Tunneled Operations on POWER9 (LP: #1762448)
+    - powerpc/powernv: Enable tunneled operations
+    - cxl: read PHB indications from the device tree
+
+  * PSL traces reset after PERST for debug AFU image (LP: #1762462)
+    - cxl: Enable NORST bit in PSL_DEBUG register for PSL9
+
+  * NFS + sec=krb5 is broken (LP: #1759791)
+    - sunrpc: remove incorrect HMAC request initialization
+
+  * Raspberry Pi 3 microSD support missing from the installer (LP: #1729128)
+    - d-i: add bcm2835 to block-modules
+
+  * Backport USB core quirks (LP: #1762695)
+    - usb: core: Add "quirks" parameter for usbcore
+    - usb: core: Copy parameter string correctly and remove superfluous null check
+    - usb: core: Add USB_QUIRK_DELAY_CTRL_MSG to usbcore quirks
+
+  * [Ubuntu 18.04] cryptsetup: 'device-mapper: reload ioctl on  failed' when
+    setting up a second end-to-end encrypted disk (LP: #1762353)
+    - SAUCE: s390/crypto: Adjust s390 aes and paes cipher
+
+  * System Z {kernel} UBUNTU18.04 wrong kernel config (LP: #1762719)
+    - s390: move nobp parameter functions to nospec-branch.c
+    - s390: add automatic detection of the spectre defense
+    - s390: report spectre mitigation via syslog
+    - s390: add sysfs attributes for spectre
+    - [Config] CONFIG_EXPOLINE_AUTO=y, CONFIG_KERNEL_NOBP=n for s390
+    - s390: correct nospec auto detection init order
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5715
+    - powerpc/64s: Wire up cpu_show_spectre_v2()
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5753
+    - powerpc/64s: Wire up cpu_show_spectre_v1()
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5754
+    - powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code
+    - powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again
+    - powerpc/rfi-flush: Always enable fallback flush on pseries
+    - powerpc/rfi-flush: Differentiate enabled and patched flush types
+    - powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration
+    - powerpc/64s: Move cpu_show_meltdown()
+    - powerpc/64s: Enhance the information in cpu_show_meltdown()
+    - powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()
+    - powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5715 //
+    CVE-2017-5753 // CVE-2017-5754
+    - powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
+    - powerpc: Add security feature flags for Spectre/Meltdown
+    - powerpc/pseries: Set or clear security feature flags
+    - powerpc/powernv: Set or clear security feature flags
+
+  * Hisilicon network subsystem 3 support (LP: #1761610)
+    - net: hns3: export pci table of hclge and hclgevf to userspace
+    - d-i: Add hns3 drivers to nic-modules
+
+  * "ip a" command on a guest VM shows UNKNOWN status (LP: #1761534)
+    - virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS
+
+  * perf vendor events arm64: Enable JSON events for ThunderX2 B0 (LP: #1760712)
+    - perf vendor events: Drop incomplete multiple mapfile support
+    - perf vendor events: Fix error code in json_events()
+    - perf vendor events: Drop support for unused topic directories
+    - perf vendor events: Add support for pmu events vendor subdirectory
+    - perf vendor events arm64: Relocate ThunderX2 JSON to cavium subdirectory
+    - perf vendor events arm64: Relocate Cortex A53 JSONs to arm subdirectory
+    - perf vendor events: Add support for arch standard events
+    - perf vendor events arm64: Add armv8-recommended.json
+    - perf vendor events arm64: Fixup ThunderX2 to use recommended events
+    - perf vendor events arm64: fixup A53 to use recommended events
+    - perf vendor events arm64: add HiSilicon hip08 JSON file
+    - perf vendor events arm64: Enable JSON events for ThunderX2 B0
+
+  * Warning "cache flush timed out!" seen when unloading the cxl driver
+    (LP: #1762367)
+    - cxl: Check if PSL data-cache is available before issue flush request
+
+  * Bionic update to v4.16.1 stable release (LP: #1763170)
+    - bitmap: fix memset optimization on big-endian systems
+    - USB: serial: ftdi_sio: add RT Systems VX-8 cable
+    - USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
+    - USB: serial: cp210x: add ELDAT Easywave RX09 id
+    - serial: 8250: Add Nuvoton NPCM UART
+    - mei: remove dev_err message on an unsupported ioctl
+    - /dev/mem: Avoid overwriting "err" in read_mem()
+    - media: usbtv: prevent double free in error case
+    - parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
+    - crypto: lrw - Free rctx->ext with kzfree
+    - crypto: ccp - Fill the result buffer only on digest, finup, and final ops
+    - crypto: talitos - don't persistently map req_ctx->hw_context and
+      req_ctx->buf
+    - crypto: inside-secure - fix clock management
+    - crypto: testmgr - Fix incorrect values in PKCS#1 test vector
+    - crypto: talitos - fix IPsec cipher in length
+    - crypto: ahash - Fix early termination in hash walk
+    - crypto: caam - Fix null dereference at error path
+    - crypto: ccp - return an actual key size from RSA max_size callback
+    - crypto: arm,arm64 - Fix random regeneration of S_shipped
+    - crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
+    - Bluetooth: hci_bcm: Add 6 new ACPI HIDs
+    - Btrfs: fix unexpected cow in run_delalloc_nocow
+    - siox: fix possible buffer overflow in device_add_store
+    - staging: comedi: ni_mio_common: ack ai fifo error interrupts.
+    - Revert "base: arch_topology: fix section mismatch build warnings"
+    - Input: ALPS - fix TrackStick detection on Thinkpad L570 and Latitude 7370
+    - Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
+    - Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
+    - vt: change SGR 21 to follow the standards
+    - Fix slab name "biovec-(1<<(21-12))"
+    - signal: Correct the offset of si_pkey and si_lower in struct siginfo on m68k
+    - Linux 4.16.1
+
+  * [18.04][config] regression: nvme and nvme_core couldn't be built as modules
+    starting 4.15-rc2 (LP: #1759893)
+    - SAUCE: Revert "lightnvm: include NVM Express driver if OCSSD is selected for
+      build"
+    - [Config] CONFIG_BLK_DEV_NMVE=m
+
+  * FFe: Enable configuring resume offset via sysfs (LP: #1760106)
+    - PM / hibernate: Make passing hibernate offsets more friendly
+
+  * Ubuntu18.04:POWER9:DD2.2 - Unable to start a KVM guest with default machine
+    type(pseries-bionic) complaining "KVM implementation does not support
+    Transactional Memory, try cap-htm=off" (kvm) (LP: #1752026)
+    - powerpc: Use feature bit for RTC presence rather than timebase presence
+    - powerpc: Book E: Remove unused CPU_FTR_L2CSR bit
+    - powerpc: Free up CPU feature bits on 64-bit machines
+    - powerpc: Add CPU feature bits for TM bug workarounds on POWER9 v2.2
+    - powerpc/powernv: Provide a way to force a core into SMT4 mode
+    - KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9
+    - KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode
+    - KVM: PPC: Book3S HV: Work around TEXASR bug in fake suspend state
+
+  * [Feature][CFL][ICL] [CNL]Thunderbolt support (Titan Ridge) (LP: #1730775)
+    - thunderbolt: Resume control channel after hibernation image is created
+    - thunderbolt: Serialize PCIe tunnel creation with PCI rescan
+    - thunderbolt: Handle connecting device in place of host properly
+    - thunderbolt: Do not overwrite error code when domain adding fails
+    - thunderbolt: Wait a bit longer for root switch config space
+    - thunderbolt: Wait a bit longer for ICM to authenticate the active NVM
+    - thunderbolt: Handle rejected Thunderbolt devices
+    - thunderbolt: Factor common ICM add and update operations out
+    - thunderbolt: Correct function name in kernel-doc comment
+    - thunderbolt: Add tb_switch_get()
+    - thunderbolt: Add tb_switch_find_by_route()
+    - thunderbolt: Add tb_xdomain_find_by_route()
+    - thunderbolt: Add constant for approval timeout
+    - thunderbolt: Move driver ready handling to struct icm
+    - thunderbolt: Add 'boot' attribute for devices
+    - thunderbolt: Add support for preboot ACL
+    - thunderbolt: Introduce USB only (SL4) security level
+    - thunderbolt: Add support for Intel Titan Ridge
+
+  * QCA9377 requires more IRAM banks for its new firmware (LP: #1748345)
+    - ath10k: update the IRAM bank number for QCA9377
+
+  * Fix an issue that when system in S3, USB keyboard can't wake up the system.
+    (LP: #1759511)
+    - ACPI / PM: Allow deeper wakeup power states with no _SxD nor _SxW
+
+  * cxl: Fix timebase synchronization status on POWER9 missing (CAPI)
+    (LP: #1757228)
+    - cxl: Fix timebase synchronization status on P9
+
+  * [Feature]Update Ubuntu 18.04 lpfc FC driver with 32/64GB HBA support and bug
+    fixes (LP: #1752182)
+    - scsi: lpfc: Fix frequency of Release WQE CQEs
+    - scsi: lpfc: Increase CQ and WQ sizes for SCSI
+    - scsi: lpfc: move placement of target destroy on driver detach
+    - scsi: lpfc: correct debug counters for abort
+    - scsi: lpfc: Add WQ Full Logic for NVME Target
+    - scsi: lpfc: Fix PRLI handling when topology type changes
+    - scsi: lpfc: Fix IO failure during hba reset testing with nvme io.
+    - scsi: lpfc: Fix RQ empty firmware trap
+    - scsi: lpfc: Allow set of maximum outstanding SCSI cmd limit for a target
+    - scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing
+    - scsi: lpfc: Fix issue_lip if link is disabled
+    - scsi: lpfc: Indicate CONF support in NVMe PRLI
+    - scsi: lpfc: Fix SCSI io host reset causing kernel crash
+    - scsi: lpfc: Validate adapter support for SRIU option
+    - scsi: lpfc: Fix header inclusion in lpfc_nvmet
+    - scsi: lpfc: Treat SCSI Write operation Underruns as an error
+    - scsi: lpfc: Fix nonrecovery of NVME controller after cable swap.
+    - scsi: lpfc: update driver version to 11.4.0.7
+    - scsi: lpfc: Update 11.4.0.7 modified files for 2018 Copyright
+    - scsi: lpfc: Rework lpfc to allow different sli4 cq and eq handlers
+    - scsi: lpfc: Rework sli4 doorbell infrastructure
+    - scsi: lpfc: Add SLI-4 if_type=6 support to the code base
+    - scsi: lpfc: Add push-to-adapter support to sli4
+    - scsi: lpfc: Add PCI Ids for if_type=6 hardware
+    - scsi: lpfc: Add 64G link speed support
+    - scsi: lpfc: Add if_type=6 support for cycling valid bits
+    - scsi: lpfc: Enable fw download on if_type=6 devices
+    - scsi: lpfc: Add embedded data pointers for enhanced performance
+    - scsi: lpfc: Fix nvme embedded io length on new hardware
+    - scsi: lpfc: Work around NVME cmd iu SGL type
+    - scsi: lpfc: update driver version to 12.0.0.0
+    - scsi: lpfc: Change Copyright of 12.0.0.0 modified files to 2018
+    - scsi: lpfc: use __raw_writeX on DPP copies
+    - scsi: lpfc: Add missing unlock in WQ full logic
+
+  * /dev/bcache/by-uuid links not created after reboot (LP: #1729145)
+    - SAUCE: (no-up) bcache: decouple emitting a cached_dev CHANGE uevent
+
+  * DKMS driver builds fail with: Cannot use CONFIG_STACK_VALIDATION=y, please
+    install libelf-dev, libelf-devel or elfutils-libelf-devel (LP: #1760876)
+    - [Packaging] include the retpoline extractor in the headers
+
+  * Use med_with_dipm SATA LPM to save more power for mobile platforms
+    (LP: #1759547)
+    - [Config] CONFIG_SATA_MOBILE_LPM_POLICY=3
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Only install cloud init files when do_tools_common=true
+    - SAUCE: Import aufs driver
+    - [Config] Enable AUFS config options
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 12 Apr 2018 09:30:56 -0500
+
+linux (4.16.0-3.4) bionic; urgency=medium
+
+  * Allow multiple mounts of zfs datasets (LP: #1759848)
+    - SAUCE: Allow mounting datasets more than once (LP: #1759848)
+
+  * zfs system process hung on container stop/delete (LP: #1754584)
+    - SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)
+    - Revert "UBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)"
+    - SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)
+
+  * ubuntu_zram_smoke test will cause soft lockup on Artful ThunderX ARM64
+    (LP: #1755073)
+    - SAUCE: crypto: thunderx_zip: Fix fallout from CONFIG_VMAP_STACK
+
+  * CAPI Flash (cxlflash) update (LP: #1752672)
+    - SAUCE: cxlflash: Preserve number of interrupts for master contexts
+    - SAUCE: cxlflash: Avoid clobbering context control register value
+    - SAUCE: cxlflash: Add argument identifier names
+    - SAUCE: cxlflash: Introduce OCXL backend
+    - SAUCE: cxlflash: Hardware AFU for OCXL
+    - SAUCE: cxlflash: Read host function configuration
+    - SAUCE: cxlflash: Setup function acTag range
+    - SAUCE: cxlflash: Read host AFU configuration
+    - SAUCE: cxlflash: Setup AFU acTag range
+    - SAUCE: cxlflash: Setup AFU PASID
+    - SAUCE: cxlflash: Adapter context support for OCXL
+    - SAUCE: cxlflash: Use IDR to manage adapter contexts
+    - SAUCE: cxlflash: Support adapter file descriptors for OCXL
+    - SAUCE: cxlflash: Support adapter context discovery
+    - SAUCE: cxlflash: Support image reload policy modification
+    - SAUCE: cxlflash: MMIO map the AFU
+    - SAUCE: cxlflash: Support starting an adapter context
+    - SAUCE: cxlflash: Support process specific mappings
+    - SAUCE: cxlflash: Support AFU state toggling
+    - SAUCE: cxlflash: Support reading adapter VPD data
+    - SAUCE: cxlflash: Setup function OCXL link
+    - SAUCE: cxlflash: Setup OCXL transaction layer
+    - SAUCE: cxlflash: Support process element lifecycle
+    - SAUCE: cxlflash: Support AFU interrupt management
+    - SAUCE: cxlflash: Support AFU interrupt mapping and registration
+    - SAUCE: cxlflash: Support starting user contexts
+    - SAUCE: cxlflash: Support adapter context polling
+    - SAUCE: cxlflash: Support adapter context reading
+    - SAUCE: cxlflash: Support adapter context mmap and release
+    - SAUCE: cxlflash: Support file descriptor mapping
+    - SAUCE: cxlflash: Introduce object handle fop
+    - SAUCE: cxlflash: Setup LISNs for user contexts
+    - SAUCE: cxlflash: Setup LISNs for master contexts
+    - SAUCE: cxlflash: Update synchronous interrupt status bits
+    - SAUCE: cxlflash: Introduce OCXL context state machine
+    - SAUCE: cxlflash: Register for translation errors
+    - SAUCE: cxlflash: Support AFU reset
+    - SAUCE: cxlflash: Enable OCXL operations
+
+  * [Artful][Wyse 3040] System hang when trying to enable an offlined CPU core
+    (LP: #1736393)
+    - SAUCE: drm/i915:Don't set chip specific data
+    - SAUCE: drm/i915: make previous commit affects Wyse 3040 only
+
+  * zed process consuming 100% cpu (LP: #1751796)
+    - SAUCE: Fix ioctl loop-spin in zed (LP: #1751796)
+
+  * Ubuntu18.04:PowerPC - Set Transparent Huge Pages (THP) by default to
+    "always" (LP: #1753708)
+    - Config: Set TRANSPARENT_HUGEPAGE_ALWAYS=y on ppc64el
+
+  * retpoline hints: primary infrastructure and initial hints (LP: #1758856)
+    - [Packaging] retpoline -- add safe usage hint support
+    - [Packaging] retpoline-check -- only report additions
+    - [Packaging] retpoline -- widen indirect call/jmp detection
+    - [Packaging] retpoline -- elide %rip relative indirections
+    - [Packaging] retpoline -- clear hint information from packages
+    - SAUCE: apm -- annotate indirect calls within
+      firmware_restrict_branch_speculation_{start,end}
+    - SAUCE: EFI -- annotate indirect calls within
+      firmware_restrict_branch_speculation_{start,end}
+    - SAUCE: early/late -- annotate indirect calls in early/late initialisation
+      code
+    - SAUCE: vga_set_mode -- avoid jump tables
+    - [Config] retpoine -- switch to new format
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] final-checks -- remove check for empty retpoline files
+    - [Packaging] skip cloud tools packaging when not building package
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 02 Apr 2018 16:15:36 -0500
+
+linux (4.16.0-2.3) bionic; urgency=medium
+
+  * devpts: handle bind-mounts (LP: #1755857)
+    - SAUCE: devpts: hoist out check for DEVPTS_SUPER_MAGIC
+    - SAUCE: devpts: resolve devpts bind-mounts
+    - SAUCE: devpts: comment devpts_mntget()
+    - SAUCE: selftests: add devpts selftests
+
+  * [bionic][arm64] d-i: add hisi_sas_v3_hw to scsi-modules (LP: #1756103)
+    - d-i: add hisi_sas_v3_hw to scsi-modules
+
+  * [Bionic][ARM64] PCI and SAS driver patches for hip08 SoCs (LP: #1756094)
+    - SAUCE: scsi: hisi_sas: config for hip08 ES
+    - SAUCE: scsi: hisi_sas: export device table of v3 hw to userspace
+
+  * s390/crypto: Fix kernel crash on aes_s390 module remove (LP: #1753424)
+    - SAUCE: s390/crypto: Fix kernel crash on aes_s390 module remove.
+
+  * Fix ARC hit rate (LP: #1755158)
+    - SAUCE: Fix ARC hit rate (LP: #1755158)
+
+  * ZFS setgid broken on 0.7 (LP: #1753288)
+    - SAUCE: Fix ZFS setgid
+
+  * CONFIG_EFI=y on armhf (LP: #1726362)
+    - [Config] CONFIG_EFI=y on armhf, reconcile secureboot EFI settings
+
+  * [Feature] Add xHCI debug device support in the driver (LP: #1730832)
+    - [Config] CONFIG_USB_XHCI_DBGCAP=y
+
+  * retpoline: ignore %cs:0xNNN constant indirections (LP: #1752655)
+    - [Packaging] retpoline -- elide %cs:0xNNNN constants on i386
+    - [Config] retpoline -- clean up i386 retpoline files
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] retpoline-extract: flag *0xNNN(%reg) branches
+    - [Config] fix up retpoline abi files
+    - [Config] fix up retpoline abi files
+    - d-i: Add netsec to nic-modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 19 Mar 2018 14:09:49 -0500
+
+linux (4.16.0-1.2) bionic; urgency=medium
+
+  * Driver not found in Ubuntu kernel does not detect interface (LP: #1745927)
+    - d-i: add cxgb4 to nic-modules
+
+  * Support low-pin-count devices on Hisilicon SoCs (LP: #1677319)
+    - [Config] CONFIG_INDIRECT_PIO=y
+    - SAUCE: LIB: Introduce a generic PIO mapping method
+    - SAUCE: PCI: Remove unused __weak attribute in pci_register_io_range()
+    - SAUCE: PCI: Add fwnode handler as input param of pci_register_io_range()
+    - SAUCE: PCI: Apply the new generic I/O management on PCI IO hosts
+    - SAUCE: OF: Add missing I/O range exception for indirect-IO devices
+    - [Config] CONFIG_HISILICON_LPC=y
+    - SAUCE: HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings
+    - SAUCE: ACPI / scan: do not enumerate Indirect IO host children
+    - SAUCE: HISI LPC: Add ACPI support
+    - SAUCE: MAINTAINERS: Add maintainer for HiSilicon LPC driver
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: tools: use CC for linking acpi tools
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 28 Feb 2018 10:17:23 -0600
+
+linux (4.16.0-0.1) bionic; urgency=medium
+
+  * retpoline abi files are empty on i386 (LP: #1751021)
+    - [Packaging] retpoline-extract -- instantiate retpoline files for i386
+    - [Packaging] final-checks -- sanity checking ABI contents
+    - [Packaging] final-checks -- check for empty retpoline files
+
+  * Miscellaneous upstream changes
+    - disable vbox build
+    - Disable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 22 Feb 2018 08:58:57 -0600
+
+linux (4.16.0-0.0) bionic; urgency=medium
+
+  * Dummy entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 21 Feb 2018 14:33:13 -0600
+
+linux (4.15.0-10.11) bionic; urgency=medium
+
+  * linux: 4.15.0-10.11 -proposed tracker (LP: #1749250)
+
+  * "swiotlb: coherent allocation failed" dmesg spam with linux 4.15.0-9.10
+    (LP: #1749202)
+    - swiotlb: suppress warning when __GFP_NOWARN is set
+    - drm/ttm: specify DMA_ATTR_NO_WARN for huge page pools
+
+  * linux-tools: perf incorrectly linking libbfd (LP: #1748922)
+    - SAUCE: tools -- add ability to disable libbfd
+    - [Packaging] correct disablement of libbfd
+
+  * [Artful] Realtek ALC225: 2 secs noise when a headset plugged in
+    (LP: #1744058)
+    - ALSA: hda/realtek - update ALC225 depop optimize
+
+  * [Artful] Support headset mode for DELL WYSE (LP: #1723913)
+    - SAUCE: ALSA: hda/realtek - Add support headset mode for DELL WYSE
+
+  * headset mic can't be detected on two Dell machines (LP: #1748807)
+    - ALSA: hda/realtek - Support headset mode for ALC215/ALC285/ALC289
+    - ALSA: hda - Fix headset mic detection problem for two Dell machines
+
+  * Bionic update to v4.15.3 stable release (LP: #1749191)
+    - ip6mr: fix stale iterator
+    - net: igmp: add a missing rcu locking section
+    - qlcnic: fix deadlock bug
+    - qmi_wwan: Add support for Quectel EP06
+    - r8169: fix RTL8168EP take too long to complete driver initialization.
+    - tcp: release sk_frag.page in tcp_disconnect
+    - vhost_net: stop device during reset owner
+    - ipv6: addrconf: break critical section in addrconf_verify_rtnl()
+    - ipv6: change route cache aging logic
+    - Revert "defer call to mem_cgroup_sk_alloc()"
+    - net: ipv6: send unsolicited NA after DAD
+    - rocker: fix possible null pointer dereference in
+      rocker_router_fib_event_work
+    - tcp_bbr: fix pacing_gain to always be unity when using lt_bw
+    - cls_u32: add missing RCU annotation.
+    - ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only
+    - soreuseport: fix mem leak in reuseport_add_sock()
+    - net_sched: get rid of rcu_barrier() in tcf_block_put_ext()
+    - net: sched: fix use-after-free in tcf_block_put_ext
+    - media: mtk-vcodec: add missing MODULE_LICENSE/DESCRIPTION
+    - media: soc_camera: soc_scale_crop: add missing
+      MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - media: tegra-cec: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - gpio: uniphier: fix mismatch between license text and MODULE_LICENSE
+    - crypto: tcrypt - fix S/G table for test_aead_speed()
+    - Linux 4.15.3
+
+  * bnx2x_attn_int_deasserted3:4323 MC assert! (LP: #1715519) //
+    CVE-2018-1000026
+    - net: create skb_gso_validate_mac_len()
+    - bnx2x: disable GSO where gso_size is too big for hardware
+
+  * ethtool -p fails to light NIC LED on HiSilicon D05 systems (LP: #1748567)
+    - net: hns: add ACPI mode support for ethtool -p
+
+  * CVE-2017-5715 (Spectre v2 Intel)
+    - [Packaging] retpoline files must be sorted
+    - [Packaging] pull in retpoline files
+
+  * [Feature] PXE boot with Intel Omni-Path (LP: #1712031)
+    - d-i: Add hfi1 to nic-modules
+
+  * CVE-2017-5715 (Spectre v2 retpoline)
+    - [Packaging] retpoline -- add call site validation
+    - [Config] disable retpoline checks for first upload
+
+  * Do not duplicate changelog entries assigned to more than one bug or CVE
+    (LP: #1743383)
+    - [Packaging] git-ubuntu-log -- handle multiple bugs/cves better
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 13 Feb 2018 11:33:58 -0600
+
+linux (4.15.0-9.10) bionic; urgency=medium
+
+  * linux: 4.15.0-9.10 -proposed tracker (LP: #1748244)
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] tests -- remove gcc-multilib dependency for arm64
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 08 Feb 2018 11:25:04 -0600
+
+linux (4.15.0-8.9) bionic; urgency=medium
+
+  * linux: 4.15.0-8.9 -proposed tracker (LP: #1748075)
+
+  * Bionic update to v4.15.2 stable release (LP: #1748072)
+    - KVM: x86: Make indirect calls in emulator speculation safe
+    - KVM: VMX: Make indirect call speculation safe
+    - module/retpoline: Warn about missing retpoline in module
+    - x86/cpufeatures: Add CPUID_7_EDX CPUID leaf
+    - x86/cpufeatures: Add Intel feature bits for Speculation Control
+    - x86/cpufeatures: Add AMD feature bits for Speculation Control
+    - x86/msr: Add definitions for new speculation control MSRs
+    - x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown
+    - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes
+    - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support
+    - x86/alternative: Print unadorned pointers
+    - x86/nospec: Fix header guards names
+    - x86/bugs: Drop one "mitigation" from dmesg
+    - x86/cpu/bugs: Make retpoline module warning conditional
+    - x86/cpufeatures: Clean up Spectre v2 related CPUID flags
+    - x86/retpoline: Simplify vmexit_fill_RSB()
+    - x86/speculation: Simplify indirect_branch_prediction_barrier()
+    - auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - iio: adc/accel: Fix up module licenses
+    - pinctrl: pxa: pxa2xx: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - KVM: nVMX: Eliminate vmcs02 pool
+    - KVM: VMX: introduce alloc_loaded_vmcs
+    - objtool: Improve retpoline alternative handling
+    - objtool: Add support for alternatives at the end of a section
+    - objtool: Warn on stripped section symbol
+    - x86/mm: Fix overlap of i386 CPU_ENTRY_AREA with FIX_BTMAP
+    - x86/spectre: Check CONFIG_RETPOLINE in command line parser
+    - x86/entry/64: Remove the SYSCALL64 fast path
+    - x86/entry/64: Push extra regs right away
+    - x86/asm: Move 'status' from thread_struct to thread_info
+    - Documentation: Document array_index_nospec
+    - array_index_nospec: Sanitize speculative array de-references
+    - x86: Implement array_index_mask_nospec
+    - x86: Introduce barrier_nospec
+    - x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec
+    - x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end}
+    - x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec
+    - x86/get_user: Use pointer masking to limit speculation
+    - x86/syscall: Sanitize syscall table de-references under speculation
+    - vfs, fdtable: Prevent bounds-check bypass via speculative execution
+    - nl80211: Sanitize array index in parse_txq_params
+    - x86/spectre: Report get_user mitigation for spectre_v1
+    - x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable"
+    - x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel
+    - x86/speculation: Use Indirect Branch Prediction Barrier in context switch
+    - x86/paravirt: Remove 'noreplace-paravirt' cmdline option
+    - KVM: VMX: make MSR bitmaps per-VCPU
+    - x86/kvm: Update spectre-v1 mitigation
+    - x86/retpoline: Avoid retpolines for built-in __init functions
+    - x86/spectre: Simplify spectre_v2 command line parsing
+    - x86/pti: Mark constant arrays as __initconst
+    - x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL
+    - KVM/x86: Update the reverse_cpuid list to include CPUID_7_EDX
+    - KVM/x86: Add IBPB support
+    - KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES
+    - KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL
+    - KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL
+    - serial: core: mark port as initialized after successful IRQ change
+    - fpga: region: release of_parse_phandle nodes after use
+    - Linux 4.15.2
+
+  * Add support for the NIC on SynQuacer E-Series boards (LP: #1747792)
+    - net: phy: core: remove now uneeded disabling of interrupts
+    - [Config] CONFIG_NET_VENDOR_SOCIONEXT=y & CONFIG_SNI_NETSEC=m
+    - net: socionext: Add Synquacer NetSec driver
+    - net: socionext: include linux/io.h to fix build
+    - net: socionext: Fix error return code in netsec_netdev_open()
+
+  * [Artful/Bionic] [Config] enable EDAC_GHES for ARM64 (LP: #1747746)
+    - [Config] CONFIG_EDAC_GHES=y
+
+  * support thunderx2 vendor pmu events (LP: #1747523)
+    - perf pmu: Pass pmu as a parameter to get_cpuid_str()
+    - perf tools arm64: Add support for get_cpuid_str function.
+    - perf pmu: Add helper function is_pmu_core to detect PMU CORE devices
+    - perf vendor events arm64: Add ThunderX2 implementation defined pmu core
+      events
+    - perf pmu: Add check for valid cpuid in perf_pmu__find_map()
+
+  * linux 4.14.0-7.9 ADT test failure with linux 4.14.0-7.9 (LP: #1732463)
+    - SAUCE: mm: disable vma based swap readahead by default
+    - SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Fix CONFIG_PROFILE_ALL_BRANCHES annotations
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 07 Feb 2018 21:13:27 -0600
+
+linux (4.15.0-7.8) bionic; urgency=medium
+
+  * Bionic update to v4.15.1 stable release (LP: #1747169)
+    - Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops
+    - tools/gpio: Fix build error with musl libc
+    - gpio: stmpe: i2c transfer are forbiden in atomic context
+    - gpio: Fix kernel stack leak to userspace
+    - ALSA: hda - Reduce the suspend time consumption for ALC256
+    - crypto: ecdh - fix typo in KPP dependency of CRYPTO_ECDH
+    - crypto: aesni - handle zero length dst buffer
+    - crypto: aesni - fix typo in generic_gcmaes_decrypt
+    - crypto: aesni - add wrapper for generic gcm(aes)
+    - crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-
+      aesni
+    - crypto: aesni - Fix out-of-bounds access of the AAD buffer in generic-gcm-
+      aesni
+    - crypto: inside-secure - fix hash when length is a multiple of a block
+    - crypto: inside-secure - avoid unmapping DMA memory that was not mapped
+    - crypto: sha3-generic - fixes for alignment and big endian operation
+    - crypto: af_alg - whitelist mask and type
+    - HID: wacom: EKR: ensure devres groups at higher indexes are released
+    - HID: wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events
+    - power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE
+    - mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - igb: Free IRQs when device is hotplugged
+    - ima/policy: fix parsing of fsuuid
+    - scsi: aacraid: Fix udev inquiry race condition
+    - scsi: aacraid: Fix hang in kdump
+    - scsi: storvsc: missing error code in storvsc_probe()
+    - staging: lustre: separate a connection destroy from free struct kib_conn
+    - staging: ccree: NULLify backup_info when unused
+    - staging: ccree: fix fips event irq handling build
+    - tty: fix data race between tty_init_dev and flush of buf
+    - usb: option: Add support for FS040U modem
+    - USB: serial: pl2303: new device id for Chilitag
+    - USB: cdc-acm: Do not log urb submission errors on disconnect
+    - CDC-ACM: apply quirk for card reader
+    - USB: serial: io_edgeport: fix possible sleep-in-atomic
+    - usbip: prevent bind loops on devices attached to vhci_hcd
+    - usbip: list: don't list devices attached to vhci_hcd
+    - USB: serial: simple: add Motorola Tetra driver
+    - usb: f_fs: Prevent gadget unbind if it is already unbound
+    - usb: uas: unconditionally bring back host after reset
+    - usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc()
+    - ANDROID: binder: remove waitqueue when thread exits.
+    - android: binder: use VM_ALLOC to get vm area
+    - mei: me: allow runtime pm for platform with D0i3
+    - serial: 8250_of: fix return code when probe function fails to get reset
+    - serial: 8250_uniphier: fix error return code in uniphier_uart_probe()
+    - serial: 8250_dw: Revert "Improve clock rate setting"
+    - serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS
+    - spi: imx: do not access registers while clocks disabled
+    - iio: adc: stm32: fix scan of multiple channels with DMA
+    - iio: chemical: ccs811: Fix output of IIO_CONCENTRATION channels
+    - test_firmware: fix missing unlock on error in config_num_requests_store()
+    - Input: synaptics-rmi4 - unmask F03 interrupts when port is opened
+    - Input: synaptics-rmi4 - do not delete interrupt memory too early
+    - x86/efi: Clarify that reset attack mitigation needs appropriate userspace
+    - Linux 4.15.1
+
+  * Dell XPS 13 9360 bluetooth (Atheros) won't connect after resume
+    (LP: #1744712)
+    - Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
+    - Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten"
+      version
+
+  * apparmor profile load in stacked policy container fails (LP: #1746463)
+    - SAUCE: apparmor: fix display of .ns_name for containers
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 04 Feb 2018 11:56:32 +0100
+
+linux (4.15.0-6.7) bionic; urgency=low
+
+  * upload urgency should be medium by default (LP: #1745338)
+    - [Packaging] update urgency to medium by default
+
+  * Shutdown hang on 16.04 with iscsi targets (LP: #1569925)
+    - scsi: libiscsi: Allow sd_shutdown on bad transport
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.5-1ubuntu1, zfs to 0.7.5-1ubuntu1
+    - Revert "UBUNTU: SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM"
+    - Revert "UBUNTU: SAUCE: mm: disable vma based swap readahead by default"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jan 2018 08:47:07 -0600
+
+linux (4.15.0-5.6) bionic; urgency=low
+
+  * $(LOCAL_ENV_CC) and $(LOCAL_ENV_DISTCC_HOSTS) should be properly quoted
+    (LP: #1744077)
+    - [Debian] pass LOCAL_ENV_CC and LOCAL_ENV_DISTCC_HOSTS properly
+
+  * Missing install-time driver for QLogic QED 25/40/100Gb Ethernet NIC
+    (LP: #1743638)
+    - [d-i] Add qede to nic-modules udeb
+
+  * boot failure on AMD Raven + WesternXT (LP: #1742759)
+    - SAUCE: drm/amdgpu: add atpx quirk handling (v2)
+
+  * Unable to handle kernel NULL pointer dereference at isci_task_abort_task
+    (LP: #1726519)
+    - SAUCE: Revert "scsi: libsas: allow async aborts"
+
+  * Update Ubuntu-4.15.0 config to support Intel Atom devices (LP: #1739939)
+    - [Config] CONFIG_SERIAL_DEV_BUS=y, CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v4.15-rc7
+    - [Config] CONFIG_CPU_ISOLATION=y
+    - [Config] Update annotations following config review
+    - Revert "UBUNTU: SAUCE: Import aufs driver"
+    - SAUCE: Import aufs driver
+    - ubuntu: vbox -- update to 5.2.6-dfsg-1
+    - ubuntu: vbox: build fixes for 4.15
+    - ubuntu: vbox -- update to 5.2.6-dfsg-2
+    - hio: updates for timer api changes in 4.15
+    - enable hio build
+    - Rebase to v4.15-rc9
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc9
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jan 2018 10:16:05 -0600
+
+linux (4.15.0-4.5) bionic; urgency=low
+
+  * [0cf3:e010] QCA6174A XR failed to pair with bt 4.0 device  (LP: #1741166)
+    - SAUCE: Bluetooth: btusb: Add support for 0cf3:e010
+
+  * External HDMI monitor failed to show screen on Lenovo X1 series
+    (LP: #1738523)
+    - SAUCE: drm/i915: Disable writing of TMDS_OE on Lenovo ThinkPad X1 series
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] autoreconstruct - add resoration of execute permissions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 10 Jan 2018 10:24:22 -0600
+
+linux (4.15.0-3.4) bionic; urgency=low
+
+  * ubuntu/xr-usb-serial didn't get built in zesty and artful (LP: #1733281)
+    - SAUCE: make sure ubuntu/xr-usb-serial builds for x86
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 03 Jan 2018 20:20:43 -0600
+
+linux (4.15.0-2.3) bionic; urgency=low
+
+  * nvidia-graphics-drivers-384 384.90-0ubuntu6 ADT test failure with linux
+    4.15.0-1.2 (LP: #1737752)
+    - x86/mm: Unbreak modules that use the DMA API
+
+  * Ubuntu 17.10 corrupting BIOS - many LENOVO laptops models (LP: #1734147)
+    - [Config] CONFIG_SPI_INTEL_SPI_*=n
+
+  * power: commonise configs IBMVETH/IBMVSCSI and ensure both are in linux-image
+    and udebs (LP: #1521712)
+    - [Config] Include ibmvnic in nic-modules
+
+  * Enable arm64 emulation of removed ARMv7 instructions (LP: #1545542)
+    - [Config] Enable support for emulation of deprecated ARMv8 instructions
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl with 4.15 compat fix (LP:#1737761)
+    - Enable zfs build
+    - [Debian] add icp to zfs-modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 18 Dec 2017 09:27:13 -0600
+
+linux (4.15.0-1.2) bionic; urgency=low
+
+  * Disabling zfs does not always disable module checks for the zfs modules
+    (LP: #1737176)
+    - [Packaging] disable zfs module checks when zfs is disabled
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_UNWINDER_FRAME_POINTER=y for amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 10 Dec 2017 22:07:19 -0600
+
+linux (4.15.0-0.1) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu: vbox -- update to 5.2.2-dfsg-2
+    - ubuntu: vbox: build fixes for 4.15
+    - disable hio build
+    - [Config] Update kernel lockdown options to fix build errors
+    - Disable zfs build
+    - SAUCE: Import aufs driver
+    - [Config] Enable AUFS config options
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 08 Dec 2017 13:55:42 -0600
+
+linux (4.14.0-11.13) bionic; urgency=low
+
+  * linux: 4.14.0-11.13 -proposed tracker (LP: #1736168)
+
+  * CVE-2017-1000405
+    - mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
+
+  * linux 4.14.0-7.9 ADT test failure with linux 4.14.0-7.9 (LP: #1732463)
+    - SAUCE: mm: disable vma based swap readahead by default
+    - SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM
+
+  * Bionic update to v4.14.3 stable release (LP: #1735843)
+    - s390: fix transactional execution control register handling
+    - s390/noexec: execute kexec datamover without DAT
+    - s390/runtime instrumention: fix possible memory corruption
+    - s390/guarded storage: fix possible memory corruption
+    - s390/disassembler: add missing end marker for e7 table
+    - s390/disassembler: increase show_code buffer size
+    - ACPI / PM: Fix acpi_pm_notifier_lock vs flush_workqueue() deadlock
+    - ACPI / EC: Fix regression related to triggering source of EC event handling
+    - cpufreq: schedutil: Reset cached_raw_freq when not in sync with next_freq
+    - serdev: fix registration of second slave
+    - sched: Make resched_cpu() unconditional
+    - lib/mpi: call cond_resched() from mpi_powm() loop
+    - x86/boot: Fix boot failure when SMP MP-table is based at 0
+    - x86/decoder: Add new TEST instruction pattern
+    - x86/entry/64: Fix entry_SYSCALL_64_after_hwframe() IRQ tracing
+    - x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
+    - perf/x86/intel: Hide TSX events when RTM is not supported
+    - arm64: Implement arch-specific pte_access_permitted()
+    - ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
+    - ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
+    - uapi: fix linux/tls.h userspace compilation error
+    - uapi: fix linux/rxrpc.h userspace compilation errors
+    - MIPS: cmpxchg64() and HAVE_VIRT_CPU_ACCOUNTING_GEN don't work for 32-bit SMP
+    - MIPS: ralink: Fix MT7628 pinmux
+    - MIPS: ralink: Fix typo in mt7628 pinmux function
+    - net: mvneta: fix handling of the Tx descriptor counter
+    - nbd: wait uninterruptible for the dead timeout
+    - nbd: don't start req until after the dead connection logic
+    - PM / OPP: Add missing of_node_put(np)
+    - PCI/ASPM: Account for downstream device's Port Common_Mode_Restore_Time
+    - PCI/ASPM: Use correct capability pointer to program LTR_L1.2_THRESHOLD
+    - PCI: hv: Use effective affinity mask
+    - PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
+    - PCI: Apply Cavium ThunderX ACS quirk to more Root Ports
+    - ALSA: hda: Add Raven PCI ID
+    - dm integrity: allow unaligned bv_offset
+    - dm cache: fix race condition in the writeback mode overwrite_bio
+      optimisation
+    - dm crypt: allow unaligned bv_offset
+    - dm zoned: ignore last smaller runt zone
+    - dm mpath: remove annoying message of 'blk_get_request() returned -11'
+    - dm bufio: fix integer overflow when limiting maximum cache size
+    - ovl: Put upperdentry if ovl_check_origin() fails
+    - dm: allocate struct mapped_device with kvzalloc
+    - sched/rt: Simplify the IPI based RT balancing logic
+    - MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
+    - dm: fix race between dm_get_from_kobject() and __dm_destroy()
+    - dm: discard support requires all targets in a table support discards
+    - MIPS: Fix odd fp register warnings with MIPS64r2
+    - MIPS: Fix MIPS64 FP save/restore on 32-bit kernels
+    - MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
+    - MIPS: Fix an n32 core file generation regset support regression
+    - MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
+    - MIPS: math-emu: Fix final emulation phase for certain instructions
+    - rt2x00usb: mark device removed when get ENOENT usb error
+    - mm/z3fold.c: use kref to prevent page free/compact race
+    - autofs: don't fail mount for transient error
+    - nilfs2: fix race condition that causes file system corruption
+    - fscrypt: lock mutex before checking for bounce page pool
+    - eCryptfs: use after free in ecryptfs_release_messaging()
+    - libceph: don't WARN() if user tries to add invalid key
+    - bcache: check ca->alloc_thread initialized before wake up it
+    - fs: guard_bio_eod() needs to consider partitions
+    - fanotify: fix fsnotify_prepare_user_wait() failure
+    - isofs: fix timestamps beyond 2027
+    - btrfs: change how we decide to commit transactions during flushing
+    - f2fs: expose some sectors to user in inline data or dentry case
+    - NFS: Fix typo in nomigration mount option
+    - NFS: Revert "NFS: Move the flock open mode check into nfs_flock()"
+    - nfs: Fix ugly referral attributes
+    - NFS: Avoid RCU usage in tracepoints
+    - NFS: revalidate "." etc correctly on "open".
+    - nfsd: deal with revoked delegations appropriately
+    - rtlwifi: rtl8192ee: Fix memory leak when loading firmware
+    - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
+    - iwlwifi: fix firmware names for 9000 and A000 series hw
+    - md: fix deadlock error in recent patch.
+    - md: don't check MD_SB_CHANGE_CLEAN in md_allow_write
+    - Bluetooth: btqcomsmd: Add support for BD address setup
+    - md/bitmap: revert a patch
+    - fsnotify: clean up fsnotify_prepare/finish_user_wait()
+    - fsnotify: pin both inode and vfsmount mark
+    - fsnotify: fix pinning group in fsnotify_prepare_user_wait()
+    - ata: fixes kernel crash while tracing ata_eh_link_autopsy event
+    - ext4: fix interaction between i_size, fallocate, and delalloc after a crash
+    - ext4: prevent data corruption with inline data + DAX
+    - ext4: prevent data corruption with journaling + DAX
+    - ALSA: pcm: update tstamp only if audio_tstamp changed
+    - ALSA: usb-audio: Add sanity checks to FE parser
+    - ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
+    - ALSA: usb-audio: Add sanity checks in v2 clock parsers
+    - ALSA: timer: Remove kernel warning at compat ioctl error paths
+    - ALSA: hda/realtek - Fix ALC275 no sound issue
+    - ALSA: hda: Fix too short HDMI/DP chmap reporting
+    - ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization
+    - ALSA: hda/realtek - Fix ALC700 family no sound issue
+    - ASoC: sun8i-codec: Invert Master / Slave condition
+    - ASoC: sun8i-codec: Fix left and right channels inversion
+    - ASoC: sun8i-codec: Set the BCLK divider
+    - mfd: lpc_ich: Avoton/Rangeley uses SPI_BYT method
+    - fix a page leak in vhost_scsi_iov_to_sgl() error recovery
+    - 9p: Fix missing commas in mount options
+    - fs/9p: Compare qid.path in v9fs_test_inode
+    - net/9p: Switch to wait_event_killable()
+    - scsi: qla2xxx: Suppress a kernel complaint in qla_init_base_qpair()
+    - scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics()
+    - scsi: lpfc: fix pci hot plug crash in timer management routines
+    - scsi: lpfc: fix pci hot plug crash in list_add call
+    - scsi: lpfc: Fix crash receiving ELS while detaching driver
+    - scsi: lpfc: Fix FCP hba_wqidx assignment
+    - scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails
+    - iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref
+    - iscsi-target: Fix non-immediate TMR reference leak
+    - target: fix null pointer regression in core_tmr_drain_tmr_list
+    - target: fix buffer offset in core_scsi3_pri_read_full_status
+    - target: Fix QUEUE_FULL + SCSI task attribute handling
+    - target: Fix caw_sem leak in transport_generic_request_failure
+    - target: Fix quiese during transport_write_pending_qf endless loop
+    - target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK
+    - mtd: Avoid probe failures when mtd->dbg.dfs_dir is invalid
+    - mtd: nand: Export nand_reset() symbol
+    - mtd: nand: atmel: Actually use the PM ops
+    - mtd: nand: omap2: Fix subpage write
+    - mtd: nand: Fix writing mtdoops to nand flash.
+    - mtd: nand: mtk: fix infinite ECC decode IRQ issue
+    - mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush sequence
+    - p54: don't unregister leds when they are not initialized
+    - block: Fix a race between blk_cleanup_queue() and timeout handling
+    - raid1: prevent freeze_array/wait_all_barriers deadlock
+    - genirq: Track whether the trigger type has been set
+    - irqchip/gic-v3: Fix ppi-partitions lookup
+    - lockd: double unregister of inetaddr notifiers
+    - KVM: PPC: Book3S HV: Don't call real-mode XICS hypercall handlers if not
+      enabled
+    - KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
+    - KVM: SVM: obey guest PAT
+    - kvm: vmx: Reinstate support for CPUs without virtual NMI
+    - dax: fix PMD faults on zero-length files
+    - dax: fix general protection fault in dax_alloc_inode
+    - SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
+    - clk: ti: dra7-atl-clock: fix child-node lookups
+    - libnvdimm, dimm: clear 'locked' status on successful DIMM enable
+    - libnvdimm, pfn: make 'resource' attribute only readable by root
+    - libnvdimm, namespace: fix label initialization to use valid seq numbers
+    - libnvdimm, region : make 'resource' attribute only readable by root
+    - libnvdimm, namespace: make 'resource' attribute only readable by root
+    - svcrdma: Preserve CB send buffer across retransmits
+    - IB/srpt: Do not accept invalid initiator port names
+    - IB/cm: Fix memory corruption in handling CM request
+    - IB/hfi1: Fix incorrect available receive user context count
+    - IB/srp: Avoid that a cable pull can trigger a kernel crash
+    - IB/core: Avoid crash on pkey enforcement failed in received MADs
+    - IB/core: Only maintain real QPs in the security lists
+    - NFC: fix device-allocation error return
+    - spi-nor: intel-spi: Fix broken software sequencing codes
+    - i40e: Use smp_rmb rather than read_barrier_depends
+    - igb: Use smp_rmb rather than read_barrier_depends
+    - igbvf: Use smp_rmb rather than read_barrier_depends
+    - ixgbevf: Use smp_rmb rather than read_barrier_depends
+    - i40evf: Use smp_rmb rather than read_barrier_depends
+    - fm10k: Use smp_rmb rather than read_barrier_depends
+    - ixgbe: Fix skb list corruption on Power systems
+    - parisc: Fix validity check of pointer size argument in new CAS
+      implementation
+    - powerpc: Fix boot on BOOK3S_32 with CONFIG_STRICT_KERNEL_RWX
+    - powerpc/mm/radix: Fix crashes on Power9 DD1 with radix MMU and STRICT_RWX
+    - powerpc/perf/imc: Use cpu_to_node() not topology_physical_package_id()
+    - powerpc/signal: Properly handle return value from uprobe_deny_signal()
+    - powerpc/64s: Fix masking of SRR1 bits on instruction fault
+    - powerpc/64s/radix: Fix 128TB-512TB virtual address boundary case allocation
+    - powerpc/64s/hash: Fix 512T hint detection to use >= 128T
+    - powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case allocation
+    - powerpc/64s/hash: Fix fork() with 512TB process address space
+    - powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary
+    - media: Don't do DMA on stack for firmware upload in the AS102 driver
+    - media: rc: check for integer overflow
+    - media: rc: nec decoder should not send both repeat and keycode
+    - cx231xx-cards: fix NULL-deref on missing association descriptor
+    - media: v4l2-ctrl: Fix flags field on Control events
+    - media: venus: fix wrong size on dma_free
+    - media: venus: venc: fix bytesused v4l2_plane field
+    - media: venus: reimplement decoder stop command
+    - ARM64: dts: meson-gxl: Add alternate ARM Trusted Firmware reserved memory
+      zone
+    - iwlwifi: fix wrong struct for a000 device
+    - iwlwifi: add a new a000 device
+    - iwlwifi: pcie: sort IDs for the 9000 series for easier comparisons
+    - iwlwifi: add new cards for a000 series
+    - iwlwifi: add new cards for 8265 series
+    - iwlwifi: add new cards for 8260 series
+    - iwlwifi: fix PCI IDs and configuration mapping for 9000 series
+    - iwlwifi: mvm: support version 7 of the SCAN_REQ_UMAC FW command
+    - e1000e: Fix error path in link detection
+    - e1000e: Fix return value test
+    - e1000e: Separate signaling for link check/link up
+    - e1000e: Avoid receiver overrun interrupt bursts
+    - e1000e: fix buffer overrun while the I219 is processing DMA transactions
+    - Linux 4.14.3
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: s390/topology: don't inline cpu_to_node
+    - SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to 0.7.3-1ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 04 Dec 2017 09:08:07 -0600
+
+linux (4.14.0-10.12) bionic; urgency=low
+
+  * linux: 4.14.0-10.12 -proposed tracker (LP: #1734901)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Enable the ACPI kernel debugger and acpidbg tool
+    - [Packaging] Include arch/arm64/kernel/ftrace-mod.o in headers package
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Nov 2017 08:46:49 -0600
+
+linux (4.14.0-9.11) bionic; urgency=low
+
+  * linux: 4.14.0-9.11 -proposed tracker (LP: #1734728)
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to
+      0.7.3-1ubuntu1"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Nov 2017 12:44:48 -0600
+
+linux (4.14.0-8.10) bionic; urgency=low
+
+  * linux: 4.14.0-8.10 -proposed tracker (LP: #1734695)
+
+  * Bionic update to v4.14.2 stable release (LP: #1734694)
+    - bio: ensure __bio_clone_fast copies bi_partno
+    - af_netlink: ensure that NLMSG_DONE never fails in dumps
+    - vxlan: fix the issue that neigh proxy blocks all icmpv6 packets
+    - net: cdc_ncm: GetNtbFormat endian fix
+    - fealnx: Fix building error on MIPS
+    - net/sctp: Always set scope_id in sctp_inet6_skb_msgname
+    - ima: do not update security.ima if appraisal status is not INTEGRITY_PASS
+    - serial: omap: Fix EFR write on RTS deassertion
+    - serial: 8250_fintek: Fix finding base_port with activated SuperIO
+    - tpm-dev-common: Reject too short writes
+    - rcu: Fix up pending cbs check in rcu_prepare_for_idle
+    - mm/pagewalk.c: report holes in hugetlb ranges
+    - ocfs2: fix cluster hang after a node dies
+    - ocfs2: should wait dio before inode lock in ocfs2_setattr()
+    - ipmi: fix unsigned long underflow
+    - mm/page_alloc.c: broken deferred calculation
+    - mm/page_ext.c: check if page_ext is not prepared
+    - coda: fix 'kernel memory exposure attempt' in fsync
+    - ipmi: Prefer ACPI system interfaces over SMBIOS ones
+    - Linux 4.14.2
+
+  * Bionic update to v4.14.1 stable release (LP: #1734693)
+    - EDAC, sb_edac: Don't create a second memory controller if HA1 is not present
+    - dmaengine: dmatest: warn user when dma test times out
+    - media: imon: Fix null-ptr-deref in imon_probe
+    - media: dib0700: fix invalid dvb_detach argument
+    - crypto: dh - Fix double free of ctx->p
+    - crypto: dh - Don't permit 'p' to be 0
+    - crypto: dh - Don't permit 'key' or 'g' size longer than 'p'
+    - crypto: brcm - Explicity ACK mailbox message
+    - USB: early: Use new USB product ID and strings for DbC device
+    - USB: usbfs: compute urb->actual_length for isochronous
+    - USB: Add delay-init quirk for Corsair K70 LUX keyboards
+    - usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
+    - USB: serial: metro-usb: stop I/O after failed open
+    - USB: serial: Change DbC debug device binding ID
+    - USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update
+    - USB: serial: garmin_gps: fix I/O after failed probe and remove
+    - USB: serial: garmin_gps: fix memory leak on probe errors
+    - selftests/x86/protection_keys: Fix syscall NR redefinition warnings
+    - x86/MCE/AMD: Always give panic severity for UC errors in kernel context
+    - platform/x86: peaq-wmi: Add DMI check before binding to the WMI interface
+    - platform/x86: peaq_wmi: Fix missing terminating entry for peaq_dmi_table
+    - HID: cp2112: add HIDRAW dependency
+    - HID: wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection
+    - rpmsg: glink: Add missing MODULE_LICENSE
+    - staging: wilc1000: Fix bssid buffer offset in Txq
+    - staging: sm750fb: Fix parameter mistake in poke32
+    - staging: ccree: fix 64 bit scatter/gather DMA ops
+    - staging: greybus: spilib: fix use-after-free after deregistration
+    - staging: rtl8188eu: Revert 4 commits breaking ARP
+    - spi: fix use-after-free at controller deregistration
+    - sparc32: Add cmpxchg64().
+    - sparc64: mmu_context: Add missing include files
+    - sparc64: Fix page table walk for PUD hugepages
+    - Linux 4.14.1
+
+  * Set PANIC_TIMEOUT=10 on Power Systems (LP: #1730660)
+    - [Config]: Set PANIC_TIMEOUT=10 on ppc64el
+
+  * enable CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH easily confuse users
+    (LP: #1732627)
+    - [Config] CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH=n
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to 0.7.3-1ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Nov 2017 07:43:44 -0600
+
+linux (4.14.0-7.9) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor: add base infastructure for socket mediation
+    - SAUCE: apparmor: af_unix mediation
+    - SAUCE: LSM stacking: procfs: add smack subdir to attrs
+    - SAUCE: LSM stacking: LSM: manage credential security blobs
+    - SAUCE: LSM stacking: LSM: Manage file security blobs
+    - SAUCE: LSM stacking: LSM: manage task security blobs
+    - SAUCE: LSM stacking: LSM: Infrastructure management of the remaining blobs
+    - SAUCE: LSM stacking: LSM: general but not extreme module stacking
+    - SAUCE: LSM stacking: LSM: Complete task_alloc hook
+    - SAUCE: LSM stacking: fixup procsfs: add smack subdir to attrs
+    - SAUCE: LSM stacking: fixup initialize task->security
+    - SAUCE: LSM stacking: fixup: alloc_task_ctx is dead code
+    - SAUCE: LSM stacking: add support for stacking getpeersec_stream
+    - SAUCE: LSM stacking: add stacking support to apparmor network hooks
+    - SAUCE: LSM stacking: fixup apparmor stacking enablement
+    - SAUCE: LSM stacking: fixup stacking kconfig
+    - SAUCE: LSM stacking: allow selecting multiple LSMs using kernel boot params
+    - SAUCE: LSM stacking: provide prctl interface for setting context
+    - SAUCE: LSM stacking: inherit current display LSM
+    - SAUCE: LSM stacking: keep an index for each registered LSM
+    - SAUCE: LSM stacking: verify display LSM
+    - SAUCE: LSM stacking: provide a way to specify the default display lsm
+    - SAUCE: LSM stacking: make sure LSM blob align on 64 bit boundaries
+    - SAUCE: LSM stacking: add /proc/<pid>/attr/display_lsm
+    - SAUCE: LSM stacking: add Kconfig to set default display LSM
+    - SAUCE: LSM stacking: add configs for LSM stacking
+    - SAUCE: LSM stacking: check for invalid zero sized writes
+    - [Config] Run updateconfigs after merging LSM stacking
+    - [Config] CONFIG_AMD_MEM_ENCRYPT=y
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 13 Nov 2017 08:12:08 -0600
+
+linux (4.14.0-6.8) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: add workarounds to enable ZFS for 4.14
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Nov 2017 11:39:00 -0600
+
+linux (4.14.0-5.7) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Fix invocation of dh_prep for dbgsym packages
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 31 Oct 2017 07:07:23 -0500
+
+linux (4.14.0-4.5) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] virtualbox -- reduce in kernel module versions
+    - vbox-update: Fix up KERN_DIR definitions
+    - ubuntu: vbox -- update to 5.2.0-dfsg-2
+    - [Config] CONFIG_AMD_MEM_ENCRYPT=n
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 30 Oct 2017 13:29:20 -0500
+
+linux (4.14.0-3.4) artful; urgency=low
+
+  * Touchpad and TrackPoint Dose Not Work on Lenovo X1C6 and X280 (LP: #1723986)
+    - SAUCE: Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3
+    - SAUCE: Input: synaptics - Lenovo X1 Carbon 5 should use SMBUS/RMI
+    - SAUCE: Input: synaptics - add Intertouch support on X1 Carbon 6th and X280
+
+  * powerpc/64s: Add workaround for P9 vector CI load issuenext (LP: #1721070)
+    - powerpc/64s: Add workaround for P9 vector CI load issue
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: staging: vboxvideo: Fix reporting invalid suggested-offset-properties
+    - [Config] CONFIG_DRM_VBOXVIDEO=m
+    - SAUCE: Import aufs driver
+    - [Config] Enable aufs
+    - [Config] Reorder annotations file after enabling aufs
+    - vbox-update: Disable imported vboxvideo module
+    - ubuntu: vbox -- update to 5.1.30-dfsg-1
+    - Enable vbox
+    - hio: Use correct sizes when initializing ssd_index_bits* arrays
+    - hio: Update io stat accounting for 4.14
+    - Enable hio
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc5
+  * Rebase to v4.14-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 23 Oct 2017 13:53:52 -0500
+
+linux (4.14.0-2.3) artful; urgency=low
+
+  * [Bug] USB controller failed to respond on Denverton after loading
+    intel_th_pci module (LP: #1715833)
+    - SAUCE: PCI: Disable broken RTIT_BAR of Intel TH
+
+  * CONFIG_DEBUG_FS is not enabled by "make zfcpdump_defconfig" with Ubuntu
+    17.10 (kernel 4.13) (LP: #1719290)
+    - SAUCE: s390: update zfcpdump_defconfig
+
+  * Add installer support for Broadcom BCM573xx network drivers. (LP: #1720466)
+    - d-i: Add bnxt_en to nic-modules.
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update annotations for 4.14-rc2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc3
+  * Rebase to v4.14-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 11 Oct 2017 16:04:27 -0500
+
+linux (4.14.0-1.2) artful; urgency=low
+
+  * [Bug] USB 3.1 Gen2 works as 5Gbps (LP: #1720045)
+    - xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
+
+  * Please make linux-libc-dev Provide: aufs-dev (LP: #1716091)
+    - [Packaging] Add aufs-dev to the Provides: for linux-libc-dev
+
+  * Upgrade to 4.13.0-11.12 in artful amd64 VM breaks display on wayland
+    (LP: #1718679)
+    - [Config] CONFIG_DRM_VBOXVIDEO=n
+
+  * ipmmu-vmsa driver breaks arm64 boots (LP: #1718734)
+    - [Config] Disable CONFIG_IPMMU_VMSA on arm64
+
+  * autopkgtest profile fails to build on armhf (LP: #1717920)
+    - [Packaging] autopkgtest -- disable d-i when dropping flavours
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_I2C_XLP9XX=m
+    - [Packaging] Use SRCPKGNAME rather than hard-coding the source package name
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 29 Sep 2017 09:09:11 -0400
+
+linux (4.14.0-0.1) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - Disable vbox build
+    - Disable hio build
+    - Disable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 19 Sep 2017 20:22:29 -0500
+
+linux (4.13.0-11.12) artful; urgency=low
+
+  * linux: 4.13.0-11.12 -proposed tracker (LP: #1716699)
+
+  * kernel panic -not syncing: Fatal exception: panic_on_oops (LP: #1708399)
+    - s390/mm: fix local TLB flushing vs. detach of an mm address space
+    - s390/mm: fix race on mm->context.flush_mm
+
+  * CVE-2017-1000251
+    - Bluetooth: Properly check L2CAP config option output buffer length
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 12 Sep 2017 10:18:38 -0500
+
+linux (4.13.0-10.11) artful; urgency=low
+
+  * linux: 4.13.0-10.11 -proposed tracker (LP: #1716287)
+
+  * please add aufs-dkms to the Provides: for the kernel packages (LP: #1716093)
+    - [Packaging] Add aufs-dkms to the Provides: for kernel packages
+
+  * Artful update to v4.13.1 stable release (LP: #1716284)
+    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
+    - USB: serial: option: add support for D-Link DWM-157 C1
+    - usb: Add device quirk for Logitech HD Pro Webcam C920-C
+    - usb:xhci:Fix regression when ATI chipsets detected
+    - USB: musb: fix external abort on suspend
+    - ANDROID: binder: add padding to binder_fd_array_object.
+    - ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES.
+    - USB: core: Avoid race of async_completed() w/ usbdev_release()
+    - staging/rts5208: fix incorrect shift to extract upper nybble
+    - staging: ccree: save ciphertext for CTS IV
+    - staging: fsl-dpaa2/eth: fix off-by-one FD ctrl bitmaks
+    - iio: adc: ti-ads1015: fix incorrect data rate setting update
+    - iio: adc: ti-ads1015: fix scale information for ADS1115
+    - iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set
+    - iio: adc: ti-ads1015: avoid getting stale result after runtime resume
+    - iio: adc: ti-ads1015: don't return invalid value from buffer setup callbacks
+    - iio: adc: ti-ads1015: add adequate wait time to get correct conversion
+    - driver core: bus: Fix a potential double free
+    - HID: wacom: Do not completely map WACOM_HID_WD_TOUCHRINGSTATUS usage
+    - binder: free memory on error
+    - crypto: caam/qi - fix compilation with CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
+    - crypto: caam/qi - fix compilation with DEBUG enabled
+    - thunderbolt: Fix reset response_type
+    - fpga: altera-hps2fpga: fix multiple init of l3_remap_lock
+    - intel_th: pci: Add Cannon Lake PCH-H support
+    - intel_th: pci: Add Cannon Lake PCH-LP support
+    - ath10k: fix memory leak in rx ring buffer allocation
+    - drm/vgem: Pin our pages for dmabuf exports
+    - drm/ttm: Fix accounting error when fail to get pages for pool
+    - drm/dp/mst: Handle errors from drm_atomic_get_private_obj_state() correctly
+    - rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
+    - Bluetooth: Add support of 13d3:3494 RTL8723BE device
+    - iwlwifi: pci: add new PCI ID for 7265D
+    - dlm: avoid double-free on error path in dlm_device_{register,unregister}
+    - mwifiex: correct channel stat buffer overflows
+    - MCB: add support for SC31 to mcb-lpc
+    - s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs
+    - drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
+    - drm/nouveau: Fix error handling in nv50_disp_atomic_commit
+    - workqueue: Fix flag collision
+    - ahci: don't use MSI for devices with the silly Intel NVMe remapping scheme
+    - cs5536: add support for IDE controller variant
+    - scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
+    - scsi: sg: recheck MMAP_IO request length with lock held
+    - of/device: Prevent buffer overflow in of_device_modalias()
+    - rtlwifi: Fix memory leak when firmware request fails
+    - rtlwifi: Fix fallback firmware loading
+    - Linux 4.13.1
+
+  * Kernel has trouble recognizing Corsair Strafe RGB keyboard (LP: #1678477)
+    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
+
+  * SRIOV: warning if unload VFs (LP: #1715073)
+    - PCI: Disable VF decoding before pcibios_sriov_disable() updates resources
+
+  * [Patch] network-i40e:NVM bug fixes (cherrypick from 4.14) (LP: #1715578)
+    - i40e: avoid NVM acquire deadlock during NVM update
+    - i40e: point wb_desc at the nvm_wb_desc during i40e_read_nvm_aq
+
+  * [P9,POwer NV] Perf PMU event : pm_br_2path and pm_ld_miss_l1 is counted
+    twice when perf stat is done (perf:) (LP: #1714571)
+    - perf vendor events powerpc: Remove duplicate events
+
+  * Unable to install Ubuntu on the NVMe disk under VMD PCI domain
+    (LP: #1703339)
+    - [Config] Include vmd in storage-core-modules udeb
+
+  * 17.10 fails to boot on POWER9 DD2.0 with Deep stop states (LP: #1715064)
+    - powerpc/powernv: Save/Restore additional SPRs for stop4 cpuidle
+    - powerpc/powernv: Clear PECE1 in LPCR via stop-api only on Hotplug
+    - SAUCE: powerpc/powernv: Clear LPCR[PECE1] via stop-api only for deep state
+      offline
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/seccomp: Support glibc 2.26 siginfo_t.h
+    - Revert "UBUNTU: SAUCE: Import aufs driver"
+    - SAUCE: Import aufs driver
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 10 Sep 2017 17:48:59 -0500
+
+linux (4.13.0-9.10) artful; urgency=low
+
+  * linux: 4.13.0-9.10 -proposed tracker (LP: #1715145)
+
+  * EDAC sbridge: Failed to register device with error -22. (LP: #1714112)
+    - [Config] CONFIG_EDAC_GHES=n
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu: vbox -- update to 5.1.26-dfsg-2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 05 Sep 2017 07:51:19 -0500
+
+linux (4.13.0-8.9) artful; urgency=low
+
+  * snapd 2.27.3+17.10 ADT test failure with linux 4.13.0-6.7 (LP: #1713103)
+    - SAUCE: apparmor: fix apparmorfs DAC access, permissions
+
+  * enable ARCH_SUNXI (and friends) in arm64 kernel .config (LP: #1701137)
+    - [Config] Enable CONFIG_ARCH_SUNXI and related options for arm64
+
+  * [Bug] Harrisonville: pnd2_edac always fail to load on B1 stepping
+    Harrisonville SDP (LP: #1709257)
+    - EDAC, pnd2: Build in a minimal sideband driver for Apollo Lake
+    - EDAC, pnd2: Mask off the lower four bits of a BAR
+    - EDAC, pnd2: Conditionally unhide/hide the P2SB PCI device to read BAR
+    - EDAC, pnd2: Properly toggle hidden state for P2SB PCI device
+    - SAUCE: i2c: i801: Restore the presence state of P2SB PCI device after
+      reading BAR
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: Import aufs driver"
+    - SAUCE: Import aufs driver
+    - SAUCE: selftests/powerpc: Disable some ptrace selftests
+    - [Config] CONFIG_CRYPTO_DEV_NITROX_CNN55XX=n for s390x
+    - [Config] CONFIG_I2C_SLAVE=n for amd64, i386, ppc64el
+    - [Config] Disable CONFIG_MDIO_* options for s390x
+    - [Config] CONFIG_SCSI_MQ_DEFAULT=n for s390x
+    - [Config] Update annotations for 4.13
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 31 Aug 2017 14:27:09 -0500
+
+linux (4.13.0-7.8) artful; urgency=low
+
+  * linux 4.12.0-11.12 ADT test failure with linux 4.12.0-11.12 (LP: #1710904)
+    - SAUCE: selftests/powerpc: Use snprintf to construct DSCR sysfs interface
+      paths
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: seccomp: log actions even when audit is disabled"
+
+  * Miscellaneous upstream changes
+    - seccomp: Provide matching filter for introspection
+    - seccomp: Sysctl to display available actions
+    - seccomp: Operation for checking if an action is available
+    - seccomp: Sysctl to configure actions that are allowed to be logged
+    - seccomp: Selftest for detection of filter flag support
+    - seccomp: Filter flag to log all actions except SECCOMP_RET_ALLOW
+    - seccomp: Action to log before allowing
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 28 Aug 2017 08:12:24 -0500
+
+linux (4.13.0-6.7) artful; urgency=low
+
+  * HID: multitouch: Support ALPS PTP Stick and Touchpad devices (LP: #1712481)
+    - SAUCE: HID: multitouch: Support ALPS PTP stick with pid 0x120A
+
+  * sort ABI files with C.UTF-8 locale (LP: #1712345)
+    - [Packaging] sort ABI files with C.UTF-8 locale
+
+  * igb: Support using Broadcom 54616 as PHY (LP: #1712024)
+    - SAUCE: igb: add support for using Broadcom 54616 as PHY
+
+  * RPT related fixes missing in Ubuntu 16.04.3 (LP: #1709220)
+    - powerpc/mm/radix: Improve _tlbiel_pid to be usable for PWC flushes
+    - powerpc/mm/radix: Improve TLB/PWC flushes
+    - powerpc/mm/radix: Avoid flushing the PWC on every flush_tlb_range
+
+  * Linux 4.12 refuses to load self-signed modules under Secure Boot with
+    properly enrolled keys (LP: #1712168)
+    - SAUCE: (efi-lockdown) MODSIGN: Fix module signature verification
+
+  * [17.10 FEAT] Enable NVMe driver - kernel (LP: #1708432)
+    - [Config] CONFIG_BLK_DEV_NVME=m for s390
+
+  * Artful: 4.12.0-11.12: Boot panic in vlv2_plat_configure_clock+0x3b/0xa0
+    (LP: #1711298)
+    - [Config] CONFIG_INTEL_ATOMISP=n
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor: af_unix mediation
+
+  * Miscellaneous upstream changes
+    - apparmor: Fix shadowed local variable in unpack_trans_table()
+    - apparmor: Fix logical error in verify_header()
+    - apparmor: Fix an error code in aafs_create()
+    - apparmor: Redundant condition: prev_ns. in [label.c:1498]
+    - apparmor: add the ability to mediate signals
+    - apparmor: add mount mediation
+    - apparmor: cleanup conditional check for label in label_print
+    - apparmor: add support for absolute root view based labels
+    - apparmor: make policy_unpack able to audit different info messages
+    - apparmor: add more debug asserts to apparmorfs
+    - apparmor: add base infastructure for socket mediation
+    - apparmor: move new_null_profile to after profile lookup fns()
+    - apparmor: fix race condition in null profile creation
+    - apparmor: ensure unconfined profiles have dfas initialized
+    - apparmor: fix incorrect type assignment when freeing proxies
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 23 Aug 2017 08:10:38 -0500
+
+linux (4.13.0-5.6) artful; urgency=low
+
+  * Ubuntu17.10 - perf: Update Power9 PMU event JSON files (LP: #1708630)
+    - perf pmu-events: Support additional POWER8+ PVR in mapfile
+    - perf vendor events: Add POWER9 PMU events
+    - perf vendor events: Add POWER9 PVRs to mapfile
+    - SAUCE: perf vendor events powerpc: remove suffix in mapfile
+    - SAUCE: perf vendor events powerpc: Update POWER9 events
+
+  * Disable CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE (LP: #1709171)
+    - [Config] CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=n for ppc64el
+
+  * Please only recommend or suggest initramfs-tools | linux-initramfs-tool for
+    kernels able to boot without initramfs (LP: #1700972)
+    - [Debian] Don't depend on initramfs-tools
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - SAUCE: aufs -- Add missing argument to loop_switch() call
+    - [Config] Enable aufs
+    - SAUCE: (noup) Update spl to 0.6.5.11-ubuntu1, zfs to 0.6.5.11-1ubuntu3
+    - Enable zfs build
+    - SAUCE: powerpc: Always initialize input array when calling epapr_hypercall()
+    - [Packaging] switch up to debhelper 9
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 15 Aug 2017 09:24:16 -0500
+
+linux (4.13.0-4.5) artful; urgency=low
+
+  * Lenovo Yoga 910 Sensors (LP: #1708120)
+    - SAUCE: (no-up) HID: Add quirk for Lenovo Yoga 910 with ITE Chips
+
+  * Unable to install Ubuntu on the NVMe disk under VMD PCI domain
+    (LP: #1703339)
+    - [Config] Add vmd driver to generic inclusion list
+
+  * Set CONFIG_SATA_HIGHBANK=y on armhf (LP: #1703430)
+    - [Config] CONFIG_SATA_HIGHBANK=y
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu: vbox -- update to 5.1.26-dfsg-1
+    - SAUCE: hio: Build fixes for 4.13
+    - Enable hio build
+    - SAUCE: (noup) Update spl to 0.6.5.11-1, zfs to 0.6.5.11-1ubuntu1
+    - [debian] use all rather than amd64 dkms debs for sync
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 08 Aug 2017 11:31:48 -0500
+
+linux (4.13.0-3.4) artful; urgency=low
+
+  * Adt tests of src:linux time out often on armhf lxc containers (LP: #1705495)
+    - [Packaging] tests -- reduce rebuild test to one flavour
+    - [Packaging] tests -- reduce rebuild test to one flavour -- use filter
+
+  * snapd 2.26.8+17.10 ADT test failure with linux 4.12.0-6.7 (LP: #1704158)
+    - SAUCE: virtio_net: Revert mergeable buffer handling rework
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 31 Jul 2017 10:08:16 -0500
+
+linux (4.13.0-2.3) artful; urgency=low
+
+  * Change CONFIG_IBMVETH to module (LP: #1704479)
+    - [Config] CONFIG_IBMVETH=m
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 24 Jul 2017 13:58:08 -0500
+
+linux (4.13.0-1.2) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Support sphinx-based kernel documentation
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 20 Jul 2017 09:18:33 -0500
+
+linux (4.13.0-0.1) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - Disable hio
+    - Disable zfs build
+    - ubuntu: vbox -- update to 5.1.24-dfsg-1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 19 Jul 2017 15:09:31 -0500
+
+linux (4.12.0-7.8) artful; urgency=low
+
+  * ThunderX: soft lockup on 4.8+ kernels when running qemu-efi with vhost=on
+    (LP: #1673564)
+    - arm64: Add a facility to turn an ESR syndrome into a sysreg encoding
+    - KVM: arm/arm64: vgic-v3: Add accessors for the ICH_APxRn_EL2 registers
+    - KVM: arm64: Make kvm_condition_valid32() accessible from EL2
+    - KVM: arm64: vgic-v3: Add hook to handle guest GICv3 sysreg accesses at EL2
+    - KVM: arm64: vgic-v3: Add ICV_BPR1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_IGRPEN1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_IAR1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_EOIR1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_AP1Rn_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_HPPIR1_EL1 handler
+    - KVM: arm64: vgic-v3: Enable trapping of Group-1 system registers
+    - KVM: arm64: Enable GICv3 Group-1 sysreg trapping via command-line
+    - KVM: arm64: vgic-v3: Add ICV_BPR0_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_IGNREN0_EL1 handler
+    - KVM: arm64: vgic-v3: Add misc Group-0 handlers
+    - KVM: arm64: vgic-v3: Enable trapping of Group-0 system registers
+    - KVM: arm64: Enable GICv3 Group-0 sysreg trapping via command-line
+    - arm64: Add MIDR values for Cavium cn83XX SoCs
+    - arm64: Add workaround for Cavium Thunder erratum 30115
+    - KVM: arm64: vgic-v3: Add ICV_DIR_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_RPR_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_CTLR_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_PMR_EL1 handler
+    - KVM: arm64: Enable GICv3 common sysreg trapping via command-line
+    - KVM: arm64: vgic-v3: Log which GICv3 system registers are trapped
+    - KVM: arm64: Log an error if trapping a read-from-write-only GICv3 access
+    - KVM: arm64: Log an error if trapping a write-to-read-only GICv3 access
+
+  * hns: under heavy load, NIC may fail and require reboot (LP: #1704146)
+    - net: hns: Bugfix for Tx timeout handling in hns driver
+
+  * New ACPI identifiers for ThunderX SMMU (LP: #1703437)
+    - iommu/arm-smmu: Plumb in new ACPI identifiers
+
+  * Transparent hugepages should default to enabled=madvise (LP: #1703742)
+    - SAUCE: use CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y as default
+
+  * Artful update to v4.12.1 stable release (LP: #1703858)
+    - driver core: platform: fix race condition with driver_override
+    - RDMA/uverbs: Check port number supplied by user verbs cmds
+    - usb: dwc3: replace %p with %pK
+    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
+    - usb: usbip: set buffer pointers to NULL after free
+    - Add USB quirk for HVR-950q to avoid intermittent device resets
+    - usb: Fix typo in the definition of Endpoint[out]Request
+    - USB: core: fix device node leak
+    - USB: serial: option: add two Longcheer device ids
+    - USB: serial: qcserial: new Sierra Wireless EM7305 device ID
+    - xhci: Limit USB2 port wake support for AMD Promontory hosts
+    - gfs2: Fix glock rhashtable rcu bug
+    - Add "shutdown" to "struct class".
+    - tpm: Issue a TPM2_Shutdown for TPM2 devices.
+    - tpm: fix a kernel memory leak in tpm-sysfs.c
+    - powerpc/powernv: Fix CPU_HOTPLUG=n idle.c compile error
+    - x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
+    - sched/fair, cpumask: Export for_each_cpu_wrap()
+    - sched/core: Implement new approach to scale select_idle_cpu()
+    - sched/numa: Use down_read_trylock() for the mmap_sem
+    - sched/numa: Override part of migrate_degrades_locality() when idle balancing
+    - sched/fair: Simplify wake_affine() for the single socket case
+    - sched/numa: Implement NUMA node level wake_affine()
+    - sched/fair: Remove effective_load()
+    - sched/numa: Hide numa_wake_affine() from UP build
+    - xen: avoid deadlock in xenbus driver
+    - crypto: drbg - Fixes panic in wait_for_completion call
+    - Linux 4.12.1
+
+  * cxlflash update request in the Xenial SRU stream (LP: #1702521)
+    - scsi: cxlflash: Combine the send queue locks
+    - scsi: cxlflash: Update cxlflash_afu_sync() to return errno
+    - scsi: cxlflash: Reset hardware queue context via specified register
+    - scsi: cxlflash: Schedule asynchronous reset of the host
+    - scsi: cxlflash: Handle AFU sync failures
+    - scsi: cxlflash: Track pending scsi commands in each hardware queue
+    - scsi: cxlflash: Flush pending commands in cleanup path
+    - scsi: cxlflash: Add scsi command abort handler
+    - scsi: cxlflash: Create character device to provide host management interface
+    - scsi: cxlflash: Separate AFU internal command handling from AFU sync
+      specifics
+    - scsi: cxlflash: Introduce host ioctl support
+    - scsi: cxlflash: Refactor AFU capability checking
+    - scsi: cxlflash: Support LUN provisioning
+    - scsi: cxlflash: Support AFU debug
+    - scsi: cxlflash: Support WS16 unmap
+    - scsi: cxlflash: Remove zeroing of private command data
+    - scsi: cxlflash: Update TMF command processing
+    - scsi: cxlflash: Avoid double free of character device
+    - scsi: cxlflash: Update send_tmf() parameters
+    - scsi: cxlflash: Update debug prints in reset handlers
+
+  * make snap-pkg support (LP: #1700747)
+    - make snap-pkg support
+
+  * Quirk for non-compliant PCI bridge on HiSilicon D05 board (LP: #1698706)
+    - SAUCE: PCI: Support hibmc VGA cards behind a misbehaving HiSilicon bridge
+
+  * arm64: fix crash reading /proc/kcore (LP: #1702749)
+    - fs/proc: kcore: use kcore_list type to check for vmalloc/module address
+    - arm64: mm: select CONFIG_ARCH_PROC_KCORE_TEXT
+
+  * Opal and POWER9 DD2 (LP: #1702159)
+    - SAUCE: powerpc/powernv: Tell OPAL about our MMU mode on POWER9
+
+  * Data corruption with hio driver  (LP: #1701316)
+    - SAUCE: hio: Fix incorrect use of enum req_opf values
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.6.5.10-1, zfs to 0.6.5.10-1ubuntu2
+    - snapcraft.yaml: Sync with xenial
+    - [Config] CONFIG_CAVIUM_ERRATUM_30115=y
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and
+      MokSBState"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 14 Jul 2017 15:25:41 -0500
+
+linux (4.12.0-6.7) artful; urgency=low
+
+  * update ENA driver to 1.2.0k from net-next (LP: #1701575)
+    - net: ena: change return value for unsupported features unsupported return
+      value
+    - net: ena: add hardware hints capability to the driver
+    - net: ena: change sizeof() argument to be the type pointer
+    - net: ena: add reset reason for each device FLR
+    - net: ena: add support for out of order rx buffers refill
+    - net: ena: allow the driver to work with small number of msix vectors
+    - net: ena: use napi_schedule_irqoff when possible
+    - net: ena: separate skb allocation to dedicated function
+    - net: ena: use lower_32_bits()/upper_32_bits() to split dma address
+    - net: ena: update driver's rx drop statistics
+    - net: ena: update ena driver to version 1.2.0
+
+  * APST gets enabled against explicit kernel option (LP: #1699004)
+    - nvme: explicitly disable APST on quirked devices
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: hio: Update to Huawei ES3000_V2 (2.1.0.40)
+    - SAUCE: hio updates for 4.12
+    - SAUCE: Enable hio build
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 05 Jul 2017 14:23:20 -0500
+
+linux (4.12.0-5.6) artful; urgency=low
+
+  * ERAT invalidate on context switch removal (LP: #1700819)
+    - powerpc: Only do ERAT invalidate on radix context switch on P9 DD1
+
+  * powerpc: Invalidate ERAT on powersave wakeup for POWER9 (LP: #1700521)
+    - SAUCE: powerpc: Invalidate ERAT on powersave wakeup for POWER9
+
+  * Miscellaneous Ubuntu changes
+    - d-i: Move qcom-emac from arm64 to shared nic-modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 03 Jul 2017 07:52:02 -0500
+
+linux (4.12.0-4.5) artful; urgency=low
+
+  * aacraid driver may return uninitialized stack data to userspace
+    (LP: #1700077)
+    - SAUCE: scsi: aacraid: Don't copy uninitialized stack memory to userspace
+
+  * KILLER1435-S[0489:e0a2] BT cannot search BT 4.0 device (LP: #1699651)
+    - Bluetooth: btusb: Add support for 0489:e0a2 QCA_ROME device
+
+  * AACRAID for power9 platform (LP: #1689980)
+    - scsi: aacraid: Remove __GFP_DMA for raw srb memory
+    - scsi: aacraid: Fix DMAR issues with iommu=pt
+    - scsi: aacraid: Added 32 and 64 queue depth for arc natives
+    - scsi: aacraid: Set correct Queue Depth for HBA1000 RAW disks
+    - scsi: aacraid: Remove reset support from check_health
+    - scsi: aacraid: Change wait time for fib completion
+    - scsi: aacraid: Log count info of scsi cmds before reset
+    - scsi: aacraid: Print ctrl status before eh reset
+    - scsi: aacraid: Using single reset mask for IOP reset
+    - scsi: aacraid: Rework IOP reset
+    - scsi: aacraid: Add periodic checks to see IOP reset status
+    - scsi: aacraid: Rework SOFT reset code
+    - scsi: aacraid: Rework aac_src_restart
+    - scsi: aacraid: Use correct function to get ctrl health
+    - scsi: aacraid: Make sure ioctl returns on controller reset
+    - scsi: aacraid: Enable ctrl reset for both hba and arc
+    - scsi: aacraid: Add reset debugging statements
+    - scsi: aacraid: Remove reference to Series-9
+    - scsi: aacraid: Update driver version to 50834
+
+  * hibmc driver does not include "pci:" prefix in bus ID (LP: #1698700)
+    - SAUCE: drm: hibmc: Use set_busid function from drm core
+
+  * HiSilicon D05: installer doesn't appear on VGA (LP: #1698954)
+    - d-i: Add hibmc-drm to kernel-image udeb
+
+  * Fix /proc/cpuinfo revision for POWER9 DD2 (LP: #1698844)
+    - SAUCE: powerpc: Fix /proc/cpuinfo revision for POWER9 DD2
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_SATA_MV=n and CONFIG_GENERIC_PHY=n for s390x
+    - [Config] CONFIG_ATA=n for s390x
+    - [Config] Update annotations for 4.12
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Jun 2017 11:27:29 -0500
+
+linux (4.12.0-3.4) artful; urgency=low
+
+  * Miscellaneous upstream changes
+    - ufs: fix the logics for tail relocation
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 19 Jun 2017 14:50:39 -0500
+
+linux (4.12.0-2.3) artful; urgency=low
+
+  * CVE-2014-9900
+    - SAUCE: (no-up) net: Zeroing the structure ethtool_wolinfo in
+      ethtool_get_wol()
+
+  * System doesn't boot properly on Gigabyte AM4 motherboards (AMD Ryzen)
+    (LP: #1671360)
+    - pinctrl/amd: Use regular interrupt instead of chained
+
+  * extend-diff-ignore should use exact matches (LP: #1693504)
+    - [Packaging] exact extend-diff-ignore matches
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: efi: Don't print secure boot state from the efi stub
+    - ubuntu: vbox -- Update to 5.1.22-dfsg-1
+    - SAUCE: vbox fixes for 4.12
+    - Re-enable virtualbox build
+    - [Config] CONFIG_ORANGEFS_FS=m
+    - SAUCE: (noup) Update spl to 0.6.5.9-1ubuntu2, zfs to 0.6.5.9-5ubuntu7
+    - Enable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc4
+  * Rebase to v4.12-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 11 Jun 2017 22:25:13 -0500
+
+linux (4.12.0-1.2) artful; urgency=low
+
+  * Enable Matrox driver for Ubuntu 16.04.3 (LP: #1693337)
+    - [Config] Enable CONFIG_DRM_MGAG200 as module
+
+  * Support low-pin-count devices on Hisilicon SoCs (LP: #1677319)
+    - [Config] CONFIG_LIBIO=y on arm64 only
+    - SAUCE: LIBIO: Introduce a generic PIO mapping method
+    - SAUCE: OF: Add missing I/O range exception for indirect-IO devices
+    - [Config] CONFIG_HISILICON_LPC=y
+    - SAUCE: LPC: Support the device-tree LPC host on Hip06/Hip07
+    - SAUCE: LIBIO: Support the dynamically logical PIO registration of ACPI host
+      I/O
+    - SAUCE: LPC: Add the ACPI LPC support
+    - SAUCE: PCI: Apply the new generic I/O management on PCI IO hosts
+    - SAUCE: PCI: Restore codepath for !CONFIG_LIBIO
+
+  * POWER9: Additional patches for TTY and CPU_IDLE (LP: #1674325)
+    - SAUCE: tty: Fix ldisc crash on reopened tty
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Add build-dep on libnuma-dev to enable 'perf bench numa'
+    - Rebase to v4.12-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 May 2017 20:56:29 -0500
+
+linux (4.12.0-0.1) artful; urgency=low
+
+  * please enable CONFIG_ARM64_LSE_ATOMICS (LP: #1691614)
+    - [Config] CONFIG_ARM64_LSE_ATOMICS=y
+
+  * [Regression] NUMA_BALANCING disabled on arm64 (LP: #1690914)
+    - [Config] CONFIG_NUMA_BALANCING{,_DEFAULT_ENABLED}=y on arm64
+
+  * exec'ing a setuid binary from a threaded program sometimes fails to setuid
+    (LP: #1672819)
+    - SAUCE: exec: ensure file system accounting in check_unsafe_exec is correct
+
+  * Miscellaneous Ubuntu changes
+    - Update find-missing-sauce.sh to compare to artful
+    - Update dropped.txt
+    - SAUCE: (efi-lockdown) efi: Add EFI_SECURE_BOOT bit
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/mem and /dev/kmem when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Add a sysrq option to exit secure boot mode
+    - SAUCE: (efi-lockdown) kexec: Disable at runtime if the kernel is locked down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: Disable at runtime if securelevel has been
+      set
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) asus-wmi: Restrict debugfs interface when the kernel
+      is locked down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Enable cold boot attack mitigation
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) scsi: Lock down the eata driver
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Add secure_boot state and status bit for
+      MokSBState
+    - SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and MokSBState
+    - [Config] Set values for UEFI secure boot lockdown options
+    - Disable virtualbox build
+    - Disable hio build
+    - SAUCE: securityfs: Replace CURRENT_TIME with current_time()
+    - Disable zfs build
+    - [Debian] Work out upstream tag for use with gen-auto-reconstruct
+    - SAUCE: Import aufs driver
+    - SAUCE: aufs -- Include linux/mm.h in fs/aufs/file.h
+    - [Config] Enable aufs
+    - SAUCE: perf callchain: Include errno.h on x86 unconditinally
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 21 May 2017 23:44:44 -0500
+
+linux (4.11.0-3.8) artful; urgency=low
+
+  [ Seth Forshee ]
+
+  * Release Tracking Bug
+    - LP: #1690999
+
+  * apparmor_parser hangs indefinitely when called by multiple threads
+    (LP: #1645037)
+    - SAUCE: apparmor: fix lock ordering for mkdir
+
+  * apparmor leaking securityfs pin count (LP: #1660846)
+    - SAUCE: apparmor: fix leak on securityfs pin count
+
+  * apparmor reference count leak when securityfs_setup_d_inode\ () fails
+    (LP: #1660845)
+    - SAUCE: apparmor: fix reference count leak when securityfs_setup_d_inode()
+      fails
+
+  * apparmor not checking error if security_pin_fs() fails (LP: #1660842)
+    - SAUCE: apparmor: fix not handling error case when securityfs_pin_fs() fails
+
+  * libvirt profile is blocking global setrlimit despite having no rlimit rule
+    (LP: #1679704)
+    - SAUCE: apparmor: fix complain mode failure for rlimit mediation
+    - apparmor: update auditing of rlimit check to provide capability information
+
+  * apparmor: does not provide a way to detect policy updataes (LP: #1678032)
+    - SAUCE: apparmor: add policy revision file interface
+
+  * apparmor does not make support of query data visible (LP: #1678023)
+    - SAUCE: apparmor: add label data availability to the feature set
+
+  * apparmor query interface does not make supported query info available
+    (LP: #1678030)
+    - SAUCE: apparmor: add information about the query inteface to the feature set
+
+  * change_profile incorrect when using namespaces with a compound stack
+    (LP: #1677959)
+    - SAUCE: apparmor: fix label parse for stacked labels
+
+  * Regression in 4.4.0-65-generic causes very frequent system crashes
+    (LP: #1669611)
+    - apparmor: sync of apparmor 3.6+ (17.04)
+
+  * Artful update to 4.11.1 stable release (LP: #1690814)
+    - dm ioctl: prevent stack leak in dm ioctl call
+    - drm/sti: fix GDP size to support up to UHD resolution
+    - power: supply: lp8788: prevent out of bounds array access
+    - brcmfmac: Ensure pointer correctly set if skb data location changes
+    - brcmfmac: Make skb header writable before use
+    - sparc64: fix fault handling in NGbzero.S and GENbzero.S
+    - refcount: change EXPORT_SYMBOL markings
+    - net: macb: fix phy interrupt parsing
+    - tcp: fix access to sk->sk_state in tcp_poll()
+    - geneve: fix incorrect setting of UDP checksum flag
+    - bpf: enhance verifier to understand stack pointer arithmetic
+    - bpf, arm64: fix jit branch offset related to ldimm64
+    - tcp: fix wraparound issue in tcp_lp
+    - net: ipv6: Do not duplicate DAD on link up
+    - net: usb: qmi_wwan: add Telit ME910 support
+    - tcp: do not inherit fastopen_req from parent
+    - ipv4, ipv6: ensure raw socket message is big enough to hold an IP header
+    - rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
+    - ipv6: initialize route null entry in addrconf_init()
+    - ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
+    - tcp: randomize timestamps on syncookies
+    - bnxt_en: allocate enough space for ->ntp_fltr_bmap
+    - bpf: don't let ldimm64 leak map addresses on unprivileged
+    - net: mdio-mux: bcm-iproc: call mdiobus_free() in error path
+    - f2fs: sanity check segment count
+    - xen/arm,arm64: fix xen_dma_ops after 815dd18 "Consolidate get_dma_ops..."
+    - xen: Revert commits da72ff5bfcb0 and 72a9b186292d
+    - block: get rid of blk_integrity_revalidate()
+    - Linux 4.11.1
+
+  * Module signing exclusion for staging drivers does not work properly
+    (LP: #1690908)
+    - SAUCE: Fix module signing exclusion in package builds
+
+  * perf: qcom: Add L3 cache PMU driver (LP: #1689856)
+    - [Config] CONFIG_QCOM_L3_PMU=y
+    - perf: qcom: Add L3 cache PMU driver
+
+  * No PMU support for ACPI-based arm64 systems (LP: #1689661)
+    - drivers/perf: arm_pmu: rework per-cpu allocation
+    - drivers/perf: arm_pmu: manage interrupts per-cpu
+    - drivers/perf: arm_pmu: split irq request from enable
+    - drivers/perf: arm_pmu: remove pointless PMU disabling
+    - drivers/perf: arm_pmu: define armpmu_init_fn
+    - drivers/perf: arm_pmu: fold init into alloc
+    - drivers/perf: arm_pmu: factor out pmu registration
+    - drivers/perf: arm_pmu: simplify cpu_pmu_request_irqs()
+    - drivers/perf: arm_pmu: handle no platform_device
+    - drivers/perf: arm_pmu: rename irq request/free functions
+    - drivers/perf: arm_pmu: split cpu-local irq request/free
+    - drivers/perf: arm_pmu: move irq request/free into probe
+    - drivers/perf: arm_pmu: split out platform device probe logic
+    - arm64: add function to get a cpu's MADT GICC table
+    - [Config] CONFIG_ARM_PMU_ACPI=y
+    - drivers/perf: arm_pmu: add ACPI framework
+    - arm64: pmuv3: handle !PMUv3 when probing
+    - arm64: pmuv3: use arm_pmu ACPI framework
+
+  * Fix NVLINK2 TCE route (LP: #1690155)
+    - powerpc/powernv: Fix TCE kill on NVLink2
+
+  * CVE-2017-0605
+    - tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline()
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Restore powerpc arch to annotations file
+    - [Config] Disable runtime testing modules
+    - [Config] Disable drivers not needed on s390x
+    - [Config] Update annotations for 4.11
+    - [Config] updateconfigs after apparmor updates
+
+  * Miscellaneous upstream changes
+    - apparmor: use SHASH_DESC_ON_STACK
+    - apparmor: fix invalid reference to index variable of iterator line 836
+    - apparmor: fix parameters so that the permission test is bypassed at boot
+    - apparmor: Make path_max parameter readonly
+    - apparmorfs: Combine two function calls into one in aa_fs_seq_raw_abi_show()
+    - apparmorfs: Use seq_putc() in two functions
+    - apparmor: provide information about path buffer size at boot
+    - apparmor: add/use fns to print hash string hex value
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 16 May 2017 00:39:13 -0500
+
+linux (4.11.0-2.7) artful; urgency=low
+
+  * kernel-wedge fails in artful due to leftover squashfs-modules d-i files
+    (LP: #1688259)
+    - Remove squashfs-modules files from d-i
+    - [Config] as squashfs-modules is builtin kernel-image must Provides: it
+
+  * [Zesty] d-i: replace msm_emac with qcom_emac (LP: #1677297)
+    - Revert "UBUNTU: d-i: initrd needs msm_emac on amberwing platform."
+    - d-i: initrd needs qcom_emac on amberwing platform.
+
+  * update for V3 kernel bits and improved multiple fan slice support
+    (LP: #1470091)
+    - SAUCE: fan: tunnel multiple mapping mode (v3)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.6.5.9-1ubuntu1, zfs to 0.6.5.9-5ubuntu5
+    - Enable zfs
+    - SAUCE: fan: add VXLAN implementation
+    - SAUCE: (efi-lockdown) efi: Add EFI_SECURE_BOOT bit
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/mem and /dev/kmem when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Add a sysrq option to exit secure boot mode
+    - SAUCE: (efi-lockdown) kexec: Disable at runtime if the kernel is locked down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: Disable at runtime if securelevel has been
+      set
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) asus-wmi: Restrict debugfs interface when the kernel
+      is locked down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Enable cold boot attack mitigation
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) scsi: Lock down the eata driver
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Add EFI signature data types
+    - SAUCE: (efi-lockdown) Add an EFI signature blob parser and key loader.
+    - SAUCE: (efi-lockdown) KEYS: Add a system blacklist keyring
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Support not importing certs from db
+    - SAUCE: (efi-lockdown) MODSIGN: Don't try secure boot if EFI runtime is
+      disabled
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Add secure_boot state and status bit for
+      MokSBState
+    - SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and MokSBState
+    - [Config] Set values for UEFI secure boot lockdown options
+    - Update dropped.txt
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 05 May 2017 07:43:14 -0500
+
+linux (4.11.0-1.6) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Use default compression for all packages
+    - SAUCE: (namespace) block_dev: Support checking inode permissions in
+      lookup_bdev()
+    - SAUCE: (namespace) block_dev: Check permissions towards block device inode
+      when mounting
+    - SAUCE: (namespace) mtd: Check permissions towards mtd block device inode
+      when mounting
+    - SAUCE: (namespace) fs: Allow superblock owner to change ownership of inodes
+    - SAUCE: (namespace) fs: Don't remove suid for CAP_FSETID for userns root
+    - SAUCE: (namespace) fs: Allow superblock owner to access do_remount_sb()
+    - SAUCE: (namespace) capabilities: Allow privileged user in s_user_ns to set
+      security.* xattrs
+    - SAUCE: (namespace) fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw
+      filesystems
+    - SAUCE: (namespace) fuse: Add support for pid namespaces
+    - SAUCE: (namespace) fuse: Support fuse filesystems outside of init_user_ns
+    - SAUCE: (namespace) fuse: Restrict allow_other to the superblock's namespace
+      or a descendant
+    - SAUCE: (namespace) fuse: Allow user namespace mounts
+    - SAUCE: (namespace) ext4: Add support for unprivileged mounts from user
+      namespaces
+    - SAUCE: (namespace) evm: Don't update hmacs in user ns mounts
+    - SAUCE: (namespace) ext4: Add module parameter to enable user namespace
+      mounts
+    - SAUCE: (namespace) block_dev: Forbid unprivileged mounting when device is
+      opened for writing
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 26 Apr 2017 10:08:29 -0500
+
+linux (4.11.0-0.5) artful; urgency=low
+
+  * [Hyper-V][SAUCE] pci-hyperv: Use only 16 bit integer for PCI domain
+    (LP: #1684971)
+    - SAUCE: pci-hyperv: Use only 16 bit integer for PCI domain
+
+  * [Hyper-V] Ubuntu 14.04.2 LTS Generation 2 SCSI Errors on VSS Based Backups
+    (LP: #1470250)
+    - SAUCE: Tools: hv: vss: Thaw the filesystem and continue after freeze fails
+
+  * Enable virtual scsi server driver for Power (LP: #1615665)
+    - SAUCE: Return TCMU-generated sense data to fabric module
+
+  * include/linux/security.h header syntax error with !CONFIG_SECURITYFS
+    (LP: #1630990)
+    - SAUCE: (no-up) include/linux/security.h -- fix syntax error with
+      CONFIG_SECURITYFS=n
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - [Config] Enable aufs
+    - [Debian] Add script to update virtualbox
+    - ubuntu: vbox -- Update to 5.1.20-dfsg-2
+    - Enable vbox
+    - SAUCE: aufs -- Include linux/mm.h in fs/aufs/file.h
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 25 Apr 2017 13:42:54 -0500
+
+linux (4.11.0-0.4) zesty; urgency=low
+
+  * POWER9: Improve performance on memory management (LP: #1681429)
+    - SAUCE: powerpc/mm/radix: Don't do page walk cache flush when doing full mm
+      flush
+    - SAUCE: powerpc/mm/radix: Remove unnecessary ptesync
+
+  * Miscellaneous Ubuntu changes
+    - find-missing-sauce.sh
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 18 Apr 2017 08:19:43 -0500
+
+linux (4.11.0-0.3) zesty; urgency=low
+
+  * Disable CONFIG_HVC_UDBG on ppc64el (LP: #1680888)
+    - [Config] Disable CONFIG_HVC_UDBG on ppc64el
+
+  * smartpqi driver needed in initram disk and installer (LP: #1680156)
+    - [Config] Add smartpqi to d-i
+
+  * Disable CONFIG_SECURITY_SELINUX_DISABLE (LP: #1680315)
+    - [Config] CONFIG_SECURITY_SELINUX_DISABLE=n
+
+  * Miscellaneous Ubuntu changes
+    - [Config] flash-kernel should be a Breaks
+    - [Config] drop the info directory
+    - [Config] drop NOTES as obsolete
+    - [Config] drop changelog.historical as obsolete
+    - rebase to v4.11-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc6
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Tue, 11 Apr 2017 07:16:52 -0600
+
+linux (4.11.0-0.2) zesty; urgency=low
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc5
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 03 Apr 2017 08:26:07 +0100
+
+linux (4.11.0-0.1) zesty; urgency=low
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc4
+    - LP: #1591053
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 20 Mar 2017 05:15:32 -0600
+
+linux (4.11.0-0.0) zesty; urgency=low
+
+  * dummy entry
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 20 Mar 2017 05:15:32 -0600
--- linux-qcom-6.8.0.orig/debian.master/config/README.rst
+++ linux-qcom-6.8.0/debian.master/config/README.rst
@@ -0,0 +1,185 @@
+==================
+Config Annotations
+==================
+
+:Author: Andrea Righi
+
+Overview
+========
+
+Each Ubuntu kernel needs to maintain its own .config for each supported
+architecture and each flavour.
+
+Every time a new patch is applied or a kernel is rebased on top of a new
+one, we need to update the .config's accordingly (config options can be
+added, removed and also renamed).
+
+So, we need to make sure that some critical config options are always
+matching the desired value in order to have a functional kernel.
+
+State of the art
+================
+
+At the moment configs are maintained as a set of Kconfig chunks (inside
+`debian.<kernel>/config/`): a global one, plus per-arch / per-flavour
+chunks.
+
+In addition to that, we need to maintain also a file called
+'annotations'; the purpose of this file is to make sure that some
+critical config options are not silently removed or changed when the
+real .config is re-generated (for example after a rebase or after
+applying a new set of patches).
+
+The main problem with this approach is that, often, we have duplicate
+information that is stored both in the Kconfig chunks *and* in the
+annotations files and, at the same time, the whole .config's information
+is distributed between Kconfig chunks and annotations, making it hard to
+maintain, review and manage in general.
+
+Proposed solution
+=================
+
+The proposed solution is to store all the config information into the
+"annotations" format and get rid of the config chunks (basically the
+real .config's can be produced "compiling" annotations).
+
+Implementation
+==============
+
+To help the management of the annotations an helper script is provided
+(`debian/scripts/misc/annotations`):
+
+```
+usage: annotations [-h] [--version] [--file FILE] [--arch ARCH] [--flavour FLAVOUR] [--config CONFIG]
+                   (--query | --export | --import FILE | --update FILE | --check FILE)
+
+Manage Ubuntu kernel .config and annotations
+
+options:
+  -h, --help            show this help message and exit
+  --version, -v         show program's version number and exit
+  --file FILE, -f FILE  Pass annotations or .config file to be parsed
+  --arch ARCH, -a ARCH  Select architecture
+  --flavour FLAVOUR, -l FLAVOUR
+                        Select flavour (default is "generic")
+  --config CONFIG, -c CONFIG
+                        Select a specific config option
+
+Action:
+  --query, -q           Query annotations
+  --export, -e          Convert annotations to .config format
+  --import FILE, -i FILE
+                        Import a full .config for a specific arch and flavour into annotations
+  --update FILE, -u FILE
+                        Import a partial .config into annotations (only resync configs specified in FILE)
+  --check FILE, -k FILE
+                        Validate kernel .config with annotations
+```
+
+This script allows to query config settings (per arch/flavour/config),
+export them into the Kconfig format (generating the real .config files)
+and check if the final .config matches the rules defined in the
+annotations.
+
+Examples (annotations is defined as an alias to `debian/scripts/annotations`):
+
+ - Show settings for `CONFIG_DEBUG_INFO_BTF` for master kernel across all the
+   supported architectures and flavours:
+
+```
+$ annotations --query --config CONFIG_DEBUG_INFO_BTF
+{
+    "policy": {
+        "amd64": "y",
+        "arm64": "y",
+        "armhf": "n",
+        "ppc64el": "y",
+        "riscv64": "y",
+        "s390x": "y"
+    },
+    "note": "'Needs newer pahole for armhf'"
+}
+```
+
+ - Dump kernel .config for arm64 and flavour generic-64k:
+
+```
+$ annotations --arch arm64 --flavour generic-64k --export
+CONFIG_DEBUG_FS=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_COMPAT=y
+...
+```
+
+ - Update annotations file with a new kernel .config for amd64 flavour
+   generic:
+
+```
+$ annotations --arch amd64 --flavour generic --import build/.config
+```
+
+Moreover, an additional kernelconfig commands are provided
+(via debian/rules targets):
+ - `migrateconfigs`: automatically merge all the previous configs into
+   annotations (local changes still need to be committed)
+
+Annotations headers
+===================
+
+The main annotations file should contain a header to define the architectures
+and flavours that are supported.
+
+Here is the format of the header for the generic kernel:
+```
+# Menu: HEADER
+# FORMAT: 4
+# ARCH: amd64 arm64 armhf ppc64el riscv64 s390x
+# FLAVOUR: amd64-generic arm64-generic arm64-generic-64k armhf-generic armhf-generic-lpae ppc64el-generic riscv64-generic s390x-generic
+
+```
+
+Example header of a derivative (linux-aws):
+```
+# Menu: HEADER
+# FORMAT: 4
+# ARCH: amd64 arm64
+# FLAVOUR: amd64-aws arm64-aws
+# FLAVOUR_DEP: {'amd64-aws': 'amd64-generic', 'arm64-aws': 'arm64-generic'}
+
+include "../../debian.master/config/annotations"
+
+# Below you can define only the specific linux-aws configs that differ from linux generic
+
+```
+
+Pros and Cons
+=============
+
+ Pros:
+  - avoid duplicate information in .config's and annotations
+  - allow to easily define groups of config settings (for a specific
+    environment or feature, such as annotations.clouds, annotations.ubuntu,
+    annotations.snapd, etc.)
+  - config options are more accessible, easy to change and review
+  - we can easily document how config options are managed (and external
+    contributors won't be discouraged anymore when they need to to change a
+    config option)
+
+ Cons:
+  - potential regressions: the new tool/scripts can have potential bugs,
+    so we could experience regressions due to some missed config changes
+  - kernel team need to understand the new process (even if everything
+    is transparent, kernel cranking process is the same, there might be
+    corner cases that need to be addressed and resolved manually)
+
+TODO
+====
+
+ - Migrate all flavour and arch definitions into annotations (rather
+   than having this information defined in multiple places inside
+   debian/scripts); right now this information is "partially" migrated,
+   meaning that we need to define arches and flavours in the headers
+   section of annotations (so that the annotations tool can figure out
+   the list of supported arches and flavours), but arches and flavours
+   are still defined elsewhere, ideally we would like to have arches and
+   flavours defined only in one place: annotations.
--- linux-qcom-6.8.0.orig/debian.master/config/annotations
+++ linux-qcom-6.8.0/debian.master/config/annotations
@@ -0,0 +1,15571 @@
+# Menu: HEADER
+# FORMAT: 4
+# ARCH: amd64 arm64 armhf ppc64el riscv64 s390x
+# FLAVOUR: amd64-generic arm64-generic arm64-generic-64k armhf-generic ppc64el-generic riscv64-generic s390x-generic
+
+CONFIG_ACCESSIBILITY                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_ACCESSIBILITY                            note<'LP: #1967702'>
+
+CONFIG_ACPI_CUSTOM_METHOD                       policy<{'amd64': 'n', 'arm64': 'n', 'riscv64': 'n'}>
+CONFIG_ACPI_CUSTOM_METHOD                       note<'SECURITY: allows arbitrary execution'>
+
+CONFIG_AGP                                      policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_AGP                                      note<'not autoloadable'>
+
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE         policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE         note<'LP: #2051835'>
+
+CONFIG_ARCH_MMAP_RND_BITS                       policy<{'amd64': '32', 'arm64': '33', 'arm64-generic-64k': '29', 'armhf': '16', 'ppc64el': '29', 'riscv64': '24'}>
+CONFIG_ARCH_MMAP_RND_BITS                       note<'LP: #1983357'>
+
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS                policy<{'amd64': '16', 'arm64': '16', 'arm64-generic-64k': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS                note<'LP: #1983357'>
+
+CONFIG_ARCH_ROCKCHIP                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_ROCKCHIP                            note<'LP: #1825222'>
+
+CONFIG_ARM64_ERRATUM_843419                     policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_843419                     note<'LP: #1647793'>
+
+CONFIG_ARM64_ERRATUM_858921                     policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_858921                     note<'LP: #1675509'>
+
+CONFIG_ARM64_USE_LSE_ATOMICS                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_USE_LSE_ATOMICS                    note<'LP: #1691614'>
+
+CONFIG_ARM64_VA_BITS_48                         policy<{'arm64': 'y'}>
+CONFIG_ARM64_VA_BITS_48                         note<'Cavium ThunderX 2-socket needs a minimum of 41 bits of VA'>
+
+CONFIG_ARMV8_DEPRECATED                         policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_ARMV8_DEPRECATED                         note<'LP: #1545542'>
+
+CONFIG_ARM_HIGHBANK_CPUIDLE                     policy<{'armhf': 'y'}>
+CONFIG_ARM_HIGHBANK_CPUIDLE                     note<'broken on ecx-1000'>
+
+CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT       policy<{'arm64': 'n', 'armhf': '-'}>
+CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT       note<'LP: #1845820'>
+
+CONFIG_ASYMMETRIC_KEY_TYPE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ASYMMETRIC_KEY_TYPE                      note<'module signing'>
+
+CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE            note<'module signing'>
+
+CONFIG_ATA_PIIX                                 policy<{'amd64': 'y', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ATA_PIIX                                 note<'LP: #1627324'>
+
+CONFIG_BINFMT_SCRIPT                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BINFMT_SCRIPT                            note<'required if init is a shell script such as in initramfs-tools'>
+
+CONFIG_BLK_DEV_DM                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_DM                               note<'LP: #560717'>
+
+CONFIG_BLK_DEV_NVME                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BLK_DEV_NVME                             note<'LP: #1759893'>
+
+CONFIG_BLK_DEV_RAM                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BLK_DEV_RAM                              note<'LP: #1593293'>
+
+CONFIG_BLK_DEV_RAM_SIZE                         policy<{'amd64': '65536', 'arm64': '65536', 'armhf': '65536', 'ppc64el': '65536', 'riscv64': '65536', 's390x': '65536'}>
+CONFIG_BLK_DEV_RAM_SIZE                         note<'Ramdisk size should be a minimum of 64M'>
+
+CONFIG_BLK_DEV_SD                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_SD                               note<'LP: #1627330'>
+
+CONFIG_BLK_DEV_SR                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_SR                               note<'LP: #1627330'>
+
+CONFIG_BLK_DEV_THROTTLING                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_THROTTLING                       note<'CGROUP disk consumption control'>
+
+CONFIG_BPF_UNPRIV_DEFAULT_OFF                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPF_UNPRIV_DEFAULT_OFF                   note<'security reason'>
+
+CONFIG_CHR_DEV_SG                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CHR_DEV_SG                               note<'not autoloadable'>
+
+CONFIG_CMA                                      policy<{'amd64': 'n', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CMA                                      note<'LP: #1803206'>
+
+CONFIG_CMA_SIZE_MBYTES                          policy<{'arm64': '32', 'armhf': '32', 'riscv64': '32'}>
+CONFIG_CMA_SIZE_MBYTES                          note<'LP: #1823753'>
+
+CONFIG_COMPAT_BRK                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_COMPAT_BRK                               note<'disables brk ASLR'>
+
+CONFIG_CONSOLE_LOGLEVEL_QUIET                   policy<{'amd64': '3', 'arm64': '3', 'armhf': '3', 'ppc64el': '3', 'riscv64': '3', 's390x': '3'}>
+CONFIG_CONSOLE_LOGLEVEL_QUIET                   note<'LP: #2049390'>
+
+CONFIG_CP15_BARRIER_EMULATION                   policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_CP15_BARRIER_EMULATION                   note<'LP: #1545542'>
+
+CONFIG_CPUFREQ_DT                               policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPUFREQ_DT                               note<'not autoloadable'>
+
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE         note<'for bootspeed'>
+
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE                note<'not autoloadable'>
+
+CONFIG_CPU_FREQ_GOV_ONDEMAND                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_GOV_ONDEMAND                    note<'not autoloadable'>
+
+CONFIG_CPU_FREQ_GOV_PERFORMANCE                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_GOV_PERFORMANCE                 note<'not autoloadable'>
+
+CONFIG_CPU_FREQ_GOV_POWERSAVE                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_GOV_POWERSAVE                   note<'not autoloadable'>
+
+CONFIG_CPU_FREQ_GOV_USERSPACE                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_GOV_USERSPACE                   note<'not autoloadable'>
+
+CONFIG_CPU_FREQ_STAT                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_STAT                            note<'dependancy of boot essential'>
+
+CONFIG_CRASH_DUMP                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRASH_DUMP                               note<'LP: #1363180'>
+
+CONFIG_CRYPTO_SHA512                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SHA512                            note<'module signing'>
+
+CONFIG_CRYPTO_SHA512_ARM                        policy<{'armhf': 'y'}>
+CONFIG_CRYPTO_SHA512_ARM                        note<'LP: #2034061'>
+
+CONFIG_CRYPTO_SHA512_ARM64                      policy<{'arm64': 'y'}>
+CONFIG_CRYPTO_SHA512_ARM64                      note<'LP: #2034061'>
+
+CONFIG_CRYPTO_SHA512_ARM64_CE                   policy<{'arm64': 'y'}>
+CONFIG_CRYPTO_SHA512_ARM64_CE                   note<'LP: #2034061'>
+
+CONFIG_CRYPTO_SHA512_S390                       policy<{'s390x': 'y'}>
+CONFIG_CRYPTO_SHA512_S390                       note<'LP: #2034061'>
+
+CONFIG_CRYPTO_SHA512_SSSE3                      policy<{'amd64': 'y'}>
+CONFIG_CRYPTO_SHA512_SSSE3                      note<'LP: #2034061'>
+
+CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE          note<'Obsolete w/ no known userspace dependencies'>
+
+CONFIG_DEBUG_FS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_FS                                 note<'required debug option'>
+
+CONFIG_DEBUG_INFO                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_INFO                               note<'required for debug packages'>
+
+CONFIG_DEBUG_INFO_BTF                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_INFO_BTF                           note<'Needs newer pahole for armhf'>
+
+CONFIG_DEBUG_INFO_SPLIT                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_INFO_SPLIT                         note<'LP: #1413664'>
+
+CONFIG_DEBUG_KERNEL                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_KERNEL                             note<'required debug option'>
+
+CONFIG_DEFAULT_MMAP_MIN_ADDR                    policy<{'amd64': '65536', 'arm64': '32768', 'armhf': '32768', 'ppc64el': '65536', 'riscv64': '65536', 's390x': '65536'}>
+CONFIG_DEFAULT_MMAP_MIN_ADDR                    note<'LP: #1531327'>
+
+CONFIG_DEVTMPFS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEVTMPFS                                 note<'upstart requirement'>
+
+CONFIG_DEVTMPFS_MOUNT                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEVTMPFS_MOUNT                           note<'upstart requirement'>
+
+CONFIG_DMA_CMA                                  policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_DMA_CMA                                  note<'LP: #1803206'>
+
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING note<'LP: #2019040'>
+
+CONFIG_DRM                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_DRM                                      note<'LP: #1965303'>
+
+CONFIG_DRM_AMDGPU_CIK                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_AMDGPU_CIK                           note<'for zesty'>
+
+CONFIG_DRM_HISI_HIBMC                           policy<{'arm64': 'm'}>
+CONFIG_DRM_HISI_HIBMC                           note<'LP: #1762940'>
+
+CONFIG_DRM_MGAG200                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_MGAG200                              note<'LP: #1693337'>
+
+CONFIG_DRM_SIMPLEDRM                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_DRM_SIMPLEDRM                            note<'LP: #1965303'>
+
+CONFIG_DRM_VBOXVIDEO                            policy<{'amd64': 'm'}>
+CONFIG_DRM_VBOXVIDEO                            note<'LP: #1718679'>
+
+CONFIG_DVB_DUMMY_FE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DUMMY_FE                             note<'expert use only'>
+
+CONFIG_ECRYPT_FS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ECRYPT_FS                                note<'not autoloadable'>
+
+CONFIG_EFIVAR_FS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_EFIVAR_FS                                note<'needed for variable EFI update'>
+
+CONFIG_EFI_HANDOVER_PROTOCOL                    policy<{'amd64': 'y'}>
+CONFIG_EFI_HANDOVER_PROTOCOL                    note<'{GRUB may include some downstream patches that may rely on the handover protocol, so make sure this is enabled}'>
+
+CONFIG_EFI_ZBOOT                                policy<{'arm64': 'y', 'riscv64': 'n'}>
+CONFIG_EFI_ZBOOT                                note<'LP: #2002226'>
+
+CONFIG_EVM                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EVM                                      note<'LP: #1643652'>
+
+CONFIG_EVM_ATTR_FSUUID                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EVM_ATTR_FSUUID                          note<'LP: #1643652'>
+
+CONFIG_EVM_LOAD_X509                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_EVM_LOAD_X509                            note<'LP: #1643652'>
+
+CONFIG_EVM_X509_PATH                            policy<{'ppc64el': '"/etc/keys/x509_evm.der"'}>
+CONFIG_EVM_X509_PATH                            note<'LP: #1643652'>
+
+CONFIG_EXT2_FS                                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_EXT2_FS                                  note<'ext4 handling via EXT4_USE_FOR_EXT23'>
+
+CONFIG_EXT3_FS                                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_EXT3_FS                                  note<'ext4 handling via EXT4_USE_FOR_EXT23'>
+
+CONFIG_FA_DUMP                                  policy<{'ppc64el': 'y'}>
+CONFIG_FA_DUMP                                  note<'LP: #1415562'>
+
+CONFIG_FB_EFI                                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'riscv64': 'n'}>
+CONFIG_FB_EFI                                   note<'LP: #1965303'>
+
+CONFIG_FB_VESA                                  policy<{'amd64': 'n'}>
+CONFIG_FB_VESA                                  note<'LP: #1965303'>
+
+CONFIG_FHANDLE                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FHANDLE                                  note<'LP: #1412543'>
+
+CONFIG_FUSE_FS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FUSE_FS                                  note<'not autoloadable'>
+
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK           note<'LP: #1398458'>
+
+CONFIG_GPIO_CDEV_V1                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GPIO_CDEV_V1                             note<'LP: #1953613'>
+
+CONFIG_GPIO_EM                                  policy<{'armhf': 'n'}>
+CONFIG_GPIO_EM                                  note<'h/w not encounted'>
+
+CONFIG_GPIO_TWL4030                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_TWL4030                             note<'LP: #921934'>
+
+CONFIG_HIBERNATION                              policy<{'amd64': 'y', 'arm64': 'n', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': '-'}>
+CONFIG_HIBERNATION                              note<'LP: #1867753'>
+
+CONFIG_HOTPLUG_PCI_PCIE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HOTPLUG_PCI_PCIE                         note<'LP: #1374440'>
+
+CONFIG_HOTPLUG_PCI_SHPC                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': 'n', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_HOTPLUG_PCI_SHPC                         note<'LP: #1374440'>
+
+CONFIG_HSA_AMD_P2P                              policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_HSA_AMD_P2P                              note<'LP: #1987394'>
+
+CONFIG_HSU_DMA                                  policy<{'amd64': 'y'}>
+CONFIG_HSU_DMA                                  note<'required by CONFIG_SERIAL_8250_MID (LP: #2009283)'>
+
+CONFIG_HVC_UDBG                                 policy<{'ppc64el': 'n'}>
+CONFIG_HVC_UDBG                                 note<'LP: #1680888'>
+
+CONFIG_HZ_100                                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'y'}>
+CONFIG_HZ_100                                   note<'LP: #2051342'>
+
+CONFIG_HZ_1000                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_HZ_1000                                  note<'LP: #2051342'>
+
+CONFIG_HZ_250                                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_HZ_250                                   note<'LP: #2051342'>
+
+CONFIG_I2C_CHARDEV                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_I2C_CHARDEV                              note<'LP: #1417032'>
+
+CONFIG_IBMVNIC                                  policy<{'ppc64el': 'm'}>
+CONFIG_IBMVNIC                                  note<'LP: #1628187'>
+
+CONFIG_IDLE_PAGE_TRACKING                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IDLE_PAGE_TRACKING                       note<'is there a cost associated with this?'>
+
+CONFIG_IIO_SIMPLE_DUMMY_BUFFER                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_IIO_SIMPLE_DUMMY_BUFFER                  note<'dummy driver'>
+
+CONFIG_IIO_SIMPLE_DUMMY_EVENTS                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_IIO_SIMPLE_DUMMY_EVENTS                  note<'dummy driver'>
+
+CONFIG_IMA                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA                                      note<'LP: #1643652'>
+
+CONFIG_IMA_APPRAISE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA_APPRAISE                             note<'LP: #1643652'>
+
+CONFIG_IMA_ARCH_POLICY                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA_ARCH_POLICY                          note<'LP: #1866909'>
+
+CONFIG_IMA_DEFAULT_HASH_SHA256                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA_DEFAULT_HASH_SHA256                  note<'LP: #2041735'>
+
+CONFIG_IMA_KEXEC                                policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IMA_KEXEC                                note<'LP: #1643652'>
+
+CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY note<'LP: #1667490'>
+
+CONFIG_IMA_READ_POLICY                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_READ_POLICY                          note<'LP: #1866909'>
+
+CONFIG_IMA_SIG_TEMPLATE                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_SIG_TEMPLATE                         note<'LP: #1643652'>
+
+CONFIG_IMA_WRITE_POLICY                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_WRITE_POLICY                         note<'LP: #1667490'>
+
+CONFIG_INPUT_UINPUT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_INPUT_UINPUT                             note<'LP: #584812'>
+
+CONFIG_INTEGRITY_PLATFORM_KEYRING               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INTEGRITY_PLATFORM_KEYRING               note<'Required for lockdown'>
+
+CONFIG_INTEL_ATOMISP                            policy<{'amd64': 'n'}>
+CONFIG_INTEL_ATOMISP                            note<'LP: #2017444'>
+
+CONFIG_INTEL_ATOMISP2_PM                        policy<{'amd64': 'm'}>
+CONFIG_INTEL_ATOMISP2_PM                        note<'LP: #2017444'>
+
+CONFIG_INTEL_IOMMU_DEFAULT_ON                   policy<{'amd64': 'y'}>
+CONFIG_INTEL_IOMMU_DEFAULT_ON                   note<'LP: #1951440'>
+
+CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON     policy<{'amd64': 'y'}>
+CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON     note<'LP: #1951440'>
+
+CONFIG_IOMMU_DEBUGFS                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IOMMU_DEBUGFS                            note<'LP: #1861057'>
+
+CONFIG_IOMMU_DEFAULT_DMA_LAZY                   policy<{'amd64': 'y', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'y'}>
+CONFIG_IOMMU_DEFAULT_DMA_LAZY                   note<'LP: #2071471'>
+
+CONFIG_IOMMU_DEFAULT_DMA_STRICT                 policy<{'amd64': 'n', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_IOMMU_DEFAULT_DMA_STRICT                 note<'LP: #2071471'>
+
+CONFIG_IPMMU_VMSA                               policy<{'arm64': 'n', 'armhf': 'n', 'riscv64': '-'}>
+CONFIG_IPMMU_VMSA                               note<'LP: #1718734'>
+
+CONFIG_IPV6                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6                                     note<'if this is a module we get a module load for every ipv6 packet'>
+
+CONFIG_IP_PNP                                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IP_PNP                                   note<'LP: #1259861'>
+
+CONFIG_ISM                                      policy<{'s390x': 'm'}>
+CONFIG_ISM                                      note<'LP: #1789934'>
+
+CONFIG_KERNEL_ZSTD                              policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_KERNEL_ZSTD                              note<'LP: #1931725'>
+
+CONFIG_KEXEC_BZIMAGE_VERIFY_SIG                 policy<{'amd64': 'y'}>
+CONFIG_KEXEC_BZIMAGE_VERIFY_SIG                 note<'Q: check this is in sync with the kexec/kdump userspace'>
+
+CONFIG_KFENCE_STATIC_KEYS                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': '-', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_KFENCE_STATIC_KEYS                       note<'LP: #1948038'>
+
+CONFIG_KGDB_SERIAL_CONSOLE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_KGDB_SERIAL_CONSOLE                      note<'early debugging support'>
+
+CONFIG_KVM                                      policy<{'amd64': 'm', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'm', 's390x': 'y'}>
+CONFIG_KVM                                      note<'LP: #1532886'>
+
+CONFIG_LATENCYTOP                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LATENCYTOP                               note<'LP: #2051342'>
+
+CONFIG_LEGACY_TIOCSTI                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LEGACY_TIOCSTI                           note<'LP:#2046192'>
+
+CONFIG_LOAD_PPC_KEYS                            policy<{'ppc64el': 'y'}>
+CONFIG_LOAD_PPC_KEYS                            note<'LP: #1866909'>
+
+CONFIG_LOCALVERSION_AUTO                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LOCALVERSION_AUTO                        note<'triggers packaging failures'>
+
+CONFIG_LRU_GEN                                  policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LRU_GEN                                  note<'{Enable multi-gen LRU by default - LP: #2023629}'>
+
+CONFIG_LRU_GEN_ENABLED                          policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LRU_GEN_ENABLED                          note<'{Enable multi-gen LRU by default - LP: #2023629}'>
+
+CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE            note<'LP: #1848492'>
+
+CONFIG_MFD_SM501                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_SM501                                note<'boot essential on OMAP4'>
+
+CONFIG_MFD_TPS65217                             policy<{'arm64': 'm', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'm'}>
+CONFIG_MFD_TPS65217                             note<'boot essential on AM335x'>
+
+CONFIG_MHP_MEMMAP_ON_MEMORY                     policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_MHP_MEMMAP_ON_MEMORY                     note<'LP: #2051835'>
+
+CONFIG_MMC_BLOCK                                policy<{'amd64': 'm', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MMC_BLOCK                                note<'boot essential on armhf/arm64'>
+
+CONFIG_MMC_OMAP_HS                              policy<{'armhf': 'y'}>
+CONFIG_MMC_OMAP_HS                              note<'boot essential on arm'>
+
+CONFIG_MMC_SDHCI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_SDHCI                                note<'installation essential on omap/highbank'>
+
+CONFIG_MMC_SDHCI_PLTFM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHCI_PLTFM                          note<'boot essential on highbank'>
+
+CONFIG_MODIFY_LDT_SYSCALL                       policy<{'amd64': 'y'}>
+CONFIG_MODIFY_LDT_SYSCALL                       note<'Q: check this with security'>
+
+CONFIG_MODULE_COMPRESS_ZSTD                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_COMPRESS_ZSTD                     note<'LP: #2028568'>
+
+CONFIG_MODVERSIONS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODVERSIONS                              note<'required as we have a livepatch/drivers modules signing key'>
+
+CONFIG_MTD                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MTD                                      note<'boot essential on arm'>
+
+CONFIG_MTD_BLOCK                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MTD_BLOCK                                note<'boot essential on arm'>
+
+CONFIG_MTD_DOCG3                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_DOCG3                                note<'LP: #1792205'>
+
+CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE             note<'can be enabled at runtime'>
+
+CONFIG_MTD_OF_PARTS                             policy<{'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_OF_PARTS                             note<'boot essential on arm'>
+
+CONFIG_MTD_ONENAND_VERIFY_WRITE                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_ONENAND_VERIFY_WRITE                 note<'writes here are not checked in full without'>
+
+CONFIG_MTD_RAW_NAND                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MTD_RAW_NAND                             note<'boot essential on arm'>
+
+CONFIG_NETWORK_PHY_TIMESTAMPING                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETWORK_PHY_TIMESTAMPING                 note<'LP: #1785816'>
+
+CONFIG_NET_9P                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_9P                                   note<'LP: #1557994'>
+
+CONFIG_NET_DROP_MONITOR                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_DROP_MONITOR                         note<'LP: #1660634'>
+
+CONFIG_NET_SWITCHDEV                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_SWITCHDEV                            note<'updated to y for s390x starting with focal'>
+
+CONFIG_NET_VENDOR_EMULEX                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_EMULEX                        note<'LP: #1543165'>
+
+CONFIG_NLS                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NLS                                      note<'dependancy of boot essential'>
+
+CONFIG_NOP_USB_XCEIV                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_NOP_USB_XCEIV                            note<'boot essential on omap/highbank'>
+
+CONFIG_NO_HZ_FULL                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_NO_HZ_FULL                               note<'LP: #2051342'>
+
+CONFIG_NO_HZ_IDLE                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NO_HZ_IDLE                               note<'LP: #2051342'>
+
+CONFIG_NR_CPUS                                  policy<{'amd64': '8192', 'arm64': '512', 'armhf': '4', 'ppc64el': '2048', 'riscv64': '32', 's390x': '512'}>
+CONFIG_NR_CPUS                                  note<'LP: #2042897 (arm64), LP: #1967889 (riscv64), LP: #1864198 (s390x)'>
+
+CONFIG_NUMA                                     policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NUMA                                     note<'LP: #1557690'>
+
+CONFIG_NUMA_BALANCING_DEFAULT_ENABLED           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NUMA_BALANCING_DEFAULT_ENABLED           note<'LP: #1557690'>
+
+CONFIG_NUMA_EMU                                 policy<{'amd64': 'n'}>
+CONFIG_NUMA_EMU                                 note<'LP: #1864198'>
+
+CONFIG_NVMEM                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NVMEM                                    note<'LP: #1543165'>
+
+CONFIG_NVRAM                                    policy<{'amd64': 'm', 'ppc64el': 'y'}>
+CONFIG_NVRAM                                    note<'LP: #1837726'>
+
+CONFIG_N_GSM                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_N_GSM                                    note<'LP: #1404670'>
+
+CONFIG_OSNOISE_TRACER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_OSNOISE_TRACER                           note<'This enables the osnoise tracer for the kernel. LP: #2018591'>
+
+CONFIG_PAGE_POISONING                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAGE_POISONING                           note<'LP: #1783651'>
+
+CONFIG_PANIC_ON_OOPS                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PANIC_ON_OOPS                            note<'keep working if at all possible'>
+
+CONFIG_PATA_HPT3X3_DMA                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_PATA_HPT3X3_DMA                          note<'DMA mode is documented problematic'>
+
+CONFIG_PCIEASPM_DEFAULT                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIEASPM_DEFAULT                         note<'LP: #1398544'>
+
+CONFIG_PCIEPORTBUS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIEPORTBUS                              note<'LP: #1665404'>
+
+CONFIG_PCI_DYNAMIC_OF_NODES                     policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_PCI_DYNAMIC_OF_NODES                     note<'LP: #2074376'>
+
+CONFIG_PCI_MESON                                policy<{'amd64': 'n', 'arm64': 'm', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCI_MESON                                note<'LP: #2007745'>
+
+CONFIG_PCI_NR_FUNCTIONS                         policy<{'s390x': '512'}>
+CONFIG_PCI_NR_FUNCTIONS                         note<'LP: #1866056'>
+
+CONFIG_PINCTRL_CHERRYVIEW                       policy<{'amd64': 'y'}>
+CONFIG_PINCTRL_CHERRYVIEW                       note<'LP: #1630238'>
+
+CONFIG_PM                                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM                                       note<'LP: #1867753'>
+
+CONFIG_PPC_MEM_KEYS                             policy<{'ppc64el': 'n'}>
+CONFIG_PPC_MEM_KEYS                             note<'LP: #1776967'>
+
+CONFIG_PPC_SECURE_BOOT                          policy<{'ppc64el': 'y'}>
+CONFIG_PPC_SECURE_BOOT                          note<'LP: #1855668'>
+
+CONFIG_PPC_SECVAR_SYSFS                         policy<{'ppc64el': 'y'}>
+CONFIG_PPC_SECVAR_SYSFS                         note<'LP: #1866909'>
+
+CONFIG_PREEMPT_DYNAMIC                          policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_PREEMPT_DYNAMIC                          note<'LP: #2051342'>
+
+CONFIG_PSI_DEFAULT_DISABLED                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'y'}>
+CONFIG_PSI_DEFAULT_DISABLED                     note<'LP: #1876044'>
+
+CONFIG_QCOM_QDF2400_ERRATUM_0065                policy<{'arm64': 'y'}>
+CONFIG_QCOM_QDF2400_ERRATUM_0065                note<'LP: #1672486'>
+
+CONFIG_QETH_OSX                                 policy<{'s390x': 'n'}>
+CONFIG_QETH_OSX                                 note<'LP: #1959890'>
+
+CONFIG_RCU_LAZY                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_RCU_LAZY                                 note<'LP: #2051342'>
+
+CONFIG_RCU_LAZY_DEFAULT_OFF                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_RCU_LAZY_DEFAULT_OFF                     note<'LP: #2051342'>
+
+CONFIG_RCU_NOCB_CPU                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_RCU_NOCB_CPU                             note<'LP: #2051342'>
+
+CONFIG_RCU_NOCB_CPU_DEFAULT_ALL                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_RCU_NOCB_CPU_DEFAULT_ALL                 note<'LP: #2051342'>
+
+CONFIG_REGULATOR_FIXED_VOLTAGE                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_REGULATOR_FIXED_VOLTAGE                  note<'boot essential on arm and the Allwinner D1 RISC-V SoC'>
+
+CONFIG_REGULATOR_TPS65217                       policy<{'arm64': 'm', 'armhf': 'y', 'ppc64el': '-', 'riscv64': 'm'}>
+CONFIG_REGULATOR_TPS65217                       note<'boot essential on AM335x'>
+
+CONFIG_REGULATOR_TWL4030                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TWL4030                        note<'boot requisite for omap4'>
+
+CONFIG_RTC_DRV_CMOS                             policy<{'amd64': 'y', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_RTC_DRV_CMOS                             note<'boot essential on i386/amd64'>
+
+CONFIG_RTC_DRV_EFI                              policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_EFI                              note<'LP: #1583738'>
+
+CONFIG_RTC_DRV_TWL4030                          policy<{'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_TWL4030                          note<'boot essential on OMAP3/OMAP4'>
+
+CONFIG_RT_GROUP_SCHED                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RT_GROUP_SCHED                           note<'LP: #1875665'>
+
+CONFIG_S390_UV_UAPI                             policy<{'s390x': 'y'}>
+CONFIG_S390_UV_UAPI                             note<'LP: #2048919'>
+
+CONFIG_SAMPLE_TRACE_PRINTK                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SAMPLE_TRACE_PRINTK                      note<'Required for ftrace selftests'>
+
+CONFIG_SATA_AHCI_PLATFORM                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_AHCI_PLATFORM                       note<'boot essential on highbank'>
+
+CONFIG_SATA_HIGHBANK                            policy<{'armhf': 'y'}>
+CONFIG_SATA_HIGHBANK                            note<'LP: #1703430'>
+
+CONFIG_SCLP_OFB                                 policy<{'s390x': 'y'}>
+CONFIG_SCLP_OFB                                 note<'LP: #1787898'>
+
+CONFIG_SCSI_IPR_DUMP                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SCSI_IPR_DUMP                            note<'LP: #1343109'>
+
+CONFIG_SCSI_IPR_TRACE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SCSI_IPR_TRACE                           note<'LP: #1343109'>
+
+CONFIG_SCSI_VIRTIO                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_VIRTIO                              note<'enable initrdless boot in VMs for ease of use, cloud-kernel parity and disaster recovery, LP: #1685291'>
+
+CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS        note<'LP: #1990064'>
+
+CONFIG_SECURITY_SAFESETID                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_SAFESETID                       note<'LP: #1845391'>
+
+CONFIG_SERIAL_8250_DW                           policy<{'amd64': 'm', 'arm64': 'y', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_DW                           note<'several RISC-V boards needs this for console output'>
+
+CONFIG_SERIAL_8250_MID                          policy<{'amd64': 'y'}>
+CONFIG_SERIAL_8250_MID                          note<'required to provide console on some Intel SoC platforms (LP: #2009283)'>
+
+CONFIG_SERIAL_DEV_BUS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SERIAL_DEV_BUS                           note<'LP: #1739939'>
+
+CONFIG_SERIAL_DEV_CTRL_TTYPORT                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SERIAL_DEV_CTRL_TTYPORT                  note<'LP: #1739939'>
+
+CONFIG_SERIAL_SH_SCI                            policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_SH_SCI                            note<'LP: #2022361'>
+
+CONFIG_SERIAL_SH_SCI_CONSOLE                    policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_SH_SCI_CONSOLE                    note<'LP: #2022361'>
+
+CONFIG_SERIAL_SH_SCI_EARLYCON                   policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_SH_SCI_EARLYCON                   note<'LP: #2022361'>
+
+CONFIG_SETEND_EMULATION                         policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_SETEND_EMULATION                         note<'LP: #1545542'>
+
+CONFIG_SMC                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SMC                                      note<'LP: #1789934'>
+
+CONFIG_SMC_DIAG                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SMC_DIAG                                 note<'LP: #1789934'>
+
+CONFIG_SND                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND                                      note<'not autoloadable on omap'>
+
+CONFIG_SND_HDA_POWER_SAVE_DEFAULT               policy<{'amd64': '1', 'arm64': '1', 'armhf': '1', 'ppc64el': '1', 'riscv64': '1'}>
+CONFIG_SND_HDA_POWER_SAVE_DEFAULT               note<'LP: #1804265'>
+
+CONFIG_SND_HDA_RECONFIG                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_HDA_RECONFIG                         note<'allows fixes to be tested live'>
+
+CONFIG_SND_PCM_OSS                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SND_PCM_OSS                              note<'deprecated in favour of pulseaudio emulation'>
+
+CONFIG_SND_SOC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC                                  note<'not autoloadable on omap'>
+
+CONFIG_SND_SOC_AMD_RENOIR                       policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_RENOIR                       note<'LP: #1881046'>
+
+CONFIG_SND_SOC_AMD_RENOIR_MACH                  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_RENOIR_MACH                  note<'LP: #1881046'>
+
+CONFIG_SND_SOC_INTEL_CFL                        policy<{'amd64': 'n'}>
+CONFIG_SND_SOC_INTEL_CFL                        note<'deprecated'>
+
+CONFIG_SND_SOC_INTEL_CML_H                      policy<{'amd64': 'n'}>
+CONFIG_SND_SOC_INTEL_CML_H                      note<'deprecated'>
+
+CONFIG_SND_SOC_INTEL_CML_LP                     policy<{'amd64': 'n'}>
+CONFIG_SND_SOC_INTEL_CML_LP                     note<'deprecated'>
+
+CONFIG_SND_SOC_INTEL_CNL                        policy<{'amd64': 'n'}>
+CONFIG_SND_SOC_INTEL_CNL                        note<'deprecated'>
+
+CONFIG_SND_SOC_INTEL_SKYLAKE                    policy<{'amd64': 'n'}>
+CONFIG_SND_SOC_INTEL_SKYLAKE                    note<'deprecated'>
+
+CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC      policy<{'amd64': 'y'}>
+CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC      note<'LP: #1915117'>
+
+CONFIG_SND_SOC_INTEL_SOUNDWIRE_SOF_MACH         policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOUNDWIRE_SOF_MACH         note<'LP: #1921632'>
+
+CONFIG_SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES   policy<{'amd64': 'y'}>
+CONFIG_SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES   note<'LP: #1921632'>
+
+CONFIG_SND_SOC_SOF_HDA_AUDIO_CODEC              policy<{'amd64': 'y'}>
+CONFIG_SND_SOC_SOF_HDA_AUDIO_CODEC              note<'LP: #1848490'>
+
+CONFIG_SND_SOC_SOF_HDA_LINK                     policy<{'amd64': 'y'}>
+CONFIG_SND_SOC_SOF_HDA_LINK                     note<'LP: #1848490'>
+
+CONFIG_SOUND                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SOUND                                    note<'not autoloadable on omap'>
+
+CONFIG_SOUNDWIRE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SOUNDWIRE                                note<'LP: #1855685'>
+
+CONFIG_SOUND_OSS_CORE_PRECLAIM                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SOUND_OSS_CORE_PRECLAIM                  note<'LP: #1385510'>
+
+CONFIG_SQUASHFS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS                                 note<'LP: #1593134'>
+
+CONFIG_SQUASHFS_4K_DEVBLK_SIZE                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SQUASHFS_4K_DEVBLK_SIZE                  note<'non-default block size'>
+
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU             note<'LP: #1980861'>
+
+CONFIG_STACK_VALIDATION                         policy<{'amd64': 'y'}>
+CONFIG_STACK_VALIDATION                         note<'needed for livepatch'>
+
+CONFIG_SUN6I_RTC_CCU                            policy<{'arm64': 'm', 'riscv64': 'y'}>
+CONFIG_SUN6I_RTC_CCU                            note<'needed by Allwinner D1 pinctrl/gpio'>
+
+CONFIG_SWP_EMULATION                            policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_SWP_EMULATION                            note<'LP: #1545542'>
+
+CONFIG_SYSFB_SIMPLEFB                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_SYSFB_SIMPLEFB                           note<'LP: #1965303'>
+
+CONFIG_TCG_TIS_I2C_ATMEL                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'y', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TCG_TIS_I2C_ATMEL                        note<'LP: #1643652'>
+
+CONFIG_TCG_TIS_I2C_INFINEON                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'y', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TCG_TIS_I2C_INFINEON                     note<'LP: #1643652'>
+
+CONFIG_TCG_TIS_I2C_NUVOTON                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'y', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TCG_TIS_I2C_NUVOTON                      note<'LP: #1643652'>
+
+CONFIG_TCG_TPM                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TCG_TPM                                  note<'needed for early validation'>
+
+CONFIG_TEST_BLACKHOLE_DEV                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TEST_BLACKHOLE_DEV                       note<'Used by net selftests'>
+
+CONFIG_TIMERLAT_TRACER                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TIMERLAT_TRACER                          note<'This enables the osnoise tracer for the kernel. LP: #2018591'>
+
+CONFIG_TMPFS_POSIX_ACL                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TMPFS_POSIX_ACL                          note<'some /dev nodes require POSIX ACLs, like /dev/dsp'>
+
+CONFIG_TOUCHSCREEN_ELAN                         policy<{'amd64': 'y', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_ELAN                         note<'LP: #1630238'>
+
+CONFIG_TUNE_Z16                                 policy<{'s390x': 'y'}>
+CONFIG_TUNE_Z16                                 note<'LP: #1982833 in general, always pick the newest tune available'>
+
+CONFIG_UBSAN                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'n', 's390x': 'y'}>
+CONFIG_UBSAN                                    note<'LP: #1942215'>
+
+CONFIG_UNWINDER_FRAME_POINTER                   policy<{'amd64': 'y', 'armhf': 'y'}>
+CONFIG_UNWINDER_FRAME_POINTER                   note<'needed for livepatch'>
+
+CONFIG_USB_EHCI_HCD                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_EHCI_HCD                             note<'ensures USB 2.0/1.1 probe ordering'>
+
+CONFIG_USB_EHCI_HCD_PLATFORM                    policy<{'amd64': 'y', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_EHCI_HCD_PLATFORM                    note<'Dont use the generic ehci/ohci code on omap, it doesnt work'>
+
+CONFIG_USB_HCD_BCMA                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_HCD_BCMA                             note<'USB_{O,E}HCI_HCD_PLATFORM must be off on omap'>
+
+CONFIG_USB_HCD_SSB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_HCD_SSB                              note<'USB_{O,E}HCI_HCD_PLATFORM must be off on omap'>
+
+CONFIG_USB_M66592                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_M66592                               note<'gadget device'>
+
+CONFIG_USB_MUSB_HDRC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_MUSB_HDRC                            note<'not autoloadable on omap'>
+
+CONFIG_USB_OTG                                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'y'}>
+CONFIG_USB_OTG                                  note<'LP: #1411295'>
+
+CONFIG_USB_SERIAL_DEBUG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_DEBUG                         note<'not actually debug'>
+
+CONFIG_USB_UHCI_HCD                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_UHCI_HCD                             note<'ensures USB 2.0/1.1 probe ordering'>
+
+CONFIG_USB_XHCI_DBGCAP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_XHCI_DBGCAP                          note<'LP: #1730832'>
+
+CONFIG_USB_XHCI_HCD                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_XHCI_HCD                             note<'ensures USB 2.0/1.1 probe ordering'>
+
+CONFIG_VFAT_FS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VFAT_FS                                  note<'needed on arm to ensure we can write the kernel when replacing'>
+
+CONFIG_VFIO                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VFIO                                     note<'LP: #1636733'>
+
+CONFIG_VFIO_PCI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VFIO_PCI                                 note<'LP: #1636733'>
+
+CONFIG_VFIO_PCI_ZDEV_KVM                        policy<{'s390x': 'y'}>
+CONFIG_VFIO_PCI_ZDEV_KVM                        note<'LP: #2042853'>
+
+CONFIG_VIDEO_VIMC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_VIMC                               note<'LP: #1831482'>
+
+CONFIG_VIRTIO_BLK                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_BLK                               note<'LP: #2030745'>
+
+CONFIG_VIRTIO_MMIO                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_VIRTIO_MMIO                              note<'LP: #1557689'>
+
+CONFIG_VIRTIO_NET                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_NET                               note<'KVM paravirt support -- cloud-init currently racy with this as a module (LP: #2036968)'>
+
+CONFIG_WWAN                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_WWAN                                     note<'LP: #2033406'>
+
+CONFIG_X509_CERTIFICATE_PARSER                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_X509_CERTIFICATE_PARSER                  note<'module signing'>
+
+CONFIG_X86_ACPI_CPUFREQ                         policy<{'amd64': 'y'}>
+CONFIG_X86_ACPI_CPUFREQ                         note<'not autoloadable'>
+
+CONFIG_X86_KERNEL_IBT                           policy<{'amd64': 'n'}>
+CONFIG_X86_KERNEL_IBT                           note<'LP: #1980484'>
+
+CONFIG_X86_PCC_CPUFREQ                          policy<{'amd64': 'y'}>
+CONFIG_X86_PCC_CPUFREQ                          note<'not autoloadable'>
+
+CONFIG_X86_POWERNOW_K8                          policy<{'amd64': 'y'}>
+CONFIG_X86_POWERNOW_K8                          note<'not autoloadable'>
+
+CONFIG_X86_SPEEDSTEP_CENTRINO                   policy<{'amd64': 'y'}>
+CONFIG_X86_SPEEDSTEP_CENTRINO                   note<'not autoloadable'>
+
+CONFIG_X86_UV                                   policy<{'amd64': 'y'}>
+CONFIG_X86_UV                                   note<'LP: #1863810'>
+
+CONFIG_X86_X32_ABI                              policy<{'amd64': 'n'}>
+CONFIG_X86_X32_ABI                              note<'LP: #1994516'>
+
+CONFIG_XEN_512GB                                policy<{'amd64': 'y'}>
+CONFIG_XEN_512GB                                note<'Q: is this related to the utlemming questions on memory size?'>
+
+CONFIG_XEN_ACPI_PROCESSOR                       policy<{'amd64': 'y'}>
+CONFIG_XEN_ACPI_PROCESSOR                       note<'boot essential on XEN host'>
+
+CONFIG_XEN_BLKDEV_FRONTEND                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_BLKDEV_FRONTEND                      note<'not autoloadable -- XEN paravirt support'>
+
+CONFIG_XEN_NETDEV_FRONTEND                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_NETDEV_FRONTEND                      note<'not autoloadable -- XEN paravirt support'>
+
+CONFIG_XZ_DEC                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XZ_DEC                                   note<'boot essential -- initramfs decompressor'>
+
+CONFIG_ZLIB_DFLTCC                              policy<{'s390x': 'y'}>
+CONFIG_ZLIB_DFLTCC                              note<'LP: #1830208'>
+
+CONFIG_ZONE_DMA                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 's390x': 'y'}>
+CONFIG_ZONE_DMA                                 note<'LP: #1628523'>
+
+
+# ---- Annotations without notes ----
+
+CONFIG_104_QUAD_8                               policy<{'amd64': 'm'}>
+CONFIG_60XX_WDT                                 policy<{'amd64': 'm'}>
+CONFIG_64BIT                                    policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_6LOWPAN                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_6LOWPAN_DEBUGFS                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_6LOWPAN_GHC_ICMPV6                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_6LOWPAN_GHC_UDP                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_6LOWPAN_NHC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_6LOWPAN_NHC_DEST                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_6LOWPAN_NHC_FRAGMENT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_6LOWPAN_NHC_HOP                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_6LOWPAN_NHC_IPV6                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_6LOWPAN_NHC_MOBILITY                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_6LOWPAN_NHC_ROUTING                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_6LOWPAN_NHC_UDP                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_6PACK                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_8139CP                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_8139TOO                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_8139TOO_8129                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_8139TOO_PIO                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_8139TOO_TUNE_TWISTER                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_8139_OLD_RX_RESET                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_842_COMPRESS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_842_DECOMPRESS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_9P_FS                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_9P_FSCACHE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_9P_FS_POSIX_ACL                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_9P_FS_SECURITY                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_A11Y_BRAILLE_CONSOLE                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_A64FX_DIAG                               policy<{'arm64': 'y'}>
+CONFIG_ABP060MG                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AC97_BUS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ACENIC                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ACENIC_OMIT_TIGON_I                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ACERHDF                                  policy<{'amd64': 'm'}>
+CONFIG_ACER_WIRELESS                            policy<{'amd64': 'm'}>
+CONFIG_ACER_WMI                                 policy<{'amd64': 'm'}>
+CONFIG_ACORN_PARTITION                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ACPI                                     policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_AC                                  policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_ADXL                                policy<{'amd64': 'y'}>
+CONFIG_ACPI_AGDI                                policy<{'arm64': 'y'}>
+CONFIG_ACPI_ALS                                 policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ACPI_APEI                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_APEI_EINJ                           policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_ACPI_APEI_ERST_DEBUG                     policy<{'amd64': 'n', 'arm64': 'n'}>
+CONFIG_ACPI_APEI_GHES                           policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_APEI_MEMORY_FAILURE                 policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_APEI_PCIEAER                        policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_APEI_SEA                            policy<{'arm64': 'y'}>
+CONFIG_ACPI_APMT                                policy<{'arm64': 'y'}>
+CONFIG_ACPI_BATTERY                             policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_BGRT                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_BUTTON                              policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_CCA_REQUIRED                        policy<{'arm64': 'y'}>
+CONFIG_ACPI_CMPC                                policy<{'amd64': 'm'}>
+CONFIG_ACPI_CONFIGFS                            policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ACPI_CONTAINER                           policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_CPPC_CPUFREQ                        policy<{'arm64': 'm'}>
+CONFIG_ACPI_CPPC_CPUFREQ_FIE                    policy<{'arm64': 'y'}>
+CONFIG_ACPI_CPPC_LIB                            policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_CPU_FREQ_PSS                        policy<{'amd64': 'y'}>
+CONFIG_ACPI_CUSTOM_DSDT_FILE                    policy<{'amd64': '""'}>
+CONFIG_ACPI_DEBUG                               policy<{'amd64': 'y', 'arm64': 'n', 'riscv64': 'n'}>
+CONFIG_ACPI_DEBUGGER                            policy<{'amd64': 'y', 'arm64': 'n', 'riscv64': 'n'}>
+CONFIG_ACPI_DEBUGGER_USER                       policy<{'amd64': 'y'}>
+CONFIG_ACPI_DOCK                                policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_DPTF                                policy<{'amd64': 'y'}>
+CONFIG_ACPI_EC_DEBUGFS                          policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ACPI_EXTLOG                              policy<{'amd64': 'm'}>
+CONFIG_ACPI_FAN                                 policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_FFH                                 policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_FPDT                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_GENERIC_GSI                         policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_GTDT                                policy<{'arm64': 'y'}>
+CONFIG_ACPI_HED                                 policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_HMAT                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_HOTPLUG_CPU                         policy<{'amd64': 'y', 'arm64': '-'}>
+CONFIG_ACPI_HOTPLUG_IOAPIC                      policy<{'amd64': 'y'}>
+CONFIG_ACPI_HOTPLUG_MEMORY                      policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_I2C_OPREGION                        policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_IORT                                policy<{'arm64': 'y'}>
+CONFIG_ACPI_IPMI                                policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ACPI_LEGACY_TABLES_LOOKUP                policy<{'amd64': 'y'}>
+CONFIG_ACPI_LPIT                                policy<{'amd64': 'y'}>
+CONFIG_ACPI_MCFG                                policy<{'arm64': 'y'}>
+CONFIG_ACPI_MDIO                                policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_NFIT                                policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ACPI_NUMA                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_PCC                                 policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_PCI_SLOT                            policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_PFRUT                               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ACPI_PLATFORM_PROFILE                    policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_ACPI_PPTT                                policy<{'arm64': 'y'}>
+CONFIG_ACPI_PRMT                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_PROCESSOR                           policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_PROCESSOR_AGGREGATOR                policy<{'amd64': 'm'}>
+CONFIG_ACPI_PROCESSOR_CSTATE                    policy<{'amd64': 'y'}>
+CONFIG_ACPI_PROCESSOR_IDLE                      policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_REDUCED_HARDWARE_ONLY               policy<{'amd64': 'n', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_REV_OVERRIDE_POSSIBLE               policy<{'amd64': 'y'}>
+CONFIG_ACPI_SBS                                 policy<{'amd64': 'm'}>
+CONFIG_ACPI_SLEEP                               policy<{'amd64': 'y'}>
+CONFIG_ACPI_SPCR_TABLE                          policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT         policy<{'amd64': 'y'}>
+CONFIG_ACPI_TABLE_LIB                           policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': '-'}>
+CONFIG_ACPI_TABLE_UPGRADE                       policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_TAD                                 policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ACPI_THERMAL                             policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_THERMAL_LIB                         policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_THERMAL_REL                         policy<{'amd64': 'm'}>
+CONFIG_ACPI_TOSHIBA                             policy<{'amd64': 'm'}>
+CONFIG_ACPI_VIDEO                               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ACPI_VIOT                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ACPI_WATCHDOG                            policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ACPI_WMI                                 policy<{'amd64': 'm'}>
+CONFIG_ACQUIRE_WDT                              policy<{'amd64': 'm'}>
+CONFIG_ACRN_GUEST                               policy<{'amd64': 'y'}>
+CONFIG_ACRN_HSM                                 policy<{'amd64': 'm'}>
+CONFIG_AD2S1200                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD2S1210                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD2S90                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD3552R                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD4130                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5064                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5110                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD525X_DPOT                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_AD525X_DPOT_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD525X_DPOT_SPI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5272                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5360                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5380                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5421                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5446                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5449                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5504                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5592R                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5592R_BASE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5593R                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5624R_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5686                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5686_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5696_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5755                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5758                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5761                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5764                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5766                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5770R                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5791                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD5933                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7091R                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7091R5                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7091R8                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7124                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7150                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7192                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7266                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7280                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7291                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7292                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7293                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7298                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7303                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD74115                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD74413R                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7476                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7606                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7606_IFACE_PARALLEL                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7606_IFACE_SPI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7746                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7766                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7768_1                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7780                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7791                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7793                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7816                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7887                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7923                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD7949                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD799X                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD8366                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD8801                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD9467                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD9523                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD9832                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD9834                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADA4250                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADAPTEC_STARFIRE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ADF4350                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADF4371                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADF4377                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADFS_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ADFS_FS_RW                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ADIN1100_PHY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ADIN1110                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIN_PHY                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ADIS16080                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16130                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16136                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16201                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16203                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16209                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16240                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16260                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16400                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16460                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16475                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADIS16480                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADI_AXI_ADC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADJD_S311                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADM8211                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADMV1013                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADMV1014                                 policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADMV4420                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADMV8818                                 policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADRF6780                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADT7316                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADT7316_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADT7316_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADUX1020                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADVANTECH_EC_WDT                         policy<{'amd64': 'm'}>
+CONFIG_ADVANTECH_WDT                            policy<{'amd64': 'm'}>
+CONFIG_ADVISE_SYSCALLS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ADV_SWBUTTON                             policy<{'amd64': 'm'}>
+CONFIG_ADXL313                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL313_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL313_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL355                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL355_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL355_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL367                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL367_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL367_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL372                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL372_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXL372_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXRS290                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ADXRS450                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AD_SIGMA_DELTA                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AEABI                                    policy<{'armhf': 'y'}>
+CONFIG_AFE4403                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AFE4404                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AFFS_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_AFIUCV                                   policy<{'s390x': 'm'}>
+CONFIG_AFS_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_AFS_DEBUG_CURSOR                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_AFS_FS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_AFS_FSCACHE                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AF_KCM                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_AF_RXRPC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_AF_RXRPC_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_AF_RXRPC_INJECT_LOSS                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_AF_RXRPC_INJECT_RX_DELAY                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_AF_RXRPC_IPV6                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AF_UNIX_OOB                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AGP_AMD64                                policy<{'amd64': 'y'}>
+CONFIG_AGP_INTEL                                policy<{'amd64': 'y'}>
+CONFIG_AGP_SIS                                  policy<{'amd64': 'm'}>
+CONFIG_AGP_VIA                                  policy<{'amd64': 'y'}>
+CONFIG_AHCI_CEVA                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AHCI_DM816                               policy<{'armhf': 'm'}>
+CONFIG_AHCI_DWC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AHCI_IMX                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_AHCI_MTK                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_AHCI_MVEBU                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_AHCI_QORIQ                               policy<{'arm64': 'm', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_AHCI_SUNXI                               policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_AHCI_TEGRA                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_AHCI_XGENE                               policy<{'arm64': 'm'}>
+CONFIG_AIC79XX_CMDS_PER_DEVICE                  policy<{'amd64': '32', 'arm64': '32', 'armhf': '32', 'ppc64el': '32', 'riscv64': '32'}>
+CONFIG_AIC79XX_DEBUG_ENABLE                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_AIC79XX_DEBUG_MASK                       policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_AIC79XX_REG_PRETTY_PRINT                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_AIC79XX_RESET_DELAY_MS                   policy<{'amd64': '5000', 'arm64': '5000', 'armhf': '5000', 'ppc64el': '5000', 'riscv64': '5000'}>
+CONFIG_AIC7XXX_CMDS_PER_DEVICE                  policy<{'amd64': '8', 'arm64': '8', 'armhf': '8', 'ppc64el': '8', 'riscv64': '8'}>
+CONFIG_AIC7XXX_DEBUG_ENABLE                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_AIC7XXX_DEBUG_MASK                       policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_AIC7XXX_REG_PRETTY_PRINT                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_AIC7XXX_RESET_DELAY_MS                   policy<{'amd64': '5000', 'arm64': '5000', 'armhf': '5000', 'ppc64el': '5000', 'riscv64': '5000'}>
+CONFIG_AIC94XX_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_AIO                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AIX_PARTITION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_AK09911                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AK8974                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AK8975                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AL3010                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AL3320A                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ALIBABA_ENI_VDPA                         policy<{'amd64': 'm'}>
+CONFIG_ALIBABA_UNCORE_DRW_PMU                   policy<{'arm64': 'm'}>
+CONFIG_ALIENWARE_WMI                            policy<{'amd64': 'm'}>
+CONFIG_ALIGNMENT_TRAP                           policy<{'armhf': 'y'}>
+CONFIG_ALIM1535_WDT                             policy<{'amd64': 'm'}>
+CONFIG_ALIM7101_WDT                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ALLOW_DEV_COREDUMP                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ALTERA_FREEZE_BRIDGE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ALTERA_MBOX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ALTERA_MSGDMA                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ALTERA_PR_IP_CORE                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ALTERA_PR_IP_CORE_PLAT                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ALTERA_STAPL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ALTERA_TSE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ALTERNATE_USER_ADDRESS_SPACE             policy<{'s390x': 'y'}>
+CONFIG_ALTIVEC                                  policy<{'ppc64el': 'y'}>
+CONFIG_ALX                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_AL_FIC                                   policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_AM2315                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AM335X_CONTROL_USB                       policy<{'armhf': 'm'}>
+CONFIG_AM335X_PHY_USB                           policy<{'armhf': 'm'}>
+CONFIG_AMBA_PL08X                               policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_AMD8111_ETH                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_AMDTEE                                   policy<{'amd64': 'm'}>
+CONFIG_AMD_HSMP                                 policy<{'amd64': 'm'}>
+CONFIG_AMD_IOMMU                                policy<{'amd64': 'y'}>
+CONFIG_AMD_MEM_ENCRYPT                          policy<{'amd64': 'y'}>
+CONFIG_AMD_NB                                   policy<{'amd64': 'y'}>
+CONFIG_AMD_NUMA                                 policy<{'amd64': 'y'}>
+CONFIG_AMD_PHY                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_AMD_PMC                                  policy<{'amd64': 'm'}>
+CONFIG_AMD_PMF                                  policy<{'amd64': 'm'}>
+CONFIG_AMD_PMF_DEBUG                            policy<{'amd64': 'y'}>
+CONFIG_AMD_PTDMA                                policy<{'amd64': 'm'}>
+CONFIG_AMD_SFH_HID                              policy<{'amd64': 'm'}>
+CONFIG_AMD_WBRF                                 policy<{'amd64': 'y'}>
+CONFIG_AMD_XGBE                                 policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_AMD_XGBE_DCB                             policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_AMD_XGBE_HAVE_ECC                        policy<{'amd64': 'y'}>
+CONFIG_AMIGA_PARTITION                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_AMILO_RFKILL                             policy<{'amd64': 'm'}>
+CONFIG_AMLOGIC_THERMAL                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_AMPERE_CORESIGHT_PMU_ARCH_SYSTEM_PMU     policy<{'arm64': 'm'}>
+CONFIG_AMPERE_ERRATUM_AC03_CPU_38               policy<{'arm64': 'y'}>
+CONFIG_AMT                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ANDROID_BINDERFS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ANDROID_BINDER_DEVICES                   policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""'}>
+CONFIG_ANDROID_BINDER_IPC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ANDROID_BINDER_IPC_SELFTEST              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ANON_VMA_NAME                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AOSONG_AGS02MA                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_APDS9300                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_APDS9802ALS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_APDS9960                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_APERTURE_HELPERS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_APM_EMULATION                            policy<{'armhf': 'n'}>
+CONFIG_APPLDATA_BASE                            policy<{'s390x': 'y'}>
+CONFIG_APPLDATA_MEM                             policy<{'s390x': 'm'}>
+CONFIG_APPLDATA_NET_SUM                         policy<{'s390x': 'm'}>
+CONFIG_APPLDATA_OS                              policy<{'s390x': 'm'}>
+CONFIG_APPLE_ADMAC                              policy<{'arm64': 'm'}>
+CONFIG_APPLE_AIC                                policy<{'arm64': 'y'}>
+CONFIG_APPLE_DART                               policy<{'arm64': 'm'}>
+CONFIG_APPLE_GMUX                               policy<{'amd64': 'm'}>
+CONFIG_APPLE_M1_CPU_PMU                         policy<{'arm64': 'y'}>
+CONFIG_APPLE_MAILBOX                            policy<{'arm64': 'm'}>
+CONFIG_APPLE_MFI_FASTCHARGE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_APPLE_PMGR_PWRSTATE                      policy<{'arm64': 'y'}>
+CONFIG_APPLE_PROPERTIES                         policy<{'amd64': 'y'}>
+CONFIG_APPLE_RTKIT                              policy<{'arm64': 'm'}>
+CONFIG_APPLE_SART                               policy<{'arm64': 'm'}>
+CONFIG_APPLE_WATCHDOG                           policy<{'arm64': 'm'}>
+CONFIG_APPLICOM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_APQ_GCC_8084                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_APQ_MMCC_8084                            policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_AQTION                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_AQUANTIA_PHY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_AR5523                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCH_32BIT_OFF_T                         policy<{'armhf': 'y'}>
+CONFIG_ARCH_32BIT_USTAT_F_TINODE                policy<{'s390x': 'y'}>
+CONFIG_ARCH_ACTIONS                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_AIROHA                              policy<{'armhf': 'y'}>
+CONFIG_ARCH_ALPINE                              policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_ARCH_APPLE                               policy<{'arm64': 'y'}>
+CONFIG_ARCH_ARTPEC                              policy<{'armhf': 'y'}>
+CONFIG_ARCH_ASPEED                              policy<{'armhf': 'y'}>
+CONFIG_ARCH_AT91                                policy<{'armhf': 'n'}>
+CONFIG_ARCH_AXXIA                               policy<{'armhf': 'y'}>
+CONFIG_ARCH_BCM                                 policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_ARCH_BERLIN                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS              policy<{'arm64': 'y'}>
+CONFIG_ARCH_BINFMT_ELF_STATE                    policy<{'arm64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_BITMAIN                             policy<{'arm64': 'y'}>
+CONFIG_ARCH_CLOCKSOURCE_INIT                    policy<{'amd64': 'y', 'riscv64': '-'}>
+CONFIG_ARCH_CONFIGURES_CPU_MITIGATIONS          policy<{'amd64': 'y'}>
+CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 's390x': 'y'}>
+CONFIG_ARCH_CPUIDLE_HALTPOLL                    policy<{'amd64': 'y'}>
+CONFIG_ARCH_CPU_PROBE_RELEASE                   policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG      policy<{'arm64': 'y'}>
+CONFIG_ARCH_DIGICOLOR                           policy<{'armhf': 'n'}>
+CONFIG_ARCH_DISABLE_KASAN_INLINE                policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_DMA_ADDR_T_64BIT                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_DMA_DEFAULT_COHERENT                policy<{'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_DOVE                                policy<{'armhf': 'n'}>
+CONFIG_ARCH_EMEV2                               policy<{'armhf': 'y'}>
+CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG               policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE             policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK             policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_ENABLE_THP_MIGRATION                policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_EXYNOS                              policy<{'arm64': 'n', 'armhf': 'y'}>
+CONFIG_ARCH_EXYNOS3                             policy<{'armhf': 'n'}>
+CONFIG_ARCH_EXYNOS4                             policy<{'armhf': 'n'}>
+CONFIG_ARCH_EXYNOS5                             policy<{'armhf': 'n'}>
+CONFIG_ARCH_FLATMEM_ENABLE                      policy<{'armhf': 'y'}>
+CONFIG_ARCH_FORCE_MAX_ORDER                     policy<{'arm64': '13', 'armhf': '11', 'ppc64el': '8'}>
+CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE              policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ARCH_HAS_ADD_PAGES                       policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_BANDGAP                         policy<{'armhf': 'y'}>
+CONFIG_ARCH_HAS_BINFMT_FLAT                     policy<{'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_CACHE_LINE_SIZE                 policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ARCH_HAS_CC_PLATFORM                     policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_COPY_MC                         policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION  policy<{'amd64': 'y'}>
+CONFIG_ARCH_HAS_CPU_FINALIZE_INIT               policy<{'amd64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_HAS_CPU_PASID                       policy<{'amd64': 'y'}>
+CONFIG_ARCH_HAS_CPU_RELAX                       policy<{'amd64': 'y'}>
+CONFIG_ARCH_HAS_CURRENT_STACK_POINTER           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_DEBUG_VIRTUAL                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE                policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_DEBUG_WX                        policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED               policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_DMA_ALLOC                       policy<{'armhf': 'y'}>
+CONFIG_ARCH_HAS_DMA_MAP_DIRECT                  policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_DMA_PREP_COHERENT               policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_EARLY_DEBUG                     policy<{'amd64': 'y'}>
+CONFIG_ARCH_HAS_ELFCORE_COMPAT                  policy<{'amd64': 'y'}>
+CONFIG_ARCH_HAS_ELF_RANDOMIZE                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_FAST_MULTIPLIER                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_FORCE_DMA_UNENCRYPTED           policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_FORTIFY_SOURCE                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_GCOV_PROFILE_ALL                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_GENERIC_CRASHKERNEL_RESERVATION policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_GIGANTIC_PAGE                   policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_HUGEPD                          policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_HW_PTE_YOUNG                    policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ARCH_HAS_KCOV                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_KEEPINITRD                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_HAS_MEMBARRIER_CALLBACKS            policy<{'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_MEMREMAP_COMPAT_ALIGN           policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_MEM_ENCRYPT                     policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_MMIOWB                          policy<{'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS           policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG               policy<{'amd64': 'y'}>
+CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_PARANOID_L1D_FLUSH              policy<{'amd64': 'y'}>
+CONFIG_ARCH_HAS_PHYS_TO_DMA                     policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_PKEYS                           policy<{'amd64': 'y'}>
+CONFIG_ARCH_HAS_PMEM_API                        policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_PTE_DEVMAP                      policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_PTE_SPECIAL                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_RELR                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_HAS_RESET_CONTROLLER                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_HAS_SCALED_CPUTIME                  policy<{'s390x': 'y'}>
+CONFIG_ARCH_HAS_SETUP_DMA_OPS                   policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_SET_DIRECT_MAP                  policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_SET_MEMORY                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_STRICT_KERNEL_RWX               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_STRICT_MODULE_RWX               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_SUBPAGE_FAULTS                  policy<{'arm64': 'y'}>
+CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE       policy<{'amd64': 'y'}>
+CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU                policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE             policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_SYSCALL_WRAPPER                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_TEARDOWN_DMA_OPS                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_HAS_TICK_BROADCAST                  policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE              policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_HAS_UBSAN                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_VDSO_DATA                       policy<{'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAS_ZONE_DMA_SET                    policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ARCH_HAVE_ELF_PROT                       policy<{'arm64': 'y'}>
+CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_HAVE_TRACE_MMIO_ACCESS              policy<{'arm64': 'y'}>
+CONFIG_ARCH_HI3xxx                              policy<{'armhf': 'y'}>
+CONFIG_ARCH_HIBERNATION_HEADER                  policy<{'amd64': 'y', 'riscv64': '-'}>
+CONFIG_ARCH_HIBERNATION_POSSIBLE                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-'}>
+CONFIG_ARCH_HIGHBANK                            policy<{'armhf': 'y'}>
+CONFIG_ARCH_HIP01                               policy<{'armhf': 'n'}>
+CONFIG_ARCH_HIP04                               policy<{'armhf': 'y'}>
+CONFIG_ARCH_HISI                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_HIX5HD2                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_HPE                                 policy<{'armhf': 'y'}>
+CONFIG_ARCH_HPE_GXP                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_INLINE_READ_LOCK                    policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_READ_LOCK_BH                 policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_READ_LOCK_IRQ                policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_READ_LOCK_IRQSAVE            policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_READ_TRYLOCK                 policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_READ_UNLOCK                  policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_READ_UNLOCK_BH               policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_READ_UNLOCK_IRQ              policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_READ_UNLOCK_IRQRESTORE       policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_LOCK                    policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_LOCK_BH                 policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_LOCK_IRQ                policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_LOCK_IRQSAVE            policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_TRYLOCK                 policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_TRYLOCK_BH              policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_UNLOCK                  policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_UNLOCK_BH               policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_UNLOCK_IRQ              policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_SPIN_UNLOCK_IRQRESTORE       policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_WRITE_LOCK                   policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_WRITE_LOCK_BH                policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_WRITE_LOCK_IRQ               policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_WRITE_LOCK_IRQSAVE           policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_WRITE_TRYLOCK                policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_WRITE_UNLOCK                 policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_WRITE_UNLOCK_BH              policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_WRITE_UNLOCK_IRQ             policy<{'s390x': 'y'}>
+CONFIG_ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE      policy<{'s390x': 'y'}>
+CONFIG_ARCH_INTEL_SOCFPGA                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_IPQ40XX                             policy<{'armhf': 'n'}>
+CONFIG_ARCH_K3                                  policy<{'arm64': 'y'}>
+CONFIG_ARCH_KEEMBAY                             policy<{'arm64': 'y'}>
+CONFIG_ARCH_KEEP_MEMBLOCK                       policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_KEYSTONE                            policy<{'armhf': 'n'}>
+CONFIG_ARCH_LAYERSCAPE                          policy<{'arm64': 'y'}>
+CONFIG_ARCH_LG1K                                policy<{'arm64': 'y'}>
+CONFIG_ARCH_MA35                                policy<{'arm64': 'y'}>
+CONFIG_ARCH_MAY_HAVE_PC_FDC                     policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_MDM9615                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_MEDIATEK                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_MEMORY_PROBE                        policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_MESON                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_MICROCHIP_POLARFIRE                 policy<{'riscv64': 'y'}>
+CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC                 policy<{'amd64': 'y'}>
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT               policy<{'amd64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_MIGHT_HAVE_PC_SERIO                 policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_MILBEAUT                            policy<{'armhf': 'y'}>
+CONFIG_ARCH_MILBEAUT_M10V                       policy<{'armhf': 'y'}>
+CONFIG_ARCH_MMAP_RND_BITS_MAX                   policy<{'amd64': '32', 'arm64': '33', 'arm64-generic-64k': '29', 'armhf': '16', 'ppc64el': '29', 'riscv64': '24'}>
+CONFIG_ARCH_MMAP_RND_BITS_MIN                   policy<{'amd64': '28', 'arm64': '18', 'arm64-generic-64k': '14', 'armhf': '8', 'ppc64el': '14', 'riscv64': '18'}>
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX            policy<{'amd64': '16', 'arm64': '16', 'ppc64el': '13', 'riscv64': '17'}>
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN            policy<{'amd64': '8', 'arm64': '11', 'arm64-generic-64k': '7', 'ppc64el': '7', 'riscv64': '8'}>
+CONFIG_ARCH_MMP                                 policy<{'armhf': 'n'}>
+CONFIG_ARCH_MSM8909                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_MSM8916                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_MSM8960                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_MSM8974                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_MSM8X60                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_MSTARV7                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_MULTIPLATFORM                       policy<{'armhf': 'y'}>
+CONFIG_ARCH_MULTI_V6                            policy<{'armhf': 'n'}>
+CONFIG_ARCH_MULTI_V6_V7                         policy<{'armhf': 'y'}>
+CONFIG_ARCH_MULTI_V7                            policy<{'armhf': 'y'}>
+CONFIG_ARCH_MVEBU                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_MXC                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED              policy<{'armhf': 'y'}>
+CONFIG_ARCH_NPCM                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_NPCM7XX                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_NXP                                 policy<{'arm64': 'y'}>
+CONFIG_ARCH_OMAP                                policy<{'armhf': 'y'}>
+CONFIG_ARCH_OMAP2PLUS                           policy<{'armhf': 'y'}>
+CONFIG_ARCH_OMAP2PLUS_TYPICAL                   policy<{'armhf': 'y'}>
+CONFIG_ARCH_OMAP3                               policy<{'armhf': 'n'}>
+CONFIG_ARCH_OMAP4                               policy<{'armhf': 'n'}>
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX                 policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT         policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_PENSANDO                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_PROC_KCORE_TEXT                     policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_QCOM                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_R7S72100                            policy<{'armhf': 'y'}>
+CONFIG_ARCH_R7S9210                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A73A4                             policy<{'armhf': 'n'}>
+CONFIG_ARCH_R8A7740                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7742                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7743                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7744                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7745                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A77470                            policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A774A1                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A774B1                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A774C0                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A774E1                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A7778                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7779                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7790                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7791                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7792                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7793                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A7794                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_R8A77951                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A77960                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A77961                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A77965                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A77970                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A77980                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A77990                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A77995                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A779A0                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A779F0                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R8A779G0                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_R9A06G032                           policy<{'armhf': 'y'}>
+CONFIG_ARCH_R9A07G043                           policy<{'arm64': 'y', 'riscv64': '-'}>
+CONFIG_ARCH_R9A07G044                           policy<{'arm64': 'y'}>
+CONFIG_ARCH_R9A07G054                           policy<{'arm64': 'y'}>
+CONFIG_ARCH_R9A08G045                           policy<{'arm64': 'y'}>
+CONFIG_ARCH_R9A09G011                           policy<{'arm64': 'y'}>
+CONFIG_ARCH_RCAR_GEN1                           policy<{'armhf': 'y'}>
+CONFIG_ARCH_RCAR_GEN2                           policy<{'armhf': 'y'}>
+CONFIG_ARCH_RCAR_GEN3                           policy<{'arm64': 'y'}>
+CONFIG_ARCH_RDA                                 policy<{'armhf': 'y'}>
+CONFIG_ARCH_REALTEK                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_REALVIEW                            policy<{'armhf': 'n'}>
+CONFIG_ARCH_RENESAS                             policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_RMOBILE                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_RV64I                               policy<{'riscv64': 'y'}>
+CONFIG_ARCH_RZG2L                               policy<{'arm64': 'y', 'riscv64': '-'}>
+CONFIG_ARCH_RZN1                                policy<{'armhf': 'y'}>
+CONFIG_ARCH_S32                                 policy<{'arm64': 'y'}>
+CONFIG_ARCH_S5PV210                             policy<{'armhf': 'n'}>
+CONFIG_ARCH_SEATTLE                             policy<{'arm64': 'y'}>
+CONFIG_ARCH_SELECTS_CRASH_DUMP                  policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_SELECTS_KEXEC                       policy<{'riscv64': 'y'}>
+CONFIG_ARCH_SELECTS_KEXEC_FILE                  policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_SELECT_MEMORY_MODEL                 policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_SH73A0                              policy<{'armhf': 'y'}>
+CONFIG_ARCH_SIFIVE                              policy<{'riscv64': 'y'}>
+CONFIG_ARCH_SOPHGO                              policy<{'riscv64': 'y'}>
+CONFIG_ARCH_SPARSEMEM_DEFAULT                   policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SPARSEMEM_ENABLE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SPARX5                              policy<{'arm64': 'y'}>
+CONFIG_ARCH_SPRD                                policy<{'arm64': 'y'}>
+CONFIG_ARCH_STACKWALK                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_STARFIVE                            policy<{'riscv64': 'y'}>
+CONFIG_ARCH_STI                                 policy<{'armhf': 'n'}>
+CONFIG_ARCH_STM32                               policy<{'arm64': 'y', 'armhf': 'n'}>
+CONFIG_ARCH_SUNPLUS                             policy<{'armhf': 'y'}>
+CONFIG_ARCH_SUNXI                               policy<{'arm64': 'y', 'armhf': 'n', 'riscv64': 'y'}>
+CONFIG_ARCH_SUPPORTS_ACPI                       policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_SUPPORTS_ATOMIC_RMW                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_CFI_CLANG                  policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_SUPPORTS_CRASH_DUMP                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_CRASH_HOTPLUG              policy<{'amd64': 'y'}>
+CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_HUGETLBFS                  policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_INT128                     policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_SUPPORTS_KEXEC                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_KEXEC_BZIMAGE_VERIFY_SIG   policy<{'amd64': 'y'}>
+CONFIG_ARCH_SUPPORTS_KEXEC_FILE                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_KEXEC_IMAGE_VERIFY_SIG     policy<{'arm64': 'y'}>
+CONFIG_ARCH_SUPPORTS_KEXEC_JUMP                 policy<{'amd64': 'y'}>
+CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY            policy<{'amd64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_KEXEC_SIG                  policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_KEXEC_SIG_FORCE            policy<{'amd64': 'y'}>
+CONFIG_ARCH_SUPPORTS_LTO_CLANG                  policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN             policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE             policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_SUPPORTS_NUMA_BALANCING             policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_PAGE_TABLE_CHECK           policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUPPORTS_SHADOW_CALL_STACK          policy<{'arm64': 'y'}>
+CONFIG_ARCH_SUPPORTS_UPROBES                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_SUSPEND_NONZERO_CPU                 policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_SUSPEND_POSSIBLE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_SYNQUACER                           policy<{'arm64': 'y'}>
+CONFIG_ARCH_TEGRA                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_TEGRA_114_SOC                       policy<{'armhf': 'y'}>
+CONFIG_ARCH_TEGRA_124_SOC                       policy<{'armhf': 'y'}>
+CONFIG_ARCH_TEGRA_132_SOC                       policy<{'arm64': 'y'}>
+CONFIG_ARCH_TEGRA_186_SOC                       policy<{'arm64': 'y'}>
+CONFIG_ARCH_TEGRA_194_SOC                       policy<{'arm64': 'y'}>
+CONFIG_ARCH_TEGRA_210_SOC                       policy<{'arm64': 'y'}>
+CONFIG_ARCH_TEGRA_234_SOC                       policy<{'arm64': 'y'}>
+CONFIG_ARCH_TEGRA_2x_SOC                        policy<{'armhf': 'y'}>
+CONFIG_ARCH_TEGRA_3x_SOC                        policy<{'armhf': 'y'}>
+CONFIG_ARCH_THEAD                               policy<{'riscv64': 'y'}>
+CONFIG_ARCH_THUNDER                             policy<{'arm64': 'y'}>
+CONFIG_ARCH_THUNDER2                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_U8500                               policy<{'armhf': 'n'}>
+CONFIG_ARCH_UNIPHIER                            policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_ARCH_USES_HIGH_VMA_FLAGS                 policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ARCH_USES_PG_ARCH_X                      policy<{'arm64': 'y'}>
+CONFIG_ARCH_USES_PG_UNCACHED                    policy<{'amd64': 'y'}>
+CONFIG_ARCH_USE_BUILTIN_BSWAP                   policy<{'amd64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_USE_CMPXCHG_LOCKREF                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_USE_GNU_PROPERTY                    policy<{'arm64': 'y'}>
+CONFIG_ARCH_USE_MEMREMAP_PROT                   policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_USE_MEMTEST                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_USE_QUEUED_RWLOCKS                  policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_USE_QUEUED_SPINLOCKS                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_ARCH_USE_SYM_ANNOTATIONS                 policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_USING_PATCHABLE_FUNCTION_ENTRY      policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_VEXPRESS                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARCH_VEXPRESS_CORTEX_A5_A9_ERRATA        policy<{'armhf': 'y'}>
+CONFIG_ARCH_VEXPRESS_DCSCB                      policy<{'armhf': 'y'}>
+CONFIG_ARCH_VEXPRESS_SPC                        policy<{'armhf': 'y'}>
+CONFIG_ARCH_VEXPRESS_TC2_PM                     policy<{'armhf': 'y'}>
+CONFIG_ARCH_VIRT                                policy<{'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_VISCONTI                            policy<{'arm64': 'y'}>
+CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT           policy<{'amd64': 'y', 's390x': '-'}>
+CONFIG_ARCH_WANTS_NO_INSTR                      policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_WANTS_THP_SWAP                      policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'riscv64': 'y'}>
+CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH        policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION       policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'ppc64el': '-', 's390x': '-'}>
+CONFIG_ARCH_WANT_DEFAULT_BPF_JIT                policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT    policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_WANT_FLAT_DTB_INSTALL               policy<{'armhf': 'y'}>
+CONFIG_ARCH_WANT_FRAME_POINTERS                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_WANT_GENERAL_HUGETLB                policy<{'amd64': 'y', 'armhf': 'y', 'riscv64': '-'}>
+CONFIG_ARCH_WANT_HUGE_PMD_SHARE                 policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'riscv64': 'y'}>
+CONFIG_ARCH_WANT_IPC_PARSE_VERSION              policy<{'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM           policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_WANT_KERNEL_PMD_MKWRITE             policy<{'s390x': 'y'}>
+CONFIG_ARCH_WANT_LD_ORPHAN_WARN                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ARCH_WANT_OLD_COMPAT_IPC                 policy<{'amd64': 'y', 'ppc64el': '-', 's390x': '-'}>
+CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP           policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP       policy<{'amd64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_WANT_PMD_MKWRITE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ARCH_WEAK_RELEASE_ACQUIRE                policy<{'ppc64el': 'y'}>
+CONFIG_ARCH_WM8850                              policy<{'armhf': 'n'}>
+CONFIG_ARCH_XGENE                               policy<{'arm64': 'y'}>
+CONFIG_ARCH_ZYNQ                                policy<{'armhf': 'n'}>
+CONFIG_ARCH_ZYNQMP                              policy<{'arm64': 'y'}>
+CONFIG_ARCNET                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ARCNET_1051                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCNET_1201                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCNET_CAP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCNET_COM20020                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCNET_COM20020_CS                       policy<{'amd64': 'm'}>
+CONFIG_ARCNET_COM20020_PCI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCNET_COM90xx                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCNET_COM90xxIO                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCNET_RAW                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCNET_RIM_I                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARCX_ANYBUS_CONTROLLER                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ARC_EMAC_CORE                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM                                      policy<{'armhf': 'y'}>
+CONFIG_ARM64                                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_16K_PAGES                          policy<{'arm64': 'n'}>
+CONFIG_ARM64_4K_PAGES                           policy<{'arm64': 'y', 'arm64-generic-64k': 'n'}>
+CONFIG_ARM64_64K_PAGES                          policy<{'arm64': 'n', 'arm64-generic-64k': 'y'}>
+CONFIG_ARM64_ACPI_PARKING_PROTOCOL              policy<{'arm64': 'y'}>
+CONFIG_ARM64_AMU_EXTN                           policy<{'arm64': 'y'}>
+CONFIG_ARM64_AS_HAS_MTE                         policy<{'arm64': 'y'}>
+CONFIG_ARM64_BTI                                policy<{'arm64': 'y'}>
+CONFIG_ARM64_CNP                                policy<{'arm64': 'y'}>
+CONFIG_ARM64_CONT_PMD_SHIFT                     policy<{'arm64': '4', 'arm64-generic-64k': '5'}>
+CONFIG_ARM64_CONT_PTE_SHIFT                     policy<{'arm64': '4', 'arm64-generic-64k': '5'}>
+CONFIG_ARM64_DEBUG_PRIORITY_MASKING             policy<{'arm64': 'n'}>
+CONFIG_ARM64_E0PD                               policy<{'arm64': 'y'}>
+CONFIG_ARM64_EPAN                               policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_1024718                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_1165522                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_1286807                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_1319367                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_1418040                    policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_ARM64_ERRATUM_1463225                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_1508412                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_1530923                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_1542419                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_1742098                    policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_ARM64_ERRATUM_2051678                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_2054223                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_2067961                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_2077057                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_2441007                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_2441009                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_2457168                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_2645198                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_2658417                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_2966298                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_3117295                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_3194386                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_819472                     policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_824069                     policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_826319                     policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_827319                     policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_832075                     policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_834220                     policy<{'arm64': 'y'}>
+CONFIG_ARM64_ERRATUM_845719                     policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_ARM64_HW_AFDBM                           policy<{'arm64': 'y'}>
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419          policy<{'arm64': 'y'}>
+CONFIG_ARM64_LSE_ATOMICS                        policy<{'arm64': 'y'}>
+CONFIG_ARM64_MTE                                policy<{'arm64': 'y'}>
+CONFIG_ARM64_PAGE_SHIFT                         policy<{'arm64': '12', 'arm64-generic-64k': '16'}>
+CONFIG_ARM64_PAN                                policy<{'arm64': 'y'}>
+CONFIG_ARM64_PA_BITS                            policy<{'arm64': '48'}>
+CONFIG_ARM64_PA_BITS_48                         policy<{'arm64': 'y'}>
+CONFIG_ARM64_PA_BITS_52                         policy<{'arm64-generic-64k': 'n'}>
+CONFIG_ARM64_PMEM                               policy<{'arm64': 'y'}>
+CONFIG_ARM64_PSEUDO_NMI                         policy<{'arm64': 'y'}>
+CONFIG_ARM64_PTR_AUTH                           policy<{'arm64': 'y'}>
+CONFIG_ARM64_PTR_AUTH_KERNEL                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_RAS_EXTN                           policy<{'arm64': 'y'}>
+CONFIG_ARM64_RELOC_TEST                         policy<{'arm64': 'n'}>
+CONFIG_ARM64_SVE                                policy<{'arm64': 'y'}>
+CONFIG_ARM64_SW_TTBR0_PAN                       policy<{'arm64': 'y'}>
+CONFIG_ARM64_TAGGED_ADDR_ABI                    policy<{'arm64': 'y'}>
+CONFIG_ARM64_TLB_RANGE                          policy<{'arm64': 'y'}>
+CONFIG_ARM64_VA_BITS                            policy<{'arm64': '48'}>
+CONFIG_ARM64_VA_BITS_39                         policy<{'arm64': 'n', 'arm64-generic-64k': '-'}>
+CONFIG_ARM64_VA_BITS_42                         policy<{'arm64-generic-64k': 'n'}>
+CONFIG_ARM64_VA_BITS_52                         policy<{'arm64-generic-64k': 'n'}>
+CONFIG_ARM64_WORKAROUND_CLEAN_CACHE             policy<{'arm64': 'y'}>
+CONFIG_ARM64_WORKAROUND_REPEAT_TLBI             policy<{'arm64': 'y'}>
+CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT          policy<{'arm64': 'y'}>
+CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD policy<{'arm64': 'y'}>
+CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE       policy<{'arm64': 'y'}>
+CONFIG_ARMADA375_USBCLUSTER_PHY                 policy<{'armhf': 'y'}>
+CONFIG_ARMADA_370_CLK                           policy<{'armhf': 'y'}>
+CONFIG_ARMADA_370_XP_IRQ                        policy<{'armhf': 'y'}>
+CONFIG_ARMADA_370_XP_TIMER                      policy<{'armhf': 'y'}>
+CONFIG_ARMADA_375_CLK                           policy<{'armhf': 'y'}>
+CONFIG_ARMADA_37XX_CLK                          policy<{'arm64': 'y'}>
+CONFIG_ARMADA_37XX_RWTM_MBOX                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARMADA_37XX_WATCHDOG                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARMADA_38X_CLK                           policy<{'armhf': 'y'}>
+CONFIG_ARMADA_39X_CLK                           policy<{'armhf': 'y'}>
+CONFIG_ARMADA_AP806_SYSCON                      policy<{'arm64': 'y'}>
+CONFIG_ARMADA_AP_CPU_CLK                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARMADA_AP_CP_HELPER                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARMADA_CP110_SYSCON                      policy<{'arm64': 'y'}>
+CONFIG_ARMADA_THERMAL                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARMADA_XP_CLK                            policy<{'armhf': 'y'}>
+CONFIG_ARM_ALLWINNER_SUN50I_CPUFREQ_NVMEM       policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_ARM_AMBA                                 policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_ARM_APPENDED_DTB                         policy<{'armhf': 'y'}>
+CONFIG_ARM_APPLE_SOC_CPUFREQ                    policy<{'arm64': 'm'}>
+CONFIG_ARM_ARCH_TIMER                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND            policy<{'arm64': 'y'}>
+CONFIG_ARM_ARMADA_37XX_CPUFREQ                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_ARMADA_8K_CPUFREQ                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_ATAG_DTB_COMPAT                      policy<{'armhf': 'n'}>
+CONFIG_ARM_BIG_LITTLE_CPUIDLE                   policy<{'armhf': 'y'}>
+CONFIG_ARM_CCI                                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_CCI400_COMMON                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_CCI400_PMU                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_CCI400_PORT_CTRL                     policy<{'armhf': 'y'}>
+CONFIG_ARM_CCI5xx_PMU                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_CCI_PMU                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_CCN                                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_CHARLCD                              policy<{'armhf': 'y'}>
+CONFIG_ARM_CMN                                  policy<{'arm64': 'm'}>
+CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU        policy<{'arm64': 'm'}>
+CONFIG_ARM_CPUIDLE                              policy<{'armhf': 'y'}>
+CONFIG_ARM_CPU_SUSPEND                          policy<{'armhf': 'y'}>
+CONFIG_ARM_CPU_TOPOLOGY                         policy<{'armhf': 'y'}>
+CONFIG_ARM_DMA_IOMMU_ALIGNMENT                  policy<{'armhf': '8'}>
+CONFIG_ARM_DMA_MEM_BUFFERABLE                   policy<{'armhf': 'y'}>
+CONFIG_ARM_DMA_USE_IOMMU                        policy<{'armhf': 'y'}>
+CONFIG_ARM_DMC620_PMU                           policy<{'arm64': 'm'}>
+CONFIG_ARM_DSU_PMU                              policy<{'arm64': 'm'}>
+CONFIG_ARM_ERRATA_430973                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_643719                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_720789                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_754322                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_754327                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_764319                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_764369                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_773022                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_775420                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_798181                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_814220                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_818325_852422                 policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_821420                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_825619                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_852421                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_852423                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_857271                        policy<{'armhf': 'y'}>
+CONFIG_ARM_ERRATA_857272                        policy<{'armhf': 'y'}>
+CONFIG_ARM_EXYNOS_BUS_DEVFREQ                   policy<{'armhf': 'n'}>
+CONFIG_ARM_EXYNOS_CPUIDLE                       policy<{'armhf': 'n'}>
+CONFIG_ARM_FFA_SMCCC                            policy<{'arm64': 'y'}>
+CONFIG_ARM_FFA_TRANSPORT                        policy<{'arm64': 'm'}>
+CONFIG_ARM_GIC                                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_GIC_MAX_NR                           policy<{'arm64': '1', 'armhf': '1'}>
+CONFIG_ARM_GIC_PM                               policy<{'arm64': 'y'}>
+CONFIG_ARM_GIC_V2M                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_GIC_V3                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_GIC_V3_ITS                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_GIC_V3_ITS_FSL_MC                    policy<{'arm64': 'y'}>
+CONFIG_ARM_GIC_V3_ITS_PCI                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_GLOBAL_TIMER                         policy<{'armhf': 'y'}>
+CONFIG_ARM_GT_INITIAL_PRESCALER_VAL             policy<{'armhf': '1'}>
+CONFIG_ARM_HAS_GROUP_RELOCS                     policy<{'armhf': 'y'}>
+CONFIG_ARM_HEAVY_MB                             policy<{'armhf': 'y'}>
+CONFIG_ARM_HIGHBANK_CPUFREQ                     policy<{'armhf': 'm'}>
+CONFIG_ARM_IMX6Q_CPUFREQ                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_IMX8M_DDRC_DEVFREQ                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_IMX_BUS_DEVFREQ                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_IMX_CPUFREQ_DT                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_KPROBES_TEST                         policy<{'armhf': 'm'}>
+CONFIG_ARM_L1_CACHE_SHIFT                       policy<{'armhf': '6'}>
+CONFIG_ARM_L1_CACHE_SHIFT_6                     policy<{'armhf': 'y'}>
+CONFIG_ARM_LPAE                                 policy<{'armhf': 'y'}>
+CONFIG_ARM_MEDIATEK_CCI_DEVFREQ                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_MEDIATEK_CPUFREQ                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_MEDIATEK_CPUFREQ_HW                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_MHU                                  policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_ARM_MHU_V2                               policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_ARM_MODULE_PLTS                          policy<{'armhf': 'y'}>
+CONFIG_ARM_MVEBU_V7_CPUIDLE                     policy<{'armhf': 'y'}>
+CONFIG_ARM_OMAP2PLUS_CPUFREQ                    policy<{'armhf': 'y'}>
+CONFIG_ARM_PATCH_IDIV                           policy<{'armhf': 'y'}>
+CONFIG_ARM_PATCH_PHYS_VIRT                      policy<{'armhf': 'y'}>
+CONFIG_ARM_PL172_MPMC                           policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_ARM_PMU                                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_PMUV3                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_PMU_ACPI                             policy<{'arm64': 'y'}>
+CONFIG_ARM_PSCI                                 policy<{'armhf': 'y'}>
+CONFIG_ARM_PSCI_CHECKER                         policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_ARM_PSCI_CPUIDLE                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_PSCI_CPUIDLE_DOMAIN                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_PSCI_FW                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_PTDUMP_CORE                          policy<{'armhf': 'y'}>
+CONFIG_ARM_PTDUMP_DEBUGFS                       policy<{'armhf': 'n'}>
+CONFIG_ARM_QCOM_CPUFREQ_HW                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_QCOM_CPUFREQ_NVMEM                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_QCOM_SPM_CPUIDLE                     policy<{'armhf': 'y'}>
+CONFIG_ARM_RK3399_DMC_DEVFREQ                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SBSA_WATCHDOG                        policy<{'arm64': 'm'}>
+CONFIG_ARM_SCMI_CPUFREQ                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SCMI_HAVE_MSG                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_HAVE_SHMEM                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_HAVE_TRANSPORT                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_NEED_DEBUGFS                    policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_PERF_DOMAIN                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SCMI_POWERCAP                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SCMI_POWER_CONTROL                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SCMI_POWER_DOMAIN                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SCMI_PROTOCOL                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_RAW_MODE_SUPPORT                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_RAW_MODE_SUPPORT_COEX           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_TRANSPORT_MAILBOX               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_TRANSPORT_SMC                   policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_TRANSPORT_SMC_ATOMIC_ENABLE     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_TRANSPORT_VIRTIO                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_TRANSPORT_VIRTIO_ATOMIC_ENABLE  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCMI_TRANSPORT_VIRTIO_VERSION1_COMPLIANCE policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SCPI_CPUFREQ                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SCPI_POWER_DOMAIN                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SCPI_PROTOCOL                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SDE_INTERFACE                        policy<{'arm64': 'y'}>
+CONFIG_ARM_SMCCC_SOC_ID                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_SMC_WATCHDOG                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SMMU                                 policy<{'arm64': 'y', 'armhf': 'n'}>
+CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS              policy<{'arm64': 'n', 'armhf': '-'}>
+CONFIG_ARM_SMMU_QCOM                            policy<{'arm64': 'y'}>
+CONFIG_ARM_SMMU_QCOM_DEBUG                      policy<{'arm64': 'y', 'arm64-generic-64k': 'n'}>
+CONFIG_ARM_SMMU_V3                              policy<{'arm64': 'y'}>
+CONFIG_ARM_SMMU_V3_PMU                          policy<{'arm64': 'm'}>
+CONFIG_ARM_SMMU_V3_SVA                          policy<{'arm64': 'y'}>
+CONFIG_ARM_SP805_WATCHDOG                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_SPE_PMU                              policy<{'arm64': 'm'}>
+CONFIG_ARM_SUN8I_A33_MBUS_DEVFREQ               policy<{'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ARM_TEGRA124_CPUFREQ                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_TEGRA186_CPUFREQ                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_TEGRA194_CPUFREQ                     policy<{'arm64': 'm'}>
+CONFIG_ARM_TEGRA20_CPUFREQ                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_TEGRA_CPUIDLE                        policy<{'armhf': 'n'}>
+CONFIG_ARM_TEGRA_DEVFREQ                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ARM_THUMB                                policy<{'armhf': 'y'}>
+CONFIG_ARM_THUMBEE                              policy<{'armhf': 'y'}>
+CONFIG_ARM_TIMER_SP804                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_TI_CPUFREQ                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ARM_VEXPRESS_SPC_CPUFREQ                 policy<{'armhf': 'm'}>
+CONFIG_ARM_VIC                                  policy<{'armhf': 'y'}>
+CONFIG_ARM_VIC_NR                               policy<{'armhf': '2'}>
+CONFIG_ARM_VIRT_EXT                             policy<{'armhf': 'y'}>
+CONFIG_AS3935                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AS73211                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ASM_MODVERSIONS                          policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ASN1                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ASN1_ENCODER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ASPEED_ADC                               policy<{'armhf': 'm'}>
+CONFIG_ASPEED_BT_IPMI_BMC                       policy<{'armhf': 'm'}>
+CONFIG_ASPEED_KCS_IPMI_BMC                      policy<{'armhf': 'm'}>
+CONFIG_ASPEED_LPC_CTRL                          policy<{'armhf': 'm'}>
+CONFIG_ASPEED_LPC_SNOOP                         policy<{'armhf': 'm'}>
+CONFIG_ASPEED_P2A_CTRL                          policy<{'armhf': 'm'}>
+CONFIG_ASPEED_SOCINFO                           policy<{'armhf': 'y'}>
+CONFIG_ASPEED_UART_ROUTING                      policy<{'armhf': 'm'}>
+CONFIG_ASPEED_WATCHDOG                          policy<{'armhf': 'y'}>
+CONFIG_ASSOCIATIVE_ARRAY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AST2600_I3C_MASTER                       policy<{'armhf': 'm'}>
+CONFIG_ASUS_LAPTOP                              policy<{'amd64': 'm'}>
+CONFIG_ASUS_NB_WMI                              policy<{'amd64': 'm'}>
+CONFIG_ASUS_TF103C_DOCK                         policy<{'amd64': 'm'}>
+CONFIG_ASUS_WIRELESS                            policy<{'amd64': 'm'}>
+CONFIG_ASUS_WMI                                 policy<{'amd64': 'm'}>
+CONFIG_ASYNC_CORE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ASYNC_MEMCPY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ASYNC_PQ                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ASYNC_RAID6_RECOV                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ASYNC_RAID6_TEST                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ASYNC_TX_DISABLE_PQ_VAL_DMA              policy<{'arm64': 'y'}>
+CONFIG_ASYNC_TX_DISABLE_XOR_VAL_DMA             policy<{'arm64': 'y'}>
+CONFIG_ASYNC_TX_DMA                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ASYNC_TX_ENABLE_CHANNEL_SWITCH           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ASYNC_XOR                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_AS_AVX512                                policy<{'amd64': 'y'}>
+CONFIG_AS_GFNI                                  policy<{'amd64': 'y'}>
+CONFIG_AS_HAS_ARMV8_2                           policy<{'arm64': 'y'}>
+CONFIG_AS_HAS_ARMV8_3                           policy<{'arm64': 'y'}>
+CONFIG_AS_HAS_ARMV8_4                           policy<{'arm64': 'y'}>
+CONFIG_AS_HAS_ARMV8_5                           policy<{'arm64': 'y'}>
+CONFIG_AS_HAS_CFI_NEGATE_RA_STATE               policy<{'arm64': 'y'}>
+CONFIG_AS_HAS_INSN                              policy<{'riscv64': 'y'}>
+CONFIG_AS_HAS_LDAPR                             policy<{'arm64': 'y'}>
+CONFIG_AS_HAS_LSE_ATOMICS                       policy<{'arm64': 'y'}>
+CONFIG_AS_HAS_NON_CONST_ULEB128                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AS_HAS_OPTION_ARCH                       policy<{'riscv64': 'y'}>
+CONFIG_AS_HAS_SHA3                              policy<{'arm64': 'y'}>
+CONFIG_AS_HAS_ULEB128                           policy<{'riscv64': 'y'}>
+CONFIG_AS_IS_GNU                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AS_SHA1_NI                               policy<{'amd64': 'y'}>
+CONFIG_AS_SHA256_NI                             policy<{'amd64': 'y'}>
+CONFIG_AS_TPAUSE                                policy<{'amd64': 'y'}>
+CONFIG_AS_VERSION                               policy<{'amd64': '24200', 'arm64': '24200', 'armhf': '24200', 'ppc64el': '24200', 'riscv64': '24200', 's390x': '24200'}>
+CONFIG_AS_VFP_VMRS_FPINST                       policy<{'armhf': 'y'}>
+CONFIG_AS_WRUSS                                 policy<{'amd64': 'y'}>
+CONFIG_AT76C50X_USB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AT803X_PHY                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ATA                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_ATAGS                                    policy<{'armhf': 'y'}>
+CONFIG_ATAGS_PROC                               policy<{'armhf': 'y'}>
+CONFIG_ATALK                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ATARI_PARTITION                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_ATA_ACPI                                 policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ATA_BMDMA                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATA_FORCE                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATA_GENERIC                              policy<{'amd64': 'y', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ATA_OVER_ETH                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ATA_SFF                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATA_VERBOSE_ERROR                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH10K                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH10K_AHB                               policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH10K_CE                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH10K_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_ATH10K_DEBUGFS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH10K_PCI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH10K_SDIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH10K_SNOC                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ATH10K_SPECTRAL                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH10K_TRACING                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH10K_USB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH11K                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH11K_AHB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_ATH11K_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_ATH11K_DEBUGFS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH11K_PCI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH11K_SPECTRAL                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH11K_TRACING                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH12K                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'm'}>
+CONFIG_ATH12K_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'riscv64': 'n'}>
+CONFIG_ATH12K_TRACING                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_ATH5K                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH5K_DEBUG                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_ATH5K_PCI                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH5K_TRACER                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_ATH6KL                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH6KL_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_ATH6KL_SDIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH6KL_TRACING                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_ATH6KL_USB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH9K                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH9K_AHB                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_BTCOEX_SUPPORT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_CHANNEL_CONTEXT                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_COMMON                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH9K_COMMON_DEBUG                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_COMMON_SPECTRAL                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_DEBUGFS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_DYNACK                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_ATH9K_HTC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH9K_HTC_DEBUGFS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_HW                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH9K_HWRNG                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_PCI                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_PCI_NO_EEPROM                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH9K_PCOEM                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_RFKILL                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_STATION_STATISTICS                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH9K_WOW                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATH_COMMON                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATH_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_ATL1                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ATL1C                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ATL1E                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ATL2                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ATLAS_EZO_SENSOR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATLAS_PH_SENSOR                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ATM_BR2684                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_BR2684_IPFILTER                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_CLIP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_CLIP_NO_ICMP                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_DRIVERS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATM_DUMMY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_ENI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_ENI_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_ENI_TUNE_BURST                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_FORE200E                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_FORE200E_DEBUG                       policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_ATM_FORE200E_TX_RETRY                    policy<{'amd64': '16', 'arm64': '16', 'armhf': '16', 'ppc64el': '16', 'riscv64': '16'}>
+CONFIG_ATM_FORE200E_USE_TASKLET                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_HE                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_HE_USE_SUNI                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATM_IA                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_IA_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_IDT77252                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_IDT77252_DEBUG                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_IDT77252_RCV_ALL                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_IDT77252_USE_SUNI                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ATM_LANAI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_LANE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_MPOA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_NICSTAR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_NICSTAR_USE_IDT77105                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_NICSTAR_USE_SUNI                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ATM_SOLOS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATM_TCP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ATOMIC64_SELFTEST                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ATP                                      policy<{'amd64': 'm'}>
+CONFIG_AUDIT                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AUDITSYSCALL                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AUDIT_ARCH                               policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC                policy<{'arm64': 'y'}>
+CONFIG_AUDIT_COMPAT_GENERIC                     policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_AUDIT_GENERIC                            policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_AUTOFS_FS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'y'}>
+CONFIG_AUTO_ZRELADDR                            policy<{'armhf': 'y'}>
+CONFIG_AUXDISPLAY                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_AUXILIARY_BUS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_AX25                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AX25_DAMA_SLAVE                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_AX45MP_L2_CACHE                          policy<{'riscv64': 'n'}>
+CONFIG_AX88796                                  policy<{'armhf': 'm'}>
+CONFIG_AX88796B_PHY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_AX88796B_RUST_PHY                        policy<{'amd64': 'n'}>
+CONFIG_AX88796_93CX6                            policy<{'armhf': 'n'}>
+CONFIG_AXI_DMAC                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_AXP20X_ADC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AXP20X_POWER                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AXP288_ADC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_AXP288_CHARGER                           policy<{'amd64': 'm'}>
+CONFIG_AXP288_FUEL_GAUGE                        policy<{'amd64': 'm'}>
+CONFIG_B43                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_B43LEGACY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_B43LEGACY_DEBUG                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_B43LEGACY_DMA                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43LEGACY_DMA_AND_PIO_MODE               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43LEGACY_DMA_MODE                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_B43LEGACY_HWRNG                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43LEGACY_LEDS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43LEGACY_PCICORE_AUTOSELECT             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43LEGACY_PCI_AUTOSELECT                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43LEGACY_PIO                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43LEGACY_PIO_MODE                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_B43_BCMA                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_BCMA_PIO                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_BUSES_BCMA                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_B43_BUSES_BCMA_AND_SSB                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_BUSES_SSB                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_B43_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_B43_HWRNG                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_LEDS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_PCICORE_AUTOSELECT                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_PCI_AUTOSELECT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_PHY_G                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_PHY_HT                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_PHY_LP                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_PHY_N                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_PIO                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B43_SDIO                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_B43_SSB                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B44                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_B44_PCI                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B44_PCICORE_AUTOSELECT                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B44_PCI_AUTOSELECT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_B53                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_B53_MDIO_DRIVER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_B53_MMAP_DRIVER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_B53_SERDES                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_B53_SPI_DRIVER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_B53_SRAB_DRIVER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_88PM860X                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_AAT2870                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_ADP5520                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_ADP8860                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_ADP8870                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_APPLE                          policy<{'amd64': 'm'}>
+CONFIG_BACKLIGHT_ARCXCNN                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_AS3711                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_BD6107                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_CLASS_DEVICE                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BACKLIGHT_DA903X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_DA9052                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_GPIO                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_KTD253                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_KTZ8866                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_LED                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_LM3533                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_LM3630A                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_LM3639                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_LP855X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_LP8788                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_LV5207LP                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_MAX8925                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_MP3309C                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_MT6370                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_PANDORA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_PCF50633                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_PWM                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_QCOM_WLED                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKLIGHT_RAVE_SP                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_RT4831                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_SAHARA                         policy<{'amd64': 'm'}>
+CONFIG_BACKLIGHT_SKY81452                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_TPS65217                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': 'm'}>
+CONFIG_BACKLIGHT_WM831X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BACKTRACE_SELF_TEST                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BACKTRACE_VERBOSE                        policy<{'armhf': 'n'}>
+CONFIG_BALLOON_COMPACTION                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BARCO_P50_GPIO                           policy<{'amd64': 'm'}>
+CONFIG_BAREUDP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BASE_FULL                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BASE_SMALL                               policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_BATMAN_ADV                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BATMAN_ADV_BATMAN_V                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_BATMAN_ADV_BLA                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BATMAN_ADV_DAT                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BATMAN_ADV_DEBUG                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_BATMAN_ADV_MCAST                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BATMAN_ADV_NC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BATMAN_ADV_TRACING                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_BATTERY_88PM860X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_ACER_A500                        policy<{'armhf': 'm'}>
+CONFIG_BATTERY_ACT8945A                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BATTERY_AXP20X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BATTERY_BQ27XXX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_BQ27XXX_DT_UPDATES_NVM           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_BATTERY_BQ27XXX_HDQ                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BATTERY_BQ27XXX_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BATTERY_CPCAP                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BATTERY_CW2015                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_DA9030                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_DA9052                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_DA9150                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BATTERY_DS2760                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_DS2780                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_DS2781                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_DS2782                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_GAUGE_LTC2941                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_GOLDFISH                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_MAX17040                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_MAX17042                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_MAX1721X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_PM8916_BMS_VM                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_BATTERY_QCOM_BATTMGR                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BATTERY_RT5033                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_RX51                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BATTERY_SAMSUNG_SDI                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BATTERY_SBS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BATTERY_SURFACE                          policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_BATTERY_TWL4030_MADC                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BATTERY_UG3105                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BAYCOM_EPP                               policy<{'armhf': 'm'}>
+CONFIG_BAYCOM_PAR                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BAYCOM_SER_FDX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BAYCOM_SER_HDX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BCACHE                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BCACHEFS_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BCACHEFS_ERASURE_CODING                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BCACHEFS_FS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BCACHEFS_LOCK_TIME_STATS                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BCACHEFS_NO_LATENCY_ACCT                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BCACHEFS_POSIX_ACL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BCACHEFS_QUOTA                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BCACHEFS_SIX_OPTIMISTIC_SPIN             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BCACHEFS_TESTS                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BCACHE_ASYNC_REGISTRATION                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BCACHE_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BCH                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BCM54140_PHY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BCM7XXX_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BCM84881_PHY                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BCM87XX_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BCMA                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BCMA_BLOCKIO                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BCMA_DEBUG                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_BCMA_DRIVER_GMAC_CMN                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BCMA_DRIVER_GPIO                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BCMA_DRIVER_PCI                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BCMA_HOST_PCI                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BCMA_HOST_PCI_POSSIBLE                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BCMA_HOST_SOC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BCMA_POSSIBLE                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BCMA_SFLASH                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BCMGENET                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BCM_KONA_USB2_PHY                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BCM_NET_PHYLIB                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BCM_NET_PHYPTP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BCM_SBA_RAID                             policy<{'arm64': 'm'}>
+CONFIG_BCM_VK                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BCM_VK_TTY                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BD957XMUF_WATCHDOG                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BE2ISCSI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BE2NET                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BE2NET_BE2                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BE2NET_BE3                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BE2NET_HWMON                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BE2NET_LANCER                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BE2NET_SKYHAWK                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BEFS_DEBUG                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_BEFS_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BERLIN2_ADC                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_BFQ_CGROUP_DEBUG                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BFQ_GROUP_IOSCHED                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BFS_FS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BH1750                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BH1780                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BIG_LITTLE                               policy<{'armhf': 'y'}>
+CONFIG_BINARY_PRINTF                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BINDGEN_VERSION_TEXT                     policy<{'amd64': '"bindgen 0.65.1"'}>
+CONFIG_BINFMT_ELF                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BINFMT_ELF_FDPIC                         policy<{'armhf': 'y'}>
+CONFIG_BINFMT_FLAT                              policy<{'armhf': 'y', 'riscv64': 'n'}>
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK          policy<{'armhf': 'y'}>
+CONFIG_BINFMT_FLAT_OLD                          policy<{'armhf': 'y'}>
+CONFIG_BINFMT_MISC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BINFMT_ZFLAT                             policy<{'armhf': 'y'}>
+CONFIG_BITREVERSE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLKDEV_UBLK_LEGACY_OPCODES               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_BLK_CGROUP                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_CGROUP_FC_APPID                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_CGROUP_IOCOST                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_CGROUP_IOLATENCY                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BLK_CGROUP_IOPRIO                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_CGROUP_PUNT_BIO                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_CGROUP_RWSTAT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEBUG_FS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEBUG_FS_ZONED                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_3W_XXXX_RAID                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BLK_DEV_BSG                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_BSGLIB                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_BSG_COMMON                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_DM_BUILTIN                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_DRBD                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BLK_DEV_FD                               policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_BLK_DEV_FD_RAWCMD                        policy<{'amd64': 'n', 'ppc64el': 'n'}>
+CONFIG_BLK_DEV_INITRD                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_INTEGRITY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_INTEGRITY_T10                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_IO_TRACE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_LOOP                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_LOOP_MIN_COUNT                   policy<{'amd64': '8', 'arm64': '8', 'armhf': '8', 'ppc64el': '8', 'riscv64': '8', 's390x': '8'}>
+CONFIG_BLK_DEV_MD                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_NBD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BLK_DEV_NULL_BLK                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BLK_DEV_PCIESSD_MTIP32XX                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BLK_DEV_PMEM                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BLK_DEV_RAM_COUNT                        policy<{'amd64': '16', 'arm64': '16', 'armhf': '16', 'ppc64el': '16', 'riscv64': '16', 's390x': '16'}>
+CONFIG_BLK_DEV_RBD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BLK_DEV_RNBD                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_RNBD_CLIENT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BLK_DEV_RNBD_SERVER                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BLK_DEV_THROTTLING_LOW                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BLK_DEV_UBLK                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_BLK_DEV_WRITE_MOUNTED                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_DEV_ZONED                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_ICQ                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_INLINE_ENCRYPTION                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_MQ_PCI                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_MQ_STACKING                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_MQ_VIRTIO                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_PM                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BLK_RQ_ALLOC_TIME                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_SED_OPAL                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_WBT                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLK_WBT_MQ                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLOCK                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLOCK_HOLDER_DEPRECATED                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BLOCK_LEGACY_AUTOLOAD                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BL_SWITCHER                              policy<{'armhf': 'y'}>
+CONFIG_BL_SWITCHER_DUMMY_IF                     policy<{'armhf': 'm'}>
+CONFIG_BMA220                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMA400                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMA400_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMA400_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMC150_ACCEL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMC150_ACCEL_I2C                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMC150_ACCEL_SPI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMC150_MAGN                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMC150_MAGN_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMC150_MAGN_SPI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BME680                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BME680_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BME680_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMG160                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMG160_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMG160_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMI088_ACCEL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMI088_ACCEL_SPI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMI160                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMI160_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMI160_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMI323                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMI323_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMI323_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMP280                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMP280_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BMP280_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BNA                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BNX2                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BNX2X                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BNX2X_SRIOV                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BNXT                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_BNXT_DCB                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BNXT_FLOWER_OFFLOAD                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BNXT_HWMON                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BNXT_SRIOV                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BOARD_TPCI200                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BONDING                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_BOOTTIME_TRACING                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BOOTX_TEXT                               policy<{'ppc64el': 'n'}>
+CONFIG_BOOT_CONFIG                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BOOT_CONFIG_EMBED                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BOOT_CONFIG_FORCE                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BOOT_PRINTK_DELAY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_BOOT_VESA_SUPPORT                        policy<{'amd64': 'y'}>
+CONFIG_BOSCH_BNO055                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BOSCH_BNO055_I2C                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BOSCH_BNO055_SERIAL                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BOUNCE                                   policy<{'armhf': 'y'}>
+CONFIG_BPF                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPF_EVENTS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPF_JIT                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPF_JIT_ALWAYS_ON                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPF_JIT_DEFAULT_ON                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPF_KPROBE_OVERRIDE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPF_LSM                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPF_PRELOAD                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BPF_STREAM_PARSER                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPF_SYSCALL                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BPQETHER                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BQL                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BRANCH_PROFILE_NONE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BRCMDBG                                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_BRCMFMAC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BRCMFMAC_PCIE                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BRCMFMAC_PROTO_BCDC                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BRCMFMAC_PROTO_MSGBUF                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BRCMFMAC_SDIO                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BRCMFMAC_USB                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BRCMSMAC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BRCMSMAC_LEDS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BRCMUTIL                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BRCM_TRACING                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BRIDGE                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_CFM                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BRIDGE_EBT_802_3                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_AMONG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_ARP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_ARPREPLY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_BROUTE                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_DNAT                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_IP                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_IP6                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_LIMIT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_LOG                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_MARK                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_MARK_T                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_NFLOG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_PKTTYPE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_REDIRECT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_SNAT                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_STP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_T_FILTER                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_T_NAT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_EBT_VLAN                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_IGMP_SNOOPING                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BRIDGE_MRP                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BRIDGE_NETFILTER                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_NF_EBTABLES                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BRIDGE_VLAN_FILTERING                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BROADCOM_PHY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BSD_DISKLABEL                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_BSD_PROCESS_ACCT                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BSD_PROCESS_ACCT_V3                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BT                                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BTREE                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BTRFS_ASSERT                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BTRFS_DEBUG                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BTRFS_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_BTRFS_FS_POSIX_ACL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BTRFS_FS_REF_VERIFY                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BTRFS_FS_RUN_SANITY_TESTS                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BTT                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_6LOWPAN                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_AOSPEXT                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_ATH3K                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_BCM                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_BNEP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_BNEP_MC_FILTER                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_BNEP_PROTO_FILTER                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_BREDR                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_CMTP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_DEBUGFS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIBCM203X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HCIBCM4377                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HCIBFUSB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HCIBLUECARD                           policy<{'amd64': 'm'}>
+CONFIG_BT_HCIBPA10X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HCIBT3C                               policy<{'amd64': 'm'}>
+CONFIG_BT_HCIBTSDIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HCIBTUSB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HCIBTUSB_AUTOSUSPEND                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIBTUSB_BCM                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIBTUSB_MTK                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIBTUSB_POLL_SYNC                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIBTUSB_RTL                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIDTL1                               policy<{'amd64': 'm'}>
+CONFIG_BT_HCIRSI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HCIUART                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HCIUART_3WIRE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_AG6XX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_ATH3K                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_BCM                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_BCSP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_H4                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_INTEL                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_LL                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_MRVL                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_NOKIA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HCIUART_QCA                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_RTL                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIUART_SERDEV                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_HCIVHCI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_HIDP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_INTEL                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_LE                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_LEDS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_LE_L2CAP_ECRED                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_MRVL                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_MRVL_SDIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_MSFTEXT                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_MTK                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_MTKSDIO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_MTKUART                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_NXPUART                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_QCA                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_QCOMSMD                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_BT_RFCOMM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_RFCOMM_TTY                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_BT_RTL                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BT_SELFTEST                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_BT_VIRTIO                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_BUFFER_HEAD                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BUG                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BUG_ON_DATA_CORRUPTION                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_BUILDTIME_MCOUNT_SORT                    policy<{'amd64': 'y', 'armhf': 'y'}>
+CONFIG_BUILDTIME_TABLE_SORT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_BUILD_SALT                               policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '""'}>
+CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC        policy<{'arm64': 'y'}>
+CONFIG_BXT_WC_PMIC_OPREGION                     policy<{'amd64': 'y'}>
+CONFIG_BYTCRC_PMIC_OPREGION                     policy<{'amd64': 'y'}>
+CONFIG_C2PORT                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_C2PORT_DURAMAR_2150                      policy<{'amd64': 'm'}>
+CONFIG_CACHEFILES                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CACHEFILES_DEBUG                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CACHEFILES_ERROR_INJECTION               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CACHEFILES_ONDEMAND                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CACHESTAT_SYSCALL                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CACHE_FEROCEON_L2                        policy<{'armhf': 'y'}>
+CONFIG_CACHE_FEROCEON_L2_WRITETHROUGH           policy<{'armhf': 'n'}>
+CONFIG_CACHE_L2X0                               policy<{'armhf': 'y'}>
+CONFIG_CACHE_L2X0_PMU                           policy<{'armhf': 'y'}>
+CONFIG_CACHE_TAUROS2                            policy<{'armhf': 'y'}>
+CONFIG_CADENCE_WATCHDOG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CAIF                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CAIF_DEBUG                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CAIF_DRIVERS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CAIF_NETDEV                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAIF_TTY                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAIF_USB                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAIF_VIRTIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CALL_DEPTH_TRACKING                      policy<{'amd64': 'y'}>
+CONFIG_CALL_PADDING                             policy<{'amd64': 'y'}>
+CONFIG_CALL_THUNKS                              policy<{'amd64': 'y'}>
+CONFIG_CALL_THUNKS_DEBUG                        policy<{'amd64': 'n'}>
+CONFIG_CAN                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CAN_8DEV_USB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_BCM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_BXCAN                                policy<{'arm64': 'm'}>
+CONFIG_CAN_CALC_BITTIMING                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CAN_CAN327                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_CC770                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_CC770_ISA                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_CC770_PLATFORM                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_CTUCANFD                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_CTUCANFD_PCI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_CTUCANFD_PLATFORM                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_C_CAN                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_C_CAN_PCI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_C_CAN_PLATFORM                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_DEBUG_DEVICES                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CAN_DEV                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_EMS_PCI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_EMS_PCMCIA                           policy<{'amd64': 'm'}>
+CONFIG_CAN_EMS_USB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_ESD_USB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_ETAS_ES58X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_F81601                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_F81604                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_FLEXCAN                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_GRCAN                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_GS_USB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_GW                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_HI311X                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_IFI_CANFD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_ISOTP                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_J1939                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_JANZ_ICAN3                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_KVASER_PCI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_KVASER_PCIEFD                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_KVASER_USB                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_MCBA_USB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_MCP251X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_MCP251XFD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_MCP251XFD_SANITY                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CAN_MSCAN                                policy<{'ppc64el': 'm'}>
+CONFIG_CAN_M_CAN                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_M_CAN_PCI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_M_CAN_PLATFORM                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_M_CAN_TCAN4X5X                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_NETLINK                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CAN_PEAK_PCI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_PEAK_PCIEC                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CAN_PEAK_PCIEFD                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_PEAK_PCMCIA                          policy<{'amd64': 'm'}>
+CONFIG_CAN_PEAK_USB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_PLX_PCI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_RAW                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_RCAR                                 policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_RCAR_CANFD                           policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_RX_OFFLOAD                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CAN_SJA1000                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_SJA1000_ISA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_SJA1000_PLATFORM                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_SLCAN                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_SOFTING                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_SOFTING_CS                           policy<{'amd64': 'm'}>
+CONFIG_CAN_SUN4I                                policy<{'riscv64': 'm'}>
+CONFIG_CAN_TI_HECC                              policy<{'armhf': 'm'}>
+CONFIG_CAN_UCAN                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_VCAN                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_VXCAN                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CAN_XILINXCAN                            policy<{'arm64': 'm'}>
+CONFIG_CAPI_TRACE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CARDBUS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': '-'}>
+CONFIG_CARL9170                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CARL9170_DEBUGFS                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CARL9170_HWRNG                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CARL9170_LEDS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CARL9170_WPC                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CARMINE_DRAM_CUSTOM                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CASSINI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CAVIUM_CPT                               policy<{'arm64': 'm'}>
+CONFIG_CAVIUM_ERRATUM_22375                     policy<{'arm64': 'y'}>
+CONFIG_CAVIUM_ERRATUM_23144                     policy<{'arm64': 'y'}>
+CONFIG_CAVIUM_ERRATUM_23154                     policy<{'arm64': 'y'}>
+CONFIG_CAVIUM_ERRATUM_27456                     policy<{'arm64': 'y'}>
+CONFIG_CAVIUM_ERRATUM_30115                     policy<{'arm64': 'y'}>
+CONFIG_CAVIUM_PTP                               policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CAVIUM_TX2_ERRATUM_219                   policy<{'arm64': 'y'}>
+CONFIG_CB710_CORE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CB710_DEBUG                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CB710_DEBUG_ASSUMPTIONS                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CC10001_ADC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CCS811                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CCW                                      policy<{'s390x': 'y'}>
+CONFIG_CCWGROUP                                 policy<{'s390x': 'm'}>
+CONFIG_CCW_CONSOLE                              policy<{'s390x': 'y'}>
+CONFIG_CC_CAN_LINK                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_CAN_LINK_STATIC                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_ASM_INLINE                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_BRANCH_PROT_PAC_RET               policy<{'arm64': 'y'}>
+CONFIG_CC_HAS_BRANCH_PROT_PAC_RET_BTI           policy<{'arm64': 'y'}>
+CONFIG_CC_HAS_ELFV2                             policy<{'ppc64el': 'y'}>
+CONFIG_CC_HAS_ENTRY_PADDING                     policy<{'amd64': 'y'}>
+CONFIG_CC_HAS_IBT                               policy<{'amd64': 'y'}>
+CONFIG_CC_HAS_INT128                            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_KASAN_GENERIC                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_KASAN_SW_TAGS                     policy<{'arm64': 'y'}>
+CONFIG_CC_HAS_NO_PROFILE_FN_ATTR                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_PCREL                             policy<{'ppc64el': 'y'}>
+CONFIG_CC_HAS_PREFIXED                          policy<{'ppc64el': 'y'}>
+CONFIG_CC_HAS_RETURN_THUNK                      policy<{'amd64': 'y'}>
+CONFIG_CC_HAS_SANCOV_TRACE_PC                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_SANE_STACKPROTECTOR               policy<{'amd64': 'y'}>
+CONFIG_CC_HAS_SIGN_RETURN_ADDRESS               policy<{'arm64': 'y'}>
+CONFIG_CC_HAS_SLS                               policy<{'amd64': 'y'}>
+CONFIG_CC_HAS_UBSAN_BOUNDS_STRICT               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_HAVE_SHADOW_CALL_STACK                policy<{'arm64': 'y'}>
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG            policy<{'arm64': 'y'}>
+CONFIG_CC_HAVE_STACKPROTECTOR_TLS               policy<{'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_CC_IMPLICIT_FALLTHROUGH                  policy<{'amd64': '"-Wimplicit-fallthrough=5"', 'arm64': '"-Wimplicit-fallthrough=5"', 'armhf': '"-Wimplicit-fallthrough=5"', 'ppc64el': '"-Wimplicit-fallthrough=5"', 'riscv64': '"-Wimplicit-fallthrough=5"', 's390x': '"-Wimplicit-fallthrough=5"'}>
+CONFIG_CC_IS_GCC                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_NO_ARRAY_BOUNDS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_NO_STRINGOP_OVERFLOW                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CC_OPTIMIZE_FOR_SIZE                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CC_VERSION_TEXT                          policy<{'amd64': '"x86_64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0"', 'arm64': '"aarch64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0"', 'armhf': '"arm-linux-gnueabihf-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0"', 'ppc64el': '"powerpc64le-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0"', 'riscv64': '"riscv64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0"', 's390x': '"s390x-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0"'}>
+CONFIG_CDNS_I3C_MASTER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CDROM                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CDROM_PKTCDVD                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CDX_BUS                                  policy<{'arm64': 'y'}>
+CONFIG_CDX_CONTROLLER                           policy<{'arm64': 'm'}>
+CONFIG_CEC_CH7322                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CEC_CORE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CEC_CROS_EC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CEC_GPIO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'm'}>
+CONFIG_CEC_MESON_AO                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CEC_MESON_G12A_AO                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CEC_NOTIFIER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CEC_PIN                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'y'}>
+CONFIG_CEC_PIN_ERROR_INJ                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'n'}>
+CONFIG_CEC_SAMSUNG_S5P                          policy<{'armhf': 'n'}>
+CONFIG_CEC_SECO                                 policy<{'amd64': 'm'}>
+CONFIG_CEC_SECO_RC                              policy<{'amd64': 'y'}>
+CONFIG_CEC_STM32                                policy<{'arm64': 'm'}>
+CONFIG_CEC_TEGRA                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CEPH_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CEPH_FSCACHE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CEPH_FS_POSIX_ACL                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CEPH_FS_SECURITY_LABEL                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CEPH_LIB                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CEPH_LIB_PRETTYDEBUG                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CEPH_LIB_USE_DNS_RESOLVER                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CERT_STORE                               policy<{'s390x': 'y'}>
+CONFIG_CFAG12864B                               policy<{'amd64': 'm'}>
+CONFIG_CFAG12864B_RATE                          policy<{'amd64': '20'}>
+CONFIG_CFG80211                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CFG80211_CERTIFICATION_ONUS              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CFG80211_CRDA_SUPPORT                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CFG80211_DEBUGFS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CFG80211_DEFAULT_PS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CFG80211_DEVELOPER_WARNINGS              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CFG80211_REQUIRE_SIGNED_REGDB            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CFG80211_WEXT                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CFG80211_WEXT_EXPORT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CFS_BANDWIDTH                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUPS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_BPF                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_CPUACCT                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CGROUP_DEVICE                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_FAVOR_DYNMODS                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CGROUP_FREEZER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_HUGETLB                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_MISC                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_NET_CLASSID                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_NET_PRIO                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_PERF                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_PIDS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_RDMA                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_SCHED                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CGROUP_WRITEBACK                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CHARGER_88PM860X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_ADP5061                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_AXP20X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_BD99954                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_BQ2415X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_BQ24190                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_BQ24257                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_BQ24735                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_BQ2515X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_BQ256XX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_BQ25890                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_BQ25980                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_CPCAP                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CHARGER_CROS_PCHG                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CHARGER_CROS_USBPD                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CHARGER_DA9150                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_DETECTOR_MAX14656                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_GPIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_ISP1704                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_LP8727                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_LP8788                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_LT3651                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_LTC4162L                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_MANAGER                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CHARGER_MAX14577                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_MAX77650                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_MAX77693                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_MAX77976                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_MAX8903                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_MAX8997                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_MAX8998                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_MP2629                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_MT6360                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_MT6370                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_PCF50633                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_PM8916_LBC                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CHARGER_QCOM_SMB2                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CHARGER_QCOM_SMBB                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CHARGER_RK817                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_RT5033                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_RT9455                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_RT9467                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'm'}>
+CONFIG_CHARGER_RT9471                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_SBS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_SC2731                           policy<{'arm64': 'm'}>
+CONFIG_CHARGER_SMB347                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_SURFACE                          policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_CHARGER_TPS65090                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHARGER_TPS65217                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': 'm'}>
+CONFIG_CHARGER_TWL4030                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_UCS1002                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARGER_WILCO                            policy<{'amd64': 'm'}>
+CONFIG_CHARLCD                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHARLCD_BL_FLASH                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CHARLCD_BL_OFF                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CHARLCD_BL_ON                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CHECKPOINT_RESTORE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CHECK_SIGNATURE                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CHELSIO_INLINE_CRYPTO                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CHELSIO_IPSEC_INLINE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHELSIO_LIB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHELSIO_T1                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHELSIO_T1_1G                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CHELSIO_T3                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHELSIO_T4                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHELSIO_T4VF                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CHELSIO_T4_DCB                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CHELSIO_T4_FCOE                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CHELSIO_TLS_DEVICE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CHROMEOS_ACPI                            policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_CHROMEOS_LAPTOP                          policy<{'amd64': 'm'}>
+CONFIG_CHROMEOS_PRIVACY_SCREEN                  policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_CHROMEOS_PSTORE                          policy<{'amd64': 'm'}>
+CONFIG_CHROMEOS_TBMC                            policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_CHROME_PLATFORMS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CHR_DEV_SCH                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CHR_DEV_ST                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CHSC_SCH                                 policy<{'s390x': 'm'}>
+CONFIG_CHTCRC_PMIC_OPREGION                     policy<{'amd64': 'y'}>
+CONFIG_CHT_DC_TI_PMIC_OPREGION                  policy<{'amd64': 'y'}>
+CONFIG_CHT_WC_PMIC_OPREGION                     policy<{'amd64': 'y'}>
+CONFIG_CICADA_PHY                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CIFS                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CIFS_ALLOW_INSECURE_LEGACY               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CIFS_DEBUG                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CIFS_DEBUG2                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CIFS_DEBUG_DUMP_KEYS                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CIFS_DFS_UPCALL                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CIFS_FSCACHE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CIFS_POSIX                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CIFS_SMB_DIRECT                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CIFS_STATS2                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CIFS_SWN_UPCALL                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CIFS_UPCALL                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CIFS_XATTR                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CIO_DAC                                  policy<{'amd64': 'm'}>
+CONFIG_CIO_INJECT                               policy<{'s390x': 'n'}>
+CONFIG_CLANG_VERSION                            policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_CLKBLD_I8253                             policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_CLKEVT_I8253                             policy<{'amd64': 'y'}>
+CONFIG_CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK      policy<{'armhf': 'y'}>
+CONFIG_CLKSRC_EXYNOS_MCT                        policy<{'armhf': 'y'}>
+CONFIG_CLKSRC_IMX_GPT                           policy<{'armhf': 'y'}>
+CONFIG_CLKSRC_IMX_TPM                           policy<{'armhf': 'y'}>
+CONFIG_CLKSRC_MMIO                              policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_CLKSRC_QCOM                              policy<{'armhf': 'y'}>
+CONFIG_CLKSRC_STM32_LP                          policy<{'arm64': 'y'}>
+CONFIG_CLKSRC_TI_32K                            policy<{'armhf': 'y'}>
+CONFIG_CLKSRC_VERSATILE                         policy<{'armhf': 'y'}>
+CONFIG_CLK_ACTIONS                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_ANALOGBITS_WRPLL_CLN28HPC            policy<{'riscv64': 'y'}>
+CONFIG_CLK_EMEV2                                policy<{'armhf': 'y'}>
+CONFIG_CLK_GFM_LPASS_SM8250                     policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_CLK_ICST                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_IMX5                                 policy<{'armhf': 'y'}>
+CONFIG_CLK_IMX6Q                                policy<{'armhf': 'y'}>
+CONFIG_CLK_IMX6SL                               policy<{'armhf': 'y'}>
+CONFIG_CLK_IMX6SLL                              policy<{'armhf': 'y'}>
+CONFIG_CLK_IMX6SX                               policy<{'armhf': 'y'}>
+CONFIG_CLK_IMX6UL                               policy<{'armhf': 'y'}>
+CONFIG_CLK_IMX7D                                policy<{'armhf': 'y'}>
+CONFIG_CLK_IMX7ULP                              policy<{'armhf': 'y'}>
+CONFIG_CLK_IMX8MM                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_IMX8MN                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_IMX8MP                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_IMX8MQ                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_IMX8QXP                              policy<{'arm64': 'y'}>
+CONFIG_CLK_IMX8ULP                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CLK_IMX93                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CLK_INTEL_SOCFPGA                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_INTEL_SOCFPGA32                      policy<{'armhf': 'y'}>
+CONFIG_CLK_INTEL_SOCFPGA64                      policy<{'arm64': 'y'}>
+CONFIG_CLK_LS1028A_PLLDIG                       policy<{'arm64': 'm'}>
+CONFIG_CLK_MA35D1                               policy<{'arm64': 'y'}>
+CONFIG_CLK_OWL_S500                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_OWL_S700                             policy<{'arm64': 'y'}>
+CONFIG_CLK_OWL_S900                             policy<{'arm64': 'y'}>
+CONFIG_CLK_PX30                                 policy<{'arm64': 'y'}>
+CONFIG_CLK_QORIQ                                policy<{'arm64': 'y'}>
+CONFIG_CLK_R7S9210                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7740                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7742                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7743                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7745                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A77470                             policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A774A1                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A774B1                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A774C0                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A774E1                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A7778                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7779                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7790                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7791                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7792                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7794                              policy<{'armhf': 'y'}>
+CONFIG_CLK_R8A7795                              policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A77960                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A77961                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A77965                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A77970                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A77980                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A77990                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A77995                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A779A0                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A779F0                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R8A779G0                             policy<{'arm64': 'y'}>
+CONFIG_CLK_R9A06G032                            policy<{'armhf': 'y'}>
+CONFIG_CLK_R9A07G043                            policy<{'arm64': 'y', 'riscv64': '-'}>
+CONFIG_CLK_R9A07G044                            policy<{'arm64': 'y'}>
+CONFIG_CLK_R9A07G054                            policy<{'arm64': 'y'}>
+CONFIG_CLK_R9A08G045                            policy<{'arm64': 'y'}>
+CONFIG_CLK_R9A09G011                            policy<{'arm64': 'y'}>
+CONFIG_CLK_RCAR_CPG_LIB                         policy<{'arm64': 'y'}>
+CONFIG_CLK_RCAR_GEN2_CPG                        policy<{'armhf': 'y'}>
+CONFIG_CLK_RCAR_GEN3_CPG                        policy<{'arm64': 'y'}>
+CONFIG_CLK_RCAR_GEN4_CPG                        policy<{'arm64': 'y'}>
+CONFIG_CLK_RCAR_USB2_CLOCK_SEL                  policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_CLK_RENESAS                              policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_CLK_RENESAS_CPG_MSSR                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_RENESAS_CPG_MSTP                     policy<{'armhf': 'y'}>
+CONFIG_CLK_RENESAS_DIV6                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_RK3036                               policy<{'armhf': 'y'}>
+CONFIG_CLK_RK312X                               policy<{'armhf': 'y'}>
+CONFIG_CLK_RK3188                               policy<{'armhf': 'y'}>
+CONFIG_CLK_RK322X                               policy<{'armhf': 'y'}>
+CONFIG_CLK_RK3288                               policy<{'armhf': 'y'}>
+CONFIG_CLK_RK3308                               policy<{'arm64': 'y'}>
+CONFIG_CLK_RK3328                               policy<{'arm64': 'y'}>
+CONFIG_CLK_RK3368                               policy<{'arm64': 'y'}>
+CONFIG_CLK_RK3399                               policy<{'arm64': 'y'}>
+CONFIG_CLK_RK3568                               policy<{'arm64': 'y', 'armhf': '-'}>
+CONFIG_CLK_RK3588                               policy<{'arm64': 'y'}>
+CONFIG_CLK_RV110X                               policy<{'armhf': 'y'}>
+CONFIG_CLK_RV1126                               policy<{'armhf': 'y'}>
+CONFIG_CLK_RZA1                                 policy<{'armhf': 'y'}>
+CONFIG_CLK_RZG2L                                policy<{'arm64': 'y', 'riscv64': '-'}>
+CONFIG_CLK_SH73A0                               policy<{'armhf': 'y'}>
+CONFIG_CLK_SIFIVE                               policy<{'riscv64': 'y'}>
+CONFIG_CLK_SIFIVE_PRCI                          policy<{'riscv64': 'y'}>
+CONFIG_CLK_SP810                                policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': '-'}>
+CONFIG_CLK_STARFIVE_JH7100                      policy<{'riscv64': 'n'}>
+CONFIG_CLK_STARFIVE_JH7110_AON                  policy<{'riscv64': 'm'}>
+CONFIG_CLK_STARFIVE_JH7110_ISP                  policy<{'riscv64': 'm'}>
+CONFIG_CLK_STARFIVE_JH7110_PLL                  policy<{'riscv64': 'y'}>
+CONFIG_CLK_STARFIVE_JH7110_STG                  policy<{'riscv64': 'm'}>
+CONFIG_CLK_STARFIVE_JH7110_SYS                  policy<{'riscv64': 'y'}>
+CONFIG_CLK_STARFIVE_JH7110_VOUT                 policy<{'riscv64': 'm'}>
+CONFIG_CLK_STARFIVE_JH71X0                      policy<{'riscv64': 'y'}>
+CONFIG_CLK_TEGRA_BPMP                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_TWL                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CLK_TWL6040                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CLK_VEXPRESS_OSC                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CLK_VF610                                policy<{'armhf': 'y'}>
+CONFIG_CLK_X1E80100_GCC                         policy<{'arm64': 'm'}>
+CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE          policy<{'amd64': 'y'}>
+CONFIG_CLOCKSOURCE_WATCHDOG                     policy<{'amd64': 'y'}>
+CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US         policy<{'amd64': '100'}>
+CONFIG_CLONE_BACKWARDS                          policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CLONE_BACKWARDS2                         policy<{'s390x': 'y'}>
+CONFIG_CLOSURES                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CLS_U32_MARK                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CLS_U32_PERF                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CLZ_TAB                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CM32181                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CM3232                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CM3323                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CM3605                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CM36651                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CMA_ALIGNMENT                            policy<{'arm64': '8', 'armhf': '8', 'riscv64': '8'}>
+CONFIG_CMA_AREAS                                policy<{'arm64': '7', 'armhf': '7', 'ppc64el': '7', 'riscv64': '7', 's390x': '7'}>
+CONFIG_CMA_DEBUG                                policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CMA_DEBUGFS                              policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CMA_SIZE_SEL_MAX                         policy<{'arm64': 'n', 'armhf': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CMA_SIZE_SEL_MBYTES                      policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_CMA_SIZE_SEL_MIN                         policy<{'arm64': 'n', 'armhf': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CMA_SIZE_SEL_PERCENTAGE                  policy<{'arm64': 'n', 'armhf': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CMA_SYSFS                                policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CMDLINE                                  policy<{'arm64': '"console=ttyAMA0"', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""'}>
+CONFIG_CMDLINE_BOOL                             policy<{'amd64': 'n'}>
+CONFIG_CMDLINE_FORCE                            policy<{'arm64': 'n', 'armhf': '-'}>
+CONFIG_CMDLINE_FROM_BOOTLOADER                  policy<{'arm64': 'y', 'armhf': '-'}>
+CONFIG_CMDLINE_PARTITION                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_CMM                                      policy<{'ppc64el': 'm', 's390x': 'y'}>
+CONFIG_CMM_IUCV                                 policy<{'s390x': 'y'}>
+CONFIG_CMODEL_MEDANY                            policy<{'riscv64': 'y'}>
+CONFIG_CMODEL_MEDLOW                            policy<{'riscv64': 'n'}>
+CONFIG_CNIC                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_CODA_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CODE_PATCHING_SELFTEST                   policy<{'ppc64el': 'n'}>
+CONFIG_COMEDI                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_COMEDI_8254                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_8255                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_8255_PCI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_8255_SA                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_1032                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_1500                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_1516                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_1564                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_16XX                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_2032                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_2200                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_3120                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_3501                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_APCI_3XXX                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADDI_WATCHDOG                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADL_PCI6208                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADL_PCI7X3X                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADL_PCI8164                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADL_PCI9111                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADL_PCI9118                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADQ12B                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADV_PCI1710                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADV_PCI1720                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADV_PCI1723                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADV_PCI1724                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADV_PCI1760                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ADV_PCI_DIO                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AIO_AIO12_8                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AIO_IIRO_16                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_DIO200                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_DIO200_ISA                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_DIO200_PCI                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_PC236                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_PC236_ISA                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_PC236_PCI                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_PC263_ISA                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_PC263_PCI                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_PCI224                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_AMPLC_PCI230                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_BOND                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_C6XDIGIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_CB_DAS16_CS                       policy<{'amd64': 'm'}>
+CONFIG_COMEDI_CB_PCIDAS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_CB_PCIDAS64                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_CB_PCIDDA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_CB_PCIMDAS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_CB_PCIMDDA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_CONTEC_PCI_DIO                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAC02                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAQBOARD2000                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAS08                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAS08_CS                          policy<{'amd64': 'm'}>
+CONFIG_COMEDI_DAS08_ISA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAS08_PCI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAS16                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAS16M1                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAS1800                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAS6402                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DAS800                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_COMEDI_DEFAULT_BUF_MAXSIZE_KB            policy<{'amd64': '20480', 'arm64': '20480', 'armhf': '20480', 'ppc64el': '20480', 'riscv64': '20480'}>
+CONFIG_COMEDI_DEFAULT_BUF_SIZE_KB               policy<{'amd64': '2048', 'arm64': '2048', 'armhf': '2048', 'ppc64el': '2048', 'riscv64': '2048'}>
+CONFIG_COMEDI_DMM32AT                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DT2801                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DT2811                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DT2814                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DT2815                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DT2817                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DT282X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DT3000                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DT9812                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_DYNA_PCI10XX                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_FL512                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_GSC_HPDI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ICP_MULTI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_II_PCI20KC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ISADMA                            policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_COMEDI_ISA_DRIVERS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_COMEDI_JR3_PCI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_KCOMEDILIB                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_KE_COUNTER                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ME4000                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_ME_DAQ                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_MF6X4                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_MISC_DRIVERS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_COMEDI_MITE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_MPC624                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_MULTIQ3                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_6527                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_65XX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_660X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_670X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_ATMIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_ATMIO16D                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_AT_A2150                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_AT_AO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_DAQ_700_CS                     policy<{'amd64': 'm'}>
+CONFIG_COMEDI_NI_DAQ_DIO24_CS                   policy<{'amd64': 'm'}>
+CONFIG_COMEDI_NI_LABPC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_LABPC_CS                       policy<{'amd64': 'm'}>
+CONFIG_COMEDI_NI_LABPC_ISA                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_LABPC_ISADMA                   policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_COMEDI_NI_LABPC_PCI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_MIO_CS                         policy<{'amd64': 'm'}>
+CONFIG_COMEDI_NI_PCIDIO                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_PCIMIO                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_ROUTING                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_TIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_TIOCMD                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_NI_USB6501                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PARPORT                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCI_DRIVERS                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCL711                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCL724                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCL726                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCL730                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCL812                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCL816                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCL818                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCM3724                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCMAD                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCMCIA_DRIVERS                    policy<{'amd64': 'm'}>
+CONFIG_COMEDI_PCMDA12                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCMMIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_PCMUIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_QUATECH_DAQP_CS                   policy<{'amd64': 'm'}>
+CONFIG_COMEDI_RTD520                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_RTI800                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_RTI802                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_S526                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_S626                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_TEST                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_TESTS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_TESTS_EXAMPLE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_TESTS_NI_ROUTES                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_USBDUX                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_USBDUXFAST                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_USBDUXSIGMA                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_USB_DRIVERS                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMEDI_VMK80XX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMAND_LINE_SIZE                        policy<{'s390x': '4096'}>
+CONFIG_COMMON_CLK                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_COMMON_CLK_A1_PERIPHERALS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_A1_PLL                        policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_APPLE_NCO                     policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_ASPEED                        policy<{'armhf': 'y'}>
+CONFIG_COMMON_CLK_AXG                           policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_AXG_AUDIO                     policy<{'arm64': 'm', 'armhf': 'n'}>
+CONFIG_COMMON_CLK_AXI_CLKGEN                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_BD718XX                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_BM1880                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_CDCE706                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_COMMON_CLK_CDCE925                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_CS2000_CP                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_COMMON_CLK_EN7523                        policy<{'armhf': 'y'}>
+CONFIG_COMMON_CLK_FIXED_MMIO                    policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_COMMON_CLK_FSL_FLEXSPI                   policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_FSL_SAI                       policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_G12A                          policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_GXBB                          policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_HI3516CV300                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_HI3519                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_HI3559A                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_HI3660                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_HI3670                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_HI3798CV200                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_HI6220                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_HI655X                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_LOCHNAGAR                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_MAX77686                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_MAX9485                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_COMMON_CLK_MEDIATEK                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MEDIATEK_FHCTL                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MESON8B                       policy<{'armhf': 'y'}>
+CONFIG_COMMON_CLK_MESON_AO_CLKC                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MESON_CLKC_UTILS              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MESON_CPU_DYNDIV              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MESON_DUALDIV                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MESON_EE_CLKC                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MESON_MPLL                    policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MESON_PHASE                   policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MESON_PLL                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MESON_REGMAP                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MESON_SCLK_DIV                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MESON_VID_PLL_DIV             policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT2701                        policy<{'armhf': 'n'}>
+CONFIG_COMMON_CLK_MT2712                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT2712_BDPSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT2712_IMGSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT2712_JPGDECSYS              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT2712_MFGCFG                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT2712_MMSYS                  policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT2712_VDECSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT2712_VENCSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_AUDIOSYS               policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_CAMSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_GCESYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_IMGSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_MFGSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_MIPI0ASYS              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_MIPI0BSYS              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_MIPI1ASYS              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_MIPI1BSYS              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_MIPI2ASYS              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_MIPI2BSYS              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_MMSYS                  policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6765_VCODECSYS              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6779                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6779_AUDSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6779_CAMSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6779_IMGSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6779_IPESYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6779_MFGCFG                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6779_MMSYS                  policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6779_VDECSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6779_VENCSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6795                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT6795_MFGCFG                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT6795_MMSYS                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT6795_VDECSYS                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT6795_VENCSYS                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT6797                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6797_IMGSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6797_MMSYS                  policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6797_VDECSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT6797_VENCSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT7622                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7622_AUDSYS                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7622_ETHSYS                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7622_HIFSYS                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7629                        policy<{'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7629_ETHSYS                 policy<{'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7629_HIFSYS                 policy<{'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7981                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7981_ETHSYS                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT7986                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7986_ETHSYS                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT7988                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT8135                        policy<{'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT8167                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8167_AUDSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8167_IMGSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8167_MFGCFG                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8167_MMSYS                  policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8167_VDECSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8173                        policy<{'arm64': 'y', 'armhf': '-'}>
+CONFIG_COMMON_CLK_MT8173_IMGSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8173_MMSYS                  policy<{'arm64': 'y', 'armhf': '-'}>
+CONFIG_COMMON_CLK_MT8173_VDECSYS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8173_VENCSYS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8183                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_AUDIOSYS               policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_CAMSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_IMGSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_IPU_ADL                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_IPU_CONN               policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_IPU_CORE0              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_IPU_CORE1              policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_MFGCFG                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_MMSYS                  policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_VDECSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8183_VENCSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8186                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8186_CAMSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_IMGSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_IMP_IIC_WRAP           policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_IPESYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_MCUSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_MDPSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_MFGCFG                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_MMSYS                  policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_VDECSYS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_VENCSYS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8186_WPESYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188                        policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_ADSP_AUDIO26M          policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_CAMSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_IMGSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_IMP_IIC_WRAP           policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_IPESYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_MFGCFG                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_VDECSYS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_VDOSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_VENCSYS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_VPPSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8188_WPESYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8192                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_AUDSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_CAMSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_IMGSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_IMP_IIC_WRAP           policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_IPESYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_MDPSYS                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_MFGCFG                 policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_MMSYS                  policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_MSDC                   policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_SCP_ADSP               policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_VDECSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8192_VENCSYS                policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8195                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_MT8195_APUSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_CAMSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_IMGSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_IMP_IIC_WRAP           policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_IPESYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_MFGCFG                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_SCP_ADSP               policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_VDECSYS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_VDOSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_VENCSYS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_VPPSYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8195_WPESYS                 policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_MT8365                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT8365_APU                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT8365_CAM                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT8365_MFG                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT8365_MMSYS                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT8365_VDEC                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT8365_VENC                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_MT8516                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_MT8516_AUDSYS                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_NUVOTON                       policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_PALMAS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_COMMON_CLK_PWM                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_COMMON_CLK_QCOM                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_RK808                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_ROCKCHIP                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_COMMON_CLK_RS9_PCIE                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_S2MPS11                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_S4_PERIPHERALS                policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_S4_PLL                        policy<{'arm64': 'm'}>
+CONFIG_COMMON_CLK_SAMSUNG                       policy<{'armhf': 'y'}>
+CONFIG_COMMON_CLK_SCMI                          policy<{'arm64': 'y', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_SCPI                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_CLK_SI514                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_SI521XX                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_SI5341                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_COMMON_CLK_SI5351                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_COMMON_CLK_SI544                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_COMMON_CLK_SI570                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_SP7021                        policy<{'armhf': 'm'}>
+CONFIG_COMMON_CLK_STM32MP                       policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_TI_ADPLL                      policy<{'armhf': 'y'}>
+CONFIG_COMMON_CLK_TPS68470                      policy<{'amd64': 'm'}>
+CONFIG_COMMON_CLK_VC3                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_VC5                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_VC7                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_COMMON_CLK_VISCONTI                      policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_WM831X                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_COMMON_CLK_XGENE                         policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_XLNX_CLKWZRD                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'n'}>
+CONFIG_COMMON_CLK_ZYNQMP                        policy<{'arm64': 'y'}>
+CONFIG_COMMON_RESET_HI3660                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMMON_RESET_HI6220                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_COMPACTION                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT              policy<{'amd64': '1', 'arm64': '1', 'armhf': '1', 'ppc64el': '1', 'riscv64': '1', 's390x': '1'}>
+CONFIG_COMPAL_LAPTOP                            policy<{'amd64': 'm'}>
+CONFIG_COMPAT                                   policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_COMPAT_32                                policy<{'amd64': 'y'}>
+CONFIG_COMPAT_32BIT_TIME                        policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': 'n', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_COMPAT_ALIGNMENT_FIXUPS                  policy<{'arm64': 'n', 'arm64-generic-64k': '-'}>
+CONFIG_COMPAT_BINFMT_ELF                        policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'ppc64el': '-', 's390x': '-'}>
+CONFIG_COMPAT_FOR_U64_ALIGNMENT                 policy<{'amd64': 'y'}>
+CONFIG_COMPAT_NETLINK_MESSAGES                  policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'ppc64el': '-'}>
+CONFIG_COMPAT_OLD_SIGACTION                     policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'ppc64el': '-', 's390x': '-'}>
+CONFIG_COMPAT_VDSO                              policy<{'amd64': 'n'}>
+CONFIG_COMPILE_TEST                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CONFIGFS_FS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CONNECTOR                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT                 policy<{'amd64': '7', 'arm64': '7', 'armhf': '7', 'ppc64el': '7', 'riscv64': '7', 's390x': '7'}>
+CONFIG_CONSOLE_POLL                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CONSOLE_TRANSLATIONS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CONTEXT_SWITCH_TRACER                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CONTEXT_TRACKING                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CONTEXT_TRACKING_IDLE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CONTEXT_TRACKING_USER                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CONTEXT_TRACKING_USER_FORCE              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CONTIG_ALLOC                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CORDIC                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_COREDUMP                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CORESIGHT                                policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CORTINA_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_COUNTER                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CPA_DEBUG                                policy<{'amd64': 'n'}>
+CONFIG_CPCAP_ADC                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CPU5_WDT                                 policy<{'amd64': 'm'}>
+CONFIG_CPUFREQ_DT_PLATDEV                       policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPUMASK_OFFSTACK                         policy<{'amd64': 'y'}>
+CONFIG_CPUSETS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CPU_32v6K                                policy<{'armhf': 'y'}>
+CONFIG_CPU_32v7                                 policy<{'armhf': 'y'}>
+CONFIG_CPU_ABRT_EV7                             policy<{'armhf': 'y'}>
+CONFIG_CPU_BIG_ENDIAN                           policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'y'}>
+CONFIG_CPU_BPREDICT_DISABLE                     policy<{'armhf': 'n'}>
+CONFIG_CPU_CACHE_V7                             policy<{'armhf': 'y'}>
+CONFIG_CPU_CACHE_VIPT                           policy<{'armhf': 'y'}>
+CONFIG_CPU_COPY_V6                              policy<{'armhf': 'y'}>
+CONFIG_CPU_CP15                                 policy<{'armhf': 'y'}>
+CONFIG_CPU_CP15_MMU                             policy<{'armhf': 'y'}>
+CONFIG_CPU_FREQ                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE        policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND            policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'n'}>
+CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL           policy<{'amd64': 'y', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CPU_FREQ_GOV_ATTR_SET                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_GOV_COMMON                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_FREQ_THERMAL                         policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_HAS_ASID                             policy<{'armhf': 'y'}>
+CONFIG_CPU_HOTPLUG_STATE_CONTROL                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CPU_IBPB_ENTRY                           policy<{'amd64': 'y'}>
+CONFIG_CPU_IBRS_ENTRY                           policy<{'amd64': 'y'}>
+CONFIG_CPU_ICACHE_DISABLE                       policy<{'armhf': 'n'}>
+CONFIG_CPU_ICACHE_MISMATCH_WORKAROUND           policy<{'armhf': 'y'}>
+CONFIG_CPU_IDLE                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_IDLE_GOV_HALTPOLL                    policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_CPU_IDLE_GOV_LADDER                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_IDLE_GOV_MENU                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_IDLE_GOV_TEO                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS                policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_IDLE_THERMAL                         policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_ISOLATION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CPU_LITTLE_ENDIAN                        policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_CPU_MITIGATIONS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CPU_PABRT_V7                             policy<{'armhf': 'y'}>
+CONFIG_CPU_PJ4                                  policy<{'armhf': 'y'}>
+CONFIG_CPU_PJ4B                                 policy<{'armhf': 'y'}>
+CONFIG_CPU_PM                                   policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_RMAP                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CPU_SPECTRE                              policy<{'armhf': 'y'}>
+CONFIG_CPU_SRSO                                 policy<{'amd64': 'y'}>
+CONFIG_CPU_SUP_AMD                              policy<{'amd64': 'y'}>
+CONFIG_CPU_SUP_CENTAUR                          policy<{'amd64': 'y'}>
+CONFIG_CPU_SUP_HYGON                            policy<{'amd64': 'y'}>
+CONFIG_CPU_SUP_INTEL                            policy<{'amd64': 'y'}>
+CONFIG_CPU_SUP_ZHAOXIN                          policy<{'amd64': 'y'}>
+CONFIG_CPU_THERMAL                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CPU_THUMB_CAPABLE                        policy<{'armhf': 'y'}>
+CONFIG_CPU_TLB_V7                               policy<{'armhf': 'y'}>
+CONFIG_CPU_UNRET_ENTRY                          policy<{'amd64': 'y'}>
+CONFIG_CPU_V7                                   policy<{'armhf': 'y'}>
+CONFIG_CRAMFS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CRAMFS_BLOCKDEV                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CRAMFS_MTD                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CRASH_CORE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRASH_HOTPLUG                            policy<{'amd64': 'y'}>
+CONFIG_CRASH_MAX_MEMORY_RANGES                  policy<{'amd64': '8192'}>
+CONFIG_CRC16                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRC32                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRC32_BIT                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CRC32_SARWATE                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CRC32_SELFTEST                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CRC32_SLICEBY4                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CRC32_SLICEBY8                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRC4                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRC64                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRC64_ROCKSOFT                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRC7                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_CRC8                                     policy<{'amd64': 'm', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRC_CCITT                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRC_ITU_T                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_CRC_T10DIF                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CROSS_MEMORY_ATTACH                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CROS_EC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_CHARDEV                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_DEBUGFS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_ISHTP                            policy<{'amd64': 'm'}>
+CONFIG_CROS_EC_LIGHTBAR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_LPC                              policy<{'amd64': 'm'}>
+CONFIG_CROS_EC_MKBP_PROXIMITY                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_PROTO                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CROS_EC_RPMSG                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_SENSORHUB                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_SYSFS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_TYPEC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_EC_UART                             policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_CROS_EC_VBC                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_HPS_I2C                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_KBD_LED_BACKLIGHT                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_TYPEC_SWITCH                        policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_CROS_USBPD_LOGGER                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CROS_USBPD_NOTIFY                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_842                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ACOMP2                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_ADIANTUM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_AEAD                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_AEAD2                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_AEGIS128                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_AEGIS128_AESNI_SSE2               policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_AEGIS128_SIMD                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_AES                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_AES_ARM                           policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_AES_ARM64                         policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_AES_ARM64_BS                      policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_AES_ARM64_CE                      policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_AES_ARM64_CE_BLK                  policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_AES_ARM64_CE_CCM                  policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK                policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_AES_ARM_BS                        policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_AES_ARM_CE                        policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_AES_NI_INTEL                      policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_AES_S390                          policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_AES_TI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_AKCIPHER                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_AKCIPHER2                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_ALGAPI                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_ALGAPI2                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_ANSI_CPRNG                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S             policy<{'amd64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ARCH_HAVE_LIB_CURVE25519          policy<{'amd64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_ARCH_HAVE_LIB_POLY1305            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_ARIA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CRYPTO_ARIA_AESNI_AVX2_X86_64            policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_ARIA_AESNI_AVX_X86_64             policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_ARIA_GFNI_AVX512_X86_64           policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_AUTHENC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_BLAKE2B                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_BLAKE2B_NEON                      policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_BLAKE2S_ARM                       policy<{'armhf': 'y'}>
+CONFIG_CRYPTO_BLAKE2S_X86                       policy<{'amd64': 'y'}>
+CONFIG_CRYPTO_BLOWFISH                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_BLOWFISH_COMMON                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_BLOWFISH_X86_64                   policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_CAMELLIA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64        policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64         policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_CAMELLIA_X86_64                   policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_CAST5                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CAST5_AVX_X86_64                  policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_CAST6                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CAST6_AVX_X86_64                  policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_CAST_COMMON                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CBC                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_CCM                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CHACHA20                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CHACHA20POLY1305                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CHACHA20_NEON                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_CHACHA20_P10                      policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_CHACHA20_X86_64                   policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_CHACHA_S390                       policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_CMAC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CRC32                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CRC32C                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_CRC32C_INTEL                      policy<{'amd64': 'y'}>
+CONFIG_CRYPTO_CRC32C_VPMSUM                     policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_CRC32_ARM_CE                      policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_CRC32_PCLMUL                      policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_CRC32_S390                        policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_CRC64_ROCKSOFT                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_CRCT10DIF                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE                policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_CRCT10DIF_ARM_CE                  policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_CRCT10DIF_PCLMUL                  policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_CRCT10DIF_VPMSUM                  policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_CRYPTD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CTR                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_CTS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_CURVE25519                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_CURVE25519_NEON                   policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_CURVE25519_X86                    policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_DEFLATE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_DES                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_DES3_EDE_X86_64                   policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_DES_S390                          policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_DEV_ALLWINNER                     policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_CRYPTO_DEV_AMLOGIC_GXL                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_DEV_AMLOGIC_GXL_DEBUG             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CRYPTO_DEV_ARTPEC6                       policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_ASPEED                        policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_ASPEED_ACRY                   policy<{'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_ASPEED_DEBUG                  policy<{'armhf': 'n'}>
+CONFIG_CRYPTO_DEV_ASPEED_HACE_CRYPTO            policy<{'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_ASPEED_HACE_HASH              policy<{'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_ATMEL_ECC                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CRYPTO_DEV_ATMEL_I2C                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_ATMEL_SHA204A                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CRYPTO_DEV_CAVIUM_ZIP                    policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_CCP                           policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_CRYPTO_DEV_CCP_CRYPTO                    policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_CCP_DD                        policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_CCP_DEBUGFS                   policy<{'amd64': 'n', 'arm64': 'n'}>
+CONFIG_CRYPTO_DEV_CCREE                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_CHELSIO                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_CPT                           policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_EXYNOS_RNG                    policy<{'armhf': 'n'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API_DESC       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_COMMON               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_QI        policy<{'arm64': 'y'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_DEBUG                policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_INTC                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_INTC_COUNT_THLD      policy<{'arm64': '255', 'armhf': '255'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_INTC_TIME_THLD       policy<{'arm64': '2048', 'armhf': '2048'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_JR                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_PKC_API              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_PRNG_API             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_RINGSIZE             policy<{'arm64': '9', 'armhf': '9'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_API              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_TEST             policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM                policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_HISI_HPRE                     policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_HISI_QM                       policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_HISI_SEC                      policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_HISI_SEC2                     policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_HISI_TRNG                     policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_HISI_ZIP                      policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_IAA_CRYPTO                    policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_DEV_IAA_CRYPTO_STATS              policy<{'amd64': 'n'}>
+CONFIG_CRYPTO_DEV_JH7110                        policy<{'arm64': '-', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_AES_SM4           policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_AES_SM4_CTS       policy<{'arm64': 'y'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_AES_SM4_ECB       policy<{'arm64': 'y'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_ECC               policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_HCU               policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_HCU_HMAC_SHA224   policy<{'arm64': 'y'}>
+CONFIG_CRYPTO_DEV_MARVELL                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_MARVELL_CESA                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_MXS_DCP                       policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_CRYPTO_DEV_NITROX                        policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_NITROX_CNN55XX                policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CRYPTO_DEV_NX                            policy<{'ppc64el': 'y'}>
+CONFIG_CRYPTO_DEV_NX_COMPRESS                   policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_DEV_NX_COMPRESS_POWERNV           policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_DEV_NX_COMPRESS_PSERIES           policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_DEV_OCTEONTX2_CPT                 policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_OCTEONTX_CPT                  policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_OMAP                          policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_OMAP_AES                      policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_OMAP_DES                      policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_OMAP_SHAM                     policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_PADLOCK                       policy<{'amd64': 'y'}>
+CONFIG_CRYPTO_DEV_PADLOCK_AES                   policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_DEV_PADLOCK_SHA                   policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT_420XX                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT_4XXX                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT_C3XXX                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT_C3XXXVF                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT_C62X                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT_C62XVF                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT_DH895xCC                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT_DH895xCCVF                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CRYPTO_DEV_QCE                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_QCE_AEAD                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_QCE_ENABLE_AEAD               policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_QCE_ENABLE_SHA                policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_CRYPTO_DEV_QCE_ENABLE_SKCIPHER           policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_CRYPTO_DEV_QCE_SHA                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_QCE_SKCIPHER                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN                policy<{'arm64': '512', 'armhf': '512'}>
+CONFIG_CRYPTO_DEV_QCOM_RNG                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_ROCKCHIP                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_ROCKCHIP_DEBUG                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_CRYPTO_DEV_S5P                           policy<{'armhf': 'n'}>
+CONFIG_CRYPTO_DEV_SA2UL                         policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_SAFEXCEL                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CRYPTO_DEV_SAHARA                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_DEV_SP_CCP                        policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_CRYPTO_DEV_SP_PSP                        policy<{'amd64': 'y'}>
+CONFIG_CRYPTO_DEV_STM32_CRC                     policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_STM32_CRYP                    policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_STM32_HASH                    policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_SUN4I_SS                      policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_SUN4I_SS_DEBUG                policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_CRYPTO_DEV_SUN4I_SS_PRNG                 policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE                      policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE_DEBUG                policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE_HASH                 policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG                 policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE_TRNG                 policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_CRYPTO_DEV_SUN8I_SS                      policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_CRYPTO_DEV_SUN8I_SS_DEBUG                policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_CRYPTO_DEV_SUN8I_SS_HASH                 policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG                 policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_CRYPTO_DEV_VIRTIO                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_DEV_VMX                           policy<{'ppc64el': 'y'}>
+CONFIG_CRYPTO_DEV_VMX_ENCRYPT                   policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_DEV_ZYNQMP_AES                    policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DEV_ZYNQMP_SHA3                   policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_DH                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_DH_RFC7919_GROUPS                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_DRBG                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_DRBG_CTR                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_DRBG_HASH                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_DRBG_HMAC                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_DRBG_MENU                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_ECB                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_ECC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ECDH                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ECDSA                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ECHAINIV                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ECRDSA                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ENGINE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ESSIV                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_FCRYPT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_GCM                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_GENIV                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_GHASH                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_GHASH_ARM64_CE                    policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_GHASH_ARM_CE                      policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL              policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_GHASH_S390                        policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_HASH                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_HASH2                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_HASH_INFO                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_HCTR2                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CRYPTO_HMAC                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_HW                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_JITTERENTROPY                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS       policy<{'amd64': '64', 'arm64': '64', 'armhf': '64', 'ppc64el': '64', 'riscv64': '64', 's390x': '64'}>
+CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE    policy<{'amd64': '32', 'arm64': '32', 'armhf': '32', 'ppc64el': '32', 'riscv64': '32', 's390x': '32'}>
+CONFIG_CRYPTO_JITTERENTROPY_OSR                 policy<{'amd64': '1', 'arm64': '1', 'armhf': '1', 'ppc64el': '1', 'riscv64': '1', 's390x': '1'}>
+CONFIG_CRYPTO_KDF800108_CTR                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_KEYWRAP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_KPP                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_KPP2                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_LIB_AES                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_LIB_ARC4                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC               policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_LIB_CHACHA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LIB_CHACHA20POLY1305              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LIB_CHACHA_GENERIC                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LIB_CURVE25519                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LIB_CURVE25519_GENERIC            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LIB_DES                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LIB_GF128MUL                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_LIB_POLY1305                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LIB_POLY1305_GENERIC              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE                policy<{'amd64': '11', 'arm64': '9', 'armhf': '9', 'ppc64el': '1', 'riscv64': '1', 's390x': '1'}>
+CONFIG_CRYPTO_LIB_SHA1                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_LIB_SHA256                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_LIB_UTILS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_LRW                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LZ4                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LZ4HC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_LZO                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_MANAGER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_MANAGER2                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_MANAGER_DISABLE_TESTS             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_MD4                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_MD5                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_MD5_PPC                           policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_MICHAEL_MIC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_NHPOLY1305                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_NHPOLY1305_AVX2                   policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_NHPOLY1305_NEON                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_NHPOLY1305_SSE2                   policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_NULL                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_NULL2                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_PAES_S390                         policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_PCBC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_PCRYPT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_POLY1305                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_POLY1305_ARM                      policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_POLY1305_NEON                     policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_POLY1305_P10                      policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_POLY1305_X86_64                   policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_POLYVAL                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_POLYVAL_ARM64_CE                  policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_POLYVAL_CLMUL_NI                  policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_RMD160                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_RNG                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_RNG2                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_RNG_DEFAULT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_RSA                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SEQIV                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SERPENT                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_SERPENT_AVX2_X86_64               policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_SERPENT_AVX_X86_64                policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_SERPENT_SSE2_X86_64               policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_SHA1                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SHA1_ARM                          policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_SHA1_ARM64_CE                     policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SHA1_ARM_CE                       policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_SHA1_ARM_NEON                     policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_SHA1_PPC                          policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_SHA1_S390                         policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_SHA1_SSSE3                        policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_SHA256                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SHA256_ARM                        policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_SHA256_ARM64                      policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SHA256_S390                       policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_SHA256_SSSE3                      policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_SHA2_ARM64_CE                     policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SHA2_ARM_CE                       policy<{'armhf': 'm'}>
+CONFIG_CRYPTO_SHA3                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SHA3_256_S390                     policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_SHA3_512_S390                     policy<{'s390x': 'm'}>
+CONFIG_CRYPTO_SHA3_ARM64                        policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SIG                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SIG2                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SIMD                              policy<{'amd64': 'm', 'armhf': 'm'}>
+CONFIG_CRYPTO_SKCIPHER                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SKCIPHER2                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_SM2                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_SM3                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_SM3_ARM64_CE                      policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SM3_AVX_X86_64                    policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_SM3_GENERIC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CRYPTO_SM3_NEON                          policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SM4                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64             policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64              policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_SM4_ARM64_CE                      policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SM4_ARM64_CE_BLK                  policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SM4_ARM64_CE_CCM                  policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SM4_ARM64_CE_GCM                  policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SM4_ARM64_NEON_BLK                policy<{'arm64': 'm'}>
+CONFIG_CRYPTO_SM4_GENERIC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CRYPTO_STATS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_STREEBOG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_TEST                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_TWOFISH                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_TWOFISH_AVX_X86_64                policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_TWOFISH_COMMON                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_TWOFISH_X86_64                    policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_TWOFISH_X86_64_3WAY               policy<{'amd64': 'm'}>
+CONFIG_CRYPTO_USER                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_USER_API                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_USER_API_AEAD                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_USER_API_HASH                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_USER_API_RNG                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_USER_API_RNG_CAVP                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CRYPTO_USER_API_SKCIPHER                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_VMAC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_VPMSUM_TESTER                     policy<{'ppc64el': 'm'}>
+CONFIG_CRYPTO_WP512                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_XCBC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_XCTR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CRYPTO_XTS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_CRYPTO_XXHASH                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_ZSTD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CS89x0                                   policy<{'armhf': 'm'}>
+CONFIG_CS89x0_PLATFORM                          policy<{'armhf': 'm'}>
+CONFIG_CSD_LOCK_WAIT_DEBUG                      policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_CTCM                                     policy<{'s390x': 'm'}>
+CONFIG_CURRENT_POINTER_IN_TPIDRURO              policy<{'armhf': 'y'}>
+CONFIG_CUSE                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_CW1200                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CW1200_WLAN_SDIO                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CW1200_WLAN_SPI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CXD2880_SPI_DRV                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CXL                                      policy<{'ppc64el': 'm'}>
+CONFIG_CXLFLASH                                 policy<{'ppc64el': 'm'}>
+CONFIG_CXL_ACPI                                 policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': '-'}>
+CONFIG_CXL_BASE                                 policy<{'ppc64el': 'y'}>
+CONFIG_CXL_BUS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_CXL_MEM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CXL_MEM_RAW_COMMANDS                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_CXL_PCI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CXL_PMEM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CXL_PMU                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CXL_PORT                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_CXL_REGION                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CXL_REGION_INVALIDATION_TEST             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_CXL_SUSPEND                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_CX_ECAT                                  policy<{'amd64': 'm'}>
+CONFIG_CYPRESS_FIRMWARE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DA280                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DA311                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DA9052_WATCHDOG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DA9055_WATCHDOG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DA9062_THERMAL                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DA9062_WATCHDOG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DA9063_WATCHDOG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DA9150_GPADC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DAMON                                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DASD                                     policy<{'s390x': 'm'}>
+CONFIG_DASD_DIAG                                policy<{'s390x': 'm'}>
+CONFIG_DASD_ECKD                                policy<{'s390x': 'm'}>
+CONFIG_DASD_EER                                 policy<{'s390x': 'y'}>
+CONFIG_DASD_FBA                                 policy<{'s390x': 'm'}>
+CONFIG_DASD_PROFILE                             policy<{'s390x': 'y'}>
+CONFIG_DATA_SHIFT                               policy<{'ppc64el': '24'}>
+CONFIG_DAVICOM_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DAX                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DA_MON_EVENTS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DA_MON_EVENTS_ID                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DCA                                      policy<{'amd64': 'm'}>
+CONFIG_DCACHE_WORD_ACCESS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_DCB                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DCDBAS                                   policy<{'amd64': 'm'}>
+CONFIG_DCSSBLK                                  policy<{'s390x': 'm'}>
+CONFIG_DDR                                      policy<{'armhf': 'y'}>
+CONFIG_DE2104X                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DE2104X_DSL                              policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_DEBUGGER                                 policy<{'ppc64el': 'y'}>
+CONFIG_DEBUG_ALIGN_RODATA                       policy<{'armhf': 'y'}>
+CONFIG_DEBUG_ATOMIC_SLEEP                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_BOOT_PARAMS                        policy<{'amd64': 'n'}>
+CONFIG_DEBUG_BUGVERBOSE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_CGROUP_REF                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_CLOSURES                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_DEVRES                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_DRIVER                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_EFI                                policy<{'arm64': 'n'}>
+CONFIG_DEBUG_ENTRY                              policy<{'amd64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B           policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_FORCE_WEAK_PER_CPU                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_FS_ALLOW_ALL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_FS_ALLOW_NONE                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_FS_DISALLOW_MOUNT                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_GPIO                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_HIGHMEM                            policy<{'armhf': 'n'}>
+CONFIG_DEBUG_INFO_BTF_MODULES                   policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_INFO_COMPRESSED_NONE               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_INFO_COMPRESSED_ZLIB               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_INFO_COMPRESSED_ZSTD               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_INFO_DWARF4                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_INFO_DWARF5                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_INFO_NONE                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_INFO_REDUCED                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_IRQFLAGS                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_KERNEL_DC                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DEBUG_KMAP_LOCAL                         policy<{'armhf': 'n'}>
+CONFIG_DEBUG_KMEMLEAK                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_KOBJECT                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_LIST                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_LL                                 policy<{'armhf': 'n'}>
+CONFIG_DEBUG_LL_INCLUDE                         policy<{'armhf': '"mach/debug-macro.S"'}>
+CONFIG_DEBUG_LOCKING_API_SELFTESTS              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_LOCK_ALLOC                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_MAPLE_TREE                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_MEMORY_INIT                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_MISC                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEBUG_MUTEXES                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_NET                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_NMI_SELFTEST                       policy<{'amd64': 'n'}>
+CONFIG_DEBUG_NOTIFIERS                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_OBJECTS                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_PAGEALLOC                          policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_PAGE_REF                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_PERF_USE_VMALLOC                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_PER_CPU_MAPS                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_PINCTRL                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DEBUG_PLIST                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_PREEMPT                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DEBUG_RODATA_TEST                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_RSEQ                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_RT_MUTEXES                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_RWSEMS                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_SECTION_MISMATCH                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_SG                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_SHIRQ                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_SPINLOCK                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_STACKOVERFLOW                      policy<{'ppc64el': 'n'}>
+CONFIG_DEBUG_STACK_USAGE                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_TEST_DRIVER_REMOVE                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_TIMEKEEPING                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_TLBFLUSH                           policy<{'amd64': 'n'}>
+CONFIG_DEBUG_USER                               policy<{'armhf': 'n'}>
+CONFIG_DEBUG_VF_UART_PORT                       policy<{'armhf': '1'}>
+CONFIG_DEBUG_VIRTUAL                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DEBUG_VM                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_VM_PGTABLE                         policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_WQ_FORCE_RR_CPU                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_WW_MUTEX_SLOWPATH                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEBUG_WX                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DECOMPRESS_BZIP2                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DECOMPRESS_GZIP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DECOMPRESS_LZ4                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DECOMPRESS_LZMA                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DECOMPRESS_LZO                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DECOMPRESS_XZ                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DECOMPRESS_ZSTD                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEFAULT_CUBIC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEFAULT_HOSTNAME                         policy<{'amd64': '"(none)"', 'arm64': '"(none)"', 'armhf': '"(none)"', 'ppc64el': '"(none)"', 'riscv64': '"(none)"', 's390x': '"(none)"'}>
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT                policy<{'amd64': '120', 'arm64': '120', 'armhf': '120', 'ppc64el': '120', 'riscv64': '120', 's390x': '120'}>
+CONFIG_DEFAULT_INIT                             policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '""'}>
+CONFIG_DEFAULT_RENO                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEFAULT_SECURITY_APPARMOR                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEFAULT_SECURITY_DAC                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEFAULT_SECURITY_SELINUX                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEFAULT_SECURITY_SMACK                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEFAULT_SECURITY_TOMOYO                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEFAULT_TCP_CONG                         policy<{'amd64': '"cubic"', 'arm64': '"cubic"', 'armhf': '"cubic"', 'ppc64el': '"cubic"', 'riscv64': '"cubic"', 's390x': '"cubic"'}>
+CONFIG_DEFERRED_STRUCT_PAGE_INIT                policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DEFXX                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DELL_LAPTOP                              policy<{'amd64': 'm'}>
+CONFIG_DELL_RBTN                                policy<{'amd64': 'm'}>
+CONFIG_DELL_RBU                                 policy<{'amd64': 'm'}>
+CONFIG_DELL_SMBIOS                              policy<{'amd64': 'm'}>
+CONFIG_DELL_SMBIOS_SMM                          policy<{'amd64': 'y'}>
+CONFIG_DELL_SMBIOS_WMI                          policy<{'amd64': 'y'}>
+CONFIG_DELL_SMO8800                             policy<{'amd64': 'm'}>
+CONFIG_DELL_UART_BACKLIGHT                      policy<{'amd64': 'n'}>
+CONFIG_DELL_WMI                                 policy<{'amd64': 'm'}>
+CONFIG_DELL_WMI_AIO                             policy<{'amd64': 'm'}>
+CONFIG_DELL_WMI_DDV                             policy<{'amd64': 'm'}>
+CONFIG_DELL_WMI_DESCRIPTOR                      policy<{'amd64': 'm'}>
+CONFIG_DELL_WMI_LED                             policy<{'amd64': 'm'}>
+CONFIG_DELL_WMI_PRIVACY                         policy<{'amd64': 'y'}>
+CONFIG_DELL_WMI_SYSMAN                          policy<{'amd64': 'm'}>
+CONFIG_DEPRECATED_PARAM_STRUCT                  policy<{'armhf': 'n'}>
+CONFIG_DETECT_HUNG_TASK                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEVFREQ_EVENT_EXYNOS_NOCP                policy<{'armhf': 'n'}>
+CONFIG_DEVFREQ_EVENT_EXYNOS_PPMU                policy<{'armhf': 'n'}>
+CONFIG_DEVFREQ_EVENT_ROCKCHIP_DFI               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DEVFREQ_GOV_PASSIVE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DEVFREQ_GOV_PERFORMANCE                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DEVFREQ_GOV_POWERSAVE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DEVFREQ_GOV_USERSPACE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DEVFREQ_THERMAL                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DEVICE_MIGRATION                         policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_DEVICE_PRIVATE                           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_DEVMEM                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEVPORT                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_DEVTMPFS_SAFE                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DEV_COREDUMP                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DEV_DAX                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DEV_DAX_CXL                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DEV_DAX_HMEM                             policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_DEV_DAX_HMEM_DEVICES                     policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_DEV_DAX_KMEM                             policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 's390x': 'm'}>
+CONFIG_DEV_DAX_PMEM                             policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm'}>
+CONFIG_DEV_SYNC_PROBE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DHT11                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DIAG288_WATCHDOG                         policy<{'s390x': 'm'}>
+CONFIG_DIMLIB                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DL2K                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DLHL60D                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DLM                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DLM_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DLN2_ADC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DM9000                                   policy<{'armhf': 'm'}>
+CONFIG_DM9000_FORCE_SIMPLE_PHY_POLL             policy<{'armhf': 'n'}>
+CONFIG_DM9051                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DM9102                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DMABUF_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DMABUF_HEAPS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DMABUF_HEAPS_CMA                         policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_DMABUF_HEAPS_SYSTEM                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DMABUF_MOVE_NOTIFY                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_DMABUF_SELFTESTS                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DMABUF_SYSFS_STATS                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DMADEVICES                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_DMADEVICES_DEBUG                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DMAPOOL_TEST                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DMARD06                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DMARD09                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DMARD10                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DMAR_TABLE                               policy<{'amd64': 'y'}>
+CONFIG_DMATEST                                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DMA_ACPI                                 policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_API_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DMA_BOUNCE_UNALIGNED_KMALLOC             policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_COHERENT_POOL                        policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_DECLARE_COHERENT                     policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_DIRECT_REMAP                         policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_ENGINE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_ENGINE_RAID                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DMA_FENCE_TRACE                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DMA_MAP_BENCHMARK                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DMA_NONCOHERENT_MMAP                     policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_NUMA_CMA                             policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_OF                                   policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_OMAP                                 policy<{'armhf': 'y'}>
+CONFIG_DMA_OPS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DMA_OPS_BYPASS                           policy<{'ppc64el': 'y'}>
+CONFIG_DMA_RESTRICTED_POOL                      policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DMA_SHARED_BUFFER                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DMA_SUN6I                                policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_DMA_VIRTUAL_CHANNELS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'y'}>
+CONFIG_DMI                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DMIID                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK        policy<{'amd64': 'y'}>
+CONFIG_DMI_SYSFS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DM_AUDIT                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DM_BIO_PRISON                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_BUFIO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_CACHE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_CACHE_SMQ                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_CLONE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_CRYPT                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_DEBUG                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'y'}>
+CONFIG_DM_DEBUG_BLOCK_MANAGER_LOCKING           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DM_DELAY                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_DUST                                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DM_EBS                                   policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_ERA                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_FLAKEY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_INIT                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DM_INTEGRITY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_LOG_USERSPACE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_LOG_WRITES                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_MIRROR                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_MULTIPATH                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_MULTIPATH_HST                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_MULTIPATH_IOA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_MULTIPATH_QL                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_MULTIPATH_ST                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_PERSISTENT_DATA                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_RAID                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_SNAPSHOT                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_SWITCH                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_THIN_PROVISIONING                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_UEVENT                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DM_UNSTRIPED                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_VERITY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_VERITY_FEC                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DM_WRITECACHE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_ZERO                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DM_ZONED                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DNET                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DNOTIFY                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DNS_RESOLVER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DOVE_CLK                                 policy<{'armhf': 'y'}>
+CONFIG_DOVE_THERMAL                             policy<{'armhf': 'm'}>
+CONFIG_DP83640_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DP83822_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DP83848_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DP83867_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DP83869_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DP83TC811_PHY                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DP83TD510_PHY                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DP83TG720_PHY                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DPAA2_CONSOLE                            policy<{'arm64': 'm'}>
+CONFIG_DPAA_ERRATUM_A050385                     policy<{'arm64': 'y'}>
+CONFIG_DPLL                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DPM_WATCHDOG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DPOT_DAC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DPS310                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DPTF_PCH_FIVR                            policy<{'amd64': 'm'}>
+CONFIG_DPTF_POWER                               policy<{'amd64': 'm'}>
+CONFIG_DQL                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DRAGONRISE_FF                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRBD_FAULT_INJECTION                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DRM_ACCEL                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_DRM_ACCEL_HABANALABS                     policy<{'amd64': 'm'}>
+CONFIG_DRM_ACCEL_IVPU                           policy<{'amd64': 'm'}>
+CONFIG_DRM_ACCEL_QAIC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_AMDGPU                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_AMDGPU_SI                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_AMDGPU_USERPTR                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_AMDGPU_WERROR                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'n'}>
+CONFIG_DRM_AMD_ACP                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_AMD_DC                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_AMD_DC_FP                            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_DRM_AMD_DC_SI                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_AMD_SECURE_DISPLAY                   policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_DRM_ANALOGIX_ANX6345                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_ANALOGIX_ANX7625                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_ANALOGIX_ANX78XX                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_ANALOGIX_DP                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_ARCPGU                               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_ARMADA                               policy<{'armhf': 'm'}>
+CONFIG_DRM_ASPEED_GFX                           policy<{'armhf': 'm'}>
+CONFIG_DRM_AST                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_ATMEL_HLCDC                          policy<{'armhf': 'm'}>
+CONFIG_DRM_AUX_BRIDGE                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_AUX_HPD_BRIDGE                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_BOCHS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DRM_BRIDGE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DRM_BUDDY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_CDNS_DSI                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_CDNS_DSI_J721E                       policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_CDNS_MHDP8546                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_CDNS_MHDP8546_J721E                  policy<{'arm64': 'y'}>
+CONFIG_DRM_CHIPONE_ICN6211                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_CHRONTEL_CH7033                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_CIRRUS_QEMU                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_CROS_EC_ANX7688                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DRM_DEBUG_MM                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_DEBUG_MODESET_LOCK                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DRM_DISPLAY_CONNECTOR                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_DISPLAY_DP_HELPER                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_DISPLAY_HDCP_HELPER                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_DISPLAY_HDMI_HELPER                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_DISPLAY_HELPER                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_DP_AUX_BUS                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_DP_AUX_CHARDEV                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_DP_CEC                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_DW_HDMI                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': 'm'}>
+CONFIG_DRM_DW_HDMI_AHB_AUDIO                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': 'm'}>
+CONFIG_DRM_DW_HDMI_CEC                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': 'm'}>
+CONFIG_DRM_DW_HDMI_GP_AUDIO                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': 'm'}>
+CONFIG_DRM_DW_HDMI_I2S_AUDIO                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': 'm'}>
+CONFIG_DRM_DW_MIPI_DSI                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_ETNAVIV                              policy<{'amd64': 'n', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DRM_ETNAVIV_THERMAL                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_EXEC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_EXYNOS                               policy<{'armhf': 'm'}>
+CONFIG_DRM_EXYNOS5433_DECON                     policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS7_DECON                        policy<{'armhf': 'n'}>
+CONFIG_DRM_EXYNOS_DSI                           policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_FIMC                          policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_FIMD                          policy<{'armhf': 'n'}>
+CONFIG_DRM_EXYNOS_G2D                           policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_GSC                           policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_HDMI                          policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_IPP                           policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_MIC                           policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_MIXER                         policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_ROTATOR                       policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_SCALER                        policy<{'armhf': 'y'}>
+CONFIG_DRM_EXYNOS_VIDI                          policy<{'armhf': 'n'}>
+CONFIG_DRM_FBDEV_EMULATION                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_DRM_FBDEV_OVERALLOC                      policy<{'amd64': '100', 'arm64': '100', 'armhf': '100', 'ppc64el': '100', 'riscv64': '100', 's390x': '100'}>
+CONFIG_DRM_FSL_DCU                              policy<{'armhf': 'm'}>
+CONFIG_DRM_FSL_LDB                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_GEM_DMA_HELPER                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_GEM_SHMEM_HELPER                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_DRM_GM12U320                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DRM_GMA500                               policy<{'amd64': 'm'}>
+CONFIG_DRM_GPUVM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_GUD                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DRM_HDLCD                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_HDLCD_SHOW_UNDERRUN                  policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_DRM_HISI_KIRIN                           policy<{'arm64': 'm'}>
+CONFIG_DRM_HYPERV                               policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_DRM_I2C_ADV7511                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_I2C_ADV7511_AUDIO                    policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_I2C_ADV7511_CEC                      policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_I2C_CH7006                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_I2C_NXP_TDA9950                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_I2C_NXP_TDA998X                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_I2C_SIL164                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_I915                                 policy<{'amd64': 'm'}>
+CONFIG_DRM_I915_CAPTURE_ERROR                   policy<{'amd64': 'y'}>
+CONFIG_DRM_I915_COMPRESS_ERROR                  policy<{'amd64': 'y'}>
+CONFIG_DRM_I915_DEBUG                           policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_DEBUG_GUC                       policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_DEBUG_MMIO                      policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_DEBUG_RUNTIME_PM                policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_DEBUG_VBLANK_EVADE              policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_DEBUG_WAKEREF                   policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_FENCE_TIMEOUT                   policy<{'amd64': '10000'}>
+CONFIG_DRM_I915_FORCE_PROBE                     policy<{'amd64': '""'}>
+CONFIG_DRM_I915_GVT                             policy<{'amd64': 'y'}>
+CONFIG_DRM_I915_GVT_KVMGT                       policy<{'amd64': 'm'}>
+CONFIG_DRM_I915_HEARTBEAT_INTERVAL              policy<{'amd64': '2500'}>
+CONFIG_DRM_I915_LOW_LEVEL_TRACEPOINTS           policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT            policy<{'amd64': '8000'}>
+CONFIG_DRM_I915_PREEMPT_TIMEOUT                 policy<{'amd64': '640'}>
+CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE         policy<{'amd64': '7500'}>
+CONFIG_DRM_I915_PXP                             policy<{'amd64': 'y'}>
+CONFIG_DRM_I915_REQUEST_TIMEOUT                 policy<{'amd64': '20000'}>
+CONFIG_DRM_I915_SELFTEST                        policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_STOP_TIMEOUT                    policy<{'amd64': '100'}>
+CONFIG_DRM_I915_SW_FENCE_CHECK_DAG              policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS          policy<{'amd64': 'n'}>
+CONFIG_DRM_I915_TIMESLICE_DURATION              policy<{'amd64': '1'}>
+CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND           policy<{'amd64': '250'}>
+CONFIG_DRM_I915_USERPTR                         policy<{'amd64': 'y'}>
+CONFIG_DRM_I915_WERROR                          policy<{'amd64': 'n'}>
+CONFIG_DRM_IMX                                  policy<{'armhf': 'm'}>
+CONFIG_DRM_IMX8QM_LDB                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_IMX8QXP_LDB                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_IMX8QXP_PIXEL_COMBINER               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_IMX8QXP_PIXEL_LINK                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_IMX8QXP_PIXEL_LINK_TO_DPI            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_IMX93_MIPI_DSI                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_IMX_DCSS                             policy<{'arm64': 'm'}>
+CONFIG_DRM_IMX_HDMI                             policy<{'armhf': 'm'}>
+CONFIG_DRM_IMX_LCDC                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_IMX_LCDIF                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_DRM_IMX_LDB                              policy<{'armhf': 'm'}>
+CONFIG_DRM_IMX_LDB_HELPER                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_IMX_PARALLEL_DISPLAY                 policy<{'armhf': 'm'}>
+CONFIG_DRM_IMX_TVE                              policy<{'armhf': 'm'}>
+CONFIG_DRM_ITE_IT6505                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_ITE_IT66121                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_KMB_DISPLAY                          policy<{'arm64': 'm'}>
+CONFIG_DRM_KMS_HELPER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_DRM_KOMEDA                               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_LIMA                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_LOAD_EDID_FIRMWARE                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DRM_LOGICVC                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_LONTIUM_LT8912B                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_LONTIUM_LT9211                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_LONTIUM_LT9611                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_LONTIUM_LT9611UXC                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_LVDS_CODEC                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_MALI_DISPLAY                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_MCDE                                 policy<{'armhf': 'm'}>
+CONFIG_DRM_MEDIATEK                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_MEDIATEK_DP                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_MEDIATEK_HDMI                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_MESON                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_MESON_DW_HDMI                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_MESON_DW_MIPI_DSI                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_MIPI_DBI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_MIPI_DSI                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_MSM                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_MSM_DP                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_DPU                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_DSI                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_DSI_10NM_PHY                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_DSI_14NM_PHY                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_DSI_20NM_PHY                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_DSI_28NM_8960_PHY                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_DSI_28NM_PHY                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_DSI_7NM_PHY                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_GPU_STATE                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_GPU_SUDO                         policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_DRM_MSM_HDMI                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_HDMI_HDCP                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_MDP4                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_MDP5                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MSM_MDSS                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_MXS                                  policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_DRM_MXSFB                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_DRM_NOUVEAU                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_NOUVEAU_BACKLIGHT                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_NOUVEAU_GSP_DEFAULT                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_NOUVEAU_SVM                          policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n'}>
+CONFIG_DRM_NWL_MIPI_DSI                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_NXP_PTN3460                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_OFDRM                                policy<{'ppc64el': 'm'}>
+CONFIG_DRM_OMAP                                 policy<{'armhf': 'n'}>
+CONFIG_DRM_PANEL                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DRM_PANEL_ABT_Y030XX067A                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ARM_VERSATILE                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ASUS_Z00T_TM5P5_NT35596        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_AUO_A030JTN01                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_BOE_BF060Y8M_AJ0               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_BOE_HIMAX8279D                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_BOE_TV101WUM_NL6               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_BRIDGE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DRM_PANEL_DSI_CM                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_EBBG_FT8719                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_EDP                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ELIDA_KD35T133                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_FEIYANG_FY07024DI26A30D        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_HIMAX_HX8394                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ILITEK_IL9322                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ILITEK_ILI9341                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ILITEK_ILI9805                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ILITEK_ILI9881C                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ILITEK_ILI9882T                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_INNOLUX_EJ030NA                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_INNOLUX_P079ZCA                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_JADARD_JD9365DA_H3             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_JDI_LPM102A188A                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_JDI_LT070ME05000               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_JDI_R63452                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_KHADAS_TS050                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_KINGDISPLAY_KD097D04           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_LEADTEK_LTK050H3146W           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_LEADTEK_LTK500HD1829           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_LG_LB035Q02                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_LG_LG4573                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_LVDS                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_MAGNACHIP_D53E6EA8966          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_MANTIX_MLAF057WE51             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_MIPI_DBI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_NEC_NL8048HL11                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_NEWVISION_NV3051D              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_NEWVISION_NV3052C              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_NOVATEK_NT35510                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_NOVATEK_NT35560                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_NOVATEK_NT35950                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_NOVATEK_NT36523                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_NOVATEK_NT36672A               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_NOVATEK_NT39016                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_OLIMEX_LCD_OLINUXINO           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_DRM_PANEL_ORISETECH_OTA5601A             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_ORISETECH_OTM8009A             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_OSD_OSD101T2587_53TS           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_PANASONIC_VVX10F034N00         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_RAYDIUM_RM67191                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_RAYDIUM_RM68200                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_RAYDIUM_RM692E5                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_RONBO_RB070D30                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_DB7430                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_LD9040                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6D16D0                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6D27A1                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6D7AA0                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6E3HA2                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6E63J0X03             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6E63M0                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6E63M0_DSI            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6E63M0_SPI            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6E88A0_AMS452EF01     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SAMSUNG_SOFEF00                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SEIKO_43WVF1G                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SHARP_LQ101R1SX01              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SHARP_LS037V7DW01              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SHARP_LS043T1LE01              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SHARP_LS060T1SX01              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SIMPLE                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SITRONIX_ST7701                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SITRONIX_ST7703                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SITRONIX_ST7789V               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SONY_ACX565AKM                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SONY_TD4353_JDI                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SONY_TULIP_TRULY_NT35521       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_STARTEK_KD070FHFID015          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_SYNAPTICS_R63353               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_TDO_TL070WSH30                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_TPO_TD028TTEC1                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_TPO_TD043MTEA1                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_TPO_TPG110                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_VISIONOX_R66451                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_VISIONOX_RM69299               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_VISIONOX_VTDR6130              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANEL_WIDECHIPS_WS2401               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DRM_PANEL_XINPENG_XPP055C272             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PANFROST                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_PARADE_PS8622                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PARADE_PS8640                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_PL111                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_POWERVR                              policy<{'arm64': 'm'}>
+CONFIG_DRM_PRIVACY_SCREEN                       policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_DRM_QXL                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_RADEON                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_RADEON_USERPTR                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DRM_RCAR_CMM                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_RCAR_DU                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_RCAR_DW_HDMI                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_DRM_RCAR_LVDS                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': '-'}>
+CONFIG_DRM_RCAR_MIPI_DSI                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_RCAR_USE_CMM                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_RCAR_USE_LVDS                        policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_DRM_RCAR_USE_MIPI_DSI                    policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_DRM_RCAR_VSP                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_RCAR_WRITEBACK                       policy<{'arm64': 'y'}>
+CONFIG_DRM_ROCKCHIP                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_RZG2L_MIPI_DSI                       policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SAMSUNG_DSIM                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SCHED                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SHMOBILE                             policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SII902X                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SII9234                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SIL_SII8620                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SIMPLE_BRIDGE                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SPRD                                 policy<{'arm64': 'm'}>
+CONFIG_DRM_SSD130X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_SSD130X_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SSD130X_SPI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_STM                                  policy<{'arm64': 'm'}>
+CONFIG_DRM_STM_DSI                              policy<{'arm64': 'm'}>
+CONFIG_DRM_SUBALLOC_HELPER                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_SUN4I                                policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_DRM_SUN6I_DSI                            policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_DRM_SUN8I_DW_HDMI                        policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_DRM_SUN8I_MIXER                          policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_DRM_SUN8I_TCON_TOP                       policy<{'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TEGRA                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_TEGRA_DEBUG                          policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_DRM_TEGRA_STAGING                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DRM_THINE_THC63LVD1024                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TIDSS                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DRM_TILCDC                               policy<{'armhf': 'm'}>
+CONFIG_DRM_TI_DLPC3433                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TI_SN65DSI83                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TI_SN65DSI86                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TI_TFP410                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TI_TPD12S015                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TOSHIBA_TC358762                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TOSHIBA_TC358764                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TOSHIBA_TC358767                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TOSHIBA_TC358768                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TOSHIBA_TC358775                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DRM_TTM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DRM_TTM_HELPER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DRM_TVE200                               policy<{'armhf': 'm'}>
+CONFIG_DRM_UDL                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DRM_VGEM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_VIRTIO_GPU                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DRM_VIRTIO_GPU_KMS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DRM_VKMS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_VMWGFX                               policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_DRM_VMWGFX_MKSSTATS                      policy<{'amd64': 'n'}>
+CONFIG_DRM_VRAM_HELPER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DRM_XE                                   policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DRM_XEN                                  policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_DRM_XEN_FRONTEND                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_DRM_XE_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_XE_DEBUG_MEM                         policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_XE_DEBUG_SRIOV                       policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_XE_DEBUG_VM                          policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_XE_DISPLAY                           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_XE_ENABLE_SCHEDTIMEOUT_LIMIT         policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DRM_XE_FORCE_PROBE                       policy<{'amd64': '""', 'arm64': '""', 'ppc64el': '""', 'riscv64': '""'}>
+CONFIG_DRM_XE_JOB_TIMEOUT_MAX                   policy<{'amd64': '10000', 'arm64': '10000', 'ppc64el': '10000', 'riscv64': '10000'}>
+CONFIG_DRM_XE_JOB_TIMEOUT_MIN                   policy<{'amd64': '1', 'arm64': '1', 'ppc64el': '1', 'riscv64': '1'}>
+CONFIG_DRM_XE_LARGE_GUC_BUFFER                  policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_XE_PREEMPT_TIMEOUT                   policy<{'amd64': '640000', 'arm64': '640000', 'ppc64el': '640000', 'riscv64': '640000'}>
+CONFIG_DRM_XE_PREEMPT_TIMEOUT_MAX               policy<{'amd64': '10000000', 'arm64': '10000000', 'ppc64el': '10000000', 'riscv64': '10000000'}>
+CONFIG_DRM_XE_PREEMPT_TIMEOUT_MIN               policy<{'amd64': '1', 'arm64': '1', 'ppc64el': '1', 'riscv64': '1'}>
+CONFIG_DRM_XE_SIMPLE_ERROR_CAPTURE              policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_XE_TIMESLICE_MAX                     policy<{'amd64': '10000000', 'arm64': '10000000', 'ppc64el': '10000000', 'riscv64': '10000000'}>
+CONFIG_DRM_XE_TIMESLICE_MIN                     policy<{'amd64': '1', 'arm64': '1', 'ppc64el': '1', 'riscv64': '1'}>
+CONFIG_DRM_XE_USERPTR_INVAL_INJECT              policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_XE_WERROR                            policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DRM_ZYNQMP_DPSUB                         policy<{'arm64': 'm'}>
+CONFIG_DS1682                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DS1803                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DS4424                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DST_CACHE                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DTC                                      policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DTL                                      policy<{'ppc64el': 'y'}>
+CONFIG_DTPM                                     policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DTPM_CPU                                 policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DTPM_DEVFREQ                             policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_DT_IDLE_GENPD                            policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_DT_IDLE_STATES                           policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_DUMMY                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DUMMY_CONSOLE                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DUMMY_CONSOLE_COLUMNS                    policy<{'amd64': '80', 'arm64': '80', 'armhf': '80', 'ppc64el': '80', 'riscv64': '80', 's390x': '80'}>
+CONFIG_DUMMY_CONSOLE_ROWS                       policy<{'amd64': '25', 'arm64': '25', 'armhf': '30', 'ppc64el': '25', 'riscv64': '25', 's390x': '25'}>
+CONFIG_DUMMY_IRQ                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DVB_A8293                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_AF9013                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_AF9033                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_AS102                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_AS102_FE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ASCOT2E                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ATBM8830                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_AU8522                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_AU8522_DTV                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_AU8522_V4L                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_AV7110                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_AV7110_IR                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DVB_AV7110_OSD                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DVB_B2C2_FLEXCOP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_B2C2_FLEXCOP_PCI                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_B2C2_FLEXCOP_PCI_DEBUG               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DVB_B2C2_FLEXCOP_USB                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_B2C2_FLEXCOP_USB_DEBUG               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DVB_BCM3510                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_BT8XX                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_BUDGET                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_BUDGET_AV                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_BUDGET_CI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_BUDGET_CORE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_BUDGET_PATCH                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_C8SECTPFE                            policy<{'armhf': 'n'}>
+CONFIG_DVB_CORE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CX22700                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CX22702                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CX24110                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CX24116                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CX24117                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CX24120                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CX24123                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CXD2099                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CXD2820R                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CXD2841ER                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_CXD2880                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DDBRIDGE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DDBRIDGE_MSIENABLE                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DVB_DEMUX_SECTION_LOSS_LOG               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DVB_DIB3000MB                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DIB3000MC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DIB7000M                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DIB7000P                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DIB8000                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DIB9000                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DM1105                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DRX39XYJ                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DRXD                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DRXK                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DS3000                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_DYNAMIC_MINORS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DVB_EC100                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_FIREDTV                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_FIREDTV_INPUT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DVB_GP8PSK_FE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_HELENE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_HOPPER                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_HORUS3A                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ISL6405                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ISL6421                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ISL6423                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_IX2505V                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_L64781                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LG2160                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LGDT3305                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LGDT3306A                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LGDT330X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LGS8GL5                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LGS8GXX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LNBH25                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LNBH29                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LNBP21                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_LNBP22                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_M88DS3103                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_M88RS2000                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MANTIS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MAX_ADAPTERS                         policy<{'amd64': '8', 'arm64': '8', 'armhf': '8', 'ppc64el': '8', 'riscv64': '8'}>
+CONFIG_DVB_MB86A16                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MB86A20S                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MMAP                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DVB_MN88443X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MN88472                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MN88473                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MT312                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MT352                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MXL5XX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_MXL692                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_NET                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DVB_NETUP_UNIDVB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_NGENE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_NXT200X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_NXT6000                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_OR51132                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_OR51211                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_PLATFORM_DRIVERS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DVB_PLL                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_PLUTO2                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_PT1                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_PT3                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_RTL2830                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_RTL2832                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_RTL2832_SDR                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_S5H1409                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_S5H1411                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_S5H1420                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_S5H1432                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_S921                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_SI2165                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_SI2168                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_SI21XX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_SMIPCIE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_SP2                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_SP8870                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_SP887X                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STB0899                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STB6000                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STB6100                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV0288                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV0297                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV0299                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV0367                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV0900                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV090x                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV0910                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV6110                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV6110x                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_STV6111                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TC90522                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA10021                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA10023                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA10048                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA1004X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA10071                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA10086                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA18271C2DD                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA665x                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA8083                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA8261                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TDA826X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TEST_DRIVERS                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DVB_TS2020                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TTUSB_BUDGET                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TTUSB_DEC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TUA6100                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TUNER_CX24113                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TUNER_DIB0070                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TUNER_DIB0090                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_TUNER_ITD1000                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ULE_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DVB_USB                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_A800                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_AF9005                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_AF9005_REMOTE                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_AF9015                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_AF9035                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_ANYSEE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_AU6610                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_AZ6007                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_AZ6027                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_CE6230                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_CINERGY_T2                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_CXUSB                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_CXUSB_ANALOG                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_DVB_USB_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DVB_USB_DIB0700                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_DIB3000MC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_DIBUSB_MB                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_DIBUSB_MB_FAULTY                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_DVB_USB_DIBUSB_MC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_DIGITV                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_DTT200U                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_DTV5100                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_DVBSKY                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_DW2102                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_EC168                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_GL861                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_GP8PSK                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_LME2510                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_M920X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_MXL111SF                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_NOVA_T_USB2                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_OPERA1                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_PCTV452E                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_RTL28XXU                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_TECHNISAT_USB2                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_TTUSB2                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_UMT_010                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_V2                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_VP702X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_VP7045                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_USB_ZD1301                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_VES1820                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_VES1X93                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ZD1301_DEMOD                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ZL10036                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ZL10039                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DVB_ZL10353                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DWC_PCIE_PMU                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DWC_XLGMAC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DWC_XLGMAC_PCI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_DWMAC_DWC_QOS_ETH                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DWMAC_GENERIC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DWMAC_IMX8                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DWMAC_INTEL                              policy<{'amd64': 'm'}>
+CONFIG_DWMAC_INTEL_PLAT                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DWMAC_IPQ806X                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DWMAC_MEDIATEK                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DWMAC_MESON                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DWMAC_QCOM_ETHQOS                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DWMAC_ROCKCHIP                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DWMAC_SOCFPGA                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DWMAC_STARFIVE                           policy<{'riscv64': 'm'}>
+CONFIG_DWMAC_STM32                              policy<{'arm64': 'm'}>
+CONFIG_DWMAC_SUN8I                              policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_DWMAC_SUNXI                              policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_DWMAC_TEGRA                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_DWMAC_VISCONTI                           policy<{'arm64': 'm'}>
+CONFIG_DW_APB_ICTL                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DW_APB_TIMER                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DW_APB_TIMER_OF                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_DW_AXI_DMAC                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DW_DMAC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DW_DMAC_CORE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DW_DMAC_PCI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DW_EDMA                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DW_EDMA_PCIE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_DW_I3C_MASTER                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_DW_WATCHDOG                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DW_XDATA_PCIE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_DYNAMIC_DEBUG                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DYNAMIC_DEBUG_CORE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DYNAMIC_EVENTS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_DYNAMIC_FTRACE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_DYNAMIC_FTRACE_WITH_ARGS                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS             policy<{'arm64': 'y'}>
+CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS         policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_DYNAMIC_FTRACE_WITH_REGS                 policy<{'amd64': 'y', 'arm64': '-', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_DYNAMIC_MEMORY_LAYOUT                    policy<{'amd64': 'y'}>
+CONFIG_DYNAMIC_PHYSICAL_MASK                    policy<{'amd64': 'y'}>
+CONFIG_DYNAMIC_SIGFRAME                         policy<{'amd64': 'y', 'riscv64': 'y'}>
+CONFIG_E100                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_E1000                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_E1000E                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_E1000E_HWTS                              policy<{'amd64': 'y'}>
+CONFIG_EADM_SCH                                 policy<{'s390x': 'm'}>
+CONFIG_EARLY_PRINTK                             policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_EARLY_PRINTK_DBGP                        policy<{'amd64': 'y'}>
+CONFIG_EARLY_PRINTK_USB                         policy<{'amd64': 'y'}>
+CONFIG_EARLY_PRINTK_USB_XDBC                    policy<{'amd64': 'y'}>
+CONFIG_EBC_C384_WDT                             policy<{'amd64': 'm'}>
+CONFIG_ECHO                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ECRYPT_FS_MESSAGING                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EDAC                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_EDAC_ALTERA                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_EDAC_ALTERA_ETHERNET                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_EDAC_ALTERA_L2C                          policy<{'armhf': 'y'}>
+CONFIG_EDAC_ALTERA_NAND                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_EDAC_ALTERA_OCRAM                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_EDAC_ALTERA_QSPI                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_EDAC_ALTERA_SDMMC                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_EDAC_ALTERA_SDRAM                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_EDAC_ALTERA_USB                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_EDAC_AMD64                               policy<{'amd64': 'm'}>
+CONFIG_EDAC_ARMADA_XP                           policy<{'armhf': 'y'}>
+CONFIG_EDAC_ASPEED                              policy<{'armhf': 'm'}>
+CONFIG_EDAC_ATOMIC_SCRUB                        policy<{'amd64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_EDAC_BLUEFIELD                           policy<{'arm64': 'm'}>
+CONFIG_EDAC_CPC925                              policy<{'ppc64el': 'm'}>
+CONFIG_EDAC_DEBUG                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_EDAC_DECODE_MCE                          policy<{'amd64': 'm'}>
+CONFIG_EDAC_DMC520                              policy<{'arm64': 'm'}>
+CONFIG_EDAC_E752X                               policy<{'amd64': 'm'}>
+CONFIG_EDAC_GHES                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_EDAC_HIGHBANK_L2                         policy<{'armhf': 'm'}>
+CONFIG_EDAC_HIGHBANK_MC                         policy<{'armhf': 'm'}>
+CONFIG_EDAC_I10NM                               policy<{'amd64': 'm'}>
+CONFIG_EDAC_I3000                               policy<{'amd64': 'm'}>
+CONFIG_EDAC_I3200                               policy<{'amd64': 'm'}>
+CONFIG_EDAC_I5100                               policy<{'amd64': 'm'}>
+CONFIG_EDAC_I5400                               policy<{'amd64': 'm'}>
+CONFIG_EDAC_I7300                               policy<{'amd64': 'm'}>
+CONFIG_EDAC_I7CORE                              policy<{'amd64': 'm'}>
+CONFIG_EDAC_I82975X                             policy<{'amd64': 'm'}>
+CONFIG_EDAC_IE31200                             policy<{'amd64': 'm'}>
+CONFIG_EDAC_IGEN6                               policy<{'amd64': 'm'}>
+CONFIG_EDAC_LAYERSCAPE                          policy<{'arm64': 'm'}>
+CONFIG_EDAC_LEGACY_SYSFS                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_EDAC_NPCM                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_EDAC_PND2                                policy<{'amd64': 'm'}>
+CONFIG_EDAC_QCOM                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_EDAC_SBRIDGE                             policy<{'amd64': 'm'}>
+CONFIG_EDAC_SIFIVE                              policy<{'riscv64': 'y'}>
+CONFIG_EDAC_SKX                                 policy<{'amd64': 'm'}>
+CONFIG_EDAC_SUPPORT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_EDAC_SYNOPSYS                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_EDAC_THUNDERX                            policy<{'arm64': 'm'}>
+CONFIG_EDAC_TI                                  policy<{'armhf': 'm'}>
+CONFIG_EDAC_VERSAL                              policy<{'arm64': 'm'}>
+CONFIG_EDAC_X38                                 policy<{'amd64': 'm'}>
+CONFIG_EDAC_XGENE                               policy<{'arm64': 'm'}>
+CONFIG_EDAC_ZYNQMP                              policy<{'arm64': 'm'}>
+CONFIG_EDD                                      policy<{'amd64': 'y'}>
+CONFIG_EDD_OFF                                  policy<{'amd64': 'y'}>
+CONFIG_EEEPC_LAPTOP                             policy<{'amd64': 'm'}>
+CONFIG_EEEPC_WMI                                policy<{'amd64': 'm'}>
+CONFIG_EEH                                      policy<{'ppc64el': 'y'}>
+CONFIG_EEPROM_93CX6                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_EEPROM_93XX46                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EEPROM_AT24                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_EEPROM_AT25                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EEPROM_EE1004                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_EEPROM_IDT_89HPESX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_EEPROM_MAX6875                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_EFI                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_EFI_ARMSTUB_DTB_LOADER                   policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_EFI_BOOTLOADER_CONTROL                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_EFI_CAPSULE_LOADER                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_EFI_COCO_SECRET                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_EFI_CUSTOM_SSDT_OVERLAYS                 policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_EFI_DEV_PATH_PARSER                      policy<{'amd64': 'y'}>
+CONFIG_EFI_DISABLE_PCI_DMA                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'riscv64': 'n'}>
+CONFIG_EFI_DISABLE_RUNTIME                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'riscv64': 'n'}>
+CONFIG_EFI_DXE_MEM_ATTRIBUTES                   policy<{'amd64': 'y'}>
+CONFIG_EFI_EARLYCON                             policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_EFI_EMBEDDED_FIRMWARE                    policy<{'amd64': 'y'}>
+CONFIG_EFI_ESRT                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_EFI_FAKE_MEMMAP                          policy<{'amd64': 'n'}>
+CONFIG_EFI_GENERIC_STUB                         policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_EFI_MIXED                                policy<{'amd64': 'y'}>
+CONFIG_EFI_PARAMS_FROM_FDT                      policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_EFI_PARTITION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EFI_PGT_DUMP                             policy<{'amd64': 'n'}>
+CONFIG_EFI_RCI2_TABLE                           policy<{'amd64': 'y'}>
+CONFIG_EFI_RUNTIME_MAP                          policy<{'amd64': 'y'}>
+CONFIG_EFI_RUNTIME_WRAPPERS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_EFI_SECRET                               policy<{'amd64': 'm'}>
+CONFIG_EFI_SOFT_RESERVE                         policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_EFI_STUB                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_EFI_TEST                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_EFI_VARS_PSTORE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'riscv64': 'n'}>
+CONFIG_EFS_FS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_EINT_MTK                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_EISA                                     policy<{'amd64': 'y'}>
+CONFIG_EISA_NAMES                               policy<{'amd64': 'y'}>
+CONFIG_EISA_PCI_EISA                            policy<{'amd64': 'y'}>
+CONFIG_EISA_VIRTUAL_ROOT                        policy<{'amd64': 'y'}>
+CONFIG_EISA_VLB_PRIMING                         policy<{'amd64': 'y'}>
+CONFIG_EL3                                      policy<{'amd64': 'm'}>
+CONFIG_ELFCORE                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ELF_CORE                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EMAC_ROCKCHIP                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_EM_TIMER_STI                             policy<{'armhf': 'y'}>
+CONFIG_ENA_ETHERNET                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ENC28J60                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ENC28J60_WRITEVERIFY                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ENCLOSURE_SERVICES                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ENCRYPTED_KEYS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ENCX24J600                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ENERGY_MODEL                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ENIC                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ENVELOPE_DETECTOR                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_EPAPR_BOOT                               policy<{'ppc64el': 'y'}>
+CONFIG_EPAPR_PARAVIRT                           policy<{'ppc64el': 'y'}>
+CONFIG_EPIC100                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EPOLL                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EQUALIZER                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_EROFS_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_EROFS_FS_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_EROFS_FS_ONDEMAND                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_EROFS_FS_PCPU_KTHREAD                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EROFS_FS_PCPU_KTHREAD_HIPRI              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_EROFS_FS_POSIX_ACL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EROFS_FS_SECURITY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EROFS_FS_XATTR                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EROFS_FS_ZIP                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EROFS_FS_ZIP_DEFLATE                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EROFS_FS_ZIP_LZMA                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ERRATA_ANDES                             policy<{'riscv64': 'n'}>
+CONFIG_ERRATA_SIFIVE                            policy<{'riscv64': 'y'}>
+CONFIG_ERRATA_SIFIVE_CIP_1200                   policy<{'riscv64': 'y'}>
+CONFIG_ERRATA_SIFIVE_CIP_453                    policy<{'riscv64': 'y'}>
+CONFIG_ERRATA_THEAD                             policy<{'riscv64': 'y'}>
+CONFIG_ERRATA_THEAD_CMO                         policy<{'riscv64': 'y'}>
+CONFIG_ERRATA_THEAD_MAE                         policy<{'riscv64': 'y'}>
+CONFIG_ERRATA_THEAD_PMU                         policy<{'riscv64': 'y'}>
+CONFIG_ET131X                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ETHERNET                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ETHOC                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ETHTOOL_NETLINK                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EUROTECH_WDT                             policy<{'amd64': 'm'}>
+CONFIG_EVENTFD                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EVENT_TRACING                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EVM_ADD_XATTRS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EVM_EXTRA_SMACK_XATTRS                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EXAR_WDT                                 policy<{'amd64': 'm'}>
+CONFIG_EXCLUSIVE_SYSTEM_RAM                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EXFAT_DEFAULT_IOCHARSET                  policy<{'amd64': '"utf8"', 'arm64': '"utf8"', 'armhf': '"utf8"', 'ppc64el': '"utf8"', 'riscv64': '"utf8"'}>
+CONFIG_EXFAT_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_EXPERT                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EXPOLINE                                 policy<{'s390x': 'y'}>
+CONFIG_EXPOLINE_AUTO                            policy<{'s390x': 'y'}>
+CONFIG_EXPOLINE_EXTERN                          policy<{'s390x': 'y'}>
+CONFIG_EXPOLINE_FULL                            policy<{'s390x': 'n'}>
+CONFIG_EXPOLINE_OFF                             policy<{'s390x': 'n'}>
+CONFIG_EXPORTFS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EXPORTFS_BLOCK_OPS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EXT4_DEBUG                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_EXT4_FS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EXT4_FS_POSIX_ACL                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EXT4_FS_SECURITY                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EXT4_USE_FOR_EXT2                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_EXTCON                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_EXTCON_ADC_JACK                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_EXTCON_AXP288                            policy<{'amd64': 'm'}>
+CONFIG_EXTCON_FSA9480                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_GPIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_INTEL_CHT_WC                      policy<{'amd64': 'm'}>
+CONFIG_EXTCON_INTEL_INT3496                     policy<{'amd64': 'm'}>
+CONFIG_EXTCON_INTEL_MRFLD                       policy<{'amd64': 'm'}>
+CONFIG_EXTCON_MAX14577                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_MAX3355                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_MAX77693                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_MAX77843                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_MAX8997                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_PALMAS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_PTN5150                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_QCOM_SPMI_MISC                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_EXTCON_RT8973A                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_RTK_TYPE_C                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_EXTCON_SM5502                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_USBC_CROS_EC                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_EXTCON_USBC_TUSB320                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTCON_USB_GPIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_EXTRA_FIRMWARE                           policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '""'}>
+CONFIG_EXTRA_TARGETS                            policy<{'ppc64el': '""'}>
+CONFIG_EXYNOS5422_DMC                           policy<{'armhf': 'n'}>
+CONFIG_EXYNOS_ADC                               policy<{'armhf': 'n'}>
+CONFIG_EXYNOS_AUDSS_CLK_CON                     policy<{'armhf': 'n'}>
+CONFIG_EXYNOS_CHIPID                            policy<{'armhf': 'n'}>
+CONFIG_EXYNOS_CLKOUT                            policy<{'armhf': 'n'}>
+CONFIG_EXYNOS_CPU_SUSPEND                       policy<{'armhf': 'y'}>
+CONFIG_EXYNOS_IOMMU                             policy<{'armhf': 'n'}>
+CONFIG_EXYNOS_IRQ_COMBINER                      policy<{'armhf': 'y'}>
+CONFIG_EXYNOS_PMU                               policy<{'armhf': 'y'}>
+CONFIG_EXYNOS_PMU_ARM_DRIVERS                   policy<{'armhf': 'y'}>
+CONFIG_EXYNOS_PM_DOMAINS                        policy<{'armhf': 'y'}>
+CONFIG_EXYNOS_SROM                              policy<{'armhf': 'y'}>
+CONFIG_EXYNOS_THERMAL                           policy<{'armhf': 'y'}>
+CONFIG_EXYNOS_USI                               policy<{'armhf': 'n'}>
+CONFIG_EZCHIP_NPS_MANAGEMENT_ENET               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_EZX_PCAP                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_CHECK_FS                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_F2FS_FAULT_INJECTION                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_F2FS_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_F2FS_FS_COMPRESSION                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_FS_LZ4                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_FS_LZ4HC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_FS_LZO                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_FS_LZORLE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_FS_POSIX_ACL                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_FS_SECURITY                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_FS_XATTR                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_FS_ZSTD                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_IOSTAT                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_F2FS_STAT_FS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F2FS_UNFAIR_RWSEM                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_F71808E_WDT                              policy<{'amd64': 'm'}>
+CONFIG_FAILOVER                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FAIR_GROUP_SCHED                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FANOTIFY                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FARSYNC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FAT_DEFAULT_CODEPAGE                     policy<{'amd64': '437', 'arm64': '437', 'armhf': '437', 'ppc64el': '437', 'riscv64': '437', 's390x': '437'}>
+CONFIG_FAT_DEFAULT_IOCHARSET                    policy<{'amd64': '"iso8859-1"', 'arm64': '"iso8859-1"', 'armhf': '"iso8859-1"', 'ppc64el': '"iso8859-1"', 'riscv64': '"iso8859-1"', 's390x': '"iso8859-1"'}>
+CONFIG_FAT_DEFAULT_UTF8                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FAT_FS                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FAULT_INJECTION                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FB                                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_3DFX                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_3DFX_ACCEL                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_FB_3DFX_I2C                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_FB_ARC                                   policy<{'amd64': 'm'}>
+CONFIG_FB_ARK                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_ASILIANT                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_FB_ATY                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_ATY128                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_ATY128_BACKLIGHT                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_ATY_BACKLIGHT                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_ATY_CT                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_ATY_GENERIC_LCD                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_FB_ATY_GX                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_BACKLIGHT                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_CARMINE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_CARMINE_DRAM_EVAL                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_CFB_COPYAREA                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_FB_CFB_FILLRECT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_FB_CFB_IMAGEBLIT                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_FB_CIRRUS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_CORE                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_CYBER2000                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_CYBER2000_DDC                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_DDC                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_DEFERRED_IO                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_DEVICE                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_DMAMEM_HELPERS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_FOREIGN_ENDIAN                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FB_GOLDFISH                              policy<{'riscv64': 'm'}>
+CONFIG_FB_HECUBA                                policy<{'amd64': 'm'}>
+CONFIG_FB_HGA                                   policy<{'amd64': 'm'}>
+CONFIG_FB_HYPERV                                policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_FB_I740                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_IBM_GXT4500                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FB_IMSTT                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_FB_IMX                                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_FB_IOMEM_FOPS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_FB_IOMEM_HELPERS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_IOMEM_HELPERS_DEFERRED                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_FB_KYRO                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_MACMODES                              policy<{'ppc64el': 'm'}>
+CONFIG_FB_MATROX                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_MATROX_G                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_MATROX_I2C                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_MATROX_MAVEN                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_MATROX_MILLENIUM                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_MATROX_MYSTIQUE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_MB862XX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_MB862XX_I2C                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_MB862XX_LIME                          policy<{'ppc64el': 'n'}>
+CONFIG_FB_MB862XX_PCI_GDC                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_METRONOME                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_MODE_HELPERS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_N411                                  policy<{'amd64': 'm'}>
+CONFIG_FB_NEOMAGIC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_NOTIFY                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_NVIDIA                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_NVIDIA_BACKLIGHT                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_NVIDIA_DEBUG                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_FB_NVIDIA_I2C                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_OF                                    policy<{'ppc64el': 'm'}>
+CONFIG_FB_OMAP2                                 policy<{'armhf': 'm'}>
+CONFIG_FB_OMAP2_CONNECTOR_ANALOG_TV             policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_CONNECTOR_DVI                   policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_CONNECTOR_HDMI                  policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_DEBUG_SUPPORT                   policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_DSS                             policy<{'armhf': 'm'}>
+CONFIG_FB_OMAP2_DSS_DEBUG                       policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_DSS_DEBUGFS                     policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_DSS_DPI                         policy<{'armhf': 'y'}>
+CONFIG_FB_OMAP2_DSS_DSI                         policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_DSS_HDMI_COMMON                 policy<{'armhf': 'y'}>
+CONFIG_FB_OMAP2_DSS_INIT                        policy<{'armhf': 'y'}>
+CONFIG_FB_OMAP2_DSS_MIN_FCK_PER_PCK             policy<{'armhf': '0'}>
+CONFIG_FB_OMAP2_DSS_SDI                         policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_DSS_SLEEP_AFTER_VENC_RESET      policy<{'armhf': 'y'}>
+CONFIG_FB_OMAP2_DSS_VENC                        policy<{'armhf': 'y'}>
+CONFIG_FB_OMAP2_ENCODER_OPA362                  policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_ENCODER_TFP410                  policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_ENCODER_TPD12S015               policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_NUM_FBS                         policy<{'armhf': '3'}>
+CONFIG_FB_OMAP2_PANEL_DPI                       policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP2_PANEL_LGPHILIPS_LB035Q02        policy<{'armhf': 'n'}>
+CONFIG_FB_OMAP4_DSS_HDMI                        policy<{'armhf': 'y'}>
+CONFIG_FB_OMAP5_DSS_HDMI                        policy<{'armhf': 'n'}>
+CONFIG_FB_OPENCORES                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_PM2                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_PM2_FIFO_DISCONNECT                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_PM3                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_PROVIDE_GET_FB_UNMAPPED_AREA          policy<{'arm64': 'y'}>
+CONFIG_FB_RADEON                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_RADEON_BACKLIGHT                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_RADEON_DEBUG                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_FB_RADEON_I2C                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_RIVA                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_RIVA_BACKLIGHT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_RIVA_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_FB_RIVA_I2C                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_S1D13XXX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_S3                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_S3_DDC                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_SAVAGE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_SAVAGE_ACCEL                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_FB_SAVAGE_I2C                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_SH_MOBILE_LCDC                        policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_FB_SIMPLE                                policy<{'amd64': '-', 'arm64': '-', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_FB_SIS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_SIS_300                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_SIS_315                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FB_SM501                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_SM712                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_SM750                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FB_SMSCUFX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FB_SSD1307                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_SVGALIB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_SYSMEM_FOPS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_SYSMEM_HELPERS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_SYSMEM_HELPERS_DEFERRED               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_SYS_COPYAREA                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_SYS_FILLRECT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_SYS_IMAGEBLIT                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FB_TFT                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FB_TFT_AGM1264K_FL                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_BD663474                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_HX8340BN                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_HX8347D                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_HX8353D                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_HX8357D                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_ILI9163                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_ILI9320                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_ILI9325                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_ILI9340                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_ILI9341                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_ILI9481                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_ILI9486                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_PCD8544                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_RA8875                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_S6D02A1                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_S6D1121                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_SEPS525                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_SH1106                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_SSD1289                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_SSD1305                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_SSD1306                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_SSD1331                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_SSD1351                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_ST7735R                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_ST7789V                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_TINYLCD                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_TLS8204                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_UC1611                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_UC1701                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TFT_UPD161704                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FB_TILEBLITTING                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_FB_TRIDENT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_UDL                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FB_UVESA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_VGA16                                 policy<{'amd64': 'm', 'ppc64el': '-'}>
+CONFIG_FB_VIA                                   policy<{'amd64': 'm'}>
+CONFIG_FB_VIA_DIRECT_PROCFS                     policy<{'amd64': 'n'}>
+CONFIG_FB_VIA_X_COMPATIBILITY                   policy<{'amd64': 'y'}>
+CONFIG_FB_VIRTUAL                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FB_VOODOO1                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_VT8623                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FB_XILINX                                policy<{'arm64': 'm'}>
+CONFIG_FCOE                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_FCOE_FNIC                                policy<{'amd64': 'm'}>
+CONFIG_FDDI                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_FEALNX                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FEC                                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_FHCI_DEBUG                               policy<{'ppc64el': 'n'}>
+CONFIG_FIB_RULES                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FIELDBUS_DEV                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FILE_LOCKING                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FIND_BIT_BENCHMARK                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FIPS_SIGNATURE_SELFTEST                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FIQ                                      policy<{'armhf': 'y'}>
+CONFIG_FIREWIRE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FIREWIRE_NET                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FIREWIRE_NOSY                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FIREWIRE_OHCI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FIREWIRE_SBP2                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FIRMWARE_EDID                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FIRMWARE_MEMMAP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_FIRMWARE_TABLE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FIXED_PHY                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FIX_EARLYCON_MEM                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_FLATMEM_MANUAL                           policy<{'armhf': 'n'}>
+CONFIG_FM10K                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FONTS                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FONT_10x18                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FONT_6x10                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FONT_6x11                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FONT_6x8                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FONT_7x14                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FONT_8x16                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FONT_8x8                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FONT_ACORN_8x8                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FONT_MINI_4x6                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FONT_PEARL_8x8                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FONT_SUN12x22                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FONT_SUN8x16                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FONT_SUPPORT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FONT_TER16x32                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FORCEDETH                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FORCE_PCI                                policy<{'ppc64el': 'y'}>
+CONFIG_FORCE_SMP                                policy<{'ppc64el': 'y'}>
+CONFIG_FORTIFY_SOURCE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'n', 's390x': 'y'}>
+CONFIG_FPGA                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_FPGA_BRIDGE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FPGA_DFL                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_FPGA_DFL_AFU                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_DFL_EMIF                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_DFL_FME                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_DFL_FME_BRIDGE                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_DFL_FME_MGR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_DFL_FME_REGION                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_DFL_NIOS_INTEL_PAC_N3000            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_DFL_PCI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_M10_BMC_SEC_UPDATE                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_FPGA_MGR_ALTERA_CVP                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_FPGA_MGR_ALTERA_PS_SPI                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FPGA_MGR_ICE40_SPI                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_MGR_LATTICE_SYSCONFIG               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_MGR_LATTICE_SYSCONFIG_SPI           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_MGR_MACHXO2_SPI                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FPGA_MGR_MICROCHIP_SPI                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPGA_MGR_SOCFPGA                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_FPGA_MGR_SOCFPGA_A10                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_FPGA_MGR_STRATIX10_SOC                   policy<{'arm64': 'm'}>
+CONFIG_FPGA_MGR_VERSAL_FPGA                     policy<{'arm64': 'm'}>
+CONFIG_FPGA_MGR_XILINX_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FPGA_MGR_ZYNQMP_FPGA                     policy<{'arm64': 'm'}>
+CONFIG_FPGA_REGION                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FPROBE                                   policy<{'amd64': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_FPROBE_EVENTS                            policy<{'amd64': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_FPU                                      policy<{'riscv64': 'y'}>
+CONFIG_FRAMEBUFFER_CONSOLE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FRAMER                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FRAMER_PEF2256                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FRAME_POINTER                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_FRAME_WARN                               policy<{'amd64': '1024', 'arm64': '1024', 'armhf': '1024', 'ppc64el': '2048', 'riscv64': '1024', 's390x': '1024'}>
+CONFIG_FREEZER                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FSCACHE                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FSCACHE_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FSCACHE_STATS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FSI                                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FSI_MASTER_ASPEED                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FSI_MASTER_AST_CF                        policy<{'armhf': 'm'}>
+CONFIG_FSI_MASTER_GPIO                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FSI_MASTER_HUB                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FSI_MASTER_I2CR                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FSI_NEW_DEV_NODE                         policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_FSI_OCC                                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FSI_SBEFIFO                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FSI_SCOM                                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FSL_BMAN_TEST                            policy<{'arm64': 'm'}>
+CONFIG_FSL_BMAN_TEST_API                        policy<{'arm64': 'n'}>
+CONFIG_FSL_DPAA                                 policy<{'arm64': 'y'}>
+CONFIG_FSL_DPAA2_ETH                            policy<{'arm64': 'm'}>
+CONFIG_FSL_DPAA2_ETH_DCB                        policy<{'arm64': 'y'}>
+CONFIG_FSL_DPAA2_PTP_CLOCK                      policy<{'arm64': 'm'}>
+CONFIG_FSL_DPAA2_QDMA                           policy<{'arm64': 'm'}>
+CONFIG_FSL_DPAA2_SWITCH                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_FSL_DPAA_CHECKING                        policy<{'arm64': 'y'}>
+CONFIG_FSL_DPAA_ETH                             policy<{'arm64': 'm'}>
+CONFIG_FSL_EDMA                                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FSL_ENETC                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_FSL_ENETC_CORE                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_FSL_ENETC_IERB                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_FSL_ENETC_MDIO                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_FSL_ENETC_PTP_CLOCK                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_FSL_ENETC_QOS                            policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_FSL_ENETC_VF                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_FSL_ERRATUM_A008585                      policy<{'arm64': 'y'}>
+CONFIG_FSL_FMAN                                 policy<{'arm64': 'y'}>
+CONFIG_FSL_GTM                                  policy<{'ppc64el': 'y'}>
+CONFIG_FSL_GUTS                                 policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_FSL_IFC                                  policy<{'arm64': 'y'}>
+CONFIG_FSL_IMX8_DDR_PMU                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_FSL_IMX9_DDR_PMU                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_FSL_LBC                                  policy<{'ppc64el': 'y'}>
+CONFIG_FSL_MC_BUS                               policy<{'arm64': 'y', 'armhf': 'n'}>
+CONFIG_FSL_MC_DPIO                              policy<{'arm64': 'm'}>
+CONFIG_FSL_MC_UAPI_SUPPORT                      policy<{'arm64': 'y'}>
+CONFIG_FSL_PQ_MDIO                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_FSL_QDMA                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_FSL_QMAN_TEST                            policy<{'arm64': 'n'}>
+CONFIG_FSL_RCPM                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_FSL_UCC_HDLC                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_FSL_XGMAC_MDIO                           policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_FSNOTIFY                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FS_DAX                                   policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_FS_DAX_LIMITED                           policy<{'s390x': 'y'}>
+CONFIG_FS_DAX_PMD                               policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_FS_ENCRYPTION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FS_ENCRYPTION_ALGS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FS_ENCRYPTION_INLINE_CRYPT               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FS_IOMAP                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FS_MBCACHE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FS_POSIX_ACL                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FS_STACK                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FS_VERITY                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FS_VERITY_BUILTIN_SIGNATURES             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FTGMAC100                                policy<{'armhf': 'm'}>
+CONFIG_FTL                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FTMAC100                                 policy<{'armhf': 'm'}>
+CONFIG_FTRACE                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FTRACE_MCOUNT_RECORD                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_FTRACE_MCOUNT_USE_CC                     policy<{'amd64': 'y', 's390x': 'y'}>
+CONFIG_FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY policy<{'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT           policy<{'armhf': 'y', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_FTRACE_RECORD_RECURSION                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_FTRACE_SORT_STARTUP_TEST                 policy<{'amd64': 'n', 'armhf': 'n'}>
+CONFIG_FTRACE_STARTUP_TEST                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FTRACE_SYSCALLS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FTR_FIXUP_SELFTEST                       policy<{'ppc64el': 'n'}>
+CONFIG_FTWDT010_WATCHDOG                        policy<{'armhf': 'm'}>
+CONFIG_FUEL_GAUGE_MM8013                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FUEL_GAUGE_SC27XX                        policy<{'arm64': 'm'}>
+CONFIG_FUJITSU_ERRATUM_010001                   policy<{'arm64': 'y'}>
+CONFIG_FUJITSU_ES                               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_FUJITSU_LAPTOP                           policy<{'amd64': 'm'}>
+CONFIG_FUJITSU_TABLET                           policy<{'amd64': 'm'}>
+CONFIG_FUNCTION_ALIGNMENT                       policy<{'amd64': '16', 'arm64': '8', 'armhf': '0', 'ppc64el': '4', 'riscv64': '0', 's390x': '8'}>
+CONFIG_FUNCTION_ALIGNMENT_16B                   policy<{'amd64': 'y'}>
+CONFIG_FUNCTION_ALIGNMENT_4B                    policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_FUNCTION_ALIGNMENT_8B                    policy<{'arm64': 'y', 's390x': 'y'}>
+CONFIG_FUNCTION_ERROR_INJECTION                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FUNCTION_GRAPH_RETVAL                    policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_FUNCTION_GRAPH_TRACER                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_FUNCTION_PADDING_BYTES                   policy<{'amd64': '16'}>
+CONFIG_FUNCTION_PADDING_CFI                     policy<{'amd64': '11'}>
+CONFIG_FUNCTION_PROFILER                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_FUNCTION_TRACER                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_FUN_CORE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FUN_ETH                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FUSE_DAX                                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_FUSION                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_FUSION_CTL                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FUSION_FC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FUSION_LAN                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FUSION_LOGGING                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FUSION_MAX_SGE                           policy<{'amd64': '128', 'arm64': '128', 'armhf': '128', 'ppc64el': '128', 'riscv64': '128'}>
+CONFIG_FUSION_SAS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FUSION_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_FUTEX                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FUTEX_PI                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FWNODE_MDIO                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FW_ATTR_CLASS                            policy<{'amd64': 'm'}>
+CONFIG_FW_CACHE                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_FW_CFG_SYSFS                             policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_FW_CFG_SYSFS_CMDLINE                     policy<{'amd64': 'n', 'arm64': 'n', 'riscv64': 'n'}>
+CONFIG_FW_CS_DSP                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_FW_LOADER                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FW_LOADER_COMPRESS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FW_LOADER_COMPRESS_XZ                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FW_LOADER_COMPRESS_ZSTD                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FW_LOADER_DEBUG                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FW_LOADER_PAGED_BUF                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FW_LOADER_SYSFS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FW_LOADER_USER_HELPER                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_FW_UPLOAD                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_FXAS21002C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FXAS21002C_I2C                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FXAS21002C_SPI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FXLS8962AF                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FXLS8962AF_I2C                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FXLS8962AF_SPI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FXOS8700                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FXOS8700_I2C                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_FXOS8700_SPI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GACT_PROB                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GADGET_UAC1                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GADGET_UAC1_LEGACY                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_GAMEPORT                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GAMEPORT_EMU10K1                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GAMEPORT_FM801                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GARP                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GART_IOMMU                               policy<{'amd64': 'y'}>
+CONFIG_GCC10_NO_ARRAY_BOUNDS                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GCC_NO_STRINGOP_OVERFLOW                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE              policy<{'riscv64': 'y'}>
+CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS    policy<{'arm64': 'y'}>
+CONFIG_GCC_VERSION                              policy<{'amd64': '130300', 'arm64': '130300', 'armhf': '130300', 'ppc64el': '130300', 'riscv64': '130300', 's390x': '130300'}>
+CONFIG_GCOV_KERNEL                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_GDB_SCRIPTS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GDS_FORCE_MITIGATION                     policy<{'amd64': 'n'}>
+CONFIG_GEMINI_ETHERNET                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GENERIC_ADC_BATTERY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GENERIC_ADC_THERMAL                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GENERIC_ALLOCATOR                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_ARCH_NUMA                        policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_ARCH_TOPOLOGY                    policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_BUG                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_CALIBRATE_DELAY                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_CLOCKEVENTS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST           policy<{'amd64': 'y'}>
+CONFIG_GENERIC_CMOS_UPDATE                      policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_GENERIC_CPU                              policy<{'amd64': 'y', 'ppc64el': '-'}>
+CONFIG_GENERIC_CPU_AUTOPROBE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_CPU_DEVICES                      policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_CPU_VULNERABILITIES              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_CSUM                             policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_EARLY_IOREMAP                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_ENTRY                            policy<{'amd64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_FRAMER                           policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_GETTIMEOFDAY                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_HWEIGHT                          policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_IDLE_POLL_SETUP                  policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_IOMAP                            policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_GENERIC_IOREMAP                          policy<{'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_IRQ_CHIP                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_IRQ_DEBUGFS                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_IRQ_IPI                          policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_IRQ_IPI_MUX                      policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_IRQ_MATRIX_ALLOCATOR             policy<{'amd64': 'y'}>
+CONFIG_GENERIC_IRQ_MIGRATION                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_IRQ_MULTI_HANDLER                policy<{'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_IRQ_PROBE                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_GENERIC_IRQ_RESERVATION_MODE             policy<{'amd64': 'y'}>
+CONFIG_GENERIC_IRQ_SHOW                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_IRQ_SHOW_LEVEL                   policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_ISA_DMA                          policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED            policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_MSI_IRQ                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_NET_UTILS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_PCI_IOMAP                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_PENDING_IRQ                      policy<{'amd64': 'y'}>
+CONFIG_GENERIC_PHY                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_GENERIC_PHY_MIPI_DPHY                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_PINCONF                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_PINCTRL_GROUPS                   policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_PINMUX_FUNCTIONS                 policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_PTDUMP                           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_SCHED_CLOCK                      policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_GENERIC_SMP_IDLE_THREAD                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_STRNCPY_FROM_USER                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_STRNLEN_USER                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_TIME_VSYSCALL                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_TRACER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENERIC_VDSO_32                          policy<{'armhf': 'y'}>
+CONFIG_GENERIC_VDSO_TIME_NS                     policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GENEVE                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GENWQE                                   policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GENWQE_PLATFORM_ERROR_RECOVERY           policy<{'amd64': '0', 'arm64': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_GEN_RTC                                  policy<{'ppc64el': 'y'}>
+CONFIG_GET_FREE_REGION                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GFS2_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GFS2_FS_LOCKING_DLM                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GIANFAR                                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_GIGABYTE_WMI                             policy<{'amd64': 'm'}>
+CONFIG_GLOB                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GLOB_SELFTEST                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_GNSS                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GNSS_MTK_SERIAL                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GNSS_SERIAL                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GNSS_SIRF_SERIAL                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GNSS_UBX_SERIAL                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GNSS_USB                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GOLDFISH                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_GOLDFISH_PIPE                            policy<{'riscv64': 'm'}>
+CONFIG_GOLDFISH_TTY                             policy<{'riscv64': 'm'}>
+CONFIG_GOOGLE_FIRMWARE                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_GP2AP002                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GP2AP020A00F                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPD_POCKET_FAN                           policy<{'amd64': 'm'}>
+CONFIG_GPIOLIB                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GPIOLIB_FASTPATH_LIMIT                   policy<{'amd64': '512', 'arm64': '512', 'armhf': '512', 'ppc64el': '512', 'riscv64': '512', 's390x': '512'}>
+CONFIG_GPIOLIB_IRQCHIP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GPIO_104_DIO_48E                         policy<{'amd64': 'm'}>
+CONFIG_GPIO_104_IDIO_16                         policy<{'amd64': 'm'}>
+CONFIG_GPIO_104_IDI_48                          policy<{'amd64': 'm'}>
+CONFIG_GPIO_74X164                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_74XX_MMIO                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_AAEON                               policy<{'amd64': 'm'}>
+CONFIG_GPIO_ACPI                                policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_ADNP                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_ADP5520                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_AGGREGATOR                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GPIO_ALTERA                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_ALTERA_A10SR                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_GPIO_AMD8111                             policy<{'amd64': 'm'}>
+CONFIG_GPIO_AMDPT                               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_AMD_FCH                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_ARIZONA                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_ASPEED                              policy<{'armhf': 'm'}>
+CONFIG_GPIO_ASPEED_SGPIO                        policy<{'armhf': 'y'}>
+CONFIG_GPIO_BD71815                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_BD71828                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_BD9571MWV                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_BT8XX                               policy<{'s390x': 'm'}>
+CONFIG_GPIO_CADENCE                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_CDEV                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GPIO_CRYSTAL_COVE                        policy<{'amd64': 'y'}>
+CONFIG_GPIO_DA9052                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_DA9055                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_DAVINCI                             policy<{'arm64': 'y'}>
+CONFIG_GPIO_DLN2                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_DS4520                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GPIO_DWAPB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_EIC_SPRD                            policy<{'arm64': 'm'}>
+CONFIG_GPIO_ELKHARTLAKE                         policy<{'amd64': 'm'}>
+CONFIG_GPIO_EN7523                              policy<{'armhf': 'm'}>
+CONFIG_GPIO_EXAR                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_F7188X                              policy<{'amd64': 'm'}>
+CONFIG_GPIO_FTGPIO010                           policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_FXL6408                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_GENERIC                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_GPIO_GENERIC_PLATFORM                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_GPIO_GPIO_MM                             policy<{'amd64': 'm'}>
+CONFIG_GPIO_GRGPIO                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_GW_PLD                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_HISI                                policy<{'arm64': 'm'}>
+CONFIG_GPIO_HLWD                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_I8255                               policy<{'amd64': 'm'}>
+CONFIG_GPIO_ICH                                 policy<{'amd64': 'm'}>
+CONFIG_GPIO_IDIO_16                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GPIO_IMX_SCU                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_GPIO_IT87                                policy<{'amd64': 'm'}>
+CONFIG_GPIO_JANZ_TTL                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_KEMPLD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_LATCH                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_LJCA                                policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_LOGICVC                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_LP3943                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_LP873X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_LP87565                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_MADERA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_MAX3191X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_MAX7300                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_MAX7301                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_MAX730X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_MAX732X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_MAX77620                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_MAX77650                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_MB86S7X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_MC33880                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_MENZ127                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_MLXBF                               policy<{'arm64': 'm'}>
+CONFIG_GPIO_MLXBF2                              policy<{'arm64': 'm'}>
+CONFIG_GPIO_MLXBF3                              policy<{'arm64': 'm'}>
+CONFIG_GPIO_ML_IOH                              policy<{'amd64': 'm'}>
+CONFIG_GPIO_MOCKUP                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_GPIO_MOXTET                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_MPC8XXX                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_GPIO_MSC313                              policy<{'armhf': 'y'}>
+CONFIG_GPIO_MVEBU                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_GPIO_MXC                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_GPIO_NPCM_SGPIO                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_GPIO_OMAP                                policy<{'armhf': 'y'}>
+CONFIG_GPIO_PALMAS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_PCA953X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_PCA953X_IRQ                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_PCA9570                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_PCF857X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_PCIE_IDIO_24                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GPIO_PCI_IDIO_16                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GPIO_PISOSR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_PL061                               policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'm'}>
+CONFIG_GPIO_PMIC_EIC_SPRD                       policy<{'arm64': 'm'}>
+CONFIG_GPIO_RC5T583                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_RCAR                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_RDA                                 policy<{'armhf': 'y'}>
+CONFIG_GPIO_RDC321X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_REGMAP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GPIO_ROCKCHIP                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_GPIO_RTD                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_GPIO_SCH                                 policy<{'amd64': 'm'}>
+CONFIG_GPIO_SCH311X                             policy<{'amd64': 'm'}>
+CONFIG_GPIO_SIFIVE                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_SIM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GPIO_SIOX                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_SL28CPLD                            policy<{'arm64': 'm'}>
+CONFIG_GPIO_SPRD                                policy<{'arm64': 'm'}>
+CONFIG_GPIO_STMPE                               policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_SYSCON                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_SYSFS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GPIO_TANGIER                             policy<{'amd64': 'm'}>
+CONFIG_GPIO_TC3589X                             policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_TEGRA                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_GPIO_TEGRA186                            policy<{'arm64': 'y'}>
+CONFIG_GPIO_THUNDERX                            policy<{'arm64': 'm'}>
+CONFIG_GPIO_TPIC2810                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_TPS65086                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_TPS65218                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_TPS65219                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_TPS6586X                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_TPS65910                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GPIO_TPS65912                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_TPS68470                            policy<{'amd64': 'm'}>
+CONFIG_GPIO_TQMX86                              policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_TS4800                              policy<{'armhf': 'm'}>
+CONFIG_GPIO_TS4900                              policy<{'armhf': 'm'}>
+CONFIG_GPIO_TWL6040                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_VF610                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_GPIO_VIPERBOARD                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_VIRTIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GPIO_VISCONTI                            policy<{'arm64': 'm'}>
+CONFIG_GPIO_VX855                               policy<{'amd64': 'm'}>
+CONFIG_GPIO_WATCHDOG                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_WCD934X                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_WHISKEY_COVE                        policy<{'amd64': 'm'}>
+CONFIG_GPIO_WINBOND                             policy<{'amd64': 'm'}>
+CONFIG_GPIO_WM831X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_WM8350                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_WM8994                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GPIO_WS16C48                             policy<{'amd64': 'm'}>
+CONFIG_GPIO_XGENE                               policy<{'arm64': 'y'}>
+CONFIG_GPIO_XGENE_SB                            policy<{'arm64': 'm'}>
+CONFIG_GPIO_XILINX                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'n'}>
+CONFIG_GPIO_XLP                                 policy<{'arm64': 'm'}>
+CONFIG_GPIO_XRA1403                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GPIO_ZEVIO                               policy<{'armhf': 'y'}>
+CONFIG_GPIO_ZYNQ                                policy<{'arm64': 'm'}>
+CONFIG_GPIO_ZYNQMP_MODEPIN                      policy<{'arm64': 'm'}>
+CONFIG_GP_PCI1XXXX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_GRACE_PERIOD                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GREENASIA_FF                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_GREYBUS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_GREYBUS_AUDIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_AUDIO_APB_CODEC                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_BEAGLEPLAY                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_BOOTROM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_BRIDGED_PHY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_ES2                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_FIRMWARE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_GPIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_HID                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_LIGHT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_LOG                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_LOOPBACK                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_POWER                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_PWM                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_RAW                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_SDIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_UART                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_USB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GREYBUS_VIBRATOR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_GRO_CELLS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_GTP                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_GUEST_PERF_EVENTS                        policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_GUP_TEST                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_GVE                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_GXP_TIMER                                policy<{'armhf': 'y'}>
+CONFIG_GXP_WATCHDOG                             policy<{'armhf': 'm'}>
+CONFIG_HALTPOLL_CPUIDLE                         policy<{'amd64': 'm'}>
+CONFIG_HAMACHI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HAMRADIO                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HANGCHECK_TIMER                          policy<{'amd64': 'm', 'ppc64el': 'm', 's390x': 'm'}>
+CONFIG_HAPPYMEAL                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HARDENED_USERCOPY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HARDEN_BRANCH_HISTORY                    policy<{'armhf': 'y'}>
+CONFIG_HARDEN_BRANCH_PREDICTOR                  policy<{'armhf': 'y'}>
+CONFIG_HARDIRQS_SW_RESEND                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HARDLOCKUP_CHECK_TIMESTAMP               policy<{'amd64': 'y'}>
+CONFIG_HARDLOCKUP_DETECTOR                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HARDLOCKUP_DETECTOR_ARCH                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'n'}>
+CONFIG_HARDLOCKUP_DETECTOR_BUDDY                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'y'}>
+CONFIG_HARDLOCKUP_DETECTOR_COUNTS_HRTIMER       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_HARDLOCKUP_DETECTOR_PERF                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY         policy<{'amd64': 'n', 'arm64': 'n'}>
+CONFIG_HAS_DMA                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAS_IOMEM                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAS_IOPORT                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAS_IOPORT_MAP                           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_64BIT_ALIGNED_ACCESS                policy<{'riscv64': 'y'}>
+CONFIG_HAVE_ACPI_APEI                           policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_HAVE_ACPI_APEI_NMI                       policy<{'amd64': 'y'}>
+CONFIG_HAVE_ALIGNED_STRUCT_PAGE                 policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_AUDITSYSCALL                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_BITREVERSE                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES              policy<{'amd64': 'y'}>
+CONFIG_HAVE_ARCH_COMPILER_H                     policy<{'arm64': 'y'}>
+CONFIG_HAVE_ARCH_HUGE_VMALLOC                   policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_ARCH_HUGE_VMAP                      policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_ARCH_JUMP_LABEL                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_KASAN                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_KASAN_HW_TAGS                  policy<{'arm64': 'y'}>
+CONFIG_HAVE_ARCH_KASAN_SW_TAGS                  policy<{'arm64': 'y'}>
+CONFIG_HAVE_ARCH_KASAN_VMALLOC                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_KCSAN                          policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_KFENCE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_KGDB                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_ARCH_KGDB_QXFER_PKT                 policy<{'riscv64': 'y'}>
+CONFIG_HAVE_ARCH_KMSAN                          policy<{'amd64': 'y'}>
+CONFIG_HAVE_ARCH_MMAP_RND_BITS                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS           policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'ppc64el': '-'}>
+CONFIG_HAVE_ARCH_NODE_DEV_GROUP                 policy<{'amd64': 'y'}>
+CONFIG_HAVE_ARCH_NVRAM_OPS                      policy<{'ppc64el': 'y'}>
+CONFIG_HAVE_ARCH_PFN_VALID                      policy<{'armhf': 'y'}>
+CONFIG_HAVE_ARCH_PREL32_RELOCATIONS             policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET        policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_SECCOMP                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_SECCOMP_FILTER                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_SOFT_DIRTY                     policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_STACKLEAK                      policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_ARCH_TRACEHOOK                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD       policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_ARCH_USERFAULTFD_MINOR              policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_ARCH_USERFAULTFD_WP                 policy<{'amd64': 'y'}>
+CONFIG_HAVE_ARCH_VMAP_STACK                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES            policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_ARM_ARCH_TIMER                      policy<{'armhf': 'y'}>
+CONFIG_HAVE_ARM_SCU                             policy<{'armhf': 'y'}>
+CONFIG_HAVE_ARM_SMCCC                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_HAVE_ARM_SMCCC_DISCOVERY                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_HAVE_ARM_TWD                             policy<{'armhf': 'y'}>
+CONFIG_HAVE_ASM_MODVERSIONS                     policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_BOOTMEM_INFO_NODE                   policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_BUILDTIME_MCOUNT_SORT               policy<{'amd64': 'y', 'armhf': 'y'}>
+CONFIG_HAVE_CALL_THUNKS                         policy<{'amd64': 'y'}>
+CONFIG_HAVE_CLK                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_CLK_PREPARE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_CMPXCHG_DOUBLE                      policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_CMPXCHG_LOCAL                       policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_CONTEXT_TRACKING_USER               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_CONTEXT_TRACKING_USER_OFFSTACK      policy<{'amd64': 'y'}>
+CONFIG_HAVE_C_RECORDMCOUNT                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_DEBUG_KMEMLEAK                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_DEBUG_STACKOVERFLOW                 policy<{'ppc64el': 'y'}>
+CONFIG_HAVE_DMA_CONTIGUOUS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_DYNAMIC_FTRACE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE         policy<{'amd64': 'y'}>
+CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS        policy<{'arm64': 'y'}>
+CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS    policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS            policy<{'amd64': 'y', 'arm64': '-', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_EBPF_JIT                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_EISA                                policy<{'amd64': 'y'}>
+CONFIG_HAVE_EXIT_THREAD                         policy<{'amd64': 'y', 'armhf': 'y'}>
+CONFIG_HAVE_FAST_GUP                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_FENTRY                              policy<{'amd64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_FUNCTION_ARG_ACCESS_API             policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_FUNCTION_ERROR_INJECTION            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_FUNCTION_GRAPH_RETVAL               policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_FUNCTION_TRACER                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_HAVE_GCC_PLUGINS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_GENERIC_VDSO                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_HARDLOCKUP_DETECTOR_ARCH            policy<{'ppc64el': 'y'}>
+CONFIG_HAVE_HARDLOCKUP_DETECTOR_BUDDY           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_HARDLOCKUP_DETECTOR_PERF            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_HW_BREAKPOINT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_IMA_KEXEC                           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_IMX_ANATOP                          policy<{'armhf': 'y'}>
+CONFIG_HAVE_IMX_GPC                             policy<{'armhf': 'y'}>
+CONFIG_HAVE_IMX_MMDC                            policy<{'armhf': 'y'}>
+CONFIG_HAVE_IMX_SRC                             policy<{'armhf': 'y'}>
+CONFIG_HAVE_INTEL_TXT                           policy<{'amd64': 'y'}>
+CONFIG_HAVE_IOREMAP_PROT                        policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK               policy<{'amd64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_IRQ_TIME_ACCOUNTING                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_JUMP_LABEL_HACK                     policy<{'amd64': 'y'}>
+CONFIG_HAVE_KCSAN_COMPILER                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KERNEL_BZIP2                        policy<{'amd64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KERNEL_GZIP                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_HAVE_KERNEL_LZ4                          policy<{'amd64': 'y', 'arm64': '-', 'armhf': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_HAVE_KERNEL_LZMA                         policy<{'amd64': 'y', 'arm64': '-', 'armhf': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_HAVE_KERNEL_LZO                          policy<{'amd64': 'y', 'arm64': '-', 'armhf': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_HAVE_KERNEL_UNCOMPRESSED                 policy<{'s390x': 'y'}>
+CONFIG_HAVE_KERNEL_XZ                           policy<{'amd64': 'y', 'arm64': '-', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_HAVE_KERNEL_ZSTD                         policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_HAVE_KPROBES                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KPROBES_ON_FTRACE                   policy<{'amd64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KRETPROBES                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KVM                                 policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT             policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KVM_DIRTY_RING                      policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_HAVE_KVM_DIRTY_RING_ACQ_REL              policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_HAVE_KVM_DIRTY_RING_TSO                  policy<{'amd64': 'y'}>
+CONFIG_HAVE_KVM_INVALID_WAKEUPS                 policy<{'s390x': 'y'}>
+CONFIG_HAVE_KVM_IRQCHIP                         policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KVM_IRQ_BYPASS                      policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_KVM_IRQ_ROUTING                     policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KVM_MSI                             policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_KVM_NO_POLL                         policy<{'amd64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KVM_PFNCACHE                        policy<{'amd64': 'y'}>
+CONFIG_HAVE_KVM_PM_NOTIFIER                     policy<{'amd64': 'y'}>
+CONFIG_HAVE_KVM_VCPU_ASYNC_IOCTL                policy<{'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE             policy<{'arm64': 'y'}>
+CONFIG_HAVE_LD_DEAD_CODE_DATA_ELIMINATION       policy<{'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_LIVEPATCH                           policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_MARCH_Z10_FEATURES                  policy<{'s390x': 'y'}>
+CONFIG_HAVE_MARCH_Z13_FEATURES                  policy<{'s390x': 'y'}>
+CONFIG_HAVE_MARCH_Z196_FEATURES                 policy<{'s390x': 'y'}>
+CONFIG_HAVE_MARCH_ZEC12_FEATURES                policy<{'s390x': 'y'}>
+CONFIG_HAVE_MEMBLOCK_PHYS_MAP                   policy<{'s390x': 'y'}>
+CONFIG_HAVE_MEMORYLESS_NODES                    policy<{'ppc64el': 'y'}>
+CONFIG_HAVE_MIXED_BREAKPOINTS_REGS              policy<{'amd64': 'y'}>
+CONFIG_HAVE_MMIOTRACE_SUPPORT                   policy<{'amd64': 'y'}>
+CONFIG_HAVE_MOD_ARCH_SPECIFIC                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_MOVE_PMD                            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_MOVE_PUD                            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_NMI                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_NOINSTR_HACK                        policy<{'amd64': 'y'}>
+CONFIG_HAVE_NOINSTR_VALIDATION                  policy<{'amd64': 'y'}>
+CONFIG_HAVE_NOP_MCOUNT                          policy<{'s390x': 'y'}>
+CONFIG_HAVE_OBJTOOL                             policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_OBJTOOL_MCOUNT                      policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_OBJTOOL_NOP_MCOUNT                  policy<{'amd64': 'y'}>
+CONFIG_HAVE_OPTPROBES                           policy<{'amd64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_PCI                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_PCSPKR_PLATFORM                     policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_PERF_EVENTS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_PERF_EVENTS_NMI                     policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_HAVE_PERF_REGS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_PERF_USER_STACK_DUMP                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_PNETID                              policy<{'s390x': 'm'}>
+CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK          policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_PREEMPT_DYNAMIC                     policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_PREEMPT_DYNAMIC_CALL                policy<{'amd64': 'y'}>
+CONFIG_HAVE_PREEMPT_DYNAMIC_KEY                 policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_PROC_CPU                            policy<{'armhf': 'y'}>
+CONFIG_HAVE_REGS_AND_STACK_ACCESS_API           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_RELIABLE_STACKTRACE                 policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_RETHOOK                             policy<{'amd64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_RSEQ                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_RUST                                policy<{'amd64': 'y'}>
+CONFIG_HAVE_SAMPLE_FTRACE_DIRECT                policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_SAMPLE_FTRACE_DIRECT_MULTI          policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_SCHED_AVG_IRQ                       policy<{'ppc64el': 'y'}>
+CONFIG_HAVE_SETUP_PER_CPU_AREA                  policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_SMP                                 policy<{'armhf': 'y'}>
+CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_STACKPROTECTOR                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HAVE_STACK_VALIDATION                    policy<{'amd64': 'y'}>
+CONFIG_HAVE_STATIC_CALL                         policy<{'amd64': 'y'}>
+CONFIG_HAVE_STATIC_CALL_INLINE                  policy<{'amd64': 'y'}>
+CONFIG_HAVE_SYSCALL_TRACEPOINTS                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_UACCESS_VALIDATION                  policy<{'amd64': 'y'}>
+CONFIG_HAVE_UID16                               policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'armhf': 'y', 's390x': '-'}>
+CONFIG_HAVE_UNSTABLE_SCHED_CLOCK                policy<{'amd64': 'y'}>
+CONFIG_HAVE_USER_RETURN_NOTIFIER                policy<{'amd64': 'y'}>
+CONFIG_HAVE_VIRT_CPU_ACCOUNTING                 policy<{'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HAVE_VIRT_CPU_ACCOUNTING_IDLE            policy<{'s390x': 'y'}>
+CONFIG_HBMC_AM654                               policy<{'arm64': 'm'}>
+CONFIG_HCALL_STATS                              policy<{'ppc64el': 'n'}>
+CONFIG_HD44780                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HD44780_COMMON                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDC100X                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDC2010                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDC3020                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDLC                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HDLC_CISCO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDLC_FR                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDLC_PPP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDLC_RAW                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDLC_RAW_ETH                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDLC_X25                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HDMI                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HDMI_LPE_AUDIO                           policy<{'amd64': 'm'}>
+CONFIG_HDQ_MASTER_OMAP                          policy<{'armhf': 'm'}>
+CONFIG_HEADERS_INSTALL                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_HFI1_DEBUG_SDMA_ORDER                    policy<{'amd64': 'n'}>
+CONFIG_HFSPLUS_FS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HFS_FS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HI13X1_GMAC                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_HI3660_MBOX                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HI6220_MBOX                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HI6421V600_IRQ                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HI8435                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HIBERNATE_CALLBACKS                      policy<{'amd64': 'y', 'armhf': 'y', 'riscv64': '-'}>
+CONFIG_HIBERNATION_SNAPSHOT_DEV                 policy<{'amd64': 'y', 'armhf': 'y', 'riscv64': '-'}>
+CONFIG_HID                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HIDRAW                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_HID_A4TECH                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_ACCUTOUCH                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_ACRUX                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_ACRUX_FF                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HID_ALPS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_APPLE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_APPLEIR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_ASUS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_AUREAL                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_BATTERY_STRENGTH                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_HID_BELKIN                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_BETOP_FF                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_BIGBEN_FF                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_BPF                                  policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_HID_CHERRY                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_CHICONY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_CMEDIA                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_CORSAIR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_COUGAR                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_CP2112                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_CREATIVE_SB0540                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_CYPRESS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_DRAGONRISE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_ELAN                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_ELECOM                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_ELO                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_EMS_FF                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_EVISION                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_EZKEY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_FT260                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_GEMBIRD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_GENERIC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_GFRM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_GLORIOUS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_GOOGLE_HAMMER                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HID_GOOGLE_STADIA_FF                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_GREENASIA                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_GT683R                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_GYRATION                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_HOLTEK                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_HYPERV_MOUSE                         policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HID_ICADE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_ITE                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_JABRA                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_KENSINGTON                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_KEYTOUCH                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_KYE                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_LCPOWER                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_LED                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_LENOVO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_LETSKETCH                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_LOGITECH                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_LOGITECH_DJ                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_LOGITECH_HIDPP                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_MACALLY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_MAGICMOUSE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_MALTRON                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_MAYFLASH                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_MCP2200                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_MCP2221                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_MEGAWORLD_FF                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_MICROSOFT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_MONTEREY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_MULTITOUCH                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_NINTENDO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_NTI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_NTRIG                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_NVIDIA_SHIELD                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_ORTEK                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_PANTHERLORD                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_PENMOUNT                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_PETALYNX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_PICOLCD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_PICOLCD_BACKLIGHT                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HID_PICOLCD_CIR                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HID_PICOLCD_FB                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HID_PICOLCD_LCD                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HID_PICOLCD_LEDS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HID_PID                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HID_PLANTRONICS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_PLAYSTATION                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_PRIMAX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_PRODIKEYS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_PXRC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_RAZER                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_REDRAGON                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_RETRODE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_RMI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_ROCCAT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SAITEK                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_SAMSUNG                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SEMITEK                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_SENSOR_ACCEL_3D                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_ALS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_CUSTOM_INTEL_HINGE            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_CUSTOM_SENSOR                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_DEVICE_ROTATION               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_GYRO_3D                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_HUB                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_SENSOR_HUMIDITY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_IIO_COMMON                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_IIO_TRIGGER                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_INCLINOMETER_3D               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_MAGNETOMETER_3D               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_PRESS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_PROX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SENSOR_TEMP                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SIGMAMICRO                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SMARTJOYPLUS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_SONY                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_SPEEDLINK                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_STEAM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_STEELSERIES                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_SUNPLUS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_SUPPORT                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_HID_THINGM                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_THRUSTMASTER                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_TIVO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_TOPRE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_TOPSEED                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_TWINHAN                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_U2FZERO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_UCLOGIC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_UDRAW_PS3                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_VIEWSONIC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_VIVALDI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_VIVALDI_COMMON                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_VRC2                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_WACOM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_WALTOP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_WIIMOTE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_XIAOMI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HID_XINMO                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_ZEROPLUS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HID_ZYDACRON                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HIGHMEM                                  policy<{'armhf': 'y'}>
+CONFIG_HIGHPTE                                  policy<{'armhf': 'y'}>
+CONFIG_HIGH_RES_TIMERS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HINIC                                    policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HIP04_ETH                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HIPPI                                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_HISILICON_ERRATUM_161010101              policy<{'arm64': 'y'}>
+CONFIG_HISILICON_ERRATUM_161600802              policy<{'arm64': 'y'}>
+CONFIG_HISILICON_ERRATUM_162100801              policy<{'arm64': 'y'}>
+CONFIG_HISILICON_IRQ_MBIGEN                     policy<{'arm64': 'y'}>
+CONFIG_HISILICON_LPC                            policy<{'arm64': 'y'}>
+CONFIG_HISI_ACC_VFIO_PCI                        policy<{'arm64': 'm'}>
+CONFIG_HISI_DMA                                 policy<{'arm64': 'n', 'armhf': 'm'}>
+CONFIG_HISI_FEMAC                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HISI_HIKEY_USB                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'n'}>
+CONFIG_HISI_PCIE_PMU                            policy<{'arm64': 'm'}>
+CONFIG_HISI_PMU                                 policy<{'arm64': 'm'}>
+CONFIG_HISI_PTT                                 policy<{'arm64': 'm'}>
+CONFIG_HISI_THERMAL                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HIST_TRIGGERS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_HIST_TRIGGERS_DEBUG                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_HIX5HD2_GMAC                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HMC425                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HMC6352                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HMC_DRV                                  policy<{'s390x': 'm'}>
+CONFIG_HMEM_REPORTING                           policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_HMM_MIRROR                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HMS_ANYBUSS_BUS                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HMS_PROFINET                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HNS                                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HNS3                                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HNS3_DCB                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_HNS3_ENET                                policy<{'arm64': 'm'}>
+CONFIG_HNS3_HCLGE                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HNS3_HCLGEVF                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HNS3_PMU                                 policy<{'arm64': 'm'}>
+CONFIG_HNS_DSAF                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HNS_ENET                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HNS_MDIO                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HOLTEK_FF                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HOTPLUG_CORE_SYNC                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_HOTPLUG_CORE_SYNC_DEAD                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_HOTPLUG_CORE_SYNC_FULL                   policy<{'amd64': 'y'}>
+CONFIG_HOTPLUG_CPU                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HOTPLUG_PARALLEL                         policy<{'amd64': 'y'}>
+CONFIG_HOTPLUG_PCI                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HOTPLUG_PCI_ACPI                         policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_HOTPLUG_PCI_ACPI_AMPERE_ALTRA            policy<{'arm64': 'm'}>
+CONFIG_HOTPLUG_PCI_ACPI_IBM                     policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_HOTPLUG_PCI_CPCI                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HOTPLUG_PCI_CPCI_GENERIC                 policy<{'amd64': 'm'}>
+CONFIG_HOTPLUG_PCI_CPCI_ZT5550                  policy<{'amd64': 'm'}>
+CONFIG_HOTPLUG_PCI_POWERNV                      policy<{'ppc64el': 'm'}>
+CONFIG_HOTPLUG_PCI_RPA                          policy<{'ppc64el': 'm'}>
+CONFIG_HOTPLUG_PCI_RPA_DLPAR                    policy<{'ppc64el': 'm'}>
+CONFIG_HOTPLUG_PCI_S390                         policy<{'s390x': 'y'}>
+CONFIG_HOTPLUG_SMT                              policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_HOTPLUG_SPLIT_STARTUP                    policy<{'amd64': 'y'}>
+CONFIG_HP03                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HP206C                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HPET                                     policy<{'amd64': 'y'}>
+CONFIG_HPET_EMULATE_RTC                         policy<{'amd64': 'y'}>
+CONFIG_HPET_MMAP                                policy<{'amd64': 'y'}>
+CONFIG_HPET_MMAP_DEFAULT                        policy<{'amd64': 'y'}>
+CONFIG_HPET_TIMER                               policy<{'amd64': 'y'}>
+CONFIG_HPFS_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HPWDT_NMI_DECODING                       policy<{'amd64': 'y'}>
+CONFIG_HP_ACCEL                                 policy<{'amd64': 'm'}>
+CONFIG_HP_BIOSCFG                               policy<{'amd64': 'm'}>
+CONFIG_HP_ILO                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HP_WATCHDOG                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HP_WMI                                   policy<{'amd64': 'm'}>
+CONFIG_HSA_AMD                                  policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_HSA_AMD_SVM                              policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_HSC030PA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HSC030PA_I2C                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HSC030PA_SPI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HSI                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HSI_BOARDINFO                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_HSI_CHAR                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HSR                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HT16K33                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_HTC_EGPIO                                policy<{'armhf': 'y'}>
+CONFIG_HTE                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_HTE_TEGRA194                             policy<{'arm64': 'm'}>
+CONFIG_HTE_TEGRA194_TEST                        policy<{'arm64': 'm'}>
+CONFIG_HTS221                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HTS221_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HTS221_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HTU21                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HUAWEI_WMI                               policy<{'amd64': 'm'}>
+CONFIG_HUGETLBFS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HUGETLB_PAGE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP            policy<{'amd64': 'y', 'arm64': '-', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON policy<{'amd64': 'n', 'arm64': '-', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_HUGETLB_PAGE_SIZE_VARIABLE               policy<{'ppc64el': 'y'}>
+CONFIG_HVCS                                     policy<{'ppc64el': 'm'}>
+CONFIG_HVC_CONSOLE                              policy<{'ppc64el': 'y'}>
+CONFIG_HVC_DCC                                  policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_HVC_DRIVER                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HVC_IRQ                                  policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_HVC_IUCV                                 policy<{'s390x': 'y'}>
+CONFIG_HVC_OLD_HVSI                             policy<{'ppc64el': 'y'}>
+CONFIG_HVC_OPAL                                 policy<{'ppc64el': 'y'}>
+CONFIG_HVC_RTAS                                 policy<{'ppc64el': 'y'}>
+CONFIG_HVC_XEN                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_HVC_XEN_FRONTEND                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_HV_PERF_CTRS                             policy<{'ppc64el': 'y'}>
+CONFIG_HWLAT_TRACER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HWMON                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_HWMON_DEBUG_CHIP                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_HWMON_VID                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HWPOISON_INJECT                          policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm'}>
+CONFIG_HWSPINLOCK                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_HWSPINLOCK_OMAP                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HWSPINLOCK_QCOM                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HWSPINLOCK_SPRD                          policy<{'arm64': 'm'}>
+CONFIG_HWSPINLOCK_SUN6I                         policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_HW_CONSOLE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HW_PERF_EVENTS                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_HW_RANDOM                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HW_RANDOM_AMD                            policy<{'amd64': 'm'}>
+CONFIG_HW_RANDOM_ARM_SMCCC_TRNG                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HW_RANDOM_BA431                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_HW_RANDOM_CAVIUM                         policy<{'arm64': 'm'}>
+CONFIG_HW_RANDOM_CCTRNG                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'm'}>
+CONFIG_HW_RANDOM_CN10K                          policy<{'arm64': 'm'}>
+CONFIG_HW_RANDOM_EXYNOS                         policy<{'armhf': 'n'}>
+CONFIG_HW_RANDOM_HISI                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HW_RANDOM_HISTB                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HW_RANDOM_IMX_RNGC                       policy<{'armhf': 'm'}>
+CONFIG_HW_RANDOM_INTEL                          policy<{'amd64': 'm'}>
+CONFIG_HW_RANDOM_JH7110                         policy<{'riscv64': 'm'}>
+CONFIG_HW_RANDOM_MESON                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HW_RANDOM_MTK                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HW_RANDOM_NPCM                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HW_RANDOM_OMAP                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HW_RANDOM_OPTEE                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_HW_RANDOM_POLARFIRE_SOC                  policy<{'riscv64': 'm'}>
+CONFIG_HW_RANDOM_POWERNV                        policy<{'ppc64el': 'm'}>
+CONFIG_HW_RANDOM_PSERIES                        policy<{'ppc64el': 'm'}>
+CONFIG_HW_RANDOM_S390                           policy<{'s390x': 'm'}>
+CONFIG_HW_RANDOM_STM32                          policy<{'arm64': 'm'}>
+CONFIG_HW_RANDOM_TIMERIOMEM                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HW_RANDOM_TPM                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_HW_RANDOM_VIA                            policy<{'amd64': 'm'}>
+CONFIG_HW_RANDOM_VIRTIO                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_HW_RANDOM_XGENE                          policy<{'arm64': 'm'}>
+CONFIG_HW_RANDOM_XIPHERA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_HX711                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_HYPERV                                   policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HYPERVISOR_GUEST                         policy<{'amd64': 'y'}>
+CONFIG_HYPERV_BALLOON                           policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HYPERV_IOMMU                             policy<{'amd64': 'y'}>
+CONFIG_HYPERV_KEYBOARD                          policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HYPERV_NET                               policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HYPERV_STORAGE                           policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HYPERV_TESTING                           policy<{'amd64': 'n', 'arm64': 'n'}>
+CONFIG_HYPERV_TIMER                             policy<{'amd64': 'y'}>
+CONFIG_HYPERV_UTILS                             policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HYPERV_VSOCKETS                          policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_HYPERV_VTL_MODE                          policy<{'amd64': 'n'}>
+CONFIG_HZ                                       policy<{'amd64': '1000', 'arm64': '1000', 'armhf': '250', 'ppc64el': '250', 'riscv64': '250', 's390x': '100'}>
+CONFIG_HZ_200                                   policy<{'armhf': 'n'}>
+CONFIG_HZ_300                                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_HZ_500                                   policy<{'armhf': 'n'}>
+CONFIG_HZ_FIXED                                 policy<{'armhf': '0'}>
+CONFIG_HZ_PERIODIC                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_I2C                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_I2CR_SCOM                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_ALGOBIT                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_I2C_ALGOPCA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_ALI1535                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_ALI1563                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_ALI15X3                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_ALTERA                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_AMD756                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_AMD756_S4882                         policy<{'amd64': 'm'}>
+CONFIG_I2C_AMD8111                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_AMD_MP2                              policy<{'amd64': 'm', 'arm64': 'n', 'riscv64': 'n'}>
+CONFIG_I2C_APPLE                                policy<{'arm64': 'm'}>
+CONFIG_I2C_ARB_GPIO_CHALLENGE                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_ASPEED                               policy<{'armhf': 'm'}>
+CONFIG_I2C_ATR                                  policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_I2C_AXXIA                                policy<{'armhf': 'm'}>
+CONFIG_I2C_BOARDINFO                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_I2C_CADENCE                              policy<{'arm64': 'n'}>
+CONFIG_I2C_CBUS_GPIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_CCGX_UCSI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_CHT_WC                               policy<{'amd64': 'm'}>
+CONFIG_I2C_COMPAT                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_I2C_CP2615                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_I2C_CROS_EC_TUNNEL                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_DEBUG_ALGO                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_I2C_DEBUG_BUS                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_I2C_DEBUG_CORE                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_I2C_DEMUX_PINCTRL                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_DESIGNWARE_BAYTRAIL                  policy<{'amd64': 'y'}>
+CONFIG_I2C_DESIGNWARE_CORE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_I2C_DESIGNWARE_PCI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_DESIGNWARE_PLATFORM                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_I2C_DESIGNWARE_SLAVE                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_I2C_DIOLAN_U2C                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_I2C_DLN2                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_EMEV2                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_I2C_EXYNOS5                              policy<{'armhf': 'n'}>
+CONFIG_I2C_FSI                                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_GPIO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_GPIO_FAULT_INJECTOR                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_I2C_GXP                                  policy<{'armhf': 'm'}>
+CONFIG_I2C_HELPER_AUTO                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_I2C_HID                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_HID_ACPI                             policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_HID_CORE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_HID_OF                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_HID_OF_ELAN                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_HID_OF_GOODIX                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_HISI                                 policy<{'arm64': 'm'}>
+CONFIG_I2C_HIX5HD2                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_I801                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_IMX                                  policy<{'arm64': 'm', 'armhf': 'y'}>
+CONFIG_I2C_IMX_LPI2C                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_ISCH                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_ISMT                                 policy<{'amd64': 'm'}>
+CONFIG_I2C_KEMPLD                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_LJCA                                 policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_MESON                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_MICROCHIP_CORE                       policy<{'riscv64': 'm'}>
+CONFIG_I2C_MLXBF                                policy<{'arm64': 'm'}>
+CONFIG_I2C_MLXCPLD                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_I2C_MPC                                  policy<{'ppc64el': 'm'}>
+CONFIG_I2C_MT65XX                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_MUX                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_I2C_MUX_GPIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_MUX_GPMUX                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_MUX_LTC4306                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_MUX_MLXCPLD                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_MUX_PCA9541                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_MUX_PCA954x                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_MUX_PINCTRL                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_MUX_REG                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_MV64XXX                              policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_NFORCE2                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_NFORCE2_S4985                        policy<{'amd64': 'm'}>
+CONFIG_I2C_NOMADIK                              policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_NPCM                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_NVIDIA_GPU                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_OCORES                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_OMAP                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_I2C_OPAL                                 policy<{'ppc64el': 'y'}>
+CONFIG_I2C_OWL                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_PARPORT                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_PCA_PLATFORM                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_PCI1XXXX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_PIIX4                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_PXA                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_PXA_SLAVE                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_I2C_QCOM_CCI                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_QCOM_GENI                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_QUP                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_RCAR                                 policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_RIIC                                 policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_RK3X                                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_ROBOTFUZZ_OSIF                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_I2C_RZV2M                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_S3C2410                              policy<{'armhf': 'n'}>
+CONFIG_I2C_SCMI                                 policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_SH_MOBILE                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_SI470X                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_SI4713                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_SIMTEC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_SIS5595                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_SIS630                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_SIS96X                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_SLAVE                                policy<{'amd64': 'n', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_I2C_SLAVE_EEPROM                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_SLAVE_TESTUNIT                       policy<{'arm64': 'n', 'armhf': 'n', 'riscv64': 'n'}>
+CONFIG_I2C_SMBUS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_SPRD                                 policy<{'arm64': 'y'}>
+CONFIG_I2C_STM32F4                              policy<{'arm64': 'm'}>
+CONFIG_I2C_STM32F7                              policy<{'arm64': 'm'}>
+CONFIG_I2C_STUB                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_I2C_SYNQUACER                            policy<{'arm64': 'm'}>
+CONFIG_I2C_TAOS_EVM                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_TEGRA                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_TEGRA_BPMP                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_THUNDERX                             policy<{'arm64': 'm'}>
+CONFIG_I2C_TINY_USB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_I2C_VERSATILE                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_I2C_VIA                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_VIAPRO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_VIPERBOARD                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_I2C_VIRTIO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_XGENE_SLIMPRO                        policy<{'arm64': 'm'}>
+CONFIG_I2C_XILINX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I2C_XLP9XX                               policy<{'arm64': 'm'}>
+CONFIG_I3C                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I40E                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_I40EVF                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_I40E_DCB                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_I6300ESB_WDT                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_I82092                                   policy<{'amd64': 'm'}>
+CONFIG_I8253_LOCK                               policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_I8254                                    policy<{'amd64': 'm'}>
+CONFIG_I8K                                      policy<{'amd64': 'y'}>
+CONFIG_IA32_EMULATION                           policy<{'amd64': 'y'}>
+CONFIG_IA32_EMULATION_DEFAULT_DISABLED          policy<{'amd64': 'n'}>
+CONFIG_IA32_FEAT_CTL                            policy<{'amd64': 'y'}>
+CONFIG_IAQCORE                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IAVF                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IB700_WDT                                policy<{'amd64': 'm'}>
+CONFIG_IBMASR                                   policy<{'amd64': 'm'}>
+CONFIG_IBMVETH                                  policy<{'ppc64el': 'm'}>
+CONFIG_IBMVIO                                   policy<{'ppc64el': 'y'}>
+CONFIG_IBMVMC                                   policy<{'ppc64el': 'm'}>
+CONFIG_IBM_ASM                                  policy<{'amd64': 'm'}>
+CONFIG_IBM_BSR                                  policy<{'ppc64el': 'm'}>
+CONFIG_IBM_PARTITION                            policy<{'s390x': 'y'}>
+CONFIG_IBM_RTL                                  policy<{'amd64': 'm'}>
+CONFIG_ICE                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ICE_HWMON                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ICE_HWTS                                 policy<{'amd64': 'y'}>
+CONFIG_ICE_SWITCHDEV                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ICP10100                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ICPLUS_PHY                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ICS932S401                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_IDEAPAD_LAPTOP                           policy<{'amd64': 'm'}>
+CONFIG_IDLE_INJECT                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IDPF                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IE6XX_WDT                                policy<{'amd64': 'm'}>
+CONFIG_IEEE802154                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_IEEE802154_6LOWPAN                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_ADF7242                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_AT86RF230                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_ATUSB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_CA8210                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_CA8210_DEBUGFS                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IEEE802154_CC2520                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_DRIVERS                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_FAKELB                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_HWSIM                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_MCR20A                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_MRF24J40                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IEEE802154_NL802154_EXPERIMENTAL         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_IEEE802154_SOCKET                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IFB                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IFCVF                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IGB                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_IGBVF                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_IGB_DCA                                  policy<{'amd64': 'y'}>
+CONFIG_IGB_HWMON                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IGC                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_IIO                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_IIO_ADIS_LIB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ADIS_LIB_BUFFER                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IIO_BACKEND                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_BUFFER                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IIO_BUFFER_CB                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_BUFFER_DMA                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_BUFFER_DMAENGINE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_BUFFER_HW_CONSUMER                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_CONFIGFS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_CONSUMERS_PER_TRIGGER                policy<{'amd64': '2', 'arm64': '2', 'armhf': '2', 'ppc64el': '2', 'riscv64': '2'}>
+CONFIG_IIO_CROS_EC_ACCEL_LEGACY                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IIO_CROS_EC_BARO                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IIO_CROS_EC_LIGHT_PROX                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IIO_CROS_EC_SENSORS                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IIO_CROS_EC_SENSORS_CORE                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IIO_CROS_EC_SENSORS_LID_ANGLE            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IIO_GTS_HELPER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_HRTIMER_TRIGGER                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_INTERRUPT_TRIGGER                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_INV_SENSORS_TIMESTAMP                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_KFIFO_BUF                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_KX022A                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_KX022A_I2C                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_KX022A_SPI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_MS_SENSORS_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_MUX                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_RESCALE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_SCMI                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IIO_SIMPLE_DUMMY                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_SSP_SENSORHUB                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_SSP_SENSORS_COMMONS                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_STM32_LPTIMER_TRIGGER                policy<{'arm64': 'm'}>
+CONFIG_IIO_STM32_TIMER_TRIGGER                  policy<{'arm64': 'm'}>
+CONFIG_IIO_ST_ACCEL_3AXIS                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_ACCEL_I2C_3AXIS                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_ACCEL_SPI_3AXIS                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_GYRO_3AXIS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_GYRO_I2C_3AXIS                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_GYRO_SPI_3AXIS                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_LSM6DSX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_LSM6DSX_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_LSM6DSX_I3C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_LSM6DSX_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_LSM9DS0                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_LSM9DS0_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_LSM9DS0_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_MAGN_3AXIS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_MAGN_I2C_3AXIS                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_MAGN_SPI_3AXIS                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_PRESS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_PRESS_I2C                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_PRESS_SPI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_SENSORS_CORE                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_SENSORS_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_ST_SENSORS_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_SW_DEVICE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_SW_TRIGGER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_SYSFS_TRIGGER                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_TIGHTLOOP_TRIGGER                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_TRIGGER                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IIO_TRIGGERED_BUFFER                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IIO_TRIGGERED_EVENT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IKCONFIG                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IKHEADERS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ILLEGAL_POINTER_VALUE                    policy<{'amd64': '0xdead000000000000', 'arm64': '0xdead000000000000', 'ppc64el': '0x5deadbeef0000000', 'riscv64': '0xdead000000000000'}>
+CONFIG_IMA_APPRAISE_BOOTPARAM                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA_APPRAISE_BUILD_POLICY                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_APPRAISE_MODSIG                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA_BLACKLIST_KEYRING                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_DEFAULT_HASH                         policy<{'amd64': '"sha256"', 'arm64': '"sha256"', 'armhf': '"sha256"', 'ppc64el': '"sha256"', 'riscv64': '"sha256"', 's390x': '"sha256"'}>
+CONFIG_IMA_DEFAULT_HASH_SHA1                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_DEFAULT_HASH_SHA512                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_DEFAULT_TEMPLATE                     policy<{'amd64': '"ima-ng"', 'arm64': '"ima-ng"', 'armhf': '"ima-ng"', 'ppc64el': '"ima-sig"', 'riscv64': '"ima-ng"', 's390x': '"ima-ng"'}>
+CONFIG_IMA_DISABLE_HTABLE                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_LOAD_X509                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IMA_LSM_RULES                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA_MEASURE_PCR_IDX                      policy<{'amd64': '10', 'arm64': '10', 'armhf': '10', 'ppc64el': '10', 'riscv64': '10', 's390x': '10'}>
+CONFIG_IMA_NG_TEMPLATE                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_IMG_ASCII_LCD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_IMX2_WDT                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX7D_ADC                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX7ULP_WDT                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX8MM_THERMAL                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX8M_BLK_CTRL                           policy<{'arm64': 'y'}>
+CONFIG_IMX8QXP_ADC                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX93_ADC                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX9_BLK_CTRL                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IMX_DMA                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_DSP                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_DSP_REMOTEPROC                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_GPCV2                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IMX_GPCV2_PM_DOMAINS                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IMX_INTMUX                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IMX_IPUV3_CORE                           policy<{'armhf': 'm'}>
+CONFIG_IMX_IRQSTEER                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IMX_MBOX                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_MU_MSI                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_REMOTEPROC                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_SCU                                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IMX_SCU_PD                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IMX_SC_THERMAL                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_SC_WDT                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_SDMA                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_THERMAL                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IMX_WEIM                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_INA2XX_ADC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INDIRECT_PIO                             policy<{'arm64': 'y'}>
+CONFIG_INET                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INET6_AH                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET6_ESP                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET6_ESPINTCP                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INET6_ESP_OFFLOAD                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET6_IPCOMP                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET6_TUNNEL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET6_XFRM_TUNNEL                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_AH                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_DCCP_DIAG                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_DIAG                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_DIAG_DESTROY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INET_ESP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_ESPINTCP                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INET_ESP_OFFLOAD                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_IPCOMP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_MPTCP_DIAG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_RAW_DIAG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_SCTP_DIAG                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_TABLE_PERTURB_ORDER                 policy<{'amd64': '16', 'arm64': '16', 'armhf': '16', 'ppc64el': '16', 'riscv64': '16', 's390x': '16'}>
+CONFIG_INET_TCP_DIAG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_TUNNEL                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_UDP_DIAG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INET_XFRM_TUNNEL                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_ADDR_TRANS                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INFINIBAND_ADDR_TRANS_CONFIGFS           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INFINIBAND_BNXT_RE                       policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INFINIBAND_CXGB4                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INFINIBAND_EFA                           policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INFINIBAND_ERDMA                         policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_INFINIBAND_HFI1                          policy<{'amd64': 'm'}>
+CONFIG_INFINIBAND_HNS                           policy<{'arm64': 'm'}>
+CONFIG_INFINIBAND_HNS_HIP08                     policy<{'arm64': 'y'}>
+CONFIG_INFINIBAND_IPOIB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_IPOIB_CM                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INFINIBAND_IPOIB_DEBUG                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_INFINIBAND_IRDMA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INFINIBAND_ISER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_ISERT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_MTHCA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_MTHCA_DEBUG                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_INFINIBAND_OCRDMA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_INFINIBAND_ON_DEMAND_PAGING              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INFINIBAND_OPA_VNIC                      policy<{'amd64': 'm'}>
+CONFIG_INFINIBAND_QEDR                          policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INFINIBAND_QIB                           policy<{'amd64': 'm'}>
+CONFIG_INFINIBAND_QIB_DCA                       policy<{'amd64': 'y'}>
+CONFIG_INFINIBAND_RDMAVT                        policy<{'amd64': 'm'}>
+CONFIG_INFINIBAND_RTRS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_RTRS_CLIENT                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_RTRS_SERVER                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_SRP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_SRPT                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_USER_ACCESS                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_USER_MAD                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INFINIBAND_USER_MEM                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INFINIBAND_USNIC                         policy<{'amd64': 'm'}>
+CONFIG_INFINIBAND_VIRT_DMA                      policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INFINIBAND_VMWARE_PVRDMA                 policy<{'amd64': 'm', 'arm64': 'm', 'arm64-generic-64k': '-', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_INFTL                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INITRAMFS_PRESERVE_MTIME                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INITRAMFS_SOURCE                         policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '""'}>
+CONFIG_INIT_ENV_ARG_LIMIT                       policy<{'amd64': '32', 'arm64': '32', 'armhf': '32', 'ppc64el': '32', 'riscv64': '32', 's390x': '32'}>
+CONFIG_INIT_ON_ALLOC_DEFAULT_ON                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INIT_ON_FREE_DEFAULT_ON                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_INIT_STACK_ALL_PATTERN                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_INIT_STACK_ALL_ZERO                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INIT_STACK_NONE                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_INLINE_READ_LOCK                         policy<{'s390x': 'y'}>
+CONFIG_INLINE_READ_LOCK_BH                      policy<{'s390x': 'y'}>
+CONFIG_INLINE_READ_LOCK_IRQ                     policy<{'s390x': 'y'}>
+CONFIG_INLINE_READ_LOCK_IRQSAVE                 policy<{'s390x': 'y'}>
+CONFIG_INLINE_READ_TRYLOCK                      policy<{'s390x': 'y'}>
+CONFIG_INLINE_READ_UNLOCK                       policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_INLINE_READ_UNLOCK_BH                    policy<{'s390x': 'y'}>
+CONFIG_INLINE_READ_UNLOCK_IRQ                   policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_INLINE_READ_UNLOCK_IRQRESTORE            policy<{'s390x': 'y'}>
+CONFIG_INLINE_SPIN_LOCK                         policy<{'s390x': 'y'}>
+CONFIG_INLINE_SPIN_LOCK_BH                      policy<{'s390x': 'y'}>
+CONFIG_INLINE_SPIN_LOCK_IRQ                     policy<{'s390x': 'y'}>
+CONFIG_INLINE_SPIN_LOCK_IRQSAVE                 policy<{'s390x': 'y'}>
+CONFIG_INLINE_SPIN_TRYLOCK                      policy<{'s390x': 'y'}>
+CONFIG_INLINE_SPIN_TRYLOCK_BH                   policy<{'s390x': 'y'}>
+CONFIG_INLINE_SPIN_UNLOCK_BH                    policy<{'s390x': 'y'}>
+CONFIG_INLINE_SPIN_UNLOCK_IRQ                   policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE            policy<{'s390x': 'y'}>
+CONFIG_INLINE_WRITE_LOCK                        policy<{'s390x': 'y'}>
+CONFIG_INLINE_WRITE_LOCK_BH                     policy<{'s390x': 'y'}>
+CONFIG_INLINE_WRITE_LOCK_IRQ                    policy<{'s390x': 'y'}>
+CONFIG_INLINE_WRITE_LOCK_IRQSAVE                policy<{'s390x': 'y'}>
+CONFIG_INLINE_WRITE_TRYLOCK                     policy<{'s390x': 'y'}>
+CONFIG_INLINE_WRITE_UNLOCK                      policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_INLINE_WRITE_UNLOCK_BH                   policy<{'s390x': 'y'}>
+CONFIG_INLINE_WRITE_UNLOCK_IRQ                  policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE           policy<{'s390x': 'y'}>
+CONFIG_INOTIFY_USER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INPUT                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INPUT_88PM80X_ONKEY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_88PM860X_ONKEY                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_AD714X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_AD714X_I2C                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_AD714X_SPI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_ADXL34X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_ADXL34X_I2C                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_ADXL34X_SPI                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_APANEL                             policy<{'amd64': 'm'}>
+CONFIG_INPUT_ARIZONA_HAPTICS                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_ATC260X_ONKEY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_ATI_REMOTE2                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_ATLAS_BTNS                         policy<{'amd64': 'm'}>
+CONFIG_INPUT_ATMEL_CAPTOUCH                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_AXP20X_PEK                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_BBNSM_PWRKEY                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INPUT_BMA150                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_CM109                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_CMA3000                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_CMA3000_I2C                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_CPCAP_PWRBUTTON                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_DA7280_HAPTICS                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_DA9052_ONKEY                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_DA9055_ONKEY                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_DA9063_ONKEY                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_DRV260X_HAPTICS                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_DRV2665_HAPTICS                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_DRV2667_HAPTICS                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_E3X0_BUTTON                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_EVBUG                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_INPUT_EVDEV                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INPUT_FF_MEMLESS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_INPUT_GPIO_BEEPER                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_GPIO_DECODER                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_GPIO_ROTARY_ENCODER                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_GPIO_VIBRA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_HISI_POWERKEY                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INPUT_IBM_PANEL                          policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_IDEAPAD_SLIDEBAR                   policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_INPUT_IMS_PCU                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_IQS269A                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_IQS626A                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_IQS7222                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_JOYDEV                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_INPUT_JOYSTICK                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_INPUT_KEYBOARD                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_INPUT_KEYSPAN_REMOTE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_KXTJ9                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_LEDS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_MATRIXKMAP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_INPUT_MAX77650_ONKEY                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_MAX77693_HAPTIC                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_MAX8925_ONKEY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_MAX8997_HAPTIC                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_MC13783_PWRBUTTON                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_MISC                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_INPUT_MMA8450                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_MOUSE                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_INPUT_MOUSEDEV                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_INPUT_MOUSEDEV_PSAUX                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_INPUT_MOUSEDEV_SCREEN_X                  policy<{'amd64': '1024', 'arm64': '1024', 'armhf': '1024', 'ppc64el': '1024', 'riscv64': '1024'}>
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y                  policy<{'amd64': '768', 'arm64': '768', 'armhf': '768', 'ppc64el': '768', 'riscv64': '768'}>
+CONFIG_INPUT_PALMAS_PWRBUTTON                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_PCAP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_PCF50633_PMU                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_PCF8574                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_PCSPKR                             policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_INPUT_PM8941_PWRKEY                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INPUT_PM8XXX_VIBRATOR                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INPUT_PMIC8XXX_PWRKEY                    policy<{'armhf': 'm'}>
+CONFIG_INPUT_POWERMATE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_PWM_BEEPER                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_PWM_VIBRA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_RAVE_SP_PWRBUTTON                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_REGULATOR_HAPTIC                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_RETU_PWRBUTTON                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_RK805_PWRKEY                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_RT5120_PWRKEY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_SC27XX_VIBRA                       policy<{'arm64': 'm'}>
+CONFIG_INPUT_SOC_BUTTON_ARRAY                   policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_SPARSEKMAP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_INPUT_STPMIC1_ONKEY                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_TABLET                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_INPUT_TOUCHSCREEN                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_INPUT_TPS65218_PWRBUTTON                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_TPS65219_PWRBUTTON                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INPUT_TWL4030_PWRBUTTON                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_TWL4030_VIBRA                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_TWL6040_VIBRA                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_VIVALDIFMAP                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_INPUT_WM831X_ON                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INPUT_XEN_KBDDEV_FRONTEND                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_INPUT_YEALINK                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INSPUR_PLATFORM_PROFILE                  policy<{'amd64': 'm'}>
+CONFIG_INSTRUCTION_DECODER                      policy<{'amd64': 'y'}>
+CONFIG_INT3406_THERMAL                          policy<{'amd64': 'm'}>
+CONFIG_INT340X_THERMAL                          policy<{'amd64': 'm'}>
+CONFIG_INTEGRITY                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INTEGRITY_ASYMMETRIC_KEYS                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INTEGRITY_AUDIT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INTEGRITY_CA_MACHINE_KEYRING             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'n'}>
+CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX         policy<{'ppc64el': 'y'}>
+CONFIG_INTEGRITY_MACHINE_KEYRING                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_INTEGRITY_SIGNATURE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INTEGRITY_TRUSTED_KEYRING                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INTEL_ATOMISP2_LED                       policy<{'amd64': 'm'}>
+CONFIG_INTEL_ATOMISP2_PDX86                     policy<{'amd64': 'y'}>
+CONFIG_INTEL_BXTWC_PMIC_TMU                     policy<{'amd64': 'm'}>
+CONFIG_INTEL_BXT_PMIC_THERMAL                   policy<{'amd64': 'm'}>
+CONFIG_INTEL_BYTCRC_PWRSRC                      policy<{'amd64': 'm'}>
+CONFIG_INTEL_CHTDC_TI_PWRBTN                    policy<{'amd64': 'm'}>
+CONFIG_INTEL_CHTWC_INT33FE                      policy<{'amd64': 'm'}>
+CONFIG_INTEL_GTT                                policy<{'amd64': 'y'}>
+CONFIG_INTEL_HFI_THERMAL                        policy<{'amd64': 'y'}>
+CONFIG_INTEL_HID_EVENT                          policy<{'amd64': 'm'}>
+CONFIG_INTEL_IDLE                               policy<{'amd64': 'y'}>
+CONFIG_INTEL_IDMA64                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_INTEL_IDXD                               policy<{'amd64': 'm'}>
+CONFIG_INTEL_IDXD_BUS                           policy<{'amd64': 'm'}>
+CONFIG_INTEL_IDXD_COMPAT                        policy<{'amd64': 'n'}>
+CONFIG_INTEL_IDXD_PERFMON                       policy<{'amd64': 'y'}>
+CONFIG_INTEL_IDXD_SVM                           policy<{'amd64': 'y'}>
+CONFIG_INTEL_IFS                                policy<{'amd64': 'm'}>
+CONFIG_INTEL_INT0002_VGPIO                      policy<{'amd64': 'm'}>
+CONFIG_INTEL_IOATDMA                            policy<{'amd64': 'm'}>
+CONFIG_INTEL_IOMMU                              policy<{'amd64': 'y'}>
+CONFIG_INTEL_IOMMU_FLOPPY_WA                    policy<{'amd64': 'y'}>
+CONFIG_INTEL_IOMMU_PERF_EVENTS                  policy<{'amd64': 'y'}>
+CONFIG_INTEL_IOMMU_SVM                          policy<{'amd64': 'y'}>
+CONFIG_INTEL_IPS                                policy<{'amd64': 'm'}>
+CONFIG_INTEL_ISHTP_ECLITE                       policy<{'amd64': 'm'}>
+CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER            policy<{'amd64': 'm'}>
+CONFIG_INTEL_ISH_HID                            policy<{'amd64': 'm'}>
+CONFIG_INTEL_LDMA                               policy<{'amd64': 'y'}>
+CONFIG_INTEL_MEI                                policy<{'amd64': 'm'}>
+CONFIG_INTEL_MEI_GSC                            policy<{'amd64': 'm'}>
+CONFIG_INTEL_MEI_GSC_PROXY                      policy<{'amd64': 'm'}>
+CONFIG_INTEL_MEI_HDCP                           policy<{'amd64': 'm'}>
+CONFIG_INTEL_MEI_ME                             policy<{'amd64': 'm'}>
+CONFIG_INTEL_MEI_PXP                            policy<{'amd64': 'm'}>
+CONFIG_INTEL_MEI_TXE                            policy<{'amd64': 'm'}>
+CONFIG_INTEL_MEI_VSC                            policy<{'amd64': 'm'}>
+CONFIG_INTEL_MEI_VSC_HW                         policy<{'amd64': 'm'}>
+CONFIG_INTEL_MEI_WDT                            policy<{'amd64': 'm'}>
+CONFIG_INTEL_MRFLD_ADC                          policy<{'amd64': 'm'}>
+CONFIG_INTEL_MRFLD_PWRBTN                       policy<{'amd64': 'm'}>
+CONFIG_INTEL_OAKTRAIL                           policy<{'amd64': 'm'}>
+CONFIG_INTEL_PCH_THERMAL                        policy<{'amd64': 'm'}>
+CONFIG_INTEL_PMC_CORE                           policy<{'amd64': 'm'}>
+CONFIG_INTEL_PMT_CLASS                          policy<{'amd64': 'm'}>
+CONFIG_INTEL_PMT_CRASHLOG                       policy<{'amd64': 'm'}>
+CONFIG_INTEL_PMT_TELEMETRY                      policy<{'amd64': 'm'}>
+CONFIG_INTEL_POWERCLAMP                         policy<{'amd64': 'm'}>
+CONFIG_INTEL_PUNIT_IPC                          policy<{'amd64': 'm'}>
+CONFIG_INTEL_QEP                                policy<{'amd64': 'm', 'arm64': '-', 'armhf': '-', 'ppc64el': '-'}>
+CONFIG_INTEL_RAPL                               policy<{'amd64': 'm'}>
+CONFIG_INTEL_RAPL_CORE                          policy<{'amd64': 'm'}>
+CONFIG_INTEL_RAPL_TPMI                          policy<{'amd64': 'm'}>
+CONFIG_INTEL_RST                                policy<{'amd64': 'm'}>
+CONFIG_INTEL_SAR_INT1092                        policy<{'amd64': 'm'}>
+CONFIG_INTEL_SCU                                policy<{'amd64': 'y'}>
+CONFIG_INTEL_SCU_IPC                            policy<{'amd64': 'y'}>
+CONFIG_INTEL_SCU_IPC_UTIL                       policy<{'amd64': 'm'}>
+CONFIG_INTEL_SCU_PCI                            policy<{'amd64': 'y'}>
+CONFIG_INTEL_SCU_PLATFORM                       policy<{'amd64': 'm'}>
+CONFIG_INTEL_SDSI                               policy<{'amd64': 'm'}>
+CONFIG_INTEL_SKL_INT3472                        policy<{'amd64': 'm'}>
+CONFIG_INTEL_SMARTCONNECT                       policy<{'amd64': 'm'}>
+CONFIG_INTEL_SOC_DTS_IOSF_CORE                  policy<{'amd64': 'm'}>
+CONFIG_INTEL_SOC_DTS_THERMAL                    policy<{'amd64': 'm'}>
+CONFIG_INTEL_SOC_PMIC                           policy<{'amd64': 'y'}>
+CONFIG_INTEL_SOC_PMIC_BXTWC                     policy<{'amd64': 'm'}>
+CONFIG_INTEL_SOC_PMIC_CHTDC_TI                  policy<{'amd64': 'm'}>
+CONFIG_INTEL_SOC_PMIC_CHTWC                     policy<{'amd64': 'y'}>
+CONFIG_INTEL_SOC_PMIC_MRFLD                     policy<{'amd64': 'm'}>
+CONFIG_INTEL_SPEED_SELECT_INTERFACE             policy<{'amd64': 'm'}>
+CONFIG_INTEL_SPEED_SELECT_TPMI                  policy<{'amd64': 'm'}>
+CONFIG_INTEL_STRATIX10_RSU                      policy<{'arm64': 'm'}>
+CONFIG_INTEL_STRATIX10_SERVICE                  policy<{'arm64': 'm'}>
+CONFIG_INTEL_TCC                                policy<{'amd64': 'y'}>
+CONFIG_INTEL_TCC_COOLING                        policy<{'amd64': 'm'}>
+CONFIG_INTEL_TDX_GUEST                          policy<{'amd64': 'y'}>
+CONFIG_INTEL_TELEMETRY                          policy<{'amd64': 'm'}>
+CONFIG_INTEL_TH                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INTEL_TH_ACPI                            policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_INTEL_TH_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_INTEL_TH_GTH                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INTEL_TH_MSU                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INTEL_TH_PCI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INTEL_TH_PTI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INTEL_TH_STH                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INTEL_TPMI                               policy<{'amd64': 'm'}>
+CONFIG_INTEL_TURBO_MAX_3                        policy<{'amd64': 'y'}>
+CONFIG_INTEL_TXT                                policy<{'amd64': 'y'}>
+CONFIG_INTEL_UNCORE_FREQ_CONTROL                policy<{'amd64': 'm'}>
+CONFIG_INTEL_UNCORE_FREQ_CONTROL_TPMI           policy<{'amd64': 'm'}>
+CONFIG_INTEL_VBTN                               policy<{'amd64': 'm'}>
+CONFIG_INTEL_VSC                                policy<{'amd64': 'm'}>
+CONFIG_INTEL_VSEC                               policy<{'amd64': 'm'}>
+CONFIG_INTEL_WMI                                policy<{'amd64': 'y'}>
+CONFIG_INTEL_WMI_SBL_FW_UPDATE                  policy<{'amd64': 'm'}>
+CONFIG_INTEL_WMI_THUNDERBOLT                    policy<{'amd64': 'm'}>
+CONFIG_INTEL_XWAY_PHY                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_INTERCONNECT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_INTERCONNECT_CLK                         policy<{'arm64': 'm'}>
+CONFIG_INTERCONNECT_IMX                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_IMX8MM                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_IMX8MN                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_IMX8MP                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_IMX8MQ                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_INTERCONNECT_QCOM_BCM_VOTER              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_MSM8916                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_MSM8939                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_MSM8974                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_MSM8996                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_OSM_L3                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_QCM2290                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_QCS404                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_QDU1000                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_RPMH                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_RPMH_POSSIBLE          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SA8775P                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SC7180                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SC7280                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SC8180X                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SC8280XP               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SDM660                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SDM670                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SDM845                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SDX55                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SDX65                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SDX75                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SM6115                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SM6350                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SM8150                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SM8250                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SM8350                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SM8450                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SM8550                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SM8650                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_SMD_RPM                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_QCOM_X1E80100               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_INTERCONNECT_SAMSUNG                     policy<{'armhf': 'n'}>
+CONFIG_INTERRUPT_CNT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_INTERRUPT_SANITIZE_REGISTERS             policy<{'ppc64el': 'y'}>
+CONFIG_INTERVAL_TREE                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_INTERVAL_TREE_SPAN_ITER                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_INTERVAL_TREE_TEST                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_INV_ICM42600                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INV_ICM42600_I2C                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INV_ICM42600_SPI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INV_MPU6050_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INV_MPU6050_IIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_INV_MPU6050_SPI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IOMMUFD                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_IOMMUFD_DRIVER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IOMMU_API                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IOMMU_DEBUG                              policy<{'amd64': 'n'}>
+CONFIG_IOMMU_DEFAULT_PASSTHROUGH                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IOMMU_DMA                                policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_IOMMU_HELPER                             policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_IOMMU_IOVA                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'y'}>
+CONFIG_IOMMU_IO_PGTABLE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IOMMU_IO_PGTABLE_ARMV7S                  policy<{'arm64': 'y', 'armhf': 'n'}>
+CONFIG_IOMMU_IO_PGTABLE_ARMV7S_SELFTEST         policy<{'arm64': 'n'}>
+CONFIG_IOMMU_IO_PGTABLE_DART                    policy<{'arm64': 'y'}>
+CONFIG_IOMMU_IO_PGTABLE_LPAE                    policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST           policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_IOMMU_MM_DATA                            policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_IOMMU_SUPPORT                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IOMMU_SVA                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_IONIC                                    policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_IOSCHED_BFQ                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IOSF_MBI                                 policy<{'amd64': 'y'}>
+CONFIG_IOSF_MBI_DEBUG                           policy<{'amd64': 'y'}>
+CONFIG_IOSM                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IO_DELAY_0X80                            policy<{'amd64': 'n'}>
+CONFIG_IO_DELAY_0XED                            policy<{'amd64': 'y'}>
+CONFIG_IO_DELAY_NONE                            policy<{'amd64': 'n'}>
+CONFIG_IO_DELAY_UDELAY                          policy<{'amd64': 'n'}>
+CONFIG_IO_EVENT_IRQ                             policy<{'ppc64el': 'y'}>
+CONFIG_IO_STRICT_DEVMEM                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IO_URING                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IO_WQ                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP5XXX_POWER                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IP6_NF_FILTER                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_IPTABLES                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MANGLE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_AH                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_EUI64                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_FRAG                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_HL                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_IPV6HEADER                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_MH                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_OPTS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_RPFILTER                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_RT                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_MATCH_SRH                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_NAT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_RAW                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_SECURITY                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_TARGET_HL                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_TARGET_MASQUERADE                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_TARGET_NPT                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_TARGET_REJECT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP6_NF_TARGET_SYNPROXY                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPACK_BUS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_IPC_NS                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPMB_DEVICE_INTERFACE                    policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_IPMI_DEVICE_INTERFACE                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IPMI_DMI_DECODE                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IPMI_HANDLER                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_IPMI_IPMB                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_IPMI_KCS_BMC                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IPMI_KCS_BMC_CDEV_IPMI                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IPMI_KCS_BMC_SERIO                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IPMI_PANIC_EVENT                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_IPMI_PLAT_DATA                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IPMI_POWERNV                             policy<{'ppc64el': 'm'}>
+CONFIG_IPMI_POWEROFF                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IPMI_SI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IPMI_SSIF                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IPMI_WATCHDOG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IPQ_APSS_6018                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IPQ_APSS_PLL                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IPQ_GCC_4019                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IPQ_GCC_5018                             policy<{'arm64': 'm'}>
+CONFIG_IPQ_GCC_5332                             policy<{'arm64': 'm'}>
+CONFIG_IPQ_GCC_6018                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IPQ_GCC_806X                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_IPQ_GCC_8074                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IPQ_GCC_9574                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IPQ_LCC_806X                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_IPU_BRIDGE                               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_IPV6_FOU                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPV6_FOU_TUNNEL                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPV6_GRE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPV6_ILA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPV6_IOAM6_LWTUNNEL                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_MIP6                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPV6_MROUTE                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_MULTIPLE_TABLES                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_NDISC_NODETYPE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_OPTIMISTIC_DAD                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IPV6_PIMSM_V2                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_ROUTER_PREF                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_ROUTE_INFO                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_RPL_LWTUNNEL                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IPV6_SEG6_BPF                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_SEG6_HMAC                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_SEG6_LWTUNNEL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_SIT                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPV6_SIT_6RD                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_SUBTREES                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPV6_TUNNEL                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPV6_VTI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPVLAN                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPVLAN_L3S                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IPVTAP                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IPW2100                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IPW2100_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_IPW2100_MONITOR                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IPW2200                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IPW2200_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_IPW2200_MONITOR                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IPW2200_PROMISCUOUS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IPW2200_QOS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IPW2200_RADIOTAP                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IPWIRELESS                               policy<{'amd64': 'm'}>
+CONFIG_IP_ADVANCED_ROUTER                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_DCCP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_DCCP_CCID2_DEBUG                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IP_DCCP_CCID3                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'y'}>
+CONFIG_IP_DCCP_CCID3_DEBUG                      policy<{'s390x': 'n'}>
+CONFIG_IP_DCCP_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IP_DCCP_TFRC_LIB                         policy<{'s390x': 'y'}>
+CONFIG_IP_FIB_TRIE_STATS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_MROUTE                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_MROUTE_COMMON                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_MROUTE_MULTIPLE_TABLES                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_MULTICAST                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_MULTIPLE_TABLES                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_NF_ARPFILTER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_ARPTABLES                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_ARP_MANGLE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_FILTER                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_IPTABLES                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_MANGLE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_MATCH_AH                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_MATCH_ECN                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_MATCH_RPFILTER                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_MATCH_TTL                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_NAT                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_RAW                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_SECURITY                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_TARGET_ECN                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_TARGET_MASQUERADE                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_TARGET_NETMAP                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_TARGET_REDIRECT                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_TARGET_REJECT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_TARGET_SYNPROXY                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_NF_TARGET_TTL                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_PIMSM_V1                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_PIMSM_V2                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_ROUTE_CLASSID                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_ROUTE_MULTIPATH                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_ROUTE_VERBOSE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_SCTP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_BITMAP_IP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_BITMAP_IPMAC                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_BITMAP_PORT                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_IP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_IPMAC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_IPMARK                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_IPPORT                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_IPPORTIP                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_IPPORTNET                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_MAC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_NET                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_NETIFACE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_NETNET                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_NETPORT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_HASH_NETPORTNET                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_LIST_SET                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_SET_MAX                               policy<{'amd64': '256', 'arm64': '256', 'armhf': '256', 'ppc64el': '256', 'riscv64': '256', 's390x': '256'}>
+CONFIG_IP_VS                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_DEBUG                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IP_VS_DH                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_FO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_FTP                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_IPV6                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_VS_LBLC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_LBLCR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_LC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_MH                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_MH_TAB_INDEX                       policy<{'amd64': '12', 'arm64': '12', 'armhf': '12', 'ppc64el': '12', 'riscv64': '12', 's390x': '12'}>
+CONFIG_IP_VS_NFCT                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_VS_NQ                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_OVF                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_PE_SIP                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_PROTO_AH                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_VS_PROTO_AH_ESP                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_VS_PROTO_ESP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_VS_PROTO_SCTP                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_VS_PROTO_TCP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_VS_PROTO_UDP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IP_VS_RR                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_SED                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_SH                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_SH_TAB_BITS                        policy<{'amd64': '8', 'arm64': '8', 'armhf': '8', 'ppc64el': '8', 'riscv64': '8', 's390x': '8'}>
+CONFIG_IP_VS_TAB_BITS                           policy<{'amd64': '12', 'arm64': '12', 'armhf': '12', 'ppc64el': '12', 'riscv64': '12', 's390x': '12'}>
+CONFIG_IP_VS_TWOS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_IP_VS_WLC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IP_VS_WRR                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IQS620AT_TEMP                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IQS621_ALS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IQS624_POS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IRQCHIP                                  policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IRQSOFF_TRACER                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_IRQSTACKS                                policy<{'armhf': 'y'}>
+CONFIG_IRQ_ALL_CPUS                             policy<{'ppc64el': 'y'}>
+CONFIG_IRQ_BYPASS_MANAGER                       policy<{'amd64': 'm', 'arm64': 'y', 'armhf': 'm', 'ppc64el': 'y', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IRQ_CROSSBAR                             policy<{'armhf': 'y'}>
+CONFIG_IRQ_DOMAIN                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IRQ_DOMAIN_HIERARCHY                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_IRQ_FORCED_THREADING                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IRQ_MSI_IOMMU                            policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_IRQ_POLL                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IRQ_REMAP                                policy<{'amd64': 'y'}>
+CONFIG_IRQ_SIM                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IRQ_STACKS                               policy<{'riscv64': 'y'}>
+CONFIG_IRQ_TIME_ACCOUNTING                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_IRQ_WORK                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_IRSD200                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_ENE                                   policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_IR_FINTEK                                policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_IR_GPIO_CIR                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_GPIO_TX                               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_HIX5HD2                               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_IGORPLUGUSB                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_IGUANA                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_IMON                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_IMON_DECODER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_IMON_RAW                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_ITE_CIR                               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_IR_JVC_DECODER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_MCEUSB                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_MCE_KBD_DECODER                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_MESON                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IR_MESON_TX                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IR_MTK                                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_IR_NEC_DECODER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_NUVOTON                               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_IR_PWM_TX                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_RC5_DECODER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_RC6_DECODER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_RCMM_DECODER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_REDRAT3                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_SANYO_DECODER                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_SERIAL                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_SERIAL_TRANSMITTER                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IR_SHARP_DECODER                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_SONY_DECODER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_SPI                                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_STREAMZAP                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_SUNXI                                 policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_IR_TOY                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_TTUSBIR                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IR_WINBOND_CIR                           policy<{'amd64': 'm'}>
+CONFIG_IR_XMP_DECODER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ISA_BUS                                  policy<{'amd64': 'y'}>
+CONFIG_ISA_BUS_API                              policy<{'amd64': 'y'}>
+CONFIG_ISA_DMA_API                              policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_ISCSI_BOOT_SYSFS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ISCSI_IBFT                               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_ISCSI_IBFT_FIND                          policy<{'amd64': 'y'}>
+CONFIG_ISCSI_TARGET                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ISCSI_TARGET_CXGB4                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ISCSI_TCP                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ISDN                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ISDN_CAPI                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ISDN_CAPI_MIDDLEWARE                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ISL29003                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ISL29020                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ISL29125                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ISL29501                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ISL76682                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ISO9660_FS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_IT8712F_WDT                              policy<{'amd64': 'm'}>
+CONFIG_IT87_WDT                                 policy<{'amd64': 'm'}>
+CONFIG_ITCO_VENDOR_SUPPORT                      policy<{'amd64': 'y'}>
+CONFIG_ITCO_WDT                                 policy<{'amd64': 'm'}>
+CONFIG_ITG3200                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IUCV                                     policy<{'s390x': 'y'}>
+CONFIG_IWL3945                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IWL4965                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IWLDVM                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IWLEGACY                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IWLEGACY_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_IWLEGACY_DEBUGFS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IWLMVM                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IWLWIFI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_IWLWIFI_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_IWLWIFI_DEBUGFS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IWLWIFI_DEVICE_TRACING                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IWLWIFI_LEDS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IWLWIFI_OPMODE_MODULAR                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IXGBE                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_IXGBEVF                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_IXGBEVF_IPSEC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IXGBE_DCA                                policy<{'amd64': 'y'}>
+CONFIG_IXGBE_DCB                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IXGBE_HWMON                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_IXGBE_IPSEC                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JAILHOUSE_GUEST                          policy<{'amd64': 'y'}>
+CONFIG_JBD2                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_JBD2_DEBUG                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_JFFS2_CMODE_FAVOURLZO                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFFS2_CMODE_NONE                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_JFFS2_CMODE_PRIORITY                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_JFFS2_CMODE_SIZE                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_JFFS2_COMPRESSION_OPTIONS                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFFS2_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JFFS2_FS_DEBUG                           policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_JFFS2_FS_POSIX_ACL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFFS2_FS_SECURITY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFFS2_FS_WBUF_VERIFY                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_JFFS2_FS_WRITEBUFFER                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFFS2_FS_XATTR                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFFS2_LZO                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFFS2_RTIME                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFFS2_RUBIN                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_JFFS2_SUMMARY                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_JFFS2_ZLIB                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFS_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_JFS_FS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_JFS_POSIX_ACL                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFS_SECURITY                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JFS_STATISTICS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JH71XX_PMU                               policy<{'riscv64': 'y'}>
+CONFIG_JME                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_JOLIET                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_JOYSTICK_A3D                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_ADC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JOYSTICK_ADI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_ANALOG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_AS5011                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_COBRA                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_DB9                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JOYSTICK_FSIA6B                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_GAMECON                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JOYSTICK_GF2K                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_GRIP                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_GRIP_MP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_GUILLEMOT                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_IFORCE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_IFORCE_232                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JOYSTICK_IFORCE_USB                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JOYSTICK_INTERACT                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_JOYDUMP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_MAGELLAN                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_PSXPAD_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_PSXPAD_SPI_FF                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JOYSTICK_PXRC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_QWIIC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_SEESAW                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JOYSTICK_SENSEHAT                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JOYSTICK_SIDEWINDER                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_SPACEBALL                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_SPACEORB                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_STINGER                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_TMDC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_TURBOGRAFX                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JOYSTICK_TWIDJOY                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_WALKERA0701                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JOYSTICK_WARRIOR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_XPAD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JOYSTICK_XPAD_FF                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JOYSTICK_XPAD_LEDS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_JOYSTICK_ZHENHUA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_JSA1212                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_JUMP_LABEL                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_JUMP_LABEL_FEATURE_CHECKS                policy<{'ppc64el': 'y'}>
+CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG           policy<{'ppc64el': 'n'}>
+CONFIG_K3_DMA                                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_K3_RTI_WATCHDOG                          policy<{'arm64': 'm'}>
+CONFIG_K3_THERMAL                               policy<{'arm64': 'm'}>
+CONFIG_KALLSYMS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KALLSYMS_ABSOLUTE_PERCPU                 policy<{'amd64': 'y'}>
+CONFIG_KALLSYMS_ALL                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KALLSYMS_SELFTEST                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_KARMA_PARTITION                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_KASAN                                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_KCMP                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KCOV                                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_KCSAN                                    policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_KDB_CONTINUE_CATASTROPHIC                policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_KDB_DEFAULT_ENABLE                       policy<{'amd64': '0x1', 'arm64': '0x1', 'armhf': '0x1', 'ppc64el': '0x1', 'riscv64': '0x1'}>
+CONFIG_KDB_KEYBOARD                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_KEEMBAY_WATCHDOG                         policy<{'arm64': 'm'}>
+CONFIG_KEMPLD_WDT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KERNEL_BZIP2                             policy<{'amd64': 'n', 's390x': 'n'}>
+CONFIG_KERNEL_GZIP                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_KERNEL_LZ4                               policy<{'amd64': 'n', 'arm64': '-', 'armhf': 'n', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_KERNEL_LZMA                              policy<{'amd64': 'n', 'arm64': '-', 'armhf': 'n', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_KERNEL_LZO                               policy<{'amd64': 'n', 'arm64': '-', 'armhf': 'n', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_KERNEL_MODE_NEON                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_KERNEL_NOBP                              policy<{'s390x': 'n'}>
+CONFIG_KERNEL_START                             policy<{'ppc64el': '0xc000000000000000'}>
+CONFIG_KERNEL_UNCOMPRESSED                      policy<{'s390x': 'n'}>
+CONFIG_KERNEL_XZ                                policy<{'amd64': 'n', 'arm64': '-', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_KERNFS                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KEXEC                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KEXEC_CORE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KEXEC_ELF                                policy<{'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_KEXEC_FILE                               policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KEXEC_IMAGE_VERIFY_SIG                   policy<{'arm64': 'y'}>
+CONFIG_KEXEC_JUMP                               policy<{'amd64': 'y'}>
+CONFIG_KEXEC_SIG                                policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_KEXEC_SIG_FORCE                          policy<{'amd64': 'n'}>
+CONFIG_KEYBOARD_ADC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_ADP5520                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_ADP5588                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_ADP5589                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_APPLESPI                        policy<{'amd64': 'm'}>
+CONFIG_KEYBOARD_ATKBD                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_KEYBOARD_BCM                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_CAP11XX                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_CROS_EC                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_KEYBOARD_CYPRESS_SF                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_DLINK_DIR685                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_GOLDFISH_EVENTS                 policy<{'riscv64': 'm'}>
+CONFIG_KEYBOARD_GPIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_GPIO_POLLED                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_IMX                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_KEYBOARD_IMX_SC_KEY                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_KEYBOARD_IQS62X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_LKKBD                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_LM8323                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_LM8333                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_MATRIX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_MAX7359                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_MCS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_MPR121                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_MT6779                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_KEYBOARD_MTK_PMIC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_NEWTON                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_NVEC                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_KEYBOARD_OMAP4                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_OPENCORES                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_PINEPHONE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_PMIC8XXX                        policy<{'armhf': 'm'}>
+CONFIG_KEYBOARD_QT1050                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_QT1070                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_QT2160                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_SAMSUNG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_SNVS_PWRKEY                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_KEYBOARD_STMPE                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_STOWAWAY                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_SUN4I_LRADC                     policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_SUNKBD                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_TC3589X                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KEYBOARD_TCA6416                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_TCA8418                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_TEGRA                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_KEYBOARD_TM2_TOUCHKEY                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_TWL4030                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYBOARD_XTKBD                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KEYS                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KEYS_REQUEST_CACHE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KEY_DH_OPERATIONS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KEY_NOTIFICATIONS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KFENCE                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KFENCE_DEFERRABLE                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_KFENCE_NUM_OBJECTS                       policy<{'amd64': '255', 'arm64': '255', 'armhf': '255', 'ppc64el': '255', 'riscv64': '255', 's390x': '255'}>
+CONFIG_KFENCE_SAMPLE_INTERVAL                   policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_KFENCE_STRESS_TEST_FAULTS                policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_KGDB                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_KGDB_HONOUR_BLOCKLIST                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_KGDB_KDB                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_KGDB_LOW_LEVEL_TRAP                      policy<{'amd64': 'y'}>
+CONFIG_KGDB_TESTS                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_KHADAS_MCU_FAN_THERMAL                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_KMAP_LOCAL                               policy<{'armhf': 'y'}>
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY          policy<{'armhf': 'y'}>
+CONFIG_KMX61                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KPROBES                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KPROBES_ON_FTRACE                        policy<{'amd64': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_KPROBE_EVENTS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KPROBE_EVENTS_ON_NOTRACE                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_KPROBE_EVENT_GEN_TEST                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_KPSS_XCC                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_KRAITCC                                  policy<{'armhf': 'm'}>
+CONFIG_KRAIT_CLOCKS                             policy<{'armhf': 'y'}>
+CONFIG_KRAIT_L2_ACCESSORS                       policy<{'armhf': 'y'}>
+CONFIG_KRETPROBES                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KRETPROBE_ON_RETHOOK                     policy<{'amd64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KS0108                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KS0108_DELAY                             policy<{'amd64': '2', 'arm64': '2', 'armhf': '2', 'ppc64el': '2', 'riscv64': '2'}>
+CONFIG_KS0108_PORT                              policy<{'amd64': '0x378', 'arm64': '0x378', 'armhf': '0x378', 'ppc64el': '0x378', 'riscv64': '0x378'}>
+CONFIG_KS7010                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KS8842                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KS8851                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KS8851_MLL                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KSM                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KSZ884X_PCI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_KUNIT                                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_KUNPENG_HCCS                             policy<{'arm64': 'm'}>
+CONFIG_KUSER_HELPERS                            policy<{'arm64': 'y', 'arm64-generic-64k': '-', 'armhf': 'y'}>
+CONFIG_KVM_AMD                                  policy<{'amd64': 'm'}>
+CONFIG_KVM_AMD_SEV                              policy<{'amd64': 'y'}>
+CONFIG_KVM_ASYNC_PF                             policy<{'amd64': 'y', 's390x': 'y'}>
+CONFIG_KVM_ASYNC_PF_SYNC                        policy<{'s390x': 'y'}>
+CONFIG_KVM_BOOK3S_64                            policy<{'ppc64el': 'm'}>
+CONFIG_KVM_BOOK3S_64_HANDLER                    policy<{'ppc64el': 'y'}>
+CONFIG_KVM_BOOK3S_64_HV                         policy<{'ppc64el': 'm'}>
+CONFIG_KVM_BOOK3S_HANDLER                       policy<{'ppc64el': 'y'}>
+CONFIG_KVM_BOOK3S_HV_EXIT_TIMING                policy<{'ppc64el': 'y'}>
+CONFIG_KVM_BOOK3S_HV_NESTED_PMU_WORKAROUND      policy<{'ppc64el': 'y'}>
+CONFIG_KVM_BOOK3S_HV_P9_TIMING                  policy<{'ppc64el': 'y'}>
+CONFIG_KVM_BOOK3S_HV_POSSIBLE                   policy<{'ppc64el': 'y'}>
+CONFIG_KVM_COMMON                               policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_KVM_COMPAT                               policy<{'amd64': 'y'}>
+CONFIG_KVM_EXTERNAL_WRITE_TRACKING              policy<{'amd64': 'y'}>
+CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT        policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_KVM_GENERIC_HARDWARE_ENABLING            policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES            policy<{'amd64': 'y'}>
+CONFIG_KVM_GENERIC_MMU_NOTIFIER                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_KVM_GENERIC_PRIVATE_MEM                  policy<{'amd64': 'y'}>
+CONFIG_KVM_GUEST                                policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_KVM_HYPERV                               policy<{'amd64': 'y'}>
+CONFIG_KVM_INTEL                                policy<{'amd64': 'm'}>
+CONFIG_KVM_MAX_NR_VCPUS                         policy<{'amd64': '4096'}>
+CONFIG_KVM_MMIO                                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': '-', 'riscv64': 'y'}>
+CONFIG_KVM_PRIVATE_MEM                          policy<{'amd64': 'y'}>
+CONFIG_KVM_PROVE_MMU                            policy<{'amd64': 'n'}>
+CONFIG_KVM_S390_UCONTROL                        policy<{'s390x': 'n'}>
+CONFIG_KVM_SMM                                  policy<{'amd64': 'y'}>
+CONFIG_KVM_SW_PROTECTED_VM                      policy<{'amd64': 'y'}>
+CONFIG_KVM_VFIO                                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_KVM_WERROR                               policy<{'amd64': 'y'}>
+CONFIG_KVM_XEN                                  policy<{'amd64': 'y'}>
+CONFIG_KVM_XFER_TO_GUEST_WORK                   policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_KVM_XICS                                 policy<{'ppc64el': 'y'}>
+CONFIG_KVM_XIVE                                 policy<{'ppc64el': 'y'}>
+CONFIG_KXCJK1013                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KXSD9                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KXSD9_I2C                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_KXSD9_SPI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_L2TP                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_L2TP_DEBUGFS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_L2TP_ETH                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_L2TP_IP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_L2TP_V3                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LAN743X                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LAN966X_DCB                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LAN966X_SWITCH                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LAPB                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_LAPBETHER                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LATTICE_ECP3_CONFIG                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LCD2S                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LCD_AMS369FG06                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_CLASS_DEVICE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_LCD_HX8357                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_ILI922X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_ILI9320                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_L4F00242T03                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_LMS283GF05                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_LMS501KF03                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_LTV350QV                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_OTM3225A                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_PLATFORM                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_TDO24M                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCD_VGG2432A4                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LCS                                      policy<{'s390x': 'm'}>
+CONFIG_LDISC_AUTOLOAD                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LDM_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_LDM_PARTITION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_LD_DEAD_CODE_DATA_ELIMINATION            policy<{'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_LD_HEAD_STUB_CATCH                       policy<{'ppc64el': 'n'}>
+CONFIG_LD_IS_BFD                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LD_ORPHAN_WARN                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LD_ORPHAN_WARN_LEVEL                     policy<{'amd64': '"warn"', 'arm64': '"warn"', 'armhf': '"warn"', 'ppc64el': '"warn"', 'riscv64': '"warn"'}>
+CONFIG_LD_VERSION                               policy<{'amd64': '24200', 'arm64': '24200', 'armhf': '24200', 'ppc64el': '24200', 'riscv64': '24200', 's390x': '24200'}>
+CONFIG_LEDS_88PM860X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_AAEON                               policy<{'amd64': 'm'}>
+CONFIG_LEDS_AAT1290                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_ACER_A500                           policy<{'armhf': 'm'}>
+CONFIG_LEDS_ADP5520                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_AN30259A                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_APU                                 policy<{'amd64': 'm'}>
+CONFIG_LEDS_AS3645A                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_AW200XX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_AW2013                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_BCM6328                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_BCM6358                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_BD2606MVV                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_BD2802                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_BLINKM                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_BRIGHTNESS_HW_CHANGED               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_CHT_WCOVE                           policy<{'amd64': 'm'}>
+CONFIG_LEDS_CLASS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_CLASS_FLASH                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_CLASS_MULTICOLOR                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_CPCAP                               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_CR0014114                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_DA903X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_DA9052                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_DAC124S085                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_EL15203000                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_GPIO                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_GROUP_MULTICOLOR                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_INTEL_SS4200                        policy<{'amd64': 'm'}>
+CONFIG_LEDS_IS31FL319X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_IS31FL32XX                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_KTD202X                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_KTD2692                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LM3530                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_LM3532                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_LM3533                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LM355x                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_LM3601X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LM36274                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LM3642                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_LM3692X                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LM3697                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LP3944                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_LP3952                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_LP50XX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_LP5521                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LP5523                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LP5562                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LP55XX_COMMON                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LP8501                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LP8788                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_LP8860                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_LT3593                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_MAX5970                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_MAX77650                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_MAX77693                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_MAX8997                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_MC13783                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_MENF21BMC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_MLXCPLD                             policy<{'amd64': 'm'}>
+CONFIG_LEDS_MLXREG                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_MT6323                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_MT6360                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_MT6370_FLASH                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_MT6370_RGB                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_NIC78BX                             policy<{'amd64': 'm'}>
+CONFIG_LEDS_NS2                                 policy<{'armhf': 'm'}>
+CONFIG_LEDS_PCA9532                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_PCA9532_GPIO                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_PCA955X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_PCA955X_GPIO                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_PCA963X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_PCA995X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_PM8058                              policy<{'armhf': 'm'}>
+CONFIG_LEDS_POWERNV                             policy<{'ppc64el': 'm'}>
+CONFIG_LEDS_PWM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_PWM_MULTICOLOR                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_QCOM_FLASH                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_LEDS_QCOM_LPG                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_REGULATOR                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_RT4505                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_RT8515                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_SC27XX_BLTC                         policy<{'arm64': 'm'}>
+CONFIG_LEDS_SGM3140                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_SIEMENS_SIMATIC_IPC                 policy<{'amd64': 'm'}>
+CONFIG_LEDS_SIEMENS_SIMATIC_IPC_APOLLOLAKE      policy<{'amd64': 'm'}>
+CONFIG_LEDS_SIEMENS_SIMATIC_IPC_ELKHARTLAKE     policy<{'amd64': 'm'}>
+CONFIG_LEDS_SIEMENS_SIMATIC_IPC_F7188X          policy<{'amd64': 'm'}>
+CONFIG_LEDS_SPI_BYTE                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_SUN50I_A100                         policy<{'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_SYSCON                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_TCA6507                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TI_LMU_COMMON                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TLC591XX                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TPS6105X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_TRIGGERS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_TRIGGER_ACTIVITY                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_AUDIO                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_BACKLIGHT                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_CAMERA                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_CPU                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_TRIGGER_DEFAULT_ON                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_DISK                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_TRIGGER_GPIO                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LEDS_TRIGGER_HEARTBEAT                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_MTD                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_TRIGGER_NETDEV                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_ONESHOT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_PANIC                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEDS_TRIGGER_PATTERN                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_TIMER                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_TRANSIENT                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TRIGGER_TTY                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_TURRIS_OMNIA                        policy<{'armhf': 'm'}>
+CONFIG_LEDS_USER                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_WM831X_STATUS                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LEDS_WM8350                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LED_TRIGGER_PHY                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LEGACY_DIRECT_IO                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LEGACY_PTYS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LEGACY_PTY_COUNT                         policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_LEGACY_VSYSCALL_NONE                     policy<{'amd64': 'n'}>
+CONFIG_LEGACY_VSYSCALL_XONLY                    policy<{'amd64': 'y'}>
+CONFIG_LENOVO_WMI_HOTKEY_UTILITIES              policy<{'amd64': 'm'}>
+CONFIG_LENOVO_YMC                               policy<{'amd64': 'm'}>
+CONFIG_LG_LAPTOP                                policy<{'amd64': 'm'}>
+CONFIG_LIB80211                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIB80211_CRYPT_CCMP                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIB80211_CRYPT_TKIP                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIB80211_CRYPT_WEP                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIB80211_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_LIBCRC32C                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LIBERTAS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIBERTAS_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_LIBERTAS_MESH                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LIBERTAS_SDIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIBERTAS_SPI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIBERTAS_THINFIRM                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIBERTAS_THINFIRM_DEBUG                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_LIBERTAS_THINFIRM_USB                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIBERTAS_USB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIBFC                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LIBFCOE                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LIBFDT                                   policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LIBIPW                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIBIPW_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_LIBNVDIMM                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_LIBWX                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIDAR_LITE_V2                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LINEAR_RANGES                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LINEDISP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIQUIDIO                                 policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LIQUIDIO_CORE                            policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIQUIDIO_VF                              policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LIRC                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LIST_HARDENED                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LITEX                                    policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LITEX_LITEETH                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LITEX_SOC_CONTROLLER                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LIVEPATCH                                policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_LIVEPATCH_64                             policy<{'ppc64el': 'y'}>
+CONFIG_LKDTM                                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LLC                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LLC2                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_LLD_VERSION                              policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_LMK04832                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LMP91000                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LOAD_IPL_KEYS                            policy<{'s390x': 'y'}>
+CONFIG_LOAD_UEFI_KEYS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_LOCALVERSION                             policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '""'}>
+CONFIG_LOCKD                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LOCKDEP_SUPPORT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LOCKD_V4                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LOCKUP_DETECTOR                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LOCK_DEBUGGING_SUPPORT                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LOCK_DOWN_IN_SECURE_BOOT                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LOCK_EVENT_COUNTS                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LOCK_MM_AND_FIND_VMA                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LOCK_SPIN_ON_OWNER                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LOCK_STAT                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LOCK_TORTURE_TEST                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LOGIG940_FF                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LOGIRUMBLEPAD2_FF                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LOGITECH_FF                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LOGIWHEELS_FF                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_LOGO                                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LOG_BUF_SHIFT                            policy<{'amd64': '18', 'arm64': '18', 'armhf': '17', 'ppc64el': '18', 'riscv64': '18', 's390x': '18'}>
+CONFIG_LOG_CPU_MAX_BUF_SHIFT                    policy<{'amd64': '12', 'arm64': '12', 'armhf': '12', 'ppc64el': '12', 'riscv64': '12', 's390x': '12'}>
+CONFIG_LOOPBACK_TARGET                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LP8788_ADC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LPARCFG                                  policy<{'ppc64el': 'y'}>
+CONFIG_LPC_ICH                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_LPC_SCH                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_LP_CONSOLE                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_LRU_CACHE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LRU_GEN_STATS                            policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LRU_GEN_WALKS_MMU                        policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_LSI_ET1011C_PHY                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LSM                                      policy<{'amd64': '"landlock,lockdown,yama,integrity,apparmor"', 'arm64': '"landlock,lockdown,yama,integrity,apparmor"', 'armhf': '"landlock,lockdown,yama,integrity,apparmor"', 'ppc64el': '"landlock,lockdown,yama,integrity,apparmor"', 'riscv64': '"landlock,lockdown,yama,integrity,apparmor"', 's390x': '"landlock,lockdown,yama,integrity,apparmor"'}>
+CONFIG_LSM_MMAP_MIN_ADDR                        policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_LS_EXTIRQ                                policy<{'arm64': 'y'}>
+CONFIG_LS_SCFG_MSI                              policy<{'arm64': 'y'}>
+CONFIG_LTC1660                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTC2309                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTC2471                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTC2485                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTC2496                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTC2497                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTC2632                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTC2688                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTC2983                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTE_GDM724X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_LTO_NONE                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LTR390                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTR501                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LTRF216A                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LV0104CS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_LWQ_TEST                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_LWTUNNEL                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LWTUNNEL_BPF                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LXT_PHY                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LZ4HC_COMPRESS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LZ4_COMPRESS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_LZ4_DECOMPRESS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LZO_COMPRESS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_LZO_DECOMPRESS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_M62332                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAC80211                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAC80211_DEBUGFS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MAC80211_DEBUG_MENU                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_MAC80211_HAS_RC                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MAC80211_HWSIM                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAC80211_LEDS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MAC80211_MESH                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MAC80211_MESSAGE_TRACING                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MAC80211_RC_DEFAULT                      policy<{'amd64': '"minstrel_ht"', 'arm64': '"minstrel_ht"', 'armhf': '"minstrel_ht"', 'ppc64el': '"minstrel_ht"', 'riscv64': '"minstrel_ht"'}>
+CONFIG_MAC80211_RC_DEFAULT_MINSTREL             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MAC80211_RC_MINSTREL                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MAC80211_STA_HASH_MAX_SIZE               policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_MAC802154                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MACB                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MACB_PCI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MACB_USE_HWSTAMP                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MACHZ_WDT                                policy<{'amd64': 'm'}>
+CONFIG_MACH_ARMADA_370                          policy<{'armhf': 'y'}>
+CONFIG_MACH_ARMADA_375                          policy<{'armhf': 'y'}>
+CONFIG_MACH_ARMADA_38X                          policy<{'armhf': 'y'}>
+CONFIG_MACH_ARMADA_39X                          policy<{'armhf': 'y'}>
+CONFIG_MACH_ARMADA_XP                           policy<{'armhf': 'y'}>
+CONFIG_MACH_ARTPEC6                             policy<{'armhf': 'n'}>
+CONFIG_MACH_ASPEED_G6                           policy<{'armhf': 'y'}>
+CONFIG_MACH_BERLIN_BG2                          policy<{'armhf': 'y'}>
+CONFIG_MACH_BERLIN_BG2CD                        policy<{'armhf': 'y'}>
+CONFIG_MACH_BERLIN_BG2Q                         policy<{'armhf': 'y'}>
+CONFIG_MACH_DOVE                                policy<{'armhf': 'y'}>
+CONFIG_MACH_INFINITY                            policy<{'armhf': 'y'}>
+CONFIG_MACH_MESON6                              policy<{'armhf': 'y'}>
+CONFIG_MACH_MESON8                              policy<{'armhf': 'y'}>
+CONFIG_MACH_MT2701                              policy<{'armhf': 'y'}>
+CONFIG_MACH_MT6589                              policy<{'armhf': 'y'}>
+CONFIG_MACH_MT6592                              policy<{'armhf': 'y'}>
+CONFIG_MACH_MT7623                              policy<{'armhf': 'y'}>
+CONFIG_MACH_MT7629                              policy<{'armhf': 'y'}>
+CONFIG_MACH_MT8127                              policy<{'armhf': 'y'}>
+CONFIG_MACH_MT8135                              policy<{'armhf': 'y'}>
+CONFIG_MACH_MVEBU_ANY                           policy<{'armhf': 'y'}>
+CONFIG_MACH_MVEBU_V7                            policy<{'armhf': 'y'}>
+CONFIG_MACH_OMAP_GENERIC                        policy<{'armhf': 'y'}>
+CONFIG_MACINTOSH_DRIVERS                        policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_MACSEC                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MACVLAN                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MACVTAP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MAC_EMUMOUSEBTN                          policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_MAC_PARTITION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MADERA_IRQ                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAG3110                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAGIC_SYSRQ                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE               policy<{'amd64': '0x01b6', 'arm64': '0x01b6', 'armhf': '0x01b6', 'ppc64el': '0x01b6', 'riscv64': '0x01b6', 's390x': '0x01b6'}>
+CONFIG_MAGIC_SYSRQ_SERIAL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE              policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '""'}>
+CONFIG_MAILBOX                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MAILBOX_TEST                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MANAGER_SBS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MANA_INFINIBAND                          policy<{'amd64': 'm'}>
+CONFIG_MANTIS_CORE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAPPING_DIRTY_HELPERS                    policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_MARCH_Z10                                policy<{'s390x': 'n'}>
+CONFIG_MARCH_Z13                                policy<{'s390x': 'y'}>
+CONFIG_MARCH_Z14                                policy<{'s390x': 'n'}>
+CONFIG_MARCH_Z15                                policy<{'s390x': 'n'}>
+CONFIG_MARCH_Z16                                policy<{'s390x': 'n'}>
+CONFIG_MARCH_Z16_TUNE                           policy<{'s390x': 'y'}>
+CONFIG_MARCH_Z196                               policy<{'s390x': 'n'}>
+CONFIG_MARCH_ZEC12                              policy<{'s390x': 'n'}>
+CONFIG_MARVELL_10G_PHY                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MARVELL_88Q2XXX_PHY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MARVELL_88X2222_PHY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MARVELL_CN10K_DDR_PMU                    policy<{'arm64': 'm'}>
+CONFIG_MARVELL_CN10K_TAD_PMU                    policy<{'arm64': 'm'}>
+CONFIG_MARVELL_GTI_WDT                          policy<{'arm64-generic': 'm', 'arm64-generic-64k': 'y'}>
+CONFIG_MARVELL_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MATOM                                    policy<{'amd64': 'n'}>
+CONFIG_MAX1027                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX11100                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX1118                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX11205                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX11410                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX1241                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX1363                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX30100                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX30102                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX30208                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX31827                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX31856                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX31865                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX34408                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX44000                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX44009                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX517                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX5432                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX5481                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX5487                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX5522                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX5821                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX63XX_WATCHDOG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MAX77541_ADC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX77620_THERMAL                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX77620_WATCHDOG                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAX8925_POWER                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MAX9611                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAXIM_THERMOCOUPLE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MAXLINEAR_GPHY                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MAXSMP                                   policy<{'amd64': 'y'}>
+CONFIG_MAX_PHYSMEM_BITS                         policy<{'s390x': '46'}>
+CONFIG_MAX_SKB_FRAGS                            policy<{'amd64': '17', 'arm64': '17', 'armhf': '17', 'ppc64el': '17', 'riscv64': '17', 's390x': '17'}>
+CONFIG_MB1232                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MC3230                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCB                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MCB_LPC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCB_PCI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCHP_CLK_MPFS                            policy<{'riscv64': 'y'}>
+CONFIG_MCORE2                                   policy<{'amd64': 'n'}>
+CONFIG_MCP320X                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP3422                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP3564                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP3911                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP4018                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP41010                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP4131                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP4531                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP4725                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP4728                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP4821                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP4922                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCP9600                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCPM                                     policy<{'armhf': 'y'}>
+CONFIG_MCPM_QUAD_CLUSTER                        policy<{'armhf': 'y'}>
+CONFIG_MCTP                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MCTP_FLOWS                               policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_MCTP_SERIAL                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MCTP_TRANSPORT_I2C                       policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MCTP_TRANSPORT_I3C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MD                                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MDIO                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_ASPEED                              policy<{'armhf': 'm'}>
+CONFIG_MDIO_BCM_UNIMAC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MDIO_BITBANG                             policy<{'amd64': 'm', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MDIO_BUS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MDIO_BUS_MUX                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_BUS_MUX_GPIO                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_BUS_MUX_MESON_G12A                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MDIO_BUS_MUX_MESON_GXL                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MDIO_BUS_MUX_MMIOREG                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_BUS_MUX_MULTIPLEXER                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_CAVIUM                              policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_DEVICE                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MDIO_DEVRES                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MDIO_GPIO                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_HISI_FEMAC                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_I2C                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MDIO_IPQ4019                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_IPQ8064                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_MSCC_MIIM                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MDIO_MVUSB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MDIO_OCTEON                              policy<{'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_REGMAP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MDIO_SUN4I                               policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_MDIO_THUNDER                             policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MDIO_XGENE                               policy<{'arm64': 'm'}>
+CONFIG_MDM_GCC_9607                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_MDM_GCC_9615                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_MD_AUTODETECT                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MD_BITMAP_FILE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MD_CLUSTER                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MD_RAID0                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MD_RAID1                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MD_RAID10                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MD_RAID456                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MEDIATEK_GE_PHY                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MEDIATEK_GE_SOC_PHY                      policy<{'amd64': 'n', 'arm64': 'm', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_MEDIATEK_MT6360_ADC                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIATEK_MT6370_ADC                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIATEK_MT6577_AUXADC                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MEDIATEK_WATCHDOG                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MEDIA_ALTERA_CI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_ANALOG_TV_SUPPORT                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_ATTACH                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_CAMERA_SUPPORT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_CEC_RC                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_CEC_SUPPORT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MEDIA_COMMON_OPTIONS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_CONTROLLER                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_CONTROLLER_DVB                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_PCI_SUPPORT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_PLATFORM_DRIVERS                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_PLATFORM_SUPPORT                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_RADIO_SUPPORT                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_SDR_SUPPORT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_SUBDRV_AUTOSELECT                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_SUPPORT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MEDIA_SUPPORT_FILTER                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_TEST_SUPPORT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEDIA_TUNER                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_E4000                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_FC0011                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_FC0012                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_FC0013                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_FC2580                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_IT913X                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_M88RS6000T                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MAX2165                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MC44S803                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MSI001                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MT2060                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MT2063                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MT20XX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MT2131                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MT2266                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MXL301RF                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MXL5005S                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_MXL5007T                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_QM1D1B0004                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_QM1D1C0042                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_QT1010                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_R820T                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_SI2157                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_SIMPLE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TDA18212                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TDA18218                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TDA18250                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TDA18271                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TDA827X                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TDA8290                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TDA9887                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TEA5761                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TEA5767                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_TUA9001                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_XC2028                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_XC4000                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_TUNER_XC5000                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEDIA_USB_SUPPORT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEGARAID_LEGACY                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MEGARAID_MAILBOX                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEGARAID_MM                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MEGARAID_NEWGEN                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MEGARAID_SAS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MELLANOX_PLATFORM                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MEMBARRIER                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MEMCG                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MEMCG_KMEM                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MEMFD_CREATE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MEMORY                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MEMORY_BALLOON                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MEMORY_FAILURE                           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_MEMORY_HOTPLUG                           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_MEMORY_HOTREMOVE                         policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_MEMORY_ISOLATION                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MEMORY_NOTIFIER_ERROR_INJECT             policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 's390x': 'm'}>
+CONFIG_MEMREGION                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEMSTICK                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MEMSTICK_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MEMSTICK_JMICRON_38X                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEMSTICK_R592                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEMSTICK_REALTEK_PCI                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEMSTICK_REALTEK_USB                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEMSTICK_TIFM_MS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEMSTICK_UNSAFE_RESUME                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MEMTEST                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MEM_SOFT_DIRTY                           policy<{'amd64': 'y', 'ppc64el': 'n', 's390x': 'y'}>
+CONFIG_MENF21BMC_WATCHDOG                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MENZ069_WATCHDOG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MEN_A21_WDT                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MEN_Z188_ADC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MERAKI_MX100                             policy<{'amd64': 'm'}>
+CONFIG_MESON6_TIMER                             policy<{'armhf': 'y'}>
+CONFIG_MESON_CANVAS                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MESON_CLK_MEASURE                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MESON_DDR_PMU                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MESON_EE_PM_DOMAINS                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MESON_GXBB_WATCHDOG                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MESON_GXL_PHY                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MESON_GX_PM_DOMAINS                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MESON_GX_SOCINFO                         policy<{'arm64': 'y'}>
+CONFIG_MESON_IRQ_GPIO                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MESON_MX_AO_ARC_REMOTEPROC               policy<{'armhf': 'm'}>
+CONFIG_MESON_MX_SOCINFO                         policy<{'armhf': 'y'}>
+CONFIG_MESON_SARADC                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MESON_SECURE_PM_DOMAINS                  policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_MESON_SM                                 policy<{'arm64': 'y', 'arm64-generic-64k': '-'}>
+CONFIG_MESON_WATCHDOG                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MESSAGE_LOGLEVEL_DEFAULT                 policy<{'amd64': '4', 'arm64': '4', 'armhf': '4', 'ppc64el': '4', 'riscv64': '4', 's390x': '4'}>
+CONFIG_MFD_88PM800                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_88PM805                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_88PM860X                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_AAEON                                policy<{'amd64': 'm'}>
+CONFIG_MFD_AAT2870_CORE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_AC100                                policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_MFD_ACER_A500_EC                         policy<{'armhf': 'm'}>
+CONFIG_MFD_ACT8945A                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_ALTERA_A10SR                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MFD_ALTERA_SYSMGR                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MFD_ARIZONA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_ARIZONA_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_ARIZONA_SPI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MFD_AS3711                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_AS3722                               policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_ATC260X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_ATC260X_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_ATMEL_FLEXCOM                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_ATMEL_HLCDC                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_AXP20X                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_AXP20X_I2C                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_AXP20X_RSB                           policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_MFD_BCM590XX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_BD9571MWV                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_CORE                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_MFD_CPCAP                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_CROS_EC_DEV                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MFD_CS42L43                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MFD_CS42L43_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MFD_CS42L43_SDW                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_CS47L15                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_CS47L24                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_CS47L35                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_CS47L85                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_CS47L90                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_CS47L92                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_DA9052_I2C                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_DA9052_SPI                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_DA9055                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_DA9062                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_DA9063                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MFD_DA9150                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_DLN2                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MFD_EXYNOS_LPASS                         policy<{'armhf': 'n'}>
+CONFIG_MFD_GATEWORKS_GSC                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_HI6421_PMIC                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_HI6421_SPMI                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_HI655X_PMIC                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MFD_INTEL_LPSS                           policy<{'amd64': 'm'}>
+CONFIG_MFD_INTEL_LPSS_ACPI                      policy<{'amd64': 'm'}>
+CONFIG_MFD_INTEL_LPSS_PCI                       policy<{'amd64': 'm'}>
+CONFIG_MFD_INTEL_M10_BMC_CORE                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_INTEL_M10_BMC_PMCI                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_INTEL_M10_BMC_SPI                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_INTEL_PMC_BXT                        policy<{'amd64': 'm'}>
+CONFIG_MFD_INTEL_QUARK_I2C_GPIO                 policy<{'amd64': 'm'}>
+CONFIG_MFD_IQS62X                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_JANZ_CMODIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_KEMPLD                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_KHADAS_MCU                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MFD_LM3533                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_LOCHNAGAR                            policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_LP3943                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_LP8788                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_MADERA                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_MADERA_I2C                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_MADERA_SPI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_MAX14577                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MFD_MAX5970                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_MAX77541                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_MAX77620                             policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_MAX77650                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_MAX77686                             policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_MAX77693                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MFD_MAX77714                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_MAX77843                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_MAX8907                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_MAX8925                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_MAX8997                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_MAX8998                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_MC13XXX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_MC13XXX_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_MC13XXX_SPI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MFD_MENF21BMC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_MP2629                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_MT6360                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_MT6370                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_MT6397                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_NTXEC                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_NVEC                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MFD_OCELOT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_OMAP_USB_HOST                        policy<{'armhf': 'y'}>
+CONFIG_MFD_PALMAS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_PCF50633                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_PM8XXX                               policy<{'armhf': 'm'}>
+CONFIG_MFD_QCOM_PM8008                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_QCOM_RPM                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MFD_RC5T583                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_RDC321X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_RETU                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_RK8XX                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_RK8XX_I2C                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_RK8XX_SPI                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_RN5T618                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_ROHM_BD71828                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_ROHM_BD718XX                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_ROHM_BD957XMUF                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_RSMU_I2C                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_RSMU_SPI                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_RT4831                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_RT5033                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_RT5120                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_SC27XX_PMIC                          policy<{'arm64': 'm'}>
+CONFIG_MFD_SEC_CORE                             policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_SI476X_CORE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_SIMPLE_MFD_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_SKY81452                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_SL28CPLD                             policy<{'arm64': 'm'}>
+CONFIG_MFD_SM501_GPIO                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_SMPRO                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_SPMI_PMIC                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MFD_STM32_LPTIMER                        policy<{'arm64': 'm'}>
+CONFIG_MFD_STM32_TIMERS                         policy<{'arm64': 'm'}>
+CONFIG_MFD_STMFX                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_STMPE                                policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_STPMIC1                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_SUN4I_GPADC                          policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_MFD_SUN6I_PRCM                           policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_MFD_SY7636A                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_SYSCON                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MFD_TC3589X                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_TI_AM335X_TSCADC                     policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-', 's390x': '-'}>
+CONFIG_MFD_TI_LMU                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_TI_LP873X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_TI_LP87565                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_TPS65086                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_TPS65090                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_TPS65218                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_TPS65219                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_TPS6586X                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_TPS65910                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_TPS65912                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_TPS65912_I2C                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MFD_TPS65912_SPI                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_TPS6594                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MFD_TPS6594_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MFD_TPS6594_SPI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MFD_TQMX86                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_TWL4030_AUDIO                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_VEXPRESS_SYSREG                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MFD_VIPERBOARD                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MFD_VX855                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_WCD934X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_WL1273_CORE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_WM5102                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_WM5110                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_WM831X                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_WM831X_I2C                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_WM831X_SPI                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_WM8350                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_WM8350_I2C                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_WM8400                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MFD_WM8994                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MFD_WM8997                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MFD_WM8998                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MHI_BUS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MHI_BUS_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MHI_BUS_EP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MHI_BUS_PCI_GENERIC                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MHI_NET                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MHI_WWAN_CTRL                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MHI_WWAN_MBIM                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MICREL_KS8995MA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MICREL_PHY                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MICROCHIP_PHY                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MICROCHIP_PIT64B                         policy<{'arm64': '-', 'armhf': 'y', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_MICROCHIP_T1S_PHY                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MICROCHIP_T1_PHY                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MICROCODE                                policy<{'amd64': 'y'}>
+CONFIG_MICROCODE_LATE_LOADING                   policy<{'amd64': 'n'}>
+CONFIG_MICROSEMI_PHY                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MICROSOFT_MANA                           policy<{'amd64': 'm', 'arm64': 'n'}>
+CONFIG_MIGHT_HAVE_CACHE_L2X0                    policy<{'armhf': 'y'}>
+CONFIG_MIGRATION                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MII                                      policy<{'amd64': 'm', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MILBEAUT_HDMAC                           policy<{'armhf': 'm'}>
+CONFIG_MILBEAUT_TIMER                           policy<{'armhf': 'y'}>
+CONFIG_MILBEAUT_XDMAC                           policy<{'armhf': 'm'}>
+CONFIG_MINIX_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MINIX_SUBPARTITION                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MIPI_I3C_HCI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISC_ALCOR_PCI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MISC_FILESYSTEMS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MISC_RTSX                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISC_RTSX_PCI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MISC_RTSX_USB                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MISDN                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MISDN_AVMFRITZ                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISDN_DSP                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MISDN_HDLC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISDN_HFCMULTI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISDN_HFCPCI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MISDN_HFCUSB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISDN_INFINEON                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISDN_IPAC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISDN_ISAR                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISDN_L1OIP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MISDN_NETJET                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISDN_SPEEDFAX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MISDN_W6692                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY          policy<{'arm64': 'y'}>
+CONFIG_MITIGATION_RFDS                          policy<{'amd64': 'y'}>
+CONFIG_MITIGATION_SPECTRE_BHI                   policy<{'amd64': 'y'}>
+CONFIG_MK8                                      policy<{'amd64': 'n'}>
+CONFIG_MKISS                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MLX4_CORE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MLX4_CORE_GEN2                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX4_DEBUG                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX4_EN                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MLX4_EN_DCB                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX4_INFINIBAND                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MLX5_BRIDGE                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_CLS_ACT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_CORE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MLX5_CORE_EN                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_CORE_EN_DCB                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_CORE_IPOIB                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_DPLL                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MLX5_EN_ARFS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_EN_IPSEC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_EN_RXNFC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_EN_TLS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_ESWITCH                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_FPGA                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_INFINIBAND                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MLX5_MACSEC                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_MPFS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_SF                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MLX5_SF_MANAGER                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MLX5_SW_STEERING                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_TC_CT                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_TC_SAMPLE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX5_VDPA                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MLX5_VDPA_NET                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MLX5_VDPA_STEERING_DEBUG                 policy<{'amd64': 'n', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MLX5_VFIO_PCI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MLX90614                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MLX90632                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MLX90635                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MLXBF_BOOTCTL                            policy<{'arm64': 'm'}>
+CONFIG_MLXBF_GIGE                               policy<{'arm64': 'm'}>
+CONFIG_MLXBF_PMC                                policy<{'arm64': 'm'}>
+CONFIG_MLXBF_TMFIFO                             policy<{'arm64': 'm'}>
+CONFIG_MLXFW                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MLXREG_HOTPLUG                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MLXREG_IO                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MLXREG_LC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MLXSW_CORE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MLXSW_CORE_HWMON                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MLXSW_CORE_THERMAL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MLXSW_I2C                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MLXSW_MINIMAL                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MLXSW_PCI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MLXSW_SPECTRUM                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MLXSW_SPECTRUM_DCB                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MLX_PLATFORM                             policy<{'amd64': 'm'}>
+CONFIG_MLX_WDT                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMA7455                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMA7455_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMA7455_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMA7660                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMA8452                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMA9551                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMA9551_CORE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMA9553                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_MMC35240                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMCONF_FAM10H                            policy<{'amd64': 'y'}>
+CONFIG_MMC_ALCOR                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_ARMMMCI                              policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'm'}>
+CONFIG_MMC_BLOCK_MINORS                         policy<{'amd64': '8', 'arm64': '8', 'armhf': '8', 'ppc64el': '8', 'riscv64': '8'}>
+CONFIG_MMC_CAVIUM_THUNDERX                      policy<{'arm64': 'm'}>
+CONFIG_MMC_CB710                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_CQHCI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_CRYPTO                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MMC_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MMC_DW                                   policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_DW_BLUEFIELD                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_DW_EXYNOS                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_DW_HI3798CV200                       policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_DW_K3                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_DW_PCI                               policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_DW_PLTFM                             policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_DW_ROCKCHIP                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMC_DW_STARFIVE                          policy<{'riscv64': 'm'}>
+CONFIG_MMC_HSQ                                  policy<{'amd64': 'n', 'arm64': 'm', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_LITEX                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_MESON_GX                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMC_MESON_MX_SDHC                        policy<{'armhf': 'm'}>
+CONFIG_MMC_MESON_MX_SDIO                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMC_MTK                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_MVSDIO                               policy<{'armhf': 'm'}>
+CONFIG_MMC_MXC                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMC_OMAP                                 policy<{'armhf': 'm'}>
+CONFIG_MMC_OWL                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMC_QCOM_DML                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MMC_REALTEK_PCI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_REALTEK_USB                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_RICOH_MMC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MMC_SDHCI_ACPI                           policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHCI_AM654                          policy<{'arm64': 'm', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_MMC_SDHCI_BIG_ENDIAN_32BIT_BYTE_SWAPPER  policy<{'ppc64el': 'y'}>
+CONFIG_MMC_SDHCI_CADENCE                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHCI_DOVE                           policy<{'armhf': 'm'}>
+CONFIG_MMC_SDHCI_ESDHC_IMX                      policy<{'arm64': 'm', 'armhf': 'y'}>
+CONFIG_MMC_SDHCI_EXTERNAL_DMA                   policy<{'arm64': '-', 'armhf': 'y', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_MMC_SDHCI_F_SDH30                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHCI_IO_ACCESSORS                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MMC_SDHCI_MILBEAUT                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHCI_MSM                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMC_SDHCI_NPCM                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMC_SDHCI_OF_ARASAN                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHCI_OF_ASPEED                      policy<{'armhf': 'm'}>
+CONFIG_MMC_SDHCI_OF_AT91                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHCI_OF_DWCMSHC                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHCI_OF_ESDHC                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_MMC_SDHCI_OF_HLWD                        policy<{'ppc64el': 'm'}>
+CONFIG_MMC_SDHCI_OF_SPARX5                      policy<{'arm64': 'm'}>
+CONFIG_MMC_SDHCI_OMAP                           policy<{'arm64': '-', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_MMC_SDHCI_PCI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHCI_PXAV3                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMC_SDHCI_S3C                            policy<{'armhf': 'n'}>
+CONFIG_MMC_SDHCI_SPRD                           policy<{'arm64': 'm'}>
+CONFIG_MMC_SDHCI_TEGRA                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MMC_SDHCI_XENON                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHI                                 policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHI_INTERNAL_DMAC                   policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDHI_SYS_DMAC                        policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SDRICOH_CS                           policy<{'amd64': 'm'}>
+CONFIG_MMC_SH_MMCIF                             policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_SPI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_MMC_STM32_SDMMC                          policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_MMC_SUNPLUS                              policy<{'armhf': 'm'}>
+CONFIG_MMC_SUNXI                                policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_MMC_TEST                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MMC_TIFM_SD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_TMIO_CORE                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MMC_TOSHIBA_PCI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_USDHI6ROL0                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_USHC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_VIA_SDMMC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_VUB300                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MMC_WBSD                                 policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_MMIOTRACE                                policy<{'amd64': 'y'}>
+CONFIG_MMIOTRACE_TEST                           policy<{'amd64': 'n'}>
+CONFIG_MMIOWB                                   policy<{'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MMU                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MMU_GATHER_MERGE_VMAS                    policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_MMU_GATHER_NO_GATHER                     policy<{'s390x': 'y'}>
+CONFIG_MMU_GATHER_PAGE_SIZE                     policy<{'ppc64el': 'y'}>
+CONFIG_MMU_GATHER_RCU_TABLE_FREE                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_MMU_GATHER_TABLE_FREE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_MMU_LAZY_TLB_REFCOUNT                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MMU_LAZY_TLB_SHOOTDOWN                   policy<{'ppc64el': 'y'}>
+CONFIG_MMU_NOTIFIER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODPROBE_PATH                            policy<{'amd64': '"/sbin/modprobe"', 'arm64': '"/sbin/modprobe"', 'armhf': '"/sbin/modprobe"', 'ppc64el': '"/sbin/modprobe"', 'riscv64': '"/sbin/modprobe"', 's390x': '"/sbin/modprobe"'}>
+CONFIG_MODULES                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULES_TREE_LOOKUP                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULES_USE_ELF_REL                      policy<{'armhf': 'y'}>
+CONFIG_MODULES_USE_ELF_RELA                     policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_ALLOW_BTF_MISMATCH                policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_COMPRESS_GZIP                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_COMPRESS_NONE                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_COMPRESS_XZ                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_DECOMPRESS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_FORCE_LOAD                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_FORCE_UNLOAD                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_SECTIONS                          policy<{'riscv64': 'y'}>
+CONFIG_MODULE_SIG                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_SIG_ALL                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_SIG_FORCE                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_SIG_FORMAT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_SIG_HASH                          policy<{'amd64': '"sha512"', 'arm64': '"sha512"', 'armhf': '"sha512"', 'ppc64el': '"sha512"', 'riscv64': '"sha512"', 's390x': '"sha512"'}>
+CONFIG_MODULE_SIG_KEY                           policy<{'amd64': '"certs/signing_key.pem"', 'arm64': '"certs/signing_key.pem"', 'armhf': '"certs/signing_key.pem"', 'ppc64el': '"certs/signing_key.pem"', 'riscv64': '"certs/signing_key.pem"', 's390x': '"certs/signing_key.pem"'}>
+CONFIG_MODULE_SIG_KEY_TYPE_ECDSA                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_SIG_KEY_TYPE_RSA                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_SIG_SHA1                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_SIG_SHA256                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_SIG_SHA384                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_SIG_SHA3_256                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_SIG_SHA3_384                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_SIG_SHA3_512                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MODULE_SIG_SHA512                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_SRCVERSION_ALL                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_UNLOAD                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MODULE_UNLOAD_TAINT_TRACKING             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_MONREADER                                policy<{'s390x': 'm'}>
+CONFIG_MONWRITER                                policy<{'s390x': 'm'}>
+CONFIG_MOST                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MOST_CDEV                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MOST_COMPONENTS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MOST_DIM2                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MOST_I2C                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MOST_NET                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MOST_SND                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MOST_USB_HDM                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MOST_VIDEO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MOTORCOMM_PHY                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_MOUSE_APPLETOUCH                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOUSE_BCM5974                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOUSE_CYAPA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOUSE_ELAN_I2C                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOUSE_ELAN_I2C_I2C                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_ELAN_I2C_SMBUS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_GPIO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOUSE_PS2                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOUSE_PS2_ALPS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_BYD                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_CYPRESS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_ELANTECH                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_ELANTECH_SMBUS                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_FOCALTECH                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_LIFEBOOK                       policy<{'amd64': 'y'}>
+CONFIG_MOUSE_PS2_LOGIPS2PP                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_SENTELIC                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_SMBUS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_SYNAPTICS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_SYNAPTICS_SMBUS                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_TOUCHKIT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_TRACKPOINT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MOUSE_PS2_VMMOUSE                        policy<{'amd64': 'y'}>
+CONFIG_MOUSE_SERIAL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOUSE_SYNAPTICS_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOUSE_SYNAPTICS_USB                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOUSE_VSXXXAA                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOXA_INTELLIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOXA_SMARTIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MOXTET                                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MP2629_ADC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MPIC                                     policy<{'ppc64el': 'y'}>
+CONFIG_MPIC_MSGR                                policy<{'ppc64el': 'n'}>
+CONFIG_MPILIB                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MPL115                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MPL115_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MPL115_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MPL3115                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MPLS                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MPLS_IPTUNNEL                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MPLS_ROUTING                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MPRLS0025PA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MPROFILE_KERNEL                          policy<{'ppc64el': 'y'}>
+CONFIG_MPSC                                     policy<{'amd64': 'n'}>
+CONFIG_MPTCP                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MPTCP_IPV6                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MPU3050                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MPU3050_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MQ_IOSCHED_DEADLINE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MQ_IOSCHED_KYBER                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MRP                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MS5611                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MS5611_I2C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MS5611_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MS5637                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MSA311                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MSC313E_WATCHDOG                         policy<{'armhf': 'm'}>
+CONFIG_MSCC_OCELOT_SWITCH                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MSCC_OCELOT_SWITCH_LIB                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MSDOS_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_MSDOS_PARTITION                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MSE102X                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MSI_BITMAP_SELFTEST                      policy<{'ppc64el': 'n'}>
+CONFIG_MSI_EC                                   policy<{'amd64': 'm'}>
+CONFIG_MSI_LAPTOP                               policy<{'amd64': 'm'}>
+CONFIG_MSI_WMI                                  policy<{'amd64': 'm'}>
+CONFIG_MSM_GCC_8660                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8909                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8916                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8917                             policy<{'arm64': 'm'}>
+CONFIG_MSM_GCC_8939                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8953                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8960                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8974                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8976                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8994                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8996                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_GCC_8998                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_GPUCC_8998                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_IOMMU                                policy<{'armhf': 'n'}>
+CONFIG_MSM_LCC_8960                             policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_MSM_MMCC_8960                            policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_MSM_MMCC_8974                            policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_MSM_MMCC_8994                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_MMCC_8996                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSM_MMCC_8998                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MSPRO_BLOCK                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MSTAR_MSC313_CPUPLL                      policy<{'armhf': 'y'}>
+CONFIG_MSTAR_MSC313_MPLL                        policy<{'armhf': 'y'}>
+CONFIG_MST_IRQ                                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MS_BLOCK                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7601U                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7603E                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7615E                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7615_COMMON                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7622_WMAC                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MT7663S                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7663U                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7663_USB_SDIO_COMMON                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76_CONNAC_LIB                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76_CORE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76_LEDS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MT76_SDIO                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76_USB                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76x02_LIB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76x02_USB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76x0E                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76x0U                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76x0_COMMON                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76x2E                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76x2U                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT76x2_COMMON                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7915E                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7921E                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7921S                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7921U                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7921_COMMON                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7925E                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7925U                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT7925_COMMON                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT792x_LIB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT792x_USB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MT798X_WMAC                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MT7996E                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTDRAM_ERASE_SIZE                        policy<{'amd64': '128', 'arm64': '128', 'armhf': '128', 'ppc64el': '128', 'riscv64': '128'}>
+CONFIG_MTDRAM_TOTAL_SIZE                        policy<{'amd64': '4096', 'arm64': '4096', 'armhf': '4096', 'ppc64el': '4096', 'riscv64': '4096'}>
+CONFIG_MTD_ABSENT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_AFS_PARTS                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_AMD76XROM                            policy<{'amd64': 'm'}>
+CONFIG_MTD_BCM47XXSFLASH                        policy<{'armhf': 'm'}>
+CONFIG_MTD_BLKDEVS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_BLOCK2MTD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_BLOCK_RO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_CFI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_CFI_ADV_OPTIONS                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_CFI_AMDSTD                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_CFI_I1                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_CFI_I2                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_CFI_INTELEXT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_CFI_STAA                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_CFI_UTIL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_CK804XROM                            policy<{'amd64': 'm'}>
+CONFIG_MTD_CMDLINE_PARTS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MTD_COMPLEX_MAPPINGS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_DATAFLASH                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_DATAFLASH_OTP                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_DATAFLASH_WRITE_VERIFY               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_ESB2ROM                              policy<{'amd64': 'm'}>
+CONFIG_MTD_GEN_PROBE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_HYPERBUS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_ICHXROM                              policy<{'amd64': 'm'}>
+CONFIG_MTD_IMPA7                                policy<{'armhf': 'm'}>
+CONFIG_MTD_INTEL_VR_NOR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_JEDECPROBE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_L440GX                               policy<{'amd64': 'm'}>
+CONFIG_MTD_LPDDR                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_LPDDR2_NVM                           policy<{'armhf': 'm'}>
+CONFIG_MTD_MAP_BANK_WIDTH_1                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_MAP_BANK_WIDTH_2                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_MAP_BANK_WIDTH_4                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_MCHP23K256                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_MCHP48L640                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_MTDRAM                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_ARASAN                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_BRCMNAND                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_BRCMNAND_BCM63XX                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_BRCMNAND_BCMBCA                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_BRCMNAND_BRCMSTB                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_BRCMNAND_IPROC                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_CADENCE                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_CAFE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_CORE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_DENALI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_DENALI_DT                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_DENALI_PCI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_DISKONCHIP                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADDRESS        policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADVANCED       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_MTD_NAND_ECC                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_NAND_ECC_MEDIATEK                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_ECC_MXIC                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_NAND_ECC_SW_BCH                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_NAND_ECC_SW_HAMMING                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_NAND_ECC_SW_HAMMING_SMC              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_NAND_FSL_IFC                         policy<{'arm64': 'm'}>
+CONFIG_MTD_NAND_GPIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_GPMI_NAND                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_HISI504                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_INTEL_LGM                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_MARVELL                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_MESON                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_MTK                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_MXC                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_MXIC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_NANDSIM                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_OMAP2                           policy<{'arm64': 'm', 'armhf': 'y'}>
+CONFIG_MTD_NAND_OMAP_BCH                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MTD_NAND_OMAP_BCH_BUILD                  policy<{'arm64': 'm', 'armhf': 'y'}>
+CONFIG_MTD_NAND_ORION                           policy<{'armhf': 'm'}>
+CONFIG_MTD_NAND_PL35X                           policy<{'armhf': 'm'}>
+CONFIG_MTD_NAND_PLATFORM                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_QCOM                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_RENESAS                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_RICOH                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_NAND_ROCKCHIP                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_STM32_FMC2                      policy<{'arm64': 'm'}>
+CONFIG_MTD_NAND_SUNXI                           policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_MTD_NAND_TEGRA                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_NAND_VF610_NFC                       policy<{'armhf': 'n'}>
+CONFIG_MTD_NETtel                               policy<{'amd64': 'm'}>
+CONFIG_MTD_ONENAND                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_ONENAND_2X_PROGRAM                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_ONENAND_GENERIC                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_ONENAND_OTP                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_OOPS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_PARSER_TRX                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_PARTITIONED_MASTER                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_PCI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_PCMCIA                               policy<{'amd64': 'm'}>
+CONFIG_MTD_PCMCIA_ANONYMOUS                     policy<{'amd64': 'n'}>
+CONFIG_MTD_PHRAM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_PHYSMAP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_PHYSMAP_COMPAT                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_PHYSMAP_GEMINI                       policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_MTD_PHYSMAP_GPIO_ADDR                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_PHYSMAP_IXP4XX                       policy<{'armhf': 'y'}>
+CONFIG_MTD_PHYSMAP_OF                           policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_PHYSMAP_VERSATILE                    policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_MTD_PLATRAM                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_PMC551                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_PMC551_BUGFIX                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_PMC551_DEBUG                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_POWERNV_FLASH                        policy<{'ppc64el': 'm'}>
+CONFIG_MTD_PSTORE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_QCOMSMEM_PARTS                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTD_QINFO_PROBE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_RAM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK              policy<{'amd64': '-1', 'arm64': '-1', 'armhf': '-1', 'ppc64el': '-1', 'riscv64': '-1'}>
+CONFIG_MTD_REDBOOT_PARTS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_REDBOOT_PARTS_READONLY               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_ROM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_SBC_GXX                              policy<{'amd64': 'm'}>
+CONFIG_MTD_SCB2_FLASH                           policy<{'amd64': 'm'}>
+CONFIG_MTD_SLRAM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_SM_COMMON                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_SPI_NAND                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_SPI_NOR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_SPI_NOR_SWP_DISABLE                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_SPI_NOR_SWP_DISABLE_ON_VOLATILE      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_SPI_NOR_SWP_KEEP                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_SPI_NOR_USE_4K_SECTORS               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_SST25L                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_SWAP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_TESTS                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_MTD_UBI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_UBI_BEB_LIMIT                        policy<{'amd64': '20', 'arm64': '20', 'armhf': '20', 'ppc64el': '20', 'riscv64': '20'}>
+CONFIG_MTD_UBI_BLOCK                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_UBI_FASTMAP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MTD_UBI_GLUEBI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTD_UBI_WL_THRESHOLD                     policy<{'amd64': '4096', 'arm64': '4096', 'armhf': '4096', 'ppc64el': '4096', 'riscv64': '4096'}>
+CONFIG_MTK_ADSP_IPC                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_ADSP_MBOX                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_CMDQ                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_CMDQ_MBOX                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_CPUX_TIMER                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MTK_CQDMA                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_DEVAPC                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_HSDMA                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_INFRACFG                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MTK_IOMMU                                policy<{'arm64': 'm', 'armhf': 'n'}>
+CONFIG_MTK_IOMMU_V1                             policy<{'armhf': 'n'}>
+CONFIG_MTK_LVTS_THERMAL                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_LVTS_THERMAL_DEBUGFS                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MTK_MMSYS                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_PMIC_WRAP                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_REGULATOR_COUPLER                    policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MTK_SCP                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_SCPSYS                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MTK_SCPSYS_PM_DOMAINS                    policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MTK_SMI                                  policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_MTK_SOC_THERMAL                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_SVS                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_T7XX                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MTK_THERMAL                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTK_TIMER                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MTK_UART_APDMA                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MTRR                                     policy<{'amd64': 'y'}>
+CONFIG_MTRR_SANITIZER                           policy<{'amd64': 'y'}>
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT            policy<{'amd64': '1'}>
+CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT      policy<{'amd64': '1'}>
+CONFIG_MULTIPLEXER                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MULTIUSER                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MUSB_PIO_ONLY                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_MUTEX_SPIN_ON_OWNER                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_MUX_ADG792A                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MUX_ADGS1408                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MUX_GPIO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MUX_MMIO                                 policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MV643XX_ETH                              policy<{'armhf': 'm'}>
+CONFIG_MVEBU_CLK_COMMON                         policy<{'armhf': 'y'}>
+CONFIG_MVEBU_CLK_COREDIV                        policy<{'armhf': 'y'}>
+CONFIG_MVEBU_CLK_CPU                            policy<{'armhf': 'y'}>
+CONFIG_MVEBU_DEVBUS                             policy<{'armhf': 'y'}>
+CONFIG_MVEBU_GICP                               policy<{'arm64': 'y'}>
+CONFIG_MVEBU_ICU                                policy<{'arm64': 'y'}>
+CONFIG_MVEBU_MBUS                               policy<{'armhf': 'y'}>
+CONFIG_MVEBU_ODMI                               policy<{'arm64': 'y'}>
+CONFIG_MVEBU_PIC                                policy<{'arm64': 'y'}>
+CONFIG_MVEBU_SEI                                policy<{'arm64': 'y'}>
+CONFIG_MVMDIO                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MVNETA                                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MVNETA_BM_ENABLE                         policy<{'armhf': 'n'}>
+CONFIG_MVPP2                                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_MVPP2_PTP                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MV_XOR                                   policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MV_XOR_V2                                policy<{'arm64': 'y'}>
+CONFIG_MWAVE                                    policy<{'amd64': 'm'}>
+CONFIG_MWIFIEX                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MWIFIEX_PCIE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MWIFIEX_SDIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MWIFIEX_USB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MWL8K                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MXC4005                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MXC6255                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_MXC_CLK                                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MXC_CLK_SCU                              policy<{'arm64': 'y'}>
+CONFIG_MXC_TZIC                                 policy<{'armhf': 'y'}>
+CONFIG_MXM_WMI                                  policy<{'amd64': 'm'}>
+CONFIG_MXS_DMA                                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_MYRI10GE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_MYRI10GE_DCA                             policy<{'amd64': 'y'}>
+CONFIG_NAMESPACES                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NATIONAL_PHY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NATSEMI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_NAU7802                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NBPFAXI_DMA                              policy<{'armhf': 'm'}>
+CONFIG_NCN26000_PHY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_NCSI_OEM_CMD_GET_MAC                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NCSI_OEM_CMD_KEEP_PHY                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NDC_DIS_DYNAMIC_CACHING                  policy<{'arm64': 'y'}>
+CONFIG_ND_BTT                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ND_CLAIM                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ND_PFN                                   policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm'}>
+CONFIG_NE2K_PCI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_NEED_DMA_MAP_STATE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NEED_KVM_DIRTY_RING_WITH_BITMAP          policy<{'arm64': 'y'}>
+CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NEED_SG_DMA_FLAGS                        policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_NEED_SG_DMA_LENGTH                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_NEED_SRCU_NMI_SAFE                       policy<{'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_NEON                                     policy<{'armhf': 'y'}>
+CONFIG_NET                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETCONSOLE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETCONSOLE_DYNAMIC                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETCONSOLE_EXTENDED_LOG                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NETDEVICES                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETDEVSIM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETDEV_NOTIFIER_ERROR_INJECT             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NETFILTER                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFILTER_ADVANCED                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFILTER_BPF_LINK                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFILTER_CONNCOUNT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_EGRESS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFILTER_FAMILY_ARP                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFILTER_FAMILY_BRIDGE                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFILTER_INGRESS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFILTER_NETLINK                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_NETLINK_ACCT                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_NETLINK_GLUE_CT                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFILTER_NETLINK_HOOK                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_NETLINK_LOG                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_NETLINK_OSF                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_NETLINK_QUEUE                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_SKIP_EGRESS                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFILTER_SYNPROXY                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XTABLES                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XTABLES_COMPAT                 policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'ppc64el': '-', 'riscv64': '-', 's390x': '-'}>
+CONFIG_NETFILTER_XT_CONNMARK                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MARK                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_BPF                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_CGROUP                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_CLUSTER               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_COMMENT               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_CONNMARK              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_CPU                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_DCCP                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_DSCP                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_ECN                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_ESP                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_HELPER                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_HL                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_IPCOMP                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_IPRANGE               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_IPVS                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_L2TP                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_LENGTH                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_LIMIT                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_MAC                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_MARK                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_NFACCT                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_OSF                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_OWNER                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_POLICY                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_QUOTA                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_RATEEST               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_REALM                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_RECENT                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_SCTP                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_SOCKET                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_STATE                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_STATISTIC             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_STRING                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_TCPMSS                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_TIME                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_MATCH_U32                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_NAT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_SET                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_AUDIT                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_CONNMARK             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_CT                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_DSCP                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_HL                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_HMARK                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_LED                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_NETFILTER_XT_TARGET_LOG                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_MARK                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_NETMAP               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_NFLOG                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_NOTRACK              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NETFILTER_XT_TARGET_RATEEST              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_REDIRECT             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_SECMARK              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_TCPMSS               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_TEE                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_TPROXY               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFILTER_XT_TARGET_TRACE                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETFS_STATS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETFS_SUPPORT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETIUCV                                  policy<{'s390x': 'm'}>
+CONFIG_NETKIT                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETLABEL                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETLINK_DIAG                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NETPOLL                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETROM                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NETWORK_FILESYSTEMS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETWORK_SECMARK                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NETXEN_NIC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_NET_9P_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NET_9P_FD                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_9P_RDMA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_9P_VIRTIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_9P_XEN                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_NET_ACT_BPF                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_CONNMARK                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_CSUM                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_CT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_CTINFO                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_GACT                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_GATE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_IFE                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NET_ACT_IPT                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_MIRRED                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_MPLS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_NAT                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_PEDIT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_POLICE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_SAMPLE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_SIMP                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_SKBEDIT                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_SKBMOD                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_TUNNEL_KEY                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_ACT_VLAN                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CALXEDA_XGMAC                        policy<{'armhf': 'm'}>
+CONFIG_NET_CLS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_CLS_ACT                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_CLS_BASIC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CLS_BPF                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CLS_CGROUP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CLS_FLOW                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CLS_FLOWER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CLS_FW                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CLS_MATCHALL                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CLS_ROUTE4                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CLS_U32                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_CORE                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_DEVLINK                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_DEV_REFCNT_TRACKER                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NET_DSA                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_NET_DSA_AR9331                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_BCM_SF2                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_HIRSCHMANN_HELLCREEK             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_LANTIQ_GSWIP                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_LOOP                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_NET_DSA_MICROCHIP_KSZ8863_SMI            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MICROCHIP_KSZ9477_I2C            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MICROCHIP_KSZ_COMMON             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MICROCHIP_KSZ_PTP                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_DSA_MICROCHIP_KSZ_SPI                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MSCC_FELIX                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n'}>
+CONFIG_NET_DSA_MSCC_FELIX_DSA_LIB               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MSCC_OCELOT_EXT                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MSCC_SEVILLE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MT7530                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MT7530_MDIO                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MT7530_MMIO                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MV88E6060                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MV88E6XXX                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_MV88E6XXX_PTP                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_DSA_QCA8K                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_DSA_REALTEK                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_REALTEK_MDIO                     policy<{'amd64': 'n', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_REALTEK_RTL8365MB                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_REALTEK_RTL8366RB                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_REALTEK_SMI                      policy<{'amd64': 'n', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_RZN1_A5PSW                       policy<{'armhf': 'm'}>
+CONFIG_NET_DSA_SJA1105                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_SJA1105_PTP                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_DSA_SJA1105_TAS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_DSA_SJA1105_VL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_DSA_SMSC_LAN9303                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_SMSC_LAN9303_I2C                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_SMSC_LAN9303_MDIO                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_AR9331                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_BRCM                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_BRCM_COMMON                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_BRCM_LEGACY                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_BRCM_PREPEND                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_DSA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_DSA_COMMON                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_EDSA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_GSWIP                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_HELLCREEK                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_KSZ                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_LAN9303                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_MTK                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_NONE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_OCELOT                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_OCELOT_8021Q                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_QCA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_RTL4_A                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_RTL8_4                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_RZN1_A5PSW                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_SJA1105                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_TRAILER                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_TAG_XRS700X                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_VITESSE_VSC73XX                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_VITESSE_VSC73XX_PLATFORM         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_VITESSE_VSC73XX_SPI              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_XRS700X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_XRS700X_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_DSA_XRS700X_MDIO                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_EGRESS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_EMATCH                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_EMATCH_CANID                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NET_EMATCH_CMP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_EMATCH_IPSET                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_EMATCH_IPT                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_EMATCH_META                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_EMATCH_NBYTE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_EMATCH_STACK                         policy<{'amd64': '32', 'arm64': '32', 'armhf': '32', 'ppc64el': '32', 'riscv64': '32', 's390x': '32'}>
+CONFIG_NET_EMATCH_TEXT                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_EMATCH_U32                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_FAILOVER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_FC                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_FLOW_LIMIT                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_FOU                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_FOU_IP_TUNNELS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_HANDSHAKE                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_IFE                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_INGRESS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_IPGRE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_IPGRE_BROADCAST                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_IPGRE_DEMUX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_IPIP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_IPVTI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_IP_TUNNEL                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_KEY                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_KEY_MIGRATE                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NET_L3_MASTER_DEV                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_MPLS_GSO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_NCSI                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_NS                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_NSH                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_NS_REFCNT_TRACKER                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NET_PKTGEN                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_POLL_CONTROLLER                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_PTP_CLASSIFY                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_REDIRECT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_RX_BUSY_POLL                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_SB1000                               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_NET_SCHED                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_SCH_CAKE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_CBS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_CHOKE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_CODEL                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_DEFAULT                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NET_SCH_DRR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_ETF                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_ETS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_FIFO                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_SCH_FQ                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_FQ_CODEL                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_FQ_PIE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_GRED                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_HFSC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_HHF                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_HTB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_INGRESS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_MQPRIO                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_MQPRIO_LIB                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_MULTIQ                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_NETEM                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_PIE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_PLUG                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_PRIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_QFQ                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_RED                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_SFB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_SFQ                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_SKBPRIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_TAPRIO                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_TBF                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SCH_TEQL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_SELFTESTS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_SOCK_MSG                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_TC_SKB_EXT                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_TEAM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_TEAM_MODE_BROADCAST                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_TEAM_MODE_LOADBALANCE                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_TEAM_MODE_RANDOM                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_TEAM_MODE_ROUNDROBIN                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_TULIP                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_UDP_TUNNEL                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_VENDOR_3COM                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_8390                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_VENDOR_ACTIONS                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_NET_VENDOR_ADAPTEC                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_ADI                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_VENDOR_AGERE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_ALACRITECH                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_ALLWINNER                     policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_NET_VENDOR_ALTEON                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_AMAZON                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_AMD                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_AQUANTIA                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_ARC                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_ASIX                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_ATHEROS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_BROADCOM                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_BROCADE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_CADENCE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_CAVIUM                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_CHELSIO                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_CIRRUS                        policy<{'amd64': 'y', 'armhf': 'y'}>
+CONFIG_NET_VENDOR_CISCO                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_CORTINA                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_DAVICOM                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_DEC                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_DLINK                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_ENGLEDER                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_EZCHIP                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_FARADAY                       policy<{'armhf': 'y'}>
+CONFIG_NET_VENDOR_FREESCALE                     policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_NET_VENDOR_FUJITSU                       policy<{'amd64': 'y'}>
+CONFIG_NET_VENDOR_FUNGIBLE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_GOOGLE                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_HISILICON                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_NET_VENDOR_HUAWEI                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_I825XX                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NET_VENDOR_IBM                           policy<{'ppc64el': 'y'}>
+CONFIG_NET_VENDOR_INTEL                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_LITEX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_MARVELL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_MEDIATEK                      policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_NET_VENDOR_MELLANOX                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_MICREL                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_MICROCHIP                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_MICROSEMI                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_MICROSOFT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_MYRI                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_NATSEMI                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_NETERION                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_NETRONOME                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_NI                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_NVIDIA                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_OKI                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_PACKET_ENGINES                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_PENSANDO                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_QLOGIC                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_QUALCOMM                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_RDC                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_REALTEK                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_RENESAS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_ROCKER                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_SAMSUNG                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_SEEQ                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_SILAN                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_SIS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_SMSC                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_SOCIONEXT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_SOLARFLARE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_STMICRO                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_SUN                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_SUNPLUS                       policy<{'armhf': 'y'}>
+CONFIG_NET_VENDOR_SYNOPSYS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_TEHUTI                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_TI                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_VERTEXCOM                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_VIA                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_WANGXUN                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_WIZNET                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NET_VENDOR_XILINX                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NET_VENDOR_XIRCOM                        policy<{'amd64': 'y'}>
+CONFIG_NET_VRF                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NET_XGENE                                policy<{'arm64': 'm'}>
+CONFIG_NET_XGENE_V2                             policy<{'arm64': 'm'}>
+CONFIG_NET_XGRESS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NEW_LEDS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_NFC                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_NFC_DIGITAL                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_FDP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_FDP_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_HCI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_MEI_PHY                              policy<{'amd64': 'm'}>
+CONFIG_NFC_MICROREAD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_MICROREAD_I2C                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_MICROREAD_MEI                        policy<{'amd64': 'm'}>
+CONFIG_NFC_MRVL                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_MRVL_I2C                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_MRVL_SPI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_MRVL_UART                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_MRVL_USB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_NCI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_NCI_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_NCI_UART                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_NXP_NCI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_NXP_NCI_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_PN532_UART                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_PN533                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_PN533_I2C                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_PN533_USB                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_PN544                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_PN544_I2C                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_PN544_MEI                            policy<{'amd64': 'm'}>
+CONFIG_NFC_PORT100                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_S3FWRN5                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_S3FWRN5_I2C                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_S3FWRN82_UART                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_SHDLC                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NFC_SIM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_ST21NFCA                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_ST21NFCA_I2C                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_ST95HF                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_ST_NCI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_ST_NCI_I2C                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_ST_NCI_SPI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_TRF7970A                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFC_VIRTUAL_NCI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFIT_SECURITY_DEBUG                      policy<{'amd64': 'n', 'arm64': 'n', 'riscv64': 'n'}>
+CONFIG_NFP                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_NFP_APP_ABM_NIC                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NFP_APP_FLOWER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NFP_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_NFP_NET_IPSEC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NFSD                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFSD_BLOCKLAYOUT                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFSD_FLEXFILELAYOUT                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFSD_LEGACY_CLIENT_TRACKING              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NFSD_PNFS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFSD_SCSILAYOUT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFSD_V2                                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NFSD_V3_ACL                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFSD_V4                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFSD_V4_2_INTER_SSC                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFSD_V4_SECURITY_LABEL                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_ACL_SUPPORT                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFS_COMMON                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_DEBUG                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_DISABLE_UDP_SUPPORT                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_FS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFS_FSCACHE                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_SWAP                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_USE_KERNEL_DNS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_USE_LEGACY_DNS                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NFS_V2                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFS_V3                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFS_V3_ACL                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_V4                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFS_V4_1                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN        policy<{'amd64': '"kernel.org"', 'arm64': '"kernel.org"', 'armhf': '"kernel.org"', 'ppc64el': '"kernel.org"', 'riscv64': '"kernel.org"', 's390x': '"kernel.org"'}>
+CONFIG_NFS_V4_1_MIGRATION                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_V4_2                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_V4_2_READ_PLUS                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NFS_V4_2_SSC_HELPER                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFS_V4_SECURITY_LABEL                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NFTL                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NFTL_RW                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NFT_BRIDGE_META                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_BRIDGE_REJECT                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_COMPAT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_CONNLIMIT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_CT                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_DUP_IPV4                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_DUP_IPV6                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_DUP_NETDEV                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_FIB                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_FIB_INET                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_FIB_IPV4                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_FIB_IPV6                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_FIB_NETDEV                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_FLOW_OFFLOAD                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_FWD_NETDEV                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_HASH                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_LIMIT                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_LOG                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_MASQ                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_NAT                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_NUMGEN                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_OSF                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_QUEUE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_QUOTA                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_REDIR                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_REJECT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_REJECT_INET                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_REJECT_IPV4                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_REJECT_IPV6                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_REJECT_NETDEV                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_SOCKET                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_SYNPROXY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_TPROXY                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_TUNNEL                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NFT_XFRM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_AMANDA                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_BRIDGE                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_BROADCAST                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_EVENTS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CONNTRACK_FTP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_H323                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_IRC                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_LABELS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CONNTRACK_MARK                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CONNTRACK_NETBIOS_NS                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_OVS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CONNTRACK_PPTP                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_PROCFS                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NF_CONNTRACK_SANE                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_SECMARK                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CONNTRACK_SIP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_SNMP                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_TFTP                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CONNTRACK_TIMEOUT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CONNTRACK_TIMESTAMP                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CONNTRACK_ZONES                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CT_NETLINK                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CT_NETLINK_HELPER                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CT_NETLINK_TIMEOUT                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_CT_PROTO_DCCP                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CT_PROTO_GRE                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CT_PROTO_SCTP                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_CT_PROTO_UDPLITE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_DEFRAG_IPV4                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_DEFRAG_IPV6                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_DUP_IPV4                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_DUP_IPV6                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_DUP_NETDEV                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_FLOW_TABLE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_FLOW_TABLE_INET                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_FLOW_TABLE_PROCFS                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NF_LOG_ARP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_LOG_IPV4                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_LOG_IPV6                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_LOG_SYSLOG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_NAT                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_NAT_AMANDA                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_NAT_FTP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_NAT_H323                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_NAT_IRC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_NAT_MASQUERADE                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_NAT_OVS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_NAT_PPTP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_NAT_REDIRECT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_NAT_SIP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_NAT_SNMP_BASIC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_NAT_TFTP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_REJECT_IPV4                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_REJECT_IPV6                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_SOCKET_IPV4                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_SOCKET_IPV6                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_TABLES                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_TABLES_ARP                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_TABLES_BRIDGE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_TABLES_INET                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_TABLES_IPV4                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_TABLES_IPV6                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_TABLES_NETDEV                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NF_TPROXY_IPV4                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NF_TPROXY_IPV6                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NGBE                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NI903X_WDT                               policy<{'amd64': 'm'}>
+CONFIG_NIC7018_WDT                              policy<{'amd64': 'm'}>
+CONFIG_NILFS2_FS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NINTENDO_FF                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NITRO_ENCLAVES                           policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_NIU                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_NI_XGE_MANAGEMENT_ENET                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_NL80211_TESTMODE                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_NLATTR                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NLMON                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ASCII                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_1250                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_1251                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_437                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NLS_CODEPAGE_737                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_775                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_850                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_852                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_855                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_857                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_860                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_861                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_862                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_863                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_864                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_865                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_866                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_869                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_874                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_932                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_936                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_949                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_CODEPAGE_950                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_DEFAULT                              policy<{'amd64': '"utf8"', 'arm64': '"utf8"', 'armhf': '"utf8"', 'ppc64el': '"utf8"', 'riscv64': '"utf8"', 's390x': '"utf8"'}>
+CONFIG_NLS_ISO8859_1                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_13                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_14                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_15                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_2                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_3                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_4                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_5                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_6                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_7                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_8                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_ISO8859_9                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_KOI8_R                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_KOI8_U                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_CELTIC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_CENTEURO                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_CROATIAN                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_CYRILLIC                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_GAELIC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_GREEK                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_ICELAND                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_INUIT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_ROMAN                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_ROMANIAN                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_MAC_TURKISH                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_UCS2_UTILS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NLS_UTF8                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NMI_CHECK_CPU                            policy<{'amd64': 'y'}>
+CONFIG_NMI_IPI                                  policy<{'ppc64el': 'y'}>
+CONFIG_NOA1305                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NODES_SHIFT                              policy<{'amd64': '10', 'arm64': '6', 'ppc64el': '8', 'riscv64': '2', 's390x': '1'}>
+CONFIG_NONPORTABLE                              policy<{'riscv64': 'n'}>
+CONFIG_NONSTATIC_KERNEL                         policy<{'ppc64el': 'y'}>
+CONFIG_NOP_TRACER                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NOTIFIER_ERROR_INJECTION                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NOUVEAU_DEBUG                            policy<{'amd64': '5', 'arm64': '5', 'armhf': '5', 'ppc64el': '5', 'riscv64': '5'}>
+CONFIG_NOUVEAU_DEBUG_DEFAULT                    policy<{'amd64': '3', 'arm64': '3', 'armhf': '3', 'ppc64el': '3', 'riscv64': '3'}>
+CONFIG_NOUVEAU_DEBUG_MMU                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_NOUVEAU_DEBUG_PUSH                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_NOUVEAU_PLATFORM_DRIVER                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_NOZOMI                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_NO_HZ                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NO_HZ_COMMON                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NO_IOPORT_MAP                            policy<{'armhf': 'y', 's390x': 'y'}>
+CONFIG_NPCM7XX_KCS_IPMI_BMC                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NPCM7XX_TIMER                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_NPCM7XX_WATCHDOG                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_NPCM_ADC                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NR_CPUS_DEFAULT                          policy<{'amd64': '8192'}>
+CONFIG_NR_CPUS_RANGE_BEGIN                      policy<{'amd64': '8192'}>
+CONFIG_NR_CPUS_RANGE_END                        policy<{'amd64': '8192'}>
+CONFIG_NR_IRQS                                  policy<{'ppc64el': '512'}>
+CONFIG_NS83820                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_NSM                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NTB                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_NTB_AMD                                  policy<{'amd64': 'n'}>
+CONFIG_NTB_EPF                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NTB_IDT                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NTB_INTEL                                policy<{'amd64': 'm'}>
+CONFIG_NTB_MSI                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NTB_MSI_TEST                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_NTB_NETDEV                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NTB_PERF                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NTB_PINGPONG                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NTB_SWITCHTEC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NTB_TOOL                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NTB_TRANSPORT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NTFS3_64BIT_CLUSTER                      policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NTFS3_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NTFS3_FS_POSIX_ACL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NTFS3_LZX_XPRESS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NTFS_DEBUG                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NTFS_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NTFS_RW                                  policy<{'amd64': 'n', 'arm64': 'n', 'arm64-generic-64k': '-', 'armhf': 'n', 'ppc64el': '-', 'riscv64': 'n', 's390x': 'y'}>
+CONFIG_NULL_TTY                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_NUMA_BALANCING                           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NUMA_KEEP_MEMINFO                        policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_NVDIMM_DAX                               policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_NVDIMM_KEYS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NVDIMM_PFN                               policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_NVDIMM_SECURITY_TEST                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_NVEC_PAZ00                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVEC_POWER                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVHE_EL2_DEBUG                           policy<{'arm64': 'n'}>
+CONFIG_NVIDIA_CARMEL_CNP_ERRATUM                policy<{'arm64': 'y'}>
+CONFIG_NVIDIA_CORESIGHT_PMU_ARCH_SYSTEM_PMU     policy<{'arm64': 'm'}>
+CONFIG_NVIDIA_SHIELD_FF                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NVIDIA_WMI_EC_BACKLIGHT                  policy<{'amd64': 'm'}>
+CONFIG_NVMEM_APPLE_EFUSES                       policy<{'arm64': 'm'}>
+CONFIG_NVMEM_IMX_IIM                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_IMX_OCOTP                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_IMX_OCOTP_ELE                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_IMX_OCOTP_SCU                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_LAYERSCAPE_SFP                     policy<{'arm64': 'm'}>
+CONFIG_NVMEM_LAYOUTS                            policy<{'amd64': 'n', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NVMEM_LAYOUT_ONIE_TLV                    policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NVMEM_LAYOUT_SL28_VPD                    policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NVMEM_MESON_EFUSE                        policy<{'arm64': 'm', 'arm64-generic-64k': '-'}>
+CONFIG_NVMEM_MESON_MX_EFUSE                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_MTK_EFUSE                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_QCOM_QFPROM                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_QCOM_SEC_QFPROM                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_RAVE_SP_EEPROM                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NVMEM_REBOOT_MODE                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NVMEM_RMEM                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_NVMEM_ROCKCHIP_EFUSE                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_ROCKCHIP_OTP                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_SC27XX_EFUSE                       policy<{'arm64': 'm'}>
+CONFIG_NVMEM_SNVS_LPGPR                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_NVMEM_SPMI_SDAM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NVMEM_SPRD_EFUSE                         policy<{'arm64': 'm'}>
+CONFIG_NVMEM_STM32_BSEC_OPTEE_TA                policy<{'arm64': 'y'}>
+CONFIG_NVMEM_STM32_ROMEM                        policy<{'arm64': 'm'}>
+CONFIG_NVMEM_SUNPLUS_OCOTP                      policy<{'armhf': 'm'}>
+CONFIG_NVMEM_SUNXI_SID                          policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_NVMEM_SYSFS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NVMEM_U_BOOT_ENV                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_NVMEM_VF610_OCOTP                        policy<{'armhf': 'n'}>
+CONFIG_NVMEM_ZYNQMP                             policy<{'arm64': 'y'}>
+CONFIG_NVME_APPLE                               policy<{'arm64': 'm'}>
+CONFIG_NVME_AUTH                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_CORE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_FABRICS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_FC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_HOST_AUTH                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NVME_HWMON                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_NVME_KEYRING                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_MULTIPATH                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NVME_RDMA                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_TARGET                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_TARGET_AUTH                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NVME_TARGET_FC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_TARGET_FCLOOP                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NVME_TARGET_LOOP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_TARGET_PASSTHRU                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NVME_TARGET_RDMA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_TARGET_TCP                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_TARGET_TCP_TLS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NVME_TCP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_NVME_TCP_TLS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_NVME_VERBOSE_ERRORS                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_NVSW_SN2201                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_NV_TCO                                   policy<{'amd64': 'm'}>
+CONFIG_NXP_C45_TJA11XX_PHY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_NXP_CBTX_PHY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_NXP_TJA11XX_PHY                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_N_HDLC                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_OABI_COMPAT                              policy<{'armhf': 'n'}>
+CONFIG_OBJAGG                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_OBJTOOL                                  policy<{'amd64': 'y', 'ppc64el': '-'}>
+CONFIG_OCFS2_DEBUG_FS                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_OCFS2_DEBUG_MASKLOG                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_OCFS2_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_OCFS2_FS_O2CB                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_OCFS2_FS_STATS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_OCFS2_FS_USERSPACE_CLUSTER               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_OCTEONTX2_AF                             policy<{'arm64': 'm'}>
+CONFIG_OCTEONTX2_MBOX                           policy<{'arm64': 'm'}>
+CONFIG_OCTEONTX2_PF                             policy<{'arm64': 'm'}>
+CONFIG_OCTEONTX2_VF                             policy<{'arm64': 'm'}>
+CONFIG_OCTEON_EP                                policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_OCXL                                     policy<{'ppc64el': 'm'}>
+CONFIG_OCXL_BASE                                policy<{'ppc64el': 'y'}>
+CONFIG_OF                                       policy<{'amd64': 'n', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_OF_ADDRESS                               policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_DYNAMIC                               policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_EARLY_FLATTREE                        policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_FLATTREE                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_FPGA_REGION                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_OF_GPIO                                  policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_GPIO_MM_GPIOCHIP                      policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_IOMMU                                 policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_IRQ                                   policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_KOBJ                                  policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_MDIO                                  policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_NUMA                                  policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_OF_OVERLAY                               policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_PMEM                                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_OF_RECONFIG_NOTIFIER_ERROR_INJECT        policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_OF_RESERVED_MEM                          policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_RESOLVE                               policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_OF_UNITTEST                              policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_OID_REGISTRY                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_OLD_SIGACTION                            policy<{'armhf': 'y', 's390x': 'y'}>
+CONFIG_OLD_SIGSUSPEND                           policy<{'ppc64el': 'y'}>
+CONFIG_OLD_SIGSUSPEND3                          policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'armhf': 'y', 's390x': 'y'}>
+CONFIG_OMAP2PLUS_MBOX                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_OMAP2PLUS_PRM                            policy<{'armhf': 'y'}>
+CONFIG_OMAP5_ERRATA_801819                      policy<{'armhf': 'y'}>
+CONFIG_OMAP_CONTROL_PHY                         policy<{'armhf': 'm'}>
+CONFIG_OMAP_DM_SYSTIMER                         policy<{'armhf': 'y'}>
+CONFIG_OMAP_DM_TIMER                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_OMAP_GPMC                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_OMAP_GPMC_DEBUG                          policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_OMAP_INTERCONNECT                        policy<{'armhf': 'y'}>
+CONFIG_OMAP_INTERCONNECT_BARRIER                policy<{'armhf': 'y'}>
+CONFIG_OMAP_IOMMU                               policy<{'armhf': 'y'}>
+CONFIG_OMAP_IOMMU_DEBUG                         policy<{'armhf': 'n'}>
+CONFIG_OMAP_IRQCHIP                             policy<{'armhf': 'y'}>
+CONFIG_OMAP_MBOX_KFIFO_SIZE                     policy<{'arm64': '256', 'armhf': '256'}>
+CONFIG_OMAP_OCP2SCP                             policy<{'armhf': 'm'}>
+CONFIG_OMAP_REMOTEPROC                          policy<{'armhf': 'm'}>
+CONFIG_OMAP_REMOTEPROC_WATCHDOG                 policy<{'armhf': 'n'}>
+CONFIG_OMAP_USB2                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_OMAP_WATCHDOG                            policy<{'armhf': 'm'}>
+CONFIG_OMFS_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_OPAL_CORE                                policy<{'ppc64el': 'n'}>
+CONFIG_OPAL_PRD                                 policy<{'ppc64el': 'm'}>
+CONFIG_OPENVSWITCH                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_OPENVSWITCH_GENEVE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_OPENVSWITCH_GRE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_OPENVSWITCH_VXLAN                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_OPEN_DICE                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_OPT3001                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_OPT4001                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_OPTEE                                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_OPTEE_INSECURE_LOAD_IMAGE                policy<{'arm64': 'n'}>
+CONFIG_OPTPROBES                                policy<{'amd64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_ORANGEFS_FS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ORION_IRQCHIP                            policy<{'armhf': 'y'}>
+CONFIG_ORION_TIMER                              policy<{'armhf': 'y'}>
+CONFIG_ORION_WATCHDOG                           policy<{'armhf': 'm'}>
+CONFIG_OSF_PARTITION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_OUTER_CACHE                              policy<{'armhf': 'y'}>
+CONFIG_OUTER_CACHE_SYNC                         policy<{'armhf': 'y'}>
+CONFIG_OUTPUT_FORMAT                            policy<{'amd64': '"elf64-x86-64"'}>
+CONFIG_OVERLAY_FS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_OVERLAY_FS_DEBUG                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_OVERLAY_FS_INDEX                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_OVERLAY_FS_METACOPY                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_OVERLAY_FS_REDIRECT_DIR                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_OVERLAY_FS_XINO_AUTO                     policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_OWL_DMA                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_OWL_EMAC                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_OWL_PM_DOMAINS                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_OWL_PM_DOMAINS_HELPER                    policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_OWL_TIMER                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_P2SB                                     policy<{'amd64': 'y'}>
+CONFIG_P54_COMMON                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_P54_LEDS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_P54_PCI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_P54_SPI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_P54_SPI_DEFAULT_EEPROM                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_P54_USB                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PA12203001                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PACKET                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PACKET_DIAG                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PACKING                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PADATA                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAGE_COUNTER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAGE_EXTENSION                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PAGE_IDLE_FLAG                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAGE_OFFSET                              policy<{'armhf': '0xC0000000', 'ppc64el': '0xc000000000000000', 'riscv64': '0xff60000000000000'}>
+CONFIG_PAGE_OWNER                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PAGE_POOL                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAGE_POOL_STATS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAGE_REPORTING                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAGE_SIZE_64KB                           policy<{'ppc64el': 'y'}>
+CONFIG_PAGE_SIZE_LESS_THAN_256KB                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAGE_SIZE_LESS_THAN_64KB                 policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'armhf': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAGE_TABLE_CHECK                         policy<{'amd64': 'n', 'arm64': 'n', 'riscv64': 'n'}>
+CONFIG_PAGE_TABLE_ISOLATION                     policy<{'amd64': 'y'}>
+CONFIG_PAHOLE_HAS_LANG_EXCLUDE                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAHOLE_HAS_SPLIT_BTF                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PAHOLE_VERSION                           policy<{'amd64': '125', 'arm64': '125', 'armhf': '125', 'ppc64el': '125', 'riscv64': '125', 's390x': '125'}>
+CONFIG_PALMAS_GPADC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PANASONIC_LAPTOP                         policy<{'amd64': 'm'}>
+CONFIG_PANEL                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PANEL_CHANGE_MESSAGE                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_PANEL_PARPORT                            policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_PANEL_PROFILE                            policy<{'amd64': '5', 'arm64': '5', 'armhf': '5', 'ppc64el': '5', 'riscv64': '5'}>
+CONFIG_PANIC_ON_OOPS_VALUE                      policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_PANIC_TIMEOUT                            policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '10', 'riscv64': '0', 's390x': '0'}>
+CONFIG_PANTHERLORD_FF                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PAPR_SCM                                 policy<{'ppc64el': 'm'}>
+CONFIG_PARAVIRT                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PARAVIRT_CLOCK                           policy<{'amd64': 'y'}>
+CONFIG_PARAVIRT_DEBUG                           policy<{'amd64': 'n'}>
+CONFIG_PARAVIRT_SPINLOCKS                       policy<{'amd64': 'y'}>
+CONFIG_PARAVIRT_TIME_ACCOUNTING                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'n'}>
+CONFIG_PARAVIRT_XXL                             policy<{'amd64': 'y'}>
+CONFIG_PARMAN                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PARPORT                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PARPORT_1284                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PARPORT_NOT_PC                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PARPORT_PANEL                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PARPORT_PC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PARPORT_PC_FIFO                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PARPORT_PC_PCMCIA                        policy<{'amd64': 'm'}>
+CONFIG_PARPORT_PC_SUPERIO                       policy<{'amd64': 'n', 'armhf': 'n', 'ppc64el': 'n'}>
+CONFIG_PARPORT_SERIAL                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PARTITION_ADVANCED                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PARTITION_PERCPU                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PATA_ACPI                                policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_ALI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_AMD                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_ARTOP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_ATIIXP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_ATP867X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_CMD640_PCI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_CMD64X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_CYPRESS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_EFAR                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_HPT366                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_HPT37X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_HPT3X2N                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_HPT3X3                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_IMX                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PATA_IT8213                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_IT821X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_JMICRON                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_LEGACY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_MARVELL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_MPIIX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_NETCELL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_NINJA32                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_NS87410                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_NS87415                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_OF_PLATFORM                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_OLDPIIX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_OPTI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_OPTIDMA                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_PARPORT                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_ATEN                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_BPCK                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_BPCK6                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_COMM                        policy<{'amd64': 'm', 'arm64': 'n', 'arm64-generic-64k': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_DSTR                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_EPAT                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_EPATC8                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_PATA_PARPORT_EPIA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_FIT2                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_FIT3                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_FRIQ                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_FRPW                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_KBIC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_KTTI                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_ON20                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PARPORT_ON26                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PATA_PCMCIA                              policy<{'amd64': 'm'}>
+CONFIG_PATA_PDC2027X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_PDC_OLD                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_PLATFORM                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_RADISYS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_RDC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_RZ1000                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_SCH                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_SERVERWORKS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_SIL680                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_SIS                                 policy<{'amd64': 'y', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_TIMINGS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PATA_TOSHIBA                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_TRIFLEX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_VIA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PATA_WINBOND                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PC104                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PC300TOO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PC87413_WDT                              policy<{'amd64': 'm'}>
+CONFIG_PCC                                      policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_PCCARD                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCCARD_NONSTATIC                         policy<{'amd64': 'y'}>
+CONFIG_PCENGINES_APU2                           policy<{'amd64': 'm'}>
+CONFIG_PCF50633_ADC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PCF50633_GPIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PCI                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCI200SYN                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PCIEAER                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': '-', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIEAER_CXL                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_PCIEAER_INJECT                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': '-', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCIEASPM                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIEASPM_PERFORMANCE                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCIEASPM_POWERSAVE                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCIEASPM_POWER_SUPERSAVE                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCIE_AL                                  policy<{'arm64': 'y'}>
+CONFIG_PCIE_ALTERA                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCIE_ALTERA_MSI                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCIE_APPLE                               policy<{'arm64': 'm'}>
+CONFIG_PCIE_APPLE_MSI_DOORBELL_ADDR             policy<{'arm64': '0xfffff000'}>
+CONFIG_PCIE_ARMADA_8K                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCIE_BUS_DEFAULT                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIE_BUS_PEER2PEER                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCIE_BUS_PERFORMANCE                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCIE_BUS_SAFE                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCIE_BUS_TUNE_OFF                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCIE_CADENCE                             policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_CADENCE_EP                          policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_CADENCE_HOST                        policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_CADENCE_PLAT                        policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_CADENCE_PLAT_EP                     policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_CADENCE_PLAT_HOST                   policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_DPC                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': '-', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIE_DW                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIE_DW_EP                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIE_DW_HOST                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIE_DW_PLAT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIE_DW_PLAT_EP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIE_DW_PLAT_HOST                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIE_ECRC                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': '-', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCIE_EDR                                 policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_FU740                               policy<{'riscv64': 'y'}>
+CONFIG_PCIE_HISI_ERR                            policy<{'arm64': 'y'}>
+CONFIG_PCIE_HISI_STB                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCIE_KEEMBAY                             policy<{'arm64': 'y'}>
+CONFIG_PCIE_KEEMBAY_EP                          policy<{'arm64': 'y'}>
+CONFIG_PCIE_KEEMBAY_HOST                        policy<{'arm64': 'y'}>
+CONFIG_PCIE_KIRIN                               policy<{'arm64': 'y'}>
+CONFIG_PCIE_LAYERSCAPE_GEN4                     policy<{'arm64': 'n'}>
+CONFIG_PCIE_MEDIATEK                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCIE_MEDIATEK_GEN3                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PCIE_MICROCHIP_HOST                      policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_MOBIVEIL_PLAT                       policy<{'arm64': 'n'}>
+CONFIG_PCIE_PME                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_PTM                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCIE_QCOM                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCIE_QCOM_EP                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PCIE_RCAR_EP                             policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_RCAR_GEN4                           policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PCIE_RCAR_GEN4_EP                        policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PCIE_RCAR_GEN4_HOST                      policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PCIE_RCAR_HOST                           policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_ROCKCHIP                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCIE_ROCKCHIP_DW_HOST                    policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCIE_ROCKCHIP_EP                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCIE_ROCKCHIP_HOST                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PCIE_TEGRA194                            policy<{'arm64': 'm'}>
+CONFIG_PCIE_TEGRA194_EP                         policy<{'arm64': 'm'}>
+CONFIG_PCIE_TEGRA194_HOST                       policy<{'arm64': 'm'}>
+CONFIG_PCIE_VISCONTI_HOST                       policy<{'arm64': 'y'}>
+CONFIG_PCIE_XILINX                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCIE_XILINX_CPM                          policy<{'arm64': 'y'}>
+CONFIG_PCIE_XILINX_DMA_PL                       policy<{'arm64': 'y'}>
+CONFIG_PCIE_XILINX_NWL                          policy<{'arm64': 'y'}>
+CONFIG_PCIPCWATCHDOG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PCI_AARDVARK                             policy<{'arm64': 'y'}>
+CONFIG_PCI_ATS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCI_BRIDGE_EMUL                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCI_CNB20LE_QUIRK                        policy<{'amd64': 'n'}>
+CONFIG_PCI_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCI_DIRECT                               policy<{'amd64': 'y'}>
+CONFIG_PCI_DOE                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCI_DOMAINS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCI_DOMAINS_GENERIC                      policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_PCI_DRA7XX                               policy<{'armhf': 'm'}>
+CONFIG_PCI_DRA7XX_EP                            policy<{'armhf': 'm'}>
+CONFIG_PCI_DRA7XX_HOST                          policy<{'armhf': 'm'}>
+CONFIG_PCI_ECAM                                 policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCI_ENDPOINT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCI_ENDPOINT_CONFIGFS                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCI_ENDPOINT_TEST                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCI_EPF_MHI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PCI_EPF_NTB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PCI_EPF_TEST                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PCI_EPF_VNTB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PCI_EXYNOS                               policy<{'armhf': 'n'}>
+CONFIG_PCI_FTPCI100                             policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCI_HISI                                 policy<{'arm64': 'y'}>
+CONFIG_PCI_HOST_COMMON                          policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCI_HOST_GENERIC                         policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PCI_HOST_THUNDER_ECAM                    policy<{'arm64': 'y'}>
+CONFIG_PCI_HOST_THUNDER_PEM                     policy<{'arm64': 'y'}>
+CONFIG_PCI_HYPERV                               policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_PCI_HYPERV_INTERFACE                     policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_PCI_IMX6                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCI_IMX6_EP                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCI_IMX6_HOST                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCI_IOV                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCI_J721E                                policy<{'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_PCI_J721E_EP                             policy<{'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_PCI_J721E_HOST                           policy<{'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_PCI_KEYSTONE                             policy<{'arm64': 'y'}>
+CONFIG_PCI_KEYSTONE_EP                          policy<{'arm64': 'y'}>
+CONFIG_PCI_KEYSTONE_HOST                        policy<{'arm64': 'y'}>
+CONFIG_PCI_LABEL                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_PCI_LAYERSCAPE                           policy<{'arm64': 'y', 'armhf': 'n'}>
+CONFIG_PCI_LAYERSCAPE_EP                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCI_LOCKLESS_CONFIG                      policy<{'amd64': 'y'}>
+CONFIG_PCI_MMCONFIG                             policy<{'amd64': 'y'}>
+CONFIG_PCI_MSI                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCI_MSI_ARCH_FALLBACKS                   policy<{'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_PCI_MVEBU                                policy<{'armhf': 'm'}>
+CONFIG_PCI_P2PDMA                               policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_PCI_PASID                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PCI_PF_STUB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PCI_PRI                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PCI_QUIRKS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PCI_RCAR_GEN2                            policy<{'armhf': 'y'}>
+CONFIG_PCI_REALLOC_ENABLE_AUTO                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCI_STUB                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PCI_SW_SWITCHTEC                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PCI_SYSCALL                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_PCI_TEGRA                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PCI_V3_SEMI                              policy<{'armhf': 'y'}>
+CONFIG_PCI_XEN                                  policy<{'amd64': 'y'}>
+CONFIG_PCI_XGENE                                policy<{'arm64': 'y'}>
+CONFIG_PCI_XGENE_MSI                            policy<{'arm64': 'y'}>
+CONFIG_PCMCIA                                   policy<{'amd64': 'm', 'arm64': 'n', 'armhf': 'n', 'ppc64el': '-'}>
+CONFIG_PCMCIA_3C574                             policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_3C589                             policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_AHA152X                           policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_AXNET                             policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_FDOMAIN                           policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_FMVJ18X                           policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_LOAD_CIS                          policy<{'amd64': 'y'}>
+CONFIG_PCMCIA_NMCLAN                            policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_PCNET                             policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_QLOGIC                            policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_SMC91C92                          policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_SYM53C500                         policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_XIRC2PS                           policy<{'amd64': 'm'}>
+CONFIG_PCMCIA_XIRCOM                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': '-'}>
+CONFIG_PCNET32                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PCPU_DEV_REFCNT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PCP_BATCH_SCALE_MAX                      policy<{'amd64': '5', 'arm64': '5', 'armhf': '5', 'ppc64el': '5', 'riscv64': '5', 's390x': '5'}>
+CONFIG_PCSPKR_PLATFORM                          policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_PCS_LYNX                                 policy<{'amd64': 'm', 'arm64': 'y', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PCS_MTK_LYNXI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PCS_RZN1_MIIC                            policy<{'armhf': 'm'}>
+CONFIG_PCS_XPCS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PD6729                                   policy<{'amd64': 'm'}>
+CONFIG_PDC_ADMA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PDS_CORE                                 policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PDS_VDPA                                 policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PDS_VFIO_PCI                             policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PECI                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PECI_ASPEED                              policy<{'armhf': 'm'}>
+CONFIG_PECI_CPU                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PECI_NPCM                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PERCPU_STATS                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PERCPU_TEST                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PERF_EVENTS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PERF_EVENTS_AMD_BRS                      policy<{'amd64': 'y'}>
+CONFIG_PERF_EVENTS_AMD_POWER                    policy<{'amd64': 'n'}>
+CONFIG_PERF_EVENTS_AMD_UNCORE                   policy<{'amd64': 'm'}>
+CONFIG_PERF_EVENTS_INTEL_CSTATE                 policy<{'amd64': 'm'}>
+CONFIG_PERF_EVENTS_INTEL_RAPL                   policy<{'amd64': 'm'}>
+CONFIG_PERF_EVENTS_INTEL_UNCORE                 policy<{'amd64': 'y'}>
+CONFIG_PERF_USE_VMALLOC                         policy<{'armhf': 'y'}>
+CONFIG_PERSISTENT_KEYRINGS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PER_VMA_LOCK                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PER_VMA_LOCK_STATS                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PFAULT                                   policy<{'s390x': 'y'}>
+CONFIG_PGSTE                                    policy<{'s390x': 'y'}>
+CONFIG_PGTABLE_LEVELS                           policy<{'amd64': '5', 'arm64': '4', 'arm64-generic-64k': '3', 'armhf': '3', 'ppc64el': '4', 'riscv64': '5', 's390x': '5'}>
+CONFIG_PHANTOM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PHONET                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PHYLIB                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PHYLIB_LEDS                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PHYLINK                                  policy<{'amd64': 'm', 'arm64': 'y', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PHYSICAL_ALIGN                           policy<{'amd64': '0x200000'}>
+CONFIG_PHYSICAL_START                           policy<{'amd64': '0x1000000', 'ppc64el': '0x00000000'}>
+CONFIG_PHYS_ADDR_T_64BIT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PHY_AM654_SERDES                         policy<{'arm64': 'm'}>
+CONFIG_PHY_BERLIN_SATA                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_BERLIN_USB                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_CADENCE_DPHY                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_CADENCE_DPHY_RX                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_CADENCE_SALVO                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_CADENCE_SIERRA                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_CADENCE_TORRENT                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_CAN_TRANSCEIVER                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PHY_CPCAP_USB                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_DM816X_USB                           policy<{'armhf': 'm'}>
+CONFIG_PHY_EXYNOS_DP_VIDEO                      policy<{'armhf': 'n'}>
+CONFIG_PHY_EXYNOS_MIPI_VIDEO                    policy<{'armhf': 'n'}>
+CONFIG_PHY_EXYNOS_PCIE                          policy<{'armhf': 'n'}>
+CONFIG_PHY_FSL_IMX8MQ_USB                       policy<{'arm64': 'm'}>
+CONFIG_PHY_FSL_IMX8M_PCIE                       policy<{'arm64': 'm'}>
+CONFIG_PHY_FSL_LYNX_28G                         policy<{'arm64': 'm'}>
+CONFIG_PHY_HI3660_USB                           policy<{'arm64': 'm'}>
+CONFIG_PHY_HI3670_PCIE                          policy<{'arm64': 'm'}>
+CONFIG_PHY_HI3670_USB                           policy<{'arm64': 'm'}>
+CONFIG_PHY_HI6220_USB                           policy<{'arm64': 'm'}>
+CONFIG_PHY_HISI_INNO_USB2                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_HISTB_COMBPHY                        policy<{'arm64': 'm'}>
+CONFIG_PHY_HIX5HD2_SATA                         policy<{'armhf': 'm'}>
+CONFIG_PHY_INTEL_KEEMBAY_EMMC                   policy<{'arm64': 'm'}>
+CONFIG_PHY_INTEL_KEEMBAY_USB                    policy<{'arm64': 'm'}>
+CONFIG_PHY_INTEL_LGM_EMMC                       policy<{'amd64': 'm'}>
+CONFIG_PHY_J721E_WIZ                            policy<{'arm64': 'm'}>
+CONFIG_PHY_LAN966X_SERDES                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_MAPPHONE_MDM6600                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_MESON8B_USB2                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MESON8_HDMI_TX                       policy<{'armhf': 'm'}>
+CONFIG_PHY_MESON_AXG_MIPI_DPHY                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MESON_AXG_MIPI_PCIE_ANALOG           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PHY_MESON_AXG_PCIE                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PHY_MESON_G12A_MIPI_DPHY_ANALOG          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MESON_G12A_USB2                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MESON_G12A_USB3_PCIE                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MESON_GXL_USB2                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MIXEL_LVDS_PHY                       policy<{'arm64': 'm'}>
+CONFIG_PHY_MIXEL_MIPI_DPHY                      policy<{'arm64': 'm'}>
+CONFIG_PHY_MTK_DP                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MTK_HDMI                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MTK_MIPI_DSI                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MTK_PCIE                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MTK_TPHY                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MTK_UFS                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MTK_XSPHY                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MVEBU_A3700_COMPHY                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MVEBU_A3700_UTMI                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MVEBU_A38X_COMPHY                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MVEBU_CP110_COMPHY                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MVEBU_CP110_UTMI                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_MVEBU_SATA                           policy<{'armhf': 'y'}>
+CONFIG_PHY_OCELOT_SERDES                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_PXA_28NM_HSIC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PHY_PXA_28NM_USB2                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PHY_QCOM_APQ8064_SATA                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_EDP                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_EUSB2_REPEATER                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_IPQ4019_USB                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_IPQ806X_SATA                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_IPQ806X_USB                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_M31_USB                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_PCIE2                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_QMP                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_QMP_COMBO                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_QMP_PCIE                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_QMP_PCIE_8996                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_QMP_UFS                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_QMP_USB                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_QMP_USB_LEGACY                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_QUSB2                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_SGMII_ETH                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_SNPS_EUSB2                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_USB_HS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_QCOM_USB_HSIC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_QCOM_USB_HS_28NM                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_QCOM_USB_SS                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_R8A779F0_ETHERNET_SERDES             policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_RCAR_GEN2                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_RCAR_GEN3_PCIE                       policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_RCAR_GEN3_USB2                       policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_RCAR_GEN3_USB3                       policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_ROCKCHIP_DP                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_DPHY_RX0                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_EMMC                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_INNO_CSIDPHY                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_INNO_DSIDPHY                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_INNO_HDMI                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_INNO_USB2                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_NANENG_COMBO_PHY            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_PCIE                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_SNPS_PCIE3                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_TYPEC                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_ROCKCHIP_USB                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_SAMSUNG_UFS                          policy<{'armhf': 'n'}>
+CONFIG_PHY_SAMSUNG_USB2                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PHY_SPARX5_SERDES                        policy<{'amd64': '-', 'arm64': 'm', 'armhf': '-', 'ppc64el': '-'}>
+CONFIG_PHY_STARFIVE_JH7110_DPHY_RX              policy<{'riscv64': 'm'}>
+CONFIG_PHY_STARFIVE_JH7110_PCIE                 policy<{'riscv64': 'm'}>
+CONFIG_PHY_STARFIVE_JH7110_USB                  policy<{'riscv64': 'm'}>
+CONFIG_PHY_STM32_USBPHYC                        policy<{'arm64': 'm'}>
+CONFIG_PHY_SUN4I_USB                            policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_PHY_SUN50I_USB3                          policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_PHY_SUN6I_MIPI_DPHY                      policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_PHY_SUN9I_USB                            policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PHY_SUNPLUS_USB                          policy<{'armhf': 'm'}>
+CONFIG_PHY_TEGRA194_P2U                         policy<{'arm64': 'm'}>
+CONFIG_PHY_TEGRA_XUSB                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PHY_TI_GMII_SEL                          policy<{'arm64': 'm', 'armhf': 'y'}>
+CONFIG_PHY_TUSB1210                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PHY_XGENE                                policy<{'arm64': 'y'}>
+CONFIG_PHY_XILINX_ZYNQMP                        policy<{'arm64': 'm'}>
+CONFIG_PI433                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PID_IN_CONTEXTIDR                        policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_PID_NS                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PINCONF                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PINCTRL_AC5                              policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_ALDERLAKE                        policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_AMD                              policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_AMLOGIC_C3                       policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_AMLOGIC_T7                       policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_APPLE_GPIO                       policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_APQ8064                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_APQ8084                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_ARMADA_370                       policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_ARMADA_375                       policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_ARMADA_37XX                      policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_ARMADA_38X                       policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_ARMADA_39X                       policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_ARMADA_AP806                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_ARMADA_CP110                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_ARMADA_XP                        policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_AS370                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_AS3722                           policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_ASPEED                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_ASPEED_G6                        policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_AXP209                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_BAYTRAIL                         policy<{'amd64': 'y'}>
+CONFIG_PINCTRL_BERLIN                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_BERLIN_BG2                       policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_BERLIN_BG2CD                     policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_BERLIN_BG2Q                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_BERLIN_BG4CT                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_BM1880                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_BROXTON                          policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_CANNONLAKE                       policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_CEDARFORK                        policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_CS42L43                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_CS47L15                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_CS47L35                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_CS47L85                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_CS47L90                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_CS47L92                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_CY8C95X0                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_DA9062                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_DENVERTON                        policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_DOVE                             policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_ELKHARTLAKE                      policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_EMMITSBURG                       policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_EXYNOS                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_EXYNOS_ARM                       policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_GEMINILAKE                       policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_ICELAKE                          policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_IMX                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_IMX50                            policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_IMX51                            policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_IMX6Q                            policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_IMX6SL                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_IMX6SLL                          policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_IMX6SX                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_IMX6UL                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_IMX7D                            policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_IMX7ULP                          policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_IMX8DXL                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IMX8MM                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IMX8MN                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IMX8MP                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IMX8MQ                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IMX8QM                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IMX8QXP                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IMX8ULP                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_IMX93                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_IMXRT1050                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_IMXRT1170                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_IMX_SCU                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_INTEL                            policy<{'amd64': 'y'}>
+CONFIG_PINCTRL_INTEL_PLATFORM                   policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_IPQ4019                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_IPQ5018                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_IPQ5332                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_IPQ6018                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_IPQ8064                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_IPQ8074                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_IPQ9574                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_JASPERLAKE                       policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_KEEMBAY                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_LAKEFIELD                        policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_LEWISBURG                        policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_LOCHNAGAR                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_LPASS_LPI                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_LYNXPOINT                        policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_MADERA                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_MAX77620                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_MCP23S08                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PINCTRL_MCP23S08_I2C                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_MCP23S08_SPI                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_MDM9607                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_MDM9615                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_MESON                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_MESON8                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_MESON8B                          policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_MESON8_PMX                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_MESON_A1                         policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MESON_AXG                        policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MESON_AXG_PMX                    policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MESON_G12A                       policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MESON_GXBB                       policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MESON_GXL                        policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MESON_S4                         policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_METEORLAKE                       policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_METEORPOINT                      policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_MICROCHIP_SGPIO                  policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_MLXBF3                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_MSM                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_MSM8226                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_MSM8660                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_MSM8909                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_MSM8916                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_MSM8953                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_MSM8960                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_MSM8976                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_MSM8994                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_MSM8996                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_MSM8998                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_MSM8X74                          policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_MT2701                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_MT2712                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT6397                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_MT6765                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT6779                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_MT6795                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT6797                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT7622                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT7623                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_MT7629                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_MT7981                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT7986                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT8127                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_MT8135                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_MT8167                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT8173                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT8183                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT8186                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT8188                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT8192                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT8195                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT8365                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT8516                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MTK                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_MTK_MOORE                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_MTK_PARIS                        policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MTK_V2                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_MVEBU                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_NPCM7XX                          policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_NPCM8XX                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_OCELOT                           policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_OWL                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_PALMAS                           policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_PEF2256                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_PFC_EMEV2                        policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7740                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7742                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7743                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7744                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7745                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A77470                     policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A774A1                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A774B1                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A774C0                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A774E1                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7778                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7779                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7790                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7791                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7792                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7793                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A7794                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_PFC_R8A77951                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A77960                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A77961                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A77965                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A77970                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A77980                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A77990                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A77995                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A779A0                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A779F0                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_R8A779G0                     policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_PFC_SH73A0                       policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_QCM2290                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_QCOM_SPMI_PMIC                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_QCOM_SSBI_PMIC                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_QCS404                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_QDF2XXX                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_QDU1000                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_RENESAS                          policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_RK805                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_ROCKCHIP                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_RTD                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_RTD1315E                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_RTD1319D                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_RTD1619B                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PINCTRL_RZA1                             policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_RZA2                             policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_RZG2L                            policy<{'arm64': 'y', 'riscv64': '-'}>
+CONFIG_PINCTRL_RZN1                             policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_RZV2M                            policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_S32CC                            policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_S32G2                            policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_S500                             policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_S700                             policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_S900                             policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SA8775P                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SAMSUNG                          policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_SC7180                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SC7280                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SC7280_LPASS_LPI                 policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SC8180X                          policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SC8280XP                         policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SC8280XP_LPASS_LPI               policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SDM660                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SDM670                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SDM845                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SDX55                            policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_SDX65                            policy<{'armhf': 'm'}>
+CONFIG_PINCTRL_SDX75                            policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SH_PFC                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_SH_PFC_GPIO                      policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_SINGLE                           policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_SM4450                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM6115                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM6115_LPASS_LPI                 policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM6125                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM6350                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM6375                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM7150                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8150                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8250                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8250_LPASS_LPI                 policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8350                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8350_LPASS_LPI                 policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8450                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8450_LPASS_LPI                 policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8550                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8550_LPASS_LPI                 policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8650                           policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SM8650_LPASS_LPI                 policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SPPCTL                           policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_SPRD                             policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SPRD_SC9860                      policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_STARFIVE_JH7100                  policy<{'riscv64': 'n'}>
+CONFIG_PINCTRL_STARFIVE_JH7110                  policy<{'riscv64': 'y'}>
+CONFIG_PINCTRL_STARFIVE_JH7110_AON              policy<{'riscv64': 'm'}>
+CONFIG_PINCTRL_STARFIVE_JH7110_SYS              policy<{'riscv64': 'y'}>
+CONFIG_PINCTRL_STM32                            policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_STM32MP257                       policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_STMFX                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_SUN20I_D1                        policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_SUN4I_A10                        policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN50I_A100                      policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN50I_A100_R                    policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN50I_A64                       policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN50I_A64_R                     policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN50I_H5                        policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN50I_H6                        policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN50I_H616                      policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN50I_H616_R                    policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN50I_H6_R                      policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN5I                            policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN6I_A31                        policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN6I_A31_R                      policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN8I_A23                        policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN8I_A23_R                      policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN8I_A33                        policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN8I_A83T                       policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN8I_A83T_R                     policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN8I_H3                         policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN8I_H3_R                       policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN8I_V3S                        policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN9I_A80                        policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUN9I_A80_R                      policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_PINCTRL_SUNRISEPOINT                     policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_SUNXI                            policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_SX150X                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PINCTRL_TEGRA                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_TEGRA114                         policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_TEGRA124                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_TEGRA194                         policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_TEGRA20                          policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_TEGRA210                         policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_TEGRA234                         policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_TEGRA30                          policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_TEGRA_XUSB                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_PINCTRL_TIGERLAKE                        policy<{'amd64': 'm'}>
+CONFIG_PINCTRL_TI_IODELAY                       policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_TMPV7700                         policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_TPS6594                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINCTRL_VF610                            policy<{'armhf': 'y'}>
+CONFIG_PINCTRL_VISCONTI                         policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_X1E80100                         policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_ZYNQMP                           policy<{'arm64': 'm'}>
+CONFIG_PING                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PINMUX                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PJ4B_ERRATA_4742                         policy<{'armhf': 'y'}>
+CONFIG_PKCS7_MESSAGE_PARSER                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PKCS7_TEST_KEY                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PKCS8_PRIVATE_KEY_PARSER                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PKEY                                     policy<{'s390x': 'm'}>
+CONFIG_PL310_ERRATA_588369                      policy<{'armhf': 'y'}>
+CONFIG_PL310_ERRATA_727915                      policy<{'armhf': 'y'}>
+CONFIG_PL310_ERRATA_753970                      policy<{'armhf': 'y'}>
+CONFIG_PL310_ERRATA_769419                      policy<{'armhf': 'y'}>
+CONFIG_PL320_MBOX                               policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_PL330_DMA                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PL353_SMC                                policy<{'armhf': 'm'}>
+CONFIG_PLATFORM_MHU                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PLATFORM_SI4713                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PLAT_ORION                               policy<{'armhf': 'y'}>
+CONFIG_PLAT_SPEAR                               policy<{'armhf': 'n'}>
+CONFIG_PLAT_VERSATILE                           policy<{'armhf': 'y'}>
+CONFIG_PLAYSTATION_FF                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PLDMFW                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PLFXLC                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PLIP                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PLX_DMA                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PM8916_WATCHDOG                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PMBUS                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PMIC_ADP5520                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_PMIC_DA903X                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_PMIC_DA9052                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PMIC_OPREGION                            policy<{'amd64': 'y', 'arm64': 'n', 'riscv64': 'y'}>
+CONFIG_PMS7003                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PMU_SYSFS                                policy<{'ppc64el': 'n'}>
+CONFIG_PM_ADVANCED_DEBUG                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_AUTOSLEEP                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_PM_CLK                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_DEBUG                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_DEVFREQ                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PM_DEVFREQ_EVENT                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_GENERIC_DOMAINS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_GENERIC_DOMAINS_OF                    policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_GENERIC_DOMAINS_SLEEP                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_NOTIFIER_ERROR_INJECT                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PM_OPP                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_SLEEP                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_SLEEP_DEBUG                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_SLEEP_SMP                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_SLEEP_SMP_NONZERO_CPU                 policy<{'ppc64el': 'y'}>
+CONFIG_PM_STD_PARTITION                         policy<{'amd64': '""', 'armhf': '""', 'riscv64': '-'}>
+CONFIG_PM_TEST_SUSPEND                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_PM_TRACE                                 policy<{'amd64': 'y'}>
+CONFIG_PM_TRACE_RTC                             policy<{'amd64': 'y'}>
+CONFIG_PM_USERSPACE_AUTOSLEEP                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_PM_WAKELOCKS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_WAKELOCKS_GC                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PM_WAKELOCKS_LIMIT                       policy<{'amd64': '100', 'arm64': '100', 'armhf': '100', 'ppc64el': '100', 'riscv64': '100'}>
+CONFIG_PNFS_BLOCK                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PNFS_FILE_LAYOUT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PNFS_FLEXFILE_LAYOUT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PNP                                      policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_PNPACPI                                  policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_PNP_DEBUG_MESSAGES                       policy<{'amd64': 'n', 'arm64': 'n', 'riscv64': 'n'}>
+CONFIG_POLARFIRE_SOC_AUTO_UPDATE                policy<{'riscv64': 'm'}>
+CONFIG_POLARFIRE_SOC_MAILBOX                    policy<{'riscv64': 'm'}>
+CONFIG_POLARFIRE_SOC_SYS_CTRL                   policy<{'riscv64': 'm'}>
+CONFIG_POLYNOMIAL                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PORTABLE                                 policy<{'riscv64': 'y'}>
+CONFIG_POSIX_CPU_TIMERS_TASK_WORK               policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_POSIX_MQUEUE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_POSIX_MQUEUE_SYSCTL                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_POSIX_TIMERS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_POWER10_CPU                              policy<{'ppc64el': 'n'}>
+CONFIG_POWER7_CPU                               policy<{'ppc64el': 'n'}>
+CONFIG_POWER8_CPU                               policy<{'ppc64el': 'n'}>
+CONFIG_POWER9_CPU                               policy<{'ppc64el': 'n'}>
+CONFIG_POWERCAP                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_POWERNV_CPUFREQ                          policy<{'ppc64el': 'y'}>
+CONFIG_POWERNV_CPUIDLE                          policy<{'ppc64el': 'y'}>
+CONFIG_POWERNV_OP_PANEL                         policy<{'ppc64el': 'm'}>
+CONFIG_POWERPC64_CPU                            policy<{'ppc64el': 'y'}>
+CONFIG_POWER_MLXBF                              policy<{'arm64': 'm'}>
+CONFIG_POWER_RESET                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_POWER_RESET_AS3722                       policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_POWER_RESET_ATC260X                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_POWER_RESET_AXXIA                        policy<{'armhf': 'y'}>
+CONFIG_POWER_RESET_BRCMKONA                     policy<{'armhf': 'y'}>
+CONFIG_POWER_RESET_GPIO                         policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_POWER_RESET_GPIO_RESTART                 policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_POWER_RESET_HISI                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_POWER_RESET_LINKSTATION                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_POWER_RESET_LTC2952                      policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_POWER_RESET_MSM                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_POWER_RESET_MT6323                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_POWER_RESET_OCELOT_RESET                 policy<{'arm64': 'y'}>
+CONFIG_POWER_RESET_ODROID_GO_ULTRA_POWEROFF     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_POWER_RESET_QCOM_PON                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_POWER_RESET_QNAP                         policy<{'armhf': 'n'}>
+CONFIG_POWER_RESET_REGULATOR                    policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_POWER_RESET_RESTART                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_POWER_RESET_RMOBILE                      policy<{'armhf': 'm'}>
+CONFIG_POWER_RESET_SC27XX                       policy<{'arm64': 'm'}>
+CONFIG_POWER_RESET_SYSCON                       policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_POWER_RESET_SYSCON_POWEROFF              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_POWER_RESET_TPS65086                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_POWER_RESET_VERSATILE                    policy<{'armhf': 'y'}>
+CONFIG_POWER_RESET_VEXPRESS                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_POWER_RESET_XGENE                        policy<{'arm64': 'n'}>
+CONFIG_POWER_SUPPLY                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_POWER_SUPPLY_DEBUG                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_POWER_SUPPLY_HWMON                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PPC                                      policy<{'ppc64el': 'y'}>
+CONFIG_PPC64                                    policy<{'ppc64el': 'y'}>
+CONFIG_PPC64_BOOT_WRAPPER                       policy<{'ppc64el': 'y'}>
+CONFIG_PPC64_ELF_ABI_V2                         policy<{'ppc64el': 'y'}>
+CONFIG_PPC64_SUPPORTS_MEMORY_FAILURE            policy<{'ppc64el': 'y'}>
+CONFIG_PPC_4K_PAGES                             policy<{'ppc64el': 'n'}>
+CONFIG_PPC_64K_PAGES                            policy<{'ppc64el': 'y'}>
+CONFIG_PPC_64S_HASH_MMU                         policy<{'ppc64el': 'y'}>
+CONFIG_PPC_BARRIER_NOSPEC                       policy<{'ppc64el': 'y'}>
+CONFIG_PPC_BOOK3E_64                            policy<{'ppc64el': 'n'}>
+CONFIG_PPC_BOOK3S                               policy<{'ppc64el': 'y'}>
+CONFIG_PPC_BOOK3S_64                            policy<{'ppc64el': 'y'}>
+CONFIG_PPC_BOOK3S_IDLE                          policy<{'ppc64el': 'y'}>
+CONFIG_PPC_COPRO_BASE                           policy<{'ppc64el': 'y'}>
+CONFIG_PPC_DAWR                                 policy<{'ppc64el': 'y'}>
+CONFIG_PPC_DENORMALISATION                      policy<{'ppc64el': 'y'}>
+CONFIG_PPC_DISABLE_WERROR                       policy<{'ppc64el': 'n'}>
+CONFIG_PPC_DOORBELL                             policy<{'ppc64el': 'y'}>
+CONFIG_PPC_DT_CPU_FTRS                          policy<{'ppc64el': 'y'}>
+CONFIG_PPC_EARLY_DEBUG                          policy<{'ppc64el': 'n'}>
+CONFIG_PPC_EMULATED_STATS                       policy<{'ppc64el': 'n'}>
+CONFIG_PPC_EPAPR_HV_BYTECHAN                    policy<{'ppc64el': 'n'}>
+CONFIG_PPC_FAST_ENDIAN_SWITCH                   policy<{'ppc64el': 'n'}>
+CONFIG_PPC_FPU                                  policy<{'ppc64el': 'y'}>
+CONFIG_PPC_FPU_REGS                             policy<{'ppc64el': 'y'}>
+CONFIG_PPC_HASH_MMU_NATIVE                      policy<{'ppc64el': 'y'}>
+CONFIG_PPC_HAS_LBARX_LHARX                      policy<{'ppc64el': 'y'}>
+CONFIG_PPC_HAVE_PMU_SUPPORT                     policy<{'ppc64el': 'y'}>
+CONFIG_PPC_I8259                                policy<{'ppc64el': 'y'}>
+CONFIG_PPC_ICP_HV                               policy<{'ppc64el': 'y'}>
+CONFIG_PPC_ICP_NATIVE                           policy<{'ppc64el': 'y'}>
+CONFIG_PPC_ICS_RTAS                             policy<{'ppc64el': 'y'}>
+CONFIG_PPC_INDIRECT_PIO                         policy<{'ppc64el': 'y'}>
+CONFIG_PPC_IRQ_SOFT_MASK_DEBUG                  policy<{'ppc64el': 'n'}>
+CONFIG_PPC_KUAP                                 policy<{'ppc64el': 'y'}>
+CONFIG_PPC_KUAP_DEBUG                           policy<{'ppc64el': 'n'}>
+CONFIG_PPC_KUEP                                 policy<{'ppc64el': 'y'}>
+CONFIG_PPC_MEMTRACE                             policy<{'ppc64el': 'y'}>
+CONFIG_PPC_MSI_BITMAP                           policy<{'ppc64el': 'y'}>
+CONFIG_PPC_OF_BOOT_TRAMPOLINE                   policy<{'ppc64el': 'y'}>
+CONFIG_PPC_P7_NAP                               policy<{'ppc64el': 'y'}>
+CONFIG_PPC_PAGE_SHIFT                           policy<{'ppc64el': '16'}>
+CONFIG_PPC_PERF_CTRS                            policy<{'ppc64el': 'y'}>
+CONFIG_PPC_PKEY                                 policy<{'ppc64el': 'y'}>
+CONFIG_PPC_POWERNV                              policy<{'ppc64el': 'y'}>
+CONFIG_PPC_PROT_SAO_LPAR                        policy<{'ppc64el': 'n'}>
+CONFIG_PPC_PSERIES                              policy<{'ppc64el': 'y'}>
+CONFIG_PPC_QUEUED_SPINLOCKS                     policy<{'ppc64el': 'n'}>
+CONFIG_PPC_RADIX_MMU                            policy<{'ppc64el': 'y'}>
+CONFIG_PPC_RADIX_MMU_DEFAULT                    policy<{'ppc64el': 'y'}>
+CONFIG_PPC_RFI_SRR_DEBUG                        policy<{'ppc64el': 'n'}>
+CONFIG_PPC_RTAS                                 policy<{'ppc64el': 'y'}>
+CONFIG_PPC_RTAS_DAEMON                          policy<{'ppc64el': 'y'}>
+CONFIG_PPC_SMLPAR                               policy<{'ppc64el': 'y'}>
+CONFIG_PPC_SMP_MUXED_IPI                        policy<{'ppc64el': 'y'}>
+CONFIG_PPC_SPLPAR                               policy<{'ppc64el': 'y'}>
+CONFIG_PPC_SUBPAGE_PROT                         policy<{'ppc64el': 'y'}>
+CONFIG_PPC_SVM                                  policy<{'ppc64el': 'y'}>
+CONFIG_PPC_TRANSACTIONAL_MEM                    policy<{'ppc64el': 'y'}>
+CONFIG_PPC_UDBG_16550                           policy<{'ppc64el': 'y'}>
+CONFIG_PPC_UV                                   policy<{'ppc64el': 'y'}>
+CONFIG_PPC_VAS                                  policy<{'ppc64el': 'y'}>
+CONFIG_PPC_WATCHDOG                             policy<{'ppc64el': 'y'}>
+CONFIG_PPC_WERROR                               policy<{'ppc64el': 'y'}>
+CONFIG_PPC_XICS                                 policy<{'ppc64el': 'y'}>
+CONFIG_PPC_XIVE                                 policy<{'ppc64el': 'y'}>
+CONFIG_PPC_XIVE_NATIVE                          policy<{'ppc64el': 'y'}>
+CONFIG_PPC_XIVE_SPAPR                           policy<{'ppc64el': 'y'}>
+CONFIG_PPDEV                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PPP                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PPPOATM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PPPOE                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PPPOE_HASH_BITS                          policy<{'amd64': '4', 'arm64': '4', 'armhf': '4', 'ppc64el': '4', 'riscv64': '4'}>
+CONFIG_PPPOE_HASH_BITS_1                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_PPPOE_HASH_BITS_2                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_PPPOE_HASH_BITS_4                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PPPOE_HASH_BITS_8                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_PPPOL2TP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PPP_ASYNC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PPP_BSDCOMP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PPP_DEFLATE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PPP_FILTER                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PPP_MPPE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PPP_MULTILINK                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PPP_SYNC_TTY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PPS                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PPS_CLIENT_GPIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PPS_CLIENT_KTIMER                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PPS_CLIENT_LDISC                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PPS_CLIENT_PARPORT                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PPS_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PPTP                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PREEMPT                                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PREEMPTION                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_PREEMPTIRQ_DELAY_TEST                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PREEMPT_BUILD                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_PREEMPT_COUNT                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_PREEMPT_NONE                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PREEMPT_NOTIFIERS                        policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PREEMPT_RCU                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_PREEMPT_TRACER                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_PREEMPT_VOLUNTARY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PREEMPT_VOLUNTARY_BUILD                  policy<{'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_PREFIX_SYMBOLS                           policy<{'amd64': 'y'}>
+CONFIG_PRESTERA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PRESTERA_PCI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PREVENT_FIRMWARE_BUILD                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PRIME_NUMBERS                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PRINTER                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PRINTK                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PRINTK_CALLER                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PRINTK_INDEX                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PRINTK_TIME                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PRINT_STACK_DEPTH                        policy<{'ppc64el': '64'}>
+CONFIG_PRISM2_USB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PROBE_EVENTS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROBE_EVENTS_BTF_ARGS                    policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROCESSOR_SELECT                         policy<{'amd64': 'y'}>
+CONFIG_PROC_CHILDREN                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROC_CPU_RESCTRL                         policy<{'amd64': 'y'}>
+CONFIG_PROC_EVENTS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROC_FS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROC_KCORE                               policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROC_MEM_ALWAYS_FORCE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROC_MEM_FORCE_PTRACE                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PROC_MEM_NO_FORCE                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PROC_PAGE_MONITOR                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROC_PID_ARCH_STATUS                     policy<{'amd64': 'y'}>
+CONFIG_PROC_PID_CPUSET                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROC_SYSCTL                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROC_THERMAL_MMIO_RAPL                   policy<{'amd64': 'm'}>
+CONFIG_PROC_VMCORE                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROC_VMCORE_DEVICE_DUMP                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROFILE_ALL_BRANCHES                     policy<{'riscv64': 'n'}>
+CONFIG_PROFILE_ANNOTATED_BRANCHES               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PROFILING                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PROTECTED_VIRTUALIZATION_GUEST           policy<{'s390x': 'y'}>
+CONFIG_PROVE_LOCKING                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_PROVIDE_OHCI1394_DMA_INIT                policy<{'amd64': 'n'}>
+CONFIG_PRU_REMOTEPROC                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PSAMPLE                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PSERIES_CPUIDLE                          policy<{'ppc64el': 'y'}>
+CONFIG_PSERIES_ENERGY                           policy<{'ppc64el': 'm'}>
+CONFIG_PSERIES_PLPKS                            policy<{'ppc64el': 'y'}>
+CONFIG_PSERIES_PLPKS_SED                        policy<{'ppc64el': 'y'}>
+CONFIG_PSERIES_WDT                              policy<{'ppc64el': 'm'}>
+CONFIG_PSE_CONTROLLER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PSE_REGULATOR                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PSI                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PSTORE                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PSTORE_BLK                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PSTORE_BLK_BLKDEV                        policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '-'}>
+CONFIG_PSTORE_BLK_CONSOLE_SIZE                  policy<{'armhf': '64'}>
+CONFIG_PSTORE_BLK_KMSG_SIZE                     policy<{'amd64': '64', 'arm64': '64', 'armhf': '64', 'ppc64el': '64', 'riscv64': '64'}>
+CONFIG_PSTORE_BLK_MAX_REASON                    policy<{'amd64': '2', 'arm64': '2', 'armhf': '2', 'ppc64el': '2', 'riscv64': '2', 's390x': '-'}>
+CONFIG_PSTORE_COMPRESS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PSTORE_CONSOLE                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_PSTORE_DEFAULT_KMSG_BYTES                policy<{'amd64': '10240', 'arm64': '10240', 'armhf': '10240', 'ppc64el': '10240', 'riscv64': '10240'}>
+CONFIG_PSTORE_FTRACE                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': '-', 's390x': '-'}>
+CONFIG_PSTORE_PMSG                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_PSTORE_RAM                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PSTORE_ZONE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PTDUMP_CORE                              policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_PTDUMP_DEBUGFS                           policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'y'}>
+CONFIG_PTE_MARKER_UFFD_WP                       policy<{'amd64': 'y'}>
+CONFIG_PTP_1588_CLOCK                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_PTP_1588_CLOCK_IDT82P33                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_PTP_1588_CLOCK_IDTCM                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PTP_1588_CLOCK_INES                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PTP_1588_CLOCK_KVM                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PTP_1588_CLOCK_MOCK                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_PTP_1588_CLOCK_OCP                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PTP_1588_CLOCK_OPTIONAL                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_PTP_1588_CLOCK_QORIQ                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_PTP_1588_CLOCK_VMW                       policy<{'amd64': 'm'}>
+CONFIG_PTP_DFL_TOD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PUNIT_ATOM_DEBUG                         policy<{'amd64': 'm'}>
+CONFIG_PVH                                      policy<{'amd64': 'y'}>
+CONFIG_PVPANIC                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PVPANIC_MMIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PVPANIC_PCI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PWC_RZV2M                                policy<{'arm64': 'y'}>
+CONFIG_PWM                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_PWM_APPLE                                policy<{'arm64': 'm'}>
+CONFIG_PWM_ATMEL_HLCDC_PWM                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_ATMEL_TCB                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_BERLIN                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_CLK                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_CRC                                  policy<{'amd64': 'y'}>
+CONFIG_PWM_CROS_EC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_PWM_DWC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PWM_DWC_CORE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_FSL_FTM                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_HIBVT                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_IMX1                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_IMX27                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_IMX_TPM                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_IQS620A                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_KEEMBAY                              policy<{'arm64': 'm'}>
+CONFIG_PWM_LP3943                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_LPSS                                 policy<{'amd64': 'y'}>
+CONFIG_PWM_LPSS_PCI                             policy<{'amd64': 'y'}>
+CONFIG_PWM_LPSS_PLATFORM                        policy<{'amd64': 'y'}>
+CONFIG_PWM_MEDIATEK                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_MESON                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_MICROCHIP_CORE                       policy<{'riscv64': 'm'}>
+CONFIG_PWM_MTK_DISP                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_NTXEC                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_OMAP_DMTIMER                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_PCA9685                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PWM_RCAR                                 policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_RENESAS_TPU                          policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_PWM_ROCKCHIP                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_RZ_MTU3                              policy<{'arm64': 'm', 'riscv64': '-'}>
+CONFIG_PWM_SAMSUNG                              policy<{'armhf': 'n'}>
+CONFIG_PWM_SIFIVE                               policy<{'riscv64': 'm'}>
+CONFIG_PWM_SL28CPLD                             policy<{'arm64': 'm'}>
+CONFIG_PWM_SPRD                                 policy<{'arm64': 'm'}>
+CONFIG_PWM_STM32                                policy<{'arm64': 'm'}>
+CONFIG_PWM_STM32_LP                             policy<{'arm64': 'm'}>
+CONFIG_PWM_STMPE                                policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PWM_SUN4I                                policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_PWM_SUNPLUS                              policy<{'armhf': 'm'}>
+CONFIG_PWM_SYSFS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_PWM_TEGRA                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_TIECAP                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_TIEHRPWM                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_PWM_TWL                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PWM_TWL_LED                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_PWM_VISCONTI                             policy<{'arm64': 'm'}>
+CONFIG_PWM_XILINX                               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWRSEQ_EMMC                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWRSEQ_SD8787                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PWRSEQ_SIMPLE                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_PXA168_ETH                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCA7000                                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCA7000_SPI                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCA7000_UART                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCM_DISPCC_2290                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCM_GCC_2290                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_A53PLL                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_A7PLL                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_AOSS_QMP                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_APCS_IPC                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_APR                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_BAM_DMA                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_BAM_DMUX                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_CLK_APCC_MSM8996                    policy<{'arm64': 'm'}>
+CONFIG_QCOM_CLK_APCS_MSM8916                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_CLK_APCS_SDX55                      policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_QCOM_CLK_RPM                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_CLK_RPMH                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_CLK_SMD_RPM                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_COINCELL                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_COMMAND_DB                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_CPR                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_EBI2                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_EMAC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_QCOM_FALKOR_ERRATUM_1003                 policy<{'arm64': 'y'}>
+CONFIG_QCOM_FALKOR_ERRATUM_1009                 policy<{'arm64': 'y'}>
+CONFIG_QCOM_FALKOR_ERRATUM_E1041                policy<{'arm64': 'y'}>
+CONFIG_QCOM_FASTRPC                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_GDSC                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_GENI_SE                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_GPI_DMA                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_GSBI                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_HFPLL                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_HIDMA                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_QCOM_HIDMA_MGMT                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_QCOM_ICC_BWMON                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_INLINE_CRYPTO_ENGINE                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_IOMMU                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_IPA                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_IPCC                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_IRQ_COMBINER                        policy<{'arm64': 'y'}>
+CONFIG_QCOM_KRYO_L2_ACCESSORS                   policy<{'arm64': 'y'}>
+CONFIG_QCOM_L2_PMU                              policy<{'arm64': 'y'}>
+CONFIG_QCOM_L3_PMU                              policy<{'arm64': 'y'}>
+CONFIG_QCOM_LLCC                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_LMH                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_MDT_LOADER                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_MPM                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_OCMEM                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_PDC                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_PDR_HELPERS                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCOM_PIL_INFO                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_PM8XXX_XOADC                        policy<{'armhf': 'm'}>
+CONFIG_QCOM_PMIC_GLINK                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCOM_PMIC_PDCHARGER_ULOG                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCOM_Q6V5_ADSP                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_Q6V5_COMMON                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_Q6V5_MSS                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_Q6V5_PAS                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_Q6V5_WCSS                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_QMI_HELPERS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCOM_QSEECOM                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_QSEECOM_UEFISECAPP                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_RAMP_CTRL                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_RMTFS_MEM                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_RPMCC                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_RPMH                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_RPMHPD                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_RPMPD                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_RPM_MASTER_STATS                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_RPROC_COMMON                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SCM                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_SCM_DOWNLOAD_MODE_DEFAULT           policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_QCOM_SMD_RPM                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SMEM                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SMEM_STATE                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_SMP2P                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SMSM                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SOCINFO                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SPM                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_SPMI_ADC5                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCOM_SPMI_ADC_TM5                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SPMI_IADC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCOM_SPMI_RRADC                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SPMI_TEMP_ALARM                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SPMI_VADC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCOM_SSC_BLOCK_BUS                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_QCOM_STATS                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_SYSMON                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_TSENS                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_VADC_COMMON                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QCOM_WCNSS_CTRL                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCOM_WCNSS_PIL                           policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_QCOM_WDT                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCS_GCC_404                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCS_Q6SSTOP_404                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QCS_TURING_404                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QDIO                                     policy<{'s390x': 'm'}>
+CONFIG_QDU_ECPRICC_1000                         policy<{'arm64': 'm'}>
+CONFIG_QDU_GCC_1000                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_QED                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_QEDE                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QEDF                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QEDI                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QED_FCOE                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_QED_ISCSI                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_QED_LL2                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_QED_OOO                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_QED_RDMA                                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_QED_SRIOV                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_QETH                                     policy<{'s390x': 'm'}>
+CONFIG_QETH_L2                                  policy<{'s390x': 'm'}>
+CONFIG_QETH_L3                                  policy<{'s390x': 'm'}>
+CONFIG_QE_GPIO                                  policy<{'ppc64el': 'y'}>
+CONFIG_QE_TDM                                   policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_QE_USB                                   policy<{'ppc64el': 'y'}>
+CONFIG_QFMT_V1                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_QFMT_V2                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_QLA3XXX                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_QLCNIC                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_QLCNIC_DCB                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_QLCNIC_HWMON                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_QLCNIC_SRIOV                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_QNX4FS_FS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_QNX6FS_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_QNX6FS_FS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_QORIQ_CPUFREQ                            policy<{'arm64': 'm'}>
+CONFIG_QORIQ_THERMAL                            policy<{'arm64': 'm'}>
+CONFIG_QRTR                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_QRTR_MHI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QRTR_SMD                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QRTR_TUN                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QSEMI_PHY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_QTNFMAC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QTNFMAC_PCIE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_QUEUED_RWLOCKS                           policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_QUEUED_SPINLOCKS                         policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_QUICC_ENGINE                             policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_QUOTA                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_QUOTACTL                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_QUOTA_DEBUG                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_QUOTA_NETLINK_INTERFACE                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_QUOTA_TREE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_R6040                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_R8169                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_R8169_LEDS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_R8712U                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_ADAPTERS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_MAXIRADIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_SAA7706H                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_SHARK                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_SHARK2                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_SI470X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_SI4713                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_SI476X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_TEA575X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_TEA5764                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_TEF6862                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_WL1273                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RADIO_WL128X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RAID6_PQ                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_RAID6_PQ_BENCHMARK                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RAID_ATTRS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_RANDOM32_SELFTEST                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RANDOMIZE_BASE                           policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RANDOMIZE_KSTACK_OFFSET                  policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT          policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_RANDOMIZE_MEMORY                         policy<{'amd64': 'y'}>
+CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING        policy<{'amd64': '0xa'}>
+CONFIG_RANDOMIZE_MODULE_REGION_FULL             policy<{'arm64': 'y'}>
+CONFIG_RANDOM_KMALLOC_CACHES                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RANDSTRUCT_NONE                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RAPIDIO                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_RAPIDIO_CHMAN                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RAPIDIO_CPS_GEN2                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RAPIDIO_CPS_XX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RAPIDIO_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_RAPIDIO_DISC_TIMEOUT                     policy<{'amd64': '30', 'arm64': '30', 'armhf': '30', 'ppc64el': '30', 'riscv64': '30'}>
+CONFIG_RAPIDIO_DMA_ENGINE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RAPIDIO_ENABLE_RX_TX_PORTS               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_RAPIDIO_ENUM_BASIC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RAPIDIO_MPORT_CDEV                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RAPIDIO_RXS_GEN3                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RAPIDIO_TSI721                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RAS                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RAS_CEC                                  policy<{'amd64': 'y'}>
+CONFIG_RAS_CEC_DEBUG                            policy<{'amd64': 'n'}>
+CONFIG_RATIONAL                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RAVB                                     policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RAVE_SP_CORE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_RAVE_SP_WATCHDOG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RBTREE_TEST                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RCAR_DMAC                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RCAR_GEN3_THERMAL                        policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RCAR_GYRO_ADC                            policy<{'armhf': 'm'}>
+CONFIG_RCAR_REMOTEPROC                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RCAR_THERMAL                             policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RCU_CPU_STALL_CPUTIME                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RCU_CPU_STALL_TIMEOUT                    policy<{'amd64': '60', 'arm64': '60', 'armhf': '60', 'ppc64el': '60', 'riscv64': '60', 's390x': '60'}>
+CONFIG_RCU_EQS_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RCU_EXPERT                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RCU_EXP_CPU_STALL_TIMEOUT                policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_RCU_NEED_SEGCBLIST                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RCU_REF_SCALE_TEST                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RCU_SCALE_TEST                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RCU_STALL_COMMON                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RCU_TORTURE_TEST                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RCU_TRACE                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RC_ATI_REMOTE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RC_CORE                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_RC_DECODERS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RC_DEVICES                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RC_LOOPBACK                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RC_MAP                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RC_XBOX_DVD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RDA_INTC                                 policy<{'armhf': 'y'}>
+CONFIG_RDA_TIMER                                policy<{'armhf': 'y'}>
+CONFIG_RDMA_RXE                                 policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_RDMA_SIW                                 policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_RDS                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_RDS_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RDS_RDMA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_RDS_TCP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_RD_BZIP2                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RD_GZIP                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RD_LZ4                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RD_LZMA                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RD_LZO                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RD_XZ                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RD_ZSTD                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_READABLE_ASM                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_READ_ONLY_THP_FOR_FS                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_REALTEK_AUTOPM                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_REALTEK_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_REBOOT_MODE                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REED_SOLOMON                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REED_SOLOMON_DEC16                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_REED_SOLOMON_DEC8                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_REED_SOLOMON_ENC8                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_REED_SOLOMON_TEST                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_REGMAP                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_REGMAP_AC97                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGMAP_I2C                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_REGMAP_I3C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGMAP_IRQ                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_REGMAP_MMIO                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_REGMAP_SCCB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGMAP_SLIMBUS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGMAP_SOUNDWIRE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGMAP_SOUNDWIRE_MBQ                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGMAP_SPI                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_REGMAP_SPI_AVMM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGMAP_SPMI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGMAP_W1                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_REGULATOR_88PG86X                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_88PM800                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_88PM8607                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_AAT2870                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_ACT8865                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_ACT8945A                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_AD5398                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_ANATOP                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_ARIZONA_LDO1                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_ARIZONA_MICSUPP                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_ARM_SCMI                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_AS3711                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_AS3722                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_ATC260X                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_AW37503                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_AXP20X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_BCM590XX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_BD71815                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_BD71828                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_BD718XX                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_BD9571MWV                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_BD957XMUF                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_CPCAP                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_CROS_EC                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_DA903X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_DA9052                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_DA9055                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_DA9062                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_DA9063                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_DA9121                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_DA9210                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_DA9211                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_DEBUG                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_REGULATOR_FAN53555                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_FAN53880                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_GPIO                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_HI6421                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_HI6421V530                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_HI6421V600                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_HI655X                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_ISL6271A                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_ISL9305                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_LM363X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_LOCHNAGAR                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_LP3971                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_LP3972                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_LP872X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_LP873X                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_LP8755                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_LP87565                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_LP8788                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_LTC3589                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_LTC3676                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX14577                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX1586                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX20086                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX20411                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX5970                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX77503                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX77541                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX77620                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX77650                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX77686                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX77693                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX77802                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX77826                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX77857                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX8649                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX8660                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX8893                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX8907                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX8925                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX8952                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX8973                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MAX8997                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MAX8998                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MC13783                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MC13892                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MC13XXX_CORE                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MCP16502                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MP5416                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MP8859                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MP886X                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MPQ7920                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6311                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_MT6315                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6323                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6331                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6332                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6357                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6358                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6359                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6360                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6370                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_MT6380                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_MT6397                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_NETLINK_EVENTS                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_REGULATOR_PALMAS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_PBIAS                          policy<{'armhf': 'm'}>
+CONFIG_REGULATOR_PCA9450                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_PCAP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_PCF50633                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_PF8X00                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_PFUZE100                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_PV88060                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_PV88080                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_PV88090                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_PWM                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_QCOM_LABIBB                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_QCOM_REFGEN                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_QCOM_RPM                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_QCOM_RPMH                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_QCOM_SMD_RPM                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_QCOM_SPMI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_QCOM_USB_VBUS                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RAA215300                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RC5T583                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_RK808                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RN5T618                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_ROHM                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RT4801                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_RT4803                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RT4831                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RT5033                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RT5120                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RT5190A                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RT5739                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RT5759                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RT6160                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_RT6190                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RT6245                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_RTMV20                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_RTQ2134                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_RTQ2208                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_RTQ6752                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_S2MPA01                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_S2MPS11                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_S5M8767                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_SC2731                         policy<{'arm64': 'm'}>
+CONFIG_REGULATOR_SKY81452                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_SLG51000                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_STM32_BOOSTER                  policy<{'arm64': 'm'}>
+CONFIG_REGULATOR_STM32_PWR                      policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_STM32_VREFBUF                  policy<{'arm64': 'm'}>
+CONFIG_REGULATOR_STPMIC1                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_SY7636A                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_SY8106A                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_SY8824X                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_SY8827N                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_TI_ABB                         policy<{'armhf': 'y'}>
+CONFIG_REGULATOR_TPS51632                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS6105X                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_TPS62360                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS6286X                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_TPS6287X                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_TPS65023                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS6507X                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS65086                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_TPS65090                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS65132                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS65218                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_TPS65219                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_TPS6524X                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS6586X                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS65910                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS65912                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_TPS6594                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_TPS68470                       policy<{'amd64': 'm'}>
+CONFIG_REGULATOR_USERSPACE_CONSUMER             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_VCTRL                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REGULATOR_VEXPRESS                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_VIRTUAL_CONSUMER               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_VQMMC_IPQ4019                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_REGULATOR_WM831X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_WM8350                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_WM8400                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_REGULATOR_WM8994                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_REISERFS_CHECK                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_REISERFS_FS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_REISERFS_FS_POSIX_ACL                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_REISERFS_FS_SECURITY                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_REISERFS_FS_XATTR                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_REISERFS_PROC_INFO                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_RELAY                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RELOCATABLE                              policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RELOCATABLE_TEST                         policy<{'ppc64el': 'n'}>
+CONFIG_REMOTEPROC                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_REMOTEPROC_CDEV                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_REMOTE_TARGET                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_RENESAS_DMA                              policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_RENESAS_ETHER_SWITCH                     policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RENESAS_GEN4_PTP                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RENESAS_INTC_IRQPIN                      policy<{'armhf': 'y'}>
+CONFIG_RENESAS_IRQC                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RENESAS_OSTM                             policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_RENESAS_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_RENESAS_RPCIF                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RENESAS_RZA1_IRQC                        policy<{'armhf': 'y'}>
+CONFIG_RENESAS_RZAWDT                           policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RENESAS_RZG2LWDT                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RENESAS_RZG2L_IRQC                       policy<{'arm64': 'y', 'riscv64': '-'}>
+CONFIG_RENESAS_RZN1WDT                          policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RENESAS_USB_DMAC                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RENESAS_WDT                              policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RESET_A10SR                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RESET_ATTACK_MITIGATION                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_RESET_BERLIN                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RESET_CONTROLLER                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_RESET_HISI                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RESET_IMX7                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RESET_MCHP_SPARX5                        policy<{'arm64': 'y'}>
+CONFIG_RESET_MESON                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RESET_MESON_AUDIO_ARB                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RESET_NPCM                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RESET_NUVOTON_MA35D1                     policy<{'arm64': 'y'}>
+CONFIG_RESET_POLARFIRE_SOC                      policy<{'riscv64': 'y'}>
+CONFIG_RESET_QCOM_AOSS                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RESET_QCOM_PDC                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RESET_RZG2L_USBPHY_CTRL                  policy<{'arm64': 'y', 'riscv64': '-'}>
+CONFIG_RESET_SCMI                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RESET_SIMPLE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RESET_SOCFPGA                            policy<{'armhf': 'y'}>
+CONFIG_RESET_STARFIVE_JH7100                    policy<{'riscv64': 'n'}>
+CONFIG_RESET_STARFIVE_JH7110                    policy<{'riscv64': 'y'}>
+CONFIG_RESET_STARFIVE_JH71X0                    policy<{'riscv64': 'y'}>
+CONFIG_RESET_SUNPLUS                            policy<{'armhf': 'y'}>
+CONFIG_RESET_SUNXI                              policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_RESET_TEGRA_BPMP                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RESET_TI_SCI                             policy<{'arm64': 'm'}>
+CONFIG_RESET_TI_SYSCON                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RESET_TI_TPS380X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RETHOOK                                  policy<{'amd64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RETHUNK                                  policy<{'amd64': 'y'}>
+CONFIG_RETPOLINE                                policy<{'amd64': 'y'}>
+CONFIG_RETU_WATCHDOG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RFD77402                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RFD_FTL                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RFKILL                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_RFKILL_GPIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RFKILL_INPUT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RFKILL_LEDS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RFS_ACCEL                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RICHTEK_RTQ6056                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RING_BUFFER                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RING_BUFFER_BENCHMARK                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RING_BUFFER_STARTUP_TEST                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_RIONET                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RIONET_RX_SIZE                           policy<{'amd64': '128', 'arm64': '128', 'armhf': '128', 'ppc64el': '128', 'riscv64': '128'}>
+CONFIG_RIONET_TX_SIZE                           policy<{'amd64': '128', 'arm64': '128', 'armhf': '128', 'ppc64el': '128', 'riscv64': '128'}>
+CONFIG_RISCV                                    policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ALTERNATIVE                        policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ALTERNATIVE_EARLY                  policy<{'riscv64': 'y'}>
+CONFIG_RISCV_BOOT_SPINWAIT                      policy<{'riscv64': 'n'}>
+CONFIG_RISCV_DMA_NONCOHERENT                    policy<{'riscv64': 'y'}>
+CONFIG_RISCV_INTC                               policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ISA_C                              policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ISA_FALLBACK                       policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ISA_SVNAPOT                        policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ISA_SVPBMT                         policy<{'riscv64': 'n'}>
+CONFIG_RISCV_ISA_V                              policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ISA_V_DEFAULT_ENABLE               policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ISA_V_PREEMPTIVE                   policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ISA_V_UCOPY_THRESHOLD              policy<{'riscv64': '768'}>
+CONFIG_RISCV_ISA_ZBB                            policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ISA_ZICBOM                         policy<{'riscv64': 'y'}>
+CONFIG_RISCV_ISA_ZICBOZ                         policy<{'riscv64': 'y'}>
+CONFIG_RISCV_MISALIGNED                         policy<{'riscv64': 'y'}>
+CONFIG_RISCV_NONSTANDARD_CACHE_OPS              policy<{'riscv64': 'y'}>
+CONFIG_RISCV_PMU                                policy<{'riscv64': 'y'}>
+CONFIG_RISCV_PMU_LEGACY                         policy<{'riscv64': 'y'}>
+CONFIG_RISCV_PMU_SBI                            policy<{'riscv64': 'y'}>
+CONFIG_RISCV_SBI                                policy<{'riscv64': 'y'}>
+CONFIG_RISCV_SBI_CPUIDLE                        policy<{'riscv64': 'y'}>
+CONFIG_RISCV_SBI_V01                            policy<{'riscv64': 'n'}>
+CONFIG_RISCV_TIMER                              policy<{'riscv64': 'y'}>
+CONFIG_RISCV_USE_LINKER_RELAXATION              policy<{'riscv64': 'y'}>
+CONFIG_RMI4_2D_SENSOR                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RMI4_CORE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_RMI4_F03                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_RMI4_F03_SERIO                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RMI4_F11                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_RMI4_F12                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_RMI4_F30                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_RMI4_F34                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_RMI4_F3A                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_RMI4_F54                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RMI4_F55                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_RMI4_I2C                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RMI4_SMB                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RMI4_SPI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RMNET                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RN5T618_ADC                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RN5T618_POWER                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RN5T618_WATCHDOG                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ROCKCHIP_ANALOGIX_DP                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_CDN_DP                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_DTPM                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ROCKCHIP_DW_HDMI                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_DW_MIPI_DSI                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_ERRATUM_3588001                 policy<{'arm64': 'y'}>
+CONFIG_ROCKCHIP_GRF                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_INNO_HDMI                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_IODOMAIN                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ROCKCHIP_IOMMU                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_LVDS                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_MBOX                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_PHY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ROCKCHIP_PM_DOMAINS                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_RGB                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_RK3066_HDMI                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_SARADC                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ROCKCHIP_THERMAL                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_ROCKCHIP_TIMER                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_VOP                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKCHIP_VOP2                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_ROCKER                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RODATA_FULL_DEFAULT_ENABLED              policy<{'arm64': 'y'}>
+CONFIG_ROHM_BM1390                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ROHM_BU27008                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ROHM_BU27034                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ROMFS_BACKED_BY_BLOCK                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ROMFS_BACKED_BY_BOTH                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ROMFS_BACKED_BY_MTD                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_ROMFS_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ROMFS_ON_BLOCK                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ROSE                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RPCSEC_GSS_KRB5                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_CAMELLIA        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RPMSG                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RPMSG_CHAR                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RPMSG_CTRL                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RPMSG_MTK_SCP                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RPMSG_NS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RPMSG_QCOM_GLINK                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RPMSG_QCOM_GLINK_RPM                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RPMSG_QCOM_GLINK_SMEM                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RPMSG_QCOM_SMD                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RPMSG_TTY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RPMSG_VIRTIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_RPMSG_WWAN_CTRL                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RPR0521                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RPS                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RSEQ                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RSI_91X                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RSI_COEX                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RSI_DEBUGFS                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RSI_SDIO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RSI_USB                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RST_RCAR                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RT2400PCI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2500PCI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2500USB                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2800PCI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2800PCI_RT3290                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800PCI_RT33XX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800PCI_RT35XX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800PCI_RT53XX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800USB                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2800USB_RT33XX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800USB_RT3573                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800USB_RT35XX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800USB_RT53XX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800USB_RT55XX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800USB_UNKNOWN                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2800_LIB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2800_LIB_MMIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2X00                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2X00_DEBUG                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RT2X00_LIB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2X00_LIB_CRYPTO                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2X00_LIB_DEBUGFS                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RT2X00_LIB_FIRMWARE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2X00_LIB_LEDS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RT2X00_LIB_MMIO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2X00_LIB_PCI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT2X00_LIB_USB                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT61PCI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT73USB                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTAS_ERROR_LOGGING                       policy<{'ppc64el': 'y'}>
+CONFIG_RTAS_FLASH                               policy<{'ppc64el': 'm'}>
+CONFIG_RTAS_PROC                                policy<{'ppc64el': 'y'}>
+CONFIG_RTC_CLASS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RTC_DRV_88PM80X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_88PM860X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_ABB5ZES3                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_ABEOZ9                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_ABX80X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_ARMADA38X                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_AS3722                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_ASPEED                           policy<{'armhf': 'm'}>
+CONFIG_RTC_DRV_BBNSM                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_BD70528                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_BQ32K                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_CADENCE                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_CPCAP                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_CROS_EC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_DA9052                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DA9055                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DA9063                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1286                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1302                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1305                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1307                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1307_CENTURY                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_DRV_DS1343                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1347                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1374                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1374_WDT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_DRV_DS1390                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1511                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1553                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1672                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1685                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_DRV_DS1685_FAMILY                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS1689                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RTC_DRV_DS17285                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RTC_DRV_DS1742                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS17485                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RTC_DRV_DS17885                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RTC_DRV_DS2404                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS3232                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_DS3232_HWMON                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_DRV_EM3027                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_FM3130                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_FSL_FTM_ALARM                    policy<{'arm64': 'm'}>
+CONFIG_RTC_DRV_FTRTC010                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_GENERIC                          policy<{'ppc64el': 'y'}>
+CONFIG_RTC_DRV_GOLDFISH                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'y'}>
+CONFIG_RTC_DRV_HID_SENSOR_TIME                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_HYM8563                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_IMXDI                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_IMX_SC                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_ISL12022                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_ISL12026                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_ISL1208                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_LP8788                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_M41T80                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_M41T80_WDT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_DRV_M41T93                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_M41T94                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_M48T35                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_M48T59                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_M48T86                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MA35D1                           policy<{'arm64': 'm'}>
+CONFIG_RTC_DRV_MAX31335                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MAX6900                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MAX6902                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MAX6916                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MAX77686                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MAX8907                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MAX8925                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MAX8997                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MAX8998                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MC13XXX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MCP795                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MESON                            policy<{'armhf': 'm'}>
+CONFIG_RTC_DRV_MESON_VRTC                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_MSC313                           policy<{'armhf': 'm'}>
+CONFIG_RTC_DRV_MSM6242                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MT2712                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_MT6397                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_MT7622                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_MV                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RTC_DRV_MXC                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_MXC_V2                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_NCT3018Y                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_NTXEC                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_OMAP                             policy<{'armhf': 'y'}>
+CONFIG_RTC_DRV_OPAL                             policy<{'ppc64el': 'y'}>
+CONFIG_RTC_DRV_OPTEE                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_PALMAS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PCAP                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PCF2123                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PCF2127                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PCF50633                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PCF85063                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PCF8523                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PCF85363                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PCF8563                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PCF8583                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PL030                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PL031                            policy<{'arm64': 'm', 'armhf': 'y', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_PM8XXX                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_POLARFIRE_SOC                    policy<{'riscv64': 'm'}>
+CONFIG_RTC_DRV_R7301                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_R9701                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RC5T583                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RC5T619                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RK808                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RP5C01                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RS5C348                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RS5C372                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RTD119X                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RTC_DRV_RV3028                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RV3029C2                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RV3029_HWMON                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_DRV_RV3032                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RV8803                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RX4581                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RX6110                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RX8010                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RX8025                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RX8581                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_RZN1                             policy<{'armhf': 'm'}>
+CONFIG_RTC_DRV_S35390A                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_S3C                              policy<{'armhf': 'n'}>
+CONFIG_RTC_DRV_S5M                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_SC27XX                           policy<{'arm64': 'm'}>
+CONFIG_RTC_DRV_SD3078                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_SH                               policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_SNVS                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_SSD202D                          policy<{'armhf': 'm'}>
+CONFIG_RTC_DRV_STK17TA8                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_STM32                            policy<{'arm64': 'm'}>
+CONFIG_RTC_DRV_SUN6I                            policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_RTC_DRV_SUNPLUS                          policy<{'armhf': 'm'}>
+CONFIG_RTC_DRV_TEGRA                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_RTC_DRV_TEST                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RTC_DRV_TI_K3                            policy<{'arm64': 'm'}>
+CONFIG_RTC_DRV_TPS6586X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_TPS65910                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_TPS6594                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_WILCO_EC                         policy<{'amd64': 'm'}>
+CONFIG_RTC_DRV_WM831X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_WM8350                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_X1205                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_DRV_XGENE                            policy<{'arm64': 'y'}>
+CONFIG_RTC_DRV_ZYNQMP                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTC_HCTOSYS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_HCTOSYS_DEVICE                       policy<{'amd64': '"rtc0"', 'arm64': '"rtc0"', 'armhf': '"rtc0"', 'ppc64el': '"rtc0"', 'riscv64': '"rtc0"'}>
+CONFIG_RTC_I2C_AND_SPI                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_INTF_DEV                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_INTF_DEV_UIE_EMUL                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RTC_INTF_PROC                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_INTF_SYSFS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_LIB                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_MC146818_LIB                         policy<{'amd64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_RTC_NVMEM                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_SYSTOHC                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTC_SYSTOHC_DEVICE                       policy<{'amd64': '"rtc0"', 'arm64': '"rtc0"', 'armhf': '"rtc0"', 'ppc64el': '"rtc0"', 'riscv64': '"rtc0"'}>
+CONFIG_RTD119X_WATCHDOG                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_RTL8180                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8187                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8187_LEDS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTL8188EE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8192CE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8192CU                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8192C_COMMON                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8192DE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8192E                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8192EE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8192SE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8723AE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8723BE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8723BS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8723_COMMON                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8821AE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8XXXU                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL8XXXU_UNTESTED                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTLBTCOEXIST                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTLLIB                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTLLIB_CRYPTO_CCMP                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTLLIB_CRYPTO_TKIP                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTLLIB_CRYPTO_WEP                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTLWIFI                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTLWIFI_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_RTLWIFI_PCI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTLWIFI_USB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTL_CARDS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTS5208                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_RTW88                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8723D                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8723DE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8723DS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8723DU                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8821C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8821CE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8821CS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8821CU                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8822B                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8822BE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8822BS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8822BU                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8822C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8822CE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8822CS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_8822CU                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_CORE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_DEBUG                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTW88_DEBUGFS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTW88_PCI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_SDIO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW88_USB                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_8851B                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_8851BE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_8852A                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_8852AE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_8852B                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_8852BE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_8852C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_8852CE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_CORE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RTW89_DEBUG                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTW89_DEBUGFS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTW89_DEBUGMSG                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_RTW89_PCI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_RT_MUTEXES                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RUNTIME_KERNEL_TESTING_MENU              policy<{'riscv64': 'n'}>
+CONFIG_RUNTIME_TESTING_MENU                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RUST                                     policy<{'amd64': 'y'}>
+CONFIG_RUSTC_VERSION_TEXT                       policy<{'amd64': '"rustc 1.75.0 (82e1608df 2023-12-21) (built from a source tarball)"'}>
+CONFIG_RUST_BUILD_ASSERT_ALLOW                  policy<{'amd64': 'n'}>
+CONFIG_RUST_DEBUG_ASSERTIONS                    policy<{'amd64': 'n'}>
+CONFIG_RUST_IS_AVAILABLE                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RUST_OVERFLOW_CHECKS                     policy<{'amd64': 'y'}>
+CONFIG_RUST_PHYLIB_ABSTRACTIONS                 policy<{'amd64': 'y'}>
+CONFIG_RV                                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RV_MON_WWNR                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RV_REACTORS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RV_REACT_PANIC                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RV_REACT_PRINTK                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RWSEM_SPIN_ON_OWNER                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RXKAD                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_RXPERF                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_RZG2L_ADC                                policy<{'arm64': 'm', 'riscv64': '-'}>
+CONFIG_RZG2L_THERMAL                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_RZN1_DMAMUX                              policy<{'armhf': 'm'}>
+CONFIG_RZ_DMAC                                  policy<{'arm64': 'm', 'riscv64': '-'}>
+CONFIG_RZ_MTU3                                  policy<{'arm64': 'y', 'riscv64': '-'}>
+CONFIG_RZ_MTU3_CNT                              policy<{'arm64': 'm'}>
+CONFIG_S2IO                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_S390                                     policy<{'s390x': 'y'}>
+CONFIG_S390_GUEST                               policy<{'s390x': 'y'}>
+CONFIG_S390_HYPFS                               policy<{'s390x': 'y'}>
+CONFIG_S390_HYPFS_FS                            policy<{'s390x': 'y'}>
+CONFIG_S390_IOMMU                               policy<{'s390x': 'y'}>
+CONFIG_S390_PRNG                                policy<{'s390x': 'm'}>
+CONFIG_S390_TAPE                                policy<{'s390x': 'm'}>
+CONFIG_S390_TAPE_34XX                           policy<{'s390x': 'm'}>
+CONFIG_S390_TAPE_3590                           policy<{'s390x': 'm'}>
+CONFIG_S390_VMUR                                policy<{'s390x': 'm'}>
+CONFIG_S3C2410_WATCHDOG                         policy<{'armhf': 'n'}>
+CONFIG_S5P_DEV_MFC                              policy<{'armhf': 'y'}>
+CONFIG_SAMPLES                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SAMPLES_RUST                             policy<{'amd64': 'n'}>
+CONFIG_SAMPLE_AUXDISPLAY                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_CONFIGFS                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_FPROBE                            policy<{'amd64': 'n', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_SAMPLE_FTRACE_DIRECT                     policy<{'amd64': 'm', 'arm64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_FTRACE_DIRECT_MULTI               policy<{'amd64': 'n', 'arm64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_FTRACE_OPS                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': '-', 's390x': 'n'}>
+CONFIG_SAMPLE_HW_BREAKPOINT                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n'}>
+CONFIG_SAMPLE_KDB                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SAMPLE_KFIFO                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_KOBJECT                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_KPROBES                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_LIVEPATCH                         policy<{'amd64': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_QMI_CLIENT                        policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_SAMPLE_RPMSG_CLIENT                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_SAMPLE_TRACE_ARRAY                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SAMPLE_TRACE_CUSTOM_EVENTS               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_TRACE_EVENTS                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_VFIO_MDEV_MBOCHS                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_VFIO_MDEV_MDPY                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_VFIO_MDEV_MDPY_FB                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_VFIO_MDEV_MTTY                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMPLE_WATCHDOG                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SAMSUNG_LAPTOP                           policy<{'amd64': 'm'}>
+CONFIG_SAMSUNG_MC                               policy<{'armhf': 'y'}>
+CONFIG_SAMSUNG_Q10                              policy<{'amd64': 'm'}>
+CONFIG_SATA_ACARD_AHCI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_AHCI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_AHCI_SEATTLE                        policy<{'arm64': 'm'}>
+CONFIG_SATA_DWC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_DWC_OLD_DMA                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SATA_HOST                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SATA_INIC162X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_MOBILE_LPM_POLICY                   policy<{'amd64': '3', 'arm64': '3', 'armhf': '3', 'ppc64el': '3', 'riscv64': '3'}>
+CONFIG_SATA_MV                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_NV                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_PMP                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SATA_PROMISE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_QSTOR                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_RCAR                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SATA_SIL                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_SIL24                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_SIS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_SVW                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_SX4                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_ULI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_VIA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_VITESSE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SATA_ZPODD                               policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_SA_GCC_8775P                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SA_GPUCC_8775P                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SBC_EPX_C3_WATCHDOG                      policy<{'amd64': 'm'}>
+CONFIG_SBC_FITPC2_WATCHDOG                      policy<{'amd64': 'm'}>
+CONFIG_SBITMAP                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SBP_TARGET                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SC1200_WDT                               policy<{'amd64': 'm'}>
+CONFIG_SC27XX_ADC                               policy<{'arm64': 'm'}>
+CONFIG_SC92031                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCA3000                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCA3300                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCD30_CORE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCD30_I2C                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCD30_SERIAL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCD4X                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCF_TORTURE_TEST                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SCHEDSTATS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCHED_AUTOGROUP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCHED_CLUSTER                            policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_SCHED_CORE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_SCHED_DEBUG                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCHED_HRTICK                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCHED_INFO                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCHED_MC                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCHED_MC_PRIO                            policy<{'amd64': 'y'}>
+CONFIG_SCHED_MM_CID                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCHED_OMIT_FRAME_POINTER                 policy<{'amd64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_SCHED_SMT                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_SCHED_STACK_END_CHECK                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCHED_THERMAL_PRESSURE                   policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SCHED_TOPOLOGY                           policy<{'s390x': 'y'}>
+CONFIG_SCHED_TRACER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCLP_CONSOLE                             policy<{'s390x': 'y'}>
+CONFIG_SCLP_TTY                                 policy<{'s390x': 'y'}>
+CONFIG_SCLP_VT220_CONSOLE                       policy<{'s390x': 'y'}>
+CONFIG_SCLP_VT220_TTY                           policy<{'s390x': 'y'}>
+CONFIG_SCM_BLOCK                                policy<{'s390x': 'm'}>
+CONFIG_SCM_BUS                                  policy<{'s390x': 'y'}>
+CONFIG_SCOM_DEBUGFS                             policy<{'ppc64el': 'y'}>
+CONFIG_SCREEN_INFO                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_SCSI                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_3W_9XXX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_3W_SAS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_AACRAID                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_ACARD                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_ADVANSYS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_AHA1740                             policy<{'amd64': 'm'}>
+CONFIG_SCSI_AIC79XX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_AIC7XXX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_AIC94XX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_AM53C974                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_ARCMSR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_BFA_FC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_BNX2X_FCOE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_BNX2_ISCSI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_BUSLOGIC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_CHELSIO_FCOE                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_COMMON                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_CONSTANTS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_CXGB3_ISCSI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_CXGB4_ISCSI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_DC395x                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_DEBUG                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_DH                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_DH_ALUA                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_DH_EMC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_DH_HP_SW                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_DH_RDAC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_DMA                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_DMX3191D                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_EFCT                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_ENCLOSURE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_ESAS2R                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_FC_ATTRS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_FDOMAIN                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_FDOMAIN_PCI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_FLASHPOINT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SCSI_HISI_SAS                            policy<{'arm64': 'm'}>
+CONFIG_SCSI_HISI_SAS_DEBUGFS_DEFAULT_ENABLE     policy<{'arm64': 'n'}>
+CONFIG_SCSI_HISI_SAS_PCI                        policy<{'arm64': 'm'}>
+CONFIG_SCSI_HPSA                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_HPTIOP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_IBMVFC                              policy<{'ppc64el': 'm'}>
+CONFIG_SCSI_IBMVFC_TRACE                        policy<{'ppc64el': 'y'}>
+CONFIG_SCSI_IBMVSCSI                            policy<{'ppc64el': 'm'}>
+CONFIG_SCSI_IBMVSCSIS                           policy<{'ppc64el': 'm'}>
+CONFIG_SCSI_IMM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_INIA100                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_INITIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_IPR                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_IPS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_ISCI                                policy<{'amd64': 'm'}>
+CONFIG_SCSI_ISCSI_ATTRS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_IZIP_SLOW_CTR                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SCSI_LOGGING                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_LOWLEVEL                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_LOWLEVEL_PCMCIA                     policy<{'amd64': 'y'}>
+CONFIG_SCSI_LPFC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_LPFC_DEBUG_FS                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SCSI_MOD                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_MPI3MR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_MPT2SAS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_MPT2SAS_MAX_SGE                     policy<{'amd64': '128', 'arm64': '128', 'armhf': '128', 'ppc64el': '128', 'riscv64': '128', 's390x': '128'}>
+CONFIG_SCSI_MPT3SAS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_MPT3SAS_MAX_SGE                     policy<{'amd64': '128', 'arm64': '128', 'armhf': '128', 'ppc64el': '128', 'riscv64': '128', 's390x': '128'}>
+CONFIG_SCSI_MVSAS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_MVSAS_DEBUG                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_SCSI_MVSAS_TASKLET                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_SCSI_MVUMI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_MYRB                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_MYRS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_NETLINK                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_NSP32                               policy<{'armhf': 'm'}>
+CONFIG_SCSI_PM8001                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_PMCRAID                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_PPA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_PROC_FS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_QLA_FC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SCSI_QLA_ISCSI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_QLOGIC_1280                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_SAS_ATA                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SCSI_SAS_ATTRS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_SAS_HOST_SMP                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_SAS_LIBSAS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_SCAN_ASYNC                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCSI_SIM710                              policy<{'amd64': 'm'}>
+CONFIG_SCSI_SMARTPQI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_SNIC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_SNIC_DEBUG_FS                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_SCSI_SPI_ATTRS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_SRP_ATTRS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'y', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SCSI_STEX                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_SYM53C8XX_2                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS              policy<{'amd64': '16', 'arm64': '16', 'armhf': '16', 'ppc64el': '16', 'riscv64': '16'}>
+CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE       policy<{'amd64': '1', 'arm64': '1', 'armhf': '1', 'ppc64el': '1', 'riscv64': '1'}>
+CONFIG_SCSI_SYM53C8XX_MAX_TAGS                  policy<{'amd64': '64', 'arm64': '64', 'armhf': '64', 'ppc64el': '64', 'riscv64': '64'}>
+CONFIG_SCSI_SYM53C8XX_MMIO                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SCSI_UFSHCD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCSI_UFSHCD_PCI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_UFSHCD_PLATFORM                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_UFS_BSG                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SCSI_UFS_CDNS_PLATFORM                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_UFS_CRYPTO                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SCSI_UFS_DWC_TC_PCI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_UFS_DWC_TC_PLATFORM                 policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_UFS_EXYNOS                          policy<{'armhf': 'n'}>
+CONFIG_SCSI_UFS_HISI                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SCSI_UFS_HWMON                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SCSI_UFS_MEDIATEK                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SCSI_UFS_QCOM                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SCSI_UFS_RENESAS                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SCSI_UFS_SPRD                            policy<{'arm64': 'm'}>
+CONFIG_SCSI_UFS_TI_J721E                        policy<{'arm64': 'm'}>
+CONFIG_SCSI_WD719X                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SCTP_COOKIE_HMAC_MD5                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCTP_COOKIE_HMAC_SHA1                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SCTP_DBG_OBJCNT                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SC_CAMCC_7180                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_CAMCC_7280                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_CAMCC_8280XP                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_DISPCC_7180                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_DISPCC_7280                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_DISPCC_8280XP                         policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_GCC_7180                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_GCC_7280                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_GCC_8180X                             policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_GCC_8280XP                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_GPUCC_7180                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_GPUCC_7280                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_GPUCC_8280XP                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_LPASSCC_7280                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_LPASSCC_8280XP                        policy<{'arm64': 'm'}>
+CONFIG_SC_LPASS_CORECC_7180                     policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_LPASS_CORECC_7280                     policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_MSS_7180                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_VIDEOCC_7180                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SC_VIDEOCC_7280                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDIO_UART                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SDMA_VERBOSITY                           policy<{'amd64': 'n'}>
+CONFIG_SDM_CAMCC_845                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDM_DISPCC_845                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDM_GCC_660                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDM_GCC_845                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDM_GPUCC_660                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDM_GPUCC_845                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDM_LPASSCC_845                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDM_MMCC_660                             policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDM_VIDEOCC_845                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SDR_MAX2175                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SDR_PLATFORM_DRIVERS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SDX_GCC_55                               policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_SDX_GCC_65                               policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_SDX_GCC_75                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SD_ADC_MODULATOR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SECCOMP                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECCOMP_CACHE_DEBUG                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SECCOMP_FILTER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECONDARY_TRUSTED_KEYRING                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECONDARY_TRUSTED_KEYRING_SIGNED_BY_BUILTIN policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SECRETMEM                                policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECTION_MISMATCH_WARN_ONLY               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITYFS                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_APPARMOR                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_APPARMOR_DEBUG                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SECURITY_APPARMOR_EXPORT_BINARY          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_APPARMOR_HASH                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_APPARMOR_HASH_DEFAULT           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_APPARMOR_INTROSPECT_POLICY      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_APPARMOR_PARANOID_LOAD          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_DMESG_RESTRICT                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_INFINIBAND                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_LANDLOCK                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_LOADPIN                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SECURITY_LOCKDOWN_LSM                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_LOCKDOWN_LSM_EARLY              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_NETWORK                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_NETWORK_XFRM                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_PATH                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_PERF_EVENTS_RESTRICT            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_SELINUX                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_SELINUX_AVC_STATS               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_SELINUX_BOOTPARAM               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SECURITY_SELINUX_DEBUG                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SECURITY_SELINUX_DEVELOP                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE      policy<{'amd64': '256', 'arm64': '256', 'armhf': '256', 'ppc64el': '256', 'riscv64': '256', 's390x': '256'}>
+CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS        policy<{'amd64': '9', 'arm64': '9', 'armhf': '9', 'ppc64el': '9', 'riscv64': '9', 's390x': '9'}>
+CONFIG_SECURITY_SMACK                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_SMACK_APPEND_SIGNALS            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_SMACK_BRINGUP                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SECURITY_SMACK_NETFILTER                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_TOMOYO                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER       policy<{'amd64': '"/sbin/init"', 'arm64': '"/sbin/init"', 'armhf': '"/sbin/init"', 'ppc64el': '"/sbin/init"', 'riscv64': '"/sbin/init"', 's390x': '"/sbin/init"'}>
+CONFIG_SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SECURITY_TOMOYO_MAX_ACCEPT_ENTRY         policy<{'amd64': '2048', 'arm64': '2048', 'armhf': '2048', 'ppc64el': '2048', 'riscv64': '2048', 's390x': '2048'}>
+CONFIG_SECURITY_TOMOYO_MAX_AUDIT_LOG            policy<{'amd64': '1024', 'arm64': '1024', 'armhf': '1024', 'ppc64el': '1024', 'riscv64': '1024', 's390x': '1024'}>
+CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SECURITY_TOMOYO_POLICY_LOADER            policy<{'amd64': '"/sbin/tomoyo-init"', 'arm64': '"/sbin/tomoyo-init"', 'armhf': '"/sbin/tomoyo-init"', 'ppc64el': '"/sbin/tomoyo-init"', 'riscv64': '"/sbin/tomoyo-init"', 's390x': '"/sbin/tomoyo-init"'}>
+CONFIG_SECURITY_YAMA                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SEL3350_PLATFORM                         policy<{'amd64': 'm'}>
+CONFIG_SELECT_MEMORY_MODEL                      policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSEAIR_SUNRISE_CO2                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSIRION_SGP30                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSIRION_SGP40                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_AAEON                            policy<{'amd64': 'm'}>
+CONFIG_SENSORS_ABITUGURU                        policy<{'amd64': 'm'}>
+CONFIG_SENSORS_ABITUGURU3                       policy<{'amd64': 'm'}>
+CONFIG_SENSORS_ACBEL_FSG032                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_ACPI_POWER                       policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_AD7314                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_AD7414                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_AD7418                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADC128D818                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADCXX                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADM1025                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADM1026                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADM1029                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADM1031                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADM1177                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADM1266                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_ADM1275                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_ADM9240                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADS7828                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADS7871                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADT7310                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADT7410                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADT7411                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADT7462                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADT7470                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADT7475                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ADT7X10                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_AHT10                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_AMC6821                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_APDS990X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SENSORS_APPLESMC                         policy<{'amd64': 'm'}>
+CONFIG_SENSORS_AQUACOMPUTER_D5NEXT              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_ARM_SCMI                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SENSORS_ARM_SCPI                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SENSORS_AS370                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ASB100                           policy<{'amd64': 'm'}>
+CONFIG_SENSORS_ASC7621                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_ASPEED                           policy<{'armhf': 'm'}>
+CONFIG_SENSORS_ASUS_EC                          policy<{'amd64': 'm'}>
+CONFIG_SENSORS_ASUS_WMI                         policy<{'amd64': 'm'}>
+CONFIG_SENSORS_ATK0110                          policy<{'amd64': 'm'}>
+CONFIG_SENSORS_ATXP1                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_AXI_FAN_CONTROL                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_BEL_PFE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_BH1770                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SENSORS_BPA_RS600                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_CORETEMP                         policy<{'amd64': 'm'}>
+CONFIG_SENSORS_CORSAIR_CPRO                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_CORSAIR_PSU                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_DA9052_ADC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_DA9055                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_DELL_SMM                         policy<{'amd64': 'm'}>
+CONFIG_SENSORS_DELTA_AHE50DC_FAN                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_DME1737                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_DPS920AB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_DRIVETEMP                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_DS1621                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_DS620                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_EMC1403                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_EMC2103                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_EMC2305                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_EMC6W201                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_F71805F                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_F71882FG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_F75375S                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_FAM15H_POWER                     policy<{'amd64': 'm'}>
+CONFIG_SENSORS_FSCHMD                           policy<{'amd64': 'm'}>
+CONFIG_SENSORS_FSP_3Y                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_FTSTEUTATES                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_G760A                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_G762                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_GIGABYTE_WATERFORCE              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_GL518SM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_GL520SM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_GPIO_FAN                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_GSC                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_GXP_FAN_CTRL                     policy<{'armhf': 'm'}>
+CONFIG_SENSORS_HDAPS                            policy<{'amd64': 'm'}>
+CONFIG_SENSORS_HIH6130                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_HMC5843                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_HMC5843_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_HMC5843_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_HP_WMI                           policy<{'amd64': 'm'}>
+CONFIG_SENSORS_HS3001                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_I5500                            policy<{'amd64': 'm'}>
+CONFIG_SENSORS_I5K_AMB                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_IBMAEM                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_IBMPEX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_IBMPOWERNV                       policy<{'ppc64el': 'm'}>
+CONFIG_SENSORS_IBM_CFFPS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_IIO_HWMON                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_INA209                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_INA238                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_INA2XX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_INA3221                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_INSPUR_IPSPS                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_INTEL_M10_BMC_HWMON              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_IR35221                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_IR36021                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_IR38064                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_IR38064_REGULATOR                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSORS_IRPS5401                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_ISL29018                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_ISL29028                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_ISL68137                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_IT87                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_JC42                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_K10TEMP                          policy<{'amd64': 'm'}>
+CONFIG_SENSORS_K8TEMP                           policy<{'amd64': 'm'}>
+CONFIG_SENSORS_LINEAGE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LIS3LV02D                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_LIS3_I2C                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SENSORS_LIS3_SPI                         policy<{'armhf': 'm', 'ppc64el': 'm', 'riscv64': '-', 's390x': '-'}>
+CONFIG_SENSORS_LM25066                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_LM25066_REGULATOR                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSORS_LM3533                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_LM63                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM70                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM73                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM75                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM77                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM78                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM80                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM83                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM85                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM87                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM90                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM92                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM93                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM95234                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM95241                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LM95245                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LOCHNAGAR                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_LT7182S                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_LTC2945                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC2947                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_LTC2947_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC2947_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC2978                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_LTC2978_REGULATOR                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSORS_LTC2990                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC2991                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_LTC2992                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC3815                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_LTC4151                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC4215                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC4222                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC4245                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC4260                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC4261                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_LTC4286                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSORS_MAX1111                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX127                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX15301                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MAX16064                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MAX16065                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX1619                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX16601                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MAX1668                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX197                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX20730                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MAX20751                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MAX31722                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX31730                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX31760                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MAX31785                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MAX31790                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX34440                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MAX6620                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MAX6621                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX6639                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX6650                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX6697                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MAX8688                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MC13783_ADC                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MC34VR500                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MCP3021                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_MENF21BMC_HWMON                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MLXREG_FAN                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SENSORS_MP2856                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MP2888                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MP2975                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MP2975_REGULATOR                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSORS_MP5023                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MP5990                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MPQ7932                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_MPQ7932_REGULATOR                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSORS_MR75203                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_NCT6683                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_NCT6775                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_NCT6775_CORE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_NCT6775_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_NCT7802                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_NCT7904                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_NPCM7XX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_NTC_THERMISTOR                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_NZXT_KRAKEN2                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_NZXT_SMART2                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_OCC                              policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_SENSORS_OCC_P8_I2C                       policy<{'amd64': 'm', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'm', 'riscv64': 'n'}>
+CONFIG_SENSORS_OCC_P9_SBE                       policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'm', 'riscv64': 'n'}>
+CONFIG_SENSORS_OXP                              policy<{'amd64': 'm'}>
+CONFIG_SENSORS_PC87360                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_PC87427                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_PCF8591                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_PECI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_PECI_CPUTEMP                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_PECI_DIMMTEMP                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_PIM4328                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_PLI1209BC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_PLI1209BC_REGULATOR              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSORS_PM6764TR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_PMBUS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_POWERZ                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_POWR1220                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_PWM_FAN                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_PXE1610                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_Q54SJ108A2                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_RM3100                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_RM3100_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_RM3100_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_SBRMI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SBTSI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SCH5627                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SCH5636                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SCH56XX_COMMON                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_SFCTEMP                          policy<{'riscv64': 'm'}>
+CONFIG_SENSORS_SHT15                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SHT21                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SHT3x                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SHT4x                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SHTC1                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SIS5595                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SL28CPLD                         policy<{'arm64': 'm'}>
+CONFIG_SENSORS_SMPRO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_SMSC47B397                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SMSC47M1                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SMSC47M192                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SPARX5                           policy<{'arm64': 'm'}>
+CONFIG_SENSORS_STPDDC60                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_STTS751                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_SY7636A                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_TC654                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TC74                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TDA38640                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_TDA38640_REGULATOR               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSORS_THMC50                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TMP102                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TMP103                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TMP108                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TMP401                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TMP421                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TMP464                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_TMP513                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TPS23861                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_TPS40422                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_TPS53679                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_TPS546D24                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_TSL2550                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SENSORS_TSL2563                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_UCD9000                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_UCD9200                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_VEXPRESS                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SENSORS_VIA686A                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_VIA_CPUTEMP                      policy<{'amd64': 'm'}>
+CONFIG_SENSORS_VT1211                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_VT8231                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83627EHF                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83627HF                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83773G                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83781D                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83791D                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83792D                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83793                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83795                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83795_FANCTRL                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_SENSORS_W83L785TS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_W83L786NG                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_WM831X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_WM8350                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SENSORS_XDPE122                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_XDPE122_REGULATOR                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SENSORS_XDPE152                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_XGENE                            policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SENSORS_ZL6100                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_8250                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_16550A_VARIANTS              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_ASPEED_VUART                 policy<{'armhf': 'm'}>
+CONFIG_SERIAL_8250_CONSOLE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_CS                           policy<{'amd64': 'm'}>
+CONFIG_SERIAL_8250_DEPRECATED_OPTIONS           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SERIAL_8250_DETECT_IRQ                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SERIAL_8250_DFL                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'm'}>
+CONFIG_SERIAL_8250_DMA                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_DWLIB                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_EM                           policy<{'arm64': 'n', 'armhf': 'n', 'riscv64': 'n'}>
+CONFIG_SERIAL_8250_EXAR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_8250_EXTENDED                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_FINTEK                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_FSL                          policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_SERIAL_8250_LPSS                         policy<{'amd64': 'm'}>
+CONFIG_SERIAL_8250_MANY_PORTS                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_MEN_MCB                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_8250_MT6577                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_8250_NR_UARTS                     policy<{'amd64': '48', 'arm64': '48', 'armhf': '48', 'ppc64el': '48', 'riscv64': '48'}>
+CONFIG_SERIAL_8250_OMAP                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_8250_OMAP_TTYO_FIXUP              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_8250_PCI                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_PCI1XXXX                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'n', 'riscv64': 'm'}>
+CONFIG_SERIAL_8250_PCILIB                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_PERICOM                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_8250_PNP                          policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_RSA                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_RT288X                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_RUNTIME_UARTS                policy<{'amd64': '32', 'arm64': '32', 'armhf': '32', 'ppc64el': '32', 'riscv64': '32'}>
+CONFIG_SERIAL_8250_SHARE_IRQ                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_8250_TEGRA                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_ALTERA_JTAGUART                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SERIAL_ALTERA_UART                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SERIAL_ALTERA_UART_BAUDRATE              policy<{'amd64': '115200', 'arm64': '115200', 'armhf': '115200', 'ppc64el': '115200', 'riscv64': '115200'}>
+CONFIG_SERIAL_ALTERA_UART_MAXPORTS              policy<{'amd64': '4', 'arm64': '4', 'armhf': '4', 'ppc64el': '4', 'riscv64': '4'}>
+CONFIG_SERIAL_AMBA_PL010                        policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_AMBA_PL011                        policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'm'}>
+CONFIG_SERIAL_AMBA_PL011_CONSOLE                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_ARC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SERIAL_ARC_NR_PORTS                      policy<{'amd64': '1', 'arm64': '1', 'armhf': '1', 'ppc64el': '1', 'riscv64': '1'}>
+CONFIG_SERIAL_CONEXANT_DIGICOLOR                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_CORE                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'm'}>
+CONFIG_SERIAL_CORE_CONSOLE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_EARLYCON                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_EARLYCON_RISCV_SBI                policy<{'riscv64': 'y'}>
+CONFIG_SERIAL_EARLYCON_SEMIHOST                 policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_FSL_LINFLEXUART                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SERIAL_FSL_LPUART                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SERIAL_ICOM                              policy<{'ppc64el': 'm'}>
+CONFIG_SERIAL_IMX                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_IMX_CONSOLE                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_IMX_EARLYCON                      policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_SERIAL_IPOCTAL                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_JSM                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SERIAL_KGDB_NMI                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_LANTIQ                            policy<{'amd64': 'm'}>
+CONFIG_SERIAL_LITEUART                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_LITEUART_MAX_PORTS                policy<{'arm64': '1', 'armhf': '1', 'ppc64el': '1', 'riscv64': '1'}>
+CONFIG_SERIAL_MAX3100                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SERIAL_MAX310X                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_MCTRL_GPIO                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_MEN_Z135                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_MESON                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_MESON_CONSOLE                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_MILBEAUT_USIO                     policy<{'armhf': 'm'}>
+CONFIG_SERIAL_MILBEAUT_USIO_PORTS               policy<{'armhf': '4'}>
+CONFIG_SERIAL_MSM                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_MSM_CONSOLE                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_MULTI_INSTANTIATE                 policy<{'amd64': 'm', 'arm64': 'n', 'riscv64': 'n'}>
+CONFIG_SERIAL_MVEBU_CONSOLE                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_MVEBU_UART                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_NONSTANDARD                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SERIAL_NUVOTON_MA35D1                    policy<{'arm64': 'm'}>
+CONFIG_SERIAL_OF_PLATFORM                       policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_OWL                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_OWL_CONSOLE                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_QCOM_GENI                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SERIAL_QCOM_GENI_CONSOLE                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_QE                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
+CONFIG_SERIAL_RDA                               policy<{'armhf': 'y'}>
+CONFIG_SERIAL_RDA_CONSOLE                       policy<{'armhf': 'y'}>
+CONFIG_SERIAL_RP2                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SERIAL_RP2_NR_UARTS                      policy<{'amd64': '32', 'arm64': '32', 'armhf': '32', 'ppc64el': '32', 'riscv64': '32'}>
+CONFIG_SERIAL_SAMSUNG                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SERIAL_SAMSUNG_CONSOLE                   policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_SAMSUNG_UARTS                     policy<{'arm64': '4', 'armhf': '4'}>
+CONFIG_SERIAL_SC16IS7XX                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SERIAL_SC16IS7XX_CORE                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIAL_SC16IS7XX_I2C                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_SC16IS7XX_SPI                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_SCCNXP                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SERIAL_SCCNXP_CONSOLE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_SH_SCI_DMA                        policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_SERIAL_SH_SCI_NR_UARTS                   policy<{'arm64': '2', 'armhf': '2', 'riscv64': '2'}>
+CONFIG_SERIAL_SIFIVE                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'y'}>
+CONFIG_SERIAL_SIFIVE_CONSOLE                    policy<{'riscv64': 'y'}>
+CONFIG_SERIAL_SPRD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SERIAL_STM32                             policy<{'arm64': 'm'}>
+CONFIG_SERIAL_ST_ASC                            policy<{'armhf': 'm'}>
+CONFIG_SERIAL_SUNPLUS                           policy<{'armhf': 'y'}>
+CONFIG_SERIAL_SUNPLUS_CONSOLE                   policy<{'armhf': 'y'}>
+CONFIG_SERIAL_TEGRA                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SERIAL_TEGRA_TCU                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_TEGRA_TCU_CONSOLE                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SERIAL_UARTLITE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SERIAL_UARTLITE_NR_UARTS                 policy<{'amd64': '1', 'arm64': '1', 'armhf': '1', 'ppc64el': '1', 'riscv64': '1', 's390x': '1'}>
+CONFIG_SERIAL_XILINX_PS_UART                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIO                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SERIO_ALTERA_PS2                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SERIO_AMBAKMI                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SERIO_APBPS2                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIO_ARC_PS2                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SERIO_CT82C710                           policy<{'amd64': 'm'}>
+CONFIG_SERIO_GPIO_PS2                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SERIO_I8042                              policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_SERIO_LIBPS2                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SERIO_NVEC_PS2                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SERIO_PARKBD                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SERIO_PCIPS2                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SERIO_PS2MULT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SERIO_RAW                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SERIO_SERPORT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SERIO_SUN4I_PS2                          policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_SERIO_XILINX_XPS_PS2                     policy<{'ppc64el': 'm'}>
+CONFIG_SEV_GUEST                                policy<{'amd64': 'm'}>
+CONFIG_SFC                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SFC_FALCON                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SFC_FALCON_MTD                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SFC_MCDI_LOGGING                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SFC_MCDI_MON                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SFC_MTD                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SFC_SIENA                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SFC_SIENA_MCDI_LOGGING                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SFC_SIENA_MCDI_MON                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SFC_SIENA_MTD                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SFC_SIENA_SRIOV                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SFC_SRIOV                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SFP                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SF_PDMA                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SGETMASK_SYSCALL                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SGI_GRU                                  policy<{'amd64': 'm'}>
+CONFIG_SGI_GRU_DEBUG                            policy<{'amd64': 'n'}>
+CONFIG_SGI_PARTITION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SGI_XP                                   policy<{'amd64': 'm'}>
+CONFIG_SGL_ALLOC                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SG_POOL                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SG_SPLIT                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SHADOW_CALL_STACK                        policy<{'arm64': 'y'}>
+CONFIG_SHMEM                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SHRINKER_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SHUFFLE_PAGE_ALLOCATOR                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SH_ETH                                   policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SH_TIMER_CMT                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SH_TIMER_MTU2                            policy<{'armhf': 'y'}>
+CONFIG_SH_TIMER_TMU                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SI1133                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SI1145                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SI7005                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SI7020                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SIEMENS_SIMATIC_IPC                      policy<{'amd64': 'm'}>
+CONFIG_SIEMENS_SIMATIC_IPC_BATT                 policy<{'amd64': 'm'}>
+CONFIG_SIEMENS_SIMATIC_IPC_BATT_APOLLOLAKE      policy<{'amd64': 'm'}>
+CONFIG_SIEMENS_SIMATIC_IPC_BATT_ELKHARTLAKE     policy<{'amd64': 'm'}>
+CONFIG_SIEMENS_SIMATIC_IPC_BATT_F7188X          policy<{'amd64': 'm'}>
+CONFIG_SIEMENS_SIMATIC_IPC_WDT                  policy<{'amd64': 'm'}>
+CONFIG_SIFIVE_CCACHE                            policy<{'riscv64': 'y'}>
+CONFIG_SIFIVE_PLIC                              policy<{'riscv64': 'y'}>
+CONFIG_SIGNALFD                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SIGNATURE                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SIGNED_PE_FILE_VERIFICATION              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SILICOM_PLATFORM                         policy<{'amd64': 'm'}>
+CONFIG_SIOX                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SIOX_BUS_GPIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SIS190                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SIS900                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SKB_EXTENSIONS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SKFP                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SKGE                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SKGE_DEBUG                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_SKGE_GENESIS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SKY2                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SKY2_DEBUG                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_SL28CPLD_WATCHDOG                        policy<{'arm64': 'm'}>
+CONFIG_SLAB_FREELIST_HARDENED                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SLAB_FREELIST_RANDOM                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SLAB_MERGE_DEFAULT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SLHC                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SLICOSS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SLIC_DS26522                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SLIMBUS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SLIM_QCOM_CTRL                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SLIM_QCOM_NGD_CTRL                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SLIP                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SLIP_COMPRESSED                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SLIP_MODE_SLIP6                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SLIP_SMART                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SLS                                      policy<{'amd64': 'y'}>
+CONFIG_SLUB                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SLUB_CPU_PARTIAL                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SLUB_DEBUG                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SLUB_DEBUG_ON                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SLUB_STATS                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SLUB_TINY                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SMARTJOYPLUS_FF                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SMBFS                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SMB_SERVER                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SMB_SERVER_KERBEROS5                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SMB_SERVER_SMBDIRECT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SMC91X                                   policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SMP                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SMPRO_ERRMON                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SMPRO_MISC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SMP_ON_UP                                policy<{'armhf': 'y'}>
+CONFIG_SMSC37B787_WDT                           policy<{'amd64': 'm'}>
+CONFIG_SMSC911X                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SMSC9420                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SMSC_PHY                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SMSC_SCH311X_WDT                         policy<{'amd64': 'm'}>
+CONFIG_SMSGIUCV                                 policy<{'s390x': 'y'}>
+CONFIG_SMSGIUCV_EVENT                           policy<{'s390x': 'm'}>
+CONFIG_SMS_SDIO_DRV                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SMS_SIANO_DEBUGFS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SMS_SIANO_MDTV                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SMS_SIANO_RC                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SMS_USB_DRV                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SMT_NUM_THREADS_DYNAMIC                  policy<{'ppc64el': 'y'}>
+CONFIG_SM_CAMCC_6350                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_CAMCC_8250                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_CAMCC_8450                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_CAMCC_8550                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_DISPCC_6115                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_DISPCC_6125                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_DISPCC_6350                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_DISPCC_6375                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_DISPCC_8250                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_DISPCC_8450                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_DISPCC_8550                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_DISPCC_8650                           policy<{'arm64': 'm'}>
+CONFIG_SM_FTL                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SM_GCC_4450                              policy<{'arm64': 'm'}>
+CONFIG_SM_GCC_6115                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GCC_6125                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GCC_6350                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GCC_6375                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GCC_7150                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SM_GCC_8150                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GCC_8250                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GCC_8350                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GCC_8450                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GCC_8550                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GCC_8650                              policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GPUCC_6115                            policy<{'arm64': 'm'}>
+CONFIG_SM_GPUCC_6125                            policy<{'arm64': 'm'}>
+CONFIG_SM_GPUCC_6350                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GPUCC_6375                            policy<{'arm64': 'm'}>
+CONFIG_SM_GPUCC_8150                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GPUCC_8250                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GPUCC_8350                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GPUCC_8450                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GPUCC_8550                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_GPUCC_8650                            policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_TCSRCC_8550                           policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_TCSRCC_8650                           policy<{'arm64': 'm'}>
+CONFIG_SM_VIDEOCC_8150                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_VIDEOCC_8250                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_VIDEOCC_8350                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_VIDEOCC_8450                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SM_VIDEOCC_8550                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SND_AC97_CODEC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AC97_POWER_SAVE                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_AC97_POWER_SAVE_DEFAULT              policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_SND_AD1889                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_ALI5451                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_ALOOP                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_ALS300                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_ALS4000                              policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_SND_AMD_ACP_CONFIG                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AMD_ASOC_ACP63                       policy<{'amd64': 'm'}>
+CONFIG_SND_AMD_ASOC_ACP70                       policy<{'amd64': 'm'}>
+CONFIG_SND_AMD_ASOC_REMBRANDT                   policy<{'amd64': 'm'}>
+CONFIG_SND_AMD_ASOC_RENOIR                      policy<{'amd64': 'm'}>
+CONFIG_SND_ARM                                  policy<{'armhf': 'y'}>
+CONFIG_SND_ARMAACI                              policy<{'armhf': 'm'}>
+CONFIG_SND_ASIHPI                               policy<{'amd64': 'm'}>
+CONFIG_SND_ATIIXP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_ATIIXP_MODEM                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_ATMEL_SOC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AU8810                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AU8820                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AU8830                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AUDIO_GRAPH_CARD                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AUDIO_GRAPH_CARD2                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AUDIO_GRAPH_CARD2_CUSTOM_SAMPLE      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AW2                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_AZT3328                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_BCD2000                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_BCM63XX_I2S_WHISTLER                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_BEBOB                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_BT87X                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_BT87X_OVERCLOCK                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SND_CA0106                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_CMIPCI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_COMPRESS_OFFLOAD                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_CS4281                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_CS46XX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_CS46XX_NEW_DSP                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_CTL_FAST_LOOKUP                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SND_CTL_INPUT_VALIDATION                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SND_CTL_LED                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_CTXFI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_DARLA20                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_DARLA24                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SND_DESIGNWARE_I2S                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_DESIGNWARE_PCM                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_DICE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_DMAENGINE_PCM                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_DMA_SGBUF                            policy<{'amd64': 'y'}>
+CONFIG_SND_DRIVERS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_DUMMY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_DYNAMIC_MINORS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_ECHO3G                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_EMU10K1                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_EMU10K1X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_EMU10K1_SEQ                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_ENS1370                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_ENS1371                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_ES1938                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_ES1968                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_ES1968_INPUT                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SND_ES1968_RADIO                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SND_FIREFACE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_FIREWIRE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_FIREWIRE_DIGI00X                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_FIREWIRE_LIB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_FIREWIRE_MOTU                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_FIREWIRE_TASCAM                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_FIREWORKS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_FM801                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_FM801_TEA575X_BOOL                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_GINA20                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_GINA24                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_ALIGNED_MMIO                     policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SND_HDA_CIRRUS_SCODEC                    policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_ANALOG                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_CA0110                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_CA0132                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_CA0132_DSP                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_HDA_CODEC_CIRRUS                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_CMEDIA                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_CONEXANT                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_CS8409                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_HDMI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_REALTEK                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_SI3054                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_SIGMATEL                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CODEC_VIA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_COMPONENT                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_HDA_CORE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CS_DSP_CONTROLS                  policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_CTL_DEV_ID                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SND_HDA_DSP_LOADER                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_HDA_EXT_CORE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_GENERIC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_GENERIC_LEDS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_HDA_HWDEP                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_HDA_I915                             policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_HDA_INPUT_BEEP                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_HDA_INPUT_BEEP_MODE                  policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_SND_HDA_INTEL                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM         policy<{'amd64': 'y', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SND_HDA_PATCH_LOADER                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_HDA_PREALLOC_SIZE                    policy<{'amd64': '0', 'arm64': '64', 'armhf': '64', 'ppc64el': '64', 'riscv64': '64'}>
+CONFIG_SND_HDA_SCODEC_CS35L41                   policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_SCODEC_CS35L41_I2C               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_SCODEC_CS35L41_SPI               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_SCODEC_CS35L56                   policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_SCODEC_CS35L56_I2C               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_SCODEC_CS35L56_SPI               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_SCODEC_TAS2781_I2C               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDA_TEGRA                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_HDSP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HDSPM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HRTIMER                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_HWDEP                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_I2S_HI6210_I2S                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_ICE1712                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_ICE1724                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_IMX_SOC                              policy<{'arm64': 'm', 'armhf': 'y'}>
+CONFIG_SND_INDIGO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_INDIGODJ                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_INDIGODJX                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_INDIGOIO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_INDIGOIOX                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_INTEL8X0                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_INTEL8X0M                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_INTEL_BYT_PREFER_SOF                 policy<{'amd64': 'y'}>
+CONFIG_SND_INTEL_DSP_CONFIG                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_INTEL_NHLT                           policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_SND_INTEL_SOUNDWIRE_ACPI                 policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_ISIGHT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_JACK                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_JACK_INPUT_DEV                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_KIRKWOOD_SOC                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_KIRKWOOD_SOC_ARMADA370_DB            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_KORG1212                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_LAYLA20                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_LAYLA24                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_LOLA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_LX6464ES                             policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_MAESTRO3                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MAESTRO3_INPUT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SND_MAX_CARDS                            policy<{'amd64': '32', 'arm64': '32', 'armhf': '32', 'ppc64el': '32', 'riscv64': '32'}>
+CONFIG_SND_MESON_AIU                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_FIFO                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_FRDDR                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_PDM                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_SOUND_CARD                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_SPDIFIN                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_SPDIFOUT                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_TDMIN                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_TDMOUT                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_TDM_FORMATTER              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_TDM_INTERFACE              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_AXG_TODDR                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_CARD_UTILS                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_CODEC_GLUE                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_G12A_TOACODEC                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_G12A_TOHDMITX                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MESON_GX_SOUND_CARD                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_MIA                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_MIXART                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_MIXER_OSS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_MONA                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_MPU401                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_MPU401_UART                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_MTPAV                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_MTS64                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_NM256                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_OPL3_LIB                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_OPL3_LIB_SEQ                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_OSSEMUL                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_OXFW                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_OXYGEN                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_OXYGEN_LIB                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_PCI                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_PCM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_PCMCIA                               policy<{'amd64': 'y'}>
+CONFIG_SND_PCMTEST                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_PCM_ELD                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_PCM_IEC958                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_PCM_TIMER                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_PCSP                                 policy<{'amd64': 'm'}>
+CONFIG_SND_PCXHR                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_PDAUDIOCF                            policy<{'amd64': 'm'}>
+CONFIG_SND_PORTMAN2X4                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_PPC                                  policy<{'ppc64el': 'y'}>
+CONFIG_SND_PROC_FS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_RAWMIDI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_RIPTIDE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_RME32                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_RME96                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_RME9652                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SB_COMMON                            policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_SND_SEQUENCER                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SEQUENCER_OSS                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SND_SEQ_DEVICE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SEQ_DUMMY                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SEQ_HRTIMER_DEFAULT                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_SEQ_MIDI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SEQ_MIDI_EMUL                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SEQ_MIDI_EVENT                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SEQ_UMP                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_SEQ_UMP_CLIENT                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SEQ_VIRMIDI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SERIAL_GENERIC                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SERIAL_U16550                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SIMPLE_CARD                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SIMPLE_CARD_UTILS                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AC97_BUS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_SOC_AC97_CODEC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ACPI                             policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ACPI_INTEL_MATCH                 policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_ADAU1372                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU1372_I2C                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU1372_SPI                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU1701                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU1761                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU1761_I2C                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU1761_SPI                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU17X1                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU7002                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU7118                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU7118_HW                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU7118_I2C                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADAU_UTILS                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADI_AXI_I2S                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ADI_AXI_SPDIF                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AK4104                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AK4118                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AK4375                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AK4458                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AK4554                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AK4613                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AK4642                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AK5386                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AK5558                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ALC5623                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ALC5632                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_AMD_ACP                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AMD_ACP3x                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_ACP5x                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_ACP6x                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_ACP_COMMON                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_ACP_I2S                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_ACP_LEGACY_COMMON            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_ACP_PCI                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_ACP_PCM                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_ACP_PDM                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_CZ_DA7219MX98357_MACH        policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AMD_CZ_RT5645_MACH               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AMD_LEGACY_MACH                  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_MACH_COMMON                  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_PS                           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_PS_MACH                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_RPL_ACP6x                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_RV_RT5682_MACH               policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_SOF_MACH                     policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_ST_ES8336_MACH               policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AMD_VANGOGH_MACH                 policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AMD_YC_MACH                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_APPLE_MCA                        policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_APQ8016_SBC                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_ARIZONA                          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_AUDIO_IIO_AUX                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AW8738                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AW87390                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AW88261                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AW88395                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AW88395_LIB                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_AW88399                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_BD28623                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_BT_SCO                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CHV3_CODEC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CHV3_I2S                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_COMPRESS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_SOC_CPCAP                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CROS_EC_CODEC                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_CS35L32                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L33                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L34                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L35                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L36                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L41                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L41_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L41_LIB                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L41_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L45                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L45_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L45_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L56                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L56_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L56_SDW                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L56_SHARED                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS35L56_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS4234                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS4265                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS4270                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS4271                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS4271_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS4271_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L42                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L42_CORE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L42_SDW                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L43                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L43_SDW                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L51                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L51_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L52                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L56                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L73                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42L83                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42XX8                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS42XX8_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS43130                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS4341                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS4349                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CS53L30                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_CX2072X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_DA7213                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_DA7219                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_DAVINCI_MCASP                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_DMIC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ES7134                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ES7241                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ES8316                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ES8326                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ES8328                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ES8328_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ES8328_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ES83XX_DSM_COMMON                policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_EUKREA_TLV320                    policy<{'armhf': 'm'}>
+CONFIG_SND_SOC_FSL_ASOC_CARD                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_FSL_ASRC                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_AUD2HTX                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_FSL_AUDMIX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_EASRC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_ESAI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_MICFIL                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_MQS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_RPMSG                        policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_SAI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_SPDIF                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_SSI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_UTILS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_FSL_XCVR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_SOC_GTM601                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_HDA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_HDAC_HDA                         policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_HDAC_HDMI                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_HDMI_CODEC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_I2C_AND_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ICS43432                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_IDT821034                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_IMG                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_SOC_IMG_I2S_IN                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_IMG_I2S_OUT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_IMG_PARALLEL_OUT                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_IMG_PISTACHIO_INTERNAL_DAC       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_IMG_SPDIF_IN                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_IMG_SPDIF_OUT                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_IMX_AUDIO_RPMSG                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_IMX_AUDMIX                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_IMX_AUDMUX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_IMX_CARD                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_IMX_ES8328                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_IMX_HDMI                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_IMX_PCM_DMA                      policy<{'arm64': 'm', 'armhf': 'y'}>
+CONFIG_SND_SOC_IMX_PCM_FIQ                      policy<{'armhf': 'y'}>
+CONFIG_SND_SOC_IMX_PCM_RPMSG                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_IMX_RPMSG                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_IMX_SGTL5000                     policy<{'arm64': 'm', 'armhf': 'y'}>
+CONFIG_SND_SOC_IMX_SPDIF                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_INNO_RK3036                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_INTEL_APL                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_DA7219            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_DMIC              policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_ES8336            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_HDAUDIO           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_I2S_TEST          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_MAX98357A         policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_MAX98373          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_MAX98927          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_NAU8825           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_PROBE             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_RT274             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_RT286             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_RT298             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_RT5514            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_RT5663            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_RT5682            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_AVS_MACH_SSM4567           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BDW_RT5650_MACH            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BDW_RT5677_MACH            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BROADWELL_MACH             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BXT_DA7219_MAX98357A_COMMON policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BXT_DA7219_MAX98357A_MACH  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BXT_RT298_MACH             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BYTCR_RT5640_MACH          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BYTCR_RT5651_MACH          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BYTCR_WM5102_MACH          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BYT_CHT_CX2072X_MACH       policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BYT_CHT_DA7213_MACH        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BYT_CHT_ES8316_MACH        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH       policy<{'amd64': 'n'}>
+CONFIG_SND_SOC_INTEL_CATPT                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_CHT_BSW_NAU8824_MACH       policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_CHT_BSW_RT5645_MACH        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_CHT_BSW_RT5672_MACH        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_CML_LP_DA7219_MAX98357A_MACH policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_DA7219_MAX98357A_GENERIC   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_EHL_RT5660_MACH            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_GLK                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_GLK_DA7219_MAX98357A_MACH  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_GLK_RT5682_MAX98357A_MACH  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_HASWELL_MACH               policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_HDA_DSP_COMMON             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_KBL                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_KBL_DA7219_MAX98357A_MACH  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_KBL_DA7219_MAX98927_MACH   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_KBL_RT5660_MACH            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_KBL_RT5663_MAX98927_MACH   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_KBL_RT5663_RT5514_MAX98927_MACH policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_KEEMBAY                    policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_INTEL_MACH                       policy<{'amd64': 'y'}>
+CONFIG_SND_SOC_INTEL_SKL                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SKL_HDA_DSP_GENERIC_MACH   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SKL_NAU88L25_MAX98357A_MACH policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SKL_NAU88L25_SSM4567_MACH  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SKL_RT286_MACH             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SKYLAKE_COMMON             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SKYLAKE_FAMILY             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SKYLAKE_SSP_CLK            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_BOARD_HELPERS          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_CIRRUS_COMMON          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_CML_RT1011_RT5682_MACH policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_CS42L42_MACH           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_DA7219_MACH            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_ES8336_MACH            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_MAXIM_COMMON           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_NAU8825_MACH           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_NUVOTON_COMMON         policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_PCM512x_MACH           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_REALTEK_COMMON         policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_RT5682_MACH            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_SSP_AMP_MACH           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_SSP_COMMON             policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SOF_WM8804_MACH            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SST                        policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_INTEL_SST_TOPLEVEL               policy<{'amd64': 'y'}>
+CONFIG_SND_SOC_J721E_EVM                        policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_JH7110_PWMDAC                    policy<{'riscv64': 'm'}>
+CONFIG_SND_SOC_JH7110_TDM                       policy<{'riscv64': 'm'}>
+CONFIG_SND_SOC_LOCHNAGAR_SC                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_LPASS_APQ8016                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_LPASS_CDC_DMA                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_LPASS_CPU                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_LPASS_HDMI                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_LPASS_IPQ806X                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_LPASS_MACRO_COMMON               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_LPASS_PLATFORM                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_LPASS_RX_MACRO                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_LPASS_SC7180                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_LPASS_SC7280                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_LPASS_TX_MACRO                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_LPASS_VA_MACRO                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_LPASS_WSA_MACRO                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX9759                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98088                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98090                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98357A                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98363                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98373                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98373_I2C                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98373_SDW                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98388                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98390                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98396                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98504                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98520                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX9860                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX9867                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MAX98927                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MEDIATEK                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MESON_T9015                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MIKROE_PROTO                     policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MSM8916_WCD_ANALOG               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MSM8916_WCD_DIGITAL              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MSM8996                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT2701                           policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_SND_SOC_MT6351                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MT6358                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MT6359                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT6359_ACCDET                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT6660                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_MT6797                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT6797_MT6351                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT7986                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT7986_WM8960                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8173                           policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_SND_SOC_MT8183                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8183_DA7219_MAX98357A          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8183_MT6358_TS3A227E_MAX98357A policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8186                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8186_MT6366_DA7219_MAX98357    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8186_MT6366_RT1019_RT5682S     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8188                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8188_MT6359                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8192                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8192_MT6359_RT1015_RT5682      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8195                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MT8195_MT6359                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_MTK_BTCVSD                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_NAU8315                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_NAU8540                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_NAU8810                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_NAU8821                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_NAU8822                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_NAU8824                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_NAU8825                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_OMAP_MCBSP                       policy<{'armhf': 'm'}>
+CONFIG_SND_SOC_PCM1681                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM1789                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM1789_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM179X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM179X_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM179X_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM186X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM186X_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM186X_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM3060                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM3060_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM3060_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM3168A                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM3168A_I2C                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM3168A_SPI                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM5102A                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM512x                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM512x_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PCM512x_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_PEB2466                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_QCOM                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QCOM_COMMON                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QCOM_SDW                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_ADM                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_AFE                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_AFE_CLOCKS                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_AFE_DAI                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_APM                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_APM_DAI                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_APM_LPASS_DAI              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_ASM                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_ASM_DAI                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_COMMON                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_CORE                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_PRM                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_PRM_LPASS_CLOCKS           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_QDSP6_ROUTING                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RCAR                             policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RK3288_HDMI_ANALOG               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RK3328                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RK3399_GRU_SOUND                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RK817                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RL6231                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RL6347A                          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_ROCKCHIP                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_ROCKCHIP_I2S                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_ROCKCHIP_I2S_TDM                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_ROCKCHIP_MAX98090                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_ROCKCHIP_PDM                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_ROCKCHIP_RT5645                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_ROCKCHIP_SPDIF                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT1011                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT1015                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT1015P                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT1017_SDCA_SDW                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT1019                           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_RT1308                           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_RT1308_SDW                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT1316_SDW                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT1318_SDW                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT274                            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_RT286                            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_RT298                            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_RT5514                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT5514_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT5616                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT5631                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT5640                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT5645                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT5651                           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_RT5659                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT5660                           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_RT5663                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT5670                           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_RT5677                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT5677_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT5682                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT5682S                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_RT5682_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT5682_SDW                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT700                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT700_SDW                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT711                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT711_SDCA_SDW                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT711_SDW                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT712_SDCA_DMIC_SDW              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT712_SDCA_SDW                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT715                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT715_SDCA_SDW                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT715_SDW                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT722_SDCA_SDW                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RT9120                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RTQ9128                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_RZ                               policy<{'arm64': 'm', 'riscv64': '-'}>
+CONFIG_SND_SOC_SAMSUNG                          policy<{'armhf': 'n'}>
+CONFIG_SND_SOC_SC7180                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_SC7280                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_SC8280XP                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_SDM845                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_SDW_MOCKUP                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SGTL5000                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SH4_FSI                          policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SI476X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SIGMADSP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SIGMADSP_I2C                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SIGMADSP_REGMAP                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SIMPLE_AMPLIFIER                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SIMPLE_MUX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SM8250                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_SMA1303                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SOF                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SND_SOC_SOF_ACPI                         policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SOF_ACPI_DEV                     policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_ACP_PROBES                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_ALDERLAKE                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_AMD_ACP63                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_AMD_COMMON                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_AMD_REMBRANDT                policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_AMD_RENOIR                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_AMD_TOPLEVEL                 policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_AMD_VANGOGH                  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_APOLLOLAKE                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_BAYTRAIL                     policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_BROADWELL                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_CANNONLAKE                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_CLIENT                       policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_COFFEELAKE                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_COMETLAKE                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_COMPRESS                     policy<{'arm64': 'y'}>
+CONFIG_SND_SOC_SOF_DEBUG_PROBES                 policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_DEVELOPER_SUPPORT            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': '-', 'ppc64el': '-'}>
+CONFIG_SND_SOC_SOF_ELKHARTLAKE                  policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_GEMINILAKE                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_HDA                          policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_HDA_COMMON                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_HDA_LINK_BASELINE            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_HDA_MLINK                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_HDA_PROBES                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_ICELAKE                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_IMX8                         policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SOF_IMX8M                        policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SOF_IMX8ULP                      policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SOF_IMX_COMMON                   policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SOF_IMX_TOPLEVEL                 policy<{'arm64': 'y'}>
+CONFIG_SND_SOC_SOF_INTEL_APL                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_ATOM_HIFI_EP           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_CNL                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_COMMON                 policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_HIFI_EP_IPC            policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_ICL                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_LNL                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_MTL                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_SKL                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_SOUNDWIRE              policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_SOUNDWIRE_LINK_BASELINE policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_TGL                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_INTEL_TOPLEVEL               policy<{'amd64': 'y'}>
+CONFIG_SND_SOC_SOF_IPC3                         policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_SND_SOC_SOF_IPC4                         policy<{'amd64': 'y'}>
+CONFIG_SND_SOC_SOF_JASPERLAKE                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_KABYLAKE                     policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_LUNARLAKE                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_MERRIFIELD                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_METEORLAKE                   policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_MT8186                       policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SOF_MT8195                       policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SOF_MTK_COMMON                   policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SOF_MTK_TOPLEVEL                 policy<{'arm64': 'y'}>
+CONFIG_SND_SOC_SOF_OF                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SOF_OF_DEV                       policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SOF_PCI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SOF_PCI_DEV                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE             policy<{'amd64': 'y'}>
+CONFIG_SND_SOC_SOF_SKYLAKE                      policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_TIGERLAKE                    policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_SOF_TOPLEVEL                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_SOC_SOF_XTENSA                       policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SND_SOC_SPDIF                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SPRD                             policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SPRD_MCDT                        policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SRC4XXX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SRC4XXX_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SSM2305                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SSM2518                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SSM2602                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SSM2602_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SSM2602_SPI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SSM3515                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_SSM4567                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_STA32X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_STA350                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_STARFIVE                         policy<{'riscv64': 'm'}>
+CONFIG_SND_SOC_STI_SAS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_STM32_DFSDM                      policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_STM32_I2S                        policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_STM32_SAI                        policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_STM32_SPDIFRX                    policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_STORM                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TAS2552                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS2562                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS2764                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS2770                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS2780                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS2781_COMLIB                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS2781_FMWLIB                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS2781_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS5086                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS571X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS5720                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS5805M                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TAS6424                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TDA7419                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TEGRA                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA186_ASRC                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA186_DSPK                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA20_AC97                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA20_DAS                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA20_I2S                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA20_SPDIF                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_ADMAIF                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_ADX                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_AHUB                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_AMX                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_DMIC                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_I2S                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_MIXER                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_MVC                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_OPE                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA210_SFC                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA30_AHUB                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA30_I2S                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_ALC5632                    policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_AUDIO_GRAPH_CARD           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_MACHINE_DRV                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_MAX98088                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_MAX98090                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_RT5631                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_RT5640                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_RT5677                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_SGTL5000                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_TRIMSLICE                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_WM8753                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_WM8903                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TEGRA_WM9712                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TFA9879                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TFA989X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TI_EDMA_PCM                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TI_SDMA_PCM                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TI_UDMA_PCM                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_TLV320ADC3XXX                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320ADCX140                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC23                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC23_I2C                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC23_SPI                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC31XX                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC32X4                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC32X4_I2C                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC32X4_SPI                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC3X                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC3X_I2C                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TLV320AIC3X_SPI                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TOPOLOGY                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SND_SOC_TPA6130A2                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TS3A227E                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TSCS42XX                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_TSCS454                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_UDA1334                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WCD9335                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WCD934X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WCD938X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WCD938X_SDW                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WCD_CLASSH                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WCD_MBHC                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM5102                           policy<{'amd64': 'm'}>
+CONFIG_SND_SOC_WM8510                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8523                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8524                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8580                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8711                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8728                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8731                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8731_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8731_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8737                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8741                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8750                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8753                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8770                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8776                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8782                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8804                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8804_I2C                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8804_SPI                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8903                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8904                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8940                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8960                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8961                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8962                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8974                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8978                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8985                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM8994                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_WM9712                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_WM_ADSP                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WM_HUBS                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_WSA881X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WSA883X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_WSA884X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_X1E80100                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SOC_XILINX_AUDIO_FORMATTER           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_XILINX_I2S                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_XILINX_SPDIF                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_XTFPGA_I2S                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SOC_ZL38060                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SONICVIBES                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_SPI                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_SST_ATOM_HIFI2_PLATFORM              policy<{'amd64': 'm'}>
+CONFIG_SND_SST_ATOM_HIFI2_PLATFORM_ACPI         policy<{'amd64': 'm'}>
+CONFIG_SND_SST_ATOM_HIFI2_PLATFORM_PCI          policy<{'amd64': 'm'}>
+CONFIG_SND_SUN4I_CODEC                          policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_SND_SUN4I_I2S                            policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_SND_SUN4I_SPDIF                          policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_SND_SUN50I_CODEC_ANALOG                  policy<{'arm64': 'm'}>
+CONFIG_SND_SUN50I_DMIC                          policy<{'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SND_SUN8I_ADDA_PR_REGMAP                 policy<{'arm64': 'm'}>
+CONFIG_SND_SUN8I_CODEC                          policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SND_SUN8I_CODEC_ANALOG                   policy<{'arm64': 'm', 'armhf': '-'}>
+CONFIG_SND_SUPPORT_OLD_API                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_SYNTH_EMUX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_TEST_COMPONENT                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_TIMER                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_TRIDENT                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SND_UMP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_UMP_LEGACY_RAWMIDI                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_USB                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_USB_6FIRE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_USB_AUDIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_USB_AUDIO_MIDI_V2                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_USB_AUDIO_USE_MEDIA_CONTROLLER       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_USB_CAIAQ                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_USB_CAIAQ_INPUT                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_USB_HIFACE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_USB_LINE6                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_USB_POD                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_USB_PODHD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_USB_TONEPORT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_USB_UA101                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_USB_US122L                           policy<{'amd64': 'm'}>
+CONFIG_SND_USB_USX2Y                            policy<{'amd64': 'm', 'ppc64el': 'm'}>
+CONFIG_SND_USB_VARIAX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_VERBOSE_PRINTK                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SND_VERBOSE_PROCFS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_VIA82XX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_VIA82XX_MODEM                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_VIRMIDI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_VIRTIO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_VIRTUOSO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_VMASTER                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SND_VX222                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_VXPOCKET                             policy<{'amd64': 'm'}>
+CONFIG_SND_VX_LIB                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SND_X86                                  policy<{'amd64': 'y'}>
+CONFIG_SND_XEN_FRONTEND                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_SND_YMFPCI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SNET_VDPA                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SNI_NETSEC                               policy<{'arm64': 'm'}>
+CONFIG_SOCFPGA_FPGA_BRIDGE                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SOCFPGA_SUSPEND                          policy<{'armhf': 'y'}>
+CONFIG_SOCIONEXT_SYNQUACER_PREITS               policy<{'arm64': 'y'}>
+CONFIG_SOCK_CGROUP_DATA                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SOCK_RX_QUEUE_MAPPING                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SOCK_VALIDATE_XMIT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SOC_AM33XX                               policy<{'armhf': 'n'}>
+CONFIG_SOC_AM43XX                               policy<{'armhf': 'n'}>
+CONFIG_SOC_BUS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SOC_DRA7XX                               policy<{'armhf': 'y'}>
+CONFIG_SOC_HAS_OMAP2_SDRC                       policy<{'armhf': 'y'}>
+CONFIG_SOC_HAS_REALTIME_COUNTER                 policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX5                                 policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX50                                policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX51                                policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX53                                policy<{'armhf': 'n'}>
+CONFIG_SOC_IMX6                                 policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX6Q                                policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX6SL                               policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX6SLL                              policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX6SX                               policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX6UL                               policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX7D                                policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX7D_CA7                            policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX7ULP                              policy<{'armhf': 'y'}>
+CONFIG_SOC_IMX8M                                policy<{'arm64': 'y', 'armhf': 'n'}>
+CONFIG_SOC_IMX9                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SOC_LS1021A                              policy<{'armhf': 'n'}>
+CONFIG_SOC_MICROCHIP_POLARFIRE                  policy<{'riscv64': 'y'}>
+CONFIG_SOC_OMAP5                                policy<{'armhf': 'n'}>
+CONFIG_SOC_RENESAS                              policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_SOC_SAMSUNG                              policy<{'armhf': 'y'}>
+CONFIG_SOC_SIFIVE                               policy<{'riscv64': 'y'}>
+CONFIG_SOC_SP7021                               policy<{'armhf': 'y'}>
+CONFIG_SOC_STARFIVE                             policy<{'riscv64': 'y'}>
+CONFIG_SOC_TEGRA20_VOLTAGE_COUPLER              policy<{'armhf': 'y'}>
+CONFIG_SOC_TEGRA30_VOLTAGE_COUPLER              policy<{'armhf': 'y'}>
+CONFIG_SOC_TEGRA_CBB                            policy<{'arm64': 'm'}>
+CONFIG_SOC_TEGRA_FLOWCTRL                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SOC_TEGRA_FUSE                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SOC_TEGRA_PMC                            policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SOC_TEGRA_POWERGATE_BPMP                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SOC_TI                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SOC_VF610                                policy<{'armhf': 'y'}>
+CONFIG_SOC_VIRT                                 policy<{'riscv64': 'y'}>
+CONFIG_SOFTIRQ_ON_OWN_STACK                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SOFTLOCKUP_DETECTOR                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SOFT_WATCHDOG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SOFT_WATCHDOG_PRETIMEOUT                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SOLARIS_X86_PARTITION                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SONYPI_COMPAT                            policy<{'amd64': 'y'}>
+CONFIG_SONY_FF                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SONY_LAPTOP                              policy<{'amd64': 'm'}>
+CONFIG_SOUNDWIRE_AMD                            policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SOUNDWIRE_CADENCE                        policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SOUNDWIRE_GENERIC_ALLOCATION             policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SOUNDWIRE_INTEL                          policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SOUNDWIRE_QCOM                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SOUND_OSS_CORE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SP5100_TCO                               policy<{'amd64': 'm'}>
+CONFIG_SP7021_EMAC                              policy<{'armhf': 'm'}>
+CONFIG_SPAPR_TCE_IOMMU                          policy<{'ppc64el': 'y'}>
+CONFIG_SPARSEMEM                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SPARSEMEM_EXTREME                        policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SPARSEMEM_MANUAL                         policy<{'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SPARSEMEM_STATIC                         policy<{'armhf': 'y'}>
+CONFIG_SPARSEMEM_VMEMMAP                        policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SPARSE_IRQ                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SPARX5_DCB                               policy<{'arm64': 'y'}>
+CONFIG_SPARX5_SWITCH                            policy<{'amd64': '-', 'arm64': 'm', 'armhf': '-', 'ppc64el': '-'}>
+CONFIG_SPEAKUP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_ACNTSA                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_APOLLO                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_AUDPTR                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_BNS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_DECEXT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_DECTLK                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_DUMMY                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_LTLK                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_SOFT                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_SPKOUT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPEAKUP_SYNTH_TXPRT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SPI_ALTERA                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_ALTERA_CORE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_ALTERA_DFL                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_AMD                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_AMLOGIC_SPIFC_A1                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_ARMADA_3700                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_ASPEED_SMC                           policy<{'armhf': 'm'}>
+CONFIG_SPI_AX88796C                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_AX88796C_COMPRESSION                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SPI_AXI_SPI_ENGINE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_BITBANG                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_BUTTERFLY                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_CADENCE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_CADENCE_QUADSPI                      policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_CADENCE_XSPI                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_CS42L43                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_SPI_DESIGNWARE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_DLN2                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_DW_DMA                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SPI_DW_MMIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_DW_PCI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_DYNAMIC                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SPI_FSI                                  policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_FSL_DSPI                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_FSL_LIB                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SPI_FSL_LPSPI                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_FSL_QUADSPI                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_FSL_SPI                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SPI_GPIO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_GXP                                  policy<{'armhf': 'm'}>
+CONFIG_SPI_HISI_KUNPENG                         policy<{'arm64': 'm'}>
+CONFIG_SPI_HISI_SFC                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_HISI_SFC_V3XX                        policy<{'arm64': 'm'}>
+CONFIG_SPI_IMX                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_INTEL                                policy<{'amd64': 'm'}>
+CONFIG_SPI_INTEL_PCI                            policy<{'amd64': 'm'}>
+CONFIG_SPI_INTEL_PLATFORM                       policy<{'amd64': 'm'}>
+CONFIG_SPI_LANTIQ_SSC                           policy<{'amd64': 'm'}>
+CONFIG_SPI_LJCA                                 policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_LM70_LLP                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_LOOPBACK_TEST                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_MASTER                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SPI_MEM                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SPI_MESON_SPICC                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_MESON_SPIFC                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_MICROCHIP_CORE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_MICROCHIP_CORE_QSPI                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_MT65XX                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_MTK_NOR                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_MTK_SNFI                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_MUX                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_MXIC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_NPCM_FIU                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_NPCM_PSPI                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_NXP_FLEXSPI                          policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-', 's390x': '-'}>
+CONFIG_SPI_OC_TINY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_OMAP24XX                             policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SPI_ORION                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_PCI1XXXX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_PL022                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_PXA2XX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_PXA2XX_PCI                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_QCOM_GENI                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_QCOM_QSPI                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_QUP                                  policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_ROCKCHIP                             policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-', 's390x': '-'}>
+CONFIG_SPI_ROCKCHIP_SFC                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_RPCIF                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_RSPI                                 policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_RZV2M_CSI                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_S3C64XX                              policy<{'armhf': 'n'}>
+CONFIG_SPI_SC18IS602                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_SH_HSPI                              policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_SH_MSIOF                             policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_SIFIVE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_SPI_SLAVE                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SPI_SLAVE_MT27XX                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_SLAVE_SYSTEM_CONTROL                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_SLAVE_TIME                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_SN_F_OSPI                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPI_SPIDEV                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_SPRD                                 policy<{'arm64': 'm'}>
+CONFIG_SPI_SPRD_ADI                             policy<{'arm64': 'm'}>
+CONFIG_SPI_STM32                                policy<{'arm64': 'm'}>
+CONFIG_SPI_STM32_QSPI                           policy<{'arm64': 'm'}>
+CONFIG_SPI_SUN4I                                policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_SPI_SUN6I                                policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_SPI_SUNPLUS_SP7021                       policy<{'armhf': 'm'}>
+CONFIG_SPI_SYNQUACER                            policy<{'arm64': 'm'}>
+CONFIG_SPI_TEGRA114                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_TEGRA20_SFLASH                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_TEGRA20_SLINK                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_TEGRA210_QUAD                        policy<{'arm64': 'y', 'armhf': 'm'}>
+CONFIG_SPI_THUNDERX                             policy<{'arm64': 'm'}>
+CONFIG_SPI_TI_QSPI                              policy<{'armhf': 'm'}>
+CONFIG_SPI_TLE62X0                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_WPCM_FIU                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPI_XCOMM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_XILINX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPI_XLP                                  policy<{'arm64': 'm'}>
+CONFIG_SPI_ZYNQMP_GQSPI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SPLIT_PTLOCK_CPUS                        policy<{'amd64': '4', 'arm64': '4', 'armhf': '4', 'ppc64el': '4', 'riscv64': '4', 's390x': '4'}>
+CONFIG_SPMI                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SPMI_HISI3670                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPMI_MSM_PMIC_ARB                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPMI_MTK_PMIF                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPMI_PMIC_CLKDIV                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_SPRD_COMMON_CLK                          policy<{'arm64': 'm'}>
+CONFIG_SPRD_DMA                                 policy<{'arm64': 'm'}>
+CONFIG_SPRD_IOMMU                               policy<{'arm64': 'm'}>
+CONFIG_SPRD_MBOX                                policy<{'arm64': 'm'}>
+CONFIG_SPRD_SC9860_CLK                          policy<{'arm64': 'm'}>
+CONFIG_SPRD_SC9863A_CLK                         policy<{'arm64': 'm'}>
+CONFIG_SPRD_THERMAL                             policy<{'arm64': 'm'}>
+CONFIG_SPRD_TIMER                               policy<{'arm64': 'y'}>
+CONFIG_SPRD_UMS512_CLK                          policy<{'arm64': 'm'}>
+CONFIG_SPRD_WATCHDOG                            policy<{'arm64': 'm'}>
+CONFIG_SPS30                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPS30_I2C                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SPS30_SERIAL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SQUASHFS_CHOICE_DECOMP_BY_MOUNT          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_DECOMP_MULTI                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_DECOMP_SINGLE                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_EMBEDDED                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SQUASHFS_FILE_CACHE                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SQUASHFS_FILE_DIRECT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE             policy<{'amd64': '3', 'arm64': '3', 'armhf': '3', 'ppc64el': '3', 'riscv64': '3', 's390x': '3'}>
+CONFIG_SQUASHFS_LZ4                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_LZO                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_MOUNT_DECOMP_THREADS            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_XATTR                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_XZ                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_ZLIB                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SQUASHFS_ZSTD                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SRAM                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SRAM_EXEC                                policy<{'armhf': 'y'}>
+CONFIG_SRF04                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SRF08                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SSB                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SSB_B43_PCI_BRIDGE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SSB_BLOCKIO                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SSB_DRIVER_GPIO                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_SSB_DRIVER_PCICORE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SSB_DRIVER_PCICORE_POSSIBLE              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SSB_PCIHOST                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_SSB_PCIHOST_POSSIBLE                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SSB_PCMCIAHOST                           policy<{'amd64': 'n'}>
+CONFIG_SSB_PCMCIAHOST_POSSIBLE                  policy<{'amd64': 'y'}>
+CONFIG_SSB_POSSIBLE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SSB_SDIOHOST                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SSB_SDIOHOST_POSSIBLE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SSB_SPROM                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SSFDC                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SSIF_IPMI_BMC                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_STACKDEPOT                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_STACKDEPOT_MAX_FRAMES                    policy<{'amd64': '64', 'arm64': '64', 'armhf': '64', 'ppc64el': '64', 'riscv64': '64', 's390x': '64'}>
+CONFIG_STACKPROTECTOR                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_STACKPROTECTOR_PER_TASK                  policy<{'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_STACKPROTECTOR_STRONG                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_STACKTRACE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_STACKTRACE_BUILD_ID                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_STACKTRACE_SUPPORT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_STACK_TRACER                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_STAGING                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_STAGING_BOARD                            policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_STAGING_MEDIA                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_STAGING_MEDIA_DEPRECATED                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_STANDALONE                               policy<{'amd64': 'n', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_STARFIVE_WATCHDOG                        policy<{'riscv64': 'y'}>
+CONFIG_STATIC_CALL_SELFTEST                     policy<{'amd64': 'n'}>
+CONFIG_STATIC_KEYS_SELFTEST                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': '-', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_STATIC_USERMODEHELPER                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_STE10XP                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_STEAM_FF                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_STK3310                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_STK8312                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_STK8BA50                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_STM                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_STM32_ADC                                policy<{'arm64': 'm'}>
+CONFIG_STM32_ADC_CORE                           policy<{'arm64': 'm'}>
+CONFIG_STM32_DAC                                policy<{'arm64': 'm'}>
+CONFIG_STM32_DAC_CORE                           policy<{'arm64': 'm'}>
+CONFIG_STM32_DFSDM_ADC                          policy<{'arm64': 'm'}>
+CONFIG_STM32_DFSDM_CORE                         policy<{'arm64': 'm'}>
+CONFIG_STM32_DMA                                policy<{'arm64': 'y'}>
+CONFIG_STM32_DMAMUX                             policy<{'arm64': 'y'}>
+CONFIG_STM32_FMC2_EBI                           policy<{'arm64': 'm'}>
+CONFIG_STM32_LPTIMER_CNT                        policy<{'arm64': 'm'}>
+CONFIG_STM32_MDMA                               policy<{'arm64': 'y'}>
+CONFIG_STM32_RPROC                              policy<{'arm64': 'm'}>
+CONFIG_STM32_TIMER_CNT                          policy<{'arm64': 'm'}>
+CONFIG_STM32_WATCHDOG                           policy<{'arm64': 'm'}>
+CONFIG_STMMAC_ETH                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_STMMAC_PCI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_STMMAC_PLATFORM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_STMMAC_SELFTESTS                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_STMPE_ADC                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_STMPE_I2C                                policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_STMPE_SPI                                policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_STMP_DEVICE                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_STM_DUMMY                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_STM_PROTO_BASIC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_STM_PROTO_SYS_T                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_STM_SOURCE_CONSOLE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_STM_SOURCE_FTRACE                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_STM_SOURCE_HEARTBEAT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_STP                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_STPMIC1_WATCHDOG                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_STREAM_PARSER                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_STRICT_DEVMEM                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_STRICT_KERNEL_RWX                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_STRICT_MODULE_RWX                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_STRICT_SIGALTSTACK_SIZE                  policy<{'amd64': 'n'}>
+CONFIG_STRING_SELFTEST                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_STRIP_ASM_SYMS                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_STUB_CLK_HI3660                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_STUB_CLK_HI6220                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_STX104                                   policy<{'amd64': 'm'}>
+CONFIG_ST_THERMAL                               policy<{'arm64': 'm'}>
+CONFIG_ST_THERMAL_MEMMAP                        policy<{'arm64': 'm'}>
+CONFIG_ST_UVIS25                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ST_UVIS25_I2C                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ST_UVIS25_SPI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SUN20I_D1_CCU                            policy<{'riscv64': 'y'}>
+CONFIG_SUN20I_D1_R_CCU                          policy<{'riscv64': 'y'}>
+CONFIG_SUN20I_GPADC                             policy<{'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_SUN20I_PPU                               policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_SUN4I_EMAC                               policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_SUN4I_GPADC                              policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_SUN4I_TIMER                              policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_SUN50I_A100_CCU                          policy<{'arm64': 'y'}>
+CONFIG_SUN50I_A100_R_CCU                        policy<{'arm64': 'y'}>
+CONFIG_SUN50I_A64_CCU                           policy<{'arm64': 'y'}>
+CONFIG_SUN50I_DE2_BUS                           policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_SUN50I_ERRATUM_UNKNOWN1                  policy<{'arm64': 'y'}>
+CONFIG_SUN50I_H616_CCU                          policy<{'arm64': 'y'}>
+CONFIG_SUN50I_H6_CCU                            policy<{'arm64': 'y'}>
+CONFIG_SUN50I_H6_R_CCU                          policy<{'arm64': 'y'}>
+CONFIG_SUN50I_IOMMU                             policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_SUN6I_MSGBOX                             policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_SUN6I_R_INTC                             policy<{'arm64': 'y'}>
+CONFIG_SUN8I_DE2_CCU                            policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_SUN8I_H3_CCU                             policy<{'arm64': 'y', 'armhf': '-'}>
+CONFIG_SUN8I_R_CCU                              policy<{'arm64': 'y', 'armhf': '-'}>
+CONFIG_SUN8I_THERMAL                            policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_SUNDANCE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SUNDANCE_MMIO                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_SUNGEM                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SUNGEM_PHY                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SUNPLUS_SP7021_INTC                      policy<{'armhf': 'y'}>
+CONFIG_SUNPLUS_WATCHDOG                         policy<{'armhf': 'm'}>
+CONFIG_SUNRPC                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SUNRPC_BACKCHANNEL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SUNRPC_DEBUG                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SUNRPC_GSS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SUNRPC_SWAP                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SUNRPC_XPRT_RDMA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_SUNXI_CCU                                policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_SUNXI_MBUS                               policy<{'arm64': 'y'}>
+CONFIG_SUNXI_NMI_INTC                           policy<{'arm64': 'y'}>
+CONFIG_SUNXI_RSB                                policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_SUNXI_SRAM                               policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_SUNXI_WATCHDOG                           policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_SUN_PARTITION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SURFACE3_WMI                             policy<{'amd64': 'm'}>
+CONFIG_SURFACE_3_POWER_OPREGION                 policy<{'amd64': 'm', 'arm64': 'n'}>
+CONFIG_SURFACE_ACPI_NOTIFY                      policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_AGGREGATOR                       policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_AGGREGATOR_BUS                   policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_SURFACE_AGGREGATOR_CDEV                  policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_AGGREGATOR_ERROR_INJECTION       policy<{'amd64': 'n', 'arm64': 'n'}>
+CONFIG_SURFACE_AGGREGATOR_HUB                   policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_AGGREGATOR_REGISTRY              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_AGGREGATOR_TABLET_SWITCH         policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_DTX                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_GPE                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_HID                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_HID_CORE                         policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_HOTPLUG                          policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_KBD                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_PLATFORMS                        policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_SURFACE_PLATFORM_PROFILE                 policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_SURFACE_PRO3_BUTTON                      policy<{'amd64': 'm', 'arm64': 'n'}>
+CONFIG_SUSPEND                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SUSPEND_FREEZER                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_SUSPEND_SKIP_SYNC                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_SVC_I3C_MASTER                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SWAP                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SWIOTLB                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SWIOTLB_DYNAMIC                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SWIOTLB_XEN                              policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_SWPHY                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SWP_EMULATE                              policy<{'armhf': 'y'}>
+CONFIG_SW_SYNC                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SX9310                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SX9324                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SX9360                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SX9500                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SXGBE_ETH                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SX_COMMON                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SYMBOLIC_ERRNAME                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYNC_FILE                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYNTH_EVENTS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYNTH_EVENT_GEN_TEST                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SYN_COOKIES                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSCON_REBOOT_MODE                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_SYSCTL                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSCTL_ARCH_UNALIGN_ALLOW                policy<{'riscv64': 'y'}>
+CONFIG_SYSCTL_EXCEPTION_TRACE                   policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSC_R8A7742                             policy<{'armhf': 'y'}>
+CONFIG_SYSC_R8A7743                             policy<{'armhf': 'y'}>
+CONFIG_SYSC_R8A7745                             policy<{'armhf': 'y'}>
+CONFIG_SYSC_R8A77470                            policy<{'armhf': 'y'}>
+CONFIG_SYSC_R8A774A1                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A774B1                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A774C0                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A774E1                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A7779                             policy<{'armhf': 'y'}>
+CONFIG_SYSC_R8A7790                             policy<{'armhf': 'y'}>
+CONFIG_SYSC_R8A7791                             policy<{'armhf': 'y'}>
+CONFIG_SYSC_R8A7792                             policy<{'armhf': 'y'}>
+CONFIG_SYSC_R8A7794                             policy<{'armhf': 'y'}>
+CONFIG_SYSC_R8A7795                             policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A77960                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A77961                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A77965                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A77970                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A77980                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A77990                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A77995                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A779A0                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A779F0                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_R8A779G0                            policy<{'arm64': 'y'}>
+CONFIG_SYSC_RCAR                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SYSC_RCAR_GEN4                           policy<{'arm64': 'y'}>
+CONFIG_SYSC_RMOBILE                             policy<{'armhf': 'y'}>
+CONFIG_SYSFB                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_SYSFS                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSFS_SYSCALL                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSTEM76_ACPI                            policy<{'amd64': 'm'}>
+CONFIG_SYSTEMPORT                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_SYSTEM_BLACKLIST_HASH_LIST               policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '""'}>
+CONFIG_SYSTEM_BLACKLIST_KEYRING                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSTEM_DATA_VERIFICATION                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSTEM_EXTRA_CERTIFICATE                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE            policy<{'amd64': '4096', 'arm64': '4096', 'armhf': '4096', 'ppc64el': '4096', 'riscv64': '4096', 's390x': '4096'}>
+CONFIG_SYSTEM_REVOCATION_KEYS                   policy<{'amd64': '"debian/canonical-revoked-certs.pem"', 'arm64': '"debian/canonical-revoked-certs.pem"', 'armhf': '"debian/canonical-revoked-certs.pem"', 'ppc64el': '"debian/canonical-revoked-certs.pem"', 'riscv64': '"debian/canonical-revoked-certs.pem"', 's390x': '"debian/canonical-revoked-certs.pem"'}>
+CONFIG_SYSTEM_REVOCATION_LIST                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSTEM_TRUSTED_KEYRING                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSTEM_TRUSTED_KEYS                      policy<{'amd64': '"debian/canonical-certs.pem"', 'arm64': '"debian/canonical-certs.pem"', 'armhf': '"debian/canonical-certs.pem"', 'ppc64el': '"debian/canonical-certs.pem"', 'riscv64': '"debian/canonical-certs.pem"', 's390x': '"debian/canonical-certs.pem"'}>
+CONFIG_SYSV68_PARTITION                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_SYSVIPC                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSVIPC_COMPAT                           policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'ppc64el': '-', 's390x': '-'}>
+CONFIG_SYSVIPC_SYSCTL                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_SYSV_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_SYS_HYPERVISOR                           policy<{'amd64': 'y', 'arm64': 'y', 's390x': 'y'}>
+CONFIG_SYS_SUPPORTS_APM_EMULATION               policy<{'armhf': 'y'}>
+CONFIG_SYS_SUPPORTS_EM_STI                      policy<{'armhf': 'y'}>
+CONFIG_SYS_SUPPORTS_SH_CMT                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_SYS_SUPPORTS_SH_MTU2                     policy<{'armhf': 'y'}>
+CONFIG_SYS_SUPPORTS_SH_TMU                      policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_T5403                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TABLET_SERIAL_WACOM4                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TABLET_USB_ACECAD                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TABLET_USB_AIPTEK                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TABLET_USB_HANWANG                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TABLET_USB_KBTAB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TABLET_USB_PEGASUS                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TAHVO_USB                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TAHVO_USB_HOST_BY_DEFAULT                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TAP                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TARGET_CORE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TARGET_CPU                               policy<{'ppc64el': '"power8"'}>
+CONFIG_TARGET_CPU_BOOL                          policy<{'ppc64el': 'y'}>
+CONFIG_TASKSTATS                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TASKS_RCU                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_TASKS_RCU_GENERIC                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TASKS_RUDE_RCU                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': '-', 's390x': 'y'}>
+CONFIG_TASKS_TRACE_RCU                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TASK_DELAY_ACCT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TASK_IO_ACCOUNTING                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TASK_XACCT                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TCG_ATMEL                                policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TCG_CRB                                  policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_TCG_FTPM_TEE                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TCG_IBMVTPM                              policy<{'ppc64el': 'y'}>
+CONFIG_TCG_INFINEON                             policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_TCG_NSC                                  policy<{'amd64': 'm'}>
+CONFIG_TCG_TIS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TCG_TIS_CORE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TCG_TIS_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TCG_TIS_I2C_CR50                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TCG_TIS_SPI                              policy<{'amd64': 'm', 'arm64': 'y', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TCG_TIS_SPI_CR50                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TCG_TIS_ST33ZP24                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TCG_TIS_ST33ZP24_I2C                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TCG_TIS_ST33ZP24_SPI                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TCG_TIS_SYNQUACER                        policy<{'arm64': 'm'}>
+CONFIG_TCG_VTPM_PROXY                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCG_XEN                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_TCM_FC                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCM_FILEIO                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCM_IBLOCK                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCM_PSCSI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCM_QLA2XXX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TCM_QLA2XXX_DEBUG                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_TCM_USER2                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_AO                                   policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TCP_CONG_ADVANCED                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TCP_CONG_BBR                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_BIC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_CDG                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_CUBIC                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TCP_CONG_DCTCP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_HSTCP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_HTCP                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_HYBLA                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_ILLINOIS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_LP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_NV                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_SCALABLE                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_VEGAS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_VENO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_WESTWOOD                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_CONG_YEAH                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TCP_MD5SIG                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TCP_SIGPOOL                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TCS3414                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TCS3472                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TDX_GUEST_DRIVER                         policy<{'amd64': 'm'}>
+CONFIG_TEE                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TEE_STMM_EFI                             policy<{'arm64-generic': 'n', 'arm64-generic-64k': 'm', 'armhf': 'm'}>
+CONFIG_TEGRA124_CLK_EMC                         policy<{'armhf': 'y'}>
+CONFIG_TEGRA124_EMC                             policy<{'armhf': 'y'}>
+CONFIG_TEGRA186_GPC_DMA                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TEGRA186_TIMER                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA20_APB_DMA                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA20_EMC                              policy<{'armhf': 'y'}>
+CONFIG_TEGRA210_ADMA                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TEGRA210_EMC                             policy<{'arm64': 'm'}>
+CONFIG_TEGRA210_EMC_TABLE                       policy<{'arm64': 'y'}>
+CONFIG_TEGRA30_EMC                              policy<{'armhf': 'y'}>
+CONFIG_TEGRA30_TSENSOR                          policy<{'armhf': 'm'}>
+CONFIG_TEGRA_ACONNECT                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TEGRA_AHB                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_BPMP                               policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_BPMP_THERMAL                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TEGRA_CLK_DFLL                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_GMI                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TEGRA_HOST1X                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TEGRA_HOST1X_CONTEXT_BUS                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_HOST1X_FIREWALL                    policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_HSP_MBOX                           policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_IOMMU_SMMU                         policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_IVC                                policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_MC                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_SOCTHERM                           policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_TEGRA_TIMER                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TEGRA_WATCHDOG                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TEHUTI                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TELCLOCK                                 policy<{'amd64': 'm'}>
+CONFIG_TERANETICS_PHY                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TEST_ASYNC_DRIVER_PROBE                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_BITMAP                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_BITOPS                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_BPF                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TEST_CLOCKSOURCE_WATCHDOG                policy<{'amd64': 'n'}>
+CONFIG_TEST_DHRY                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_DIV64                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_DYNAMIC_DEBUG                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_FIRMWARE                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_FPU                                 policy<{'amd64': 'n'}>
+CONFIG_TEST_FREE_PAGES                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_HEXDUMP                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_HMM                                 policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n'}>
+CONFIG_TEST_IDA                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_KMOD                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_KSTRTOX                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_LIVEPATCH                           policy<{'amd64': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_TEST_LKM                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_LOCKUP                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_MAPLE_TREE                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_MEMCAT_P                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_MEMINIT                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_MIN_HEAP                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_OBJAGG                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_OBJPOOL                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_PARMAN                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_POWER                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TEST_PRINTF                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_REF_TRACKER                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_RHASHTABLE                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_SCANF                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_STATIC_KEYS                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_STRING_HELPERS                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_SYSCTL                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_UBSAN                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_TEST_UDELAY                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_USER_COPY                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_UUID                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_VMALLOC                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEST_XARRAY                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TEXTSEARCH                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TEXTSEARCH_BM                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TEXTSEARCH_FSM                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TEXTSEARCH_KMP                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_THERMAL                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_THERMAL_DEBUGFS                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_THERMAL_DEFAULT_GOV_BANG_BANG            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_THERMAL_DEFAULT_GOV_POWER_ALLOCATOR      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS      policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0'}>
+CONFIG_THERMAL_EMULATION                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_GOV_BANG_BANG                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_GOV_FAIR_SHARE                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_GOV_POWER_ALLOCATOR              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_GOV_STEP_WISE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_GOV_USER_SPACE                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_HWMON                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_MMIO                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_THERMAL_NETLINK                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_OF                               policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_STATISTICS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THERMAL_WRITABLE_TRIPS                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THINKPAD_ACPI                            policy<{'amd64': 'm'}>
+CONFIG_THINKPAD_ACPI_ALSA_SUPPORT               policy<{'amd64': 'y'}>
+CONFIG_THINKPAD_ACPI_DEBUG                      policy<{'amd64': 'n'}>
+CONFIG_THINKPAD_ACPI_DEBUGFACILITIES            policy<{'amd64': 'y'}>
+CONFIG_THINKPAD_ACPI_HOTKEY_POLL                policy<{'amd64': 'y'}>
+CONFIG_THINKPAD_ACPI_UNSAFE_LEDS                policy<{'amd64': 'n'}>
+CONFIG_THINKPAD_ACPI_VIDEO                      policy<{'amd64': 'y'}>
+CONFIG_THINKPAD_LMI                             policy<{'amd64': 'm'}>
+CONFIG_THP_SWAP                                 policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'riscv64': 'y'}>
+CONFIG_THREAD_INFO_IN_TASK                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_THREAD_SHIFT                             policy<{'ppc64el': '14'}>
+CONFIG_THREAD_SIZE_ORDER                        policy<{'riscv64': '2'}>
+CONFIG_THRUSTMASTER_FF                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_THUMB2_KERNEL                            policy<{'armhf': 'n'}>
+CONFIG_THUNDERX2_PMU                            policy<{'arm64': 'm'}>
+CONFIG_THUNDER_NIC_BGX                          policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_THUNDER_NIC_PF                           policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_THUNDER_NIC_RGX                          policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_THUNDER_NIC_VF                           policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TICK_CPU_ACCOUNTING                      policy<{'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_TICK_ONESHOT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TIFM_7XX1                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TIFM_CORE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TIGON3                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TIGON3_HWMON                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TIMERFD                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TIMER_ACPI                               policy<{'arm64': 'y'}>
+CONFIG_TIMER_IMX_SYS_CTR                        policy<{'arm64': 'y'}>
+CONFIG_TIMER_OF                                 policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': '-', 'riscv64': 'y'}>
+CONFIG_TIMER_PROBE                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': '-', 'riscv64': 'y'}>
+CONFIG_TIME_NS                                  policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TINYDRM_HX8357D                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TINYDRM_ILI9163                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TINYDRM_ILI9225                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TINYDRM_ILI9341                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TINYDRM_ILI9486                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TINYDRM_MI0283QT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TINYDRM_REPAPER                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TINYDRM_ST7586                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TINYDRM_ST7735R                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TIPC                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TIPC_CRYPTO                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TIPC_DIAG                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TIPC_MEDIA_IB                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TIPC_MEDIA_UDP                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TI_ADC081C                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADC0832                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADC084S021                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADC108S102                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADC12138                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADC128S052                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADC161S626                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADS1015                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADS1100                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADS124S08                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADS131E08                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADS7924                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADS7950                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADS8344                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_ADS8688                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_AM335X_ADC                            policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_TI_AM65_CPSW_QOS                         policy<{'arm64': 'y'}>
+CONFIG_TI_CPPI41                                policy<{'armhf': 'm'}>
+CONFIG_TI_CPSW                                  policy<{'armhf': 'y'}>
+CONFIG_TI_CPSW_PHY_SEL                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_TI_CPSW_SWITCHDEV                        policy<{'armhf': 'm'}>
+CONFIG_TI_CPTS                                  policy<{'armhf': 'y'}>
+CONFIG_TI_DAC082S085                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_DAC5571                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_DAC7311                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_DAC7612                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_DAVINCI_MDIO                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TI_DMA_CROSSBAR                          policy<{'armhf': 'y'}>
+CONFIG_TI_ECAP_CAPTURE                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TI_EDMA                                  policy<{'armhf': 'y'}>
+CONFIG_TI_EMIF                                  policy<{'armhf': 'm'}>
+CONFIG_TI_ICSSG_PRUETH                          policy<{'arm64': 'm'}>
+CONFIG_TI_ICSS_IEP                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TI_K3_AM65_CPSW_NUSS                     policy<{'arm64': 'm'}>
+CONFIG_TI_K3_AM65_CPSW_SWITCHDEV                policy<{'arm64': 'y'}>
+CONFIG_TI_K3_AM65_CPTS                          policy<{'arm64': 'm'}>
+CONFIG_TI_K3_CPPI_DESC_POOL                     policy<{'arm64': 'm'}>
+CONFIG_TI_K3_DSP_REMOTEPROC                     policy<{'arm64': 'm'}>
+CONFIG_TI_K3_PSIL                               policy<{'arm64': 'y'}>
+CONFIG_TI_K3_R5_REMOTEPROC                      policy<{'arm64': 'm'}>
+CONFIG_TI_K3_RINGACC                            policy<{'arm64': 'y'}>
+CONFIG_TI_K3_SOCINFO                            policy<{'arm64': 'y'}>
+CONFIG_TI_K3_UDMA                               policy<{'arm64': 'y'}>
+CONFIG_TI_K3_UDMA_GLUE_LAYER                    policy<{'arm64': 'y'}>
+CONFIG_TI_LMP92064                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_MESSAGE_MANAGER                       policy<{'arm64': 'y'}>
+CONFIG_TI_PIPE3                                 policy<{'armhf': 'm'}>
+CONFIG_TI_PRUSS                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TI_PRUSS_INTC                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TI_PWMSS                                 policy<{'armhf': 'y'}>
+CONFIG_TI_SCI_CLK                               policy<{'arm64': 'm'}>
+CONFIG_TI_SCI_CLK_PROBE_FROM_FW                 policy<{'arm64': 'n'}>
+CONFIG_TI_SCI_INTA_IRQCHIP                      policy<{'arm64': 'y'}>
+CONFIG_TI_SCI_INTA_MSI_DOMAIN                   policy<{'arm64': 'y'}>
+CONFIG_TI_SCI_INTR_IRQCHIP                      policy<{'arm64': 'y'}>
+CONFIG_TI_SCI_PM_DOMAINS                        policy<{'arm64': 'm'}>
+CONFIG_TI_SCI_PROTOCOL                          policy<{'arm64': 'y'}>
+CONFIG_TI_SOC_THERMAL                           policy<{'arm64': '-', 'armhf': 'n', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_TI_ST                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TI_SYSC                                  policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_TI_SYSCON_CLK                            policy<{'arm64': 'y'}>
+CONFIG_TI_TLC4541                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_TMAG5273                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TI_TSC2046                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TLAN                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TLS                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TLS_DEVICE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TLS_TOE                                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TMP006                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TMP007                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TMP117                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TMPFS                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TMPFS_INODE64                            policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TMPFS_QUOTA                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TMPFS_XATTR                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TN3215                                   policy<{'s390x': 'y'}>
+CONFIG_TN3215_CONSOLE                           policy<{'s390x': 'y'}>
+CONFIG_TN3270                                   policy<{'s390x': 'y'}>
+CONFIG_TN3270_CONSOLE                           policy<{'s390x': 'y'}>
+CONFIG_TN3270_FS                                policy<{'s390x': 'm'}>
+CONFIG_TOOLCHAIN_DEFAULT_CPU                    policy<{'ppc64el': 'n'}>
+CONFIG_TOOLCHAIN_HAS_V                          policy<{'riscv64': 'y'}>
+CONFIG_TOOLCHAIN_HAS_ZBB                        policy<{'riscv64': 'y'}>
+CONFIG_TOOLCHAIN_HAS_ZIHINTPAUSE                policy<{'riscv64': 'y'}>
+CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI  policy<{'riscv64': 'y'}>
+CONFIG_TOOLS_SUPPORT_RELR                       policy<{'amd64': 'y', 'ppc64el': 'y'}>
+CONFIG_TOPSTAR_LAPTOP                           policy<{'amd64': 'm'}>
+CONFIG_TOSHIBA_BT_RFKILL                        policy<{'amd64': 'm'}>
+CONFIG_TOSHIBA_HAPS                             policy<{'amd64': 'm'}>
+CONFIG_TOSHIBA_WMI                              policy<{'amd64': 'n'}>
+CONFIG_TOUCHSCREEN_88PM860X                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_AD7877                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_AD7879                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_AD7879_I2C                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_AD7879_SPI                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_ADC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_ADS7846                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_AR1021_I2C                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_ATMEL_MXT                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_ATMEL_MXT_T37                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_AUO_PIXCIR                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_BU21013                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_BU21029                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_CHIPONE_ICN8318              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_CHIPONE_ICN8505              policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_COLIBRI_VF50                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_CY8CTMA140                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_CY8CTMG110                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_CYTTSP4_CORE                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_CYTTSP4_I2C                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_CYTTSP4_SPI                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_CYTTSP5                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_CYTTSP_CORE                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_CYTTSP_I2C                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_CYTTSP_SPI                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_DA9034                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_DA9052                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_DMI                          policy<{'amd64': 'y'}>
+CONFIG_TOUCHSCREEN_DYNAPRO                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_EDT_FT5X06                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_EETI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_EGALAX                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_EGALAX_SERIAL                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_EKTF2127                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_ELO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_EXC3000                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_FUJITSU                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_GOODIX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_GUNZE                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_HAMPSHIRE                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_HIDEEP                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_HIMAX_HX83112B               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_HYCON_HY46XX                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_HYNITRON_CSTXXX              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_ILI210X                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_ILITEK                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_IMAGIS                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_IMX6UL_TSC                   policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_INEXIO                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_IQS5XX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_IQS7211                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_MAX11801                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_MC13783                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_MCS5000                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_MELFAS_MIP4                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_MMS114                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_MSG2638                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_MTOUCH                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_NOVATEK_NVT_TS               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_PCAP                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_PENMOUNT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_PIXCIR                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_RM_TS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_ROHM_BU21023                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_S6SY761                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_SILEAD                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_SIS_I2C                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_ST1232                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_STMFTS                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_STMPE                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_SUN4I                        policy<{'arm64': 'n', 'armhf': '-', 'riscv64': 'n'}>
+CONFIG_TOUCHSCREEN_SUR40                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_SURFACE3_SPI                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_SX8654                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_TI_AM335X_TSC                policy<{'amd64': '-', 'arm64': 'm', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_TOUCHSCREEN_TOUCHIT213                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_TOUCHRIGHT                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_TOUCHWIN                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_TPS6507X                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_TS4800                       policy<{'armhf': 'm'}>
+CONFIG_TOUCHSCREEN_TSC2004                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_TSC2005                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_TSC2007                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_TSC2007_IIO                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_TSC200X_CORE                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_TSC_SERIO                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_USB_3M                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_COMPOSITE                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_USB_DMC_TSC10                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_E2I                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_EASYTOUCH                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_EGALAX                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_ELO                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_ETT_TC45USB              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_ETURBO                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_GOTOP                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_GUNZE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_IDEALTEK                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_IRTOUCH                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_ITM                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_JASTEC                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_NEXIO                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_PANJIT                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_USB_ZYTRONIC                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_WACOM_I2C                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_WACOM_W8001                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_WDT87XX_I2C                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_WM831X                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_WM9705                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_WM9712                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_WM9713                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_TOUCHSCREEN_WM97XX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TOUCHSCREEN_ZET6223                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_ZFORCE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TOUCHSCREEN_ZINITIX                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TPL0102                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TPS6105X                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TPS65010                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TPS6507X                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_TPS6594_ESM                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TPS6594_PFSM                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TPS68470_PMIC_OPREGION                   policy<{'amd64': 'y'}>
+CONFIG_TQMX86_WDT                               policy<{'amd64': 'm'}>
+CONFIG_TRACEPOINTS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRACEPOINT_BENCHMARK                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TRACER_MAX_TRACE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRACER_SNAPSHOT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TRACE_CLOCK                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRACE_EVAL_MAP_FILE                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TRACE_EVENT_INJECT                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT               policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_TRACE_IRQFLAGS_SUPPORT                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRACE_MMIO_ACCESS                        policy<{'arm64': 'y'}>
+CONFIG_TRACING                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRACING_MAP                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_TRACING_SUPPORT                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRANSPARENT_HUGEPAGE                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'y', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TRANSPARENT_HUGEPAGE_MADVISE             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'n', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRANSPARENT_HUGEPAGE_NEVER               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TRANS_TABLE                              policy<{'arm64': 'y'}>
+CONFIG_TREE_RCU                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TREE_SRCU                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRIM_UNUSED_KSYMS                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TRUSTED_FOUNDATIONS                      policy<{'armhf': 'y'}>
+CONFIG_TRUSTED_KEYS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TRUSTED_KEYS_TPM                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TS4800_IRQ                               policy<{'armhf': 'm'}>
+CONFIG_TS4800_WATCHDOG                          policy<{'armhf': 'm'}>
+CONFIG_TSL2583                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TSL2591                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TSL2772                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TSL4531                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TSM_REPORTS                              policy<{'amd64': 'm'}>
+CONFIG_TSNEP                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_TSNEP_SELFTESTS                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TSYS01                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TSYS02D                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TTPCI_EEPROM                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TTY                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TTY_PRINTK                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_TTY_PRINTK_LEVEL                         policy<{'amd64': '6', 'arm64': '6', 'armhf': '6', 'ppc64el': '6', 'riscv64': '6'}>
+CONFIG_TULIP                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TULIP_MMIO                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_TULIP_MWI                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_TULIP_NAPI                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_TUN                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_TUNE_CPU                                 policy<{'ppc64el': '"-mtune=power10"'}>
+CONFIG_TUNE_DEFAULT                             policy<{'s390x': 'n'}>
+CONFIG_TUNE_GENERIC                             policy<{'riscv64': 'y'}>
+CONFIG_TUNE_Z10                                 policy<{'s390x': 'n'}>
+CONFIG_TUNE_Z13                                 policy<{'s390x': 'n'}>
+CONFIG_TUNE_Z14                                 policy<{'s390x': 'n'}>
+CONFIG_TUNE_Z15                                 policy<{'s390x': 'n'}>
+CONFIG_TUNE_Z196                                policy<{'s390x': 'n'}>
+CONFIG_TUNE_ZEC12                               policy<{'s390x': 'n'}>
+CONFIG_TUN_VNET_CROSS_LE                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_TURRIS_MOX_RWTM                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TWL4030_CORE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_TWL4030_MADC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TWL4030_POWER                            policy<{'armhf': 'y'}>
+CONFIG_TWL4030_USB                              policy<{'armhf': 'm'}>
+CONFIG_TWL4030_WATCHDOG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TWL6030_GPADC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TWL6030_USB                              policy<{'armhf': 'm'}>
+CONFIG_TWL6040_CORE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_TXGBE                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_TYPEC_ANX7411                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_DP_ALTMODE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_FUSB302                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_HD3SS3220                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_MT6360                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_MUX_FSA4480                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_MUX_GPIO_SBU                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_MUX_INTEL_PMC                      policy<{'amd64': 'm'}>
+CONFIG_TYPEC_MUX_NB7VPQ904M                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_MUX_PI3USB30532                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_MUX_PTN36502                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_MUX_WCD939X_USBSS                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_NVIDIA_ALTMODE                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_QCOM_PMIC                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_TYPEC_RT1711H                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_RT1719                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_STUSB160X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_TCPCI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_TCPCI_MAXIM                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_TCPCI_MT6370                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_TCPM                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_TPS6598X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_UCSI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPEC_WCOVE                              policy<{'amd64': 'm'}>
+CONFIG_TYPEC_WUSB3801                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_TYPHOON                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_UACCE                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UACCESS_WITH_MEMCPY                      policy<{'armhf': 'n'}>
+CONFIG_UBIFS_ATIME_SUPPORT                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_UBIFS_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_UBIFS_FS_ADVANCED_COMPR                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_UBIFS_FS_AUTHENTICATION                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_UBIFS_FS_LZO                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_UBIFS_FS_SECURITY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_UBIFS_FS_XATTR                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_UBIFS_FS_ZLIB                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_UBIFS_FS_ZSTD                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_UBSAN_ALIGNMENT                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_UBSAN_BOOL                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_UBSAN_BOUNDS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_UBSAN_BOUNDS_STRICT                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_UBSAN_DIV_ZERO                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_UBSAN_ENUM                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_UBSAN_SHIFT                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_UBSAN_TRAP                               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_UBSAN_UNREACHABLE                        policy<{'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_UBUNTU_HOST                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_UBUNTU_ODM_DRIVERS                       policy<{'amd64': 'y', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_UCC                                      policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_UCC_FAST                                 policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_UCC_SLOW                                 policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y'}>
+CONFIG_UCLAMP_BUCKETS_COUNT                     policy<{'amd64': '5', 'arm64': '5', 'armhf': '5', 'ppc64el': '5', 'riscv64': '5'}>
+CONFIG_UCLAMP_TASK                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_UCLAMP_TASK_GROUP                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_UCS2_STRING                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_UCSI_ACPI                                policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_UCSI_CCG                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_UCSI_PMIC_GLINK                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_UCSI_STM32G0                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_UDBG_RTAS_CONSOLE                        policy<{'ppc64el': 'n'}>
+CONFIG_UDF_FS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_UDMABUF                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_UEFI_CPER                                policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_UEFI_CPER_ARM                            policy<{'arm64': 'y'}>
+CONFIG_UEFI_CPER_X86                            policy<{'amd64': 'y'}>
+CONFIG_UEVENT_HELPER                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_UEVENT_HELPER_PATH                       policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '""'}>
+CONFIG_UFS_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_UFS_FS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UFS_FS_WRITE                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_UHID                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_UID16                                    policy<{'amd64': 'y', 'arm64': 'y', 'arm64-generic-64k': '-', 'armhf': 'y', 's390x': '-'}>
+CONFIG_UIO                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_UIO_AEC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UIO_CIF                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UIO_DFL                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_UIO_DMEM_GENIRQ                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UIO_FSL_ELBC_GPCM                        policy<{'ppc64el': 'm'}>
+CONFIG_UIO_FSL_ELBC_GPCM_NETX5152               policy<{'ppc64el': 'n'}>
+CONFIG_UIO_HV_GENERIC                           policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_UIO_MF624                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UIO_NETX                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UIO_PCI_GENERIC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UIO_PDRV_GENIRQ                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UIO_PRUSS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_UIO_SERCOS3                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ULI526X                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_ULTRIX_PARTITION                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_UNACCEPTED_MEMORY                        policy<{'amd64': 'y'}>
+CONFIG_UNCOMPRESS_INCLUDE                       policy<{'armhf': '"debug/uncompress.h"'}>
+CONFIG_UNICODE                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_UNICODE_NORMALIZATION_SELFTEST           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_UNINLINE_SPIN_UNLOCK                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-', 'ppc64el': '-', 'riscv64': 'y'}>
+CONFIG_UNIX                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_UNIX98_PTYS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_UNIXWARE_DISKLABEL                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_UNIX_DIAG                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_UNIX_SCM                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_UNMAP_KERNEL_AT_EL0                      policy<{'arm64': 'y'}>
+CONFIG_UNWINDER_ARM                             policy<{'armhf': 'n'}>
+CONFIG_UNWINDER_ORC                             policy<{'amd64': 'n'}>
+CONFIG_UPROBES                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_UPROBE_EVENTS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_US5182D                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB4                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_USB4_DEBUGFS_WRITE                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB4_DMA_TEST                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB4_NET                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USBIP_CORE                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USBIP_DEBUG                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USBIP_HOST                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USBIP_VHCI_HCD                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USBIP_VHCI_HC_PORTS                      policy<{'amd64': '8', 'arm64': '8', 'armhf': '8', 'ppc64el': '8', 'riscv64': '8'}>
+CONFIG_USBIP_VHCI_NR_HCS                        policy<{'amd64': '1', 'arm64': '1', 'armhf': '1', 'ppc64el': '1', 'riscv64': '1'}>
+CONFIG_USBIP_VUDC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USBPCWATCHDOG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_ACM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_ADUTUX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_AIRSPY                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_ALI_M5632                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_AMD5536UDC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_AN2720                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_ANNOUNCE_NEW_DEVICES                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_APPLEDISPLAY                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_ARCH_HAS_HCD                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_ARMLINUX                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_ASPEED_UDC                           policy<{'armhf': 'm'}>
+CONFIG_USB_ASPEED_VHUB                          policy<{'armhf': 'm'}>
+CONFIG_USB_ATM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_AUDIO                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_AUTOSUSPEND_DELAY                    policy<{'amd64': '2', 'arm64': '2', 'armhf': '2', 'ppc64el': '2', 'riscv64': '2'}>
+CONFIG_USB_BDC_UDC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_BELKIN                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_C67X00_HCD                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_CATC                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CDC_COMPOSITE                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CDC_PHONET                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CDNS2_UDC                            policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CDNS3                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CDNS3_GADGET                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CDNS3_HOST                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CDNS3_IMX                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_CDNS3_PCI_WRAP                       policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CDNS3_STARFIVE                       policy<{'riscv64': 'm'}>
+CONFIG_USB_CDNS3_TI                             policy<{'arm64': 'm'}>
+CONFIG_USB_CDNSP_GADGET                         policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CDNSP_HOST                           policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CDNSP_PCI                            policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CDNS_HOST                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CDNS_SUPPORT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_CHAOSKEY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_CHIPIDEA                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_CHIPIDEA_GENERIC                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CHIPIDEA_HOST                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CHIPIDEA_IMX                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CHIPIDEA_MSM                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CHIPIDEA_NPCM                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CHIPIDEA_PCI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CHIPIDEA_TEGRA                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CHIPIDEA_UDC                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_COMMON                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CONFIGFS_ACM                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_ECM                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_ECM_SUBSET                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_EEM                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_FS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_HID                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_LB_SS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_MIDI                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_MIDI2                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_PRINTER                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_TCM                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_UAC1                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_UAC1_LEGACY               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_UAC2                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_F_UVC                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_MASS_STORAGE                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_NCM                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_OBEX                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_PHONET                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_RNDIS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONFIGFS_SERIAL                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_CONN_GPIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_CXACRU                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_CYPRESS_CY7C63                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_CYTHERM                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_DEFAULT_PERSIST                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_DSBR                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_DUMMY_HCD                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_DWC2                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_DWC2_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB_DWC2_DUAL_ROLE                       policy<{'armhf': 'n'}>
+CONFIG_USB_DWC2_HOST                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_DWC2_PCI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_DWC2_PERIPHERAL                      policy<{'armhf': 'n'}>
+CONFIG_USB_DWC2_TRACK_MISSED_SOFS               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB_DWC3                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_DWC3_AM62                            policy<{'arm64': 'm'}>
+CONFIG_USB_DWC3_DUAL_ROLE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_DWC3_EXYNOS                          policy<{'armhf': 'n'}>
+CONFIG_USB_DWC3_GADGET                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_DWC3_HAPS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_DWC3_HOST                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_DWC3_IMX8MP                          policy<{'arm64': 'm'}>
+CONFIG_USB_DWC3_KEYSTONE                        policy<{'arm64': 'm'}>
+CONFIG_USB_DWC3_MESON_G12A                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_DWC3_OF_SIMPLE                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_DWC3_OMAP                            policy<{'armhf': 'm'}>
+CONFIG_USB_DWC3_PCI                             policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_USB_DWC3_QCOM                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_DWC3_RTK                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_DWC3_ULPI                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_DWC3_XILINX                          policy<{'arm64': 'm'}>
+CONFIG_USB_DYNAMIC_MINORS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_EG20T                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_EHCI_EXYNOS                          policy<{'armhf': 'n'}>
+CONFIG_USB_EHCI_FSL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_EHCI_HCD_NPCM7XX                     policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_EHCI_HCD_OMAP                        policy<{'armhf': 'm'}>
+CONFIG_USB_EHCI_HCD_ORION                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_USB_EHCI_HCD_PPC_OF                      policy<{'ppc64el': 'y'}>
+CONFIG_USB_EHCI_PCI                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_EHCI_ROOT_HUB_TT                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_EHCI_TEGRA                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_EHCI_TT_NEWSCHED                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_EHSET_TEST_FIXTURE                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_EMI26                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_EMI62                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_EMXX                                 policy<{'arm64': 'm', 'armhf': 'y', 'riscv64': 'm'}>
+CONFIG_USB_EPSON2888                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_ETH                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_ETH_EEM                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_ETH_RNDIS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_EZUSB_FX2                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_FEW_INIT_RETRIES                     policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB_FHCI_HCD                             policy<{'ppc64el': 'm'}>
+CONFIG_USB_FUNCTIONFS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_FUNCTIONFS_ETH                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_FUNCTIONFS_GENERIC                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_FUNCTIONFS_RNDIS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_F_ACM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_ECM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_EEM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_FS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_HID                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_MASS_STORAGE                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_MIDI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_MIDI2                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_NCM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_OBEX                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_PHONET                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_PRINTER                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_RNDIS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_SERIAL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_SS_LB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_SUBSET                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_TCM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_UAC1                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_UAC1_LEGACY                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_UAC2                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_F_UVC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GADGET                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_GADGETFS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GADGET_DEBUG                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_GADGET_DEBUG_FILES                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_GADGET_DEBUG_FS                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS           policy<{'amd64': '2', 'arm64': '2', 'armhf': '2', 'ppc64el': '2', 'riscv64': '2'}>
+CONFIG_USB_GADGET_TARGET                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GADGET_VBUS_DRAW                     policy<{'amd64': '2', 'arm64': '2', 'armhf': '2', 'ppc64el': '2', 'riscv64': '2'}>
+CONFIG_USB_GADGET_XILINX                        policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GL860                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GOKU                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GPIO_VBUS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_GR_UDC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_BENQ                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_CONEX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_CPIA1                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_DTCS033                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_ETOMS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_FINEPIX                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_JEILINJ                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_JL2005BCD                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_KINECT                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_KONICA                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_MARS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_MR97310A                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_NW80X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_OV519                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_OV534                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_OV534_9                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_PAC207                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_PAC7302                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_PAC7311                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SE401                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SN9C2028                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SN9C20X                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SONIXB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SONIXJ                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SPCA1528                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SPCA500                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SPCA501                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SPCA505                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SPCA506                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SPCA508                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SPCA561                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SQ905                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SQ905C                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SQ930X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_STK014                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_STK1135                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_STV0680                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_SUNPLUS                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_T613                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_TOPRO                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_TOUPTEK                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_TV8532                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_VC032X                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_VICAM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_XIRLINK_CIT                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_GSPCA_ZC3XX                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_G_ACM_MS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_G_DBGP                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_G_DBGP_PRINTK                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_G_DBGP_SERIAL                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_G_HID                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_G_MULTI                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_G_NCM                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_G_NOKIA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_G_PRINTER                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_G_SERIAL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_G_WEBCAM                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_HACKRF                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_HCD_TEST_MODE                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB_HID                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_HIDDEV                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_HSIC_USB3503                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_HSIC_USB4604                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_HSO                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_HUB_USB251XB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_IDMOUSE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_IOWARRIOR                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_IPHETH                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_ISIGHTFW                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_ISP116X_HCD                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_ISP1301                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_ISP1760                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_ISP1760_DUAL_ROLE                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_ISP1760_GADGET_ROLE                  policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_ISP1760_HCD                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_ISP1760_HOST_ROLE                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_ISP1761_UDC                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_KAWETH                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_KBD                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_KC2190                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_KEENE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_LAN78XX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_LCD                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_LD                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_LEDS_TRIGGER_USBPORT                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_LED_TRIG                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_LEGOTOWER                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_LGM_PHY                              policy<{'amd64': 'm'}>
+CONFIG_USB_LIBCOMPOSITE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_LINK_LAYER_TEST                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_LJCA                                 policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_USB_M5602                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_MA901                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_MASS_STORAGE                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_MAX3420_UDC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_MAX3421_HCD                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_MDC800                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_MICROTEK                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_MIDI_GADGET                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_MON                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_MOUSE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_MR800                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_MSI2500                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_MTU3                                 policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_MTU3_DEBUG                           policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_USB_MTU3_DUAL_ROLE                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_USB_MTU3_GADGET                          policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_USB_MTU3_HOST                            policy<{'arm64': 'n', 'armhf': 'n'}>
+CONFIG_USB_MUSB_DSPS                            policy<{'armhf': 'm'}>
+CONFIG_USB_MUSB_DUAL_ROLE                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_MUSB_GADGET                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_MUSB_HOST                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_USB_MUSB_MEDIATEK                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_MUSB_OMAP2PLUS                       policy<{'armhf': 'm'}>
+CONFIG_USB_MUSB_POLARFIRE_SOC                   policy<{'riscv64': 'm'}>
+CONFIG_USB_MUSB_SUNXI                           policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_USB_MUSB_TUSB6010                        policy<{'armhf': 'm'}>
+CONFIG_USB_MV_U3D                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_MV_UDC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_MXS_PHY                              policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_USB_NET2272                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET2272_DMA                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_NET2280                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_AQC111                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_AX88179_178A                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_AX8817X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_CDCETHER                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_CDC_EEM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_CDC_MBIM                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_CDC_NCM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_CDC_SUBSET                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_CDC_SUBSET_ENABLE                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_CH9200                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_CX82310_ETH                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_DM9601                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_DRIVERS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_NET_GL620A                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_HUAWEI_CDC_NCM                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_INT51X1                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_KALMIA                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_MCS7830                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_NET1080                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_PLUSB                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_QMI_WWAN                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_RNDIS_HOST                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_SMSC75XX                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_SMSC95XX                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_SR9700                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_SR9800                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_NET_ZAURUS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_OHCI_EXYNOS                          policy<{'armhf': 'n'}>
+CONFIG_USB_OHCI_HCD                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_OHCI_HCD_PCI                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_OHCI_HCD_PLATFORM                    policy<{'amd64': 'y', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_OHCI_HCD_PPC_OF_BE                   policy<{'ppc64el': 'n'}>
+CONFIG_USB_OHCI_HCD_PPC_OF_LE                   policy<{'ppc64el': 'n'}>
+CONFIG_USB_OHCI_LITTLE_ENDIAN                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_USB_ONBOARD_HUB                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_OTG_DISABLE_EXTERNAL_HUB             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB_OTG_FSM                              policy<{'riscv64': 'm'}>
+CONFIG_USB_OTG_PRODUCTLIST                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB_OXU210HP_HCD                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_PCI                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_PCI_AMD                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_PEGASUS                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_PHY                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_PRINTER                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_PULSE8_CEC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_PWC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_PWC_DEBUG                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB_PWC_INPUT_EVDEV                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_PXA27X                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_QCOM_EUD                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_R8A66597                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_R8A66597_HCD                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_RAINSHADOW_CEC                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_RAREMONO                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_RAW_GADGET                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_RENESAS_USB3                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_USB_RENESAS_USBF                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_USB_RENESAS_USBHS                        policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_USB_RENESAS_USBHS_HCD                    policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_USB_RENESAS_USBHS_UDC                    policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_USB_ROLES_INTEL_XHCI                     policy<{'amd64': 'm'}>
+CONFIG_USB_ROLE_SWITCH                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_RTL8150                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_RTL8152                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_RTL8153_ECM                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_RZV2M_USB3DRD                        policy<{'arm64': 'm'}>
+CONFIG_USB_S2255                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_SERIAL_AIRCABLE                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_ARK3116                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_BELKIN                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_CH341                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_CP210X                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_CYBERJACK                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_CYPRESS_M8                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_EDGEPORT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_EDGEPORT_TI                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_EMPEG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_F81232                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_F8153X                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_FTDI_SIO                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_GARMIN                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_GENERIC                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_SERIAL_IPAQ                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_IPW                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_IR                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_IUU                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_KEYSPAN                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_KEYSPAN_PDA                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_KLSI                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_KOBIL_SCT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_MCT_U232                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_METRO                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_MOS7715_PARPORT               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_SERIAL_MOS7720                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_MOS7840                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_MXUPORT                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_NAVMAN                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_OMNINET                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_OPTICON                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_OPTION                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_OTI6858                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_PL2303                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_QCAUX                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_QT2                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_QUALCOMM                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_SAFE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_SAFE_PADDED                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB_SERIAL_SIERRAWIRELESS                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_SIMPLE                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_SPCP8X5                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_SSU100                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_SYMBOL                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_TI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_UPD78F0730                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_VISOR                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_WHITEHEAT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_WISHBONE                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_WWAN                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_XR                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SERIAL_XSENS_MT                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SEVSEG                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_SI470X                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SI4713                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SIERRA_NET                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SISUSBVGA                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_SL811_CS                             policy<{'amd64': 'm'}>
+CONFIG_USB_SL811_HCD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_SL811_HCD_ISO                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_SNP_CORE                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SNP_UDC_PLAT                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SPEEDTOUCH                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_STORAGE_ALAUDA                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_CYPRESS_ATACB                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_DATAFAB                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_DEBUG                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_USB_STORAGE_ENE_UB6250                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_FREECOM                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_ISD200                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_JUMPSHOT                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_KARMA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_ONETOUCH                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_REALTEK                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_SDDR09                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_SDDR55                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STORAGE_USBAT                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_STV06XX                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_SUPPORT                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_USB_TEGRA_PHY                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_TEGRA_XUDC                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_TEST                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_TMC                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_TRANCEVIBRATOR                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_UAS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_UEAGLEATM                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_UHCI_ASPEED                          policy<{'armhf': 'y'}>
+CONFIG_USB_UHCI_PLATFORM                        policy<{'armhf': 'y'}>
+CONFIG_USB_UHCI_SUPPORT_NON_PCI_HC              policy<{'armhf': 'y'}>
+CONFIG_USB_ULPI                                 policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_USB_ULPI_BUS                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_ULPI_VIEWPORT                        policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_USB_USBNET                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_USS720                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_U_AUDIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_U_ETHER                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_U_SERIAL                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_VIDEO_CLASS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_USB_VL600                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_WDM                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_XEN_HCD                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_USB_XHCI_HISTB                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_XHCI_MTK                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_XHCI_MVEBU                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_XHCI_PCI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_XHCI_PCI_RENESAS                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_XHCI_PLATFORM                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_XHCI_RCAR                            policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_USB_XHCI_RZV2M                           policy<{'arm64': 'y'}>
+CONFIG_USB_XHCI_TEGRA                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_USB_XUSBATM                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_YUREX                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USB_ZERO                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_USB_ZERO_HNPTEST                         policy<{'riscv64': 'n'}>
+CONFIG_USELIB                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_USERFAULTFD                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_USERIO                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_USER_DECRYPTED_DATA                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_USER_EVENTS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_USER_NS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_USER_RETURN_NOTIFIER                     policy<{'amd64': 'y'}>
+CONFIG_USER_STACKTRACE_SUPPORT                  policy<{'amd64': 'y', 's390x': 'y'}>
+CONFIG_USE_OF                                   policy<{'armhf': 'y'}>
+CONFIG_USE_PERCPU_NUMA_NODE_ID                  policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_UTS_NS                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_UVC_COMMON                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_UV_MMTIMER                               policy<{'amd64': 'm'}>
+CONFIG_UV_SYSFS                                 policy<{'amd64': 'm'}>
+CONFIG_U_SERIAL_CONSOLE                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_V4L2_ASYNC                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_V4L2_CCI                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_V4L2_CCI_I2C                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_V4L2_FLASH_LED_CLASS                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_V4L2_FWNODE                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_V4L2_H264                                policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_V4L2_JPEG_HELPER                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_V4L2_MEM2MEM_DEV                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_V4L2_VP9                                 policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_V4L_MEM2MEM_DRIVERS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_V4L_PLATFORM_DRIVERS                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_V4L_TEST_DRIVERS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VALIDATE_FS_PARSER                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VBOXGUEST                                policy<{'amd64': 'm'}>
+CONFIG_VBOXSF_FS                                policy<{'amd64': 'm'}>
+CONFIG_VCAP                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VCNL3020                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VCNL4000                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VCNL4035                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VCPU_STALL_DETECTOR                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VDPA                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_VDPA_SIM                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VDPA_SIM_BLOCK                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VDPA_SIM_NET                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VDPA_USER                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VDSO                                     policy<{'armhf': 'y'}>
+CONFIG_VEML6030                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VEML6070                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VEML6075                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VERSION_SIGNATURE                        policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 'riscv64': '""', 's390x': '""'}>
+CONFIG_VETH                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VEXPRESS_CONFIG                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_VF610_ADC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VF610_DAC                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VFIO_AMBA                                policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VFIO_AP                                  policy<{'s390x': 'm'}>
+CONFIG_VFIO_CCW                                 policy<{'s390x': 'm'}>
+CONFIG_VFIO_CDX                                 policy<{'arm64': 'm'}>
+CONFIG_VFIO_CONTAINER                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VFIO_DEBUGFS                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_VFIO_DEVICE_CDEV                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y'}>
+CONFIG_VFIO_FSL_MC                              policy<{'arm64': 'm'}>
+CONFIG_VFIO_GROUP                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VFIO_IOMMU_SPAPR_TCE                     policy<{'ppc64el': 'm'}>
+CONFIG_VFIO_IOMMU_TYPE1                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 's390x': 'm'}>
+CONFIG_VFIO_MDEV                                policy<{'amd64': 'm', 'arm64': '-', 'armhf': '-', 'ppc64el': '-', 'riscv64': '-', 's390x': 'm'}>
+CONFIG_VFIO_NOIOMMU                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VFIO_PCI_CORE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VFIO_PCI_IGD                             policy<{'amd64': 'y'}>
+CONFIG_VFIO_PCI_INTX                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VFIO_PCI_MMAP                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VFIO_PCI_VGA                             policy<{'amd64': 'y'}>
+CONFIG_VFIO_PLATFORM                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VFIO_PLATFORM_AMDXGBE_RESET              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VFIO_PLATFORM_BASE                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VFIO_PLATFORM_CALXEDAXGMAC_RESET         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VFIO_VIRQFD                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VFP                                      policy<{'armhf': 'y'}>
+CONFIG_VFPv3                                    policy<{'armhf': 'y'}>
+CONFIG_VF_USE_ARM_GLOBAL_TIMER                  policy<{'armhf': 'y'}>
+CONFIG_VF_USE_PIT_TIMER                         policy<{'armhf': 'n'}>
+CONFIG_VGASTATE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VGA_ARB                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VGA_ARB_MAX_GPUS                         policy<{'amd64': '16', 'arm64': '16', 'armhf': '16', 'ppc64el': '16', 'riscv64': '16'}>
+CONFIG_VGA_CONSOLE                              policy<{'amd64': 'y', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_VGA_SWITCHEROO                           policy<{'amd64': 'y'}>
+CONFIG_VHOST                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VHOST_CROSS_ENDIAN_LEGACY                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_VHOST_IOTLB                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VHOST_MENU                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VHOST_NET                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VHOST_RING                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VHOST_SCSI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VHOST_TASK                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VHOST_VDPA                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VHOST_VSOCK                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VIA_RHINE                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_VIA_RHINE_MMIO                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIA_VELOCITY                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_VIA_WDT                                  policy<{'amd64': 'm'}>
+CONFIG_VIDEOBUF2_CORE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEOBUF2_DMA_CONTIG                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEOBUF2_DMA_SG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEOBUF2_DVB                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEOBUF2_MEMOPS                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEOBUF2_V4L2                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEOBUF2_VMALLOC                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEOMODE_HELPERS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_AD5820                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADP1653                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV7170                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV7175                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV7180                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV7183                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV7343                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV7393                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV748X                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV7511                            policy<{'amd64': 'm'}>
+CONFIG_VIDEO_ADV7511_CEC                        policy<{'amd64': 'n'}>
+CONFIG_VIDEO_ADV7604                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV7604_CEC                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_ADV7842                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ADV7842_CEC                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_ADV_DEBUG                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_VIDEO_AK7375                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_AK881X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ALLEGRO_DVT                        policy<{'arm64': 'm'}>
+CONFIG_VIDEO_ALVIUM_CSI2                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_AMPHION_VPU                        policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_APTINA_PLL                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_AR0521                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ASPEED                             policy<{'amd64': '-', 'arm64': '-', 'armhf': 'm', 'ppc64el': '-', 'riscv64': '-'}>
+CONFIG_VIDEO_AU0828                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_AU0828_RC                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_AU0828_V4L2                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_BT819                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_BT848                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_BT856                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_BT866                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CADENCE_CSI2RX                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CADENCE_CSI2TX                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CAFE_CCIC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CAMERA_SENSOR                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_CCS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CCS_PLL                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CMDLINE                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIDEO_COBALT                             policy<{'amd64': 'm'}>
+CONFIG_VIDEO_CODA                               policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_CS3308                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CS5345                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CS53L32A                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX18                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX18_ALSA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX231XX                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX231XX_ALSA                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX231XX_DVB                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX231XX_RC                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_CX2341X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX23885                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX25821                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX25821_ALSA                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX25840                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX88                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX88_ALSA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX88_BLACKBIRD                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX88_DVB                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX88_ENABLE_VP3054                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_CX88_MPEG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_CX88_VP3054                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_DEV                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_DS90UB913                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_DS90UB953                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_DS90UB960                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_DT3155                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_DW100                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_DW9714                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_DW9719                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_DW9768                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_DW9807_VCM                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_EM28XX                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_EM28XX_ALSA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_EM28XX_DVB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_EM28XX_RC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_EM28XX_V4L2                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ET8EK8                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_FB_IVTV                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_FB_IVTV_FORCE_PAT                  policy<{'amd64': 'y'}>
+CONFIG_VIDEO_FIXED_MINOR_RANGES                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_VIDEO_GC0308                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_GC2145                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_GO7007                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_GO7007_LOADER                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_GO7007_USB                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_GS1662                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_HANTRO                             policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_HANTRO_IMX8M                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_VIDEO_HANTRO_ROCKCHIP                    policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_VIDEO_HANTRO_SUNXI                       policy<{'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_HDPVR                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_HEXIUM_GEMINI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_HEXIUM_ORION                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_HI556                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_HI846                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_HI847                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_I2C                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX208                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX214                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX219                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX258                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX274                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX290                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX296                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX319                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX334                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX335                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX355                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX412                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX415                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IMX7_CSI                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_IMX8MQ_MIPI_CSI2                   policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_IMX8_ISI                           policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_IMX8_ISI_M2M                       policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_VIDEO_IMX8_JPEG                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_IMX_MEDIA                          policy<{'arm64': '-', 'armhf': 'm'}>
+CONFIG_VIDEO_IMX_MIPI_CSIS                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_IMX_PXP                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_IMX_VDOA                           policy<{'armhf': 'm'}>
+CONFIG_VIDEO_IPU3_CIO2                          policy<{'amd64': 'm'}>
+CONFIG_VIDEO_IPU3_IMGU                          policy<{'amd64': 'm'}>
+CONFIG_VIDEO_IR_I2C                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ISL7998X                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IVTV                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_IVTV_ALSA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_KS0127                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_LM3560                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_LM3646                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_M52790                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MAX9271_LIB                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MAX9286                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MAX96712                           policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MEDIATEK_JPEG                      policy<{'arm64': 'n'}>
+CONFIG_VIDEO_MEDIATEK_MDP                       policy<{'arm64': 'n'}>
+CONFIG_VIDEO_MEDIATEK_MDP3                      policy<{'arm64': 'n'}>
+CONFIG_VIDEO_MEDIATEK_VCODEC                    policy<{'arm64': 'n'}>
+CONFIG_VIDEO_MEDIATEK_VPU                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_MEM2MEM_DEINTERLACE                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MESON_GE2D                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_MESON_VDEC                         policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_MGB4                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ML86V7667                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MSP3400                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MT9M001                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MT9M111                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MT9M114                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MT9P031                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MT9T112                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MT9V011                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MT9V032                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MT9V111                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MUX                                policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_MXB                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_NOMODESET                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIDEO_NPCM_VCD_ECE                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_OG01A1B                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV01A10                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV02A10                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV08D10                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV08X40                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV13858                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV13B10                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV2640                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV2659                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV2680                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV2685                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV2740                             policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV4689                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV5640                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV5645                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV5647                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV5648                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV5670                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV5675                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV5693                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV5695                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV64A40                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV6650                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV7251                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV7640                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV7670                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV772X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV7740                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV8856                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV8858                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV8865                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV9282                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV9640                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV9650                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_OV9734                             policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_PCI_SKELETON                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_VIDEO_PVRUSB2                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_PVRUSB2_DEBUGIFC                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_VIDEO_PVRUSB2_DVB                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_PVRUSB2_SYSFS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_QCOM_CAMSS                         policy<{'arm64': 'm'}>
+CONFIG_VIDEO_QCOM_VENUS                         policy<{'arm64': 'm'}>
+CONFIG_VIDEO_RCAR_CSI2                          policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RCAR_DRIF                          policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RCAR_ISP                           policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RCAR_VIN                           policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RDACM20                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RDACM21                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RENESAS_CEU                        policy<{'armhf': 'm'}>
+CONFIG_VIDEO_RENESAS_FCP                        policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RENESAS_FDP1                       policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RENESAS_JPU                        policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RENESAS_VSP1                       policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RJ54N1                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ROCKCHIP_ISP1                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_ROCKCHIP_RGA                       policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_ROCKCHIP_VDEC                      policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_RZG2L_CRU                          policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_RZG2L_CSI2                         policy<{'arm64': 'm', 'armhf': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_S5C73M3                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_S5K5BAF                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_S5K6A3                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA6588                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA6752HS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7110                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA711X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7127                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7134                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7134_ALSA                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7134_DVB                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7134_GO7007                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7134_RC                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_SAA7146                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7146_VV                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7164                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA717X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAA7185                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SAMSUNG_EXYNOS4_IS                 policy<{'armhf': 'n'}>
+CONFIG_VIDEO_SAMSUNG_EXYNOS_GSC                 policy<{'armhf': 'n'}>
+CONFIG_VIDEO_SAMSUNG_S5P_G2D                    policy<{'armhf': 'n'}>
+CONFIG_VIDEO_SAMSUNG_S5P_JPEG                   policy<{'armhf': 'n'}>
+CONFIG_VIDEO_SAMSUNG_S5P_MFC                    policy<{'armhf': 'n'}>
+CONFIG_VIDEO_SOLO6X10                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'n', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SONY_BTF_MPX                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_STARFIVE_CAMSS                     policy<{'riscv64': 'm'}>
+CONFIG_VIDEO_STK1160                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_STM32_DCMI                         policy<{'arm64': 'm'}>
+CONFIG_VIDEO_STM32_DCMIPP                       policy<{'arm64': 'm'}>
+CONFIG_VIDEO_STM32_DMA2D                        policy<{'arm64': 'm'}>
+CONFIG_VIDEO_ST_MIPID02                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ST_VGXY61                          policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SUN4I_CSI                          policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_VIDEO_SUN6I_CSI                          policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_VIDEO_SUN6I_ISP                          policy<{'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SUN6I_MIPI_CSI2                    policy<{'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SUN8I_A83T_MIPI_CSI2               policy<{'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_SUN8I_DEINTERLACE                  policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_VIDEO_SUN8I_ROTATE                       policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_VIDEO_SUNXI                              policy<{'arm64': 'y', 'armhf': '-', 'riscv64': 'y'}>
+CONFIG_VIDEO_SUNXI_CEDRUS                       policy<{'arm64': 'm', 'armhf': '-', 'riscv64': 'm'}>
+CONFIG_VIDEO_TC358743                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TC358743_CEC                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_TC358746                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TDA1997X                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TDA7432                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TDA9840                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TEA6415C                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TEA6420                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TEGRA                              policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_TEGRA_TPG                          policy<{'arm64': 'y', 'armhf': '-'}>
+CONFIG_VIDEO_TEGRA_VDE                          policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_THP7312                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_THS7303                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_THS8200                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TI_CAL                             policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_VIDEO_TI_CAL_MC                          policy<{'arm64': 'y', 'armhf': 'y'}>
+CONFIG_VIDEO_TI_CSC                             policy<{'armhf': 'm'}>
+CONFIG_VIDEO_TI_J721E_CSI2RX                    policy<{'arm64': 'm'}>
+CONFIG_VIDEO_TI_SC                              policy<{'armhf': 'm'}>
+CONFIG_VIDEO_TI_VPDMA                           policy<{'armhf': 'm'}>
+CONFIG_VIDEO_TI_VPE                             policy<{'armhf': 'm'}>
+CONFIG_VIDEO_TI_VPE_DEBUG                       policy<{'armhf': 'n'}>
+CONFIG_VIDEO_TLV320AIC23B                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TUNER                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TVAUDIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TVEEPROM                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TVP514X                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TVP5150                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TVP7002                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TW2804                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TW5864                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TW68                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TW686X                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TW9900                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TW9903                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TW9906                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_TW9910                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_UDA1342                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_UPD64031A                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_UPD64083                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_USBTV                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_V4L2_I2C                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_V4L2_SUBDEV_API                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_V4L2_TPG                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_VIA_CAMERA                         policy<{'amd64': 'm'}>
+CONFIG_VIDEO_VICODEC                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_VIM2M                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_VISL                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_VIVID                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_VIVID_CEC                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIDEO_VIVID_MAX_DEVS                     policy<{'amd64': '64', 'arm64': '64', 'armhf': '64', 'ppc64el': '64', 'riscv64': '64'}>
+CONFIG_VIDEO_VP27SMPX                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_VPX3220                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_WAVE_VPU                           policy<{'arm64': 'm'}>
+CONFIG_VIDEO_WM8739                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_WM8775                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_XILINX                             policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_XILINX_CSI2RXSS                    policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_XILINX_TPG                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_XILINX_VTC                         policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIDEO_ZORAN                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_VIPERBOARD_ADC                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIRTIO                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_ANCHOR                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_BALLOON                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_CONSOLE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_DMA_SHARED_BUFFER                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VIRTIO_FS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VIRTIO_INPUT                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VIRTIO_IOMMU                             policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_VIRTIO_MEM                               policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_VIRTIO_MENU                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIRTIO_PCI                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_PCI_ADMIN_LEGACY                  policy<{'amd64': 'y'}>
+CONFIG_VIRTIO_PCI_LEGACY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_PCI_LIB                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_PCI_LIB_LEGACY                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRTIO_PMEM                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_VIRTIO_VDPA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VIRTIO_VFIO_PCI                          policy<{'amd64': 'm'}>
+CONFIG_VIRTIO_VSOCKETS                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VIRTIO_VSOCKETS_COMMON                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VIRTUALIZATION                           policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRT_CPU_ACCOUNTING                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRT_CPU_ACCOUNTING_GEN                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VIRT_CPU_ACCOUNTING_NATIVE               policy<{'ppc64el': 'n', 's390x': 'y'}>
+CONFIG_VIRT_DRIVERS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VIRT_WIFI                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VISCONTI_WATCHDOG                        policy<{'arm64': 'm'}>
+CONFIG_VISL_DEBUGFS                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_VITESSE_PHY                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VL53L0X_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VL6180                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VLAN_8021Q                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VLAN_8021Q_GVRP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VLAN_8021Q_MVRP                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VMAP_PFN                                 policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VMAP_STACK                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VMCP                                     policy<{'s390x': 'y'}>
+CONFIG_VMCP_CMA_SIZE                            policy<{'s390x': '4'}>
+CONFIG_VMD                                      policy<{'amd64': 'm'}>
+CONFIG_VME_BUS                                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_VME_FAKE                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_VME_TSI148                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_VME_USER                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_VMGENID                                  policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_VMLINUX_MAP                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VMLOGRDR                                 policy<{'s390x': 'm'}>
+CONFIG_VMSPLIT_1G                               policy<{'armhf': 'n'}>
+CONFIG_VMSPLIT_2G                               policy<{'armhf': 'n'}>
+CONFIG_VMSPLIT_3G                               policy<{'armhf': 'y'}>
+CONFIG_VMWARE_BALLOON                           policy<{'amd64': 'm'}>
+CONFIG_VMWARE_PVSCSI                            policy<{'amd64': 'm'}>
+CONFIG_VMWARE_VMCI                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_VMWARE_VMCI_VSOCKETS                     policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_VMXNET3                                  policy<{'amd64': 'm', 'arm64': 'm', 'arm64-generic-64k': '-', 'armhf': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_VM_EVENT_COUNTERS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VORTEX                                   policy<{'amd64': 'm', 'arm64': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VP_VDPA                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VSOCKETS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VSOCKETS_DIAG                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VSOCKETS_LOOPBACK                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VSOCKMON                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VSX                                      policy<{'ppc64el': 'y'}>
+CONFIG_VT                                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VT6655                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VT6656                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_VT_CONSOLE                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VT_CONSOLE_SLEEP                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_VT_HW_CONSOLE_BINDING                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_VXFS_FS                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_VXLAN                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_VZ89X                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_W1                                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_W1_CON                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': '-'}>
+CONFIG_W1_MASTER_AMD_AXI                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_W1_MASTER_DS2482                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_MASTER_DS2490                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_MASTER_GPIO                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_MASTER_MATROX                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_MASTER_MXC                            policy<{'arm64': 'm', 'armhf': 'm'}>
+CONFIG_W1_MASTER_SGI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2405                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2406                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2408                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2408_READBACK                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_W1_SLAVE_DS2413                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2423                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2430                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2431                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2433                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2433_CRC                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2438                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS250X                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2780                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2781                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS2805                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS28E04                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_DS28E17                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_SMEM                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W1_SLAVE_THERM                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_W83627HF_WDT                             policy<{'amd64': 'm'}>
+CONFIG_W83877F_WDT                              policy<{'amd64': 'm'}>
+CONFIG_W83977F_WDT                              policy<{'amd64': 'm'}>
+CONFIG_WAFER_WDT                                policy<{'amd64': 'm'}>
+CONFIG_WAN                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_WANT_COMPAT_NETLINK_MESSAGES             policy<{'amd64': 'y'}>
+CONFIG_WANT_DEV_COREDUMP                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WANXL                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WARN_ALL_UNSEEDED_RANDOM                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_WATCHDOG                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_WATCHDOG_CORE                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_WATCHDOG_HRTIMER_PRETIMEOUT              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_WATCHDOG_NOWAYOUT                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_WATCHDOG_OPEN_TIMEOUT                    policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
+CONFIG_WATCHDOG_PRETIMEOUT_DEFAULT_GOV_NOOP     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_WATCHDOG_PRETIMEOUT_DEFAULT_GOV_PANIC    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_WATCHDOG_PRETIMEOUT_GOV                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_WATCHDOG_PRETIMEOUT_GOV_NOOP             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_WATCHDOG_PRETIMEOUT_GOV_PANIC            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_WATCHDOG_PRETIMEOUT_GOV_SEL              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_WATCHDOG_RTAS                            policy<{'ppc64el': 'm'}>
+CONFIG_WATCHDOG_SYSFS                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_WATCH_QUEUE                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_WCN36XX                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WCN36XX_DEBUGFS                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_WDAT_WDT                                 policy<{'amd64': 'm', 'arm64': 'm', 'riscv64': 'm'}>
+CONFIG_WDTPCI                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_WERROR                                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_WEXT_CORE                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WEXT_PRIV                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WEXT_PROC                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WEXT_SPY                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WFX                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WIL6210                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WIL6210_DEBUGFS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WIL6210_ISR_COR                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WIL6210_TRACING                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WILC1000                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WILC1000_HW_OOB_INTR                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WILC1000_SDIO                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WILC1000_SPI                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WILCO_EC                                 policy<{'amd64': 'm'}>
+CONFIG_WILCO_EC_DEBUGFS                         policy<{'amd64': 'm'}>
+CONFIG_WILCO_EC_EVENTS                          policy<{'amd64': 'm'}>
+CONFIG_WILCO_EC_TELEMETRY                       policy<{'amd64': 'm'}>
+CONFIG_WINBOND_840                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_WINDFARM                                 policy<{'ppc64el': 'm'}>
+CONFIG_WINMATE_FM07_KEYS                        policy<{'amd64': 'm'}>
+CONFIG_WIREGUARD                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_WIREGUARD_DEBUG                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_WIRELESS                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WIRELESS_EXT                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WIRELESS_HOTKEY                          policy<{'amd64': 'm'}>
+CONFIG_WIZNET_BUS_ANY                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WIZNET_BUS_DIRECT                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_WIZNET_BUS_INDIRECT                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': '-'}>
+CONFIG_WIZNET_W5100                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_WIZNET_W5100_SPI                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WIZNET_W5300                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_WL1251                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WL1251_SDIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WL1251_SPI                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WL12XX                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WL18XX                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WLAN                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_ADMTEK                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_ATH                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_ATMEL                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_BROADCOM                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_INTEL                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_INTERSIL                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_MARVELL                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_MEDIATEK                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_MICROCHIP                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_PURELIFI                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_QUANTENNA                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_RALINK                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_REALTEK                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_RSI                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_SILABS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_ST                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_TI                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLAN_VENDOR_ZYDAS                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WLCORE                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WLCORE_SDIO                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WLCORE_SPI                               policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_WM831X_BACKUP                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_WM831X_POWER                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_WM831X_WATCHDOG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_WM8350_POWER                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_WM8350_WATCHDOG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_WMI_BMOF                                 policy<{'amd64': 'm'}>
+CONFIG_WPCM450_SOC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_WQ_CPU_INTENSIVE_REPORT                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_WQ_POWER_EFFICIENT_DEFAULT               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'n'}>
+CONFIG_WQ_WATCHDOG                              policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_WWAN_DEBUGFS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_WWAN_HWSIM                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_WW_MUTEX_SELFTEST                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_X25                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_X86                                      policy<{'amd64': 'y'}>
+CONFIG_X86_16BIT                                policy<{'amd64': 'y'}>
+CONFIG_X86_5LEVEL                               policy<{'amd64': 'y'}>
+CONFIG_X86_64                                   policy<{'amd64': 'y'}>
+CONFIG_X86_64_ACPI_NUMA                         policy<{'amd64': 'y'}>
+CONFIG_X86_64_SMP                               policy<{'amd64': 'y'}>
+CONFIG_X86_ACPI_CPUFREQ_CPB                     policy<{'amd64': 'y'}>
+CONFIG_X86_AMD_FREQ_SENSITIVITY                 policy<{'amd64': 'm'}>
+CONFIG_X86_AMD_PLATFORM_DEVICE                  policy<{'amd64': 'y'}>
+CONFIG_X86_AMD_PSTATE                           policy<{'amd64': 'y'}>
+CONFIG_X86_AMD_PSTATE_DEFAULT_MODE              policy<{'amd64': '3'}>
+CONFIG_X86_AMD_PSTATE_UT                        policy<{'amd64': 'n'}>
+CONFIG_X86_ANDROID_TABLETS                      policy<{'amd64': 'm'}>
+CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK    policy<{'amd64': 'y'}>
+CONFIG_X86_CET                                  policy<{'amd64': 'y'}>
+CONFIG_X86_CHECK_BIOS_CORRUPTION                policy<{'amd64': 'y'}>
+CONFIG_X86_CMOV                                 policy<{'amd64': 'y'}>
+CONFIG_X86_CMPXCHG64                            policy<{'amd64': 'y'}>
+CONFIG_X86_CPA_STATISTICS                       policy<{'amd64': 'n'}>
+CONFIG_X86_CPUID                                policy<{'amd64': 'm'}>
+CONFIG_X86_CPU_RESCTRL                          policy<{'amd64': 'y'}>
+CONFIG_X86_DEBUGCTLMSR                          policy<{'amd64': 'y'}>
+CONFIG_X86_DEBUG_FPU                            policy<{'amd64': 'y'}>
+CONFIG_X86_DECODER_SELFTEST                     policy<{'amd64': 'n'}>
+CONFIG_X86_DIRECT_GBPAGES                       policy<{'amd64': 'y'}>
+CONFIG_X86_ESPFIX64                             policy<{'amd64': 'y'}>
+CONFIG_X86_EXTENDED_PLATFORM                    policy<{'amd64': 'y'}>
+CONFIG_X86_GOLDFISH                             policy<{'amd64': 'n'}>
+CONFIG_X86_HAVE_PAE                             policy<{'amd64': 'y'}>
+CONFIG_X86_HV_CALLBACK_VECTOR                   policy<{'amd64': 'y'}>
+CONFIG_X86_INTEL_LPSS                           policy<{'amd64': 'y'}>
+CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS         policy<{'amd64': 'y'}>
+CONFIG_X86_INTEL_MID                            policy<{'amd64': 'n'}>
+CONFIG_X86_INTEL_PSTATE                         policy<{'amd64': 'y'}>
+CONFIG_X86_INTEL_TSX_MODE_AUTO                  policy<{'amd64': 'n'}>
+CONFIG_X86_INTEL_TSX_MODE_OFF                   policy<{'amd64': 'y'}>
+CONFIG_X86_INTEL_TSX_MODE_ON                    policy<{'amd64': 'n'}>
+CONFIG_X86_INTERNODE_CACHE_SHIFT                policy<{'amd64': '6'}>
+CONFIG_X86_IOPL_IOPERM                          policy<{'amd64': 'y'}>
+CONFIG_X86_IO_APIC                              policy<{'amd64': 'y'}>
+CONFIG_X86_L1_CACHE_SHIFT                       policy<{'amd64': '6'}>
+CONFIG_X86_LOCAL_APIC                           policy<{'amd64': 'y'}>
+CONFIG_X86_MCE                                  policy<{'amd64': 'y'}>
+CONFIG_X86_MCELOG_LEGACY                        policy<{'amd64': 'y'}>
+CONFIG_X86_MCE_AMD                              policy<{'amd64': 'y'}>
+CONFIG_X86_MCE_INJECT                           policy<{'amd64': 'm'}>
+CONFIG_X86_MCE_INTEL                            policy<{'amd64': 'y'}>
+CONFIG_X86_MCE_THRESHOLD                        policy<{'amd64': 'y'}>
+CONFIG_X86_MEM_ENCRYPT                          policy<{'amd64': 'y'}>
+CONFIG_X86_MINIMUM_CPU_FAMILY                   policy<{'amd64': '64'}>
+CONFIG_X86_MPPARSE                              policy<{'amd64': 'y'}>
+CONFIG_X86_MSR                                  policy<{'amd64': 'm'}>
+CONFIG_X86_NEED_RELOCS                          policy<{'amd64': 'y'}>
+CONFIG_X86_NUMACHIP                             policy<{'amd64': 'y'}>
+CONFIG_X86_P4_CLOCKMOD                          policy<{'amd64': 'm'}>
+CONFIG_X86_PAT                                  policy<{'amd64': 'y'}>
+CONFIG_X86_PKG_TEMP_THERMAL                     policy<{'amd64': 'm'}>
+CONFIG_X86_PLATFORM_DEVICES                     policy<{'amd64': 'y'}>
+CONFIG_X86_PLATFORM_DRIVERS_DELL                policy<{'amd64': 'y'}>
+CONFIG_X86_PLATFORM_DRIVERS_HP                  policy<{'amd64': 'y'}>
+CONFIG_X86_PMEM_LEGACY                          policy<{'amd64': 'y'}>
+CONFIG_X86_PMEM_LEGACY_DEVICE                   policy<{'amd64': 'y'}>
+CONFIG_X86_PM_TIMER                             policy<{'amd64': 'y'}>
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS         policy<{'amd64': 'y'}>
+CONFIG_X86_SGX                                  policy<{'amd64': 'y'}>
+CONFIG_X86_SGX_KVM                              policy<{'amd64': 'y'}>
+CONFIG_X86_SPEEDSTEP_LIB                        policy<{'amd64': 'm'}>
+CONFIG_X86_SUPPORTS_MEMORY_FAILURE              policy<{'amd64': 'y'}>
+CONFIG_X86_THERMAL_VECTOR                       policy<{'amd64': 'y'}>
+CONFIG_X86_TSC                                  policy<{'amd64': 'y'}>
+CONFIG_X86_UMIP                                 policy<{'amd64': 'y'}>
+CONFIG_X86_USER_SHADOW_STACK                    policy<{'amd64': 'y'}>
+CONFIG_X86_VERBOSE_BOOTUP                       policy<{'amd64': 'n'}>
+CONFIG_X86_VMX_FEATURE_NAMES                    policy<{'amd64': 'y'}>
+CONFIG_X86_VSMP                                 policy<{'amd64': 'n'}>
+CONFIG_X86_VSYSCALL_EMULATION                   policy<{'amd64': 'y'}>
+CONFIG_X86_X2APIC                               policy<{'amd64': 'y'}>
+CONFIG_X9250                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XARRAY_MULTI                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XDP_SOCKETS                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XDP_SOCKETS_DIAG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XEN                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'n'}>
+CONFIG_XENFS                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_ACPI                                 policy<{'amd64': 'y'}>
+CONFIG_XEN_AUTO_XLATE                           policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_XEN_BACKEND                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_BALLOON                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_BALLOON_MEMORY_HOTPLUG               policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_XEN_BLKDEV_BACKEND                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_COMPAT_XENFS                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_DEBUG_FS                             policy<{'amd64': 'n'}>
+CONFIG_XEN_DEV_EVTCHN                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_DOM0                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_EFI                                  policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_XEN_FBDEV_FRONTEND                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_FRONT_PGDIR_SHBUF                    policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_XEN_GNTDEV                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_GNTDEV_DMABUF                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_GRANT_DEV_ALLOC                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_GRANT_DMA_ALLOC                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_GRANT_DMA_IOMMU                      policy<{'arm64': 'y'}>
+CONFIG_XEN_GRANT_DMA_OPS                        policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_XEN_HAVE_PVMMU                           policy<{'amd64': 'y'}>
+CONFIG_XEN_HAVE_VPMU                            policy<{'amd64': 'y'}>
+CONFIG_XEN_MCE_LOG                              policy<{'amd64': 'y'}>
+CONFIG_XEN_MEMORY_HOTPLUG_LIMIT                 policy<{'amd64': '512'}>
+CONFIG_XEN_NETDEV_BACKEND                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_PCIDEV_BACKEND                       policy<{'amd64': 'm'}>
+CONFIG_XEN_PCIDEV_FRONTEND                      policy<{'amd64': 'm'}>
+CONFIG_XEN_PCIDEV_STUB                          policy<{'arm64': 'm'}>
+CONFIG_XEN_PCI_STUB                             policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_XEN_PRIVCMD                              policy<{'amd64': 'm', 'arm64': 'm'}>
+CONFIG_XEN_PRIVCMD_EVENTFD                      policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_XEN_PV                                   policy<{'amd64': 'y'}>
+CONFIG_XEN_PVCALLS_BACKEND                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': '-'}>
+CONFIG_XEN_PVCALLS_FRONTEND                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_PVH                                  policy<{'amd64': 'y'}>
+CONFIG_XEN_PVHVM                                policy<{'amd64': 'y'}>
+CONFIG_XEN_PVHVM_GUEST                          policy<{'amd64': 'y'}>
+CONFIG_XEN_PVHVM_SMP                            policy<{'amd64': 'y'}>
+CONFIG_XEN_PV_DOM0                              policy<{'amd64': 'y'}>
+CONFIG_XEN_PV_MSR_SAFE                          policy<{'amd64': 'y'}>
+CONFIG_XEN_PV_SMP                               policy<{'amd64': 'y'}>
+CONFIG_XEN_SAVE_RESTORE                         policy<{'amd64': 'y'}>
+CONFIG_XEN_SCRUB_PAGES_DEFAULT                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_SCSI_BACKEND                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_SCSI_FRONTEND                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_SYMS                                 policy<{'amd64': 'y'}>
+CONFIG_XEN_SYS_HYPERVISOR                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': '-'}>
+CONFIG_XEN_UNPOPULATED_ALLOC                    policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_XEN_VIRTIO                               policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_XEN_VIRTIO_FORCE_GRANT                   policy<{'amd64': 'n', 'arm64': 'n'}>
+CONFIG_XEN_WDT                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': '-'}>
+CONFIG_XEN_XENBUS_FRONTEND                      policy<{'amd64': 'y', 'arm64': 'y'}>
+CONFIG_XFRM                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XFRM_AH                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XFRM_ALGO                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XFRM_ESP                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XFRM_ESPINTCP                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XFRM_INTERFACE                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XFRM_IPCOMP                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XFRM_MIGRATE                             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_XFRM_OFFLOAD                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XFRM_STATISTICS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XFRM_SUB_POLICY                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_XFRM_USER                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XFRM_USER_COMPAT                         policy<{'amd64': 'm'}>
+CONFIG_XFS_DEBUG                                policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_XFS_FS                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XFS_ONLINE_SCRUB                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_XFS_POSIX_ACL                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XFS_QUOTA                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XFS_RT                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XFS_SUPPORT_ASCII_CI                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XFS_SUPPORT_V4                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XFS_WARN                                 policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_XGENE_DMA                                policy<{'arm64': 'm'}>
+CONFIG_XGENE_PMU                                policy<{'arm64': 'y'}>
+CONFIG_XGENE_SLIMPRO_MBOX                       policy<{'arm64': 'm'}>
+CONFIG_XIAOMI_WMI                               policy<{'amd64': 'm'}>
+CONFIG_XILINX_AMS                               policy<{'arm64': 'm'}>
+CONFIG_XILINX_AXI_EMAC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_XILINX_DMA                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XILINX_EMACLITE                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_XILINX_GMII2RGMII                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XILINX_INTC                              policy<{'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_XILINX_LL_TEMAC                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_XILINX_PR_DECOUPLER                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XILINX_SDFEC                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_XILINX_VCU                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_XILINX_WATCHDOG                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_XILINX_WINDOW_WATCHDOG                   policy<{'arm64': 'm'}>
+CONFIG_XILINX_XADC                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XILINX_XDMA                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XILINX_ZYNQMP_DMA                        policy<{'arm64': 'm'}>
+CONFIG_XILINX_ZYNQMP_DPDMA                      policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XILLYBUS                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_XILLYBUS_CLASS                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XILLYBUS_OF                              policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XILLYBUS_PCIE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XILLYUSB                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': '-'}>
+CONFIG_XIL_AXIS_FIFO                            policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_XLNX_EVENT_MANAGER                       policy<{'arm64': 'y'}>
+CONFIG_XLNX_R5_REMOTEPROC                       policy<{'arm64': 'm'}>
+CONFIG_XMON                                     policy<{'ppc64el': 'y'}>
+CONFIG_XMON_DEFAULT                             policy<{'ppc64el': 'n'}>
+CONFIG_XMON_DEFAULT_RO_MODE                     policy<{'ppc64el': 'y'}>
+CONFIG_XMON_DISASSEMBLY                         policy<{'ppc64el': 'y'}>
+CONFIG_XOR_BLOCKS                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_XPOWER_PMIC_OPREGION                     policy<{'amd64': 'y'}>
+CONFIG_XPS                                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XXHASH                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XZ_DEC_ARM                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_XZ_DEC_ARMTHUMB                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_XZ_DEC_BCJ                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_XZ_DEC_MICROLZMA                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_XZ_DEC_POWERPC                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_XZ_DEC_SPARC                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_XZ_DEC_TEST                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_XZ_DEC_X86                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'n'}>
+CONFIG_YAM                                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_YAMAHA_YAS530                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_YELLOWFIN                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_YENTA                                    policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': '-'}>
+CONFIG_YENTA_ENE_TUNE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': '-'}>
+CONFIG_YENTA_O2                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': '-'}>
+CONFIG_YENTA_RICOH                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': '-'}>
+CONFIG_YENTA_TI                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': '-'}>
+CONFIG_YENTA_TOSHIBA                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': '-'}>
+CONFIG_YOGABOOK                                 policy<{'amd64': 'm'}>
+CONFIG_Z3FOLD                                   policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_Z3FOLD_DEPRECATED                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ZBOOT_ROM_BSS                            policy<{'armhf': '0x0'}>
+CONFIG_ZBOOT_ROM_TEXT                           policy<{'armhf': '0x0'}>
+CONFIG_ZBUD                                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZCRYPT                                   policy<{'s390x': 'm'}>
+CONFIG_ZCRYPT_DEBUG                             policy<{'s390x': 'n'}>
+CONFIG_ZD1211RW                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ZD1211RW_DEBUG                           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n'}>
+CONFIG_ZEROPLUS_FF                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y'}>
+CONFIG_ZERO_CALL_USED_REGS                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZFCP                                     policy<{'s390x': 'm'}>
+CONFIG_ZIIRAVE_WATCHDOG                         policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'n'}>
+CONFIG_ZISOFS                                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZLIB_DEFLATE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZLIB_INFLATE                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZONEFS_FS                                policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ZONE_DEVICE                              policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y'}>
+CONFIG_ZONE_DMA32                               policy<{'amd64': 'y', 'arm64': 'y', 'riscv64': 'y'}>
+CONFIG_ZOPT2201                                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ZPA2326                                  policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ZPA2326_I2C                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ZPA2326_SPI                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm'}>
+CONFIG_ZPOOL                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZRAM                                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
+CONFIG_ZRAM_DEF_COMP                            policy<{'amd64': '"lzo-rle"', 'arm64': '"lzo-rle"', 'armhf': '"lzo-rle"', 'ppc64el': '"lzo-rle"', 'riscv64': '"lzo-rle"', 's390x': '"lzo-rle"'}>
+CONFIG_ZRAM_DEF_COMP_842                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZRAM_DEF_COMP_LZ4                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZRAM_DEF_COMP_LZ4HC                      policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZRAM_DEF_COMP_LZO                        policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZRAM_DEF_COMP_LZORLE                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZRAM_DEF_COMP_ZSTD                       policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZRAM_MEMORY_TRACKING                     policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZRAM_MULTI_COMP                          policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZRAM_TRACK_ENTRY_ACTIME                  policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZRAM_WRITEBACK                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZSMALLOC                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZSMALLOC_CHAIN_SIZE                      policy<{'amd64': '8', 'arm64': '8', 'armhf': '8', 'ppc64el': '8', 'riscv64': '8', 's390x': '8'}>
+CONFIG_ZSMALLOC_STAT                            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZSTD_COMMON                              policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZSTD_COMPRESS                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZSTD_DECOMPRESS                          policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZSWAP                                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZSWAP_COMPRESSOR_DEFAULT                 policy<{'amd64': '"lzo"', 'arm64': '"lzo"', 'armhf': '"lzo"', 'ppc64el': '"lzo"', 'riscv64': '"lzo"', 's390x': '"lzo"'}>
+CONFIG_ZSWAP_COMPRESSOR_DEFAULT_842             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZSWAP_COMPRESSOR_DEFAULT_DEFLATE         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4HC           policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZO             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD            policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZSWAP_DEFAULT_ON                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZSWAP_EXCLUSIVE_LOADS_DEFAULT_ON         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZSWAP_SHRINKER_DEFAULT_ON                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZSWAP_ZPOOL_DEFAULT                      policy<{'amd64': '"zbud"', 'arm64': '"zbud"', 'armhf': '"zbud"', 'ppc64el': '"zbud"', 'riscv64': '"zbud"', 's390x': '"zbud"'}>
+CONFIG_ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZSWAP_ZPOOL_DEFAULT_ZBUD                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 'riscv64': 'y', 's390x': 'y'}>
+CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
+CONFIG_ZYNQMP_FIRMWARE                          policy<{'arm64': 'y'}>
+CONFIG_ZYNQMP_FIRMWARE_DEBUG                    policy<{'arm64': 'n'}>
+CONFIG_ZYNQMP_IPI_MBOX                          policy<{'arm64': 'y'}>
+CONFIG_ZYNQMP_PM_DOMAINS                        policy<{'arm64': 'y'}>
+CONFIG_ZYNQMP_POWER                             policy<{'arm64': 'y'}>
--- linux-qcom-6.8.0.orig/debian.master/control.d/flavour-control.stub
+++ linux-qcom-6.8.0/debian.master/control.d/flavour-control.stub
@@ -0,0 +1,153 @@
+# Items that get replaced:
+# FLAVOUR
+# DESC
+# ARCH
+# SUPPORTED
+# TARGET
+# BOOTLOADER
+# =PROVIDES=
+#
+# Items marked with =FOO= are optional
+#
+# This file describes the template for packages that are created for each flavour
+# in debian/control.d/vars.*
+#
+# This file gets edited in a couple of places. See the debian/control.stub rule in
+# debian/rules. PGGVER, ABINUM, and SRCPKGNAME are all converted in the
+# process of creating debian/control.
+#
+# The flavour specific strings (ARCH, DESC, etc) are converted using values from the various
+# flavour files in debian/control.d/vars.*
+#
+# XXX: Leave the blank line before the first package!!
+
+Package: linux-image=SIGN-ME-PKG=-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: kernel
+Priority: optional
+Provides: linux-image, fuse-module, =PROVIDES=${linux:rprovides}
+Depends: ${misc:Depends}, ${shlibs:Depends}, kmod, linux-base (>= 4.5ubuntu1~16.04.1), linux-modules-PKGVER-ABINUM-FLAVOUR
+Recommends: BOOTLOADER, initramfs-tools | linux-initramfs-tool
+Breaks: flash-kernel (<< 3.90ubuntu2) [arm64 armhf], s390-tools (<< 2.3.0-0ubuntu3) [s390x]
+Conflicts: linux-image=SIGN-PEER-PKG=-PKGVER-ABINUM-FLAVOUR
+Suggests: fdutils, SRCPKGNAME-tools, linux-headers-PKGVER-ABINUM-FLAVOUR, linux-modules-extra-PKGVER-ABINUM-FLAVOUR
+Description: Linux kernel image for version PKGVER on DESC
+ This package contains the=SIGN-ME-TXT= Linux kernel image for version PKGVER on
+ DESC.
+ .
+ Supports SUPPORTED processors.
+ .
+ TARGET
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-FLAVOUR meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-modules-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: kernel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Built-Using: ${linux:BuiltUsing}
+Description: Linux kernel extra modules for version PKGVER on DESC
+ Contains the corresponding System.map file, the modules built by the
+ packager, and scripts that try to ensure that the system is not left in an
+ unbootable state after an update.
+ .
+ Supports SUPPORTED processors.
+ .
+ TARGET
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-FLAVOUR meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-modules-extra-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: kernel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}, linux-modules-PKGVER-ABINUM-FLAVOUR, wireless-regdb
+Description: Linux kernel extra modules for version PKGVER on DESC
+ This package contains the Linux kernel extra modules for version PKGVER on
+ DESC.
+ .
+ Also includes the corresponding System.map file, the modules built by the
+ packager, and scripts that try to ensure that the system is not left in an
+ unbootable state after an update.
+ .
+ Supports SUPPORTED processors.
+ .
+ TARGET
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-FLAVOUR meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-headers-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, SRCPKGNAME-headers-PKGVER-ABINUM, ${shlibs:Depends}
+Provides: linux-headers, linux-headers-3.0
+Description: Linux kernel headers for version PKGVER on DESC
+ This package provides kernel header files for version PKGVER on
+ DESC.
+ .
+ This is for sites that want the latest kernel headers.  Please read
+ /usr/share/doc/linux-headers-PKGVER-ABINUM/debian.README.gz for details.
+
+Package: SRCPKGNAME-lib-rust-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: amd64
+Multi-Arch: foreign
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, coreutils
+Description: Rust library files related to Linux kernel version PKGVER
+ This package provides kernel library files for version PKGVER, that allow to
+ compile out-of-tree kernel modules written in Rust.
+
+Package: linux-image=SIGN-ME-PKG=-PKGVER-ABINUM-FLAVOUR-dbgsym
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}
+Provides: linux-debug
+Description: Linux kernel debug image for version PKGVER on DESC
+ This package provides the=SIGN-ME-TXT= kernel debug image for version PKGVER on
+ DESC.
+ .
+ This is for sites that wish to debug the kernel.
+ .
+ The kernel image contained in this package is NOT meant to boot from. It
+ is uncompressed, and unstripped. This package also includes the
+ unstripped modules.
+
+Package: linux-tools-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, SRCPKGNAME-tools-PKGVER-ABINUM
+Description: Linux kernel version specific tools for version PKGVER-ABINUM
+ This package provides the architecture dependant parts for kernel
+ version locked tools (such as perf and x86_energy_perf_policy) for
+ version PKGVER-ABINUM on
+ =HUMAN=.
+
+Package: linux-cloud-tools-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, SRCPKGNAME-cloud-tools-PKGVER-ABINUM
+Description: Linux kernel version specific cloud tools for version PKGVER-ABINUM
+ This package provides the architecture dependant parts for kernel
+ version locked tools for cloud for version PKGVER-ABINUM on
+ =HUMAN=.
+
--- linux-qcom-6.8.0.orig/debian.master/control.d/generic.inclusion-list
+++ linux-qcom-6.8.0/debian.master/control.d/generic.inclusion-list
@@ -0,0 +1,307 @@
+arch/*/{crypto,kernel,oprofile}
+arch/*/kvm/kvm.ko
+arch/powerpc/kvm/kvm-hv.ko
+arch/powerpc/kvm/kvm-pr.ko
+arch/powerpc/kvm/vfio.ko
+arch/powerpc/platforms/powernv/opal-prd.ko
+arch/s390/*
+arch/x86/kvm/kvm-amd.ko
+arch/x86/kvm/kvm-intel.ko
+crypto/*
+drivers/acpi/*
+drivers/ata/acard-ahci.ko
+drivers/ata/ahci.ko
+drivers/ata/ahci_platform.ko
+drivers/ata/ahci_tegra.ko
+drivers/ata/ata_generic.ko
+drivers/ata/libahci.ko
+drivers/ata/libahci_platform.ko
+drivers/block/brd.ko
+drivers/block/cryptoloop.ko
+drivers/block/floppy.ko
+drivers/block/loop.ko
+drivers/block/nbd.ko
+drivers/block/rbd.ko
+drivers/block/virtio_blk.ko
+drivers/block/xen-blkfront.ko
+drivers/bus/tegra-aconnect.ko
+drivers/char/hangcheck-timer.ko
+drivers/char/hw_random/powernv-rng.ko
+drivers/char/hw_random/virtio-rng.ko
+drivers/char/ipmi/*
+drivers/char/ipmi/ipmi_msghandler.ko
+drivers/char/lp.ko
+drivers/char/nvram.ko
+drivers/char/ppdev.ko
+drivers/char/raw.ko
+drivers/char/virtio_console.ko
+drivers/clk/clk-max77686.ko
+drivers/cpufreq/tegra186-cpufreq.ko
+drivers/cpufreq/tegra194-cpufreq.ko
+drivers/crypto/nx/*
+drivers/crypto/vmx/vmx-crypto.ko
+drivers/dma/tegra210-adma.ko
+drivers/firmware/dmi-sysfs.ko
+drivers/firmware/efi/*
+drivers/firmware/iscsi_ibft.ko
+drivers/gpio/gpio-max77620.ko
+drivers/gpu/drm/ast/ast.ko
+drivers/gpu/drm/bochs/bochs-drm.ko
+drivers/gpu/drm/cirrus/cirrus.ko
+drivers/gpu/drm/drm.ko
+drivers/gpu/drm/drm_kms_helper.ko
+drivers/gpu/drm/tegra/tegra-drm.ko
+drivers/gpu/drm/ttm/ttm.ko
+drivers/gpu/drm/vboxvideo/vboxvideo.ko
+drivers/gpu/drm/virtio/virtio-gpu.ko
+drivers/gpu/drm/vmwgfx/vmwgfx.ko
+drivers/gpu/drm/xen/drm_xen_front.ko
+drivers/gpu/host1x/host1x.ko
+drivers/hid/hid-generic.ko
+drivers/hid/hid-hyperv.ko
+drivers/hid/hid.ko
+drivers/hid/usbhid/usbhid.ko
+drivers/hv/*
+drivers/hwmon/ibmpowernv.ko
+drivers/hwmon/pwm-fan.ko
+drivers/i2c/busses/i2c-tegra-bpmp.ko
+drivers/i2c/busses/i2c-tegra-bpmp.ko
+drivers/i2c/busses/i2c-tegra.ko
+drivers/infiniband/core/ib_addr.ko
+drivers/infiniband/core/ib_cm.ko
+drivers/infiniband/core/ib_core.ko
+drivers/infiniband/core/ib_mad.ko
+drivers/infiniband/core/ib_sa.ko
+drivers/infiniband/core/iw_cm.ko
+drivers/infiniband/core/rdma_cm.ko
+drivers/infiniband/ulp/iser/ib_iser.ko
+drivers/infiniband/ulp/isert/ib_isert.ko
+drivers/input/evbug.ko
+drivers/input/gameport/gameport.ko
+drivers/input/input-leds.ko
+drivers/input/joydev.ko
+drivers/input/keyboard/gpio_keys.ko
+drivers/input/misc/xen-kbdfront.ko
+drivers/input/mouse/psmouse.ko
+drivers/input/serio/hyperv-keyboard.ko
+drivers/input/serio/serio_raw.ko
+drivers/input/serio/serport.ko
+drivers/input/touchscreen/usbtouchscreen.ko
+drivers/leds/leds-powernv.ko
+drivers/md/*
+drivers/memory/tegra/tegra210-emc.ko
+drivers/message/fusion*
+drivers/misc/cxl/*
+drivers/misc/eeprom/at24.ko
+drivers/misc/vmw_balloon.ko
+drivers/misc/vmw_vmci/vmw_vmci.ko
+drivers/mmc/host/sdhci-tegra.ko
+drivers/mtd/cmdlinepart.ko
+drivers/mtd/devices/powernv_flash.ko
+drivers/mtd/ofpart.ko
+drivers/net/appletalk/ipddp.ko
+drivers/net/bonding/bonding.ko
+drivers/net/caif/caif_virtio.ko
+drivers/net/dummy.ko
+drivers/net/eql.ko
+drivers/net/ethernet/8390/8390.ko
+drivers/net/ethernet/8390/ne2k-pci.ko
+drivers/net/ethernet/amazon/ena/ena.ko
+drivers/net/ethernet/amd/pcnet32.ko
+drivers/net/ethernet/broadcom/bnx2x/*
+drivers/net/ethernet/broadcom/tg3.ko
+drivers/net/ethernet/dec/tulip/*
+drivers/net/ethernet/emulex/benet/*
+drivers/net/ethernet/ibm/*
+drivers/net/ethernet/intel/e1000/e1000.ko
+drivers/net/ethernet/intel/e1000e/e1000e.ko
+drivers/net/ethernet/intel/i40e/*
+drivers/net/ethernet/intel/iavf/iavf.ko
+drivers/net/ethernet/intel/igb/*
+drivers/net/ethernet/intel/igbvf/igbvf.ko
+drivers/net/ethernet/intel/ixgbe/*
+drivers/net/ethernet/intel/ixgbevf/ixgbevf.ko
+drivers/net/ethernet/mellanox/*
+drivers/net/ethernet/netronome/nfp/nfp.ko
+drivers/net/ethernet/realtek/8139cp.ko
+drivers/net/ethernet/realtek/8139too.ko
+drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.ko
+drivers/net/ethernet/stmicro/stmmac/stmmac-platform.ko
+drivers/net/ethernet/stmicro/stmmac/stmmac.ko
+drivers/net/fddi/*
+drivers/net/geneve.ko
+drivers/net/hyperv/hv_netvsc.ko
+drivers/net/ifb.ko
+drivers/net/ipvlan/*
+drivers/net/macvlan.ko
+drivers/net/macvtap.ko
+drivers/net/mii.ko
+drivers/net/netconsole.ko
+drivers/net/pcs/pcs-xpcs.ko
+drivers/net/phy/marvell.ko
+drivers/net/phy/phylink.ko
+drivers/net/ppp/*
+drivers/net/ppp/bsd_comp.ko
+drivers/net/slip/*
+drivers/net/veth.ko
+drivers/net/virtio_net.ko
+drivers/net/vmxnet3/vmxnet3.ko
+drivers/net/vxlan.ko
+drivers/net/wireguard/wireguard.ko
+drivers/net/wwan/*
+drivers/net/xen-netback/*
+drivers/net/xen-netfront.ko
+drivers/nvme/host/nvme.ko
+drivers/nvmem/nvmem_core.ko
+drivers/parport/parport.ko
+drivers/parport/parport_pc.ko
+drivers/pci/controller/dwc/pcie-tegra194.ko
+drivers/pci/host/vmd.ko
+drivers/phy/tegra/phy-tegra194-p2u.ko
+drivers/pinctrl/pinctrl-max77620.ko
+drivers/platform/x86/pvpanic.ko
+drivers/pps/pps_core.ko
+drivers/ptp/ptp.ko
+drivers/pwm/pwm-tegra.ko
+drivers/regulator/fixed.ko
+drivers/regulator/max77620-regulator.ko
+drivers/rtc/rtc-max77686.ko
+drivers/rtc/rtc-tegra.ko
+drivers/s390/*
+drivers/s390/block/xpram.ko
+drivers/scsi/BusLogic.ko
+drivers/scsi/aacraid/*
+drivers/scsi/cxlflash/*
+drivers/scsi/device_handler/scsi_dh_alua.ko
+drivers/scsi/device_handler/scsi_dh_emc.ko
+drivers/scsi/device_handler/scsi_dh_hp_sw.ko
+drivers/scsi/device_handler/scsi_dh_rdac.ko
+drivers/scsi/hv_storvsc.ko
+drivers/scsi/ibmvscsi/*
+drivers/scsi/ipr.ko
+drivers/scsi/iscsi_boot_sysfs.ko
+drivers/scsi/iscsi_tcp.ko
+drivers/scsi/libiscsi.ko
+drivers/scsi/libiscsi_tcp.ko
+drivers/scsi/libsas/*
+drivers/scsi/lpfc/*
+drivers/scsi/megaraid/*
+drivers/scsi/mpt3sas/*
+drivers/scsi/osd/libosd.ko
+drivers/scsi/osd/osd.ko
+drivers/scsi/qla1280.ko
+drivers/scsi/qla2xxx/*
+drivers/scsi/raid_class.ko
+drivers/scsi/scsi_transport_fc.ko
+drivers/scsi/scsi_transport_iscsi.ko
+drivers/scsi/scsi_transport_sas.ko
+drivers/scsi/scsi_transport_spi.ko
+drivers/scsi/sd_mod.ko
+drivers/scsi/sr_mod.ko
+drivers/scsi/virtio_scsi.ko
+drivers/scsi/vmw_pvscsi.ko
+drivers/spi/spi-tegra114.ko
+drivers/staging/media/tegra-video/tegra-video.ko
+drivers/target/loopback/tcm_loop.ko
+drivers/target/target_core*.ko
+drivers/thermal/tegra/tegra-bpmp-thermal.ko
+drivers/tty/serial/jsm/*
+drivers/tty/serial/serial-tegra.ko
+drivers/uio/uio.ko
+drivers/uio/uio_pdrv_genirq.ko
+drivers/usb/gadget/udc/tegra-xudc.ko
+drivers/usb/host/*
+drivers/usb/storage/uas.ko
+drivers/usb/storage/usb-storage.ko
+drivers/vfio/*
+drivers/vhost/*
+drivers/video/fbdev/*
+drivers/video/vgastate.ko
+drivers/virt/vboxguest/vboxguest.ko
+drivers/virtio/*
+drivers/watchdog/softdog.ko
+drivers/watchdog/wdat_wdt.ko
+drivers/xen/*
+fs/9p/*
+fs/aufs/aufs.ko
+fs/autofs/autofs4.ko
+fs/binfmt_misc.ko
+fs/btrfs/*
+fs/cachefiles/cachefiles.ko
+fs/ceph/*
+fs/smb/*
+fs/configfs/*
+fs/dlm/dlm.ko
+fs/ecryptfs/*
+fs/efivarfs/*
+fs/erofs/*
+fs/exofs/libore.ko
+fs/ext4/*
+fs/fat/*
+fs/fscache/*
+fs/fuse/*
+fs/isofs/*
+fs/lockd/*
+fs/nfs/*
+fs/nfs_common/*
+fs/nfsd/*
+fs/nls/nls_cp437.ko
+fs/nls/nls_iso8859-1.ko
+fs/overlayfs/*
+fs/shiftfs.ko
+fs/squashfs/*
+fs/udf/*
+fs/ufs/*
+fs/vboxsf/vboxsf.ko
+fs/xfs/*
+lib/*
+net/6lowpan/*
+net/802/*
+net/8021q/*
+net/9p/*
+net/appletalk/*
+net/atm/*
+net/ax25/*
+net/bpfilter/*
+net/bridge/*
+net/can/*
+net/ceph/libceph.ko
+net/core/*
+net/dccp/*
+net/decnet/*
+net/ieee802154/*
+net/ipv4/*
+net/ipv6/*
+net/ipx/*
+net/key/*
+net/lapb/*
+net/llc/*
+net/netfilter/*
+net/netlink/netlink_diag.ko
+net/netrom/*
+net/openvswitch/*
+net/packet/af_packet_diag.ko
+net/phonet/*
+net/rose/*
+net/rxrpc/*
+net/sched/*
+net/sctp/*
+net/sunrpc/auth_gss/auth_rpcgss.ko
+net/sunrpc/auth_gss/rpcsec_gss_krb5.ko
+net/sunrpc/sunrpc.ko
+net/tipc/*
+net/unix/unix_diag.ko
+net/vmw_vsock/*
+net/x25/*
+net/xfrm/*
+! find sound/core -name oss -prune -o -name *.ko -print
+sound/drivers/pcsp/snd-pcsp.ko
+sound/pci/hda/snd-hda-tegra.ko
+sound/pci/snd-ens1370.ko
+sound/soc/tegra/snd-soc-tegra186-dspk.ko
+sound/soc/tegra/snd-soc-tegra210-admaif.ko
+sound/soc/tegra/snd-soc-tegra210-ahub.ko
+sound/soc/tegra/snd-soc-tegra210-dmic.ko
+sound/soc/tegra/snd-soc-tegra210-i2s.ko
+sound/soundcore.ko
+ubuntu/ubuntu-host/ubuntu-host.ko
--- linux-qcom-6.8.0.orig/debian.master/control.d/vars.generic
+++ linux-qcom-6.8.0/debian.master/control.d/vars.generic
@@ -0,0 +1,6 @@
+arch="amd64 armhf arm64 ppc64el s390x"
+supported="Generic"
+target="Geared toward desktop and server systems."
+desc="=HUMAN= SMP"
+bootloader="grub-pc [amd64] | grub-efi-amd64 [amd64] | grub-efi-ia32 [amd64] | grub [amd64] | lilo [amd64] | flash-kernel [armhf arm64] | grub-efi-arm64 [arm64] | grub-efi-arm [armhf] | grub-ieee1275 [ppc64el]"
+provides="kvm-api-4, redhat-cluster-modules, ivtv-modules, virtualbox-guest-modules [amd64]"
--- linux-qcom-6.8.0.orig/debian.master/control.d/vars.generic-64k
+++ linux-qcom-6.8.0/debian.master/control.d/vars.generic-64k
@@ -0,0 +1,6 @@
+arch="arm64"
+supported="Generic 64K pages"
+target="Geared toward desktop and server systems."
+desc="=HUMAN= SMP"
+bootloader="grub-efi-arm64 [arm64] | flash-kernel [arm64]"
+provides="kvm-api-4, redhat-cluster-modules, ivtv-modules"
--- linux-qcom-6.8.0.orig/debian.master/control.d/vars.generic-lpae
+++ linux-qcom-6.8.0/debian.master/control.d/vars.generic-lpae
@@ -0,0 +1,6 @@
+arch="armhf"
+supported="Generic LPAE"
+target="Geared toward desktop and server systems."
+desc="=HUMAN= SMP"
+bootloader="flash-kernel [armhf] | grub-efi-arm [armhf]"
+provides="kvm-api-4, redhat-cluster-modules, ivtv-modules"
--- linux-qcom-6.8.0.orig/debian.master/control.stub.in
+++ linux-qcom-6.8.0/debian.master/control.stub.in
@@ -0,0 +1,98 @@
+Source: SRCPKGNAME
+Section: devel
+Priority: optional
+Maintainer: Ubuntu Kernel Team <kernel-team@lists.ubuntu.com>
+Rules-Requires-Root: no
+Standards-Version: 3.9.4.0
+Build-Depends:
+ autoconf <!stage1>,
+ automake <!stage1>,
+ bc <!stage1>,
+ bindgen-0.65 [amd64 arm64 armhf ppc64el riscv64 s390x],
+ bison <!stage1>,
+ clang-18 [amd64 arm64 armhf ppc64el riscv64 s390x],
+ cpio,
+ curl <!stage1>,
+ debhelper-compat (= 10),
+ default-jdk-headless <!stage1>,
+ dkms <!stage1>,
+ dwarfdump <!stage1>,
+ flex <!stage1>,
+ gawk <!stage1>,
+ java-common <!stage1>,
+ kmod <!stage1>,
+ libaudit-dev <!stage1>,
+ libcap-dev <!stage1>,
+ libdw-dev <!stage1>,
+ libelf-dev <!stage1>,
+ libiberty-dev <!stage1>,
+ liblzma-dev <!stage1>,
+ libnewt-dev <!stage1>,
+ libnuma-dev [amd64 arm64 ppc64el s390x] <!stage1>,
+ libpci-dev <!stage1>,
+ libssl-dev <!stage1>,
+ libstdc++-dev,
+ libtool <!stage1>,
+ libtraceevent-dev [amd64 arm64 armhf ppc64el s390x riscv64] <!stage1>,
+ libtracefs-dev [amd64 arm64 armhf ppc64el s390x riscv64] <!stage1>,
+ libudev-dev <!stage1>,
+ libunwind8-dev [amd64 arm64 armhf ppc64el] <!stage1>,
+ makedumpfile [amd64] <!stage1>,
+ openssl <!stage1>,
+ pahole [amd64 arm64 armhf ppc64el s390x riscv64] | dwarves (>= 1.21) [amd64 arm64 armhf ppc64el s390x riscv64] <!stage1>,
+ pkg-config <!stage1>,
+ python3 <!stage1>,
+ python3-dev <!stage1>,
+ python3-setuptools <!stage1>,
+ rsync [!i386] <!stage1>,
+ rust-src [amd64 arm64 armhf ppc64el riscv64 s390x],
+ rustc [amd64 arm64 armhf ppc64el riscv64 s390x],
+ rustfmt [amd64 arm64 armhf ppc64el riscv64 s390x],
+ uuid-dev <!stage1>,
+ zstd <!stage1>,
+Build-Depends-Indep:
+ asciidoc <!stage1>,
+ bzip2 <!stage1>,
+ python3-docutils <!stage1>,
+ sharutils <!stage1>,
+ xmlto <!stage1>,
+Vcs-Git: git://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/=SERIES=
+XS-Testsuite: autopkgtest
+#XS-Testsuite-Depends: gcc-4.7 binutils
+
+Package: SRCPKGNAME-headers-PKGVER-ABINUM
+Build-Profiles: <!stage1>
+Architecture: all
+Multi-Arch: foreign
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, coreutils
+Description: Header files related to Linux kernel version PKGVER
+ This package provides kernel header files for version PKGVER, for sites
+ that want the latest kernel headers. Please read
+ /usr/share/doc/SRCPKGNAME-headers-PKGVER-ABINUM/debian.README.gz for details
+
+Package: SRCPKGNAME-tools-PKGVER-ABINUM
+Build-Profiles: <!stage1>
+Architecture: amd64 armhf arm64 ppc64el s390x
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}, linux-tools-common
+Description: Linux kernel version specific tools for version PKGVER-ABINUM
+ This package provides the architecture dependant parts for kernel
+ version locked tools (such as perf and x86_energy_perf_policy) for
+ version PKGVER-ABINUM on
+ =HUMAN=.
+ You probably want to install linux-tools-PKGVER-ABINUM-<flavour>.
+
+Package: SRCPKGNAME-cloud-tools-PKGVER-ABINUM
+Build-Profiles: <!stage1>
+Architecture: amd64 armhf
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}, linux-cloud-tools-common
+Description: Linux kernel version specific cloud tools for version PKGVER-ABINUM
+ This package provides the architecture dependant parts for kernel
+ version locked tools for cloud tools for version PKGVER-ABINUM on
+ =HUMAN=.
+ You probably want to install linux-cloud-tools-PKGVER-ABINUM-<flavour>.
--- linux-qcom-6.8.0.orig/debian.master/copyright
+++ linux-qcom-6.8.0/debian.master/copyright
@@ -0,0 +1,29 @@
+This is the Ubuntu prepackaged version of the Linux kernel.
+Linux was written by Linus Torvalds <Linus.Torvalds@cs.Helsinki.FI>
+and others.
+
+This package was put together by the Ubuntu Kernel Team, from
+sources retrieved from upstream linux git.
+The sources may be found at most Linux ftp sites, including 
+ftp://ftp.kernel.org/pub/linux/kernel/
+
+This package is currently maintained by the
+Ubuntu Kernel Team <ubuntu-kernel@lists.ubuntu.com>
+
+Linux is copyrighted by Linus Torvalds and others.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 dated June, 1991.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+On Ubuntu Linux systems, the complete text of the GNU General
+Public License v2 can be found in `/usr/share/common-licenses/GPL-2'.
--- linux-qcom-6.8.0.orig/debian.master/dkms-versions
+++ linux-qcom-6.8.0/debian.master/dkms-versions
@@ -0,0 +1,5 @@
+zfs-linux 2.2.2-0ubuntu9.2 modulename=zfs debpath=pool/universe/z/%package%/zfs-dkms_%version%_all.deb arch=amd64 arch=arm64 arch=ppc64el arch=s390x rprovides=spl-modules rprovides=spl-dkms rprovides=zfs-modules rprovides=zfs-dkms
+ipu6-drivers 0~git202406240945.aecec2aa-0ubuntu2~24.04.2 modulename=ipu6 debpath=pool/universe/i/%package%/intel-ipu6-dkms_%version%_amd64.deb arch=amd64 rprovides=ipu6-modules rprovides=intel-ipu6-dkms type=standalone
+backport-iwlwifi-dkms 11510-0ubuntu1.1 modulename=iwlwifi debpath=pool/universe/b/%package%/backport-iwlwifi-dkms_%version%_all.deb arch=amd64 rprovides=iwlwifi-modules rprovides=backport-iwlwifi-dkms type=standalone
+v4l2loopback 0.12.7-2ubuntu5 modulename=v4l2loopback debpath=pool/universe/v/%package%/v4l2loopback-dkms_%version%_all.deb arch=amd64 rprovides=v4l2loopback-modules rprovides=v4l2loopback-dkms
+usbio-drivers 0~git202312141918.78ffb706-0ubuntu2.1 modulename=usbio debpath=pool/universe/u/%package%/intel-usbio-dkms_%version%_amd64.deb arch=amd64 rprovides=usbio-modules rprovides=intel-usbio-dkms type=standalone
--- linux-qcom-6.8.0.orig/debian.master/modprobe.d/common.conf
+++ linux-qcom-6.8.0/debian.master/modprobe.d/common.conf
@@ -0,0 +1,3 @@
+# LP:1434842 -- disable OSS drivers by default to allow pulseaudio to emulate
+blacklist snd-mixer-oss
+blacklist snd-pcm-oss
--- linux-qcom-6.8.0.orig/debian.master/reconstruct
+++ linux-qcom-6.8.0/debian.master/reconstruct
@@ -0,0 +1,56 @@
+# Recreate any symlinks created since the orig.
+chmod +x 'arch/mips/pci/pcie-octeon.c'
+chmod +x 'debian/cloud-tools/hv_get_dhcp_info'
+chmod +x 'debian/cloud-tools/hv_get_dns_info'
+chmod +x 'debian/cloud-tools/hv_set_ifconfig'
+chmod +x 'debian/rules'
+chmod +x 'debian/scripts/checks/final-checks'
+chmod +x 'debian/scripts/checks/module-signature-check'
+chmod +x 'debian/scripts/control-create'
+chmod +x 'debian/scripts/dkms-build'
+chmod +x 'debian/scripts/dkms-build--nvidia-N'
+chmod +x 'debian/scripts/dkms-build-configure--zfs'
+chmod +x 'debian/scripts/file-downloader'
+chmod +x 'debian/scripts/link-headers'
+chmod +x 'debian/scripts/link-lib-rust'
+chmod +x 'debian/scripts/misc/annotations'
+chmod +x 'debian/scripts/misc/find-missing-sauce.sh'
+chmod +x 'debian/scripts/misc/gen-auto-reconstruct'
+chmod +x 'debian/scripts/misc/git-ubuntu-log'
+chmod +x 'debian/scripts/misc/insert-changes'
+chmod +x 'debian/scripts/misc/insert-ubuntu-changes'
+chmod +x 'debian/scripts/misc/kernelconfig'
+chmod +x 'debian/scripts/module-inclusion'
+chmod +x 'debian/scripts/sign-module'
+chmod +x 'debian/templates/extra.postinst.in'
+chmod +x 'debian/templates/extra.postrm.in'
+chmod +x 'debian/templates/headers.postinst.in'
+chmod +x 'debian/templates/image.postinst.in'
+chmod +x 'debian/templates/image.postrm.in'
+chmod +x 'debian/templates/image.preinst.in'
+chmod +x 'debian/templates/image.prerm.in'
+chmod +x 'debian/tests-build/check-aliases'
+chmod +x 'debian/tests/rebuild'
+chmod +x 'debian/tests/ubuntu-regression-suite'
+chmod +x 'drivers/watchdog/f71808e_wdt.c'
+chmod +x 'tools/testing/selftests/gpio/gpio-aggregator.sh'
+chmod +x 'tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh'
+# Remove any files deleted from the orig.
+rm -f 'arch/arm/kernel/pj4-cp0.c'
+rm -f 'arch/arm64/boot/dts/qcom/pm2250.dtsi'
+rm -f 'arch/loongarch/include/asm/dma-direct.h'
+rm -f 'arch/loongarch/include/asm/qspinlock.h'
+rm -f 'arch/s390/kernel/earlypgm.S'
+rm -f 'arch/sparc/lib/cmpdi2.c'
+rm -f 'arch/sparc/lib/ucmpdi2.c'
+rm -f 'drivers/dax/pmem/Makefile'
+rm -f 'drivers/dax/pmem/pmem.c'
+rm -f 'drivers/gpu/drm/gma500/psb_lid.c'
+rm -f 'drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c'
+rm -f 'include/linux/amd-pstate.h'
+rm -f 'include/linux/iio/adc/adi-axi-adc.h'
+rm -f 'net/bluetooth/a2mp.c'
+rm -f 'net/bluetooth/a2mp.h'
+rm -f 'net/bluetooth/amp.c'
+rm -f 'net/bluetooth/amp.h'
+exit 0
--- linux-qcom-6.8.0.orig/debian.master/rules.d/amd64.mk
+++ linux-qcom-6.8.0/debian.master/rules.d/amd64.mk
@@ -0,0 +1,22 @@
+human_arch	= 64 bit x86
+build_arch	= x86
+defconfig	= defconfig
+flavours	= generic
+build_image	= bzImage
+kernel_file	= arch/$(build_arch)/boot/bzImage
+install_file	= vmlinuz
+vdso		= vdso_install
+no_dumpfile	= true
+uefi_signed     = true
+do_tools_usbip  = true
+do_tools_cpupower = true
+do_tools_perf   = true
+do_tools_perf_jvmti = true
+do_tools_perf_python = true
+do_tools_bpftool = true
+do_tools_x86	= true
+do_tools_hyperv	= true
+do_tools_rtla = true
+do_extras_package = true
+do_tools_acpidbg = true
+do_lib_rust     = true
--- linux-qcom-6.8.0.orig/debian.master/rules.d/arm64.mk
+++ linux-qcom-6.8.0/debian.master/rules.d/arm64.mk
@@ -0,0 +1,22 @@
+human_arch	= ARMv8
+build_arch	= arm64
+defconfig	= defconfig
+flavours	= generic generic-64k
+build_image	= Image.gz
+kernel_file	= arch/$(build_arch)/boot/Image.gz
+install_file	= vmlinuz
+no_dumpfile = true
+uefi_signed     = true
+
+vdso		= vdso_install
+
+do_extras_package = true
+do_tools_usbip  = true
+do_tools_cpupower = true
+do_tools_perf   = true
+do_tools_perf_jvmti = true
+do_tools_perf_python = true
+do_tools_bpftool = true
+do_tools_rtla = true
+
+do_dtbs		= true
--- linux-qcom-6.8.0.orig/debian.master/rules.d/armhf.mk
+++ linux-qcom-6.8.0/debian.master/rules.d/armhf.mk
@@ -0,0 +1,19 @@
+human_arch	= ARM (hard float)
+build_arch	= arm
+defconfig	= defconfig
+flavours	= generic
+build_image	= zImage
+kernel_file	= arch/$(build_arch)/boot/zImage
+install_file	= vmlinuz
+no_dumpfile	= true
+
+do_tools_usbip  = true
+do_tools_cpupower = true
+do_tools_perf	= true
+do_tools_perf_jvmti = true
+do_tools_perf_python = true
+do_tools_bpftool = true
+do_tools_bpftool_stub = true
+do_tools_rtla = true
+
+do_dtbs		= true
--- linux-qcom-6.8.0.orig/debian.master/rules.d/i386.mk
+++ linux-qcom-6.8.0/debian.master/rules.d/i386.mk
@@ -0,0 +1,15 @@
+human_arch	= 32 bit x86
+build_arch	= i386
+defconfig	= defconfig
+flavours        = generic
+build_image	= bzImage
+kernel_file	= arch/$(build_arch)/boot/bzImage
+install_file	= vmlinuz
+vdso		= vdso_install
+no_dumpfile	= true
+do_flavour_image_package = false
+do_tools	= false
+do_extras_package = false
+do_source_package = false
+do_flavour_header_package = false
+do_common_headers_indep = false
--- linux-qcom-6.8.0.orig/debian.master/rules.d/ppc64el.mk
+++ linux-qcom-6.8.0/debian.master/rules.d/ppc64el.mk
@@ -0,0 +1,19 @@
+human_arch	= PowerPC 64el
+build_arch	= powerpc
+defconfig	= pseries_le_defconfig
+flavours	= generic
+build_image	= vmlinux.strip
+kernel_file     = arch/powerpc/boot/vmlinux.strip
+install_file	= vmlinux
+no_dumpfile	= true
+do_extras_package = true
+opal_signed       = false
+do_tools_usbip    = true
+do_tools_cpupower = true
+do_tools_perf	  = true
+do_tools_perf_jvmti = true
+do_tools_perf_python = true
+do_tools_bpftool  = true
+do_tools_rtla = true
+
+#do_flavour_image_package = false
--- linux-qcom-6.8.0.orig/debian.master/rules.d/riscv64.mk
+++ linux-qcom-6.8.0/debian.master/rules.d/riscv64.mk
@@ -0,0 +1,25 @@
+human_arch     = RISC-V
+build_arch     = riscv
+defconfig      = defconfig
+flavours       = generic
+build_image    = Image
+kernel_file    = arch/$(build_arch)/boot/Image
+install_file   = vmlinuz
+
+vdso           = vdso_install
+no_dumpfile    = true
+
+do_flavour_image_package = false
+do_tools                 = false
+do_tools_common          = false
+do_source_package        = false
+do_flavour_header_package = false
+do_common_headers_indep = false
+do_extras_package      = false
+do_tools_usbip         = false
+do_tools_cpupower      = false
+do_tools_perf          = false
+do_tools_perf_jvmti    = false
+do_tools_perf_python = false
+do_tools_bpftool       = false
+do_dtbs                = false
--- linux-qcom-6.8.0.orig/debian.master/rules.d/s390x.mk
+++ linux-qcom-6.8.0/debian.master/rules.d/s390x.mk
@@ -0,0 +1,20 @@
+human_arch      = System 390x
+build_arch      = s390
+defconfig       = defconfig
+flavours        = generic
+build_image	= bzImage
+kernel_file	= arch/$(build_arch)/boot/bzImage
+install_file	= vmlinuz
+
+vdso		= vdso_install
+no_dumpfile	= true
+
+do_extras_package = true
+sipl_signed       = true
+do_tools_usbip    = true
+do_tools_cpupower = true
+do_tools_perf     = true
+do_tools_perf_jvmti = true
+do_tools_perf_python = true
+do_tools_bpftool  = true
+do_tools_rtla = false
--- linux-qcom-6.8.0.orig/debian.master/rules.d/x32.mk
+++ linux-qcom-6.8.0/debian.master/rules.d/x32.mk
@@ -0,0 +1,12 @@
+human_arch	= 64 bit x86 (32 bit userspace)
+build_arch	= x86
+defconfig	= defconfig
+flavours	= 
+build_image	= bzImage
+kernel_file	= arch/$(build_arch)/boot/bzImage
+install_file	= vmlinuz
+vdso		= vdso_install
+no_dumpfile	= true
+uefi_signed     = true
+
+do_flavour_image_package = false
--- linux-qcom-6.8.0.orig/debian.master/tracking-bug
+++ linux-qcom-6.8.0/debian.master/tracking-bug
@@ -0,0 +1 @@
+2110737 2025.05.19-1
--- linux-qcom-6.8.0.orig/debian.master/upstream-stable
+++ linux-qcom-6.8.0/debian.master/upstream-stable
@@ -0,0 +1,8 @@
+# The following upstream stable releases have been ported:
+[upstream-stable]
+    linux-6.6.y = v6.6.75
+    linux-6.8.y = v6.8.12
+    linux-6.9.y = v6.9.12
+    linux-6.10.y = v6.10.14
+    linux-6.11.y = v6.11.11
+    linux-6.12.y = v6.12.12
--- linux-qcom-6.8.0.orig/debian.qcom/changelog
+++ linux-qcom-6.8.0/debian.qcom/changelog
@@ -0,0 +1,37489 @@
+linux-qcom (6.8.0-1046.46) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1046.46 -proposed tracker (LP: #2114979)
+
+  * [qcom] Qcom kernel crashes in virtual machine
+    - SAUCE: gunyah_qcom: check qcom,msm-id property before HW access
+
+  * [RB3] Plugged USB storage is not detected via type-c port after reboot
+    occasionally
+    - soc: qcom: pmic_glink: Fix possible race between rpmsg and pmicglink
+      probe
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 19 Jun 2025 22:04:02 +0900
+
+linux-qcom (6.8.0-1045.45) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1045.45 -proposed tracker (LP: #2114901)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update Ubuntu.md
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Config] add FLAVOUR_DEP
+    - [package] fix Vcs-Git
+    - SAUCE: arm64: dts: qcm6490: enable platform sound-dai
+    - SAUCE: ASoC: q6dsp: increase AR_MAX_MOD_LINKS
+    - SAUCE: arm64: dts: qcom fix interrupts arguments
+    - SAUCE: usb: dwc3: do not call dwc3_remove() when dwc3_qcom_probe_core()
+      fails
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 18 Jun 2025 23:42:59 +0900
+
+linux-qcom (6.8.0-1043.43) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1043.43 -proposed tracker (LP: #2112456)
+
+  * [5430] thermal_sys failed to bind errors found in dmesg
+    - SAUCE: comment out invalid cooling-maps
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs
+
+  [ Ubuntu: 6.8.0-62.65 ]
+
+  * noble/linux: 6.8.0-62.65 -proposed tracker (LP: #2110737)
+  * Rotate the Canonical Livepatch key (LP: #2111244)
+    - [Config] Prepare for Canonical Livepatch key rotation
+  * KVM bug causes Firecracker crash when it runs the vCPU for the first time
+    (LP: #2109859)
+    - vhost: return task creation error instead of NULL
+    - kvm: retry nx_huge_page_recovery_thread creation
+  * CVE-2025-2312 cifs.upcall could access incorrect kerberos credentials cache
+    (LP: #2099914) // CVE-2025-2312
+    - CIFS: New mount option for cifs.upcall namespace resolution
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640)
+    - ASoC: wm8994: Add depends on MFD core
+    - ASoC: samsung: Add missing selects for MFD_WM8994
+    - seccomp: Stub for !CONFIG_SECCOMP
+    - scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
+    - of/unittest: Add test that of_address_to_resource() fails on non-
+      translatable address
+    - irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
+    - hwmon: (drivetemp) Set scsi command timeout to 10s
+    - ASoC: samsung: Add missing depends on I2C
+    - ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf()
+    - Revert "libfs: fix infinite directory reads for offset dir"
+    - libfs: Replace simple_offset end-of-directory detection
+    - Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
+    - ALSA: usb-audio: Add delay quirk for USB Audio Device
+    - Input: xpad - add support for Nacon Pro Compact
+    - Input: atkbd - map F23 key to support default copilot shortcut
+    - Input: xpad - add unofficial Xbox 360 wireless receiver clone
+    - Input: xpad - add QH Electronics VID/PID
+    - Input: xpad - improve name of 8BitDo controller 2dc8:3106
+    - Input: xpad - add support for Nacon Evol-X Xbox One Controller
+    - Input: xpad - add support for wooting two he (arm)
+    - ASoC: codecs: es8316: Fix HW rate calculation for 48Mhz MCLK
+    - ASoC: cs42l43: Add codec force suspend/resume ops
+    - ALSA: hda/realtek: Fix volume adjustment issue on Lenovo ThinkBook 16P Gen5
+    - libfs: Return ENOSPC when the directory offset range is exhausted
+    - Revert "libfs: Add simple_offset_empty()"
+    - libfs: Use d_children list to iterate simple_offset directories
+    - wifi: rtl8xxxu: add more missing rtl8192cu USB IDs
+    - HID: wacom: Initialize brightness of LED trigger
+    - Upstream stable to v6.6.75, v6.12.12
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21689
+    - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21690
+    - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21691
+    - cachestat: fix page cache statistics permission checking
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21692
+    - net: sched: fix ets qdisc OOB Indexing
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21699
+    - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2024-50157
+    - RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
+  * rtw89: Support hardware rfkill (LP: #2077384)
+    - wifi: rtw89: add support for hardware rfkill
+  * Introduce configfs-based interface for gpio-aggregator (LP: #2103496)
+    - gpio: introduce utilities for synchronous fake device creation
+    - bitmap: Define a cleanup function for bitmaps
+    - gpio: aggregator: simplify aggr_parse() with scoped bitmap
+    - gpio: aggregator: protect driver attr handlers against module unload
+    - gpio: aggregator: reorder functions to prepare for configfs introduction
+    - gpio: aggregator: unify function naming
+    - gpio: aggregator: add gpio_aggregator_{alloc, free}()
+    - gpio: aggregator: introduce basic configfs interface
+    - [Config] Enable DEV_SYNC_PROBE as module
+    - SAUCE: gpio: aggregator: Fix error code in gpio_aggregator_activate()
+    - gpio: aggregator: rename 'name' to 'key' in gpio_aggregator_parse()
+    - gpio: aggregator: expose aggregator created via legacy sysfs to configfs
+    - SAUCE: gpio: aggregator: fix "_sysfs" prefix check in
+      gpio_aggregator_make_group()
+    - SAUCE: gpio: aggregator: Fix gpio_aggregator_line_alloc() checking
+    - SAUCE: gpio: aggregator: Return an error if there are no GPIOs in
+      gpio_aggregator_parse()
+    - SAUCE: gpio: aggregator: Fix leak in gpio_aggregator_parse()
+    - gpio: aggregator: cancel deferred probe for devices created via configfs
+    - Documentation: gpio: document configfs interface for gpio-aggregator
+    - selftests: gpio: add test cases for gpio-aggregator
+    - SAUCE: selftests: gpio: gpio-aggregator: add a test case for _sysfs prefix
+      reservation
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449)
+    - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
+    - net: add exit_batch_rtnl() method
+    - gtp: use exit_batch_rtnl() method
+    - gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
+    - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
+    - nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
+    - net: xilinx: axienet: Fix IRQ coalescing packet count overflow
+    - net/mlx5: Fix RDMA TX steering prio
+    - net/mlx5e: Rely on reqid in IPsec tunnel mode
+    - net/mlx5e: Always start IPsec sequence number from 1
+    - drm/vmwgfx: Add new keep_resv BO param
+    - drm/v3d: Assign job pointer to NULL before signaling the fence
+    - soc: ti: pruss: Fix pruss APIs
+    - hwmon: (tmp513) Fix division of negative numbers
+    - i2c: mux: demux-pinctrl: check initial mux selection, too
+    - i2c: rcar: fix NACK handling when being a target
+    - hfs: Sanity check the root record
+    - fs: fix missing declaration of init_files
+    - kheaders: Ignore silly-rename files
+    - cachefiles: Parse the "secctx" immediately
+    - scsi: ufs: core: Honor runtime/system PM levels if set by host controller
+      drivers
+    - selftests: tc-testing: reduce rshift value
+    - ACPI: resource: acpi_dev_irq_override(): Check DMI match last
+    - poll_wait: add mb() to fix theoretical race between waitqueue_active() and
+      .poll()
+    - RDMA/bnxt_re: Fix to export port num to ib_query_qp
+    - nvmet: propagate npwg topology
+    - ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
+    - i2c: atr: Fix client detach
+    - mptcp: be sure to send ack when mptcp-level window re-opens
+    - mptcp: fix spurious wake-up on under memory pressure
+    - selftests: mptcp: avoid spurious errors on disconnect
+    - net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
+    - vsock/virtio: cancel close work in the destructor
+    - vsock: reset socket state when de-assigning the transport
+    - nouveau/fence: handle cross device fences properly
+    - irqchip: Plug a OF node reference leak in platform_irqchip_probe()
+    - irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
+    - drm/i915/fb: Relax clear color alignment to 64 bytes
+    - drm/amdgpu: always sync the GFX pipe on ctx switch
+    - ocfs2: fix deadlock in ocfs2_get_system_file_inode
+    - nfsd: add list_head nf_gc to struct nfsd_file
+    - x86/xen: fix SLS mitigation in xen_hypercall_iret()
+    - efi/zboot: Limit compression options to GZIP and ZSTD
+    - [Config] updateconfigs for HAVE_KERNEL_(LZ4|LZMA|LZO|XZ)
+    - net: ravb: Fix max TX frame size for RZ/V2M
+    - net/mlx5: SF, Fix add port error handling
+    - drm/vmwgfx: Unreserve BO on error
+    - i2c: testunit: on errors, repeat NACK until STOP
+    - hwmon: (ltc2991) Fix mixed signed/unsigned in DIV_ROUND_CLOSEST
+    - fs/qnx6: Fix building with GCC 15
+    - gpio: sim: lock up configfs that an instantiated device depends on
+    - gpio: sim: lock hog configfs items if present
+    - platform/x86: ISST: Add Clearwater Forest to support list
+    - drm/nouveau/disp: Fix missing backlight control on Macbook 5,1
+    - net/ncsi: fix locking in Get MAC Address handling
+    - drm/amd/display: Do not elevate mem_type change to full update
+    - drm/xe: Mark ComputeCS read mode as UC on iGPU
+    - drm/amdgpu/smu13: update powersave optimizations
+    - drm/amdgpu: fix fw attestation for MP0_14_0_{2/3}
+    - drm/amdgpu: disable gfxoff with the compute workload on gfx12
+    - drm/amd/display: Fix PSR-SU not support but still call the
+      amdgpu_dm_psr_enable
+    - Upstream stable to v6.6.73, v6.6.74, v6.12.11
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21672
+    - afs: Fix merge preference rule failure condition
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21682
+    - eth: bnxt: always recalculate features after XDP clearing, fix null-deref
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-53124
+    - net: fix data-races around sk->sk_forward_alloc
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57924
+    - fs: relax assertions on failure to encode file handles
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57951
+    - hrtimers: Handle CPU state correctly on hotplug
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57949
+    - irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21668
+    - pmdomain: imx8mp-blk-ctrl: add missing loop break condition
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21684
+    - gpio: xilinx: Convert gpio_lock to raw spinlock
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21694
+    - fs/proc: fix softlockup in __read_vmcore (part 2)
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21665
+    - filemap: avoid truncating 64-bit offset to 32 bits
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21666
+    - vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21669
+    - vsock/virtio: discard packets if the transport changes
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21670
+    - vsock/bpf: return early if transport is not assigned
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21667
+    - iomap: avoid avoid truncating 64-bit offset to 32 bits
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57948
+    - mac802154: check local interfaces before deleting sdata list
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21673
+    - smb: client: fix double free of TCP_Server_Info::hostname
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21697
+    - drm/v3d: Ensure job pointer is set to NULL after job completion
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21674
+    - net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21675
+    - net/mlx5: Clear port select structure when fail to create
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21676
+    - net: fec: handle page_pool_dev_alloc_pages error
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21678
+    - gtp: Destroy device along with udp socket's netns dismantle.
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21680
+    - pktgen: Avoid out-of-bounds access in get_imix_entries
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21681
+    - openvswitch: fix lockup on tx to unregistering netdev with carrier
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21683
+    - bpf: Fix bpf_sk_select_reuseport() memory leak
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update annotations scripts
+
+  [ Ubuntu: 6.8.0-60.63 ]
+
+  * noble/linux: 6.8.0-60.63 -proposed tracker (LP: #2107138)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2025.04.14)
+  * Missing upstream commits for LP: #2102181 (LP: #2107336)
+    - libperf cpumap: Add any, empty and min helpers
+    - libperf cpumap: Ensure empty cpumap is NULL from alloc
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770)
+    - memblock: use numa_valid_node() helper to check for invalid node ID
+    - jbd2: increase IO priority for writing revoke records
+    - jbd2: flush filesystem device before updating tail sequence
+    - dm array: fix unreleased btree blocks on closing a faulty array cursor
+    - dm array: fix cursor index when skipping across block boundaries
+    - exfat: fix the infinite loop in __exfat_free_cluster()
+    - erofs: fix PSI memstall accounting
+    - ASoC: rt722: add delay time to wait for the calibration procedure
+    - ASoC: mediatek: disable buffer pre-allocation
+    - selftests/alsa: Fix circular dependency involving global-timer
+    - ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
+    - net: 802: LLC+SNAP OID:PID lookup on start of skb data
+    - tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
+    - tcp/dccp: allow a connection when sk_max_ack_backlog is zero
+    - net: libwx: fix firmware mailbox abnormal return
+    - pds_core: limit loop over fw name list
+    - bnxt_en: Fix possible memory leak when hwrm_req_replace fails
+    - cxgb4: Avoid removal of uninserted tid
+    - ice: fix incorrect PHY settings for 100 GB/s
+    - igc: return early when failing to read EECD register
+    - tls: Fix tls_sw_sendmsg error handling
+    - eth: gve: use appropriate helper to set xdp_features
+    - Bluetooth: hci_sync: Fix not setting Random Address when required
+    - Bluetooth: MGMT: Fix Add Device to responding before completing
+    - Bluetooth: btnxpuart: Fix driver sending truncated data
+    - tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
+    - riscv: Fix early ftrace nop patching
+    - memblock tests: fix implicit declaration of function 'numa_valid_node'
+    - iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
+    - netfilter: nf_tables: imbalance in flowtable binding
+    - drm/mediatek: stop selecting foreign drivers
+    - [Config] updateconfigs for MTK_SMI
+    - drm/mediatek: Fix YCbCr422 color format issue for DP
+    - drm/mediatek: Fix mode valid issue for dp
+    - drm/mediatek: Add return value check when reading DPCD
+    - cpuidle: riscv-sbi: fix device node release in early exit of
+      for_each_possible_cpu
+    - scsi: ufs: qcom: Power off the PHY if it was already powered on in
+      ufs_qcom_power_up_sequence()
+    - dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
+    - ksmbd: Implement new SMB3 POSIX type
+    - thermal: of: fix OF node leak in of_thermal_zone_find()
+    - smb: client: sync the root session and superblock context passwords before
+      automounting
+    - ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
+    - ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
+    - drm/amd/display: increase MAX_SURFACES to the value supported by hw
+    - io_uring/timeout: fix multishot updates
+    - dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
+    - USB: serial: option: add MeiG Smart SRM815
+    - USB: serial: option: add Neoway N723-EA support
+    - staging: iio: ad9834: Correct phase range check
+    - staging: iio: ad9832: Correct phase range check
+    - usb-storage: Add max sectors quirk for Nokia 208
+    - USB: serial: cp210x: add Phoenix Contact UPS Device
+    - usb: dwc3: gadget: fix writing NYET threshold
+    - misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set
+      config
+    - tty: serial: 8250: Fix another runtime PM usage counter underflow
+    - usb: dwc3-am62: Disable autosuspend during remove
+    - USB: usblp: return error when setting unsupported protocol
+    - USB: core: Disable LPM only for non-suspended ports
+    - usb: fix reference leak in usb_new_device()
+    - usb: gadget: midi2: Reverse-select at the right place
+    - usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in
+      the error path of .probe()
+    - usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
+    - usb: typec: tcpm/tcpci_maxim: fix error code in
+      max_contaminant_read_resistance_kohm()
+    - usb: gadget: configfs: Ignore trailing LF for user strings to cdev
+    - iio: gyro: fxas21002c: Fix missing data update in trigger handler
+    - iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
+    - iio: inkern: call iio_device_put() only on mapped devices
+    - iio: adc: ad7124: Disable all channels at probe time
+    - riscv: kprobes: Fix incorrect address calculation
+    - ARM: dts: imxrt1050: Fix clocks for mmc
+    - arm64: dts: rockchip: add hevc power domain clock to rk3328
+    - pmdomain: imx: gpcv2: Simplify with scoped for each OF child loop
+    - pmdomain: imx: gpcv2: fix an OF node reference leak in imx_gpcv2_probe()
+    - workqueue: Add rcu lock check at the end of work item execution
+    - workqueue: Update lock debugging code
+    - mm/hugetlb: enforce that PMD PT sharing has split PMD PT locks
+    - riscv: Fix text patching when IPI are used
+    - drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported
+    - ovl: pass realinode to ovl_encode_real_fh() instead of realdentry
+    - net: don't dump Tx and uninitialized NAPIs
+    - ice: fix max values for dpll pin phase adjust
+    - net: hns3: fixed reset failure issues caused by the incorrect reset type
+    - net: hns3: fix missing features due to dev->features configuration too early
+    - net: hns3: Resolved the issue that the debugfs query result is inconsistent.
+    - net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
+    - mctp i3c: fix MCTP I3C driver multi-thread issue
+    - drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb()
+    - drm/mediatek: Add support for 180-degree rotation in the display driver
+    - drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188
+    - platform/x86: intel/pmc: Fix ioremap() of bad address
+    - riscv: module: remove relocation_head rel_entry member allocation
+    - cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
+    - fs: kill MNT_ONRB
+    - gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset
+    - drm/amd/pm: fix BUG: scheduling while atomic
+    - drm/amdkfd: wq_release signals dma_fence only when available
+    - drm/amd/display: fix divide error in DM plane scale calcs
+    - drm/amd/display: fix page fault due to max surface definition mismatch
+    - serial: stm32: use port lock wrappers for break control
+    - usb: host: xhci-plat: set skip_phy_initialization if software node has
+      XHCI_SKIP_PHY_INIT property
+    - iio: imu: inv_icm42600: add register caching in the regmap
+    - iio: imu: inv_icm42600: fix spi burst write not supported
+    - Upstream stable to v6.6.71, v6.6.72, v6.12.10
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21659
+    - netdev: prevent accessing NAPI instances from another namespace
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21634
+    - cgroup/cpuset: remove kernfs active break
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21635
+    - rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21643
+    - netfs: Fix kernel async DIO
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21649
+    - net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21650
+    - net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21651
+    - net: hns3: don't auto enable misc vector
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21654
+    - ovl: support encoding fid from inode with no alias
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57883
+    - mm: hugetlb: independent PMD page table shared count
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57888
+    - workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from
+      !WQ_MEM_RECLAIM worker
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21631
+    - block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21656
+    - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21655
+    - io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57904
+    - iio: adc: at91: call input_free_device() on allocated iio_dev
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57906
+    - iio: adc: ti-ads8688: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57907
+    - iio: adc: rockchip_saradc: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57908
+    - iio: imu: kmx61: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57910
+    - iio: light: vcnl4035: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57911
+    - iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered
+      buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57912
+    - iio: pressure: zpa2326: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57913
+    - usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21632
+    - x86/fpu: Ensure shadow stack is active before "getting" registers
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57916
+    - misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57917
+    - topology: Keep the cpumask unchanged when printing cpumap
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57939
+    - riscv: Fix sleeping in invalid context in die()
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21636
+    - sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21637
+    - sctp: sysctl: udp_port: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21638
+    - sctp: sysctl: auth_enable: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21639
+    - sctp: sysctl: rto_min/max: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21640
+    - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21642
+    - mptcp: sysctl: sched: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21664
+    - dm thin: make get_first_thin use rcu-safe list first function
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57945
+    - riscv: mm: Fix the out of bound issue of vmemmap address
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21660
+    - ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21645
+    - platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled
+      it
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21646
+    - afs: Fix the maximum cell name length
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57925
+    - ksmbd: fix a missing return value check bug
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57926
+    - drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind
+      returns err
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21662
+    - net/mlx5: Fix variable not being completed when function returns
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21663
+    - net: stmmac: dwmac-tegra: Read iommu stream id from device tree
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21647
+    - sched: sch_cake: add bounds checks to host bulk flow fairness counts
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21648
+    - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21652
+    - ipvlan: Fix use-after-free in ipvlan_get_iflink().
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21658
+    - btrfs: avoid NULL pointer dereference if no valid extent tree
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21653
+    - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-47736
+    - erofs: handle overlapped pclusters out of crafted images properly
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57940
+    - exfat: fix the infinite loop in exfat_readdir()
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57929
+    - dm array: fix releasing a faulty array block twice in dm_array_cursor_end
+  * intel_idle: add Granite Rapids Xeon (D) support (LP: #2106638)
+    - intel_idle: add Granite Rapids Xeon support
+    - intel_idle: add Granite Rapids Xeon D support
+  * [SRU] Enable speaker/mic mute LEDs on Lenovo ideapad and thinkbook
+    (LP: #2106449)
+    - ALSA: hda: Support for Ideapad hotkey mute LEDs
+    - platform/x86:lenovo-wmi-hotkey-utilities.c: Support for mic and audio mute
+      LEDs
+    - [Config] Enable Lenovo wmi hotkey driver
+  * Backport "PCI: Wait for device readiness with Configuration RRS" to N/O
+    (LP: #2106251)
+    - PCI: Wait for device readiness with Configuration RRS
+    - PCI: Avoid FLR for Mediatek MT7922 WiFi
+  * Enable OOB P-state control for Intel Sierra Forest/Granite Rapids
+    (LP: #2106275)
+    - cpufreq: intel_pstate: Support Granite Rapids and Sierra Forest OOB mode
+  * mptcp BUG 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
+    (LP: #2101120)
+    - mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
+  * CVE-2025-21971
+    - net_sched: Prevent creation of classes with TC_H_ROOT
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632)
+    - smb/client: rename cifs_ntsd to smb_ntsd
+    - smb/client: rename cifs_sid to smb_sid
+    - smb/client: rename cifs_acl to smb_acl
+    - smb/client: rename cifs_ace to smb_ace
+    - fs/smb/client: implement chmod() for SMB3 POSIX Extensions
+    - smb: client: stop flooding dmesg in smb2_calc_signature()
+    - media: uvcvideo: Force UVC version to 1.0a for 0408:4033
+    - Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925
+    - watchdog: rzg2l_wdt: Remove reset de-assert from probe
+    - watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset
+    - watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler
+    - ALSA: ump: Use guard() for locking
+    - ALSA: ump: Don't open legacy substream for an inactive group
+    - scsi: mpi3mr: Use ida to manage mrioc ID
+    - scsi: mpi3mr: Start controller indexing from 0
+    - ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11
+    - ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A
+    - x86/ptrace: Cleanup the definition of the pt_regs structure
+    - x86/ptrace: Add FRED additional information to the pt_regs structure
+    - Bluetooth: btusb: add callback function in btusb suspend/resume
+    - Bluetooth: btusb: mediatek: add callback function in btusb_disconnect
+    - platform/x86: mlx-platform: call pci_dev_put() to balance the refcount
+    - mmc: sdhci-msm: fix crypto key eviction
+    - tracing: Handle old buffer mappings for event strings and functions
+    - tracing: Fix trace_check_vprintf() when tp_printk is used
+    - tracing: Check "%s" dereference via the field and not the TP_printk format
+    - RDMA/bnxt_re: Allow MSN table capability check
+    - RDMA/bnxt_re: Remove always true dattr validity check
+    - RDMA/mlx5: Enforce same type port association for multiport RoCE
+    - RDMA/bnxt_re: Avoid initializing the software queue for user queues
+    - RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters
+    - nvme-pci: 512 byte aligned dma pool segment quirk
+    - RDMA/bnxt_re: Fix the check for 9060 condition
+    - RDMA/bnxt_re: Add check for path mtu in modify_qp
+    - RDMA/bnxt_re: Fix reporting hw_ver in query_device
+    - RDMA/bnxt_re: Fix max_qp_wrs reported
+    - RDMA/bnxt_re: Add support for Variable WQE in Genp7 adapters
+    - RDMA/bnxt_re: Disable use of reserved wqes
+    - RDMA/bnxt_re: Add send queue size check for variable wqe
+    - RDMA/bnxt_re: Fix MSN table size for variable wqe mode
+    - drm/bridge: adv7511_audio: Update Audio InfoFrame properly
+    - net: dsa: microchip: Fix KSZ9477 set_ageing_time function
+    - net: dsa: microchip: Fix LAN937X set_ageing_time function
+    - RDMA/hns: Refactor mtr find
+    - RDMA/hns: Remove unused parameters and variables
+    - RDMA/hns: Fix mapping error of zero-hop WQE buffer
+    - RDMA/hns: Fix warning storm caused by invalid input in IO path
+    - RDMA/hns: Fix missing flush CQE for DWQE
+    - ip_tunnel: annotate data-races around t->parms.link
+    - ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()
+    - ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit()
+    - ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()
+    - net: Fix netns for ip_tunnel_init_flow()
+    - net/mlx5: DR, select MSIX vector 0 for completion queue creation
+    - net/mlx5e: macsec: Maintain TX SA from encoding_sa
+    - drm/i915/dg1: Fix power gate sequence.
+    - net: llc: reset skb->transport_header
+    - ALSA: usb-audio: US16x08: Initialize array before use
+    - eth: bcmsysport: fix call balance of priv->clk handling routines
+    - net: mv643xx_eth: fix an OF node reference leak
+    - net: sfc: Correct key_len for efx_tc_ct_zone_ht_params
+    - net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init()
+    - net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init
+    - wifi: mac80211: wake the queues in case of failure in resume
+    - ALSA: hda/ca0132: Use standard HD-audio quirk matching helpers
+    - ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model
+    - sound: usb: enable DSD output for ddHiFi TC44C
+    - sound: usb: format: don't warn that raw DSD is unsupported
+    - bpf: fix potential error return
+    - ksmbd: retry iterate_dir in smb2_query_dir
+    - smb: client: destroy cfid_put_wq on module exit
+    - net: usb: qmi_wwan: add Telit FE910C04 compositions
+    - irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
+    - ARC: build: Try to guess GCC variant of cross compiler
+    - RDMA/bnxt_re: Fix the max WQE size for static WQE support
+    - modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
+    - modpost: fix the missed iteration for the max bit in do_input()
+    - ALSA: seq: Check UMP support for midi_version change
+    - ALSA hda/realtek: Add quirk for Framework F111:000C
+    - kcov: mark in_softirq_really() as __always_inline
+    - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
+    - sky2: Add device ID 11ab:4373 for Marvell 88E8075
+    - drm: adv7511: Drop dsi single lane support
+    - dt-bindings: display: adi,adv7533: Drop single lane support
+    - fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit
+    - mm/readahead: fix large folio support in async readahead
+    - mptcp: fix recvbuffer adjust on sleeping rcvmsg
+    - mptcp: don't always assume copied data in mptcp_cleanup_rbuf()
+    - RDMA/bnxt_re: Fix max SGEs for the Work Request
+    - scsi: hisi_sas: Remove redundant checks for automatic debugfs dump
+    - platform/x86: hp-wmi: Add thermal profile support for 8BAD boards
+    - platform/x86: hp-wmi: Fix platform profile option switch bug on Omen and
+      Victus laptops
+    - platform/x86: hp-wmi: Fix implementation of the platform_profile_omen_get
+      function
+    - platform/x86: hp-wmi: mark 8A15 board for timed OMEN thermal profile
+    - RDMA/core: Fix ENODEV error for iWARP test over vlan
+    - net: phy: micrel: Dynamically control external clock of KSZ PHY
+    - netdev-genl: avoid empty messages in napi get
+    - net: stmmac: restructure the error path of stmmac_probe_config_dt()
+    - net/mlx5e: Fix netif state handling
+    - net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only
+    - drm/i915/cx0_phy: Fix C10 pll programming sequence
+    - RDMA/bnxt_re: Fix error recovery sequence
+    - btrfs: allow swap activation to be interruptible
+    - perf/x86/intel: Add Arrow Lake U support
+    - ALSA: hda: cs35l56: Remove calls to
+      cs35l56_force_sync_asp1_registers_from_cache()
+    - ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio
+    - spi: spi-cadence-qspi: Disable STIG mode for Altera SoCFPGA.
+    - ARC: build: disallow invalid PAE40 + 4K page config
+    - bpf: refactor bpf_helper_changes_pkt_data to use helper number
+    - bpf: consider that tail calls invalidate packet pointers
+    - maple_tree: reload mas before the second call for mas_empty_area
+    - io_uring/rw: fix downgraded mshot read
+    - wifi: iwlwifi: mvm: Fix __counted_by usage in cfg80211_wowlan_nd_*
+    - net: ethernet: ti: am65-cpsw: default to round-robin for host port receive
+    - gve: process XSK TX descriptors as part of RX NAPI
+    - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
+    - mm: reinstate ability to map write-sealed memfd mappings read-only
+    - Upstream stable to v6.6.70, v6.12.9
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57898
+    - wifi: cfg80211: clear link ID from bitmap during link delete after clean up
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57882
+    - mptcp: fix TCP options overflow.
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57884
+    - mm: vmscan: account for free pages to prevent infinite Loop in
+      throttle_direct_reclaim()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57885
+    - mm/kmemleak: fix sleeping function called from invalid context at print
+      message
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57932
+    - gve: guard XDP xmit NDO on existence of xdp queues
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57933
+    - gve: guard XSK operations on the existence of queues
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57887
+    - drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57938
+    - net/sctp: Prevent autoclose integer overflow in sctp_association_init()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57889
+    - pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57890
+    - RDMA/uverbs: Prevent integer overflow issue
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57892
+    - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57893
+    - ALSA: seq: oss: Fix races at processing SysEx messages
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57895
+    - ksmbd: set ATTR_CTIME flags when setting mtime
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57896
+    - btrfs: flush delalloc workers queue before stopping cleaner kthread during
+      unmount
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57897
+    - drm/amdkfd: Correct the migration DMA map direction
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57899
+    - wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57900
+    - ila: serialize calls to nf_register_net_hooks()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57901
+    - af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57902
+    - af_packet: fix vlan_get_tci() vs MSG_PEEK
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57903
+    - net: restrict SO_REUSEPORT to inet sockets
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-36476
+    - RDMA/rtrs: Ensure 'ib_sge list' is accessible
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-39282
+    - net: wwan: t7xx: Fix FSM command timeout issue
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57801
+    - net/mlx5e: Skip restore TC rules for vport rep without loaded flag
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57802
+    - netrom: check buffer length before accessing it
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57841
+    - net: fix memory leak in tcp_conn_request()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57931
+    - selinux: ignore unknown extended permissions
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-56761
+    - x86/fred: Clear WFE in missing-ENDBRANCH #CPs
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-53179
+    - smb: client: fix use-after-free of signing key
+  * uprobe-related panics during profiling (LP: #2104210)
+    - uprobes: Fix race in uprobe_free_utask
+  * ubuntu_bpf failed to build on Noble / Oracular (LP: #2069407)
+    - selftests/bpf: Fix compilation failure when CONFIG_NET_FOU!=y
+  * nfsd hangs and never recovers after NFS4ERR_DELAY and a connection loss
+    (LP: #2103564)
+    - NFSD: Reset cb_seq_status after NFS4ERR_DELAY
+  * thermal: Fix temperature readings on intel hardware (LP: #2103427)
+    - thermal: intel: intel_tcc: Add model checks for temperature registers
+    - thermal: intel: intel_tcc_cooling: Use a model-specific bitmask for TCC
+      offset
+    - hwmon: (coretemp) Extend the bitmask to read temperature to 0xff
+  * [SRU] Fix Lenovo M70/90 gen6 micmute key and led (LP: #2101811)
+    - ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
+    - ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869)
+    - ceph: allocate sparse_ext map only for sparse reads
+    - mm/vmstat: fix a W=1 clang compiler warning
+    - tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress()
+    - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
+    - bpf: Check negative offsets in __bpf_skb_min_len()
+    - mtd: diskonchip: Cast an operand to prevent potential overflow
+    - mtd: rawnand: arasan: Fix double assertion of chip-select
+    - mtd: rawnand: arasan: Fix missing de-registration of NAND
+    - phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP
+    - phy: core: Fix an OF node refcount leakage in _of_phy_get()
+    - phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
+    - phy: core: Fix that API devm_phy_put() fails to release the phy
+    - phy: core: Fix that API devm_of_phy_provider_unregister() fails to
+      unregister the phy provider
+    - phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
+    - phy: usb: Toggle the PHY power during init
+    - phy: rockchip: naneng-combphy: fix phy reset
+    - dmaengine: mv_xor: fix child node refcount handling in early exit
+    - dmaengine: dw: Select only supported masters for ACPI devices
+    - dmaengine: tegra: Return correct DMA status when paused
+    - dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd()
+    - dmaengine: apple-admac: Avoid accessing registers in probe
+    - stddef: make __struct_group() UAPI C++-friendly
+    - tracing/kprobe: Make trace_kprobe's module callback called after jump_label
+      update
+    - watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
+    - watchdog: mediatek: Add support for MT6735 TOPRGU/WDT
+    - scsi: qla1280: Fix hw revision numbering for ISP1020/1040
+    - udf: Skip parent dir link count update if corrupted
+    - ALSA: hda/conexant: fix Z60MR100 startup pop issue
+    - ALSA: sh: Use standard helper for buffer accesses
+    - smb: server: Fix building with GCC 15
+    - regmap: Use correct format specifier for logging range errors
+    - LoongArch: Fix reserving screen info memory for above-4G firmware
+    - LoongArch: BPF: Adjust the parameter of emit_jirl()
+    - platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
+    - spi: intel: Add Panther Lake SPI controller support
+    - scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load
+      time
+    - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN
+      as an error
+    - spi: omap2-mcspi: Fix the IS_ERR() bug for devm_clk_get_optional_enabled()
+    - blk-mq: register cpuhp callback after hctx is added to xarray table
+    - blk-mq: move cpuhp callback registering out of q->sysfs_lock
+    - MIPS: Probe toolchain support of -msym32
+    - MIPS: mipsregs: Set proper ISA level for virt extensions
+    - freezer, sched: Report frozen tasks as 'D' instead of 'R'
+    - tracing: Constify string literal data member in struct trace_event_call
+    - io_uring/sqpoll: fix sqpoll error handling races
+    - i2c: microchip-core: actually use repeated sends
+    - i2c: imx: add imx7d compatible string for applying erratum ERR007805
+    - i2c: microchip-core: fix "ghost" detections
+    - btrfs: sysfs: fix direct super block member reads
+    - ALSA: sh: Fix wrong argument order for copy_from_iter()
+    - block: avoid to reuse `hctx` not removed from cpuhp callback list
+    - fork: avoid inappropriate uprobe access to invalid mm
+    - ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
+    - power: supply: bq24190: Fix BQ24296 Vbus regulator support
+    - udf: Verify inode link counts before performing rename
+    - ALSA: ump: Indicate the inactive group in legacy substream names
+    - ALSA: ump: Update legacy substream names upon FB info update
+    - scsi: mpi3mr: Synchronize access to ioctl data buffer
+    - scsi: mpi3mr: Handling of fault code for insufficient power
+    - objtool: Add bch2_trans_unlocked_error() to bcachefs noreturns
+    - dmaengine: loongson2-apb: Change GENMASK to GENMASK_ULL
+    - perf/x86/intel/ds: Add PEBS format 6
+    - btrfs: add and use helper to verify the calling task has locked the inode
+    - btrfs: fix race with memory mapped writes when activating swap file
+    - btrfs: fix swap file activation failure due to extents that used to be
+      shared
+    - ALSA: ump: Shut up truncated string warning
+    - Upstream stable to v6.6.69, v6.12.8
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56758
+    - btrfs: check folio mapping after unlock in relocate_one_folio()
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56759
+    - btrfs: fix use-after-free when COWing tree bock and tracing is enabled
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57806
+    - btrfs: fix transaction atomicity bug when enabling simple quotas
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57793
+    - virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56764
+    - ublk: detach gendisk from ublk device if add_disk() fails
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57804
+    - scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57792
+    - power: supply: gpio-charger: Fix set charge current limits
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56760
+    - PCI/MSI: Handle lack of irqdomain gracefully
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56763
+    - tracing: Prevent bad count for tracing_cpumask_write
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57946
+    - virtio-blk: don't keep queue frozen during system suspend
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57807
+    - scsi: megaraid_sas: Fix for a potential deadlock
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56767
+    - dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56769
+    - media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266)
+    - usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with
+      iommu enabled
+    - PCI: vmd: Create domain symlink before pci_bus_add_devices()
+    - PCI: Add ACS quirk for Broadcom BCM5760X NIC
+    - usb: cdns3-ti: Add workaround for Errata i2409
+    - MIPS: Loongson64: DTS: Fix msi node for ls7a
+    - ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP
+    - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C
+    - usb: cdns3: Add quirk flag to enable suspend residency
+    - platform/x86: p2sb: Make p2sb_get_devfn() return void
+    - p2sb: Factor out p2sb_read_from_cache()
+    - p2sb: Introduce the global flag p2sb_hidden_by_bios
+    - p2sb: Move P2SB hide and unhide code to p2sb_scan_and_cache()
+    - p2sb: Do not scan and remove the P2SB device when it is unhidden
+    - i2c: pnx: Fix timeout in wait functions
+    - xfs: fix the contact address for the sysfs ABI documentation
+    - xfs: verify buffer, inode, and dquot items every tx commit
+    - xfs: use consistent uid/gid when grabbing dquots for inodes
+    - xfs: declare xfs_file.c symbols in xfs_file.h
+    - xfs: create a new helper to return a file's allocation unit
+    - xfs: Fix xfs_flush_unmap_range() range for RT
+    - xfs: Fix xfs_prepare_shift() range for RT
+    - xfs: convert comma to semicolon
+    - xfs: fix file_path handling in tracepoints
+    - xfs: remove unused parameter in macro XFS_DQUOT_LOGRES
+    - xfs: attr forks require attr, not attr2
+    - xfs: conditionally allow FS_XFLAG_REALTIME changes if S_DAX is set
+    - xfs: Fix the owner setting issue for rmap query in xfs fsmap
+    - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
+    - xfs: take m_growlock when running growfsrt
+    - xfs: reset rootdir extent size hint after growfsrt
+    - tools: hv: change permissions of NetworkManager configuration file
+    - cxl/pci: Fix potential bogus return value upon successful probing
+    - cxl/region: Fix region creation for greater than x2 switches
+    - net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
+    - ionic: use ee->offset when returning sprom data
+    - net: renesas: rswitch: rework ts tags management
+    - net: hinic: Fix cleanup in create_rxqs/txqs()
+    - net: ethernet: bgmac-platform: fix an OF node reference leak
+    - ipvs: Fix clamp() of ip_vs_conn_tab on small memory systems
+    - netfilter: ipset: Fix for recursive locking warning
+    - selftests: openvswitch: fix tcpdump execution
+    - net: mdiobus: fix an OF node reference leak
+    - mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
+    - mmc: mtk-sd: disable wakeup in .remove() and in the error path of .probe()
+    - EDAC/amd64: Simplify ECC check on unified memory controllers
+    - chelsio/chtls: prevent potential integer overflow on 32bit
+    - i2c: riic: Always round-up when calculating bus period
+    - efivarfs: Fix error on non-existent file
+    - hexagon: Disable constant extender optimization for LLVM prior to 19.1.0
+    - USB: serial: option: add TCL IK512 MBIM & ECM
+    - USB: serial: option: add MeiG Smart SLM770A
+    - USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
+    - USB: serial: option: add MediaTek T7XX compositions
+    - USB: serial: option: add Telit FE910C04 rmnet compositions
+    - thunderbolt: Improve redrive mode handling
+    - drm/panel: novatek-nt35950: fix return value check in nt35950_probe()
+    - i915/guc: Reset engine utilization buffer before registration
+    - i915/guc: Ensure busyness counter increases motonically
+    - i915/guc: Accumulate active runtime on gt reset
+    - hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit
+      Registers
+    - hwmon: (tmp513) Fix Current Register value interpretation
+    - hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit
+      Registers
+    - zram: refuse to use zero sized block device as backing device
+    - zram: fix uninitialized ZRAM not releasing backing device
+    - zram: fix potential UAF of zram table
+    - vmalloc: fix accounting with i915
+    - btrfs: tree-checker: reject inline extent items with 0 ref count
+    - smb: client: fix TCP timers deadlock after rmmod
+    - tracing: Fix test_event_printk() to process entire print argument
+    - tracing: Add missing helper functions in event pointer dereference check
+    - tracing: Add "%s" check in test_event_printk()
+    - tracing: Have process_string() also allow arrays
+    - selftests/memfd: run sysctl tests when PID namespace support is enabled
+    - selftests/bpf: Use asm constraint "m" for LoongArch
+    - io_uring: Fix registered ring file refcount leak
+    - NFS/pnfs: Fix a live lock between recalled layouts and layoutget
+    - of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent()
+    - of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
+    - nilfs2: fix buffer head leaks in calls to truncate_inode_pages()
+    - udmabuf: also check for F_SEAL_FUTURE_WRITE
+    - of: Fix error path in of_parse_phandle_with_args_map()
+    - of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
+    - ceph: validate snapdirname option length when mounting
+    - ceph: improve error handling and short/overflow-read logic in
+      __ceph_sync_read()
+    - ceph: fix memory leaks in __ceph_sync_read()
+    - epoll: Add synchronous wakeup support for ep_poll_callback
+    - io_uring/rw: avoid punting to io-wq directly
+    - drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update
+    - xfs: sb_spino_align is not verified
+    - xfs: fix sparse inode limits on runt AG
+    - xfs: fix sb_spino_align checks for large fsblock sizes
+    - xfs: fix zero byte checking in the superblock scrubber
+    - netdev: fix repeated netlink messages in queue dump
+    - team: Fix feature exposure when no ports are present
+    - can: m_can: fix missed interrupts with m_can_pci
+    - netdev-genl: avoid empty messages in queue dump
+    - KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden
+    - KVM: arm64: Fix set_id_regs selftest for ASIDBITS becoming unwritable
+    - net: mctp: handle skb cleanup on sock_queue failures
+    - xhci: retry Stop Endpoint on buggy NEC controllers
+    - usb: xhci: Limit Stop Endpoint retries
+    - usb: xhci: Avoid queuing redundant Stop Endpoint commands
+    - xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic
+    - thunderbolt: Add support for Intel Panther Lake-M/P
+    - thunderbolt: Don't display nvm_version unless upgrade supported
+    - drm/panel: st7701: Add prepare_prev_first flag to drm_panel
+    - drm/panel: synaptics-r63353: Fix regulator unbalance
+    - drm/amdgpu/nbio7.11: fix IP version check
+    - drm/amdgpu/nbio7.7: fix IP version check
+    - fgraph: Still initialize idle shadow stacks when starting
+    - x86/hyperv: Fix hv tsc page based sched_clock for hibernation
+    - ocfs2: fix the space leak in LA when releasing LA
+    - of: property: fw_devlink: Do not use interrupt-parent directly
+    - of: address: Preserve the flags portion on 1:1 dma-ranges mapping
+    - Upstream stable to v6.6.68, v6.12.7
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56710
+    - ceph: fix memory leak in ceph_direct_read_write()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-53685
+    - ceph: give up on paths longer than PATH_MAX
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-54193
+    - accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-54455
+    - accel/ivpu: Fix general protection fault in ivpu_bo_list()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-53690
+    - nilfs2: prevent use of deleted inode
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56709
+    - io_uring: check if iowq is killed before queuing
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-55881
+    - KVM: x86: Play nice with protected guests in complete_hypercall_exit()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-55916
+    - Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56369
+    - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56372
+    - net: tun: fix tun_napi_alloc_frags()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56715
+    - ionic: Fix netdev notifier unregister on failure
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56716
+    - netdevsim: prevent bad user input in nsim_dev_health_break_write()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56717
+    - net: mscc: ocelot: fix incorrect IFH SRC_PORT field in
+      ocelot_ifh_set_basic()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-57791
+    - net/smc: check return value of sock_recvmsg when draining clc data
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-47408
+    - net/smc: check smcd_v2_ext_offset when receiving proposal msg
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-49568
+    - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-49571
+    - net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal
+      msg
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56718
+    - net/smc: protect link down work from execute after lgr freed
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-41013
+    - xfs: don't walk off the end of a directory data block
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181)
+    - perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
+    - ksmbd: fix racy issue from session lookup and expire
+    - splice: do not checksum AF_UNIX sockets
+    - tcp: check space before adding MPTCP SYN options
+    - ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
+    - usb: host: max3421-hcd: Correctly abort a USB request.
+    - ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
+    - usb: dwc2: Fix HCD resume
+    - usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
+    - usb: dwc2: Fix HCD port connection race
+    - scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
+    - usb: gadget: midi2: Fix interpretation of is_midi1 bits
+    - usb: ehci-hcd: fix call balance of clocks handling routines
+    - usb: typec: anx7411: fix fwnode_handle reference leak
+    - usb: typec: anx7411: fix OF node reference leaks in
+      anx7411_typec_switch_probe()
+    - usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
+    - drm/i915: Fix memory leak by correcting cache object name in error handler
+    - xfs: update btree keys correctly when _insrec splits an inode root block
+    - xfs: don't drop errno values when we fail to ficlone the entire range
+    - xfs: return from xfs_symlink_verify early on V4 filesystems
+    - xfs: fix scrub tracepoints when inode-rooted btrees are involved
+    - xfs: only run precommits once per transaction object
+    - bpf: Check size for BTF-based ctx access of pointer members
+    - bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
+    - bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
+    - bpf, sockmap: Fix update element with same
+    - wifi: mac80211: init cnt before accessing elem in
+      ieee80211_copy_mbssid_beacon
+    - wifi: mac80211: clean up 'ret' in sta_link_apply_parameters()
+    - wifi: mac80211: fix station NSS capability initialization order
+    - batman-adv: Do not send uninitialized TT changes
+    - batman-adv: Remove uninitialized data in full table TT response
+    - batman-adv: Do not let TT changes list grows indefinitely
+    - wifi: cfg80211: sme: init n_channels before channels[] access
+    - selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
+    - selftests: mlxsw: sharedbuffer: Remove duplicate test cases
+    - selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
+    - ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
+    - net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
+    - net: mscc: ocelot: improve handling of TX timestamp for unknown skb
+    - net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-
+      safe
+    - net: mscc: ocelot: be resilient to loss of PTP packets during transmission
+    - net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
+    - spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
+    - net: sparx5: fix FDMA performance issue
+    - net: sparx5: fix the maximum frame length register
+    - ACPI: resource: Fix memory resource type union access
+    - cxgb4: use port number to set mac addr
+    - qca_spi: Fix clock speed for multiple QCA7000
+    - qca_spi: Make driver probing reliable
+    - ASoC: amd: yc: Fix the wrong return value
+    - Documentation: PM: Clarify pm_runtime_resume_and_get() return value
+    - net: renesas: rswitch: fix race window between tx start and complete
+    - net: renesas: rswitch: fix leaked pointer on error path
+    - net: renesas: rswitch: handle stop vs interrupt race
+    - net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
+    - netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
+    - bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
+    - team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
+    - ACPICA: events/evxfregn: don't release the ContextMutex that was never
+      acquired
+    - Bluetooth: iso: Fix recursive locking warning
+    - Bluetooth: SCO: Add support for 16 bits transparent voice setting
+    - net: renesas: rswitch: fix initial MPIC register setting
+    - net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
+    - blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
+    - kselftest/arm64: abi: fix SVCR detection
+    - KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
+    - selftests/bpf: remove use of __xlated()
+    - xen/netfront: fix crash when removing device
+    - x86: make get_cpu_vendor() accessible from Xen code
+    - objtool/x86: allow syscall instruction
+    - x86/static-call: provide a way to do very early static-call updates
+    - x86/xen: don't do PV iret hypercall through hypercall page
+    - x86/xen: add central hypercall functions
+    - x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
+    - x86/xen: add FRAME_END to xen_hypercall_hvm()
+    - x86/xen: use new hypercall functions instead of hypercall page
+    - x86/xen: remove hypercall page
+    - x86/static-call: fix 32-bit build
+    - x86/asm: Make serialize() always_inline
+    - x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0
+    - serial: sh-sci: Check if TX data was written to device in .tx_empty()
+    - gpio: ljca: Initialize num before accessing item in ljca_gpio_config
+    - ALSA: hda/realtek: Fix headset mic on Acer Nitro 5
+    - drm/amdkfd: Use device based logging for errors
+    - drm/amdkfd: pause autosuspend when creating pdd
+    - drm/amdkfd: fixed page fault when enable MES shader debugger
+    - drm/i915/color: Stop using non-posted DSB writes for legacy LUT
+    - drm/amd/pm: Set SMU v13.0.7 default workload type
+    - xfs: return a 64-bit block count from xfs_btree_count_blocks
+    - perf machine: Initialize machine->env to address a segfault
+    - bnxt_en: Fix GSO type for HW GRO packets on 5750X chips
+    - net: renesas: rswitch: fix possible early skb release
+    - Bluetooth: Improve setsockopt() handling of malformed user input
+    - libperf: evlist: Fix --cpu argument on hybrid platform
+    - selftests: netfilter: Stabilize rpath.sh
+    - net, team, bonding: Add netdev_base_features helper
+    - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
+    - team: Fix initial vlan_feature set in __team_compute_features
+    - drm/xe: fix the ERR_PTR() returned on failure to allocate tiny pt
+    - Upstream stable to v6.6.67, v6.12.6
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56652
+    - drm/xe/reg_sr: Remove register pool
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-54460
+    - Bluetooth: iso: Fix circular lock in iso_listen_bis
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-57879
+    - Bluetooth: iso: Always release hdev at the end of iso_listen_bis
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56656
+    - bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-53125
+    - bpf: sync_linked_regs() must preserve subreg_def
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56654
+    - Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56770
+    - net/sched: netem: account for backlog updates from child qdisc
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-54683
+    - netfilter: IDLETIMER: Fix for possible ABBA deadlock
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-55639
+    - net: renesas: rswitch: avoid use-after-put for a device tree node
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56657
+    - ALSA: control: Avoid WARN() for symlink errors
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56659
+    - net: lapb: increase LAPB_HEADER_LEN
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56660
+    - net/mlx5: DR, prevent potential error pointer dereference
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56662
+    - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56664
+    - bpf, sockmap: Fix race between element replace and close()
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56667
+    - drm/i915: Fix NULL pointer dereference in capture_engine
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56670
+    - usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to
+      accessing null pointer
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-53687
+    - riscv: Fix IPIs usage in kfence_protect_page()
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56675
+    - bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
+  * Noble update: upstream stable patchset 2025-02-04 (LP: #2097393)
+    - selftests: net: Remove executable bits from library scripts
+  * CVE-2024-56653
+    - Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
+
+  [ Ubuntu: 6.8.0-58.60 ]
+
+  * noble/linux: 6.8.0-58.60 -proposed tracker (LP: #2102529)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2025.03.17)
+  * wdat_wdt.ko should be pulled in by linux-image-virtual (LP: #2098554)
+    - [Packaging]: wdat_wdt.ko is moved from "linux-modules-extra-*-generic" to
+      "linux-modules-*-generic"
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118)
+    - openrisc: Use asm-generic's version of fix_to_virt() & virt_to_fix()
+    - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
+    - watchdog: xilinx_wwdt: Calculate max_hw_heartbeat_ms using clock frequency
+    - watchdog: apple: Actually flush writes after requesting watchdog restart
+    - watchdog: mediatek: Make sure system reset gets asserted in
+      mtk_wdt_restart()
+    - can: gs_usb: add VID/PID for Xylanta SAINT3 product family
+    - can: gs_usb: add usb endpoint address detection at driver probe step
+    - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
+    - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics
+    - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics
+    - can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
+    - can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
+    - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
+    - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
+    - can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics
+    - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
+    - selftests: hid: fix typo and exit code
+    - ptp: Add error handling for adjfine callback in ptp_clock_adjtime
+    - net/sched: tbf: correct backlog statistic for GSO packets
+    - net: hsr: fix fill_frame_info() regression vs VLAN packets
+    - platform/x86: asus-wmi: add support for vivobook fan profiles
+    - platform/x86: asus-wmi: Fix inconsistent use of thermal policies
+    - platform/x86: asus-wmi: Ignore return value when writing thermal policy
+    - net/smc: mark optional smcd_ops and check for support when called
+    - net/smc: add operations to merge sndbuf with peer DMB
+    - net/smc: {at|de}tach sndbuf to peer DMB if supported
+    - net/smc: refactoring initialization of smc sock
+    - net/qed: allow old cards not supporting "num_images" to work
+    - ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5
+    - ixgbe: downgrade logging of unsupported VF API version to debug
+    - net: sched: fix erspan_opt settings in cls_flower
+    - netfilter: nft_set_hash: skip duplicated elements pending gc run
+    - netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
+    - ethtool: Fix wrong mod state in case of verbose and no_mask bitset
+    - mlxsw: spectrum_acl_flex_keys: Constify struct mlxsw_afk_element_inst
+    - mlxsw: spectrum_acl_flex_keys: Use correct key block on Spectrum-4
+    - net/mlx5e: Remove workaround to avoid syndrome for internal port
+    - xhci: Allow RPM on the USB controller (1022:43f7) by default
+    - gpio: grgpio: use a helper variable to store the address of ofdev->dev
+    - usb: dwc3: gadget: Rewrite endpoint allocation flow
+    - usb: dwc3: ep0: Don't reset resource alloc flag (including ep0)
+    - usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED
+    - mmc: mtk-sd: use devm_mmc_alloc_host
+    - mmc: mtk-sd: Fix error handle of probe function
+    - mmc: mtk-sd: fix devm_clk_get_optional usage
+    - mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting
+    - zram: do not mark idle slots that cannot be idle
+    - zram: clear IDLE flag in mark_idle()
+    - powerpc/vdso: Refactor CFLAGS for CVDSO build
+    - powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang
+    - ntp: Remove invalid cast in time offset math
+    - driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link
+    - driver core: fw_devlink: Stop trying to optimize cycle detection logic
+    - drivers: core: fix device leak in __fw_devlink_relax_cycles()
+    - i3c: master: support to adjust first broadcast address speed
+    - i3c: master: svc: use slow speed for first broadcast address
+    - i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter
+    - i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS
+    - i3c: master: Extend address status bit to 4 and add
+      I3C_ADDR_SLOT_EXT_DESIRED
+    - i3c: master: Fix dynamic address leak when 'assigned-address' is present
+    - i3c: master: Fix missing 'ret' assignment in set_speed()
+    - drm/bridge: it6505: update usleep_range for RC circuit charge time
+    - drm/bridge: it6505: Fix inverted reset polarity
+    - scsi: ufs: core: Always initialize the UIC done completion
+    - scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG
+    - bpf, vsock: Fix poll() missing a queue
+    - bpf, vsock: Invoke proto::close on close()
+    - xsk: always clear DMA mapping information when unmapping the pool
+    - bpftool: fix potential NULL pointer dereferencing in prog_dump()
+    - drm/sti: Add __iomem for mixer_dbg_mxn's parameter
+    - ALSA: seq: ump: Use automatic cleanup of kfree()
+    - ALSA: ump: Update substream name from assigned FB names
+    - ALSA: seq: ump: Fix seq port updates per FB info notify
+    - ALSA: usb-audio: Notify xrun for low-latency mode
+    - tools: Override makefile ARCH variable if defined, but empty
+    - ASoC: SOF: ipc3-topology: Convert the topology pin index to ALH dai index
+    - ASoC: SOF: ipc3-topology: fix resource leaks in
+      sof_ipc3_widget_setup_comp_dai()
+    - bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
+    - scsi: scsi_debug: Fix hrtimer support for ndelay
+    - ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
+    - drm/v3d: Enable Performance Counters before clearing them
+    - scatterlist: fix incorrect func name in kernel-doc
+    - iio: magnetometer: yas530: use signed integer type for clamp limits
+    - bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
+    - bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem
+    - bpf: Handle in-place update for full LPM trie correctly
+    - bpf: Fix exact match conditions in trie_get_next_key()
+    - x86/CPU/AMD: WARN when setting EFER.AUTOIBRS if and only if the WRMSR fails
+    - watchdog: rti: of: honor timeout-sec property
+    - can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6.
+    - tracing: Fix cmp_entries_dup() to respect sort() comparison rules
+    - arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit
+      ASIDs
+    - ALSA: usb-audio: add mixer mapping for Corsair HS80
+    - ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
+    - ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
+    - scsi: qla2xxx: Fix abort in bsg timeout
+    - scsi: qla2xxx: Fix NVMe and NPIV connect issue
+    - scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
+    - scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
+    - scsi: ufs: core: Add missing post notify for power mode change
+    - fs/smb/client: cifs_prime_dcache() for SMB3 POSIX reparse points
+    - drm/dp_mst: Verify request type in the corresponding down message reply
+    - drm/amdgpu/hdp5.2: do a posting read when flushing HDP
+    - modpost: Add .irqentry.text to OTHER_SECTIONS
+    - x86/kexec: Restore GDT on return from ::preserve_context kexec
+    - dma-buf: fix dma_fence_array_signaled v4
+    - dma-fence: Fix reference leak on fence merge failure path
+    - dma-fence: Use kernel's sort for merging fences
+    - regmap: detach regmap from dev on regmap_exit
+    - mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10
+      tablet
+    - mmc: core: Further prevent card detect during shutdown
+    - ocfs2: update seq_file index in ocfs2_dlm_seq_next
+    - lib: stackinit: hide never-taken branch from compiler
+    - kasan: make report_lock a raw spinlock
+    - x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables
+    - epoll: annotate racy check
+    - kselftest/arm64: Log fp-stress child startup errors to stdout
+    - btrfs: avoid unnecessary device path update for the same device
+    - btrfs: do not clear read-only when adding sprout device
+    - kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
+    - hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list
+    - ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID
+    - perf/x86/amd: Warn only on new bits set
+    - spi: spi-fsl-lpspi: Adjust type of scldiv
+    - HID: add per device quirk to force bind to hid-generic
+    - media: uvcvideo: RealSense D421 Depth module metadata
+    - media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
+    - media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
+    - mmc: core: Add SD card quirk for broken poweroff notification
+    - mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
+    - regmap: maple: Provide lockdep (sub)class for maple tree's internal lock
+    - selftests/resctrl: Protect against array overflow when reading strings
+    - drm/vc4: hdmi: Avoid log spam for audio start failure
+    - drm/vc4: hvs: Set AXI panic modes for the HVS
+    - drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
+    - drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
+    - drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
+    - drm/bridge: it6505: Enable module autoloading
+    - drm/mcde: Enable module autoloading
+    - drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
+    - drm/display: Fix building with GCC 15
+    - ALSA: hda: Use own quirk lookup helper
+    - ALSA: hda/conexant: Use the new codec SSID matching
+    - r8169: don't apply UDP padding quirk on RTL8126A
+    - samples/bpf: Fix a resource leak
+    - net: fec_mpc52xx_phy: Use %pa to format resource_size_t
+    - net: ethernet: fs_enet: Use %pa to format resource_size_t
+    - net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
+    - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
+    - wifi: ath5k: add PCI ID for SX76X
+    - wifi: ath5k: add PCI ID for Arcadyan devices
+    - fanotify: allow reporting errors on failure to open fd
+    - drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
+    - net: sfp: change quirks for Alcatel Lucent G-010S-P
+    - net: stmmac: Programming sequence for VLAN packets with split header
+    - drm/sched: memset() 'job' in drm_sched_job_init()
+    - amdgpu/uvd: get ring reference from rq scheduler
+    - drm/amdgpu: don't access invalid sched
+    - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
+    - drm/amdgpu: Dereference the ATCS ACPI buffer
+    - netlink: specs: Add missing bitset attrs to ethtool spec
+    - drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
+    - fsl/fman: Validate cell-index value obtained from Device Tree
+    - drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
+    - ALSA: usb-audio: Make mic volume workarounds globally applicable
+    - wifi: ipw2x00: libipw_rx_any(): fix bad alignment
+    - dsa: qca8k: Use nested lock to avoid splat
+    - Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
+    - Bluetooth: Add new quirks for ATS2851
+    - Bluetooth: Support new quirks for ATS2851
+    - Bluetooth: Set quirks for ATS2851
+    - ASoC: hdmi-codec: reorder channel allocation list
+    - rocker: fix link status detection in rocker_carrier_init()
+    - net/neighbor: clear error in case strict check is not set
+    - netpoll: Use rcu_access_pointer() in __netpoll_setup
+    - pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
+    - tracing/ftrace: disable preemption in syscall probe
+    - tracing: Use atomic64_inc_return() in trace_clock_counter()
+    - tools/rtla: fix collision with glibc sched_attr/sched_set_attr
+    - rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
+    - scsi: ufs: core: Make DMA mask configuration more flexible
+    - scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
+    - clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
+    - clk: qcom: rpmh: add support for SAR2130P
+    - clk: qcom: tcsrcc-sm8550: add SAR2130P support
+    - scsi: st: Don't modify unknown block number in MTIOCGET
+    - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
+    - pinctrl: qcom-pmic-gpio: add support for PM8937
+    - pinctrl: qcom: spmi-mpp: Add PM8937 compatible
+    - thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens
+    - nvdimm: rectify the illogical code within nd_dax_probe()
+    - smb: client: memcpy() with surrounding object base address
+    - verification/dot2: Improve dot parser robustness
+    - KMSAN: uninit-value in inode_go_dump (5)
+    - PCI: qcom: Add support for IPQ9574
+    - PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs
+    - PCI: vmd: Set devices to D0 before enabling PM L1 Substates
+    - PCI: Detect and trust built-in Thunderbolt chips
+    - PCI: Add 'reset_subordinate' to reset hierarchy below bridge
+    - PCI: Add ACS quirk for Wangxun FF5xxx NICs
+    - f2fs: print message if fscorrupted was found in f2fs_new_node_page()
+    - ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840
+    - ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[]
+    - fs/ntfs3: Fix case when unmarked clusters intersect with zone
+    - usb: chipidea: udc: handle USB Error Interrupt if IOC not set
+    - iio: light: ltr501: Add LTER0303 to the supported devices
+    - ASoC: amd: yc: fix internal mic on Redmi G 2022
+    - drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3
+    - drm/amdgpu/vcn: reset fw_shared under SRIOV
+    - ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6
+      21M1CTO1WW
+    - misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
+    - rtc: cmos: avoid taking rtc_lock for extended period of time
+    - serial: 8250_dw: Add Sophgo SG2044 quirk
+    - smb: client: don't try following DFS links in cifs_tree_connect()
+    - setlocalversion: work around "git describe" performance
+    - sched/core: Remove the unnecessary need_resched() check in nohz_csd_func()
+    - sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning
+      busy
+    - sched/core: Prevent wakeup of ksoftirqd during idle load balance
+    - btrfs: fix missing snapshot drew unlock when root is dead during swap
+      activation
+    - clk: en7523: Initialize num before accessing hws in en7523_register_clocks()
+    - tracing/eprobe: Fix to release eprobe when failed to add dyn_event
+    - x86: Fix build regression with CONFIG_KEXEC_JUMP enabled
+    - Revert "unicode: Don't special case ignorable code points"
+    - vfio/mlx5: Align the page tracking max message size with the device
+      capability
+    - selftests/ftrace: adjust offset for kprobe syntax error test
+    - KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from
+      kvm_faultin_pfn()
+    - jffs2: Fix rtime decompressor
+    - mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
+    - iio: invensense: fix multiple odr switch when FIFO is off
+    - ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
+    - ALSA: hda: Fix build error without CONFIG_SND_DEBUG
+    - usb: dwc3: ep0: Don't reset resource alloc flag
+    - ALSA: usb-audio: Update UMP group attributes for GTB blocks, too
+    - platform/x86: asus-wmi: Fix thermal profile initialization
+    - i3c: master: svc: fix possible assignment of the same address to two devices
+    - btrfs: drop unused parameter file_offset from
+      btrfs_encoded_read_regular_fill_pages()
+    - md/raid5: Wait sync io to finish before changing group cnt
+    - media: platform: rga: fix 32-bit DMA limitation
+    - net: phy: dp83869: fix status reporting for 1000base-x autonegotiation
+    - remoteproc: qcom_q6v5_pas: disable auto boot for wpss
+    - mtd: spinand: winbond: Fix 512GW and 02JW OOB layout
+    - PCI: Pass domain number to pci_bus_release_domain_nr() explicitly
+    - dt-bindings: net: fec: add pps channel property
+    - net: fec: refactor PPS channel configuration
+    - net: fec: make PPS channel configurable
+    - drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
+    - drm/xe/migrate: use XE_BO_FLAG_PAGETABLE
+    - drm/amd: Add some missing straps from NBIO 7.11.0
+    - drm/amd: Fix initialization mistake for NBIO 7.11 devices
+    - drm/amdgpu/pm: Don't use OD table on Arcturus
+    - drm/amd/pm: Remove arcturus min power limit
+    - drm/amd/display: update pipe selection policy to check head pipe
+    - drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto
+    - Revert "drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs"
+    - ipv6: avoid possible NULL deref in modify_prefix_route()
+    - net: phy: microchip: Reset LAN88xx PHY to ensure clean link state on
+      LAN7800/7850
+    - ice: fix PHY Clock Recovery availability check
+    - vsock/test: fix failures due to wrong SO_RCVLOWAT parameter
+    - vsock/test: fix parameter types in SO_VM_SOCKETS_* calls
+    - mmc: core Convert UNSTUFF_BITS macro to inline function
+    - mmc: sd: SDUC Support Recognition
+    - mmc: core: Adjust ACMD22 to SDUC
+    - mmc: core: Use GFP_NOIO in ACMD22
+    - f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK}
+    - f2fs: fix to adjust appropriate length for fiemap
+    - f2fs: fix to requery extent which cross boundary of inquiry
+    - drm/amd/display: calculate final viewport before TAP optimization
+    - drm/amd/display: Ignore scalar validation failure if pipe is phantom
+    - pmdomain: core: Add missing put_device()
+    - pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails
+    - pmdomain: core: add dummy release function to genpd device
+    - bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
+    - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
+    - LoongArch: KVM: Protect kvm_check_requests() with SRCU
+    - net :mana :Request a V2 response version for MANA_QUERY_GF_STAT
+    - ALSA: usb-audio: Add extra PID for RME Digiface USB
+    - ALSA: hda/realtek: fix micmute LEDs don't work on HP Laptops
+    - scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers
+    - io_uring/cmd: document some uring_cmd related helpers
+    - io_uring: Change res2 parameter type in io_uring_cmd_done
+    - selftests/damon: add _damon_sysfs.py to TEST_FILES
+    - drm/amd/display: Correct prefetch calculation
+    - drm/amd/amdgpu: allow use kiq to do hdp flush under sriov
+    - drm/amdgpu/hdp6.0: do a posting read when flushing HDP
+    - drm/amdgpu/hdp4.0: do a posting read when flushing HDP
+    - drm/amdgpu/hdp5.0: do a posting read when flushing HDP
+    - x86/cpu/intel: Switch to new Intel CPU model defines
+    - x86/cpu/intel: Drop stray FAM6 check with new Intel CPU model defines
+    - x86/cpu: Add Lunar Lake to list of CPUs with a broken MONITOR implementation
+    - mm/damon: fix order of arguments in damos_before_apply tracepoint
+    - mm: respect mmap hint address when aligning for THP
+    - scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove()
+    - memblock: allow zero threshold in validate_numa_converage()
+    - s390/pci: Sort PCI functions prior to creating virtual busses
+    - s390/pci: Use topology ID for multi-function devices
+    - s390/pci: Ignore RID for isolated VFs
+    - s390/pci: Fix SR-IOV for PFs initially in standby
+    - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
+    - s390/pci: Fix handling of isolated VFs
+    - ext4: partial zero eof block on unaligned inode size extension
+    - crypto: ecdsa - Convert byte arrays with key coordinates to digits
+    - crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes
+    - crypto: ecdsa - Rename keylen to bufsize where necessary
+    - crypto: ecdsa - Use ecc_digits_from_bytes to convert signature
+    - crypto: ecdsa - Avoid signed integer overflow on signature decoding
+    - ACPI: video: force native for Apple MacbookPro11,2 and Air7,2
+    - cleanup: Adjust scoped_guard() macros to avoid potential warning
+    - gpio: free irqs that are still requested when the chip is being removed
+    - media: uvcvideo: Force UVC version to 1.0a for 0408:4035
+    - media: uvcvideo: Force UVC version to 1.0a for 0408:4033
+    - wifi: mac80211: export ieee80211_purge_tx_queue() for drivers
+    - drm/amd/display: skip disable CRTC in seemless bootup case
+    - drm/amd/display: disable SG displays on cyan skillfish
+    - wifi: mac80211: Add non-atomic station iterator
+    - accel/qaic: Add AIC080 support
+    - mptcp: annotate data-races around subflow->fully_established
+    - net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
+    - drm/amd/display: Prune Invalid Modes For HDMI Output
+    - i2c: i801: Add support for Intel Arrow Lake-H
+    - i2c: i801: Add support for Intel Panther Lake
+    - Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
+    - Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925
+    - Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925
+    - Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925
+    - Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925
+    - Bluetooth: btusb: Add 3 HWIDs for MT7925
+    - rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
+    - ring-buffer: Correct stale comments related to non-consuming readers
+    - ring-buffer: Limit time with disabled interrupts in rb_check_pages()
+    - scsi: lpfc: Check SLI_ACTIVE flag in FDMI cmpl before submitting follow up
+      FDMI
+    - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback
+    - clk: qcom: clk-alpha-pll: Add support for zonda ole pll configure
+    - clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574
+    - mailbox: pcc: Check before sending MCTP PCC response ACK
+    - remoteproc: qcom: pas: Add support for SA8775p ADSP, CDSP and GPDSP
+    - remoteproc: qcom: pas: enable SAR2130P audio DSP support
+    - fs/ntfs3: Implement fallocate for compressed files
+    - fs/ntfs3: Fix warning in ni_fiemap
+    - regulator: qcom-rpmh: Update ranges for FTSMPS525
+    - usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag
+    - usb: chipidea: udc: limit usb request length to max 16KB
+    - usb: chipidea: udc: create bounce buffer for problem sglist entries if
+      possible
+    - iio: adc: ad7192: Convert from of specific to fwnode property handling
+    - iio: adc: ad7192: properly check spi_get_device_match_data()
+    - usb: typec: ucsi: add callback for connector status updates
+    - usb: typec: ucsi: glink: move GPIO reading into connector_status callback
+    - usb: typec: ucsi: add update_connector callback
+    - usb: typec: ucsi: glink: set orientation aware if supported
+    - usb: typec: ucsi: glink: be more precise on orientation-aware ports
+    - usb: typec: ucsi: glink: fix off-by-one in connector_status
+    - usb: typec: ucsi: Set orientation as none when connector is unplugged
+    - nvme: use helper nvme_ctrl_state in nvme_keep_alive_finish function
+    - Revert "nvme: make keep-alive synchronous operation"
+    - irqchip/gic-v3-its: Avoid explicit cpumask allocation on stack
+    - irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
+    - [Config] updateconfigs for HISILICON_ERRATUM_162100801
+    - drm/amd/display: Add option to retrieve detile buffer size
+    - btrfs: drop unused parameter options from open_ctree()
+    - btrfs: drop unused parameter data from btrfs_fill_super()
+    - btrfs: fix mount failure due to remount races
+    - net/mlx5: unique names for per device caches
+    - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails
+    - ALSA: hda/realtek: Fix spelling mistake "Firelfy" -> "Firefly"
+    - softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
+    - Upstream stable to v6.6.65, v6.6.66, v6.12.4, v6.12.5
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-41932
+    - sched: fix warning in sched_setaffinity
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57872
+    - scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56588
+    - scsi: hisi_sas: Create all dump files during debugfs initialization
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47794
+    - bpf: Prevent tailcall infinite loop caused by freplace
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56599
+    - wifi: ath10k: avoid NULL pointer error during sdio remove
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56607
+    - wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56608
+    - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56609
+    - wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56782
+    - ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48876
+    - stackdepot: fix stack_depot_save_flags() in NMI context
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56620
+    - scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56621
+    - scsi: ufs: core: Cancel RTC work during ufshcd_remove()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-49569
+    - nvme-rdma: unquiesce admin_q before destroy it
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56632
+    - nvme-tcp: fix the memleak while create new ctrl failed
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56647
+    - net: Fix icmp host relookup triggering ip_rt_bug
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56775
+    - drm/amd/display: Fix handling of plane refcount
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56561
+    - PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56550
+    - s390/stacktrace: Use break instead of return statement
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56771
+    - mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56568
+    - iommu/arm-smmu: Defer probe of clients after smmu device bound
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56772
+    - kunit: string-stream: Fix a UAF bug in kunit_init_suite()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56773
+    - kunit: Fix potential null dereference in kunit_device_driver_test()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56580
+    - media: qcom: camss: fix error path on configuration of power domains
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57850
+    - jffs2: Prevent rtime decompress memory corruption
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56583
+    - sched/deadline: Fix warning in migrate_enable for boosted tasks
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56611
+    - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a
+      MM
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56613
+    - sched/numa: fix memory leak due to the overwritten vma->numab_state
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56584
+    - io_uring/tctx: work around xa_store() allocation error issue
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56781
+    - powerpc/prom_init: Fixup missing powermac #size-cells
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56785
+    - MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56585
+    - LoongArch: Fix sleeping in atomic context for PREEMPT_RT
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-41935
+    - f2fs: fix to shrink read extent node in batches
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-43098
+    - i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to
+      avoid deadlock
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-45828
+    - i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56586
+    - f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56587
+    - leds: class: Protect brightness_show() with led_cdev->led_access mutex
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56786
+    - bpf: put bpf_link's program when link is safe to be deallocated
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47141
+    - pinmux: Use sequential access to access desc->pinmux data
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56589
+    - scsi: hisi_sas: Add cond_resched() for no forced preemption model
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56590
+    - Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56592
+    - bpf: Call free_htab_elem() after htab_unlock_bucket()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56593
+    - wifi: brcmfmac: Fix oops due to NULL pointer dereference in
+      brcmf_sdiod_sglist_rw()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56594
+    - drm/amdgpu: set the right AMDGPU sg segment limitation
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57843
+    - virtio-net: fix overflow inside virtnet_rq_alloc
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56596
+    - jfs: fix array-index-out-of-bounds in jfs_readdir
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56597
+    - jfs: fix shift-out-of-bounds in dbSplit
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47143
+    - dma-debug: fix a possible deadlock on radix_lock
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56601
+    - net: inet: do not leave a dangling sk pointer in inet_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56602
+    - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56603
+    - net: af_can: do not leave a dangling sk pointer in can_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56604
+    - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56605
+    - Bluetooth: L2CAP: do not leave dangling sk pointer on error in
+      l2cap_sock_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56606
+    - af_packet: avoid erroring out after sock_init_data() in packet_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47809
+    - dlm: fix possible lkb_resource null dereference
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48873
+    - wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
+  * Missing support for USB-C Apple Magic Trackpad (LP: #2098063) // Noble
+    update: upstream stable patchset 2025-03-12 (LP: #2102118)
+    - HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56787
+    - soc: imx8m: Probe the SoC driver as platform driver
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56610
+    - kcsan: Turn report_filterlist_lock into a raw_spinlock
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48875
+    - btrfs: don't take dev_replace rwsem on task already holding it
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57849
+    - s390/cpum_sf: Handle CPU hotplug remove during sampling
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57876
+    - drm/dp_mst: Fix resetting msg rx state after topology removal
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56616
+    - drm/dp_mst: Fix MST sideband message body length check
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48881
+    - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56619
+    - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56622
+    - scsi: ufs: core: sysfs: Prevent div by zero
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56623
+    - scsi: qla2xxx: Fix use after free on unload
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57874
+    - arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56625
+    - can: dev: can_set_termination(): allow sleeping GPIOs
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56626
+    - ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56628
+    - LoongArch: Add architecture specific huge_pte_clear()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56629
+    - HID: wacom: fix when get product name maybe null pointer
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56630
+    - ocfs2: free inode when ocfs2_get_init_inode() fails
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56631
+    - scsi: sg: Fix slab-use-after-free read in sg_release()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-50051
+    - spi: mpc52xx: Add cancel_work_sync before module remove
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56633
+    - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56565
+    - f2fs: fix to drop all discards after creating snapshot on lvm device
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56634
+    - gpio: grgpio: Add NULL check in grgpio_probe
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56635
+    - net: avoid potential UAF in default_operstate()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56636
+    - geneve: do not assume mac header is set in geneve_xmit_skb()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56637
+    - netfilter: ipset: Hold module reference while requesting a module
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56638
+    - netfilter: nft_inner: incorrect percpu area handling under softirq
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-52332
+    - igb: Fix potential invalid memory access in igb_init_module()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56640
+    - net/smc: fix LGR and link use-after-free issue
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56641
+    - net/smc: initialize close_work early to avoid warning
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56643
+    - dccp: Fix memory leak in dccp_feat_change_recv
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56644
+    - net/ipv6: release expired exception dst cached in socket
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56645
+    - can: j1939: j1939_session_new(): fix skb reference counting
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56648
+    - net: hsr: avoid potential out-of-bound access in fill_frame_info()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56649
+    - net: enetc: Do not configure preemptible TCs if SIs do not support
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56783
+    - netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56650
+    - netfilter: x_tables: fix LED ID check in led_tg_check()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915)
+    - wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings
+    - ASoC: codecs: rt5640: Always disable IRQs from rt5640_cancel_work()
+    - ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec
+    - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
+    - ASoC: Intel: sst: Support LPE0F28 ACPI HID
+    - wifi: iwlwifi: mvm: Use the sync timepoint API in suspend
+    - mac80211: fix user-power when emulating chanctx
+    - usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver
+    - selftests/watchdog-test: Fix system accidentally reset after watchdog-test
+    - ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
+    - x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
+    - bpf: fix filed access without lock
+    - net: usb: qmi_wwan: add Quectel RG650V
+    - soc: qcom: Add check devm_kasprintf() returned value
+    - firmware: arm_scmi: Reject clear channel request on A2P
+    - regulator: rk808: Add apply_bit for BUCK3 on RK809
+    - platform/x86: dell-smbios-base: Extends support to Alienware products
+    - platform/x86: dell-wmi-base: Handle META key Lock/Unlock events
+    - ASoC: tas2781: Add new driver version for tas2563 & tas2781 qfn chip
+    - tools/lib/thermal: Remove the thermal.h soft link when doing make clean
+    - can: j1939: fix error in J1939 documentation.
+    - platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect
+      fan speed
+    - ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6
+    - ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
+    - ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
+    - drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less
+      strict
+    - proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
+    - ASoC: audio-graph-card2: Purge absent supplies for device tree nodes
+    - LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS
+    - ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
+    - ARM: 9420/1: smp: Fix SMP for xip kernels
+    - ipmr: Fix access to mfc_cache_list without lock held
+    - mptcp: fix possible integer overflow in mptcp_reset_tout_timer
+    - arm64: probes: Disable kprobes/uprobes on MOPS instructions
+    - kselftest/arm64: mte: fix printf type warnings about __u64
+    - kselftest/arm64: mte: fix printf type warnings about longs
+    - s390/cio: Do not unregister the subchannel based on DNV
+    - s390/pageattr: Implement missing kernel_page_present()
+    - ext4: avoid remount errors with 'abort' mount option
+    - mips: asm: fix warning when disabling MIPS_FP_SUPPORT
+    - m68k: mvme147: Fix SCSI controller IRQ numbers
+    - m68k: mvme147: Reinstate early console
+    - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
+    - acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
+    - cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter()
+    - block: fix bio_split_rw_at to take zone_write_granularity into account
+    - s390/syscalls: Avoid creation of arch/arch/ directory
+    - ext4: remove calls to to set/clear the folio error flag
+    - ext4: pipeline buffer reads in mext_page_mkuptodate()
+    - ext4: remove array of buffer_heads from mext_page_mkuptodate()
+    - ext4: fix race in buffer_head read fault injection
+    - nvme-pci: reverse request order in nvme_queue_rqs
+    - virtio_blk: reverse request order in virtio_queue_rqs
+    - crypto: qat - remove check after debugfs_create_dir()
+    - firmware: google: Unregister driver_info on failure
+    - crypto: qat - remove faulty arbiter config reset
+    - thermal: core: Initialize thermal zones before registering them
+    - EDAC/fsl_ddr: Fix bad bit shift operations
+    - EDAC/skx_common: Differentiate memory error sources
+    - EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator
+    - crypto: cavium - Fix the if condition to exit loop after timeout
+    - amd-pstate: Set min_perf to nominal_perf for active mode performance gov
+    - crypto: hisilicon/qm - disable same error report before resetting
+    - crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init()
+    - doc: rcu: update printed dynticks counter bits
+    - hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK
+    - hwmon: (pmbus/core) clear faults after setting smbalert mask
+    - hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
+    - ACPI: CPPC: Fix _CPC register setting issue
+    - crypto: caam - add error check to caam_rsa_set_priv_key_form
+    - crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
+    - rcuscale: Do a proper cleanup if kfree_scale_init() fails
+    - tools/lib/thermal: Make more generic the command encoding function
+    - thermal/lib: Fix memory leak on error in thermal_genl_auto()
+    - x86/unwind/orc: Fix unwind for newly forked tasks
+    - time: Partially revert cleanup on msecs_to_jiffies() documentation
+    - time: Fix references to _msecs_to_jiffies() handling of values
+    - kcsan, seqlock: Support seqcount_latch_t
+    - kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
+    - clocksource/drivers:sp804: Make user selectable
+    - clocksource/drivers/timer-ti-dm: Fix child node refcount handling
+    - spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
+    - microblaze: Export xmb_manager functions
+    - arm64: dts: mt8195: Fix dtbs_check error for mutex node
+    - arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node
+    - soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
+    - arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins
+    - ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode
+    - mmc: mmc_spi: drop buggy snprintf()
+    - openrisc: Implement fixmap to fix earlycon
+    - efi/libstub: fix efi_parse_options() ignoring the default command line
+    - tpm: fix signed/unsigned bug when checking event logs
+    - media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call
+    - arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
+    - arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
+    - arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source
+      trackpad
+    - Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
+    - cgroup/bpf: only cgroup v2 can be attached by bpf programs
+    - regulator: rk808: Restrict DVS GPIOs to the RK808 variant only
+    - arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns
+    - arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns
+    - arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns
+    - arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns
+    - pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
+    - ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
+    - arm64: dts: ti: k3-j7200: use ti,j7200-padconf compatible
+    - arm64: dts: ti: k3-j7200: Fix register map for main domain pmx
+    - arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances
+    - arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances
+    - arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances
+    - um: Unconditionally call unflatten_device_tree()
+    - x86/of: Unconditionally call unflatten_and_copy_device_tree()
+    - of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify
+    - riscv: Fix wrong usage of __pa() on a fixmap address
+    - pmdomain: ti-sci: Add missing of_node_put() for args.np
+    - spi: tegra210-quad: Avoid shift-out-of-bounds
+    - spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time​
+    - regmap: irq: Set lockdep class for hierarchical IRQ domains
+    - arm64: dts: renesas: hihope: Drop #sound-dai-cells
+    - arm64: dts: mediatek: Add ADC node on MT6357, MT6358, MT6359 PMICs
+    - arm64: dts: mediatek: mt6358: fix dtbs_check error
+    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names
+    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed
+      regulators
+    - selftests/resctrl: Split fill_buf to allow tests finer-grained control
+    - selftests/resctrl: Refactor fill_buf functions
+    - selftests/resctrl: Fix memory overflow due to unhandled wraparound
+    - selftests/resctrl: Protect against array overrun during iMC config parsing
+    - arm64: dts: rockchip: correct analog audio name on Indiedroid Nova
+    - platform/x86: panasonic-laptop: Return errno correctly in show callback
+    - drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
+    - drm/vc4: hvs: Don't write gamma luts on 2711
+    - drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer
+    - drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function
+    - drm/vc4: hvs: Correct logic on stopping an HVS channel
+    - drm/omap: Fix possible NULL dereference
+    - drm/omap: Fix locking in omap_gem_new_dmabuf()
+    - wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
+    - wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/v3d: Address race-condition in MMU flush
+    - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
+    - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
+    - dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
+    - ASoC: fsl_micfil: fix regmap_write_bits usage
+    - ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
+    - drm/bridge: anx7625: Drop EDID cache on bridge power off
+    - drm/bridge: it6505: Drop EDID cache on bridge power off
+    - libbpf: Fix expected_attach_type set handling in program load callback
+    - libbpf: Fix output .symtab byte-order during linking
+    - bpf: Fix the xdp_adjust_tail sample prog issue
+    - wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR
+    - ice: consistently use q_idx in ice_vc_cfg_qs_msg()
+    - drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush
+    - libbpf: fix sym_is_subprog() logic for weak global subprogs
+    - ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c
+    - libbpf: never interpret subprogs in .text as entry programs
+    - netdevsim: copy addresses for both in and out paths
+    - drm/bridge: tc358767: Fix link properties discovery
+    - selftests/bpf: Fix msg_verify_data in test_sockmap
+    - selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
+    - drm: fsl-dcu: enable PIXCLK on LS1021A
+    - drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
+    - drm/msm/dpu: drop LM_3 / LM_4 on SDM845
+    - drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
+    - selftests/bpf: fix test_spin_lock_fail.c's global vars usage
+    - drm/panfrost: Remove unused id_mask from struct panfrost_model
+    - bpf, arm64: Remove garbage frame for struct_ops trampoline
+    - drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/msm/gpu: Check the status of registration to PM QoS
+    - drm/etnaviv: Request pages from DMA32 zone on addressing_limited
+    - drm/etnaviv: hold GPU lock across perfmon sampling
+    - wifi: wfx: Fix error handling in wfx_core_init()
+    - drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
+    - bpf, bpftool: Fix incorrect disasm pc
+    - drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
+    - drm: use ATOMIC64_INIT() for atomic64_t
+    - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion
+    - netfilter: nf_tables: must hold rcu read lock while iterating expression
+      type list
+    - netfilter: nf_tables: skip transaction if update object is not implemented
+    - netfilter: nf_tables: must hold rcu read lock while iterating object type
+      list
+    - netlink: typographical error in nlmsg_type constants definition
+    - selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
+    - selftests/bpf: Fix SENDPAGE data logic in test_sockmap
+    - selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
+    - selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
+    - bpf, sockmap: Several fixes to bpf_msg_push_data
+    - bpf, sockmap: Fix sk_msg_reset_curr
+    - sock_diag: add module pointer to "struct sock_diag_handler"
+    - sock_diag: allow concurrent operations
+    - sock_diag: allow concurrent operation in sock_diag_rcv_msg()
+    - net: use unrcu_pointer() helper
+    - selftests: net: really check for bg process completion
+    - drm/amdkfd: Fix wrong usage of INIT_WORK()
+    - bpf: Force uprobe bpf program to always return 0
+    - net: rfkill: gpio: Add check for clk_enable()
+    - netpoll: Use rcu_access_pointer() in netpoll_poll_lock
+    - wireguard: selftests: load nf_conntrack if not present
+    - cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged
+    - clk: mediatek: drop two dead config options
+    - [Config] drop COMMON_CLK_MT8195_AUDSYS and COMMON_CLK_MT8195_MSDC
+    - trace/trace_event_perf: remove duplicate samples on the first tracepoint
+      event
+    - pinctrl: zynqmp: drop excess struct member description
+    - scsi: hisi_sas: Enable all PHYs that are not disabled by user during
+      controller reset
+    - mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
+    - mfd: da9052-spi: Change read-mask to write-mask
+    - cpufreq: loongson2: Unregister platform_driver on failure
+    - powerpc/fadump: Refactor and prepare fadump_cma_init for late init
+    - mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE
+    - mtd: rawnand: atmel: Fix possible memory leak
+    - mtd: rawnand: fix double free in atmel_pmecc_create_user()
+    - mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in
+      RD_ANY_REG_OP
+    - RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci
+    - RDMA/hns: Use dev_* printings in hem code instead of ibdev_*
+    - RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
+    - clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset
+    - clk: renesas: rzg2l: Fix FOUTPOSTDIV clk
+    - RDMA/rxe: Set queue pair cur_qp_state when being queried
+    - RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation
+    - clk: imx: lpcg-scu: SW workaround for errata (e10858)
+    - clk: imx: fracn-gppll: correct PLL initialization flow
+    - clk: imx: fracn-gppll: fix pll power up
+    - clk: imx: clk-scu: fix clk enable state save and restore
+    - clk: imx: imx8-acm: Fix return value check in
+      clk_imx_acm_attach_pm_domains()
+    - iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes()
+    - iommu/vt-d: Fix checks and print in pgtable_walk()
+    - checkpatch: check for missing Fixes tags
+    - checkpatch: always parse orig_commit in fixes tag
+    - mfd: rt5033: Fix missing regmap_del_irq_chip()
+    - fs/proc/kcore.c: fix coccinelle reported ERROR instances
+    - scsi: fusion: Remove unused variable 'rc'
+    - scsi: sg: Enable runtime power management
+    - x86/tdx: Introduce wrappers to read and write TD metadata
+    - x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup()
+    - x86/tdx: Dynamically disable SEPT violations from causing #VEs
+    - RDMA/hns: Fix out-of-order issue of requester when setting FENCE
+    - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()
+    - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()
+    - dax: delete a stale directory pmem
+    - KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests
+    - KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending
+      doorbells
+    - powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
+    - powerpc/kexec: Fix return of uninitialized variable
+    - IB/mlx5: Allocate resources just before first QP/SRQ is created
+    - clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
+    - clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC RT3883
+    - dt-bindings: clock: axi-clkgen: include AXI clk
+    - clk: clk-axi-clkgen: make sure to enable the AXI bus clock
+    - arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw
+    - pinctrl: k210: Undef K210_PC_DEFAULT
+    - smb: cached directories can be more than root file handle
+    - mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()
+    - perf cs-etm: Don't flush when packet_queue fills up
+    - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw
+    - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async
+    - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE
+    - gfs2: Allow immediate GLF_VERIFY_DELETE work
+    - gfs2: Fix unlinked inode cleanup
+    - perf stat: Close cork_fd when create_perf_stat_counter() failed
+    - perf stat: Fix affinity memory leaks on error path
+    - perf trace: Keep exited threads for summary
+    - perf test attr: Add back missing topdown events
+    - f2fs: compress: fix inconsistent update of i_blocks in
+      release_compress_blocks and reserve_compress_blocks
+    - perf probe: Fix libdw memory leak
+    - perf probe: Correct demangled symbols in C++ program
+    - rust: macros: fix documentation of the paste! macro
+    - PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
+    - PCI: cpqphp: Fix PCIBIOS_* return value confusion
+    - perf ftrace latency: Fix unit on histogram first entry when using --use-nsec
+    - f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
+    - f2fs: check curseg->inited before write_sum_page in change_curseg
+    - f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or
+      GC_URGENT_MID
+    - PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup()
+    - PCI: cadence: Set cdns_pcie_host_init() global
+    - PCI: j721e: Add reset GPIO to struct j721e_pcie
+    - PCI: j721e: Use T_PERST_CLK_US macro
+    - PCI: j721e: Add suspend and resume support
+    - PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds
+    - f2fs: fix to avoid forcing direct write to use buffered IO on inline_data
+      inode
+    - perf trace: avoid garbage when not printing a trace event's arguments
+    - m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
+    - m68k: coldfire/device.c: only build FEC when HW macros are defined
+    - perf list: Fix topic and pmu_name argument order
+    - perf trace: Fix tracing itself, creating feedback loops
+    - perf trace: Do not lose last events in a race
+    - perf trace: Avoid garbage when not printing a syscall's arguments
+    - remoteproc: qcom: pas: add minidump_id to SM8350 resources
+    - rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
+    - remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
+    - nfsd: restore callback functionality for NFSv4.0
+    - NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
+    - NFSD: Fix nfsd4_shutdown_copy()
+    - hwmon: (tps23861) Fix reporting of negative temperatures
+    - vdpa/mlx5: Fix suboptimal range on iotlb iteration
+    - selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels
+    - gpio: zevio: Add missed label initialisation
+    - fs_parser: update mount_api doc to match function signature
+    - LoongArch: Fix build failure with GCC 15 (-std=gnu23)
+    - LoongArch: BPF: Sign-extend return values
+    - power: supply: core: Remove might_sleep() from power_supply_put()
+    - power: supply: bq27xxx: Fix registers of bq27426
+    - power: supply: rt9471: Fix wrong WDT function regfield declaration
+    - power: supply: rt9471: Use IC status regfield to report real charger status
+    - net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
+    - tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
+    - net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL
+      configuration
+    - net: microchip: vcap: Add typegroup table terminators in kunit tests
+    - net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged
+    - net: mdio-ipq4019: add missing error check
+    - marvell: pxa168_eth: fix call balance of pep->clk handling routines
+    - net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
+    - octeontx2-af: RPM: Fix mismatch in lmac type
+    - octeontx2-af: RPM: Fix low network performance
+    - octeontx2-pf: Reset MAC stats during probe
+    - octeontx2-af: RPM: fix stale RSFEC counters
+    - octeontx2-af: RPM: fix stale FCFEC counters
+    - octeontx2-af: Quiesce traffic before NIX block reset
+    - spi: atmel-quadspi: Fix register name in verbose logging function
+    - net: hsr: fix hsr_init_sk() vs network/transport headers.
+    - bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
+    - bnxt_en: Refactor bnxt_ptp_init()
+    - bnxt_en: Unregister PTP during PCI shutdown and suspend
+    - llc: Improve setsockopt() handling of malformed user input
+    - rxrpc: Improve setsockopt() handling of malformed user input
+    - tcp: Fix use-after-free of nreq in reqsk_timer_handler().
+    - ip6mr: fix tables suspicious RCU usage
+    - ipmr: fix tables suspicious RCU usage
+    - iio: light: al3010: Fix an error handling path in al3010_probe()
+    - usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
+    - usb: yurex: make waiting on yurex_write interruptible
+    - USB: chaoskey: fail open after removal
+    - USB: chaoskey: Fix possible deadlock chaoskey_list_lock
+    - misc: apds990x: Fix missing pm_runtime_disable()
+    - counter: stm32-timer-cnt: Add check for clk_enable()
+    - counter: ti-ecap-capture: Add check for clk_enable()
+    - ALSA: hda/realtek: Update ALC256 depop procedure
+    - drm/radeon: add helper rdev_to_drm(rdev)
+    - drm/radeon: change rdev->ddev to rdev_to_drm(rdev)
+    - drm/radeon: Fix spurious unplug event on radeon HDMI
+    - apparmor: fix 'Do simple duplicate message elimination'
+    - ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry
+    - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru
+    - gfs2: Remove and replace gfs2_glock_queue_work
+    - f2fs: fix fiemap failure issue when page size is 16KB
+    - usb: ehci-spear: fix call balance of sehci clk handling routines
+    - ALSA: usb-audio: Fix a DMA to stack memory bug
+    - ASoC: Intel: sst: Fix used of uninitialized ctx to log an error
+    - soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
+    - ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
+    - ext4: fix FS_IOC_GETFSMAP handling
+    - jfs: xattr: check invalid xattr size more strictly
+    - ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5
+      21MES00B00
+    - ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
+    - perf/x86/intel/pt: Fix buffer full but size is 0 case
+    - crypto: x86/aegis128 - access 32-bit arguments as 32-bit
+    - KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE
+    - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector
+    - KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR
+    - KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
+    - KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
+    - KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
+    - KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
+    - fsnotify: fix sending inotify event with unexpected filename
+    - tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
+    - locking/lockdep: Avoid creating new name string literals in
+      lockdep_set_subclass()
+    - tools/nolibc: s390: include std.h
+    - pinctrl: qcom: spmi: fix debugfs drive strength
+    - dt-bindings: iio: dac: ad3552r: fix maximum spi speed
+    - exfat: fix uninit-value in __exfat_get_dentry_set
+    - Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
+    - Compiler Attributes: disable __counted_by for clang < 19.1.3
+    - usb: xhci: Fix TD invalidation under pending Set TR Dequeue
+    - ARM: dts: omap36xx: declare 1GHz OPP as turbo again
+    - wifi: brcmfmac: release 'root' node in all execution paths
+    - Revert "usb: gadget: composite: fix OS descriptors w_value logic"
+    - gpio: exar: set value when external pull-up or pull-down is present
+    - spi: Fix acpi deferred irq probe
+    - cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power()
+    - cifs: support mounting with alternate password to allow password rotation
+    - parisc/ftrace: Fix function graph tracing disablement
+    - platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
+    - ubi: wl: Put source PEB into correct list if trying locking LEB failed
+    - dt-bindings: serial: rs485: Fix rs485-rts-delay property
+    - serial: 8250_fintek: Add support for F81216E
+    - serial: 8250: omap: Move pm_runtime_get_sync
+    - iio: gts: Fix uninitialized symbol 'ret'
+    - ublk: fix ublk_ch_mmap() for 64K page size
+    - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
+    - block: fix missing dispatching request when queue is started or unquiesced
+    - block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding
+    - block: fix ordering between checking BLK_MQ_S_STOPPED request adding
+    - blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long
+    - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
+    - soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting()
+    - media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
+    - ALSA: ump: Fix evaluation of MIDI 1.0 FB info
+    - ALSA: hda/realtek: Update ALC225 depop procedure
+    - ALSA: hda/realtek: Fixup ALC225 depop procedure
+    - ALSA: hda/realtek: Set PCBeep to default value for ALC274
+    - ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
+    - ALSA: hda/realtek: Apply quirk for Medion E15433
+    - smb3: request handle caching when caching directories
+    - smb: client: handle max length for SMB symlinks
+    - cifs: Add tracing for the cifs_tcon struct refcounting
+    - usb: dwc3: gadget: Fix checking for number of TRBs left
+    - ublk: fix error code for unsupported command
+    - lib: string_helpers: silence snprintf() output truncation warning
+    - um: Fix the return value of elf_core_copy_task_fpregs
+    - um: Always dump trace for specified task in show_stack
+    - rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
+    - rtc: abx80x: Fix WDT bit position of the status register
+    - ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
+    - ubifs: Correct the total block count by deducting journal reservation
+    - jffs2: fix use of uninitialized variable
+    - rtc: rzn1: fix BCD to rtc_time conversion errors
+    - nvme-multipath: prepare for "queue-depth" iopolicy
+    - nvme-multipath: implement "queue-depth" iopolicy
+    - nvme-multipath: avoid hang on inaccessible namespaces
+    - nvme/multipath: Fix RCU list traversal to use SRCU primitive
+    - block: return unsigned int from bdev_io_min
+    - 9p/xen: fix init sequence
+    - perf/arm-smmuv3: Fix lockdep assert in ->event_init()
+    - perf/arm-cmn: Ensure port and device id bits are set properly
+    - smb: client: disable directory caching when dir_cache_timeout is zero
+    - cifs: Fix parsing native symlinks relative to the export
+    - cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE
+      session
+    - rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
+    - init/modpost: conditionally check section mismatch to __meminit*
+    - Rename .data.unlikely to .data..unlikely
+    - Rename .data.once to .data..once to fix resetting WARN*_ONCE
+    - modpost: remove incorrect code in do_eisa_entry()
+    - cifs: during remount, make sure passwords are in sync
+    - cifs: unlock on error in smb3_reconfigure()
+    - nfs: ignore SB_RDONLY when mounting nfs
+    - SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT
+    - xfs: remove unknown compat feature check in superblock write validation
+    - btrfs: don't loop for nowait writes when checking for cross references
+    - md/md-bitmap: Add missing destroy_work_on_stack()
+    - arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
+    - arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
+    - arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
+    - media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
+    - media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
+    - media: verisilicon: av1: Fix reference video buffer pointer assignment
+    - media: platform: exynos4-is: Fix an OF node reference leak in
+      fimc_md_is_isp_available
+    - media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
+    - media: uvcvideo: Stop stream during unregister
+    - maple_tree: refine mas_store_root() on storing NULL
+    - vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
+    - zram: clear IDLE flag after recompression
+    - iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
+    - leds: lp55xx: Remove redundant test for invalid channel number
+    - clk: qcom: gcc-qcs404: fix initial rate of GPLL3
+    - ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow
+    - ARM: 9430/1: entry: Do a dummy read from VMAP shadow
+    - ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()
+    - ceph: extract entity name from device id
+    - util_macros.h: fix/rework find_closest() macros
+    - scsi: ufs: exynos: Fix hibern8 notify callbacks
+    - i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible
+    - PCI: keystone: Add link up check to ks_pcie_other_map_bus()
+    - PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf()
+    - fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful
+      iov_iter_zero
+    - thermal: int3400: Fix reading of current_uuid for active policy
+    - leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error
+      paths
+    - ovl: properly handle large files in ovl_security_fileattr
+    - dm: Fix typo in error message
+    - dm thin: Add missing destroy_work_on_stack()
+    - PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes
+    - PCI: rockchip-ep: Fix address translation unit programming
+    - iio: accel: kx022a: Fix raw read format
+    - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
+    - iio: gts: fix infinite loop for gain_to_scaletables()
+    - powerpc: Fix stack protector Kconfig test for clang
+    - powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang
+    - udmabuf: use vmf_insert_pfn and VM_PFNMAP for handling mmap
+    - drm/mediatek: Fix child node refcount handling in early exit
+    - drm/etnaviv: flush shader L1 cache after user commandstream
+    - drm: xlnx: zynqmp_dpsub: fix hotplug detection
+    - drm/amdkfd: Use the correct wptr size
+    - drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu
+      v13.0.7
+    - posix-timers: Target group sigqueue to current task only if not exiting
+    - wifi: cfg80211: Add wiphy_delayed_work_pending()
+    - wifi: mac80211: Convert color collision detection to wiphy work
+    - spi: stm32: fix missing device mode capability in stm32mp25
+    - usb: typec: use cleanup facility for 'altmodes_node'
+    - platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys
+    - integrity: Avoid -Wflex-array-member-not-at-end warnings
+    - integrity: Use static_assert() to check struct sizes
+    - ASoC: max9768: Fix event generation for playback mute
+    - ARM: 9434/1: cfi: Fix compilation corner case
+    - drm/amd/display: Skip Invalid Streams from DSC Policy
+    - drm/amd/display: Fix DSC-re-computing
+    - drm/amd/display: Fix incorrect DSC recompute trigger
+    - s390/facilities: Fix warning about shadow of global variable
+    - cachefiles: Fix incorrect length return value in
+      cachefiles_ondemand_fd_write_iter()
+    - thermal: core: Drop thermal_zone_device_is_enabled()
+    - thermal: core: Synchronize suspend-prepare and post-suspend actions
+    - thermal: core: Rearrange PM notification code
+    - thermal: core: Represent suspend-related thermal zone flags as bits
+    - thermal: core: Mark thermal zones as initializing to start with
+    - thermal: core: Fix race between zone registration and system suspend
+    - crypto: qat - Fix missing destroy_workqueue in adf_init_aer()
+    - sched/cpufreq: Ensure sd is rebuilt for EAS check
+    - cleanup: Remove address space of returned pointer
+    - ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash
+    - arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy
+    - scripts/kernel-doc: Do not track section counter across processed files
+    - arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region
+    - scripts/kernel-doc: add modeline for vim users
+    - scripts/kernel-doc: simplify function printing
+    - scripts/kernel-doc: separate out function signature
+    - scripts/kernel-doc: simplify signature printing
+    - doc: kerneldoc.py: fix indentation
+    - kernel-doc: allow object-like macros in ReST output
+    - arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status
+    - arm64: dts: rockchip: Remove 'enable-active-low' from two boards
+    - arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers
+    - dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries
+    - pwm: Assume a disabled PWM to emit a constant inactive output
+    - drm/imagination: Convert to use time_before macro
+    - drm/imagination: Use pvr_vm_context_get()
+    - drm/v3d: Flush the MMU before we supply more memory to the binner
+    - drm/amdgpu: Fix JPEG v4.0.3 register write
+    - ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios
+    - wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled
+    - selftests/bpf: netns_new() and netns_free() helpers.
+    - selftests/bpf: Fix backtrace printing for selftests crashes
+    - selftests/bpf: add missing header include for htons
+    - drm/vc4: hdmi: Increase audio MAI fifo dreq threshold
+    - drm/vc4: Introduce generation number enum
+    - drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load
+    - drm/vc4: Correct generation check in vc4_hvs_lut_load
+    - bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable
+    - drm/panfrost: Add missing OPP table refcnt decremental
+    - selftests: netfilter: Fix missing return values in conntrack_dump_flush
+    - Bluetooth: btintel: Do no pass vendor events to stack
+    - Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name()
+    - Bluetooth: ISO: Use kref to track lifetime of iso_conn
+    - Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending
+    - Bluetooth: hci_conn: Use __counted_by() to avoid -Wfamnae warning
+    - Bluetooth: hci_conn: Use struct_size() in hci_le_big_create_sync()
+    - Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending
+    - Bluetooth: ISO: Send BIG Create Sync via hci_sync
+    - Bluetooth: iso: Fix circular lock in iso_conn_big_sync
+    - net: txgbe: remove GPIO interrupt controller
+    - net: txgbe: fix null pointer to pcs
+    - RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages
+    - RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset
+    - iommu/amd: Remove amd_iommu_domain_update() from page table freeing
+    - iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB
+    - RDMA/hns: Fix flush cqe error when racing with destroy qp
+    - RDMA/hns: Modify debugfs name
+    - leds: max5970: Fix unreleased fwnode_handle in probe function
+    - kasan: move checks to do_strncpy_from_user
+    - kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL
+    - RDMA/hns: Fix different dgids mapping to the same dip_idx
+    - RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
+    - rust: kernel: add srctree-relative doclinks
+    - rust: kernel: fix THIS_MODULE header path in ThisModule doc comment
+    - i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin
+    - remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe()
+    - remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe()
+    - nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
+    - f2fs: clean up val{>>,<<}F2FS_BLKSIZE_BITS
+    - f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow
+    - vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data()
+    - exfat: fix file being changed by unaligned direct write
+    - bnxt_en: Set backplane link modes correctly for ethtool
+    - devres: Fix page faults when tracing devres from unloaded modules
+    - usb: gadget: uvc: wake pump everytime we update the free list
+    - drm/xe/ufence: Wake up waiters after setting ufence->signalled
+    - net_sched: sch_fq: don't follow the fast path if Tx is behind now
+    - ASoC: da7213: Populate max_register to regmap_config
+    - KVM: x86: switch hugepage recovery thread to vhost_task
+    - kvm: defer huge page recovery vhost task to later
+    - KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking
+    - KVM: arm64: Change kvm_handle_mmio_return() return polarity
+    - dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with
+      fallbacks
+    - xhci: Fix control transfer error on Etron xHCI host
+    - xhci: Combine two if statements for Etron xHCI host
+    - xhci: Don't perform Soft Retry for Etron xHCI host
+    - xhci: Don't issue Reset Device command to Etron xHCI host
+    - mtd: spi-nor: core: replace dummy buswidth from addr to data
+    - Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
+    - RISC-V: Scalar unaligned access emulated on hotplug CPUs
+    - serial: amba-pl011: Fix RX stall when DMA is used
+    - serial: amba-pl011: fix build regression
+    - i40e: Fix handling changed priv flags
+    - netdev-genl: Hold rcu_read_lock in napi_get
+    - usb: misc: ljca: set small runtime autosuspend delay
+    - usb: misc: ljca: move usb_autopm_put_interface() after wait for response
+    - blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs
+    - block: model freeze & enter queue as lock for supporting lockdep
+    - block: always verify unfreeze lock on the owner task
+    - x86/Documentation: Update algo in init_size description of boot protocol
+    - kbuild: deb-pkg: Don't fail if modules.order is missing
+    - tools/power turbostat: Fix trailing '\n' parsing
+    - block: don't verify IO lock for freeze/unfreeze in elevator_init_mq()
+    - zram: permit only one post-processing operation at a time
+    - perf jevents: Don't stop at the first matched pmu when searching a events
+      table
+    - docs: media: update location of the media patches
+    - Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of
+      setup_vmcs_config()"
+    - soc: fsl: cpm1: qmc: Fix blank line and spaces
+    - soc: fsl: cpm1: qmc: Re-order probe() operations
+    - soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version
+    - soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version
+    - soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure
+    - x86/mm: Carve out INVLPG inline asm for use by others
+    - ALSA: hda/realtek: Enable mic on Vaio VJFH52
+    - ALSA: hda/realtek: Enable speaker pins for Medion E15443 platform
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i
+    - usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing
+      logic
+    - sched: Initialize idle tasks only once
+    - Upstream stable to v6.6.64, v6.11.11, v6.12.1, v6.12.2, v6.12.3
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53222
+    - zram: fix NULL pointer in comp_algorithm_show()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53169
+    - nvme-fabrics: fix kernel crash while shutting down controller
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56721
+    - x86/CPU/AMD: Terminate the erratum_1386_microcode array
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53187
+    - io_uring: check for overflows in io_pin_pages
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53147
+    - exfat: fix out-of-bounds access of directory entries
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53196
+    - KVM: arm64: Don't retire aborted MMIO instruction
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56685
+    - ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53201
+    - drm/amd/display: Fix null check for pipe_ctx->plane_state in
+      dcn20_program_pipe
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53203
+    - usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53209
+    - bnxt_en: Fix receive ring space parameters when XDP is active
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56742
+    - vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53216
+    - nfsd: release svc_expkey/svc_export with rcu_work
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53219
+    - virtiofs: use pages instead of pointer for kernel direct IO
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53221
+    - f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53228
+    - riscv: kvm: Fix out-of-bounds array access
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53232
+    - iommu/s390: Implement blocking domain
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53236
+    - xsk: Free skb when TX metadata options are invalid
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56703
+    - ipv6: Fix soft lockups in fib6_select_path under high next hop churn
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56540
+    - accel/ivpu: Prevent recovery invocation during probe and resume
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53163
+    - crypto: qat/qat_420xx - fix off by one in uof_get_name()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56755
+    - netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56549
+    - cachefiles: Fix NULL pointer dereference in object->file
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56551
+    - drm/amdgpu: fix usage slab after free
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56776
+    - drm/sti: avoid potential dereference of error pointers
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56777
+    - drm/sti: avoid potential dereference of error pointers in
+      sti_gdp_atomic_check
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56778
+    - drm/sti: avoid potential dereference of error pointers in
+      sti_hqvdp_atomic_check
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56557
+    - iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56779
+    - nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56558
+    - nfsd: make sure exp active before svc_export_show
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56562
+    - i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56566
+    - mm/slub: Avoid list corruption when removing a slab from the full list
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-57838
+    - s390/entry: Mark IRQ entries to fix stack depot warnings
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56567
+    - ad7780: fix division by zero in ad7780_write_raw()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56569
+    - ftrace: Fix regression with module command in stack_trace_filter
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56570
+    - ovl: Filter invalid inodes with missing lookup function
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56572
+    - media: platform: allegro-dvt: Fix possible memory leak in
+      allocate_buffers_internal()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56573
+    - efi/libstub: Free correct pointer on failure
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56574
+    - media: ts2020: fix null-ptr-deref in ts2020_probe()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56575
+    - media: imx-jpeg: Ensure power suppliers be suspended before detach them
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56576
+    - media: i2c: tc358743: Fix crash in the probe error path when using polling
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56577
+    - media: mtk-jpeg: Fix null-ptr-deref during unload module
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56578
+    - media: imx-jpeg: Set video drvdata before register video device
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56579
+    - media: amphion: Set video drvdata before register video device
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56581
+    - btrfs: ref-verify: fix use-after-free after invalid ref action
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56774
+    - btrfs: add a sanity check for btrfs root in btrfs_search_slot()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56780
+    - quota: flush quota_release_work upon quota writeback
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53168
+    - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56688
+    - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56729
+    - smb: Initialize cfid->tcon before performing network ops
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56704
+    - 9p/xen: fix release of IRQ
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53171
+    - ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53172
+    - ubi: fastmap: Fix duplicate slab cache names while attaching
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56739
+    - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53173
+    - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53145
+    - um: Fix potential integer overflow during physmem setup
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53174
+    - SUNRPC: make sure cache entry active before cache_show
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53146
+    - NFSD: Prevent a potential integer overflow
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53175
+    - ipc: fix memleak if msg_init_ns failed in create_ipc_ns
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56692
+    - f2fs: fix to do sanity check on node blkaddr in truncate_node()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56698
+    - usb: dwc3: gadget: Fix looping of queued SG entries
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56687
+    - usb: musb: Fix hardware lockup on first Rx endpoint request
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53176
+    - smb: During unmount, ensure all cached dir instances drop their dentry
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53177
+    - smb: prevent use-after-free due to open_cached_dir error paths
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53178
+    - smb: Don't leak cfid when reconnect races with open_cached_dir
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53180
+    - ALSA: pcm: Add sanity NULL check for the default mmap fault handler
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56700
+    - media: wl128x: Fix atomicity violation in fmc_send_cmd()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2022-49034
+    - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53181
+    - um: vector: Do not use drvdata in release
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53183
+    - um: net: Do not use drvdata in release
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53184
+    - um: ubd: Do not use drvdata in release
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53185
+    - smb: client: fix NULL ptr deref in crypto_aead_setkey()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53188
+    - wifi: ath12k: fix crash when unbinding
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53190
+    - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of
+      failures
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53191
+    - wifi: ath12k: fix warning when unbinding
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56741
+    - apparmor: test: Fix memory leak for aa_unpack_strdup()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53148
+    - comedi: Flush partial mappings in error case
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53194
+    - PCI: Fix use-after-free of slot->bus on hot remove
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53195
+    - KVM: arm64: Get rid of userspace_irqchip_in_use
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53197
+    - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox
+      devices
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-42122
+    - drm/amd/display: Add NULL pointer check for kzalloc
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-49906
+    - drm/amd/display: Check null pointer before try to access it
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53150
+    - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53198
+    - xen: Fix the issue of resource not being properly released in
+      xenbus_dev_probe()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-41014
+    - xfs: add bounds checking to xlog_recover_process_data
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53200
+    - drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53202
+    - firmware_loader: Fix possible resource leak in fw_log_firmware_info()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53208
+    - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53210
+    - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53213
+    - net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53214
+    - vfio/pci: Properly hide first-in-list PCIe extended capability
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53215
+    - svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53217
+    - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56689
+    - PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio'
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53151
+    - svcrdma: Address an integer overflow
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53218
+    - f2fs: fix race in concurrent f2fs_stop_gc_thread
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56744
+    - f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53220
+    - f2fs: fix to account dirty data in __get_secs_required()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56745
+    - PCI: Fix reset_method_store() memory leak
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53223
+    - clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53154
+    - clk: clk-apple-nco: Add NULL check in applnco_probe
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53224
+    - RDMA/mlx5: Move events notifier registration to be after device registration
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56746
+    - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53155
+    - ocfs2: fix uninitialized value in ocfs2_file_read_iter()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53226
+    - RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56747
+    - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56748
+    - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53229
+    - RDMA/rxe: Fix the qp flush warnings in req
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56722
+    - RDMA/hns: Fix cpu stuck caused by printings during reset
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53230
+    - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53231
+    - cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56701
+    - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56678
+    - powerpc/mm/fault: Fix kfence page fault reporting
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56677
+    - powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56723
+    - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56724
+    - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56691
+    - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53233
+    - unicode: Fix utf8_load() error path
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56694
+    - bpf: fix recursive lock when verdict program return SK_PASS
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53234
+    - erofs: handle NONHEAD !delta[1] lclusters gracefully
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53239
+    - ALSA: 6fire: Release resources at card release
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56531
+    - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56532
+    - ALSA: us122l: Use snd_card_free_when_closed() at disconnection
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56533
+    - ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56751
+    - ipv6: release nexthop on device removal
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56720
+    - bpf, sockmap: Several fixes to bpf_msg_pop_data
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56538
+    - drm: zynqmp_kms: Unplug DRM device before removal
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56752
+    - drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56725
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56707
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56726
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56727
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56728
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56679
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56539
+    - wifi: mwifiex: Fix memcpy() field-spanning write warning in
+      mwifiex_config_scan()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56543
+    - wifi: ath12k: Skip Rx TID cleanup for self peer
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56683
+    - drm/vc4: hdmi: Avoid hang with debug registers when suspended
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56545
+    - HID: hyperv: streamline driver probe to avoid devres issues
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56705
+    - media: atomisp: Add check for rgby_data memory allocation failure
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53157
+    - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53158
+    - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56546
+    - drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56681
+    - crypto: bcm - add error check in the ahash_hmac_init function
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53160
+    - rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56708
+    - EDAC/igen6: Avoid segmentation fault on module unload
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56690
+    - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return
+      -EBUSY
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53161
+    - EDAC/bluefield: Fix potential integer overflow
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53162
+    - crypto: qat/qat_4xxx - fix off by one in uof_get_name()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56754
+    - crypto: caam - Fix the pointer passed to caam_qi_shutdown()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56548
+    - hfsplus: don't query the device logical block size multiple times
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56756
+    - nvme-pci: fix freeing of the HMB descriptor table
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53142
+    - initramfs: avoid filename buffer overrun
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56693
+    - brd: defer automatic disk creation until module initialization succeeds
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-44955
+    - drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-49899
+    - drm/amd/display: Initialize denominators' default to 1
+  * Noble update: upstream stable patchset 2025-03-06 (LP: #2101042)
+    - sctp: fix possible UAF in sctp_v6_available()
+    - net: vertexcom: mse102x: Fix tx_bytes calculation
+    - drm/rockchip: vop: Fix a dereferenced before check warning
+    - mptcp: error out earlier on disconnect
+    - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
+    - net/mlx5: fs, lock FTE when checking if active
+    - net/mlx5e: kTLS, Fix incorrect page refcounting
+    - net/mlx5e: clear xdp features on non-uplink representors
+    - net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
+    - virtio/vsock: Fix accept_queue memory leak
+    - Bluetooth: btintel: Direct exception event to bluetooth stack
+    - net: sched: cls_u32: Fix u32's systematic failure to free IDR entries for
+      hnodes.
+    - samples: pktgen: correct dev to DEV
+    - net: stmmac: dwmac-mediatek: Fix inverted handling of mediatek,mac-wol
+    - net: Make copy_safe_from_sockptr() match documentation
+    - stmmac: dwmac-intel-plat: fix call balance of tx_clk handling routines
+    - net: ti: icssg-prueth: Fix 1 PPS sync
+    - bonding: add ns target multicast address to slave device
+    - ARM: 9419/1: mm: Fix kernel memory mapping for xip kernels
+    - x86/mm: Fix a kdump kernel failure on SME system when CONFIG_IMA_KEXEC=y
+    - mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
+    - ocfs2: uncache inode which has failed entering the group
+    - vdpa: solidrun: Fix UB bug with devres
+    - vdpa/mlx5: Fix PA offset with unaligned starting iotlb map
+    - vp_vdpa: fix id_table array not null terminated error
+    - ima: fix buffer overrun in ima_eventdigest_init_common
+    - KVM: nVMX: Treat vpid01 as current if L2 is active, but with VPID disabled
+    - KVM: x86: Unconditionally set irr_pending when updating APICv state
+    - KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind
+      CONFIG_BROKEN
+    - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
+    - nommu: pass NULL argument to vma_iter_prealloc()
+    - ALSA: hda/realtek - Fixed Clevo platform headset Mic issue
+    - ocfs2: fix UBSAN warning in ocfs2_verify_volume()
+    - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
+    - LoongArch: Fix early_numa_add_cpu() usage for FDT systems
+    - LoongArch: Disable KASAN if PGDIR_SIZE is too large for cpu_vabits
+    - LoongArch: Make KASAN work with 5-level page-tables
+    - Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
+    - mmc: sunxi-mmc: Fix A100 compatible description
+    - drm/bridge: tc358768: Fix DSI command tx
+    - pmdomain: imx93-blk-ctrl: correct remove path
+    - nouveau: fw: sync dma after setup is called.
+    - drm/amd: Fix initialization mistake for NBIO 7.7.0
+    - drm/amd/display: Adjust VSDB parser for replay feature
+    - lib/buildid: Fix build ID parsing logic
+    - media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
+    - mptcp: add userspace_pm_lookup_addr_by_id helper
+    - mptcp: update local address flags when setting it
+    - mptcp: hold pm lock when deleting entry
+    - mptcp: drop lookup_by_id in lookup_addr
+    - mptcp: pm: use _rcu variant under rcu_read_lock
+    - mm: avoid unsafe VMA hook invocation when error arises on mmap hook
+    - mm: unconditionally close VMAs on error
+    - mm: refactor map_deny_write_exec()
+    - mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling
+    - mm: resolve faulty mmap_region() error path behaviour
+    - net/mlx5: Fix msix vectors to respect platform limit
+    - vsock: Fix sk_error_queue memory leak
+    - virtio/vsock: Improve MSG_ZEROCOPY error handling
+    - net: phylink: ensure PHY momentary link-fails are handled
+    - drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle
+    - ARM: fix cacheflush with PAN
+    - drm/amd/display: Run idle optimizations at end of vblank handler
+    - drm/amd/display: Change some variable name of psr
+    - x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
+    - x86/stackprotector: Work around strict Clang TLS symbol requirements
+    - sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
+    - fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args()
+    - mm/mremap: fix address wraparound in move_page_tables()
+    - KVM: selftests: Disable strict aliasing
+    - mm: page_alloc: move mlocked flag clearance into free_pages_prepare()
+    - LoongArch: Add WriteCombine shadow mapping in KASAN
+    - drm/xe: handle flat ccs during hibernation on igpu
+    - pmdomain: arm: Use FLAG_DEV_NAME_FW to ensure unique names
+    - pmdomain: core: Add GENPD_FLAG_DEV_NAME_FW flag
+    - nouveau: handle EBUSY and EAGAIN for GSP aux errors.
+    - nouveau/dp: handle retries for AUX CH transfers with GSP.
+    - drm/amdgpu: fix check in gmc_v9_0_get_vm_pte()
+    - drm/amdgpu: Fix video caps for H264 and HEVC encode maximum size
+    - drm/amd/pm: print pp_dpm_mclk in ascending order on SMU v14.0.0
+    - drm/amd/display: Handle dml allocation failure to avoid crash
+    - drm/amd/display: Fix failure to read vram info due to static BP_RESULT
+    - drm/xe: Restore system memory GGTT mappings
+    - drm/xe: improve hibernation on igpu
+    - net: sched: u32: Add test case for systematic hnode IDR leaks
+    - Upstream stable to v6.6.63, v6.11.10
+  * Noble update: upstream stable patchset 2025-03-04 (LP: #2100894)
+    - 9p: v9fs_fid_find: also lookup by inode if not found dentry
+    - 9p: Avoid creating multiple slab caches with the same name
+    - selftests/bpf: Verify that sync_linked_regs preserves subreg_def
+    - irqchip/ocelot: Fix trigger register address
+    - nvme: tcp: avoid race between queue_lock lock and destroy
+    - block: Fix elevator_get_default() checking for NULL q->tag_set
+    - HID: multitouch: Add support for B2402FVA track point
+    - HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
+    - iommu/arm-smmu: Clarify MMU-500 CPRE workaround
+    - nvme: disable CC.CRIME (NVME_CC_CRIME)
+    - bpf: use kvzmalloc to allocate BPF verifier environment
+    - crypto: api - Fix liveliness check in crypto_alg_tested
+    - crypto: marvell/cesa - Disable hash algorithms
+    - sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
+    - drm/vmwgfx: Limit display layout ioctl array size to
+      VMWGFX_NUM_DISPLAY_UNITS
+    - RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES
+    - nvme-multipath: defer partition scanning
+    - drm/amdkfd: Accounting pdd vram_usage for svm
+    - powerpc/powernv: Free name on error in opal_event_init()
+    - net: phy: mdio-bcm-unimac: Add BCM6846 support
+    - nvme-loop: flush off pending I/O while shutting down loop controller
+    - smb: client: Fix use-after-free of network namespace.
+    - nvme/host: Fix RCU list traversal to use SRCU primitive
+    - vDPA/ifcvf: Fix pci_read_config_byte() return code handling
+    - bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx
+    - bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6
+    - ASoC: amd: yc: Add quirk for ASUS Vivobook S15 M3502RA
+    - ASoC: amd: yc: Fix non-functional mic on ASUS E1404FA
+    - fs: Fix uninitialized value issue in from_kuid and from_kgid
+    - HID: multitouch: Add quirk for Logitech Bolt receiver w/ Casa touchpad
+    - HID: lenovo: Add support for Thinkpad X1 Tablet Gen 3 keyboard
+    - RISCV: KVM: use raw_spinlock for critical section in imsic
+    - ASoC: rt722-sdca: increase clk_stop_timeout to fix clock stop issue
+    - LoongArch: Use "Exception return address" to comment ERA
+    - ASoC: fsl_micfil: Add sample rate constraint
+    - net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
+    - bpf: Check validity of link->type in bpf_link_show_fdinfo()
+    - mm: support order-1 folios in the page cache
+    - mm: always initialise folio->_deferred_list
+    - mm: refactor folio_undo_large_rmappable()
+    - mm/thp: fix deferred split unqueue naming and locking
+    - 9p: fix slab cache name creation for real
+    - nvmet-passthru: clear EUID/NGUID/UUID while using loop target
+    - pinctrl: intel: platform: Add Panther Lake to the list of supported
+    - s390/ap: Fix CCA crypto card behavior within protected execution environment
+    - selftests/bpf: Assert link info uprobe_multi count & path_size if unset
+    - ALSA: hda/tas2781: Add new quirk for Lenovo, ASUS, Dell projects
+    - drm/xe/query: Increase timestamp width
+    - nvme: make keep-alive synchronous operation
+    - samples/landlock: Fix port parsing in sandboxer
+    - ASoC: Intel: avs: Update stream status in a separate thread
+    - ASoC: codecs: Fix error handling in aw_dev_get_dsp_status function
+    - netfs: Downgrade i_rwsem for a buffered write
+    - afs: Fix lock recursion
+    - HID: i2c-hid: Delayed i2c resume wakeup for 0x0d42 Goodix touchpad
+    - LoongArch: KVM: Mark hrtimer to expire in hard interrupt context
+    - drm/xe: Don't restart parallel queues multiple times on GT reset
+    - Upstream stable to v6.6.62, v6.11.9
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292)
+    - arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610
+    - arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-
+      excavator
+    - arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
+    - arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node
+    - arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes
+    - arm64: dts: rockchip: fix i2c2 pinctrl-names property on anbernic-rg353p/v
+    - arm64: dts: rockchip: Fix bluetooth properties on rk3566 box demo
+    - arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
+    - arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus
+    - arm64: dts: rockchip: Remove undocumented supports-emmc property
+    - arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
+    - arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc
+    - arm64: dts: rockchip: remove num-slots property from rk3328-nanopi-r2s-plus
+    - arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs
+    - arm64: dts: imx8mp: correct sdhc ipg clk
+    - arm64: dts: rockchip: remove orphaned pinctrl-names from pinephone pro
+    - ARM: dts: rockchip: fix rk3036 acodec node
+    - ARM: dts: rockchip: drop grf reference from rk3036 hdmi
+    - ARM: dts: rockchip: Fix the spi controller on rk3036
+    - ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
+    - arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes
+    - sunrpc: handle -ENOTCONN in xs_tcp_setup_socket()
+    - NFSv3: only use NFS timeout for MOUNT when protocols are compatible
+    - nfs: avoid i_lock contention in nfs_clear_invalid_mapping
+    - net: enetc: set MAC address to the VF net_device
+    - dt-bindings: net: xlnx,axi-ethernet: Correct phy-mode property value
+    - can: c_can: fix {rx,tx}_errors statistics
+    - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation
+      fails
+    - ice: change q_index variable type to s16 to store -1 value
+    - e1000e: Remove Meteor Lake SMBUS workarounds
+    - net: phy: ti: add PHY_RST_AFTER_CLK_EN flag
+    - net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case
+    - netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
+    - netfilter: nf_tables: wait for rcu grace period on net_device removal
+    - netfilter: nf_tables: do not defer rule destruction via call_rcu
+    - net: arc: rockchip: fix emac mdio node support
+    - drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path
+    - Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
+    - media: stb0899_algo: initialize cfr before using it
+    - media: dvb_frontend: don't play tricks with underflow values
+    - media: adv7604: prevent underflow condition when reporting colorspace
+    - scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer
+    - ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
+    - tools/lib/thermal: Fix sampling handler context ptr
+    - thermal/of: support thermal zones w/o trips subnode
+    - ASoC: SOF: sof-client-probes-ipc4: Set param_size extension bits
+    - media: pulse8-cec: fix data timestamp at pulse8_setup()
+    - media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl()
+    - can: m_can: m_can_close(): don't call free_irq() for IRQ-less devices
+    - can: mcp251xfd: mcp251xfd_get_tef_len(): fix length calculation
+    - can: mcp251xfd: mcp251xfd_ring_alloc(): fix coalescing configuration when
+      switching CAN modes
+    - ksmbd: count all requests in req_running counter
+    - ksmbd: fix broken transfers when exceeding max simultaneous operations
+    - pwm: imx-tpm: Use correct MODULO value for EPWM mode
+    - rpmsg: glink: Handle rejected intent request better
+    - drm/amdgpu: Adjust debugfs eviction and IB access permissions
+    - drm/amdgpu: Adjust debugfs register access permissions
+    - drm/amdgpu: Fix DPX valid mode check on GC 9.4.3
+    - thermal/drivers/qcom/lmh: Remove false lockdep backtrace
+    - dm cache: correct the number of origin blocks to match the target length
+    - dm cache: optimize dirty bit checking with find_next_bit when resizing
+    - dm-unstriped: cast an operand to sector_t to prevent potential uint32_t
+      overflow
+    - ALSA: usb-audio: Add quirk for HP 320 FHD Webcam
+    - net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc()
+    - mptcp: use sock_kfree_s instead of kfree
+    - arm64: Kconfig: Make SME depend on BROKEN for now
+    - [Config] updateconfigs for ARM64_SME
+    - arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint
+    - Revert "wifi: mac80211: fix RCU list iterations"
+    - i2c: designware: do not hold SCL low when I2C_DYNAMIC_TAR_UPDATE is not set
+    - fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
+    - usb: dwc3: fix fault at system suspend if device was already runtime
+      suspended
+    - USB: serial: qcserial: add support for Sierra Wireless EM86xx
+    - USB: serial: option: add Fibocom FG132 0x0112 composition
+    - USB: serial: option: add Quectel RG650V
+    - irqchip/gic-v3: Force propagation of the active state with a read-back
+    - ucounts: fix counter leak in inc_rlimit_get_ucounts()
+    - ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022
+    - arm64: dts: rockchip: Designate Turing RK1's system power controller
+    - EDAC/qcom: Make irq configuration optional
+    - arm64: dts: rockchip: Drop regulator-init-microvolt from two boards
+    - net: dpaa_eth: print FD status in CPU endianness in dpaa_eth_fd tracepoint
+    - virtio_net: Sync rss config to device when virtnet_probe
+    - drm/xe: Set mask bits for CCS_MODE register
+    - drm/amd/display: Fix brightness level not retained over reboot
+    - drm/imagination: Add a per-file PVR context list
+    - mptcp: no admin perm to list endpoints
+    - btrfs: fix the length of reserved qgroup to free
+    - btrfs: fix per-subvolume RO/RW flags with new mount API
+    - clk: qcom: gcc-x1e80100: Fix USB MP SS1 PHY GDSC pwrsts flags
+    - clk: qcom: clk-alpha-pll: Fix pll post div mask when width is not set
+    - objpool: fix to make percpu slot allocation more robust
+    - mm/damon/core: handle zero {aggregation,ops_update} intervals
+    - mm/damon/core: handle zero schemes apply interval
+    - mm/mlock: set the correct prev on failure
+    - clk: qcom: gcc-x1e80100: Fix halt_check for pipediv2 clocks
+    - staging: vchiq_arm: Get the rid off struct vchiq_2835_state
+    - staging: vchiq_arm: Use devm_kzalloc() for vchiq_arm_state allocation
+    - drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
+    - drm/xe: Move LNL scheduling WA to xe_device.h
+    - drm/xe/ufence: Flush xe ordered_wq in case of ufence timeout
+    - drm/xe/guc/tlb: Flush g2h worker in case of tlb timeout
+    - xtensa: Emulate one-byte cmpxchg
+    - Upstream stable to v6.6.61, v6.11.8
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50270
+    - mm/damon/core: avoid overflow in damon_feed_loop_next_input()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50274
+    - idpf: avoid vport access in idpf_get_link_ksettings
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53067
+    - scsi: ufs: core: Start the RTC update work later
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53084
+    - drm/imagination: Break an object reference loop
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53085
+    - tpm: Lock TPM chip in tpm_pm_suspend() first
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53086
+    - drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53087
+    - drm/xe: Fix possible exec queue leak in exec IOCTL
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50288
+    - media: vivid: fix buffer overwrite when using > 32 buffers
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50289
+    - media: av7110: fix a spectre vulnerability
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53062
+    - media: mgb4: protect driver against spectre
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50291
+    - media: dvb-core: add missing buffer index check
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50297
+    - net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50267
+    - USB: serial: io_edgeport: fix use after free in debug printk
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50268
+    - usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53083
+    - usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50269
+    - usb: musb: sunxi: Fix accessing an released usb phy
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50271
+    - signal: restore the override_rlimit logic
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50272
+    - filemap: Fix bounds checking in filemap_read()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50273
+    - btrfs: reinitialize delayed ref list after deleting it from the list
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50275
+    - arm64/sve: Discard stale CPU state when handling SVE traps
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50276
+    - net: vertexcom: mse102x: Fix possible double free of TX skb
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53066
+    - nfs: Fix KMSAN warning in decode_getfattr_attrs()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50278
+    - dm cache: fix potential out-of-bounds access on the first resume
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50279
+    - dm cache: fix out-of-bounds access to the dirty bitset when resizing
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50280
+    - dm cache: fix flushing uninitialized delayed_work on cache_ctr error
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53060
+    - drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50282
+    - drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50283
+    - ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50284
+    - ksmbd: Fix the missing xa_store error check
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50285
+    - ksmbd: check outstanding simultaneous SMB operations
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50286
+    - ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50287
+    - media: v4l2-tpg: prevent the risk of a division by zero
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50290
+    - media: cx24116: prevent overflows on SNR calculus
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53061
+    - media: s5p-jpeg: prevent buffer overflows
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53081
+    - media: ar0521: don't overflow when checking PLL values
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50292
+    - ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50294
+    - rxrpc: Fix missing locking causing hanging calls
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50295
+    - net: arc: fix the device for dma_map_single/dma_unmap_single
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53082
+    - virtio_net: Add hash_key_length check
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50296
+    - net: hns3: fix kernel crash when uninstalling driver
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53088
+    - i40e: fix race condition by adding filter's intermediate sync state
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50298
+    - net: enetc: allocate vf_state during PF probes
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50299
+    - sctp: properly validate chunk size in sctp_sf_ootb()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50300
+    - regulator: rtq2208: Fix uninitialized use of regulator_config
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50301
+    - security/keys: fix slab-out-of-bounds in key_task_permission
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53072
+    - platform/x86/amd/pmc: Detect when STB is not available
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53068
+    - firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996)
+    - Input: xpad - sort xpad_device by vendor and product ID
+    - Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller
+    - cgroup: Fix potential overflow issue when checking max_depth
+    - spi: geni-qcom: Fix boot warning related to pm_runtime and devres
+    - wifi: iwlegacy: Fix "field-spanning write" warning in il_enqueue_hcmd()
+    - mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING
+    - wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
+    - wifi: ath11k: Fix invalid ring usage in full monitor mode
+    - wifi: brcm80211: BRCM_TRACING should depend on TRACING
+    - RDMA/cxgb4: Dump vendor specific QP details
+    - RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down
+    - RDMA/bnxt_re: Fix the usage of control path spin locks
+    - RDMA/bnxt_re: synchronize the qp-handle table array
+    - RDMA/bnxt_re: Fix the locking while accessing the QP table
+    - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
+    - wifi: iwlwifi: mvm: don't add default link in fw restart flow
+    - ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
+    - net: stmmac: dwmac4: Fix high address display by updating reg_space[] from
+      register values
+    - net: stmmac: fix TSO DMA API usage causing oops
+    - gtp: allow -1 to be specified as file description from userspace
+    - bpf: Force checkpoint when jmp history is too long
+    - net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
+    - net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets
+    - mlxsw: spectrum_ptp: Add missing verification before pushing Tx header
+    - bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled
+    - iomap: improve shared block detection in iomap_unshare_iter
+    - iomap: don't bother unsharing delalloc extents
+    - iomap: share iomap_unshare_iter predicate code with fsdax
+    - fsdax: remove zeroing code from dax_unshare_iter
+    - iomap: turn iomap_want_unshare_iter into an inline function
+    - kasan: Fix Software Tag-Based KASAN with GCC
+    - firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
+    - afs: Fix missing subdir edit when renamed between parent dirs
+    - smb: client: set correct device number on nfs reparse points
+    - cxl/events: Fix Trace DRAM Event Record
+    - fs/ntfs3: Fix warning possible deadlock in ntfs_set_state
+    - fs/ntfs3: Stale inode instead of bad
+    - scsi: scsi_transport_fc: Allow setting rport state to current state
+    - cifs: Fix creating native symlinks pointing to current or parent directory
+    - thermal: intel: int340x: processor: Remove MMIO RAPL CPU hotplug support
+    - thermal: intel: int340x: processor: Add MMIO RAPL PL4 support
+    - net: amd: mvme147: Fix probe banner message
+    - NFS: remove revoked delegation from server's delegation list
+    - misc: sgi-gru: Don't disable preemption in GRU driver
+    - usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler
+    - usb: gadget: dummy_hcd: Set transfer interval to 1 microframe
+    - usb: gadget: dummy_hcd: execute hrtimer callback in softirq context
+    - USB: gadget: dummy-hcd: Fix "task hung" problem
+    - ALSA: usb-audio: Add quirks for Dell WD19 dock
+    - usbip: tools: Fix detach_port() invalid port error path
+    - usb: phy: Fix API devm_usb_put_phy() can not release the phy
+    - usb: typec: fix unreleased fwnode_handle in typec_port_register_altmodes()
+    - usb: typec: qcom-pmic-typec: use fwnode_handle_put() to release fwnodes
+    - xhci: Fix Link TRB DMA in command ring stopped completion event
+    - xhci: Use pm_runtime_get to prevent RPM on unsupported systems
+    - Revert "driver core: Fix uevent_show() vs driver detach race"
+    - iio: light: veml6030: fix microlux value calculation
+    - RISC-V: ACPI: fix early_ioremap to early_memremap
+    - tools/mm: -Werror fixes in page-types/slabinfo
+    - tools/mm: fix compile error
+    - thunderbolt: Honor TMU requirements in the domain when setting TMU mode
+    - mmc: sdhci-pci-gli: GL9767: Fix low power mode on the set clock function
+    - mmc: sdhci-pci-gli: GL9767: Fix low power mode in the SD Express process
+    - block: fix sanity checks in blk_rq_map_user_bvec
+    - cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
+    - phy: freescale: imx8m-pcie: Do CMN_RST just before PHY PLL lock check
+    - riscv: vdso: Prevent the compiler from inserting calls to memset()
+    - Input: edt-ft5x06 - fix regmap leak when probe fails
+    - ALSA: hda/realtek: Limit internal Mic boost on Dell platform
+    - riscv: efi: Set NX compat flag in PE/COFF header
+    - riscv: Use '%u' to format the output of 'cpu'
+    - riscv: Remove unused GENERATING_ASM_OFFSETS
+    - riscv: Remove duplicated GET_RM
+    - cxl/port: Fix cxl_bus_rescan() vs bus_rescan_devices()
+    - cxl/acpi: Ensure ports ready at cxl_acpi_probe() return
+    - mei: use kvmalloc for read buffer
+    - mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves
+    - x86/traps: Enable UBSAN traps on x86
+    - x86/traps: move kmsan check after instrumentation_begin
+    - kasan: remove vmalloc_percpu test
+    - vmscan,migrate: fix page count imbalance on node stats when demoting pages
+    - io_uring: always lock __io_cqring_overflow_flush
+    - mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw()
+    - mm: don't install PMD mappings when THPs are disabled by the hw/process/vma
+    - perf trace: Fix non-listed archs in the syscalltbl routines
+    - dpll: add Embedded SYNC feature for a pin
+    - ice: add callbacks for Embedded SYNC enablement on dpll pins
+    - bpf: Add bpf_mem_alloc_check_size() helper
+    - net: ethernet: mtk_wed: fix path of MT7988 WO firmware
+    - drm/mediatek: ovl: Remove the color format comment for ovl_fmt_convert()
+    - drm/mediatek: Fix get efuse issue for MT8188 DPTX
+    - ACPI: resource: Fold Asus Vivobook Pro N6506M* DMI quirks together
+    - powercap: intel_rapl_msr: Add PL4 support for Arrowlake-U
+    - usb: typec: qcom-pmic-typec: fix missing fwnode removal in error path
+    - mm: shrinker: avoid memleak in alloc_shrinker_info
+    - firmware: microchip: auto-update: fix poll_complete() to not report spurious
+      timeout errors
+    - soc: qcom: pmic_glink: Handle GLINK intent allocation rejections
+    - cxl/port: Fix CXL port initialization order when the subsystem is built-in
+    - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io()
+    - posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone
+    - mm/ksm: remove redundant code in ksm_fork
+    - nvme: re-fix error-handling for io_uring nvme-passthrough
+    - btrfs: fix extent map merging not happening for adjacent extents
+    - btrfs: fix defrag not merging contiguous extents due to merged extent maps
+    - mm, mmap: limit THP alignment of anonymous mappings to PMD-aligned sizes
+    - mm: multi-gen LRU: ignore non-leaf pmd_young for force_scan=true
+    - mm: multi-gen LRU: remove MM_LEAF_OLD and MM_NONLEAF_TOTAL stats
+    - mm: shrink skip folio mapped by an exiting process
+    - mm: multi-gen LRU: use {ptep,pmdp}_clear_young_notify()
+    - drm/i915: Skip programming FIA link enable bits for MTL+
+    - drm/i915/display: WA for Re-initialize dispcnlunitt1 xosc clock
+    - drm/i915/dp: Clear VSC SDP during post ddi disable routine
+    - drm/i915/pps: Disable DPLS_GATING around pps sequence
+    - drm/i915: move rawclk from runtime to display runtime info
+    - drm/xe/display: drop unused rawclk_freq and RUNTIME_INFO()
+    - drm/xe: Support 'nomodeset' kernel command-line option
+    - drm/xe/xe2hpg: Introduce performance tuning changes for Xe2_HPG
+    - drm/amdgpu/swsmu: fix ordering for setting workload_mask
+    - drm/amdgpu/swsmu: default to fullscreen 3D profile for dGPUs
+    - drm/amdgpu: handle default profile on on devices without fullscreen 3D
+    - MIPS: export __cmpxchg_small()
+    - rcu/kvfree: Add kvfree_rcu_barrier() API
+    - rcu/kvfree: Refactor kvfree_rcu_queue_batch()
+    - Upstream stable to v6.6.60, v6.11.7
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53050
+    - drm/i915/hdcp: Add encoder check in hdcp2_get_capability
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53051
+    - drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50303
+    - resource,kexec: walk_system_ram_res_rev must retain resource flags
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50263
+    - fork: only invoke khugepaged, ksm hooks if no error
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50220
+    - fork: do not invoke uffd on fork if error occurs
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50221
+    - drm/amd/pm: Vangogh: Fix kernel memory out of bounds write
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53053
+    - scsi: ufs: core: Fix another deadlock during RTC update
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50225
+    - btrfs: fix error propagation of split bios
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50230
+    - nilfs2: fix kernel bug due to missing clearing of checked flag
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50238
+    - phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53044
+    - net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50304
+    - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53048
+    - ice: fix crash on probe for DPLL enabled E810 LOM
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53045
+    - ASoC: dapm: fix bounds checker error in dapm_widget_list_create
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53055
+    - wifi: iwlwifi: mvm: fix 6 GHz scan construction
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53046
+    - arm64: dts: imx8ulp: correct the flexspi compatible string
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53052
+    - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50215
+    - nvmet-auth: assign dh_key to NULL after kfree_sensitive
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50216
+    - xfs: fix finding a last resort AG in xfs_filestream_pick_ag
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53043
+    - mctp i2c: handle NULL header address
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50218
+    - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53047
+    - mptcp: init: protect sched with rcu_read_lock
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50222
+    - iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50223
+    - sched/numa: Fix the potential null pointer dereference in task_numa_work()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50224
+    - spi: spi-fsl-dspi: Fix crash when not using GPIO chip select
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50226
+    - cxl/port: Fix use-after-free, permit out-of-order decoder shutdown
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50231
+    - iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53076
+    - iio: gts-helper: Fix memory leaks for the error path of
+      iio_gts_build_avail_scale_table()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50232
+    - iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50234
+    - wifi: iwlegacy: Clear stale interrupts before resuming device
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50235
+    - wifi: cfg80211: clear wdev->cqm_config pointer on free
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50236
+    - wifi: ath10k: Fix memory leak in management tx
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50237
+    - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50239
+    - phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50240
+    - phy: qcom: qmp-usb: fix NULL-deref on runtime suspend
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50242
+    - fs/ntfs3: Additional check in ntfs_file_release
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50243
+    - fs/ntfs3: Fix general protection fault in run_is_mapped_full
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50244
+    - fs/ntfs3: Additional check in ni_clear()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50245
+    - fs/ntfs3: Fix possible deadlock in mi_read
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50246
+    - fs/ntfs3: Add rough attr alloc_size check
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50247
+    - fs/ntfs3: Check if more than chunk-size bytes are written
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50250
+    - fsdax: dax_unshare_iter needs to copy entire blocks
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50251
+    - netfilter: nft_payload: sanitize offset and length before calling
+      skb_checksum()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50252
+    - mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50255
+    - Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50257
+    - netfilter: Fix use-after-free in get_info()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50258
+    - net: fix crash when config small gso_max_size/gso_ipv4_max_size
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50262
+    - bpf: Fix out-of-bounds write in trie_get_next_key()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50259
+    - netdevsim: Add trailing zero to terminate the string in
+      nsim_nexthop_bucket_activity_write()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53042
+    - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53058
+    - net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50261
+    - macsec: Fix use-after-free while sending the offloading packet
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53059
+    - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
+  * Noble update: upstream stable patchset 2025-02-07 (LP: #2097575)
+    - irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1
+    - xfs: fix error returns from xfs_bmapi_write
+    - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions
+    - xfs: remove a racy if_bytes check in xfs_reflink_end_cow_extent
+    - xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item
+      recovery
+    - xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2
+    - xfs: fix missing check for invalid attr flags
+    - xfs: check shortform attr entry flags specifically
+    - xfs: validate recovered name buffers when recovering xattr items
+    - xfs: enforce one namespace per attribute
+    - xfs: revert commit 44af6c7e59b12
+    - xfs: use dontcache for grabbing inodes during scrub
+    - xfs: match lock mode in xfs_buffered_write_iomap_begin()
+    - xfs: make the seq argument to xfs_bmapi_convert_delalloc() optional
+    - xfs: make xfs_bmapi_convert_delalloc() to allocate the target offset
+    - xfs: convert delayed extents to unwritten when zeroing post eof blocks
+    - xfs: allow symlinks with short remote targets
+    - xfs: make sure sb_fdblocks is non-negative
+    - xfs: fix unlink vs cluster buffer instantiation race
+    - xfs: fix freeing speculative preallocations for preallocated files
+    - xfs: allow unlinked symlinks and dirs with zero size
+    - xfs: restrict when we try to align cow fork delalloc to cowextsz hints
+    - selftests: mptcp: join: change capture/checksum as bool
+    - selftests: mptcp: join: test for prohibited MPC to port-based endp
+    - selftests: mptcp: remove duplicated variables
+    - iio: accel: bma400: Fix uninitialized variable field_value in tap event
+      handling.
+    - bpf: Make sure internal and UAPI bpf_redirect flags don't overlap
+    - bpf: devmap: provide rxq after redirect
+    - cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory systems
+    - lib/Kconfig.debug: fix grammar in RUST_BUILD_ASSERT_ALLOW
+    - bpf: Fix memory leak in bpf_core_apply
+    - RDMA/bnxt_re: Fix a possible memory leak
+    - RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
+    - RDMA/bnxt_re: Add a check for memory allocation
+    - x86/resctrl: Avoid overflow in MB settings in bw_validate()
+    - ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
+    - bpf: Add cookie to perf_event bpf_link_info records
+    - bpf: fix unpopulated name_len field in perf_event link info
+    - selftests/bpf: Add cookies check for perf_event fill_link_info test
+    - selftests/bpf: fix perf_event link info name_len assertion
+    - s390/pci: Handle PCI error codes other than 0x3a
+    - bpf: fix kfunc btf caching for modules
+    - iio: frequency: {admv4420,adrf6780}: format Kconfig entries
+    - iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig
+    - drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check
+    - selftests/bpf: Fix cross-compiling urandom_read
+    - task_work: Add TWA_NMI_CURRENT as an additional notify mode.
+    - sched/core: Disable page allocation in task_tick_mm_cid()
+    - ALSA: hda/cs8409: Fix possible NULL dereference
+    - firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
+    - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
+    - RDMA/irdma: Fix misspelling of "accept*"
+    - RDMA/srpt: Make slab cache names unique
+    - ipv4: give an IPv4 dev to blackhole_netdev
+    - RDMA/bnxt_re: Fix the max CQ WQEs for older adapters
+    - RDMA/bnxt_re: Fix out of bound check
+    - RDMA/bnxt_re: Return more meaningful error
+    - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
+    - RDMA/bnxt_re: Fix the GID table length
+    - accel/qaic: Fix the for loop used to walk SG table
+    - drm/msm/dpu: make sure phys resources are properly initialized
+    - drm/msm/dpu: check for overflow in _dpu_crtc_setup_lm_bounds()
+    - drm/msm/dsi: improve/fix dsc pclk calculation
+    - drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
+    - drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()
+    - drm/msm: Allocate memory for disp snapshot with kvzalloc()
+    - firmware: arm_scmi: Queue in scmi layer for mailbox implementation
+    - net/smc: Fix memory leak when using percpu refs
+    - net: usb: usbnet: fix race in probe failure
+    - net: stmmac: dwmac-tegra: Fix link bring-up sequence
+    - octeontx2-af: Fix potential integer overflows on integer shifts
+    - drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring
+    - macsec: don't increment counters for an unrelated SA
+    - netdevsim: use cond_resched() in nsim_dev_trap_report_work()
+    - net: ethernet: aeroflex: fix potential memory leak in
+      greth_start_xmit_gbit()
+    - net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
+    - net: xilinx: axienet: fix potential memory leak in axienet_start_xmit()
+    - bpf: Fix truncation bug in coerce_reg_to_size_sx()
+    - irqchip/renesas-rzg2l: Fix missing put_device
+    - drm/msm/dpu: don't always program merge_3d block
+    - net: bcmasp: fix potential memory leak in bcmasp_xmit()
+    - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
+    - net: dsa: mv88e6xxx: Fix the max_vid definition for the MV88E6361
+    - genetlink: hold RCU in genlmsg_mcast()
+    - ravb: Remove setting of RX software timestamp
+    - net: ravb: Only advertise Rx/Tx timestamps if hardware supports it
+    - scsi: target: core: Fix null-ptr-deref in target_alloc_device()
+    - smb: client: fix possible double free in smb2_set_ea()
+    - smb: client: fix OOBs when building SMB2_IOCTL request
+    - usb: typec: altmode should keep reference to parent
+    - s390: Initialize psw mask in perf_arch_fetch_caller_regs()
+    - bpf: Fix link info netfilter flags to populate defrag flag
+    - vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame
+    - net/mlx5: Check for invalid vector index on EQ creation
+    - net/mlx5: Fix command bitmask initialization
+    - net/mlx5: Unregister notifier on eswitch init failure
+    - bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock
+    - vsock: Update rx_bytes on read_skb()
+    - vsock: Update msg_count on read_skb()
+    - bpf, vsock: Drop static vsock_bpf_prot initialization
+    - riscv, bpf: Make BPF_CMPXCHG fully ordered
+    - nvme-pci: fix race condition between reset and nvme_dev_disable()
+    - bpf: Fix iter/task tid filtering
+    - cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed()
+    - khugepaged: inline hpage_collapse_alloc_folio()
+    - khugepaged: convert alloc_charge_hpage to alloc_charge_folio
+    - khugepaged: remove hpage from collapse_file()
+    - mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace
+      point
+    - iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - xhci: dbgtty: remove kfifo_out() wrapper
+    - xhci: dbgtty: use kfifo from tty_port struct
+    - xhci: dbc: honor usb transfer size boundaries.
+    - usb: gadget: f_uac2: fix non-newline-terminated function name
+    - usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store
+    - XHCI: Separate PORT and CAPs macros into dedicated file
+    - usb: dwc3: core: Fix system suspend on TI AM62 platforms
+    - tracing/fprobe-event: cleanup: Fix a wrong comment in fprobe event
+    - tracing/probes: cleanup: Set trace_probe::nr_args at trace_probe_init
+    - tracing/probes: Support $argN in return probe (kprobe and fprobe)
+    - uprobes: encapsulate preparation of uprobe args buffer
+    - uprobes: prepare uprobe args buffer lazily
+    - uprobes: prevent mutex_lock() under rcu_read_lock()
+    - uprobe: avoid out-of-bounds memory access of fetching args
+    - exec: don't WARN for racy path_noexec check
+    - ASoC: amd: yc: Add quirk for HP Dragonfly pro one
+    - ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to
+      default regs values
+    - ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit
+    - arm64: Force position-independent veneers
+    - udf: refactor udf_current_aext() to handle error
+    - udf: refactor udf_next_aext() to handle error
+    - udf: refactor inode_bmap() to handle error
+    - udf: fix uninit-value use in udf_get_fileshortad
+    - ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string
+    - cifs: Validate content of NFS reparse point buffer
+    - platform/x86: dell-sysman: add support for alienware products
+    - LoongArch: Don't crash in stack_top() for tasks without vDSO
+    - jfs: Fix sanity check in dbMount
+    - tracing/probes: Fix MAX_TRACE_ARGS limit handling
+    - tracing: Consider the NULL character when validating the event length
+    - xfrm: extract dst lookup parameters into a struct
+    - xfrm: respect ip protocols rules criteria when performing dst lookups
+    - netfilter: bpf: must hold reference on net namespace
+    - net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
+    - net: plip: fix break; causing plip to never transmit
+    - octeon_ep: Implement helper for iterating packets in Rx queue
+    - octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()
+    - net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x
+    - fsl/fman: Save device references taken in mac_probe()
+    - fsl/fman: Fix refcount handling of fman-related devices
+    - netfilter: xtables: fix typo causing some targets not to load on IPv6
+    - net: wwan: fix global oob in wwan_rtnl_policy
+    - net/sched: adjust device watchdog timer to detect stopped queue at right
+      time
+    - net: fix races in netdev_tx_sent_queue()/dev_watchdog()
+    - net: usb: usbnet: fix name regression
+    - bpf: Add MEM_WRITE attribute
+    - bpf: Fix overloading of MEM_UNINIT's meaning
+    - bpf: Remove MEM_UNINIT from skb/xdp MTU helpers
+    - net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions
+      created by classifiers
+    - net: sched: fix use-after-free in taprio_change()
+    - net: sched: use RCU read-side critical section in taprio_dump()
+    - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
+    - Bluetooth: SCO: Fix UAF on sco_sock_timeout
+    - Bluetooth: ISO: Fix UAF on iso_sock_timeout
+    - bpf,perf: Fix perf_event_detach_bpf_prog error handling
+    - net: dsa: mv88e6xxx: group cycle counter coefficients
+    - net: dsa: mv88e6xxx: read cycle counter period from hardware
+    - net: dsa: mv88e6xxx: support 4000ps cycle counter period
+    - ASoC: dt-bindings: davinci-mcasp: Fix interrupts property
+    - ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties
+    - ASoC: loongson: Fix component check failed on FDT systems
+    - ASoC: max98388: Fix missing increment of variable slot_found
+    - ASoC: rsnd: Fix probe failure on HiHope boards due to endpoint parsing
+    - ASoC: fsl_micfil: Add a flag to distinguish with different volume control
+      types
+    - ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
+    - powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request()
+    - nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
+    - ALSA: hda/realtek: Update default depop procedure
+    - smb: client: Handle kstrdup failures for passwords
+    - cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception
+    - btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item()
+    - btrfs: zoned: fix zone unusable accounting for freed reserved extent
+    - ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
+    - ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context
+    - ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid
+      detection issue
+    - nilfs2: fix kernel bug due to missing clearing of buffer delay flag
+    - openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
+    - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
+    - KVM: arm64: Fix shift-out-of-bounds bug
+    - KVM: arm64: Don't eagerly teardown the vgic on init error
+    - x86/lam: Disable ADDRESS_MASKING in most cases
+    - [Config] disable ADDRESS_MASKING
+    - ALSA: hda/tas2781: select CRC32 instead of CRC32_SARWATE
+    - ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
+    - LoongArch: Get correct cores_per_package for SMT systems
+    - LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context
+    - LoongArch: Make KASAN usable for variable cpu_vabits
+    - xfrm: fix one more kernel-infoleak in algo dumping
+    - hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
+    - drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too
+    - selinux: improve error checking in sel_write_load()
+    - net: phy: dp83822: Fix reset pin definitions
+    - ata: libata: Set DID_TIME_OUT for commands that actually timed out
+    - ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
+    - platform/x86: dell-wmi: Ignore suspend notifications
+    - ACPI: PRM: Clean up guid type in struct prm_handler_info
+    - tracing: probes: Fix to zero initialize a local variable
+    - task_work: make TWA_NMI_CURRENT handling conditional on IRQ_WORK
+    - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
+    - bpf: Use raw_spinlock_t in ringbuf
+    - reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC
+    - bpf: Fix unpopulated path_size when uprobe_multi fields unset
+    - RDMA/bnxt_re: Fix incorrect dereference of srq in async event
+    - RDMA/bnxt_re: Get the toggle bits from SRQ events
+    - RDMA/bnxt_re: Change the sequence of updating the CQ toggle value
+    - drm/msm/dpu: move CRTC resource assignment to dpu_encoder_virt_atomic_check
+    - ring-buffer: Fix reader locking when changing the sub buffer order
+    - drm/msm/dpu: Don't always set merge_3d pending flush
+    - drm/msm/a6xx+: Insert a fence wait before SMMU table update
+    - drm/xe: Take job list lock in xe_sched_add_pending_job
+    - drm/xe: Use bookkeep slots for external BO's in exec IOCTL
+    - net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init
+    - net/mlx5e: Don't call cleanup on profile rollback failure
+    - bpf: Fix print_reg_state's constant scalar dump
+    - fsnotify: optimize the case of no parent watcher
+    - fsnotify: Avoid data race between fsnotify_recalc_mask() and
+      fsnotify_object_watched()
+    - drm/xe/mcr: Use Xe2_LPM steering tables for Xe2_HPM
+    - objpool: fix choosing allocation for percpu slots
+    - bnxt_en: replace ptp_lock with irqsave variant
+    - bpf, arm64: Fix address emission with tag-based KASAN enabled
+    - net: dsa: microchip: disable EEE for KSZ879x/KSZ877x/KSZ876x
+    - ASoC: topology: Bump minimal topology ABI version
+    - fbdev: wm8505fb: select CONFIG_FB_IOMEM_FOPS
+    - btrfs: qgroup: set a more sane default value for subtree drop threshold
+    - btrfs: clear force-compress on remount when compress mount option is given
+    - x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h-70h
+    - x86/amd_nb: Add new PCI ID for AMD family 1Ah model 20h
+    - btrfs: reject ro->rw reconfiguration if there are hard ro requirements
+    - xfs: don't fail repairs on metadata files with no attr fork
+    - drm/bridge: Fix assignment of the of_node of the parent to aux bridge
+    - platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid
+      addresses
+    - fgraph: Fix missing unlock in register_ftrace_graph()
+    - fgraph: Change the name of cpuhp state to "fgraph:online"
+    - ASoC: SOF: Intel: hda: Always clean up link DMA during stop
+    - ASoC: dapm: avoid container_of() to get component
+    - ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc
+    - ASoC: qcom: sdm845: add missing soundwire runtime stream alloc
+    - soundwire: intel_ace2x: Send PDI stream number during prepare
+    - x86: support user address masking instead of non-speculative conditional
+    - ASoC: qcom: Select missing common Soundwire module code on SDM845
+    - SAUCE: Revert "iio: adc: ti-lmp92064: add missing select
+      IIO_(TRIGGERED_)BUFFER in Kconfig"
+    - Upstream stable to v6.6.58, v6.6.59, v6.11.6
+  * CVE-2025-21756
+    - vsock: Keep the binding until socket destruction
+    - vsock: Orphan socket after transport release
+  * Fix NIC name changes for ice (LP: #2100264)
+    - ice: Remove ndo_get_phys_port_name
+  * CVE-2024-50256
+    - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
+  * CVE-2025-21702
+    - pfifo_tail_enqueue: Drop new packet when sch->limit == 0
+  * CVE-2024-50167
+    - be2net: fix potential memory leak in be_xmit()
+  * Fix line-out playback on some platforms with Cirrus Logic “Dolphin” hardware
+    (LP: #2099880)
+    - ALSA: hda/cirrus: Correct the full scale volume set logic
+  * Enable Large Language Model (LLM) workloads using Intel NPU (LP: #2098972)
+    - accel/ivpu: Increase DMA address range
+  * Patchset for TUXEDO devices (LP: #2098104)
+    - wifi: ath12k: add fallback board name without variant while searching
+      board-2.bin
+    - wifi: ath12k: remove unused ATH12K_BD_IE_BOARD_EXT
+    - wifi: ath12k: add support to search regdb data in board-2.bin for WCN7850
+    - wifi: ath12k: support default regdb while searching board-2.bin for WCN7850
+    - ACPI: resource: Use IRQ override on Maibenben X565
+    - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
+    - ALSA: hda/realtek: Fix headset mic on TUXEDO Gemini 17 Gen3
+    - ALSA: hda/realtek: Fix headset mic on TUXEDO Stellaris 16 Gen6 mb1
+    - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
+    - nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
+    - nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
+  * Introduce and use sendpages_ok() instead of sendpage_ok() in nvme-tcp and
+    drbd (LP: #2093871)
+    - net: introduce helper sendpages_ok()
+    - nvme-tcp: use sendpages_ok() instead of sendpage_ok()
+    - drbd: use sendpages_ok() instead of sendpage_ok()
+  * CVE-2024-56765
+    - powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
+  * CVE-2025-21700
+    - net: sched: Disallow replacing of child qdisc from one parent to another
+  * CVE-2024-56615
+    - bpf: fix OOB devmap writes when deleting elements
+  * CVE-2024-56651
+    - can: hi311x: hi3110_can_ist(): fix potential use-after-free
+  * CVE-2024-56627
+    - ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
+  * CVE-2024-56600
+    - net: inet6: do not leave a dangling sk pointer in inet6_create()
+  * CVE-2024-56661
+    - tipc: fix NULL deref in cleanup_bearer()
+  * CVE-2024-56642
+    - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
+  * CVE-2024-53227
+    - scsi: bfa: Fix use-after-free in bfad_im_module_exit()
+  * CVE-2024-53237
+    - Bluetooth: fix use-after-free in device_for_each_child()
+  * CVE-2024-53166
+    - block, bfq: fix bfqq uaf in bfq_limit_depth()
+  * CVE-2024-50265
+    - ocfs2: remove entry once instead of null-ptr-dereference in
+      ocfs2_xa_remove()
+  * CVE-2024-50249
+    - ACPI: CPPC: Make rmw_lock a raw_spin_lock
+  * iBFT iSCSI out-of-bounds shift UBSAN warning (LP: #2097824)
+    - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
+  * [Ubuntu 24.04] MultiVM - L2 guest(s) running stress-ng getting stuck at
+    booting after triggering crash (LP: #2077722)
+    - KVM: PPC: Book3S HV: Mask off LPCR_MER for a vCPU before running it to avoid
+      spurious interrupts
+  * btrfs will WARN_ON() in btrfs_remove_qgroup() unnecessarily (LP: #2091719)
+    - btrfs: improve the warning and error message for btrfs_remove_qgroup()
+  * CVE-2024-50248
+    - ntfs3: Add bounds checking to mi_enum_attr()
+    - fs/ntfs3: Sequential field availability check in mi_enum_attr()
+  * CVE-2025-21701
+    - net: avoid race between device unregistration and ethnl ops
+  * CVE-2024-57798
+    - drm/dp_mst: Ensure mst_primary pointer is valid in
+      drm_dp_mst_handle_up_req()
+  * CVE-2024-56672
+    - blk-cgroup: Fix UAF in blkcg_unpin_online()
+  * CVE-2024-56658
+    - net: defer final 'struct net' free in netns dismantle
+  * CVE-2024-56598
+    - jfs: array-index-out-of-bounds fix in dtReadFirst
+  * CVE-2024-56595
+    - jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
+  * CVE-2024-53140
+    - netlink: terminate outstanding dump on socket close
+  * CVE-2024-53063
+    - media: dvbdev: prevent the risk of out of memory access
+  * CVE-2024-50302
+    - HID: core: zero-initialize the report buffer
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 04 Jun 2025 20:20:57 +0900
+
+linux-qcom (6.8.0-1042.42) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1042.42 -proposed tracker (LP: #2112174)
+
+  * Miscellaneous Ubuntu changes
+    - [configs] change CONFIG_HWSPINLOCK_QCOM to y
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 30 May 2025 17:59:33 +0900
+
+linux-qcom (6.8.0-1041.41) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1041.41 -proposed tracker (LP: #2111886)
+
+  * [RB3][x02] spf core errors found in dmesg
+    - SAUCE: qcom: spf-core: use pr_info() for successful logs
+
+  * [RB3][x03] va_macro error found in dmesg
+    - SAUCE: ASoC: lpass-va-macro: change dt entry missing to dev_info()
+
+  * [RB8][x02] spmi errors found in dmesg
+    - SAUCE: arm64: sa8775: remove allow-set-time property from rtc
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: switch WIFI firmware to *.mbn from *.mdt
+
+  * Miscellaneous upstream changes
+    - msm: camera: icp: Remove Redundant Structure Field
+    - msm: camera: uapi: Adding flex array support to fix UBSAN kernel panic
+    - PENDING: rpmsg: glink: do not serve intent request if no callback present
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 28 May 2025 16:55:09 +0900
+
+linux-qcom (6.8.0-1040.40) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1040.40 -proposed tracker (LP: #2110187)
+
+  * "[6490][x02] tc956x_pci-eth errors found in dmesg"
+    - Ubuntu: SAUCE: change phy detection log-level from alert to info
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: follow-up renaming from qcs9075-rb8 to qcs9075-iq-9075-evk
+
+  * Miscellaneous upstream changes
+    - PENDING: qcom: ice: Add ice probe
+    - PENDING: arm64: dts: qcom: Rename qcs9075-rb8 to qcs9075-iq-9075-evk
+    - QCLINUX: arm64: dts: qcom: qcs9075-addons: Rename rb8 to iq-9075-evk
+    - PENDING: tty: serial: qcom-geni-serial: fix CTS control for UART in loopback
+      mode
+    - QCLINUX: arm64: deconfig: enable CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT
+    - PENDING: misc: fastrpc: Remove PD status check
+    - Revert "FROMLIST: arm64: dts: qcom: sa8775p: Add CPUs to psci power domain"
+    - Revert "BACKPORT: UPSTREAM: arm64: dts: qcom: sa8775p: add CPU idle states"
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 09 May 2025 17:00:23 +0900
+
+linux-qcom (6.8.0-1039.39) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1039.39 -proposed tracker (LP: #2108955)
+
+  * [RB8][x02] hd3ss3220 not boud to the device
+    - Revert "usb: dwc3: core: set force_gen1 bit in USB31 devices if max speed is
+      SS"
+
+  * "[RB8][x02] The firmware for i2c_qcom_geni (qupv3fw.elf) not in
+    initramfs" // "[RB8][x02] qcom_geni_serial errors found in dmesg"
+    - SAUCE: qcom-geni-se.c: add MODULE_FIRMWARE() to copy firmware to initrd
+
+  * Miscellaneous upstream changes
+    - kgsl: Read DDR type from device tree node
+    - qcom: qtee_shmbridge: change pr_err() to pr_info() for bridge size
+    - qcom: qtee_shmbridge: change pr_err() to pr_info() for bridge size
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 24 Apr 2025 12:47:31 +0900
+
+linux-qcom (6.8.0-1038.38) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1038.38 -proposed tracker (LP: #2107286)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.qcom/dkms-versions -- update from kernel-versions
+      (main/d2025.04.13)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: fix firmware for rb8
+
+  * Miscellaneous upstream changes
+    - kgsl: Fix UBSAN warning in kgsl_get_page_size
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 14 Apr 2025 02:26:32 +0900
+
+linux-qcom (6.8.0-1037.37) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1037.37 -proposed tracker (LP: #2106781)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: add QCS6490 industrical kit dt to compiled-dtb.dtb
+    - [Config] Disable CONFIG_DRM_MSM_VALIDATE_XML
+
+  * Miscellaneous upstream changes
+    - QCLINUX: arm64: dts: qcom: qcm6490-graphics: Don't disable drm gpu/gmu nodes
+    - QCLINUX: arm64: dts: qcom: qcs9100-graphics: Don't disable drm gpu/gmu nodes
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 11 Apr 2025 08:22:42 +0900
+
+linux-qcom (6.8.0-1036.36) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1036.36 -proposed tracker (LP: #2105444)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.qcom/dkms-versions -- update from kernel-versions
+      (main/d2025.03.31)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Add Makefile code to apply overlays for GA1.4
+    - [Packaging] build zfs
+
+  * Miscellaneous upstream changes
+    - PENDING: drm/msm/dsi: Add DSI support for SA8775P
+    - PENDING: drm/msm/dsi: add DSI PHY configuration for SA8775P
+    - QCLINUX: Revert "PENDING: drm/bridge: anx7625: Fix circular dependency"
+    - PENDING: arm64: dts: qcom: sa8775p: add DSI CTRL and PHY support
+    - PENDING: ASoC: dt-bindings: q6dsp: Add High Speed Audio DAI ID support for
+      MI2S and TDM
+    - PENDING: net: pcs: Add 5G baseR changes in PCS driver
+    - PENDING: net: stmmac: Add support for 5GbaseR to configure mac
+    - PENDING: ASoC: qcom: q6dsp: Add SDR High speed DAI support for MI2S and TDM
+    - PENDING: ASoC: qcom: qcm9100: Add machine driver for qcs9100-ride and
+      qcs9075-rb8 boards
+    - PENDING: net: phy: aquantia: Add support for 5GbaseR
+    - PENDING: arm64: dts: qcom: sa8775p: add anx7625 DSI to DP bridge nodes
+    - PENDING: drm/bridge: anx7625: vote for pm runtime during bridge attach
+    - PENDING: drm/bridge: anx7625: update bridge_ops and sink detect logic
+    - PENDING: arm64: defconfig: qcom_gen5auto: Enable TSC
+    - PENDING: arm64: dts: qcom: qcs8300: Add support for camss
+    - PENDING: media: qcom: camss: Add support for camss driver on qcs8300
+    - PENDING: media: qcom: camss: add TPG support on camss for qcs8300
+    - PENDING: net: stmmac: Enable PTP Packet id based timestamping
+    - PENDING: net: PCS: Call PCS link up sequence for 10GBASER
+    - PENDING: net: stmmac: Add support for 10GBASER mode within Mac link up
+    - PENDING: ARM: dts: msm: Add RPMh stats for 8255p
+    - QCLINUX: arm64: dts: qcom: Update the DAI ID for SDR High Speed dailinks
+    - QCLINUX: Revert "PENDING: tty: serial: qcom-geni-serial: Increase Rx buffer
+      size"
+    - UPSTREAM: BACKPORT: arm64: dts: qcm6490: Add interconnect for CDSP
+      remoteproc
+    - BACKPORT: FROMLIST: remoteproc: qcom: Add iommu map_unmap helper function
+    - BACKPORT: FROMLIST: remoteproc: qcom: Add helper function to support IOMMU
+      devmem translation
+    - BACKPORT: FROMLIST: remoteproc: qcom: Add support to parse qcom,devmem
+      property
+    - BACKPORT: FROMLIST: remoteproc: qcom: Add support of SHM bridge to enable
+      memory protection
+    - BACKPORT: FROMLIST: remoteproc: qcom: Enable map/unmap and SHM bridge
+      support
+    - QCLINUX: drm/msm: Remove changes made to prevent gpu probe
+    - FROMLIST: arm64: dts: qcom: sa8775p: Add gpu and gmu nodes
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Don't disable drm gpu/gmu nodes
+    - QCLINUX: arm64: dts: qcom: qcs615: addons: Add coresight nodes
+    - PENDING: arm64: dts: qcom: sa8255p: Update hysteresis to 10degC
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add EL2 dtb support
+    - QCLINUX: arm64: dts: qcom: qcs615: addons: Add memory dump table
+    - QCLINUX: arm64: defconfig: qcom: Enable QCS9100 machine driver config
+    - PENDING: arm64: dts: qcom: sa7255p: Disable USB U1/U2 entry
+    - FROMGIT: arm64: dts: qcom: sc8280xp: Disable USB U1/U2 entry
+    - FROMGIT: arm64: dts: qcom: sc8180x: Disable USB U1/U2 entry
+    - PENDING: Coresight: Add an integer array to tmc driver data
+    - PENDING: pinctrl: qcom: fix sa8775p lpass lpi quad pinctrl setting
+    - FROMLIST: arm64: dts: qcom: sa8775p: Remove extra entries from the iommus
+      property
+    - QCLINUX: arm64: dts: qcom: add hs0 mi2s dai for qcs9075-rb8
+    - QCLINUX: arm64: dts: qcom: qcs615: addons: Enable DCC
+    - PENDING: usb: dwc3: qcom: Adding GPIO-based regulator functionality for VBUS
+    - PENDING: arm64: dts: configs: Enable HD3SS322 USB Type-C DRP port controller
+      driver on QCS9075 RB8
+    - PENDING: arm64: dts: qcom: Flatten USB DT node for USB0 on QCS9075 RB8
+      Platform
+    - PENDING: arm64: dts: qcom: Add DRD mode support for USB0 on QCS9075 RB8
+    - PENDING: arm64: dts: qcom: Flatten USB DT node for USB1 on QCS9075 RB8
+      Platform
+    - PENDING: arm64: dts: qcom: Add host mode support for USB1 on QCS9075 RB8
+    - FROMLIST: dt-bindings: clock: Add Qualcomm QCS615 Camera clock controller
+    - FROMLIST: clk: qcom: camcc-qcs615: Add QCS615 camera clock controller driver
+    - FROMLIST: dt-bindings: clock: Add Qualcomm QCS615 Display clock controller
+    - FROMLIST: clk: qcom: dispcc-qcs615: Add QCS615 display clock controller
+      driver
+    - FROMLIST: dt-bindings: clock: Add Qualcomm QCS615 Graphics clock controller
+    - FROMLIST: clk: qcom: gpucc-qcs615: Add QCS615 graphics clock controller
+      driver
+    - FROMLIST: dt-bindings: clock: Add Qualcomm QCS615 Video clock controller
+    - FROMLIST: clk: qcom: videocc-qcs615: Add QCS615 video clock controller
+      driver
+    - FROMLIST: arm64: defconfig: Enable QCS615 clock controllers
+    - PENDING: ASoC: qcom: q6dsp: Update formats and max rate for Primary i2s
+    - QCLINUX: arm64: defconfigs: Disable TBU support
+    - FROMLIST: arm64: dts: qcom: sa8775p-ride: Add firmware-name in BT node
+    - QCLINUX: Revert "PENDING: arm64: qcs9075-rb8: disable uart bt en pin in DTS"
+    - FROMLIST: arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10
+    - FROMLIST: arm64: dts: qcom: qcs8300-ride: Add firmware-name in BT node
+    - PENDING: arm64: dts: qcom: qcs8300: enable DSI-DP bridge port on QCS8300
+    - PENDING: driver: bluetooth: hci_qca: fix SSR unable to wake up bug
+    - QCLINUX: arm64: deconfig: Enable QCS615 clock controllers
+    - FROMLIST: arm64: dts: qcom: Add clock nodes for multimedia clock
+    - FROMLIST: arm64: dts: qcom: Add cpu scaling clock node
+    - QCLINUX: ASoC: qcom: common: Add qcom_snd_parse_of_v2 support
+    - QCLINUX: arm64: defconfigs: Enable CONFIG_PM_DEBUG
+    - PENDING: serial: qcom-geni: Optimize qcom_geni_uart_ports and increase UART
+      ports to 5
+    - QCLINUX: firmware: qcom_tzmem: Use ns_vmid_num to set self owner bit
+    - QCLINUX: arm64: dts: qcom: sa8775p: Fix cdsp1 node properties
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add EL2 dtb support for ride board
+    - PENDING: ASoC: qcom: q6dsp: Update rates for Primary i2s rx
+    - QCLINUX: arm64: dts: Remove unused pcie1 QPS615 phy node for QEP8121
+    - PENDING: arm64: dts: qcom: qcs9075: Add displayport1 device node
+    - PENDING: serial: qcom-geni-serial: Enable support for
+    - PENDING: net: stmmac: dwmac-qcom-ethqos: Configure host DMA width for
+      SA8797P
+    - QCLINUX: arm64: dts: Replace AQR113c phy with RTL8211 phy
+    - QCLINUX: arm64: defconfig: enable Novatek NT36672E and Lontium lt9611UXC
+      configs
+    - PENDING: net: stmmac: Fix NULL pointer access for GPTP packets
+    - PENDING: arm64: dts: qcom: qcs9075: Change phy-mode to SGMII
+    - QCLINUX: ASoC: qcom: qcm6490: Use qcom_snd_parse_of_v2 to support common
+      dailink data
+    - PENDING: ASoC: qcom: qcm9100: Fix the dapm routings for qcs8300
+    - QCLINUX: duplicate msm/ to msm_default/
+    - QCLINUX: Add support to compile msm_display.ko
+    - Ubuntu: [Config] update CONFIGs for GA 1.4
+
+  [ Ubuntu: 6.8.0-56.58 ]
+
+  * noble/linux: 6.8.0-56.58 -proposed tracker (LP: #2098244)
+  * Noble update: upstream stable patchset 2024-07-19 (LP: #2073603)
+    - Revert "drm: Make drivers depends on DRM_DW_HDMI"
+    - Revert "UBUNTU: [Config] Drivers now depend on DRM_DW_HDMI"
+  * drm/amd/display: Add check for granularity in dml ceil/floor helpers
+    (LP: #2098080)
+    - drm/amd/display: Add check for granularity in dml ceil/floor helpers
+  * optimized default EPP for GNR family (LP: #2097554)
+    - cpufreq: intel_pstate: Update Balance-performance EPP for Granite Rapids
+  * Incorrect LAPIC/x2APIC parsing order (LP: #2097455)
+    - x86/acpi: Fix LAPIC/x2APIC parsing order
+  * MGLRU: page allocation failure on NUMA-enabled systems (LP: #2097214)
+    - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
+  * Upstream commit 65357e2c164a: "RDMA/mana_ib: set node_guid" applied
+    incorrectly (LP: #2096885)
+    - Revert "RDMA/mana_ib: set node_guid"
+  * AppArmor early policy load not funcitoning (LP: #2095370)
+    - SAUCE: Revert "UBUNTU: SAUCE: apparmor4.0.0 [67/90]: userns - add the
+      ability to reference a global variable for a feature value"
+  * apparmor unconfined profile blocks pivot_root (LP: #2067900)
+    - SAUCE: Revert "UBUNTU: SAUCE: apparmor4.0.0 [81/90]: apparmor: convert easy
+      uses of unconfined() to label_mediates()"
+  * CVE-2024-50117
+    - drm/amd: Guard against bad data for ATIF ACPI method
+  * CVE-2024-56582
+    - btrfs: fix use-after-free in btrfs_encoded_read_endio()
+  * CVE-2024-53165
+    - sh: intc: Fix use-after-free bug in register_intc_controller()
+  * CVE-2024-53156
+    - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
+  * CVE-2024-56663
+    - wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
+  * CVE-2024-56614
+    - xsk: fix OOB map writes when deleting elements
+  * VM boots slowly with large-BAR GPU Passthrough due to pci/probe.c redundancy
+    (LP: #2097389)
+    - PCI: Batch BAR sizing operations
+  * Noble update: upstream stable patchset 2025-02-04 (LP: #2097393)
+    - Revert "PCI/MSI: Provide stubs for IMS functions"
+    - gfs2: Revert "introduce qd_bh_get_or_undo"
+    - gfs2: qd_check_sync cleanups
+    - gfs2: Revert "ignore negated quota changes"
+    - Revert "powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2"
+    - tracing: Have saved_cmdlines arrays all in one allocation
+    - spi: spi-fsl-lpspi: remove redundant spi_controller_put call
+    - ata: ahci: Add mask_port_map module parameter
+    - ASoC: tas2781: mark dvc_tlv with __maybe_unused
+    - scsi: sd: Do not repeat the starting disk message
+    - bootconfig: Fix the kerneldoc of _xbc_exit()
+    - perf sched: Move start_work_mutex and work_done_wait_mutex initialization to
+      perf_sched__replay()
+    - perf sched: Fix memory leak in perf_sched__map()
+    - perf sched: Move curr_thread initialization to perf_sched__map()
+    - perf sched: Move curr_pid and cpu_last_switched initialization to
+      perf_sched__{lat|map|replay}()
+    - libsubcmd: Don't free the usage string
+    - selftests: Introduce Makefile variable to list shared bash scripts
+    - jbd2: fix kernel-doc for j_transaction_overhead_buffers
+    - lib/build_OID_registry: avoid non-destructive substitution for Perl < 5.13.2
+      compat
+    - drm/amd/display: Remove a redundant check in authenticated_dp
+    - drm/amd/display: Revert "Check HDCP returned status"
+    - zram: don't free statically defined names
+    - x86/amd_nb: Add new PCI IDs for AMD family 0x1a
+    - rtnetlink: change nlk->cb_mutex role
+    - rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag
+    - mpls: no longer hold RTNL in mpls_netconf_dump_devconf()
+    - phonet: no longer hold RTNL in route_dumpit()
+    - rcu/nocb: Make IRQs disablement symmetric
+    - HID: asus: add ROG Ally N-Key ID and keycodes
+    - HID: asus: add ROG Z13 lightbar
+    - hid-asus: add ROG Ally X prod ID to quirk list
+    - scsi: Revert "scsi: sd: Do not repeat the starting disk message"
+    - btrfs: fix uninitialized pointer free in add_inode_ref()
+    - btrfs: fix uninitialized pointer free on read_alloc_one_name() error
+    - ksmbd: fix user-after-free from session log off
+    - ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2
+    - mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow
+    - net: enetc: remove xdp_drops statistic from enetc_xdp_drop()
+    - net: enetc: block concurrent XDP transmissions during ring reconfiguration
+    - net: enetc: disable Tx BD rings after they are empty
+    - net: enetc: disable NAPI after all rings are disabled
+    - net: enetc: add missing static descriptor and inline keyword
+    - posix-clock: Fix missing timespec64 check in pc_clock_settime()
+    - udp: Compute L4 checksum as usual when not segmenting the skb
+    - arm64: probes: Remove broken LDR (literal) uprobe support
+    - arm64: probes: Fix simulate_ldr*_literal()
+    - arm64: probes: Fix uprobes for big-endian kernels
+    - net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-
+      link PHY
+    - net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()
+    - maple_tree: correct tree corruption on spanning store
+    - nilfs2: propagate directory read errors from nilfs_find_entry()
+    - fat: fix uninitialized variable
+    - mm/mremap: fix move_normal_pmd/retract_page_tables race
+    - mm/swapfile: skip HugeTLB pages for unuse_vma
+    - mm/damon/tests/sysfs-kunit.h: fix memory leak in
+      damon_sysfs_test_add_targets()
+    - tcp: fix mptcp DSS corruption due to large pmtu xmit
+    - net: fec: Move `fec_ptp_read()` to the top of the file
+    - net: fec: Remove duplicated code
+    - mptcp: prevent MPC handshake on port-based signal endpoints
+    - iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
+    - s390/sclp: Deactivate sclp after all its users
+    - s390/sclp_vt220: Convert newlines to CRLF instead of LFCR
+    - KVM: s390: gaccess: Check if guest address is in memslot
+    - KVM: s390: Change virtual to physical address access in diag 0x258 handler
+    - x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
+    - x86/cpufeatures: Add a IBPB_NO_RET BUG flag
+    - x86/entry: Have entry_ibpb() invalidate return predictions
+    - x86/bugs: Skip RSB fill at VMEXIT
+    - x86/bugs: Do not use UNTRAIN_RET with IBPB on entry
+    - fgraph: Use CPU hotplug mechanism to initialize idle shadow stacks
+    - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
+    - io_uring/sqpoll: close race on waiting for sqring entries
+    - blk-mq: setup queue ->tag_set before initializing hctx
+    - ublk: don't allow user copy for unprivileged device
+    - selftest: hid: add the missing tests directory
+    - Input: xpad - add support for MSI Claw A1M
+    - scsi: mpi3mr: Correct a test in mpi3mr_sas_port_add()
+    - scsi: mpi3mr: Validate SAS port assignments
+    - scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down
+    - scsi: ufs: core: Fix the issue of ICU failure
+    - scsi: ufs: core: Requeue aborted request
+    - drm/radeon: Fix encoder->possible_clones
+    - drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation
+    - drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible
+      mode
+    - drm/xe/xe_sync: initialise ufence.signalled
+    - drm/xe/ufence: ufence can be signaled right after wait_woken
+    - drm/vmwgfx: Cleanup kms setup without 3d
+    - drm/vmwgfx: Handle surface check failure correctly
+    - drm/amdgpu/pm: Fix code alignment issue
+    - drm/amdgpu/smu13: always apply the powersave optimization
+    - drm/amdgpu/swsmu: Only force workload setup on init
+    - iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig
+    - iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig
+    - iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig
+    - iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: hid-sensors: Fix an error handling path in
+      _hid_sensor_set_report_latency()
+    - iio: light: veml6030: fix ALS sensor resolution
+    - iio: light: veml6030: fix IIO device retrieval from embedded device
+    - iio: light: opt3001: add missing full-scale range value
+    - iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig
+    - iio: frequency: adf4377: add missing select REMAP_SPI in Kconfig
+    - iio: light: bu27008: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: resolver: ad2s1210 add missing select REGMAP in Kconfig
+    - iio: pressure: bm1390: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: adc: ti-lmp92064: add missing select REGMAP_SPI in Kconfig
+    - iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: resolver: ad2s1210: add missing select (TRIGGERED_)BUFFER in Kconfig
+    - iio: accel: kx022a: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - Bluetooth: Call iso_exit() on module unload
+    - Bluetooth: Remove debugfs directory on module init failure
+    - Bluetooth: ISO: Fix multiple init when debugfs is disabled
+    - Bluetooth: btusb: Fix not being able to reconnect after suspend
+    - Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
+    - vt: prevent kernel-infoleak in con_font_get()
+    - xhci: tegra: fix checked USB2 port number
+    - xhci: Fix incorrect stream context type macro
+    - xhci: Mitigate failed set dequeue pointer commands
+    - USB: serial: option: add support for Quectel EG916Q-GL
+    - USB: serial: option: add Telit FN920C04 MBIM compositions
+    - usb: typec: qcom-pmic-typec: fix sink status being overwritten with RP_DEF
+    - usb: dwc3: Wait for EndXfer completion before restoring GUSB2PHYCFG
+    - misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for EEPROM
+      device
+    - misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for OTP device
+    - serial: imx: Update mctrl old_status on RTSD interrupt
+    - parport: Proper fix for array out-of-bounds access
+    - x86/resctrl: Annotate get_mem_config() functions as __init
+    - x86/apic: Always explicitly disarm TSC-deadline timer
+    - x86/CPU/AMD: Only apply Zenbleed fix for Zen2 during late microcode load
+    - x86/entry_32: Do not clobber user EFLAGS.ZF
+    - x86/entry_32: Clear CPU buffers after register restore in NMI return
+    - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
+    - x86/bugs: Use code segment selector for VERW operand
+    - pinctrl: intel: platform: fix error path in device_for_each_child_node()
+    - pinctrl: ocelot: fix system hang on level based interrupts
+    - pinctrl: stm32: check devm_kasprintf() returned value
+    - pinctrl: apple: check devm_kasprintf() returned value
+    - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
+    - irqchip/sifive-plic: Unmask interrupt in plic_irq_enable()
+    - serial: qcom-geni: fix polled console initialisation
+    - serial: qcom-geni: revert broken hibernation support
+    - serial: qcom-geni: fix shutdown race
+    - serial: qcom-geni: fix dma rx cancellation
+    - serial: qcom-geni: fix receiver enable
+    - mm: vmscan.c: fix OOM on swap stress test
+    - ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne
+      1000 G2
+    - Upstream stable to v6.6.57, v6.11.5
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301)
+    - Revert "perf callchain: Fix stitch LBR memory leaks"
+    - ASoC: amd: acp: add ZSC control register programming sequence
+    - virtio: rename virtio_config_enabled to virtio_config_core_enabled
+    - virtio: allow driver to disable the configure change notification
+    - virtio-net: synchronize operstate with admin state on up/down
+    - virtio-net: synchronize probe with ndo_set_features
+    - wifi: rtw89: limit the PPDU length for VHT rate to 0x40000
+    - af_unix: Don't call skb_get() for OOB skb.
+    - af_unix: Remove single nest in manage_oob().
+    - af_unix: Rename unlinked_skb in manage_oob().
+    - af_unix: Move spin_lock() in manage_oob().
+    - iommu/amd: Move allocation of the top table into v1_alloc_pgtable
+    - iommu/amd: Set the pgsize_bitmap correctly
+    - drm/xe: Move and export xe_hw_engine lookup.
+    - drm/msm/dp: rename wide_bus_en to wide_bus_supported
+    - drm/msm/dp: enable widebus on all relevant chipsets
+    - bpf, arm64: Fix tailcall hierarchy
+    - libbpf: Don't take direct pointers into BTF data from st_ops
+    - s390/entry: Move early program check handler to entry.S
+    - selftests/bpf: fix to avoid __msg tag de-duplication by clang
+    - libbpf: Ensure new BTF objects inherit input endianness
+    - PCI: dwc: ep: Rename dw_pcie_ep_exit() to dw_pcie_ep_deinit()
+    - PCI: qcom-ep: Enable controller resources like PHY only after refclk is
+      available
+    - net: ravb: Fix maximum TX frame size for GbEth devices
+    - ravb: Make it clear the information relates to maximum frame size
+    - net: ravb: Fix R-Car RX frame size limit
+    - netfilter: nf_tables: missing objects with no memcg accounting
+    - PCI: dra7xx: Fix error handling when IRQ request fails in probe
+    - KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)
+    - intel_idle: fix ACPI _CST matching for newer Xeon platforms
+    - wifi: mt76: mt7925: fix a potential association failure upon resuming
+    - cifs: Remove intermediate object of failed create reparse call
+    - drm/amd/display: Disable replay if VRR capability is false
+    - drm/amd/display: Fix VRR cannot enable
+    - l2tp: free sessions using rcu
+    - net: skbuff: sprinkle more __GFP_NOWARN on ingress allocs
+    - nvme: fix metadata handling in nvme-passthrough
+    - wifi: wilc1000: Do not operate uninitialized hardware during suspend/resume
+    - x86/apic: Remove logical destination mode for 64-bit
+    - pmdomain: core: Use dev_name() instead of kobject_get_path() in debugfs
+    - drm/xe: Name and document Wa_14019789679
+    - drm/xe: Add timeout to preempt fences
+    - drm/amd/display: Fix possible overflow in integer multiplication
+    - ext4: fix error message when rejecting the default hash
+    - power: supply: Drop use_cnt check from power_supply_property_is_writeable()
+    - ALSA: hda/realtek: fix mute/micmute LED for HP mt645 G8
+    - drm/xe: Generate oob before compiling anything
+    - clk: qcom: gcc-sc8180x: Register QUPv3 RCGs for DFS on sc8180x
+    - drm/amd/display: Restore Optimized pbn Value if Failed to Disable DSC
+    - Revert "drm/amd/display: Skip Recompute DSC Params if no Stream on Link"
+    - pmdomain: core: Reduce debug summary table width
+    - fs/ntfs3: Do not call file_modified if collapse range failed
+    - fs/ntfs3: Optimize large writes into sparse file
+    - fs/ntfs3: Fix sparse warning in ni_fiemap
+    - fs/ntfs3: Refactor enum_rstbl to suppress static checker
+    - virtio_console: fix misc probe bugs
+    - ntfs3: Change to non-blocking allocation in ntfs_d_hash
+    - bpf: Call the missed btf_record_free() when map creation fails
+    - selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
+    - bpf: Check percpu map value size first
+    - s390/facility: Disable compile time optimization for decompressor code
+    - s390/mm: Add cond_resched() to cmm_alloc/free_pages()
+    - bpf, x64: Fix a jit convergence issue
+    - ext4: nested locking for xattr inode
+    - s390/cpum_sf: Remove WARN_ON_ONCE statements
+    - ktest.pl: Avoid false positives with grub2 skip regex
+    - soundwire: intel_bus_common: enable interrupts before exiting reset
+    - PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
+    - clk: bcm: bcm53573: fix OF node leak in init
+    - PCI: Add ACS quirk for Qualcomm SA8775P
+    - i2c: i801: Use a different adapter-name for IDF adapters
+    - PCI: Mark Creative Labs EMU20k2 INTx masking as broken
+    - RISC-V: Don't have MAX_PHYSMEM_BITS exceed phys_addr_t
+    - mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less strict
+    - mfd: intel-lpss: Add Intel Arrow Lake-H LPSS PCI IDs
+    - mfd: intel-lpss: Rename SPI intel_lpss_platform_info structs
+    - mfd: intel-lpss: Add Intel Panther Lake LPSS PCI IDs
+    - riscv: Omit optimized string routines when using KASAN
+    - riscv: avoid Imbalance in RAS
+    - RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
+    - PCI: qcom: Disable mirroring of DBI and iATU register space in BAR region
+    - PCI: endpoint: Assign PCI domain number for endpoint controllers
+    - soundwire: cadence: re-check Peripheral status with delayed_work
+    - riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16
+      unknown
+    - media: videobuf2-core: clear memory related fields in
+      __vb2_plane_dmabuf_put()
+    - remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
+    - usb: chipidea: udc: enable suspend interrupt after usb reset
+    - usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the
+      Crashkernel Scenario
+    - xhci: dbc: Fix STALL transfer event handling
+    - usb: host: xhci-plat: Parse xhci-missing_cas_quirk and apply quirk
+    - comedi: ni_routing: tools: Check when the file could not be opened
+    - LoongArch: Fix memleak in pci_acpi_scan_root()
+    - netfilter: nf_nat: don't try nat source port reallocation for reverse dir
+      clash
+    - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
+    - tools/iio: Add memory allocation failure check for trigger_name
+    - staging: vme_user: added bound check to geoid
+    - driver core: bus: Return -EIO instead of 0 when show/store invalid bus
+      attribute
+    - scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in
+      lpfc_els_flush_cmd()
+    - scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR to
+      KERN_WARNING
+    - NFSD: Mark filecache "down" if init fails
+    - nfsd: nfsd_destroy_serv() must call svc_destroy() even if nfsd_startup_net()
+      failed
+    - ice: set correct dst VSI in only LAN filters
+    - ice: clear port vlan config during reset
+    - ice: disallow DPLL_PIN_STATE_SELECTABLE for dpll output pins
+    - ice: fix VLAN replay after reset
+    - SUNRPC: Fix integer overflow in decode_rc_list()
+    - tcp: fix to allow timestamp undo if no retransmits were sent
+    - tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
+    - tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out
+    - rxrpc: Fix uninitialised variable in rxrpc_send_data()
+    - selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids()
+      test
+    - Bluetooth: btusb: Don't fail external suspend requests
+    - net: phy: bcm84881: Fix some error handling paths
+    - Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
+    - net: ethernet: adi: adin1110: Fix some error handling path in
+      adin1110_read_fifo()
+    - net: dsa: b53: fix jumbo frame mtu check
+    - net: dsa: b53: fix max MTU for 1g switches
+    - net: dsa: b53: fix max MTU for BCM5325/BCM5365
+    - net: dsa: b53: allow lower MTUs on BCM5325/5365
+    - net: dsa: b53: fix jumbo frames on 10/100 ports
+    - drm/nouveau: pass cli to nouveau_channel_new() instead of drm+device
+    - nouveau/dmem: Fix privileged error in copy engine channel
+    - gpio: aspeed: Add the flush write to ensure the write complete.
+    - gpio: aspeed: Use devm_clk api to manage clock source
+    - powercap: intel_rapl_tpmi: Ignore minor version change
+    - ice: Fix netif_is_ice() in Safe Mode
+    - ice: Flush FDB entries before reset
+    - e1000e: change I219 (19) devices to ADP
+    - net: ibm: emac: mal: fix wrong goto
+    - btrfs: zoned: fix missing RCU locking in error message when loading zone
+      info
+    - sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
+    - netfilter: fib: check correct rtable in vrf setups
+    - net: ibm: emac: mal: add dcr_unmap to _remove
+    - net: dsa: refuse cross-chip mirroring operations
+    - rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
+    - vxlan: Handle error of rtnl_register_module().
+    - bridge: Handle error of rtnl_register_module().
+    - mctp: Handle error of rtnl_register_module().
+    - mpls: Handle error of rtnl_register_module().
+    - phonet: Handle error of rtnl_register_module().
+    - rcu/nocb: Fix rcuog wake-up from offline softirq
+    - x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h
+    - HID: multitouch: Add support for lenovo Y9000P Touchpad
+    - hwmon: intel-m10-bmc-hwmon: relabel Columbiaville to CVL Die Temperature
+    - hwmon: (tmp513) Add missing dependency on REGMAP_I2C
+    - hwmon: (mc34vr500) Add missing dependency on REGMAP_I2C
+    - hwmon: (adm9240) Add missing dependency on REGMAP_I2C
+    - hwmon: (adt7470) Add missing dependency on REGMAP_I2C
+    - hwmon: (ltc2991) Add missing dependency on REGMAP_I2C
+    - HID: plantronics: Workaround for an unexcepted opposite volume key
+    - Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
+    - usb: dwc3: core: Stop processing of pending events if controller is halted
+    - usb: xhci: Fix problem with xhci resume from suspend
+    - usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
+    - usb: dwc3: re-enable runtime PM after failed resume
+    - usb: gadget: core: force synchronous registration
+    - hid: intel-ish-hid: Fix uninitialized variable 'rv' in
+      ish_fw_xfer_direct_dma
+    - ACPI: resource: Make Asus ExpertBook B2402 matches cover more models
+    - ACPI: resource: Make Asus ExpertBook B2502 matches cover more models
+    - drm/amdkfd: Fix an eviction fence leak
+    - drm/amd/display: fix hibernate entry for DCN35+
+    - drm/xe/guc_submit: fix xa_store() error checking
+    - drm/i915/hdcp: fix connector refcounting
+    - drm/xe/ct: fix xa_store() error checking
+    - scsi: ufs: Use pre-calculated offsets in ufshcd_init_lrb()
+    - mmc: sdhci-of-dwcmshc: Prevent stale command interrupt handling
+    - mptcp: fallback when MPTCP opts are dropped after 1st data
+    - ata: libata: avoid superfluous disk spin down + spin up during hibernation
+    - OPP: fix error code in dev_pm_opp_set_config()
+    - net: dsa: lan9303: ensure chip reset and wait for READY status
+    - mptcp: pm: do not remove closing subflows
+    - powercap: intel_rapl_tpmi: Fix bogus register reading
+    - selftests/mm: fix incorrect buffer->mirror size in hmm2 double_map test
+    - selftests/rseq: Fix mm_cid test failure
+    - btrfs: split remaining space to discard in chunks
+    - btrfs: add cancellation points to trim loops
+    - fs/proc/kcore.c: allow translation of physical memory addresses
+    - io_uring/rw: fix cflags posting for single issue multishot read
+    - Upstream stable to v6.6.56, v6.11.1, v6.11.2, v6.11.3, v6.11.4
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50182
+    - secretmem: disable memfd_secret() if arch cannot set direct map
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50019
+    - kthread: unpark only parked kthread
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50096
+    - nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50020
+    - ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50021
+    - ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50022
+    - device-dax: correct pgoff align in dax_set_mapping()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50185
+    - mptcp: handle consistently DSS corruption
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50023
+    - net: phy: Remove LED entry from LEDs list on unregister
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50024
+    - net: Fix an unsafe loop on the list
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50186
+    - net: explicitly clear the sk pointer, when pf->create fails
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50025
+    - scsi: fnic: Move flush_work initialization out of if block
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50026
+    - scsi: wd33c93: Don't use stale scsi_pointer value
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50027
+    - thermal: core: Free tzp copy along with the thermal zone
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50028
+    - thermal: core: Reference count the zone in thermal_zone_get_by_id()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50029
+    - Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50030
+    - drm/xe/ct: prevent UAF in send_recv()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50187
+    - drm/vc4: Stop the active perfmon before being destroyed
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50031
+    - drm/v3d: Stop the active perfmon before being destroyed
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50189
+    - HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50033
+    - slip: make slhc_remember() more robust against malicious packets
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50035
+    - ppp: fix ppp_async_encode() illegal access
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50036
+    - net: do not delay dst_entries_add() in dst_release()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50038
+    - netfilter: xtables: avoid NFPROTO_UNSPEC where needed
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50039
+    - net/sched: accept TCA_STAB only for root qdisc
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50040
+    - igb: Do not bring the device up after non-fatal error
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50041
+    - i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50042
+    - ice: Fix increasing MSI-X on VF
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50093
+    - thermal: intel: int340x: processor: Fix warning during module unload
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50044
+    - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50045
+    - netfilter: br_netfilter: fix panic with metadata_dst skb
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50188
+    - net: phy: dp83869: fix memory corruption when enabling fiber
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50046
+    - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50180
+    - fbdev: sisfb: Fix strbuf array overflow
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50047
+    - smb: client: fix UAF in async decryption
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50048
+    - fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50049
+    - drm/amd/display: Check null pointer before dereferencing se
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50090
+    - drm/xe/oa: Fix overflow in oa batch buffer
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50183
+    - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV
+      instance
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50055
+    - driver core: bus: Fix double free in driver API bus_register()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50056
+    - usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50184
+    - virtio_pmem: Check device status before requesting flush
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50057
+    - usb: typec: tipd: Free IRQ only if it was requested before
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50058
+    - serial: protect uart_port_dtr_rts() in uart_shutdown() too
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50181
+    - clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50059
+    - ntb: ntb_hw_switchtec: Fix use after free vulnerability in
+      switchtec_ntb_remove due to race condition
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50060
+    - io_uring: check if we need to reschedule during overflow flush
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50061
+    - i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master
+      Driver Due to Race Condition
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50062
+    - RDMA/rtrs-srv: Avoid null pointer deref during path establishment
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50095
+    - RDMA/mad: Improve handling of timed out WRs of mad agent
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50063
+    - bpf: Prevent tail call between progs attached to different hooks
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50191
+    - ext4: don't set SB_RDONLY after filesystem errors
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50064
+    - zram: free secondary algorithms names
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50089
+    - unicode: Don't special case ignorable code points
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49865
+    - drm/xe/vm: move xa_alloc to prevent UAF
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49968
+    - ext4: filesystems without casefold feature cannot be mounted with siphash
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49893
+    - drm/amd/display: Check stream_status before it is used
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49972
+    - drm/amd/display: Deallocate DML memory if allocation fails
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49914
+    - drm/amd/display: Add null check for pipe_ctx->plane_state in
+      dcn20_program_pipe
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49920
+    - drm/amd/display: Check null pointers before multiple uses
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49921
+    - drm/amd/display: Check null pointers before used
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50009
+    - cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-47726
+    - f2fs: fix to wait dio completion
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-47711
+    - af_unix: Don't return OOB skb in manage_oob().
+  * CVE-2024-53170
+    - block: fix uaf for flush rq while iterating tags
+  * CVE-2024-50148
+    - Bluetooth: bnep: fix wild-memory-access in proto_unregister
+  * CVE-2024-50134
+    - drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real
+      VLA
+  * CVE-2024-50171
+    - net: systemport: fix potential memory leak in bcm_sysport_xmit()
+  * CVE-2024-50229
+    - nilfs2: fix potential deadlock with newly created symlinks
+  * CVE-2024-50233
+    - staging: iio: frequency: ad9832: fix division by zero in
+      ad9832_calc_freqreg()
+  * [Lenovo Ubuntu 24.04 Bug] dmesg show "spi-nor: probe of spi0.0 failed with
+    error -95" (LP: #2070339)
+    - mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported
+    - mtd: core: Align comment with an action in mtd_otp_nvmem_add()
+  * python perf module missing in realtime kernel (LP: #2089411)
+    - [Packaging] linux-tools: Add missing python perf symlink
+    - [Packaging] linux-tools: Fix python perf library packaging
+    - [Packaging] linux-tools: Fall back to old python perf path
+  * CVE-2024-53104
+    - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in
+      uvc_parse_format
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 31 Mar 2025 03:30:47 +0900
+
+linux-qcom (6.8.0-1035.35) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1034.34 -proposed tracker (LP: #2103614)
+
+  * [RB8] iris_vpu module crashes the kernel
+    - Ubuntu: [Config] enable CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT
+
+  * Miscellaneous upstream changes
+    - kgsl: Add support for using compatible string "qcom,kgsl"
+    - ARM: dts: msm: Don't allow drm driver probe kgsl nodes
+    - QCLINUX: drm/msm: Remove changes made to prevent gpu probe
+    - FROMLIST: arm64: dts: qcom: sa8775p: Add gpu and gmu nodes
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Don't disable drm gpu/gmu nodes
+    - BACKPORT: arm64: dts: qcom: sc7280: don't enable GPU on unsupported devices
+    - QCLINUX: arm64: deconfig: enable CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT
+    - QCLINUX: Add support to compile msm_display.ko
+    - Ubuntu: [Config] enable CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 19 Mar 2025 23:02:25 +0900
+
+linux-qcom (6.8.0-1033.33) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1033.33 -proposed tracker (LP: #2101706)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: arm64: dts: disable iris_vpu on RB8 board for now
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Sun, 09 Mar 2025 13:41:59 +0900
+
+linux-qcom (6.8.0-1032.32) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1032.32 -proposed tracker (LP: #2100991)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: build camera drivers for qcm6490/qcs9100 separately
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy() (take 2)
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+      (take 2)
+    - SAUCE: ubuntu/qcom/camera: remove camera_banner
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: hack modpost to allow multiple exports
+    - SAUCE: fix phy-mode for RB8 board
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 06 Mar 2025 11:34:29 +0900
+
+linux-qcom (6.8.0-1031.31) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1031.31 -proposed tracker (LP: #2099991)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: add qcs9075-addons-rb8-ovl.dtb
+
+  * Miscellaneous upstream changes
+    - PENDING: arm64: dts: qcom: qcs9075: Enable ethernet on QCS9075 RB8
+    - video: driver: fix life cycle of a buffer shared across multiple clients
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 25 Feb 2025 23:33:35 +0900
+
+linux-qcom (6.8.0-1030.30) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1030.30 -proposed tracker (LP: #2098733)
+
+  * "[RB3] tc956x_pci-eth errors found in dmesg"
+    - SAUCE: ubuntu/qcom/qps615: suppress false alerts
+    - SAUCE: ubuntu/qcom/qps615: use INFO level for logging
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import external DT from GA 1.3.1
+    - SAUCE: Add Makefile code to apply overlays for GA1.2
+    - SAUCE: ubuntu/qcom/graphics: import qcm6490 graphics driver code from
+      GA1.3.1
+    - SAUCE: ubuntu/qcom/camera: import qcm6490 camera driver code from GA1.3.1
+    - SAUCE: ubuntu/qcom/qps615: import ethernet driver from GA1.3.1
+    - SAUCE: ubuntu/qcom/video: import video driver from GA 1.3.1
+    - SAUCE: ubuntu/qcom: build external drivers
+    - SAUCE: ubuntu/qcom/camera: fix build warnings and errors
+    - SAUCE: rename qcom,phy-rst-gpio to qcom,phy-rst-gpio-id
+    - SAUCE: suppress unneeded build logs
+    - SAUCE: ubuntu/qcom: suppress Wno-enum-int-mismatch warning
+    - SAUCE: ubuntu/qcom/graphics: change strtobool() to kstrtobool()
+    - SAUCE: ubuntu/qcom/graphics: dynamically allocate the kgsl-pool shrinker for
+      kernel>=6.7
+    - SAUCE: ubuntu/qcom/camera: remove unused camera_banner
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/video: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: auto-load module
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: disable downstream display driver
+    - [Config] update config options for GA 1.3.2
+    - SAUCE: import external DT from GA 1.3.2
+    - SAUCE: merge two msm-camera.h
+    - [Packaging] update contents of linux-libc-dev-qcom package
+
+  * Miscellaneous upstream changes
+    - PENDING: arm64: dts: qcom: sa8255p-ride: Disable aoss_qmp
+    - FROMLIST: clk: qcom: Update the support for alpha mode configuration
+    - FROMLIST: clk: qcom: clk-alpha-pll: Add support for dynamic update for
+      slewing PLLs
+    - FROMLIST: phy: qcom: qmp-usbc: Add qmp configuration for QCS615
+    - FROMLIST: mmc: sdhci-msm: Enable MMC_CAP_AGGRESSIVE_PM for qualcomm
+      controllers
+    - QCLINUX: arm64: defconfig: Enable Ftrace for Gen5 Auto targets
+    - FROMLIST: net: stmmac: dwmac-qcom-ethqos: add support for EMAC on qcs615
+      platforms
+    - FROMLIST: arm64: dts: qcom: qcs615: add ethernet node
+    - FROMLIST: arm64: dts: qcom: qcs615-ride: Enable ethernet node
+    - FROMLIST: net: stmmac: qcom-ethqos: Enable RX programmable swap on qcs615
+    - FROMLIST: arm64: dts: qcom: qcs615-ride: Enable RX programmable swap on
+      qcs615-ride
+    - PENDING: net: stmmac: Create new mdio for every emac instance
+    - PENDING: arm64: dts: qcom: Add coresight nodes for QCS615
+    - PENDING: media: qcom: camss: Add support for camss driver on sa8775p
+    - PENDING: arm64: dts: qcom: sa8775p: Add support for camss
+    - PENDING: add TPG driver on camss for sa8775p
+    - QCLINUX: arm64: defconfig: Enable GS_USB
+    - QCLINUX: firmware: qcom_scm: Set SHE scm to atomic
+    - PENDING: ptp: qcom: Add support for Time Stamp Counter(TSC) driver
+    - PENDING: ptp: ptp_qcom_tsc: Add nsecs support for adjtime
+    - QCLINUX: arm64: dts: qcom: add lpi-quad mi2s/tdm dai for qcs9075-rb8
+    - PENDING: clk: qcom: videocc-sa8775p: Add HW_CTRL for video_cc_mvs0_gdsc
+    - QCLINUX: arm64: qcs9075-rb8: disable uart bt en pin in DTS
+    - FROMGIT: arm64: dts: qcom: sa8775p: Disable USB U1/U2 entry
+    - QCLINUX: arm64: defconfig: Enable MHI driver for Gen5auto targets
+    - QCLINUX: arm64: dts: qcom: add support for GPIO expander on rb8 board
+    - PENDING: net: PCS: Fix USXGMII reset sequence to poll for proper bit
+    - PENDING: drm/msm/dpu: remove duplicate formats from wb_formats list
+    - BACKPORT: UPSTREAM: phy: add NXP PTN3222 eUSB2 to USB2 redriver
+    - QCLINUX: ASoC: qcom: qdsp6: Increase the timeout to 20 secs
+    - Revert "PENDING: arm64: dts: qcom: qcs9075: Update memory map for qcs9075"
+    - PENDING: arm64: dts: qcom: qcs9xxx: Update memory map for qcs9xxx boards
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 18 Feb 2025 17:04:47 +0900
+
+linux-qcom (6.8.0-1029.29) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1028.28 -proposed tracker (LP: #2098058)
+
+  * Add list of source files to linux-buildinfo (LP: #2086606)
+    - [Packaging] Add list of used source files to buildinfo package
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: disable downstream display driver
+
+  * Miscellaneous upstream changes
+    - kernel: Enable upstream display on qcm6490 rgb3gen2
+
+  [ Ubuntu: 6.8.0-54.56 ]
+
+  * CVE-2025-0927
+    - SAUCE: fs: hfs/hfsplus: add key_len boundary check to hfs_bnode_read_key
+
+  [ Ubuntu: 6.8.0-53.55 ]
+
+  * noble/linux: 6.8.0-53.55 -proposed tracker (LP: #2093677)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2025.01.13)
+  * generate and ship vmlinux.h to allow packages to build BPF CO-RE
+    (LP: #2050083)
+    - [Packaging] add linux-bpf-dev package
+    - [Packaging] do not attempt to generate BTF header on armhf
+  * Unable to boot as a guest on VMware ESX (LP: #2091941)
+    - ptp/vmware: Use VMware hypercall API
+    - input/vmmouse: Use VMware hypercall API
+    - drm/vmwgfx: Use VMware hypercall API
+    - x86/vmware: Use VMware hypercall API
+    - x86/vmware: Correct macro names
+    - x86/vmware: Remove legacy VMWARE_HYPERCALL* macros
+  * When /dev/vmbus/hv_kvp is not present, disable hv-kvp-daemon (LP: #2091744)
+    - [Packaging] disable hv-kvp-daemon if needed
+  * Backport "netkit: Add option for scrubbing skb meta data" to 6.8
+    (LP: #2091184)
+    - netkit: Add option for scrubbing skb meta data
+  * KVM: Cache CPUID at KVM.ko module init to reduce latency of VM-Enter and VM-
+    Exit (LP: #2093146)
+    - KVM: x86: Cache CPUID.0xD XSTATE offsets+sizes during module init
+  * [SRU] add support of QCA BT 0489:e0fc (LP: #2085406)
+    - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x
+  * ice driver RTNL assertion failed warning on shutdown/reboot (LP: #2091107)
+    - ice: Remove and readd netdev during devlink reload
+  * vfio_pci soft lockup on VM start while using PCIe passthrough (LP: #2089306)
+    - SAUCE: Revert "vfio/pci: Insert full vma on mmap'd MMIO fault"
+    - SAUCE: Revert "vfio/pci: Use unmap_mapping_range()"
+  * [SRU] Fix error of resume on rtl8168fp (LP: #2087507)
+    - r8169: avoid unsolicited interrupts
+  * [SRU] power: intel_pstate: HWP interrupt support for maximum ratio changed
+    (LP: #2090852)
+    - x86/cpufeatures: Add HWP highest perf change feature flag
+    - cpufreq: intel_pstate: Support highest performance change interrupt
+  * Noble update: upstream stable patchset 2024-11-29 (LP: #2089884)
+    - static_call: Handle module init failure correctly in
+      static_call_del_module()
+    - static_call: Replace pointless WARN_ON() in static_call_module_notify()
+    - jump_label: Simplify and clarify static_key_fast_inc_cpus_locked()
+    - jump_label: Fix static_key_slow_dec() yet again
+    - scsi: st: Fix input/output error on empty drive reset
+    - scsi: pm8001: Do not overwrite PCI queue mapping
+    - drm/amdgpu: Fix get each xcp macro
+    - mailbox: rockchip: fix a typo in module autoloading
+    - mailbox: bcm2835: Fix timeout during suspend mode
+    - ceph: remove the incorrect Fw reference check when dirtying pages
+    - ieee802154: Fix build error
+    - net: sparx5: Fix invalid timestamps
+    - net/mlx5: Fix error path in multi-packet WQE transmit
+    - net/mlx5: Added cond_resched() to crdump collection
+    - net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
+    - net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
+    - netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
+    - net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
+    - net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
+    - selftests: netfilter: Fix nft_audit.sh for newer nft binaries
+    - netfilter: nf_tables: prevent nf_skb_duplicated corruption
+    - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
+    - Bluetooth: MGMT: Fix possible deadlocks
+    - Bluetooth: L2CAP: Fix uaf in l2cap_connect
+    - Bluetooth: hci_core: Fix calling mgmt_device_connected
+    - Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
+    - net: Add netif_get_gro_max_size helper for GRO
+    - net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_size
+    - net: ethernet: lantiq_etop: fix memory disclosure
+    - net: fec: Restart PPS after link state change
+    - net: fec: Reload PTP registers after link-state change
+    - net: avoid potential underflow in qdisc_pkt_len_init() with UFO
+    - net: add more sanity checks to qdisc_pkt_len_init()
+    - net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
+    - ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
+    - net: test for not too small csum_start in virtio_net_hdr_to_skb()
+    - ppp: do not assume bh is held in ppp_channel_bridge_input()
+    - iomap: constrain the file range passed to iomap_file_unshare
+    - dt-bindings: net: xlnx,axi-ethernet: Add missing reg minItems
+    - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
+    - i2c: xiic: improve error message when transfer fails to start
+    - i2c: xiic: Try re-initialization on bus busy timeout
+    - loop: don't set QUEUE_FLAG_NOMERGES
+    - ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is
+      uninitialized
+    - ALSA: mixer_oss: Remove some incorrect kfree_const() usages
+    - ALSA: hda/realtek: Fix the push button function for the ALC257
+    - ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
+    - ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
+    - cifs: Fix buffer overflow when parsing NFS reparse points
+    - cifs: Do not convert delimiter when parsing NFS-style symlinks
+    - ALSA: gus: Fix some error handling paths related to get_bpos() usage
+    - ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
+    - wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
+    - wifi: rtw89: avoid to add interface to list twice when SER
+    - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
+    - crypto: x86/sha256 - Add parentheses around macros' single arguments
+    - crypto: octeontx - Fix authenc setkey
+    - crypto: octeontx2 - Fix authenc setkey
+    - ice: Adjust over allocation of memory in ice_sched_add_root_node() and
+      ice_sched_add_node()
+    - wifi: iwlwifi: mvm: Fix a race in scan abort flow
+    - wifi: iwlwifi: mvm: drop wrong STA selection in TX
+    - wifi: cfg80211: Set correct chandef when starting CAC
+    - net/xen-netback: prevent UAF in xenvif_flush_hash()
+    - net: hisilicon: hip04: fix OF node leak in probe()
+    - net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
+    - net: hisilicon: hns_mdio: fix OF node leak in probe()
+    - ACPI: PAD: fix crash in exit_round_robin()
+    - ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
+    - ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
+    - e1000e: avoid failing the system during pm_suspend
+    - wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
+    - net: sched: consistently use rcu_replace_pointer() in taprio_change()
+    - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
+    - Bluetooth: btrtl: Set msft ext address filter quirk for RTL8852B
+    - ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
+    - ACPI: CPPC: Add support for setting EPP register in FFH
+    - blk_iocost: fix more out of bound shifts
+    - wifi: ath12k: fix array out-of-bound access in SoC stats
+    - wifi: ath11k: fix array out-of-bound access in SoC stats
+    - wifi: rtw88: select WANT_DEV_COREDUMP
+    - ACPI: EC: Do not release locks during operation region accesses
+    - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in
+      acpi_db_convert_to_package()
+    - tipc: guard against string buffer overrun
+    - net: mvpp2: Increase size of queue_name buffer
+    - bnxt_en: Extend maximum length of version string by 1 byte
+    - ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
+    - wifi: rtw89: correct base HT rate mask for firmware
+    - ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
+    - net: atlantic: Avoid warning about potential string truncation
+    - crypto: simd - Do not call crypto_alloc_tfm during registration
+    - netpoll: Ensure clean state on setup failures
+    - tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
+    - wifi: iwlwifi: mvm: use correct key iteration
+    - wifi: iwlwifi: mvm: avoid NULL pointer dereference
+    - ACPICA: iasl: handle empty connection_node
+    - proc: add config & param to block forcing mem writes
+    - [Config] updateconfigs to select PROC_MEM_ALWAYS_FORCE
+    - drivers/perf: arm_spe: Use perf_allow_kernel() for permissions
+    - can: netlink: avoid call to do_set_data_bittiming callback with stale
+      can_priv::ctrlmode
+    - wifi: mt76: mt7915: add dummy HW offload of IEEE 802.11 fragmentation
+    - wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
+    - wifi: mwifiex: Fix memcpy() field-spanning write warning in
+      mwifiex_cmd_802_11_scan_ext()
+    - nfp: Use IRQF_NO_AUTOEN flag in request_irq()
+    - ALSA: usb-audio: Add input value sanity checks for standard types
+    - x86/ioapic: Handle allocation failures gracefully
+    - ALSA: usb-audio: Define macros for quirk table entries
+    - ALSA: usb-audio: Replace complex quirk lines with macros
+    - ALSA: usb-audio: Add logitech Audio profile quirk
+    - ASoC: codecs: wsa883x: Handle reading version failure
+    - tools/x86/kcpuid: Protect against faulty "max subleaf" values
+    - x86/pkeys: Add PKRU as a parameter in signal handling functions
+    - x86/pkeys: Restore altstack access in sigreturn()
+    - x86/kexec: Add EFI config table identity mapping for kexec kernel
+    - ALSA: asihpi: Fix potential OOB array access
+    - ALSA: hdsp: Break infinite MIDI input flush loop
+    - tools/nolibc: powerpc: limit stack-protector workaround to GCC
+    - selftests/nolibc: avoid passing NULL to printf("%s")
+    - x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
+    - hwmon: (nct6775) add G15CF to ASUS WMI monitoring list
+    - fbdev: efifb: Register sysfs groups through driver core
+    - fbdev: pxafb: Fix possible use after free in pxafb_task()
+    - rcuscale: Provide clear error when async specified without primitives
+    - power: reset: brcmstb: Do not go into infinite loop if reset fails
+    - iommu/vt-d: Always reserve a domain ID for identity setup
+    - iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
+    - drm/stm: Avoid use-after-free issues with crtc and plane
+    - drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
+    - drm/amdgpu: prevent BO_HANDLES error from being overwritten
+    - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
+    - drm/amd/display: Add null check for top_pipe_to_program in
+      commit_planes_for_stream
+    - ata: pata_serverworks: Do not use the term blacklist
+    - ata: sata_sil: Rename sil_blacklist to sil_quirks
+    - HID: Ignore battery for all ELAN I2C-HID devices
+    - drm/amd/display: Handle null 'stream_status' in
+      'planes_changed_for_existing_stream'
+    - drm/amd/display: Check null pointers before using dc->clk_mgr
+    - drm/amd/display: Add null check for 'afb' in
+      amdgpu_dm_plane_handle_cursor_update (v2)
+    - drm/amd/display: fix double free issue during amdgpu module unload
+    - jfs: UBSAN: shift-out-of-bounds in dbFindBits
+    - jfs: Fix uaf in dbFreeBits
+    - jfs: check if leafidx greater than num leaves per dmap tree
+    - scsi: smartpqi: correct stream detection
+    - drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
+    - jfs: Fix uninit-value access of new_ea in ea_buffer
+    - drm/amdgpu: add raven1 gfxoff quirk
+    - drm/amdgpu: enable gfxoff quirk on HP 705G4
+    - drm/amdkfd: Fix resource leak in criu restore queue
+    - HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
+    - platform/x86: touchscreen_dmi: add nanote-next quirk
+    - drm/stm: ltdc: reset plane transparency after plane disable
+    - drm/amd/display: Check stream before comparing them
+    - drm/amd/display: Check link_res->hpo_dp_link_enc before using it
+    - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format
+      translation
+    - drm/amd/display: Fix index out of bounds in degamma hardware format
+      translation
+    - drm/amd/display: Fix index out of bounds in DCN30 color transformation
+    - drm/amd/display: Avoid overflow assignment in link_dp_cts
+    - drm/amd/display: Initialize get_bytes_per_element's default to 1
+    - drm/printer: Allow NULL data in devcoredump printer
+    - perf,x86: avoid missing caller address in stack traces captured in uprobe
+    - scsi: lpfc: Update PRLO handling in direct attached topology
+    - drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
+    - perf: Fix event_function_call() locking
+    - scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
+    - drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
+    - drm/amdgpu: Block MMR_READ IOCTL in reset
+    - drm/amdgpu/gfx9: use rlc safe mode for soft recovery
+    - drm/amd/pm: ensure the fw_info is not null before using it
+    - of/irq: Refer to actual buffer size in of_irq_parse_one()
+    - powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
+    - drm/amdgpu/gfx11: use rlc safe mode for soft recovery
+    - drm/amdgpu/gfx10: use rlc safe mode for soft recovery
+    - platform/x86: lenovo-ymc: Ignore the 0x0 state
+    - ksmbd: add refcnt to ksmbd_conn struct
+    - ksmbd: fix use-after-free in SMB request handling
+    - bpf: Make the pointer returned by iter next method valid
+    - ext4: ext4_search_dir should return a proper error
+    - ext4: avoid use-after-free in ext4_ext_show_leaf()
+    - ext4: fix i_data_sem unlock order in ext4_ind_migrate()
+    - bpftool: Fix undefined behavior caused by shifting into the sign bit
+    - iomap: handle a post-direct I/O invalidate race in
+      iomap_write_delalloc_release
+    - bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
+    - spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - spi: spi-cadence: Fix missing spi_controller_is_target() check
+    - selftest: hid: add missing run-hid-tools-tests.sh
+    - spi: s3c64xx: fix timeout counters in flush_fifo
+    - selftests: breakpoints: use remaining time to check if suspend succeed
+    - accel/ivpu: Add missing MODULE_FIRMWARE metadata
+    - spi: rpc-if: Add missing MODULE_DEVICE_TABLE
+    - perf: Really fix event_function_call() locking
+    - selftests: vDSO: fix vDSO name for powerpc
+    - selftests: vDSO: fix vdso_config for powerpc
+    - selftests: vDSO: fix vDSO symbols lookup for powerpc64
+    - powerpc/vdso: Flag VDSO64 entry points as functions
+    - selftests/mm: fix charge_reserved_hugetlb.sh test
+    - powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
+    - selftests: vDSO: fix ELF hash table entry size for s390x
+    - selftests: vDSO: fix vdso_config for s390
+    - Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
+    - platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
+    - i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
+    - i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
+    - i2c: xiic: Wait for TX empty to avoid missed TX NAKs
+    - media: i2c: ar0521: Use cansleep version of gpiod_set_value()
+    - i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - i2c: designware: fix controller is holding SCL low while ENABLE bit is
+      disabled
+    - rust: sync: require `T: Sync` for `LockedBy::access`
+    - ovl: fail if trusted xattrs are needed but caller lacks permission
+    - firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
+    - memory: tegra186-emc: drop unused to_tegra186_emc()
+    - dt-bindings: clock: exynos7885: Fix duplicated binding
+    - spi: bcm63xx: Fix module autoloading
+    - spi: bcm63xx: Fix missing pm_runtime_disable()
+    - power: supply: hwmon: Fix missing temp1_max_alarm attribute
+    - perf/core: Fix small negative period being ignored
+    - parisc: Fix itlb miss handler for 64-bit programs
+    - drm/mediatek: ovl_adaptor: Add missing of_node_put()
+    - drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
+    - ALSA: hda/tas2781: Add new quirk for Lenovo Y990 Laptop
+    - ALSA: core: add isascii() check to card ID generator
+    - ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
+    - ALSA: usb-audio: Add native DSD support for Luxman D-08u
+    - ALSA: line6: add hw monitor volume control to POD HD500X
+    - ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
+    - ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
+    - ext4: correct encrypted dentry name hash when not casefolded
+    - ext4: fix slab-use-after-free in ext4_split_extent_at()
+    - ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
+    - ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible()
+    - ext4: dax: fix overflowing extents beyond inode size when partially writing
+    - ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
+    - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
+    - ext4: aovid use-after-free in ext4_ext_insert_extent()
+    - ext4: fix double brelse() the buffer of the extents path
+    - ext4: fix timer use-after-free on failed mount
+    - ext4: update orig_path in ext4_find_extent()
+    - ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
+    - ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list()
+    - ext4: fix fast commit inode enqueueing during a full journal commit
+    - ext4: use handle to mark fc as ineligible in __track_dentry_update()
+    - ext4: mark fc as ineligible using an handle in ext4_xattr_set()
+    - parisc: Fix 64-bit userspace syscall path
+    - parisc: Allow mmap(MAP_STACK) memory to automatically expand upwards
+    - parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
+    - drm/rockchip: vop: clear DMA stop bit on RK3066
+    - of: address: Report error on resource bounds overflow
+    - of/irq: Support #msi-cells=<0> in of_msi_get_domain
+    - drm: omapdrm: Add missing check for alloc_ordered_workqueue
+    - resource: fix region_intersects() vs add_memory_driver_managed()
+    - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
+    - jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
+    - mm: krealloc: consider spare memory for __GFP_ZERO
+    - mm: krealloc: Fix MTE false alarm in __do_krealloc
+    - ocfs2: fix the la space leak when unmounting an ocfs2 volume
+    - ocfs2: fix uninit-value in ocfs2_get_block()
+    - ocfs2: reserve space for inline xattr before attaching reflink tree
+    - ocfs2: cancel dqi_sync_work before freeing oinfo
+    - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
+    - ocfs2: fix null-ptr-deref when journal load failed.
+    - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
+    - arm64: fix selection of HAVE_DYNAMIC_FTRACE_WITH_ARGS
+    - arm64: Subscribe Microsoft Azure Cobalt 100 to erratum 3194386
+    - riscv: define ILLEGAL_POINTER_VALUE for 64bit
+    - [Config] updateconfigs to set ILLEGAL_POINTER_VALUE for riscv64
+    - exfat: fix memory leak in exfat_load_bitmap()
+    - perf python: Disable -Wno-cast-function-type-mismatch if present on clang
+    - perf hist: Update hist symbol when updating maps
+    - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
+    - nfsd: map the EBADMSG to nfserr_io to avoid warning
+    - NFSD: Fix NFSv4's PUTPUBFH operation
+    - i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver
+      Due to Race Condition
+    - RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page
+    - riscv: Fix kernel stack size when KASAN is enabled
+    - aoe: fix the potential use-after-free problem in more places
+    - media: ov5675: Fix power on/off delay timings
+    - clk: rockchip: fix error for unknown clocks
+    - remoteproc: k3-r5: Fix error handling when power-up failed
+    - clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
+    - media: sun4i_csi: Implement link validate for sun4i_csi subdev
+    - clk: qcom: gcc-sm8450: Do not turn off PCIe GDSCs during gdsc_disable()
+    - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
+    - clk: qcom: clk-rpmh: Fix overflow in BCM vote
+    - clk: samsung: exynos7885: Update CLKS_NR_FSYS after bindings fix
+    - clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src
+    - media: venus: fix use after free bug in venus_remove due to race condition
+    - clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
+    - media: qcom: camss: Remove use_count guard in stop_streaming
+    - media: qcom: camss: Fix ordering of pm_runtime_enable
+    - clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table
+    - clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL
+    - smb: client: use actual path when queryfs
+    - smb3: fix incorrect mode displayed for read-only files
+    - iio: magnetometer: ak8975: Fix reading for ak099xx sensors
+    - vrf: revert "vrf: Remove unnecessary RCU-bh critical section"
+    - gso: fix udp gso fraglist segmentation after pull from frag_list
+    - tomoyo: fallback to realpath if symlink's pathname does not exist
+    - net: stmmac: Fix zero-division error when disabling tc cbs
+    - rtc: at91sam9: fix OF node leak in probe() error path
+    - Input: adp5589-keys - fix NULL pointer dereference
+    - Input: adp5589-keys - fix adp5589_gpio_get_value()
+    - cachefiles: fix dentry leak in cachefiles_open_file()
+    - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
+    - btrfs: send: fix invalid clone operation for file that got its size
+      decreased
+    - btrfs: wait for fixup workers before stopping cleaner kthread during umount
+    - cpufreq: Avoid a bad reference count on CPU node
+    - gpio: davinci: fix lazy disable
+    - net: pcs: xpcs: fix the wrong register that was written back
+    - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
+    - mac802154: Fix potential RCU dereference issue in mac802154_scan_worker
+    - ceph: fix cap ref leak via netfs init_request
+    - tracing/hwlat: Fix a race during cpuhp processing
+    - tracing/timerlat: Drop interface_lock in stop_kthread()
+    - tracing/timerlat: Fix a race during cpuhp processing
+    - tracing/timerlat: Fix duplicated kthread creation due to CPU online/offline
+    - rtla: Fix the help text in osnoise and timerlat top tools
+    - drm/i915/gem: fix bitwise and logical AND mixup
+    - drm/sched: Add locking to drm_sched_entity_modify_sched
+    - drm/amd/display: Add HDR workaround for specific eDP
+    - cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock
+    - kconfig: qconf: fix buffer overflow in debug links
+    - platform/x86: x86-android-tablets: Fix use after free on
+      platform_device_register() errors
+    - i2c: core: Lock address during client device instantiation
+    - i2c: synquacer: Remove a clk reference from struct synquacer_i2c
+    - i2c: synquacer: Deal with optional PCLK correctly
+    - arm64: cputype: Add Neoverse-N3 definitions
+    - arm64: errata: Expand speculative SSBS workaround once more
+    - io_uring/net: harden multishot termination case for recv
+    - uprobes: fix kernel info leak via "[uprobes]" vma
+    - mm: z3fold: deprecate CONFIG_Z3FOLD
+    - [Config] updateconfigs for deprecated CONFIG_Z3FOLD
+    - drm/amd/display: Allow backlight to go below
+      `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT`
+    - build-id: require program headers to be right after ELF header
+    - lib/buildid: harden build ID parsing logic
+    - sched: psi: fix bogus pressure spikes from aggregation race
+    - net: mana: Enable MANA driver on ARM64 with 4K page size
+    - net: mana: Add support for page sizes other than 4KB on ARM64
+    - [Config] updateconfigs for MICROSOFT_MANA
+    - RDMA/mana_ib: use the correct page table index based on hardware page size
+    - media: imx335: Fix reset-gpio handling
+    - remoteproc: k3-r5: Acquire mailbox handle during probe routine
+    - remoteproc: k3-r5: Delay notification of wakeup event
+    - dt-bindings: clock: qcom: Add missing UFS QREF clocks
+    - dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
+    - iio: pressure: bmp280: Improve indentation and line wrapping
+    - iio: pressure: bmp280: Use BME prefix for BME280 specifics
+    - iio: pressure: bmp280: Fix regmap for BMP280 device
+    - iio: pressure: bmp280: Fix waiting time for BMP3xx configuration
+    - r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
+    - r8169: add tally counter fields added with RTL8125
+    - clk: qcom: gcc-sc8180x: Add GPLL9 support
+    - ACPI: battery: Simplify battery hook locking
+    - ACPI: battery: Fix possible crash when unregistering a battery hook
+    - btrfs: drop the backref cache during relocation if we commit
+    - drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
+    - rxrpc: Fix a race between socket set up and I/O thread creation
+    - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
+    - crypto: octeontx* - Select CRYPTO_AUTHENC
+    - drm/amd/display: Revert Avoid overflow assignment
+    - perf report: Fix segfault when 'sym' sort key is not used
+    - drm/amd/display: enable_hpo_dp_link_output: Check link_res->hpo_dp_link_enc
+      before using it
+    - Revert "ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path"
+    - perf python: Allow checking for the existence of warning options in clang
+    - drm/i915/dp: Fix AUX IO power enabling for eDP PSR
+    - drm/amd/display: handle nulled pipe context in DCE110's set_drr()
+    - selftests: netfilter: Add missing return value
+    - afs: Fix the setting of the server responding flag
+    - net: dsa: improve shutdown sequence
+    - bridge: mcast: Fail MDB get request on empty entry
+    - net/ncsi: Disable the ncsi work before freeing the associated structure
+    - drm/xe: Restore pci state upon resume
+    - drm/xe: Resume TDR after GT reset
+    - drm/xe: Prevent null pointer access in xe_migrate_copy
+    - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Go E1404GAB
+    - nvme-keyring: restrict match length for version '1' identifiers
+    - nvme-tcp: sanitize TLS key handling
+    - nvme-fabrics: typo in nvmf_parse_key()
+    - nvme-tcp: check for invalidated or revoked key
+    - net: fec: don't save PTP state if PTP is unsupported
+    - wifi: mac80211: fix RCU list iterations
+    - netdev-genl: Set extack and fix error on napi-get
+    - block: fix integer overflow in BLKSECDISCARD
+    - arm64: trans_pgd: mark PTEs entries as valid to avoid dead kexec()
+    - net: phy: Check for read errors in SIOCGMIIREG
+    - wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
+    - x86/bugs: Add missing NO_SSB flag
+    - x86/bugs: Fix handling when SRSO mitigation is disabled
+    - net: napi: Prevent overflow of napi_defer_hard_irqs
+    - crypto: hisilicon - fix missed error branch
+    - ALSA: usb-audio: Add quirk for RME Digiface USB
+    - ALSA: usb-audio: Add mixer quirk for RME Digiface USB
+    - ALSA: control: Use automatic cleanup of kfree()
+    - ALSA: control: Fix unannotated kfree() cleanup
+    - ALSA: control: Use guard() for locking
+    - ALSA: control: Take power_ref lock primarily
+    - x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
+    - ASoC: Intel: boards: always check the result of
+      acpi_dev_get_first_match_dev()
+    - rcu-tasks: Add data to eliminate RCU-tasks/do_exit() deadlocks
+    - rcu-tasks: Initialize data to eliminate RCU-tasks/do_exit() deadlocks
+    - rcu-tasks: Fix access non-existent percpu rtpcp variable in
+      rcu_tasks_need_gpcb()
+    - pmdomain: core: Don't hold the genpd-lock when calling dev_pm_domain_set()
+    - iommu/vt-d: Unconditionally flush device TLB for pasid table updates
+    - iommu/arm-smmu-v3: Do not use devm for the cd table allocations
+    - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
+    - drm/amd/display: Check null pointers before using them
+    - drm/amd/display: Add null check for head_pipe in
+      dcn201_acquire_free_pipe_for_layer
+    - drm/amd/display: Add null check for head_pipe in
+      dcn32_acquire_idle_pipe_for_head_pipe_in_layer
+    - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in
+      dcn30_init_hw
+    - drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
+    - drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces
+    - scsi: smartpqi: Add new controller PCI IDs
+    - drm/amd/display: Add NULL check for function pointer in
+      dcn20_set_output_transfer_func
+    - drm/amd/display: Add NULL check for function pointer in
+      dcn32_set_output_transfer_func
+    - scsi: smartpqi: add new controller PCI IDs
+    - drm/amd/display: Check null-initialized variables
+    - drm/amd/display: Check phantom_stream before it is used
+    - drm/amdgpu/gfx9: properly handle error ints on all pipes
+    - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata
+      paths
+    - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached
+      topology
+    - drm/amdgpu: check PS, WS index
+    - drm/amdgpu: fix wrong sizeof argument
+    - drm/amdgpu: fix unchecked return value warning for amdgpu_atombios
+    - drm/amdgpu/gfx11: enter safe mode before touching CP_INT_CNTL
+    - drm/xe: Invert page fault queue head / tail
+    - drm/xe: Add helper macro to loop each DSS
+    - drm/xe: fix multicast support for Xe_LP platforms
+    - drm/xe: Use topology to determine page fault queue size
+    - drm/xe: Drop warn on xe_guc_pc_gucrc_disable in guc pc fini
+    - ovl: fsync after metadata copy-up
+    - HID: i2c-hid: ensure various commands do not interfere with each other
+    - platform/mellanox: mlxbf-pmc: Replace uintN_t with kernel-style types
+    - platform/mellanox: mlxbf-pmc: Cleanup signed/unsigned mix-up
+    - platform/mellanox: mlxbf-pmc: fix signedness bugs
+    - platform/mellanox: mlxbf-pmc: fix lockdep warning
+    - bpf: Fix a sdiv overflow issue
+    - ALSA: control: Fix power_ref lock order for compat code, too
+    - perf callchain: Fix stitch LBR memory leaks
+    - drm/xe: fixup xe_alloc_pf_queue
+    - drm/xe: Fix memory leak on xe_alloc_pf_queue failure
+    - nvme-tcp: fix link failure for TCP auth
+    - f2fs: fix zoned block device information initialization
+    - f2fs: add write priority option based on zone UFS
+    - f2fs: make BG GC more aggressive for zoned devices
+    - f2fs: introduce migration_window_granularity
+    - f2fs: increase BG GC migration window granularity when boosted for zoned
+      devices
+    - f2fs: do FG_GC when GC boosting is required for zoned devices
+    - f2fs: forcibly migrate to secure space for zoned device file pinning
+    - mm, slub: avoid zeroing kmalloc redzone
+    - drm/v3d: Prevent out of bounds access in performance query extensions
+    - ext4: fix access to uninitialised lock in fc replay path
+    - ext4: fix off by one issue in alloc_flex_gd()
+    - scripts/gdb: add iteration function for rbtree
+    - scripts/gdb: fix lx-mounts command error
+    - sched/deadline: Comment sched_dl_entity::dl_server variable
+    - sched/core: Add clearing of ->dl_server in put_prev_task_balance()
+    - sched/core: Clear prev->dl_server in CFS pick fast path
+    - drivers/perf: riscv: Align errno for unsupported perf event
+    - ACPI: resource: Remove duplicate Asus E1504GAB IRQ override
+    - ACPI: resource: Loosen the Asus E1404GAB DMI match to also cover the E1404GA
+    - ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
+    - ACPI: resource: Add Asus ExpertBook B2502CVA to
+      irq1_level_low_skip_override[]
+    - firmware/sysfb: Disable sysfb for firmware buffers with unknown parent
+    - close_range(): fix the logics in descriptor table trimming
+    - drm/sched: Fix dynamic job-flow control race
+    - drm/sched: Always wake up correct scheduler in drm_sched_entity_push_job
+    - drm/sched: Always increment correct scheduler score
+    - drm/xe: Delete unused GuC submission_state.suspend
+    - drm/xe: Use ordered wq for preempt fence waiting
+    - drm/xe: fix UAF around queue destruction
+    - sunrpc: change sp_nrthreads from atomic_t to unsigned int.
+    - NFSD: Async COPY result needs to return a write verifier
+    - NFSD: Limit the number of concurrent async COPY operations
+    - NFSD: Initialize struct nfsd4_copy earlier
+    - NFSD: Never decrement pending_async_copies on error
+    - drm/sched: revert "Always increment correct scheduler score"
+    - ALSA: control: Fix leftover snd_power_unref()
+    - Upstream stable to v6.6.55, v6.10.14
+  * By always inlining _compound_head(), clone() sees 3%+ performance increase
+    (LP: #2089327)
+    - mm: always inline _compound_head() with
+      CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+  * Random flickering with Intel i915 (Comet Lake and Kaby Lake) on Linux 6.8+
+    (LP: #2086587)
+    - SAUCE: iommu/intel: disable DMAR for KBL and CML integrated gfx
+  * Add list of source files to linux-buildinfo (LP: #2086606)
+    - [Packaging] Sort build dependencies alphabetically
+    - [Packaging] Add list of used source files to buildinfo package
+  * UFS: uspi->s_3apb UBSAN: shift-out-of-bounds (LP: #2087853)
+    - ufs: ufs_sb_private_info: remove unused s_{2, 3}apb fields
+  * Mute/mic LEDs don't function on HP EliteBook 645 G10 (LP: #2087983)
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP EliteBook 645 G10
+  * Noble update: upstream stable patchset 2024-11-22 (LP: #2089340)
+    - EDAC/synopsys: Fix ECC status and IRQ control race condition
+    - EDAC/synopsys: Fix error injection on Zynq UltraScale+
+    - wifi: rtw88: always wait for both firmware loading attempts
+    - crypto: xor - fix template benchmarking
+    - ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
+    - wifi: brcmfmac: export firmware interface functions
+    - wifi: brcmfmac: introducing fwil query functions
+    - wifi: ath9k: Remove error checks when creating debugfs entries
+    - wifi: ath12k: fix BSS chan info request WMI command
+    - wifi: ath12k: match WMI BSS chan info structure with firmware definition
+    - wifi: ath12k: fix invalid AMPDU factor calculation in
+      ath12k_peer_assoc_h_he()
+    - net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
+    - arm64: signal: Fix some under-bracketed UAPI macros
+    - wifi: rtw88: remove CPT execution branch never used
+    - RISC-V: KVM: Fix sbiret init before forwarding to userspace
+    - RISC-V: KVM: Allow legacy PMU access from guest
+    - RISC-V: KVM: Fix to allow hpmcounter31 from the guest
+    - mount: handle OOM on mnt_warn_timestamp_expiry
+    - ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros
+    - powercap: intel_rapl: Fix off by one in get_rpi()
+    - kselftest/arm64: signal: fix/refactor SVE vector length enumeration
+    - drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
+    - wifi: mac80211: don't use rate mask for offchannel TX either
+    - wifi: iwlwifi: remove AX101, AX201 and AX203 support from LNL
+    - wifi: iwlwifi: config: label 'gl' devices as discrete
+    - wifi: iwlwifi: mvm: increase the time between ranging measurements
+    - padata: Honor the caller's alignment in case of chunk_size 0
+    - drivers/perf: hisi_pcie: Record hardware counts correctly
+    - drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting
+    - kselftest/arm64: Actually test SME vector length changes via sigreturn
+    - can: j1939: use correct function name in comment
+    - ACPI: CPPC: Fix MASK_VAL() usage
+    - netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
+    - netfilter: nf_tables: reject element expiration with no timeout
+    - netfilter: nf_tables: reject expiration higher than timeout
+    - netfilter: nf_tables: remove annotation to access set timeout while holding
+      lock
+    - perf/arm-cmn: Improve debugfs pretty-printing for large configs
+    - perf/arm-cmn: Refactor node ID handling. Again.
+    - perf/arm-cmn: Fix CCLA register offset
+    - perf/arm-cmn: Ensure dtm_idx is big enough
+    - cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
+    - wifi: mt76: mt7915: fix oops on non-dbdc mt7986
+    - wifi: mt76: mt7996: use hweight16 to get correct tx antenna
+    - wifi: mt76: mt7996: fix traffic delay when switching back to working channel
+    - wifi: mt76: mt7996: fix wmm set of station interface to 3
+    - wifi: mt76: mt7996: fix HE and EHT beamforming capabilities
+    - wifi: mt76: mt7996: fix EHT beamforming capability check
+    - x86/sgx: Fix deadlock in SGX NUMA node search
+    - pm:cpupower: Add missing powercap_set_enabled() stub function
+    - crypto: hisilicon/hpre - mask cluster timeout error
+    - crypto: hisilicon/qm - reset device before enabling it
+    - crypto: hisilicon/qm - inject error before stopping queue
+    - wifi: mt76: mt7603: fix mixed declarations and code
+    - wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
+    - wifi: mt76: mt7915: fix rx filter setting for bfee functionality
+    - wifi: mt76: mt7996: ensure 4-byte alignment for beacon commands
+    - wifi: mt76: mt7996: fix uninitialized TLV data
+    - wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
+    - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
+    - wifi: wilc1000: fix potential RCU dereference issue in
+      wilc_parse_join_bss_param
+    - Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
+    - Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
+    - sock_map: Add a cond_resched() in sock_hash_free()
+    - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
+    - can: m_can: enable NAPI before enabling interrupts
+    - can: m_can: m_can_close(): stop clocks after device has been shut down
+    - Bluetooth: btusb: Fix not handling ZPL/short-transfer
+    - bareudp: Pull inner IP header in bareudp_udp_encap_recv().
+    - bareudp: Pull inner IP header on xmit.
+    - net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
+    - net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
+    - net: tipc: avoid possible garbage value
+    - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
+    - ublk: move zone report data out of request pdu
+    - nbd: fix race between timeout and normal completion
+    - block, bfq: fix possible UAF for bfqq->bic with merge chain
+    - block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
+    - block, bfq: don't break merge chain in bfq_split_bfqq()
+    - cachefiles: Fix non-taking of sb_writers around set/removexattr
+    - erofs: fix incorrect symlink detection in fast symlink
+    - block, bfq: fix uaf for accessing waker_bfqq after splitting
+    - block, bfq: fix procress reference leakage for bfqq in merge chain
+    - io_uring/io-wq: do not allow pinning outside of cpuset
+    - io_uring/io-wq: inherit cpuset of cgroup in io worker
+    - block: fix potential invalid pointer dereference in blk_add_partition
+    - spi: ppc4xx: handle irq_of_parse_and_map() errors
+    - arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
+    - arm64: dts: mediatek: mt8186: Fix supported-hw mask for GPU OPPs
+    - firmware: arm_scmi: Fix double free in OPTEE transport
+    - spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
+    - regulator: Return actual error in of_regulator_bulk_get_all()
+    - arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
+    - arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
+    - arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
+    - ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
+    - arm64: dts: rockchip: Correct vendor prefix for Hardkernel ODROID-M1
+    - arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
+    - arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations
+    - spi: bcmbca-hsspi: Fix missing pm_runtime_disable()
+    - ARM: dts: microchip: sama7g5: Fix RTT clock
+    - ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
+    - ARM: versatile: fix OF node leak in CPUs prepare
+    - reset: berlin: fix OF node leak in probe() error path
+    - reset: k210: fix OF node leak in probe() error path
+    - clocksource/drivers/qcom: Add missing iounmap() on errors in
+      msm_dt_timer_init()
+    - arm64: dts: mediatek: mt8195: Correct clock order for dp_intf*
+    - x86/mm: Use IPIs to synchronize LAM enablement
+    - ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error
+    - ASoC: tas2781: remove unused acpi_subysystem_id
+    - ASoC: tas2781: Use of_property_read_reg()
+    - ASoC: tas2781-i2c: Drop weird GPIO code
+    - ASoC: tas2781-i2c: Get the right GPIO line
+    - selftests/ftrace: Add required dependency for kprobe tests
+    - ALSA: hda: cs35l41: fix module autoloading
+    - m68k: Fix kernel_clone_args.flags in m68k_clone()
+    - ASoC: loongson: fix error release
+    - hwmon: (max16065) Fix overflows seen when writing limits
+    - hwmon: (max16065) Remove use of i2c_match_id()
+    - hwmon: (max16065) Fix alarm attributes
+    - mtd: slram: insert break after errors in parsing the map
+    - hwmon: (ntc_thermistor) fix module autoloading
+    - power: supply: axp20x_battery: Remove design from min and max voltage
+    - power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
+    - fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
+    - iommu/amd: Do not set the D bit on AMD v2 table entries
+    - mtd: powernv: Add check devm_kasprintf() returned value
+    - rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
+    - mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
+    - mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
+    - mtd: rawnand: mtk: Fix init error path
+    - iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
+    - iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K pages
+    - iommu/arm-smmu-qcom: apply num_context_bank fixes for SDM630 / SDM660
+    - pmdomain: core: Harden inter-column space in debug summary
+    - drm/stm: Fix an error handling path in stm_drm_platform_probe()
+    - drm/stm: ltdc: check memory returned by devm_kzalloc()
+    - drm/amd/display: Add null check for set_output_gamma in
+      dcn30_set_output_transfer_func
+    - drm/amdgpu: properly handle vbios fake edid sizing
+    - drm/radeon: properly handle vbios fake edid sizing
+    - scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly
+    - scsi: NCR5380: Check for phase match during PDMA fixup
+    - drm/amd/amdgpu: Properly tune the size of struct
+    - drm/rockchip: vop: Allow 4096px width scaling
+    - drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
+    - drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
+    - drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()
+    - drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
+    - scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
+    - jfs: fix out-of-bounds in dbNextAG() and diAlloc()
+    - drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config()
+    - drm/mediatek: Use spin_lock_irqsave() for CRTC event lock
+    - powerpc/8xx: Fix initial memory mapping
+    - powerpc/8xx: Fix kernel vs user address comparison
+    - powerpc/vdso: Inconditionally use CFUNC macro
+    - drm/msm: Fix incorrect file name output in adreno_request_fw()
+    - drm/msm/a5xx: disable preemption in submits by default
+    - drm/msm/a5xx: properly clear preemption records on resume
+    - drm/msm/a5xx: fix races in preemption evaluation stage
+    - drm/msm/a5xx: workaround early ring-buffer emptiness check
+    - ipmi: docs: don't advertise deprecated sysfs entries
+    - drm/msm/dsi: correct programming sequence for SM8350 / SM8450
+    - drm/msm: fix %s null argument error
+    - drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
+    - xen: use correct end address of kernel for conflict checking
+    - HID: wacom: Support sequence numbers smaller than 16-bit
+    - HID: wacom: Do not warn about dropped packets for first packet
+    - ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data
+    - minmax: avoid overly complex min()/max() macro arguments in xen
+    - xen: introduce generic helper checking for memory map conflicts
+    - xen: move max_pfn in xen_memory_setup() out of function scope
+    - xen: add capability to remap non-RAM pages to different PFNs
+    - xen: tolerate ACPI NVS memory overlapping with Xen allocated memory
+    - xen/swiotlb: add alignment check for dma buffers
+    - xen/swiotlb: fix allocated size
+    - tpm: Clean up TPM space after command failure
+    - sched/fair: Make SCHED_IDLE entity be preempted in strict hierarchy
+    - selftests/bpf: Workaround strict bpf_lsm return value check.
+    - selftests/bpf: Fix error linking uprobe_multi on mips
+    - bpf: Use -Wno-error in certain tests when building with GCC
+    - bpf: Disable some `attribute ignored' warnings in GCC
+    - bpf: Temporarily define BPF_NO_PRESEVE_ACCESS_INDEX for GCC
+    - selftests/bpf: Add CFLAGS per source file and runner
+    - selftests/bpf: Fix wrong binary in Makefile log output
+    - tools/runqslower: Fix LDFLAGS and add LDLIBS support
+    - selftests/bpf: Use pid_t consistently in test_progs.c
+    - selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
+    - selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc
+    - selftests/bpf: Drop unneeded error.h includes
+    - selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
+    - selftests/bpf: Fix missing UINT_MAX definitions in benchmarks
+    - selftests/bpf: Fix missing BUILD_BUG_ON() declaration
+    - selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test
+    - selftests/bpf: Refactor out some functions in ns_current_pid_tgid test
+    - selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test
+    - selftests/bpf: Fix include of <sys/fcntl.h>
+    - selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc
+    - selftests/bpf: Fix compiling kfree_skb.c with musl-libc
+    - selftests/bpf: Fix compiling flow_dissector.c with musl-libc
+    - selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
+    - selftests/bpf: Fix compiling core_reloc.c with musl-libc
+    - selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc
+    - selftests/bpf: Fix errors compiling decap_sanity.c with musl libc
+    - selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
+    - selftests/bpf: Fix arg parsing in veristat, test_progs
+    - selftests/bpf: Fix error compiling test_lru_map.c
+    - selftests/bpf: Fix C++ compile error from missing _Bool type
+    - selftests/bpf: Fix flaky selftest lwt_redirect/lwt_reroute
+    - selftests/bpf: Fix redefinition errors compiling lwt_reroute.c
+    - selftests/bpf: Fix compile if backtrace support missing in libc
+    - selftests/bpf: Fix error compiling tc_redirect.c with musl libc
+    - samples/bpf: Fix compilation errors with cf-protection option
+    - bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
+    - xz: cleanup CRC32 edits from 2018
+    - kthread: fix task state in kthread worker if being frozen
+    - ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
+    - smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
+    - ext4: avoid buffer_head leak in ext4_mark_inode_used()
+    - ext4: avoid potential buffer_head leak in __ext4_new_inode()
+    - ext4: avoid negative min_clusters in find_group_orlov()
+    - ext4: return error on ext4_find_inline_entry
+    - ext4: avoid OOB when system.data xattr changes underneath the filesystem
+    - ext4: check stripe size compatibility on remount as well
+    - sched/numa: Fix the vma scan starving issue
+    - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
+    - nilfs2: determine empty node blocks as corrupted
+    - nilfs2: fix potential oob read in nilfs_btree_check_delete()
+    - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
+    - bpf: Fix helper writes to read-only maps
+    - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
+    - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
+    - perf mem: Free the allocated sort string, fixing a leak
+    - perf inject: Fix leader sampling inserting additional samples
+    - perf report: Fix --total-cycles --stdio output error
+    - perf sched timehist: Fix missing free of session in perf_sched__timehist()
+    - perf stat: Display iostat headers correctly
+    - perf sched timehist: Fixed timestamp error when unable to confirm event
+      sched_in time
+    - perf time-utils: Fix 32-bit nsec parsing
+    - clk: imx: clk-audiomix: Correct parent clock for earc_phy and audpll
+    - clk: imx: imx6ul: fix default parent for enet*_ref_sel
+    - clk: imx: composite-8m: Less function calls in __imx8m_clk_hw_composite()
+      after error detection
+    - clk: imx: composite-8m: Enable gate clk with mcore_booted
+    - clk: imx: composite-93: keep root clock on when mcore enabled
+    - clk: imx: composite-7ulp: Check the PCC present bit
+    - clk: imx: fracn-gppll: fix fractional part of PLL getting lost
+    - clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
+    - clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
+    - clk: imx: imx8qxp: Parent should be initialized earlier than the clock
+    - remoteproc: imx_rproc: Correct ddr alias for i.MX8M
+    - remoteproc: imx_rproc: Initialize workqueue earlier
+    - clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
+    - clk: qcom: dispcc-sm8550: fix several supposed typos
+    - clk: qcom: dispcc-sm8550: use rcg2_ops for mdss_dptx1_aux_clk_src
+    - clk: qcom: dispcc-sm8650: Update the GDSC flags
+    - clk: qcom: dispcc-sm8550: use rcg2_shared_ops for ESC RCGs
+    - leds: bd2606mvv: Fix device child node usage in bd2606mvv_probe()
+    - pinctrl: ti: iodelay: Use scope based of_node_put() cleanups
+    - pinctrl: ti: ti-iodelay: Fix some error handling paths
+    - Input: ilitek_ts_i2c - avoid wrong input subsystem sync
+    - Input: ilitek_ts_i2c - add report id message validation
+    - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
+    - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
+    - PCI: Wait for Link before restoring Downstream Buses
+    - firewire: core: correct range of block for case of switch statement
+    - PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
+    - clk: qcom: ipq5332: Register gcc_qdss_tsctr_clk_src
+    - clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL
+    - leds: leds-pca995x: Add support for NXP PCA9956B
+    - leds: pca995x: Use device_for_each_child_node() to access device child nodes
+    - leds: pca995x: Fix device child node usage in pca995x_probe()
+    - x86/PCI: Check pcie_find_root_port() return for NULL
+    - nvdimm: Fix devs leaks in scan_labels()
+    - PCI: xilinx-nwl: Fix register misspelling
+    - PCI: xilinx-nwl: Clean up clock on probe failure/removal
+    - media: platform: rzg2l-cru: rzg2l-csi2: Add missing MODULE_DEVICE_TABLE
+    - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
+    - pinctrl: single: fix missing error code in pcs_probe()
+    - clk: at91: sama7g5: Allocate only the needed amount of memory for PLLs
+    - media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
+    - media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
+    - media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
+    - RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer
+    - RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
+    - clk: ti: dra7-atl: Fix leak of of_nodes
+    - clk: starfive: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync()
+      usage
+    - clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p
+    - nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
+    - nfsd: fix refcount leak when file is unhashed after being found
+    - pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
+    - IB/core: Fix ib_cache_setup_one error flow cleanup
+    - PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
+    - RDMA/erdma: Return QP state in erdma_query_qp
+    - RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache
+    - watchdog: imx_sc_wdt: Don't disable WDT in suspend
+    - RDMA/hns: Don't modify rq next block addr in HIP09 QPC
+    - RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
+    - RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
+    - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
+    - RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
+    - RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
+    - RDMA/hns: Optimize hem allocation performance
+    - RDMA/hns: Fix restricted __le16 degrades to integer issue
+    - RDMA/mlx5: Obtain upper net device only when needed
+    - riscv: Fix fp alignment bug in perf_callchain_user()
+    - RDMA/cxgb4: Added NULL check for lookup_atid
+    - RDMA/irdma: fix error message in irdma_modify_qp_roce()
+    - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
+    - ntb_perf: Fix printk format
+    - ntb: Force physically contiguous allocation of rx ring buffers
+    - nfsd: call cache_put if xdr_reserve_space returns NULL
+    - nfsd: return -EINVAL when namelen is 0
+    - crypto: caam - Pad SG length when allocating hash edesc
+    - crypto: powerpc/p10-aes-gcm - Disable CRYPTO_AES_GCM_P10
+    - f2fs: atomic: fix to avoid racing w/ GC
+    - f2fs: reduce expensive checkpoint trigger frequency
+    - f2fs: fix to avoid racing in between read and OPU dio write
+    - f2fs: Create COW inode from parent dentry for atomic write
+    - f2fs: fix to wait page writeback before setting gcing flag
+    - f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation
+    - f2fs: support .shutdown in f2fs_sops
+    - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
+    - f2fs: compress: don't redirty sparse cluster during {,de}compress
+    - f2fs: prevent atomic file from being dirtied before commit
+    - f2fs: get rid of online repaire on corrupted directory
+    - f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()
+    - spi: atmel-quadspi: Undo runtime PM changes at driver exit time
+    - spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
+    - lib/sbitmap: define swap_lock as raw_spinlock_t
+    - spi: atmel-quadspi: Avoid overwriting delay register settings
+    - nvme-multipath: system fails to create generic nvme device
+    - iio: adc: ad7606: fix oversampling gpio array
+    - iio: adc: ad7606: fix standby gpio state to match the documentation
+    - driver core: Fix error handling in driver API device_rename()
+    - ABI: testing: fix admv8818 attr description
+    - iio: chemical: bme680: Fix read/write ops to device by adding mutexes
+    - iio: magnetometer: ak8975: drop incorrect AK09116 compatible
+    - dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible
+    - driver core: Fix a potential null-ptr-deref in module_add_driver()
+    - serial: 8250: omap: Cleanup on error in request_irq
+    - coresight: tmc: sg: Do not leak sg_table
+    - interconnect: icc-clk: Add missed num_nodes initialization
+    - cxl/pci: Fix to record only non-zero ranges
+    - vhost_vdpa: assign irq bypass producer token correctly
+    - ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
+    - Revert "dm: requeue IO if mapping table not yet available"
+    - net: xilinx: axienet: Schedule NAPI in two steps
+    - net: xilinx: axienet: Fix packet counting
+    - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
+    - net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race
+      Condition
+    - net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
+    - tcp: check skb is non-NULL in tcp_rto_delta_us()
+    - net: qrtr: Update packets cloning when broadcasting
+    - bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
+    - virtio_net: Fix mismatched buf address when unmapping for small packets
+    - netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
+    - netfilter: ctnetlink: compile ctnetlink_label_size with
+      CONFIG_NF_CONNTRACK_EVENTS
+    - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump
+      path
+    - io_uring/sqpoll: do not allow pinning outside of cpuset
+    - io_uring: check for presence of task_work rather than TIF_NOTIFY_SIGNAL
+    - mm: call the security_mmap_file() LSM hook in remap_file_pages()
+    - drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
+    - Revert "net: libwx: fix alloc msix vectors failed"
+    - xen: move checks for e820 conflicts further up
+    - xen: allow mapping ACPI data using a different physical address
+    - io_uring/sqpoll: retain test for whether the CPU is valid
+    - io_uring/sqpoll: do not put cpumask on stack
+    - Remove *.orig pattern from .gitignore
+    - PCI: Revert to the original speed after PCIe failed link retraining
+    - PCI: Clear the LBMS bit after a link retrain
+    - PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ
+    - PCI: imx6: Fix missing call to phy_power_off() in error handling
+    - PCI: Correct error reporting with PCIe failed link retraining
+    - PCI: Use an error code with PCIe failed link retraining
+    - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
+    - Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible"
+    - ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
+    - soc: fsl: cpm1: tsa: Fix tsa_write8()
+    - soc: versatile: integrator: fix OF node leak in probe() error path
+    - Revert "media: tuners: fix error return code of
+      hybrid_tuner_request_state()"
+    - iommufd: Protect against overflow of ALIGN() during iova allocation
+    - Input: adp5588-keys - fix check on return code
+    - Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
+    - Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
+    - Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
+    - KVM: arm64: Add memory length checks and remove inline in do_ffa_mem_xfer
+    - KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits
+    - KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode()
+    - KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock
+    - drm/amd/display: Add HDMI DSC native YCbCr422 support
+    - drm/amd/display: Round calculated vtotal
+    - drm/amd/display: Validate backlight caps are sane
+    - KEYS: prevent NULL pointer dereference in find_asymmetric_key()
+    - powerpc/atomic: Use YZ constraints for DS-form instructions
+    - fs: Create a generic is_dot_dotdot() utility
+    - ksmbd: make __dir_empty() compatible with POSIX
+    - ksmbd: allow write with FILE_APPEND_DATA
+    - ksmbd: handle caseless file creation
+    - ata: libata-scsi: Fix ata_msense_control() CDL page reporting
+    - scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
+    - scsi: ufs: qcom: Update MODE_MAX cfg_bw value
+    - scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages
+    - scsi: mac_scsi: Refactor polling loop
+    - scsi: mac_scsi: Disallow bus errors during PDMA send
+    - can: esd_usb: Remove CAN_CTRLMODE_3_SAMPLES for CAN-USB/3-FD
+    - wifi: rtw88: Fix USB/SDIO devices not transmitting beacons
+    - usbnet: fix cyclical race on disconnect with work queue
+    - USB: appledisplay: close race between probe and completion handler
+    - USB: misc: cypress_cy7c63: check for short transfer
+    - USB: class: CDC-ACM: fix race between get_serial and set_serial
+    - usb: cdnsp: Fix incorrect usb_request status
+    - usb: dwc2: drd: fix clock gating on USB role switch
+    - bus: integrator-lm: fix OF node leak in probe()
+    - bus: mhi: host: pci_generic: Fix the name for the Telit FE990A
+    - firmware_loader: Block path traversal
+    - tty: rp2: Fix reset with non forgiving PCIe host bridges
+    - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
+    - serial: qcom-geni: fix fifo polling timeout
+    - crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
+    - drbd: Fix atomicity violation in drbd_uuid_set_bm()
+    - drbd: Add NULL check for net_conf to prevent dereference in state validation
+    - ACPI: sysfs: validate return type of _STR method
+    - ACPI: resource: Add another DMI match for the TongFang GMxXGxx
+    - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
+    - perf/x86/intel/pt: Fix sampling synchronization
+    - wifi: mt76: mt7921: Check devm_kasprintf() returned value
+    - wifi: mt76: mt7915: check devm_kasprintf() returned value
+    - wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he
+    - wifi: rtw88: 8821cu: Remove VID/PID 0bda:c82c
+    - wifi: rtw88: 8822c: Fix reported RX band width
+    - wifi: mt76: mt7615: check devm_kasprintf() returned value
+    - debugobjects: Fix conditions in fill_pool()
+    - btrfs: tree-checker: fix the wrong output of data backref objectid
+    - btrfs: always update fstrim_range on failure in FITRIM ioctl
+    - f2fs: fix several potential integer overflows in file offsets
+    - f2fs: prevent possible int overflow in dir_block_index()
+    - f2fs: avoid potential int overflow in sanity_check_area_boundary()
+    - f2fs: Require FMODE_WRITE for atomic write ioctls
+    - f2fs: fix to check atomic_file in f2fs ioctl interfaces
+    - hwrng: mtk - Use devm_pm_runtime_enable
+    - hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init
+    - hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
+    - arm64: esr: Define ESR_ELx_EC_* constants as UL
+    - arm64: errata: Enable the AC03_CPU_38 workaround for ampere1a
+    - arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
+    - arm64: dts: qcom: sa8775p: Mark APPS and PCIe SMMUs as DMA coherent
+    - arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
+    - vfs: fix race between evice_inodes() and find_inode()&iput()
+    - fs: Fix file_set_fowner LSM hook inconsistencies
+    - nfs: fix memory leak in error path of nfs4_do_reclaim
+    - EDAC/igen6: Fix conversion of system address to physical memory address
+    - icmp: change the order of rate limits
+    - cpuidle: riscv-sbi: Use scoped device node handling to fix missing
+      of_node_put
+    - padata: use integer wrap around to prevent deadlock on seq_nr overflow
+    - spi: fspi: involve lut_num for struct nxp_fspi_devtype_data
+    - ARM: dts: imx6ul-geam: fix fsl,pins property in tscgrp pinctrl
+    - soc: versatile: realview: fix memory leak during device remove
+    - soc: versatile: realview: fix soc_dev leak during device remove
+    - USB: misc: yurex: fix race between read and write
+    - xhci: Add a quirk for writing ERST in high-low order
+    - usb: xhci: fix loss of data on Cadence xHC
+    - pps: remove usage of the deprecated ida_simple_xx() API
+    - pps: add an error check in parport_attach
+    - serial: don't use uninitialized value in uart_poll_init()
+    - x86/idtentry: Incorporate definitions/declarations of the FRED entries
+    - x86/entry: Remove unwanted instrumentation in common_interrupt()
+    - lib/bitmap: add bitmap_{read,write}()
+    - btrfs: subpage: fix the bitmap dump which can cause bitmap corruption
+    - btrfs: fix race setting file private on concurrent lseek using same fd
+    - dt-bindings: spi: nxp-fspi: support i.MX93 and i.MX95
+    - dt-bindings: spi: nxp-fspi: add imx8ulp support
+    - thunderbolt: Improve DisplayPort tunnel setup process to be more robust
+    - bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0
+    - dm-verity: restart or panic on an I/O error
+    - lockdep: fix deadlock issue between lockdep and rcu
+    - mm: only enforce minimum stack gap size if it's sensible
+    - spi: fspi: add support for imx8ulp
+    - module: Fix KCOV-ignored file name
+    - mm/damon/vaddr: protect vma traversal in __damon_va_thre_regions() with rcu
+      read lock
+    - i2c: aspeed: Update the stop sw state when the bus recovery occurs
+    - i2c: isch: Add missed 'else'
+    - Documentation: KVM: fix warning in "make htmldocs"
+    - bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
+    - wifi: brcmfmac: add linefeed at end of file
+    - x86/tdx: Fix "in-kernel MMIO" check
+    - spi: atmel-quadspi: Fix wrong register value written to MR
+    - Revert: "dm-verity: restart or panic on an I/O error"
+    - wifi: ath11k: use work queue to process beacon tx event
+    - crypto: qat - disable IOV in adf_dev_stop()
+    - crypto: qat - fix recovery flow for VFs
+    - crypto: qat - ensure correct order in VF restarting handler
+    - crypto: iaa - Fix potential use after free bug
+    - autofs: fix missing fput for FSCONFIG_SET_FD
+    - arm64: smp: smp_send_stop() and crash_smp_send_stop() should try non-NMI
+      first
+    - thermal: core: Fold two functions into their respective callers
+    - thermal: core: Fix rounding of delay jiffies
+    - perf/dwc_pcie: Fix registration issue in multi PCIe controller instances
+    - perf/dwc_pcie: Always register for PCIe bus notifier
+    - ACPI: video: force native for some T2 macbooks
+    - ACPI: video: force native for Apple MacbookPro9,2
+    - wifi: cfg80211: fix bug of mapping AF3x to incorrect User Priority
+    - wifi: mac80211: fix the comeback long retry times
+    - ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
+    - ACPICA: executer/exsystem: Don't nag user about every Stall() violating the
+      spec
+    - netfilter: nft_dynset: annotate data-races around set timeout
+    - wifi: mt76: mt7921: fix wrong UNII-4 freq range check for the channel usage
+    - crypto: ccp - do not request interrupt on cmd completion when irqs disabled
+    - wifi: mt76: connac: fix checksum offload fields of connac3 RXD
+    - net: hsr: Use the seqnr lock for frames received via interlink port.
+    - crypto: n2 - Set err to EINVAL if snprintf fails for hmac
+    - firmware: qcom: scm: Disable SDI and write no dump to dump mode
+    - arm64: dts: renesas: r9a08g045: Correct GICD and GICR sizes
+    - arm64: tegra: Correct location of power-sensors for IGX Orin
+    - arm64: dts: ti: k3-am654-idk: Fix dtbs_check warning in ICSSG dmas
+    - selftests/ftrace: Fix eventfs ownership testcase to find mount point
+    - iommu/amd: Introduce struct protection_domain.pd_mode
+    - iommu/amd: Allocate the page table root using GFP_KERNEL
+    - iommu/amd: Convert comma to semicolon
+    - platform/x86: ideapad-laptop: Make the scope_guard() clear of its scope
+    - kselftest: dt: Ignore nodes that have ancestors disabled
+    - bpf, x64: Fix tailcall hierarchy
+    - bpf, lsm: Add check for BPF LSM return value
+    - bpf: Fix compare error in function retval_range_within
+    - bpf: Fail verification for sign-extension of packet data/data_end/data_meta
+    - selftests/bpf: Support checks against a regular expression
+    - selftests/bpf: no need to track next_match_pos in struct test_loader
+    - selftests/bpf: extract test_loader->expect_msgs as a data structure
+    - selftests/bpf: allow checking xlated programs in verifier_* tests
+    - selftests/bpf: __arch_* macro to limit test cases to specific archs
+    - libbpf: Fix bpf_object__open_skeleton()'s mishandling of options
+    - s390/ap: Fix deadlock caused by recursive lock of the AP bus scan mutex
+    - sched/deadline: Fix schedstats vs deadline servers
+    - perf scripts python cs-etm: Restore first sample log in verbose mode
+    - perf lock contention: Change stack_id type to s32
+    - quota: avoid missing put_quota_format when DQUOT_SUSPENDED is passed
+    - media: staging: media: starfive: camss: Drop obsolete return value
+      documentation
+    - leds: gpio: Set num_leds after allocation
+    - iommufd/selftest: Fix buffer read overrrun in the dirty test
+    - iommufd: Check the domain owner of the parent before creating a nesting
+      domain
+    - RDMA/mlx5: Fix counter update on MR cache mkey creation
+    - RDMA/mlx5: Drop redundant work canceling from clean_keys()
+    - RDMA/mlx5: Fix MR cache temp entries cleanup
+    - RDMA/hns: Fix ah error counter in sw stat not increasing
+    - Coresight: Set correct cs_mode for TPDM to fix disable issue
+    - Coresight: Set correct cs_mode for dummy source to fix disable issue
+    - interconnect: qcom: sm8250: Enable sync_state
+    - vdpa/mlx5: Fix invalid mr resource destroy
+    - net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled
+    - selftests: netfilter: Avoid hanging ipvs.sh
+    - io_uring/rw: treat -EOPNOTSUPP for IOCB_NOWAIT like -EAGAIN
+    - mm: migrate: annotate data-race in migrate_folio_unmap()
+    - selftests/bpf: correctly move 'log' upon successful match
+    - soc: fsl: cpm1: qmc: Update TRNSYNC only in transparent mode
+    - drm/amdgpu/vcn: enable AV1 on both instances
+    - drm/amd/display: Clean up dsc blocks in accelerated mode
+    - drm/amd/display: Skip to enable dsc if it has been off
+    - arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled
+    - usb: xHCI: add XHCI_RESET_ON_RESUME quirk for Phytium xHCI host
+    - serial: qcom-geni: fix false console tx restart
+    - crypto: qcom-rng - fix support for ACPI-based systems
+    - ACPI: resource: Do IRQ override on MECHREV GM7XG0M
+    - perf/x86/intel: Allow to setup LBR for counting event for BPF
+    - f2fs: check discard support for conventional zones
+    - netfs: Delete subtree of 'fs/netfs' when netfs module exits
+    - md: Don't flush sync_work in md_write_start()
+    - tools/nolibc: include arch.h from string.h
+    - KVM: x86: Make x2APIC ID 100% readonly
+    - x86/mm/cpa: Warn for set_memory_XXcrypted() VMM fails
+    - x86/mm: Make x86_platform.guest.enc_status_change_*() return an error
+    - x86/tdx: Account shared memory
+    - x86/mm: Add callbacks to prepare encrypted memory for kexec
+    - x86/tdx: Convert shared memory back to private on kexec
+    - soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers
+    - serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit()
+    - serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield()
+    - idpf: stop using macros for accessing queue descriptors
+    - fs_parse: add uid & gid option option parsing helpers
+    - compiler.h: specify correct attribute for .rodata..c_jump_table
+    - exfat: resolve memory leak from exfat_create_upcase_table()
+    - s390/ftrace: Avoid calling unwinder in ftrace_return_address()
+    - fbdev: xen-fbfront: Assign fb_info->device
+    - [Config] update configs for CONFIG_CRYPTO_AES_GCM_P10
+    - Upstream stable to v6.6.54, v6.10.13
+  * Backport some AppArmor complain-mode profile bugfixes from Oracular
+    (LP: #2086210)
+    - SAUCE: apparmor4.0.0 [94/99]: apparmor: allocate xmatch for nullpdf inside
+      aa_alloc_null
+    - SAUCE: apparmor4.0.0 [95/99]: apparmor: properly handle cx/px lookup failure
+      for complain mode profiles
+  * Noble update: upstream stable patchset 2024-11-08 (LP: #2087519)
+    - ASoC: SOF: mediatek: Add missing board compatible
+    - ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile
+    - ASoC: allow module autoloading for table db1200_pids
+    - ASoC: allow module autoloading for table board_ids
+    - scsi: lpfc: Fix overflow build issue
+    - pinctrl: at91: make it work with current gpiolib
+    - hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
+    - microblaze: don't treat zero reserved memory regions as error
+    - platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F DMI match
+      less strict
+    - net: ftgmac100: Ensure tx descriptor updates are visible
+    - LoongArch: Define ARCH_IRQ_INIT_FLAGS as IRQ_NOPROBE
+    - wifi: iwlwifi: lower message level for FW buffer destination
+    - wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
+    - wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
+    - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
+    - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
+    - wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap()
+    - wifi: iwlwifi: clear trans->state earlier upon error
+    - can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing configuration
+    - ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict
+    - ASoC: intel: fix module autoloading
+    - ASoC: google: fix module autoloading
+    - ASoC: tda7419: fix module autoloading
+    - ASoC: fix module autoloading
+    - spi: spidev: Add an entry for elgin,jg10309-01
+    - ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
+    - ALSA: hda: add HDMI codec ID for Intel PTL
+    - drm: komeda: Fix an issue related to normalized zpos
+    - spi: bcm63xx: Enable module autoloading
+    - smb: client: fix hang in wait_for_response() for negproto
+    - x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
+    - tools: hv: rm .*.cmd when make clean
+    - spi: spidev: Add missing spi_device_id for jg10309-01
+    - ocfs2: add bounds checking to ocfs2_xattr_find_entry()
+    - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
+    - drm: Use XArray instead of IDR for minors
+    - accel: Use XArray instead of IDR for minors
+    - drm: Expand max DRM device number to full MINORBITS
+    - powercap/intel_rapl: Add support for AMD family 1Ah
+    - netfilter: nft_socket: make cgroupsv2 matching work with namespaces
+    - netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in
+      nft_socket_cgroup_subtree_level()
+    - nvme-pci: qdepth 1 quirk
+    - x86/mm: Switch to new Intel CPU model defines
+    - can: mcp251xfd: properly indent labels
+    - can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
+      mcp251xfd_chip_start/stop()
+    - USB: serial: pl2303: add device id for Macrosilicon MS3020
+    - USB: usbtmc: prevent kernel-usb-infoleak
+    - platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA
+    - ASoC: mediatek: mt8188-mt6359: Modify key
+    - clk: qcom: gcc-sm8650: Don't use shared clk_ops for QUPs
+    - ice: check for XDP rings instead of bpf program when unconfiguring
+    - powercap/intel_rapl: Fix the energy-pkg event for AMD CPUs
+    - powercap: intel_rapl: Change an error pointer to NULL
+    - Upstream stable to v6.6.53, v6.10.12
+
+  [ Ubuntu: 6.8.0-52.53 ]
+
+  * noble/linux: 6.8.0-52.53 -proposed tracker (LP: #2093521)
+  * CVE-2024-53164
+    - net: sched: fix ordering of qlen adjustment
+  * CVE-2024-53141
+    - netfilter: ipset: add missing range check in bitmap_ip_uadt
+  * CVE-2024-53103
+    - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
+
+  [ Ubuntu: 6.8.0-51.52 ]
+
+  * noble/linux: 6.8.0-51.52 -proposed tracker (LP: #2090369)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] update variants
+  * MGLRU: kswapd uses 100% CPU when MGLRU is enabled and under memory pressure
+    (LP: #2087886)
+    - mm/mglru: only clear kswapd_failures if reclaimable
+  * CVE-2024-50264
+    - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
+  * CVE-2024-53057
+    - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
+  * CVE-2024-49967
+    - ext4: no need to continue when the number of entries is 1
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 12 Feb 2025 21:04:42 +0900
+
+linux-qcom (6.8.0-1027.27) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1027.27 -proposed tracker (LP: #2097551)
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 07 Feb 2025 00:20:45 +0900
+
+linux-qcom (6.8.0-1025.25) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1025.25 -proposed tracker (LP: #2097247)
+    - [Packaging] switch from jammy to noble
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 03 Feb 2025 22:35:26 +0900
+
+linux-qcom (6.8.0-1023.23) jammy; urgency=medium
+
+  * jammy/linux-qcom: 6.8.0-1023.23 -proposed tracker (LP: #2097246)
+
+  * Miscellaneous upstream changes
+    - PENDING: iommu/arm-smmu: add ACTLR data and support for sa7255p
+    - QCLINUX: arm64: dts: qcom: Enable gpu tsens mitigation for sa8775p variants
+    - PENDING: arm64: dts: qcom: sa8255p: Add ICE node
+    - QCLINUX: arm64: defconfigs: Enable PCIe EP configuration
+    - QCLINUX: firmware: qtee_shmbridge: Fix stubs
+    - FROMLIST: firmware: qcom: scm: add a call for deriving the software secret
+    - FROMLIST: firmware: qcom: scm: add calls for creating, preparing and
+      importing keys
+    - QCLINUX: arm64: qcom_defconfig: enable SHM Bridge support for the TZ memory
+      allocator
+    - QCLINUX: firmware: qtee_shmbrige: Disable bridge enablement call
+    - PENDING: firmware: qcom_tzmem: Add register/deregister interfaces
+    - PENDING: firmware: qcom: tz_log: Migrate to qcom_tzmem interfaces
+    - PENDING: soc: qcom: memory_dump: Use qcom_tzmem interfaces
+    - PENDING: arm64: defconfig: qcom: Enable MMC crypto
+    - QCLINUX: soc: qcom: smem: Switch partitions to xarray
+    - QCLINUX: soc: qcom: smem: Ignore multi remote host partitions
+    - PENDING: arm64: dts: qcom: sa8255p: Add PCIe EP nodes
+    - PENDING: qcom: ice: enable ufs clock scaling
+    - PENDING: arm64: dts: qcom: qcs9075-rb8: Add PON resin support
+    - PENDING: arm64: dts: qcom: Add duplicate funnel device
+    - PENDING: clk: qcom: videocc-sa8775p: Remove HW_CTRL for video_cc_mvs0_gdsc
+    - PENDING: arm64: dts: qcom: Add cpufreq_hw support on sa7255p
+    - QCLINUX: ASoC: qcom: qdsp6: msm_audio_mem: Fix excessive logging in
+      msm_audio_mem_ioctl fun
+    - BACKPORT: FROMLIST: arm64: dts: qcom: qcs9100: Update memory map for QCS9100
+      Ride and QCS9100 Ride Rev3
+    - QCLINUX: firmware: qcom_scm: Fix indentation for ice scm calls
+    - FROMLIST: PCI: epf-mhi: Update device id for SA8775P
+    - FROMLIST: bus: mhi: host: pci_generic: Add supoprt for SA8775P target
+    - QCLINUX: usb: dwc3: qcom: export core_exit_mode and free_event_buffers
+    - FROMLIST: net: Add MHI Endpoint network driver
+    - PENDING: arm64: dts: qcom: Add MXC power domain to camcc node on QCS8300
+    - PENDING: arm64: dts: qcom: sa7255p: Add pcie nodes
+    - PENDING: net: phy: aquantia: AQR113c fix up PMA capabilities
+    - QCLINUX: arm64: dts: qcom: Add nodes for Data Capture and Compare
+    - QCLINUX: arm64: dts: qcom: Update the size for swao-etf node
+    - PENDING: thermal: qcom: add support for nsp1 qmi tmd devices
+    - PENDING: arm64: dts: qcom: Disable idle injection cooling device for cpu0
+    - QCLINUX: arm64: dts: qcom: Enable cdsp qmi tmd devices for sa8775p variants
+    - QCLINUX: arm64: dts: qcom: use 2nd trip for gpu passive cooling mitigation
+    - PENDING: net: stmmac: Add sa8797p support within ethqos driver
+    - PENDING: net: stmmac: Add 4k Virtualization support to Emac registers
+    - PENDING: net: stmmac: Add IO macro configuration for USXGMII
+    - PENDING: arm64: dts: qcom: Enable EUD on QCS9075 RB8
+    - PENDING: arm64: dts: qcom: sa7255p: Add ICE node
+    - QCLINUX: arm64: defconfig: enable scmi-cpufreq and cpucp mbox
+    - PENDING: net: stmmac: Add Qcom specific changes for HDMA
+    - QCLINUX: arm64: defconfigs: Enable MHI configs for PCIE RC and EP
+    - FROMLIST: drm/msm/dpu: fix the intf_type of MST interfaces
+    - FROMLIST: drm/msm/dp: split msm_dp_panel_read_sink_caps() into two parts
+    - FROMLIST: drm/msm/dp: add a helper to read mst caps for dp_panel
+    - FROMLIST: drm/msm/dp: remove dp_display's dp_mode and use dp_panel's instead
+    - FROMLIST: drm/msm/dp: break up dp_display_enable into two parts
+    - FROMLIST: drm/msm/dp: re-arrange dp_display_disable() into functional parts
+    - FROMLIST: drm/msm/dp: allow dp_ctrl stream APIs to use any panel passed to
+      it
+    - PENDING: net: stmmac: Add missing 25GMAC link capabilities
+    - PENDING: phy: qcom: qmp: Add default Type-C reverse orientation flag
+    - PENDING: net: stmmac: Move desc cache compute within HDMA
+    - PENDING: net: PCS: Add Qualcomm XPCS driver
+    - PENDING: arm64: dts: qcom: qcs8300: add support for steam 1
+    - FROMLIST: nvmem: qfprom: Add constraint read for some SoCs
+    - FROMLIST: arm64/dts/qcom: add mst support for stream 1 clk
+    - FROMLIST: drm/msm/dp: move the pixel clock control to its own API
+    - PENDING: net: stmmac: Use new Qualcomm XPCS driver
+    - QCLINUX: arm64: defconfig: Remove HVC console for Gen5auto targets
+    - PENDING: ASoC: codecs: wcd937x: fix aux playback issue
+    - FROMLIST: arm64: dts: qcom: sa8775p: Add CPUs to psci power domain
+    - QCLINUX: arm64: dts: qcom: Disable HCI uart for Industrial mezz kit
+    - PENDING: soc: qcom: smcinvoke: Remove mem-buf dependency for PVM
+    - QCLINUX: ASoC: qcom: qcm6490: fix the probe defer issue
+    - FROMLIST: drm/msm/dp: split dp_ctrl_off() into stream and link parts
+    - FROMLIST: drm/msm/dp: make bridge helpers use dp_display to allow re-use
+    - FROMLIST: drm/msm/dp: separate dp_display_prepare() into its own API
+    - FROMLIST: drm/msm/dp: introduce stream_id for each DP panel
+    - FROMLIST: drm/msm/dp: convert dp_display_set_mode() to use dp_panel argument
+    - FROMLIST: drm/msm/dp: add support for programming p1 register block
+    - FROMLIST: drm/msm/dp: use stream_id to change offsets in dp_catalog
+    - FROMLIST: drm/msm/dp: add support to send ACT packets for MST
+    - FROMLIST: drm/msm/dp: add support to program mst support in mainlink
+    - FROMLIST: drm/msm/dp: no need to update tu calculation for mst
+    - FROMLIST: drm/msm/dp: add support for mst channel slot allocation
+    - FROMLIST: drm/msm/dp: add support to send vcpf packets in dp controller
+    - FROMLIST: drm/msm/dp: always program MST_FIFO_CONSTANT_FILL for MST
+    - FROMLIST: drm/msm/dp: abstract out the dp_display stream helpers to accept a
+      panel
+    - FROMLIST: drm/msm/dp: move link related operations to dp_display_unprepare()
+    - FROMLIST: drm/msm/dp: replace power_on with active_stream_cnt for dp_display
+    - FROMLIST: drm/msm/dp: make the SST bridge disconnected when
+    - PENDING: drm/msm/dp: make the mst disable call separate
+    - FROMLIST: drm/msm/dp: add an API to initialize MST on sink side
+    - FROMLIST: drm/msm/dp: skip reading the EDID for MST cases
+    - FROMLIST: drm/msm/dp: add dp_display_get_panel() to initialize DP panel
+    - FROMLIST: drm/msm/dp: add dp_mst_drm to manage DP MST bridge operations
+    - FROMLIST: drm/msm/dp: add connector abstraction for DP MST
+    - FROMLIST: drm/msm/dp: add irq hpd callback for dp mst
+    - PENDING: drm/msm/dp: use the max_streams from dp catalog
+    - FROMLIST: drm/msm/dp: add support to re-use and clear the panel edid
+    - FROMLIST: drm/msm/dp: add a mst session mutex to protect bridge ops
+    - FROMLIST: drm/msm/dp: propagate hpd state changes to dp mst module
+    - PENDING: drm/msm/dp: make the changes for hpd to work
+    - FROMLIST: drm/msm: add support for non-blocking commits
+    - FROMLIST: drm/msm: initialize DRM MST encoders for DP controllers
+    - FROMLIST: drm/msm/dp: initialize dp_mst module for each DP MST controller
+    - FROMLIST: drm/msm: add a stream to intf map for DP controller
+    - FROMLIST: drm/msm/dpu: use msm_dp_get_mst_intf_id() to get the intf id
+    - FROMLIST: drm/msm/dp: populate the max_streams for sa8775 mst controller
+    - PENDING: drm/msm/dpu: make max h_display split to 2560 to allow 4 streams
+    - PENDING: drm/msm/dp: populate the max streams for DP1
+    - FROMLIST: drm: allow encoder mode_set even when connectors change for crtc
+    - PENDING: drm/msm/dp: fix up the hpd state machine for mst cases
+    - PENDING: drm/msm/dp: use stream id for streams clk on
+    - PENDING: drm/msm/dp: populate the max_streams for qcs8300
+    - FROMLIST: arm64/dts/qcom: add mst support for stream 0 clk
+    - FROMLIST: irqchip: gic-v3: Handle failure case of CPU enters low power state
+    - PENDING: arm64: dts: qcom: qcs8300: Fix quirks being added to usb node
+    - QCLINUX: arm64: dts: qcom: remove unused tlmm gpio entry
+    - FROMLIST: Revert "PENDING: Bluetooth: hci_sync: Fix disconnect
+    - PENDING: arm64: dts: qcom: Add L3 interconnect device for QCS8300
+    - PENDING: arm64: dts: qcom: Add static vote for QCS8300
+    - QCLINUX: arm64: defconfig: Enable additional debug configs for gen5auto
+    - QCLINUX: arm64: dts: qcom: Add reserved regions
+    - PENDING: arm64: dts: qcom: qcs8300: Add support to scale DDR/L3
+    - PENDING: arm64: dts: qcom: qcs8300: Add LMH interrupts for cpufreq_hw node
+    - PENDING: clk: qcom: gdsc: Increase the GDSC status poll timeout
+    - QCLINUX: firmware: shmbridge/tzmem: Improve error reporting
+    - QCLINUX: ASoC: qcom: qdsp6: Increase the timeout to 5 secs
+    - PENDING: net: stmmac: enable SGMII loopback for DMA reset
+    - QCLINUX: arm64: dts: qcom: Add addons support for QCS615 RIDE
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for QCS615
+    - QCLINUX: arm64: deconfig: enable clock controller, interconnect and pinctrl
+      for QCS615
+    - BACKPORT: FROMGIT: clk: qcom: rpmhcc: Add support for QCS615 Clocks
+    - BACKPORT: FROMGIT: clk: qcom: gcc: Add support for QCS615 GCC clocks
+    - FROMLIST: pinctrl: qcom: correct the ngpios entry for QCS615
+    - PENDING: net: stmmac: Support 10GBaseR iomacro configuration
+    - QCLINUX: arm64: defconfig: enable carveout heaps
+    - FROMLIST: misc: fastrpc: Fix race condition in MUNMAP
+    - PENDING: net: PCS: Add 10GBaseR support in XPCS driver
+    - PENDING: arm64: dts: qcom: qcs9075: Update memory map for qcs9075
+    - Ubuntu: [Config] update CONFIG options for Yocto GA 1.3.1
+    - drm/i915: convert remaining intel_dp_vsc_sdp_pack
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 03 Feb 2025 17:53:58 +0900
+
+linux-qcom (6.8.0-1019.19) jammy; urgency=medium
+
+  * jammy/linux-qcom: 6.8.0-1019.19 -proposed tracker (LP: #2095417)
+
+  * "[RB3] tc956x_pci-eth errors found in dmesg"
+    - SAUCE: ubuntu/qcom/qps615: suppress false alerts
+    - SAUCE: ubuntu/qcom/qps615: use INFO level for logging
+
+  * [RB3] drm sde error/ msm-dsi-error found in dmesg
+    - SAUCE: do not show error on EPROBE_DEFER
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import external DT from GA 1.3
+    - SAUCE: Add Makefile code to apply overlays for GA1.2
+    - SAUCE: ubuntu/qcom/display: import qcm6490 display code from GA1.3
+    - SAUCE: ubuntu/qcom/graphics: import qcm6490 graphics driver code from GA1.3
+    - SAUCE: ubuntu/qcom/camera: import qcm6490 camera driver code from GA1.3
+    - SAUCE: ubuntu/qcom/qps615: import ethernet driver from GA1.3
+    - SAUCE: ubuntu/qcom/video: import video driver from GA 1.3
+    - SAUCE: ubuntu/qcom: build external drivers
+    - SAUCE: ubuntu/qcom/camera: fix build warnings and errors
+    - SAUCE: suppress unneeded build logs
+    - SAUCE: ubuntu/qcom: suppress Wno-enum-int-mismatch warning
+    - SAUCE: ubuntu/qcom/graphics: change strtobool() to kstrtobool()
+    - SAUCE: ubuntu/qcom/graphics: dynamically allocate the kgsl-pool shrinker for
+      kernel>=6.7
+    - SAUCE: ubuntu/qcom/camera: remove unused camera_banner
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/video: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: auto-load module
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: ubuntu/qcom/display: Rename min_buffers_needed to min_queued_buffers
+    - SAUCE: ubuntu/qcom: remove DRM_UNLOCKED
+    - SAUCE: ubuntu/qcom/display: suppress EPROBE_DEFER error log
+    - SAUCE: Add Makefile code to apply qcs5430 overlays for GA1.2
+    - SAUCE: rename qcom,phy-rst-gpio to qcom,phy-rst-gpio-id
+    - SAUCE: comment out BUILD_TIMESTAMP
+    - SAUCE: add more DT to combined-dtb.dtb
+
+  * Miscellaneous upstream changes
+    - PENDING: usb: typec: ucsi_glink: Search current directory for headers
+    - PENDING: iommu/arm-smmu-qcom: Add SA8255p SMMUv2
+    - FROMLIST: usb: misc: qcom_eud: Access mode manager through secure calls
+    - FROMLIST: arm64: dts: qcom: sc7280: Update eud compatible string
+    - PENDING: arm64: dts: qcom: sa8775p: Add EUD dt node
+    - QCLINUX: arm64: dts: qcom: Add DT configuration
+    - PENDING: phy: qcom: Add support for eDP PHY on qcs8300
+    - UPSTREAM: wifi: ath11k: fix connection failure due to unexpected peer delete
+    - PENDING: arm64: dts: qcom: sa8775p-ride: Enable gpi-dma and qup node
+    - FROMLIST: wifi: ath11k: enable fw_wmi_diag_event hw param for WCN6750
+    - PENDING: Bluetooth: mgmt: Verify cmd pending status before removing it
+    - QCLINUX: firmware: qcom_scm: Add new scm to update Camera QoS
+    - QCLINUX: arm64: defconfig: Enable usb5807 driver
+    - QCLINUX: arm64: defconfigs: Add configs for Auto targets
+    - PENDING: drm/msm/dpu: Add QCS8300 support
+    - PENDING: arm64: dts: qcom: qcs8300: Add CDSP and ADSP fastrpc nodes
+    - PENDING: net: stmmac: Add the missing programming sequence for Split header
+      feature
+    - QCLINUX: firmware: qcom_scm_addon: Fix qcom_she_op missing arginfo and res
+    - UPSTREAM: arm64: mm: Batch dsb and isb when populating pgtables
+    - UPSTREAM: arm64: mm: Don't remap pgtables for allocate vs populate
+    - PENDING: drm/msm/dp: Add DisplayPort controller for QCS8300
+    - PENDING: arm64: dts: qcom: sa8775p: Enable EUD function
+    - PENDING: arm64: dts: qcom: qcs8300: Add BWMON instances
+    - PENDING: Bluetooth: mgmt: Verify command pending status before removing it
+    - PENDING: pinctrl: qcom: Add qcs8300 lpass lpi pinctrl driver
+    - QCLINUX: ASoC: qcm6490: Add sound card support for QCS8300
+    - QCLINUX: qcom: qtee_shmbridge: Register dma bridge
+    - PENDING: drm/msm: mdss: Add QCS8300 support
+    - QCLINUX: arm64: deconfig: qcom: disable CONFIG_ARM_SCMI_CPUFREQ
+    - PENDING: net: phy: aquantia: Fix aquantia driver to support 2.5Gbps
+    - QCLINUX: arm64: defconfig: Enable LPASS LPI QCS8300 pinctrl
+    - PENDING: arm64: dts: qcom: Add on-board PMICs for qcs8300
+    - PENDING: arm64: dts: qcom: Add PMIC GPIO devices for qcs8300
+    - PENDING: arm64: dts: qcom: Add PMIC RTC device for qcs8300
+    - PENDING: arm64: dts: qcom: qcs8300-ride: Add Bluetooth support
+    - PENDING: arm64: dts: qcom: sa8775p: Enable high bandwidth for hs isoc eps
+    - PENDING: arm64: dts: qcom: sa8255p-ride: Disable USB wakeup capability
+    - PENDING: usb: dwc3: Update nominal max votes for qcom usb
+    - PENDING: tty: serial: qcom-geni-serial: Increase Rx buffer size
+    - PENDING: arm64: dts: qcom: qcs8300: add display dt nodes
+    - QCLINUX: ARM64: configs: Remove Gunyah in-tree drivers
+    - PENDING: arm64: dts: qcom: qcs8300: Add gpr device tree node for ADSP
+    - QCLINUX: arm64: dts: qcom: qcs8300: Add lpass_tlmm node for lpi pinctrl
+    - QCLINUX: arm64: dts: qcom: qcs8300: Add sound node for qcs8300 ridesx target
+    - PENDING: arm64: dts: qcom: qcs8300: Add DisplayPort device node
+    - PENDING: usb: dwc3: Reserve Higher Bandwidth for HS Periodic EPs
+    - QCLINUX: arm64: defconfig: Add configs for Gen5auto targets
+    - QCLINUX: soc: qcom: Fix showing watchdog device attr "disable"
+    - PENDING: QCLINUX: arm64: PCI: qcom: Add support for QCS8300 SoC
+    - QCLINUX: secure-buffer: Minor cleanup
+    - PENDING: phy: qcom-qmp-pcie: add dual lane PHY support for QCS8300
+    - PENDING: pinctrl: qcom: add tlmm driver for sa7255p platform
+    - QCLINUX: arm64: defconfigs: Enable SA7255P Pinctrl
+    - PENDING: ARM64: dts: qcom: Update camera PIL memory to 7MB
+    - PENDING: arm64: dts: qcom: Add dcvsh interrupts
+    - QCLINUX: arm64: dts: qcom: addons: Add TGU components
+    - PENDING: arm64: dts: qcom: Add lpass_stm device
+    - PENDING: arm64: dts: qcom: qcs8300: Add EUD dt node
+    - QCLINUX: arm64: configs: Disable the console for perf build
+    - PENDING: arm64: dts: qcom: qcs8300: enable pcie0 for QCS8300
+    - PENDING: arm64: dts: qcom: qcs8300: Correct IRQ number of EL2 non-secure
+      physical timer
+    - PENDING: QCLINUX: arm64: dts: add pmu node for WCN6855
+    - PENDING: arm64: dts: qcom: qcs8300: add Watchdog
+    - QCLINUX: dcc: Configure the correct bit for MEM_MAP_VER3
+    - QCLINUX: arm64: defconfig: Enable EFI runtime service
+    - QCLINUX: rpmsg: glink: Get reference of channel objects in rx path
+    - PENDING: arm64: dts: qcom: Add support for SA7255p Ride platform
+    - PENDING: arm64: dts: qcom: sa7255p: Add UFS node
+    - PENDING: arm64: dts: qcom: sa7255p: Add USB nodes
+    - QCLINUX: arm64: dts: qcom: Add/Modify board-id and msm-id for V1,v2 and V3
+    - PENDING: arm64: dts: qcom: add the PCIE SMMU node
+    - PENDING: arm64: dts: qcom: Add nodes for Data Capture and Compare
+    - QCLINUX: secure-buffer: Roll-back failed assigns
+    - QCLINUX: dma-heap: qcom: Reclaim pages we failed to hyp-assign
+    - QCLINUX: arm64: dts: qcom: sa8775p: add ride r3 addons dts support
+    - QCLINUX: arm64: dts: qcom: qcs9100: add addons ride dts support
+    - PENDING: pinctrl: qcom: add pdc wakeup irq map for sa7255p
+    - PENDING: slimbus: messaging: Free transaction ID in delayed interrupt
+      scenario
+    - PENDING: clk: qcom: videocc-sa8775p: Increase mvs0c divider to div-3
+    - PENDING: arm64: dts: qcom: Add support for tsens and thermal for SA7255p
+    - PENDING: net: stmmac: dwmac-qcom-ethqos: Add ethernet support for sa8620
+    - PENDING: net: stmmac: Fix SPH feature to support AV packets
+    - PENDING: arm64: dts: qcom: sa8255p: Add PCIe nodes
+    - PENDING: arm64: dts: qcom: Add PCIe SMMU node for SA7255P
+    - QCLINUX: arm64: dts: qcom: addons: Correct the dcc version
+    - QCLINUX: Revert "PENDING: net: phy: aquantia: Fix aquantia driver to
+    - QCLINUX: arm64: dts: qcom: addons: add periphid for TGU
+    - PENDING: arm64: dts: qcom: Add the Adreno SMMU node for SA7255P
+    - QCLINUX: arm64: defconfig: Enable Intel IXGBE driver
+    - PENDING: dt-bindings: arm: qcom,ids: add SoC ID for SA7255P
+    - PENDING: soc: qcom: socinfo: add support for SA7255P SoC
+    - PENDING: arm64: dts: qcom: qcs8300: enable pcie1 for QCS8300
+    - PENDING: arm64: dts: qcom: add support for ipcc
+    - PENDING: arm64: dts: qcom: Add WDT device node for SA7255
+    - PENDING: arm64: dts: qcom: sa8775p: Enable DPTX1 on MDSS0 for SA8775P target
+    - PENDING: arm64: dts: qcom: sa8775p: Enable DPTX1 on MDSS0 for SA8775P target
+    - QCLINUX: arm64: deconfig: enable dm-verity configs
+    - QCLINUX: arm64: deconfig: qcom: disable SOC_DEBUG CONFIG
+    - QCLINUX: arm64: dts: qcom: qcs6490-addons-rb3gen2: Enable camera subsystem
+    - FROMLIST: arm64: dts: qcom: Disable TPDM_GCC for QCS8300
+    - QCLINUX: arm64: defconfig: Enable Aquantia Phy
+    - PENDING: arm64: dts: qcom: sc7280: Update camss driver properties
+    - QCLINUX: usb: dwc3: qcom: Add shutdown callback for qcom wrapper
+    - QCLINUX: drivers: thermal: Add dummy set hysteresis operation for all
+      sensors
+    - PENDING: arm64: dts: qcom: sa7255p: Enable i2c15 for audio
+    - QCLINUX: arm64: deconfig: qcom: enable IOMMU_DEFAULT_DMA_LAZY
+    - PENDING: arm64: dts: qcom: qcs8300: update videocc compatible
+    - PENDING: arm64: dts: qcom: qcs8300: add rdbg nodes
+    - PENDING: arm64: dts: qcom: qcs8300: add TRNG node
+    - QCLINUX: arm64: dts: qcom: Add msm-id/board-id for SA7255P
+    - PENDING: arm64: dts: qcom: sa8775p: Define interconnect bandwidth value in
+      dtsi
+    - PENDING: arm64: qcom: dts: Add psci sys_reset2 modes for SA8255P & SA7255P
+    - PENDING: Bluetooth: Increase settling time for baudrate change VSC
+    - QCLINUX: arm64: dts: qcom: Enable TPM device
+    - PENDING: arm64: dts: qcom: qcs8300: add ICE node
+    - BACKPORT: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
+    - QCLINUX: arm64: dts: qcom: qcs6490-rb3gen2: Move the msm-id and board-id
+    - QCLINUX: arm64: defconfigs: Add configs for Auto targets
+    - FROMLIST: wifi: ath11k: Fix unexpected return buffer manager error for
+      WCN6750/WCN6855
+    - PENDING: soc: qcom: qup_fw: QUP SE Firmware load from Linux
+    - FROMLIST: arm64: dts: qcom: qcs8300: Add PMU support for QCS8300
+    - BACKPORT: FROMLIST: io_uring: Do not set iowait before sleeping
+    - PENDING: dt-bindings: arm: qcom,ids: add SoC ID for SA8797P
+    - PENDING: soc: qcom: socinfo: add support for SA8797P SoC
+    - PENDING: arm64: dts: qcom: qcs8300: Add tz-log node
+    - QCLINUX: arm64: dts: qcom: qcs8300: add dcodec and macro clk
+    - QCLINUX: ASoC: qcm6490: Add AIF3 and AIF4 for qcs8300
+    - PENDING: arm64: dts: qcom: qcs8300: Add spi dev node for qcs8300 ridesx
+      target
+    - PENDING: arm64: dts: qcom: qcs8300: Enable i2c15 node for qcs8300 ridesx
+      target
+    - QCLINUX: arm64: dts: qcom: qcs8300: Enable HS MI2S
+    - PENDING: arm64: dts: qcom: qcs8300: Add shmbridge and smcinvoke nodes
+    - PENDING: arm64: dts: qcom: qcs8300-addons: Add CMA heap
+    - PENDING: drivers: char: fix rdbg driver init sequence
+    - PENDING: arm64: dts: qcom: qcs8300: add QCrypto nodes
+    - QCLINUX: arm64: dts: qcom: addons: Enable mem-buf and secure-buffer for
+      qcs8300
+    - PENDING: clk: qcom: common: Add support to attach multiple power domains
+    - PENDING: clk: qcom: gdsc: Add support to link multiple PDs as GDSC parents
+    - PENDING: clk: qcom: camcc-sa8775p: Add support to attach multiple pds
+    - PENDING: arm64: dts: qcom: Add MXC power domain to camcc node on SA8775P
+    - PENDING: arm64: qcom: dts: qcs8300: Add psci sys_reset2 modes
+    - FROMLIST: dt-bindings: arm: qcom,ids: add SoC ID for QCS9075
+    - FROMLIST: soc: qcom: socinfo: add QCS9075 SoC ID
+    - FROMLIST: arm64: dts: qcom: Add support for QCS9075 RB8
+    - FROMLIST: arm64: dts: qcom: Add support for QCS9075 Ride & Ride-r3
+    - QCLINUX: arm64: dts: qcom: Add msm-id & board-id for qcs9075-rb8
+    - QCLINUX: arm64: dts: qcom: qcs9075: Add msm-id & board-id for ride/ride-r3
+    - PENDING: ARM: dts: qcom: Add ADC thermistor support for SA8775P
+    - PENDING: arm64: dts: qcom: qcs8300: Add adsp memory-region and vmids
+    - PENDING: arm64: dts: qcom: qcs9075-rb8: Add support for remoteproc instances
+    - PENDING: arm64: dts: qcom: qcs9075-rb8: Enable llcc node
+    - FROMLIST: net: stmmac: Add snps_id, dev_id to struct plat_stmmacenet_data
+    - FROMLIST: net: stmmac: Integrate dw25gmac into stmmac hwif handling
+    - QCLINUX:arm64:defconfigs: Enable NO_HZ_FULL for better rcu performance
+    - PENDING: serial: qcom-geni: Support of uart firmware load from Linux
+    - PENDING: spi: geni-qcom: Load spi Firmware from driver probe
+    - PENDING: i2c: qcom-geni: Load i2c Firmware from driver probe
+    - PENDING: arm64: dts: qcom: Disable USB U1/U2 entry for QCS9100/QCS8300
+    - FROMLIST: net: stmmac: Add basic dw25gmac support in stmmac core
+    - QCLINUX: arm64: dts: qcom: qcs9100: Enable DISPLAY-PORT
+    - PENDING: misc: fastrpc: Add support for invoke v2
+    - PENDING: wifi: ath11k: fix wrong overriding for VHT Beamformee STS
+      Capability
+    - QCLINUX: arm64: dts: qcom: Add QPS615 and PHY devicetree config for RC0 for
+      RB3Gen2 ia-mezz
+    - QCLINUX: arm64: dts: qcom: Add support for Eth0 and Eth1 on QPS615 for
+      RB3Gen2 ia-mezz
+    - QCLINUX: arm64: dts: qcom: Add QPS615 and PHY devicestree config for RC1 for
+      RB3gen2 IPC board
+    - QCLINUX: arm64: dts: qcom: Add QPS615 Ethernet support for RC1 for RB3gen2
+      IPC board
+    - PENDING: ARM: dts: qcom: Add support for PMIC peripherals for qcs8300
+    - PENDING: arm64: dts: qcom: sa8775p: Add dma heap for cdsp_secure_heap_mem
+    - PENDING: spi: spi-geni-qcom: Add immediate DMA support
+    - PENDING: arm64: dts: qcom: qcs8300: Add dma heap for cdsp_secure_heap_mem
+    - QCLINUX: ASoC: qcs9100: add HDMI/DP Jack
+    - QCLINUX: arm64: dts: qcom: qcs6490-rb3gen2: disable camss driver
+    - PENDING: net: stmmac: pass stmmac_priv in some callbacks
+    - FROMLIST: arm64: dts: qcom: sa8775p: Update iommu-map entry
+    - PENDING: Bluetooth: clear cmd_sync_work_list when power off
+    - QCLINUX: dma-heap: qcom: Snapshot of dma-buf-carveout-heap
+    - PENDING: clk: qcom: Add support for qdss_xo clock for QCS8300
+    - PENDING: arm64: dts: qcom: Fix dr_mode for secondary port
+    - PENDING: arm64: qcs9075-rb8: Enable PCIe0 & PCIe1 nodes
+    - BACKPORT: PCI: Add ACS quirk for Qualcomm SA8775P
+    - PENDING: Bluetooth: hci_sync: Fix disconnect complete event timeout issue
+    - PENDING: arm64: dts: qcom: qcs8300: Delete duplicate cdsp fastrpc nodes
+    - BACKPORT: PCI: qcom-ep: Add HDMA support for SA8775P SoC
+    - QCLINUX: arm64: defconfigs: convert usb configs to module
+    - PENDING: arm64: dts: qcom: sa8775p: Define interconnect bandwidth value in
+      dtsi
+    - PENDING: arm64: dts: qcom: Enable cpu idle injection for cpu tsens for
+      qcs9100
+    - PENDING: pinctrl: sa8775p: Enable egpio function for pingroups
+    - PENDING: arm64: dts: qcom: Memory map for qcs8300 v1 approved
+    - PENDING: arm-smmu-qcom: program actlr earlier in init to include GPU and GMU
+    - QCLINUX: arm64: defconfig: qcom: Enable EMC2305 Sensor driver
+    - QCLINUX: arm64: dts: qcom: qcs9075: Add support for rb8 addons
+    - QCLINUX: arm64: dts: qcom: qcs9075: Add support for ride/ride-r3 addons
+    - PENDING: arm64: dts: qcom: Add wlan support for qcs9075-rb8
+    - PENDING: arm64: qcs9075-rb8: Config BT bootstrap pin in DTS
+    - FROMLIST: qcom: llcc/edac: Correct interrupt enable register configuration
+    - PENDING: arm64: dts: qcom: Enable cpu idle injection for cpu tsens for
+      qcs9075
+    - QCLINUX: arm64: dts: qcom: Fix dr_mode for non-primary ports
+    - QCLINUX: arm64: dts: qcom: qcs6490-rb3gen2: disable camss driver
+    - BACKPORT: PCI: epf-mhi: Add "pci_epf_mhi_" prefix to the function names
+    - QCLINUX: rpmsg: Align channel objects reference in rx path
+    - QCLINUX: arm64: dts: qcom: qcs6490-addons-rb3gen2: Enable camera subsystem"
+    - PENDING: qcom: ice: Remove ice probe
+    - PENDING: arm64: dts: qcom: qcs9100-rb8: QUP Firmware load from Linux
+    - QCLINUX: arm64: dts: qcom: Enable usb controller on QCS9075 RB8
+    - QCLINUX: arm64: dts: qcom: qcs9075: Add UFS support for QCS9075 RB8
+    - PENDING: arm64: dts: qcom: qcs9075: Add displayport device node
+    - QCLINUX: arm64: dts: qcom: add audio support for qcs9075-rb8
+    - QCLINUX: ASoC: qcm6490: Add support for QCS9075 RB8
+    - QCLINUX: clk: qcom: videocc-sa8775: disable HW CTRL for video GDSC
+    - PENDING: arm64: dts: qcom: update power-domain for display-controller
+    - PENDING: hwmon: Add I2C detection and initialization for EMC2303
+    - BACKPORT: FROMLIST: arm64: dts: qcom: qcs9100: Update memory map  for
+      QCS9100 Ride and QCS9100 Ride Rev3
+    - FROMLIST: usb: misc: usb5807: Add driver
+    - PENDING: USB: Adapt USB5807 driver for IPC hardware design
+    - PENDING: wifi: ath11k: add support for MU EDCA
+    - PENDING: ARM: dts: qcom: Update thermal zone names for qcs8300
+    - PENDING: pinctrl: qcs8300: Update function and group binding
+    - QCLINUX: drm/msm: Avoid probing gpu device
+    - QCLINUX: arm64: dts: qcom: qcs6490-rb3gen2: enable camera sensor
+    - PENDING: arm64: dts: qcom: qcs8300: Add capacity and DPC properties
+    - Revert: ICE eMMC and probe
+    - QCLINUX: arm64: defconfig: Enable GPUCC SA8775P driver as static module
+    - Ubuntu: [Config] update CONFIG options for GA 1.3
+    - Ubuntu: [Config] change CONFIG_USB_DWC3 to y
+    - Ubuntu: [Config] change CONFIG_SENSORS_EMC2305 to y
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 22 Jan 2025 07:54:04 +0900
+
+linux-qcom (6.8.0-1018.18) jammy; urgency=medium
+
+  * "[Canonical][RB3] [ftmdaemon] WlanSetPhyRFMode fail by ftmdaemon tool"
+    - [Config] Enable CONFIG_NL80211_TESTMODE
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 19 Dec 2024 21:02:17 +0900
+
+linux-qcom (6.8.0-1017.17) jammy; urgency=medium
+
+  * Miscellaneous upstream changes
+    - scsi: ufs: qcom: revive the enabled check in ufs_qcom_host_clk_get()
+    - Revert "usb: typec: fsa4480: Relax CHIP_ID check"
+    - Revert "usb: typec: fsa4480: Check if the chip is really there"
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 17 Dec 2024 04:05:48 +0900
+
+linux-qcom (6.8.0-1016.16) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Add Makefile code to apply qcs5430 overlays for GA1.2
+
+  * Miscellaneous upstream changes
+    - msm: camera: isp: Fix warnings
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 10 Dec 2024 15:45:41 +0900
+
+linux-qcom (6.8.0-1015.15) jammy; urgency=medium
+
+  * Noble update: upstream stable patchset 2024-10-02 (LP: #2083488)
+    - [Config] Update CONFIG_SCREEN_INFO
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+
+  * [RB3] CONFIG_KASAN_GENERIC report potential memory bug in tc956x_pcie_eth
+    - SAUCE: ubuntu/qcom/qps615: suppress KASAN error
+
+  * Miscellaneous Ubuntu changes
+    - [Config] set CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND
+
+  [ Ubuntu: 6.8.0-50.51 ]
+
+  * noble/linux: 6.8.0-50.51 -proposed tracker (LP: #2086301)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.10.28)
+  * Noble update: upstream stable patchset 2024-10-31 (LP: #2086138)
+    - device property: Add cleanup.h based fwnode_handle_put() scope based
+      cleanup.
+    - device property: Introduce device_for_each_child_node_scoped()
+    - iio: adc: ad7124: Switch from of specific to fwnode based property handling
+    - ksmbd: override fsids for share path check
+    - ksmbd: override fsids for smb2_query_info()
+    - usbnet: ipheth: remove extraneous rx URB length check
+    - usbnet: ipheth: drop RX URBs with no payload
+    - usbnet: ipheth: do not stop RX on failing RX callback
+    - usbnet: ipheth: fix carrier detection in modes 1 and 4
+    - net: ethernet: use ip_hdrlen() instead of bit shift
+    - drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero
+    - drm: panel-orientation-quirks: Add quirk for Ayn Loki Max
+    - net: phy: vitesse: repair vsc73xx autonegotiation
+    - powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
+    - wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
+    - net: hns3: use correct release function during uninitialization
+    - btrfs: update target inode's ctime on unlink
+    - Input: ads7846 - ratelimit the spi_sync error message
+    - Input: synaptics - enable SMBus for HP Elitebook 840 G2
+    - HID: multitouch: Add support for GT7868Q
+    - scripts: kconfig: merge_config: config files: add a trailing newline
+    - platform/surface: aggregator_registry: Add Support for Surface Pro 10
+    - platform/surface: aggregator_registry: Add support for Surface Laptop Go 3
+    - drm/msm/adreno: Fix error return if missing firmware-name
+    - Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
+    - smb/server: fix return value of smb2_open()
+    - NFSv4: Fix clearing of layout segments in layoutreturn
+    - NFS: Avoid unnecessary rescanning of the per-server delegation list
+    - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
+    - platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array
+    - mptcp: pm: Fix uaf in __timer_delete_sync
+    - arm64: dts: rockchip: fix eMMC/SPI corruption when audio has been used on
+      RK3399 Puma
+    - arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399
+      Puma
+    - minmax: reduce min/max macro expansion in atomisp driver
+    - net: tighten bad gso csum offset check in virtio_net_hdr
+    - dm-integrity: fix a race condition when accessing recalc_sector
+    - x86/hyperv: fix kexec crash due to VP assist page corruption
+    - mm: avoid leaving partial pfn mappings around in error case
+    - arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E
+    - drm/amd/display: Disable error correction if it's not supported
+    - drm/amd/display: Fix FEC_READY write on DP LT
+    - eeprom: digsy_mtc: Fix 93xx46 driver probe failure
+    - cxl/core: Fix incorrect vendor debug UUID define
+    - selftests/bpf: Support SOCK_STREAM in unix_inet_redir_to_connected()
+    - hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >=
+      1.2
+    - ice: Fix lldp packets dropping after changing the number of channels
+    - ice: fix accounting for filters shared by multiple VSIs
+    - ice: fix VSI lists confusion when adding VLANs
+    - igb: Always call igb_xdp_ring_update_tail() under Tx lock
+    - net/mlx5: Update the list of the PCI supported devices
+    - net/mlx5e: Add missing link modes to ptys2ethtool_map
+    - net/mlx5e: Add missing link mode to ptys2ext_ethtool_map
+    - net/mlx5: Explicitly set scheduling element and TSAR type
+    - net/mlx5: Add missing masks and QoS bit masks for scheduling elements
+    - net/mlx5: Correct TASR typo into TSAR
+    - net/mlx5: Verify support for scheduling element and TSAR type
+    - net/mlx5: Fix bridge mode operations when there are no VFs
+    - fou: fix initialization of grc
+    - octeontx2-af: Modify SMQ flush sequence to drop packets
+    - net: ftgmac100: Enable TX interrupt to avoid TX timeout
+    - selftests: net: csum: Fix checksums for packets with non-zero padding
+    - netfilter: nft_socket: fix sk refcount leaks
+    - net: dsa: felix: ignore pending status of TAS module when it's disabled
+    - net: dpaa: Pad packets to ETH_ZLEN
+    - tracing/osnoise: Fix build when timerlat is not enabled
+    - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
+    - drm/syncobj: Fix syncobj leak in drm_syncobj_eventfd_ioctl
+    - dma-buf: heaps: Fix off-by-one in CMA heap fault handler
+    - drm/nouveau/fb: restore init() for ramgp102
+    - drm/amdgpu/atomfirmware: Silence UBSAN warning
+    - drm/amd/amdgpu: apply command submission parser for JPEG v1
+    - spi: geni-qcom: Undo runtime PM changes at driver exit time
+    - spi: geni-qcom: Fix incorrect free_irq() sequence
+    - drm/i915/guc: prevent a possible int overflow in wq offsets
+    - ASoC: codecs: avoid possible garbage value in peb2466_reg_read()
+    - cifs: Fix signature miscalculation
+    - pinctrl: meteorlake: Add Arrow Lake-H/U ACPI ID
+    - ASoC: meson: axg-card: fix 'use-after-free'
+    - drm/mediatek: Set sensible cursor width/height values to fix crash
+    - Input: edt-ft5x06 - add support for FocalTech FT5452 and FT8719
+    - Input: edt-ft5x06 - add support for FocalTech FT8201
+    - cgroup/cpuset: Eliminate unncessary sched domains rebuilds in hotplug
+    - spi: zynqmp-gqspi: Scale timeout by data size
+    - drm/xe: use devm instead of drmm for managed bo
+    - net: libwx: fix number of Rx and Tx descriptors
+    - clocksource: hyper-v: Use lapic timer in a TDX VM without paravisor
+    - bcachefs: Fix bch2_extents_match() false positive
+    - bcachefs: Don't delete open files in online fsck
+    - firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire()
+    - riscv: dts: starfive: jh7110-common: Fix lower rate of CPUfreq by setting
+      PLL0 rate to 1.5GHz
+    - cxl: Restore XOR'd position bits during address translation
+    - netlink: specs: mptcp: fix port endianness
+    - drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct()
+    - drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct()
+    - drm/amd/amdgpu: apply command submission parser for JPEG v2+
+    - drm/xe/client: fix deadlock in show_meminfo()
+    - drm/xe/client: remove bogus rcu list usage
+    - drm/xe/client: add missing bo locking in show_meminfo()
+    - tracing/kprobes: Fix build error when find_module() is not available
+    - drm/xe/display: fix compat IS_DISPLAY_STEP() range end
+    - Upstream stable to v6.6.52, v6.10.11
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849)
+    - KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
+    - KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing
+    - ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius
+      devices
+    - ALSA: hda/realtek: add patch for internal mic in Lenovo V145
+    - ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
+    - ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
+    - ata: libata: Fix memory leak for error path in ata_host_alloc()
+    - irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
+    - x86/kaslr: Expose and use the end of the physical memory address space
+    - nvme-pci: Add sleep quirk for Samsung 990 Evo
+    - rust: types: Make Opaque::get const
+    - rust: macros: provide correct provenance when constructing THIS_MODULE
+    - Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
+    - Bluetooth: MGMT: Ignore keys being loaded with invalid type
+    - mmc: core: apply SD quirks earlier during probe
+    - mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
+    - mmc: sdhci-of-aspeed: fix module autoloading
+    - mmc: cqhci: Fix checking of CQHCI_HALT state
+    - fuse: update stats for pages in dropped aux writeback list
+    - fuse: use unsigned type for getxattr/listxattr size truncation
+    - fuse: fix memory leak in fuse_create_open
+    - clk: starfive: jh7110-sys: Add notifier for PLL0 clock
+    - clk: qcom: clk-alpha-pll: Fix the pll post div mask
+    - clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
+    - kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y
+    - tracing: Avoid possible softlockup in tracing_iter_reset()
+    - tracing/timerlat: Add interface_lock around clearing of kthread in
+      stop_kthread()
+    - net: mctp-serial: Fix missing escapes on transmit
+    - x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported
+    - x86/apic: Make x2apic_disable() work correctly
+    - drm/i915: Do not attempt to load the GSC multiple times
+    - ALSA: control: Apply sanity check of input values for user elements
+    - ALSA: hda: Add input value sanity checks to HDMI channel map controls
+    - wifi: ath12k: fix uninitialize symbol error on ath12k_peer_assoc_h_he()
+    - smack: unix sockets: fix accept()ed socket label
+    - bpf, verifier: Correct tail_call_reachable for bpf prog
+    - accel/habanalabs/gaudi2: unsecure edma max outstanding register
+    - irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
+    - af_unix: Remove put_pid()/put_cred() in copy_peercred().
+    - x86/kmsan: Fix hook for unaligned accesses
+    - iommu: sun50i: clear bypass register
+    - netfilter: nf_conncount: fix wrong variable type
+    - fs/ntfs3: One more reason to mark inode bad
+    - riscv: kprobes: Use patch_text_nosync() for insn slots
+    - media: vivid: fix wrong sizeimage value for mplane
+    - leds: spi-byte: Call of_node_put() on error path
+    - wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
+    - usb: uas: set host status byte on data completion error
+    - drm/amd/display: Check HDCP returned status
+    - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts
+    - media: vivid: don't set HDMI TX controls if there are no HDMI outputs
+    - vfio/spapr: Always clear TCEs before unsetting the window
+    - ice: Check all ice_vsi_rebuild() errors in function
+    - Input: ili210x - use kvmalloc() to allocate buffer for firmware update
+    - media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
+    - pcmcia: Use resource_size function on resource object
+    - drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
+    - can: m_can: Release irq on error in m_can_open
+    - can: mcp251xfd: fix ring configuration when switching from CAN-CC to CAN-FD
+      mode
+    - rust: kbuild: fix export of bss symbols
+    - cifs: Fix FALLOC_FL_ZERO_RANGE to preflush buffered part of target region
+    - igb: Fix not clearing TimeSync interrupts for 82580
+    - platform/x86: dell-smbios: Fix error path in dell_smbios_init()
+    - regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR
+    - can: kvaser_pciefd: Skip redundant NULL pointer check in ISR
+    - can: kvaser_pciefd: Remove unnecessary comment
+    - can: kvaser_pciefd: Rename board_irq to pci_irq
+    - can: kvaser_pciefd: Move reset of DMA RX buffers to the end of the ISR
+    - can: kvaser_pciefd: Use a single write when releasing RX buffers
+    - Bluetooth: qca: If memdump doesn't work, re-enable IBS
+    - Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once
+    - Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT
+    - igc: Unlock on error in igc_io_resume()
+    - ice: do not bring the VSI up, if it was down before the XDP setup
+    - usbnet: modern method to get random MAC
+    - bpf, net: Fix a potential race in do_sock_getsockopt()
+    - bareudp: Fix device stats updates.
+    - r8152: fix the firmware doesn't work
+    - net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
+    - net: dsa: vsc73xx: fix possible subblocks range of CAPT block
+    - selftests: net: enable bind tests
+    - firmware: cs_dsp: Don't allow writes to read-only controls
+    - phy: zynqmp: Take the phy mutex in xlate
+    - ASoC: topology: Properly initialize soc_enum values
+    - dm init: Handle minors larger than 255
+    - iommu/vt-d: Handle volatile descriptor status read
+    - cgroup: Protect css->cgroup write under css_set_lock
+    - devres: Initialize an uninitialized struct member
+    - virtio_ring: fix KMSAN error for premapped mode
+    - crypto: qat - fix unintentional re-enabling of error interrupts
+    - ASoc: TAS2781: replace beXX_to_cpup with get_unaligned_beXX for potentially
+      broken alignment
+    - libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
+    - drm/amdgpu: Set no_hw_access when VF request full GPU fails
+    - ext4: fix possible tid_t sequence overflows
+    - jbd2: avoid mount failed when commit block is partial submitted
+    - dma-mapping: benchmark: Don't starve others when doing the test
+    - drm/amdgpu: reject gang submit on reserved VMIDs
+    - smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
+    - fs/ntfs3: Check more cases when directory is corrupted
+    - btrfs: replace BUG_ON with ASSERT in walk_down_proc()
+    - cxl/region: Verify target positions using the ordered target list
+    - riscv: set trap vector earlier
+    - tcp: Don't drop SYN+ACK for simultaneous connect().
+    - net: dpaa: avoid on-stack arrays of NR_CPUS elements
+    - LoongArch: Use correct API to map cmdline in relocate_kernel()
+    - regmap: maple: work around gcc-14.1 false-positive warning
+    - vfs: Fix potential circular locking through setxattr() and removexattr()
+    - i3c: master: svc: resend target address when get NACK
+    - kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
+    - btrfs: initialize location to fix -Wmaybe-uninitialized in
+      btrfs_lookup_dentry()
+    - s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
+    - usbnet: ipheth: race between ipheth_close and error handling
+    - spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register
+    - ata: pata_macio: Use WARN instead of BUG
+    - NFSv4: Add missing rescheduling points in
+      nfs_client_return_marked_delegations
+    - ACPI: CPPC: Add helper to get the highest performance value
+    - cpufreq: amd-pstate: Enable amd-pstate preferred core support
+    - cpufreq: amd-pstate: fix the highest frequency issue which limits
+      performance
+    - tcp: process the 3rd ACK with sk_socket for TFO/MPTCP
+    - iio: buffer-dmaengine: fix releasing dma channel on error
+    - iio: fix scale application in iio_convert_raw_to_processed_unlocked
+    - iio: adc: ad7124: fix config comparison
+    - iio: adc: ad7606: remove frstdata check for serial mode
+    - iio: adc: ad7124: fix chip ID mismatch
+    - usb: dwc3: core: update LC timer as per USB Spec V3.2
+    - usb: cdns2: Fix controller reset issue
+    - usb: dwc3: Avoid waking up gadget during startxfer
+    - nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
+    - Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
+    - clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
+    - clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
+    - clocksource/drivers/timer-of: Remove percpu irq related code
+    - uprobes: Use kzalloc to allocate xol area
+    - Revert "mm: skip CMA pages when they are not available"
+    - workqueue: wq_watchdog_touch is always called with valid CPU
+    - workqueue: Improve scalability of workqueue watchdog touch
+    - ACPI: processor: Return an error if acpi_processor_get_info() fails in
+      processor_add()
+    - ACPI: processor: Fix memory leaks in error paths of processor_add()
+    - arm64: acpi: Move get_cpu_for_acpi_id() to a header
+    - can: mcp251xfd: mcp251xfd_handle_rxif_ring_uinc(): factor out in separate
+      function
+    - can: mcp251xfd: rx: prepare to workaround broken RX FIFO head index erratum
+    - can: mcp251xfd: clarify the meaning of timestamp
+    - can: mcp251xfd: rx: add workaround for erratum DS80000789E 6 of mcp2518fd
+    - drm/amd: Add gfx12 swizzle mode defs
+    - drm/amdgpu: handle gfx12 in amdgpu_display_verify_sizes
+    - ata: libata-scsi: Remove redundant sense_buffer memsets
+    - ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf
+    - crypto: starfive - Align rsa input data to 32-bit
+    - crypto: starfive - Fix nent assignment in rsa dec
+    - clk: qcom: ipq9574: Update the alpha PLL type for GPLLs
+    - powerpc/64e: remove unused IBM HTW code
+    - powerpc/64e: split out nohash Book3E 64-bit code
+    - powerpc/64e: Define mmu_pte_psize static
+    - powerpc/vdso: Don't discard rela sections
+    - ASoC: tegra: Fix CBB error during probe()
+    - nvme-pci: allocate tagset on reset if necessary
+    - ASoc: SOF: topology: Clear SOF link platform name upon unload
+    - ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
+    - clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs
+    - clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time
+    - drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
+    - drm/i915/fence: Mark debug_fence_free() with __maybe_unused
+    - gpio: rockchip: fix OF node leak in probe()
+    - gpio: modepin: Enable module autoloading
+    - riscv: Fix toolchain vector detection
+    - riscv: Do not restrict memory size because of linear mapping on nommu
+    - membarrier: riscv: Add full memory barrier in switch_mm()
+    - [Config] updateconfigs for ARCH_HAS_MEMBARRIER_CALLBACKS
+    - x86/mm: Fix PTI for i386 some more
+    - btrfs: fix race between direct IO write and fsync when using same fd
+    - spi: spi-fsl-lpspi: Fix off-by-one in prescale max
+    - ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx
+    - ALSA: hda/realtek - Fix inactive headset mic jack for ASUS Vivobook 15
+      X1504VAP
+    - fuse: clear PG_uptodate when using a stolen page
+    - riscv: misaligned: remove CONFIG_RISCV_M_MODE specific code
+    - parisc: Delay write-protection until mark_rodata_ro() call
+    - pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now
+    - maple_tree: remove rcu_read_lock() from mt_validate()
+    - Revert "wifi: ath11k: restore country code during resume"
+    - btrfs: qgroup: don't use extent changeset when not needed
+    - btrfs: zoned: handle broken write pointer on zones
+    - drm/xe/gsc: Do not attempt to load the GSC multiple times
+    - drm/amdgpu: always allocate cleared VRAM for GEM allocations
+    - drm/amd/display: Lock DC and exit IPS when changing backlight
+    - ALSA: hda/realtek: extend quirks for Clevo V5[46]0
+    - cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition
+    - virt: sev-guest: Mark driver struct with __refdata to prevent section
+      mismatch
+    - media: b2c2: flexcop-usb: fix flexcop_usb_memory_req
+    - gve: Add adminq mutex lock
+    - wifi: rtw89: wow: prevent to send unexpected H2C during download Firmware
+    - drm/amdgpu: add missing error handling in function
+      amdgpu_gmc_flush_gpu_tlb_pasid
+    - crypto: qat - initialize user_input.lock for rate_limiting
+    - locking: Add rwsem_assert_held() and rwsem_assert_held_write()
+    - fs: don't copy to userspace under namespace semaphore
+    - fs: relax permissions for statmount()
+    - seccomp: release task filters when the task exits
+    - drm/amdgpu/display: handle gfx12 in amdgpu_dm_plane_format_mod_supported
+    - can: m_can: Remove m_can_rx_peripheral indirection
+    - can: m_can: Do not cancel timer from within timer
+    - mm: Provide a means of invalidation without using launder_folio
+    - cifs: Fix copy offload to flush destination region
+    - hwmon: ltc2991: fix register bits defines
+    - scripts: fix gfp-translate after ___GFP_*_BITS conversion to an enum
+    - ptp: ocp: convert serial ports to array
+    - ptp: ocp: adjust sysfs entries to expose tty information
+    - ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
+    - ice: remove ICE_CFG_BUSY locking from AF_XDP code
+    - net: xilinx: axienet: Fix race in axienet_stop
+    - iommu/vt-d: Remove control over Execute-Requested requests
+    - block: don't call bio_uninit from bio_endio
+    - tracing/kprobes: Add symbol counting check when module loads
+    - perf/x86/intel: Hide Topdown metrics events if the feature is not enumerated
+    - PCI: qcom: Override NO_SNOOP attribute for SA8775P RC
+    - staging: vchiq_core: Bubble up wait_event_interruptible() return value
+    - watchdog: imx7ulp_wdt: keep already running watchdog enabled
+    - btrfs: slightly loosen the requirement for qgroup removal
+    - drm/amdgpu: add PSP RAS address query command
+    - drm/amdgpu: add mutex to protect ras shared memory
+    - s390/boot: Do not assume the decompressor range is reserved
+    - drm/amdgpu: Fix two reset triggered in a row
+    - drm/amdgpu: Add reset_context flag for host FLR
+    - drm/amdgpu: Fix amdgpu_device_reset_sriov retry logic
+    - fs: only copy to userspace on success in listmount()
+    - iio: adc: ad7124: fix DT configuration parsing
+    - nvmem: u-boot-env: error if NVMEM device is too small
+    - mm: zswap: rename is_zswap_enabled() to zswap_is_enabled()
+    - mm/memcontrol: respect zswap.writeback setting from parent cg too
+    - path: add cleanup helper
+    - fs: simplify error handling
+    - fs: relax permissions for listmount()
+    - hid: bpf: add BPF_JIT dependency
+    - net/mlx5e: SHAMPO, Use KSMs instead of KLMs
+    - net/mlx5e: SHAMPO, Fix page leak
+    - drm/xe/xe2: Add workaround 14021402888
+    - drm/xe/xe2lpg: Extend workaround 14021402888
+    - clk: qcom: gcc-x1e80100: Fix USB 0 and 1 PHY GDSC pwrsts flags
+    - clk: qcom: gcc-x1e80100: Don't use parking clk_ops for QUPs
+    - nouveau: fix the fwsec sb verification register.
+    - riscv: Add tracepoints for SBI calls and returns
+    - riscv: Improve sbi_ecall() code generation by reordering arguments
+    - riscv: Fix RISCV_ALTERNATIVE_EARLY
+    - cifs: Fix zero_point init on inode initialisation
+    - nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err
+    - nvme: fix status magic numbers
+    - nvme: rename CDR/MORE/DNR to NVME_STATUS_*
+    - nvmet: Identify-Active Namespace ID List command should reject invalid nsid
+    - drm/i915/display: Add mechanism to use sink model when applying quirk
+    - drm/i915/display: Increase Fast Wake Sync length as a quirk
+    - LoongArch: Use accessors to page table entries instead of direct dereference
+    - Upstream stable to v6.6.51, v6.10.10
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46823
+    - kunit/overflow: Fix UB in overflow_allocation_test
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46834
+    - ethtool: fail closed if we can't get max channel used in indirection tables
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46751
+    - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46753
+    - btrfs: handle errors from btrfs_dec_ref() properly
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46841
+    - btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in
+      walk_down_proc()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46754
+    - bpf: Remove tst_run from lwt_seg6local_prog_ops.
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46824
+    - iommufd: Require drivers to supply the cache_invalidate_user ops
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46842
+    - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46766
+    - ice: move netif_queue_set_napi to rtnl-protected sections
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46772
+    - drm/amd/display: Check denominator crb_pipes before used
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46774
+    - powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46775
+    - drm/amd/display: Validate function returns
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46778
+    - drm/amd/display: Check UnboundedRequestEnabled's value
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46779
+    - drm/imagination: Free pvr_vm_gpuva after unlink
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46792
+    - riscv: misaligned: Restrict user access to kernel memory
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46793
+    - ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46735
+    - ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46737
+    - nvmet-tcp: fix kernel crash if commands allocation fails
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46822
+    - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46713
+    - perf/aux: Fix AUX buffer serialization
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46739
+    - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46740
+    - binder: fix UAF caused by offsets overwrite
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46741
+    - misc: fastrpc: Fix double free of 'buf' in error path
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47663
+    - staging: iio: frequency: ad9834: Validate frequency parameter value
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46832
+    - MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47668
+    - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46744
+    - Squashfs: sanity check symbolic link size
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46745
+    - Input: uinput - reject requests with unreasonable number of slots
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46746
+    - HID: amd_sfh: free driver_data after destroying hid device
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47664
+    - spi: hisi-kunpeng: Add verification for the max_frequency provided by the
+      firmware
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47665
+    - i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46749
+    - Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46750
+    - PCI: Add missing bridge lock to pci_bus_lock()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46752
+    - btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46840
+    - btrfs: clean up our handling of refs == 0 in snapshot delete
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46755
+    - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47666
+    - scsi: pm80xx: Set phy->enable_completion only when we wait for it
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46843
+    - scsi: ufs: core: Remove SCSI host only if added
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46760
+    - wifi: rtw88: usb: schedule rx work after everything is set up
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46761
+    - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46844
+    - um: line: always fill *error_out in setup_one_line()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46762
+    - xen: privcmd: Fix possible access to a freed kirqfd instance
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46763
+    - fou: Fix null-ptr-deref in GRO.
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46765
+    - ice: protect XDP configuration with a mutex
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46767
+    - net: phy: Fix missing of_node_put() for leds
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46768
+    - hwmon: (hp-wmi-sensors) Check if WMI event data exists
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46770
+    - ice: Add netif_device_attach/detach into PF reset flow
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46771
+    - can: bcm: Remove proc entry when dev is unregistered.
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46773
+    - drm/amd/display: Check denominator pbn_div before used
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47667
+    - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46835
+    - drm/amdgpu: Fix smatch static checker warning
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46776
+    - drm/amd/display: Run DC_LOG_DC after checking link->link_enc
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46836
+    - usb: gadget: aspeed_udc: validate endpoint index for ast udc
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46777
+    - udf: Avoid excessive partition lengths
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46825
+    - wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46826
+    - ELF: fix kernel.randomize_va_space double read
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46827
+    - wifi: ath12k: fix firmware crash due to invalid peer nss
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47669
+    - nilfs2: fix state management in error path of log writing function
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46780
+    - nilfs2: protect references to superblock parameters exposed in sysfs
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46781
+    - nilfs2: fix missing cleanup on rollforward recovery error
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46828
+    - sched: sch_cake: fix bulk flow accounting logic for host fairness
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46782
+    - ila: call nf_unregister_net_hooks() sooner
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46783
+    - tcp_bpf: fix return value of tcp_bpf_sendmsg()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46784
+    - net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46785
+    - eventfs: Use list_del_rcu() for SRCU protected list variable
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46786
+    - fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46787
+    - userfaultfd: fix checks for huge PMDs
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46838
+    - userfaultfd: don't BUG_ON() if khugepaged yanks our page table
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46845
+    - tracing/timerlat: Only clear timer if a kthread exists
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46788
+    - tracing/osnoise: Use a cpumask to know what threads are kthreads
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46846
+    - spi: rockchip: Resolve unbalanced runtime PM / system PM handling
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46847
+    - mm: vmalloc: ensure vmap_block is initialised before adding to queue
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46791
+    - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46829
+    - rtmutex: Drop rt_mutex::wait_lock before scheduling
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46848
+    - perf/x86/intel: Limit the period on Haswell
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46794
+    - x86/tdx: Fix data leak in mmio_read()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46795
+    - ksmbd: unset the binding mark of a reused connection
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46797
+    - powerpc/qspinlock: Fix deadlock in MCS queue
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46830
+    - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46798
+    - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46831
+    - net: microchip: vcap: Fix use-after-free error in kunit test
+  * Navi24 RX6300 light up issue on 6.8 kernel (LP: #2084513)
+    - drm/amd/display: Ensure populate uclk in bb construction
+  * Noble update: upstream stable patchset 2024-10-18 (LP: #2084941)
+    - drm/fb-helper: Don't schedule_work() to flush frame buffer during panic()
+    - drm: panel-orientation-quirks: Add quirk for OrangePi Neo
+    - scsi: ufs: core: Check LSDBS cap when !mcq
+    - scsi: ufs: core: Bypass quick recovery if force reset is needed
+    - btrfs: tree-checker: validate dref root and objectid
+    - ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
+    - ALSA: hda/conexant: Mute speakers at suspend / shutdown
+    - ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
+    - ALSA: ump: Explicitly reset RPN with Null RPN
+    - ALSA: seq: ump: Use the common RPN/bank conversion context
+    - ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
+    - ALSA: seq: ump: Explicitly reset RPN with Null RPN
+    - net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule
+    - ASoC: amd: yc: Support mic on HP 14-em0002la
+    - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
+    - i2c: Fix conditional for substituting empty ACPI functions
+    - dma-debug: avoid deadlock between dma debug vs printk and netconsole
+    - net: usb: qmi_wwan: add MeiG Smart SRM825L
+    - ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
+    - ASoC: codecs: ES8326: button detect issue
+    - selftests: mptcp: userspace pm create id 0 subflow
+    - selftests: mptcp: dump userspace addrs list
+    - selftests: mptcp: userspace pm get addr tests
+    - selftests: mptcp: declare event macros in mptcp_lib
+    - selftests: mptcp: join: cannot rm sf if closed
+    - selftests: mptcp: add explicit test case for remove/readd
+    - selftests: mptcp: join: check re-using ID of unused ADD_ADDR
+    - selftests: mptcp: join: check re-adding init endp with != id
+    - selftests: mptcp: add mptcp_lib_events helper
+    - selftests: mptcp: join: validate event numbers
+    - selftests: mptcp: join: check re-re-adding ID 0 signal
+    - selftests: mptcp: join: test for flush/re-add endpoints
+    - selftests: mptcp: join: disable get and dump addr checks
+    - selftests: mptcp: join: stop transfer when check is done (part 2.2)
+    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
+    - drm/amd/display: Assign linear_pitch_alignment even for VM
+    - drm/amdgpu: fix overflowed array index read warning
+    - drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
+    - drm/amd/pm: fix uninitialized variable warning
+    - drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
+    - drm/amd/pm: fix warning using uninitialized value of max_vid_step
+    - drm/amd/pm: Fix negative array index read
+    - drm/amd/pm: fix the Out-of-bounds read warning
+    - drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
+    - drm/amdgpu: avoid reading vf2pf info size from FB
+    - drm/amd/display: Check gpio_id before used as array index
+    - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
+    - drm/amd/display: Check index for aux_rd_interval before using
+    - drm/amd/display: Add array index check for hdcp ddc access
+    - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
+    - drm/amd/display: Check msg_id before processing transcation
+    - drm/amd/display: Fix Coverity INTERGER_OVERFLOW within
+      construct_integrated_info
+    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
+      dal_gpio_service_create
+    - drm/amd/display: Spinlock before reading event
+    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
+      decide_fallback_link_setting_max_bw_policy
+    - drm/amd/display: Ensure index calculation will not overflow
+    - drm/amd/display: Skip inactive planes within
+      ModeSupportAndSystemConfiguration
+    - drm/amd/display: Fix index may exceed array range within
+      fpu_update_bw_bounding_box
+    - drm/amd/amdgpu: Check tbo resource pointer
+    - drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
+    - drm/amdgpu/pm: Fix uninitialized variable warning for smu10
+    - drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
+    - drm/amdgpu: Fix the uninitialized variable warning
+    - drm/amdkfd: Check debug trap enable before write dbg_ev_file
+    - drm/amdkfd: Reconcile the definition and use of oem_id in struct
+      kfd_topology_device
+    - apparmor: fix possible NULL pointer dereference
+    - wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem()
+    - wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem()
+    - drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy
+      SOCs
+    - drm/amdgpu: Fix the warning division or modulo by zero
+    - drm/amdgpu: fix dereference after null check
+    - drm/amdgpu: fix the waring dereferencing hive
+    - drm/amd/pm: check specific index for aldebaran
+    - drm/amd/pm: check specific index for smu13
+    - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
+    - drm/amd/pm: check negtive return for table entries
+    - wifi: rtw89: ser: avoid multiple deinit on same CAM
+    - drm/kfd: Correct pinned buffer handling at kfd restore and validate process
+    - drm/amdgpu: update type of buf size to u32 for eeprom functions
+    - wifi: iwlwifi: remove fw_running op
+    - cpufreq: scmi: Avoid overflow of target_freq in fast switch
+    - PCI: al: Check IORESOURCE_BUS existence during probe
+    - wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
+    - hwspinlock: Introduce hwspin_lock_bust()
+    - soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
+    - RDMA/efa: Properly handle unexpected AQ completions
+    - ionic: fix potential irq name truncation
+    - pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
+    - rcu/nocb: Remove buggy bypass lock contention mitigation
+    - media: v4l2-cci: Always assign *val
+    - usbip: Don't submit special requests twice
+    - usb: typec: ucsi: Fix null pointer dereference in trace
+    - fsnotify: clear PARENT_WATCHED flags lazily
+    - net: remove NULL-pointer net parameter in ip_metrics_convert
+    - drm/amdgu: fix Unintentional integer overflow for mall size
+    - regmap: spi: Fix potential off-by-one when calculating reserved size
+    - smack: tcp: ipv4, fix incorrect labeling
+    - platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
+    - net/mlx5e: SHAMPO, Fix incorrect page release
+    - drm/meson: plane: Add error handling
+    - crypto: stm32/cryp - call finalize with bh disabled
+    - gfs2: Revert "Add quota_change type"
+    - drm/bridge: tc358767: Check if fully initialized before signalling HPD event
+      via IRQ
+    - dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while invoking
+      callbacks
+    - dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
+    - hwmon: (k10temp) Check return value of amd_smn_read()
+    - wifi: cfg80211: make hash table duplicates more survivable
+    - f2fs: fix to do sanity check on blocks for inline_data inode
+    - driver: iio: add missing checks on iio_info's callback access
+    - block: remove the blk_flush_integrity call in blk_integrity_unregister
+    - drm/amdgpu: add skip_hw_access checks for sriov
+    - drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
+    - drm/amdgpu: add lock in kfd_process_dequeue_from_device
+    - drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay
+    - drm/amd/display: added NULL check at start of dc_validate_stream
+    - drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
+    - drm/amd/display: use preferred link settings for dp signal only
+    - drm/amd/display: Check BIOS images before it is used
+    - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
+    - media: uvcvideo: Enforce alignment of frame and interval
+    - virtio_net: Fix napi_skb_cache_put warning
+    - i2c: Use IS_REACHABLE() for substituting empty ACPI functions
+    - btrfs: factor out stripe length calculation into a helper
+    - btrfs: scrub: update last_physical after scrubbing one stripe
+    - btrfs: fix qgroup reserve leaks in cow_file_range
+    - virtio-net: check feature before configuring the vq coalescing command
+    - drm/amd/display: Handle the case which quad_part is equal 0
+    - drm/amdgpu: Handle sg size limit for contiguous allocation
+    - drm/amd/pm: fix uninitialized variable warning for smu_v13
+    - drm/amdgpu: fix uninitialized scalar variable warning
+    - drm/amd/display: Ensure array index tg_inst won't be -1
+    - drm/amd/display: handle invalid connector indices
+    - drm/amd/display: Increase MAX_LINKS by 2
+    - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than
+      max_links
+    - drm/amd/display: Fix incorrect size calculation for loop
+    - drm/amd/display: Use kcalloc() instead of kzalloc()
+    - drm/amd/display: Add missing NULL pointer check within
+      dpcd_extend_address_range
+    - drm/amd/display: Release state memory if amdgpu_dm_create_color_properties
+      fail
+    - drm/amd/display: Check link_index before accessing dc->links[]
+    - drm/amd/display: Add otg_master NULL check within
+      resource_log_pipe_topology_update
+    - drm/amd/display: Release clck_src memory if clk_src_construct fails
+    - drm/amd/display: Fix writeback job lock evasion within dm_crtc_high_irq
+    - drm/xe: Demote CCS_MODE info to debug only
+    - drm/drm-bridge: Drop conditionals around of_node pointers
+    - drm/amdgpu: fix uninitialized variable warning for amdgpu_xgmi
+    - drm/amdgpu: fix uninitialized variable warning for jpeg_v4
+    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_info_ioctl
+    - wifi: ath12k: initialize 'ret' in ath12k_dp_rxdma_ring_sel_config_wcn7850()
+    - drm/amdgpu/pm: Check input value for power profile setting on smu11, smu13
+      and smu14
+    - drm/xe: Fix the warning conditions
+    - drm/amd/display: Fix pipe addition logic in calc_blocks_to_ungate DCN35
+    - wifi: cfg80211: restrict operation during radar detection
+    - remoteproc: qcom_q6v5_pas: Add hwspinlock bust on stop
+    - tcp: annotate data-races around tw->tw_ts_recent and tw->tw_ts_recent_stamp
+    - drm/xe: Don't overmap identity VRAM mapping
+    - net: tcp/dccp: prepare for tw_timer un-pinning
+    - drm/xe: Ensure caller uses sole domain for xe_force_wake_assert_held
+    - drm/xe: Check valid domain is passed in xe_force_wake_ref
+    - thermal: trip: Use READ_ONCE() for lockless access to trip properties
+    - drm/xe: Add GuC state asserts to deregister_exec_queue
+    - drm/amdgpu: fix overflowed constant warning in mmhub_set_clockgating()
+    - drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection
+    - drm/amd/display: Disable DMCUB timeout for DCN35
+    - drm/amd/display: Avoid overflow from uint32_t to uint8_t
+    - pinctrl: core: reset gpio_device in loop in pinctrl_pins_show()
+    - Upstream stable to v6.6.50, v6.10.9
+  * CVE-2024-46747
+    - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
+  * CVE-2024-46725
+    - drm/amdgpu: Fix out-of-bounds write warning
+  * CVE-2024-46724
+    - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
+  * [SRU] Fix AST DP output after resume (LP: #2083022)
+    - drm/ast: Inline drm_simple_encoder_init()
+    - drm/ast: Implement atomic enable/disable for encoders
+    - drm/ast: Program mode for AST DP in atomic_mode_set
+    - drm/ast: Move mode-setting code into mode_set_nofb CRTC helper
+    - drm/ast: Handle primary-plane format setup in atomic_update
+    - drm/ast: Remove gamma LUT updates from DPMS code
+    - drm/ast: Only set VGA SCREEN_DISABLE bit in CRTC code
+    - drm/ast: Inline ast_crtc_dpms() into callers
+    - drm/ast: Use drm_atomic_helper_commit_tail() helper
+  * UBSAN array-index-out-of-bounds reported with N-6.8 on P9 node baltar
+    (LP: #2078038)
+    - scripts/kernel-doc: reindent
+    - compiler_types: add Endianness-dependent __counted_by_{le, be}
+    - scsi: aacraid: union aac_init: Replace 1-element array with flexible array
+    - scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array with
+      flexible array
+    - scsi: aacraid: Rearrange order of struct aac_srb_unit
+    - scsi: aacraid: struct {user, }sgmap{, 64, raw}: Replace 1-element arrays
+      with flexible arrays
+  * r8169: transmit queue 0 timed out error when re-plugging the Ethernet cable
+    (LP: #2084526)
+    - r8169: disable ALDPS per default for RTL8125
+  * [SRU] cpufreq: intel_pstate: Support Emerald Rapids OOB mode (LP: #2084834)
+    - cpufreq: intel_pstate: Support Emerald Rapids OOB mode
+  * CVE-2024-46723
+    - drm/amdgpu: fix ucode out-of-bounds read warning
+  * CVE-2024-46743
+    - of/irq: Prevent device address out-of-bounds read in interrupt map walk
+  * CVE-2024-46757
+    - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
+  * [SRU] Ubuntu 24.04 - GPU cannot be installed with DL380a Gen12 (2P, SRF-SP)
+    (LP: #2081079)
+    - perf/x86/uncore: Save the unit control address of all units
+    - perf/x86/uncore: Support per PMU cpumask
+    - perf/x86/uncore: Retrieve the unit ID from the unit control RB tree
+    - perf/x86/uncore: Apply the unit control RB tree to MMIO uncore units
+    - perf/x86/uncore: Apply the unit control RB tree to MSR uncore units
+    - perf/x86/uncore: Apply the unit control RB tree to PCI uncore units
+    - perf/x86/uncore: Cleanup unused unit structure
+    - perf/x86/intel/uncore: Support HBM and CXL PMON counters
+  * Noble update: upstream stable patchset 2024-10-11 (LP: #2084225)
+    - ALSA: seq: Skip event type filtering for UMP events
+    - LoongArch: Remove the unused dma-direct.h
+    - btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()
+    - btrfs: run delayed iputs when flushing delalloc
+    - smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
+    - pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
+    - pinctrl: single: fix potential NULL dereference in pcs_get_function()
+    - wifi: wfx: repair open network AP mode
+    - wifi: mwifiex: duplicate static structs used in driver instances
+    - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
+    - mptcp: close subflow when receiving TCP+FIN
+    - mptcp: sched: check both backup in retrans
+    - mptcp: pm: reuse ID 0 after delete and re-add
+    - mptcp: pm: skip connecting to already established sf
+    - mptcp: pm: reset MPC endp ID when re-added
+    - mptcp: pm: send ACK on an active subflow
+    - mptcp: pm: do not remove already closed subflows
+    - mptcp: pm: fix ID 0 endp usage after multiple re-creations
+    - mptcp: pm: ADD_ADDR 0 is not a new address
+    - selftests: mptcp: join: check removing ID 0 endpoint
+    - selftests: mptcp: join: no extra msg if no counter
+    - selftests: mptcp: join: check re-re-adding ID 0 endp
+    - drm/amdgpu/swsmu: always force a state reprogram on init
+    - drm/vmwgfx: Fix prime with external buffers
+    - usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister
+      existing source caps before re-registration"
+    - ASoC: amd: acp: fix module autoloading
+    - ASoC: SOF: amd: Fix for acp init sequence
+    - pinctrl: mediatek: common-v2: Fix broken bias-disable for
+      PULL_PU_PD_RSEL_TYPE
+    - pinctrl: starfive: jh7110: Correct the level trigger configuration of iev
+      register
+    - ovl: pass string to ovl_parse_layer()
+    - ovl: fix wrong lowerdir number check for parameter Opt_lowerdir
+    - ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err
+    - mm: Fix missing folio invalidation calls during truncation
+    - cifs: Fix FALLOC_FL_PUNCH_HOLE support
+    - selinux,smack: don't bypass permissions check in inode_setsecctx hook
+    - iommufd: Do not allow creating areas without READ or WRITE
+    - phy: fsl-imx8mq-usb: fix tuning parameter name
+    - dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA
+    - dmaengine: dw-edma: Do not enable watermark interrupts for HDMA
+    - phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
+    - dmaengine: dw: Add peripheral bus width verification
+    - dmaengine: dw: Add memory bus width verification
+    - Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test
+    - Bluetooth: btnxpuart: Handle FW Download Abort scenario
+    - Bluetooth: btnxpuart: Fix random crash seen while removing driver
+    - Bluetooth: hci_core: Fix not handling hibernation actions
+    - iommu: Do not return 0 from map_pages if it doesn't do anything
+    - netfilter: nf_tables: restore IP sanity checks for netdev/egress
+    - wifi: iwlwifi: fw: fix wgds rev 3 exact size
+    - ethtool: check device is present when getting link settings
+    - netfilter: nf_tables_ipv6: consider network offset in netdev/egress
+      validation
+    - selftests: forwarding: no_forwarding: Down ports on cleanup
+    - selftests: forwarding: local_termination: Down ports on cleanup
+    - bonding: implement xdo_dev_state_free and call it after deletion
+    - bonding: extract the use of real_device into local variable
+    - bonding: change ipsec_lock from spin lock to mutex
+    - gtp: fix a potential NULL pointer dereference
+    - sctp: fix association labeling in the duplicate COOKIE-ECHO case
+    - drm/amd/display: avoid using null object of framebuffer
+    - net: busy-poll: use ktime_get_ns() instead of local_clock()
+    - nfc: pn533: Add poll mod list filling check
+    - soc: qcom: cmd-db: Map shared memory as WC, not WB
+    - soc: qcom: pmic_glink: Actually communicate when remote goes down
+    - soc: qcom: pmic_glink: Fix race during initialization
+    - cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
+    - scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress
+    - USB: serial: option: add MeiG Smart SRM825L
+    - ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design
+    - usb: dwc3: omap: add missing depopulate in probe error path
+    - usb: dwc3: core: Prevent USB core invalid event buffer address access
+    - usb: dwc3: st: fix probed platform device ref count on probe error path
+    - usb: dwc3: st: add missing depopulate in probe error path
+    - usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
+      remove_power_attributes()
+    - usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
+    - usb: cdnsp: fix for Link TRB with TC
+    - ARM: dts: omap3-n900: correct the accelerometer orientation
+    - arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962
+    - arm64: dts: imx93: add nvmem property for fec1
+    - arm64: dts: imx93: add nvmem property for eqos
+    - arm64: dts: imx93: update default value for snps,clk-csr
+    - arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges
+    - arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo
+    - scsi: aacraid: Fix double-free on probe failure
+    - apparmor: fix policy_unpack_test on big endian systems
+    - mptcp: pr_debug: add missing \n at the end
+    - mptcp: make pm_remove_addrs_and_subflows static
+    - mptcp: pm: fix RM_ADDR ID for the initial subflow
+    - mptcp: avoid duplicated SUB_CLOSED events
+    - drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict
+    - drm/vmwgfx: Prevent unmapping active read buffers
+    - drm/vmwgfx: Disable coherent dumb buffers without 3d
+    - firmware/sysfb: Set firmware-framebuffer parent device
+    - firmware/sysfb: Create firmware device only for enabled PCI devices
+    - video/aperture: optionally match the device in sysfb_disable()
+    - drm/xe: Prepare display for D3Cold
+    - drm/xe/display: Make display suspend/resume work on discrete
+    - drm/xe/vm: Simplify if condition
+    - drm/xe/exec_queue: Rename xe_exec_queue::compute to xe_exec_queue::lr
+    - drm/xe: prevent UAF around preempt fence
+    - pinctrl: qcom: x1e80100: Update PDC hwirq map
+    - ASoC: SOF: amd: move iram-dram fence register programming sequence
+    - nfsd: ensure that nfsd4_fattr_args.context is zeroed out
+    - backing-file: convert to using fops->splice_write
+    - pinctrl: qcom: x1e80100: Fix special pin offsets
+    - afs: Fix post-setattr file edit to do truncation correctly
+    - netfs: Fix netfs_release_folio() to say no if folio dirty
+    - netfs: Fix missing iterator reset on retry of short read
+    - dmaengine: ti: omap-dma: Initialize sglen after allocation
+    - pktgen: use cpus_read_lock() in pg_net_init()
+    - net_sched: sch_fq: fix incorrect behavior for small weights
+    - tcp: fix forever orphan socket caused by tcp_abort
+    - drm/xe/hwmon: Fix WRITE_I1 param from u32 to u16
+    - usb: typec: fsa4480: Relax CHIP_ID check
+    - firmware: qcom: scm: Mark get_wq_ctx() as atomic call
+    - usb: gadget: uvc: queue pump work in uvcg_video_enable()
+    - usb: dwc3: xilinx: add missing depopulate in probe error path
+    - usb: typec: ucsi: Move unregister out of atomic section
+    - firmware: microchip: fix incorrect error report of programming:timeout on
+      success
+    - Upstream stable to v6.6.49, v6.10.8
+  * Fix blank screen on external display after reconnecting the USB type-C
+    (LP: #2081786) // Noble update: upstream stable patchset 2024-10-11
+    (LP: #2084225)
+    - drm/i915/display: add intel_display -> drm_device backpointer
+    - drm/i915/display: add generic to_intel_display() macro
+    - drm/i915/dp_mst: Fix MST state after a sink reset
+  * Noble update: upstream stable patchset 2024-10-09 (LP: #2084005)
+    - tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
+    - tty: atmel_serial: use the correct RTS flag.
+    - Revert "ACPI: EC: Evaluate orphan _REG under EC device"
+    - Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"
+    - Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET"
+    - selinux: revert our use of vma_is_initial_heap()
+    - fuse: Initialize beyond-EOF page contents before setting uptodate
+    - char: xillybus: Don't destroy workqueue from work item running on it
+    - char: xillybus: Refine workqueue handling
+    - char: xillybus: Check USB endpoints when probing device
+    - ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
+    - ALSA: usb-audio: Support Yamaha P-125 quirk entry
+    - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
+    - thunderbolt: Mark XDomain as unplugged when router is removed
+    - ALSA: hda/tas2781: fix wrong calibrated data order
+    - s390/dasd: fix error recovery leading to data corruption on ESE devices
+    - KVM: s390: fix validity interception issue when gisa is switched off
+    - riscv: change XIP's kernel_map.size to be size of the entire kernel
+    - i2c: tegra: Do not mark ACPI devices as irq safe
+    - ACPICA: Add a depth argument to acpi_execute_reg_methods()
+    - ACPI: EC: Evaluate _REG outside the EC scope more carefully
+    - arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to
+      NUMA_NO_NODE
+    - dm resume: don't return EINVAL when signalled
+    - dm persistent data: fix memory allocation failure
+    - fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
+    - s390/cio: rename bitmap_size() -> idset_bitmap_size()
+    - btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
+    - bitmap: introduce generic optimized bitmap_size()
+    - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
+    - i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
+    - rtla/osnoise: Prevent NULL dereference in error handling
+    - net: mana: Fix RX buf alloc_size alignment and atomic op panic
+    - net: mana: Fix doorbell out of order violation and avoid unnecessary
+      doorbell rings
+    - wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
+    - selinux: fix potential counting error in avc_add_xperms_decision()
+    - selinux: add the processing of the failure of avc_add_xperms_decision()
+    - mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu
+    - btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type
+    - btrfs: zoned: properly take lock to read/update block group's zoned
+      variables
+    - btrfs: tree-checker: add dev extent item checks
+    - drm/amdgpu: Actually check flags for all context ops.
+    - memcg_write_event_control(): fix a user-triggerable oops
+    - drm/amdgpu/jpeg2: properly set atomics vmid field
+    - drm/amdgpu/jpeg4: properly set atomics vmid field
+    - s390/uv: Panic for set and remove shared access UVC errors
+    - bpf: Fix updating attached freplace prog in prog_array map
+    - igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
+    - igc: Fix qbv_config_change_errors logics
+    - igc: Fix reset adapter logics when tx mode change
+    - net/mlx5e: Take state lock during tx timeout reporter
+    - net/mlx5e: Correctly report errors for ethtool rx flows
+    - net: axienet: Fix register defines comment description
+    - net: dsa: vsc73xx: pass value in phy_write operation
+    - net: dsa: vsc73xx: use read_poll_timeout instead delay loop
+    - net: dsa: vsc73xx: check busy flag in MDIO operations
+    - net: ethernet: mtk_wed: fix use-after-free panic in
+      mtk_wed_setup_tc_block_cb()
+    - mlxbf_gige: disable RX filters until RX path initialized
+    - mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
+    - tcp: Update window clamping condition
+    - netfilter: allow ipv6 fragments to arrive on different devices
+    - netfilter: flowtable: initialise extack before use
+    - netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
+    - netfilter: nf_tables: Audit log dump reset after the fact
+    - netfilter: nf_tables: Introduce nf_tables_getobj_single
+    - netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests
+    - vsock: fix recursive ->recvmsg calls
+    - selftests: net: lib: ignore possible errors
+    - selftests: net: lib: kill PIDs before del netns
+    - net: hns3: fix wrong use of semaphore up
+    - net: hns3: use the user's cfg after reset
+    - net: hns3: fix a deadlock problem when config TC during resetting
+    - gpio: mlxbf3: Support shutdown() function
+    - ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
+    - rust: work around `bindgen` 0.69.0 issue
+    - rust: suppress error messages from CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
+    - rust: fix the default format for CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
+    - cpu/SMT: Enable SMT only if a core is online
+    - powerpc/topology: Check if a core is online
+    - arm64: Fix KASAN random tag seed initialization
+    - block: Fix lockdep warning in blk_mq_mark_tag_wait
+    - wifi: ath12k: Add missing qmi_txn_cancel() calls
+    - quota: Remove BUG_ON from dqget()
+    - riscv: blacklist assembly symbols for kprobe
+    - kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
+    - media: pci: cx23885: check cx23885_vdev_init() return
+    - fs: binfmt_elf_efpic: don't use missing interpreter's properties
+    - scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
+    - media: drivers/media/dvb-core: copy user arrays safely
+    - wifi: iwlwifi: mvm: avoid garbage iPN
+    - net/sun3_82586: Avoid reading past buffer in debug output
+    - drm/lima: set gp bus_stop bit before hard reset
+    - gpio: sysfs: extend the critical section for unregistering sysfs devices
+    - hrtimer: Select housekeeping CPU during migration
+    - virtiofs: forbid newlines in tags
+    - accel/habanalabs: fix debugfs files permissions
+    - clocksource/drivers/arm_global_timer: Guard against division by zero
+    - tick: Move got_idle_tick away from common flags
+    - netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
+    - md: clean up invalid BUG_ON in md_ioctl
+    - x86: Increase brk randomness entropy for 64-bit systems
+    - memory: stm32-fmc2-ebi: check regmap_read return value
+    - parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
+    - rxrpc: Don't pick values out of the wire header when setting up security
+    - f2fs: stop checkpoint when get a out-of-bounds segment
+    - powerpc/boot: Handle allocation failure in simple_realloc()
+    - powerpc/boot: Only free if realloc() succeeds
+    - btrfs: delayed-inode: drop pointless BUG_ON in __btrfs_remove_delayed_item()
+    - btrfs: defrag: change BUG_ON to assertion in btrfs_defrag_leaves()
+    - btrfs: change BUG_ON to assertion when checking for delayed_node root
+    - btrfs: push errors up from add_async_extent()
+    - btrfs: handle invalid root reference found in may_destroy_subvol()
+    - btrfs: send: handle unexpected data in header buffer in begin_cmd()
+    - btrfs: send: handle unexpected inode in header process_recorded_refs()
+    - btrfs: change BUG_ON to assertion in tree_move_down()
+    - btrfs: delete pointless BUG_ON check on quota root in
+      btrfs_qgroup_account_extent()
+    - f2fs: fix to do sanity check in update_sit_entry
+    - usb: gadget: fsl: Increase size of name buffer for endpoints
+    - nvme: clear caller pointer on identify failure
+    - Bluetooth: bnep: Fix out-of-bound access
+    - firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid
+    - rtc: nct3018y: fix possible NULL dereference
+    - net: hns3: add checking for vf id of mailbox
+    - nvmet-tcp: do not continue for invalid icreq
+    - NFS: avoid infinite loop in pnfs_update_layout.
+    - openrisc: Call setup_memory() earlier in the init sequence
+    - s390/iucv: fix receive buffer virtual vs physical address confusion
+    - irqchip/renesas-rzg2l: Do not set TIEN and TINT source at the same time
+    - platform/x86: lg-laptop: fix %s null argument warning
+    - usb: dwc3: core: Skip setting event buffers for host only controllers
+    - irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
+    - ext4: set the type of max_zeroout to unsigned int to avoid overflow
+    - nvmet-rdma: fix possible bad dereference when freeing rsps
+    - selftests/bpf: Fix a few tests for GCC related warnings.
+    - Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
+    - nvme: use srcu for iterating namespace list
+    - drm/amdgpu: fix dereference null return value for the function
+      amdgpu_vm_pt_parent
+    - hrtimer: Prevent queuing of hrtimer without a function callback
+    - nvme: fix namespace removal list
+    - gtp: pull network headers in gtp_dev_xmit()
+    - riscv: entry: always initialize regs->a0 to -ENOSYS
+    - smb3: fix lock breakage for cached writes
+    - dm suspend: return -ERESTARTSYS instead of -EINTR
+    - selftests: memfd_secret: don't build memfd_secret test on unsupported arches
+    - mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order
+      fallback to order 0
+    - btrfs: send: allow cloning non-aligned extent if it ends at i_size
+    - drm/amd/amdgpu: command submission parser for JPEG
+    - platform/surface: aggregator: Fix warning when controller is destroyed in
+      probe
+    - ALSA: hda/tas2781: Use correct endian conversion
+    - Bluetooth: hci_core: Fix LE quote calculation
+    - Bluetooth: SMP: Fix assumption of Central always being Initiator
+    - net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and
+      register injection
+    - net: mscc: ocelot: fix QoS class for injected packets with "ocelot-8021q"
+    - net: mscc: ocelot: serialize access to the injection/extraction groups
+    - tc-testing: don't access non-existent variable on exception
+    - selftests: udpgro: report error when receive failed
+    - tcp/dccp: bypass empty buckets in inet_twsk_purge()
+    - tcp/dccp: do not care about families in inet_twsk_purge()
+    - tcp: prevent concurrent execution of tcp_sk_exit_batch
+    - net: mctp: test: Use correct skb for route input check
+    - kcm: Serialise kcm_sendmsg() for the same socket.
+    - netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
+    - netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
+    - ip6_tunnel: Fix broken GRO
+    - bonding: fix bond_ipsec_offload_ok return type
+    - bonding: fix null pointer deref in bond_ipsec_offload_ok
+    - bonding: fix xfrm real_dev null pointer dereference
+    - bonding: fix xfrm state handling when clearing active slave
+    - ice: fix page reuse when PAGE_SIZE is over 8k
+    - ice: fix ICE_LAST_OFFSET formula
+    - ice: fix truesize operations for PAGE_SIZE >= 8192
+    - dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
+    - igb: cope with large MAX_SKB_FRAGS
+    - net: dsa: mv88e6xxx: Fix out-of-bound access
+    - udp: fix receiving fraglist GSO packets
+    - ipv6: fix possible UAF in ip6_finish_output2()
+    - ipv6: prevent possible UAF in ip6_xmit()
+    - bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
+    - netfilter: flowtable: validate vlan header
+    - octeontx2-af: Fix CPT AF register offset calculation
+    - net: xilinx: axienet: Always disable promiscuous mode
+    - net: xilinx: axienet: Fix dangling multicast addresses
+    - net: ovs: fix ovs_drop_reasons error
+    - drm/msm/dpu: don't play tricks with debug macros
+    - drm/msm/dp: fix the max supported bpp logic
+    - drm/msm/dpu: split dpu_encoder_wait_for_event into two functions
+    - drm/msm/dpu: capture snapshot on the first commit_done timeout
+    - drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()
+    - drm/msm/dp: reset the link phy params before link training
+    - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
+    - drm/msm/dpu: take plane rotation into account for wide planes
+    - drm/msm: fix the highest_bank_bit for sc7180
+    - mmc: mmc_test: Fix NULL dereference on allocation failure
+    - Bluetooth: MGMT: Add error handling to pair_device()
+    - scsi: core: Fix the return value of scsi_logical_block_count()
+    - ksmbd: the buffer of smb2 query dir response has at least 1 byte
+    - drm/amdgpu: Validate TA binary size
+    - net: dsa: microchip: fix PTP config failure when using multiple ports
+    - MIPS: Loongson64: Set timer mode in cpu-probe
+    - HID: wacom: Defer calculation of resolution until resolution_code is known
+    - Input: i8042 - add forcenorestore quirk to leave controller untouched even
+      on s3
+    - Input: i8042 - use new forcenorestore quirk to replace old buggy quirk
+      combination
+    - cxgb4: add forgotten u64 ivlan cast before shift
+    - KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
+    - mmc: mtk-sd: receive cmd8 data when hs400 tuning fail
+    - mmc: dw_mmc: allow biu and ciu clocks to defer
+    - smb3: fix broken cached reads when posix locks
+    - pmdomain: imx: scu-pd: Remove duplicated clocks
+    - pmdomain: imx: wait SSAR when i.MX93 power domain on
+    - nouveau/firmware: use dma non-coherent allocator
+    - mptcp: pm: re-using ID of unused removed ADD_ADDR
+    - mptcp: pm: re-using ID of unused removed subflows
+    - mptcp: pm: re-using ID of unused flushed subflows
+    - mptcp: pm: remove mptcp_pm_remove_subflow()
+    - mptcp: pm: only mark 'subflow' endp as available
+    - mptcp: pm: only decrement add_addr_accepted for MPJ req
+    - mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
+    - mptcp: pm: only in-kernel cannot have entries with ID 0
+    - mptcp: pm: fullmesh: select the right ID later
+    - mptcp: pm: avoid possible UaF when selecting endp
+    - selftests: mptcp: join: validate fullmesh endp on 1st sf
+    - selftests: mptcp: join: restrict fullmesh endp on 1st sf
+    - selftests: mptcp: join: check re-using ID of closed subflow
+    - tcp: do not export tcp_twsk_purge()
+    - drm/msm/mdss: specify cfg bandwidth for SDM670
+    - drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels
+    - igc: Fix qbv tx latency by setting gtxoffset
+    - ALSA: timer: Relax start tick time check for slave timer elements
+    - bpf: Fix a kernel verifier crash in stacksafe()
+    - selftests/bpf: Add a test to verify previous stacksafe() fix
+    - Revert "s390/dasd: Establish DMA alignment"
+    - Input: MT - limit max slots
+    - tools: move alignment-related macros to new <linux/align.h>
+    - Revert "serial: 8250_omap: Set the console genpd always on if no console
+      suspend"
+    - usb: misc: ljca: Add Lunar Lake ljca GPIO HID to ljca_gpio_hids[]
+    - usb: xhci: Check for xhci->interrupters being allocated in
+      xhci_mem_clearup()
+    - vfs: Don't evict inode under the inode lru traversing context
+    - tracing: Return from tracing_buffers_read() if the file has been closed
+    - mm: fix endless reclaim on machines with unaccepted memory
+    - fs/netfs/fscache_cookie: add missing "n_accesses" check
+    - mm/numa: no task_numa_fault() call if PMD is changed
+    - mm/numa: no task_numa_fault() call if PTE is changed
+    - btrfs: check delayed refs when we're checking if a ref exists
+    - drm/amd/display: Adjust cursor position
+    - drm/amd/display: fix s2idle entry for DCN3.5+
+    - drm/amd/display: Enable otg synchronization logic for DCN321
+    - drm/amd/display: fix cursor offset on rotation 180
+    - netfs: Fault in smaller chunks for non-large folio mappings
+    - libfs: fix infinite directory reads for offset dir
+    - kallsyms: Avoid weak references for kallsyms symbols
+    - kbuild: avoid unneeded kallsyms step 3
+    - kbuild: refactor variables in scripts/link-vmlinux.sh
+    - kbuild: remove PROVIDE() for kallsyms symbols
+    - kallsyms: get rid of code for absolute kallsyms
+    - [Config] Remove CONFIG_KALLSYMS_BASE_RELATIVE
+    - kallsyms: Do not cleanup .llvm.<hash> suffix before sorting symbols
+    - bpf: Replace deprecated strncpy with strscpy
+    - kallsyms: replace deprecated strncpy with strscpy
+    - kallsyms: rework symbol lookup return codes
+    - kallsyms: Match symbols exactly with CONFIG_LTO_CLANG
+    - drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()`
+    - drm/amd/display: Don't register panel_power_savings on OLED panels
+    - wifi: ath12k: use 128 bytes aligned iova in transmit path for WCN7850
+    - kbuild: merge temporary vmlinux for BTF and kallsyms
+    - kbuild: avoid scripts/kallsyms parsing /dev/null
+    - Bluetooth: HCI: Invert LE State quirk to be opt-out rather then opt-in
+    - net/mlx5: Fix IPsec RoCE MPV trace call
+    - selftests: udpgro: no need to load xdp for gro
+    - ice: use internal pf id instead of function number
+    - drm/msm/dpu: limit QCM2290 to RGB formats only
+    - drm/msm/dpu: relax YUV requirements
+    - spi: spi-cadence-quadspi: Fix OSPI NOR failures during system resume
+    - drm/xe/display: stop calling domains_driver_remove twice
+    - drm/xe: Fix opregion leak
+    - drm/xe/mmio: move mmio_fini over to devm
+    - drm/xe: reset mmio mappings with devm
+    - drm/xe: Fix tile fini sequence
+    - drm/xe: Fix missing workqueue destroy in xe_gt_pagefault
+    - drm/xe: Free job before xe_exec_queue_put
+    - thermal/debugfs: Fix the NULL vs IS_ERR() confusion in debugfs_create_dir()
+    - nvme: move stopping keep-alive into nvme_uninit_ctrl()
+    - drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1
+    - s390/ap: Refine AP bus bindings complete processing
+    - net: ngbe: Fix phy mode set to external phy
+    - iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace()
+    - cgroup/cpuset: fix panic caused by partcmd_update
+    - cgroup/cpuset: Clear effective_xcpus on cpus_allowed clearing only if
+      cpus.exclusive not set
+    - of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put()
+      handling
+    - thermal: of: Fix OF node leak in thermal_of_trips_init() error path
+    - thermal: of: Fix OF node leak in thermal_of_zone_register()
+    - thermal: of: Fix OF node leak in of_thermal_zone_find() error paths
+    - Upstream stable to v6.6.48, v6.10.7
+  * Unable to list directories using CIFS on 6.8 kernel (LP: #2082423) // Noble
+    update: upstream stable patchset 2024-10-09 (LP: #2084005)
+    - smb: client: ignore unhandled reparse tags
+  * CVE-2024-46759
+    - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
+  * CVE-2024-46758
+    - hwmon: (lm95234) Fix underflows seen when writing limit attributes
+  * CVE-2024-46756
+    - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
+  * CVE-2024-46738
+    - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
+  * CVE-2024-46722
+    - drm/amdgpu: fix mc_data out-of-bounds read warning
+  * LXD fan bridge causes blocked tasks (LP: #2064176)
+    - SAUCE: fan: release rcu_read_lock on skb discard path
+    - SAUCE: fan: fix racy device stat update
+  * x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (LP: #2081863)
+    - x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
+  * UBSAN: array-index-out-of-bounds in module mt76 (LP: #2081785)
+    - wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc
+  * The system hangs after resume with thunderbolt monitor(AMD GPU [1002:1900])
+    (LP: #2083182)
+    - SAUCE: drm/amd/display: Fix system hang while resume with TBT monitor
+  * [SRU] GPU: support additional device ids for DG2 driver (LP: #2083701)
+    - drm/i915: Add new PCI IDs to DG2 platform in driver
+  * [SRU]Intel Arrow Lake IBECC feature backport request for ubuntu 22.04.5 and
+    24.04.1 server (LP: #2077861)
+    - EDAC/igen6: Add Intel Arrow Lake-U/H SoCs support
+  * Noble update: upstream stable patchset 2024-10-07 (LP: #2083794)
+    - ASoC: topology: Clean up route loading
+    - ASoC: topology: Fix route memory corruption
+    - LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h
+    - sunrpc: don't change ->sv_stats if it doesn't exist
+    - nfsd: stop setting ->pg_stats for unused stats
+    - sunrpc: pass in the sv_stats struct through svc_create_pooled
+    - sunrpc: remove ->pg_stats from svc_program
+    - nfsd: remove nfsd_stats, make th_cnt a global counter
+    - nfsd: make svc_stat per-network namespace instead of global
+    - mm: gup: stop abusing try_grab_folio
+    - nvme/pci: Add APST quirk for Lenovo N60z laptop
+    - genirq/cpuhotplug: Skip suspended interrupts when restoring affinity
+    - genirq/cpuhotplug: Retry with cpu_online_mask when migration fails
+    - quota: Detect loops in quota tree
+    - bpf: Replace bpf_lpm_trie_key 0-length array with flexible array
+    - fs: Annotate struct file_handle with __counted_by() and use struct_size()
+    - mISDN: fix MISDN_TIME_STAMP handling
+    - mm/page_table_check: support userfault wr-protect entries
+    - bpf, net: Use DEV_STAT_INC()
+    - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
+    - f2fs: fix to cover read extent cache access with lock
+    - fou: remove warn in gue_gro_receive on unsupported protocol
+    - jfs: fix null ptr deref in dtInsertEntry
+    - jfs: Fix shift-out-of-bounds in dbDiscardAG
+    - fs/ntfs3: Do copy_to_user out of run_lock
+    - ALSA: usb: Fix UBSAN warning in parse_audio_unit()
+    - binfmt_flat: Fix corruption when not offsetting data start
+    - mm/debug_vm_pgtable: drop RANDOM_ORVALUE trick
+    - KVM: arm64: Don't defer TLB invalidation when zapping table entries
+    - KVM: arm64: Don't pass a TLBI level hint when zapping table entries
+    - drm/amd/display: Defer handling mst up request in resume
+    - drm/amd/display: Guard cursor idle reallow by DC debug option
+    - drm/amd/display: Separate setting and programming of cursor
+    - drm/amd/display: Prevent IPX From Link Detect and Set Mode
+    - ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
+    - platform/x86/amd/pmf: Fix to Update HPD Data When ALS is Disabled
+    - platform/x86: ideapad-laptop: introduce a generic notification chain
+    - platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc
+    - platform/x86: ideapad-laptop: add a mutex to synchronize VPC commands
+    - drm/amd/display: Solve mst monitors blank out problem after resume
+    - drm/amdgpu/display: Fix null pointer dereference in
+      dc_stream_program_cursor_position
+    - Upstream stable to v6.6.47, v6.10.6
+  * Noble update: upstream stable patchset 2024-10-04 (LP: #2083656)
+    - irqchip/mbigen: Fix mbigen node address layout
+    - platform/x86/intel/ifs: Initialize union ifs_status to zero
+    - jump_label: Fix the fix, brown paper bags galore
+    - x86/mm: Fix pti_clone_pgtable() alignment assumption
+    - x86/mm: Fix pti_clone_entry_text() for i386
+    - smb: client: move most of reparse point handling code to common file
+    - smb: client: set correct d_type for reparse DFS/DFSR and mount point
+    - smb: client: handle lack of FSCTL_GET_REPARSE_POINT support
+    - sctp: Fix null-ptr-deref in reuseport_add_sock().
+    - net: usb: qmi_wwan: fix memory leak for not ip packets
+    - net: bridge: mcast: wait for previous gc cycles when removing port
+    - net: linkwatch: use system_unbound_wq
+    - ice: Fix reset handler
+    - Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
+    - Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv
+      monitor
+    - net/smc: add the max value of fallback reason count
+    - net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
+    - l2tp: fix lockdep splat
+    - net: bcmgenet: Properly overlay PHY and MAC Wake-on-LAN capabilities
+    - net: fec: Stop PPS on driver remove
+    - gpio: prevent potential speculation leaks in gpio_device_get_desc()
+    - hwmon: corsair-psu: add USB id of HX1200i Series 2023 psu
+    - rcutorture: Fix rcu_torture_fwd_cb_cr() data race
+    - md: do not delete safemode_timer in mddev_suspend
+    - md/raid5: avoid BUG_ON() while continue reshape after reassembling
+    - block: change rq_integrity_vec to respect the iterator
+    - rcu: Fix rcu_barrier() VS post CPUHP_TEARDOWN_CPU invocation
+    - clocksource/drivers/sh_cmt: Address race condition for clock events
+    - ACPI: battery: create alarm sysfs attribute atomically
+    - ACPI: SBS: manage alarm sysfs attribute through psy core
+    - xen: privcmd: Switch from mutex to spinlock for irqfds
+    - wifi: nl80211: disallow setting special AP channel widths
+    - wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup()
+    - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
+    - selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
+    - af_unix: Don't retry after unix_state_lock_nested() in
+      unix_stream_connect().
+    - PCI: Add Edimax Vendor ID to pci_ids.h
+    - udf: prevent integer overflow in udf_bitmap_free_blocks()
+    - wifi: nl80211: don't give key data to userspace
+    - can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index
+      erratum
+    - can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of
+      mcp2518fd
+    - net: stmmac: qcom-ethqos: enable SGMII loopback during DMA reset on
+      sa8775p-ride-r3
+    - btrfs: do not clear page dirty inside extent_write_locked_range()
+    - btrfs: fix invalid mapping of extent xarray state
+    - btrfs: fix bitmap leak when loading free space cache on duplicate entry
+    - Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver
+      unloading
+    - drm/amd/display: Add delay to improve LTTPR UHBR interop
+    - drm/amdgpu: fix potential resource leak warning
+    - drm/amdgpu/pm: Fix the param type of set_power_profile_mode
+    - drm/amdgpu/pm: Fix the null pointer dereference for smu7
+    - drm/amdgpu: Fix the null pointer dereference to ras_manager
+    - drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
+    - drm/admgpu: fix dereferencing null pointer context
+    - drm/amdgpu: Add lock around VF RLCG interface
+    - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
+    - media: amphion: Remove lock in s_ctrl callback
+    - drm/amd/display: Add null checker before passing variables
+    - media: uvcvideo: Ignore empty TS packets
+    - media: uvcvideo: Fix the bandwdith quirk on USB 3.x
+    - media: xc2028: avoid use-after-free in load_firmware_cb()
+    - ext4: fix uninitialized variable in ext4_inlinedir_to_tree
+    - jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
+    - s390/sclp: Prevent release of buffer in I/O
+    - SUNRPC: Fix a race to wake a sync task
+    - profiling: remove profile=sleep support
+    - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
+    - irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to
+      'raw_spinlock_t'
+    - irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq()
+    - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
+    - net: drop bad gso csum_start and offset in virtio_net_hdr
+    - arm64: Add Neoverse-V2 part
+    - arm64: barrier: Restore spec_bar() macro
+    - arm64: cputype: Add Cortex-X4 definitions
+    - arm64: cputype: Add Neoverse-V3 definitions
+    - arm64: errata: Add workaround for Arm errata 3194386 and 3312417
+    - arm64: cputype: Add Cortex-X3 definitions
+    - arm64: cputype: Add Cortex-A720 definitions
+    - arm64: cputype: Add Cortex-X925 definitions
+    - arm64: errata: Unify speculative SSBS errata logic
+    - [Config] Set ARM64_ERRATUM_3194386=y
+    - arm64: errata: Expand speculative SSBS workaround
+    - arm64: cputype: Add Cortex-X1C definitions
+    - arm64: cputype: Add Cortex-A725 definitions
+    - arm64: errata: Expand speculative SSBS workaround (again)
+    - i2c: smbus: Improve handling of stuck alerts
+    - ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
+    - ASoC: codecs: wsa881x: Correct Soundwire ports mask
+    - ASoC: codecs: wsa883x: parse port-mapping information
+    - ASoC: codecs: wsa883x: Correct Soundwire ports mask
+    - ASoC: codecs: wsa884x: parse port-mapping information
+    - ASoC: codecs: wsa884x: Correct Soundwire ports mask
+    - ASoC: sti: add missing probe entry for player and reader
+    - spi: spidev: Add missing spi_device_id for bh2228fv
+    - ASoC: SOF: Remove libraries from topology lookups
+    - i2c: smbus: Send alert notifications to all devices if source not found
+    - bpf: kprobe: remove unused declaring of bpf_kprobe_override
+    - kprobes: Fix to check symbol prefixes correctly
+    - i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume
+    - i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
+    - spi: spi-fsl-lpspi: Fix scldiv calculation
+    - ALSA: usb-audio: Re-add ScratchAmp quirk entries
+    - ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
+    - cifs: cifs_inval_name_dfs_link_error: correct the check for fullpath
+    - module: warn about excessively long module waits
+    - module: make waiting for a concurrent module loader interruptible
+    - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
+    - drm/amd/display: Skip Recompute DSC Params if no Stream on Link
+    - drm/amdgpu: Forward soft recovery errors to userspace
+    - drm/i915/gem: Adjust vma offset for framebuffer mmap offset
+    - drm/client: fix null pointer dereference in drm_client_modeset_probe
+    - ALSA: line6: Fix racy access to midibuf
+    - ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
+    - ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks
+    - ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
+    - usb: vhci-hcd: Do not drop references before new references are gained
+    - USB: serial: debug: do not echo input by default
+    - usb: gadget: core: Check for unset descriptor
+    - usb: gadget: midi2: Fix the response for FB info with block 0xff
+    - usb: gadget: u_serial: Set start_delayed during suspend
+    - usb: gadget: u_audio: Check return codes from usb_ep_enable and
+      config_ep_by_speed.
+    - scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES
+    - scsi: ufs: core: Do not set link to OFF state while waking up from
+      hibernation
+    - scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
+    - tick/broadcast: Move per CPU pointer access into the atomic section
+    - vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
+    - ntp: Clamp maxerror and esterror to operating range
+    - clocksource: Scale the watchdog read retries automatically
+    - clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
+    - driver core: Fix uevent_show() vs driver detach race
+    - tracefs: Fix inode allocation
+    - tracefs: Use generic inode RCU for synchronizing freeing
+    - ntp: Safeguard against time_constant overflow
+    - timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex()
+    - serial: core: check uartclk for zero to avoid divide by zero
+    - memcg: protect concurrent access to mem_cgroup_idr
+    - parisc: fix unaligned accesses in BPF
+    - parisc: fix a possible DMA corruption
+    - ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx
+    - kcov: properly check for softirq context
+    - irqchip/xilinx: Fix shift out of bounds
+    - genirq/irqdesc: Honor caller provided affinity in alloc_desc()
+    - LoongArch: Enable general EFI poweroff method
+    - power: supply: qcom_battmgr: return EAGAIN when firmware service is not up
+    - power: supply: axp288_charger: Fix constant_charge_voltage writes
+    - power: supply: axp288_charger: Round constant_charge_voltage writes down
+    - tracing: Fix overflow in get_free_elt()
+    - padata: Fix possible divide-by-0 panic in padata_mt_helper()
+    - smb3: fix setting SecurityFlags when encryption is required
+    - eventfs: Don't return NULL in eventfs_create_dir()
+    - eventfs: Use SRCU for freeing eventfs_inodes
+    - selftests: mm: add s390 to ARCH check
+    - btrfs: avoid using fixed char array size for tree names
+    - x86/paravirt: Fix incorrect virt spinlock setting on bare metal
+    - x86/mtrr: Check if fixed MTRRs exist before saving them
+    - sched/smt: Introduce sched_smt_present_inc/dec() helper
+    - sched/smt: Fix unbalance sched_smt_present dec/inc
+    - sched/core: Introduce sched_set_rq_on/offline() helper
+    - sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate()
+    - drm/bridge: analogix_dp: properly handle zero sized AUX transactions
+    - drm/dp_mst: Skip CSN if topology probing is not done yet
+    - drm/lima: Mark simple_ondemand governor as softdep
+    - drm/mgag200: Set DDC timeout in milliseconds
+    - drm/mgag200: Bind I2C lifetime to DRM device
+    - drm/radeon: Remove __counted_by from StateArray.states[]
+    - mptcp: fully established after ADD_ADDR echo on MPJ
+    - mptcp: pm: deny endp with signal + subflow + port
+    - block: use the right type for stub rq_integrity_vec()
+    - btrfs: fix corruption after buffer fault in during direct IO append write
+    - tools headers arm64: Sync arm64's cputype.h with the kernel sources
+    - mm/hugetlb: fix potential race in __update_and_free_hugetlb_folio()
+    - xfs: fix log recovery buffer allocation for the legacy h_size fixup
+    - mptcp: pm: reduce indentation blocks
+    - mptcp: pm: don't try to create sf if alloc failed
+    - mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set
+    - selftests: mptcp: join: ability to invert ADD_ADDR check
+    - selftests: mptcp: join: test both signal & subflow
+    - Revert "selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky"
+    - btrfs: fix double inode unlock for direct IO sync writes
+    - perf/x86/intel/cstate: Switch to new Intel CPU model defines
+    - perf/x86/intel/cstate: Add Arrowlake support
+    - perf/x86/intel/cstate: Add Lunarlake support
+    - perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest
+    - platform/x86: intel-vbtn: Protect ACPI notify handler against recursion
+    - perf/x86/amd: Use try_cmpxchg() in events/amd/{un,}core.c
+    - perf/x86/intel: Support the PEBS event mask
+    - perf/x86: Support counter mask
+    - perf/x86: Fix smp_processor_id()-in-preemptible warnings
+    - virtio-net: unbreak vq resizing when coalescing is not negotiated
+    - net: dsa: microchip: Fix Wake-on-LAN check to not return an error
+    - net: dsa: microchip: disable EEE for KSZ8567/KSZ9567/KSZ9896/KSZ9897.
+    - regmap: kunit: Use a KUnit action to call regmap_exit()
+    - regmap: kunit: Replace a kmalloc/kfree() pair with KUnit-managed alloc
+    - regmap: kunit: Fix memory leaks in gen_regmap() and gen_raw_regmap()
+    - debugobjects: Annotate racy debug variables
+    - nvme: apple: fix device reference counting
+    - cpufreq: amd-pstate: Allow users to write 'default' EPP string
+    - cpufreq: amd-pstate: auto-load pstate driver by default
+    - soc: qcom: icc-bwmon: Allow for interrupts to be shared across instances
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MU
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MJ
+    - thermal: intel: hfi: Give HFI instances package scope
+    - wifi: ath12k: fix race due to setting ATH12K_FLAG_EXT_IRQ_ENABLED too early
+    - wifi: rtlwifi: handle return value of usb init TX/RX
+    - wifi: rtw89: pci: fix RX tag race condition resulting in wrong RX length
+    - wifi: mac80211: fix NULL dereference at band check in starting tx ba session
+    - bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory
+      accesses
+    - mlxsw: pci: Lock configuration space of upstream bridge during reset
+    - btrfs: do not BUG_ON() when freeing tree block after error
+    - btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info()
+    - btrfs: fix data race when accessing the last_trans field of a root
+    - drm/xe/preempt_fence: enlarge the fence critical section
+    - drm/amd/display: Handle HPD_IRQ for internal link
+    - drm/amd/amdkfd: Fix a resource leak in svm_range_validate_and_map()
+    - drm/xe/xe_guc_submit: Fix exec queue stop race condition
+    - drm/amd/display: Add null checks for 'stream' and 'plane' before
+      dereferencing
+    - drm/amd/display: Wake DMCUB before sending a command for replay feature
+    - drm/amd/display: reduce ODM slice count to initial new dc state only when
+      needed
+    - of: Add cleanup.h based auto release via __free(device_node) markings
+    - media: i2c: ov5647: replacing of_node_put with __free(device_node)
+    - drm/amd/display: Fix null pointer deref in dcn20_resource.c
+    - ext4: sanity check for NULL pointer after ext4_force_shutdown
+    - mm, slub: do not call do_slab_free for kfence object
+    - ASoC: cs35l56: Revert support for dual-ownership of ASP registers
+    - drm/atomic: allow no-op FB_ID updates for async flips
+    - drm/amd/display: Replace dm_execute_dmub_cmd with
+      dc_wake_and_execute_dmub_cmd
+    - drm/xe/rtp: Fix off-by-one when processing rules
+    - drm/xe: Use dma_fence_chain_free in chain fence unused as a sync
+    - drm/xe/hwmon: Fix PL1 disable flow in xe_hwmon_power_max_write
+    - drm/xe: Move lrc snapshot capturing to xe_lrc.c
+    - drm/xe: Minor cleanup in LRC handling
+    - drm/test: fix the gem shmem test to map the sg table.
+    - usb: typec: pd: no opencoding of FIELD_GET
+    - usb: typec: fsa4480: Check if the chip is really there
+    - PM: runtime: Simplify pm_runtime_get_if_active() usage
+    - scsi: ufs: core: Fix deadlock during RTC update
+    - serial: sc16is7xx: fix invalid FIFO access with special register set
+    - tracing: Have format file honor EVENT_FILE_FL_FREED
+    - mm: list_lru: fix UAF for memory cgroup
+    - net/tcp: Disable TCP-AO static key after RCU grace period
+    - Revert "drm/amd/display: Handle HPD_IRQ for internal link"
+    - idpf: fix memleak in vport interrupt configuration
+    - drm/amd/display: Add null check in resource_log_pipe_topology_update
+    - Upstream stable to v6.6.46, v6.10.5
+  * Noble update: upstream stable patchset 2024-10-02 (LP: #2083488)
+    - sysctl: allow change system v ipc sysctls inside ipc namespace
+    - sysctl: allow to change limits for posix messages queues
+    - sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)
+    - ext4: factor out a common helper to query extent map
+    - ext4: check the extent status again before inserting delalloc block
+    - leds: trigger: Store brightness set by led_trigger_event()
+    - leds: trigger: Call synchronize_rcu() before calling trig->activate()
+    - KVM: VMX: Move posted interrupt descriptor out of VMX code
+    - fbdev/vesafb: Replace references to global screen_info by local pointer
+    - video: Add helpers for decoding screen_info
+    - [Config] Update CONFIG_SCREEN_INFO
+    - video: Provide screen_info_get_pci_dev() to find screen_info's PCI device
+    - firmware/sysfb: Update screen_info for relocated EFI framebuffers
+    - mm: page_alloc: control latency caused by zone PCP draining
+    - mm/page_alloc: fix pcp->count race between drain_pages_zone() vs
+      __rmqueue_pcplist()
+    - f2fs: fix to avoid use SSR allocate when do defragment
+    - f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid
+    - dmaengine: fsl-edma: add address for channel mux register in fsl_edma_chan
+    - dmaengine: fsl-edma: add i.MX8ULP edma support
+    - perf: imx_perf: fix counter start and config sequence
+    - MIPS: Loongson64: DTS: Fix PCIe port nodes for ls7a
+    - MIPS: dts: loongson: Fix liointc IRQ polarity
+    - MIPS: dts: loongson: Fix ls2k1000-rtc interrupt
+    - ARM: 9406/1: Fix callchain_trace() return value
+    - HID: amd_sfh: Move sensor discovery before HID device initialization
+    - perf tool: fix dereferencing NULL al->maps
+    - drm/nouveau: prime: fix refcount underflow
+    - drm/vmwgfx: Fix overlay when using Screen Targets
+    - drm/vmwgfx: Trigger a modeset when the screen moves
+    - sched: act_ct: take care of padding in struct zones_ht_key
+    - wifi: cfg80211: fix reporting failed MLO links status with
+      cfg80211_connect_done
+    - net: phy: realtek: add support for RTL8366S Gigabit PHY
+    - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode
+    - Bluetooth: btintel: Fail setup on error
+    - Bluetooth: hci_sync: Fix suspending with wrong filter policy
+    - tcp: annotate data-races around tp->window_clamp
+    - tcp: Adjust clamping window for applications specifying SO_RCVBUF
+    - net: axienet: start napi before enabling Rx/Tx
+    - rtnetlink: Don't ignore IFLA_TARGET_NETNSID when ifname is specified in
+      rtnl_dellink().
+    - i915/perf: Remove code to update PWR_CLK_STATE for gen12
+    - ice: respect netif readiness in AF_XDP ZC related ndo's
+    - ice: don't busy wait for Rx queue disable in ice_qp_dis()
+    - ice: replace synchronize_rcu with synchronize_net
+    - ice: add missing WRITE_ONCE when clearing ice_rx_ring::xdp_prog
+    - drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro
+    - net: mvpp2: Don't re-use loop iterator
+    - net: phy: micrel: Fix the KSZ9131 MDI-X status issue
+    - ALSA: hda: Conditionally use snooping for AMD HDMI
+    - netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().
+    - netfilter: iptables: Fix potential null-ptr-deref in
+      ip6table_nat_table_init().
+    - net/mlx5: Always drain health in shutdown callback
+    - net/mlx5: Fix error handling in irq_pool_request_irq
+    - net/mlx5: Lag, don't use the hardcoded value of the first port
+    - net/mlx5: Fix missing lock on sync reset reload
+    - net/mlx5e: Require mlx5 tc classifier action support for IPsec prio
+      capability
+    - net/mlx5e: Fix CT entry update leaks of modify header context
+    - net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
+    - igc: Fix double reset adapter triggered from a single taprio cmd
+    - ipv6: fix ndisc_is_useropt() handling for PIO
+    - perf: riscv: Fix selecting counters in legacy mode
+    - riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
+    - riscv: Fix linear mapping checks for non-contiguous memory regions
+    - arm64: jump_label: Ensure patched jump_labels are visible to all CPUs
+    - rust: SHADOW_CALL_STACK is incompatible with Rust
+    - platform/chrome: cros_ec_proto: Lock device when updating MKBP version
+    - HID: wacom: Modify pen IDs
+    - btrfs: zoned: fix zone_unusable accounting on making block group read-write
+      again
+    - btrfs: do not subtract delalloc from avail bytes
+    - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
+    - mptcp: sched: check both directions for backup
+    - ALSA: usb-audio: Correct surround channels in UAC1 channel map
+    - ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
+    - ALSA: seq: ump: Optimize conversions from SysEx to UMP
+    - Revert "ALSA: firewire-lib: obsolete workqueue for period update"
+    - Revert "ALSA: firewire-lib: operate for period elapse event in process
+      context"
+    - drm/vmwgfx: Fix a deadlock in dma buf fence polling
+    - drm/virtio: Fix type of dma-fence context variable
+    - drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll()
+    - net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
+    - r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
+    - mptcp: fix user-space PM announced address accounting
+    - mptcp: distinguish rcv vs sent backup flag in requests
+    - mptcp: fix NL PM announced address accounting
+    - mptcp: mib: count MPJ with backup flag
+    - mptcp: fix bad RCVPRUNED mib accounting
+    - mptcp: pm: only set request_bkup flag when sending MP_PRIO
+    - mptcp: fix duplicate data handling
+    - selftests: mptcp: always close input's FD if opened
+    - selftests: mptcp: join: validate backup in MPJ
+    - selftests: mptcp: join: check backup support in signal endp
+    - mm/huge_memory: mark racy access onhuge_anon_orders_always
+    - mm: fix khugepaged activation policy
+    - x86/cpu/vfm: Add/initialize x86_vfm field to struct cpuinfo_x86
+    - perf/x86/intel: Switch to new Intel CPU model defines
+    - perf/x86/intel: Add a distinct name for Granite Rapids
+    - drm/gpuvm: fix missing dependency to DRM_EXEC
+    - netlink: specs: correct the spec of ethtool
+    - ethtool: rss: echo the context number back
+    - wifi: cfg80211: correct S1G beacon length calculation
+    - ethtool: fix setting key and resetting indir at once
+    - ice: modify error handling when setting XSK pool in ndo_bpf
+    - ice: toggle netif_carrier when setting up XSK pool
+    - ice: improve updating ice_{t,r}x_ring::xsk_pool
+    - ice: xsk: fix txq interrupt mapping
+    - drm/atomic: Allow userspace to use explicit sync with atomic async flips
+    - drm/atomic: Allow userspace to use damage clips with async flips
+    - riscv/purgatory: align riscv_kernel_entry
+    - perf arch events: Fix duplicate RISC-V SBI firmware event name
+    - RISC-V: Enable the IPI before workqueue_online_cpu()
+    - ceph: force sending a cap update msg back to MDS for revoke op
+    - drm/vmwgfx: Remove unused code
+    - drm/vmwgfx: Fix handling of dumb buffers
+    - drm/v3d: Prevent out of bounds access in performance query extensions
+    - drm/v3d: Fix potential memory leak in the timestamp extension
+    - drm/v3d: Fix potential memory leak in the performance extension
+    - drm/v3d: Validate passed in drm syncobj handles in the timestamp extension
+    - drm/v3d: Validate passed in drm syncobj handles in the performance extension
+    - nouveau: set placement to original placement on uvmm validate.
+    - wifi: ath12k: fix soft lockup on suspend
+    - mptcp: pm: fix backup support in signal endpoints
+    - selftests: mptcp: fix error path
+    - Upstream stable to v6.6.45, v6.10.4
+  * [SRU] Fix AST DP output after resume (LP: #2083022) // Noble update:
+    upstream stable patchset 2024-10-02 (LP: #2083488)
+    - drm/ast: astdp: Wake up during connector status detection
+    - drm/ast: Fix black screen after resume
+  * [SRU]Fail to locate the LED of NVME disk behind  Intel VMD (LP: #2077287) //
+    Noble update: upstream stable patchset 2024-10-02 (LP: #2083488)
+    - PCI: pciehp: Retain Power Indicator bits for userspace indicators
+  * Noble update: upstream stable patchset 2024-09-30 (LP: #2083196)
+    - powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
+    - spi: spi-microchip-core: Fix the number of chip selects supported
+    - spi: atmel-quadspi: Add missing check for clk_prepare
+    - EDAC, i10nm: make skx_common.o a separate module
+    - rcu/tasks: Fix stale task snaphot for Tasks Trace
+    - platform/chrome: cros_ec_debugfs: fix wrong EC message version
+    - ubd: refactor the interrupt handler
+    - ubd: untagle discard vs write zeroes not support handling
+    - block: initialize integrity buffer to zero before writing it to media
+    - x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS
+    - hfsplus: fix to avoid false alarm of circular locking
+    - x86/of: Return consistent error type from x86_of_pci_irq_enable()
+    - x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
+    - x86/pci/xen: Fix PCIBIOS_* return code handling
+    - x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
+    - cgroup/cpuset: Prevent UAF in proc_cpuset_show()
+    - hwmon: (adt7475) Fix default duty on fan is disabled
+    - block: Call .limit_depth() after .hctx has been set
+    - block/mq-deadline: Fix the tag reservation code
+    - md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl
+    - pwm: stm32: Always do lazy disabling
+    - nvmet-auth: fix nvmet_auth hash error handling
+    - drm/meson: fix canvas release in bind function
+    - pwm: atmel-tcb: Fix race condition and convert to guards
+    - hwmon: (max6697) Fix underflow when writing limit attributes
+    - hwmon: (max6697) Fix swapped temp{1,8} critical alarms
+    - arm64: dts: qcom: sc8180x: Correct PCIe slave ports
+    - arm64: dts: qcom: sc8180x: add power-domain to UFS PHY
+    - arm64: dts: qcom: sdm845: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm6115: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm6350: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm8250: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm8350: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm8450: add power-domain to UFS PHY
+    - arm64: dts: qcom: msm8996-xiaomi-common: drop excton from the USB PHY
+    - arm64: dts: qcom: sdm850-lenovo-yoga-c630: fix IPA firmware path
+    - arm64: dts: qcom: msm8998: enable adreno_smmu by default
+    - soc: qcom: pmic_glink: Handle the return value of pmic_glink_init
+    - soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data()
+      callers
+    - arm64: dts: rockchip: Add sdmmc related properties on rk3308-rock-pi-s
+    - arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s
+    - arm64: dts: rockchip: Add mdio and ethernet-phy nodes to rk3308-rock-pi-s
+    - arm64: dts: rockchip: Update WIFi/BT related nodes on rk3308-rock-pi-s
+    - arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
+    - arm64: dts: qcom: sa8775p: mark ethernet devices as DMA-coherent
+    - soc: xilinx: rename cpu_number1 to dummy_cpu_number
+    - ARM: dts: sunxi: remove duplicated entries in makefile
+    - ARM: dts: stm32: Add arm,no-tick-in-suspend to STM32MP15xx STGEN timer
+    - arm64: dts: qcom: qrb4210-rb2: make L9A always-on
+    - cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe()
+    - OPP: ti: Fix ti_opp_supply_probe wrong return values
+    - memory: fsl_ifc: Make FSL_IFC config visible and selectable
+    - arm64: dts: ti: k3-am62x: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am625-beagleplay: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am62-verdin: Drop McASP AFIFOs
+    - arm64: dts: qcom: qdu1000: Add secure qfprom node
+    - soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove
+    - soc: qcom: pdr: protect locator_addr with the main mutex
+    - soc: qcom: pdr: fix parsing of domains lists
+    - arm64: dts: rockchip: Increase VOP clk rate on RK3328
+    - arm64: dts: amlogic: sm1: fix spdif compatibles
+    - ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
+    - ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
+    - ARM: dts: imx6qdl-kontron-samx6i: fix board reset
+    - ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
+    - ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
+    - arm64: dts: mediatek: mt8195: Fix GPU thermal zone name for SVS
+    - arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
+    - arm64: dts: mediatek: mt8192-asurada: Add off-on-delay-us for
+      pp3300_mipibrdg
+    - arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
+    - arm64: dts: mediatek: mt8183-kukui: Fix the value of `dlg,jack-det-rate`
+      mismatch
+    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add ports node for anx7625
+    - arm64: dts: amlogic: gx: correct hdmi clocks
+    - arm64: dts: amlogic: add power domain to hdmitx
+    - arm64: dts: amlogic: setup hdmi system clock
+    - arm64: dts: rockchip: Drop invalid mic-in-differential on rk3568-rock-3a
+    - arm64: dts: rockchip: Fix mic-in-differential usage on rk3566-roc-pc
+    - arm64: dts: rockchip: Fix mic-in-differential usage on rk3568-evb1-v10
+    - arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r8a779f0: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r8a779g0: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r9a07g043u: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r9a07g044: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r9a07g054: Add missing hypervisor virtual timer IRQ
+    - m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
+    - arm64: dts: imx8mp: Fix pgc_mlmix location
+    - arm64: dts: imx8mp: add HDMI power-domains
+    - arm64: dts: imx8mp: Fix pgc vpu locations
+    - x86/xen: Convert comma to semicolon
+    - arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu
+    - arm64: dts: rockchip: fix regulator name for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: fix usb regulator for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: fix pmu_io supply for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: remove unused usb2 nodes for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: disable display subsystem for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: fixes PHY reset for Lunzn Fastrhino R68S
+    - arm64: dts: qcom: sm6350: Add missing qcom,non-secure-domain property
+    - cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC
+      systems
+    - m68k: cmpxchg: Fix return value for default case in __arch_xchg()
+    - ARM: spitz: fix GPIO assignment for backlight
+    - vmlinux.lds.h: catch .bss..L* sections into BSS")
+    - firmware: turris-mox-rwtm: Do not complete if there are no waiters
+    - firmware: turris-mox-rwtm: Fix checking return value of
+      wait_for_completion_timeout()
+    - firmware: turris-mox-rwtm: Initialize completion before mailbox
+    - wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
+    - wifi: ath12k: Correct 6 GHz frequency value in rx status
+    - wifi: ath12k: Fix tx completion ring (WBM2SW) setup failure
+    - bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer
+    - selftests/bpf: Fix prog numbers in test_sockmap
+    - net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
+    - wifi: ath12k: change DMA direction while mapping reinjected packets
+    - wifi: ath12k: fix invalid memory access while processing fragmented packets
+    - wifi: ath12k: fix firmware crash during reo reinject
+    - wifi: ath11k: fix wrong definition of CE ring's base address
+    - wifi: ath12k: fix wrong definition of CE ring's base address
+    - tcp: add tcp_done_with_error() helper
+    - tcp: fix race in tcp_write_err()
+    - tcp: fix races in tcp_v[46]_err()
+    - net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when
+      CONFIG_ARCH_NO_SG_CHAIN is defined
+    - selftests/bpf: Check length of recv in test_sockmap
+    - udf: Fix lock ordering in udf_evict_inode()
+    - lib: objagg: Fix general protection fault
+    - mlxsw: spectrum_acl_erp: Fix object nesting warning
+    - mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
+    - perf/x86: Serialize set_attr_rdpmc()
+    - jump_label: Fix concurrency issues in static_key_slow_dec()
+    - wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
+    - wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
+    - wifi: cfg80211: handle 2x996 RU allocation in
+      cfg80211_calculate_bitrate_he()
+    - udf: Fix bogus checksum computation in udf_rename()
+    - net: fec: Refactor: #define magic constants
+    - net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
+    - libbpf: Checking the btf_type kind when fixing variable offsets
+    - xfrm: Fix unregister netdevice hang on hardware offload.
+    - ipvs: Avoid unnecessary calls to skb_is_gso_sctp
+    - netfilter: nf_tables: rise cap on SELinux secmark context
+    - wifi: rtw89: 8852b: fix definition of KIP register number
+    - wifi: rtl8xxxu: 8188f: Limit TX power index
+    - xfrm: Export symbol xfrm_dev_state_delete.
+    - bpftool: Mount bpffs when pinmaps path not under the bpffs
+    - perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
+    - perf: Fix perf_aux_size() for greater-than 32-bit size
+    - perf: Prevent passing zero nr_pages to rb_alloc_aux()
+    - perf: Fix default aux_watermark calculation
+    - perf/x86/intel/cstate: Fix Alderlake/Raptorlake/Meteorlake
+    - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()
+    - xfrm: fix netdev reference count imbalance
+    - xfrm: call xfrm_dev_policy_delete when kill policy
+    - wifi: virt_wifi: avoid reporting connection success with wrong SSID
+    - gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
+    - wifi: virt_wifi: don't use strlen() in const context
+    - locking/rwsem: Add __always_inline annotation to __down_write_common() and
+      inlined callers
+    - selftests/bpf: Close fd in error path in drop_on_reuseport
+    - selftests/bpf: Null checks for links in bpf_tcp_ca
+    - selftests/bpf: Close obj in error path in xdp_adjust_tail
+    - selftests/resctrl: Convert perror() to ksft_perror() or ksft_print_msg()
+    - selftests/resctrl: Fix closing IMC fds on error and open-code R+W instead of
+      loops
+    - bpf: annotate BTF show functions with __printf
+    - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
+    - bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
+    - bpf: Fix null pointer dereference in resolve_prog_type() for
+      BPF_PROG_TYPE_EXT
+    - selftests: forwarding: devlink_lib: Wait for udev events after reloading
+    - Bluetooth: hci_bcm4377: Use correct unit for timeouts
+    - Bluetooth: btintel: Refactor btintel_set_ppag()
+    - Bluetooth: btnxpuart: Add handling for boot-signature timeout errors
+    - xdp: fix invalid wait context of page_pool_destroy()
+    - net: bridge: mst: Check vlan state for egress decision
+    - drm/rockchip: vop2: Fix the port mux of VP2
+    - drm/arm/komeda: Fix komeda probe failing if there are no links in the
+      secondary pipeline
+    - drm/amdkfd: Fix CU Masking for GFX 9.4.3
+    - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq()
+    - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_generic_write_seq()
+    - drm/amd/pm: Fix aldebaran pcie speed reporting
+    - drm/amdgpu: Fix memory range calculation
+    - drm/amdgpu: Check if NBIO funcs are NULL in amdgpu_device_baco_exit
+    - drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1
+    - drm/panel: himax-hx8394: Handle errors from mipi_dsi_dcs_set_display_on()
+      better
+    - drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before
+      regulators
+    - drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
+    - drm/bridge: Fixed a DP link training bug
+    - drm/bridge: it6505: fix hibernate to resume no display issue
+    - media: pci: ivtv: Add check for DMA map result
+    - media: imon: Fix race getting ictx->lock
+    - media: i2c: Fix imx412 exposure control
+    - media: v4l: async: Fix NULL pointer dereference in adding ancillary links
+    - s390/mm: Convert make_page_secure to use a folio
+    - s390/mm: Convert gmap_make_secure to use a folio
+    - s390/uv: Don't call folio_wait_writeback() without a folio reference
+    - media: mediatek: vcodec: Handle invalid decoder vsi
+    - x86/shstk: Make return uprobe work with shadow stack
+    - ipmi: ssif_bmc: prevent integer overflow on 32bit systems
+    - saa7134: Unchecked i2c_transfer function result fixed
+    - media: i2c: imx219: fix msr access command sequence
+    - media: uvcvideo: Disable autosuspend for Insta360 Link
+    - media: uvcvideo: Quirk for invalid dev_sof in Logitech C922
+    - media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920
+    - media: uvcvideo: Override default flags
+    - drm: zynqmp_dpsub: Fix an error handling path in zynqmp_dpsub_probe()
+    - drm: zynqmp_kms: Fix AUX bus not getting unregistered
+    - media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2
+    - media: rcar-csi2: Disable runtime_pm in probe error
+    - media: rcar-csi2: Cleanup subdevice in remove()
+    - media: renesas: vsp1: Fix _irqsave and _irq mix
+    - media: renesas: vsp1: Store RPF partition configuration per RPF instance
+    - drm/mediatek: Add missing plane settings when async update
+    - drm/mediatek: Use 8-bit alpha in ETHDR
+    - drm/mediatek: Fix XRGB setting error in OVL
+    - drm/mediatek: Fix XRGB setting error in Mixer
+    - drm/mediatek: Fix destination alpha error in OVL
+    - drm/mediatek: Turn off the layers with zero width or height
+    - drm/mediatek: Add OVL compatible name for MT8195
+    - media: imx-jpeg: Drop initial source change event if capture has been setup
+    - leds: trigger: Unregister sysfs attributes before calling deactivate()
+    - drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC
+    - drm/msm/dpu: drop validity checks for clear_pending_flush() ctl op
+    - perf test: Make test_arm_callgraph_fp.sh more robust
+    - perf pmus: Fixes always false when compare duplicates aliases
+    - perf report: Fix condition in sort__sym_cmp()
+    - drm/etnaviv: fix DMA direction handling for cached RW buffers
+    - drm/qxl: Add check for drm_cvt_mode
+    - Revert "leds: led-core: Fix refcount leak in of_led_get()"
+    - drm/mediatek: Remove less-than-zero comparison of an unsigned value
+    - ext4: fix infinite loop when replaying fast_commit
+    - drm/mediatek/dp: switch to ->edid_read callback
+    - drm/mediatek/dp: Fix spurious kfree()
+    - media: venus: flush all buffers in output plane streamoff
+    - perf intel-pt: Fix aux_watermark calculation for 64-bit size
+    - perf intel-pt: Fix exclude_guest setting
+    - mfd: rsmu: Split core code into separate module
+    - mfd: omap-usb-tll: Use struct_size to allocate tll
+    - xprtrdma: Fix rpcrdma_reqs_reset()
+    - SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
+    - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server
+    - ext4: don't track ranges in fast_commit if inode has inlined data
+    - ext4: avoid writing unitialized memory to disk in EA inodes
+    - leds: flash: leds-qcom-flash: Test the correct variable in init
+    - sparc64: Fix incorrect function signature and add prototype for
+      prom_cif_init
+    - SUNRPC: Fixup gss_status tracepoint error output
+    - iio: Fix the sorting functionality in iio_gts_build_avail_time_table
+    - PCI: Fix resource double counting on remove & rescan
+    - PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode()
+    - PCI: keystone: Don't enable BAR 0 for AM654x
+    - PCI: keystone: Fix NULL pointer dereference in case of DT error in
+      ks_pcie_setup_rc_app_regs()
+    - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()
+    - scsi: ufs: mcq: Fix missing argument 'hba' in MCQ_OPR_OFFSET_n
+    - clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock
+    - clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs
+    - iio: frequency: adrf6780: rm clk provider include
+    - coresight: Fix ref leak when of_coresight_parse_endpoint() fails
+    - RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE
+    - ASoc: tas2781: Enable RCA-based playback without DSP firmware download
+    - ASoC: cs35l56: Accept values greater than 0 as IRQ numbers
+    - usb: typec-mux: nb7vpq904m: unregister typec switch on probe error and
+      remove
+    - RDMA/cache: Release GID table even if leak is detected
+    - clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable
+    - clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags
+    - clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags
+    - clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable
+    - clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's
+    - interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID
+    - Input: qt1050 - handle CHIP_ID reading error
+    - RDMA/mlx4: Fix truncated output warning in mad.c
+    - RDMA/mlx4: Fix truncated output warning in alias_GUID.c
+    - RDMA/mlx5: Use sq timestamp as QP timestamp when RoCE is disabled
+    - RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
+    - ASoC: qcom: Adjust issues in case of DT error in
+      asoc_qcom_lpass_cpu_platform_probe()
+    - scsi: lpfc: Fix a possible null pointer dereference
+    - hwrng: core - Fix wrong quality calculation at hw rng registration
+    - powerpc/prom: Add CPU info to hardware description string later
+    - ASoC: max98088: Check for clk_prepare_enable() error
+    - mtd: make mtd_test.c a separate module
+    - RDMA/device: Return error earlier if port in not valid
+    - Input: elan_i2c - do not leave interrupt disabled on suspend failure
+    - ASoC: amd: Adjust error handling in case of absent codec device
+    - PCI: endpoint: Clean up error handling in vpci_scan_bus()
+    - PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup()
+    - vhost/vsock: always initialize seqpacket_allow
+    - net: missing check virtio
+    - nvmem: rockchip-otp: set add_legacy_fixed_of_cells config option
+    - crypto: qat - extend scope of lock in adf_cfg_add_key_value_param()
+    - clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error
+    - clk: qcom: Park shared RCGs upon registration
+    - clk: en7523: fix rate divider for slic and spi clocks
+    - MIPS: Octeron: remove source file executable bit
+    - PCI: qcom-ep: Disable resources unconditionally during PERST# assert
+    - PCI: dwc: Fix index 0 incorrectly being interpreted as a free ATU slot
+    - powerpc/xmon: Fix disassembly CPU feature checks
+    - macintosh/therm_windtunnel: fix module unload.
+    - RDMA/hns: Check atomic wr length
+    - RDMA/hns: Fix unmatch exception handling when init eq table fails
+    - RDMA/hns: Fix missing pagesize and alignment check in FRMR
+    - RDMA/hns: Fix shift-out-bounds when max_inline_data is 0
+    - RDMA/hns: Fix undifined behavior caused by invalid max_sge
+    - RDMA/hns: Fix insufficient extend DB for VFs.
+    - iommu/vt-d: Fix identity map bounds in si_domain_init()
+    - RDMA/core: Remove NULL check before dev_{put, hold}
+    - RDMA: Fix netdev tracker in ib_device_set_netdev
+    - bnxt_re: Fix imm_data endianness
+    - netfilter: ctnetlink: use helper function to calculate expect ID
+    - netfilter: nf_set_pipapo: fix initial map fill
+    - ipvs: properly dereference pe in ip_vs_add_service
+    - gve: Fix XDP TX completion handling when counters overflow
+    - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
+    - ipv4: Fix incorrect TOS in route get reply
+    - ipv4: Fix incorrect TOS in fibmatch route get reply
+    - net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
+    - net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
+    - fs/ntfs3: Merge synonym COMPRESSION_UNIT and NTFS_LZNT_CUNIT
+    - fs/ntfs3: Fix transform resident to nonresident for compressed files
+    - fs/ntfs3: Deny getting attr data block in compressed frame
+    - fs/ntfs3: Missed NI_FLAG_UPDATE_PARENT setting
+    - fs/ntfs3: Fix getting file type
+    - fs/ntfs3: Add missing .dirty_folio in address_space_operations
+    - pinctrl: rockchip: update rk3308 iomux routes
+    - pinctrl: core: fix possible memory leak when pinctrl_enable() fails
+    - pinctrl: single: fix possible memory leak when pinctrl_enable() fails
+    - pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable()
+      fails
+    - pinctrl: freescale: mxs: Fix refcount of child
+    - fs/ntfs3: Replace inode_trylock with inode_lock
+    - fs/ntfs3: Correct undo if ntfs_create_inode failed
+    - fs/ntfs3: Drop stray '\' (backslash) in formatting string
+    - fs/ntfs3: Fix field-spanning write in INDEX_HDR
+    - pinctrl: renesas: r8a779g0: Fix CANFD5 suffix
+    - pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes
+    - pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes
+    - pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes
+    - pinctrl: renesas: r8a779g0: Fix IRQ suffixes
+    - pinctrl: renesas: r8a779g0: FIX PWM suffixes
+    - pinctrl: renesas: r8a779g0: Fix TCLK suffixes
+    - pinctrl: renesas: r8a779g0: Fix TPU suffixes
+    - fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
+    - fs/proc/task_mmu.c: add_to_pagemap: remove useless parameter addr
+    - fs/proc/task_mmu: don't indicate PM_MMAP_EXCLUSIVE without PM_PRESENT
+    - fs/proc/task_mmu: properly detect PM_MMAP_EXCLUSIVE per page of PMD-mapped
+      THPs
+    - nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
+    - rtc: interface: Add RTC offset to alarm after fix-up
+    - fs/ntfs3: Fix the format of the "nocase" mount option
+    - fs/ntfs3: Missed error return
+    - fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP
+    - powerpc/8xx: fix size given to set_huge_pte_at()
+    - s390/dasd: fix error checks in dasd_copy_pair_store()
+    - sbitmap: use READ_ONCE to access map->word
+    - sbitmap: fix io hung due to race on sbitmap_word::cleared
+    - LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint
+    - landlock: Don't lose track of restrictions on cred_transfer
+    - hugetlb: force allocating surplus hugepages on mempolicy allowed nodes
+    - mm/hugetlb: fix possible recursive locking detected warning
+    - mm/mglru: fix div-by-zero in vmpressure_calc_level()
+    - mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer
+    - mm/mglru: fix overshooting shrinker memory
+    - x86/efistub: Avoid returning EFI_SUCCESS on error
+    - x86/efistub: Revert to heap allocated boot_params for PE entrypoint
+    - exfat: fix potential deadlock on __exfat_get_dentry_set
+    - dt-bindings: thermal: correct thermal zone node name limit
+    - tick/broadcast: Make takeover of broadcast hrtimer reliable
+    - net: netconsole: Disable target before netpoll cleanup
+    - af_packet: Handle outgoing VLAN packets without hardware offloading
+    - btrfs: fix extent map use-after-free when adding pages to compressed bio
+    - kernel: rerun task_work while freezing in get_signal()
+    - ipv4: fix source address selection with route leak
+    - ipv6: take care of scope when choosing the src addr
+    - NFSD: Support write delegations in LAYOUTGET
+    - sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE
+      tasks
+    - fuse: verify {g,u}id mount options correctly
+    - ata: libata-scsi: Fix offsets for the fixed format sense data
+    - char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
+    - media: venus: fix use after free in vdec_close
+    - ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1
+    - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
+    - ext2: Verify bitmap and itable block numbers before using them
+    - io_uring/io-wq: limit retrying worker initialisation
+    - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
+    - drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
+    - scsi: qla2xxx: Fix optrom version displayed in FDMI
+    - drm/amd/display: Check for NULL pointer
+    - apparmor: use kvfree_sensitive to free data->data
+    - cifs: fix potential null pointer use in destroy_workqueue in init_cifs error
+      path
+    - cifs: fix reconnect with SMB1 UNIX Extensions
+    - cifs: mount with "unix" mount option for SMB1 incorrectly handled
+    - task_work: s/task_work_cancel()/task_work_cancel_func()/
+    - task_work: Introduce task_work_cancel() again
+    - udf: Avoid using corrupted block bitmap buffer
+    - m68k: amiga: Turn off Warp1260 interrupts during boot
+    - ext4: check dot and dotdot of dx_root before making dir indexed
+    - ext4: make sure the first directory block is not a hole
+    - io_uring: tighten task exit cancellations
+    - trace/pid_list: Change gfp flags in pid_list_fill_irq()
+    - selftests/landlock: Add cred_transfer test
+    - wifi: mwifiex: Fix interface type change
+    - wifi: rtw88: usb: Fix disconnection after beacon loss
+    - drivers: soc: xilinx: check return status of get_api_version()
+    - leds: ss4200: Convert PCIBIOS_* return codes to errnos
+    - leds: mt6360: Fix memory leak in mt6360_init_isnk_properties()
+    - media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
+    - jbd2: make jbd2_journal_get_max_txn_bufs() internal
+    - jbd2: precompute number of transaction descriptor blocks
+    - jbd2: avoid infinite transaction commit loop
+    - media: uvcvideo: Fix integer overflow calculating timestamp
+    - KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
+    - KVM: nVMX: Request immediate exit iff pending nested event needs injection
+    - ALSA: ump: Don't update FB name for static blocks
+    - ALSA: ump: Force 1 Group for MIDI1 FBs
+    - ALSA: usb-audio: Fix microphone sound on HD webcam.
+    - ALSA: usb-audio: Move HD Webcam quirk to the right place
+    - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
+    - tools/memory-model: Fix bug in lock.cat
+    - hwrng: amd - Convert PCIBIOS_* return codes to errnos
+    - parisc: Fix warning at drivers/pci/msi/msi.h:121
+    - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
+    - PCI: dw-rockchip: Fix initial PERST# GPIO value
+    - PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
+    - PCI: loongson: Enable MSI in LS7A Root Complex
+    - binder: fix hang of unregistered readers
+    - hostfs: fix dev_t handling
+    - efi/libstub: Zero initialize heap allocated struct screen_info
+    - fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
+    - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
+    - ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
+    - f2fs: fix to force buffered IO on inline_data inode
+    - f2fs: fix to don't dirty inode for readonly filesystem
+    - f2fs: fix return value of f2fs_convert_inline_inode()
+    - f2fs: use meta inode for GC of atomic file
+    - f2fs: use meta inode for GC of COW file
+    - clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
+    - ubi: eba: properly rollback inside self_check_eba
+    - block: fix deadlock between sd_remove & sd_release
+    - mm: fix old/young bit handling in the faulting path
+    - decompress_bunzip2: fix rare decompression failure
+    - kbuild: Fix '-S -c' in x86 stack protector scripts
+    - ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA on unprepare
+    - ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2
+    - kobject_uevent: Fix OOB access within zap_modalias_env()
+    - gve: Fix an edge case for TSO skb validity check
+    - ice: Add a per-VF limit on number of FDIR filters
+    - devres: Fix devm_krealloc() wasting memory
+    - devres: Fix memory leakage caused by driver API devm_free_percpu()
+    - irqdomain: Fixed unbalanced fwnode get and put
+    - irqchip/imx-irqsteer: Handle runtime power management correctly
+    - mm/numa_balancing: teach mpol_to_str about the balancing mode
+    - rtc: cmos: Fix return value of nvmem callbacks
+    - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE
+      state
+    - scsi: qla2xxx: During vport delete send async logout explicitly
+    - scsi: qla2xxx: Unable to act on RSCN for port online
+    - scsi: qla2xxx: Fix for possible memory corruption
+    - scsi: qla2xxx: Use QP lock to search for bsg
+    - scsi: qla2xxx: Reduce fabric scan duplicate code
+    - scsi: qla2xxx: Fix flash read failure
+    - scsi: qla2xxx: Complete command early within lock
+    - scsi: qla2xxx: validate nvme_local_port correctly
+    - perf: Fix event leak upon exit
+    - perf: Fix event leak upon exec and file release
+    - perf stat: Fix the hard-coded metrics calculation on the hybrid
+    - perf/x86/intel/uncore: Fix the bits of the CHA extended umask for SPR
+    - perf/x86/intel/ds: Fix non 0 retire latency on Raptorlake
+    - perf/x86/intel/pt: Fix topa_entry base length
+    - perf/x86/intel/pt: Fix a topa_entry base address calculation
+    - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8
+    - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell
+    - drm/udl: Remove DRM_CONNECTOR_POLL_HPD
+    - drm/dp_mst: Fix all mstb marked as not probed after suspend/resume
+    - drm/amdgpu: reset vm state machine after gpu reset(vram lost)
+    - drm/amd/amdgpu: Fix uninitialized variable warnings
+    - drm/i915/dp: Reset intel_dp->link_trained before retraining the link
+    - drm/i915/dp: Don't switch the LTTPR mode on an active link
+    - rtc: isl1208: Fix return value of nvmem callbacks
+    - rtc: abx80x: Fix return value of nvmem callback on read
+    - watchdog/perf: properly initialize the turbo mode timestamp and rearm
+      counter
+    - platform: mips: cpu_hwmon: Disable driver on unsupported hardware
+    - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
+    - selftests/sigaltstack: Fix ppc64 GCC build
+    - dm-verity: fix dm_is_verity_target() when dm-verity is builtin
+    - rbd: don't assume rbd_is_lock_owner() for exclusive mappings
+    - remoteproc: stm32_rproc: Fix mailbox interrupts queuing
+    - remoteproc: imx_rproc: Skip over memory region when node value is NULL
+    - remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init
+    - MIPS: dts: loongson: Add ISA node
+    - MIPS: ip30: ip30-console: Add missing include
+    - MIPS: dts: loongson: Fix GMAC phy node
+    - MIPS: Loongson64: env: Hook up Loongsson-2K
+    - MIPS: Loongson64: Remove memory node for builtin-dtb
+    - MIPS: Loongson64: reset: Prioritise firmware service
+    - MIPS: Loongson64: Test register availability before use
+    - drm/etnaviv: don't block scheduler when GPU is still active
+    - drm/panfrost: Mark simple_ondemand governor as softdep
+    - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
+    - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
+    - lib/build_OID_registry: don't mention the full path of the script in output
+    - video: logo: Drop full path of the input filename in generated file
+    - Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
+    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
+    - minmax: scsi: fix mis-use of 'clamp()' in sr.c
+    - mm/mglru: fix ineffective protection calculation
+    - PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
+    - f2fs: fix to truncate preallocated blocks in f2fs_file_open()
+    - kdb: address -Wformat-security warnings
+    - kdb: Use the passed prompt in kdb_position_cursor()
+    - dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels
+    - phy: cadence-torrent: Check return value on register read
+    - phy: zynqmp: Enable reference clock correctly
+    - um: time-travel: fix time-travel-start option
+    - um: time-travel: fix signal blocking race/hang
+    - f2fs: fix start segno of large section
+    - watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get()
+    - watchdog: rzg2l_wdt: Check return status of pm_runtime_put()
+    - f2fs: fix to update user block counts in block_operations()
+    - kbuild: avoid build error when single DTB is turned into composite DTB
+    - selftests/bpf: fexit_sleep: Fix stack allocation for arm64
+    - libbpf: Fix no-args func prototype BTF dumping syntax
+    - af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash
+    - dma: fix call order in dmam_free_coherent
+    - bpf, events: Use prog to emit ksymbol event for main program
+    - tools/resolve_btfids: Fix comparison of distinct pointer types warning in
+      resolve_btfids
+    - MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
+    - ipv4: Fix incorrect source address in Record Route option
+    - net: bonding: correctly annotate RCU in bond_should_notify_peers()
+    - ice: Fix recipe read procedure
+    - netfilter: nft_set_pipapo_avx2: disable softinterrupts
+    - net: stmmac: Correct byte order of perfect_match
+    - net: nexthop: Initialize all fields in dumped nexthops
+    - bpf: Fix a segment issue when downgrading gso_size
+    - apparmor: Fix null pointer deref when receiving skb during sock creation
+    - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
+    - lirc: rc_dev_get_from_fd(): fix file leak
+    - auxdisplay: ht16k33: Drop reference after LED registration
+    - ASoC: SOF: imx8m: Fix DSP control regmap retrieval
+    - spi: microchip-core: fix the issues in the isr
+    - spi: microchip-core: defer asserting chip select until just before write to
+      TX FIFO
+    - spi: microchip-core: only disable SPI controller when register value change
+      requires it
+    - spi: microchip-core: fix init function not setting the master and motorola
+      modes
+    - spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer
+    - nvme-pci: Fix the instructions for disabling power management
+    - ASoC: sof: amd: fix for firmware reload failure in Vangogh platform
+    - spi: spidev: add correct compatible for Rohm BH2228FV
+    - ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
+    - ASoC: TAS2781: Fix tasdev_load_calibrated_data()
+    - ceph: fix incorrect kmalloc size of pagevec mempool
+    - s390/pci: Refactor arch_setup_msi_irqs()
+    - s390/pci: Allow allocation of more than 1 MSI interrupt
+    - s390/cpum_cf: Fix endless loop in CF_DIAG event stop
+    - iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
+    - io_uring: fix io_match_task must_hold
+    - nvme-pci: add missing condition check for existence of mapped data
+    - fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
+    - md/raid0: don't free conf on raid0_run failure
+    - md/raid1: don't free conf on raid0_run failure
+    - io_uring: Fix probe of disabled operations
+    - cgroup/cpuset: Optimize isolated partition only generate_sched_domains()
+      calls
+    - cgroup/cpuset: Fix remote root partition creation problem
+    - x86/syscall: Mark exit[_group] syscall handlers __noreturn
+    - perf: arm_pmuv3: Avoid assigning fixed cycle counter with threshold
+    - md/raid5: recheck if reshape has finished with device_lock held
+    - hwmon: (ltc2991) re-order conditions to fix off by one bug
+    - arm64: smp: Fix missing IPI statistics
+    - arm64: dts: qcom: sc7280: Remove CTS/RTS configuration
+    - ARM: dts: qcom: msm8226-microsoft-common: Enable smbb explicitly
+    - OPP: Fix missing cleanup on error in _opp_attach_genpd()
+    - arm64: dts: qcom: sc8280xp-*: Remove thermal zone polling delays
+    - arm64: dts: ti: k3-am62-main: Fix the reg-range for main_pktdma
+    - arm64: dts: ti: k3-am62a-main: Fix the reg-range for main_pktdma
+    - arm64: dts: ti: k3-am62p-main: Fix the reg-range for main_pktdma
+    - arm64: dts: ti: k3-am62a7: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am62p5: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am62p5-sk: Fix pinmux for McASP1 TX
+    - arm64: dts: qcom: sc7180-trogdor: Disable pwmleds node where unused
+    - arm64: dts: mediatek: mt8192: Fix GPU thermal zone name for SVS
+    - arm64: dts: mediatek: mt8183-pico6: Fix wake-on-X event node names
+    - arm64: dts: renesas: r9a08g045: Add missing hypervisor virtual timer IRQ
+    - cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons
+    - wifi: mac80211: cancel multi-link reconf work on disconnect
+    - wifi: ath11k: refactor setting country code logic
+    - wifi: ath11k: restore country code during resume
+    - net: ethernet: cortina: Restore TSO support
+    - tcp: fix races in tcp_abort()
+    - hns3: avoid linking objects into multiple modules
+    - sched/core: Move preempt_model_*() helpers from sched.h to preempt.h
+    - sched/core: Drop spinlocks on contention iff kernel is preemptible
+    - net: dsa: ksz_common: Allow only up to two HSR HW offloaded ports for
+      KSZ9477
+    - libbpf: Skip base btf sanity checks
+    - wifi: mac80211: add ieee80211_tdls_sta_link_id()
+    - wifi: iwlwifi: fix iwl_mvm_get_valid_rx_ant()
+    - wifi: ath12k: advertise driver capabilities for MBSSID and EMA
+    - riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
+    - perf/x86/amd/uncore: Avoid PMU registration if counters are unavailable
+    - perf/x86/amd/uncore: Fix DF and UMC domain identification
+    - NFSD: Fix nfsdcld warning
+    - net: page_pool: fix warning code
+    - bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
+    - Bluetooth: hci_event: Set QoS encryption from BIGInfo report
+    - Bluetooth: hci_core, hci_sync: cleanup struct discovery_state
+    - Bluetooth: Fix usage of __hci_cmd_sync_status
+    - tcp: Don't access uninit tcp_rsk(req)->ao_keyid in
+      tcp_create_openreq_child().
+    - drm/panel: ilitek-ili9882t: If prepare fails, disable GPIO before regulators
+    - drm/panel: ilitek-ili9882t: Check for errors on the NOP in prepare()
+    - drm/amd/display: Move 'struct scaler_data' off stack
+    - media: i2c: hi846: Fix V4L2_SUBDEV_FORMAT_TRY get_selection()
+    - drm/msm/dpu: fix encoder irq wait skip
+    - drm/msm/dpu: drop duplicate drm formats from wb2_formats arrays
+    - drm/msm/dp: fix runtime_pm handling in dp_wait_hpd_asserted
+    - perf maps: Switch from rbtree to lazily sorted array for addresses
+    - perf maps: Fix use after free in __maps__fixup_overlap_and_insert
+    - drm/bridge: samsung-dsim: Set P divider based on min/max of fin pll
+    - drm/i915/psr: Print Panel Replay status instead of frame lock status
+    - drm/mediatek: Set DRM mode configs accordingly
+    - drm/msm/dsi: set video mode widebus enable bit when widebus is enabled
+    - tools/perf: Fix the string match for "/tmp/perf-$PID.map" files in dso__load
+    - drm/amd/display: Add null check before access structs
+    - nfs: pass explicit offset/count to trace events
+    - PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in
+      pci_epf_test_core_init()
+    - PCI: tegra194: Set EP alignment restriction for inbound ATU
+    - riscv: smp: fail booting up smp if inconsistent vlen is detected
+    - clk: meson: s4: fix fixed_pll_dco clock
+    - clk: meson: s4: fix pwm_j_div parent clock
+    - usb: typec-mux: ptn36502: unregister typec switch on probe error and remove
+    - mtd: spi-nor: winbond: fix w25q128 regression
+    - iommufd/selftest: Fix dirty bitmap tests with u8 bitmaps
+    - iommufd/selftest: Fix iommufd_test_dirty() to handle <u8 bitmaps
+    - iommufd/selftest: Add tests for <= u8 bitmap sizes
+    - iommufd/selftest: Fix tests to use MOCK_PAGE_SIZE based buffer sizes
+    - iommufd/iova_bitmap: Check iova_bitmap_done() after set ahead
+    - clk: qcom: gcc-x1e80100: Fix halt_check for all pipe clocks
+    - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
+    - kvm: s390: Reject memory region operations for ucontrol VMs
+    - eeprom: ee1004: Call i2c_new_scanned_device to instantiate thermal sensor
+    - clk: qcom: gcc-x1e80100: Set parent rate for USB3 sec and tert PHY pipe clks
+    - workqueue: Introduce from_work() helper for cleaner callback declarations
+    - RDMA/hns: Fix mbx timing out before CMD execution is completed
+    - crypto: mxs-dcp - Ensure payload is zero when using key slot
+    - RDMA/mana_ib: Enable RoCE on port 1
+    - RDMA/mana_ib: set node_guid
+    - rtc: tps6594: Fix memleak in probe
+    - selftests/damon/access_memory: use user-defined region size
+    - md-cluster: fix hanging issue while a new disk adding
+    - power: supply: ab8500: Fix error handling when calling
+      iio_read_channel_processed()
+    - power: supply: ingenic: Fix some error handling paths in
+      ingenic_battery_get_property()
+    - remoteproc: mediatek: Don't attempt to remap l1tcm memory if missing
+    - remoteproc: k3-r5: Fix IPC-only mode detection
+    - mailbox: imx: fix TXDB_V2 channel race condition
+    - mailbox: mtk-cmdq: Move devm_mbox_controller_register() after
+      devm_pm_runtime_enable()
+    - mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit
+      machines
+    - mm/huge_memory: avoid PMD-size page cache if needed
+    - thermal/drivers/broadcom: Fix race between removal and clock disable
+    - workqueue: Always queue work items to the newest PWQ for order workqueues
+    - ipv6: fix source address selection with route leak
+    - drm/xe: Use write-back caching mode for system memory on DGFX
+    - md/raid5: fix spares errors about rcu usage
+    - media: stm32: dcmipp: correct error handling in dcmipp_create_subdevs
+    - tpm_tis_spi: add missing attpm20p SPI device ID entry
+    - sysctl: always initialize i_uid/i_gid
+    - media: i2c: Kconfig: Fix missing firmware upload config select
+    - genirq: Set IRQF_COND_ONESHOT in request_irq()
+    - cpufreq: qcom-nvmem: fix memory leaks in probe error paths
+    - leds: triggers: Flush pending brightness before activating trigger
+    - media: i2c: alvium: Move V4L2_CID_GAIN to V4L2_CID_ANALOG_GAIN
+    - KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector
+    - KVM: nVMX: Check for pending posted interrupts when looking for nested
+      events
+    - ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
+    - fbdev: vesafb: Detect VGA compatibility from screen info's VESA attributes
+    - drm/fbdev-dma: Fix framebuffer mode for big endian devices
+    - xhci: Apply XHCI_RESET_TO_DEFAULT quirk to TGL
+    - dmaengine: fsl-edma: clean up unused "fsl,imx8qm-adma" compatible string
+    - dmaengine: fsl-edma: change the memory access from local into remote mode in
+      i.MX 8QM
+    - clk: samsung: fix getting Exynos4 fin_pll rate from external clocks
+    - bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone
+    - ASoC: SOF: ipc4-topology: Use correct queue_id for requesting input pin
+      format
+    - arch: um: rust: Use the generated target.json again
+    - f2fs: fix null reference error when checking end of zone
+    - selftests: forwarding: skip if kernel not support setting bridge fdb
+      learning limit
+    - xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len
+    - drm/xe/exec: Fix minor bug related to xe_sync_entry_cleanup
+    - thermal: trip: Split thermal_zone_device_set_mode()
+    - apparmor: unpack transition table if dfa is not present
+    - i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1
+    - selinux,smack: remove the capability checks in the removexattr hooks
+    - selftests/bpf: DENYLIST.aarch64: Skip fexit_sleep again
+    - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
+    - Upstream stable to v6.6.44, v6.10.3
+  * Noble update: upstream stable patchset 2024-09-30 (LP: #2083196) //
+    CVE-2024-42284
+    - tipc: Return non-zero value from tipc_udp_addr2str() on error
+  * CVE-2024-44987
+    - ipv6: prevent UAF in ip6_send_skb()
+  * CVE-2024-42301
+    - dev/parport: fix the array out-of-bounds risk
+  * CVE-2024-44998
+    - atm: idt77252: prevent use after free in dequeue_rx()
+
+  [ Ubuntu: 6.8.0-49.49 ]
+
+  * noble/linux: 6.8.0-49.49 -proposed tracker (LP: #2085942)
+  * CVE-2024-46800
+    - sch/netem: fix use after free in netem_dequeue
+  * mm/folios: xfs hangs with hung task timeouts with corrupted folio pointer
+    lists (LP: #2085495)
+    - lib/xarray: introduce a new helper xas_get_order
+    - mm/filemap: return early if failed to allocate memory for split
+    - mm/filemap: optimize filemap folio adding
+  * CVE-2024-43882
+    - exec: Fix ToCToU between perm check and set-uid/gid usage
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 04 Dec 2024 13:04:13 +0900
+
+linux-qcom (6.8.0-1014.14) jammy; urgency=medium
+
+  * [RB3] CONFIG_KASAN_GENERIC report potential memory bug in tc956x_pcie_eth
+    - SAUCE: ubuntu/qcom/qps615: suppress KASAN error
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: arm64: dts: qcom: remove redundant code in qcs6490.dtsi
+
+  * Miscellaneous upstream changes
+    - QCLINUX: data-eth: qps615: Properly set HW address assign type property
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 24 Oct 2024 22:10:11 +0900
+
+linux-qcom (6.8.0-1013.13) jammy; urgency=medium
+
+  * "[RB3] tc956x_pci-eth errors found in dmesg"
+    - SAUCE: ubuntu/qcom/qps615: suppress false alerts
+    - SAUCE: ubuntu/qcom/qps615: use INFO level for logging
+
+  * [RB3] drm sde error/ msm-dsi-error found in dmesg
+    - SAUCE: do not show error on EPROBE_DEFER
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: arm64: dts: qcom: enable WIFI
+    - SAUCE: import external DT from GA 1.2
+    - SAUCE: Add Makefile code to apply overlays for GA1.2
+    - SAUCE: ubuntu/qcom/display: import qcm6490 display code from GA1.2
+    - SAUCE: ubuntu/qcom/graphics: import qcm6490 graphics driver code from GA1.2
+    - SAUCE: ubuntu/qcom/camera: import qcm6490 camera driver code from GA1.2
+    - SAUCE: ubuntu/qcom/qps615: import ethernet driver from GA1.2
+    - SAUCE: ubuntu/qcom/video: import video driver from GA 1.2
+    - SAUCE: ubuntu/qcom/touch: import touch driver from GA 1.2
+    - SAUCE: ubuntu/qcom: build external drivers
+    - SAUCE: ubuntu/qcom/camera: fix build warnings and errors
+    - SAUCE: suppress unneeded build logs
+    - SAUCE: ubuntu/qcom: suppress warning and error
+    - SAUCE: ubuntu/qcom/graphics: change strtobool() to kstrtobool()
+    - SAUCE: ubuntu/qcom/graphics: dynamically allocate the kgsl-pool shrinker for
+      kernel>=6.7
+    - SAUCE: ubuntu/qcom/camera: remove unused camera_banner
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/video: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/touch: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: auto-load module
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: ubuntu/qcom/display: Rename min_buffers_needed to min_queued_buffers
+    - SAUCE: ubuntu/qcom: remove DRM_UNLOCKED
+    - SAUCE: ubuntu/qcom/display: suppress EPROBE_DEFER error log
+    - SAUCE: rename qcom,phy-rst-gpio to qcom,phy-rst-gpio-id
+    - SAUCE: Revert "PENDING: arm64: dts: qcom: qcs6490-rb3gen2: Enable IMX577
+      camera sensor"
+    - SAUCE: ASoC: wsa883x:  suppress noisy pr_err
+
+  * Miscellaneous upstream changes
+    - Revert "rpmsg: glink: Introduce packet tracepoints"
+    - PENDING: arm64: dts: qcom: sa8775p: add TBU support
+    - QCLINUX: coresight: add etr ATID filter function support
+    - PENDING: ASOC: WSA883X: Add swr slave dev number kcontrol
+    - FROMLIST: arm64: dts: qcom: sc7280: Add PCIe0 node
+    - QCLINUX: arm64: defconfig: qcom: Enable BT_BNEP
+    - QCLINUX: arm64: dts: qcom: sa8775p-ride: add board id and msm id support
+    - PENDING: coresight: tmc: Fix byte-cntr irq count mismatch issue
+    - QCLINUX: arm64: qcom_debug: Enable ATH trace
+    - QCLINUX: arm64: dts: qcom: sa8775p: Disable gunyah watchdog
+    - PENDING: arm64: dts: qcom: sa8775p: Add tz-log node
+    - QCLINUX: arm64: defconfig: qcom: Enable UINPUT
+    - PENDING: arm64: dts: qcom: sa8775: add QCrypto nodes
+    - PENDING: arm64: dts: qcom: sa8775p: add coresight components
+    - QCLINUX: arm64: dts: qcom: sa8775p: addons: add coresight components
+    - QCLINUX: net: can: Add support for mcp25xxfd driver
+    - BACKPORT: FROMLIST: wifi: ath11k: Add firmware coredump collection support
+    - QCLINUX: arm64: defconfig: Enable ATH reg setting
+    - PENDING: media: qcom: camss: Designate lite subdevices in resources
+    - PENDING: thermal: qcom: Add support for MBG Temp monitor
+    - FROMLIST: soc: qcom: icc-bwmon: Allow for interrupts to be shared across
+      instances
+    - PENDING: dt-bindings: iio: Add ADC5 GEN3 Channel macros
+    - PENDING: arm64: dts: qcom: sa8775p: Add cpu and llcc BWMON
+    - QCLINUX: ASoC: qcom: qcm6490: Add sound card compatible for qcs6490 rb3gen2
+      mezzanine boards
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add uart4 node for RB3GEN2 video-
+      mezz
+    - BACKPORT: FROMLIST: iio: adc: Add support for QCOM PMIC5 Gen3 ADC
+    - PENDING: arm64: dts: qcom: sc7280: Add support for camss
+    - PENDING: arm64: dts: qcom: sa8775p: add remaining coresight components
+    - QCLINUX: arm64: dts: qcom: Remove iommu enc dec data from venus node
+    - PENDING: ARM: dts: qcom: Add support for MBG TM for pm8775
+    - PENDING: dt-bindings: clock: qcom: Add qdss_xo clock SA8775P
+    - PENDING: clk: qcom: Add support for qdss_xo clock for SA8775P
+    - PENDING: arm64: dts: qcom: sa8775p: add dma-coherent for smmu
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add dcc device tree node
+    - QCLINUX: arm64: dts: qcom: Add memory dump table on SA8775p
+    - PENDING: arm64: dts: qcom: sa8775p: Add fastrpc nsession property
+    - PENDING: arm64: dts: qcom: qcs6490-rb3gen2: Enable IMX577 camera sensor
+    - PENDING: i2c: Enable IMX577 camera sensor for qcm6490
+    - QCLINUX: arm64: defconfig: qcom: Enable IMX577 module support
+    - QCLINUX: arm64: qcom_debug: Enable ath11k coredump
+    - QCLINUX: ASoC: qcom: qcm6490: Update widgets for rb3gen2-ia-mezz board
+    - PENDING: misc: dcc: Fix invalid character issue
+    - QCLINUX: ASoC: qcm6490: Add sound card support for QCS9100
+    - PENDING: arm64: dts: qcom: sa8775p: add NSP0 fastrpc-compute-cb nodes
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for Rb3Gen2
+    - PENDING: arm64: dts: qcom: sa8775p: Add QFPROM node
+    - PENDING: arm64: dts: qcom: sa8775p: Correct the device name for TPDM and CTI
+    - QCLINUX: arm64: defconfig: Update memory configs
+    - PENDING: arm64: dts: qcom: sa8775p: Add memory region for audioPD
+    - FROMLIST: coresight: Add support to get preferred id for system trace
+      sources
+    - FROMLIST: coresight: dummy: Add reserve atid support for dummy source
+    - QCLINUX: virt: gunyah: Zero state_data after vcpu_run
+    - QCLINUX: arm64: defconfig: qcom: Enable MBG TM and ADC5 Gen3
+    - QCLINUX: arm64: dts: qcom: sa8775p: addons: Correct the device name for
+    - QCLINUX: arm64: dts: qcom: Add trace-id of modem_diag for qcm6490
+    - PENDING: misc: fastrpc: Fix registered buffer page address
+    - PENDING: arm64: dts: qcom: qcm6490: Use existing tcsr_2 node from sc7280
+    - PENDING: pinctrl: qcom: Add sa8775p lpass lpi pinctrl driver
+    - PENDING: opp: add a new helper set_opp api
+    - PENDING: can: mcp251xfd: enable CAN transceiver using gpio_0
+    - PENDING: arm64: config: Enable MCP251x CAN Device
+    - QCLINUX: ASoC: codecs: msm-stub: Add AIF2 dai support for LPI MI2S interface
+    - PENDING: arm64: dts: qcom: Add MCP251xFD CAN Controller
+    - PENDING: firmware: arm_scmi: add qcom smc xport descriptor
+    - QCLINUX: arm64: dts: qcom: sa8775p: Remove status override for watchdog node
+    - PENDING: arm64: dts: qcom: sc7280: Add device name for CTIs
+    - QCLINUX: arm64: defconfig: Enable LPASS LPI SA8775P pinctrl
+    - PENDING: crypto: qce - Add command descriptor support for crypto driver
+    - QCLINUX: usb: dwc3: core: Set driver data before core init
+    - QCLINUX: ASoC: qcom: qcm6490: Remove LPASS_CDC_DMA_TX3 dai id from
+      qcm6490_snd_init
+    - QCLINUX: ASoC: codecs: wcd937x: Add conditional regulator control for
+      wcd937x
+    - QCLINUX: coresight: tpdm: Correct the TPDA Key
+    - QCLINUX: arm64: dts: qcom: Bringup wcd9375 headphone on rb3gen2-ia-mezz
+      board
+    - PENDING: soc: qcom: socinfo: add SoC Info support for QCS9100 platform
+    - PENDING: dt-bindings: arm: qcom,ids: Add SoC ID for QCS9100
+    - PENDING: arm64: dts: qcom: sa8775p: Add gpr device tree node for ADSP
+    - PENDING: soc: qcom: socinfo: add SoC Info support for QCM6490 and QCS6490
+      platform
+    - PENDING: dt-bindings: arm: qcom,ids: Add SoC ID for QCM6490 and QCS6490
+    - PENDING: pinctrl: sa8775p: Update function and group binding
+    - QCLINUX: ASoC: qcom: qcm6490: Add AIF2 dapm pinctrl widget for QCS9100
+    - PENDING: arm64: dts: qcom: sa8775p: Add TCSR halt register space
+    - QCLINUX: soc: qcom: Update soc wdt node only for sc7280
+    - PENDING: arm64: qcom: dts: sa8775p: Add psci sys_reset2 modes
+    - QCLINUX: soc: qcom: Add documentation to align with code
+    - PENDING: arm64: dts: qcom: sa8775p: add rdbg nodes
+    - PENDING: gunyah: Add support for tracking Guest VM run time
+    - QCLINUX: arm64: dts: qcom: Add qcm6490 IDP dts file
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add lpass_tlmm node for lpi pinctrl
+    - PENDING: drivers: char: add remote debugger driver support for cDSP1
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add sound node for qcs9100 ridesx target
+    - PENDING: coresight: tmc: Remove duplicated ETR disable HW
+    - PENDING: arm64: dts: qcom: sc7280: Add msr properties to TPDMs
+    - QCLINUX: arm64: dts: qcom: Enable the uart for Rb3gen2-IA-MEZZ board
+    - QCLINUX: arm64: dts: qcom: Bring up LED-GPIO for Rb3gen2-IA-MEZZ board
+    - PENDING: ARM: dts: qcom: sa8775p: Update VADC interrupt-name
+    - QCLINUX: arm64: dts: qcom: Bring up I2C switch for Rb3gen2-IA-MEZZ board
+    - QCLINUX: arm64: deconfig: qcom: Enable vfio driver
+    - QCLINUX: arm64: deconfig: qcom: Enable mhi_bus_ep driver
+    - FROMLIST: iommu/arm-smmu-qcom: NULL pointer check for driver data
+    - QCLINUX: Revert "QCLINUX: net: can: Add support for mcp25xxfd driver"
+    - QCLINUX: qcom: tz_log: enable tz_log support hypervisor
+    - QCLINUX: coresight: Use desc name to get the CSR node
+    - QCLINUX: arm64: dts: qcom: Bring up TPM for Rb3gen2-IA-MEZZ board
+    - QCLINUX: arm64: defconfig: Enable NULL TTY for VM's
+    - QCLINUX: arm64: deconfig: qcom: disable smccc_trng driver
+    - QCLINUX: coresight: Enable ETR ATID filter for remote-etm
+    - PENDING: coresight: Disable RTB for coresight-stm
+    - PENDING: arm64: dts: qcom: sa8775p: Add protection-domain support for APM
+      and PRM
+    - PENDING: wifi: ath11k: fix vmalloc-out-of-bounds
+    - PENDING: arm64: dts: qcom: qcs6490-rb3gen2: Update the io-channels
+    - QCLINUX: arm64: defconfig: Remove unused VM config
+    - QCLINUX: coresight: Add extended CTI support
+    - QCLINUX: coresight: Remote-etm can probe successfully without ATID
+    - PENDING: iommu/arm-smmu-qcom: Fix compilation error
+    - QCLINUX: arm64: defconfig: Update VM memory and cpu configs
+    - QCLINUX: firmware: qcom_scm_addon:  Add qcom_she_op and
+      qcom_scm_ddrbw_profiler scm calls
+    - FROMLIST: arm64: dts: qcom: sa8775p: Add capacity and DPC properties
+    - QCLINUX: arm64: dts: restore wlan_ce_mem node
+    - QCLINUX: clk: qcom: dispcc1-sa8775p: Reparent dptx crypto RCG's to XO
+    - PENDING: arm64: dts: qcom: sa8775p: Correct the names of TPDMs
+    - PENDING: ath11k: Send pdev suspend before sending qmi mode off
+    - PENDING: dt-bindings: arm: qcom: add the SoC ID for SA8255P
+    - PENDING: soc: qcom: socinfo: add support for SA8255P
+    - PENDING: ARM64: dts: qcom: sa8775p: change camera PIL memory to 7MB
+    - PENDING: iommu/arm-smmu: add ACTLR data and support for sa8775p
+    - PENDING: arm64: dts: qcom: Add L3 interconnect device for SA8775P
+    - PENDING: interconnect: qcom: Add EPSS L3 support on SA8775P
+    - PENDING: usb: dwc3: Redesign flattening implementation
+    - PENDING: pinctrl: sa8775p: Add support for SA8255p SoC
+    - QCLINUX: smcinvoke: Add support hypervisor of shmbridge
+    - BACKPORT: wifi: mac80211: track capability/opmode NSS separately
+    - QCLINUX: drm/msm: Avoid probing gpu device
+    - QCLINUX: arm64: dts: qcom: sa8775p: addons: Enable byte-cntr for ETR1
+    - dt-bindings: net: Document QCA808x PHYs
+    - PENDING: dt-bindings: arm: qcom,ids: add SoC ID for QCS8300/QCS8275
+    - PENDING: soc: qcom: socinfo: add QCS8300/QCS8275 SoC ID
+    - PENDING: dt-bindings: pinctrl: describe qcs8300-tlmm
+    - PENDING: dt-bindings: qcom,pdc: document QCS8300 Power Domain Controller
+    - PENDING: arm64: dts: qcom: Add L3/DDR freq scaling from cpufreq on SA8775P
+    - QCLINUX: arm64: defconfig: qcom: Enable WLAN debug configs
+    - PENDING: pinctrl: qcom: add the tlmm driver for QCS8300 platforms
+    - FROMLIST: arm64: dts: qcom: sa8775p-ride: Add QCS9100 compatible
+    - PENDING: dt-bindings: clock: qcom: Add GCC clocks for QCS8300
+    - PENDING: clk: qcom: Add support for Global Clock Controller on QCS8300
+    - PENDING: dt-bindings: interconnect: Add Qualcomm QCS8300 DT bindings
+    - QCLINUX: arm64: defconfig: enable arm64 pmem
+    - PENDING: interconnect: qcom: add QCS8300 interconnect provider driver
+    - PENDING: dt-bindings: clock: qcom: Add GPU clocks for QCS8300
+    - PENDING: dt-bindings: power: qcom,rpmpd: document qcs8300
+    - PENDING: arm64: dts: qcom: Add static vote for SA8775P
+    - PENDING: arm64: dts: qcom: add initial support for QCS8300 DTSI
+    - PENDING: arm64: dts: qcom: add base QCS8300 RIDE dts
+    - QCLINUX: arm64: dts: qcom: Add addons support for QCS8300
+    - PENDING: arm64: dts: qcom: qcs8300: Add IMEM, PIL info and download mode
+      region
+    - QCLINUX: arm64: dts: qcom: qcs8300: define kaslr offset and mem dump table
+      regions
+    - QCLINUX: arm64: dts: qcom: qcs8300: addons: Add CSR device
+    - QCLINUX: arm64: deconfig: enable clock controller, interconnect and pinctrl
+      for QCS8300
+    - PENDING: soc: qcom: llcc: add errata to get bank num
+    - PENDING: soc: qcom: llcc: Add llcc configuration support for the QCS8300
+      platform
+    - PENDING:arm64: dts: qcom: qcs8300: Add qmp device nodes
+    - PENDING: arm64: dts: qcom: qcs8300: Add llcc support for the QCS8300
+      platform
+    - PENDING: drivers: phy: qualcomm: qmp-ufs qcs8300 compatible
+    - PENDING: dt-bindings: clock: qcom: Add CAMCC clocks for QCS8300
+    - QCLINUX: arm64: dts: qcom: Add qcs5430 dts support
+    - PENDING: arm64: dts: qcom: qcs8300: Add interconnect device nodes
+    - PENDING: arm64: dts: qcom: qcs8300: Add support for cpufreq hw
+    - QCLINUX: arm64: defconfig: Add Aquantia AQR115C config
+    - PENDING: net: stmmac: dwmac-qcom-ethqos: add support for emac4 on qcs8300
+      platforms
+    - PENDING: arm64: dts: qcom: qcs8300: add the SGMII PHY node
+    - FROMGIT: Bluetooth: SMP: Fix assumption of Central always being Initiator
+    - QCLINUX: arm64: dts: qcom: qcs8300: Add dma-buf heaps support
+    - PENDING: arm64: dts: qcom: qcs8300: add rpmhpd dts node
+    - PENDING: arm64: dts: qcom: qcs8300: Add regulators dts node
+    - PENDING: phy: qcom: add support for SGMII SerDes PHY on qcs8300 platform
+    - PENDING: clk: qcom: Add support for Camera Clock Controller on QCS8300
+    - PENDING: clk: qcom: Add support for GPU Clock Controller on QCS8300
+    - PENDING: arm64: dts: qcom: qcs8300: add coresight components
+    - QCLINUX: arm64: dts: qcom: qcs8300: Add dcc device tree node
+    - PENDING: arm64: dts: qcom: qcs8300: add the first 1Gb ethernet interface
+    - PENDING: arm64: dts: qcom: qcs8300-ride: enable the SerDes PHY
+    - PENDING: arm64: dts: qcom: qcs8300-ride: add pin functions for ethernet0
+    - PENDING: arm64: dts: qcom: qcs8300-ride: enable ethernet0
+    - PENDING: arm64: dts: qcom: qcs8300: add UFS nodes
+    - PENDING: arm64: dts: qcom: qcs8300: add the pcie smmu node
+    - PENDING: arm64: dts: qcom: qcs8300-ride: Add ufs mem
+    - PENDING: dmaengine: qcom: bam_dma: Correct descriptor FIFO size
+    - PENDING: arm64: dts: qcom: qcs8300: Add clock controllers support
+    - PENDING: remoteproc: qcom: pas: Add QCS8300 CDSP support
+    - PENDING: remoteproc: qcom: disable remoteproc auto boot for wpss
+    - PENDING: ARM: dt: add extended SPI specifier
+    - PENDING: arm64: dts: qcom: Add support for SA8255p Ride platform
+    - PENDING: arm64: dts: QCS8300: Add device node for gfx_smmu
+    - FROMLIST: misc: fastrpc: Add support for multiple PD from one process
+    - PENDING: arm64: dts: qcom: qcs8300: add CDSP support
+    - PENDING: arm64: dts: qcom: qcs8300-ride: enable CDSP for QCS8300
+    - PENDING: phy: qcom: Add support for eDP PHY on sa8775p
+    - PENDING: arm64: dts: qcom: qcs8300: add ADSP GPDSP support
+    - PENDING: arm64: dts: qcom: qcs8300-ride: enable ADSP GPDSP for QCS8300
+    - PENDING: arm64: dts: qcom: qcs8300: Add spmi bus
+    - QCLINUX: arm64: dts: qcom: qcs8300: addons: Add memory dump table
+    - PENDING: clk: qcom: gcc-qcs8300: Fixup the copyright
+    - PENDING: drm/msm/dp: Add DisplayPort controller for SA8775P
+    - PENDING: arm64: dts: qcom: mark ethernet devices as DMA-coherent
+    - PENDING: arm64: dts: qcom: sa8255p: enable safety IRQ
+    - PENDING: remoteproc: qcom: pas: Add QCS8300 ADSP GPDSP support
+    - FROMLIST: misc: fastrpc: Save actual DMA size in fastrpc_map structure
+    - FROMLIST: misc: fastrpc: Fix fastrpc_map_lookup operation
+    - FROMLIST: misc: fastrpc: Skip reference for DMA handles
+    - PENDING: phy: qcom: qmp: Add qmp conifguration for QCS8300
+    - PENDING: drm/msm: mdss: Add SA8775P support
+    - PENDING: drm/msm/dpu: Add SA8775P support
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add uart4 node for RB3GEN2 vision-
+      mezz
+    - PENDING: arm64: dts: qcom: qcs8300: add "clock-names" property
+    - PENDING:wifi: ath11k: support DBS and DFS compatibility
+    - PENDING: pmdomain: qcom: rpmhpd: Add qcs8300 power domains
+    - QCLINUX: arm64: defconfig: Revert Add Aquantia AQR115C config
+    - QCLINUX: qcom: tz_log: differentiate hlos and hypversior of creating
+      shmbridge
+    - BACKPORT: FROMGIT: soc: qcom: smp2p: Introduce tracepoint support
+    - FROMLIST: wifi: ath11k: Fix double free issue during SRNG deinit
+    - PENDING: arm64: dts: qcom: Add support for usb nodes on QCS8300
+    - PENDING: arm64: dts: qcom: sa8775p: add display dt nodes
+    - QCLINUX: coresight: Correct the loglevel of the log info
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add spi dev node for qcs100 ridesx
+      target
+    - PENDING: arm64: dts: qcom: qcs8300: Add QUPv3 configuration
+    - PENDING: arm64: dts: qcom: sa8775p: Add DisplayPort device node
+    - PENDING: arm64: dts: qcom: Enable USB controllers for QCS8300
+    - PENDING: smcinvoke: Decrement the server object ref count in mutex context
+    - QCLINUX: defconfig: Enable SKBEDIT AND CLS TC utilities
+    - PENDING: coresight: tmc: flush remaining data when ETR is disabled
+    - QCLINUX: Revert "drivers: core: synchronize really_probe() and dev_uevent()"
+    - PENDING: drm/bridge: anx7625: change the gpio_set_value API
+    - PENDING: Bluetooth: mgmt: Verify cmd pending status before removing it
+    - PENDING: remoteproc: qcom: pas: fix QCS8300 GPDSP support
+    - PENDING: Bluetooth: mgmt: Verify command pending status before removing it
+    - QCLINUX: arm64: dts: qcom: sa8775p: Enable HS MI2S
+    - QCLINUX: ASoC: qcm6490: Add AIF0 and AIF3 for qcs9100
+    - QCLINUX: ASoC: codecs: msm-stub: Add AIF0 and AIF3 DAIs
+    - QCLINUX: ASoC: qcm6490: add macro and dcodec clk for qcs9100
+    - QCLINUX: arm64: dts: qcom: sa8775p: add dcodec and macro clk
+    - QCLINUX: arm64: dts: qcom: Add HSP dts support
+    - QCLINUX: arm64: dts: qcom: Add HSP BT dts support
+    - QCLINUX: arm64: dts: qcom: Disable MPSS on HSP dts
+    - QCLINUX: arm64: dts: qcom: Add PCIe node on HSP
+    - PENDING: arm64: dts: qcom: sc7280: add ICE node
+    - PENDING: qcom: ice: Remove ice probe
+    - QCLINUX: mmc: host: support wrapped keys in mmc
+    - PENDING: mmc: host: add support to derive software secret
+    - PENDING: mmc: host: add support for generate, import and prepare keys
+    - PENDING: mmc: host: wrapped keys support in mmc qcom
+    - PENDING: mmc: host: implement derive sw secret vop in mmc qcom
+    - PENDING: mmc: host: support for generate, import and prepare key
+    - PENDING: arm64: defconfig: qcom: Enable MMC crypto
+    - QCLINUX: net: qrtr: mhi: synchronize qrtr and mhi preparation
+    - PENDING: ath11k: Fix CE offset address calculation for WCN6750 in SSR
+    - QCLINUX: rpmsg: glink: multi enter for unregister path
+    - PENDING: arm64: dts: qcom: sa8775p: Update memory map for SA8775P
+    - Ubuntu: [Config] update CONFIG options for GA 1.2
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 18 Oct 2024 18:49:17 +0900
+
+linux-qcom (6.8.0-1012.12) jammy; urgency=medium
+
+  * perf build disables tracepoint support (LP: #2076190)
+    - [Packaging] add libtraceevent as dependency
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 04 Oct 2024 12:13:50 +0900
+
+linux-qcom (6.8.0-1011.11) jammy; urgency=medium
+
+  * "[RB3] tc956x_pci-eth errors found in dmesg"
+    - SAUCE: ubuntu/qcom/qps615: suppress false alerts
+    - SAUCE: ubuntu/qcom/qps615: use INFO level for logging
+
+  * "[RB3] slim-ngd-ctrl error found in dmesg"
+    - SAUCE: qcom-ngd-ctrl: suppress "QMI handle is NULL" error
+    - SAUCE: qcom-ngd-ctrl: fix race condition for completion
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] remove modules-extra package
+
+  [ Ubuntu: 6.8.0-48.48 ]
+
+  * noble/linux: 6.8.0-48.48 -proposed tracker (LP: #2082437)
+  * [SRU][Noble] Bad EPP defaults cause performance regressions on select Intel
+    CPUs (LP: #2077470)
+    - x86/cpu/vfm: Update arch/x86/include/asm/intel-family.h
+    - cpufreq: intel_pstate: Allow model specific EPPs
+    - cpufreq: intel_pstate: Update default EPPs for Meteor Lake
+    - cpufreq: intel_pstate: Switch to new Intel CPU model defines
+    - cpufreq: intel_pstate: Update Meteor Lake EPPs
+    - cpufreq: intel_pstate: Use Meteor Lake EPPs for Arrow Lake
+    - cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids
+  * power: Enable intel_rapl driver (LP: #2078834)
+    - powercap: intel_rapl: Add support for ArrowLake-H platform
+  * x86/vmware: Add TDX hypercall support (LP: #2077729)
+    - x86/vmware: Introduce VMware hypercall API
+    - x86/vmware: Add TDX hypercall support
+  * Guest crashes post migration with migrate_misplaced_folio+0x4cc/0x5d0
+    (LP: #2076866)
+    - mm/mempolicy: use numa_node_id() instead of cpu_to_node()
+    - mm/numa_balancing: allow migrate on protnone reference with
+      MPOL_PREFERRED_MANY policy
+    - mm: convert folio_estimated_sharers() to folio_likely_mapped_shared()
+    - mm: factor out the numa mapping rebuilding into a new helper
+    - mm: support multi-size THP numa balancing
+    - mm/migrate: make migrate_misplaced_folio() return 0 on success
+    - mm/migrate: move NUMA hinting fault folio isolation + checks under PTL
+    - mm: fix possible OOB in numa_rebuild_large_mapping()
+  * Add 'mm: hold PTL from the first PTE while reclaiming a large folio' to fix
+    L2 Guest hang during LTP Test (LP: #2076147)
+    - mm: hold PTL from the first PTE while reclaiming a large folio
+  * KOP L2 guest fails to boot with 1 core - SMT8 topology (LP: #2070329)
+    - KVM: PPC: Book3S HV nestedv2: Add DPDES support in helper library for Guest
+      state buffer
+    - KVM: PPC: Book3S HV nestedv2: Fix doorbell emulation
+  * L2 Guest migration: continuously dumping while running NFS guest migration
+    (LP: #2076406)
+    - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3
+    - KVM: PPC: Book3S HV: Fix the get_one_reg of SDAR
+    - KVM: PPC: Book3S HV: Add one-reg interface for DEXCR register
+    - KVM: PPC: Book3S HV nestedv2: Keep nested guest DEXCR in sync
+    - KVM: PPC: Book3S HV: Add one-reg interface for HASHKEYR register
+    - KVM: PPC: Book3S HV nestedv2: Keep nested guest HASHKEYR in sync
+    - KVM: PPC: Book3S HV: Add one-reg interface for HASHPKEYR register
+    - KVM: PPC: Book3S HV nestedv2: Keep nested guest HASHPKEYR in sync
+  * perf build disables tracepoint support (LP: #2076190)
+    - [Packaging] perf: reenable libtraceevent
+  * Please backport the more restrictive XSAVES deactivation for  Zen1/2 arch
+    (LP: #2077321)
+    - x86/CPU/AMD: Improve the erratum 1386 workaround
+  * Fix alsa scarlett2 driver in 6.8  (LP: #2076402)
+    - ALSA: scarlett2: Move initialisation code lower in the source
+    - ALSA: scarlett2: Implement handling of the ACK notification
+  * rtw89: reset IDMEM mode to prevent download firmware failure (LP: #2077396)
+    - wifi: rtw89: 885xb: reset IDMEM mode to prevent download firmware failure
+  * CVE-2024-43858
+    - jfs: Fix array-index-out-of-bounds in diFree
+  * CVE-2024-42280
+    - mISDN: Fix a use after free in hfcmulti_tx()
+  * CVE-2024-42271
+    - net/iucv: fix use after free in iucv_sock_close()
+  * [Ubuntu-24.04] FADump with recommended crash size is making the L1 hang
+    (LP: #2060039)
+    - powerpc/64s/radix/kfence: map __kfence_pool at page granularity
+  * Noble update: upstream stable patchset 2024-09-09 (LP: #2079945)
+    - ocfs2: add bounds checking to ocfs2_check_dir_entry()
+    - jfs: don't walk off the end of ealist
+    - fs/ntfs3: Add a check for attr_names and oatbl
+    - fs/ntfs3: Validate ff offset
+    - usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup
+    - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
+    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
+    - arm64: dts: qcom: qrb4210-rb2: switch I2C2 to i2c-gpio
+    - arm64: dts: qcom: msm8996: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: sm6350: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: ipq6018: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: sdm630: Disable SS instance in Parkmode for USB
+    - ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused
+    - ALSA: seq: ump: Skip useless ports for static blocks
+    - filelock: Fix fcntl/close race recovery compat path
+    - tun: add missing verification for short frame
+    - tap: add missing verification for short frame
+    - s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()
+    - ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop
+    - arm64: dts: qcom: sc7180: Disable SuperSpeed instances in park mode
+    - arm64: dts: qcom: sc7280: Disable SuperSpeed instances in park mode
+    - arm64: dts: qcom: qrb2210-rb1: switch I2C2 to i2c-gpio
+    - arm64: dts: qcom: msm8998: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: ipq8074: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: sdm845: Disable SS instance in Parkmode for USB
+    - Upstream stable to v6.6.43, v6.9.12
+  * Noble update: upstream stable patchset 2024-09-02 (LP: #2078304)
+    - filelock: Remove locks reliably when fcntl/close race is detected
+    - scsi: core: alua: I/O errors for ALUA state transitions
+    - scsi: sr: Fix unintentional arithmetic wraparound
+    - scsi: qedf: Don't process stag work during unload and recovery
+    - scsi: qedf: Wait for stag work during unload
+    - scsi: qedf: Set qed_slowpath_params to zero before use
+    - efi/libstub: zboot.lds: Discard .discard sections
+    - ACPI: EC: Abort address space access upon error
+    - ACPI: EC: Avoid returning AE_OK on errors in address space handler
+    - tools/power/cpupower: Fix Pstate frequency reporting on AMD Family 1Ah CPUs
+    - wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata
+    - wifi: mac80211: apply mcast rate only if interface is up
+    - wifi: mac80211: handle tasklet frames before stopping
+    - wifi: cfg80211: fix 6 GHz scan request building
+    - wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup
+    - wifi: iwlwifi: mvm: remove stale STA link data during restart
+    - wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd
+    - wifi: iwlwifi: mvm: handle BA session teardown in RF-kill
+    - wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe option
+    - wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill
+    - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
+    - selftests: cachestat: Fix build warnings on ppc64
+    - selftests/openat2: Fix build warnings on ppc64
+    - selftests/futex: pass _GNU_SOURCE without a value to the compiler
+    - of/irq: Factor out parsing of interrupt-map parent phandle+args from
+      of_irq_parse_raw()
+    - Input: silead - Always support 10 fingers
+    - net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
+    - ila: block BH in ila_output()
+    - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
+    - null_blk: fix validation of block size
+    - kconfig: gconf: give a proper initial state to the Save button
+    - kconfig: remove wrong expr_trans_bool()
+    - input: Add event code for accessibility key
+    - input: Add support for "Do Not Disturb"
+    - HID: Ignore battery for ELAN touchscreens 2F2C and 4116
+    - NFSv4: Fix memory leak in nfs4_set_security_label
+    - nfs: propagate readlink errors in nfs_symlink_filler
+    - nfs: Avoid flushing many pages with NFS_FILE_SYNC
+    - nfs: don't invalidate dentries on transient errors
+    - cachefiles: add consistency check for copen/cread
+    - cachefiles: Set object to close if ondemand_id < 0 in copen
+    - cachefiles: make on-demand read killable
+    - fs/file: fix the check in find_next_fd()
+    - mei: demote client disconnect warning on suspend to debug
+    - iomap: Fix iomap_adjust_read_range for plen calculation
+    - drm/exynos: dp: drop driver owner initialization
+    - drm: panel-orientation-quirks: Add quirk for Aya Neo KUN
+    - drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time
+    - nvme: avoid double free special payload
+    - nvmet: always initialize cqe.result
+    - ALSA: hda: cs35l56: Fix lifecycle of codec pointer
+    - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
+    - ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5
+    - KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
+    - drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency
+    - ALSA: hda/realtek: Add more codec ID to no shutup pins list
+    - spi: Fix OCTAL mode support
+    - cpumask: limit FORCE_NR_CPUS to just the UP case
+    - [Config] Remove FORCE_NR_CPUS
+    - selftests: openvswitch: Set value to nla flags.
+    - drm/amdgpu: Indicate CU havest info to CP
+    - ALSA: hda: cs35l56: Select SERIAL_MULTI_INSTANTIATE
+    - mips: fix compat_sys_lseek syscall
+    - Input: elantech - fix touchpad state on resume for Lenovo N24
+    - Input: i8042 - add Ayaneo Kun to i8042 quirk table
+    - ASoC: rt722-sdca-sdw: add silence detection register as volatile
+    - Input: xpad - add support for ASUS ROG RAIKIRI PRO
+    - ASoC: topology: Fix references to freed memory
+    - ASoC: topology: Do not assign fields that are already set
+    - bytcr_rt5640 : inverse jack detect for Archos 101 cesium
+    - ALSA: dmaengine: Synchronize dma channel after drop()
+    - ASoC: ti: davinci-mcasp: Set min period size using FIFO config
+    - ASoC: ti: omap-hdmi: Fix too long driver name
+    - ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on error rollback
+    - ASoC: rt722-sdca-sdw: add debounce time for type detection
+    - nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA.
+    - Input: ads7846 - use spi_device_id table
+    - can: kvaser_usb: fix return value for hif_usb_send_regout
+    - gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
+    - octeontx2-pf: Fix coverity and klockwork issues in octeon PF driver
+    - s390/sclp: Fix sclp_init() cleanup on failure
+    - platform/mellanox: nvsw-sn2201: Add check for platform_device_add_resources
+    - platform/x86: wireless-hotkey: Add support for LG Airplane Button
+    - platform/x86: lg-laptop: Remove LGEX0815 hotkey handling
+    - platform/x86: lg-laptop: Change ACPI device id
+    - platform/x86: lg-laptop: Use ACPI device handle when evaluating WMAB/WMBB
+    - btrfs: qgroup: fix quota root leak after quota disable failure
+    - ibmvnic: Add tx check to prevent skb leak
+    - ALSA: PCM: Allow resume only for suspended streams
+    - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
+    - ALSA: dmaengine_pcm: terminate dmaengine before synchronize
+    - ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA
+    - net: usb: qmi_wwan: add Telit FN912 compositions
+    - net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and
+      DEV_STATS_ADD()
+    - powerpc/pseries: Whitelist dtl slub object for copying to userspace
+    - powerpc/eeh: avoid possible crash when edev->pdev changes
+    - scsi: libsas: Fix exp-attached device scan after probe failure scanned in
+      again after probe failed
+    - tee: optee: ffa: Fix missing-field-initializers warning
+    - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
+    - Bluetooth: btnxpuart: Enable Power Save feature on startup
+    - bluetooth/l2cap: sync sock recv cb and release
+    - erofs: ensure m_llen is reset to 0 if metadata is invalid
+    - drm/amd/display: Add refresh rate range check
+    - drm/amd/display: Account for cursor prefetch BW in DML1 mode support
+    - drm/amd/display: Fix refresh rate range for some panel
+    - drm/radeon: check bo_va->bo is non-NULL before using it
+    - fs: better handle deep ancestor chains in is_subdir()
+    - wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK
+    - drivers/perf: riscv: Reset the counter to hpmevent mapping while starting
+      cpus
+    - riscv: stacktrace: fix usage of ftrace_graph_ret_addr()
+    - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
+    - ksmbd: return FILE_DEVICE_DISK instead of super magic
+    - ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods by
+      MAX_BDL_ENTRIES
+    - selftest/timerns: fix clang build failures for abs() calls
+    - selftests/vDSO: fix clang build errors and warnings
+    - hfsplus: fix uninit-value in copy_name
+    - selftests/bpf: Extend tcx tests to cover late tcx_entry release
+    - spi: mux: set ctlr->bits_per_word_mask
+    - ALSA: hda: Use imply for suggesting CONFIG_SERIAL_MULTI_INSTANTIATE
+    - [Config] Update CONFIG_SERIAL_MULTI_INSTANTIATE
+    - cifs: fix noisy message on copy_file_range
+    - Bluetooth: L2CAP: Fix deadlock
+    - of/irq: Disable "interrupt-map" parsing for PASEMI Nemo
+    - wifi: cfg80211: wext: set ssids=NULL for passive scans
+    - wifi: mac80211: disable softirqs for queued frame handling
+    - wifi: iwlwifi: mvm: don't wake up rx_sync_waitq upon RFKILL
+    - cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
+    - cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
+    - btrfs: ensure fast fsync waits for ordered extents after a write failure
+    - PNP: Hide pnp_bus_type from the non-PNP code
+    - ACPI: AC: Properly notify powermanagement core about changes
+    - selftests/overlayfs: Fix build error on ppc64
+    - nvme-fabrics: use reserved tag for reg read/write command
+    - LoongArch: Fix GMAC's phy-mode definitions in dts
+    - io_uring: fix possible deadlock in io_register_iowq_max_workers()
+    - vfio: Create vfio_fs_type with inode per device
+    - vfio/pci: Use unmap_mapping_range()
+    - parport: amiga: Mark driver struct with __refdata to prevent section
+      mismatch
+    - drm: renesas: shmobile: Call drm_atomic_helper_shutdown() at shutdown time
+    - vfio/pci: Insert full vma on mmap'd MMIO fault
+    - ALSA: hda: cs35l41: Support Lenovo Thinkbook 16P Gen 5
+    - ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 4
+    - ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 4
+    - wifi: mac80211: Avoid address calculations via out of bounds array indexing
+    - drm/amd/display: change dram_clock_latency to 34us for dcn35
+    - closures: Change BUG_ON() to WARN_ON()
+    - ASoC: codecs: ES8326: Solve headphone detection issue
+    - ASoC: Intel: avs: Fix route override
+    - net: mvpp2: fill-in dev_port attribute
+    - btrfs: scrub: handle RST lookup error correctly
+    - clk: qcom: apss-ipq-pll: remove 'config_ctl_hi_val' from Stromer pll configs
+    - drm/amd/display: Update efficiency bandwidth for dcn351
+    - drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport
+    - btrfs: fix uninitialized return value in the ref-verify tool
+    - spi: davinci: Unset POWERDOWN bit when releasing resources
+    - mm: page_ref: remove folio_try_get_rcu()
+    - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Lenovo ThinBook 13x
+      Gen4
+    - netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume()
+    - Upstream stable to v6.6.42, v6.9.11
+  * CVE-2024-27022
+    - Revert "Revert "fork: defer linking file vma until vma is fully
+      initialized""
+  * UBSAN: array-index-out-of-bounds in /build/linux-Z1RxaK/linux-
+    6.8.0/drivers/gpu/drm/amd/amdgpu/../pm/powerplay/hwmgr/processpptables.c:124
+    9:61 (LP: #2078041)
+    - drm/amdgpu/pptable: convert some variable sized arrays to [] style
+    - drm/amdgpu: convert some variable sized arrays to [] style
+    - drm/amdgpu/pptable: Fix UBSAN array-index-out-of-bounds
+  * alsa: Headphone and Speaker couldn't output sound intermittently
+    (LP: #2077690)
+    - ALSA: hda/realtek - Fixed ALC256 headphone no sound
+    - ALSA: hda/realtek - FIxed ALC285 headphone no sound
+  * Fix ethernet performance on JSL and EHL (LP: #2077858)
+    - intel_idle: Disable promotion to C1E on Jasper Lake and Elkhart Lake
+  * Noble update: upstream stable patchset 2024-08-29 (LP: #2078289)
+    - Revert "usb: xhci: prevent potential failure in handle_tx_event() for
+      Transfer events without TRB"
+    - Compiler Attributes: Add __uninitialized macro
+    - mm: prevent derefencing NULL ptr in pfn_section_valid()
+    - scsi: ufs: core: Fix ufshcd_clear_cmd racing issue
+    - scsi: ufs: core: Fix ufshcd_abort_one racing issue
+    - vfio/pci: Init the count variable in collecting hot-reset devices
+    - cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop
+    - cachefiles: stop sending new request when dropping object
+    - cachefiles: cancel all requests for the object that is being dropped
+    - cachefiles: wait for ondemand_object_worker to finish when dropping object
+    - cachefiles: cyclic allocation of msg_id to avoid reuse
+    - cachefiles: add missing lock protection when polling
+    - dsa: lan9303: Fix mapping between DSA port number and PHY address
+    - filelock: fix potential use-after-free in posix_lock_inode
+    - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
+    - vfs: don't mod negative dentry count when on shrinker list
+    - net: bcmasp: Fix error code in probe()
+    - tcp: fix incorrect undo caused by DSACK of TLP retransmit
+    - bpf: Fix too early release of tcx_entry
+    - net: phy: microchip: lan87xx: reinit PHY after cable test
+    - skmsg: Skip zero length skb in sk_msg_recvmsg
+    - octeontx2-af: Fix incorrect value output on error path in
+      rvu_check_rsrc_availability()
+    - net: fix rc7's __skb_datagram_iter()
+    - i40e: Fix XDP program unloading while removing the driver
+    - net: ethernet: lantiq_etop: fix double free in detach
+    - bpf: fix order of args in call to bpf_map_kvcalloc
+    - bpf: make timer data struct more generic
+    - bpf: replace bpf_timer_init with a generic helper
+    - bpf: Fail bpf_timer_cancel when callback is being cancelled
+    - net: ethernet: mtk-star-emac: set mac_managed_pm when probing
+    - ppp: reject claimed-as-LCP but actually malformed packets
+    - ethtool: netlink: do not return SQI value if link is down
+    - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
+    - net, sunrpc: Remap EPERM in case of connection failure in
+      xs_tcp_setup_socket
+    - s390: Mark psw in __load_psw_mask() as __unitialized
+    - arm64: dts: qcom: sc8180x: Fix LLCC reg property again
+    - firmware: cs_dsp: Fix overflow checking of wmfw header
+    - firmware: cs_dsp: Return error if block header overflows file
+    - firmware: cs_dsp: Validate payload length before processing block
+    - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
+    - ASoC: SOF: Intel: hda: fix null deref on system suspend entry
+    - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
+    - ARM: davinci: Convert comma to semicolon
+    - octeontx2-af: replace cpt slot with lf id on reg write
+    - octeontx2-af: fix a issue with cpt_lf_alloc mailbox
+    - octeontx2-af: fix detection of IP layer
+    - octeontx2-af: fix issue with IPv6 ext match for RSS
+    - octeontx2-af: fix issue with IPv4 match for RSS
+    - cifs: fix setting SecurityFlags to true
+    - Revert "sched/fair: Make sure to try to detach at least one movable task"
+    - tcp: avoid too many retransmit packets
+    - net: ks8851: Fix deadlock with the SPI chip variant
+    - net: ks8851: Fix potential TX stall after interface reopen
+    - USB: serial: option: add Telit generic core-dump composition
+    - USB: serial: option: add Telit FN912 rmnet compositions
+    - USB: serial: option: add Fibocom FM350-GL
+    - USB: serial: option: add support for Foxconn T99W651
+    - USB: serial: option: add Netprisma LCUK54 series modules
+    - USB: serial: option: add Rolling RW350-GL variants
+    - USB: serial: mos7840: fix crash on resume
+    - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
+    - usb: dwc3: pci: add support for the Intel Panther Lake
+    - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
+    - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the
+      descriptor
+    - misc: microchip: pci1xxxx: Fix return value of nvmem callbacks
+    - hpet: Support 32-bit userspace
+    - xhci: always resume roothubs if xHC was reset during resume
+    - s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()
+    - mm: vmalloc: check if a hash-index is in cpu_possible_mask
+    - mm/filemap: skip to create PMD-sized page cache if needed
+    - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
+    - ksmbd: discard write access to the directory open
+    - iio: trigger: Fix condition for own trigger
+    - arm64: dts: qcom: sa8775p: Correct IRQ number of EL2 non-secure physical
+      timer
+    - arm64: dts: qcom: sc8280xp-x13s: fix touchscreen power on
+    - nvmem: rmem: Fix return value of rmem_read()
+    - nvmem: meson-efuse: Fix return value of nvmem callbacks
+    - nvmem: core: only change name to fram for current attribute
+    - platform/x86: toshiba_acpi: Fix array out-of-bounds access
+    - tty: serial: ma35d1: Add a NULL check for of_node
+    - ALSA: hda/realtek: add quirk for Clevo V5[46]0TU
+    - ALSA: hda/realtek: Enable Mute LED on HP 250 G7
+    - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
+    - Fix userfaultfd_api to return EINVAL as expected
+    - pmdomain: qcom: rpmhpd: Skip retention level for Power Domains
+    - libceph: fix race between delayed_work() and ceph_monc_stop()
+    - ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
+    - cpufreq: ACPI: Mark boost policy as enabled when setting boost
+    - cpufreq: Allow drivers to advertise boost enabled
+    - wireguard: selftests: use acpi=off instead of -no-acpi for recent QEMU
+    - wireguard: allowedips: avoid unaligned 64-bit memory accesses
+    - wireguard: queueing: annotate intentional data race in cpu round robin
+    - wireguard: send: annotate intentional data race in checking empty queue
+    - misc: fastrpc: Fix DSP capabilities request
+    - misc: fastrpc: Avoid updating PD type for capability request
+    - misc: fastrpc: Copy the complete capability structure to user
+    - misc: fastrpc: Fix memory leak in audio daemon attach operation
+    - misc: fastrpc: Fix ownership reassignment of remote heap
+    - misc: fastrpc: Restrict untrusted app to attach to privileged PD
+    - mm/shmem: disable PMD-sized page cache if needed
+    - mm/damon/core: merge regions aggressively when max_nr_regions is unmet
+    - selftests/net: fix gro.c compilation failure due to non-existent
+      opt_ipproto_off
+    - ext4: avoid ptr null pointer dereference
+    - sched: Move psi_account_irqtime() out of update_rq_clock_task() hotpath
+    - i2c: rcar: bring hardware to known state when probing
+    - i2c: mark HostNotify target address as used
+    - i2c: rcar: ensure Gen3+ reset does not disturb local targets
+    - i2c: testunit: avoid re-issued work after read message
+    - i2c: rcar: clear NO_RXDMA flag after resetting
+    - x86/bhi: Avoid warning in #DB handler due to BHI mitigation
+    - kbuild: Make ld-version.sh more robust against version string changes
+    - spi: axi-spi-engine: fix sleep calculation
+    - minixfs: Fix minixfs_rename with HIGHMEM
+    - bpf: Defer work in bpf_timer_cancel_and_free
+    - netfilter: nf_tables: prefer nft_chain_validate
+    - arm64: dts: qcom: x1e80100-*: Allocate some CMA buffers
+    - arm64: dts: qcom: sm6115: add iommu for sdhc_1
+    - arm64: dts: qcom: qdu1000: Fix LLCC reg property
+    - net: ethtool: Fix RSS setting
+    - nilfs2: fix kernel bug on rename operation of broken directory
+    - cachestat: do not flush stats in recency check
+    - mm: fix crashes from deferred split racing folio migration
+    - nvmem: core: limit cell sysfs permissions to main attribute ones
+    - serial: imx: ensure RTS signal is not left active after shutdown
+    - mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE
+    - mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length
+    - mm/readahead: limit page cache size in page_cache_ra_order()
+    - Revert "dt-bindings: cache: qcom,llcc: correct QDU1000 reg entries"
+    - sched/deadline: Fix task_struct reference leak
+    - Upstream stable to v6.6.40, v6.6.41, v6.9.10
+  * [SRU][HPE 24.04] Intel FVL NIC FW flash fails with inbox driver, causing
+    driver not detected (LP: #2076675) // Noble update: upstream stable patchset
+    2024-08-29 (LP: #2078289)
+    - i40e: fix: remove needless retries of NVM update
+  * CVE-2024-41022
+    - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
+  *  Deadlock occurs while suspending md raid  (LP: #2073695)
+    - md: change the return value type of md_write_start to void
+    - md: fix deadlock between mddev_suspend and flush bio
+  * Lenovo X12 Detachable Gen 2 unresponsive under light load (LP: #2076361)
+    - drm/i915: Enable Wa_16019325821
+    - drm/i915/guc: Add support for w/a KLVs
+    - drm/i915/guc: Enable Wa_14019159160
+  * Regression: unable to reach low idle states on Tiger Lake (LP: #2072679)
+    - SAUCE: PCI: ASPM: Allow OS to configure ASPM where BIOS is incapable of
+    - SAUCE: PCI: vmd: Let OS control ASPM for devices under VMD domain
+  * Noble update: upstream stable patchset 2024-08-22 (LP: #2077600)
+    - locking/mutex: Introduce devm_mutex_init()
+    - leds: an30259a: Use devm_mutex_init() for mutex initialization
+    - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
+    - drm/lima: fix shared irq handling on driver remove
+    - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
+    - media: dvb: as102-fe: Fix as10x_register_addr packing
+    - media: dvb-usb: dib0700_devices: Add missing release_firmware()
+    - IB/core: Implement a limit on UMAD receive List
+    - scsi: qedf: Make qedf_execute_tmf() non-preemptible
+    - selftests/bpf: adjust dummy_st_ops_success to detect additional error
+    - selftests/bpf: do not pass NULL for non-nullable params in dummy_st_ops
+    - selftests/bpf: dummy_st_ops should reject 0 for non-nullable params
+    - RISC-V: KVM: Fix the initial sample period value
+    - crypto: aead,cipher - zeroize key buffer after use
+    - media: mediatek: vcodec: Only free buffer VA that is not NULL
+    - drm/amdgpu: Fix uninitialized variable warnings
+    - drm/amdgpu: Initialize timestamp for some legacy SOCs
+    - drm/amd/display: Check index msg_id before read or write
+    - drm/amd/display: Check pipe offset before setting vblank
+    - drm/amd/display: Skip finding free audio for unknown engine_id
+    - drm/amd/display: Fix uninitialized variables in DM
+    - drm/amdgpu: fix uninitialized scalar variable warning
+    - drm/amdgpu: fix the warning about the expression (int)size - len
+    - media: dw2102: Don't translate i2c read into write
+    - riscv: Apply SiFive CIP-1200 workaround to single-ASID sfence.vma
+    - sctp: prefer struct_size over open coded arithmetic
+    - firmware: dmi: Stop decoding on broken entry
+    - Input: ff-core - prefer struct_size over open coded arithmetic
+    - wifi: mt76: replace skb_put with skb_put_zero
+    - wifi: mt76: mt7996: add sanity checks for background radar trigger
+    - thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
+    - media: dvb-frontends: tda18271c2dd: Remove casting during div
+    - media: s2255: Use refcount_t instead of atomic_t for num_channels
+    - media: dvb-frontends: tda10048: Fix integer overflow
+    - i2c: i801: Annotate apanel_addr as __ro_after_init
+    - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
+    - orangefs: fix out-of-bounds fsid access
+    - kunit: Fix timeout message
+    - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
+    - selftests/net: fix uninitialized variables
+    - igc: fix a log entry using uninitialized netdev
+    - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
+    - serial: imx: Raise TX trigger level to 8
+    - jffs2: Fix potential illegal address access in jffs2_free_inode
+    - s390/pkey: Wipe sensitive data on failure
+    - btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation
+      warning
+    - cdrom: rearrange last_media_change check to avoid unintentional overflow
+    - tools/power turbostat: Remember global max_die_id
+    - vhost: Use virtqueue mutex for swapping worker
+    - vhost: Release worker mutex during flushes
+    - vhost_task: Handle SIGKILL by flushing work and exiting
+    - mac802154: fix time calculation in ieee802154_configure_durations()
+    - net: phy: phy_device: Fix PHY LED blinking code comment
+    - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
+    - net/mlx5: E-switch, Create ingress ACL when needed
+    - net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup()
+    - Bluetooth: hci_event: Fix setting of unicast qos interval
+    - Bluetooth: Ignore too large handle values in BIG
+    - Bluetooth: ISO: Check socket flag instead of hcon
+    - bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
+    - KVM: s390: fix LPSWEY handling
+    - e1000e: Fix S0ix residency on corporate systems
+    - gpiolib: of: fix lookup quirk for MIPS Lantiq
+    - net: allow skb_datagram_iter to be called from any context
+    - net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
+    - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from
+      __netif_rx()
+    - gpio: mmio: do not calculate bgpio_bits via "ngpios"
+    - wifi: wilc1000: fix ies_len type in connect path
+    - riscv: kexec: Avoid deadlock in kexec crash path
+    - netfilter: nf_tables: unconditionally flush pending work before notifier
+    - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
+    - selftests: fix OOM in msg_zerocopy selftest
+    - selftests: make order checking verbose in msg_zerocopy selftest
+    - inet_diag: Initialize pad field in struct inet_diag_req_v2
+    - mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI
+      file
+    - gpiolib: of: add polarity quirk for TSC2005
+    - cpu: Fix broken cmdline "nosmp" and "maxcpus=0"
+    - platform/x86: toshiba_acpi: Fix quickstart quirk handling
+    - Revert "igc: fix a log entry using uninitialized netdev"
+    - nilfs2: fix inode number range checks
+    - nilfs2: add missing check for inode numbers on directory entries
+    - mm: optimize the redundant loop of mm_update_owner_next()
+    - mm: avoid overflows in dirty throttling logic
+    - btrfs: fix adding block group to a reclaim list and the unused list during
+      reclaim
+    - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add()
+    - Bluetooth: hci_bcm4377: Fix msgid release
+    - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
+    - can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
+    - fsnotify: Do not generate events for O_PATH file descriptors
+    - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(),
+      again"
+    - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
+    - drm/amdgpu/atomfirmware: silence UBSAN warning
+    - drm: panel-orientation-quirks: Add quirk for Valve Galileo
+    - clk: qcom: gcc-ipq9574: Add BRANCH_HALT_VOTED flag
+    - clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common
+    - powerpc/pseries: Fix scv instruction crash with kexec
+    - powerpc/64s: Fix unnecessary copy to 0 when kernel is booted at address 0
+    - mtd: rawnand: Ensure ECC configuration is propagated to upper layers
+    - mtd: rawnand: Fix the nand_read_data_op() early check
+    - mtd: rawnand: Bypass a couple of sanity checks during NAND identification
+    - mtd: rawnand: rockchip: ensure NVDDR timings are rejected
+    - net: stmmac: dwmac-qcom-ethqos: fix error array size
+    - arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model B
+    - media: dw2102: fix a potential buffer overflow
+    - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents
+    - clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs
+    - clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
+    - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
+    - fs/ntfs3: Mark volume as dirty if xattr is broken
+    - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
+    - vhost-scsi: Handle vhost_vq_work_queue failures for events
+    - nvme-multipath: find NUMA path only for online numa-node
+    - dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails
+    - connector: Fix invalid conversion in cn_proc.h
+    - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
+    - regmap-i2c: Subtract reg size from max_write
+    - platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6"
+      tablet
+    - platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
+    - nvmet: fix a possible leak when destroy a ctrl during qp establishment
+    - kbuild: fix short log for AS in link-vmlinux.sh
+    - nfc/nci: Add the inconsistency check between the input data length and count
+    - spi: cadence: Ensure data lines set to low during dummy-cycle period
+    - ALSA: ump: Set default protocol when not given explicitly
+    - drm/amdgpu: silence UBSAN warning
+    - null_blk: Do not allow runt zone with zone capacity smaller then zone size
+    - nilfs2: fix incorrect inode allocation from reserved inodes
+    - leds: mlxreg: Use devm_mutex_init() for mutex initialization
+    - net: dql: Avoid calling BUG() when WARN() is enough
+    - drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf
+    - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
+    - drm/amdgpu: fix double free err_addr pointer warnings
+    - drm/amd/display: Fix overlapping copy within dml_core_mode_programming
+    - drm/amd/display: update pipe topology log to support subvp
+    - drm/amd/display: Do not return negative stream id for array
+    - drm/amd/display: ASSERT when failing to find index by plane/stream id
+    - usb: xhci: prevent potential failure in handle_tx_event() for Transfer
+      events without TRB
+    - media: i2c: st-mipid02: Use the correct div function
+    - media: tc358746: Use the correct div_ function
+    - crypto: hisilicon/sec2 - fix for register offset
+    - s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
+    - s390/pkey: Wipe copies of clear-key structures on failure
+    - s390/pkey: Wipe copies of protected- and secure-keys
+    - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
+    - wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
+    - net: txgbe: remove separate irq request for MSI and INTx
+    - net: txgbe: add extra handle for MSI/INTx into thread irq handle
+    - net: txgbe: free isb resources at the right time
+    - btrfs: always do the basic checks for btrfs_qgroup_inherit structure
+    - net: phy: aquantia: add missing include guards
+    - drm/fbdev-generic: Fix framebuffer on big endian devices
+    - net: stmmac: enable HW-accelerated VLAN stripping for gmac4 only
+    - net: rswitch: Avoid use-after-free in rswitch_poll()
+    - ice: use proper macro for testing bit
+    - drm/xe/mcr: Avoid clobbering DSS steering
+    - tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO.
+    - btrfs: zoned: fix calc_available_free_space() for zoned mode
+    - btrfs: fix folio refcount in __alloc_dummy_extent_buffer()
+    - Bluetooth: Add quirk to ignore reserved PHY bits in LE Extended Adv Report
+    - drm/xe: fix error handling in xe_migrate_update_pgtables
+    - drm/ttm: Always take the bo delayed cleanup path for imported bos
+    - fs: don't misleadingly warn during thaw operations
+    - drm/amdkfd: Let VRAM allocations go to GTT domain on small APUs
+    - drm/amdgpu: correct hbm field in boot status
+    - Upstream stable to v6.6.38, v6.6.39, v6.9.9
+  * Panels show garbage or flickering when i915.psr2 enabled (LP: #2069993)
+    - SAUCE: drm/i915/display/psr: add a psr2 disable quirk table
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x4d_0x10_0x93_0x15
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x30_0xe4_0x8b_0x07
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x30_0xe4_0x78_0x07
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x30_0xe4_0x8c_0x07
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x06_0xaf_0x9a_0xf9
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x4d_0x10_0x8f_0x15
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x06_0xaf_0xa3_0xc3
+  * Random flickering with Intel i915 (Gen9 GPUs in 6th-8th gen CPUs) on Linux
+    6.8 (LP: #2062951)
+    - SAUCE: iommu/intel: disable DMAR for SKL integrated gfx
+  * [SRU][22.04.5]: mpi3mr driver update (LP: #2073583)
+    - scsi: mpi3mr: HDB allocation and posting for hardware and firmware buffers
+    - scsi: mpi3mr: Trigger support
+    - scsi: mpi3mr: Add ioctl support for HDB
+    - scsi: mpi3mr: Support PCI Error Recovery callback handlers
+    - scsi: mpi3mr: Prevent PCI writes from driver during PCI error recovery
+    - scsi: mpi3mr: Driver version update
+  * Fix power consumption while using HW accelerated video decode on AMD
+    platforms (LP: #2073282)
+    - drm/amdgpu/vcn: identify unified queue in sw init
+    - drm/amdgpu/vcn: not pause dpg for unified queue
+  * Noble update: upstream stable patchset 2024-08-09 (LP: #2076435)
+    - usb: typec: ucsi: Never send a lone connector change ack
+    - usb: typec: ucsi: Ack also failed Get Error commands
+    - Input: ili210x - fix ili251x_read_touch_data() return value
+    - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
+    - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
+    - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
+    - pinctrl: rockchip: use dedicated pinctrl type for RK3328
+    - pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
+    - MIPS: pci: lantiq: restore reset gpio polarity
+    - ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right mclk
+    - ASoC: mediatek: mt8183-da7219-max98357: Fix kcontrol name collision
+    - ASoC: atmel: atmel-classd: Re-add dai_link->platform to fix card init
+    - workqueue: Increase worker desc's length to 32
+    - ASoC: q6apm-lpass-dai: close graph on prepare errors
+    - bpf: Add missed var_off setting in set_sext32_default_val()
+    - bpf: Add missed var_off setting in coerce_subreg_to_size_sx()
+    - s390/pci: Add missing virt_to_phys() for directed DIBV
+    - ASoC: amd: acp: add a null check for chip_pdev structure
+    - ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
+    - ASoC: fsl-asoc-card: set priv->pdev before using it
+    - net: dsa: microchip: fix initial port flush problem
+    - openvswitch: get related ct labels from its master if it is not confirmed
+    - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
+    - ibmvnic: Free any outstanding tx skbs during scrq reset
+    - net: phy: micrel: add Microchip KSZ 9477 to the device table
+    - net: dsa: microchip: use collision based back pressure mode
+    - ice: Rebuild TC queues on VSI queue reconfiguration
+    - xdp: Remove WARN() from __xdp_reg_mem_model()
+    - netfilter: fix undefined reference to 'netfilter_lwtunnel_*' when
+      CONFIG_SYSCTL=n
+    - btrfs: use NOFS context when getting inodes during logging and log replay
+    - Fix race for duplicate reqsk on identical SYN
+    - ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2 messages
+    - net: dsa: microchip: fix wrong register write when masking interrupt
+    - sparc: fix old compat_sys_select()
+    - sparc: fix compat recv/recvfrom syscalls
+    - parisc: use correct compat recv/recvfrom syscalls
+    - powerpc: restore some missing spu syscalls
+    - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
+    - ALSA: seq: Fix missing MSB in MIDI2 SPP conversion
+    - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data
+      registers
+    - net: mana: Fix possible double free in error handling path
+    - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
+    - vduse: validate block features only with block devices
+    - vduse: Temporarily fail if control queue feature requested
+    - x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
+    - mtd: partitions: redboot: Added conversion of operands to a larger type
+    - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
+    - bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
+    - RDMA/restrack: Fix potential invalid address access
+    - net/iucv: Avoid explicit cpumask var allocation on stack
+    - net/dpaa2: Avoid explicit cpumask var allocation on stack
+    - crypto: ecdh - explicitly zeroize private_key
+    - ALSA: emux: improve patch ioctl data validation
+    - media: dvbdev: Initialize sbuf
+    - irqchip/loongson: Select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP for
+      IRQ_LOONGARCH_CPU
+    - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
+    - gfs2: Fix NULL pointer dereference in gfs2_log_flush
+    - drm/radeon/radeon_display: Decrease the size of allocated memory
+    - nvme: fixup comment for nvme RDMA Provider Type
+    - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
+    - gpio: davinci: Validate the obtained number of IRQs
+    - RISC-V: fix vector insn load/store width mask
+    - drm/amdgpu: Fix pci state save during mode-1 reset
+    - riscv: stacktrace: convert arch_stack_walk() to noinstr
+    - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
+    - randomize_kstack: Remove non-functional per-arch entropy filtering
+    - x86: stop playing stack games in profile_pc()
+    - parisc: use generic sys_fanotify_mark implementation
+    - Revert "MIPS: pci: lantiq: restore reset gpio polarity"
+    - pinctrl: qcom: spmi-gpio: drop broken pm8008 support
+    - ocfs2: fix DIO failure due to insufficient transaction credits
+    - nfs: drop the incorrect assertion in nfs_swap_rw()
+    - mm: fix incorrect vbq reference in purge_fragmented_block
+    - mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos
+    - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
+    - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
+    - mmc: sdhci: Do not invert write-protect twice
+    - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
+    - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
+    - counter: ti-eqep: enable clock at probe
+    - kbuild: doc: Update default INSTALL_MOD_DIR from extra to updates
+    - kbuild: Fix build target deb-pkg: ln: failed to create hard link
+    - i2c: testunit: don't erase registers after STOP
+    - i2c: testunit: discard write requests while old command is running
+    - ata: libata-core: Fix null pointer dereference on error
+    - ata,scsi: libata-core: Do not leak memory for ata_port struct members
+    - iio: adc: ad7266: Fix variable checking bug
+    - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
+    - iio: chemical: bme680: Fix pressure value output
+    - iio: chemical: bme680: Fix calibration data variable
+    - iio: chemical: bme680: Fix overflows in compensate() functions
+    - iio: chemical: bme680: Fix sensor data read operation
+    - net: usb: ax88179_178a: improve link status logs
+    - usb: gadget: printer: SS+ support
+    - usb: gadget: printer: fix races against disable
+    - usb: musb: da8xx: fix a resource leak in probe()
+    - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
+    - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to
+      avoid deadlock
+    - usb: gadget: aspeed_udc: fix device address configuration
+    - usb: typec: ucsi: glink: fix child node release in probe function
+    - usb: ucsi: stm32: fix command completion handling
+    - usb: dwc3: core: Add DWC31 version 2.00a controller
+    - usb: dwc3: core: Workaround for CSR read timeout
+    - Revert "serial: core: only stop transmit when HW fifo is empty"
+    - serial: 8250_omap: Implementation of Errata i2310
+    - serial: imx: set receiver level before starting uart
+    - serial: core: introduce uart_port_tx_limited_flags()
+    - serial: bcm63xx-uart: fix tx after conversion to uart_port_tx_limited()
+    - tty: mcf: MCF54418 has 10 UARTS
+    - net: can: j1939: Initialize unused data in j1939_send_one()
+    - net: can: j1939: recover socket queue on CAN bus error during BAM
+      transmission
+    - net: can: j1939: enhanced error handling for tightly received RTS messages
+      in xtp_rx_rts_session_new
+    - PCI/MSI: Fix UAF in msi_capability_init
+    - cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
+    - irqchip/loongson-eiointc: Use early_cpu_to_node() instead of cpu_to_node()
+    - cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
+    - irqchip/loongson-liointc: Set different ISRs for different cores
+    - kbuild: Install dtb files as 0644 in Makefile.dtbinst
+    - sh: rework sync_file_range ABI
+    - btrfs: zoned: fix initial free space detection
+    - csky, hexagon: fix broken sys_sync_file_range
+    - hexagon: fix fadvise64_64 calling conventions
+    - drm/drm_file: Fix pid refcounting race
+    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
+    - drm/fbdev-dma: Only set smem_start is enable per module option
+    - drm/amdgpu: avoid using null object of framebuffer
+    - drm/i915/gt: Fix potential UAF by revoke of fence registers
+    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
+    - drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if LTTPR is
+      present
+    - drm/amdgpu/atomfirmware: fix parsing of vram_info
+    - batman-adv: Don't accept TT entries for out-of-spec VIDs
+    - can: mcp251xfd: fix infinite loop when xmit fails
+    - ata: ahci: Clean up sysfs file on error
+    - ata: libata-core: Fix double free on error
+    - ftruncate: pass a signed offset
+    - syscalls: fix compat_sys_io_pgetevents_time64 usage
+    - syscalls: fix sys_fanotify_mark prototype
+    - Revert "cpufreq: amd-pstate: Fix the inconsistency in max frequency units"
+    - mm/page_alloc: Separate THP PCP into movable and non-movable categories
+    - arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s
+    - arm64: dts: rockchip: Rename LED related pinctrl nodes on rk3308-rock-pi-s
+    - arm64: dts: rockchip: Fix the value of `dlg,jack-det-rate` mismatch on
+      rk3399-gru
+    - ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node
+    - arm64: dts: rockchip: make poweroff(8) work on Radxa ROCK 5A
+    - arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E
+    - arm64: dts: rockchip: Add sound-dai-cells for RK3368
+    - cxl/region: Move cxl_dpa_to_region() work to the region driver
+    - cxl/region: Avoid null pointer dereference in region lookup
+    - cxl/region: check interleave capability
+    - serial: imx: only set receiver level if it is zero
+    - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
+    - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
+    - pwm: stm32: Improve precision of calculation in .apply()
+    - pwm: stm32: Fix for settings using period > UINT32_MAX
+    - pwm: stm32: Calculate prescaler with a division instead of a loop
+    - pwm: stm32: Refuse too small period requests
+    - ASoC: cs42l43: Increase default type detect time and button delay
+    - ASoC: amd: acp: move chip->flag variable assignment
+    - bonding: fix incorrect software timestamping report
+    - mlxsw: pci: Fix driver initialization with Spectrum-4
+    - vxlan: Pull inner IP header in vxlan_xmit_one().
+    - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link
+    - af_unix: Stop recv(MSG_PEEK) at consumed OOB skb.
+    - af_unix: Don't stop recv(MSG_DONTWAIT) if consumed OOB skb is at the head.
+    - af_unix: Don't stop recv() at consumed ex-OOB skb.
+    - af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.
+    - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
+    - bpf: Take return from set_memory_rox() into account with
+      bpf_jit_binary_lock_ro()
+    - drm/xe: Fix potential integer overflow in page size calculation
+    - drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init
+    - drm/amd/display: correct hostvm flag
+    - drm/amd/display: Skip pipe if the pipe idx not set properly
+    - bpf: Add a check for struct bpf_fib_lookup size
+    - drm/xe/xe_devcoredump: Check NULL before assignments
+    - iommu/arm-smmu-v3: Do not allow a SVA domain to be set on the wrong PASID
+    - evm: Enforce signatures on unsupported filesystem for EVM_INIT_X509
+    - drm/xe: Check pat.ops before dumping PAT settings
+    - nvmet: do not return 'reserved' for empty TSAS values
+    - nvmet: make 'tsas' attribute idempotent for RDMA
+    - iommu/amd: Fix GT feature enablement again
+    - gpiolib: cdev: Ignore reconfiguration without direction
+    - kasan: fix bad call to unpoison_slab_object
+    - mm/memory: don't require head page for do_set_pmd()
+    - SUNRPC: Fix backchannel reply, again
+    - Revert "usb: gadget: u_ether: Re-attach netif device to mirror detachment"
+    - Revert "usb: gadget: u_ether: Replace netif_stop_queue with
+      netif_device_detach"
+    - tty: serial: 8250: Fix port count mismatch with the device
+    - tty: mxser: Remove __counted_by from mxser_board.ports[]
+    - nvmet-fc: Remove __counted_by from nvmet_fc_tgt_queue.fod[]
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for all Crucial BX SSD1 models
+    - bcachefs: Fix sb_field_downgrade validation
+    - bcachefs: Fix sb-downgrade validation
+    - bcachefs: Fix bch2_sb_downgrade_update()
+    - bcachefs: Fix setting of downgrade recovery passes/errors
+    - bcachefs: btree_gc can now handle unknown btrees
+    - pwm: stm32: Fix calculation of prescaler
+    - pwm: stm32: Fix error message to not describe the previous error path
+    - cxl/region: Convert cxl_pmem_region_alloc to scope-based resource management
+    - cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
+    - arm64: dts: rockchip: Fix the i2c address of es8316 on Cool Pi 4B
+    - netfs: Fix netfs_page_mkwrite() to check folio->mapping is valid
+    - netfs: Fix netfs_page_mkwrite() to flush conflicting data, not wait
+    - Upstream stable to v6.6.37, v6.9.8
+  * [UBUNTU 22.04] s390/cpum_cf: make crypto counters upward compatible
+    (LP: #2074380)
+    - s390/cpum_cf: make crypto counters upward compatible across machine types
+  * CVE-2024-45016
+    - netem: fix return value if duplicate enqueue fails
+
+  [ Ubuntu: 6.8.0-45.45 ]
+
+  * noble/linux: 6.8.0-45.45 -proposed tracker (LP: #2078100)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/s2024.08.05)
+  * Noble update: upstream stable patchset 2024-08-09 (LP: #2076435) //
+    CVE-2024-41009
+    - bpf: Fix overrunning reservations in ringbuf
+  * CVE-2024-42160
+    - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
+    - f2fs: Add inline to f2fs_build_fault_attr() stub
+  * Noble update: upstream stable patchset 2024-08-22 (LP: #2077600) //
+    CVE-2024-42224
+    - net: dsa: mv88e6xxx: Correct check for empty list
+  * Noble update: upstream stable patchset 2024-08-22 (LP: #2077600) //
+    CVE-2024-42154
+    - tcp_metrics: validate source addr length
+  * CVE-2024-42228
+    - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
+  * CVE-2024-42159
+    - scsi: mpi3mr: Sanitise num_phys
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 03 Oct 2024 23:24:01 +0900
+
+linux-qcom (6.8.0-1010.10) jammy; urgency=medium
+
+  * jammy/linux-qcom: 6.8.0-1010.10 -proposed tracker (LP: #2081038)
+
+  * Disable PCI_DYNAMIC_OF_NODES in Ubuntu (LP: #2074376)
+    - [Config] Disable PCI_DYNAMIC_OF_NODES
+
+  * Reenable CONFIG_UBSAN for noble (LP: #2076650)
+    - [Config] Remove CONFIG_UBSAN_SANITIZE_ALL
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update update.conf
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] create linux-libc-dev-qcom package
+    - SAUCE: rdbg: include <linux/platform_device.h>
+    - SAUCE: add empty dkms-versions
+
+  * Miscellaneous upstream changes
+    - Ubuntu: [Config] enable more CONFIG options based on GA 1.1
+
+  [ Ubuntu: 6.8.0-44.44 ]
+
+  * noble/linux: 6.8.0-44.44 -proposed tracker (LP: #2076647)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.08.05)
+  * Disable PCI_DYNAMIC_OF_NODES in Ubuntu (LP: #2074376)
+    - [Config] Disable PCI_DYNAMIC_OF_NODES
+  * [SRU] Turbostat support for Arrow Lake H (LP: #2074372)
+    - tools/power turbostat: Enhance ARL/LNL support
+    - x86/cpu: Add model number for another Intel Arrow Lake mobile processor
+    - tools/power turbostat: Add ARL-H support
+  * Noble update: upstream stable patchset 2024-07-30 (LP: #2075154)
+    - fs/writeback: bail out if there is no more inodes for IO and queued once
+    - padata: Disable BH when taking works lock on MT path
+    - crypto: hisilicon/sec - Fix memory leak for sec resource release
+    - crypto: hisilicon/qm - Add the err memory release process to qm uninit
+    - io_uring/sqpoll: work around a potential audit memory leak
+    - rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
+    - rcutorture: Make stall-tasks directly exit when rcutorture tests end
+    - rcutorture: Fix invalid context warning when enable srcu barrier testing
+    - block/ioctl: prefer different overflow check
+    - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
+    - selftests/bpf: Prevent client connect before server bind in
+      test_tc_tunnel.sh
+    - selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
+    - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
+    - wifi: ath9k: work around memset overflow warning
+    - af_packet: avoid a false positive warning in packet_setsockopt()
+    - ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
+    - drop_monitor: replace spin_lock by raw_spin_lock
+    - scsi: qedi: Fix crash while reading debugfs attribute
+    - net: sfp: add quirk for ATS SFP-GE-T 1000Base-TX module
+    - net/sched: fix false lockdep warning on qdisc root lock
+    - kselftest: arm64: Add a null pointer check
+    - net: dsa: realtek: keep default LED state in rtl8366rb
+    - netpoll: Fix race condition in netpoll_owner_active
+    - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
+    - HID: Add quirk for Logitech Casa touchpad
+    - HID: asus: fix more n-key report descriptors if n-key quirked
+    - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
+    - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
+    - drm/amd/display: Exit idle optimizations before HDCP execution
+    - platform/x86: toshiba_acpi: Add quirk for buttons on Z830
+    - ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
+    - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F
+    - drm/lima: add mask irq callback to gp and pp
+    - drm/lima: mask irqs in timeout path before hard reset
+    - ALSA: hda/realtek: Add quirks for Lenovo 13X
+    - powerpc/pseries: Enforce hcall result buffer validity and size
+    - media: intel/ipu6: Fix build with !ACPI
+    - media: mtk-vcodec: potential null pointer deference in SCP
+    - powerpc/io: Avoid clang null pointer arithmetic warnings
+    - platform/x86: p2sb: Don't init until unassigned resources have been assigned
+    - power: supply: cros_usbpd: provide ID table for avoiding fallback match
+    - iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
+    - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
+    - kprobe/ftrace: bail out if ftrace was killed
+    - usb: gadget: uvc: configfs: ensure guid to be valid before set
+    - f2fs: remove clear SB_INLINECRYPT flag in default_options
+    - usb: misc: uss720: check for incompatible versions of the Belkin F5U002
+    - Avoid hw_desc array overrun in dw-axi-dmac
+    - usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on Lenovo Yoga
+      Tab2 1380
+    - usb: typec: ucsi_glink: drop special handling for CCI_BUSY
+    - udf: udftime: prevent overflow in udf_disk_stamp_to_time()
+    - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
+    - f2fs: don't set RO when shutting down f2fs
+    - MIPS: Octeon: Add PCIe link status check
+    - serial: imx: Introduce timeout when waiting on transmitter empty
+    - serial: exar: adding missing CTI and Exar PCI ids
+    - usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
+    - tty: add the option to have a tty reject a new ldisc
+    - vfio/pci: Collect hot-reset devices to local buffer
+    - cpufreq: amd-pstate: fix memory leak on CPU EPP exit
+    - ACPI: EC: Install address space handler at the namespace root
+    - PCI: Do not wait for disconnected devices when resuming
+    - ALSA: hda: cs35l41: Possible null pointer dereference in
+      cs35l41_hda_unbind()
+    - ALSA: seq: ump: Fix missing System Reset message handling
+    - MIPS: Routerboard 532: Fix vendor retry check code
+    - mips: bmips: BCM6358: make sure CBR is correctly set
+    - tracing: Build event generation tests only as modules
+    - ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
+    - ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
+    - ice: avoid IRQ collision to fix init failure on ACPI S3 resume
+    - btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
+    - net: mvpp2: use slab_build_skb for oversized frames
+    - cipso: fix total option length computation
+    - ALSA: hda: cs35l56: Component should be unbound before deconstruction
+    - ALSA: hda: tas2781: Component should be unbound before deconstruction
+    - bpf: Avoid splat in pskb_pull_reason
+    - ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
+    - netrom: Fix a memory leak in nr_heartbeat_expiry()
+    - ipv6: prevent possible NULL deref in fib6_nh_init()
+    - ipv6: prevent possible NULL dereference in rt6_probe()
+    - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
+    - netns: Make get_net_ns() handle zero refcount net
+    - qca_spi: Make interrupt remembering atomic
+    - net: lan743x: disable WOL upon resume to restore full data path operation
+    - net: lan743x: Support WOL at both the PHY and MAC appropriately
+    - net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
+    - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
+    - tipc: force a dst refcount before doing decryption
+    - sched: act_ct: add netns into the key of tcf_ct_flow_table
+    - ptp: fix integer overflow in max_vclocks_store
+    - selftests: openvswitch: Use bash as interpreter
+    - net: stmmac: No need to calculate speed divider when offload is disabled
+    - virtio_net: checksum offloading handling fix
+    - virtio_net: fixing XDP for fully checksummed packets handling
+    - octeontx2-pf: Add error handling to VLAN unoffload handling
+    - octeontx2-pf: Fix linking objects into multiple modules
+    - netfilter: ipset: Fix suspicious rcu_dereference_protected()
+    - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6
+      behaviors
+    - netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core
+    - ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
+    - bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
+    - net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
+    - RDMA/bnxt_re: Fix the max msix vectors macro
+    - spi: cs42l43: Correct SPI root clock speed
+    - RDMA/rxe: Fix responder length checking for UD request packets
+    - regulator: core: Fix modpost error "regulator_get_regmap" undefined
+    - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
+    - dmaengine: ioatdma: Fix leaking on version mismatch
+    - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
+    - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
+    - dmaengine: fsl-edma: avoid linking both modules
+    - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
+    - regulator: bd71815: fix ramp values
+    - thermal/drivers/mediatek/lvts_thermal: Return error in case of invalid efuse
+      data
+    - arm64: dts: imx8mp: Fix TC9595 input clock on DH i.MX8M Plus DHCOM SoM
+    - arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix BT shutdown GPIO
+    - arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property
+    - arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
+    - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is
+      fine."
+    - spi: spi-imx: imx51: revert burst length calculation back to bits_per_word
+    - io_uring/rsrc: fix incorrect assignment of iter->nr_segs in io_import_fixed
+    - firmware: psci: Fix return value from psci_system_suspend()
+    - RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init
+    - RDMA/mlx5: Add check for srq max_sge attribute
+    - RDMA/mana_ib: Ignore optional access flags for MRs
+    - ACPI: EC: Evaluate orphan _REG under EC device
+    - arm64: defconfig: enable the vf610 gpio driver
+    - ext4: avoid overflow when setting values via sysfs
+    - ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
+    - net: stmmac: Assign configured channel value to EXTTS event
+    - net: usb: ax88179_178a: improve reset check
+    - net: do not leave a dangling sk pointer, when socket creation fails
+    - btrfs: retry block group reclaim without infinite loop
+    - scsi: ufs: core: Free memory allocated for model before reinit
+    - cifs: fix typo in module parameter enable_gcm_256
+    - LoongArch: Fix watchpoint setting error
+    - LoongArch: Trigger user-space watchpoints correctly
+    - LoongArch: Fix multiple hardware watchpoint issues
+    - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
+    - KVM: arm64: Disassociate vcpus from redistributor region on teardown
+    - KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
+    - RDMA/rxe: Fix data copy for IB_SEND_INLINE
+    - RDMA/mlx5: Remove extra unlock on error path
+    - RDMA/mlx5: Follow rb_key.ats when creating new mkeys
+    - ovl: fix encoding fid for lower only root
+    - ALSA: hda/realtek: Limit mic boost on N14AP7
+    - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9
+    - drm/i915/mso: using joiner is not possible with eDP MSO
+    - drm/radeon: fix UBSAN warning in kv_dpm.c
+    - drm/amdgpu: fix UBSAN warning in kv_dpm.c
+    - dt-bindings: dma: fsl-edma: fix dma-channels constraints
+    - ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()
+    - ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
+    - gcov: add support for GCC 14
+    - kcov: don't lose track of remote references during softirqs
+    - efi/x86: Free EFI memory map only when installing a new one.
+    - serial: 8250_dw: Revert "Move definitions to the shared header"
+    - mm: mmap: allow for the maximum number of bits for randomizing mmap_base by
+      default
+    - tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
+    - mm/page_table_check: fix crash on ZONE_DEVICE
+    - i2c: ocores: set IACK bit after core is enabled
+    - dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema
+    - dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller
+      schema
+    - spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup()
+    - arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
+    - spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4
+    - perf: script: add raw|disasm arguments to --insn-trace option
+    - nbd: Improve the documentation of the locking assumptions
+    - nbd: Fix signal handling
+    - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
+    - x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
+    - x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
+    - drm/amd/display: revert Exit idle optimizations before HDCP execution
+    - ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk
+    - net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path
+    - kprobe/ftrace: fix build error due to bad function definition
+    - hid: asus: asus_report_fixup: fix potential read out of bounds
+    - Revert "mm: mmap: allow for the maximum number of bits for randomizing
+      mmap_base by default"
+    - platform/chrome: cros_usbpd_logger: provide ID table for avoiding fallback
+      match
+    - platform/chrome: cros_usbpd_notify: provide ID table for avoiding fallback
+      match
+    - ubsan: Avoid i386 UBSAN handler crashes with Clang
+    - arm64: defconfig: select INTERCONNECT_QCOM_SM6115 as built-in
+    - bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.
+    - devlink: use kvzalloc() to allocate devlink instance resources
+    - wifi: rtw89: 8852c: add quirk to set PCI BER for certain platforms
+    - clocksource: Make watchdog and suspend-timing multiplication overflow safe
+    - ACPI: resource: Do IRQ override on GMxBGxx (XMG APEX 17 M23)
+    - wifi: ath12k: add string type to search board data in board-2.bin for
+      WCN7850
+    - wifi: ath12k: add firmware-2.bin support
+    - wifi: ath12k: fix kernel crash during resume
+    - arm64/sysreg: Update PIE permission encodings
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MV
+    - wifi: ath12k: fix the problem that down grade phy mode operation
+    - bpf: avoid uninitialized warnings in verifier_global_subprogs.c
+    - selftests: net: fix timestamp not arriving in cmsg_time.sh
+    - net: ena: Add validation for completion descriptors consistency
+    - drm/amd/display: Workaround register access in idle race with cursor
+    - cgroup/cpuset: Make cpuset hotplug processing synchronous
+    - platform/x86: x86-android-tablets: Unregister devices in reverse order
+    - platform/x86: x86-android-tablets: Add Lenovo Yoga Tablet 2 Pro 1380F/L data
+    - ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41
+    - ext4: fold quota accounting into ext4_xattr_inode_lookup_create()
+    - ext4: do not create EA inode under buffer lock
+    - f2fs: fix to detect inconsistent nat entry during truncation
+    - usb: typec: ucsi_glink: rework quirks implementation
+    - xhci: remove XHCI_TRUST_TX_LENGTH quirk
+    - clk: Add a devm variant of clk_rate_exclusive_get()
+    - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
+    - i2c: lpi2c: Avoid calling clk_get_rate during transfer
+    - cxl: Add post-reset warning if reset results in loss of previously committed
+      HDM decoders
+    - OPP: Fix required_opp_tables for multiple genpds using same table
+    - wifi: iwlwifi: mvm: fix ROC version check
+    - wifi: mac80211: Recalc offload when monitor stop
+    - ice: fix 200G link speed message log
+    - ice: implement AQ download pkg retry
+    - bpf: Fix reg_set_min_max corruption of fake_reg
+    - ALSA: hda: cs35l41: Component should be unbound before deconstruction
+    - netdev-genl: fix error codes when outputting XDP features
+    - arm64: dts: freescale: imx8mm-verdin: Fix GPU speed
+    - phy: qcom-qmp: qserdes-txrx: Add missing registers offsets
+    - phy: qcom-qmp: pcs: Add missing v6 N4 register offsets
+    - phy: qcom: qmp-combo: Switch from V6 to V6 N4 register offsets
+    - powerpc/crypto: Add generated P8 asm to .gitignore
+    - spi: Exctract spi_dev_check_cs() helper
+    - spi: Fix SPI slave probe failure
+    - net: phy: dp83tg720: wake up PHYs in managed mode
+    - net: phy: dp83tg720: get master/slave configuration in link down state
+    - RDMA/mlx5: Ensure created mkeys always have a populated rb_key
+    - drm/amdgpu: fix locking scope when flushing tlb
+    - drm/amd/display: Remove redundant idle optimization check
+    - drm/amd/display: Attempt to avoid empty TUs when endpoint is DPIA
+    - ata: ahci: Do not enable LPM if no LPM states are supported by the HBA
+    - dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()
+    - net/tcp_ao: Don't leak ao_info on error-path
+    - mm: shmem: fix getting incorrect lruvec when replacing a shmem folio
+    - selftests: mptcp: print_test out of verify_listener_events
+    - selftests: mptcp: userspace_pm: fixed subtest names
+    - ima: Avoid blocking in RCU read-side critical section
+    - virt: guest_memfd: fix reference leak on hwpoisoned page
+    - thermal: int340x: processor_thermal: Support shared interrupts
+    - thermal: core: Change PM notifier priority to the minimum
+    - wifi: ath12k: check M3 buffer size as well whey trying to reuse it
+    - Upstream stable to v6.6.36, v6.9.7
+  * [SRU] Add Dynamic Tuning Technology (DTT)  support for Lunar Lake
+    (LP: #2073961)
+    - thermal: int340x: processor_thermal: Add Lunar Lake-M PCI ID
+  * Kubuntu 24.04 freezes after plugging in ethernet cable (LP: #2073358)
+    - e1000e: move force SMBUS near the end of enable_ulp function
+    - e1000e: fix force smbus during suspend flow
+  * Noble update: upstream stable patchset 2024-07-25 (LP: #2074091)
+    - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
+    - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
+    - wifi: cfg80211: fully move wiphy work to unbound workqueue
+    - wifi: cfg80211: Lock wiphy in cfg80211_get_station
+    - wifi: cfg80211: pmsr: use correct nla_get_uX functions
+    - wifi: iwlwifi: mvm: don't initialize csa_work twice
+    - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
+    - wifi: iwlwifi: mvm: set properly mac header
+    - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
+    - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
+    - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
+    - wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
+    - scsi: ufs: mcq: Fix error output and clean up ufshcd_mcq_abort()
+    - RISC-V: KVM: No need to use mask when hart-index-bit is 0
+    - RISC-V: KVM: Fix incorrect reg_subtype labels in
+      kvm_riscv_vcpu_set_reg_isa_ext function
+    - ax25: Fix refcount imbalance on inbound connections
+    - ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()
+    - net/ncsi: Fix the multi thread manner of NCSI driver
+    - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume
+    - bpf: Fix a potential use-after-free in bpf_link_free()
+    - KVM: SEV-ES: Disallow SEV-ES guests when X86_FEATURE_LBRV is absent
+    - KVM: SEV-ES: Delegate LBR virtualization to the processor
+    - vmxnet3: disable rx data ring on dma allocation failure
+    - ipv6: ioam: block BH from ioam6_output()
+    - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
+    - net: tls: fix marking packets as decrypted
+    - bpf: Set run context for rawtp test_run callback
+    - octeontx2-af: Always allocate PF entries from low prioriy zone
+    - net/smc: avoid overwriting when adjusting sock bufsizes
+    - net: phy: Micrel KSZ8061: fix errata solution not taking effect problem
+    - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
+    - vxlan: Fix regression when dropping packets due to invalid src addresses
+    - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
+    - mptcp: count CLOSE-WAIT sockets for MPTCP_MIB_CURRESTAB
+    - net/mlx5: Stop waiting for PCI if pci channel is offline
+    - net/mlx5: Always stop health timer during driver removal
+    - net/mlx5: Fix tainted pointer delete is case of flow rules creation fail
+    - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
+    - ptp: Fix error message on failed pin verification
+    - ice: fix iteration of TLVs in Preserved Fields Area
+    - ice: remove af_xdp_zc_qps bitmap
+    - ice: add flag to distinguish reset from .ndo_bpf in XDP rings config
+    - net: wwan: iosm: Fix tainted pointer delete is case of region creation fail
+    - af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted
+      peer.
+    - af_unix: Annodate data-races around sk->sk_state for writers.
+    - af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
+    - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and
+      poll().
+    - af_unix: Annotate data-race of sk->sk_state in unix_stream_connect().
+    - af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
+    - af_unix: Annotate data-race of sk->sk_state in unix_stream_read_skb().
+    - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
+    - af_unix: Annotate data-races around sk->sk_sndbuf.
+    - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
+    - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
+    - af_unix: Use skb_queue_empty_lockless() in unix_release_sock().
+    - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
+    - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
+    - ipv6: fix possible race in __fib6_drop_pcpu_from()
+    - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
+    - selftests/mm: log a consistent test name for check_compaction
+    - irqchip/riscv-intc: Allow large non-standard interrupt number
+    - irqchip/riscv-intc: Introduce Andes hart-level interrupt controller
+    - eventfs: Update all the eventfs_inodes from the events descriptor
+    - io_uring/rsrc: don't lock while !TASK_RUNNING
+    - io_uring: check for non-NULL file pointer in io_file_can_poll()
+    - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
+    - USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected
+    - usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps
+    - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
+    - mei: me: release irq in mei_me_pci_resume error path
+    - tty: n_tty: Fix buffer offsets when lookahead is used
+    - serial: port: Don't block system suspend even if bytes are left to xmit
+    - landlock: Fix d_parent walk
+    - jfs: xattr: fix buffer overflow for invalid xattr
+    - xhci: Set correct transferred length for cancelled bulk transfers
+    - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
+    - xhci: Handle TD clearing for multiple streams case
+    - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
+    - thunderbolt: debugfs: Fix margin debugfs node creation condition
+    - scsi: core: Disable CDL by default
+    - scsi: mpi3mr: Fix ATA NCQ priority support
+    - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
+    - scsi: sd: Use READ(16) when reading block zero on large capacity disks
+    - gve: Clear napi->skb before dev_kfree_skb_any()
+    - powerpc/uaccess: Fix build errors seen with GCC 13/14
+    - HID: nvidia-shield: Add missing check for input_ff_create_memless
+    - cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c
+    - cxl/region: Fix memregion leaks in devm_cxl_add_region()
+    - cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd
+    - cachefiles: remove requests from xarray during flushing requests
+    - cachefiles: add spin_lock for cachefiles_ondemand_info
+    - cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()
+    - cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
+    - cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read()
+    - cachefiles: never get a new anonymous fd if ondemand_id is valid
+    - cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
+    - cachefiles: flush all requests after setting CACHEFILES_DEAD
+    - selftests/ftrace: Fix to check required event file
+    - clk: sifive: Do not register clkdevs for PRCI clocks
+    - NFSv4.1 enforce rootpath check in fs_location query
+    - SUNRPC: return proper error from gss_wrap_req_priv
+    - NFS: add barriers when testing for NFS_FSDATA_BLOCKED
+    - selftests/tracing: Fix event filter test to retry up to 10 times
+    - nvme: fix nvme_pr_* status code parsing
+    - drm/panel: sitronix-st7789v: Add check for of_drm_get_panel_orientation
+    - platform/x86: dell-smbios: Fix wrong token data in sysfs
+    - gpio: tqmx86: fix typo in Kconfig label
+    - gpio: tqmx86: introduce shadow register for GPIO output value
+    - gpio: tqmx86: store IRQ trigger type and unmask status separately
+    - gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type
+    - HID: core: remove unnecessary WARN_ON() in implement()
+    - iommu/amd: Fix sysfs leak in iommu init
+    - iommu: Return right value in iommu_sva_bind_device()
+    - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
+    - io_uring/io-wq: avoid garbage value of 'match' in io_wq_enqueue()
+    - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
+    - drm/vmwgfx: Refactor drm connector probing for display modes
+    - drm/vmwgfx: Filter modes which exceed graphics memory
+    - drm/vmwgfx: 3D disabled should not effect STDU memory limits
+    - drm/vmwgfx: Remove STDU logic from generic mode_valid function
+    - drm/vmwgfx: Don't memcmp equivalent pointers
+    - af_unix: Annotate data-race of sk->sk_state in unix_accept().
+    - modpost: do not warn about missing MODULE_DESCRIPTION() for vmlinux.o
+    - net: sfp: Always call `sfp_sm_mod_remove()` on remove
+    - net: hns3: fix kernel crash problem in concurrent scenario
+    - net: hns3: add cond_resched() to hns3 ring buffer init process
+    - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
+    - net: stmmac: dwmac-qcom-ethqos: Configure host DMA width
+    - drm/komeda: check for error-valued pointer
+    - drm/bridge/panel: Fix runtime warning on panel bridge release
+    - tcp: fix race in tcp_v6_syn_recv_sock()
+    - net dsa: qca8k: fix usages of device_get_named_child_node()
+    - geneve: Fix incorrect inner network header offset when innerprotoinherit is
+      set
+    - net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN)
+      packets
+    - Bluetooth: fix connection setup in l2cap_connect
+    - netfilter: nft_inner: validate mandatory meta and payload
+    - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set
+      type
+    - x86/asm: Use %c/%n instead of %P operand modifier in asm templates
+    - x86/uaccess: Fix missed zeroing of ia32 u64 get_user() range checking
+    - scsi: ufs: core: Quiesce request queues before checking pending cmds
+    - net: pse-pd: Use EOPNOTSUPP error code instead of ENOTSUPP
+    - gve: ignore nonrelevant GSO type bits when processing TSO headers
+    - net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs
+      parameters
+    - block: sed-opal: avoid possible wrong address reference in
+      read_sed_opal_key()
+    - block: fix request.queuelist usage in flush
+    - nvmet-passthru: propagate status from id override functions
+    - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
+    - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
+    - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
+    - ionic: fix use after netif_napi_del()
+    - af_unix: Read with MSG_PEEK loops if the first unread byte is OOB
+    - bnxt_en: Adjust logging of firmware messages in case of released token in
+      __hwrm_send()
+    - misc: microchip: pci1xxxx: fix double free in the error handling of
+      gp_aux_bus_probe()
+    - ksmbd: move leading slash check to smb2_get_name()
+    - ksmbd: fix missing use of get_write in in smb2_set_ea()
+    - x86/boot: Don't add the EFI stub to targets, again
+    - iio: adc: ad9467: fix scan type sign
+    - iio: dac: ad5592r: fix temperature channel scaling value
+    - iio: invensense: fix odr switching to same value
+    - iio: imu: inv_icm42600: delete unneeded update watermark call
+    - drivers: core: synchronize really_probe() and dev_uevent()
+    - parisc: Try to fix random segmentation faults in package builds
+    - ACPI: x86: Force StorageD3Enable on more products
+    - drm/exynos/vidi: fix memory leak in .get_modes()
+    - drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
+    - mptcp: ensure snd_una is properly initialized on connect
+    - mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
+    - mptcp: pm: update add_addr counters after connect
+    - clkdev: Update clkdev id usage to allow for longer names
+    - irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
+    - x86/kexec: Fix bug with call depth tracking
+    - x86/amd_nb: Check for invalid SMN reads
+    - perf/core: Fix missing wakeup when waiting for context reference
+    - perf auxtrace: Fix multiple use of --itrace option
+    - riscv: fix overlap of allocated page and PTR_ERR
+    - tracing/selftests: Fix kprobe event name test for .isra. functions
+    - kheaders: explicitly define file modes for archived headers
+    - null_blk: Print correct max open zones limit in null_init_zoned_dev()
+    - sock_map: avoid race between sock_map_close and sk_psock_put
+    - dma-buf: handle testing kthreads creation failure
+    - vmci: prevent speculation leaks by sanitizing event in event_deliver()
+    - spmi: hisi-spmi-controller: Do not override device identifier
+    - knfsd: LOOKUP can return an illegal error value
+    - fs/proc: fix softlockup in __read_vmcore
+    - ocfs2: use coarse time for new created files
+    - ocfs2: fix races between hole punching and AIO+DIO
+    - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
+    - dmaengine: axi-dmac: fix possible race in remove()
+    - remoteproc: k3-r5: Wait for core0 power-up before powering up core1
+    - remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs
+    - iio: adc: axi-adc: make sure AXI clock is enabled
+    - iio: invensense: fix interrupt timestamp alignment
+    - riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
+    - rtla/timerlat: Simplify "no value" printing on top
+    - rtla/auto-analysis: Replace \t with spaces
+    - drm/i915/gt: Disarm breadcrumbs if engines are already idle
+    - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
+    - drm/i915/dpt: Make DPT object unshrinkable
+    - drm/i915: Fix audio component initialization
+    - intel_th: pci: Add Meteor Lake-S support
+    - pmdomain: ti-sci: Fix duplicate PD referrals
+    - btrfs: zoned: fix use-after-free due to race with dev replace
+    - xfs: fix imprecise logic in xchk_btree_check_block_owner
+    - xfs: fix scrub stats file permissions
+    - xfs: fix SEEK_HOLE/DATA for regions with active COW extents
+    - xfs: shrink failure needs to hold AGI buffer
+    - xfs: ensure submit buffers on LSN boundaries in error handlers
+    - xfs: allow sunit mount option to repair bad primary sb stripe values
+    - xfs: don't use current->journal_info
+    - xfs: allow cross-linking special files without project quota
+    - swiotlb: Enforce page alignment in swiotlb_alloc()
+    - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE
+    - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary
+    - tick/nohz_full: Don't abuse smp_call_function_single() in
+      tick_setup_device()
+    - mm/huge_memory: don't unpoison huge_zero_folio
+    - serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
+    - Revert "fork: defer linking file vma until vma is fully initialized"
+    - remoteproc: k3-r5: Jump to error handling labels in start/stop errors
+    - greybus: Fix use-after-free bug in gb_interface_release due to race
+      condition.
+    - ima: Fix use-after-free on a dentry's dname.name
+    - serial: core: Add UPIO_UNKNOWN constant for unknown port type
+    - serial: port: Introduce a common helper to read properties
+    - serial: 8250_dw: Switch to use uart_read_port_properties()
+    - serial: 8250_dw: Replace ACPI device check by a quirk
+    - serial: 8250_dw: Don't use struct dw8250_data outside of 8250_dw
+    - usb-storage: alauda: Check whether the media is initialized
+    - misc: microchip: pci1xxxx: Fix a memory leak in the error handling of
+      gp_aux_bus_probe()
+    - i2c: at91: Fix the functionality flags of the slave-only interface
+    - i2c: designware: Fix the functionality flags of the slave-only interface
+    - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
+    - wifi: ath11k: fix WCN6750 firmware crash caused by 17 num_vdevs
+    - cpufreq: amd-pstate: Unify computation of
+      {max,min,nominal,lowest_nonlinear}_freq
+    - cpufreq: amd-pstate: Add quirk for the pstate CPPC capabilities missing
+    - cpufreq: amd-pstate: remove global header file
+    - virtio_net: fix possible dim status unrecoverable
+    - net: ethernet: mtk_eth_soc: handle dma buffer size soc specific
+    - ice: fix reads from NVM Shadow RAM on E830 and E825-C devices
+    - ice: map XDP queues to vectors in ice_vsi_map_rings_to_vectors()
+    - x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes()
+    - x86/cpu: Provide default cache line size if not enumerated
+    - selftests/mm: ksft_exit functions do not return
+    - selftests/mm: compaction_test: fix bogus test success and reduce probability
+      of OOM-killer invocation
+    - .editorconfig: remove trim_trailing_whitespace option
+    - kcov, usb: disable interrupts in kcov_remote_start_usb_softirq
+    - ata: libata-scsi: Set the RMB bit only for removable media devices
+    - powerpc/85xx: fix compile error without CONFIG_CRASH_DUMP
+    - kselftest/alsa: Ensure _GNU_SOURCE is defined
+    - thermal: core: Do not fail cdev registration because of invalid initial
+      state
+    - Bluetooth: hci_sync: Fix not using correct handle
+    - net/sched: initialize noop_qdisc owner
+    - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
+    - drm/nouveau: don't attempt to schedule hpd_work on headless cards
+    - drm/xe/xe_gt_idle: use GT forcewake domain assertion
+    - drm/xe: flush engine buffers before signalling user fence on all engines
+    - drm/xe: Remove mem_access from guc_pc calls
+    - drm/xe: move disable_c6 call
+    - bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response
+    - iio: imu: bmi323: Fix trigger notification in case of error
+    - iio: pressure: bmp280: Fix BMP580 temperature reading
+    - iio: temperature: mlx90635: Fix ERR_PTR dereference in mlx90635_probe()
+    - thermal: ACPI: Invalidate trip points with temperature of 0 or below
+    - x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
+    - memblock: make memblock_set_node() also warn about use of MAX_NUMNODES
+    - perf script: Show also errors for --insn-trace option
+    - wifi: cfg80211: validate HE operation element parsing
+    - wifi: rtlwifi: Ignore IEEE80211_CONF_CHANGE_RETRY_LIMITS
+    - locking/atomic: scripts: fix ${atomic}_sub_and_test() kerneldoc
+    - ata: ahci: Do not apply Intel PCS quirk on Intel Alder Lake
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for Apacer AS340
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for Crucial CT240BX500SSD1
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for AMD Radeon S3 SSD
+    - kexec: fix the unexpected kexec_dprintk() macro
+    - ocfs2: update inode fsync transaction id in ocfs2_unlink and ocfs2_link
+    - dm-integrity: set discard_granularity to logical block size
+    - drm/bridge: aux-hpd-bridge: correct devm_drm_dp_hpd_bridge_add() stub
+    - iio: temperature: mcp9600: Fix temperature reading for negative values
+    - drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2
+    - riscv: force PAGE_SIZE linear mapping if debug_pagealloc is enabled
+    - drm/xe: Properly handle alloc_guc_id() failure
+    - wifi: iwlwifi: mvm: support iwl_dev_tx_power_cmd_v8
+    - wifi: iwlwifi: mvm: fix a crash on 7265
+    - mei: vsc: Fix wrong invocation of ACPI SID method
+    - Upstream stable to v6.6.35, v6.9.6
+  * [SRU] Add support for intel trace hub for last platforms (LP: #2073926) //
+    Noble update: upstream stable patchset 2024-07-25 (LP: #2074091)
+    - intel_th: pci: Add Granite Rapids support
+    - intel_th: pci: Add Granite Rapids SOC support
+    - intel_th: pci: Add Sapphire Rapids SOC support
+    - intel_th: pci: Add Lunar Lake support
+  * Fix L2CAP/LE/CPU/BV-02-C bluetooth certification failure (LP: #2072858) //
+    Noble update: upstream stable patchset 2024-07-25 (LP: #2074091)
+    - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
+  * Noble update: upstream stable patchset 2024-07-22 (LP: #2073788)
+    - drm/i915/hwmon: Get rid of devm
+    - afs: Don't cross .backup mountpoint from backup volume
+    - erofs: avoid allocating DEFLATE streams before mounting
+    - vxlan: Fix regression when dropping packets due to invalid src addresses
+    - drm/sun4i: hdmi: Convert encoder to atomic
+    - drm/sun4i: hdmi: Move mode_set into enable
+    - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
+    - media: lgdt3306a: Add a check against null-pointer-def
+    - drm/amdgpu: add error handle to avoid out-of-bounds
+    - wifi: rtw89: correct aSIFSTime for 6GHz band
+    - ata: pata_legacy: make legacy_exit() work again
+    - fsverity: use register_sysctl_init() to avoid kmemleak warning
+    - proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission
+      operation
+    - platform/chrome: cros_ec: Handle events during suspend after resume
+      completion
+    - thermal/drivers/qcom/lmh: Check for SCM availability at probe
+    - soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request
+    - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
+    - arm64: tegra: Correct Tegra132 I2C alias
+    - arm64: dts: qcom: qcs404: fix bluetooth device address
+    - md/raid5: fix deadlock that raid5d() wait for itself to clear
+      MD_SB_CHANGE_PENDING
+    - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
+    - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
+    - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
+    - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
+    - arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP
+    - arm64: dts: hi3798cv200: fix the size of GICR
+    - arm64: dts: ti: verdin-am62: Set memory size to 2gb
+    - media: mc: Fix graph walk in media_pipeline_start
+    - media: mc: mark the media devnode as registered from the, start
+    - media: mxl5xx: Move xpt structures off stack
+    - media: v4l2-core: hold videodev_lock until dev reg, finishes
+    - media: v4l: async: Properly re-initialise notifier entry in unregister
+    - media: v4l: async: Don't set notifier's V4L2 device if registering fails
+    - media: v4l: async: Fix notifier list entry init
+    - mmc: core: Add mmc_gpiod_set_cd_config() function
+    - mmc: sdhci: Add support for "Tuning Error" interrupts
+    - mmc: sdhci-acpi: Sort DMI quirks alphabetically
+    - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working
+    - mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A
+    - mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect GPIO on Asus
+      T100TA
+    - drm/fbdev-generic: Do not set physical framebuffer address
+    - fbdev: savage: Handle err return when savagefb_check_var failed
+    - drm/amdgpu/atomfirmware: add intergrated info v2.3 table
+    - 9p: add missing locking around taking dentry fid list
+    - drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms
+    - Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices"
+    - KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
+    - KVM: arm64: Fix AArch32 register narrowing on userspace write
+    - KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
+    - KVM: arm64: AArch32: Fix spurious trapping of conditional instructions
+    - LoongArch: Add all CPUs enabled by fdt to NUMA node 0
+    - LoongArch: Override higher address bits in JUMP_VIRT_ADDR
+    - clk: bcm: dvp: Assign ->num before accessing ->hws
+    - clk: bcm: rpi: Assign ->num before accessing ->hws
+    - clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs
+    - crypto: ecdsa - Fix module auto-load on add-key
+    - crypto: ecrdsa - Fix module auto-load on add_key
+    - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
+    - kbuild: Remove support for Clang's ThinLTO caching
+    - mm: fix race between __split_huge_pmd_locked() and GUP-fast
+    - filemap: add helper mapping_max_folio_size()
+    - iomap: fault in smaller chunks for non-large folio mappings
+    - i2c: acpi: Unbind mux adapters before delete
+    - HID: i2c-hid: elan: fix reset suspend current leakage
+    - scsi: core: Handle devices which return an unusually large VPD page count
+    - net/ipv6: Fix route deleting failure when metric equals 0
+    - net/9p: fix uninit-value in p9_client_rpc()
+    - mm/ksm: fix ksm_pages_scanned accounting
+    - mm/ksm: fix ksm_zero_pages accounting
+    - kmsan: do not wipe out origin when doing partial unpoisoning
+    - tpm_tis: Do *not* flush uninitialized work
+    - intel_th: pci: Add Meteor Lake-S CPU support
+    - rtla/timerlat: Fix histogram report when a cpu count is 0
+    - sparc64: Fix number of online CPUs
+    - mm/cma: drop incorrect alignment check in cma_init_reserved_mem
+    - mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid
+    - mm: /proc/pid/smaps_rollup: avoid skipping vma after getting mmap_lock again
+    - mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL
+    - selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages
+    - selftests/mm: fix build warnings on ppc64
+    - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin
+    - bonding: fix oops during rmmod
+    - wifi: ath10k: fix QCOM_RPROC_COMMON dependency
+    - kdb: Fix buffer overflow during tab-complete
+    - kdb: Use format-strings rather than '\0' injection in kdb_read()
+    - kdb: Fix console handling when editing and tab-completing commands
+    - kdb: Merge identical case statements in kdb_read()
+    - kdb: Use format-specifiers rather than memset() for padding in kdb_read()
+    - sparc: move struct termio to asm/termios.h
+    - drm/amdkfd: handle duplicate BOs in reserve_bo_and_cond_vms
+    - ext4: Fixes len calculation in mpage_journal_page_buffers
+    - ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow
+    - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
+    - riscv: dts: starfive: Remove PMIC interrupt info for Visionfive 2 board
+    - ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
+    - ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
+    - ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
+    - parisc: Define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
+    - parisc: Define sigset_t in parisc uapi header
+    - s390/ap: Fix crash in AP internal function modify_bitmap()
+    - s390/cpacf: Split and rework cpacf query functions
+    - s390/cpacf: Make use of invalid opcode produce a link error
+    - i3c: master: svc: fix invalidate IBI type and miss call client IBI handler
+    - genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
+    - ASoC: SOF: ipc4-topology: Fix input format query of process modules without
+      base extension
+    - ALSA: ump: Don't clear bank selection after sending a program change
+    - ALSA: ump: Don't accept an invalid UMP protocol number
+    - EDAC/amd64: Convert PCIBIOS_* return codes to errnos
+    - EDAC/igen6: Convert PCIBIOS_* return codes to errnos
+    - nfs: fix undefined behavior in nfs_block_bits()
+    - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
+    - eventfs: Fix a possible null pointer dereference in eventfs_find_events()
+    - eventfs: Keep the directories from having the same inode number as files
+    - tracefs: Clear EVENT_INODE flag in tracefs_drop_inode()
+    - btrfs: fix crash on racing fsync and size-extending write into prealloc
+    - btrfs: fix leak of qgroup extent records after transaction abort
+    - ALSA: seq: Fix incorrect UMP type for system messages
+    - powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH
+    - smb: client: fix deadlock in smb2_find_smb_tcon()
+    - smp: Provide 'setup_max_cpus' definition on UP too
+    - drm/xe/bb: assert width in xe_bb_create_job()
+    - crypto: starfive - Do not free stack buffer
+    - btrfs: qgroup: fix initialization of auto inherit array
+    - wifi: rtl8xxxu: enable MFP support with security flag of RX descriptor
+    - media: mgb4: Fix double debugfs remove
+    - media: ov2740: Fix LINK_FREQ and PIXEL_RATE control value reporting
+    - firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails
+    - LoongArch: Fix built-in DTB detection
+    - LoongArch: Fix entry point in kernel image header
+    - clk: qcom: apss-ipq-pll: use stromer ops for IPQ5018 to fix boot failure
+    - net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED
+    - selftests: net: lib: support errexit with busywait
+    - selftests: net: lib: avoid error removing empty netns name
+    - cpufreq: amd-pstate: Fix the inconsistency in max frequency units
+    - mm/memory-failure: fix handling of dissolved but not taken off from buddy
+      pages
+    - selftests/mm: compaction_test: fix bogus test success on Aarch64
+    - irqchip/riscv-intc: Prevent memory leak when riscv_intc_init_common() fails
+    - Revert "perf record: Reduce memory for recording PERF_RECORD_LOST_SAMPLES
+      event"
+    - hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
+    - riscv: enable HAVE_ARCH_HUGE_VMAP for XIP kernel
+    - btrfs: qgroup: update rescan message levels and error codes
+    - btrfs: qgroup: fix qgroup id collision across mounts
+    - btrfs: cache folio size and shift in extent_buffer
+    - btrfs: protect folio::private when attaching extent buffer folios
+    - bpf: fix multi-uprobe PID filtering logic
+    - powerpc/64/bpf: fix tail calls for PCREL addressing
+    - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
+    - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
+    - Upstream stable to v6.6.34, v6.9.5
+  * Noble update: upstream stable patchset 2024-07-19 (LP: #2073603)
+    - perf record: Delete session after stopping sideband thread
+    - perf probe: Add missing libgen.h header needed for using basename()
+    - iio: core: Leave private pointer NULL when no private data supplied
+    - greybus: lights: check return of get_channel_from_mode
+    - phy: qcom: qmp-combo: fix duplicate return in qmp_v4_configure_dp_phy
+    - f2fs: multidev: fix to recognize valid zero block address
+    - f2fs: fix to wait on page writeback in __clone_blkaddrs()
+    - fpga: manager: add owner module and take its refcount
+    - fpga: bridge: add owner module and take its refcount
+    - counter: linux/counter.h: fix Excess kernel-doc description warning
+    - perf annotate: Get rid of duplicate --group option item
+    - usb: typec: ucsi: always register a link to USB PD device
+    - usb: typec: ucsi: simplify partner's PD caps registration
+    - perf stat: Do not fail on metrics on s390 z/VM systems
+    - soundwire: cadence: fix invalid PDI offset
+    - dmaengine: idma64: Add check for dma_set_max_seg_size
+    - firmware: dmi-id: add a release callback function
+    - perf annotate: Fix annotation_calc_lines() to pass correct address to
+      get_srcline()
+    - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
+    - serial: max3100: Update uart_driver_registered on driver removal
+    - serial: max3100: Fix bitwise types
+    - greybus: arche-ctrl: move device table to its right location
+    - PCI: tegra194: Fix probe path for Endpoint mode
+    - serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
+    - module: don't ignore sysfs_create_link() failures
+    - interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment
+    - arm64: dts: meson: fix S4 power-controller node
+    - perf tests: Make "test data symbol" more robust on Neoverse N1
+    - perf tests: Apply attributes to all events in object code reading test
+    - perf record: Fix debug message placement for test consumption
+    - dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties
+    - perf bench uprobe: Remove lib64 from libc.so.6 binary path
+    - f2fs: compress: fix to relocate check condition in
+      f2fs_{release,reserve}_compress_blocks()
+    - f2fs: compress: fix to relocate check condition in
+      f2fs_ioc_{,de}compress_file()
+    - f2fs: fix to relocate check condition in f2fs_fallocate()
+    - f2fs: fix to check pinfile flag in f2fs_move_file_range()
+    - iio: adc: stm32: Fixing err code to not indicate success
+    - riscv: dts: starfive: visionfive 2: Remove non-existing TDM hardware
+    - coresight: etm4x: Fix unbalanced pm_runtime_enable()
+    - perf docs: Document bpf event modifier
+    - perf test shell arm_coresight: Increase buffer size for Coresight basic
+      tests
+    - iio: pressure: dps310: support negative temperature values
+    - iio: buffer-dmaengine: export buffer alloc and free functions
+    - iio: add the IIO backend framework
+    - [CONFIG] Update CONFIG_IIO_BACKEND
+    - iio: adc: ad9467: convert to backend framework
+    - [Config] Update CONFIG_AD9467
+    - iio: adc: adi-axi-adc: move to backend framework
+    - [Config] Update CONFIG_ADI_AXI_ADC
+    - iio: adc: adi-axi-adc: only error out in major version mismatch
+    - coresight: etm4x: Do not hardcode IOMEM access for register restore
+    - coresight: etm4x: Do not save/restore Data trace control registers
+    - coresight: etm4x: Safe access for TRCQCLTR
+    - coresight: etm4x: Fix access to resource selector registers
+    - vfio/pci: fix potential memory leak in vfio_intx_enable()
+    - fpga: region: add owner module and take its refcount
+    - udf: Remove GFP_NOFS allocation in udf_expand_file_adinicb()
+    - udf: Convert udf_expand_file_adinicb() to use a folio
+    - microblaze: Remove gcc flag for non existing early_printk.c file
+    - microblaze: Remove early printk call from cpuinfo-static.c
+    - PCI: Wait for Link Training==0 before starting Link retrain
+    - perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer)
+    - leds: pwm: Disable PWM when going to suspend
+    - ovl: remove upper umask handling from ovl_create_upper()
+    - PCI: of_property: Return error for int_map allocation failure
+    - VMCI: Fix an error handling path in vmci_guest_probe_device()
+    - dt-bindings: pinctrl: mediatek: mt7622: fix array properties
+    - pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs
+    - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
+    - watchdog: bd9576: Drop "always-running" property
+    - watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe()
+    - dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains
+    - dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x
+    - dmaengine: idxd: Avoid unnecessary destruction of file_ida
+    - usb: gadget: u_audio: Fix race condition use of controls after free during
+      gadget unbind.
+    - usb: gadget: u_audio: Clear uac pointer when freed.
+    - stm class: Fix a double free in stm_register_device()
+    - ppdev: Add an error check in register_device
+    - i2c: cadence: Avoid fifo clear after start
+    - i2c: synquacer: Fix an error handling path in synquacer_i2c_probe()
+    - perf bench internals inject-build-id: Fix trap divide when collecting just
+      one DSO
+    - perf ui browser: Don't save pointer to stack memory
+    - extcon: max8997: select IRQ_DOMAIN instead of depending on it
+    - dt-bindings: spmi: hisilicon,hisi-spmi-controller: fix binding references
+    - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
+    - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
+    - f2fs: support printk_ratelimited() in f2fs_printk()
+    - f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC
+    - f2fs: separate f2fs_gc_range() to use GC for a range
+    - f2fs: kill heap-based allocation
+    - f2fs: support file pinning for zoned devices
+    - f2fs: fix block migration when section is not aligned to pow2
+    - perf ui browser: Avoid SEGV on title
+    - perf report: Avoid SEGV in report__setup_sample_type()
+    - perf thread: Fixes to thread__new() related to initializing comm
+    - perf symbols: Fix ownership of string in dso__load_vmlinux()
+    - f2fs: compress: fix to update i_compr_blocks correctly
+    - f2fs: deprecate io_bits
+    - f2fs: introduce get_available_block_count() for cleanup
+    - f2fs: compress: fix error path of inc_valid_block_count()
+    - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem
+      lock
+    - f2fs: fix to release node block count in error path of f2fs_new_node_page()
+    - f2fs: compress: don't allow unaligned truncation on released compress inode
+    - serial: sh-sci: protect invalidating RXDMA on shutdown
+    - libsubcmd: Fix parse-options memory leak
+    - perf daemon: Fix file leak in daemon_session__control
+    - f2fs: fix to add missing iput() in gc_data_segment()
+    - usb: fotg210: Add missing kernel doc description
+    - perf stat: Don't display metric header for non-leader uncore events
+    - perf tools: Use pmus to describe type from attribute
+    - perf tools: Add/use PMU reverse lookup from config to name
+    - perf pmu: Assume sysfs events are always the same case
+    - perf pmu: Count sys and cpuid JSON events separately
+    - LoongArch: Fix callchain parse error with kernel tracepoint events again
+    - s390/vdso64: filter out munaligned-symbols flag for vdso
+    - s390/vdso: Generate unwind information for C modules
+    - s390/vdso: Create .build-id links for unstripped vdso files
+    - s390/vdso: Use standard stack frame layout
+    - s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
+    - s390/ipl: Fix incorrect initialization of nvme dump block
+    - s390/boot: Remove alt_stfle_fac_list from decompressor
+    - dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios
+    - gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node
+      match
+    - eventfs: Do not differentiate the toplevel events directory
+    - eventfs: Create eventfs_root_inode to store dentry
+    - eventfs/tracing: Add callback for release of an eventfs_inode
+    - eventfs: Free all of the eventfs_inode after RCU
+    - eventfs: Have "events" directory get permissions from its parent
+    - dt-bindings: adc: axi-adc: update bindings for backend framework
+    - dt-bindings: adc: axi-adc: add clocks property
+    - Input: ims-pcu - fix printf string overflow
+    - mmc: sdhci_am654: Add tuning algorithm for delay chain
+    - mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
+    - mmc: sdhci_am654: Add OTAP/ITAP delay enable
+    - mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
+    - mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
+    - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
+    - media: v4l: Don't turn on privacy LED if streamon fails
+    - media: ov2680: Clear the 'ret' variable on success
+    - media: ov2680: Allow probing if link-frequencies is absent
+    - media: ov2680: Do not fail if data-lanes property is absent
+    - drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk
+    - drm/msm/dpu: Always flush the slave INTF on the CTL
+    - drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
+    - drm/meson: gate px_clk when setting rate
+    - um: Fix return value in ubd_init()
+    - um: vector: fix bpfflash parameter evaluation
+    - fs/ntfs3: Check 'folio' pointer for NULL
+    - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
+    - fs/ntfs3: Use variable length array instead of fixed size
+    - drm/msm/dpu: Add callback function pointer check before its call
+    - drm/bridge: tc358775: fix support for jeida-18 and jeida-24
+    - media: stk1160: fix bounds checking in stk1160_copy_video()
+    - Input: cyapa - add missing input core locking to suspend/resume functions
+    - drm/amdgpu: init microcode chip name from ip versions
+    - drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and
+      rlc_microcode()
+    - media: mediatek: vcodec: fix possible unbalanced PM counter
+    - tools/arch/x86/intel_sdsi: Fix maximum meter bundle length
+    - tools/arch/x86/intel_sdsi: Fix meter_show display
+    - tools/arch/x86/intel_sdsi: Fix meter_certificate decoding
+    - platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit()
+    - media: flexcop-usb: fix sanity check of bNumEndpoints
+    - powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
+    - um: Fix the -Wmissing-prototypes warning for __switch_mm
+    - um: Fix the -Wmissing-prototypes warning for get_thread_reg
+    - um: Fix the declaration of kasan_map_memory
+    - cxl/trace: Correct DPA field masks for general_media & dram events
+    - cxl/region: Fix cxlr_pmem leaks
+    - media: sunxi: a83-mips-csi2: also select GENERIC_PHY
+    - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
+    - media: cec: cec-api: add locking in cec_release()
+    - media: cec: core: avoid recursive cec_claim_log_addrs
+    - media: cec: core: avoid confusing "transmit timed out" message
+    - Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
+    - drm: zynqmp_dpsub: Always register bridge
+    - selftests/powerpc/dexcr: Add -no-pie to hashchk tests
+    - drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
+    - ASoC: tas2781: Fix a warning reported by robot kernel test
+    - null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
+    - ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
+    - ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance
+    - ASoC: mediatek: mt8192: fix register configuration for tdm
+    - drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations
+    - blk-cgroup: fix list corruption from resetting io stat
+    - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
+    - blk-cgroup: Properly propagate the iostat update up the hierarchy
+    - regulator: bd71828: Don't overwrite runtime voltages
+    - xen/x86: add extra pages to unpopulated-alloc if available
+    - perf/arm-dmc620: Fix lockdep assert in ->event_init()
+    - x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when
+      UNWINDER_FRAME_POINTER=y
+    - [Config] Update CONFIG_ARCH_WANT_FRAME_POINTERS
+    - net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
+    - ipv6: sr: fix missing sk_buff release in seg6_input_core
+    - selftests: net: kill smcrouted in the cleanup logic in amt.sh
+    - nfc: nci: Fix uninit-value in nci_rx_work
+    - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
+    - ASoC: tas2781: Fix wrong loading calibrated data sequence
+    - NFSv4: Fixup smatch warning for ambiguous return
+    - nfs: keep server info for remounts
+    - sunrpc: fix NFSACL RPC retry on soft mount
+    - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
+    - regulator: pickable ranges: don't always cache vsel
+    - regulator: tps6287x: Force writing VSEL bit
+    - af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
+    - ipv6: sr: fix memleak in seg6_hmac_init_algo
+    - regulator: tps6594-regulator: Correct multi-phase configuration
+    - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
+    - pNFS/filelayout: fixup pNfs allocation modes
+    - openvswitch: Set the skbuff pkt_type for proper pmtud support.
+    - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
+    - rv: Update rv_en(dis)able_monitor doc to match kernel-doc
+    - net: lan966x: Remove ptp traps in case the ptp is not enabled.
+    - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
+    - i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame
+    - Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI"
+    - net: fec: avoid lock evasion when reading pps_enable
+    - tls: fix missing memory barrier in tls_init
+    - net: relax socket state check at accept time.
+    - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
+    - drivers/xen: Improve the late XenStore init protocol
+    - ice: Interpret .set_channels() input differently
+    - kasan, fortify: properly rename memintrinsics
+    - tracing/probes: fix error check in parse_btf_field()
+    - tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
+    - netfilter: nfnetlink_queue: acquire rcu_read_lock() in
+      instance_destroy_rcu()
+    - netfilter: ipset: Add list flush to cancel_gc
+    - netfilter: nft_payload: restore vlan q-in-q match support
+    - spi: Don't mark message DMA mapped when no transfer in it is
+    - dma-mapping: benchmark: fix up kthread-related error handling
+    - dma-mapping: benchmark: fix node id validation
+    - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
+    - nvme-multipath: fix io accounting on failover
+    - nvmet: fix ns enable/disable possible hang
+    - drm/amd/display: Enable colorspace property for MST connectors
+    - net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061
+    - net/mlx5: Lag, do bond only if slaves agree on roce state
+    - net/mlx5: Fix MTMP register capability offset in MCAM register
+    - net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules
+    - net/mlx5e: Fix IPsec tunnel mode offload feature check
+    - net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer
+      exhaustion
+    - net/mlx5e: Fix UDP GSO for encapsulated packets
+    - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
+    - bpf: Fix potential integer overflow in resolve_btfids
+    - ALSA: jack: Use guard() for locking
+    - ALSA: core: Remove debugfs at disconnection
+    - ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
+    - enic: Validate length of nl attributes in enic_set_vf_port
+    - af_unix: Annotate data-race around unix_sk(sk)->addr.
+    - af_unix: Read sk->sk_hash under bindlock during bind().
+    - Octeontx2-pf: Free send queue buffers incase of leaf to inner
+    - net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
+    - ASoC: cs42l43: Only restrict 44.1kHz for the ASP
+    - bpf: Allow delete from sockmap/sockhash only if update is allowed
+    - net:fec: Add fec_enet_deinit()
+    - net: micrel: Fix lan8841_config_intr after getting out of sleep mode
+    - ice: fix accounting if a VLAN already exists
+    - selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky
+    - selftests: mptcp: add ms units for tc-netem delay
+    - selftests: mptcp: join: mark 'fail' tests as flaky
+    - ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion
+    - ALSA: seq: Don't clear bank selection at event -> UMP MIDI2 conversion
+    - net: ti: icssg-prueth: Fix start counter for ft1 filter
+    - netfilter: nft_payload: skbuff vlan metadata mangle support
+    - netfilter: tproxy: bail out if IP has been disabled on the device
+    - netfilter: nft_fib: allow from forward/input without iif selector
+    - net/sched: taprio: make q->picos_per_byte available to fill_sched_entry()
+    - net/sched: taprio: extend minimum interval restriction to entire cycle too
+    - kconfig: fix comparison to constant symbols, 'm', 'n'
+    - drm/i915/guc: avoid FIELD_PREP warning
+    - kheaders: use `command -v` to test for existence of `cpio`
+    - spi: stm32: Don't warn about spurious interrupts
+    - net: dsa: microchip: fix RGMII error in KSZ DSA driver
+    - net: ena: Reduce lines with longer column width boundary
+    - net: ena: Fix redundant device NUMA node override
+    - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
+    - ALSA: seq: Fix yet another spot for system message conversion
+    - powerpc/pseries/lparcfg: drop error message from guest name lookup
+    - drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel
+    - drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel
+    - drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel
+    - hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor
+    - hwmon: (shtc1) Fix property misspelling
+    - ALSA: seq: ump: Fix swapped song position pointer data
+    - ALSA: timer: Set lower bound of start tick time
+    - x86/efistub: Omit physical KASLR when memory reservations exist
+    - efi: libstub: only free priv.runtime_map when allocated
+    - x86/pci: Skip early E820 check for ECAM region
+    - KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID
+    - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
+    - platform/x86/intel/tpmi: Handle error from tpmi_process_info()
+    - platform/x86/intel-uncore-freq: Don't present root domain on error
+    - perf sched timehist: Fix -g/--call-graph option failure
+    - f2fs: write missing last sum blk of file pinning section
+    - f2fs: use f2fs_{err,info}_ratelimited() for cleanup
+    - SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
+    - riscv: prevent pt_regs corruption for secondary idle threads
+    - riscv: stacktrace: fixed walk_stackframe()
+    - perf build: Fix out of tree build related to installation of sysreg-defs
+    - dt-bindings: pinctrl: qcom: update functions to match with driver
+    - usb: typec: ucsi: allow non-partner GET_PDOS for Qualcomm devices
+    - perf report: Fix PAI counter names for s390 virtual machines
+    - PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host
+    - perf map: Remove kernel map before updating start and end addresses
+    - riscv: dts: starfive: visionfive 2: Remove non-existing I2S hardware
+    - pinctrl: renesas: rzg2l: Limit 2.5V power supply to Ethernet interfaces
+    - riscv: Flush the instruction cache during SMP bringup
+    - usb: xhci: check if 'requested segments' exceeds ERST capacity
+    - spmi: pmic-arb: Replace three IS_ERR() calls by null pointer checks in
+      spmi_pmic_arb_probe()
+    - perf symbols: Remove map from list before updating addresses
+    - perf symbols: Update kcore map before merging in remaining symbols
+    - s390/ftrace: Use unwinder instead of __builtin_return_address()
+    - s390/stacktrace: Merge perf_callchain_user() and arch_stack_walk_user()
+    - s390/stacktrace: Skip first user stack frame
+    - s390/stacktrace: Improve detection of invalid instruction pointers
+    - s390/vdso: Introduce and use struct stack_frame_vdso_wrapper
+    - s390/stackstrace: Detect vdso stack frames
+    - s390/ap: Fix bind complete udev event sent after each AP bus scan
+    - ocfs2: correctly use ocfs2_find_next_zero_bit()
+    - mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown
+    - Input: ioc3kbd - add device table
+    - phy: qcom: qmp-combo: fix sm8650 voltage swing table
+    - media: ti: j721e-csi2rx: Fix races while restarting DMA
+    - drm/msm/dpu: Allow configuring multiple active DSC blocks
+    - drm: Make drivers depends on DRM_DW_HDMI
+    - [Config] Drivers now depend on DRM_DW_HDMI
+    - string: Prepare to merge strscpy_kunit.c into string_kunit.c
+    - string: Prepare to merge strcat KUnit tests into string_kunit.c
+    - drm/msm/adreno: fix CP cycles stat retrieval on a7xx
+    - printk: Fix LOG_CPU_MAX_BUF_SHIFT when BASE_SMALL is enabled
+    - powerpc/bpf/32: Fix failing test_bpf tests
+    - KVM: PPC: Book3S HV nestedv2: Cancel pending DEC exception
+    - KVM: PPC: Book3S HV nestedv2: Fix an error handling path in
+      gs_msg_ops_kvmhv_nestedv2_config_fill_info()
+    - KVM: arm64: Destroy mpidr_data for 'late' vCPU creation
+    - Bluetooth: ISO: Handle PA sync when no BIGInfo reports are generated
+    - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
+    - ubsan: Restore dependency on ARCH_HAS_UBSAN
+    - selftests: forwarding: Have RET track kselftest framework constants
+    - selftests: forwarding: Convert log_test() to recognize RET values
+    - selftests: net: Unify code of busywait() and slowwait()
+    - selftests/net: use tc rule to filter the na packet
+    - virtio_balloon: Give the balloon its own wakeup source
+    - riscv: cpufeature: Fix thead vector hwcap removal
+    - riscv: cpufeature: Fix extension subset checking
+    - riscv: selftests: Add hwprobe binaries to .gitignore
+    - idpf: Interpret .set_channels() input differently
+    - null_blk: fix null-ptr-dereference while configuring 'power' and
+      'submit_queues'
+    - netfs: Fix setting of BDP_ASYNC from iocb flags
+    - cifs: Set zero_point in the copy_file_range() and remap_file_range()
+    - cifs: Fix missing set of remote_i_size
+    - selftests: net: lib: set 'i' as local
+    - nvme: fix multipath batched completion accounting
+    - netkit: Fix setting mac address in l2 mode
+    - netkit: Fix pkt_type override upon netkit pass verdict
+    - null_blk: Fix return value of nullb_device_power_store()
+    - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers
+    - selftests: mptcp: join: mark 'fastclose' tests as flaky
+    - drm/xe: Add dbg messages on the suspend resume functions.
+    - drm/xe: check pcode init status only on root gt of root tile
+    - drm/xe: Change pcode timeout to 50msec while polling again
+    - drm/xe: Only use reserved BCS instances for usm migrate exec queue
+    - sd: also set max_user_sectors when setting max_sectors
+    - block: stack max_user_sectors
+    - ipv6: introduce dst_rt6_info() helper
+    - inet: introduce dst_rtable() helper
+    - net: fix __dst_negative_advice() race
+    - ice: fix 200G PHY types to link speed mapping
+    - x86/topology/intel: Unlock CPUID before evaluating anything
+    - Upstream stable to v6.6.33, v6.9.4
+  * Reenable CONFIG_UBSAN for noble (LP: #2076650)
+    - ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL
+    - [Config] Remove CONFIG_UBSAN_SANITIZE_ALL
+  * Dangling symlink to linux-lib-rust when Rust is disabled (LP: #2072592)
+    - [Packaging] Check do_lib_rust before linking Rust lib files
+  * kdump doesn't work with UEFI secure boot and kernel lockdown enabled on
+    ARM64 (LP: #2033007)
+    - [Config]: Enable CONFIG_KEXEC_IMAGE_VERIFY_SIG on arm64
+  * net/sched: Fix conntrack use-after-free (LP: #2073092)
+    - net/sched: Fix UAF when resolving a clash
+  * No sound on Huawei Matebook D14  AMD since Linux 6.8.0-38 [regression]
+    (LP: #2073049)
+    - ASoC: amd: acp: fix for acp platform device creation failure
+  * i915: Fixup regressions introduced with enabling single CCS engine
+    (LP: #2072755)
+    - drm/i915/gt: Fix CCS id's calculation for CCS mode setting
+  * [Ubuntu 24.04] FW1060.00 (NH1060_026) sosreport is running to Kernel OOPS
+    crash (LP: #2070358)
+    - nfsd: initialise nfsd_info.mutex early.
+  * 6.8 generic & amdpgu / polaris (LP: #2072428)
+    - drm/amdgpu: Adjust logic in amdgpu_device_partner_bandwidth()
+  * md: nvme over tcp with a striped underlying md raid device leads to data
+    corruption (LP: #2075110)
+    - md/md-bitmap: fix writing non bitmap pages
+  * Linux 6.8 fails to boot on ARM64 if any param is more than 146 chars
+    (LP: #2069534)
+    - SAUCE: arm64: v6.8: cmdline param >= 146 chars kills kernel
+  * CVE-2024-39484
+    - mmc: davinci: Don't strip remove function when driver is builtin
+  * CVE-2024-39292
+    - um: Add winch to winch_handlers before registering winch IRQ
+  * Miscellaneous upstream changes
+    - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 18 Sep 2024 21:04:33 +0900
+
+linux-qcom (6.8.0-1009.9) jammy; urgency=medium
+
+  * [RB3] Kernel call trace while inserting storage to type-c USB port
+    - SAUCE: usb3: dwc3-qcom: Fix calltrace for USB host mode
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 02 Sep 2024 10:37:50 +0900
+
+linux-qcom (6.8.0-1008.8) jammy; urgency=medium
+
+  * [RB3] drm sde error/ msm-dsi-error found in dmesg
+    - SAUCE: do not show error on EPROBE_DEFER
+
+  * [RB3] slim-ngd-ctrl error found in dmesg
+    - SAUCE: dma: qcom: bam_dma: set DMA_PRIVATE
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: generate combined-dtb.dtb at compile time
+    - SAUCE: rename qcom,phy-rst-gpio to qcom,phy-rst-gpio-id
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 21 Aug 2024 03:11:39 +0900
+
+linux-qcom (6.8.0-1007.7) jammy; urgency=medium
+
+  * [RB3] gpi 900000.dma-controller error found in dmesg
+    - dmaengine: qcom: gpi: set DMA_PRIVATE flag
+
+  * [RB3] btfm_slime error message found in dmesg
+    - SAUCE: ubuntu/qcom: fix bogus error message
+
+  * [RB3] Bluetooth device is not detected
+    - SAUCE: Set local-bd-address to fix bluetooth detection
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: ubuntu/qcom/video: import video driver from GA 1.1
+    - SAUCE: ubuntu/qcom/touch: import touch driver from GA 1.1
+    - SAUCE: ubuntu/qcom/video: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/touch: replace strlcpy() with strscpy()
+    - SAUCE: build video and touch external drivers
+
+  [ Ubuntu: 6.8.0-40.40 ]
+
+  * noble/linux: 6.8.0-40.40 -proposed tracker (LP: #2072201)
+  * FPS of glxgear with fullscreen is too low on MTL platform (LP: #2069380)
+    - drm/i915: Bypass LMEMBAR/GTTMMADR for MTL stolen memory access
+  * a critical typo in the code managing the ASPM  settings for PCI Express
+    devices (LP: #2071889)
+    - PCI/ASPM: Restore parent state to parent, child state to child
+  * [UBUNTU 24.04] IOMMU DMA mode changed in kernel config causes massive
+    throughput degradation for PCI-related network workloads (LP: #2071471)
+    - [Config] Set IOMMU_DEFAULT_DMA_STRICT=n and IOMMU_DEFAULT_DMA_LAZY=yes for
+      s390x
+  * UBSAN: array-index-out-of-bounds in
+    /build/linux-D15vQj/linux-6.5.0/drivers/md/bcache/bset.c:1098:3
+    (LP: #2039368)
+    - bcache: fix variable length array abuse in btree_iter
+  * Mute/mic LEDs and speaker no function on EliteBook 645/665 G11
+    (LP: #2071296)
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665
+      G11.
+  * failed to enable IPU6 camera sensor on kernel >= 6.8: ivsc_ace
+    intel_vsc-5db76cf6-0a68-4ed6-9b78-0361635e2447: switch camera to host
+    failed: -110 (LP: #2067364)
+    - mei: vsc: Don't stop/restart mei device during system suspend/resume
+    - SAUCE: media: ivsc: csi: don't count privacy on as error
+    - SAUCE: media: ivsc: csi: add separate lock for v4l2 control handler
+    - SAUCE: media: ivsc: csi: remove privacy status in struct mei_csi
+    - SAUCE: mei: vsc: Enhance IVSC chipset stability during warm reboot
+    - SAUCE: mei: vsc: Enhance SPI transfer of IVSC rom
+    - SAUCE: mei: vsc: Utilize the appropriate byte order swap function
+    - SAUCE: mei: vsc: Prevent timeout error with added delay post-firmware
+      download
+  * failed to probe camera sensor on Dell XPS 9315: ov01a10 i2c-OVTI01A0:00:
+    failed to check hwcfg: -22 (LP: #2070251)
+    - ACPI: utils: Make acpi_handle_path() not static
+    - ACPI: property: Ignore bad graph port nodes on Dell XPS 9315
+    - ACPI: property: Polish ignoring bad data nodes
+    - ACPI: scan: Ignore camera graph port nodes on all Dell Tiger, Alder and
+      Raptor Lake models
+  * Update amd_sfh for AMD strix series (LP: #2058331)
+    - HID: amd_sfh: Increase sensor command timeout
+    - HID: amd_sfh: Improve boot time when SFH is available
+    - HID: amd_sfh: Extend MP2 register access to SFH
+    - HID: amd_sfh: Set the AMD SFH driver to depend on x86
+  * RFIM and SAGV Linux Support for G10 models (LP: #2070158)
+    - drm/i915/display: Add meaningful traces for QGV point info error handling
+    - drm/i915/display: Extract code required to calculate max qgv/psf gv point
+    - drm/i915/display: extract code to prepare qgv points mask
+    - drm/i915/display: Disable SAGV on bw init, to force QGV point recalculation
+    - drm/i915/display: handle systems with duplicate psf gv points
+    - drm/i915/display: force qgv check after the hw state readout
+  * Update amd-pmf for AMD strix series (LP: #2058330)
+    - platform/x86/amd/pmf: Differentiate PMF ACPI versions
+    - platform/x86/amd/pmf: Disable debugfs support for querying power thermals
+    - platform/x86/amd/pmf: Add support to get sbios requests in PMF driver
+    - platform/x86/amd/pmf: Add support to notify sbios heart beat event
+    - platform/x86/amd/pmf: Add support to get APTS index numbers for static
+      slider
+    - platform/x86/amd/pmf: Add support to get sps default APTS index values
+    - platform/x86/amd/pmf: Update sps power thermals according to the platform-
+      profiles
+  * noble:linux: ADT ubuntu-regression-suite misses fakeroot dependency
+    (LP: #2070042)
+    - [DEP-8] Add missing fakeroot dependency
+  * Noble update: v6.8.12 upstream stable release (LP: #2071621)
+    - sunrpc: use the struct net as the svc proc private
+    - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
+    - selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly
+    - ftrace: Fix possible use-after-free issue in ftrace_location()
+    - Revert "arm64: fpsimd: Implement lazy restore for kernel mode FPSIMD"
+    - arm64/fpsimd: Avoid erroneous elide of user state reload
+    - Reapply "arm64: fpsimd: Implement lazy restore for kernel mode FPSIMD"
+    - tty: n_gsm: fix missing receive state reset after mode switch
+    - speakup: Fix sizeof() vs ARRAY_SIZE() bug
+    - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
+    - serial: 8250_bcm7271: use default_mux_rate if possible
+    - serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
+    - Input: try trimming too long modalias strings
+    - io_uring: fail NOP if non-zero op flags is passed in
+    - Revert "r8169: don't try to disable interrupts if NAPI is, scheduled
+      already"
+    - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
+    - ring-buffer: Fix a race between readers and resize checks
+    - net: mana: Fix the extra HZ in mana_hwc_send_request
+    - tools/latency-collector: Fix -Wformat-security compile warns
+    - tools/nolibc/stdlib: fix memory error in realloc()
+    - net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()
+    - net: lan966x: remove debugfs directory in probe() error path
+    - net: smc91x: Fix m68k kernel compilation for ColdFire CPU
+    - nilfs2: fix use-after-free of timer for log writer thread
+    - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
+    - nilfs2: fix potential hang in nilfs_detach_log_writer()
+    - fs/ntfs3: Remove max link count info display during driver init
+    - fs/ntfs3: Taking DOS names into account during link counting
+    - fs/ntfs3: Fix case when index is reused during tree transformation
+    - fs/ntfs3: Break dir enumeration if directory contents error
+    - ksmbd: avoid to send duplicate oplock break notifications
+    - ksmbd: ignore trailing slashes in share paths
+    - ALSA: core: Fix NULL module pointer assignment at card init
+    - ALSA: Fix deadlocks with kctl removals at disconnection
+    - KEYS: asymmetric: Add missing dependency on CRYPTO_SIG
+    - [Config] updateconfigs for CRYPTO_SIG
+    - KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST
+    - HID: nintendo: Fix N64 controller being identified as mouse
+    - dmaengine: xilinx: xdma: Clarify kdoc in XDMA driver
+    - wifi: mac80211: don't use rate mask for scanning
+    - wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon
+      timestamp field
+    - wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt
+      class
+    - dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
+    - HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled
+    - net: usb: qmi_wwan: add Telit FN920C04 compositions
+    - drm/amd/display: Set color_mgmt_changed to true on unsuspend
+    - drm/amdgpu: Update BO eviction priorities
+    - drm/amd/pm: Restore config space after reset
+    - drm/amdkfd: Add VRAM accounting for SVM migration
+    - drm/amdgpu: Fix the ring buffer size for queue VM flush
+    - Revert "net: txgbe: fix i2c dev name cannot match clkdev"
+    - Revert "net: txgbe: fix clk_name exceed MAX_DEV_ID limits"
+    - cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n
+    - LoongArch: Lately init pmu after smp is online
+    - drm/etnaviv: fix tx clock gating on some GC7000 variants
+    - selftests: sud_test: return correct emulated syscall value on RISC-V
+    - riscv: thead: Rename T-Head PBMT to MAE
+    - [Config] updateconfigs for ERRATA_THEAD_MAE
+    - riscv: T-Head: Test availability bit before enabling MAE errata
+    - sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU
+    - ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too
+    - regulator: irq_helpers: duplicate IRQ name
+    - ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot()
+    - ASoC: SOF: ipc4-pcm: Use consistent name for snd_sof_pcm_stream pointer
+    - ASoC: SOF: ipc4-pcm: Use consistent name for sof_ipc4_timestamp_info pointer
+    - ASoC: SOF: ipc4-pcm: Introduce generic sof_ipc4_pcm_stream_priv
+    - ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3
+    - ASoC: acp: Support microphone from device Acer 315-24p
+    - ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
+    - ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
+    - ASoC: rt722-sdca: modify channel number to support 4 channels
+    - ASoC: rt722-sdca: add headset microphone vrefo setting
+    - regulator: qcom-refgen: fix module autoloading
+    - regulator: vqmmc-ipq4019: fix module autoloading
+    - ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config
+    - ASoC: rt715: add vendor clear control register
+    - ASoC: rt715-sdca: volume step modification
+    - KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF
+    - Input: xpad - add support for ASUS ROG RAIKIRI
+    - btrfs: take the cleaner_mutex earlier in qgroup disable
+    - EDAC/versal: Do not register for NOC errors
+    - fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
+    - bpf, x86: Fix PROBE_MEM runtime load check
+    - ALSA: emu10k1: make E-MU FPGA writes potentially more reliable
+    - softirq: Fix suspicious RCU usage in __do_softirq()
+    - platform/x86: ISST: Add Grand Ridge to HPM CPU list
+    - ASoC: da7219-aad: fix usage of device_get_named_child_node()
+    - ASoC: cs35l56: fix usages of device_get_named_child_node()
+    - ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection
+    - Input: amimouse - mark driver struct with __refdata to prevent section
+      mismatch
+    - drm/amdgpu: Fix VRAM memory accounting
+    - drm/amd/display: Ensure that dmcub support flag is set for DCN20
+    - drm/amd/display: Add dtbclk access to dcn315
+    - drm/amd/display: Allocate zero bw after bw alloc enable
+    - drm/amd/display: Add VCO speed parameter for DCN31 FPU
+    - drm/amd/display: Fix DC mode screen flickering on DCN321
+    - drm/amd/display: Disable seamless boot on 128b/132b encoding
+    - drm/amdkfd: Flush the process wq before creating a kfd_process
+    - x86/mm: Remove broken vsyscall emulation code from the page fault code
+    - nvme: find numa distance only if controller has valid numa id
+    - nvmet-auth: return the error code to the nvmet_auth_host_hash() callers
+    - nvmet-auth: replace pr_debug() with pr_err() to report an error.
+    - nvme: cancel pending I/O if nvme controller is in terminal state
+    - nvmet-tcp: fix possible memory leak when tearing down a controller
+    - nvmet: fix nvme status code when namespace is disabled
+    - nvme-tcp: strict pdu pacing to avoid send stalls on TLS
+    - epoll: be better about file lifetimes
+    - nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
+    - openpromfs: finish conversion to the new mount API
+    - crypto: bcm - Fix pointer arithmetic
+    - firmware: qcom: qcm: fix unused qcom_scm_qseecom_allowlist
+    - mm/slub, kunit: Use inverted data to corrupt kmem cache
+    - firmware: raspberrypi: Use correct device for DMA mappings
+    - ecryptfs: Fix buffer size for tag 66 packet
+    - nilfs2: fix out-of-range warning
+    - parisc: add missing export of __cmpxchg_u8()
+    - crypto: ccp - drop platform ifdef checks
+    - crypto: x86/nh-avx2 - add missing vzeroupper
+    - crypto: x86/sha256-avx2 - add missing vzeroupper
+    - crypto: x86/sha512-avx2 - add missing vzeroupper
+    - s390/cio: fix tracepoint subchannel type field
+    - io_uring: use the right type for work_llist empty check
+    - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
+    - rcu: Fix buffer overflow in print_cpu_stall_info()
+    - ARM: configs: sunxi: Enable DRM_DW_HDMI
+    - jffs2: prevent xattr node from overflowing the eraseblock
+    - libfs: Re-arrange locking in offset_iterate_dir()
+    - libfs: Define a minimum directory offset
+    - libfs: Add simple_offset_empty()
+    - maple_tree: Add mtree_alloc_cyclic()
+    - libfs: Convert simple directory offsets to use a Maple Tree
+    - libfs: Fix simple_offset_rename_exchange()
+    - libfs: Add simple_offset_rename() API
+    - shmem: Fix shmem_rename2()
+    - io-wq: write next_work before dropping acct_lock
+    - mm/userfaultfd: Do not place zeropages when zeropages are disallowed
+    - s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests
+    - crypto: octeontx2 - add missing check for dma_map_single
+    - crypto: qat - improve error message in adf_get_arbiter_mapping()
+    - crypto: qat - improve error logging to be consistent across features
+    - soc: qcom: pmic_glink: don't traverse clients list without a lock
+    - soc: qcom: pmic_glink: notify clients about the current state
+    - firmware: qcom: scm: Fix __scm and waitq completion variable initialization
+    - soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
+    - null_blk: Fix missing mutex_destroy() at module removal
+    - crypto: qat - validate slices count returned by FW
+    - hwrng: stm32 - use logical OR in conditional
+    - hwrng: stm32 - put IP into RPM suspend on failure
+    - hwrng: stm32 - repair clock handling
+    - kunit/fortify: Fix mismatched kvalloc()/vfree() usage
+    - io_uring/net: remove dependency on REQ_F_PARTIAL_IO for sr->done_io
+    - io_uring/net: fix sendzc lazy wake polling
+    - soc: qcom: pmic_glink: Make client-lock non-sleeping
+    - lkdtm: Disable CFI checking for perms functions
+    - md: fix resync softlockup when bitmap size is less than array size
+    - crypto: qat - specify firmware files for 402xx
+    - block: refine the EOF check in blkdev_iomap_begin
+    - block: fix and simplify blkdevparts= cmdline parsing
+    - block: support to account io_ticks precisely
+    - wifi: ath10k: poll service ready message before failing
+    - wifi: brcmfmac: pcie: handle randbuf allocation failure
+    - wifi: ath11k: don't force enable power save on non-running vdevs
+    - bpftool: Fix missing pids during link show
+    - libbpf: Prevent null-pointer dereference when prog to load has no BTF
+    - wifi: ath12k: use correct flag field for 320 MHz channels
+    - wifi: mt76: mt7915: workaround too long expansion sparse warnings
+    - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
+    - wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok()
+    - wifi: iwlwifi: mvm: Do not warn on invalid link on scan complete
+    - wifi: iwlwifi: mvm: allocate STA links only for active links
+    - wifi: mac80211: don't select link ID if not provided in scan request
+    - wifi: iwlwifi: implement can_activate_links callback
+    - wifi: iwlwifi: mvm: fix active link counting during recovery
+    - wifi: iwlwifi: mvm: select STA mask only for active links
+    - wifi: iwlwifi: reconfigure TLC during HW restart
+    - wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask
+    - sched/fair: Add EAS checks before updating root_domain::overutilized
+    - ACPI: bus: Indicate support for _TFP thru _OSC
+    - ACPI: bus: Indicate support for more than 16 p-states thru _OSC
+    - ACPI: bus: Indicate support for the Generic Event Device thru _OSC
+    - ACPI: Fix Generic Initiator Affinity _OSC bit
+    - ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC
+    - enetc: avoid truncating error message
+    - qed: avoid truncating work queue length
+    - mlx5: avoid truncating error message
+    - mlx5: stop warning for 64KB pages
+    - bitops: add missing prototype check
+    - dlm: fix user space lock decision to copy lvb
+    - wifi: carl9170: re-fix fortified-memset warning
+    - bpftool: Mount bpffs on provided dir instead of parent dir
+    - bpf: Pack struct bpf_fib_lookup
+    - bpf: prevent r10 register from being marked as precise
+    - x86/microcode/AMD: Avoid -Wformat warning with clang-15
+    - scsi: ufs: qcom: Perform read back after writing reset bit
+    - scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
+    - scsi: ufs: qcom: Perform read back after writing unipro mode
+    - scsi: ufs: qcom: Perform read back after writing CGC enable
+    - scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
+    - scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H
+    - scsi: ufs: core: Perform read back after disabling interrupts
+    - scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
+    - ACPI: LPSS: Advertise number of chip selects via property
+    - EDAC/skx_common: Allow decoding of SGX addresses
+    - locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128()
+    - irqchip/alpine-msi: Fix off-by-one in allocation error path
+    - irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
+    - ACPI: disable -Wstringop-truncation
+    - gfs2: Don't forget to complete delayed withdraw
+    - gfs2: Fix "ignore unlock failures after withdraw"
+    - arm64: Remove unnecessary irqflags alternative.h include
+    - x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57
+    - selftests/bpf: Fix umount cgroup2 error in test_sockmap
+    - tcp: increase the default TCP scaling ratio
+    - cpufreq: exit() callback is optional
+    - x86/pat: Introduce lookup_address_in_pgd_attr()
+    - x86/pat: Restructure _lookup_address_cpa()
+    - x86/pat: Fix W^X violation false-positives when running as Xen PV guest
+    - udp: Avoid call to compute_score on multiple sites
+    - openrisc: traps: Don't send signals to kernel mode threads
+    - cppc_cpufreq: Fix possible null pointer dereference
+    - wifi: iwlwifi: mvm: init vif works only once
+    - scsi: libsas: Fix the failure of adding phy with zero-address to port
+    - scsi: hpsa: Fix allocation size for Scsi_Host private data
+    - x86/purgatory: Switch to the position-independent small code model
+    - wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
+    - thermal/drivers/mediatek/lvts_thermal: Add coeff for mt8192
+    - thermal/drivers/tsens: Fix null pointer dereference
+    - dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 compatible
+    - dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible
+      definition
+    - wifi: ath10k: Fix an error code problem in
+      ath10k_dbg_sta_write_peer_debug_trigger()
+    - gfs2: Remove ill-placed consistency check
+    - gfs2: Fix potential glock use-after-free on unmount
+    - gfs2: finish_xmote cleanup
+    - gfs2: do_xmote fixes
+    - thermal/debugfs: Avoid excessive updates of trip point statistics
+    - selftests/bpf: Fix a fd leak in error paths in open_netns
+    - scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search()
+    - cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations
+    - wifi: ath10k: populate board data for WCN3990
+    - net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset
+      handlers
+    - net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family
+      switches
+    - tcp: avoid premature drops in tcp_add_backlog()
+    - thermal/debugfs: Create records for cdev states as they get used
+    - thermal/debugfs: Pass cooling device state to thermal_debug_cdev_add()
+    - pwm: sti: Prepare removing pwm_chip from driver data
+    - pwm: sti: Simplify probe function using devm functions
+    - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
+    - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
+    - drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
+    - net: give more chances to rcu in netdev_wait_allrefs_any()
+    - macintosh/via-macii: Fix "BUG: sleeping function called from invalid
+      context"
+    - wifi: carl9170: add a proper sanity check for endpoints
+    - bpf: Fix verifier assumptions about socket->sk
+    - selftests/bpf: Run cgroup1_hierarchy test in own mount namespace
+    - wifi: ar5523: enable proper endpoint verification
+    - pwm: Drop useless member .of_pwm_n_cells of struct pwm_chip
+    - pwm: Let the of_xlate callbacks accept references without period
+    - pwm: Drop duplicate check against chip->npwm in of_pwm_xlate_with_flags()
+    - pwm: Reorder symbols in core.c
+    - pwm: Provide an inline function to get the parent device of a given chip
+    - pwm: meson: Change prototype of a few helpers to prepare further changes
+    - pwm: meson: Make use of pwmchip_parent() accessor
+    - pwm: meson: Add check for error from clk_round_rate()
+    - pwm: meson: Use mul_u64_u64_div_u64() for frequency calculating
+    - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
+    - sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
+    - Revert "sh: Handle calling csum_partial with misaligned data"
+    - wifi: mt76: mt7603: fix tx queue of loopback packets
+    - wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
+    - wifi: mt76: mt7996: fix size of txpower MCU command
+    - wifi: mt76: mt7925: ensure 4-byte alignment for suspend & wow command
+    - wifi: mt76: mt7996: fix uninitialized variable in mt7996_irq_tasklet()
+    - wifi: mt76: mt7996: fix potential memory leakage when reading chip
+      temperature
+    - libbpf: Fix error message in attach_kprobe_multi
+    - wifi: nl80211: Avoid address calculations via out of bounds array indexing
+    - wifi: rtw89: wow: refine WoWLAN flows of HCI interrupts and low power mode
+    - selftests/binderfs: use the Makefile's rules, not Make's implicit rules
+    - selftests/resctrl: fix clang build failure: use LOCAL_HDRS
+    - selftests: default to host arch for LLVM builds
+    - kunit: Fix kthread reference
+    - kunit: unregister the device on error
+    - kunit: bail out early in __kunit_test_suites_init() if there are no suites
+      to test
+    - selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect
+    - HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
+    - scsi: bfa: Ensure the copied buf is NUL terminated
+    - scsi: qedf: Ensure the copied buf is NUL terminated
+    - scsi: qla2xxx: Fix debugfs output for fw_resource_count
+    - gpio: nuvoton: Fix sgpio irq handle error
+    - x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks()
+    - wifi: mwl8k: initialize cmd->addr[] properly
+    - HID: amd_sfh: Handle "no sensors" in PM operations
+    - usb: aqc111: stop lying about skb->truesize
+    - net: usb: sr9700: stop lying about skb->truesize
+    - m68k: Fix spinlock race in kernel thread creation
+    - m68k: mac: Fix reboot hang on Mac IIci
+    - dm-delay: fix workqueue delay_timer race
+    - dm-delay: fix hung task introduced by kthread mode
+    - dm-delay: fix max_delay calculations
+    - ptp: ocp: fix DPLL functions
+    - net: ipv6: fix wrong start position when receive hop-by-hop fragment
+    - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
+    - selftests: net: add missing config for amt.sh
+    - selftests: net: move amt to socat for better compatibility
+    - net: ethernet: mediatek: split tx and rx fields in mtk_soc_data struct
+    - net: ethernet: mediatek: use ADMAv1 instead of ADMAv2.0 on MT7981 and MT7986
+    - ice: Fix package download algorithm
+    - net: ethernet: cortina: Locking fixes
+    - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
+    - net: usb: smsc95xx: stop lying about skb->truesize
+    - net: openvswitch: fix overwriting ct original tuple for ICMPv6
+    - ipv6: sr: add missing seg6_local_exit
+    - ipv6: sr: fix incorrect unregister order
+    - ipv6: sr: fix invalid unregister error path
+    - net/mlx5: Fix peer devlink set for SF representor devlink port
+    - net/mlx5: Reload only IB representors upon lag disable/enable
+    - net/mlx5: Add a timeout to acquire the command queue semaphore
+    - net/mlx5: Discard command completions in internal error
+    - s390/bpf: Emit a barrier for BPF_FETCH instructions
+    - riscv, bpf: make some atomic operations fully ordered
+    - ax25: Use kernel universal linked list to implement ax25_dev_list
+    - ax25: Fix reference count leak issues of ax25_dev
+    - ax25: Fix reference count leak issue of net_device
+    - dpll: fix return value check for kmemdup
+    - net: fec: remove .ndo_poll_controller to avoid deadlocks
+    - mptcp: SO_KEEPALIVE: fix getsockopt support
+    - mptcp: cleanup writer wake-up
+    - mptcp: avoid some duplicate code in socket option handling
+    - mptcp: implement TCP_NOTSENT_LOWAT support
+    - mptcp: cleanup SOL_TCP handling
+    - mptcp: fix full TCP keep-alive support
+    - net: stmmac: Offload queueMaxSDU from tc-taprio
+    - net: stmmac: est: Per Tx-queue error count for HLBF
+    - net: stmmac: Report taprio offload status
+    - net: stmmac: move the EST lock to struct stmmac_priv
+    - net: micrel: Fix receiving the timestamp in the frame for lan8841
+    - Bluetooth: compute LE flow credits based on recvbuf space
+    - Bluetooth: qca: Fix error code in qca_read_fw_build_info()
+    - Bluetooth: ISO: Add hcon for listening bis sk
+    - Bluetooth: ISO: Clean up returns values in iso_connect_ind()
+    - Bluetooth: ISO: Make iso_get_sock_listen generic
+    - Bluetooth: Remove usage of the deprecated ida_simple_xx() API
+    - Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS
+    - Bluetooth: HCI: Remove HCI_AMP support
+    - ice: make ice_vsi_cfg_rxq() static
+    - ice: make ice_vsi_cfg_txq() static
+    - overflow: Change DEFINE_FLEX to take __counted_by member
+    - Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings
+    - Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1
+    - drm/bridge: Fix improper bridge init order with pre_enable_prev_first
+    - drm/ci: update device type for volteer devices
+    - drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer()
+    - drm/omapdrm: Fix console by implementing fb_dirty
+    - drm/omapdrm: Fix console with deferred ops
+    - printk: Let no_printk() use _printk()
+    - dev_printk: Add and use dev_no_printk()
+    - drm/lcdif: Do not disable clocks on already suspended hardware
+    - drm/dp: Don't attempt AUX transfers when eDP panels are not powered
+    - drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't
+      assert
+    - drm/amd/display: Fix potential index out of bounds in color transformation
+      function
+    - drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate()
+    - ASoC: Intel: Disable route checks for Skylake boards
+    - ASoC: Intel: avs: ssm4567: Do not ignore route checks
+    - mtd: core: Report error if first mtd_otp_size() call fails in
+      mtd_otp_nvmem_add()
+    - mtd: rawnand: hynix: fixed typo
+    - drm/imagination: avoid -Woverflow warning
+    - ASoC: mediatek: Assign dummy when codec not specified for a DAI link
+    - drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W flags
+    - drm/panel: ltk050h3146w: drop duplicate commands from LTK050H3148W init
+    - fbdev: shmobile: fix snprintf truncation
+    - ASoC: kirkwood: Fix potential NULL dereference
+    - drm/meson: vclk: fix calculation of 59.94 fractional rates
+    - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
+    - drm/mediatek: Init `ddp_comp` with devm_kcalloc()
+    - ASoC: SOF: Intel: hda-dai: fix channel map configuration for aggregated
+      dailink
+    - powerpc/fsl-soc: hide unused const variable
+    - ASoC: SOF: Intel: mtl: Correct rom_status_reg
+    - ASoC: SOF: Intel: lnl: Correct rom_status_reg
+    - ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed
+    - ASoC: SOF: Intel: mtl: Implement firmware boot state check
+    - fbdev: sisfb: hide unused variables
+    - selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 mounted
+      without nsdelegate
+    - ASoC: Intel: avs: Restore stream decoupling on prepare
+    - ASoC: Intel: avs: Fix ASRC module initialization
+    - ASoC: Intel: avs: Fix potential integer overflow
+    - ASoC: Intel: avs: Test result of avs_get_module_entry()
+    - media: ngene: Add dvb_ca_en50221_init return value check
+    - staging: media: starfive: Remove links when unregistering devices
+    - media: rcar-vin: work around -Wenum-compare-conditional warning
+    - media: radio-shark2: Avoid led_names truncations
+    - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
+    - platform/x86: xiaomi-wmi: Fix race condition when reporting key events
+    - drm/msm/dp: allow voltage swing / pre emphasis of 3
+    - drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected
+    - media: ipu3-cio2: Request IRQ earlier
+    - media: dt-bindings: ovti,ov2680: Fix the power supply names
+    - media: i2c: et8ek8: Don't strip remove function when driver is builtin
+    - media: v4l2-subdev: Fix stream handling for crop API
+    - fbdev: sh7760fb: allow modular build
+    - media: atomisp: ssh_css: Fix a null-pointer dereference in
+      load_video_binaries
+    - drm/arm/malidp: fix a possible null pointer dereference
+    - drm: vc4: Fix possible null pointer dereference
+    - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
+    - drm/bridge: anx7625: Don't log an error when DSI host can't be found
+    - drm/bridge: icn6211: Don't log an error when DSI host can't be found
+    - drm/bridge: lt8912b: Don't log an error when DSI host can't be found
+    - drm/bridge: lt9611: Don't log an error when DSI host can't be found
+    - drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found
+    - drm/bridge: tc358775: Don't log an error when DSI host can't be found
+    - drm/bridge: dpc3433: Don't log an error when DSI host can't be found
+    - drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found
+    - drm/bridge: anx7625: Update audio status while detecting
+    - drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
+    - ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim 7 16ARHA7
+    - drm/mipi-dsi: use correct return type for the DSC functions
+    - media: uvcvideo: Add quirk for Logitech Rally Bar
+    - drm/rockchip: vop2: Do not divide height twice for YUV
+    - drm/edid: Parse topology block for all DispID structure v1.x
+    - media: cadence: csi2rx: configure DPHY before starting source stream
+    - clk: samsung: exynosautov9: fix wrong pll clock id value
+    - RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent
+    - RDMA/mlx5: Change check for cacheable mkeys
+    - RDMA/mlx5: Adding remote atomic access flag to updatable flags
+    - clk: mediatek: pllfh: Don't log error for missing fhctl node
+    - iommu: Undo pasid attachment only for the devices that have succeeded
+    - RDMA/hns: Fix return value in hns_roce_map_mr_sg
+    - RDMA/hns: Fix deadlock on SRQ async events.
+    - RDMA/hns: Fix UAF for cq async event
+    - RDMA/hns: Fix GMV table pagesize
+    - RDMA/hns: Use complete parentheses in macros
+    - RDMA/hns: Modify the print level of CQE error
+    - clk: mediatek: mt8365-mm: fix DPI0 parent
+    - clk: rs9: fix wrong default value for clock amplitude
+    - clk: qcom: clk-alpha-pll: remove invalid Stromer register offset
+    - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
+    - RDMA/rxe: Allow good work requests to be executed
+    - RDMA/rxe: Fix incorrect rxe_put in error path
+    - IB/mlx5: Use __iowrite64_copy() for write combining stores
+    - clk: renesas: r8a779a0: Fix CANFD parent clock
+    - clk: renesas: r9a07g043: Add clock and reset entry for PLIC
+    - lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
+    - mm/ksm: fix ksm exec support for prctl
+    - clk: qcom: dispcc-sm8450: fix DisplayPort clocks
+    - clk: qcom: dispcc-sm6350: fix DisplayPort clocks
+    - clk: qcom: dispcc-sm8550: fix DisplayPort clocks
+    - clk: qcom: dispcc-sm8650: fix DisplayPort clocks
+    - clk: qcom: mmcc-msm8998: fix venus clock issue
+    - x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
+    - x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS
+    - ext4: avoid excessive credit estimate in ext4_tmpfile()
+    - RDMA/mana_ib: Introduce helpers to create and destroy mana queues
+    - RDMA/mana_ib: Use struct mana_ib_queue for CQs
+    - RDMA/mana_ib: boundary check before installing cq callbacks
+    - virt: acrn: stop using follow_pfn
+    - drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
+    - sunrpc: removed redundant procp check
+    - nfsd: don't create nfsv4recoverydir in nfsdfs when not used.
+    - ext4: fix potential unnitialized variable
+    - ext4: remove the redundant folio_wait_stable()
+    - clk: qcom: Fix SC_CAMCC_8280XP dependencies
+    - [Config] updateconfigs for SC_CAMCC_8280XP
+    - clk: qcom: Fix SM_GPUCC_8650 dependencies
+    - [Config] updateconfigs for SM_GPUCC_8650
+    - clk: qcom: apss-ipq-pll: fix PLL rate for IPQ5018
+    - of: module: add buffer overflow check in of_modalias()
+    - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
+    - SUNRPC: Fix gss_free_in_token_pages()
+    - selftests/damon/_damon_sysfs: check errors from nr_schemes file reads
+    - selftests/kcmp: remove unused open mode
+    - RDMA/IPoIB: Fix format truncation compilation errors
+    - RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use
+      siw
+    - samples/landlock: Fix incorrect free in populate_ruleset_net
+    - tracing/user_events: Prepare find/delete for same name events
+    - tracing/user_events: Fix non-spaced field matching
+    - modules: Drop the .export_symbol section from the final modules
+    - net: bridge: xmit: make sure we have at least eth header len bytes
+    - selftests: net: bridge: increase IGMP/MLD exclude timeout membership
+      interval
+    - net: bridge: mst: fix vlan use-after-free
+    - net: qrtr: ns: Fix module refcnt
+    - selftests/net/lib: no need to record ns name if it already exist
+    - idpf: don't skip over ethtool tcp-data-split setting
+    - netrom: fix possible dead-lock in nr_rt_ioctl()
+    - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
+    - sched/fair: Allow disabling sched_balance_newidle with
+      sched_relax_domain_level
+    - sched/core: Fix incorrect initialization of the 'burst' parameter in
+      cpu_max_write()
+    - net: wangxun: fix to change Rx features
+    - net: wangxun: match VLAN CTAG and STAG features
+    - net: txgbe: move interrupt codes to a separate file
+    - net: txgbe: use irq_domain for interrupt controller
+    - net: txgbe: fix to control VLAN strip
+    - l2tp: fix ICMP error handling for UDP-encap sockets
+    - io_uring/net: ensure async prep handlers always initialize ->done_io
+    - pwm: Fix setting period with #pwm-cells = <1> and of_pwm_single_xlate()
+    - net: txgbe: fix to clear interrupt status after handling IRQ
+    - net: txgbe: fix GPIO interrupt blocking
+    - Linux 6.8.12
+  * Noble update: v6.8.11 upstream stable release (LP: #2070355)
+    - drm/amd/display: Fix division by zero in setup_dsc_config
+    - net: ks8851: Fix another TX stall caused by wrong ISR flag handling
+    - ice: pass VSI pointer into ice_vc_isvalid_q_id
+    - ice: remove unnecessary duplicate checks for VF VSI ID
+    - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
+    - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
+    - KEYS: trusted: Fix memory leak in tpm2_key_encode()
+    - erofs: get rid of erofs_fs_context
+    - erofs: reliably distinguish block based and fscache mode
+    - binder: fix max_thread type inconsistency
+    - usb: dwc3: Wait unconditionally after issuing EndXfer command
+    - net: usb: ax88179_178a: fix link status when link is set to down/up
+    - usb: typec: ucsi: displayport: Fix potential deadlock
+    - usb: typec: tipd: fix event checking for tps25750
+    - usb: typec: tipd: fix event checking for tps6598x
+    - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
+    - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
+    - KEYS: trusted: Do not use WARN when encode fails
+    - admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
+    - docs: kernel_include.py: Cope with docutils 0.21
+    - Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching
+      sysfs file
+    - block: add a disk_has_partscan helper
+    - block: add a partscan sysfs attribute for disks
+    - Linux 6.8.11
+  * Noble update: v6.8.10 upstream stable release (LP: #2070349)
+    - rust: module: place generated init_module() function in .init.text
+    - rust: macros: fix soundness issue in `module!` macro
+    - wifi: nl80211: don't free NULL coalescing rule
+    - pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
+    - pinctrl/meson: fix typo in PDM's pin name
+    - pinctrl: core: delete incorrect free in pinctrl_enable()
+    - pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
+    - pinctrl: mediatek: paris: Rework support for
+      PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
+    - sunrpc: add a struct rpc_stats arg to rpc_create_args
+    - nfs: expose /proc/net/sunrpc/nfs in net namespaces
+    - nfs: make the rpc_stat per net namespace
+    - nfs: Handle error of rpc_proc_register() in nfs_net_init().
+    - pinctrl: baytrail: Fix selecting gpio pinctrl state
+    - power: rt9455: hide unused rt9455_boost_voltage_values
+    - power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
+    - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
+    - nfsd: rename NFSD_NET_* to NFSD_STATS_*
+    - nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
+    - nfsd: make all of the nfsd stats per-network namespace
+    - NFSD: add support for CB_GETATTR callback
+    - NFSD: Fix nfsd4_encode_fattr4() crasher
+    - regulator: mt6360: De-capitalize devicetree regulator subnodes
+    - regulator: change stubbed devm_regulator_get_enable to return Ok
+    - regulator: change devm_regulator_get_enable_optional() stub to return Ok
+    - bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
+    - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
+    - regmap: Add regmap_read_bypassed()
+    - ASoC: SOF: Intel: add default firmware library path for LNL
+    - nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
+    - bpf: Fix a verifier verbose message
+    - spi: axi-spi-engine: use common AXI macros
+    - spi: axi-spi-engine: fix version format string
+    - spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
+    - bpf, arm64: Fix incorrect runtime stats
+    - riscv, bpf: Fix incorrect runtime stats
+    - ASoC: Intel: avs: Set name of control as in topology
+    - ASoC: codecs: wsa881x: set clk_stop_mode1 flag
+    - s390/mm: Fix storage key clearing for guest huge pages
+    - s390/mm: Fix clearing storage keys for huge pages
+    - arm32, bpf: Reimplement sign-extension mov instruction
+    - xdp: use flags field to disambiguate broadcast redirect
+    - efi/unaccepted: touch soft lockup during memory accept
+    - ice: ensure the copied buf is NUL terminated
+    - bna: ensure the copied buf is NUL terminated
+    - octeontx2-af: avoid off-by-one read from userspace
+    - thermal/debugfs: Free all thermal zone debug memory on zone removal
+    - thermal/debugfs: Fix two locking issues with thermal zone debug
+    - nsh: Restore skb->{protocol,data,mac_header} for outer header in
+      nsh_gso_segment().
+    - net l2tp: drop flow hash on forward
+    - thermal/debugfs: Prevent use-after-free from occurring after cdev removal
+    - s390/vdso: Add CFI for RA register to asm macro vdso_func
+    - Fix a potential infinite loop in extract_user_to_sg()
+    - ALSA: emu10k1: fix E-MU card dock presence monitoring
+    - ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()
+    - ALSA: emu10k1: move the whole GPIO event handling to the workqueue
+    - ALSA: emu10k1: fix E-MU dock initialization
+    - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
+    - net: qede: use return from qede_parse_flow_attr() for flower
+    - net: qede: use return from qede_parse_flow_attr() for flow_spec
+    - net: qede: use return from qede_parse_actions()
+    - vxlan: Fix racy device stats updates.
+    - vxlan: Add missing VNI filter counter update in arp_reduce().
+    - ASoC: meson: axg-fifo: use FIELD helpers
+    - ASoC: meson: axg-fifo: use threaded irq to check periods
+    - ASoC: meson: axg-card: make links nonatomic
+    - ASoC: meson: axg-tdm-interface: manage formatters in trigger
+    - ASoC: meson: cards: select SND_DYNAMIC_MINORS
+    - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
+    - s390/cio: Ensure the copied buf is NUL terminated
+    - cxgb4: Properly lock TX queue for the selftest.
+    - net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
+    - drm/amdgpu: fix doorbell regression
+    - spi: fix null pointer dereference within spi_sync
+    - net: bridge: fix multicast-to-unicast with fraglist GSO
+    - net: core: reject skb_copy(_expand) for fraglist GSO skbs
+    - rxrpc: Clients must accept conn from any address
+    - tipc: fix a possible memleak in tipc_buf_append
+    - vxlan: Pull inner IP header in vxlan_rcv().
+    - s390/qeth: Fix kernel panic after setting hsuid
+    - drm/panel: ili9341: Correct use of device property APIs
+    - [Config] updateconfigs for DRM_PANEL_ILITEK_ILI9341
+    - drm/panel: ili9341: Respect deferred probe
+    - drm/panel: ili9341: Use predefined error codes
+    - ipv4: Fix uninit-value access in __ip_make_skb()
+    - net: gro: fix udp bad offset in socket lookup by adding
+      {inner_}network_offset to napi_gro_cb
+    - net: gro: add flush check in udp_gro_receive_segment
+    - drm/xe/display: Fix ADL-N detection
+    - clk: qcom: smd-rpm: Restore msm8976 num_clk
+    - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
+    - powerpc/pseries: make max polling consistent for longer H_CALLs
+    - powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
+    - EDAC/versal: Do not log total error counts
+    - swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
+    - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
+    - exfat: fix timing of synchronizing bitmap and inode
+    - firmware: microchip: don't unconditionally print validation success
+    - scsi: ufs: core: Fix MCQ MAC configuration
+    - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
+    - scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling
+    - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
+    - scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
+    - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
+    - scsi: lpfc: Use a dedicated lock for ras_fwlog state
+    - gfs2: Fix invalid metadata access in punch_hole
+    - fs/9p: fix uninitialized values during inode evict
+    - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
+    - wifi: cfg80211: fix rdev_dump_mpp() arguments order
+    - wifi: mac80211: fix prep_connection error path
+    - wifi: iwlwifi: read txq->read_ptr under lock
+    - wifi: iwlwifi: mvm: guard against invalid STA ID on removal
+    - net: mark racy access on sk->sk_rcvbuf
+    - drm/xe: Fix END redefinition
+    - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
+    - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
+    - btrfs: return accurate error code on open failure in open_fs_devices()
+    - drm/amdkfd: Check cgroup when returning DMABuf info
+    - drm/amdkfd: range check cp bad op exception interrupts
+    - bpf: Check bloom filter map value size
+    - selftests/ftrace: Fix event filter target_func selection
+    - kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
+    - ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3
+      suspend
+    - regulator: tps65132: Add of_match table
+    - OSS: dmasound/paula: Mark driver struct with __refdata to prevent section
+      mismatch
+    - scsi: ufs: core: WLUN suspend dev/link state error recovery
+    - scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN
+    - scsi: ufs: core: Fix MCQ mode dev command timeout
+    - ALSA: line6: Zero-initialize message buffers
+    - block: fix overflow in blk_ioctl_discard()
+    - ASoC: codecs: ES8326: Solve error interruption issue
+    - ASoC: codecs: ES8326: modify clock table
+    - net: bcmgenet: Reset RBUF on first open
+    - vboxsf: explicitly deny setlease attempts
+    - ata: sata_gemini: Check clk_enable() result
+    - firewire: ohci: mask bus reset interrupts between ISR and bottom half
+    - tools/power turbostat: Fix added raw MSR output
+    - tools/power turbostat: Increase the limit for fd opened
+    - tools/power turbostat: Fix Bzy_MHz documentation typo
+    - tools/power turbostat: Do not print negative LPI residency
+    - tools/power turbostat: Expand probe_intel_uncore_frequency()
+    - tools/power turbostat: Print ucode revision only if valid
+    - tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read
+    - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
+    - btrfs: always clear PERTRANS metadata during commit
+    - memblock tests: fix undefined reference to `early_pfn_to_nid'
+    - memblock tests: fix undefined reference to `panic'
+    - memblock tests: fix undefined reference to `BIT'
+    - nouveau/gsp: Avoid addressing beyond end of rpc->entries
+    - scsi: target: Fix SELinux error when systemd-modules loads the target module
+    - scsi: hisi_sas: Handle the NCQ error returned by D2H frame
+    - blk-iocost: avoid out of bounds shift
+    - accel/ivpu: Remove d3hot_after_power_off WA
+    - accel/ivpu: Improve clarity of MMU error messages
+    - accel/ivpu: Fix missed error message after VPU rename
+    - platform/x86: acer-wmi: Add support for Acer PH18-71
+    - gpu: host1x: Do not setup DMA for virtual devices
+    - MIPS: scall: Save thread_info.syscall unconditionally on entry
+    - tools/power/turbostat: Fix uncore frequency file string
+    - net: add copy_safe_from_sockptr() helper
+    - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
+    - drm/amdgpu: Refine IB schedule error logging
+    - drm/amd/display: add DCN 351 version for microcode load
+    - drm/amdgpu: add smu 14.0.1 discovery support
+    - drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
+    - drm/amd/display: Skip on writeback when it's not applicable
+    - drm/amd/pm: fix the high voltage issue after unload
+    - drm/amdgpu: Fix VCN allocation in CPX partition
+    - amd/amdkfd: sync all devices to wait all processes being evicted
+    - selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
+    - Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
+    - Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
+    - hv_netvsc: Don't free decrypted memory
+    - uio_hv_generic: Don't free decrypted memory
+    - Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
+    - drm/xe/xe_migrate: Cast to output precision before multiplying operands
+    - drm/xe: Label RING_CONTEXT_CONTROL as masked
+    - smb3: fix broken reconnect when password changing on the server by allowing
+      password rotation
+    - iommu: mtk: fix module autoloading
+    - fs/9p: only translate RWX permissions for plain 9P2000
+    - fs/9p: translate O_TRUNC into OTRUNC
+    - fs/9p: fix the cache always being enabled on files with qid flags
+    - 9p: explicitly deny setlease attempts
+    - powerpc/crypto/chacha-p10: Fix failure on non Power10
+    - gpio: wcove: Use -ENOTSUPP consistently
+    - gpio: crystalcove: Use -ENOTSUPP consistently
+    - clk: Don't hold prepare_lock when calling kref_put()
+    - fs/9p: remove erroneous nlink init from legacy stat2inode
+    - fs/9p: drop inodes immediately on non-.L too
+    - gpio: lpc32xx: fix module autoloading
+    - drm/nouveau/dp: Don't probe eDP ports twice harder
+    - platform/x86/amd: pmf: Decrease error message to debug
+    - platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
+    - drm/radeon: silence UBSAN warning (v3)
+    - net:usb:qmi_wwan: support Rolling modules
+    - blk-iocost: do not WARN if iocg was already offlined
+    - SUNRPC: add a missing rpc_stat for TCP TLS
+    - qibfs: fix dentry leak
+    - xfrm: Preserve vlan tags for transport mode software GRO
+    - ARM: 9381/1: kasan: clear stale stack poison
+    - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
+    - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
+    - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
+    - Bluetooth: msft: fix slab-use-after-free in msft_do_close()
+    - arm64: dts: mediatek: mt8183-pico6: Fix bluetooth node
+    - Bluetooth: HCI: Fix potential null-ptr-deref
+    - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
+    - net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
+    - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
+    - hwmon: (corsair-cpro) Use a separate buffer for sending commands
+    - hwmon: (corsair-cpro) Use complete_all() instead of complete() in
+      ccp_raw_event()
+    - hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
+    - phonet: fix rtm_phonet_notify() skb allocation
+    - netlink: specs: Add missing bridge linkinfo attrs
+    - nfc: nci: Fix kcov check in nci_rx_work()
+    - net: bridge: fix corrupted ethernet header on multicast-to-unicast
+    - ipv6: Fix potential uninit-value access in __ip6_make_skb()
+    - selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC
+    - rxrpc: Fix the names of the fields in the ACK trailer struct
+    - rxrpc: Fix congestion control algorithm
+    - rxrpc: Only transmit one ACK per jumbo packet received
+    - dt-bindings: net: mediatek: remove wrongly added clocks and SerDes
+    - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
+    - net-sysfs: convert dev->operstate reads to lockless ones
+    - hsr: Simplify code for announcing HSR nodes timer setup
+    - ipv6: annotate data-races around cnf.disable_ipv6
+    - ipv6: prevent NULL dereference in ip6_output()
+    - net/smc: fix neighbour and rtable leak in smc_ib_find_route()
+    - net: hns3: using user configure after hardware reset
+    - net: hns3: direct return when receive a unknown mailbox message
+    - net: hns3: change type of numa_node_mask as nodemask_t
+    - net: hns3: release PTP resources if pf initialization failed
+    - net: hns3: use appropriate barrier function after setting a bit value
+    - net: hns3: fix port vlan filter not disabled issue
+    - net: hns3: fix kernel crash when devlink reload during initialization
+    - net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family
+    - drm/meson: dw-hdmi: power up phy on device init
+    - drm/meson: dw-hdmi: add bandgap setting for g12
+    - drm/connector: Add \n to message about demoting connector force-probes
+    - dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11
+      users
+    - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
+    - gpiolib: cdev: fix uninitialised kfifo
+    - drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible
+    - drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
+    - firewire: nosy: ensure user_length is taken into account when fetching
+      packet contents
+    - Reapply "drm/qxl: simplify qxl_fence_wait"
+    - usb: typec: ucsi: Check for notifications after init
+    - usb: typec: ucsi: Fix connector check on init
+    - usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed
+      device
+    - usb: ohci: Prevent missed ohci interrupts
+    - USB: core: Fix access violation during port device removal
+    - usb: gadget: composite: fix OS descriptors w_value logic
+    - usb: gadget: uvc: use correct buffer size when parsing configfs lists
+    - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
+    - usb: gadget: f_fs: Fix a race condition when processing setup packets.
+    - usb: xhci-plat: Don't include xhci.h
+    - usb: dwc3: core: Prevent phy suspend during init
+    - usb: typec: tcpm: clear pd_event queue in PORT_RESET
+    - usb: typec: tcpm: unregister existing source caps before re-registration
+    - usb: typec: tcpm: Check for port partner validity before consuming it
+    - ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
+    - ALSA: hda/realtek: Fix conflicting PCI SSID 17aa:386f for Lenovo Legion
+      models
+    - firewire: ohci: fulfill timestamp for some local asynchronous transaction
+    - mm/slub: avoid zeroing outside-object freepointer for single free
+    - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
+    - btrfs: set correct ram_bytes when splitting ordered extent
+    - btrfs: qgroup: do not check qgroup inherit if qgroup is disabled
+    - btrfs: make sure that WRITTEN is set on all metadata blocks
+    - maple_tree: fix mas_empty_area_rev() null pointer dereference
+    - mm/slab: make __free(kfree) accept error pointers
+    - mptcp: ensure snd_nxt is properly initialized on connect
+    - mptcp: only allow set existing scheduler for net.mptcp.scheduler
+    - workqueue: Fix selection of wake_cpu in kick_pool()
+    - dt-bindings: iio: health: maxim,max30102: fix compatible check
+    - iio:imu: adis16475: Fix sync mode setting
+    - iio: pressure: Fixes BME280 SPI driver data
+    - iio: pressure: Fixes SPI support for BMP3xx devices
+    - iio: accel: mxc4005: Interrupt handling fixes
+    - iio: accel: mxc4005: Reset chip on probe() and resume()
+    - kmsan: compiler_types: declare __no_sanitize_or_inline
+    - e1000e: change usleep_range to udelay in PHY mdic access
+    - tipc: fix UAF in error path
+    - xtensa: fix MAKE_PC_FROM_RA second argument
+    - net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
+    - net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
+    - net: bcmgenet: synchronize UMAC_CMD access
+    - ASoC: tegra: Fix DSPK 16-bit playback
+    - ASoC: ti: davinci-mcasp: Fix race condition during probe
+    - dyndbg: fix old BUG_ON in >control parser
+    - slimbus: qcom-ngd-ctrl: Add timeout for wait operation
+    - clk: samsung: Revert "clk: Use device_get_match_data()"
+    - clk: sunxi-ng: common: Support minimum and maximum rate
+    - clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI
+    - mei: me: add lunar lake point M DID
+    - drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()
+    - Revert "drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()"
+    - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
+    - drm/ttm: Print the memory decryption status just once
+    - drm/vmwgfx: Fix Legacy Display Unit
+    - drm/vmwgfx: Fix invalid reads in fence signaled events
+    - drm/imagination: Ensure PVR_MIPS_PT_PAGE_COUNT is never zero
+    - drm/amd/display: Fix idle optimization checks for multi-display and dual eDP
+    - drm/nouveau/gsp: Use the sg allocator for level 2 of radix3
+    - drm/i915/gt: Automate CCS Mode setting during engine resets
+    - drm/i915/bios: Fix parsing backlight BDB data
+    - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
+    - drm/amd/display: Fix incorrect DSC instance for MST
+    - arm64: dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration
+    - iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()
+    - net: fix out-of-bounds access in ops_init
+    - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
+    - misc/pvpanic-pci: register attributes via pci_driver
+    - x86/apic: Don't access the APIC when disabling x2APIC
+    - selftests/mm: fix powerpc ARCH check
+    - mm: use memalloc_nofs_save() in page_cache_ra_order()
+    - mm/userfaultfd: reset ptes when close() for wr-protected ones
+    - iommu/amd: Enhance def_domain_type to handle untrusted device
+    - fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan
+    - fs/proc/task_mmu: fix uffd-wp confusion in pagemap_scan_pmd_entry()
+    - nvme-pci: Add quirk for broken MSIs
+    - regulator: core: fix debugfs creation regression
+    - spi: microchip-core-qspi: fix setting spi bus clock rate
+    - ksmbd: off ipv6only for both ipv4/ipv6 binding
+    - ksmbd: avoid to send duplicate lease break notifications
+    - ksmbd: do not grant v2 lease if parent lease key and epoch are not set
+    - tracefs: Reset permissions on remount if permissions are options
+    - tracefs: Still use mount point as default permissions for instances
+    - eventfs: Do not treat events directory different than other directories
+    - Bluetooth: qca: fix invalid device address check
+    - Bluetooth: qca: fix wcn3991 device address check
+    - Bluetooth: qca: add missing firmware sanity checks
+    - Bluetooth: qca: fix NVM configuration parsing
+    - Bluetooth: qca: generalise device address check
+    - Bluetooth: qca: fix info leak when fetching board id
+    - Bluetooth: qca: fix info leak when fetching fw build id
+    - Bluetooth: qca: fix firmware check error path
+    - keys: Fix overwrite of key expiration on instantiation
+    - Linux 6.8.10
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337)
+    - cifs: Fix reacquisition of volume cookie on still-live connection
+    - smb: client: fix rename(2) regression against samba
+    - cifs: reinstate original behavior again for forceuid/forcegid
+    - HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc
+    - HID: logitech-dj: allow mice to use all types of reports
+    - arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f
+    - arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 Puma
+    - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
+    - arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
+    - arm64: dts: rockchip: Fix the i2c address of es8316 on Cool Pi CM5
+    - arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts
+    - arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
+    - arm64: dts: mediatek: mt8192: Add missing gce-client-reg to mutex
+    - arm64: dts: mediatek: mt8195: Add missing gce-client-reg to vpp/vdosys
+    - arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex
+    - arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex1
+    - arm64: dts: mediatek: cherry: Describe CPU supplies
+    - arm64: dts: mediatek: mt8192-asurada: Update min voltage constraint for
+      MT6315
+    - arm64: dts: mediatek: mt8195-cherry: Update min voltage constraint for
+      MT6315
+    - arm64: dts: mediatek: mt8183-kukui: Use default min voltage for MT6358
+    - arm64: dts: mediatek: mt7622: fix clock controllers
+    - arm64: dts: mediatek: mt7622: fix IR nodename
+    - arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
+    - arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
+    - arm64: dts: mediatek: mt7986: reorder properties
+    - arm64: dts: mediatek: mt7986: drop invalid properties from ethsys
+    - arm64: dts: mediatek: mt7986: drop "#reset-cells" from Ethernet controller
+    - arm64: dts: mediatek: mt7986: reorder nodes
+    - arm64: dts: mediatek: mt7986: drop invalid thermal block clock
+    - arm64: dts: mediatek: mt7986: prefix BPI-R3 cooling maps with "map-"
+    - arm64: dts: mediatek: mt2712: fix validation errors
+    - arm64: dts: rockchip: mark system power controller and fix typo on
+      orangepi-5-plus
+    - arm64: dts: rockchip: regulator for sd needs to be always on for BPI-R2Pro
+    - block: fix module reference leakage from bdev_open_by_dev error path
+    - arm64: dts: qcom: Fix type of "wdog" IRQs for remoteprocs
+    - arm64: dts: qcom: x1e80100: Fix the compatible for cluster idle states
+    - arm64: dts: qcom: sc8180x: Fix ss_phy_irq for secondary USB controller
+    - gpio: tangier: Use correct type for the IRQ chip data
+    - ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
+    - wifi: mac80211: clean up assignments to pointer cache.
+    - wifi: mac80211: split mesh fast tx cache into local/proxied/forwarded
+    - wifi: iwlwifi: mvm: remove old PASN station when adding a new one
+    - wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd
+    - drm/gma500: Remove lid code
+    - wifi: mac80211_hwsim: init peer measurement result
+    - wifi: mac80211: remove link before AP
+    - wifi: mac80211: fix unaligned le16 access
+    - net: libwx: fix alloc msix vectors failed
+    - vxlan: drop packets from invalid src-address
+    - net: bcmasp: fix memory leak when bringing down interface
+    - mlxsw: core: Unregister EMAD trap using FORWARD action
+    - mlxsw: core_env: Fix driver initialization with old firmware
+    - mlxsw: pci: Fix driver initialization with old firmware
+    - ARM: dts: microchip: at91-sama7g5ek: Replace regulator-suspend-voltage with
+      the valid property
+    - icmp: prevent possible NULL dereferences from icmp_build_probe()
+    - bridge/br_netlink.c: no need to return void function
+    - bnxt_en: refactor reset close code
+    - bnxt_en: Fix the PCI-AER routines
+    - bnxt_en: Fix error recovery for 5760X (P7) chips
+    - cxl/core: Fix potential payload size confusion in cxl_mem_get_poison()
+    - net: dsa: mv88e6xx: fix supported_interfaces setup in
+      mv88e6250_phylink_get_caps()
+    - NFC: trf7970a: disable all regulators on removal
+    - netfs: Fix writethrough-mode error handling
+    - ax25: Fix netdev refcount issue
+    - soc: mediatek: mtk-svs: Append "-thermal" to thermal zone names
+    - tools: ynl: don't ignore errors in NLMSG_DONE messages
+    - net: usb: ax88179_178a: stop lying about skb->truesize
+    - tcp: Fix Use-After-Free in tcp_ao_connect_init
+    - net: gtp: Fix Use-After-Free in gtp_dellink
+    - net: phy: mediatek-ge-soc: follow netdev LED trigger semantics
+    - gpio: tegra186: Fix tegra186_gpio_is_accessible() check
+    - drm/xe: Remove sysfs only once on action add failure
+    - drm/xe: call free_gsc_pkt only once on action add failure
+    - Bluetooth: hci_event: Use HCI error defines instead of magic values
+    - Bluetooth: hci_conn: Only do ACL connections sequentially
+    - Bluetooth: Remove pending ACL connection attempts
+    - Bluetooth: hci_conn: Always use sk_timeo as conn_timeout
+    - Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync
+    - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue
+    - Bluetooth: hci_sync: Attempt to dequeue connection attempt
+    - Bluetooth: ISO: Reassemble PA data for bcast sink
+    - Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync
+    - Bluetooth: btusb: Fix triggering coredump implementation for QCA
+    - Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE
+    - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID
+    - Bluetooth: btusb: mediatek: Fix double free of skb in coredump
+    - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor
+    - Bluetooth: qca: set power_ctrl_enabled on NULL returned by
+      gpiod_get_optional()
+    - ipvs: Fix checksumming on GSO of SCTP packets
+    - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
+    - mlxsw: Use refcount_t for reference counting
+    - mlxsw: spectrum_acl_tcam: Fix race in region ID allocation
+    - mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
+    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
+    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
+    - mlxsw: spectrum_acl_tcam: Rate limit error message
+    - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
+    - mlxsw: spectrum_acl_tcam: Fix warning during rehash
+    - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
+    - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
+    - eth: bnxt: fix counting packets discarded due to OOM and netpoll
+    - ARM: dts: imx6ull-tarragon: fix USB over-current polarity
+    - netfilter: nf_tables: honor table dormant flag from netdev release event
+      path
+    - net: phy: dp83869: Fix MII mode failure
+    - net: ti: icssg-prueth: Fix signedness bug in prueth_init_rx_chns()
+    - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
+    - i40e: Report MFS in decimal base instead of hex
+    - iavf: Fix TC config comparison with existing adapter TC config
+    - ice: fix LAG and VF lock dependency in ice_reset_vf()
+    - net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
+    - octeontx2-af: fix the double free in rvu_npc_freemem()
+    - dpll: check that pin is registered in __dpll_pin_unregister()
+    - dpll: fix dpll_pin_on_pin_register() for multiple parent pins
+    - tls: fix lockless read of strp->msg_ready in ->poll
+    - af_unix: Suppress false-positive lockdep splat for spin_lock() in
+      __unix_gc().
+    - netfs: Fix the pre-flush when appending to a file in writethrough mode
+    - drm/amd/display: Check DP Alt mode DPCS state via DMUB
+    - Revert "drm/amd/display: fix USB-C flag update after enc10 feature init"
+    - xhci: move event processing for one interrupter to a separate function
+    - usb: xhci: correct return value in case of STS_HCE
+    - KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled
+    - KVM: x86/pmu: Set enable bits for GP counters in PERF_GLOBAL_CTRL at "RESET"
+    - drm: add drm_gem_object_is_shared_for_memory_stats() helper
+    - drm/amdgpu: add shared fdinfo stats
+    - drm/amdgpu: fix visible VRAM handling during faults
+    - Revert "UBUNTU: SAUCE: selftests/seccomp: fix check of fds being assigned"
+    - selftests/seccomp: user_notification_addfd check nextfd is available
+    - selftests/seccomp: Change the syscall used in KILL_THREAD test
+    - selftests/seccomp: Handle EINVAL on unshare(CLONE_NEWPID)
+    - x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range
+    - x86/cpu: Fix check for RDPKRU in __show_regs()
+    - rust: phy: implement `Send` for `Registration`
+    - rust: kernel: require `Send` for `Module` implementations
+    - rust: don't select CONSTRUCTORS
+    - [Config] updateconfigs to drop CONSTRUCTORS for rust
+    - rust: init: remove impl Zeroable for Infallible
+    - rust: make mutually exclusive with CFI_CLANG
+    - kbuild: rust: remove unneeded `@rustc_cfg` to avoid ICE
+    - kbuild: rust: force `alloc` extern to allow "empty" Rust files
+    - rust: remove `params` from `module` macro example
+    - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
+    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
+    - Bluetooth: qca: fix NULL-deref on non-serdev suspend
+    - Bluetooth: qca: fix NULL-deref on non-serdev setup
+    - mtd: rawnand: qcom: Fix broken OP_RESET_DEVICE command in
+      qcom_misc_cmd_type_exec()
+    - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
+    - mmc: sdhci-msm: pervent access to suspended controller
+    - mmc: sdhci-of-dwcmshc: th1520: Increase tuning loop count to 128
+    - mm: create FOLIO_FLAG_FALSE and FOLIO_TYPE_OPS macros
+    - mm: support page_mapcount() on page_has_type() pages
+    - mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
+    - smb: client: Fix struct_group() usage in __packed structs
+    - smb3: missing lock when picking channel
+    - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result
+    - btrfs: fallback if compressed IO fails for ENOSPC
+    - btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range()
+    - btrfs: scrub: run relocation repair when/only needed
+    - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
+    - x86/tdx: Preserve shared bit on mprotect()
+    - cpu: Re-enable CPU mitigations by default for !X86 architectures
+    - [Config] updateconfigs for CPU_MITIGATIONS
+    - eeprom: at24: fix memory corruption race condition
+    - LoongArch: Fix callchain parse error with kernel tracepoint events
+    - LoongArch: Fix access error when read fault on a write-only VMA
+    - arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP
+    - arm64: dts: qcom: sm8450: Fix the msi-map entries
+    - arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
+    - dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
+    - dmaengine: xilinx: xdma: Fix wrong offsets in the buffers addresses in dma
+      descriptor
+    - dmaengine: xilinx: xdma: Fix synchronization issue
+    - drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
+    - drm/amdgpu: Assign correct bits for SDMA HDP flush
+    - drm/atomic-helper: fix parameter order in drm_format_conv_state_copy() call
+    - drm/amdgpu/pm: Remove gpu_od if it's an empty directory
+    - drm/amdgpu/umsch: don't execute umsch test when GPU is in reset/suspend
+    - drm/amdgpu: Fix leak when GPU memory allocation fails
+    - drm/amdkfd: Fix rescheduling of restore worker
+    - drm/amdkfd: Fix eviction fence handling
+    - irqchip/gic-v3-its: Prevent double free on error
+    - ACPI: CPPC: Use access_width over bit_width for system memory accesses
+    - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
+    - ACPI: CPPC: Fix access width used for PCC registers
+    - net/mlx5e: Advertise mlx5 ethernet driver updates sk_buff md_dst for MACsec
+    - ethernet: Add helper for assigning packet type when dest address does not
+      match device address
+    - net: b44: set pause params only when interface is up
+    - macsec: Enable devices to advertise whether they update sk_buff md_dst
+      during offloads
+    - macsec: Detect if Rx skb is macsec-related for offloading devices that
+      update md_dst
+    - stackdepot: respect __GFP_NOLOCKDEP allocation flag
+    - fbdev: fix incorrect address computation in deferred IO
+    - udp: preserve the connected status if only UDP cmsg
+    - mtd: limit OTP NVMEM cell parse to non-NAND devices
+    - mtd: diskonchip: work around ubsan link failure
+    - firmware: qcom: uefisecapp: Fix memory related IO errors and crashes
+    - phy: qcom: qmp-combo: Fix register base for QSERDES_DP_PHY_MODE
+    - phy: qcom: qmp-combo: Fix VCO div offset on v3
+    - mm: turn folio_test_hugetlb into a PageType
+    - mm: zswap: fix shrinker NULL crash with cgroup_disable=memory
+    - dmaengine: owl: fix register access functions
+    - dmaengine: tegra186: Fix residual calculation
+    - idma64: Don't try to serve interrupts when device is powered off
+    - soundwire: amd: fix for wake interrupt handling for clockstop mode
+    - phy: marvell: a3700-comphy: Fix hardcoded array size
+    - phy: freescale: imx8m-pcie: fix pcie link-up instability
+    - phy: rockchip-snps-pcie3: fix bifurcation on rk3588
+    - phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits
+    - phy: rockchip: naneng-combphy: Fix mux on rk3588
+    - phy: qcom: m31: match requested regulator name with dt schema
+    - dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue
+    - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
+    - riscv: Fix TASK_SIZE on 64-bit NOMMU
+    - riscv: Fix loading 64-bit NOMMU kernels past the start of RAM
+    - phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered
+    - dt-bindings: eeprom: at24: Fix ST M24C64-D compatible schema
+    - sched/eevdf: Always update V if se->on_rq when reweighting
+    - sched/eevdf: Fix miscalculation in reweight_entity() when se is not curr
+    - riscv: hwprobe: fix invalid sign extension for RISCV_HWPROBE_EXT_ZVFHMIN
+    - RISC-V: selftests: cbo: Ensure asm operands match constraints, take 2
+    - phy: qcom: qmp-combo: fix VCO div offset on v5_5nm and v6
+    - bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
+    - Bluetooth: hci_sync: Fix UAF in hci_acl_create_conn_sync
+    - Bluetooth: hci_sync: Fix UAF on create_le_conn_complete
+    - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync
+    - Linux 6.8.9
+  * amdgpu hangs on DCN 3.5 at bootup: RIP:
+    0010:dcn35_clk_mgr_construct+0x183/0x2210 [amdgpu] (LP: #2066233)
+    - drm/amd/display: Atom Integrated System Info v2_2 for DCN35
+  * [MTL] ACPI: PM: s2idle: Backport Linux ACPI s2idle patches to fix
+    suspend/resume issue (LP: #2069231)
+    - ACPI: PM: s2idle: Enable Low-Power S0 Idle MSFT UUID for non-AMD systems
+    - ACPI: PM: s2idle: Evaluate all Low-Power S0 Idle _DSM functions
+  * Removing legacy virtio-pci devices causes kernel panic (LP: #2067862)
+    - virtio-pci: Check if is_avq is NULL
+  * Mute/mic LEDs no function on ProBook 445/465 G11 (LP: #2069664)
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465 G11.
+  * Mute/mic LEDs no function on  ProBook 440/460 G11 (LP: #2067669)
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11.
+  * rtw89_8852ce - Lost WIFI connection after suspend  (LP: #2065128)
+    - wifi: rtw89: reset AFEDIG register in power off sequence
+    - wifi: rtw89: 8852c: refine power sequence to imporve power consumption
+  * CVE-2024-25742
+    - x86/sev: Harden #VC instruction emulation somewhat
+    - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337) //
+    CVE-2024-35984
+    - i2c: smbus: fix NULL function pointer dereference
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337) //
+    CVE-2024-35990
+    - dma: xilinx_dpdma: Fix locking
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337) //
+    CVE-2024-35997
+    - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
+  * CVE-2024-36016
+    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
+  * CVE-2024-36008
+    - ipv4: check for NULL idev in ip_route_use_hint()
+  * CVE-2024-35992
+    - phy: marvell: a3700-comphy: Fix out of bounds read
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 12 Aug 2024 10:40:26 +0900
+
+linux-qcom (6.8.0-1006.6) jammy; urgency=medium
+
+  * [qcom alpha] Suppress noisy logs
+    - SAUCE: ubuntu/qcom/wlan: supress noisy logs
+    - SAUCE: ubuntu/qcom/wlan: supress noisy logs (take 2)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: ubuntu/qcom/wlan: import wlan qclacld driver code from GA1.1
+    - SAUCE: ubuntu/qcom/display: import qcm6490 display code from GA1.1
+    - SAUCE: ubuntu/qcom/graphics: import qcm6490 graphics driver code from GA1.1
+    - SAUCE: ubuntu/qcom/camera: import qcm6490 camera driver code from GA1.1
+    - SAUCE: ubuntu/qcom/bt: import qcm6490 bluetooth driver from GA1.1
+    - SAUCE: ubuntu/qcom/qps615: import ethernet driver from GA1.1
+    - SAUCE: ubuntu/qcom: build external drivers
+    - SAUCE: ubuntu/qcom: suppress warning and error
+    - SAUCE: ubuntu/qcom/wlan: fix build warnings and errors in WLAN driver
+    - SAUCE: ubuntu/qcom/graphics: change strtobool() to kstrtobool()
+    - SAUCE: ubuntu/qcom/graphics: dynamically allocate the kgsl-pool shrinker for
+      kernel>=6.7
+    - SAUCE: ubuntu/qcom/camera: remove unused camera_banner
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: auto-load module
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: ubuntu/qcom/display: Rename min_buffers_needed to min_queued_buffers
+    - SAUCE: ubuntu/qcom: remove DRM_UNLOCKED
+    - SAUCE: ubuntu/qcom/display: suppress EPROBE_DEFER error log
+    - SAUCE: qcom/bt: support uevent module loading
+    - SAUCE: qcom/bt: add sentinel to MODULE_DEVICE_TABLE()
+    - SAUCE: import external DT from GA 1.1
+    - SAUCE: Add Makefile code to apply overlays for GA1
+
+  * Miscellaneous upstream changes
+    - QCLINUX: regulator: qcom-rpmh-regulator: Add debug-regulator support
+    - PENDING: arm64: dts: qcom: qcs8550-rb5gen2: enable PMIC Volume and Power
+      buttons
+    - FROMLIST: dt-bindings: arm: qcom,ids: Add SoC ID for SM8650P
+    - FROMLIST: soc: qcom: socinfo: Add SM8650P SoC ID table entry
+    - PENDING: slimbus: messaging: use memcpy_fromio for io mapped memory
+    - FROMLIST: arm64: dts: qcom: sm8650p: introduce sm8650p dtsi
+    - FROMLIST: arm64: dts: qcom: add base AIM500 dtsi
+    - FROMLIST: arm64: dts: qcom: add AIM500 AIoT
+    - PENDING: arm64: qcom: dts: qcs8550: Add modem rproc node
+    - QCLINUX: soc: qcom: f_qdss: Initialize qdss channel with NULL
+    - PENDING: misc: fastrpc: Check for static PD status
+    - QCLINUX: soc: qcom: Use SoC watchdog when Linux boots in hyp mode
+    - QCLINUX: arm64: dts: qcom: qcm6490: Leave SoC watchdog enabled
+    - QCLINUX: arm64: Enable watchdog configuration through sysfs
+    - QCLINUX: soc: qcom: Make SoC debug module as builtin module
+    - FROMLIST: soc: qcom: aoss: Add tracepoints in qmp_send()
+    - PENDING: arm64: dts: qcom: sc7280: Add gpio for sec MI2S mclk
+    - QCLINUX: arm64: dts: qcom: Add addons support for AIM500 AIoT
+    - QCLINUX: arm64: defconfig: qcom: enable SM8650 related config
+    - QCLINUX: arm64: dts: qcom: aim300: Add board-id and msm-id support
+    - PENDING: misc: fastrpc: Fix use after free on devices
+    - PENDING: arm64: dts: qcom: qcs8550-rb5gen2: Add definition for three LEDs
+    - PENDING: arm64: dts: qcom: qcs8550-rb5gen2: Add definitions for flash leds
+    - PENDING: iommu/arm-smmu-qcom: Fix an empty list_head accessing
+    - PENDING: trece: buses: Change __assign_str to __assign_str_len
+    - PENDING: spi: spi-geni-qcom: add trace log support
+    - Revert "QCLINUX: arm64: configs: qcom_defconfig: Disable NVMEM_REBOOT_MODE"
+    - PENDING: i2c: i2c-qcom-geni: Add trace log support
+    - PENDING: arm64: dts: qcom: sm8550: add slimbus DT node
+    - PENDING: arm64: dts: qcm6490: Disable nvmem-reboot-mode
+    - QCLINUX: usb: dwc3: Initialize variable ret to 0
+    - QCLINUX: usb: dwc3: qcom: Take wakelock to block pm suspend in autosleep
+    - PENDING: soc: qcom: memory_dump: initialize initialized value
+    - PENDING: arm64: dts: qcom: qcs6490-rb3gen2: disable ipa node on qcs6490
+    - PENDING: arm64: dts: qcom: Enable PCIe1 on aim500
+    - QCLINUX: arm64: dts: qcom: Add support for qps615 switch
+    - QCLINUX: arm64: defconfig: Enable ARM64_VA=39
+    - PENDING: arm64: dts: qcom: qcs6490-rb3gen2: Modify DVT device USB2
+    - QCLINUX: virt: gunyah: Use kvcalloc for tracking large number of pages
+    - PENDING: firmware: Error handling in qcom_scm_prepare_ice_key
+    - PENDING: arm64: dts: qcom: sa8775p: Add UART node
+    - QCLINUX: arm64: dts: qcom: Rename regulators for QCM6490
+    - PENDING: power: supply: qcom_battmgr: Add support to configure USB ICL
+    - QCLINUX: soc: qcom: Don't assume that soc watchdog is enabled by default
+    - PENDING: arm64: dts: Add missing clkreq pin configuration
+    - PENDING: arm64: dts: qcom: sa8775p: Add GPI configuration
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for Rb3Gen2
+    - QCLINUX: arm64: defconfig: Add AQC107 config
+    - QCLINUX: usb: dwc3: qcom: Avoid PM Resume if device is RT suspended
+    - PENDING: Bluetooth: Increase settling time for baudrate change VSC
+    - PENDING: remoteproc: qcom: pas: Add SA8775p remoteproc support
+    - PENDING: arm64: dts: qcom: sa8775p: add ADSP and CDSP support
+    - QCLINUX: arm64: dts: qcom: sa8775p: add addons dts support for sa8775p
+    - PENDING: arm64: dts: qcom: sa8775p: enable CDSP for SA8775p
+    - PENDING: remoteproc: qcom: pas: Add SA8775p CDSP1 remoteproc support
+    - PENDING: arm64: dts: qcom: sa8775p: add CDSP1 support
+    - PENDING: arm64: dts: qcom: sa8775p: enable CDSP1 for SA8775p
+    - PENDING: dt-bindings: mailbox: qcom-ipcc: Add GPDSP0 and GPDSP1 client
+    - PENDING: remoteproc: qcom: pas: Add SA8775p GPDSP0 and GPDSP1 remoteproc
+      support
+    - PENDING: arm64: dts: qcom: sa8775p: add GPDSP0 and GPDSP1 support
+    - QCLINUX: arm64: defconfig: Enable STMMAC eth and Marvell phy config
+    - PENDING: uapi: add userspace interface file to uapi
+    - PENDING: soc: qcom: llcc: add llcc config support for SA8775p platform
+    - PENDING: arm64: dts: qcom: sa8775p: Add llcc support for SA8775p platform
+    - PENDING: arm64: dts: qcom: sa8775p-ride: Enable llcc function
+    - QCLINUX: arm64: defconfig: qcom: Enable i3c support
+    - PENDING: soc: qcom: smem: Add boundary checks for partitions
+    - PENDING: crypto: qce - Fetch interconnect bandwidth value from dtsi
+    - PENDING: arm64: dts: qcom: sc7280: Define interconnect bandwidth value in
+      dtsi
+    - QCLINUX: rpmsg: glink: replace deprecated 'strcpy' with 'strscpy'
+    - QCLINUX: arm64: defconfig: enable configs required for kubernetes
+    - PENDING: slimbus: ngd: Add check before memory free
+    - QCLINUX: arm64: dts: qcom: sa8775p: add dma-buf heaps
+    - QCLINUX: arm64: dts: qcom: sa8775p: add secure buffer device
+    - QCLINUX: arm64: dts: qcom: sa8775p: add mem-buf device
+    - QCLINUX: arm64: dts: qcm6490-addons: Update memory dump table
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add gunyah watchdog support
+    - PENDING: pcie: Save & restore configuration space for qps615
+    - QCLINUX: thermal: qcom: Add support to update tsens trip based on nvmem data
+    - PENDING: arm64: dts: qcom: sa8775p: Add IMEM and PIL info region
+    - QCLINUX: arm64: dts: qcom: sa8775p: define kaslr offset and mem dump table
+      regions
+    - QCLINUX: arm64: dts: qcom: sa8775p-ride: Add board-id and msm-id support
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add shmbridge and smcinvoke nodes
+    - FROMLIST: arm64: dts: qcom: qcm8550: introduce qcs8550 dtsi
+    - PENDING: arm64: qcom: dts: qcs8550: Update included dtsi name for rb5gen2
+    - QCLINUX: arm64: dts: qcom: qcs8550: update qcs8550 addons dtsi file name
+    - PENDING: arm64: dts: qcom: sa8775p: enable ADSP and GPDSP for SA8775p
+    - PENDING: USB: pci-quirks: skip usb_early_handoff for Renesas PCI USB
+    - PENDING: coresight-tmc-etf: fix failure to disable/enable ETF after reading
+    - QCLINUX: PCI: qcom: Enable powering up upd controller
+    - QCLINUX: ASoC: qcm6490: Update channel slot number for slimbus codec dai
+    - PENDING: arm64: dts: qcom: aim500: Add more reserved gpio pins
+    - PENDING: soc: qcom: ice: Handle ice probe return
+    - PENDING: usb: dwc3: core: Handle failure of get sync during cable disconnect
+    - PENDING: arm64: dts: qcom: sa8775p: Enable smp2p-sleepstate
+    - QCLINUX: clk: qcom: gcc-sa8775p: Remove the HW control clocks on SA8775P
+    - PENDING: iris: Disable slice mode for VBR rate control
+    - PENDING: usb: dwc3: qcom: Introduce post-connection done vendor hook
+    - PENDING: misc: fastrpc: Add support for cdsp1 remoteproc
+    - QCLINUX: arm64: dts: qcom: Enable tsens dynamic trip update for qcm6490
+    - PENDING: crypto: qce - Bam crash during suspend-shutdown scenario
+    - PENDING: arm64: dts: qcom: sa8775p-ride: add Bluetooth support
+    - PENDING: arm64: dts: qcom: sa8775p: add CDSP1 fastrpc-compute-cb nodes
+    - PENDING: dt-bindings: clock: qcom: Add SA8775P video clock controller
+    - PENDING: clk: qcom: Add support for Video clock controller on SA8775P
+    - PENDING: dt-bindings: clock: qcom: Add SA8775P camera controller
+    - PENDING: clk: qcom: Add support for Camera Clock Controller on SA8775P
+    - PENDING: dt-bindings: clock: qcom: Add SA8775P display controller
+    - PENDING: clk: qcom: Add support for Display Controllers on SA8775P
+    - PENDING: clk: qcom: Remove the CLK_IS_CRITICAL flag for SA8775P
+    - QCLINUX: arm64: defconfig: enable Clock controllers SA8775P
+    - PENDING: arm64: dts: qcom: sa8775p: add clock controllers support
+    - QCLINUX: arm64: dts: qcs5430-rb3: Enable PCIE1
+    - FROMLIST: PCI: hold the rescan mutex when scanning for the first time
+    - FROMLIST: PCI/pwrctl: reuse the OF node for power controlled devices
+    - FROMLIST: PCI/pwrctl: create platform devices for child OF nodes of the port
+      node
+    - FROMLIST: PCI/pwrctl: add PCI power control core code
+    - FROMLIST: power: sequencing: implement the pwrseq core
+    - FROMLIST: power: pwrseq: add a driver for the PMU module on the QCom WCN
+      chipsets
+    - FROMLIST: PCI/pwrctl: add a PCI power control driver for power sequenced
+      devices
+    - PENDING: PCI/pwrctl: enable power control for WCN6855
+    - PENDING: power: pwrseq: add WCN6855 PMU support
+    - PENDING: arm64: dts: qcom: sa8775p-ride: add pmu node for WCN6855
+    - PENDING: Bluetooth: hci_qca: Drop unused event during BT on
+    - config: enable PCA953x PCA954x and ANX7625 driver
+    - PENDING: drm/bridge: anx7625: Fix circular dependency
+    - PENDING: iris: devicetree: remove iommu and video enc dec nodes
+    - PENDING: videocc: remove HW_CTRL from mvs0 gdsc
+    - PENDING: interconnect: qcom: sa8775p: enable qos programming
+    - PENDING: arm64: dts: qcom: sa8775p: Add reg field & clocks to program QoS
+    - PENDING: arm64: dts: qcom: Add SD Card node for qcm6490-rb3
+    - QCLINUX: arm64: dts: qcom: qcs6490: Add PCIe bridge and endpoint nodes
+    - QCLINUX: arm64: dts: qcom:Add QPS615 and PHY devicestree config
+    - QCLINUX: arm64: configs: qcom_defconfig: Enable NVMEM_REBOOT_MODE
+    - QCLINUX: arm64: defconfig: qcom: Disable ASPM
+    - PENDING: usb: dwc3: qcom: Check if driver is resumed before reg access
+    - PENDING: arm64: dts: qcom: sa8775p-ride: Change swctrl-gpios in BT
+    - PENDING: arm64: dts: qcom: sa8775p-pmics: enable rtc
+    - QCLINUX: arm64: dts: qcom: sa8775p-addons: Add CMA heap
+    - QCLINUX: arm64: defconfig: Enable vsock support
+    - QCLINUX: arm64: defconfig: Host kernel accelerator for virtio net
+    - QCLINUX: arm64: defconfig: Enable required virtio configs for VM
+    - QCLINUX: arm64: defconfig: Enable watchdog drivers for VM
+    - FROMLIST: drivers: qcom: icc-bwmon: Change zone1_thres_count to 3
+    - PENDING: crypto: qce - remove return values from qce_crypto_probe()
+    - thermal: re-add thermal_zone_set_trip()
+    - thermal: tsens: remove use of thermal_zone_device_exec()
+    - Revert "net: phylink: remove .validate() method"
+    - Ubuntu [Config] update configs for GA 1.1
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 23 Jul 2024 17:25:21 +0900
+
+linux-qcom (6.8.0-1005.5) jammy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] drop getabis data
+
+  * [RB3] Kernel back trace while audio play
+    - Revert "ASoC: qcom: Move Soundwire runtime stream alloc to soundcards"
+
+  * [qcom alpha] Suppress noisy logs
+    - SAUCE: ubuntu/qcom/wlan: supress noisy logs (take 2)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: qcom/bt: support uevent module loading
+    - SAUCE: qcom/bt: add sentinel to MODULE_DEVICE_TABLE()
+
+  [ Ubuntu: 6.8.0-38.38 ]
+
+  * noble/linux: 6.8.0-38.38 -proposed tracker (LP: #2068318)
+  * race_sched in ubuntu_stress_smoke_test will cause kernel panic on 6.8 with
+    Azure Standard_A2_v2 instance (LP: #2068024)
+    - sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()
+  * Noble: btrfs: re-introduce 'norecovery' mount option (LP: #2068591)
+    - btrfs: re-introduce 'norecovery' mount option
+  * Fix system hang while entering suspend with AMD Navi3x graphics
+    (LP: #2063417)
+    - drm/amdgpu/mes: fix use-after-free issue
+  * Noble update: v6.8.8 upstream stable release (LP: #2068087)
+    - io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64()
+      failure
+    - drm/i915/cdclk: Fix voltage_level programming edge case
+    - Revert "vmgenid: emit uevent when VMGENID updates"
+    - SUNRPC: Fix rpcgss_context trace event acceptor field
+    - selftests/ftrace: Limit length in subsystem-enable tests
+    - random: handle creditable entropy from atomic process context
+    - scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING
+    - net: usb: ax88179_178a: avoid writing the mac address before first reading
+    - btrfs: do not wait for short bulk allocation
+    - btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
+    - r8169: fix LED-related deadlock on module removal
+    - r8169: add missing conditional compiling for call to r8169_remove_leds
+    - scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5
+    - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
+    - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
+    - netfilter: br_netfilter: skip conntrack input hook for promisc packets
+    - netfilter: nft_set_pipapo: constify lookup fn args where possible
+    - netfilter: nft_set_pipapo: walk over current view on netlink dump
+    - netfilter: flowtable: validate pppoe header
+    - netfilter: flowtable: incorrect pppoe tuple
+    - af_unix: Call manage_oob() for every skb in unix_stream_read_generic().
+    - af_unix: Don't peek OOB data without MSG_OOB.
+    - net: sparx5: flower: fix fragment flags handling
+    - net/mlx5: Lag, restore buckets number to default after hash LAG deactivation
+    - net/mlx5: Restore mistakenly dropped parts in register devlink flow
+    - net/mlx5e: Prevent deadlock while disabling aRFS
+    - net: change maximum number of UDP segments to 128
+    - octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation
+    - selftests/tcp_ao: Make RST tests less flaky
+    - selftests/tcp_ao: Zero-init tcp_ao_info_opt
+    - selftests/tcp_ao: Fix fscanf() call for format-security
+    - selftests/tcp_ao: Printing fixes to confirm with format-security
+    - net: stmmac: Apply half-duplex-less constraint for DW QoS Eth only
+    - net: stmmac: Fix max-speed being ignored on queue re-init
+    - net: stmmac: Fix IP-cores specific MAC capabilities
+    - ice: tc: check src_vsi in case of traffic from VF
+    - ice: tc: allow zero flags in parsing tc flower
+    - ice: Fix checking for unsupported keys on non-tunnel device
+    - tun: limit printing rate when illegal packet received by tun dev
+    - net: dsa: mt7530: fix mirroring frames received on local port
+    - net: dsa: mt7530: fix port mirroring for MT7988 SoC switch
+    - s390/ism: Properly fix receive message buffer allocation
+    - netfilter: nf_tables: missing iterator type in lookup walk
+    - netfilter: nf_tables: restore set elements when delete set fails
+    - gpiolib: swnode: Remove wrong header inclusion
+    - netfilter: nf_tables: fix memleak in map from abort path
+    - net/sched: Fix mirred deadlock on device recursion
+    - net: ethernet: mtk_eth_soc: fix WED + wifi reset
+    - ravb: Group descriptor types used in Rx ring
+    - net: ravb: Count packets instead of descriptors in R-Car RX path
+    - net: ravb: Allow RX loop to move past DMA mapping errors
+    - net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them
+    - NFSD: fix endianness issue in nfsd4_encode_fattr4
+    - RDMA/rxe: Fix the problem "mutex_destroy missing"
+    - RDMA/cm: Print the old state when cm_destroy_id gets timeout
+    - RDMA/mlx5: Fix port number for counter query in multi-port configuration
+    - perf annotate: Make sure to call symbol__annotate2() in TUI
+    - perf lock contention: Add a missing NULL check
+    - s390/qdio: handle deferred cc1
+    - s390/cio: fix race condition during online processing
+    - iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest
+    - iommufd: Add config needed for iommufd_fail_nth
+    - drm: nv04: Fix out of bounds access
+    - drm/v3d: Don't increment `enabled_ns` twice
+    - userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE
+    - thunderbolt: Introduce tb_port_reset()
+    - thunderbolt: Introduce tb_path_deactivate_hop()
+    - thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4
+      routers
+    - thunderbolt: Reset topology created by the boot firmware
+    - drm/panel: visionox-rm69299: don't unregister DSI device
+    - drm/radeon: make -fstrict-flex-arrays=3 happy
+    - ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4
+    - thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()
+    - platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes
+    - interconnect: qcom: x1e80100: Remove inexistent ACV_PERF BCM
+    - interconnect: Don't access req_list while it's being manipulated
+    - clk: Remove prepare_lock hold assertion in __clk_release()
+    - clk: Initialize struct clk_core kref earlier
+    - clk: Get runtime PM before walking tree during disable_unused
+    - clk: Get runtime PM before walking tree for clk_summary
+    - clk: mediatek: Do a runtime PM get on controllers during probe
+    - clk: mediatek: mt7988-infracfg: fix clocks for 2nd PCIe port
+    - selftests/powerpc/papr-vpd: Fix missing variable initialization
+    - x86/bugs: Fix BHI retpoline check
+    - x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
+    - block: propagate partition scanning errors to the BLKRRPART ioctl
+    - net/mlx5: E-switch, store eswitch pointer before registering devlink_param
+    - ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages
+    - ALSA: hda/tas2781: correct the register for pow calibrated data
+    - ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N
+    - ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC
+    - usb: misc: onboard_usb_hub: Disable the USB hub clock on failure
+    - misc: rtsx: Fix rts5264 driver status incorrect when card removed
+    - thunderbolt: Avoid notify PM core about runtime PM resume
+    - thunderbolt: Fix wake configurations after device unplug
+    - thunderbolt: Do not create DisplayPort tunnels on adapters of the same
+      router
+    - comedi: vmk80xx: fix incomplete endpoint checking
+    - serial: mxs-auart: add spinlock around changing cts state
+    - serial/pmac_zilog: Remove flawed mitigation for rx irq flood
+    - serial: 8250_dw: Revert: Do not reclock if already at correct rate
+    - serial: stm32: Return IRQ_NONE in the ISR if no handling happend
+    - serial: stm32: Reset .throttled state in .startup()
+    - serial: core: Fix regression when runtime PM is not enabled
+    - serial: core: Clearing the circular buffer before NULLifying it
+    - serial: core: Fix missing shutdown and startup for serial base port
+    - USB: serial: option: add Fibocom FM135-GL variants
+    - USB: serial: option: add support for Fibocom FM650/FG650
+    - USB: serial: option: add Lonsung U8300/U9300 product
+    - USB: serial: option: support Quectel EM060K sub-models
+    - USB: serial: option: add Rolling RW101-GL and RW135-GL support
+    - USB: serial: option: add Telit FN920C04 rmnet compositions
+    - Revert "usb: cdc-wdm: close race between read and workqueue"
+    - usb: dwc2: host: Fix dereference issue in DDMA completion flow.
+    - usb: Disable USB3 LPM at shutdown
+    - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport
+      error
+    - usb: typec: tcpm: Correct the PDO counting in pd_set
+    - mei: me: disable RPL-S on SPS and IGN firmwares
+    - speakup: Avoid crash on very long word
+    - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
+    - sched: Add missing memory barrier in switch_mm_cid
+    - KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible
+    - KVM: x86/pmu: Disable support for adaptive PEBS
+    - KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms
+    - KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes
+    - KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
+    - arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H
+    - arm64: hibernate: Fix level3 translation fault in swsusp_save()
+    - init/main.c: Fix potential static_command_line memory overflow
+    - mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly
+    - mm/userfaultfd: allow hugetlb change protection upon poison entry
+    - mm,swapops: update check in is_pfn_swap_entry for hwpoison entries
+    - mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled
+    - mm/shmem: inline shmem_is_huge() for disabled transparent hugepages
+    - fuse: fix leaked ENOSYS error on first statx call
+    - drm/amdkfd: Fix memory leak in create_process failure
+    - drm/amdgpu: remove invalid resource->start check v2
+    - drm/ttm: stop pooling cached NUMA pages v2
+    - drm/xe: Fix bo leak in intel_fb_bo_framebuffer_init
+    - drm/vmwgfx: Fix prime import/export
+    - drm/vmwgfx: Sort primary plane formats by order of preference
+    - drm/vmwgfx: Fix crtc's atomic check conditional
+    - nouveau: fix instmem race condition around ptr stores
+    - bootconfig: use memblock_free_late to free xbc memory to buddy
+    - Squashfs: check the inode number is not the invalid value of zero
+    - nilfs2: fix OOB in nilfs_set_de_type
+    - fork: defer linking file vma until vma is fully initialized
+    - net: dsa: mt7530: fix improper frames on all 25MHz and 40MHz XTAL MT7530
+    - net: dsa: mt7530: fix enabling EEE on MT7531 switch on all boards
+    - ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
+    - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
+    - ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
+    - ksmbd: common: use struct_group_attr instead of struct_group for
+      network_open_info
+    - thunderbolt: Reset only non-USB4 host routers in resume
+    - Linux 6.8.8
+  * Fix inaudible HDMI/DP audio on USB-C MST dock (LP: #2064689)
+    - drm/i915/audio: Fix audio time stamp programming for DP
+  * Add Cirrus Logic CS35L56 amplifier support (LP: #2062135)
+    - ALSA: hda: realtek: Re-work CS35L41 fixups to re-use for other amps
+    - ALSA: hda/realtek: Add quirks for HP G11 Laptops using CS35L56
+  * net:fib_rule_tests.sh in ubuntu_kselftests_net fails on Noble (LP: #2066332)
+    - Revert "UBUNTU: SAUCE: selftests: net: fix "from" match test in
+      fib_rule_tests.sh"
+  * mtk_t7xx WWAN module fails to probe with: Invalid device status 0x1
+    (LP: #2049358)
+    - Revert "UBUNTU: SAUCE: net: wwan: t7xx: PCIe reset rescan"
+    - Revert "UBUNTU: SAUCE: net: wwan: t7xx: Add AP CLDMA"
+    - net: wwan: t7xx: Add AP CLDMA
+    - wwan: core: Add WWAN fastboot port type
+    - net: wwan: t7xx: Add sysfs attribute for device state machine
+    - net: wwan: t7xx: Infrastructure for early port configuration
+    - net: wwan: t7xx: Add fastboot WWAN port
+  * Pull-request to address TPM bypass issue (LP: #2037688)
+    - [Config]: Configure TPM drivers as builtins for arm64 in annotations
+  * re-enable Ubuntu FAN in the Noble kernel (LP: #2064508)
+    - SAUCE: fan: add VXLAN implementation
+    - SAUCE: fan: Fix NULL pointer dereference
+    - SAUCE: fan: support vxlan strict length validation
+  * update for V3 kernel bits and improved multiple fan slice support
+    (LP: #1470091) // re-enable Ubuntu FAN in the Noble kernel (LP: #2064508)
+    - SAUCE: fan: tunnel multiple mapping mode (v3)
+  * TCP memory  leak, slow network (arm64) (LP: #2045560)
+    - net: make SK_MEMORY_PCPU_RESERV tunable
+    - net: fix sk_memory_allocated_{add|sub} vs softirqs
+  * panel flickering after the i915.psr2 is enabled (LP: #2046315)
+    - drm/i915/alpm: Add ALPM register definitions
+    - drm/i915/psr: Add alpm_parameters struct
+    - drm/i915/alpm: Calculate ALPM Entry check
+    - drm/i915/alpm: Alpm aux wake configuration for lnl
+    - drm/i915/display: Make intel_dp_aux_fw_sync_len available for PSR code
+    - drm/i915/psr: Improve fast and IO wake lines calculation
+    - drm/i915/psr: Calculate IO wake and fast wake lines for DISPLAY_VER < 12
+    - drm/i915/display: Increase number of fast wake precharge pulses
+  * I2C HID device sometimes fails to initialize causing touchpad to not work
+    (LP: #2061040)
+    - HID: i2c-hid: Revert to await reset ACK before reading report descriptor
+  * Fix the RTL8852CE BT FW Crash based on SER false alarm (LP: #2060904)
+    - wifi: rtw89: disable txptctrl IMR to avoid flase alarm
+    - wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of
+      firmware command
+  * [X13s] Fingerprint reader is not working (LP: #2065376)
+    - SAUCE: arm64: dts: qcom: sc8280xp: Add USB DWC3 Multiport controller
+    - SAUCE: arm64: dts: qcom: sc8280xp-x13s: enable USB MP and fingerprint reader
+  * Fix random HuC/GuC initialization failure of Intel i915 driver
+    (LP: #2061049)
+    - drm/i915/huc: Allow for very slow HuC loading
+  * Add support of TAS2781 amp of audio (LP: #2064064)
+    - ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad
+      ICE-1
+  * Noble update: v6.8.7 upstream stable release (LP: #2065912)
+    - smb3: fix Open files on server counter going negative
+    - ata: libata-core: Allow command duration limits detection for ACS-4 drives
+    - ata: libata-scsi: Fix ata_scsi_dev_rescan() error path
+    - drm/amdgpu/vpe: power on vpe when hw_init
+    - batman-adv: Avoid infinite loop trying to resize local TT
+    - ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE
+    - ceph: switch to use cap_delay_lock for the unlink delay list
+    - virtio_net: Do not send RSS key if it is not supported
+    - arm64: tlb: Fix TLBI RANGE operand
+    - ARM: dts: imx7s-warp: Pass OV2680 link-frequencies
+    - raid1: fix use-after-free for original bio in raid1_write_request()
+    - ring-buffer: Only update pages_touched when a new page is touched
+    - Bluetooth: Fix memory leak in hci_req_sync_complete()
+    - drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11
+    - platform/chrome: cros_ec_uart: properly fix race condition
+    - ACPI: scan: Do not increase dep_unmet for already met dependencies
+    - PM: s2idle: Make sure CPUs will wakeup directly on resume
+    - media: cec: core: remove length check of Timer Status
+    - btrfs: tests: allocate dummy fs_info and root in test_find_delalloc()
+    - ARM: OMAP2+: fix bogus MMC GPIO labels on Nokia N8x0
+    - ARM: OMAP2+: fix N810 MMC gpiod table
+    - mmc: omap: fix broken slot switch lookup
+    - mmc: omap: fix deferred probe
+    - mmc: omap: restore original power up/down steps
+    - ARM: OMAP2+: fix USB regression on Nokia N8x0
+    - firmware: arm_ffa: Fix the partition ID check in ffa_notification_info_get()
+    - firmware: arm_scmi: Make raw debugfs entries non-seekable
+    - cxl/mem: Fix for the index of Clear Event Record Handle
+    - cxl/core/regs: Fix usage of map->reg_type in cxl_decode_regblock() before
+      assigned
+    - arm64: dts: freescale: imx8mp-venice-gw72xx-2x: fix USB vbus regulator
+    - arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix USB vbus regulator
+    - drm/msm: Add newlines to some debug prints
+    - drm/msm/dpu: don't allow overriding data from catalog
+    - drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more
+      sensible
+    - dt-bindings: display/msm: sm8150-mdss: add DP node
+    - arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order
+    - cxl/core: Fix initialization of mbox_cmd.size_out in get event
+    - Revert "drm/qxl: simplify qxl_fence_wait"
+    - nouveau: fix function cast warning
+    - drm/msm/adreno: Set highest_bank_bit for A619
+    - scsi: hisi_sas: Modify the deadline for ata_wait_after_reset()
+    - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
+    - net: openvswitch: fix unwanted error log on timeout policy probing
+    - u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
+    - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
+    - octeontx2-pf: Fix transmit scheduler resource leak
+    - block: fix q->blkg_list corruption during disk rebind
+    - lib: checksum: hide unused expected_csum_ipv6_magic[]
+    - geneve: fix header validation in geneve[6]_xmit_skb
+    - s390/ism: fix receive message buffer allocation
+    - bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()
+    - bnxt_en: Fix error recovery for RoCE ulp client
+    - bnxt_en: Reset PTP tx_avail after possible firmware reset
+    - ACPI: bus: allow _UID matching for integer zero
+    - base/node / ACPI: Enumerate node access class for 'struct access_coordinate'
+    - ACPI: HMAT: Introduce 2 levels of generic port access class
+    - ACPI: HMAT / cxl: Add retrieval of generic port coordinates for both access
+      classes
+    - cxl: Split out combine_coordinates() for common shared usage
+    - cxl: Split out host bridge access coordinates
+    - cxl: Remove checking of iter in cxl_endpoint_get_perf_coordinates()
+    - cxl: Fix retrieving of access_coordinates in PCIe path
+    - net: ks8851: Inline ks8851_rx_skb()
+    - net: ks8851: Handle softirqs at the end of IRQ thread to fix hang
+    - af_unix: Clear stale u->oob_skb.
+    - octeontx2-af: Fix NIX SQ mode and BP config
+    - ipv6: fib: hide unused 'pn' variable
+    - ipv4/route: avoid unused-but-set-variable warning
+    - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
+    - pds_core: use pci_reset_function for health reset
+    - pds_core: Fix pdsc_check_pci_health function to use work thread
+    - Bluetooth: ISO: Align broadcast sync_timeout with connection timeout
+    - Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters are unset
+    - Bluetooth: hci_sync: Use QoS to determine which PHY to scan
+    - Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY
+    - Bluetooth: SCO: Fix not validating setsockopt user input
+    - Bluetooth: RFCOMM: Fix not validating setsockopt user input
+    - Bluetooth: L2CAP: Fix not validating setsockopt user input
+    - Bluetooth: ISO: Fix not validating setsockopt user input
+    - Bluetooth: hci_sock: Fix not validating setsockopt user input
+    - Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit
+    - netfilter: complete validation of user input
+    - net/mlx5: SF, Stop waiting for FW as teardown was called
+    - net/mlx5: Register devlink first under devlink lock
+    - net/mlx5: offset comp irq index in name by one
+    - net/mlx5: Properly link new fs rules into the tree
+    - net/mlx5: Correctly compare pkt reformat ids
+    - net/mlx5e: RSS, Block changing channels number when RXFH is configured
+    - net/mlx5e: Fix mlx5e_priv_init() cleanup flow
+    - net/mlx5e: HTB, Fix inconsistencies with QoS SQs number
+    - net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit
+    - net: sparx5: fix wrong config being used when reconfiguring PCS
+    - Revert "s390/ism: fix receive message buffer allocation"
+    - net: dsa: mt7530: trap link-local frames regardless of ST Port State
+    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
+    - af_unix: Fix garbage collector racing against connect()
+    - net: ena: Fix potential sign extension issue
+    - net: ena: Wrong missing IO completions check order
+    - net: ena: Fix incorrect descriptor free behavior
+    - net: ena: Set tx_info->xdpf value to NULL
+    - drm/xe/display: Fix double mutex initialization
+    - drm/xe/hwmon: Cast result to output precision on left shift of operand
+    - tracing: hide unused ftrace_event_id_fops
+    - iommu/vt-d: Fix wrong use of pasid config
+    - iommu/vt-d: Allocate local memory for page request queue
+    - iommu/vt-d: Fix WARN_ON in iommu probe path
+    - io_uring: refactor DEFER_TASKRUN multishot checks
+    - io_uring: disable io-wq execution of multishot NOWAIT requests
+    - btrfs: qgroup: correctly model root qgroup rsv in convert
+    - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
+    - btrfs: record delayed inode root in transaction
+    - btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans
+    - io_uring/net: restore msg_control on sendzc retry
+    - kprobes: Fix possible use-after-free issue on kprobe registration
+    - fs/proc: remove redundant comments from /proc/bootconfig
+    - fs/proc: Skip bootloader comment if no embedded kernel parameters
+    - scsi: sg: Avoid sg device teardown race
+    - scsi: sg: Avoid race in error handling & drop bogus warn
+    - accel/ivpu: Check return code of ipc->lock init
+    - accel/ivpu: Fix PCI D0 state entry in resume
+    - accel/ivpu: Put NPU back to D3hot after failed resume
+    - accel/ivpu: Return max freq for DRM_IVPU_PARAM_CORE_CLOCK_RATE
+    - accel/ivpu: Fix deadlock in context_xa
+    - drm/vmwgfx: Enable DMA mappings with SEV
+    - drm/i915/vrr: Disable VRR when using bigjoiner
+    - drm/amdkfd: Reset GPU on queue preemption failure
+    - drm/ast: Fix soft lockup
+    - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
+    - drm/client: Fully protect modes[] with dev->mode_config.mutex
+    - drm/msm/dp: fix runtime PM leak on disconnect
+    - drm/msm/dp: fix runtime PM leak on connect failure
+    - drm/amdgpu/umsch: reinitialize write pointer in hw init
+    - arm64: dts: imx8qm-ss-dma: fix can lpcg indices
+    - arm64: dts: imx8-ss-dma: fix can lpcg indices
+    - arm64: dts: imx8-ss-dma: fix adc lpcg indices
+    - arm64: dts: imx8-ss-conn: fix usb lpcg indices
+    - arm64: dts: imx8-ss-dma: fix pwm lpcg indices
+    - arm64: dts: imx8-ss-lsio: fix pwm lpcg indices
+    - arm64: dts: imx8-ss-dma: fix spi lpcg indices
+    - vhost: Add smp_rmb() in vhost_vq_avail_empty()
+    - vhost: Add smp_rmb() in vhost_enable_notify()
+    - perf/x86: Fix out of range data
+    - x86/cpu: Actually turn off mitigations by default for
+      SPECULATION_MITIGATIONS=n
+    - selftests/timers/posix_timers: Reimplement check_timer_distribution()
+    - selftests: timers: Fix posix_timers ksft_print_msg() warning
+    - selftests: timers: Fix abs() warning in posix_timers test
+    - selftests: kselftest: Mark functions that unconditionally call exit() as
+      __noreturn
+    - x86/apic: Force native_apic_mem_read() to use the MOV instruction
+    - irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
+    - selftests: kselftest: Fix build failure with NOLIBC
+    - kernfs: annotate different lockdep class for of->mutex of writable files
+    - x86/bugs: Fix return type of spectre_bhi_state()
+    - x86/bugs: Fix BHI documentation
+    - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
+    - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
+    - x86/bugs: Fix BHI handling of RRSBA
+    - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
+    - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto
+    - [Config] updateconfigs to remove obsolete SPECTRE_BHI_AUTO
+    - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with
+      CONFIG_MITIGATION_SPECTRE_BHI
+    - [Config] updateconfigs to enable new MITIGATION_SPECTRE_BHI
+    - drm/i915/cdclk: Fix CDCLK programming order when pipes are active
+    - drm/i915/psr: Disable PSR when bigjoiner is used
+    - drm/i915: Disable port sync when bigjoiner is used
+    - drm/i915: Disable live M/N updates when using bigjoiner
+    - drm/amdgpu: Reset dGPU if suspend got aborted
+    - drm/amdgpu: always force full reset for SOC21
+    - drm/amdgpu: fix incorrect number of active RBs for gfx11
+    - drm/amdgpu: differentiate external rev id for gfx 11.5.0
+    - drm/amd/display: Program VSC SDP colorimetry for all DP sinks >= 1.4
+    - drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST
+    - drm/amd/display: Do not recursively call manual trigger programming
+    - drm/amd/display: Return max resolution supported by DWB
+    - drm/amd/display: always reset ODM mode in context when adding first plane
+    - drm/amd/display: fix disable otg wa logic in DCN316
+    - Linux 6.8.7
+  * Noble update: v6.8.6 upstream stable release (LP: #2065899)
+    - amdkfd: use calloc instead of kzalloc to avoid integer overflow
+    - wifi: ath9k: fix LNA selection in ath_ant_try_scan()
+    - wifi: rtw89: fix null pointer access when abort scan
+    - bnx2x: Fix firmware version string character counts
+    - net: stmmac: dwmac-starfive: Add support for JH7100 SoC
+    - net: phy: phy_device: Prevent nullptr exceptions on ISR
+    - wifi: rtw89: pci: validate RX tag for RXQ and RPQ
+    - wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor
+    - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
+    - wifi: iwlwifi: pcie: Add the PCI device id for new hardware
+    - arm64: dts: qcom: qcm6490-idp: Add definition for three LEDs
+    - net: dsa: qca8k: put MDIO controller OF node if unavailable
+    - arm64: dts: qcom: qrb2210-rb1: disable cluster power domains
+    - printk: For @suppress_panic_printk check for other CPU in panic
+    - panic: Flush kernel log buffer at the end
+    - dump_stack: Do not get cpu_sync for panic CPU
+    - wifi: iwlwifi: pcie: Add new PCI device id and CNVI
+    - cpuidle: Avoid potential overflow in integer multiplication
+    - ARM: dts: rockchip: fix rk3288 hdmi ports node
+    - ARM: dts: rockchip: fix rk322x hdmi ports node
+    - arm64: dts: rockchip: fix rk3328 hdmi ports node
+    - arm64: dts: rockchip: fix rk3399 hdmi ports node
+    - net: add netdev_lockdep_set_classes() to virtual drivers
+    - arm64: dts: qcom: qcs6490-rb3gen2: Declare GCC clocks protected
+    - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
+    - pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain
+    - ACPI: resource: Add IRQ override quirk for ASUS ExpertBook B2502FBA
+    - ionic: set adminq irq affinity
+    - net: skbuff: add overflow debug check to pull/push helpers
+    - firmware: tegra: bpmp: Return directly after a failed kzalloc() in
+      get_filename()
+    - wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro
+    - wifi: mt76: mt7915: add locking for accessing mapped registers
+    - wifi: mt76: mt7996: disable AMSDU for non-data frames
+    - wifi: mt76: mt7996: add locking for accessing mapped registers
+    - ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of
+      CONFIG_X86_ANDROID_TABLETS
+    - ACPI: x86: Add DELL0501 handling to acpi_quirk_skip_serdev_enumeration()
+    - pstore/zone: Add a null pointer check to the psz_kmsg_read
+    - tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
+    - net: pcs: xpcs: Return EINVAL in the internal methods
+    - dma-direct: Leak pages on dma_set_decrypted() failure
+    - wifi: ath11k: decrease MHI channel buffer length to 8KB
+    - iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev
+    - cpufreq: Don't unregister cpufreq cooling on CPU hotplug
+    - overflow: Allow non-type arg to type_max() and type_min()
+    - wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm
+    - wifi: cfg80211: check A-MSDU format more carefully
+    - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
+    - btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
+    - btrfs: send: handle path ref underflow in header iterate_inode_ref()
+    - ice: use relative VSI index for VFs instead of PF VSI number
+    - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
+    - netdev: let netlink core handle -EMSGSIZE errors
+    - Bluetooth: btintel: Fix null ptr deref in btintel_read_version
+    - Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922
+    - Bluetooth: Add new quirk for broken read key length on ATS2851
+    - drm/vc4: don't check if plane->state->fb == state->fb
+    - drm/ci: uprev mesa version: fix kdl commit fetch
+    - drm/amdgpu: Skip do PCI error slot reset during RAS recovery
+    - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
+    - drm: panel-orientation-quirks: Add quirk for GPD Win Mini
+    - ASoC: SOF: amd: Optimize quirk for Valve Galileo
+    - drm/ttm: return ENOSPC from ttm_bo_mem_space v3
+    - scsi: ufs: qcom: Avoid re-init quirk when gears match
+    - drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz
+    - pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
+    - sysv: don't call sb_bread() with pointers_lock held
+    - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
+    - drm/amd/display: Disable idle reallow as part of command/gpint execution
+    - isofs: handle CDs with bad root inode but good Joliet root directory
+    - ASoC: Intel: sof_rt5682: dmi quirk cleanup for mtl boards
+    - ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710)
+      laptops
+    - rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()
+    - rcu-tasks: Repair RCU Tasks Trace quiescence check
+    - Julia Lawall reported this null pointer dereference, this should fix it.
+    - media: sta2x11: fix irq handler cast
+    - ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block
+      counter
+    - drm/panel: simple: Add BOE BP082WX1-100 8.2" panel
+    - x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o
+    - ASoC: Intel: avs: Populate board selection with new I2S entries
+    - ext4: add a hint for block bitmap corrupt state in mb_groups
+    - ext4: forbid commit inconsistent quota data when errors=remount-ro
+    - drm/amd/display: Fix nanosec stat overflow
+    - accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings
+    - i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC
+    - HID: input: avoid polling stylus battery on Chromebook Pompom
+    - drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
+    - drm: Check output polling initialized before disabling
+    - drm: Check polling initialized before enabling in
+      drm_helper_probe_single_connector_modes
+    - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned
+      int
+    - PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge
+    - Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
+    - libperf evlist: Avoid out-of-bounds access
+    - crypto: iaa - Fix async_disable descriptor leak
+    - input/touchscreen: imagis: Correct the maximum touch area value
+    - drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09
+    - block: prevent division by zero in blk_rq_stat_sum()
+    - RDMA/cm: add timeout to cm_destroy_id wait
+    - Input: imagis - use FIELD_GET where applicable
+    - Input: allocate keycode for Display refresh rate toggle
+    - platform/x86: acer-wmi: Add support for Acer PH16-71
+    - platform/x86: acer-wmi: Add predator_v4 module parameter
+    - platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi
+      Vi8 tablet
+    - perf/x86/amd/lbr: Discard erroneous branch entries
+    - ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9
+    - ktest: force $buildonly = 1 for 'make_warnings_file' test type
+    - Input: xpad - add support for Snakebyte GAMEPADs
+    - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent
+      environment
+    - tools: iio: replace seekdir() in iio_generic_buffer
+    - bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state
+    - kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in
+      kernfs_find_and_get_node_by_id()
+    - usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk
+    - thunderbolt: Calculate DisplayPort tunnel bandwidth after DPRX capabilities
+      read
+    - usb: gadget: uvc: refactor the check for a valid buffer in the pump worker
+    - usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR
+    - usb: typec: ucsi: Limit read size on v1.2
+    - serial: 8250_of: Drop quirk fot NPCM from 8250_port
+    - thunderbolt: Keep the domain powered when USB4 port is in redrive mode
+    - usb: typec: tcpci: add generic tcpci fallback compatible
+    - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
+    - ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE
+    - thermal/of: Assume polling-delay(-passive) 0 when absent
+    - ASoC: soc-core.c: Skip dummy codec when adding platforms
+    - x86/xen: attempt to inflate the memory balloon on PVH
+    - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
+    - io_uring: clear opcode specific data for an early failure
+    - modpost: fix null pointer dereference
+    - drivers/nvme: Add quirks for device 126f:2262
+    - fbmon: prevent division by zero in fb_videomode_from_videomode()
+    - ALSA: hda/realtek: Add quirks for some Clevo laptops
+    - drm/amdgpu: Init zone device and drm client after mode-1 reset on reload
+    - gcc-plugins/stackleak: Avoid .head.text section
+    - media: mediatek: vcodec: Fix oops when HEVC init fails
+    - media: mediatek: vcodec: adding lock to protect decoder context list
+    - media: mediatek: vcodec: adding lock to protect encoder context list
+    - randomize_kstack: Improve entropy diffusion
+    - platform/x86/intel/hid: Don't wake on 5-button releases
+    - platform/x86: intel-vbtn: Update tablet mode switch at end of probe
+    - nouveau: fix devinit paths to only handle display on GSP.
+    - Bluetooth: btintel: Fixe build regression
+    - net: mpls: error out if inner headers are not set
+    - VMCI: Fix possible memcpy() run-time warning in
+      vmci_datagram_invoke_guest_handler()
+    - x86/vdso: Fix rethunk patching for vdso-image-x32.o too
+    - Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in
+      amdgpu_device_init()"
+    - Linux 6.8.6
+  * Noble update: v6.8.5 upstream stable release (LP: #2065400)
+    - scripts/bpf_doc: Use silent mode when exec make cmd
+    - xsk: Don't assume metadata is always requested in TX completion
+    - s390/bpf: Fix bpf_plt pointer arithmetic
+    - bpf, arm64: fix bug in BPF_LDX_MEMSX
+    - dma-buf: Fix NULL pointer dereference in sanitycheck()
+    - arm64: bpf: fix 32bit unconditional bswap
+    - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
+    - nfsd: Fix error cleanup path in nfsd_rename()
+    - tools: ynl: fix setting presence bits in simple nests
+    - mlxbf_gige: stop PHY during open() error paths
+    - wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
+    - wifi: iwlwifi: mvm: rfi: fix potential response leaks
+    - wifi: iwlwifi: mvm: include link ID when releasing frames
+    - ALSA: hda: cs35l56: Set the init_done flag before component_add()
+    - ice: Refactor FW data type and fix bitmap casting issue
+    - ice: fix memory corruption bug with suspend and rebuild
+    - ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
+    - igc: Remove stale comment about Tx timestamping
+    - drm/xe: Remove unused xe_bo->props struct
+    - drm/xe: Add exec_queue.sched_props.job_timeout_ms
+    - drm/xe/guc_submit: use jiffies for job timeout
+    - drm/xe/queue: fix engine_class bounds check
+    - drm/xe/device: fix XE_MAX_GT_PER_TILE check
+    - drm/xe/device: fix XE_MAX_TILES_PER_DEVICE check
+    - dpll: indent DPLL option type by a tab
+    - s390/qeth: handle deferred cc1
+    - net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
+    - tcp: properly terminate timers for kernel sockets
+    - net: wwan: t7xx: Split 64bit accesses to fix alignment issues
+    - drm/rockchip: vop2: Remove AR30 and AB30 format support
+    - selftests: vxlan_mdb: Fix failures with old libnet
+    - gpiolib: Fix debug messaging in gpiod_find_and_request()
+    - ACPICA: debugger: check status of acpi_evaluate_object() in
+      acpi_db_walk_for_fields()
+    - net: hns3: fix index limit to support all queue stats
+    - net: hns3: fix kernel crash when devlink reload during pf initialization
+    - net: hns3: mark unexcuted loopback test result as UNEXECUTED
+    - tls: recv: process_rx_list shouldn't use an offset with kvec
+    - tls: adjust recv return with async crypto and failed copy to userspace
+    - tls: get psock ref after taking rxlock to avoid leak
+    - mlxbf_gige: call request_irq() after NAPI initialized
+    - drm/amd/display: Update P010 scaling cap
+    - drm/amd/display: Send DTBCLK disable message on first commit
+    - bpf: Protect against int overflow for stack access size
+    - cifs: Fix duplicate fscache cookie warnings
+    - netfilter: nf_tables: reject destroy command to remove basechain hooks
+    - netfilter: nf_tables: reject table flag and netdev basechain updates
+    - netfilter: nf_tables: skip netdev hook unregistration if table is dormant
+    - iommu: Validate the PASID in iommu_attach_device_pasid()
+    - net: bcmasp: Bring up unimac after PHY link up
+    - net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips
+    - Octeontx2-af: fix pause frame configuration in GMP mode
+    - inet: inet_defrag: prevent sk release while still in use
+    - drm/i915: Stop doing double audio enable/disable on SDVO and g4x+ DP
+    - drm/i915/display: Disable AuxCCS framebuffers if built for Xe
+    - drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74
+    - drm/i915/mtl: Update workaround 14018575942
+    - drm/i915: Do not print 'pxp init failed with 0' when it succeed
+    - dm integrity: fix out-of-range warning
+    - modpost: do not make find_tosym() return NULL
+    - kbuild: make -Woverride-init warnings more consistent
+    - mm/treewide: replace pud_large() with pud_leaf()
+    - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be
+      mapped."
+    - gpio: cdev: sanitize the label before requesting the interrupt
+    - RISC-V: KVM: Fix APLIC setipnum_le/be write emulation
+    - RISC-V: KVM: Fix APLIC in_clrip[x] read emulation
+    - KVM: arm64: Fix host-programmed guest events in nVHE
+    - KVM: arm64: Fix out-of-IPA space translation fault handling
+    - selinux: avoid dereference of garbage after mount failure
+    - r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
+    - x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
+    - x86/bpf: Fix IP after emitting call depth accounting
+    - Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
+    - arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
+    - Bluetooth: qca: fix device-address endianness
+    - Bluetooth: add quirk for broken address properties
+    - Bluetooth: hci_event: set the conn encrypted before conn establishes
+    - Bluetooth: Fix TOCTOU in HCI debugfs implementation
+    - netfilter: nf_tables: release batch on table validation from abort path
+    - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
+    - selftests: mptcp: join: fix dev in check_endpoint
+    - net/rds: fix possible cp null dereference
+    - net: usb: ax88179_178a: avoid the interface always configured as random
+      address
+    - net: mana: Fix Rx DMA datasize and skb_over_panic
+    - vsock/virtio: fix packet delivery to tap device
+    - netfilter: nf_tables: reject new basechain after table flag update
+    - netfilter: nf_tables: flush pending destroy work before exit_net release
+    - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
+    - netfilter: nf_tables: discard table flag update with pending basechain
+      deletion
+    - netfilter: validate user input for expected length
+    - vboxsf: Avoid an spurious warning if load_nls_xxx() fails
+    - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
+    - mptcp: prevent BPF accessing lowat from a subflow socket.
+    - x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for
+      !SRSO
+    - KVM: arm64: Use TLBI_TTL_UNKNOWN in __kvm_tlb_flush_vmid_range()
+    - KVM: arm64: Ensure target address is granule-aligned for range TLBI
+    - net/sched: act_skbmod: prevent kernel-infoleak
+    - net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45()
+    - net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
+    - net: stmmac: fix rx queue priority assignment
+    - net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping
+    - net: txgbe: fix i2c dev name cannot match clkdev
+    - net: fec: Set mac_managed_pm during probe
+    - net: phy: micrel: Fix potential null pointer dereference
+    - net: dsa: mv88e6xxx: fix usable ports on 88e6020
+    - selftests: net: gro fwd: update vxlan GRO test expectations
+    - gro: fix ownership transfer
+    - idpf: fix kernel panic on unknown packet types
+    - ice: fix enabling RX VLAN filtering
+    - i40e: Fix VF MAC filter removal
+    - tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-
+      wildcard addresses.
+    - erspan: make sure erspan_base_hdr is present in skb->head
+    - selftests: reuseaddr_conflict: add missing new line at the end of the output
+    - tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6) non-
+      wildcard addresses.
+    - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
+    - e1000e: Workaround for sporadic MDI error on Meteor Lake systems
+    - ipv6: Fix infinite recursion in fib6_dump_done().
+    - mlxbf_gige: stop interface during shutdown
+    - r8169: skip DASH fw status checks when DASH is disabled
+    - udp: do not accept non-tunnel GSO skbs landing in a tunnel
+    - udp: do not transition UDP GRO fraglist partial checksums to unnecessary
+    - udp: prevent local UDP tunnel packets from being GROed
+    - octeontx2-af: Fix issue with loading coalesced KPU profiles
+    - octeontx2-pf: check negative error code in otx2_open()
+    - octeontx2-af: Add array index check
+    - i40e: fix i40e_count_filters() to count only active/new filters
+    - i40e: fix vf may be used uninitialized in this function warning
+    - i40e: Enforce software interrupt during busy-poll exit
+    - drm/amd: Flush GFXOFF requests in prepare stage
+    - e1000e: Minor flow correction in e1000_shutdown function
+    - e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue
+    - mean_and_variance: Drop always failing tests
+    - net: ravb: Let IP-specific receive function to interrogate descriptors
+    - net: ravb: Always process TX descriptor ring
+    - net: ravb: Always update error counters
+    - KVM: SVM: Use unsigned integers when dealing with ASIDs
+    - KVM: SVM: Add support for allowing zero SEV ASIDs
+    - selftests: mptcp: connect: fix shellcheck warnings
+    - selftests: mptcp: use += operator to append strings
+    - mptcp: don't account accept() of non-MPC client as fallback to TCP
+    - 9p: Fix read/write debug statements to report server reply
+    - ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl()
+    - ASoC: cs42l43: Correct extraction of data pointer in suspend/resume
+    - riscv: mm: Fix prototype to avoid discarding const
+    - riscv: hwprobe: do not produce frtace relocation
+    - drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported
+    - block: count BLK_OPEN_RESTRICT_WRITES openers
+    - RISC-V: Update AT_VECTOR_SIZE_ARCH for new AT_MINSIGSTKSZ
+    - ASoC: amd: acp: fix for acp pdm configuration check
+    - regmap: maple: Fix cache corruption in regcache_maple_drop()
+    - ALSA: hda: cs35l56: Add ACPI device match tables
+    - drm/panfrost: fix power transition timeout warnings
+    - nouveau/uvmm: fix addr/range calcs for remap operations
+    - drm/prime: Unbreak virtgpu dma-buf export
+    - ASoC: rt5682-sdw: fix locking sequence
+    - ASoC: rt711-sdca: fix locking sequence
+    - ASoC: rt711-sdw: fix locking sequence
+    - ASoC: rt712-sdca-sdw: fix locking sequence
+    - ASoC: rt722-sdca-sdw: fix locking sequence
+    - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
+    - spi: s3c64xx: Extract FIFO depth calculation to a dedicated macro
+    - spi: s3c64xx: sort headers alphabetically
+    - spi: s3c64xx: explicitly include <linux/bits.h>
+    - spi: s3c64xx: remove else after return
+    - spi: s3c64xx: define a magic value
+    - spi: s3c64xx: allow full FIFO masks
+    - spi: s3c64xx: determine the fifo depth only once
+    - spi: s3c64xx: Use DMA mode from fifo size
+    - ASoC: amd: acp: fix for acp_init function error handling
+    - regmap: maple: Fix uninitialized symbol 'ret' warnings
+    - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
+    - scsi: mylex: Fix sysfs buffer lengths
+    - scsi: sd: Unregister device if device_add_disk() failed in sd_probe()
+    - Revert "ALSA: emu10k1: fix synthesizer sample playback position and caching"
+    - drm/i915/dp: Fix DSC state HW readout for SST connectors
+    - cifs: Fix caching to try to do open O_WRONLY as rdwr on server
+    - spi: mchp-pci1xxx: Fix a possible null pointer dereference in
+      pci1xxx_spi_probe
+    - s390/pai: fix sampling event removal for PMU device driver
+    - thermal: gov_power_allocator: Allow binding without cooling devices
+    - thermal: gov_power_allocator: Allow binding without trip points
+    - drm/i915/gt: Limit the reserved VM space to only the platforms that need it
+    - ata: sata_mv: Fix PCI device ID table declaration compilation warning
+    - ASoC: SOF: amd: fix for false dsp interrupts
+    - SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
+    - riscv: use KERN_INFO in do_trap
+    - riscv: Fix warning by declaring arch_cpu_idle() as noinstr
+    - riscv: Disable preemption when using patch_map()
+    - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
+    - lib/stackdepot: move stack_record struct definition into the header
+    - stackdepot: rename pool_index to pool_index_plus_1
+    - x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk
+    - Revert "drm/amd/display: Send DTBCLK disable message on first commit"
+    - gpio: cdev: check for NULL labels when sanitizing them for irqs
+    - gpio: cdev: fix missed label sanitizing in debounce_setup()
+    - ksmbd: don't send oplock break if rename fails
+    - ksmbd: validate payload size in ipc response
+    - ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
+    - ALSA: hda: Add pplcllpl/u members to hdac_ext_stream
+    - ALSA: hda/realtek - Fix inactive headset mic jack
+    - ALSA: hda/realtek: Add sound quirks for Lenovo Legion slim 7 16ARHA7 models
+    - ALSA: hda/realtek: cs35l41: Support ASUS ROG G634JYR
+    - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with
+      microphone
+    - io_uring/kbuf: get rid of lower BGID lists
+    - io_uring/kbuf: get rid of bl->is_ready
+    - io_uring/kbuf: protect io_buffer_list teardown with a reference
+    - io_uring/rw: don't allow multishot reads without NOWAIT support
+    - io_uring: use private workqueue for exit work
+    - io_uring/kbuf: hold io_buffer_list reference over mmap
+    - ASoC: SOF: Add dsp_max_burst_size_in_ms member to snd_sof_pcm_stream
+    - ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs
+    - ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint
+    - ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)
+    - ASoC: SOF: Intel: mtl/lnl: Use the generic get_stream_position callback
+    - ASoC: SOF: Introduce a new callback pair to be used for PCM delay reporting
+    - ASoC: SOF: Intel: Set the dai/host get frame/byte counter callbacks
+    - ASoC: SOF: Intel: hda-common-ops: Do not set the get_stream_position
+      callback
+    - ASoC: SOF: ipc4-pcm: Use the snd_sof_pcm_get_dai_frame_counter() for
+      pcm_delay
+    - ASoC: SOF: Remove the get_stream_position callback
+    - ASoC: SOF: ipc4-pcm: Move struct sof_ipc4_timestamp_info definition locally
+    - ASoC: SOF: ipc4-pcm: Combine the SOF_IPC4_PIPE_PAUSED cases in pcm_trigger
+    - ASoC: SOF: ipc4-pcm: Invalidate the stream_start_offset in PAUSED state
+    - ASoC: SOF: sof-pcm: Add pointer callback to sof_ipc_pcm_ops
+    - ASoC: SOF: ipc4-pcm: Correct the delay calculation
+    - ASoC: SOF: Intel: hda: Compensate LLP in case it is not reset
+    - driver core: Introduce device_link_wait_removal()
+    - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
+    - of: module: prevent NULL pointer dereference in vsnprintf()
+    - x86/mm/pat: fix VM_PAT handling in COW mappings
+    - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
+    - x86/coco: Require seeding RNG with RDRAND on CoCo systems
+    - perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last PEBS event
+    - riscv: Fix vector state restore in rt_sigreturn()
+    - arm64/ptrace: Use saved floating point state type to determine SVE layout
+    - mm/secretmem: fix GUP-fast succeeding on secretmem folios
+    - selftests/mm: include strings.h for ffsl
+    - s390/entry: align system call table on 8 bytes
+    - riscv: Fix spurious errors from __get/put_kernel_nofault
+    - riscv: process: Fix kernel gp leakage
+    - smb: client: fix UAF in smb2_reconnect_server()
+    - smb: client: guarantee refcounted children from parent session
+    - smb: client: refresh referral without acquiring refpath_lock
+    - smb: client: handle DFS tcons in cifs_construct_tcon()
+    - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex
+    - smb3: retrying on failed server close
+    - smb: client: fix potential UAF in cifs_debug_files_proc_show()
+    - smb: client: fix potential UAF in cifs_stats_proc_write()
+    - smb: client: fix potential UAF in cifs_stats_proc_show()
+    - smb: client: fix potential UAF in cifs_dump_full_key()
+    - smb: client: fix potential UAF in smb2_is_valid_oplock_break()
+    - smb: client: fix potential UAF in smb2_is_valid_lease_break()
+    - smb: client: fix potential UAF in is_valid_oplock_break()
+    - smb: client: fix potential UAF in smb2_is_network_name_deleted()
+    - smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
+    - drm/i915/mst: Limit MST+DSC to TGL+
+    - drm/i915/mst: Reject FEC+MST on ICL
+    - drm/i915/dp: Fix the computation for compressed_bpp for DISPLAY < 13
+    - drm/i915/gt: Disable HW load balancing for CCS
+    - drm/i915/gt: Do not generate the command streamer for all the CCS
+    - drm/i915/gt: Enable only one CCS for compute workload
+    - drm/xe: Use ring ops TLB invalidation for rebinds
+    - drm/xe: Rework rebinding
+    - Revert "x86/mpparse: Register APIC address only once"
+    - bpf: put uprobe link's path and task in release callback
+    - bpf: support deferring bpf_link dealloc to after RCU grace period
+    - efi/libstub: Add generic support for parsing mem_encrypt=
+    - x86/boot: Move mem_encrypt= parsing to the decompressor
+    - x86/sme: Move early SME kernel encryption handling into .head.text
+    - x86/sev: Move early startup code into .head.text section
+    - Linux 6.8.5
+  * CVE-2024-26926
+    - binder: check offset alignment in binder_get_object()
+  * CVE-2024-26922
+    - drm/amdgpu: validate the parameters of bo mapping operations more clearly
+  * CVE-2024-26924
+    - netfilter: nft_set_pipapo: do not free live element
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 05 Jul 2024 13:25:34 +0900
+
+linux-qcom (6.8.0-1004.4) jammy; urgency=medium
+
+  * [RB3] bluetooth hci0 failure found in dmesg
+    - SAUCE: bluetooth/hci_qca: fix timing
+
+  * ftrace:test.d--dynevent--add_remove_btfarg.tc in ubuntu_kselftests_ftrace
+    failed on some architectures (LP: #2067291)
+    - selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly
+
+  [ Ubuntu: 6.8.0-35.35 ]
+
+  * noble/linux: 6.8.0-35.35 -proposed tracker (LP: #2065886)
+  * CVE-2024-21823
+    - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
+    - dmaengine: idxd: add a new security check to deal with a hardware erratum
+    - dmaengine: idxd: add a write() method for applications to submit work
+
+  [ Ubuntu: 6.8.0-34.34 ]
+
+  * noble/linux: 6.8.0-34.34 -proposed tracker (LP: #2065167)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.04.29)
+
+  [ Ubuntu: 6.8.0-32.32 ]
+
+  * noble/linux: 6.8.0-32.32 -proposed tracker (LP: #2064344)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] drop getabis data
+    - [Packaging] update variants
+    - [Packaging] update annotations scripts
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.04.29)
+  * Enable Nezha board (LP: #1975592)
+    - [Config] Enable CONFIG_REGULATOR_FIXED_VOLTAGE on riscv64
+  * Enable Nezha board (LP: #1975592) // Enable StarFive VisionFive 2 board
+    (LP: #2013232)
+    - [Config] Enable CONFIG_SERIAL_8250_DW on riscv64
+  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
+    - [Config] Sync riscv64 config with other architectures
+  * obsolete out-of-tree ivsc dkms in favor of in-tree one (LP: #2061747)
+    - ACPI: scan: Defer enumeration of devices with a _DEP pointing to IVSC device
+    - Revert "mei: vsc: Call wake_up() in the threaded IRQ handler"
+    - mei: vsc: Unregister interrupt handler for system suspend
+    - media: ipu-bridge: Add ov01a10 in Dell XPS 9315
+    - SAUCE: media: ipu-bridge: Support more sensors
+  * Fix after-suspend-mediacard/sdhc-insert test failed (LP: #2042500)
+    - PCI/ASPM: Move pci_configure_ltr() to aspm.c
+    - PCI/ASPM: Always build aspm.c
+    - PCI/ASPM: Move pci_save_ltr_state() to aspm.c
+    - PCI/ASPM: Save L1 PM Substates Capability for suspend/resume
+    - PCI/ASPM: Call pci_save_ltr_state() from pci_save_pcie_state()
+    - PCI/ASPM: Disable L1 before configuring L1 Substates
+    - PCI/ASPM: Update save_state when configuration changes
+  * RTL8852BE fw security fail then lost WIFI function during suspend/resume
+    cycle (LP: #2063096)
+    - wifi: rtw89: download firmware with five times retry
+  * intel_rapl_common: Add support for ARL and LNL (LP: #2061953)
+    - powercap: intel_rapl: Add support for Lunar Lake-M paltform
+    - powercap: intel_rapl: Add support for Arrow Lake
+  * Kernel panic during checkbox stress_ng_test on Grace running noble 6.8
+    (arm64+largemem) kernel (LP: #2058557)
+    - aio: Fix null ptr deref in aio_complete() wakeup
+  * Avoid creating non-working backlight sysfs knob from ASUS board
+    (LP: #2060422)
+    - platform/x86: asus-wmi: Consider device is absent when the read is ~0
+  * Include cifs.ko in linux-modules package (LP: #2042546)
+    - [Packaging] Replace fs/cifs with fs/smb/client in inclusion list
+  * Add Real-time Linux Analysis tool (rtla) to linux-tools (LP: #2059080)
+    - SAUCE: rtla: fix deb build
+    - [Packaging] add Real-time Linux Analysis tool (rtla) to linux-tools
+    - [Packaging] update dependencies for rtla
+  * Noble update: v6.8.4 upstream stable release (LP: #2060533)
+    - Revert "workqueue: Shorten events_freezable_power_efficient name"
+    - Revert "workqueue: Don't call cpumask_test_cpu() with -1 CPU in
+      wq_update_node_max_active()"
+    - Revert "workqueue: Implement system-wide nr_active enforcement for unbound
+      workqueues"
+    - Revert "workqueue: Introduce struct wq_node_nr_active"
+    - Revert "workqueue: RCU protect wq->dfl_pwq and implement accessors for it"
+    - Revert "workqueue: Make wq_adjust_max_active() round-robin pwqs while
+      activating"
+    - Revert "workqueue: Move nr_active handling into helpers"
+    - Revert "workqueue: Replace pwq_activate_inactive_work() with
+      [__]pwq_activate_work()"
+    - Revert "workqueue: Factor out pwq_is_empty()"
+    - Revert "workqueue: Move pwq->max_active to wq->max_active"
+    - Revert "workqueue.c: Increase workqueue name length"
+    - Linux 6.8.4
+  * Noble update: v6.8.3 upstream stable release (LP: #2060531)
+    - drm/vmwgfx: Unmap the surface before resetting it on a plane state
+    - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
+    - wifi: brcmfmac: avoid invalid list operation when vendor attach fails
+    - media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
+    - arm64: dts: qcom: sc7280: Add additional MSI interrupts
+    - remoteproc: virtio: Fix wdg cannot recovery remote processor
+    - clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
+    - smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
+    - smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
+    - arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
+    - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
+    - arm64: dts: qcom: sm8450-hdk: correct AMIC4 and AMIC5 microphones
+    - serial: max310x: fix NULL pointer dereference in I2C instantiation
+    - drm/vmwgfx: Fix the lifetime of the bo cursor memory
+    - pci_iounmap(): Fix MMIO mapping leak
+    - media: xc4000: Fix atomicity violation in xc4000_get_frequency
+    - media: mc: Add local pad to pipeline regardless of the link state
+    - media: mc: Fix flags handling when creating pad links
+    - media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access
+    - media: mc: Add num_links flag to media_pad
+    - media: mc: Rename pad variable to clarify intent
+    - media: mc: Expand MUST_CONNECT flag to always require an enabled link
+    - media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT
+    - md: use RCU lock to protect traversal in md_spares_need_change()
+    - KVM: Always flush async #PF workqueue when vCPU is being destroyed
+    - arm64: dts: qcom: sm8550-qrd: correct WCD9385 TX port mapping
+    - arm64: dts: qcom: sm8550-mtp: correct WCD9385 TX port mapping
+    - cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf()
+    - thermal/intel: Fix intel_tcc_get_temp() to support negative CPU temperature
+    - powercap: intel_rapl: Fix a NULL pointer dereference
+    - powercap: intel_rapl: Fix locking in TPMI RAPL
+    - powercap: intel_rapl_tpmi: Fix a register bug
+    - powercap: intel_rapl_tpmi: Fix System Domain probing
+    - powerpc/smp: Adjust nr_cpu_ids to cover all threads of a core
+    - powerpc/smp: Increase nr_cpu_ids to include the boot CPU
+    - sparc64: NMI watchdog: fix return value of __setup handler
+    - sparc: vDSO: fix return value of __setup handler
+    - selftests/mqueue: Set timeout to 180 seconds
+    - pinctrl: qcom: sm8650-lpass-lpi: correct Kconfig name
+    - ext4: correct best extent lstart adjustment logic
+    - drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects'
+    - block: Clear zone limits for a non-zoned stacked queue
+    - kasan/test: avoid gcc warning for intentional overflow
+    - bounds: support non-power-of-two CONFIG_NR_CPUS
+    - fat: fix uninitialized field in nostale filehandles
+    - fuse: fix VM_MAYSHARE and direct_io_allow_mmap
+    - mfd: twl: Select MFD_CORE
+    - ubifs: Set page uptodate in the correct place
+    - ubi: Check for too small LEB size in VTBL code
+    - ubi: correct the calculation of fastmap size
+    - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
+    - mtd: rawnand: meson: fix scrambling mode value in command macro
+    - md/md-bitmap: fix incorrect usage for sb_index
+    - x86/nmi: Fix the inverse "in NMI handler" check
+    - parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
+    - parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt
+      macros
+    - parisc: Fix ip_fast_csum
+    - parisc: Fix csum_ipv6_magic on 32-bit systems
+    - parisc: Fix csum_ipv6_magic on 64-bit systems
+    - parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
+    - md/raid5: fix atomicity violation in raid5_cache_count
+    - iio: adc: rockchip_saradc: fix bitmask for channels on SARADCv2
+    - iio: adc: rockchip_saradc: use mask for write_enable bitfield
+    - docs: Restore "smart quotes" for quotes
+    - cpufreq: Limit resolving a frequency to policy min/max
+    - PM: suspend: Set mem_sleep_current during kernel command line setup
+    - vfio/pds: Always clear the save/restore FDs on reset
+    - clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays
+    - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
+    - clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
+    - clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays
+    - clk: qcom: camcc-sc8280xp: fix terminating of frequency table arrays
+    - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
+    - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
+    - usb: xhci: Add error handling in xhci_map_urb_for_dma
+    - powerpc/fsl: Fix mfpmr build errors with newer binutils
+    - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
+    - USB: serial: add device ID for VeriFone adapter
+    - USB: serial: cp210x: add ID for MGP Instruments PDS100
+    - wifi: mac80211: track capability/opmode NSS separately
+    - USB: serial: option: add MeiG Smart SLM320 product
+    - KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled
+    - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
+    - PM: sleep: wakeirq: fix wake irq warning in system suspend
+    - mmc: tmio: avoid concurrent runs of mmc_request_done()
+    - fuse: replace remaining make_bad_inode() with fuse_make_bad()
+    - fuse: fix root lookup with nonzero generation
+    - fuse: don't unhash root
+    - usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
+    - usb: dwc3-am62: fix module unload/reload behavior
+    - usb: dwc3-am62: Disable wakeup at remove
+    - serial: core: only stop transmit when HW fifo is empty
+    - serial: Lock console when calling into driver before registration
+    - btrfs: qgroup: always free reserved space for extent records
+    - btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
+    - wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU
+    - docs: Makefile: Add dependency to $(YNL_INDEX) for targets other than
+      htmldocs
+    - PCI/PM: Drain runtime-idle callbacks before driver removal
+    - PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
+    - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
+    - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume
+    - md: export helpers to stop sync_thread
+    - md: export helper md_is_rdwr()
+    - md: add a new helper reshape_interrupted()
+    - dm-raid: really frozen sync_thread during suspend
+    - md/dm-raid: don't call md_reap_sync_thread() directly
+    - dm-raid: add a new helper prepare_suspend() in md_personality
+    - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent
+      with reshape
+    - dm-raid: fix lockdep waring in "pers->hot_add_disk"
+    - powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
+    - mac802154: fix llsec key resources release in mac802154_llsec_key_del
+    - mm: swap: fix race between free_swap_and_cache() and swapoff()
+    - mmc: core: Fix switch on gp3 partition
+    - Bluetooth: btnxpuart: Fix btnxpuart_close
+    - leds: trigger: netdev: Fix kernel panic on interface rename trig notify
+    - drm/etnaviv: Restore some id values
+    - landlock: Warn once if a Landlock action is requested while disabled
+    - io_uring: fix mshot read defer taskrun cqe posting
+    - hwmon: (amc6821) add of_match table
+    - io_uring: fix io_queue_proc modifying req->flags
+    - ext4: fix corruption during on-line resize
+    - nvmem: meson-efuse: fix function pointer type mismatch
+    - slimbus: core: Remove usage of the deprecated ida_simple_xx() API
+    - phy: tegra: xusb: Add API to retrieve the port number of phy
+    - usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
+    - speakup: Fix 8bit characters from direct synth
+    - debugfs: fix wait/cancellation handling during remove
+    - PCI/AER: Block runtime suspend when handling errors
+    - io_uring/net: correctly handle multishot recvmsg retry setup
+    - io_uring: fix mshot io-wq checks
+    - PCI: qcom: Disable ASPM L0s for sc8280xp, sa8540p and sa8295p
+    - sparc32: Fix parport build with sparc32
+    - nfs: fix UAF in direct writes
+    - NFS: Read unlock folio on nfs_page_create_from_folio() error
+    - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
+    - PCI: qcom: Enable BDF to SID translation properly
+    - PCI: dwc: endpoint: Fix advertised resizable BAR size
+    - PCI: hv: Fix ring buffer size calculation
+    - cifs: prevent updating file size from server if we have a read/write lease
+    - cifs: allow changing password during remount
+    - thermal/drivers/mediatek: Fix control buffer enablement on MT7896
+    - vfio/pci: Disable auto-enable of exclusive INTx IRQ
+    - vfio/pci: Lock external INTx masking ops
+    - vfio/platform: Disable virqfds on cleanup
+    - vfio/platform: Create persistent IRQ handlers
+    - vfio/fsl-mc: Block calling interrupt handler without trigger
+    - tpm,tpm_tis: Avoid warning splat at shutdown
+    - ksmbd: replace generic_fillattr with vfs_getattr
+    - ksmbd: retrieve number of blocks using vfs_getattr in
+      set_file_allocation_info
+    - platform/x86/intel/tpmi: Change vsec offset to u64
+    - io_uring/rw: return IOU_ISSUE_SKIP_COMPLETE for multishot retry
+    - io_uring: clean rings on NO_MMAP alloc fail
+    - ring-buffer: Do not set shortest_full when full target is hit
+    - ring-buffer: Fix full_waiters_pending in poll
+    - ring-buffer: Use wait_event_interruptible() in ring_buffer_wait()
+    - tracing/ring-buffer: Fix wait_on_pipe() race
+    - dlm: fix user space lkb refcounting
+    - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
+    - soc: fsl: qbman: Use raw spinlock for cgr_lock
+    - s390/zcrypt: fix reference counting on zcrypt card objects
+    - drm/probe-helper: warn about negative .get_modes()
+    - drm/panel: do not return negative error codes from drm_panel_get_modes()
+    - drm/exynos: do not return negative values from .get_modes()
+    - drm/imx/ipuv3: do not return negative values from .get_modes()
+    - drm/vc4: hdmi: do not return negative values from .get_modes()
+    - clocksource/drivers/timer-riscv: Clear timer interrupt on timer
+      initialization
+    - memtest: use {READ,WRITE}_ONCE in memory scanning
+    - Revert "block/mq-deadline: use correct way to throttling write requests"
+    - lsm: use 32-bit compatible data types in LSM syscalls
+    - lsm: handle the NULL buffer case in lsm_fill_user_ctx()
+    - f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag
+    - f2fs: truncate page cache before clearing flags when aborting atomic write
+    - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
+    - nilfs2: prevent kernel bug at submit_bh_wbc()
+    - cifs: make sure server interfaces are requested only for SMB3+
+    - cifs: reduce warning log level for server not advertising interfaces
+    - cifs: open_cached_dir(): add FILE_READ_EA to desired access
+    - mtd: rawnand: Fix and simplify again the continuous read derivations
+    - mtd: rawnand: Add a helper for calculating a page index
+    - mtd: rawnand: Ensure all continuous terms are always in sync
+    - mtd: rawnand: Constrain even more when continuous reads are enabled
+    - cpufreq: dt: always allocate zeroed cpumask
+    - io_uring/futex: always remove futex entry for cancel all
+    - io_uring/waitid: always remove waitid entry for cancel all
+    - x86/CPU/AMD: Update the Zenbleed microcode revisions
+    - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
+    - net: esp: fix bad handling of pages from page_pool
+    - NFSD: Fix nfsd_clid_class use of __string_len() macro
+    - drm/i915: Add missing ; to __assign_str() macros in tracepoint code
+    - net: hns3: tracing: fix hclgevf trace event strings
+    - cxl/trace: Properly initialize cxl_poison region name
+    - ksmbd: fix potencial out-of-bounds when buffer offset is invalid
+    - virtio: reenable config if freezing device failed
+    - LoongArch: Change __my_cpu_offset definition to avoid mis-optimization
+    - LoongArch: Define the __io_aw() hook as mmiowb()
+    - LoongArch/crypto: Clean up useless assignment operations
+    - wireguard: netlink: check for dangling peer via is_dead instead of empty
+      list
+    - wireguard: netlink: access device through ctx instead of peer
+    - wireguard: selftests: set RISCV_ISA_FALLBACK on riscv{32,64}
+    - ahci: asm1064: asm1166: don't limit reported ports
+    - drm/amd/display: Change default size for dummy plane in DML2
+    - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
+    - drm/amdgpu/pm: Fix NULL pointer dereference when get power limit
+    - drm/amdgpu/pm: Check the validity of overdiver power limit
+    - drm/amd/display: Override min required DCFCLK in dml1_validate
+    - drm/amd/display: Allow dirty rects to be sent to dmub when abm is active
+    - drm/amd/display: Init DPPCLK from SMU on dcn32
+    - drm/amd/display: Update odm when ODM combine is changed on an otg master
+      pipe with no plane
+    - drm/amd/display: Fix idle check for shared firmware state
+    - drm/amd/display: Amend coasting vtotal for replay low hz
+    - drm/amd/display: Lock all enabled otg pipes even with no planes
+    - drm/amd/display: Implement wait_for_odm_update_pending_complete
+    - drm/amd/display: Return the correct HDCP error code
+    - drm/amd/display: Add a dc_state NULL check in dc_state_release
+    - drm/amd/display: Fix noise issue on HDMI AV mute
+    - dm snapshot: fix lockup in dm_exception_table_exit
+    - x86/pm: Work around false positive kmemleak report in msr_build_context()
+    - wifi: brcmfmac: add per-vendor feature detection callback
+    - wifi: brcmfmac: cfg80211: Use WSEC to set SAE password
+    - wifi: brcmfmac: Demote vendor-specific attach/detach messages to info
+    - drm/ttm: Make sure the mapped tt pages are decrypted when needed
+    - drm/amd/display: Unify optimize_required flags and VRR adjustments
+    - drm/amd/display: Add more checks for exiting idle in DC
+    - btrfs: add set_folio_extent_mapped() helper
+    - btrfs: replace sb::s_blocksize by fs_info::sectorsize
+    - btrfs: add helpers to get inode from page/folio pointers
+    - btrfs: add helpers to get fs_info from page/folio pointers
+    - btrfs: add helper to get fs_info from struct inode pointer
+    - btrfs: qgroup: validate btrfs_qgroup_inherit parameter
+    - vfio: Introduce interface to flush virqfd inject workqueue
+    - vfio/pci: Create persistent INTx handler
+    - drm/bridge: add ->edid_read hook and drm_bridge_edid_read()
+    - drm/bridge: lt8912b: use drm_bridge_edid_read()
+    - drm/bridge: lt8912b: clear the EDID property on failures
+    - drm/bridge: lt8912b: do not return negative values from .get_modes()
+    - drm/amd/display: Remove pixle rate limit for subvp
+    - drm/amd/display: Revert Remove pixle rate limit for subvp
+    - workqueue: Shorten events_freezable_power_efficient name
+    - drm/amd/display: Use freesync when `DRM_EDID_FEATURE_CONTINUOUS_FREQ` found
+    - netfilter: nf_tables: reject constant set with timeout
+    - Revert "crypto: pkcs7 - remove sha1 support"
+    - x86/efistub: Call mixed mode boot services on the firmware's stack
+    - ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2"
+    - ASoC: amd: yc: Revert "add new YC platform variant (0x63) support"
+    - Fix memory leak in posix_clock_open()
+    - wifi: rtw88: 8821cu: Fix connection failure
+    - x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
+    - x86/sev: Fix position dependent variable references in startup code
+    - clocksource/drivers/arm_global_timer: Fix maximum prescaler value
+    - ARM: 9352/1: iwmmxt: Remove support for PJ4/PJ4B cores
+    - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
+    - entry: Respect changes to system call number by trace_sys_enter()
+    - swiotlb: Fix double-allocation of slots due to broken alignment handling
+    - swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc()
+    - swiotlb: Fix alignment checks when both allocation and DMA masks are present
+    - iommu/dma: Force swiotlb_max_mapping_size on an untrusted device
+    - printk: Update @console_may_schedule in console_trylock_spinning()
+    - irqchip/renesas-rzg2l: Flush posted write in irq_eoi()
+    - irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi()
+    - irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi()
+    - irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type
+    - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
+    - efi/libstub: fix efi_random_alloc() to allocate memory at alloc_min or
+      higher address
+    - x86/mpparse: Register APIC address only once
+    - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
+    - efi: fix panic in kdump kernel
+    - pwm: img: fix pwm clock lookup
+    - selftests/mm: Fix build with _FORTIFY_SOURCE
+    - btrfs: handle errors returned from unpin_extent_cache()
+    - btrfs: fix warning messages not printing interval at unpin_extent_range()
+    - btrfs: do not skip re-registration for the mounted device
+    - mfd: intel-lpss: Switch to generalized quirk table
+    - mfd: intel-lpss: Introduce QUIRK_CLOCK_DIVIDER_UNITY for XPS 9530
+    - drm/i915: Replace a memset() with zero initialization
+    - drm/i915: Try to preserve the current shared_dpll for fastset on type-c
+      ports
+    - drm/i915: Include the PLL name in the debug messages
+    - drm/i915: Suppress old PLL pipe_mask checks for MG/TC/TBT PLLs
+    - crypto: iaa - Fix nr_cpus < nr_iaa case
+    - drm/amd/display: Prevent crash when disable stream
+    - ALSA: hda/tas2781: remove digital gain kcontrol
+    - ALSA: hda/tas2781: add locks to kcontrols
+    - mm: zswap: fix writeback shinker GFP_NOIO/GFP_NOFS recursion
+    - init: open /initrd.image with O_LARGEFILE
+    - x86/efistub: Add missing boot_params for mixed mode compat entry
+    - efi/libstub: Cast away type warning in use of max()
+    - x86/efistub: Reinstate soft limit for initrd loading
+    - prctl: generalize PR_SET_MDWE support check to be per-arch
+    - ARM: prctl: reject PR_SET_MDWE on pre-ARMv6
+    - tmpfs: fix race on handling dquot rbtree
+    - btrfs: validate device maj:min during open
+    - btrfs: fix race in read_extent_buffer_pages()
+    - btrfs: zoned: don't skip block groups with 100% zone unusable
+    - btrfs: zoned: use zone aware sb location for scrub
+    - btrfs: zoned: fix use-after-free in do_zone_finish()
+    - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
+    - wifi: cfg80211: add a flag to disable wireless extensions
+    - wifi: iwlwifi: mvm: disable MLO for the time being
+    - wifi: iwlwifi: fw: don't always use FW dump trig
+    - wifi: iwlwifi: mvm: handle debugfs names more carefully
+    - Revert "drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP
+      displays without PSR"
+    - fbdev: Select I/O-memory framebuffer ops for SBus
+    - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
+    - hexagon: vmlinux.lds.S: handle attributes section
+    - mm: cachestat: fix two shmem bugs
+    - selftests/mm: sigbus-wp test requires UFFD_FEATURE_WP_HUGETLBFS_SHMEM
+    - selftests/mm: fix ARM related issue with fork after pthread_create
+    - mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc
+      HS200 mode
+    - mmc: core: Initialize mmc_blk_ioc_data
+    - mmc: core: Avoid negative index with array access
+    - sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove()
+    - block: Do not force full zone append completion in req_bio_endio()
+    - thermal: devfreq_cooling: Fix perf state when calculate dfc res_util
+    - Revert "thermal: core: Don't update trip points inside the hysteresis range"
+    - nouveau/dmem: handle kcalloc() allocation failure
+    - net: ll_temac: platform_get_resource replaced by wrong function
+    - net: wan: framer: Add missing static inline qualifiers
+    - net: phy: qcom: at803x: fix kernel panic with at8031_probe
+    - drm/xe/query: fix gt_id bounds check
+    - drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau
+    - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
+    - drm/amdkfd: fix TLB flush after unmap for GFX9.4.2
+    - drm/amdgpu: fix deadlock while reading mqd from debugfs
+    - drm/amd/display: Remove MPC rate control logic from DCN30 and above
+    - drm/amd/display: Set DCN351 BB and IP the same as DCN35
+    - drm/i915/hwmon: Fix locking inversion in sysfs getter
+    - drm/i915/vma: Fix UAF on destroy against retire race
+    - drm/i915/bios: Tolerate devdata==NULL in
+      intel_bios_encoder_supports_dp_dual_mode()
+    - drm/i915/vrr: Generate VRR "safe window" for DSB
+    - drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly
+    - drm/i915/dsb: Fix DSB vblank waits when using VRR
+    - drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed()
+    - drm/i915: Pre-populate the cursor physical dma address
+    - drm/i915/gt: Reset queue_priority_hint on parking
+    - drm/amd/display: Fix bounds check for dcn35 DcfClocks
+    - Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
+    - mtd: spinand: Add support for 5-byte IDs
+    - Revert "usb: phy: generic: Get the vbus supply"
+    - usb: cdc-wdm: close race between read and workqueue
+    - usb: misc: ljca: Fix double free in error handling path
+    - USB: UAS: return ENODEV when submit urbs fail with device not attached
+    - vfio/pds: Make sure migration file isn't accessed after reset
+    - ring-buffer: Make wake once of ring_buffer_wait() more robust
+    - btrfs: fix extent map leak in unexpected scenario at unpin_extent_cache()
+    - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
+    - scsi: ufs: qcom: Provide default cycles_in_1us value
+    - scsi: sd: Fix TCG OPAL unlock on system resume
+    - scsi: core: Fix unremoved procfs host directory regression
+    - staging: vc04_services: changen strncpy() to strscpy_pad()
+    - staging: vc04_services: fix information leak in create_component()
+    - genirq: Introduce IRQF_COND_ONESHOT and use it in pinctrl-amd
+    - usb: dwc3: Properly set system wakeup
+    - USB: core: Fix deadlock in usb_deauthorize_interface()
+    - USB: core: Add hub_get() and hub_put() routines
+    - USB: core: Fix deadlock in port "disable" sysfs attribute
+    - usb: dwc2: host: Fix remote wakeup from hibernation
+    - usb: dwc2: host: Fix hibernation flow
+    - usb: dwc2: host: Fix ISOC flow in DDMA mode
+    - usb: dwc2: gadget: Fix exiting from clock gating
+    - usb: dwc2: gadget: LPM flow fix
+    - usb: udc: remove warning when queue disabled ep
+    - usb: typec: ucsi: Fix race between typec_switch and role_switch
+    - usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()
+    - usb: typec: tcpm: Correct port source pdo array in pd_set callback
+    - usb: typec: tcpm: Update PD of Type-C port upon pd_set
+    - usb: typec: Return size of buffer if pd_set operation succeeds
+    - usb: typec: ucsi: Clear EVENT_PENDING under PPM lock
+    - usb: typec: ucsi: Ack unsupported commands
+    - usb: typec: ucsi_acpi: Refactor and fix DELL quirk
+    - usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
+    - scsi: qla2xxx: Prevent command send on chip reset
+    - scsi: qla2xxx: Fix N2N stuck connection
+    - scsi: qla2xxx: Split FCE|EFT trace control
+    - scsi: qla2xxx: Update manufacturer detail
+    - scsi: qla2xxx: NVME|FCP prefer flag not being honored
+    - scsi: qla2xxx: Fix command flush on cable pull
+    - scsi: qla2xxx: Fix double free of the ha->vp_map pointer
+    - scsi: qla2xxx: Fix double free of fcport
+    - scsi: qla2xxx: Change debug message during driver unload
+    - scsi: qla2xxx: Delay I/O Abort on PCI error
+    - x86/bugs: Fix the SRSO mitigation on Zen3/4
+    - crash: use macro to add crashk_res into iomem early for specific arch
+    - drm/amd/display: fix IPX enablement
+    - x86/bugs: Use fixed addressing for VERW operand
+    - Revert "x86/bugs: Use fixed addressing for VERW operand"
+    - usb: dwc3: pci: Drop duplicate ID
+    - scsi: lpfc: Correct size for cmdwqe/rspwqe for memset()
+    - scsi: lpfc: Correct size for wqe for memset()
+    - scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
+    - scsi: libsas: Fix disk not being scanned in after being removed
+    - perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and
+      later
+    - x86/sev: Skip ROM range scans and validation for SEV-SNP guests
+    - tools/resolve_btfids: fix build with musl libc
+    - drm/amdgpu: fix use-after-free bug
+    - drm/sched: fix null-ptr-deref in init entity
+    - Linux 6.8.3
+    - [Config] updateconfigs following v6.8.3 import
+  * Noble update: v6.8.3 upstream stable release (LP: #2060531) //
+    [Ubuntu-24.04] Hugepage memory is not getting released even after destroying
+    the guest! (LP: #2062556)
+    - block: Fix page refcounts for unaligned buffers in __bio_release_pages()
+  *  [SPR][EMR][GNR] TDX: efi: TD Measurement support for kernel cmdline/initrd
+    sections from EFI stub  (LP: #2060130)
+    - efi/libstub: Use TPM event typedefs from the TCG PC Client spec
+    - efi/tpm: Use symbolic GUID name from spec for final events table
+    - efi/libstub: Add Confidential Computing (CC) measurement typedefs
+    - efi/libstub: Measure into CC protocol if TCG2 protocol is absent
+    - efi/libstub: Add get_event_log() support for CC platforms
+    - x86/efistub: Remap kernel text read-only before dropping NX attribute
+  * Fix acpi_power_meter accessing IPMI region before it's ready (LP: #2059263)
+    - ACPI: IPMI: Add helper to wait for when SMI is selected
+    - hwmon: (acpi_power_meter) Ensure IPMI space handler is ready on Dell systems
+  * Drop fips-checks script from trees (LP: #2055083)
+    - [Packaging] Remove fips-checks script
+  * alsa/realtek: adjust max output valume for headphone on 2 LG machines
+    (LP: #2058573)
+    - ALSA: hda/realtek: fix the hp playback volume issue for LG machines
+  * Noble update: v6.8.2 upstream stable release (LP: #2060097)
+    - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
+    - workqueue.c: Increase workqueue name length
+    - workqueue: Move pwq->max_active to wq->max_active
+    - workqueue: Factor out pwq_is_empty()
+    - workqueue: Replace pwq_activate_inactive_work() with [__]pwq_activate_work()
+    - workqueue: Move nr_active handling into helpers
+    - workqueue: Make wq_adjust_max_active() round-robin pwqs while activating
+    - workqueue: RCU protect wq->dfl_pwq and implement accessors for it
+    - workqueue: Introduce struct wq_node_nr_active
+    - workqueue: Implement system-wide nr_active enforcement for unbound
+      workqueues
+    - workqueue: Don't call cpumask_test_cpu() with -1 CPU in
+      wq_update_node_max_active()
+    - iomap: clear the per-folio dirty bits on all writeback failures
+    - fs: Fix rw_hint validation
+    - io_uring: remove looping around handling traditional task_work
+    - io_uring: remove unconditional looping in local task_work handling
+    - s390/dasd: Use dev_*() for device log messages
+    - s390/dasd: fix double module refcount decrement
+    - fs/hfsplus: use better @opf description
+    - md: fix kmemleak of rdev->serial
+    - rcu/exp: Fix RCU expedited parallel grace period kworker allocation failure
+      recovery
+    - rcu/exp: Handle RCU expedited grace period kworker allocation failure
+    - fs/select: rework stack allocation hack for clang
+    - block: fix deadlock between bd_link_disk_holder and partition scan
+    - md: Don't clear MD_CLOSING when the raid is about to stop
+    - kunit: Setup DMA masks on the kunit device
+    - ovl: Always reject mounting over case-insensitive directories
+    - kunit: test: Log the correct filter string in executor_test
+    - lib/cmdline: Fix an invalid format specifier in an assertion msg
+    - lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg
+    - time: test: Fix incorrect format specifier
+    - rtc: test: Fix invalid format specifier.
+    - net: test: Fix printf format specifier in skb_segment kunit test
+    - drm/xe/tests: Fix printf format specifiers in xe_migrate test
+    - drm: tests: Fix invalid printf format specifiers in KUnit tests
+    - md/raid1: factor out helpers to add rdev to conf
+    - md/raid1: record nonrot rdevs while adding/removing rdevs to conf
+    - md/raid1: fix choose next idle in read_balance()
+    - io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
+    - io_uring/net: move receive multishot out of the generic msghdr path
+    - io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
+    - nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()
+    - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
+    - x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type
+    - x86/resctrl: Remove hard-coded memory bandwidth limit
+    - x86/resctrl: Read supported bandwidth sources from CPUID
+    - x86/resctrl: Implement new mba_MBps throttling heuristic
+    - x86/sme: Fix memory encryption setting if enabled by default and not
+      overridden
+    - timekeeping: Fix cross-timestamp interpolation on counter wrap
+    - timekeeping: Fix cross-timestamp interpolation corner case decision
+    - timekeeping: Fix cross-timestamp interpolation for non-x86
+    - x86/asm: Remove the __iomem annotation of movdir64b()'s dst argument
+    - sched/fair: Take the scheduling domain into account in select_idle_smt()
+    - sched/fair: Take the scheduling domain into account in select_idle_core()
+    - wifi: ath10k: fix NULL pointer dereference in
+      ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
+    - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
+    - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
+    - wifi: b43: Stop correct queue in DMA worker when QoS is disabled
+    - wifi: b43: Disable QoS for bcm4331
+    - wifi: wilc1000: fix declarations ordering
+    - wifi: wilc1000: fix RCU usage in connect path
+    - wifi: ath11k: add support to select 6 GHz regulatory type
+    - wifi: ath11k: store cur_regulatory_info for each radio
+    - wifi: ath11k: fix a possible dead lock caused by ab->base_lock
+    - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
+    - wifi: wilc1000: do not realloc workqueue everytime an interface is added
+    - wifi: wilc1000: fix multi-vif management when deleting a vif
+    - wifi: mwifiex: debugfs: Drop unnecessary error check for
+      debugfs_create_dir()
+    - ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate
+    - arm64: dts: qcom: x1e80100: drop qcom,drv-count
+    - arm64: dts: qcom: sc8180x: Hook up VDD_CX as GCC parent domain
+    - arm64: dts: qcom: sc8180x: Fix up big CPU idle state entry latency
+    - arm64: dts: qcom: sc8180x: Add missing CPU off state
+    - arm64: dts: qcom: sc8180x: Fix eDP PHY power-domains
+    - arm64: dts: qcom: sc8180x: Don't hold MDP core clock at FMAX
+    - arm64: dts: qcom: sc8180x: Require LOW_SVS vote for MMCX if DISPCC is on
+    - arm64: dts: qcom: sc8180x: Add missing CPU<->MDP_CFG path
+    - arm64: dts: qcom: sc8180x: Shrink aoss_qmp register space size
+    - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
+    - cpufreq: mediatek-hw: Wait for CPU supplies before probing
+    - sock_diag: annotate data-races around sock_diag_handlers[family]
+    - inet_diag: annotate data-races around inet_diag_table[]
+    - bpftool: Silence build warning about calloc()
+    - selftests/bpf: Fix potential premature unload in bpf_testmod
+    - libbpf: Apply map_set_def_max_entries() for inner_maps on creation
+    - selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values
+    - bpftool: Fix wrong free call in do_show_link
+    - wifi: ath12k: Fix issues in channel list update
+    - selftests/bpf: Fix the flaky tc_redirect_dtime test
+    - selftests/bpf: Wait for the netstamp_needed_key static key to be turned on
+    - wifi: cfg80211: add RNR with reporting AP information
+    - wifi: mac80211: use deflink and fix typo in link ID check
+    - wifi: iwlwifi: change link id in time event to s8
+    - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
+    - arm64: dts: qcom: sm8450: Add missing interconnects to serial
+    - soc: qcom: socinfo: rename PM2250 to PM4125
+    - arm64: dts: qcom: sc7280: Add static properties to cryptobam
+    - arm64: dts: qcom: qcm6490-fairphone-fp5: Add missing reserved-memory
+    - arm64: dts: qcom: sdm845-oneplus-common: improve DAI node naming
+    - arm64: dts: qcom: rename PM2250 to PM4125
+    - cpufreq: mediatek-hw: Don't error out if supply is not found
+    - libbpf: Fix faccessat() usage on Android
+    - libbpf: fix __arg_ctx type enforcement for perf_event programs
+    - pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl
+    - arm64: dts: qcom: sa8540p: Drop gfx.lvl as power-domain for gpucc
+    - arm64: dts: renesas: r8a779g0: Restore sort order
+    - arm64: dts: renesas: r8a779g0: Add missing SCIF_CLK2
+    - selftests/bpf: Disable IPv6 for lwt_redirect test
+    - arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S i.MX8MM
+    - arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM
+    - arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL
+      OSM-S board
+    - arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL
+      board
+    - arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL
+      OSM-S board
+    - arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL
+      board
+    - arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module
+    - arm64: dts: imx8qm: Align edma3 power-domains resources indentation
+    - arm64: dts: imx8qm: Correct edma3 power-domains and interrupt numbers
+    - libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API
+    - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
+    - wifi: ath11k: change to move WMI_VDEV_PARAM_SET_HEMU_MODE before
+      WMI_PEER_ASSOC_CMDID
+    - wifi: ath12k: fix fetching MCBC flag for QCN9274
+    - wifi: iwlwifi: mvm: report beacon protection failures
+    - wifi: iwlwifi: dbg-tlv: ensure NUL termination
+    - wifi: iwlwifi: acpi: fix WPFC reading
+    - wifi: iwlwifi: mvm: initialize rates in FW earlier
+    - wifi: iwlwifi: fix EWRD table validity check
+    - wifi: iwlwifi: mvm: d3: fix IPN byte order
+    - wifi: iwlwifi: always have 'uats_enabled'
+    - wifi: iwlwifi: mvm: fix the TLC command after ADD_STA
+    - wifi: iwlwifi: read BIOS PNVM only for non-Intel SKU
+    - gpio: vf610: allow disabling the vf610 driver
+    - selftests/bpf: trace_helpers.c: do not use poisoned type
+    - bpf: make sure scalar args don't accept __arg_nonnull tag
+    - bpf: don't emit warnings intended for global subprogs for static subprogs
+    - arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
+    - pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
+    - net: blackhole_dev: fix build warning for ethh set but not used
+    - spi: consolidate setting message->spi
+    - spi: move split xfers for CS_WORD emulation
+    - arm64: dts: ti: k3-am62p5-sk: Enable CPSW MDIO node
+    - arm64: dts: ti: k3-j721s2: Fix power domain for VTM node
+    - arm64: dts: ti: k3-j784s4: Fix power domain for VTM node
+    - wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use
+    - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
+    - arm64: dts: ti: k3-am69-sk: remove assigned-clock-parents for unused VP
+    - libbpf: fix return value for PERF_EVENT __arg_ctx type fix up check
+    - arm64: dts: ti: k3-am62p-mcu/wakeup: Disable MCU and wakeup R5FSS nodes
+    - arm64: dts: qcom: x1e80100-qcp: Fix supplies for LDOs 3E and 2J
+    - libbpf: Use OPTS_SET() macro in bpf_xdp_query()
+    - wifi: wfx: fix memory leak when starting AP
+    - arm64: dts: qcom: qcm2290: declare VLS CLAMP register for USB3 PHY
+    - arm64: dts: qcom: sm6115: declare VLS CLAMP register for USB3 PHY
+    - arm64: dts: qcom: sm8650: Fix UFS PHY clocks
+    - wifi: ath12k: fix incorrect logic of calculating vdev_stats_id
+    - printk: nbcon: Relocate 32bit seq macros
+    - printk: ringbuffer: Do not skip non-finalized records with prb_next_seq()
+    - printk: Wait for all reserved records with pr_flush()
+    - printk: Add this_cpu_in_panic()
+    - printk: ringbuffer: Cleanup reader terminology
+    - printk: ringbuffer: Skip non-finalized records in panic
+    - printk: Disable passing console lock owner completely during panic()
+    - pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
+    - tools/resolve_btfids: Refactor set sorting with types from btf_ids.h
+    - tools/resolve_btfids: Fix cross-compilation to non-host endianness
+    - wifi: iwlwifi: support EHT for WH
+    - wifi: iwlwifi: properly check if link is active
+    - wifi: iwlwifi: mvm: fix erroneous queue index mask
+    - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK
+    - wifi: iwlwifi: mvm: don't set replay counters to 0xff
+    - s390/pai: fix attr_event_free upper limit for pai device drivers
+    - s390/vdso: drop '-fPIC' from LDFLAGS
+    - arm64: dts: qcom: qcm6490-idp: Correct the voltage setting for vph_pwr
+    - arm64: dts: qcom: qcs6490-rb3gen2: Correct the voltage setting for vph_pwr
+    - selftests: forwarding: Add missing config entries
+    - selftests: forwarding: Add missing multicast routing config entries
+    - arm64: dts: qcom: sm6115: drop pipe clock selection
+    - ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
+    - arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs
+    - arm64: dts: mediatek: mt7986: fix reference to PWM in fan node
+    - arm64: dts: mediatek: mt7986: drop crypto's unneeded/invalid clock name
+    - arm64: dts: mediatek: mt7986: fix SPI bus width properties
+    - arm64: dts: mediatek: mt7986: fix SPI nodename
+    - arm64: dts: mediatek: mt7986: drop "#clock-cells" from PWM
+    - arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg
+    - arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection node
+    - arm64: dts: mediatek: mt8192: fix vencoder clock name
+    - arm64: dts: mediatek: mt8186: fix VENC power domain clocks
+    - arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
+    - can: m_can: Start/Cancel polling timer together with interrupts
+    - wifi: iwlwifi: mvm: Fix the listener MAC filter flags
+    - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
+    - arm64: dts: qcom: sdm845: Use the Low Power Island CX/MX for SLPI
+    - soc: qcom: llcc: Check return value on Broadcast_OR reg read
+    - ARM: dts: qcom: msm8974: correct qfprom node size
+    - arm64: dts: mediatek: mt8186: Add missing clocks to ssusb power domains
+    - arm64: dts: mediatek: mt8186: Add missing xhci clock to usb controllers
+    - arm64: dts: ti: am65x: Fix dtbs_install for Rocktech OLDI overlay
+    - cpufreq: qcom-hw: add CONFIG_COMMON_CLK dependency
+    - wifi: wilc1000: prevent use-after-free on vif when cleaning up all
+      interfaces
+    - pwm: dwc: use pm_sleep_ptr() macro
+    - arm64: dts: ti: k3-am69-sk: fix PMIC interrupt number
+    - arm64: dts: ti: k3-j721e-sk: fix PMIC interrupt number
+    - arm64: dts: ti: k3-am62-main: disable usb lpm
+    - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
+    - bus: tegra-aconnect: Update dependency to ARCH_TEGRA
+    - iommu/amd: Mark interrupt as managed
+    - wifi: brcmsmac: avoid function pointer casts
+    - arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios
+    - arm64: dts: qcom: sm8150: correct PCIe wake-gpios
+    - powercap: dtpm_cpu: Fix error check against freq_qos_add_request()
+    - net: ena: Remove ena_select_queue
+    - arm64: dts: ti: k3-j7200-common-proc-board: Modify Pinmux for wkup_uart0 and
+      mcu_uart0
+    - arm64: dts: ti: k3-j7200-common-proc-board: Remove clock-frequency from
+      mcu_uart0
+    - arm64: dts: ti: k3-j721s2-common-proc-board: Remove Pinmux for CTS and RTS
+      in wkup_uart0
+    - arm64: dts: ti: k3-j784s4-evm: Remove Pinmux for CTS and RTS in wkup_uart0
+    - arm64: dts: ti: k3-am64-main: Fix ITAP/OTAP values for MMC
+    - arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow
+    - arm64: dts: ti: Add common1 register space for AM65x SoC
+    - arm64: dts: ti: Add common1 register space for AM62x SoC
+    - firmware: arm_scmi: Fix double free in SMC transport cleanup path
+    - wifi: cfg80211: set correct param change count in ML element
+    - arm64: dts: ti: k3-j721e: Fix mux-reg-masks in hbmc_mux
+    - arm64: dts: ti: k3-j784s4-main: Fix mux-reg-masks in serdes_ln_ctrl
+    - arm64: dts: ti: k3-am62p: Fix memory ranges for DMSS
+    - wifi: wilc1000: revert reset line logic flip
+    - ARM: dts: arm: realview: Fix development chip ROM compatible value
+    - memory: tegra: Correct DLA client names
+    - wifi: mt76: mt7996: fix fw loading timeout
+    - wifi: mt76: mt7925: fix connect to 80211b mode fail in 2Ghz band
+    - wifi: mt76: mt7925: fix SAP no beacon issue in 5Ghz and 6Ghz band
+    - wifi: mt76: mt7925: fix mcu query command fail
+    - wifi: mt76: mt7925: fix wmm queue mapping
+    - wifi: mt76: mt7925: fix fw download fail
+    - wifi: mt76: mt7925: fix WoW failed in encrypted mode
+    - wifi: mt76: mt7925: fix the wrong header translation config
+    - wifi: mt76: mt7925: add flow to avoid chip bt function fail
+    - wifi: mt76: mt7925: add support to set ifs time by mcu command
+    - wifi: mt76: mt7925: update PCIe DMA settings
+    - wifi: mt76: mt7996: check txs format before getting skb by pid
+    - wifi: mt76: mt7996: fix TWT issues
+    - wifi: mt76: mt7996: fix incorrect interpretation of EHT MCS caps
+    - wifi: mt76: mt7996: fix HE beamformer phy cap for station vif
+    - wifi: mt76: mt7996: fix efuse reading issue
+    - wifi: mt76: mt7996: fix HIF_TXD_V2_1 value
+    - wifi: mt76: mt792x: fix ethtool warning
+    - wifi: mt76: mt7921e: fix use-after-free in free_irq()
+    - wifi: mt76: mt7925e: fix use-after-free in free_irq()
+    - wifi: mt76: mt7921: fix incorrect type conversion for CLC command
+    - wifi: mt76: mt792x: fix a potential loading failure of the 6Ghz channel
+      config from ACPI
+    - wifi: mt76: fix the issue of missing txpwr settings from ch153 to ch177
+    - arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes
+    - arm64: dts: renesas: r9a08g045: Add missing interrupts to IRQC node
+    - arm64: dts: renesas: rzg3s-smarc-som: Guard Ethernet IRQ GPIO hogs
+    - arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
+    - arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes
+    - net: mctp: copy skb ext data when fragmenting
+    - pstore: inode: Only d_invalidate() is needed
+    - arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF
+    - ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
+    - ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
+    - arm64: dts: imx8mp: Set SPI NOR to max 40 MHz on Data Modul i.MX8M Plus eDM
+      SBC
+    - arm64: dts: imx8mp-evk: Fix hdmi@3d node
+    - regulator: userspace-consumer: add module device table
+    - gpiolib: Pass consumer device through to core in
+      devm_fwnode_gpiod_get_index()
+    - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
+    - ACPI: resource: Do IRQ override on Lunnen Ground laptops
+    - ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
+    - ACPI: scan: Fix device check notification handling
+    - arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu
+    - arm64: dts: rockchip: fix reset-names for rk356x i2s2 controller
+    - arm64: dts: rockchip: drop rockchip,trcm-sync-tx-only from rk3588 i2s
+    - objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks
+    - x86, relocs: Ignore relocations in .notes section
+    - SUNRPC: fix a memleak in gss_import_v2_context
+    - SUNRPC: fix some memleaks in gssx_dec_option_array
+    - arm64: dts: qcom: sm8550: Fix SPMI channels size
+    - arm64: dts: qcom: sm8650: Fix SPMI channels size
+    - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove
+      function
+    - ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors
+    - btrfs: fix race when detecting delalloc ranges during fiemap
+    - wifi: rtw88: 8821cu: Fix firmware upload fail
+    - wifi: rtw88: 8821c: Fix beacon loss and disconnect
+    - wifi: rtw88: 8821c: Fix false alarm count
+    - wifi: brcm80211: handle pmk_op allocation failure
+    - riscv: dts: starfive: jh7100: fix root clock names
+    - PCI: Make pci_dev_is_disconnected() helper public for other drivers
+    - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
+    - iommu/vt-d: Use rbtree to track iommu probed devices
+    - iommu/vt-d: Improve ITE fault handling if target device isn't present
+    - iommu/vt-d: Use device rbtree in iopf reporting path
+    - iommu: Add static iommu_ops->release_domain
+    - iommu/vt-d: Fix NULL domain on device release
+    - igc: Fix missing time sync events
+    - igb: Fix missing time sync events
+    - ice: fix stats being updated by way too large values
+    - Bluetooth: Remove HCI_POWER_OFF_TIMEOUT
+    - Bluetooth: mgmt: Remove leftover queuing of power_off work
+    - Bluetooth: Remove superfluous call to hci_conn_check_pending()
+    - Bluetooth: Remove BT_HS
+    - Bluetooth: hci_event: Fix not indicating new connection for BIG Sync
+    - Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
+    - Bluetooth: hci_core: Cancel request on command timeout
+    - Bluetooth: hci_sync: Fix overwriting request callback
+    - Bluetooth: hci_h5: Add ability to allocate memory for private data
+    - Bluetooth: btrtl: fix out of bounds memory access
+    - Bluetooth: hci_core: Fix possible buffer overflow
+    - Bluetooth: msft: Fix memory leak
+    - Bluetooth: btusb: Fix memory leak
+    - Bluetooth: af_bluetooth: Fix deadlock
+    - Bluetooth: fix use-after-free in accessing skb after sending it
+    - sr9800: Add check for usbnet_get_endpoints
+    - s390/cache: prevent rebuild of shared_cpu_list
+    - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
+    - bpf: Fix hashtab overflow check on 32-bit arches
+    - bpf: Fix stackmap overflow check on 32-bit arches
+    - net: dsa: microchip: make sure drive strength configuration is not lost by
+      soft reset
+    - dpll: spec: use proper enum for pin capabilities attribute
+    - iommu: Fix compilation without CONFIG_IOMMU_INTEL
+    - ipv6: fib6_rules: flush route cache when rule is changed
+    - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
+    - octeontx2-af: Fix devlink params
+    - net: phy: fix phy_get_internal_delay accessing an empty array
+    - dpll: fix dpll_xa_ref_*_del() for multiple registrations
+    - net: hns3: fix wrong judgment condition issue
+    - net: hns3: fix kernel crash when 1588 is received on HIP08 devices
+    - net: hns3: fix port duplex configure error in IMP reset
+    - Bluetooth: Fix eir name length
+    - net: phy: dp83822: Fix RGMII TX delay configuration
+    - erofs: fix lockdep false positives on initializing erofs_pseudo_mnt
+    - OPP: debugfs: Fix warning around icc_get_name()
+    - tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
+    - ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt()
+      function
+    - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
+      function
+    - udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
+    - net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
+    - net/x25: fix incorrect parameter validation in the x25_getsockopt() function
+    - devlink: Fix length of eswitch inline-mode
+    - r8152: fix unknown device for choose_configuration
+    - nfp: flower: handle acti_netdevs allocation failure
+    - bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
+    - dm raid: fix false positive for requeue needed during reshape
+    - dm: call the resume method on internal suspend
+    - fbdev/simplefb: change loglevel when the power domains cannot be parsed
+    - drm/tegra: dsi: Add missing check for of_find_device_by_node
+    - drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
+    - drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
+    - drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path
+      of tegra_dsi_probe()
+    - drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe()
+    - drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
+    - drm/tegra: rgb: Fix missing clk_put() in the error handling paths of
+      tegra_dc_rgb_probe()
+    - drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths
+      of tegra_output_probe()
+    - drm/rockchip: inno_hdmi: Fix video timing
+    - drm: Don't treat 0 as -1 in drm_fixp2int_ceil
+    - drm/vkms: Avoid reading beyond LUT array
+    - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
+    - drm/rockchip: lvds: do not overwrite error code
+    - drm/rockchip: lvds: do not print scary message when probing defer
+    - drm/panel-edp: use put_sync in unprepare
+    - drm/lima: fix a memleak in lima_heap_alloc
+    - ASoC: amd: acp: Add missing error handling in sof-mach
+    - ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe()
+    - ASoC: SOF: core: Skip firmware test for custom loaders
+    - ASoC: SOF: amd: Compute file paths on firmware load
+    - soundwire: stream: add missing const to Documentation
+    - dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
+    - media: tc358743: register v4l2 async device only after successful setup
+    - media: cadence: csi2rx: use match fwnode for media link
+    - PCI/DPC: Print all TLP Prefixes, not just the first
+    - perf record: Fix possible incorrect free in record__switch_output()
+    - perf record: Check conflict between '--timestamp-filename' option and pipe
+      mode before recording
+    - HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
+    - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
+    - perf pmu: Treat the msr pmu as software
+    - crypto: qat - avoid memcpy() overflow warning
+    - ALSA: hda: cs35l41: Set Channel Index correctly when system is missing _DSD
+    - drm/amd/display: Fix potential NULL pointer dereferences in
+      'dcn10_set_output_transfer_func()'
+    - ASoC: sh: rz-ssi: Fix error message print
+    - drm/vmwgfx: Fix vmw_du_get_cursor_mob fencing of newly-created MOBs
+    - clk: renesas: r8a779g0: Fix PCIe clock name
+    - pinctrl: renesas: rzg2l: Fix locking in rzg2l_dt_subnode_to_map()
+    - pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function
+    - clk: samsung: exynos850: Propagate SPI IPCLK rate change
+    - media: v4l2: cci: print leading 0 on error
+    - perf evsel: Fix duplicate initialization of data->id in
+      evsel__parse_sample()
+    - perf bpf: Clean up the generated/copied vmlinux.h
+    - clk: meson: Add missing clocks to axg_clk_regmaps
+    - media: em28xx: annotate unchecked call to media_device_register()
+    - media: v4l2-tpg: fix some memleaks in tpg_alloc
+    - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
+    - media: dt-bindings: techwell,tw9900: Fix port schema ref
+    - mtd: spinand: esmt: Extend IDs to 5 bytes
+    - media: edia: dvbdev: fix a use-after-free
+    - pinctrl: mediatek: Drop bogus slew rate register range for MT8186
+    - pinctrl: mediatek: Drop bogus slew rate register range for MT8192
+    - drm/amdgpu: Fix potential out-of-bounds access in
+      'amdgpu_discovery_reg_base_init()'
+    - clk: qcom: reset: Commonize the de/assert functions
+    - clk: qcom: reset: Ensure write completion on reset de/assertion
+    - quota: Fix potential NULL pointer dereference
+    - quota: Fix rcu annotations of inode dquot pointers
+    - quota: Properly annotate i_dquot arrays with __rcu
+    - ASoC: Intel: ssp-common: Add stub for sof_ssp_get_codec_name
+    - PCI/P2PDMA: Fix a sleeping issue in a RCU read section
+    - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
+    - crypto: xilinx - call finalize with bh disabled
+    - drivers/ps3: select VIDEO to provide cmdline functions
+    - perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
+    - perf srcline: Add missed addr2line closes
+    - dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible
+    - drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN
+    - drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled
+    - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
+    - drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
+    - clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks
+    - clk: renesas: r8a779f0: Correct PFC/GPIO parent clock
+    - clk: renesas: r9a07g04[34]: Use SEL_SDHI1_STS status configuration for SD1
+      mux
+    - ALSA: seq: fix function cast warnings
+    - perf expr: Fix "has_event" function for metric style events
+    - perf stat: Avoid metric-only segv
+    - perf metric: Don't remove scale from counts
+    - ASoC: meson: aiu: fix function pointer type mismatch
+    - ASoC: meson: t9015: fix function pointer type mismatch
+    - powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
+    - ASoC: SOF: Add some bounds checking to firmware data
+    - drm: ci: use clk_ignore_unused for apq8016
+    - NTB: fix possible name leak in ntb_register_device()
+    - media: cedrus: h265: Fix configuring bitstream size
+    - media: sun8i-di: Fix coefficient writes
+    - media: sun8i-di: Fix power on/off sequences
+    - media: sun8i-di: Fix chroma difference threshold
+    - staging: media: starfive: Set 16 bpp for capture_raw device
+    - media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
+    - media: go7007: add check of return value of go7007_read_addr()
+    - media: pvrusb2: remove redundant NULL check
+    - media: videobuf2: Add missing doc comment for waiting_in_dqbuf
+    - media: pvrusb2: fix pvr2_stream_callback casts
+    - clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
+    - drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'
+    - drm/panel: boe-tv101wum-nl6: make use of prepare_prev_first
+    - drm/msm/dpu: finalise global state object
+    - drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
+    - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
+    - drm/bridge: adv7511: fix crash on irq during probe
+    - pinctrl: renesas: Allow the compiler to optimize away sh_pfc_pm
+    - clk: hisilicon: hi3519: Release the correct number of gates in
+      hi3519_clk_unregister()
+    - clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
+    - clk: mediatek: mt8135: Fix an error handling path in
+      clk_mt8135_apmixed_probe()
+    - clk: mediatek: mt7622-apmixedsys: Fix an error handling path in
+      clk_mt8135_apmixed_probe()
+    - clk: mediatek: mt8183: Correct parent of CLK_INFRA_SSPM_32K_SELF
+    - clk: mediatek: mt7981-topckgen: flag SGM_REG_SEL as critical
+    - drm/tegra: put drm_gem_object ref on error in tegra_fb_create
+    - tty: mips_ejtag_fdc: Fix passing incompatible pointer type warning
+    - media: ivsc: csi: Swap SINK and SOURCE pads
+    - media: i2c: imx290: Fix IMX920 typo
+    - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
+    - mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a
+      ref
+    - perf print-events: make is_event_supported() more robust
+    - crypto: arm/sha - fix function cast warnings
+    - crypto: ccp - Avoid discarding errors in psp_send_platform_access_msg()
+    - crypto: qat - remove unused macros in qat_comp_alg.c
+    - crypto: qat - removed unused macro in adf_cnv_dbgfs.c
+    - crypto: qat - avoid division by zero
+    - crypto: qat - remove double initialization of value
+    - crypto: qat - fix ring to service map for dcc in 4xxx
+    - crypto: qat - fix ring to service map for dcc in 420xx
+    - crypto: jitter - fix CRYPTO_JITTERENTROPY help text
+    - drm/tidss: Fix initial plane zpos values
+    - drm/tidss: Fix sync-lost issue with two displays
+    - clk: imx: imx8mp: Fix SAI_MCLK_SEL definition
+    - mtd: maps: physmap-core: fix flash size larger than 32-bit
+    - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
+    - mtd: rawnand: brcmnand: exec_op helper functions return type fixes
+    - ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
+    - ASoC: meson: axg-tdm-interface: add frame rate constraint
+    - drm/msm/a6xx: specify UBWC config for sc7180
+    - drm/msm/a7xx: Fix LLC typo
+    - dt-bindings: arm-smmu: fix SM8[45]50 GPU SMMU if condition
+    - perf pmu: Fix a potential memory leak in perf_pmu__lookup()
+    - HID: amd_sfh: Update HPD sensor structure elements
+    - HID: amd_sfh: Avoid disabling the interrupt
+    - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
+    - media: pvrusb2: fix uaf in pvr2_context_set_notify
+    - media: dvb-frontends: avoid stack overflow warnings with clang
+    - media: go7007: fix a memleak in go7007_load_encoder
+    - media: ttpci: fix two memleaks in budget_av_attach
+    - media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
+    - arm64: ftrace: Don't forbid CALL_OPS+CC_OPTIMIZE_FOR_SIZE with Clang
+    - drm/tests: helpers: Include missing drm_drv header
+    - drm/amd/pm: Fix esm reg mask use to get pcie speed
+    - gpio: nomadik: fix offset bug in nmk_pmx_set()
+    - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
+    - mfd: cs42l43: Fix wrong register defaults
+    - powerpc/32: fix ADB_CUDA kconfig warning
+    - powerpc/pseries: Fix potential memleak in papr_get_attr()
+    - powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
+    - clk: qcom: gcc-ipq5018: fix 'enable_reg' offset of 'gcc_gmac0_sys_clk'
+    - clk: qcom: gcc-ipq5018: fix 'halt_reg' offset of 'gcc_pcie1_pipe_clk'
+    - clk: qcom: gcc-ipq5018: fix register offset for GCC_UBI0_AXI_ARES reset
+    - perf vendor events amd: Fix Zen 4 cache latency events
+    - drm/msm/dpu: allow certain formats for CDM for DP
+    - drm/msm/dpu: add division of drm_display_mode's hskew parameter
+    - media: usbtv: Remove useless locks in usbtv_video_free()
+    - drm/xe: Fix ref counting leak on page fault
+    - drm/xe: Replace 'grouped target' in Makefile with pattern rule
+    - lib/stackdepot: fix first entry having a 0-handle
+    - lib/stackdepot: off by one in depot_fetch_stack()
+    - modules: wait do_free_init correctly
+    - mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults
+    - power: supply: mm8013: fix "not charging" detection
+    - powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
+    - powerpc/4xx: Fix warp_gpio_leds build failure
+    - RISC-V: KVM: Forward SEED CSR access to user space
+    - leds: aw2013: Unlock mutex before destroying it
+    - leds: sgm3140: Add missing timer cleanup and flash gpio control
+    - backlight: hx8357: Fix potential NULL pointer dereference
+    - backlight: ktz8866: Correct the check for of_property_read_u32
+    - backlight: lm3630a: Initialize backlight_properties on init
+    - backlight: lm3630a: Don't set bl->props.brightness in get_brightness
+    - backlight: da9052: Fully initialize backlight_properties during probe
+    - backlight: lm3639: Fully initialize backlight_properties during probe
+    - backlight: lp8788: Fully initialize backlight_properties during probe
+    - sparc32: Use generic cmpdi2/ucmpdi2 variants
+    - mtd: maps: sun_uflash: Declare uflash_devinit static
+    - sparc32: Do not select GENERIC_ISA_DMA
+    - sparc32: Fix section mismatch in leon_pci_grpci
+    - clk: Fix clk_core_get NULL dereference
+    - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
+    - PCI: brcmstb: Fix broken brcm_pcie_mdio_write() polling
+    - cifs: Fix writeback data corruption
+    - ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
+    - ALSA: hda/tas2781: use dev_dbg in system_resume
+    - ALSA: hda/tas2781: add lock to system_suspend
+    - ALSA: hda/tas2781: do not reset cur_* values in runtime_suspend
+    - ALSA: hda/tas2781: do not call pm_runtime_force_* in system_resume/suspend
+    - ALSA: hda/tas2781: restore power state after system_resume
+    - ALSA: scarlett2: Fix Scarlett 4th Gen 4i4 low-voltage detection
+    - ALSA: scarlett2: Fix Scarlett 4th Gen autogain status values
+    - ALSA: scarlett2: Fix Scarlett 4th Gen input gain range
+    - ALSA: scarlett2: Fix Scarlett 4th Gen input gain range again
+    - mips: cm: Convert __mips_cm_l2sync_phys_base() to weak function
+    - platform/x86/intel/pmc/lnl: Remove SSRAM support
+    - platform/x86/intel/pmc/arl: Put GNA device in D3
+    - platform/x86/amd/pmf: Do not use readl() for policy buffer access
+    - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
+    - phy: qcom: qmp-usb: split USB-C PHY driver
+    - phy: qcom: qmp-usbc: add support for the Type-C handling
+    - phy: qcom: qmp-usbc: handle CLAMP register in a correct way
+    - scsi: hisi_sas: Fix a deadlock issue related to automatic dump
+    - RDMA/irdma: Remove duplicate assignment
+    - RDMA/srpt: Do not register event handler until srpt device is fully setup
+    - f2fs: compress: fix to guarantee persisting compressed blocks by CP
+    - f2fs: compress: fix to cover normal cluster write with cp_rwsem
+    - f2fs: compress: fix to check unreleased compressed cluster
+    - f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode
+    - f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic
+    - f2fs: zone: fix to wait completion of last bio in zone correctly
+    - f2fs: fix NULL pointer dereference in f2fs_submit_page_write()
+    - f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem
+    - f2fs: fix to avoid potential panic during recovery
+    - scsi: csiostor: Avoid function pointer casts
+    - i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling
+    - RDMA/hns: Fix mis-modifying default congestion control algorithm
+    - RDMA/device: Fix a race between mad_client and cm_client init
+    - RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
+    - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
+    - f2fs: fix to create selinux label during whiteout initialization
+    - f2fs: compress: fix to check zstd compress level correctly in mount option
+    - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
+    - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
+    - NFSv4.2: fix listxattr maximum XDR buffer size
+    - f2fs: compress: fix to check compress flag w/ .i_sem lock
+    - f2fs: check number of blocks in a current section
+    - watchdog: starfive: Check pm_runtime_enabled() before decrementing usage
+      counter
+    - watchdog: stm32_iwdg: initialize default timeout
+    - f2fs: fix to use correct segment type in f2fs_allocate_data_block()
+    - f2fs: ro: compress: fix to avoid caching unaligned extent
+    - RDMA/mana_ib: Fix bug in creation of dma regions
+    - RDMA/mana_ib: Introduce mdev_to_gc helper function
+    - RDMA/mana_ib: Introduce mana_ib_get_netdev helper function
+    - RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function
+    - RDMA/mana_ib: Use virtual address in dma regions for MRs
+    - Input: iqs7222 - add support for IQS7222D v1.1 and v1.2
+    - NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt
+    - NFS: Fix an off by one in root_nfs_cat()
+    - NFSv4.1/pnfs: fix NFS with TLS in pnfs
+    - ACPI: HMAT: Remove register of memory node for generic target
+    - f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks
+    - f2fs: compress: fix reserve_cblocks counting error when out of space
+    - f2fs: fix to truncate meta inode pages forcely
+    - f2fs: zone: fix to remove pow2 check condition for zoned block device
+    - cxl: Fix the incorrect assignment of SSLBIS entry pointer initial location
+    - perf/x86/amd/core: Avoid register reset when CPU is dead
+    - afs: Revert "afs: Hide silly-rename files from userspace"
+    - afs: Don't cache preferred address
+    - afs: Fix occasional rmdir-then-VNOVNODE with generic/011
+    - f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
+    - nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
+    - ovl: relax WARN_ON in ovl_verify_area()
+    - io_uring/net: correct the type of variable
+    - remoteproc: stm32: Fix incorrect type in assignment for va
+    - remoteproc: stm32: Fix incorrect type assignment returned by
+      stm32_rproc_get_loaded_rsc_tablef
+    - iio: pressure: mprls0025pa fix off-by-one enum
+    - usb: phy: generic: Get the vbus supply
+    - tty: vt: fix 20 vs 0x20 typo in EScsiignore
+    - serial: max310x: fix syntax error in IRQ error message
+    - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
+    - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
+    - coresight: Fix issue where a source device's helpers aren't disabled
+    - coresight: etm4x: Set skip_power_up in etm4_init_arch_data function
+    - xhci: Add interrupt pending autoclear flag to each interrupter
+    - xhci: make isoc_bei_interval variable interrupter specific.
+    - xhci: remove unnecessary event_ring_deq parameter from xhci_handle_event()
+    - xhci: update event ring dequeue pointer position to controller correctly
+    - coccinelle: device_attr_show: Remove useless expression STR
+    - kconfig: fix infinite loop when expanding a macro at the end of file
+    - iio: gts-helper: Fix division loop
+    - bus: mhi: ep: check the correct variable in mhi_ep_register_controller()
+    - hwtracing: hisi_ptt: Move type check to the beginning of
+      hisi_ptt_pmu_event_init()
+    - rtc: mt6397: select IRQ_DOMAIN instead of depending on it
+    - rtc: max31335: fix interrupt status reg
+    - serial: 8250_exar: Don't remove GPIO device on suspend
+    - staging: greybus: fix get_channel_from_mode() failure path
+    - mei: vsc: Call wake_up() in the threaded IRQ handler
+    - mei: vsc: Don't use sleeping condition in wait_event_timeout()
+    - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
+    - char: xilinx_hwicap: Fix NULL vs IS_ERR() bug
+    - x86/hyperv: Use per cpu initial stack for vtl context
+    - ASoC: tlv320adc3xxx: Don't strip remove function when driver is builtin
+    - thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error
+      handling path
+    - thermal/drivers/qoriq: Fix getting tmu range
+    - io_uring: don't save/restore iowait state
+    - spi: lpspi: Avoid potential use-after-free in probe()
+    - spi: Restore delays for non-GPIO chip select
+    - ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates
+    - nouveau: reset the bo resource bus info after an eviction
+    - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
+    - rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
+    - octeontx2-af: Use matching wake_up API variant in CGX command interface
+    - s390/vtime: fix average steal time calculation
+    - net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
+    - devlink: Fix devlink parallel commands processing
+    - riscv: Only check online cpus for emulated accesses
+    - soc: fsl: dpio: fix kcalloc() argument order
+    - cpufreq: Fix per-policy boost behavior on SoCs using cpufreq_boost_set_sw()
+    - io_uring: Fix release of pinned pages when __io_uaddr_map fails
+    - tcp: Fix refcnt handling in __inet_hash_connect().
+    - vmxnet3: Fix missing reserved tailroom
+    - hsr: Fix uninit-value access in hsr_get_node()
+    - net: txgbe: fix clk_name exceed MAX_DEV_ID limits
+    - spi: spi-mem: add statistics support to ->exec_op() calls
+    - spi: Fix error code checking in spi_mem_exec_op()
+    - nvme: fix reconnection fail due to reserved tag allocation
+    - drm/xe: Invalidate userptr VMA on page pin fault
+    - drm/xe: Skip VMAs pin when requesting signal to the last XE_EXEC
+    - net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
+    - net: ethernet: mtk_eth_soc: fix PPE hanging issue
+    - io_uring: fix poll_remove stalled req completion
+    - ASoC: SOF: amd: Move signed_fw_image to struct acp_quirk_entry
+    - ASoC: SOF: amd: Skip IRAM/DRAM size modification for Steam Deck OLED
+    - riscv: Fix compilation error with FAST_GUP and rv32
+    - xen/evtchn: avoid WARN() when unbinding an event channel
+    - xen/events: increment refcnt only if event channel is refcounted
+    - packet: annotate data-races around ignore_outgoing
+    - xfrm: Allow UDP encapsulation only in offload modes
+    - net: veth: do not manipulate GRO when using XDP
+    - net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
+    - spi: spi-imx: fix off-by-one in mx51 CPU mode burst length
+    - drm: Fix drm_fixp2int_round() making it add 0.5
+    - virtio: uapi: Drop __packed attribute in linux/virtio_pci.h
+    - vdpa_sim: reset must not run
+    - vdpa/mlx5: Allow CVQ size changes
+    - virtio: packed: fix unmap leak for indirect desc table
+    - net: move dev->state into net_device_read_txrx group
+    - wireguard: receive: annotate data-race around receiving_counter.counter
+    - rds: introduce acquire/release ordering in acquire/release_in_xmit()
+    - hsr: Handle failures in module init
+    - ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels
+    - nouveau/gsp: don't check devinit disable on GSP.
+    - ceph: stop copying to iter at EOF on sync reads
+    - net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
+    - dm-integrity: fix a memory leak when rechecking the data
+    - net/bnx2x: Prevent access to a freed page in page_pool
+    - devlink: fix port new reply cmd type
+    - octeontx2: Detect the mbox up or down message via register
+    - octeontx2-pf: Wait till detach_resources msg is complete
+    - octeontx2-pf: Use default max_active works instead of one
+    - octeontx2-pf: Send UP messages to VF only when VF is up.
+    - octeontx2-af: Use separate handlers for interrupts
+    - drm/amdgpu: add MMHUB 3.3.1 support
+    - drm/amdgpu: fix mmhub client id out-of-bounds access
+    - drm/amdgpu: drop setting buffer funcs in sdma442
+    - netfilter: nft_set_pipapo: release elements in clone only from destroy path
+    - netfilter: nf_tables: do not compare internal table flags on updates
+    - rcu: add a helper to report consolidated flavor QS
+    - net: report RCU QS on threaded NAPI repolling
+    - bpf: report RCU QS in cpumap kthread
+    - net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
+    - net: dsa: mt7530: fix handling of all link-local frames
+    - netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
+    - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
+    - selftests: forwarding: Fix ping failure due to short timeout
+    - dm io: Support IO priority
+    - dm-integrity: align the outgoing bio in integrity_recheck
+    - x86/efistub: Clear decompressor BSS in native EFI entrypoint
+    - x86/efistub: Don't clear BSS twice in mixed mode
+    - printk: Adjust mapping for 32bit seq macros
+    - printk: Use prb_first_seq() as base for 32bit seq macros
+    - Linux 6.8.2
+    - [Config] updateconfig following v6.8.2 import
+  * Provide python perf module (LP: #2051560)
+    - [Packaging] enable perf python module
+    - [Packaging] provide a wrapper module for python-perf
+  * To support AMD Adaptive Backlight Management (ABM) for power profiles daemon
+    >= 2.0 (LP: #2056716)
+    - drm/amd/display: add panel_power_savings sysfs entry to eDP connectors
+    - drm/amdgpu: respect the abmlevel module parameter value if it is set
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable StarFive JH7100 support
+    - [Config] Disable Renesas RZ/Five support
+    - [Config] Disable BINFMT_FLAT for riscv64
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 03 Jun 2024 17:15:49 +0900
+
+linux-qcom (6.8.0-1003.3) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - Fix PCIe bus error
+    - Fix GPU regression
+    - Fix qps615 firmware load
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 10 May 2024 14:41:07 +0900
+
+linux-qcom (6.8.0-1002.2) jammy; urgency=medium
+
+  [ Ubuntu: 6.8.0-31.31 ]
+
+  * noble/linux: 6.8.0-31.31 -proposed tracker (LP: #2062933)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.04.04)
+
+  [ Ubuntu: 6.8.0-30.30 ]
+
+  * noble/linux: 6.8.0-30.30 -proposed tracker (LP: #2061893)
+  * System unstable, kernel ring buffer flooded with "BUG: Bad page state in
+    process swapper/0" (LP: #2056706)
+    - xen-netfront: Add missing skb_mark_for_recycle
+
+  [ Ubuntu: 6.8.0-29.29 ]
+
+  * noble/linux: 6.8.0-29.29 -proposed tracker (LP: #2061888)
+  * [24.04 FEAT] [SEC2353] zcrypt: extend error recovery to deal with device
+    scans (LP: #2050019)
+    - s390/zcrypt: harmonize debug feature calls and defines
+    - s390/zcrypt: introduce dynamic debugging for AP and zcrypt code
+    - s390/pkey: harmonize pkey s390 debug feature calls
+    - s390/pkey: introduce dynamic debugging for pkey
+    - s390/ap: add debug possibility for AP messages
+    - s390/zcrypt: add debug possibility for CCA and EP11 messages
+    - s390/ap: rearm APQNs bindings complete completion
+    - s390/ap: clarify AP scan bus related functions and variables
+    - s390/ap: rework ap_scan_bus() to return true on config change
+    - s390/ap: introduce mutex to lock the AP bus scan
+    - s390/zcrypt: introduce retries on in-kernel send CPRB functions
+    - s390/zcrypt: improve zcrypt retry behavior
+    - s390/pkey: improve pkey retry behavior
+  * [24.04 FEAT] Memory hotplug vmem pages (s390x) (LP: #2051835)
+    - mm/memory_hotplug: introduce MEM_PREPARE_ONLINE/MEM_FINISH_OFFLINE notifiers
+    - s390/mm: allocate vmemmap pages from self-contained memory range
+    - s390/sclp: remove unhandled memory notifier type
+    - s390/mm: implement MEM_PREPARE_ONLINE/MEM_FINISH_OFFLINE notifiers
+    - s390: enable MHP_MEMMAP_ON_MEMORY
+    - [Config] enable CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE and
+      CONFIG_MHP_MEMMAP_ON_MEMORY for s390x
+
+  [ Ubuntu: 6.8.0-28.28 ]
+
+  * noble/linux: 6.8.0-28.28 -proposed tracker (LP: #2061867)
+  * linux-gcp 6.8.0-1005.5 (+ others) Noble kernel regression iwth new apparmor
+    profiles/features (LP: #2061851)
+    - SAUCE: apparmor4.0.0 [92/90]: fix address mapping for recvfrom
+
+  [ Ubuntu: 6.8.0-25.25 ]
+
+  * noble/linux: 6.8.0-25.25 -proposed tracker (LP: #2061083)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.04.04)
+  * Apply mitigations for the native BHI hardware vulnerabilty (LP: #2060909)
+    - x86/cpufeatures: Add new word for scattered features
+    - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file
+    - x86/syscall: Don't force use of indirect calls for system calls
+    - x86/bhi: Add support for clearing branch history at syscall entry
+    - x86/bhi: Define SPEC_CTRL_BHI_DIS_S
+    - x86/bhi: Enumerate Branch History Injection (BHI) bug
+    - x86/bhi: Add BHI mitigation knob
+    - x86/bhi: Mitigate KVM by default
+    - KVM: x86: Add BHI_NO
+    - x86: set SPECTRE_BHI_ON as default
+    - [Config] enable spectre_bhi=auto by default
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/90]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/90]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/90]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/90]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/90]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/90]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/90]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/90]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/90]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/90]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/90]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/90]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/90]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/90]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/90]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/90]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/90]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/90]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/90]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/90]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/90]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [31/90]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/90]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/90]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/90]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/90]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/90]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/90]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/90]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/90]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/90]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/90]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/90]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [43/90]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/90]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/90]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/90]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/90]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/90]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/90]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/90]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/90]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/90]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/90]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/90]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/90]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/90]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/90]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/90]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/90]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/90]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/90]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/90]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/90]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/90]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [65/90] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [69/90]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [70/90]: apparmor: fix oops when racing to retrieve
+      notification
+    - SAUCE: apparmor4.0.0 [71/90]: apparmor: fix notification header size
+    - SAUCE: apparmor4.0.0 [72/90]: apparmor: fix request field from a prompt
+      reply that denies all access
+    - SAUCE: apparmor4.0.0 [73/90]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+    - SAUCE: apparmor4.0.0 [74/90]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/90]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/90]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/90]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/90]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/90]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/90]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/90]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/90]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/90]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/90]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/90]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/90]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/90]: fixup notify
+    - SAUCE: apparmor4.0.0 [88/90]: apparmor: add fine grained ipv4/ipv6 mediation
+    - SAUCE: apparmor4.0.0 [89/90]:apparmor: disable tailglob responses for now
+    - SAUCE: apparmor4.0.0 [90/90]: apparmor: Fix notify build warnings
+    - SAUCE: apparmor4.0.0: fix reserved mem for when we save ipv6 addresses
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/90]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/90]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/90]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+  * [MTL] x86: Fix Cache info sysfs is not populated (LP: #2049793)
+    - SAUCE: cacheinfo: Check for null last-level cache info
+    - SAUCE: cacheinfo: Allocate memory for memory if not done from the primary
+      CPU
+    - SAUCE: x86/cacheinfo: Delete global num_cache_leaves
+    - SAUCE: x86/cacheinfo: Clean out init_cache_level()
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor4.0.0: LSM stacking v39: fix build error with
+      CONFIG_SECURITY=n
+    - [Config] toolchain version update
+
+  [ Ubuntu: 6.8.0-22.22 ]
+
+  * noble/linux: 6.8.0-22.22 -proposed tracker (LP: #2060238)
+
+  [ Ubuntu: 6.8.0-21.21 ]
+
+  * noble/linux: 6.8.0-21.21 -proposed tracker (LP: #2060225)
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain version in annotations
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 01 May 2024 13:45:36 +0900
+
+linux-qcom (6.8.0-1001.1) jammy; urgency=medium
+
+  * Import GA1
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 09 Apr 2024 01:46:04 +0900
+
+linux-qcom (6.8.0-1000.0) jammy; urgency=medium
+
+  [ Ubuntu: 6.8.0-20.20 ]
+
+  * noble/linux: 6.8.0-20.20 -proposed tracker (LP: #2058221)
+  * Noble update: v6.8.1 upstream stable release (LP: #2058224)
+    - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
+    - Documentation/hw-vuln: Add documentation for RFDS
+    - x86/rfds: Mitigate Register File Data Sampling (RFDS)
+    - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
+    - Linux 6.8.1
+  * Autopkgtest failures on amd64 (LP: #2048768)
+    - [Packaging] update to clang-18
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor4.0.0: LSM stacking v39: fix build error with
+      CONFIG_SECURITY=n
+    - [Config] amd64: MITIGATION_RFDS=y
+
+  [ Ubuntu: 6.8.0-19.19 ]
+
+  * noble/linux: 6.8.0-19.19 -proposed tracker (LP: #2057910)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-introduce linux-doc as an empty package
+
+  [ Ubuntu: 6.8.0-18.18 ]
+
+  * noble/linux: 6.8.0-18.18 -proposed tracker (LP: #2057456)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] drop dependency on libclang-17
+
+  [ Ubuntu: 6.8.0-17.17 ]
+
+  * noble/linux: 6.8.0-17.17 -proposed tracker (LP: #2056745)
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Add debian/control sanity check"
+
+  [ Ubuntu: 6.8.0-16.16 ]
+
+  * noble/linux: 6.8.0-16.16 -proposed tracker (LP: #2056738)
+  * left-over ceph debugging printks (LP: #2056616)
+    - Revert "UBUNTU: SAUCE: ceph: make sure all the files successfully put before
+      unmounting"
+  * qat: Improve error recovery flows (LP: #2056354)
+    - crypto: qat - add heartbeat error simulator
+    - crypto: qat - disable arbitration before reset
+    - crypto: qat - update PFVF protocol for recovery
+    - crypto: qat - re-enable sriov after pf reset
+    - crypto: qat - add fatal error notification
+    - crypto: qat - add auto reset on error
+    - crypto: qat - limit heartbeat notifications
+    - crypto: qat - improve aer error reset handling
+    - crypto: qat - change SLAs cleanup flow at shutdown
+    - crypto: qat - resolve race condition during AER recovery
+    - Documentation: qat: fix auto_reset section
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/87]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/87]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/87]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/87]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/87]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/87]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/87]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/87]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/87]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/87]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/87]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/87]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/87]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/87]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/87]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/87]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/87]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/87]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/87]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/87]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/87]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [31/87]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/87]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/87]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/87]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/87]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/87]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/87]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/87]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/87]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/87]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/87]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/87]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [43/87]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/87]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/87]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/87]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/87]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/87]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/87]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/87]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/87]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/87]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/87]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/87]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/87]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/87]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/87]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/87]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/87]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/87]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/87]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/87]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/87]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/87]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [65/87] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [69/87]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [70/87]: apparmor: fix oops when racing to retrieve
+      notification
+    - SAUCE: apparmor4.0.0 [71/87]: apparmor: fix notification header size
+    - SAUCE: apparmor4.0.0 [72/87]: apparmor: fix request field from a prompt
+      reply that denies all access
+    - SAUCE: apparmor4.0.0 [73/87]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+    - SAUCE: apparmor4.0.0 [74/87]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/87]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/87]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/87]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/87]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/87]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/87]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/87]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/87]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/87]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/87]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/87]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/87]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/87]: fixup notify
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/87]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/87]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/87]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+  * Enable lowlatency settings in the generic kernel (LP: #2051342)
+    - [Config] enable low-latency settings
+  * hwmon: (coretemp) Fix core count limitation (LP: #2056126)
+    - hwmon: (coretemp) Introduce enum for attr index
+    - hwmon: (coretemp) Remove unnecessary dependency of array index
+    - hwmon: (coretemp) Replace sensor_device_attribute with device_attribute
+    - hwmon: (coretemp) Remove redundant pdata->cpu_map[]
+    - hwmon: (coretemp) Abstract core_temp helpers
+    - hwmon: (coretemp) Split package temp_data and core temp_data
+    - hwmon: (coretemp) Remove redundant temp_data->is_pkg_data
+    - hwmon: (coretemp) Use dynamic allocated memory for core temp_data
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION
+    - [Packaging] remove debian/scripts/misc/arch-has-odm-enabled.sh
+    - rebase on v6.8
+    - [Config] toolchain version update
+  * Miscellaneous upstream changes
+    - crypto: qat - add fatal error notify method
+  * Rebase on v6.8
+
+  [ Ubuntu: 6.8.0-15.15 ]
+
+  * noble/linux: 6.8.0-15.15 -proposed tracker (LP: #2055871)
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.8-rc7
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Transition laptop-23.10 to generic"
+  * Rebase on v6.8-rc7
+
+  [ Ubuntu: 6.8.0-14.14 ]
+
+  * noble/linux: 6.8.0-14.14 -proposed tracker (LP: #2055551)
+  * Please change CONFIG_CONSOLE_LOGLEVEL_QUIET to 3 (LP: #2049390)
+    - [Config] reduce verbosity when booting in quiet mode
+  * linux: please move erofs.ko (CONFIG_EROFS for EROFS support) from linux-
+    modules-extra to linux-modules (LP: #2054809)
+    - UBUNTU [Packaging]: Include erofs in linux-modules instead of linux-modules-
+      extra
+  * linux: please move dmi-sysfs.ko (CONFIG_DMI_SYSFS for SMBIOS support) from
+    linux-modules-extra to linux-modules (LP: #2045561)
+    - [Packaging] Move dmi-sysfs.ko into linux-modules
+  * Enable CONFIG_INTEL_IOMMU_DEFAULT_ON and
+    CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON (LP: #1951440)
+    - [Config] enable Intel DMA remapping by default
+  * disable Intel DMA remapping by default (LP: #1971699)
+    - [Config] update tracking bug for CONFIG_INTEL_IOMMU_DEFAULT_ON
+  * Packaging resync (LP: #1786013)
+    - debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.02.29)
+  * Miscellaneous Ubuntu changes
+    - SAUCE: modpost: Replace 0-length array with flex-array member
+    - [packaging] do not include debian/ directory in a binary package
+    - [packaging] remove debian/stamps/keep-dir
+
+  [ Ubuntu: 6.8.0-13.13 ]
+
+  * noble/linux: 6.8.0-13.13 -proposed tracker (LP: #2055421)
+  * Packaging resync (LP: #1786013)
+    - debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.02.29)
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.8-rc6
+    - [Config] updateconfifs following v6.8-rc6 rebase
+  * Rebase on v6.8-rc6
+
+  [ Ubuntu: 6.8.0-12.12 ]
+
+  * linux-tools-common: man page of usbip[d] is misplaced (LP: #2054094)
+    - [Packaging] rules: Put usbip manpages in the correct directory
+  * Validate connection interval to pass Bluetooth Test Suite (LP: #2052005)
+    - Bluetooth: Enforce validation on max value of connection interval
+  * Turning COMPAT_32BIT_TIME off on s390x (LP: #2038583)
+    - [Config] Turn off 31-bit COMPAT on s390x
+  * Don't produce linux-source binary package (LP: #2043994)
+    - [Packaging] Add debian/control sanity check
+  * Don't produce linux-*-source-<version> package (LP: #2052439)
+    - [Packaging] Move linux-source package stub to debian/control.d
+    - [Packaging] Build linux-source package only for the main kernel
+  * Don't produce linux-*-cloud-tools-common, linux-*-tools-common and
+    linux-*-tools-host binary packages (LP: #2048183)
+    - [Packaging] Move indep tools package stubs to debian/control.d
+    - [Packaging] Build indep tools packages only for the main kernel
+  * Enable CONFIG_INTEL_IOMMU_DEFAULT_ON and
+    CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON (LP: #1951440)
+    - [Config] enable Intel DMA remapping by default
+  * disable Intel DMA remapping by default (LP: #1971699)
+    - [Config] update tracking bug for CONFIG_INTEL_IOMMU_DEFAULT_ON
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Transition laptop-23.10 to generic
+
+  [ Ubuntu: 6.8.0-11.11 ]
+
+  * noble/linux: 6.8.0-11.11 -proposed tracker (LP: #2053094)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] riscv64: disable building unnecessary binary debs
+
+  [ Ubuntu: 6.8.0-10.10 ]
+
+  * noble/linux: 6.8.0-10.10 -proposed tracker (LP: #2053015)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] add Rust build-deps for riscv64
+  * Miscellaneous upstream changes
+    - Revert "Revert "UBUNTU: [Packaging] temporarily disable Rust dependencies on
+      riscv64""
+
+  [ Ubuntu: 6.8.0-9.9 ]
+
+  * noble/linux: 6.8.0-9.9 -proposed tracker (LP: #2052945)
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable Rust dependencies on
+      riscv64"
+
+  [ Ubuntu: 6.8.0-8.8 ]
+
+  * noble/linux: 6.8.0-8.8 -proposed tracker (LP: #2052918)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] riscv64: enable linux-libc-dev build
+    - v6.8-rc4 rebase
+  * Rebase on v6.8-rc4
+
+  [ Ubuntu: 6.8.0-7.7 ]
+
+  * noble/linux: 6.8.0-7.7 -proposed tracker (LP: #2052691)
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/87]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/87]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/87]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/87]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/87]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/87]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/87]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/87]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/87]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/87]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/87]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/87]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/87]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/87]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/87]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/87]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/87]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/87]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/87]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/87]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/87]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [31/87]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/87]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/87]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/87]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/87]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/87]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/87]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/87]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/87]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/87]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/87]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/87]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [43/87]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/87]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/87]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/87]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/87]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/87]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/87]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/87]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/87]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/87]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/87]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/87]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/87]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/87]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/87]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/87]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/87]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/87]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/87]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/87]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/87]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/87]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [65/87] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [69/87]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [70/87]: apparmor: fix oops when racing to retrieve
+      notification
+    - SAUCE: apparmor4.0.0 [71/87]: apparmor: fix notification header size
+    - SAUCE: apparmor4.0.0 [72/87]: apparmor: fix request field from a prompt
+      reply that denies all access
+    - SAUCE: apparmor4.0.0 [73/87]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+    - SAUCE: apparmor4.0.0 [74/87]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/87]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/87]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/87]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/87]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/87]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/87]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/87]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/87]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/87]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/87]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/87]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/87]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/87]: fixup notify
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/87]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/87]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/87]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+
+  [ Ubuntu: 6.8.0-6.6 ]
+
+  * noble/linux: 6.8.0-6.6 -proposed tracker (LP: #2052592)
+  * Packaging resync (LP: #1786013)
+    - debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.02.07)
+    - [Packaging] update variants
+  * FIPS kernels should default to fips mode (LP: #2049082)
+    - SAUCE: Enable fips mode by default, in FIPS kernels only
+  * Fix snapcraftyaml.yaml for jammy:linux-raspi (LP: #2051468)
+    - [Packaging] Remove old snapcraft.yaml
+  * Azure: Fix regression introduced in LP: #2045069 (LP: #2052453)
+    - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove in-tree abi checks
+    - [Packaging] drop abi files with clean
+    - [Packaging] Remove do_full_source variable (fixup)
+    - [Packaging] Remove update-dkms-versions and move dkms-versions
+    - [Config] updateconfigs following v6.8-rc3 rebase
+    - [packaging] rename to linux
+    - [packaging] rebase on v6.8-rc3
+    - [packaging] disable signing for ppc64el
+  * Rebase on v6.8-rc3
+
+  [ Ubuntu: 6.8.0-5.5 ]
+
+  * noble/linux-unstable: 6.8.0-5.5 -proposed tracker (LP: #2052136)
+  * Miscellaneous upstream changes
+    - Revert "mm/sparsemem: fix race in accessing memory_section->usage"
+
+  [ Ubuntu: 6.8.0-4.4 ]
+
+  * noble/linux-unstable: 6.8.0-4.4 -proposed tracker (LP: #2051502)
+  * Migrate from fbdev drivers to simpledrm and DRM fbdev emulation layer
+    (LP: #1965303)
+    - [Config] enable simpledrm and DRM fbdev emulation layer
+  * Miscellaneous Ubuntu changes
+    - [Config] toolchain update
+  * Miscellaneous upstream changes
+    - rust: upgrade to Rust 1.75.0
+
+  [ Ubuntu: 6.8.0-3.3 ]
+
+  * noble/linux-unstable: 6.8.0-3.3 -proposed tracker (LP: #2051488)
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [43/87]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/87]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/87]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/87]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/87]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/87]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/87]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/87]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/87]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/87]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/87]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/87]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/87]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/87]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/87]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/87]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/87]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/87]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/87]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/87]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/87]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/87]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [69/87]: add io_uring mediation
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+  * apparmor restricts read access of user namespace mediation sysctls to root
+    (LP: #2040194)
+    - SAUCE: apparmor4.0.0 [73/87]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+  * AppArmor spams kernel log with assert when auditing (LP: #2040192)
+    - SAUCE: apparmor4.0.0 [72/87]: apparmor: fix request field from a prompt
+      reply that denies all access
+  * apparmor notification files verification (LP: #2040250)
+    - SAUCE: apparmor4.0.0 [71/87]: apparmor: fix notification header size
+  * apparmor oops when racing to retrieve a notification (LP: #2040245)
+    - SAUCE: apparmor4.0.0 [70/87]: apparmor: fix oops when racing to retrieve
+      notification
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/87]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/87]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/87]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor4.0.0 [01/87]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/87]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/87]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/87]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/87]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/87]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/87]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/87]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/87]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/87]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/87]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/87]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/87]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/87]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/87]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/87]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/87]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/87]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/87]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/87]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/87]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [30/87]: LSM stacking v39: LSM: Single calls in
+      socket_getpeersec hooks
+    - SAUCE: apparmor4.0.0 [31/87]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/87]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/87]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/87]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/87]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/87]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/87]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/87]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/87]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/87]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/87]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/87]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [65/87] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [74/87]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/87]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/87]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/87]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/87]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/87]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/87]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/87]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/87]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/87]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/87]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/87]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/87]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/87]: fixup notify
+    - [Config] updateconfigs following v6.8-rc2 rebase
+
+  [ Ubuntu: 6.8.0-2.2 ]
+
+  * noble/linux-unstable: 6.8.0-2.2 -proposed tracker (LP: #2051110)
+  * Miscellaneous Ubuntu changes
+    - [Config] toolchain update
+    - [Config] enable Rust
+
+  [ Ubuntu: 6.8.0-1.1 ]
+
+  * noble/linux-unstable: 6.8.0-1.1 -proposed tracker (LP: #2051102)
+  * Miscellaneous Ubuntu changes
+    - [packaging] move to v6.8-rc1
+    - [Config] updateconfigs following v6.8-rc1 rebase
+    - SAUCE: export file_close_fd() instead of close_fd_get_file()
+    - SAUCE: cpufreq: s/strlcpy/strscpy/
+    - debian/dkms-versions -- temporarily disable zfs dkms
+    - debian/dkms-versions -- temporarily disable ipu6 and isvsc dkms
+    - debian/dkms-versions -- temporarily disable v4l2loopback
+
+  [ Ubuntu: 6.8.0-0.0 ]
+
+  * Empty entry.
+
+  [ Ubuntu: 6.7.0-7.7 ]
+
+  * noble/linux-unstable: 6.7.0-7.7 -proposed tracker (LP: #2049357)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable signing for s390x and ppc64el
+
+  [ Ubuntu: 6.7.0-6.6 ]
+
+  * Empty entry.
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 27 Mar 2024 23:23:18 +0900
+
+linux-qcom (6.7.0-1012.12) jammy; urgency=medium
+
+  * [qcom alpha] Suppress noisy logs
+    - SAUCE: icnss2: supress noisy logs
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: update apply overlay application for pre-GA
+    - SAUCE: update graphics DT overlay to pre-GA
+    - SAUCE: update display DT overlay to pre-GA
+    - SAUCE: update camera overlay to pre-GA
+    - SAUCE: update bluetooth DT overlay to pre-GA
+    - SAUCE: update wlan DT overlay to pre-GA
+    - [config] Disable CONFIG_EFI_ZBOOT
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 21 Mar 2024 02:17:22 +0900
+
+linux-qcom (6.7.0-1011.11) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: update wlan qclacld driver code to pre-GA
+    - SAUCE: update qcm6490 display code to pre-GA
+    - SAUCE: fix build warnings and errors in WLAN driver
+    - SAUCE: import qcm6490 graphics driver code
+    - SAUCE: dynamically allocate the kgsl-pool shrinker for kernel>=6.7
+    - SAUCE: change strtobool() to kstrtobool()
+    - SAUCE: update qcm6490 camera driver code to pre-GA
+    - SAUCE: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: remove unused camera_banner
+    - Config: Update config after applying Pre-GA patches
+    - Packaging: Update module list after merging pre-ga patches
+
+  * Miscellaneous upstream changes
+    - QCLINUX: arm64: defconfig: qcom: Enable UVC/UAC related configs
+    - FROMGIT: scsi: ufs: qcom: Add support to Configure
+      PA_VS_CORE_CLK_40NS_CYCLES
+    - FROMLIST: iommu/arm-smmu: add ACTLR data and support for SC7280
+    - FROMLIST: iommu/arm-smmu: re-enable context caching in smmu reset operation
+    - PENDING: soundwire: qcom: add channel mask port configuration for soundwire
+      master
+    - PENDING: dt-bindings: soundwire: qcom: Document the port channel mask
+      property
+    - PENDING: arm64: dts: qcom: sc7280: add channel mask ports for tx soundwire
+    - FROMGIT: iio: adc: Add PM7325 PMIC7 ADC bindings
+    - PENDING: iris: fix LTR_COUNT configuration to firmware
+    - PENDING: i2c: i2c-qcom-geni: Add Multi EE feature support
+    - FROMLIST: dt-bindings: misc: qcom,dcc: Add the dtschema
+    - PENDING: ASoC: qcom: qcm6490: Fix clock freq for mi2s and tdm
+    - FROMLIST: misc: dcc: Add driver support for Data Capture and Compare
+      unit(DCC)
+    - PENDING: misc: fastrpc: Release PDR handle
+    - QCLINUX: arm64: configs: qcom: Enable TRACE_MMIO_ACCESS
+    - PENDING: arm64: dts: qcom: sc7280: Correct the compatible of dcc
+    - QCLINUX: arm64: defconfig: Enable DCC config
+    - QCLINUX: arm64: defconfig: qcom: Disable DEBUG_INFO_REDUCED
+    - PENDING: scsi: ufs: host: Bugfix evict key call in ufs host
+    - FROMLIST: soc: qcom: ice: support for hardware wrapped keys
+    - PENDING: iris: change the default value of HEADER_MODE config
+    - QCLINUX: ASoC: qcom: audio-pkt: avoid duplicate sysfs during ssr
+    - QCLINUX: ASoC: qcom: qdsp6: Add support to create CMA heap
+    - QCLINUX: soc: qcom: Implement a driver to write kaslr addr to imem
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add reserved memory for audio ml
+    - QCLINUX: arm64: defconfig: Enable smp2p_sleepstate
+    - FROMGIT: dt-bindings: soc: qcom,aoss-qmp: document the SM8560 Always-On
+      Subsystem side channel
+    - FROMGIT: dt-bindings: interconnect: qcom-bwmon: document SM8650 BWMONs
+    - FROMGIT: dt-bindings: usb: qcom,dwc3: document the SM8560 SuperSpeed DWC3
+      USB controller
+    - FROMGIT: dt-bindings: dma: qcom,gpi: document the SM8650 GPI DMA Engine
+    - FROMGIT: dt-bindings: crypto: qcom,inline-crypto-engine: document the SM8650
+      ICE
+    - FROMGIT: dt-bindings: qcom,pdc: Add compatible for SM8550
+    - FROMGIT: arm64: dts: qcom: sm8550: add TRNG node
+    - FROMGIT: dt-bindings: qcom,pdc: document the SM8650 Power Domain Controller
+    - FROMGIT: dt-bindings: soc: qcom: pmic-glink: document SM8650 compatible
+    - FROMGIT: dt-bindings: crypto: qcom,prng: document SM8650
+    - FROMGIT: dt-bindings: firmware: qcom,scm: document SM8650 SCM Firmware
+      Interface
+    - FROMGIT: dt-bindings: iommu: arm,smmu: document the SM8650 System MMU
+    - FROMGIT: dt-bindings: thermal: qcom-tsens: document the SM8650 Temperature
+      Sensor
+    - FROMGIT: dt-bindings: clock: qcom: document the SM8650 TCSR Clock Controller
+    - FROMGIT: dt-bindings: clock: qcom: document the SM8650 General Clock
+      Controller
+    - FROMGIT: dt-bindings: clock: qcom: document the SM8650 Display Clock
+      Controller
+    - FROMGIT: dt-bindings: clock: qcom: document the SM8650 GPU Clock Controller
+    - FROMGIT: clk: qcom: add the SM8650 Global Clock Controller driver, part 1
+    - FROMGIT: clk: qcom: add the SM8650 Global Clock Controller driver, part 2
+    - FROMGIT: clk: qcom: add the SM8650 TCSR Clock Controller driver
+    - FROMGIT: clk: qcom: add the SM8650 Display Clock Controller driver
+    - FROMGIT: clk: qcom: add the SM8650 GPU Clock Controller driver
+    - FROMGIT: clk: qcom: rpmh: add clocks for SM8650
+    - FROMGIT: dt-bindings: interconnect: document the RPMh Network-On-Chip
+      Interconnect in Qualcomm SM8650 SoC
+    - FROMGIT: interconnect: qcom: introduce RPMh Network-On-Chip Interconnect on
+      SM8650 SoC
+    - FROMGIT: dt-bindings: cache: qcom,llcc: Document the SM8650 Last Level Cache
+      Controller
+    - FROMGIT: soc: qcom: llcc: Add configuration data for SM8650
+    - FROMGIT: drm/msm/dpu: enable smartdma on sm8350
+    - FROMGIT: drm/msm/dpu: enable SmartDMA on SM8450
+    - FROMGIT: drm/msm/dpu: populate SSPP scaler block version
+    - FROMGIT: drm/msm/dpu: Drop unused get_scaler_ver callback from SSPP
+    - FROMGIT: drm/msm/dpu: Drop unused qseed_type from catalog dpu_caps
+    - FROMGIT: drm/msm/dpu: drop the `id' field from DPU_HW_SUBBLK_INFO
+    - FROMGIT: drm/msm/dpu: drop the `smart_dma_priority' field from struct
+      dpu_sspp_sub_blks
+    - FROMGIT: drm/msm/dpu: deduplicate some (most) of SSPP sub-blocks
+    - FROMGIT: drm/msm/dpu: drop DPU_HW_SUBBLK_INFO macro
+    - FROMGIT: drm/msm/dpu: rewrite scaler and CSC presense checks
+    - FROMGIT: drm/msm/dpu: merge DPU_SSPP_SCALER_QSEED3, QSEED3LITE, QSEED4
+    - FROMGIT: drm/msm/gpu: drop duplicating VIG feature masks
+    - FROMGIT: dt-bindings: display: msm-dsi-phy-7nm: document the SM8650 DSI PHY
+    - FROMGIT: dt-bindings: display: msm-dsi-controller-main: document the SM8650
+      DSI Controller
+    - FROMGIT: dt-bindings: display: msm: document the SM8650 DPU
+    - FROMGIT: dt-bindings: display: msm: document the SM8650 Mobile Display
+      Subsystem
+    - FROMGIT: drm/msm/dpu: add support for SM8650 DPU
+    - FROMGIT: drm/msm: mdss: add support for SM8650
+    - FROMGIT: drm/msm: dsi: add support for DSI-PHY on SM8650
+    - FROMGIT: drm/msm: dsi: add support for DSI 2.8.0
+    - FROMGIT: dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: document the SM8650
+      QMP UFS PHY
+    - FROMGIT: dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: document the SM8650
+      QMP PCIe PHYs
+    - FROMGIT: dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: document the
+      SM8650 QMP USB/DP Combo PHY
+    - FROMGIT: dt-bindings: phy: qcom,snps-eusb2: document the SM8650 Synopsys
+      eUSB2 PHY
+    - FROMGIT: phy: qcom: qmp-ufs: add QMP UFS PHY tables for SM8650
+    - FROMGIT: phy: qcom: qmp-pcie: add QMP PCIe PHY tables for SM8650
+    - FROMGIT: phy: qcom: qmp-combo: add QMP USB3/DP PHY tables for SM8650
+    - FROMGIT: dt-bindings: pinctrl: document the SM8650 Top Level Mode
+      Multiplexer
+    - FROMGIT: pinctrl: qcom: handle intr_target_reg wakeup_present/enable bits
+    - FROMGIT: pinctrl: qcom: sm8650-lpass-lpi: add SM8650 LPASS
+    - FROMGIT: pinctrl: qcom: Introduce the SM8650 Top Level Mode Multiplexer
+      driver
+    - FROMGIT: dt-bindings: arm: qcom,ids: Add SoC ID for SM8650
+    - FROMGIT: soc: qcom: socinfo: Add SM8650 SoC ID table entry
+    - FROMGIT: dt-bindings: arm: qcom: document SM8650 and the reference boards
+    - FROMGIT: arm64: dts: qcom: add initial SM8650 dtsi
+    - FROMGIT: arm64: dts: qcom: pm8550ve: make PMK8550VE SID configurable
+    - FROMGIT: arm64: dts: qcom: sm8650: add initial SM8650 MTP dts
+    - FROMGIT: arm64: dts: qcom: sm8650: add initial SM8650 QRD dts
+    - FROMGIT: arm64: dts: qcom: sm8650: add interconnect dependent device nodes
+    - FROMGIT: arm64: dts: qcom: sm8650-mtp: add interconnect dependent device
+      nodes
+    - FROMGIT: arm64: dts: qcom: sm8650-qrd: add interconnect dependent device
+      nodes
+    - FROMGIT: dt-bindings: clock: qcom: Document the SM8650 RPMH Clock Controller
+    - QCLINUX: ASoC: qcm6490: Initialize slimbus dais
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add sound node for RB3 Gen2 nav mezz
+    - PENDING: videocc: enable HW_CTRL for mvs0 gdsc
+    - PENDING: iris: switch vcodec gdsc mode before handling vcodec clocks
+    - PENDING: arm64: dts: qcom: qcm6490-rb3g2: Add PCIe nodes
+    - QCLINUX: dt-bindings: pci: qps615: Add qps615 QCOM PCIe switch
+    - QCLINUX: arm64: dts: qcm6490-rb3: Add support for qps615 switch
+    - QCLINUX: pci: controller: misc: Add qcom qps615 switch driver
+    - QCLINUX: soc: qcom: Register a panic_notifier to cause wdt bite on panic
+    - PENDING: arm64: boot: dts: qcm6490: Add CMA heap for smcinvoke
+    - PENDING: soundwire: qcom: Add support for multiple sample rates
+    - PENDING: ASoC: codecs: lpass: Add macro and dcodec clock disable in suspend
+    - QCLINUX: arm64: defconfig: qcom: Enable CONFIG_SCHED_DEBUG
+    - PENDING: iris: fix bitrate mode setting to firmware
+    - PENDING: i2c: i2c-qcom-geni: Correct I2C TRE sequence
+    - QCLINUX: Revert "QCLINUX: soc: qcom: smcinvoke: Add hardcoded mem-buf API
+      values"
+    - PENDING: dt-bindings: phy: qcom,qmp: Add PCIe qcom,refclk-always-on property
+    - PENDING: phy: qcom-qmp-pcie: Add endpoint refclk control register offset
+    - BACKPORT: FROMGIT: dt-bindings: power: rpmpd: Update part number to X1E80100
+    - FROMGIT: pmdomain: qcom: rpmhpd: Update part number to X1E80100
+    - FROMGIT: dt-bindings: pinctrl: qcom: Add X1E80100 pinctrl
+    - FROMGIT: pinctrl: qcom: Add X1E80100 pinctrl driver
+    - BACKPORT: FROMGIT: dt-bindings: cache: qcom,llcc: Add X1E80100 compatible
+    - FROMGIT: dt-bindings: arm: qcom-soc: extend pattern for matching existing
+      SoCs
+    - FROMGIT: dt-bindings: arm: qcom-soc: extend pattern matching for X1E80100
+      SoC
+    - FROMGIT: dt-bindings: firmware: qcom,scm: document SCM on X1E80100 SoCs
+    - FROMGIT: dt-bindings: clock: qcom: Add X1E80100 GCC clocks
+    - FROMGIT: dt-bindings: clock: qcom-rpmhcc: Add RPMHCC bindings for X1E80100
+    - FROMGIT: clk: qcom: Add Global Clock controller (GCC) driver for X1E80100
+    - FROMGIT: clk: qcom: rpmh: Add support for X1E80100 rpmh clocks
+    - FROMGIT: dt-bindings: arm: cpus: Add qcom,oryon compatible
+    - FROMGIT: dt-bindings: arm: qcom: Document X1E80100 SoC and boards
+    - FROMGIT: dt-bindings: arm-smmu: Add compatible for X1E80100 SoC
+    - FROMGIT: dt-bindings: dma: qcom: gpi: add compatible for X1E80100
+    - FROMGIT: dt-bindings: interrupt-controller: qcom,pdc: document pdc on
+      X1E80100
+    - FROMGIT: dt-bindings: interconnect: Add Qualcomm X1E80100 SoC
+    - FROMGIT: interconnect: qcom: Add X1E80100 interconnect provider driver
+    - FROMGIT: arm64: dts: qcom: Add base X1E80100 dtsi and the QCP dts
+    - UPSTREAM: arm64: dts: qcom: x1e80100: Add Compute Reference Device
+    - QCLINUX: Add audio support for rb3gen2 video mezzanine boards
+    - PENDING: phy: qcom-qmp-pcie: Add support for keeping refclk always on
+    - QCLINUX: arm64: configs: qcom: Disable QCOM_FORCE_WDOG_BITE_ON_PANIC
+    - QCLINUX: arm64: configs: qcom: Enable QCOM_SOC_DEBUG driver
+    - Revert "QCLINUX: virt: gunyah: Write KASLR addr to IMEM"
+    - PENDING: Revert "PENDING: soc: qcom: smcinvoke: Add custom CMA heap support"
+    - PENDING: ASoC: qcom: q6dsp: Add support for multiple sample rates
+    - PENDING: i2c: i2c-qcom-geni: Add support to identify NACK in GSI Mode
+    - PENDING: pinctrl: qcom: lpass-lpi: Add suspend and resume runtime pm ops
+    - PENDING: arm64: dts: qcom: Enable support for pcie1 clocks on rb3 board
+    - QCLINUX: arm64: defconfig: qcom: Add support for NB7VPQ904M on AIM300
+    - QCLINUX: arm64: defconfig: qcom: Enable PCIe related configs
+    - QCLINUX: arm64: defconfig: qcom: Auto update configs
+    - QCLINUX: arm64: defconfig: qcom: Enable MODULE_SIG config
+    - PENDING: arm64: dts: qcom: Enable and update ipa to load gsi fw
+    - PENDING: drivers: smp2p: Add snapshot of smp2p_sleepstate driver
+    - PENDING: ARM: msm: Add support for smp2p_sleepstate
+    - QCLINUX: Revert "QCLINUX: arm64: dts: qcm6490-rb3: Add support for PM8008
+      PMIC"
+    - PENDING: firmware: shmbridge: Set dma capabilities 32bit by default
+    - PENDING: arm64: dts: qcom: qcm6490-addons: Enable smp2p-sleepstate
+    - PENDING: soc: qcom: qmi_encdec: out of bound check for input buffer
+    - PENDING: iris: configure work mode to STAGE 1 in CBR use case
+    - FROMLIST: arm64: dts: qcom: sc7280: Add additional MSI interrupts
+    - QCLINUX: soc: glink_altmode: Add API to notify hpd-irq & orientation
+    - PENDING: arm64: dts: qcom: sm8550: Add dma-coherent property
+    - QCLINUX: arm64: defconfig: qcom: Enable testmode config for QCM6490
+    - FROMGIT: arm64: dts: qcom: pm8550: drop PWM address/size cells
+    - FROMLIST: dt-bindings: arm: qcom: Document QCM8550, QCS8550 SoC and board
+    - FROMLIST: dt-bindings: arm: qcom,ids: add SoC ID for QCM8550 and QCS8550
+    - FROMLIST: soc: qcom: socinfo: add SoC Info support for QCM8550 and QCS8550
+      platform
+    - FROMGIT: ASoC: dt-bindings: qcom,sm8250: add SM8550 sound card
+    - FROMLIST: arm64: dts: qcom: qcm8550: introduce qcm8550 dtsi
+    - FROMLIST: arm64: dts: qcom: add base AIM300 dtsi
+    - FROMLIST: arm64: dts: qcom: aim300: add AIM300 AIoT
+    - FROMGIT: arm64: dts: qcom: sm8550: Add GPU nodes
+    - QCLINUX: arm64: defconfig: Add VM configs for qcm6490
+    - FROMLIST: misc: fastrpc: Mark all sessions as invalid in cb_remove
+    - PENDING: wil6210: Drop unicast sub frame if part of a multicast amsdu
+    - QCLINUX: arm64: defconfig: Add support for USB mouse&keyboard on AIM300
+    - QCLINUX: arm64: defconfig: Add qcom vm configs
+    - QCLINUX: dt-bindings: arm: qcom: Add X1E80100 addons support
+    - QCLINUX: arm64: defconfig: Add configs for Radar enumeration over USB
+    - QCLINUX: arm64: dts: qcm6490-idp: Add label for pmic-glink DT node
+    - PENDING: iris: replace dev_info with dev_dbg
+    - PENDING: iris: add support for dynamic resolution flag
+    - FROMLIST: media: v4l2-ctrls: add encoder maximum bitrate control
+    - QCLINUX: arm64: dts: Add x1e80100-addons CRD and QCP
+    - QCLINUX: arm64: defconfig: Enable X1E80100 base configs
+    - QCLINUX: arm64: defconfig: qcom: enable SM8550 GPUCC/CAMCC
+    - QCLINUX: arm64: dts: qcm6490-addons: Add label for pmic-glink DT node
+    - FROMGIT: soc: qcom: add ADSP PDCharger ULOG driver
+    - PENDING: soc: qcom: add snapshot for panel event notifier
+    - QCLINUX: arm64: defconfig: enable panel_event_notifier
+    - PENDING: iris: add new rate control type MBR for encoder
+    - QCLINUX: arm64: defconfig: qcom: enable flash led device
+    - PENDING: qcom: defconfig: enable module compilation of videoCC 8550
+    - PENDING: arm64: boot: dts: Add Support for nb7vpq904m on QCM6490 RB3
+    - QCLINUX: dt-bindings: arm: qcom: Add QCS8550 addons support
+    - PENDING:arm64:defconfig:add realtek config
+    - FROMLIST: phy: qcom: qmp-pcie: Update PCIe1 PHY settings for SM8550
+    - FROMLIST: arm64: dts: qcom: sm8550: Increase supported MSI interrupts
+    - FROMLIST: phy: qcom: qmp-pcie: Update PCIe0 PHY settings for SM8550
+    - FROMLIST: arm64: dts: qcom: aim300: Enable PCIe0 for WLAN
+    - PENDING: arm64: dts: qcom: aim300: Add smmu id for each BDF
+    - QCLINUX: arm64: dts: qcom: Add addons support for AIM300 AIOT
+    - QCLINUX: arm64: dts: qcom: aim300: Add support for qps615 switch
+    - PENDING: arm64: dts: qcom: qcs8550: overwrite video attribute in qcs8550
+    - PENDING: arm64: dts: qcom: sm8550: fix this issue of ICE HW generate key
+    - PENDING: arm64: dts: qcom: sm8550: add iris DT node
+    - FROMGIT: ufs: core: Add CPU latency QoS support for ufs driver
+    - QCLINUX: arm64: defconfig: Prune qcom_defconfig
+    - QCLINUX: arm64: defconfig: enable displayport config
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add sound node for RB3 Gen2 video
+      mezz
+    - QCLINUX: dt-bindings: soc: qcom: Add secure buffer doc
+    - PENDING: slimbus: qcom-ngd-ctrl: Add null check for dma descriptor
+    - PENDING: slimbus: qcom-ngd-ctrl: Add timeout for wait operation
+    - QCLINUX: ASoC: codecs: msm-stub: Add input and output dapm widget
+    - QCLINUX: ASoC: qcom: qcm6490: Modify dapm routings for pinctrl widget
+    - QCLINUX: arm64: defconfig: qcom: Enable CEC support
+    - PENDING: arm64: dts: qcom: aim300: update PIL firmware path and name
+    - PENDING: arm64: dts: qcom: Disable the lpasscc node on qcm6490
+    - PENDING: dt-bindings: arm: qcom: Document rb5gen2-hdk board
+    - PENDING: arm64: dts: qcom: Add initial support for rb5gen2 SOM
+    - QCLINUX: arm64: dts: qcom: Add tz-log node
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Update the MI2S pinctrl name
+    - PENDING: arm64: dts: qcom: Add initial support for rb5gen2 HDK board
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for qcs8550-rb5gen2-HDK
+    - PENDING: iris: add to support max input buffer count
+    - PENDING: iris: update firmware path for SM8550
+    - FROMLIST: coresight: etm4x: Set skip_power_up in etm4_init_arch_data
+      function
+    - FROMGIT: coresight-tpdm: Remove the unnecessary lock
+    - FROMGIT: dt-bindings: arm: Add support for DSB element size
+    - FROMGIT: coresight-tpdm: Introduce TPDM subtype to TPDM driver
+    - FROMGIT: coresight-tpda: Add DSB dataset support
+    - FROMGIT: coresight-tpdm: Initialize DSB subunit configuration
+    - FROMGIT: coresight-tpdm: Add reset node to TPDM node
+    - FROMGIT: coresight-tpdm: Add nodes to set trigger timestamp and type
+    - FROMGIT: coresight-tpdm: Add node to set dsb programming mode
+    - PENDING: ASoC: dt-bindings: qcom,lpass-rx-macro: Document the rx_mclk muxsel
+      property
+    - PENDING: dt-bindings: soc: qcom: Add documentation for memory-dump
+    - FROMGIT: coresight-tpdm: Add nodes for dsb edge control
+    - FROMGIT: coresight-tpdm: Add nodes to configure pattern match output
+    - FROMGIT: coresight-tpdm: Add nodes for timestamp request
+    - FROMGIT: dt-bindings: arm: Add support for DSB MSR register
+    - FROMLIST: coresight: core: Add device name support
+    - FROMGIT: coresight-tpdm: Add nodes for dsb msr support
+    - FROMGIT: coresight-tpdm: Correct the property name of MSR number
+    - FROMLIST: coresight-tpdm: Optimize the store function of tpdm simple dataset
+    - FROMLIST: coresight-tpdm: Optimize the useage of tpdm_has_dsb_dataset
+    - FROMLIST: dt-bindings: arm: qcom,coresight-tpdm: Add support for CMB element
+      size
+    - FROMLIST: coresight-tpdm: Add CMB dataset support
+    - FROMLIST: coresight-tpda: Add support to configure CMB element
+    - FROMLIST: coresight-tpdm: Add support to configure CMB
+    - FROMLIST: coresight-tpdm: Add pattern registers support for CMB
+    - FROMLIST: coresight-tpdm: Add timestamp control register support for the CMB
+    - FROMLIST: dt-bindings: arm: qcom,coresight-tpdm: Add support for TPDM CMB
+      MSR register
+    - FROMLIST: coresight-tpdm: Add msr register support for CMB
+    - QCLINUX: arm64: defconfig: Align qcm6490 configs
+    - QCLINUX: arm64: defconfig: Enable zram for qcm6490
+    - QCLINUX: arm64: defconfig: Enable UIO for qcm6490
+    - PENDING: soundwire: stream: Skip asynchronous mode support
+    - PENDING: ASoC: codec: lpass-rx-macro: Add native sample rate headset
+      playback support
+    - PENDING: ASoC: qcom: q6dsp: Update channels and max rate for TDM
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add MI2S Data1 line support
+    - QCLINUX: ASoC: qcom: qcm6490: Remove clock set in machine driver
+    - QCLINUX: ASoC: codecs: Update channels and sample rate for stub codec
+    - QCLINUX: drivers: soc: qcom: Add support for qcom secure buffer driver
+    - QCLINUX: drivers: dma-buf: heaps: Use hyp_assign_table implementation
+    - QCLINUX: arm64: configs: qcom: Enable secure buffer driver
+    - PENDING: ASoC: qcom: q6dsp: Add support for multiple sample rates
+    - PENDING: slimbus: qcom-ngd-ctrl: Reduce autosuspend delay to 100msec
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Disable drm gpu/gmu nodes
+    - PENDING: arm64: dts: qcom: qcm6490: Add vi-feedback dai-link for qcm6490 idp
+      & rb3 platform
+    - PENDING: ASoC: qcom: qcm6490: Add handling for WSA Codec DMA TX
+    - PENDING: dt-bindings: wsa883x: Document port mapping property
+    - PENDING: ASoC: wsa883x: Add Speaker Protection Support
+    - PENDING: soundwire: qcom: Update Port Reading logic from DT node
+    - PENDING: ASoC: wsa883x: Add Get temperature control
+    - FROMLIST: dt-bindings: arm: Add device-name in the coresight components
+    - PENDING: arm64: dts: qcom: Add label for timer node
+    - PENDING: Revert "silmbus: ngd: register controller after power up."
+    - PENDING: arm64: dts: qcom: qcm6490: Add rx-mclk and rx-npl clock support
+    - PENDING: soc: qcom: Add snapshot of memory dump driver
+    - PENDING: dt-bindings: soc: qcom: Add memory dump table bindings
+    - FROMLIST: soc: qcom: mdt_loader: Add Upperbounds check for program header
+      access
+    - PENDING: slimbus: qcom-ngd-ctrl: validate dma descriptor tx base address
+    - PENDING: gunyah: vm_mgr: Add lent memory
+    - PENDING: iris: fix sfr handling logic
+    - QCLINUX: arm64: defconfig: qcom: Enable USB Audio/MIDI driver
+    - PENDING: iris: fix logic to switch gdsc mode
+    - PENDING: slimbus: stream: Fix null pointer dereference of stream
+    - PENDING: slimbus: qcom-ngd-ctrl: Synchronize suspend/resume routine with
+      mutex
+    - PENDING: slimbus: qcom-ngd-ctrl: Return for channel disconnect/removal
+      during SSR
+    - PENDING: slimbus: qcom-ngd-ctrl: Handle race condition between SSR and qmi
+      request
+    - PENDING: slimbus: qcom-ngd-ctrl: Re-order platform driver registration
+    - PENDING: shmbridge/tz_log/smcinvoke: Adapt generic VMID/PERM entries
+    - PENDING: slimbus: qcom-ngd-ctrl: enable/disable ngd interrupt in runtime ops
+    - PENDING: slimbus: qcom-ngd-ctrl: Move qmi_handle_release to
+      QCOM_SSR_AFTER_SHUTDOWN
+    - PENDING: slimbus: qcom-ngd-ctrl: Avoid deadlock in SSR/PDR path
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add the secure-buffer device
+    - PENDING: ASoC: codecs: lpass-va-macro: Add sleep after digitial unmute to
+      avoid pop issue
+    - PENDING: crypto: qce - Implement suspend/resume for crypto driver
+    - PENDING: slimbus: qcom-ngd-ctrl: Register QMI service once resources are
+      available
+    - PENDING: slimbus: qcom-ngd: Handle SSR and xfer message scenario
+    - UPSTREAM: regulator: qcom-rpmh: extend to support multiple linear voltage
+      ranges
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add dummy msm_gpu node
+    - QCLINUX: arm64: dts: qcm6490-addons: Add nodes for memory dump
+    - QCLINUX: arm64: defconfig: Enable memory dump
+    - Revert "ASoC: codecs: wsa883x: make use of new mute_unmute_on_trigger flag"
+    - UPSTREAM: regulator: qcom-rpmh: add support for pm8010 regulators
+    - UPSTREAM: regulator: dt-bindings: qcom,rpmh: add compatible for pm8010
+    - PENDING: slimbus: qcom-ngd-ctrl: Return from cb if TX capability exchange
+      timeout
+    - QCLINUX: arm64: configs: qcom: Enable EFI_DISABLE_RUNTIME
+    - QCLINUX: ASoC: qcom: qdsp6: Cleanup APM during audio_pkt release
+    - PENDING: iris: fix min and max fps values in enum_frameintervals
+    - QCLINUX: arm64: dts: qcm6490-addons: Add label for typec-retimer
+    - PENDING: dt-bindings: soc: qcom: Replace "_" with "-" for memory dump
+    - FROMLIST: remoteproc: qcom: probe all child devices
+    - PENDING: misc: fastrpc: Fix memory corruption in DSP capabilities
+    - PENDING: iommu/arm-smmu-qcom: Fix use-after-free issue in qcom_smmu_create()
+    - QCLINUX: Revert "FROMLIST: sched/pelt: Introduce PELT multiplier"
+    - FROMLIST: sched/pelt: Introduce PELT multiplier
+    - FROMLIST: firmware/psci: Move psci_init_system_suspend() to late_initcall()
+    - FROMGIT: arm64: dts: qcom: sc7280: Add static properties to cryptobam
+    - QCLINUX: arm64: defconfig: Enable autosleep and wakelocks
+    - BACKPORT: FROMLIST: arm64: dts: qcom: sc7280: Add power-domains for cpuidle
+      states
+    - BACKPORT: FROMLIST: arm64: dts: qcom: sc7280: Update domain-idle-states for
+      cluster sleep
+    - PENDING: firmware: shmbridge: Defer probe if qcom_scm is not up
+    - Revert "PENDING: wil6210: Drop unicast sub frame if part of a multicast
+      amsdu"
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Sat, 16 Mar 2024 13:26:39 +0800
+
+linux-qcom (6.7.0-1010.10) jammy; urgency=medium
+
+  * Add camera driver
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 08 Feb 2024 10:48:07 +0900
+
+linux-qcom (6.7.0-1009.9) jammy; urgency=medium
+
+  * Enable display driver
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 07 Feb 2024 01:13:11 +0900
+
+linux-qcom (6.7.0-1008.8) jammy; urgency=medium
+
+  * Enable wlan driver
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 24 Jan 2024 14:53:34 +0900
+
+linux-qcom (6.7.0-1007.7) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] sync
+    - Revert "arm64: dts: qcom: sc7280: Add power-domains for cpuidle states"
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 16 Jan 2024 13:01:33 +0900
+
+linux-qcom (6.7.0-1005.5) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: drivers: dma-buf: qcom: adjust shrinker since api changed
+    - SAUCE: firmware: qcom_scm: fix building error
+    - [Config]: enable kconfigs in the qcom_addons of alpha release
+    - [Packaging]: update abi after kconfig is changed
+
+ -- Hui Wang <hui.wang@canonical.com>  Sat, 13 Jan 2024 18:58:00 +0800
+
+linux-qcom (6.7.0-1004.4) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config]: Update annotations after merge alpha patches
+    - [Packaging]: Update abi
+
+  * Miscellaneous upstream changes
+    - FROMLIST: dma-heap: Add proper kref handling on dma-buf heaps
+    - FROMLIST: dma-heap: Provide accessors so that in-kernel drivers can allocate
+      dmabufs from specific heaps
+    - QCLINUX: arm64: defconfig: qcom: Enable POWERCAP, IDLE_INJECT and
+      CPU_IDLE_THERMAL
+    - PENDING: arm64: dts: qcom: qcm6490: add fastrpc nodes
+    - PENDING: misc: fastrpc: Avoid ref count increment for invoke context
+    - PENDING: dt-bindings: soc: qcom,apr: Add audio-pkt and spf-core compatible
+      support
+    - PENDING: ASoC: dt-bindings: Add compatible for wcd9370 codec
+    - PENDING: arm64: dts: qcom: qcm6490: Add memory region for audioPD
+    - FROMLIST: soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
+    - FROMLIST: arm64: dts: qcom: sc7280: Add capacity and DPC properties
+    - FROMLIST: iommu: Allow passing custom allocators to pgtable drivers
+    - FROMLIST: iommu: Extend LPAE page table format to support custom allocators
+    - QCLINUX: dt-bindings: qcom: Add IMEM nodes
+    - PENDING: clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs
+    - PENDING: dt-bindings: media: Add sm8550 dt schema
+    - PENDING: MAINTAINERS: Add Qualcomm Iris video accelerator driver
+    - PENDING: iris: register video device to platform driver
+    - PENDING: iris: initialize power resources
+    - PENDING: iris: introduce state machine for iris core
+    - PENDING: iris: introduce shared queues for host and firmware communication
+    - PENDING: iris: add PIL functionality for video firmware
+    - PENDING: iris: introduce packetization layer for creating HFI packets
+    - PENDING: iris: add video processing unit(VPU) specific register handling
+    - PENDING: iris: introduce platform specific capabilities for core and
+      instance
+    - PENDING: iris: implement iris v4l2 file ops
+    - PENDING: iris: add handling for interrupt service routine(ISR) invoked by
+      hardware
+    - PENDING: iris: implement iris v4l2_ctrl_ops and prepare capabilities
+    - PENDING: iris: introduce memory pool for buffer management
+    - PENDING: iris: implement vb2_ops queue setup
+    - PENDING: iris: introduce and implement iris vb2 mem ops
+    - PENDING: iris: implement HFI to queue and release buffers
+    - PENDING: iris: add video hardware internal buffer count and size calculation
+    - PENDING: iris: implement internal buffer management
+    - PENDING: iris: introduce instance states
+    - PENDING: iris: implement iris v4l2 ioctl ops supported by decoder
+    - PENDING: iris: subscribe input and output properties to firmware
+    - PENDING: iris: subscribe src change and handle firmware responses
+    - PENDING: iris: implement vb2 streaming ops on capture and output planes
+    - QCLINUX: arm64: configs: qcom: Enable QCOM_WDT_CORE
+    - QCLINUX: arm64: configs: qcom: Enable PANIC ON BITE
+    - QCLINUX: soc: qcom: Add support for watchdog framework
+    - PENDING: iris: implement vb2 ops for buf_queue and firmware response
+    - PENDING: iris: add instance sub states and implement DRC and Drain sequence
+    - PENDING: iris: implement power management
+    - FROMLIST: docs: gunyah: Introduce Gunyah Hypervisor
+    - FROMLIST: dt-bindings: Add binding for gunyah hypervisor
+    - FROMLIST: gunyah: Common types and error codes for Gunyah hypercalls
+    - FROMLIST: arm-smmu: Add iommu support to share pgtable
+    - PENDING: iris: register video encoder device to platform driver
+    - FROMLIST: virt: gunyah: Add hypercalls to identify Gunyah
+    - FROMLIST: virt: gunyah: msgq: Add hypercalls to send and receive messages
+    - FROMLIST: mailbox: Add Gunyah message queue mailbox
+    - FROMLIST: gunyah: rsc_mgr: Add resource manager RPC core
+    - FROMLIST: gunyah: rsc_mgr: Add VM lifecycle RPC
+    - FROMLIST: gunyah: vm_mgr: Introduce basic VM Manager
+    - FROMLIST: gunyah: rsc_mgr: Add RPC for sharing memory
+    - FROMLIST: gunyah: vm_mgr: Add/remove user memory regions
+    - FROMLIST: gunyah: vm_mgr: Add ioctls to support basic non-proxy VM boot
+    - FROMLIST: samples: Add sample userspace Gunyah VM Manager
+    - FROMLIST: gunyah: rsc_mgr: Add platform ops on mem_lend/mem_reclaim
+    - FROMLIST: virt: gunyah: Add Qualcomm Gunyah platform ops
+    - FROMLIST: docs: gunyah: Document Gunyah VM Manager
+    - FROMLIST: virt: gunyah: Translate gh_rm_hyp_resource into gunyah_resource
+    - FROMLIST: gunyah: vm_mgr: Add framework for VM Functions
+    - FROMLIST: virt: gunyah: Add resource tickets
+    - FROMLIST: virt: gunyah: Add IO handlers
+    - FROMLIST: virt: gunyah: Add proxy-scheduled vCPUs
+    - FROMLIST: virt: gunyah: Add hypercalls for sending doorbell
+    - FROMLIST: virt: gunyah: Add irqfd interface
+    - FROMLIST: virt: gunyah: Add ioeventfd
+    - FROMLIST: MAINTAINERS: Add Gunyah hypervisor drivers section
+    - PENDING: iris: add platform specific instance capabilities for encoder
+    - PENDING: iris: implement iris v4l2 ioctl ops supported by encoder
+    - PENDING: iris: add vb2 streaming and buffer ops for encoder
+    - PENDING: iris: add power management for encoder
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add node for gh_watchdog
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add node for IMEM
+    - QCLINUX: dt-bindings: watchdog: Add qcom,gh-watchdog
+    - QCLINUX: virt: gunyah: Gunyah virtual watchdog driver
+    - QCLINUX: virt: gunyah: Write KASLR addr to IMEM
+    - QCLINUX: arm64: configs: qcom: Enable GH_VIRT_WATCHDOG
+    - PENDING: misc: fastrpc: Redesign remote heap management
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Disable wdt-sc7280
+    - PENDING: dt-bindings: media: Add qcm6490 dt schema
+    - PENDING: ASoC: dt-bindings: Add compatibles for qcm6490
+    - PENDING: arm64: dts: qcom: qcm6490: update venus node
+    - PENDING: qcom: defconfig: auto update of defconfig
+    - PENDING: qcom: defconfig: enable module compilation of iris
+    - PENDING: videocc: remove HW_CTRL from mvs0 gdsc
+    - FROMLIST: scsi: ufs: qcom: dt-bindings: Add SC7280 compatible string
+    - PENDING: iris: change interconnect name and correct few api
+    - PENDING: iris: add qcm6490 platform support
+    - PENDING: iris: add internal buffer calculation for iris2
+    - PENDING: iris: add power up/down sequence and bandwidth calculation
+    - FROMLIST: stm: class: Add MIPI OST protocol support
+    - PENDING: arm64: dts: qcom: qcm6490: Enable remoteprocs for RB3 Gen2
+    - FROMLIST: MAINTAINERS: Add the entry for DCC(Data Capture and Compare)
+      driver support
+    - PENDING: regulator: add a regulator driver for the PM8008 PMIC
+    - QCLINUX: drivers: regulator: Add snapshot of qpnp-lcdb regulator driver
+    - QCLINUX: mfd: introduce I2C PMIC controller
+    - FROMLIST: arm64: dts: qcom: sc7280: Add slimbus DT node
+    - QCLINUX: arm64: defconfig: disable display configs
+    - PENDING: ASoC: qcom: qcm6490: Add machine driver
+    - PENDING: arm64: dts: Increase min voltage of l1b and l10c rails
+    - QCLINUX: arm64: configs: Sort entries in qcom_addons
+    - QCLINUX: regulator: add debug control library
+    - QCLINUX: regulator: add proxy consumer library
+    - FROMGIT: arm64: dts: qcom: sc7280: add TRNG node
+    - QCLINUX: dt-bindings: arm: qcom: Add QCM6490 addons support
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add addons support for RB3
+    - PENDING: arm64: qcom: dts: Enable pmk8350 RTC for qcm6490-idp
+    - PENDING: arm64: dts: qcom: sc7280: Add cti nodes
+    - PENDING: arm64: dts: qcom: qcm6490: overwrite video attribute in qcm6490
+    - QCLINUX: defconfig: Enable qcom-wled & qpnp-lcdb-regulator for qcm6490
+    - QCLINUX: pinctrl: qcom: spmi-gpio: Add PM7325b support
+    - PENDING: iris: update video firmware path for qcm6490
+    - QCLINUX: backlight: qcom-wled: Add support for PM7325b compatible
+    - QCLINUX: dt-bindings: backlight: qcom-wled: Add PM7325B support
+    - QCLINUX: arm64: dts: qcom: Add support for PM7325b PMIC
+    - QCLINUX: soc: qcom: apr: GPR support for audioreach solution
+    - PENDING: ASoC: codecs: lpass-macro: Add support for channel map mixer
+      control
+    - PENDING: ASoC: codecs: wcd937x: Add wcd937x codec driver
+    - PENDING: ASoC: dt-bindings: Add property to support cpu dai with dummy ops
+    - FROMLIST: dma-buf: heaps: Introduce cma_heap_add() for non-default CMA heap
+    - FROMLIST: drm/drm_mode_object: increase max objects to accommodate new color
+      props
+    - PENDING: arm64: qcom: dts: qcm6490-idp: Add BT node
+    - PENDING: misc: fastrpc: Fix DSP capabilities request
+    - PENDING: arm64: dts: qcom: qcm6490-idp: Add definition for three LEDs
+    - PENDING: arm64: qcom: dts: Support refgen regulator for qcm6490
+    - FROMGIT: scsi: ufs: ufs-sysfs: Expose UFS power info
+    - QCLINUX: defconfig: Enable LEICA regulator and proxy-consumer
+    - QCLINUX: defconfig: Enable refgen regulator for qcm6490
+    - PENDING: arm64: qcom: dts: qcm6490-rb3: Add BT node
+    - PENDING: arm64: dts: qcom: qcm6490-idp: add die temp ADC channel
+    - PENDING: defconfig: enable VADC, LPG and SPMI-TEMP-ALARM driver
+    - QCLINUX: ASoC: dt-bindings: qcom,spf-core-platform: Add msm audio mem for
+      spf core platform
+    - FROMLIST: iommu/arm-smmu: introduction of ACTLR for custom prefetcher
+      settings
+    - FROMLIST: iommu/arm-smmu: add ACTLR data and support for SM8550
+    - PENDING: ASoC: qcom: qdsp6: Add support for cpu dai with dummy ops
+    - PENDING: arm64: dts: qcom: qcm6490: Add gpr device tree node for ADSP
+    - QCLINUX: ASoC: qcom: qdsp6: Add spf-core, audio-pkt and msm-audio driver
+      support
+    - PENDING: arm64: dts: qcom: qcm6490-addons: Add shmbridge node
+    - PENDING: firmware: qcom: Add tz_log debug driver support
+    - PENDING: dt-bindings: firmware: Add tz-log doc
+    - PENDING: dt-bindings: soc: qcom: Add shmbridge doc
+    - PENDING: arm64: dts: qcom: qcm6490-addons: Add tz-log node
+    - PENDING: firmware: shmbridge: Add new driver support
+    - PENDING: arm64: dts: qcom: qcm6490: Add WSA codec macro for qcm6490 SoC
+    - PENDING: arm64: qcom: dts: qcm6490-rb3: Add remoteproc nodes
+    - QCLINUX: remoteproc: qcom: pas: disable auto boot for wpss
+    - PENDING: Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT
+    - PENDING: arm64: dts: qcom: qcm6490-idp: Add wcd9370 codec device tree node
+    - QCLINUX: arm64: dts: qcom: Add support for PM8008 PMIC
+    - QCLINUX: arm64: dts: qcom: Add PM7325b PMIC support for qcm6490-idp
+    - QCLINUX: arm64: defconfig: Enable QDSS configs
+    - QCLINUX: arm64: defconfig: qcom: Enable BT_RFCOMM
+    - QCLINUX: dt-bindings: arm: msm: Add remote debugger doc
+    - FROMLIST: usb: dwc3: qcom: Rename dwc3 platform_device reference
+    - FROMLIST: usb: dwc3: qcom: Merge resources from urs_usb device
+    - FROMLIST: usb: dwc3: Expose core driver as library
+    - FROMLIST: usb: dwc3: Override end of dwc3 memory resource
+    - FROMLIST: usb: dwc3: qcom: Add dwc3 core reference in driver state
+    - FROMLIST: usb: dwc3: qcom: Instantiate dwc3 core directly
+    - FROMLIST: usb: dwc3: qcom: Inline the qscratch constants
+    - QCLINUX: arm64: defconfig: qcom: Add USB defconfigs in qcom_defconfig
+    - FROMLIST: usb: dwc3: qcom: Flatten the Qualcomm dwc3 binding and
+      implementation
+    - FROMLIST: usb: dwc3: core: Register vendor hooks for dwc3-qcom
+    - FROMLIST: usb: dwc3: qcom: Enable autosuspend for host mode
+    - FROMLIST: usb: dwc3: core: Skip set_mode notification if cable is
+      disconnected
+    - PENDING: arm64: dts: qcom: qcm6490-idp: Enable pmic-glink and clients
+    - PENDING: arm64: dts: qcom: qcm6490: Add VMID for adsp mem heap
+    - FROMLIST: dt-bindings: input: qcom,pm8xxx-vib: add new SPMI vibrator module
+    - QCLINUX: drivers: char: add remote debugger driver
+    - PENDING: arm64: dts: qcom: qcm6490-idp: enable pon_key and pon_resin key
+    - QCLINUX: arm64: defconfig: Enable Audio support configs for QCM6490
+    - PENDING: arm64: dts: qcom: Flatten USB DT node for QCM6490
+    - PENDING: arm64: boot: dts: Add Type-c orientation support for QCM6490 IDP
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add dt nodes for audio memory, audio-pkt
+      router and spf
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: add die temp ADC channel
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: Add definition for three LEDs
+    - PENDING: arm64: dts: qcom: qcm6490-idp: Add sound node for qcm6490 idp
+      platform
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: Add sound node for RB3 Gen2
+    - PENDING: misc: fastrpc: Add support for unsigned PD
+    - PENDING: arm64: dts: qcm6490-idp: orientation-gpio support in pmic-glink
+    - QCLINUX: dt-bindings: qcom: Add msm stub audio codec documentation
+    - QCLINUX: arm64: dts: qcom: Add bindings for qcom-i2c-pmic and PM8008 devices
+    - FROMLIST: input: pm8xxx-vib: refactor to easily support new SPMI vibrator
+    - QCLINUX: arm64: defconfig: Add RDBG support for qcom_addons_debug
+    - PENDING: misc: fastrpc: Add static PD restart support
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: Enable pmic-glink and clients
+    - QCLINUX: arm64: dts: qcm6490-rb3: Add support for PM8008 PMIC
+    - PENDING: dt-bindings: soc: qcom: Add mem-buf doc
+    - PENDING: drivers: soc: qcom: Add mem_buf driver support
+    - QCLINUX: arm64: configs: qcom: Enable QTEE_SHM_BRIDGE
+    - QCLINUX: arm64: configs: qcom: Enable CONFIG_QTI_TZ_LOG
+    - PENDING: firmware: shmbridge: Drop KP memory protection
+    - QCLINUX: arm64: configs: qcom: Enable PANIC_ON_OOPS
+    - FROMLIST: input: pm8xxx-vibrator: add new SPMI vibrator support
+    - PENDING: arm64: dts: qcom: qcm6490: Add mem-buf device nodes
+    - QCLINUX: arm64: defconfig: qcom: Enable mem-buf
+    - PENDING: dt-bindings: arm: msm: Add dmabuf heaps doc
+    - QCLINUX: drivers: dma-buf: Add QCOM Heaps
+    - FROMLIST: dt-bindings: iommu: Add Translation Buffer Unit bindings
+    - BACKPORT: FROMLIST: iommu/arm-smmu-qcom: Add support for TBUs
+    - FROMLIST: iommu/arm-smmu-qcom: Add Qualcomm TBU driver
+    - PENDING: iris: Fix copy of vb2 buf details to iris buf
+    - PENDING: misc: fastrpc: Pass proper arguments to scm call
+    - QCLINUX: drivers: dma-buf: heaps: Remove support for unused heaps and add
+      replacement for hyp_assign_table api
+    - QCLINUX: dt-bindings: arm: qcom: Add dt-bindings soft link for devicetree
+      constants
+    - FROMLIST: iommu/arm-smmu: Allow using a threaded handler for context
+      interrupts
+    - BACKPORT: FROMLIST: iommu/arm-smmu-qcom: Use a custom context fault handler
+      for sdm845
+    - PENDING: arm64: dts: qcom: sc7280: Add TBU support
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: enable pon_key pon_resin & rtc
+    - QCLINUX: arm64: defconfig: qcom: Enable TBU support
+    - PENDING: iris: add support to set MAX input buffer count to firmware
+    - QCLINUX: dt-bindings: arm: qcom: Correct the symlink for
+      qcom_dma_heap_dt_constants
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add dma-buf heaps support
+    - QCLINUX: arm64: defconfig: qcom: Enable QCOM Heaps
+    - PENDING: arm64: dts: qcom: qm6490-addons: Add smcinvoke node
+    - PENDING: dt-bindings: firmware: Add smcinvoke doc
+    - QCLINUX: defconfig: Enable ufs bsg node
+    - PENDING: iris: add cache management operation
+    - PENDING: dt-bindings: firmware: smcinvoke: Add memory-region
+    - PENDING: arm64: dts: qcm6490: Add memory-region for smcinvoke
+    - PENDING: dt-bindings: interconnect: Add QCOM_ICC_TAG_PERF_MODE macro
+    - FROMGIT: dt-bindings: phy: Add QMP UFS PHY comptible for SC7280
+    - PENDING: soc: qcom: Add smcinvoke driver support
+    - PENDING: soc: qcom: smcinvoke: Add custom CMA heap support
+    - PENDING: interconnect: qcom: Add support for PERF_MODE on RPMh targets
+    - QCLINUX: arm64: configs: qcom: Enable QCOM_SMCINVOKE
+    - PENDING: arm64: dts: qcom: qcm6490: Add dma-coherent property
+    - PENDING: interconnect: qcom: icc-rpmh: Add QoS config support
+    - PENDING: interconnect: qcom: sc7280: enable qos programming
+    - PENDING: arm64: dts: qcm6490-rb3: Increase min voltage of l1b & l10c rail
+    - PENDING: usb: dwc3: qcom: De-assert BCR upon resume
+    - PENDING: arm64: dts: qcom: sc7280: Add clocks for QOS programming
+    - QCLINUX: arm64: dts: qcom: qcm6490-idp: Add MI2S and TDM dai-link support
+    - PENDING: ASoC: qdsp6: q6apm: Add mi2s and tdm audio support
+    - PENDING: dt-bindings: Document the qcom,prmcc_clk property
+    - QCLINUX: ASoC: codecs: Add msm stub codec for audio usecase
+    - PENDING: iris: update output crop offset calculation for encoder
+    - QCLINUX: arm64: defconfig: qcom: Enable MSM_STUB config for QCM6490
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: add rdbg nodes
+    - FROMLIST: blk-crypto: add basic hardware-wrapped key support
+    - FROMLIST: blk-crypto: show supported key types in sysfs
+    - FROMLIST: blk-crypto: add ioctls to create and prepare hardware-wrapped keys
+    - PENDING: arm64: dts: qcom: sc7280: add ICE node
+    - QCLINUX: dt-bindings: pinctrl: qcom-pmic-gpio: Add pm7325b support
+    - FROMLIST: dt-bindings: crypto: ice: document the hwkm property
+    - PENDING: arm64: dts: qcm6490-rb3: Add LDO vibrator support
+    - QCLINUX: defconfig: Enable ldo vibrator driver config for qcm6490
+    - QCLINUX: arm64: defconfig: qcom: enable ICE driver
+    - QCLINUX: remoteproc: qcom: pas: Enable auto boot for wpss
+    - PENDING: ASoC: qcom: qdsp6: q6prm: Update the TDM clock id values
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add MI2S and TDM dai-link support
+    - PENDING: misc: fastrpc: Add rpdev check in device_open
+    - FROMLIST: fscrypt: add support for hardware-wrapped keys
+    - FROMLIST: ice, ufs, mmc: use blk_crypto_key for program_key
+    - FROMLIST: qcom_scm: scm call for deriving a software secret
+    - FROMLIST: soc: qcom: ice: add hwkm support in ice
+    - FROMLIST: soc: qcom: ice: support for hardware wrapped keys
+    - QCLINUX: firmware: qcom_scm_addon: Add function qcom_scm_spin_cpu
+    - FROMLIST: ufs: core: support wrapped keys in ufs core
+    - FROMLIST: ufs: host: wrapped keys support in ufs qcom
+    - FROMGIT: dt-bindings: crypto: qcom-qce: document the SM8650 crypto engine
+    - FROMLIST: rpmsg: glink: smem: validate index before fifo read write
+    - PENDING: iris: update set bitrate api
+    - QCLINUX: arm64: defconfig: qcom: enable CRYPTO_USER_API
+    - FROMLIST: dt-bindings: crypto: qcom-qce: document the SC7280 crypto engine
+    - FROMLIST: arm64: dts: qcom: sc7280: add QCrypto nodes
+    - PENDING: iris: fix checks while handling the output buffers
+    - FROMLIST: qcom_scm: scm call for create, prepare and import keys
+    - FROMLIST: ufs: core: add support for generate, import and prepare keys
+    - FROMLIST: soc: qcom: support for generate, import and prepare key
+    - FROMLIST: ufs: host: support for generate, import and prepare key
+    - QCLINUX: arm64: defconfig: qcom: Enable KPROBE
+    - PENDING: iris: replace do_div with div64_u64
+    - PENDING: iris: fix rotation angle configuration to firmware
+    - QCLINUX: dt-bindings: arm: Add mezz board support on QCM6490
+    - PENDING: dt-bindings: arm: qcom: Add rb3gen2 mezzanine board support on
+      QCM6490
+    - PENDING: arm64: dts: qcom: Add qcm6490 rb3gen2 mezzanine board support
+    - FROMLIST: sched/pelt: Introduce PELT multiplier
+    - PENDING: wil6210: Drop plaintext frames on secure network
+    - PENDING: wil6210: check integrity of received AMSDU packets
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add rb3gen2 board support
+    - QCLINUX: remoteproc: Panic on remoteproc crash
+    - QCLINUX: Add audio support for rb3gen2 vision mezzanine boards
+    - PENDING: arm64: dts: qcom: Flatten USB DT node on QCM6490 RB3 Platform
+    - PENDING: arm64: boot: dts: Add Type-c orientation support for QCM6490 RB3
+    - PENDING: firmware: qcom_scm: Make smcinvoke scm calls non-atomic
+    - PENDING: soc: qcom: ice: fix return value as per qcom-scm driver change
+    - PENDING: soc: qcom: ice: bugfix for HWKMv1 targets
+    - PENDING: firmware: qcom_smc-smc: Use qtee_shmbridge if available
+    - PENDING: include: linux: qtee_shmbridge: Add additional stubs
+    - PENDING: usb: dwc3: Add vendor hook for run_stop notification
+    - PENDING: arm64: dts: qcm6490-rb3: Update compatible string of pmic-glink
+    - PENDING: iris: add bit depth source change event for avc decoder
+    - QCLINUX: soc: qcom: smcinvoke: Add hardcoded mem-buf API values
+    - FROMLIST: soc: qcom: ice: bugfix for HWKMv1 targets
+    - FROMLIST: firmware: qcom_scm: scm call for deriving a software secret
+    - PENDING: firmware: qcom_scm: add FBE SCM calls with shmbridge
+    - QCLINUX: drivers: dmabuf: heaps: Remove alias for qcom system heap
+    - PENDING: iris: fix out of boundary hfi queue access
+    - QCLINUX: arm64: defconfig: Prune qcom_defconfig
+    - Revert "arm64: dts: qcom: sc7280: switch USB+DP QMP PHY to new style of
+      bindings"
+    - PENDING: arm64: dts: qcom: Add remote endpoints for QMP and USB nodes
+    - Revert "PENDING: wil6210: Drop plaintext frames on secure network"
+    - Revert "PENDING: wil6210: check integrity of received AMSDU packets"
+
+ -- Hui Wang <hui.wang@canonical.com>  Thu, 11 Jan 2024 14:22:29 +0800
+
+linux-qcom (6.7.0-1003.3) jammy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] remove helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - Config: fix the environment for building in jammy
+    - [Packaging]: Update getabis for jammy
+    - [Config]: update annotations
+    - [Config]: Update config after cranky close
+    - [Packaging]: Update modules
+
+ -- Hui Wang <hui.wang@canonical.com>  Wed, 10 Jan 2024 22:28:08 +0800
+
+linux-qcom (6.7.0-1001.1) jammy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update Ubuntu.md
+    - [Packaging] update update.conf
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Init linux-qcom kernel creation
+    - Config: compose the init kconfig for linux-qcom
+    - [Packaing] adjust kernel modules
+    - Config: cleanup by running check-config
+
+  * Miscellaneous upstream changes
+    - QCLINUX: arm64: defconfig: Add qcom configs
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add qcm6490 board support
+    - QCLINUX: arm64: defconfig: Enable dmabuf heaps for qcm6490
+    - QCLINUX: arm64: defconfig: qcom: Enable FTRACE
+    - QCLINUX: arm64: defconfig: Add DWC3_QCOM support in qcom_defconfig
+    - QCLINUX: arm64: defconfig: qcom: Enable zram
+    - QCLINUX: Revert "QCLINUX: arm64: dts: qcom: qcm6490: Add qcm6490 board
+      support"
+    - FROMLIST: arm64: dts: qcom: Add qcm6490 dts file
+    - QCLINUX: arm64: dts: qcom: Add qcm6490 addons support
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for QCM6490
+    - FROMLIST: dt-bindings: arm: qcom: Add QCM6490 IDP board
+    - PENDING: arm64: dts: qcom: Remove voltage vote support for UFS
+    - QCLINUX: arm64: defconfig: Enable Config for Phy and Controller
+    - PENDING: arm64: dts: qcm6490: Remove voltage voting for USB rails
+    - QCLINUX: arm64: dts: qcom: qcm6490: disable sdhc1 for ufs target
+    - QCLINUX: arm64: defconfig: Enable memory features
+    - FROMLIST: arm64: dts: qcom: sc7280: Add UFS nodes for sc7280 soc
+    - PENDING: arm64: dts: qcom: qcm6490: Add UFS nodes
+    - QCLINUX: arm64: defconfig: qcom: Enable SLAB_FREELIST_RANDOM
+    - QCLINUX: arm64: defconfig: qcom: Enable FORTIFY_SOURCE
+    - QCLINUX: arm64: dts: qcom: qcm6490: FIX: qcm6490 addons
+    - QCLINUX: arm64: defconfig: qcom: Disable DEVMEM and STRICT_DEVMEM
+    - PENDING: remoteproc: qcom: pas: Add ADSP, CDSP and WPSS support on SC7280
+      SoC
+    - PENDING: arm64: dts: qcom: qcm6490: Add ADSP, CDSP remoteproc support
+    - PENDING: arm64: dts: qcom: qcm6490: Update WPSS node to use PAS
+    - PENDING: dt-bindings: remoteproc: qcom: Add SC7280 ADSP, CDSP and WPSS
+      support
+    - PENDING: arm64: dts: qcom: qcm6490: Enable ADSP, CDSP, MPSS and WPSS support
+    - QCLINUX: arm64: defconfig: qcom: Enable SECURITY_SELINUX and
+      SECURITY_NETWORK
+    - QCLINUX: arm64: defconfig: qcom: Enable HARDENED_USERCOPY
+    - QCLINUX: arm64: defconfig: qcom: Enable SLAB_FREELIST_HARDENED
+    - QCLINUX: arm64: defconfig: qcom: Enable ARM64_SW_TTBR0_PAN
+    - PENDING: clk: qcom: gcc: Enable the force mem core for UFS ICE clock
+    - PENDING: arm64: dts: qcom: qcm6490: Add gpio-reserved-ranges
+    - FROMGIT: misc: fastrpc: Free DMA handles for RPC calls with no arguments
+    - PENDING: dt-bindings: clock: Add "qcom,adsp-skip-pll" property
+    - PENDING: clk: qcom: lpassaudiocc: Add support to skip PLL configuration
+    - QCLINUX: firmware: qcom_scm: provisioning addon scm call
+    - QCLINUX: arm64: defconfig: qcom: Auto update configs
+    - PENDING: dt-bindings: arm: qcom: Add QCM6490 RB3 board
+    - PENDING: arm64: dts: qcom: Add qcm6490 rb3 support
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for qcm6490-rb3
+    - PENDING: arm64: dts: qcm6490: Update the protected clocks for QCM6490
+    - QCLINUX: arm64: defconfig: Add clock controller configs for SC7280
+    - QCLINUX: arm64: configs: qcom: Disable CONFIG_QCOM_WDT
+    - FROMGIT: misc: fastrpc: Clean buffers on remote invocation failures
+    - QCLINUX: arm64: configs: qcom: Enable QCOM_SCM_ADDON
+    - QCLINUX: arm64: defconfig: qcom: Enable UCLAMP and SCHEDSTATS
+    - PENDING: arm64: dts: qcom: Remove voltage vote support for UFS
+    - PENDING: arm64: dts: qcm6490-rb3: Remove voltage voting for USB rails
+    - PENDING: arm64: dts: qcom: Add UFS nodes for qcm6490-rb3
+    - PENDING: arm64: dts: qcom: qcm6490: add phandle & modify adsp node
+    - PENDING: arm64: dts: qcom: sc7280: Add interconnect paths to UFSHC
+    - QCLINUX: arm64: defconfig: qcom: Enable bootconfig
+    - PENDING: arm64: dts: qcom: qcm6490: update memory map
+    - FROMLIST: arm64: dts: qcom: Update memorymap for qcm6490
+    - QCLINUX: arm64: dts: qcom: qcm6490: disable video fw attribute in qcm6490
+
+ -- Hui Wang <hui.wang@canonical.com>  Fri, 15 Dec 2023 08:12:34 +0800
+
+linux-qcom (6.7.0-1000.0) jammy; urgency=medium
+
+  * Init creation of linux-qcom
+
+ -- Hui Wang <hui.wang@canonical.com>  Wed, 13 Dec 2023 21:37:16 +0800
+
+linux-unstable (6.7.0-3.3) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-3.3 -proposed tracker (LP: #2046060)
+
+  * enable CONFIG_INTEL_TDX_HOST in linux >= 6.7 for noble (LP: #2046040)
+    - [Config] enable CONFIG_INTEL_TDX_HOST
+
+  * linux tools packages for derived kernels refuse to install simultaneously
+    due to libcpupower name collision (LP: #2035971)
+    - [Packaging] Statically link libcpupower into cpupower tool
+
+  * make lazy RCU a boot time option (LP: #2045492)
+    - SAUCE: rcu: Provide a boot time parameter to control lazy RCU
+
+  * Build failure if run in a console (LP: #2044512)
+    - [Packaging] Fix kernel module compression failures
+
+  * Turning COMPAT_32BIT_TIME off on arm64 (64k & derivatives) (LP: #2038582)
+    - [Config] y2038: Turn off COMPAT and COMPAT_32BIT_TIME on arm64 64k
+
+  * Turning COMPAT_32BIT_TIME off on riscv64 (LP: #2038584)
+    - [Config] y2038: Disable COMPAT_32BIT_TIME on riscv64
+
+  * Turning COMPAT_32BIT_TIME off on ppc64el (LP: #2038587)
+    - [Config] y2038: Disable COMPAT and COMPAT_32BIT_TIME on ppc64le
+
+  * [UBUNTU 23.04] Kernel config option missing for s390x PCI passthrough
+    (LP: #2042853)
+    - [Config] CONFIG_VFIO_PCI_ZDEV_KVM=y
+
+  * back-out zstd module compression automatic for backports (LP: #2045593)
+    - [Packaging] make ZSTD module compression conditional
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove do_full_source variable
+    - [Packaging] Remove obsolete config handling
+    - [Packaging] Remove support for sub-flavors
+    - [Packaging] Remove old linux-libc-dev version hack
+    - [Packaging] Remove obsolete scripts
+    - [Packaging] Remove README.inclusion-list
+    - [Packaging] make $(stampdir)/stamp-build-perarch depend on build-arch
+    - [Packaging] Enable rootless builds
+    - [Packaging] Allow to run debian/rules without (fake)root
+    - [Packaging] remove unneeded trailing slash for INSTALL_MOD_PATH
+    - [Packaging] override KERNELRELEASE instead of KERNELVERSION
+    - [Config] update toolchain versions in annotations
+    - [Packaging] drop useless linux-doc
+    - [Packaging] scripts: Rewrite insert-ubuntu-changes in Python
+    - [Packaging] enable riscv64 builds
+    - [Packaging] remove the last sub-flavours bit
+    - [Packaging] check debian.env to determine do_libc_dev_package
+    - [Packaging] remove debian.*/variants
+    - [Packaging] remove do_libc_dev_package variable
+    - [Packaging] move linux-libc-dev.stub to debian/control.d/
+    - [Packaging] Update check to build linux-libc-dev to the source package name
+    - [Packaging] rules: Remove startnewrelease target
+    - [Packaging] Remove debian/commit-templates
+    - [Config] update annotations after rebase to v6.7-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 11 Dec 2023 15:56:11 +0100
+
+linux-unstable (6.7.0-2.2) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-2.2 -proposed tracker (LP: #2045107)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable Rust
+    - [Config] enable Rust in annotations
+    - [Packaging] Remove do_enforce_all variable
+    - [Config] disable Softlogic 6x10 capture card driver on armhf
+    - [Packaging] disable Rust support
+    - [Config] update annotations after rebase to v6.7-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 29 Nov 2023 07:51:17 +0100
+
+linux-unstable (6.7.0-1.1) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-1.1 -proposed tracker (LP: #2044069)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update annotations scripts
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations after rebase to v6.7-rc2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 21 Nov 2023 10:45:24 +0100
+
+linux-unstable (6.7.0-0.0) noble; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 21 Nov 2023 07:26:46 +0100
+
+linux-unstable (6.6.0-12.12) noble; urgency=medium
+
+  * noble/linux-unstable: 6.6.0-12.12 -proposed tracker (LP: #2043664)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable zfs dkms
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 16 Nov 2023 10:20:26 +0100
+
+linux-unstable (6.6.0-11.11) noble; urgency=medium
+
+  * noble/linux-unstable: 6.6.0-11.11 -proposed tracker (LP: #2043480)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] resync update-dkms-versions helper
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.11.14)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move to Noble
+    - [Config] toolchain version update
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 15 Nov 2023 14:50:40 +0100
+
+linux-unstable (6.6.0-10.10) noble; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-10.10 -proposed tracker (LP: #2043088)
+
+  * Bump arm64's CONFIG_NR_CPUS to 512 (LP: #2042897)
+    - [Config] Bump CONFIG_NR_CPUS to 512 for arm64
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Include a note for the NR_CPUS setting on riscv64
+    - SAUCE: apparmor4.0.0 [83/83]: Fix inode_init for changed prototype
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 09 Nov 2023 12:05:11 +0200
+
+linux-unstable (6.6.0-9.9) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-9.9 -proposed tracker (LP: #2041852)
+
+  * Switch IMA default hash to sha256 (LP: #2041735)
+    - [Config] Switch IMA_DEFAULT_HASH from sha1 to sha256
+
+  * apparmor restricts read access of user namespace mediation sysctls to root
+    (LP: #2040194)
+    - SAUCE: apparmor4.0.0 [82/82]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+
+  * AppArmor spams kernel log with assert when auditing (LP: #2040192)
+    - SAUCE: apparmor4.0.0 [81/82]: apparmor: fix request field from a prompt
+      reply that denies all access
+
+  * apparmor notification files verification (LP: #2040250)
+    - SAUCE: apparmor4.0.0 [80/82]: apparmor: fix notification header size
+
+  * apparmor oops when racing to retrieve a notification (LP: #2040245)
+    - SAUCE: apparmor4.0.0 [79/82]: apparmor: fix oops when racing to retrieve
+      notification
+
+  * Disable restricting unprivileged change_profile by default, due to LXD
+    latest/stable not yet compatible with this new apparmor feature
+    (LP: #2038567)
+    - SAUCE: apparmor4.0.0 [78/82]: apparmor: Make
+      apparmor_restrict_unprivileged_unconfined opt-in
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/82]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [02/82]: rename SK_CTX() to aa_sock and make it an
+      inline fn
+    - SAUCE: apparmor4.0.0 [03/82]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [04/82]: add user namespace creation mediation
+    - SAUCE: apparmor4.0.0 [05/82]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [06/82]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [07/82]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [08/82]: Stacking v38: LSM: Identify modules by more
+      than name
+    - SAUCE: apparmor4.0.0 [09/82]: Stacking v38: LSM: Add an LSM identifier for
+      external use
+    - SAUCE: apparmor4.0.0 [10/82]: Stacking v38: LSM: Identify the process
+      attributes for each module
+    - SAUCE: apparmor4.0.0 [11/82]: Stacking v38: LSM: Maintain a table of LSM
+      attribute data
+    - SAUCE: apparmor4.0.0 [12/82]: Stacking v38: proc: Use lsmids instead of lsm
+      names for attrs
+    - SAUCE: apparmor4.0.0 [13/82]: Stacking v38: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [14/82]: Stacking v38: LSM: Infrastructure management
+      of the sock security
+    - SAUCE: apparmor4.0.0 [15/82]: Stacking v38: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [16/82]: Stacking v38: LSM: provide lsm name and id
+      slot mappings
+    - SAUCE: apparmor4.0.0 [17/82]: Stacking v38: IMA: avoid label collisions with
+      stacked LSMs
+    - SAUCE: apparmor4.0.0 [18/82]: Stacking v38: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [19/82]: Stacking v38: LSM: Use lsmblob in
+      security_kernel_act_as
+    - SAUCE: apparmor4.0.0 [20/82]: Stacking v38: LSM: Use lsmblob in
+      security_secctx_to_secid
+    - SAUCE: apparmor4.0.0 [21/82]: Stacking v38: LSM: Use lsmblob in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [22/82]: Stacking v38: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [23/82]: Stacking v38: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [24/82]: Stacking v38: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [25/82]: Stacking v38: LSM: Use lsmblob in
+      security_cred_getsecid
+    - SAUCE: apparmor4.0.0 [26/82]: Stacking v38: LSM: Specify which LSM to
+      display
+    - SAUCE: apparmor4.0.0 [28/82]: Stacking v38: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [29/82]: Stacking v38: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [30/82]: Stacking v38: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [31/82]: Stacking v38: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [32/82]: Stacking v38: LSM: security_secid_to_secctx in
+      netlink netfilter
+    - SAUCE: apparmor4.0.0 [33/82]: Stacking v38: NET: Store LSM netlabel data in
+      a lsmblob
+    - SAUCE: apparmor4.0.0 [34/82]: Stacking v38: binder: Pass LSM identifier for
+      confirmation
+    - SAUCE: apparmor4.0.0 [35/82]: Stacking v38: LSM: security_secid_to_secctx
+      module selection
+    - SAUCE: apparmor4.0.0 [36/82]: Stacking v38: Audit: Keep multiple LSM data in
+      audit_names
+    - SAUCE: apparmor4.0.0 [37/82]: Stacking v38: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [38/82]: Stacking v38: LSM: Add a function to report
+      multiple LSMs
+    - SAUCE: apparmor4.0.0 [39/82]: Stacking v38: Audit: Allow multiple records in
+      an audit_buffer
+    - SAUCE: apparmor4.0.0 [40/82]: Stacking v38: Audit: Add record for multiple
+      task security contexts
+    - SAUCE: apparmor4.0.0 [41/82]: Stacking v38: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [42/82]: Stacking v38: Audit: Add record for multiple
+      object contexts
+    - SAUCE: apparmor4.0.0 [43/82]: Stacking v38: netlabel: Use a struct lsmblob
+      in audit data
+    - SAUCE: apparmor4.0.0 [44/82]: Stacking v38: LSM: Removed scaffolding
+      function lsmcontext_init
+    - SAUCE: apparmor4.0.0 [45/82]: Stacking v38: AppArmor: Remove the exclusive
+      flag
+    - SAUCE: apparmor4.0.0 [46/82]: combine common_audit_data and
+      apparmor_audit_data
+    - SAUCE: apparmor4.0.0 [47/82]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [48/82]: rename audit_data->label to
+      audit_data->subj_label
+    - SAUCE: apparmor4.0.0 [49/82]: pass cred through to audit info.
+    - SAUCE: apparmor4.0.0 [50/82]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/82]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/82]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/82]: cache buffers on percpu list if there is lock
+      contention
+    - SAUCE: apparmor4.0.0 [54/82]: advertise availability of exended perms
+    - SAUCE: apparmor4.0.0 [56/82]: cleanup: provide separate audit messages for
+      file and policy checks
+    - SAUCE: apparmor4.0.0 [57/82]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [58/82]: prompt - ref count pdb
+    - SAUCE: apparmor4.0.0 [59/82]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [60/82]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [61/82]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [62/82]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [63/82]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [64/82]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [65/82]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [66/82]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [67/82]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [68/82]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [69/82]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [74/82]: advertise disconnected.path is available
+    - SAUCE: apparmor4.0.0 [75/82]: fix invalid reference on profile->disconnected
+    - SAUCE: apparmor4.0.0 [76/82]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [77/82]: apparmor: Fix regression in mount mediation
+
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [70/82]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [71/82]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [72/82]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+    - SAUCE: apparmor4.0.0 [73/82]: userns - allow restricting unprivileged
+      change_profile
+
+  * LSM stacking and AppArmor for 6.2: additional fixes (LP: #2017903) // update
+    apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [55/82]: fix profile verification and enable it
+
+  * udev fails to make prctl() syscall with apparmor=0 (as used by maas by
+    default) (LP: #2016908) // update apparmor and LSM stacking patch set
+    (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [27/82]: Stacking v38: Fix prctl() syscall with
+      apparmor=0
+
+  * Miscellaneous Ubuntu changes
+    - [Config] SECURITY_APPARMOR_RESTRICT_USERNS=y
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 03 Nov 2023 11:59:12 +0100
+
+linux-unstable (6.6.0-8.8) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-8.8 -proposed tracker (LP: #2040243)
+
+  * Miscellaneous Ubuntu changes
+    - abi: gc reference to phy-rtk-usb2/phy-rtk-usb3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 24 Oct 2023 10:55:34 +0200
+
+linux-unstable (6.6.0-7.7) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-7.7 -proposed tracker (LP: #2040147)
+
+  * test_021_aslr_dapper_libs from ubuntu_qrt_kernel_security failed on K-5.19 /
+    J-OEM-6.1 / J-6.2 AMD64 (LP: #1983357)
+    - [Config]: set ARCH_MMAP_RND_{COMPAT_, }BITS to the maximum
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs following v6.6-rc7 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 23 Oct 2023 11:51:14 +0200
+
+linux-unstable (6.6.0-6.6) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-6.6 -proposed tracker (LP: #2039780)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.6-rc6
+    - [Config] updateconfigs following v6.6-rc6 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 19 Oct 2023 12:09:16 +0200
+
+linux-unstable (6.6.0-5.5) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-5.5 -proposed tracker (LP: #2038899)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.6-rc5
+    - [Config] updateconfigs following v6.6-rc5 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 10 Oct 2023 11:18:41 +0200
+
+linux-unstable (6.6.0-4.4) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-4.4 -proposed tracker (LP: #2038423)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.6-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 04 Oct 2023 11:16:25 +0200
+
+linux-unstable (6.6.0-3.3) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-3.3 -proposed tracker (LP: #2037622)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs following v6.6-rc3 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: enforce rust availability only on x86_64"
+    - arm64: rust: Enable Rust support for AArch64
+    - arm64: rust: Enable PAC support for Rust.
+    - arm64: Restrict Rust support to little endian only.
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 28 Sep 2023 10:45:38 +0200
+
+linux-unstable (6.6.0-2.2) mantic; urgency=medium
+
+  * Miscellaneous upstream changes
+    - UBUBNTU: [Config] build all COMEDI drivers as modules
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 Sep 2023 14:42:56 +0200
+
+linux-unstable (6.6.0-1.1) mantic; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move linux to linux-unstable
+    - [Packaging] rebase on v6.6-rc1
+    - [Config] updateconfigs following v6.6-rc1 rebase
+    - [packaging] skip ABI, modules and retpoline checks
+    - update dropped.txt
+    - [Config] SHIFT_FS FTBFS with Linux 6.6, disable it
+    - [Config] DELL_UART_BACKLIGHT FTBFS with Linux 6.6, disable it
+    - [Packaging] debian/dkms-versions: temporarily disable dkms
+    - [Packaging] temporarily disable signing for s390x
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 15 Sep 2023 14:42:18 +0200
+
+linux-unstable (6.6.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 14 Sep 2023 15:03:19 +0200
+
+linux (6.5.0-5.5) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-5.5 -proposed tracker (LP: #2034546)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.08.23)
+
+
+linux (6.5.0-4.4) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-4.4 -proposed tracker (LP: #2034042)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.08.23)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Sep 2023 16:55:44 +0200
+
+linux (6.5.0-3.3) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-3.3 -proposed tracker (LP: #2033904)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.08.23)
+
+  * [23.10] Please test secure-boot and lockdown on the early 6.5 kernel (s390x)
+    (LP: #2026833)
+    - [Packaging] re-enable signing for s390x
+
+  * Miscellaneous upstream changes
+    - module/decompress: use vmalloc() for zstd decompression workspace
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 01 Sep 2023 16:15:33 +0200
+
+linux (6.5.0-2.2) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-2.2 -proposed tracker (LP: #2033240)
+
+  * Soundwire support for Dell SKU0C87 devices (LP: #2029281)
+    - SAUCE: ASoC: Intel: soc-acpi: add support for Dell SKU0C87 devices
+
+  * Fix numerous AER related issues (LP: #2033025)
+    - SAUCE: PCI/AER: Disable AER service during suspend, again
+    - SAUCE: PCI/DPC: Disable DPC service during suspend, again
+
+  * Support Realtek RTL8852CE WiFi 6E/BT Combo (LP: #2025672)
+    - wifi: rtw89: debug: Fix error handling in rtw89_debug_priv_btc_manual_set()
+    - Bluetooth: btrtl: Load FW v2 otherwise FW v1 for RTL8852C
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Aug 2023 08:53:19 +0200
+
+linux (6.5.0-1.1) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-1.1 -proposed tracker (LP: #2032750)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.07.26)
+
+  * ceph: support idmapped mounts (LP: #2032959)
+    - SAUCE: libceph: add spinlock around osd->o_requests
+    - SAUCE: libceph: define struct ceph_sparse_extent and add some helpers
+    - SAUCE: libceph: new sparse_read op, support sparse reads on msgr2 crc
+      codepath
+    - SAUCE: libceph: support sparse reads on msgr2 secure codepath
+    - SAUCE: libceph: add sparse read support to msgr1
+    - SAUCE: libceph: add sparse read support to OSD client
+    - SAUCE: ceph: add new mount option to enable sparse reads
+    - SAUCE: ceph: preallocate inode for ops that may create one
+    - SAUCE: ceph: make ceph_msdc_build_path use ref-walk
+    - SAUCE: libceph: add new iov_iter-based ceph_msg_data_type and
+      ceph_osd_data_type
+    - SAUCE: ceph: use osd_req_op_extent_osd_iter for netfs reads
+    - SAUCE: ceph: fscrypt_auth handling for ceph
+    - SAUCE: ceph: implement -o test_dummy_encryption mount option
+    - SAUCE: ceph: add fscrypt ioctls and ceph.fscrypt.auth vxattr
+    - SAUCE: ceph: make ioctl cmds more readable in debug log
+    - SAUCE: ceph: add base64 endcoding routines for encrypted names
+    - SAUCE: ceph: encode encrypted name in ceph_mdsc_build_path and dentry
+      release
+    - SAUCE: ceph: send alternate_name in MClientRequest
+    - SAUCE: ceph: decode alternate_name in lease info
+    - SAUCE: ceph: set DCACHE_NOKEY_NAME flag in ceph_lookup/atomic_open()
+    - SAUCE: ceph: make d_revalidate call fscrypt revalidator for encrypted
+      dentries
+    - SAUCE: ceph: add helpers for converting names for userland presentation
+    - SAUCE: ceph: make ceph_fill_trace and ceph_get_name decrypt names
+    - SAUCE: ceph: pass the request to parse_reply_info_readdir()
+    - SAUCE: ceph: add support to readdir for encrypted names
+    - SAUCE: ceph: create symlinks with encrypted and base64-encoded targets
+    - SAUCE: ceph: add some fscrypt guardrails
+    - SAUCE: ceph: allow encrypting a directory while not having Ax caps
+    - SAUCE: ceph: mark directory as non-complete after loading key
+    - SAUCE: ceph: size handling in MClientRequest, cap updates and inode traces
+    - SAUCE: ceph: handle fscrypt fields in cap messages from MDS
+    - SAUCE: ceph: add infrastructure for file encryption and decryption
+    - SAUCE: libceph: add CEPH_OSD_OP_ASSERT_VER support
+    - SAUCE: libceph: allow ceph_osdc_new_request to accept a multi-op read
+    - SAUCE: ceph: add object version support for sync read
+    - SAUCE: ceph: add truncate size handling support for fscrypt
+    - SAUCE: ceph: don't use special DIO path for encrypted inodes
+    - SAUCE: ceph: align data in pages in ceph_sync_write
+    - SAUCE: ceph: add read/modify/write to ceph_sync_write
+    - SAUCE: ceph: add encryption support to writepage and writepages
+    - SAUCE: ceph: plumb in decryption during reads
+    - SAUCE: ceph: invalidate pages when doing direct/sync writes
+    - SAUCE: ceph: add support for encrypted snapshot names
+    - SAUCE: ceph: prevent snapshot creation in encrypted locked directories
+    - SAUCE: ceph: update documentation regarding snapshot naming limitations
+    - SAUCE: ceph: drop messages from MDS when unmounting
+    - SAUCE: ceph: wait for OSD requests' callbacks to finish when unmounting
+    - SAUCE: ceph: fix updating i_truncate_pagecache_size for fscrypt
+    - SAUCE: ceph: switch ceph_lookup/atomic_open() to use new fscrypt helper
+    - SAUCE: libceph: do not include crypto/algapi.h
+    - SAUCE: rbd: bump RBD_MAX_PARENT_CHAIN_LEN to 128
+    - SAUCE: ceph: dump info about cap flushes when we're waiting too long for
+      them
+    - SAUCE: mm: BUG if filemap_alloc_folio gives us a folio with a non-NULL
+      ->private
+    - SAUCE: ceph: make sure all the files successfully put before unmounting
+    - SAUCE: ceph: BUG if MDS changed truncate_seq with client caps still
+      outstanding
+    - SAUCE: ceph: add the *_client debug macros support
+    - SAUCE: ceph: pass the mdsc to several helpers
+    - SAUCE: ceph: rename _to_client() to _to_fs_client()
+    - SAUCE: ceph: move mdsmap.h to fs/ceph/
+    - SAUCE: ceph: add ceph_inode_to_client() helper support
+    - SAUCE: ceph: print the client global_id in all the debug logs
+    - SAUCE: ceph: make the members in struct ceph_mds_request_args_ext an union
+    - SAUCE: ceph: make num_fwd and num_retry to __u32
+    - SAUCE: fs: export mnt_idmap_get/mnt_idmap_put
+    - SAUCE: ceph: stash idmapping in mdsc request
+    - SAUCE: ceph: handle idmapped mounts in create_request_message()
+    - SAUCE: ceph: add enable_unsafe_idmap module parameter
+    - SAUCE: ceph: pass an idmapping to mknod/symlink/mkdir
+    - SAUCE: ceph: allow idmapped getattr inode op
+    - SAUCE: ceph: allow idmapped permission inode op
+    - SAUCE: ceph: pass idmap to __ceph_setattr
+    - SAUCE: ceph: allow idmapped setattr inode op
+    - SAUCE: ceph/acl: allow idmapped set_acl inode op
+    - SAUCE: ceph/file: allow idmapped atomic_open inode op
+    - SAUCE: ceph: allow idmapped mounts
+
+  * Got soft lockup CPU if dell_uart_backlight is probed (LP: #2032174)
+    - SAUCE: platform/x86: dell-uart-backlight: replace chars_in_buffer() with
+      flush_chars()
+
+  * Fix ACPI TAD  on some Intel based systems (LP: #2032767)
+    - ACPI: TAD: Install SystemCMOS address space handler for ACPI000E
+
+  * Fix unreliable ethernet cable detection on I219 NIC (LP: #2028122)
+    - e1000e: Use PME poll to circumvent unreliable ACPI wake
+
+  * Fix panel brightness issues on HP laptops (LP: #2032704)
+    - ACPI: video: Put ACPI video and its child devices into D0 on boot
+
+  * FATAL:credentials.cc(127)] Check failed: . : Permission denied (13)
+    (LP: #2017980)
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * Support initrdless boot on default qemu virt models and openstack
+    (LP: #2030745)
+    - [Config] set VIRTIO_BLK=y for default qemu/openstack boot
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] rust: use Rust 1.68.2
+    - [Packaging] depend on clang/libclang-15 for Rust
+    - [Config] update toolchain versions in annotations
+    - [Config] update annotations after rebase to v6.5-rc6
+    - [Config] update toolchain version in annotations
+    - [Packaging] temporarily disable Rust support
+    - [Packaging] temporarily disable signing for ppc64el
+    - [Packaging] temporarily disable signing for s390x
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 24 Aug 2023 17:47:10 +0200
+
+linux (6.5.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 23 Aug 2023 08:14:48 +0200
+
+linux-unstable (6.5.0-4.4) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-4.4 -proposed tracker (LP: #2029086)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Add .NOTPARALLEL
+    - [Packaging] Remove meaningless $(header_arch)
+    - [Packaging] Fix File exists error in install-arch-headers
+    - [Packaging] clean debian/linux-* directories
+    - [Packaging] remove hmake
+    - [Packaging] install headers to debian/linux-libc-dev directly
+    - [Config] define CONFIG options for arm64 instead of arm64-generic
+    - [Config] update annotations after rebase to v6.5-rc4
+    - [Packaging] temporarily disable Rust support
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 31 Jul 2023 08:41:59 +0200
+
+linux-unstable (6.5.0-3.3) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-3.3 -proposed tracker (LP: #2028779)
+
+  * enable Rust support in the kernel (LP: #2007654)
+    - SAUCE: rust: support rustc-1.69.0
+    - [Packaging] depend on rustc-1.69.0
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+    - [Packaging] resync getabis
+
+  * Fix UBSAN in Intel EDAC driver (LP: #2028746)
+    - EDAC/i10nm: Skip the absent memory controllers
+
+  * Ship kernel modules Zstd compressed (LP: #2028568)
+    - SAUCE: Support but do not require compressed modules
+    - [Config] Enable support for ZSTD compressed modules
+    - [Packaging] ZSTD compress modules
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [02/60]: rename SK_CTX() to aa_sock and make it an
+      inline fn
+    - SAUCE: apparmor3.2.0 [05/60]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor3.2.0 [08/60]: Stacking v38: LSM: Identify modules by more
+      than name
+    - SAUCE: apparmor3.2.0 [09/60]: Stacking v38: LSM: Add an LSM identifier for
+      external use
+    - SAUCE: apparmor3.2.0 [10/60]: Stacking v38: LSM: Identify the process
+      attributes for each module
+    - SAUCE: apparmor3.2.0 [11/60]: Stacking v38: LSM: Maintain a table of LSM
+      attribute data
+    - SAUCE: apparmor3.2.0 [12/60]: Stacking v38: proc: Use lsmids instead of lsm
+      names for attrs
+    - SAUCE: apparmor3.2.0 [13/60]: Stacking v38: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor3.2.0 [14/60]: Stacking v38: LSM: Infrastructure management
+      of the sock security
+    - SAUCE: apparmor3.2.0 [15/60]: Stacking v38: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor3.2.0 [16/60]: Stacking v38: LSM: provide lsm name and id
+      slot mappings
+    - SAUCE: apparmor3.2.0 [17/60]: Stacking v38: IMA: avoid label collisions with
+      stacked LSMs
+    - SAUCE: apparmor3.2.0 [18/60]: Stacking v38: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor3.2.0 [19/60]: Stacking v38: LSM: Use lsmblob in
+      security_kernel_act_as
+    - SAUCE: apparmor3.2.0 [20/60]: Stacking v38: LSM: Use lsmblob in
+      security_secctx_to_secid
+    - SAUCE: apparmor3.2.0 [21/60]: Stacking v38: LSM: Use lsmblob in
+      security_secid_to_secctx
+    - SAUCE: apparmor3.2.0 [22/60]: Stacking v38: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor3.2.0 [23/60]: Stacking v38: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor3.2.0 [24/60]: Stacking v38: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor3.2.0 [25/60]: Stacking v38: LSM: Use lsmblob in
+      security_cred_getsecid
+    - SAUCE: apparmor3.2.0 [26/60]: Stacking v38: LSM: Specify which LSM to
+      display
+    - SAUCE: apparmor3.2.0 [28/60]: Stacking v38: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor3.2.0 [29/60]: Stacking v38: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor3.2.0 [30/60]: Stacking v38: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor3.2.0 [31/60]: Stacking v38: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor3.2.0 [32/60]: Stacking v38: LSM: security_secid_to_secctx in
+      netlink netfilter
+    - SAUCE: apparmor3.2.0 [33/60]: Stacking v38: NET: Store LSM netlabel data in
+      a lsmblob
+    - SAUCE: apparmor3.2.0 [34/60]: Stacking v38: binder: Pass LSM identifier for
+      confirmation
+    - SAUCE: apparmor3.2.0 [35/60]: Stacking v38: LSM: security_secid_to_secctx
+      module selection
+    - SAUCE: apparmor3.2.0 [36/60]: Stacking v38: Audit: Keep multiple LSM data in
+      audit_names
+    - SAUCE: apparmor3.2.0 [37/60]: Stacking v38: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor3.2.0 [38/60]: Stacking v38: LSM: Add a function to report
+      multiple LSMs
+    - SAUCE: apparmor3.2.0 [39/60]: Stacking v38: Audit: Allow multiple records in
+      an audit_buffer
+    - SAUCE: apparmor3.2.0 [40/60]: Stacking v38: Audit: Add record for multiple
+      task security contexts
+    - SAUCE: apparmor3.2.0 [41/60]: Stacking v38: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor3.2.0 [42/60]: Stacking v38: Audit: Add record for multiple
+      object contexts
+    - SAUCE: apparmor3.2.0 [43/60]: Stacking v38: netlabel: Use a struct lsmblob
+      in audit data
+    - SAUCE: apparmor3.2.0 [44/60]: Stacking v38: LSM: Removed scaffolding
+      function lsmcontext_init
+    - SAUCE: apparmor3.2.0 [45/60]: Stacking v38: AppArmor: Remove the exclusive
+      flag
+    - SAUCE: apparmor3.2.0 [46/60]: combine common_audit_data and
+      apparmor_audit_data
+    - SAUCE: apparmor3.2.0 [47/60]: setup slab cache for audit data
+    - SAUCE: apparmor3.2.0 [48/60]: rename audit_data->label to
+      audit_data->subj_label
+    - SAUCE: apparmor3.2.0 [49/60]: pass cred through to audit info.
+    - SAUCE: apparmor3.2.0 [50/60]: Improve debug print infrastructure
+    - SAUCE: apparmor3.2.0 [51/60]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor3.2.0 [52/60]: enable userspace upcall for mediation
+    - SAUCE: apparmor3.2.0 [53/60]: cache buffers on percpu list if there is lock
+      contention
+    - SAUCE: apparmor3.2.0 [55/60]: advertise availability of exended perms
+    - SAUCE: apparmor3.2.0 [60/60]: [Config] enable
+      CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * LSM stacking and AppArmor for 6.2: additional fixes (LP: #2017903) // update
+    apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [57/60]: fix profile verification and enable it
+
+  * udev fails to make prctl() syscall with apparmor=0 (as used by maas by
+    default) (LP: #2016908) // update apparmor and LSM stacking patch set
+    (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [27/60]: Stacking v38: Fix prctl() syscall with
+      apparmor=0
+
+  * kinetic: apply new apparmor and LSM stacking patch set (LP: #1989983) //
+    update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [01/60]: add/use fns to print hash string hex value
+    - SAUCE: apparmor3.2.0 [03/60]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor3.2.0 [04/60]: add user namespace creation mediation
+    - SAUCE: apparmor3.2.0 [06/60]: af_unix mediation
+    - SAUCE: apparmor3.2.0 [07/60]: Add fine grained mediation of posix mqueues
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Use consistent llvm/clang for rust
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 28 Jul 2023 07:44:20 +0200
+
+linux-unstable (6.5.0-2.2) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-2.2 -proposed tracker (LP: #2027953)
+
+  * Remove non-LPAE kernel flavor (LP: #2025265)
+    - [Packaging] Rename armhf generic-lpae flavor to generic
+
+  * Please enable Renesas RZ platform serial installer (LP: #2022361)
+    - [Config] enable hihope RZ/G2M serial console
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] snap: Remove old configs handling
+    - [Packaging] checks/final-checks: Remove old configs handling
+    - [Packaging] checks/final-checks: check existance of Makefile first
+    - [Packaging] checks/final-checks: Fix shellcheck issues
+    - [Packaging] add libstdc++-dev to the build dependencies
+    - [Config] update annotations after rebase to v6.5-rc2
+
+  * Miscellaneous upstream changes
+    - kbuild: rust: avoid creating temporary files
+    - rust: fix bindgen build error with UBSAN_BOUNDS_STRICT
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 18 Jul 2023 10:14:14 +0200
+
+linux-unstable (6.5.0-1.1) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-1.1 -proposed tracker (LP: #2026689)
+
+  * CVE-2023-31248
+    - netfilter: nf_tables: do not ignore genmask when looking up chain by id
+
+  * CVE-2023-35001
+    - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
+
+  * HDMI output with More than one child device for port B in VBT error
+    (LP: #2025195)
+    - SAUCE: drm/i915/quirks: Add multiple VBT quirk for HP ZBook Power G10
+
+  * CVE-2023-2640 // CVE-2023-32629
+    - SAUCE: overlayfs: default to userxattr when mounted from non initial user
+      namespace
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+
+  * enable Rust support in the kernel (LP: #2007654)
+    - SAUCE: btf, scripts: rust: drop is_rust_module.sh
+    - [Packaging] add rust dependencies
+
+  * CVE-2023-2612
+    - SAUCE: shiftfs: prevent lock unbalance in shiftfs_create_object()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: shiftfs: support linux 6.5
+    - [Config] update annotations after rebase to v6.5-rc1
+    - [Config] temporarily disable Rust
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 10 Jul 2023 09:15:26 +0200
+
+linux-unstable (6.5.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 05 Jul 2023 12:48:39 +0200
+
+linux-unstable (6.4.0-8.8) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-8.8 -proposed tracker (LP: #2025018)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain version (gcc) in annotations
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 26 Jun 2023 09:14:02 +0200
+
+linux-unstable (6.4.0-7.7) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-7.7 -proposed tracker (LP: #2024338)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 19 Jun 2023 08:51:27 +0200
+
+linux-unstable (6.4.0-6.6) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-6.6 -proposed tracker (LP: #2023966)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update annotations scripts
+
+  * enable multi-gen LRU by default (LP: #2023629)
+    - [Config] enable multi-gen LRU by default
+
+  * Fix Monitor lost after replug WD19TBS to SUT port with VGA/DVI to type-C
+    dongle (LP: #2021949)
+    - thunderbolt: Do not touch CL state configuration during discovery
+    - thunderbolt: Increase DisplayPort Connection Manager handshake timeout
+
+  * Neuter signing tarballs (LP: #2012776)
+    - [Packaging] remove the signing tarball support
+
+  * Enable Tracing Configs for OSNOISE and TIMERLAT (LP: #2018591)
+    - [Config] Enable OSNOISE_TRACER and TIMERLAT_TRACER configs
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Add CONFIG_AS_HAS_NON_CONST_LEB128 on riscv64
+    - [Packaging] introduce do_lib_rust and enable it only on generic amd64
+    - [Config] update annotations after rebase to v6.4-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 15 Jun 2023 20:11:07 +0200
+
+linux-unstable (6.4.0-5.5) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-5.5 -proposed tracker (LP: #2022886)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] update getabis to support linux-unstable
+    - UBUNTU [Config]: disable hibernation on riscv64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 06 Jun 2023 08:18:01 +0200
+
+linux-unstable (6.4.0-4.4) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-4.4 -proposed tracker (LP: #2021597)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] udpate annotations after rebase to v6.4-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 30 May 2023 11:55:41 +0200
+
+linux-unstable (6.4.0-3.3) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-3.3 -proposed tracker (LP: #2021497)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] resync getabis
+
+  * support python < 3.9 with annotations (LP: #2020531)
+    - [Packaging] kconfig/annotations.py: support older way of merging dicts
+
+  * generate linux-lib-rust only on amd64 (LP: #2020356)
+    - [Packaging] generate linux-lib-rust only on amd64
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: never drop configs that have notes different than
+      the parent
+    - [Config] drop CONFIG_SMBFS_COMMON from annotations
+    - [Packaging] perf: build without libtraceevent
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 30 May 2023 08:38:10 +0200
+
+linux-unstable (6.4.0-2.2) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-2.2 -proposed tracker (LP: #2020330)
+
+  * Computer with Intel Atom CPU will  not boot with Kernel 6.2.0-20
+    (LP: #2017444)
+    - [Config]: Disable CONFIG_INTEL_ATOMISP
+
+  * Fix NVME storage with RAID ON disappeared under Dell factory WINPE
+    environment (LP: #2011768)
+    - SAUCE: PCI: vmd: Reset VMD config register between soft reboots
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Drop support of old config handling
+    - [Config] update annotations after rebase to v6.4-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 May 2023 11:22:14 +0200
+
+linux-unstable (6.4.0-1.1) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-1.1 -proposed tracker (LP: #2019965)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] update helper scripts
+
+  * Kernel 6.1 bumped the disk consumption on default images by 15%
+    (LP: #2015867)
+    - [Packaging] introduce a separate linux-lib-rust package
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable CONFIG_BLK_DEV_UBLK on amd64
+    - [Packaging] annotations: use python3 in the shebang
+    - SAUCE: blk-throttle: Fix io statistics for cgroup v1
+    - [Packaging] move to v6.4 and rename to linux-unstable
+    - [Config] update annotations after rebase to v6.4-rc1
+    - [Packaging] temporarily disable perf
+    - [Packaging] temporarily disable bpftool
+    - [Config] ppc64el: reduce CONFIG_ARCH_FORCE_MAX_ORDER from 9 to 8
+    - SAUCE: perf: explicitly disable libtraceevent
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 18 May 2023 07:34:09 +0200
+
+linux-unstable (6.4.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 May 2023 15:29:25 +0200
+
+linux-unstable (6.3.0-2.2) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.3.0-2.2 -proposed tracker (LP: #2017788)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move python3-dev to build-depends
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 26 Apr 2023 21:52:12 +0200
+
+linux-unstable (6.3.0-1.1) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.3.0-1.1 -proposed tracker (LP: #2017776)
+
+  * RFC: virtio and virtio-scsi should be built in (LP: #1685291)
+    - [Config] Mark CONFIG_SCSI_VIRTIO built-in
+
+  * Debian autoreconstruct Fix restoration of execute permissions (LP: #2015498)
+    - [Debian] autoreconstruct - fix restoration of execute permissions
+
+  * [SRU][Jammy] CONFIG_PCI_MESON is not enabled (LP: #2007745)
+    - [Config] arm64: Enable PCI_MESON module
+
+  * vmd may fail to create sysfs entry while `pci_rescan_bus()` called in some
+    other drivers like wwan (LP: #2011389)
+    - SAUCE: PCI: vmd: guard device addition and removal
+
+  * Lunar update: v6.2.9 upstream stable release (LP: #2016877)
+    - [Config] ppc64: updateconfigs following v6.2.9 stable updates
+
+  * Lunar update: v6.2.8 upstream stable release (LP: #2016876)
+    - [Config] ppc64: updateconfigs following v6.2.8 stable updates
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Move final-checks script to debian/scripts/checks
+    - [Packaging] checks/final-checks: Honor 'do_skip_checks'
+    - [Packaging] Drop wireguard DKMS
+    - [Packaging] Remove update-version-dkms
+    - [Packaging] debian/rules: Add DKMS info to 'printenv' output
+    - [Packaging] ignore KBUILD_VERBOSE in arch-has-odm-enabled.sh
+    - SAUCE: shiftfs: support linux 6.3
+    - [Packaging] move to v6.3 and rename to linux-unstable
+    - [Config] latency-related optimizations
+    - [Config] update annotations after rebase to v6.3
+    - [Packaging] temporarily disable dkms
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 26 Apr 2023 14:53:52 +0200
+
+linux-unstable (6.3.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 25 Apr 2023 10:24:12 +0200
+
+linux (6.2.0-21.21) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-21.21 -proposed tracker (LP: #2016249)
+
+  * efivarfs:efivarfs.sh in ubuntu_kernel_selftests crash L-6.2 ARM64 node
+    dazzle (rcu_preempt detected stalls) (LP: #2015741)
+    - efi/libstub: smbios: Use length member instead of record struct size
+    - arm64: efi: Use SMBIOS processor version to key off Ampere quirk
+    - efi/libstub: smbios: Drop unused 'recsize' parameter
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/bpf: ignore pointer types check with clang
+    - SAUCE: selftests/bpf: avoid conflicting data types in profiler.inc.h
+    - [Packaging] get rid of unnecessary artifacts in linux-headers
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: Revert "efi: random: refresh non-volatile random seed
+      when RNG is initialized""
+    - Revert "UBUNTU: SAUCE: Revert "efi: random: fix NULL-deref when refreshing
+      seed""
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 14 Apr 2023 12:11:49 +0200
+
+linux (6.2.0-20.20) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-20.20 -proposed tracker (LP: #2015429)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * FTBFS with different dkms or when makeflags are set (LP: #2015361)
+    - [Packaging] FTBFS with different dkms or when makeflags are set
+
+  * expoline.o is packaged unconditionally for s390x (LP: #2013209)
+    - [Packaging] Copy expoline.o only when produced by the build
+
+  * net:l2tp.sh failure with lunar:linux 6.2 (LP: #2013014)
+    - SAUCE: l2tp: generate correct module alias strings
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: prevent duplicate include lines
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 06 Apr 2023 08:33:14 +0200
+
+linux (6.2.0-19.19) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-19.19 -proposed tracker (LP: #2012488)
+
+  * Neuter signing tarballs (LP: #2012776)
+    - [Packaging] neuter the signing tarball
+
+  * LSM stacking and AppArmor refresh for 6.2 kernel (LP: #2012136)
+    - Revert "UBUNTU: [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS"
+    - Revert "UBUNTU: SAUCE: apparmor: add user namespace creation mediation"
+    - Revert "UBUNTU: SAUCE: apparmor: Add fine grained mediation of posix
+      mqueues"
+    - Revert "UBUNTU: SAUCE: Revert "apparmor: make __aa_path_perm() static""
+    - Revert "UBUNTU: SAUCE: LSM: Specify which LSM to display (using struct cred
+      as input)"
+    - Revert "UBUNTU: SAUCE: apparmor: Fix build error, make sk parameter const"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in smk_netlbl_mls()"
+    - Revert "UBUNTU: SAUCE: LSM: change ima_read_file() to use lsmblob"
+    - Revert "UBUNTU: SAUCE: apparmor: rename kzfree() to kfree_sensitive()"
+    - Revert "UBUNTU: SAUCE: AppArmor: Remove the exclusive flag"
+    - Revert "UBUNTU: SAUCE: LSM: Add /proc attr entry for full LSM context"
+    - Revert "UBUNTU: SAUCE: Audit: Fix incorrect static inline function
+      declration."
+    - Revert "UBUNTU: SAUCE: Audit: Fix for missing NULL check"
+    - Revert "UBUNTU: SAUCE: Audit: Add a new record for multiple object LSM
+      attributes"
+    - Revert "UBUNTU: SAUCE: Audit: Add new record for multiple process LSM
+      attributes"
+    - Revert "UBUNTU: SAUCE: NET: Store LSM netlabel data in a lsmblob"
+    - Revert "UBUNTU: SAUCE: LSM: security_secid_to_secctx in netlink netfilter"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmcontext in security_inode_getsecctx"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmcontext in security_secid_to_secctx"
+    - Revert "UBUNTU: SAUCE: LSM: Ensure the correct LSM context releaser"
+    - Revert "UBUNTU: SAUCE: LSM: Specify which LSM to display"
+    - Revert "UBUNTU: SAUCE: IMA: Change internal interfaces to use lsmblobs"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_cred_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_inode_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_task_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_ipc_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_secid_to_secctx"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_secctx_to_secid"
+    - Revert "UBUNTU: SAUCE: net: Prepare UDS for security module stacking"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_kernel_act_as"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_audit_rule_match"
+    - Revert "UBUNTU: SAUCE: LSM: Create and manage the lsmblob data structure."
+    - Revert "UBUNTU: SAUCE: LSM: Infrastructure management of the sock security"
+    - Revert "UBUNTU: SAUCE: apparmor: LSM stacking: switch from SK_CTX() to
+      aa_sock()"
+    - Revert "UBUNTU: SAUCE: apparmor: rename aa_sock() to aa_unix_sk()"
+    - Revert "UBUNTU: SAUCE: apparmor: disable showing the mode as part of a secid
+      to secctx"
+    - Revert "UBUNTU: SAUCE: apparmor: fix use after free in sk_peer_label"
+    - Revert "UBUNTU: SAUCE: apparmor: af_unix mediation"
+    - Revert "UBUNTU: SAUCE: apparmor: patch to provide compatibility with v2.x
+      net rules"
+    - Revert "UBUNTU: SAUCE: apparmor: add/use fns to print hash string hex value"
+    - SAUCE: apparmor: rename SK_CTX() to aa_sock and make it an inline fn
+    - SAUCE: apparmor: Add sysctls for additional controls of unpriv userns
+      restrictions
+    - SAUCE: Stacking v38: LSM: Identify modules by more than name
+    - SAUCE: Stacking v38: LSM: Add an LSM identifier for external use
+    - SAUCE: Stacking v38: LSM: Identify the process attributes for each module
+    - SAUCE: Stacking v38: LSM: Maintain a table of LSM attribute data
+    - SAUCE: Stacking v38: proc: Use lsmids instead of lsm names for attrs
+    - SAUCE: Stacking v38: integrity: disassociate ima_filter_rule from
+      security_audit_rule
+    - SAUCE: Stacking v38: LSM: Infrastructure management of the sock security
+    - SAUCE: Stacking v38: LSM: Add the lsmblob data structure.
+    - SAUCE: Stacking v38: LSM: provide lsm name and id slot mappings
+    - SAUCE: Stacking v38: IMA: avoid label collisions with stacked LSMs
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_audit_rule_match
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_kernel_act_as
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_secctx_to_secid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_secid_to_secctx
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_ipc_getsecid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_current_getsecid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_inode_getsecid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_cred_getsecid
+    - SAUCE: Stacking v38: LSM: Specify which LSM to display
+    - SAUCE: Stacking v38: LSM: Ensure the correct LSM context releaser
+    - SAUCE: Stacking v38: LSM: Use lsmcontext in security_secid_to_secctx
+    - SAUCE: Stacking v38: LSM: Use lsmcontext in security_inode_getsecctx
+    - SAUCE: Stacking v38: Use lsmcontext in security_dentry_init_security
+    - SAUCE: Stacking v38: LSM: security_secid_to_secctx in netlink netfilter
+    - SAUCE: Stacking v38: NET: Store LSM netlabel data in a lsmblob
+    - SAUCE: Stacking v38: binder: Pass LSM identifier for confirmation
+    - SAUCE: Stacking v38: LSM: security_secid_to_secctx module selection
+    - SAUCE: Stacking v38: Audit: Keep multiple LSM data in audit_names
+    - SAUCE: Stacking v38: Audit: Create audit_stamp structure
+    - SAUCE: Stacking v38: LSM: Add a function to report multiple LSMs
+    - SAUCE: Stacking v38: Audit: Allow multiple records in an audit_buffer
+    - SAUCE: Stacking v38: Audit: Add record for multiple task security contexts
+    - SAUCE: Stacking v38: audit: multiple subject lsm values for netlabel
+    - SAUCE: Stacking v38: Audit: Add record for multiple object contexts
+    - SAUCE: Stacking v38: netlabel: Use a struct lsmblob in audit data
+    - SAUCE: Stacking v38: LSM: Removed scaffolding function lsmcontext_init
+    - SAUCE: Stacking v38: AppArmor: Remove the exclusive flag
+    - SAUCE: apparmor: combine common_audit_data and apparmor_audit_data
+    - SAUCE: apparmor: setup slab cache for audit data
+    - SAUCE: apparmor: rename audit_data->label to audit_data->subj_label
+    - SAUCE: apparmor: pass cred through to audit info.
+    - SAUCE: apparmor: Improve debug print infrastructure
+    - SAUCE: apparmor: add the ability for profiles to have a learning cache
+    - SAUCE: apparmor: enable userspace upcall for mediation
+    - SAUCE: apparmor: cache buffers on percpu list if there is lock contention
+    - SAUCE: apparmor: fix policy_compat permission remap with extended
+      permissions
+    - SAUCE: apparmor: advertise availability of exended perms
+    - [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * kinetic: apply new apparmor and LSM stacking patch set (LP: #1989983) // LSM
+    stacking and AppArmor refresh for 6.2 kernel (LP: #2012136)
+    - SAUCE: apparmor: add/use fns to print hash string hex value
+    - SAUCE: apparmor: patch to provide compatibility with v2.x net rules
+    - SAUCE: apparmor: add user namespace creation mediation
+    - SAUCE: apparmor: af_unix mediation
+    - SAUCE: apparmor: Add fine grained mediation of posix mqueues
+
+  * devlink_port_split from ubuntu_kernel_selftests.net fails on hirsute
+    (KeyError: 'flavour') (LP: #1937133)
+    - selftests: net: devlink_port_split.py: skip test if no suitable device
+      available
+
+  * NFS deathlock with last Kernel 5.4.0-144.161 and 5.15.0-67.74 (LP: #2009325)
+    - NFS: Correct timing for assigning access cache timestamp
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Sat, 25 Mar 2023 07:37:30 +0100
+
+linux (6.2.0-18.18) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-18.18 -proposed tracker (LP: #2011750)
+
+  * lunar/linux 6.2 fails to boot on arm64 (LP: #2011748)
+    - SAUCE: Revert "efi: random: fix NULL-deref when refreshing seed"
+    - SAUCE: Revert "efi: random: refresh non-volatile random seed when RNG is
+      initialized"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 15 Mar 2023 23:54:18 +0100
+
+linux (6.2.0-17.17) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-17.17 -proposed tracker (LP: #2011593)
+
+  * lunar/linux 6.2 fails to boot on ppc64el (LP: #2011413)
+    - SAUCE: Revert "powerpc: remove STACK_FRAME_OVERHEAD"
+    - SAUCE: Revert "powerpc/pseries: hvcall stack frame overhead"
+
+  * Speaker / Audio/Mic mute LED don't work on a HP platform (LP: #2011379)
+    - SAUCE: ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP
+      platform
+
+  * Some QHD panels fail to refresh when PSR2 enabled (LP: #2009014)
+    - SAUCE: drm/i915/psr: Use calculated io and fast wake lines
+
+  * Lunar update: v6.2.6 upstream stable release (LP: #2011431)
+    - tpm: disable hwrng for fTPM on some AMD designs
+    - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
+    - staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script
+    - staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh
+    - Linux 6.2.6
+
+  * Lunar update: v6.2.5 upstream stable release (LP: #2011430)
+    - net/sched: Retire tcindex classifier
+    - auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
+    - fs/jfs: fix shift exponent db_agl2size negative
+    - driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()
+    - f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin
+    - f2fs: fix to avoid potential deadlock
+    - objtool: Fix memory leak in create_static_call_sections()
+    - soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on
+    - soc: qcom: socinfo: Fix soc_id order
+    - memory: renesas-rpc-if: Split-off private data from struct rpcif
+    - memory: renesas-rpc-if: Move resource acquisition to .probe()
+    - soc: mediatek: mtk-svs: Enable the IRQ later
+    - pwm: sifive: Always let the first pwm_apply_state succeed
+    - pwm: stm32-lp: fix the check on arr and cmp registers update
+    - f2fs: introduce trace_f2fs_replace_atomic_write_block
+    - f2fs: clear atomic_write_task in f2fs_abort_atomic_write()
+    - soc: mediatek: mtk-svs: restore default voltages when svs_init02() fail
+    - soc: mediatek: mtk-svs: reset svs when svs_resume() fail
+    - soc: mediatek: mtk-svs: Use pm_runtime_resume_and_get() in svs_init01()
+    - f2fs: fix to do sanity check on extent cache correctly
+    - fs: f2fs: initialize fsdata in pagecache_write()
+    - f2fs: allow set compression option of files without blocks
+    - f2fs: fix to abort atomic write only during do_exist()
+    - um: vector: Fix memory leak in vector_config
+    - ubi: ensure that VID header offset + VID header size <= alloc, size
+    - ubifs: Fix build errors as symbol undefined
+    - ubifs: Fix memory leak in ubifs_sysfs_init()
+    - ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
+    - ubifs: Rectify space budget for ubifs_xrename()
+    - ubifs: Fix wrong dirty space budget for dirty inode
+    - ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
+    - ubifs: Reserve one leb for each journal head while doing budget
+    - ubi: Fix use-after-free when volume resizing failed
+    - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
+    - ubifs: Fix memory leak in alloc_wbufs()
+    - ubi: Fix possible null-ptr-deref in ubi_free_volume()
+    - ubifs: Re-statistic cleaned znode count if commit failed
+    - ubifs: dirty_cow_znode: Fix memleak in error handling path
+    - ubifs: ubifs_writepage: Mark page dirty after writing inode failed
+    - ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
+    - ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling
+      fastmap
+    - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
+    - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
+    - f2fs: fix to handle F2FS_IOC_START_ATOMIC_REPLACE in f2fs_compat_ioctl()
+    - f2fs: fix to avoid potential memory corruption in __update_iostat_latency()
+    - f2fs: fix to update age extent correctly during truncation
+    - f2fs: fix to update age extent in f2fs_do_zero_range()
+    - soc: qcom: stats: Populate all subsystem debugfs files
+    - f2fs: introduce IS_F2FS_IPU_* macro
+    - f2fs: fix to set ipu policy
+    - ext4: use ext4_fc_tl_mem in fast-commit replay path
+    - ext4: don't show commit interval if it is zero
+    - netfilter: nf_tables: allow to fetch set elements when table has an owner
+    - x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
+    - um: virtio_uml: free command if adding to virtqueue failed
+    - um: virtio_uml: mark device as unregistered when breaking it
+    - um: virtio_uml: move device breaking into workqueue
+    - um: virt-pci: properly remove PCI device from bus
+    - f2fs: synchronize atomic write aborts
+    - watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks
+    - watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M
+    - watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in
+      error path
+    - watchdog: Fix kmemleak in watchdog_cdev_register
+    - watchdog: pcwd_usb: Fix attempting to access uninitialized memory
+    - watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
+    - netfilter: ctnetlink: fix possible refcount leak in
+      ctnetlink_create_conntrack()
+    - netfilter: conntrack: fix rmmod double-free race
+    - netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
+    - netfilter: ebtables: fix table blob use-after-free
+    - netfilter: xt_length: use skb len to match in length_mt6
+    - netfilter: ctnetlink: make event listener tracking global
+    - netfilter: x_tables: fix percpu counter block leak on error path when
+      creating new netns
+    - swiotlb: mark swiotlb_memblock_alloc() as __init
+    - ptp: vclock: use mutex to fix "sleep on atomic" bug
+    - drm/i915: move a Kconfig symbol to unbreak the menu presentation
+    - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
+    - drm/i915/xelpmp: Consider GSI offset when doing MCR lookups
+    - octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet
+    - net: sunhme: Fix region request
+    - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
+    - octeontx2-pf: Use correct struct reference in test condition
+    - net: fix __dev_kfree_skb_any() vs drop monitor
+    - 9p/xen: fix version parsing
+    - 9p/xen: fix connection sequence
+    - 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
+    - spi: tegra210-quad: Fix validate combined sequence
+    - mlx5: fix skb leak while fifo resync and push
+    - mlx5: fix possible ptp queue fifo use-after-free
+    - net/mlx5: ECPF, wait for VF pages only after disabling host PFs
+    - net/mlx5e: Verify flow_source cap before using it
+    - net/mlx5: Geneve, Fix handling of Geneve object id as error code
+    - ext4: fix incorrect options show of original mount_opt and extend mount_opt2
+    - nfc: fix memory leak of se_io context in nfc_genl_se_io
+    - net/sched: transition act_pedit to rcu and percpu stats
+    - net/sched: act_pedit: fix action bind logic
+    - net/sched: act_mpls: fix action bind logic
+    - net/sched: act_sample: fix action bind logic
+    - net: dsa: seville: ignore mscc-miim read errors from Lynx PCS
+    - net: dsa: felix: fix internal MDIO controller resource length
+    - ARM: dts: aspeed: p10bmc: Update battery node name
+    - ARM: dts: spear320-hmi: correct STMPE GPIO compatible
+    - tcp: tcp_check_req() can be called from process context
+    - vc_screen: modify vcs_size() handling in vcs_read()
+    - spi: tegra210-quad: Fix iterator outside loop
+    - rtc: sun6i: Always export the internal oscillator
+    - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
+    - scsi: ipr: Work around fortify-string warning
+    - scsi: mpi3mr: Fix an issue found by KASAN
+    - scsi: mpi3mr: Use number of bits to manage bitmap sizes
+    - rtc: allow rtc_read_alarm without read_alarm callback
+    - io_uring: fix size calculation when registering buf ring
+    - loop: loop_set_status_from_info() check before assignment
+    - ASoC: adau7118: don't disable regulators on device unbind
+    - ASoC: apple: mca: Fix final status read on SERDES reset
+    - ASoC: apple: mca: Fix SERDES reset sequence
+    - ASoC: apple: mca: Improve handling of unavailable DMA channels
+    - nvme: bring back auto-removal of deleted namespaces during sequential scan
+    - nvme-tcp: don't access released socket during error recovery
+    - nvme-fabrics: show well known discovery name
+    - ASoC: zl38060 add gpiolib dependency
+    - ASoC: mediatek: mt8195: add missing initialization
+    - thermal: intel: quark_dts: fix error pointer dereference
+    - thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
+    - cpufreq: apple-soc: Fix an IS_ERR() vs NULL check
+    - tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
+    - kernel/printk/index.c: fix memory leak with using debugfs_lookup()
+    - firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
+    - bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC
+      support
+    - mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
+    - IB/hfi1: Update RMT size calculation
+    - iommu: Remove deferred attach check from __iommu_detach_device()
+    - PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3()
+    - media: uvcvideo: Remove format descriptions
+    - media: uvcvideo: Handle cameras with invalid descriptors
+    - media: uvcvideo: Handle errors from calls to usb_string
+    - media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
+    - media: uvcvideo: Silence memcpy() run-time false positive warnings
+    - USB: fix memory leak with using debugfs_lookup()
+    - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
+    - usb: fotg210: List different variants
+    - dt-bindings: usb: Add device id for Genesys Logic hub controller
+    - staging: emxx_udc: Add checks for dma_alloc_coherent()
+    - tty: fix out-of-bounds access in tty_driver_lookup_tty()
+    - tty: serial: fsl_lpuart: disable the CTS when send break signal
+    - serial: sc16is7xx: setup GPIO controller later in probe
+    - mei: bus-fixup:upon error print return values of send and receive
+    - tools/iio/iio_utils:fix memory leak
+    - bus: mhi: ep: Fix the debug message for MHI_PKT_TYPE_RESET_CHAN_CMD cmd
+    - iio: accel: mma9551_core: Prevent uninitialized variable in
+      mma9551_read_status_word()
+    - iio: accel: mma9551_core: Prevent uninitialized variable in
+      mma9551_read_config_word()
+    - media: uvcvideo: Add GUID for BGRA/X 8:8:8:8
+    - soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
+    - PCI/portdrv: Prevent LS7A Bus Master clearing on shutdown
+    - PCI: loongson: Prevent LS7A MRRS increases
+    - staging: pi433: fix memory leak with using debugfs_lookup()
+    - USB: dwc3: fix memory leak with using debugfs_lookup()
+    - USB: chipidea: fix memory leak with using debugfs_lookup()
+    - USB: ULPI: fix memory leak with using debugfs_lookup()
+    - USB: uhci: fix memory leak with using debugfs_lookup()
+    - USB: sl811: fix memory leak with using debugfs_lookup()
+    - USB: fotg210: fix memory leak with using debugfs_lookup()
+    - USB: isp116x: fix memory leak with using debugfs_lookup()
+    - USB: isp1362: fix memory leak with using debugfs_lookup()
+    - USB: gadget: gr_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()
+    - usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer
+      math
+    - USB: ene_usb6250: Allocate enough memory for full object
+    - usb: uvc: Enumerate valid values for color matching
+    - usb: gadget: uvc: Make bSourceID read/write
+    - PCI: Align extra resources for hotplug bridges properly
+    - PCI: Take other bus devices into account when distributing resources
+    - PCI: Distribute available resources for root buses, too
+    - tty: pcn_uart: fix memory leak with using debugfs_lookup()
+    - misc: vmw_balloon: fix memory leak with using debugfs_lookup()
+    - drivers: base: component: fix memory leak with using debugfs_lookup()
+    - drivers: base: dd: fix memory leak with using debugfs_lookup()
+    - kernel/fail_function: fix memory leak with using debugfs_lookup()
+    - PCI: loongson: Add more devices that need MRRS quirk
+    - PCI: Add ACS quirk for Wangxun NICs
+    - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
+    - phy: rockchip-typec: Fix unsigned comparison with less than zero
+    - RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size
+    - soundwire: cadence: Remove wasted space in response_buf
+    - soundwire: cadence: Drain the RX FIFO after an IO timeout
+    - eth: fealnx: bring back this old driver
+    - net: tls: avoid hanging tasks on the tx_lock
+    - x86/resctl: fix scheduler confusion with 'current'
+    - vDPA/ifcvf: decouple hw features manipulators from the adapter
+    - vDPA/ifcvf: decouple config space ops from the adapter
+    - vDPA/ifcvf: alloc the mgmt_dev before the adapter
+    - vDPA/ifcvf: decouple vq IRQ releasers from the adapter
+    - vDPA/ifcvf: decouple config IRQ releaser from the adapter
+    - vDPA/ifcvf: decouple vq irq requester from the adapter
+    - vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the
+      adapter
+    - vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw
+    - vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev
+    - vDPA/ifcvf: allocate the adapter in dev_add()
+    - drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state()
+    - drm/display/dp_mst: Fix down/up message handling after sink disconnect
+    - drm/display/dp_mst: Fix down message handling after a packet reception error
+    - drm/display/dp_mst: Fix payload addition on a disconnected sink
+    - drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs
+    - drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload()
+    - drm/i915/dp_mst: Fix payload removal during output disabling
+    - drm/i915: Fix system suspend without fbdev being initialized
+    - media: uvcvideo: Fix race condition with usb_kill_urb
+    - arm64: efi: Make efi_rt_lock a raw_spinlock
+    - usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
+    - Linux 6.2.5
+
+  * Lunar update: v6.2.4 upstream stable release (LP: #2011428)
+    - Revert "blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and
+      blkcg_deactivate_policy()"
+    - Revert "blk-cgroup: dropping parent refcount after pd_free_fn() is done"
+    - Linux 6.2.4
+
+  * Lunar update: v6.2.3 upstream stable release (LP: #2011425)
+    - HID: asus: use spinlock to protect concurrent accesses
+    - HID: asus: use spinlock to safely schedule workers
+    - iommu/amd: Fix error handling for pdev_pri_ats_enable()
+    - iommu/amd: Skip attach device domain is same as new domain
+    - iommu/amd: Improve page fault error reporting
+    - iommu: Attach device group to old domain in error path
+    - powerpc/mm: Rearrange if-else block to avoid clang warning
+    - ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller"
+    - ARM: OMAP2+: Fix memory leak in realtime_counter_init()
+    - arm64: dts: qcom: qcs404: use symbol names for PCIe resets
+    - arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
+    - arm64: dts: qcom: sm6115: Fix UFS node
+    - arm64: dts: qcom: sm6115: Provide xo clk to rpmcc
+    - arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k
+    - arm64: dts: qcom: pmi8950: Correct rev_1250v channel label to mv
+    - arm64: dts: qcom: sm6350: Fix up the ramoops node
+    - arm64: dts: qcom: sdm670-google-sargo: keep pm660 ldo8 on
+    - arm64: dts: qcom: Re-enable resin on MSM8998 and SDM845 boards
+    - arm64: dts: qcom: sm8350-sagami: Configure SLG51000 PMIC on PDX215
+    - arm64: dts: qcom: sm8350-sagami: Add GPIO line names for PMIC GPIOs
+    - arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys
+    - arm64: dts: qcom: sm6350-lena: Flatten gpio-keys pinctrl state
+    - arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
+    - arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume down)
+    - arm64: dts: imx8m: Align SoC unique ID node unit address
+    - ARM: zynq: Fix refcount leak in zynq_early_slcr_init
+    - fs: dlm: fix return value check in dlm_memory_init()
+    - arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 T-PHY
+    - arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
+    - arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock description
+    - arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock description
+    - arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock description
+    - arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
+    - arm64: dts: qcom: sdm845-xiaomi-beryllium: fix audio codec interrupt pin
+      name
+    - x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC
+    - arm64: dts: qcom: sc7180: correct SPMI bus address cells
+    - arm64: dts: qcom: sc7280: correct SPMI bus address cells
+    - arm64: dts: qcom: sc8280xp: correct SPMI bus address cells
+    - arm64: dts: qcom: sm8450: correct Soundwire wakeup interrupt name
+    - arm64: dts: qcom: sdm845: make DP node follow the schema
+    - arm64: dts: qcom: msm8996-oneplus-common: drop vdda-supply from DSI PHY
+    - arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers
+    - arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node
+    - arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name
+    - arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node names
+    - arm64: dts: meson-gx: Fix Ethernet MAC address unit name
+    - arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
+    - arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
+    - cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*
+    - arm64: dts: ti: k3-am62-main: Fix clocks for McSPI
+    - arm64: tegra: Fix duplicate regulator on Jetson TX1
+    - arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size
+    - arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem
+    - arm64: dts: qcom: msm8956: use SoC-specific compat for tsens
+    - arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
+    - arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
+    - arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
+    - arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
+    - arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
+    - arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
+    - arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
+    - ARM: OMAP1: call platform_device_put() in error case in
+      omap1_dm_timer_init()
+    - arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken
+    - ARM: bcm2835_defconfig: Enable the framebuffer
+    - ARM: s3c: fix s3c64xx_set_timer_source prototype
+    - arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
+    - ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
+    - ARM: imx: Call ida_simple_remove() for ida_simple_get
+    - arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
+    - arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
+    - arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
+    - arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix supply name of USB
+      controller node
+    - arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names
+      property
+    - arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
+    - arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix invalid rtc
+      node name
+    - arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix invalid rtc node
+      name
+    - arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node
+      name
+    - arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
+    - arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names
+    - arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
+    - arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
+    - arm64: dts: amlogic: meson-g12b-odroid-go-ultra: fix rk818 pmic properties
+    - arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip
+    - locking/rwsem: Disable preemption in all down_read*() and up_read() code
+      paths
+    - arm64: tegra: Mark host1x as dma-coherent on Tegra194/234
+    - arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
+    - arm64: dts: meson: radxa-zero: allow usb otg mode
+    - arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
+    - ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
+    - ublk_drv: remove nr_aborted_queues from ublk_device
+    - ublk_drv: don't probe partitions if the ubq daemon isn't trusted
+    - ARM: dts: imx7s: correct iomuxc gpr mux controller cells
+    - sbitmap: remove redundant check in __sbitmap_queue_get_batch
+    - sbitmap: correct wake_batch recalculation to avoid potential IO hung
+    - arm64: dts: mt8195: Fix CPU map for single-cluster SoC
+    - arm64: dts: mt8192: Fix CPU map for single-cluster SoC
+    - arm64: dts: mt8186: Fix CPU map for single-cluster SoC
+    - arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
+    - arm64: dts: mediatek: mt8186: Fix watchdog compatible
+    - arm64: dts: mediatek: mt8195: Fix watchdog compatible
+    - arm64: dts: mediatek: mt7986: Fix watchdog compatible
+    - ARM: dts: stm32: Update part number NVMEM description on stm32mp131
+    - arm64: dts: qcom: sm8450-nagara: Correct firmware paths
+    - blk-mq: avoid sleep in blk_mq_alloc_request_hctx
+    - blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
+    - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
+    - blk-mq: Fix potential io hung for shared sbitmap per tagset
+    - blk-mq: correct stale comment of .get_budget
+    - arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input
+    - arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC
+    - arm64: dts: qcom: sm8350: drop incorrect cells from serial
+    - arm64: dts: qcom: sm8450: drop incorrect cells from serial
+    - arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM
+      and MPSS memory regions
+    - arm64: dts: qcom: msm8953: correct TLMM gpio-ranges
+    - arm64: dts: qcom: sm6115: correct TLMM gpio-ranges
+    - arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators
+    - s390/dasd: Fix potential memleak in dasd_eckd_init()
+    - io_uring,audit: don't log IORING_OP_MADVISE
+    - sched/rt: pick_next_rt_entity(): check list_entry
+    - perf/x86/intel/ds: Fix the conversion from TSC to perf time
+    - x86/perf/zhaoxin: Add stepping check for ZXC
+    - KEYS: asymmetric: Fix ECDSA use via keyctl uapi
+    - block: ublk: check IO buffer based on flag need_get_data
+    - arm64: dts: qcom: pmk8350: Use the correct PON compatible
+    - erofs: relinquish volume with mutex held
+    - block: sync mixed merged request's failfast with 1st bio's
+    - block: Fix io statistics for cgroup in throttle path
+    - block: bio-integrity: Copy flags when bio_integrity_payload is cloned
+    - block: use proper return value from bio_failfast()
+    - wifi: mt76: mt7915: add missing of_node_put()
+    - wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host
+    - wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks
+    - wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_ie_countdown()
+    - wifi: mt76: mt7996: fix insecure data handling of
+      mt7996_mcu_rx_radar_detected()
+    - wifi: mt76: mt7996: fix integer handling issue of mt7996_rf_regval_set()
+    - wifi: mt76: mt7915: check return value before accessing free_block_num
+    - wifi: mt76: mt7996: check return value before accessing free_block_num
+    - wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr()
+    - wifi: mt76: mt7996: drop always true condition of __mt7996_reg_addr()
+    - wifi: mt76: mt7996: fix endianness warning in mt7996_mcu_sta_he_tlv
+    - wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
+    - wifi: mt76: mt7996: fix unintended sign extension of mt7996_hw_queue_read()
+    - wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read()
+    - wifi: mt76: fix coverity uninit_use_in_call in
+      mt76_connac2_reverse_frag0_hdr_trans()
+    - wifi: mt76: mt7921: resource leaks at mt7921_check_offload_capability()
+    - wifi: rsi: Fix memory leak in rsi_coex_attach()
+    - wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: fix memory leak in lbs_init_adapter()
+    - wifi: rtl8xxxu: Fix assignment to bit field priv->pi_enabled
+    - wifi: rtl8xxxu: Fix assignment to bit field priv->cck_agc_report_type
+    - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
+    - wifi: rtw89: 8852c: rfk: correct DACK setting
+    - wifi: rtw89: 8852c: rfk: correct DPK settings
+    - wifi: rtlwifi: Fix global-out-of-bounds bug in
+      _rtl8812ae_phy_set_txpower_limit()
+    - libbpf: Fix single-line struct definition output in btf_dump
+    - libbpf: Fix btf__align_of() by taking into account field offsets
+    - wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
+    - wifi: ipw2200: fix memory leak in ipw_wdev_init()
+    - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
+    - wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()
+    - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
+    - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
+    - wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
+    - libbpf: Fix invalid return address register in s390
+    - crypto: x86/ghash - fix unaligned access in ghash_setkey()
+    - crypto: ux500 - update debug config after ux500 cryp driver removal
+    - ACPICA: Drop port I/O validation for some regions
+    - genirq: Fix the return type of kstat_cpu_irqs_sum()
+    - rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
+    - rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
+    - rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
+    - lib/mpi: Fix buffer overrun when SG is too long
+    - crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
+    - platform/chrome: cros_ec_typec: Update port DP VDO
+    - ACPICA: nsrepair: handle cases without a return value correctly
+    - libbpf: Fix map creation flags sanitization
+    - bpf_doc: Fix build error with older python versions
+    - selftests/xsk: print correct payload for packet dump
+    - selftests/xsk: print correct error codes when exiting
+    - arm64/cpufeature: Fix field sign for DIT hwcap detection
+    - arm64/sysreg: Fix errors in 32 bit enumeration values
+    - kselftest/arm64: Fix syscall-abi for systems without 128 bit SME
+    - workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex
+    - s390/early: fix sclp_early_sccb variable lifetime
+    - s390/vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue()
+    - x86/signal: Fix the value returned by strict_sas_size()
+    - thermal/drivers/tsens: Drop msm8976-specific defines
+    - thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
+    - thermal/drivers/tsens: fix slope values for msm8939
+    - thermal/drivers/tsens: limit num_sensors to 9 for msm8939
+    - wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()
+    - wifi: rtw89: Add missing check for alloc_workqueue
+    - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
+    - wifi: orinoco: check return value of hermes_write_wordrec()
+    - wifi: rtw88: Use rtw_iterate_vifs() for rtw_vif_watch_dog_iter()
+    - wifi: rtw88: Use non-atomic sta iterator in rtw_ra_mask_info_update()
+    - thermal/drivers/imx_sc_thermal: Fix the loop condition
+    - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback
+      function
+    - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
+    - wifi: ath9k: Fix potential stack-out-of-bounds write in
+      ath9k_wmi_rsp_callback()
+    - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
+    - wifi: cfg80211: Fix extended KCK key length check in
+      nl80211_set_rekey_data()
+    - ACPI: battery: Fix missing NUL-termination with large strings
+    - selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m
+    - crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
+    - crypto: essiv - Handle EBUSY correctly
+    - crypto: seqiv - Handle EBUSY correctly
+    - powercap: fix possible name leak in powercap_register_zone()
+    - bpf: Fix state pruning for STACK_DYNPTR stack slots
+    - bpf: Fix missing var_off check for ARG_PTR_TO_DYNPTR
+    - bpf: Fix partial dynptr stack slot reads/writes
+    - x86/microcode: Add a parameter to microcode_check() to store CPU
+      capabilities
+    - x86/microcode: Check CPU capabilities after late microcode update correctly
+    - x86/microcode: Adjust late loading result reporting message
+    - net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action
+    - selftests/bpf: Fix vmtest static compilation error
+    - crypto: xts - Handle EBUSY correctly
+    - leds: led-class: Add missing put_device() to led_put()
+    - drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size
+    - s390/bpf: Add expoline to tail calls
+    - wifi: iwlwifi: mei: fix compilation errors in rfkill()
+    - kselftest/arm64: Fix enumeration of systems without 128 bit SME
+    - can: rcar_canfd: Fix R-Car V3U CAN mode selection
+    - can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses
+    - selftests/bpf: Initialize tc in xdp_synproxy
+    - crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
+    - bpftool: profile online CPUs instead of possible
+    - wifi: mt76: mt7921: fix deadlock in mt7921_abort_roc
+    - wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after
+      init_work
+    - wifi: mt76: mt7915: rework mt7915_mcu_set_thermal_throttling
+    - wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
+    - wifi: mt76: mt7921: fix channel switch fail in monitor mode
+    - wifi: mt76: mt7996: fix chainmask calculation in mt7996_set_antenna()
+    - wifi: mt76: mt7996: update register for CFEND_RATE
+    - wifi: mt76: connac: fix POWER_CTRL command name typo
+    - wifi: mt76: mt7921: fix invalid remain_on_channel duration
+    - wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit
+    - wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit
+    - wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup
+    - wifi: mt76: fix switch default case in mt7996_reverse_frag0_hdr_trans
+    - wifi: mt76: mt7915: fix WED TxS reporting
+    - wifi: mt76: add memory barrier to SDIO queue kick
+    - wifi: mt76: mt7996: rely on mt76_connac2_mac_tx_rate_val
+    - net/mlx5: Enhance debug print in page allocation failure
+    - irqchip: Fix refcount leak in platform_irqchip_probe
+    - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
+    - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
+    - irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
+    - s390/mem_detect: fix detect_memory() error handling
+    - s390/vmem: fix empty page tables cleanup under KASAN
+    - s390/boot: cleanup decompressor header files
+    - s390/mem_detect: rely on diag260() if sclp_early_get_memsize() fails
+    - s390/boot: fix mem_detect extended area allocation
+    - net: add sock_init_data_uid()
+    - tun: tun_chr_open(): correctly initialize socket uid
+    - tap: tap_open(): correctly initialize socket uid
+    - rxrpc: Fix overwaking on call poking
+    - OPP: fix error checking in opp_migrate_dentry()
+    - cpufreq: davinci: Fix clk use after free
+    - Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds
+    - Bluetooth: L2CAP: Fix potential user-after-free
+    - Bluetooth: hci_qca: get wakeup status from serdev device handle
+    - net: ipa: generic command param fix
+    - s390: vfio-ap: tighten the NIB validity check
+    - s390/ap: fix status returned by ap_aqic()
+    - s390/ap: fix status returned by ap_qact()
+    - libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
+    - xen/grant-dma-iommu: Implement a dummy probe_device() callback
+    - rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
+    - crypto: rsa-pkcs1pad - Use akcipher_request_complete
+    - m68k: /proc/hardware should depend on PROC_FS
+    - RISC-V: time: initialize hrtimer based broadcast clock event device
+    - clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first
+      use
+    - wifi: iwl3945: Add missing check for create_singlethread_workqueue
+    - wifi: iwl4965: Add missing check for create_singlethread_workqueue()
+    - wifi: brcmfmac: Rename Cypress 89459 to BCM4355
+    - wifi: brcmfmac: pcie: Add IDs/properties for BCM4355
+    - wifi: brcmfmac: pcie: Add IDs/properties for BCM4377
+    - wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection
+    - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
+    - wifi: rtw89: fix parsing offset for MCC C2H
+    - selftests/bpf: Fix out-of-srctree build
+    - ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
+    - ACPI: resource: Do IRQ override on all TongFang GMxRGxx
+    - crypto: octeontx2 - Fix objects shared between several modules
+    - crypto: crypto4xx - Call dma_unmap_page when done
+    - vfio/ccw: remove WARN_ON during shutdown
+    - wifi: mac80211: move color collision detection report in a delayed work
+    - wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
+    - wifi: mac80211: fix non-MLO station association
+    - wifi: mac80211: Don't translate MLD addresses for multicast
+    - wifi: mac80211: avoid u32_encode_bits() warning
+    - wifi: mac80211: fix off-by-one link setting
+    - tools/lib/thermal: Fix thermal_sampling_exit()
+    - thermal/drivers/hisi: Drop second sensor hi3660
+    - selftests/bpf: Fix map_kptr test.
+    - wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta()
+    - bpf: Zeroing allocated object from slab in bpf memory allocator
+    - selftests/bpf: Fix xdp_do_redirect on s390x
+    - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a
+      bus error
+    - can: esd_usb: Make use of can_change_state() and relocate checking skb for
+      NULL
+    - xsk: check IFF_UP earlier in Tx path
+    - LoongArch, bpf: Use 4 instructions for function address in JIT
+    - bpf: Fix global subprog context argument resolution logic
+    - irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
+    - irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
+    - net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
+    - net/smc: fix application data exception
+    - selftests/net: Interpret UDP_GRO cmsg data as an int value
+    - l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
+    - net: bcmgenet: fix MoCA LED control
+    - net: lan966x: Fix possible deadlock inside PTP
+    - net/mlx4_en: Introduce flexible array to silence overflow warning
+    - net/mlx5e: Align IPsec ASO result memory to be as required by hardware
+    - selftest: fib_tests: Always cleanup before exit
+    - sefltests: netdevsim: wait for devlink instance after netns removal
+    - drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
+    - drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
+    - drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec
+    - drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC
+    - drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
+    - drm/bridge: megachips: Fix error handling in i2c_register_driver()
+    - drm/vkms: Fix memory leak in vkms_init()
+    - drm/vkms: Fix null-ptr-deref in vkms_release()
+    - drm/modes: Use strscpy() to copy command-line mode name
+    - drm/vc4: dpi: Fix format mapping for RGB565
+    - drm/bridge: it6505: Guard bridge power in IRQ handler
+    - drm: tidss: Fix pixel format definition
+    - gpu: ipu-v3: common: Add of_node_put() for reference returned by
+      of_graph_get_port_by_id()
+    - drm/ast: Init iosys_map pointer as I/O memory for damage handling
+    - drm/vc4: drop all currently held locks if deadlock happens
+    - hwmon: (ftsteutates) Fix scaling of measurements
+    - drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()
+    - drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
+    - pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
+    - pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
+    - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
+    - drm/vc4: hvs: Configure the HVS COB allocations
+    - drm/vc4: hvs: Set AXI panic modes
+    - drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4
+    - drm/vc4: hvs: Correct interrupt masking bit assignment for HVS5
+    - drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
+    - drm/vc4: hdmi: Correct interlaced timings again
+    - drm/msm: clean event_thread->worker in case of an error
+    - drm/panel-edp: fix name for IVO product id 854b
+    - scsi: qla2xxx: Fix exchange oversubscription
+    - scsi: qla2xxx: Fix exchange oversubscription for management commands
+    - scsi: qla2xxx: edif: Fix clang warning
+    - ASoC: fsl_sai: initialize is_dsp_mode flag
+    - drm/bridge: tc358767: Set default CLRSIPO count
+    - drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
+    - ALSA: hda/ca0132: minor fix for allocation size
+    - drm/amdgpu: Use the sched from entity for amdgpu_cs trace
+    - drm/msm/gem: Add check for kmalloc
+    - drm/msm/dpu: Disallow unallocated resources to be returned
+    - drm/bridge: lt9611: fix sleep mode setup
+    - drm/bridge: lt9611: fix HPD reenablement
+    - drm/bridge: lt9611: fix polarity programming
+    - drm/bridge: lt9611: fix programming of video modes
+    - drm/bridge: lt9611: fix clock calculation
+    - drm/bridge: lt9611: pass a pointer to the of node
+    - regulator: tps65219: use IS_ERR() to detect an error pointer
+    - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
+    - drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
+    - drm/msm/dsi: Allow 2 CTRLs on v2.5.0
+    - scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096
+    - drm/msm/dpu: sc7180: add missing WB2 clock control
+    - drm/msm: use strscpy instead of strncpy
+    - drm/msm/dpu: Add check for cstate
+    - drm/msm/dpu: Add check for pstates
+    - drm/msm/mdp5: Add check for kzalloc
+    - habanalabs: bugs fixes in timestamps buff alloc
+    - pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
+    - pinctrl: mediatek: Initialize variable pullen and pullup to zero
+    - pinctrl: mediatek: Initialize variable *buf to zero
+    - gpu: host1x: Fix mask for syncpoint increment register
+    - gpu: host1x: Don't skip assigning syncpoints to channels
+    - drm/tegra: firewall: Check for is_addr_reg existence in IMM check
+    - drm/i915/mtl: Add initial gt workarounds
+    - drm/i915/xehp: GAM registers don't need to be re-applied on engine resets
+    - pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as interrupts
+    - drm/i915/xehp: Annotate a couple more workaround registers as MCR
+    - drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update()
+    - drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
+    - drm/mediatek: Use NULL instead of 0 for NULL pointer
+    - drm/mediatek: Drop unbalanced obj unref
+    - drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
+    - drm/mediatek: Clean dangling pointer on bind error path
+    - ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
+    - dt-bindings: display: mediatek: Fix the fallback for mediatek,mt8186-disp-
+      ccorr
+    - gpio: pca9570: rename platform_data to chip_data
+    - gpio: vf610: connect GPIO label to dev name
+    - ASoC: topology: Properly access value coming from topology file
+    - spi: dw_bt1: fix MUX_MMIO dependencies
+    - ASoC: mchp-spdifrx: fix controls which rely on rsr register
+    - ASoC: mchp-spdifrx: fix return value in case completion times out
+    - ASoC: mchp-spdifrx: fix controls that works with completion mechanism
+    - ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
+    - dm: improve shrinker debug names
+    - regmap: apply reg_base and reg_downshift for single register ops
+    - accel: fix CONFIG_DRM dependencies
+    - ASoC: rsnd: fixup #endif position
+    - ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
+    - ASoC: dt-bindings: meson: fix gx-card codec node regex
+    - regulator: tps65219: use generic set_bypass()
+    - hwmon: (asus-ec-sensors) add missing mutex path
+    - hwmon: (ltc2945) Handle error case in ltc2945_value_store
+    - ALSA: hda: Fix the control element identification for multiple codecs
+    - drm/amdgpu: fix enum odm_combine_mode mismatch
+    - scsi: mpt3sas: Fix a memory leak
+    - scsi: aic94xx: Add missing check for dma_map_single()
+    - HID: multitouch: Add quirks for flipped axes
+    - HID: retain initial quirks set up when creating HID devices
+    - ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared
+    - ASoC: qcom: q6apm-dai: fix race condition while updating the position
+      pointer
+    - ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag
+    - ASoC: codecs: lpass: register mclk after runtime pm
+    - ASoC: codecs: lpass: fix incorrect mclk rate
+    - drm/amd/display: don't call dc_interrupt_set() for disabled crtcs
+    - HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support
+    - spi: bcm63xx-hsspi: Fix multi-bit mode setting
+    - hwmon: (mlxreg-fan) Return zero speed for broken fan
+    - ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
+    - dm: remove flush_scheduled_work() during local_exit()
+    - nfs4trace: fix state manager flag printing
+    - NFS: fix disabling of swap
+    - drm/i915/pvc: Implement recommended caching policy
+    - drm/i915/pvc: Annotate two more workaround/tuning registers as MCR
+    - drm/i915: Fix GEN8_MISCCPCTL
+    - spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
+    - ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
+    - HID: bigben: use spinlock to protect concurrent accesses
+    - HID: bigben_worker() remove unneeded check on report_field
+    - HID: bigben: use spinlock to safely schedule workers
+    - hid: bigben_probe(): validate report count
+    - ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks
+    - drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
+    - NFSD: enhance inter-server copy cleanup
+    - NFSD: fix leaked reference count of nfsd4_ssc_umount_item
+    - nfsd: fix race to check ls_layouts
+    - nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
+    - NFSD: fix problems with cleanup on errors in nfsd4_copy
+    - nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open
+    - nfsd: don't fsync nfsd_files on last close
+    - NFSD: copy the whole verifier in nfsd_copy_write_verifier
+    - cifs: Fix lost destroy smbd connection when MR allocate failed
+    - cifs: Fix warning and UAF when destroy the MR list
+    - cifs: use tcon allocation functions even for dummy tcon
+    - gfs2: jdata writepage fix
+    - perf llvm: Fix inadvertent file creation
+    - leds: led-core: Fix refcount leak in of_led_get()
+    - leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest()
+    - leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing driver
+    - tools/tracing/rtla: osnoise_hist: use total duration for average calculation
+    - perf inject: Use perf_data__read() for auxtrace
+    - perf intel-pt: Do not try to queue auxtrace data on pipe
+    - perf stat: Hide invalid uncore event output for aggr mode
+    - perf jevents: Correct bad character encoding
+    - perf test bpf: Skip test if kernel-debuginfo is not present
+    - perf tools: Fix auto-complete on aarch64
+    - perf stat: Avoid merging/aggregating metric counts twice
+    - sparc: allow PM configs for sparc32 COMPILE_TEST
+    - selftests: find echo binary to use -ne options
+    - selftests/ftrace: Fix bash specific "==" operator
+    - selftests: use printf instead of echo -ne
+    - perf record: Fix segfault with --overwrite and --max-size
+    - printf: fix errname.c list
+    - perf tests stat_all_metrics: Change true workload to sleep workload for
+      system wide check
+    - objtool: add UACCESS exceptions for __tsan_volatile_read/write
+    - selftests/ftrace: Fix probepoint testcase to ignore __pfx_* symbols
+    - sysctl: fix proc_dobool() usability
+    - mfd: rk808: Re-add rk808-clkout to RK818
+    - mfd: cs5535: Don't build on UML
+    - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
+    - dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
+    - RDMA/erdma: Fix refcount leak in erdma_mmap
+    - dmaengine: HISI_DMA should depend on ARCH_HISI
+    - RDMA/hns: Fix refcount leak in hns_roce_mmap
+    - iio: light: tsl2563: Do not hardcode interrupt trigger type
+    - usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe()
+    - i2c: designware: fix i2c_dw_clk_rate() return size to be u32
+    - i2c: qcom-geni: change i2c_master_hub to static
+    - soundwire: cadence: Don't overflow the command FIFOs
+    - driver core: fix potential null-ptr-deref in device_add()
+    - kobject: Fix slab-out-of-bounds in fill_kobj_path()
+    - alpha/boot/tools/objstrip: fix the check for ELF header
+    - media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
+    - media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU
+    - media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX
+    - media: uvcvideo: Refactor power_line_frequency_controls_limited
+    - coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
+    - coresight: cti: Prevent negative values of enable count
+    - coresight: cti: Add PM runtime call in enable_store
+    - usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count
+    - PCI/IOV: Enlarge virtfn sysfs name buffer
+    - PCI: switchtec: Return -EFAULT for copy_to_user() errors
+    - PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws kernel-doc
+    - hwtracing: hisi_ptt: Only add the supported devices to the filters list
+    - tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
+    - tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown()
+    - serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init()
+    - Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in
+      set_protocol"
+    - eeprom: idt_89hpesx: Fix error handling in idt_init()
+    - applicom: Fix PCI device refcount leak in applicom_init()
+    - firmware: stratix10-svc: add missing gen_pool_destroy() in
+      stratix10_svc_drv_probe()
+    - firmware: stratix10-svc: fix error handle while alloc/add device failed
+    - VMCI: check context->notify_page after call to get_user_pages_fast() to
+      avoid GPF
+    - mei: pxp: Use correct macros to initialize uuid_le
+    - misc/mei/hdcp: Use correct macros to initialize uuid_le
+    - misc: fastrpc: Fix an error handling path in fastrpc_rpmsg_probe()
+    - iommu/exynos: Fix error handling in exynos_iommu_init()
+    - driver core: fix resource leak in device_add()
+    - driver core: location: Free struct acpi_pld_info *pld before return false
+    - drivers: base: transport_class: fix possible memory leak
+    - drivers: base: transport_class: fix resource leak when
+      transport_add_device() fails
+    - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
+    - selftests: iommu: Fix test_cmd_destroy_access() call in user_copy
+    - iommufd: Add three missing structures in ucmd_buffer
+    - fotg210-udc: Add missing completion handler
+    - dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers
+    - fpga: microchip-spi: move SPI I/O buffers out of stack
+    - fpga: microchip-spi: rewrite status polling in a time measurable way
+    - usb: early: xhci-dbc: Fix a potential out-of-bound memory access
+    - tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case
+    - RDMA/cxgb4: add null-ptr-check after ip_dev_find()
+    - usb: musb: mediatek: don't unregister something that wasn't registered
+    - usb: gadget: configfs: Restrict symlink creation is UDC already binded
+    - phy: mediatek: remove temporary variable @mask_
+    - PCI: mt7621: Delay phy ports initialization
+    - iommu/vt-d: Set No Execute Enable bit in PASID table entry
+    - power: supply: remove faulty cooling logic
+    - RDMA/siw: Fix user page pinning accounting
+    - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
+    - usb: max-3421: Fix setting of I/O pins
+    - RDMA/irdma: Cap MSIX used to online CPUs + 1
+    - serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
+    - tty: serial: imx: disable Ageing Timer interrupt request irq
+    - driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
+    - driver core: fw_devlink: Don't purge child fwnode's consumer links
+    - driver core: fw_devlink: Allow marking a fwnode link as being part of a
+      cycle
+    - driver core: fw_devlink: Consolidate device link flag computation
+    - driver core: fw_devlink: Improve check for fwnode with no device/driver
+    - driver core: fw_devlink: Make cycle detection more robust
+    - mtd: mtdpart: Don't create platform device that'll never probe
+    - usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev
+    - dmaengine: dw-edma: Fix readq_ch() return value truncation
+    - PCI: Fix dropping valid root bus resources with .end = zero
+    - phy: rockchip-typec: fix tcphy_get_mode error case
+    - PCI: qcom: Fix host-init error handling
+    - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
+    - iommu: Fix error unwind in iommu_group_alloc()
+    - iommu/amd: Do not identity map v2 capable device when snp is enabled
+    - dmaengine: sf-pdma: pdma_desc memory leak fix
+    - dmaengine: dw-axi-dmac: Do not dereference NULL structure
+    - dmaengine: ptdma: check for null desc before calling pt_cmd_callback
+    - iommu/vt-d: Fix error handling in sva enable/disable paths
+    - iommu/vt-d: Allow to use flush-queue when first level is default
+    - RDMA/rxe: Cleanup mr_check_range
+    - RDMA/rxe: Move rxe_map_mr_sg to rxe_mr.c
+    - RDMA-rxe: Isolate mr code from atomic_reply()
+    - RDMA-rxe: Isolate mr code from atomic_write_reply()
+    - RDMA/rxe: Cleanup page variables in rxe_mr.c
+    - RDMA/rxe: Replace rxe_map and rxe_phys_buf by xarray
+    - Subject: RDMA/rxe: Handle zero length rdma
+    - RDMA/mana_ib: Fix a bug when the PF indicates more entries for registering
+      memory on first packet
+    - RDMA/rxe: Fix missing memory barriers in rxe_queue.h
+    - IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
+    - IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
+    - Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after
+      use"
+    - remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
+    - media: ti: cal: fix possible memory leak in cal_ctx_create()
+    - media: platform: ti: Add missing check for devm_regulator_get
+    - media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in
+      imx7_csi_init()
+    - powerpc: Remove linker flag from KBUILD_AFLAGS
+    - s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64
+    - builddeb: clean generated package content
+    - media: max9286: Fix memleak in max9286_v4l2_register()
+    - media: ov2740: Fix memleak in ov2740_init_controls()
+    - media: ov5675: Fix memleak in ov5675_init_controls()
+    - media: i2c: tc358746: fix missing return assignment
+    - media: i2c: tc358746: fix ignoring read error in g_register callback
+    - media: i2c: tc358746: fix possible endianness issue
+    - media: ov5640: Fix soft reset sequence and timings
+    - media: ov5640: Handle delays when no reset_gpio set
+    - media: mc: Get media_device directly from pad
+    - media: i2c: ov772x: Fix memleak in ov772x_probe()
+    - media: i2c: imx219: Split common registers from mode tables
+    - media: i2c: imx219: Fix binning for RAW8 capture
+    - media: platform: mtk-mdp3: Fix return value check in mdp_probe()
+    - media: camss: csiphy-3ph: avoid undefined behavior
+    - media: platform: mtk-mdp3: fix Kconfig dependencies
+    - media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
+    - media: v4l2-jpeg: ignore the unknown APP14 marker
+    - media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399
+    - media: imx-jpeg: Apply clk_bulk api instead of operating specific clk
+    - media: amphion: correct the unspecified color space
+    - media: drivers/media/v4l2-core/v4l2-h264 : add detection of null pointers
+    - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
+    - media: atomisp: fix videobuf2 Kconfig depenendency
+    - media: atomisp: Only set default_run_mode on first open of a stream/asd
+    - media: i2c: ov7670: 0 instead of -EINVAL was returned
+    - media: usb: siano: Fix use after free bugs caused by do_submit_urb
+    - media: saa7134: Use video_unregister_device for radio_dev
+    - rpmsg: glink: Avoid infinite loop on intent for missing channel
+    - rpmsg: glink: Release driver_override
+    - ARM: OMAP2+: omap4-common: Fix refcount leak bug
+    - arm64: dts: qcom: msm8996: Add additional A2NoC clocks
+    - udf: Define EFSCORRUPTED error code
+    - context_tracking: Fix noinstr vs KASAN
+    - exit: Detect and fix irq disabled state in oops
+    - ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
+    - fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
+    - blk-iocost: fix divide by 0 error in calc_lcoefs()
+    - blk-cgroup: dropping parent refcount after pd_free_fn() is done
+    - blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and
+      blkcg_deactivate_policy()
+    - trace/blktrace: fix memory leak with using debugfs_lookup()
+    - btrfs: scrub: improve tree block error reporting
+    - arm64: zynqmp: Enable hs termination flag for USB dwc3 controller
+    - cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE
+    - x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads
+    - cpuidle: drivers: firmware: psci: Dont instrument suspend code
+    - cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG
+    - perf/x86/intel/uncore: Add Meteor Lake support
+    - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
+    - wifi: ath11k: fix monitor mode bringup crash
+    - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
+    - rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
+    - rcu: Suppress smp_processor_id() complaint in
+      synchronize_rcu_expedited_wait()
+    - srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
+    - rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
+    - rcu-tasks: Handle queue-shrink/callback-enqueue race condition
+    - wifi: ath11k: debugfs: fix to work with multiple PCI devices
+    - thermal: intel: Fix unsigned comparison with less than zero
+    - timers: Prevent union confusion from unexpected restart_syscall()
+    - x86/bugs: Reset speculation control settings on init
+    - bpftool: Always disable stack protection for BPF objects
+    - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-
+      of-bounds
+    - wifi: rtw89: fix assignation of TX BD RAM table
+    - wifi: mt7601u: fix an integer underflow
+    - inet: fix fast path in __inet_hash_connect()
+    - ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
+    - ice: add missing checks for PF vsi type
+    - Compiler attributes: GCC cold function alignment workarounds
+    - ACPI: Don't build ACPICA with '-Os'
+    - bpf, docs: Fix modulo zero, division by zero, overflow, and underflow
+    - thermal: intel: intel_pch: Add support for Wellsburg PCH
+    - clocksource: Suspend the watchdog temporarily when high read latency
+      detected
+    - crypto: hisilicon: Wipe entire pool on error
+    - net: bcmgenet: Add a check for oversized packets
+    - m68k: Check syscall_trace_enter() return code
+    - s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping
+    - netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
+    - can: isotp: check CAN address family in isotp_bind()
+    - gcc-plugins: drop -std=gnu++11 to fix GCC 13 build
+    - tools/power/x86/intel-speed-select: Add Emerald Rapid quirk
+    - platform/x86: dell-ddv: Add support for interface version 3
+    - wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
+    - ACPI: video: Fix Lenovo Ideapad Z570 DMI match
+    - net/mlx5: fw_tracer: Fix debug print
+    - coda: Avoid partial allocation of sig_inputArgs
+    - uaccess: Add minimum bounds check on kernel buffer size
+    - s390/idle: mark arch_cpu_idle() noinstr
+    - time/debug: Fix memory leak with using debugfs_lookup()
+    - PM: domains: fix memory leak with using debugfs_lookup()
+    - PM: EM: fix memory leak with using debugfs_lookup()
+    - Bluetooth: Fix issue with Actions Semi ATS2851 based devices
+    - Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921
+    - Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
+    - wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30
+    - hv_netvsc: Check status in SEND_RNDIS_PKT completion message
+    - s390/kfence: fix page fault reporting
+    - devlink: Fix TP_STRUCT_entry in trace of devlink health report
+    - scm: add user copy checks to put_cmsg()
+    - drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F
+    - drm: panel-orientation-quirks: Add quirk for DynaBook K50
+    - drm/amd/display: Reduce expected sdp bandwidth for dcn321
+    - drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h
+      write
+    - drm/amd/display: Fix potential null-deref in dm_resume
+    - drm/omap: dsi: Fix excessive stack usage
+    - HID: Add Mapping for System Microphone Mute
+    - drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
+    - drm/amd/display: Defer DIG FIFO disable after VID stream enable
+    - drm/radeon: free iio for atombios when driver shutdown
+    - drm/amd: Avoid BUG() for case of SRIOV missing IP version
+    - drm/amdkfd: Page aligned memory reserve size
+    - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
+    - Revert "fbcon: don't lose the console font across generic->chip driver
+      switch"
+    - drm/amd: Avoid ASSERT for some message failures
+    - drm: amd: display: Fix memory leakage
+    - drm/amd/display: fix mapping to non-allocated address
+    - HID: uclogic: Add frame type quirk
+    - HID: uclogic: Add battery quirk
+    - HID: uclogic: Add support for XP-PEN Deco Pro SW
+    - HID: uclogic: Add support for XP-PEN Deco Pro MW
+    - drm/msm/dsi: Add missing check for alloc_ordered_workqueue
+    - drm: rcar-du: Add quirk for H3 ES1.x pclk workaround
+    - drm: rcar-du: Fix setting a reserved bit in DPLLCR
+    - drm/drm_print: correct format problem
+    - drm/amd/display: Set hvm_enabled flag for S/G mode
+    - drm/client: Test for connectors before sending hotplug event
+    - habanalabs: extend fatal messages to contain PCI info
+    - habanalabs: fix bug in timestamps registration code
+    - docs/scripts/gdb: add necessary make scripts_gdb step
+    - drm/msm/dpu: Add DSC hardware blocks to register snapshot
+    - ASoC: soc-compress: Reposition and add pcm_mutex
+    - ASoC: kirkwood: Iterate over array indexes instead of using pointer math
+    - regulator: max77802: Bounds check regulator id against opmode
+    - regulator: s5m8767: Bounds check id indexing into arrays
+    - Revert "drm/amdgpu: TA unload messages are not actually sent to psp when
+      amdgpu is uninstalled"
+    - drm/amd/display: fix FCLK pstate change underflow
+    - gfs2: Improve gfs2_make_fs_rw error handling
+    - hwmon: (coretemp) Simplify platform device handling
+    - hwmon: (nct6775) Directly call ASUS ACPI WMI method
+    - hwmon: (nct6775) B650/B660/X670 ASUS boards support
+    - pinctrl: at91: use devm_kasprintf() to avoid potential leaks
+    - drm/amd/display: Do not commit pipe when updating DRR
+    - scsi: snic: Fix memory leak with using debugfs_lookup()
+    - scsi: ufs: core: Fix device management cmd timeout flow
+    - HID: logitech-hidpp: Don't restart communication if not necessary
+    - drm/amd/display: Enable P-state validation checks for DCN314
+    - drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
+    - drm/amd/display: Disable HUBP/DPP PG on DCN314 for now
+    - drm/amd/display: disable SubVP + DRR to prevent underflow
+    - dm thin: add cond_resched() to various workqueue loops
+    - dm cache: add cond_resched() to various workqueue loops
+    - nfsd: zero out pointers after putting nfsd_files on COPY setup error
+    - nfsd: don't hand out delegation on setuid files being opened for write
+    - cifs: prevent data race in smb2_reconnect()
+    - drm/i915/mtl: Correct implementation of Wa_18018781329
+    - drm/shmem-helper: Revert accidental non-GPL export
+    - driver core: fw_devlink: Avoid spurious error message
+    - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
+    - firmware: coreboot: framebuffer: Ignore reserved pixel color bits
+    - block: don't allow multiple bios for IOCB_NOWAIT issue
+    - block: clear bio->bi_bdev when putting a bio back in the cache
+    - block: be a bit more careful in checking for NULL bdev while polling
+    - rtc: pm8xxx: fix set-alarm race
+    - ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms'
+    - ipmi:ssif: resend_msg() cannot fail
+    - ipmi_ssif: Rename idle state and check
+    - ipmi:ssif: Add a timer between request retries
+    - io_uring: Replace 0-length array with flexible array
+    - io_uring: use user visible tail in io_uring_poll()
+    - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
+    - io_uring: add a conditional reschedule to the IOPOLL cancelation loop
+    - io_uring: add reschedule point to handle_tw_list()
+    - io_uring/rsrc: disallow multi-source reg buffers
+    - io_uring: remove MSG_NOSIGNAL from recvmsg
+    - io_uring/poll: allow some retries for poll triggering spuriously
+    - io_uring: fix fget leak when fs don't support nowait buffered read
+    - s390/extmem: return correct segment type in __segment_load()
+    - s390: discard .interp section
+    - s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
+    - s390/kprobes: fix current_kprobe never cleared after kprobes reenter
+    - KVM: s390: disable migration mode when dirty tracking is disabled
+    - cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID
+    - cifs: Fix uninitialized memory read in smb3_qfs_tcon()
+    - cifs: Fix uninitialized memory reads for oparms.mode
+    - cifs: fix mount on old smb servers
+    - cifs: introduce cifs_io_parms in smb2_async_writev()
+    - cifs: split out smb3_use_rdma_offload() helper
+    - cifs: don't try to use rdma offload on encrypted connections
+    - cifs: Check the lease context if we actually got a lease
+    - cifs: return a single-use cfid if we did not get a lease
+    - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization
+    - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()
+    - scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi
+    - btrfs: hold block group refcount during async discard
+    - btrfs: sysfs: update fs features directory asynchronously
+    - locking/rwsem: Prevent non-first waiter from spinning in down_write()
+      slowpath
+    - ksmbd: fix wrong data area length for smb2 lock request
+    - ksmbd: do not allow the actual frame length to be smaller than the rfc1002
+      length
+    - ksmbd: fix possible memory leak in smb2_lock()
+    - torture: Fix hang during kthread shutdown phase
+    - ARM: dts: exynos: correct HDMI phy compatible in Exynos4
+    - io_uring: mark task TASK_RUNNING before handling resume/task work
+    - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
+    - fs: hfsplus: fix UAF issue in hfsplus_put_super
+    - exfat: fix reporting fs error when reading dir beyond EOF
+    - exfat: fix unexpected EOF while reading dir
+    - exfat: redefine DIR_DELETED as the bad cluster number
+    - exfat: fix inode->i_blocks for non-512 byte sector size device
+    - fs: dlm: start midcomms before scand
+    - fs: dlm: fix use after free in midcomms commit
+    - fs: dlm: be sure to call dlm_send_queue_flush()
+    - fs: dlm: fix race setting stop tx flag
+    - fs: dlm: don't set stop rx flag after node reset
+    - fs: dlm: move sending fin message into state change handling
+    - fs: dlm: send FIN ack back in right cases
+    - f2fs: fix information leak in f2fs_move_inline_dirents()
+    - f2fs: retry to update the inode page given data corruption
+    - f2fs: fix cgroup writeback accounting with fs-layer encryption
+    - f2fs: fix kernel crash due to null io->bio
+    - f2fs: Revert "f2fs: truncate blocks in batch in __complete_revoke_list()"
+    - ocfs2: fix defrag path triggering jbd2 ASSERT
+    - ocfs2: fix non-auto defrag path not working issue
+    - fs/cramfs/inode.c: initialize file_ra_state
+    - selftests/landlock: Skip overlayfs tests when not supported
+    - selftests/landlock: Test ptrace as much as possible with Yama
+    - udf: Truncate added extents on failed expansion
+    - udf: Do not bother merging very long extents
+    - udf: Do not update file length for failed writes to inline files
+    - udf: Preserve link count of system files
+    - udf: Detect system inodes linked into directory hierarchy
+    - udf: Fix file corruption when appending just after end of preallocated
+      extent
+    - md: don't update recovery_cp when curr_resync is ACTIVE
+    - KVM: Destroy target device if coalesced MMIO unregistration fails
+    - KVM: VMX: Fix crash due to uninitialized current_vmcs
+    - KVM: Register /dev/kvm as the _very_ last thing during initialization
+    - KVM: x86: Purge "highest ISR" cache when updating APICv state
+    - KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps
+    - KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is disabled
+    - KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID
+    - KVM: SVM: Flush the "current" TLB when activating AVIC
+    - KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target
+    - KVM: SVM: Don't put/load AVIC when setting virtual APIC mode
+    - KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
+    - KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32
+    - KVM: SVM: Fix potential overflow in SEV's send|receive_update_data()
+    - KVM: SVM: hyper-v: placate modpost section mismatch error
+    - selftests: x86: Fix incorrect kernel headers search path
+    - x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
+    - x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
+    - x86/reboot: Disable virtualization in an emergency if SVM is supported
+    - x86/reboot: Disable SVM, not just VMX, when stopping CPUs
+    - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
+    - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe
+      range
+    - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
+    - x86/microcode/AMD: Add a @cpu parameter to the reloading functions
+    - x86/microcode/AMD: Fix mixed steppings support
+    - x86/speculation: Allow enabling STIBP with legacy IBRS
+    - Documentation/hw-vuln: Document the interaction between IBRS and STIBP
+    - virt/sev-guest: Return -EIO if certificate buffer is not large enough
+    - brd: mark as nowait compatible
+    - brd: return 0/-error from brd_insert_page()
+    - brd: check for REQ_NOWAIT and set correct page allocation mask
+    - ima: fix error handling logic when file measurement failed
+    - ima: Align ima_file_mmap() parameters with mmap_file LSM hook
+    - selftests/powerpc: Fix incorrect kernel headers search path
+    - selftests/ftrace: Fix eprobe syntax test case to check filter support
+    - selftests: sched: Fix incorrect kernel headers search path
+    - selftests: core: Fix incorrect kernel headers search path
+    - selftests: pid_namespace: Fix incorrect kernel headers search path
+    - selftests: arm64: Fix incorrect kernel headers search path
+    - selftests: clone3: Fix incorrect kernel headers search path
+    - selftests: pidfd: Fix incorrect kernel headers search path
+    - selftests: membarrier: Fix incorrect kernel headers search path
+    - selftests: kcmp: Fix incorrect kernel headers search path
+    - selftests: media_tests: Fix incorrect kernel headers search path
+    - selftests: gpio: Fix incorrect kernel headers search path
+    - selftests: filesystems: Fix incorrect kernel headers search path
+    - selftests: user_events: Fix incorrect kernel headers search path
+    - selftests: ptp: Fix incorrect kernel headers search path
+    - selftests: sync: Fix incorrect kernel headers search path
+    - selftests: rseq: Fix incorrect kernel headers search path
+    - selftests: move_mount_set_group: Fix incorrect kernel headers search path
+    - selftests: mount_setattr: Fix incorrect kernel headers search path
+    - selftests: perf_events: Fix incorrect kernel headers search path
+    - selftests: ipc: Fix incorrect kernel headers search path
+    - selftests: futex: Fix incorrect kernel headers search path
+    - selftests: drivers: Fix incorrect kernel headers search path
+    - selftests: dmabuf-heaps: Fix incorrect kernel headers search path
+    - selftests: vm: Fix incorrect kernel headers search path
+    - selftests: seccomp: Fix incorrect kernel headers search path
+    - irqdomain: Fix association race
+    - irqdomain: Fix disassociation race
+    - irqdomain: Look for existing mapping only once
+    - irqdomain: Drop bogus fwspec-mapping error handling
+    - irqdomain: Refactor __irq_domain_alloc_irqs()
+    - irqdomain: Fix mapping-creation race
+    - irqdomain: Fix domain registration race
+    - crypto: qat - fix out-of-bounds read
+    - mm/damon/paddr: fix missing folio_put()
+    - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
+    - ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
+    - jbd2: fix data missing when reusing bh which is ready to be checkpointed
+    - ext4: optimize ea_inode block expansion
+    - ext4: refuse to create ea block when umounted
+    - cxl/pmem: Fix nvdimm registration races
+    - Input: exc3000 - properly stop timer on shutdown
+    - mtd: spi-nor: sfdp: Fix index value for SCCR dwords
+    - mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
+    - dm: send just one event on resize, not two
+    - dm: add cond_resched() to dm_wq_work()
+    - dm: add cond_resched() to dm_wq_requeue_work()
+    - wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice
+    - wifi: rtl8xxxu: Use a longer retry limit of 48
+    - wifi: ath11k: allow system suspend to survive ath11k
+    - wifi: cfg80211: Fix use after free for wext
+    - wifi: cfg80211: Set SSID if it is not already set
+    - cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies
+    - qede: fix interrupt coalescing configuration
+    - thermal: intel: powerclamp: Fix cur_state for multi package system
+    - dm flakey: fix logic when corrupting a bio
+    - dm cache: free background tracker's queued work in btracker_destroy
+    - dm flakey: don't corrupt the zero page
+    - dm flakey: fix a bug with 32-bit highmem systems
+    - hwmon: (peci/cputemp) Fix off-by-one in coretemp_label allocation
+    - hwmon: (nct6775) Fix incorrect parenthesization in nct6775_write_fan_div()
+    - spi: intel: Check number of chip selects after reading the descriptor
+    - ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for IOMMU node
+    - ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node
+    - ARM: dts: exynos: correct TMU phandle in Exynos4210
+    - ARM: dts: exynos: correct TMU phandle in Exynos4
+    - ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
+    - ARM: dts: exynos: correct TMU phandle in Exynos5250
+    - ARM: dts: exynos: correct TMU phandle in Odroid XU
+    - ARM: dts: exynos: correct TMU phandle in Odroid HC1
+    - arm64: acpi: Fix possible memory leak of ffh_ctxt
+    - arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP
+    - arm64: Reset KASAN tag in copy_highpage with HW tags only
+    - fuse: add inode/permission checks to fileattr_get/fileattr_set
+    - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
+    - ceph: update the time stamps and try to drop the suid/sgid
+    - regulator: core: Use ktime_get_boottime() to determine how long a regulator
+      was off
+    - panic: fix the panic_print NMI backtrace setting
+    - mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON
+    - genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced
+    - genirq/msi: Take the per-device MSI lock before validating the control
+      structure
+    - spi: spi-sn-f-ospi: fix duplicate flag while assigning to mode_bits
+    - alpha: fix FEN fault handling
+    - dax/kmem: Fix leak of memory-hotplug resources
+    - mips: fix syscall_get_nr
+    - media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
+    - remoteproc/mtk_scp: Move clk ops outside send_lock
+    - vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd
+    - docs: gdbmacros: print newest record
+    - mm: memcontrol: deprecate charge moving
+    - mm/thp: check and bail out if page in deferred queue already
+    - ktest.pl: Give back console on Ctrt^C on monitor
+    - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
+    - ktest.pl: Fix missing "end_monitor" when machine check fails
+    - ktest.pl: Add RUN_TIMEOUT option with default unlimited
+    - memory tier: release the new_memtier in find_create_memory_tier()
+    - ring-buffer: Handle race between rb_move_tail and rb_check_pages
+    - tools/bootconfig: fix single & used for logical condition
+    - tracing/eprobe: Fix to add filter on eprobe description in README file
+    - iommu/amd: Add a length limitation for the ivrs_acpihid command-line
+      parameter
+    - scsi: aacraid: Allocate cmd_priv with scsicmd
+    - scsi: qla2xxx: Fix link failure in NPIV environment
+    - scsi: qla2xxx: Check if port is online before sending ELS
+    - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
+    - scsi: qla2xxx: Remove unintended flag clearing
+    - scsi: qla2xxx: Fix erroneous link down
+    - scsi: qla2xxx: Remove increment of interface err cnt
+    - scsi: ses: Don't attach if enclosure has no components
+    - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
+    - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
+    - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
+    - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
+    - RISC-V: add a spin_shadow_stack declaration
+    - riscv: Avoid enabling interrupts in die()
+    - riscv: mm: fix regression due to update_mmu_cache change
+    - riscv: jump_label: Fixup unaligned arch_static_branch function
+    - riscv: ftrace: Fixup panic by disabling preemption
+    - riscv, mm: Perform BPF exhandler fixup on page fault
+    - riscv: ftrace: Remove wasted nops for !RISCV_ISA_C
+    - riscv: ftrace: Reduce the detour code size to half
+    - MIPS: DTS: CI20: fix otg power gpio
+    - PCI/PM: Observe reset delay irrespective of bridge_d3
+    - PCI: Unify delay handling for reset and resume
+    - PCI: hotplug: Allow marking devices as disconnected during bind/unbind
+    - PCI: Avoid FLR for AMD FCH AHCI adapters
+    - PCI/DPC: Await readiness of secondary bus after reset
+    - bus: mhi: ep: Only send -ENOTCONN status if client driver is available
+    - bus: mhi: ep: Move chan->lock to the start of processing queued ch ring
+    - bus: mhi: ep: Save channel state locally during suspend and resume
+    - iommufd: Make sure to zero vfio_iommu_type1_info before copying to user
+    - iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
+    - iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode
+    - iommu/vt-d: Fix PASID directory pointer coherency
+    - vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR
+    - vfio/type1: prevent underflow of locked_vm via exec()
+    - vfio/type1: track locked_vm per dma
+    - vfio/type1: restore locked_vm
+    - drm/amd: Fix initialization for nbio 7.5.1
+    - drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
+    - drm/radeon: Fix eDP for single-display iMac11,2
+    - drm/i915: Don't use stolen memory for ring buffers with LLC
+    - drm/i915: Don't use BAR mappings for ring buffers with LLC
+    - drm/gud: Fix UBSAN warning
+    - drm/edid: fix AVI infoframe aspect ratio handling
+    - drm/edid: fix parsing of 3D modes from HDMI VSDB
+    - qede: avoid uninitialized entries in coal_entry array
+    - brd: use radix_tree_maybe_preload instead of radix_tree_preload
+    - net: avoid double iput when sock_alloc_file fails
+    - Linux 6.2.3
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations after applying 6.2.3 stable patches
+    - [Config] update annotations after applying 6.2.6 stable patches
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 14 Mar 2023 16:43:44 +0100
+
+linux (6.2.0-16.16) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-16.16 -proposed tracker (LP: #2009914)
+
+  * linux-libc-dev is no longer multi-arch safe (LP: #2009355)
+    - Revert "UBUNTU: [Packaging] install headers to debian/linux-libc-dev
+      directly"
+
+  * linux: CONFIG_SERIAL_8250_MID=y (LP: #2009283)
+    - [Config] enable CONFIG_SERIAL_8250_MID=y
+
+  * cpufreq: intel_pstate: Update Balance performance EPP for Sapphire Rapids
+    (LP: #2008519)
+    - cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Mar 2023 18:34:28 +0100
+
+linux (6.2.0-15.15) lunar; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: document annotations headers
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Mar 2023 07:36:59 +0100
+
+linux (6.2.0-14.14) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-14.14 -proposed tracker (LP: #2009856)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] rust: add rust build dependencies to all arches
+    - [Packaging] Support skipped dkms modules
+    - [Packaging] actually enforce set -e in dkms-build--nvidia-N
+    - [Packaging] Preserve the correct log file variable value
+    - [Packaging] update getabis
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 09 Mar 2023 16:40:36 +0100
+
+linux (6.2.0-13.13) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-13.13 -proposed tracker (LP: #2009704)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * mt7921: add support of MTFG table (LP: #2009642)
+    - wifi: mt76: mt7921: add support to update fw capability with MTFG table
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 14:40:25 +0100
+
+linux (6.2.0-12.12) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-12.12 -proposed tracker (LP: #2009698)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: enforce rust availability only on x86_64
+    - [Config] update CONFIG_RUST_IS_AVAILABLE
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 12:50:15 +0100
+
+linux (6.2.0-11.11) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-11.11 -proposed tracker (LP: #2009697)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] do not stop the build if rust is not available
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 12:24:55 +0100
+
+linux (6.2.0-10.10) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-10.10 -proposed tracker (LP: #2009673)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * enable Rust support in the kernel (LP: #2007654)
+    - [Packaging] propagate makefile variables to kernelconfig
+    - SAUCE: rust: fix regexp in scripts/is_rust_module.sh
+    - SAUCE: scripts: rust: drop is_rust_module.sh
+    - SAUCE: rust: allow to use INIT_STACK_ALL_ZERO
+    - SAUCE: scripts: Exclude Rust CUs with pahole
+    - SAUCE: modpost: support arbitrary symbol length in modversion
+    - SAUCE: allows to enable Rust with modversions
+    - SAUCE: rust: properly detect the version of libclang used by bindgen
+    - [Packaging] rust: add the proper make flags to enable rust support
+    - [Packaging] add rust dependencies
+    - [Packaging] bpftool: always use vmlinux to generate headers
+    - [Packaging] run rustavailable target as debugging before build
+    - [Config] enable Rust support
+
+  * Fail to output sound to external monitor which connects via docking station
+    (LP: #2009024)
+    - [Config] Enable CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Makefile: replace rsync with tar
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 12:01:56 +0100
+
+linux (6.2.0-1.1) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-1.1 -proposed tracker (LP: #2009621)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * kinetic: apply new apparmor and LSM stacking patch set (LP: #1989983)
+    - SAUCE: apparmor: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor: add user namespace creation mediation
+
+  * Lunar update: v6.2.2 upstream stable release (LP: #2009358)
+    - ALSA: hda: cs35l41: Correct error condition handling
+    - crypto: arm64/sm4-gcm - Fix possible crash in GCM cryption
+    - bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
+    - vc_screen: don't clobber return value in vcs_read
+    - drm/amd/display: Move DCN314 DOMAIN power control to DMCUB
+    - drm/amd/display: Properly reuse completion structure
+    - scripts/tags.sh: fix incompatibility with PCRE2
+    - wifi: rtw88: usb: Set qsel correctly
+    - wifi: rtw88: usb: send Zero length packets if necessary
+    - wifi: rtw88: usb: drop now unnecessary URB size check
+    - usb: dwc3: pci: add support for the Intel Meteor Lake-M
+    - USB: serial: option: add support for VW/Skoda "Carstick LTE"
+    - usb: gadget: u_serial: Add null pointer check in gserial_resume
+    - arm64: dts: uniphier: Fix property name in PXs3 USB node
+    - usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO
+    - USB: core: Don't hold device lock while reading the "descriptors" sysfs file
+    - Linux 6.2.2
+
+  * Lunar update: v6.2.1 upstream stable release (LP: #2009127)
+    - uaccess: Add speculation barrier to copy_from_user()
+    - x86/alternatives: Introduce int3_emulate_jcc()
+    - x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions
+    - x86/static_call: Add support for Jcc tail-calls
+    - HID: mcp-2221: prevent UAF in delayed work
+    - wifi: mwifiex: Add missing compatible string for SD8787
+    - audit: update the mailing list in MAINTAINERS
+    - platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY
+    - platform/x86: nvidia-wmi-ec-backlight: Add force module parameter
+    - ext4: Fix function prototype mismatch for ext4_feat_ktype
+    - randstruct: disable Clang 15 support
+    - bpf: add missing header file include
+    - Linux 6.2.1
+
+  * Fix mediatek wifi driver crash when loading wrong SAR table (LP: #2009118)
+    - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read
+
+  * overlayfs mounts as R/O over idmapped mount (LP: #2009065)
+    - SAUCE: overlayfs: handle idmapped mounts in ovl_do_(set|remove)xattr
+
+  * RaptorLake: Fix the Screen is shaking by onboard HDMI port in mirror mode
+    (LP: #1993561)
+    - drm/i915/display: Drop check for doublescan mode in modevalid
+    - drm/i915/display: Prune Interlace modes for Display >=12
+
+  * screen flicker after PSR2 enabled (LP: #2007516)
+    - SAUCE: drm/i915/display/psr: Disable PSR2 sel fetch on panel SHP 5457
+
+  * [23.04 FEAT] Support for new IBM Z Hardware (IBM z16) - Reset DAT-Protection
+    facility support (LP: #1982378)
+    - s390/mm: add support for RDP (Reset DAT-Protection)
+
+  * [23.04 FEAT] zcrypt DD: AP command filtering (LP: #2003637)
+    - s390/zcrypt: introduce ctfm field in struct CPRBX
+
+  * rtcpie in timers from ubuntu_kernel_selftests randomly failing
+    (LP: #1814234)
+    - SAUCE: selftest: rtcpie: Force passing unreliable subtest
+
+  * [23.04 FEAT] Support for List-Directed IPL and re-IPL from ECKD DASD
+    (LP: #2003394)
+    - s390/ipl: add DEFINE_GENERIC_LOADPARM()
+    - s390/ipl: add loadparm parameter to eckd ipl/reipl data
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: drm/i915/sseu: fix max_subslices array-index-out-of-bounds access
+    - SAUCE: mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
+    - SAUCE: Revert "fbdev: Make registered_fb[] private to fbmem.c"
+    - [Packaging] disable signing for ppc64el
+    - [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+    - SAUCE: Revert "arm64/fpsimd: Make kernel_neon_ API _GPL"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 07 Mar 2023 18:45:31 +0100
+
+linux (6.2.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 03 Mar 2023 08:42:43 +0100
+
+linux-unstable (6.2.0-10.10) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-10.10 -proposed tracker (LP: #2007818)
+
+  * Built-in camera device dies after runtime suspended (LP: #2007530)
+    - SAUCE: usb: xhci: Workaround for runpm issue on AMD xHC
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations after rebase to v6.2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Feb 2023 10:36:20 +0100
+
+linux-unstable (6.2.0-9.9) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-9.9 -proposed tracker (LP: #2007069)
+
+  * Move kernel ADT tests to python3 (LP: #2004429)
+    - [Debian] Use a python3 compatable kernel-testing repo
+
+  * Mediatek FM350-GL wwan module failed to init: Invalid device status 0x1
+    (LP: #2002089)
+    - SAUCE: Revert "net: wwan: t7xx: Add AP CLDMA"
+    - SAUCE: net: wwan: t7xx: Add AP CLDMA
+    - SAUCE: net: wwan: t7xx: Infrastructure for early port configuration
+    - SAUCE: net: wwan: t7xx: PCIe reset rescan
+    - SAUCE: net: wwan: t7xx: Enable devlink based fw flashing and coredump
+      collection
+    - SAUCE: net: wwan: t7xx: Devlink documentation
+
+  * LXD containers using shiftfs on ZFS or TMPFS broken on 5.15.0-48.54
+    (LP: #1990849)
+    - SAUCE: shiftfs: fix -EOVERFLOW inside the container
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: do not drop undefined configs in derivatives
+    - [Packaging]: annotations: fix _remove_entry() logic
+    - [Packaging] rsync no longer available on lunar
+    - [Packaging] annotations: Handle single-line annoation rules
+    - [Packaging] annotations: Preserve single-line annotation rules
+    - [Packaging] annotations: Fix linter errors
+    - [Packaging] annotations: Clean up policy writes
+    - [Packaging] annotations: Handle tabs in annotations file
+    - [Packaging] annotations: Fail on invalid lines
+    - [Packaging] annotations: Write out annotations with notes first
+    - [Packaging] annotations: Check validity of FLAVOUR_DEP
+    - [Config] update annotations to split configs with/without notes
+    - [Packaging] annotations: various code cleanups
+    - [Config] update annotations after rebase to v6.2-rc8
+
+  * Miscellaneous upstream changes
+    - selftests/net: mv bpf/nat6to4.c to net folder
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Feb 2023 09:32:18 +0100
+
+linux-unstable (6.2.0-8.8) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-8.8 -proposed tracker (LP: #2004229)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable signing for ppc64el and s390x
+    - SAUCE: s390/decompressor: specify __decompress() buf len to avoid overflow
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 31 Jan 2023 08:21:21 +0100
+
+linux-unstable (6.2.0-7.7) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-7.7 -proposed tracker (LP: #2004142)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 30 Jan 2023 10:23:15 +0100
+
+linux-unstable (6.2.0-6.6) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-6.6 -proposed tracker (LP: #2004138)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] debian/rules: Bring back 'editconfigs'
+    - [Packaging] debian/rules: 1-maintainer.mk -- Use make's if-else
+    - [Packaging] annotations: make sure to always drop undefined configs
+    - [Config] update annotations after rebase to v6.2-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 30 Jan 2023 09:20:26 +0100
+
+linux-unstable (6.2.0-5.5) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-5.5 -proposed tracker (LP: #2003682)
+
+  * [23.04] Kernel 6.2 does not boot on s390x (LP: #2003348)
+    - SAUCE Revert "zstd: import usptream v1.5.2"
+    - SAUCE: Revert "zstd: Move zstd-common module exports to
+      zstd_common_module.c"
+
+  * Revoke & rotate to new signing key (LP: #2002812)
+    - [Packaging] Revoke and rotate to new signing key
+
+  * CVE-2023-0179
+    - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
+
+  * [23.04] net/smc: Alibaba patches about tunable buffer sizes may cause errors
+    and need to be removed (kernel 6.2) (LP: #2003547)
+    - SAUCE: Revert "net/smc: Unbind r/w buffer size from clcsock and make them
+      tunable"
+    - SAUCE: Revert "net/smc: Introduce a specific sysctl for TEST_LINK time"
+
+  * 5.15 stuck at boot on c4.large (LP: #1956780)
+    - SAUCE: Revert "PCI/MSI: Mask MSI-X vectors only on success"
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] scripts/misc/kernelconfig: Disable config checks for mainline
+      builds
+    - [Packaging] annotations: add CONFIG_GCC_VERSION to the list of ignored
+      configs
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 Jan 2023 08:20:26 +0100
+
+linux-unstable (6.2.0-4.4) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-4.4 -proposed tracker (LP: #2003051)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] add python3 as a build dependency
+    - [Packaging] scripts/misc/kernelconfig: Rewrite
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 17 Jan 2023 09:18:54 +0100
+
+linux-unstable (6.2.0-3.3) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-3.3 -proposed tracker (LP: #2002939)
+
+  * Enable kernel config for P2PDMA (LP: #1987394)
+    - [Config] Enable CONFIG_HSA_AMD_P2P
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (no-up) Remove obj- += foo.o hack
+    - SAUCE: (no-up) re-add ubuntu/ directory
+    - [Config] enable EFI handover protocol
+    - [Packaging] Fix module-check error when modules are compressed
+    - SAUCE: (no-up) do not remove debian directory by 'make mrproper'
+    - [Packaging] debian/rules: Drop AUTOBUILD
+    - [Packaging] debian/rules: Drop NOKERNLOG and PRINTSHAS env variables
+    - [Packaging] debian/rules: Replace skip<foo> variables with skip_checks
+    - [Packaging] checks/retpoline-check: Make 'skipretpoline' argument optional
+    - [Packaging] checks/module-signature-check: Add 'skip_checks' argument
+    - [Packaging] debian/rules: Rename 'skip_dbg' to 'do_dbgsym_package'
+    - [Packaging] debian/rules: Rename 'skip_checks' to 'do_skip_checks'
+    - [Packaging] debian/rules: Rename 'full_build' to 'do_full_build'
+    - [Packaging] debian/rules: Fix PPA debug package builds
+    - [Packaging] debian/rules: Remove debug package install directory earlier
+    - [Packaging] debian/rules: Remove unnecessary 'lockme_<foo>' variables
+    - [Packaging] debian/rules: Remove unused target 'diffupstream'
+    - [Packaging] debian/rules: Mark PHONY targets individually
+    - [Packaging] debian/rules: Clean up 'help' target output
+    - [Packaging] debian/rules: Clean up 'printenv' target output
+    - [Packaging] debian/rules: Add missing 'do_<foo>' variables to 'printenv'
+    - [Config] update annotations after rebase to v6.2-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 16 Jan 2023 16:01:40 +0100
+
+linux-unstable (6.2.0-2.2) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-2.2 -proposed tracker (LP: #2001892)
+
+  * Soundwire support for the Intel RPL Gen 0C40/0C11 platforms (LP: #2000030)
+    - SAUCE: ASoC: Intel: soc-acpi: add configuration for variant of 0C40 product
+    - SAUCE: ASoC: Intel: soc-acpi: add configuration for variant of 0C11 product
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain version in annotations
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Support skipped dkms modules"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 05 Jan 2023 09:19:55 +0100
+
+linux-unstable (6.2.0-1.1) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-1.1 -proposed tracker (LP: #2000904)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: remove configs that are undefined across all
+      arches/flavours
+    - SAUCE: Revert "apparmor: make __aa_path_perm() static"
+    - [Packaging] abi-check: ignore failures when abi check is skipped
+    - [Packaging] temporarily disable zfs dkms
+    - [Config] update annotations after rebase to 6.2-rc1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 04 Jan 2023 12:08:32 +0100
+
+linux-unstable (6.2.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Sun, 01 Jan 2023 10:16:00 +0100
+
+linux (6.1.0-11.11) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-11.11 -proposed tracker (LP: #2000704)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Lunar update: v6.1.1 upstream stable release (LP: #2000706)
+    - x86/vdso: Conditionally export __vdso_sgx_enter_enclave()
+    - libbpf: Fix uninitialized warning in btf_dump_dump_type_data
+    - PCI: mt7621: Add sentinel to quirks table
+    - mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem
+    - mips: ralink: mt7621: soc queries and tests as functions
+    - mips: ralink: mt7621: do not use kzalloc too early
+    - irqchip/ls-extirq: Fix endianness detection
+    - udf: Discard preallocation before extending file with a hole
+    - udf: Fix preallocation discarding at indirect extent boundary
+    - udf: Do not bother looking for prealloc extents if i_lenExtents matches
+      i_size
+    - udf: Fix extending file within last block
+    - usb: gadget: uvc: Prevent buffer overflow in setup handler
+    - USB: serial: option: add Quectel EM05-G modem
+    - USB: serial: cp210x: add Kamstrup RF sniffer PIDs
+    - USB: serial: f81232: fix division by zero on line-speed change
+    - USB: serial: f81534: fix division by zero on line-speed change
+    - xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N
+    - staging: r8188eu: fix led register settings
+    - igb: Initialize mailbox message for VF reset
+    - usb: typec: ucsi: Resume in separate work
+    - usb: dwc3: pci: Update PCIe device ID for USB3 controller on CPU sub-system
+      for Raptor Lake
+    - cifs: fix oops during encryption
+    - KEYS: encrypted: fix key instantiation with user-provided data
+    - Linux 6.1.1
+
+  * Expose built-in trusted and revoked certificates (LP: #1996892)
+    - [Packaging] Expose built-in trusted and revoked certificates
+
+  * Fix System cannot detect bluetooth after running suspend stress test
+    (LP: #1998727)
+    - wifi: rtw88: 8821c: enable BT device recovery mechanism
+
+  * Gnome doesn't run smooth when performing normal usage with RPL-P CPU
+    (LP: #1998419)
+    - drm/i915/rpl-p: Add stepping info
+
+  * Mute/mic LEDs no function on a HP platfrom (LP: #1998882)
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
+
+  * Add additional Mediatek MT7922 BT device ID (LP: #1998885)
+    - Bluetooth: btusb: Add a new VID/PID 0489/e0f2 for MT7922
+
+  * Support Icicle Kit reference design v2022.10 (LP: #1993148)
+    - SAUCE: riscv: dts: microchip: Disable PCIe on the Icicle Kit
+
+  * Add iommu passthrough quirk for Intel IPU6 on RaptorLake (LP: #1989041)
+    - SAUCE: iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs on Raptor
+      Lake
+
+  * Enable Intel FM350 wwan CCCI driver port logging (LP: #1997686)
+    - net: wwan: t7xx: use union to group port type specific data
+    - net: wwan: t7xx: Add port for modem logging
+
+  * TEE Support for CCP driver (LP: #1991608)
+    - crypto: ccp - Add support for TEE for PCI ID 0x14CA
+
+  * Kinetic update: v5.19.17 upstream stable release (LP: #1994179)
+    - Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
+    - kbuild: Add skip_encoding_btf_enum64 option to pahole
+
+  * Kinetic update: v5.19.15 upstream stable release (LP: #1994078)
+    - Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5"
+
+  * support independent clock and LED GPIOs for Intel IPU6 platforms
+    (LP: #1989046)
+    - SAUCE: platform/x86: int3472: support independent clock and LED GPIOs
+
+  * Kernel livepatch support for for s390x (LP: #1639924)
+    - [Config] Enable EXPOLINE_EXTERN on s390x
+
+  * Kinetic update: v5.19.7 upstream stable release (LP: #1988733)
+    - Revert "PCI/portdrv: Don't disable AER reporting in
+      get_port_device_capability()"
+
+  * Kinetic update: v5.19.3 upstream stable release (LP: #1987345)
+    - Revert "mm: kfence: apply kmemleak_ignore_phys on early allocated pool"
+
+  * Fix non-working e1000e device after resume (LP: #1951861)
+    - SAUCE: Revert "e1000e: Add polling mechanism to indicate CSME DPG exit"
+
+  * Add additional Mediatek MT7921 WiFi/BT device IDs (LP: #1937004)
+    - SAUCE: Bluetooth: btusb: Add support for Foxconn Mediatek Chip
+
+  * Fix system sleep on TGL systems with Intel ME (LP: #1919321)
+    - SAUCE: PCI: Serialize TGL e1000e PM ops
+
+  * Fix broken e1000e device after S3 (LP: #1897755)
+    - SAUCE: e1000e: Increase polling timeout on MDIC ready bit
+
+  * Fix unusable USB hub on Dell TB16 after S3 (LP: #1855312)
+    - SAUCE: USB: core: Make port power cycle a seperate helper function
+    - SAUCE: USB: core: Attempt power cycle port when it's in eSS.Disabled state
+
+  * Set explicit CC in the headers package (LP: #1999750)
+    - [Packaging] Set explicit CC in the headers package
+
+  * commit cf58599cded35cf4affed1e659c0e2c742d3fda7 seems to be missing in
+    kinetic master to remove "hio" reference from Makefile (LP: #1999556)
+    - SAUCE: remove leftover reference to ubuntu/hio driver
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] kernelconfig: always complete all config checks
+    - [Packaging] annotations: unify same rule across all flavour within the same
+      arch
+    - [Config] annotations: compact annotations file
+    - [Config] disable EFI_ZBOOT
+    - SAUCE: input: i8042: fix section mismatch warning
+    - debian/dkms-versions -- re-enable zfs
+    - [Packaging] old-kernelconfig: update config-check path
+    - [Packaging] update getabis
+    - [Packaging] update Ubuntu.md
+
+  * Miscellaneous upstream changes
+    - Revert "drm/i915/opregion: check port number bounds for SWSCI display power
+      state"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 30 Dec 2022 11:23:16 +0100
+
+linux (6.1.0-10.10) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-10.10 -proposed tracker (LP: #1999569)
+
+  * Soundwire support for the Intel RPL Gen platforms (LP: #1997944)
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C10 product
+    - ASoC: Intel: soc-acpi: add SKU 0C10 SoundWire configuration
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C40 product
+    - ASoC: Intel: soc-acpi: add SKU 0C40 SoundWire configuration
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C4F product
+    - ASoC: rt1318: Add RT1318 SDCA vendor-specific driver
+    - ASoC: intel: sof_sdw: add rt1318 codec support.
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C11 product
+    - ASoC: Intel: soc-acpi: add SKU 0C11 SoundWire configuration
+    - SAUCE: ASoC: Intel: soc-acpi: update codec addr on 0C11/0C4F product
+    - [Config] enable CONFIG_SND_SOC_RT1318_SDW
+
+  * Virtual GPU driver packaging regression (LP: #1996112)
+    - [Packaging] Reintroduce VM DRM drivers into modules
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 13 Dec 2022 22:14:08 +0100
+
+linux (6.1.0-9.9) lunar; urgency=medium
+
+  * Empty entry (ABI bump)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 13 Dec 2022 21:31:08 +0100
+
+linux (6.1.0-3.3) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-3.3 -proposed tracker (LP: #1999534)
+
+  * [DEP-8] Run ADT regression suite for lowlatency kernels Jammy and later
+    (LP: #1999528)
+    - [DEP-8] Fix regression suite to run on lowlatency
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: do not add constraints on toolchain versions
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 13 Dec 2022 16:45:59 +0100
+
+linux (6.1.0-2.2) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-2.2 -proposed tracker (LP: #1999411)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: do not enforce toolchain versions
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Dec 2022 17:05:59 +0100
+
+linux (6.1.0-1.1) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-1.1 -proposed tracker (LP: #1999373)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: set and delete configs from command line
+    - [Packaging] migrateconfigs: ignore README.rst if it doesn't exist
+    - [Packaging] migrate-annotations: properly determine arches in derivatives
+    - [Packaging] annotations: allow to set note to config options directly
+    - [Packaging] annotations: assume --query as default command
+    - [Packaging] annotations: allow to query using CONFIG_<option> or <option>
+    - [Packaging] annotations: support flavour inheritance
+    - [Packaging] annotations: properly merge configs with includes
+    - [Packaging] annotations: accept config options with or without CONFIG_
+      prefix
+    - [Packaging] annotations: clarify error message with --import
+    - [Packaging] annotations: properly support multiple levels of inclusion
+    - [Packaging] annotations: catch syntax errors in annotations
+    - [Packaging] kernelconfig: report arch and flavour in config-check log
+    - [Packaging] annotations: prevent generating .pyc files on import
+    - [Packaging] annotations: prevent python broken pipe errors
+    - [Packaging] annotations: allow to specify --write and --note at the same
+      time
+    - [Packaging] annotations: add an option to enable config autocompletion in
+      bash
+    - [Packaging] annotations: introduce --source
+    - [Packaging] annotations: add missing CONFIG_ prefix in main()
+    - [Packaging] Remove obsolete etc/kernelconfig
+    - [Packaging] Rewrite debian/scripts/abi-check in Python
+    - [Packaging] Simplify debian/scripts/module-check
+    - [Packaging] Clean up debian/scripts/module-check
+    - [Packaging] Move checker scripts to debian/scripts/checks
+    - [Packaging] mark phony targets
+    - [Packaging] Make the compiler for fix-filenames explicit
+    - [Packaging] add -rR MAKEFLAGS to clear implicit rules
+    - [Packaging] use dpkg-parsechangelog to get package name and series
+    - [Packaging] simplify revision/release
+    - [Packaging] simplify custom_override
+    - [Packaging] Remove meaningless code in install-arch-headers
+    - [Packaging] use olddefconfig in stamp-prepare-tree
+    - [Packaging] use parralel builds in more places
+    - [Packaging] install headers to debian/linux-libc-dev directly
+    - [Packaging] simplify abinum and uploadnum definitions
+    - [Packaging] Remove unused INSTALL_FW_PATH
+    - [Packaging] Merge install commands
+    - [Config] clean up deprecated notes in annotations
+    - [Packaging] automatically apply changes to annotations and drop
+      importconfigs
+    - [Packaging] kernelconfig: drop listnewconfigs
+    - [Packaging] annotations: do not hijack CONFIGS/* to update annotations
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Dec 2022 10:05:03 +0100
+
+linux (6.1.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Dec 2022 09:42:01 +0100
+
+linux-unstable (6.1.0-9.9) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-9.9 -proposed tracker (LP: #1998078)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Set ARM64_ERRATUM_2077057=y
+    - SAUCE: add python cached bytecode to .gitignore
+    - [Packaging] config-check: ignore values that are not defined in annotations
+    - [Packaging] config-check: do not strictly enforce CONFIG_CC_VERSION_TEXT
+    - [Packaging] config-check: support annotations format 4
+    - [Packaging] introduce annotations script
+    - [Packaging] add a README.rst to document the new annotations schema
+    - [Packaging] kernelconfig: automatically generate configs from annotations
+    - [Packaging] drop deprecated script tristate.sh
+    - [Packaging] use annotations to generate initial configs check them
+    - [Packaging] simplify kernelconfig
+    - [Packaging] kernelconfig: always keep configs
+    - [Packaging] kernelconfig: provide listnewconfigs
+    - [Packaging] kernelconfig: introduce importconfigs
+    - [Packaging] snap: support new annotations with snapcraft
+    - [Packaging] final-checks: support new annotations
+    - [Packaging] introduce migrate-annotations
+    - [Packaging] re-introduce previous kernelconfig as old-kernelconfig
+    - [Packaging] provide migrateconfigs debian/rules target
+    - [Packaging] correctly propagate errors during updateconfigs
+    - [Packaging] annotations: report failed config checks in alphabetic order
+    - [Config] merge configs into annotations
+    - [Config] udpate annotations after rebase to v6.1-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Nov 2022 11:25:44 +0100
+
+linux-unstable (6.1.0-8.8) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-8.8 -proposed tracker (LP: #1997357)
+
+  *  Fibocom WWAN FM350-GL suspend error (notebook not suspend) (LP: #1990700)
+    - net: wwan: t7xx: Add AP CLDMA
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v6.1-rc6
+    - [Config] update configs following v6.1-rc6 rebase
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs following v6.1-rc6 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 22 Nov 2022 11:56:26 +0100
+
+linux-unstable (6.1.0-7.7) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-7.7 -proposed tracker (LP: #1996731)
+
+  * Miscellaneous Ubuntu changes
+    - ppc64el: remove missing module
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 16 Nov 2022 11:37:05 +0100
+
+linux-unstable (6.1.0-6.6) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-6.6 -proposed tracker (LP: #1996616)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs following v6.1-rc5 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 15 Nov 2022 15:55:33 +0100
+
+linux-unstable (6.1.0-5.5) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-5.5 -proposed tracker (LP: #1995875)
+
+  * Please have linux-tools-common Provide: bpftool (LP: #1981089)
+    - [Packaging] let linux-tools-common provides bpftool
+
+  * Miscellaneous Ubuntu changes
+    - packaging: switch to lunar series
+    - Rebase to v6.1-rc4
+    - [Config] toolchian update
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 07 Nov 2022 16:43:21 +0100
+
+linux-unstable (6.1.0-4.4) lunar; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-4.4 -proposed tracker (LP: #1995500)
+
+  * Fix ath11k deadlock on WCN6855 (LP: #1995041)
+    - SAUCE: wifi: ath11k: avoid deadlock during regulatory update in
+      ath11k_regd_update()
+
+  * Bump (kernel) '-mtune' to z16 / arch14 with 23.04 (LP: #1982833)
+    - [Config] Enable mtune z16
+
+  * armhf kernel compiled with gcc-12 fails to boot on pi 3/2 (LP: #1993120)
+    - [Packaging] Support arch-specific compilers in updateconfigs
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs after rebase to 6.1-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 03 Nov 2022 14:00:41 +0100
+
+linux-unstable (6.1.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-3.3 -proposed tracker (LP: #1994037)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Support skipped dkms modules
+    - [Config] update configs after rebase to 6.1-rc2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 24 Oct 2022 15:53:11 +0200
+
+linux-unstable (6.1.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-2.2 -proposed tracker (LP: #1993350)
+
+  * Populating Hyper-V MSR for Ubuntu 13.10 (LP: #1193172)
+    - SAUCE: (no-up) hv: Supply vendor ID and package ABI
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: perf tools: Fix man page build wrt perf-arm-coresight.txt
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 18 Oct 2022 23:02:31 +0200
+
+linux-unstable (6.1.0-1.1) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-1.1 -proposed tracker (LP: #1993118)
+
+  * Raise CONFIG_NR_CPUS (LP: #1967889)
+    - [Config] Raise riscv64 CONFIG_NR_CPUS to 32
+
+  * rcu_sched detected stalls on CPUs/tasks (LP: #1967130)
+    - [Config] Disable VMAP_STACK on riscv64
+
+  * Disable sv57 as the userspace is not ready (LP: #1991790)
+    - SAUCE: riscv: mm: Force disable sv57
+
+  * earlyconsole prints question marks on 5.19.0-1002-generic (LP: #1988984)
+    - [Config] Set CONFIG_PWM_SIFIVE=m for riscv64
+
+  * RCU stalls (LP: #1991951)
+    - [Config] Harmonize RCU_CPU_STALL_TIMEOUT
+
+  * backport dkms fixes to build modules correctly for hwe-5.19+ kernels with
+    custom compiler (LP: #1991664)
+    - [Packaging] use versioned gcc-12
+    - [Packaging] Update configs with versioned compiler version
+
+  * FTBFS on kinetic (LP: #1990964)
+    - SAUCE: uapi: Fixup strace compile error
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] sameport -- add support for sameport versioning
+    - [Packaging] move to kernel 6.1
+    - SAUCE: platform/x86: dell-uart-backlight: remove
+      acpi_video_set_dmi_backlight_type()
+    - SAUCE: shiftfs: support kernel 6.1
+    - [Config] update configs and annotations after rebase to 6.1-rc1
+    - debian/dkms-versions -- temporarily disable dkms builds
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 18 Oct 2022 17:21:43 +0200
+
+linux-unstable (6.1.0-0.0) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 17 Oct 2022 08:57:58 +0200
+
+linux-unstable (6.0.0-9.9) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-9.9 -proposed tracker (LP: #1991521)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain configs after rebase to 6.0
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 03 Oct 2022 15:51:57 +0200
+
+linux-unstable (6.0.0-8.8) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-8.8 -proposed tracker (LP: #1990101)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 20 Sep 2022 10:22:14 +0200
+
+linux-unstable (6.0.0-7.7) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-7.7 -proposed tracker (LP: #1989331)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+    - [Packaging] resync getabis
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Please enable CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU (LP: #1980861)
+    - [Config] Switch from DECOMP_SINGLE to DECOMP_MULTI_PERCPU
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Pass kernel build_arch to dkms
+    - [Packaging[ get rid of unnecessary 'set -x'
+    - [Config] update configs and annotations after rebase to 6.0-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Sep 2022 14:03:55 +0200
+
+linux-unstable (6.0.0-6.6) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-6.6 -proposed tracker (LP: #1988706)
+
+  * Support Intel TDX guest attestation driver (LP: #1988120)
+    - SAUCE: x86/tdx: Add TDX Guest attestation interface driver
+    - SAUCE: selftests: tdx: Test GetReport TDX attestation feature
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable signing for ppc64el and s390x
+    - [Config] enable security-related configs
+    - [Config] update toolchain versions
+    - [Packaging] fix URLs used to retrieve kernel ABI
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 05 Sep 2022 16:59:40 +0200
+
+linux-unstable (6.0.0-5.5) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-5.5 -proposed tracker (LP: #1988019)
+
+  * LSM: Configuring Too Many LSMs Causes Kernel Panic on Boot (LP: #1987998)
+    - SAUCE: LSM: Change Landlock from LSMBLOB_NEEDED to LSMBLOB_NOT_NEEDED
+
+  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
+    - [Config] Align riscv64 CONFIG_LSM with other architectures
+    - [Config] Enable CONFIG_DRM_RCAR_USE_LVDS for riscv64
+    - [Config] Enable CONFIG_DTPM for riscv64
+    - [Config] Set CONFIG_MTD_RAW_NAND=m for riscv64
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging]: always use fully qualified <triplet>-gcc-VER toolchain
+    - [Packaging] use unversioned default gcc
+    - [Packaging] Remove circular dependency between image & modules
+    - [Config] update configs after rebase to 6.0-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 29 Aug 2022 09:18:39 +0200
+
+linux-unstable (6.0.0-4.4) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-4.4 -proposed tracker (LP: #1987517)
+
+  * Fix invalid MAC address after hotplug tbt dock (LP: #1942999)
+    - SAUCE: igc: wait for the MAC copy when enabled MAC passthrough
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] getabis: Add modules.builtin to the ABI
+
+  * Miscellaneous upstream changes
+    - perf tools: Fix compile error for x86
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 24 Aug 2022 15:10:24 +0200
+
+linux-unstable (6.0.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-3.3 -proposed tracker (LP: #1987241)
+
+  * [22.04 FEAT] Deactivitate  CONFIG_QETH_OSX kernel config option
+    (LP: #1959890)
+    - [Config] disable CONFIG_QETH_OSX on s390x
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Make stamp-install-<flavor> target reentrant
+    - [Config] update toolchain version
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 Aug 2022 09:09:26 +0200
+
+linux-unstable (6.0.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-2.2 -proposed tracker (LP: #1986844)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "perf tools: Use Python devtools for version autodetection
+      rather than runtime"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 Aug 2022 19:40:07 +0200
+
+linux-unstable (6.0.0-1.1) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-1.1 -proposed tracker (LP: #1986784)
+
+  * refactoring of overlayfs fix to properly support shiftfs (LP: #1983640)
+    - SAUCE: for aufs mmap: print the virtual file path
+    - SAUCE: overlayfs: fix incorrect mnt_id of files opened from map_files
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move to kernel 6.0
+    - [Config] update configs and annotations after rebase to 6.0-rc1
+    - [Packaging] temporarily disable dkms
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 Aug 2022 16:56:18 +0200
+
+linux-unstable (6.0.0-0.0) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 Aug 2022 10:23:42 +0200
+
+linux (5.19.0-15.15) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-15.15 -proposed tracker (LP: #1983335)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations to support both gcc-11 and gcc-12
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 02 Aug 2022 09:23:01 +0200
+
+linux (5.19.0-14.14) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-14.14 -proposed tracker (LP: #1983273)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] module-signature-check: Check debian.<foo>/signature-inclusion
+    - [Packaging] Introduce debian/scripts/sign-module
+    - SAUCE: Switch to using debian/scripts/sign-module
+    - [Config] update configs/annotations after rebase to 5.19
+    - [Config] update configs after moving to gcc-12
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging]: always use fully qualified <triplet>-gcc-VER
+      toolchain"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 01 Aug 2022 17:19:01 +0200
+
+linux (5.19.0-13.13) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-13.13 -proposed tracker (LP: #1983033)
+
+  * network-manager/1.36.4-2ubuntu1 ADT test failure with linux/5.15.0-28.29
+    (LP: #1971418)
+    - Revert "rfkill: make new event layout opt-in"
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Tighten up LP bug links in annotations
+    - [Config] Use mark<ENFORCED> for CONFIG_DEVTMPFS
+    - [Config] Use flag<DEPRECATED> for CONFIG_HIPPI
+    - [Config] Use note<> for CONFIG_XEN_ACPI_PROCESSOR
+    - [Config] Fix DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING annotation
+    - [Config] Fix CONFIG_CPU_LITTLE_ENDIAN annotation
+    - SAUCE: x86/bugs: Do not enable IBPB at firmware entry when IBPB is not
+      available
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 28 Jul 2022 17:04:33 +0200
+
+linux (5.19.0-12.12) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-12.12 -proposed tracker (LP: #1982741)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging]: always use fully qualified <triplet>-gcc-VER toolchain
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 26 Jul 2022 15:07:13 +0200
+
+linux (5.19.0-11.11) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-11.11 -proposed tracker (LP: #1982726)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * GPIO character device v1 API not enabled in kernel (LP: #1953613)
+    - [Config] Enable CONFIG_GPIO_CDEV_V1
+
+  * Use kernel-testing repo from launchpad for ADT tests (LP: #1968016)
+    - [Debian] Use kernel-testing repo from launchpad
+
+  * Support AMD P-State cpufreq control mechanism (LP: #1956509)
+    - [Config] enable X86_AMD_PSTATE as built-in on amd64
+
+  * PCIE LnkCtl ASPM not enabled under VMD mode for Alder Lake platforms
+    (LP: #1942160)
+    - SAUCE: PCI/ASPM: Enable ASPM for links under VMD domain
+    - SAUCE: PCI/ASPM: Enable LTR for endpoints behind VMD
+    - SAUCE: vmd: fixup bridge ASPM by driver name instead
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Double the speed of updateconfigs
+    - Remove ubuntu/hio driver
+    - [Config] update config after rebase to 5.19-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 25 Jul 2022 08:54:21 +0200
+
+linux (5.19.0-10.10) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-10.10 -proposed tracker (LP: #1982013)
+
+  * enable config for fixing 5.17 kernel won't load mok (LP: #1972802)
+    - [Config] enable configs for fixing kernel won't load mok
+
+  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
+    - [Config] Disable CONFIG_CXL_MEM_RAW_COMMANDS on riscv64
+    - [Config] Disable CONFIG_EROFS_FS_ZIP_LZMA on riscv64
+    - [Config] Disable CONFIG_FONT_6x8 on riscv64
+    - [Config] Disable CONFIG_NTFS3_64BIT_CLUSTER on riscv64
+    - [Config] Disable CONFIG_SCSI_IZIP_EPP16 on riscv64
+    - [Config] Disable CONFIG_SCSI_UFS_HWMON on riscv64
+    - [Config] Disable CONFIG_SPI_AX88796C_COMPRESSION on riscv64
+    - [Config] Disable CONFIG_VIDEO_ZORAN on riscv64
+    - [Config] Enable CONFIG_BPF_KPROBE_OVERRIDE on riscv64
+    - [Config] Enable CONFIG_CACHEFILES_ERROR_INJECTION on riscv64
+    - [Config] Enable CONFIG_DRM_AMD_DC_SI on riscv64
+    - [Config] Enable CONFIG_NUMA_BALANCING on riscv64
+    - [Config] Enable CONFIG_PROC_VMCORE_DEVICE_DUMP on riscv64
+    - [Config] Enable CONFIG_WLAN_VENDOR_MICROCHIP on riscv64
+    - [Config] Set CONFIG_MHI_WWAN_CTRL=m on riscv64
+    - [Config] Set CONFIG_NFC_S3FWRN82_UART=m on riscv64
+    - [Config] Enable CONFIG_EFIVAR_FS on riscv64
+    - [Config] Enable CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES on riscv64
+    - [Config] Enable CONFIG_STRICT_DEVMEM on riscv64
+    - [Config] Enable CONFIG_VMAP_STACK on riscv64
+    - [Config] Enable CONFIG_KEXEC_FILE on riscv64
+    - [Config] Set CONFIG_MTD_PSTORE=m on riscv64
+    - [Config] Set CONFIG_KFENCE_SAMPLE_INTERVAL=0 on riscv64
+    - [Config] Enable CONFIG_KEXEC_FILE on s390x
+
+  * Ubuntu 22.04 and 20.04 DPC Fixes for Failure Cases of DownPort Containment
+    events (LP: #1965241)
+    - Enable config option CONFIG_PCIE_EDR
+    - Correct CONFIG_PCIE_EDR annotation on arm64
+
+  * config CONFIG_HISI_PMU for  kunpeng920 (LP: #1956086)
+    - [Config] CONFIG_HISI_PMU=m
+
+  * Skip setting ethernet LED on Dell EMC board (LP: #1971667)
+    - SAUCE: net: phy: marvell: Skip setting LED on Dell EMC board
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] ignore warnings from the output of ld.bfd
+    - [Packaging] Fix bashism in dkms-build script
+    - [Packaging] Always catch errors in dkms-build scripts
+    - [Packaging] Fix dkms builds with linker @module.mod files
+    - [Packaging] mark dkms-build-configure--zfs executable
+    - [Config] update configs and annotations after rebase to 5.19-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 18 Jul 2022 23:45:28 +0200
+
+linux (5.19.0-9.9) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-9.9 -proposed tracker (LP: #1980622)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update config after rebase to 5.19-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Jul 2022 12:05:04 +0200
+
+linux (5.19.0-8.8) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-8.8 -proposed tracker (LP: #1980482)
+
+  * temporarily disable CONFIG_X86_KERNEL_IBT (LP: #1980484)
+    - [Config] temporarily disable CONFIG_X86_KERNEL_IBT
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 01 Jul 2022 11:58:56 +0200
+
+linux (5.19.0-7.7) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-7.7 -proposed tracker (LP: #1980056)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * RISC-V enables CONFIG_COMPAT in the unstable branch (LP: #1980061)
+    - [Config] Disable CONFIG_COMPAT on RISC-V
+
+  * No RISC-V configuration in the unstable tree (LP: #1979647)
+    - [Config] Merge riscv64 config and annotations
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 28 Jun 2022 12:25:48 +0200
+
+linux (5.19.0-6.6) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 28 Jun 2022 07:50:17 +0200
+
+linux-unstable (5.19.0-6.6) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-6.6 -proposed tracker (LP: #1979948)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove 'family=ubuntu' concept
+    - [Packaging] final-checks: Remove useless sourcing of kernelconfig
+    - [Config] update config after rebase to 5.19-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 27 Jun 2022 09:16:40 +0200
+
+linux-unstable (5.19.0-5.5) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-5.5 -proposed tracker (LP: #1979611)
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable signing for ppc64el and
+      s390x"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 23 Jun 2022 11:13:32 +0200
+
+linux-unstable (5.19.0-4.4) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-4.4 -proposed tracker (LP: #1979177)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs after rebase to 5.19-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Jun 2022 09:02:58 +0200
+
+linux-unstable (5.19.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-3.3 -proposed tracker (LP: #1978439)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations for 5.19
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Jun 2022 07:16:32 +0200
+
+linux-unstable (5.19.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-2.2 -proposed tracker (LP: #1978313)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Jun 2022 15:17:20 +0200
+
+linux-unstable (5.19.0-1.1) kinetic; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * linux: Staging modules should be unsigned (LP: #1642368)
+    - [Packaging] Move and update signature inclusion list
+    - [Packaging] Strip signatures from untrusted staging modules
+    - [Packaging] Add module-signature-check
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to 5.19-rc1
+    - [Packaging] move to kernel 5.19
+    - [Packaging] workaround missing python3-dev dependency
+    - SAUCE: Revert "perf tools: Use Python devtools for version autodetection
+      rather than runtime"
+    - SAUCE: watchdog: gxp: Add missing MODULE_LICENSE
+    - [Packaging] add python3-dev as build dependency
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Jun 2022 14:43:46 +0200
+
+linux-unstable (5.19.0-0.0) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 09 Jun 2022 12:13:06 +0200
+
+linux (5.18.0-6.6) kinetic; urgency=medium
+
+  * kinetic/linux: 5.18.0-6.6 -proposed tracker (LP: #1976327)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable signing for ppc64el and s390x
+    - [Config] update toolchain versions
+    - [Config] enable CONFIG_X86_KERNEL_IBT
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 31 May 2022 11:05:51 +0200
+
+linux (5.18.0-5.5) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 May 2022 16:59:47 +0200
+
+linux-unstable (5.18.0-5.5) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-5.5 -proposed tracker (LP: #1975458)
+
+  * enable CONFIG_DEVTMPFS_SAFE (LP: #1974442)
+    - [Config] enable CONFIG_DEVTMPFS_SAFE
+
+  * build backport-iwlwifi-dkms as linux-modules-iwlwifi-ABI (LP: #1969434)
+    - [Packaging] drop do_<mod> arch specific configs
+
+  * prevent kernel panic with overlayfs + shiftfs (LP: #1973620)
+    - SAUCE: overlayfs: prevent dereferencing struct file in ovl_vm_prfile_set()
+
+  * linux-image-5.0.0-35-generic breaks checkpointing of container
+    (LP: #1857257) // re-apply missing overlayfs SAUCE patch (LP: #1967924)
+    - SAUCE: overlayfs: fix incorrect mnt_id of files opened from map_files
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 May 2022 11:21:38 +0200
+
+linux-unstable (5.18.0-4.4) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-4.4 -proposed tracker (LP: #1973587)
+
+  * build backport-iwlwifi-dkms as linux-modules-iwlwifi-ABI (LP: #1969434)
+    - [Packaging] support standalone dkms module builds
+
+  * Enable speakup kernel modules to allow the speakup screen reader to function
+    (LP: #1967702)
+    - [Config] CONFIG_SPEAKUP=m for all but s390x
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable v4l2loopback"
+    - Revert "UBUNTU: [Packaging] temporarily disable zfs"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 16 May 2022 14:15:35 +0200
+
+linux-unstable (5.18.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-3.3 -proposed tracker (LP: #1972162)
+
+  * disable Intel DMA remapping by default (LP: #1971699)
+    - Revert "UBUNTU: [Config] enable Intel DMA remapping options by default"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 May 2022 12:15:39 +0200
+
+linux-unstable (5.18.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-2.2 -proposed tracker (LP: #1971340)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs after rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 03 May 2022 12:24:49 +0200
+
+linux-unstable (5.18.0-1.1) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 03 May 2022 09:38:06 +0200
+
+linux-unstable (5.18.0-1.1) jammy; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-1.1 -proposed tracker (LP: #1969476)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to 5.18
+    - [Packaging] temporarily disable zfs
+    - [Packaging] temporarily disable v4l2loopback
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 27 Apr 2022 20:26:42 +0200
+
+linux-unstable (5.18.0-0.0) jammy; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 19 Apr 2022 16:20:00 +0200
+
+linux-unstable (5.17.0-8.8) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-8.8 -proposed tracker (LP: #1969016)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Apr 2022 10:30:39 +0200
+
+linux-unstable (5.17.0-7.7) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-7.7 -proposed tracker (LP: #1968988)
+
+  * zfcpdump-kernel update to v5.15 (LP: #1965766)
+    - SAUCE: Audit: Fix incorrect static inline function declration.
+
+  * intel_iommu breaks Intel IPU6 camera: isys port open ready failed -16
+    (LP: #1958004)
+    - SAUCE: iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs
+
+  * Jammy update: v5.17.3 upstream stable release (LP: #1968986)
+    - lib/logic_iomem: correct fallback config references
+    - um: fix and optimize xor select template for CONFIG64 and timetravel mode
+    - rtc: wm8350: Handle error for wm8350_register_irq
+    - net: dsa: felix: fix possible NULL pointer dereference
+    - mm: kfence: fix objcgs vector allocation
+    - KVM: x86/pmu: Use different raw event masks for AMD and Intel
+    - KVM: SVM: Fix kvm_cache_regs.h inclusions for is_guest_mode()
+    - KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
+    - KVM: x86/pmu: Fix and isolate TSX-specific performance event logic
+    - KVM: x86/emulator: Emulate RDPID only if it is enabled in guest
+    - drm: Add orientation quirk for GPD Win Max
+    - Bluetooth: hci_sync: Fix compilation warning
+    - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
+    - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
+    - drm/amd/display: Add signal type check when verify stream backends same
+    - drm/amdkfd: enable heavy-weight TLB flush on Arcturus
+    - drm/edid: remove non_desktop quirk for HPN-3515 and LEN-B800.
+    - drm/edid: improve non-desktop quirk logging
+    - Bluetooth: hci_event: Ignore multiple conn complete events
+    - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
+    - drm/amd/display: Fix memory leak
+    - drm/amd/display: Use PSR version selected during set_psr_caps
+    - usb: gadget: tegra-xudc: Do not program SPARAM
+    - usb: gadget: tegra-xudc: Fix control endpoint's definitions
+    - usb: cdnsp: fix cdnsp_decode_trb function to properly handle ret value
+    - ptp: replace snprintf with sysfs_emit
+    - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set
+    - selftests, xsk: Fix bpf_res cleanup test
+    - net/mlx5e: TC, Hold sample_attr on stack instead of pointer
+    - drm/amdkfd: Don't take process mutex for svm ioctls
+    - drm/amdkfd: Ensure mm remain valid in svm deferred_list work
+    - drm/amdkfd: svm range restore work deadlock when process exit
+    - drm/amdgpu: Fix an error message in rmmod
+    - mlxsw: spectrum: Guard against invalid local ports
+    - RDMA/rtrs-clt: Do stop and failover outside reconnect work.
+    - powerpc/xive: Export XIVE IPI information for online-only processors.
+    - powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
+    - ath11k: fix kernel panic during unload/load ath11k modules
+    - ath11k: pci: fix crash on suspend if board file is not found
+    - ath11k: mhi: use mhi_sync_power_up()
+    - net/smc: Send directly when TCP_CORK is cleared
+    - drm/bridge: Add missing pm_runtime_put_sync
+    - bpf: Make dst_port field in struct bpf_sock 16-bit wide
+    - scsi: mvsas: Replace snprintf() with sysfs_emit()
+    - scsi: bfa: Replace snprintf() with sysfs_emit()
+    - drm/v3d: fix missing unlock
+    - power: supply: axp20x_battery: properly report current when discharging
+    - mt76: mt7921: fix crash when startup fails.
+    - mt76: dma: initialize skip_unmap in mt76_dma_rx_fill
+    - i40e: Add sending commands in atomic context
+    - cfg80211: don't add non transmitted BSS to 6GHz scanned channels
+    - libbpf: Fix build issue with llvm-readelf
+    - ipv6: make mc_forwarding atomic
+    - ref_tracker: implement use-after-free detection
+    - net: initialize init_net earlier
+    - powerpc: Set crashkernel offset to mid of RMA region
+    - drm/amdgpu: Fix recursive locking warning
+    - scsi: smartpqi: Fix rmmod stack trace
+    - scsi: smartpqi: Fix kdump issue when controller is locked up
+    - PCI: aardvark: Fix support for MSI interrupts
+    - kvm: selftests: aarch64: fix assert in gicv3_access_reg
+    - kvm: selftests: aarch64: pass vgic_irq guest args as a pointer
+    - kvm: selftests: aarch64: fix the failure check in
+      kvm_set_gsi_routing_irqchip_check
+    - kvm: selftests: aarch64: fix some vgic related comments
+    - kvm: selftests: aarch64: use a tighter assert in vgic_poke_irq()
+    - iommu/arm-smmu-v3: fix event handling soft lockup
+    - usb: ehci: add pci device support for Aspeed platforms
+    - KVM: arm64: Do not change the PMU event filter after a VCPU has run
+    - libbpf: Fix accessing syscall arguments on powerpc
+    - libbpf: Fix accessing the first syscall argument on arm64
+    - libbpf: Fix accessing the first syscall argument on s390
+    - PCI: endpoint: Fix alignment fault error in copy tests
+    - tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH.
+    - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
+    - scsi: mpi3mr: Fix deadlock while canceling the fw event
+    - scsi: mpi3mr: Fix reporting of actual data transfer size
+    - scsi: mpi3mr: Fix memory leaks
+    - powerpc/set_memory: Avoid spinlock recursion in change_page_attr()
+    - power: supply: axp288-charger: Set Vhold to 4.4V
+    - drm/sprd: fix potential NULL dereference
+    - drm/sprd: check the platform_get_resource() return value
+    - drm/amd/display: reset lane settings after each PHY repeater LT
+    - net/mlx5e: Disable TX queues before registering the netdev
+    - HID: apple: Report Magic Keyboard 2021 battery over USB
+    - HID: apple: Report Magic Keyboard 2021 with fingerprint reader battery over
+      USB
+    - usb: dwc3: pci: Set the swnode from inside dwc3_pci_quirks()
+    - iwlwifi: mvm: Correctly set fragmented EBS
+    - iwlwifi: fix small doc mistake for iwl_fw_ini_addr_val
+    - iwlwifi: mvm: move only to an enabled channel
+    - ipv6: annotate some data-races around sk->sk_prot
+    - drm/msm/dsi: Remove spurious IRQF_ONESHOT flag
+    - x86/mce: Work around an erratum on fast string copy instructions
+    - rtw89: fix RCU usage in rtw89_core_txq_push()
+    - ath11k: Fix frames flush failure caused by deadlock
+    - ipv4: Invalidate neighbour for broadcast address upon address addition
+    - rtw88: change rtw_info() to proper message level
+    - dm ioctl: prevent potential spectre v1 gadget
+    - dm: requeue IO if mapping table not yet available
+    - drm/amdkfd: make CRAT table missing message informational only
+    - vfio/pci: Stub vfio_pci_vga_rw when !CONFIG_VFIO_PCI_VGA
+    - scsi: pm8001: Fix pm80xx_pci_mem_copy() interface
+    - scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
+    - scsi: pm8001: Fix tag values handling
+    - scsi: pm8001: Fix task leak in pm8001_send_abort_all()
+    - scsi: pm8001: Fix tag leaks on error
+    - scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req()
+    - mt76: mt7915: fix injected MPDU transmission to not use HW A-MSDU
+    - mctp: make __mctp_dev_get() take a refcount hold
+    - powerpc/64s/hash: Make hash faults work in NMI context
+    - mt76: mt7615: Fix assigning negative values to unsigned variable
+    - power: supply: axp288_charger: Use acpi_quirk_skip_acpi_ac_and_battery()
+    - power: supply: axp288_fuel_gauge: Use acpi_quirk_skip_acpi_ac_and_battery()
+    - scsi: aha152x: Fix aha152x_setup() __setup handler return value
+    - scsi: hisi_sas: Free irq vectors in order for v3 HW
+    - scsi: hisi_sas: Limit users changing debugfs BIST count value
+    - net/smc: correct settings of RMB window update limit
+    - mips: ralink: fix a refcount leak in ill_acc_of_setup()
+    - iavf: stop leaking iavf_status as "errno" values
+    - macvtap: advertise link netns via netlink
+    - platform/x86: thinkpad_acpi: Add dual fan probe
+    - tuntap: add sanity checks about msg_controllen in sendmsg
+    - Bluetooth: mediatek: fix the conflict between mtk and msft vendor event
+    - Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg}
+    - Bluetooth: use memset avoid memory leaks
+    - bnxt_en: Eliminate unintended link toggle during FW reset
+    - PCI: endpoint: Fix misused goto label
+    - MIPS: fix fortify panic when copying asm exception handlers
+    - powerpc/code-patching: Pre-map patch area
+    - powerpc/64e: Tie PPC_BOOK3E_64 to PPC_FSL_BOOK3E
+    - powerpc/secvar: fix refcount leak in format_show()
+    - scsi: libfc: Fix use after free in fc_exch_abts_resp()
+    - platform/x86: x86-android-tablets: Depend on EFI and SPI
+    - can: isotp: set default value for N_As to 50 micro seconds
+    - can: etas_es58x: es58x_fd_rx_event_msg(): initialize rx_event_msg before
+      calling es58x_check_msg_len()
+    - riscv: Fixed misaligned memory access. Fixed pointer comparison.
+    - net: account alternate interface name memory
+    - net: limit altnames to 64k total
+    - net/mlx5e: Remove overzealous validations in netlink EEPROM query
+    - platform/x86: hp-wmi: Fix SW_TABLET_MODE detection method
+    - platform/x86: hp-wmi: Fix 0x05 error code reported by several WMI calls
+    - net: sfp: add 2500base-X quirk for Lantech SFP module
+    - usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
+    - xen/usb: harden xen_hcd against malicious backends
+    - mt76: fix monitor mode crash with sdio driver
+    - xtensa: fix DTC warning unit_address_format
+    - iwlwifi: mei: fix building iwlmei
+    - MIPS: ingenic: correct unit node address
+    - Bluetooth: Fix use after free in hci_send_acl
+    - netfilter: conntrack: revisit gc autotuning
+    - netlabel: fix out-of-bounds memory accesses
+    - ceph: fix inode reference leakage in ceph_get_snapdir()
+    - ceph: fix memory leak in ceph_readdir when note_last_dentry returns error
+    - lib/Kconfig.debug: add ARCH dependency for FUNCTION_ALIGN option
+    - init/main.c: return 1 from handled __setup() functions
+    - minix: fix bug when opening a file with O_DIRECT
+    - clk: si5341: fix reported clk_rate when output divider is 2
+    - clk: mediatek: Fix memory leaks on probe
+    - staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances
+    - staging: vchiq_core: handle NULL result of find_service_by_handle
+    - phy: amlogic: phy-meson-gxl-usb2: fix shared reset controller use
+    - phy: amlogic: meson8b-usb2: Use dev_err_probe()
+    - phy: amlogic: meson8b-usb2: fix shared reset control use
+    - clk: rockchip: drop CLK_SET_RATE_PARENT from dclk_vop* on rk3568
+    - cpufreq: CPPC: Fix performance/frequency conversion
+    - opp: Expose of-node's name in debugfs
+    - staging: wfx: apply the necessary SDIO quirks for the Silabs WF200
+    - staging: wfx: fix an error handling in wfx_init_common()
+    - w1: w1_therm: fixes w1_seq for ds28ea00 sensors
+    - NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify()
+    - NFSv4: Protect the state recovery thread against direct reclaim
+    - habanalabs: fix possible memory leak in MMU DR fini
+    - habanalabs: reject host map with mmu disabled
+    - habanalabs/gaudi: handle axi errors from NIC engines
+    - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32
+    - clk: ti: Preserve node in ti_dt_clocks_register()
+    - clk: Enforce that disjoints limits are invalid
+    - SUNRPC/xprt: async tasks mustn't block waiting for memory
+    - SUNRPC: remove scheduling boost for "SWAPPER" tasks.
+    - NFS: swap IO handling is slightly different for O_DIRECT IO
+    - NFS: swap-out must always use STABLE writes.
+    - x86: Annotate call_on_stack()
+    - x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy
+    - serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
+    - virtio_console: eliminate anonymous module_init & module_exit
+    - jfs: prevent NULL deref in diFree
+    - SUNRPC: Fix socket waits for write buffer space
+    - NFS: nfsiod should not block forever in mempool_alloc()
+    - NFS: Avoid writeback threads getting stuck in mempool_alloc()
+    - selftests: net: Add tls config dependency for tls selftests
+    - parisc: Fix CPU affinity for Lasi, WAX and Dino chips
+    - parisc: Fix patch code locking and flushing
+    - mm: fix race between MADV_FREE reclaim and blkdev direct IO read
+    - drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire()
+    - Drivers: hv: vmbus: Fix initialization of device object in
+      vmbus_device_register()
+    - Drivers: hv: vmbus: Fix potential crash on module unload
+    - netfilter: bitwise: fix reduce comparisons
+    - Revert "NFSv4: Handle the special Linux file open access mode"
+    - NFSv4: fix open failure with O_ACCMODE flag
+    - scsi: core: scsi_logging: Fix a BUG
+    - scsi: sr: Fix typo in CDROM(CLOSETRAY|EJECT) handling
+    - scsi: core: Fix sbitmap depth in scsi_realloc_sdev_budget_map()
+    - scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
+    - vdpa: mlx5: prevent cvq work from hogging CPU
+    - net: sfc: add missing xdp queue reinitialization
+    - net/tls: fix slab-out-of-bounds bug in decrypt_internal
+    - vrf: fix packet sniffing for traffic originating from ip tunnels
+    - skbuff: fix coalescing for page_pool fragment recycling
+    - Revert "net: dsa: stop updating master MTU from master.c"
+    - ice: Clear default forwarding VSI during VSI release
+    - ice: Fix MAC address setting
+    - mctp: Fix check for dev_hard_header() result
+    - mctp: Use output netdev to allocate skb headroom
+    - net: ipv4: fix route with nexthop object delete warning
+    - net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
+    - drm/imx: imx-ldb: Check for null pointer after calling kmemdup
+    - drm/imx: Fix memory leak in imx_pd_connector_get_modes
+    - drm/imx: dw_hdmi-imx: Fix bailout in error cases of probe
+    - regulator: rtq2134: Fix missing active_discharge_on setting
+    - spi: rpc-if: Fix RPM imbalance in probe error path
+    - regulator: atc260x: Fix missing active_discharge_on setting
+    - arch/arm64: Fix topology initialization for core scheduling
+    - bnxt_en: Synchronize tx when xdp redirects happen on same ring
+    - bnxt_en: reserve space inside receive page for skb_shared_info
+    - bnxt_en: Prevent XDP redirect from running when stopping TX queue
+    - sfc: Do not free an empty page_ring
+    - RDMA/mlx5: Don't remove cache MRs when a delay is needed
+    - RDMA/mlx5: Add a missing update of cache->last_add
+    - IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD
+    - cifs: fix potential race with cifsd thread
+    - IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition
+    - sctp: count singleton chunks in assoc user stats
+    - dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe
+    - ice: Set txq_teid to ICE_INVAL_TEID on ring creation
+    - ice: Do not skip not enabled queues in ice_vc_dis_qs_msg
+    - ipv6: Fix stats accounting in ip6_pkt_drop
+    - ice: synchronize_rcu() when terminating rings
+    - ice: xsk: fix VSI state check in ice_xsk_wakeup()
+    - ice: clear cmd_type_offset_bsz for TX rings
+    - net: openvswitch: don't send internal clone attribute to the userspace.
+    - net: ethernet: mv643xx: Fix over zealous checking of_get_mac_address()
+    - net: openvswitch: fix leak of nested actions
+    - rxrpc: fix a race in rxrpc_exit_net()
+    - net: sfc: fix using uninitialized xdp tx_queue
+    - net: phy: mscc-miim: reject clause 45 register accesses
+    - qede: confirm skb is allocated before using
+    - spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op()
+    - drm/amd/display: Fix for dmub outbox notification enable
+    - drm/amd/display: Remove redundant dsc power gating from init_hw
+    - bpf: Support dual-stack sockets in bpf_tcp_check_syncookie
+    - drbd: Fix five use after free bugs in get_initial_state
+    - scsi: sd: sd_read_cpr() requires VPD pages
+    - scsi: ufs: ufshpb: Fix a NULL check on list iterator
+    - io_uring: nospec index for tags on files update
+    - io_uring: don't touch scm_fp_list after queueing skb
+    - SUNRPC: Handle ENOMEM in call_transmit_status()
+    - SUNRPC: Handle low memory situations in call_status()
+    - SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec()
+    - iommu/omap: Fix regression in probe for NULL pointer dereference
+    - perf unwind: Don't show unwind error messages when augmenting frame pointer
+      stack
+    - perf: arm-spe: Fix perf report --mem-mode
+    - perf tools: Fix perf's libperf_print callback
+    - perf session: Remap buf if there is no space for event
+    - arm64: Add part number for Arm Cortex-A78AE
+    - scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove()
+    - scsi: ufs: ufs-pci: Add support for Intel MTL
+    - Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
+    - mmc: block: Check for errors after write on SPI
+    - mmc: mmci: stm32: correctly check all elements of sg list
+    - mmc: renesas_sdhi: special 4tap settings only apply to HS400
+    - mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is
+      complete
+    - mmc: core: Fixup support for writeback-cache for eMMC and SD
+    - lz4: fix LZ4_decompress_safe_partial read out of bound
+    - highmem: fix checks in __kmap_local_sched_{in,out}
+    - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
+    - mm/mempolicy: fix mpol_new leak in shared_policy_replace
+    - io_uring: don't check req->file in io_fsync_prep()
+    - io_uring: defer splice/tee file validity check until command issue
+    - io_uring: implement compat handling for IORING_REGISTER_IOWQ_AFF
+    - io_uring: fix race between timeout flush and removal
+    - x86/pm: Save the MSR validity status at context setup
+    - x86/speculation: Restore speculation related MSRs during S3 resume
+    - perf/x86/intel: Update the FRONTEND MSR mask on Sapphire Rapids
+    - btrfs: fix qgroup reserve overflow the qgroup limit
+    - btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone
+    - btrfs: remove device item and update super block in the same transaction
+    - btrfs: avoid defragging extents whose next extents are not targets
+    - btrfs: prevent subvol with swapfile from being deleted
+    - spi: core: add dma_map_dev for __spi_unmap_msg()
+    - cifs: force new session setup and tcon for dfs
+    - qed: fix ethtool register dump
+    - arm64: patch_text: Fixup last cpu should be master
+    - RDMA/hfi1: Fix use-after-free bug for mm struct
+    - drbd: fix an invalid memory access caused by incorrect use of list iterator
+    - gpio: Restrict usage of GPIO chip irq members before initialization
+    - x86/msi: Fix msi message data shadow struct
+    - x86/mm/tlb: Revert retpoline avoidance approach
+    - perf/x86/intel: Don't extend the pseudo-encoding to GP counters
+    - ata: sata_dwc_460ex: Fix crash due to OOB write
+    - perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
+    - perf/core: Inherit event_caps
+    - irqchip/gic-v3: Fix GICR_CTLR.RWP polling
+    - fbdev: Fix unregistering of framebuffers without device
+    - amd/display: set backlight only if required
+    - drm/panel: ili9341: fix optional regulator handling
+    - drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw
+    - drm/amdgpu/display: change pipe policy for DCN 2.1
+    - drm/amdgpu/smu10: fix SoC/fclk units in auto mode
+    - drm/amdgpu/vcn: Fix the register setting for vcn1
+    - drm/nouveau/pmu: Add missing callbacks for Tegra devices
+    - drm/amdkfd: Create file descriptor after client is added to smi_clients list
+    - drm/amdgpu: don't use BACO for reset in S3
+    - SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
+    - Revert "ACPI: processor: idle: Only flush cache on entering C3"
+    - drm/amdkfd: Fix variable set but not used warning
+    - net/smc: send directly on setting TCP_NODELAY
+    - Revert "selftests: net: Add tls config dependency for tls selftests"
+    - bpf: Make remote_port field in struct bpf_sk_lookup 16-bit wide
+    - selftests/bpf: Fix u8 narrow load checks for bpf_sk_lookup remote_port
+    - bpf: Treat bpf_sk_lookup remote_port as a 2-byte field
+    - perf build: Don't use -ffat-lto-objects in the python feature test when
+      building with clang-13
+    - perf python: Fix probing for some clang command line options
+    - tools build: Filter out options and warnings not supported by clang
+    - tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
+    - dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
+    - KVM: avoid NULL pointer dereference in kvm_dirty_ring_push
+    - Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb()
+    - powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit
+    - Revert "powerpc: Set max_mapnr correctly"
+    - x86/bug: Prevent shadowing in __WARN_FLAGS
+    - objtool: Fix SLS validation for kcov tail-call replacement
+    - sched/core: Fix forceidle balancing
+    - sched: Teach the forced-newidle balancer about CPU affinity limitation.
+    - x86,static_call: Fix __static_call_return0 for i386
+    - x86/extable: Prefer local labels in .set directives
+    - irqchip/gic-v4: Wait for GICR_VPENDBASER.Dirty to clear before descheduling
+    - powerpc/64: Fix build failure with allyesconfig in book3s_64_entry.S
+    - irqchip/gic, gic-v3: Prevent GSI to SGI translations
+    - mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
+    - static_call: Don't make __static_call_return0 static
+    - io_uring: move read/write file prep state into actual opcode handler
+    - io_uring: propagate issue_flags state down to file assignment
+    - io_uring: defer file assignment
+    - io_uring: drop the old style inflight file tracking
+    - Linux 5.17.3
+
+  * Jammy update: v5.17.2 upstream stable release Edit (LP: #1968984)
+    - Revert "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
+    - USB: serial: pl2303: add IBM device IDs
+    - dt-bindings: usb: hcd: correct usb-device path
+    - USB: serial: pl2303: fix GS type detection
+    - USB: serial: simple: add Nokia phone driver
+    - mm: kfence: fix missing objcg housekeeping for SLAB
+    - locking/lockdep: Avoid potential access of invalid memory in lock_class
+    - drm/amdgpu: move PX checking into amdgpu_device_ip_early_init
+    - drm/amdgpu: only check for _PR3 on dGPUs
+    - iommu/iova: Improve 32-bit free space estimate
+    - block: flush plug based on hardware and software queue order
+    - block: ensure plug merging checks the correct queue at least once
+    - usb: typec: tipd: Forward plug orientation to typec subsystem
+    - USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
+    - xhci: fix garbage USBSTS being logged in some cases
+    - xhci: fix runtime PM imbalance in USB2 resume
+    - xhci: make xhci_handshake timeout for xhci_reset() adjustable
+    - xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx()
+    - mei: me: disable driver on the ign firmware
+    - mei: me: add Alder Lake N device id.
+    - mei: avoid iterator usage outside of list_for_each_entry
+    - bus: mhi: pci_generic: Add mru_default for Quectel EM1xx series
+    - bus: mhi: Fix pm_state conversion to string
+    - bus: mhi: Fix MHI DMA structure endianness
+    - docs: sphinx/requirements: Limit jinja2<3.1
+    - coresight: Fix TRCCONFIGR.QE sysfs interface
+    - coresight: syscfg: Fix memleak on registration failure in
+      cscfg_create_device
+    - dt-bindings: iio: adc: zynqmp_ams: Add clock entry
+    - iio: adc: xilinx-ams: Fix single channel switching sequence
+    - iio: accel: mma8452: use the correct logic to get mma8452_data
+    - iio: adc: aspeed: Add divider flag to fix incorrect voltage reading.
+    - iio: imu: st_lsm6dsx: use dev_to_iio_dev() to get iio_dev struct
+    - iio: afe: rescale: use s64 for temporary scale calculations
+    - iio: adc: xilinx-ams: Fixed missing PS channels
+    - iio: adc: xilinx-ams: Fixed wrong sequencer register settings
+    - iio: inkern: apply consumer scale on IIO_VAL_INT cases
+    - iio: inkern: apply consumer scale when no channel scale is available
+    - iio: inkern: make a best effort on offset calculation
+    - greybus: svc: fix an error handling bug in gb_svc_hello()
+    - clk: rockchip: re-add rational best approximation algorithm to the
+      fractional divider
+    - clk: uniphier: Fix fixed-rate initialization
+    - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
+    - cifs: truncate the inode and mapping when we simulate fcollapse
+    - cifs: fix handlecache and multiuser
+    - cifs: we do not need a spinlock around the tree access during umount
+    - KEYS: fix length validation in keyctl_pkey_params_get_2()
+    - KEYS: asymmetric: enforce that sig algo matches key algo
+    - KEYS: asymmetric: properly validate hash_algo and encoding
+    - Documentation: add link to stable release candidate tree
+    - Documentation: update stable tree link
+    - firmware: stratix10-svc: add missing callback parameter on RSU
+    - firmware: sysfb: fix platform-device leak in error path
+    - HID: intel-ish-hid: Use dma_alloc_coherent for firmware update
+    - SUNRPC: avoid race between mod_timer() and del_timer_sync()
+    - SUNRPC: Do not dereference non-socket transports in sysfs
+    - NFS: NFSv2/v3 clients should never be setting NFS_CAP_XATTR
+    - NFSD: prevent underflow in nfssvc_decode_writeargs()
+    - NFSD: prevent integer overflow on 32 bit systems
+    - f2fs: fix to unlock page correctly in error path of is_alive()
+    - f2fs: quota: fix loop condition at f2fs_quota_sync()
+    - f2fs: fix to do sanity check on .cp_pack_total_block_count
+    - remoteproc: Fix count check in rproc_coredump_write()
+    - mm/mlock: fix two bugs in user_shm_lock()
+    - pinctrl: ingenic: Fix regmap on X series SoCs
+    - pinctrl: samsung: drop pin banks references on error paths
+    - net: bnxt_ptp: fix compilation error
+    - spi: mxic: Fix the transmit path
+    - mtd: spi-nor: Skip erase logic when SPI_NOR_NO_ERASE is set
+    - mtd: rawnand: protect access to rawnand devices while in suspend
+    - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
+    - can: m_can: m_can_tx_handler(): fix use after free of skb
+    - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error
+      path
+    - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
+    - jffs2: fix memory leak in jffs2_do_mount_fs
+    - jffs2: fix memory leak in jffs2_scan_medium
+    - mm: fs: fix lru_cache_disabled race in bh_lru
+    - mm: don't skip swap entry even if zap_details specified
+    - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
+    - mm: invalidate hwpoison page cache page in fault path
+    - mempolicy: mbind_range() set_policy() after vma_merge()
+    - scsi: core: sd: Add silence_suspend flag to suppress some PM messages
+    - scsi: ufs: Fix runtime PM messages never-ending cycle
+    - scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters
+    - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
+    - qed: display VF trust config
+    - qed: validate and restrict untrusted VFs vlan promisc mode
+    - riscv: dts: canaan: Fix SPI3 bus width
+    - riscv: Fix fill_callchain return value
+    - riscv: Increase stack size under KASAN
+    - RISC-V: Declare per cpu boot data as static
+    - Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
+    - cifs: do not skip link targets when an I/O fails
+    - cifs: fix incorrect use of list iterator after the loop
+    - cifs: prevent bad output lengths in smb2_ioctl_query_info()
+    - cifs: fix NULL ptr dereference in smb2_ioctl_query_info()
+    - ALSA: cs4236: fix an incorrect NULL check on list iterator
+    - ALSA: hda: Avoid unsol event during RPM suspending
+    - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
+    - ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020
+    - rtc: mc146818-lib: fix locking in mc146818_set_time
+    - rtc: pl031: fix rtc features null pointer dereference
+    - io_uring: ensure that fsnotify is always called
+    - ocfs2: fix crash when mount with quota enabled
+    - drm/simpledrm: Add "panel orientation" property on non-upright mounted LCD
+      panels
+    - mm: madvise: skip unmapped vma holes passed to process_madvise
+    - mm: madvise: return correct bytes advised with process_madvise
+    - Revert "mm: madvise: skip unmapped vma holes passed to process_madvise"
+    - mm,hwpoison: unmap poisoned page before invalidation
+    - mm: only re-generate demotion targets when a numa node changes its N_CPU
+      state
+    - mm/kmemleak: reset tag when compare object pointer
+    - dm stats: fix too short end duration_ns when using precise_timestamps
+    - dm: fix use-after-free in dm_cleanup_zoned_dev()
+    - dm: interlock pending dm_io and dm_wait_for_bios_completion
+    - dm: fix double accounting of flush with data
+    - dm integrity: set journal entry unused when shrinking device
+    - tracing: Have trace event string test handle zero length strings
+    - drbd: fix potential silent data corruption
+    - can: isotp: sanitize CAN ID checks in isotp_bind()
+    - PCI: fu740: Force 2.5GT/s for initial device probe
+    - arm64: signal: nofpsimd: Do not allocate fp/simd context when not available
+    - arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory
+      zones
+    - arm64: dts: qcom: sm8250: Fix MSI IRQ for PCIe1 and PCIe2
+    - arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-am64: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-j721s2: Fix gic-v3 compatible regs
+    - ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
+    - mmc: core: use sysfs_emit() instead of sprintf()
+    - Revert "ACPI: Pass the same capabilities to the _OSC regardless of the query
+      flag"
+    - ACPI: properties: Consistently return -ENOENT if there are no more
+      references
+    - coredump: Also dump first pages of non-executable ELF libraries
+    - ext4: fix ext4_fc_stats trace point
+    - ext4: fix fs corruption when tring to remove a non-empty directory with IO
+      error
+    - ext4: make mb_optimize_scan option work with set/unset mount cmd
+    - ext4: make mb_optimize_scan performance mount option work with extents
+    - samples/landlock: Fix path_list memory leak
+    - landlock: Use square brackets around "landlock-ruleset"
+    - mailbox: tegra-hsp: Flush whole channel
+    - btrfs: zoned: put block group after final usage
+    - block: fix rq-qos breakage from skipping rq_qos_done_bio()
+    - block: limit request dispatch loop duration
+    - block: don't merge across cgroup boundaries if blkcg is enabled
+    - drm/edid: check basic audio support on CEA extension block
+    - fbdev: Hot-unplug firmware fb devices on forced removal
+    - video: fbdev: sm712fb: Fix crash in smtcfb_read()
+    - video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
+    - rfkill: make new event layout opt-in
+    - ARM: dts: at91: sama7g5: Remove unused properties in i2c nodes
+    - ARM: dts: at91: sama5d2: Fix PMERRLOC resource size
+    - ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
+    - ARM: dts: exynos: add missing HDMI supplies on SMDK5250
+    - ARM: dts: exynos: add missing HDMI supplies on SMDK5420
+    - mgag200 fix memmapsl configuration in GCTL6 register
+    - carl9170: fix missing bit-wise or operator for tx_params
+    - pstore: Don't use semaphores in always-atomic-context code
+    - thermal: int340x: Increase bitmap size
+    - lib/raid6/test: fix multiple definition linking error
+    - exec: Force single empty string when argv is empty
+    - crypto: rsa-pkcs1pad - only allow with rsa
+    - crypto: rsa-pkcs1pad - correctly get hash from source scatterlist
+    - crypto: rsa-pkcs1pad - restore signature length check
+    - crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete()
+    - bcache: fixup multiple threads crash
+    - PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove()
+    - DEC: Limit PMAX memory probing to R3k systems
+    - media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC
+    - media: omap3isp: Use struct_group() for memcpy() region
+    - media: venus: vdec: fixed possible memory leak issue
+    - media: venus: hfi_cmds: List HDR10 property as unsupported for v1 and v3
+    - media: venus: venc: Fix h264 8x8 transform control
+    - media: davinci: vpif: fix unbalanced runtime PM get
+    - media: davinci: vpif: fix unbalanced runtime PM enable
+    - media: davinci: vpif: fix use-after-free on driver unbind
+    - mips: Always permit to build u-boot images
+    - btrfs: zoned: mark relocation as writing
+    - btrfs: extend locking to all space_info members accesses
+    - btrfs: verify the tranisd of the to-be-written dirty extent buffer
+    - xtensa: define update_mmu_tlb function
+    - xtensa: fix stop_machine_cpuslocked call in patch_text
+    - xtensa: fix xtensa_wsr always writing 0
+    - KVM: s390x: fix SCK locking
+    - drm/syncobj: flatten dma_fence_chains on transfer
+    - drm/nouveau/backlight: Fix LVDS backlight detection on some laptops
+    - drm/nouveau/backlight: Just set all backlight types as RAW
+    - drm/fb-helper: Mark screen buffers in system memory with FBINFO_VIRTFB
+    - brcmfmac: firmware: Allocate space for default boardrev in nvram
+    - brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path
+    - brcmfmac: pcie: Declare missing firmware files in pcie.c
+    - brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
+    - brcmfmac: pcie: Fix crashes due to early IRQs
+    - drm/i915/opregion: check port number bounds for SWSCI display power state
+    - drm/i915/gem: add missing boundary check in vm_access
+    - PCI: imx6: Allow to probe when dw_pcie_wait_for_link() fails
+    - PCI: pciehp: Clear cmd_busy bit in polling mode
+    - PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup"
+    - PCI: xgene: Revert "PCI: xgene: Fix IB window setup"
+    - regulator: qcom_smd: fix for_each_child.cocci warnings
+    - selinux: access superblock_security_struct in LSM blob way
+    - selinux: check return value of sel_make_avc_files
+    - crypto: ccp - Ensure psp_ret is always init'd in
+      __sev_platform_init_locked()
+    - crypto: qat - fix a signedness bug in get_service_enabled()
+    - hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER
+    - crypto: sun8i-ss - really disable hash on A80
+    - crypto: kdf - Select hmac in addition to sha256
+    - crypto: qat - fix access to PFVF interrupt registers for GEN4
+    - crypto: authenc - Fix sleep in atomic context in decrypt_tail
+    - crypto: octeontx2 - select CONFIG_NET_DEVLINK
+    - crypto: mxs-dcp - Fix scatterlist processing
+    - selinux: Fix selinux_sb_mnt_opts_compat()
+    - thermal: int340x: Check for NULL after calling kmemdup()
+    - crypto: octeontx2 - remove CONFIG_DM_CRYPT check
+    - spi: tegra114: Add missing IRQ check in tegra_spi_probe
+    - spi: tegra210-quad: Fix missin IRQ check in tegra_qspi_probe
+    - perf: MARVELL_CN10K_TAD_PMU should depend on ARCH_THUNDER
+    - selftests/sgx: Fix NULL-pointer-dereference upon early test failure
+    - selftests/sgx: Do not attempt enclave build without valid enclave
+    - selftests/sgx: Ensure enclave data available during debug print
+    - stack: Constrain and fix stack offset randomization with Clang builds
+    - arm64/mm: avoid fixmap race condition when create pud mapping
+    - security: add sctp_assoc_established hook
+    - blk-cgroup: set blkg iostat after percpu stat aggregation
+    - selftests/x86: Add validity check and allow field splitting
+    - selftests/sgx: Treat CC as one argument
+    - crypto: rockchip - ECB does not need IV
+    - block: update io_ticks when io hang
+    - audit: log AUDIT_TIME_* records only from rules
+    - EVM: fix the evm= __setup handler return value
+    - crypto: ccree - don't attempt 0 len DMA mappings
+    - crypto: hisilicon/sec - fix the aead software fallback for engine
+    - spi: pxa2xx-pci: Balance reference count for PCI DMA device
+    - hwmon: (pmbus) Add mutex to regulator ops
+    - hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
+    - nvme: cleanup __nvme_check_ids
+    - nvme: fix the check for duplicate unique identifiers
+    - block: don't delete queue kobject before its children
+    - PM: hibernate: fix __setup handler error handling
+    - PM: suspend: fix return value of __setup handler
+    - spi: spi-zynqmp-gqspi: Handle error for dma_set_mask
+    - hwrng: atmel - disable trng on failure path
+    - crypto: sun8i-ss - call finalize with bh disabled
+    - crypto: sun8i-ce - call finalize with bh disabled
+    - crypto: amlogic - call finalize with bh disabled
+    - crypto: gemini - call finalize with bh disabled
+    - crypto: vmx - add missing dependencies
+    - clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix
+    - clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts
+    - clocksource/drivers/timer-microchip-pit64b: Use notrace
+    - clocksource/drivers/timer-of: Check return value of of_iomap in
+      timer_of_base_init()
+    - arm64: prevent instrumentation of bp hardening callbacks
+    - perf/arm-cmn: Hide XP PUB events for CMN-600
+    - perf/arm-cmn: Update watchpoint format
+    - KEYS: trusted: Fix trusted key backends when building as module
+    - KEYS: trusted: Avoid calling null function trusted_key_exit
+    - ACPI: APEI: fix return value of __setup handlers
+    - crypto: ccp - ccp_dmaengine_unregister release dma channels
+    - crypto: ccree - Fix use after free in cc_cipher_exit()
+    - crypto: qat - fix initialization of pfvf cap_msg structures
+    - crypto: qat - fix initialization of pfvf rts_map_msg structures
+    - hwrng: nomadik - Change clk_disable to clk_disable_unprepare
+    - hwmon: (pmbus) Add Vin unit off handling
+    - clocksource: acpi_pm: fix return value of __setup handler
+    - io_uring: don't check unrelated req->open.how in accept request
+    - io_uring: terminate manual loop iterator loop correctly for non-vecs
+    - watch_queue: Fix NULL dereference in error cleanup
+    - watch_queue: Actually free the watch
+    - f2fs: fix to enable ATGC correctly via gc_idle sysfs interface
+    - sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
+    - sched/core: Export pelt_thermal_tp
+    - sched/sugov: Ignore 'busy' filter when rq is capped by uclamp_max
+    - sched/uclamp: Fix iowait boost escaping uclamp restriction
+    - rseq: Remove broken uapi field layout on 32-bit little endian
+    - perf/core: Fix address filter parser for multiple filters
+    - perf/x86/intel/pt: Fix address filter config for 32-bit kernel
+    - sched/fair: Improve consistency of allowed NUMA balance calculations
+    - f2fs: fix missing free nid in f2fs_handle_failed_inode
+    - ext4: fix remount with 'abort' option
+    - nfsd: more robust allocation failure handling in nfsd_file_cache_init
+    - sched/cpuacct: Fix charge percpu cpuusage
+    - sched/rt: Plug rt_mutex_setprio() vs push_rt_task() race
+    - f2fs: fix to avoid potential deadlock
+    - btrfs: fix unexpected error path when reflinking an inline extent
+    - iomap: Fix iomap_invalidatepage tracepoint
+    - fs: erofs: add sanity check for kobject in erofs_unregister_sysfs
+    - f2fs: fix compressed file start atomic write may cause data corruption
+    - cifs: use a different reconnect helper for non-cifsd threads
+    - selftests, x86: fix how check_cc.sh is being invoked
+    - drivers/base/memory: add memory block to memory group after registration
+      succeeded
+    - kunit: make kunit_test_timeout compatible with comment
+    - pinctrl: samsung: Remove EINT handler for Exynos850 ALIVE and CMGP gpios
+    - media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size
+    - media: camss: csid-170: fix non-10bit formats
+    - media: camss: csid-170: don't enable unused irqs
+    - media: camss: csid-170: set the right HALT_CMD when disabled
+    - media: camss: vfe-170: fix "VFE halt timeout" error
+    - media: staging: media: imx: imx7-mipi-csis: Make subdev name unique
+    - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
+    - media: mtk-vcodec: potential dereference of null pointer
+    - media: imx: imx8mq-mipi-csi2: remove wrong irq config write operation
+    - media: imx: imx8mq-mipi_csi2: fix system resume
+    - media: bttv: fix WARNING regression on tunerless devices
+    - media: atmel: atmel-sama7g5-isc: fix ispck leftover
+    - ASoC: sh: rz-ssi: Drop calling rz_ssi_pio_recv() recursively
+    - ASoC: codecs: Check for error pointer after calling devm_regmap_init_mmio
+    - ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting
+    - ASoC: simple-card-utils: Set sysclk on all components
+    - memory: tegra20-emc: Correct memory device mask
+    - media: coda: Fix missing put_device() call in coda_get_vdoa_data
+    - media: meson: vdec: potential dereference of null pointer
+    - media: hantro: Fix overfill bottom register field name
+    - media: ov6650: Fix set format try processing path
+    - media: v4l: Avoid unaligned access warnings when printing 4cc modifiers
+    - media: ov5648: Don't pack controls struct
+    - media: ov2740: identify module after subdev initialisation
+    - media: aspeed: Correct value for h-total-pixels
+    - video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to
+      avoid black screen
+    - video: fbdev: controlfb: Fix COMPILE_TEST build
+    - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
+    - video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe()
+    - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
+    - ARM: dts: Fix OpenBMC flash layout label addresses
+    - ASoC: max98927: add missing header file
+    - arm64: dts: qcom: sc7280: Fix gmu unit address
+    - firmware: qcom: scm: Remove reassignment to desc following initializer
+    - ARM: dts: qcom: ipq4019: fix sleep clock
+    - soc: qcom: rpmpd: Check for null return of devm_kcalloc
+    - soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem
+    - soc: qcom: aoss: Fix missing put_device call in qmp_get
+    - soc: qcom: aoss: remove spurious IRQF_ONESHOT flags
+    - arm64: dts: qcom: sdm845: fix microphone bias properties and values
+    - arm64: dts: qcom: sm8250: fix PCIe bindings to follow schema
+    - arm64: dts: qcom: msm8916-j5: Fix typo
+    - arm64: dts: broadcom: bcm4908: use proper TWD binding
+    - arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc
+    - arm64: dts: qcom: sm8350: Correct TCS configuration for apps rsc
+    - arm64: dts: qcom: sm8450: Update cpuidle states parameters
+    - arm64: dts: qcom: msm8994: Provide missing "xo_board" and "sleep_clk" to GCC
+    - arm64: dts: qcom: ipq6018: fix usb reference period
+    - firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not
+      defined
+    - soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
+    - cpuidle: qcom-spm: Check if any CPU is managed by SPM
+    - ARM: dts: sun8i: v3s: Move the csi1 block to follow address order
+    - ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
+    - vsprintf: Fix potential unaligned access
+    - ARM: dts: qcom: sdx55: Fix the address used for PCIe EP local addr space
+    - ARM: dts: imx: Add missing LVDS decoder on M53Menlo
+    - media: mexon-ge2d: fixup frames size in registers
+    - media: video/hdmi: handle short reads of hdmi info frame.
+    - media: ti-vpe: cal: Fix a NULL pointer dereference in
+      cal_ctx_v4l2_init_formats()
+    - media: em28xx: initialize refcount before kref_get
+    - media: uapi: Init VP9 stateless decode params
+    - media: usb: go7007: s2250-board: fix leak in probe()
+    - media: cedrus: H265: Fix neighbour info buffer size
+    - media: cedrus: h264: Fix neighbour info buffer size
+    - arm64: dts: ti: k3-j721s2-mcu-wakeup: Fix the interrupt-parent for
+      wkup_gpioX instances
+    - ASoC: codecs: rx-macro: fix accessing compander for aux
+    - ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type
+    - ASoC: codecs: va-macro: fix accessing array out of bounds for enum type
+    - ASoC: codecs: wc938x: fix accessing array out of bounds for enum type
+    - ASoC: codecs: wcd938x: fix kcontrol max values
+    - ASoC: codecs: wcd934x: fix kcontrol max values
+    - ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put
+    - media: v4l2-core: Initialize h264 scaling matrix
+    - media: hantro: sunxi: Fix VP9 steps
+    - media: ov5640: Fix set format, v4l2_mbus_pixelcode not updated
+    - selftests: vm: remove dependecy from internal kernel macros
+    - selftests/lkdtm: Add UBSAN config
+    - vsprintf: Fix %pK with kptr_restrict == 0
+    - uaccess: fix nios2 and microblaze get_user_8()
+    - ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp()
+    - ASoC: acp: check the return value of devm_kzalloc() in
+      acp_legacy_dai_links_create()
+    - soc: mediatek: pm-domains: Add wakeup capacity support in power domain
+    - mmc: sdhci_am654: Fix the driver data of AM64 SoC
+    - ASoC: ti: davinci-i2s: Add check for clk_enable()
+    - ALSA: spi: Add check for clk_enable()
+    - arm64: dts: ns2: Fix spi-cpol and spi-cpha property
+    - arm64: dts: broadcom: Fix sata nodename
+    - printk: fix return value of printk.devkmsg __setup handler
+    - ASoC: mxs-saif: Handle errors for clk_enable
+    - ASoC: atmel_ssc_dai: Handle errors for clk_enable
+    - ASoC: dwc-i2s: Handle errors for clk_enable
+    - ASoC: soc-compress: prevent the potentially use of null pointer
+    - media: i2c: Fix pixel array positions in ov8865
+    - memory: emif: Add check for setup_interrupts
+    - memory: emif: check the pointer temp in get_device_details()
+    - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
+    - arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly
+    - m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined
+    - media: stk1160: If start stream fails, return buffers with
+      VB2_BUF_STATE_QUEUED
+    - media: vidtv: Check for null return of vzalloc
+    - ASoC: cs35l41: Fix GPIO2 configuration
+    - ASoC: cs35l41: Fix max number of TX channels
+    - ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
+    - ASoC: wm8350: Handle error for wm8350_register_irq
+    - ASoC: fsi: Add check for clk_enable
+    - video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
+    - media: saa7134: fix incorrect use to determine if list is empty
+    - ivtv: fix incorrect device_caps for ivtvfb
+    - ASoC: atmel: Fix error handling in snd_proto_probe
+    - ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in
+      rockchip_i2s_probe
+    - ASoC: SOF: Add missing of_node_put() in imx8m_probe
+    - ASoC: mediatek: mt8192-mt6359: Fix error handling in mt8192_mt6359_dev_probe
+    - ASoC: rk817: Fix missing clk_disable_unprepare() in rk817_platform_probe
+    - ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
+    - ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
+    - ASoC: fsl_spdif: Disable TX clock when stop
+    - ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
+    - ASoC: SOF: Intel: enable DMI L1 for playback streams
+    - ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in
+      msm8916_wcd_digital_probe
+    - mmc: davinci_mmc: Handle error for clk_enable
+    - rtla/osnoise: Fix osnoise hist stop tracing message
+    - ASoC: rockchip: Fix PM usage reference of rockchip_i2s_tdm_resume
+    - ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe
+    - ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe
+    - ASoC: mediatek: mt8195: Fix error handling in
+      mt8195_mt6359_rt1019_rt5682_dev_probe
+    - ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data
+    - ASoC: amd: Fix reference to PCM buffer address
+    - ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS
+    - ARM: configs: multi_v5_defconfig: re-enable DRM_PANEL and FB_xxx
+    - drm/bridge: sn65dsi83: Fix an error handling path in sn65dsi83_probe()
+    - drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops
+    - drm/meson: Fix error handling when afbcd.ops->init fails
+    - drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
+    - drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe
+    - drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe
+    - drm: bridge: adv7511: Fix ADV7535 HPD enablement
+    - ath11k: add missing of_node_put() to avoid leak
+    - ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
+    - drm/v3d/v3d_drv: Check for error num after setting mask
+    - Bluetooth: hci_sync: unlock on error in hci_inquiry_result_with_rssi_evt()
+    - ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855
+    - drm/panfrost: Check for error num after setting mask
+    - bpftool: Fix error check when calling hashmap__new()
+    - libbpf: Fix possible NULL pointer dereference when destroying skeleton
+    - bpftool: Only set obj->skeleton on complete success
+    - ath11k: fix error code in ath11k_qmi_assign_target_mem_chunk()
+    - udmabuf: validate ubuf->pagecount
+    - bpf: Fix UAF due to race between btf_try_get_module and load_module
+    - drm/selftests/test-drm_dp_mst_helper: Fix memory leak in
+      sideband_msg_req_encode_decode
+    - drm/locking: fix drm_modeset_acquire_ctx kernel-doc
+    - selftests: bpf: Fix bind on used port
+    - Bluetooth: btintel: Fix WBS setting for Intel legacy ROM products
+    - Bluetooth: hci_serdev: call init_rwsem() before p->open()
+    - Bluetooth: mt7921s: fix firmware coredump retrieve
+    - Bluetooth: mt7921s: fix bus hang with wrong privilege
+    - Bluetooth: btmtksdio: refactor btmtksdio_runtime_[suspend|resume]()
+    - Bluetooth: mt7921s: fix btmtksdio_[drv|fw]_pmctrl()
+    - Bluetooth: btmtksdio: mask out interrupt status
+    - mtd: onenand: Check for error irq
+    - mtd: rawnand: gpmi: fix controller timings setting
+    - selftests, xsk: Fix rx_full stats test
+    - drm/edid: Don't clear formats if using deep color
+    - drm/edid: Split deep color modes between RGB and YUV444
+    - ionic: fix type complaint in ionic_dev_cmd_clean()
+    - ionic: start watchdog after all is setup
+    - ionic: Don't send reset commands if FW isn't running
+    - ionic: fix up printing of timeout error
+    - ionic: Correctly print AQ errors if completions aren't received
+    - net: dsa: Move VLAN filtering syncing out of dsa_switch_bridge_leave
+    - net: dsa: Avoid cross-chip syncing of VLAN filtering
+    - Bluetooth: hci_event: Fix HCI_EV_VENDOR max_len
+    - drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl()
+    - drm/amd/display: Call dc_stream_release for remove link enc assignment
+    - drm/amd/display: Fix a NULL pointer dereference in
+      amdgpu_dm_connector_add_common_modes()
+    - drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function
+    - net: phy: at803x: move page selection fix to config_init
+    - selftests/bpf/test_xdp_redirect_multi: use temp netns for testing
+    - ath9k_htc: fix uninit value bugs
+    - ath11k: set WMI_PEER_40MHZ while peer assoc for 6 GHz
+    - RDMA/core: Set MR type in ib_reg_user_mr
+    - KVM: PPC: Fix vmx/vsx mixup in mmio emulation
+    - selftests/net: timestamping: Fix bind_phc check
+    - rtw88: check for validity before using a pointer
+    - rtw88: fix idle mode flow for hw scan
+    - rtw88: fix memory overrun and memory leak during hw_scan
+    - drm/bridge: lt9611: Fix an error handling path in lt9611_probe()
+    - i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - i40e: respect metadata on XSK Rx to skb
+    - ice: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - ice: respect metadata on XSK Rx to skb
+    - igc: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - ixgbe: pass bi->xdp to ixgbe_construct_skb_zc() directly
+    - ixgbe: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - ixgbe: respect metadata on XSK Rx to skb
+    - power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
+    - ray_cs: Check ioremap return value
+    - powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch
+    - KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init
+    - powerpc/perf: Don't use perf_hw_context for trace IMC PMU
+    - mt76: connac: fix sta_rec_wtbl tag len
+    - mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta
+      mode
+    - mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv
+    - mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error
+    - mt76: mt7921: set EDCA parameters with the MCU CE command
+    - mt76: mt7921: do not always disable fw runtime-pm
+    - mt76: mt7921: fix a leftover race in runtime-pm
+    - mt76: mt7615: fix a leftover race in runtime-pm
+    - mt76: mt7915: fix ht mcs in mt7915_mac_add_txs_skb()
+    - mt76: mt7921: fix ht mcs in mt7921_mac_add_txs_skb()
+    - mt76: mt7921s: fix mt7921s_mcu_[fw|drv]_pmctrl
+    - mt76: mt7921e: fix possible probe failure after reboot
+    - mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update
+    - mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update
+    - mt76: mt7915: fix possible memory leak in mt7915_mcu_add_sta
+    - mt76: mt7921s: fix a possible memory leak in mt7921_load_patch
+    - mt76: mt7915: fix mcs_map in mt7915_mcu_set_sta_he_mcs()
+    - mt76: mt7915: fix the nss setting in bitrates
+    - ptp: unregister virtual clocks when unregistering physical clock.
+    - net: dsa: mv88e6xxx: Enable port policy support on 6097
+    - bpf: Fix a btf decl_tag bug when tagging a function
+    - mac80211: limit bandwidth in HE capabilities
+    - scripts/dtc: Call pkg-config POSIXly correct
+    - livepatch: Fix build failure on 32 bits processors
+    - net: asix: add proper error handling of usb read errors
+    - i2c: bcm2835: Fix the error handling in 'bcm2835_i2c_probe()'
+    - mtd: mchp23k256: Add SPI ID table
+    - mtd: mchp48l640: Add SPI ID table
+    - selftests/bpf: Extract syscall wrapper
+    - selftests/bpf: Use "__se_" prefix on architectures without syscall wrapper
+    - igc: avoid kernel warning when changing RX ring parameters
+    - igb: refactor XDP registration
+    - drm/amdgpu: Don't offset by 2 in FRU EEPROM
+    - PCI: aardvark: Fix reading MSI interrupt number
+    - PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge
+    - RDMA/rxe: Check the last packet by RXE_END_MASK
+    - libbpf: Fix signedness bug in btf_dump_array_data()
+    - libbpf: Fix riscv register names
+    - cxl/core: Fix cxl_probe_component_regs() error message
+    - tools/testing/cxl: Fix root port to host bridge assignment
+    - cxl/regs: Fix size of CXL Capability Header Register
+    - Netvsc: Call hv_unmap_memory() in the netvsc_device_remove()
+    - net:enetc: allocate CBD ring data memory using DMA coherent methods
+    - libbpf: Fix compilation warning due to mismatched printf format
+    - rtw88: fix use after free in rtw_hw_scan_update_probe_req()
+    - drm/bridge: dw-hdmi: use safe format when first in bridge chain
+    - power: supply: ab8500: Swap max and overvoltage
+    - libbpf: Fix libbpf.map inheritance chain for LIBBPF_0.7.0
+    - libbpf: Use dynamically allocated buffer when receiving netlink messages
+    - power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
+    - HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
+    - iommu/ipmmu-vmsa: Check for error num after setting mask
+    - drm/bridge: anx7625: Fix overflow issue on reading EDID
+    - ath11k: fix uninitialized rate_idx in ath11k_dp_tx_update_txcompl()
+    - i2c: pasemi: Drop I2C classes from platform driver variant
+    - bpftool: Fix the error when lookup in no-btf maps
+    - drm/amd/pm: enable pm sysfs write for one VF mode
+    - drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug
+    - bpftool: Fix pretty print dump for maps without BTF loaded
+    - libbpf: Fix memleak in libbpf_netlink_recv()
+    - IB/cma: Allow XRC INI QPs to set their local ACK timeout
+    - cxl/core/port: Rename bus.c to port.c
+    - cxl/port: Hold port reference until decoder release
+    - dax: make sure inodes are flushed before destroy cache
+    - selftests: mptcp: add csum mib check for mptcp_connect
+    - iwlwifi: mvm: Don't call iwl_mvm_sta_from_mac80211() with NULL sta
+    - iwlwifi: mvm: don't iterate unadded vifs when handling FW SMPS req
+    - iwlwifi: mvm: align locking in D3 test debugfs
+    - iwlwifi: yoyo: remove DBGI_SRAM address reset writing
+    - iwlwifi: yoyo: Avoid using dram data if allocation failed
+    - iwlwifi: mvm: fix off by one in iwl_mvm_stat_iterator_all_macs()
+    - iwlwifi: Fix -EIO error code that is never returned
+    - iwlwifi: mvm: Fix an error code in iwl_mvm_up()
+    - mtd: rawnand: pl353: Set the nand chip node as the flash node
+    - drm/msm/dp: do not initialize phy until plugin interrupt received
+    - drm/msm/dp: populate connector of struct dp_panel
+    - drm/msm/dp: stop link training after link training 2 failed
+    - drm/msm/dp: always add fail-safe mode into connector mode list
+    - drm/msm/dsi: Use "ref" fw clock instead of global name for VCO parent
+    - drm/msm/dsi/phy: fix 7nm v4.0 settings for C-PHY mode
+    - drm/msm/dpu: add DSPP blocks teardown
+    - drm/msm/dpu: fix dp audio condition
+    - drm/msm/dpu: remove msm_dp cached in dpu_encoder_virt
+    - drm/msm/dp: fix panel bridge attachment
+    - i40e: remove dead stores on XSK hotpath
+    - ath11k: Invalidate cached reo ring entry before accessing it
+    - mips: Enable KCSAN
+    - dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
+    - vfio/pci: fix memory leak during D3hot to D0 transition
+    - vfio/pci: wake-up devices around reset functions
+    - scsi: fnic: Fix a tracing statement
+    - scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
+    - scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
+    - scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
+    - scsi: pm8001: Fix le32 values handling in
+      pm80xx_set_sas_protocol_timer_config()
+    - scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update()
+    - scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req()
+    - scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req()
+    - scsi: pm8001: Fix NCQ NON DATA command task initialization
+    - scsi: pm8001: Fix NCQ NON DATA command completion handling
+    - scsi: pm8001: Fix abort all task initialization
+    - mt76: do not always copy ethhdr in reverse_frag0_hdr_trans
+    - mt76: fix endianness errors in reverse_frag0_hdr_trans
+    - mt76: mt7921s: fix missing fc type/sub-type for 802.11 pkts
+    - net: dsa: realtek-smi: fix kdoc warnings
+    - net: dsa: realtek-smi: move to subdirectory
+    - RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR
+    - drm/amd/display: Remove vupdate_int_entry definition
+    - TOMOYO: fix __setup handlers return values
+    - power: supply: sbs-charger: Don't cancel work that is not initialized
+    - mt76: mt7915: enlarge wcid size to 544
+    - mt76: mt7915: fix the muru tlv issue
+    - drm/dp: Fix OOB read when handling Post Cursor2 register
+    - ext2: correct max file size computing
+    - drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
+    - power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false
+      return
+    - scsi: hisi_sas: Change permission of parameter prot_mask
+    - drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt
+    - bpf, arm64: Call build_prologue() first in first JIT pass
+    - bpf, arm64: Feed byte-offset into bpf line info
+    - xsk: Fix race at socket teardown
+    - RDMA/irdma: Fix netdev notifications for vlan's
+    - RDMA/irdma: Fix Passthrough mode in VM
+    - RDMA/irdma: Remove incorrect masking of PD
+    - libbpf: Fix BPF_MAP_TYPE_PERF_EVENT_ARRAY auto-pinning
+    - gpu: host1x: Fix an error handling path in 'host1x_probe()'
+    - gpu: host1x: Fix a memory leak in 'host1x_remove()'
+    - libbpf: Skip forward declaration when counting duplicated type names
+    - powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties()
+    - powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit
+    - KVM: x86: Fix emulation in writing cr8
+    - KVM: x86/emulator: Defer not-present segment check in
+      __load_segment_descriptor()
+    - KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors
+    - hv_balloon: rate-limit "Unhandled message" warning
+    - KVM: arm64: Enable Cortex-A510 erratum 2077057 by default
+    - i2c: xiic: Make bus names unique
+    - net: phy: micrel: Fix concurrent register access
+    - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync()
+    - Bluetooth: Fix skb allocation in mgmt_remote_name() &
+      mgmt_device_connected()
+    - power: supply: wm8350-power: Handle error for wm8350_register_irq
+    - power: supply: wm8350-power: Add missing free in free_charger_irq
+    - IB/hfi1: Allow larger MTU without AIP
+    - RDMA/core: Fix ib_qp_usecnt_dec() called when error
+    - PCI: Reduce warnings on possible RW1C corruption
+    - net: axienet: fix RX ring refill allocation failure handling
+    - drm/msm/a6xx: Fix missing ARRAY_SIZE() check
+    - mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n
+    - MIPS: Sanitise Cavium switch cases in TLB handler synthesizers
+    - powerpc/sysdev: fix incorrect use to determine if list is empty
+    - powerpc/64s: Don't use DSISR for SLB faults
+    - mfd: mc13xxx: Add check for mc13xxx_irq_request
+    - libbpf: Unmap rings when umem deleted
+    - selftests/bpf: Make test_lwt_ip_encap more stable and faster
+    - platform/x86: huawei-wmi: check the return value of device_create_file()
+    - scsi: mpt3sas: Fix incorrect 4GB boundary check
+    - powerpc: 8xx: fix a return value error in mpc8xx_pic_init
+    - xtensa: add missing XCHAL_HAVE_WINDOWED check
+    - iwlwifi: pcie: fix SW error MSI-X mapping
+    - vxcan: enable local echo for sent CAN frames
+    - ath10k: Fix error handling in ath10k_setup_msa_resources
+    - mips: cdmm: Fix refcount leak in mips_cdmm_phys_base
+    - MIPS: RB532: fix return value of __setup handler
+    - MIPS: pgalloc: fix memory leak caused by pgd_free()
+    - mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
+    - power: ab8500_chargalg: Use CLOCK_MONOTONIC
+    - RDMA/irdma: Prevent some integer underflows
+    - Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error"
+    - RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
+    - bpf, sockmap: Fix memleak in sk_psock_queue_msg
+    - bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
+    - bpf, sockmap: Fix more uncharged while msg has more_data
+    - bpf, sockmap: Fix double uncharge the mem of sk_msg
+    - samples/bpf, xdpsock: Fix race when running for fix duration of time
+    - USB: storage: ums-realtek: fix error code in rts51x_read_mem()
+    - drm/amd/display: Fix double free during GPU reset on DC streams
+    - RDMA/rxe: Change variable and function argument to proper type
+    - RDMA/rxe: Fix ref error in rxe_av.c
+    - powerpc/xive: fix return value of __setup handler
+    - powerpc/time: Fix KVM host re-arming a timer beyond decrementer range
+    - drm/i915/display: Fix HPD short pulse handling for eDP
+    - drm/i915/display: Do not re-enable PSR after it was marked as not reliable
+    - netfilter: flowtable: Fix QinQ and pppoe support for inet table
+    - mt76: mt7921: fix mt7921_queues_acq implementation
+    - can: isotp: return -EADDRNOTAVAIL when reading from unbound socket
+    - can: isotp: support MSG_TRUNC flag when reading from socket
+    - bareudp: use ipv6_mod_enabled to check if IPv6 enabled
+    - PCI: imx6: Invoke the PHY exit function after PHY power off
+    - PCI: imx6: Assert i.MX8MM CLKREQ# even if no device present
+    - ibmvnic: fix race between xmit and reset
+    - af_unix: Fix some data-races around unix_sk(sk)->oob_skb.
+    - selftests/bpf: Fix error reporting from sock_fields programs
+    - Bluetooth: hci_uart: add missing NULL check in h5_enqueue
+    - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed
+    - Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
+    - RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit()
+    - ipv4: Fix route lookups when handling ICMP redirects and PMTU updates
+    - mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release
+      skb
+    - af_netlink: Fix shift out of bounds in group mask calculation
+    - i2c: meson: Fix wrong speed use from probe
+    - netfilter: conntrack: Add and use nf_ct_set_auto_assign_helper_warned()
+    - i2c: mux: demux-pinctrl: do not deactivate a master that is not active
+    - powerpc/pseries: Fix use after free in remove_phb_dynamic()
+    - ax25: Fix refcount leaks caused by ax25_cb_del()
+    - ax25: Fix NULL pointer dereferences in ax25 timers
+    - drm/i915: Fix renamed struct field
+    - selftests/bpf/test_lirc_mode2.sh: Exit with proper code
+    - bpftool: Fix print error when show bpf map
+    - PCI: Avoid broken MSI on SB600 USB devices
+    - net: bcmgenet: Use stronger register read/writes to assure ordering
+    - tcp: ensure PMTU updates are processed during fastopen
+    - openvswitch: always update flow key after nat
+    - net: dsa: fix panic on shutdown if multi-chip tree failed to probe
+    - net: wwan: qcom_bam_dmux: fix wrong pointer passed to IS_ERR()
+    - tipc: fix the timer expires after interval 100ms
+    - mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
+    - ice: fix 'scheduling while atomic' on aux critical err interrupt
+    - ice: don't allow to run ice_send_event_to_aux() in atomic ctx
+    - drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via
+      ethtool
+    - kernel/resource: fix kfree() of bootmem memory again
+    - clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3
+    - staging: r8188eu: release_firmware is not called if allocation fails
+    - mxser: fix xmit_buf leak in activate when LSR == 0xff
+    - fsi: scom: Fix error handling
+    - fsi: scom: Remove retries in indirect scoms
+    - pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
+    - pps: clients: gpio: Propagate return value from pps_gpio_probe
+    - fsi: Aspeed: Fix a potential double free
+    - misc: alcor_pci: Fix an error handling path
+    - cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse
+    - soundwire: intel: fix wrong register name in intel_shim_wake
+    - clk: qcom: ipq8074: fix PCI-E clock oops
+    - dmaengine: idxd: restore traffic class defaults after wq reset
+    - iio: mma8452: Fix probe failing when an i2c_device_id is used
+    - staging: qlge: add unregister_netdev in qlge_probe
+    - serial: 8250_aspeed_vuart: add PORT_ASPEED_VUART port type
+    - staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
+    - clk: renesas: r8a779f0: Fix RSW2 clock divider
+    - pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel
+    - pinctrl: renesas: checker: Fix miscalculation of number of states
+    - clk: qcom: ipq8074: Use floor ops for SDCC1 clock
+    - phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure})
+    - phy: phy-brcm-usb: fixup BCM4908 support
+    - serial: 8250_mid: Balance reference count for PCI DMA device
+    - serial: 8250_lpss: Balance reference count for PCI DMA device
+    - NFS: Use of mapping_set_error() results in spurious errors
+    - serial: 8250: Fix race condition in RTS-after-send handling
+    - iio: adc: Add check for devm_request_threaded_irq
+    - habanalabs: Add check for pci_enable_device
+    - NFS: Return valid errors from nfs2/3_decode_dirent()
+    - staging: r8188eu: fix endless loop in recv_func
+    - dma-debug: fix return value of __setup handlers
+    - clk: imx7d: Remove audio_mclk_root_clk
+    - clk: imx: off by one in imx_lpcg_parse_clks_from_dt()
+    - clk: at91: sama7g5: fix parents of PDMCs' GCLK
+    - clk: qcom: clk-rcg2: Update logic to calculate D value for RCG
+    - clk: qcom: clk-rcg2: Update the frac table for pixel clock
+    - clk: starfive: jh7100: Don't round divisor up twice
+    - clk: starfive: jh7100: Handle audio_div clock properly
+    - dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma
+    - remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region
+    - remoteproc: qcom_wcnss: Add missing of_node_put() in
+      wcnss_alloc_memory_region
+    - remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region
+    - nvdimm/region: Fix default alignment for small regions
+    - clk: actions: Terminate clk_div_table with sentinel element
+    - clk: loongson1: Terminate clk_div_table with sentinel element
+    - clk: hisilicon: Terminate clk_div_table with sentinel element
+    - clk: clps711x: Terminate clk_div_table with sentinel element
+    - clk: Fix clk_hw_get_clk() when dev is NULL
+    - clk: tegra: tegra124-emc: Fix missing put_device() call in
+      emc_ensure_emc_driver
+    - mailbox: imx: fix crash in resume on i.mx8ulp
+    - NFS: remove unneeded check in decode_devicenotify_args()
+    - staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
+    - staging: mt7621-dts: fix formatting
+    - staging: mt7621-dts: fix pinctrl properties for ethernet
+    - staging: mt7621-dts: fix GB-PC2 devicetree
+    - pinctrl: ocelot: fix confops resource index
+    - pinctrl: ocelot: fix duplicate debugfs entry
+    - pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
+    - pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback
+    - pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get()
+    - pinctrl: mediatek: paris: Fix pingroup pin config state readback
+    - pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual
+      GPIOs
+    - pinctrl: ocelot: Fix interrupt parsing
+    - pinctrl: microchip-sgpio: lock RMW access
+    - pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
+    - pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
+    - clk: visconti: prevent array overflow in visconti_clk_register_gates()
+    - tty: hvc: fix return value of __setup handler
+    - kgdboc: fix return value of __setup handler
+    - serial: 8250: fix XOFF/XON sending when DMA is used
+    - virt: acrn: obtain pa from VMA with PFNMAP flag
+    - virt: acrn: fix a memory leak in acrn_dev_ioctl()
+    - kgdbts: fix return value of __setup handler
+    - firmware: google: Properly state IOMEM dependency
+    - driver core: dd: fix return value of __setup handler
+    - perf test arm64: Test unwinding using fame-pointer (fp) mode
+    - jfs: fix divide error in dbNextAG
+    - SUNRPC/call_alloc: async tasks mustn't block waiting for memory
+    - SUNRPC: improve 'swap' handling: scheduling and PF_MEMALLOC
+    - SUNRPC: Don't call connect() more than once on a TCP socket
+    - perf parse-events: Move slots only with topdown
+    - netfilter: egress: Report interface as outgoing
+    - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
+    - SUNRPC don't resend a task on an offlined transport
+    - NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error
+    - kdb: Fix the putarea helper function
+    - perf stat: Fix forked applications enablement of counters
+    - net: stmmac: dwmac-qcom-ethqos: Enable RGMII functional clock on resume
+    - clk: qcom: gcc-msm8994: Fix gpll4 width
+    - vsock/virtio: initialize vdev->priv before using VQs
+    - vsock/virtio: read the negotiated features before using VQs
+    - vsock/virtio: enable VQs early on probe
+    - clk: Initialize orphan req_rate
+    - xen: fix is_xen_pmu()
+    - net: enetc: report software timestamping via SO_TIMESTAMPING
+    - net: hns3: fix bug when PF set the duplicate MAC address for VFs
+    - net: hns3: fix port base vlan add fail when concurrent with reset
+    - net: hns3: add vlan list lock to protect vlan list
+    - net: hns3: refine the process when PF set VF VLAN
+    - net: phy: broadcom: Fix brcm_fet_config_init()
+    - selftests: test_vxlan_under_vrf: Fix broken test case
+    - NFS: Don't loop forever in nfs_do_recoalesce()
+    - libperf tests: Fix typo in perf_evlist__open() failure error messages
+    - net: hns3: fix ethtool tx copybreak buf size indicating not aligned issue
+    - net: hns3: add max order judgement for tx spare buffer
+    - net: hns3: clean residual vf config after disable sriov
+    - net: hns3: add netdev reset check for hns3_set_tunable()
+    - net: hns3: add NULL pointer check for hns3_set/get_ringparam()
+    - net: hns3: fix phy can not link up when autoneg off and reset
+    - net: sparx5: depends on PTP_1588_CLOCK_OPTIONAL
+    - qlcnic: dcb: default to returning -EOPNOTSUPP
+    - net/x25: Fix null-ptr-deref caused by x25_disconnect
+    - net: sparx5: switchdev: fix possible NULL pointer dereference
+    - octeontx2-af: initialize action variable
+    - selftests: tls: skip cmsg_to_pipe tests with TLS=n
+    - net/sched: act_ct: fix ref leak when switching zones
+    - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
+    - net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator
+    - fs: fd tables have to be multiples of BITS_PER_LONG
+    - lib/test: use after free in register_test_dev_kmod()
+    - fs: fix fd table size alignment properly
+    - LSM: general protection fault in legacy_parse_param
+    - regulator: rpi-panel: Handle I2C errors/timing to the Atmel
+    - crypto: hisilicon/qm - cleanup warning in qm_vf_read_qos
+    - crypto: octeontx2 - CN10K CPT to RNM workaround
+    - gcc-plugins/stackleak: Exactly match strings instead of prefixes
+    - rcu: Kill rnp->ofl_seq and use only rcu_state.ofl_lock for exclusion
+    - pinctrl: npcm: Fix broken references to chip->parent_device
+    - rcu: Mark writes to the rcu_segcblist structure's ->flags field
+    - block: throttle split bio in case of iops limit
+    - memstick/mspro_block: fix handling of read-only devices
+    - block/bfq_wf2q: correct weight to ioprio
+    - crypto: xts - Add softdep on ecb
+    - crypto: hisilicon/sec - not need to enable sm4 extra mode at HW V3
+    - block, bfq: don't move oom_bfqq
+    - selinux: use correct type for context length
+    - powercap/dtpm_cpu: Reset per_cpu variable in the release function
+    - arm64: module: remove (NOLOAD) from linker script
+    - selinux: allow FIOCLEX and FIONCLEX with policy capability
+    - loop: use sysfs_emit() in the sysfs xxx show()
+    - Fix incorrect type in assignment of ipv6 port for audit
+    - irqchip/qcom-pdc: Fix broken locking
+    - irqchip/nvic: Release nvic_base upon failure
+    - fs/binfmt_elf: Fix AT_PHDR for unusual ELF files
+    - hwrng: cavium - fix NULL but dereferenced coccicheck error
+    - bfq: fix use-after-free in bfq_dispatch_request
+    - ACPICA: Avoid walking the ACPI Namespace if it is not there
+    - ACPI / x86: Add skip i2c clients quirk for Nextbook Ares 8
+    - ACPI / x86: Add skip i2c clients quirk for Lenovo Yoga Tablet 1050F/L
+    - lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3
+    - Revert "Revert "block, bfq: honor already-setup queue merges""
+    - ACPI/APEI: Limit printable size of BERT table data
+    - PM: core: keep irq flags in device_pm_check_callbacks()
+    - parisc: Fix non-access data TLB cache flush faults
+    - parisc: Fix handling off probe non-access faults
+    - nvme-tcp: lockdep: annotate in-kernel sockets
+    - spi: tegra20: Use of_device_get_match_data()
+    - spi: fsi: Implement a timeout for polling status
+    - atomics: Fix atomic64_{read_acquire,set_release} fallbacks
+    - locking/lockdep: Iterate lock_classes directly when reading lockdep files
+    - ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb
+    - ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit
+    - sched/tracing: Report TASK_RTLOCK_WAIT tasks as TASK_UNINTERRUPTIBLE
+    - ext4: don't BUG if someone dirty pages without asking ext4 first
+    - f2fs: fix to do sanity check on curseg->alloc_type
+    - NFSD: Fix nfsd_breaker_owns_lease() return values
+    - f2fs: don't get FREEZE lock in f2fs_evict_inode in frozen fs
+    - btrfs: harden identification of a stale device
+    - btrfs: make search_csum_tree return 0 if we get -EFBIG
+    - btrfs: handle csum lookup errors properly on reads
+    - btrfs: do not double complete bio on errors during compressed reads
+    - btrfs: do not clean up repair bio if submit fails
+    - f2fs: use spin_lock to avoid hang
+    - f2fs: compress: fix to print raw data size in error path of lz4
+      decompression
+    - Adjust cifssb maximum read size
+    - ntfs: add sanity check on allocation size
+    - media: staging: media: zoran: move videodev alloc
+    - media: staging: media: zoran: calculate the right buffer number for
+      zoran_reap_stat_com
+    - media: staging: media: zoran: fix various V4L2 compliance errors
+    - media: atmel: atmel-isc-base: report frame sizes as full supported range
+    - media: ir_toy: free before error exiting
+    - ASoC: sh: rz-ssi: Make the data structures available before registering the
+      handlers
+    - ASoC: cs42l42: Report full jack status when plug is detected
+    - ASoC: SOF: Intel: match sdw version on link_slaves_found
+    - media: imx-jpeg: Prevent decoding NV12M jpegs into single-planar buffers
+    - ASoC: SOF: Intel: hda: Remove link assignment limitation
+    - media: iommu/mediatek-v1: Free the existed fwspec if the master dev already
+      has
+    - media: iommu/mediatek: Return ENODEV if the device is NULL
+    - media: iommu/mediatek: Add device_link between the consumer and the larb
+      devices
+    - video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
+    - video: fbdev: w100fb: Reset global state
+    - video: fbdev: cirrusfb: check pixclock to avoid divide by zero
+    - video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
+    - ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
+    - ARM: dts: bcm2837: Add the missing L1/L2 cache information
+    - ASoC: madera: Add dependencies on MFD
+    - media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator
+      off on some boards
+    - media: atomisp: fix dummy_ptr check to avoid duplicate active_bo
+    - ARM: ftrace: avoid redundant loads or clobbering IP
+    - ALSA: hda: Fix driver index handling at re-binding
+    - ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk
+    - arm64: defconfig: build imx-sdma as a module
+    - video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
+    - video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of
+      snprintf()
+    - video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit
+    - ARM: dts: bcm2711: Add the missing L1/L2 cache information
+    - ASoC: soc-core: skip zero num_dai component in searching dai name
+    - ASoC: Intel: sof_es8336: add quirk for Huawei D15 2021
+    - media: imx-jpeg: fix a bug of accessing array out of bounds
+    - media: cx88-mpeg: clear interrupt status register before streaming video
+    - ASoC: rt5682s: Fix the wrong jack type detected
+    - ARM: tegra: transformer: Drop reg-shift for Tegra HS UART
+    - uaccess: fix type mismatch warnings from access_ok()
+    - lib/test_lockup: fix kernel pointer check for separate address spaces
+    - ARM: tegra: tamonten: Fix I2C3 pad setting
+    - ARM: mmp: Fix failure to remove sram device
+    - ASoC: amd: vg: fix for pm resume callback sequence
+    - ASoC: amd: vangogh: fix uninitialized symbol warning in machine driver
+    - video: fbdev: sm712fb: Fix crash in smtcfb_write()
+    - media: i2c: ov5648: Fix lockdep error
+    - media: Revert "media: em28xx: add missing em28xx_close_extension"
+    - media: hdpvr: initialize dev->worker at hdpvr_register_videodev
+    - ASoC: SOF: debug: clarify operator precedence
+    - ASoC: Intel: sof_sdw: fix quirks for 2022 HP Spectre x360 13"
+    - ASoC: SOF: Intel: hda: retrieve DMIC number for I2S boards
+    - ALSA: intel-nhlt: add helper to detect SSP link mask
+    - ALSA: intel-dsp-config: add more ACPI HIDs for ES83x6 devices
+    - ASoC: Intel: soc-acpi: add more ACPI HIDs for ES83x6 devices
+    - ALSA: intel-dspconfig: add ES8336 support for CNL
+    - ASoC: Intel: Revert "ASoC: Intel: sof_es8336: add quirk for Huawei D15 2021"
+    - ASoC: Intel: sof_es8336: log all quirks
+    - tracing: Have TRACE_DEFINE_ENUM affect trace event types as well
+    - mmc: host: Return an error when ->enable_sdio_irq() ops is missing
+    - ASoC: mediatek: Fix error handling in mt8183_da7219_max98357_dev_probe
+    - media: atomisp: fix bad usage at error handling logic
+    - ALSA: hda/realtek: Add alc256-samsung-headphone fixup
+    - KVM: SVM: Allow AVIC support on system w/ physical APIC ID > 255
+    - KVM: x86: Reinitialize context if host userspace toggles EFER.LME
+    - KVM: x86/mmu: Use common TDP MMU zap helper for MMU notifier unmap hook
+    - KVM: x86/mmu: Move "invalid" check out of kvm_tdp_mmu_get_root()
+    - KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU
+    - KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU
+    - KVM: x86: hyper-v: Drop redundant 'ex' parameter from kvm_hv_send_ipi()
+    - KVM: x86: hyper-v: Drop redundant 'ex' parameter from kvm_hv_flush_tlb()
+    - KVM: x86: hyper-v: Fix the maximum number of sparse banks for XMM fast TLB
+      flush hypercalls
+    - KVM: x86: hyper-v: HVCALL_SEND_IPI_EX is an XMM fast hypercall
+    - powerpc/kasan: Fix early region not updated correctly
+    - powerpc/tm: Fix more userspace r13 corruption
+    - powerpc/lib/sstep: Fix 'sthcx' instruction
+    - powerpc/lib/sstep: Fix build errors with newer binutils
+    - powerpc: Add set_memory_{p/np}() and remove set_memory_attr()
+    - powerpc: Fix build errors with newer binutils
+    - drm/dp: Fix off-by-one in register cache size
+    - drm/i915: Treat SAGV block time 0 as SAGV disabled
+    - drm/i915: Fix PSF GV point mask when SAGV is not possible
+    - drm/i915: Reject unsupported TMDS rates on ICL+
+    - scsi: qla2xxx: Refactor asynchronous command initialization
+    - scsi: qla2xxx: Implement ref count for SRB
+    - scsi: qla2xxx: Fix stuck session in gpdb
+    - scsi: qla2xxx: Fix warning message due to adisc being flushed
+    - scsi: qla2xxx: Fix scheduling while atomic
+    - scsi: qla2xxx: Fix premature hw access after PCI error
+    - scsi: qla2xxx: Fix wrong FDMI data for 64G adapter
+    - scsi: qla2xxx: Fix warning for missing error code
+    - scsi: qla2xxx: Fix device reconnect in loop topology
+    - scsi: qla2xxx: edif: Fix clang warning
+    - scsi: qla2xxx: Fix T10 PI tag escape and IP guard options for 28XX adapters
+    - scsi: qla2xxx: Add devids and conditionals for 28xx
+    - scsi: qla2xxx: Check for firmware dump already collected
+    - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
+    - scsi: qla2xxx: Fix disk failure to rediscover
+    - scsi: qla2xxx: Fix incorrect reporting of task management failure
+    - scsi: qla2xxx: Fix hang due to session stuck
+    - scsi: qla2xxx: Fix laggy FC remote port session recovery
+    - scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests
+    - scsi: qla2xxx: Fix crash during module load unload test
+    - scsi: qla2xxx: Fix N2N inconsistent PLOGI
+    - scsi: qla2xxx: Fix stuck session of PRLI reject
+    - scsi: qla2xxx: Reduce false trigger to login
+    - scsi: qla2xxx: Use correct feature type field during RFF_ID processing
+    - platform: chrome: Split trace include file
+    - MIPS: crypto: Fix CRC32 code
+    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
+    - KVM: x86: Avoid theoretical NULL pointer dereference in
+      kvm_irq_delivery_to_apic_fast()
+    - KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
+    - KVM: x86/mmu: do compare-and-exchange of gPTE via the user address
+    - KVM: Prevent module exit until all VMs are freed
+    - KVM: x86: fix sending PV IPI
+    - KVM: SVM: fix panic on out-of-bounds guest IRQ
+    - KVM: avoid double put_page with gfn-to-pfn cache
+    - ubifs: rename_whiteout: Fix double free for whiteout_ui->data
+    - ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
+    - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
+    - ubifs: Rename whiteout atomically
+    - ubifs: Fix 'ui->dirty' race between do_tmpfile() and writeback work
+    - ubifs: Rectify space amount budget for mkdir/tmpfile operations
+    - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
+    - ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
+    - ubifs: Fix to add refcount once page is set private
+    - ubifs: rename_whiteout: correct old_dir size computing
+    - nvme: allow duplicate NSIDs for private namespaces
+    - nvme: fix the read-only state for zoned namespaces with unsupposed features
+    - wireguard: queueing: use CFI-safe ptr_ring cleanup function
+    - wireguard: socket: free skb in send6 when ipv6 is disabled
+    - wireguard: socket: ignore v6 endpoints when ipv6 is disabled
+    - XArray: Fix xas_create_range() when multi-order entry present
+    - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
+    - can: mcba_usb: properly check endpoint type
+    - can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value
+    - XArray: Include bitmap.h from xarray.h
+    - XArray: Update the LRU list in xas_split()
+    - modpost: restore the warning message for missing symbol versions
+    - rtc: gamecube: Fix refcount leak in gamecube_rtc_read_offset_from_sram
+    - rtc: check if __rtc_read_time was successful
+    - loop: fix ioctl calls using compat_loop_info
+    - gfs2: gfs2_setattr_size error path fix
+    - gfs2: Fix gfs2_file_buffered_write endless loop workaround
+    - gfs2: Make sure FITRIM minlen is rounded up to fs block size
+    - net: hns3: fix the concurrency between functions reading debugfs
+    - net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware
+    - rxrpc: fix some null-ptr-deref bugs in server_key.c
+    - rxrpc: Fix call timer start racing with call destruction
+    - mailbox: imx: fix wakeup failure from freeze mode
+    - crypto: x86/poly1305 - Fixup SLS
+    - crypto: arm/aes-neonbs-cbc - Select generic cbc and aes
+    - watch_queue: Free the page array when watch_queue is dismantled
+    - pinctrl: pinconf-generic: Print arguments for bias-pull-*
+    - watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function
+    - net: sparx5: uses, depends on BRIDGE or !BRIDGE
+    - pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR()
+    - pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE()
+    - ASoC: rockchip: i2s_tdm: Fixup config for SND_SOC_DAIFMT_DSP_A/B
+    - ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs
+    - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
+    - ARM: iop32x: offset IRQ numbers by 1
+    - block: Fix the maximum minor value is blk_alloc_ext_minor()
+    - block: restore the old set_task_ioprio() behaviour wrt PF_EXITING
+    - Revert "virtio-pci: harden INTX interrupts"
+    - Revert "virtio_pci: harden MSI-X interrupts"
+    - virtio: use virtio_device_ready() in virtio_device_restore()
+    - io_uring: remove poll entry from list when canceling all
+    - io_uring: bump poll refs to full 31-bits
+    - io_uring: fix memory leak of uid in files registration
+    - riscv module: remove (NOLOAD)
+    - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
+    - vhost: handle error while adding split ranges to iotlb
+    - spi: Fix Tegra QSPI example
+    - platform/chrome: cros_ec_typec: Check for EC device
+    - platform/x86: asus-wmi: Fix regression when probing for fan curve control
+    - can: isotp: restore accidentally removed MSG_PEEK feature
+    - proc: bootconfig: Add null pointer check
+    - x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation
+    - x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO
+    - drm/connector: Fix typo in documentation
+    - scsi: qla2xxx: Add qla2x00_async_done() for async routines
+    - staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet
+    - docs: fix 'make htmldocs' warning in SCTP.rst
+    - arm64: mm: Drop 'const' from conditional arm64_dma_phys_limit definition
+    - ASoC: soc-compress: Change the check for codec_dai
+    - KVM: x86: SVM: fix avic spec based definitions again
+    - ax25: fix UAF bug in ax25_send_control()
+    - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
+    - tracing: Have type enum modifications copy the strings
+    - mips: Enable KCSAN - take 2
+    - net: add skb_set_end_offset() helper
+    - mm/mmap: return 1 from stack_guard_gap __setup() handler
+    - ARM: 9187/1: JIVE: fix return value of __setup handler
+    - mm/memcontrol: return 1 from cgroup.memory __setup() handler
+    - mm/usercopy: return 1 from hardened_usercopy __setup() handler
+    - af_unix: Support POLLPRI for OOB.
+    - libbpf: Define BTF_KIND_* constants in btf.h to avoid compilation errors
+    - bpf: Adjust BPF stack helper functions to accommodate skip > 0
+    - bpf: Fix comment for helper bpf_current_task_under_cgroup()
+    - nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
+    - mmc: rtsx: Use pm_runtime_{get,put}() to handle runtime PM
+    - dt-bindings: mtd: nand-controller: Fix the reg property description
+    - dt-bindings: mtd: nand-controller: Fix a comment in the examples
+    - dt-bindings: spi: mxic: The interrupt property is not mandatory
+    - media: dt-binding: media: hynix,hi846: use $defs/port-base port description
+    - media: dt-bindings: media: hynix,hi846: add link-frequencies description
+    - dt-bindings: memory: mtk-smi: Rename clock to clocks
+    - dt-bindings: memory: mtk-smi: No need mediatek,larb-id for mt8167
+    - dt-bindings: memory: mtk-smi: Correct minItems to 2 for the gals clocks
+    - dt-bindings: pinctrl: mt8195: fix bias-pull-{up,down} checks
+    - dt-bindings: pinctrl: pinctrl-microchip-sgpio: Fix example
+    - ubi: fastmap: Return error code if memory allocation fails in add_aeb()
+    - net: preserve skb_end_offset() in skb_unclone_keeptruesize()
+    - ASoC: SOF: Intel: Fix build error without SND_SOC_SOF_PCI_DEV
+    - ASoC: topology: Allow TLV control to be either read or write
+    - perf vendor events: Update metrics for SkyLake Server
+    - media: ov6650: Add try support to selection API operations
+    - media: ov6650: Fix crop rectangle affected by set format
+    - pinctrl: canonical rsel resistance selection property
+    - spi: mediatek: support tick_delay without enhance_timing
+    - ARM: dts: spear1340: Update serial node properties
+    - ARM: dts: spear13xx: Update SPI dma properties
+    - arm64: dts: ls1043a: Update i2c dma properties
+    - arm64: dts: ls1046a: Update i2c node dma properties
+    - um: Fix uml_mconsole stop/go
+    - docs: sysctl/kernel: add missing bit to panic_print
+    - xsk: Do not write NULL in SW ring at allocation failure
+    - ice: xsk: Fix indexing in ice_tx_xsk_pool()
+    - vdpa/mlx5: Avoid processing works if workqueue was destroyed
+    - openvswitch: Fixed nd target mask field in the flow dump.
+    - torture: Make torture.sh help message match reality
+    - n64cart: convert bi_disk to bi_bdev->bd_disk fix build
+    - Revert "nbd: fix possible overflow on 'first_minor' in nbd_dev_add()"
+    - mmc: rtsx: Let MMC core handle runtime PM
+    - mmc: rtsx: Fix build errors/warnings for unused variable
+    - coredump: Snapshot the vmas in do_coredump
+    - coredump: Remove the WARN_ON in dump_vma_snapshot
+    - coredump/elf: Pass coredump_params into fill_note_info
+    - coredump: Use the vma snapshot in fill_files_note
+    - Linux 5.17.2
+
+  * Jammy update: v5.17.1 upstream stable release (LP: #1968982)
+    - tpm: Fix error handling in async work
+    - Bluetooth: btusb: Add another Realtek 8761BU
+    - llc: fix netdevice reference leaks in llc_ui_bind()
+    - ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call
+    - ALSA: oss: Fix PCM OSS buffer allocation overflow
+    - ALSA: usb-audio: add mapping for new Corsair Virtuoso SE
+    - ALSA: hda/realtek: Add quirk for Clevo NP70PNJ
+    - ALSA: hda/realtek: Add quirk for Clevo NP50PNJ
+    - ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671
+    - ALSA: hda/realtek: Add quirk for ASUS GA402
+    - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
+    - ALSA: pcm: Fix races among concurrent read/write and buffer changes
+    - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
+    - ALSA: pcm: Fix races among concurrent prealloc proc writes
+    - ALSA: pcm: Add stream lock during PCM reset ioctl operations
+    - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
+    - ALSA: cmipci: Restore aux vol on suspend/resume
+    - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
+    - drivers: net: xgene: Fix regression in CRC stripping
+    - netfilter: nf_tables: initialize registers in nft_do_chain()
+    - netfilter: nf_tables: validate registers coming from userspace.
+    - ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
+    - ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
+    - ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
+    - crypto: qat - disable registration of algorithms
+    - Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE
+    - Bluetooth: hci_sync: Add a new quirk to skip HCI_FLT_CLEAR_ALL
+    - Bluetooth: btusb: Use quirk to skip HCI_FLT_CLEAR_ALL on fake CSR
+      controllers
+    - Revert "ath: add support for special 0x0 regulatory domain"
+    - drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()
+    - jbd2: fix use-after-free of transaction_t race
+    - rcu: Don't deboost before reporting expedited quiescent state
+    - uaccess: fix integer overflow on access_ok()
+    - mac80211: fix potential double free on mesh join
+    - tpm: fix reference counting for struct tpm_chip
+    - tpm: use try_get_ops() in tpm-space.c
+    - wcn36xx: Differentiate wcn3660 from wcn3620
+    - m68k: fix access_ok for coldfire
+    - nds32: fix access_ok() checks in get/put_user
+    - drm/msm/gpu: Fix crash on devices without devfreq support (v2)
+    - llc: only change llc->dev when bind() succeeds
+    - Linux 5.17.1
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: shiftfs: always rely on init_user_ns
+    - [Config] update configs and annotations after stable updates
+    - SAUCE: sfc: The size of the RX recycle ring should be more flexible
+    - [Packaging] remove references to lowlatency flavor
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Apr 2022 08:45:40 +0200
+
+linux-unstable (5.17.0-6.6) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-6.6 -proposed tracker (LP: #1965731)
+
+  * dependency on crda obsolete according to Debian (LP: #1958918)
+    - [Packaging] switch dependency from crda to wireless-regdb
+
+  * Miscellaneous Ubuntu changes
+    - [Config] disable CONFIG_SYSFB_SIMPLEFB on amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Mar 2022 09:46:03 +0100
+
+linux-unstable (5.17.0-5.5) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-5.5 -proposed tracker (LP: #1964766)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync dkms-build{,--nvidia-N} from LRMv5
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to v5.17-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Mar 2022 13:15:50 +0100
+
+linux-unstable (5.17.0-4.4) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-4.4 -proposed tracker (LP: #1963880)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 07 Mar 2022 10:20:48 +0100
+
+linux-unstable (5.17.0-3.3) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-3.3 -proposed tracker (LP: #1962450)
+
+  * 5.15 stuck at boot on c4.large (LP: #1956780)
+    - Revert "PCI/MSI: Mask MSI-X vectors only on success"
+
+  * [22.04 FEAT] KVM: Enable storage key checking for intercepted instruction
+    handled by userspace (LP: #1933179)
+    - s390/uaccess: Add copy_from/to_user_key functions
+    - KVM: s390: Honor storage keys when accessing guest memory
+    - KVM: s390: handle_tprot: Honor storage keys
+    - KVM: s390: Add optional storage key checking to MEMOP IOCTL
+    - KVM: s390: Add vm IOCTL for key checked guest absolute memory access
+    - KVM: s390: Rename existing vcpu memop functions
+    - KVM: s390: Update api documentation for memop ioctl
+    - KVM: s390: Clarify key argument for MEM_OP in api docs
+    - KVM: s390: Add missing vm MEM_OP size check
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Feb 2022 09:42:32 +0100
+
+linux-unstable (5.17.0-2.2) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-2.2 -proposed tracker (LP: #1962137)
+
+  * CVE-2022-25636
+    - netfilter: nf_tables_offload: incorrect flow offload action array size
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+    - [Packaging] update Ubuntu.md
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Jammy update: v5.15.22 upstream stable release (LP: #1960516)
+    - Revert "ASoC: mediatek: Check for error clk pointer"
+    - [Config] disable FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION
+
+  * Jammy update: v5.15.20 upstream stable release (LP: #1960509)
+    - Revert "UBUNTU: SAUCE: Revert "e1000e: Additional PHY power saving in S0ix""
+
+  * Jammy update: v5.15.19 upstream stable release (LP: #1959879)
+    - drm/etnaviv: relax submit size limits
+
+  * Jammy update: v5.15.17 upstream stable release (LP: #1959376)
+    - net: dsa: hellcreek: Allow PTP P2P measurements on blocked ports
+    - rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC
+    - ASoC: mediatek: Check for error clk pointer
+    - regulator: da9121: Prevent current limit change when enabled
+    - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
+    - drm/etnaviv: limit submit sizes
+    - Bluetooth: hci_sync: Fix not setting adv set duration
+    - net: axienet: Wait for PhyRstCmplt after core reset
+
+  * rtw88_8821ce causes freeze (LP: #1927808) // Jammy update: v5.15.17 upstream
+    stable release (LP: #1959376)
+    - rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
+
+  * Jammy update: v5.15.15 upstream stable release (LP: #1958418)
+    - Bluetooth: btusb: Add support for Foxconn MT7922A
+    - Bluetooth: btbcm: disable read tx power for MacBook Air 8,1 and 8,2
+    - platform/x86/intel: hid: add quirk to support Surface Go 3
+
+  * Support USB4 DP alt mode for AMD Yellow Carp graphics card (LP: #1953008)
+    - SAUCE: drm/amd/display: Fixup previous PSR policy commit
+
+  * alsa/sdw: add sdw audio machine driver for several ADL machines
+    (LP: #1951563)
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B11 product
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B13 product
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B29 product
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B12 product
+
+  * Improve performance and idle power consumption (LP: #1941893)
+    - x86: ACPI: cstate: Optimize C3 entry on AMD CPUs
+
+  * Fix spurious wakeup caused by Intel 7560 WWAN (LP: #1956443)
+    - net: wwan: iosm: Keep device at D0 for s2idle case
+
+  * Jammy update: v5.15.13 upstream stable release (LP: #1956926)
+    - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
+    - net/mlx5: Fix tc max supported prio for nic mode
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Update dependency of pahole / dwarves
+    - [packaging] unhook lowlatency flavours from the build
+    - [Packaging] use default zstd compression
+    - [Packaging] do not use compression for image packages
+    - [Packaging] use xz compression for ddebs
+    - SAUCE: Makefile: Remove inclusion of lbm header files
+    - SAUCE: Makefile: Fix compiler warnings
+    - [Config] drop unused lowlatency configs
+    - [Config] update configs and annotations after rebase to v5.17-rc5
+
+  * Miscellaneous upstream changes
+    - Revert "rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE"
+    - MAINTAINERS: Add scripts/pahole-flags.sh to BPF section
+    - kbuild: Add CONFIG_PAHOLE_VERSION
+    - lib/Kconfig.debug: Use CONFIG_PAHOLE_VERSION
+    - lib/Kconfig.debug: Allow BTF + DWARF5 with pahole 1.21+
+    - Revert "UBUNTU: [Packaging] temporarily disable zfs"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 24 Feb 2022 09:41:40 +0100
+
+linux-unstable (5.17.0-1.1) jammy; urgency=medium
+
+  * Rebase to 5.17-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Feb 2022 08:22:18 +0100
+
+linux-unstable (5.17.0-0.0) jammy; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 28 Jan 2022 17:14:13 +0100
+
+linux (5.15.0-18.18) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-18.18 -proposed tracker (LP: #1958638)
+
+  * CVE-2021-4155
+    - xfs: map unwritten blocks in XFS_IOC_{ALLOC, FREE}SP just like fallocate
+
+  * CVE-2022-0185
+    - SAUCE: vfs: test that one given mount param is not larger than PAGE_SIZE
+
+  * [UBUNTU 20.04] KVM hardware diagnose data improvements for guest kernel -
+    kernel part (LP: #1953334)
+    - KVM: s390: add debug statement for diag 318 CPNC data
+
+  * OOB write on BPF_RINGBUF (LP: #1956585)
+    - SAUCE: bpf: prevent helper argument PTR_TO_ALLOC_MEM to have offset other
+      than 0
+
+  * Miscellaneous Ubuntu changes
+    - [Config] re-enable shiftfs
+    - [SAUCE] shiftfs: support kernel 5.15
+    - [Config] update toolchain versions
+
+  * Miscellaneous upstream changes
+    - vfs: fs_context: fix up param length parsing in legacy_parse_param
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 21 Jan 2022 13:32:27 +0100
+
+linux (5.15.0-17.17) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-17.17 -proposed tracker (LP: #1957809)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 13 Jan 2022 17:11:21 +0100
+
+linux (5.15.0-16.16) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-16.16 -proposed tracker (LP: #1956820)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * 5.15 stuck at boot on c4.large (LP: #1956780)
+    - Revert "PCI/MSI: Mask MSI-X vectors only on success"
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable signed v4l2loopback"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Sat, 08 Jan 2022 10:57:58 +0100
+
+linux (5.15.0-15.15) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-15.15 -proposed tracker (LP: #1956314)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * rtw88_8821ce causes freeze (LP: #1927808)
+    - rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
+
+  * alsa/sdw: fix the  audio sdw codec parsing logic in the acpi table
+    (LP: #1955686)
+    - ALSA: hda: intel-sdw-acpi: go through HDAS ACPI at max depth of 2
+    - ALSA: hda: intel-sdw-acpi: harden detection of controller
+
+  * Got black screen when resume from s2idle with AMD dGPU (LP: #1955790)
+    - SAUCE: drm/amdgpu: put SMU into proper state on runpm suspending for BOCO
+      capable platform
+    - SAUCE: drm/amdgpu: always reset the asic in suspend (v2)
+
+  *  Fix USB3 detection on HP dock (LP: #1955443)
+    - usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
+
+  * support signed v4l2loopback dkms build (LP: #1938531)
+    - enable v4l2loopback builds on amd64 kernels
+    - support v4l2loopback dkms build
+
+  * Jammy update: v5.15.12 upstream stable release (LP: #1956305)
+    - arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd
+    - net: usb: lan78xx: add Allied Telesis AT29M2-AF
+    - ext4: prevent partial update of the extent blocks
+    - ext4: check for out-of-order index extents in ext4_valid_extent_entries()
+    - ext4: check for inconsistent extents between index and leaf block
+    - selftests: KVM: Fix non-x86 compiling
+    - HID: holtek: fix mouse probing
+    - HID: potential dereference of null pointer
+    - NFSD: Fix READDIR buffer overflow
+    - PM: sleep: Fix error handling in dpm_prepare()
+    - arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode
+    - bus: sunxi-rsb: Fix shutdown
+    - spi: change clk_disable_unprepare to clk_unprepare
+    - ucounts: Fix rlimit max values check
+    - drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf
+    - ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent()
+    - RDMA/hns: Fix RNR retransmission issue for HIP08
+    - IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
+    - RDMA/hns: Replace kfree() with kvfree()
+    - netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
+    - netfilter: fix regression in looped (broad|multi)cast's MAC handling
+    - ARM: dts: imx6qdl-wandboard: Fix Ethernet support
+    - ice: Use xdp_buf instead of rx_buf for xsk zero-copy
+    - ice: xsk: return xsk buffers back to pool when cleaning the ring
+    - net: marvell: prestera: fix incorrect return of port_find
+    - net: marvell: prestera: fix incorrect structure access
+    - qlcnic: potential dereference null pointer of rx_queue->page_ring
+    - tcp: move inet->rx_dst_ifindex to sk->sk_rx_dst_ifindex
+    - ipv6: move inet6_sk(sk)->rx_dst_cookie to sk->sk_rx_dst_cookie
+    - inet: fully convert sk->sk_rx_dst to RCU rules
+    - net: accept UFOv6 packages in virtio_net_hdr_to_skb
+    - net: skip virtio_net_hdr_set_proto if protocol already set
+    - igb: fix deadlock caused by taking RTNL in RPM resume path
+    - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
+    - gpio: virtio: remove timeout
+    - bonding: fix ad_actor_system option setting to default
+    - fjes: Check for error irq
+    - drivers: net: smc911x: Check for error irq
+    - net: ks8851: Check for error irq
+    - sfc: Check null pointer of rx_queue->page_ring
+    - sfc: falcon: Check null pointer of rx_queue->page_ring
+    - asix: fix uninit-value in asix_mdio_read()
+    - asix: fix wrong return value in asix_check_host_enable()
+    - io_uring: zero iocb->ki_pos for stream file types
+    - veth: ensure skb entering GRO are not cloned.
+    - net: stmmac: ptp: fix potentially overflowing expression
+    - net: bridge: Use array_size() helper in copy_to_user()
+    - net: bridge: fix ioctl old_deviceless bridge argument
+    - r8152: fix the force speed doesn't work for RTL8156
+    - net: stmmac: dwmac-visconti: Fix value of ETHER_CLK_SEL_FREQ_SEL_2P5M
+    - pinctrl: bcm2835: Change init order for gpio hogs
+    - hwmon: (lm90) Fix usage of CONFIG2 register in detect function
+    - hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations
+    - hwmon: (lm90) Introduce flag indicating extended temperature support
+    - hwmon: (lm90) Add basic support for TI TMP461
+    - hwmon: (lm90) Drop critical attribute support for MAX6654
+    - ARM: 9160/1: NOMMU: Reload __secondary_data after PROCINFO_INITFUNC
+    - uapi: Fix undefined __always_inline on non-glibc systems
+    - compiler.h: Fix annotation macro misplacement with Clang
+    - platform/x86/intel: Remove X86_PLATFORM_DRIVERS_INTEL
+    - kernel/crash_core: suppress unknown crashkernel parameter warning
+    - Revert "x86/boot: Pull up cmdline preparation and early param parsing"
+    - x86/boot: Move EFI range reservation after cmdline parsing
+    - ALSA: jack: Check the return value of kstrdup()
+    - ALSA: drivers: opl3: Fix incorrect use of vp->state
+    - ALSA: rawmidi - fix the uninitalized user_pversion
+    - ALSA: hda/hdmi: Disable silent stream on GLK
+    - ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
+    - ALSA: hda/realtek: Add new alc285-hp-amp-init model
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
+    - ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
+    - ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s
+    - ASoC: tegra: Add DAPM switches for headphones and mic jack
+    - ASoC: tegra: Restore headphones jack name on Nyan Big
+    - Input: atmel_mxt_ts - fix double free in mxt_read_info_block
+    - ipmi: bail out if init_srcu_struct fails
+    - ipmi: ssif: initialize ssif_info->client early
+    - ipmi: fix initialization when workqueue allocation fails
+    - parisc: Correct completer in lws start
+    - parisc: Fix mask used to select futex spinlock
+    - tee: handle lookup of shm with reference count 0
+    - x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
+    - platform/x86: amd-pmc: only use callbacks for suspend
+    - platform/x86: intel_pmc_core: fix memleak on registration failure
+    - KVM: x86: Always set kvm_run->if_flag
+    - KVM: x86/mmu: Don't advance iterator after restart due to yielding
+    - KVM: nVMX: Synthesize TRIPLE_FAULT for L2 if emulation is required
+    - KVM: VMX: Always clear vmx->fail on emulation_required
+    - KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU
+    - pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines
+    - gpio: dln2: Fix interrupts when replugging the device
+    - mmc: sdhci-tegra: Fix switch to HS400ES mode
+    - mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands
+    - mmc: core: Disable card detect during shutdown
+    - mmc: mmci: stm32: clear DLYB_CR after sending tuning command
+    - ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
+    - ksmbd: fix error code in ndr_read_int32()
+    - ksmbd: fix uninitialized symbol 'pntsd_size'
+    - ksmbd: disable SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
+    - mac80211: fix locking in ieee80211_start_ap error path
+    - mm: mempolicy: fix THP allocations escaping mempolicy restrictions
+    - mm, hwpoison: fix condition in free hugetlb page path
+    - mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
+    - mm/damon/dbgfs: protect targets destructions with kdamond_lock
+    - tee: optee: Fix incorrect page free bug
+    - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
+    - netfs: fix parameter of cleanup()
+    - KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
+    - arm64: dts: lx2160a: fix scl-gpios property name
+    - kfence: fix memory leak when cat kfence objects
+    - Input: iqs626a - prohibit inlining of channel parsing functions
+    - Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
+    - Input: goodix - add id->model mapping for the "9111" model
+    - ASoC: tas2770: Fix setting of high sample rates
+    - ASoC: SOF: Intel: pci-tgl: add new ADL-P variant
+    - ASoC: SOF: Intel: pci-tgl: add ADL-N support
+    - ASoC: rt5682: fix the wrong jack type detected
+    - pinctrl: mediatek: fix global-out-of-bounds issue
+    - hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
+    - hwmon: (lm90) Do not report 'busy' status bit as alarm
+    - r8152: sync ocp base
+    - ax25: NPD bug when detaching AX25 device
+    - hamradio: defer ax25 kfree after unregister_netdev
+    - hamradio: improve the incomplete fix to avoid NPD
+    - tun: avoid double free in tun_free_netdev
+    - phonet/pep: refuse to enable an unbound pipe
+    - Linux 5.15.12
+
+  * Thinkpad E14 Gen2: Kernel panic with trackpad and trackpoint enabled
+    (LP: #1945590) // Jammy update: v5.15.12 upstream stable release
+    (LP: #1956305)
+    - Input: elantech - fix stack out of bound access in
+      elantech_change_report_id()
+
+  * Jammy update: v5.15.11 upstream stable release (LP: #1956302)
+    - reset: tegra-bpmp: Revert Handle errors in BPMP response
+    - KVM: VMX: clear vmx_x86_ops.sync_pir_to_irr if APICv is disabled
+    - KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE
+    - KVM: downgrade two BUG_ONs to WARN_ON_ONCE
+    - x86/kvm: remove unused ack_notifier callbacks
+    - KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid()
+    - mac80211: fix rate control for retransmitted frames
+    - mac80211: fix regression in SSN handling of addba tx
+    - mac80211: mark TX-during-stop for TX in in_reconfig
+    - mac80211: send ADDBA requests using the tid/queue of the aggregation session
+    - mac80211: validate extended element ID is present
+    - firmware: arm_scpi: Fix string overflow in SCPI genpd driver
+    - bpf: Fix kernel address leakage in atomic fetch
+    - bpf, selftests: Add test case for atomic fetch on spilled pointer
+    - bpf: Fix signed bounds propagation after mov32
+    - bpf: Make 32->64 bounds propagation slightly more robust
+    - bpf, selftests: Add test case trying to taint map value pointer
+    - bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg
+    - bpf, selftests: Update test case for atomic cmpxchg on r0 with pointer
+    - vduse: fix memory corruption in vduse_dev_ioctl()
+    - vduse: check that offset is within bounds in get_config()
+    - virtio_ring: Fix querying of maximum DMA mapping size for virtio device
+    - vdpa: check that offsets are within bounds
+    - s390/entry: fix duplicate tracking of irq nesting level
+    - recordmcount.pl: look for jgnop instruction as well as bcrl on s390
+    - arm64: dts: ten64: remove redundant interrupt declaration for gpio-keys
+    - ceph: fix up non-directory creation in SGID directories
+    - dm btree remove: fix use after free in rebalance_children()
+    - audit: improve robustness of the audit queue handling
+    - btrfs: convert latest_bdev type to btrfs_device and rename
+    - btrfs: use latest_dev in btrfs_show_devname
+    - btrfs: update latest_dev when we create a sprout device
+    - btrfs: remove stale comment about the btrfs_show_devname
+    - scsi: ufs: core: Retry START_STOP on UNIT_ATTENTION
+    - arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-
+      edge
+    - arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply
+    - arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
+    - arm64: dts: rockchip: fix audio-supply for Rock Pi 4
+    - arm64: dts: rockchip: fix poweroff on helios64
+    - dmaengine: idxd: add halt interrupt support
+    - dmaengine: idxd: fix calling wq quiesce inside spinlock
+    - mac80211: track only QoS data frames for admission control
+    - tee: amdtee: fix an IS_ERR() vs NULL bug
+    - ceph: fix duplicate increment of opened_inodes metric
+    - ceph: initialize pathlen variable in reconnect_caps_cb
+    - ARM: socfpga: dts: fix qspi node compatible
+    - arm64: dts: imx8mq: remove interconnect property from lcdif
+    - clk: Don't parent clks until the parent is fully registered
+    - soc: imx: Register SoC device only on i.MX boards
+    - iwlwifi: mvm: don't crash on invalid rate w/o STA
+    - virtio: always enter drivers/virtio/
+    - virtio/vsock: fix the transport to work with VMADDR_CID_ANY
+    - vdpa: Consider device id larger than 31
+    - Revert "drm/fb-helper: improve DRM fbdev emulation device names"
+    - selftests: net: Correct ping6 expected rc from 2 to 1
+    - s390/kexec_file: fix error handling when applying relocations
+    - sch_cake: do not call cake_destroy() from cake_init()
+    - inet_diag: fix kernel-infoleak for UDP sockets
+    - netdevsim: don't overwrite read only ethtool parms
+    - selftests: icmp_redirect: pass xfail=0 to log_test()
+    - net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
+    - net: hns3: fix race condition in debugfs
+    - selftests: Add duplicate config only for MD5 VRF tests
+    - selftests: Fix raw socket bind tests with VRF
+    - selftests: Fix IPv6 address bind tests
+    - dmaengine: idxd: fix missed completion on abort path
+    - dmaengine: st_fdma: fix MODULE_ALIAS
+    - drm: simpledrm: fix wrong unit with pixel clock
+    - net/sched: sch_ets: don't remove idle classes from the round-robin list
+    - selftests/net: toeplitz: fix udp option
+    - net: dsa: mv88e6xxx: Unforce speed & duplex in mac_link_down()
+    - selftest/net/forwarding: declare NETIFS p9 p10
+    - mptcp: never allow the PM to close a listener subflow
+    - drm/ast: potential dereference of null pointer
+    - drm/i915/display: Fix an unsigned subtraction which can never be negative.
+    - mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
+    - cfg80211: Acquire wiphy mutex on regulatory work
+    - mac80211: fix lookup when adding AddBA extension element
+    - net: stmmac: fix tc flower deletion for VLAN priority Rx steering
+    - flow_offload: return EOPNOTSUPP for the unsupported mpls action type
+    - rds: memory leak in __rds_conn_create()
+    - ice: Use div64_u64 instead of div_u64 in adjfine
+    - ice: Don't put stale timestamps in the skb
+    - drm/amd/display: Set exit_optimized_pwr_state for DCN31
+    - drm/amd/pm: fix a potential gpu_metrics_table memory leak
+    - mptcp: remove tcp ulp setsockopt support
+    - mptcp: clear 'kern' flag from fallback sockets
+    - mptcp: fix deadlock in __mptcp_push_pending()
+    - soc/tegra: fuse: Fix bitwise vs. logical OR warning
+    - igb: Fix removal of unicast MAC filters of VFs
+    - igbvf: fix double free in `igbvf_probe`
+    - igc: Fix typo in i225 LTR functions
+    - ixgbe: Document how to enable NBASE-T support
+    - ixgbe: set X550 MDIO speed before talking to PHY
+    - netdevsim: Zero-initialize memory for new map's value in function
+      nsim_bpf_map_alloc
+    - net/packet: rx_owner_map depends on pg_vec
+    - net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup
+    - sfc_ef100: potential dereference of null pointer
+    - dsa: mv88e6xxx: fix debug print for SPEED_UNFORCED
+    - net: Fix double 0x prefix print in SKB dump
+    - net/smc: Prevent smc_release() from long blocking
+    - net: systemport: Add global locking for descriptor lifecycle
+    - sit: do not call ipip6_dev_free() from sit_init_net()
+    - afs: Fix mmap
+    - arm64: kexec: Fix missing error code 'ret' warning in load_other_segments()
+    - bpf: Fix extable fixup offset.
+    - bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
+    - powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n
+    - USB: gadget: bRequestType is a bitfield, not a enum
+    - Revert "usb: early: convert to readl_poll_timeout_atomic()"
+    - KVM: x86: Drop guest CPUID check for host initiated writes to
+      MSR_IA32_PERF_CAPABILITIES
+    - tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
+    - USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
+    - usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe
+    - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
+    - PCI/MSI: Mask MSI-X vectors only on success
+    - usb: xhci-mtk: fix list_del warning when enable list debug
+    - usb: xhci: Extend support for runtime power management for AMD's Yellow
+      carp.
+    - usb: cdnsp: Fix incorrect status for control request
+    - usb: cdnsp: Fix incorrect calling of cdnsp_died function
+    - usb: cdnsp: Fix issue in cdnsp_log_ep trace event
+    - usb: cdnsp: Fix lack of spin_lock_irqsave/spin_lock_restore
+    - usb: typec: tcpm: fix tcpm unregister port but leave a pending timer
+    - usb: gadget: u_ether: fix race in setting MAC address in setup phase
+    - USB: serial: cp210x: fix CP2105 GPIO registration
+    - USB: serial: option: add Telit FN990 compositions
+    - selinux: fix sleeping function called from invalid context
+    - btrfs: fix memory leak in __add_inode_ref()
+    - btrfs: fix double free of anon_dev after failure to create subvolume
+    - btrfs: check WRITE_ERR when trying to read an extent buffer
+    - btrfs: fix missing blkdev_put() call in btrfs_scan_one_device()
+    - zonefs: add MODULE_ALIAS_FS
+    - iocost: Fix divide-by-zero on donation from low hweight cgroup
+    - serial: 8250_fintek: Fix garbled text for console
+    - timekeeping: Really make sure wall_to_monotonic isn't positive
+    - cifs: sanitize multiple delimiters in prepath
+    - locking/rtmutex: Fix incorrect condition in rtmutex_spin_on_owner()
+    - riscv: dts: unleashed: Add gpio card detect to mmc-spi-slot
+    - riscv: dts: unmatched: Add gpio card detect to mmc-spi-slot
+    - perf inject: Fix segfault due to close without open
+    - perf inject: Fix segfault due to perf_data__fd() without open
+    - libata: if T_LENGTH is zero, dma direction should be DMA_NONE
+    - powerpc/module_64: Fix livepatching for RO modules
+    - drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
+    - drm/amdgpu: don't override default ECO_BITs setting
+    - drm/amd/pm: fix reading SMU FW version from amdgpu_firmware_info on YC
+    - Revert "can: m_can: remove support for custom bit timing"
+    - can: m_can: make custom bittiming fields const
+    - can: m_can: pci: use custom bit timings for Elkhart Lake
+    - ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
+    - xsk: Do not sleep in poll() when need_wakeup set
+    - mptcp: add missing documented NL params
+    - bpf, x64: Factor out emission of REX byte in more cases
+    - bpf: Fix extable address check.
+    - USB: core: Make do_proc_control() and do_proc_bulk() killable
+    - media: mxl111sf: change mutex_init() location
+    - fuse: annotate lock in fuse_reverse_inval_entry()
+    - ovl: fix warning in ovl_create_real()
+    - scsi: scsi_debug: Don't call kcalloc() if size arg is zero
+    - scsi: scsi_debug: Fix type in min_t to avoid stack OOB
+    - scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
+    - io-wq: remove spurious bit clear on task_work addition
+    - io-wq: check for wq exit after adding new worker task_work
+    - rcu: Mark accesses to rcu_state.n_force_qs
+    - io-wq: drop wqe lock before creating new worker
+    - bus: ti-sysc: Fix variable set but not used warning for reinit_modules
+    - selftests/damon: test debugfs file reads/writes with huge count
+    - Revert "xsk: Do not sleep in poll() when need_wakeup set"
+    - xen/blkfront: harden blkfront against event channel storms
+    - xen/netfront: harden netfront against event channel storms
+    - xen/console: harden hvc_xen against event channel storms
+    - xen/netback: fix rx queue stall detection
+    - xen/netback: don't queue unlimited number of packages
+    - Linux 5.15.11
+
+  * Jammy update: v5.15.10 upstream stable release (LP: #1956301)
+    - nfc: fix segfault in nfc_genl_dump_devices_done
+    - hwmon: (corsair-psu) fix plain integer used as NULL pointer
+    - RDMA: Fix use-after-free in rxe_queue_cleanup
+    - RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow
+    - mtd: rawnand: Fix nand_erase_op delay
+    - mtd: rawnand: Fix nand_choose_best_timings() on unsupported interface
+    - inet: use #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING consistently
+    - dt-bindings: media: nxp,imx7-mipi-csi2: Drop bad if/then schema
+    - clk: qcom: sm6125-gcc: Swap ops of ice and apps on sdcc1
+    - perf bpf_skel: Do not use typedef to avoid error on old clang
+    - netfs: Fix lockdep warning from taking sb_writers whilst holding mmap_lock
+    - RDMA/irdma: Fix a user-after-free in add_pble_prm
+    - RDMA/irdma: Fix a potential memory allocation issue in
+      'irdma_prm_add_pble_mem()'
+    - RDMA/irdma: Report correct WC errors
+    - RDMA/irdma: Don't arm the CQ more than two times if no CE for this CQ
+    - ice: fix FDIR init missing when reset VF
+    - vmxnet3: fix minimum vectors alloc issue
+    - i2c: virtio: fix completion handling
+    - drm/msm: Fix null ptr access msm_ioctl_gem_submit()
+    - drm/msm/a6xx: Fix uinitialized use of gpu_scid
+    - drm/msm/dsi: set default num_data_lanes
+    - drm/msm/dp: Avoid unpowered AUX xfers that caused crashes
+    - KVM: arm64: Save PSTATE early on exit
+    - s390/test_unwind: use raw opcode instead of invalid instruction
+    - Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
+    - net/mlx4_en: Update reported link modes for 1/10G
+    - loop: Use pr_warn_once() for loop_control_remove() warning
+    - ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
+    - ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
+    - parisc/agp: Annotate parisc agp init functions with __init
+    - i2c: rk3x: Handle a spurious start completion interrupt flag
+    - net: netlink: af_netlink: Prevent empty skb by adding a check on len.
+    - drm/amdgpu: cancel the correct hrtimer on exit
+    - drm/amdgpu: check atomic flag to differeniate with legacy path
+    - drm/amd/display: Fix for the no Audio bug with Tiled Displays
+    - drm/amdkfd: fix double free mem structure
+    - drm/amd/display: add connector type check for CRC source set
+    - drm/amdkfd: process_info lock not needed for svm
+    - tracing: Fix a kmemleak false positive in tracing_map
+    - staging: most: dim2: use device release method
+    - fuse: make sure reclaim doesn't write the inode
+    - perf inject: Fix itrace space allowed for new attributes
+    - Linux 5.15.10
+
+  * Jammy update: v5.15.9 upstream stable release (LP: #1955161)
+    - netfilter: selftest: conntrack_vrf.sh: fix file permission
+    - Linux 5.15.9
+
+  * [SRU][I/J/OEM-5.13/OEM-5.14] Fix pci port lost when hotplug dock
+    (LP: #1954646)
+    - PCI: Re-enable Downstream Port LTR after reset or hotplug
+
+  * Add support for NVIDIA EC backlight (LP: #1953286)
+    - platform/x86: Add driver for ACPI WMAA EC-based backlight control
+    - platform/x86: Remove "WMAA" from identifier names in wmaa-backlight-wmi.c
+    - platform/x86: Rename wmaa-backlight-wmi to nvidia-wmi-ec-backlight
+    - [Config] NVIDIA_WMI_EC_BACKLIGHT=m
+
+  * Improve USB Type-C support (LP: #1950974)
+    - usb: typec: ucsi: Always cancel the command if PPM reports BUSY condition
+    - usb: typec: ucsi: Don't stop alt mode registration on busy condition
+    - usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode
+      checking
+    - usb: typec: ucsi: acpi: Reduce the command completion timeout
+    - usb: typec: ucsi: Check the partner alt modes always if there is PD contract
+    - usb: typec: ucsi: Read the PDOs in separate work
+    - usb: typec: ucsi: Better fix for missing unplug events issue
+
+  *  Fix power button wakeup with shared IRQs on AMD platforms (LP: #1953540)
+    - pinctrl: amd: Fix wakeups when IRQ is shared with SCI
+
+  * AMD: Suspend not working when some cores are disabled through cpufreq
+    (LP: #1954930)
+    - ACPI: processor idle: Allow playing dead in C3 state
+
+  * Jammy update: v5.15.8 upstream stable release (LP: #1954931)
+    - Revert "UBUNTU: SAUCE: selftests: fib_tests: assign address to dummy1 for
+      rp_filter tests"
+    - usb: gadget: uvc: fix multiple opens
+    - HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
+    - HID: google: add eel USB id
+    - HID: intel-ish-hid: ipc: only enable IRQ wakeup when requested
+    - HID: add hid_is_usb() function to make it simpler for USB detection
+    - HID: add USB_HID dependancy to hid-prodikeys
+    - HID: add USB_HID dependancy to hid-chicony
+    - HID: add USB_HID dependancy on some USB HID drivers
+    - HID: bigbenff: prevent null pointer dereference
+    - HID: wacom: fix problems when device is not a valid USB device
+    - HID: check for valid USB device for many HID drivers
+    - mtd: dataflash: Add device-tree SPI IDs
+    - mmc: spi: Add device-tree SPI IDs
+    - HID: sony: fix error path in probe
+    - HID: Ignore battery for Elan touchscreen on Asus UX550VE
+    - platform/x86/intel: hid: add quirk to support Surface Go 3
+    - nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups
+    - IB/hfi1: Insure use of smp_processor_id() is preempt disabled
+    - IB/hfi1: Fix early init panic
+    - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
+    - can: kvaser_usb: get CAN clock frequency from device
+    - can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct
+      stats->{rx,tx}_errors counter
+    - can: sja1000: fix use after free in ems_pcmcia_add_card()
+    - can: pch_can: pch_can_rx_normal: fix use after free
+    - can: m_can: m_can_read_fifo: fix memory leak in error branch
+    - can: m_can: pci: fix incorrect reference clock rate
+    - can: m_can: pci: fix iomap_read_fifo() and iomap_write_fifo()
+    - can: m_can: Disable and ignore ELO interrupt
+    - net: dsa: mv88e6xxx: fix "don't use PHY_DETECT on internal PHY's"
+    - net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
+    - x86/sme: Explicitly map new EFI memmap table as encrypted
+    - platform/x86: amd-pmc: Fix s2idle failures on certain AMD laptops
+    - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
+    - selftests: netfilter: add a vrf+conntrack testcase
+    - vrf: don't run conntrack on vrf with !dflt qdisc
+    - bpf, x86: Fix "no previous prototype" warning
+    - bpf, sockmap: Attach map progs to psock early for feature probes
+    - bpf: Make sure bpf_disable_instrumentation() is safe vs preemption.
+    - bpf: Fix the off-by-two error in range markings
+    - ice: ignore dropped packets during init
+    - ethtool: do not perform operations on net devices being unregistered
+    - bonding: make tx_rebalance_counter an atomic
+    - nfp: Fix memory leak in nfp_cpp_area_cache_add()
+    - udp: using datalen to cap max gso segments
+    - netfilter: nft_exthdr: break evaluation if setting TCP option fails
+    - netfilter: conntrack: annotate data-races around ct->timeout
+    - iavf: restore MSI state on reset
+    - iavf: Fix reporting when setting descriptor count
+    - IB/hfi1: Correct guard on eager buffer deallocation
+    - devlink: fix netns refcount leak in devlink_nl_cmd_reload()
+    - net: bcm4908: Handle dma_set_coherent_mask error codes
+    - net: dsa: mv88e6xxx: error handling for serdes_power functions
+    - net: dsa: felix: Fix memory leak in felix_setup_mmio_filtering
+    - net/sched: fq_pie: prevent dismantle issue
+    - net: mvpp2: fix XDP rx queues registering
+    - KVM: x86: Don't WARN if userspace mucks with RCX during string I/O exit
+    - KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI req
+    - KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush
+      hypercall
+    - timers: implement usleep_idle_range()
+    - mm/damon/core: fix fake load reports due to uninterruptible sleeps
+    - mm/slub: fix endianness bug for alloc/free_traces attributes
+    - mm: bdi: initialize bdi_min_ratio when bdi is unregistered
+    - ALSA: ctl: Fix copy of updated id with element read/write
+    - ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
+    - ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
+    - ALSA: pcm: oss: Fix negative period/buffer sizes
+    - ALSA: pcm: oss: Limit the period size to 16MB
+    - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
+    - cifs: Fix crash on unload of cifs_arc4.ko
+    - scsi: qla2xxx: Format log strings only if needed
+    - btrfs: clear extent buffer uptodate when we fail to write it
+    - btrfs: fix re-dirty process of tree-log nodes
+    - btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
+    - btrfs: free exchange changeset on failures
+    - perf intel-pt: Fix some PGE (packet generation enable/control flow packets)
+      usage
+    - perf intel-pt: Fix sync state when a PSB (synchronization) packet is found
+    - perf intel-pt: Fix intel_pt_fup_event() assumptions about setting state type
+    - perf intel-pt: Fix state setting when receiving overflow (OVF) packet
+    - perf intel-pt: Fix next 'err' value, walking trace
+    - perf intel-pt: Fix missing 'instruction' events with 'q' option
+    - perf intel-pt: Fix error timestamp setting on the decoder error path
+    - md: fix update super 1.0 on rdev size change
+    - nfsd: fix use-after-free due to delegation race
+    - nfsd: Fix nsfd startup race (again)
+    - tracefs: Have new files inherit the ownership of their parent
+    - selftests: KVM: avoid failures due to reserved HyperTransport region
+    - hwmon: (pwm-fan) Ensure the fan going on in .probe()
+    - mmc: renesas_sdhi: initialize variable properly when tuning
+    - clk: qcom: regmap-mux: fix parent clock lookup
+    - thermal: int340x: Fix VCoRefLow MMIO bit offset for TGL
+    - drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
+    - libata: add horkage for ASMedia 1092
+    - io_uring: ensure task_work gets run as part of cancelations
+    - wait: add wake_up_pollfree()
+    - binder: use wake_up_pollfree()
+    - signalfd: use wake_up_pollfree()
+    - aio: keep poll requests on waitqueue until completed
+    - aio: fix use-after-free due to missing POLLFREE handling
+    - tracefs: Set all files to the same group ownership as the mount option
+    - i2c: mpc: Use atomic read and fix break condition
+    - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
+    - scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
+    - scsi: scsi_debug: Fix buffer size of REPORT ZONES command
+    - ALSA: usb-audio: Reorder snd_djm_devices[] entries
+    - qede: validate non LSO skb length
+    - PM: runtime: Fix pm_runtime_active() kerneldoc comment
+    - ASoC: rt5682: Fix crash due to out of scope stack vars
+    - ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer
+    - ASoC: codecs: wsa881x: fix return values from kcontrol put
+    - ASoC: codecs: wcd934x: handle channel mappping list correctly
+    - ASoC: codecs: wcd934x: return correct value from mixer put
+    - RDMA/hns: Do not halt commands during reset until later
+    - RDMA/hns: Do not destroy QP resources in the hw resetting phase
+    - hwmon: (dell-smm) Fix warning on /proc/i8k creation error
+    - clk: imx: use module_platform_driver
+    - clk: qcom: clk-alpha-pll: Don't reconfigure running Trion
+    - i40e: Fix failed opcode appearing if handling messages from VF
+    - i40e: Fix pre-set max number of queues for VF
+    - mtd: rawnand: fsmc: Take instruction delay into account
+    - mtd: rawnand: fsmc: Fix timing computation
+    - bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap
+    - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
+    - Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge"
+    - drm/amd/display: Fix DPIA outbox timeout after S3/S4/reset
+    - perf tools: Fix SMT detection fast read path
+    - Documentation/locking/locktypes: Update migrate_disable() bits.
+    - dt-bindings: net: Reintroduce PHY no lane swap binding
+    - tools build: Remove needless libpython-version feature check that breaks
+      test-all fast path
+    - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
+    - net: altera: set a couple error code in probe()
+    - net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
+    - net, neigh: clear whole pneigh_entry at alloc time
+    - net/qla3xxx: fix an error code in ql_adapter_up()
+    - selftests/fib_tests: Rework fib_rp_filter_test()
+    - USB: gadget: detect too-big endpoint 0 requests
+    - USB: gadget: zero allocate endpoint 0 buffers
+    - Revert "usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by default"
+    - usb: core: config: fix validation of wMaxPacketValue entries
+    - usb: core: config: using bit mask instead of individual bits
+    - xhci: avoid race between disable slot command and host runtime suspend
+    - iio: gyro: adxrs290: fix data signedness
+    - iio: trigger: Fix reference counting
+    - iio: trigger: stm32-timer: fix MODULE_ALIAS
+    - iio: stk3310: Don't return error code in interrupt handler
+    - iio: mma8452: Fix trigger reference couting
+    - iio: ltr501: Don't return error code in trigger handler
+    - iio: kxsd9: Don't return error code in trigger handler
+    - iio: itg3200: Call iio_trigger_notify_done() on error
+    - iio: dln2-adc: Fix lockdep complaint
+    - iio: dln2: Check return value of devm_iio_trigger_register()
+    - iio: at91-sama5d2: Fix incorrect sign extension
+    - iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
+    - iio: adc: axp20x_adc: fix charging current reporting on AXP22x
+    - iio: ad7768-1: Call iio_trigger_notify_done() on error
+    - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
+    - nvmem: eeprom: at25: fix FRAM byte_len
+    - bus: mhi: pci_generic: Fix device recovery failed issue
+    - bus: mhi: core: Add support for forced PM resume
+    - csky: fix typo of fpu config macro
+    - irqchip/aspeed-scu: Replace update_bits with write_bits.
+    - irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
+    - irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
+    - aio: Fix incorrect usage of eventfd_signal_allowed()
+    - irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
+    - irqchip: nvic: Fix offset for Interrupt Priority Offsets
+    - misc: fastrpc: fix improper packet size calculation
+    - clocksource/drivers/dw_apb_timer_of: Fix probe failure
+    - bpf: Add selftests to cover packet access corner cases
+    - Linux 5.15.8
+
+  * Can't read/write SD card after running CPU offline test in 5.11.0 and 5.13.0
+    (LP: #1951784) // Jammy update: v5.15.8 upstream stable release
+    (LP: #1954931)
+    - misc: rtsx: Avoid mangling IRQ during runtime PM
+
+  * Enable Landlock by default (LP: #1953192)
+    - [Config] Enable Landlock by default
+
+  * Add s0i3 RTC wake up for AMD systems (LP: #1950013)
+    - platform/x86: amd-pmc: Export Idlemask values based on the APU
+    - platform/x86: amd-pmc: adjust arguments for `amd_pmc_send_cmd`
+    - platform/x86: amd-pmc: Add special handling for timer based S0i3 wakeup
+
+  * Fix runtime power management on USB controller with XHCI_RESET_ON_RESUME
+    flag (LP: #1954369)
+    - SAUCE: xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime
+      suspending
+
+  * Fix System hangs on black screen when reboot (LP: #1949321)
+    - drm/i915/hdmi: convert intel_hdmi_to_dev to intel_hdmi_to_i915
+    - drm/i915: Don't request GMBUS to generate irqs when called while irqs are
+      off
+    - drm/i915/hdmi: Turn DP++ TMDS output buffers back on in encoder->shutdown()
+
+  * require CAP_NET_ADMIN to attach N_HCI ldisc (LP: #1949516)
+    - Bluetooth: hci_ldisc: require CAP_NET_ADMIN to attach N_HCI ldisc
+
+  * mt7921e: Failed to start WM firmware (LP: #1954300)
+    - SAUCE: Bluetooth: btusb: Handle download_firmware failure cases
+    - SAUCE: Bluetooth: btusb: Return error code when getting patch status failed
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Add list of built-in modules to the ABI
+    - [Packaging] abi-check: Process modules.builtin
+    - SAUCE: allow to use __wake_up_pollfree() from GPL modules
+    - [Packaging] enforce xz compression for debs
+    - [Config] update config after v5.15.12
+    - [Packaging] temporarily disable signed v4l2loopback
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 04 Jan 2022 11:22:10 +0100
+
+linux (5.15.0-14.14) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-14.14 -proposed tracker (LP: #1954627)
+
+  * Jammy update: v5.15.7 upstream stable release (LP: #1953731)
+    - ALSA: usb-audio: Restrict rates for the shared clocks
+    - ALSA: usb-audio: Rename early_playback_start flag with lowlatency_playback
+    - ALSA: usb-audio: Disable low-latency playback for free-wheel mode
+    - ALSA: usb-audio: Disable low-latency mode for implicit feedback sync
+    - ALSA: usb-audio: Check available frames for the next packet size
+    - ALSA: usb-audio: Add spinlock to stop_urbs()
+    - ALSA: usb-audio: Improved lowlatency playback support
+    - ALSA: usb-audio: Avoid killing in-flight URBs during draining
+    - ALSA: usb-audio: Fix packet size calculation regression
+    - ALSA: usb-audio: Less restriction for low-latency playback mode
+    - ALSA: usb-audio: Switch back to non-latency mode at a later point
+    - ALSA: usb-audio: Don't start stream for capture at prepare
+    - gfs2: release iopen glock early in evict
+    - gfs2: Fix length of holes reported at end-of-file
+    - powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for
+      persistent memory"
+    - powerpc/pseries/ddw: Do not try direct mapping with persistent memory and
+      one window
+    - drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY
+    - mac80211: do not access the IV when it was stripped
+    - mac80211: fix throughput LED trigger
+    - x86/hyperv: Move required MSRs check to initial platform probing
+    - net/smc: Transfer remaining wait queue entries during fallback
+    - atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
+    - net: return correct error code
+    - pinctrl: qcom: fix unmet dependencies on GPIOLIB for GPIOLIB_IRQCHIP
+    - platform/x86: dell-wmi-descriptor: disable by default
+    - platform/x86: thinkpad_acpi: Add support for dual fan control
+    - platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
+    - s390/setup: avoid using memblock_enforce_memory_limit
+    - btrfs: silence lockdep when reading chunk tree during mount
+    - btrfs: check-integrity: fix a warning on write caching disabled disk
+    - thermal: core: Reset previous low and high trip during thermal zone init
+    - scsi: iscsi: Unblock session then wake up error handler
+    - drm/amd/pm: Remove artificial freq level on Navi1x
+    - drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
+    - drm/amd/amdgpu: fix potential memleak
+    - ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
+    - ata: libahci: Adjust behavior when StorageD3Enable _DSD is set
+    - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in
+      hns_dsaf_ge_srst_by_port()
+    - ipv6: check return value of ipv6_skip_exthdr
+    - net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of
+      bound
+    - net: ethernet: dec: tulip: de4x5: fix possible array overflows in
+      type3_infoblock()
+    - perf sort: Fix the 'weight' sort key behavior
+    - perf sort: Fix the 'ins_lat' sort key behavior
+    - perf sort: Fix the 'p_stage_cyc' sort key behavior
+    - perf inject: Fix ARM SPE handling
+    - perf hist: Fix memory leak of a perf_hpp_fmt
+    - perf report: Fix memory leaks around perf_tip()
+    - tracing: Don't use out-of-sync va_list in event printing
+    - net/smc: Avoid warning of possible recursive locking
+    - ACPI: Add stubs for wakeup handler functions
+    - net/tls: Fix authentication failure in CCM mode
+    - vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
+    - kprobes: Limit max data_size of the kretprobe instances
+    - ALSA: hda/cs8409: Set PMSG_ON earlier inside cs8409 driver
+    - rt2x00: do not mark device gone on EPROTO errors during start
+    - ipmi: Move remove_work to dedicated workqueue
+    - cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
+    - iwlwifi: mvm: retry init flow if failed
+    - dma-buf: system_heap: Use 'for_each_sgtable_sg' in pages free flow
+    - s390/pci: move pseudo-MMIO to prevent MIO overlap
+    - fget: check that the fd still exists after getting a ref to it
+    - sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
+    - sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
+    - scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO
+    - scsi: ufs: ufs-pci: Add support for Intel ADL
+    - ipv6: fix memory leak in fib6_rule_suppress
+    - drm/amd/display: Allow DSC on supported MST branch devices
+    - drm/i915/dp: Perform 30ms delay after source OUI write
+    - KVM: fix avic_set_running for preemptable kernels
+    - KVM: Disallow user memslot with size that exceeds "unsigned long"
+    - KVM: x86/mmu: Fix TLB flush range when handling disconnected pt
+    - KVM: Ensure local memslot copies operate on up-to-date arch-specific data
+    - KVM: x86: ignore APICv if LAPIC is not enabled
+    - KVM: nVMX: Emulate guest TLB flush on nested VM-Enter with new vpid12
+    - KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST
+    - KVM: nVMX: Abide to KVM_REQ_TLB_FLUSH_GUEST request on nested vmentry/vmexit
+    - KVM: VMX: prepare sync_pir_to_irr for running with APICv disabled
+    - KVM: x86: Use a stable condition around all VT-d PI paths
+    - KVM: MMU: shadow nested paging does not have PKU
+    - KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1
+    - KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
+    - KVM: x86: check PIR even for vCPUs with disabled APICv
+    - tracing/histograms: String compares should not care about signed values
+    - net: dsa: mv88e6xxx: Fix application of erratum 4.8 for 88E6393X
+    - net: dsa: mv88e6xxx: Drop unnecessary check in
+      mv88e6393x_serdes_erratum_4_6()
+    - net: dsa: mv88e6xxx: Save power by disabling SerDes trasmitter and receiver
+    - net: dsa: mv88e6xxx: Add fix for erratum 5.2 of 88E6393X family
+    - net: dsa: mv88e6xxx: Fix inband AN for 2500base-x on 88E6393X family
+    - net: dsa: mv88e6xxx: Link in pcs_get_state() if AN is bypassed
+    - wireguard: selftests: increase default dmesg log size
+    - wireguard: allowedips: add missing __rcu annotation to satisfy sparse
+    - wireguard: selftests: actually test for routing loops
+    - wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST
+    - wireguard: device: reset peer src endpoint when netns exits
+    - wireguard: receive: use ring buffer for incoming handshakes
+    - wireguard: receive: drop handshakes if queue lock is contended
+    - wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
+    - i2c: stm32f7: flush TX FIFO upon transfer errors
+    - i2c: stm32f7: recover the bus on access timeout
+    - i2c: stm32f7: stop dma transfer in case of NACK
+    - i2c: cbus-gpio: set atomic transfer callback
+    - natsemi: xtensa: fix section mismatch warnings
+    - tcp: fix page frag corruption on page fault
+    - net: qlogic: qlcnic: Fix a NULL pointer dereference in
+      qlcnic_83xx_add_rings()
+    - net: mpls: Fix notifications when deleting a device
+    - siphash: use _unaligned version by default
+    - arm64: ftrace: add missing BTIs
+    - iwlwifi: fix warnings produced by kernel debug options
+    - net/mlx5e: IPsec: Fix Software parser inner l3 type setting in case of
+      encapsulation
+    - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
+    - selftests: net: Correct case name
+    - net: dsa: b53: Add SPI ID table
+    - mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
+    - ASoC: tegra: Fix wrong value type in ADMAIF
+    - ASoC: tegra: Fix wrong value type in I2S
+    - ASoC: tegra: Fix wrong value type in DMIC
+    - ASoC: tegra: Fix wrong value type in DSPK
+    - ASoC: tegra: Fix kcontrol put callback in ADMAIF
+    - ASoC: tegra: Fix kcontrol put callback in I2S
+    - ASoC: tegra: Fix kcontrol put callback in DMIC
+    - ASoC: tegra: Fix kcontrol put callback in DSPK
+    - ASoC: tegra: Fix kcontrol put callback in AHUB
+    - rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
+    - rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
+    - ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec
+    - net: stmmac: Avoid DMA_CHAN_CONTROL write if no Split Header support
+    - net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ
+      is available
+    - net: marvell: mvpp2: Fix the computation of shared CPUs
+    - dpaa2-eth: destroy workqueue at the end of remove function
+    - octeontx2-af: Fix a memleak bug in rvu_mbox_init()
+    - net: annotate data-races on txq->xmit_lock_owner
+    - ipv4: convert fib_num_tclassid_users to atomic_t
+    - net/smc: fix wrong list_del in smc_lgr_cleanup_early
+    - net/rds: correct socket tunable error in rds_tcp_tune()
+    - net/smc: Keep smc_close_final rc during active close
+    - drm/msm/a6xx: Allocate enough space for GMU registers
+    - drm/msm: Do hw_init() before capturing GPU state
+    - drm/vc4: kms: Wait for the commit before increasing our clock rate
+    - drm/vc4: kms: Fix return code check
+    - drm/vc4: kms: Add missing drm_crtc_commit_put
+    - drm/vc4: kms: Clear the HVS FIFO commit pointer once done
+    - drm/vc4: kms: Don't duplicate pending commit
+    - drm/vc4: kms: Fix previous HVS commit wait
+    - atlantic: Increase delay for fw transactions
+    - atlatnic: enable Nbase-t speeds with base-t
+    - atlantic: Fix to display FW bundle version instead of FW mac version.
+    - atlantic: Add missing DIDs and fix 115c.
+    - Remove Half duplex mode speed capabilities.
+    - atlantic: Fix statistics logic for production hardware
+    - atlantic: Remove warn trace message.
+    - KVM: x86/mmu: Skip tlb flush if it has been done in zap_gfn_range()
+    - KVM: x86/mmu: Pass parameter flush as false in
+      kvm_tdp_mmu_zap_collapsible_sptes()
+    - drm/msm/devfreq: Fix OPP refcnt leak
+    - drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP
+    - drm/msm: Fix wait_fence submitqueue leak
+    - drm/msm: Restore error return on invalid fence
+    - ASoC: rk817: Add module alias for rk817-codec
+    - iwlwifi: Fix memory leaks in error handling path
+    - KVM: X86: Fix when shadow_root_level=5 && guest root_level<4
+    - KVM: SEV: initialize regions_list of a mirror VM
+    - net/mlx5e: Fix missing IPsec statistics on uplink representor
+    - net/mlx5: Move MODIFY_RQT command to ignore list in internal error state
+    - net/mlx5: E-switch, Respect BW share of the new group
+    - net/mlx5: E-Switch, fix single FDB creation on BlueField
+    - net/mlx5: E-Switch, Check group pointer before reading bw_share value
+    - KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
+    - KVM: VMX: Set failure code in prepare_vmcs02()
+    - mctp: Don't let RTM_DELROUTE delete local routes
+    - Revert "drm/i915: Implement Wa_1508744258"
+    - io-wq: don't retry task_work creation failure on fatal conditions
+    - x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
+    - x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
+    - x86/entry: Use the correct fence macro after swapgs in kernel CR3
+    - x86/xen: Add xenpv_restore_regs_and_return_to_usermode()
+    - preempt/dynamic: Fix setup_preempt_mode() return value
+    - sched/uclamp: Fix rq->uclamp_max not set on first enqueue
+    - KVM: SEV: Return appropriate error codes if SEV-ES scratch setup fails
+    - KVM: x86/mmu: Rename slot_handle_leaf to slot_handle_level_4k
+    - KVM: x86/mmu: Remove spurious TLB flushes in TDP MMU zap collapsible path
+    - net/mlx5e: Rename lro_timeout to packet_merge_timeout
+    - net/mlx5e: Rename TIR lro functions to TIR packet merge functions
+    - net/mlx5e: Sync TIR params updates against concurrent create/modify
+    - serial: 8250_bcm7271: UART errors after resuming from S2
+    - parisc: Fix KBUILD_IMAGE for self-extracting kernel
+    - parisc: Fix "make install" on newer debian releases
+    - parisc: Mark cr16 CPU clocksource unstable on all SMP machines
+    - vgacon: Propagate console boot parameters before calling `vc_resize'
+    - xhci: Fix commad ring abort, write all 64 bits to CRCR register.
+    - USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
+    - usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
+    - usb: cdns3: gadget: fix new urb never complete if ep cancel previous
+      requests
+    - usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()
+    - x86/tsc: Add a timer to make sure TSC_adjust is always checked
+    - x86/tsc: Disable clocksource watchdog for TSC on qualified platorms
+    - x86/64/mm: Map all kernel memory into trampoline_pgd
+    - tty: serial: msm_serial: Deactivate RX DMA for polling support
+    - serial: pl011: Add ACPI SBSA UART match id
+    - serial: tegra: Change lower tolerance baud rate limit for tegra20 and
+      tegra30
+    - serial: core: fix transmit-buffer reset and memleak
+    - serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
+    - serial: 8250_pci: rewrite pericom_do_set_divisor()
+    - serial: 8250: Fix RTS modem control while in rs485 mode
+    - serial: liteuart: Fix NULL pointer dereference in ->remove()
+    - serial: liteuart: fix use-after-free and memleak on unbind
+    - serial: liteuart: fix minor-number leak on probe errors
+    - ipmi: msghandler: Make symbol 'remove_work_wq' static
+    - Linux 5.15.7
+
+  * Updates to ib_peer_memory requested by Nvidia (LP: #1947206)
+    - SAUCE: RDMA/core: Updated ib_peer_memory
+    - SAUCE: RDMA/core: ib_peer_memory fix build errors
+
+  * Jammy update: v5.15.6 upstream stable release (LP: #1953370)
+    - scsi: sd: Fix sd_do_mode_sense() buffer length handling
+    - ACPI: Get acpi_device's parent from the parent field
+    - ACPI: CPPC: Add NULL pointer check to cppc_get_perf()
+    - USB: serial: pl2303: fix GC type detection
+    - USB: serial: option: add Telit LE910S1 0x9200 composition
+    - USB: serial: option: add Fibocom FM101-GL variants
+    - usb: dwc2: gadget: Fix ISOC flow for elapsed frames
+    - usb: dwc2: hcd_queue: Fix use of floating point literal
+    - usb: dwc3: leave default DMA for PCI devices
+    - usb: dwc3: core: Revise GHWPARAMS9 offset
+    - usb: dwc3: gadget: Ignore NoStream after End Transfer
+    - usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer
+    - usb: dwc3: gadget: Fix null pointer exception
+    - net: usb: Correct PHY handling of smsc95xx
+    - net: nexthop: fix null pointer dereference when IPv6 is not enabled
+    - usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe
+    - usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts
+    - usb: xhci: tegra: Check padctrl interrupt presence in device tree
+    - usb: hub: Fix usb enumeration issue due to address0 race
+    - usb: hub: Fix locking issues with address0_mutex
+    - binder: fix test regression due to sender_euid change
+    - ALSA: ctxfi: Fix out-of-range access
+    - ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100
+    - ALSA: hda/realtek: Fix LED on HP ProBook 435 G7
+    - media: cec: copy sequence field for the reply
+    - Revert "parisc: Fix backtrace to always include init funtion names"
+    - HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts
+    - staging/fbtft: Fix backlight
+    - staging: greybus: Add missing rwsem around snd_ctl_remove() calls
+    - staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
+    - staging: r8188eu: Use kzalloc() with GFP_ATOMIC in atomic context
+    - staging: r8188eu: Fix breakage introduced when 5G code was removed
+    - staging: r8188eu: use GFP_ATOMIC under spinlock
+    - staging: r8188eu: fix a memory leak in rtw_wx_read32()
+    - fuse: release pipe buf after last use
+    - xen: don't continue xenstore initialization in case of errors
+    - xen: detect uninitialized xenbus in xenbus_init
+    - io_uring: correct link-list traversal locking
+    - io_uring: fail cancellation for EXITING tasks
+    - io_uring: fix link traversal locking
+    - drm/amdgpu: IH process reset count when restart
+    - drm/amdgpu/pm: fix powerplay OD interface
+    - drm/nouveau: recognise GA106
+    - ksmbd: downgrade addition info error msg to debug in smb2_get_info_sec()
+    - ksmbd: contain default data stream even if xattr is empty
+    - ksmbd: fix memleak in get_file_stream_info()
+    - KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB
+    - tracing/uprobe: Fix uprobe_perf_open probes iteration
+    - tracing: Fix pid filtering when triggers are attached
+    - mmc: sdhci-esdhc-imx: disable CMDQ support
+    - mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB
+    - mdio: aspeed: Fix "Link is Down" issue
+    - arm64: mm: Fix VM_BUG_ON(mm != &init_mm) for trans_pgd
+    - cpufreq: intel_pstate: Fix active mode offline/online EPP handling
+    - powerpc/32: Fix hardlockup on vmap stack overflow
+    - iomap: Fix inline extent handling in iomap_readpage
+    - NFSv42: Fix pagecache invalidation after COPY/CLONE
+    - PCI: aardvark: Deduplicate code in advk_pcie_rd_conf()
+    - PCI: aardvark: Implement re-issuing config requests on CRS response
+    - PCI: aardvark: Simplify initialization of rootcap on virtual bridge
+    - PCI: aardvark: Fix link training
+    - drm/amd/display: Fix OLED brightness control on eDP
+    - proc/vmcore: fix clearing user buffer by properly using clear_user()
+    - ASoC: SOF: Intel: hda: fix hotplug when only codec is suspended
+    - netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY
+    - netfilter: ctnetlink: do not erase error code with EINVAL
+    - netfilter: ipvs: Fix reuse connection if RS weight is 0
+    - netfilter: flowtable: fix IPv6 tunnel addr match
+    - media: v4l2-core: fix VIDIOC_DQEVENT handling on non-x86
+    - firmware: arm_scmi: Fix null de-reference on error path
+    - ARM: dts: BCM5301X: Fix I2C controller interrupt
+    - ARM: dts: BCM5301X: Add interrupt properties to GPIO node
+    - ARM: dts: bcm2711: Fix PCIe interrupts
+    - ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer
+    - ASoC: qdsp6: q6asm: fix q6asm_dai_prepare error handling
+    - ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
+    - ASoC: codecs: wcd938x: fix volatile register range
+    - ASoC: codecs: wcd934x: return error code correctly from hw_params
+    - ASoC: codecs: lpass-rx-macro: fix HPHR setting CLSH mask
+    - net: ieee802154: handle iftypes as u32
+    - firmware: arm_scmi: Fix base agent discover response
+    - firmware: arm_scmi: pm: Propagate return value to caller
+    - ASoC: stm32: i2s: fix 32 bits channel length without mclk
+    - NFSv42: Don't fail clone() unless the OP_CLONE operation failed
+    - ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
+    - drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks
+    - scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo()
+    - scsi: mpt3sas: Fix kernel panic during drive powercycle test
+    - scsi: mpt3sas: Fix system going into read-only mode
+    - scsi: mpt3sas: Fix incorrect system timestamp
+    - drm/vc4: fix error code in vc4_create_object()
+    - drm/aspeed: Fix vga_pw sysfs output
+    - net: marvell: prestera: fix brige port operation
+    - net: marvell: prestera: fix double free issue on err path
+    - HID: input: Fix parsing of HID_CP_CONSUMER_CONTROL fields
+    - HID: input: set usage type to key on keycode remap
+    - HID: magicmouse: prevent division by 0 on scroll
+    - iavf: Prevent changing static ITR values if adaptive moderation is on
+    - iavf: Fix refreshing iavf adapter stats on ethtool request
+    - iavf: Fix VLAN feature flags after VFR
+    - x86/pvh: add prototype for xen_pvh_init()
+    - xen/pvh: add missing prototype to header
+    - ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec
+    - mptcp: fix delack timer
+    - mptcp: use delegate action to schedule 3rd ack retrans
+    - af_unix: fix regression in read after shutdown
+    - firmware: smccc: Fix check for ARCH_SOC_ID not implemented
+    - ipv6: fix typos in __ip6_finish_output()
+    - nfp: checking parameter process for rx-usecs/tx-usecs is invalid
+    - net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls
+    - net: ipv6: add fib6_nh_release_dsts stub
+    - net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group
+    - ice: fix vsi->txq_map sizing
+    - ice: avoid bpf_prog refcount underflow
+    - scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
+    - scsi: scsi_debug: Zero clear zones at reset write pointer
+    - erofs: fix deadlock when shrink erofs slab
+    - i2c: virtio: disable timeout handling
+    - net/smc: Ensure the active closing peer first closes clcsock
+    - mlxsw: spectrum: Protect driver from buggy firmware
+    - net: ipa: directly disable ipa-setup-ready interrupt
+    - net: ipa: separate disabling setup from modem stop
+    - net: ipa: kill ipa_cmd_pipeline_clear()
+    - net: marvell: mvpp2: increase MTU limit when XDP enabled
+    - cpufreq: intel_pstate: Add Ice Lake server to out-of-band IDs
+    - nvmet-tcp: fix incomplete data digest send
+    - drm/hyperv: Fix device removal on Gen1 VMs
+    - arm64: uaccess: avoid blocking within critical sections
+    - net/ncsi : Add payload to be 32-bit aligned to fix dropped packets
+    - PM: hibernate: use correct mode for swsusp_close()
+    - drm/amd/display: Fix DPIA outbox timeout after GPU reset
+    - drm/amd/display: Set plane update flags for all planes in reset
+    - tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited
+      flows
+    - lan743x: fix deadlock in lan743x_phy_link_status_change()
+    - net: phylink: Force link down and retrigger resolve on interface change
+    - net: phylink: Force retrigger in case of latched link-fail indicator
+    - net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
+    - net/smc: Fix loop in smc_listen
+    - nvmet: use IOCB_NOWAIT only if the filesystem supports it
+    - igb: fix netpoll exit with traffic
+    - MIPS: loongson64: fix FTLB configuration
+    - MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
+    - tls: splice_read: fix record type check
+    - tls: splice_read: fix accessing pre-processed records
+    - tls: fix replacing proto_ops
+    - net: stmmac: Disable Tx queues when reconfiguring the interface
+    - net/sched: sch_ets: don't peek at classes beyond 'nbands'
+    - ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
+    - net: vlan: fix underflow for the real_dev refcnt
+    - net/smc: Don't call clcsock shutdown twice when smc shutdown
+    - net: hns3: fix VF RSS failed problem after PF enable multi-TCs
+    - net: hns3: fix incorrect components info of ethtool --reset command
+    - net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP
+    - net: mscc: ocelot: correctly report the timestamping RX filters in ethtool
+    - locking/rwsem: Make handoff bit handling more consistent
+    - perf: Ignore sigtrap for tracepoints destined for other tasks
+    - sched/scs: Reset task stack state in bringup_cpu()
+    - iommu/rockchip: Fix PAGE_DESC_HI_MASKs for RK3568
+    - iommu/vt-d: Fix unmap_pages support
+    - f2fs: quota: fix potential deadlock
+    - f2fs: set SBI_NEED_FSCK flag when inconsistent node block found
+    - riscv: dts: microchip: fix board compatible
+    - riscv: dts: microchip: drop duplicated MMC/SDHC node
+    - cifs: nosharesock should not share socket with future sessions
+    - ceph: properly handle statfs on multifs setups
+    - iommu/amd: Clarify AMD IOMMUv2 initialization messages
+    - vdpa_sim: avoid putting an uninitialized iova_domain
+    - vhost/vsock: fix incorrect used length reported to the guest
+    - ksmbd: Fix an error handling path in 'smb2_sess_setup()'
+    - tracing: Check pid filtering when creating events
+    - cifs: nosharesock should be set on new server
+    - io_uring: fix soft lockup when call __io_remove_buffers
+    - firmware: arm_scmi: Fix type error assignment in voltage protocol
+    - firmware: arm_scmi: Fix type error in sensor protocol
+    - docs: accounting: update delay-accounting.rst reference
+    - blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and
+      disk_release()
+    - block: avoid to quiesce queue in elevator_init_mq
+    - drm/amdgpu/gfx10: add wraparound gpu counter check for APUs as well
+    - drm/amdgpu/gfx9: switch to golden tsc registers for renoir+
+    - Linux 5.15.6
+
+  * Fix bogus HDMI audio interface  (LP: #1953208)
+    - ALSA: hda/hdmi: Consider ELD is invalid when no SAD is present
+
+  * Miscellaneous Ubuntu changes
+    - [Config] re-enabled UBSAN without TRAP
+    - SAUCE: ipv6: fix NULL pointer dereference in ip6_output()
+    - SAUCE: RDMA/core: Introduce peer memory interface
+    - [Config] toolchain version update
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] Temporarily disable signing for ppc64el and s390x"
+    - Revert "UBUNTU: SAUCE: vt -- maintain bootloader screen mode and content
+      until vt switch"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 13 Dec 2021 12:13:17 +0100
+
+linux (5.15.0-13.13) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-13.13 -proposed tracker (LP: #1952583)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Jammy update: v5.15.5 upstream stable release (LP: #1952579)
+    - arm64: zynqmp: Do not duplicate flash partition label property
+    - arm64: zynqmp: Fix serial compatible string
+    - clk: sunxi-ng: Unregister clocks/resets when unbinding
+    - ARM: dts: sunxi: Fix OPPs node name
+    - arm64: dts: allwinner: h5: Fix GPU thermal zone node name
+    - arm64: dts: allwinner: a100: Fix thermal zone node name
+    - staging: wfx: ensure IRQ is ready before enabling it
+    - ARM: dts: BCM5301X: Fix nodes names
+    - ARM: dts: BCM5301X: Fix MDIO mux binding
+    - ARM: dts: NSP: Fix mpcore, mmc node names
+    - arm64: dts: broadcom: bcm4908: Move reboot syscon out of bus
+    - scsi: pm80xx: Fix memory leak during rmmod
+    - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
+    - ASoC: mediatek: mt8195: Add missing of_node_put()
+    - arm64: dts: rockchip: Disable CDN DP on Pinebook Pro
+    - arm64: dts: hisilicon: fix arm,sp805 compatible string
+    - RDMA/bnxt_re: Check if the vlan is valid before reporting
+    - bus: ti-sysc: Add quirk handling for reinit on context lost
+    - bus: ti-sysc: Use context lost quirk for otg
+    - usb: musb: tusb6010: check return value after calling
+      platform_get_resource()
+    - usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
+    - ARM: dts: ux500: Skomer regulator fixes
+    - staging: rtl8723bs: remove possible deadlock when disconnect (v2)
+    - staging: rtl8723bs: remove a second possible deadlock
+    - staging: rtl8723bs: remove a third possible deadlock
+    - ARM: BCM53016: Specify switch ports for Meraki MR32
+    - arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency
+    - arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property
+    - arm64: dts: qcom: ipq8074: Fix qcom,controlled-remotely property
+    - arm64: dts: qcom: sdm845: Fix qcom,controlled-remotely property
+    - arm64: dts: freescale: fix arm,sp805 compatible string
+    - arm64: dts: ls1012a: Add serial alias for ls1012a-rdb
+    - RDMA/rxe: Separate HW and SW l/rkeys
+    - ASoC: SOF: Intel: hda-dai: fix potential locking issue
+    - scsi: core: Fix scsi_mode_sense() buffer length handling
+    - ALSA: usb-audio: disable implicit feedback sync for Behringer UFX1204 and
+      UFX1604
+    - clk: imx: imx6ul: Move csi_sel mux to correct base register
+    - ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
+    - ASoC: rt5651: Use IRQF_NO_AUTOEN when requesting the IRQ
+    - ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect
+    - scsi: advansys: Fix kernel pointer leak
+    - scsi: smartpqi: Add controller handshake during kdump
+    - arm64: dts: imx8mm-kontron: Fix reset delays for ethernet PHY
+    - ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336
+      codec
+    - ASoC: Intel: soc-acpi: add missing quirk for TGL SDCA single amp
+    - ASoC: Intel: sof_sdw: add missing quirk for Dell SKU 0A45
+    - firmware_loader: fix pre-allocated buf built-in firmware use
+    - HID: multitouch: disable sticky fingers for UPERFECT Y
+    - ALSA: usb-audio: Add support for the Pioneer DJM 750MK2 Mixer/Soundcard
+    - ARM: dts: omap: fix gpmc,mux-add-data type
+    - usb: host: ohci-tmio: check return value after calling
+      platform_get_resource()
+    - ASoC: rt5682: fix a little pop while playback
+    - ARM: dts: ls1021a: move thermal-zones node out of soc/
+    - ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash
+    - ALSA: ISA: not for M68K
+    - iommu/vt-d: Do not falsely log intel_iommu is unsupported kernel option
+    - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
+    - MIPS: sni: Fix the build
+    - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
+    - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
+    - scsi: target: Fix ordered tag handling
+    - scsi: target: Fix alua_tg_pt_gps_count tracking
+    - iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr()
+    - RDMA/core: Use kvzalloc when allocating the struct ib_port
+    - scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
+    - scsi: lpfc: Fix link down processing to address NULL pointer dereference
+    - scsi: lpfc: Allow fabric node recovery if recovery is in progress before
+      devloss
+    - memory: tegra20-emc: Add runtime dependency on devfreq governor module
+    - powerpc/5200: dts: fix memory node unit name
+    - ARM: dts: qcom: fix memory and mdio nodes naming for RB3011
+    - arm64: dts: qcom: Fix node name of rpm-msg-ram device nodes
+    - ALSA: gus: fix null pointer dereference on pointer block
+    - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
+    - clk: at91: sama7g5: remove prescaler part of master clock
+    - iommu/dart: Initialize DART_STREAMS_ENABLE
+    - powerpc/dcr: Use cmplwi instead of 3-argument cmpli
+    - powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST
+    - sh: check return code of request_irq
+    - maple: fix wrong return value of maple_bus_init().
+    - f2fs: fix up f2fs_lookup tracepoints
+    - f2fs: fix to use WHINT_MODE
+    - f2fs: fix wrong condition to trigger background checkpoint correctly
+    - sh: fix kconfig unmet dependency warning for FRAME_POINTER
+    - sh: math-emu: drop unused functions
+    - sh: define __BIG_ENDIAN for math-emu
+    - f2fs: compress: disallow disabling compress on non-empty compressed file
+    - f2fs: fix incorrect return value in f2fs_sanity_check_ckpt()
+    - clk: ingenic: Fix bugs with divided dividers
+    - clk/ast2600: Fix soc revision for AHB
+    - clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk
+    - KVM: arm64: Fix host stage-2 finalization
+    - mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
+    - MIPS: boot/compressed/: add __bswapdi2() to target for ZSTD decompression
+    - sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
+    - sched/fair: Prevent dead task groups from regaining cfs_rq's
+    - perf/x86/vlbr: Add c->flags to vlbr event constraints
+    - blkcg: Remove extra blkcg_bio_issue_init
+    - tracing/histogram: Do not copy the fixed-size char array field over the
+      field size
+    - perf bpf: Avoid memory leak from perf_env__insert_btf()
+    - perf bench futex: Fix memory leak of perf_cpu_map__new()
+    - perf tests: Remove bash construct from record+zstd_comp_decomp.sh
+    - drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame
+    - bpf: Fix inner map state pruning regression.
+    - samples/bpf: Fix summary per-sec stats in xdp_sample_user
+    - samples/bpf: Fix incorrect use of strlen in xdp_redirect_cpu
+    - selftests: net: switch to socat in the GSO GRE test
+    - net/ipa: ipa_resource: Fix wrong for loop range
+    - tcp: Fix uninitialized access in skb frags array for Rx 0cp.
+    - tracing: Add length protection to histogram string copies
+    - nl80211: fix radio statistics in survey dump
+    - mac80211: fix monitor_sdata RCU/locking assertions
+    - net: ipa: HOLB register sometimes must be written twice
+    - net: ipa: disable HOLB drop when updating timer
+    - selftests: gpio: fix gpio compiling error
+    - net: bnx2x: fix variable dereferenced before check
+    - bnxt_en: reject indirect blk offload when hw-tc-offload is off
+    - tipc: only accept encrypted MSG_CRYPTO msgs
+    - sock: fix /proc/net/sockstat underflow in sk_clone_lock()
+    - net/smc: Make sure the link_id is unique
+    - NFSD: Fix exposure in nfsd4_decode_bitmap()
+    - iavf: Fix return of set the new channel count
+    - iavf: check for null in iavf_fix_features
+    - iavf: free q_vectors before queues in iavf_disable_vf
+    - iavf: don't clear a lock we don't hold
+    - iavf: Fix failure to exit out from last all-multicast mode
+    - iavf: prevent accidental free of filter structure
+    - iavf: validate pointers
+    - iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
+    - iavf: Fix for setting queues to 0
+    - iavf: Restore VLAN filters after link down
+    - bpf: Fix toctou on read-only map's constant scalar tracking
+    - MIPS: generic/yamon-dt: fix uninitialized variable error
+    - mips: bcm63xx: add support for clk_get_parent()
+    - mips: lantiq: add support for clk_get_parent()
+    - gpio: rockchip: needs GENERIC_IRQ_CHIP to fix build errors
+    - platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
+    - platform/x86: think-lmi: Abort probe on analyze failure
+    - udp: Validate checksum in udp_read_sock()
+    - btrfs: make 1-bit bit-fields of scrub_page unsigned int
+    - RDMA/core: Set send and receive CQ before forwarding to the driver
+    - net/mlx5e: kTLS, Fix crash in RX resync flow
+    - net/mlx5e: Wait for concurrent flow deletion during neigh/fib events
+    - net/mlx5: E-Switch, Fix resetting of encap mode when entering switchdev
+    - net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
+    - net/mlx5: Update error handler for UCTX and UMEM
+    - net/mlx5: E-Switch, rebuild lag only when needed
+    - net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
+    - net/mlx5: Lag, update tracker when state change event received
+    - net/mlx5: E-Switch, return error if encap isn't supported
+    - scsi: ufs: core: Improve SCSI abort handling
+    - scsi: core: sysfs: Fix hang when device state is set via sysfs
+    - scsi: ufs: core: Fix task management completion timeout race
+    - scsi: ufs: core: Fix another task management completion race
+    - net: mvmdio: fix compilation warning
+    - net: sched: act_mirred: drop dst for the direction from egress to ingress
+    - net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
+    - net: virtio_net_hdr_to_skb: count transport header in UFO
+    - i40e: Fix correct max_pkt_size on VF RX queue
+    - i40e: Fix NULL ptr dereference on VSI filter sync
+    - i40e: Fix changing previously set num_queue_pairs for PFs
+    - i40e: Fix ping is lost after configuring ADq on VF
+    - RDMA/mlx4: Do not fail the registration on port stats
+    - i40e: Fix warning message and call stack during rmmod i40e driver
+    - i40e: Fix creation of first queue by omitting it if is not power of two
+    - i40e: Fix display error code in dmesg
+    - NFC: reorganize the functions in nci_request
+    - NFC: reorder the logic in nfc_{un,}register_device
+    - NFC: add NCI_UNREG flag to eliminate the race
+    - e100: fix device suspend/resume
+    - ptp: ocp: Fix a couple NULL vs IS_ERR() checks
+    - tools build: Fix removal of feature-sync-compare-and-swap feature detection
+    - riscv: fix building external modules
+    - KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr()
+    - powerpc: clean vdso32 and vdso64 directories
+    - powerpc/pseries: rename numa_dist_table to form2_distances
+    - powerpc/pseries: Fix numa FORM2 parsing fallback code
+    - pinctrl: qcom: sdm845: Enable dual edge errata
+    - pinctrl: qcom: sm8350: Correct UFS and SDC offsets
+    - perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
+    - perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
+    - perf/x86/intel/uncore: Fix IIO event constraints for Snowridge
+    - s390/kexec: fix return code handling
+    - blk-cgroup: fix missing put device in error path from blkg_conf_pref()
+    - dmaengine: remove debugfs #ifdef
+    - tun: fix bonding active backup with arp monitoring
+    - Revert "mark pstore-blk as broken"
+    - pstore/blk: Use "%lu" to format unsigned long
+    - hexagon: export raw I/O routines for modules
+    - hexagon: clean up timer-regs.h
+    - tipc: check for null after calling kmemdup
+    - ipc: WARN if trying to remove ipc object which is absent
+    - shm: extend forced shm destroy to support objects from several IPC nses
+    - mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
+    - hugetlb, userfaultfd: fix reservation restore on userfaultfd error
+    - kmap_local: don't assume kmap PTEs are linear arrays in memory
+    - mm/damon/dbgfs: use '__GFP_NOWARN' for user-specified size buffer allocation
+    - mm/damon/dbgfs: fix missed use of damon_dbgfs_lock
+    - x86/boot: Pull up cmdline preparation and early param parsing
+    - x86/sgx: Fix free page accounting
+    - x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
+    - KVM: x86: Assume a 64-bit hypercall for guests with protected state
+    - KVM: x86: Fix uninitialized eoi_exit_bitmap usage in vcpu_load_eoi_exitmap()
+    - KVM: x86/mmu: include EFER.LMA in extended mmu role
+    - KVM: x86/xen: Fix get_attr of KVM_XEN_ATTR_TYPE_SHARED_INFO
+    - powerpc/signal32: Fix sigset_t copy
+    - powerpc/xive: Change IRQ domain to a tree domain
+    - powerpc/8xx: Fix pinned TLBs with CONFIG_STRICT_KERNEL_RWX
+    - Revert "drm/i915/tgl/dsi: Gate the ddi clocks after pll mapping"
+    - Revert "parisc: Reduce sigreturn trampoline to 3 instructions"
+    - ata: libata: improve ata_read_log_page() error message
+    - ata: libata: add missing ata_identify_page_supported() calls
+    - scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id()
+    - pinctrl: ralink: include 'ralink_regs.h' in 'pinctrl-mt7620.c'
+    - s390/setup: avoid reserving memory above identity mapping
+    - s390/boot: simplify and fix kernel memory layout setup
+    - s390/vdso: filter out -mstack-guard and -mstack-size
+    - s390/kexec: fix memory leak of ipl report buffer
+    - s390/dump: fix copying to user-space of swapped kdump oldmem
+    - block: Check ADMIN before NICE for IOPRIO_CLASS_RT
+    - fbdev: Prevent probing generic drivers if a FB is already registered
+    - KVM: SEV: Disallow COPY_ENC_CONTEXT_FROM if target has created vCPUs
+    - KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested
+      state load
+    - drm/cma-helper: Release non-coherent memory with dma_free_noncoherent()
+    - printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces
+    - udf: Fix crash after seekdir
+    - spi: fix use-after-free of the add_lock mutex
+    - net: stmmac: socfpga: add runtime suspend/resume callback for stratix10
+      platform
+    - Drivers: hv: balloon: Use VMBUS_RING_SIZE() wrapper for dm_ring_size
+    - btrfs: fix memory ordering between normal and ordered work functions
+    - fs: handle circular mappings correctly
+    - net: stmmac: Fix signed/unsigned wreckage
+    - parisc/sticon: fix reverse colors
+    - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
+    - mac80211: fix radiotap header generation
+    - mac80211: drop check for DONT_REORDER in __ieee80211_select_queue
+    - drm/amd/display: Update swizzle mode enums
+    - drm/amd/display: Limit max DSC target bpp for specific monitors
+    - drm/i915/guc: Fix outstanding G2H accounting
+    - drm/i915/guc: Don't enable scheduling on a banned context, guc_id invalid,
+      not registered
+    - drm/i915/guc: Workaround reset G2H is received after schedule done G2H
+    - drm/i915/guc: Don't drop ce->guc_active.lock when unwinding context
+    - drm/i915/guc: Unwind context requests in reverse order
+    - drm/udl: fix control-message timeout
+    - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
+    - drm/nouveau: Add a dedicated mutex for the clients list
+    - drm/nouveau: use drm_dev_unplug() during device removal
+    - drm/nouveau: clean up all clients on device removal
+    - drm/i915/dp: Ensure sink rate values are always valid
+    - drm/i915/dp: Ensure max link params are always valid
+    - drm/i915: Fix type1 DVI DP dual mode adapter heuristic for modern platforms
+    - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga
+      and dvi connectors
+    - drm/amd/pm: avoid duplicate powergate/ungate setting
+    - signal: Implement force_fatal_sig
+    - exit/syscall_user_dispatch: Send ordinary signals on failure
+    - signal/powerpc: On swapcontext failure force SIGSEGV
+    - signal/s390: Use force_sigsegv in default_trap_handler
+    - signal/sparc32: Exit with a fatal signal when try_to_clear_window_buffer
+      fails
+    - signal/sparc32: In setup_rt_frame and setup_fram use force_fatal_sig
+    - signal/vm86_32: Properly send SIGSEGV when the vm86 state cannot be saved.
+    - signal/x86: In emulate_vsyscall force a signal instead of calling do_exit
+    - signal: Replace force_sigsegv(SIGSEGV) with force_fatal_sig(SIGSEGV)
+    - signal: Don't always set SA_IMMUTABLE for forced signals
+    - signal: Replace force_fatal_sig with force_exit_sig when in doubt
+    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare
+    - RDMA/netlink: Add __maybe_unused to static inline in C file
+    - bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs
+    - selinux: fix NULL-pointer dereference when hashtab allocation fails
+    - ASoC: DAPM: Cover regression by kctl change notification fix
+    - ASoC: rsnd: fixup DMAEngine API
+    - usb: max-3421: Use driver data instead of maintaining a list of bound
+      devices
+    - ice: Fix VF true promiscuous mode
+    - ice: Delete always true check of PF pointer
+    - fs: export an inode_update_time helper
+    - btrfs: update device path inode time instead of bd_inode
+    - net: add and use skb_unclone_keeptruesize() helper
+    - x86/Kconfig: Fix an unused variable error in dell-smm-hwmon
+    - ALSA: hda: hdac_ext_stream: fix potential locking issues
+    - ALSA: hda: hdac_stream: fix potential locking issue in
+      snd_hdac_stream_assign()
+    - Linux 5.15.5
+
+  * Fix non-working e1000e device after resume (LP: #1951861)
+    - SAUCE: Revert "e1000e: Additional PHY power saving in S0ix"
+    - SAUCE: Revert "e1000e: Add polling mechanism to indicate CSME DPG exit"
+    - SAUCE: Revert "e1000e: Add handshake with the CSME to support S0ix"
+
+  * [SRU][I/OEM-5.13/OEM-5.14] Add MAC passthrough support for more Lenovo docks
+    (LP: #1951767)
+    - net: usb: r8152: Add MAC passthrough support for more Lenovo Docks
+
+  * [amdgpu] USB4 support for DP tunneling (LP: #1951868)
+    - drm/amd/display: Support for DMUB HPD interrupt handling
+    - drm/amd/display: Update link encoder object creation.
+    - drm/amd/display: USB4 DPIA enumeration and AUX Tunneling
+    - drm/amd/display: Support for DMUB HPD and HPD RX interrupt handling
+    - drm/amd/display: Set DPIA link endpoint type
+    - drm/amd/display: Stub out DPIA link training call
+    - drm/amd/display: Add stub to get DPIA tunneling device data
+    - drm/amd/display: Skip DPCD read for DPTX-to-DPIA hop
+    - drm/amd/display: Train DPIA links with fallback
+    - drm/amd/display: Implement DPIA training loop
+    - drm/amd/display: Implement DPIA link configuration
+    - drm/amd/display: Implement DPIA clock recovery phase
+    - drm/amd/display: Implement DPIA equalisation phase
+    - drm/amd/display: Implement end of training for hop in DPIA display path
+    - drm/amd/display: Support for SET_CONFIG processing with DMUB
+    - drm/amd/display: isolate link training setting override to its own function
+    - drm/amd/display: Read USB4 DP tunneling data from DPCD.
+    - drm/amd/display: Add dpia debug options
+    - drm/amd/display: Support for SET_CONFIG processing with DMUB
+    - drm/amd/display: Add DPCD writes at key points
+    - drm/amd/display: Fix DIG_HPD_SELECT for USB4 display endpoints.
+    - drm/amd/display: Add helper for blanking all dp displays
+    - drm/amd/display: Fix link training fallback logic
+    - drm/amd/display: Add debug flags for USB4 DP link training.
+    - drm/amd/display: Fix dynamic link encoder access.
+    - drm/amd/display: Fix concurrent dynamic encoder assignment
+    - drm/amd/display: Fix dynamic encoder reassignment
+    - drm/amd/display: Fix for access for ddc pin and aux engine.
+    - drm/amd/display: Deadlock/HPD Status/Crash Bug Fix
+    - drm/amd/display: Fix USB4 Aux via DMUB terminate unexpectedly
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Rewrite debian/scripts/module-check in Python
+    - [Config] update config and annotations after applying v5.15.5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 29 Nov 2021 09:25:37 +0100
+
+linux (5.15.0-12.12) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-12.12 -proposed tracker (LP: #1951810)
+
+  * Jammy update: v5.15.4 upstream stable release (LP: #1951820)
+    - string: uninline memcpy_and_pad
+    - Revert "drm: fb_helper: improve CONFIG_FB dependency"
+    - Revert "drm: fb_helper: fix CONFIG_FB dependency"
+    - KVM: Fix steal time asm constraints
+    - btrfs: introduce btrfs_is_data_reloc_root
+    - btrfs: zoned: add a dedicated data relocation block group
+    - btrfs: zoned: only allow one process to add pages to a relocation inode
+    - btrfs: zoned: use regular writes for relocation
+    - btrfs: check for relocation inodes on zoned btrfs in should_nocow
+    - btrfs: zoned: allow preallocation for relocation inodes
+    - fortify: Explicitly disable Clang support
+    - block: Add a helper to validate the block size
+    - loop: Use blk_validate_block_size() to validate block size
+    - Bluetooth: btusb: Add support for TP-Link UB500 Adapter
+    - parisc/entry: fix trace test in syscall exit path
+    - PCI/MSI: Deal with devices lying about their MSI mask capability
+    - PCI: Add MSI masking quirk for Nvidia ION AHCI
+    - perf/core: Avoid put_page() when GUP fails
+    - thermal: Fix NULL pointer dereferences in of_thermal_ functions
+    - Revert "ACPI: scan: Release PM resources blocked by unused objects"
+    - Linux 5.15.4
+
+  * Jammy update: v5.15.3 upstream stable release (LP: #1951822)
+    - xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good
+      delay
+    - usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform
+    - Input: iforce - fix control-message timeout
+    - Input: elantench - fix misreporting trackpoint coordinates
+    - Input: i8042 - Add quirk for Fujitsu Lifebook T725
+    - libata: fix read log timeout value
+    - ocfs2: fix data corruption on truncate
+    - scsi: scsi_ioctl: Validate command size
+    - scsi: core: Avoid leaving shost->last_reset with stale value if EH does not
+      run
+    - scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd()
+    - scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding
+    - scsi: lpfc: Fix FCP I/O flush functionality for TMF routines
+    - scsi: qla2xxx: Fix crash in NVMe abort path
+    - scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file
+    - scsi: qla2xxx: Fix use after free in eh_abort path
+    - ce/gf100: fix incorrect CE0 address calculation on some GPUs
+    - char: xillybus: fix msg_ep UAF in xillyusb_probe()
+    - mmc: mtk-sd: Add wait dma stop done flow
+    - mmc: dw_mmc: Dont wait for DRTO on Write RSP error
+    - exfat: fix incorrect loading of i_blocks for large files
+    - io-wq: remove worker to owner tw dependency
+    - parisc: Fix set_fixmap() on PA1.x CPUs
+    - parisc: Fix ptrace check on syscall return
+    - tpm: Check for integer overflow in tpm2_map_response_body()
+    - firmware/psci: fix application of sizeof to pointer
+    - crypto: s5p-sss - Add error handling in s5p_aes_probe()
+    - media: rkvdec: Do not override sizeimage for output format
+    - media: ite-cir: IR receiver stop working after receive overflow
+    - media: rkvdec: Support dynamic resolution changes
+    - media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
+    - media: v4l2-ioctl: Fix check_ext_ctrls
+    - ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14
+    - ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED
+    - ALSA: hda/realtek: Add quirk for Clevo PC70HS
+    - ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ
+    - ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N
+    - ALSA: hda/realtek: Add quirk for ASUS UX550VE
+    - ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED
+    - ALSA: ua101: fix division by zero at probe
+    - ALSA: 6fire: fix control and bulk message timeouts
+    - ALSA: line6: fix control and interrupt message timeouts
+    - ALSA: mixer: oss: Fix racy access to slots
+    - ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
+    - ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk
+    - ALSA: usb-audio: Add registration quirk for JBL Quantum 400
+    - ALSA: hda: Free card instance properly at probe errors
+    - ALSA: synth: missing check for possible NULL after the call to kstrdup
+    - ALSA: pci: rme: Fix unaligned buffer addresses
+    - ALSA: PCM: Fix NULL dereference at mmap checks
+    - ALSA: timer: Fix use-after-free problem
+    - ALSA: timer: Unconditionally unlink slave instances, too
+    - Revert "ext4: enforce buffer head state assertion in ext4_da_map_blocks"
+    - ext4: fix lazy initialization next schedule time computation in more
+      granular unit
+    - ext4: ensure enough credits in ext4_ext_shift_path_extents
+    - ext4: refresh the ext4_ext_path struct after dropping i_data_sem.
+    - fuse: fix page stealing
+    - x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
+    - x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
+    - x86/irq: Ensure PI wakeup handler is unregistered before module unload
+    - x86/iopl: Fake iopl(3) CLI/STI usage
+    - btrfs: clear MISSING device status bit in btrfs_close_one_device
+    - btrfs: fix lost error handling when replaying directory deletes
+    - btrfs: call btrfs_check_rw_degradable only if there is a missing device
+    - KVM: x86/mmu: Drop a redundant, broken remote TLB flush
+    - KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup
+    - KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ
+      handling
+    - ia64: kprobes: Fix to pass correct trampoline address to the handler
+    - selinux: fix race condition when computing ocontext SIDs
+    - ipmi:watchdog: Set panic count to proper value on a panic
+    - md/raid1: only allocate write behind bio for WriteMostly device
+    - hwmon: (pmbus/lm25066) Add offset coefficients
+    - regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is
+      disabled
+    - regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-
+      dvs-idx property
+    - EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
+    - mwifiex: fix division by zero in fw download path
+    - ath6kl: fix division by zero in send path
+    - ath6kl: fix control-message timeout
+    - ath10k: fix control-message timeout
+    - ath10k: fix division by zero in send path
+    - PCI: Mark Atheros QCA6174 to avoid bus reset
+    - rtl8187: fix control-message timeouts
+    - evm: mark evm_fixmode as __ro_after_init
+    - ifb: Depend on netfilter alternatively to tc
+    - platform/surface: aggregator_registry: Add support for Surface Laptop Studio
+    - mt76: mt7615: fix skb use-after-free on mac reset
+    - HID: surface-hid: Use correct event registry for managing HID events
+    - HID: surface-hid: Allow driver matching for target ID 1 devices
+    - wcn36xx: Fix HT40 capability for 2Ghz band
+    - wcn36xx: Fix tx_status mechanism
+    - wcn36xx: Fix (QoS) null data frame bitrate/modulation
+    - PM: sleep: Do not let "syscore" devices runtime-suspend during system
+      transitions
+    - mwifiex: Read a PCI register after writing the TX ring write pointer
+    - mwifiex: Try waking the firmware until we get an interrupt
+    - libata: fix checking of DMA state
+    - dma-buf: fix and rework dma_buf_poll v7
+    - wcn36xx: handle connection loss indication
+    - rsi: fix occasional initialisation failure with BT coex
+    - rsi: fix key enabled check causing unwanted encryption for vap_id > 0
+    - rsi: fix rate mask set leading to P2P failure
+    - rsi: Fix module dev_oper_mode parameter description
+    - perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server
+    - perf/x86/intel/uncore: Fix invalid unit check
+    - perf/x86/intel/uncore: Fix Intel ICX IIO event constraints
+    - RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
+    - ASoC: tegra: Set default card name for Trimslice
+    - ASoC: tegra: Restore AC97 support
+    - signal: Remove the bogus sigkill_pending in ptrace_stop
+    - memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode
+    - signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
+    - soc: samsung: exynos-pmu: Fix compilation when nothing selects
+      CONFIG_MFD_CORE
+    - soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
+    - soc: fsl: dpio: use the combined functions to protect critical zone
+    - mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines
+    - mctp: handle the struct sockaddr_mctp padding fields
+    - power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
+    - power: supply: max17042_battery: use VFSOC for capacity when no rsns
+    - iio: core: fix double free in iio_device_unregister_sysfs()
+    - iio: core: check return value when calling dev_set_name()
+    - KVM: arm64: Extract ESR_ELx.EC only
+    - KVM: x86: Fix recording of guest steal time / preempted status
+    - KVM: x86: Add helper to consolidate core logic of SET_CPUID{2} flows
+    - KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use
+    - KVM: nVMX: Handle dynamic MSR intercept toggling
+    - can: peak_usb: always ask for BERR reporting for PCAN-USB devices
+    - can: mcp251xfd: mcp251xfd_irq(): add missing
+      can_rx_offload_threaded_irq_finish() in case of bus off
+    - can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport
+    - can: j1939: j1939_can_recv(): ignore messages with invalid source address
+    - can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
+    - iio: adc: tsc2046: fix scan interval warning
+    - powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
+    - io_uring: honour zeroes as io-wq worker limits
+    - ring-buffer: Protect ring_buffer_reset() from reentrancy
+    - serial: core: Fix initializing and restoring termios speed
+    - ifb: fix building without CONFIG_NET_CLS_ACT
+    - xen/balloon: add late_initcall_sync() for initial ballooning done
+    - ovl: fix use after free in struct ovl_aio_req
+    - ovl: fix filattr copy-up failure
+    - PCI: pci-bridge-emul: Fix emulation of W1C bits
+    - PCI: cadence: Add cdns_plat_pcie_probe() missing return
+    - cxl/pci: Fix NULL vs ERR_PTR confusion
+    - PCI: aardvark: Do not clear status bits of masked interrupts
+    - PCI: aardvark: Fix checking for link up via LTSSM state
+    - PCI: aardvark: Do not unmask unused interrupts
+    - PCI: aardvark: Fix reporting Data Link Layer Link Active
+    - PCI: aardvark: Fix configuring Reference clock
+    - PCI: aardvark: Fix return value of MSI domain .alloc() method
+    - PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
+    - PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated
+      bridge
+    - PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge
+    - PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge
+    - PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge
+    - quota: check block number when reading the block in quota file
+    - quota: correct error number in free_dqentry()
+    - cifs: To match file servers, make sure the server hostname matches
+    - cifs: set a minimum of 120s for next dns resolution
+    - mfd: simple-mfd-i2c: Select MFD_CORE to fix build error
+    - pinctrl: core: fix possible memory leak in pinctrl_enable()
+    - coresight: cti: Correct the parameter for pm_runtime_put
+    - coresight: trbe: Fix incorrect access of the sink specific data
+    - coresight: trbe: Defer the probe on offline CPUs
+    - iio: buffer: check return value of kstrdup_const()
+    - iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask()
+    - iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
+    - iio: buffer: Fix memory leak in iio_buffer_register_legacy_sysfs_groups()
+    - drivers: iio: dac: ad5766: Fix dt property name
+    - iio: dac: ad5446: Fix ad5622_write() return value
+    - iio: ad5770r: make devicetree property reading consistent
+    - Documentation:devicetree:bindings:iio:dac: Fix val
+    - USB: serial: keyspan: fix memleak on probe errors
+    - serial: 8250: fix racy uartclk update
+    - ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION
+    - io-wq: serialize hash clear with wakeup
+    - serial: 8250: Fix reporting real baudrate value in c_ospeed field
+    - Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
+    - most: fix control-message timeouts
+    - USB: iowarrior: fix control-message timeouts
+    - USB: chipidea: fix interrupt deadlock
+    - power: supply: max17042_battery: Clear status bits in interrupt handler
+    - component: do not leave master devres group open after bind
+    - dma-buf: WARN on dmabuf release with pending attachments
+    - drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)
+    - drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
+    - drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6
+    - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
+    - Bluetooth: fix use-after-free error in lock_sock_nested()
+    - Bluetooth: call sock_hold earlier in sco_conn_del
+    - drm/panel-orientation-quirks: add Valve Steam Deck
+    - rcutorture: Avoid problematic critical section nesting on PREEMPT_RT
+    - platform/x86: wmi: do not fail if disabling fails
+    - drm/amdgpu: move iommu_resume before ip init/resume
+    - MIPS: lantiq: dma: add small delay after reset
+    - MIPS: lantiq: dma: reset correct number of channel
+    - locking/lockdep: Avoid RCU-induced noinstr fail
+    - net: sched: update default qdisc visibility after Tx queue cnt changes
+    - rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop
+    - smackfs: Fix use-after-free in netlbl_catmap_walk()
+    - ath11k: Align bss_chan_info structure with firmware
+    - crypto: aesni - check walk.nbytes instead of err
+    - x86/mm/64: Improve stack overflow warnings
+    - x86: Increase exception stack sizes
+    - mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
+    - mwifiex: Properly initialize private structure on interface type changes
+    - spi: Check we have a spi_device_id for each DT compatible
+    - fscrypt: allow 256-bit master keys with AES-256-XTS
+    - drm/amdgpu: Fix MMIO access page fault
+    - drm/amd/display: Fix null pointer dereference for encoders
+    - selftests: net: fib_nexthops: Wait before checking reported idle time
+    - ath11k: Avoid reg rules update during firmware recovery
+    - ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
+    - ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets
+    - ath10k: high latency fixes for beacon buffer
+    - octeontx2-pf: Enable promisc/allmulti match MCAM entries.
+    - media: mt9p031: Fix corrupted frame after restarting stream
+    - media: netup_unidvb: handle interrupt properly according to the firmware
+    - media: atomisp: Fix error handling in probe
+    - media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()
+    - media: uvcvideo: Set capability in s_param
+    - media: uvcvideo: Return -EIO for control errors
+    - media: uvcvideo: Set unique vdev name based in type
+    - media: vidtv: Fix memory leak in remove
+    - media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
+    - media: s5p-mfc: Add checking to s5p_mfc_probe().
+    - media: videobuf2: rework vb2_mem_ops API
+    - media: imx: set a media_device bus_info string
+    - media: rcar-vin: Use user provided buffers when starting
+    - media: mceusb: return without resubmitting URB in case of -EPROTO error.
+    - ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
+    - rtw88: fix RX clock gate setting while fifo dump
+    - brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet
+    - media: rcar-csi2: Add checking to rcsi2_start_receiver()
+    - ipmi: Disable some operations during a panic
+    - fs/proc/uptime.c: Fix idle time reporting in /proc/uptime
+    - kselftests/sched: cleanup the child processes
+    - ACPICA: Avoid evaluating methods too early during system resume
+    - cpufreq: Make policy min/max hard requirements
+    - ice: Move devlink port to PF/VF struct
+    - media: imx-jpeg: Fix possible null pointer dereference
+    - media: ipu3-imgu: imgu_fmt: Handle properly try
+    - media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info
+    - media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
+    - net-sysfs: try not to restart the syscall if it will fail eventually
+    - drm/amdkfd: rm BO resv on validation to avoid deadlock
+    - tracefs: Have tracefs directories not set OTH permission bits by default
+    - tracing: Disable "other" permission bits in the tracefs files
+    - ath: dfs_pattern_detector: Fix possible null-pointer dereference in
+      channel_detector_create()
+    - KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall
+    - mmc: moxart: Fix reference count leaks in moxart_probe
+    - iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value
+    - ACPI: battery: Accept charges over the design capacity as full
+    - ACPI: scan: Release PM resources blocked by unused objects
+    - drm/amd/display: fix null pointer deref when plugging in display
+    - drm/amdkfd: fix resume error when iommu disabled in Picasso
+    - net: phy: micrel: make *-skew-ps check more lenient
+    - leaking_addresses: Always print a trailing newline
+    - thermal/core: Fix null pointer dereference in thermal_release()
+    - drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture()
+    - thermal/drivers/tsens: Add timeout to get_temp_tsens_valid
+    - block: bump max plugged deferred size from 16 to 32
+    - floppy: fix calling platform_device_unregister() on invalid drives
+    - md: update superblock after changing rdev flags in state_store
+    - memstick: r592: Fix a UAF bug when removing the driver
+    - locking/rwsem: Disable preemption for spinning region
+    - lib/xz: Avoid overlapping memcpy() with invalid input with in-place
+      decompression
+    - lib/xz: Validate the value before assigning it to an enum variable
+    - workqueue: make sysfs of unbound kworker cpumask more clever
+    - tracing/cfi: Fix cmp_entries_* functions signature mismatch
+    - mt76: mt7915: fix an off-by-one bound check
+    - mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
+    - iwlwifi: change all JnP to NO-160 configuration
+    - block: remove inaccurate requeue check
+    - media: allegro: ignore interrupt if mailbox is not initialized
+    - drm/amdgpu/pm: properly handle sclk for profiling modes on vangogh
+    - nvmet: fix use-after-free when a port is removed
+    - nvmet-rdma: fix use-after-free when a port is removed
+    - nvmet-tcp: fix use-after-free when a port is removed
+    - nvme: drop scan_lock and always kick requeue list when removing namespaces
+    - samples/bpf: Fix application of sizeof to pointer
+    - arm64: vdso32: suppress error message for 'make mrproper'
+    - PM: hibernate: Get block device exclusively in swsusp_check()
+    - selftests: kvm: fix mismatched fclose() after popen()
+    - selftests/bpf: Fix perf_buffer test on system with offline cpus
+    - iwlwifi: mvm: disable RX-diversity in powersave
+    - smackfs: use __GFP_NOFAIL for smk_cipso_doi()
+    - ARM: clang: Do not rely on lr register for stacktrace
+    - gre/sit: Don't generate link-local addr if addr_gen_mode is
+      IN6_ADDR_GEN_MODE_NONE
+    - can: bittiming: can_fixup_bittiming(): change type of tseg1 and alltseg to
+      unsigned int
+    - gfs2: Cancel remote delete work asynchronously
+    - gfs2: Fix glock_hash_walk bugs
+    - ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
+    - tools/latency-collector: Use correct size when writing queue_full_warning
+    - vrf: run conntrack only in context of lower/physdev for locally generated
+      packets
+    - net: annotate data-race in neigh_output()
+    - ACPI: AC: Quirk GK45 to skip reading _PSR
+    - ACPI: resources: Add one more Medion model in IRQ override quirk
+    - btrfs: reflink: initialize return value to 0 in btrfs_extent_same()
+    - btrfs: do not take the uuid_mutex in btrfs_rm_device
+    - spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in
+      bcm_qspi_probe()
+    - wcn36xx: Correct band/freq reporting on RX
+    - wcn36xx: Fix packet drop on resume
+    - Revert "wcn36xx: Enable firmware link monitoring"
+    - ftrace: do CPU checking after preemption disabled
+    - inet: remove races in inet{6}_getname()
+    - x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
+    - drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled
+    - perf/x86/intel: Fix ICL/SPR INST_RETIRED.PREC_DIST encodings
+    - parisc: fix warning in flush_tlb_all
+    - task_stack: Fix end_of_stack() for architectures with upwards-growing stack
+    - erofs: don't trigger WARN() when decompression fails
+    - parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
+    - parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
+    - netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream
+      state
+    - selftests/bpf: Fix strobemeta selftest regression
+    - fbdev/efifb: Release PCI device's runtime PM ref during FB destroy
+    - drm/bridge: anx7625: Propagate errors from sp_tx_rst_aux()
+    - perf/x86/intel/uncore: Fix Intel SPR CHA event constraints
+    - perf/x86/intel/uncore: Fix Intel SPR IIO event constraints
+    - perf/x86/intel/uncore: Fix Intel SPR M2PCIE event constraints
+    - perf/x86/intel/uncore: Fix Intel SPR M3UPI event constraints
+    - drm/bridge: it66121: Initialize {device,vendor}_ids
+    - drm/bridge: it66121: Wait for next bridge to be probed
+    - Bluetooth: fix init and cleanup of sco_conn.timeout_work
+    - libbpf: Don't crash on object files with no symbol tables
+    - Bluetooth: hci_uart: fix GPF in h5_recv
+    - rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()
+    - MIPS: lantiq: dma: fix burst length for DEU
+    - x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
+    - objtool: Handle __sanitize_cov*() tail calls
+    - net/mlx5: Publish and unpublish all devlink parameters at once
+    - drm/v3d: fix wait for TMU write combiner flush
+    - crypto: sm4 - Do not change section of ck and sbox
+    - virtio-gpu: fix possible memory allocation failure
+    - lockdep: Let lock_is_held_type() detect recursive read as read
+    - net: net_namespace: Fix undefined member in key_remove_domain()
+    - net: phylink: don't call netif_carrier_off() with NULL netdev
+    - drm: bridge: it66121: Fix return value it66121_probe
+    - spi: Fixed division by zero warning
+    - cgroup: Make rebind_subsystems() disable v2 controllers all at once
+    - wcn36xx: Fix Antenna Diversity Switching
+    - wilc1000: fix possible memory leak in cfg_scan_result()
+    - Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
+    - drm/amdgpu: Fix crash on device remove/driver unload
+    - drm/amd/display: Pass display_pipe_params_st as const in DML
+    - drm/amdgpu: move amdgpu_virt_release_full_gpu to fini_early stage
+    - crypto: caam - disable pkc for non-E SoCs
+    - crypto: qat - power up 4xxx device
+    - Bluetooth: hci_h5: Fix (runtime)suspend issues on RTL8723BS HCIs
+    - bnxt_en: Check devlink allocation and registration status
+    - qed: Don't ignore devlink allocation failures
+    - rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()
+    - mptcp: do not shrink snd_nxt when recovering
+    - fortify: Fix dropped strcpy() compile-time write overflow check
+    - mac80211: twt: don't use potentially unaligned pointer
+    - cfg80211: always free wiphy specific regdomain
+    - net/mlx5: Accept devlink user input after driver initialization complete
+    - net: dsa: rtl8366rb: Fix off-by-one bug
+    - net: dsa: rtl8366: Fix a bug in deleting VLANs
+    - bpf/tests: Fix error in tail call limit tests
+    - ath11k: fix some sleeping in atomic bugs
+    - ath11k: Avoid race during regd updates
+    - ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status
+    - ath11k: Fix memory leak in ath11k_qmi_driver_event_work
+    - gve: DQO: avoid unused variable warnings
+    - ath10k: Fix missing frame timestamp for beacon/probe-resp
+    - ath10k: sdio: Add missing BH locking around napi_schdule()
+    - drm/ttm: stop calling tt_swapin in vm_access
+    - arm64: mm: update max_pfn after memory hotplug
+    - drm/amdgpu: fix warning for overflow check
+    - libbpf: Fix skel_internal.h to set errno on loader retval < 0
+    - media: em28xx: add missing em28xx_close_extension
+    - media: meson-ge2d: Fix rotation parameter changes detection in
+      'ge2d_s_ctrl()'
+    - media: cxd2880-spi: Fix a null pointer dereference on error handling path
+    - media: ttusb-dec: avoid release of non-acquired mutex
+    - media: dvb-usb: fix ununit-value in az6027_rc_query
+    - media: imx258: Fix getting clock frequency
+    - media: v4l2-ioctl: S_CTRL output the right value
+    - media: mtk-vcodec: venc: fix return value when start_streaming fails
+    - media: TDA1997x: handle short reads of hdmi info frame.
+    - media: mtk-vpu: Fix a resource leak in the error handling path of
+      'mtk_vpu_probe()'
+    - media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()'
+    - media: i2c: ths8200 needs V4L2_ASYNC
+    - media: sun6i-csi: Allow the video device to be open multiple times
+    - media: radio-wl1273: Avoid card name truncation
+    - media: si470x: Avoid card name truncation
+    - media: tm6000: Avoid card name truncation
+    - media: cx23885: Fix snd_card_free call on null card pointer
+    - media: atmel: fix the ispck initialization
+    - scs: Release kasan vmalloc poison in scs_free process
+    - kprobes: Do not use local variable when creating debugfs file
+    - crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency
+    - drm: fb_helper: fix CONFIG_FB dependency
+    - cpuidle: Fix kobject memory leaks in error paths
+    - media: em28xx: Don't use ops->suspend if it is NULL
+    - ath10k: Don't always treat modem stop events as crashes
+    - ath9k: Fix potential interrupt storm on queue reset
+    - PM: EM: Fix inefficient states detection
+    - x86/insn: Use get_unaligned() instead of memcpy()
+    - EDAC/amd64: Handle three rank interleaving mode
+    - rcu: Always inline rcu_dynticks_task*_{enter,exit}()
+    - rcu: Fix rcu_dynticks_curr_cpu_in_eqs() vs noinstr
+    - netfilter: nft_dynset: relax superfluous check on set updates
+    - media: venus: fix vpp frequency calculation for decoder
+    - media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
+    - crypto: ccree - avoid out-of-range warnings from clang
+    - crypto: qat - detect PFVF collision after ACK
+    - crypto: qat - disregard spurious PFVF interrupts
+    - hwrng: mtk - Force runtime pm ops for sleep ops
+    - ima: fix deadlock when traversing "ima_default_rules".
+    - b43legacy: fix a lower bounds test
+    - b43: fix a lower bounds test
+    - gve: Recover from queue stall due to missed IRQ
+    - gve: Track RX buffer allocation failures
+    - mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
+    - mmc: sdhci-omap: Fix context restore
+    - memstick: avoid out-of-range warning
+    - memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
+    - net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE
+    - hwmon: Fix possible memleak in __hwmon_device_register()
+    - hwmon: (pmbus/lm25066) Let compiler determine outer dimension of
+      lm25066_coeff
+    - ath10k: fix max antenna gain unit
+    - kernel/sched: Fix sched_fork() access an invalid sched_task_group
+    - net: fealnx: fix build for UML
+    - net: intel: igc_ptp: fix build for UML
+    - net: tulip: winbond-840: fix build for UML
+    - tcp: switch orphan_count to bare per-cpu counters
+    - crypto: octeontx2 - set assoclen in aead_do_fallback()
+    - thermal/core: fix a UAF bug in __thermal_cooling_device_register()
+    - drm/msm/dsi: do not enable irq handler before powering up the host
+    - drm/msm: Fix potential Oops in a6xx_gmu_rpmh_init()
+    - drm/msm: potential error pointer dereference in init()
+    - drm/msm: unlock on error in get_sched_entity()
+    - drm/msm: fix potential NULL dereference in cleanup
+    - drm/msm: uninitialized variable in msm_gem_import()
+    - net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
+    - thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM
+    - mailbox: Remove WARN_ON for async_cb.cb in cmdq_exec_done
+    - media: ivtv: fix build for UML
+    - media: ir_toy: assignment to be16 should be of correct type
+    - mmc: mxs-mmc: disable regulator on error and in the remove function
+    - io-wq: Remove duplicate code in io_workqueue_create()
+    - block: ataflop: fix breakage introduced at blk-mq refactoring
+    - platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
+    - mailbox: mtk-cmdq: Validate alias_id on probe
+    - mailbox: mtk-cmdq: Fix local clock ID usage
+    - ACPI: PM: Turn off unused wakeup power resources
+    - ACPI: PM: Fix sharing of wakeup power resources
+    - drm/amdkfd: Fix an inappropriate error handling in allloc memory of gpu
+    - mt76: mt7921: fix endianness in mt7921_mcu_tx_done_event
+    - mt76: mt7915: fix endianness warning in mt7915_mac_add_txs_skb
+    - mt76: mt7921: fix endianness warning in mt7921_update_txs
+    - mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi
+    - mt76: mt7915: fix info leak in mt7915_mcu_set_pre_cal()
+    - mt76: connac: fix mt76_connac_gtk_rekey_tlv usage
+    - mt76: fix build error implicit enumeration conversion
+    - mt76: mt7921: fix survey-dump reporting
+    - mt76: mt76x02: fix endianness warnings in mt76x02_mac.c
+    - mt76: mt7921: Fix out of order process by invalid event pkt
+    - mt76: mt7915: fix potential overflow of eeprom page index
+    - mt76: mt7915: fix bit fields for HT rate idx
+    - mt76: mt7921: fix dma hang in rmmod
+    - mt76: connac: fix GTK rekey offload failure on WPA mixed mode
+    - mt76: overwrite default reg_ops if necessary
+    - mt76: mt7921: report HE MU radiotap
+    - mt76: mt7921: fix firmware usage of RA info using legacy rates
+    - mt76: mt7921: fix kernel warning from cfg80211_calculate_bitrate
+    - mt76: mt7921: always wake device if necessary in debugfs
+    - mt76: mt7915: fix hwmon temp sensor mem use-after-free
+    - mt76: mt7615: fix hwmon temp sensor mem use-after-free
+    - mt76: mt7915: fix possible infinite loop release semaphore
+    - mt76: mt7921: fix retrying release semaphore without end
+    - mt76: mt7615: fix monitor mode tear down crash
+    - mt76: connac: fix possible NULL pointer dereference in
+      mt76_connac_get_phy_mode_v2
+    - mt76: mt7915: fix sta_rec_wtbl tag len
+    - mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req()
+    - rsi: stop thread firstly in rsi_91x_init() error handling
+    - mwifiex: Send DELBA requests according to spec
+    - iwlwifi: mvm: reset PM state on unsuccessful resume
+    - iwlwifi: pnvm: don't kmemdup() more than we have
+    - iwlwifi: pnvm: read EFI data only if long enough
+    - net: enetc: unmap DMA in enetc_send_cmd()
+    - phy: micrel: ksz8041nl: do not use power down mode
+    - nbd: Fix use-after-free in pid_show
+    - nvme-rdma: fix error code in nvme_rdma_setup_ctrl
+    - PM: hibernate: fix sparse warnings
+    - clocksource/drivers/timer-ti-dm: Select TIMER_OF
+    - x86/sev: Fix stack type check in vc_switch_off_ist()
+    - drm/msm: Fix potential NULL dereference in DPU SSPP
+    - drm/msm/dsi: fix wrong type in msm_dsi_host
+    - crypto: tcrypt - fix skcipher multi-buffer tests for 1420B blocks
+    - smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
+    - KVM: selftests: Fix nested SVM tests when built with clang
+    - libbpf: Fix memory leak in btf__dedup()
+    - bpftool: Avoid leaking the JSON writer prepared for program metadata
+    - libbpf: Fix overflow in BTF sanity checks
+    - libbpf: Fix BTF header parsing checks
+    - mt76: mt7615: mt7622: fix ibss and meshpoint
+    - s390/gmap: validate VMA in __gmap_zap()
+    - s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
+    - s390/mm: validate VMA in PGSTE manipulation functions
+    - s390/mm: fix VMA and page table handling code in storage key handling
+      functions
+    - s390/uv: fully validate the VMA before calling follow_page()
+    - KVM: s390: pv: avoid double free of sida page
+    - KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm
+    - irq: mips: avoid nested irq_enter()
+    - net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error
+    - ARM: 9142/1: kasan: work around LPAE build warning
+    - ath10k: fix module load regression with iram-recovery feature
+    - block: ataflop: more blk-mq refactoring fixes
+    - blk-cgroup: synchronize blkg creation against policy deactivation
+    - libbpf: Fix off-by-one bug in bpf_core_apply_relo()
+    - tpm: fix Atmel TPM crash caused by too frequent queries
+    - tpm_tis_spi: Add missing SPI ID
+    - libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED()
+    - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
+    - tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks
+    - cpufreq: intel_pstate: Fix cpu->pstate.turbo_freq initialization
+    - spi: spi-rpc-if: Check return value of rpcif_sw_init()
+    - samples/kretprobes: Fix return value if register_kretprobe() failed
+    - KVM: s390: Fix handle_sske page fault handling
+    - libertas_tf: Fix possible memory leak in probe and disconnect
+    - libertas: Fix possible memory leak in probe and disconnect
+    - wcn36xx: add proper DMA memory barriers in rx path
+    - wcn36xx: Fix discarded frames due to wrong sequence number
+    - bpf: Avoid races in __bpf_prog_run() for 32bit arches
+    - bpf: Fixes possible race in update_prog_stats() for 32bit arches
+    - wcn36xx: Channel list update before hardware scan
+    - drm/amdgpu: fix a potential memory leak in amdgpu_device_fini_sw()
+    - drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
+    - selftests/bpf: Fix fd cleanup in sk_lookup test
+    - selftests/bpf: Fix memory leak in test_ima
+    - sctp: allow IP fragmentation when PLPMTUD enters Error state
+    - sctp: reset probe_timer in sctp_transport_pl_update
+    - sctp: subtract sctphdr len in sctp_transport_pl_hlen
+    - sctp: return true only for pathmtu update in sctp_transport_pl_toobig
+    - net: amd-xgbe: Toggle PLL settings during rate change
+    - ipmi: kcs_bmc: Fix a memory leak in the error handling path of
+      'kcs_bmc_serio_add_device()'
+    - nfp: fix NULL pointer access when scheduling dim work
+    - nfp: fix potential deadlock when canceling dim work
+    - net: phylink: avoid mvneta warning when setting pause parameters
+    - net: bridge: fix uninitialized variables when BRIDGE_CFM is disabled
+    - selftests: net: bridge: update IGMP/MLD membership interval value
+    - crypto: pcrypt - Delay write to padata->info
+    - selftests/bpf: Fix fclose/pclose mismatch in test_progs
+    - udp6: allow SO_MARK ctrl msg to affect routing
+    - ibmvnic: don't stop queue in xmit
+    - ibmvnic: Process crqs after enabling interrupts
+    - ibmvnic: delay complete()
+    - selftests: mptcp: fix proto type in link_failure tests
+    - skmsg: Lose offset info in sk_psock_skb_ingress
+    - cgroup: Fix rootcg cpu.stat guest double counting
+    - bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.
+    - bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.
+    - of: unittest: fix EXPECT text for gpio hog errors
+    - cpufreq: Fix parameter in parse_perf_domain()
+    - staging: r8188eu: fix memory leak in rtw_set_key
+    - arm64: dts: meson: sm1: add Ethernet PHY reset line for ODROID-C4/HC4
+    - iio: st_sensors: disable regulators after device unregistration
+    - RDMA/rxe: Fix wrong port_cap_flags
+    - ARM: dts: BCM5301X: Fix memory nodes names
+    - arm64: dts: broadcom: bcm4908: Fix UART clock name
+    - clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths
+    - scsi: pm80xx: Fix lockup in outbound queue management
+    - scsi: qla2xxx: edif: Use link event to wake up app
+    - scsi: lpfc: Fix NVMe I/O failover to non-optimized path
+    - ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
+    - arm64: dts: rockchip: Fix GPU register width for RK3328
+    - ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY
+    - RDMA/bnxt_re: Fix query SRQ failure
+    - arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes
+    - arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe
+    - arm64: dts: ti: j7200-main: Fix "vendor-id"/"device-id" properties of pcie
+      node
+    - arm64: dts: ti: j7200-main: Fix "bus-range" upto 256 bus number for PCIe
+    - arm64: dts: meson-g12a: Fix the pwm regulator supply properties
+    - arm64: dts: meson-g12b: Fix the pwm regulator supply properties
+    - arm64: dts: meson-sm1: Fix the pwm regulator supply properties
+    - bus: ti-sysc: Fix timekeeping_suspended warning on resume
+    - ARM: dts: at91: tse850: the emac<->phy interface is rmii
+    - arm64: dts: qcom: sc7180: Base dynamic CPU power coefficients in reality
+    - soc: qcom: llcc: Disable MMUHWT retention
+    - arm64: dts: qcom: sc7280: fix display port phy reg property
+    - scsi: dc395: Fix error case unwinding
+    - MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
+    - JFS: fix memleak in jfs_mount
+    - pinctrl: renesas: rzg2l: Fix missing port register 21h
+    - ASoC: wcd9335: Use correct version to initialize Class H
+    - arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock
+    - arm64: dts: renesas: beacon: Fix Ethernet PHY mode
+    - iommu/mediatek: Fix out-of-range warning with clang
+    - arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000
+    - iommu/dma: Fix sync_sg with swiotlb
+    - iommu/dma: Fix arch_sync_dma for map
+    - ALSA: hda: Reduce udelay() at SKL+ position reporting
+    - ALSA: hda: Use position buffer for SKL+ again
+    - ALSA: usb-audio: Fix possible race at sync of urb completions
+    - soundwire: debugfs: use controller id and link_id for debugfs
+    - power: reset: at91-reset: check properly the return value of devm_of_iomap
+    - scsi: ufs: core: Fix ufshcd_probe_hba() prototype to match the definition
+    - scsi: ufs: core: Stop clearing UNIT ATTENTIONS
+    - scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and
+      real interrupt
+    - scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp()
+    - driver core: Fix possible memory leak in device_link_add()
+    - arm: dts: omap3-gta04a4: accelerometer irq fix
+    - ASoC: SOF: topology: do not power down primary core during topology removal
+    - iio: st_pressure_spi: Add missing entries SPI to device ID table
+    - soc/tegra: Fix an error handling path in tegra_powergate_power_up()
+    - memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
+    - clk: at91: check pmc node status before registering syscore ops
+    - powerpc/mem: Fix arch/powerpc/mm/mem.c:53:12: error: no previous prototype
+      for 'create_section_mapping'
+    - video: fbdev: chipsfb: use memset_io() instead of memset()
+    - powerpc: fix unbalanced node refcount in check_kvm_guest()
+    - powerpc/paravirt: correct preempt debug splat in vcpu_is_preempted()
+    - serial: 8250_dw: Drop wrong use of ACPI_PTR()
+    - usb: gadget: hid: fix error code in do_config()
+    - power: supply: rt5033_battery: Change voltage values to µV
+    - power: supply: max17040: fix null-ptr-deref in max17040_probe()
+    - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
+    - RDMA/mlx4: Return missed an error if device doesn't support steering
+    - usb: musb: select GENERIC_PHY instead of depending on it
+    - staging: most: dim2: do not double-register the same device
+    - staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC
+    - RDMA/core: Set sgtable nents when using ib_dma_virt_map_sg()
+    - dyndbg: make dyndbg a known cli param
+    - powerpc/perf: Fix cycles/instructions as PM_CYC/PM_INST_CMPL in power10
+    - pinctrl: renesas: checker: Fix off-by-one bug in drive register check
+    - ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz
+    - ARM: dts: stm32: fix STUSB1600 Type-C irq level on stm32mp15xx-dkx
+    - ARM: dts: stm32: fix SAI sub nodes register range
+    - ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
+    - ASoC: cs42l42: Always configure both ASP TX channels
+    - ASoC: cs42l42: Correct some register default values
+    - ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
+    - soc: qcom: rpmhpd: Make power_on actually enable the domain
+    - soc: qcom: socinfo: add two missing PMIC IDs
+    - iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask()
+    - usb: typec: STUSB160X should select REGMAP_I2C
+    - iio: adis: do not disabe IRQs in 'adis_init()'
+    - soundwire: bus: stop dereferencing invalid slave pointer
+    - scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer
+    - scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset
+    - serial: imx: fix detach/attach of serial console
+    - usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init
+    - usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled
+    - usb: dwc2: drd: reset current session before setting the new one
+    - powerpc/booke: Disable STRICT_KERNEL_RWX, DEBUG_PAGEALLOC and KFENCE
+    - usb: dwc3: gadget: Skip resizing EP's TX FIFO if already resized
+    - firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()
+    - soc: qcom: rpmhpd: fix sm8350_mxc's peer domain
+    - soc: qcom: apr: Add of_node_put() before return
+    - arm64: dts: qcom: pmi8994: Fix "eternal"->"external" typo in WLED node
+    - arm64: dts: qcom: sdm845: Use RPMH_CE_CLK macro directly
+    - arm64: dts: qcom: sdm845: Fix Qualcomm crypto engine bus clock
+    - pinctrl: equilibrium: Fix function addition in multiple groups
+    - ASoC: topology: Fix stub for snd_soc_tplg_component_remove()
+    - phy: qcom-qusb2: Fix a memory leak on probe
+    - phy: ti: gmii-sel: check of_get_address() for failure
+    - phy: qcom-qmp: another fix for the sc8180x PCIe definition
+    - phy: qcom-snps: Correct the FSEL_MASK
+    - phy: Sparx5 Eth SerDes: Fix return value check in sparx5_serdes_probe()
+    - serial: xilinx_uartps: Fix race condition causing stuck TX
+    - clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL
+    - clk: at91: clk-master: check if div or pres is zero
+    - clk: at91: clk-master: fix prescaler logic
+    - HID: u2fzero: clarify error check and length calculations
+    - HID: u2fzero: properly handle timeouts in usb_submit_urb
+    - powerpc/nohash: Fix __ptep_set_access_flags() and ptep_set_wrprotect()
+    - powerpc/book3e: Fix set_memory_x() and set_memory_nx()
+    - powerpc/44x/fsp2: add missing of_node_put
+    - powerpc/xmon: fix task state output
+    - ALSA: oxfw: fix functional regression for Mackie Onyx 1640i in v5.14 or
+      later
+    - iommu/dma: Fix incorrect error return on iommu deferred attach
+    - powerpc: Don't provide __kernel_map_pages() without
+      ARCH_SUPPORTS_DEBUG_PAGEALLOC
+    - ASoC: cs42l42: Correct configuring of switch inversion from ts-inv
+    - RDMA/hns: Fix initial arm_st of CQ
+    - RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility
+    - ASoC: rsnd: Fix an error handling path in 'rsnd_node_count()'
+    - serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE
+    - virtio_ring: check desc == NULL when using indirect with packed
+    - vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit
+    - mips: cm: Convert to bitfield API to fix out-of-bounds access
+    - power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
+    - RDMA/core: Require the driver to set the IOVA correctly during rereg_mr
+    - apparmor: fix error check
+    - rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
+    - mtd: rawnand: intel: Fix potential buffer overflow in probe
+    - nfsd: don't alloc under spinlock in rpc_parse_scope_id
+    - rtc: ds1302: Add SPI ID table
+    - rtc: ds1390: Add SPI ID table
+    - rtc: pcf2123: Add SPI ID table
+    - remoteproc: imx_rproc: Fix TCM io memory type
+    - i2c: i801: Use PCI bus rescan mutex to protect P2SB access
+    - dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside
+      submission
+    - rtc: mcp795: Add SPI ID table
+    - Input: ariel-pwrbutton - add SPI device ID table
+    - i2c: mediatek: fixing the incorrect register offset
+    - NFS: Default change_attr_type to NFS4_CHANGE_TYPE_IS_UNDEFINED
+    - NFS: Don't set NFS_INO_DATA_INVAL_DEFER and NFS_INO_INVALID_DATA
+    - NFS: Ignore the directory size when marking for revalidation
+    - NFS: Fix dentry verifier races
+    - pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
+    - drm/bridge/lontium-lt9611uxc: fix provided connector suport
+    - drm/plane-helper: fix uninitialized variable reference
+    - PCI: aardvark: Don't spam about PIO Response Status
+    - PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge
+    - opp: Fix return in _opp_add_static_v2()
+    - NFS: Fix deadlocks in nfs_scan_commit_list()
+    - sparc: Add missing "FORCE" target when using if_changed
+    - fs: orangefs: fix error return code of orangefs_revalidate_lookup()
+    - Input: st1232 - increase "wait ready" timeout
+    - drm/bridge: nwl-dsi: Add atomic_get_input_bus_fmts
+    - mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
+    - PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation
+    - mtd: rawnand: arasan: Prevent an unsupported configuration
+    - mtd: core: don't remove debugfs directory if device is in use
+    - remoteproc: Fix a memory leak in an error handling path in
+      'rproc_handle_vdev()'
+    - rtc: rv3032: fix error handling in rv3032_clkout_set_rate()
+    - dmaengine: at_xdmac: call at_xdmac_axi_config() on resume path
+    - dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
+    - dmaengine: stm32-dma: fix stm32_dma_get_max_width
+    - NFS: Fix up commit deadlocks
+    - NFS: Fix an Oops in pnfs_mark_request_commit()
+    - Fix user namespace leak
+    - auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
+    - auxdisplay: ht16k33: Connect backlight to fbdev
+    - auxdisplay: ht16k33: Fix frame buffer device blanking
+    - soc: fsl: dpaa2-console: free buffer before returning from
+      dpaa2_console_read
+    - netfilter: nfnetlink_queue: fix OOB when mac header was cleared
+    - dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
+    - dmaengine: tegra210-adma: fix pm runtime unbalance
+    - dmanegine: idxd: fix resource free ordering on driver removal
+    - dmaengine: idxd: reconfig device after device reset command
+    - signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)
+    - m68k: set a default value for MEMORY_RESERVE
+    - watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
+    - ar7: fix kernel builds for compiler test
+    - scsi: target: core: Remove from tmr_list during LUN unlink
+    - scsi: qla2xxx: Relogin during fabric disturbance
+    - scsi: qla2xxx: Fix gnl list corruption
+    - scsi: qla2xxx: Turn off target reset during issue_lip
+    - scsi: qla2xxx: edif: Fix app start fail
+    - scsi: qla2xxx: edif: Fix app start delay
+    - scsi: qla2xxx: edif: Flush stale events and msgs on session down
+    - scsi: qla2xxx: edif: Increase ELS payload
+    - scsi: qla2xxx: edif: Fix EDIF bsg
+    - NFSv4: Fix a regression in nfs_set_open_stateid_locked()
+    - dmaengine: idxd: fix resource leak on dmaengine driver disable
+    - i2c: xlr: Fix a resource leak in the error handling path of
+      'xlr_i2c_probe()'
+    - gpio: realtek-otto: fix GPIO line IRQ offset
+    - xen-pciback: Fix return in pm_ctrl_init()
+    - nbd: fix max value for 'first_minor'
+    - nbd: fix possible overflow for 'first_minor' in nbd_dev_add()
+    - io-wq: fix max-workers not correctly set on multi-node system
+    - net: davinci_emac: Fix interrupt pacing disable
+    - kselftests/net: add missed icmp.sh test to Makefile
+    - kselftests/net: add missed setup_loopback.sh/setup_veth.sh to Makefile
+    - kselftests/net: add missed SRv6 tests
+    - kselftests/net: add missed vrf_strict_mode_test.sh test to Makefile
+    - kselftests/net: add missed toeplitz.sh/toeplitz_client.sh to Makefile
+    - ethtool: fix ethtool msg len calculation for pause stats
+    - openrisc: fix SMP tlb flush NULL pointer dereference
+    - net: vlan: fix a UAF in vlan_dev_real_dev()
+    - net: dsa: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge
+    - ice: Fix replacing VF hardware MAC to existing MAC filter
+    - ice: Fix not stopping Tx queues for VFs
+    - kdb: Adopt scheduler's task classification
+    - ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
+    - PCI: j721e: Fix j721e_pcie_probe() error path
+    - nvdimm/btt: do not call del_gendisk() if not needed
+    - scsi: bsg: Fix errno when scsi_bsg_register_queue() fails
+    - scsi: ufs: ufshpb: Use proper power management API
+    - scsi: ufs: core: Fix NULL pointer dereference
+    - scsi: ufs: ufshpb: Properly handle max-single-cmd
+    - drm/nouveau/svm: Fix refcount leak bug and missing check against null bug
+    - nvdimm/pmem: cleanup the disk if pmem_release_disk() is yet assigned
+    - block/ataflop: use the blk_cleanup_disk() helper
+    - block/ataflop: add registration bool before calling del_gendisk()
+    - block/ataflop: provide a helper for cleanup up an atari disk
+    - ataflop: remove ataflop_probe_lock mutex
+    - PCI: Do not enable AtomicOps on VFs
+    - cpufreq: intel_pstate: Clear HWP desired on suspend/shutdown and offline
+    - net: phy: fix duplex out of sync problem while changing settings
+    - block: fix device_add_disk() kobject_create_and_add() error handling
+    - drm/ttm: remove ttm_bo_vm_insert_huge()
+    - bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
+    - octeontx2-pf: select CONFIG_NET_DEVLINK
+    - ALSA: memalloc: Catch call with NULL snd_dma_buffer pointer
+    - mfd: core: Add missing of_node_put for loop iteration
+    - mfd: cpcap: Add SPI device ID table
+    - mfd: sprd: Add SPI device ID table
+    - mfd: altera-sysmgr: Fix a mistake caused by resource_size conversion
+    - ACPI: PM: Fix device wakeup power reference counting error
+    - libbpf: Fix lookup_and_delete_elem_flags error reporting
+    - selftests/bpf/xdp_redirect_multi: Put the logs to tmp folder
+    - selftests/bpf/xdp_redirect_multi: Use arping to accurate the arp number
+    - selftests/bpf/xdp_redirect_multi: Give tcpdump a chance to terminate cleanly
+    - selftests/bpf/xdp_redirect_multi: Limit the tests in netns
+    - drm: fb_helper: improve CONFIG_FB dependency
+    - Revert "drm/imx: Annotate dma-fence critical section in commit path"
+    - drm/amdgpu/powerplay: fix sysfs_emit/sysfs_emit_at handling
+    - can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path
+    - can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for
+      mcp251xfd_chip_rx_int_enable()
+    - mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and
+      zs_unregister_migration()
+    - zram: off by one in read_block_state()
+    - perf bpf: Add missing free to bpf_event__print_bpf_prog_info()
+    - llc: fix out-of-bound array index in llc_sk_dev_hash()
+    - nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
+    - litex_liteeth: Fix a double free in the remove function
+    - arm64: arm64_ftr_reg->name may not be a human-readable string
+    - arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
+    - bpf, sockmap: Remove unhash handler for BPF sockmap usage
+    - bpf, sockmap: Fix race in ingress receive verdict with redirect to self
+    - bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
+    - bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg
+    - dmaengine: stm32-dma: fix burst in case of unaligned memory address
+    - dmaengine: stm32-dma: avoid 64-bit division in stm32_dma_get_max_width
+    - gve: Fix off by one in gve_tx_timeout()
+    - drm/i915/fb: Fix rounding error in subsampled plane size calculation
+    - init: make unknown command line param message clearer
+    - seq_file: fix passing wrong private data
+    - drm/amdgpu: fix uvd crash on Polaris12 during driver unloading
+    - net: dsa: mv88e6xxx: Don't support >1G speeds on 6191X on ports other than
+      10
+    - net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any
+    - net: hns3: fix ROCE base interrupt vector initialization bug
+    - net: hns3: fix pfc packet number incorrect after querying pfc parameters
+    - net: hns3: fix kernel crash when unload VF while it is being reset
+    - net: hns3: allow configure ETS bandwidth of all TCs
+    - net: stmmac: allow a tc-taprio base-time of zero
+    - net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory
+    - net: marvell: mvpp2: Fix wrong SerDes reconfiguration order
+    - vsock: prevent unnecessary refcnt inc for nonblocking connect
+    - net/smc: fix sk_refcnt underflow on linkdown and fallback
+    - cxgb4: fix eeprom len when diagnostics not implemented
+    - selftests/net: udpgso_bench_rx: fix port argument
+    - thermal: int340x: fix build on 32-bit targets
+    - smb3: do not error on fsync when readonly
+    - ARM: 9155/1: fix early early_iounmap()
+    - ARM: 9156/1: drop cc-option fallbacks for architecture selection
+    - parisc: Fix backtrace to always include init funtion names
+    - parisc: Flush kernel data mapping in set_pte_at() when installing pte for
+      user page
+    - MIPS: fix duplicated slashes for Platform file path
+    - MIPS: fix *-pkg builds for loongson2ef platform
+    - MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL
+    - x86/mce: Add errata workaround for Skylake SKX37
+    - PCI/MSI: Move non-mask check back into low level accessors
+    - PCI/MSI: Destroy sysfs before freeing entries
+    - KVM: x86: move guest_pv_has out of user_access section
+    - posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()
+    - irqchip/sifive-plic: Fixup EOI failed when masked
+    - f2fs: should use GFP_NOFS for directory inodes
+    - f2fs: include non-compressed blocks in compr_written_block
+    - f2fs: fix UAF in f2fs_available_free_memory
+    - ceph: fix mdsmap decode when there are MDS's beyond max_mds
+    - erofs: fix unsafe pagevec reuse of hooked pclusters
+    - drm/i915/guc: Fix blocked context accounting
+    - block: Hold invalidate_lock in BLKDISCARD ioctl
+    - block: Hold invalidate_lock in BLKZEROOUT ioctl
+    - block: Hold invalidate_lock in BLKRESETZONE ioctl
+    - ksmbd: Fix buffer length check in fsctl_validate_negotiate_info()
+    - ksmbd: don't need 8byte alignment for request length in ksmbd_check_message
+    - dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail
+    - dmaengine: ti: k3-udma: Set r/tchan or rflow to NULL if request fail
+    - dmaengine: bestcomm: fix system boot lockups
+    - net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
+    - 9p/net: fix missing error check in p9_check_errors
+    - mm/filemap.c: remove bogus VM_BUG_ON
+    - memcg: prohibit unconditional exceeding the limit of dying tasks
+    - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
+    - mm, oom: do not trigger out_of_memory from the #PF
+    - mm, thp: lock filemap when truncating page cache
+    - mm, thp: fix incorrect unmap behavior for private pages
+    - mfd: dln2: Add cell for initializing DLN2 ADC
+    - video: backlight: Drop maximum brightness override for brightness zero
+    - bcache: fix use-after-free problem in bcache_device_free()
+    - bcache: Revert "bcache: use bvec_virt"
+    - PM: sleep: Avoid calling put_device() under dpm_list_mtx
+    - s390/cpumf: cpum_cf PMU displays invalid value after hotplug remove
+    - s390/cio: check the subchannel validity for dev_busid
+    - s390/tape: fix timer initialization in tape_std_assign()
+    - s390/ap: Fix hanging ioctl caused by orphaned replies
+    - s390/cio: make ccw_device_dma_* more robust
+    - remoteproc: elf_loader: Fix loading segment when is_iomem true
+    - remoteproc: Fix the wrong default value of is_iomem
+    - remoteproc: imx_rproc: Fix ignoring mapping vdev regions
+    - remoteproc: imx_rproc: Fix rsc-table name
+    - mtd: rawnand: fsmc: Fix use of SM ORDER
+    - mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines
+    - powerpc/vas: Fix potential NULL pointer dereference
+    - powerpc/bpf: Fix write protecting JIT code
+    - powerpc/32e: Ignore ESR in instruction storage interrupt handler
+    - powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload
+    - powerpc/security: Use a mutex for interrupt exit code patching
+    - powerpc/64s/interrupt: Fix check_return_regs_valid() false positive
+    - powerpc/pseries/mobility: ignore ibm, platform-facilities updates
+    - powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n
+    - drm/sun4i: Fix macros in sun8i_csc.h
+    - PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
+    - PCI: aardvark: Fix PCIe Max Payload Size setting
+    - SUNRPC: Partial revert of commit 6f9f17287e78
+    - drm/amd/display: Look at firmware version to determine using dmub on dcn21
+    - media: vidtv: move kfree(dvb) to vidtv_bridge_dev_release()
+    - cifs: fix memory leak of smb3_fs_context_dup::server_hostname
+    - ath10k: fix invalid dma_addr_t token assignment
+    - mmc: moxart: Fix null pointer dereference on pointer host
+    - selftests/x86/iopl: Adjust to the faked iopl CLI/STI usage
+    - selftests/bpf: Fix also no-alu32 strobemeta selftest
+    - arch/cc: Introduce a function to check for confidential computing features
+    - x86/sev: Add an x86 version of cc_platform_has()
+    - x86/sev: Make the #VC exception stacks part of the default stacks storage
+    - media: videobuf2: always set buffer vb2 pointer
+    - media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference
+    - Linux 5.15.3
+
+  * kernel panic: NULL pointer dereference in wb_timer_f() (LP: #1947557) //
+    Jammy update: v5.15.3 upstream stable release (LP: #1951822)
+    - blk-wbt: prevent NULL pointer dereference in wb_timer_fn
+
+  * Medion Notebook Keyboard not working (LP: #1909814) // Jammy update: v5.15.3
+    upstream stable release (LP: #1951822)
+    - ACPI: resources: Add DMI-based legacy IRQ override quirk
+
+  * Enable CONFIG_INTEL_IOMMU_DEFAULT_ON and
+    CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON on jammy 5.15 (LP: #1951440)
+    - [Config] enable Intel DMA remapping options by default
+
+  * Thinkpad E14 Gen2: Kernel panic with trackpad and trackpoint enabled
+    (LP: #1945590)
+    - SAUCE: Input: elantech - Fix stack out of bound access in
+      elantech_change_report_id()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: LSM: Specify which LSM to display (using struct cred as input)
+    - SAUCE: selftests/seccomp: fix check of fds being assigned
+    - [Config] enable SUNRPC_DISABLE_INSECURE_ENCTYPES
+    - [Config] updateconfigs following v5.15.3, v5.15.4 import
+
+  * Miscellaneous upstream changes
+    - binder: use cred instead of task for selinux checks
+    - binder: use cred instead of task for getsecid
+    - Revert "UBUNTU: SAUCE: storvsc: use small sg_tablesize on x86"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 22 Nov 2021 13:14:15 +0100
+
+linux (5.15.0-11.11) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-11.11 -proposed tracker (LP: #1950948)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * OOPs on boot: invalid opcode: 0000 [#1] SMP NOPTI (LP: #1942215)
+    - SAUCE: ACPICA: prevent out-of-bound access with buggy DSDT
+    - [Config] disable UBSAN
+    - SAUCE: ACPICA: avoid accessing operands out-of-bounds
+
+  * Jammy update: v5.15.2 upstream stable release (LP: #1950949)
+    - KVM: x86: avoid warning with -Wbitwise-instead-of-logical
+    - Revert "x86/kvm: fix vcpu-id indexed array sizes"
+    - usb: ehci: handshake CMD_RUN instead of STS_HALT
+    - usb: gadget: Mark USB_FSL_QE broken on 64-bit
+    - usb: musb: Balance list entry in musb_gadget_queue
+    - usb-storage: Add compatibility quirk flags for iODD 2531/2541
+    - Revert "proc/wchan: use printk format instead of lookup_symbol_name()"
+    - binder: use euid from cred instead of using task
+    - binder: don't detect sender/target during buffer cleanup
+    - kfence: always use static branches to guard kfence_alloc()
+    - kfence: default to dynamic branch instead of static keys mode
+    - btrfs: fix lzo_decompress_bio() kmap leakage
+    - staging: rtl8712: fix use-after-free in rtl8712_dl_fw
+    - isofs: Fix out of bound access for corrupted isofs image
+    - comedi: dt9812: fix DMA buffers on stack
+    - comedi: ni_usb6501: fix NULL-deref in command paths
+    - comedi: vmk80xx: fix transfer-buffer overflows
+    - comedi: vmk80xx: fix bulk-buffer overflow
+    - comedi: vmk80xx: fix bulk and interrupt message timeouts
+    - staging: r8712u: fix control-message timeout
+    - staging: rtl8192u: fix control-message timeouts
+    - staging: r8188eu: fix memleak in rtw_wx_set_enc_ext
+    - media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
+    - rsi: fix control-message timeout
+    - Linux 5.15.2
+
+  * reuseport_bpf_numa in net from ubuntu_kernel_selftests fails on ppc64le
+    (LP: #1867570)
+    - selftests/net: Fix reuseport_bpf_numa by skipping unavailable nodes
+
+  * Miscellaneous Ubuntu changes
+    - packaging: switch getabis to the linux package name
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (no-up) rename the adv7511 drm driver to adv7511_drm"
+    - Revert "UBUNTU: SAUCE: drm/i915/dp: Use max params for older panels"
+    - Revert "UBUNTU: SAUCE: i915: Fix build error due to missing struct
+      definition"
+    - selftests/core: fix conflicting types compile error for close_range()
+    - selftests: net: test_vxlan_under_vrf: fix HV connectivity test
+    - Revert "UBUNTU: SAUCE: ACPICA: prevent out-of-bound access with buggy DSDT"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 15 Nov 2021 10:12:47 +0100
+
+linux (5.15.0-10.10) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-10.10 -proposed tracker (LP: #1950133)
+
+  * Jammy update: v5.15.1 upstream stable release (LP: #1950131)
+    - sfc: Fix reading non-legacy supported link modes
+    - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
+    - Revert "xhci: Set HCD flag to defer primary roothub registration"
+    - Revert "usb: core: hcd: Add support for deferring roothub registration"
+    - drm/amdkfd: fix boot failure when iommu is disabled in Picasso.
+    - Revert "soc: imx: gpcv2: move reset assert after requesting domain power up"
+    - ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
+    - Revert "wcn36xx: Disable bmps when encryption is disabled"
+    - drm/amdgpu: revert "Add autodump debugfs node for gpu reset v8"
+    - drm/amd/display: Revert "Directly retrain link from debugfs"
+    - Revert "drm/i915/gt: Propagate change in error status to children on unhold"
+    - ALSA: usb-audio: Add quirk for Audient iD14
+    - Linux 5.15.1
+
+  * Miscellaneous Ubuntu changes
+    - packaging: fixup previous ABI/spin to -9.9
+    - [Packaging] Drop unused d-i build-deps and packaging
+    - [Packaging] Drop now unsupported d-i/ input files
+
+  * Miscellaneous upstream changes
+    - selftests: net: properly support IPv6 in GSO GRE test
+    - signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 08 Nov 2021 14:43:24 +0100
+
+linux (5.15.0-9.9) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-1.1 -proposed tracker (LP: #1949876)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] update Ubuntu.md
+
+  * Add F81966 watchdog support (LP: #1949063)
+    - SAUCE: ODM: watchdog: f71808e_wdt: Add F81966 support
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Rewrite debian/scripts/misc/insert-changes.pl in Python
+    - [Packaging] change source package name to linux
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 04 Nov 2021 18:47:19 +0100
+
+linux (5.15.0-0.0) jammy; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 04 Nov 2021 16:47:16 +0100
+
+linux-unstable (5.15.0-8.8) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.15.0-8.8 -proposed tracker (LP: #1949436)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Drop "UBUNTU: SAUCE: cachefiles: Page leaking in
+    cachefiles_read_backing_file while vmscan is active" (LP: #1947709)
+    - Revert "UBUNTU: SAUCE: cachefiles: Page leaking in
+      cachefiles_read_backing_file while vmscan is active"
+
+  * Add l2tp.sh in net from ubuntu_kernel_selftests back (LP: #1934293)
+    - Revert "UBUNTU: SAUCE: selftests/net -- disable l2tp.sh test"
+
+  * Check for changes relevant for security certifications (LP: #1945989)
+    - [Packaging] Add fips-checks as part of finalchecks
+
+  * Add final-checks to check certificates (LP: #1947174)
+    - [Packaging] Add system trusted and revocation keys final check
+
+  * Can only reach PC3 when ethernet is plugged r8169 (LP: #1946433)
+    - r8169: Enable chip-specific ASPM regardless of PCIe ASPM status
+    - PCI/ASPM: Introduce a new helper to report ASPM capability
+    - r8169: Implement dynamic ASPM mechanism
+
+  * rtw89 kernel module for Realtek 8852 wifi is missing (LP: #1945967)
+    - rtw89: add Realtek 802.11ax driver
+    - rtw89: Remove redundant check of ret after call to rtw89_mac_enable_bb_rf
+    - rtw89: fix return value check in rtw89_cam_send_sec_key_cmd()
+    - rtw89: remove unneeded semicolon
+    - [Config] RTW89=m
+
+  * Fix A yellow screen pops up in an instant (< 1 second) and then disappears
+    before loading the system (LP: #1945932)
+    - drm/i915: Stop force enabling pipe bottom color gammma/csc
+
+  * disable CONFIG_KFENCE_STATIC_KEYS in linux 5.15 (LP: #1948038)
+    - [Config] disable CONFIG_KFENCE_STATIC_KEYS
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Remove old and unused firmware helper scripts
+    - [Packaging] Replace Perl oneliner with Bash statements
+    - rebase to v5.15
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 02 Nov 2021 08:29:45 +0100
+
+linux-unstable (5.15.0-7.7) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.15.0-7.7 -proposed tracker (LP: #1948770)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Temporarily disable signing for ppc64el and s390x
+    - packaging: switch release to Jammy
+    - rebase to v5.15-rc7
+    - [Config] GCC version update
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 26 Oct 2021 11:38:14 +0200
+
+linux-unstable (5.15.0-6.6) jammy; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-6.6 -proposed tracker (LP: #1947565)
+
+  * [impish] Remove the downstream xr-usb-uart driver (LP: #1945938)
+    - SAUCE: xr-usb-serial: remove driver
+    - [Config] update modules list
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc6
+    - [Config] update config & annotations following v5.15-rc6 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: xr-usb-serial: switch to tty_alloc_driver() and
+      tty_driver_kref_put()"
+    - Revert "UBUNTU: SAUCE: xr-usb-serial: update return code for
+      xr_usb_serial_tty_write_room() and xr_usb_serial_tty_chars_in_buffer()"
+    - Revert "UBUNTU: [Packaging] FTBFS: disable zfs"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 Oct 2021 12:24:45 +0200
+
+linux-unstable (5.15.0-5.5) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-5.5 -proposed tracker (LP: #1946338)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc5
+    - [Config] FB_SIMPLE=m
+    - [Config] update annotations
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 11 Oct 2021 12:14:02 +0200
+
+linux-unstable (5.15.0-4.4) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-4.4 -proposed tracker (LP: #1945953)
+
+  * Fix missing HDMI audio on Intel RKL (LP: #1945556)
+    - drm/i915/audio: Use BIOS provided value for RKL HDA link
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: media: atomisp: add missing return type (fix -Werror=return-type)
+    - SAUCE: xr-usb-serial: switch to tty_alloc_driver() and tty_driver_kref_put()
+    - rebase to v5.15-rc4
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] FTBFS: disable INTEL_ATOMISP"
+    - Revert "UBUNTU: [Config] FTBFS: disable xr-usb-serial"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 04 Oct 2021 10:52:41 +0200
+
+linux-unstable (5.15.0-3.3) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-3.3 -proposed tracker (LP: #1944944)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc3
+    - [Config] updateconfigs following v5.15-rc3 rebase
+    - [Packaging] correctly evaluate release in update-dkms-versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 27 Sep 2021 16:48:03 +0200
+
+linux-unstable (5.15.0-2.2) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-2.2 -proposed tracker (LP: #1944423)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc2
+    - [Config] updateconfigs following v5.15-rc2 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 21 Sep 2021 11:46:59 +0200
+
+linux-unstable (5.15.0-1.1) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  *  LRMv5: switch primary version handling to kernel-versions data set
+    (LP: #1928921)
+    - [Packaging] switch to kernel-versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] remove remaining references to ports
+    - [Packaging] drop x32 architecture configs
+    - [Config] mark CONFIG_BPF_UNPRIV_DEFAULT_OFF enforced
+    - [Packaging] bump kernel version to 5.15
+    - rebase to v5.15-rc1
+    - [Config] updateconfigs following v5.15-rc1 rebase
+    - [Config] FTBFS: disable INTEL_ATOMISP
+    - [Config] FTBFS: disable xr-usb-serial
+    - [Packaging] FTBFS: disable zfs
+
+  * Miscellaneous upstream changes
+    - Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables
+      ASPM"
+    - Revert "UBUNTU: SAUCE: RDMA/core: Introduce peer memory interface"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 17 Sep 2021 11:42:25 +0200
+
+linux-unstable (5.15.0-0.0) impish; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 15 Sep 2021 11:54:10 +0200
+
+linux-unstable (5.14.0-9.9) impish; urgency=medium
+
+  * impish/linux-unstable: 5.14.0-9.9 -proposed tracker (LP: #1943022)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] NVIDIA -- Add the NVIDIA 470 driver
+    - [Packaging] NVIDIA: transition -460 and -465 to -470, transition -460-server
+      to -470-server
+
+  * Miscellaneous upstream changes
+    - vt_kdsetmode: extend console locking
+    - Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
+    - net: dsa: mt7530: fix VLAN traffic leaks again
+    - btrfs: fix NULL pointer dereference when deleting device by invalid id
+    - Revert "floppy: reintroduce O_NDELAY fix"
+    - fscrypt: add fscrypt_symlink_getattr() for computing st_size
+    - ext4: report correct st_size for encrypted symlinks
+    - f2fs: report correct st_size for encrypted symlinks
+    - ubifs: report correct st_size for encrypted symlinks
+    - net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
+    - audit: move put_tree() to avoid trim_trees refcount underflow and UAF
+    - Linux 5.14.1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 08 Sep 2021 12:20:18 +0200
+
+linux-unstable (5.14.0-8.8) impish; urgency=medium
+
+  * impish/linux-unstable: 5.14.0-8.8 -proposed tracker (LP: #1941887)
+
+  * Fix  Intel AC9560 BT function cannot turn on if BT turn off before S3 entry
+    (LP: #1941696)
+    - SAUCE: Bluetooth: btusb: add a reject table to disable msft
+
+  *  Add USB4 support for AMD SoC (LP: #1941036)
+    - thunderbolt: Add vendor specific NHI quirk for auto-clearing interrupt
+      status
+    - thunderbolt: Handle ring interrupt by reading interrupt status register
+    - thunderbolt: Do not read control adapter config space
+    - thunderbolt: Fix port linking by checking all adapters
+
+  * Support builtin revoked certificates (LP: #1932029)
+    - [Config] Enforce SYSTEM_TRUSTED_KEYS and SYSTEM_REVOCATION_KEYS
+
+  * GPIO error logs in start and dmesg after update of kernel (LP: #1937897)
+    - ODM: mfd: Check AAEON BFPI version before adding device
+
+  * initramfs-tools & kernel: use zstd as the default compression method
+    (LP: #1931725)
+    - [Config] enforce ZSTD compression
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.14
+    - [Config] RESET_MCHP_SPARX5 depends on ARCH_SPARX5
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] FTBFS: disable zfs"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 30 Aug 2021 12:57:19 +0200
+
+linux-unstable (5.14.0-7.7) impish; urgency=medium
+
+  * Please enable CONFIG_UBSAN_BOUNDS (LP: #1914685)
+    - [Config] Enable CONFIG_UBSAN_BOUNDS
+
+  * CONFIG_HARDENED_USERCOPY_FALLBACK should be disabled (LP: #1855340)
+    - [Config] Disable CONFIG_HARDENED_USERCOPY_FALLBACK
+
+  * fs: removing mandatory locks (LP: #1940392)
+    - [Config] Disable CONFIG_MANDATORY_FILE_LOCKING
+
+  * Fix kernel panic caused by legacy devices on AMD platforms (LP: #1936682)
+    - SAUCE: iommu/amd: Keep swiotlb enabled to ensure devices with 32bit DMA
+      still work
+
+  * ALSA: hda/cs8409: Add support for dolphin (LP: #1939541)
+    - ALSA: hda/cirrus: Move CS8409 HDA bridge to separate module
+    - ALSA: hda/cs8409: Move arrays of configuration to a new file
+    - ALSA: hda/cs8409: Use enums for register names and coefficients
+    - ALSA: hda/cs8409: Mask all CS42L42 interrupts on initialization
+    - ALSA: hda/cs8409: Reduce HS pops/clicks for Cyborg
+    - ALSA: hda/cs8409: Disable unnecessary Ring Sense for Cyborg/Warlock/Bullseye
+    - ALSA: hda/cs8409: Disable unsolicited responses during suspend
+    - ALSA: hda/cs8409: Disable unsolicited response for the first boot
+    - ALSA: hda/cs8409: Mask CS42L42 wake events
+    - ALSA: hda/cs8409: Simplify CS42L42 jack detect.
+    - ALSA: hda/cs8409: Prevent I2C access during suspend time
+    - ALSA: hda/cs8409: Generalize volume controls
+    - ALSA: hda/cs8409: Dont disable I2C clock between consecutive accesses
+    - ALSA: hda/cs8409: Avoid setting the same I2C address for every access
+    - ALSA: hda/cs8409: Avoid re-setting the same page as the last access
+    - ALSA: hda/cs8409: Support i2c bulk read/write functions
+    - ALSA: hda/cs8409: Separate CS8409, CS42L42 and project functions
+    - ALSA: hda/cs8409: Move codec properties to its own struct
+    - ALSA: hda/cs8409: Support multiple sub_codecs for Suspend/Resume/Unsol
+      events
+    - ALSA: hda/cs8409: Add Support to disable jack type detection for CS42L42
+    - ALSA: hda/cs8409: Add support for dolphin
+    - ALSA: hda/cs8409: Enable Full Scale Volume for Line Out Codec on Dolphin
+    - ALSA: hda/cs8409: Set fixed sample rate of 48kHz for CS42L42
+    - ALSA: hda/cs8409: Use timeout rather than retries for I2C transaction waits
+    - ALSA: hda/cs8409: Remove unnecessary delays
+    - ALSA: hda/cs8409: Follow correct CS42L42 power down sequence for suspend
+    - ALSA: hda/cs8409: Unmute/Mute codec when stream starts/stops
+    - ALSA: hda/cs8409: Prevent pops and clicks during suspend
+    - SAUCE: ALSA: hda/cs8409: Prevent pops and clicks during reboot
+    - [Config] Enable Cirrus Logic HDA bridge support
+
+  * e1000e: add handshake with the Intel CSME to support S0ix (LP: #1937252)
+    - SAUCE: e1000e: Add handshake with the CSME to support S0ix
+    - SAUCE: e1000e: Add polling mechanism to indicate CSME DPG exit
+    - SAUCE: e1000e: Additional PHY power saving in S0ix
+
+  * AMDGPU: Fix System hang after resume from suspend (LP: #1940204)
+    - SAUCE: drm/amdgpu: disable BACO support for 699F:C7 polaris12 SKU
+      temporarily
+
+  * [Regression] Audio card [8086:9d71] not detected after upgrade from linux
+    5.4 to 5.8 (LP: #1915117)
+    - [Config] set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.14-rc7
+    - [Config] updateconfigs following 5.14-rc7 rebase
+    - [Config] Enable CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT
+    - [Config] annotations: set CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT to y
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] annotations: set
+      CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y"
+    - Revert "UBUNTU: [Config] set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to
+      y"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 24 Aug 2021 10:32:31 +0200
+
+linux-unstable (5.14.0-6.6) impish; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - no changes upload (to avoid picking up libc6 from -proposed)
+
+  * No changes upload (to avoid picking up libc6 from -proposed)
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 18 Aug 2021 13:41:16 +0200
+
+linux-unstable (5.14.0-5.5) impish; urgency=medium
+
+  * disable “CONFIG_HISI_DMA” config for ubuntu version (LP: #1936771)
+    - [Config] Disable CONFIG_HISI_DMA
+
+  * Dell XPS 17 (9710) PCI/internal sound card not detected  (LP: #1935850)
+    - ASoC: Intel: sof_sdw: include rt711.h for RT711 JD mode
+    - ASoC: Intel: sof_sdw: add quirk for Dell XPS 9710
+
+  * [regression] USB device is not detected during boot (LP: #1939638)
+    - SAUCE: Revert "usb: core: reduce power-on-good delay time of root hub"
+
+  * armhf build failure (LP: #1939308)
+    - SAUCE: arm: Fix instruction set selection for GCC 11
+
+  * REGRESSION: shiftfs lets sendfile fail with EINVAL (LP: #1939301)
+    - SAUCE: shiftfs: fix sendfile() invocations
+
+  * Wobbly graphics on built-in display since linux-image-5.11.0-22-generic
+    (LP: #1936708)
+    - SAUCE: drm/i915/dp: Use max params for older panels
+
+  * [SRU][H/OEM-5.10/OEM-5.13/U] Fix system hang after unplug tbt dock
+    (LP: #1938689)
+    - SAUCE: igc: fix page fault when thunderbolt is unplugged
+
+  * e1000e blocks the boot process when it tried to write checksum to its NVM
+    (LP: #1936998)
+    - SAUCE: e1000e: Do not take care about recovery NVM checksum
+
+  * [Regression] Audio card [8086:9d71] not detected after upgrade from linux
+    5.4 to 5.8 (LP: #1915117)
+    - [Config] set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y
+    - [Config] annotations: set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs following 5.14-rc6 rebase
+    - rebase to v5.14-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 17 Aug 2021 17:49:15 +0200
+
+linux-unstable (5.14.0-4.4) impish; urgency=medium
+
+  * impish/linux-unstable: 5.14.0-4.4 -proposed tracker (LP: #1938566)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous upstream changes
+    - Revert "riscv: Get CPU manufacturer information"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 03 Aug 2021 14:50:27 +0200
+
+linux-unstable (5.14.0-3.3) impish; urgency=medium
+
+  * Add additional Mediatek MT7921 WiFi/BT device IDs (LP: #1937004)
+    - SAUCE: Bluetooth: btusb: Add Mediatek MT7921 support for Foxconn
+    - SAUCE: Bluetooth: btusb: Add Mediatek MT7921 support for IMC Network
+    - SAUCE: Bluetooth: btusb: Add support for Foxconn Mediatek Chip
+
+  * Fix display output on HP hybrid GFX laptops (LP: #1936296)
+    - drm/i915: Invoke another _DSM to enable MUX on HP Workstation laptops
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.14-rc3
+    - [Config] updateconfigs following 5.14-rc3 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 26 Jul 2021 12:52:38 +0200
+
+linux-unstable (5.14.0-2.2) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: xr-usb-serial: update return code for xr_usb_serial_tty_write_room()
+      and xr_usb_serial_tty_chars_in_buffer()
+    - SAUCE: platform/x86: dell-uart-backlight: update return code for
+      uart_chars_in_buffer(()
+    - [Config] updateconfigs following 5.14-rc2 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] FTBFS: disable ubuntu/xr-usb-serial"
+    - Revert "UBUNTU: [Config] FTBFS: disable DELL_UART_BACKLIGHT"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 22 Jul 2021 11:03:28 +0200
+
+linux-unstable (5.14.0-1.1) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] bump kernel version to 5.14
+    - [Config] updateconfigs following 5.14-rc1 rebase
+    - [Config] update annotations
+    - [Packaging] FTBFS: disable zfs
+    - [Config] FTBFS: disable DELL_UART_BACKLIGHT
+    - [Config] FTBFS: disable ubuntu/xr-usb-serial
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] update variants"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 16 Jul 2021 15:20:04 +0200
+
+linux-unstable (5.14.0-0.0) impish; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 13 Jul 2021 12:15:35 +0200
+
+linux (5.13.0-11.11) impish; urgency=medium
+
+  * impish/linux: 5.13.0-11.11 -proposed tracker (LP: #1933854)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Support builtin revoked certificates (LP: #1932029)
+    - [Packaging] build canonical-revoked-certs.pem from branch/arch certs
+    - [Packaging] Revoke 2012 UEFI signing certificate as built-in
+    - [Config] Configure CONFIG_SYSTEM_REVOCATION_KEYS with revoked keys
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Change source package name to linux
+
+  * Miscellaneous upstream changes
+    - mm/page_alloc: Correct return value of populated elements if bulk array is
+      populated
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 29 Jun 2021 07:50:25 +0200
+
+linux (5.13.0-10.10) impish; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Jun 2021 08:40:05 +0200
+
+linux-unstable (5.13.0-10.10) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-10.10 -proposed tracker (LP: #1933795)
+
+  * Pixel format change broken for Elgato Cam Link 4K (LP: #1932367)
+    - media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
+
+  * initramfs-tools & kernel: use zstd as the default compression method
+    (LP: #1931725)
+    - s390/decompressor: correct BOOT_HEAP_SIZE condition
+    - s390/boot: add zstd support
+    - [Packaging] use ZSTD to compress s390 kernels
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: tls: fix chacha+bidir tests
+    - SAUCE: selftests: icmp_redirect: support expected failures
+    - [Config] update configs and annotations after rebase to 5.13
+
+  * Miscellaneous upstream changes
+    - tls: prevent oversized sendfile() hangs by ignoring MSG_MORE
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Jun 2021 08:40:05 +0200
+
+linux-unstable (5.13.0-9.9) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-9.9 -proposed tracker (LP: #1933070)
+
+  * Add support for selective build of special drivers (LP: #1912789)
+    - [Packaging] Add support for ODM drivers
+    - [Packaging] Turn on ODM support for amd64
+    - [Packaging] Fix ODM support in actual build
+    - [Packaging] Fix ODM DRIVERS Kconfig
+
+  * Add support for IO functions of AAEON devices (LP: #1929504)
+    - ODM: [Config] update config for AAEON devices
+    - ODM: hwmon: add driver for AAEON devices
+    - ODM: leds: add driver for AAEON devices
+    - ODM: watchdog: add driver for AAEON devices
+    - ODM: gpio: add driver for AAEON devices
+    - ODM: mfd: Add support for IO functions of AAEON devices
+
+  * Disable hv-kvp-daemon.service on certain instance types (LP: #1932081)
+    - [Packaging]: Add kernel command line condition to hv-kvp-daemon service
+
+  * Fix non-working GPU on Some HP desktops (LP: #1931147)
+    - PCI: Coalesce host bridge contiguous apertures
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: seccomp: bump up timeout to 5min
+    - SAUCE: Revert "net/tls(TLS_SW): Add selftest for 'chunked' sendfile test"
+    - [Config] update annotations after rebase to 5.13-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Jun 2021 10:55:36 +0200
+
+linux-unstable (5.13.0-8.8) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-8.8 -proposed tracker (LP: #1932018)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * initramfs-tools & kernel: use zstd as the default compression method
+    (LP: #1931725)
+    - [Config] use ZSTD to compress amd64 kernels
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable signing for ppc64el
+    - SAUCE: powerpc: Fix initrd corruption with relative jump labels
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 15 Jun 2021 15:07:34 +0200
+
+linux-unstable (5.13.0-7.7) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-7.7 -proposed tracker (LP: #1931840)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+    - [Packaging] resync getabis
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  * Intel ADL-S graphics feature enabling (LP: #1931240)
+    - SAUCE: drm/i915/adl_s: ADL-S platform Update PCI ids for Mobile BGA
+
+  * Kernel package builds running out of space on builders (LP: #1930713)
+    - [Config] CONFIG_DEBUG_INFO_COMPRESSED=n
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] remove nvidia dkms build support
+    - [Config] remove now unsued do_dkms_nvidia* build variables
+    - [Config] enable signing for s390x
+    - [Config] update annotations after configs review
+    - [Config] update toolchain versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Jun 2021 11:53:08 +0200
+
+linux-unstable (5.13.0-6.6) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-6.6 -proposed tracker (LP: #1931071)
+
+  * Kernel package builds running out of space on builders (LP: #1930713)
+    - [Debian] use stamps for flavour install targets
+    - [Debian] run install-$(flavour) targets during build phase
+    - [Debian] remove dh_testroot from install targets
+    - [Debian] dkms-build -- use fakeroot if not running as root
+    - [Debian] exclude $(DEBIAN)/__abi.current from linux-source
+
+  * [UBUNTU 21.04] tools/kvm_stat: Add restart delay (LP: #1921870)
+    - [Debian] install kvm_stat systemd service
+
+  * Debugging symbols (dbgsym) packages are missing GDB kernel scripts
+    (LP: #1928715)
+    - [Packaging] Build and include GDB Python scripts into debug packages
+
+  * Can't detect intel wifi 6235 (LP: #1920180)
+    - SAUCE: iwlwifi: add new pci id for 6235
+
+  * Select correct boot VGA when BIOS doesn't do it properly (LP: #1929217)
+    - vgaarb: Use ACPI HID name to find integrated GPU
+
+  * Fix kernel panic on Intel Bluetooth (LP: #1928838)
+    - Bluetooth: Shutdown controller after workqueues are flushed or cancelled
+
+  * build module CONFIG_SND_SOC_INTEL_SOUNDWIRE_SOF_MACH=m for 5.11,  5.13-rc2
+    and later (LP: #1921632)
+    - [Config] enable soundwire audio mach driver
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_SND_SOC_RT1308 can only be enabled on amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 07 Jun 2021 10:45:13 +0200
+
+linux-unstable (5.13.0-5.5) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-5.5 -proposed tracker (LP: #1930205)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] set CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 31 May 2021 12:32:38 +0200
+
+linux-unstable (5.13.0-4.4) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-4.4 -proposed tracker (LP: #1929404)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Support importing mokx keys into revocation list from the mok table
+    (LP: #1928679)
+    - SAUCE: integrity: add informational messages when revoking certs
+
+  * Support importing mokx keys into revocation list from the mok table
+    (LP: #1928679) // CVE-2020-26541 when certificates are revoked via
+    MokListXRT.
+    - SAUCE: integrity: Load mokx certs from the EFI MOK config table
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Temporarily disable signing for ppc64el and s390x
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Be more careful about copying up
+      sxid files"
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Propogate nosuid from lower and
+      upper mounts"
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Enable user namespace mounts"
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: ensure mounter privileges when
+      reading directories"
+    - SAUCE: Revert "UBUNTU: SAUCE: fs: Move SB_I_NOSUID to the top of s_iflags"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 24 May 2021 13:06:17 +0200
+
+linux-unstable (5.13.0-3.3) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-3.3 -proposed tracker (LP: #1928655)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 17 May 2021 11:55:02 +0200
+
+linux-unstable (5.13.0-2.2) impish; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable CONFIG_DEBUG_INFO_COMPRESSED
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] temporarily disable BPF JIT"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 14 May 2021 09:19:02 +0200
+
+linux-unstable (5.13.0-1.1) impish; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 12 May 2021 11:35:23 +0200
+
+linux-unstable (5.13.0-0.0) impish; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 11 May 2021 08:40:09 +0200
+
+linux-unstable (5.12.0-11.11) impish; urgency=medium
+
+  * Impish update: v5.12.1 upstream stable release (LP: #1927094)
+    - net: hso: fix NULL-deref on disconnect regression
+    - USB: CDC-ACM: fix poison/unpoison imbalance
+    - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
+    - cfg80211: fix locking in netlink owner interface destruction
+    - mei: me: add Alder Lake P device id.
+    - Linux 5.12.1
+
+  * Packaging resync (LP: #1786013) // Impish update: v5.12.1 upstream stable
+    release (LP: #1927094)
+    - update dkms package versions
+
+  * Gigabyte R120-T33 (ARM ThunderX SoC) fails to boot in ACPI mode
+    (LP: #1925075) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure
+
+  * Fix kernel panic at boot on dual GFX systems (LP: #1926792) // Impish
+    update: v5.12.1 upstream stable release (LP: #1927094)
+    - drm/amdgpu: Register VGA clients after init can no longer fail
+
+  * On TGL platforms screen shows garbage when browsing website by scrolling
+    mouse (LP: #1926579) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - SAUCE: drm/i915/display: Disable PSR2 if TGL Display stepping is B1 from A0
+
+  * CirrusLogic: Cracking noises appears in built-in speaker when output volume
+    is set >80% (LP: #1924997) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - SAUCE: ALSA: hda/cirrus: Use CS8409 Equalizer to fix abnormal sounds on
+      Bullseye
+
+  * Enable mute/micmute LEDs and limit mic boost on EliteBook 845 G8
+    (LP: #1925415) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook
+      845 G8
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: PCI: Disable broken RTIT_BAR of Intel TH"
+    - Revert "UBUNTU: [Config] temporarily disable ZFS"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 04 May 2021 18:35:54 +0200
+
+linux-unstable (5.12.0-10.10) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Drop versioned ABI directory names
+    - [Packaging] getabis: Download ABIs into an unversioned directory
+    - [Packaging] final-checks: Handle unversioned ABI directories
+    - bump to impish
+    - [Config] GCC version update
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 29 Apr 2021 12:27:20 +0200
+
+linux-unstable (5.12.0-9.9) impish; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Apr 2021 11:14:16 -0500
+
+linux-unstable (5.12.0-8.8) hirsute; urgency=medium
+
+  * CVE-2021-3492
+    - SAUCE: shiftfs: free allocated memory in shiftfs_btrfs_ioctl_fd_replace()
+      error paths
+    - SAUCE: shiftfs: handle copy_to_user() return values correctly
+
+  * Fix no picture from HDMI when it's plugged after boot (LP: #1924238)
+    - drm/i915/display: Handle lane polarity for DDI port
+
+  * hirsute beta desktop AMD64 ISO kernel panic on boot when booting using UEFI
+    (LP: #1922403)
+    - SAUCE: efifb: Check efifb_pci_dev before using it
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.12-rc8
+    - [Config] updateconfigs following 5.12-rc8 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc8
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 19 Apr 2021 11:37:27 +0200
+
+linux-unstable (5.12.0-7.7) hirsute; urgency=medium
+
+  * drm/i915: Drop force_probe requirement for Rocket Lake (LP: #1905466)
+    - drm/i915/rkl: Remove require_force_probe protection
+
+  * HP m400 cartridges fail to find NIC when deploying hirsute (LP: #1918793)
+    - PCI: xgene: Fix cfg resource mapping
+
+  * Update - Fix no screen show on display after S3 on CML-R  (LP: #1922768)
+    - drm/i915/gen9bc: Handle TGP PCH during suspend/resume
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: RDMA/core: Introduce peer memory interface
+    - Rebase to v5.12-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 12 Apr 2021 11:48:07 +0200
+
+linux-unstable (5.12.0-6.6) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * i915 doesn't support some high pixel clock 4k * 60Hz monitors (LP: #1922372)
+    - drm/i915/vbt: update DP max link rate table
+
+  * Tegra "mmc0: Timeout waiting for hardware interrupt" (LP: #1921140)
+    - SAUCE: mmc: host: Add required callbacks to set/clear CQE_EN bit
+
+  * Enable ath11k debugfs/tracing (LP: #1922033)
+    - [Config] enable ath11k debugfs/tracing
+
+  * Fix mic on P620 after S3 resume (LP: #1921757)
+    - ALSA: usb-audio: Carve out connector value checking into a helper
+    - ALSA: usb-audio: Check connector value on resume
+
+  * Miscellaneous Ubuntu changes
+    - [Config] amd64,arm64: build KFENCE support but disable it by default
+      (KFENCE_SAMPLE_INTERVAL=0)
+    - Rebase to v5.12-rc6
+
+  * Miscellaneous upstream changes
+    - drm/dp: add MSO related DPCD registers
+    - drm/i915/edp: reject modes with dimensions other than fixed mode
+    - drm/i915/edp: always add fixed mode to probed modes in ->get_modes()
+    - drm/i915/edp: read sink MSO configuration for eDP 1.4+
+    - drm/i915/reg: add stream splitter configuration definitions
+    - drm/i915/mso: add splitter state readout for platforms that support it
+    - drm/i915/mso: add splitter state check
+    - drm/i915/edp: modify fixed and downclock modes for MSO
+    - drm/i915/edp: enable eDP MSO during link training
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 07 Apr 2021 11:42:55 +0200
+
+linux-unstable (5.12.0-5.5) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * alsa/realtek: extend the delay time in the  determine_headset_type for a
+    Dell AIO (LP: #1920747)
+    - SAUCE: ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO
+
+  * power off stress test will hang on the TGL machines (LP: #1919930)
+    - SAUCE: ASoC: SOF: Intel: TGL: set shutdown callback to hda_dsp_shutdown
+    - [Config] set SND_SOC_SOF_HDA_ALWAYS_ENABLE_DMI_L1 to n
+
+  * lockdown on power (LP: #1855668)
+    - SAUCE: (lockdown) powerpc: lock down kernel in secure boot mode
+
+  * Miscellaneous Ubuntu changes
+    - [Config] arm64 -- unify build_image and kernel_file values
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: xr-usb-serial: clean up indentation
+    - SAUCE: xr-usb-serial: clean up build warnings
+    - SAUCE: apparmor: Fix build error, make sk parameter const
+    - Rebase to v5.12-rc5
+    - [Config] updateconfigs following v5.12-rc5 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (lockdown) s390: Lock down the kernel when the IPL
+      secure flag is set"
+    - Revert "UBUNTU: SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to
+      indicate secure boot mode"
+    - Revert "UBUNTU: SAUCE: (lockdown) powerpc: lock down kernel in secure boot
+      mode"
+    - Revert "UBUNTU: SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic"
+    - Revert "UBUNTU: SAUCE: (lockdown) arm64: Allow locking down the kernel under
+      EFI secure boot"
+    - Revert "UBUNTU: SAUCE: (lockdown) KEYS: Make use of platform keyring for
+      module signature verify"
+    - Revert "UBUNTU: SAUCE: (lockdown) efi: Lock down the kernel if booted in
+      secure boot mode"
+    - Revert "UBUNTU: SAUCE: (lockdown) security: lockdown: expose a hook to lock
+      the kernel down"
+    - Revert "UBUNTU: SAUCE: (lockdown) Make get_cert_list() use
+      efi_status_to_str() to print error messages."
+    - Revert "UBUNTU: SAUCE: (lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err()."
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 29 Mar 2021 12:59:38 +0200
+
+linux-unstable (5.12.0-4.4) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Fix broken efifb on graphics device without driver (LP: #1914411)
+    - SAUCE: efifb: Ensure graphics device for efifb stays at PCI D0
+
+  * Fix system sleep on TGL systems with Intel ME (LP: #1919321)
+    - SAUCE: PCI: Serialize TGL e1000e PM ops
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.12-rc4
+    - [Config] updateconfigs following v5.12-rc4 rebase
+
+  * Miscellaneous upstream changes
+    - riscv: dts: fu740: fix cache-controller interrupts
+    - riscv: sifive: fu740: cpu{1, 2, 3, 4} set compatible to sifive, u74-mc
+    - riscv: sifive: unmatched: update for 16GB rev3
+    - riscv: Add 3 SBI wrapper functions to get cpu manufacturer information
+    - riscv: Get CPU manufacturer information
+    - riscv: Introduce alternative mechanism to apply errata solution
+    - riscv: sifive: apply errata "cip-453" patch
+    - clk: sifive: Add pcie_aux clock in prci driver for PCIe driver
+    - clk: sifive: Use reset-simple in prci driver for PCIe driver
+    - MAINTAINERS: Add maintainers for SiFive FU740 PCIe driver
+    - dt-bindings: PCI: Add SiFive FU740 PCIe host controller
+    - PCI: designware: Add SiFive FU740 PCIe host controller driver
+    - riscv: dts: Add PCIe support for the SiFive FU740-C000 SoC
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 22 Mar 2021 12:43:14 +0100
+
+linux-unstable (5.12.0-3.3) hirsute; urgency=medium
+
+  *  riscv: revert SiFive Unleashed CPUFreq (LP: #1917433)
+    - SAUCE: Revert "SiFive Unleashed CPUFreq"
+
+  * Dell Precision 5550 takes up to 10 seconds to respond when coming out of
+    sleep (LP: #1919123)
+    - SAUCE: Input: i8042 - add dmi quirk
+
+  * LRMv4: switch to signing nvidia modules via the Ubuntu Modules signing key
+    (LP: #1918134)
+    - [Packaging] sync dkms-build et al from LRMv4
+
+  * curtin: install flash-kernel in arm64 UEFI unexpected (LP: #1918427)
+    - [Packaging] Allow grub-efi-arm* to satisfy recommends on ARM
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Enable Tegra support in arm64 for NVIDIA Jetson (LP: #1918471)
+    - [Config] enable ARCH_TEGRA and all Tegra SOC's
+    - [Packaging] include modern Tegra modules
+
+  * Cirrus Audio Codec CS8409/CS42L42: Input Device does not switch to headset
+    Mic when a headset is inserted (LP: #1918378)
+    - SAUCE: ALSA: hda/cirrus: Fix Headset Mic volume control name
+
+  * Cirrus Audio Codec CS8409/CS42L42 support (LP: #1916554)
+    - ALSA: hda/cirrus: Increase AUTO_CFG_MAX_INS from 8 to 18
+    - ALSA: hda/cirrus: Add support for CS8409 HDA bridge and CS42L42 companion
+      codec.
+    - ALSA: hda/cirrus: Add jack detect interrupt support from CS42L42 companion
+      codec.
+    - ALSA: hda/cirrus: Add Headphone and Headset MIC Volume Control
+
+  * drm/i915: Drop force_probe requirement for JSL (LP: #1917843)
+    - SAUCE: drm/i915: Drop require_force_probe from JSL
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Skip d-i code if udebs are disabled
+    - [Packaging] Disable udebs if $DEBIAN/d-i doesn't exist
+    - [Packaging] remove dh-systemd build dependency
+    - [Config] fix several annotaions with enforcement typos
+    - [Config] refresh annotations
+    - [Config] updateconfigs following v5.12-rc3 rebase
+    - annotations: fixup after v5.12-rc3 rebase
+    - Rebase to v5.12-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 16 Mar 2021 18:43:03 +0100
+
+linux-unstable (5.12.0-2.2) hirsute; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.12-rc2
+    - [Config] updateconfigs following v5.12-rc2 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 08 Mar 2021 11:22:04 +0100
+
+linux-unstable (5.12.0-1.1) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Support no udeb profile (LP: #1916095)
+    - [Packaging] replace custom filter script with dctrl-tools
+    - [Packaging] correctly implement noudeb build profiles.
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] dkms-versions -- remove nvidia-graphics-drivers-440-server
+    - [Debian] run ubuntu-regression-suite for linux-unstable
+    - [Packaging] remove Provides: aufs-dkms
+    - [Config] update config and annotations following v5.12-rc1 rebase
+    - [Config] disable nvidia and nvidia_server builds
+    - [Config] temporarily disable ZFS
+    - temporarily disable modules check
+    - annotations: s390: temporarily remove CONFIG_KMSG_IDS
+    - [Config] amd64: FTBFS: disable HIO
+    - [Config] FTBFS: disable SHIFT_FS
+    - [Config] s390: temporarily remove CONFIG_KMSG_IDS
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] disable nvidia and nvidia_server builds"
+    - Revert "UBUNTU: SAUCE: s390: kernel message catalog"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 04 Mar 2021 18:26:12 +0100
+
+linux-unstable (5.12.0-0.0) hirsute; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 04 Mar 2021 18:17:32 +0100
+
+linux-unstable (5.11.0-10.11) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Support CML-S CPU + TGP PCH (LP: #1909457)
+    - drm/i915/rkl: new rkl ddc map for different PCH
+    - SAUCE: drm/i915/gen9_bc : Add TGP PCH support
+
+  * Use DCPD to control HP DreamColor panel (LP: #1911001)
+    - SAUCE: drm/dp: Another HP DreamColor panel brigntness fix
+
+  * Update nvidia dkms build for module linker script changes
+    - [Packaging] build-dkms--nvidia-N -- Update for preprocessed module linker
+      script
+
+  * Please trust Canonical Livepatch Service kmod signing key (LP: #1898716)
+    - [Config] enable CONFIG_MODVERSIONS=y
+    - [Packaging] build canonical-certs.pem from branch/arch certs
+    - [Config] add Canonical Livepatch Service key to SYSTEM_TRUSTED_KEYS
+    - [Config] add ubuntu-drivers key to SYSTEM_TRUSTED_KEYS
+
+  * Miscellaneous Ubuntu changes
+    - [Config] re-enable nvidia dkms
+    - SAUCE: selftests: memory-hotplug: bump timeout to 10min
+    - [Debian] update-aufs.sh -- Don't apply tmpfs-idr.patch
+    - [Config] Update configs
+    - [Config] disable nvidia and nvidia_server builds
+    - SAUCE: Import aufs driver
+    - [Config] CONFIG_AUFS_FS=n
+    - [Config] refresh annotations file
+    - [Config] set CONFIG_MIPI_I3C_HCI=m consistently
+    - [Config] set CONFIG_PINCTRL_MSM8953=m on armhf generic-lpae
+    - [Packaging] Change source package name to linux-unstable
+    - [Config] update LD_VERSION in config due to toolchain update
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: tmpfs: Don't use 64-bit inodes by defulat with 32-bit
+      ino_t"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 Feb 2021 07:18:07 +0100
+
+linux-unstable (5.11.0-9.10) hirsute; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 Feb 2021 07:02:45 +0100
+
+linux (5.11.0-9.10) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs/annotations after rebase to 5.11
+    - zfs-modules.ignore: add zzstd
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 15 Feb 2021 16:29:36 +0100
+
+linux (5.11.0-8.9) hirsute; urgency=medium
+
+  * Missing device id for Intel TGL-H ISH [8086:43fc] in intel-ish-hid driver
+    (LP: #1914543)
+    - SAUCE: HID: intel-ish-hid: ipc: Add Tiger Lake H PCI device ID
+
+  *  Add support for new Realtek ethernet NIC (LP: #1914604)
+    - r8169: Add support for another RTL8168FP
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: tmpfs: Don't use 64-bit inodes by defulat with 32-bit ino_t
+    - [Config] Set CONFIG_TMPFS_INODE64=n for s390x
+    - [Config] re-enable ZFS
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 08 Feb 2021 11:56:23 +0100
+
+linux (5.11.0-7.8) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  *  Boot fails: failed to validate module [nls_iso8859_1] BTF: -22
+    (LP: #1911359)
+    - SAUCE: x86/entry: build thunk_$(BITS) only if CONFIG_PREEMPTION=y
+
+  * Remove scary stack trace from Realtek WiFi driver (LP: #1913263)
+    - rtw88: reduce the log level for failure of tx report
+
+  * Fix unexpected AER/DPC on PCH400 and PCH500 (LP: #1913691)
+    - Revert "UBUNTU: SAUCE: PCI: Enable ACS quirk on all CML root ports"
+    - Revert "UBUNTU: SAUCE: PCI: Enable ACS quirk on CML root port"
+    - SAUCE: PCI/AER: Disable AER interrupt during suspend
+    - SAUCE: PCI/DPC: Disable DPC interrupt during suspend
+
+  * switch to an autogenerated nvidia series based core via dkms-versions
+    (LP: #1912803)
+    - [Packaging] nvidia -- use dkms-versions to define versions built
+    - [Packaging] update-version-dkms -- maintain flags fields
+
+  * Introduce the new NVIDIA 460-server series and update the 460 series
+    (LP: #1913200)
+    - [Config] dkms-versions -- add the 460-server nvidia driver
+
+  * Fix the video can't output through WD19TB connected with TGL platform during
+    cold-boot (LP: #1910211)
+    - SAUCE: drm/i915/dp: Prevent setting LTTPR mode if no LTTPR is detected
+
+  * Stop using get_scalar_status command in Dell AIO uart backlight driver
+    (LP: #1865402)
+    - SAUCE: platform/x86: dell-uart-backlight: add get_display_mode command
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/seccomp: Accept any valid fd in user_notification_addfd
+    - [Packaging] Don't disable CONFIG_DEBUG_INFO in headers packages
+    - [Config] update configs/annotations after rebase to 5.11-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 01 Feb 2021 10:27:52 +0100
+
+linux (5.11.0-6.7) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Prevent thermal shutdown during boot process (LP: #1906168)
+    - thermal/drivers/acpi: Use hot and critical ops
+    - thermal/core: Remove notify ops
+    - thermal: int340x: Fix unexpected shutdown at critical temperature
+    - thermal: intel: pch: Fix unexpected shutdown at critical temperature
+
+  * riscv: backport support for SiFive Unmatched (LP: #1910965)
+    - RISC-V: Update l2 cache DT documentation to add support for SiFive FU740
+    - RISC-V: sifive_l2_cache: Update L2 cache driver to support SiFive FU740
+    - dt-bindings: riscv: Update DT binding docs to support SiFive FU740 SoC
+    - riscv: dts: add initial support for the SiFive FU740-C000 SoC
+    - dt-bindings: riscv: Update YAML doc to support SiFive HiFive Unmatched board
+    - riscv: dts: add initial board data for the SiFive HiFive Unmatched
+    - PCI: microsemi: Add host driver for Microsemi PCIe controller
+    - Microsemi PCIe expansion board DT entry.
+    - SiFive Unleashed CPUFreq
+    - SiFive HiFive Unleashed: Add PWM LEDs (D1, D2, D3, D4)
+
+  * initramfs unpacking failed (LP: #1835660)
+    - lib/decompress_unlz4.c: correctly handle zero-padding around initrds.
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to 5.11-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 25 Jan 2021 09:31:31 +0100
+
+linux (5.11.0-5.6) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update config and annotations after rebase to 5.11-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 18 Jan 2021 10:46:10 +0100
+
+linux (5.11.0-4.5) hirsute; urgency=medium
+
+  *  Boot fails: failed to validate module [nls_iso8859_1] BTF: -22
+    (LP: #1911359)
+    - SAUCE: x86/entry: build thunk_$(BITS) only if CONFIG_PREEMPTION=y
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Jan 2021 12:53:26 +0100
+
+linux (5.11.0-3.4) hirsute; urgency=medium
+
+  *  Boot fails: failed to validate module [nls_iso8859_1] BTF: -22
+    (LP: #1911359)
+    - bpf: Allow empty module BTFs
+    - libbpf: Allow loading empty BTFs
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Jan 2021 07:43:45 +0100
+
+linux (5.11.0-2.3) hirsute; urgency=medium
+
+  * DMI entry syntax fix for Pegatron / ByteSpeed C15B (LP: #1910639)
+    - Input: i8042 - unbreak Pegatron C15B
+
+  * SYNA30B4:00 06CB:CE09 Mouse  on HP EliteBook 850 G7 not working at all
+    (LP: #1908992)
+    - HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device
+
+  * debian/scripts/file-downloader does not handle positive failures correctly
+    (LP: #1878897)
+    - [Packaging] file-downloader not handling positive failures correctly
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * CVE-2021-1052 // CVE-2021-1053
+    - [Packaging] NVIDIA -- Add the NVIDIA 460 driver
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove nvidia-455 dkms build
+    - SAUCE: ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP
+      machines
+    - [Config] update configs and annotations after rebase to 5.11-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 11 Jan 2021 09:52:27 +0100
+
+linux (5.11.0-1.2) hirsute; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 07 Jan 2021 16:57:01 +0100
+
+linux (5.11.0-0.1) hirsute; urgency=medium
+
+  * dep-8 ubuntu-regression-suite tests are not run for all linux-hwe-* kernels
+    (LP: #1908529)
+    - [dep-8] Allow all hwe kernels
+
+  * Fix reading speed and duplex sysfs on igc device (LP: #1906851)
+    - igc: Report speed and duplex as unknown when device is runtime suspended
+
+  * rtwpci driver blocks the system to enter PC10, stuck at PC3 (LP: #1907200)
+    - SAUCE: rtw88: 8723de: let cpu enter c10
+
+  * [21.04 FEAT] Deactivate CONFIG_QETH_OSN kernel config option (LP: #1906370)
+    - [Config] Deactivate CONFIG_QETH_OSN kernel config option
+
+  * Add dpcd backlight control for 0x4c83 0x4f41 (LP: #1905663)
+    - SAUCE: drm/dp: Add dpcd backlight control for 0x4c83 0x4f41
+
+  * disable building bpf selftests (LP: #1908144)
+    - SAUCE: selftests/bpf: Clarify build error if no vmlinux
+    - SAUCE: selftests: Skip BPF selftests by default
+    - disable building bpf selftests (no VMLINUX_BTF)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - [Config] update configs and annotations after rebase to v5.11-rc1
+    - hio: fix build error with kernel 5.11
+    - SAUCE: shiftfs: fix build error with 5.11
+    - [Config] temporarily disable ZFS
+    - check-aliases: do not error if modules.alias does not exist
+    - ppc64el: don't build stripped vdso
+
+  * Miscellaneous upstream changes
+    - irq: export irq_check_status_bit
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Jan 2021 09:17:48 +0100
+
+linux (5.11.0-0.0) hirsute; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 30 Dec 2020 09:04:41 +0100
+
+linux (5.10.0-9.10) hirsute; urgency=medium
+
+  * Use INTx for Pericom USB controllers (LP: #1906839)
+    - PCI: Disable MSI for Pericom PCIe-USB adapter
+
+  * disable building bpf selftests (LP: #1908144)
+    - SAUCE: selftests/bpf: clarify build error if no vmlinux
+    - SAUCE: selftests: Skip BPF seftests by default
+    - disable building bpf selftests (no VMLINUX_BTF)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Enable CONFIG_BPF_LSM
+
+  * Miscellaneous upstream changes
+    - Revert "md: change mddev 'chunk_sectors' from int to unsigned"
+    - Revert "dm raid: fix discard limits for raid1 and raid10"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 15 Dec 2020 10:16:14 +0100
+
+linux (5.10.0-8.9) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Fix bpf selftest compilation with clang 11
+    - bpf: Fix selftest compilation on clang 11
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to v5.10
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Dec 2020 08:57:57 +0100
+
+linux (5.10.0-7.8) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Fix linux-libc-dev build for hirsute forward port kernels (LP: #1904067)
+    - [Debian] Build linux-libc-dev for debian.master* branches
+
+  * Update kernel packaging to support forward porting kernels (LP: #1902957)
+    - [Debian] Update for leader included in BACKPORT_SUFFIX
+
+  * Introduce the new NVIDIA 455 series (LP: #1897751)
+    - [Packaging] NVIDIA -- Add signed modules for the 455 driver
+
+  * 5.10 kernel fails to boot with secure boot disabled (LP: #1904906)
+    - [Config] CONFIG_RCU_SCALE_TEST=n
+
+  * Miscellaneous Ubuntu changes
+    - [Config] s390x: disable GPIO_CDEV
+    - [Config] ARM_CMN=m
+    - [Config] disable GPIO_CDEV_V1
+    - [Config] Reorder annotations after 5.10-rc6 rebase
+    - [Packaging] Remove nvidia-435 dkms build
+    - [Packaging] Change source package name to linux
+    - [Config] Update configs and annotations after rebase to v5.10-rc7
+    - SAUCE: Revert "mm/filemap: add static for function
+      __add_to_page_cache_locked"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 07 Dec 2020 00:15:20 -0600
+
+linux (5.10.0-6.7) hirsute; urgency=medium
+
+  * Empty entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 06 Dec 2020 22:13:46 -0600
+
+linux-5.10 (5.10.0-6.7) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Avoid double newline when running insertchanges (LP: #1903293)
+    - [Packaging] insertchanges: avoid double newline
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging]: linux-modules should depend on linux-image
+    - [Packaging]: linux-image should suggest linux-modules-extra
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 30 Nov 2020 07:47:34 +0100
+
+linux-5.10 (5.10.0-5.6) hirsute; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] add CONFIG_INFINIBAND_VIRT_DMA
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 Nov 2020 13:17:44 +0100
+
+linux-5.10 (5.10.0-4.5) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] reduce the size required to build packages
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 16 Nov 2020 08:33:54 +0100
+
+linux-5.10 (5.10.0-3.4) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * e1000e: fix issues with S0ix (LP: #1902687)
+    - SAUCE: e1000e: fix S0ix flow to allow S0i3.2 subset entry
+    - SAUCE: e1000e: allow turning s0ix flows on for systems with ME
+    - SAUCE: e1000e: Add Dell's Comet Lake systems into s0ix heuristics
+    - SAUCE: e1000e: Add more Dell CML systems into s0ix heuristics
+    - [Config] Update CONFIG_E1000E for ppc64el in annotations
+
+  * perf: Add support for Rocket Lake (LP: #1902004)
+    - SAUCE: perf/x86/intel: Add Rocket Lake CPU support
+    - SAUCE: perf/x86/cstate: Add Rocket Lake CPU support
+    - SAUCE: perf/x86/msr: Add Rocket Lake CPU support
+    - SAUCE: perf/x86/intel/uncore: Add Rocket Lake support
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE
+    - [Config] update CONFIG_MST_IRQ after rebase to 5.10-rc3
+    - [Config] drop obsolete SND_SST_IPC options
+    - [Config] re-enable ZFS
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Nov 2020 09:37:08 +0100
+
+linux-5.10 (5.10.0-2.3) hirsute; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Switch arm64 default cpufreq governor to ondemand
+    - [Debian] Include scripts/module.lds from builddir in headers package
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 03 Nov 2020 21:01:52 -0600
+
+linux-5.10 (5.10.0-1.2) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Fix non-working Intel NVMe after S3 (LP: #1900847)
+    - SAUCE: PCI: Enable ACS quirk on all CML root ports
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move to hirsute
+    - [Config] Update configs and annotations after rebase to 5.10-rc2
+    - [Config] Update numerous configs to conform with policy
+    - [Config] Switch default CPUFreq governer for arm64/armhf to schedultil
+    - [Config] Temporarily disable DEBUG_INFO_BTF for armhf
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 02 Nov 2020 13:18:27 -0600
+
+linux-5.10 (5.10.0-0.1) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update configs and annotations for v5.10-rc1
+    - SAUCE: platform/x86: dell-uart-backlight: rename kzfree() to
+      kfree_sensitive()
+    - SAUCE: apparmor: rename kzfree() to kfree_sensitive()
+    - SAUCE: LSM: change ima_read_file() to use lsmblob
+    - SAUCE: LSM: Use lsmblob in smk_netlbl_mls()
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Change source package name to linux-5.10"
+    - s390: correct __bootdata / __bootdata_preserved macros
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 27 Oct 2020 16:57:07 +0100
+
+linux-5.10 (5.10.0-0.0) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 26 Oct 2020 14:55:48 +0100
+
+linux-5.9 (5.9.0-2.3) groovy; urgency=medium
+
+  * Fix system reboot when disconnecting WiFi (LP: #1899726)
+    - iwlwifi: msix: limit max RX queues for 9000 family
+
+  * booting linux-generic-lpae armhf kernel under qemu results in relocation out
+    of range, and thus no modules can be loaded (LP: #1899519)
+    - [Config] armhf: ARM_MODULE_PLTS=y
+
+  * Fix broken MSI interrupt after HDA controller was suspended (LP: #1899586)
+    - ALSA: hda: fix jack detection with Realtek codecs when in D3
+
+  * CVE-2020-16119
+    - SAUCE: dccp: avoid double free of ccid on child socket
+
+  * python3-venv is gone (LP: #1896801)
+    - SAUCE: doc: remove python3-venv dependency
+
+  * *-tools-common packages descriptions have typo "PGKVER" (LP: #1898903)
+    - [Packaging] Fix typo in -tools template s/PGKVER/PKGVER/
+
+  * Enable brightness control on HP DreamColor panel (LP: #1898865)
+    - SAUCE: drm/i915/dpcd_bl: Skip testing control capability with force DPCD
+      quirk
+    - SAUCE: drm/dp: HP DreamColor panel brigntness fix
+
+  * HP Zbook Studio G7 boots into corrupted screen with PSR featured panel
+    (LP: #1897501)
+    - SAUCE: drm/i915/psr: allow overriding PSR disable param by quirk
+    - SAUCE: drm/dp: add DP_QUIRK_FORCE_PSR_CHIP_DEFAULT quirk to CMN prod-ID
+      19-15
+
+  * Fix broken e1000e device after S3 (LP: #1897755)
+    - SAUCE: e1000e: Increase polling timeout on MDIC ready bit
+
+  * Wakeup the system by touching the touchpad (LP: #1888331)
+    - HID: i2c-hid: Enable wakeup capability from Suspend-to-Idle
+
+  * Enable LTR for endpoints behind VMD (LP: #1896598)
+    - SAUCE: PCI/ASPM: Enable LTR for endpoints behind VMD
+
+  * [SRU] [Focal/OEM-5.6/Groovy]Fix AMD usb host controller lost after stress S3
+    (LP: #1893914)
+    - SAUCE: xhci: workaround for S3 issue on AMD SNPS 3.0 xHC
+
+  * debian/rules editconfigs does not work on s390x to change s390x only configs
+    (LP: #1863116)
+    - [Packaging] kernelconfig -- only update/edit configurations on architectures
+      we have compiler support
+
+  * Fix non-working NVMe after S3 (LP: #1895718)
+    - SAUCE: PCI: Enable ACS quirk on CML root port
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: bpf: Check CONFIG_BPF option for resolve_btfids
+    - SAUCE: tools resolve_btfids: Always force HOSTARCH
+    - packaging: arm64: add a 64KB mem pages flavour called 'generic-64k'
+    - packaging: arm64: generic-64k: skip ABI, modules and retpoline checks
+    - SAUCE: drm/i915/display: Fix null deref in intel_psr_atomic_check()
+    - [Config] Update toolchain versions
+    - [Config] Refresh annotations
+    - Add ubuntu-host module
+    - CONFIG_UBUNTU_HOST=m
+    - SAUCE: apparmor: drop prefixing abs root labels with '='
+    - SAUCE: apparmor: disable showing the mode as part of a secid to secctx
+    - SAUCE: apparmor: rename aa_sock() to aa_unix_sk()
+    - SAUCE: apparmor: LSM stacking: switch from SK_CTX() to aa_sock()
+    - SAUCE: LSM: Infrastructure management of the sock security
+    - SAUCE: LSM: Create and manage the lsmblob data structure.
+    - SAUCE: LSM: Use lsmblob in security_audit_rule_match
+    - SAUCE: LSM: Use lsmblob in security_kernel_act_as
+    - SAUCE: net: Prepare UDS for security module stacking
+    - SAUCE: LSM: Use lsmblob in security_secctx_to_secid
+    - SAUCE: LSM: Use lsmblob in security_secid_to_secctx
+    - SAUCE: LSM: Use lsmblob in security_ipc_getsecid
+    - SAUCE: LSM: Use lsmblob in security_task_getsecid
+    - SAUCE: LSM: Use lsmblob in security_inode_getsecid
+    - SAUCE: LSM: Use lsmblob in security_cred_getsecid
+    - SAUCE: IMA: Change internal interfaces to use lsmblobs
+    - SAUCE: LSM: Specify which LSM to display
+    - SAUCE: LSM: Ensure the correct LSM context releaser
+    - SAUCE: LSM: Use lsmcontext in security_secid_to_secctx
+    - SAUCE: LSM: Use lsmcontext in security_inode_getsecctx
+    - SAUCE: LSM: security_secid_to_secctx in netlink netfilter
+    - SAUCE: NET: Store LSM netlabel data in a lsmblob
+    - SAUCE: LSM: Verify LSM display sanity in binder
+    - SAUCE: Audit: Add new record for multiple process LSM attributes
+    - SAUCE: Audit: Add a new record for multiple object LSM
+    - SAUCE: LSM: Add /proc attr entry for full LSM context
+    - SAUCE: AppArmor: Remove the exclusive flag
+    - SAUCE: Audit: Fix for missing NULL check
+
+  * Miscellaneous upstream changes
+    - tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup()
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.9
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 14 Oct 2020 13:31:18 -0500
+
+linux-5.9 (5.9.0-1.2) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update configs after rebase to 5.9-rc6
+    - SAUCE: dax: Fix compilation for CONFIG_DAX && !CONFIG_FS_DAX
+    - SAUCE: bpf: Use --no-fail option if CONFIG_BPF is not enabled
+    - SAUCE: tools resolve_btfids: Always force HOSTARCH
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.9-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 21 Sep 2020 14:39:34 -0500
+
+linux-5.9 (5.9.0-0.1) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update configs and annotations for v5.9-rc1
+    - SAUCE: i915: Fix build error due to missing struct definition
+    - hio -- Update blk_queue_split() calls for changes in 5.9-rc1
+    - hio -- Updates for move of make_request_fn to struct block_device_operations
+    - [Config] Disable zfs dkms build
+    - [Config] Disable nvidia dkms build
+    - [Config] Disable nvidia server dkms builds
+    - SAUCE: remoteproc: qcom: Use div_u64() for 64-bit division
+    - SAUCE: PCI/ASPM: Enable ASPM for links under VMD domain
+    - [Packaging] Bind hv_vss_daemon startup to hv_vss device
+    - [Packaging] bind hv_fcopy_daemon startup to hv_fcopy device
+    - [Config] Re-enable UEFI signing for arm64
+    - SAUCE: Revert "UBUNTU: SAUCE: export __get_vm_area_caller() and map_kernel_range()"
+    - [Config] Set the default CPU governor to ONDEMAND
+    - [Packaging] update variants
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.9-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 17 Sep 2020 15:01:21 -0500
+
+linux-5.9 (5.9.0-0.0) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 18 Aug 2020 16:48:03 -0500
+
+linux (5.8.0-16.17) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-16.17 -proposed tracker (LP: #1891233)
+
+  * Miscellaneous Ubuntu changes
+    - hio -- Update to use bio_{start,end}_io_acct with 5.8+
+    - Enable hio driver
+    - [Packaging] Temporarily disable building doc package contents
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 11 Aug 2020 15:32:58 -0500
+
+linux (5.8.0-15.16) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-15.16 -proposed tracker (LP: #1891177)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Documentation: import error c_funcptr_sig_re, c_sig_re (sphinx-
+      doc/sphinx@0f49e30c)
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 11 Aug 2020 09:29:58 -0500
+
+linux (5.8.0-14.15) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-14.15 -proposed tracker (LP: #1891085)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * msg_zerocopy.sh in net from ubuntu_kernel_selftests failed (LP: #1812620)
+    - selftests/net: relax cpu affinity requirement in msg_zerocopy test
+
+  * Fix missing HDMI/DP Audio on an HP Desktop (LP: #1890441)
+    - ALSA: hda/hdmi: Add quirk to force connectivity
+
+  * Add initial audio support for Lenovo ThinkStation P620 (LP: #1890317)
+    - ALSA: usb-audio: Add support for Lenovo ThinkStation P620
+
+  * Fix IOMMU error on AMD Radeon Pro W5700 (LP: #1890306)
+    - PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
+
+  * Enlarge hisi_sec2 capability (LP: #1890222)
+    - crypto: hisilicon - update SEC driver module parameter
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Re-enable signing for ppc64el
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 10 Aug 2020 15:26:46 -0500
+
+linux (5.8.0-13.14) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Remove i386 configs
+    - SAUCE: apply a workaround to re-enable CONFIG_CRYPTO_AEGIS128_SIMD
+    - SAUCE: export __get_vm_area_caller() and map_kernel_range()
+    - [Config] drop CONFIG_BINFMT_AOUT enforcement
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] disable CONFIG_CRYPTO_AEGIS128_SIMD"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 04 Aug 2020 09:51:50 +0200
+
+linux (5.8.0-12.13) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-12.13 -proposed tracker (LP: #1889481)
+
+  * Fix right speaker of HP laptop (LP: #1889375)
+    - SAUCE: hda/realtek: Fix right speaker of HP laptop
+
+  * blk_update_request error when mount nvme partition (LP: #1872383)
+    - SAUCE: nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
+
+  * Add support for Atlantic NIC firmware v4 (LP: #1886908)
+    - Revert "UBUNTU: SAUCE: net: atlantic: Add support for firmware v4"
+    - net: atlantic: align return value of ver_match function with function name
+    - net: atlantic: add support for FW 4.x
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Fix debian/tests for linux-5.8 -> linux rename
+    - SAUCE: selftests/powerpc: return skip code for spectre_v2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 29 Jul 2020 16:58:47 -0500
+
+linux (5.8.0-11.12) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-11.12 -proposed tracker (LP: #1889336)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] dwarves is not required for linux-libc-dev or stage1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Jul 2020 22:33:24 -0500
+
+linux (5.8.0-10.11) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-10.11 -proposed tracker (LP: #1889316)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Add more packages to Build-Depends-Indep for docs
+    - [Debian] Specify python executable in kmake
+    - [Debian] Don't treat warnings as errors during perf builds
+    - [Config] Disable signing for ppc64el
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Jul 2020 17:09:52 -0500
+
+linux (5.8.0-9.10) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-9.10 -proposed tracker (LP: #1889140)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Fix s390x compile error on F32 utils/stat-display.c
+    - [Packaging] Add python3-venv to Build-Depends-Indep
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Jul 2020 21:01:46 -0500
+
+linux (5.8.0-8.9) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-8.9 -proposed tracker (LP: #1889104)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+    - [Packaging] update variants
+
+  * Introduce the new NVIDIA 450-server and the 450 UDA series (LP: #1887674)
+    - [Packaging] NVIDIA -- Add signed modules for 450 450-server
+
+  * Introduce the new NVIDIA 418-server and 440-server series, and update the
+    current NVIDIA drivers (LP: #1881137)
+    - [packaging] add signed modules for the 418-server and the 440-server
+      flavours
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "radix-tree: Use local_lock for protection"
+    - [Config] CONFIG_DEBUG_INFO_COMPRESSED=n
+    - [Config] disable CONFIG_CRYPTO_AEGIS128_SIMD
+    - [Config] Enable nvidia dkms build
+
+  * Miscellaneous upstream changes
+    - usbip: tools: fix build error for multiple definition
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Jul 2020 11:18:12 -0500
+
+linux (5.8.0-7.8) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Jul 2020 09:22:19 +0200
+
+linux-5.8 (5.8.0-7.8) groovy; urgency=medium
+
+  * soc/amd/renoir: detect dmic from acpi table (LP: #1887734)
+    - ASoC: amd: add logic to check dmic hardware runtime
+    - ASoC: amd: add ACPI dependency check
+    - ASoC: amd: fixed kernel warnings
+
+  * linux 4.15.0-109-generic network DoS regression vs -108 (LP: #1886668)
+    - SAUCE: Revert "netprio_cgroup: Fix unlimited memory leak of v2 cgroups"
+
+  * Add support for Atlantic NIC firmware v4 (LP: #1886908)
+    - SAUCE: net: atlantic: Add support for firmware v4
+
+  * MGA G200e doesn't work under GDM Wayland (LP: #1886140)
+    - drm/mgag200: Remove HW cursor
+    - drm/mgag200: Clean up mga_set_start_address()
+    - drm/mgag200: Clean up mga_crtc_do_set_base()
+    - drm/mgag200: Move mode-setting code into separate helper function
+    - drm/mgag200: Split MISC register update into PLL selection, SYNC and I/O
+    - drm/mgag200: Update mode registers after plane registers
+    - drm/mgag200: Set pitch in a separate helper function
+    - drm/mgag200: Set primary plane's format in separate helper function
+    - drm/mgag200: Move TAGFIFO reset into separate function
+    - drm/mgag200: Move hiprilvl setting into separate functions
+    - drm/mgag200: Move register initialization into separate function
+    - drm/mgag200: Remove out-commented suspend/resume helpers
+    - drm/mgag200: Use simple-display data structures
+    - drm/mgag200: Convert to simple KMS helper
+    - drm/mgag200: Replace VRAM helpers with SHMEM helpers
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: s390/bpf: fix sign extension in branch_ku
+    - SAUCE: selftests: net: ip_defrag: modprobe missing nf_defrag_ipv6 support
+    - SAUCE: selftests: fib_nexthop_multiprefix: fix cleanup() netns deletion
+    - [packaging] debhelper-compat (= 10) (and retire debian/compat)
+    - [Config] Update configs after rebase to 5.8-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Jul 2020 09:55:47 +0200
+
+linux-5.8 (5.8.0-6.7) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * perf build broken after updating to bintuils 2.34.90.20200706-1ubuntu1
+    (LP: #1887397)
+    - SAUCE: libtraceevent: Strip symbol version from nm output
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 13 Jul 2020 14:07:53 -0500
+
+linux-5.8 (5.8.0-5.6) groovy; urgency=medium
+
+  * linux-libc-dev broken for crossbuilding, Multi-Arch:same violation
+    (LP: #1886188)
+    - [Packaging] Produce linux-libc-deb package for riscv64
+    - [Debian] Disallow building linux-libc-dev from linux-riscv
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "UBUNTU: SAUCE: test_bpf: remove expected fail for Ctx heavy
+      transformations test on s390"
+    - SAUCE: Revert "test_bpf: flag tests that cannot be jited on s390"
+    - [Config] Update configs (gcc update)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Jul 2020 08:42:14 +0200
+
+linux-5.8 (5.8.0-4.5) groovy; urgency=medium
+
+  * Add generic LED class support for audio LED (LP: #1885896)
+    - ALSA: hda: generic: Always call led-trigger for mic mute LED
+    - ALSA: hda: generic: Add a helper for mic-mute LED with LED classdev
+    - ALSA: hda/realtek: Convert to cdev-variant of mic-mute LED controls
+    - ALSA: hda/conexant: Convert to cdev-variant of mic-mute LED controls
+    - ALSA: hda/sigmatel: Convert to cdev-variant of mic-mute LED controls
+    - ALSA: hda: generic: Drop unused snd_hda_gen_fixup_micmute_led()
+    - ALSA: hda: generic: Drop the old mic-mute LED hook
+    - ALSA: hda: generic: Add vmaster mute LED helper
+    - ALSA: hda/realtek: Use the new vmaster mute LED helper
+    - ALSA: hda/conexant: Use the new vmaster mute LED helper
+    - ALSA: hda/sigmatel: Use the new vmaster mute LED helper
+    - ALSA: hda/realtek: Unify LED helper code
+    - ALSA: hda: Let LED cdev handling suspend/resume
+
+  * seccomp_bpf fails on powerpc (LP: #1885757)
+    - SAUCE: selftests/seccomp: fix ptrace tests on powerpc
+
+  * CVE-2020-11935
+    - SAUCE: aufs: do not call i_readcount_inc()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Update aufs to 5.x-rcN 20200622
+    - [Config] Update configs to set CONFIG_SND_HDA_GENERIC_LEDS value
+    - [Config] CONFIG_SECURITY_DMESG_RESTRICT=y
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Jul 2020 08:14:28 -0500
+
+linux-5.8 (5.8.0-3.4) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  * lxc 1:4.0.2-0ubuntu1 ADT test failure with linux-5.8 5.8.0-1.2
+    (LP: #1884635)
+    - SAUCE: overlayfs: fix faulty rebase
+
+  * shiftfs: O_TMPFILE reports ESTALE (LP: #1872757)
+    - SAUCE: shiftfs: prevent ESTALE for LOOKUP_JUMP lookups
+
+  * shiftfs: fix btrfs regression (LP: #1884767)
+    - SAUCE: Revert "UBUNTU: SAUCE: shiftfs: fix dentry revalidation"
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_DEBUG_INFO_COMPRESSED=y
+    - SAUCE: regulator: rename da903x to da903x-regulator
+    - [Config] Add da903x to modules.ignore
+    - [Config] Update configs for rebase to 5.8-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jun 2020 08:48:25 -0500
+
+linux-5.8 (5.8.0-2.3) groovy; urgency=medium
+
+  * Support Audio Mute LED for two new HP laptops (LP: #1884251)
+    - ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems
+
+  * CVE-2019-16089
+    - SAUCE: nbd_genl_status: null check for nla_nest_start
+
+  * tpm: fix TIS locality timeout problems (LP: #1881710)
+    - SAUCE: tpm: fix TIS locality timeout problems
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: security,perf: Allow further restriction of perf_event_open
+    - [Config] CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
+    - [Config] Update configs and annotations for 5.8-rc2
+    - [Config] Enable zfs
+    - [Config] Enable CONFIG_DEBUG_INFO_BTF
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jun 2020 15:05:54 -0500
+
+linux-5.8 (5.8.0-1.2) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Support linux-x.y in udeb package names
+    - [Packaging] Use SRCPKGNAME for udeb packages
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 17 Jun 2020 19:34:32 -0500
+
+linux-5.8 (5.8.0-0.1) groovy; urgency=medium
+
+  * Docker registry doesn't stay up and keeps restarting (LP: #1879690)
+    - Revert "UBUNTU: SAUCE: overlayfs: use shiftfs hacks only with shiftfs as underlay"
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Update source package name to linux-5.8
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: (lockdown) powerpc: lock down kernel in secure boot mode
+    - SAUCE: Import aufs driver
+    - [Config] Update configs for v5.8-rc1
+    - [Config] Update annotations for v5.8-rc1 config changes
+    - SAUCE: shiftfs -- Fix build errors from missing fiemap definitions
+    - Disable hio driver
+
+  * Miscellaneous upstream changes
+    - acpi: disallow loading configfs acpi tables when locked down
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 17 Jun 2020 11:54:24 -0500
+
+linux-5.8 (5.8.0-0.0) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 14 Jun 2020 22:40:35 -0500
+
+linux-5.7 (5.7.0-8.9) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Enforce all config annotations (LP: #1879327)
+    - [Config]: do not enforce CONFIG_VERSION_SIGNATURE
+    - [Config]: prepare to enforce all
+    - [Config]: enforce all config options
+
+  * Miscellaneous Ubuntu changes
+    - [Config]: annotations review after 5.7 rebase
+    - [Config] annotations: IXP4XX* depends on ARCH_IXP4XX
+    - [Config] THERMAL_GOV_POWER_ALLOCATOR=y
+    - [Config] annotations: SOC_CAMERA is marked as BROKEN
+    - [Config] annotations: NFSD_V4_2_INTER_SSC depends on NFS_FS=y
+    - [Config] annotations: CRYPTO_DEV_CHELSIO_TLS depends on legacy (and largely
+      unmantained) TLS_TOE
+    - [Config] annotations: SERIO_OLPC_APSP depends on ARCH_MMP
+    - [Config] RTW88_DEBUG=y
+    - [Config] annotations: ISDN_CAPI is a bool, and BT_CMTP depends on  it
+    - [Config] annotations SND_SOC_SOF_DEVELOPER_SUPPORT depends on
+      SND_SOC_SOF_DEVELOPER_SUPPORT
+    - [Config] annotations: SND_SOC_SOF_BAYTRAIL_SUPPORT is mutually exclusive
+      with SND_SST_ATOM_HIFI2_PLATFORM_ACPI
+    - [Config] annotations: DEBUG_IMX_UART_PORT is defined only any
+      DEBUG_IMX*_UART is enabled
+    - [Config] annotations: HW_RANDOM_IMX_RNGC depends on SOC_IMX25
+    - [Config] annotations: armhf: VIRTUALIZATION support was removed for arm32
+    - [Config] annotations: arm64: remove DEBUG_ALIGN_RODATA
+    - [Config] annotations: ppc64: DATA_SHIFT defaults to PPC_PAGE_SHIFT
+    - [Config] arm64: enforce ARM64_USE_LSE_ATOMICS
+    - [Config] s390x: MOST is not set
+    - [Config] s390x: BCM84881_PHY is not set
+    - [Config] s390x: XILINX_LL_TEMAC is not set
+    - [Config] s390x: PHY_INTEL_EMMC requires GENERIC_PHY (off by default on
+      s390x)
+    - [Config] s390x: CHECK_STACK conflicts with VMAP_STACK
+    - [Config] annotations: s390x: NODES_SHIFT=1
+    - [Config] annotations: import new symbols
+    - [Config] annotations: remove unmatched menu and options
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 12 Jun 2020 12:03:01 +0200
+
+linux-5.7 (5.7.0-7.8) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+    - [Packaging] update helper scripts
+
+  * [UBUNTU 20.04] s390x/pci: fix linking between PF and VF for multifunction
+    devices (LP: #1879704)
+    - PCI/IOV: Introduce pci_iov_sysfs_link() function
+    - s390/pci: create links between PFs and VFs
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable UEFI signing for arm64
+    - Rebase to v5.7.1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7.1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 08 Jun 2020 11:16:58 +0200
+
+linux-5.7 (5.7.0-6.7) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  * shiftfs: fix btrfs snapshot deletion (LP: #1879688)
+    - SAUCE: shiftfs: let userns root destroy subvolumes from other users
+
+  * seccomp_benchmark times out on eoan (LP: #1881576)
+    - SAUCE: selftests/seccomp: use 90s as timeout
+
+  * Realtek 8723DE [10ec:d723] subsystem [10ec:d738]  disconnects unsolicitedly
+    when Bluetooth is paired: Reason: 23=IEEE8021X_FAILED (LP: #1878147)
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: Move driver IQK to set channel before
+      association for 11N chip"
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: fix rate for a while after being
+      connected"
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: No retry and report for auth and assoc"
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: 8723d: Add coex support"
+    - rtw88: 8723d: Add coex support
+    - SAUCE: rtw88: coex: 8723d: set antanna control owner
+    - SAUCE: rtw88: coex: 8723d: handle BT inquiry cases
+    - SAUCE: rtw88: fix EAPOL 4-way failure by finish IQK earlier
+
+  * ASoC/amd: add audio driver for amd renoir (LP: #1881046)
+    - ASoC: amd: add Renoir ACP3x IP register header
+    - ASoC: amd: add Renoir ACP PCI driver
+    - ASoC: amd: add acp init/de-init functions
+    - ASoC: amd: create acp3x pdm platform device
+    - ASoC: amd: add ACP3x PDM platform driver
+    - ASoC: amd: irq handler changes for ACP3x PDM dma driver
+    - ASoC: amd: add acp3x pdm driver dma ops
+    - ASoC: amd: add ACP PDM DMA driver dai ops
+    - ASoC: amd: add Renoir ACP PCI driver PM ops
+    - ASoC: amd: add ACP PDM DMA driver pm ops
+    - ASoC: amd: enable Renoir acp3x drivers build
+    - ASoC: amd: create platform devices for Renoir
+    - ASoC: amd: RN machine driver using dmic
+    - ASoC: amd: enable build for RN machine driver
+    - ASoC: amd: fix kernel warning
+    - ASoC: amd: refactoring dai_hw_params() callback
+    - ASoC: amd: return error when acp de-init fails
+    - [Config]: enable amd renoir ASoC audio
+
+  * Slow send speed with Intel I219-V on Ubuntu 18.04.1 (LP: #1802691)
+    - e1000e: Disable TSO for buffer overrun workaround
+
+  * Fix incorrect speed/duplex when I210 device is runtime suspended
+    (LP: #1880656)
+    - igb: Report speed and duplex as unknown when device is runtime suspended
+
+  * Fix Pericom USB controller OHCI/EHCI PME# defect (LP: #1879321)
+    - serial: 8250_pci: Move Pericom IDs to pci_ids.h
+    - PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect
+
+  * [UBUNTU 20.04] s390x/pci: enumerate pci functions per physical adapter
+    (LP: #1874056)
+    - s390/pci: Expose new port attribute for PCIe functions
+    - s390/pci: adaptation of iommu to multifunction
+    - s390/pci: define kernel parameters for PCI multifunction
+    - s390/pci: define RID and RID available
+    - s390/pci: create zPCI bus
+    - s390/pci: adapt events for zbus
+    - s390/pci: Handling multifunctions
+    - s390/pci: Do not disable PF when VFs exist
+    - s390/pci: Documentation for zPCI
+    - s390/pci: removes wrong PCI multifunction assignment
+
+  * add 16-bit width registers support for EEPROM at24 device (LP: #1876699)
+    - regmap-i2c: add 16-bit width registers support
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Enable virtualbox guest and shared-folder modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 01 Jun 2020 16:11:24 -0500
+
+linux-5.7 (5.7.0-5.6) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * [UBUNTU 20.04] PSI generates overhead on s390x (LP: #1876044)
+    - Ubuntu: [Config] CONFIG_PSI is enabled by default, but creates additional
+      overhead on s390x, hence should be disabled by default on s390x only.
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.7-rc7
+    - [Config] ppc64el: disable STRICT_KERNEL_RWX
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 25 May 2020 11:44:09 +0200
+
+linux-5.7 (5.7.0-4.5) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * update-initramfs complains of missing amdgpu firmware files (LP: #1873325)
+    - SAUCE: drm/amdgpu: Remove unreleased arcturus and navi12 firmware from
+      modinfo
+
+  * Support DMIC micmute LED on HP platforms (LP: #1876859)
+    - ALSA: hda/realtek - Introduce polarity for micmute LED GPIO
+    - ALSA: hda/realtek - Enable micmute LED on and HP system
+    - ALSA: hda/realtek - Add LED class support for micmute LED
+    - ALSA: hda/realtek - Fix unused variable warning w/o
+      CONFIG_LEDS_TRIGGER_AUDIO
+    - ASoC: SOF: Update correct LED status at the first time usage of
+      update_mute_led()
+
+  * Killer(R) Wi-Fi 6 AX1650i 160MHz Wireless Network Adapter (201NGW),
+    REV=0x354 [8086:a0f0] subsystem id [1a56:1651] wireless adapter not found
+    due to firmware crash (LP: #1874685)
+    - SAUCE: iwlwifi: pcie: handle QuZ configs with killer NICs as well
+
+  * rtkit-daemon[*]: Failed to make ourselves RT: Operation not permitted after
+    upgrade to 20.04 (LP: #1875665)
+    - [Config] Turn off CONFIG_RT_GROUP_SCHED everywhere
+
+  * Unable to handle kernel pointer dereference in virtual kernel address space
+    on Eoan (LP: #1876645)
+    - SAUCE: overlayfs: fix shitfs special-casing
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: skip building selftest 'runqslower' if kernel not built
+    - Rebase to v5.7-rc6
+    - [Config] updateconfigs after 5.7-rc6 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 May 2020 11:27:25 +0200
+
+linux-5.7 (5.7.0-3.4) groovy; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc5
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * getitimer returns it_value=0 erroneously (LP: #1349028)
+    - [Config] CONTEXT_TRACKING_FORCE policy should be unset
+
+  * lockdown on power (LP: #1855668) // Ubuntu Kernel Support for OpenPOWER NV
+    Secure & Trusted Boot (LP: #1866909)
+    - [Config] Enable configs for OpenPOWER NV Secure & Trusted Boot
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - [Config] Enable aufs
+    - [Config] annotations: remove SND_SOC_SOF_HDA_COMMON_HDMI_CODEC
+    - [Config] Remove CONFIG_SND_HDA_INTEL_DETECT_DMIC from annotations
+    - [Debian] final-checks -- Do not remove ~* from abi
+    - [Config] Enable 5-level page table support for x86
+    - [Config] updateconfigs after 5.7-rc5 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 11 May 2020 10:25:42 +0200
+
+linux-5.7 (5.7.0-2.3) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+    - [Packaging] update helper scripts
+
+  * ASUS T100HAN boots to a blank screen with a cursor [i965: Failed to submit
+    batchbuffer: Input/output error] (LP: #1860754)
+    - [Config] CONFIG_PMIC_OPREGION=y and CONFIG_GPIO_CRYSTAL_COVE=y for amd64
+
+  * ubuntu/focal64 fails to mount Vagrant shared folders  (LP: #1873506)
+    - [Packaging] Move virtualbox modules to linux-modules
+    - [Packaging] Remove vbox and zfs modules from generic.inclusion-list
+
+  * built-using constraints preventing uploads (LP: #1875601)
+    - temporarily drop Built-Using data
+
+  * dkms artifacts may expire from the pool (LP: #1850958)
+    - [Packaging] autoreconstruct -- manage executable debian files
+    - [packaging] handle downloads from the librarian better
+
+  * Add signed modules for the 435 NVIDIA driver (LP: #1875888)
+    - [Packaging] NVIDIA -- add signed modules for the 435 NVIDIA driver
+
+  * [Selftests] Apply various fixes and improvements (LP: #1870543)
+    - SAUCE: selftests/seccomp -- Disable timeout for seccomp tests
+
+  * [17.04 FEAT] Integrate kernel message catalogue for s390x into Ubuntu
+    distribution (LP: #1628889)
+    - SAUCE: s390: kernel message catalog
+
+  * Overlayfs in user namespace leaks directory content of inaccessible
+    directories (LP: #1793458) // CVE-2018-6559
+    - SAUCE: overlayfs: ensure mounter privileges when reading directories
+
+  * suspend only works once on ThinkPad X1 Carbon gen 7 (LP: #1865570)
+    - SAUCE: e1000e: Disable s0ix flow for X1 Carbon 7th
+
+  * [ICL] TC port in legacy/static mode can't be detected due TCCOLD
+    (LP: #1868936)
+    - drm/i915/display: Move out code to return the digital_port of the aux ch
+    - drm/i915/display: Add intel_legacy_aux_to_power_domain()
+    - drm/i915/display: Split hsw_power_well_enable() into two
+    - drm/i915/tc/icl: Implement TC cold sequences
+    - drm/i915/tc: Skip ref held check for TC legacy aux power wells
+    - drm/i915/tc/tgl: Implement TC cold sequences
+    - drm/i915/tc: Catch TC users accessing FIA registers without enable aux
+    - drm/i915/tc: Do not warn when aux power well of static TC ports timeout
+
+  * Touchpad doesn't work on Dell Inspiron 7000 2-in-1 (LP: #1851901)
+    - Revert "UBUNTU: SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390
+      2-in-1"
+
+  * 'Elan touchpad' not detected on 'Lenovo ThinkBook 15 IIL' (LP: #1861610)
+    - SAUCE: Input: elan_i2c - add more hardware ID for Lenovo laptop
+
+  * linux-image-5.0.0-35-generic breaks checkpointing of container
+    (LP: #1857257)
+    - SAUCE: overlayfs: use shiftfs hacks only with shiftfs as underlay
+
+  * alsa/sof: kernel oops on the machine without Intel hdmi audio codec (a
+    regression in the  asoc machine driver) (LP: #1874359)
+    - ASoC: intel/skl/hda - fix oops on systems without i915 audio codec
+
+  * Add debian/rules targets to compile/run kernel selftests (LP: #1874286)
+    - [Packaging] add support to compile/run selftests
+
+  * 5.4.0-24.28 does not seem to apply rtprio, whereas -21 does. (LP: #1873315)
+    - [Config] lowlatency: turn off RT_GROUP_SCHED
+
+  * alsa/sof: external mic can't be deteced on Lenovo and HP laptops
+    (LP: #1872569)
+    - SAUCE: ASoC: intel/skl/hda - set autosuspend timeout for hda codecs
+
+  * shiftfs: O_TMPFILE reports ESTALE (LP: #1872757)
+    - SAUCE: shiftfs: fix dentry revalidation
+
+  * shiftfs: broken shiftfs nesting (LP: #1872094)
+    - SAUCE: shiftfs: record correct creator credentials
+
+  * lockdown on power (LP: #1855668)
+    - SAUCE: (lockdown) powerpc: lock down kernel in secure boot mode
+
+  * Add support for Realtek 8723DE wireless adapter (LP: #1780590)
+    - SAUCE: rtw88: add adaptivity support for EU/JP regulatory
+    - SAUCE: rtw88: update tx descriptor of mgmt and rsvd page packets
+    - SAUCE: rtw88: sar: dump sar information via debugfs
+    - SAUCE: rtw88: 8723d: add IQ calibration
+    - SAUCE: rtw88: 8723d: Add power tracking
+    - SAUCE: rtw88: 8723d: implement flush queue
+    - SAUCE: rtw88: 8723d: set ltecoex register address in chip_info
+    - SAUCE: rtw88: 8723d: Add coex support
+    - SAUCE: rtw88: 8723d: Add shutdown callback to disable BT USB suspend
+
+  * Fix authentication fail on Realtek WiFi 8723de (LP: #1871300)
+    - SAUCE: rtw88: No retry and report for auth and assoc
+    - SAUCE: rtw88: fix rate for a while after being connected
+    - SAUCE: rtw88: Move driver IQK to set channel before association for 11N chip
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: rtw88: fix 'const' mismatch in power suequence hooks
+    - SAUCE: rtw88: fix 'const' mismatch in
+      __priority_queue_cfg_legacy()/__priority_queue_cfg()
+    - [Config] RTW88=m
+    - SAUCE: (lockdown) Revert carried-forward lockdown patches
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - [Config] Add back CONFIG_LOCK_DOWN_IN_SECURE_BOOT annotation for ppc64el
+    - [Config] CONFIG_RT_GROUP_SCHED=y
+    - [Packaging] Include modules.builtin.modinfo in linux-modules
+    - SAUCE: LSM: Infrastructure management of the sock security
+    - SAUCE: Fix-up af_unix mediation for sock infrastructure management
+    - SAUCE: Revert "apparmor: Allow filtering based on secmark policy"
+    - SAUCE: Revert "apparmor: Parse secmark policy"
+    - SAUCE: Revert "apparmor: Add a wildcard secid"
+    - SAUCE: Revert "apparmor: fixup secid map conversion to using IDR"
+    - SAUCE: Revert "apparmor: Use an IDR to allocate apparmor secids"
+    - SAUCE: Revert "apparmor: add support for mapping secids and using secctxes"
+    - Update dropped.txt for restored apparmor patches
+    - Remove lockdown patches from dropped.txt
+    - SAUCE: powerpc/ima: require IMA module signatures only if MODULE_SIG is not
+      enabled
+    - SAUCE: selftests/ftrace: Use printf instead of echo in kprobe syntax error
+      tests
+    - SAUCE: selftests/net -- disable l2tp.sh test
+    - SAUCE: selftests/net -- disable timeout
+    - SAUCE: tools: hv: Update shebang to use python3 instead of python
+    - Remove dropped.txt
+    - [Packaging] move linux-doc and linux-libc-dev stubs to debian.master
+    - [Debian] Support generating configs for riscv64
+    - [Config] CONFIG_KMSG_IDS=y for s390x
+    - [Packaging] add libcap-dev dependency
+    - [Config] CONFIG_AD5770R=m
+    - [Config] CONFIG_AL3010=m
+    - [Config] CONFIG_APPLE_MFI_FASTCHARGE=m
+    - [Config] CONFIG_BAREUDP=m
+    - [Config] CONFIG_CRYPTO_DEV_OCTEONTX_CPT=m
+    - [Config] CONFIG_CRYPTO_DEV_ZYNQMP_AES=m
+    - [Config] CONFIG_DRM_DISPLAY_CONNECTOR=m
+    - [Config] CONFIG_DRM_PANEL_BOE_TV101WUM_NL6=m
+    - [Config] CONFIG_DRM_PANEL_ELIDA_KD35T133=m
+    - [Config] CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02=m
+    - [Config] CONFIG_DRM_PANEL_NOVATEK_NT35510=m
+    - [Config] CONFIG_DRM_PANEL_SAMSUNG_S6E88A0_AMS452EF01=m
+    - [Config] CONFIG_DRM_PARADE_PS8640=m
+    - [Config] CONFIG_DRM_SIMPLE_BRIDGE=m
+    - [Config] CONFIG_DRM_TIDSS=m
+    - [Config] CONFIG_DRM_TI_TPD12S015=m
+    - [Config] CONFIG_DRM_TOSHIBA_TC358768=m
+    - [Config] CONFIG_EDAC_DMC520=m
+    - [Config] CONFIG_EXFAT_FS=m
+    - [Config] CONFIG_GP2AP002=m
+    - [Config] CONFIG_GPIO_MLXBF2=m
+    - [Config] CONFIG_HID_GLORIOUS=m
+    - [Config] CONFIG_HID_MCP2221=m
+    - [Config] CONFIG_HMC425=m
+    - [Config] CONFIG_ICP10100=m
+    - [Config] CONFIG_IMX8MM_THERMAL=m
+    - [Config] CONFIG_IMX_SC_THERMAL=m
+    - [Config] CONFIG_INTERCONNECT_QCOM_OSM_L3=m
+    - [Config] CONFIG_INTERCONNECT_QCOM_SC7180=m
+    - [Config] CONFIG_K3_RTI_WATCHDOG=m
+    - [Config] CONFIG_MDIO_IPQ8064=m
+    - [Config] CONFIG_MDIO_MVUSB=m
+    - [Config] CONFIG_MHI_BUS=m
+    - [Config] CONFIG_OCTEONTX2_VF=m
+    - [Config] CONFIG_PHY_CADENCE_TORRENT=m
+    - [Config] CONFIG_PHY_QCOM_USB_HS_28NM=m
+    - [Config] CONFIG_PHY_QCOM_USB_SS=m
+    - [Config] CONFIG_PINCTRL_DA9062=m
+    - [Config] CONFIG_PINCTRL_IPQ6018=m
+    - [Config] CONFIG_PTP_1588_CLOCK_IDT82P33=m
+    - [Config] CONFIG_PTP_1588_CLOCK_VMW=m
+    - [Config] CONFIG_QCOM_IPA=m
+    - [Config] CONFIG_REGULATOR_MP5416=m
+    - [Config] CONFIG_REGULATOR_MP886X=m
+    - [Config] CONFIG_RN5T618_ADC=m
+    - [Config] CONFIG_RTC_DRV_MT2712=m
+    - [Config] CONFIG_RTC_DRV_RC5T619=m
+    - [Config] CONFIG_SC_MSS_7180=m
+    - [Config] CONFIG_SENSORS_AXI_FAN_CONTROL=m
+    - [Config] CONFIG_SM_GCC_8250=m
+    - [Config] CONFIG_SND_BCM63XX_I2S_WHISTLER=m
+    - [Config] CONFIG_SND_MESON_AIU=m
+    - [Config] CONFIG_SND_MESON_G12A_TOACODEC=m
+    - [Config] CONFIG_SND_MESON_GX_SOUND_CARD=m
+    - [Config] CONFIG_SND_SOC_AMD_RV_RT5682_MACH=m
+    - [Config] CONFIG_SND_SOC_INTEL_SOF_PCM512x_MACH=m
+    - [Config] CONFIG_SND_SOC_MESON_T9015=m
+    - [Config] CONFIG_SND_SOC_RT5682_SDW=m
+    - [Config] CONFIG_SND_SOC_TLV320ADCX140=m
+    - [Config] CONFIG_SPI_FSI=m
+    - [Config] CONFIG_SPI_MTK_NOR=m
+    - [Config] CONFIG_SPI_MUX=m
+    - [Config] CONFIG_SPRD_THERMAL=m
+    - [Config] CONFIG_SURFACE_3_POWER_OPREGION=m
+    - [Config] CONFIG_TINYDRM_ILI9486=m
+    - [Config] CONFIG_TI_K3_AM65_CPSW_NUSS=m
+    - [Config] CONFIG_TYPEC_MUX_INTEL_PMC=m
+    - [Config] CONFIG_UACCE=m
+    - [Config] CONFIG_UNIPHIER_XDMAC=m
+    - [Config] CONFIG_USB_MAX3420_UDC=m
+    - [Config] CONFIG_USB_RAW_GADGET=m
+    - [Config] CONFIG_VHOST_VDPA=m
+    - [Config] CONFIG_VIDEO_IMX219=m
+    - [Config] CONFIG_VIDEO_SUN8I_ROTATE=m
+    - [Config] CONFIG_VIRTIO_VDPA=m
+    - [Config] CONFIG_MOST_COMPONENTS=m
+    - [Config] CONFIG_MFD_IQS62X=m
+    - packaging: getabis: switch to ckt-ppa:bootstrap/linux-5.7
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: rtw88: add rtw_read8_mask and rtw_read16_mask"
+    - Revert "UBUNTU: SAUCE: drm/i915/fbc: disable framebuffer compression on
+      IceLake"
+    - Revert "UBUNTU: SAUCE: platform/x86: dell-uart-backlight: move retry block"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 04 May 2020 10:48:48 +0200
+
+linux-5.7 (5.7.0-1.2) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: hio: pass make_request ptr directly to blk_alloc_queue()
+    - SAUCE: hio: locally define disk_map_sector_rcu()
+    - SAUCE: hio: Revert "block: unexport disk_map_sector_rcu"
+    - SAUCE: hio: include <linux/part_stat.h>
+    - [Config] amd64: i386: HIO=m
+    - [Config] updateconfigs after 5.7-rc3 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 27 Apr 2020 11:31:38 +0200
+
+linux-5.7 (5.7.0-0.1) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.7-rc1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc1
+  * Rebase to v5.7-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 16 Apr 2020 11:53:58 +0200
+
+linux-5.7 (5.7.0-0.0) focal; urgency=medium
+
+  * Dummy entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 16 Apr 2020 11:53:58 +0200
+
+linux-5.6 (5.6.0-7.7) focal; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Kernel Oops - general protection fault: 0000 [#1] SMP PTI after
+    disconnecting thunderbolt docking station (LP: #1864754)
+    - SAUCE: ptp: free ptp clock properly
+
+  * swap storms kills interactive use (LP: #1861359)
+    - SAUCE: mm/page_alloc.c: disable memory reclaim watermark boosting by default
+
+  * sysfs: incorrect network device permissions on network namespace change
+    (LP: #1865359)
+    - sysfs: add sysfs_file_change_owner()
+    - sysfs: add sysfs_link_change_owner()
+    - sysfs: add sysfs_group{s}_change_owner()
+    - sysfs: add sysfs_change_owner()
+    - device: add device_change_owner()
+    - drivers/base/power: add dpm_sysfs_change_owner()
+    - net-sysfs: add netdev_change_owner()
+    - net-sysfs: add queue_change_owner()
+    - net: fix sysfs permssions when device changes network namespace
+    - sysfs: fix static inline declaration of sysfs_groups_change_owner()
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 31 Mar 2020 10:45:09 +0200
+
+linux-5.6 (5.6.0-6.6) focal; urgency=medium
+
+  * suspend only works once on ThinkPad X1 Carbon gen 7 (LP: #1865570)
+    - SAUCE: e1000e: Disable s0ix flow for X1 Carbon 7th
+
+  *  Make Dell WD19 dock more reliable after suspend (LP: #1868217)
+    - xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3
+    - xhci: Wait until link state trainsits to U0 after setting USB_SS_PORT_LS_U0
+    - xhci: Finetune host initiated USB3 rootport link suspend and resume
+
+  * update-version-dkms doesn't add a BugLink (LP: #1867790)
+    - [Packaging] Add BugLink to update-version-dkms commit
+
+  * Add support for Realtek 8723DE wireless adapter (LP: #1780590)
+    - SAUCE: rtw88: add regulatory process strategy for different chipset
+    - SAUCE: rtw88: support dynamic user regulatory setting
+    - SAUCE: rtw88: Use secondary channel offset enumeration
+    - SAUCE: rtw88: 8822c: modify rf protection setting
+    - SAUCE: rtw88: disable TX-AMSDU on 2.4G band
+    - SAUCE: Revert "rtw88: disable TX-AMSDU on 2.4G band"
+    - SAUCE: rtw88: disable TX-AMSDU on 2.4G band
+    - SAUCE: rtw88: remove unused parameter vif in rtw_lps_pg_info_get()
+    - SAUCE: rtw88: add rtw_read8_mask and rtw_read16_mask
+    - SAUCE: rtw88: pci: 8822c should set clock delay to zero
+    - SAUCE: rtw88: move rtw_enter_ips() to the last when config
+    - SAUCE: rtw88: avoid holding mutex for cancel_delayed_work_sync()
+    - SAUCE: rtw88: add ciphers to suppress error message
+    - SAUCE: rtw88: 8822c: update power sequence to v16
+    - SAUCE: rtw88: Fix incorrect beamformee role setting
+    - SAUCE: rtw88: don't hold all IRQs disabled for PS operations
+    - SAUCE: rtw88: extract alloc rsvd_page and h2c skb routines
+    - SAUCE: rtw88: associate reserved pages with each vif
+    - SAUCE: rtw88: add adaptivity support for EU/JP regulatory
+    - SAUCE: rtw88: 8723d: Add basic chip capabilities
+    - SAUCE: rtw88: 8723d: add beamform wrapper functions
+    - SAUCE: rtw88: 8723d: Add power sequence
+    - SAUCE: rtw88: 8723d: Add RF read/write ops
+    - SAUCE: rtw88: 8723d: Add mac/bb/rf/agc/power_limit tables
+    - SAUCE: rtw88: 8723d: Add cfg_ldo25 to control LDO25
+    - SAUCE: rtw88: 8723d: Add new chip op efuse_grant() to control efuse access
+    - SAUCE: rtw88: 8723d: Add read_efuse to recognize efuse info from map
+    - SAUCE: rtw88: add legacy firmware download for 8723D devices
+    - SAUCE: rtw88: no need to send additional information to legacy firmware
+    - SAUCE: rtw88: 8723d: Add mac power-on/-off function
+    - SAUCE: rtw88: decompose while(1) loop of power sequence polling command
+    - SAUCE: rtw88: 8723d: 11N chips don't support H2C queue
+    - SAUCE: rtw88: 8723d: implement set_tx_power_index ops
+    - SAUCE: rtw88: 8723d: Organize chip TX/RX FIFO
+    - SAUCE: rtw88: 8723d: initialize mac/bb/rf basic functions
+    - SAUCE: rtw88: 8723d: Add DIG parameter
+    - SAUCE: rtw88: 8723d: Add query_rx_desc
+    - SAUCE: rtw88: 8723d: Add set_channel
+    - SAUCE: rtw88: handle C2H_CCX_TX_RPT to know if packet TX'ed successfully
+    - SAUCE: rtw88: 8723d: 11N chips don't support LDPC
+    - SAUCE: rtw88: set default port to firmware
+    - SAUCE: rtw88: update tx descriptor of mgmt and rsvd page packets
+    - SAUCE: rtw88: sar: add SAR of TX power limit
+    - SAUCE: rtw88: sar: Load static SAR table from ACPI WRDS method
+    - SAUCE: rtw88: sar: Load dynamic SAR table from ACPI methods
+    - SAUCE: rtw88: sar: apply dynamic SAR table to tx power limit
+    - SAUCE: rtw88: sar: add sar_work to poll if dynamic SAR table is changed
+    - SAUCE: rtw88: sar: dump sar information via debugfs
+    - SAUCE: rtw88: 8723d: Add chip_ops::false_alarm_statistics
+    - SAUCE: rtw88: 8723d: Set IG register for CCK rate
+    - SAUCE: rtw88: 8723d: add interface configurations table
+    - SAUCE: rtw88: 8723d: Add LC calibration
+    - SAUCE: rtw88: 8723d: add IQ calibration
+    - SAUCE: rtw88: 8723d: Add power tracking
+    - SAUCE: rtw88: 8723d: Add shutdown callback to disable BT USB suspend
+    - SAUCE: rtw88: 8723d: implement flush queue
+    - SAUCE: rtw88: 8723d: set ltecoex register address in chip_info
+    - SAUCE: rtw88: 8723d: Add coex support
+    - SAUCE: rtw88: fill zeros to words 0x06 and 0x07 of security cam entry
+    - SAUCE: rtw88: 8723d: Add 8723DE to Kconfig and Makefile
+    - [Config] CONFIG_RTW88_8723DE=y
+
+  * [Ubuntu 20.04] Unset HIBERNATION and PM kernel config options for focal
+    (LP: #1867753)
+    - [Config] CONFIG_HIBERNATION=n and CONFIG_PM=n for s390x
+
+  * [20.04 FEAT] Base KVM setup for secure guests - kernel part (LP: #1835531)
+    - s390/protvirt: introduce host side setup
+    - s390/protvirt: add ultravisor initialization
+    - s390/mm: provide memory management functions for protected KVM guests
+    - s390/mm: add (non)secure page access exceptions handlers
+    - s390/protvirt: Add sysfs firmware interface for Ultravisor information
+    - KVM: s390/interrupt: do not pin adapter interrupt pages
+    - KVM: s390: protvirt: Add UV debug trace
+    - KVM: s390: add new variants of UV CALL
+    - KVM: s390: protvirt: Add initial vm and cpu lifecycle handling
+    - KVM: s390: protvirt: Secure memory is not mergeable
+    - KVM: s390/mm: Make pages accessible before destroying the guest
+    - KVM: s390: protvirt: Handle SE notification interceptions
+    - KVM: s390: protvirt: Instruction emulation
+    - KVM: s390: protvirt: Implement interrupt injection
+    - KVM: s390: protvirt: Add SCLP interrupt handling
+    - KVM: s390: protvirt: Handle spec exception loops
+    - KVM: s390: protvirt: Add new gprs location handling
+    - KVM: S390: protvirt: Introduce instruction data area bounce buffer
+    - KVM: s390: protvirt: handle secure guest prefix pages
+    - KVM: s390/mm: handle guest unpin events
+    - KVM: s390: protvirt: Write sthyi data to instruction data area
+    - KVM: s390: protvirt: STSI handling
+    - KVM: s390: protvirt: disallow one_reg
+    - KVM: s390: protvirt: Do only reset registers that are accessible
+    - KVM: s390: protvirt: Only sync fmt4 registers
+    - KVM: s390: protvirt: Add program exception injection
+    - KVM: s390: protvirt: UV calls in support of diag308 0, 1
+    - KVM: s390: protvirt: Report CPU state to Ultravisor
+    - KVM: s390: protvirt: Support cmd 5 operation state
+    - KVM: s390: protvirt: Mask PSW interrupt bits for interception 104 and 112
+    - KVM: s390: protvirt: do not inject interrupts after start
+    - KVM: s390: protvirt: Add UV cpu reset calls
+    - DOCUMENTATION: Protected virtual machine introduction and IPL
+    - KVM: s390: protvirt: introduce and enable KVM_CAP_S390_PROTECTED
+    - KVM: s390: protvirt: Add KVM api documentation
+    - mm/gup/writeback: add callbacks for inaccessible pages
+
+  * All PS/2 ports on PS/2 Serial add-in bracket are not working after S3
+    (LP: #1866734)
+    - SAUCE: Input: i8042 - fix the selftest retry logic
+
+  * Sys oopsed with sysfs test in ubuntu_stress_smoke_test on X-hwe ARM64
+    (LP: #1866772)
+    - ACPI: sysfs: copy ACPI data using io memory copying
+
+  * Miscellaneous Ubuntu changes
+    - hio -- remove duplicated MODULE_DEVICE_TABLE declaration
+    - SAUCE: r8169: disable ASPM L1.1
+    - [Config] update annotations from configs
+    - [Config] update configs after annotation file review
+    - SAUCE: Revert "tools/power turbostat: Fix 32-bit capabilities warning"
+
+  * Miscellaneous upstream changes
+    - drm/i915: Fix eDP DPCD aux max backlight calculations
+    - drm/dp: Introduce EDID-based quirks
+    - drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED panel
+    - drm/i915: Force DPCD backlight mode for some Dell CML 2020 panels
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 25 Mar 2020 18:09:13 +0100
+
+linux-5.6 (5.6.0-5.5) focal; urgency=medium
+
+  * please help enable CONFIG_EROFS_FS_ZIP (LP: #1867099)
+    - [Config] CONFIG_EROFS_FS_ZIP=y
+    - [Config] CONFIG_EROFS_FS_CLUSTER_PAGE_LIMIT=1
+
+  * Miscellaneous Ubuntu changes
+    - Config: Fix SND_HDA_PREALLOC_SIZE annotations
+    - Config: Fix DATA_SHIFT annotations
+    - Config: remove ANDROID_VSOC from annotations
+    - Config: remove arm arch from annotations
+    - Config: Update SOC_R8A7796X annotations
+    - Config: Update CLK_R8A7796X annotations
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 18 Mar 2020 17:25:30 +0100
+
+linux-5.6 (5.6.0-4.4) focal; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+    - [Packaging] update helper scripts
+
+  * Add sysfs attribute to show remapped NVMe (LP: #1863621)
+    - SAUCE: ata: ahci: Add sysfs attribute to show remapped NVMe device count
+
+  * [20.04 FEAT] Compression improvements in Linux kernel (LP: #1830208)
+    - [Config] Introducing s390x specific kernel config option CONFIG_ZLIB_DFLTCC
+
+  * [UBUNTU 20.04] s390x/pci: increase CONFIG_PCI_NR_FUNCTIONS to 512 in kernel
+    config (LP: #1866056)
+    - [Config] Increase CONFIG_PCI_NR_FUNCTIONS from 64 to 512 starting with focal
+      on s390x
+
+  * CONFIG_IP_MROUTE_MULTIPLE_TABLES is not set (LP: #1865332)
+    - [Config] CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+
+  * [UBUNTU 20.04] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x
+    starting with focal (LP: #1865452)
+    - [Config] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x starting
+      with focal
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "UBUNTU: SAUCE: blk/core: Gracefully handle unset
+      make_request_fn"
+    - [Packaging] prevent duplicated entries in modules.ignore
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Mar 2020 09:42:06 +0100
+
+linux-5.6 (5.6.0-3.3) focal; urgency=medium
+
+  * nsleep-lat / set-timer-lat / inconsistency-check / raw_skew from timer in
+    ubuntu_kernel_selftests timeout on 5.3 / 5.4 (LP: #1864626)
+    - selftests/timers: Turn off timeout setting
+
+  * Update kernel options CONFIG_NR_CPUS and CONFIG_NUMA_EMU for focal
+    (LP: #1864198)
+    - Ubuntu: [Config] Update kernel options CONFIG_NR_CPUS and CONFIG_NUMA_EMU
+
+  * alsa/hda/realtek: fix a mute led regression on Lenovo X1 Carbon
+    (LP: #1864576)
+    - SAUCE: ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1
+
+  * r8152 init may take up to 40 seconds at initialization with Dell WD19/WD19DC
+    during hotplug (LP: #1864284)
+    - UBUNTU SAUCE: r8151: check disconnect status after long sleep
+
+  * Another Dell AIO backlight issue (LP: #1863880)
+    - SAUCE: platform/x86: dell-uart-backlight: move retry block
+
+  * Backport GetFB2 ioctl (LP: #1863874)
+    - SAUCE: drm: Add getfb2 ioctl
+
+  * Focal Fossa (20.04) feature request - Enable CONFIG_X86_UV (LP: #1863810)
+    - [Config] CONFIG_X86_UV=y
+
+  * Miscellaneous Ubuntu changes
+    - debian: remove snapdragon config, rules and flavour
+    - remove snapdragon abi files
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc4
+
+  * Miscellaneous upstream changes
+    - updateconfigs following snapdragon removal
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 04 Mar 2020 08:21:10 +0100
+
+linux-5.6 (5.6.0-2.2) focal; urgency=medium
+
+  * Sometimes can't adjust brightness on Dell AIO (LP: #1862885)
+    - SAUCE: platform/x86: dell-uart-backlight: increase retry times
+
+  * Dell XPS 13 (7390) Display Flickering - 19.10  (LP: #1849947)
+    - SAUCE: drm/i915: Disable PSR by default on all platforms
+
+  * Miscellaneous Ubuntu changes
+    - [debian] ignore missing wireguard module
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - [Config] CONFIG_LOCK_DOWN_IN_SECURE_BOOT=y
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc3
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (lockdown) s390/ipl: lockdown kernel when booted
+      secure"
+    - Revert "UBUNTU: SAUCE: (lockdown) KEYS: Make use of platform keyring for
+      module signature verify"
+    - Revert "UBUNTU: SAUCE: (lockdown) Add a SysRq option to lift kernel
+      lockdown"
+    - Revert "UBUNTU: SAUCE: (lockdown) security: lockdown: expose a hook to lock
+      the kernel down"
+    - Revert "UBUNTU: SAUCE: (lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err()."
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 24 Feb 2020 18:57:22 +0100
+
+linux-5.6 (5.6.0-1.1) focal; urgency=medium
+
+  *  Integrate Intel SGX driver into linux-azure (LP: #1844245)
+    - [Packaging] Add systemd service to load intel_sgx
+
+  * QAT drivers for C3XXX and C62X not included as modules (LP: #1845959)
+    - [Config] CRYPTO_DEV_QAT_C3XXX=m, CRYPTO_DEV_QAT_C62X=m and
+      CRYPTO_DEV_QAT_DH895xCC=m
+
+  * 5.4.0-11 crash on cryptsetup open (LP: #1860231)
+    - SAUCE: blk/core: Gracefully handle unset make_request_fn
+
+  * multi-zone raid0 corruption (LP: #1850540)
+    - SAUCE: md/raid0: Use kernel specific layout
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - update dropped.txt after rebase to v5.6-rc1
+    - [Config] updateconfigs after rebase to 5.6-rc1
+    - hio -- proc_create() requires a "struct proc_ops" in 5.6
+    - SAUCE: arm: fix build error in kvm tracepoint
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] Disable the uselib system call"
+    - Revert "UBUNTU: [Config] Disable legacy PTY naming"
+    - Revert "UBUNTU: [Config] Enforce filtered access to iomem"
+    - Revert "UBUNTU: [Config] Enable notifier call chain validations"
+    - Revert "UBUNTU: [Config] Enable scatterlist validation"
+    - Revert "UBUNTU: [Config] Enable cred sanity checks"
+    - Revert "UBUNTU: [Config] Enable linked list manipulation checks"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 13 Feb 2020 17:20:27 +0100
+
+linux-5.6 (5.6.0-0.0) focal; urgency=medium
+
+  * Dummy entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 10 Feb 2020 11:06:18 +0100
+
+linux-5.5 (5.5.0-7.8) focal; urgency=medium
+
+  * CONFIG_USELIB should be disabled (LP: #1855341)
+    - [Config] Disable the uselib system call
+
+  * CONFIG_LEGACY_PTYS should be disabled (LP: #1855339)
+    - [Config] Disable legacy PTY naming
+
+  * CONFIG_IO_STRICT_DEVMEM should be enabled (LP: #1855338)
+    - [Config] Enforce filtered access to iomem
+
+  * CONFIG_DEBUG_NOTIFIERS should be enabled (LP: #1855337)
+    - [Config] Enable notifier call chain validations
+
+  * CONFIG_DEBUG_SG should be enabled (LP: #1855336)
+    - [Config] Enable scatterlist validation
+
+  * CONFIG_DEBUG_CREDENTIALS should be enabled (LP: #1855335)
+    - [Config] Enable cred sanity checks
+
+  * CONFIG_DEBUG_LIST should be enabled (LP: #1855334)
+    - [Config] Enable linked list manipulation checks
+
+  * shiftfs: prevent lower dentries from going negative during unlink
+    (LP: #1860041)
+    - SAUCE: shiftfs: prevent lower dentries from going negative during unlink
+
+  * [SRU][B/OEM-B/OEM-OSP1/D/E/Unstable] UBUNTU: SAUCE: Use native backlight on
+    Lenovo E41-25/45 (LP: #1859561)
+    - SAUCE: ACPI: video: Use native backlight on Lenovo E41-25/45
+
+  * USB key cannot be detected by hotplug on Sunix USB Type-A 3.1 Gen 2 card
+    [1b21:2142]  (LP: #1858988)
+    - SAUCE: PCI: Avoid ASMedia XHCI USB PME# from D0 defect
+
+  * Dell AIO can't adjust brightness (LP: #1858761)
+    - SAUCE: platform/x86: dell-uart-backlight: add retry for get scalar status
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Fix typo in annotations file
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 27 Jan 2020 11:39:38 +0100
+
+linux-5.5 (5.5.0-6.7) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Update ubuntu-regression-suite dependency to python2
+    - [Packaging] Fix ubuntu-regression-suite python dependency for hwe kernel
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Jan 2020 10:16:01 +0100
+
+linux-5.5 (5.5.0-5.6) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Jan 2020 15:50:12 +0100
+
+linux-5.5 (5.5.0-4.5) focal; urgency=medium
+
+  * linux build and autopkg tests need to use python2 instead of python
+    (LP: #1858487)
+    - [Packaging] Remove python-dev build dependency
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Jan 2020 16:00:26 +0100
+
+linux-5.5 (5.5.0-3.4) focal; urgency=medium
+
+  * [SRU][B/OEM-B/OEM-OSP1/D/E/F] Add LG I2C touchscreen multitouch support
+    (LP: #1857541)
+    - SAUCE: HID: multitouch: Add LG MELF0410 I2C touchscreen support
+
+  * Make vfio-pci built-in or xhci_hcd optional (LP: #1770845)
+    - [Config]: built-in VFIO_PCI for amd64
+
+  * multi-zone raid0 corruption (LP: #1850540)
+    - SAUCE: md/raid0: Link to wiki with guidance on multi-zone RAID0 layout
+      migration
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Change source package to linux-5.5
+    - [Packaging] Don't use SRCPKGNAME for linux-libc-dev
+    - [Packaging] Remove linux-source-3 Provides: from linux-source
+    - [Packaging] Fix linux-doc in linux-image Suggests:
+    - [Debian] Read variants list into a variable
+    - [Packaging] Generate linux-libc-dev package only for primary variant
+    - [Packaging] Generate linux-doc for only the primary variant
+    - [Debian] Update linux source package name in debian/tests/*
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.5-rc3
+    - [Config] disable PCI_MESON
+    - [Config] Add pinctrl-equilibrium to modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Jan 2020 11:28:43 +0100
+
+linux-5.5 (5.5.0-2.3) focal; urgency=medium
+
+  * Empty entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 17 Dec 2019 22:33:59 -0600
+
+linux (5.5.0-2.3) focal; urgency=medium
+
+  * Support DPCD aux brightness control (LP: #1856134)
+    - SAUCE: drm/i915: Fix eDP DPCD aux max backlight calculations
+    - SAUCE: drm/i915: Assume 100% brightness when not in DPCD control mode
+    - SAUCE: drm/i915: Fix DPCD register order in intel_dp_aux_enable_backlight()
+    - SAUCE: drm/i915: Auto detect DPCD backlight support by default
+    - SAUCE: drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED
+      panel
+    - USUNTU: SAUCE: drm/i915: Force DPCD backlight mode on Dell Precision 4K sku
+
+  * change kconfig of the soundwire bus driver from y to m (LP: #1855685)
+    - [Config]: SOUNDWIRE=m
+
+  * Fix unusable USB hub on Dell TB16 after S3 (LP: #1855312)
+    - SAUCE: USB: core: Make port power cycle a seperate helper function
+    - SAUCE: USB: core: Attempt power cycle port when it's in eSS.Disabled state
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] add python depends to ubuntu-regression-suite
+    - SAUCE: selftests: net: tls: remove recv_rcvbuf test
+    - update dkms package versions
+
+  * Miscellaneous upstream changes
+    - [Config] updateconfigs after rebase to 5.5-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 17 Dec 2019 16:02:43 +0100
+
+linux (5.5.0-1.2) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] disable nvidia dkms build
+    - [Config] disable virtualbox dkms build
+    - [Config] disable zfs dkms build
+    - update dropped.txt after rebase to v5.5-rc1
+    - SAUCE: (lockdown) Make get_cert_list() not complain about cert lists that
+      aren't present.
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: (lockdown) s390/ipl: lockdown kernel when booted secure
+    - [Config] Enable lockdown under secure boot
+    - update dkms package versions
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 12 Dec 2019 16:54:41 +0100
+
+linux (5.5.0-0.1) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.5-rc1
+
+   [ Upstream Kernel Changes ]
+
+   * Rebase to v5.5-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Dec 2019 19:03:35 +0100
+
+linux (5.5.0-0.0) focal; urgency=medium
+
+  * Dummy entry.
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Dec 2019 15:14:37 +0100
+
+linux (5.4.0-8.11) focal; urgency=medium
+
+  * focal/linux: 5.4.0-8.9 -proposed tracker (LP: #1855448)
+
+  * update ENA driver for DIMLIB dynamic interrupt moderation (LP: #1853180)
+    - SAUCE: net: ena: fix issues in setting interrupt moderation params in
+      ethtool
+    - SAUCE: net: ena: fix too long default tx interrupt moderation interval
+
+  * Kernel build log filled with "/bin/bash: line 5: warning: command
+    substitution: ignored null byte in input" (LP: #1853843)
+    - [Debian] Fix warnings when checking for modules signatures
+
+  * hwe-edge kernel 5.3.0-23.25 kernel does not boot on Precision 5720 AIO
+    (LP: #1852581)
+    - [Packaging] Fix module signing with older modinfo
+
+  * Fix MST support on Ice Lake (LP: #1854432)
+    - drm/i915: fix port checks for MST support on gen >= 11
+
+  * headphone has noise as not mute on dell machines with alc236/256
+    (LP: #1854401)
+    - SAUCE: ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236
+
+  * [CML-S62] Need enable intel_pmc_core driver patch for Comet lake- S 6+2
+    (LP: #1847450)
+    - SAUCE: platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support
+      to intel_pmc_core driver
+
+  * CVE-2019-14901
+    - SAUCE: mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
+
+  * CVE-2019-14896 // CVE-2019-14897
+    - SAUCE: libertas: Fix two buffer overflows at parsing bss descriptor
+
+  * CVE-2019-14895
+    - SAUCE: mwifiex: fix possible heap overflow in mwifiex_process_country_ie()
+
+  * [CML-S62] Need enable intel_rapl patch support for Comet lake- S 6+2
+    (LP: #1847454)
+    - powercap/intel_rapl: add support for CometLake Mobile
+    - powercap/intel_rapl: add support for Cometlake desktop
+
+  * External microphone can't work on some dell machines with the codec alc256
+    or alc236 (LP: #1853791)
+    - SAUCE: ALSA: hda/realtek - Move some alc256 pintbls to fallback table
+    - SAUCE: ALSA: hda/realtek - Move some alc236 pintbls to fallback table
+
+  * remount of multilower moved pivoted-root overlayfs root, results in I/O
+    errors on some modified files (LP: #1824407)
+    - SAUCE: ovl: fix lookup failure on multi lower squashfs
+
+  * [CML-S62] Need enable turbostat patch support for Comet lake- S 6+2
+    (LP: #1847451)
+    - SAUCE: tools/power turbostat: Add Cometlake support
+
+  * CONFIG_ARCH_ROCKCHIP is not set in ubuntu 18.04 aarch64,arm64 (LP: #1825222)
+    - [Config] Enable ROCKCHIP support for arm64
+
+  * [broadwell-rt286, playback] Since Linux 5.2rc2 audio playback no longer
+    works on Dell Venue 11 Pro 7140 (LP: #1846539)
+    - SAUCE: ASoC: SOF: Intel: Broadwell: clarify mutual exclusion with legacy
+      driver
+
+  * i40e: general protection fault in i40e_config_vf_promiscuous_mode
+    (LP: #1852663)
+    - SAUCE: i40e Fix GPF when deleting VMs
+
+  * libbpf check_abi fails on ppc64el (LP: #1854974)
+    - libbpf: Fix readelf output parsing on powerpc with recent binutils
+
+  * CVE-2019-19050
+    - crypto: user - fix memory leak in crypto_reportstat
+
+  * Make hotplugging docking station to Thunderbolt port more reliable
+    (LP: #1853991)
+    - PCI/PM: Add pcie_wait_for_link_delay()
+    - PCI/PM: Add missing link delays required by the PCIe spec
+
+  * i915: Display flickers (monitor loses signal briefly) during "flickerfree"
+    boot, while showing the BIOS logo on a black background (LP: #1836858)
+    - [Config] FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER=y
+
+  * [CML] New device id's for CMP-H (LP: #1846335)
+    - i2c: i801: Add support for Intel Comet Lake PCH-H
+    - mtd: spi-nor: intel-spi: Add support for Intel Comet Lake-H SPI serial flash
+    - mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs
+
+  * Focal update: v5.4.2 upstream stable release (LP: #1855326)
+    - io_uring: async workers should inherit the user creds
+    - net: separate out the msghdr copy from ___sys_{send,recv}msg()
+    - net: disallow ancillary data for __sys_{send,recv}msg_file()
+    - crypto: inside-secure - Fix stability issue with Macchiatobin
+    - driver core: platform: use the correct callback type for bus_find_device
+    - usb: dwc2: use a longer core rest timeout in dwc2_core_reset()
+    - staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param()
+    - staging: rtl8192e: fix potential use after free
+    - staging: rtl8723bs: Drop ACPI device ids
+    - staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
+    - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
+    - mei: bus: prefix device names on bus with the bus name
+    - mei: me: add comet point V device id
+    - thunderbolt: Power cycle the router if NVM authentication fails
+    - x86/fpu: Don't cache access to fpu_fpregs_owner_ctx
+    - gve: Fix the queue page list allocated pages count
+    - macvlan: schedule bc_work even if error
+    - mdio_bus: don't use managed reset-controller
+    - net: dsa: sja1105: fix sja1105_parse_rgmii_delays()
+    - net: macb: add missed tasklet_kill
+    - net: psample: fix skb_over_panic
+    - net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
+    - openvswitch: fix flow command message size
+    - sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
+    - slip: Fix use-after-free Read in slip_open
+    - sctp: cache netns in sctp_ep_common
+    - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
+    - openvswitch: remove another BUG_ON()
+    - net/tls: take into account that bpf_exec_tx_verdict() may free the record
+    - net/tls: free the record on encryption error
+    - net: skmsg: fix TLS 1.3 crash with full sk_msg
+    - selftests/tls: add a test for fragmented messages
+    - net/tls: remove the dead inplace_crypto code
+    - net/tls: use sg_next() to walk sg entries
+    - selftests: bpf: test_sockmap: handle file creation failures gracefully
+    - selftests: bpf: correct perror strings
+    - tipc: fix link name length check
+    - selftests: pmtu: use -oneline for ip route list cache
+    - r8169: fix jumbo configuration for RTL8168evl
+    - r8169: fix resume on cable plug-in
+    - ext4: add more paranoia checking in ext4_expand_extra_isize handling
+    - Revert "jffs2: Fix possible null-pointer dereferences in
+      jffs2_add_frag_to_fragtree()"
+    - crypto: talitos - Fix build error by selecting LIB_DES
+    - HID: core: check whether Usage Page item is after Usage ID items
+    - platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
+    - platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size
+    - Linux 5.4.2
+
+  * no HDMI video output since GDM greeter after linux-oem-osp1 version
+    5.0.0-1026 (LP: #1852386)
+    - drm/i915: Add new CNL PCH ID seen on a CML platform
+    - SAUCE: drm/i915: Fix detection for a CMP-V PCH
+
+  * Please add patch fixing RK818 ID detection (LP: #1853192)
+    - SAUCE: mfd: rk808: Fix RK818 ID template
+
+  * Raydium Touchscreen on ThinkPad L390 does not work (LP: #1849721)
+    - HID: i2c-hid: fix no irq after reset on raydium 3118
+
+  * Touchpad doesn't work on Dell Inspiron 7000 2-in-1 (LP: #1851901)
+    - Revert "UBUNTU: SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390
+      2-in-1"
+    - lib: devres: add a helper function for ioremap_uc
+    - mfd: intel-lpss: Use devm_ioremap_uc for MMIO
+
+  * Lenovo dock MAC Address pass through doesn't work in Ubuntu  (LP: #1827961)
+    - r8152: Add macpassthru support for ThinkPad Thunderbolt 3 Dock Gen 2
+
+  * Disable unreliable HPET on CFL-H system (LP: #1852216)
+    - SAUCE: x86/intel: Disable HPET on Intel Coffe Lake H platforms
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] Enable virtualbox dkms build
+    - [Config] update annotations to match current configs
+    - SAUCE: Add exfat module to signature inclusion list
+
+  * Miscellaneous upstream changes
+    - Bluetooth: Fix invalid-free in bcsp_close()
+    - ath9k_hw: fix uninitialized variable data
+    - ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe
+    - ath10k: Fix HOST capability QMI incompatibility
+    - ath10k: restore QCA9880-AR1A (v1) detection
+    - Revert "Bluetooth: hci_ll: set operational frequency earlier"
+    - Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues"
+    - md/raid10: prevent access of uninitialized resync_pages offset
+    - x86/insn: Fix awk regexp warnings
+    - x86/speculation: Fix incorrect MDS/TAA mitigation status
+    - x86/speculation: Fix redundant MDS mitigation message
+    - nbd: prevent memory leak
+    - x86/stackframe/32: Repair 32-bit Xen PV
+    - x86/xen/32: Make xen_iret_crit_fixup() independent of frame layout
+    - x86/xen/32: Simplify ring check in xen_iret_crit_fixup()
+    - x86/doublefault/32: Fix stack canaries in the double fault handler
+    - x86/pti/32: Size initial_page_table correctly
+    - x86/cpu_entry_area: Add guard page for entry stack on 32bit
+    - x86/entry/32: Fix IRET exception
+    - x86/entry/32: Use %ss segment where required
+    - x86/entry/32: Move FIXUP_FRAME after pushing %fs in SAVE_ALL
+    - x86/entry/32: Unwind the ESPFIX stack earlier on exception entry
+    - x86/entry/32: Fix NMI vs ESPFIX
+    - selftests/x86/mov_ss_trap: Fix the SYSENTER test
+    - selftests/x86/sigreturn/32: Invalidate DS and ES when abusing the kernel
+    - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make
+      the CPU_ENTRY_AREA_PAGES assert precise
+    - x86/entry/32: Fix FIXUP_ESPFIX_STACK with user CR3
+    - futex: Prevent robust futex exit race
+    - ALSA: usb-audio: Fix NULL dereference at parsing BADD
+    - ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data
+    - media: vivid: Set vid_cap_streaming and vid_out_streaming to true
+    - media: vivid: Fix wrong locking that causes race conditions on streaming
+      stop
+    - media: usbvision: Fix invalid accesses after device disconnect
+    - media: usbvision: Fix races among open, close, and disconnect
+    - cpufreq: Add NULL checks to show() and store() methods of cpufreq
+    - futex: Move futex exit handling into futex code
+    - futex: Replace PF_EXITPIDONE with a state
+    - exit/exec: Seperate mm_release()
+    - futex: Split futex_mm_release() for exit/exec
+    - futex: Set task::futex_state to DEAD right after handling futex exit
+    - futex: Mark the begin of futex exit explicitly
+    - futex: Sanitize exit state handling
+    - futex: Provide state handling for exec() as well
+    - futex: Add mutex around futex exit
+    - futex: Provide distinct return value when owner is exiting
+    - futex: Prevent exit livelock
+    - media: uvcvideo: Fix error path in control parsing failure
+    - media: b2c2-flexcop-usb: add sanity checking
+    - media: cxusb: detect cxusb_ctrl_msg error in query
+    - media: imon: invalid dereference in imon_touch_event
+    - media: mceusb: fix out of bounds read in MCE receiver buffer
+    - ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs
+    - USBIP: add config dependency for SGL_ALLOC
+    - usbip: tools: fix fd leakage in the function of read_attr_usbip_status
+    - usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit()
+    - usb-serial: cp201x: support Mark-10 digital force gauge
+    - USB: chaoskey: fix error case of a timeout
+    - appledisplay: fix error handling in the scheduled work
+    - USB: serial: mos7840: add USB ID to support Moxa UPort 2210
+    - USB: serial: mos7720: fix remote wakeup
+    - USB: serial: mos7840: fix remote wakeup
+    - USB: serial: option: add support for DW5821e with eSIM support
+    - USB: serial: option: add support for Foxconn T77W968 LTE modules
+    - staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
+    - powerpc/book3s64: Fix link stack flush on context switch
+    - KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel
+    - Linux 5.4.1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 06 Dec 2019 15:53:53 -0600
+
+linux (5.4.0-7.8) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/bpf: Comment out BPF_CORE_READ's which cause clang to
+      segfault
+    - Update nvidia-430 to nvidia-440
+    - [Config] Enable nvidia dkms build
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 25 Nov 2019 15:02:30 +0100
+
+linux (5.4.0-6.7) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.4-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 18 Nov 2019 12:08:01 +0100
+
+linux (5.4.0-5.6) focal; urgency=medium
+
+  * refcount underflow and type confusion in shiftfs (LP: #1850867) //
+    CVE-2019-15793
+    - SAUCE: shiftfs: Correct id translation for lower fs operations
+
+  * refcount underflow and type confusion in shiftfs (LP: #1850867) //
+    CVE-2019-15792
+    - SAUCE: shiftfs: prevent type confusion
+
+  * refcount underflow and type confusion in shiftfs (LP: #1850867) //
+    CVE-2019-15791
+    - SAUCE: shiftfs: Fix refcount underflow in btrfs ioctl handling
+
+  * Some EFI systems fail to boot in efi_init() when booted via maas
+    (LP: #1851810)
+    - SAUCE: efi: efi_get_memory_map -- increase map headroom
+
+  * seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test (LP: #1849281)
+    - SAUCE: seccomp: rework define for SECCOMP_USER_NOTIF_FLAG_CONTINUE
+    - SAUCE: seccomp: avoid overflow in implicit constant conversion
+
+  * dkms artifacts may expire from the pool (LP: #1850958)
+    - [Packaging] dkms -- try launchpad librarian for pool downloads
+    - [Packaging] dkms -- dkms-build quieten wget verbiage
+
+  * tsc marked unstable after entered PC10 on Intel CoffeeLake (LP: #1840239)
+    - SAUCE: x86/intel: Disable HPET on Intel Coffe Lake platforms
+    - SAUCE: x86/intel: Disable HPET on Intel Ice Lake platforms
+
+  * shiftfs: prevent exceeding project quotas (LP: #1849483)
+    - SAUCE: shiftfs: drop CAP_SYS_RESOURCE from effective capabilities
+
+  * shiftfs: fix fallocate() (LP: #1849482)
+    - SAUCE: shiftfs: setup correct s_maxbytes limit
+
+  * The alsa hda driver is not loaded due to the missing of PCIID for Comet
+    Lake-S [8086:a3f0] (LP: #1852070)
+    - SAUCE: ALSA: hda: Add Cometlake-S PCI ID
+
+  * Can't adjust brightness on DELL UHD dGPU AIO (LP: #1813877)
+    - SAUCE: platform/x86: dell-uart-backlight: add missing status command
+    - SAUCE: platform/x86: dell-uart-backlight: load driver by scalar status
+    - SAUCE: platform/x86: dell-uart-backlight: add force parameter
+    - SAUCE: platform/x86: dell-uart-backlight: add quirk for old platforms
+
+  * s_iflags overlap prevents unprivileged overlayfs mounts (LP: #1851677)
+    - SAUCE: fs: Move SB_I_NOSUID to the top of s_iflags
+
+  * ubuntu-aufs-modified mmap_region() breaks refcounting in overlayfs/shiftfs
+    error path (LP: #1850994) // CVE-2019-15794
+    - SAUCE: shiftfs: Restore vm_file value when lower fs mmap fails
+    - SAUCE: ovl: Restore vm_file value when lower fs mmap fails
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Convert update-aufs.sh to use aufs5
+    - SAUCE: import aufs driver
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 13 Nov 2019 11:56:35 -0800
+
+linux (5.4.0-4.5) focal; urgency=medium
+
+  * High power consumption using 5.0.0-25-generic (LP: #1840835)
+    - PCI: Add a helper to check Power Resource Requirements _PR3 existence
+    - ALSA: hda: Allow HDA to be runtime suspended when dGPU is not bound to a
+      driver
+    - PCI: Fix missing inline for pci_pr3_present()
+
+  * Fix signing of staging modules in eoan (LP: #1850234)
+    - [Packaging] Leave unsigned modules unsigned after adding .gnu_debuglink
+
+  * [20.04 FEAT] Set Architecture Level (ALS) to z13 (LP: #1837525)
+    - [Config] s390x bump march to z13, with tune to z15
+
+  * Miscellaneous Ubuntu changes
+    - [Debian]: do not skip tests for linux-hwe-edge
+    - update dkms package versions
+    - [Config] re-enable zfs
+    - [Config] rename module virtio_fs to virtiofs
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Nov 2019 15:12:02 +0100
+
+linux (5.4.0-3.4) focal; urgency=medium
+
+  * seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test (LP: #1849281)
+    - SAUCE: seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test
+
+  * cloudimg: no iavf/i40evf module so no network available with SR-IOV enabled
+    cloud (LP: #1848481)
+    - [Packaging] include iavf/i40evf in generic
+
+  * CVE-2019-17666
+    - SAUCE: rtlwifi: Fix potential overflow on P2P code
+
+  * Change Config Option CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE for s390x from yes
+    to no (LP: #1848492)
+    - [Config] Change Config Option CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE for s390x
+      from yes to no
+
+  * Add Intel Comet Lake ethernet support (LP: #1848555)
+    - SAUCE: e1000e: Add support for Comet Lake
+
+  * seccomp: add SECCOMP_USER_NOTIF_FLAG_CONTINUE    (LP: #1847744)
+    - SAUCE: seccomp: add SECCOMP_USER_NOTIF_FLAG_CONTINUE
+    - SAUCE: seccomp: test SECCOMP_USER_NOTIF_FLAG_CONTINUE
+
+  * drm/i915: Fix the issue of "azx_get_response timeout" for hdmi audio on ICL
+    platforms (LP: #1847192)
+    - SAUCE: drm/i915: Fix audio power up sequence for gen10+ display
+    - SAUCE: drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms
+
+  * PM / hibernate: fix potential memory corruption (LP: #1847118)
+    - SAUCE: PM / hibernate: memory_bm_find_bit -- tighten node optimisation
+
+  * [regression] NoNewPrivileges incompatible with Apparmor (LP: #1844186)
+    - SAUCE: apparmor: fix nnp subset test for unconfined
+
+  * overlayfs: allow with shiftfs as underlay (LP: #1846272)
+    - SAUCE: overlayfs: allow with shiftfs as underlay
+
+  * eoan: alsa/sof: Enable SOF_HDA link and codec (LP: #1848490)
+    - [Config] Fix SOF Kconfig options
+
+  * linux won't build when new virtualbox version is present on the archive
+    (LP: #1848788)
+    - [Packaging]: download virtualbox from sources
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations from configs
+    - [Config] updateconfigs after rebase to 5.4-rc5
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 29 Oct 2019 12:01:27 -0500
+
+linux (5.4.0-2.3) eoan; urgency=medium
+
+  * Add installer support for iwlmvm adapters (LP: #1848236)
+    - d-i: Add iwlmvm to nic-modules
+
+  * shiftfs: rework how shiftfs opens files (LP: #1846265)
+    - SAUCE: shiftfs: rework how shiftfs opens files
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.4-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Oct 2019 17:31:26 +0200
+
+linux (5.4.0-1.2) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.4-rc3
+    - [Config] add flexfb, fbtft_device and rio500 to modules.ignore
+    - [Config] amd64: ignore fbtft and all dependent modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Oct 2019 19:48:52 +0200
+
+linux (5.4.0-0.1) eoan; urgency=medium
+
+  * Enable the Dragonboards out of Eoan/master arm64 kernel (LP: #1846704)
+    - [Packaging] arm64: snapdragon: introduce a snapdragon flavour
+    - [Packaging] arm64: snapdragon: switch kernel format to Image
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8916=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8994=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8996=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8998=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_RPMH=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_BAM_DMA=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_HIDMA_MGMT=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_HIDMA=y
+    - [Config] arm64: snapdragon: CONFIG_COMMON_CLK_QCOM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_RPMH=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8916=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8994=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_MMCC_8996=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8998=y
+    - [Config] arm64: snapdragon: CONFIG_HWSPINLOCK_QCOM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_APCS_IPC=y
+    - [Config] arm64: snapdragon: CONFIG_RPMSG_QCOM_GLINK_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_GENI_SE=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMEM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMD_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMP2P=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMSM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_QFPROM=y
+    - [Config] arm64: snapdragon: CONFIG_SERIAL_QCOM_GENI=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_TSENS=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_SMD_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_SMD_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_RPMSG_QCOM_SMD=y
+    - [Config] arm64: snapdragon: CONFIG_MFD_QCOM_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_SCSI_UFSHCD=y
+    - [Config] arm64: snapdragon: CONFIG_SCSI_UFSHCD_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_SCSI_UFS_HISI=y
+    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI=y
+    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI_PLTFM=y
+    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI_MSM=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_SPMI=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_USB_HS=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_QMP=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_UFS=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_USB_HSIC=y
+    - [Config] arm64: snapdragon: CONFIG_USB_CHIPIDEA_OF=y
+    - [Config] arm64: snapdragon: CONFIG_USB_EHCI_HCD_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_EXTCON_USB_GPIO=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_FIXED_VOLTAGE=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_GPIO=y
+    - [Config] arm64: snapdragon: CONFIG_USB_HSIC_USB3503=y
+    - [Config] arm64: snapdragon: CONFIG_USB_NET_DRIVERS=y
+    - [Config] arm64: snapdragon: CONFIG_USB_OTG=y
+    - [Config] arm64: snapdragon: CONFIG_USB_XHCI_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_USB_OHCI_HCD_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_USB_MUSB_HDRC=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3_PCI=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3_OF_SIMPLE=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3_QCOM=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_PWM=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_A53PLL=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_APCS_MSM8916=y
+    - [Config] arm64: snapdragon: CONFIG_NLS_ISO8859_1=y
+    - [Config] arm64: snapdragon: CONFIG_USB_USBNET=y
+    - [Config] arm64: snapdragon: CONFIG_CRYPTO_DEV_QCOM_RNG=y
+    - [Config] arm64: snapdragon: CONFIG_POWER_RESET_QCOM_PON=y
+    - [Config] arm64: snapdragon: CONFIG_INPUT_PM8941_PWRKEY=y
+    - [Config] arm64: snapdragon: CONFIG_KEYBOARD_GPIO=y
+    - [Config] arm64: snapdragon: CONFIG_RTC_DRV_PM8XXX=y
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.4-rc2
+    - SAUCE: (lockdown) Make get_cert_list() not complain about cert lists that
+      aren't present.
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: (lockdown) s390/ipl: lockdown kernel when booted secure
+    - [Config] Enable lockdown under secure boot
+    - SAUCE: import aufs driver
+    - SAUCE: aufs: rwsem owner changed to atmoic_long_t in 5.3
+    - SAUCE: aufs: add "WITH Linux-syscall-note" to SPDX tag of uapi headers
+    - [Config] enable aufs
+    - update dkms package versions
+    - [Config] disable zfs
+    - [Config] disable nvidia dkms build
+    - [Config] disable virtualbox dkms build
+    - [Debian] Generate stub reconstruct for -rc kernels
+    - Revert "UBUNTU: SAUCE: (namespace) block_dev: Forbid unprivileged mounting
+      when device is opened for writing"
+    - Revert "UBUNTU: SAUCE: (namespace) ext4: Add module parameter to enable user
+      namespace mounts"
+    - Revert "UBUNTU: SAUCE: (namespace) ext4: Add support for unprivileged mounts
+      from user namespaces"
+    - Revert "UBUNTU: SAUCE: (namespace) mtd: Check permissions towards mtd block
+      device inode when mounting"
+    - Revert "UBUNTU: SAUCE: (namespace) block_dev: Check permissions towards
+      block device inode when mounting"
+    - Revert "UBUNTU: SAUCE: (namespace) block_dev: Support checking inode
+      permissions in lookup_bdev()"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 11 Oct 2019 16:42:41 -0500
+
+linux (5.4.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 08 Oct 2019 09:59:00 -0500
+
+linux (5.3.0-17.18) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-17.18 -proposed tracker (LP: #1846641)
+
+  * CVE-2019-17056
+    - nfc: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17055
+    - mISDN: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17054
+    - appletalk: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17053
+    - ieee802154: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17052
+    - ax25: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-15098
+    - ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()
+
+  * xHCI on AMD Stoney Ridge cannot detect USB 2.0 or 1.1 devices.
+    (LP: #1846470)
+    - x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect
+
+  * Re-enable linux-libc-dev build on i386 (LP: #1846508)
+    - [Packaging] Build only linux-libc-dev for i386
+    - [Debian] final-checks -- ignore archtictures with no binaries
+
+  * arm64: loop on boot after installing linux-generic-hwe-18.04-edge/bionic-
+    proposed (LP: #1845820)
+    - [Config] Disable CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT
+
+  * Revert ESE DASD discard support (LP: #1846219)
+    - SAUCE: Revert "s390/dasd: Add discard support for ESE volumes"
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 03 Oct 2019 16:57:05 -0500
+
+linux (5.3.0-16.17) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-16.17 -proposed tracker (LP: #1846204)
+
+  * zfs fails to build on s390x  with debug symbols enabled (LP: #1846143)
+    - SAUCE: s390: Mark atomic const ops always inline
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 01 Oct 2019 07:46:43 -0500
+
+linux (5.3.0-15.16) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-15.16 -proposed tracker (LP: #1845987)
+
+  * Drop i386 build for 19.10 (LP: #1845714)
+    - [Packaging] Remove x32 arch references from control files
+    - [Debian] final-checks -- Get arch list from debian/control
+
+  * ZFS kernel modules lack debug symbols (LP: #1840704)
+    - [Debian] Fix conditional for setting zfs debug package path
+
+  * Use pyhon3-sphinx instead of python-sphinx for building html docs
+    (LP: #1845808)
+    - [Packaging] Update sphinx build dependencies to python3 packages
+
+  * Kernel panic with 19.10 beta image (LP: #1845454)
+    - efi/tpm: Don't access event->count when it isn't mapped.
+    - efi/tpm: don't traverse an event log with no events
+    - efi/tpm: only set efi_tpm_final_log_size after successful event log parsing
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 30 Sep 2019 11:57:20 -0500
+
+linux (5.3.0-14.15) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-14.15 -proposed tracker (LP: #1845728)
+
+  * Drop i386 build for 19.10 (LP: #1845714)
+    - [Debian] Remove support for producing i386 kernels
+    - [Debian] Don't use CROSS_COMPILE for i386 configs
+
+  * udevadm trigger will fail when trying to add /sys/devices/vio/
+    (LP: #1845572)
+    - SAUCE: powerpc/vio: drop bus_type from parent device
+
+  * Trying to online dasd drive results in invalid input/output from the kernel
+    on z/VM (LP: #1845323)
+    - SAUCE: s390/dasd: Fix error handling during online processing
+
+  * intel-lpss driver conflicts with write-combining MTRR region (LP: #1845584)
+    - SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390 2-in-1
+
+  * Support Hi1620 zip hw accelerator (LP: #1845355)
+    - [Config] Enable HiSilicon QM/ZIP as modules
+    - crypto: hisilicon - add queue management driver for HiSilicon QM module
+    - crypto: hisilicon - add hardware SGL support
+    - crypto: hisilicon - add HiSilicon ZIP accelerator support
+    - crypto: hisilicon - add SRIOV support for ZIP
+    - Documentation: Add debugfs doc for hisi_zip
+    - crypto: hisilicon - add debugfs for ZIP and QM
+    - MAINTAINERS: add maintainer for HiSilicon QM and ZIP controller driver
+    - crypto: hisilicon - fix kbuild warnings
+    - crypto: hisilicon - add dependency for CRYPTO_DEV_HISI_ZIP
+    - crypto: hisilicon - init curr_sgl_dma to fix compile warning
+    - crypto: hisilicon - add missing single_release
+    - crypto: hisilicon - fix error handle in hisi_zip_create_req_q
+    - crypto: hisilicon - Fix warning on printing %p with dma_addr_t
+    - crypto: hisilicon - Fix return value check in hisi_zip_acompress()
+    - crypto: hisilicon - avoid unused function warning
+
+  * SafeSetID LSM should be built but disabled by default (LP: #1845391)
+    - LSM: SafeSetID: Stop releasing uninitialized ruleset
+    - [Config] Build SafeSetID LSM but don't enable it by default
+
+  * CONFIG_LSM should not specify loadpin since it is not built (LP: #1845383)
+    - [Config] loadpin shouldn't be in CONFIG_LSM
+
+  * Add new pci-id's for CML-S, ICL (LP: #1845317)
+    - drm/i915/icl: Add missing device ID
+    - drm/i915/cml: Add Missing PCI IDs
+
+  * Thunderbolt support for ICL (LP: #1844680)
+    - thunderbolt: Correct path indices for PCIe tunnel
+    - thunderbolt: Move NVM upgrade support flag to struct icm
+    - thunderbolt: Use 32-bit writes when writing ring producer/consumer
+    - thunderbolt: Do not fail adding switch if some port is not implemented
+    - thunderbolt: Hide switch attributes that are not set
+    - thunderbolt: Expose active parts of NVM even if upgrade is not supported
+    - thunderbolt: Add support for Intel Ice Lake
+    - ACPI / property: Add two new Thunderbolt property GUIDs to the list
+
+  * Ubuntu 19.10 -  Additional PCI patch and fix (LP: #1844668)
+    - s390/pci: fix MSI message data
+
+  * Enhanced Hardware Support - Finalize Naming (LP: #1842774)
+    - s390: add support for IBM z15 machines
+    - [Config] CONFIG_MARCH_Z15=n, CONFIG_TUNE_Z15=n
+
+  * Eoan update: v5.3.1 upstream stable release (LP: #1845642)
+    - USB: usbcore: Fix slab-out-of-bounds bug during device reset
+    - media: tm6000: double free if usb disconnect while streaming
+    - phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
+    - ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit
+    - net/sched: fix race between deactivation and dequeue for NOLOCK qdisc
+    - net_sched: let qdisc_put() accept NULL pointer
+    - udp: correct reuseport selection with connected sockets
+    - xen-netfront: do not assume sk_buff_head list is empty in error handling
+    - net: dsa: Fix load order between DSA drivers and taggers
+    - net: stmmac: Hold rtnl lock in suspend/resume callbacks
+    - KVM: coalesced_mmio: add bounds checking
+    - Documentation: sphinx: Add missing comma to list of strings
+    - firmware: google: check if size is valid when decoding VPD data
+    - serial: sprd: correct the wrong sequence of arguments
+    - tty/serial: atmel: reschedule TX after RX was started
+    - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
+    - Revert "arm64: Remove unnecessary ISBs from set_{pte,pmd,pud}"
+    - ovl: fix regression caused by overlapping layers detection
+    - phy: qcom-qmp: Correct ready status, again
+    - floppy: fix usercopy direction
+    - media: technisat-usb2: break out of loop at end of buffer
+    - Linux 5.3.1
+
+  * ZFS kernel modules lack debug symbols (LP: #1840704)
+    - [Debian]: Remove hardcoded $(pkgdir) in debug symbols handling
+    - [Debian]: Handle debug symbols for modules in extras too
+    - [Debian]: Check/link modules with debug symbols after DKMS modules
+    - [Debian]: Warn about modules without debug symbols
+    - [Debian]: dkms-build: new parameter for debug package directory
+    - [Debian]: dkms-build: zfs: support for debug symbols
+    - [Debian]: dkms-build: Avoid executing post-processor scripts twice
+    - [Debian]: dkms-build: Move zfs special-casing into configure script
+
+  * /proc/self/maps paths missing on live session (was vlc won't start; eoan
+    19.10 & bionic 18.04 ubuntu/lubuntu/kubuntu/xubuntu/ubuntu-mate dailies)
+    (LP: #1842382)
+    - SAUCE: Revert "UBUNTU: SAUCE: shiftfs: enable overlayfs on shiftfs"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 27 Sep 2019 16:08:06 -0500
+
+linux (5.3.0-13.14) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-13.14 -proposed tracker (LP: #1845105)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Remove binutils-dev build dependency
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 23 Sep 2019 19:26:43 -0500
+
+linux (5.3.0-12.13) eoan; urgency=medium
+
+  * Change kernel compression method to improve boot speed (LP: #1840934)
+    - [Packaging] Add lz4 build dependency for s390x
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Remove spl and zfs source
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 17 Sep 2019 13:36:26 +0200
+
+linux (5.3.0-11.12) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-11.12 -proposed tracker (LP: #1844144)
+
+  *  Suspend to RAM(S3) does not wake up for latest megaraid and mpt3sas
+    adapters(SAS3.5 onwards) (LP: #1838751)
+    - PCI: Restore Resizable BAR size bits correctly for 1MB BARs
+
+  * s390/setup: Actually init kernel lock down (LP: #1843961)
+    - SAUCE: (lockdown) s390/setup: Actually init kernel lock down
+
+  * cherrypick has_sipl fix (LP: #1843960)
+    - SAUCE: s390/sclp: Fix bit checked for has_sipl
+
+  * Change kernel compression method to improve boot speed (LP: #1840934)
+    - [Config]: Switch kernel compression from LZO to LZ4 on s390x
+
+  * Installation fails on eoan/PowerVM : missing /dev/nvram (LP: #1837726)
+    - [Config] CONFIG_NVRAM=y for ppc64el
+
+  * Miscellaneous Ubuntu changes
+    - [Config]: remove nvram from ppc64el modules ABI
+    - [Config] Update annotations for recent config changes
+    - SAUCE: sched: Add __ASSEMBLY__ guards around struct clone_args
+    - SAUCE: i2c: qcom-geni: Disable DMA processing on the Lenovo Yoga C630
+    - SAUCE: arm64: dts: qcom: Add Lenovo Yoga C630
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 16 Sep 2019 16:18:27 +0200
+
+linux (5.3.0-10.11) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-10.11 -proposed tracker (LP: #1843232)
+
+  * No sound inputs from the external microphone and headset on a Dell machine
+    (LP: #1842265)
+    - SAUCE: ALSA: hda - Expand pin_match function to match upcoming new tbls
+    - SAUCE: ALSA: hda - Define a fallback_pin_fixup_tbl for alc269 family
+
+  * Horizontal corrupted line at top of screen caused by framebuffer compression
+    (LP: #1840236)
+    - SAUCE: drm/i915/fbc: disable framebuffer compression on IceLake
+
+  * Add bpftool to linux-tools-common (LP: #1774815)
+    - [Debian] package bpftool in linux-tools-common
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc8
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 09 Sep 2019 10:00:41 +0200
+
+linux (5.3.0-9.10) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-9.10 -proposed tracker (LP: #1842393)
+
+  * shiftfs: mark kmem_cache as reclaimable (LP: #1842059)
+    - SAUCE: shiftfs: mark slab objects SLAB_RECLAIM_ACCOUNT
+
+  * shiftfs: drop entries from cache on unlink (LP: #1841977)
+    - SAUCE: shiftfs: fix buggy unlink logic
+
+  * Fix touchpad IRQ storm after S3 (LP: #1841396)
+    - pinctrl: intel: remap the pin number to gpio offset for irq enabled pin
+
+  * Please include DTBs for arm64 laptops (LP: #1842050)
+    - arm64: dts: qcom: Add Lenovo Miix 630
+    - arm64: dts: qcom: Add HP Envy x2
+    - arm64: dts: qcom: Add Asus NovaGo TP370QL
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import aufs driver
+    - [Packaging]: ignore vbox modules when vbox is disabled
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 03 Sep 2019 10:27:33 +0200
+
+linux (5.3.0-8.9) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+
+  * Change kernel compression method to improve boot speed (LP: #1840934)
+    - [Config] change kernel compression method to improve boot speed
+    - [Packaging] add build dependencies for compression algorithms
+
+  * realtek r8822be kernel module fails after update to linux kernel-headers
+    5.0.0-21 (LP: #1838133)
+    - rtw88: Fix misuse of GENMASK macro
+    - rtw88: pci: Rearrange the memory usage for skb in RX ISR
+    - rtw88: pci: Use DMA sync instead of remapping in RX ISR
+    - rtw88: debug: dump tx power indexes in use
+    - rtw88: use txpwr_lmt_cfg_pair struct, not arrays
+    - rtw88: pci: remove set but not used variable 'ip_sel'
+    - rtw88: allow c2h operation in irq context
+    - rtw88: enclose c2h cmd handle with mutex
+    - rtw88: add BT co-existence support
+    - SAUCE: rtw88: pci: enable MSI interrupt
+
+  * VIMC module not available (CONFIG_VIDEO_VIMC not set) (LP: #1831482)
+    - [Config] Enable VIMC module
+
+  * Goodix touchpad may drop first input event (LP: #1840075)
+    - Revert "UBUNTU: SAUCE: i2c: designware: add G3 3590 into i2c quirk"
+    - Revert "UBUNTU: SAUCE: i2c: designware: add Inpiron 7591 into i2c quirk"
+    - Revert "UBUNTU: SAUCE: i2c: designware: add Inpiron/Vostro 7590 into i2c
+      quirk"
+    - Revert "UBUNTU: SAUCE: i2c: designware: Add disable runtime pm quirk"
+    - mfd: intel-lpss: Remove D3cold delay
+
+  * Include Sunix serial/parallel driver (LP: #1826716)
+    - serial: 8250_pci: Add support for Sunix serial boards
+    - parport: parport_serial: Add support for Sunix Multi I/O boards
+
+  * enable lockdown on s390x when Secure IPL is performed (LP: #1839622)
+    - SAUCE: (lockdown) s390/ipl: lockdown kernel when booted secure
+    - Ubuntu: [Config] Enable CONFIG_LOCK_DOWN_KERNEL on s390x.
+
+  * UBUNTU: SAUCE: shiftfs: pass correct point down (LP: #1837231)
+    - SAUCE: shiftfs: pass correct point down
+
+  * shiftfs: add O_DIRECT support (LP: #1837223)
+    - SAUCE: shiftfs: add O_DIRECT support
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable secureboot signing on s390x
+    - [Config] CONFIG_TEST_BLACKHOLE_DEV=m
+    - SAUCE: selftests: fib_tests: assign address to dummy1 for rp_filter tests
+    - [Debian] disable dkms builds for autopktest rebuilds
+    - update dkms package versions
+    - [Config] updateconfigs after v5.3-rc6 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 26 Aug 2019 10:09:42 +0200
+
+linux (5.3.0-7.8) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after v5.3-rc5 rebase
+    - remove missing module after updateconfigs
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 19 Aug 2019 15:31:24 +0200
+
+linux (5.3.0-6.7) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/bpf: prevent headers to be compiled as C code
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 14 Aug 2019 13:25:01 -0500
+
+linux (5.3.0-5.6) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] enable zfs build
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 13 Aug 2019 09:16:06 -0500
+
+linux (5.3.0-4.5) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+    - [Packaging] update helper scripts
+
+  * bcache: bch_allocator_thread(): hung task timeout (LP: #1784665) // Tight
+    timeout for bcache removal causes spurious failures (LP: #1796292)
+    - SAUCE: bcache: fix deadlock in bcache_allocator
+
+  * shiftfs: allow overlayfs (LP: #1838677)
+    - SAUCE: shiftfs: enable overlayfs on shiftfs
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "kbuild: modpost: do not parse unnecessary rules for vmlinux
+      modpost"
+    - update dkms package versions
+    - enable nvidia dkms build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 12 Aug 2019 10:41:27 -0500
+
+linux (5.3.0-3.4) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - SAUCE: aufs: add "WITH Linux-syscall-note" to SPDX tag of uapi headers
+    - [Config] add mux-* to modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 05 Aug 2019 18:17:09 +0200
+
+linux (5.3.0-2.3) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] add build dependincy on fontconfig
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jul 2019 12:18:46 -0400
+
+linux (5.3.0-1.2) eoan; urgency=medium
+
+  * System does not auto detect disconnection of external monitor (LP: #1835001)
+    - SAUCE: drm/i915: Add support for retrying hotplug
+    - SAUCE: drm/i915: Enable hotplug retry
+
+  * Please enable CONFIG_SCSI_UFS_QCOM as a module on arm64 (LP: #1837332)
+    - [Config] Enable CONFIG_SCSI_UFS_QCOM as a module on arm64.
+
+  * Add arm64 CONFIG_ARCH_MESON=y and related configs Edit (LP: #1820530)
+    - [Config] enable ARCH_MESON
+    - remove missing module
+    - [Config] update annotations after enabling ARCH_MESON for arm64
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: KVM: PPC: comment implicit fallthrough
+    - update dkms package versions
+    - [Config] enable vbox dkms build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 28 Jul 2019 23:10:16 -0400
+
+linux (5.3.0-0.1) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and
+      KEXEC_SIG_FORCE
+    - SAUCE: (efi-lockdown) kexec_file: Restrict at runtime if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) lockdown: Print current->comm in restriction messages
+    - SAUCE: (efi-lockdown) kexec: Allow kexec_file() with appropriate IMA policy
+      when locked down
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) KEYS: Make use of platform keyring for module
+      signature verify
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) furter KEXEC_VERIFY_SIG -> KEXEC_SIG updates
+    - SAUCE: (efi-lockdown) arm64: add kernel config option to lock down when in
+      Secure Boot mode
+    - SAUCE: import aufs driver
+    - SAUCE: aufs: rwsem owner changed to atmoic_long_t in 5.3
+    - [Config] disable zfs dkms build
+    - [Config] disable nvidia dkms build
+    - [Config] disable vbox dkms build
+    - SAUCE: perf diff: use llabs for s64 vaules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 23 Jul 2019 21:45:44 -0500
+
+linux (5.3.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jul 2019 10:19:04 -0500
+
+linux (5.2.0-9.10) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * input/mouse: alps trackpoint-only device doesn't work (LP: #1836752)
+    - SAUCE: Input: alps - don't handle ALPS cs19 trackpoint-only device
+    - SAUCE: Input: alps - fix a mismatch between a condition check and its
+      comment
+
+  * System does not auto detect disconnection of external monitor (LP: #1835001)
+    - SAUCE: drm/i915: Add support for retrying hotplug
+    - SAUCE: drm/i915: Enable hotplug retry
+
+  * alsa/hdmi: add icelake hdmi audio support for a Dell machine (LP: #1836916)
+    - SAUCE: ALSA: hda/hdmi - Remove duplicated define
+    - SAUCE: ALSA: hda/hdmi - Fix i915 reverse port/pin mapping
+
+  * First click on Goodix touchpad doesn't be recognized after runtime suspended
+    (LP: #1836836)
+    - SAUCE: i2c: designware: add G3 3590 into i2c quirk
+
+  * ixgbe{vf} - Physical Function gets IRQ when VF checks link state
+    (LP: #1836760)
+    - ixgbevf: Use cached link state instead of re-reading the value for ethtool
+
+  * Doing multiple squashfs (and other loop?) mounts in parallel breaks
+    (LP: #1836914)
+    - SAUCE: Revert "loop: Don't change loop device under exclusive opener"
+
+  * hibmc-drm Causes Unreadable Display for Huawei amd64 Servers (LP: #1762940)
+    - SAUCE: Make CONFIG_DRM_HISI_HIBMC depend on ARM64
+    - [Config] Set CONFIG_DRM_HISI_HIBMC to arm64 only
+    - [Config] add hibmc-drm to modules.ignore
+
+  * hda/realtek: can't detect external mic on a Dell machine (LP: #1836755)
+    - ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine
+
+  * Enable Armada SOCs and MVPP2 NIC driver for disco/generic arm64
+    (LP: #1835054)
+    - [Config] Enable Armada SOCs and MVPP2 NIC driver for disco/generic arm64
+
+  * Unhide Nvidia HDA audio controller (LP: #1836308)
+    - PCI: Enable NVIDIA HDA controllers
+
+  * Intel ethernet I219 may wrongly detect connection speed as 10Mbps
+    (LP: #1836177)
+    - e1000e: Make watchdog use delayed work
+
+  * Sometimes touchpad(goodix) can't use tap function (LP: #1836020)
+    - SAUCE: i2c: designware: add Inpiron/Vostro 7590 into i2c quirk
+    - SAUCE: i2c: designware: add Inpiron 7591 into i2c quirk
+
+  * Intel ethernet I219 has slow RX speed (LP: #1836152)
+    - e1000e: add workaround for possible stalled packet
+    - e1000e: disable force K1-off feature
+
+  * bcache: risk of data loss on I/O errors in backing or caching devices
+    (LP: #1829563)
+    - Revert "bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()"
+
+  * bnx2x driver causes 100% CPU load (LP: #1832082)
+    - bnx2x: Prevent ptp_task to be rescheduled indefinitely
+
+  * fcf-protection=none patch with new version
+    - Revert "UBUNTU: SAUCE: kbuild: add -fcf-protection=none to retpoline flags"
+    - SAUCE: kbuild: add -fcf-protection=none when using retpoline flags
+
+  * CVE-2019-12614
+    - powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property()
+
+  * Eoan update: v5.2.1 upstream stable release (LP: #1836622)
+    - crypto: lrw - use correct alignmask
+    - crypto: talitos - rename alternative AEAD algos.
+    - fscrypt: don't set policy for a dead directory
+    - udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
+    - media: stv0297: fix frequency range limit
+    - ALSA: usb-audio: Fix parse of UAC2 Extension Units
+    - ALSA: hda/realtek - Headphone Mic can't record after S3
+    - tpm: Actually fail on TPM errors during "get random"
+    - tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations
+    - block: fix .bi_size overflow
+    - block, bfq: NULL out the bic when it's no longer valid
+    - perf intel-pt: Fix itrace defaults for perf script
+    - perf auxtrace: Fix itrace defaults for perf script
+    - perf intel-pt: Fix itrace defaults for perf script intel-pt documentation
+    - perf pmu: Fix uncore PMU alias list for ARM64
+    - perf thread-stack: Fix thread stack return from kernel for kernel-only case
+    - perf header: Assign proper ff->ph in perf_event__synthesize_features()
+    - x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
+    - x86/tls: Fix possible spectre-v1 in do_get_thread_area()
+    - Documentation: Add section about CPU vulnerabilities for Spectre
+    - Documentation/admin: Remove the vsyscall=native documentation
+    - mwifiex: Don't abort on small, spec-compliant vendor IEs
+    - USB: serial: ftdi_sio: add ID for isodebug v1
+    - USB: serial: option: add support for GosunCn ME3630 RNDIS mode
+    - Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
+    - p54usb: Fix race between disconnect and firmware loading
+    - usb: gadget: f_fs: data_len used before properly set
+    - usb: gadget: ether: Fix race between gether_disconnect and rx_submit
+    - usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset()
+    - usb: renesas_usbhs: add a workaround for a race condition of workqueue
+    - drivers/usb/typec/tps6598x.c: fix portinfo width
+    - drivers/usb/typec/tps6598x.c: fix 4CC cmd write
+    - p54: fix crash during initialization
+    - staging: comedi: dt282x: fix a null pointer deref on interrupt
+    - staging: wilc1000: fix error path cleanup in wilc_wlan_initialize()
+    - staging: bcm2835-camera: Restore return behavior of ctrl_set_bitrate()
+    - staging: comedi: amplc_pci230: fix null pointer deref on interrupt
+    - staging: mt7621-pci: fix PCIE_FTS_NUM_LO macro
+    - HID: Add another Primax PIXART OEM mouse quirk
+    - lkdtm: support llvm-objcopy
+    - binder: fix memory leak in error path
+    - binder: return errors from buffer copy functions
+    - iio: adc: stm32-adc: add missing vdda-supply
+    - coresight: Potential uninitialized variable in probe()
+    - coresight: etb10: Do not call smp_processor_id from preemptible
+    - coresight: tmc-etr: Do not call smp_processor_id() from preemptible
+    - coresight: tmc-etr: alloc_perf_buf: Do not call smp_processor_id from
+      preemptible
+    - coresight: tmc-etf: Do not call smp_processor_id from preemptible
+    - carl9170: fix misuse of device driver API
+    - Revert "x86/build: Move _etext to actual end of .text"
+    - VMCI: Fix integer overflow in VMCI handle arrays
+    - staging: vchiq_2835_arm: revert "quit using custom down_interruptible()"
+    - staging: vchiq: make wait events interruptible
+    - staging: vchiq: revert "switch to wait_for_completion_killable"
+    - staging: fsl-dpaa2/ethsw: fix memory leak of switchdev_work
+    - staging: bcm2835-camera: Replace spinlock protecting context_map with mutex
+    - staging: bcm2835-camera: Ensure all buffers are returned on disable
+    - staging: bcm2835-camera: Remove check of the number of buffers supplied
+    - staging: bcm2835-camera: Handle empty EOS buffers whilst streaming
+    - staging: rtl8712: reduce stack usage, again
+    - Linux 5.2.1
+    - [Config] updateconfigs after v5.2.1 stable update
+
+  * fcf-protection=none patch with upstream version
+    - Revert "UBUNTU: SAUCE: add -fcf-protection=none to retpoline flags"
+    - SAUCE: kbuild: add -fcf-protection=none to retpoline flags
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/ftrace: avoid failure when trying to probe a notrace
+      function
+    - SAUCE: selftests/powerpc/ptrace: fix build failure
+    - update dkms package versions
+    - [Packaging] add zlua to zfs-modules.ignore
+    - update dkms package versions
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 19 Jul 2019 15:04:45 -0500
+
+linux (5.2.0-8.9) eoan; urgency=medium
+
+  * linux: 5.2.0-8.9 -proposed tracker (LP: #1835700)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] replace zfs and spl build with zfs 0.8.1-1ubuntu1
+    - SAUCE: test_bpf: remove expected fail for Ctx heavy transformations test on
+      s390
+    - SAUCE: add -fcf-protection=none to retpoline flags
+    - SAUCE: usbip: ensure strings copied using strncpy are null-terminated
+    - SAUCE: usbip: add -Wno-address-of-packed-member to EXTRA_CFLAGS
+    - SAUCE: perf jvmti: ensure strncpy result is null-terminated
+    - update dkms package versions
+    - add removed zfs modules to modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 08 Jul 2019 07:13:41 -0500
+
+linux (5.2.0-7.8) eoan; urgency=medium
+
+  * Kernel panic upon resetting ixgbe SR-IOV VFIO virtual function using 5.0
+    kernel (LP: #1829652)
+    - SAUCE: ixgbe: Avoid NULL pointer dereference with VF on non-IPsec hw
+
+  * Hi1620 driver updates from upstream 5.2 merge window (LP: #1830815)
+    - net: hns3: initialize CPU reverse mapping
+    - net: hns3: refine the flow director handle
+    - net: hns3: add aRFS support for PF
+    - net: hns3: fix for FEC configuration
+    - RDMA/hns: Remove unnecessary print message in aeq
+    - RDMA/hns: Update CQE specifications
+    - RDMA/hns: Move spin_lock_irqsave to the correct place
+    - RDMA/hns: Remove jiffies operation in disable interrupt context
+    - RDMA/hns: Replace magic numbers with #defines
+    - net: hns3: fix compile warning without CONFIG_RFS_ACCEL
+    - net: hns3: fix for HNS3_RXD_GRO_SIZE_M macro
+    - net: hns3: add support for dump firmware statistics by debugfs
+    - net: hns3: use HCLGE_STATE_NIC_REGISTERED to indicate PF NIC client has
+      registered
+    - net: hns3: use HCLGE_STATE_ROCE_REGISTERED to indicate PF ROCE client has
+      registered
+    - net: hns3: use HCLGEVF_STATE_NIC_REGISTERED to indicate VF NIC client has
+      registered
+    - net: hns3: modify hclge_init_client_instance()
+    - net: hns3: modify hclgevf_init_client_instance()
+    - net: hns3: add handshake with hardware while doing reset
+    - net: hns3: stop schedule reset service while unloading driver
+    - net: hns3: adjust hns3_uninit_phy()'s location in the hns3_client_uninit()
+    - net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector
+    - RDMA/hns: Bugfix for posting multiple srq work request
+    - net: hns3: remove redundant core reset
+    - net: hns3: don't configure new VLAN ID into VF VLAN table when it's full
+    - net: hns3: fix VLAN filter restore issue after reset
+    - net: hns3: set the port shaper according to MAC speed
+    - net: hns3: add a check to pointer in error_detected and slot_reset
+    - net: hns3: set ops to null when unregister ad_dev
+    - net: hns3: add handling of two bits in MAC tunnel interrupts
+    - net: hns3: remove setting bit of reset_requests when handling mac tunnel
+      interrupts
+    - net: hns3: add opcode about query and clear RAS & MSI-X to special opcode
+    - net: hns3: delay and separate enabling of NIC and ROCE HW errors
+    - RDMA/hns: fix inverted logic of readl read and shift
+    - RDMA/hns: Bugfix for filling the sge of srq
+    - net: hns3: log detail error info of ROCEE ECC and AXI errors
+    - net: hns3: fix wrong size of mailbox responding data
+    - net: hns3: make HW GRO handling compliant with SW GRO
+    - net: hns3: replace numa_node_id with numa_mem_id for buffer reusing
+    - net: hns3: refactor hns3_get_new_int_gl function
+    - net: hns3: trigger VF reset if a VF has an over_8bd_nfe_err
+    - net: hns3: delete the redundant user NIC codes
+    - net: hns3: small changes for magic numbers
+    - net: hns3: use macros instead of magic numbers
+    - net: hns3: refactor PF/VF RSS hash key configuration
+    - net: hns3: some modifications to simplify and optimize code
+    - net: hns3: fix some coding style issues
+    - net: hns3: delay setting of reset level for hw errors until slot_reset is
+      called
+    - net: hns3: fix avoid unnecessary resetting for the H/W errors which do not
+      require reset
+    - net: hns3: process H/W errors occurred before HNS dev initialization
+    - net: hns3: add recovery for the H/W errors occurred before the HNS dev
+      initialization
+    - net: hns3: some changes of MSI-X bits in PPU(RCB)
+    - net: hns3: extract handling of mpf/pf msi-x errors into functions
+    - net: hns3: clear restting state when initializing HW device
+    - net: hns3: free irq when exit from abnormal branch
+    - net: hns3: fix for dereferencing before null checking
+    - net: hns3: fix for skb leak when doing selftest
+    - net: hns3: delay ring buffer clearing during reset
+    - net: hns3: some variable modification
+    - net: hns3: fix dereference of ae_dev before it is null checked
+    - scsi: hisi_sas: Delete PHY timers when rmmod or probe failed
+    - scsi: hisi_sas: Fix the issue of argument mismatch of printing ecc errors
+    - scsi: hisi_sas: Reduce HISI_SAS_SGE_PAGE_CNT in size
+    - scsi: hisi_sas: Change the type of some numbers to unsigned
+    - scsi: hisi_sas: Ignore the error code between phy down to phy up
+    - scsi: hisi_sas: Disable stash for v3 hw
+    - net: hns3: Add missing newline at end of file
+    - RDMa/hns: Don't stuck in endless timeout loop
+
+  * Sometimes touchpad automatically trigger double click (LP: #1833484)
+    - SAUCE: i2c: designware: Add disable runtime pm quirk
+
+  * Add pointstick support on HP ZBook 17 G5 (LP: #1833387)
+    - Revert "HID: multitouch: Support ALPS PTP stick with pid 0x120A"
+
+  * depmod may prefer unsigned l-r-m nvidia modules to signed modules
+    (LP: #1834479)
+    - [Packaging] dkms-build--nvidia-N -- clean up unsigned ko files
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/powerpc: disable signal_fuzzer test
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 01 Jul 2019 07:22:18 -0500
+
+linux (5.2.0-6.7) eoan; urgency=medium
+
+  * hinic: fix oops due to race in set_rx_mode (LP: #1832048)
+    - hinic: fix a bug in set rx mode
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.2-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 23 Jun 2019 23:36:11 -0500
+
+linux (5.2.0-5.6) eoan; urgency=medium
+
+  * QCA9377 isn't being recognized sometimes (LP: #1757218)
+    - SAUCE: USB: Disable USB2 LPM at shutdown
+
+  * shiftfs: allow changing ro/rw for subvolumes (LP: #1832316)
+    - SAUCE: shiftfs: allow changing ro/rw for subvolumes
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Packaging] replace nvidia-418 dkms build with nvidia-430
+    - SAUCE: import aufs driver
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 17 Jun 2019 15:04:12 -0500
+
+linux (5.2.0-4.5) eoan; urgency=medium
+
+  * arm64: cma_alloc errors at boot (LP: #1823753)
+    - [Config] Bump CMA_SIZE_MBYTES to 32 on arm64
+    - dma-contiguous: add dma_{alloc,free}_contiguous() helpers
+    - dma-contiguous: use fallback alloc_pages for single pages
+    - dma-contiguous: fix !CONFIG_DMA_CMA version of dma_{alloc,
+      free}_contiguous()
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_MFD_TQMX86=n for s390x
+    - [Config] CONFIG_GPIO_AMD_FCH=n for s390x
+    - [Config] CONFIG_BACKLIGHT_CLASS_DEVICE=n on s390x
+    - [Config] CONFIG_LCD_CLASS_DEVICE=n for s390x
+    - [Config] CONFIG_DRM_ETNAVIV=m for armhf generic-lpae
+    - [Config] CONFIG_DRM_NOUVEAU_SVM=n
+    - [Config] CONFIG_HWMON=n for s390x
+    - [Config] CONFIG_NEW_LEDS=n for s390x
+    - [Config] CONFIG_MTD_NAND_OMAP2=y for armhf
+    - [Config] CONFIG_VOP_BUS=n for non-amd64 arches
+    - [Config] CONFIG_TI_CPSW_PHY_SEL=n
+    - [Config] CONFIG_INTERCONNECT=n for s390x
+    - [Config] CONFIG_SCSI_GDTH=n for s390x
+    - [Config] CONFIG_PACKING=n for s390x
+    - [Config] CONFIG_ARCH_MILBEAUT=y for armhf
+    - [Config] update annotations following config review
+    - update dkms package versions
+    - [Config] enable nvidia dkms build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 10 Jun 2019 07:00:11 -0500
+
+linux (5.2.0-3.4) eoan; urgency=medium
+
+  * [18.04/18.10] File libperf-jvmti.so is missing in linux-tools-common deb on
+    Ubuntu (LP: #1761379)
+    - [Packaging] Support building libperf-jvmti.so
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "bpf, selftest: test global data/bss/rodata sections"
+    - update dkms package versions
+    - [Config] enable zfs
+    - rebase to v5.2-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 02 Jun 2019 21:48:50 -0500
+
+linux (5.2.0-2.3) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: perf arm64: Fix mksyscalltbl when system kernel headers are ahead of
+      the kernel
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 May 2019 07:12:39 -0500
+
+linux (5.2.0-1.2) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_INTEGRITY_PLATFORM_KEYRING=y
+    - update dkms package versions
+    - [Config] enable vbox dkms build
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 May 2019 21:11:27 -0500
+
+linux (5.2.0-0.1) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import aufs driver
+    - [Packaging] disable ZFS
+    - [Packaging] disable nvidia
+    - [Packaging] dkms-build -- expand paths searched for make.log files
+    - add virtualbox-guest-dkms dkms package build
+    - enable vbox dkms build for amd64 and i386
+    - update dkms package versions
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and
+      KEXEC_SIG_FORCE
+    - SAUCE: (efi-lockdown) kexec_file: Restrict at runtime if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) lockdown: Print current->comm in restriction messages
+    - SAUCE: (efi-lockdown) kexec: Allow kexec_file() with appropriate IMA policy
+      when locked down
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) KEYS: Make use of platform keyring for module
+      signature verify
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) furter KEXEC_VERIFY_SIG -> KEXEC_SIG updates
+    - SAUCE: (efi-lockdown) arm64: add kernel config option to lock down when in
+      Secure Boot mode
+    - update dkms package versions
+    - [Config] disable vbox build
+    - SAUCE: s390: mark __cpacf_check_opcode() and cpacf_query_func() as
+      __always_inline
+    - SAUCE: IB/mlx5: use size_t instead of u64 when dividing
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 21 May 2019 11:18:43 -0500
+
+linux (5.2.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 21 May 2019 07:34:43 -0500
+
+linux (5.1.0-2.2) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+
+  * Eoan update: v5.1.2 upstream stable release (LP: #1829050)
+    - x86/msr-index: Cleanup bit defines
+    - x86/speculation: Consolidate CPU whitelists
+    - x86/speculation/mds: Add basic bug infrastructure for MDS
+    - x86/speculation/mds: Add BUG_MSBDS_ONLY
+    - x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
+    - x86/speculation/mds: Add mds_clear_cpu_buffers()
+    - x86/speculation/mds: Clear CPU buffers on exit to user
+    - x86/kvm/vmx: Add MDS protection when L1D Flush is not active
+    - x86/speculation/mds: Conditionally clear CPU buffers on idle entry
+    - x86/speculation/mds: Add mitigation control for MDS
+    - x86/speculation/mds: Add sysfs reporting for MDS
+    - x86/speculation/mds: Add mitigation mode VMWERV
+    - Documentation: Move L1TF to separate directory
+    - Documentation: Add MDS vulnerability documentation
+    - x86/speculation/mds: Add mds=full,nosmt cmdline option
+    - x86/speculation: Move arch_smt_update() call to after mitigation decisions
+    - x86/speculation/mds: Add SMT warning message
+    - x86/speculation/mds: Fix comment
+    - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
+    - cpu/speculation: Add 'mitigations=' cmdline option
+    - x86/speculation: Support 'mitigations=' cmdline option
+    - powerpc/speculation: Support 'mitigations=' cmdline option
+    - s390/speculation: Support 'mitigations=' cmdline option
+    - x86/speculation/mds: Add 'mitigations=' support for MDS
+    - x86/mds: Add MDSUM variant to the MDS documentation
+    - Documentation: Correct the possible MDS sysfs values
+    - x86/speculation/mds: Fix documentation typo
+    - Linux 5.1.2
+
+  * Eoan update: v5.1.1 upstream stable release (LP: #1829046)
+    - Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in hv_synic_cleanup()
+    - ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings
+    - staging: greybus: power_supply: fix prop-descriptor request size
+    - staging: wilc1000: Avoid GFP_KERNEL allocation from atomic context.
+    - staging: most: cdev: fix chrdev_region leak in mod_exit
+    - staging: most: sound: pass correct device when creating a sound card
+    - usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON
+    - usb: dwc3: Fix default lpm_nyet_threshold value
+    - USB: serial: f81232: fix interrupt worker not stop
+    - USB: cdc-acm: fix unthrottle races
+    - usb-storage: Set virt_boundary_mask to avoid SG overflows
+    - genirq: Prevent use-after-free and work list corruption
+    - intel_th: pci: Add Comet Lake support
+    - iio: adc: qcom-spmi-adc5: Fix of-based module autoloading
+    - cpufreq: armada-37xx: fix frequency calculation for opp
+    - ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for
+      hibernate
+    - soc: sunxi: Fix missing dependency on REGMAP_MMIO
+    - scsi: lpfc: change snprintf to scnprintf for possible overflow
+    - scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines
+    - scsi: qla2xxx: Set remote port devloss timeout to 0
+    - scsi: qla2xxx: Fix device staying in blocked state
+    - Bluetooth: hidp: fix buffer overflow
+    - Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
+    - Bluetooth: Fix not initializing L2CAP tx_credits
+    - Bluetooth: hci_bcm: Fix empty regulator supplies for Intel Macs
+    - UAS: fix alignment of scatter/gather segments
+    - ASoC: Intel: avoid Oops if DMA setup fails
+    - i3c: Fix a shift wrap bug in i3c_bus_set_addr_slot_status()
+    - locking/futex: Allow low-level atomic operations to return -EAGAIN
+    - arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP
+    - Linux 5.1.1
+
+  * shiftfs: lock security sensitive superblock flags (LP: #1827122)
+    - SAUCE: shiftfs: lock down certain superblock flags
+
+  * Please package libbpf (which is done out of the kernel src) in Debian [for
+    19.10] (LP: #1826410)
+    - SAUCE: tools -- fix add ability to disable libbfd
+
+  * ratelimit cma_alloc messages (LP: #1828092)
+    - SAUCE: cma: ratelimit cma_alloc error messages
+
+  * Headphone jack switch sense is inverted: plugging in headphones disables
+    headphone output (LP: #1824259)
+    - ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board
+
+  * There are 4 HDMI/Displayport audio output listed in sound setting without
+    attach any HDMI/DP monitor (LP: #1827967)
+    - ALSA: hda/hdmi - Read the pin sense from register when repolling
+    - ALSA: hda/hdmi - Consider eld_valid when reporting jack event
+
+  * CONFIG_LOG_BUF_SHIFT set to 14 is too low on arm64 (LP: #1824864)
+    - [Config] CONFIG_LOG_BUF_SHIFT=18 on all 64bit arches
+
+  * CTAUTO:DevOps:860.50:devops4fp1:Error occurred during LINUX Dmesg error
+    Checking for all LINUX clients for devops4p10 (LP: #1766201)
+    - SAUCE: integrity: downgrade error to warning
+
+  * linux-buildinfo: pull out ABI information into its own package
+    (LP: #1806380)
+    - [Packaging] autoreconstruct -- base tag is always primary mainline version
+
+  * [SRU] Please sync vbox modules from virtualbox 6.0.6 on next kernel update
+    (LP: #1825210)
+    - vbox-update: updates for renamed makefiles
+    - ubuntu: vbox -- update to 6.0.6-dfsg-1
+
+  * autofs kernel module missing (LP: #1824333)
+    - [Config] Update autofs4 path in inclusion list
+
+  * The Realtek card reader does not enter PCIe 1.1/1.2 (LP: #1825487)
+    - SAUCE: misc: rtsx: Fixed rts5260 power saving parameter and sd glitch
+
+  * CVE-2019-3874
+    - sctp: implement memory accounting on tx path
+    - sctp: implement memory accounting on rx path
+
+  * apparmor does not start in Disco LXD containers (LP: #1824812)
+    - SAUCE: shiftfs: use separate llseek method for directories
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] autoreconstruct -- remove for -rc kernels
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) furter KEXEC_VERIFY_SIG -> KEXEC_SIG updates
+    - [Config] (efi-lockdown): update configs after efi lockdown patch refresh
+    - [Packaging] don't delete efi_parser.c
+    - vbox-update -- do not fix up KERN_DIR or KBUILD_EXTMOD
+    - ubuntu: vbox -- update to 6.0.6-dfsg-2
+    - add nvidia-418 dkms build
+    - remove virtualbox guest drivers
+    - [Packaging] dkms-build -- expand paths searched for make.log files
+    - add virtualbox-guest-dkms dkms package build
+    - enable vbox dkms build for amd64 and i386
+    - [Config] update configs for v5.1(-rc7)? rebase
+    - update dkms package versions
+    - Add the ability to lock down access to the running kernel image
+    - Enforce module signatures if the kernel is locked down
+    - Restrict /dev/{mem,kmem,port} when the kernel is locked down
+    - kexec_load: Disable at runtime if the kernel is locked down
+    - Copy secure_boot flag in boot params across kexec reboot
+    - kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE
+    - kexec_file: Restrict at runtime if the kernel is locked down
+    - hibernate: Disable when the kernel is locked down
+    - uswsusp: Disable when the kernel is locked down
+    - PCI: Lock down BAR access when the kernel is locked down
+    - x86: Lock down IO port access when the kernel is locked down
+    - x86/msr: Restrict MSR access when the kernel is locked down
+    - ACPI: Limit access to custom_method when the kernel is locked down
+    - acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down
+    - acpi: Disable ACPI table override if the kernel is locked down
+    - acpi: Disable APEI error injection if the kernel is locked down
+    - Prohibit PCMCIA CIS storage when the kernel is locked down
+    - Lock down TIOCSSERIAL
+    - Lock down module params that specify hardware parameters (eg. ioport)
+    - x86/mmiotrace: Lock down the testmmiotrace module
+    - Lock down /proc/kcore
+    - Lock down kprobes
+    - bpf: Restrict kernel image access functions when the kernel is locked down
+    - Lock down perf
+    - debugfs: Restrict debugfs when the kernel is locked down
+    - lockdown: Print current->comm in restriction messages
+    - kexec: Allow kexec_file() with appropriate IMA policy when locked down
+    - Make get_cert_list() not complain about cert lists that aren't present.
+    - Add efi_status_to_str() and rework efi_status_to_err().
+    - Make get_cert_list() use efi_status_to_str() to print error messages.
+    - efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
+    - efi: Lock down the kernel if booted in secure boot mode
+    - KEYS: Make use of platform keyring for module signature verify
+
+  * Miscellaneous upstream changes
+    - ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14)
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 14 May 2019 12:32:56 -0500
+
+linux (5.1.0-1.1) eoan; urgency=medium
+
+  * bionic: fork out linux-snapdragon into its own topic kernel (LP: #1820868)
+    - [Packaging]: really drop snapdragon
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: fix vbox use of MAP_SHARED
+    - SAUCE: fix vbox use of vm_fault_t
+    - [Packaging] disable ZFS
+    - [Packaging] disable nvidia
+    - SAUCE: perf annotate: Fix build on 32 bit for BPF annotation
+    - [Config]: updateconfig after rebase to v5.1-rc
+    - [Config]: build ETNAVIV only on arm platforms
+    - [Config]: Disable CMA on non-arm platforms
+    - [Config]: MMC_CQHCI is needed by some built-in drivers
+    - [Config]: a.out support has been deprecated
+    - [Config]: R3964 was marked as BROKEN
+    - [Config]: Add SENSIRION_SGP30 module
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: tools: lib/bpf -- add generated headers to search
+      path"
+    - Revert "UBUNTU: SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK"
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 25 Apr 2019 10:03:25 -0300
+
+linux (5.1.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 25 Apr 2019 09:49:47 -0300
+
+linux (5.0.0-13.14) disco; urgency=medium
+
+  * linux: 5.0.0-13.14 -proposed tracker (LP: #1824819)
+
+  * Display only has 640x480 (LP: #1824677)
+    - Revert "UBUNTU: SAUCE: drm/nouveau: Disable nouveau driver by default"
+
+  * shiftfs: use after free when checking mount options (LP: #1824735)
+    - SAUCE: shiftfs: prevent use-after-free when verifying mount options
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 15 Apr 2019 09:11:23 -0500
+
+linux (5.0.0-12.13) disco; urgency=medium
+
+  * linux: 5.0.0-12.13 -proposed tracker (LP: #1824726)
+
+  * Linux 5.0 black screen on boot, display flickers (i915 regression with
+    certain laptop panels) (LP: #1824216)
+    - drm/i915/dp: revert back to max link rate and lane count on eDP
+
+  * kernel BUG at fs/attr.c:287 when using shiftfs (LP: #1824717)
+    - SAUCE: shiftfs: fix passing of attrs to underaly for setattr
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 14 Apr 2019 13:38:05 -0500
+
+linux (5.0.0-11.12) disco; urgency=medium
+
+  * linux: 5.0.0-11.12 -proposed tracker (LP: #1824383)
+
+  * hns3: PPU_PF_ABNORMAL_INT_ST over_8bd_no_fe found [error status=0x1]
+    (LP: #1824194)
+    - net: hns3: fix for not calculating tx bd num correctly
+
+  * disco: unable to use iptables/enable ufw under -virtual kernel
+    (LP: #1823862)
+    - [Packaging] add bpfilter to linux-modules
+
+  * Make shiftfs a module rather than built-in (LP: #1824354)
+    - [Config] CONFIG_SHIFT_FS=m
+
+  * shiftfs: chown sets untranslated ids in lower fs (LP: #1824350)
+    - SAUCE: shiftfs: use translated ids when chaning lower fs attrs
+
+  * [Hyper-V] KVP daemon fails to start on first boot of disco VM (LP: #1820063)
+    - [Packaging] bind hv_kvp_daemon startup to hv_kvp device
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 11 Apr 2019 10:17:19 -0500
+
+linux (5.0.0-10.11) disco; urgency=medium
+
+  * linux: 5.0.0-10.11 -proposed tracker (LP: #1823936)
+
+  * Apparmor enforcement failure in lxc selftests (LP: #1823379)
+    - SAUCE: apparmor: Restore Y/N in /sys for apparmor's "enabled"
+
+  * systemd cause kernel trace "BUG: unable to handle kernel paging request at
+    6db23a14" on Cosmic i386 (LP: #1813244)
+    - openvswitch: fix flow actions reallocation
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 09 Apr 2019 08:30:38 -0500
+
+linux (5.0.0-9.10) disco; urgency=medium
+
+  * linux: 5.0.0-9.10 -proposed tracker (LP: #1823228)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] update helper scripts
+    - [Packaging] resync retpoline extraction
+
+  * Huawei Hi1822 NIC has poor performance (LP: #1820187)
+    - net-next/hinic: replace disable_irq_nosync/enable_irq
+
+  * Add uid shifting overlay filesystem (shiftfs) (LP: #1823186)
+    - shiftfs: uid/gid shifting bind mount
+    - shiftfs: rework and extend
+    - shiftfs: support some btrfs ioctls
+    - [Config] enable shiftfs
+
+  * Cannot boot or install - have to use nomodeset (LP: #1821820)
+    - Revert "drm/i915/fbdev: Actually configure untiled displays"
+
+  * Disco update: v5.0.6 upstream stable release (LP: #1823060)
+    - netfilter: nf_tables: fix set double-free in abort path
+    - dccp: do not use ipv6 header for ipv4 flow
+    - genetlink: Fix a memory leak on error path
+    - gtp: change NET_UDP_TUNNEL dependency to select
+    - ipv6: make ip6_create_rt_rcu return ip6_null_entry instead of NULL
+    - mac8390: Fix mmio access size probe
+    - mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
+    - net: aquantia: fix rx checksum offload for UDP/TCP over IPv6
+    - net: datagram: fix unbounded loop in __skb_try_recv_datagram()
+    - net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec
+    - net: phy: meson-gxl: fix interrupt support
+    - net: rose: fix a possible stack overflow
+    - net: stmmac: fix memory corruption with large MTUs
+    - net-sysfs: call dev_hold if kobject_init_and_add success
+    - net: usb: aqc111: Extend HWID table by QNAP device
+    - packets: Always register packet sk in the same order
+    - rhashtable: Still do rehash when we get EEXIST
+    - sctp: get sctphdr by offset in sctp_compute_cksum
+    - sctp: use memdup_user instead of vmemdup_user
+    - tcp: do not use ipv6 header for ipv4 flow
+    - tipc: allow service ranges to be connect()'ed on RDM/DGRAM
+    - tipc: change to check tipc_own_id to return in tipc_net_stop
+    - tipc: fix cancellation of topology subscriptions
+    - tun: properly test for IFF_UP
+    - vrf: prevent adding upper devices
+    - vxlan: Don't call gro_cells_destroy() before device is unregistered
+    - thunderx: enable page recycling for non-XDP case
+    - thunderx: eliminate extra calls to put_page() for pages held for recycling
+    - net: dsa: mv88e6xxx: fix few issues in mv88e6390x_port_set_cmode
+    - net: mii: Fix PAUSE cap advertisement from linkmode_adv_to_lcl_adv_t()
+      helper
+    - net: phy: don't clear BMCR in genphy_soft_reset
+    - r8169: fix cable re-plugging issue
+    - ila: Fix rhashtable walker list corruption
+    - tun: add a missing rcu_read_unlock() in error path
+    - powerpc/fsl: Fix the flush of branch predictor.
+    - Btrfs: fix incorrect file size after shrinking truncate and fsync
+    - btrfs: remove WARN_ON in log_dir_items
+    - btrfs: don't report readahead errors and don't update statistics
+    - btrfs: Fix bound checking in qgroup_trace_new_subtree_blocks
+    - btrfs: Avoid possible qgroup_rsv_size overflow in
+      btrfs_calculate_inode_block_rsv_size
+    - Btrfs: fix assertion failure on fsync with NO_HOLES enabled
+    - locks: wake any locks blocked on request before deadlock check
+    - tracing: initialize variable in create_dyn_event()
+    - ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time
+    - powerpc: bpf: Fix generation of load/store DW instructions
+    - vfio: ccw: only free cp on final interrupt
+    - NFS: Fix nfs4_lock_state refcounting in nfs4_alloc_{lock,unlock}data()
+    - NFS: fix mount/umount race in nlmclnt.
+    - NFSv4.1 don't free interrupted slot on open
+    - net: dsa: qca8k: remove leftover phy accessors
+    - ALSA: rawmidi: Fix potential Spectre v1 vulnerability
+    - ALSA: seq: oss: Fix Spectre v1 vulnerability
+    - ALSA: pcm: Fix possible OOB access in PCM oss plugins
+    - ALSA: pcm: Don't suspend stream in unrecoverable PCM state
+    - ALSA: hda/realtek - Fixed Headset Mic JD not stable
+    - ALSA: hda/realtek: merge alc_fixup_headset_jack to alc295_fixup_chromebook
+    - ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO
+    - ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB
+    - ALSA: hda/realtek: Enable headset MIC of Acer AIO with ALC286
+    - ALSA: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286
+    - ALSA: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic
+    - ALSA: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256
+    - ALSA: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256
+    - ALSA: hda/realtek: Enable headset MIC of ASUS X430UN and X512DK with ALC256
+    - ALSA: hda/realtek - Fix speakers on Acer Predator Helios 500 Ryzen laptops
+    - kbuild: modversions: Fix relative CRC byte order interpretation
+    - fs/open.c: allow opening only regular files during execve()
+    - ocfs2: fix inode bh swapping mixup in ocfs2_reflink_inodes_lock
+    - scsi: sd: Fix a race between closing an sd device and sd I/O
+    - scsi: sd: Quiesce warning if device does not report optimal I/O size
+    - scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host
+    - scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP
+      devices
+    - drm/rockchip: vop: reset scale mode when win is disabled
+    - tty/serial: atmel: Add is_half_duplex helper
+    - tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
+    - tty: mxs-auart: fix a potential NULL pointer dereference
+    - tty: atmel_serial: fix a potential NULL pointer dereference
+    - tty: serial: qcom_geni_serial: Initialize baud in qcom_geni_console_setup
+    - staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest
+    - staging: olpc_dcon_xo_1: add missing 'const' qualifier
+    - staging: speakup_soft: Fix alternate speech with other synths
+    - staging: vt6655: Remove vif check from vnt_interrupt
+    - staging: vt6655: Fix interrupt race condition on device start up.
+    - staging: erofs: fix to handle error path of erofs_vmap()
+    - staging: erofs: fix error handling when failed to read compresssed data
+    - staging: erofs: keep corrupted fs from crashing kernel in erofs_readdir()
+    - serial: max310x: Fix to avoid potential NULL pointer dereference
+    - serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference
+    - serial: sh-sci: Fix setting SCSCR_TIE while transferring data
+    - USB: serial: cp210x: add new device id
+    - USB: serial: ftdi_sio: add additional NovaTech products
+    - USB: serial: mos7720: fix mos_parport refcount imbalance on error path
+    - USB: serial: option: set driver_info for SIM5218 and compatibles
+    - USB: serial: option: add support for Quectel EM12
+    - USB: serial: option: add Olicard 600
+    - ACPI / CPPC: Fix guaranteed performance handling
+    - Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc
+    - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
+    - drivers/block/zram/zram_drv.c: fix idle/writeback string compare
+    - blk-mq: fix sbitmap ws_active for shared tags
+    - cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency
+    - cpufreq: scpi: Fix use after free
+    - drm/vgem: fix use-after-free when drm_gem_handle_create() fails
+    - drm/vkms: fix use-after-free when drm_gem_handle_create() fails
+    - drm/i915: Mark AML 0x87CA as ULX
+    - drm/i915/gvt: Fix MI_FLUSH_DW parsing with correct index check
+    - drm/i915/icl: Fix the TRANS_DDI_FUNC_CTL2 bitfield macro
+    - gpio: exar: add a check for the return value of ida_simple_get fails
+    - gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
+    - phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs
+    - usb: mtu3: fix EXTCON dependency
+    - USB: gadget: f_hid: fix deadlock in f_hidg_write()
+    - usb: common: Consider only available nodes for dr_mode
+    - mm/memory.c: fix modifying of page protection by insert_pfn()
+    - usb: host: xhci-rcar: Add XHCI_TRUST_TX_LENGTH quirk
+    - xhci: Fix port resume done detection for SS ports with LPM enabled
+    - usb: xhci: dbc: Don't free all memory with spinlock held
+    - xhci: Don't let USB3 ports stuck in polling state prevent suspend
+    - usb: cdc-acm: fix race during wakeup blocking TX traffic
+    - usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 source-caps
+    - usb: typec: Fix unchecked return value
+    - mm/hotplug: fix offline undo_isolate_page_range()
+    - mm: add support for kmem caches in DMA32 zone
+    - iommu/io-pgtable-arm-v7s: request DMA32 memory, and improve debugging
+    - mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
+    - mm/debug.c: fix __dump_page when mapping->host is not set
+    - mm/memory_hotplug.c: fix notification in offline error path
+    - mm/page_isolation.c: fix a wrong flag in set_migratetype_isolate()
+    - mm/migrate.c: add missing flush_dcache_page for non-mapped page migrate
+    - perf pmu: Fix parser error for uncore event alias
+    - perf intel-pt: Fix TSC slip
+    - objtool: Query pkg-config for libelf location
+    - powerpc/pseries/energy: Use OF accessor functions to read ibm,drc-indexes
+    - powerpc/64: Fix memcmp reading past the end of src/dest
+    - powerpc/pseries/mce: Fix misleading print for TLB mutlihit
+    - watchdog: Respect watchdog cpumask on CPU hotplug
+    - cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n
+    - x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y
+    - KVM: Reject device ioctls from processes other than the VM's creator
+    - KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts
+    - KVM: x86: update %rip after emulating IO
+    - bpf: do not restore dst_reg when cur_state is freed
+    - mt76x02u: use usb_bulk_msg to upload firmware
+    - Linux 5.0.6
+
+  * RDMA/hns updates for disco (LP: #1822897)
+    - RDMA/hns: Fix the bug with updating rq head pointer when flush cqe
+    - RDMA/hns: Bugfix for the scene without receiver queue
+    - RDMA/hns: Add constraint on the setting of local ACK timeout
+    - RDMA/hns: Modify the pbl ba page size for hip08
+    - RDMA/hns: RDMA/hns: Assign rq head pointer when enable rq record db
+    - RDMA/hns: Add the process of AEQ overflow for hip08
+    - RDMA/hns: Add SCC context allocation support for hip08
+    - RDMA/hns: Add SCC context clr support for hip08
+    - RDMA/hns: Add timer allocation support for hip08
+    - RDMA/hns: Remove set but not used variable 'rst'
+    - RDMA/hns: Make some function static
+    - RDMA/hns: Fix the Oops during rmmod or insmod ko when reset occurs
+    - RDMA/hns: Fix the chip hanging caused by sending mailbox&CMQ during reset
+    - RDMA/hns: Fix the chip hanging caused by sending doorbell during reset
+    - RDMA/hns: Limit minimum ROCE CQ depth to 64
+    - RDMA/hns: Fix the state of rereg mr
+    - RDMA/hns: Set allocated memory to zero for wrid
+    - RDMA/hns: Delete useful prints for aeq subtype event
+    - RDMA/hns: Configure capacity of hns device
+    - RDMA/hns: Modify qp&cq&pd specification according to UM
+    - RDMA/hns: Bugfix for set hem of SCC
+    - RDMA/hns: Use GFP_ATOMIC in hns_roce_v2_modify_qp
+
+  * autopkgtests run too often, too much and don't skip enough (LP: #1823056)
+    - Set +x on rebuild testcase.
+    - Skip rebuild test, for regression-suite deps.
+    - Make ubuntu-regression-suite skippable on unbootable kernels.
+    - make rebuild use skippable error codes when skipping.
+    - Only run regression-suite, if requested to.
+
+  * touchpad not working on lenovo yoga 530 (LP: #1787775)
+    - Revert "UBUNTU: SAUCE: i2c:amd Depends on ACPI"
+    - Revert "UBUNTU: SAUCE: i2c:amd move out pointer in union i2c_event_base"
+    - i2c: add extra check to safe DMA buffer helper
+    - i2c: Add drivers for the AMD PCIe MP2 I2C controller
+    - [Config] Update config for AMD MP2 I2C driver
+
+  * Detect SMP PHY control command errors (LP: #1822680)
+    - scsi: libsas: Check SMP PHY control function result
+
+  * disable a.out support (LP: #1818552)
+    - [Config] Disable a.out support
+    - [Config] remove binfmt_aout from abi for i386 lowlatency
+
+  * bionic: fork out linux-snapdragon into its own topic kernel (LP: #1820868)
+    - [Packaging] remove snapdragon flavour support
+    - Revert "UBUNTU: SAUCE: (snapdragon) drm/msm/adv7511: wrap hacks under
+      CONFIG_ADV7511_SNAPDRAGON_HACKS #ifdefs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) media: ov5645: skip address change if dt
+      addr == default addr"
+    - Revert "UBUNTU: SAUCE: (snapdragon) DT: leds: Add Qualcomm Light Pulse
+      Generator binding"
+    - Revert "UBUNTU: SAUCE: (snapdragon) MAINTAINERS: Add Qualcomm Camera Control
+      Interface driver"
+    - Revert "UBUNTU: SAUCE: (snapdragon) dt-bindings: media: Binding document for
+      Qualcomm Camera Control Interface driver"
+    - Revert "UBUNTU: SAUCE: (snapdragon) leds: Add driver for Qualcomm LPG"
+    - Revert "UBUNTU: SAUCE: (snapdragon) HACK: drm/msm/adv7511: Don't rely on
+      interrupts for EDID parsing"
+    - Revert "UBUNTU: SAUCE: (snapdragon) drm/bridge/adv7511: Delay clearing of
+      HPD interrupt status"
+    - Revert "UBUNTU: SAUCE: (snapdragon) media: ov5645: Fix I2C address"
+    - Revert "UBUNTU: SAUCE: (snapdragon) i2c-qcom-cci: Fix I2C address bug"
+    - Revert "UBUNTU: SAUCE: (snapdragon) i2c-qcom-cci: Fix run queue completion
+      timeout"
+    - Revert "UBUNTU: SAUCE: (snapdragon) camss: Do not register if no cameras are
+      present"
+    - Revert "UBUNTU: SAUCE: (snapdragon) i2c: Add Qualcomm Camera Control
+      Interface driver"
+    - Revert "UBUNTU: SAUCE: (snapdragon) ov5645: I2C address change"
+    - Revert "UBUNTU: SAUCE: (snapdragon) regulator: smd: Allow
+      REGULATOR_QCOM_SMD_RPM=m"
+    - Revert "UBUNTU: SAUCE: (snapdragon) cpufreq: Add apq8016 to cpufreq-dt-
+      platdev blacklist"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: Add a helper to get an opp
+      regulator for device"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: HACK: Allow to set regulator
+      without opp_list"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: Drop RCU usage in
+      dev_pm_opp_adjust_voltage()"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: Support adjusting OPP voltages
+      at runtime"
+    - Revert "UBUNTU: SAUCE: (snapdragon) regulator: smd: Add floor and corner
+      operations"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: cpr: Register with cpufreq-
+      dt"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: cpr: fix with new
+      reg_sequence structures"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: cpr: Use raw mem access for
+      qfprom"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: Add support for CPR (Core
+      Power Reduction)"
+    - Revert "UBUNTU: SAUCE: (snapdragon) HACK: drm/msm/iommu: Remove runtime_put
+      calls in map/unmap"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable LEDS_QCOM_LPG"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable 'BBR' TCP
+      congestion algorithm"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable 'fq' and
+      'fq_codel' qdiscs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable
+      'schedutil' CPUfreq governor"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: set USB_CONFIG_F_FS in
+      distro.config"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable
+      CONFIG_USB_CONFIGFS_F_FS by default"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: add freq stat to sysfs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: Enable camera drivers"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: disable ANALOG_TV and
+      DIGITAL_TV"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: add more USB net
+      drivers"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: enable BT_QCOMSMD"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable
+      CFG80211_DEFAULT_PS by default"
+    - Revert "UBUNTU: SAUCE: (snapdragon) Force the SMD regulator driver to be
+      compiled-in"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: enable dm_mod and
+      dm_crypt"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: Enable a53/apcs and
+      avs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: enable QCOM Venus"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable debug
+      friendly USB network adpater"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: enable WCN36xx"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs; add distro.config"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable QCOM audio
+      drivers for APQ8016 and DB410c"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable REMOTEPROC"
+    - [Config] fix abi for remove i2c-qcom-cci module
+    - [Config] update annotations
+    - [Config] update configs following snapdragon removal
+
+  * Disco update: v5.0.5 upstream stable release (LP: #1822671)
+    - Revert "ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec"
+    - ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist
+    - ALSA: firewire-motu: use 'version' field of unit directory to identify model
+    - mmc: pxamci: fix enum type confusion
+    - mmc: alcor: fix DMA reads
+    - mmc: mxcmmc: "Revert mmc: mxcmmc: handle highmem pages"
+    - mmc: renesas_sdhi: limit block count to 16 bit for old revisions
+    - drm/amdgpu: fix invalid use of change_bit
+    - drm/vmwgfx: Don't double-free the mode stored in par->set_mode
+    - drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's
+    - iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
+    - iommu/iova: Fix tracking of recently failed iova address
+    - libceph: wait for latest osdmap in ceph_monc_blacklist_add()
+    - udf: Fix crash on IO error during truncate
+    - mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction.
+    - MIPS: Ensure ELF appended dtb is relocated
+    - MIPS: Fix kernel crash for R6 in jump label branch function
+    - powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038
+    - powerpc/security: Fix spectre_v2 reporting
+    - net/mlx5: Fix DCT creation bad flow
+    - scsi: core: Avoid that a kernel warning appears during system resume
+    - scsi: qla2xxx: Fix FC-AL connection target discovery
+    - scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton
+    - scsi: ibmvscsi: Fix empty event pool access during host removal
+    - futex: Ensure that futex address is aligned in handle_futex_death()
+    - perf probe: Fix getting the kernel map
+    - objtool: Move objtool_file struct off the stack
+    - irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp
+    - clocksource/drivers/riscv: Fix clocksource mask
+    - ALSA: ac97: Fix of-node refcount unbalance
+    - ext4: fix NULL pointer dereference while journal is aborted
+    - ext4: fix data corruption caused by unaligned direct AIO
+    - ext4: brelse all indirect buffer in ext4_ind_remove_space()
+    - media: v4l2-ctrls.c/uvc: zero v4l2_event
+    - Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf()
+    - Bluetooth: Fix decrementing reference count twice in releasing socket
+    - Bluetooth: hci_ldisc: Initialize hci_dev before open()
+    - Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in
+      hci_uart_set_proto()
+    - drm/vkms: Fix flush_work() without INIT_WORK().
+    - RDMA/cma: Rollback source IP address if failing to acquire device
+    - f2fs: fix to avoid deadlock of atomic file operations
+    - aio: simplify - and fix - fget/fput for io_submit()
+    - netfilter: ebtables: remove BUGPRINT messages
+    - loop: access lo_backing_file only when the loop device is Lo_bound
+    - x86/unwind: Handle NULL pointer calls better in frame unwinder
+    - x86/unwind: Add hardcoded ORC entry for NULL
+    - locking/lockdep: Add debug_locks check in __lock_downgrade()
+    - ALSA: hda - Record the current power state before suspend/resume calls
+    - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec
+    - Linux 5.0.5
+
+  * hisi_sas updates for disco (LP: #1822385)
+    - scsi: hisi_sas: send primitive NOTIFY to SSP situation only
+    - scsi: hisi_sas: shutdown axi bus to avoid exception CQ returned
+    - scsi: hisi_sas: remove the check of sas_dev status in
+      hisi_sas_I_T_nexus_reset()
+    - scsi: hisi_sas: Remove unused parameter of function hisi_sas_alloc()
+    - scsi: hisi_sas: Reject setting programmed minimum linkrate > 1.5G
+    - scsi: hisi_sas: Fix losing directly attached disk when hot-plug
+    - scsi: hisi_sas: Correct memory allocation size for DQ debugfs
+    - scsi: hisi_sas: Some misc tidy-up
+    - scsi: hisi_sas: Fix to only call scsi_get_prot_op() for non-NULL scsi_cmnd
+    - scsi: hisi_sas: Add missing seq_printf() call in hisi_sas_show_row_32()
+    - scsi: hisi_sas: Add support for DIX feature for v3 hw
+    - scsi: hisi_sas: Add manual trigger for debugfs dump
+    - scsi: hisi_sas: change queue depth from 512 to 4096
+    - scsi: hisi_sas: Issue internal abort on all relevant queues
+    - scsi: hisi_sas: Use pci_irq_get_affinity() for v3 hw as experimental
+    - scsi: hisi_sas: Do some more tidy-up
+    - scsi: hisi_sas: Change return variable type in phy_up_v3_hw()
+    - scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO
+    - scsi: hisi_sas: print PHY RX errors count for later revision of v3 hw
+    - scsi: hisi_sas: Set PHY linkrate when disconnected
+    - scsi: hisi_sas: Send HARD RESET to clear the previous affiliation of STP
+      target port
+    - scsi: hisi_sas: Change SERDES_CFG init value to increase reliability of
+      HiLink
+    - scsi: hisi_sas: Add softreset in hisi_sas_I_T_nexus_reset()
+
+  * [Patch][Raven 2] kernel 5.0.0 cannot boot because of psp response
+    (LP: #1822267)
+    - drm/amdgpu/psp: Fix can't detect psp INVOKE command failed
+    - drm/amdgpu/psp: ignore psp response status
+
+  * 3b080b2564287be91605bfd1d5ee985696e61d3c in ubuntu_btrfs_kernel_fixes
+    triggers system hang on i386 (LP: #1812845)
+    - btrfs: raid56: properly unmap parity page in finish_parity_scrub()
+
+  * enable CONFIG_DRM_BOCHS (LP: #1795857)
+    - [Config] Reenable DRM_BOCHS as module
+
+  * [Dell Precision 7530/5530 with Nvidia Quadro P1000] Live USB freezes or
+    cannot complete install when nouveau driver is loaded (crashing in GP100
+    code) (LP: #1822026)
+    - SAUCE: drm/nouveau: Disable nouveau driver by default
+
+  * Need to add Intel CML related pci-id's (LP: #1821863)
+    - drm/i915/cml: Add CML PCI IDS
+    - drm/i915/cml: Introduce Comet Lake PCH
+
+  * ARM: Add support for the SDEI interface (LP: #1822005)
+    - ACPI / APEI: Don't wait to serialise with oops messages when panic()ing
+    - ACPI / APEI: Remove silent flag from ghes_read_estatus()
+    - ACPI / APEI: Switch estatus pool to use vmalloc memory
+    - ACPI / APEI: Make hest.c manage the estatus memory pool
+    - ACPI / APEI: Make estatus pool allocation a static size
+    - ACPI / APEI: Don't store CPER records physical address in struct ghes
+    - ACPI / APEI: Remove spurious GHES_TO_CLEAR check
+    - ACPI / APEI: Don't update struct ghes' flags in read/clear estatus
+    - ACPI / APEI: Generalise the estatus queue's notify code
+    - ACPI / APEI: Don't allow ghes_ack_error() to mask earlier errors
+    - ACPI / APEI: Move NOTIFY_SEA between the estatus-queue and NOTIFY_NMI
+    - ACPI / APEI: Switch NOTIFY_SEA to use the estatus queue
+    - KVM: arm/arm64: Add kvm_ras.h to collect kvm specific RAS plumbing
+    - arm64: KVM/mm: Move SEA handling behind a single 'claim' interface
+    - ACPI / APEI: Move locking to the notification helper
+    - ACPI / APEI: Let the notification helper specify the fixmap slot
+    - ACPI / APEI: Pass ghes and estatus separately to avoid a later copy
+    - ACPI / APEI: Make GHES estatus header validation more user friendly
+    - ACPI / APEI: Split ghes_read_estatus() to allow a peek at the CPER length
+    - ACPI / APEI: Only use queued estatus entry during in_nmi_queue_one_entry()
+    - ACPI / APEI: Use separate fixmap pages for arm64 NMI-like notifications
+    - firmware: arm_sdei: Add ACPI GHES registration helper
+    - ACPI / APEI: Add support for the SDEI GHES Notification type
+
+  * CVE-2019-9857
+    - inotify: Fix fsnotify_mark refcount leak in inotify_update_existing_watch()
+
+  * scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+    discovery (LP: #1821408)
+    - scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+      discovery
+
+  * Qualcomm Atheros QCA9377 wireless does not work (LP: #1818204)
+    - platform/x86: ideapad-laptop: Add Ideapad 530S-14ARR to no_hw_rfkill list
+
+  * Lenovo ideapad 330-15ICH Wifi rfkill hard blocked (LP: #1811815)
+    - platform/x86: ideapad: Add ideapad 330-15ICH to no_hw_rfkill
+
+  * hid-sensor-hub spamming dmesg in 4.20 (LP: #1818547)
+    - HID: Increase maximum report size allowed by hid_field_extract()
+
+  * [disco] [5.0.0-7.8] can't mount guest cifs share (LP: #1821053)
+    - cifs: allow guest mounts to work for smb3.11
+    - SMB3: Fix SMB3.1.1 guest mounts to Samba
+
+  * Add HiSilicon SoC quirk for cpufreq (LP: #1821620)
+    - ACPI / CPPC: Add a helper to get desired performance
+    - cpufreq / cppc: Work around for Hisilicon CPPC cpufreq
+
+  * Disco update: v5.0.4 upstream stable release (LP: #1821607)
+    - 9p: use inode->i_lock to protect i_size_write() under 32-bit
+    - 9p/net: fix memory leak in p9_client_create
+    - ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
+    - ASoC: codecs: pcm186x: fix wrong usage of DECLARE_TLV_DB_SCALE()
+    - ASoC: codecs: pcm186x: Fix energysense SLEEP bit
+    - iio: adc: exynos-adc: Fix NULL pointer exception on unbind
+    - iio: adc: exynos-adc: Use proper number of channels for Exynos4x12
+    - mei: hbm: clean the feature flags on link reset
+    - mei: bus: move hw module get/put to probe/release
+    - stm class: Prevent division by zero
+    - stm class: Fix an endless loop in channel allocation
+    - crypto: caam - fix hash context DMA unmap size
+    - crypto: ccree - fix missing break in switch statement
+    - crypto: caam - fixed handling of sg list
+    - crypto: caam - fix DMA mapping of stack memory
+    - crypto: ccree - fix free of unallocated mlli buffer
+    - crypto: ccree - unmap buffer before copying IV
+    - crypto: ccree - don't copy zero size ciphertext
+    - crypto: cfb - add missing 'chunksize' property
+    - crypto: cfb - remove bogus memcpy() with src == dest
+    - crypto: ofb - fix handling partial blocks and make thread-safe
+    - crypto: ahash - fix another early termination in hash walk
+    - crypto: rockchip - fix scatterlist nents error
+    - crypto: rockchip - update new iv to device in multiple operations
+    - dax: Flush partial PMDs correctly
+    - nfit: Fix nfit_intel_shutdown_status() command submission
+    - nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
+    - acpi/nfit: Fix bus command validation
+    - nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot
+    - nfit/ars: Attempt short-ARS even in the no_init_ars case
+    - libnvdimm/label: Clear 'updating' flag after label-set update
+    - libnvdimm, pfn: Fix over-trim in trim_pfn_device()
+    - libnvdimm/pmem: Honor force_raw for legacy pmem regions
+    - libnvdimm: Fix altmap reservation size calculation
+    - fix cgroup_do_mount() handling of failure exits
+    - crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
+    - crypto: aegis - fix handling chunked inputs
+    - crypto: arm/crct10dif - revert to C code for short inputs
+    - crypto: arm64/aes-neonbs - fix returning final keystream block
+    - crypto: arm64/crct10dif - revert to C code for short inputs
+    - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
+    - crypto: morus - fix handling chunked inputs
+    - crypto: pcbc - remove bogus memcpy()s with src == dest
+    - crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
+    - crypto: testmgr - skip crc32c context test for ahash algorithms
+    - crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP
+    - crypto: x86/aesni-gcm - fix crash on empty plaintext
+    - crypto: x86/morus - fix handling chunked inputs and MAY_SLEEP
+    - crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
+    - crypto: arm64/aes-ccm - fix bugs in non-NEON fallback routine
+    - CIFS: Fix leaking locked VFS cache pages in writeback retry
+    - CIFS: Do not reset lease state to NONE on lease break
+    - CIFS: Do not skip SMB2 message IDs on send failures
+    - CIFS: Fix read after write for files with read caching
+    - smb3: make default i/o size for smb3 mounts larger
+    - tracing: Use strncpy instead of memcpy for string keys in hist triggers
+    - tracing: Do not free iter->trace in fail path of tracing_open_pipe()
+    - tracing/perf: Use strndup_user() instead of buggy open-coded version
+    - vmw_balloon: release lock on error in vmballoon_reset()
+    - xen: fix dom0 boot on huge systems
+    - ACPI / device_sysfs: Avoid OF modalias creation for removed device
+    - mmc: sdhci-esdhc-imx: fix HS400 timing issue
+    - mmc: renesas_sdhi: Fix card initialization failure in high speed mode
+    - mmc:fix a bug when max_discard is 0
+    - spi: ti-qspi: Fix mmap read when more than one CS in use
+    - spi: pxa2xx: Setup maximum supported DMA transfer length
+    - spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
+    - spi: spi-gpio: fix SPI_CS_HIGH capability
+    - regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
+    - regulator: max77620: Initialize values for DT properties
+    - regulator: s2mpa01: Fix step values for some LDOs
+    - mt76: fix corrupted software generated tx CCMP PN
+    - clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
+    - clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
+    - clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer
+      instability
+    - s390: vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem
+    - s390/setup: fix early warning messages
+    - s390/virtio: handle find on invalid queue gracefully
+    - scsi: virtio_scsi: don't send sc payload with tmfs
+    - scsi: aacraid: Fix performance issue on logical drives
+    - scsi: sd: Optimal I/O size should be a multiple of physical block size
+    - scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
+    - scsi: qla2xxx: Fix LUN discovery if loop id is not assigned yet by firmware
+    - scsi: qla2xxx: Avoid PCI IRQ affinity mapping when multiqueue is not
+      supported
+    - scsi: qla2xxx: Use complete switch scan for RSCN events
+    - fs/devpts: always delete dcache dentry-s in dput()
+    - splice: don't merge into linked buffers
+    - ovl: During copy up, first copy up data and then xattrs
+    - ovl: Do not lose security.capability xattr over metadata file copy-up
+    - m68k: Add -ffreestanding to CFLAGS
+    - Btrfs: setup a nofs context for memory allocation at btrfs_create_tree()
+    - Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl
+    - btrfs: scrub: fix circular locking dependency warning
+    - btrfs: drop the lock on error in btrfs_dev_replace_cancel
+    - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
+    - btrfs: init csum_list before possible free
+    - Btrfs: fix corruption reading shared and compressed extents after hole
+      punching
+    - Btrfs: fix deadlock between clone/dedupe and rename
+    - soc: qcom: rpmh: Avoid accessing freed memory from batch API
+    - libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer
+    - irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table
+    - irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code
+    - x86/kprobes: Prohibit probing on optprobe template code
+    - cpufreq: kryo: Release OPP tables on module removal
+    - cpufreq: tegra124: add missing of_node_put()
+    - cpufreq: pxa2xx: remove incorrect __init annotation
+    - ext4: fix check of inode in swap_inode_boot_loader
+    - ext4: cleanup pagecache before swap i_data
+    - mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
+    - mm/vmalloc: fix size check for remap_vmalloc_range_partial()
+    - mm/memory.c: do_fault: avoid usage of stale vm_area_struct
+    - kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
+    - nvmem: core: don't check the return value of notifier chain call
+    - device property: Fix the length used in PROPERTY_ENTRY_STRING()
+    - intel_th: Don't reference unassigned outputs
+    - parport_pc: fix find_superio io compare code, should use equal test.
+    - i2c: tegra: fix maximum transfer size
+    - i2c: tegra: update maximum transfer size
+    - media: i2c: ov5640: Fix post-reset delay
+    - gpio: pca953x: Fix dereference of irq data in shutdown
+    - ext4: update quota information while swapping boot loader inode
+    - ext4: add mask of ext4 flags to swap
+    - ext4: fix crash during online resizing
+    - dma: Introduce dma_max_mapping_size()
+    - swiotlb: Introduce swiotlb_max_mapping_size()
+    - swiotlb: Add is_swiotlb_active() function
+    - PCI/ASPM: Use LTR if already enabled by platform
+    - PCI/DPC: Fix print AER status in DPC event handling
+    - PCI: qcom: Don't deassert reset GPIO during probe
+    - PCI: dwc: skip MSI init if MSIs have been explicitly disabled
+    - PCI: pci-bridge-emul: Create per-bridge copy of register behavior
+    - PCI: pci-bridge-emul: Extend pci_bridge_emul_init() with flags
+    - IB/hfi1: Close race condition on user context disable and close
+    - IB/rdmavt: Fix loopback send with invalidate ordering
+    - IB/rdmavt: Fix concurrency panics in QP post_send and modify to error
+    - cxl: Wrap iterations over afu slices inside 'afu_list_lock'
+    - ext2: Fix underflow in ext2_max_size()
+    - clk: uniphier: Fix update register for CPU-gear
+    - clk: clk-twl6040: Fix imprecise external abort for pdmclk
+    - clk: samsung: exynos5: Fix possible NULL pointer exception on
+      platform_device_alloc() failure
+    - clk: samsung: exynos5: Fix kfree() of const memory on setting
+      driver_override
+    - clk: ingenic: Fix round_rate misbehaving with non-integer dividers
+    - clk: ingenic: Fix doc of ingenic_cgu_div_info
+    - usb: chipidea: tegra: Fix missed ci_hdrc_remove_device()
+    - usb: typec: tps6598x: handle block writes separately with plain-I2C adapters
+    - dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
+    - serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO
+    - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
+    - serial: 8250_pci: Fix number of ports for ACCES serial cards
+    - serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954
+      chip use the pci_pericom_setup()
+    - jbd2: clear dirty flag when revoking a buffer from an older transaction
+    - jbd2: fix compile warning when using JBUFFER_TRACE
+    - selinux: add the missing walk_size + len check in selinux_sctp_bind_connect
+    - security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock
+    - powerpc/32: Clear on-stack exception marker upon exception return
+    - powerpc/wii: properly disable use of BATs when requested.
+    - powerpc/powernv: Make opal log only readable by root
+    - powerpc/83xx: Also save/restore SPRG4-7 during suspend
+    - powerpc/kvm: Save and restore host AMR/IAMR/UAMOR
+    - powerpc/powernv: Don't reprogram SLW image on every KVM guest entry/exit
+    - powerpc/64s/hash: Fix assert_slb_presence() use of the slbfee. instruction
+    - powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
+    - powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
+    - powerpc/hugetlb: Don't do runtime allocation of 16G pages in LPAR
+      configuration
+    - powerpc/smp: Fix NMI IPI timeout
+    - powerpc/smp: Fix NMI IPI xmon timeout
+    - powerpc/traps: fix recoverability of machine check handling on book3s/32
+    - powerpc/traps: Fix the message printed when stack overflows
+    - ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
+    - arm64: Fix HCR.TGE status for NMI contexts
+    - arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
+    - arm64: debug: Ensure debug handlers check triggering exception level
+    - arm64: KVM: Fix architecturally invalid reset value for FPEXC32_EL2
+    - Revert "KVM/MMU: Flush tlb directly in the kvm_zap_gfn_range()"
+    - ipmi_si: Fix crash when using hard-coded device
+    - ipmi_si: fix use-after-free of resource->name
+    - dm: fix to_sector() for 32bit
+    - dm integrity: limit the rate of error messages
+    - media: cx25840: mark pad sig_types to fix cx231xx init
+    - mfd: sm501: Fix potential NULL pointer dereference
+    - cpcap-charger: generate events for userspace
+    - cpuidle: governor: Add new governors to cpuidle_governors again
+    - NFS: Fix I/O request leakages
+    - NFS: Fix an I/O request leakage in nfs_do_recoalesce
+    - NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
+    - nfsd: fix performance-limiting session calculation
+    - nfsd: fix memory corruption caused by readdir
+    - nfsd: fix wrong check in write_v4_end_grace()
+    - NFSv4.1: Reinitialise sequence results before retransmitting a request
+    - svcrpc: fix UDP on servers with lots of threads
+    - PM / wakeup: Rework wakeup source timer cancellation
+    - PM / OPP: Update performance state when freq == old_freq
+    - bcache: treat stale && dirty keys as bad keys
+    - bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata
+    - stable-kernel-rules.rst: add link to networking patch queue
+    - vt: perform safe console erase in the right order
+    - x86/unwind/orc: Fix ORC unwind table alignment
+    - perf intel-pt: Fix CYC timestamp calculation after OVF
+    - perf tools: Fix split_kallsyms_for_kcore() for trampoline symbols
+    - perf auxtrace: Define auxtrace record alignment
+    - perf intel-pt: Fix overlap calculation for padding
+    - perf/x86/intel/uncore: Fix client IMC events return huge result
+    - perf intel-pt: Fix divide by zero when TSC is not available
+    - md: Fix failed allocation of md_register_thread
+    - x86/kvmclock: set offset for kvm unstable clock
+    - x86/ftrace: Fix warning and considate ftrace_jmp_replace() and
+      ftrace_call_replace()
+    - tpm/tpm_crb: Avoid unaligned reads in crb_recv()
+    - tpm: Unify the send callback behaviour
+    - rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
+    - media: imx: prpencvf: Stop upstream before disabling IDMA channel
+    - media: lgdt330x: fix lock status reporting
+    - media: sun6i: Fix CSI regmap's max_register
+    - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
+    - media: vimc: Add vimc-streamer for stream control
+    - media: imx-csi: Input connections to CSI should be optional
+    - media: imx: csi: Disable CSI immediately after last EOF
+    - media: imx: csi: Stop upstream before disabling IDMA channel
+    - drm/fb-helper: generic: Fix drm_fbdev_client_restore()
+    - drm/radeon/evergreen_cs: fix missing break in switch statement
+    - drm/amd/powerplay: correct power reading on fiji
+    - drm/amd/display: don't call dm_pp_ function from an fpu block
+    - KVM: Call kvm_arch_memslots_updated() before updating memslots
+    - KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run
+    - KVM: VMX: Zero out *all* general purpose registers after VM-Exit
+    - KVM: x86/mmu: Detect MMIO generation wrap in any address space
+    - KVM: x86/mmu: Do not cache MMIO accesses while memslots are in flux
+    - KVM: nVMX: Sign extend displacements of VMX instr's mem operands
+    - KVM: nVMX: Apply addr size mask to effective address for VMX instructions
+    - KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
+    - KVM: nVMX: Check a single byte for VMCS "launched" in nested early checks
+    - net: dsa: lantiq_gswip: fix use-after-free on failed probe
+    - net: dsa: lantiq_gswip: fix OF child-node lookups
+    - s390/setup: fix boot crash for machine without EDAT-1
+    - SUNRPC: Prevent thundering herd when the socket is not connected
+    - SUNRPC: Fix up RPC back channel transmission
+    - SUNRPC: Respect RPC call timeouts when retrying transmission
+    - Linux 5.0.4
+    - [Config] update configs for 5.0.4 stable update
+
+  * New Intel Wireless-AC 9260 [8086:2526] card not correctly probed in Ubuntu
+    system (LP: #1821271)
+    - iwlwifi: add new card for 9260 series
+
+  * [CONFIG] please enable highdpi font FONT_TER16x32 (LP: #1819881)
+    - [Config]: enable highdpi Terminus 16x32 font support
+
+  * [SRU][B/B-OEM/C/D] Fix AMD IOMMU NULL dereference (LP: #1820990)
+    - iommu/amd: Fix NULL dereference bug in match_hid_uid
+
+  * some codecs stop working after S3 (LP: #1820930)
+    - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec
+    - ALSA: hda - Don't trigger jackpoll_work in azx_resume
+
+  * tcm_loop.ko: move from modules-extra into main modules package
+    (LP: #1817786)
+    - [Packaging] move tcm_loop.lo to main linux-modules package
+
+  * C++ demangling support missing from perf (LP: #1396654)
+    - [Packaging] fix a mistype
+
+  * r8169 doesn't get woken up by ethernet cable plugging, no PME generated
+    (LP: #1817676)
+    - PCI: pciehp: Disable Data Link Layer State Changed event on suspend
+
+  * Disco update: v5.0.3 upstream stable release (LP: #1821074)
+    - connector: fix unsafe usage of ->real_parent
+    - fou, fou6: avoid uninit-value in gue_err() and gue6_err()
+    - gro_cells: make sure device is up in gro_cells_receive()
+    - ipv4/route: fail early when inet dev is missing
+    - l2tp: fix infoleak in l2tp_ip6_recvmsg()
+    - lan743x: Fix RX Kernel Panic
+    - lan743x: Fix TX Stall Issue
+    - net: hsr: fix memory leak in hsr_dev_finalize()
+    - net/hsr: fix possible crash in add_timer()
+    - net: sit: fix UBSAN Undefined behaviour in check_6rd
+    - net/x25: fix use-after-free in x25_device_event()
+    - net/x25: reset state in x25_connect()
+    - pptp: dst_release sk_dst_cache in pptp_sock_destruct
+    - ravb: Decrease TxFIFO depth of Q3 and Q2 to one
+    - route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
+    - rxrpc: Fix client call queueing, waiting for channel
+    - sctp: remove sched init from sctp_stream_init
+    - tcp: do not report TCP_CM_INQ of 0 for closed connections
+    - tcp: Don't access TCP_SKB_CB before initializing it
+    - tcp: handle inet_csk_reqsk_queue_add() failures
+    - vxlan: Fix GRO cells race condition between receive and link delete
+    - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
+    - net/mlx4_core: Fix reset flow when in command polling mode
+    - net/mlx4_core: Fix locking in SRIOV mode when switching between events and
+      polling
+    - net/mlx4_core: Fix qp mtt size calculation
+    - net: dsa: mv88e6xxx: Set correct interface mode for CPU/DSA ports
+    - vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock
+    - net: sched: flower: insert new filter to idr after setting its mask
+    - f2fs: wait on atomic writes to count F2FS_CP_WB_DATA
+    - perf/x86: Fixup typo in stub functions
+    - ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against
+      Liquid Saffire 56
+    - ALSA: firewire-motu: fix construction of PCM frame for capture direction
+    - ALSA: hda: Extend i915 component bind timeout
+    - ALSA: hda - add more quirks for HP Z2 G4 and HP Z240
+    - ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294
+    - ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone
+    - ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with
+      ALC255
+    - perf/x86/intel: Fix memory corruption
+    - perf/x86/intel: Make dev_attr_allow_tsx_force_abort static
+    - It's wrong to add len to sector_nr in raid10 reshape twice
+    - drm: Block fb changes for async plane updates
+    - Linux 5.0.3
+
+  * Disco update: v5.0.2 upstream stable release (LP: #1820318)
+    - media: uvcvideo: Fix 'type' check leading to overflow
+    - Input: wacom_serial4 - add support for Wacom ArtPad II tablet
+    - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
+    - iscsi_ibft: Fix missing break in switch statement
+    - scsi: aacraid: Fix missing break in switch statement
+    - x86/PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub
+    - arm64: dts: zcu100-revC: Give wifi some time after power-on
+    - arm64: dts: hikey: Give wifi some time after power-on
+    - arm64: dts: hikey: Revert "Enable HS200 mode on eMMC"
+    - ARM: dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3
+    - ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
+    - ARM: dts: exynos: Fix max voltage for buck8 regulator on Odroid XU3/XU4
+    - drm: disable uncached DMA optimization for ARM and arm64
+    - media: Revert "media: rc: some events are dropped by userspace"
+    - Revert "PCI/PME: Implement runtime PM callbacks"
+    - bpf: Stop the psock parser before canceling its work
+    - gfs2: Fix missed wakeups in find_insert_glock
+    - staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()
+    - staging: erofs: compressed_pages should not be accessed again after freed
+    - scripts/gdb: replace flags (MS_xyz -> SB_xyz)
+    - ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom
+    - perf/x86/intel: Make cpuc allocations consistent
+    - perf/x86/intel: Generalize dynamic constraint creation
+    - x86: Add TSX Force Abort CPUID/MSR
+    - perf/x86/intel: Implement support for TSX Force Abort
+    - Linux 5.0.2
+
+  * Linux security module stacking support
+    - LSM: Introduce LSM_FLAG_LEGACY_MAJOR
+    - LSM: Provide separate ordered initialization
+    - LSM: Plumb visibility into optional "enabled" state
+    - LSM: Lift LSM selection out of individual LSMs
+    - LSM: Build ordered list of LSMs to initialize
+    - LSM: Introduce CONFIG_LSM
+    - LSM: Introduce "lsm=" for boottime LSM selection
+    - LSM: Tie enabling logic to presence in ordered list
+    - LSM: Prepare for reorganizing "security=" logic
+    - LSM: Refactor "security=" in terms of enable/disable
+    - LSM: Separate idea of "major" LSM from "exclusive" LSM
+    - apparmor: Remove SECURITY_APPARMOR_BOOTPARAM_VALUE
+    - selinux: Remove SECURITY_SELINUX_BOOTPARAM_VALUE
+    - LSM: Add all exclusive LSMs to ordered initialization
+    - LSM: Split LSM preparation from initialization
+    - LoadPin: Initialize as ordered LSM
+    - Yama: Initialize as ordered LSM
+    - LSM: Introduce enum lsm_order
+    - capability: Initialize as LSM_ORDER_FIRST
+    - procfs: add smack subdir to attrs
+    - Smack: Abstract use of cred security blob
+    - SELinux: Abstract use of cred security blob
+    - SELinux: Remove cred security blob poisoning
+    - SELinux: Remove unused selinux_is_enabled
+    - AppArmor: Abstract use of cred security blob
+    - TOMOYO: Abstract use of cred security blob
+    - Infrastructure management of the cred security blob
+    - SELinux: Abstract use of file security blob
+    - Smack: Abstract use of file security blob
+    - LSM: Infrastructure management of the file security
+    - SELinux: Abstract use of inode security blob
+    - Smack: Abstract use of inode security blob
+    - LSM: Infrastructure management of the inode security
+    - LSM: Infrastructure management of the task security
+    - SELinux: Abstract use of ipc security blobs
+    - Smack: Abstract use of ipc security blobs
+    - LSM: Infrastructure management of the ipc security blob
+    - TOMOYO: Update LSM flags to no longer be exclusive
+    - LSM: generalize flag passing to security_capable
+    - LSM: Make lsm_early_cred() and lsm_early_task() local functions.
+    - LSM: Make some functions static
+    - apparmor: Adjust offset when accessing task blob.
+    - LSM: Ignore "security=" when "lsm=" is specified
+    - LSM: Update list of SECURITYFS users in Kconfig
+    - apparmor: delete the dentry in aafs_remove() to avoid a leak
+    - apparmor: fix double free when unpack of secmark rules fails
+    - SAUCE: LSM: Infrastructure management of the sock security
+    - SAUCE: LSM: Limit calls to certain module hooks
+    - SAUCE: LSM: Special handling for secctx lsm hooks
+    - SAUCE: LSM: Specify which LSM to display with /proc/self/attr/display
+    - SAUCE: Fix-up af_unix mediation for sock infrastructure management
+    - SAUCE: Revert "apparmor: Fix warning about unused function
+      apparmor_ipv6_postroute"
+    - SAUCE: Revert "apparmor: fix checkpatch error in Parse secmark policy"
+    - SAUCE: Revert "apparmor: add #ifdef checks for secmark filtering"
+    - SAUCE: Revert "apparmor: Allow filtering based on secmark policy"
+    - SAUCE: Revert "apparmor: Parse secmark policy"
+    - SAUCE: Revert "apparmor: Add a wildcard secid"
+    - SAUCE: Revert "apparmor: fix bad debug check in apparmor_secid_to_secctx()"
+    - SAUCE: Revert "apparmor: fixup secid map conversion to using IDR"
+    - SAUCE: Revert "apparmor: Use an IDR to allocate apparmor secids"
+    - SAUCE: Revert "apparmor: Fix memory leak of rule on error exit path"
+    - SAUCE: Revert "apparmor: modify audit rule support to support profile
+      stacks"
+    - SAUCE: Revert "apparmor: Add support for audit rule filtering"
+    - SAUCE: Revert "apparmor: add the ability to get a task's secid"
+    - SAUCE: Revert "apparmor: add support for mapping secids and using secctxes"
+    - SAUCE: apparmor: add proc subdir to attrs
+    - SAUCE: apparmor: add an apparmorfs entry to access current attrs
+    - SAUCE: apparmor: update flags to no longer be exclusive
+    - SAUCE: update configs and annotations for LSM stacking
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_EARLY_PRINTK_USB_XDBC=y
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - [Config] CONFIG_RANDOM_TRUST_CPU=y
+    - [Config] refresh annotations for recent config changes
+    - ubuntu: vbox -- update to 6.0.4-dfsg-7
+    - Revert "UBUNTU: SAUCE: i2c:amd I2C Driver based on PCI Interface for
+      upcoming platform"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 04 Apr 2019 14:49:59 -0500
+
+linux (5.0.0-8.9) disco; urgency=medium
+
+  * linux: 5.0.0-8.9 -proposed tracker (LP: #1819759)
+
+  * hisi_sas: add debugfs support (LP: #1819500)
+    - scsi: hisi_sas: Create root and device debugfs directories
+    - scsi: hisi_sas: Alloc debugfs snapshot buffer memory for all registers
+    - scsi: hisi_sas: Take debugfs snapshot for all regs
+    - scsi: hisi_sas: Debugfs global register create file and add file operations
+    - scsi: hisi_sas: Add debugfs for port registers
+    - scsi: hisi_sas: Add debugfs CQ file and add file operations
+    - scsi: hisi_sas: Add debugfs DQ file and add file operations
+    - scsi: hisi_sas: Add debugfs IOST file and add file operations
+    - scsi: hisi_sas: No need to check return value of debugfs_create functions
+    - scsi: hisi_sas: Fix type casting and missing static qualifier in debugfs
+      code
+    - scsi: hisi_sas: Add debugfs ITCT file and add file operations
+
+  * [disco] hns driver updates from 5.1 merge window (LP: #1819535)
+    - net: hns: Use struct_size() in devm_kzalloc()
+    - net: hns3: modify enet reinitialization interface
+    - net: hns3: remove unused member in struct hns3_enet_ring
+    - net: hns3: remove unnecessary hns3_adjust_tqps_num
+    - net: hns3: reuse reinitialization interface in the hns3_set_channels
+    - net: hns3: add interface hclge_tm_bp_setup
+    - net: hns3: modify parameter checks in the hns3_set_channels
+    - net: hns3: remove redundant codes in hclge_knic_setup
+    - net: hns3: fix user configuration loss for ethtool -L
+    - net: hns3: adjust the use of alloc_tqps and num_tqps
+    - net: hns3: fix wrong combined count returned by ethtool -l
+    - net: hns3: do reinitialization while ETS configuration changed
+    - net: hns3: add HNAE3_RESTORE_CLIENT interface in enet module
+    - net: hns3: add calling roce callback function when link status change
+    - net: hns3: add rx multicast packets statistic
+    - net: hns3: refactor the statistics updating for netdev
+    - net: hns3: fix rss configuration lost problem when setting channel
+    - net: hns3: fix for shaper not setting when TC num changes
+    - net: hns3: fix bug of ethtool_ops.get_channels for VF
+    - net: hns3: clear param in ring when free ring
+    - net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED
+    - net: hns3: do not return GE PFC setting err when initializing
+    - net: hns3: add ETS TC weight setting in SSU module
+    - net: hns3: add statistics for PFC frames and MAC control frames
+    - net: hns3: fix PFC not setting problem for DCB module
+    - net: hns3: don't update packet statistics for packets dropped by hardware
+    - net: hns3: clear pci private data when unload hns3 driver
+    - net: hns3: add error handling in hclge_ieee_setets
+    - net: hns3: fix return value handle issue for hclge_set_loopback()
+    - net: hns3: fix broadcast promisc issue for revision 0x20
+    - net: hns3: After setting the loopback, add the status of getting MAC
+    - net: hns3: do reinitialization while mqprio configuration changed
+    - net: hns3: remove dcb_ops->map_update in hclge_dcb
+    - net: hns3: call hns3_nic_set_real_num_queue with netdev down
+    - net: hns3: add 8 BD limit for tx flow
+    - net: hns3: add initialization for nic state
+    - net: hns3: don't allow vf to enable promisc mode
+    - net: hns3: reuse the definition of l3 and l4 header info union
+    - net: hns3: fix VF dump register issue
+    - net: hns3: use the correct interface to stop|open port
+    - net: hns3: change hnae3_register_ae_dev() to int
+    - net: hns3: only support tc 0 for VF
+    - net: hns3: Fix NULL deref when unloading driver
+    - net: hns3: fix netif_napi_del() not do problem when unloading
+    - net: hns3: fix for rss result nonuniform
+    - net: hns3: fix improper error handling in the hclge_init_ae_dev()
+    - net: hns3: fix an issue for hclgevf_ae_get_hdev
+    - net: hns3: stop sending keep alive msg to PF when VF is resetting
+    - net: hns3: keep flow director state unchanged when reset
+    - net: hns3: Check for allocation failure
+    - net: hns3: fix a code style issue for hns3_update_new_int_gl()
+    - net: hns3: fix an issue for hns3_update_new_int_gl
+    - net: hns3: Modify parameter type from int to bool in set_gro_en
+    - net: hns3: code optimization for hclge_rx_buffer_calc
+    - net: hns3: add hclge_cmd_check_retval() to parse comman's return value
+    - net: hns3: move some set_bit statement into hclge_prepare_mac_addr
+    - net: hns3: fix a wrong checking in the hclge_tx_buffer_calc()
+    - net: hns3: fix the problem that the supported port is empty
+    - net: hns3: optimize the maximum TC macro
+    - net: hns3: don't allow user to change vlan filter state
+    - net: hns3: modify the upper limit judgment condition
+    - net: hns3: MAC table entry count function increases operation 0 value
+      protection measures
+    - net: hns3: make function hclge_set_all_vf_rst() static
+    - net: hns3: add pointer checking at the beginning of the exported functions.
+    - net: hns3: Check variable is valid before assigning it to another
+    - net: hns3: convert mac advertize and supported from u32 to link mode
+    - net: hns3: fix port info query issue for copper port
+    - net: hns3: modify print message of ssu common ecc errors
+    - net: hns3: some bugfix of ppu(rcb) ras errors
+    - net: hns3: enable 8~11th bit of mac common msi-x error
+    - net: hns3: fix 6th bit of ppp mpf abnormal errors
+    - net: hns3: Record VF unicast and multicast tables
+    - net: hns3: Record VF vlan tables
+    - net: hns3: uninitialize command queue while unloading PF driver
+    - net: hns3: clear command queue's registers when unloading VF driver
+    - net: hns3: add xps setting support for hns3 driver
+    - net: hns3: avoid mult + div op in critical data path
+    - net: hns3: limit some variable scope in critical data path
+    - net: hns3: remove some ops in struct hns3_nic_ops
+    - net: hns3: add unlikely for error handling in data path
+    - net: hns3: replace hnae3_set_bit and hnae3_set_field in data path
+    - net: hns3: remove hnae3_get_bit in data path
+    - net: hns3: add support to config depth for tx|rx ring separately
+    - net: hns3: enable VF VLAN filter for each VF when initializing
+    - net: hns3: fix get VF RSS issue
+    - net: hns3: fix setting of the hns reset_type for rdma hw errors
+    - net: hns3: fix improper error handling for hns3_client_start
+    - net: hns: use struct_size() in devm_kzalloc()
+    - net: hns3: Fix a logical vs bitwise typo
+    - net: hns3: add dma_rmb() for rx description
+    - net: hns3: fix to stop multiple HNS reset due to the AER changes
+
+  * Build Nvidia drivers in conjunction with kernel (LP: #1764792)
+    - [Packaging] dkms-build -- support building against packages in PPAs
+    - [Packaging] dkms-build: do not redownload files on subsequent passes
+    - [Packaging] dkms-build -- elide partial Built-Using information
+    - [Packaging] dkms-build -- remove retpoline data from final binary packages
+    - [Packaging] dkms-build--nvidia* -- check gcc version against primary build
+    - [Packaging] dkms-build -- add support for unversioned overrides
+    - [Packaging] dkms-build--nvidia-* -- convert to generic -N form
+    - [Packaging] fix-filenames -- handle exact string removal
+    - [Packaging] dkms-build--nvidia-N -- remove GCC versions
+
+  * Disco update: v5.0.1 upstream stable release (LP: #1819515)
+    - cpufreq: Use struct kobj_attribute instead of struct global_attr
+    - staging: erofs: fix mis-acted TAIL merging behavior
+    - binder: create node flag to request sender's security context
+    - USB: serial: option: add Telit ME910 ECM composition
+    - USB: serial: cp210x: add ID for Ingenico 3070
+    - USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
+    - driver core: Postpone DMA tear-down until after devres release
+    - staging: erofs: fix fast symlink w/o xattr when fs xattr is on
+    - staging: erofs: fix memleak of inode's shared xattr array
+    - staging: erofs: fix race of initializing xattrs of a inode at the same time
+    - staging: erofs: fix illegal address access under memory pressure
+    - staging: comedi: ni_660x: fix missing break in switch statement
+    - staging: wilc1000: fix to set correct value for 'vif_num'
+    - staging: android: ion: fix sys heap pool's gfp_flags
+    - staging: android: ashmem: Don't call fallocate() with ashmem_mutex held.
+    - staging: android: ashmem: Avoid range_alloc() allocation with ashmem_mutex
+      held.
+    - ip6mr: Do not call __IP6_INC_STATS() from preemptible context
+    - net: dsa: mv88e6xxx: add call to mv88e6xxx_ports_cmode_init to probe for new
+      DSA framework
+    - net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in
+      mv88e6xxx_port_set_duplex
+    - net: dsa: mv8e6xxx: fix number of internal PHYs for 88E6x90 family
+    - net: mscc: Enable all ports in QSGMII
+    - net: sched: put back q.qlen into a single location
+    - net-sysfs: Fix mem leak in netdev_register_kobject
+    - qmi_wwan: Add support for Quectel EG12/EM12
+    - sctp: call iov_iter_revert() after sending ABORT
+    - team: Free BPF filter when unregistering netdev
+    - tipc: fix RDM/DGRAM connect() regression
+    - x86/CPU/AMD: Set the CPB bit unconditionally on F17h
+    - x86/boot/compressed/64: Do not read legacy ROM on EFI system
+    - tracing: Fix event filters and triggers to handle negative numbers
+    - xhci: tegra: Prevent error pointer dereference
+    - usb: xhci: Fix for Enabling USB ROLE SWITCH QUIRK on
+      INTEL_SUNRISEPOINT_LP_XHCI
+    - applicom: Fix potential Spectre v1 vulnerabilities
+    - alpha: wire up io_pgetevents system call
+    - MIPS: irq: Allocate accurate order pages for irq stack
+    - aio: Fix locking in aio_poll()
+    - xtensa: fix get_wchan
+    - gnss: sirf: fix premature wakeup interrupt enable
+    - USB: serial: cp210x: fix GPIO in autosuspend
+    - Revert "selftests: firmware: add CONFIG_FW_LOADER_USER_HELPER_FALLBACK to
+      config"
+    - Revert "selftests: firmware: remove use of non-standard diff -Z option"
+    - selftests: firmware: fix verify_reqs() return value
+    - Bluetooth: btrtl: Restore old logic to assume firmware is already loaded
+    - Bluetooth: Fix locking in bt_accept_enqueue() for BH context
+    - Linux 5.0.1
+
+  * sky2 ethernet card doesn't work after returning from suspend
+    (LP: #1807259) // sky2 ethernet card link not up after suspend
+    (LP: #1809843) // Disco update: v5.0.1 upstream stable release
+    (LP: #1819515)
+    - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
+
+  * tls selftest failures/hangs on i386 (LP: #1813607)
+    - [Config] CONFIG_TLS=n for i386
+
+  * CVE-2019-8980
+    - exec: Fix mem leak in kernel_read_file
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: net: Use 'ipproto ipv6-icmp' to match ICMPv6 headers
+    - [Config] enable nvidia build
+    - [Config] update gcc version to 8.3
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: selftests: pmtu: disable accept_dad for tests"
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 12 Mar 2019 16:15:44 -0300
+
+linux (5.0.0-7.8) disco; urgency=medium
+
+  * linux: 5.0.0-7.8 -proposed tracker (LP: #1818519)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * unnecessary request_queue freeze (LP: #1815733)
+    - block: avoid setting nr_requests to current value
+    - block: avoid setting none scheduler if it's already none
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: net: Don't fail test_vxlan_under_vrf on xfail
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 04 Mar 2019 08:46:10 -0600
+
+linux (5.0.0-6.7) disco; urgency=medium
+
+  * linux: 5.0.0-6.7 -proposed tracker (LP: #1817585)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - [Packaging] resync getabis
+
+  * installer does not support iSCSI iBFT (LP: #1817321)
+    - d-i: add iscsi_ibft to scsi-modules
+
+  * Silent "Unknown key" message when pressing keyboard backlight hotkey
+    (LP: #1817063)
+    - platform/x86: dell-wmi: Ignore new keyboard backlight change event
+
+  * Fix I219 doesn't get woken up after plugging ethernet cable (LP: #1817058)
+    - e1000e: Disable runtime PM on CNP+
+
+  * efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted (LP: #1814982)
+    - efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted
+
+  * CVE-2019-3460
+    - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt
+
+  * CVE-2019-3459
+    - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer
+
+  * kernel net tls selftest fails on 5.0 (LP: #1816716)
+    - SAUCE: Revert "selftests/tls: Add test for recv(PEEK) spanning across
+      multiple records"
+
+  * Please enable CONFIG_DMA_CMA=y on arm64 (LP: #1803206)
+    - [Config] annotations -- enforce CONFIG_DMA_CMA and update notes
+
+  * [19.04 FEAT] [LS1801] PCI Virtual function enablement (LP: #1814684)
+    - s390/pci: map IOV resources
+    - s390/pci: improve bar check
+
+  * glibc 2.28-0ubuntu1 ADT test failure with linux 5.0.0-1.2 (LP: #1813060)
+    - SAUCE: prevent a glibc test failure when looking for obsolete types on
+      headers
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Enforce CONFIG_ZCRYPT_MULTIDEVNODES in annotations
+    - SAUCE: selftests: pmtu: disable accept_dad for tests
+    - SAUCE: arm64: add kernel config option to lock down when in Secure Boot mode
+    - SAUCE: selftests: net: Make test for VXLAN underlay in non-default VRF an
+      expected failure
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 25 Feb 2019 09:37:36 -0600
+
+linux (5.0.0-5.6) disco; urgency=medium
+
+  * [ALSA] [PATCH] System76 darp5 and oryp5 fixups (LP: #1815831)
+    - ALSA: hda/realtek - Headset microphone and internal speaker support for
+      System76 oryp5
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Fix aufs menus in annotations file
+    - [Config] CONFIG_SAMPLE_TRACE_PRINTK=m
+    - [Config] Update annotations based on configs
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 18 Feb 2019 10:04:11 +0100
+
+linux (5.0.0-4.5) disco; urgency=medium
+
+  * linux-buildinfo: pull out ABI information into its own package
+    (LP: #1806380)
+    - [Packaging] autoreconstruct -- base tag is always primary mainline version
+
+  * [Packaging] Allow overlay of config annotations (LP: #1752072)
+    - [Packaging] config-check: Add an include directive
+
+  * Miscellaneous Ubuntu changes
+    - hio -- stub out BIOVEC_PHYS_MERGEABLE for 4.20+
+    - hio -- replace use of do_gettimeofday()
+    - hio -- part_round_stats() removed in 5.0
+    - hio -- device_add_disk() grew a 'groups' argument in 4.20
+    - enable hio build
+    - Revert "UBUNTU: [Packaging] autoreconstruct -- base tag is always primary
+      mainline version"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 12 Feb 2019 08:15:32 -0600
+
+linux (5.0.0-3.4) disco; urgency=medium
+
+  * CONFIG_TEST_BPF is disabled (LP: #1813955)
+    - [Config]: Reenable TEST_BPF
+
+  * Ignore "incomplete report" from Elan touchpanels (LP: #1813733)
+    - HID: i2c-hid: Ignore input report if there's no data present on Elan
+      touchpanels
+
+  * SecureBoot support for arm64 (LP: #1804481)
+    - Build signed kernels for arm64
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: net: fix "from" match test in fib_rule_tests.sh
+    - [Config] CONFIG_PCMCIA=n for arm64 and s390x
+    - [Config] CONFIG_SERIAL_SC16IS7XX=n for s390x
+    - [Config] disable I2C TPM drivers for s390x
+    - [Config] CONFIG_RAPIDIO=n for s390x
+    - [Config] CONFIG_DMADEVICES=n for s390x
+    - [Config] disable gpio drivers for s390x
+    - [Config] CONFIG_SENSORS_OCC_P8_I2C=m for ppc64el
+    - [Config] disable I2C hardware drivers for s390x
+    - [Config] CONFIG_I3C=n for s390x
+    - [Config] CONFIG_SERIO=n for s390x
+    - [Config] disable misc drivers for s390x
+    - [Config] disable EEPROM drivers for s390x
+    - [Config] disable MFD drivers for s390x
+    - [Config] CONFIG_NVMEM=n for s390x
+    - [Config] CONFIG_MLXSW_I2C=n for s390x
+    - [Config] CONFIG_NET_VENDOR_MICROCHIP=n for s390x
+    - [Config] CONFIG_PPP=n for s390x
+    - [Config] CONFIG_PCCARD=n for s390x
+    - [Config] CONFIG_PCI_MESON=y
+    - [Config] CONFIG_SCSI_MYRB=n for s390x
+    - [Config] CONFIG_REGULATOR=n for s390x
+    - [Config] CONFIG_ZIIRAVE_WATCHDOG=n for s390x
+    - [Config] CONFIG_NCSI_OEM_CMD_GET_MAC=y
+    - [Config] update annotations following config review
+    - [Packaging] remove handoff check for uefi signing
+    - [Packaging] decompress gzipped efi images in signing tarball
+    - vbox-update: allow leading whitespace when fixing up KERN_DIR
+    - ubuntu: vbox -- update to 6.0.4-dfsg-3
+    - vbox: remove remount check in sf_read_super_aux()
+    - enable vbox build
+    - [Config] CONFIG_ANDROID_BINDER_DEVICES=""
+    - SAUCE: import aufs driver
+    - [Config]: Enable aufs
+    - [Config] relocate aufs annotations to menu
+    - [Config] remove unmatched configs from annotations
+    - [Config] fix up abi for removed modules
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) module: remove support for having IMA validate modules
+    - SAUCE: (efi-lockdown) Move EFI signature blob parser to shared location
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - [Config] (efi-lockdown) enable importing of efi certificates for module sig
+      verification
+
+  * Miscellaneous upstream changes
+    - binder: fix CONFIG_ANDROID_BINDER_DEVICES
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 05 Feb 2019 14:26:12 -0600
+
+linux (5.0.0-2.3) disco; urgency=medium
+
+  * kernel oops in bcache module (LP: #1793901)
+    - SAUCE: bcache: never writeback a discard operation
+
+  * Enable sound card power saving by default (LP: #1804265)
+    - [Config] CONFIG_SND_HDA_POWER_SAVE_DEFAULT=1
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: selftests: disable some failing networking tests"
+    - SAUCE: ashmem: turn into module
+    - SAUCE: binder: turn into module
+    - SAUCE: binder: give binder_alloc its own debug mask file
+    - [Config] enable binder and ashmem as modules
+    - SAUCE: selftests: net: replace AF_MAX with INT_MAX in socket.c
+    - SAUCE: selftests/ftrace: Fix tab expansion in trace_marker snapshot trigger
+      test
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 29 Jan 2019 06:57:32 -0600
+
+linux (5.0.0-1.2) disco; urgency=medium
+
+  * Fix non-working QCA Rome Bluetooth after S3 (LP: #1812812)
+    - USB: Add new USB LPM helpers
+    - USB: Consolidate LPM checks to avoid enabling LPM twice
+
+  * bluetooth controller not detected with 4.15 kernel (LP: #1810797)
+    - SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK
+    - [Config] arm64: snapdragon: BT_QCOMSMD_HACK=y
+
+  * [19.04 FEAT| Enable virtio-gpu for s390x (LP: #1799467)
+    - [Config] enable virtio-gpu for s390x
+
+  * Crash on "ip link add foo type ipip" (LP: #1811803)
+    - SAUCE: fan: Fix NULL pointer dereference
+
+  * Fix not working Goodix touchpad (LP: #1811929)
+    - HID: i2c-hid: Disable runtime PM on Goodix touchpad
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - enable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 22 Jan 2019 13:56:17 -0600
+
+linux (5.0.0-0.1) disco; urgency=medium
+
+  * Build Nvidia drivers in conjunction with kernel (LP: #1764792)
+    - [Packaging] dkms -- add per package post-process step
+    - [Packaging] dkms -- switch to a consistent build prefix length and strip
+    - [Packaging] nvidia -- build and sign nvidia packages and ship signatures
+    - [Packaging] nvidia -- make nvidia package version explicit
+
+  * Add support for ALC3277 codec on new Dell edge gateways (LP: #1807334)
+    - [Config] CONFIG_SND_SOC_INTEL_KBL_RT5660_MACH=m
+
+  * RTL8822BE WiFi Disabled in Kernel 4.18.0-12 (LP: #1806472)
+    - [Config] CONFIG_RTLWIFI_DEBUG_ST=n
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu -- disable vbox build
+    - ubuntu -- disable hio build
+    - Disable zfs build
+    - SAUCE: import aufs driver
+    - update dkms package versions
+    - [Config] disable aufs config options
+    - [Config] disable nvidia build
+    - update dropped.txt
+    - [Packaging] disable nvidia dkms builds for mainline
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - [Config] set config options for efi lockdown
+    - Revert "UBUNTU: SAUCE: import aufs driver"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 17 Jan 2019 12:31:29 -0600
+
+linux (5.0.0-0.0) disco; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 16 Jan 2019 14:48:05 -0600
+
+linux (4.20.0-2.3) disco; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.20
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 03 Jan 2019 12:11:43 -0600
+
+linux (4.20.0-1.2) disco; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Power leakage at S5 with Qualcomm Atheros QCA9377 802.11ac Wireless Network
+    Adapter (LP: #1805607)
+    - SAUCE: ath10k: provide reset function for QCA9377 chip
+
+  * zfs/spl build in conjunction with the kernel from DKMS source (LP: #1807378)
+    - [Packaging] dkms -- dkms package build packaging support
+    - [Packaging] dkms -- save build objects artifacts for validation
+    - [Packaging] dkms -- add general Built-Using: support
+    - [Packaging] simplify Provides comma handling
+    - [Packaging] zfs/spl -- remove packaging support for incorporated source
+    - [Packaging] zfs/spl -- remove incorporated source
+    - [Packaging] zfs/spl -- build via dkms
+    - [Packaging] zfs/spl -- make zfs package version explicit
+    - [Packaging] update-version-dkms -- sync archive versions to package
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] update-version-dkms -- fix getting distrbution from changelog
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.20-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 11 Dec 2018 11:33:08 -0600
+
+linux (4.20.0-0.1) disco; urgency=medium
+
+  * Overlayfs in user namespace leaks directory content of inaccessible
+    directories (LP: #1793458) // CVE-2018-6559
+    - Revert "ovl: relax permission checking on underlying layers"
+    - SAUCE: overlayfs: ensure mounter privileges when reading directories
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) Fix for module sig verification
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: Import aufs driver
+    - ubuntu: vbox -- update to 5.2.22-dfsg-2
+    - ubuntu -- disable vbox build
+    - ubuntu -- disable hio build
+    - Disable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.20-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 07 Dec 2018 07:13:42 -0600
+
+linux (4.20.0-0.0) disco; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 06 Dec 2018 10:20:19 -0600
+
+linux (4.19.0-8.9) disco; urgency=medium
+
+  * linux: 4.19.0-8.9 -proposed tracker (LP: #1806952)
+
+  * Workaround CSS timeout on AMD SNPS 3.0 xHC (LP: #1806838)
+    - xhci: workaround CSS timeout on AMD SNPS 3.0 xHC
+
+  * Fix Intel I210 doesn't work when ethernet cable gets plugged (LP: #1806818)
+    - igb: Fix an issue that PME is not enabled during runtime suspend
+
+  * The line-out on the Dell Dock station can't work (LP: #1806532)
+    - ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock
+
+  * CVE-2018-19407
+    - KVM: X86: Fix scan ioapic use-before-initialization
+
+  * PC SN720 NVMe WDC 256GB consumes more power in S2Idle than during long idle
+    (LP: #1805775)
+    - SAUCE: pci/nvme: prevent WDC PC SN720 NVMe from entering D3 and being
+      disabled
+
+  * Disco update: 4.19.6 upstream stable release (LP: #1806909)
+    - HID: steam: remove input device when a hid client is running.
+    - efi/libstub: arm: support building with clang
+    - usb: core: Fix hub port connection events lost
+    - usb: dwc3: gadget: fix ISOC TRB type on unaligned transfers
+    - usb: dwc3: gadget: Properly check last unaligned/zero chain TRB
+    - usb: dwc3: core: Clean up ULPI device
+    - usb: dwc3: Fix NULL pointer exception in dwc3_pci_remove()
+    - xhci: Fix leaking USB3 shared_hcd at xhci removal
+    - xhci: handle port status events for removed USB3 hcd
+    - xhci: Add check for invalid byte size error when UAS devices are connected.
+    - usb: xhci: fix uninitialized completion when USB3 port got wrong status
+    - usb: xhci: fix timeout for transition from RExit to U0
+    - xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc
+    - usb: xhci: Prevent bus suspend if a port connect change or polling state is
+      detected
+    - ALSA: oss: Use kvzalloc() for local buffer allocations
+    - MAINTAINERS: Add Sasha as a stable branch maintainer
+    - Documentation/security-bugs: Clarify treatment of embargoed information
+    - Documentation/security-bugs: Postpone fix publication in exceptional cases
+    - mmc: sdhci-pci: Try "cd" for card-detect lookup before using NULL
+    - mmc: sdhci-pci: Workaround GLK firmware failing to restore the tuning value
+    - gpio: don't free unallocated ida on gpiochip_add_data_with_key() error path
+    - iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE
+    - iwlwifi: mvm: support sta_statistics() even on older firmware
+    - iwlwifi: mvm: fix regulatory domain update when the firmware starts
+    - iwlwifi: mvm: don't use SAR Geo if basic SAR is not used
+    - brcmfmac: fix reporting support for 160 MHz channels
+    - opp: ti-opp-supply: Dynamically update u_volt_min
+    - opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call
+    - tools/power/cpupower: fix compilation with STATIC=true
+    - v9fs_dir_readdir: fix double-free on p9stat_read error
+    - selinux: Add __GFP_NOWARN to allocation at str_read()
+    - Input: synaptics - avoid using uninitialized variable when probing
+    - bfs: add sanity check at bfs_fill_super()
+    - sctp: clear the transport of some out_chunk_list chunks in
+      sctp_assoc_rm_peer
+    - gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
+    - llc: do not use sk_eat_skb()
+    - mm: don't warn about large allocations for slab
+    - mm/memory.c: recheck page table entry with page table lock held
+    - tcp: do not release socket ownership in tcp_close()
+    - drm/fb-helper: Blacklist writeback when adding connectors to fbdev
+    - drm/amdgpu: Add missing firmware entry for HAINAN
+    - drm/vc4: Set ->legacy_cursor_update to false when doing non-async updates
+    - drm/amdgpu: Fix oops when pp_funcs->switch_power_profile is unset
+    - drm/i915: Disable LP3 watermarks on all SNB machines
+    - drm/ast: change resolution may cause screen blurred
+    - drm/ast: fixed cursor may disappear sometimes
+    - drm/ast: Remove existing framebuffers before loading driver
+    - can: flexcan: Unlock the MB unconditionally
+    - can: dev: can_get_echo_skb(): factor out non sending code to
+      __can_get_echo_skb()
+    - can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to
+      access frame length
+    - can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb
+      is accessed out of bounds
+    - can: dev: __can_get_echo_skb(): print error message, if trying to echo non
+      existing skb
+    - can: rx-offload: introduce can_rx_offload_get_echo_skb() and
+      can_rx_offload_queue_sorted() functions
+    - can: rx-offload: rename can_rx_offload_irq_queue_err_skb() to
+      can_rx_offload_queue_tail()
+    - can: flexcan: use can_rx_offload_queue_sorted() for flexcan_irq_bus_*()
+    - can: flexcan: handle tx-complete CAN frames via rx-offload infrastructure
+    - can: raw: check for CAN FD capable netdev in raw_sendmsg()
+    - can: hi311x: Use level-triggered interrupt
+    - can: flexcan: Always use last mailbox for TX
+    - can: flexcan: remove not needed struct flexcan_priv::tx_mb and struct
+      flexcan_priv::tx_mb_idx
+    - ACPICA: AML interpreter: add region addresses in global list during
+      initialization
+    - IB/hfi1: Eliminate races in the SDMA send error path
+    - fsnotify: generalize handling of extra event flags
+    - fanotify: fix handling of events on child sub-directory
+    - pinctrl: meson: fix pinconf bias disable
+    - pinctrl: meson: fix gxbb ao pull register bits
+    - pinctrl: meson: fix gxl ao pull register bits
+    - pinctrl: meson: fix meson8 ao pull register bits
+    - pinctrl: meson: fix meson8b ao pull register bits
+    - tools/testing/nvdimm: Fix the array size for dimm devices.
+    - scsi: lpfc: fix remoteport access
+    - scsi: hisi_sas: Remove set but not used variable 'dq_list'
+    - KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
+    - cpufreq: imx6q: add return value check for voltage scale
+    - rtc: cmos: Do not export alarm rtc_ops when we do not support alarms
+    - rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write
+    - crypto: simd - correctly take reqsize of wrapped skcipher into account
+    - floppy: fix race condition in __floppy_read_block_0()
+    - powerpc/io: Fix the IO workarounds code to work with Radix
+    - sched/fair: Fix cpu_util_wake() for 'execl' type workloads
+    - perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs
+    - block: copy ioprio in __bio_clone_fast() and bounce
+    - SUNRPC: Fix a bogus get/put in generic_key_to_expire()
+    - riscv: add missing vdso_install target
+    - RISC-V: Silence some module warnings on 32-bit
+    - drm/amdgpu: fix bug with IH ring setup
+    - kdb: Use strscpy with destination buffer size
+    - NFSv4: Fix an Oops during delegation callbacks
+    - powerpc/numa: Suppress "VPHN is not supported" messages
+    - efi/arm: Revert deferred unmap of early memmap mapping
+    - z3fold: fix possible reclaim races
+    - mm, memory_hotplug: check zone_movable in has_unmovable_pages
+    - tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
+    - mm, page_alloc: check for max order in hot path
+    - dax: Avoid losing wakeup in dax_lock_mapping_entry
+    - include/linux/pfn_t.h: force '~' to be parsed as an unary operator
+    - tty: wipe buffer.
+    - tty: wipe buffer if not echoing data
+    - gfs2: Fix iomap buffer head reference counting bug
+    - rcu: Make need_resched() respond to urgent RCU-QS needs
+    - media: ov5640: Re-work MIPI startup sequence
+    - media: ov5640: Fix timings setup code
+    - media: ov5640: fix exposure regression
+    - media: ov5640: fix auto gain & exposure when changing mode
+    - media: ov5640: fix wrong binning value in exposure calculation
+    - media: ov5640: fix auto controls values when switching to manual mode
+    - Linux 4.19.6
+
+  * linux-buildinfo: pull out ABI information into its own package
+    (LP: #1806380)
+    - [Packaging] limit preparation to linux-libc-dev in headers
+    - [Packaging] commonise debhelper invocation
+    - [Packaging] ABI -- accumulate abi information at the end of the build
+    - [Packaging] buildinfo -- add basic build information
+    - [Packaging] buildinfo -- add firmware information to the flavour ABI
+    - [Packaging] buildinfo -- add compiler information to the flavour ABI
+    - [Packaging] buildinfo -- add buildinfo support to getabis
+    - [Packaging] getabis -- handle all known package combinations
+    - [Packaging] getabis -- support parsing a simple version
+
+  * linux packages should own /usr/lib/linux/triggers (LP: #1770256)
+    - [Packaging] own /usr/lib/linux/triggers
+
+  * Miscellaneous upstream changes
+    - blk-mq: fix corruption with direct issue
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 05 Dec 2018 09:18:30 -0600
+
+linux (4.19.0-7.8) disco; urgency=medium
+
+  * linux: 4.19.0-7.8 -proposed tracker (LP: #1805465)
+
+  * Fix and issue that LG I2C touchscreen stops working after reboot
+    (LP: #1805085)
+    - HID: i2c-hid: Disable runtime PM for LG touchscreen
+
+  * click/pop noise in the headphone on several lenovo laptops (LP: #1805079) //
+    click/pop noise in the headphone on several lenovo laptops (LP: #1805079)
+    - ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops
+
+  * Regression: hinic performance degrades over time (LP: #1805248)
+    - Revert "net-next/hinic: add checksum offload and TSO support"
+
+  * Disco update: 4.19.5 upstream stable release (LP: #1805461)
+    - drm/i915: Replace some PAGE_SIZE with I915_GTT_PAGE_SIZE
+    - cifs: don't dereference smb_file_target before null check
+    - cifs: fix return value for cifs_listxattr
+    - arm64: kprobe: make page to RO mode when allocate it
+    - block: brd: associate with queue until adding disk
+    - net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset()
+    - net: hns3: bugfix for rtnl_lock's range in the hclge_reset()
+    - net: hns3: bugfix for handling mailbox while the command queue reinitialized
+    - net: hns3: bugfix for the initialization of command queue's spin lock
+    - ixgbe: fix MAC anti-spoofing filter after VFLR
+    - reiserfs: propagate errors from fill_with_dentries() properly
+    - hfs: prevent btree data loss on root split
+    - hfsplus: prevent btree data loss on root split
+    - perf unwind: Take pgoff into account when reporting elf to libdwfl
+    - um: Give start_idle_thread() a return code
+    - drm/edid: Add 6 bpc quirk for BOE panel.
+    - afs: Handle EIO from delivery function
+    - platform/x86: intel_telemetry: report debugfs failure
+    - clk: fixed-rate: fix of_node_get-put imbalance
+    - perf symbols: Set PLT entry/header sizes properly on Sparc
+    - fs/exofs: fix potential memory leak in mount option parsing
+    - clk: samsung: exynos5420: Enable PERIS clocks for suspend
+    - apparmor: Fix uninitialized value in aa_split_fqname
+    - x86/earlyprintk: Add a force option for pciserial device
+    - platform/x86: acerhdf: Add BIOS entry for Gateway LT31 v1.3307
+    - clk: meson-axg: pcie: drop the mpll3 clock parent
+    - arm64: percpu: Initialize ret in the default case
+    - clk: meson: clk-pll: drop CLK_GET_RATE_NOCACHE where unnecessary
+    - clk: renesas: r9a06g032: Fix UART34567 clock rate
+    - clk: ti: fix OF child-node lookup
+    - serial: sh-sci: Fix receive on SCIFA/SCIFB variants with DMA
+    - netfilter: ipv6: fix oops when defragmenting locally generated fragments
+    - netfilter: bridge: define INT_MIN & INT_MAX in userspace
+    - s390/decompressor: add missing FORCE to build targets
+    - s390/vdso: add missing FORCE to build targets
+    - HID: i2c-hid: Add a small delay after sleep command for Raydium touchpanel
+    - Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS"
+    - HID: alps: allow incoming reports when only the trackstick is opened
+    - Revert "netfilter: nft_numgen: add map lookups for numgen random operations"
+    - netfilter: ipset: list:set: Decrease refcount synchronously on deletion and
+      replace
+    - netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net
+    - netfilter: ipset: fix ip_set_list allocation failure
+    - s390/mm: fix mis-accounting of pgtable_bytes
+    - s390/mm: Fix ERROR: "__node_distance" undefined!
+    - bpf: fix bpf_prog_get_info_by_fd to return 0 func_lens for unpriv
+    - netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment()
+    - netfilter: xt_IDLETIMER: add sysfs filename checking routine
+    - netfilter: ipset: Fix calling ip_set() macro at dumping
+    - netfilter: nft_compat: ebtables 'nat' table is normal chain type
+    - s390/qeth: fix HiperSockets sniffer
+    - s390/qeth: unregister netdevice only when registered
+    - net: hns3: Fix for out-of-bounds access when setting pfc back pressure
+    - hwmon: (ibmpowernv) Remove bogus __init annotations
+    - ARM: dts: imx6sll: fix typo for fsl,imx6sll-i2c node
+    - ARM: dts: fsl: Fix improperly quoted stdout-path values
+    - Revert "drm/exynos/decon5433: implement frame counter"
+    - arm64: dts: renesas: r8a7795: add missing dma-names on hscif2
+    - arm64: dts: renesas: condor: switch from EtherAVB to GEther
+    - xen/grant-table: Fix incorrect gnttab_dma_free_pages() pr_debug message
+    - clk: fixed-factor: fix of_node_get-put imbalance
+    - mtd: nand: Fix nanddev_pos_next_page() kernel-doc header
+    - lib/raid6: Fix arm64 test build
+    - drm/amd/display: Stop leaking planes
+    - block: Clear kernel memory before copying to user
+    - drm/amd/display: Drop reusing drm connector for MST
+    - drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder()
+    - s390/perf: Change CPUM_CF return code in event init function
+    - ceph: quota: fix null pointer dereference in quota check
+    - of/device: Really only set bus DMA mask when appropriate
+    - nvme: make sure ns head inherits underlying device limits
+    - i2c: omap: Enable for ARCH_K3
+    - i2c: qcom-geni: Fix runtime PM mismatch with child devices
+    - sched/core: Take the hotplug lock in sched_init_smp()
+    - perf tools: Fix undefined symbol scnprintf in libperf-jvmti.so
+    - perf tools: Do not zero sample_id_all for group members
+    - ice: Fix dead device link issue with flow control
+    - ice: Fix the bytecount sent to netdev_tx_sent_queue
+    - ice: Change req_speeds to be u16
+    - i40e: restore NETIF_F_GSO_IPXIP[46] to netdev features
+    - qed: Fix memory/entry leak in qed_init_sp_request()
+    - qed: Fix blocking/unlimited SPQ entries leak
+    - qed: Fix SPQ entries not returned to pool in error flows
+    - qed: Fix potential memory corruption
+    - net: stmmac: Fix RX packet size > 8191
+    - net: aquantia: fix potential IOMMU fault after driver unbind
+    - net: aquantia: fixed enable unicast on 32 macvlan
+    - net: aquantia: invalid checksumm offload implementation
+    - kbuild: deb-pkg: fix too low build version number
+    - Revert "scripts/setlocalversion: git: Make -dirty check more robust"
+    - SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer()
+    - x86/mm: Move LDT remap out of KASLR region on 5-level paging
+    - x86/ldt: Unmap PTEs for the slot before freeing LDT pages
+    - x86/ldt: Remove unused variable in map_ldt_struct()
+    - media: v4l: event: Add subscription to list before calling "add" operation
+    - MIPS: OCTEON: cavium_octeon_defconfig: re-enable OCTEON USB driver
+    - RISC-V: Fix raw_copy_{to,from}_user()
+    - uio: Fix an Oops on load
+    - ALSA: hda/realtek - Add quirk entry for HP Pavilion 15
+    - ALSA: hda/ca0132 - Call pci_iounmap() instead of iounmap()
+    - can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit()
+    - can: kvaser_usb: Fix potential uninitialized variable use
+    - usb: cdc-acm: add entry for Hiro (Conexant) modem
+    - USB: Wait for extra delay time after USB_PORT_FEAT_RESET for quirky hub
+    - usb: quirks: Add delay-init quirk for Corsair K70 LUX RGB
+    - misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
+    - USB: misc: appledisplay: add 20" Apple Cinema Display
+    - gnss: serial: fix synchronous write timeout
+    - gnss: sirf: fix synchronous write timeout
+    - mtd: rawnand: atmel: fix OF child-node lookup
+    - drivers/misc/sgi-gru: fix Spectre v1 vulnerability
+    - ACPI / platform: Add SMB0001 HID to forbidden_id_list
+    - HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges
+    - HID: Add quirk for Primax PIXART OEM mice
+    - HID: Add quirk for Microsoft PIXART OEM mouse
+    - libceph: fall back to sendmsg for slab pages
+    - mt76x0: run vco calibration for each channel configuration
+    - Linux 4.19.5
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: Build signed kernels for arm64"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 27 Nov 2018 10:38:34 -0600
+
+linux (4.19.0-6.7) disco; urgency=medium
+
+  * linux: 4.19.0-6.7 -proposed tracker (LP: #1805195)
+
+  * SecureBoot support for arm64 (LP: #1804481)
+    - Build signed kernels for arm64
+
+  * Add pointstick support for Cirque Touchpad (LP: #1805081)
+    - HID: multitouch: Add pointstick support for Cirque Touchpad
+
+  * Power consumption during s2idle is higher than long idle (Intel SSDPEKKF)
+    (LP: #1804588)
+    - SAUCE: pci: prevent Intel NVMe SSDPEKKF from entering D3
+    - SAUCE: nvme: add quirk to not call disable function when suspending
+
+  * Disco update: 4.19.4 upstream stable release (LP: #1805159)
+    - flow_dissector: do not dissect l4 ports for fragments
+    - ibmvnic: fix accelerated VLAN handling
+    - ip_tunnel: don't force DF when MTU is locked
+    - ipv6: fix a dst leak when removing its exception
+    - ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF
+    - net: bcmgenet: protect stop from timeout
+    - net-gro: reset skb->pkt_type in napi_reuse_skb()
+    - sctp: not allow to set asoc prsctp_enable by sockopt
+    - tcp: Fix SOF_TIMESTAMPING_RX_HARDWARE to use the latest timestamp during TCP
+      coalescing
+    - tg3: Add PHY reset for 5717/5719/5720 in change ring and flow control paths
+    - tipc: don't assume linear buffer when reading ancillary data
+    - tipc: fix lockdep warning when reinitilaizing sockets
+    - tuntap: fix multiqueue rx
+    - net: systemport: Protect stop from timeout
+    - net/sched: act_pedit: fix memory leak when IDR allocation fails
+    - net: sched: cls_flower: validate nested enc_opts_policy to avoid warning
+    - tipc: fix link re-establish failure
+    - net/mlx5e: Don't match on vlan non-existence if ethertype is wildcarded
+    - net/mlx5e: Claim TC hw offloads support only under a proper build config
+    - net/mlx5e: Adjust to max number of channles when re-attaching
+    - net/mlx5e: RX, verify received packet size in Linear Striding RQ
+    - Revert "sctp: remove sctp_transport_pmtu_check"
+    - net/mlx5e: Always use the match level enum when parsing TC rule match
+    - net/mlx5e: Fix selftest for small MTUs
+    - net/mlx5e: Removed unnecessary warnings in FEC caps query
+    - inet: frags: better deal with smp races
+    - l2tp: fix a sock refcnt leak in l2tp_tunnel_register
+    - net/mlx5: IPSec, Fix the SA context hash key
+    - net/mlx5e: IPoIB, Reset QP after channels are closed
+    - net: dsa: mv88e6xxx: Fix clearing of stats counters
+    - net: phy: realtek: fix RTL8201F sysfs name
+    - sctp: define SCTP_SS_DEFAULT for Stream schedulers
+    - net: qualcomm: rmnet: Fix incorrect assignment of real_dev
+    - net: dsa: microchip: initialize mutex before use
+    - sctp: fix strchange_flags name for Stream Change Event
+    - net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs
+    - sctp: not increase stream's incnt before sending addstrm_in request
+    - mlxsw: spectrum: Fix IP2ME CPU policer configuration
+    - net: smsc95xx: Fix MTU range
+    - rxrpc: Fix lockup due to no error backoff after ack transmit error
+    - usbnet: smsc95xx: disable carrier check while suspending
+    - Revert "x86/speculation: Enable cross-hyperthread spectre v2 STIBP
+      mitigation"
+    - Linux 4.19.4
+
+  * Disco update: 4.19.3 upstream stable release (LP: #1805158)
+    - powerpc/traps: restore recoverability of machine_check interrupts
+    - powerpc/64/module: REL32 relocation range check
+    - powerpc/mm: Fix page table dump to work on Radix
+    - powerpc/mm: fix always true/false warning in slice.c
+    - drm/amd/display: fix bug of accessing invalid memory
+    - Input: wm97xx-ts - fix exit path
+    - powerpc/Makefile: Fix PPC_BOOK3S_64 ASFLAGS
+    - powerpc/eeh: Fix possible null deref in eeh_dump_dev_log()
+    - tty: check name length in tty_find_polling_driver()
+    - tracing/kprobes: Check the probe on unloaded module correctly
+    - drm/nouveau/secboot/acr: fix memory leak
+    - drm/amdgpu/powerplay: fix missing break in switch statements
+    - ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL
+    - powerpc/nohash: fix undefined behaviour when testing page size support
+    - drm/msm/gpu: fix parameters in function msm_gpu_crashstate_capture
+    - drm/msm/disp/dpu: Use proper define for drm_encoder_init() 'encoder_type'
+    - drm/msm: dpu: Allow planes to extend past active display
+    - powerpc/mm: Don't report hugepage tables as memory leaks when using kmemleak
+    - drm/omap: fix memory barrier bug in DMM driver
+    - drm/amd/display: Raise dispclk value for dce120 by 15%
+    - drm/amd/display: fix gamma not being applied
+    - drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer
+    - media: pci: cx23885: handle adding to list failure
+    - media: coda: don't overwrite h.264 profile_idc on decoder instance
+    - MIPS: kexec: Mark CPU offline before disabling local IRQ
+    - powerpc/boot: Ensure _zimage_start is a weak symbol
+    - powerpc/memtrace: Remove memory in chunks
+    - MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS
+    - staging: erofs: fix a missing endian conversion
+    - serial: 8250_of: Fix for lack of interrupt support
+    - sc16is7xx: Fix for multi-channel stall
+    - media: tvp5150: fix width alignment during set_selection()
+    - powerpc/selftests: Wait all threads to join
+    - staging:iio:ad7606: fix voltage scales
+    - drm: rcar-du: Update Gen3 output limitations
+    - drm/amdgpu: Fix SDMA TO after GPU reset v3
+    - staging: most: video: fix registration of an empty comp core_component
+    - 9p locks: fix glock.client_id leak in do_lock
+    - udf: Prevent write-unsupported filesystem to be remounted read-write
+    - ARM: dts: imx6ull: keep IMX6UL_ prefix for signals on both i.MX6UL and
+      i.MX6ULL
+    - media: ov5640: fix mode change regression
+    - 9p: clear dangling pointers in p9stat_free
+    - drm/amdgpu: fix integer overflow test in amdgpu_bo_list_create()
+    - media: ov5640: fix restore of last mode set
+    - cdrom: fix improper type cast, which can leat to information leak.
+    - ovl: fix error handling in ovl_verify_set_fh()
+    - ovl: fix recursive oi->lock in ovl_link()
+    - ovl: check whiteout in ovl_create_over_whiteout()
+    - ovl: automatically enable redirect_dir on metacopy=on
+    - serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout
+    - scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
+    - scsi: qla2xxx: Fix process response queue for ISP26XX and above
+    - scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx
+    - scsi: qla2xxx: Fix early srb free on abort
+    - scsi: qla2xxx: shutdown chip if reset fail
+    - scsi: qla2xxx: Reject bsg request if chip is down.
+    - scsi: qla2xxx: Fix re-using LoopID when handle is in use
+    - scsi: qla2xxx: Fix for double free of SRB structure
+    - scsi: qla2xxx: Fix NVMe session hang on unload
+    - scsi: qla2xxx: Fix NVMe Target discovery
+    - scsi: qla2xxx: Fix duplicate switch database entries
+    - scsi: qla2xxx: Fix driver hang when FC-NVMe LUNs are configured
+    - vfs: fix FIGETBSZ ioctl on an overlayfs file
+    - fuse: Fix use-after-free in fuse_dev_do_read()
+    - fuse: Fix use-after-free in fuse_dev_do_write()
+    - fuse: fix blocked_waitq wakeup
+    - fuse: set FR_SENT while locked
+    - drm/msm: fix OF child-node lookup
+    - arm64: dts: stratix10: Support Ethernet Jumbo frame
+    - arm64: dts: stratix10: fix multicast filtering
+    - clk: meson-gxbb: set fclk_div3 as CLK_IS_CRITICAL
+    - clk: meson: axg: mark fdiv2 and fdiv3 as critical
+    - zram: close udev startup race condition as default groups
+    - MIPS: Loongson-3: Fix CPU UART irq delivery problem
+    - MIPS: Loongson-3: Fix BRIDGE irq delivery problem
+    - xtensa: add NOTES section to the linker script
+    - xtensa: make sure bFLT stack is 16 byte aligned
+    - xtensa: fix boot parameters address translation
+    - um: Drop own definition of PTRACE_SYSEMU/_SINGLESTEP
+    - clk: s2mps11: Fix matching when built as module and DT node contains
+      compatible
+    - clk: at91: Fix division by zero in PLL recalc_rate()
+    - clk: sunxi-ng: h6: fix bus clocks' divider position
+    - clk: rockchip: fix wrong mmc sample phase shift for rk3328
+    - clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call
+    - libceph: bump CEPH_MSG_MAX_DATA_LEN
+    - Revert "ceph: fix dentry leak in splice_dentry()"
+    - thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs
+    - mach64: fix display corruption on big endian machines
+    - mach64: fix image corruption due to reading accelerator registers
+    - acpi/nfit, x86/mce: Handle only uncorrectable machine checks
+    - acpi/nfit, x86/mce: Validate a MCE's address before using it
+    - acpi, nfit: Fix ARS overflow continuation
+    - reset: hisilicon: fix potential NULL pointer dereference
+    - crypto: hisilicon - Fix NULL dereference for same dst and src
+    - crypto: hisilicon - Fix reference after free of memories on error path
+    - vhost/scsi: truncate T10 PI iov_iter to prot_bytes
+    - scsi: qla2xxx: Initialize port speed to avoid setting lower speed
+    - SCSI: fix queue cleanup race before queue initialization is done
+    - Revert "powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED for
+      CONFIG_SWAP"
+    - soc: ti: QMSS: Fix usage of irq_set_affinity_hint
+    - ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry
+    - ocfs2: free up write context when direct IO failed
+    - mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
+    - memory_hotplug: cond_resched in __remove_pages
+    - netfilter: conntrack: fix calculation of next bucket number in early_drop
+    - ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm
+    - bonding/802.3ad: fix link_failure_count tracking
+    - mtd: spi-nor: cadence-quadspi: Return error code in
+      cqspi_direct_read_execute()
+    - mtd: nand: Fix nanddev_neraseblocks()
+    - mtd: docg3: don't set conflicting BCH_CONST_PARAMS option
+    - hwmon: (core) Fix double-free in __hwmon_device_register()
+    - perf cs-etm: Correct CPU mode for samples
+    - perf stat: Handle different PMU names with common prefix
+    - perf callchain: Honour the ordering of PERF_CONTEXT_{USER,KERNEL,etc}
+    - perf intel-pt/bts: Calculate cpumode for synthesized samples
+    - perf intel-pt: Insert callchain context into synthesized callchains
+    - of, numa: Validate some distance map rules
+    - x86/cpu/vmware: Do not trace vmware_sched_clock()
+    - x86/hyper-v: Enable PIT shutdown quirk
+    - termios, tty/tty_baudrate.c: fix buffer overrun
+    - arch/alpha, termios: implement BOTHER, IBSHIFT and termios2
+    - watchdog/core: Add missing prototypes for weak functions
+    - btrfs: fix pinned underflow after transaction aborted
+    - Btrfs: fix missing data checksums after a ranged fsync (msync)
+    - Btrfs: fix cur_offset in the error case for nocow
+    - Btrfs: fix infinite loop on inode eviction after deduplication of eof block
+    - Btrfs: fix data corruption due to cloning of eof block
+    - btrfs: tree-checker: Fix misleading group system information
+    - clockevents/drivers/i8253: Add support for PIT shutdown quirk
+    - ext4: add missing brelse() update_backups()'s error path
+    - ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path
+    - ext4: add missing brelse() add_new_gdb_meta_bg()'s error path
+    - ext4: avoid potential extra brelse in setup_new_flex_group_blocks()
+    - ext4: missing !bh check in ext4_xattr_inode_write()
+    - ext4: fix possible inode leak in the retry loop of ext4_resize_fs()
+    - ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty()
+    - ext4: avoid buffer leak in ext4_orphan_add() after prior errors
+    - ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing
+    - ext4: avoid possible double brelse() in add_new_gdb() on error path
+    - ext4: fix possible leak of sbi->s_group_desc_leak in error path
+    - ext4: fix possible leak of s_journal_flag_rwsem in error path
+    - ext4: fix buffer leak in ext4_xattr_get_block() on error path
+    - ext4: release bs.bh before re-using in ext4_xattr_block_find()
+    - ext4: fix buffer leak in ext4_xattr_move_to_block() on error path
+    - ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path
+    - ext4: fix buffer leak in __ext4_read_dirblock() on error path
+    - mount: Prevent MNT_DETACH from disconnecting locked mounts
+    - mnt: fix __detach_mounts infinite loop
+    - uapi: fix linux/kfd_ioctl.h userspace compilation errors
+    - ARM: cpuidle: Don't register the driver when back-end init returns -ENXIO
+    - kdb: use correct pointer when 'btc' calls 'btt'
+    - kdb: print real address of pointers instead of hashed addresses
+    - sunrpc: correct the computation for page_ptr when truncating
+    - NFSv4: Don't exit the state manager without clearing
+      NFS4CLNT_MANAGER_RUNNING
+    - nfsd: COPY and CLONE operations require the saved filehandle to be set
+    - rtc: hctosys: Add missing range error reporting
+    - fuse: fix use-after-free in fuse_direct_IO()
+    - fuse: fix leaked notify reply
+    - fuse: fix possibly missed wake-up after abort
+    - selinux: check length properly in SCTP bind hook
+    - gfs2: Put bitmap buffers in put_super
+    - gfs2: Fix metadata read-ahead during truncate (2)
+    - libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD
+    - crypto: user - fix leaking uninitialized memory to userspace
+    - lib/ubsan.c: don't mark __ubsan_handle_builtin_unreachable as noreturn
+    - hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444!
+    - mm/swapfile.c: use kvzalloc for swap_info_struct allocation
+    - efi/arm/libstub: Pack FDT after populating it
+    - mm: don't reclaim inodes with many attached pages
+    - scripts/spdxcheck.py: make python3 compliant
+    - drm/rockchip: Allow driver to be shutdown on reboot/kexec
+    - drm/amdgpu: Fix typo in amdgpu_vmid_mgr_init
+    - drm/amdgpu: add missing CHIP_HAINAN in amdgpu_ucode_get_load_type
+    - drm/amdgpu: Suppress keypresses from ACPI_VIDEO events
+    - drm/nouveau: Check backlight IDs are >= 0, not > 0
+    - drm/nouveau: Fix nv50_mstc->best_encoder()
+    - drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD
+    - drm/etnaviv: fix bogus fence complete check in timeout handler
+    - drm/dp_mst: Check if primary mstb is null
+    - drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003)
+    - drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit
+      panel's native mode
+    - drm/i915: Use the correct crtc when sanitizing plane mapping
+    - drm/i915: Restore vblank interrupts earlier
+    - drm/i915: Don't unset intel_connector->mst_port
+    - drm/i915: Skip vcpi allocation for MSTB ports that are gone
+    - drm/i915: Large page offsets for pread/pwrite
+    - drm/i915/dp: Fix link retraining comment in intel_dp_long_pulse()
+    - drm/i915/dp: Restrict link retrain workaround to external monitors
+    - drm/i915/icl: Fix the macros for DFLEXDPMLE register bits
+    - drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values
+    - drm/i915: Mark up GTT sizes as u64
+    - drm/i915: Fix error handling for the NV12 fb dimensions check
+    - drm/i915: Fix ilk+ watermarks when disabling pipes
+    - drm/i915: Compare user's 64b GTT offset even on 32b
+    - drm/i915: Don't oops during modeset shutdown after lpe audio deinit
+    - drm/i915: Mark pin flags as u64
+    - drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5
+    - drm/i915/execlists: Force write serialisation into context image vs
+      execution
+    - drm/i915: Fix possible race in intel_dp_add_mst_connector()
+    - drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST
+    - drm/i915: Fix hpd handling for pins with two encoders
+    - CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM
+    - Revert "ACPICA: AML interpreter: add region addresses in global list during
+      initialization"
+    - Linux 4.19.3
+
+  * glibc 2.28-0ubuntu1 ADT test failure with linux 4.19.0-5.6 (LP: #1805154)
+    - SAUCE: Revert "x86: vdso: Use $LD instead of $CC to link"
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.12-1ubuntu1, zfs to 0.7.12-1ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Nov 2018 11:44:00 -0600
+
+linux (4.19.0-5.6) disco; urgency=medium
+
+  * crash in ENA driver on removing an interface (LP: #1802341)
+    - SAUCE: net: ena: fix crash during ena_remove()
+
+  * Ubuntu 18.04.1 - [s390x] Kernel panic while stressing network bonding
+    (LP: #1797367)
+    - s390/qeth: sanitize strings in debug messages
+
+  * Disco update: 4.19.2 upstream stable release (LP: #1803410)
+    - bpf: fix partial copy of map_ptr when dst is scalar
+    - MIPS: VDSO: Reduce VDSO_RANDOMIZE_SIZE to 64MB for 64bit
+    - gpio: mxs: Get rid of external API call
+    - mtd: rawnand: marvell: fix the IRQ handler complete() condition
+    - mtd: maps: gpio-addr-flash: Fix ioremapped size
+    - mtd: spi-nor: fsl-quadspi: fix read error for flash size larger than 16MB
+    - mtd: spi-nor: intel-spi: Add support for Intel Ice Lake SPI serial flash
+    - mtd: spi-nor: fsl-quadspi: Don't let -EINVAL on the bus
+    - spi: spi-mem: Adjust op len based on message/transfer size limitations
+    - spi: bcm-qspi: switch back to reading flash using smaller chunks
+    - spi: bcm-qspi: fix calculation of address length
+    - bcache: trace missed reading by cache_missed
+    - bcache: fix ioctl in flash device
+    - bcache: correct dirty data statistics
+    - bcache: fix miss key refill->end in writeback
+    - hwmon: (pmbus) Fix page count auto-detection.
+    - jffs2: free jffs2_sb_info through jffs2_kill_sb()
+    - block: setup bounce bio_sets properly
+    - block: make sure discard bio is aligned with logical block size
+    - block: make sure writesame bio is aligned with logical block size
+    - cpufreq: conservative: Take limits changes into account properly
+    - dma-mapping: fix panic caused by passing empty cma command line argument
+    - pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
+    - ACPI / OSL: Use 'jiffies' as the time bassis for acpi_os_get_timer()
+    - ACPICA: AML interpreter: add region addresses in global list during
+      initialization
+    - ACPICA: AML Parser: fix parse loop to correctly skip erroneous extended
+      opcodes
+    - acpi, nfit: Fix Address Range Scrub completion tracking
+    - kprobes/x86: Use preempt_enable() in optimized_callback()
+    - mailbox: PCC: handle parse error
+    - parisc: Fix address in HPMC IVA
+    - parisc: Fix map_pages() to not overwrite existing pte entries
+    - parisc: Fix exported address of os_hpmc handler
+    - ALSA: hda - Add quirk for ASUS G751 laptop
+    - ALSA: hda - Fix headphone pin config for ASUS G751
+    - ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905)
+    - ALSA: hda: Add 2 more models to the power_save blacklist
+    - ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops
+    - ALSA: hda - Fix incorrect clearance of thinkpad_acpi hooks
+    - x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
+    - x86/xen: Fix boot loader version reported for PVH guests
+    - x86/corruption-check: Fix panic in memory_corruption_check() when boot
+      option without value is provided
+    - x86/kvm/nVMX: allow bare VMXON state migration
+    - x86/mm/pat: Disable preemption around __flush_tlb_all()
+    - x86/numa_emulation: Fix uniform-split numa emulation
+    - ARM: dts: exynos: Disable pull control for MAX8997 interrupts on Origen
+    - net: socionext: Reset tx queue in ndo_stop
+    - net: loopback: clear skb->tstamp before netif_rx()
+    - locking/lockdep: Fix debug_locks off performance problem
+    - netfilter: xt_nat: fix DNAT target for shifted portmap ranges
+    - ataflop: fix error handling during setup
+    - swim: fix cleanup on setup error
+    - arm64: cpufeature: ctr: Fix cpu capability check for late CPUs
+    - hv_netvsc: fix vf serial matching with pci slot info
+    - nfp: devlink port split support for 1x100G CXP NIC
+    - tun: Consistently configure generic netdev params via rtnetlink
+    - s390/sthyi: Fix machine name validity indication
+    - hwmon: (pwm-fan) Set fan speed to 0 on suspend
+    - lightnvm: pblk: fix race on sysfs line state
+    - lightnvm: pblk: fix two sleep-in-atomic-context bugs
+    - lightnvm: pblk: fix race condition on metadata I/O
+    - spi: spi-ep93xx: Use dma_data_direction for ep93xx_spi_dma_{finish,prepare}
+    - perf tools: Free temporary 'sys' string in read_event_files()
+    - perf tools: Cleanup trace-event-info 'tdata' leak
+    - perf tools: Free 'printk' string in parse_ftrace_printk()
+    - perf strbuf: Match va_{add,copy} with va_end
+    - cpupower: Fix coredump on VMWare
+    - bcache: Populate writeback_rate_minimum attribute
+    - mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01
+    - sdhci: acpi: add free_slot callback
+    - mtd: rawnand: denali: set SPARE_AREA_SKIP_BYTES register to 8 if unset
+    - iwlwifi: pcie: avoid empty free RB queue
+    - iwlwifi: mvm: clear HW_RESTART_REQUESTED when stopping the interface
+    - iwlwifi: mvm: check for n_profiles validity in EWRD ACPI
+    - x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC
+    - wlcore: Fix BUG with clear completion on timeout
+    - ACPI/PPTT: Handle architecturally unknown cache types
+    - ACPI / PM: LPIT: Register sysfs attributes based on FADT
+    - ACPI / processor: Fix the return value of acpi_processor_ids_walk()
+    - cpufreq: dt: Try freeing static OPPs only if we have added them
+    - x86/intel_rdt: Show missing resctrl mount options
+    - mtd: rawnand: atmel: Fix potential NULL pointer dereference
+    - nvme: call nvme_complete_rq when nvmf_check_ready fails for mpath I/O
+    - ath10k: fix tx status flag setting for management frames
+    - signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
+    - ice: fix changing of ring descriptor size (ethtool -G)
+    - ice: update fw version check logic
+    - net: hns3: Fix for packet buffer setting bug
+    - Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth
+    - Bluetooth: hci_qca: Remove hdev dereference in qca_close().
+    - x86: boot: Fix EFI stub alignment
+    - net: hns3: Add nic state check before calling netif_tx_wake_queue
+    - net: hns3: Fix ets validate issue
+    - pinctrl: sunxi: fix 'pctrl->functions' allocation in
+      sunxi_pinctrl_build_state
+    - pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux
+    - brcmfmac: fix for proper support of 160MHz bandwidth
+    - net: hns3: Check hdev state when getting link status
+    - net: hns3: Set STATE_DOWN bit of hdev state when stopping net
+    - net: phy: phylink: ensure the carrier is off when starting phylink
+    - block, bfq: correctly charge and reset entity service in all cases
+    - arm64: entry: Allow handling of undefined instructions from EL1
+    - kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
+    - spi: gpio: No MISO does not imply no RX
+    - ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers
+    - pinctrl: qcom: spmi-mpp: Fix drive strength setting
+    - bpf/verifier: fix verifier instability
+    - failover: Add missing check to validate 'slave_dev' in
+      net_failover_slave_unregister
+    - perf tests: Fix record+probe_libc_inet_pton.sh without ping's debuginfo
+    - pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant
+    - pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant
+    - net: hns3: Preserve vlan 0 in hardware table
+    - net: hns3: Fix ping exited problem when doing lp selftest
+    - net: hns3: Fix for vf vlan delete failed problem
+    - net: dsa: mv88e6xxx: Fix writing to a PHY page.
+    - mt76x2u: run device cleanup routine if resume fails
+    - rsi: fix memory alignment issue in ARM32 platforms
+    - libertas_tf: prevent underflow in process_cmdrequest()
+    - iwlwifi: mvm: fix BAR seq ctrl reporting
+    - gpio: brcmstb: allow 0 width GPIO banks
+    - ixgbe: disallow IPsec Tx offload when in SR-IOV mode
+    - ixgbevf: VF2VF TCP RSS
+    - wil6210: fix RX buffers release and unmap
+    - ath10k: schedule hardware restart if WMI command times out
+    - libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9
+    - thermal: rcar_thermal: Prevent doing work after unbind
+    - thermal: da9062/61: Prevent hardware access during system suspend
+    - cifs: fix a credits leak for compund commands
+    - cgroup, netclassid: add a preemption point to write_classid
+    - net: stmmac: dwmac-sun8i: fix OF child-node lookup
+    - f2fs: fix to account IO correctly for cgroup writeback
+    - MD: Memory leak when flush bio size is zero
+    - md: fix memleak for mempool
+    - of: Add missing exports of node name compare functions
+    - scsi: esp_scsi: Track residual for PIO transfers
+    - scsi: ufs: Schedule clk gating work on correct queue
+    - UAPI: ndctl: Fix g++-unsupported initialisation in headers
+    - KVM: nVMX: Clear reserved bits of #DB exit qualification
+    - scsi: megaraid_sas: fix a missing-check bug
+    - RDMA/core: Do not expose unsupported counters
+    - RDMA/cm: Respect returned status of cm_init_av_by_path
+    - IB/ipoib: Clear IPCB before icmp_send
+    - RDMA/bnxt_re: Avoid accessing nq->bar_reg_iomem in failure case
+    - RDMA/bnxt_re: Fix recursive lock warning in debug kernel
+    - usb: host: ohci-at91: fix request of irq for optional gpio
+    - PCI: mediatek: Fix mtk_pcie_find_port() endpoint/port matching logic
+    - PCI: cadence: Use AXI region 0 to signal interrupts from EP
+    - usb: typec: tcpm: Report back negotiated PPS voltage and current
+    - tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated
+    - f2fs: clear PageError on the read path
+    - Drivers: hv: vmbus: Use cpumask_var_t for on-stack cpu mask
+    - VMCI: Resource wildcard match fixed
+    - PCI / ACPI: Enable wake automatically for power managed bridges
+    - xprtrdma: Reset credit grant properly after a disconnect
+    - irqchip/pdc: Setup all edge interrupts as rising edge at GIC
+    - usb: dwc2: fix call to vbus supply exit routine, call it unlocked
+    - usb: dwc2: fix a race with external vbus supply
+    - usb: gadget: udc: atmel: handle at91sam9rl PMC
+    - ext4: fix argument checking in EXT4_IOC_MOVE_EXT
+    - MD: fix invalid stored role for a disk
+    - PCI: cadence: Correct probe behaviour when failing to get PHY
+    - nvmem: check the return value of nvmem_add_cells()
+    - xhci: Avoid USB autosuspend when resuming USB2 ports.
+    - scsi: qla2xxx: Fix recursive mailbox timeout
+    - f2fs: fix to recover inode's crtime during POR
+    - f2fs: fix to recover inode's i_flags during POR
+    - PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice
+    - coresight: etb10: Fix handling of perf mode
+    - PCI: dwc: pci-dra7xx: Enable errata i870 for both EP and RC mode
+    - crypto: caam - fix implicit casts in endianness helpers
+    - usb: chipidea: Prevent unbalanced IRQ disable
+    - Smack: ptrace capability use fixes
+    - driver/dma/ioat: Call del_timer_sync() without holding prep_lock
+    - ASoC: AMD: Fix capture unstable in beginning for some runs
+    - firmware: coreboot: Unmap ioregion after device population
+    - IB/ipoib: Use dev_port to expose network interface port numbers
+    - IB/mlx5: Allow transition of DCI QP to reset
+    - uio: ensure class is registered before devices
+    - scsi: lpfc: Correct soft lockup when running mds diagnostics
+    - scsi: lpfc: Correct race with abort on completion path
+    - f2fs: avoid sleeping under spin_lock
+    - f2fs: report error if quota off error during umount
+    - signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace
+      init
+    - f2fs: fix to flush all dirty inodes recovered in readonly fs
+    - mfd: menelaus: Fix possible race condition and leak
+    - dmaengine: dma-jz4780: Return error if not probed from DT
+    - IB/rxe: fix for duplicate request processing and ack psns
+    - ALSA: hda: Check the non-cached stream buffers more explicitly
+    - cpupower: Fix AMD Family 0x17 msr_pstate size
+    - Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()"
+    - f2fs: fix missing up_read
+    - f2fs: fix to recover cold bit of inode block during POR
+    - f2fs: fix to account IO correctly
+    - OPP: Free OPP table properly on performance state irregularities
+    - ARM: dts: exynos: Convert exynos5250.dtsi to opp-v2 bindings
+    - ARM: dts: exynos: Mark 1 GHz CPU OPP as suspend OPP on Exynos5250
+    - xen-swiotlb: use actually allocated size on check physical continuous
+    - tpm: Restore functionality to xen vtpm driver.
+    - xen/blkfront: avoid NULL blkfront_info dereference on device removal
+    - xen/balloon: Support xend-based toolstack
+    - xen: fix race in xen_qlock_wait()
+    - xen: make xen_qlock_wait() nestable
+    - xen/pvh: increase early stack size
+    - xen/pvh: don't try to unplug emulated devices
+    - libertas: don't set URB_ZERO_PACKET on IN USB transfer
+    - usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten
+    - usb: typec: tcpm: Fix APDO PPS order checking to be based on voltage
+    - usb: gadget: udc: renesas_usb3: Fix b-device mode for "workaround"
+    - mt76: mt76x2: fix multi-interface beacon configuration
+    - iwlwifi: mvm: check return value of rs_rate_from_ucode_rate()
+    - net/ipv4: defensive cipso option parsing
+    - dmaengine: ppc4xx: fix off-by-one build failure
+    - scsi: sched/wait: Add wait_event_lock_irq_timeout for TASK_UNINTERRUPTIBLE
+      usage
+    - scsi: target: Fix target_wait_for_sess_cmds breakage with active signals
+    - libnvdimm: Hold reference on parent while scheduling async init
+    - libnvdimm, region: Fail badblocks listing for inactive regions
+    - libnvdimm, pmem: Fix badblocks population for 'raw' namespaces
+    - ASoC: intel: skylake: Add missing break in skl_tplg_get_token()
+    - ASoC: sta32x: set ->component pointer in private struct
+    - IB/mlx5: Fix MR cache initialization
+    - IB/rxe: Revise the ib_wr_opcode enum
+    - jbd2: fix use after free in jbd2_log_do_checkpoint()
+    - gfs2_meta: ->mount() can get NULL dev_name
+    - ext4: fix EXT4_IOC_SWAP_BOOT
+    - ext4: initialize retries variable in ext4_da_write_inline_data_begin()
+    - ext4: fix setattr project check in fssetxattr ioctl
+    - ext4: propagate error from dquot_initialize() in EXT4_IOC_FSSETXATTR
+    - ext4: fix use-after-free race in ext4_remount()'s error path
+    - selinux: fix mounting of cgroup2 under older policies
+    - HID: wacom: Work around HID descriptor bug in DTK-2451 and DTH-2452
+    - HID: hiddev: fix potential Spectre v1
+    - EDAC, amd64: Add Family 17h, models 10h-2fh support
+    - EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting
+    - EDAC, skx_edac: Fix logical channel intermediate decoding
+    - ARM: dts: dra7: Fix up unaligned access setting for PCIe EP
+    - PCI/ASPM: Fix link_state teardown on device removal
+    - PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk
+    - signal/GenWQE: Fix sending of SIGKILL
+    - signal: Guard against negative signal numbers in copy_siginfo_from_user32
+    - crypto: lrw - Fix out-of bounds access on counter overflow
+    - crypto: tcrypt - fix ghash-generic speed test
+    - crypto: aesni - don't use GFP_ATOMIC allocation if the request doesn't cross
+      a page in gcm
+    - crypto: morus/generic - fix for big endian systems
+    - crypto: aegis/generic - fix for big endian systems
+    - crypto: speck - remove Speck
+    - mm: /proc/pid/smaps_rollup: fix NULL pointer deref in smaps_pte_range()
+    - userfaultfd: disable irqs when taking the waitqueue lock
+    - ima: fix showing large 'violations' or 'runtime_measurements_count'
+    - ima: open a new file instance if no read permissions
+    - hugetlbfs: dirty pages as they are added to pagecache
+    - mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly
+    - mm/hmm: fix race between hmm_mirror_unregister() and mmu_notifier callback
+    - KVM: arm/arm64: Ensure only THP is candidate for adjustment
+    - KVM: arm64: Fix caching of host MDCR_EL2 value
+    - kbuild: fix kernel/bounds.c 'W=1' warning
+    - iio: ad5064: Fix regulator handling
+    - iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs()
+    - iio: adc: at91: fix acking DRDY irq on simple conversions
+    - iio: adc: at91: fix wrong channel number in triggered buffer mode
+    - w1: omap-hdq: fix missing bus unregister at removal
+    - smb3: allow stats which track session and share reconnects to be reset
+    - smb3: do not attempt cifs operation in smb3 query info error path
+    - smb3: on kerberos mount if server doesn't specify auth type use krb5
+    - printk: Fix panic caused by passing log_buf_len to command line
+    - genirq: Fix race on spurious interrupt detection
+    - tpm: fix response size validation in tpm_get_random()
+    - NFC: nfcmrvl_uart: fix OF child-node lookup
+    - NFSv4.1: Fix the r/wsize checking
+    - nfs: Fix a missed page unlock after pg_doio()
+    - nfsd: correctly decrement odstate refcount in error path
+    - nfsd: Fix an Oops in free_session()
+    - lockd: fix access beyond unterminated strings in prints
+    - dm ioctl: harden copy_params()'s copy_from_user() from malicious users
+    - dm zoned: fix metadata block ref counting
+    - dm zoned: fix various dmz_get_mblock() issues
+    - media: ov7670: make "xclk" clock optional
+    - fsnotify: Fix busy inodes during unmount
+    - powerpc64/module elfv1: Set opd addresses after module relocation
+    - powerpc/msi: Fix compile error on mpc83xx
+    - powerpc/tm: Fix HFSCR bit for no suspend case
+    - powerpc/64s/hash: Do not use PPC_INVALIDATE_ERAT on CPUs before POWER9
+    - MIPS: OCTEON: fix out of bounds array access on CN68XX
+    - rtc: ds1307: fix ds1339 wakealarm support
+    - rtc: cmos: Fix non-ACPI undefined reference to `hpet_rtc_interrupt'
+    - rtc: cmos: Remove the `use_acpi_alarm' module parameter for !ACPI
+    - power: supply: twl4030-charger: fix OF sibling-node lookup
+    - ocxl: Fix access to the AFU Descriptor Data
+    - iommu/arm-smmu: Ensure that page-table updates are visible before TLBI
+    - TC: Set DMA masks for devices
+    - net: bcmgenet: fix OF child-node lookup
+    - media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
+    - Revert "media: dvbsky: use just one mutex for serializing device R/W ops"
+    - kgdboc: Passing ekgdboc to command line causes panic
+    - remoteproc: qcom: q6v5: Propagate EPROBE_DEFER
+    - media: cec: make cec_get_edid_spa_location() an inline function
+    - media: cec: integrate cec_validate_phys_addr() in cec-api.c
+    - xen: fix xen_qlock_wait()
+    - xen: remove size limit of privcmd-buf mapping interface
+    - xen-blkfront: fix kernel panic with negotiate_mq error path
+    - media: cec: add new tx/rx status bits to detect aborts/timeouts
+    - media: cec: fix the Signal Free Time calculation
+    - media: cec: forgot to cancel delayed work
+    - media: em28xx: use a default format if TRY_FMT fails
+    - media: tvp5150: avoid going past array on v4l2_querymenu()
+    - media: em28xx: fix input name for Terratec AV 350
+    - media: em28xx: make v4l2-compliance happier by starting sequence on zero
+    - media: em28xx: fix handler for vidioc_s_input()
+    - media: adv7604: when the EDID is cleared, unconfigure CEC as well
+    - media: adv7842: when the EDID is cleared, unconfigure CEC as well
+    - drm/mediatek: fix OF sibling-node lookup
+    - media: media colorspaces*.rst: rename AdobeRGB to opRGB
+    - media: replace ADOBERGB by OPRGB
+    - media: hdmi.h: rename ADOBE_RGB to OPRGB and ADOBE_YCC to OPYCC
+    - arm64: lse: remove -fcall-used-x0 flag
+    - rpmsg: smd: fix memory leak on channel create
+    - Cramfs: fix abad comparison when wrap-arounds occur
+    - ARM: dts: socfpga: Fix SDRAM node address for Arria10
+    - arm64: dts: stratix10: Correct System Manager register size
+    - soc: qcom: rmtfs-mem: Validate that scm is available
+    - soc/tegra: pmc: Fix child-node lookup
+    - selftests/ftrace: Fix synthetic event test to delete event correctly
+    - selftests/powerpc: Fix ptrace tm failure
+    - tracing: Return -ENOENT if there is no target synthetic event
+    - btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled
+    - btrfs: Handle owner mismatch gracefully when walking up tree
+    - btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock
+    - btrfs: fix error handling in free_log_tree
+    - btrfs: fix error handling in btrfs_dev_replace_start
+    - btrfs: Enhance btrfs_trim_fs function to handle error better
+    - btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
+    - btrfs: iterate all devices during trim, instead of fs_devices::alloc_list
+    - btrfs: don't attempt to trim devices that don't support it
+    - btrfs: keep trim from interfering with transaction commits
+    - btrfs: wait on caching when putting the bg cache
+    - Btrfs: don't clean dirty pages during buffered writes
+    - btrfs: release metadata before running delayed refs
+    - btrfs: protect space cache inode alloc with GFP_NOFS
+    - btrfs: reset max_extent_size on clear in a bitmap
+    - btrfs: make sure we create all new block groups
+    - Btrfs: fix warning when replaying log after fsync of a tmpfile
+    - Btrfs: fix wrong dentries after fsync of file that got its parent replaced
+    - btrfs: qgroup: Dirty all qgroups before rescan
+    - Btrfs: fix null pointer dereference on compressed write path error
+    - Btrfs: fix assertion on fsync of regular file when using no-holes feature
+    - Btrfs: fix deadlock when writing out free space caches
+    - btrfs: reset max_extent_size properly
+    - btrfs: set max_extent_size properly
+    - btrfs: don't use ctl->free_space for max_extent_size
+    - btrfs: only free reserved extent if we didn't insert it
+    - btrfs: fix insert_reserved error handling
+    - btrfs: don't run delayed_iputs in commit
+    - btrfs: move the dio_sem higher up the callchain
+    - Btrfs: fix use-after-free during inode eviction
+    - Btrfs: fix use-after-free when dumping free space
+    - net: sched: Remove TCA_OPTIONS from policy
+    - vt: fix broken display when running aptitude
+    - bpf: wait for running BPF programs when updating map-in-map
+    - vga_switcheroo: Fix missing gpu_bound call at audio client registration
+    - MD: fix invalid stored role for a disk - try2
+    - Linux 4.19.2
+
+  * [FEAT] Guest-dedicated Crypto Adapters (LP: #1787405)
+    - KVM: s390: vsie: simulate VCPU SIE entry/exit
+    - KVM: s390: introduce and use KVM_REQ_VSIE_RESTART
+    - KVM: s390: refactor crypto initialization
+    - s390: vfio-ap: base implementation of VFIO AP device driver
+    - s390: vfio-ap: register matrix device with VFIO mdev framework
+    - s390: vfio-ap: sysfs interfaces to configure adapters
+    - s390: vfio-ap: sysfs interfaces to configure domains
+    - s390: vfio-ap: sysfs interfaces to configure control domains
+    - s390: vfio-ap: sysfs interface to view matrix mdev matrix
+    - KVM: s390: interface to clear CRYCB masks
+    - s390: vfio-ap: implement mediated device open callback
+    - s390: vfio-ap: implement VFIO_DEVICE_GET_INFO ioctl
+    - s390: vfio-ap: zeroize the AP queues
+    - s390: vfio-ap: implement VFIO_DEVICE_RESET ioctl
+    - KVM: s390: Clear Crypto Control Block when using vSIE
+    - KVM: s390: vsie: Do the CRYCB validation first
+    - KVM: s390: vsie: Make use of CRYCB FORMAT2 clear
+    - KVM: s390: vsie: Allow CRYCB FORMAT-2
+    - KVM: s390: vsie: allow CRYCB FORMAT-1
+    - KVM: s390: vsie: allow CRYCB FORMAT-0
+    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-1
+    - KVM: s390: vsie: allow guest FORMAT-1 CRYCB on host FORMAT-2
+    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-2
+    - KVM: s390: device attrs to enable/disable AP interpretation
+    - KVM: s390: CPU model support for AP virtualization
+    - s390: doc: detailed specifications for AP virtualization
+    - KVM: s390: fix locking for crypto setting error path
+    - KVM: s390: Tracing APCB changes
+    - s390: vfio-ap: setup APCB mask using KVM dedicated function
+    - [Config:] Enable CONFIG_S390_AP_IOMMU and set CONFIG_VFIO_AP to module.
+
+  * Bypass of mount visibility through userns + mount propagation (LP: #1789161)
+    - mount: Retest MNT_LOCKED in do_umount
+    - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts
+
+  *  CVE-2018-18955: nested user namespaces with more than five extents
+    incorrectly grant privileges over inode (LP: #1801924) // CVE-2018-18955
+    - userns: also map extents in the reverse map to kernel IDs
+
+  * kdump fail due to an IRQ storm (LP: #1797990)
+    - SAUCE: x86/PCI: Export find_cap() to be used in early PCI code
+    - SAUCE: x86/quirks: Add parameter to clear MSIs early on boot
+    - SAUCE: x86/quirks: Scan all busses for early PCI quirks
+
+  * Disable LPM for Raydium Touchscreens (LP: #1802248)
+    - USB: quirks: Add no-lpm quirk for Raydium touchscreens
+
+  * Power consumption during s2idle is higher than long idle(sk hynix)
+    (LP: #1801875)
+    - SAUCE: pci: prevent sk hynix nvme from entering D3
+    - SAUCE: nvme: add quirk to not call disable function when suspending
+
+  * Disco update: v4.19.1 upstream stable release (LP: #1801739)
+    - bridge: do not add port to router list when receives query with source
+      0.0.0.0
+    - ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are
+      called
+    - net/mlx5e: fix csum adjustments caused by RXFCS
+    - net: sched: gred: pass the right attribute to gred_change_table_def()
+    - net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
+    - net: udp: fix handling of CHECKSUM_COMPLETE packets
+    - Revert "net: simplify sock_poll_wait"
+    - rtnetlink: Disallow FDB configuration for non-Ethernet device
+    - vhost: Fix Spectre V1 vulnerability
+    - bonding: fix length of actor system
+    - openvswitch: Fix push/pop ethernet validation
+    - net/ipv6: Allow onlink routes to have a device mismatch if it is the default
+      route
+    - net/smc: fix smc_buf_unuse to use the lgr pointer
+    - mlxsw: spectrum_switchdev: Don't ignore deletions of learned MACs
+    - mlxsw: core: Fix devlink unregister flow
+    - net: drop skb on failure in ip_check_defrag()
+    - net: Properly unlink GRO packets on overflow.
+    - r8169: fix broken Wake-on-LAN from S5 (poweroff)
+    - Revert "be2net: remove desc field from be_eq_obj"
+    - sctp: check policy more carefully when getting pr status
+    - sparc64: Export __node_distance.
+    - sparc64: Make corrupted user stacks more debuggable.
+    - sparc64: Wire up compat getpeername and getsockname.
+    - net: bridge: remove ipv6 zero address check in mcast queries
+    - Linux 4.19.1
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.11-1ubuntu1, zfs to 0.7.11-3ubuntu1
+    - [Config] updateconfigs after 4.19.2 stable update
+    - [Config] Disable unneded options for s390
+    - [Config] Update annotations for 4.19
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 15 Nov 2018 09:55:37 -0800
+
+linux (4.19.0-4.5) disco; urgency=medium
+
+  * Add checksum offload and TSO support for HiNIC adapters (LP: #1800664)
+    - net-next/hinic: add checksum offload and TSO support
+
+  * [Bionic][Cosmic] Fix to ipmi to support vendor specific messages greater
+    than 255 bytes (LP: #1799794)
+    - ipmi:ssif: Add support for multi-part transmit messages > 2 parts
+
+  * Packaging resync (LP: #1786013)
+    - [Package] add support for specifying the primary makefile
+
+  * Update ENA driver to version 2.0.1K (LP: #1798182)
+    - net: ena: minor performance improvement
+    - net: ena: complete host info to match latest ENA spec
+    - net: ena: introduce Low Latency Queues data structures according to ENA spec
+    - net: ena: add functions for handling Low Latency Queues in ena_com
+    - net: ena: add functions for handling Low Latency Queues in ena_netdev
+    - net: ena: use CSUM_CHECKED device indication to report skb's checksum status
+    - net: ena: explicit casting and initialization, and clearer error handling
+    - net: ena: limit refill Rx threshold to 256 to avoid latency issues
+    - net: ena: change rx copybreak default to reduce kernel memory pressure
+    - net: ena: remove redundant parameter in ena_com_admin_init()
+    - net: ena: update driver version to 2.0.1
+    - net: ena: fix indentations in ena_defs for better readability
+    - net: ena: Fix Kconfig dependency on X86
+    - net: ena: enable Low Latency Queues
+    - net: ena: fix compilation error in xtensa architecture
+
+  * [Bionic][Cosmic]  ipmi: Fix timer race with module unload (LP: #1799281)
+    - ipmi: Fix timer race with module unload
+
+  * Overlayfs in user namespace leaks directory content of inaccessible
+    directories (LP: #1793458) // CVE-2018-6559
+    - SAUCE: overlayfs: ensure mounter privileges when reading directories
+
+  * not able to unwind the stack from within __kernel_clock_gettime in the Linux
+    vDSO (LP: #1797963)
+    - powerpc/vdso: Correct call frame information
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Don't print secure boot state
+      from the efi stub"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Make get_cert_list() use
+      efi_status_to_str() to print error messages."
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err()."
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Make get_cert_list() not complain
+      about cert lists that aren't present."
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable
+      to be suppressed"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI
+      Secure Boot"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add EFI signature data types"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time
+      addition of keys to secondary keyring"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in
+      secure boot mode"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to
+      indicate secure boot mode"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Copy secure_boot flag in boot params
+      across kexec reboot"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down perf"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) bpf: Restrict kernel image access
+      functions when the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down kprobes"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down /proc/kcore"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the
+      testmmiotrace module"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down module params that specify
+      hardware parameters (eg. ioport)"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down TIOCSSERIAL"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) acpi: Disable APEI error injection if
+      the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) acpi: Disable ACPI table override if
+      the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param
+      when the kernel has been locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) ACPI: Limit access to custom_method
+      when the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) x86: Lock down IO port access when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) PCI: Lock down BAR access when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is
+      locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) hibernate: Disable when the kernel is
+      locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Enforce module signatures if the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add a SysRq option to lift kernel
+      lockdown"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add the ability to lock down access to
+      the running kernel image"
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) efi/x86: Call efi_parse_options() from efi_main()
+    - SAUCE: (efi-lockdown) Fix for module sig verification
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) module: remove support for having IMA validate modules
+    - [Packaging] generate Vcs-Git url from changelog
+    - [Config] CONFIG_SCSI_MQ_DEFAULT=y
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 02 Nov 2018 14:22:55 -0500
+
+linux (4.19.0-3.4) cosmic; urgency=medium
+
+  * Support Edge Gateway's Bluetooth LED (LP: #1798332)
+    - SAUCE: Bluetooth: Support for LED on Edge Gateways
+
+  * Support Edge Gateway's WIFI LED (LP: #1798330)
+    - SAUCE: mwifiex: Switch WiFi LED state according to the device status
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Oct 2018 09:13:39 -0500
+
+linux (4.19.0-2.3) cosmic; urgency=medium
+
+  * fscache: bad refcounting in fscache_op_complete leads to OOPS (LP: #1797314)
+    - SAUCE: fscache: Fix race in decrementing refcount of op->npages
+
+  * Provide mode where all vCPUs on a core must be the same VM (LP: #1792957)
+    - KVM: PPC: Book3S HV: Provide mode where all vCPUs on a core must be the same
+      VM
+
+  * The front MIC can't work on the Lenovo M715 (LP: #1797292)
+    - ALSA: hda/realtek - Fix the problem of the front MIC on the Lenovo M715
+
+  * arm64: snapdragon: WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1016
+    gic_irq_domain_translate (LP: #1797143)
+    - SAUCE: arm64: dts: msm8916: camms: fix gic_irq_domain_translate warnings
+
+  * Dell new AIO requires a new uart backlight driver (LP: #1727235)
+    - SAUCE: platform/x86: dell-uart-backlight: new backlight driver for DELL AIO
+    - updateconfigs for Dell UART backlight driver
+
+  * Please make CONFIG_PWM_LPSS_PCI and CONFIG_PWM_LPSS_PLATFORM built in to
+    make brightness adjustment working on various BayTrail/CherryTrail-based
+    devices (LP: #1783964)
+    - [Config]: Make PWM_LPSS_* built-in
+
+  * check and fix zkey required kernel modules locations in debs, udebs, and
+    initramfs (LP: #1794346)
+    - [Config] add s390 crypto modules to crypt-modules udeb
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_VBOXGUEST=n
+    - ubuntu: vbox -- update to 5.2.18-dfsg-2
+    - ubuntu: enable vbox build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 15 Oct 2018 10:52:04 -0500
+
+linux (4.19.0-1.2) cosmic; urgency=medium
+
+  * Page leaking in cachefiles_read_backing_file while vmscan is active
+    (LP: #1793430)
+    - SAUCE: cachefiles: Page leaking in cachefiles_read_backing_file while vmscan
+      is active
+
+  * SRU: Enable middle button of touchpad on ThinkPad P72 (LP: #1793463)
+    - Input: elantech - enable middle button of touchpad on ThinkPad P72
+
+  * Improvements to the kernel source package preparation (LP: #1793461)
+    - [Packaging] startnewrelease: add support for backport kernels
+
+  * Fix unusable NVIDIA GPU after S3 (LP: #1793338)
+    - SAUCE: PCI: Reprogram bridge prefetch registers on resume
+
+  * Error reported when creating ZFS pool with "-t" option, despite successful
+    pool creation (LP: #1769937)
+    - SAUCE: (noup) Update zfs to 0.7.9-3ubuntu6
+
+  * device hotplug of vfio devices can lead to deadlock in vfio_pci_release
+    (LP: #1792099)
+    - SAUCE: vfio -- release device lock before userspace requests
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] retpoline -- fix temporary filenaming
+    - CONFIG_BCH_CONST_PARAMS=n
+    - Packaging: final-checks: remove trailing backport suffix
+    - SAUCE: import aufs driver
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 25 Sep 2018 16:32:24 -0500
+
+linux (4.19.0-0.1) cosmic; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu -- disable vbox build
+    - Disable zfs build
+    - SAUCE: Import aufs driver
+    - Update dropped.txt
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 13 Sep 2018 07:54:47 -0500
+
+linux (4.19.0-0.0) cosmic; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 13 Sep 2018 06:44:09 -0500
+
+linux (4.18.0-8.9) cosmic; urgency=medium
+
+  * linux: 4.18.0-8.9 -proposed tracker (LP: #1791663)
+
+  * Cosmic update to v4.18.7 stable release (LP: #1791660)
+    - rcu: Make expedited GPs handle CPU 0 being offline
+    - net: 6lowpan: fix reserved space for single frames
+    - net: mac802154: tx: expand tailroom if necessary
+    - 9p/net: Fix zero-copy path in the 9p virtio transport
+    - spi: davinci: fix a NULL pointer dereference
+    - spi: pxa2xx: Add support for Intel Ice Lake
+    - spi: spi-fsl-dspi: Fix imprecise abort on VF500 during probe
+    - spi: cadence: Change usleep_range() to udelay(), for atomic context
+    - mmc: block: Fix unsupported parallel dispatch of requests
+    - mmc: renesas_sdhi_internal_dmac: mask DMAC interrupts
+    - mmc: renesas_sdhi_internal_dmac: fix #define RST_RESERVED_BITS
+    - readahead: stricter check for bdi io_pages
+    - block: fix infinite loop if the device loses discard capability
+    - block: blk_init_allocated_queue() set q->fq as NULL in the fail case
+    - block: really disable runtime-pm for blk-mq
+    - blkcg: Introduce blkg_root_lookup()
+    - block: Introduce blk_exit_queue()
+    - block: Ensure that a request queue is dissociated from the cgroup controller
+    - apparmor: fix bad debug check in apparmor_secid_to_secctx()
+    - dma-buf: Move BUG_ON from _add_shared_fence to _add_shared_inplace
+    - libertas: fix suspend and resume for SDIO connected cards
+    - media: Revert "[media] tvp5150: fix pad format frame height"
+    - mailbox: xgene-slimpro: Fix potential NULL pointer dereference
+    - Replace magic for trusting the secondary keyring with #define
+    - Fix kexec forbidding kernels signed with keys in the secondary keyring to
+      boot
+    - powerpc/fadump: handle crash memory ranges array index overflow
+    - powerpc/64s: Fix page table fragment refcount race vs speculative references
+    - powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.
+    - powerpc/pkeys: Give all threads control of their key permissions
+    - powerpc/pkeys: Deny read/write/execute by default
+    - powerpc/pkeys: key allocation/deallocation must not change pkey registers
+    - powerpc/pkeys: Save the pkey registers before fork
+    - powerpc/pkeys: Fix calculation of total pkeys.
+    - powerpc/pkeys: Preallocate execute-only key
+    - powerpc/nohash: fix pte_access_permitted()
+    - powerpc64/ftrace: Include ftrace.h needed for enable/disable calls
+    - powerpc/powernv/pci: Work around races in PCI bridge enabling
+    - cxl: Fix wrong comparison in cxl_adapter_context_get()
+    - IB/mlx5: Honor cnt_set_id_valid flag instead of set_id
+    - IB/mlx5: Fix leaking stack memory to userspace
+    - IB/srpt: Fix srpt_cm_req_recv() error path (1/2)
+    - IB/srpt: Fix srpt_cm_req_recv() error path (2/2)
+    - IB/srpt: Support HCAs with more than two ports
+    - overflow.h: Add arithmetic shift helper
+    - RDMA/mlx5: Fix shift overflow in mlx5_ib_create_wq
+    - ib_srpt: Fix a use-after-free in srpt_close_ch()
+    - ib_srpt: Fix a use-after-free in __srpt_close_all_ch()
+    - RDMA/rxe: Set wqe->status correctly if an unexpected response is received
+    - 9p: fix multiple NULL-pointer-dereferences
+    - fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr failed
+    - 9p/virtio: fix off-by-one error in sg list bounds check
+    - net/9p/client.c: version pointer uninitialized
+    - net/9p/trans_fd.c: fix race-condition by flushing workqueue before the
+      kfree()
+    - dm integrity: change 'suspending' variable from bool to int
+    - dm thin: stop no_space_timeout worker when switching to write-mode
+    - dm cache metadata: save in-core policy_hint_size to on-disk superblock
+    - dm cache metadata: set dirty on all cache blocks after a crash
+    - dm crypt: don't decrease device limits
+    - dm writecache: fix a crash due to reading past end of dirty_bitmap
+    - uart: fix race between uart_put_char() and uart_shutdown()
+    - Drivers: hv: vmbus: Fix the offer_in_progress in vmbus_process_offer()
+    - Drivers: hv: vmbus: Reset the channel callback in vmbus_onoffer_rescind()
+    - iio: sca3000: Fix missing return in switch
+    - iio: ad9523: Fix displayed phase
+    - iio: ad9523: Fix return value for ad952x_store()
+    - extcon: Release locking when sending the notification of connector state
+    - eventpoll.h: wrap casts in () properly
+    - vmw_balloon: fix inflation of 64-bit GFNs
+    - vmw_balloon: do not use 2MB without batching
+    - vmw_balloon: VMCI_DOORBELL_SET does not check status
+    - vmw_balloon: fix VMCI use when balloon built into kernel
+    - rtc: omap: fix resource leak in registration error path
+    - rtc: omap: fix potential crash on power off
+    - tracing: Do not call start/stop() functions when tracing_on does not change
+    - tracing/blktrace: Fix to allow setting same value
+    - printk/tracing: Do not trace printk_nmi_enter()
+    - livepatch: Validate module/old func name length
+    - uprobes: Use synchronize_rcu() not synchronize_sched()
+    - mfd: hi655x: Fix regmap area declared size for hi655x
+    - ovl: fix wrong use of impure dir cache in ovl_iterate()
+    - ACPICA: AML Parser: skip opcodes that open a scope upon parse failure
+    - ACPICA: Clear status of all events when entering sleep states
+    - drivers/block/zram/zram_drv.c: fix bug storing backing_dev
+    - sched: idle: Avoid retaining the tick when it has been stopped
+    - cpuidle: menu: Handle stopped tick more aggressively
+    - cpufreq: governor: Avoid accessing invalid governor_data
+    - PM / sleep: wakeup: Fix build error caused by missing SRCU support
+    - ALSA: ac97: fix device initialization in the compat layer
+    - ALSA: ac97: fix check of pm_runtime_get_sync failure
+    - ALSA: ac97: fix unbalanced pm_runtime_enable
+    - i2c: designware: Re-init controllers with pm_disabled set on resume
+    - KVM: VMX: fixes for vmentry_l1d_flush module parameter
+    - KVM: PPC: Book3S: Fix guest DMA when guest partially backed by THP pages
+    - xtensa: limit offsets in __loop_cache_{all,page}
+    - xtensa: increase ranges in ___invalidate_{i,d}cache_all
+    - block, bfq: return nbytes and not zero from struct cftype .write() method
+    - pnfs/blocklayout: off by one in bl_map_stripe()
+    - nfsd: fix leaked file lock with nfs exported overlayfs
+    - NFSv4 client live hangs after live data migration recovery
+    - NFSv4: Fix locking in pnfs_generic_recover_commit_reqs
+    - NFSv4: Fix a sleep in atomic context in nfs4_callback_sequence()
+    - ARM: tegra: Fix Tegra30 Cardhu PCA954x reset
+    - ARM: dts: am57xx-idk: Enable dual role for USB2 port
+    - pwm: omap-dmtimer: Return -EPROBE_DEFER if no dmtimer platform data
+    - mm/tlb: Remove tlb_remove_table() non-concurrent condition
+    - iommu/ipmmu-vmsa: Don't register as BUS IOMMU if machine doesn't have IPMMU-
+      VMSA
+    - iommu/vt-d: Add definitions for PFSID
+    - iommu/vt-d: Fix dev iotlb pfsid use
+    - sys: don't hold uts_sem while accessing userspace memory
+    - userns: move user access out of the mutex
+    - ubifs: Fix memory leak in lprobs self-check
+    - Revert "UBIFS: Fix potential integer overflow in allocation"
+    - ubifs: Check data node size before truncate
+    - ubifs: xattr: Don't operate on deleted inodes
+    - ubifs: Fix directory size calculation for symlinks
+    - ubifs: Fix synced_i_size calculation for xattr inodes
+    - pwm: tiehrpwm: Don't use emulation mode bits to control PWM output
+    - pwm: tiehrpwm: Fix disabling of output of PWMs
+    - fb: fix lost console when the user unplugs a USB adapter
+    - udlfb: fix semaphore value leak
+    - udlfb: fix display corruption of the last line
+    - udlfb: don't switch if we are switching to the same videomode
+    - udlfb: set optimal write delay
+    - udlfb: make a local copy of fb_ops
+    - udlfb: handle allocation failure
+    - udlfb: set line_length in dlfb_ops_set_par
+    - getxattr: use correct xattr length
+    - libnvdimm: Use max contiguous area for namespace size
+    - libnvdimm: fix ars_status output length calculation
+    - bcache: release dc->writeback_lock properly in bch_writeback_thread()
+    - kconfig: fix "Can't open ..." in parallel build
+    - perf auxtrace: Fix queue resize
+    - crypto: vmx - Fix sleep-in-atomic bugs
+    - crypto: aesni - Use unaligned loads from gcm_context_data
+    - crypto: arm64/sm4-ce - check for the right CPU feature bit
+    - crypto: caam - fix DMA mapping direction for RSA forms 2 & 3
+    - crypto: caam/jr - fix descriptor DMA unmapping
+    - crypto: caam/qi - fix error path in xts setkey
+    - fs/quota: Fix spectre gadget in do_quotactl
+    - udf: Fix mounting of Win7 created UDF filesystems
+    - cpuidle: menu: Retain tick when shallow state is selected
+    - arm64: mm: always enable CONFIG_HOLES_IN_ZONE
+    - Linux 4.18.7
+
+  * CVE-2017-5715
+    - s390: detect etoken facility
+    - KVM: s390: add etoken support for guests
+
+  * Missing Intel GPU pci-id's (LP: #1789924)
+    - drm/i915/whl: Introducing Whiskey Lake platform
+    - drm/i915/aml: Introducing Amber Lake platform
+    - drm/i915/cfl: Add a new CFL PCI ID.
+
+  * [18.10 FEAT] Add kernel config options for SMC-R/D (LP: #1789934)
+    - s390/ism: add device driver for internal shared memory
+    - CONFIG_ISM=y for s390
+
+  * Cosmic update to v4.18.6 stable release (LP: #1791105)
+    - PATCH scripts/kernel-doc
+    - scripts/kernel-doc: Escape all literal braces in regexes
+    - scsi: libsas: dynamically allocate and free ata host
+    - xprtrdma: Fix disconnect regression
+    - mei: don't update offset in write
+    - cifs: add missing support for ACLs in SMB 3.11
+    - CIFS: fix uninitialized ptr deref in smb2 signing
+    - cifs: add missing debug entries for kconfig options
+    - cifs: use a refcount to protect open/closing the cached file handle
+    - cifs: check kmalloc before use
+    - smb3: enumerating snapshots was leaving part of the data off end
+    - smb3: Do not send SMB3 SET_INFO if nothing changed
+    - smb3: don't request leases in symlink creation and query
+    - smb3: fill in statfs fsid and correct namelen
+    - btrfs: use correct compare function of dirty_metadata_bytes
+    - btrfs: don't leak ret from do_chunk_alloc
+    - Btrfs: fix mount failure after fsync due to hard link recreation
+    - Btrfs: fix btrfs_write_inode vs delayed iput deadlock
+    - Btrfs: fix send failure when root has deleted files still open
+    - Btrfs: send, fix incorrect file layout after hole punching beyond eof
+    - hwmon: (k10temp) 27C Offset needed for Threadripper2
+    - bpf, arm32: fix stack var offset in jit
+    - regulator: arizona-ldo1: Use correct device to get enable GPIO
+    - iommu/arm-smmu: Error out only if not enough context interrupts
+    - printk: Split the code for storing a message into the log buffer
+    - printk: Create helper function to queue deferred console handling
+    - printk/nmi: Prevent deadlock when accessing the main log buffer in NMI
+    - kprobes/arm64: Fix %p uses in error messages
+    - arm64: Fix mismatched cache line size detection
+    - arm64: Handle mismatched cache type
+    - arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid()
+    - arm64: dts: rockchip: corrected uart1 clock-names for rk3328
+    - KVM: arm/arm64: Fix potential loss of ptimer interrupts
+    - KVM: arm/arm64: Fix lost IRQs from emulated physcial timer when blocked
+    - KVM: arm/arm64: Skip updating PMD entry if no change
+    - KVM: arm/arm64: Skip updating PTE entry if no change
+    - s390/kvm: fix deadlock when killed by oom
+    - perf kvm: Fix subcommands on s390
+    - stop_machine: Reflow cpu_stop_queue_two_works()
+    - stop_machine: Atomically queue and wake stopper threads
+    - ext4: check for NUL characters in extended attribute's name
+    - ext4: use ext4_warning() for sb_getblk failure
+    - ext4: sysfs: print ext4_super_block fields as little-endian
+    - ext4: reset error code in ext4_find_entry in fallback
+    - ext4: fix race when setting the bitmap corrupted flag
+    - x86/gpu: reserve ICL's graphics stolen memory
+    - platform/x86: wmi: Do not mix pages and kmalloc
+    - platform/x86: ideapad-laptop: Apply no_hw_rfkill to Y20-15IKBM, too
+    - mm: move tlb_table_flush to tlb_flush_mmu_free
+    - mm/tlb, x86/mm: Support invalidating TLB caches for RCU_TABLE_FREE
+    - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
+    - x86/speculation/l1tf: Fix off-by-one error when warning that system has too
+      much RAM
+    - x86/speculation/l1tf: Suggest what to do on systems with too much RAM
+    - x86/vdso: Fix vDSO build if a retpoline is emitted
+    - x86/process: Re-export start_thread()
+    - KVM: x86: ensure all MSRs can always be KVM_GET/SET_MSR'd
+    - KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled
+    - fuse: Don't access pipe->buffers without pipe_lock()
+    - fuse: fix initial parallel dirops
+    - fuse: fix double request_end()
+    - fuse: fix unlocked access to processing queue
+    - fuse: umount should wait for all requests
+    - fuse: Fix oops at process_init_reply()
+    - fuse: Add missed unlock_page() to fuse_readpages_fill()
+    - lib/vsprintf: Do not handle %pO[^F] as %px
+    - udl-kms: change down_interruptible to down
+    - udl-kms: handle allocation failure
+    - udl-kms: fix crash due to uninitialized memory
+    - udl-kms: avoid division
+    - b43legacy/leds: Ensure NUL-termination of LED name string
+    - b43/leds: Ensure NUL-termination of LED name string
+    - ASoC: dpcm: don't merge format from invalid codec dai
+    - ASoC: zte: Fix incorrect PCM format bit usages
+    - ASoC: sirf: Fix potential NULL pointer dereference
+    - ASoC: wm_adsp: Correct DSP pointer for preloader control
+    - soc: qcom: rmtfs-mem: fix memleak in probe error paths
+    - pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show()
+    - scsi: qla2xxx: Fix stalled relogin
+    - x86/vdso: Fix lsl operand order
+    - x86/nmi: Fix NMI uaccess race against CR3 switching
+    - x86/irqflags: Mark native_restore_fl extern inline
+    - x86/spectre: Add missing family 6 check to microcode check
+    - x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
+    - hwmon: (nct6775) Fix potential Spectre v1
+    - x86/entry/64: Wipe KASAN stack shadow before rewind_stack_do_exit()
+    - x86: Allow generating user-space headers without a compiler
+    - s390/mm: fix addressing exception after suspend/resume
+    - s390/lib: use expoline for all bcr instructions
+    - s390: fix br_r1_trampoline for machines without exrl
+    - s390/qdio: reset old sbal_state flags
+    - s390/numa: move initial setup of node_to_cpumask_map
+    - s390/purgatory: Fix crash with expoline enabled
+    - s390/purgatory: Add missing FORCE to Makefile targets
+    - kprobes: Show blacklist addresses as same as kallsyms does
+    - kprobes: Replace %p with other pointer types
+    - kprobes/arm: Fix %p uses in error messages
+    - kprobes: Make list and blacklist root user read only
+    - MIPS: Correct the 64-bit DSP accumulator register size
+    - MIPS: memset.S: Fix byte_fixup for MIPSr6
+    - MIPS: Always use -march=<arch>, not -<arch> shortcuts
+    - MIPS: Change definition of cpu_relax() for Loongson-3
+    - MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7
+    - tpm: Return the actual size when receiving an unsupported command
+    - tpm: separate cmd_ready/go_idle from runtime_pm
+    - scsi: mpt3sas: Fix calltrace observed while running IO & reset
+    - scsi: mpt3sas: Fix _transport_smp_handler() error path
+    - scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
+    - scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock
+    - iscsi target: fix session creation failure handling
+    - mtd: rawnand: hynix: Use ->exec_op() in hynix_nand_reg_write_op()
+    - mtd: rawnand: fsmc: Stop using chip->read_buf()
+    - mtd: rawnand: marvell: add suspend and resume hooks
+    - mtd: rawnand: qcom: wait for desc completion in all BAM channels
+    - clk: rockchip: fix clk_i2sout parent selection bits on rk3399
+    - clk: npcm7xx: fix memory allocation
+    - PM / clk: signedness bug in of_pm_clk_add_clks()
+    - power: generic-adc-battery: fix out-of-bounds write when copying channel
+      properties
+    - power: generic-adc-battery: check for duplicate properties copied from iio
+      channels
+    - watchdog: Mark watchdog touch functions as notrace
+    - cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status
+    - x86/dumpstack: Don't dump kernel memory based on usermode RIP
+    - Linux 4.18.6
+    - updateconfigs after v4.18.6 stable update
+
+  * random oopses on s390 systems using NVMe devices (LP: #1790480)
+    - s390/pci: fix out of bounds access during irq setup
+
+  * [18.10 FEAT] zcrypt DD: introduce APQN tags to support deterministic driver
+    binding (LP: #1784331)
+    - s390/zcrypt: code beautify
+    - s390/zcrypt: AP bus support for alternate driver(s)
+    - s390/zcrypt: hex string mask improvements for apmask and aqmask.
+
+  * performance drop with ATS enabled (LP: #1788097)
+    - powerpc/powernv: Fix concurrency issue with npu->mmio_atsd_usage
+
+  * Fix MCE handling for user access of poisoned device-dax mapping
+    (LP: #1774366)
+    - device-dax: Convert to vmf_insert_mixed and vm_fault_t
+    - device-dax: Enable page_mapping()
+    - device-dax: Set page->index
+    - filesystem-dax: Set page->index
+    - mm, madvise_inject_error: Disable MADV_SOFT_OFFLINE for ZONE_DEVICE pages
+    - mm, dev_pagemap: Do not clear ->mapping on final put
+    - mm, madvise_inject_error: Let memory_failure() optionally take a page
+      reference
+    - mm, memory_failure: Collect mapping size in collect_procs()
+    - filesystem-dax: Introduce dax_lock_mapping_entry()
+    - mm, memory_failure: Teach memory_failure() about dev_pagemap pages
+    - x86/mm/pat: Prepare {reserve, free}_memtype() for "decoy" addresses
+    - x86/memory_failure: Introduce {set, clear}_mce_nospec()
+    - libnvdimm, pmem: Restore page attributes when clearing errors
+
+  * Reconcile hns3 SAUCE patches with upstream (LP: #1787477)
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix comments for
+      hclge_get_ring_chain_from_mbx"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for using wrong mask and
+      shift in hclge_get_ring_chain_from_mbx"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for reset_level default
+      assignment probelm"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unnecessary ring
+      configuration operation while resetting"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix return value error in
+      hns3_reset_notify_down_enet"
+    - Revert "UBUNTU: SAUCE: net: hns3: Fix for phy link issue when using marvell
+      phy driver"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: separate roce from nic when
+      resetting"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: correct reset event status
+      register"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: prevent to request reset
+      frequently"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: reset net device with rtnl_lock"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify the order of initializeing
+      command queue register"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: prevent sending command during
+      global or core reset"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Use roce handle when calling roce
+      callback function"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove the warning when clear
+      reset cause"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix get_vector ops in
+      hclgevf_main module"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix warning bug when doing lp
+      selftest"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add configure for mac minimal
+      frame size"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for mailbox message truncated
+      problem"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for l4 checksum offload bug"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for waterline not setting
+      correctly"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for mac pause not disable in
+      pfc mode"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix tc setup when netdev is first
+      up"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add calling roce callback
+      function when link status change"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: optimize the process of notifying
+      roce client"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add pf reset for hip08 RoCE"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add SPDX tags to hns3 driver"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused struct member and
+      definition"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix mislead parameter name"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify inconsistent bit mask
+      macros"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use decimal for bit offset
+      macros"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix unreasonable code comments"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove extra space and brackets"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: standardize the handle of return
+      value"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some redundant
+      assignments"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify hnae_ to hnae3_"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use dma_zalloc_coherent instead
+      of kzalloc/dma_map_single"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: give default option while
+      dependency HNS3 set"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some unused members of
+      some structures"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove a redundant
+      hclge_cmd_csq_done"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: using modulo for cyclic counters
+      in hclge_cmd_send"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: simplify hclge_cmd_csq_clean"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some redundant
+      assignments"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove useless code in
+      hclge_cmd_send"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused
+      hclge_ring_to_dma_dir"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use lower_32_bits and
+      upper_32_bits"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove back in struct hclge_hw"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add unlikely for error check"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove the Redundant put_vector
+      in hns3_client_uninit"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: print the ret value in error
+      information"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: extraction an interface for state
+      state init|uninit"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused head file in
+      hnae3.c"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add l4_type check for both ipv4
+      and ipv6"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add vector status check before
+      free vector"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: rename the interface for
+      init_client_instance and uninit_client_instance"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove hclge_get_vector_index
+      from hclge_bind_ring_with_vector"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: RX BD information valid only in
+      last BD except VLD bit and buffer size"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add support for serdes loopback
+      selftest"
+    - net: hns3: Updates RX packet info fetch in case of multi BD
+    - net: hns3: remove hclge_get_vector_index from hclge_bind_ring_with_vector
+    - net: hns3: rename the interface for init_client_instance and
+      uninit_client_instance
+    - net: hns3: add vector status check before free vector
+    - net: hns3: add l4_type check for both ipv4 and ipv6
+    - net: hns3: add unlikely for error check
+    - net: hns3: remove unused head file in hnae3.c
+    - net: hns3: extraction an interface for state init|uninit
+    - net: hns3: print the ret value in error information
+    - net: hns3: remove the Redundant put_vector in hns3_client_uninit
+    - net: hns3: remove back in struct hclge_hw
+    - net: hns3: use lower_32_bits and upper_32_bits
+    - net: hns3: remove unused hclge_ring_to_dma_dir
+    - net: hns3: remove useless code in hclge_cmd_send
+    - net: hns3: remove some redundant assignments
+    - net: hns3: simplify hclge_cmd_csq_clean
+    - net: hns3: remove a redundant hclge_cmd_csq_done
+    - net: hns3: remove some unused members of some structures
+    - net: hns3: give default option while dependency HNS3 set
+    - net: hns3: use dma_zalloc_coherent instead of kzalloc/dma_map_single
+    - net: hns3: modify hnae_ to hnae3_
+    - net: hns3: Fix tc setup when netdev is first up
+    - net: hns3: Fix for mac pause not disable in pfc mode
+    - net: hns3: Fix for waterline not setting correctly
+    - net: hns3: Fix for l4 checksum offload bug
+    - net: hns3: Fix for mailbox message truncated problem
+    - net: hns3: Add configure for mac minimal frame size
+    - net: hns3: Fix warning bug when doing lp selftest
+    - net: hns3: Fix get_vector ops in hclgevf_main module
+    - net: hns3: Remove the warning when clear reset cause
+    - net: hns3: Prevent sending command during global or core reset
+    - net: hns3: Modify the order of initializing command queue register
+    - net: hns3: Reset net device with rtnl_lock
+    - net: hns3: Prevent to request reset frequently
+    - net: hns3: Correct reset event status register
+    - net: hns3: Fix return value error in hns3_reset_notify_down_enet
+    - net: hns3: remove unnecessary ring configuration operation while resetting
+    - net: hns3: Fix for reset_level default assignment probelm
+    - net: hns3: Fix for using wrong mask and shift in
+      hclge_get_ring_chain_from_mbx
+    - net: hns3: Fix comments for hclge_get_ring_chain_from_mbx
+    - net: hns3: Remove some redundant assignments
+    - net: hns3: Standardize the handle of return value
+    - net: hns3: Remove extra space and brackets
+    - net: hns3: Correct unreasonable code comments
+    - net: hns3: Use decimal for bit offset macros
+    - net: hns3: Modify inconsistent bit mask macros
+    - net: hns3: Fix misleading parameter name
+    - net: hns3: Remove unused struct member and definition
+    - net: hns3: Add SPDX tags to HNS3 PF driver
+    - net: hns3: Add support for serdes loopback selftest
+    - net: hns3: Fix for phy link issue when using marvell phy driver
+
+  * [Regression] kernel crashdump fails on arm64 (LP: #1786878)
+    - arm64: export memblock_reserve()d regions via /proc/iomem
+    - drivers: acpi: add dependency of EFI for arm64
+    - efi/arm: preserve early mapping of UEFI memory map longer for BGRT
+    - efi/arm: map UEFI memory map even w/o runtime services enabled
+    - arm64: acpi: fix alignment fault in accessing ACPI
+    - [Config] CONFIG_ARCH_SUPPORTS_ACPI=y
+    - arm64: fix ACPI dependencies
+    - ACPI: fix menuconfig presentation of ACPI submenu
+
+  * TB 16 issue on Dell Lattitude 7490 with large amount of data (LP: #1785780)
+    - r8152: disable RX aggregation on new Dell TB16 dock
+
+  * Support Power Management for Thunderbolt Controller  (LP: #1789358)
+    - thunderbolt: Use 64-bit DMA mask if supported by the platform
+    - thunderbolt: Do not unnecessarily call ICM get route
+    - thunderbolt: No need to take tb->lock in domain suspend/complete
+    - thunderbolt: Use correct ICM commands in system suspend
+    - thunderbolt: Add support for runtime PM
+
+  * Enable AMD PCIe MP2 for AMDI0011 (LP: #1773940)
+    - SAUCE: i2c:amd I2C Driver based on PCI Interface for upcoming platform
+    - SAUCE: i2c:amd move out pointer in union i2c_event_base
+    - SAUCE: i2c:amd Depends on ACPI
+    - [Config] i2c: CONFIG_I2C_AMD_MP2=y on x86
+
+  * Microphone cannot be detected with front panel audio combo jack on HP Z8-G4
+    machine (LP: #1789145)
+    - ALSA: hda/realtek - Fix HP Headset Mic can't record
+
+  * Please enable CONFIG_PAGE_POISONING (LP: #1783651)
+    - [Config] Enable CONFIG_PAGE_POISONING configs
+
+  * Tango platform uses __initcall without further checks (LP: #1787945)
+    - [Config] disable ARCH_TANGO
+
+  * [18.10 FEAT] SMC-Direct (LP: #1786902)
+    - net/smc: determine port attributes independent from pnet table
+    - net/smc: add pnetid support
+    - net/smc: add base infrastructure for SMC-D and ISM
+    - net/smc: add pnetid support for SMC-D and ISM
+    - net/smc: add SMC-D support in CLC messages
+    - net/smc: add SMC-D support in data transfer
+    - net/smc: add SMC-D support in af_smc
+    - net/smc: add SMC-D diag support
+    - net/smc: provide smc mode in smc_diag.c
+    - net/smc: eliminate cursor read and write calls
+    - net/smc: add function to get link group from link
+    - net/smc: use DECLARE_BITMAP for rtokens_used_mask
+    - net/smc: remove local variable page in smc_rx_splice()
+    - net/smc: Remove a WARN_ON() statement
+    - net/smc: Simplify ib_post_(send|recv|srq_recv)() calls
+    - net/smc: fewer parameters for smc_llc_send_confirm_link()
+    - net/smc: use correct vlan gid of RoCE device
+    - net/smc: provide fallback reason code
+    - net/smc: improve delete link processing
+    - net: simplify sock_poll_wait
+    - net/smc: send response to test link signal
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations for CONFIG_CRYPTO_SPECK_NEON
+    - [Config] fix up annotatios for CONFIG_CRYPTO_SPECK
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 10 Sep 2018 07:08:38 -0500
+
+linux (4.18.0-7.8) cosmic; urgency=medium
+
+  * linux: 4.18.0-7.8 -proposed tracker (LP: #1789459)
+
+  * pmtu.sh fails on 4.18 kernel (LP: #1789436)
+    - SAUCE: Revert "vti6: fix PMTU caching and reporting on xmit"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Aug 2018 11:08:51 -0500
+
+linux (4.18.0-6.7) cosmic; urgency=medium
+
+  * linux: 4.18.0-6.7 -proposed tracker (LP: #1788881)
+
+  * systemd 237-3ubuntu10 ADT test failure with linux 4.18.0-5.6 (LP: #1787440)
+    - Config: Disable BPF_JIT_ALWAYS_ON on i386
+
+  * execveat03 in ubuntu_ltp_syscalls failed on X/B (LP: #1786729)
+    - cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()
+
+  * Cosmic update to v4.18.5 stable release (LP: #1788874)
+    - EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[]
+    - pty: fix O_CLOEXEC for TIOCGPTPEER
+    - mm: Allow non-direct-map arguments to free_reserved_area()
+    - x86/mm/init: Pass unconverted symbol addresses to free_init_pages()
+    - x86/mm/init: Add helper for freeing kernel image pages
+    - x86/mm/init: Remove freed kernel image areas from alias mapping
+    - powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2
+    - ext4: fix spectre gadget in ext4_mb_regular_allocator()
+    - drm/i915/kvmgt: Fix potential Spectre v1
+    - drm/amdgpu/pm: Fix potential Spectre v1
+    - parisc: Remove unnecessary barriers from spinlock.h
+    - parisc: Remove ordered stores from syscall.S
+    - PCI: Restore resized BAR state on resume
+    - PCI / ACPI / PM: Resume all bridges on suspend-to-RAM
+    - PCI: hotplug: Don't leak pci_slot on registration failure
+    - PCI: aardvark: Size bridges before resources allocation
+    - PCI: Skip MPS logic for Virtual Functions (VFs)
+    - PCI: pciehp: Fix use-after-free on unplug
+    - PCI: pciehp: Fix unprotected list iteration in IRQ handler
+    - i2c: core: ACPI: Properly set status byte to 0 for multi-byte writes
+    - i2c: imx: Fix race condition in dma read
+    - reiserfs: fix broken xattr handling (heap corruption, bad retval)
+    - Linux 4.18.5
+
+  * [18.10 FEAT] Add kernel config option "CONFIG_SCLP_OFB" (LP: #1787898)
+    - [Config] CONFIG_SCLP_OFB=y for s390x
+
+  * errors when scanning partition table of corrupted AIX disk (LP: #1787281)
+    - partitions/aix: fix usage of uninitialized lv_info and lvname structures
+    - partitions/aix: append null character to print data from disk
+
+  * Apply NVMe bugfix from Google that bjf asked for (LP: #1787635)
+    - nvme-pci: add a memory barrier to nvme_dbbuf_update_and_check_event
+
+  * ThinkPad systems have no HDMI sound when using the nvidia GPU (LP: #1787058)
+    - ACPI / OSI: Add OEM _OSI string to enable NVidia HDMI audio
+
+  * Cosmic update to v4.18.4 stable release (LP: #1788454)
+    - l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache
+    - net_sched: fix NULL pointer dereference when delete tcindex filter
+    - net_sched: Fix missing res info when create new tc_index filter
+    - r8169: don't use MSI-X on RTL8168g
+    - ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs
+    - ALSA: hda - Turn CX8200 into D3 as well upon reboot
+    - ALSA: vx222: Fix invalid endian conversions
+    - ALSA: virmidi: Fix too long output trigger loop
+    - ALSA: cs5535audio: Fix invalid endian conversion
+    - ALSA: dice: fix wrong copy to rx parameters for Alesis iO26
+    - ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry
+    - ALSA: memalloc: Don't exceed over the requested size
+    - ALSA: vxpocket: Fix invalid endian conversions
+    - ALSA: seq: Fix poll() error return
+    - media: gl861: fix probe of dvb_usb_gl861
+    - USB: serial: sierra: fix potential deadlock at close
+    - USB: serial: pl2303: add a new device id for ATEN
+    - USB: option: add support for DW5821e
+    - ACPI / PM: save NVS memory for ASUS 1025C laptop
+    - tty: serial: 8250: Revert NXP SC16C2552 workaround
+    - serial: 8250_exar: Read INT0 from slave device, too
+    - serial: 8250_dw: always set baud rate in dw8250_set_termios
+    - serial: 8250_dw: Add ACPI support for uart on Broadcom SoC
+    - uio: fix wrong return value from uio_mmap()
+    - misc: sram: fix resource leaks in probe error path
+    - Revert "uio: use request_threaded_irq instead"
+    - Bluetooth: avoid killing an already killed socket
+    - isdn: Disable IIOCDBGVAR
+    - net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd()
+    - hv/netvsc: Fix NULL dereference at single queue mode fallback
+    - r8169: don't use MSI-X on RTL8106e
+    - ip_vti: fix a null pointer deferrence when create vti fallback tunnel
+    - net: ethernet: mvneta: Fix napi structure mixup on armada 3700
+    - net: mvneta: fix mvneta_config_rss on armada 3700
+    - cls_matchall: fix tcf_unbind_filter missing
+    - Linux 4.18.4
+
+  * Cosmic update to v4.18.3 stable release (LP: #1788453)
+    - x86/speculation/l1tf: Exempt zeroed PTEs from inversion
+    - Linux 4.18.3
+
+  * Cosmic update to v4.18.2 stable release (LP: #1788452)
+    - x86/l1tf: Fix build error seen if CONFIG_KVM_INTEL is disabled
+    - x86: i8259: Add missing include file
+    - x86/hyper-v: Check for VP_INVAL in hyperv_flush_tlb_others()
+    - x86/platform/UV: Mark memblock related init code and data correctly
+    - x86/mm/pti: Clear Global bit more aggressively
+    - xen/pv: Call get_cpu_address_sizes to set x86_virt/phys_bits
+    - x86/mm: Disable ioremap free page handling on x86-PAE
+    - kbuild: verify that $DEPMOD is installed
+    - crypto: ccree - fix finup
+    - crypto: ccree - fix iv handling
+    - crypto: ccp - Check for NULL PSP pointer at module unload
+    - crypto: ccp - Fix command completion detection race
+    - crypto: x86/sha256-mb - fix digest copy in sha256_mb_mgr_get_comp_job_avx2()
+    - crypto: vmac - require a block cipher with 128-bit block size
+    - crypto: vmac - separate tfm and request context
+    - crypto: blkcipher - fix crash flushing dcache in error path
+    - crypto: ablkcipher - fix crash flushing dcache in error path
+    - crypto: skcipher - fix aligning block size in skcipher_copy_iv()
+    - crypto: skcipher - fix crash flushing dcache in error path
+    - ioremap: Update pgtable free interfaces with addr
+    - x86/mm: Add TLB purge to free pmd/pte page interfaces
+    - Linux 4.18.2
+
+  * Cosmic update to v4.18.2 stable release (LP: #1788452) // CVE-2018-9363
+    - Bluetooth: hidp: buffer overflow in hidp_process_report
+
+  * linux-cloud-tools-common: Ensure hv-kvp-daemon.service starts before
+    walinuxagent.service (LP: #1739107)
+    - [Debian] hyper-v -- Ensure that hv-kvp-daemon.service starts before
+      walinuxagent.service
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: ipvs: remove nbsp characters from Kconfig
+    - [Config] CONFIG_MPROFILE_KERNEL=y for ppc64el
+    - [Config] CONFIG_DRM_RCAR_LVDS=m for snapdragon
+    - [Config] CONFIG_MDIO_MSCC_MIIM=n for s390x
+    - [Config] CONFIG_NET_VENDOR_MICROSEMI=n, CONFIG_NET_VENDOR_NI=n for s390x
+    - [Config] update annotations following config review
+    - [Debian] set CROSS_COMPILE when generating kernel configs
+    - [Config] Disable the Speck cipher
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 24 Aug 2018 14:18:15 -0500
+
+linux (4.18.0-5.6) cosmic; urgency=medium
+
+  * Cosmic update to v4.18.1 stable release (LP: #1787264)
+    - x86/paravirt: Fix spectre-v2 mitigations for paravirt guests
+    - x86/speculation: Protect against userspace-userspace spectreRSB
+    - kprobes/x86: Fix %p uses in error messages
+    - x86/irqflags: Provide a declaration for native_save_fl
+    - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
+    - x86/speculation/l1tf: Change order of offset/type in swap entry
+    - x86/speculation/l1tf: Protect swap entries against L1TF
+    - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
+    - x86/speculation/l1tf: Make sure the first page is always reserved
+    - x86/speculation/l1tf: Add sysfs reporting for l1tf
+    - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
+    - x86/speculation/l1tf: Limit swap file size to MAX_PA/2
+    - x86/bugs: Move the l1tf function and define pr_fmt properly
+    - sched/smt: Update sched_smt_present at runtime
+    - x86/smp: Provide topology_is_primary_thread()
+    - x86/topology: Provide topology_smt_supported()
+    - cpu/hotplug: Make bringup/teardown of smp threads symmetric
+    - cpu/hotplug: Split do_cpu_down()
+    - cpu/hotplug: Provide knobs to control SMT
+    - x86/cpu: Remove the pointless CPU printout
+    - x86/cpu/AMD: Remove the pointless detect_ht() call
+    - x86/cpu/common: Provide detect_ht_early()
+    - x86/cpu/topology: Provide detect_extended_topology_early()
+    - x86/cpu/intel: Evaluate smp_num_siblings early
+    - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info
+    - x86/cpu/AMD: Evaluate smp_num_siblings early
+    - x86/apic: Ignore secondary threads if nosmt=force
+    - x86/speculation/l1tf: Extend 64bit swap file size limit
+    - x86/cpufeatures: Add detection of L1D cache flush support.
+    - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings
+    - x86/speculation/l1tf: Protect PAE swap entries against L1TF
+    - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
+    - Revert "x86/apic: Ignore secondary threads if nosmt=force"
+    - cpu/hotplug: Boot HT siblings at least once
+    - x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present
+    - x86/KVM/VMX: Add module argument for L1TF mitigation
+    - x86/KVM/VMX: Add L1D flush algorithm
+    - x86/KVM/VMX: Add L1D MSR based flush
+    - x86/KVM/VMX: Add L1D flush logic
+    - x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers
+    - x86/KVM/VMX: Add find_msr() helper function
+    - x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting
+    - x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
+    - x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
+    - cpu/hotplug: Online siblings when SMT control is turned on
+    - x86/litf: Introduce vmx status variable
+    - x86/kvm: Drop L1TF MSR list approach
+    - x86/l1tf: Handle EPT disabled state proper
+    - x86/kvm: Move l1tf setup function
+    - x86/kvm: Add static key for flush always
+    - x86/kvm: Serialize L1D flush parameter setter
+    - x86/kvm: Allow runtime control of L1D flush
+    - cpu/hotplug: Expose SMT control init function
+    - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early
+    - x86/bugs, kvm: Introduce boot-time control of L1TF mitigations
+    - Documentation: Add section about CPU vulnerabilities
+    - x86/speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures
+    - x86/KVM/VMX: Initialize the vmx_l1d_flush_pages' content
+    - Documentation/l1tf: Fix typos
+    - cpu/hotplug: detect SMT disabled by BIOS
+    - x86/KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush()
+    - x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond'
+    - x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()
+    - x86/irq: Demote irq_cpustat_t::__softirq_pending to u16
+    - x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d
+    - x86: Don't include linux/irq.h from asm/hardirq.h
+    - x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d
+    - x86/KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr()
+    - Documentation/l1tf: Remove Yonah processors from not vulnerable list
+    - x86/speculation: Simplify sysfs report of VMX L1TF vulnerability
+    - x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry
+    - KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry
+    - cpu/hotplug: Fix SMT supported evaluation
+    - x86/speculation/l1tf: Invert all not present mappings
+    - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
+    - x86/mm/pat: Make set_memory_np() L1TF safe
+    - x86/mm/kmmio: Make the tracer robust against L1TF
+    - tools headers: Synchronise x86 cpufeatures.h for L1TF additions
+    - x86/microcode: Allow late microcode loading with SMT disabled
+    - x86/smp: fix non-SMP broken build due to redefinition of
+      apic_id_is_primary_thread
+    - cpu/hotplug: Non-SMP machines do not make use of booted_once
+    - x86/init: fix build with CONFIG_SWAP=n
+    - Linux 4.18.1
+    - [Config] updateconfigs after v4.18.1 stable update
+
+  * Consider enabling CONFIG_NETWORK_PHY_TIMESTAMPING (LP: #1785816)
+    - [Config] Enable timestamping in network PHY devices
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_SYSCTL_SYSCALL=n
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 15 Aug 2018 14:20:59 -0500
+
+linux (4.18.0-4.5) cosmic; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Aug 2018 13:54:02 -0500
+
+linux (4.18.0-3.4) cosmic; urgency=medium
+
+  * Suspend fails in Ubuntu and Kubuntu 18.04 but works fine in Ubuntu and
+    Kubuntu 17.10 (and on Kubuntu 18.04 using kernel 4.14.47) (LP: #1774950)
+    - ACPI / LPSS: Avoid PM quirks on suspend and resume from hibernation
+
+  * hinic interfaces aren't getting predictable names (LP: #1783138)
+    - hinic: Link the logical network device to the pci device in sysfs
+
+  * libvirtd is unable to configure bridge devices inside of LXD containers
+    (LP: #1784501)
+    - kernfs: allow creating kernfs objects with arbitrary uid/gid
+    - sysfs, kobject: allow creating kobject belonging to arbitrary users
+    - kobject: kset_create_and_add() - fetch ownership info from parent
+    - driver core: set up ownership of class devices in sysfs
+    - net-sysfs: require net admin in the init ns for setting tx_maxrate
+    - net-sysfs: make sure objects belong to container's owner
+    - net: create reusable function for getting ownership info of sysfs inodes
+    - bridge: make sure objects belong to container's owner
+    - sysfs: Fix regression when adding a file to an existing group
+
+  * locking sockets broken due to missing AppArmor socket mediation patches
+    (LP: #1780227)
+    - UBUNTU SAUCE: apparmor: fix apparmor mediating locking non-fs, unix sockets
+
+  * Update2 for ocxl driver (LP: #1781436)
+    - ocxl: Fix page fault handler in case of fault on dying process
+
+  * HDMI/DP audio can't work on the laptop of Dell Latitude 5495 (LP: #1782689)
+    - ALSA: hda: use PCI_BASE_CLASS_DISPLAY to replace PCI_CLASS_DISPLAY_VGA
+    - vga_switcheroo: set audio client id according to bound GPU id
+
+  * Allow Raven Ridge's audio controller to be runtime suspended (LP: #1782540)
+    - ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge
+
+  * Invoking obsolete 'firmware_install' target breaks snap build (LP: #1782166)
+    - snapcraft.yaml: stop invoking the obsolete (and non-existing)
+      'firmware_install' target
+
+  * snapcraft.yaml: missing ubuntu-retpoline-extract-one script breaks the build
+    (LP: #1782116)
+    - snapcraft.yaml: copy retpoline-extract-one to scripts before build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 01 Aug 2018 08:49:40 -0500
+
+linux (4.18.0-2.3) cosmic; urgency=medium
+
+  * Kernel error "task zfs:pid blocked for more than 120 seconds" (LP: #1781364)
+    - SAUCE: (noup) zfs to 0.7.9-3ubuntu4
+
+  * [Regression] EXT4-fs error (device sda1): ext4_validate_inode_bitmap:99:
+    comm stress-ng: Corrupt inode bitmap (LP: #1780137)
+    - SAUCE: ext4: fix ext4_validate_inode_bitmap: comm stress-ng: Corrupt inode
+      bitmap
+
+  * Cloud-init causes potentially huge boot delays with 4.15 kernels
+    (LP: #1780062)
+    - random: Make getrandom() ready earlier
+
+  * hisi_sas_v3_hw: internal task abort: timeout and not done. (LP: #1777736)
+    - scsi: hisi_sas: Update a couple of register settings for v3 hw
+
+  * hisi_sas: Add missing PHY spinlock init (LP: #1777734)
+    - scsi: hisi_sas: Add missing PHY spinlock init
+
+  * hisi_sas: improve read performance by pre-allocating slot DMA buffers
+    (LP: #1777727)
+    - scsi: hisi_sas: Use dmam_alloc_coherent()
+    - scsi: hisi_sas: Pre-allocate slot DMA buffers
+
+  * hisi_sas: Failures during host reset (LP: #1777696)
+    - scsi: hisi_sas: Only process broadcast change in phy_bcast_v3_hw()
+    - scsi: hisi_sas: Fix the conflict between dev gone and host reset
+    - scsi: hisi_sas: Adjust task reject period during host reset
+    - scsi: hisi_sas: Add a flag to filter PHY events during reset
+    - scsi: hisi_sas: Release all remaining resources in clear nexus ha
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.9-3ubuntu2, zfs to 0.7.9-3ubuntu3
+    - SAUCE: mm: Fix exports that inadvertently make put_page() EXPORT_SYMBOL_GPL
+    - Enable zfs build
+    - SAUCE: Import aufs driver
+    - Revert "UBUNTU: [Config]: set CONFIG_EDAC_DEBUG=y for ARM64"
+    - [Config] retpoline -- review and accept retpoline changes
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc5
+  * Rebase to v4.18-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 24 Jul 2018 08:41:22 -0500
+
+linux (4.18.0-1.2) cosmic; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 09 Jul 2018 07:36:31 -0500
+
+linux (4.18.0-0.1) cosmic; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu -- disable vbox build
+    - Disable zfs build
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) ima: require secure_boot rules in lockdown mode
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) lockdown: fix coordination of kernel module signature
+      verification
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Don't print secure boot state from the efi stub
+    - SAUCE: (namespace) block_dev: Support checking inode permissions in
+      lookup_bdev()
+    - SAUCE: (namespace) block_dev: Check permissions towards block device inode
+      when mounting
+    - SAUCE: (namespace) mtd: Check permissions towards mtd block device inode
+      when mounting
+    - SAUCE: (namespace) ext4: Add support for unprivileged mounts from user
+      namespaces
+    - SAUCE: (namespace) ext4: Add module parameter to enable user namespace
+      mounts
+    - SAUCE: (namespace) block_dev: Forbid unprivileged mounting when device is
+      opened for writing
+    - SAUCE: Import aufs driver
+    - Update dropped.txt
+    - [Config] updateconfigs after 4.18-rc3 rebase
+    - SAUCE: (no-up): ASoC: Intel: bytcr-rt5660: Remove snd_soc_codec use for 4.18
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 06 Jul 2018 10:46:37 -0500
+
+linux (4.18.0-0.0) cosmic; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 03 Jul 2018 11:10:33 -0500
+
+linux (4.17.0-4.5) cosmic; urgency=medium
+
+  * linux: 4.17.0-4.5 -proposed tracker (LP: #1779399)
+
+  * Update to ocxl driver for 18.04.1 (LP: #1775786)
+    - powerpc: Add TIDR CPU feature for POWER9
+    - powerpc: Use TIDR CPU feature to control TIDR allocation
+    - powerpc: use task_pid_nr() for TID allocation
+    - ocxl: Rename pnv_ocxl_spa_remove_pe to clarify it's action
+    - ocxl: Expose the thread_id needed for wait on POWER9
+    - ocxl: Add an IOCTL so userspace knows what OCXL features are available
+    - ocxl: Document new OCXL IOCTLs
+    - ocxl: Fix missing unlock on error in afu_ioctl_enable_p9_wait()
+
+  * Please include ax88179_178a and r8152 modules in d-i udeb (LP: #1771823)
+    - [Config:] d-i: Add ax88179_178a and r8152 to nic-modules
+
+  * glibc pkeys test fail on powerpc (LP: #1776967)
+    - [Config] Temporarily disable CONFIG_PPC_MEM_KEYS
+
+  * After update to 4.13-43 Intel Graphics are Laggy (LP: #1773520)
+    - Revert "drm/i915/edp: Allow alternate fixed mode for eDP if available."
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.9-3ubuntu1, zfs to 0.7.9-3ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 29 Jun 2018 13:37:52 -0500
+
+linux (4.17.0-3.4) cosmic; urgency=medium
+
+  * linux: 4.17.0-3.4 -proposed tracker (LP: #1779124)
+
+  * Cosmic update to v4.17.3 stable release (LP: #1778997)
+    - net: aquantia: fix unsigned numvecs comparison with less than zero
+    - bonding: re-evaluate force_primary when the primary slave name changes
+    - cdc_ncm: avoid padding beyond end of skb
+    - ipv6: allow PMTU exceptions to local routes
+    - net: dsa: add error handling for pskb_trim_rcsum
+    - net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620
+    - net/sched: act_simple: fix parsing of TCA_DEF_DATA
+    - tcp: verify the checksum of the first data segment in a new connection
+    - tls: fix use-after-free in tls_push_record
+    - tls: fix waitall behavior in tls_sw_recvmsg
+    - socket: close race condition between sock_close() and sockfs_setattr()
+    - udp: fix rx queue len reported by diag and proc interface
+    - net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds
+      vlan
+    - hv_netvsc: Fix a network regression after ifdown/ifup
+    - ACPICA: AML parser: attempt to continue loading table after error
+    - ext4: fix hole length detection in ext4_ind_map_blocks()
+    - ext4: update mtime in ext4_punch_hole even if no blocks are released
+    - ext4: do not allow external inodes for inline data
+    - ext4: bubble errors from ext4_find_inline_data_nolock() up to ext4_iget()
+    - ext4: correctly handle a zero-length xattr with a non-zero e_value_offs
+    - ext4: fix fencepost error in check for inode count overflow during resize
+    - driver core: Don't ignore class_dir_create_and_add() failure.
+    - Btrfs: allow empty subvol= again
+    - Btrfs: fix clone vs chattr NODATASUM race
+    - Btrfs: fix memory and mount leak in btrfs_ioctl_rm_dev_v2()
+    - btrfs: return error value if create_io_em failed in cow_file_range
+    - btrfs: scrub: Don't use inode pages for device replace
+    - ALSA: usb-audio: Disable the quirk for Nura headset
+    - ALSA: hda/conexant - Add fixup for HP Z2 G4 workstation
+    - ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
+    - ALSA: hda: add dock and led support for HP EliteBook 830 G5
+    - ALSA: hda: add dock and led support for HP ProBook 640 G4
+    - x86/MCE: Fix stack out-of-bounds write in mce-inject.c: Flags_read()
+    - smb3: fix various xid leaks
+    - smb3: on reconnect set PreviousSessionId field
+    - CIFS: 511c54a2f69195b28afb9dd119f03787b1625bb4 adds a check for session
+      expiry
+    - cifs: For SMB2 security informaion query, check for minimum sized security
+      descriptor instead of sizeof FileAllInformation class
+    - nbd: fix nbd device deletion
+    - nbd: update size when connected
+    - nbd: use bd_set_size when updating disk size
+    - blk-mq: reinit q->tag_set_list entry only after grace period
+    - bdi: Move cgroup bdi_writeback to a dedicated low concurrency workqueue
+    - cpufreq: Fix new policy initialization during limits updates via sysfs
+    - cpufreq: ti-cpufreq: Fix an incorrect error return value
+    - cpufreq: governors: Fix long idle detection logic in load calculation
+    - libata: zpodd: small read overflow in eject_tray()
+    - libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
+    - nvme/pci: Sync controller reset for AER slot_reset
+    - w1: mxc_w1: Enable clock before calling clk_get_rate() on it
+    - x86/vector: Fix the args of vector_alloc tracepoint
+    - x86/apic/vector: Prevent hlist corruption and leaks
+    - x86/apic: Provide apic_ack_irq()
+    - x86/ioapic: Use apic_ack_irq()
+    - x86/platform/uv: Use apic_ack_irq()
+    - irq_remapping: Use apic_ack_irq()
+    - genirq/generic_pending: Do not lose pending affinity update
+    - genirq/affinity: Defer affinity setting if irq chip is busy
+    - genirq/migration: Avoid out of line call if pending is not set
+    - x86/intel_rdt: Enable CMT and MBM on new Skylake stepping
+    - media: uvcvideo: Prevent setting unavailable flags
+    - media: rc: ensure input/lirc device can be opened after register
+    - iwlwifi: fw: harden page loading code
+    - orangefs: set i_size on new symlink
+    - orangefs: report attributes_mask and attributes for statx
+    - HID: intel_ish-hid: ipc: register more pm callbacks to support hibernation
+    - HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large
+    - vhost: fix info leak due to uninitialized memory
+    - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
+    - Linux 4.17.3
+
+  * Use-after-free in sk_peer_label (LP: #1778646)
+    - SAUCE: apparmor: fix use after free in sk_peer_label
+
+  * kernel: Fix memory leak on CCA and EP11 CPRB processing. (LP: #1775390)
+    - s390/zcrypt: Fix CCA and EP11 CPRB processing failure memory leak.
+
+  * Various fixes for CXL kernel module (LP: #1774471)
+    - cxl: Configure PSL to not use APC virtual machines
+    - cxl: Disable prefault_mode in Radix mode
+
+  * Bluetooth not working (LP: #1764645)
+    - Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
+
+  * Fake SAS addresses for SATA disks on HiSilicon D05 are non-unique
+    (LP: #1776750)
+    - scsi: hisi_sas: make SAS address of SATA disks unique
+
+  * linux-snapdragon: wcn36xx: mac address generation on boot (LP: #1776491)
+    - [Config] arm64: snapdragon: WCN36XX_SNAPDRAGON_HACKS=y
+    - SAUCE: wcn36xx: read MAC from file or randomly generate one
+
+  * Lenovo V330 needs patch in ideapad_laptop module for rfkill (LP: #1774636)
+    - SAUCE: Add Lenovo V330 to the ideapad_laptop rfkill blacklist
+
+  * register on binfmt_misc may overflow and crash the system (LP: #1775856)
+    - fs/binfmt_misc.c: do not allow offset overflow
+
+  * Network installs fail on SocioNext board (LP: #1775884)
+    - net: socionext: reset hardware in ndo_stop
+    - net: netsec: enable tx-irq during open callback
+
+  * Fix several bugs in RDMA/hns driver (LP: #1770974)
+    - RDMA/hns: Drop local zgid in favor of core defined variable
+    - RDMA/hns: Add 64KB page size support for hip08
+    - RDMA/hns: Rename the idx field of db
+    - RDMA/hns: Modify uar allocation algorithm to avoid bitmap exhaust
+    - RDMA/hns: Increase checking CMQ status timeout value
+    - RDMA/hns: Add reset process for RoCE in hip08
+    - RDMA/hns: Fix the illegal memory operation when cross page
+    - RDMA/hns: Implement the disassociate_ucontext API
+
+  * powerpc/livepatch: Implement reliable stack tracing for the consistency
+    model (LP: #1771844)
+    - powerpc/livepatch: Implement reliable stack tracing for the consistency
+      model
+
+  * Adding back alx WoL feature (LP: #1772610)
+    - SAUCE: Revert "alx: remove WoL support"
+    - SAUCE: alx: add enable_wol paramenter
+
+  * Lancer A0 Asic HBA's won't boot with 18.04 (LP: #1768103)
+    - scsi: lpfc: Fix WQ/CQ creation for older asic's.
+    - scsi: lpfc: Fix 16gb hbas failing cq create.
+
+  * [LTCTest][OPAL][OP920] cpupower idle-info is not listing stop4 and stop5
+    idle states when all CORES are guarded (LP: #1771780)
+    - powerpc/powernv/cpuidle: Init all present cpus for deep states
+
+  * Huawei 25G/100G Network Adapters Unsupported (LP: #1770970)
+    - net-next/hinic: add pci device ids for 25ge and 100ge card
+
+  * Expose arm64 CPU topology to userspace (LP: #1770231)
+    - drivers: base: cacheinfo: move cache_setup_of_node()
+    - drivers: base: cacheinfo: setup DT cache properties early
+    - cacheinfo: rename of_node to fw_token
+    - arm64/acpi: Create arch specific cpu to acpi id helper
+    - ACPI/PPTT: Add Processor Properties Topology Table parsing
+    - [Config] CONFIG_ACPI_PPTT=y
+    - ACPI: Enable PPTT support on ARM64
+    - drivers: base cacheinfo: Add support for ACPI based firmware tables
+    - arm64: Add support for ACPI based firmware tables
+    - arm64: topology: rename cluster_id
+    - arm64: topology: enable ACPI/PPTT based CPU topology
+    - ACPI: Add PPTT to injectable table list
+    - arm64: topology: divorce MC scheduling domain from core_siblings
+
+  * Vcs-Git header on bionic linux source package points to zesty git tree
+    (LP: #1766055)
+    - [Packaging]: Update Vcs-Git
+
+  * Request to revert SAUCE patches in the 18.04 SRU and update with upstream
+    version (LP: #1768431)
+    - scsi: cxlflash: Handle spurious interrupts
+    - scsi: cxlflash: Remove commmands from pending list on timeout
+    - scsi: cxlflash: Synchronize reset and remove ops
+    - SAUCE: (no-up) cxlflash: OCXL diff between v2 and v3
+
+  * hisi_sas robustness fixes (LP: #1774466)
+    - scsi: hisi_sas: delete timer when removing hisi_sas driver
+    - scsi: hisi_sas: print device id for errors
+    - scsi: hisi_sas: Add some checks to avoid free'ing a sas_task twice
+    - scsi: hisi_sas: check host frozen before calling "done" function
+    - scsi: hisi_sas: check sas_dev gone earlier in hisi_sas_abort_task()
+    - scsi: hisi_sas: stop controller timer for reset
+    - scsi: hisi_sas: update PHY linkrate after a controller reset
+    - scsi: hisi_sas: change slot index allocation mode
+    - scsi: hisi_sas: Change common allocation mode of device id
+    - scsi: hisi_sas: Reset disks when discovered
+    - scsi: hisi_sas: Create a scsi_host_template per HW module
+    - scsi: hisi_sas: Init disks after controller reset
+    - scsi: hisi_sas: Try wait commands before before controller reset
+    - scsi: hisi_sas: Include TMF elements in struct hisi_sas_slot
+    - scsi: hisi_sas: Add v2 hw force PHY function for internal ATA command
+    - scsi: hisi_sas: Terminate STP reject quickly for v2 hw
+    - scsi: hisi_sas: Fix return value when get_free_slot() failed
+    - scsi: hisi_sas: Mark PHY as in reset for nexus reset
+
+  * hisi_sas: Support newer v3 hardware (LP: #1774467)
+    - scsi: hisi_sas: update RAS feature for later revision of v3 HW
+    - scsi: hisi_sas: check IPTT is valid before using it for v3 hw
+    - scsi: hisi_sas: fix PI memory size
+    - scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw
+    - scsi: hisi_sas: remove redundant handling to event95 for v3
+    - scsi: hisi_sas: add readl poll timeout helper wrappers
+    - scsi: hisi_sas: workaround a v3 hw hilink bug
+    - scsi: hisi_sas: Add LED feature for v3 hw
+
+  * hisi_sas: improve performance by optimizing DQ locking (LP: #1774472)
+    - scsi: hisi_sas: optimise the usage of DQ locking
+    - scsi: hisi_sas: relocate smp sg map
+    - scsi: hisi_sas: make return type of prep functions void
+    - scsi: hisi_sas: allocate slot buffer earlier
+    - scsi: hisi_sas: Don't lock DQ for complete task sending
+    - scsi: hisi_sas: Use device lock to protect slot alloc/free
+    - scsi: hisi_sas: add check of device in hisi_sas_task_exec()
+    - scsi: hisi_sas: fix a typo in hisi_sas_task_prep()
+
+  * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336)
+    - SAUCE: CacheFiles: fix a read_waiter/read_copier race
+
+  * enable mic-mute hotkey and led on Lenovo M820z and M920z (LP: #1774306)
+    - ALSA: hda/realtek - Enable mic-mute hotkey for several Lenovo AIOs
+
+  * hns3 driver updates (LP: #1768670)
+    - net: hns3: Remove error log when getting pfc stats fails
+    - net: hns3: fix to correctly fetch l4 protocol outer header
+    - net: hns3: Fixes the out of bounds access in hclge_map_tqp
+    - net: hns3: Fixes the error legs in hclge_init_ae_dev function
+    - net: hns3: fix for phy_addr error in hclge_mac_mdio_config
+    - net: hns3: Fix to support autoneg only for port attached with phy
+    - net: hns3: fix a dead loop in hclge_cmd_csq_clean
+    - net: hns3: Fix for packet loss due wrong filter config in VLAN tbls
+    - net: hns3: Remove packet statistics in the range of 8192~12287
+    - net: hns3: Add support of hardware rx-vlan-offload to HNS3 VF driver
+    - net: hns3: Fix for setting mac address when resetting
+    - net: hns3: remove add/del_tunnel_udp in hns3_enet module
+    - net: hns3: fix for cleaning ring problem
+    - net: hns3: refactor the loopback related function
+    - net: hns3: Fix for deadlock problem occurring when unregistering ae_algo
+    - net: hns3: Fix for the null pointer problem occurring when initializing
+      ae_dev failed
+    - net: hns3: Add a check for client instance init state
+    - net: hns3: Change return type of hnae3_register_ae_dev
+    - net: hns3: Change return type of hnae3_register_ae_algo
+    - net: hns3: Change return value in hnae3_register_client
+    - net: hns3: Fixes the back pressure setting when sriov is enabled
+    - net: hns3: Fix for fiber link up problem
+    - net: hns3: Add support of .sriov_configure in HNS3 driver
+    - net: hns3: Fixes the missing PCI iounmap for various legs
+    - net: hns3: Fixes error reported by Kbuild and internal review
+    - net: hns3: Fixes API to fetch ethernet header length with kernel default
+    - net: hns3: cleanup of return values in hclge_init_client_instance()
+    - net: hns3: Fix the missing client list node initialization
+    - net: hns3: Fix for hns3 module is loaded multiple times problem
+    - net: hns3: Use enums instead of magic number in hclge_is_special_opcode
+    - net: hns3: Fix for netdev not running problem after calling net_stop and
+      net_open
+    - net: hns3: Fixes kernel panic issue during rmmod hns3 driver
+    - net: hns3: Fix for CMDQ and Misc. interrupt init order problem
+    - net: hns3: Updates RX packet info fetch in case of multi BD
+    - net: hns3: Add support for tx_accept_tag2 and tx_accept_untag2 config
+    - net: hns3: Add STRP_TAGP field support for hardware revision 0x21
+    - net: hns3: Add support to enable TX/RX promisc mode for H/W rev(0x21)
+    - net: hns3: Fix for PF mailbox receving unknown message
+    - net: hns3: Fixes the state to indicate client-type initialization
+    - net: hns3: Fixes the init of the VALID BD info in the descriptor
+    - net: hns3: Removes unnecessary check when clearing TX/RX rings
+    - net: hns3: Clear TX/RX rings when stopping port & un-initializing client
+    - net: hns3: Remove unused led control code
+    - net: hns3: Adds support for led locate command for copper port
+    - net: hns3: Fixes initalization of RoCE handle and makes it conditional
+    - net: hns3: Disable vf vlan filter when vf vlan table is full
+    - net: hns3: Add support for IFF_ALLMULTI flag
+    - net: hns3: Add repeat address checking for setting mac address
+    - net: hns3: Fix setting mac address error
+    - net: hns3: Fix for service_task not running problem after resetting
+    - net: hns3: Fix for hclge_reset running repeatly problem
+    - net: hns3: Fix for phy not link up problem after resetting
+    - net: hns3: Add missing break in misc_irq_handle
+    - net: hns3: Fix for vxlan tx checksum bug
+    - net: hns3: Optimize the PF's process of updating multicast MAC
+    - net: hns3: Optimize the VF's process of updating multicast MAC
+    - SAUCE: {topost} net: hns3: add support for serdes loopback selftest
+    - SAUCE: {topost} net: hns3: RX BD information valid only in last BD except
+      VLD bit and buffer size
+    - SAUCE: {topost} net: hns3: remove hclge_get_vector_index from
+      hclge_bind_ring_with_vector
+    - SAUCE: {topost} net: hns3: rename the interface for init_client_instance and
+      uninit_client_instance
+    - SAUCE: {topost} net: hns3: add vector status check before free vector
+    - SAUCE: {topost} net: hns3: add l4_type check for both ipv4 and ipv6
+    - SAUCE: {topost} net: hns3: remove unused head file in hnae3.c
+    - SAUCE: {topost} net: hns3: extraction an interface for state state
+      init|uninit
+    - SAUCE: {topost} net: hns3: print the ret value in error information
+    - SAUCE: {topost} net: hns3: remove the Redundant put_vector in
+      hns3_client_uninit
+    - SAUCE: {topost} net: hns3: add unlikely for error check
+    - SAUCE: {topost} net: hns3: remove back in struct hclge_hw
+    - SAUCE: {topost} net: hns3: use lower_32_bits and upper_32_bits
+    - SAUCE: {topost} net: hns3: remove unused hclge_ring_to_dma_dir
+    - SAUCE: {topost} net: hns3: remove useless code in hclge_cmd_send
+    - SAUCE: {topost} net: hns3: remove some redundant assignments
+    - SAUCE: {topost} net: hns3: simplify hclge_cmd_csq_clean
+    - SAUCE: {topost} net: hns3: using modulo for cyclic counters in
+      hclge_cmd_send
+    - SAUCE: {topost} net: hns3: remove a redundant hclge_cmd_csq_done
+    - SAUCE: {topost} net: hns3: remove some unused members of some structures
+    - SAUCE: {topost} net: hns3: give default option while dependency HNS3 set
+    - SAUCE: {topost} net: hns3: use dma_zalloc_coherent instead of
+      kzalloc/dma_map_single
+    - SAUCE: {topost} net: hns3: modify hnae_ to hnae3_
+    - SAUCE: {topost} net: hns3: fix unused function warning in VF driver
+    - SAUCE: {topost} net: hns3: remove some redundant assignments
+    - SAUCE: {topost} net: hns3: standardize the handle of return value
+    - SAUCE: {topost} net: hns3: remove extra space and brackets
+    - SAUCE: {topost} net: hns3: fix unreasonable code comments
+    - SAUCE: {topost} net: hns3: use decimal for bit offset macros
+    - SAUCE: {topost} net: hns3: modify inconsistent bit mask macros
+    - SAUCE: {topost} net: hns3: fix mislead parameter name
+    - SAUCE: {topost} net: hns3: remove unused struct member and definition
+    - SAUCE: {topost} net: hns3: Add SPDX tags to hns3 driver
+    - SAUCE: {topost} net: hns3: Add pf reset for hip08 RoCE
+    - SAUCE: {topost} net: hns3: optimize the process of notifying roce client
+    - SAUCE: {topost} net: hns3: Add calling roce callback function when link
+      status change
+    - SAUCE: {topost} net: hns3: fix tc setup when netdev is first up
+    - SAUCE: {topost} net: hns3: fix for mac pause not disable in pfc mode
+    - SAUCE: {topost} net: hns3: fix for waterline not setting correctly
+    - SAUCE: {topost} net: hns3: fix for l4 checksum offload bug
+    - SAUCE: {topost} net: hns3: fix for mailbox message truncated problem
+    - SAUCE: {topost} net: hns3: Add configure for mac minimal frame size
+    - SAUCE: {topost} net: hns3: fix warning bug when doing lp selftest
+    - SAUCE: {topost} net: hns3: fix get_vector ops in hclgevf_main module
+    - SAUCE: {topost} net: hns3: remove the warning when clear reset cause
+    - SAUCE: {topost} net: hns3: Use roce handle when calling roce callback
+      function
+    - SAUCE: {topost} net: hns3: prevent sending command during global or core
+      reset
+    - SAUCE: {topost} net: hns3: modify the order of initializeing command queue
+      register
+    - SAUCE: {topost} net: hns3: reset net device with rtnl_lock
+    - SAUCE: {topost} net: hns3: prevent to request reset frequently
+    - SAUCE: {topost} net: hns3: correct reset event status register
+    - SAUCE: {topost} net: hns3: separate roce from nic when resetting
+    - SAUCE: net: hns3: Fix for phy link issue when using marvell phy driver
+    - SAUCE: {topost} net: hns3: fix return value error in
+      hns3_reset_notify_down_enet
+    - SAUCE: {topost} net: hns3: remove unnecessary ring configuration operation
+      while resetting
+    - SAUCE: {topost} net: hns3: fix for reset_level default assignment probelm
+    - SAUCE: {topost} net: hns3: fix for using wrong mask and shift in
+      hclge_get_ring_chain_from_mbx
+    - SAUCE: {topost} net: hns3: fix comments for hclge_get_ring_chain_from_mbx
+    - SAUCE: net: hns3: Fix for VF mailbox cannot receiving PF response
+    - SAUCE: net: hns3: Fix for VF mailbox receiving unknown message
+    - SAUCE: net: hns3: Optimize PF CMDQ interrupt switching process
+
+  * CVE-2018-7755
+    - SAUCE: floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
+
+  * Incorrect blacklist of bcm2835_wdt (LP: #1766052)
+    - [Packaging] Fix missing watchdog for Raspberry Pi
+
+  * kernel: Fix arch random implementation (LP: #1775391)
+    - s390/archrandom: Rework arch random implementation.
+
+  * [Ubuntu 1804][boston][ixgbe] EEH causes kernel BUG at /build/linux-
+    jWa1Fv/linux-4.15.0/drivers/pci/msi.c:352 (i2S) (LP: #1776389)
+    - ixgbe/ixgbevf: Free IRQ when PCI error recovery removes the device
+
+  * Cosmic update to v4.17.2 stable release (LP: #1779117)
+    - crypto: chelsio - request to HW should wrap
+    - blkdev_report_zones_ioctl(): Use vmalloc() to allocate large buffers
+    - KVM: X86: Fix reserved bits check for MOV to CR3
+    - KVM: x86: introduce linear_{read,write}_system
+    - kvm: fix typo in flag name
+    - kvm: nVMX: Enforce cpl=0 for VMX instructions
+    - KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and
+      kvm_write_guest_virt_system
+    - kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access
+    - staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy
+    - NFC: pn533: don't send USB data off of the stack
+    - usbip: vhci_sysfs: fix potential Spectre v1
+    - usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver
+    - usb-storage: Add compatibility quirk flags for G-Technologies G-Drive
+    - Input: xpad - add GPD Win 2 Controller USB IDs
+    - phy: qcom-qusb2: Fix crash if nvmem cell not specified
+    - usb: core: message: remove extra endianness conversion in
+      usb_set_isoch_delay
+    - usb: typec: wcove: Remove dependency on HW FSM
+    - usb: gadget: function: printer: avoid wrong list handling in printer_write()
+    - usb: gadget: udc: renesas_usb3: fix double phy_put()
+    - usb: gadget: udc: renesas_usb3: should remove debugfs
+    - usb: gadget: udc: renesas_usb3: should call pm_runtime_enable() before add
+      udc
+    - usb: gadget: udc: renesas_usb3: should call devm_phy_get() before add udc
+    - usb: gadget: udc: renesas_usb3: should fail if devm_phy_get() returns error
+    - usb: gadget: udc: renesas_usb3: disable the controller's irqs for
+      reconnecting
+    - serial: sh-sci: Stop using printk format %pCr
+    - tty/serial: atmel: use port->name as name in request_irq()
+    - serial: samsung: fix maxburst parameter for DMA transactions
+    - serial: 8250: omap: Fix idling of clocks for unused uarts
+    - vmw_balloon: fixing double free when batching mode is off
+    - doc: fix sysfs ABI documentation
+    - arm64: defconfig: Enable CONFIG_PINCTRL_MT7622 by default
+    - tty: pl011: Avoid spuriously stuck-off interrupts
+    - crypto: ccree - correct host regs offset
+    - Input: goodix - add new ACPI id for GPD Win 2 touch screen
+    - Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID
+    - crypto: caam - strip input zeros from RSA input buffer
+    - crypto: caam - fix DMA mapping dir for generated IV
+    - crypto: caam - fix IV DMA mapping and updating
+    - crypto: caam/qi - fix IV DMA mapping and updating
+    - crypto: caam - fix size of RSA prime factor q
+    - crypto: cavium - Fix fallout from CONFIG_VMAP_STACK
+    - crypto: cavium - Limit result reading attempts
+    - crypto: vmx - Remove overly verbose printk from AES init routines
+    - crypto: vmx - Remove overly verbose printk from AES XTS init
+    - crypto: omap-sham - fix memleak
+    - Linux 4.17.2
+
+  * Cosmic update to v4.17.1 stable release (LP: #1779116)
+    - netfilter: nf_flow_table: attach dst to skbs
+    - bnx2x: use the right constant
+    - ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds
+    - ipv6: omit traffic class when calculating flow hash
+    - l2tp: fix refcount leakage on PPPoL2TP sockets
+    - netdev-FAQ: clarify DaveM's position for stable backports
+    - net: metrics: add proper netlink validation
+    - net/packet: refine check for priv area size
+    - rtnetlink: validate attributes in do_setlink()
+    - sctp: not allow transport timeout value less than HZ/5 for hb_timer
+    - team: use netdev_features_t instead of u32
+    - vrf: check the original netdevice for generating redirect
+    - net: dsa: b53: Fix for brcm tag issue in Cygnus SoC
+    - ipmr: fix error path when ipmr_new_table fails
+    - PCI: hv: Do not wait forever on a device that has disappeared
+    - Linux 4.17.1
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: crypto: thunderx_zip: Fix fallout from
+      CONFIG_VMAP_STACK"
+    - Revert "UBUNTU: SAUCE: cred: Add clone_cred() interface"
+    - SAUCE: apparmor: userspace queries
+    - SAUCE: apparmor: patch to provide compatibility with v2.x net rules
+    - SAUCE: apparmor: af_unix mediation
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 28 Jun 2018 08:03:32 -0500
+
+linux (4.17.0-2.3) cosmic; urgency=medium
+
+  * linux: 4.17.0-2.3 -proposed tracker (LP: #1776276)
+
+  * Miscellaneous Ubuntu changes
+    - Config: remove IrDA from annotations
+    - Config: remove scsi drivers from annotations
+    - Config: remove BT_HCIBTUART from annotations
+    - Config: pstore zlib support was renamed
+    - Config: disable NVRAM for armhf on annotations
+    - Config: Disable VT on s390x
+    - Config: Update SSB and B43/B44 options
+    - Config: some options not supported on some arches anymore
+    - Config: renamed and removed options
+    - Config: TCG_CRB is required for IMA on ACPI systems
+    - Config: EXTCON_AXP288 depends on X86
+    - Config: CONFIG_FSI depends on OF
+    - Config: DRM_RCAR_LVDS now depends on DRM
+    - CONFIG: Allow CONFIG_LEDS_MLXCPLD for i386
+    - Config: Enable HINIC on arm64
+    - Config: Set PPS and PTP_1588_CLOCK as y
+    - Config: Some NF_TABLES options are built-in now
+    - Config: GENERIC_CPU for ppc64el
+    - Config: KEXEC_FILE=n for s390x
+    - Config: CRYPTO_DEFLATE is needed by PSTORE_DEFLATE_COMPRESS
+    - Config: Disable STM32 support
+    - Config: Enable FORTIFY_SOURCE for armhf
+    - Config: use STRONG instead of AUTO for CC_STACKPROTECTOR
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.17
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 11 Jun 2018 15:22:10 -0300
+
+linux (4.17.0-1.2) cosmic; urgency=medium
+
+  [ Seth Forshee ]
+  * [Config] enable EDAC_DEBUG on ARM64 (LP: #1772516)
+    - [Config]: set CONFIG_EDAC_DEBUG=y for ARM64
+
+  * Ubuntu 18.04 kernel crashed while in degraded mode (LP: #1770849)
+    - SAUCE: powerpc/perf: Fix memory allocation for core-imc based on
+      num_possible_cpus()
+
+  * Integrated Webcam Realtek Integrated_Webcam_HD (0bda:58f4) not working in
+    DELL XPS 13 9370 with firmware 1.50 (LP: #1763748)
+    - SAUCE: media: uvcvideo: Support realtek's UVC 1.5 device
+
+  * Switch Build-Depends: transfig to fig2dev (LP: #1770770)
+    - [Config] update Build-Depends: transfig to fig2dev
+
+  * update-initramfs not adding i915 GuC firmware for Kaby Lake, firmware fails
+    to load (LP: #1728238)
+    - Revert "UBUNTU: SAUCE: (no-up) i915: Remove MODULE_FIRMWARE statements for
+      unreleased firmware"
+
+  * No driver for Huawei network adapters on arm64 (LP: #1769899)
+    - net-next/hinic: add arm64 support
+
+  * linux-snapdragon: reduce EPROBEDEFER noise during boot (LP: #1768761)
+    - [Config] snapdragon: DRM_I2C_ADV7511=y
+
+  * Add d-i support for Huawei NICs (LP: #1767490)
+    - d-i: add hinic to nic-modules udeb
+
+  * Acer Swift sf314-52 power button not managed  (LP: #1766054)
+    - SAUCE: platform/x86: acer-wmi: add another KEY_POWER keycode
+
+  * Include nfp driver in linux-modules (LP: #1768526)
+    - [Config] Add nfp.ko to generic inclusion list
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - [Config] Enable AUFS config options
+    - SAUCE: (efi-lockdown) Fix for module sig verification
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Don't print secure boot state from the efi stub
+    - [Config] CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
+    - SAUCE: (efi-lockdown) really lock down kernel under EFI secure boot
+    - SAUCE: (noup) Update spl to 0.7.5-1ubuntu3, zfs to 0.7.5-1ubuntu17
+    - enable zfs build
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) ima: require secure_boot rules in
+      lockdown mode"
+    - Rebased to v4.17-rc6
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 22 May 2018 14:48:13 -0300
+
+linux (4.17.0-0.1) bionic; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.17-rc4
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 08 May 2018 16:38:51 -0300
+
+linux (4.17.0-0.0) bionic; urgency=medium
+
+  * Dummy entry.
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 27 Apr 2018 11:01:13 -0300
+
+linux (4.16.0-4.5) bionic; urgency=medium
+
+  * [18.04 FEAT] Add kvm_stat from kernel tree (LP: #1734130)
+    - tools/kvm_stat: Fix python3 syntax
+    - tools/kvm_stat: Don't use deprecated file()
+    - tools/kvm_stat: Remove unused function
+    - [Packaging] Add linux-tools-host package for VM host tools
+    - [Config] do_tools_host=true for amd64
+
+  * [Featire] CNL: Enable RAPL support (LP: #1685712)
+    - powercap: RAPL: Add support for Cannon Lake
+
+  * Bionic update to v4.16.2 stable release (LP: #1763388)
+    - sparc64: Oracle DAX driver depends on SPARC64
+    - arp: fix arp_filter on l3slave devices
+    - net: dsa: Discard frames from unused ports
+    - net/ipv6: Increment OUTxxx counters after netfilter hook
+    - net/sched: fix NULL dereference in the error path of tcf_bpf_init()
+    - pptp: remove a buggy dst release in pptp_connect()
+    - sctp: do not leak kernel memory to user space
+    - sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
+    - vlan: also check phy_driver ts_info for vlan's real device
+    - net: fool proof dev_valid_name()
+    - ip_tunnel: better validate user provided tunnel names
+    - ipv6: sit: better validate user provided tunnel names
+    - ip6_gre: better validate user provided tunnel names
+    - ip6_tunnel: better validate user provided tunnel names
+    - vti6: better validate user provided tunnel names
+    - net_sched: fix a missing idr_remove() in u32_delete_key()
+    - nfp: use full 40 bits of the NSP buffer address
+    - Linux 4.16.2
+
+  * sky2 gigabit ethernet driver sometimes stops working after lid-open resume
+    from sleep (88E8055) (LP: #1758507) // Bionic update to v4.16.2 stable
+    release (LP: #1763388)
+    - sky2: Increase D3 delay to sky2 stops working after suspend
+
+  * Merge the linux-snapdragon kernel into bionic master/snapdragon
+    (LP: #1763040)
+    - arm64: defconfig: enable REMOTEPROC
+    - arm64: defconfig: enable QCOM audio drivers for APQ8016 and DB410c
+    - kernel: configs; add distro.config
+    - arm64: configs: enable WCN36xx
+    - kernel: distro.config: enable debug friendly USB network adpater
+    - arm64: configs: enable QCOM Venus
+    - arm64: defconfig: Enable a53/apcs and avs
+    - arm64: defconfig: enable ondemand governor as default
+    - arm64: defconfig: enable QCOM_TSENS
+    - kernel: configs: enable dm_mod and dm_crypt
+    - Force the SMD regulator driver to be compiled-in
+    - arm64: defconfig: enable CFG80211_DEFAULT_PS by default
+    - arm64: configs: enable BT_QCOMSMD
+    - kernel: configs: add more USB net drivers
+    - arm64: defconfig: disable ANALOG_TV and DIGITAL_TV
+    - arm64: configs: Enable camera drivers
+    - kernel: configs: add freq stat to sysfs
+    - arm64: defconfig: enable CONFIG_USB_CONFIGFS_F_FS by default
+    - arm64: defconfig: Enable QRTR features
+    - kernel: configs: set USB_CONFIG_F_FS in distro.config
+    - kernel: distro.config: enable 'schedutil' CPUfreq governor
+    - kernel: distro.config: enable 'fq' and 'fq_codel' qdiscs
+    - kernel: distro.config: enable 'BBR' TCP congestion algorithm
+    - arm64: defconfig: enable LEDS_QCOM_LPG
+    - HACK: drm/msm/iommu: Remove runtime_put calls in map/unmap
+    - power: avs: Add support for CPR (Core Power Reduction)
+    - power: avs: cpr: Use raw mem access for qfprom
+    - power: avs: cpr: fix with new reg_sequence structures
+    - power: avs: cpr: Register with cpufreq-dt
+    - regulator: smd: Add floor and corner operations
+    - PM / OPP: Support adjusting OPP voltages at runtime
+    - PM / OPP: Drop RCU usage in dev_pm_opp_adjust_voltage()
+    - PM / OPP: HACK: Allow to set regulator without opp_list
+    - PM / OPP: Add a helper to get an opp regulator for device
+    - cpufreq: Add apq8016 to cpufreq-dt-platdev blacklist
+    - regulator: smd: Allow REGULATOR_QCOM_SMD_RPM=m
+    - ov5645: I2C address change
+    - i2c: Add Qualcomm Camera Control Interface driver
+    - camss: vfe: Skip first four frames from sensor
+    - camss: Do not register if no cameras are present
+    - i2c-qcom-cci: Fix run queue completion timeout
+    - i2c-qcom-cci: Fix I2C address bug
+    - media: ov5645: Fix I2C address
+    - drm/bridge/adv7511: Delay clearing of HPD interrupt status
+    - HACK: drm/msm/adv7511: Don't rely on interrupts for EDID parsing
+    - leds: Add driver for Qualcomm LPG
+    - wcn36xx: Fix warning due to duplicate scan_completed notification
+    - arm64: dts: Add CPR DT node for msm8916
+    - arm64: dts: add spmi-regulator nodes
+    - arm64: dts: msm8916: Add cpufreq support
+    - arm64: dts: msm8916: Add a shared CPU opp table
+    - arm64: dts: msm8916: Add cpu cooling maps
+    - arm64: dts: pm8916: Mark the s2 regulator as always-on
+    - arm64: dts: qcom: msm8916: Add msm8916 A53 PLL DT node
+    - arm64: dts: qcom: msm8916: Use the new APCS mailbox driver
+    - arm64: dts: qcom: msm8916: Add clock properties to the APCS node
+    - dt-bindings: media: Binding document for Qualcomm Camera Control Interface
+      driver
+    - MAINTAINERS: Add Qualcomm Camera Control Interface driver
+    - DT: leds: Add Qualcomm Light Pulse Generator binding
+    - arm64: dts: qcom: msm8996: Add mpp and lpg blocks
+    - arm64: dts: qcom: Add pwm node for pm8916
+    - arm64: dts: qcom: Add user LEDs on db820c
+    - arm64: dts: qcom: Add WiFI/BT LEDs on db820c
+    - ARM: dts: qcom: Add LPG node to pm8941
+    - ARM: dts: qcom: honami: Add LPG node and RGB LED
+    - arm64: dts: qcom: Add Camera Control Interface support
+    - arm64: dts: qcom: Add apps_iommu vfe child node
+    - arm64: dts: qcom: Add camss device node
+    - arm64: dts: qcom: Add ov5645 device nodes
+    - arm64: dts: msm8916: Fix camera sensors I2C addresses
+    - arm: dts: qcom: db410c: Enable PWM signal on MPP4
+    - packaging: arm64: add a uboot flavour - part1
+    - packaging: arm64: add a uboot flavour - part2
+    - packaging: arm64: add a uboot flavour - part3
+    - packaging: arm64: add a uboot flavour - part4
+    - packaging: arm64: add a uboot flavour - part5
+    - packaging: arm64: rename uboot flavour to snapdragon
+    - [Config] updateconfigs after qcomlt import
+    - [Config] arm64: snapdragon: COMMON_CLK_QCOM=y
+    - [Config] arm64: snapdragon: MSM_GCC_8916=y
+    - [Config] arm64: snapdragon: REGULATOR_FIXED_VOLTAGE=y
+    - [Config] arm64: snapdragon: PINCTRL_MSM8916=y
+    - [Config] arm64: snapdragon: HWSPINLOCK_QCOM=y
+    - [Config] arm64: snapdragon: SPMI=y, SPMI_MSM_PMIC_ARB=y
+    - [Config] arm64: snapdragon: REGMAP_SPMI=y, PINCTRL_QCOM_SPMI_PMIC=y
+    - [Config] arm64: snapdragon: REGULATOR_QCOM_SPMI=y
+    - [Config] arm64: snapdragon: MFD_SPMI_PMIC=y
+    - [Config] arm64: snapdragon: QCOM_SMEM=y
+    - [Config] arm64: snapdragon: RPMSG=y, RPMSG_QCOM_SMD=y
+    - [Config] arm64: snapdragon: QCOM_SMD_RPM=y, REGULATOR_QCOM_SMD_RPM=y
+    - [Config] arm64: snapdragon: QCOM_CLK_SMD_RPM=y
+    - [Config] arm64: snapdragon: QCOM_BAM_DMA=y
+    - [Config] arm64: snapdragon: QCOM_HIDMA=y, QCOM_HIDMA_MGMT=y
+    - [Config] arm64: snapdragon: QCOM_CPR=y
+    - [Config] arm64: snapdragon: QCOM_QFPROM=y, QCOM_TSENS=y
+    - [Config] arm64: snapdragon: MMC_SDHCI=y, MMC_SDHCI_PLTFM=y, MMC_SDHCI_MSM=y
+    - [Config] turn off DRM_MSM_REGISTER_LOGGING
+    - [Config] arm64: snapdragon: I2C_QUP=y
+    - [Config] arm64: snapdragon: SPI_QUP=y
+    - [Config] arm64: snapdragon: USB_ULPI_BUS=y, PHY_QCOM_USB_HS=y
+    - [Config] arm64: snapdragon: QCOM_APCS_IPC=y
+    - [Config] arm64: snapdragon: QCOM_WCNSS_CTRL=y
+    - [Config] arm64: snapdragon: QCOM_SMSM=y
+    - [Config] arm64: snapdragon: QCOM_SMP2P=y
+    - [Config] arm64: snapdragon: DRM_MSM=y
+    - [Config] arm64: snapdragon: SND_SOC=y
+    - [Config] arm64: snapdragon: QCOM_WCNSS_PIL=m
+    - [Config] arm64: snapdragon: INPUT_PM8941_PWRKEY=y
+    - [Config] arm64: snapdragon: MEDIA_SUBDRV_AUTOSELECT=y, VIDEO_OV5645=m
+    - [Config] arm64: snapdragon: SND_SOC_APQ8016_SBC=y, SND_SOC_LPASS_APQ8016=y
+    - [Config] arm64: snapdragon: SND_SOC_MSM8916_WCD_ANALOG=y,
+      SND_SOC_MSM8916_WCD_DIGITAL=y
+    - SAUCE: media: ov5645: skip address change if dt addr == default addr
+    - SAUCE: drm/msm/adv7511: wrap hacks under CONFIG_ADV7511_SNAPDRAGON_HACKS
+      #ifdefs
+    - [Config] arm64: snapdragon: ADV7511_SNAPDRAGON_HACKS=y
+    - [Packaging] fix up snapdragon abi paths
+
+  * LSM stacking patches for bionic (LP: #1763062)
+    - SAUCE: LSM stacking: procfs: add smack subdir to attrs
+    - SAUCE: LSM stacking: LSM: Manage credential security blobs
+    - SAUCE: LSM stacking: LSM: Manage file security blobs
+    - SAUCE: LSM stacking: LSM: Manage task security blobs
+    - SAUCE: LSM stacking: LSM: Manage remaining security blobs
+    - SAUCE: LSM stacking: LSM: General stacking
+    - SAUCE: LSM stacking: fixup initialize task->security
+    - SAUCE: LSM stacking: fixup: alloc_task_ctx is dead code
+    - SAUCE: LSM stacking: add support for stacking getpeersec_stream
+    - SAUCE: LSM stacking: add stacking support to apparmor network hooks
+    - SAUCE: LSM stacking: fixup apparmor stacking enablement
+    - SAUCE: LSM stacking: fixup stacking kconfig
+    - SAUCE: LSM stacking: allow selecting multiple LSMs using kernel boot params
+    - SAUCE: LSM stacking: provide prctl interface for setting context
+    - SAUCE: LSM stacking: inherit current display LSM
+    - SAUCE: LSM stacking: keep an index for each registered LSM
+    - SAUCE: LSM stacking: verify display LSM
+    - SAUCE: LSM stacking: provide a way to specify the default display lsm
+    - SAUCE: LSM stacking: make sure LSM blob align on 64 bit boundaries
+    - SAUCE: LSM stacking: add /proc/<pid>/attr/display_lsm
+    - SAUCE: LSM stacking: add Kconfig to set default display LSM
+    - SAUCE: LSM stacking: add configs for LSM stacking
+    - SAUCE: LSM stacking: add apparmor and selinux proc dirs
+    - SAUCE: LSM stacking: remove procfs context interface
+
+  * linux 4.13.0-13.14 ADT test failure with linux 4.13.0-13.14
+    (LP: #1720779) // LSM stacking patches for bionic (LP: #1763062)
+    - SAUCE: LSM stacking: check for invalid zero sized writes
+
+  * Support cq/rq record doorbell for RDMA on HSilicon hip08 systems
+    (LP: #1762755)
+    - RDMA/hns: Support rq record doorbell for the user space
+    - RDMA/hns: Support cq record doorbell for the user space
+    - RDMA/hns: Support rq record doorbell for kernel space
+    - RDMA/hns: Support cq record doorbell for kernel space
+    - RDMA/hns: Fix cqn type and init resp
+    - RDMA/hns: Fix init resp when alloc ucontext
+    - RDMA/hns: Fix cq record doorbell enable in kernel
+
+  * Replace LPC patchset with upstream version (LP: #1762758)
+    - Revert "UBUNTU: SAUCE: MAINTAINERS: Add maintainer for HiSilicon LPC driver"
+    - Revert "UBUNTU: SAUCE: HISI LPC: Add ACPI support"
+    - Revert "UBUNTU: SAUCE: ACPI / scan: do not enumerate Indirect IO host
+      children"
+    - Revert "UBUNTU: SAUCE: HISI LPC: Support the LPC host on Hip06/Hip07 with DT
+      bindings"
+    - Revert "UBUNTU: SAUCE: OF: Add missing I/O range exception for indirect-IO
+      devices"
+    - Revert "UBUNTU: SAUCE: PCI: Apply the new generic I/O management on PCI IO
+      hosts"
+    - Revert "UBUNTU: SAUCE: PCI: Add fwnode handler as input param of
+      pci_register_io_range()"
+    - Revert "UBUNTU: SAUCE: PCI: Remove unused __weak attribute in
+      pci_register_io_range()"
+    - Revert "UBUNTU: SAUCE: LIB: Introduce a generic PIO mapping method"
+    - lib: Add generic PIO mapping method
+    - PCI: Remove __weak tag from pci_register_io_range()
+    - PCI: Add fwnode handler as input param of pci_register_io_range()
+    - PCI: Apply the new generic I/O management on PCI IO hosts
+    - of: Add missing I/O range exception for indirect-IO devices
+    - HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings
+    - ACPI / scan: Rename acpi_is_serial_bus_slave() for more general use
+    - ACPI / scan: Do not enumerate Indirect IO host children
+    - HISI LPC: Add ACPI support
+    - MAINTAINERS: Add John Garry as maintainer for HiSilicon LPC driver
+
+  * Enable Tunneled Operations on POWER9 (LP: #1762448)
+    - powerpc/powernv: Enable tunneled operations
+    - cxl: read PHB indications from the device tree
+
+  * PSL traces reset after PERST for debug AFU image (LP: #1762462)
+    - cxl: Enable NORST bit in PSL_DEBUG register for PSL9
+
+  * NFS + sec=krb5 is broken (LP: #1759791)
+    - sunrpc: remove incorrect HMAC request initialization
+
+  * Raspberry Pi 3 microSD support missing from the installer (LP: #1729128)
+    - d-i: add bcm2835 to block-modules
+
+  * Backport USB core quirks (LP: #1762695)
+    - usb: core: Add "quirks" parameter for usbcore
+    - usb: core: Copy parameter string correctly and remove superfluous null check
+    - usb: core: Add USB_QUIRK_DELAY_CTRL_MSG to usbcore quirks
+
+  * [Ubuntu 18.04] cryptsetup: 'device-mapper: reload ioctl on  failed' when
+    setting up a second end-to-end encrypted disk (LP: #1762353)
+    - SAUCE: s390/crypto: Adjust s390 aes and paes cipher
+
+  * System Z {kernel} UBUNTU18.04 wrong kernel config (LP: #1762719)
+    - s390: move nobp parameter functions to nospec-branch.c
+    - s390: add automatic detection of the spectre defense
+    - s390: report spectre mitigation via syslog
+    - s390: add sysfs attributes for spectre
+    - [Config] CONFIG_EXPOLINE_AUTO=y, CONFIG_KERNEL_NOBP=n for s390
+    - s390: correct nospec auto detection init order
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5715
+    - powerpc/64s: Wire up cpu_show_spectre_v2()
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5753
+    - powerpc/64s: Wire up cpu_show_spectre_v1()
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5754
+    - powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code
+    - powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again
+    - powerpc/rfi-flush: Always enable fallback flush on pseries
+    - powerpc/rfi-flush: Differentiate enabled and patched flush types
+    - powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration
+    - powerpc/64s: Move cpu_show_meltdown()
+    - powerpc/64s: Enhance the information in cpu_show_meltdown()
+    - powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()
+    - powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5715 //
+    CVE-2017-5753 // CVE-2017-5754
+    - powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
+    - powerpc: Add security feature flags for Spectre/Meltdown
+    - powerpc/pseries: Set or clear security feature flags
+    - powerpc/powernv: Set or clear security feature flags
+
+  * Hisilicon network subsystem 3 support (LP: #1761610)
+    - net: hns3: export pci table of hclge and hclgevf to userspace
+    - d-i: Add hns3 drivers to nic-modules
+
+  * "ip a" command on a guest VM shows UNKNOWN status (LP: #1761534)
+    - virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS
+
+  * perf vendor events arm64: Enable JSON events for ThunderX2 B0 (LP: #1760712)
+    - perf vendor events: Drop incomplete multiple mapfile support
+    - perf vendor events: Fix error code in json_events()
+    - perf vendor events: Drop support for unused topic directories
+    - perf vendor events: Add support for pmu events vendor subdirectory
+    - perf vendor events arm64: Relocate ThunderX2 JSON to cavium subdirectory
+    - perf vendor events arm64: Relocate Cortex A53 JSONs to arm subdirectory
+    - perf vendor events: Add support for arch standard events
+    - perf vendor events arm64: Add armv8-recommended.json
+    - perf vendor events arm64: Fixup ThunderX2 to use recommended events
+    - perf vendor events arm64: fixup A53 to use recommended events
+    - perf vendor events arm64: add HiSilicon hip08 JSON file
+    - perf vendor events arm64: Enable JSON events for ThunderX2 B0
+
+  * Warning "cache flush timed out!" seen when unloading the cxl driver
+    (LP: #1762367)
+    - cxl: Check if PSL data-cache is available before issue flush request
+
+  * Bionic update to v4.16.1 stable release (LP: #1763170)
+    - bitmap: fix memset optimization on big-endian systems
+    - USB: serial: ftdi_sio: add RT Systems VX-8 cable
+    - USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
+    - USB: serial: cp210x: add ELDAT Easywave RX09 id
+    - serial: 8250: Add Nuvoton NPCM UART
+    - mei: remove dev_err message on an unsupported ioctl
+    - /dev/mem: Avoid overwriting "err" in read_mem()
+    - media: usbtv: prevent double free in error case
+    - parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
+    - crypto: lrw - Free rctx->ext with kzfree
+    - crypto: ccp - Fill the result buffer only on digest, finup, and final ops
+    - crypto: talitos - don't persistently map req_ctx->hw_context and
+      req_ctx->buf
+    - crypto: inside-secure - fix clock management
+    - crypto: testmgr - Fix incorrect values in PKCS#1 test vector
+    - crypto: talitos - fix IPsec cipher in length
+    - crypto: ahash - Fix early termination in hash walk
+    - crypto: caam - Fix null dereference at error path
+    - crypto: ccp - return an actual key size from RSA max_size callback
+    - crypto: arm,arm64 - Fix random regeneration of S_shipped
+    - crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
+    - Bluetooth: hci_bcm: Add 6 new ACPI HIDs
+    - Btrfs: fix unexpected cow in run_delalloc_nocow
+    - siox: fix possible buffer overflow in device_add_store
+    - staging: comedi: ni_mio_common: ack ai fifo error interrupts.
+    - Revert "base: arch_topology: fix section mismatch build warnings"
+    - Input: ALPS - fix TrackStick detection on Thinkpad L570 and Latitude 7370
+    - Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
+    - Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
+    - vt: change SGR 21 to follow the standards
+    - Fix slab name "biovec-(1<<(21-12))"
+    - signal: Correct the offset of si_pkey and si_lower in struct siginfo on m68k
+    - Linux 4.16.1
+
+  * [18.04][config] regression: nvme and nvme_core couldn't be built as modules
+    starting 4.15-rc2 (LP: #1759893)
+    - SAUCE: Revert "lightnvm: include NVM Express driver if OCSSD is selected for
+      build"
+    - [Config] CONFIG_BLK_DEV_NMVE=m
+
+  * FFe: Enable configuring resume offset via sysfs (LP: #1760106)
+    - PM / hibernate: Make passing hibernate offsets more friendly
+
+  * Ubuntu18.04:POWER9:DD2.2 - Unable to start a KVM guest with default machine
+    type(pseries-bionic) complaining "KVM implementation does not support
+    Transactional Memory, try cap-htm=off" (kvm) (LP: #1752026)
+    - powerpc: Use feature bit for RTC presence rather than timebase presence
+    - powerpc: Book E: Remove unused CPU_FTR_L2CSR bit
+    - powerpc: Free up CPU feature bits on 64-bit machines
+    - powerpc: Add CPU feature bits for TM bug workarounds on POWER9 v2.2
+    - powerpc/powernv: Provide a way to force a core into SMT4 mode
+    - KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9
+    - KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode
+    - KVM: PPC: Book3S HV: Work around TEXASR bug in fake suspend state
+
+  * [Feature][CFL][ICL] [CNL]Thunderbolt support (Titan Ridge) (LP: #1730775)
+    - thunderbolt: Resume control channel after hibernation image is created
+    - thunderbolt: Serialize PCIe tunnel creation with PCI rescan
+    - thunderbolt: Handle connecting device in place of host properly
+    - thunderbolt: Do not overwrite error code when domain adding fails
+    - thunderbolt: Wait a bit longer for root switch config space
+    - thunderbolt: Wait a bit longer for ICM to authenticate the active NVM
+    - thunderbolt: Handle rejected Thunderbolt devices
+    - thunderbolt: Factor common ICM add and update operations out
+    - thunderbolt: Correct function name in kernel-doc comment
+    - thunderbolt: Add tb_switch_get()
+    - thunderbolt: Add tb_switch_find_by_route()
+    - thunderbolt: Add tb_xdomain_find_by_route()
+    - thunderbolt: Add constant for approval timeout
+    - thunderbolt: Move driver ready handling to struct icm
+    - thunderbolt: Add 'boot' attribute for devices
+    - thunderbolt: Add support for preboot ACL
+    - thunderbolt: Introduce USB only (SL4) security level
+    - thunderbolt: Add support for Intel Titan Ridge
+
+  * QCA9377 requires more IRAM banks for its new firmware (LP: #1748345)
+    - ath10k: update the IRAM bank number for QCA9377
+
+  * Fix an issue that when system in S3, USB keyboard can't wake up the system.
+    (LP: #1759511)
+    - ACPI / PM: Allow deeper wakeup power states with no _SxD nor _SxW
+
+  * cxl: Fix timebase synchronization status on POWER9 missing (CAPI)
+    (LP: #1757228)
+    - cxl: Fix timebase synchronization status on P9
+
+  * [Feature]Update Ubuntu 18.04 lpfc FC driver with 32/64GB HBA support and bug
+    fixes (LP: #1752182)
+    - scsi: lpfc: Fix frequency of Release WQE CQEs
+    - scsi: lpfc: Increase CQ and WQ sizes for SCSI
+    - scsi: lpfc: move placement of target destroy on driver detach
+    - scsi: lpfc: correct debug counters for abort
+    - scsi: lpfc: Add WQ Full Logic for NVME Target
+    - scsi: lpfc: Fix PRLI handling when topology type changes
+    - scsi: lpfc: Fix IO failure during hba reset testing with nvme io.
+    - scsi: lpfc: Fix RQ empty firmware trap
+    - scsi: lpfc: Allow set of maximum outstanding SCSI cmd limit for a target
+    - scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing
+    - scsi: lpfc: Fix issue_lip if link is disabled
+    - scsi: lpfc: Indicate CONF support in NVMe PRLI
+    - scsi: lpfc: Fix SCSI io host reset causing kernel crash
+    - scsi: lpfc: Validate adapter support for SRIU option
+    - scsi: lpfc: Fix header inclusion in lpfc_nvmet
+    - scsi: lpfc: Treat SCSI Write operation Underruns as an error
+    - scsi: lpfc: Fix nonrecovery of NVME controller after cable swap.
+    - scsi: lpfc: update driver version to 11.4.0.7
+    - scsi: lpfc: Update 11.4.0.7 modified files for 2018 Copyright
+    - scsi: lpfc: Rework lpfc to allow different sli4 cq and eq handlers
+    - scsi: lpfc: Rework sli4 doorbell infrastructure
+    - scsi: lpfc: Add SLI-4 if_type=6 support to the code base
+    - scsi: lpfc: Add push-to-adapter support to sli4
+    - scsi: lpfc: Add PCI Ids for if_type=6 hardware
+    - scsi: lpfc: Add 64G link speed support
+    - scsi: lpfc: Add if_type=6 support for cycling valid bits
+    - scsi: lpfc: Enable fw download on if_type=6 devices
+    - scsi: lpfc: Add embedded data pointers for enhanced performance
+    - scsi: lpfc: Fix nvme embedded io length on new hardware
+    - scsi: lpfc: Work around NVME cmd iu SGL type
+    - scsi: lpfc: update driver version to 12.0.0.0
+    - scsi: lpfc: Change Copyright of 12.0.0.0 modified files to 2018
+    - scsi: lpfc: use __raw_writeX on DPP copies
+    - scsi: lpfc: Add missing unlock in WQ full logic
+
+  * /dev/bcache/by-uuid links not created after reboot (LP: #1729145)
+    - SAUCE: (no-up) bcache: decouple emitting a cached_dev CHANGE uevent
+
+  * DKMS driver builds fail with: Cannot use CONFIG_STACK_VALIDATION=y, please
+    install libelf-dev, libelf-devel or elfutils-libelf-devel (LP: #1760876)
+    - [Packaging] include the retpoline extractor in the headers
+
+  * Use med_with_dipm SATA LPM to save more power for mobile platforms
+    (LP: #1759547)
+    - [Config] CONFIG_SATA_MOBILE_LPM_POLICY=3
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Only install cloud init files when do_tools_common=true
+    - SAUCE: Import aufs driver
+    - [Config] Enable AUFS config options
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 12 Apr 2018 09:30:56 -0500
+
+linux (4.16.0-3.4) bionic; urgency=medium
+
+  * Allow multiple mounts of zfs datasets (LP: #1759848)
+    - SAUCE: Allow mounting datasets more than once (LP: #1759848)
+
+  * zfs system process hung on container stop/delete (LP: #1754584)
+    - SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)
+    - Revert "UBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)"
+    - SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)
+
+  * ubuntu_zram_smoke test will cause soft lockup on Artful ThunderX ARM64
+    (LP: #1755073)
+    - SAUCE: crypto: thunderx_zip: Fix fallout from CONFIG_VMAP_STACK
+
+  * CAPI Flash (cxlflash) update (LP: #1752672)
+    - SAUCE: cxlflash: Preserve number of interrupts for master contexts
+    - SAUCE: cxlflash: Avoid clobbering context control register value
+    - SAUCE: cxlflash: Add argument identifier names
+    - SAUCE: cxlflash: Introduce OCXL backend
+    - SAUCE: cxlflash: Hardware AFU for OCXL
+    - SAUCE: cxlflash: Read host function configuration
+    - SAUCE: cxlflash: Setup function acTag range
+    - SAUCE: cxlflash: Read host AFU configuration
+    - SAUCE: cxlflash: Setup AFU acTag range
+    - SAUCE: cxlflash: Setup AFU PASID
+    - SAUCE: cxlflash: Adapter context support for OCXL
+    - SAUCE: cxlflash: Use IDR to manage adapter contexts
+    - SAUCE: cxlflash: Support adapter file descriptors for OCXL
+    - SAUCE: cxlflash: Support adapter context discovery
+    - SAUCE: cxlflash: Support image reload policy modification
+    - SAUCE: cxlflash: MMIO map the AFU
+    - SAUCE: cxlflash: Support starting an adapter context
+    - SAUCE: cxlflash: Support process specific mappings
+    - SAUCE: cxlflash: Support AFU state toggling
+    - SAUCE: cxlflash: Support reading adapter VPD data
+    - SAUCE: cxlflash: Setup function OCXL link
+    - SAUCE: cxlflash: Setup OCXL transaction layer
+    - SAUCE: cxlflash: Support process element lifecycle
+    - SAUCE: cxlflash: Support AFU interrupt management
+    - SAUCE: cxlflash: Support AFU interrupt mapping and registration
+    - SAUCE: cxlflash: Support starting user contexts
+    - SAUCE: cxlflash: Support adapter context polling
+    - SAUCE: cxlflash: Support adapter context reading
+    - SAUCE: cxlflash: Support adapter context mmap and release
+    - SAUCE: cxlflash: Support file descriptor mapping
+    - SAUCE: cxlflash: Introduce object handle fop
+    - SAUCE: cxlflash: Setup LISNs for user contexts
+    - SAUCE: cxlflash: Setup LISNs for master contexts
+    - SAUCE: cxlflash: Update synchronous interrupt status bits
+    - SAUCE: cxlflash: Introduce OCXL context state machine
+    - SAUCE: cxlflash: Register for translation errors
+    - SAUCE: cxlflash: Support AFU reset
+    - SAUCE: cxlflash: Enable OCXL operations
+
+  * [Artful][Wyse 3040] System hang when trying to enable an offlined CPU core
+    (LP: #1736393)
+    - SAUCE: drm/i915:Don't set chip specific data
+    - SAUCE: drm/i915: make previous commit affects Wyse 3040 only
+
+  * zed process consuming 100% cpu (LP: #1751796)
+    - SAUCE: Fix ioctl loop-spin in zed (LP: #1751796)
+
+  * Ubuntu18.04:PowerPC - Set Transparent Huge Pages (THP) by default to
+    "always" (LP: #1753708)
+    - Config: Set TRANSPARENT_HUGEPAGE_ALWAYS=y on ppc64el
+
+  * retpoline hints: primary infrastructure and initial hints (LP: #1758856)
+    - [Packaging] retpoline -- add safe usage hint support
+    - [Packaging] retpoline-check -- only report additions
+    - [Packaging] retpoline -- widen indirect call/jmp detection
+    - [Packaging] retpoline -- elide %rip relative indirections
+    - [Packaging] retpoline -- clear hint information from packages
+    - SAUCE: apm -- annotate indirect calls within
+      firmware_restrict_branch_speculation_{start,end}
+    - SAUCE: EFI -- annotate indirect calls within
+      firmware_restrict_branch_speculation_{start,end}
+    - SAUCE: early/late -- annotate indirect calls in early/late initialisation
+      code
+    - SAUCE: vga_set_mode -- avoid jump tables
+    - [Config] retpoine -- switch to new format
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] final-checks -- remove check for empty retpoline files
+    - [Packaging] skip cloud tools packaging when not building package
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 02 Apr 2018 16:15:36 -0500
+
+linux (4.16.0-2.3) bionic; urgency=medium
+
+  * devpts: handle bind-mounts (LP: #1755857)
+    - SAUCE: devpts: hoist out check for DEVPTS_SUPER_MAGIC
+    - SAUCE: devpts: resolve devpts bind-mounts
+    - SAUCE: devpts: comment devpts_mntget()
+    - SAUCE: selftests: add devpts selftests
+
+  * [bionic][arm64] d-i: add hisi_sas_v3_hw to scsi-modules (LP: #1756103)
+    - d-i: add hisi_sas_v3_hw to scsi-modules
+
+  * [Bionic][ARM64] PCI and SAS driver patches for hip08 SoCs (LP: #1756094)
+    - SAUCE: scsi: hisi_sas: config for hip08 ES
+    - SAUCE: scsi: hisi_sas: export device table of v3 hw to userspace
+
+  * s390/crypto: Fix kernel crash on aes_s390 module remove (LP: #1753424)
+    - SAUCE: s390/crypto: Fix kernel crash on aes_s390 module remove.
+
+  * Fix ARC hit rate (LP: #1755158)
+    - SAUCE: Fix ARC hit rate (LP: #1755158)
+
+  * ZFS setgid broken on 0.7 (LP: #1753288)
+    - SAUCE: Fix ZFS setgid
+
+  * CONFIG_EFI=y on armhf (LP: #1726362)
+    - [Config] CONFIG_EFI=y on armhf, reconcile secureboot EFI settings
+
+  * [Feature] Add xHCI debug device support in the driver (LP: #1730832)
+    - [Config] CONFIG_USB_XHCI_DBGCAP=y
+
+  * retpoline: ignore %cs:0xNNN constant indirections (LP: #1752655)
+    - [Packaging] retpoline -- elide %cs:0xNNNN constants on i386
+    - [Config] retpoline -- clean up i386 retpoline files
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] retpoline-extract: flag *0xNNN(%reg) branches
+    - [Config] fix up retpoline abi files
+    - [Config] fix up retpoline abi files
+    - d-i: Add netsec to nic-modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 19 Mar 2018 14:09:49 -0500
+
+linux (4.16.0-1.2) bionic; urgency=medium
+
+  * Driver not found in Ubuntu kernel does not detect interface (LP: #1745927)
+    - d-i: add cxgb4 to nic-modules
+
+  * Support low-pin-count devices on Hisilicon SoCs (LP: #1677319)
+    - [Config] CONFIG_INDIRECT_PIO=y
+    - SAUCE: LIB: Introduce a generic PIO mapping method
+    - SAUCE: PCI: Remove unused __weak attribute in pci_register_io_range()
+    - SAUCE: PCI: Add fwnode handler as input param of pci_register_io_range()
+    - SAUCE: PCI: Apply the new generic I/O management on PCI IO hosts
+    - SAUCE: OF: Add missing I/O range exception for indirect-IO devices
+    - [Config] CONFIG_HISILICON_LPC=y
+    - SAUCE: HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings
+    - SAUCE: ACPI / scan: do not enumerate Indirect IO host children
+    - SAUCE: HISI LPC: Add ACPI support
+    - SAUCE: MAINTAINERS: Add maintainer for HiSilicon LPC driver
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: tools: use CC for linking acpi tools
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 28 Feb 2018 10:17:23 -0600
+
+linux (4.16.0-0.1) bionic; urgency=medium
+
+  * retpoline abi files are empty on i386 (LP: #1751021)
+    - [Packaging] retpoline-extract -- instantiate retpoline files for i386
+    - [Packaging] final-checks -- sanity checking ABI contents
+    - [Packaging] final-checks -- check for empty retpoline files
+
+  * Miscellaneous upstream changes
+    - disable vbox build
+    - Disable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 22 Feb 2018 08:58:57 -0600
+
+linux (4.16.0-0.0) bionic; urgency=medium
+
+  * Dummy entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 21 Feb 2018 14:33:13 -0600
+
+linux (4.15.0-10.11) bionic; urgency=medium
+
+  * linux: 4.15.0-10.11 -proposed tracker (LP: #1749250)
+
+  * "swiotlb: coherent allocation failed" dmesg spam with linux 4.15.0-9.10
+    (LP: #1749202)
+    - swiotlb: suppress warning when __GFP_NOWARN is set
+    - drm/ttm: specify DMA_ATTR_NO_WARN for huge page pools
+
+  * linux-tools: perf incorrectly linking libbfd (LP: #1748922)
+    - SAUCE: tools -- add ability to disable libbfd
+    - [Packaging] correct disablement of libbfd
+
+  * [Artful] Realtek ALC225: 2 secs noise when a headset plugged in
+    (LP: #1744058)
+    - ALSA: hda/realtek - update ALC225 depop optimize
+
+  * [Artful] Support headset mode for DELL WYSE (LP: #1723913)
+    - SAUCE: ALSA: hda/realtek - Add support headset mode for DELL WYSE
+
+  * headset mic can't be detected on two Dell machines (LP: #1748807)
+    - ALSA: hda/realtek - Support headset mode for ALC215/ALC285/ALC289
+    - ALSA: hda - Fix headset mic detection problem for two Dell machines
+
+  * Bionic update to v4.15.3 stable release (LP: #1749191)
+    - ip6mr: fix stale iterator
+    - net: igmp: add a missing rcu locking section
+    - qlcnic: fix deadlock bug
+    - qmi_wwan: Add support for Quectel EP06
+    - r8169: fix RTL8168EP take too long to complete driver initialization.
+    - tcp: release sk_frag.page in tcp_disconnect
+    - vhost_net: stop device during reset owner
+    - ipv6: addrconf: break critical section in addrconf_verify_rtnl()
+    - ipv6: change route cache aging logic
+    - Revert "defer call to mem_cgroup_sk_alloc()"
+    - net: ipv6: send unsolicited NA after DAD
+    - rocker: fix possible null pointer dereference in
+      rocker_router_fib_event_work
+    - tcp_bbr: fix pacing_gain to always be unity when using lt_bw
+    - cls_u32: add missing RCU annotation.
+    - ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only
+    - soreuseport: fix mem leak in reuseport_add_sock()
+    - net_sched: get rid of rcu_barrier() in tcf_block_put_ext()
+    - net: sched: fix use-after-free in tcf_block_put_ext
+    - media: mtk-vcodec: add missing MODULE_LICENSE/DESCRIPTION
+    - media: soc_camera: soc_scale_crop: add missing
+      MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - media: tegra-cec: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - gpio: uniphier: fix mismatch between license text and MODULE_LICENSE
+    - crypto: tcrypt - fix S/G table for test_aead_speed()
+    - Linux 4.15.3
+
+  * bnx2x_attn_int_deasserted3:4323 MC assert! (LP: #1715519) //
+    CVE-2018-1000026
+    - net: create skb_gso_validate_mac_len()
+    - bnx2x: disable GSO where gso_size is too big for hardware
+
+  * ethtool -p fails to light NIC LED on HiSilicon D05 systems (LP: #1748567)
+    - net: hns: add ACPI mode support for ethtool -p
+
+  * CVE-2017-5715 (Spectre v2 Intel)
+    - [Packaging] retpoline files must be sorted
+    - [Packaging] pull in retpoline files
+
+  * [Feature] PXE boot with Intel Omni-Path (LP: #1712031)
+    - d-i: Add hfi1 to nic-modules
+
+  * CVE-2017-5715 (Spectre v2 retpoline)
+    - [Packaging] retpoline -- add call site validation
+    - [Config] disable retpoline checks for first upload
+
+  * Do not duplicate changelog entries assigned to more than one bug or CVE
+    (LP: #1743383)
+    - [Packaging] git-ubuntu-log -- handle multiple bugs/cves better
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 13 Feb 2018 11:33:58 -0600
+
+linux (4.15.0-9.10) bionic; urgency=medium
+
+  * linux: 4.15.0-9.10 -proposed tracker (LP: #1748244)
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] tests -- remove gcc-multilib dependency for arm64
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 08 Feb 2018 11:25:04 -0600
+
+linux (4.15.0-8.9) bionic; urgency=medium
+
+  * linux: 4.15.0-8.9 -proposed tracker (LP: #1748075)
+
+  * Bionic update to v4.15.2 stable release (LP: #1748072)
+    - KVM: x86: Make indirect calls in emulator speculation safe
+    - KVM: VMX: Make indirect call speculation safe
+    - module/retpoline: Warn about missing retpoline in module
+    - x86/cpufeatures: Add CPUID_7_EDX CPUID leaf
+    - x86/cpufeatures: Add Intel feature bits for Speculation Control
+    - x86/cpufeatures: Add AMD feature bits for Speculation Control
+    - x86/msr: Add definitions for new speculation control MSRs
+    - x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown
+    - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes
+    - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support
+    - x86/alternative: Print unadorned pointers
+    - x86/nospec: Fix header guards names
+    - x86/bugs: Drop one "mitigation" from dmesg
+    - x86/cpu/bugs: Make retpoline module warning conditional
+    - x86/cpufeatures: Clean up Spectre v2 related CPUID flags
+    - x86/retpoline: Simplify vmexit_fill_RSB()
+    - x86/speculation: Simplify indirect_branch_prediction_barrier()
+    - auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - iio: adc/accel: Fix up module licenses
+    - pinctrl: pxa: pxa2xx: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - KVM: nVMX: Eliminate vmcs02 pool
+    - KVM: VMX: introduce alloc_loaded_vmcs
+    - objtool: Improve retpoline alternative handling
+    - objtool: Add support for alternatives at the end of a section
+    - objtool: Warn on stripped section symbol
+    - x86/mm: Fix overlap of i386 CPU_ENTRY_AREA with FIX_BTMAP
+    - x86/spectre: Check CONFIG_RETPOLINE in command line parser
+    - x86/entry/64: Remove the SYSCALL64 fast path
+    - x86/entry/64: Push extra regs right away
+    - x86/asm: Move 'status' from thread_struct to thread_info
+    - Documentation: Document array_index_nospec
+    - array_index_nospec: Sanitize speculative array de-references
+    - x86: Implement array_index_mask_nospec
+    - x86: Introduce barrier_nospec
+    - x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec
+    - x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end}
+    - x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec
+    - x86/get_user: Use pointer masking to limit speculation
+    - x86/syscall: Sanitize syscall table de-references under speculation
+    - vfs, fdtable: Prevent bounds-check bypass via speculative execution
+    - nl80211: Sanitize array index in parse_txq_params
+    - x86/spectre: Report get_user mitigation for spectre_v1
+    - x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable"
+    - x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel
+    - x86/speculation: Use Indirect Branch Prediction Barrier in context switch
+    - x86/paravirt: Remove 'noreplace-paravirt' cmdline option
+    - KVM: VMX: make MSR bitmaps per-VCPU
+    - x86/kvm: Update spectre-v1 mitigation
+    - x86/retpoline: Avoid retpolines for built-in __init functions
+    - x86/spectre: Simplify spectre_v2 command line parsing
+    - x86/pti: Mark constant arrays as __initconst
+    - x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL
+    - KVM/x86: Update the reverse_cpuid list to include CPUID_7_EDX
+    - KVM/x86: Add IBPB support
+    - KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES
+    - KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL
+    - KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL
+    - serial: core: mark port as initialized after successful IRQ change
+    - fpga: region: release of_parse_phandle nodes after use
+    - Linux 4.15.2
+
+  * Add support for the NIC on SynQuacer E-Series boards (LP: #1747792)
+    - net: phy: core: remove now uneeded disabling of interrupts
+    - [Config] CONFIG_NET_VENDOR_SOCIONEXT=y & CONFIG_SNI_NETSEC=m
+    - net: socionext: Add Synquacer NetSec driver
+    - net: socionext: include linux/io.h to fix build
+    - net: socionext: Fix error return code in netsec_netdev_open()
+
+  * [Artful/Bionic] [Config] enable EDAC_GHES for ARM64 (LP: #1747746)
+    - [Config] CONFIG_EDAC_GHES=y
+
+  * support thunderx2 vendor pmu events (LP: #1747523)
+    - perf pmu: Pass pmu as a parameter to get_cpuid_str()
+    - perf tools arm64: Add support for get_cpuid_str function.
+    - perf pmu: Add helper function is_pmu_core to detect PMU CORE devices
+    - perf vendor events arm64: Add ThunderX2 implementation defined pmu core
+      events
+    - perf pmu: Add check for valid cpuid in perf_pmu__find_map()
+
+  * linux 4.14.0-7.9 ADT test failure with linux 4.14.0-7.9 (LP: #1732463)
+    - SAUCE: mm: disable vma based swap readahead by default
+    - SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Fix CONFIG_PROFILE_ALL_BRANCHES annotations
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 07 Feb 2018 21:13:27 -0600
+
+linux (4.15.0-7.8) bionic; urgency=medium
+
+  * Bionic update to v4.15.1 stable release (LP: #1747169)
+    - Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops
+    - tools/gpio: Fix build error with musl libc
+    - gpio: stmpe: i2c transfer are forbiden in atomic context
+    - gpio: Fix kernel stack leak to userspace
+    - ALSA: hda - Reduce the suspend time consumption for ALC256
+    - crypto: ecdh - fix typo in KPP dependency of CRYPTO_ECDH
+    - crypto: aesni - handle zero length dst buffer
+    - crypto: aesni - fix typo in generic_gcmaes_decrypt
+    - crypto: aesni - add wrapper for generic gcm(aes)
+    - crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-
+      aesni
+    - crypto: aesni - Fix out-of-bounds access of the AAD buffer in generic-gcm-
+      aesni
+    - crypto: inside-secure - fix hash when length is a multiple of a block
+    - crypto: inside-secure - avoid unmapping DMA memory that was not mapped
+    - crypto: sha3-generic - fixes for alignment and big endian operation
+    - crypto: af_alg - whitelist mask and type
+    - HID: wacom: EKR: ensure devres groups at higher indexes are released
+    - HID: wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events
+    - power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE
+    - mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - igb: Free IRQs when device is hotplugged
+    - ima/policy: fix parsing of fsuuid
+    - scsi: aacraid: Fix udev inquiry race condition
+    - scsi: aacraid: Fix hang in kdump
+    - scsi: storvsc: missing error code in storvsc_probe()
+    - staging: lustre: separate a connection destroy from free struct kib_conn
+    - staging: ccree: NULLify backup_info when unused
+    - staging: ccree: fix fips event irq handling build
+    - tty: fix data race between tty_init_dev and flush of buf
+    - usb: option: Add support for FS040U modem
+    - USB: serial: pl2303: new device id for Chilitag
+    - USB: cdc-acm: Do not log urb submission errors on disconnect
+    - CDC-ACM: apply quirk for card reader
+    - USB: serial: io_edgeport: fix possible sleep-in-atomic
+    - usbip: prevent bind loops on devices attached to vhci_hcd
+    - usbip: list: don't list devices attached to vhci_hcd
+    - USB: serial: simple: add Motorola Tetra driver
+    - usb: f_fs: Prevent gadget unbind if it is already unbound
+    - usb: uas: unconditionally bring back host after reset
+    - usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc()
+    - ANDROID: binder: remove waitqueue when thread exits.
+    - android: binder: use VM_ALLOC to get vm area
+    - mei: me: allow runtime pm for platform with D0i3
+    - serial: 8250_of: fix return code when probe function fails to get reset
+    - serial: 8250_uniphier: fix error return code in uniphier_uart_probe()
+    - serial: 8250_dw: Revert "Improve clock rate setting"
+    - serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS
+    - spi: imx: do not access registers while clocks disabled
+    - iio: adc: stm32: fix scan of multiple channels with DMA
+    - iio: chemical: ccs811: Fix output of IIO_CONCENTRATION channels
+    - test_firmware: fix missing unlock on error in config_num_requests_store()
+    - Input: synaptics-rmi4 - unmask F03 interrupts when port is opened
+    - Input: synaptics-rmi4 - do not delete interrupt memory too early
+    - x86/efi: Clarify that reset attack mitigation needs appropriate userspace
+    - Linux 4.15.1
+
+  * Dell XPS 13 9360 bluetooth (Atheros) won't connect after resume
+    (LP: #1744712)
+    - Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
+    - Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten"
+      version
+
+  * apparmor profile load in stacked policy container fails (LP: #1746463)
+    - SAUCE: apparmor: fix display of .ns_name for containers
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 04 Feb 2018 11:56:32 +0100
+
+linux (4.15.0-6.7) bionic; urgency=low
+
+  * upload urgency should be medium by default (LP: #1745338)
+    - [Packaging] update urgency to medium by default
+
+  * Shutdown hang on 16.04 with iscsi targets (LP: #1569925)
+    - scsi: libiscsi: Allow sd_shutdown on bad transport
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.5-1ubuntu1, zfs to 0.7.5-1ubuntu1
+    - Revert "UBUNTU: SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM"
+    - Revert "UBUNTU: SAUCE: mm: disable vma based swap readahead by default"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jan 2018 08:47:07 -0600
+
+linux (4.15.0-5.6) bionic; urgency=low
+
+  * $(LOCAL_ENV_CC) and $(LOCAL_ENV_DISTCC_HOSTS) should be properly quoted
+    (LP: #1744077)
+    - [Debian] pass LOCAL_ENV_CC and LOCAL_ENV_DISTCC_HOSTS properly
+
+  * Missing install-time driver for QLogic QED 25/40/100Gb Ethernet NIC
+    (LP: #1743638)
+    - [d-i] Add qede to nic-modules udeb
+
+  * boot failure on AMD Raven + WesternXT (LP: #1742759)
+    - SAUCE: drm/amdgpu: add atpx quirk handling (v2)
+
+  * Unable to handle kernel NULL pointer dereference at isci_task_abort_task
+    (LP: #1726519)
+    - SAUCE: Revert "scsi: libsas: allow async aborts"
+
+  * Update Ubuntu-4.15.0 config to support Intel Atom devices (LP: #1739939)
+    - [Config] CONFIG_SERIAL_DEV_BUS=y, CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v4.15-rc7
+    - [Config] CONFIG_CPU_ISOLATION=y
+    - [Config] Update annotations following config review
+    - Revert "UBUNTU: SAUCE: Import aufs driver"
+    - SAUCE: Import aufs driver
+    - ubuntu: vbox -- update to 5.2.6-dfsg-1
+    - ubuntu: vbox: build fixes for 4.15
+    - ubuntu: vbox -- update to 5.2.6-dfsg-2
+    - hio: updates for timer api changes in 4.15
+    - enable hio build
+    - Rebase to v4.15-rc9
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc9
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jan 2018 10:16:05 -0600
+
+linux (4.15.0-4.5) bionic; urgency=low
+
+  * [0cf3:e010] QCA6174A XR failed to pair with bt 4.0 device  (LP: #1741166)
+    - SAUCE: Bluetooth: btusb: Add support for 0cf3:e010
+
+  * External HDMI monitor failed to show screen on Lenovo X1 series
+    (LP: #1738523)
+    - SAUCE: drm/i915: Disable writing of TMDS_OE on Lenovo ThinkPad X1 series
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] autoreconstruct - add resoration of execute permissions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 10 Jan 2018 10:24:22 -0600
+
+linux (4.15.0-3.4) bionic; urgency=low
+
+  * ubuntu/xr-usb-serial didn't get built in zesty and artful (LP: #1733281)
+    - SAUCE: make sure ubuntu/xr-usb-serial builds for x86
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 03 Jan 2018 20:20:43 -0600
+
+linux (4.15.0-2.3) bionic; urgency=low
+
+  * nvidia-graphics-drivers-384 384.90-0ubuntu6 ADT test failure with linux
+    4.15.0-1.2 (LP: #1737752)
+    - x86/mm: Unbreak modules that use the DMA API
+
+  * Ubuntu 17.10 corrupting BIOS - many LENOVO laptops models (LP: #1734147)
+    - [Config] CONFIG_SPI_INTEL_SPI_*=n
+
+  * power: commonise configs IBMVETH/IBMVSCSI and ensure both are in linux-image
+    and udebs (LP: #1521712)
+    - [Config] Include ibmvnic in nic-modules
+
+  * Enable arm64 emulation of removed ARMv7 instructions (LP: #1545542)
+    - [Config] Enable support for emulation of deprecated ARMv8 instructions
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl with 4.15 compat fix (LP:#1737761)
+    - Enable zfs build
+    - [Debian] add icp to zfs-modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 18 Dec 2017 09:27:13 -0600
+
+linux (4.15.0-1.2) bionic; urgency=low
+
+  * Disabling zfs does not always disable module checks for the zfs modules
+    (LP: #1737176)
+    - [Packaging] disable zfs module checks when zfs is disabled
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_UNWINDER_FRAME_POINTER=y for amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 10 Dec 2017 22:07:19 -0600
+
+linux (4.15.0-0.1) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu: vbox -- update to 5.2.2-dfsg-2
+    - ubuntu: vbox: build fixes for 4.15
+    - disable hio build
+    - [Config] Update kernel lockdown options to fix build errors
+    - Disable zfs build
+    - SAUCE: Import aufs driver
+    - [Config] Enable AUFS config options
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 08 Dec 2017 13:55:42 -0600
+
+linux (4.14.0-11.13) bionic; urgency=low
+
+  * linux: 4.14.0-11.13 -proposed tracker (LP: #1736168)
+
+  * CVE-2017-1000405
+    - mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
+
+  * linux 4.14.0-7.9 ADT test failure with linux 4.14.0-7.9 (LP: #1732463)
+    - SAUCE: mm: disable vma based swap readahead by default
+    - SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM
+
+  * Bionic update to v4.14.3 stable release (LP: #1735843)
+    - s390: fix transactional execution control register handling
+    - s390/noexec: execute kexec datamover without DAT
+    - s390/runtime instrumention: fix possible memory corruption
+    - s390/guarded storage: fix possible memory corruption
+    - s390/disassembler: add missing end marker for e7 table
+    - s390/disassembler: increase show_code buffer size
+    - ACPI / PM: Fix acpi_pm_notifier_lock vs flush_workqueue() deadlock
+    - ACPI / EC: Fix regression related to triggering source of EC event handling
+    - cpufreq: schedutil: Reset cached_raw_freq when not in sync with next_freq
+    - serdev: fix registration of second slave
+    - sched: Make resched_cpu() unconditional
+    - lib/mpi: call cond_resched() from mpi_powm() loop
+    - x86/boot: Fix boot failure when SMP MP-table is based at 0
+    - x86/decoder: Add new TEST instruction pattern
+    - x86/entry/64: Fix entry_SYSCALL_64_after_hwframe() IRQ tracing
+    - x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
+    - perf/x86/intel: Hide TSX events when RTM is not supported
+    - arm64: Implement arch-specific pte_access_permitted()
+    - ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
+    - ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
+    - uapi: fix linux/tls.h userspace compilation error
+    - uapi: fix linux/rxrpc.h userspace compilation errors
+    - MIPS: cmpxchg64() and HAVE_VIRT_CPU_ACCOUNTING_GEN don't work for 32-bit SMP
+    - MIPS: ralink: Fix MT7628 pinmux
+    - MIPS: ralink: Fix typo in mt7628 pinmux function
+    - net: mvneta: fix handling of the Tx descriptor counter
+    - nbd: wait uninterruptible for the dead timeout
+    - nbd: don't start req until after the dead connection logic
+    - PM / OPP: Add missing of_node_put(np)
+    - PCI/ASPM: Account for downstream device's Port Common_Mode_Restore_Time
+    - PCI/ASPM: Use correct capability pointer to program LTR_L1.2_THRESHOLD
+    - PCI: hv: Use effective affinity mask
+    - PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
+    - PCI: Apply Cavium ThunderX ACS quirk to more Root Ports
+    - ALSA: hda: Add Raven PCI ID
+    - dm integrity: allow unaligned bv_offset
+    - dm cache: fix race condition in the writeback mode overwrite_bio
+      optimisation
+    - dm crypt: allow unaligned bv_offset
+    - dm zoned: ignore last smaller runt zone
+    - dm mpath: remove annoying message of 'blk_get_request() returned -11'
+    - dm bufio: fix integer overflow when limiting maximum cache size
+    - ovl: Put upperdentry if ovl_check_origin() fails
+    - dm: allocate struct mapped_device with kvzalloc
+    - sched/rt: Simplify the IPI based RT balancing logic
+    - MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
+    - dm: fix race between dm_get_from_kobject() and __dm_destroy()
+    - dm: discard support requires all targets in a table support discards
+    - MIPS: Fix odd fp register warnings with MIPS64r2
+    - MIPS: Fix MIPS64 FP save/restore on 32-bit kernels
+    - MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
+    - MIPS: Fix an n32 core file generation regset support regression
+    - MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
+    - MIPS: math-emu: Fix final emulation phase for certain instructions
+    - rt2x00usb: mark device removed when get ENOENT usb error
+    - mm/z3fold.c: use kref to prevent page free/compact race
+    - autofs: don't fail mount for transient error
+    - nilfs2: fix race condition that causes file system corruption
+    - fscrypt: lock mutex before checking for bounce page pool
+    - eCryptfs: use after free in ecryptfs_release_messaging()
+    - libceph: don't WARN() if user tries to add invalid key
+    - bcache: check ca->alloc_thread initialized before wake up it
+    - fs: guard_bio_eod() needs to consider partitions
+    - fanotify: fix fsnotify_prepare_user_wait() failure
+    - isofs: fix timestamps beyond 2027
+    - btrfs: change how we decide to commit transactions during flushing
+    - f2fs: expose some sectors to user in inline data or dentry case
+    - NFS: Fix typo in nomigration mount option
+    - NFS: Revert "NFS: Move the flock open mode check into nfs_flock()"
+    - nfs: Fix ugly referral attributes
+    - NFS: Avoid RCU usage in tracepoints
+    - NFS: revalidate "." etc correctly on "open".
+    - nfsd: deal with revoked delegations appropriately
+    - rtlwifi: rtl8192ee: Fix memory leak when loading firmware
+    - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
+    - iwlwifi: fix firmware names for 9000 and A000 series hw
+    - md: fix deadlock error in recent patch.
+    - md: don't check MD_SB_CHANGE_CLEAN in md_allow_write
+    - Bluetooth: btqcomsmd: Add support for BD address setup
+    - md/bitmap: revert a patch
+    - fsnotify: clean up fsnotify_prepare/finish_user_wait()
+    - fsnotify: pin both inode and vfsmount mark
+    - fsnotify: fix pinning group in fsnotify_prepare_user_wait()
+    - ata: fixes kernel crash while tracing ata_eh_link_autopsy event
+    - ext4: fix interaction between i_size, fallocate, and delalloc after a crash
+    - ext4: prevent data corruption with inline data + DAX
+    - ext4: prevent data corruption with journaling + DAX
+    - ALSA: pcm: update tstamp only if audio_tstamp changed
+    - ALSA: usb-audio: Add sanity checks to FE parser
+    - ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
+    - ALSA: usb-audio: Add sanity checks in v2 clock parsers
+    - ALSA: timer: Remove kernel warning at compat ioctl error paths
+    - ALSA: hda/realtek - Fix ALC275 no sound issue
+    - ALSA: hda: Fix too short HDMI/DP chmap reporting
+    - ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization
+    - ALSA: hda/realtek - Fix ALC700 family no sound issue
+    - ASoC: sun8i-codec: Invert Master / Slave condition
+    - ASoC: sun8i-codec: Fix left and right channels inversion
+    - ASoC: sun8i-codec: Set the BCLK divider
+    - mfd: lpc_ich: Avoton/Rangeley uses SPI_BYT method
+    - fix a page leak in vhost_scsi_iov_to_sgl() error recovery
+    - 9p: Fix missing commas in mount options
+    - fs/9p: Compare qid.path in v9fs_test_inode
+    - net/9p: Switch to wait_event_killable()
+    - scsi: qla2xxx: Suppress a kernel complaint in qla_init_base_qpair()
+    - scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics()
+    - scsi: lpfc: fix pci hot plug crash in timer management routines
+    - scsi: lpfc: fix pci hot plug crash in list_add call
+    - scsi: lpfc: Fix crash receiving ELS while detaching driver
+    - scsi: lpfc: Fix FCP hba_wqidx assignment
+    - scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails
+    - iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref
+    - iscsi-target: Fix non-immediate TMR reference leak
+    - target: fix null pointer regression in core_tmr_drain_tmr_list
+    - target: fix buffer offset in core_scsi3_pri_read_full_status
+    - target: Fix QUEUE_FULL + SCSI task attribute handling
+    - target: Fix caw_sem leak in transport_generic_request_failure
+    - target: Fix quiese during transport_write_pending_qf endless loop
+    - target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK
+    - mtd: Avoid probe failures when mtd->dbg.dfs_dir is invalid
+    - mtd: nand: Export nand_reset() symbol
+    - mtd: nand: atmel: Actually use the PM ops
+    - mtd: nand: omap2: Fix subpage write
+    - mtd: nand: Fix writing mtdoops to nand flash.
+    - mtd: nand: mtk: fix infinite ECC decode IRQ issue
+    - mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush sequence
+    - p54: don't unregister leds when they are not initialized
+    - block: Fix a race between blk_cleanup_queue() and timeout handling
+    - raid1: prevent freeze_array/wait_all_barriers deadlock
+    - genirq: Track whether the trigger type has been set
+    - irqchip/gic-v3: Fix ppi-partitions lookup
+    - lockd: double unregister of inetaddr notifiers
+    - KVM: PPC: Book3S HV: Don't call real-mode XICS hypercall handlers if not
+      enabled
+    - KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
+    - KVM: SVM: obey guest PAT
+    - kvm: vmx: Reinstate support for CPUs without virtual NMI
+    - dax: fix PMD faults on zero-length files
+    - dax: fix general protection fault in dax_alloc_inode
+    - SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
+    - clk: ti: dra7-atl-clock: fix child-node lookups
+    - libnvdimm, dimm: clear 'locked' status on successful DIMM enable
+    - libnvdimm, pfn: make 'resource' attribute only readable by root
+    - libnvdimm, namespace: fix label initialization to use valid seq numbers
+    - libnvdimm, region : make 'resource' attribute only readable by root
+    - libnvdimm, namespace: make 'resource' attribute only readable by root
+    - svcrdma: Preserve CB send buffer across retransmits
+    - IB/srpt: Do not accept invalid initiator port names
+    - IB/cm: Fix memory corruption in handling CM request
+    - IB/hfi1: Fix incorrect available receive user context count
+    - IB/srp: Avoid that a cable pull can trigger a kernel crash
+    - IB/core: Avoid crash on pkey enforcement failed in received MADs
+    - IB/core: Only maintain real QPs in the security lists
+    - NFC: fix device-allocation error return
+    - spi-nor: intel-spi: Fix broken software sequencing codes
+    - i40e: Use smp_rmb rather than read_barrier_depends
+    - igb: Use smp_rmb rather than read_barrier_depends
+    - igbvf: Use smp_rmb rather than read_barrier_depends
+    - ixgbevf: Use smp_rmb rather than read_barrier_depends
+    - i40evf: Use smp_rmb rather than read_barrier_depends
+    - fm10k: Use smp_rmb rather than read_barrier_depends
+    - ixgbe: Fix skb list corruption on Power systems
+    - parisc: Fix validity check of pointer size argument in new CAS
+      implementation
+    - powerpc: Fix boot on BOOK3S_32 with CONFIG_STRICT_KERNEL_RWX
+    - powerpc/mm/radix: Fix crashes on Power9 DD1 with radix MMU and STRICT_RWX
+    - powerpc/perf/imc: Use cpu_to_node() not topology_physical_package_id()
+    - powerpc/signal: Properly handle return value from uprobe_deny_signal()
+    - powerpc/64s: Fix masking of SRR1 bits on instruction fault
+    - powerpc/64s/radix: Fix 128TB-512TB virtual address boundary case allocation
+    - powerpc/64s/hash: Fix 512T hint detection to use >= 128T
+    - powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case allocation
+    - powerpc/64s/hash: Fix fork() with 512TB process address space
+    - powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary
+    - media: Don't do DMA on stack for firmware upload in the AS102 driver
+    - media: rc: check for integer overflow
+    - media: rc: nec decoder should not send both repeat and keycode
+    - cx231xx-cards: fix NULL-deref on missing association descriptor
+    - media: v4l2-ctrl: Fix flags field on Control events
+    - media: venus: fix wrong size on dma_free
+    - media: venus: venc: fix bytesused v4l2_plane field
+    - media: venus: reimplement decoder stop command
+    - ARM64: dts: meson-gxl: Add alternate ARM Trusted Firmware reserved memory
+      zone
+    - iwlwifi: fix wrong struct for a000 device
+    - iwlwifi: add a new a000 device
+    - iwlwifi: pcie: sort IDs for the 9000 series for easier comparisons
+    - iwlwifi: add new cards for a000 series
+    - iwlwifi: add new cards for 8265 series
+    - iwlwifi: add new cards for 8260 series
+    - iwlwifi: fix PCI IDs and configuration mapping for 9000 series
+    - iwlwifi: mvm: support version 7 of the SCAN_REQ_UMAC FW command
+    - e1000e: Fix error path in link detection
+    - e1000e: Fix return value test
+    - e1000e: Separate signaling for link check/link up
+    - e1000e: Avoid receiver overrun interrupt bursts
+    - e1000e: fix buffer overrun while the I219 is processing DMA transactions
+    - Linux 4.14.3
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: s390/topology: don't inline cpu_to_node
+    - SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to 0.7.3-1ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 04 Dec 2017 09:08:07 -0600
+
+linux (4.14.0-10.12) bionic; urgency=low
+
+  * linux: 4.14.0-10.12 -proposed tracker (LP: #1734901)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Enable the ACPI kernel debugger and acpidbg tool
+    - [Packaging] Include arch/arm64/kernel/ftrace-mod.o in headers package
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Nov 2017 08:46:49 -0600
+
+linux (4.14.0-9.11) bionic; urgency=low
+
+  * linux: 4.14.0-9.11 -proposed tracker (LP: #1734728)
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to
+      0.7.3-1ubuntu1"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Nov 2017 12:44:48 -0600
+
+linux (4.14.0-8.10) bionic; urgency=low
+
+  * linux: 4.14.0-8.10 -proposed tracker (LP: #1734695)
+
+  * Bionic update to v4.14.2 stable release (LP: #1734694)
+    - bio: ensure __bio_clone_fast copies bi_partno
+    - af_netlink: ensure that NLMSG_DONE never fails in dumps
+    - vxlan: fix the issue that neigh proxy blocks all icmpv6 packets
+    - net: cdc_ncm: GetNtbFormat endian fix
+    - fealnx: Fix building error on MIPS
+    - net/sctp: Always set scope_id in sctp_inet6_skb_msgname
+    - ima: do not update security.ima if appraisal status is not INTEGRITY_PASS
+    - serial: omap: Fix EFR write on RTS deassertion
+    - serial: 8250_fintek: Fix finding base_port with activated SuperIO
+    - tpm-dev-common: Reject too short writes
+    - rcu: Fix up pending cbs check in rcu_prepare_for_idle
+    - mm/pagewalk.c: report holes in hugetlb ranges
+    - ocfs2: fix cluster hang after a node dies
+    - ocfs2: should wait dio before inode lock in ocfs2_setattr()
+    - ipmi: fix unsigned long underflow
+    - mm/page_alloc.c: broken deferred calculation
+    - mm/page_ext.c: check if page_ext is not prepared
+    - coda: fix 'kernel memory exposure attempt' in fsync
+    - ipmi: Prefer ACPI system interfaces over SMBIOS ones
+    - Linux 4.14.2
+
+  * Bionic update to v4.14.1 stable release (LP: #1734693)
+    - EDAC, sb_edac: Don't create a second memory controller if HA1 is not present
+    - dmaengine: dmatest: warn user when dma test times out
+    - media: imon: Fix null-ptr-deref in imon_probe
+    - media: dib0700: fix invalid dvb_detach argument
+    - crypto: dh - Fix double free of ctx->p
+    - crypto: dh - Don't permit 'p' to be 0
+    - crypto: dh - Don't permit 'key' or 'g' size longer than 'p'
+    - crypto: brcm - Explicity ACK mailbox message
+    - USB: early: Use new USB product ID and strings for DbC device
+    - USB: usbfs: compute urb->actual_length for isochronous
+    - USB: Add delay-init quirk for Corsair K70 LUX keyboards
+    - usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
+    - USB: serial: metro-usb: stop I/O after failed open
+    - USB: serial: Change DbC debug device binding ID
+    - USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update
+    - USB: serial: garmin_gps: fix I/O after failed probe and remove
+    - USB: serial: garmin_gps: fix memory leak on probe errors
+    - selftests/x86/protection_keys: Fix syscall NR redefinition warnings
+    - x86/MCE/AMD: Always give panic severity for UC errors in kernel context
+    - platform/x86: peaq-wmi: Add DMI check before binding to the WMI interface
+    - platform/x86: peaq_wmi: Fix missing terminating entry for peaq_dmi_table
+    - HID: cp2112: add HIDRAW dependency
+    - HID: wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection
+    - rpmsg: glink: Add missing MODULE_LICENSE
+    - staging: wilc1000: Fix bssid buffer offset in Txq
+    - staging: sm750fb: Fix parameter mistake in poke32
+    - staging: ccree: fix 64 bit scatter/gather DMA ops
+    - staging: greybus: spilib: fix use-after-free after deregistration
+    - staging: rtl8188eu: Revert 4 commits breaking ARP
+    - spi: fix use-after-free at controller deregistration
+    - sparc32: Add cmpxchg64().
+    - sparc64: mmu_context: Add missing include files
+    - sparc64: Fix page table walk for PUD hugepages
+    - Linux 4.14.1
+
+  * Set PANIC_TIMEOUT=10 on Power Systems (LP: #1730660)
+    - [Config]: Set PANIC_TIMEOUT=10 on ppc64el
+
+  * enable CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH easily confuse users
+    (LP: #1732627)
+    - [Config] CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH=n
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to 0.7.3-1ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Nov 2017 07:43:44 -0600
+
+linux (4.14.0-7.9) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor: add base infastructure for socket mediation
+    - SAUCE: apparmor: af_unix mediation
+    - SAUCE: LSM stacking: procfs: add smack subdir to attrs
+    - SAUCE: LSM stacking: LSM: manage credential security blobs
+    - SAUCE: LSM stacking: LSM: Manage file security blobs
+    - SAUCE: LSM stacking: LSM: manage task security blobs
+    - SAUCE: LSM stacking: LSM: Infrastructure management of the remaining blobs
+    - SAUCE: LSM stacking: LSM: general but not extreme module stacking
+    - SAUCE: LSM stacking: LSM: Complete task_alloc hook
+    - SAUCE: LSM stacking: fixup procsfs: add smack subdir to attrs
+    - SAUCE: LSM stacking: fixup initialize task->security
+    - SAUCE: LSM stacking: fixup: alloc_task_ctx is dead code
+    - SAUCE: LSM stacking: add support for stacking getpeersec_stream
+    - SAUCE: LSM stacking: add stacking support to apparmor network hooks
+    - SAUCE: LSM stacking: fixup apparmor stacking enablement
+    - SAUCE: LSM stacking: fixup stacking kconfig
+    - SAUCE: LSM stacking: allow selecting multiple LSMs using kernel boot params
+    - SAUCE: LSM stacking: provide prctl interface for setting context
+    - SAUCE: LSM stacking: inherit current display LSM
+    - SAUCE: LSM stacking: keep an index for each registered LSM
+    - SAUCE: LSM stacking: verify display LSM
+    - SAUCE: LSM stacking: provide a way to specify the default display lsm
+    - SAUCE: LSM stacking: make sure LSM blob align on 64 bit boundaries
+    - SAUCE: LSM stacking: add /proc/<pid>/attr/display_lsm
+    - SAUCE: LSM stacking: add Kconfig to set default display LSM
+    - SAUCE: LSM stacking: add configs for LSM stacking
+    - SAUCE: LSM stacking: check for invalid zero sized writes
+    - [Config] Run updateconfigs after merging LSM stacking
+    - [Config] CONFIG_AMD_MEM_ENCRYPT=y
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 13 Nov 2017 08:12:08 -0600
+
+linux (4.14.0-6.8) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: add workarounds to enable ZFS for 4.14
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Nov 2017 11:39:00 -0600
+
+linux (4.14.0-5.7) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Fix invocation of dh_prep for dbgsym packages
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 31 Oct 2017 07:07:23 -0500
+
+linux (4.14.0-4.5) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] virtualbox -- reduce in kernel module versions
+    - vbox-update: Fix up KERN_DIR definitions
+    - ubuntu: vbox -- update to 5.2.0-dfsg-2
+    - [Config] CONFIG_AMD_MEM_ENCRYPT=n
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 30 Oct 2017 13:29:20 -0500
+
+linux (4.14.0-3.4) artful; urgency=low
+
+  * Touchpad and TrackPoint Dose Not Work on Lenovo X1C6 and X280 (LP: #1723986)
+    - SAUCE: Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3
+    - SAUCE: Input: synaptics - Lenovo X1 Carbon 5 should use SMBUS/RMI
+    - SAUCE: Input: synaptics - add Intertouch support on X1 Carbon 6th and X280
+
+  * powerpc/64s: Add workaround for P9 vector CI load issuenext (LP: #1721070)
+    - powerpc/64s: Add workaround for P9 vector CI load issue
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: staging: vboxvideo: Fix reporting invalid suggested-offset-properties
+    - [Config] CONFIG_DRM_VBOXVIDEO=m
+    - SAUCE: Import aufs driver
+    - [Config] Enable aufs
+    - [Config] Reorder annotations file after enabling aufs
+    - vbox-update: Disable imported vboxvideo module
+    - ubuntu: vbox -- update to 5.1.30-dfsg-1
+    - Enable vbox
+    - hio: Use correct sizes when initializing ssd_index_bits* arrays
+    - hio: Update io stat accounting for 4.14
+    - Enable hio
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc5
+  * Rebase to v4.14-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 23 Oct 2017 13:53:52 -0500
+
+linux (4.14.0-2.3) artful; urgency=low
+
+  * [Bug] USB controller failed to respond on Denverton after loading
+    intel_th_pci module (LP: #1715833)
+    - SAUCE: PCI: Disable broken RTIT_BAR of Intel TH
+
+  * CONFIG_DEBUG_FS is not enabled by "make zfcpdump_defconfig" with Ubuntu
+    17.10 (kernel 4.13) (LP: #1719290)
+    - SAUCE: s390: update zfcpdump_defconfig
+
+  * Add installer support for Broadcom BCM573xx network drivers. (LP: #1720466)
+    - d-i: Add bnxt_en to nic-modules.
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update annotations for 4.14-rc2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc3
+  * Rebase to v4.14-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 11 Oct 2017 16:04:27 -0500
+
+linux (4.14.0-1.2) artful; urgency=low
+
+  * [Bug] USB 3.1 Gen2 works as 5Gbps (LP: #1720045)
+    - xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
+
+  * Please make linux-libc-dev Provide: aufs-dev (LP: #1716091)
+    - [Packaging] Add aufs-dev to the Provides: for linux-libc-dev
+
+  * Upgrade to 4.13.0-11.12 in artful amd64 VM breaks display on wayland
+    (LP: #1718679)
+    - [Config] CONFIG_DRM_VBOXVIDEO=n
+
+  * ipmmu-vmsa driver breaks arm64 boots (LP: #1718734)
+    - [Config] Disable CONFIG_IPMMU_VMSA on arm64
+
+  * autopkgtest profile fails to build on armhf (LP: #1717920)
+    - [Packaging] autopkgtest -- disable d-i when dropping flavours
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_I2C_XLP9XX=m
+    - [Packaging] Use SRCPKGNAME rather than hard-coding the source package name
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 29 Sep 2017 09:09:11 -0400
+
+linux (4.14.0-0.1) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - Disable vbox build
+    - Disable hio build
+    - Disable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 19 Sep 2017 20:22:29 -0500
+
+linux (4.13.0-11.12) artful; urgency=low
+
+  * linux: 4.13.0-11.12 -proposed tracker (LP: #1716699)
+
+  * kernel panic -not syncing: Fatal exception: panic_on_oops (LP: #1708399)
+    - s390/mm: fix local TLB flushing vs. detach of an mm address space
+    - s390/mm: fix race on mm->context.flush_mm
+
+  * CVE-2017-1000251
+    - Bluetooth: Properly check L2CAP config option output buffer length
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 12 Sep 2017 10:18:38 -0500
+
+linux (4.13.0-10.11) artful; urgency=low
+
+  * linux: 4.13.0-10.11 -proposed tracker (LP: #1716287)
+
+  * please add aufs-dkms to the Provides: for the kernel packages (LP: #1716093)
+    - [Packaging] Add aufs-dkms to the Provides: for kernel packages
+
+  * Artful update to v4.13.1 stable release (LP: #1716284)
+    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
+    - USB: serial: option: add support for D-Link DWM-157 C1
+    - usb: Add device quirk for Logitech HD Pro Webcam C920-C
+    - usb:xhci:Fix regression when ATI chipsets detected
+    - USB: musb: fix external abort on suspend
+    - ANDROID: binder: add padding to binder_fd_array_object.
+    - ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES.
+    - USB: core: Avoid race of async_completed() w/ usbdev_release()
+    - staging/rts5208: fix incorrect shift to extract upper nybble
+    - staging: ccree: save ciphertext for CTS IV
+    - staging: fsl-dpaa2/eth: fix off-by-one FD ctrl bitmaks
+    - iio: adc: ti-ads1015: fix incorrect data rate setting update
+    - iio: adc: ti-ads1015: fix scale information for ADS1115
+    - iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set
+    - iio: adc: ti-ads1015: avoid getting stale result after runtime resume
+    - iio: adc: ti-ads1015: don't return invalid value from buffer setup callbacks
+    - iio: adc: ti-ads1015: add adequate wait time to get correct conversion
+    - driver core: bus: Fix a potential double free
+    - HID: wacom: Do not completely map WACOM_HID_WD_TOUCHRINGSTATUS usage
+    - binder: free memory on error
+    - crypto: caam/qi - fix compilation with CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
+    - crypto: caam/qi - fix compilation with DEBUG enabled
+    - thunderbolt: Fix reset response_type
+    - fpga: altera-hps2fpga: fix multiple init of l3_remap_lock
+    - intel_th: pci: Add Cannon Lake PCH-H support
+    - intel_th: pci: Add Cannon Lake PCH-LP support
+    - ath10k: fix memory leak in rx ring buffer allocation
+    - drm/vgem: Pin our pages for dmabuf exports
+    - drm/ttm: Fix accounting error when fail to get pages for pool
+    - drm/dp/mst: Handle errors from drm_atomic_get_private_obj_state() correctly
+    - rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
+    - Bluetooth: Add support of 13d3:3494 RTL8723BE device
+    - iwlwifi: pci: add new PCI ID for 7265D
+    - dlm: avoid double-free on error path in dlm_device_{register,unregister}
+    - mwifiex: correct channel stat buffer overflows
+    - MCB: add support for SC31 to mcb-lpc
+    - s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs
+    - drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
+    - drm/nouveau: Fix error handling in nv50_disp_atomic_commit
+    - workqueue: Fix flag collision
+    - ahci: don't use MSI for devices with the silly Intel NVMe remapping scheme
+    - cs5536: add support for IDE controller variant
+    - scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
+    - scsi: sg: recheck MMAP_IO request length with lock held
+    - of/device: Prevent buffer overflow in of_device_modalias()
+    - rtlwifi: Fix memory leak when firmware request fails
+    - rtlwifi: Fix fallback firmware loading
+    - Linux 4.13.1
+
+  * Kernel has trouble recognizing Corsair Strafe RGB keyboard (LP: #1678477)
+    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
+
+  * SRIOV: warning if unload VFs (LP: #1715073)
+    - PCI: Disable VF decoding before pcibios_sriov_disable() updates resources
+
+  * [Patch] network-i40e:NVM bug fixes (cherrypick from 4.14) (LP: #1715578)
+    - i40e: avoid NVM acquire deadlock during NVM update
+    - i40e: point wb_desc at the nvm_wb_desc during i40e_read_nvm_aq
+
+  * [P9,POwer NV] Perf PMU event : pm_br_2path and pm_ld_miss_l1 is counted
+    twice when perf stat is done (perf:) (LP: #1714571)
+    - perf vendor events powerpc: Remove duplicate events
+
+  * Unable to install Ubuntu on the NVMe disk under VMD PCI domain
+    (LP: #1703339)
+    - [Config] Include vmd in storage-core-modules udeb
+
+  * 17.10 fails to boot on POWER9 DD2.0 with Deep stop states (LP: #1715064)
+    - powerpc/powernv: Save/Restore additional SPRs for stop4 cpuidle
+    - powerpc/powernv: Clear PECE1 in LPCR via stop-api only on Hotplug
+    - SAUCE: powerpc/powernv: Clear LPCR[PECE1] via stop-api only for deep state
+      offline
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/seccomp: Support glibc 2.26 siginfo_t.h
+    - Revert "UBUNTU: SAUCE: Import aufs driver"
+    - SAUCE: Import aufs driver
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 10 Sep 2017 17:48:59 -0500
+
+linux (4.13.0-9.10) artful; urgency=low
+
+  * linux: 4.13.0-9.10 -proposed tracker (LP: #1715145)
+
+  * EDAC sbridge: Failed to register device with error -22. (LP: #1714112)
+    - [Config] CONFIG_EDAC_GHES=n
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu: vbox -- update to 5.1.26-dfsg-2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 05 Sep 2017 07:51:19 -0500
+
+linux (4.13.0-8.9) artful; urgency=low
+
+  * snapd 2.27.3+17.10 ADT test failure with linux 4.13.0-6.7 (LP: #1713103)
+    - SAUCE: apparmor: fix apparmorfs DAC access, permissions
+
+  * enable ARCH_SUNXI (and friends) in arm64 kernel .config (LP: #1701137)
+    - [Config] Enable CONFIG_ARCH_SUNXI and related options for arm64
+
+  * [Bug] Harrisonville: pnd2_edac always fail to load on B1 stepping
+    Harrisonville SDP (LP: #1709257)
+    - EDAC, pnd2: Build in a minimal sideband driver for Apollo Lake
+    - EDAC, pnd2: Mask off the lower four bits of a BAR
+    - EDAC, pnd2: Conditionally unhide/hide the P2SB PCI device to read BAR
+    - EDAC, pnd2: Properly toggle hidden state for P2SB PCI device
+    - SAUCE: i2c: i801: Restore the presence state of P2SB PCI device after
+      reading BAR
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: Import aufs driver"
+    - SAUCE: Import aufs driver
+    - SAUCE: selftests/powerpc: Disable some ptrace selftests
+    - [Config] CONFIG_CRYPTO_DEV_NITROX_CNN55XX=n for s390x
+    - [Config] CONFIG_I2C_SLAVE=n for amd64, i386, ppc64el
+    - [Config] Disable CONFIG_MDIO_* options for s390x
+    - [Config] CONFIG_SCSI_MQ_DEFAULT=n for s390x
+    - [Config] Update annotations for 4.13
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 31 Aug 2017 14:27:09 -0500
+
+linux (4.13.0-7.8) artful; urgency=low
+
+  * linux 4.12.0-11.12 ADT test failure with linux 4.12.0-11.12 (LP: #1710904)
+    - SAUCE: selftests/powerpc: Use snprintf to construct DSCR sysfs interface
+      paths
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: seccomp: log actions even when audit is disabled"
+
+  * Miscellaneous upstream changes
+    - seccomp: Provide matching filter for introspection
+    - seccomp: Sysctl to display available actions
+    - seccomp: Operation for checking if an action is available
+    - seccomp: Sysctl to configure actions that are allowed to be logged
+    - seccomp: Selftest for detection of filter flag support
+    - seccomp: Filter flag to log all actions except SECCOMP_RET_ALLOW
+    - seccomp: Action to log before allowing
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 28 Aug 2017 08:12:24 -0500
+
+linux (4.13.0-6.7) artful; urgency=low
+
+  * HID: multitouch: Support ALPS PTP Stick and Touchpad devices (LP: #1712481)
+    - SAUCE: HID: multitouch: Support ALPS PTP stick with pid 0x120A
+
+  * sort ABI files with C.UTF-8 locale (LP: #1712345)
+    - [Packaging] sort ABI files with C.UTF-8 locale
+
+  * igb: Support using Broadcom 54616 as PHY (LP: #1712024)
+    - SAUCE: igb: add support for using Broadcom 54616 as PHY
+
+  * RPT related fixes missing in Ubuntu 16.04.3 (LP: #1709220)
+    - powerpc/mm/radix: Improve _tlbiel_pid to be usable for PWC flushes
+    - powerpc/mm/radix: Improve TLB/PWC flushes
+    - powerpc/mm/radix: Avoid flushing the PWC on every flush_tlb_range
+
+  * Linux 4.12 refuses to load self-signed modules under Secure Boot with
+    properly enrolled keys (LP: #1712168)
+    - SAUCE: (efi-lockdown) MODSIGN: Fix module signature verification
+
+  * [17.10 FEAT] Enable NVMe driver - kernel (LP: #1708432)
+    - [Config] CONFIG_BLK_DEV_NVME=m for s390
+
+  * Artful: 4.12.0-11.12: Boot panic in vlv2_plat_configure_clock+0x3b/0xa0
+    (LP: #1711298)
+    - [Config] CONFIG_INTEL_ATOMISP=n
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor: af_unix mediation
+
+  * Miscellaneous upstream changes
+    - apparmor: Fix shadowed local variable in unpack_trans_table()
+    - apparmor: Fix logical error in verify_header()
+    - apparmor: Fix an error code in aafs_create()
+    - apparmor: Redundant condition: prev_ns. in [label.c:1498]
+    - apparmor: add the ability to mediate signals
+    - apparmor: add mount mediation
+    - apparmor: cleanup conditional check for label in label_print
+    - apparmor: add support for absolute root view based labels
+    - apparmor: make policy_unpack able to audit different info messages
+    - apparmor: add more debug asserts to apparmorfs
+    - apparmor: add base infastructure for socket mediation
+    - apparmor: move new_null_profile to after profile lookup fns()
+    - apparmor: fix race condition in null profile creation
+    - apparmor: ensure unconfined profiles have dfas initialized
+    - apparmor: fix incorrect type assignment when freeing proxies
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 23 Aug 2017 08:10:38 -0500
+
+linux (4.13.0-5.6) artful; urgency=low
+
+  * Ubuntu17.10 - perf: Update Power9 PMU event JSON files (LP: #1708630)
+    - perf pmu-events: Support additional POWER8+ PVR in mapfile
+    - perf vendor events: Add POWER9 PMU events
+    - perf vendor events: Add POWER9 PVRs to mapfile
+    - SAUCE: perf vendor events powerpc: remove suffix in mapfile
+    - SAUCE: perf vendor events powerpc: Update POWER9 events
+
+  * Disable CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE (LP: #1709171)
+    - [Config] CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=n for ppc64el
+
+  * Please only recommend or suggest initramfs-tools | linux-initramfs-tool for
+    kernels able to boot without initramfs (LP: #1700972)
+    - [Debian] Don't depend on initramfs-tools
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - SAUCE: aufs -- Add missing argument to loop_switch() call
+    - [Config] Enable aufs
+    - SAUCE: (noup) Update spl to 0.6.5.11-ubuntu1, zfs to 0.6.5.11-1ubuntu3
+    - Enable zfs build
+    - SAUCE: powerpc: Always initialize input array when calling epapr_hypercall()
+    - [Packaging] switch up to debhelper 9
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 15 Aug 2017 09:24:16 -0500
+
+linux (4.13.0-4.5) artful; urgency=low
+
+  * Lenovo Yoga 910 Sensors (LP: #1708120)
+    - SAUCE: (no-up) HID: Add quirk for Lenovo Yoga 910 with ITE Chips
+
+  * Unable to install Ubuntu on the NVMe disk under VMD PCI domain
+    (LP: #1703339)
+    - [Config] Add vmd driver to generic inclusion list
+
+  * Set CONFIG_SATA_HIGHBANK=y on armhf (LP: #1703430)
+    - [Config] CONFIG_SATA_HIGHBANK=y
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu: vbox -- update to 5.1.26-dfsg-1
+    - SAUCE: hio: Build fixes for 4.13
+    - Enable hio build
+    - SAUCE: (noup) Update spl to 0.6.5.11-1, zfs to 0.6.5.11-1ubuntu1
+    - [debian] use all rather than amd64 dkms debs for sync
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 08 Aug 2017 11:31:48 -0500
+
+linux (4.13.0-3.4) artful; urgency=low
+
+  * Adt tests of src:linux time out often on armhf lxc containers (LP: #1705495)
+    - [Packaging] tests -- reduce rebuild test to one flavour
+    - [Packaging] tests -- reduce rebuild test to one flavour -- use filter
+
+  * snapd 2.26.8+17.10 ADT test failure with linux 4.12.0-6.7 (LP: #1704158)
+    - SAUCE: virtio_net: Revert mergeable buffer handling rework
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 31 Jul 2017 10:08:16 -0500
+
+linux (4.13.0-2.3) artful; urgency=low
+
+  * Change CONFIG_IBMVETH to module (LP: #1704479)
+    - [Config] CONFIG_IBMVETH=m
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 24 Jul 2017 13:58:08 -0500
+
+linux (4.13.0-1.2) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Support sphinx-based kernel documentation
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 20 Jul 2017 09:18:33 -0500
+
+linux (4.13.0-0.1) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - Disable hio
+    - Disable zfs build
+    - ubuntu: vbox -- update to 5.1.24-dfsg-1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 19 Jul 2017 15:09:31 -0500
+
+linux (4.12.0-7.8) artful; urgency=low
+
+  * ThunderX: soft lockup on 4.8+ kernels when running qemu-efi with vhost=on
+    (LP: #1673564)
+    - arm64: Add a facility to turn an ESR syndrome into a sysreg encoding
+    - KVM: arm/arm64: vgic-v3: Add accessors for the ICH_APxRn_EL2 registers
+    - KVM: arm64: Make kvm_condition_valid32() accessible from EL2
+    - KVM: arm64: vgic-v3: Add hook to handle guest GICv3 sysreg accesses at EL2
+    - KVM: arm64: vgic-v3: Add ICV_BPR1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_IGRPEN1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_IAR1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_EOIR1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_AP1Rn_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_HPPIR1_EL1 handler
+    - KVM: arm64: vgic-v3: Enable trapping of Group-1 system registers
+    - KVM: arm64: Enable GICv3 Group-1 sysreg trapping via command-line
+    - KVM: arm64: vgic-v3: Add ICV_BPR0_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_IGNREN0_EL1 handler
+    - KVM: arm64: vgic-v3: Add misc Group-0 handlers
+    - KVM: arm64: vgic-v3: Enable trapping of Group-0 system registers
+    - KVM: arm64: Enable GICv3 Group-0 sysreg trapping via command-line
+    - arm64: Add MIDR values for Cavium cn83XX SoCs
+    - arm64: Add workaround for Cavium Thunder erratum 30115
+    - KVM: arm64: vgic-v3: Add ICV_DIR_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_RPR_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_CTLR_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_PMR_EL1 handler
+    - KVM: arm64: Enable GICv3 common sysreg trapping via command-line
+    - KVM: arm64: vgic-v3: Log which GICv3 system registers are trapped
+    - KVM: arm64: Log an error if trapping a read-from-write-only GICv3 access
+    - KVM: arm64: Log an error if trapping a write-to-read-only GICv3 access
+
+  * hns: under heavy load, NIC may fail and require reboot (LP: #1704146)
+    - net: hns: Bugfix for Tx timeout handling in hns driver
+
+  * New ACPI identifiers for ThunderX SMMU (LP: #1703437)
+    - iommu/arm-smmu: Plumb in new ACPI identifiers
+
+  * Transparent hugepages should default to enabled=madvise (LP: #1703742)
+    - SAUCE: use CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y as default
+
+  * Artful update to v4.12.1 stable release (LP: #1703858)
+    - driver core: platform: fix race condition with driver_override
+    - RDMA/uverbs: Check port number supplied by user verbs cmds
+    - usb: dwc3: replace %p with %pK
+    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
+    - usb: usbip: set buffer pointers to NULL after free
+    - Add USB quirk for HVR-950q to avoid intermittent device resets
+    - usb: Fix typo in the definition of Endpoint[out]Request
+    - USB: core: fix device node leak
+    - USB: serial: option: add two Longcheer device ids
+    - USB: serial: qcserial: new Sierra Wireless EM7305 device ID
+    - xhci: Limit USB2 port wake support for AMD Promontory hosts
+    - gfs2: Fix glock rhashtable rcu bug
+    - Add "shutdown" to "struct class".
+    - tpm: Issue a TPM2_Shutdown for TPM2 devices.
+    - tpm: fix a kernel memory leak in tpm-sysfs.c
+    - powerpc/powernv: Fix CPU_HOTPLUG=n idle.c compile error
+    - x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
+    - sched/fair, cpumask: Export for_each_cpu_wrap()
+    - sched/core: Implement new approach to scale select_idle_cpu()
+    - sched/numa: Use down_read_trylock() for the mmap_sem
+    - sched/numa: Override part of migrate_degrades_locality() when idle balancing
+    - sched/fair: Simplify wake_affine() for the single socket case
+    - sched/numa: Implement NUMA node level wake_affine()
+    - sched/fair: Remove effective_load()
+    - sched/numa: Hide numa_wake_affine() from UP build
+    - xen: avoid deadlock in xenbus driver
+    - crypto: drbg - Fixes panic in wait_for_completion call
+    - Linux 4.12.1
+
+  * cxlflash update request in the Xenial SRU stream (LP: #1702521)
+    - scsi: cxlflash: Combine the send queue locks
+    - scsi: cxlflash: Update cxlflash_afu_sync() to return errno
+    - scsi: cxlflash: Reset hardware queue context via specified register
+    - scsi: cxlflash: Schedule asynchronous reset of the host
+    - scsi: cxlflash: Handle AFU sync failures
+    - scsi: cxlflash: Track pending scsi commands in each hardware queue
+    - scsi: cxlflash: Flush pending commands in cleanup path
+    - scsi: cxlflash: Add scsi command abort handler
+    - scsi: cxlflash: Create character device to provide host management interface
+    - scsi: cxlflash: Separate AFU internal command handling from AFU sync
+      specifics
+    - scsi: cxlflash: Introduce host ioctl support
+    - scsi: cxlflash: Refactor AFU capability checking
+    - scsi: cxlflash: Support LUN provisioning
+    - scsi: cxlflash: Support AFU debug
+    - scsi: cxlflash: Support WS16 unmap
+    - scsi: cxlflash: Remove zeroing of private command data
+    - scsi: cxlflash: Update TMF command processing
+    - scsi: cxlflash: Avoid double free of character device
+    - scsi: cxlflash: Update send_tmf() parameters
+    - scsi: cxlflash: Update debug prints in reset handlers
+
+  * make snap-pkg support (LP: #1700747)
+    - make snap-pkg support
+
+  * Quirk for non-compliant PCI bridge on HiSilicon D05 board (LP: #1698706)
+    - SAUCE: PCI: Support hibmc VGA cards behind a misbehaving HiSilicon bridge
+
+  * arm64: fix crash reading /proc/kcore (LP: #1702749)
+    - fs/proc: kcore: use kcore_list type to check for vmalloc/module address
+    - arm64: mm: select CONFIG_ARCH_PROC_KCORE_TEXT
+
+  * Opal and POWER9 DD2 (LP: #1702159)
+    - SAUCE: powerpc/powernv: Tell OPAL about our MMU mode on POWER9
+
+  * Data corruption with hio driver  (LP: #1701316)
+    - SAUCE: hio: Fix incorrect use of enum req_opf values
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.6.5.10-1, zfs to 0.6.5.10-1ubuntu2
+    - snapcraft.yaml: Sync with xenial
+    - [Config] CONFIG_CAVIUM_ERRATUM_30115=y
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and
+      MokSBState"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 14 Jul 2017 15:25:41 -0500
+
+linux (4.12.0-6.7) artful; urgency=low
+
+  * update ENA driver to 1.2.0k from net-next (LP: #1701575)
+    - net: ena: change return value for unsupported features unsupported return
+      value
+    - net: ena: add hardware hints capability to the driver
+    - net: ena: change sizeof() argument to be the type pointer
+    - net: ena: add reset reason for each device FLR
+    - net: ena: add support for out of order rx buffers refill
+    - net: ena: allow the driver to work with small number of msix vectors
+    - net: ena: use napi_schedule_irqoff when possible
+    - net: ena: separate skb allocation to dedicated function
+    - net: ena: use lower_32_bits()/upper_32_bits() to split dma address
+    - net: ena: update driver's rx drop statistics
+    - net: ena: update ena driver to version 1.2.0
+
+  * APST gets enabled against explicit kernel option (LP: #1699004)
+    - nvme: explicitly disable APST on quirked devices
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: hio: Update to Huawei ES3000_V2 (2.1.0.40)
+    - SAUCE: hio updates for 4.12
+    - SAUCE: Enable hio build
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 05 Jul 2017 14:23:20 -0500
+
+linux (4.12.0-5.6) artful; urgency=low
+
+  * ERAT invalidate on context switch removal (LP: #1700819)
+    - powerpc: Only do ERAT invalidate on radix context switch on P9 DD1
+
+  * powerpc: Invalidate ERAT on powersave wakeup for POWER9 (LP: #1700521)
+    - SAUCE: powerpc: Invalidate ERAT on powersave wakeup for POWER9
+
+  * Miscellaneous Ubuntu changes
+    - d-i: Move qcom-emac from arm64 to shared nic-modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 03 Jul 2017 07:52:02 -0500
+
+linux (4.12.0-4.5) artful; urgency=low
+
+  * aacraid driver may return uninitialized stack data to userspace
+    (LP: #1700077)
+    - SAUCE: scsi: aacraid: Don't copy uninitialized stack memory to userspace
+
+  * KILLER1435-S[0489:e0a2] BT cannot search BT 4.0 device (LP: #1699651)
+    - Bluetooth: btusb: Add support for 0489:e0a2 QCA_ROME device
+
+  * AACRAID for power9 platform (LP: #1689980)
+    - scsi: aacraid: Remove __GFP_DMA for raw srb memory
+    - scsi: aacraid: Fix DMAR issues with iommu=pt
+    - scsi: aacraid: Added 32 and 64 queue depth for arc natives
+    - scsi: aacraid: Set correct Queue Depth for HBA1000 RAW disks
+    - scsi: aacraid: Remove reset support from check_health
+    - scsi: aacraid: Change wait time for fib completion
+    - scsi: aacraid: Log count info of scsi cmds before reset
+    - scsi: aacraid: Print ctrl status before eh reset
+    - scsi: aacraid: Using single reset mask for IOP reset
+    - scsi: aacraid: Rework IOP reset
+    - scsi: aacraid: Add periodic checks to see IOP reset status
+    - scsi: aacraid: Rework SOFT reset code
+    - scsi: aacraid: Rework aac_src_restart
+    - scsi: aacraid: Use correct function to get ctrl health
+    - scsi: aacraid: Make sure ioctl returns on controller reset
+    - scsi: aacraid: Enable ctrl reset for both hba and arc
+    - scsi: aacraid: Add reset debugging statements
+    - scsi: aacraid: Remove reference to Series-9
+    - scsi: aacraid: Update driver version to 50834
+
+  * hibmc driver does not include "pci:" prefix in bus ID (LP: #1698700)
+    - SAUCE: drm: hibmc: Use set_busid function from drm core
+
+  * HiSilicon D05: installer doesn't appear on VGA (LP: #1698954)
+    - d-i: Add hibmc-drm to kernel-image udeb
+
+  * Fix /proc/cpuinfo revision for POWER9 DD2 (LP: #1698844)
+    - SAUCE: powerpc: Fix /proc/cpuinfo revision for POWER9 DD2
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_SATA_MV=n and CONFIG_GENERIC_PHY=n for s390x
+    - [Config] CONFIG_ATA=n for s390x
+    - [Config] Update annotations for 4.12
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Jun 2017 11:27:29 -0500
+
+linux (4.12.0-3.4) artful; urgency=low
+
+  * Miscellaneous upstream changes
+    - ufs: fix the logics for tail relocation
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 19 Jun 2017 14:50:39 -0500
+
+linux (4.12.0-2.3) artful; urgency=low
+
+  * CVE-2014-9900
+    - SAUCE: (no-up) net: Zeroing the structure ethtool_wolinfo in
+      ethtool_get_wol()
+
+  * System doesn't boot properly on Gigabyte AM4 motherboards (AMD Ryzen)
+    (LP: #1671360)
+    - pinctrl/amd: Use regular interrupt instead of chained
+
+  * extend-diff-ignore should use exact matches (LP: #1693504)
+    - [Packaging] exact extend-diff-ignore matches
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: efi: Don't print secure boot state from the efi stub
+    - ubuntu: vbox -- Update to 5.1.22-dfsg-1
+    - SAUCE: vbox fixes for 4.12
+    - Re-enable virtualbox build
+    - [Config] CONFIG_ORANGEFS_FS=m
+    - SAUCE: (noup) Update spl to 0.6.5.9-1ubuntu2, zfs to 0.6.5.9-5ubuntu7
+    - Enable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc4
+  * Rebase to v4.12-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 11 Jun 2017 22:25:13 -0500
+
+linux (4.12.0-1.2) artful; urgency=low
+
+  * Enable Matrox driver for Ubuntu 16.04.3 (LP: #1693337)
+    - [Config] Enable CONFIG_DRM_MGAG200 as module
+
+  * Support low-pin-count devices on Hisilicon SoCs (LP: #1677319)
+    - [Config] CONFIG_LIBIO=y on arm64 only
+    - SAUCE: LIBIO: Introduce a generic PIO mapping method
+    - SAUCE: OF: Add missing I/O range exception for indirect-IO devices
+    - [Config] CONFIG_HISILICON_LPC=y
+    - SAUCE: LPC: Support the device-tree LPC host on Hip06/Hip07
+    - SAUCE: LIBIO: Support the dynamically logical PIO registration of ACPI host
+      I/O
+    - SAUCE: LPC: Add the ACPI LPC support
+    - SAUCE: PCI: Apply the new generic I/O management on PCI IO hosts
+    - SAUCE: PCI: Restore codepath for !CONFIG_LIBIO
+
+  * POWER9: Additional patches for TTY and CPU_IDLE (LP: #1674325)
+    - SAUCE: tty: Fix ldisc crash on reopened tty
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Add build-dep on libnuma-dev to enable 'perf bench numa'
+    - Rebase to v4.12-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 May 2017 20:56:29 -0500
+
+linux (4.12.0-0.1) artful; urgency=low
+
+  * please enable CONFIG_ARM64_LSE_ATOMICS (LP: #1691614)
+    - [Config] CONFIG_ARM64_LSE_ATOMICS=y
+
+  * [Regression] NUMA_BALANCING disabled on arm64 (LP: #1690914)
+    - [Config] CONFIG_NUMA_BALANCING{,_DEFAULT_ENABLED}=y on arm64
+
+  * exec'ing a setuid binary from a threaded program sometimes fails to setuid
+    (LP: #1672819)
+    - SAUCE: exec: ensure file system accounting in check_unsafe_exec is correct
+
+  * Miscellaneous Ubuntu changes
+    - Update find-missing-sauce.sh to compare to artful
+    - Update dropped.txt
+    - SAUCE: (efi-lockdown) efi: Add EFI_SECURE_BOOT bit
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/mem and /dev/kmem when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Add a sysrq option to exit secure boot mode
+    - SAUCE: (efi-lockdown) kexec: Disable at runtime if the kernel is locked down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: Disable at runtime if securelevel has been
+      set
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) asus-wmi: Restrict debugfs interface when the kernel
+      is locked down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Enable cold boot attack mitigation
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) scsi: Lock down the eata driver
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Add secure_boot state and status bit for
+      MokSBState
+    - SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and MokSBState
+    - [Config] Set values for UEFI secure boot lockdown options
+    - Disable virtualbox build
+    - Disable hio build
+    - SAUCE: securityfs: Replace CURRENT_TIME with current_time()
+    - Disable zfs build
+    - [Debian] Work out upstream tag for use with gen-auto-reconstruct
+    - SAUCE: Import aufs driver
+    - SAUCE: aufs -- Include linux/mm.h in fs/aufs/file.h
+    - [Config] Enable aufs
+    - SAUCE: perf callchain: Include errno.h on x86 unconditinally
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 21 May 2017 23:44:44 -0500
+
+linux (4.11.0-3.8) artful; urgency=low
+
+  [ Seth Forshee ]
+
+  * Release Tracking Bug
+    - LP: #1690999
+
+  * apparmor_parser hangs indefinitely when called by multiple threads
+    (LP: #1645037)
+    - SAUCE: apparmor: fix lock ordering for mkdir
+
+  * apparmor leaking securityfs pin count (LP: #1660846)
+    - SAUCE: apparmor: fix leak on securityfs pin count
+
+  * apparmor reference count leak when securityfs_setup_d_inode\ () fails
+    (LP: #1660845)
+    - SAUCE: apparmor: fix reference count leak when securityfs_setup_d_inode()
+      fails
+
+  * apparmor not checking error if security_pin_fs() fails (LP: #1660842)
+    - SAUCE: apparmor: fix not handling error case when securityfs_pin_fs() fails
+
+  * libvirt profile is blocking global setrlimit despite having no rlimit rule
+    (LP: #1679704)
+    - SAUCE: apparmor: fix complain mode failure for rlimit mediation
+    - apparmor: update auditing of rlimit check to provide capability information
+
+  * apparmor: does not provide a way to detect policy updataes (LP: #1678032)
+    - SAUCE: apparmor: add policy revision file interface
+
+  * apparmor does not make support of query data visible (LP: #1678023)
+    - SAUCE: apparmor: add label data availability to the feature set
+
+  * apparmor query interface does not make supported query info available
+    (LP: #1678030)
+    - SAUCE: apparmor: add information about the query inteface to the feature set
+
+  * change_profile incorrect when using namespaces with a compound stack
+    (LP: #1677959)
+    - SAUCE: apparmor: fix label parse for stacked labels
+
+  * Regression in 4.4.0-65-generic causes very frequent system crashes
+    (LP: #1669611)
+    - apparmor: sync of apparmor 3.6+ (17.04)
+
+  * Artful update to 4.11.1 stable release (LP: #1690814)
+    - dm ioctl: prevent stack leak in dm ioctl call
+    - drm/sti: fix GDP size to support up to UHD resolution
+    - power: supply: lp8788: prevent out of bounds array access
+    - brcmfmac: Ensure pointer correctly set if skb data location changes
+    - brcmfmac: Make skb header writable before use
+    - sparc64: fix fault handling in NGbzero.S and GENbzero.S
+    - refcount: change EXPORT_SYMBOL markings
+    - net: macb: fix phy interrupt parsing
+    - tcp: fix access to sk->sk_state in tcp_poll()
+    - geneve: fix incorrect setting of UDP checksum flag
+    - bpf: enhance verifier to understand stack pointer arithmetic
+    - bpf, arm64: fix jit branch offset related to ldimm64
+    - tcp: fix wraparound issue in tcp_lp
+    - net: ipv6: Do not duplicate DAD on link up
+    - net: usb: qmi_wwan: add Telit ME910 support
+    - tcp: do not inherit fastopen_req from parent
+    - ipv4, ipv6: ensure raw socket message is big enough to hold an IP header
+    - rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
+    - ipv6: initialize route null entry in addrconf_init()
+    - ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
+    - tcp: randomize timestamps on syncookies
+    - bnxt_en: allocate enough space for ->ntp_fltr_bmap
+    - bpf: don't let ldimm64 leak map addresses on unprivileged
+    - net: mdio-mux: bcm-iproc: call mdiobus_free() in error path
+    - f2fs: sanity check segment count
+    - xen/arm,arm64: fix xen_dma_ops after 815dd18 "Consolidate get_dma_ops..."
+    - xen: Revert commits da72ff5bfcb0 and 72a9b186292d
+    - block: get rid of blk_integrity_revalidate()
+    - Linux 4.11.1
+
+  * Module signing exclusion for staging drivers does not work properly
+    (LP: #1690908)
+    - SAUCE: Fix module signing exclusion in package builds
+
+  * perf: qcom: Add L3 cache PMU driver (LP: #1689856)
+    - [Config] CONFIG_QCOM_L3_PMU=y
+    - perf: qcom: Add L3 cache PMU driver
+
+  * No PMU support for ACPI-based arm64 systems (LP: #1689661)
+    - drivers/perf: arm_pmu: rework per-cpu allocation
+    - drivers/perf: arm_pmu: manage interrupts per-cpu
+    - drivers/perf: arm_pmu: split irq request from enable
+    - drivers/perf: arm_pmu: remove pointless PMU disabling
+    - drivers/perf: arm_pmu: define armpmu_init_fn
+    - drivers/perf: arm_pmu: fold init into alloc
+    - drivers/perf: arm_pmu: factor out pmu registration
+    - drivers/perf: arm_pmu: simplify cpu_pmu_request_irqs()
+    - drivers/perf: arm_pmu: handle no platform_device
+    - drivers/perf: arm_pmu: rename irq request/free functions
+    - drivers/perf: arm_pmu: split cpu-local irq request/free
+    - drivers/perf: arm_pmu: move irq request/free into probe
+    - drivers/perf: arm_pmu: split out platform device probe logic
+    - arm64: add function to get a cpu's MADT GICC table
+    - [Config] CONFIG_ARM_PMU_ACPI=y
+    - drivers/perf: arm_pmu: add ACPI framework
+    - arm64: pmuv3: handle !PMUv3 when probing
+    - arm64: pmuv3: use arm_pmu ACPI framework
+
+  * Fix NVLINK2 TCE route (LP: #1690155)
+    - powerpc/powernv: Fix TCE kill on NVLink2
+
+  * CVE-2017-0605
+    - tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline()
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Restore powerpc arch to annotations file
+    - [Config] Disable runtime testing modules
+    - [Config] Disable drivers not needed on s390x
+    - [Config] Update annotations for 4.11
+    - [Config] updateconfigs after apparmor updates
+
+  * Miscellaneous upstream changes
+    - apparmor: use SHASH_DESC_ON_STACK
+    - apparmor: fix invalid reference to index variable of iterator line 836
+    - apparmor: fix parameters so that the permission test is bypassed at boot
+    - apparmor: Make path_max parameter readonly
+    - apparmorfs: Combine two function calls into one in aa_fs_seq_raw_abi_show()
+    - apparmorfs: Use seq_putc() in two functions
+    - apparmor: provide information about path buffer size at boot
+    - apparmor: add/use fns to print hash string hex value
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 16 May 2017 00:39:13 -0500
+
+linux (4.11.0-2.7) artful; urgency=low
+
+  * kernel-wedge fails in artful due to leftover squashfs-modules d-i files
+    (LP: #1688259)
+    - Remove squashfs-modules files from d-i
+    - [Config] as squashfs-modules is builtin kernel-image must Provides: it
+
+  * [Zesty] d-i: replace msm_emac with qcom_emac (LP: #1677297)
+    - Revert "UBUNTU: d-i: initrd needs msm_emac on amberwing platform."
+    - d-i: initrd needs qcom_emac on amberwing platform.
+
+  * update for V3 kernel bits and improved multiple fan slice support
+    (LP: #1470091)
+    - SAUCE: fan: tunnel multiple mapping mode (v3)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.6.5.9-1ubuntu1, zfs to 0.6.5.9-5ubuntu5
+    - Enable zfs
+    - SAUCE: fan: add VXLAN implementation
+    - SAUCE: (efi-lockdown) efi: Add EFI_SECURE_BOOT bit
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/mem and /dev/kmem when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Add a sysrq option to exit secure boot mode
+    - SAUCE: (efi-lockdown) kexec: Disable at runtime if the kernel is locked down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: Disable at runtime if securelevel has been
+      set
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) asus-wmi: Restrict debugfs interface when the kernel
+      is locked down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Enable cold boot attack mitigation
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) scsi: Lock down the eata driver
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Add EFI signature data types
+    - SAUCE: (efi-lockdown) Add an EFI signature blob parser and key loader.
+    - SAUCE: (efi-lockdown) KEYS: Add a system blacklist keyring
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Support not importing certs from db
+    - SAUCE: (efi-lockdown) MODSIGN: Don't try secure boot if EFI runtime is
+      disabled
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Add secure_boot state and status bit for
+      MokSBState
+    - SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and MokSBState
+    - [Config] Set values for UEFI secure boot lockdown options
+    - Update dropped.txt
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 05 May 2017 07:43:14 -0500
+
+linux (4.11.0-1.6) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Use default compression for all packages
+    - SAUCE: (namespace) block_dev: Support checking inode permissions in
+      lookup_bdev()
+    - SAUCE: (namespace) block_dev: Check permissions towards block device inode
+      when mounting
+    - SAUCE: (namespace) mtd: Check permissions towards mtd block device inode
+      when mounting
+    - SAUCE: (namespace) fs: Allow superblock owner to change ownership of inodes
+    - SAUCE: (namespace) fs: Don't remove suid for CAP_FSETID for userns root
+    - SAUCE: (namespace) fs: Allow superblock owner to access do_remount_sb()
+    - SAUCE: (namespace) capabilities: Allow privileged user in s_user_ns to set
+      security.* xattrs
+    - SAUCE: (namespace) fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw
+      filesystems
+    - SAUCE: (namespace) fuse: Add support for pid namespaces
+    - SAUCE: (namespace) fuse: Support fuse filesystems outside of init_user_ns
+    - SAUCE: (namespace) fuse: Restrict allow_other to the superblock's namespace
+      or a descendant
+    - SAUCE: (namespace) fuse: Allow user namespace mounts
+    - SAUCE: (namespace) ext4: Add support for unprivileged mounts from user
+      namespaces
+    - SAUCE: (namespace) evm: Don't update hmacs in user ns mounts
+    - SAUCE: (namespace) ext4: Add module parameter to enable user namespace
+      mounts
+    - SAUCE: (namespace) block_dev: Forbid unprivileged mounting when device is
+      opened for writing
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 26 Apr 2017 10:08:29 -0500
+
+linux (4.11.0-0.5) artful; urgency=low
+
+  * [Hyper-V][SAUCE] pci-hyperv: Use only 16 bit integer for PCI domain
+    (LP: #1684971)
+    - SAUCE: pci-hyperv: Use only 16 bit integer for PCI domain
+
+  * [Hyper-V] Ubuntu 14.04.2 LTS Generation 2 SCSI Errors on VSS Based Backups
+    (LP: #1470250)
+    - SAUCE: Tools: hv: vss: Thaw the filesystem and continue after freeze fails
+
+  * Enable virtual scsi server driver for Power (LP: #1615665)
+    - SAUCE: Return TCMU-generated sense data to fabric module
+
+  * include/linux/security.h header syntax error with !CONFIG_SECURITYFS
+    (LP: #1630990)
+    - SAUCE: (no-up) include/linux/security.h -- fix syntax error with
+      CONFIG_SECURITYFS=n
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - [Config] Enable aufs
+    - [Debian] Add script to update virtualbox
+    - ubuntu: vbox -- Update to 5.1.20-dfsg-2
+    - Enable vbox
+    - SAUCE: aufs -- Include linux/mm.h in fs/aufs/file.h
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 25 Apr 2017 13:42:54 -0500
+
+linux (4.11.0-0.4) zesty; urgency=low
+
+  * POWER9: Improve performance on memory management (LP: #1681429)
+    - SAUCE: powerpc/mm/radix: Don't do page walk cache flush when doing full mm
+      flush
+    - SAUCE: powerpc/mm/radix: Remove unnecessary ptesync
+
+  * Miscellaneous Ubuntu changes
+    - find-missing-sauce.sh
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 18 Apr 2017 08:19:43 -0500
+
+linux (4.11.0-0.3) zesty; urgency=low
+
+  * Disable CONFIG_HVC_UDBG on ppc64el (LP: #1680888)
+    - [Config] Disable CONFIG_HVC_UDBG on ppc64el
+
+  * smartpqi driver needed in initram disk and installer (LP: #1680156)
+    - [Config] Add smartpqi to d-i
+
+  * Disable CONFIG_SECURITY_SELINUX_DISABLE (LP: #1680315)
+    - [Config] CONFIG_SECURITY_SELINUX_DISABLE=n
+
+  * Miscellaneous Ubuntu changes
+    - [Config] flash-kernel should be a Breaks
+    - [Config] drop the info directory
+    - [Config] drop NOTES as obsolete
+    - [Config] drop changelog.historical as obsolete
+    - rebase to v4.11-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc6
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Tue, 11 Apr 2017 07:16:52 -0600
+
+linux (4.11.0-0.2) zesty; urgency=low
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc5
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 03 Apr 2017 08:26:07 +0100
+
+linux (4.11.0-0.1) zesty; urgency=low
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc4
+    - LP: #1591053
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 20 Mar 2017 05:15:32 -0600
+
+linux (4.11.0-0.0) zesty; urgency=low
+
+  * dummy entry
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 20 Mar 2017 05:15:32 -0600
--- linux-qcom-6.8.0.orig/debian.qcom/config/README.rst
+++ linux-qcom-6.8.0/debian.qcom/config/README.rst
@@ -0,0 +1,185 @@
+==================
+Config Annotations
+==================
+
+:Author: Andrea Righi
+
+Overview
+========
+
+Each Ubuntu kernel needs to maintain its own .config for each supported
+architecture and each flavour.
+
+Every time a new patch is applied or a kernel is rebased on top of a new
+one, we need to update the .config's accordingly (config options can be
+added, removed and also renamed).
+
+So, we need to make sure that some critical config options are always
+matching the desired value in order to have a functional kernel.
+
+State of the art
+================
+
+At the moment configs are maintained as a set of Kconfig chunks (inside
+`debian.<kernel>/config/`): a global one, plus per-arch / per-flavour
+chunks.
+
+In addition to that, we need to maintain also a file called
+'annotations'; the purpose of this file is to make sure that some
+critical config options are not silently removed or changed when the
+real .config is re-generated (for example after a rebase or after
+applying a new set of patches).
+
+The main problem with this approach is that, often, we have duplicate
+information that is stored both in the Kconfig chunks *and* in the
+annotations files and, at the same time, the whole .config's information
+is distributed between Kconfig chunks and annotations, making it hard to
+maintain, review and manage in general.
+
+Proposed solution
+=================
+
+The proposed solution is to store all the config information into the
+"annotations" format and get rid of the config chunks (basically the
+real .config's can be produced "compiling" annotations).
+
+Implementation
+==============
+
+To help the management of the annotations an helper script is provided
+(`debian/scripts/misc/annotations`):
+
+```
+usage: annotations [-h] [--version] [--file FILE] [--arch ARCH] [--flavour FLAVOUR] [--config CONFIG]
+                   (--query | --export | --import FILE | --update FILE | --check FILE)
+
+Manage Ubuntu kernel .config and annotations
+
+options:
+  -h, --help            show this help message and exit
+  --version, -v         show program's version number and exit
+  --file FILE, -f FILE  Pass annotations or .config file to be parsed
+  --arch ARCH, -a ARCH  Select architecture
+  --flavour FLAVOUR, -l FLAVOUR
+                        Select flavour (default is "generic")
+  --config CONFIG, -c CONFIG
+                        Select a specific config option
+
+Action:
+  --query, -q           Query annotations
+  --export, -e          Convert annotations to .config format
+  --import FILE, -i FILE
+                        Import a full .config for a specific arch and flavour into annotations
+  --update FILE, -u FILE
+                        Import a partial .config into annotations (only resync configs specified in FILE)
+  --check FILE, -k FILE
+                        Validate kernel .config with annotations
+```
+
+This script allows to query config settings (per arch/flavour/config),
+export them into the Kconfig format (generating the real .config files)
+and check if the final .config matches the rules defined in the
+annotations.
+
+Examples (annotations is defined as an alias to `debian/scripts/annotations`):
+
+ - Show settings for `CONFIG_DEBUG_INFO_BTF` for master kernel across all the
+   supported architectures and flavours:
+
+```
+$ annotations --query --config CONFIG_DEBUG_INFO_BTF
+{
+    "policy": {
+        "amd64": "y",
+        "arm64": "y",
+        "armhf": "n",
+        "ppc64el": "y",
+        "riscv64": "y",
+        "s390x": "y"
+    },
+    "note": "'Needs newer pahole for armhf'"
+}
+```
+
+ - Dump kernel .config for arm64 and flavour generic-64k:
+
+```
+$ annotations --arch arm64 --flavour generic-64k --export
+CONFIG_DEBUG_FS=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_COMPAT=y
+...
+```
+
+ - Update annotations file with a new kernel .config for amd64 flavour
+   generic:
+
+```
+$ annotations --arch amd64 --flavour generic --import build/.config
+```
+
+Moreover, an additional kernelconfig commands are provided
+(via debian/rules targets):
+ - `migrateconfigs`: automatically merge all the previous configs into
+   annotations (local changes still need to be committed)
+
+Annotations headers
+===================
+
+The main annotations file should contain a header to define the architectures
+and flavours that are supported.
+
+Here is the format of the header for the generic kernel:
+```
+# Menu: HEADER
+# FORMAT: 4
+# ARCH: amd64 arm64 armhf ppc64el riscv64 s390x
+# FLAVOUR: amd64-generic arm64-generic arm64-generic-64k armhf-generic armhf-generic-lpae ppc64el-generic riscv64-generic s390x-generic
+
+```
+
+Example header of a derivative (linux-aws):
+```
+# Menu: HEADER
+# FORMAT: 4
+# ARCH: amd64 arm64
+# FLAVOUR: amd64-aws arm64-aws
+# FLAVOUR_DEP: {'amd64-aws': 'amd64-generic', 'arm64-aws': 'arm64-generic'}
+
+include "../../debian.master/config/annotations"
+
+# Below you can define only the specific linux-aws configs that differ from linux generic
+
+```
+
+Pros and Cons
+=============
+
+ Pros:
+  - avoid duplicate information in .config's and annotations
+  - allow to easily define groups of config settings (for a specific
+    environment or feature, such as annotations.clouds, annotations.ubuntu,
+    annotations.snapd, etc.)
+  - config options are more accessible, easy to change and review
+  - we can easily document how config options are managed (and external
+    contributors won't be discouraged anymore when they need to to change a
+    config option)
+
+ Cons:
+  - potential regressions: the new tool/scripts can have potential bugs,
+    so we could experience regressions due to some missed config changes
+  - kernel team need to understand the new process (even if everything
+    is transparent, kernel cranking process is the same, there might be
+    corner cases that need to be addressed and resolved manually)
+
+TODO
+====
+
+ - Migrate all flavour and arch definitions into annotations (rather
+   than having this information defined in multiple places inside
+   debian/scripts); right now this information is "partially" migrated,
+   meaning that we need to define arches and flavours in the headers
+   section of annotations (so that the annotations tool can figure out
+   the list of supported arches and flavours), but arches and flavours
+   are still defined elsewhere, ideally we would like to have arches and
+   flavours defined only in one place: annotations.
--- linux-qcom-6.8.0.orig/debian.qcom/config/annotations
+++ linux-qcom-6.8.0/debian.qcom/config/annotations
@@ -0,0 +1,2030 @@
+# Menu: HEADER
+# FORMAT: 4
+# ARCH: arm64
+# FLAVOUR: arm64-qcom
+# FLAVOUR_DEP: {'arm64-qcom': 'arm64-generic'}
+
+include "../../debian.master/config/annotations"
+
+CONFIG_ARCH_MMAP_RND_BITS                       policy<{'arm64': '18'}>
+CONFIG_ARCH_MMAP_RND_BITS                       note<'LP: #1983357'>
+
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS                policy<{'arm64': '11'}>
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS                note<'LP: #1983357'>
+
+CONFIG_ARCH_ROCKCHIP                            policy<{'arm64': 'n'}>
+CONFIG_ARCH_ROCKCHIP                            note<'LP: #1825222'>
+
+CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT       policy<{'arm64': 'y'}>
+CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT       note<'LP: #2102032'>
+
+CONFIG_DEFAULT_MMAP_MIN_ADDR                    policy<{'arm64': '4096'}>
+CONFIG_DEFAULT_MMAP_MIN_ADDR                    note<'LP: #1531327'>
+
+CONFIG_DRM_AMDGPU_CIK                           policy<{'arm64': '-'}>
+CONFIG_DRM_AMDGPU_CIK                           note<'for zesty'>
+
+CONFIG_EFI_ZBOOT                                policy<{'arm64': 'n'}>
+CONFIG_EFI_ZBOOT                                note<'we use arch/arm64/boot/Image.gz'>
+
+CONFIG_HSA_AMD_P2P                              policy<{'arm64': '-'}>
+CONFIG_HSA_AMD_P2P                              note<'LP: #1987394'>
+
+CONFIG_IPMMU_VMSA                               policy<{'arm64': '-'}>
+CONFIG_IPMMU_VMSA                               note<'LP: #1718734'>
+
+CONFIG_KERNEL_ZSTD                              policy<{'arm64': '-'}>
+CONFIG_KERNEL_ZSTD                              note<'we use arch/arm64/boot/Image.gz'>
+
+CONFIG_MMC_SDHCI                                policy<{'arm64': 'y'}>
+CONFIG_MMC_SDHCI                                note<'installation essential on omap/highbank'>
+
+CONFIG_MMC_SDHCI_PLTFM                          policy<{'arm64': 'y'}>
+CONFIG_MMC_SDHCI_PLTFM                          note<'boot essential on highbank'>
+
+CONFIG_NR_CPUS                                  policy<{'arm64': '256'}>
+CONFIG_NR_CPUS                                  note<'LP: #2042897 (arm64), LP: #1967889 (riscv64), LP: #1864198 (s390x)'>
+
+CONFIG_REGULATOR_FIXED_VOLTAGE                  policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_FIXED_VOLTAGE                  note<'boot essential on arm'>
+
+CONFIG_SERIAL_SH_SCI                            policy<{'arm64': '-'}>
+CONFIG_SERIAL_SH_SCI                            note<'LP: #2022361'>
+
+CONFIG_SERIAL_SH_SCI_CONSOLE                    policy<{'arm64': '-'}>
+CONFIG_SERIAL_SH_SCI_CONSOLE                    note<'LP: #2022361'>
+
+CONFIG_SERIAL_SH_SCI_EARLYCON                   policy<{'arm64': '-'}>
+CONFIG_SERIAL_SH_SCI_EARLYCON                   note<'LP: #2022361'>
+
+CONFIG_SUN6I_RTC_CCU                            policy<{'arm64': '-'}>
+CONFIG_SUN6I_RTC_CCU                            note<'needed by Allwinner D1 pinctrl/gpio'>
+
+CONFIG_SYSFB_SIMPLEFB                           policy<{'arm64': 'n'}>
+CONFIG_SYSFB_SIMPLEFB                           note<'LP: #1965303'>
+
+
+# ---- Annotations without notes ----
+
+CONFIG_AHCI_IMX                                 policy<{'arm64': '-'}>
+CONFIG_AHCI_MTK                                 policy<{'arm64': '-'}>
+CONFIG_AHCI_MVEBU                               policy<{'arm64': '-'}>
+CONFIG_AHCI_QORIQ                               policy<{'arm64': '-'}>
+CONFIG_AHCI_SUNXI                               policy<{'arm64': '-'}>
+CONFIG_AHCI_TEGRA                               policy<{'arm64': '-'}>
+CONFIG_AHCI_XGENE                               policy<{'arm64': '-'}>
+CONFIG_AMLOGIC_THERMAL                          policy<{'arm64': '-'}>
+CONFIG_APPLE_ADMAC                              policy<{'arm64': '-'}>
+CONFIG_APPLE_AIC                                policy<{'arm64': '-'}>
+CONFIG_APPLE_DART                               policy<{'arm64': '-'}>
+CONFIG_APPLE_M1_CPU_PMU                         policy<{'arm64': '-'}>
+CONFIG_APPLE_MAILBOX                            policy<{'arm64': '-'}>
+CONFIG_APPLE_PMGR_PWRSTATE                      policy<{'arm64': '-'}>
+CONFIG_APPLE_RTKIT                              policy<{'arm64': '-'}>
+CONFIG_APPLE_SART                               policy<{'arm64': '-'}>
+CONFIG_APPLE_WATCHDOG                           policy<{'arm64': '-'}>
+CONFIG_ARCH_ACTIONS                             policy<{'arm64': 'n'}>
+CONFIG_ARCH_APPLE                               policy<{'arm64': 'n'}>
+CONFIG_ARCH_BERLIN                              policy<{'arm64': 'n'}>
+CONFIG_ARCH_BITMAIN                             policy<{'arm64': 'n'}>
+CONFIG_ARCH_FORCE_MAX_ORDER                     policy<{'arm64': '10'}>
+CONFIG_ARCH_HAS_RESET_CONTROLLER                policy<{'arm64': '-'}>
+CONFIG_ARCH_HISI                                policy<{'arm64': 'n'}>
+CONFIG_ARCH_INTEL_SOCFPGA                       policy<{'arm64': 'n'}>
+CONFIG_ARCH_K3                                  policy<{'arm64': 'n'}>
+CONFIG_ARCH_KEEMBAY                             policy<{'arm64': 'n'}>
+CONFIG_ARCH_LAYERSCAPE                          policy<{'arm64': '-'}>
+CONFIG_ARCH_LG1K                                policy<{'arm64': 'n'}>
+CONFIG_ARCH_MA35                                policy<{'arm64': 'n'}>
+CONFIG_ARCH_MEDIATEK                            policy<{'arm64': 'n'}>
+CONFIG_ARCH_MESON                               policy<{'arm64': 'n'}>
+CONFIG_ARCH_MVEBU                               policy<{'arm64': 'n'}>
+CONFIG_ARCH_MXC                                 policy<{'arm64': '-'}>
+CONFIG_ARCH_NPCM                                policy<{'arm64': 'n'}>
+CONFIG_ARCH_NXP                                 policy<{'arm64': 'n'}>
+CONFIG_ARCH_PENSANDO                            policy<{'arm64': 'n'}>
+CONFIG_ARCH_R8A774A1                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A774B1                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A774C0                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A774E1                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A77951                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A77960                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A77961                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A77965                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A77970                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A77980                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A77990                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A77995                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A779A0                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A779F0                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R8A779G0                            policy<{'arm64': '-'}>
+CONFIG_ARCH_R9A07G043                           policy<{'arm64': '-'}>
+CONFIG_ARCH_R9A07G044                           policy<{'arm64': '-'}>
+CONFIG_ARCH_R9A07G054                           policy<{'arm64': '-'}>
+CONFIG_ARCH_R9A08G045                           policy<{'arm64': '-'}>
+CONFIG_ARCH_R9A09G011                           policy<{'arm64': '-'}>
+CONFIG_ARCH_RCAR_GEN3                           policy<{'arm64': '-'}>
+CONFIG_ARCH_REALTEK                             policy<{'arm64': 'n'}>
+CONFIG_ARCH_RENESAS                             policy<{'arm64': 'n'}>
+CONFIG_ARCH_RZG2L                               policy<{'arm64': '-'}>
+CONFIG_ARCH_S32                                 policy<{'arm64': '-'}>
+CONFIG_ARCH_SEATTLE                             policy<{'arm64': 'n'}>
+CONFIG_ARCH_SPARX5                              policy<{'arm64': 'n'}>
+CONFIG_ARCH_SPRD                                policy<{'arm64': 'n'}>
+CONFIG_ARCH_STM32                               policy<{'arm64': 'n'}>
+CONFIG_ARCH_SUNXI                               policy<{'arm64': 'n'}>
+CONFIG_ARCH_SYNQUACER                           policy<{'arm64': 'n'}>
+CONFIG_ARCH_TEGRA                               policy<{'arm64': 'n'}>
+CONFIG_ARCH_TEGRA_132_SOC                       policy<{'arm64': '-'}>
+CONFIG_ARCH_TEGRA_186_SOC                       policy<{'arm64': '-'}>
+CONFIG_ARCH_TEGRA_194_SOC                       policy<{'arm64': '-'}>
+CONFIG_ARCH_TEGRA_210_SOC                       policy<{'arm64': '-'}>
+CONFIG_ARCH_TEGRA_234_SOC                       policy<{'arm64': '-'}>
+CONFIG_ARCH_THUNDER                             policy<{'arm64': 'n'}>
+CONFIG_ARCH_THUNDER2                            policy<{'arm64': 'n'}>
+CONFIG_ARCH_VEXPRESS                            policy<{'arm64': 'n'}>
+CONFIG_ARCH_VISCONTI                            policy<{'arm64': 'n'}>
+CONFIG_ARCH_XGENE                               policy<{'arm64': 'n'}>
+CONFIG_ARCH_ZYNQMP                              policy<{'arm64': 'n'}>
+CONFIG_ARC_EMAC_CORE                            policy<{'arm64': '-'}>
+CONFIG_ARMADA_37XX_CLK                          policy<{'arm64': '-'}>
+CONFIG_ARMADA_37XX_RWTM_MBOX                    policy<{'arm64': '-'}>
+CONFIG_ARMADA_37XX_WATCHDOG                     policy<{'arm64': '-'}>
+CONFIG_ARMADA_AP806_SYSCON                      policy<{'arm64': '-'}>
+CONFIG_ARMADA_AP_CPU_CLK                        policy<{'arm64': '-'}>
+CONFIG_ARMADA_AP_CP_HELPER                      policy<{'arm64': '-'}>
+CONFIG_ARMADA_CP110_SYSCON                      policy<{'arm64': '-'}>
+CONFIG_ARMADA_THERMAL                           policy<{'arm64': '-'}>
+CONFIG_ARM_ALLWINNER_SUN50I_CPUFREQ_NVMEM       policy<{'arm64': '-'}>
+CONFIG_ARM_APPLE_SOC_CPUFREQ                    policy<{'arm64': '-'}>
+CONFIG_ARM_ARMADA_37XX_CPUFREQ                  policy<{'arm64': '-'}>
+CONFIG_ARM_ARMADA_8K_CPUFREQ                    policy<{'arm64': '-'}>
+CONFIG_ARM_GIC_PM                               policy<{'arm64': '-'}>
+CONFIG_ARM_GIC_V3_ITS_FSL_MC                    policy<{'arm64': '-'}>
+CONFIG_ARM_IMX6Q_CPUFREQ                        policy<{'arm64': '-'}>
+CONFIG_ARM_IMX8M_DDRC_DEVFREQ                   policy<{'arm64': '-'}>
+CONFIG_ARM_IMX_BUS_DEVFREQ                      policy<{'arm64': '-'}>
+CONFIG_ARM_IMX_CPUFREQ_DT                       policy<{'arm64': '-'}>
+CONFIG_ARM_MEDIATEK_CCI_DEVFREQ                 policy<{'arm64': '-'}>
+CONFIG_ARM_MEDIATEK_CPUFREQ                     policy<{'arm64': '-'}>
+CONFIG_ARM_MEDIATEK_CPUFREQ_HW                  policy<{'arm64': '-'}>
+CONFIG_ARM_MHU                                  policy<{'arm64': 'y'}>
+CONFIG_ARM_QCOM_CPUFREQ_HW                      policy<{'arm64': 'y'}>
+CONFIG_ARM_RK3399_DMC_DEVFREQ                   policy<{'arm64': '-'}>
+CONFIG_ARM_SBSA_WATCHDOG                        policy<{'arm64': 'y'}>
+CONFIG_ARM_SCMI_CPUFREQ                         policy<{'arm64': 'y'}>
+CONFIG_ARM_SCMI_PERF_DOMAIN                     policy<{'arm64': 'y'}>
+CONFIG_ARM_SCMI_POWER_DOMAIN                    policy<{'arm64': 'y'}>
+CONFIG_ARM_SCPI_POWER_DOMAIN                    policy<{'arm64': 'y'}>
+CONFIG_ARM_SCPI_PROTOCOL                        policy<{'arm64': 'y'}>
+CONFIG_ARM_SMC_WATCHDOG                         policy<{'arm64': 'y'}>
+CONFIG_ARM_SMMU_QCOM_TBU                        policy<{'arm64': 'y'}>
+CONFIG_ARM_SP805_WATCHDOG                       policy<{'arm64': 'y'}>
+CONFIG_ARM_SUN8I_A33_MBUS_DEVFREQ               policy<{'arm64': '-'}>
+CONFIG_ARM_TEGRA124_CPUFREQ                     policy<{'arm64': '-'}>
+CONFIG_ARM_TEGRA186_CPUFREQ                     policy<{'arm64': '-'}>
+CONFIG_ARM_TEGRA194_CPUFREQ                     policy<{'arm64': '-'}>
+CONFIG_ARM_TEGRA20_CPUFREQ                      policy<{'arm64': '-'}>
+CONFIG_ARM_TEGRA_DEVFREQ                        policy<{'arm64': '-'}>
+CONFIG_ARM_TI_CPUFREQ                           policy<{'arm64': '-'}>
+CONFIG_ATH11K_COREDUMP                          policy<{'arm64': 'n'}>
+CONFIG_AXI_DMAC                                 policy<{'arm64': '-'}>
+CONFIG_BACKLIGHT_QCOM_WLED                      policy<{'arm64': 'y'}>
+CONFIG_BERLIN2_ADC                              policy<{'arm64': '-'}>
+CONFIG_CAN_BXCAN                                policy<{'arm64': '-'}>
+CONFIG_CAN_RCAR                                 policy<{'arm64': '-'}>
+CONFIG_CAN_RCAR_CANFD                           policy<{'arm64': '-'}>
+CONFIG_CAVIUM_CPT                               policy<{'arm64': '-'}>
+CONFIG_CEC_MESON_AO                             policy<{'arm64': '-'}>
+CONFIG_CEC_MESON_G12A_AO                        policy<{'arm64': '-'}>
+CONFIG_CEC_STM32                                policy<{'arm64': '-'}>
+CONFIG_CEC_TEGRA                                policy<{'arm64': '-'}>
+CONFIG_CHARGER_CPCAP                            policy<{'arm64': '-'}>
+CONFIG_CHARGER_SC2731                           policy<{'arm64': '-'}>
+CONFIG_CLKSRC_STM32_LP                          policy<{'arm64': '-'}>
+CONFIG_CLK_ACTIONS                              policy<{'arm64': '-'}>
+CONFIG_CLK_IMX8MM                               policy<{'arm64': '-'}>
+CONFIG_CLK_IMX8MN                               policy<{'arm64': '-'}>
+CONFIG_CLK_IMX8MP                               policy<{'arm64': '-'}>
+CONFIG_CLK_IMX8MQ                               policy<{'arm64': '-'}>
+CONFIG_CLK_IMX8QXP                              policy<{'arm64': '-'}>
+CONFIG_CLK_IMX8ULP                              policy<{'arm64': '-'}>
+CONFIG_CLK_IMX93                                policy<{'arm64': '-'}>
+CONFIG_CLK_INTEL_SOCFPGA                        policy<{'arm64': '-'}>
+CONFIG_CLK_INTEL_SOCFPGA64                      policy<{'arm64': '-'}>
+CONFIG_CLK_LS1028A_PLLDIG                       policy<{'arm64': '-'}>
+CONFIG_CLK_MA35D1                               policy<{'arm64': '-'}>
+CONFIG_CLK_OWL_S500                             policy<{'arm64': '-'}>
+CONFIG_CLK_OWL_S700                             policy<{'arm64': '-'}>
+CONFIG_CLK_OWL_S900                             policy<{'arm64': '-'}>
+CONFIG_CLK_PX30                                 policy<{'arm64': '-'}>
+CONFIG_CLK_QORIQ                                policy<{'arm64': '-'}>
+CONFIG_CLK_R8A774A1                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A774B1                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A774C0                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A774E1                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A7795                              policy<{'arm64': '-'}>
+CONFIG_CLK_R8A77960                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A77961                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A77965                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A77970                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A77980                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A77990                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A77995                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A779A0                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A779F0                             policy<{'arm64': '-'}>
+CONFIG_CLK_R8A779G0                             policy<{'arm64': '-'}>
+CONFIG_CLK_R9A07G043                            policy<{'arm64': '-'}>
+CONFIG_CLK_R9A07G044                            policy<{'arm64': '-'}>
+CONFIG_CLK_R9A07G054                            policy<{'arm64': '-'}>
+CONFIG_CLK_R9A08G045                            policy<{'arm64': '-'}>
+CONFIG_CLK_R9A09G011                            policy<{'arm64': '-'}>
+CONFIG_CLK_RCAR_CPG_LIB                         policy<{'arm64': '-'}>
+CONFIG_CLK_RCAR_GEN3_CPG                        policy<{'arm64': '-'}>
+CONFIG_CLK_RCAR_GEN4_CPG                        policy<{'arm64': '-'}>
+CONFIG_CLK_RCAR_USB2_CLOCK_SEL                  policy<{'arm64': '-'}>
+CONFIG_CLK_RENESAS                              policy<{'arm64': '-'}>
+CONFIG_CLK_RENESAS_CPG_MSSR                     policy<{'arm64': '-'}>
+CONFIG_CLK_RENESAS_DIV6                         policy<{'arm64': '-'}>
+CONFIG_CLK_RK3308                               policy<{'arm64': '-'}>
+CONFIG_CLK_RK3328                               policy<{'arm64': '-'}>
+CONFIG_CLK_RK3368                               policy<{'arm64': '-'}>
+CONFIG_CLK_RK3399                               policy<{'arm64': '-'}>
+CONFIG_CLK_RK3568                               policy<{'arm64': '-'}>
+CONFIG_CLK_RK3588                               policy<{'arm64': '-'}>
+CONFIG_CLK_RZG2L                                policy<{'arm64': '-'}>
+CONFIG_CLK_TEGRA_BPMP                           policy<{'arm64': '-'}>
+CONFIG_CLK_X1E80100_CAMCC                       policy<{'arm64': 'n'}>
+CONFIG_CLK_X1E80100_DISPCC                      policy<{'arm64': 'n'}>
+CONFIG_CLK_X1E80100_GCC                         policy<{'arm64': 'y'}>
+CONFIG_CLK_X1E80100_GPUCC                       policy<{'arm64': 'n'}>
+CONFIG_COMMON_CLK_A1_PERIPHERALS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_A1_PLL                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_APPLE_NCO                     policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_AXG                           policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_AXG_AUDIO                     policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_BM1880                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_CS2000_CP                     policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_FSL_FLEXSPI                   policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_FSL_SAI                       policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_G12A                          policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_GXBB                          policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_HI3516CV300                   policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_HI3519                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_HI3559A                       policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_HI3660                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_HI3670                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_HI3798CV200                   policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_HI6220                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_HI655X                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MEDIATEK                      policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MEDIATEK_FHCTL                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_AO_CLKC                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_CLKC_UTILS              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_CPU_DYNDIV              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_DUALDIV                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_EE_CLKC                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_MPLL                    policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_PHASE                   policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_PLL                     policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_REGMAP                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_SCLK_DIV                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MESON_VID_PLL_DIV             policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT2712                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT2712_BDPSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT2712_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT2712_JPGDECSYS              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT2712_MFGCFG                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT2712_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT2712_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT2712_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_AUDIOSYS               policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_CAMSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_GCESYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_MFGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_MIPI0ASYS              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_MIPI0BSYS              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_MIPI1ASYS              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_MIPI1BSYS              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_MIPI2ASYS              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_MIPI2BSYS              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6765_VCODECSYS              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6779                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6779_AUDSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6779_CAMSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6779_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6779_IPESYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6779_MFGCFG                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6779_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6779_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6779_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6795                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6795_MFGCFG                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6795_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6795_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6795_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6797                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6797_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6797_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6797_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT6797_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT7622                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT7622_AUDSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT7622_ETHSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT7622_HIFSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT7981                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT7981_ETHSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT7986                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT7986_ETHSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT7988                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8167                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8167_AUDSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8167_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8167_MFGCFG                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8167_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8167_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8173                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8173_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8173_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8173_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8173_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_AUDIOSYS               policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_CAMSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_IPU_ADL                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_IPU_CONN               policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_IPU_CORE0              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_IPU_CORE1              policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_MFGCFG                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8183_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_CAMSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_IMP_IIC_WRAP           policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_IPESYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_MCUSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_MDPSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_MFGCFG                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8186_WPESYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_ADSP_AUDIO26M          policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_CAMSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_IMP_IIC_WRAP           policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_IPESYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_MFGCFG                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_VDOSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_VPPSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8188_WPESYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_AUDSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_CAMSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_IMP_IIC_WRAP           policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_IPESYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_MDPSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_MFGCFG                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_MSDC                   policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_SCP_ADSP               policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8192_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_APUSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_AUDSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_CAMSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_IMGSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_IMP_IIC_WRAP           policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_IPESYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_MFGCFG                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_MSDC                   policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_SCP_ADSP               policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_VDECSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_VDOSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_VENCSYS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_VPPSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8195_WPESYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8365                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8365_APU                    policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8365_CAM                    policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8365_MFG                    policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8365_MMSYS                  policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8365_VDEC                   policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8365_VENC                   policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8516                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_MT8516_AUDSYS                 policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_NUVOTON                       policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_PWM                           policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_QCOM                          policy<{'arm64': 'y'}>
+CONFIG_COMMON_CLK_ROCKCHIP                      policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_S4_PERIPHERALS                policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_S4_PLL                        policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_STM32MP                       policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_VISCONTI                      policy<{'arm64': '-'}>
+CONFIG_COMMON_CLK_ZYNQMP                        policy<{'arm64': '-'}>
+CONFIG_COMMON_RESET_HI3660                      policy<{'arm64': '-'}>
+CONFIG_COMMON_RESET_HI6220                      policy<{'arm64': '-'}>
+CONFIG_CRC7                                     policy<{'arm64': 'y'}>
+CONFIG_CRC_ITU_T                                policy<{'arm64': 'y'}>
+CONFIG_CRYPTO_DEV_ALLWINNER                     policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_CPT                           policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM                      policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API            policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API_DESC       policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_COMMON               policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API           policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC      policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_QI        policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_DEBUG                policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_INTC                 policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_INTC_COUNT_THLD      policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_INTC_TIME_THLD       policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_JR                   policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_PKC_API              policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_PRNG_API             policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_RINGSIZE             policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_API              policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_TEST             policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM                policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_AES_SM4           policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_AES_SM4_CTS       policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_AES_SM4_ECB       policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_ECC               policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_HCU               policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_KEEMBAY_OCS_HCU_HMAC_SHA224   policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_MARVELL                       policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_MARVELL_CESA                  policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_MXS_DCP                       policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_OCTEONTX2_CPT                 policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_OCTEONTX_CPT                  policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_ROCKCHIP                      policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_ROCKCHIP_DEBUG                policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SA2UL                         policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SAHARA                        policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_STM32_CRC                     policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_STM32_CRYP                    policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_STM32_HASH                    policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN4I_SS                      policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN4I_SS_DEBUG                policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN4I_SS_PRNG                 policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE                      policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE_DEBUG                policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE_HASH                 policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG                 policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN8I_CE_TRNG                 policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN8I_SS                      policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN8I_SS_DEBUG                policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN8I_SS_HASH                 policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG                 policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_ZYNQMP_AES                    policy<{'arm64': '-'}>
+CONFIG_CRYPTO_DEV_ZYNQMP_SHA3                   policy<{'arm64': '-'}>
+CONFIG_DEBUG_KERNEL_DC                          policy<{'arm64': '-'}>
+CONFIG_DEVFREQ_EVENT_ROCKCHIP_DFI               policy<{'arm64': '-'}>
+CONFIG_DMA_SUN6I                                policy<{'arm64': '-'}>
+CONFIG_DPAA2_CONSOLE                            policy<{'arm64': '-'}>
+CONFIG_DPAA_ERRATUM_A050385                     policy<{'arm64': '-'}>
+CONFIG_DRM_AMDGPU                               policy<{'arm64': 'n'}>
+CONFIG_DRM_AMDGPU_SI                            policy<{'arm64': '-'}>
+CONFIG_DRM_AMDGPU_USERPTR                       policy<{'arm64': '-'}>
+CONFIG_DRM_AMDGPU_WERROR                        policy<{'arm64': '-'}>
+CONFIG_DRM_AMD_ACP                              policy<{'arm64': '-'}>
+CONFIG_DRM_AMD_DC                               policy<{'arm64': '-'}>
+CONFIG_DRM_AMD_DC_FP                            policy<{'arm64': '-'}>
+CONFIG_DRM_AMD_DC_SI                            policy<{'arm64': '-'}>
+CONFIG_DRM_AMD_SECURE_DISPLAY                   policy<{'arm64': '-'}>
+CONFIG_DRM_CDNS_MHDP8546_J721E                  policy<{'arm64': '-'}>
+CONFIG_DRM_DW_HDMI                              policy<{'arm64': '-'}>
+CONFIG_DRM_DW_HDMI_AHB_AUDIO                    policy<{'arm64': '-'}>
+CONFIG_DRM_DW_HDMI_CEC                          policy<{'arm64': '-'}>
+CONFIG_DRM_DW_HDMI_GP_AUDIO                     policy<{'arm64': '-'}>
+CONFIG_DRM_DW_HDMI_I2S_AUDIO                    policy<{'arm64': '-'}>
+CONFIG_DRM_DW_MIPI_DSI                          policy<{'arm64': '-'}>
+CONFIG_DRM_FSL_LDB                              policy<{'arm64': '-'}>
+CONFIG_DRM_IMX8QM_LDB                           policy<{'arm64': '-'}>
+CONFIG_DRM_IMX8QXP_LDB                          policy<{'arm64': '-'}>
+CONFIG_DRM_IMX8QXP_PIXEL_COMBINER               policy<{'arm64': '-'}>
+CONFIG_DRM_IMX8QXP_PIXEL_LINK                   policy<{'arm64': '-'}>
+CONFIG_DRM_IMX8QXP_PIXEL_LINK_TO_DPI            policy<{'arm64': '-'}>
+CONFIG_DRM_IMX93_MIPI_DSI                       policy<{'arm64': '-'}>
+CONFIG_DRM_IMX_DCSS                             policy<{'arm64': '-'}>
+CONFIG_DRM_IMX_LCDC                             policy<{'arm64': '-'}>
+CONFIG_DRM_IMX_LCDIF                            policy<{'arm64': '-'}>
+CONFIG_DRM_IMX_LDB_HELPER                       policy<{'arm64': '-'}>
+CONFIG_DRM_KMB_DISPLAY                          policy<{'arm64': '-'}>
+CONFIG_DRM_MEDIATEK                             policy<{'arm64': '-'}>
+CONFIG_DRM_MEDIATEK_DP                          policy<{'arm64': '-'}>
+CONFIG_DRM_MEDIATEK_HDMI                        policy<{'arm64': '-'}>
+CONFIG_DRM_MESON                                policy<{'arm64': '-'}>
+CONFIG_DRM_MESON_DW_HDMI                        policy<{'arm64': '-'}>
+CONFIG_DRM_MESON_DW_MIPI_DSI                    policy<{'arm64': '-'}>
+CONFIG_DRM_MXS                                  policy<{'arm64': '-'}>
+CONFIG_DRM_MXSFB                                policy<{'arm64': '-'}>
+CONFIG_DRM_PANEL_NOVATEK_NT36672E               policy<{'arm64': 'm'}>
+CONFIG_DRM_RADEON                               policy<{'arm64': 'n'}>
+CONFIG_DRM_RADEON_USERPTR                       policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_CMM                             policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_DU                              policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_DW_HDMI                         policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_LVDS                            policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_MIPI_DSI                        policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_USE_CMM                         policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_USE_LVDS                        policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_USE_MIPI_DSI                    policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_VSP                             policy<{'arm64': '-'}>
+CONFIG_DRM_RCAR_WRITEBACK                       policy<{'arm64': '-'}>
+CONFIG_DRM_ROCKCHIP                             policy<{'arm64': '-'}>
+CONFIG_DRM_RZG2L_MIPI_DSI                       policy<{'arm64': '-'}>
+CONFIG_DRM_SHMOBILE                             policy<{'arm64': '-'}>
+CONFIG_DRM_SPRD                                 policy<{'arm64': '-'}>
+CONFIG_DRM_STM                                  policy<{'arm64': '-'}>
+CONFIG_DRM_STM_DSI                              policy<{'arm64': '-'}>
+CONFIG_DRM_SUN4I                                policy<{'arm64': '-'}>
+CONFIG_DRM_SUN6I_DSI                            policy<{'arm64': '-'}>
+CONFIG_DRM_SUN8I_DW_HDMI                        policy<{'arm64': '-'}>
+CONFIG_DRM_SUN8I_MIXER                          policy<{'arm64': '-'}>
+CONFIG_DRM_SUN8I_TCON_TOP                       policy<{'arm64': '-'}>
+CONFIG_DRM_TEGRA                                policy<{'arm64': '-'}>
+CONFIG_DRM_TEGRA_DEBUG                          policy<{'arm64': '-'}>
+CONFIG_DRM_TEGRA_STAGING                        policy<{'arm64': '-'}>
+CONFIG_DRM_ZYNQMP_DPSUB                         policy<{'arm64': '-'}>
+CONFIG_DVB_MAX_ADAPTERS                         policy<{'arm64': '16'}>
+CONFIG_DWMAC_IMX8                               policy<{'arm64': '-'}>
+CONFIG_DWMAC_MEDIATEK                           policy<{'arm64': '-'}>
+CONFIG_DWMAC_MESON                              policy<{'arm64': '-'}>
+CONFIG_DWMAC_ROCKCHIP                           policy<{'arm64': '-'}>
+CONFIG_DWMAC_SOCFPGA                            policy<{'arm64': '-'}>
+CONFIG_DWMAC_STM32                              policy<{'arm64': '-'}>
+CONFIG_DWMAC_SUN8I                              policy<{'arm64': '-'}>
+CONFIG_DWMAC_SUNXI                              policy<{'arm64': '-'}>
+CONFIG_DWMAC_TEGRA                              policy<{'arm64': '-'}>
+CONFIG_DWMAC_VISCONTI                           policy<{'arm64': '-'}>
+CONFIG_DW_APB_ICTL                              policy<{'arm64': '-'}>
+CONFIG_DW_APB_TIMER                             policy<{'arm64': '-'}>
+CONFIG_DW_APB_TIMER_OF                          policy<{'arm64': '-'}>
+CONFIG_EDAC_ALTERA                              policy<{'arm64': '-'}>
+CONFIG_EDAC_ALTERA_ETHERNET                     policy<{'arm64': '-'}>
+CONFIG_EDAC_ALTERA_NAND                         policy<{'arm64': '-'}>
+CONFIG_EDAC_ALTERA_OCRAM                        policy<{'arm64': '-'}>
+CONFIG_EDAC_ALTERA_QSPI                         policy<{'arm64': '-'}>
+CONFIG_EDAC_ALTERA_SDMMC                        policy<{'arm64': '-'}>
+CONFIG_EDAC_ALTERA_SDRAM                        policy<{'arm64': '-'}>
+CONFIG_EDAC_ALTERA_USB                          policy<{'arm64': '-'}>
+CONFIG_EDAC_LAYERSCAPE                          policy<{'arm64': '-'}>
+CONFIG_EDAC_NPCM                                policy<{'arm64': '-'}>
+CONFIG_EDAC_SYNOPSYS                            policy<{'arm64': '-'}>
+CONFIG_EDAC_VERSAL                              policy<{'arm64': '-'}>
+CONFIG_EDAC_ZYNQMP                              policy<{'arm64': '-'}>
+CONFIG_EINT_MTK                                 policy<{'arm64': '-'}>
+CONFIG_EMAC_ROCKCHIP                            policy<{'arm64': '-'}>
+CONFIG_EXTCON_RTK_TYPE_C                        policy<{'arm64': '-'}>
+CONFIG_FB_IMX                                   policy<{'arm64': '-'}>
+CONFIG_FB_PROVIDE_GET_FB_UNMAPPED_AREA          policy<{'arm64': '-'}>
+CONFIG_FB_SH_MOBILE_LCDC                        policy<{'arm64': '-'}>
+CONFIG_FB_XILINX                                policy<{'arm64': '-'}>
+CONFIG_FEC                                      policy<{'arm64': '-'}>
+CONFIG_FPGA_MGR_SOCFPGA                         policy<{'arm64': '-'}>
+CONFIG_FPGA_MGR_SOCFPGA_A10                     policy<{'arm64': '-'}>
+CONFIG_FPGA_MGR_STRATIX10_SOC                   policy<{'arm64': '-'}>
+CONFIG_FPGA_MGR_VERSAL_FPGA                     policy<{'arm64': '-'}>
+CONFIG_FPGA_MGR_ZYNQMP_FPGA                     policy<{'arm64': '-'}>
+CONFIG_FRAME_WARN                               policy<{'arm64': '2048'}>
+CONFIG_FSL_BMAN_TEST                            policy<{'arm64': '-'}>
+CONFIG_FSL_BMAN_TEST_API                        policy<{'arm64': '-'}>
+CONFIG_FSL_DPAA                                 policy<{'arm64': '-'}>
+CONFIG_FSL_DPAA2_ETH                            policy<{'arm64': '-'}>
+CONFIG_FSL_DPAA2_ETH_DCB                        policy<{'arm64': '-'}>
+CONFIG_FSL_DPAA2_PTP_CLOCK                      policy<{'arm64': '-'}>
+CONFIG_FSL_DPAA2_QDMA                           policy<{'arm64': '-'}>
+CONFIG_FSL_DPAA_CHECKING                        policy<{'arm64': '-'}>
+CONFIG_FSL_DPAA_ETH                             policy<{'arm64': '-'}>
+CONFIG_FSL_FMAN                                 policy<{'arm64': '-'}>
+CONFIG_FSL_GUTS                                 policy<{'arm64': '-'}>
+CONFIG_FSL_IFC                                  policy<{'arm64': '-'}>
+CONFIG_FSL_IMX8_DDR_PMU                         policy<{'arm64': '-'}>
+CONFIG_FSL_IMX9_DDR_PMU                         policy<{'arm64': '-'}>
+CONFIG_FSL_MC_BUS                               policy<{'arm64': '-'}>
+CONFIG_FSL_MC_DPIO                              policy<{'arm64': '-'}>
+CONFIG_FSL_MC_UAPI_SUPPORT                      policy<{'arm64': '-'}>
+CONFIG_FSL_QMAN_TEST                            policy<{'arm64': '-'}>
+CONFIG_FUEL_GAUGE_SC27XX                        policy<{'arm64': '-'}>
+CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT            policy<{'arm64': 'y'}>
+CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND           policy<{'arm64': '-'}>
+CONFIG_GENERIC_IRQ_IPI_MUX                      policy<{'arm64': '-'}>
+CONFIG_GH_VIRT_WATCHDOG                         policy<{'arm64': 'y'}>
+CONFIG_GPIO_ALTERA_A10SR                        policy<{'arm64': '-'}>
+CONFIG_GPIO_DAVINCI                             policy<{'arm64': '-'}>
+CONFIG_GPIO_EIC_SPRD                            policy<{'arm64': '-'}>
+CONFIG_GPIO_IMX_SCU                             policy<{'arm64': '-'}>
+CONFIG_GPIO_MPC8XXX                             policy<{'arm64': '-'}>
+CONFIG_GPIO_MVEBU                               policy<{'arm64': '-'}>
+CONFIG_GPIO_MXC                                 policy<{'arm64': '-'}>
+CONFIG_GPIO_NPCM_SGPIO                          policy<{'arm64': '-'}>
+CONFIG_GPIO_PCA953X                             policy<{'arm64': 'y'}>
+CONFIG_GPIO_PMIC_EIC_SPRD                       policy<{'arm64': '-'}>
+CONFIG_GPIO_RCAR                                policy<{'arm64': '-'}>
+CONFIG_GPIO_ROCKCHIP                            policy<{'arm64': '-'}>
+CONFIG_GPIO_RTD                                 policy<{'arm64': '-'}>
+CONFIG_GPIO_SL28CPLD                            policy<{'arm64': '-'}>
+CONFIG_GPIO_SPRD                                policy<{'arm64': '-'}>
+CONFIG_GPIO_TEGRA                               policy<{'arm64': '-'}>
+CONFIG_GPIO_TEGRA186                            policy<{'arm64': '-'}>
+CONFIG_GPIO_THUNDERX                            policy<{'arm64': '-'}>
+CONFIG_GPIO_VF610                               policy<{'arm64': '-'}>
+CONFIG_GPIO_VISCONTI                            policy<{'arm64': '-'}>
+CONFIG_GPIO_XGENE_SB                            policy<{'arm64': '-'}>
+CONFIG_GPIO_XLP                                 policy<{'arm64': '-'}>
+CONFIG_GPIO_ZYNQ                                policy<{'arm64': '-'}>
+CONFIG_GPIO_ZYNQMP_MODEPIN                      policy<{'arm64': '-'}>
+CONFIG_GUNYAH                                   policy<{'arm64': 'y'}>
+CONFIG_GUNYAH_DRIVERS                           policy<{'arm64': 'y'}>
+CONFIG_GUNYAH_IOEVENTFD                         policy<{'arm64': 'y'}>
+CONFIG_GUNYAH_IRQFD                             policy<{'arm64': 'y'}>
+CONFIG_GUNYAH_PLATFORM_HOOKS                    policy<{'arm64': 'y'}>
+CONFIG_GUNYAH_QCOM_PLATFORM                     policy<{'arm64': 'y'}>
+CONFIG_GUNYAH_VCPU                              policy<{'arm64': 'y'}>
+CONFIG_HAVE_KERNEL_GZIP                         policy<{'arm64': '-'}>
+CONFIG_HAVE_KERNEL_ZSTD                         policy<{'arm64': '-'}>
+CONFIG_HBMC_AM654                               policy<{'arm64': '-'}>
+CONFIG_HI3660_MBOX                              policy<{'arm64': '-'}>
+CONFIG_HI6220_MBOX                              policy<{'arm64': '-'}>
+CONFIG_HISILICON_IRQ_MBIGEN                     policy<{'arm64': '-'}>
+CONFIG_HISILICON_LPC                            policy<{'arm64': '-'}>
+CONFIG_HISI_DMA                                 policy<{'arm64': '-'}>
+CONFIG_HISI_THERMAL                             policy<{'arm64': '-'}>
+CONFIG_HSA_AMD                                  policy<{'arm64': '-'}>
+CONFIG_HSA_AMD_SVM                              policy<{'arm64': '-'}>
+CONFIG_HTE_TEGRA194                             policy<{'arm64': '-'}>
+CONFIG_HTE_TEGRA194_TEST                        policy<{'arm64': '-'}>
+CONFIG_HWSPINLOCK_OMAP                          policy<{'arm64': '-'}>
+CONFIG_HWSPINLOCK_QCOM                          policy<{'arm64': 'y'}>
+CONFIG_HWSPINLOCK_SPRD                          policy<{'arm64': '-'}>
+CONFIG_HWSPINLOCK_SUN6I                         policy<{'arm64': '-'}>
+CONFIG_HW_RANDOM_CAVIUM                         policy<{'arm64': '-'}>
+CONFIG_HW_RANDOM_HISI                           policy<{'arm64': '-'}>
+CONFIG_HW_RANDOM_HISTB                          policy<{'arm64': '-'}>
+CONFIG_HW_RANDOM_MESON                          policy<{'arm64': '-'}>
+CONFIG_HW_RANDOM_MTK                            policy<{'arm64': '-'}>
+CONFIG_HW_RANDOM_NPCM                           policy<{'arm64': '-'}>
+CONFIG_HW_RANDOM_OMAP                           policy<{'arm64': '-'}>
+CONFIG_HW_RANDOM_STM32                          policy<{'arm64': '-'}>
+CONFIG_HW_RANDOM_XGENE                          policy<{'arm64': '-'}>
+CONFIG_I2C_ALTERA                               policy<{'arm64': '-'}>
+CONFIG_I2C_APPLE                                policy<{'arm64': '-'}>
+CONFIG_I2C_DEMUX_PINCTRL                        policy<{'arm64': 'n'}>
+CONFIG_I2C_HIX5HD2                              policy<{'arm64': '-'}>
+CONFIG_I2C_IMX                                  policy<{'arm64': '-'}>
+CONFIG_I2C_IMX_LPI2C                            policy<{'arm64': '-'}>
+CONFIG_I2C_MESON                                policy<{'arm64': '-'}>
+CONFIG_I2C_MT65XX                               policy<{'arm64': '-'}>
+CONFIG_I2C_MUX                                  policy<{'arm64': 'y'}>
+CONFIG_I2C_MUX_PCA954x                          policy<{'arm64': 'y'}>
+CONFIG_I2C_MV64XXX                              policy<{'arm64': '-'}>
+CONFIG_I2C_NPCM                                 policy<{'arm64': '-'}>
+CONFIG_I2C_OMAP                                 policy<{'arm64': '-'}>
+CONFIG_I2C_OWL                                  policy<{'arm64': '-'}>
+CONFIG_I2C_PXA                                  policy<{'arm64': '-'}>
+CONFIG_I2C_PXA_SLAVE                            policy<{'arm64': '-'}>
+CONFIG_I2C_QUP                                  policy<{'arm64': 'y'}>
+CONFIG_I2C_RCAR                                 policy<{'arm64': '-'}>
+CONFIG_I2C_RIIC                                 policy<{'arm64': '-'}>
+CONFIG_I2C_RZV2M                                policy<{'arm64': '-'}>
+CONFIG_I2C_SH_MOBILE                            policy<{'arm64': '-'}>
+CONFIG_I2C_SPRD                                 policy<{'arm64': '-'}>
+CONFIG_I2C_STM32F4                              policy<{'arm64': '-'}>
+CONFIG_I2C_STM32F7                              policy<{'arm64': '-'}>
+CONFIG_I2C_SYNQUACER                            policy<{'arm64': '-'}>
+CONFIG_I2C_TEGRA                                policy<{'arm64': '-'}>
+CONFIG_I2C_TEGRA_BPMP                           policy<{'arm64': '-'}>
+CONFIG_I2C_VERSATILE                            policy<{'arm64': '-'}>
+CONFIG_I2C_XGENE_SLIMPRO                        policy<{'arm64': '-'}>
+CONFIG_I2C_XLP9XX                               policy<{'arm64': '-'}>
+CONFIG_IIO_STM32_LPTIMER_TRIGGER                policy<{'arm64': '-'}>
+CONFIG_IIO_STM32_TIMER_TRIGGER                  policy<{'arm64': '-'}>
+CONFIG_IMX2_WDT                                 policy<{'arm64': '-'}>
+CONFIG_IMX7D_ADC                                policy<{'arm64': '-'}>
+CONFIG_IMX7ULP_WDT                              policy<{'arm64': '-'}>
+CONFIG_IMX8MM_THERMAL                           policy<{'arm64': '-'}>
+CONFIG_IMX8M_BLK_CTRL                           policy<{'arm64': '-'}>
+CONFIG_IMX8QXP_ADC                              policy<{'arm64': '-'}>
+CONFIG_IMX93_ADC                                policy<{'arm64': '-'}>
+CONFIG_IMX9_BLK_CTRL                            policy<{'arm64': '-'}>
+CONFIG_IMX_DMA                                  policy<{'arm64': '-'}>
+CONFIG_IMX_DSP                                  policy<{'arm64': '-'}>
+CONFIG_IMX_DSP_REMOTEPROC                       policy<{'arm64': '-'}>
+CONFIG_IMX_GPCV2                                policy<{'arm64': '-'}>
+CONFIG_IMX_GPCV2_PM_DOMAINS                     policy<{'arm64': '-'}>
+CONFIG_IMX_INTMUX                               policy<{'arm64': '-'}>
+CONFIG_IMX_IRQSTEER                             policy<{'arm64': '-'}>
+CONFIG_IMX_MBOX                                 policy<{'arm64': '-'}>
+CONFIG_IMX_MU_MSI                               policy<{'arm64': '-'}>
+CONFIG_IMX_REMOTEPROC                           policy<{'arm64': '-'}>
+CONFIG_IMX_SCU                                  policy<{'arm64': '-'}>
+CONFIG_IMX_SCU_PD                               policy<{'arm64': '-'}>
+CONFIG_IMX_SC_THERMAL                           policy<{'arm64': '-'}>
+CONFIG_IMX_SC_WDT                               policy<{'arm64': '-'}>
+CONFIG_IMX_SDMA                                 policy<{'arm64': '-'}>
+CONFIG_IMX_THERMAL                              policy<{'arm64': '-'}>
+CONFIG_IMX_WEIM                                 policy<{'arm64': '-'}>
+CONFIG_INPUT_BBNSM_PWRKEY                       policy<{'arm64': '-'}>
+CONFIG_INPUT_HISI_POWERKEY                      policy<{'arm64': '-'}>
+CONFIG_INPUT_SC27XX_VIBRA                       policy<{'arm64': '-'}>
+CONFIG_INTEL_STRATIX10_RSU                      policy<{'arm64': '-'}>
+CONFIG_INTEL_STRATIX10_SERVICE                  policy<{'arm64': '-'}>
+CONFIG_INTERCONNECT_CLK                         policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_IMX                         policy<{'arm64': '-'}>
+CONFIG_INTERCONNECT_IMX8MM                      policy<{'arm64': '-'}>
+CONFIG_INTERCONNECT_IMX8MN                      policy<{'arm64': '-'}>
+CONFIG_INTERCONNECT_IMX8MP                      policy<{'arm64': '-'}>
+CONFIG_INTERCONNECT_IMX8MQ                      policy<{'arm64': '-'}>
+CONFIG_INTERCONNECT_QCOM_BCM_VOTER              policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_QCS615                 policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_QCS8300                policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_RPMH                   policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SA8775P                policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SC7180                 policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SC7280                 policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SC8180X                policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SC8280XP               policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SDM845                 policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SM8450                 policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SM8550                 policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_SM8650                 policy<{'arm64': 'y'}>
+CONFIG_INTERCONNECT_QCOM_X1E80100               policy<{'arm64': 'y'}>
+CONFIG_IPMI_KCS_BMC                             policy<{'arm64': '-'}>
+CONFIG_IPMI_KCS_BMC_CDEV_IPMI                   policy<{'arm64': '-'}>
+CONFIG_IPMI_KCS_BMC_SERIO                       policy<{'arm64': '-'}>
+CONFIG_IPQ_APSS_6018                            policy<{'arm64': 'y'}>
+CONFIG_IPQ_APSS_PLL                             policy<{'arm64': 'y'}>
+CONFIG_IPQ_GCC_5332                             policy<{'arm64': 'y'}>
+CONFIG_IPQ_GCC_6018                             policy<{'arm64': 'y'}>
+CONFIG_IPQ_GCC_8074                             policy<{'arm64': 'y'}>
+CONFIG_IPQ_GCC_9574                             policy<{'arm64': 'y'}>
+CONFIG_IR_MESON                                 policy<{'arm64': '-'}>
+CONFIG_IR_MESON_TX                              policy<{'arm64': '-'}>
+CONFIG_IR_MTK                                   policy<{'arm64': '-'}>
+CONFIG_IR_SUNXI                                 policy<{'arm64': '-'}>
+CONFIG_K3_DMA                                   policy<{'arm64': '-'}>
+CONFIG_K3_RTI_WATCHDOG                          policy<{'arm64': '-'}>
+CONFIG_K3_THERMAL                               policy<{'arm64': '-'}>
+CONFIG_KASAN                                    policy<{'arm64': 'y'}>
+CONFIG_KASAN_EXTRA_INFO                         policy<{'arm64': 'n'}>
+CONFIG_KASAN_GENERIC                            policy<{'arm64': 'n'}>
+CONFIG_KASAN_HW_TAGS                            policy<{'arm64': 'y'}>
+CONFIG_KASAN_SW_TAGS                            policy<{'arm64': 'n'}>
+CONFIG_KASAN_VMALLOC                            policy<{'arm64': 'y'}>
+CONFIG_KCSAN                                    policy<{'arm64': '-'}>
+CONFIG_KEEMBAY_WATCHDOG                         policy<{'arm64': '-'}>
+CONFIG_KERNEL_GZIP                              policy<{'arm64': '-'}>
+CONFIG_KEYBOARD_IMX                             policy<{'arm64': '-'}>
+CONFIG_KEYBOARD_IMX_SC_KEY                      policy<{'arm64': '-'}>
+CONFIG_KEYBOARD_MT6779                          policy<{'arm64': '-'}>
+CONFIG_KEYBOARD_NVEC                            policy<{'arm64': '-'}>
+CONFIG_KEYBOARD_SNVS_PWRKEY                     policy<{'arm64': '-'}>
+CONFIG_KEYBOARD_SUN4I_LRADC                     policy<{'arm64': '-'}>
+CONFIG_KEYBOARD_TEGRA                           policy<{'arm64': '-'}>
+CONFIG_KHADAS_MCU_FAN_THERMAL                   policy<{'arm64': '-'}>
+CONFIG_KUNPENG_HCCS                             policy<{'arm64': '-'}>
+CONFIG_LEDS_SC27XX_BLTC                         policy<{'arm64': '-'}>
+CONFIG_LEDS_SUN50I_A100                         policy<{'arm64': '-'}>
+CONFIG_LEGACY_PTY_COUNT                         policy<{'arm64': '16'}>
+CONFIG_LOG_BUF_SHIFT                            policy<{'arm64': '17'}>
+CONFIG_LSM_MMAP_MIN_ADDR                        policy<{'arm64': '32768'}>
+CONFIG_LS_EXTIRQ                                policy<{'arm64': '-'}>
+CONFIG_LS_SCFG_MSI                              policy<{'arm64': '-'}>
+CONFIG_MARVELL_CN10K_DDR_PMU                    policy<{'arm64': '-'}>
+CONFIG_MARVELL_CN10K_TAD_PMU                    policy<{'arm64': '-'}>
+CONFIG_MARVELL_GTI_WDT                          policy<{'arm64': '-'}>
+CONFIG_MDIO_BUS_MUX_MESON_G12A                  policy<{'arm64': '-'}>
+CONFIG_MDIO_BUS_MUX_MESON_GXL                   policy<{'arm64': '-'}>
+CONFIG_MDIO_SUN4I                               policy<{'arm64': '-'}>
+CONFIG_MDIO_XGENE                               policy<{'arm64': '-'}>
+CONFIG_MEDIATEK_GE_SOC_PHY                      policy<{'arm64': 'n'}>
+CONFIG_MEDIATEK_MT6577_AUXADC                   policy<{'arm64': '-'}>
+CONFIG_MEDIATEK_WATCHDOG                        policy<{'arm64': '-'}>
+CONFIG_MESON_CANVAS                             policy<{'arm64': '-'}>
+CONFIG_MESON_CLK_MEASURE                        policy<{'arm64': '-'}>
+CONFIG_MESON_DDR_PMU                            policy<{'arm64': '-'}>
+CONFIG_MESON_EE_PM_DOMAINS                      policy<{'arm64': '-'}>
+CONFIG_MESON_GXBB_WATCHDOG                      policy<{'arm64': '-'}>
+CONFIG_MESON_GXL_PHY                            policy<{'arm64': '-'}>
+CONFIG_MESON_GX_PM_DOMAINS                      policy<{'arm64': '-'}>
+CONFIG_MESON_GX_SOCINFO                         policy<{'arm64': '-'}>
+CONFIG_MESON_IRQ_GPIO                           policy<{'arm64': '-'}>
+CONFIG_MESON_SARADC                             policy<{'arm64': '-'}>
+CONFIG_MESON_SECURE_PM_DOMAINS                  policy<{'arm64': '-'}>
+CONFIG_MESON_SM                                 policy<{'arm64': '-'}>
+CONFIG_MESON_WATCHDOG                           policy<{'arm64': '-'}>
+CONFIG_MFD_AC100                                policy<{'arm64': '-'}>
+CONFIG_MFD_ALTERA_A10SR                         policy<{'arm64': '-'}>
+CONFIG_MFD_ALTERA_SYSMGR                        policy<{'arm64': '-'}>
+CONFIG_MFD_AXP20X_RSB                           policy<{'arm64': '-'}>
+CONFIG_MFD_HI655X_PMIC                          policy<{'arm64': '-'}>
+CONFIG_MFD_I2C_PMIC                             policy<{'arm64': 'y'}>
+CONFIG_MFD_KHADAS_MCU                           policy<{'arm64': '-'}>
+CONFIG_MFD_NVEC                                 policy<{'arm64': '-'}>
+CONFIG_MFD_SC27XX_PMIC                          policy<{'arm64': '-'}>
+CONFIG_MFD_SL28CPLD                             policy<{'arm64': '-'}>
+CONFIG_MFD_SPMI_PMIC                            policy<{'arm64': 'y'}>
+CONFIG_MFD_STM32_LPTIMER                        policy<{'arm64': '-'}>
+CONFIG_MFD_STM32_TIMERS                         policy<{'arm64': '-'}>
+CONFIG_MFD_SUN4I_GPADC                          policy<{'arm64': '-'}>
+CONFIG_MFD_SUN6I_PRCM                           policy<{'arm64': '-'}>
+CONFIG_MFD_TI_AM335X_TSCADC                     policy<{'arm64': '-'}>
+CONFIG_MHI_EP_NET                               policy<{'arm64': 'n'}>
+CONFIG_MMC_BLOCK_MINORS                         policy<{'arm64': '32'}>
+CONFIG_MMC_CAVIUM_THUNDERX                      policy<{'arm64': '-'}>
+CONFIG_MMC_CQHCI                                policy<{'arm64': 'y'}>
+CONFIG_MMC_DW                                   policy<{'arm64': 'y'}>
+CONFIG_MMC_DW_EXYNOS                            policy<{'arm64': 'y'}>
+CONFIG_MMC_DW_HI3798CV200                       policy<{'arm64': 'y'}>
+CONFIG_MMC_DW_K3                                policy<{'arm64': 'y'}>
+CONFIG_MMC_DW_PLTFM                             policy<{'arm64': 'y'}>
+CONFIG_MMC_DW_ROCKCHIP                          policy<{'arm64': '-'}>
+CONFIG_MMC_MESON_GX                             policy<{'arm64': '-'}>
+CONFIG_MMC_MESON_MX_SDIO                        policy<{'arm64': '-'}>
+CONFIG_MMC_MTK                                  policy<{'arm64': 'y'}>
+CONFIG_MMC_MXC                                  policy<{'arm64': '-'}>
+CONFIG_MMC_OWL                                  policy<{'arm64': '-'}>
+CONFIG_MMC_SDHCI_ACPI                           policy<{'arm64': 'y'}>
+CONFIG_MMC_SDHCI_AM654                          policy<{'arm64': '-'}>
+CONFIG_MMC_SDHCI_CADENCE                        policy<{'arm64': 'y'}>
+CONFIG_MMC_SDHCI_ESDHC_IMX                      policy<{'arm64': '-'}>
+CONFIG_MMC_SDHCI_F_SDH30                        policy<{'arm64': 'y'}>
+CONFIG_MMC_SDHCI_MSM                            policy<{'arm64': 'y'}>
+CONFIG_MMC_SDHCI_NPCM                           policy<{'arm64': '-'}>
+CONFIG_MMC_SDHCI_OF_ARASAN                      policy<{'arm64': 'y'}>
+CONFIG_MMC_SDHCI_OF_DWCMSHC                     policy<{'arm64': 'y'}>
+CONFIG_MMC_SDHCI_OF_ESDHC                       policy<{'arm64': '-'}>
+CONFIG_MMC_SDHCI_OF_SPARX5                      policy<{'arm64': '-'}>
+CONFIG_MMC_SDHCI_PXAV3                          policy<{'arm64': '-'}>
+CONFIG_MMC_SDHCI_SPRD                           policy<{'arm64': '-'}>
+CONFIG_MMC_SDHCI_TEGRA                          policy<{'arm64': '-'}>
+CONFIG_MMC_SDHCI_XENON                          policy<{'arm64': 'y'}>
+CONFIG_MMC_SDHI                                 policy<{'arm64': '-'}>
+CONFIG_MMC_SDHI_INTERNAL_DMAC                   policy<{'arm64': '-'}>
+CONFIG_MMC_SDHI_SYS_DMAC                        policy<{'arm64': '-'}>
+CONFIG_MMC_SH_MMCIF                             policy<{'arm64': '-'}>
+CONFIG_MMC_SPI                                  policy<{'arm64': 'y'}>
+CONFIG_MMC_SUNXI                                policy<{'arm64': '-'}>
+CONFIG_MMC_TMIO_CORE                            policy<{'arm64': '-'}>
+CONFIG_MSM_GCC_8916                             policy<{'arm64': 'y'}>
+CONFIG_MSM_GCC_8994                             policy<{'arm64': 'y'}>
+CONFIG_MSM_GCC_8998                             policy<{'arm64': 'y'}>
+CONFIG_MSM_RDBG                                 policy<{'arm64': 'm'}>
+CONFIG_MST_IRQ                                  policy<{'arm64': '-'}>
+CONFIG_MT7622_WMAC                              policy<{'arm64': '-'}>
+CONFIG_MT798X_WMAC                              policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_ECC_MEDIATEK                    policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_FSL_IFC                         policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_GPMI_NAND                       policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_HISI504                         policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_MARVELL                         policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_MESON                           policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_MTK                             policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_MXC                             policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_OMAP2                           policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_OMAP_BCH                        policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_OMAP_BCH_BUILD                  policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_RENESAS                         policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_ROCKCHIP                        policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_STM32_FMC2                      policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_SUNXI                           policy<{'arm64': '-'}>
+CONFIG_MTD_NAND_TEGRA                           policy<{'arm64': '-'}>
+CONFIG_MTD_PARSER_TRX                           policy<{'arm64': '-'}>
+CONFIG_MTK_ADSP_IPC                             policy<{'arm64': '-'}>
+CONFIG_MTK_ADSP_MBOX                            policy<{'arm64': '-'}>
+CONFIG_MTK_CMDQ                                 policy<{'arm64': '-'}>
+CONFIG_MTK_CMDQ_MBOX                            policy<{'arm64': '-'}>
+CONFIG_MTK_CPUX_TIMER                           policy<{'arm64': '-'}>
+CONFIG_MTK_CQDMA                                policy<{'arm64': '-'}>
+CONFIG_MTK_DEVAPC                               policy<{'arm64': '-'}>
+CONFIG_MTK_HSDMA                                policy<{'arm64': '-'}>
+CONFIG_MTK_INFRACFG                             policy<{'arm64': '-'}>
+CONFIG_MTK_IOMMU                                policy<{'arm64': '-'}>
+CONFIG_MTK_LVTS_THERMAL                         policy<{'arm64': '-'}>
+CONFIG_MTK_LVTS_THERMAL_DEBUGFS                 policy<{'arm64': '-'}>
+CONFIG_MTK_MMSYS                                policy<{'arm64': '-'}>
+CONFIG_MTK_PMIC_WRAP                            policy<{'arm64': '-'}>
+CONFIG_MTK_REGULATOR_COUPLER                    policy<{'arm64': '-'}>
+CONFIG_MTK_SCP                                  policy<{'arm64': '-'}>
+CONFIG_MTK_SCPSYS                               policy<{'arm64': '-'}>
+CONFIG_MTK_SCPSYS_PM_DOMAINS                    policy<{'arm64': '-'}>
+CONFIG_MTK_SMI                                  policy<{'arm64': '-'}>
+CONFIG_MTK_SOC_THERMAL                          policy<{'arm64': '-'}>
+CONFIG_MTK_SVS                                  policy<{'arm64': '-'}>
+CONFIG_MTK_THERMAL                              policy<{'arm64': '-'}>
+CONFIG_MTK_TIMER                                policy<{'arm64': '-'}>
+CONFIG_MTK_UART_APDMA                           policy<{'arm64': '-'}>
+CONFIG_MVEBU_GICP                               policy<{'arm64': '-'}>
+CONFIG_MVEBU_ICU                                policy<{'arm64': '-'}>
+CONFIG_MVEBU_ODMI                               policy<{'arm64': '-'}>
+CONFIG_MVEBU_PIC                                policy<{'arm64': '-'}>
+CONFIG_MVEBU_SEI                                policy<{'arm64': '-'}>
+CONFIG_MVNETA                                   policy<{'arm64': '-'}>
+CONFIG_MVPP2                                    policy<{'arm64': '-'}>
+CONFIG_MVPP2_PTP                                policy<{'arm64': '-'}>
+CONFIG_MV_XOR                                   policy<{'arm64': '-'}>
+CONFIG_MXC_CLK                                  policy<{'arm64': '-'}>
+CONFIG_MXC_CLK_SCU                              policy<{'arm64': '-'}>
+CONFIG_MXS_DMA                                  policy<{'arm64': '-'}>
+CONFIG_NET_VENDOR_ACTIONS                       policy<{'arm64': '-'}>
+CONFIG_NET_VENDOR_ALLWINNER                     policy<{'arm64': '-'}>
+CONFIG_NET_VENDOR_MEDIATEK                      policy<{'arm64': '-'}>
+CONFIG_NET_XGENE                                policy<{'arm64': '-'}>
+CONFIG_NET_XGENE_V2                             policy<{'arm64': '-'}>
+CONFIG_NL80211_TESTMODE                         policy<{'arm64': 'y'}>
+CONFIG_NLS_DEFAULT                              policy<{'arm64': '"iso8859-1"'}>
+CONFIG_NODES_SHIFT                              policy<{'arm64': '4'}>
+CONFIG_NOUVEAU_PLATFORM_DRIVER                  policy<{'arm64': '-'}>
+CONFIG_NPCM7XX_KCS_IPMI_BMC                     policy<{'arm64': '-'}>
+CONFIG_NPCM7XX_TIMER                            policy<{'arm64': '-'}>
+CONFIG_NPCM7XX_WATCHDOG                         policy<{'arm64': '-'}>
+CONFIG_NPCM_ADC                                 policy<{'arm64': '-'}>
+CONFIG_NVEC_PAZ00                               policy<{'arm64': '-'}>
+CONFIG_NVEC_POWER                               policy<{'arm64': '-'}>
+CONFIG_NVMEM_APPLE_EFUSES                       policy<{'arm64': '-'}>
+CONFIG_NVMEM_IMX_IIM                            policy<{'arm64': '-'}>
+CONFIG_NVMEM_IMX_OCOTP                          policy<{'arm64': '-'}>
+CONFIG_NVMEM_IMX_OCOTP_ELE                      policy<{'arm64': '-'}>
+CONFIG_NVMEM_IMX_OCOTP_SCU                      policy<{'arm64': '-'}>
+CONFIG_NVMEM_LAYERSCAPE_SFP                     policy<{'arm64': '-'}>
+CONFIG_NVMEM_MESON_EFUSE                        policy<{'arm64': '-'}>
+CONFIG_NVMEM_MESON_MX_EFUSE                     policy<{'arm64': '-'}>
+CONFIG_NVMEM_MTK_EFUSE                          policy<{'arm64': '-'}>
+CONFIG_NVMEM_QCOM_QFPROM                        policy<{'arm64': 'y'}>
+CONFIG_NVMEM_ROCKCHIP_EFUSE                     policy<{'arm64': '-'}>
+CONFIG_NVMEM_ROCKCHIP_OTP                       policy<{'arm64': '-'}>
+CONFIG_NVMEM_SC27XX_EFUSE                       policy<{'arm64': '-'}>
+CONFIG_NVMEM_SNVS_LPGPR                         policy<{'arm64': '-'}>
+CONFIG_NVMEM_SPRD_EFUSE                         policy<{'arm64': '-'}>
+CONFIG_NVMEM_STM32_BSEC_OPTEE_TA                policy<{'arm64': '-'}>
+CONFIG_NVMEM_STM32_ROMEM                        policy<{'arm64': '-'}>
+CONFIG_NVMEM_SUNXI_SID                          policy<{'arm64': '-'}>
+CONFIG_NVMEM_ZYNQMP                             policy<{'arm64': '-'}>
+CONFIG_NVME_APPLE                               policy<{'arm64': '-'}>
+CONFIG_OF_DYNAMIC                               policy<{'arm64': '-'}>
+CONFIG_OF_OVERLAY                               policy<{'arm64': 'n'}>
+CONFIG_OF_RECONFIG_NOTIFIER_ERROR_INJECT        policy<{'arm64': '-'}>
+CONFIG_OF_RESOLVE                               policy<{'arm64': '-'}>
+CONFIG_OMAP2PLUS_MBOX                           policy<{'arm64': '-'}>
+CONFIG_OMAP_DM_TIMER                            policy<{'arm64': '-'}>
+CONFIG_OMAP_GPMC                                policy<{'arm64': '-'}>
+CONFIG_OMAP_GPMC_DEBUG                          policy<{'arm64': '-'}>
+CONFIG_OMAP_MBOX_KFIFO_SIZE                     policy<{'arm64': '-'}>
+CONFIG_OMAP_USB2                                policy<{'arm64': '-'}>
+CONFIG_OWL_DMA                                  policy<{'arm64': '-'}>
+CONFIG_OWL_EMAC                                 policy<{'arm64': '-'}>
+CONFIG_OWL_PM_DOMAINS                           policy<{'arm64': '-'}>
+CONFIG_OWL_PM_DOMAINS_HELPER                    policy<{'arm64': '-'}>
+CONFIG_OWL_TIMER                                policy<{'arm64': '-'}>
+CONFIG_PANIC_TIMEOUT                            policy<{'arm64': '-1'}>
+CONFIG_PATA_IMX                                 policy<{'arm64': '-'}>
+CONFIG_PCIE_APPLE                               policy<{'arm64': '-'}>
+CONFIG_PCIE_APPLE_MSI_DOORBELL_ADDR             policy<{'arm64': '-'}>
+CONFIG_PCIE_ARMADA_8K                           policy<{'arm64': '-'}>
+CONFIG_PCIE_HISI_STB                            policy<{'arm64': '-'}>
+CONFIG_PCIE_KEEMBAY                             policy<{'arm64': '-'}>
+CONFIG_PCIE_KEEMBAY_EP                          policy<{'arm64': '-'}>
+CONFIG_PCIE_KEEMBAY_HOST                        policy<{'arm64': '-'}>
+CONFIG_PCIE_LAYERSCAPE_GEN4                     policy<{'arm64': '-'}>
+CONFIG_PCIE_MEDIATEK                            policy<{'arm64': '-'}>
+CONFIG_PCIE_MEDIATEK_GEN3                       policy<{'arm64': '-'}>
+CONFIG_PCIE_MOBIVEIL_PLAT                       policy<{'arm64': '-'}>
+CONFIG_PCIE_QCOM_COMMON                         policy<{'arm64': 'y'}>
+CONFIG_PCIE_RCAR_EP                             policy<{'arm64': '-'}>
+CONFIG_PCIE_RCAR_GEN4                           policy<{'arm64': '-'}>
+CONFIG_PCIE_RCAR_GEN4_EP                        policy<{'arm64': '-'}>
+CONFIG_PCIE_RCAR_GEN4_HOST                      policy<{'arm64': '-'}>
+CONFIG_PCIE_RCAR_HOST                           policy<{'arm64': '-'}>
+CONFIG_PCIE_ROCKCHIP                            policy<{'arm64': '-'}>
+CONFIG_PCIE_ROCKCHIP_DW_HOST                    policy<{'arm64': '-'}>
+CONFIG_PCIE_ROCKCHIP_EP                         policy<{'arm64': '-'}>
+CONFIG_PCIE_ROCKCHIP_HOST                       policy<{'arm64': '-'}>
+CONFIG_PCIE_TEGRA194                            policy<{'arm64': '-'}>
+CONFIG_PCIE_TEGRA194_EP                         policy<{'arm64': '-'}>
+CONFIG_PCIE_TEGRA194_HOST                       policy<{'arm64': '-'}>
+CONFIG_PCIE_VISCONTI_HOST                       policy<{'arm64': '-'}>
+CONFIG_PCIE_XILINX_CPM                          policy<{'arm64': '-'}>
+CONFIG_PCIE_XILINX_DMA_PL                       policy<{'arm64': '-'}>
+CONFIG_PCIE_XILINX_NWL                          policy<{'arm64': '-'}>
+CONFIG_PCI_AARDVARK                             policy<{'arm64': '-'}>
+CONFIG_PCI_BRIDGE_EMUL                          policy<{'arm64': '-'}>
+CONFIG_PCI_IMX6                                 policy<{'arm64': '-'}>
+CONFIG_PCI_IMX6_EP                              policy<{'arm64': '-'}>
+CONFIG_PCI_IMX6_HOST                            policy<{'arm64': '-'}>
+CONFIG_PCI_J721E                                policy<{'arm64': '-'}>
+CONFIG_PCI_J721E_EP                             policy<{'arm64': '-'}>
+CONFIG_PCI_J721E_HOST                           policy<{'arm64': '-'}>
+CONFIG_PCI_KEYSTONE                             policy<{'arm64': '-'}>
+CONFIG_PCI_KEYSTONE_EP                          policy<{'arm64': '-'}>
+CONFIG_PCI_KEYSTONE_HOST                        policy<{'arm64': '-'}>
+CONFIG_PCI_LAYERSCAPE                           policy<{'arm64': '-'}>
+CONFIG_PCI_LAYERSCAPE_EP                        policy<{'arm64': '-'}>
+CONFIG_PCI_PWRCTL                               policy<{'arm64': 'm'}>
+CONFIG_PCI_PWRCTL_PWRSEQ                        policy<{'arm64': 'm'}>
+CONFIG_PCI_TEGRA                                policy<{'arm64': '-'}>
+CONFIG_PCS_LYNX                                 policy<{'arm64': 'm'}>
+CONFIG_PECI_NPCM                                policy<{'arm64': '-'}>
+CONFIG_PHYLINK                                  policy<{'arm64': 'm'}>
+CONFIG_PHY_AM654_SERDES                         policy<{'arm64': '-'}>
+CONFIG_PHY_BERLIN_SATA                          policy<{'arm64': '-'}>
+CONFIG_PHY_BERLIN_USB                           policy<{'arm64': '-'}>
+CONFIG_PHY_FSL_IMX8MQ_USB                       policy<{'arm64': '-'}>
+CONFIG_PHY_FSL_IMX8M_PCIE                       policy<{'arm64': '-'}>
+CONFIG_PHY_FSL_LYNX_28G                         policy<{'arm64': '-'}>
+CONFIG_PHY_HI3660_USB                           policy<{'arm64': '-'}>
+CONFIG_PHY_HI3670_PCIE                          policy<{'arm64': '-'}>
+CONFIG_PHY_HI3670_USB                           policy<{'arm64': '-'}>
+CONFIG_PHY_HI6220_USB                           policy<{'arm64': '-'}>
+CONFIG_PHY_HISI_INNO_USB2                       policy<{'arm64': '-'}>
+CONFIG_PHY_HISTB_COMBPHY                        policy<{'arm64': '-'}>
+CONFIG_PHY_INTEL_KEEMBAY_EMMC                   policy<{'arm64': '-'}>
+CONFIG_PHY_INTEL_KEEMBAY_USB                    policy<{'arm64': '-'}>
+CONFIG_PHY_J721E_WIZ                            policy<{'arm64': '-'}>
+CONFIG_PHY_MESON8B_USB2                         policy<{'arm64': '-'}>
+CONFIG_PHY_MESON_AXG_MIPI_DPHY                  policy<{'arm64': '-'}>
+CONFIG_PHY_MESON_AXG_MIPI_PCIE_ANALOG           policy<{'arm64': '-'}>
+CONFIG_PHY_MESON_AXG_PCIE                       policy<{'arm64': '-'}>
+CONFIG_PHY_MESON_G12A_MIPI_DPHY_ANALOG          policy<{'arm64': '-'}>
+CONFIG_PHY_MESON_G12A_USB2                      policy<{'arm64': '-'}>
+CONFIG_PHY_MESON_G12A_USB3_PCIE                 policy<{'arm64': '-'}>
+CONFIG_PHY_MESON_GXL_USB2                       policy<{'arm64': '-'}>
+CONFIG_PHY_MIXEL_LVDS_PHY                       policy<{'arm64': '-'}>
+CONFIG_PHY_MIXEL_MIPI_DPHY                      policy<{'arm64': '-'}>
+CONFIG_PHY_MTK_DP                               policy<{'arm64': '-'}>
+CONFIG_PHY_MTK_HDMI                             policy<{'arm64': '-'}>
+CONFIG_PHY_MTK_MIPI_DSI                         policy<{'arm64': '-'}>
+CONFIG_PHY_MTK_PCIE                             policy<{'arm64': '-'}>
+CONFIG_PHY_MTK_TPHY                             policy<{'arm64': '-'}>
+CONFIG_PHY_MTK_UFS                              policy<{'arm64': '-'}>
+CONFIG_PHY_MTK_XSPHY                            policy<{'arm64': '-'}>
+CONFIG_PHY_MVEBU_A3700_COMPHY                   policy<{'arm64': '-'}>
+CONFIG_PHY_MVEBU_A3700_UTMI                     policy<{'arm64': '-'}>
+CONFIG_PHY_MVEBU_A38X_COMPHY                    policy<{'arm64': '-'}>
+CONFIG_PHY_MVEBU_CP110_COMPHY                   policy<{'arm64': '-'}>
+CONFIG_PHY_MVEBU_CP110_UTMI                     policy<{'arm64': '-'}>
+CONFIG_PHY_NXP_PTN3222                          policy<{'arm64': 'n'}>
+CONFIG_PHY_QCOM_QMP                             policy<{'arm64': 'y'}>
+CONFIG_PHY_QCOM_QMP_PCIE                        policy<{'arm64': 'y'}>
+CONFIG_PHY_QCOM_QMP_PCIE_8996                   policy<{'arm64': 'y'}>
+CONFIG_PHY_QCOM_QMP_UFS                         policy<{'arm64': 'y'}>
+CONFIG_PHY_QCOM_QMP_USB                         policy<{'arm64': 'y'}>
+CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2               policy<{'arm64': 'y'}>
+CONFIG_PHY_R8A779F0_ETHERNET_SERDES             policy<{'arm64': '-'}>
+CONFIG_PHY_RCAR_GEN2                            policy<{'arm64': '-'}>
+CONFIG_PHY_RCAR_GEN3_PCIE                       policy<{'arm64': '-'}>
+CONFIG_PHY_RCAR_GEN3_USB2                       policy<{'arm64': '-'}>
+CONFIG_PHY_RCAR_GEN3_USB3                       policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_DP                          policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_DPHY_RX0                    policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_EMMC                        policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_INNO_CSIDPHY                policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_INNO_DSIDPHY                policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_INNO_HDMI                   policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_INNO_USB2                   policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_NANENG_COMBO_PHY            policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_PCIE                        policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_SNPS_PCIE3                  policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_TYPEC                       policy<{'arm64': '-'}>
+CONFIG_PHY_ROCKCHIP_USB                         policy<{'arm64': '-'}>
+CONFIG_PHY_SPARX5_SERDES                        policy<{'arm64': '-'}>
+CONFIG_PHY_STM32_USBPHYC                        policy<{'arm64': '-'}>
+CONFIG_PHY_SUN4I_USB                            policy<{'arm64': '-'}>
+CONFIG_PHY_SUN50I_USB3                          policy<{'arm64': '-'}>
+CONFIG_PHY_SUN6I_MIPI_DPHY                      policy<{'arm64': '-'}>
+CONFIG_PHY_SUN9I_USB                            policy<{'arm64': '-'}>
+CONFIG_PHY_TEGRA194_P2U                         policy<{'arm64': '-'}>
+CONFIG_PHY_TEGRA_XUSB                           policy<{'arm64': '-'}>
+CONFIG_PHY_TI_GMII_SEL                          policy<{'arm64': '-'}>
+CONFIG_PHY_XGENE                                policy<{'arm64': '-'}>
+CONFIG_PHY_XILINX_ZYNQMP                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_AC5                              policy<{'arm64': '-'}>
+CONFIG_PINCTRL_AMLOGIC_C3                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_AMLOGIC_T7                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_APPLE_GPIO                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_ARMADA_37XX                      policy<{'arm64': '-'}>
+CONFIG_PINCTRL_ARMADA_AP806                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_ARMADA_CP110                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_AS370                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_BERLIN                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_BERLIN_BG4CT                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_BM1880                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX                              policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX8DXL                          policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX8MM                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX8MN                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX8MP                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX8MQ                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX8QM                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX8QXP                          policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX8ULP                          policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX93                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMXRT1050                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMXRT1170                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IMX_SCU                          policy<{'arm64': '-'}>
+CONFIG_PINCTRL_IPQ5332                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IPQ6018                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IPQ8074                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_IPQ9574                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_KEEMBAY                          policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MESON                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MESON8_PMX                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MESON_A1                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MESON_AXG                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MESON_AXG_PMX                    policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MESON_G12A                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MESON_GXBB                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MESON_GXL                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MESON_S4                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MSM8916                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MSM8953                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MSM8976                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MSM8994                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MSM8996                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MSM8998                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_MT2712                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT6397                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT6765                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT6779                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT6795                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT6797                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT7622                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT7981                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT7986                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT8167                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT8173                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT8183                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT8186                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT8188                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT8192                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT8195                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT8365                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MT8516                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MTK                              policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MTK_MOORE                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MTK_PARIS                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MTK_V2                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_MVEBU                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_NPCM8XX                          policy<{'arm64': '-'}>
+CONFIG_PINCTRL_OWL                              policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A774A1                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A774B1                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A774C0                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A774E1                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A77951                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A77960                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A77961                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A77965                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A77970                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A77980                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A77990                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A77995                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A779A0                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A779F0                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_PFC_R8A779G0                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_QCM2290                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_QCOM_SPMI_PMIC                   policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_QCS404                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_QCS615                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_QCS8300                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_QCS8300_LPASS_LPI                policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_QDF2XXX                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_QDU1000                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_RENESAS                          policy<{'arm64': '-'}>
+CONFIG_PINCTRL_ROCKCHIP                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_RTD                              policy<{'arm64': '-'}>
+CONFIG_PINCTRL_RTD1315E                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_RTD1319D                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_RTD1619B                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_RZG2L                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_RZV2M                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_S32CC                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_S32G2                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_S700                             policy<{'arm64': '-'}>
+CONFIG_PINCTRL_S900                             policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SA7255P                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SA8775P                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SA8775P_LPASS_LPI                policy<{'arm64': 'm'}>
+CONFIG_PINCTRL_SC7180                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SC7280                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SC8180X                          policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SC8280XP                         policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SDM660                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SDM670                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SDM845                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SH_PFC                           policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SM6115                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SM6125                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SM6350                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SM6375                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SM8150                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SM8250                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SM8350                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SM8450                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SM8550                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SM8650                           policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_SPRD                             policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SPRD_SC9860                      policy<{'arm64': '-'}>
+CONFIG_PINCTRL_STM32                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_STM32MP257                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN20I_D1                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN4I_A10                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN50I_A100                      policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN50I_A100_R                    policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN50I_A64                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN50I_A64_R                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN50I_H5                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN50I_H6                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN50I_H616                      policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN50I_H616_R                    policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN50I_H6_R                      policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN5I                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN6I_A31                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN6I_A31_R                      policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN8I_A23                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN8I_A23_R                      policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN8I_A33                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN8I_A83T                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN8I_A83T_R                     policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN8I_H3                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN8I_H3_R                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN8I_V3S                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN9I_A80                        policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUN9I_A80_R                      policy<{'arm64': '-'}>
+CONFIG_PINCTRL_SUNXI                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_TEGRA                            policy<{'arm64': '-'}>
+CONFIG_PINCTRL_TEGRA124                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_TEGRA194                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_TEGRA210                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_TEGRA234                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_TEGRA_XUSB                       policy<{'arm64': '-'}>
+CONFIG_PINCTRL_TMPV7700                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_VISCONTI                         policy<{'arm64': '-'}>
+CONFIG_PINCTRL_X1E80100                         policy<{'arm64': 'y'}>
+CONFIG_PINCTRL_ZYNQMP                           policy<{'arm64': '-'}>
+CONFIG_PM_AUTOSLEEP                             policy<{'arm64': 'y'}>
+CONFIG_PM_WAKELOCKS_LIMIT                       policy<{'arm64': '0'}>
+CONFIG_POWER_RESET_HISI                         policy<{'arm64': '-'}>
+CONFIG_POWER_RESET_LINKSTATION                  policy<{'arm64': '-'}>
+CONFIG_POWER_RESET_OCELOT_RESET                 policy<{'arm64': '-'}>
+CONFIG_POWER_RESET_ODROID_GO_ULTRA_POWEROFF     policy<{'arm64': '-'}>
+CONFIG_POWER_RESET_SC27XX                       policy<{'arm64': '-'}>
+CONFIG_POWER_SEQUENCING                         policy<{'arm64': 'm'}>
+CONFIG_POWER_SEQUENCING_QCOM_WCN                policy<{'arm64': 'm'}>
+CONFIG_PRU_REMOTEPROC                           policy<{'arm64': '-'}>
+CONFIG_PTP_QCOM_CLOCK_TSC                       policy<{'arm64': 'n'}>
+CONFIG_PWC_RZV2M                                policy<{'arm64': '-'}>
+CONFIG_PWM_APPLE                                policy<{'arm64': '-'}>
+CONFIG_PWM_BERLIN                               policy<{'arm64': '-'}>
+CONFIG_PWM_HIBVT                                policy<{'arm64': '-'}>
+CONFIG_PWM_IMX1                                 policy<{'arm64': '-'}>
+CONFIG_PWM_IMX27                                policy<{'arm64': '-'}>
+CONFIG_PWM_IMX_TPM                              policy<{'arm64': '-'}>
+CONFIG_PWM_KEEMBAY                              policy<{'arm64': '-'}>
+CONFIG_PWM_MEDIATEK                             policy<{'arm64': '-'}>
+CONFIG_PWM_MESON                                policy<{'arm64': '-'}>
+CONFIG_PWM_MTK_DISP                             policy<{'arm64': '-'}>
+CONFIG_PWM_OMAP_DMTIMER                         policy<{'arm64': '-'}>
+CONFIG_PWM_RCAR                                 policy<{'arm64': '-'}>
+CONFIG_PWM_RENESAS_TPU                          policy<{'arm64': '-'}>
+CONFIG_PWM_ROCKCHIP                             policy<{'arm64': '-'}>
+CONFIG_PWM_RZ_MTU3                              policy<{'arm64': '-'}>
+CONFIG_PWM_SL28CPLD                             policy<{'arm64': '-'}>
+CONFIG_PWM_SPRD                                 policy<{'arm64': '-'}>
+CONFIG_PWM_STM32                                policy<{'arm64': '-'}>
+CONFIG_PWM_STM32_LP                             policy<{'arm64': '-'}>
+CONFIG_PWM_SUN4I                                policy<{'arm64': '-'}>
+CONFIG_PWM_TEGRA                                policy<{'arm64': '-'}>
+CONFIG_PWM_TIECAP                               policy<{'arm64': '-'}>
+CONFIG_PWM_TIEHRPWM                             policy<{'arm64': '-'}>
+CONFIG_PWM_VISCONTI                             policy<{'arm64': '-'}>
+CONFIG_PXA168_ETH                               policy<{'arm64': '-'}>
+CONFIG_QCM_GCC_2290                             policy<{'arm64': 'y'}>
+CONFIG_QCOM_A53PLL                              policy<{'arm64': 'y'}>
+CONFIG_QCOM_AOSS_QMP                            policy<{'arm64': 'y'}>
+CONFIG_QCOM_APCS_IPC                            policy<{'arm64': 'y'}>
+CONFIG_QCOM_APR                                 policy<{'arm64': 'y'}>
+CONFIG_QCOM_BAM_DMA                             policy<{'arm64': 'y'}>
+CONFIG_QCOM_CLK_APCC_MSM8996                    policy<{'arm64': 'y'}>
+CONFIG_QCOM_CLK_APCS_MSM8916                    policy<{'arm64': 'y'}>
+CONFIG_QCOM_CLK_RPMH                            policy<{'arm64': 'y'}>
+CONFIG_QCOM_CLK_SMD_RPM                         policy<{'arm64': 'y'}>
+CONFIG_QCOM_CPR                                 policy<{'arm64': 'y'}>
+CONFIG_QCOM_CPUCP_MBOX                          policy<{'arm64': 'n'}>
+CONFIG_QCOM_DCC                                 policy<{'arm64': 'y'}>
+CONFIG_QCOM_DMABUF_HEAPS                        policy<{'arm64': 'y'}>
+CONFIG_QCOM_DMABUF_HEAPS_CARVEOUT               policy<{'arm64': 'n'}>
+CONFIG_QCOM_DMABUF_HEAPS_CMA                    policy<{'arm64': 'y'}>
+CONFIG_QCOM_DMABUF_HEAPS_PAGE_POOL_REFILL       policy<{'arm64': 'n'}>
+CONFIG_QCOM_DMABUF_HEAPS_SYSTEM                 policy<{'arm64': 'y'}>
+CONFIG_QCOM_DMABUF_HEAPS_SYSTEM_SECURE          policy<{'arm64': 'y'}>
+CONFIG_QCOM_DMABUF_HEAPS_SYSTEM_UNCACHED        policy<{'arm64': 'n'}>
+CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC            policy<{'arm64': 'y'}>
+CONFIG_QCOM_GENI_SE                             policy<{'arm64': 'y'}>
+CONFIG_QCOM_HFPLL                               policy<{'arm64': 'y'}>
+CONFIG_QCOM_HIDMA                               policy<{'arm64': 'y'}>
+CONFIG_QCOM_HIDMA_MGMT                          policy<{'arm64': 'y'}>
+CONFIG_QCOM_INLINE_CRYPTO_ENGINE                policy<{'arm64': 'y'}>
+CONFIG_QCOM_KVM_ENABLED                         policy<{'arm64': 'n'}>
+CONFIG_QCOM_MEMORY_DUMP_V2                      policy<{'arm64': 'y'}>
+CONFIG_QCOM_MEM_BUF                             policy<{'arm64': 'y'}>
+CONFIG_QCOM_MEM_BUF_DEV                         policy<{'arm64': 'y'}>
+CONFIG_QCOM_MPM                                 policy<{'arm64': 'y'}>
+CONFIG_QCOM_PANEL_EVENT_NOTIFIER                policy<{'arm64': 'm'}>
+CONFIG_QCOM_PDR_HELPERS                         policy<{'arm64': 'y'}>
+CONFIG_QCOM_QMI_COOLING                         policy<{'arm64': 'm'}>
+CONFIG_QCOM_QMI_HELPERS                         policy<{'arm64': 'y'}>
+CONFIG_QCOM_QPS615_PCIE_SWITCH                  policy<{'arm64': 'y'}>
+CONFIG_QCOM_RPMPD                               policy<{'arm64': 'y'}>
+CONFIG_QCOM_SCM_ADDON                           policy<{'arm64': 'y'}>
+CONFIG_QCOM_SECURE_BUFFER                       policy<{'arm64': 'y'}>
+CONFIG_QCOM_SMCINVOKE                           policy<{'arm64': 'm'}>
+CONFIG_QCOM_SMD_RPM                             policy<{'arm64': 'y'}>
+CONFIG_QCOM_SMEM                                policy<{'arm64': 'y'}>
+CONFIG_QCOM_SMP2P                               policy<{'arm64': 'y'}>
+CONFIG_QCOM_SMP2P_SLEEPSTATE                    policy<{'arm64': 'm'}>
+CONFIG_QCOM_SMSM                                policy<{'arm64': 'y'}>
+CONFIG_QCOM_SOC_DEBUG                           policy<{'arm64': 'y'}>
+CONFIG_QCOM_SPMI_ADC5_GEN3                      policy<{'arm64': 'm'}>
+CONFIG_QCOM_SPMI_MBG_TM                         policy<{'arm64': 'm'}>
+CONFIG_QCOM_TZMEM                               policy<{'arm64': 'y'}>
+CONFIG_QCOM_TZMEM_MODE_GENERIC                  policy<{'arm64': 'n'}>
+CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE                policy<{'arm64': 'y'}>
+CONFIG_QCOM_WATCHDOG_BARK_TIME                  policy<{'arm64': '11000'}>
+CONFIG_QCOM_WATCHDOG_IPI_PING                   policy<{'arm64': 'y'}>
+CONFIG_QCOM_WATCHDOG_PET_TIME                   policy<{'arm64': '9360'}>
+CONFIG_QCOM_WDOG_BITE_EARLY_PANIC               policy<{'arm64': 'n'}>
+CONFIG_QCOM_WDT_CORE                            policy<{'arm64': 'y'}>
+CONFIG_QCS_CAMCC_615                            policy<{'arm64': 'm'}>
+CONFIG_QCS_DISPCC_615                           policy<{'arm64': 'm'}>
+CONFIG_QCS_GCC_404                              policy<{'arm64': 'y'}>
+CONFIG_QCS_GCC_615                              policy<{'arm64': 'y'}>
+CONFIG_QCS_GCC_8300                             policy<{'arm64': 'y'}>
+CONFIG_QCS_GPUCC_615                            policy<{'arm64': 'm'}>
+CONFIG_QCS_VIDEOCC_615                          policy<{'arm64': 'm'}>
+CONFIG_QORIQ_CPUFREQ                            policy<{'arm64': '-'}>
+CONFIG_QORIQ_THERMAL                            policy<{'arm64': '-'}>
+CONFIG_QTEE_SHM_BRIDGE                          policy<{'arm64': 'y'}>
+CONFIG_QTI_BCL_PMIC5                            policy<{'arm64': 'y'}>
+CONFIG_QTI_DEVFREQ_CDEV                         policy<{'arm64': 'm'}>
+CONFIG_QTI_TZ_LOG                               policy<{'arm64': 'm'}>
+CONFIG_RAVB                                     policy<{'arm64': '-'}>
+CONFIG_RCAR_DMAC                                policy<{'arm64': '-'}>
+CONFIG_RCAR_GEN3_THERMAL                        policy<{'arm64': '-'}>
+CONFIG_RCAR_REMOTEPROC                          policy<{'arm64': '-'}>
+CONFIG_RCAR_THERMAL                             policy<{'arm64': '-'}>
+CONFIG_RCU_CPU_STALL_TIMEOUT                    policy<{'arm64': '21'}>
+CONFIG_REGMAP_AC97                              policy<{'arm64': '-'}>
+CONFIG_REGMAP_SPMI                              policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_ANATOP                         policy<{'arm64': '-'}>
+CONFIG_REGULATOR_DEBUG_CONTROL                  policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_GPIO                           policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_HI655X                         policy<{'arm64': '-'}>
+CONFIG_REGULATOR_MT6380                         policy<{'arm64': '-'}>
+CONFIG_REGULATOR_PROXY_CONSUMER                 policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_PWM                            policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_QCOM_PM8008                    policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_QCOM_REFGEN                    policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_QCOM_RPMH                      policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_QCOM_SMD_RPM                   policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_QCOM_SPMI                      policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_QPNP_LCDB                      policy<{'arm64': 'y'}>
+CONFIG_REGULATOR_SC2731                         policy<{'arm64': '-'}>
+CONFIG_REGULATOR_STM32_BOOSTER                  policy<{'arm64': '-'}>
+CONFIG_REGULATOR_STM32_PWR                      policy<{'arm64': '-'}>
+CONFIG_REGULATOR_STM32_VREFBUF                  policy<{'arm64': '-'}>
+CONFIG_RENESAS_DMA                              policy<{'arm64': '-'}>
+CONFIG_RENESAS_ETHER_SWITCH                     policy<{'arm64': '-'}>
+CONFIG_RENESAS_GEN4_PTP                         policy<{'arm64': '-'}>
+CONFIG_RENESAS_IRQC                             policy<{'arm64': '-'}>
+CONFIG_RENESAS_OSTM                             policy<{'arm64': '-'}>
+CONFIG_RENESAS_RPCIF                            policy<{'arm64': '-'}>
+CONFIG_RENESAS_RZAWDT                           policy<{'arm64': '-'}>
+CONFIG_RENESAS_RZG2LWDT                         policy<{'arm64': '-'}>
+CONFIG_RENESAS_RZG2L_IRQC                       policy<{'arm64': '-'}>
+CONFIG_RENESAS_RZN1WDT                          policy<{'arm64': '-'}>
+CONFIG_RENESAS_USB_DMAC                         policy<{'arm64': '-'}>
+CONFIG_RENESAS_WDT                              policy<{'arm64': '-'}>
+CONFIG_RESET_A10SR                              policy<{'arm64': '-'}>
+CONFIG_RESET_BERLIN                             policy<{'arm64': '-'}>
+CONFIG_RESET_HISI                               policy<{'arm64': '-'}>
+CONFIG_RESET_IMX7                               policy<{'arm64': '-'}>
+CONFIG_RESET_MCHP_SPARX5                        policy<{'arm64': '-'}>
+CONFIG_RESET_MESON                              policy<{'arm64': '-'}>
+CONFIG_RESET_MESON_AUDIO_ARB                    policy<{'arm64': '-'}>
+CONFIG_RESET_NPCM                               policy<{'arm64': '-'}>
+CONFIG_RESET_NUVOTON_MA35D1                     policy<{'arm64': '-'}>
+CONFIG_RESET_RZG2L_USBPHY_CTRL                  policy<{'arm64': '-'}>
+CONFIG_RESET_SUNXI                              policy<{'arm64': '-'}>
+CONFIG_RESET_TEGRA_BPMP                         policy<{'arm64': '-'}>
+CONFIG_RESET_TI_SCI                             policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_ANALOGIX_DP                     policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_CDN_DP                          policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_DTPM                            policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_DW_HDMI                         policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_DW_MIPI_DSI                     policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_GRF                             policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_INNO_HDMI                       policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_IODOMAIN                        policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_IOMMU                           policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_LVDS                            policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_MBOX                            policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_PM_DOMAINS                      policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_RGB                             policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_RK3066_HDMI                     policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_SARADC                          policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_THERMAL                         policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_TIMER                           policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_VOP                             policy<{'arm64': '-'}>
+CONFIG_ROCKCHIP_VOP2                            policy<{'arm64': '-'}>
+CONFIG_RPMSG                                    policy<{'arm64': 'y'}>
+CONFIG_RPMSG_MTK_SCP                            policy<{'arm64': '-'}>
+CONFIG_RPMSG_QCOM_GLINK                         policy<{'arm64': 'y'}>
+CONFIG_RPMSG_QCOM_GLINK_RPM                     policy<{'arm64': 'y'}>
+CONFIG_RPMSG_QCOM_SMD                           policy<{'arm64': 'y'}>
+CONFIG_RST_RCAR                                 policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_ARMADA38X                        policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_BBNSM                            policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_FSL_FTM_ALARM                    policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_IMXDI                            policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_IMX_SC                           policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_MA35D1                           policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_MESON_VRTC                       policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_MT2712                           policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_MT7622                           policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_MV                               policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_MXC                              policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_MXC_V2                           policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_RTD119X                          policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_SC27XX                           policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_SH                               policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_SNVS                             policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_STM32                            policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_SUN6I                            policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_TEGRA                            policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_TI_K3                            policy<{'arm64': '-'}>
+CONFIG_RTC_DRV_XGENE                            policy<{'arm64': '-'}>
+CONFIG_RTD119X_WATCHDOG                         policy<{'arm64': '-'}>
+CONFIG_RZG2L_ADC                                policy<{'arm64': '-'}>
+CONFIG_RZG2L_THERMAL                            policy<{'arm64': '-'}>
+CONFIG_RZ_DMAC                                  policy<{'arm64': '-'}>
+CONFIG_RZ_MTU3                                  policy<{'arm64': '-'}>
+CONFIG_RZ_MTU3_CNT                              policy<{'arm64': '-'}>
+CONFIG_SATA_AHCI_SEATTLE                        policy<{'arm64': '-'}>
+CONFIG_SATA_RCAR                                policy<{'arm64': '-'}>
+CONFIG_SA_CAMCC_8775P                           policy<{'arm64': 'm'}>
+CONFIG_SA_DISPCC_8775P                          policy<{'arm64': 'm'}>
+CONFIG_SA_GCC_8775P                             policy<{'arm64': 'y'}>
+CONFIG_SA_VIDEOCC_8775P                         policy<{'arm64': 'm'}>
+CONFIG_SC27XX_ADC                               policy<{'arm64': '-'}>
+CONFIG_SCREEN_INFO                              policy<{'arm64': '-'}>
+CONFIG_SCSI_UFSHCD                              policy<{'arm64': 'y'}>
+CONFIG_SCSI_UFSHCD_PLATFORM                     policy<{'arm64': 'y'}>
+CONFIG_SCSI_UFS_HISI                            policy<{'arm64': '-'}>
+CONFIG_SCSI_UFS_MEDIATEK                        policy<{'arm64': '-'}>
+CONFIG_SCSI_UFS_QCOM                            policy<{'arm64': 'y'}>
+CONFIG_SCSI_UFS_RENESAS                         policy<{'arm64': '-'}>
+CONFIG_SCSI_UFS_SPRD                            policy<{'arm64': '-'}>
+CONFIG_SCSI_UFS_TI_J721E                        policy<{'arm64': '-'}>
+CONFIG_SC_CAMCC_7280                            policy<{'arm64': 'y'}>
+CONFIG_SC_DISPCC_7280                           policy<{'arm64': 'y'}>
+CONFIG_SC_GCC_7180                              policy<{'arm64': 'y'}>
+CONFIG_SC_GCC_7280                              policy<{'arm64': 'y'}>
+CONFIG_SC_GCC_8180X                             policy<{'arm64': 'y'}>
+CONFIG_SC_GCC_8280XP                            policy<{'arm64': 'y'}>
+CONFIG_SC_GPUCC_7280                            policy<{'arm64': 'y'}>
+CONFIG_SC_LPASS_CORECC_7280                     policy<{'arm64': 'y'}>
+CONFIG_SC_VIDEOCC_7280                          policy<{'arm64': 'y'}>
+CONFIG_SDM_DISPCC_845                           policy<{'arm64': 'y'}>
+CONFIG_SDM_GCC_845                              policy<{'arm64': 'y'}>
+CONFIG_SDM_GPUCC_845                            policy<{'arm64': 'y'}>
+CONFIG_SDM_VIDEOCC_845                          policy<{'arm64': 'y'}>
+CONFIG_SENSORS_EMC2305                          policy<{'arm64': 'y'}>
+CONFIG_SENSORS_SL28CPLD                         policy<{'arm64': '-'}>
+CONFIG_SENSORS_SPARX5                           policy<{'arm64': '-'}>
+CONFIG_SERIAL_8250_EM                           policy<{'arm64': '-'}>
+CONFIG_SERIAL_8250_EXAR                         policy<{'arm64': 'y'}>
+CONFIG_SERIAL_8250_MT6577                       policy<{'arm64': '-'}>
+CONFIG_SERIAL_8250_OMAP                         policy<{'arm64': '-'}>
+CONFIG_SERIAL_8250_OMAP_TTYO_FIXUP              policy<{'arm64': '-'}>
+CONFIG_SERIAL_8250_PERICOM                      policy<{'arm64': 'y'}>
+CONFIG_SERIAL_8250_TEGRA                        policy<{'arm64': '-'}>
+CONFIG_SERIAL_FSL_LINFLEXUART                   policy<{'arm64': 'y'}>
+CONFIG_SERIAL_FSL_LINFLEXUART_CONSOLE           policy<{'arm64': 'y'}>
+CONFIG_SERIAL_FSL_LPUART                        policy<{'arm64': 'y'}>
+CONFIG_SERIAL_FSL_LPUART_CONSOLE                policy<{'arm64': 'y'}>
+CONFIG_SERIAL_IMX                               policy<{'arm64': '-'}>
+CONFIG_SERIAL_IMX_CONSOLE                       policy<{'arm64': '-'}>
+CONFIG_SERIAL_IMX_EARLYCON                      policy<{'arm64': '-'}>
+CONFIG_SERIAL_MESON                             policy<{'arm64': '-'}>
+CONFIG_SERIAL_MESON_CONSOLE                     policy<{'arm64': '-'}>
+CONFIG_SERIAL_MVEBU_CONSOLE                     policy<{'arm64': '-'}>
+CONFIG_SERIAL_MVEBU_UART                        policy<{'arm64': '-'}>
+CONFIG_SERIAL_NUVOTON_MA35D1                    policy<{'arm64': '-'}>
+CONFIG_SERIAL_OWL                               policy<{'arm64': '-'}>
+CONFIG_SERIAL_OWL_CONSOLE                       policy<{'arm64': '-'}>
+CONFIG_SERIAL_QCOM_GENI                         policy<{'arm64': 'y'}>
+CONFIG_SERIAL_SAMSUNG                           policy<{'arm64': '-'}>
+CONFIG_SERIAL_SAMSUNG_CONSOLE                   policy<{'arm64': '-'}>
+CONFIG_SERIAL_SAMSUNG_UARTS                     policy<{'arm64': '-'}>
+CONFIG_SERIAL_SH_SCI_DMA                        policy<{'arm64': '-'}>
+CONFIG_SERIAL_SH_SCI_NR_UARTS                   policy<{'arm64': '-'}>
+CONFIG_SERIAL_STM32                             policy<{'arm64': '-'}>
+CONFIG_SERIAL_TEGRA                             policy<{'arm64': '-'}>
+CONFIG_SERIAL_TEGRA_TCU                         policy<{'arm64': '-'}>
+CONFIG_SERIAL_TEGRA_TCU_CONSOLE                 policy<{'arm64': '-'}>
+CONFIG_SERIAL_XILINX_PS_UART                    policy<{'arm64': 'y'}>
+CONFIG_SERIAL_XILINX_PS_UART_CONSOLE            policy<{'arm64': 'y'}>
+CONFIG_SERIO_AMBAKMI                            policy<{'arm64': 'y'}>
+CONFIG_SERIO_NVEC_PS2                           policy<{'arm64': '-'}>
+CONFIG_SERIO_SUN4I_PS2                          policy<{'arm64': '-'}>
+CONFIG_SH_ETH                                   policy<{'arm64': '-'}>
+CONFIG_SH_TIMER_CMT                             policy<{'arm64': '-'}>
+CONFIG_SH_TIMER_TMU                             policy<{'arm64': '-'}>
+CONFIG_SL28CPLD_WATCHDOG                        policy<{'arm64': '-'}>
+CONFIG_SLIC_DS26522                             policy<{'arm64': '-'}>
+CONFIG_SM_CAMCC_7150                            policy<{'arm64': 'n'}>
+CONFIG_SM_DISPCC_7150                           policy<{'arm64': 'n'}>
+CONFIG_SM_DISPCC_8250                           policy<{'arm64': 'y'}>
+CONFIG_SM_DISPCC_8650                           policy<{'arm64': 'y'}>
+CONFIG_SM_GCC_6115                              policy<{'arm64': 'y'}>
+CONFIG_SM_GCC_8150                              policy<{'arm64': 'y'}>
+CONFIG_SM_GCC_8250                              policy<{'arm64': 'y'}>
+CONFIG_SM_GCC_8350                              policy<{'arm64': 'y'}>
+CONFIG_SM_GCC_8450                              policy<{'arm64': 'y'}>
+CONFIG_SM_GCC_8550                              policy<{'arm64': 'y'}>
+CONFIG_SM_GCC_8650                              policy<{'arm64': 'y'}>
+CONFIG_SM_GPUCC_8150                            policy<{'arm64': 'y'}>
+CONFIG_SM_GPUCC_8250                            policy<{'arm64': 'y'}>
+CONFIG_SM_GPUCC_8650                            policy<{'arm64': 'y'}>
+CONFIG_SM_TCSRCC_8550                           policy<{'arm64': 'y'}>
+CONFIG_SM_TCSRCC_8650                           policy<{'arm64': 'y'}>
+CONFIG_SM_VIDEOCC_7150                          policy<{'arm64': 'n'}>
+CONFIG_SM_VIDEOCC_8250                          policy<{'arm64': 'y'}>
+CONFIG_SND_HDA_ALIGNED_MMIO                     policy<{'arm64': '-'}>
+CONFIG_SND_HDA_TEGRA                            policy<{'arm64': '-'}>
+CONFIG_SND_IMX_SOC                              policy<{'arm64': '-'}>
+CONFIG_SND_KIRKWOOD_SOC                         policy<{'arm64': '-'}>
+CONFIG_SND_KIRKWOOD_SOC_ARMADA370_DB            policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AIU                            policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_FIFO                       policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_FRDDR                      policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_PDM                        policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_SOUND_CARD                 policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_SPDIFIN                    policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_SPDIFOUT                   policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_TDMIN                      policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_TDMOUT                     policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_TDM_FORMATTER              policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_TDM_INTERFACE              policy<{'arm64': '-'}>
+CONFIG_SND_MESON_AXG_TODDR                      policy<{'arm64': '-'}>
+CONFIG_SND_MESON_CARD_UTILS                     policy<{'arm64': '-'}>
+CONFIG_SND_MESON_CODEC_GLUE                     policy<{'arm64': '-'}>
+CONFIG_SND_MESON_G12A_TOACODEC                  policy<{'arm64': '-'}>
+CONFIG_SND_MESON_G12A_TOHDMITX                  policy<{'arm64': '-'}>
+CONFIG_SND_MESON_GX_SOUND_CARD                  policy<{'arm64': '-'}>
+CONFIG_SND_SOC_ALC5632                          policy<{'arm64': '-'}>
+CONFIG_SND_SOC_APPLE_MCA                        policy<{'arm64': '-'}>
+CONFIG_SND_SOC_AUDIO_PKT                        policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_DAVINCI_MCASP                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_FSL_ASOC_CARD                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_FSL_AUD2HTX                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_AUDIO_RPMSG                  policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_AUDMIX                       policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_CARD                         policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_ES8328                       policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_HDMI                         policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_PCM_DMA                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_PCM_RPMSG                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_RPMSG                        policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_SGTL5000                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_IMX_SPDIF                        policy<{'arm64': '-'}>
+CONFIG_SND_SOC_INTEL_KEEMBAY                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_J721E_EVM                        policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MEDIATEK                         policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MESON_T9015                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MSM_AUDIO_MEM                    policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_MSM_STUB                         policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_MT2701                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT6359                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT6359_ACCDET                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT6797                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT6797_MT6351                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT7986                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT7986_WM8960                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8173                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8183                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8183_DA7219_MAX98357A          policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8183_MT6358_TS3A227E_MAX98357A policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8186                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8186_MT6366_DA7219_MAX98357    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8186_MT6366_RT1019_RT5682S     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8188                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8188_MT6359                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8192                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8192_MT6359_RT1015_RT5682      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8195                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_MT8195_MT6359                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_NAU8825                          policy<{'arm64': '-'}>
+CONFIG_SND_SOC_QCM6490                          policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_QCS9100                          policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_RCAR                             policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RK3288_HDMI_ANALOG               policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RK3399_GRU_SOUND                 policy<{'arm64': '-'}>
+CONFIG_SND_SOC_ROCKCHIP                         policy<{'arm64': '-'}>
+CONFIG_SND_SOC_ROCKCHIP_I2S                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_ROCKCHIP_I2S_TDM                 policy<{'arm64': '-'}>
+CONFIG_SND_SOC_ROCKCHIP_MAX98090                policy<{'arm64': '-'}>
+CONFIG_SND_SOC_ROCKCHIP_PDM                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_ROCKCHIP_RT5645                  policy<{'arm64': '-'}>
+CONFIG_SND_SOC_ROCKCHIP_SPDIF                   policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RT1011                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RT1015                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RT1015P                          policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RT5514                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RT5514_SPI                       policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RT5677                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RT5677_SPI                       policy<{'arm64': '-'}>
+CONFIG_SND_SOC_RZ                               policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SH4_FSI                          policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF                              policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_COMPRESS                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_DEVELOPER_SUPPORT            policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_IMX8                         policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_IMX8M                        policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_IMX8ULP                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_IMX_COMMON                   policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_IPC3                         policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_MT8186                       policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_MT8195                       policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_MTK_COMMON                   policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_OF_DEV                       policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SOF_XTENSA                       policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SPF_CORE                         policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_SPRD                             policy<{'arm64': '-'}>
+CONFIG_SND_SOC_SPRD_MCDT                        policy<{'arm64': '-'}>
+CONFIG_SND_SOC_STM32_DFSDM                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_STM32_I2S                        policy<{'arm64': '-'}>
+CONFIG_SND_SOC_STM32_SAI                        policy<{'arm64': '-'}>
+CONFIG_SND_SOC_STM32_SPDIFRX                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA                            policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA186_ASRC                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA186_DSPK                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA20_AC97                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA20_DAS                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA20_I2S                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA20_SPDIF                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_ADMAIF                  policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_ADX                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_AHUB                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_AMX                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_DMIC                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_I2S                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_MIXER                   policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_MVC                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_OPE                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA210_SFC                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA30_AHUB                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA30_I2S                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_ALC5632                    policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_AUDIO_GRAPH_CARD           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_MACHINE_DRV                policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_MAX98088                   policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_MAX98090                   policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_RT5631                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_RT5640                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_RT5677                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_SGTL5000                   policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_TRIMSLICE                  policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_WM8753                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_WM8903                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TEGRA_WM9712                     policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TI_EDMA_PCM                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TI_SDMA_PCM                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_TI_UDMA_PCM                      policy<{'arm64': '-'}>
+CONFIG_SND_SOC_WCD937X                          policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_WCD937X_SDW                      policy<{'arm64': 'm'}>
+CONFIG_SND_SOC_WM8994                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_WM9712                           policy<{'arm64': '-'}>
+CONFIG_SND_SOC_WM_HUBS                          policy<{'arm64': '-'}>
+CONFIG_SND_SUN4I_CODEC                          policy<{'arm64': '-'}>
+CONFIG_SND_SUN4I_I2S                            policy<{'arm64': '-'}>
+CONFIG_SND_SUN4I_SPDIF                          policy<{'arm64': '-'}>
+CONFIG_SND_SUN50I_CODEC_ANALOG                  policy<{'arm64': '-'}>
+CONFIG_SND_SUN50I_DMIC                          policy<{'arm64': '-'}>
+CONFIG_SND_SUN8I_ADDA_PR_REGMAP                 policy<{'arm64': '-'}>
+CONFIG_SND_SUN8I_CODEC                          policy<{'arm64': '-'}>
+CONFIG_SND_SUN8I_CODEC_ANALOG                   policy<{'arm64': '-'}>
+CONFIG_SNI_NETSEC                               policy<{'arm64': '-'}>
+CONFIG_SOCFPGA_FPGA_BRIDGE                      policy<{'arm64': '-'}>
+CONFIG_SOC_IMX8M                                policy<{'arm64': '-'}>
+CONFIG_SOC_IMX9                                 policy<{'arm64': '-'}>
+CONFIG_SOC_RENESAS                              policy<{'arm64': '-'}>
+CONFIG_SOC_TEGRA_CBB                            policy<{'arm64': '-'}>
+CONFIG_SOC_TEGRA_FLOWCTRL                       policy<{'arm64': '-'}>
+CONFIG_SOC_TEGRA_FUSE                           policy<{'arm64': '-'}>
+CONFIG_SOC_TEGRA_PMC                            policy<{'arm64': '-'}>
+CONFIG_SOC_TEGRA_POWERGATE_BPMP                 policy<{'arm64': '-'}>
+CONFIG_SPARX5_DCB                               policy<{'arm64': '-'}>
+CONFIG_SPARX5_SWITCH                            policy<{'arm64': '-'}>
+CONFIG_SPI_AMLOGIC_SPIFC_A1                     policy<{'arm64': '-'}>
+CONFIG_SPI_ARMADA_3700                          policy<{'arm64': '-'}>
+CONFIG_SPI_FSL_DSPI                             policy<{'arm64': '-'}>
+CONFIG_SPI_FSL_LPSPI                            policy<{'arm64': '-'}>
+CONFIG_SPI_FSL_QUADSPI                          policy<{'arm64': '-'}>
+CONFIG_SPI_HISI_SFC                             policy<{'arm64': '-'}>
+CONFIG_SPI_IMX                                  policy<{'arm64': '-'}>
+CONFIG_SPI_MESON_SPICC                          policy<{'arm64': '-'}>
+CONFIG_SPI_MESON_SPIFC                          policy<{'arm64': '-'}>
+CONFIG_SPI_MT65XX                               policy<{'arm64': '-'}>
+CONFIG_SPI_MTK_NOR                              policy<{'arm64': '-'}>
+CONFIG_SPI_MTK_SNFI                             policy<{'arm64': '-'}>
+CONFIG_SPI_NPCM_FIU                             policy<{'arm64': '-'}>
+CONFIG_SPI_NPCM_PSPI                            policy<{'arm64': '-'}>
+CONFIG_SPI_NXP_FLEXSPI                          policy<{'arm64': '-'}>
+CONFIG_SPI_OMAP24XX                             policy<{'arm64': '-'}>
+CONFIG_SPI_ORION                                policy<{'arm64': '-'}>
+CONFIG_SPI_QUP                                  policy<{'arm64': 'y'}>
+CONFIG_SPI_ROCKCHIP                             policy<{'arm64': '-'}>
+CONFIG_SPI_ROCKCHIP_SFC                         policy<{'arm64': '-'}>
+CONFIG_SPI_RPCIF                                policy<{'arm64': '-'}>
+CONFIG_SPI_RSPI                                 policy<{'arm64': '-'}>
+CONFIG_SPI_RZV2M_CSI                            policy<{'arm64': '-'}>
+CONFIG_SPI_SH_HSPI                              policy<{'arm64': '-'}>
+CONFIG_SPI_SH_MSIOF                             policy<{'arm64': '-'}>
+CONFIG_SPI_SLAVE_MT27XX                         policy<{'arm64': '-'}>
+CONFIG_SPI_SPRD                                 policy<{'arm64': '-'}>
+CONFIG_SPI_SPRD_ADI                             policy<{'arm64': '-'}>
+CONFIG_SPI_STM32                                policy<{'arm64': '-'}>
+CONFIG_SPI_STM32_QSPI                           policy<{'arm64': '-'}>
+CONFIG_SPI_SUN4I                                policy<{'arm64': '-'}>
+CONFIG_SPI_SUN6I                                policy<{'arm64': '-'}>
+CONFIG_SPI_SYNQUACER                            policy<{'arm64': '-'}>
+CONFIG_SPI_TEGRA114                             policy<{'arm64': '-'}>
+CONFIG_SPI_TEGRA20_SFLASH                       policy<{'arm64': '-'}>
+CONFIG_SPI_TEGRA20_SLINK                        policy<{'arm64': '-'}>
+CONFIG_SPI_TEGRA210_QUAD                        policy<{'arm64': '-'}>
+CONFIG_SPI_WPCM_FIU                             policy<{'arm64': '-'}>
+CONFIG_SPI_XLP                                  policy<{'arm64': '-'}>
+CONFIG_SPMI                                     policy<{'arm64': 'y'}>
+CONFIG_SPMI_MSM_PMIC_ARB                        policy<{'arm64': 'y'}>
+CONFIG_SPMI_MTK_PMIF                            policy<{'arm64': '-'}>
+CONFIG_SPRD_COMMON_CLK                          policy<{'arm64': '-'}>
+CONFIG_SPRD_DMA                                 policy<{'arm64': '-'}>
+CONFIG_SPRD_IOMMU                               policy<{'arm64': '-'}>
+CONFIG_SPRD_MBOX                                policy<{'arm64': '-'}>
+CONFIG_SPRD_SC9860_CLK                          policy<{'arm64': '-'}>
+CONFIG_SPRD_SC9863A_CLK                         policy<{'arm64': '-'}>
+CONFIG_SPRD_THERMAL                             policy<{'arm64': '-'}>
+CONFIG_SPRD_TIMER                               policy<{'arm64': '-'}>
+CONFIG_SPRD_UMS512_CLK                          policy<{'arm64': '-'}>
+CONFIG_SPRD_WATCHDOG                            policy<{'arm64': '-'}>
+CONFIG_STACKDEPOT_ALWAYS_INIT                   policy<{'arm64': 'y'}>
+CONFIG_STM32_ADC                                policy<{'arm64': '-'}>
+CONFIG_STM32_ADC_CORE                           policy<{'arm64': '-'}>
+CONFIG_STM32_DAC                                policy<{'arm64': '-'}>
+CONFIG_STM32_DAC_CORE                           policy<{'arm64': '-'}>
+CONFIG_STM32_DFSDM_ADC                          policy<{'arm64': '-'}>
+CONFIG_STM32_DFSDM_CORE                         policy<{'arm64': '-'}>
+CONFIG_STM32_DMA                                policy<{'arm64': '-'}>
+CONFIG_STM32_DMAMUX                             policy<{'arm64': '-'}>
+CONFIG_STM32_FMC2_EBI                           policy<{'arm64': '-'}>
+CONFIG_STM32_LPTIMER_CNT                        policy<{'arm64': '-'}>
+CONFIG_STM32_MDMA                               policy<{'arm64': '-'}>
+CONFIG_STM32_RPROC                              policy<{'arm64': '-'}>
+CONFIG_STM32_TIMER_CNT                          policy<{'arm64': '-'}>
+CONFIG_STM32_WATCHDOG                           policy<{'arm64': '-'}>
+CONFIG_STMP_DEVICE                              policy<{'arm64': '-'}>
+CONFIG_STM_PROTO_OST                            policy<{'arm64': 'm'}>
+CONFIG_STUB_CLK_HI3660                          policy<{'arm64': '-'}>
+CONFIG_STUB_CLK_HI6220                          policy<{'arm64': '-'}>
+CONFIG_ST_THERMAL                               policy<{'arm64': '-'}>
+CONFIG_ST_THERMAL_MEMMAP                        policy<{'arm64': '-'}>
+CONFIG_SUN20I_GPADC                             policy<{'arm64': '-'}>
+CONFIG_SUN20I_PPU                               policy<{'arm64': '-'}>
+CONFIG_SUN4I_EMAC                               policy<{'arm64': '-'}>
+CONFIG_SUN4I_GPADC                              policy<{'arm64': '-'}>
+CONFIG_SUN4I_TIMER                              policy<{'arm64': '-'}>
+CONFIG_SUN50I_A100_CCU                          policy<{'arm64': '-'}>
+CONFIG_SUN50I_A100_R_CCU                        policy<{'arm64': '-'}>
+CONFIG_SUN50I_A64_CCU                           policy<{'arm64': '-'}>
+CONFIG_SUN50I_DE2_BUS                           policy<{'arm64': '-'}>
+CONFIG_SUN50I_ERRATUM_UNKNOWN1                  policy<{'arm64': '-'}>
+CONFIG_SUN50I_H616_CCU                          policy<{'arm64': '-'}>
+CONFIG_SUN50I_H6_CCU                            policy<{'arm64': '-'}>
+CONFIG_SUN50I_H6_R_CCU                          policy<{'arm64': '-'}>
+CONFIG_SUN50I_IOMMU                             policy<{'arm64': '-'}>
+CONFIG_SUN6I_MSGBOX                             policy<{'arm64': '-'}>
+CONFIG_SUN6I_R_INTC                             policy<{'arm64': '-'}>
+CONFIG_SUN8I_DE2_CCU                            policy<{'arm64': '-'}>
+CONFIG_SUN8I_H3_CCU                             policy<{'arm64': '-'}>
+CONFIG_SUN8I_R_CCU                              policy<{'arm64': '-'}>
+CONFIG_SUN8I_THERMAL                            policy<{'arm64': '-'}>
+CONFIG_SUNXI_CCU                                policy<{'arm64': '-'}>
+CONFIG_SUNXI_MBUS                               policy<{'arm64': '-'}>
+CONFIG_SUNXI_NMI_INTC                           policy<{'arm64': '-'}>
+CONFIG_SUNXI_RSB                                policy<{'arm64': '-'}>
+CONFIG_SUNXI_SRAM                               policy<{'arm64': '-'}>
+CONFIG_SUNXI_WATCHDOG                           policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A774A1                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A774B1                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A774C0                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A774E1                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A7795                             policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A77960                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A77961                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A77965                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A77970                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A77980                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A77990                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A77995                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A779A0                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A779F0                            policy<{'arm64': '-'}>
+CONFIG_SYSC_R8A779G0                            policy<{'arm64': '-'}>
+CONFIG_SYSC_RCAR                                policy<{'arm64': '-'}>
+CONFIG_SYSC_RCAR_GEN4                           policy<{'arm64': '-'}>
+CONFIG_SYSFB                                    policy<{'arm64': '-'}>
+CONFIG_SYS_SUPPORTS_SH_CMT                      policy<{'arm64': '-'}>
+CONFIG_SYS_SUPPORTS_SH_TMU                      policy<{'arm64': '-'}>
+CONFIG_TCG_TIS_SYNQUACER                        policy<{'arm64': '-'}>
+CONFIG_TEE_STMM_EFI                             policy<{'arm64': 'n'}>
+CONFIG_TEGRA186_GPC_DMA                         policy<{'arm64': '-'}>
+CONFIG_TEGRA186_TIMER                           policy<{'arm64': '-'}>
+CONFIG_TEGRA20_APB_DMA                          policy<{'arm64': '-'}>
+CONFIG_TEGRA210_ADMA                            policy<{'arm64': '-'}>
+CONFIG_TEGRA210_EMC                             policy<{'arm64': '-'}>
+CONFIG_TEGRA210_EMC_TABLE                       policy<{'arm64': '-'}>
+CONFIG_TEGRA_ACONNECT                           policy<{'arm64': '-'}>
+CONFIG_TEGRA_AHB                                policy<{'arm64': '-'}>
+CONFIG_TEGRA_BPMP                               policy<{'arm64': '-'}>
+CONFIG_TEGRA_BPMP_THERMAL                       policy<{'arm64': '-'}>
+CONFIG_TEGRA_CLK_DFLL                           policy<{'arm64': '-'}>
+CONFIG_TEGRA_GMI                                policy<{'arm64': '-'}>
+CONFIG_TEGRA_HOST1X                             policy<{'arm64': '-'}>
+CONFIG_TEGRA_HOST1X_CONTEXT_BUS                 policy<{'arm64': '-'}>
+CONFIG_TEGRA_HOST1X_FIREWALL                    policy<{'arm64': '-'}>
+CONFIG_TEGRA_HSP_MBOX                           policy<{'arm64': '-'}>
+CONFIG_TEGRA_IOMMU_SMMU                         policy<{'arm64': '-'}>
+CONFIG_TEGRA_IVC                                policy<{'arm64': '-'}>
+CONFIG_TEGRA_MC                                 policy<{'arm64': '-'}>
+CONFIG_TEGRA_SOCTHERM                           policy<{'arm64': '-'}>
+CONFIG_TEGRA_TIMER                              policy<{'arm64': '-'}>
+CONFIG_TEGRA_WATCHDOG                           policy<{'arm64': '-'}>
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS      policy<{'arm64': '10000'}>
+CONFIG_THUNDERX2_PMU                            policy<{'arm64': '-'}>
+CONFIG_TIMER_IMX_SYS_CTR                        policy<{'arm64': '-'}>
+CONFIG_TI_AM335X_ADC                            policy<{'arm64': '-'}>
+CONFIG_TI_AM65_CPSW_QOS                         policy<{'arm64': '-'}>
+CONFIG_TI_AM65_CPSW_TAS                         policy<{'arm64': '-'}>
+CONFIG_TI_DAVINCI_MDIO                          policy<{'arm64': '-'}>
+CONFIG_TI_ECAP_CAPTURE                          policy<{'arm64': '-'}>
+CONFIG_TI_ICSSG_PRUETH                          policy<{'arm64': '-'}>
+CONFIG_TI_ICSS_IEP                              policy<{'arm64': '-'}>
+CONFIG_TI_K3_AM65_CPSW_NUSS                     policy<{'arm64': '-'}>
+CONFIG_TI_K3_AM65_CPSW_SWITCHDEV                policy<{'arm64': '-'}>
+CONFIG_TI_K3_AM65_CPTS                          policy<{'arm64': '-'}>
+CONFIG_TI_K3_CPPI_DESC_POOL                     policy<{'arm64': '-'}>
+CONFIG_TI_K3_DSP_REMOTEPROC                     policy<{'arm64': '-'}>
+CONFIG_TI_K3_PSIL                               policy<{'arm64': '-'}>
+CONFIG_TI_K3_R5_REMOTEPROC                      policy<{'arm64': '-'}>
+CONFIG_TI_K3_RINGACC                            policy<{'arm64': '-'}>
+CONFIG_TI_K3_SOCINFO                            policy<{'arm64': '-'}>
+CONFIG_TI_K3_UDMA                               policy<{'arm64': '-'}>
+CONFIG_TI_K3_UDMA_GLUE_LAYER                    policy<{'arm64': '-'}>
+CONFIG_TI_MESSAGE_MANAGER                       policy<{'arm64': '-'}>
+CONFIG_TI_PRUSS                                 policy<{'arm64': '-'}>
+CONFIG_TI_PRUSS_INTC                            policy<{'arm64': '-'}>
+CONFIG_TI_SCI_CLK                               policy<{'arm64': '-'}>
+CONFIG_TI_SCI_CLK_PROBE_FROM_FW                 policy<{'arm64': '-'}>
+CONFIG_TI_SCI_INTA_IRQCHIP                      policy<{'arm64': '-'}>
+CONFIG_TI_SCI_INTA_MSI_DOMAIN                   policy<{'arm64': '-'}>
+CONFIG_TI_SCI_INTR_IRQCHIP                      policy<{'arm64': '-'}>
+CONFIG_TI_SCI_PM_DOMAINS                        policy<{'arm64': '-'}>
+CONFIG_TI_SCI_PROTOCOL                          policy<{'arm64': '-'}>
+CONFIG_TI_SYSC                                  policy<{'arm64': '-'}>
+CONFIG_TI_SYSCON_CLK                            policy<{'arm64': '-'}>
+CONFIG_TOUCHSCREEN_GOODIX_BERLIN_I2C            policy<{'arm64': 'n'}>
+CONFIG_TOUCHSCREEN_GOODIX_BERLIN_SPI            policy<{'arm64': 'n'}>
+CONFIG_TOUCHSCREEN_SUN4I                        policy<{'arm64': '-'}>
+CONFIG_TOUCHSCREEN_TI_AM335X_TSC                policy<{'arm64': '-'}>
+CONFIG_TURRIS_MOX_RWTM                          policy<{'arm64': '-'}>
+CONFIG_USB_CDNS3_IMX                            policy<{'arm64': '-'}>
+CONFIG_USB_CDNS3_TI                             policy<{'arm64': '-'}>
+CONFIG_USB_DWC3_AM62                            policy<{'arm64': '-'}>
+CONFIG_USB_DWC3_IMX8MP                          policy<{'arm64': '-'}>
+CONFIG_USB_DWC3_KEYSTONE                        policy<{'arm64': '-'}>
+CONFIG_USB_DWC3_MESON_G12A                      policy<{'arm64': '-'}>
+CONFIG_USB_DWC3_RTK                             policy<{'arm64': '-'}>
+CONFIG_USB_DWC3_XILINX                          policy<{'arm64': '-'}>
+CONFIG_USB_EHCI_HCD_NPCM7XX                     policy<{'arm64': '-'}>
+CONFIG_USB_EHCI_HCD_ORION                       policy<{'arm64': '-'}>
+CONFIG_USB_EHCI_TEGRA                           policy<{'arm64': '-'}>
+CONFIG_USB_EMXX                                 policy<{'arm64': '-'}>
+CONFIG_USB_F_QDSS                               policy<{'arm64': 'm'}>
+CONFIG_USB_HUB_USB5807                          policy<{'arm64': 'm'}>
+CONFIG_USB_MTU3                                 policy<{'arm64': '-'}>
+CONFIG_USB_MTU3_DEBUG                           policy<{'arm64': '-'}>
+CONFIG_USB_MTU3_DUAL_ROLE                       policy<{'arm64': '-'}>
+CONFIG_USB_MTU3_GADGET                          policy<{'arm64': '-'}>
+CONFIG_USB_MTU3_HOST                            policy<{'arm64': '-'}>
+CONFIG_USB_MUSB_MEDIATEK                        policy<{'arm64': '-'}>
+CONFIG_USB_MUSB_SUNXI                           policy<{'arm64': '-'}>
+CONFIG_USB_MXS_PHY                              policy<{'arm64': '-'}>
+CONFIG_USB_RENESAS_USB3                         policy<{'arm64': '-'}>
+CONFIG_USB_RENESAS_USBF                         policy<{'arm64': '-'}>
+CONFIG_USB_RENESAS_USBHS                        policy<{'arm64': '-'}>
+CONFIG_USB_RENESAS_USBHS_HCD                    policy<{'arm64': '-'}>
+CONFIG_USB_RENESAS_USBHS_UDC                    policy<{'arm64': '-'}>
+CONFIG_USB_RZV2M_USB3DRD                        policy<{'arm64': '-'}>
+CONFIG_USB_TEGRA_PHY                            policy<{'arm64': '-'}>
+CONFIG_USB_TEGRA_XUDC                           policy<{'arm64': '-'}>
+CONFIG_USB_XHCI_HISTB                           policy<{'arm64': '-'}>
+CONFIG_USB_XHCI_MTK                             policy<{'arm64': '-'}>
+CONFIG_USB_XHCI_MVEBU                           policy<{'arm64': '-'}>
+CONFIG_USB_XHCI_RCAR                            policy<{'arm64': '-'}>
+CONFIG_USB_XHCI_RZV2M                           policy<{'arm64': '-'}>
+CONFIG_USB_XHCI_TEGRA                           policy<{'arm64': '-'}>
+CONFIG_V4L2_H264                                policy<{'arm64': '-'}>
+CONFIG_V4L2_JPEG_HELPER                         policy<{'arm64': '-'}>
+CONFIG_V4L2_VP9                                 policy<{'arm64': '-'}>
+CONFIG_VFIO_FSL_MC                              policy<{'arm64': '-'}>
+CONFIG_VIDEO_ALLEGRO_DVT                        policy<{'arm64': '-'}>
+CONFIG_VIDEO_AMPHION_VPU                        policy<{'arm64': '-'}>
+CONFIG_VIDEO_CODA                               policy<{'arm64': '-'}>
+CONFIG_VIDEO_DW100                              policy<{'arm64': '-'}>
+CONFIG_VIDEO_HANTRO                             policy<{'arm64': '-'}>
+CONFIG_VIDEO_HANTRO_IMX8M                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_HANTRO_ROCKCHIP                    policy<{'arm64': '-'}>
+CONFIG_VIDEO_HANTRO_SUNXI                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_IMX7_CSI                           policy<{'arm64': '-'}>
+CONFIG_VIDEO_IMX8MQ_MIPI_CSI2                   policy<{'arm64': '-'}>
+CONFIG_VIDEO_IMX8_ISI                           policy<{'arm64': '-'}>
+CONFIG_VIDEO_IMX8_ISI_M2M                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_IMX8_JPEG                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_IMX_MIPI_CSIS                      policy<{'arm64': '-'}>
+CONFIG_VIDEO_IMX_PXP                            policy<{'arm64': '-'}>
+CONFIG_VIDEO_MEDIATEK_JPEG                      policy<{'arm64': '-'}>
+CONFIG_VIDEO_MEDIATEK_MDP                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_MEDIATEK_MDP3                      policy<{'arm64': '-'}>
+CONFIG_VIDEO_MEDIATEK_VCODEC                    policy<{'arm64': '-'}>
+CONFIG_VIDEO_MEDIATEK_VPU                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_MESON_GE2D                         policy<{'arm64': '-'}>
+CONFIG_VIDEO_MESON_VDEC                         policy<{'arm64': '-'}>
+CONFIG_VIDEO_NPCM_VCD_ECE                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_QCOM_IRIS                          policy<{'arm64': 'm'}>
+CONFIG_VIDEO_RCAR_CSI2                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_RCAR_DRIF                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_RCAR_ISP                           policy<{'arm64': '-'}>
+CONFIG_VIDEO_RCAR_VIN                           policy<{'arm64': '-'}>
+CONFIG_VIDEO_RENESAS_FCP                        policy<{'arm64': '-'}>
+CONFIG_VIDEO_RENESAS_FDP1                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_RENESAS_JPU                        policy<{'arm64': '-'}>
+CONFIG_VIDEO_RENESAS_VSP1                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_ROCKCHIP_ISP1                      policy<{'arm64': '-'}>
+CONFIG_VIDEO_ROCKCHIP_RGA                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_ROCKCHIP_VDEC                      policy<{'arm64': '-'}>
+CONFIG_VIDEO_RZG2L_CRU                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_RZG2L_CSI2                         policy<{'arm64': '-'}>
+CONFIG_VIDEO_STM32_DCMI                         policy<{'arm64': '-'}>
+CONFIG_VIDEO_STM32_DCMIPP                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_STM32_DMA2D                        policy<{'arm64': '-'}>
+CONFIG_VIDEO_SUN4I_CSI                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_SUN6I_CSI                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_SUN6I_ISP                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_SUN6I_MIPI_CSI2                    policy<{'arm64': '-'}>
+CONFIG_VIDEO_SUN8I_A83T_MIPI_CSI2               policy<{'arm64': '-'}>
+CONFIG_VIDEO_SUN8I_DEINTERLACE                  policy<{'arm64': '-'}>
+CONFIG_VIDEO_SUN8I_ROTATE                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_SUNXI                              policy<{'arm64': '-'}>
+CONFIG_VIDEO_SUNXI_CEDRUS                       policy<{'arm64': '-'}>
+CONFIG_VIDEO_TEGRA                              policy<{'arm64': '-'}>
+CONFIG_VIDEO_TEGRA_TPG                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_TEGRA_VDE                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_TI_CAL                             policy<{'arm64': '-'}>
+CONFIG_VIDEO_TI_CAL_MC                          policy<{'arm64': '-'}>
+CONFIG_VIDEO_TI_J721E_CSI2RX                    policy<{'arm64': '-'}>
+CONFIG_VIDEO_WAVE_VPU                           policy<{'arm64': '-'}>
+CONFIG_VISCONTI_WATCHDOG                        policy<{'arm64': '-'}>
+CONFIG_W1_MASTER_MXC                            policy<{'arm64': '-'}>
+CONFIG_XGENE_DMA                                policy<{'arm64': '-'}>
+CONFIG_XGENE_PMU                                policy<{'arm64': '-'}>
+CONFIG_XGENE_SLIMPRO_MBOX                       policy<{'arm64': '-'}>
+CONFIG_XILINX_AMS                               policy<{'arm64': '-'}>
+CONFIG_XLNX_EVENT_MANAGER                       policy<{'arm64': '-'}>
+CONFIG_XLNX_R5_REMOTEPROC                       policy<{'arm64': '-'}>
+CONFIG_ZYNQMP_FIRMWARE                          policy<{'arm64': '-'}>
+CONFIG_ZYNQMP_FIRMWARE_DEBUG                    policy<{'arm64': '-'}>
+CONFIG_ZYNQMP_IPI_MBOX                          policy<{'arm64': '-'}>
+CONFIG_ZYNQMP_PM_DOMAINS                        policy<{'arm64': '-'}>
+CONFIG_ZYNQMP_POWER                             policy<{'arm64': '-'}>
--- linux-qcom-6.8.0.orig/debian.qcom/control.d/flavour-control.stub
+++ linux-qcom-6.8.0/debian.qcom/control.d/flavour-control.stub
@@ -0,0 +1,120 @@
+# Items that get replaced:
+# FLAVOUR
+# DESC
+# ARCH
+# SUPPORTED
+# TARGET
+# BOOTLOADER
+# =PROVIDES=
+#
+# Items marked with =FOO= are optional
+#
+# This file describes the template for packages that are created for each flavour
+# in debian/control.d/vars.*
+#
+# This file gets edited in a couple of places. See the debian/control.stub rule in
+# debian/rules. PGGVER, ABINUM, and SRCPKGNAME are all converted in the
+# process of creating debian/control.
+#
+# The flavour specific strings (ARCH, DESC, etc) are converted using values from the various
+# flavour files in debian/control.d/vars.*
+#
+# XXX: Leave the blank line before the first package!!
+
+Package: linux-image=SIGN-ME-PKG=-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: kernel
+Priority: optional
+Provides: linux-image, fuse-module, =PROVIDES=${linux:rprovides}
+Depends: ${misc:Depends}, ${shlibs:Depends}, kmod, linux-base (>= 4.5ubuntu1~16.04.1), linux-modules-PKGVER-ABINUM-FLAVOUR
+Recommends: BOOTLOADER, initramfs-tools | linux-initramfs-tool
+Breaks: flash-kernel (<< 3.90ubuntu2) [arm64 armhf], s390-tools (<< 2.3.0-0ubuntu3) [s390x]
+Conflicts: linux-image=SIGN-PEER-PKG=-PKGVER-ABINUM-FLAVOUR
+Suggests: fdutils, SRCPKGNAME-tools, linux-headers-PKGVER-ABINUM-FLAVOUR
+Description: Linux kernel image for version PKGVER on DESC
+ This package contains the=SIGN-ME-TXT= Linux kernel image for version PKGVER on
+ DESC.
+ .
+ Supports SUPPORTED processors.
+ .
+ TARGET
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-FLAVOUR meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-modules-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: kernel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Built-Using: ${linux:BuiltUsing}
+Description: Linux kernel modules for version PKGVER on DESC
+ Contains the corresponding System.map file, the modules built by the
+ packager, and scripts that try to ensure that the system is not left in an
+ unbootable state after an update.
+ .
+ Supports SUPPORTED processors.
+ .
+ TARGET
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-FLAVOUR meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-headers-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, SRCPKGNAME-headers-PKGVER-ABINUM, ${shlibs:Depends}
+Provides: linux-headers, linux-headers-3.0
+Description: Linux kernel headers for version PKGVER on DESC
+ This package provides kernel header files for version PKGVER on
+ DESC.
+ .
+ This is for sites that want the latest kernel headers.  Please read
+ /usr/share/doc/linux-headers-PKGVER-ABINUM/debian.README.gz for details.
+
+Package: SRCPKGNAME-lib-rust-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: arm64
+Multi-Arch: foreign
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, coreutils
+Description: Rust library files related to Linux kernel version PKGVER
+ This package provides kernel library files for version PKGVER, that allow to
+ compile out-of-tree kernel modules written in Rust.
+
+Package: linux-image=SIGN-ME-PKG=-PKGVER-ABINUM-FLAVOUR-dbgsym
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}
+Provides: linux-debug
+Description: Linux kernel debug image for version PKGVER on DESC
+ This package provides the=SIGN-ME-TXT= kernel debug image for version PKGVER on
+ DESC.
+ .
+ This is for sites that wish to debug the kernel.
+ .
+ The kernel image contained in this package is NOT meant to boot from. It
+ is uncompressed, and unstripped. This package also includes the
+ unstripped modules.
+
+Package: linux-tools-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, SRCPKGNAME-tools-PKGVER-ABINUM
+Description: Linux kernel version specific tools for version PKGVER-ABINUM
+ This package provides the architecture dependant parts for kernel
+ version locked tools (such as perf and x86_energy_perf_policy) for
+ version PKGVER-ABINUM on
+ =HUMAN=.
+
--- linux-qcom-6.8.0.orig/debian.qcom/control.d/vars.qcom
+++ linux-qcom-6.8.0/debian.qcom/control.d/vars.qcom
@@ -0,0 +1,6 @@
+arch="arm64"
+supported="Qualcomm SoC"
+target="Geared toward desktop and server systems."
+desc="=HUMAN= SMP"
+bootloader="grub-pc [amd64] | grub-efi-amd64 [amd64] | grub-efi-ia32 [amd64] | grub [amd64] | lilo [amd64] | flash-kernel [armhf arm64] | grub-efi-arm64 [arm64] | grub-efi-arm [armhf] | grub-ieee1275 [ppc64el]"
+provides="kvm-api-4, redhat-cluster-modules, ivtv-modules, virtualbox-guest-modules [amd64]"
--- linux-qcom-6.8.0.orig/debian.qcom/control.stub.in
+++ linux-qcom-6.8.0/debian.qcom/control.stub.in
@@ -0,0 +1,95 @@
+Source: SRCPKGNAME
+Section: devel
+Priority: optional
+Maintainer: Ubuntu Kernel Team <kernel-team@lists.ubuntu.com>
+Rules-Requires-Root: no
+Standards-Version: 3.9.4.0
+Build-Depends:
+ debhelper-compat (= 10),
+ cpio,
+ kmod <!stage1>,
+ makedumpfile [amd64] <!stage1>,
+ libcap-dev <!stage1>,
+ libelf-dev <!stage1>,
+ libnewt-dev <!stage1>,
+ libiberty-dev <!stage1>,
+ default-jdk-headless <!stage1>,
+ java-common <!stage1>,
+ rsync [!i386] <!stage1>,
+ libdw-dev <!stage1>,
+ libpci-dev <!stage1>,
+ pkg-config <!stage1>,
+ python3 <!stage1>,
+ python3-dev <!stage1>,
+ python3-setuptools <!stage1>,
+ flex <!stage1>,
+ bison <!stage1>,
+ libunwind8-dev [amd64 arm64 armhf ppc64el] <!stage1>,
+ liblzma-dev <!stage1>,
+ openssl <!stage1>,
+ libssl-dev <!stage1>,
+ libaudit-dev <!stage1>,
+ bc <!stage1>,
+ gawk <!stage1>,
+ libudev-dev <!stage1>,
+ autoconf <!stage1>,
+ automake <!stage1>,
+ libtool <!stage1>,
+ uuid-dev <!stage1>,
+ libnuma-dev [amd64 arm64 ppc64el s390x] <!stage1>,
+ libtraceevent-dev [amd64 arm64 armhf ppc64el s390x riscv64] <!stage1>,
+ libtracefs-dev [amd64 arm64 armhf ppc64el s390x riscv64] <!stage1>,
+ dkms <!stage1>,
+ dwarfdump <!stage1>,
+ curl <!stage1>,
+ zstd <!stage1>,
+ pahole [amd64 arm64 armhf ppc64el s390x riscv64] | dwarves (>= 1.21) [amd64 arm64 armhf ppc64el s390x riscv64] <!stage1>,
+ clang-18 [amd64 arm64 armhf ppc64el riscv64 s390x],
+ rustc [amd64 arm64 armhf ppc64el riscv64 s390x],
+ rust-src [amd64 arm64 armhf ppc64el riscv64 s390x],
+ rustfmt [amd64 arm64 armhf ppc64el riscv64 s390x],
+ bindgen-0.65 [amd64 arm64 armhf ppc64el riscv64 s390x],
+ libstdc++-dev,
+Build-Depends-Indep:
+ xmlto <!stage1>,
+ bzip2 <!stage1>,
+ sharutils <!stage1>,
+ asciidoc <!stage1>,
+ python3-docutils <!stage1>,
+Vcs-Git: git://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-qcom/+git/=SERIES=
+XS-Testsuite: autopkgtest
+#XS-Testsuite-Depends: gcc-4.7 binutils
+
+Package: SRCPKGNAME-headers-PKGVER-ABINUM
+Build-Profiles: <!stage1>
+Architecture: all
+Multi-Arch: foreign
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, coreutils
+Description: Header files related to Linux kernel version PKGVER
+ This package provides kernel header files for version PKGVER, for sites
+ that want the latest kernel headers. Please read
+ /usr/share/doc/SRCPKGNAME-headers-PKGVER-ABINUM/debian.README.gz for details
+
+Package: SRCPKGNAME-tools-PKGVER-ABINUM
+Build-Profiles: <!stage1>
+Architecture: arm64
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}, linux-tools-common
+Description: Linux kernel version specific tools for version PKGVER-ABINUM
+ This package provides the architecture dependant parts for kernel
+ version locked tools (such as perf and x86_energy_perf_policy) for
+ version PKGVER-ABINUM on
+ =HUMAN=.
+ You probably want to install linux-tools-PKGVER-ABINUM-<flavour>.
+
+Package: linux-libc-dev-qcom
+Architecture: all
+Depends: ${misc:Depends}
+Description: Linux Kernel Headers for development
+ This package provides additional downstream headers from the Linux kernel.
+ These headers are used by the installed headers for GNU glibc and other system
+ libraries. They are NOT meant to be used to build third-party modules for
+ your kernel. Use SRCPKGNAME-headers-* packages for that.
--- linux-qcom-6.8.0.orig/debian.qcom/copyright
+++ linux-qcom-6.8.0/debian.qcom/copyright
@@ -0,0 +1,29 @@
+This is the Ubuntu prepackaged version of the Linux kernel.
+Linux was written by Linus Torvalds <Linus.Torvalds@cs.Helsinki.FI>
+and others.
+
+This package was put together by the Ubuntu Kernel Team, from
+sources retrieved from upstream linux git.
+The sources may be found at most Linux ftp sites, including 
+ftp://ftp.kernel.org/pub/linux/kernel/
+
+This package is currently maintained by the
+Ubuntu Kernel Team <ubuntu-kernel@lists.ubuntu.com>
+
+Linux is copyrighted by Linus Torvalds and others.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 dated June, 1991.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+On Ubuntu Linux systems, the complete text of the GNU General
+Public License v2 can be found in `/usr/share/common-licenses/GPL-2'.
--- linux-qcom-6.8.0.orig/debian.qcom/dkms-versions
+++ linux-qcom-6.8.0/debian.qcom/dkms-versions
@@ -0,0 +1,3 @@
+zfs-linux 2.2.2-0ubuntu9.2 modulename=zfs debpath=pool/universe/z/%package%/zfs-dkms_%version%_all.deb arch=amd64 arch=arm64 arch=ppc64el arch=s390x rprovides=spl-modules rprovides=spl-dkms rprovides=zfs-modules rprovides=zfs-dkms
+backport-iwlwifi-dkms 11510-0ubuntu1.1 modulename=iwlwifi debpath=pool/universe/b/%package%/backport-iwlwifi-dkms_%version%_all.deb arch=amd64 rprovides=iwlwifi-modules rprovides=backport-iwlwifi-dkms type=standalone
+v4l2loopback 0.12.7-2ubuntu5 modulename=v4l2loopback debpath=pool/universe/v/%package%/v4l2loopback-dkms_%version%_all.deb arch=amd64 rprovides=v4l2loopback-modules rprovides=v4l2loopback-dkms
--- linux-qcom-6.8.0.orig/debian.qcom/etc/update.conf
+++ linux-qcom-6.8.0/debian.qcom/etc/update.conf
@@ -0,0 +1,7 @@
+# WARNING: we do not create update.conf when we are not a
+# derivative. Various cranky components make use of this.
+# If we start unconditionally creating update.conf we need
+# to fix at least cranky close and cranky rebase.
+RELEASE_REPO=git://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble
+SOURCE_RELEASE_BRANCH=master-next
+DEBIAN_MASTER=debian.master
--- linux-qcom-6.8.0.orig/debian.qcom/linux-libc-dev-qcom.install
+++ linux-qcom-6.8.0/debian.qcom/linux-libc-dev-qcom.install
@@ -0,0 +1,20 @@
+include/uapi/sound/qcom/msm_audio.h                                   usr/include/sound/qcom/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_cpas.h        usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_cre.h         usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_custom.h      usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_defs.h        usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_fd.h          usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_icp.h         usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp.h         usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_ife.h     usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_sfe.h     usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_tfe.h     usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_vfe.h     usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_jpeg.h        usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_lrme.h        usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_ope.h         usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_req_mgr.h     usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_sensor.h      usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_sync.h        usr/include/camera/media/
+ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_tfe.h         usr/include/camera/media/
+ubuntu/qcom/graphics/include/uapi/linux/msm_kgsl.h                    usr/include/linux/
--- linux-qcom-6.8.0.orig/debian.qcom/modprobe.d/common.conf
+++ linux-qcom-6.8.0/debian.qcom/modprobe.d/common.conf
@@ -0,0 +1,3 @@
+# LP:1434842 -- disable OSS drivers by default to allow pulseaudio to emulate
+blacklist snd-mixer-oss
+blacklist snd-pcm-oss
--- linux-qcom-6.8.0.orig/debian.qcom/reconstruct
+++ linux-qcom-6.8.0/debian.qcom/reconstruct
@@ -0,0 +1,119 @@
+# Recreate any symlinks created since the orig.
+[ ! -L 'include/dt-bindings/arm/qcom_dma_heap_dt_constants.h' ] && ln -sf '../../linux/qcom_dma_heap_dt_constants.h' 'include/dt-bindings/arm/qcom_dma_heap_dt_constants.h'
+chmod +x 'arch/mips/pci/pcie-octeon.c'
+chmod +x 'debian/cloud-tools/hv_get_dhcp_info'
+chmod +x 'debian/cloud-tools/hv_get_dns_info'
+chmod +x 'debian/cloud-tools/hv_set_ifconfig'
+chmod +x 'debian/rules'
+chmod +x 'debian/scripts/checks/final-checks'
+chmod +x 'debian/scripts/checks/module-signature-check'
+chmod +x 'debian/scripts/control-create'
+chmod +x 'debian/scripts/dkms-build'
+chmod +x 'debian/scripts/dkms-build--nvidia-N'
+chmod +x 'debian/scripts/dkms-build-configure--zfs'
+chmod +x 'debian/scripts/file-downloader'
+chmod +x 'debian/scripts/link-headers'
+chmod +x 'debian/scripts/link-lib-rust'
+chmod +x 'debian/scripts/misc/annotations'
+chmod +x 'debian/scripts/misc/find-missing-sauce.sh'
+chmod +x 'debian/scripts/misc/gen-auto-reconstruct'
+chmod +x 'debian/scripts/misc/git-ubuntu-log'
+chmod +x 'debian/scripts/misc/insert-changes'
+chmod +x 'debian/scripts/misc/insert-ubuntu-changes'
+chmod +x 'debian/scripts/misc/kernelconfig'
+chmod +x 'debian/scripts/module-inclusion'
+chmod +x 'debian/scripts/sign-module'
+chmod +x 'debian/templates/extra.postinst.in'
+chmod +x 'debian/templates/extra.postrm.in'
+chmod +x 'debian/templates/headers.postinst.in'
+chmod +x 'debian/templates/image.postinst.in'
+chmod +x 'debian/templates/image.postrm.in'
+chmod +x 'debian/templates/image.preinst.in'
+chmod +x 'debian/templates/image.prerm.in'
+chmod +x 'debian/tests-build/check-aliases'
+chmod +x 'debian/tests/rebuild'
+chmod +x 'debian/tests/ubuntu-regression-suite'
+chmod +x 'drivers/watchdog/f71808e_wdt.c'
+chmod +x 'tools/testing/selftests/gpio/gpio-aggregator.sh'
+chmod +x 'tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh'
+chmod +x 'ubuntu/qcom/camera/sanitize_uapi.sh'
+chmod +x 'ubuntu/qcom/qps615/LICENSE'
+chmod +x 'ubuntu/qcom/qps615/Makefile'
+chmod +x 'ubuntu/qcom/qps615/common.h'
+chmod +x 'ubuntu/qcom/qps615/config.ini'
+chmod +x 'ubuntu/qcom/qps615/descs.h'
+chmod +x 'ubuntu/qcom/qps615/dwxgmac2.h'
+chmod +x 'ubuntu/qcom/qps615/dwxgmac2_descs.c'
+chmod +x 'ubuntu/qcom/qps615/dwxgmac2_dma.c'
+chmod +x 'ubuntu/qcom/qps615/hwif.c'
+chmod +x 'ubuntu/qcom/qps615/hwif.h'
+chmod +x 'ubuntu/qcom/qps615/tc956x_ipa_intf.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_ipa_intf.h'
+chmod +x 'ubuntu/qcom/qps615/tc956x_msigen.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_pcie_logstat.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_pcie_logstat.h'
+chmod +x 'ubuntu/qcom/qps615/tc956x_pf_mbx.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_pf_mbx.h'
+chmod +x 'ubuntu/qcom/qps615/tc956x_pf_mbx_wrapper.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_pf_rsc_mng.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_pf_rsc_mng.h'
+chmod +x 'ubuntu/qcom/qps615/tc956x_qcom.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_vf_mbx.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_vf_mbx.h'
+chmod +x 'ubuntu/qcom/qps615/tc956x_vf_mbx_wrapper.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_vf_rsc_mng.c'
+chmod +x 'ubuntu/qcom/qps615/tc956x_vf_rsc_mng.h'
+chmod +x 'ubuntu/qcom/qps615/tc956x_xpcs.h'
+chmod +x 'ubuntu/qcom/qps615/tc956xmac_ethtool.c'
+chmod +x 'ubuntu/qcom/qps615/tc956xmac_hwtstamp.c'
+chmod +x 'ubuntu/qcom/qps615/tc956xmac_inc.h'
+chmod +x 'ubuntu/qcom/qps615/tc956xmac_ioctl.h'
+chmod +x 'ubuntu/qcom/qps615/tc956xmac_ptp.c'
+chmod +x 'ubuntu/qcom/qps615/tc956xmac_ptp.h'
+chmod +x 'ubuntu/qcom/qps615/tc956xmac_selftests.c'
+chmod +x 'ubuntu/qcom/qps615/tc956xmac_tc.c'
+# Remove any files deleted from the orig.
+rm -f 'arch/arm/kernel/pj4-cp0.c'
+rm -f 'arch/arm64/boot/dts/qcom/pm2250.dtsi'
+rm -f 'arch/loongarch/include/asm/dma-direct.h'
+rm -f 'arch/loongarch/include/asm/qspinlock.h'
+rm -f 'arch/s390/kernel/earlypgm.S'
+rm -f 'arch/sparc/lib/cmpdi2.c'
+rm -f 'arch/sparc/lib/ucmpdi2.c'
+rm -f 'drivers/dax/pmem/Makefile'
+rm -f 'drivers/dax/pmem/pmem.c'
+rm -f 'drivers/gpu/drm/gma500/psb_lid.c'
+rm -f 'drivers/gpu/drm/msm/adreno/a2xx.xml.h'
+rm -f 'drivers/gpu/drm/msm/adreno/a3xx.xml.h'
+rm -f 'drivers/gpu/drm/msm/adreno/a4xx.xml.h'
+rm -f 'drivers/gpu/drm/msm/adreno/a5xx.xml.h'
+rm -f 'drivers/gpu/drm/msm/adreno/a6xx.xml.h'
+rm -f 'drivers/gpu/drm/msm/adreno/a6xx_gmu.xml.h'
+rm -f 'drivers/gpu/drm/msm/adreno/adreno_common.xml.h'
+rm -f 'drivers/gpu/drm/msm/adreno/adreno_pm4.xml.h'
+rm -f 'drivers/gpu/drm/msm/disp/mdp4/mdp4.xml.h'
+rm -f 'drivers/gpu/drm/msm/disp/mdp5/mdp5.xml.h'
+rm -f 'drivers/gpu/drm/msm/disp/mdp_common.xml.h'
+rm -f 'drivers/gpu/drm/msm/dp/dp_parser.c'
+rm -f 'drivers/gpu/drm/msm/dp/dp_parser.h'
+rm -f 'drivers/gpu/drm/msm/dp/dp_power.c'
+rm -f 'drivers/gpu/drm/msm/dp/dp_power.h'
+rm -f 'drivers/gpu/drm/msm/dsi/dsi.xml.h'
+rm -f 'drivers/gpu/drm/msm/dsi/dsi_phy_10nm.xml.h'
+rm -f 'drivers/gpu/drm/msm/dsi/dsi_phy_14nm.xml.h'
+rm -f 'drivers/gpu/drm/msm/dsi/dsi_phy_20nm.xml.h'
+rm -f 'drivers/gpu/drm/msm/dsi/dsi_phy_28nm.xml.h'
+rm -f 'drivers/gpu/drm/msm/dsi/dsi_phy_28nm_8960.xml.h'
+rm -f 'drivers/gpu/drm/msm/dsi/dsi_phy_7nm.xml.h'
+rm -f 'drivers/gpu/drm/msm/dsi/sfpb.xml.h'
+rm -f 'drivers/gpu/drm/msm/hdmi/hdmi.xml.h'
+rm -f 'drivers/gpu/drm/msm/msm_gpummu.c'
+rm -f 'drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c'
+rm -f 'drivers/media/platform/qcom/camss/camss-vfe-170.c'
+rm -f 'include/linux/amd-pstate.h'
+rm -f 'include/linux/iio/adc/adi-axi-adc.h'
+rm -f 'net/bluetooth/a2mp.c'
+rm -f 'net/bluetooth/a2mp.h'
+rm -f 'net/bluetooth/amp.c'
+rm -f 'net/bluetooth/amp.h'
+exit 0
--- linux-qcom-6.8.0.orig/debian.qcom/rules.d/arm64.mk
+++ linux-qcom-6.8.0/debian.qcom/rules.d/arm64.mk
@@ -0,0 +1,19 @@
+human_arch	= ARMv8
+build_arch	= arm64
+defconfig	= defconfig
+flavours	= qcom
+build_image	= Image.gz
+kernel_file	= arch/$(build_arch)/boot/Image.gz
+install_file	= vmlinuz
+no_dumpfile	= true
+uefi_signed     = true
+
+vdso		= vdso_install
+
+do_tools_usbip  = true
+do_tools_cpupower = true
+do_tools_perf   = true
+do_tools_perf_jvmti = true
+do_tools_bpftool = true
+
+do_dtbs		= true
--- linux-qcom-6.8.0.orig/debian.qcom/tracking-bug
+++ linux-qcom-6.8.0/debian.qcom/tracking-bug
@@ -0,0 +1 @@
+2114979 d2025.06.19-1
--- linux-qcom-6.8.0.orig/debian.qcom/variants
+++ linux-qcom-6.8.0/debian.qcom/variants
@@ -0,0 +1,2 @@
+-6.8
+--
--- linux-qcom-6.8.0.orig/debian/canonical-certs.pem
+++ linux-qcom-6.8.0/debian/canonical-certs.pem
@@ -0,0 +1,371 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            47:77:26:6d:ae:6c:57:73:eb:80:e2:96:dd:26:93:ff:e9:f5:62:5d
+        Signature Algorithm: sha512WithRSAEncryption
+        Issuer: CN=Canonical Ltd. Live Patch Signing 2025 Kmod
+        Validity
+            Not Before: May 16 09:07:40 2025 GMT
+            Not After : May 16 09:07:40 2050 GMT
+        Subject: CN=Canonical Ltd. Live Patch Signing 2025 Kmod
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:b8:a9:03:47:2e:7b:c6:86:16:f4:b7:a8:4d:3b:
+                    05:f6:c4:75:35:e9:22:8a:4e:40:06:89:15:7f:ad:
+                    99:bb:e6:90:93:61:c8:16:cf:2e:00:1b:81:36:fd:
+                    cc:31:7b:97:79:8d:5e:d2:4d:d3:2f:ab:35:2d:74:
+                    48:98:b3:d9:75:f9:bb:e1:f2:3f:6b:6d:dc:e4:bb:
+                    ee:f5:aa:f7:8a:8c:7a:a8:0b:df:b1:f8:d6:04:13:
+                    27:e9:1a:aa:c2:4d:d2:35:3a:bc:06:d7:83:7f:e8:
+                    c4:1c:63:8b:3a:ff:0e:0b:89:6e:4f:5f:ea:ad:78:
+                    df:37:ab:f9:55:1d:fb:6e:29:a4:22:43:d1:9b:12:
+                    1e:b2:84:23:1b:d2:38:91:b8:a8:6c:1c:59:3c:ff:
+                    4c:a9:18:ce:d0:7f:1d:ef:04:cf:8a:e8:29:b2:4b:
+                    68:0d:92:32:bc:9c:5d:8f:0a:d1:dd:4d:25:ba:3a:
+                    8c:6a:48:5b:1e:9c:01:10:99:c1:a7:34:ee:68:ec:
+                    a1:d3:26:be:45:c8:b4:97:ac:8a:aa:7e:13:a6:e5:
+                    43:f1:1b:3f:a1:80:0a:d2:a9:e7:f2:77:ca:e1:f5:
+                    29:36:df:75:8a:7e:02:d6:17:aa:46:12:b9:51:f0:
+                    6b:ca:22:f8:05:de:d6:02:47:76:0c:88:f1:c6:90:
+                    44:99:58:71:c7:62:1e:2b:94:c5:2b:8e:dc:ca:7b:
+                    a7:bd:cd:38:8f:4e:73:6d:b0:9b:4e:7c:12:1f:5c:
+                    c5:62:d6:82:c6:d2:78:09:52:dc:d7:78:2e:23:d0:
+                    63:1f:7d:77:91:c8:3f:66:7a:20:8a:cf:70:09:0f:
+                    a2:c0:82:a5:42:d9:be:dc:5f:78:73:f7:fa:3c:70:
+                    47:7b:39:77:89:5a:6f:ef:83:09:c9:1b:21:53:89:
+                    7c:10:bf:99:9c:05:39:32:1e:84:3b:a5:84:7e:ef:
+                    08:6d:b0:b0:31:61:d6:1a:aa:dd:7a:d6:10:02:e6:
+                    72:02:e5:40:bf:07:b9:cd:61:d1:55:04:9a:cd:02:
+                    73:41:c1:df:20:30:12:97:ca:a1:83:1a:97:8a:92:
+                    1c:47:5c:0a:60:da:41:3b:e6:0e:2c:82:ce:45:65:
+                    81:ba:45:a1:66:cc:ef:ab:65:5c:e5:a8:0c:86:dd:
+                    fc:86:54:f3:37:7c:89:a9:0c:fa:3a:da:82:c9:90:
+                    99:1e:1d:66:44:de:d3:c5:d4:0b:da:15:f8:d8:d4:
+                    63:2b:4e:6f:24:e9:c2:d7:74:9c:29:91:9f:25:39:
+                    8d:77:15:8c:cb:8e:ad:e3:80:0a:ea:79:04:72:9d:
+                    51:01:18:ae:35:51:ef:95:79:38:c4:db:99:50:47:
+                    62:38:e9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Key Identifier: 
+                D5:41:CE:F6:1D:C7:E7:93:B7:EB:7E:89:99:70:A2:EE:F0:B5:DC:8C
+            X509v3 Authority Key Identifier: 
+                D5:41:CE:F6:1D:C7:E7:93:B7:EB:7E:89:99:70:A2:EE:F0:B5:DC:8C
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.2312.16.1.2
+    Signature Algorithm: sha512WithRSAEncryption
+    Signature Value:
+        40:9d:5b:70:66:fe:9c:99:eb:ed:78:61:be:da:67:da:ac:80:
+        a8:c2:78:91:f8:90:11:be:9f:6a:e7:bf:79:dc:11:0c:c7:83:
+        e8:13:c4:1c:b6:fe:f0:e7:7d:1a:12:97:5d:19:56:9c:10:12:
+        1e:b9:19:88:30:95:c4:3b:2f:aa:91:6f:c1:9e:68:4a:f4:5c:
+        ef:a1:51:b5:a3:9b:58:3f:e2:ae:5c:29:a6:c4:30:fd:65:0b:
+        cc:8c:99:95:33:61:c6:07:fa:c3:bd:1a:57:80:e5:43:97:2e:
+        f3:5c:d6:1e:b7:23:9f:58:10:19:24:46:9e:f8:fd:2c:8e:88:
+        e7:ec:ef:15:4b:7a:6a:ce:b0:25:c0:01:c5:21:83:1a:d5:89:
+        0c:90:86:ad:d4:3e:6e:28:bf:6c:21:91:ff:b9:a9:ef:d4:ac:
+        de:7c:67:c1:e4:ed:75:26:15:ff:5d:67:39:24:2d:15:57:21:
+        09:76:e5:85:f3:45:e8:bf:b1:c0:39:2b:83:34:1a:f5:3f:1f:
+        ae:07:8c:82:1f:d4:dc:95:c0:4e:f3:7f:ac:db:8f:2c:db:a4:
+        d4:2a:4c:8c:de:e6:5b:84:fc:df:a3:74:d8:dc:9c:93:1f:5b:
+        c9:33:b5:b3:7d:2b:a4:4d:7a:bb:73:92:ff:8d:e9:9e:c7:a7:
+        d2:0d:83:bb:2c:2f:47:51:15:5c:6d:db:9a:d3:9e:6e:25:90:
+        01:e6:09:bd:a2:d0:1e:cf:a3:12:22:0d:56:70:bf:89:e4:be:
+        62:76:9c:d9:f5:c8:01:55:95:02:57:a1:67:59:88:97:57:f6:
+        bb:8d:c9:40:d5:e3:60:4f:43:dd:49:90:fa:a5:6d:08:96:b2:
+        4d:dd:a7:c6:e3:5c:06:ba:af:8c:30:9d:d5:a5:b0:ab:c4:e5:
+        f3:09:47:05:ba:9b:46:f4:26:70:3b:fa:da:a5:0a:47:ce:be:
+        43:87:eb:73:63:3b:cd:41:7a:78:a0:f6:7d:c5:37:fb:bb:26:
+        3b:b3:e7:44:49:06:8c:14:03:fc:b3:46:54:3b:0d:57:02:08:
+        99:79:68:a2:9c:62:95:4d:ac:8e:19:43:4e:8f:2d:52:fa:91:
+        ca:78:06:a2:b7:a3:66:6d:67:0b:13:ee:b1:01:38:e0:7c:ac:
+        9a:16:27:36:f1:45:83:5d:eb:d6:cd:65:3f:56:9a:d3:56:c4:
+        15:55:b2:64:ca:13:cb:31:1e:7e:03:85:68:61:40:02:99:4b:
+        25:01:68:8d:97:cc:39:1a:54:1b:e5:51:38:8e:ce:66:74:61:
+        5e:87:f4:31:7d:0d:be:9d:01:e1:b3:5c:bc:1a:d0:ea:5e:b2:
+        c8:ee:97:34:bc:9f:bb:98
+-----BEGIN CERTIFICATE-----
+MIIFejCCA2KgAwIBAgIUR3cmba5sV3PrgOKW3SaT/+n1Yl0wDQYJKoZIhvcNAQEN
+BQAwNjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTGl2ZSBQYXRjaCBTaWduaW5n
+IDIwMjUgS21vZDAgFw0yNTA1MTYwOTA3NDBaGA8yMDUwMDUxNjA5MDc0MFowNjE0
+MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTGl2ZSBQYXRjaCBTaWduaW5nIDIwMjUg
+S21vZDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALipA0cue8aGFvS3
+qE07BfbEdTXpIopOQAaJFX+tmbvmkJNhyBbPLgAbgTb9zDF7l3mNXtJN0y+rNS10
+SJiz2XX5u+HyP2tt3OS77vWq94qMeqgL37H41gQTJ+kaqsJN0jU6vAbXg3/oxBxj
+izr/DguJbk9f6q143zer+VUd+24ppCJD0ZsSHrKEIxvSOJG4qGwcWTz/TKkYztB/
+He8Ez4roKbJLaA2SMrycXY8K0d1NJbo6jGpIWx6cARCZwac07mjsodMmvkXItJes
+iqp+E6blQ/EbP6GACtKp5/J3yuH1KTbfdYp+AtYXqkYSuVHwa8oi+AXe1gJHdgyI
+8caQRJlYccdiHiuUxSuO3Mp7p73NOI9Oc22wm058Eh9cxWLWgsbSeAlS3Nd4LiPQ
+Yx99d5HIP2Z6IIrPcAkPosCCpULZvtxfeHP3+jxwR3s5d4lab++DCckbIVOJfBC/
+mZwFOTIehDulhH7vCG2wsDFh1hqq3XrWEALmcgLlQL8Huc1h0VUEms0Cc0HB3yAw
+EpfKoYMal4qSHEdcCmDaQTvmDiyCzkVlgbpFoWbM76tlXOWoDIbd/IZU8zd8iakM
++jragsmQmR4dZkTe08XUC9oV+NjUYytObyTpwtd0nCmRnyU5jXcVjMuOreOACup5
+BHKdUQEYrjVR75V5OMTbmVBHYjjpAgMBAAGjfjB8MAwGA1UdEwEB/wQCMAAwCwYD
+VR0PBAQDAgeAMB0GA1UdDgQWBBTVQc72Hcfnk7frfomZcKLu8LXcjDAfBgNVHSME
+GDAWgBTVQc72Hcfnk7frfomZcKLu8LXcjDAfBgNVHSUEGDAWBggrBgEFBQcDAwYK
+KwYBBAGSCBABAjANBgkqhkiG9w0BAQ0FAAOCAgEAQJ1bcGb+nJnr7Xhhvtpn2qyA
+qMJ4kfiQEb6faue/edwRDMeD6BPEHLb+8Od9GhKXXRlWnBASHrkZiDCVxDsvqpFv
+wZ5oSvRc76FRtaObWD/irlwppsQw/WULzIyZlTNhxgf6w70aV4DlQ5cu81zWHrcj
+n1gQGSRGnvj9LI6I5+zvFUt6as6wJcABxSGDGtWJDJCGrdQ+bii/bCGR/7mp79Ss
+3nxnweTtdSYV/11nOSQtFVchCXblhfNF6L+xwDkrgzQa9T8frgeMgh/U3JXATvN/
+rNuPLNuk1CpMjN7mW4T836N02Nyckx9byTO1s30rpE16u3OS/43pnsen0g2Duywv
+R1EVXG3bmtOebiWQAeYJvaLQHs+jEiINVnC/ieS+Ynac2fXIAVWVAlehZ1mIl1f2
+u43JQNXjYE9D3UmQ+qVtCJayTd2nxuNcBrqvjDCd1aWwq8Tl8wlHBbqbRvQmcDv6
+2qUKR86+Q4frc2M7zUF6eKD2fcU3+7smO7PnREkGjBQD/LNGVDsNVwIImXloopxi
+lU2sjhlDTo8tUvqRyngGorejZm1nCxPusQE44HysmhYnNvFFg13r1s1lP1aa01bE
+FVWyZMoTyzEefgOFaGFAAplLJQFojZfMORpUG+VROI7OZnRhXof0MX0Nvp0B4bNc
+vBrQ6l6yyO6XNLyfu5g=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            c7:7e:51:6a:1c:25:cd:40
+        Signature Algorithm: sha512WithRSAEncryption
+        Issuer: CN = Canonical Ltd. Live Patch Signing
+        Validity
+            Not Before: Jul 18 23:41:27 2016 GMT
+            Not After : Jul 16 23:41:27 2026 GMT
+        Subject: CN = Canonical Ltd. Live Patch Signing
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (4096 bit)
+                Modulus:
+                    00:bd:74:ee:72:b3:4a:ab:e6:31:e8:29:24:c2:bd:
+                    46:98:32:c0:39:ee:a3:fb:8a:ad:fe:ab:1a:5b:a3:
+                    2e:a1:80:db:79:61:9e:47:79:2c:75:57:a2:21:f0:
+                    93:f6:87:f2:9b:4b:9d:2f:b3:58:61:28:3c:41:70:
+                    13:16:a1:72:90:c9:d5:16:71:7c:e0:30:f9:28:5e:
+                    48:20:36:00:69:b7:59:9f:a3:ec:a8:eb:55:41:9f:
+                    38:1e:22:4a:57:20:f4:83:59:49:c5:00:93:d3:33:
+                    02:92:d1:fc:f0:84:3b:4a:5b:8f:b6:73:9a:89:fa:
+                    30:1e:e6:2a:68:f2:91:ef:59:57:3d:dc:1c:52:6f:
+                    5e:e6:9b:b5:b8:7c:98:c9:13:d1:39:68:01:67:91:
+                    e0:d3:67:72:16:0a:5e:16:83:45:31:4f:b5:2b:b3:
+                    f6:40:86:89:3a:84:6e:6f:16:61:bc:70:84:be:5a:
+                    13:36:7b:82:ea:07:19:fc:18:c1:16:c6:32:0b:7d:
+                    2c:6b:c4:21:b9:38:6b:31:dc:d9:0c:ad:56:40:68:
+                    7c:e3:c6:64:8e:bf:1c:e0:72:3e:6c:db:d2:73:79:
+                    da:d7:c5:2f:5d:04:7d:b0:07:1e:95:dd:2a:47:5e:
+                    bf:3e:3a:c8:66:f6:67:0f:d4:2a:f1:e2:71:59:d2:
+                    6c:7b:a0:37:ac:e6:97:80:30:13:97:48:d5:74:fc:
+                    38:68:e4:57:cb:99:69:5a:84:27:ac:98:51:e4:64:
+                    bd:91:62:e8:58:27:06:2a:b9:0b:b8:08:e5:e5:b4:
+                    51:a7:a2:10:df:4e:07:6c:a0:3b:96:f2:6e:df:75:
+                    8c:97:1e:64:a0:9a:86:9b:98:26:f9:d8:b7:de:5b:
+                    21:b7:af:89:01:a3:f7:98:6b:da:19:ba:86:ef:ef:
+                    f1:ce:bb:2f:89:ed:c0:b6:1b:e5:5b:f8:90:11:9a:
+                    52:93:e9:be:f7:35:b9:08:cb:ba:c3:ed:2f:73:af:
+                    cc:96:07:55:b5:de:f6:03:f6:f1:89:f9:21:40:76:
+                    c1:69:f2:61:cc:9a:94:df:9c:ec:6a:65:38:be:d1:
+                    4e:2a:87:c7:2f:3e:53:ae:8b:9f:54:a1:09:59:64:
+                    25:aa:a9:d8:44:a9:a8:a0:71:e1:32:aa:4c:32:fd:
+                    44:28:cc:9c:6f:8e:db:81:7e:6f:fa:00:56:c5:e5:
+                    03:46:63:fb:8e:71:8d:e3:13:91:9f:ac:60:3e:64:
+                    f3:df:25:34:09:fa:2d:96:9f:16:05:ea:93:f5:e6:
+                    00:08:27:32:7b:3c:bd:ee:70:24:6c:3b:55:e9:db:
+                    f4:10:2d:20:06:b4:ca:e9:29:65:55:ad:f6:52:54:
+                    5f:e5:a3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Key Identifier: 
+                14:DF:34:D1:A8:7C:F3:76:25:AB:EC:03:9E:F2:BF:52:12:49:B9:69
+            X509v3 Authority Key Identifier: 
+                keyid:14:DF:34:D1:A8:7C:F3:76:25:AB:EC:03:9E:F2:BF:52:12:49:B9:69
+
+    Signature Algorithm: sha512WithRSAEncryption
+         30:e7:48:02:37:e9:28:cf:04:a2:4d:5c:fa:d8:4e:c9:76:c7:
+         14:3f:bd:2c:51:3d:33:f0:1a:bc:49:f1:47:95:8f:69:d8:a9:
+         54:14:44:6c:4d:9f:55:82:08:1e:c6:5b:d5:91:d9:bc:2e:b0:
+         af:d6:25:65:74:96:aa:36:de:ae:31:a8:11:f2:a4:2c:5a:e1:
+         4f:73:f8:4a:c3:35:b0:76:96:71:f2:b5:7d:4b:75:ee:5d:bf:
+         86:a5:ba:0b:a9:52:cb:ec:ab:e5:23:4b:f2:74:55:28:17:1e:
+         b3:ac:27:ad:45:13:6e:69:b3:5a:be:42:36:29:48:db:e7:5c:
+         22:58:a0:90:82:2c:2a:21:2b:db:f4:64:b7:91:5d:1f:2c:48:
+         a4:1a:85:e3:86:a5:aa:19:cd:19:e8:a5:fb:a3:7b:94:77:48:
+         25:a4:cf:a0:cf:71:82:5c:6f:71:22:7c:d6:97:a0:53:bb:ec:
+         30:f6:cb:16:fb:7b:fd:16:94:7a:53:6e:bd:04:64:a2:01:10:
+         9f:f0:5b:b5:a6:73:41:9d:5f:6f:45:73:0d:05:f7:30:6d:39:
+         90:b6:7d:55:7d:4c:2f:ae:5f:38:56:2f:8b:df:f4:bf:12:06:
+         93:6e:0d:02:23:bf:71:91:57:88:e8:bd:62:72:99:00:40:29:
+         1e:c9:13:11:da:7e:8e:e1:d2:a5:0d:bf:f7:d6:ec:01:0d:89:
+         41:cd:d5:dc:d2:f7:5f:33:0d:4c:2f:85:b7:85:b7:81:e4:17:
+         29:f0:74:cf:0e:15:8c:1a:50:0b:08:63:1a:91:4f:e7:76:97:
+         f1:d4:3b:7e:72:d4:c5:45:58:0c:6a:e9:0d:f2:85:d8:91:1e:
+         37:bd:78:e3:39:4d:2e:fd:85:31:c1:a6:3b:6a:cc:2c:53:72:
+         1d:8e:7b:f0:e6:76:86:09:6f:1a:f3:e4:a1:e2:dd:76:5f:b0:
+         8c:e2:2a:54:5d:c1:88:49:90:10:15:42:7d:05:24:53:8c:54:
+         ff:48:18:1a:36:e3:31:d3:54:32:78:0d:fe:f2:3d:aa:0d:37:
+         15:84:b4:36:47:31:e8:85:6e:0b:58:38:ff:21:91:09:c9:a8:
+         43:a3:ea:60:cb:7e:ed:f7:41:6f:4e:91:c1:fd:77:46:e7:d4:
+         e7:86:c0:1b:fd:50:6c:aa:be:00:b3:63:02:ff:4e:c7:a5:57:
+         6e:29:64:e9:54:d5:30:63:38:5f:2d:5a:db:49:5f:14:14:22:
+         d2:81:1f:61:9e:ee:ee:16:66:d6:bc:bd:ac:1b:5c:fb:38:31:
+         95:33:2e:84:6e:7a:de:ee:b9:fc:97:17:06:13:bf:70:1c:6e:
+         76:ed:66:38:e2:70:08:00
+-----BEGIN CERTIFICATE-----
+MIIFODCCAyCgAwIBAgIJAMd+UWocJc1AMA0GCSqGSIb3DQEBDQUAMCwxKjAoBgNV
+BAMMIUNhbm9uaWNhbCBMdGQuIExpdmUgUGF0Y2ggU2lnbmluZzAeFw0xNjA3MTgy
+MzQxMjdaFw0yNjA3MTYyMzQxMjdaMCwxKjAoBgNVBAMMIUNhbm9uaWNhbCBMdGQu
+IExpdmUgUGF0Y2ggU2lnbmluZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBAL107nKzSqvmMegpJMK9RpgywDnuo/uKrf6rGlujLqGA23lhnkd5LHVXoiHw
+k/aH8ptLnS+zWGEoPEFwExahcpDJ1RZxfOAw+SheSCA2AGm3WZ+j7KjrVUGfOB4i
+Slcg9INZScUAk9MzApLR/PCEO0pbj7Zzmon6MB7mKmjyke9ZVz3cHFJvXuabtbh8
+mMkT0TloAWeR4NNnchYKXhaDRTFPtSuz9kCGiTqEbm8WYbxwhL5aEzZ7guoHGfwY
+wRbGMgt9LGvEIbk4azHc2QytVkBofOPGZI6/HOByPmzb0nN52tfFL10EfbAHHpXd
+Kkdevz46yGb2Zw/UKvHicVnSbHugN6zml4AwE5dI1XT8OGjkV8uZaVqEJ6yYUeRk
+vZFi6FgnBiq5C7gI5eW0UaeiEN9OB2ygO5bybt91jJceZKCahpuYJvnYt95bIbev
+iQGj95hr2hm6hu/v8c67L4ntwLYb5Vv4kBGaUpPpvvc1uQjLusPtL3OvzJYHVbXe
+9gP28Yn5IUB2wWnyYcyalN+c7GplOL7RTiqHxy8+U66Ln1ShCVlkJaqp2ESpqKBx
+4TKqTDL9RCjMnG+O24F+b/oAVsXlA0Zj+45xjeMTkZ+sYD5k898lNAn6LZafFgXq
+k/XmAAgnMns8ve5wJGw7Venb9BAtIAa0yukpZVWt9lJUX+WjAgMBAAGjXTBbMAwG
+A1UdEwEB/wQCMAAwCwYDVR0PBAQDAgeAMB0GA1UdDgQWBBQU3zTRqHzzdiWr7AOe
+8r9SEkm5aTAfBgNVHSMEGDAWgBQU3zTRqHzzdiWr7AOe8r9SEkm5aTANBgkqhkiG
+9w0BAQ0FAAOCAgEAMOdIAjfpKM8Eok1c+thOyXbHFD+9LFE9M/AavEnxR5WPadip
+VBREbE2fVYIIHsZb1ZHZvC6wr9YlZXSWqjberjGoEfKkLFrhT3P4SsM1sHaWcfK1
+fUt17l2/hqW6C6lSy+yr5SNL8nRVKBces6wnrUUTbmmzWr5CNilI2+dcIligkIIs
+KiEr2/Rkt5FdHyxIpBqF44alqhnNGeil+6N7lHdIJaTPoM9xglxvcSJ81pegU7vs
+MPbLFvt7/RaUelNuvQRkogEQn/BbtaZzQZ1fb0VzDQX3MG05kLZ9VX1ML65fOFYv
+i9/0vxIGk24NAiO/cZFXiOi9YnKZAEApHskTEdp+juHSpQ2/99bsAQ2JQc3V3NL3
+XzMNTC+Ft4W3geQXKfB0zw4VjBpQCwhjGpFP53aX8dQ7fnLUxUVYDGrpDfKF2JEe
+N7144zlNLv2FMcGmO2rMLFNyHY578OZ2hglvGvPkoeLddl+wjOIqVF3BiEmQEBVC
+fQUkU4xU/0gYGjbjMdNUMngN/vI9qg03FYS0Nkcx6IVuC1g4/yGRCcmoQ6PqYMt+
+7fdBb06Rwf13RufU54bAG/1QbKq+ALNjAv9Ox6VXbilk6VTVMGM4Xy1a20lfFBQi
+0oEfYZ7u7hZm1ry9rBtc+zgxlTMuhG563u65/JcXBhO/cBxudu1mOOJwCAA=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            e9:df:13:0f:92:92:a9:b7
+        Signature Algorithm: sha512WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Kernel Module Signing
+        Validity
+            Not Before: May 31 16:06:09 2016 GMT
+            Not After : May 29 16:06:09 2026 GMT
+        Subject: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Kernel Module Signing
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (4096 bit)
+                Modulus:
+                    00:b3:b0:4f:c6:0a:77:8b:f9:d1:53:33:34:d2:80:
+                    b5:63:6f:e1:f6:a2:83:99:d5:b6:b1:e4:99:91:fa:
+                    6c:19:c6:d0:91:2a:b9:7d:b5:98:a6:0d:28:01:b8:
+                    7c:8e:aa:38:ec:51:37:33:96:f0:b0:9b:8d:86:5f:
+                    67:23:69:2f:d7:c2:f3:fb:c5:d7:f9:04:ff:f2:e5:
+                    61:68:b7:29:b9:c6:8e:4b:4d:2d:8f:92:0c:00:b3:
+                    a3:d2:5a:08:64:cd:f2:09:0b:a5:0e:e6:64:75:d5:
+                    41:f4:4d:49:3a:0d:dc:b9:27:8e:c4:d6:b1:df:8f:
+                    6c:f0:e4:f7:31:cb:a9:04:a1:f9:a7:aa:15:da:59:
+                    03:4d:46:14:d0:dd:bf:e0:f5:9e:f0:71:0c:70:78:
+                    2b:08:fb:e0:b6:68:a4:74:12:9d:f7:f2:64:88:17:
+                    2a:8a:ed:1a:91:b5:6c:13:bd:4c:10:0a:0b:72:0b:
+                    90:db:7d:f3:78:44:4c:d2:a5:41:f7:1c:77:7d:5a:
+                    8a:54:bc:8f:fe:b7:ee:e1:bc:59:37:c4:d4:e8:14:
+                    d0:5b:42:9b:04:00:8e:6d:83:8a:25:21:5b:08:c4:
+                    7b:b2:d9:99:52:c9:5e:59:6d:c4:aa:52:59:e2:e4:
+                    2f:7e:7e:ac:05:01:99:bf:13:72:b7:45:c5:17:da:
+                    8a:d5:3e:71:73:2e:d8:aa:e6:eb:5a:d0:9a:c4:93:
+                    f3:be:eb:d2:47:25:34:16:29:fa:dd:9a:2f:b1:20:
+                    e5:41:4e:ed:ea:51:7c:23:80:ba:3d:b5:3a:0b:8c:
+                    9c:85:48:6c:3c:8b:29:2f:2f:12:c7:52:34:02:ea:
+                    0f:ac:53:23:3c:f8:3e:40:1b:30:63:e9:2d:e6:f6:
+                    58:cc:51:f9:eb:08:4a:b4:c7:16:80:d1:8b:c2:64:
+                    6a:71:a9:70:31:a4:a7:3a:c0:93:99:1b:0e:42:c1:
+                    00:6d:43:27:99:6c:e5:fd:23:16:c1:8e:b5:66:17:
+                    2b:4c:53:5a:6d:1e:96:16:13:6a:c6:d4:85:5b:74:
+                    2e:ce:7c:45:2f:ad:cb:75:9e:5e:91:bd:9a:6a:86:
+                    1a:06:bd:39:be:a3:50:56:ea:e1:f6:e3:95:69:d7:
+                    31:e4:66:f7:36:b5:51:c2:22:b4:9c:74:9c:44:0b:
+                    0e:16:5f:53:f0:23:c6:b9:40:bd:d6:b8:7d:1b:f6:
+                    73:f6:27:e7:c0:e3:65:a0:58:ab:5c:59:b7:80:8c:
+                    8c:04:b4:a9:ae:a0:51:40:10:3b:63:59:49:87:d1:
+                    9b:df:a3:8c:c4:2e:eb:70:c1:0a:18:1f:cb:22:c2:
+                    f2:4a:65:0d:e5:81:74:d8:ce:72:c6:35:be:ba:63:
+                    72:c4:f9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Key Identifier: 
+                88:F7:52:E5:60:A1:E0:73:7E:31:16:3A:46:6A:D7:B7:0A:85:0C:19
+            X509v3 Authority Key Identifier: 
+                keyid:88:F7:52:E5:60:A1:E0:73:7E:31:16:3A:46:6A:D7:B7:0A:85:0C:19
+
+    Signature Algorithm: sha512WithRSAEncryption
+         04:85:16:27:58:ba:71:28:57:86:7b:c2:83:db:e5:72:6f:1e:
+         b2:1c:63:b0:db:ad:c0:42:96:c0:4f:65:f6:35:4d:c0:07:0d:
+         46:be:d3:1e:ec:f1:22:18:2a:18:5d:bb:69:a6:a6:d4:0d:c3:
+         57:03:b9:e7:45:49:28:ca:6d:98:17:68:97:cb:7b:36:81:0a:
+         37:9e:34:79:f3:e1:0e:5b:77:43:bb:5a:a5:45:b7:16:50:86:
+         fd:12:a4:96:0f:15:19:09:1c:e1:fa:80:a5:80:09:be:bb:c8:
+         26:0b:3e:de:03:d2:c2:18:a4:8d:0d:de:c5:32:82:0b:fb:75:
+         55:66:1a:2a:bb:e4:bd:25:91:20:15:d4:be:b8:3f:53:e3:fb:
+         a8:c3:55:e3:d5:e7:82:18:95:df:39:09:a7:fc:89:6e:b4:1c:
+         aa:2d:e8:67:c2:0d:34:34:3e:f9:fa:0b:ce:81:92:11:ae:12:
+         0a:fe:35:63:ce:46:29:c4:2b:4f:cb:4e:05:0a:a1:11:e2:35:
+         f6:5a:5d:b5:e8:d2:6f:4c:fc:3d:24:a6:03:4b:dd:98:6b:f2:
+         71:58:16:1d:a5:25:ef:d9:06:7c:e8:db:7b:88:6a:89:5c:59:
+         01:92:64:db:44:08:63:6c:7c:32:d6:55:98:63:09:26:61:67:
+         0a:fe:5d:ee:fd:23:59:b3:4d:91:c1:4d:41:8b:cd:20:58:fa:
+         2d:45:e5:bd:1d:69:5c:03:a0:49:a6:97:54:13:b6:c9:e0:f8:
+         56:83:a1:2a:c3:f4:6c:fd:ab:20:ca:3d:9c:95:c0:cf:04:bb:
+         46:39:cf:34:81:65:45:27:64:01:7d:62:b3:b8:72:ea:10:d5:
+         0f:53:7d:39:88:25:09:6f:8c:bc:e0:49:bb:39:e2:0e:8d:cf:
+         56:4d:c1:82:6d:87:d2:e7:fc:c0:9f:a7:65:60:d2:6c:65:18:
+         59:38:6e:d0:9c:d7:c3:81:9a:9a:29:8f:83:84:c3:b5:44:ff:
+         28:ac:13:17:64:f2:26:13:d9:55:06:b7:69:68:7c:bf:ec:d1:
+         8c:ef:b7:da:76:e1:07:73:c6:31:62:31:cb:b6:e1:e7:7f:0c:
+         c3:f7:4c:52:be:25:36:8e:a1:bb:60:02:c3:cb:3e:6f:29:fc:
+         7f:6a:fa:f8:ec:0a:df:49:e2:57:0e:bc:bd:93:c3:1b:d5:36:
+         8a:ff:d8:1b:17:c7:1f:cb:69:00:d2:54:9e:ad:61:89:92:95:
+         11:f8:ea:17:83:9f:9b:09:7d:b8:94:a4:ea:f5:ae:ea:dc:dd:
+         62:b9:9e:68:9c:18:ec:19:c4:13:08:c8:b1:62:ab:8e:84:69:
+         11:3c:da:ea:0d:b7:22:bd
+-----BEGIN CERTIFICATE-----
+MIIF2jCCA8KgAwIBAgIJAOnfEw+Skqm3MA0GCSqGSIb3DQEBDQUAMH0xCzAJBgNV
+BAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEQMA4GA1UEBwwHRG91Z2xhczEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xLTArBgNVBAMMJENhbm9uaWNhbCBMdGQu
+IEtlcm5lbCBNb2R1bGUgU2lnbmluZzAeFw0xNjA1MzExNjA2MDlaFw0yNjA1Mjkx
+NjA2MDlaMH0xCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEQMA4G
+A1UEBwwHRG91Z2xhczEXMBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xLTArBgNVBAMM
+JENhbm9uaWNhbCBMdGQuIEtlcm5lbCBNb2R1bGUgU2lnbmluZzCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBALOwT8YKd4v50VMzNNKAtWNv4faig5nVtrHk
+mZH6bBnG0JEquX21mKYNKAG4fI6qOOxRNzOW8LCbjYZfZyNpL9fC8/vF1/kE//Ll
+YWi3KbnGjktNLY+SDACzo9JaCGTN8gkLpQ7mZHXVQfRNSToN3LknjsTWsd+PbPDk
+9zHLqQSh+aeqFdpZA01GFNDdv+D1nvBxDHB4Kwj74LZopHQSnffyZIgXKortGpG1
+bBO9TBAKC3ILkNt983hETNKlQfccd31ailS8j/637uG8WTfE1OgU0FtCmwQAjm2D
+iiUhWwjEe7LZmVLJXlltxKpSWeLkL35+rAUBmb8TcrdFxRfaitU+cXMu2Krm61rQ
+msST877r0kclNBYp+t2aL7Eg5UFO7epRfCOAuj21OguMnIVIbDyLKS8vEsdSNALq
+D6xTIzz4PkAbMGPpLeb2WMxR+esISrTHFoDRi8JkanGpcDGkpzrAk5kbDkLBAG1D
+J5ls5f0jFsGOtWYXK0xTWm0elhYTasbUhVt0Ls58RS+ty3WeXpG9mmqGGga9Ob6j
+UFbq4fbjlWnXMeRm9za1UcIitJx0nEQLDhZfU/AjxrlAvda4fRv2c/Yn58DjZaBY
+q1xZt4CMjAS0qa6gUUAQO2NZSYfRm9+jjMQu63DBChgfyyLC8kplDeWBdNjOcsY1
+vrpjcsT5AgMBAAGjXTBbMAwGA1UdEwEB/wQCMAAwCwYDVR0PBAQDAgeAMB0GA1Ud
+DgQWBBSI91LlYKHgc34xFjpGate3CoUMGTAfBgNVHSMEGDAWgBSI91LlYKHgc34x
+FjpGate3CoUMGTANBgkqhkiG9w0BAQ0FAAOCAgEABIUWJ1i6cShXhnvCg9vlcm8e
+shxjsNutwEKWwE9l9jVNwAcNRr7THuzxIhgqGF27aaam1A3DVwO550VJKMptmBdo
+l8t7NoEKN540efPhDlt3Q7tapUW3FlCG/RKklg8VGQkc4fqApYAJvrvIJgs+3gPS
+whikjQ3exTKCC/t1VWYaKrvkvSWRIBXUvrg/U+P7qMNV49XnghiV3zkJp/yJbrQc
+qi3oZ8INNDQ++foLzoGSEa4SCv41Y85GKcQrT8tOBQqhEeI19lpdtejSb0z8PSSm
+A0vdmGvycVgWHaUl79kGfOjbe4hqiVxZAZJk20QIY2x8MtZVmGMJJmFnCv5d7v0j
+WbNNkcFNQYvNIFj6LUXlvR1pXAOgSaaXVBO2yeD4VoOhKsP0bP2rIMo9nJXAzwS7
+RjnPNIFlRSdkAX1is7hy6hDVD1N9OYglCW+MvOBJuzniDo3PVk3Bgm2H0uf8wJ+n
+ZWDSbGUYWThu0JzXw4GamimPg4TDtUT/KKwTF2TyJhPZVQa3aWh8v+zRjO+32nbh
+B3PGMWIxy7bh538Mw/dMUr4lNo6hu2ACw8s+byn8f2r6+OwK30niVw68vZPDG9U2
+iv/YGxfHH8tpANJUnq1hiZKVEfjqF4Ofmwl9uJSk6vWu6tzdYrmeaJwY7BnEEwjI
+sWKrjoRpETza6g23Ir0=
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/canonical-revoked-certs.pem
+++ linux-qcom-6.8.0/debian/canonical-revoked-certs.pem
@@ -0,0 +1,688 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Apr 12 11:39:08 2012 GMT
+            Not After : Apr 11 11:39:08 2042 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c9:5f:9b:62:8f:0b:b0:64:82:ac:be:c9:e2:62:
+                    e3:4b:d2:9f:1e:8a:d5:61:1a:2b:5d:38:f4:b7:ce:
+                    b9:9a:b8:43:b8:43:97:77:ab:4f:7f:0c:70:46:0b:
+                    fc:7f:6d:c6:6d:ea:80:5e:01:d2:b7:66:1e:87:de:
+                    0d:6d:d0:41:97:a8:a5:af:0c:63:4f:f7:7c:c2:52:
+                    cc:a0:31:a9:bb:89:5d:99:1e:46:6f:55:73:b9:76:
+                    69:ec:d7:c1:fc:21:d6:c6:07:e7:4f:bd:22:de:e4:
+                    a8:5b:2d:db:95:34:19:97:d6:28:4b:21:4c:ca:bb:
+                    1d:79:a6:17:7f:5a:f9:67:e6:5c:78:45:3d:10:6d:
+                    b0:17:59:26:11:c5:57:e3:7f:4e:82:ba:f6:2c:4e:
+                    c8:37:4d:ff:85:15:84:47:e0:ed:3b:7c:7f:bc:af:
+                    e9:01:05:a7:0c:6f:c3:e9:8d:a3:ce:be:a6:e3:cd:
+                    3c:b5:58:2c:9e:c2:03:1c:60:22:37:39:ff:41:02:
+                    c1:29:a4:65:51:ff:33:34:aa:42:15:f9:95:78:fc:
+                    2d:f5:da:8a:85:7c:82:9d:fb:37:2c:6b:a5:a8:df:
+                    7c:55:0b:80:2e:3c:b0:63:e1:cd:38:48:89:e8:14:
+                    06:0b:82:bc:fd:d4:07:68:1b:0f:3e:d9:15:dd:94:
+                    11:1b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                61:48:2A:A2:83:0D:0A:B2:AD:5A:F1:0B:72:50:DA:90:33:DD:CE:F0
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        8f:8a:a1:06:1f:29:b7:0a:4a:d5:c5:fd:81:ab:25:ea:c0:7d:
+        e2:fc:6a:96:a0:79:93:67:ee:05:0e:25:12:25:e4:5a:f6:aa:
+        1a:f1:12:f3:05:8d:87:5e:f1:5a:5c:cb:8d:23:73:65:1d:15:
+        b9:de:22:6b:d6:49:67:c9:a3:c6:d7:62:4e:5c:b5:f9:03:83:
+        40:81:dc:87:9c:3c:3f:1c:0d:51:9f:94:65:0a:84:48:67:e4:
+        a2:f8:a6:4a:f0:e7:cd:cd:bd:94:e3:09:d2:5d:2d:16:1b:05:
+        15:0b:cb:44:b4:3e:61:42:22:c4:2a:5c:4e:c5:1d:a3:e2:e0:
+        52:b2:eb:f4:8b:2b:dc:38:39:5d:fb:88:a1:56:65:5f:2b:4f:
+        26:ff:06:78:10:12:eb:8c:5d:32:e3:c6:45:af:25:9b:a0:ff:
+        8e:ef:47:09:a3:e9:8b:37:92:92:69:76:7e:34:3b:92:05:67:
+        4e:b0:25:ed:bc:5e:5f:8f:b4:d6:ca:40:ff:e4:e2:31:23:0c:
+        85:25:ae:0c:55:01:ec:e5:47:5e:df:5b:bc:14:33:e3:c6:f5:
+        18:b6:d9:f7:dd:b3:b4:a1:31:d3:5a:5c:5d:7d:3e:bf:0a:e4:
+        e4:e8:b4:59:7d:3b:b4:8c:a3:1b:b5:20:a3:b9:3e:84:6f:8c:
+        21:00:c3:39
+-----BEGIN CERTIFICATE-----
+MIIEIDCCAwigAwIBAgIBATANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMjA0MTIxMTM5MDhaFw00MjA0MTEx
+MTM5MDhaMH8xCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEXMBUG
+A1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MSswKQYD
+VQQDDCJDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyV+bYo8LsGSCrL7J4mLjS9KfHorVYRor
+XTj0t865mrhDuEOXd6tPfwxwRgv8f23GbeqAXgHSt2Yeh94NbdBBl6ilrwxjT/d8
+wlLMoDGpu4ldmR5Gb1VzuXZp7NfB/CHWxgfnT70i3uSoWy3blTQZl9YoSyFMyrsd
+eaYXf1r5Z+ZceEU9EG2wF1kmEcVX439Ogrr2LE7IN03/hRWER+DtO3x/vK/pAQWn
+DG/D6Y2jzr6m4808tVgsnsIDHGAiNzn/QQLBKaRlUf8zNKpCFfmVePwt9dqKhXyC
+nfs3LGulqN98VQuALjywY+HNOEiJ6BQGC4K8/dQHaBsPPtkV3ZQRGwIDAQABo4Gg
+MIGdMAwGA1UdEwEB/wQCMAAwHwYDVR0lBBgwFgYIKwYBBQUHAwMGCisGAQQBgjcK
+AwYwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl
+MB0GA1UdDgQWBBRhSCqigw0Ksq1a8QtyUNqQM93O8DAfBgNVHSMEGDAWgBStkZkL
+wiqx9RcEjCO2ZVomjjRaYzANBgkqhkiG9w0BAQsFAAOCAQEAj4qhBh8ptwpK1cX9
+gasl6sB94vxqlqB5k2fuBQ4lEiXkWvaqGvES8wWNh17xWlzLjSNzZR0Vud4ia9ZJ
+Z8mjxtdiTly1+QODQIHch5w8PxwNUZ+UZQqESGfkovimSvDnzc29lOMJ0l0tFhsF
+FQvLRLQ+YUIixCpcTsUdo+LgUrLr9Isr3Dg5XfuIoVZlXytPJv8GeBAS64xdMuPG
+Ra8lm6D/ju9HCaPpizeSkml2fjQ7kgVnTrAl7bxeX4+01spA/+TiMSMMhSWuDFUB
+7OVHXt9bvBQz48b1GLbZ992ztKEx01pcXX0+vwrk5Oi0WX07tIyjG7Ugo7k+hG+M
+IQDDOQ==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 26 21:52:11 2017 GMT
+            Not After : Sep 25 21:52:11 2047 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2017)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ef:9f:fa:9f:19:3a:9d:38:23:91:cc:c4:f9:42:
+                    e0:f8:54:12:82:dc:97:2c:d6:5b:c1:35:eb:ff:4a:
+                    74:06:b5:9d:32:aa:7b:f3:fc:31:5a:34:3e:a1:a4:
+                    44:db:7b:6d:16:af:35:76:e0:9b:99:ad:21:11:c6:
+                    12:4b:ae:24:8f:bb:d3:b2:00:fe:c5:1d:9b:3a:1a:
+                    4a:6c:ca:fa:16:37:85:22:f9:ff:22:fc:40:e0:58:
+                    35:c1:39:27:b4:c6:42:1a:96:d8:a5:c5:95:2e:f7:
+                    c5:1e:21:6e:36:84:f7:a9:a1:e1:f1:03:08:96:65:
+                    71:f8:eb:83:cf:82:f7:9a:44:58:72:00:14:39:29:
+                    4b:e9:78:2f:65:20:b3:80:76:3b:ba:0d:2d:46:f6:
+                    37:05:e7:05:fe:bd:6c:c7:a2:65:b5:06:6e:07:24:
+                    99:a1:c1:cf:e1:0e:5e:49:41:71:17:a8:50:e7:38:
+                    99:e5:6e:b6:db:9f:63:db:56:f4:9c:7d:89:f6:d2:
+                    03:6c:99:83:e0:99:23:39:36:bd:cb:b5:26:7c:7d:
+                    b0:c6:fe:82:7c:52:ed:f9:2c:8f:79:71:3d:a9:2f:
+                    b5:aa:7e:77:a0:fd:69:f9:97:10:a8:b2:c6:7d:88:
+                    9e:a2:19:bd:31:b8:02:2d:34:4d:9d:98:60:82:ad:
+                    04:ff
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                24:2A:DE:75:AC:4A:15:E5:0D:50:C8:4B:0D:45:FF:3E:AE:70:7A:03
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        00:b2:b7:57:b5:2b:5d:16:d3:04:88:6a:d7:77:d5:0d:89:f1:
+        d2:6e:11:d1:8e:f5:62:05:c4:6a:57:df:eb:d2:86:68:f2:fd:
+        a7:37:11:3c:f4:ce:5d:fe:32:5f:31:a2:6b:3a:da:28:c2:88:
+        fa:7f:70:b5:25:99:ea:27:9a:56:6a:9d:b2:0f:14:99:e2:b7:
+        c6:39:1e:8e:a7:76:31:d9:ed:c5:05:8d:48:ae:1b:68:18:14:
+        51:a1:7d:f6:c7:df:cb:9d:eb:a4:3b:0b:ff:c2:07:c5:42:bc:
+        0d:b2:11:fa:37:17:2b:1c:b5:84:48:2d:f9:31:4a:57:49:8e:
+        61:a6:82:11:06:4c:34:ea:9c:2a:47:4d:eb:e0:26:af:da:d2:
+        c2:08:a0:37:35:7b:73:71:de:0b:c4:ba:c8:34:de:20:04:03:
+        6f:46:26:0d:b9:91:02:5b:71:76:cc:45:e4:08:d0:a6:dd:a4:
+        50:d3:d9:04:91:2b:d9:5c:34:88:fc:c2:37:fd:c6:d4:3e:57:
+        f7:6b:ba:7b:d7:02:7a:84:0c:c8:c1:19:cc:bc:fa:52:d5:7f:
+        b3:35:c4:53:5d:70:0a:f6:44:60:8d:a9:11:7a:1b:7d:ae:7b:
+        20:5a:4c:8d:44:f6:c1:a9:61:cb:dc:cb:90:37:d5:28:24:73:
+        87:d0:e0:d8
+-----BEGIN CERTIFICATE-----
+MIIEKDCCAxCgAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNzA5MjYyMTUyMTFaFw00NzA5MjUy
+MTUyMTFaMIGGMQswCQYDVQQGEwJHQjEUMBIGA1UECAwLSXNsZSBvZiBNYW4xFzAV
+BgNVBAoMDkNhbm9uaWNhbCBMdGQuMRQwEgYDVQQLDAtTZWN1cmUgQm9vdDEyMDAG
+A1UEAwwpQ2Fub25pY2FsIEx0ZC4gU2VjdXJlIEJvb3QgU2lnbmluZyAoMjAxNykw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDvn/qfGTqdOCORzMT5QuD4
+VBKC3Jcs1lvBNev/SnQGtZ0yqnvz/DFaND6hpETbe20WrzV24JuZrSERxhJLriSP
+u9OyAP7FHZs6GkpsyvoWN4Ui+f8i/EDgWDXBOSe0xkIaltilxZUu98UeIW42hPep
+oeHxAwiWZXH464PPgveaRFhyABQ5KUvpeC9lILOAdju6DS1G9jcF5wX+vWzHomW1
+Bm4HJJmhwc/hDl5JQXEXqFDnOJnlbrbbn2PbVvScfYn20gNsmYPgmSM5Nr3LtSZ8
+fbDG/oJ8Uu35LI95cT2pL7Wqfneg/Wn5lxCossZ9iJ6iGb0xuAItNE2dmGCCrQT/
+AgMBAAGjgaAwgZ0wDAYDVR0TAQH/BAIwADAfBgNVHSUEGDAWBggrBgEFBQcDAwYK
+KwYBBAGCNwoDBjAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2Vy
+dGlmaWNhdGUwHQYDVR0OBBYEFCQq3nWsShXlDVDISw1F/z6ucHoDMB8GA1UdIwQY
+MBaAFK2RmQvCKrH1FwSMI7ZlWiaONFpjMA0GCSqGSIb3DQEBCwUAA4IBAQAAsrdX
+tStdFtMEiGrXd9UNifHSbhHRjvViBcRqV9/r0oZo8v2nNxE89M5d/jJfMaJrOtoo
+woj6f3C1JZnqJ5pWap2yDxSZ4rfGOR6Op3Yx2e3FBY1IrhtoGBRRoX32x9/Lneuk
+Owv/wgfFQrwNshH6NxcrHLWESC35MUpXSY5hpoIRBkw06pwqR03r4Cav2tLCCKA3
+NXtzcd4LxLrINN4gBANvRiYNuZECW3F2zEXkCNCm3aRQ09kEkSvZXDSI/MI3/cbU
+Plf3a7p71wJ6hAzIwRnMvPpS1X+zNcRTXXAK9kRgjakReht9rnsgWkyNRPbBqWHL
+3MuQN9UoJHOH0ODY
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Oct 26 18:31:14 2018 GMT
+            Not After : Oct 24 18:31:14 2048 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (ESM 2018)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bf:6a:e5:6d:55:7a:ec:7a:11:37:45:9c:4c:8f:
+                    6b:2d:56:d3:74:2b:32:ac:84:2d:ba:cb:cc:ec:8d:
+                    92:22:69:48:a5:d4:f6:75:11:66:2f:cb:b2:fd:9e:
+                    56:ab:e6:f1:52:8e:75:3e:50:bd:25:b3:50:fc:ef:
+                    3d:76:f3:3f:7f:03:f6:e2:a1:25:69:5c:14:98:54:
+                    bd:11:bf:e9:a5:ac:46:91:4b:1d:de:b7:18:2b:c8:
+                    22:83:15:a7:4a:00:8d:9d:e4:c0:da:f7:41:02:fd:
+                    9f:5f:79:93:56:cc:86:e1:b5:e0:39:0e:3c:a2:5b:
+                    fe:c0:56:f0:92:50:5a:2b:67:67:93:56:d7:7a:75:
+                    99:6a:25:b4:63:a8:5f:69:7e:3a:49:58:2a:a7:80:
+                    f6:5a:b4:be:b2:be:a8:8c:45:41:c9:f2:fc:76:a8:
+                    65:ef:99:29:0d:c9:9c:54:6b:0a:f0:4a:0e:61:0d:
+                    ed:99:32:af:12:e2:12:7b:9f:7b:ec:05:c4:e0:b6:
+                    d5:c3:71:28:ae:dd:0b:ba:97:ad:68:0b:76:e9:bf:
+                    e7:01:7e:64:54:39:23:85:36:c8:9d:dd:27:a1:ff:
+                    df:46:36:14:7e:cb:cc:a1:cd:49:0b:6d:c2:0c:45:
+                    99:56:58:7c:87:0d:59:9a:dc:4a:39:3b:1d:d9:15:
+                    2e:b5
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                36:51:88:C1:D3:74:D6:B0:7C:3C:8F:24:0F:8E:F7:22:43:3D:6A:8B
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        4c:0f:cd:77:60:b4:6f:53:87:f3:3c:4f:e6:81:5f:a7:1c:cc:
+        60:29:b6:34:6c:4d:08:9b:e2:d2:bd:f6:17:1a:62:79:b8:17:
+        bc:a2:60:59:fd:03:51:c3:b7:6b:de:73:b3:48:95:f5:0b:aa:
+        b6:3c:b4:34:dc:1d:0b:c4:97:62:87:e7:48:d5:8f:c9:ea:e8:
+        91:8f:2a:40:cd:b7:b3:ee:b2:98:9e:fb:37:31:29:e6:8e:2f:
+        0a:39:99:1e:c6:aa:b8:05:62:85:d3:a8:3e:60:38:98:0f:f0:
+        fe:c7:ab:01:a5:6a:a5:7f:70:a6:26:94:76:23:2f:08:89:74:
+        97:c2:2a:ca:22:3e:7a:ea:22:22:08:07:f4:bb:f6:bc:69:9c:
+        4e:44:33:e2:8e:70:17:b0:9b:cb:33:94:66:6d:ff:9a:7d:e9:
+        50:b2:e8:90:14:e4:2b:91:cb:a0:c5:2e:0e:cf:19:ef:44:ef:
+        84:f0:bd:57:9e:26:c2:63:3d:df:fc:a1:84:de:5c:d7:5f:3b:
+        fb:94:61:f0:93:89:1f:cf:c3:b2:d1:90:97:35:7d:b9:8a:ad:
+        e6:05:f0:e8:3b:a1:7c:af:2b:c4:af:18:33:2e:5e:87:db:9d:
+        80:b5:04:fd:00:d0:60:ab:ff:85:77:0f:cb:47:22:c9:b2:85:
+        a8:48:16:e2
+-----BEGIN CERTIFICATE-----
+MIIELDCCAxSgAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xODEwMjYxODMxMTRaFw00ODEwMjQx
+ODMxMTRaMIGKMQswCQYDVQQGEwJHQjEUMBIGA1UECAwLSXNsZSBvZiBNYW4xFzAV
+BgNVBAoMDkNhbm9uaWNhbCBMdGQuMRQwEgYDVQQLDAtTZWN1cmUgQm9vdDE2MDQG
+A1UEAwwtQ2Fub25pY2FsIEx0ZC4gU2VjdXJlIEJvb3QgU2lnbmluZyAoRVNNIDIw
+MTgpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2rlbVV67HoRN0Wc
+TI9rLVbTdCsyrIQtusvM7I2SImlIpdT2dRFmL8uy/Z5Wq+bxUo51PlC9JbNQ/O89
+dvM/fwP24qElaVwUmFS9Eb/ppaxGkUsd3rcYK8gigxWnSgCNneTA2vdBAv2fX3mT
+VsyG4bXgOQ48olv+wFbwklBaK2dnk1bXenWZaiW0Y6hfaX46SVgqp4D2WrS+sr6o
+jEVByfL8dqhl75kpDcmcVGsK8EoOYQ3tmTKvEuISe5977AXE4LbVw3Eort0Lupet
+aAt26b/nAX5kVDkjhTbInd0nof/fRjYUfsvMoc1JC23CDEWZVlh8hw1ZmtxKOTsd
+2RUutQIDAQABo4GgMIGdMAwGA1UdEwEB/wQCMAAwHwYDVR0lBBgwFgYIKwYBBQUH
+AwMGCisGAQQBgjcKAwYwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVk
+IENlcnRpZmljYXRlMB0GA1UdDgQWBBQ2UYjB03TWsHw8jyQPjvciQz1qizAfBgNV
+HSMEGDAWgBStkZkLwiqx9RcEjCO2ZVomjjRaYzANBgkqhkiG9w0BAQsFAAOCAQEA
+TA/Nd2C0b1OH8zxP5oFfpxzMYCm2NGxNCJvi0r32FxpiebgXvKJgWf0DUcO3a95z
+s0iV9Quqtjy0NNwdC8SXYofnSNWPyerokY8qQM23s+6ymJ77NzEp5o4vCjmZHsaq
+uAVihdOoPmA4mA/w/serAaVqpX9wpiaUdiMvCIl0l8IqyiI+euoiIggH9Lv2vGmc
+TkQz4o5wF7CbyzOUZm3/mn3pULLokBTkK5HLoMUuDs8Z70TvhPC9V54mwmM93/yh
+hN5c1187+5Rh8JOJH8/DstGQlzV9uYqt5gXw6DuhfK8rxK8YMy5eh9udgLUE/QDQ
+YKv/hXcPy0ciybKFqEgW4g==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4 (0x4)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 18 16:10:17 2019 GMT
+            Not After : Sep 16 16:10:17 2049 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2019)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e6:47:d8:75:e5:87:59:26:87:83:7d:5b:7a:b8:
+                    58:3d:7c:ef:36:f8:a0:7a:b7:14:56:58:7d:01:f1:
+                    1c:3b:8c:e6:5b:03:77:7d:a0:ed:47:0a:45:e6:75:
+                    5c:de:95:38:0d:38:fa:41:79:89:56:31:87:e7:a3:
+                    9a:36:70:b6:cf:24:2f:99:26:89:08:39:0e:14:c3:
+                    35:be:02:8b:52:e1:8e:7b:0c:a6:9d:78:ff:01:60:
+                    d7:f5:c3:d5:f0:5e:dc:e4:23:09:59:72:93:d3:b5:
+                    22:af:7c:cd:e0:84:0f:af:11:2d:bc:c6:72:42:af:
+                    ea:67:63:c4:10:41:78:02:80:62:0d:43:74:b4:1c:
+                    ed:50:d7:94:f1:b0:bb:f9:57:80:e4:69:0f:83:4b:
+                    a2:e6:2c:4a:9a:e1:7d:7c:62:19:29:27:97:1f:4c:
+                    f1:85:f0:39:f5:31:9f:3a:39:0e:d4:4d:07:3a:40:
+                    55:4b:a6:6c:9d:04:89:51:2d:7c:b0:ef:40:b5:42:
+                    29:16:cc:65:73:38:62:21:f6:e3:2c:17:50:9d:74:
+                    34:4e:df:7c:4a:33:a4:bb:40:cf:d5:e5:ed:05:07:
+                    cd:4c:f9:af:7f:a6:5c:b9:f7:c5:16:45:4e:44:40:
+                    d7:85:32:de:ac:e5:75:ad:9b:d7:c0:26:33:1f:77:
+                    a5:37
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                C0:74:6F:D6:C5:DA:3A:E8:27:86:46:51:AD:66:AE:47:FE:24:B3:E8
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        aa:12:6c:d1:9d:6a:da:f0:ec:7c:17:46:3b:57:b8:d6:76:5f:
+        24:e6:06:a2:0a:55:1f:2f:d3:5e:8f:de:cf:02:f2:ff:e0:dd:
+        d3:c7:bd:75:59:aa:cd:34:f3:28:80:73:cc:28:69:e7:a2:70:
+        88:a2:c7:dc:66:f0:92:0e:ff:64:bf:30:04:54:01:1b:96:ad:
+        15:c5:61:fd:32:61:d7:5e:b5:ba:91:fd:31:fc:6b:15:df:ee:
+        22:d9:e4:1f:f3:cc:8b:0c:9f:f5:e8:f7:e2:62:3f:40:52:c9:
+        f0:f1:1c:63:fc:6c:90:e1:5b:74:03:b9:df:d1:3e:a8:ec:db:
+        2b:6e:83:6f:9f:7f:ba:b4:79:fc:3d:e7:12:2f:4a:e7:17:8c:
+        2b:77:a5:90:74:3c:bd:cf:75:83:0d:1a:95:d5:56:ef:07:9b:
+        a6:b3:31:e3:8c:97:ce:68:11:b5:7b:25:03:72:1c:ea:67:e9:
+        7c:3e:73:c7:7c:3e:fc:f5:ae:8a:b2:07:0d:15:6a:66:09:d7:
+        23:b9:5d:80:7a:26:d6:b6:22:30:aa:84:af:c0:42:e9:75:c3:
+        59:ab:a3:84:87:6b:0c:b7:ab:4e:92:69:ae:2c:82:6f:ab:01:
+        24:ab:ff:78:6d:59:85:c2:3b:23:c0:bd:0d:d8:6e:3a:29:82:
+        e1:c4:5f:db
+-----BEGIN CERTIFICATE-----
+MIIEKDCCAxCgAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xOTA5MTgxNjEwMTdaFw00OTA5MTYx
+NjEwMTdaMIGGMQswCQYDVQQGEwJHQjEUMBIGA1UECAwLSXNsZSBvZiBNYW4xFzAV
+BgNVBAoMDkNhbm9uaWNhbCBMdGQuMRQwEgYDVQQLDAtTZWN1cmUgQm9vdDEyMDAG
+A1UEAwwpQ2Fub25pY2FsIEx0ZC4gU2VjdXJlIEJvb3QgU2lnbmluZyAoMjAxOSkw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDmR9h15YdZJoeDfVt6uFg9
+fO82+KB6txRWWH0B8Rw7jOZbA3d9oO1HCkXmdVzelTgNOPpBeYlWMYfno5o2cLbP
+JC+ZJokIOQ4UwzW+AotS4Y57DKadeP8BYNf1w9XwXtzkIwlZcpPTtSKvfM3ghA+v
+ES28xnJCr+pnY8QQQXgCgGINQ3S0HO1Q15TxsLv5V4DkaQ+DS6LmLEqa4X18Yhkp
+J5cfTPGF8Dn1MZ86OQ7UTQc6QFVLpmydBIlRLXyw70C1QikWzGVzOGIh9uMsF1Cd
+dDRO33xKM6S7QM/V5e0FB81M+a9/ply598UWRU5EQNeFMt6s5XWtm9fAJjMfd6U3
+AgMBAAGjgaAwgZ0wDAYDVR0TAQH/BAIwADAfBgNVHSUEGDAWBggrBgEFBQcDAwYK
+KwYBBAGCNwoDBjAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2Vy
+dGlmaWNhdGUwHQYDVR0OBBYEFMB0b9bF2jroJ4ZGUa1mrkf+JLPoMB8GA1UdIwQY
+MBaAFK2RmQvCKrH1FwSMI7ZlWiaONFpjMA0GCSqGSIb3DQEBCwUAA4IBAQCqEmzR
+nWra8Ox8F0Y7V7jWdl8k5gaiClUfL9Nej97PAvL/4N3Tx711WarNNPMogHPMKGnn
+onCIosfcZvCSDv9kvzAEVAEblq0VxWH9MmHXXrW6kf0x/GsV3+4i2eQf88yLDJ/1
+6PfiYj9AUsnw8Rxj/GyQ4Vt0A7nf0T6o7NsrboNvn3+6tHn8PecSL0rnF4wrd6WQ
+dDy9z3WDDRqV1VbvB5umszHjjJfOaBG1eyUDchzqZ+l8PnPHfD789a6KsgcNFWpm
+CdcjuV2AeibWtiIwqoSvwELpdcNZq6OEh2sMt6tOkmmuLIJvqwEkq/94bVmFwjsj
+wL0N2G46KYLhxF/b
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 6 (0x6)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 23 19:29:32 2021 GMT
+            Not After : Sep 22 19:29:32 2051 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2021 v1)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:aa:b8:34:5b:b6:ae:44:bf:41:e1:78:11:b9:7a:
+                    c8:88:b3:b0:26:50:10:9c:98:d1:f3:98:9f:23:50:
+                    64:f6:39:dd:50:3a:23:44:53:65:fc:f3:9f:f5:a5:
+                    8b:ae:8b:df:47:9f:e9:d5:a0:92:19:f1:21:ea:cc:
+                    59:3a:74:df:45:71:bc:de:64:15:a5:f6:db:ca:71:
+                    fa:19:d4:44:0d:12:ec:47:3a:43:e2:f2:dd:8b:fe:
+                    0d:7b:dc:4d:db:53:06:22:61:e5:8b:35:49:b6:33:
+                    c4:0a:69:5f:5b:81:09:84:6b:42:33:18:09:9d:a0:
+                    35:f7:9c:1e:de:6e:de:90:69:1a:e8:32:e4:49:ad:
+                    c3:31:e9:f8:4a:a2:28:1d:db:0d:29:b6:48:0a:44:
+                    93:86:41:62:8f:73:97:60:10:8a:74:46:66:55:fe:
+                    a0:95:35:9e:ef:9f:af:11:fa:5b:a3:7c:c2:35:64:
+                    11:67:28:1e:14:0a:7d:68:61:9c:cd:c7:46:39:30:
+                    31:79:94:56:b3:45:16:9a:b5:77:66:fe:41:43:0f:
+                    00:48:6e:99:dd:0c:d4:47:2c:86:8c:50:04:61:20:
+                    dd:aa:8e:73:4f:21:b4:ee:09:4d:d3:40:01:d0:f2:
+                    a7:5b:7d:05:3d:c1:e7:65:26:aa:8c:9a:58:5a:7c:
+                    6d:6f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                A8:D5:4B:BB:38:25:CF:B9:4F:A1:3C:9F:8A:59:4A:19:5C:10:7B:8D
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        24:25:25:7e:01:a5:c8:3d:54:8c:1b:05:73:d1:06:d8:db:d4:
+        3a:71:d5:19:9d:97:1c:85:3c:ca:38:5a:0c:25:25:39:1a:67:
+        bc:6c:9d:98:6c:f3:7d:5f:b7:40:f9:73:a0:f5:7b:40:a8:66:
+        a5:f1:53:b1:78:80:24:3f:19:50:2f:02:09:ec:a1:8a:e6:0d:
+        df:c4:ae:24:9e:69:0d:5c:dc:44:4c:38:3a:53:4e:4b:a1:4b:
+        92:9f:43:a4:9d:1e:76:33:18:1b:bf:62:e5:f5:bc:93:3c:4e:
+        21:d5:5b:20:69:11:28:c1:c5:93:b5:8e:96:1d:1b:ca:72:79:
+        24:de:67:2a:50:9d:ce:8b:41:dd:3e:82:dd:a5:04:75:54:fb:
+        35:70:98:87:b4:f3:ea:41:23:23:80:0e:99:d7:03:16:ee:7e:
+        11:e2:c8:29:ab:73:c5:6d:5c:a8:2f:32:03:9f:8e:66:d6:cb:
+        54:84:55:75:ab:9a:dd:95:fd:05:1e:11:85:37:1e:63:d2:f4:
+        7f:34:64:32:a1:63:91:91:50:39:14:1a:ea:54:78:e6:0d:04:
+        23:c7:83:51:c5:25:27:07:6c:f8:65:b7:da:95:89:76:83:cc:
+        f3:7e:06:74:d3:6c:ef:e9:17:de:29:1e:ab:5c:d7:ec:df:f1:
+        98:b8:e9:66
+-----BEGIN CERTIFICATE-----
+MIIELTCCAxWgAwIBAgIBBjANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAgFw0yMTA5MjMxOTI5MzJaGA8yMDUxMDky
+MjE5MjkzMlowgYkxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MTUw
+MwYDVQQDDCxDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nICgyMDIx
+IHYxKTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKq4NFu2rkS/QeF4
+Ebl6yIizsCZQEJyY0fOYnyNQZPY53VA6I0RTZfzzn/Wli66L30ef6dWgkhnxIerM
+WTp030VxvN5kFaX228px+hnURA0S7Ec6Q+Ly3Yv+DXvcTdtTBiJh5Ys1SbYzxApp
+X1uBCYRrQjMYCZ2gNfecHt5u3pBpGugy5EmtwzHp+EqiKB3bDSm2SApEk4ZBYo9z
+l2AQinRGZlX+oJU1nu+frxH6W6N8wjVkEWcoHhQKfWhhnM3HRjkwMXmUVrNFFpq1
+d2b+QUMPAEhumd0M1EcshoxQBGEg3aqOc08htO4JTdNAAdDyp1t9BT3B52Umqoya
+WFp8bW8CAwEAAaOBoDCBnTAMBgNVHRMBAf8EAjAAMB8GA1UdJQQYMBYGCCsGAQUF
+BwMDBgorBgEEAYI3CgMGMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRl
+ZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUqNVLuzglz7lPoTyfillKGVwQe40wHwYD
+VR0jBBgwFoAUrZGZC8IqsfUXBIwjtmVaJo40WmMwDQYJKoZIhvcNAQELBQADggEB
+ACQlJX4Bpcg9VIwbBXPRBtjb1Dpx1RmdlxyFPMo4WgwlJTkaZ7xsnZhs831ft0D5
+c6D1e0CoZqXxU7F4gCQ/GVAvAgnsoYrmDd/EriSeaQ1c3ERMODpTTkuhS5KfQ6Sd
+HnYzGBu/YuX1vJM8TiHVWyBpESjBxZO1jpYdG8pyeSTeZypQnc6LQd0+gt2lBHVU
++zVwmIe08+pBIyOADpnXAxbufhHiyCmrc8VtXKgvMgOfjmbWy1SEVXWrmt2V/QUe
+EYU3HmPS9H80ZDKhY5GRUDkUGupUeOYNBCPHg1HFJScHbPhlt9qViXaDzPN+BnTT
+bO/pF94pHqtc1+zf8Zi46WY=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7 (0x7)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 23 19:29:42 2021 GMT
+            Not After : Sep 22 19:29:42 2051 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2021 v2)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ba:06:8b:ee:58:b7:8b:49:7b:53:7a:d1:df:02:
+                    e3:f2:d8:b0:8c:03:5c:f4:2d:0b:d8:18:3b:23:fa:
+                    68:b0:e8:e9:9d:dc:a2:eb:5e:d3:06:a9:28:d4:9f:
+                    14:b6:1e:1c:1d:ef:69:0e:7f:44:f2:cc:4a:f1:b1:
+                    d0:71:30:6a:50:1e:b0:d3:f8:a4:19:d0:4a:f1:e3:
+                    eb:7a:e5:57:4c:a1:fb:d1:87:b9:48:e0:55:37:52:
+                    f9:de:99:2e:95:85:36:ce:d3:1d:67:2f:14:cb:7f:
+                    05:82:75:21:b6:aa:a5:14:ac:da:4a:f4:fe:fa:5c:
+                    33:49:3d:6f:de:fd:9d:75:ba:e2:c4:02:38:b5:69:
+                    f5:ff:a8:67:4b:3a:e0:34:f6:3b:07:03:a5:7e:59:
+                    6f:3a:d2:28:a4:2f:25:ac:d8:a9:1f:59:52:5d:24:
+                    36:58:51:b5:f0:12:a8:d3:78:56:57:b1:e0:a9:df:
+                    14:05:65:7c:b5:a5:00:f0:88:39:14:44:18:85:2d:
+                    0c:28:69:7b:b9:b4:1c:47:6f:43:66:4c:22:ad:f7:
+                    f6:19:75:e1:14:2c:0d:33:3f:c1:3f:fc:73:56:b2:
+                    68:05:b5:92:03:9b:65:6b:81:80:92:35:03:9b:66:
+                    68:58:c5:66:11:b6:8c:7f:05:09:9a:45:a6:0e:5e:
+                    5f:bf
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                4C:F0:46:89:2D:6F:D3:C9:A5:B0:3F:98:D8:45:F9:08:51:DC:6A:8C
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        93:9d:49:7d:9f:3e:3e:27:79:97:d9:c2:fc:0b:f7:30:b7:f4:
+        78:b2:c9:e4:5e:42:d3:27:26:70:cf:88:96:d1:f2:ea:a0:75:
+        7e:3c:f6:b7:d2:e7:95:30:e3:a6:67:a7:ee:b9:53:8f:fd:b2:
+        cb:db:e1:98:32:be:98:79:09:46:c6:63:6a:57:87:4d:b2:26:
+        46:f6:34:5e:18:75:ca:82:80:8e:33:c2:1d:c7:76:d7:14:57:
+        ef:2e:0e:9e:58:5c:81:8e:ed:53:2c:07:46:0a:8a:fc:2f:f5:
+        b2:c8:58:f5:fa:fa:bb:f9:7d:47:13:39:f0:f2:1c:15:9c:75:
+        90:40:bd:08:04:b3:6a:de:c2:cd:34:21:7e:ba:31:48:bc:a1:
+        23:bc:ee:93:b2:62:96:27:30:86:c2:d4:f7:b4:e6:3c:71:47:
+        37:84:ff:3d:0c:1e:ec:f3:0e:da:6b:dc:64:7a:b8:c0:7e:45:
+        13:09:bf:02:b3:b7:5b:6d:09:2d:6a:4e:0b:93:94:29:4c:a6:
+        c3:c7:05:fa:69:08:04:53:3c:4c:64:c0:7e:89:00:91:1b:a6:
+        c2:d7:ea:c4:db:86:38:fe:66:03:85:7b:fc:39:24:99:4c:2a:
+        3e:10:8b:91:c3:6e:20:9d:0c:ee:51:70:b5:98:58:f3:5c:ac:
+        16:98:7b:ce
+-----BEGIN CERTIFICATE-----
+MIIELTCCAxWgAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAgFw0yMTA5MjMxOTI5NDJaGA8yMDUxMDky
+MjE5Mjk0MlowgYkxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MTUw
+MwYDVQQDDCxDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nICgyMDIx
+IHYyKTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALoGi+5Yt4tJe1N6
+0d8C4/LYsIwDXPQtC9gYOyP6aLDo6Z3coute0wapKNSfFLYeHB3vaQ5/RPLMSvGx
+0HEwalAesNP4pBnQSvHj63rlV0yh+9GHuUjgVTdS+d6ZLpWFNs7THWcvFMt/BYJ1
+IbaqpRSs2kr0/vpcM0k9b979nXW64sQCOLVp9f+oZ0s64DT2OwcDpX5ZbzrSKKQv
+JazYqR9ZUl0kNlhRtfASqNN4Vlex4KnfFAVlfLWlAPCIORREGIUtDChpe7m0HEdv
+Q2ZMIq339hl14RQsDTM/wT/8c1ayaAW1kgObZWuBgJI1A5tmaFjFZhG2jH8FCZpF
+pg5eX78CAwEAAaOBoDCBnTAMBgNVHRMBAf8EAjAAMB8GA1UdJQQYMBYGCCsGAQUF
+BwMDBgorBgEEAYI3CgMGMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRl
+ZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUTPBGiS1v08mlsD+Y2EX5CFHcaowwHwYD
+VR0jBBgwFoAUrZGZC8IqsfUXBIwjtmVaJo40WmMwDQYJKoZIhvcNAQELBQADggEB
+AJOdSX2fPj4neZfZwvwL9zC39HiyyeReQtMnJnDPiJbR8uqgdX489rfS55Uw46Zn
+p+65U4/9ssvb4Zgyvph5CUbGY2pXh02yJkb2NF4YdcqCgI4zwh3HdtcUV+8uDp5Y
+XIGO7VMsB0YKivwv9bLIWPX6+rv5fUcTOfDyHBWcdZBAvQgEs2rews00IX66MUi8
+oSO87pOyYpYnMIbC1Pe05jxxRzeE/z0MHuzzDtpr3GR6uMB+RRMJvwKzt1ttCS1q
+TguTlClMpsPHBfppCARTPExkwH6JAJEbpsLX6sTbhjj+ZgOFe/w5JJlMKj4Qi5HD
+biCdDO5RcLWYWPNcrBaYe84=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8 (0x8)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 23 19:30:02 2021 GMT
+            Not After : Sep 22 19:30:02 2051 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2021 v3)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d6:29:96:87:ae:07:42:45:bb:65:09:b2:9b:de:
+                    5d:8e:78:61:10:d5:6d:ae:ae:26:08:6a:06:ec:4a:
+                    dd:2b:e7:1a:a9:ad:78:e3:fc:cf:8f:d1:47:bd:1e:
+                    33:d8:7a:e3:66:9b:e9:73:c1:5f:42:e2:fe:bc:c3:
+                    41:f7:cd:d7:85:d7:42:c9:ea:31:e5:47:b1:93:5b:
+                    43:2b:07:51:b8:75:08:ad:0f:e7:0d:81:38:5a:21:
+                    df:b1:43:5b:db:37:c5:ac:aa:14:3a:33:19:6a:26:
+                    e0:05:fe:cd:41:31:af:5d:a8:ab:31:77:44:fc:da:
+                    00:e2:7a:44:33:c3:a7:ed:13:54:9f:19:5d:c9:98:
+                    a2:3b:af:4d:0d:87:29:9c:90:9e:42:9e:9a:06:6a:
+                    70:27:c5:aa:f7:a2:f2:88:e0:b9:66:9a:72:a0:f6:
+                    61:7e:30:8f:14:9f:44:0d:dd:54:ae:47:c8:82:ba:
+                    d2:b2:db:6f:24:c1:f4:0a:81:07:90:47:49:5f:57:
+                    d6:3f:bf:2a:73:98:f2:f6:24:1a:74:03:d7:35:f0:
+                    42:d8:14:c5:94:27:5d:3c:49:0c:b0:f0:7a:61:1b:
+                    d7:5a:e3:a3:40:57:e9:a4:07:ee:02:a3:32:27:94:
+                    bb:f3:36:c5:5f:ef:d3:07:04:3a:80:4c:9c:0a:b7:
+                    88:9f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                10:04:37:BB:6D:E6:E4:69:B5:81:E6:1C:D6:6B:CE:3E:F4:ED:53:AF
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        3b:37:d6:a8:8d:cd:d2:df:13:35:ac:8c:92:d6:b0:ac:d1:38:
+        a8:00:97:47:59:b8:4a:84:8c:80:a5:1d:c7:29:bf:00:66:e5:
+        10:40:26:2e:31:f5:e1:13:c0:1b:29:f3:0b:7e:2d:71:d8:db:
+        e1:32:8f:79:8e:e3:97:0c:40:a9:a0:12:c1:fc:c2:50:88:72:
+        44:c5:bc:8b:45:6e:28:fd:d2:37:d6:db:17:cf:4e:61:33:08:
+        5a:5d:08:94:73:44:e2:76:00:44:1b:b8:00:a1:86:00:64:8a:
+        f1:42:32:3c:28:11:67:7c:8b:aa:06:34:74:58:e8:b3:3a:36:
+        8d:f6:04:5d:37:f5:66:52:c9:48:b0:a7:6f:34:09:dd:60:2a:
+        86:b9:14:f1:09:f6:06:16:56:e0:51:b1:e8:75:7f:fa:37:dc:
+        e0:98:a7:69:ae:7b:1a:73:89:0d:06:67:cc:01:ef:80:31:45:
+        9e:bb:03:2a:eb:89:70:d6:19:b2:c7:ce:bc:81:df:da:c8:6f:
+        a9:4b:2d:d7:a7:e1:af:c6:e8:fb:f0:61:c9:cd:d2:91:cd:8b:
+        c2:6c:ef:e0:b6:7f:f1:c4:81:f9:bb:76:9c:26:e3:fa:a1:a0:
+        cd:5e:05:de:ee:f9:1b:5b:50:0a:8b:0f:47:e3:90:32:ac:2a:
+        e7:65:02:80
+-----BEGIN CERTIFICATE-----
+MIIELTCCAxWgAwIBAgIBCDANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAgFw0yMTA5MjMxOTMwMDJaGA8yMDUxMDky
+MjE5MzAwMlowgYkxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MTUw
+MwYDVQQDDCxDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nICgyMDIx
+IHYzKTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANYploeuB0JFu2UJ
+spveXY54YRDVba6uJghqBuxK3SvnGqmteOP8z4/RR70eM9h642ab6XPBX0Li/rzD
+QffN14XXQsnqMeVHsZNbQysHUbh1CK0P5w2BOFoh37FDW9s3xayqFDozGWom4AX+
+zUExr12oqzF3RPzaAOJ6RDPDp+0TVJ8ZXcmYojuvTQ2HKZyQnkKemgZqcCfFqvei
+8ojguWaacqD2YX4wjxSfRA3dVK5HyIK60rLbbyTB9AqBB5BHSV9X1j+/KnOY8vYk
+GnQD1zXwQtgUxZQnXTxJDLDwemEb11rjo0BX6aQH7gKjMieUu/M2xV/v0wcEOoBM
+nAq3iJ8CAwEAAaOBoDCBnTAMBgNVHRMBAf8EAjAAMB8GA1UdJQQYMBYGCCsGAQUF
+BwMDBgorBgEEAYI3CgMGMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRl
+ZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUEAQ3u23m5Gm1geYc1mvOPvTtU68wHwYD
+VR0jBBgwFoAUrZGZC8IqsfUXBIwjtmVaJo40WmMwDQYJKoZIhvcNAQELBQADggEB
+ADs31qiNzdLfEzWsjJLWsKzROKgAl0dZuEqEjIClHccpvwBm5RBAJi4x9eETwBsp
+8wt+LXHY2+Eyj3mO45cMQKmgEsH8wlCIckTFvItFbij90jfW2xfPTmEzCFpdCJRz
+ROJ2AEQbuAChhgBkivFCMjwoEWd8i6oGNHRY6LM6No32BF039WZSyUiwp280Cd1g
+Koa5FPEJ9gYWVuBRseh1f/o33OCYp2muexpziQ0GZ8wB74AxRZ67AyrriXDWGbLH
+zryB39rIb6lLLden4a/G6PvwYcnN0pHNi8Js7+C2f/HEgfm7dpwm4/qhoM1eBd7u
++RtbUAqLD0fjkDKsKudlAoA=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Mar  4 10:27:14 2020 GMT
+            Not After : Mar  3 10:27:14 2050 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (Ubuntu Core 2019)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b9:10:47:2e:75:5d:f3:10:23:bb:a0:75:d2:fa:
+                    02:2d:ff:22:df:c1:e6:cd:38:7c:36:0f:ae:74:15:
+                    6e:a5:34:52:2b:c3:a4:3a:60:d7:06:ee:1d:99:93:
+                    ff:66:91:a3:18:52:2c:8c:58:e6:b4:2f:4b:c5:fb:
+                    83:e6:f3:19:bd:1b:ca:23:ec:97:1f:d8:f1:9a:f1:
+                    04:da:da:10:04:53:4b:ec:1d:b6:26:47:7c:bb:8f:
+                    a7:0a:6e:2e:e8:91:e6:c4:bb:64:34:78:3c:fa:09:
+                    15:1c:8f:9e:eb:04:99:36:22:c6:8d:07:15:0f:b9:
+                    69:08:fa:ff:4b:45:bd:ba:2b:cd:01:0e:e7:01:23:
+                    c9:e5:7a:39:3b:91:b0:45:3c:d5:77:ba:ca:f9:29:
+                    3d:11:3f:1c:6b:5b:8e:6c:4b:3f:c9:29:05:cb:59:
+                    d6:b1:c1:c0:2d:56:88:70:27:fa:73:05:5c:c2:11:
+                    d4:27:11:f7:0b:c2:d5:68:d3:1a:cd:ed:d0:e4:10:
+                    ff:34:cb:b7:45:70:34:2c:23:53:b6:9c:30:70:b4:
+                    5c:d1:e2:64:18:82:8f:62:b1:5e:aa:0b:d4:89:f2:
+                    1c:53:c4:32:7d:ef:53:ee:9b:6e:02:ab:78:bd:25:
+                    67:8b:39:36:d8:84:3b:06:99:02:d6:75:73:4e:f2:
+                    f6:b9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                C1:D5:7B:8F:6B:74:3F:23:EE:41:F4:F7:EE:29:2F:06:EE:CA:DF:B9
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        2d:b5:11:a8:d2:a0:af:81:a0:18:22:18:2c:08:d0:f4:63:e8:
+        8f:9a:f4:f5:20:dd:eb:22:77:19:9a:1a:09:3d:7f:aa:7d:c9:
+        81:bc:26:98:65:94:46:30:4b:c2:51:7c:f7:21:41:63:87:31:
+        fc:a4:c9:41:28:c7:2e:2a:2e:d8:a8:75:7a:72:77:3b:1b:9f:
+        72:15:0d:0c:96:8d:8b:51:f3:ce:37:b6:ca:9f:ca:59:40:4a:
+        fc:73:7a:94:12:99:aa:c2:8d:52:ce:91:19:2e:b4:da:ff:e5:
+        2c:67:74:d9:58:47:38:2f:61:88:c5:cf:a7:48:e1:08:ba:bc:
+        ec:d5:3a:47:d9:8c:dc:c3:bc:cb:98:2b:79:7a:02:46:ef:85:
+        19:2f:03:4b:05:84:eb:56:98:5f:6d:cf:a5:8b:a2:b6:e5:50:
+        51:7c:33:44:bd:7a:94:2e:0d:90:39:39:3e:62:60:ae:3a:e2:
+        f5:17:fa:f1:94:06:1d:ae:a3:f8:19:20:7f:4b:4c:07:c4:e6:
+        2d:0d:e5:94:84:51:6d:6f:0f:c4:c6:79:1d:f0:e8:0e:23:9e:
+        fd:f9:46:2c:b9:ec:97:38:56:7e:b8:13:f6:d2:e1:8e:a5:93:
+        02:7b:6e:dd:33:9a:bf:10:a8:1b:3d:fa:c4:f2:15:f0:27:73:
+        26:a6:94:d1
+-----BEGIN CERTIFICATE-----
+MIIENjCCAx6gAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAgFw0yMDAzMDQxMDI3MTRaGA8yMDUwMDMw
+MzEwMjcxNFowgZIxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MT4w
+PAYDVQQDDDVDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nIChVYnVu
+dHUgQ29yZSAyMDE5KTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALkQ
+Ry51XfMQI7ugddL6Ai3/It/B5s04fDYPrnQVbqU0UivDpDpg1wbuHZmT/2aRoxhS
+LIxY5rQvS8X7g+bzGb0byiPslx/Y8ZrxBNraEARTS+wdtiZHfLuPpwpuLuiR5sS7
+ZDR4PPoJFRyPnusEmTYixo0HFQ+5aQj6/0tFvborzQEO5wEjyeV6OTuRsEU81Xe6
+yvkpPRE/HGtbjmxLP8kpBctZ1rHBwC1WiHAn+nMFXMIR1CcR9wvC1WjTGs3t0OQQ
+/zTLt0VwNCwjU7acMHC0XNHiZBiCj2KxXqoL1InyHFPEMn3vU+6bbgKreL0lZ4s5
+NtiEOwaZAtZ1c07y9rkCAwEAAaOBoDCBnTAMBgNVHRMBAf8EAjAAMB8GA1UdJQQY
+MBYGCCsGAQUFBwMDBgorBgEEAYI3CgMGMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM
+IEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUwdV7j2t0PyPuQfT37ikv
+Bu7K37kwHwYDVR0jBBgwFoAUrZGZC8IqsfUXBIwjtmVaJo40WmMwDQYJKoZIhvcN
+AQELBQADggEBAC21EajSoK+BoBgiGCwI0PRj6I+a9PUg3esidxmaGgk9f6p9yYG8
+JphllEYwS8JRfPchQWOHMfykyUEoxy4qLtiodXpydzsbn3IVDQyWjYtR8843tsqf
+yllASvxzepQSmarCjVLOkRkutNr/5SxndNlYRzgvYYjFz6dI4Qi6vOzVOkfZjNzD
+vMuYK3l6AkbvhRkvA0sFhOtWmF9tz6WLorblUFF8M0S9epQuDZA5OT5iYK464vUX
++vGUBh2uo/gZIH9LTAfE5i0N5ZSEUW1vD8TGeR3w6A4jnv35Riy57Jc4Vn64E/bS
+4Y6lkwJ7bt0zmr8QqBs9+sTyFfAncyamlNE=
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/certs/canonical-livepatch-2025-all.pem
+++ linux-qcom-6.8.0/debian/certs/canonical-livepatch-2025-all.pem
@@ -0,0 +1,125 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            47:77:26:6d:ae:6c:57:73:eb:80:e2:96:dd:26:93:ff:e9:f5:62:5d
+        Signature Algorithm: sha512WithRSAEncryption
+        Issuer: CN=Canonical Ltd. Live Patch Signing 2025 Kmod
+        Validity
+            Not Before: May 16 09:07:40 2025 GMT
+            Not After : May 16 09:07:40 2050 GMT
+        Subject: CN=Canonical Ltd. Live Patch Signing 2025 Kmod
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:b8:a9:03:47:2e:7b:c6:86:16:f4:b7:a8:4d:3b:
+                    05:f6:c4:75:35:e9:22:8a:4e:40:06:89:15:7f:ad:
+                    99:bb:e6:90:93:61:c8:16:cf:2e:00:1b:81:36:fd:
+                    cc:31:7b:97:79:8d:5e:d2:4d:d3:2f:ab:35:2d:74:
+                    48:98:b3:d9:75:f9:bb:e1:f2:3f:6b:6d:dc:e4:bb:
+                    ee:f5:aa:f7:8a:8c:7a:a8:0b:df:b1:f8:d6:04:13:
+                    27:e9:1a:aa:c2:4d:d2:35:3a:bc:06:d7:83:7f:e8:
+                    c4:1c:63:8b:3a:ff:0e:0b:89:6e:4f:5f:ea:ad:78:
+                    df:37:ab:f9:55:1d:fb:6e:29:a4:22:43:d1:9b:12:
+                    1e:b2:84:23:1b:d2:38:91:b8:a8:6c:1c:59:3c:ff:
+                    4c:a9:18:ce:d0:7f:1d:ef:04:cf:8a:e8:29:b2:4b:
+                    68:0d:92:32:bc:9c:5d:8f:0a:d1:dd:4d:25:ba:3a:
+                    8c:6a:48:5b:1e:9c:01:10:99:c1:a7:34:ee:68:ec:
+                    a1:d3:26:be:45:c8:b4:97:ac:8a:aa:7e:13:a6:e5:
+                    43:f1:1b:3f:a1:80:0a:d2:a9:e7:f2:77:ca:e1:f5:
+                    29:36:df:75:8a:7e:02:d6:17:aa:46:12:b9:51:f0:
+                    6b:ca:22:f8:05:de:d6:02:47:76:0c:88:f1:c6:90:
+                    44:99:58:71:c7:62:1e:2b:94:c5:2b:8e:dc:ca:7b:
+                    a7:bd:cd:38:8f:4e:73:6d:b0:9b:4e:7c:12:1f:5c:
+                    c5:62:d6:82:c6:d2:78:09:52:dc:d7:78:2e:23:d0:
+                    63:1f:7d:77:91:c8:3f:66:7a:20:8a:cf:70:09:0f:
+                    a2:c0:82:a5:42:d9:be:dc:5f:78:73:f7:fa:3c:70:
+                    47:7b:39:77:89:5a:6f:ef:83:09:c9:1b:21:53:89:
+                    7c:10:bf:99:9c:05:39:32:1e:84:3b:a5:84:7e:ef:
+                    08:6d:b0:b0:31:61:d6:1a:aa:dd:7a:d6:10:02:e6:
+                    72:02:e5:40:bf:07:b9:cd:61:d1:55:04:9a:cd:02:
+                    73:41:c1:df:20:30:12:97:ca:a1:83:1a:97:8a:92:
+                    1c:47:5c:0a:60:da:41:3b:e6:0e:2c:82:ce:45:65:
+                    81:ba:45:a1:66:cc:ef:ab:65:5c:e5:a8:0c:86:dd:
+                    fc:86:54:f3:37:7c:89:a9:0c:fa:3a:da:82:c9:90:
+                    99:1e:1d:66:44:de:d3:c5:d4:0b:da:15:f8:d8:d4:
+                    63:2b:4e:6f:24:e9:c2:d7:74:9c:29:91:9f:25:39:
+                    8d:77:15:8c:cb:8e:ad:e3:80:0a:ea:79:04:72:9d:
+                    51:01:18:ae:35:51:ef:95:79:38:c4:db:99:50:47:
+                    62:38:e9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Key Identifier: 
+                D5:41:CE:F6:1D:C7:E7:93:B7:EB:7E:89:99:70:A2:EE:F0:B5:DC:8C
+            X509v3 Authority Key Identifier: 
+                D5:41:CE:F6:1D:C7:E7:93:B7:EB:7E:89:99:70:A2:EE:F0:B5:DC:8C
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.2312.16.1.2
+    Signature Algorithm: sha512WithRSAEncryption
+    Signature Value:
+        40:9d:5b:70:66:fe:9c:99:eb:ed:78:61:be:da:67:da:ac:80:
+        a8:c2:78:91:f8:90:11:be:9f:6a:e7:bf:79:dc:11:0c:c7:83:
+        e8:13:c4:1c:b6:fe:f0:e7:7d:1a:12:97:5d:19:56:9c:10:12:
+        1e:b9:19:88:30:95:c4:3b:2f:aa:91:6f:c1:9e:68:4a:f4:5c:
+        ef:a1:51:b5:a3:9b:58:3f:e2:ae:5c:29:a6:c4:30:fd:65:0b:
+        cc:8c:99:95:33:61:c6:07:fa:c3:bd:1a:57:80:e5:43:97:2e:
+        f3:5c:d6:1e:b7:23:9f:58:10:19:24:46:9e:f8:fd:2c:8e:88:
+        e7:ec:ef:15:4b:7a:6a:ce:b0:25:c0:01:c5:21:83:1a:d5:89:
+        0c:90:86:ad:d4:3e:6e:28:bf:6c:21:91:ff:b9:a9:ef:d4:ac:
+        de:7c:67:c1:e4:ed:75:26:15:ff:5d:67:39:24:2d:15:57:21:
+        09:76:e5:85:f3:45:e8:bf:b1:c0:39:2b:83:34:1a:f5:3f:1f:
+        ae:07:8c:82:1f:d4:dc:95:c0:4e:f3:7f:ac:db:8f:2c:db:a4:
+        d4:2a:4c:8c:de:e6:5b:84:fc:df:a3:74:d8:dc:9c:93:1f:5b:
+        c9:33:b5:b3:7d:2b:a4:4d:7a:bb:73:92:ff:8d:e9:9e:c7:a7:
+        d2:0d:83:bb:2c:2f:47:51:15:5c:6d:db:9a:d3:9e:6e:25:90:
+        01:e6:09:bd:a2:d0:1e:cf:a3:12:22:0d:56:70:bf:89:e4:be:
+        62:76:9c:d9:f5:c8:01:55:95:02:57:a1:67:59:88:97:57:f6:
+        bb:8d:c9:40:d5:e3:60:4f:43:dd:49:90:fa:a5:6d:08:96:b2:
+        4d:dd:a7:c6:e3:5c:06:ba:af:8c:30:9d:d5:a5:b0:ab:c4:e5:
+        f3:09:47:05:ba:9b:46:f4:26:70:3b:fa:da:a5:0a:47:ce:be:
+        43:87:eb:73:63:3b:cd:41:7a:78:a0:f6:7d:c5:37:fb:bb:26:
+        3b:b3:e7:44:49:06:8c:14:03:fc:b3:46:54:3b:0d:57:02:08:
+        99:79:68:a2:9c:62:95:4d:ac:8e:19:43:4e:8f:2d:52:fa:91:
+        ca:78:06:a2:b7:a3:66:6d:67:0b:13:ee:b1:01:38:e0:7c:ac:
+        9a:16:27:36:f1:45:83:5d:eb:d6:cd:65:3f:56:9a:d3:56:c4:
+        15:55:b2:64:ca:13:cb:31:1e:7e:03:85:68:61:40:02:99:4b:
+        25:01:68:8d:97:cc:39:1a:54:1b:e5:51:38:8e:ce:66:74:61:
+        5e:87:f4:31:7d:0d:be:9d:01:e1:b3:5c:bc:1a:d0:ea:5e:b2:
+        c8:ee:97:34:bc:9f:bb:98
+-----BEGIN CERTIFICATE-----
+MIIFejCCA2KgAwIBAgIUR3cmba5sV3PrgOKW3SaT/+n1Yl0wDQYJKoZIhvcNAQEN
+BQAwNjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTGl2ZSBQYXRjaCBTaWduaW5n
+IDIwMjUgS21vZDAgFw0yNTA1MTYwOTA3NDBaGA8yMDUwMDUxNjA5MDc0MFowNjE0
+MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTGl2ZSBQYXRjaCBTaWduaW5nIDIwMjUg
+S21vZDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALipA0cue8aGFvS3
+qE07BfbEdTXpIopOQAaJFX+tmbvmkJNhyBbPLgAbgTb9zDF7l3mNXtJN0y+rNS10
+SJiz2XX5u+HyP2tt3OS77vWq94qMeqgL37H41gQTJ+kaqsJN0jU6vAbXg3/oxBxj
+izr/DguJbk9f6q143zer+VUd+24ppCJD0ZsSHrKEIxvSOJG4qGwcWTz/TKkYztB/
+He8Ez4roKbJLaA2SMrycXY8K0d1NJbo6jGpIWx6cARCZwac07mjsodMmvkXItJes
+iqp+E6blQ/EbP6GACtKp5/J3yuH1KTbfdYp+AtYXqkYSuVHwa8oi+AXe1gJHdgyI
+8caQRJlYccdiHiuUxSuO3Mp7p73NOI9Oc22wm058Eh9cxWLWgsbSeAlS3Nd4LiPQ
+Yx99d5HIP2Z6IIrPcAkPosCCpULZvtxfeHP3+jxwR3s5d4lab++DCckbIVOJfBC/
+mZwFOTIehDulhH7vCG2wsDFh1hqq3XrWEALmcgLlQL8Huc1h0VUEms0Cc0HB3yAw
+EpfKoYMal4qSHEdcCmDaQTvmDiyCzkVlgbpFoWbM76tlXOWoDIbd/IZU8zd8iakM
++jragsmQmR4dZkTe08XUC9oV+NjUYytObyTpwtd0nCmRnyU5jXcVjMuOreOACup5
+BHKdUQEYrjVR75V5OMTbmVBHYjjpAgMBAAGjfjB8MAwGA1UdEwEB/wQCMAAwCwYD
+VR0PBAQDAgeAMB0GA1UdDgQWBBTVQc72Hcfnk7frfomZcKLu8LXcjDAfBgNVHSME
+GDAWgBTVQc72Hcfnk7frfomZcKLu8LXcjDAfBgNVHSUEGDAWBggrBgEFBQcDAwYK
+KwYBBAGSCBABAjANBgkqhkiG9w0BAQ0FAAOCAgEAQJ1bcGb+nJnr7Xhhvtpn2qyA
+qMJ4kfiQEb6faue/edwRDMeD6BPEHLb+8Od9GhKXXRlWnBASHrkZiDCVxDsvqpFv
+wZ5oSvRc76FRtaObWD/irlwppsQw/WULzIyZlTNhxgf6w70aV4DlQ5cu81zWHrcj
+n1gQGSRGnvj9LI6I5+zvFUt6as6wJcABxSGDGtWJDJCGrdQ+bii/bCGR/7mp79Ss
+3nxnweTtdSYV/11nOSQtFVchCXblhfNF6L+xwDkrgzQa9T8frgeMgh/U3JXATvN/
+rNuPLNuk1CpMjN7mW4T836N02Nyckx9byTO1s30rpE16u3OS/43pnsen0g2Duywv
+R1EVXG3bmtOebiWQAeYJvaLQHs+jEiINVnC/ieS+Ynac2fXIAVWVAlehZ1mIl1f2
+u43JQNXjYE9D3UmQ+qVtCJayTd2nxuNcBrqvjDCd1aWwq8Tl8wlHBbqbRvQmcDv6
+2qUKR86+Q4frc2M7zUF6eKD2fcU3+7smO7PnREkGjBQD/LNGVDsNVwIImXloopxi
+lU2sjhlDTo8tUvqRyngGorejZm1nCxPusQE44HysmhYnNvFFg13r1s1lP1aa01bE
+FVWyZMoTyzEefgOFaGFAAplLJQFojZfMORpUG+VROI7OZnRhXof0MX0Nvp0B4bNc
+vBrQ6l6yyO6XNLyfu5g=
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/certs/canonical-livepatch-all.pem
+++ linux-qcom-6.8.0/debian/certs/canonical-livepatch-all.pem
@@ -0,0 +1,121 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            c7:7e:51:6a:1c:25:cd:40
+        Signature Algorithm: sha512WithRSAEncryption
+        Issuer: CN = Canonical Ltd. Live Patch Signing
+        Validity
+            Not Before: Jul 18 23:41:27 2016 GMT
+            Not After : Jul 16 23:41:27 2026 GMT
+        Subject: CN = Canonical Ltd. Live Patch Signing
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (4096 bit)
+                Modulus:
+                    00:bd:74:ee:72:b3:4a:ab:e6:31:e8:29:24:c2:bd:
+                    46:98:32:c0:39:ee:a3:fb:8a:ad:fe:ab:1a:5b:a3:
+                    2e:a1:80:db:79:61:9e:47:79:2c:75:57:a2:21:f0:
+                    93:f6:87:f2:9b:4b:9d:2f:b3:58:61:28:3c:41:70:
+                    13:16:a1:72:90:c9:d5:16:71:7c:e0:30:f9:28:5e:
+                    48:20:36:00:69:b7:59:9f:a3:ec:a8:eb:55:41:9f:
+                    38:1e:22:4a:57:20:f4:83:59:49:c5:00:93:d3:33:
+                    02:92:d1:fc:f0:84:3b:4a:5b:8f:b6:73:9a:89:fa:
+                    30:1e:e6:2a:68:f2:91:ef:59:57:3d:dc:1c:52:6f:
+                    5e:e6:9b:b5:b8:7c:98:c9:13:d1:39:68:01:67:91:
+                    e0:d3:67:72:16:0a:5e:16:83:45:31:4f:b5:2b:b3:
+                    f6:40:86:89:3a:84:6e:6f:16:61:bc:70:84:be:5a:
+                    13:36:7b:82:ea:07:19:fc:18:c1:16:c6:32:0b:7d:
+                    2c:6b:c4:21:b9:38:6b:31:dc:d9:0c:ad:56:40:68:
+                    7c:e3:c6:64:8e:bf:1c:e0:72:3e:6c:db:d2:73:79:
+                    da:d7:c5:2f:5d:04:7d:b0:07:1e:95:dd:2a:47:5e:
+                    bf:3e:3a:c8:66:f6:67:0f:d4:2a:f1:e2:71:59:d2:
+                    6c:7b:a0:37:ac:e6:97:80:30:13:97:48:d5:74:fc:
+                    38:68:e4:57:cb:99:69:5a:84:27:ac:98:51:e4:64:
+                    bd:91:62:e8:58:27:06:2a:b9:0b:b8:08:e5:e5:b4:
+                    51:a7:a2:10:df:4e:07:6c:a0:3b:96:f2:6e:df:75:
+                    8c:97:1e:64:a0:9a:86:9b:98:26:f9:d8:b7:de:5b:
+                    21:b7:af:89:01:a3:f7:98:6b:da:19:ba:86:ef:ef:
+                    f1:ce:bb:2f:89:ed:c0:b6:1b:e5:5b:f8:90:11:9a:
+                    52:93:e9:be:f7:35:b9:08:cb:ba:c3:ed:2f:73:af:
+                    cc:96:07:55:b5:de:f6:03:f6:f1:89:f9:21:40:76:
+                    c1:69:f2:61:cc:9a:94:df:9c:ec:6a:65:38:be:d1:
+                    4e:2a:87:c7:2f:3e:53:ae:8b:9f:54:a1:09:59:64:
+                    25:aa:a9:d8:44:a9:a8:a0:71:e1:32:aa:4c:32:fd:
+                    44:28:cc:9c:6f:8e:db:81:7e:6f:fa:00:56:c5:e5:
+                    03:46:63:fb:8e:71:8d:e3:13:91:9f:ac:60:3e:64:
+                    f3:df:25:34:09:fa:2d:96:9f:16:05:ea:93:f5:e6:
+                    00:08:27:32:7b:3c:bd:ee:70:24:6c:3b:55:e9:db:
+                    f4:10:2d:20:06:b4:ca:e9:29:65:55:ad:f6:52:54:
+                    5f:e5:a3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Key Identifier: 
+                14:DF:34:D1:A8:7C:F3:76:25:AB:EC:03:9E:F2:BF:52:12:49:B9:69
+            X509v3 Authority Key Identifier: 
+                keyid:14:DF:34:D1:A8:7C:F3:76:25:AB:EC:03:9E:F2:BF:52:12:49:B9:69
+
+    Signature Algorithm: sha512WithRSAEncryption
+         30:e7:48:02:37:e9:28:cf:04:a2:4d:5c:fa:d8:4e:c9:76:c7:
+         14:3f:bd:2c:51:3d:33:f0:1a:bc:49:f1:47:95:8f:69:d8:a9:
+         54:14:44:6c:4d:9f:55:82:08:1e:c6:5b:d5:91:d9:bc:2e:b0:
+         af:d6:25:65:74:96:aa:36:de:ae:31:a8:11:f2:a4:2c:5a:e1:
+         4f:73:f8:4a:c3:35:b0:76:96:71:f2:b5:7d:4b:75:ee:5d:bf:
+         86:a5:ba:0b:a9:52:cb:ec:ab:e5:23:4b:f2:74:55:28:17:1e:
+         b3:ac:27:ad:45:13:6e:69:b3:5a:be:42:36:29:48:db:e7:5c:
+         22:58:a0:90:82:2c:2a:21:2b:db:f4:64:b7:91:5d:1f:2c:48:
+         a4:1a:85:e3:86:a5:aa:19:cd:19:e8:a5:fb:a3:7b:94:77:48:
+         25:a4:cf:a0:cf:71:82:5c:6f:71:22:7c:d6:97:a0:53:bb:ec:
+         30:f6:cb:16:fb:7b:fd:16:94:7a:53:6e:bd:04:64:a2:01:10:
+         9f:f0:5b:b5:a6:73:41:9d:5f:6f:45:73:0d:05:f7:30:6d:39:
+         90:b6:7d:55:7d:4c:2f:ae:5f:38:56:2f:8b:df:f4:bf:12:06:
+         93:6e:0d:02:23:bf:71:91:57:88:e8:bd:62:72:99:00:40:29:
+         1e:c9:13:11:da:7e:8e:e1:d2:a5:0d:bf:f7:d6:ec:01:0d:89:
+         41:cd:d5:dc:d2:f7:5f:33:0d:4c:2f:85:b7:85:b7:81:e4:17:
+         29:f0:74:cf:0e:15:8c:1a:50:0b:08:63:1a:91:4f:e7:76:97:
+         f1:d4:3b:7e:72:d4:c5:45:58:0c:6a:e9:0d:f2:85:d8:91:1e:
+         37:bd:78:e3:39:4d:2e:fd:85:31:c1:a6:3b:6a:cc:2c:53:72:
+         1d:8e:7b:f0:e6:76:86:09:6f:1a:f3:e4:a1:e2:dd:76:5f:b0:
+         8c:e2:2a:54:5d:c1:88:49:90:10:15:42:7d:05:24:53:8c:54:
+         ff:48:18:1a:36:e3:31:d3:54:32:78:0d:fe:f2:3d:aa:0d:37:
+         15:84:b4:36:47:31:e8:85:6e:0b:58:38:ff:21:91:09:c9:a8:
+         43:a3:ea:60:cb:7e:ed:f7:41:6f:4e:91:c1:fd:77:46:e7:d4:
+         e7:86:c0:1b:fd:50:6c:aa:be:00:b3:63:02:ff:4e:c7:a5:57:
+         6e:29:64:e9:54:d5:30:63:38:5f:2d:5a:db:49:5f:14:14:22:
+         d2:81:1f:61:9e:ee:ee:16:66:d6:bc:bd:ac:1b:5c:fb:38:31:
+         95:33:2e:84:6e:7a:de:ee:b9:fc:97:17:06:13:bf:70:1c:6e:
+         76:ed:66:38:e2:70:08:00
+-----BEGIN CERTIFICATE-----
+MIIFODCCAyCgAwIBAgIJAMd+UWocJc1AMA0GCSqGSIb3DQEBDQUAMCwxKjAoBgNV
+BAMMIUNhbm9uaWNhbCBMdGQuIExpdmUgUGF0Y2ggU2lnbmluZzAeFw0xNjA3MTgy
+MzQxMjdaFw0yNjA3MTYyMzQxMjdaMCwxKjAoBgNVBAMMIUNhbm9uaWNhbCBMdGQu
+IExpdmUgUGF0Y2ggU2lnbmluZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBAL107nKzSqvmMegpJMK9RpgywDnuo/uKrf6rGlujLqGA23lhnkd5LHVXoiHw
+k/aH8ptLnS+zWGEoPEFwExahcpDJ1RZxfOAw+SheSCA2AGm3WZ+j7KjrVUGfOB4i
+Slcg9INZScUAk9MzApLR/PCEO0pbj7Zzmon6MB7mKmjyke9ZVz3cHFJvXuabtbh8
+mMkT0TloAWeR4NNnchYKXhaDRTFPtSuz9kCGiTqEbm8WYbxwhL5aEzZ7guoHGfwY
+wRbGMgt9LGvEIbk4azHc2QytVkBofOPGZI6/HOByPmzb0nN52tfFL10EfbAHHpXd
+Kkdevz46yGb2Zw/UKvHicVnSbHugN6zml4AwE5dI1XT8OGjkV8uZaVqEJ6yYUeRk
+vZFi6FgnBiq5C7gI5eW0UaeiEN9OB2ygO5bybt91jJceZKCahpuYJvnYt95bIbev
+iQGj95hr2hm6hu/v8c67L4ntwLYb5Vv4kBGaUpPpvvc1uQjLusPtL3OvzJYHVbXe
+9gP28Yn5IUB2wWnyYcyalN+c7GplOL7RTiqHxy8+U66Ln1ShCVlkJaqp2ESpqKBx
+4TKqTDL9RCjMnG+O24F+b/oAVsXlA0Zj+45xjeMTkZ+sYD5k898lNAn6LZafFgXq
+k/XmAAgnMns8ve5wJGw7Venb9BAtIAa0yukpZVWt9lJUX+WjAgMBAAGjXTBbMAwG
+A1UdEwEB/wQCMAAwCwYDVR0PBAQDAgeAMB0GA1UdDgQWBBQU3zTRqHzzdiWr7AOe
+8r9SEkm5aTAfBgNVHSMEGDAWgBQU3zTRqHzzdiWr7AOe8r9SEkm5aTANBgkqhkiG
+9w0BAQ0FAAOCAgEAMOdIAjfpKM8Eok1c+thOyXbHFD+9LFE9M/AavEnxR5WPadip
+VBREbE2fVYIIHsZb1ZHZvC6wr9YlZXSWqjberjGoEfKkLFrhT3P4SsM1sHaWcfK1
+fUt17l2/hqW6C6lSy+yr5SNL8nRVKBces6wnrUUTbmmzWr5CNilI2+dcIligkIIs
+KiEr2/Rkt5FdHyxIpBqF44alqhnNGeil+6N7lHdIJaTPoM9xglxvcSJ81pegU7vs
+MPbLFvt7/RaUelNuvQRkogEQn/BbtaZzQZ1fb0VzDQX3MG05kLZ9VX1ML65fOFYv
+i9/0vxIGk24NAiO/cZFXiOi9YnKZAEApHskTEdp+juHSpQ2/99bsAQ2JQc3V3NL3
+XzMNTC+Ft4W3geQXKfB0zw4VjBpQCwhjGpFP53aX8dQ7fnLUxUVYDGrpDfKF2JEe
+N7144zlNLv2FMcGmO2rMLFNyHY578OZ2hglvGvPkoeLddl+wjOIqVF3BiEmQEBVC
+fQUkU4xU/0gYGjbjMdNUMngN/vI9qg03FYS0Nkcx6IVuC1g4/yGRCcmoQ6PqYMt+
+7fdBb06Rwf13RufU54bAG/1QbKq+ALNjAv9Ox6VXbilk6VTVMGM4Xy1a20lfFBQi
+0oEfYZ7u7hZm1ry9rBtc+zgxlTMuhG563u65/JcXBhO/cBxudu1mOOJwCAA=
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/certs/ubuntu-drivers-all.pem
+++ linux-qcom-6.8.0/debian/certs/ubuntu-drivers-all.pem
@@ -0,0 +1,125 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            e9:df:13:0f:92:92:a9:b7
+        Signature Algorithm: sha512WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Kernel Module Signing
+        Validity
+            Not Before: May 31 16:06:09 2016 GMT
+            Not After : May 29 16:06:09 2026 GMT
+        Subject: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Kernel Module Signing
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (4096 bit)
+                Modulus:
+                    00:b3:b0:4f:c6:0a:77:8b:f9:d1:53:33:34:d2:80:
+                    b5:63:6f:e1:f6:a2:83:99:d5:b6:b1:e4:99:91:fa:
+                    6c:19:c6:d0:91:2a:b9:7d:b5:98:a6:0d:28:01:b8:
+                    7c:8e:aa:38:ec:51:37:33:96:f0:b0:9b:8d:86:5f:
+                    67:23:69:2f:d7:c2:f3:fb:c5:d7:f9:04:ff:f2:e5:
+                    61:68:b7:29:b9:c6:8e:4b:4d:2d:8f:92:0c:00:b3:
+                    a3:d2:5a:08:64:cd:f2:09:0b:a5:0e:e6:64:75:d5:
+                    41:f4:4d:49:3a:0d:dc:b9:27:8e:c4:d6:b1:df:8f:
+                    6c:f0:e4:f7:31:cb:a9:04:a1:f9:a7:aa:15:da:59:
+                    03:4d:46:14:d0:dd:bf:e0:f5:9e:f0:71:0c:70:78:
+                    2b:08:fb:e0:b6:68:a4:74:12:9d:f7:f2:64:88:17:
+                    2a:8a:ed:1a:91:b5:6c:13:bd:4c:10:0a:0b:72:0b:
+                    90:db:7d:f3:78:44:4c:d2:a5:41:f7:1c:77:7d:5a:
+                    8a:54:bc:8f:fe:b7:ee:e1:bc:59:37:c4:d4:e8:14:
+                    d0:5b:42:9b:04:00:8e:6d:83:8a:25:21:5b:08:c4:
+                    7b:b2:d9:99:52:c9:5e:59:6d:c4:aa:52:59:e2:e4:
+                    2f:7e:7e:ac:05:01:99:bf:13:72:b7:45:c5:17:da:
+                    8a:d5:3e:71:73:2e:d8:aa:e6:eb:5a:d0:9a:c4:93:
+                    f3:be:eb:d2:47:25:34:16:29:fa:dd:9a:2f:b1:20:
+                    e5:41:4e:ed:ea:51:7c:23:80:ba:3d:b5:3a:0b:8c:
+                    9c:85:48:6c:3c:8b:29:2f:2f:12:c7:52:34:02:ea:
+                    0f:ac:53:23:3c:f8:3e:40:1b:30:63:e9:2d:e6:f6:
+                    58:cc:51:f9:eb:08:4a:b4:c7:16:80:d1:8b:c2:64:
+                    6a:71:a9:70:31:a4:a7:3a:c0:93:99:1b:0e:42:c1:
+                    00:6d:43:27:99:6c:e5:fd:23:16:c1:8e:b5:66:17:
+                    2b:4c:53:5a:6d:1e:96:16:13:6a:c6:d4:85:5b:74:
+                    2e:ce:7c:45:2f:ad:cb:75:9e:5e:91:bd:9a:6a:86:
+                    1a:06:bd:39:be:a3:50:56:ea:e1:f6:e3:95:69:d7:
+                    31:e4:66:f7:36:b5:51:c2:22:b4:9c:74:9c:44:0b:
+                    0e:16:5f:53:f0:23:c6:b9:40:bd:d6:b8:7d:1b:f6:
+                    73:f6:27:e7:c0:e3:65:a0:58:ab:5c:59:b7:80:8c:
+                    8c:04:b4:a9:ae:a0:51:40:10:3b:63:59:49:87:d1:
+                    9b:df:a3:8c:c4:2e:eb:70:c1:0a:18:1f:cb:22:c2:
+                    f2:4a:65:0d:e5:81:74:d8:ce:72:c6:35:be:ba:63:
+                    72:c4:f9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Key Identifier: 
+                88:F7:52:E5:60:A1:E0:73:7E:31:16:3A:46:6A:D7:B7:0A:85:0C:19
+            X509v3 Authority Key Identifier: 
+                keyid:88:F7:52:E5:60:A1:E0:73:7E:31:16:3A:46:6A:D7:B7:0A:85:0C:19
+
+    Signature Algorithm: sha512WithRSAEncryption
+         04:85:16:27:58:ba:71:28:57:86:7b:c2:83:db:e5:72:6f:1e:
+         b2:1c:63:b0:db:ad:c0:42:96:c0:4f:65:f6:35:4d:c0:07:0d:
+         46:be:d3:1e:ec:f1:22:18:2a:18:5d:bb:69:a6:a6:d4:0d:c3:
+         57:03:b9:e7:45:49:28:ca:6d:98:17:68:97:cb:7b:36:81:0a:
+         37:9e:34:79:f3:e1:0e:5b:77:43:bb:5a:a5:45:b7:16:50:86:
+         fd:12:a4:96:0f:15:19:09:1c:e1:fa:80:a5:80:09:be:bb:c8:
+         26:0b:3e:de:03:d2:c2:18:a4:8d:0d:de:c5:32:82:0b:fb:75:
+         55:66:1a:2a:bb:e4:bd:25:91:20:15:d4:be:b8:3f:53:e3:fb:
+         a8:c3:55:e3:d5:e7:82:18:95:df:39:09:a7:fc:89:6e:b4:1c:
+         aa:2d:e8:67:c2:0d:34:34:3e:f9:fa:0b:ce:81:92:11:ae:12:
+         0a:fe:35:63:ce:46:29:c4:2b:4f:cb:4e:05:0a:a1:11:e2:35:
+         f6:5a:5d:b5:e8:d2:6f:4c:fc:3d:24:a6:03:4b:dd:98:6b:f2:
+         71:58:16:1d:a5:25:ef:d9:06:7c:e8:db:7b:88:6a:89:5c:59:
+         01:92:64:db:44:08:63:6c:7c:32:d6:55:98:63:09:26:61:67:
+         0a:fe:5d:ee:fd:23:59:b3:4d:91:c1:4d:41:8b:cd:20:58:fa:
+         2d:45:e5:bd:1d:69:5c:03:a0:49:a6:97:54:13:b6:c9:e0:f8:
+         56:83:a1:2a:c3:f4:6c:fd:ab:20:ca:3d:9c:95:c0:cf:04:bb:
+         46:39:cf:34:81:65:45:27:64:01:7d:62:b3:b8:72:ea:10:d5:
+         0f:53:7d:39:88:25:09:6f:8c:bc:e0:49:bb:39:e2:0e:8d:cf:
+         56:4d:c1:82:6d:87:d2:e7:fc:c0:9f:a7:65:60:d2:6c:65:18:
+         59:38:6e:d0:9c:d7:c3:81:9a:9a:29:8f:83:84:c3:b5:44:ff:
+         28:ac:13:17:64:f2:26:13:d9:55:06:b7:69:68:7c:bf:ec:d1:
+         8c:ef:b7:da:76:e1:07:73:c6:31:62:31:cb:b6:e1:e7:7f:0c:
+         c3:f7:4c:52:be:25:36:8e:a1:bb:60:02:c3:cb:3e:6f:29:fc:
+         7f:6a:fa:f8:ec:0a:df:49:e2:57:0e:bc:bd:93:c3:1b:d5:36:
+         8a:ff:d8:1b:17:c7:1f:cb:69:00:d2:54:9e:ad:61:89:92:95:
+         11:f8:ea:17:83:9f:9b:09:7d:b8:94:a4:ea:f5:ae:ea:dc:dd:
+         62:b9:9e:68:9c:18:ec:19:c4:13:08:c8:b1:62:ab:8e:84:69:
+         11:3c:da:ea:0d:b7:22:bd
+-----BEGIN CERTIFICATE-----
+MIIF2jCCA8KgAwIBAgIJAOnfEw+Skqm3MA0GCSqGSIb3DQEBDQUAMH0xCzAJBgNV
+BAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEQMA4GA1UEBwwHRG91Z2xhczEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xLTArBgNVBAMMJENhbm9uaWNhbCBMdGQu
+IEtlcm5lbCBNb2R1bGUgU2lnbmluZzAeFw0xNjA1MzExNjA2MDlaFw0yNjA1Mjkx
+NjA2MDlaMH0xCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEQMA4G
+A1UEBwwHRG91Z2xhczEXMBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xLTArBgNVBAMM
+JENhbm9uaWNhbCBMdGQuIEtlcm5lbCBNb2R1bGUgU2lnbmluZzCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBALOwT8YKd4v50VMzNNKAtWNv4faig5nVtrHk
+mZH6bBnG0JEquX21mKYNKAG4fI6qOOxRNzOW8LCbjYZfZyNpL9fC8/vF1/kE//Ll
+YWi3KbnGjktNLY+SDACzo9JaCGTN8gkLpQ7mZHXVQfRNSToN3LknjsTWsd+PbPDk
+9zHLqQSh+aeqFdpZA01GFNDdv+D1nvBxDHB4Kwj74LZopHQSnffyZIgXKortGpG1
+bBO9TBAKC3ILkNt983hETNKlQfccd31ailS8j/637uG8WTfE1OgU0FtCmwQAjm2D
+iiUhWwjEe7LZmVLJXlltxKpSWeLkL35+rAUBmb8TcrdFxRfaitU+cXMu2Krm61rQ
+msST877r0kclNBYp+t2aL7Eg5UFO7epRfCOAuj21OguMnIVIbDyLKS8vEsdSNALq
+D6xTIzz4PkAbMGPpLeb2WMxR+esISrTHFoDRi8JkanGpcDGkpzrAk5kbDkLBAG1D
+J5ls5f0jFsGOtWYXK0xTWm0elhYTasbUhVt0Ls58RS+ty3WeXpG9mmqGGga9Ob6j
+UFbq4fbjlWnXMeRm9za1UcIitJx0nEQLDhZfU/AjxrlAvda4fRv2c/Yn58DjZaBY
+q1xZt4CMjAS0qa6gUUAQO2NZSYfRm9+jjMQu63DBChgfyyLC8kplDeWBdNjOcsY1
+vrpjcsT5AgMBAAGjXTBbMAwGA1UdEwEB/wQCMAAwCwYDVR0PBAQDAgeAMB0GA1Ud
+DgQWBBSI91LlYKHgc34xFjpGate3CoUMGTAfBgNVHSMEGDAWgBSI91LlYKHgc34x
+FjpGate3CoUMGTANBgkqhkiG9w0BAQ0FAAOCAgEABIUWJ1i6cShXhnvCg9vlcm8e
+shxjsNutwEKWwE9l9jVNwAcNRr7THuzxIhgqGF27aaam1A3DVwO550VJKMptmBdo
+l8t7NoEKN540efPhDlt3Q7tapUW3FlCG/RKklg8VGQkc4fqApYAJvrvIJgs+3gPS
+whikjQ3exTKCC/t1VWYaKrvkvSWRIBXUvrg/U+P7qMNV49XnghiV3zkJp/yJbrQc
+qi3oZ8INNDQ++foLzoGSEa4SCv41Y85GKcQrT8tOBQqhEeI19lpdtejSb0z8PSSm
+A0vdmGvycVgWHaUl79kGfOjbe4hqiVxZAZJk20QIY2x8MtZVmGMJJmFnCv5d7v0j
+WbNNkcFNQYvNIFj6LUXlvR1pXAOgSaaXVBO2yeD4VoOhKsP0bP2rIMo9nJXAzwS7
+RjnPNIFlRSdkAX1is7hy6hDVD1N9OYglCW+MvOBJuzniDo3PVk3Bgm2H0uf8wJ+n
+ZWDSbGUYWThu0JzXw4GamimPg4TDtUT/KKwTF2TyJhPZVQa3aWh8v+zRjO+32nbh
+B3PGMWIxy7bh538Mw/dMUr4lNo6hu2ACw8s+byn8f2r6+OwK30niVw68vZPDG9U2
+iv/YGxfHH8tpANJUnq1hiZKVEfjqF4Ofmwl9uJSk6vWu6tzdYrmeaJwY7BnEEwjI
+sWKrjoRpETza6g23Ir0=
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/changelog
+++ linux-qcom-6.8.0/debian/changelog
@@ -0,0 +1,37489 @@
+linux-qcom (6.8.0-1046.46) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1046.46 -proposed tracker (LP: #2114979)
+
+  * [qcom] Qcom kernel crashes in virtual machine
+    - SAUCE: gunyah_qcom: check qcom,msm-id property before HW access
+
+  * [RB3] Plugged USB storage is not detected via type-c port after reboot
+    occasionally
+    - soc: qcom: pmic_glink: Fix possible race between rpmsg and pmicglink
+      probe
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 19 Jun 2025 22:04:02 +0900
+
+linux-qcom (6.8.0-1045.45) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1045.45 -proposed tracker (LP: #2114901)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update Ubuntu.md
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Config] add FLAVOUR_DEP
+    - [package] fix Vcs-Git
+    - SAUCE: arm64: dts: qcm6490: enable platform sound-dai
+    - SAUCE: ASoC: q6dsp: increase AR_MAX_MOD_LINKS
+    - SAUCE: arm64: dts: qcom fix interrupts arguments
+    - SAUCE: usb: dwc3: do not call dwc3_remove() when dwc3_qcom_probe_core()
+      fails
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 18 Jun 2025 23:42:59 +0900
+
+linux-qcom (6.8.0-1043.43) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1043.43 -proposed tracker (LP: #2112456)
+
+  * [5430] thermal_sys failed to bind errors found in dmesg
+    - SAUCE: comment out invalid cooling-maps
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs
+
+  [ Ubuntu: 6.8.0-62.65 ]
+
+  * noble/linux: 6.8.0-62.65 -proposed tracker (LP: #2110737)
+  * Rotate the Canonical Livepatch key (LP: #2111244)
+    - [Config] Prepare for Canonical Livepatch key rotation
+  * KVM bug causes Firecracker crash when it runs the vCPU for the first time
+    (LP: #2109859)
+    - vhost: return task creation error instead of NULL
+    - kvm: retry nx_huge_page_recovery_thread creation
+  * CVE-2025-2312 cifs.upcall could access incorrect kerberos credentials cache
+    (LP: #2099914) // CVE-2025-2312
+    - CIFS: New mount option for cifs.upcall namespace resolution
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640)
+    - ASoC: wm8994: Add depends on MFD core
+    - ASoC: samsung: Add missing selects for MFD_WM8994
+    - seccomp: Stub for !CONFIG_SECCOMP
+    - scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
+    - of/unittest: Add test that of_address_to_resource() fails on non-
+      translatable address
+    - irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
+    - hwmon: (drivetemp) Set scsi command timeout to 10s
+    - ASoC: samsung: Add missing depends on I2C
+    - ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf()
+    - Revert "libfs: fix infinite directory reads for offset dir"
+    - libfs: Replace simple_offset end-of-directory detection
+    - Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
+    - ALSA: usb-audio: Add delay quirk for USB Audio Device
+    - Input: xpad - add support for Nacon Pro Compact
+    - Input: atkbd - map F23 key to support default copilot shortcut
+    - Input: xpad - add unofficial Xbox 360 wireless receiver clone
+    - Input: xpad - add QH Electronics VID/PID
+    - Input: xpad - improve name of 8BitDo controller 2dc8:3106
+    - Input: xpad - add support for Nacon Evol-X Xbox One Controller
+    - Input: xpad - add support for wooting two he (arm)
+    - ASoC: codecs: es8316: Fix HW rate calculation for 48Mhz MCLK
+    - ASoC: cs42l43: Add codec force suspend/resume ops
+    - ALSA: hda/realtek: Fix volume adjustment issue on Lenovo ThinkBook 16P Gen5
+    - libfs: Return ENOSPC when the directory offset range is exhausted
+    - Revert "libfs: Add simple_offset_empty()"
+    - libfs: Use d_children list to iterate simple_offset directories
+    - wifi: rtl8xxxu: add more missing rtl8192cu USB IDs
+    - HID: wacom: Initialize brightness of LED trigger
+    - Upstream stable to v6.6.75, v6.12.12
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21689
+    - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21690
+    - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21691
+    - cachestat: fix page cache statistics permission checking
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21692
+    - net: sched: fix ets qdisc OOB Indexing
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2025-21699
+    - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
+  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
+    CVE-2024-50157
+    - RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
+  * rtw89: Support hardware rfkill (LP: #2077384)
+    - wifi: rtw89: add support for hardware rfkill
+  * Introduce configfs-based interface for gpio-aggregator (LP: #2103496)
+    - gpio: introduce utilities for synchronous fake device creation
+    - bitmap: Define a cleanup function for bitmaps
+    - gpio: aggregator: simplify aggr_parse() with scoped bitmap
+    - gpio: aggregator: protect driver attr handlers against module unload
+    - gpio: aggregator: reorder functions to prepare for configfs introduction
+    - gpio: aggregator: unify function naming
+    - gpio: aggregator: add gpio_aggregator_{alloc, free}()
+    - gpio: aggregator: introduce basic configfs interface
+    - [Config] Enable DEV_SYNC_PROBE as module
+    - SAUCE: gpio: aggregator: Fix error code in gpio_aggregator_activate()
+    - gpio: aggregator: rename 'name' to 'key' in gpio_aggregator_parse()
+    - gpio: aggregator: expose aggregator created via legacy sysfs to configfs
+    - SAUCE: gpio: aggregator: fix "_sysfs" prefix check in
+      gpio_aggregator_make_group()
+    - SAUCE: gpio: aggregator: Fix gpio_aggregator_line_alloc() checking
+    - SAUCE: gpio: aggregator: Return an error if there are no GPIOs in
+      gpio_aggregator_parse()
+    - SAUCE: gpio: aggregator: Fix leak in gpio_aggregator_parse()
+    - gpio: aggregator: cancel deferred probe for devices created via configfs
+    - Documentation: gpio: document configfs interface for gpio-aggregator
+    - selftests: gpio: add test cases for gpio-aggregator
+    - SAUCE: selftests: gpio: gpio-aggregator: add a test case for _sysfs prefix
+      reservation
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449)
+    - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
+    - net: add exit_batch_rtnl() method
+    - gtp: use exit_batch_rtnl() method
+    - gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
+    - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
+    - nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
+    - net: xilinx: axienet: Fix IRQ coalescing packet count overflow
+    - net/mlx5: Fix RDMA TX steering prio
+    - net/mlx5e: Rely on reqid in IPsec tunnel mode
+    - net/mlx5e: Always start IPsec sequence number from 1
+    - drm/vmwgfx: Add new keep_resv BO param
+    - drm/v3d: Assign job pointer to NULL before signaling the fence
+    - soc: ti: pruss: Fix pruss APIs
+    - hwmon: (tmp513) Fix division of negative numbers
+    - i2c: mux: demux-pinctrl: check initial mux selection, too
+    - i2c: rcar: fix NACK handling when being a target
+    - hfs: Sanity check the root record
+    - fs: fix missing declaration of init_files
+    - kheaders: Ignore silly-rename files
+    - cachefiles: Parse the "secctx" immediately
+    - scsi: ufs: core: Honor runtime/system PM levels if set by host controller
+      drivers
+    - selftests: tc-testing: reduce rshift value
+    - ACPI: resource: acpi_dev_irq_override(): Check DMI match last
+    - poll_wait: add mb() to fix theoretical race between waitqueue_active() and
+      .poll()
+    - RDMA/bnxt_re: Fix to export port num to ib_query_qp
+    - nvmet: propagate npwg topology
+    - ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
+    - i2c: atr: Fix client detach
+    - mptcp: be sure to send ack when mptcp-level window re-opens
+    - mptcp: fix spurious wake-up on under memory pressure
+    - selftests: mptcp: avoid spurious errors on disconnect
+    - net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
+    - vsock/virtio: cancel close work in the destructor
+    - vsock: reset socket state when de-assigning the transport
+    - nouveau/fence: handle cross device fences properly
+    - irqchip: Plug a OF node reference leak in platform_irqchip_probe()
+    - irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
+    - drm/i915/fb: Relax clear color alignment to 64 bytes
+    - drm/amdgpu: always sync the GFX pipe on ctx switch
+    - ocfs2: fix deadlock in ocfs2_get_system_file_inode
+    - nfsd: add list_head nf_gc to struct nfsd_file
+    - x86/xen: fix SLS mitigation in xen_hypercall_iret()
+    - efi/zboot: Limit compression options to GZIP and ZSTD
+    - [Config] updateconfigs for HAVE_KERNEL_(LZ4|LZMA|LZO|XZ)
+    - net: ravb: Fix max TX frame size for RZ/V2M
+    - net/mlx5: SF, Fix add port error handling
+    - drm/vmwgfx: Unreserve BO on error
+    - i2c: testunit: on errors, repeat NACK until STOP
+    - hwmon: (ltc2991) Fix mixed signed/unsigned in DIV_ROUND_CLOSEST
+    - fs/qnx6: Fix building with GCC 15
+    - gpio: sim: lock up configfs that an instantiated device depends on
+    - gpio: sim: lock hog configfs items if present
+    - platform/x86: ISST: Add Clearwater Forest to support list
+    - drm/nouveau/disp: Fix missing backlight control on Macbook 5,1
+    - net/ncsi: fix locking in Get MAC Address handling
+    - drm/amd/display: Do not elevate mem_type change to full update
+    - drm/xe: Mark ComputeCS read mode as UC on iGPU
+    - drm/amdgpu/smu13: update powersave optimizations
+    - drm/amdgpu: fix fw attestation for MP0_14_0_{2/3}
+    - drm/amdgpu: disable gfxoff with the compute workload on gfx12
+    - drm/amd/display: Fix PSR-SU not support but still call the
+      amdgpu_dm_psr_enable
+    - Upstream stable to v6.6.73, v6.6.74, v6.12.11
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21672
+    - afs: Fix merge preference rule failure condition
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21682
+    - eth: bnxt: always recalculate features after XDP clearing, fix null-deref
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-53124
+    - net: fix data-races around sk->sk_forward_alloc
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57924
+    - fs: relax assertions on failure to encode file handles
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57951
+    - hrtimers: Handle CPU state correctly on hotplug
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57949
+    - irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21668
+    - pmdomain: imx8mp-blk-ctrl: add missing loop break condition
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21684
+    - gpio: xilinx: Convert gpio_lock to raw spinlock
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21694
+    - fs/proc: fix softlockup in __read_vmcore (part 2)
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21665
+    - filemap: avoid truncating 64-bit offset to 32 bits
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21666
+    - vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21669
+    - vsock/virtio: discard packets if the transport changes
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21670
+    - vsock/bpf: return early if transport is not assigned
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21667
+    - iomap: avoid avoid truncating 64-bit offset to 32 bits
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2024-57948
+    - mac802154: check local interfaces before deleting sdata list
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21673
+    - smb: client: fix double free of TCP_Server_Info::hostname
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21697
+    - drm/v3d: Ensure job pointer is set to NULL after job completion
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21674
+    - net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21675
+    - net/mlx5: Clear port select structure when fail to create
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21676
+    - net: fec: handle page_pool_dev_alloc_pages error
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21678
+    - gtp: Destroy device along with udp socket's netns dismantle.
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21680
+    - pktgen: Avoid out-of-bounds access in get_imix_entries
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21681
+    - openvswitch: fix lockup on tx to unregistering netdev with carrier
+  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
+    CVE-2025-21683
+    - bpf: Fix bpf_sk_select_reuseport() memory leak
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update annotations scripts
+
+  [ Ubuntu: 6.8.0-60.63 ]
+
+  * noble/linux: 6.8.0-60.63 -proposed tracker (LP: #2107138)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2025.04.14)
+  * Missing upstream commits for LP: #2102181 (LP: #2107336)
+    - libperf cpumap: Add any, empty and min helpers
+    - libperf cpumap: Ensure empty cpumap is NULL from alloc
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770)
+    - memblock: use numa_valid_node() helper to check for invalid node ID
+    - jbd2: increase IO priority for writing revoke records
+    - jbd2: flush filesystem device before updating tail sequence
+    - dm array: fix unreleased btree blocks on closing a faulty array cursor
+    - dm array: fix cursor index when skipping across block boundaries
+    - exfat: fix the infinite loop in __exfat_free_cluster()
+    - erofs: fix PSI memstall accounting
+    - ASoC: rt722: add delay time to wait for the calibration procedure
+    - ASoC: mediatek: disable buffer pre-allocation
+    - selftests/alsa: Fix circular dependency involving global-timer
+    - ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
+    - net: 802: LLC+SNAP OID:PID lookup on start of skb data
+    - tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
+    - tcp/dccp: allow a connection when sk_max_ack_backlog is zero
+    - net: libwx: fix firmware mailbox abnormal return
+    - pds_core: limit loop over fw name list
+    - bnxt_en: Fix possible memory leak when hwrm_req_replace fails
+    - cxgb4: Avoid removal of uninserted tid
+    - ice: fix incorrect PHY settings for 100 GB/s
+    - igc: return early when failing to read EECD register
+    - tls: Fix tls_sw_sendmsg error handling
+    - eth: gve: use appropriate helper to set xdp_features
+    - Bluetooth: hci_sync: Fix not setting Random Address when required
+    - Bluetooth: MGMT: Fix Add Device to responding before completing
+    - Bluetooth: btnxpuart: Fix driver sending truncated data
+    - tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
+    - riscv: Fix early ftrace nop patching
+    - memblock tests: fix implicit declaration of function 'numa_valid_node'
+    - iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
+    - netfilter: nf_tables: imbalance in flowtable binding
+    - drm/mediatek: stop selecting foreign drivers
+    - [Config] updateconfigs for MTK_SMI
+    - drm/mediatek: Fix YCbCr422 color format issue for DP
+    - drm/mediatek: Fix mode valid issue for dp
+    - drm/mediatek: Add return value check when reading DPCD
+    - cpuidle: riscv-sbi: fix device node release in early exit of
+      for_each_possible_cpu
+    - scsi: ufs: qcom: Power off the PHY if it was already powered on in
+      ufs_qcom_power_up_sequence()
+    - dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
+    - ksmbd: Implement new SMB3 POSIX type
+    - thermal: of: fix OF node leak in of_thermal_zone_find()
+    - smb: client: sync the root session and superblock context passwords before
+      automounting
+    - ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
+    - ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
+    - drm/amd/display: increase MAX_SURFACES to the value supported by hw
+    - io_uring/timeout: fix multishot updates
+    - dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
+    - USB: serial: option: add MeiG Smart SRM815
+    - USB: serial: option: add Neoway N723-EA support
+    - staging: iio: ad9834: Correct phase range check
+    - staging: iio: ad9832: Correct phase range check
+    - usb-storage: Add max sectors quirk for Nokia 208
+    - USB: serial: cp210x: add Phoenix Contact UPS Device
+    - usb: dwc3: gadget: fix writing NYET threshold
+    - misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set
+      config
+    - tty: serial: 8250: Fix another runtime PM usage counter underflow
+    - usb: dwc3-am62: Disable autosuspend during remove
+    - USB: usblp: return error when setting unsupported protocol
+    - USB: core: Disable LPM only for non-suspended ports
+    - usb: fix reference leak in usb_new_device()
+    - usb: gadget: midi2: Reverse-select at the right place
+    - usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in
+      the error path of .probe()
+    - usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
+    - usb: typec: tcpm/tcpci_maxim: fix error code in
+      max_contaminant_read_resistance_kohm()
+    - usb: gadget: configfs: Ignore trailing LF for user strings to cdev
+    - iio: gyro: fxas21002c: Fix missing data update in trigger handler
+    - iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
+    - iio: inkern: call iio_device_put() only on mapped devices
+    - iio: adc: ad7124: Disable all channels at probe time
+    - riscv: kprobes: Fix incorrect address calculation
+    - ARM: dts: imxrt1050: Fix clocks for mmc
+    - arm64: dts: rockchip: add hevc power domain clock to rk3328
+    - pmdomain: imx: gpcv2: Simplify with scoped for each OF child loop
+    - pmdomain: imx: gpcv2: fix an OF node reference leak in imx_gpcv2_probe()
+    - workqueue: Add rcu lock check at the end of work item execution
+    - workqueue: Update lock debugging code
+    - mm/hugetlb: enforce that PMD PT sharing has split PMD PT locks
+    - riscv: Fix text patching when IPI are used
+    - drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported
+    - ovl: pass realinode to ovl_encode_real_fh() instead of realdentry
+    - net: don't dump Tx and uninitialized NAPIs
+    - ice: fix max values for dpll pin phase adjust
+    - net: hns3: fixed reset failure issues caused by the incorrect reset type
+    - net: hns3: fix missing features due to dev->features configuration too early
+    - net: hns3: Resolved the issue that the debugfs query result is inconsistent.
+    - net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
+    - mctp i3c: fix MCTP I3C driver multi-thread issue
+    - drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb()
+    - drm/mediatek: Add support for 180-degree rotation in the display driver
+    - drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188
+    - platform/x86: intel/pmc: Fix ioremap() of bad address
+    - riscv: module: remove relocation_head rel_entry member allocation
+    - cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
+    - fs: kill MNT_ONRB
+    - gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset
+    - drm/amd/pm: fix BUG: scheduling while atomic
+    - drm/amdkfd: wq_release signals dma_fence only when available
+    - drm/amd/display: fix divide error in DM plane scale calcs
+    - drm/amd/display: fix page fault due to max surface definition mismatch
+    - serial: stm32: use port lock wrappers for break control
+    - usb: host: xhci-plat: set skip_phy_initialization if software node has
+      XHCI_SKIP_PHY_INIT property
+    - iio: imu: inv_icm42600: add register caching in the regmap
+    - iio: imu: inv_icm42600: fix spi burst write not supported
+    - Upstream stable to v6.6.71, v6.6.72, v6.12.10
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21659
+    - netdev: prevent accessing NAPI instances from another namespace
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21634
+    - cgroup/cpuset: remove kernfs active break
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21635
+    - rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21643
+    - netfs: Fix kernel async DIO
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21649
+    - net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21650
+    - net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21651
+    - net: hns3: don't auto enable misc vector
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21654
+    - ovl: support encoding fid from inode with no alias
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57883
+    - mm: hugetlb: independent PMD page table shared count
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57888
+    - workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from
+      !WQ_MEM_RECLAIM worker
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21631
+    - block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21656
+    - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21655
+    - io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57904
+    - iio: adc: at91: call input_free_device() on allocated iio_dev
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57906
+    - iio: adc: ti-ads8688: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57907
+    - iio: adc: rockchip_saradc: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57908
+    - iio: imu: kmx61: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57910
+    - iio: light: vcnl4035: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57911
+    - iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered
+      buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57912
+    - iio: pressure: zpa2326: fix information leak in triggered buffer
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57913
+    - usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21632
+    - x86/fpu: Ensure shadow stack is active before "getting" registers
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57916
+    - misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57917
+    - topology: Keep the cpumask unchanged when printing cpumap
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57939
+    - riscv: Fix sleeping in invalid context in die()
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21636
+    - sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21637
+    - sctp: sysctl: udp_port: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21638
+    - sctp: sysctl: auth_enable: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21639
+    - sctp: sysctl: rto_min/max: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21640
+    - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21642
+    - mptcp: sysctl: sched: avoid using current->nsproxy
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21664
+    - dm thin: make get_first_thin use rcu-safe list first function
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57945
+    - riscv: mm: Fix the out of bound issue of vmemmap address
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21660
+    - ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21645
+    - platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled
+      it
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21646
+    - afs: Fix the maximum cell name length
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57925
+    - ksmbd: fix a missing return value check bug
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57926
+    - drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind
+      returns err
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21662
+    - net/mlx5: Fix variable not being completed when function returns
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21663
+    - net: stmmac: dwmac-tegra: Read iommu stream id from device tree
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21647
+    - sched: sch_cake: add bounds checks to host bulk flow fairness counts
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21648
+    - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21652
+    - ipvlan: Fix use-after-free in ipvlan_get_iflink().
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21658
+    - btrfs: avoid NULL pointer dereference if no valid extent tree
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2025-21653
+    - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-47736
+    - erofs: handle overlapped pclusters out of crafted images properly
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57940
+    - exfat: fix the infinite loop in exfat_readdir()
+  * Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
+    CVE-2024-57929
+    - dm array: fix releasing a faulty array block twice in dm_array_cursor_end
+  * intel_idle: add Granite Rapids Xeon (D) support (LP: #2106638)
+    - intel_idle: add Granite Rapids Xeon support
+    - intel_idle: add Granite Rapids Xeon D support
+  * [SRU] Enable speaker/mic mute LEDs on Lenovo ideapad and thinkbook
+    (LP: #2106449)
+    - ALSA: hda: Support for Ideapad hotkey mute LEDs
+    - platform/x86:lenovo-wmi-hotkey-utilities.c: Support for mic and audio mute
+      LEDs
+    - [Config] Enable Lenovo wmi hotkey driver
+  * Backport "PCI: Wait for device readiness with Configuration RRS" to N/O
+    (LP: #2106251)
+    - PCI: Wait for device readiness with Configuration RRS
+    - PCI: Avoid FLR for Mediatek MT7922 WiFi
+  * Enable OOB P-state control for Intel Sierra Forest/Granite Rapids
+    (LP: #2106275)
+    - cpufreq: intel_pstate: Support Granite Rapids and Sierra Forest OOB mode
+  * mptcp BUG 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
+    (LP: #2101120)
+    - mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
+  * CVE-2025-21971
+    - net_sched: Prevent creation of classes with TC_H_ROOT
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632)
+    - smb/client: rename cifs_ntsd to smb_ntsd
+    - smb/client: rename cifs_sid to smb_sid
+    - smb/client: rename cifs_acl to smb_acl
+    - smb/client: rename cifs_ace to smb_ace
+    - fs/smb/client: implement chmod() for SMB3 POSIX Extensions
+    - smb: client: stop flooding dmesg in smb2_calc_signature()
+    - media: uvcvideo: Force UVC version to 1.0a for 0408:4033
+    - Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925
+    - watchdog: rzg2l_wdt: Remove reset de-assert from probe
+    - watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset
+    - watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler
+    - ALSA: ump: Use guard() for locking
+    - ALSA: ump: Don't open legacy substream for an inactive group
+    - scsi: mpi3mr: Use ida to manage mrioc ID
+    - scsi: mpi3mr: Start controller indexing from 0
+    - ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11
+    - ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A
+    - x86/ptrace: Cleanup the definition of the pt_regs structure
+    - x86/ptrace: Add FRED additional information to the pt_regs structure
+    - Bluetooth: btusb: add callback function in btusb suspend/resume
+    - Bluetooth: btusb: mediatek: add callback function in btusb_disconnect
+    - platform/x86: mlx-platform: call pci_dev_put() to balance the refcount
+    - mmc: sdhci-msm: fix crypto key eviction
+    - tracing: Handle old buffer mappings for event strings and functions
+    - tracing: Fix trace_check_vprintf() when tp_printk is used
+    - tracing: Check "%s" dereference via the field and not the TP_printk format
+    - RDMA/bnxt_re: Allow MSN table capability check
+    - RDMA/bnxt_re: Remove always true dattr validity check
+    - RDMA/mlx5: Enforce same type port association for multiport RoCE
+    - RDMA/bnxt_re: Avoid initializing the software queue for user queues
+    - RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters
+    - nvme-pci: 512 byte aligned dma pool segment quirk
+    - RDMA/bnxt_re: Fix the check for 9060 condition
+    - RDMA/bnxt_re: Add check for path mtu in modify_qp
+    - RDMA/bnxt_re: Fix reporting hw_ver in query_device
+    - RDMA/bnxt_re: Fix max_qp_wrs reported
+    - RDMA/bnxt_re: Add support for Variable WQE in Genp7 adapters
+    - RDMA/bnxt_re: Disable use of reserved wqes
+    - RDMA/bnxt_re: Add send queue size check for variable wqe
+    - RDMA/bnxt_re: Fix MSN table size for variable wqe mode
+    - drm/bridge: adv7511_audio: Update Audio InfoFrame properly
+    - net: dsa: microchip: Fix KSZ9477 set_ageing_time function
+    - net: dsa: microchip: Fix LAN937X set_ageing_time function
+    - RDMA/hns: Refactor mtr find
+    - RDMA/hns: Remove unused parameters and variables
+    - RDMA/hns: Fix mapping error of zero-hop WQE buffer
+    - RDMA/hns: Fix warning storm caused by invalid input in IO path
+    - RDMA/hns: Fix missing flush CQE for DWQE
+    - ip_tunnel: annotate data-races around t->parms.link
+    - ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()
+    - ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit()
+    - ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()
+    - net: Fix netns for ip_tunnel_init_flow()
+    - net/mlx5: DR, select MSIX vector 0 for completion queue creation
+    - net/mlx5e: macsec: Maintain TX SA from encoding_sa
+    - drm/i915/dg1: Fix power gate sequence.
+    - net: llc: reset skb->transport_header
+    - ALSA: usb-audio: US16x08: Initialize array before use
+    - eth: bcmsysport: fix call balance of priv->clk handling routines
+    - net: mv643xx_eth: fix an OF node reference leak
+    - net: sfc: Correct key_len for efx_tc_ct_zone_ht_params
+    - net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init()
+    - net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init
+    - wifi: mac80211: wake the queues in case of failure in resume
+    - ALSA: hda/ca0132: Use standard HD-audio quirk matching helpers
+    - ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model
+    - sound: usb: enable DSD output for ddHiFi TC44C
+    - sound: usb: format: don't warn that raw DSD is unsupported
+    - bpf: fix potential error return
+    - ksmbd: retry iterate_dir in smb2_query_dir
+    - smb: client: destroy cfid_put_wq on module exit
+    - net: usb: qmi_wwan: add Telit FE910C04 compositions
+    - irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
+    - ARC: build: Try to guess GCC variant of cross compiler
+    - RDMA/bnxt_re: Fix the max WQE size for static WQE support
+    - modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
+    - modpost: fix the missed iteration for the max bit in do_input()
+    - ALSA: seq: Check UMP support for midi_version change
+    - ALSA hda/realtek: Add quirk for Framework F111:000C
+    - kcov: mark in_softirq_really() as __always_inline
+    - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
+    - sky2: Add device ID 11ab:4373 for Marvell 88E8075
+    - drm: adv7511: Drop dsi single lane support
+    - dt-bindings: display: adi,adv7533: Drop single lane support
+    - fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit
+    - mm/readahead: fix large folio support in async readahead
+    - mptcp: fix recvbuffer adjust on sleeping rcvmsg
+    - mptcp: don't always assume copied data in mptcp_cleanup_rbuf()
+    - RDMA/bnxt_re: Fix max SGEs for the Work Request
+    - scsi: hisi_sas: Remove redundant checks for automatic debugfs dump
+    - platform/x86: hp-wmi: Add thermal profile support for 8BAD boards
+    - platform/x86: hp-wmi: Fix platform profile option switch bug on Omen and
+      Victus laptops
+    - platform/x86: hp-wmi: Fix implementation of the platform_profile_omen_get
+      function
+    - platform/x86: hp-wmi: mark 8A15 board for timed OMEN thermal profile
+    - RDMA/core: Fix ENODEV error for iWARP test over vlan
+    - net: phy: micrel: Dynamically control external clock of KSZ PHY
+    - netdev-genl: avoid empty messages in napi get
+    - net: stmmac: restructure the error path of stmmac_probe_config_dt()
+    - net/mlx5e: Fix netif state handling
+    - net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only
+    - drm/i915/cx0_phy: Fix C10 pll programming sequence
+    - RDMA/bnxt_re: Fix error recovery sequence
+    - btrfs: allow swap activation to be interruptible
+    - perf/x86/intel: Add Arrow Lake U support
+    - ALSA: hda: cs35l56: Remove calls to
+      cs35l56_force_sync_asp1_registers_from_cache()
+    - ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio
+    - spi: spi-cadence-qspi: Disable STIG mode for Altera SoCFPGA.
+    - ARC: build: disallow invalid PAE40 + 4K page config
+    - bpf: refactor bpf_helper_changes_pkt_data to use helper number
+    - bpf: consider that tail calls invalidate packet pointers
+    - maple_tree: reload mas before the second call for mas_empty_area
+    - io_uring/rw: fix downgraded mshot read
+    - wifi: iwlwifi: mvm: Fix __counted_by usage in cfg80211_wowlan_nd_*
+    - net: ethernet: ti: am65-cpsw: default to round-robin for host port receive
+    - gve: process XSK TX descriptors as part of RX NAPI
+    - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
+    - mm: reinstate ability to map write-sealed memfd mappings read-only
+    - Upstream stable to v6.6.70, v6.12.9
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57898
+    - wifi: cfg80211: clear link ID from bitmap during link delete after clean up
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57882
+    - mptcp: fix TCP options overflow.
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57884
+    - mm: vmscan: account for free pages to prevent infinite Loop in
+      throttle_direct_reclaim()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57885
+    - mm/kmemleak: fix sleeping function called from invalid context at print
+      message
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57932
+    - gve: guard XDP xmit NDO on existence of xdp queues
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57933
+    - gve: guard XSK operations on the existence of queues
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57887
+    - drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57938
+    - net/sctp: Prevent autoclose integer overflow in sctp_association_init()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57889
+    - pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57890
+    - RDMA/uverbs: Prevent integer overflow issue
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57892
+    - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57893
+    - ALSA: seq: oss: Fix races at processing SysEx messages
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57895
+    - ksmbd: set ATTR_CTIME flags when setting mtime
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57896
+    - btrfs: flush delalloc workers queue before stopping cleaner kthread during
+      unmount
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57897
+    - drm/amdkfd: Correct the migration DMA map direction
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57899
+    - wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57900
+    - ila: serialize calls to nf_register_net_hooks()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57901
+    - af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57902
+    - af_packet: fix vlan_get_tci() vs MSG_PEEK
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57903
+    - net: restrict SO_REUSEPORT to inet sockets
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-36476
+    - RDMA/rtrs: Ensure 'ib_sge list' is accessible
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-39282
+    - net: wwan: t7xx: Fix FSM command timeout issue
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57801
+    - net/mlx5e: Skip restore TC rules for vport rep without loaded flag
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57802
+    - netrom: check buffer length before accessing it
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57841
+    - net: fix memory leak in tcp_conn_request()
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-57931
+    - selinux: ignore unknown extended permissions
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-56761
+    - x86/fred: Clear WFE in missing-ENDBRANCH #CPs
+  * Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
+    CVE-2024-53179
+    - smb: client: fix use-after-free of signing key
+  * uprobe-related panics during profiling (LP: #2104210)
+    - uprobes: Fix race in uprobe_free_utask
+  * ubuntu_bpf failed to build on Noble / Oracular (LP: #2069407)
+    - selftests/bpf: Fix compilation failure when CONFIG_NET_FOU!=y
+  * nfsd hangs and never recovers after NFS4ERR_DELAY and a connection loss
+    (LP: #2103564)
+    - NFSD: Reset cb_seq_status after NFS4ERR_DELAY
+  * thermal: Fix temperature readings on intel hardware (LP: #2103427)
+    - thermal: intel: intel_tcc: Add model checks for temperature registers
+    - thermal: intel: intel_tcc_cooling: Use a model-specific bitmask for TCC
+      offset
+    - hwmon: (coretemp) Extend the bitmask to read temperature to 0xff
+  * [SRU] Fix Lenovo M70/90 gen6 micmute key and led (LP: #2101811)
+    - ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
+    - ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869)
+    - ceph: allocate sparse_ext map only for sparse reads
+    - mm/vmstat: fix a W=1 clang compiler warning
+    - tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress()
+    - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
+    - bpf: Check negative offsets in __bpf_skb_min_len()
+    - mtd: diskonchip: Cast an operand to prevent potential overflow
+    - mtd: rawnand: arasan: Fix double assertion of chip-select
+    - mtd: rawnand: arasan: Fix missing de-registration of NAND
+    - phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP
+    - phy: core: Fix an OF node refcount leakage in _of_phy_get()
+    - phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
+    - phy: core: Fix that API devm_phy_put() fails to release the phy
+    - phy: core: Fix that API devm_of_phy_provider_unregister() fails to
+      unregister the phy provider
+    - phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
+    - phy: usb: Toggle the PHY power during init
+    - phy: rockchip: naneng-combphy: fix phy reset
+    - dmaengine: mv_xor: fix child node refcount handling in early exit
+    - dmaengine: dw: Select only supported masters for ACPI devices
+    - dmaengine: tegra: Return correct DMA status when paused
+    - dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd()
+    - dmaengine: apple-admac: Avoid accessing registers in probe
+    - stddef: make __struct_group() UAPI C++-friendly
+    - tracing/kprobe: Make trace_kprobe's module callback called after jump_label
+      update
+    - watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
+    - watchdog: mediatek: Add support for MT6735 TOPRGU/WDT
+    - scsi: qla1280: Fix hw revision numbering for ISP1020/1040
+    - udf: Skip parent dir link count update if corrupted
+    - ALSA: hda/conexant: fix Z60MR100 startup pop issue
+    - ALSA: sh: Use standard helper for buffer accesses
+    - smb: server: Fix building with GCC 15
+    - regmap: Use correct format specifier for logging range errors
+    - LoongArch: Fix reserving screen info memory for above-4G firmware
+    - LoongArch: BPF: Adjust the parameter of emit_jirl()
+    - platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
+    - spi: intel: Add Panther Lake SPI controller support
+    - scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load
+      time
+    - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN
+      as an error
+    - spi: omap2-mcspi: Fix the IS_ERR() bug for devm_clk_get_optional_enabled()
+    - blk-mq: register cpuhp callback after hctx is added to xarray table
+    - blk-mq: move cpuhp callback registering out of q->sysfs_lock
+    - MIPS: Probe toolchain support of -msym32
+    - MIPS: mipsregs: Set proper ISA level for virt extensions
+    - freezer, sched: Report frozen tasks as 'D' instead of 'R'
+    - tracing: Constify string literal data member in struct trace_event_call
+    - io_uring/sqpoll: fix sqpoll error handling races
+    - i2c: microchip-core: actually use repeated sends
+    - i2c: imx: add imx7d compatible string for applying erratum ERR007805
+    - i2c: microchip-core: fix "ghost" detections
+    - btrfs: sysfs: fix direct super block member reads
+    - ALSA: sh: Fix wrong argument order for copy_from_iter()
+    - block: avoid to reuse `hctx` not removed from cpuhp callback list
+    - fork: avoid inappropriate uprobe access to invalid mm
+    - ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
+    - power: supply: bq24190: Fix BQ24296 Vbus regulator support
+    - udf: Verify inode link counts before performing rename
+    - ALSA: ump: Indicate the inactive group in legacy substream names
+    - ALSA: ump: Update legacy substream names upon FB info update
+    - scsi: mpi3mr: Synchronize access to ioctl data buffer
+    - scsi: mpi3mr: Handling of fault code for insufficient power
+    - objtool: Add bch2_trans_unlocked_error() to bcachefs noreturns
+    - dmaengine: loongson2-apb: Change GENMASK to GENMASK_ULL
+    - perf/x86/intel/ds: Add PEBS format 6
+    - btrfs: add and use helper to verify the calling task has locked the inode
+    - btrfs: fix race with memory mapped writes when activating swap file
+    - btrfs: fix swap file activation failure due to extents that used to be
+      shared
+    - ALSA: ump: Shut up truncated string warning
+    - Upstream stable to v6.6.69, v6.12.8
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56758
+    - btrfs: check folio mapping after unlock in relocate_one_folio()
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56759
+    - btrfs: fix use-after-free when COWing tree bock and tracing is enabled
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57806
+    - btrfs: fix transaction atomicity bug when enabling simple quotas
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57793
+    - virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56764
+    - ublk: detach gendisk from ublk device if add_disk() fails
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57804
+    - scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57792
+    - power: supply: gpio-charger: Fix set charge current limits
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56760
+    - PCI/MSI: Handle lack of irqdomain gracefully
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56763
+    - tracing: Prevent bad count for tracing_cpumask_write
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57946
+    - virtio-blk: don't keep queue frozen during system suspend
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-57807
+    - scsi: megaraid_sas: Fix for a potential deadlock
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56767
+    - dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
+  * Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
+    CVE-2024-56769
+    - media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266)
+    - usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with
+      iommu enabled
+    - PCI: vmd: Create domain symlink before pci_bus_add_devices()
+    - PCI: Add ACS quirk for Broadcom BCM5760X NIC
+    - usb: cdns3-ti: Add workaround for Errata i2409
+    - MIPS: Loongson64: DTS: Fix msi node for ls7a
+    - ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP
+    - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C
+    - usb: cdns3: Add quirk flag to enable suspend residency
+    - platform/x86: p2sb: Make p2sb_get_devfn() return void
+    - p2sb: Factor out p2sb_read_from_cache()
+    - p2sb: Introduce the global flag p2sb_hidden_by_bios
+    - p2sb: Move P2SB hide and unhide code to p2sb_scan_and_cache()
+    - p2sb: Do not scan and remove the P2SB device when it is unhidden
+    - i2c: pnx: Fix timeout in wait functions
+    - xfs: fix the contact address for the sysfs ABI documentation
+    - xfs: verify buffer, inode, and dquot items every tx commit
+    - xfs: use consistent uid/gid when grabbing dquots for inodes
+    - xfs: declare xfs_file.c symbols in xfs_file.h
+    - xfs: create a new helper to return a file's allocation unit
+    - xfs: Fix xfs_flush_unmap_range() range for RT
+    - xfs: Fix xfs_prepare_shift() range for RT
+    - xfs: convert comma to semicolon
+    - xfs: fix file_path handling in tracepoints
+    - xfs: remove unused parameter in macro XFS_DQUOT_LOGRES
+    - xfs: attr forks require attr, not attr2
+    - xfs: conditionally allow FS_XFLAG_REALTIME changes if S_DAX is set
+    - xfs: Fix the owner setting issue for rmap query in xfs fsmap
+    - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
+    - xfs: take m_growlock when running growfsrt
+    - xfs: reset rootdir extent size hint after growfsrt
+    - tools: hv: change permissions of NetworkManager configuration file
+    - cxl/pci: Fix potential bogus return value upon successful probing
+    - cxl/region: Fix region creation for greater than x2 switches
+    - net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
+    - ionic: use ee->offset when returning sprom data
+    - net: renesas: rswitch: rework ts tags management
+    - net: hinic: Fix cleanup in create_rxqs/txqs()
+    - net: ethernet: bgmac-platform: fix an OF node reference leak
+    - ipvs: Fix clamp() of ip_vs_conn_tab on small memory systems
+    - netfilter: ipset: Fix for recursive locking warning
+    - selftests: openvswitch: fix tcpdump execution
+    - net: mdiobus: fix an OF node reference leak
+    - mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
+    - mmc: mtk-sd: disable wakeup in .remove() and in the error path of .probe()
+    - EDAC/amd64: Simplify ECC check on unified memory controllers
+    - chelsio/chtls: prevent potential integer overflow on 32bit
+    - i2c: riic: Always round-up when calculating bus period
+    - efivarfs: Fix error on non-existent file
+    - hexagon: Disable constant extender optimization for LLVM prior to 19.1.0
+    - USB: serial: option: add TCL IK512 MBIM & ECM
+    - USB: serial: option: add MeiG Smart SLM770A
+    - USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
+    - USB: serial: option: add MediaTek T7XX compositions
+    - USB: serial: option: add Telit FE910C04 rmnet compositions
+    - thunderbolt: Improve redrive mode handling
+    - drm/panel: novatek-nt35950: fix return value check in nt35950_probe()
+    - i915/guc: Reset engine utilization buffer before registration
+    - i915/guc: Ensure busyness counter increases motonically
+    - i915/guc: Accumulate active runtime on gt reset
+    - hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit
+      Registers
+    - hwmon: (tmp513) Fix Current Register value interpretation
+    - hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit
+      Registers
+    - zram: refuse to use zero sized block device as backing device
+    - zram: fix uninitialized ZRAM not releasing backing device
+    - zram: fix potential UAF of zram table
+    - vmalloc: fix accounting with i915
+    - btrfs: tree-checker: reject inline extent items with 0 ref count
+    - smb: client: fix TCP timers deadlock after rmmod
+    - tracing: Fix test_event_printk() to process entire print argument
+    - tracing: Add missing helper functions in event pointer dereference check
+    - tracing: Add "%s" check in test_event_printk()
+    - tracing: Have process_string() also allow arrays
+    - selftests/memfd: run sysctl tests when PID namespace support is enabled
+    - selftests/bpf: Use asm constraint "m" for LoongArch
+    - io_uring: Fix registered ring file refcount leak
+    - NFS/pnfs: Fix a live lock between recalled layouts and layoutget
+    - of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent()
+    - of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
+    - nilfs2: fix buffer head leaks in calls to truncate_inode_pages()
+    - udmabuf: also check for F_SEAL_FUTURE_WRITE
+    - of: Fix error path in of_parse_phandle_with_args_map()
+    - of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
+    - ceph: validate snapdirname option length when mounting
+    - ceph: improve error handling and short/overflow-read logic in
+      __ceph_sync_read()
+    - ceph: fix memory leaks in __ceph_sync_read()
+    - epoll: Add synchronous wakeup support for ep_poll_callback
+    - io_uring/rw: avoid punting to io-wq directly
+    - drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update
+    - xfs: sb_spino_align is not verified
+    - xfs: fix sparse inode limits on runt AG
+    - xfs: fix sb_spino_align checks for large fsblock sizes
+    - xfs: fix zero byte checking in the superblock scrubber
+    - netdev: fix repeated netlink messages in queue dump
+    - team: Fix feature exposure when no ports are present
+    - can: m_can: fix missed interrupts with m_can_pci
+    - netdev-genl: avoid empty messages in queue dump
+    - KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden
+    - KVM: arm64: Fix set_id_regs selftest for ASIDBITS becoming unwritable
+    - net: mctp: handle skb cleanup on sock_queue failures
+    - xhci: retry Stop Endpoint on buggy NEC controllers
+    - usb: xhci: Limit Stop Endpoint retries
+    - usb: xhci: Avoid queuing redundant Stop Endpoint commands
+    - xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic
+    - thunderbolt: Add support for Intel Panther Lake-M/P
+    - thunderbolt: Don't display nvm_version unless upgrade supported
+    - drm/panel: st7701: Add prepare_prev_first flag to drm_panel
+    - drm/panel: synaptics-r63353: Fix regulator unbalance
+    - drm/amdgpu/nbio7.11: fix IP version check
+    - drm/amdgpu/nbio7.7: fix IP version check
+    - fgraph: Still initialize idle shadow stacks when starting
+    - x86/hyperv: Fix hv tsc page based sched_clock for hibernation
+    - ocfs2: fix the space leak in LA when releasing LA
+    - of: property: fw_devlink: Do not use interrupt-parent directly
+    - of: address: Preserve the flags portion on 1:1 dma-ranges mapping
+    - Upstream stable to v6.6.68, v6.12.7
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56710
+    - ceph: fix memory leak in ceph_direct_read_write()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-53685
+    - ceph: give up on paths longer than PATH_MAX
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-54193
+    - accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-54455
+    - accel/ivpu: Fix general protection fault in ivpu_bo_list()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-53690
+    - nilfs2: prevent use of deleted inode
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56709
+    - io_uring: check if iowq is killed before queuing
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-55881
+    - KVM: x86: Play nice with protected guests in complete_hypercall_exit()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-55916
+    - Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56369
+    - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56372
+    - net: tun: fix tun_napi_alloc_frags()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56715
+    - ionic: Fix netdev notifier unregister on failure
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56716
+    - netdevsim: prevent bad user input in nsim_dev_health_break_write()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56717
+    - net: mscc: ocelot: fix incorrect IFH SRC_PORT field in
+      ocelot_ifh_set_basic()
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-57791
+    - net/smc: check return value of sock_recvmsg when draining clc data
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-47408
+    - net/smc: check smcd_v2_ext_offset when receiving proposal msg
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-49568
+    - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-49571
+    - net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal
+      msg
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-56718
+    - net/smc: protect link down work from execute after lgr freed
+  * Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
+    CVE-2024-41013
+    - xfs: don't walk off the end of a directory data block
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181)
+    - perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
+    - ksmbd: fix racy issue from session lookup and expire
+    - splice: do not checksum AF_UNIX sockets
+    - tcp: check space before adding MPTCP SYN options
+    - ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
+    - usb: host: max3421-hcd: Correctly abort a USB request.
+    - ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
+    - usb: dwc2: Fix HCD resume
+    - usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
+    - usb: dwc2: Fix HCD port connection race
+    - scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
+    - usb: gadget: midi2: Fix interpretation of is_midi1 bits
+    - usb: ehci-hcd: fix call balance of clocks handling routines
+    - usb: typec: anx7411: fix fwnode_handle reference leak
+    - usb: typec: anx7411: fix OF node reference leaks in
+      anx7411_typec_switch_probe()
+    - usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
+    - drm/i915: Fix memory leak by correcting cache object name in error handler
+    - xfs: update btree keys correctly when _insrec splits an inode root block
+    - xfs: don't drop errno values when we fail to ficlone the entire range
+    - xfs: return from xfs_symlink_verify early on V4 filesystems
+    - xfs: fix scrub tracepoints when inode-rooted btrees are involved
+    - xfs: only run precommits once per transaction object
+    - bpf: Check size for BTF-based ctx access of pointer members
+    - bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
+    - bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
+    - bpf, sockmap: Fix update element with same
+    - wifi: mac80211: init cnt before accessing elem in
+      ieee80211_copy_mbssid_beacon
+    - wifi: mac80211: clean up 'ret' in sta_link_apply_parameters()
+    - wifi: mac80211: fix station NSS capability initialization order
+    - batman-adv: Do not send uninitialized TT changes
+    - batman-adv: Remove uninitialized data in full table TT response
+    - batman-adv: Do not let TT changes list grows indefinitely
+    - wifi: cfg80211: sme: init n_channels before channels[] access
+    - selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
+    - selftests: mlxsw: sharedbuffer: Remove duplicate test cases
+    - selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
+    - ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
+    - net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
+    - net: mscc: ocelot: improve handling of TX timestamp for unknown skb
+    - net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-
+      safe
+    - net: mscc: ocelot: be resilient to loss of PTP packets during transmission
+    - net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
+    - spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
+    - net: sparx5: fix FDMA performance issue
+    - net: sparx5: fix the maximum frame length register
+    - ACPI: resource: Fix memory resource type union access
+    - cxgb4: use port number to set mac addr
+    - qca_spi: Fix clock speed for multiple QCA7000
+    - qca_spi: Make driver probing reliable
+    - ASoC: amd: yc: Fix the wrong return value
+    - Documentation: PM: Clarify pm_runtime_resume_and_get() return value
+    - net: renesas: rswitch: fix race window between tx start and complete
+    - net: renesas: rswitch: fix leaked pointer on error path
+    - net: renesas: rswitch: handle stop vs interrupt race
+    - net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
+    - netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
+    - bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
+    - team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
+    - ACPICA: events/evxfregn: don't release the ContextMutex that was never
+      acquired
+    - Bluetooth: iso: Fix recursive locking warning
+    - Bluetooth: SCO: Add support for 16 bits transparent voice setting
+    - net: renesas: rswitch: fix initial MPIC register setting
+    - net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
+    - blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
+    - kselftest/arm64: abi: fix SVCR detection
+    - KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
+    - selftests/bpf: remove use of __xlated()
+    - xen/netfront: fix crash when removing device
+    - x86: make get_cpu_vendor() accessible from Xen code
+    - objtool/x86: allow syscall instruction
+    - x86/static-call: provide a way to do very early static-call updates
+    - x86/xen: don't do PV iret hypercall through hypercall page
+    - x86/xen: add central hypercall functions
+    - x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
+    - x86/xen: add FRAME_END to xen_hypercall_hvm()
+    - x86/xen: use new hypercall functions instead of hypercall page
+    - x86/xen: remove hypercall page
+    - x86/static-call: fix 32-bit build
+    - x86/asm: Make serialize() always_inline
+    - x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0
+    - serial: sh-sci: Check if TX data was written to device in .tx_empty()
+    - gpio: ljca: Initialize num before accessing item in ljca_gpio_config
+    - ALSA: hda/realtek: Fix headset mic on Acer Nitro 5
+    - drm/amdkfd: Use device based logging for errors
+    - drm/amdkfd: pause autosuspend when creating pdd
+    - drm/amdkfd: fixed page fault when enable MES shader debugger
+    - drm/i915/color: Stop using non-posted DSB writes for legacy LUT
+    - drm/amd/pm: Set SMU v13.0.7 default workload type
+    - xfs: return a 64-bit block count from xfs_btree_count_blocks
+    - perf machine: Initialize machine->env to address a segfault
+    - bnxt_en: Fix GSO type for HW GRO packets on 5750X chips
+    - net: renesas: rswitch: fix possible early skb release
+    - Bluetooth: Improve setsockopt() handling of malformed user input
+    - libperf: evlist: Fix --cpu argument on hybrid platform
+    - selftests: netfilter: Stabilize rpath.sh
+    - net, team, bonding: Add netdev_base_features helper
+    - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
+    - team: Fix initial vlan_feature set in __team_compute_features
+    - drm/xe: fix the ERR_PTR() returned on failure to allocate tiny pt
+    - Upstream stable to v6.6.67, v6.12.6
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56652
+    - drm/xe/reg_sr: Remove register pool
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-54460
+    - Bluetooth: iso: Fix circular lock in iso_listen_bis
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-57879
+    - Bluetooth: iso: Always release hdev at the end of iso_listen_bis
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56656
+    - bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-53125
+    - bpf: sync_linked_regs() must preserve subreg_def
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56654
+    - Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56770
+    - net/sched: netem: account for backlog updates from child qdisc
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-54683
+    - netfilter: IDLETIMER: Fix for possible ABBA deadlock
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-55639
+    - net: renesas: rswitch: avoid use-after-put for a device tree node
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56657
+    - ALSA: control: Avoid WARN() for symlink errors
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56659
+    - net: lapb: increase LAPB_HEADER_LEN
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56660
+    - net/mlx5: DR, prevent potential error pointer dereference
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56662
+    - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56664
+    - bpf, sockmap: Fix race between element replace and close()
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56667
+    - drm/i915: Fix NULL pointer dereference in capture_engine
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56670
+    - usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to
+      accessing null pointer
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-53687
+    - riscv: Fix IPIs usage in kfence_protect_page()
+  * Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
+    CVE-2024-56675
+    - bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
+  * Noble update: upstream stable patchset 2025-02-04 (LP: #2097393)
+    - selftests: net: Remove executable bits from library scripts
+  * CVE-2024-56653
+    - Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
+
+  [ Ubuntu: 6.8.0-58.60 ]
+
+  * noble/linux: 6.8.0-58.60 -proposed tracker (LP: #2102529)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2025.03.17)
+  * wdat_wdt.ko should be pulled in by linux-image-virtual (LP: #2098554)
+    - [Packaging]: wdat_wdt.ko is moved from "linux-modules-extra-*-generic" to
+      "linux-modules-*-generic"
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118)
+    - openrisc: Use asm-generic's version of fix_to_virt() & virt_to_fix()
+    - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
+    - watchdog: xilinx_wwdt: Calculate max_hw_heartbeat_ms using clock frequency
+    - watchdog: apple: Actually flush writes after requesting watchdog restart
+    - watchdog: mediatek: Make sure system reset gets asserted in
+      mtk_wdt_restart()
+    - can: gs_usb: add VID/PID for Xylanta SAINT3 product family
+    - can: gs_usb: add usb endpoint address detection at driver probe step
+    - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
+    - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics
+    - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics
+    - can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
+    - can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
+    - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
+    - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
+    - can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics
+    - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
+    - selftests: hid: fix typo and exit code
+    - ptp: Add error handling for adjfine callback in ptp_clock_adjtime
+    - net/sched: tbf: correct backlog statistic for GSO packets
+    - net: hsr: fix fill_frame_info() regression vs VLAN packets
+    - platform/x86: asus-wmi: add support for vivobook fan profiles
+    - platform/x86: asus-wmi: Fix inconsistent use of thermal policies
+    - platform/x86: asus-wmi: Ignore return value when writing thermal policy
+    - net/smc: mark optional smcd_ops and check for support when called
+    - net/smc: add operations to merge sndbuf with peer DMB
+    - net/smc: {at|de}tach sndbuf to peer DMB if supported
+    - net/smc: refactoring initialization of smc sock
+    - net/qed: allow old cards not supporting "num_images" to work
+    - ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5
+    - ixgbe: downgrade logging of unsupported VF API version to debug
+    - net: sched: fix erspan_opt settings in cls_flower
+    - netfilter: nft_set_hash: skip duplicated elements pending gc run
+    - netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
+    - ethtool: Fix wrong mod state in case of verbose and no_mask bitset
+    - mlxsw: spectrum_acl_flex_keys: Constify struct mlxsw_afk_element_inst
+    - mlxsw: spectrum_acl_flex_keys: Use correct key block on Spectrum-4
+    - net/mlx5e: Remove workaround to avoid syndrome for internal port
+    - xhci: Allow RPM on the USB controller (1022:43f7) by default
+    - gpio: grgpio: use a helper variable to store the address of ofdev->dev
+    - usb: dwc3: gadget: Rewrite endpoint allocation flow
+    - usb: dwc3: ep0: Don't reset resource alloc flag (including ep0)
+    - usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED
+    - mmc: mtk-sd: use devm_mmc_alloc_host
+    - mmc: mtk-sd: Fix error handle of probe function
+    - mmc: mtk-sd: fix devm_clk_get_optional usage
+    - mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting
+    - zram: do not mark idle slots that cannot be idle
+    - zram: clear IDLE flag in mark_idle()
+    - powerpc/vdso: Refactor CFLAGS for CVDSO build
+    - powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang
+    - ntp: Remove invalid cast in time offset math
+    - driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link
+    - driver core: fw_devlink: Stop trying to optimize cycle detection logic
+    - drivers: core: fix device leak in __fw_devlink_relax_cycles()
+    - i3c: master: support to adjust first broadcast address speed
+    - i3c: master: svc: use slow speed for first broadcast address
+    - i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter
+    - i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS
+    - i3c: master: Extend address status bit to 4 and add
+      I3C_ADDR_SLOT_EXT_DESIRED
+    - i3c: master: Fix dynamic address leak when 'assigned-address' is present
+    - i3c: master: Fix missing 'ret' assignment in set_speed()
+    - drm/bridge: it6505: update usleep_range for RC circuit charge time
+    - drm/bridge: it6505: Fix inverted reset polarity
+    - scsi: ufs: core: Always initialize the UIC done completion
+    - scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG
+    - bpf, vsock: Fix poll() missing a queue
+    - bpf, vsock: Invoke proto::close on close()
+    - xsk: always clear DMA mapping information when unmapping the pool
+    - bpftool: fix potential NULL pointer dereferencing in prog_dump()
+    - drm/sti: Add __iomem for mixer_dbg_mxn's parameter
+    - ALSA: seq: ump: Use automatic cleanup of kfree()
+    - ALSA: ump: Update substream name from assigned FB names
+    - ALSA: seq: ump: Fix seq port updates per FB info notify
+    - ALSA: usb-audio: Notify xrun for low-latency mode
+    - tools: Override makefile ARCH variable if defined, but empty
+    - ASoC: SOF: ipc3-topology: Convert the topology pin index to ALH dai index
+    - ASoC: SOF: ipc3-topology: fix resource leaks in
+      sof_ipc3_widget_setup_comp_dai()
+    - bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
+    - scsi: scsi_debug: Fix hrtimer support for ndelay
+    - ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
+    - drm/v3d: Enable Performance Counters before clearing them
+    - scatterlist: fix incorrect func name in kernel-doc
+    - iio: magnetometer: yas530: use signed integer type for clamp limits
+    - bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
+    - bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem
+    - bpf: Handle in-place update for full LPM trie correctly
+    - bpf: Fix exact match conditions in trie_get_next_key()
+    - x86/CPU/AMD: WARN when setting EFER.AUTOIBRS if and only if the WRMSR fails
+    - watchdog: rti: of: honor timeout-sec property
+    - can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6.
+    - tracing: Fix cmp_entries_dup() to respect sort() comparison rules
+    - arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit
+      ASIDs
+    - ALSA: usb-audio: add mixer mapping for Corsair HS80
+    - ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
+    - ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
+    - scsi: qla2xxx: Fix abort in bsg timeout
+    - scsi: qla2xxx: Fix NVMe and NPIV connect issue
+    - scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
+    - scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
+    - scsi: ufs: core: Add missing post notify for power mode change
+    - fs/smb/client: cifs_prime_dcache() for SMB3 POSIX reparse points
+    - drm/dp_mst: Verify request type in the corresponding down message reply
+    - drm/amdgpu/hdp5.2: do a posting read when flushing HDP
+    - modpost: Add .irqentry.text to OTHER_SECTIONS
+    - x86/kexec: Restore GDT on return from ::preserve_context kexec
+    - dma-buf: fix dma_fence_array_signaled v4
+    - dma-fence: Fix reference leak on fence merge failure path
+    - dma-fence: Use kernel's sort for merging fences
+    - regmap: detach regmap from dev on regmap_exit
+    - mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10
+      tablet
+    - mmc: core: Further prevent card detect during shutdown
+    - ocfs2: update seq_file index in ocfs2_dlm_seq_next
+    - lib: stackinit: hide never-taken branch from compiler
+    - kasan: make report_lock a raw spinlock
+    - x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables
+    - epoll: annotate racy check
+    - kselftest/arm64: Log fp-stress child startup errors to stdout
+    - btrfs: avoid unnecessary device path update for the same device
+    - btrfs: do not clear read-only when adding sprout device
+    - kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
+    - hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list
+    - ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID
+    - perf/x86/amd: Warn only on new bits set
+    - spi: spi-fsl-lpspi: Adjust type of scldiv
+    - HID: add per device quirk to force bind to hid-generic
+    - media: uvcvideo: RealSense D421 Depth module metadata
+    - media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
+    - media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
+    - mmc: core: Add SD card quirk for broken poweroff notification
+    - mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
+    - regmap: maple: Provide lockdep (sub)class for maple tree's internal lock
+    - selftests/resctrl: Protect against array overflow when reading strings
+    - drm/vc4: hdmi: Avoid log spam for audio start failure
+    - drm/vc4: hvs: Set AXI panic modes for the HVS
+    - drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
+    - drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
+    - drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
+    - drm/bridge: it6505: Enable module autoloading
+    - drm/mcde: Enable module autoloading
+    - drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
+    - drm/display: Fix building with GCC 15
+    - ALSA: hda: Use own quirk lookup helper
+    - ALSA: hda/conexant: Use the new codec SSID matching
+    - r8169: don't apply UDP padding quirk on RTL8126A
+    - samples/bpf: Fix a resource leak
+    - net: fec_mpc52xx_phy: Use %pa to format resource_size_t
+    - net: ethernet: fs_enet: Use %pa to format resource_size_t
+    - net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
+    - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
+    - wifi: ath5k: add PCI ID for SX76X
+    - wifi: ath5k: add PCI ID for Arcadyan devices
+    - fanotify: allow reporting errors on failure to open fd
+    - drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
+    - net: sfp: change quirks for Alcatel Lucent G-010S-P
+    - net: stmmac: Programming sequence for VLAN packets with split header
+    - drm/sched: memset() 'job' in drm_sched_job_init()
+    - amdgpu/uvd: get ring reference from rq scheduler
+    - drm/amdgpu: don't access invalid sched
+    - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
+    - drm/amdgpu: Dereference the ATCS ACPI buffer
+    - netlink: specs: Add missing bitset attrs to ethtool spec
+    - drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
+    - fsl/fman: Validate cell-index value obtained from Device Tree
+    - drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
+    - ALSA: usb-audio: Make mic volume workarounds globally applicable
+    - wifi: ipw2x00: libipw_rx_any(): fix bad alignment
+    - dsa: qca8k: Use nested lock to avoid splat
+    - Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
+    - Bluetooth: Add new quirks for ATS2851
+    - Bluetooth: Support new quirks for ATS2851
+    - Bluetooth: Set quirks for ATS2851
+    - ASoC: hdmi-codec: reorder channel allocation list
+    - rocker: fix link status detection in rocker_carrier_init()
+    - net/neighbor: clear error in case strict check is not set
+    - netpoll: Use rcu_access_pointer() in __netpoll_setup
+    - pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
+    - tracing/ftrace: disable preemption in syscall probe
+    - tracing: Use atomic64_inc_return() in trace_clock_counter()
+    - tools/rtla: fix collision with glibc sched_attr/sched_set_attr
+    - rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
+    - scsi: ufs: core: Make DMA mask configuration more flexible
+    - scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
+    - clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
+    - clk: qcom: rpmh: add support for SAR2130P
+    - clk: qcom: tcsrcc-sm8550: add SAR2130P support
+    - scsi: st: Don't modify unknown block number in MTIOCGET
+    - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
+    - pinctrl: qcom-pmic-gpio: add support for PM8937
+    - pinctrl: qcom: spmi-mpp: Add PM8937 compatible
+    - thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens
+    - nvdimm: rectify the illogical code within nd_dax_probe()
+    - smb: client: memcpy() with surrounding object base address
+    - verification/dot2: Improve dot parser robustness
+    - KMSAN: uninit-value in inode_go_dump (5)
+    - PCI: qcom: Add support for IPQ9574
+    - PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs
+    - PCI: vmd: Set devices to D0 before enabling PM L1 Substates
+    - PCI: Detect and trust built-in Thunderbolt chips
+    - PCI: Add 'reset_subordinate' to reset hierarchy below bridge
+    - PCI: Add ACS quirk for Wangxun FF5xxx NICs
+    - f2fs: print message if fscorrupted was found in f2fs_new_node_page()
+    - ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840
+    - ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[]
+    - fs/ntfs3: Fix case when unmarked clusters intersect with zone
+    - usb: chipidea: udc: handle USB Error Interrupt if IOC not set
+    - iio: light: ltr501: Add LTER0303 to the supported devices
+    - ASoC: amd: yc: fix internal mic on Redmi G 2022
+    - drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3
+    - drm/amdgpu/vcn: reset fw_shared under SRIOV
+    - ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6
+      21M1CTO1WW
+    - misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
+    - rtc: cmos: avoid taking rtc_lock for extended period of time
+    - serial: 8250_dw: Add Sophgo SG2044 quirk
+    - smb: client: don't try following DFS links in cifs_tree_connect()
+    - setlocalversion: work around "git describe" performance
+    - sched/core: Remove the unnecessary need_resched() check in nohz_csd_func()
+    - sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning
+      busy
+    - sched/core: Prevent wakeup of ksoftirqd during idle load balance
+    - btrfs: fix missing snapshot drew unlock when root is dead during swap
+      activation
+    - clk: en7523: Initialize num before accessing hws in en7523_register_clocks()
+    - tracing/eprobe: Fix to release eprobe when failed to add dyn_event
+    - x86: Fix build regression with CONFIG_KEXEC_JUMP enabled
+    - Revert "unicode: Don't special case ignorable code points"
+    - vfio/mlx5: Align the page tracking max message size with the device
+      capability
+    - selftests/ftrace: adjust offset for kprobe syntax error test
+    - KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from
+      kvm_faultin_pfn()
+    - jffs2: Fix rtime decompressor
+    - mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
+    - iio: invensense: fix multiple odr switch when FIFO is off
+    - ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
+    - ALSA: hda: Fix build error without CONFIG_SND_DEBUG
+    - usb: dwc3: ep0: Don't reset resource alloc flag
+    - ALSA: usb-audio: Update UMP group attributes for GTB blocks, too
+    - platform/x86: asus-wmi: Fix thermal profile initialization
+    - i3c: master: svc: fix possible assignment of the same address to two devices
+    - btrfs: drop unused parameter file_offset from
+      btrfs_encoded_read_regular_fill_pages()
+    - md/raid5: Wait sync io to finish before changing group cnt
+    - media: platform: rga: fix 32-bit DMA limitation
+    - net: phy: dp83869: fix status reporting for 1000base-x autonegotiation
+    - remoteproc: qcom_q6v5_pas: disable auto boot for wpss
+    - mtd: spinand: winbond: Fix 512GW and 02JW OOB layout
+    - PCI: Pass domain number to pci_bus_release_domain_nr() explicitly
+    - dt-bindings: net: fec: add pps channel property
+    - net: fec: refactor PPS channel configuration
+    - net: fec: make PPS channel configurable
+    - drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
+    - drm/xe/migrate: use XE_BO_FLAG_PAGETABLE
+    - drm/amd: Add some missing straps from NBIO 7.11.0
+    - drm/amd: Fix initialization mistake for NBIO 7.11 devices
+    - drm/amdgpu/pm: Don't use OD table on Arcturus
+    - drm/amd/pm: Remove arcturus min power limit
+    - drm/amd/display: update pipe selection policy to check head pipe
+    - drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto
+    - Revert "drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs"
+    - ipv6: avoid possible NULL deref in modify_prefix_route()
+    - net: phy: microchip: Reset LAN88xx PHY to ensure clean link state on
+      LAN7800/7850
+    - ice: fix PHY Clock Recovery availability check
+    - vsock/test: fix failures due to wrong SO_RCVLOWAT parameter
+    - vsock/test: fix parameter types in SO_VM_SOCKETS_* calls
+    - mmc: core Convert UNSTUFF_BITS macro to inline function
+    - mmc: sd: SDUC Support Recognition
+    - mmc: core: Adjust ACMD22 to SDUC
+    - mmc: core: Use GFP_NOIO in ACMD22
+    - f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK}
+    - f2fs: fix to adjust appropriate length for fiemap
+    - f2fs: fix to requery extent which cross boundary of inquiry
+    - drm/amd/display: calculate final viewport before TAP optimization
+    - drm/amd/display: Ignore scalar validation failure if pipe is phantom
+    - pmdomain: core: Add missing put_device()
+    - pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails
+    - pmdomain: core: add dummy release function to genpd device
+    - bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
+    - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
+    - LoongArch: KVM: Protect kvm_check_requests() with SRCU
+    - net :mana :Request a V2 response version for MANA_QUERY_GF_STAT
+    - ALSA: usb-audio: Add extra PID for RME Digiface USB
+    - ALSA: hda/realtek: fix micmute LEDs don't work on HP Laptops
+    - scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers
+    - io_uring/cmd: document some uring_cmd related helpers
+    - io_uring: Change res2 parameter type in io_uring_cmd_done
+    - selftests/damon: add _damon_sysfs.py to TEST_FILES
+    - drm/amd/display: Correct prefetch calculation
+    - drm/amd/amdgpu: allow use kiq to do hdp flush under sriov
+    - drm/amdgpu/hdp6.0: do a posting read when flushing HDP
+    - drm/amdgpu/hdp4.0: do a posting read when flushing HDP
+    - drm/amdgpu/hdp5.0: do a posting read when flushing HDP
+    - x86/cpu/intel: Switch to new Intel CPU model defines
+    - x86/cpu/intel: Drop stray FAM6 check with new Intel CPU model defines
+    - x86/cpu: Add Lunar Lake to list of CPUs with a broken MONITOR implementation
+    - mm/damon: fix order of arguments in damos_before_apply tracepoint
+    - mm: respect mmap hint address when aligning for THP
+    - scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove()
+    - memblock: allow zero threshold in validate_numa_converage()
+    - s390/pci: Sort PCI functions prior to creating virtual busses
+    - s390/pci: Use topology ID for multi-function devices
+    - s390/pci: Ignore RID for isolated VFs
+    - s390/pci: Fix SR-IOV for PFs initially in standby
+    - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
+    - s390/pci: Fix handling of isolated VFs
+    - ext4: partial zero eof block on unaligned inode size extension
+    - crypto: ecdsa - Convert byte arrays with key coordinates to digits
+    - crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes
+    - crypto: ecdsa - Rename keylen to bufsize where necessary
+    - crypto: ecdsa - Use ecc_digits_from_bytes to convert signature
+    - crypto: ecdsa - Avoid signed integer overflow on signature decoding
+    - ACPI: video: force native for Apple MacbookPro11,2 and Air7,2
+    - cleanup: Adjust scoped_guard() macros to avoid potential warning
+    - gpio: free irqs that are still requested when the chip is being removed
+    - media: uvcvideo: Force UVC version to 1.0a for 0408:4035
+    - media: uvcvideo: Force UVC version to 1.0a for 0408:4033
+    - wifi: mac80211: export ieee80211_purge_tx_queue() for drivers
+    - drm/amd/display: skip disable CRTC in seemless bootup case
+    - drm/amd/display: disable SG displays on cyan skillfish
+    - wifi: mac80211: Add non-atomic station iterator
+    - accel/qaic: Add AIC080 support
+    - mptcp: annotate data-races around subflow->fully_established
+    - net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
+    - drm/amd/display: Prune Invalid Modes For HDMI Output
+    - i2c: i801: Add support for Intel Arrow Lake-H
+    - i2c: i801: Add support for Intel Panther Lake
+    - Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
+    - Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925
+    - Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925
+    - Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925
+    - Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925
+    - Bluetooth: btusb: Add 3 HWIDs for MT7925
+    - rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
+    - ring-buffer: Correct stale comments related to non-consuming readers
+    - ring-buffer: Limit time with disabled interrupts in rb_check_pages()
+    - scsi: lpfc: Check SLI_ACTIVE flag in FDMI cmpl before submitting follow up
+      FDMI
+    - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback
+    - clk: qcom: clk-alpha-pll: Add support for zonda ole pll configure
+    - clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574
+    - mailbox: pcc: Check before sending MCTP PCC response ACK
+    - remoteproc: qcom: pas: Add support for SA8775p ADSP, CDSP and GPDSP
+    - remoteproc: qcom: pas: enable SAR2130P audio DSP support
+    - fs/ntfs3: Implement fallocate for compressed files
+    - fs/ntfs3: Fix warning in ni_fiemap
+    - regulator: qcom-rpmh: Update ranges for FTSMPS525
+    - usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag
+    - usb: chipidea: udc: limit usb request length to max 16KB
+    - usb: chipidea: udc: create bounce buffer for problem sglist entries if
+      possible
+    - iio: adc: ad7192: Convert from of specific to fwnode property handling
+    - iio: adc: ad7192: properly check spi_get_device_match_data()
+    - usb: typec: ucsi: add callback for connector status updates
+    - usb: typec: ucsi: glink: move GPIO reading into connector_status callback
+    - usb: typec: ucsi: add update_connector callback
+    - usb: typec: ucsi: glink: set orientation aware if supported
+    - usb: typec: ucsi: glink: be more precise on orientation-aware ports
+    - usb: typec: ucsi: glink: fix off-by-one in connector_status
+    - usb: typec: ucsi: Set orientation as none when connector is unplugged
+    - nvme: use helper nvme_ctrl_state in nvme_keep_alive_finish function
+    - Revert "nvme: make keep-alive synchronous operation"
+    - irqchip/gic-v3-its: Avoid explicit cpumask allocation on stack
+    - irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
+    - [Config] updateconfigs for HISILICON_ERRATUM_162100801
+    - drm/amd/display: Add option to retrieve detile buffer size
+    - btrfs: drop unused parameter options from open_ctree()
+    - btrfs: drop unused parameter data from btrfs_fill_super()
+    - btrfs: fix mount failure due to remount races
+    - net/mlx5: unique names for per device caches
+    - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails
+    - ALSA: hda/realtek: Fix spelling mistake "Firelfy" -> "Firefly"
+    - softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
+    - Upstream stable to v6.6.65, v6.6.66, v6.12.4, v6.12.5
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-41932
+    - sched: fix warning in sched_setaffinity
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57872
+    - scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56588
+    - scsi: hisi_sas: Create all dump files during debugfs initialization
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47794
+    - bpf: Prevent tailcall infinite loop caused by freplace
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56599
+    - wifi: ath10k: avoid NULL pointer error during sdio remove
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56607
+    - wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56608
+    - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56609
+    - wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56782
+    - ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48876
+    - stackdepot: fix stack_depot_save_flags() in NMI context
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56620
+    - scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56621
+    - scsi: ufs: core: Cancel RTC work during ufshcd_remove()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-49569
+    - nvme-rdma: unquiesce admin_q before destroy it
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56632
+    - nvme-tcp: fix the memleak while create new ctrl failed
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56647
+    - net: Fix icmp host relookup triggering ip_rt_bug
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56775
+    - drm/amd/display: Fix handling of plane refcount
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56561
+    - PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56550
+    - s390/stacktrace: Use break instead of return statement
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56771
+    - mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56568
+    - iommu/arm-smmu: Defer probe of clients after smmu device bound
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56772
+    - kunit: string-stream: Fix a UAF bug in kunit_init_suite()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56773
+    - kunit: Fix potential null dereference in kunit_device_driver_test()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56580
+    - media: qcom: camss: fix error path on configuration of power domains
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57850
+    - jffs2: Prevent rtime decompress memory corruption
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56583
+    - sched/deadline: Fix warning in migrate_enable for boosted tasks
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56611
+    - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a
+      MM
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56613
+    - sched/numa: fix memory leak due to the overwritten vma->numab_state
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56584
+    - io_uring/tctx: work around xa_store() allocation error issue
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56781
+    - powerpc/prom_init: Fixup missing powermac #size-cells
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56785
+    - MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56585
+    - LoongArch: Fix sleeping in atomic context for PREEMPT_RT
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-41935
+    - f2fs: fix to shrink read extent node in batches
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-43098
+    - i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to
+      avoid deadlock
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-45828
+    - i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56586
+    - f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56587
+    - leds: class: Protect brightness_show() with led_cdev->led_access mutex
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56786
+    - bpf: put bpf_link's program when link is safe to be deallocated
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47141
+    - pinmux: Use sequential access to access desc->pinmux data
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56589
+    - scsi: hisi_sas: Add cond_resched() for no forced preemption model
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56590
+    - Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56592
+    - bpf: Call free_htab_elem() after htab_unlock_bucket()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56593
+    - wifi: brcmfmac: Fix oops due to NULL pointer dereference in
+      brcmf_sdiod_sglist_rw()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56594
+    - drm/amdgpu: set the right AMDGPU sg segment limitation
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57843
+    - virtio-net: fix overflow inside virtnet_rq_alloc
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56596
+    - jfs: fix array-index-out-of-bounds in jfs_readdir
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56597
+    - jfs: fix shift-out-of-bounds in dbSplit
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47143
+    - dma-debug: fix a possible deadlock on radix_lock
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56601
+    - net: inet: do not leave a dangling sk pointer in inet_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56602
+    - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56603
+    - net: af_can: do not leave a dangling sk pointer in can_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56604
+    - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56605
+    - Bluetooth: L2CAP: do not leave dangling sk pointer on error in
+      l2cap_sock_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56606
+    - af_packet: avoid erroring out after sock_init_data() in packet_create()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-47809
+    - dlm: fix possible lkb_resource null dereference
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48873
+    - wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
+  * Missing support for USB-C Apple Magic Trackpad (LP: #2098063) // Noble
+    update: upstream stable patchset 2025-03-12 (LP: #2102118)
+    - HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56787
+    - soc: imx8m: Probe the SoC driver as platform driver
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56610
+    - kcsan: Turn report_filterlist_lock into a raw_spinlock
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48875
+    - btrfs: don't take dev_replace rwsem on task already holding it
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57849
+    - s390/cpum_sf: Handle CPU hotplug remove during sampling
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57876
+    - drm/dp_mst: Fix resetting msg rx state after topology removal
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56616
+    - drm/dp_mst: Fix MST sideband message body length check
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-48881
+    - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56619
+    - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56622
+    - scsi: ufs: core: sysfs: Prevent div by zero
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56623
+    - scsi: qla2xxx: Fix use after free on unload
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-57874
+    - arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56625
+    - can: dev: can_set_termination(): allow sleeping GPIOs
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56626
+    - ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56628
+    - LoongArch: Add architecture specific huge_pte_clear()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56629
+    - HID: wacom: fix when get product name maybe null pointer
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56630
+    - ocfs2: free inode when ocfs2_get_init_inode() fails
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56631
+    - scsi: sg: Fix slab-use-after-free read in sg_release()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-50051
+    - spi: mpc52xx: Add cancel_work_sync before module remove
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56633
+    - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56565
+    - f2fs: fix to drop all discards after creating snapshot on lvm device
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56634
+    - gpio: grgpio: Add NULL check in grgpio_probe
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56635
+    - net: avoid potential UAF in default_operstate()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56636
+    - geneve: do not assume mac header is set in geneve_xmit_skb()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56637
+    - netfilter: ipset: Hold module reference while requesting a module
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56638
+    - netfilter: nft_inner: incorrect percpu area handling under softirq
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-52332
+    - igb: Fix potential invalid memory access in igb_init_module()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56640
+    - net/smc: fix LGR and link use-after-free issue
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56641
+    - net/smc: initialize close_work early to avoid warning
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56643
+    - dccp: Fix memory leak in dccp_feat_change_recv
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56644
+    - net/ipv6: release expired exception dst cached in socket
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56645
+    - can: j1939: j1939_session_new(): fix skb reference counting
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56648
+    - net: hsr: avoid potential out-of-bound access in fill_frame_info()
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56649
+    - net: enetc: Do not configure preemptible TCs if SIs do not support
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56783
+    - netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
+  * Noble update: upstream stable patchset 2025-03-12 (LP: #2102118) //
+    CVE-2024-56650
+    - netfilter: x_tables: fix LED ID check in led_tg_check()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915)
+    - wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings
+    - ASoC: codecs: rt5640: Always disable IRQs from rt5640_cancel_work()
+    - ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec
+    - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
+    - ASoC: Intel: sst: Support LPE0F28 ACPI HID
+    - wifi: iwlwifi: mvm: Use the sync timepoint API in suspend
+    - mac80211: fix user-power when emulating chanctx
+    - usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver
+    - selftests/watchdog-test: Fix system accidentally reset after watchdog-test
+    - ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
+    - x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
+    - bpf: fix filed access without lock
+    - net: usb: qmi_wwan: add Quectel RG650V
+    - soc: qcom: Add check devm_kasprintf() returned value
+    - firmware: arm_scmi: Reject clear channel request on A2P
+    - regulator: rk808: Add apply_bit for BUCK3 on RK809
+    - platform/x86: dell-smbios-base: Extends support to Alienware products
+    - platform/x86: dell-wmi-base: Handle META key Lock/Unlock events
+    - ASoC: tas2781: Add new driver version for tas2563 & tas2781 qfn chip
+    - tools/lib/thermal: Remove the thermal.h soft link when doing make clean
+    - can: j1939: fix error in J1939 documentation.
+    - platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect
+      fan speed
+    - ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6
+    - ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
+    - ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
+    - drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less
+      strict
+    - proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
+    - ASoC: audio-graph-card2: Purge absent supplies for device tree nodes
+    - LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS
+    - ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
+    - ARM: 9420/1: smp: Fix SMP for xip kernels
+    - ipmr: Fix access to mfc_cache_list without lock held
+    - mptcp: fix possible integer overflow in mptcp_reset_tout_timer
+    - arm64: probes: Disable kprobes/uprobes on MOPS instructions
+    - kselftest/arm64: mte: fix printf type warnings about __u64
+    - kselftest/arm64: mte: fix printf type warnings about longs
+    - s390/cio: Do not unregister the subchannel based on DNV
+    - s390/pageattr: Implement missing kernel_page_present()
+    - ext4: avoid remount errors with 'abort' mount option
+    - mips: asm: fix warning when disabling MIPS_FP_SUPPORT
+    - m68k: mvme147: Fix SCSI controller IRQ numbers
+    - m68k: mvme147: Reinstate early console
+    - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
+    - acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
+    - cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter()
+    - block: fix bio_split_rw_at to take zone_write_granularity into account
+    - s390/syscalls: Avoid creation of arch/arch/ directory
+    - ext4: remove calls to to set/clear the folio error flag
+    - ext4: pipeline buffer reads in mext_page_mkuptodate()
+    - ext4: remove array of buffer_heads from mext_page_mkuptodate()
+    - ext4: fix race in buffer_head read fault injection
+    - nvme-pci: reverse request order in nvme_queue_rqs
+    - virtio_blk: reverse request order in virtio_queue_rqs
+    - crypto: qat - remove check after debugfs_create_dir()
+    - firmware: google: Unregister driver_info on failure
+    - crypto: qat - remove faulty arbiter config reset
+    - thermal: core: Initialize thermal zones before registering them
+    - EDAC/fsl_ddr: Fix bad bit shift operations
+    - EDAC/skx_common: Differentiate memory error sources
+    - EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator
+    - crypto: cavium - Fix the if condition to exit loop after timeout
+    - amd-pstate: Set min_perf to nominal_perf for active mode performance gov
+    - crypto: hisilicon/qm - disable same error report before resetting
+    - crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init()
+    - doc: rcu: update printed dynticks counter bits
+    - hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK
+    - hwmon: (pmbus/core) clear faults after setting smbalert mask
+    - hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
+    - ACPI: CPPC: Fix _CPC register setting issue
+    - crypto: caam - add error check to caam_rsa_set_priv_key_form
+    - crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
+    - rcuscale: Do a proper cleanup if kfree_scale_init() fails
+    - tools/lib/thermal: Make more generic the command encoding function
+    - thermal/lib: Fix memory leak on error in thermal_genl_auto()
+    - x86/unwind/orc: Fix unwind for newly forked tasks
+    - time: Partially revert cleanup on msecs_to_jiffies() documentation
+    - time: Fix references to _msecs_to_jiffies() handling of values
+    - kcsan, seqlock: Support seqcount_latch_t
+    - kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
+    - clocksource/drivers:sp804: Make user selectable
+    - clocksource/drivers/timer-ti-dm: Fix child node refcount handling
+    - spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
+    - microblaze: Export xmb_manager functions
+    - arm64: dts: mt8195: Fix dtbs_check error for mutex node
+    - arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node
+    - soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
+    - arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins
+    - ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode
+    - mmc: mmc_spi: drop buggy snprintf()
+    - openrisc: Implement fixmap to fix earlycon
+    - efi/libstub: fix efi_parse_options() ignoring the default command line
+    - tpm: fix signed/unsigned bug when checking event logs
+    - media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call
+    - arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
+    - arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
+    - arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source
+      trackpad
+    - Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
+    - cgroup/bpf: only cgroup v2 can be attached by bpf programs
+    - regulator: rk808: Restrict DVS GPIOs to the RK808 variant only
+    - arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns
+    - arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns
+    - arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns
+    - arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns
+    - pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
+    - ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
+    - arm64: dts: ti: k3-j7200: use ti,j7200-padconf compatible
+    - arm64: dts: ti: k3-j7200: Fix register map for main domain pmx
+    - arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances
+    - arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances
+    - arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances
+    - um: Unconditionally call unflatten_device_tree()
+    - x86/of: Unconditionally call unflatten_and_copy_device_tree()
+    - of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify
+    - riscv: Fix wrong usage of __pa() on a fixmap address
+    - pmdomain: ti-sci: Add missing of_node_put() for args.np
+    - spi: tegra210-quad: Avoid shift-out-of-bounds
+    - spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time​
+    - regmap: irq: Set lockdep class for hierarchical IRQ domains
+    - arm64: dts: renesas: hihope: Drop #sound-dai-cells
+    - arm64: dts: mediatek: Add ADC node on MT6357, MT6358, MT6359 PMICs
+    - arm64: dts: mediatek: mt6358: fix dtbs_check error
+    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names
+    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed
+      regulators
+    - selftests/resctrl: Split fill_buf to allow tests finer-grained control
+    - selftests/resctrl: Refactor fill_buf functions
+    - selftests/resctrl: Fix memory overflow due to unhandled wraparound
+    - selftests/resctrl: Protect against array overrun during iMC config parsing
+    - arm64: dts: rockchip: correct analog audio name on Indiedroid Nova
+    - platform/x86: panasonic-laptop: Return errno correctly in show callback
+    - drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
+    - drm/vc4: hvs: Don't write gamma luts on 2711
+    - drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer
+    - drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function
+    - drm/vc4: hvs: Correct logic on stopping an HVS channel
+    - drm/omap: Fix possible NULL dereference
+    - drm/omap: Fix locking in omap_gem_new_dmabuf()
+    - wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
+    - wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/v3d: Address race-condition in MMU flush
+    - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
+    - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
+    - dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
+    - ASoC: fsl_micfil: fix regmap_write_bits usage
+    - ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
+    - drm/bridge: anx7625: Drop EDID cache on bridge power off
+    - drm/bridge: it6505: Drop EDID cache on bridge power off
+    - libbpf: Fix expected_attach_type set handling in program load callback
+    - libbpf: Fix output .symtab byte-order during linking
+    - bpf: Fix the xdp_adjust_tail sample prog issue
+    - wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR
+    - ice: consistently use q_idx in ice_vc_cfg_qs_msg()
+    - drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush
+    - libbpf: fix sym_is_subprog() logic for weak global subprogs
+    - ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c
+    - libbpf: never interpret subprogs in .text as entry programs
+    - netdevsim: copy addresses for both in and out paths
+    - drm/bridge: tc358767: Fix link properties discovery
+    - selftests/bpf: Fix msg_verify_data in test_sockmap
+    - selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
+    - drm: fsl-dcu: enable PIXCLK on LS1021A
+    - drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
+    - drm/msm/dpu: drop LM_3 / LM_4 on SDM845
+    - drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
+    - selftests/bpf: fix test_spin_lock_fail.c's global vars usage
+    - drm/panfrost: Remove unused id_mask from struct panfrost_model
+    - bpf, arm64: Remove garbage frame for struct_ops trampoline
+    - drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
+    - drm/msm/gpu: Check the status of registration to PM QoS
+    - drm/etnaviv: Request pages from DMA32 zone on addressing_limited
+    - drm/etnaviv: hold GPU lock across perfmon sampling
+    - wifi: wfx: Fix error handling in wfx_core_init()
+    - drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
+    - bpf, bpftool: Fix incorrect disasm pc
+    - drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
+    - drm: use ATOMIC64_INIT() for atomic64_t
+    - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion
+    - netfilter: nf_tables: must hold rcu read lock while iterating expression
+      type list
+    - netfilter: nf_tables: skip transaction if update object is not implemented
+    - netfilter: nf_tables: must hold rcu read lock while iterating object type
+      list
+    - netlink: typographical error in nlmsg_type constants definition
+    - selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
+    - selftests/bpf: Fix SENDPAGE data logic in test_sockmap
+    - selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
+    - selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
+    - bpf, sockmap: Several fixes to bpf_msg_push_data
+    - bpf, sockmap: Fix sk_msg_reset_curr
+    - sock_diag: add module pointer to "struct sock_diag_handler"
+    - sock_diag: allow concurrent operations
+    - sock_diag: allow concurrent operation in sock_diag_rcv_msg()
+    - net: use unrcu_pointer() helper
+    - selftests: net: really check for bg process completion
+    - drm/amdkfd: Fix wrong usage of INIT_WORK()
+    - bpf: Force uprobe bpf program to always return 0
+    - net: rfkill: gpio: Add check for clk_enable()
+    - netpoll: Use rcu_access_pointer() in netpoll_poll_lock
+    - wireguard: selftests: load nf_conntrack if not present
+    - cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged
+    - clk: mediatek: drop two dead config options
+    - [Config] drop COMMON_CLK_MT8195_AUDSYS and COMMON_CLK_MT8195_MSDC
+    - trace/trace_event_perf: remove duplicate samples on the first tracepoint
+      event
+    - pinctrl: zynqmp: drop excess struct member description
+    - scsi: hisi_sas: Enable all PHYs that are not disabled by user during
+      controller reset
+    - mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
+    - mfd: da9052-spi: Change read-mask to write-mask
+    - cpufreq: loongson2: Unregister platform_driver on failure
+    - powerpc/fadump: Refactor and prepare fadump_cma_init for late init
+    - mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE
+    - mtd: rawnand: atmel: Fix possible memory leak
+    - mtd: rawnand: fix double free in atmel_pmecc_create_user()
+    - mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in
+      RD_ANY_REG_OP
+    - RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci
+    - RDMA/hns: Use dev_* printings in hem code instead of ibdev_*
+    - RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
+    - clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset
+    - clk: renesas: rzg2l: Fix FOUTPOSTDIV clk
+    - RDMA/rxe: Set queue pair cur_qp_state when being queried
+    - RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation
+    - clk: imx: lpcg-scu: SW workaround for errata (e10858)
+    - clk: imx: fracn-gppll: correct PLL initialization flow
+    - clk: imx: fracn-gppll: fix pll power up
+    - clk: imx: clk-scu: fix clk enable state save and restore
+    - clk: imx: imx8-acm: Fix return value check in
+      clk_imx_acm_attach_pm_domains()
+    - iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes()
+    - iommu/vt-d: Fix checks and print in pgtable_walk()
+    - checkpatch: check for missing Fixes tags
+    - checkpatch: always parse orig_commit in fixes tag
+    - mfd: rt5033: Fix missing regmap_del_irq_chip()
+    - fs/proc/kcore.c: fix coccinelle reported ERROR instances
+    - scsi: fusion: Remove unused variable 'rc'
+    - scsi: sg: Enable runtime power management
+    - x86/tdx: Introduce wrappers to read and write TD metadata
+    - x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup()
+    - x86/tdx: Dynamically disable SEPT violations from causing #VEs
+    - RDMA/hns: Fix out-of-order issue of requester when setting FENCE
+    - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()
+    - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()
+    - dax: delete a stale directory pmem
+    - KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests
+    - KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending
+      doorbells
+    - powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
+    - powerpc/kexec: Fix return of uninitialized variable
+    - IB/mlx5: Allocate resources just before first QP/SRQ is created
+    - clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
+    - clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC RT3883
+    - dt-bindings: clock: axi-clkgen: include AXI clk
+    - clk: clk-axi-clkgen: make sure to enable the AXI bus clock
+    - arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw
+    - pinctrl: k210: Undef K210_PC_DEFAULT
+    - smb: cached directories can be more than root file handle
+    - mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()
+    - perf cs-etm: Don't flush when packet_queue fills up
+    - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw
+    - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async
+    - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE
+    - gfs2: Allow immediate GLF_VERIFY_DELETE work
+    - gfs2: Fix unlinked inode cleanup
+    - perf stat: Close cork_fd when create_perf_stat_counter() failed
+    - perf stat: Fix affinity memory leaks on error path
+    - perf trace: Keep exited threads for summary
+    - perf test attr: Add back missing topdown events
+    - f2fs: compress: fix inconsistent update of i_blocks in
+      release_compress_blocks and reserve_compress_blocks
+    - perf probe: Fix libdw memory leak
+    - perf probe: Correct demangled symbols in C++ program
+    - rust: macros: fix documentation of the paste! macro
+    - PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
+    - PCI: cpqphp: Fix PCIBIOS_* return value confusion
+    - perf ftrace latency: Fix unit on histogram first entry when using --use-nsec
+    - f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
+    - f2fs: check curseg->inited before write_sum_page in change_curseg
+    - f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or
+      GC_URGENT_MID
+    - PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup()
+    - PCI: cadence: Set cdns_pcie_host_init() global
+    - PCI: j721e: Add reset GPIO to struct j721e_pcie
+    - PCI: j721e: Use T_PERST_CLK_US macro
+    - PCI: j721e: Add suspend and resume support
+    - PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds
+    - f2fs: fix to avoid forcing direct write to use buffered IO on inline_data
+      inode
+    - perf trace: avoid garbage when not printing a trace event's arguments
+    - m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
+    - m68k: coldfire/device.c: only build FEC when HW macros are defined
+    - perf list: Fix topic and pmu_name argument order
+    - perf trace: Fix tracing itself, creating feedback loops
+    - perf trace: Do not lose last events in a race
+    - perf trace: Avoid garbage when not printing a syscall's arguments
+    - remoteproc: qcom: pas: add minidump_id to SM8350 resources
+    - rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
+    - remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
+    - nfsd: restore callback functionality for NFSv4.0
+    - NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
+    - NFSD: Fix nfsd4_shutdown_copy()
+    - hwmon: (tps23861) Fix reporting of negative temperatures
+    - vdpa/mlx5: Fix suboptimal range on iotlb iteration
+    - selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels
+    - gpio: zevio: Add missed label initialisation
+    - fs_parser: update mount_api doc to match function signature
+    - LoongArch: Fix build failure with GCC 15 (-std=gnu23)
+    - LoongArch: BPF: Sign-extend return values
+    - power: supply: core: Remove might_sleep() from power_supply_put()
+    - power: supply: bq27xxx: Fix registers of bq27426
+    - power: supply: rt9471: Fix wrong WDT function regfield declaration
+    - power: supply: rt9471: Use IC status regfield to report real charger status
+    - net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
+    - tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
+    - net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL
+      configuration
+    - net: microchip: vcap: Add typegroup table terminators in kunit tests
+    - net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged
+    - net: mdio-ipq4019: add missing error check
+    - marvell: pxa168_eth: fix call balance of pep->clk handling routines
+    - net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
+    - octeontx2-af: RPM: Fix mismatch in lmac type
+    - octeontx2-af: RPM: Fix low network performance
+    - octeontx2-pf: Reset MAC stats during probe
+    - octeontx2-af: RPM: fix stale RSFEC counters
+    - octeontx2-af: RPM: fix stale FCFEC counters
+    - octeontx2-af: Quiesce traffic before NIX block reset
+    - spi: atmel-quadspi: Fix register name in verbose logging function
+    - net: hsr: fix hsr_init_sk() vs network/transport headers.
+    - bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
+    - bnxt_en: Refactor bnxt_ptp_init()
+    - bnxt_en: Unregister PTP during PCI shutdown and suspend
+    - llc: Improve setsockopt() handling of malformed user input
+    - rxrpc: Improve setsockopt() handling of malformed user input
+    - tcp: Fix use-after-free of nreq in reqsk_timer_handler().
+    - ip6mr: fix tables suspicious RCU usage
+    - ipmr: fix tables suspicious RCU usage
+    - iio: light: al3010: Fix an error handling path in al3010_probe()
+    - usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
+    - usb: yurex: make waiting on yurex_write interruptible
+    - USB: chaoskey: fail open after removal
+    - USB: chaoskey: Fix possible deadlock chaoskey_list_lock
+    - misc: apds990x: Fix missing pm_runtime_disable()
+    - counter: stm32-timer-cnt: Add check for clk_enable()
+    - counter: ti-ecap-capture: Add check for clk_enable()
+    - ALSA: hda/realtek: Update ALC256 depop procedure
+    - drm/radeon: add helper rdev_to_drm(rdev)
+    - drm/radeon: change rdev->ddev to rdev_to_drm(rdev)
+    - drm/radeon: Fix spurious unplug event on radeon HDMI
+    - apparmor: fix 'Do simple duplicate message elimination'
+    - ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry
+    - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru
+    - gfs2: Remove and replace gfs2_glock_queue_work
+    - f2fs: fix fiemap failure issue when page size is 16KB
+    - usb: ehci-spear: fix call balance of sehci clk handling routines
+    - ALSA: usb-audio: Fix a DMA to stack memory bug
+    - ASoC: Intel: sst: Fix used of uninitialized ctx to log an error
+    - soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
+    - ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
+    - ext4: fix FS_IOC_GETFSMAP handling
+    - jfs: xattr: check invalid xattr size more strictly
+    - ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5
+      21MES00B00
+    - ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
+    - perf/x86/intel/pt: Fix buffer full but size is 0 case
+    - crypto: x86/aegis128 - access 32-bit arguments as 32-bit
+    - KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE
+    - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector
+    - KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR
+    - KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
+    - KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
+    - KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
+    - KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
+    - fsnotify: fix sending inotify event with unexpected filename
+    - tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
+    - locking/lockdep: Avoid creating new name string literals in
+      lockdep_set_subclass()
+    - tools/nolibc: s390: include std.h
+    - pinctrl: qcom: spmi: fix debugfs drive strength
+    - dt-bindings: iio: dac: ad3552r: fix maximum spi speed
+    - exfat: fix uninit-value in __exfat_get_dentry_set
+    - Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
+    - Compiler Attributes: disable __counted_by for clang < 19.1.3
+    - usb: xhci: Fix TD invalidation under pending Set TR Dequeue
+    - ARM: dts: omap36xx: declare 1GHz OPP as turbo again
+    - wifi: brcmfmac: release 'root' node in all execution paths
+    - Revert "usb: gadget: composite: fix OS descriptors w_value logic"
+    - gpio: exar: set value when external pull-up or pull-down is present
+    - spi: Fix acpi deferred irq probe
+    - cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power()
+    - cifs: support mounting with alternate password to allow password rotation
+    - parisc/ftrace: Fix function graph tracing disablement
+    - platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
+    - ubi: wl: Put source PEB into correct list if trying locking LEB failed
+    - dt-bindings: serial: rs485: Fix rs485-rts-delay property
+    - serial: 8250_fintek: Add support for F81216E
+    - serial: 8250: omap: Move pm_runtime_get_sync
+    - iio: gts: Fix uninitialized symbol 'ret'
+    - ublk: fix ublk_ch_mmap() for 64K page size
+    - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
+    - block: fix missing dispatching request when queue is started or unquiesced
+    - block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding
+    - block: fix ordering between checking BLK_MQ_S_STOPPED request adding
+    - blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long
+    - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
+    - soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting()
+    - media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
+    - ALSA: ump: Fix evaluation of MIDI 1.0 FB info
+    - ALSA: hda/realtek: Update ALC225 depop procedure
+    - ALSA: hda/realtek: Fixup ALC225 depop procedure
+    - ALSA: hda/realtek: Set PCBeep to default value for ALC274
+    - ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
+    - ALSA: hda/realtek: Apply quirk for Medion E15433
+    - smb3: request handle caching when caching directories
+    - smb: client: handle max length for SMB symlinks
+    - cifs: Add tracing for the cifs_tcon struct refcounting
+    - usb: dwc3: gadget: Fix checking for number of TRBs left
+    - ublk: fix error code for unsupported command
+    - lib: string_helpers: silence snprintf() output truncation warning
+    - um: Fix the return value of elf_core_copy_task_fpregs
+    - um: Always dump trace for specified task in show_stack
+    - rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
+    - rtc: abx80x: Fix WDT bit position of the status register
+    - ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
+    - ubifs: Correct the total block count by deducting journal reservation
+    - jffs2: fix use of uninitialized variable
+    - rtc: rzn1: fix BCD to rtc_time conversion errors
+    - nvme-multipath: prepare for "queue-depth" iopolicy
+    - nvme-multipath: implement "queue-depth" iopolicy
+    - nvme-multipath: avoid hang on inaccessible namespaces
+    - nvme/multipath: Fix RCU list traversal to use SRCU primitive
+    - block: return unsigned int from bdev_io_min
+    - 9p/xen: fix init sequence
+    - perf/arm-smmuv3: Fix lockdep assert in ->event_init()
+    - perf/arm-cmn: Ensure port and device id bits are set properly
+    - smb: client: disable directory caching when dir_cache_timeout is zero
+    - cifs: Fix parsing native symlinks relative to the export
+    - cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE
+      session
+    - rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
+    - init/modpost: conditionally check section mismatch to __meminit*
+    - Rename .data.unlikely to .data..unlikely
+    - Rename .data.once to .data..once to fix resetting WARN*_ONCE
+    - modpost: remove incorrect code in do_eisa_entry()
+    - cifs: during remount, make sure passwords are in sync
+    - cifs: unlock on error in smb3_reconfigure()
+    - nfs: ignore SB_RDONLY when mounting nfs
+    - SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT
+    - xfs: remove unknown compat feature check in superblock write validation
+    - btrfs: don't loop for nowait writes when checking for cross references
+    - md/md-bitmap: Add missing destroy_work_on_stack()
+    - arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
+    - arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
+    - arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
+    - media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
+    - media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
+    - media: verisilicon: av1: Fix reference video buffer pointer assignment
+    - media: platform: exynos4-is: Fix an OF node reference leak in
+      fimc_md_is_isp_available
+    - media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
+    - media: uvcvideo: Stop stream during unregister
+    - maple_tree: refine mas_store_root() on storing NULL
+    - vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
+    - zram: clear IDLE flag after recompression
+    - iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
+    - leds: lp55xx: Remove redundant test for invalid channel number
+    - clk: qcom: gcc-qcs404: fix initial rate of GPLL3
+    - ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow
+    - ARM: 9430/1: entry: Do a dummy read from VMAP shadow
+    - ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()
+    - ceph: extract entity name from device id
+    - util_macros.h: fix/rework find_closest() macros
+    - scsi: ufs: exynos: Fix hibern8 notify callbacks
+    - i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible
+    - PCI: keystone: Add link up check to ks_pcie_other_map_bus()
+    - PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf()
+    - fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful
+      iov_iter_zero
+    - thermal: int3400: Fix reading of current_uuid for active policy
+    - leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error
+      paths
+    - ovl: properly handle large files in ovl_security_fileattr
+    - dm: Fix typo in error message
+    - dm thin: Add missing destroy_work_on_stack()
+    - PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes
+    - PCI: rockchip-ep: Fix address translation unit programming
+    - iio: accel: kx022a: Fix raw read format
+    - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
+    - iio: gts: fix infinite loop for gain_to_scaletables()
+    - powerpc: Fix stack protector Kconfig test for clang
+    - powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang
+    - udmabuf: use vmf_insert_pfn and VM_PFNMAP for handling mmap
+    - drm/mediatek: Fix child node refcount handling in early exit
+    - drm/etnaviv: flush shader L1 cache after user commandstream
+    - drm: xlnx: zynqmp_dpsub: fix hotplug detection
+    - drm/amdkfd: Use the correct wptr size
+    - drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu
+      v13.0.7
+    - posix-timers: Target group sigqueue to current task only if not exiting
+    - wifi: cfg80211: Add wiphy_delayed_work_pending()
+    - wifi: mac80211: Convert color collision detection to wiphy work
+    - spi: stm32: fix missing device mode capability in stm32mp25
+    - usb: typec: use cleanup facility for 'altmodes_node'
+    - platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys
+    - integrity: Avoid -Wflex-array-member-not-at-end warnings
+    - integrity: Use static_assert() to check struct sizes
+    - ASoC: max9768: Fix event generation for playback mute
+    - ARM: 9434/1: cfi: Fix compilation corner case
+    - drm/amd/display: Skip Invalid Streams from DSC Policy
+    - drm/amd/display: Fix DSC-re-computing
+    - drm/amd/display: Fix incorrect DSC recompute trigger
+    - s390/facilities: Fix warning about shadow of global variable
+    - cachefiles: Fix incorrect length return value in
+      cachefiles_ondemand_fd_write_iter()
+    - thermal: core: Drop thermal_zone_device_is_enabled()
+    - thermal: core: Synchronize suspend-prepare and post-suspend actions
+    - thermal: core: Rearrange PM notification code
+    - thermal: core: Represent suspend-related thermal zone flags as bits
+    - thermal: core: Mark thermal zones as initializing to start with
+    - thermal: core: Fix race between zone registration and system suspend
+    - crypto: qat - Fix missing destroy_workqueue in adf_init_aer()
+    - sched/cpufreq: Ensure sd is rebuilt for EAS check
+    - cleanup: Remove address space of returned pointer
+    - ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash
+    - arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy
+    - scripts/kernel-doc: Do not track section counter across processed files
+    - arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region
+    - scripts/kernel-doc: add modeline for vim users
+    - scripts/kernel-doc: simplify function printing
+    - scripts/kernel-doc: separate out function signature
+    - scripts/kernel-doc: simplify signature printing
+    - doc: kerneldoc.py: fix indentation
+    - kernel-doc: allow object-like macros in ReST output
+    - arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status
+    - arm64: dts: rockchip: Remove 'enable-active-low' from two boards
+    - arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers
+    - dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries
+    - pwm: Assume a disabled PWM to emit a constant inactive output
+    - drm/imagination: Convert to use time_before macro
+    - drm/imagination: Use pvr_vm_context_get()
+    - drm/v3d: Flush the MMU before we supply more memory to the binner
+    - drm/amdgpu: Fix JPEG v4.0.3 register write
+    - ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios
+    - wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled
+    - selftests/bpf: netns_new() and netns_free() helpers.
+    - selftests/bpf: Fix backtrace printing for selftests crashes
+    - selftests/bpf: add missing header include for htons
+    - drm/vc4: hdmi: Increase audio MAI fifo dreq threshold
+    - drm/vc4: Introduce generation number enum
+    - drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load
+    - drm/vc4: Correct generation check in vc4_hvs_lut_load
+    - bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable
+    - drm/panfrost: Add missing OPP table refcnt decremental
+    - selftests: netfilter: Fix missing return values in conntrack_dump_flush
+    - Bluetooth: btintel: Do no pass vendor events to stack
+    - Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name()
+    - Bluetooth: ISO: Use kref to track lifetime of iso_conn
+    - Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending
+    - Bluetooth: hci_conn: Use __counted_by() to avoid -Wfamnae warning
+    - Bluetooth: hci_conn: Use struct_size() in hci_le_big_create_sync()
+    - Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending
+    - Bluetooth: ISO: Send BIG Create Sync via hci_sync
+    - Bluetooth: iso: Fix circular lock in iso_conn_big_sync
+    - net: txgbe: remove GPIO interrupt controller
+    - net: txgbe: fix null pointer to pcs
+    - RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages
+    - RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset
+    - iommu/amd: Remove amd_iommu_domain_update() from page table freeing
+    - iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB
+    - RDMA/hns: Fix flush cqe error when racing with destroy qp
+    - RDMA/hns: Modify debugfs name
+    - leds: max5970: Fix unreleased fwnode_handle in probe function
+    - kasan: move checks to do_strncpy_from_user
+    - kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL
+    - RDMA/hns: Fix different dgids mapping to the same dip_idx
+    - RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
+    - rust: kernel: add srctree-relative doclinks
+    - rust: kernel: fix THIS_MODULE header path in ThisModule doc comment
+    - i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin
+    - remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe()
+    - remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe()
+    - nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
+    - f2fs: clean up val{>>,<<}F2FS_BLKSIZE_BITS
+    - f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow
+    - vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data()
+    - exfat: fix file being changed by unaligned direct write
+    - bnxt_en: Set backplane link modes correctly for ethtool
+    - devres: Fix page faults when tracing devres from unloaded modules
+    - usb: gadget: uvc: wake pump everytime we update the free list
+    - drm/xe/ufence: Wake up waiters after setting ufence->signalled
+    - net_sched: sch_fq: don't follow the fast path if Tx is behind now
+    - ASoC: da7213: Populate max_register to regmap_config
+    - KVM: x86: switch hugepage recovery thread to vhost_task
+    - kvm: defer huge page recovery vhost task to later
+    - KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking
+    - KVM: arm64: Change kvm_handle_mmio_return() return polarity
+    - dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with
+      fallbacks
+    - xhci: Fix control transfer error on Etron xHCI host
+    - xhci: Combine two if statements for Etron xHCI host
+    - xhci: Don't perform Soft Retry for Etron xHCI host
+    - xhci: Don't issue Reset Device command to Etron xHCI host
+    - mtd: spi-nor: core: replace dummy buswidth from addr to data
+    - Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
+    - RISC-V: Scalar unaligned access emulated on hotplug CPUs
+    - serial: amba-pl011: Fix RX stall when DMA is used
+    - serial: amba-pl011: fix build regression
+    - i40e: Fix handling changed priv flags
+    - netdev-genl: Hold rcu_read_lock in napi_get
+    - usb: misc: ljca: set small runtime autosuspend delay
+    - usb: misc: ljca: move usb_autopm_put_interface() after wait for response
+    - blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs
+    - block: model freeze & enter queue as lock for supporting lockdep
+    - block: always verify unfreeze lock on the owner task
+    - x86/Documentation: Update algo in init_size description of boot protocol
+    - kbuild: deb-pkg: Don't fail if modules.order is missing
+    - tools/power turbostat: Fix trailing '\n' parsing
+    - block: don't verify IO lock for freeze/unfreeze in elevator_init_mq()
+    - zram: permit only one post-processing operation at a time
+    - perf jevents: Don't stop at the first matched pmu when searching a events
+      table
+    - docs: media: update location of the media patches
+    - Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of
+      setup_vmcs_config()"
+    - soc: fsl: cpm1: qmc: Fix blank line and spaces
+    - soc: fsl: cpm1: qmc: Re-order probe() operations
+    - soc: fsl: cpm1: qmc: Introduce qmc_init_resource() and its CPM1 version
+    - soc: fsl: cpm1: qmc: Introduce qmc_{init,exit}_xcc() and their CPM1 version
+    - soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure
+    - x86/mm: Carve out INVLPG inline asm for use by others
+    - ALSA: hda/realtek: Enable mic on Vaio VJFH52
+    - ALSA: hda/realtek: Enable speaker pins for Medion E15443 platform
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i
+    - usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing
+      logic
+    - sched: Initialize idle tasks only once
+    - Upstream stable to v6.6.64, v6.11.11, v6.12.1, v6.12.2, v6.12.3
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53222
+    - zram: fix NULL pointer in comp_algorithm_show()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53169
+    - nvme-fabrics: fix kernel crash while shutting down controller
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56721
+    - x86/CPU/AMD: Terminate the erratum_1386_microcode array
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53187
+    - io_uring: check for overflows in io_pin_pages
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53147
+    - exfat: fix out-of-bounds access of directory entries
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53196
+    - KVM: arm64: Don't retire aborted MMIO instruction
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56685
+    - ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53201
+    - drm/amd/display: Fix null check for pipe_ctx->plane_state in
+      dcn20_program_pipe
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53203
+    - usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53209
+    - bnxt_en: Fix receive ring space parameters when XDP is active
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56742
+    - vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53216
+    - nfsd: release svc_expkey/svc_export with rcu_work
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53219
+    - virtiofs: use pages instead of pointer for kernel direct IO
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53221
+    - f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53228
+    - riscv: kvm: Fix out-of-bounds array access
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53232
+    - iommu/s390: Implement blocking domain
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53236
+    - xsk: Free skb when TX metadata options are invalid
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56703
+    - ipv6: Fix soft lockups in fib6_select_path under high next hop churn
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56540
+    - accel/ivpu: Prevent recovery invocation during probe and resume
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53163
+    - crypto: qat/qat_420xx - fix off by one in uof_get_name()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56755
+    - netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56549
+    - cachefiles: Fix NULL pointer dereference in object->file
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56551
+    - drm/amdgpu: fix usage slab after free
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56776
+    - drm/sti: avoid potential dereference of error pointers
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56777
+    - drm/sti: avoid potential dereference of error pointers in
+      sti_gdp_atomic_check
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56778
+    - drm/sti: avoid potential dereference of error pointers in
+      sti_hqvdp_atomic_check
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56557
+    - iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56779
+    - nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56558
+    - nfsd: make sure exp active before svc_export_show
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56562
+    - i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56566
+    - mm/slub: Avoid list corruption when removing a slab from the full list
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-57838
+    - s390/entry: Mark IRQ entries to fix stack depot warnings
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56567
+    - ad7780: fix division by zero in ad7780_write_raw()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56569
+    - ftrace: Fix regression with module command in stack_trace_filter
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56570
+    - ovl: Filter invalid inodes with missing lookup function
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56572
+    - media: platform: allegro-dvt: Fix possible memory leak in
+      allocate_buffers_internal()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56573
+    - efi/libstub: Free correct pointer on failure
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56574
+    - media: ts2020: fix null-ptr-deref in ts2020_probe()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56575
+    - media: imx-jpeg: Ensure power suppliers be suspended before detach them
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56576
+    - media: i2c: tc358743: Fix crash in the probe error path when using polling
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56577
+    - media: mtk-jpeg: Fix null-ptr-deref during unload module
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56578
+    - media: imx-jpeg: Set video drvdata before register video device
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56579
+    - media: amphion: Set video drvdata before register video device
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56581
+    - btrfs: ref-verify: fix use-after-free after invalid ref action
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56774
+    - btrfs: add a sanity check for btrfs root in btrfs_search_slot()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56780
+    - quota: flush quota_release_work upon quota writeback
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53168
+    - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56688
+    - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56729
+    - smb: Initialize cfid->tcon before performing network ops
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56704
+    - 9p/xen: fix release of IRQ
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53171
+    - ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53172
+    - ubi: fastmap: Fix duplicate slab cache names while attaching
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56739
+    - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53173
+    - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53145
+    - um: Fix potential integer overflow during physmem setup
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53174
+    - SUNRPC: make sure cache entry active before cache_show
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53146
+    - NFSD: Prevent a potential integer overflow
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53175
+    - ipc: fix memleak if msg_init_ns failed in create_ipc_ns
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56692
+    - f2fs: fix to do sanity check on node blkaddr in truncate_node()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56698
+    - usb: dwc3: gadget: Fix looping of queued SG entries
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56687
+    - usb: musb: Fix hardware lockup on first Rx endpoint request
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53176
+    - smb: During unmount, ensure all cached dir instances drop their dentry
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53177
+    - smb: prevent use-after-free due to open_cached_dir error paths
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53178
+    - smb: Don't leak cfid when reconnect races with open_cached_dir
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53180
+    - ALSA: pcm: Add sanity NULL check for the default mmap fault handler
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56700
+    - media: wl128x: Fix atomicity violation in fmc_send_cmd()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2022-49034
+    - sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53181
+    - um: vector: Do not use drvdata in release
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53183
+    - um: net: Do not use drvdata in release
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53184
+    - um: ubd: Do not use drvdata in release
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53185
+    - smb: client: fix NULL ptr deref in crypto_aead_setkey()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53188
+    - wifi: ath12k: fix crash when unbinding
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53190
+    - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of
+      failures
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53191
+    - wifi: ath12k: fix warning when unbinding
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56741
+    - apparmor: test: Fix memory leak for aa_unpack_strdup()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53148
+    - comedi: Flush partial mappings in error case
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53194
+    - PCI: Fix use-after-free of slot->bus on hot remove
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53195
+    - KVM: arm64: Get rid of userspace_irqchip_in_use
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53197
+    - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox
+      devices
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-42122
+    - drm/amd/display: Add NULL pointer check for kzalloc
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-49906
+    - drm/amd/display: Check null pointer before try to access it
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53150
+    - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53198
+    - xen: Fix the issue of resource not being properly released in
+      xenbus_dev_probe()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-41014
+    - xfs: add bounds checking to xlog_recover_process_data
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53200
+    - drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53202
+    - firmware_loader: Fix possible resource leak in fw_log_firmware_info()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53208
+    - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53210
+    - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53213
+    - net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53214
+    - vfio/pci: Properly hide first-in-list PCIe extended capability
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53215
+    - svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53217
+    - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56689
+    - PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio'
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53151
+    - svcrdma: Address an integer overflow
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53218
+    - f2fs: fix race in concurrent f2fs_stop_gc_thread
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56744
+    - f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53220
+    - f2fs: fix to account dirty data in __get_secs_required()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56745
+    - PCI: Fix reset_method_store() memory leak
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53223
+    - clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53154
+    - clk: clk-apple-nco: Add NULL check in applnco_probe
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53224
+    - RDMA/mlx5: Move events notifier registration to be after device registration
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56746
+    - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53155
+    - ocfs2: fix uninitialized value in ocfs2_file_read_iter()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53226
+    - RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56747
+    - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56748
+    - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53229
+    - RDMA/rxe: Fix the qp flush warnings in req
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56722
+    - RDMA/hns: Fix cpu stuck caused by printings during reset
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53230
+    - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53231
+    - cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56701
+    - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56678
+    - powerpc/mm/fault: Fix kfence page fault reporting
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56677
+    - powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56723
+    - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56724
+    - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56691
+    - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53233
+    - unicode: Fix utf8_load() error path
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56694
+    - bpf: fix recursive lock when verdict program return SK_PASS
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53234
+    - erofs: handle NONHEAD !delta[1] lclusters gracefully
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53239
+    - ALSA: 6fire: Release resources at card release
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56531
+    - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56532
+    - ALSA: us122l: Use snd_card_free_when_closed() at disconnection
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56533
+    - ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56751
+    - ipv6: release nexthop on device removal
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56720
+    - bpf, sockmap: Several fixes to bpf_msg_pop_data
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56538
+    - drm: zynqmp_kms: Unplug DRM device before removal
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56752
+    - drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56725
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56707
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56726
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56727
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56728
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56679
+    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56539
+    - wifi: mwifiex: Fix memcpy() field-spanning write warning in
+      mwifiex_config_scan()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56543
+    - wifi: ath12k: Skip Rx TID cleanup for self peer
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56683
+    - drm/vc4: hdmi: Avoid hang with debug registers when suspended
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56545
+    - HID: hyperv: streamline driver probe to avoid devres issues
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56705
+    - media: atomisp: Add check for rgby_data memory allocation failure
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53157
+    - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53158
+    - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56546
+    - drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56681
+    - crypto: bcm - add error check in the ahash_hmac_init function
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53160
+    - rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56708
+    - EDAC/igen6: Avoid segmentation fault on module unload
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56690
+    - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return
+      -EBUSY
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53161
+    - EDAC/bluefield: Fix potential integer overflow
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53162
+    - crypto: qat/qat_4xxx - fix off by one in uof_get_name()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56754
+    - crypto: caam - Fix the pointer passed to caam_qi_shutdown()
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56548
+    - hfsplus: don't query the device logical block size multiple times
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56756
+    - nvme-pci: fix freeing of the HMB descriptor table
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-53142
+    - initramfs: avoid filename buffer overrun
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-56693
+    - brd: defer automatic disk creation until module initialization succeeds
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-44955
+    - drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute
+  * Noble update: upstream stable patchset 2025-03-11 (LP: #2101915) //
+    CVE-2024-49899
+    - drm/amd/display: Initialize denominators' default to 1
+  * Noble update: upstream stable patchset 2025-03-06 (LP: #2101042)
+    - sctp: fix possible UAF in sctp_v6_available()
+    - net: vertexcom: mse102x: Fix tx_bytes calculation
+    - drm/rockchip: vop: Fix a dereferenced before check warning
+    - mptcp: error out earlier on disconnect
+    - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
+    - net/mlx5: fs, lock FTE when checking if active
+    - net/mlx5e: kTLS, Fix incorrect page refcounting
+    - net/mlx5e: clear xdp features on non-uplink representors
+    - net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
+    - virtio/vsock: Fix accept_queue memory leak
+    - Bluetooth: btintel: Direct exception event to bluetooth stack
+    - net: sched: cls_u32: Fix u32's systematic failure to free IDR entries for
+      hnodes.
+    - samples: pktgen: correct dev to DEV
+    - net: stmmac: dwmac-mediatek: Fix inverted handling of mediatek,mac-wol
+    - net: Make copy_safe_from_sockptr() match documentation
+    - stmmac: dwmac-intel-plat: fix call balance of tx_clk handling routines
+    - net: ti: icssg-prueth: Fix 1 PPS sync
+    - bonding: add ns target multicast address to slave device
+    - ARM: 9419/1: mm: Fix kernel memory mapping for xip kernels
+    - x86/mm: Fix a kdump kernel failure on SME system when CONFIG_IMA_KEXEC=y
+    - mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
+    - ocfs2: uncache inode which has failed entering the group
+    - vdpa: solidrun: Fix UB bug with devres
+    - vdpa/mlx5: Fix PA offset with unaligned starting iotlb map
+    - vp_vdpa: fix id_table array not null terminated error
+    - ima: fix buffer overrun in ima_eventdigest_init_common
+    - KVM: nVMX: Treat vpid01 as current if L2 is active, but with VPID disabled
+    - KVM: x86: Unconditionally set irr_pending when updating APICv state
+    - KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind
+      CONFIG_BROKEN
+    - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
+    - nommu: pass NULL argument to vma_iter_prealloc()
+    - ALSA: hda/realtek - Fixed Clevo platform headset Mic issue
+    - ocfs2: fix UBSAN warning in ocfs2_verify_volume()
+    - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
+    - LoongArch: Fix early_numa_add_cpu() usage for FDT systems
+    - LoongArch: Disable KASAN if PGDIR_SIZE is too large for cpu_vabits
+    - LoongArch: Make KASAN work with 5-level page-tables
+    - Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
+    - mmc: sunxi-mmc: Fix A100 compatible description
+    - drm/bridge: tc358768: Fix DSI command tx
+    - pmdomain: imx93-blk-ctrl: correct remove path
+    - nouveau: fw: sync dma after setup is called.
+    - drm/amd: Fix initialization mistake for NBIO 7.7.0
+    - drm/amd/display: Adjust VSDB parser for replay feature
+    - lib/buildid: Fix build ID parsing logic
+    - media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
+    - mptcp: add userspace_pm_lookup_addr_by_id helper
+    - mptcp: update local address flags when setting it
+    - mptcp: hold pm lock when deleting entry
+    - mptcp: drop lookup_by_id in lookup_addr
+    - mptcp: pm: use _rcu variant under rcu_read_lock
+    - mm: avoid unsafe VMA hook invocation when error arises on mmap hook
+    - mm: unconditionally close VMAs on error
+    - mm: refactor map_deny_write_exec()
+    - mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling
+    - mm: resolve faulty mmap_region() error path behaviour
+    - net/mlx5: Fix msix vectors to respect platform limit
+    - vsock: Fix sk_error_queue memory leak
+    - virtio/vsock: Improve MSG_ZEROCOPY error handling
+    - net: phylink: ensure PHY momentary link-fails are handled
+    - drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle
+    - ARM: fix cacheflush with PAN
+    - drm/amd/display: Run idle optimizations at end of vblank handler
+    - drm/amd/display: Change some variable name of psr
+    - x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
+    - x86/stackprotector: Work around strict Clang TLS symbol requirements
+    - sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
+    - fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args()
+    - mm/mremap: fix address wraparound in move_page_tables()
+    - KVM: selftests: Disable strict aliasing
+    - mm: page_alloc: move mlocked flag clearance into free_pages_prepare()
+    - LoongArch: Add WriteCombine shadow mapping in KASAN
+    - drm/xe: handle flat ccs during hibernation on igpu
+    - pmdomain: arm: Use FLAG_DEV_NAME_FW to ensure unique names
+    - pmdomain: core: Add GENPD_FLAG_DEV_NAME_FW flag
+    - nouveau: handle EBUSY and EAGAIN for GSP aux errors.
+    - nouveau/dp: handle retries for AUX CH transfers with GSP.
+    - drm/amdgpu: fix check in gmc_v9_0_get_vm_pte()
+    - drm/amdgpu: Fix video caps for H264 and HEVC encode maximum size
+    - drm/amd/pm: print pp_dpm_mclk in ascending order on SMU v14.0.0
+    - drm/amd/display: Handle dml allocation failure to avoid crash
+    - drm/amd/display: Fix failure to read vram info due to static BP_RESULT
+    - drm/xe: Restore system memory GGTT mappings
+    - drm/xe: improve hibernation on igpu
+    - net: sched: u32: Add test case for systematic hnode IDR leaks
+    - Upstream stable to v6.6.63, v6.11.10
+  * Noble update: upstream stable patchset 2025-03-04 (LP: #2100894)
+    - 9p: v9fs_fid_find: also lookup by inode if not found dentry
+    - 9p: Avoid creating multiple slab caches with the same name
+    - selftests/bpf: Verify that sync_linked_regs preserves subreg_def
+    - irqchip/ocelot: Fix trigger register address
+    - nvme: tcp: avoid race between queue_lock lock and destroy
+    - block: Fix elevator_get_default() checking for NULL q->tag_set
+    - HID: multitouch: Add support for B2402FVA track point
+    - HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
+    - iommu/arm-smmu: Clarify MMU-500 CPRE workaround
+    - nvme: disable CC.CRIME (NVME_CC_CRIME)
+    - bpf: use kvzmalloc to allocate BPF verifier environment
+    - crypto: api - Fix liveliness check in crypto_alg_tested
+    - crypto: marvell/cesa - Disable hash algorithms
+    - sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
+    - drm/vmwgfx: Limit display layout ioctl array size to
+      VMWGFX_NUM_DISPLAY_UNITS
+    - RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES
+    - nvme-multipath: defer partition scanning
+    - drm/amdkfd: Accounting pdd vram_usage for svm
+    - powerpc/powernv: Free name on error in opal_event_init()
+    - net: phy: mdio-bcm-unimac: Add BCM6846 support
+    - nvme-loop: flush off pending I/O while shutting down loop controller
+    - smb: client: Fix use-after-free of network namespace.
+    - nvme/host: Fix RCU list traversal to use SRCU primitive
+    - vDPA/ifcvf: Fix pci_read_config_byte() return code handling
+    - bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx
+    - bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6
+    - ASoC: amd: yc: Add quirk for ASUS Vivobook S15 M3502RA
+    - ASoC: amd: yc: Fix non-functional mic on ASUS E1404FA
+    - fs: Fix uninitialized value issue in from_kuid and from_kgid
+    - HID: multitouch: Add quirk for Logitech Bolt receiver w/ Casa touchpad
+    - HID: lenovo: Add support for Thinkpad X1 Tablet Gen 3 keyboard
+    - RISCV: KVM: use raw_spinlock for critical section in imsic
+    - ASoC: rt722-sdca: increase clk_stop_timeout to fix clock stop issue
+    - LoongArch: Use "Exception return address" to comment ERA
+    - ASoC: fsl_micfil: Add sample rate constraint
+    - net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
+    - bpf: Check validity of link->type in bpf_link_show_fdinfo()
+    - mm: support order-1 folios in the page cache
+    - mm: always initialise folio->_deferred_list
+    - mm: refactor folio_undo_large_rmappable()
+    - mm/thp: fix deferred split unqueue naming and locking
+    - 9p: fix slab cache name creation for real
+    - nvmet-passthru: clear EUID/NGUID/UUID while using loop target
+    - pinctrl: intel: platform: Add Panther Lake to the list of supported
+    - s390/ap: Fix CCA crypto card behavior within protected execution environment
+    - selftests/bpf: Assert link info uprobe_multi count & path_size if unset
+    - ALSA: hda/tas2781: Add new quirk for Lenovo, ASUS, Dell projects
+    - drm/xe/query: Increase timestamp width
+    - nvme: make keep-alive synchronous operation
+    - samples/landlock: Fix port parsing in sandboxer
+    - ASoC: Intel: avs: Update stream status in a separate thread
+    - ASoC: codecs: Fix error handling in aw_dev_get_dsp_status function
+    - netfs: Downgrade i_rwsem for a buffered write
+    - afs: Fix lock recursion
+    - HID: i2c-hid: Delayed i2c resume wakeup for 0x0d42 Goodix touchpad
+    - LoongArch: KVM: Mark hrtimer to expire in hard interrupt context
+    - drm/xe: Don't restart parallel queues multiple times on GT reset
+    - Upstream stable to v6.6.62, v6.11.9
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292)
+    - arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610
+    - arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-
+      excavator
+    - arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
+    - arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node
+    - arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes
+    - arm64: dts: rockchip: fix i2c2 pinctrl-names property on anbernic-rg353p/v
+    - arm64: dts: rockchip: Fix bluetooth properties on rk3566 box demo
+    - arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
+    - arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus
+    - arm64: dts: rockchip: Remove undocumented supports-emmc property
+    - arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
+    - arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc
+    - arm64: dts: rockchip: remove num-slots property from rk3328-nanopi-r2s-plus
+    - arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs
+    - arm64: dts: imx8mp: correct sdhc ipg clk
+    - arm64: dts: rockchip: remove orphaned pinctrl-names from pinephone pro
+    - ARM: dts: rockchip: fix rk3036 acodec node
+    - ARM: dts: rockchip: drop grf reference from rk3036 hdmi
+    - ARM: dts: rockchip: Fix the spi controller on rk3036
+    - ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
+    - arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes
+    - sunrpc: handle -ENOTCONN in xs_tcp_setup_socket()
+    - NFSv3: only use NFS timeout for MOUNT when protocols are compatible
+    - nfs: avoid i_lock contention in nfs_clear_invalid_mapping
+    - net: enetc: set MAC address to the VF net_device
+    - dt-bindings: net: xlnx,axi-ethernet: Correct phy-mode property value
+    - can: c_can: fix {rx,tx}_errors statistics
+    - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation
+      fails
+    - ice: change q_index variable type to s16 to store -1 value
+    - e1000e: Remove Meteor Lake SMBUS workarounds
+    - net: phy: ti: add PHY_RST_AFTER_CLK_EN flag
+    - net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case
+    - netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
+    - netfilter: nf_tables: wait for rcu grace period on net_device removal
+    - netfilter: nf_tables: do not defer rule destruction via call_rcu
+    - net: arc: rockchip: fix emac mdio node support
+    - drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path
+    - Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
+    - media: stb0899_algo: initialize cfr before using it
+    - media: dvb_frontend: don't play tricks with underflow values
+    - media: adv7604: prevent underflow condition when reporting colorspace
+    - scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer
+    - ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
+    - tools/lib/thermal: Fix sampling handler context ptr
+    - thermal/of: support thermal zones w/o trips subnode
+    - ASoC: SOF: sof-client-probes-ipc4: Set param_size extension bits
+    - media: pulse8-cec: fix data timestamp at pulse8_setup()
+    - media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl()
+    - can: m_can: m_can_close(): don't call free_irq() for IRQ-less devices
+    - can: mcp251xfd: mcp251xfd_get_tef_len(): fix length calculation
+    - can: mcp251xfd: mcp251xfd_ring_alloc(): fix coalescing configuration when
+      switching CAN modes
+    - ksmbd: count all requests in req_running counter
+    - ksmbd: fix broken transfers when exceeding max simultaneous operations
+    - pwm: imx-tpm: Use correct MODULO value for EPWM mode
+    - rpmsg: glink: Handle rejected intent request better
+    - drm/amdgpu: Adjust debugfs eviction and IB access permissions
+    - drm/amdgpu: Adjust debugfs register access permissions
+    - drm/amdgpu: Fix DPX valid mode check on GC 9.4.3
+    - thermal/drivers/qcom/lmh: Remove false lockdep backtrace
+    - dm cache: correct the number of origin blocks to match the target length
+    - dm cache: optimize dirty bit checking with find_next_bit when resizing
+    - dm-unstriped: cast an operand to sector_t to prevent potential uint32_t
+      overflow
+    - ALSA: usb-audio: Add quirk for HP 320 FHD Webcam
+    - net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc()
+    - mptcp: use sock_kfree_s instead of kfree
+    - arm64: Kconfig: Make SME depend on BROKEN for now
+    - [Config] updateconfigs for ARM64_SME
+    - arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint
+    - Revert "wifi: mac80211: fix RCU list iterations"
+    - i2c: designware: do not hold SCL low when I2C_DYNAMIC_TAR_UPDATE is not set
+    - fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
+    - usb: dwc3: fix fault at system suspend if device was already runtime
+      suspended
+    - USB: serial: qcserial: add support for Sierra Wireless EM86xx
+    - USB: serial: option: add Fibocom FG132 0x0112 composition
+    - USB: serial: option: add Quectel RG650V
+    - irqchip/gic-v3: Force propagation of the active state with a read-back
+    - ucounts: fix counter leak in inc_rlimit_get_ucounts()
+    - ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022
+    - arm64: dts: rockchip: Designate Turing RK1's system power controller
+    - EDAC/qcom: Make irq configuration optional
+    - arm64: dts: rockchip: Drop regulator-init-microvolt from two boards
+    - net: dpaa_eth: print FD status in CPU endianness in dpaa_eth_fd tracepoint
+    - virtio_net: Sync rss config to device when virtnet_probe
+    - drm/xe: Set mask bits for CCS_MODE register
+    - drm/amd/display: Fix brightness level not retained over reboot
+    - drm/imagination: Add a per-file PVR context list
+    - mptcp: no admin perm to list endpoints
+    - btrfs: fix the length of reserved qgroup to free
+    - btrfs: fix per-subvolume RO/RW flags with new mount API
+    - clk: qcom: gcc-x1e80100: Fix USB MP SS1 PHY GDSC pwrsts flags
+    - clk: qcom: clk-alpha-pll: Fix pll post div mask when width is not set
+    - objpool: fix to make percpu slot allocation more robust
+    - mm/damon/core: handle zero {aggregation,ops_update} intervals
+    - mm/damon/core: handle zero schemes apply interval
+    - mm/mlock: set the correct prev on failure
+    - clk: qcom: gcc-x1e80100: Fix halt_check for pipediv2 clocks
+    - staging: vchiq_arm: Get the rid off struct vchiq_2835_state
+    - staging: vchiq_arm: Use devm_kzalloc() for vchiq_arm_state allocation
+    - drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
+    - drm/xe: Move LNL scheduling WA to xe_device.h
+    - drm/xe/ufence: Flush xe ordered_wq in case of ufence timeout
+    - drm/xe/guc/tlb: Flush g2h worker in case of tlb timeout
+    - xtensa: Emulate one-byte cmpxchg
+    - Upstream stable to v6.6.61, v6.11.8
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50270
+    - mm/damon/core: avoid overflow in damon_feed_loop_next_input()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50274
+    - idpf: avoid vport access in idpf_get_link_ksettings
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53067
+    - scsi: ufs: core: Start the RTC update work later
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53084
+    - drm/imagination: Break an object reference loop
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53085
+    - tpm: Lock TPM chip in tpm_pm_suspend() first
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53086
+    - drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53087
+    - drm/xe: Fix possible exec queue leak in exec IOCTL
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50288
+    - media: vivid: fix buffer overwrite when using > 32 buffers
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50289
+    - media: av7110: fix a spectre vulnerability
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53062
+    - media: mgb4: protect driver against spectre
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50291
+    - media: dvb-core: add missing buffer index check
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50297
+    - net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50267
+    - USB: serial: io_edgeport: fix use after free in debug printk
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50268
+    - usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53083
+    - usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50269
+    - usb: musb: sunxi: Fix accessing an released usb phy
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50271
+    - signal: restore the override_rlimit logic
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50272
+    - filemap: Fix bounds checking in filemap_read()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50273
+    - btrfs: reinitialize delayed ref list after deleting it from the list
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50275
+    - arm64/sve: Discard stale CPU state when handling SVE traps
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50276
+    - net: vertexcom: mse102x: Fix possible double free of TX skb
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53066
+    - nfs: Fix KMSAN warning in decode_getfattr_attrs()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50278
+    - dm cache: fix potential out-of-bounds access on the first resume
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50279
+    - dm cache: fix out-of-bounds access to the dirty bitset when resizing
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50280
+    - dm cache: fix flushing uninitialized delayed_work on cache_ctr error
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53060
+    - drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50282
+    - drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50283
+    - ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50284
+    - ksmbd: Fix the missing xa_store error check
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50285
+    - ksmbd: check outstanding simultaneous SMB operations
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50286
+    - ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50287
+    - media: v4l2-tpg: prevent the risk of a division by zero
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50290
+    - media: cx24116: prevent overflows on SNR calculus
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53061
+    - media: s5p-jpeg: prevent buffer overflows
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53081
+    - media: ar0521: don't overflow when checking PLL values
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50292
+    - ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50294
+    - rxrpc: Fix missing locking causing hanging calls
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50295
+    - net: arc: fix the device for dma_map_single/dma_unmap_single
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53082
+    - virtio_net: Add hash_key_length check
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50296
+    - net: hns3: fix kernel crash when uninstalling driver
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53088
+    - i40e: fix race condition by adding filter's intermediate sync state
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50298
+    - net: enetc: allocate vf_state during PF probes
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50299
+    - sctp: properly validate chunk size in sctp_sf_ootb()
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50300
+    - regulator: rtq2208: Fix uninitialized use of regulator_config
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-50301
+    - security/keys: fix slab-out-of-bounds in key_task_permission
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53072
+    - platform/x86/amd/pmc: Detect when STB is not available
+  * Noble update: upstream stable patchset 2025-02-27 (LP: #2100292) //
+    CVE-2024-53068
+    - firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996)
+    - Input: xpad - sort xpad_device by vendor and product ID
+    - Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller
+    - cgroup: Fix potential overflow issue when checking max_depth
+    - spi: geni-qcom: Fix boot warning related to pm_runtime and devres
+    - wifi: iwlegacy: Fix "field-spanning write" warning in il_enqueue_hcmd()
+    - mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING
+    - wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
+    - wifi: ath11k: Fix invalid ring usage in full monitor mode
+    - wifi: brcm80211: BRCM_TRACING should depend on TRACING
+    - RDMA/cxgb4: Dump vendor specific QP details
+    - RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down
+    - RDMA/bnxt_re: Fix the usage of control path spin locks
+    - RDMA/bnxt_re: synchronize the qp-handle table array
+    - RDMA/bnxt_re: Fix the locking while accessing the QP table
+    - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
+    - wifi: iwlwifi: mvm: don't add default link in fw restart flow
+    - ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
+    - net: stmmac: dwmac4: Fix high address display by updating reg_space[] from
+      register values
+    - net: stmmac: fix TSO DMA API usage causing oops
+    - gtp: allow -1 to be specified as file description from userspace
+    - bpf: Force checkpoint when jmp history is too long
+    - net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
+    - net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets
+    - mlxsw: spectrum_ptp: Add missing verification before pushing Tx header
+    - bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled
+    - iomap: improve shared block detection in iomap_unshare_iter
+    - iomap: don't bother unsharing delalloc extents
+    - iomap: share iomap_unshare_iter predicate code with fsdax
+    - fsdax: remove zeroing code from dax_unshare_iter
+    - iomap: turn iomap_want_unshare_iter into an inline function
+    - kasan: Fix Software Tag-Based KASAN with GCC
+    - firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
+    - afs: Fix missing subdir edit when renamed between parent dirs
+    - smb: client: set correct device number on nfs reparse points
+    - cxl/events: Fix Trace DRAM Event Record
+    - fs/ntfs3: Fix warning possible deadlock in ntfs_set_state
+    - fs/ntfs3: Stale inode instead of bad
+    - scsi: scsi_transport_fc: Allow setting rport state to current state
+    - cifs: Fix creating native symlinks pointing to current or parent directory
+    - thermal: intel: int340x: processor: Remove MMIO RAPL CPU hotplug support
+    - thermal: intel: int340x: processor: Add MMIO RAPL PL4 support
+    - net: amd: mvme147: Fix probe banner message
+    - NFS: remove revoked delegation from server's delegation list
+    - misc: sgi-gru: Don't disable preemption in GRU driver
+    - usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler
+    - usb: gadget: dummy_hcd: Set transfer interval to 1 microframe
+    - usb: gadget: dummy_hcd: execute hrtimer callback in softirq context
+    - USB: gadget: dummy-hcd: Fix "task hung" problem
+    - ALSA: usb-audio: Add quirks for Dell WD19 dock
+    - usbip: tools: Fix detach_port() invalid port error path
+    - usb: phy: Fix API devm_usb_put_phy() can not release the phy
+    - usb: typec: fix unreleased fwnode_handle in typec_port_register_altmodes()
+    - usb: typec: qcom-pmic-typec: use fwnode_handle_put() to release fwnodes
+    - xhci: Fix Link TRB DMA in command ring stopped completion event
+    - xhci: Use pm_runtime_get to prevent RPM on unsupported systems
+    - Revert "driver core: Fix uevent_show() vs driver detach race"
+    - iio: light: veml6030: fix microlux value calculation
+    - RISC-V: ACPI: fix early_ioremap to early_memremap
+    - tools/mm: -Werror fixes in page-types/slabinfo
+    - tools/mm: fix compile error
+    - thunderbolt: Honor TMU requirements in the domain when setting TMU mode
+    - mmc: sdhci-pci-gli: GL9767: Fix low power mode on the set clock function
+    - mmc: sdhci-pci-gli: GL9767: Fix low power mode in the SD Express process
+    - block: fix sanity checks in blk_rq_map_user_bvec
+    - cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
+    - phy: freescale: imx8m-pcie: Do CMN_RST just before PHY PLL lock check
+    - riscv: vdso: Prevent the compiler from inserting calls to memset()
+    - Input: edt-ft5x06 - fix regmap leak when probe fails
+    - ALSA: hda/realtek: Limit internal Mic boost on Dell platform
+    - riscv: efi: Set NX compat flag in PE/COFF header
+    - riscv: Use '%u' to format the output of 'cpu'
+    - riscv: Remove unused GENERATING_ASM_OFFSETS
+    - riscv: Remove duplicated GET_RM
+    - cxl/port: Fix cxl_bus_rescan() vs bus_rescan_devices()
+    - cxl/acpi: Ensure ports ready at cxl_acpi_probe() return
+    - mei: use kvmalloc for read buffer
+    - mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves
+    - x86/traps: Enable UBSAN traps on x86
+    - x86/traps: move kmsan check after instrumentation_begin
+    - kasan: remove vmalloc_percpu test
+    - vmscan,migrate: fix page count imbalance on node stats when demoting pages
+    - io_uring: always lock __io_cqring_overflow_flush
+    - mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw()
+    - mm: don't install PMD mappings when THPs are disabled by the hw/process/vma
+    - perf trace: Fix non-listed archs in the syscalltbl routines
+    - dpll: add Embedded SYNC feature for a pin
+    - ice: add callbacks for Embedded SYNC enablement on dpll pins
+    - bpf: Add bpf_mem_alloc_check_size() helper
+    - net: ethernet: mtk_wed: fix path of MT7988 WO firmware
+    - drm/mediatek: ovl: Remove the color format comment for ovl_fmt_convert()
+    - drm/mediatek: Fix get efuse issue for MT8188 DPTX
+    - ACPI: resource: Fold Asus Vivobook Pro N6506M* DMI quirks together
+    - powercap: intel_rapl_msr: Add PL4 support for Arrowlake-U
+    - usb: typec: qcom-pmic-typec: fix missing fwnode removal in error path
+    - mm: shrinker: avoid memleak in alloc_shrinker_info
+    - firmware: microchip: auto-update: fix poll_complete() to not report spurious
+      timeout errors
+    - soc: qcom: pmic_glink: Handle GLINK intent allocation rejections
+    - cxl/port: Fix CXL port initialization order when the subsystem is built-in
+    - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io()
+    - posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone
+    - mm/ksm: remove redundant code in ksm_fork
+    - nvme: re-fix error-handling for io_uring nvme-passthrough
+    - btrfs: fix extent map merging not happening for adjacent extents
+    - btrfs: fix defrag not merging contiguous extents due to merged extent maps
+    - mm, mmap: limit THP alignment of anonymous mappings to PMD-aligned sizes
+    - mm: multi-gen LRU: ignore non-leaf pmd_young for force_scan=true
+    - mm: multi-gen LRU: remove MM_LEAF_OLD and MM_NONLEAF_TOTAL stats
+    - mm: shrink skip folio mapped by an exiting process
+    - mm: multi-gen LRU: use {ptep,pmdp}_clear_young_notify()
+    - drm/i915: Skip programming FIA link enable bits for MTL+
+    - drm/i915/display: WA for Re-initialize dispcnlunitt1 xosc clock
+    - drm/i915/dp: Clear VSC SDP during post ddi disable routine
+    - drm/i915/pps: Disable DPLS_GATING around pps sequence
+    - drm/i915: move rawclk from runtime to display runtime info
+    - drm/xe/display: drop unused rawclk_freq and RUNTIME_INFO()
+    - drm/xe: Support 'nomodeset' kernel command-line option
+    - drm/xe/xe2hpg: Introduce performance tuning changes for Xe2_HPG
+    - drm/amdgpu/swsmu: fix ordering for setting workload_mask
+    - drm/amdgpu/swsmu: default to fullscreen 3D profile for dGPUs
+    - drm/amdgpu: handle default profile on on devices without fullscreen 3D
+    - MIPS: export __cmpxchg_small()
+    - rcu/kvfree: Add kvfree_rcu_barrier() API
+    - rcu/kvfree: Refactor kvfree_rcu_queue_batch()
+    - Upstream stable to v6.6.60, v6.11.7
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53050
+    - drm/i915/hdcp: Add encoder check in hdcp2_get_capability
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53051
+    - drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50303
+    - resource,kexec: walk_system_ram_res_rev must retain resource flags
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50263
+    - fork: only invoke khugepaged, ksm hooks if no error
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50220
+    - fork: do not invoke uffd on fork if error occurs
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50221
+    - drm/amd/pm: Vangogh: Fix kernel memory out of bounds write
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53053
+    - scsi: ufs: core: Fix another deadlock during RTC update
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50225
+    - btrfs: fix error propagation of split bios
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50230
+    - nilfs2: fix kernel bug due to missing clearing of checked flag
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50238
+    - phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53044
+    - net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50304
+    - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53048
+    - ice: fix crash on probe for DPLL enabled E810 LOM
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53045
+    - ASoC: dapm: fix bounds checker error in dapm_widget_list_create
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53055
+    - wifi: iwlwifi: mvm: fix 6 GHz scan construction
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53046
+    - arm64: dts: imx8ulp: correct the flexspi compatible string
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53052
+    - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50215
+    - nvmet-auth: assign dh_key to NULL after kfree_sensitive
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50216
+    - xfs: fix finding a last resort AG in xfs_filestream_pick_ag
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53043
+    - mctp i2c: handle NULL header address
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50218
+    - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53047
+    - mptcp: init: protect sched with rcu_read_lock
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50222
+    - iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50223
+    - sched/numa: Fix the potential null pointer dereference in task_numa_work()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50224
+    - spi: spi-fsl-dspi: Fix crash when not using GPIO chip select
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50226
+    - cxl/port: Fix use-after-free, permit out-of-order decoder shutdown
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50231
+    - iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53076
+    - iio: gts-helper: Fix memory leaks for the error path of
+      iio_gts_build_avail_scale_table()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50232
+    - iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50234
+    - wifi: iwlegacy: Clear stale interrupts before resuming device
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50235
+    - wifi: cfg80211: clear wdev->cqm_config pointer on free
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50236
+    - wifi: ath10k: Fix memory leak in management tx
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50237
+    - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50239
+    - phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50240
+    - phy: qcom: qmp-usb: fix NULL-deref on runtime suspend
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50242
+    - fs/ntfs3: Additional check in ntfs_file_release
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50243
+    - fs/ntfs3: Fix general protection fault in run_is_mapped_full
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50244
+    - fs/ntfs3: Additional check in ni_clear()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50245
+    - fs/ntfs3: Fix possible deadlock in mi_read
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50246
+    - fs/ntfs3: Add rough attr alloc_size check
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50247
+    - fs/ntfs3: Check if more than chunk-size bytes are written
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50250
+    - fsdax: dax_unshare_iter needs to copy entire blocks
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50251
+    - netfilter: nft_payload: sanitize offset and length before calling
+      skb_checksum()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50252
+    - mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50255
+    - Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50257
+    - netfilter: Fix use-after-free in get_info()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50258
+    - net: fix crash when config small gso_max_size/gso_ipv4_max_size
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50262
+    - bpf: Fix out-of-bounds write in trie_get_next_key()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50259
+    - netdevsim: Add trailing zero to terminate the string in
+      nsim_nexthop_bucket_activity_write()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53042
+    - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53058
+    - net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-50261
+    - macsec: Fix use-after-free while sending the offloading packet
+  * Noble update: upstream stable patchset 2025-02-25 (LP: #2099996) //
+    CVE-2024-53059
+    - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
+  * Noble update: upstream stable patchset 2025-02-07 (LP: #2097575)
+    - irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1
+    - xfs: fix error returns from xfs_bmapi_write
+    - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions
+    - xfs: remove a racy if_bytes check in xfs_reflink_end_cow_extent
+    - xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item
+      recovery
+    - xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2
+    - xfs: fix missing check for invalid attr flags
+    - xfs: check shortform attr entry flags specifically
+    - xfs: validate recovered name buffers when recovering xattr items
+    - xfs: enforce one namespace per attribute
+    - xfs: revert commit 44af6c7e59b12
+    - xfs: use dontcache for grabbing inodes during scrub
+    - xfs: match lock mode in xfs_buffered_write_iomap_begin()
+    - xfs: make the seq argument to xfs_bmapi_convert_delalloc() optional
+    - xfs: make xfs_bmapi_convert_delalloc() to allocate the target offset
+    - xfs: convert delayed extents to unwritten when zeroing post eof blocks
+    - xfs: allow symlinks with short remote targets
+    - xfs: make sure sb_fdblocks is non-negative
+    - xfs: fix unlink vs cluster buffer instantiation race
+    - xfs: fix freeing speculative preallocations for preallocated files
+    - xfs: allow unlinked symlinks and dirs with zero size
+    - xfs: restrict when we try to align cow fork delalloc to cowextsz hints
+    - selftests: mptcp: join: change capture/checksum as bool
+    - selftests: mptcp: join: test for prohibited MPC to port-based endp
+    - selftests: mptcp: remove duplicated variables
+    - iio: accel: bma400: Fix uninitialized variable field_value in tap event
+      handling.
+    - bpf: Make sure internal and UAPI bpf_redirect flags don't overlap
+    - bpf: devmap: provide rxq after redirect
+    - cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory systems
+    - lib/Kconfig.debug: fix grammar in RUST_BUILD_ASSERT_ALLOW
+    - bpf: Fix memory leak in bpf_core_apply
+    - RDMA/bnxt_re: Fix a possible memory leak
+    - RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
+    - RDMA/bnxt_re: Add a check for memory allocation
+    - x86/resctrl: Avoid overflow in MB settings in bw_validate()
+    - ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
+    - bpf: Add cookie to perf_event bpf_link_info records
+    - bpf: fix unpopulated name_len field in perf_event link info
+    - selftests/bpf: Add cookies check for perf_event fill_link_info test
+    - selftests/bpf: fix perf_event link info name_len assertion
+    - s390/pci: Handle PCI error codes other than 0x3a
+    - bpf: fix kfunc btf caching for modules
+    - iio: frequency: {admv4420,adrf6780}: format Kconfig entries
+    - iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig
+    - drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check
+    - selftests/bpf: Fix cross-compiling urandom_read
+    - task_work: Add TWA_NMI_CURRENT as an additional notify mode.
+    - sched/core: Disable page allocation in task_tick_mm_cid()
+    - ALSA: hda/cs8409: Fix possible NULL dereference
+    - firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
+    - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
+    - RDMA/irdma: Fix misspelling of "accept*"
+    - RDMA/srpt: Make slab cache names unique
+    - ipv4: give an IPv4 dev to blackhole_netdev
+    - RDMA/bnxt_re: Fix the max CQ WQEs for older adapters
+    - RDMA/bnxt_re: Fix out of bound check
+    - RDMA/bnxt_re: Return more meaningful error
+    - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
+    - RDMA/bnxt_re: Fix the GID table length
+    - accel/qaic: Fix the for loop used to walk SG table
+    - drm/msm/dpu: make sure phys resources are properly initialized
+    - drm/msm/dpu: check for overflow in _dpu_crtc_setup_lm_bounds()
+    - drm/msm/dsi: improve/fix dsc pclk calculation
+    - drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
+    - drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()
+    - drm/msm: Allocate memory for disp snapshot with kvzalloc()
+    - firmware: arm_scmi: Queue in scmi layer for mailbox implementation
+    - net/smc: Fix memory leak when using percpu refs
+    - net: usb: usbnet: fix race in probe failure
+    - net: stmmac: dwmac-tegra: Fix link bring-up sequence
+    - octeontx2-af: Fix potential integer overflows on integer shifts
+    - drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring
+    - macsec: don't increment counters for an unrelated SA
+    - netdevsim: use cond_resched() in nsim_dev_trap_report_work()
+    - net: ethernet: aeroflex: fix potential memory leak in
+      greth_start_xmit_gbit()
+    - net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
+    - net: xilinx: axienet: fix potential memory leak in axienet_start_xmit()
+    - bpf: Fix truncation bug in coerce_reg_to_size_sx()
+    - irqchip/renesas-rzg2l: Fix missing put_device
+    - drm/msm/dpu: don't always program merge_3d block
+    - net: bcmasp: fix potential memory leak in bcmasp_xmit()
+    - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
+    - net: dsa: mv88e6xxx: Fix the max_vid definition for the MV88E6361
+    - genetlink: hold RCU in genlmsg_mcast()
+    - ravb: Remove setting of RX software timestamp
+    - net: ravb: Only advertise Rx/Tx timestamps if hardware supports it
+    - scsi: target: core: Fix null-ptr-deref in target_alloc_device()
+    - smb: client: fix possible double free in smb2_set_ea()
+    - smb: client: fix OOBs when building SMB2_IOCTL request
+    - usb: typec: altmode should keep reference to parent
+    - s390: Initialize psw mask in perf_arch_fetch_caller_regs()
+    - bpf: Fix link info netfilter flags to populate defrag flag
+    - vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame
+    - net/mlx5: Check for invalid vector index on EQ creation
+    - net/mlx5: Fix command bitmask initialization
+    - net/mlx5: Unregister notifier on eswitch init failure
+    - bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock
+    - vsock: Update rx_bytes on read_skb()
+    - vsock: Update msg_count on read_skb()
+    - bpf, vsock: Drop static vsock_bpf_prot initialization
+    - riscv, bpf: Make BPF_CMPXCHG fully ordered
+    - nvme-pci: fix race condition between reset and nvme_dev_disable()
+    - bpf: Fix iter/task tid filtering
+    - cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed()
+    - khugepaged: inline hpage_collapse_alloc_folio()
+    - khugepaged: convert alloc_charge_hpage to alloc_charge_folio
+    - khugepaged: remove hpage from collapse_file()
+    - mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace
+      point
+    - iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - xhci: dbgtty: remove kfifo_out() wrapper
+    - xhci: dbgtty: use kfifo from tty_port struct
+    - xhci: dbc: honor usb transfer size boundaries.
+    - usb: gadget: f_uac2: fix non-newline-terminated function name
+    - usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store
+    - XHCI: Separate PORT and CAPs macros into dedicated file
+    - usb: dwc3: core: Fix system suspend on TI AM62 platforms
+    - tracing/fprobe-event: cleanup: Fix a wrong comment in fprobe event
+    - tracing/probes: cleanup: Set trace_probe::nr_args at trace_probe_init
+    - tracing/probes: Support $argN in return probe (kprobe and fprobe)
+    - uprobes: encapsulate preparation of uprobe args buffer
+    - uprobes: prepare uprobe args buffer lazily
+    - uprobes: prevent mutex_lock() under rcu_read_lock()
+    - uprobe: avoid out-of-bounds memory access of fetching args
+    - exec: don't WARN for racy path_noexec check
+    - ASoC: amd: yc: Add quirk for HP Dragonfly pro one
+    - ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to
+      default regs values
+    - ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit
+    - arm64: Force position-independent veneers
+    - udf: refactor udf_current_aext() to handle error
+    - udf: refactor udf_next_aext() to handle error
+    - udf: refactor inode_bmap() to handle error
+    - udf: fix uninit-value use in udf_get_fileshortad
+    - ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string
+    - cifs: Validate content of NFS reparse point buffer
+    - platform/x86: dell-sysman: add support for alienware products
+    - LoongArch: Don't crash in stack_top() for tasks without vDSO
+    - jfs: Fix sanity check in dbMount
+    - tracing/probes: Fix MAX_TRACE_ARGS limit handling
+    - tracing: Consider the NULL character when validating the event length
+    - xfrm: extract dst lookup parameters into a struct
+    - xfrm: respect ip protocols rules criteria when performing dst lookups
+    - netfilter: bpf: must hold reference on net namespace
+    - net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
+    - net: plip: fix break; causing plip to never transmit
+    - octeon_ep: Implement helper for iterating packets in Rx queue
+    - octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()
+    - net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x
+    - fsl/fman: Save device references taken in mac_probe()
+    - fsl/fman: Fix refcount handling of fman-related devices
+    - netfilter: xtables: fix typo causing some targets not to load on IPv6
+    - net: wwan: fix global oob in wwan_rtnl_policy
+    - net/sched: adjust device watchdog timer to detect stopped queue at right
+      time
+    - net: fix races in netdev_tx_sent_queue()/dev_watchdog()
+    - net: usb: usbnet: fix name regression
+    - bpf: Add MEM_WRITE attribute
+    - bpf: Fix overloading of MEM_UNINIT's meaning
+    - bpf: Remove MEM_UNINIT from skb/xdp MTU helpers
+    - net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions
+      created by classifiers
+    - net: sched: fix use-after-free in taprio_change()
+    - net: sched: use RCU read-side critical section in taprio_dump()
+    - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
+    - Bluetooth: SCO: Fix UAF on sco_sock_timeout
+    - Bluetooth: ISO: Fix UAF on iso_sock_timeout
+    - bpf,perf: Fix perf_event_detach_bpf_prog error handling
+    - net: dsa: mv88e6xxx: group cycle counter coefficients
+    - net: dsa: mv88e6xxx: read cycle counter period from hardware
+    - net: dsa: mv88e6xxx: support 4000ps cycle counter period
+    - ASoC: dt-bindings: davinci-mcasp: Fix interrupts property
+    - ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties
+    - ASoC: loongson: Fix component check failed on FDT systems
+    - ASoC: max98388: Fix missing increment of variable slot_found
+    - ASoC: rsnd: Fix probe failure on HiHope boards due to endpoint parsing
+    - ASoC: fsl_micfil: Add a flag to distinguish with different volume control
+      types
+    - ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
+    - powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request()
+    - nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
+    - ALSA: hda/realtek: Update default depop procedure
+    - smb: client: Handle kstrdup failures for passwords
+    - cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception
+    - btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item()
+    - btrfs: zoned: fix zone unusable accounting for freed reserved extent
+    - ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
+    - ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context
+    - ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid
+      detection issue
+    - nilfs2: fix kernel bug due to missing clearing of buffer delay flag
+    - openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
+    - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
+    - KVM: arm64: Fix shift-out-of-bounds bug
+    - KVM: arm64: Don't eagerly teardown the vgic on init error
+    - x86/lam: Disable ADDRESS_MASKING in most cases
+    - [Config] disable ADDRESS_MASKING
+    - ALSA: hda/tas2781: select CRC32 instead of CRC32_SARWATE
+    - ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
+    - LoongArch: Get correct cores_per_package for SMT systems
+    - LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context
+    - LoongArch: Make KASAN usable for variable cpu_vabits
+    - xfrm: fix one more kernel-infoleak in algo dumping
+    - hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
+    - drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too
+    - selinux: improve error checking in sel_write_load()
+    - net: phy: dp83822: Fix reset pin definitions
+    - ata: libata: Set DID_TIME_OUT for commands that actually timed out
+    - ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
+    - platform/x86: dell-wmi: Ignore suspend notifications
+    - ACPI: PRM: Clean up guid type in struct prm_handler_info
+    - tracing: probes: Fix to zero initialize a local variable
+    - task_work: make TWA_NMI_CURRENT handling conditional on IRQ_WORK
+    - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
+    - bpf: Use raw_spinlock_t in ringbuf
+    - reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC
+    - bpf: Fix unpopulated path_size when uprobe_multi fields unset
+    - RDMA/bnxt_re: Fix incorrect dereference of srq in async event
+    - RDMA/bnxt_re: Get the toggle bits from SRQ events
+    - RDMA/bnxt_re: Change the sequence of updating the CQ toggle value
+    - drm/msm/dpu: move CRTC resource assignment to dpu_encoder_virt_atomic_check
+    - ring-buffer: Fix reader locking when changing the sub buffer order
+    - drm/msm/dpu: Don't always set merge_3d pending flush
+    - drm/msm/a6xx+: Insert a fence wait before SMMU table update
+    - drm/xe: Take job list lock in xe_sched_add_pending_job
+    - drm/xe: Use bookkeep slots for external BO's in exec IOCTL
+    - net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init
+    - net/mlx5e: Don't call cleanup on profile rollback failure
+    - bpf: Fix print_reg_state's constant scalar dump
+    - fsnotify: optimize the case of no parent watcher
+    - fsnotify: Avoid data race between fsnotify_recalc_mask() and
+      fsnotify_object_watched()
+    - drm/xe/mcr: Use Xe2_LPM steering tables for Xe2_HPM
+    - objpool: fix choosing allocation for percpu slots
+    - bnxt_en: replace ptp_lock with irqsave variant
+    - bpf, arm64: Fix address emission with tag-based KASAN enabled
+    - net: dsa: microchip: disable EEE for KSZ879x/KSZ877x/KSZ876x
+    - ASoC: topology: Bump minimal topology ABI version
+    - fbdev: wm8505fb: select CONFIG_FB_IOMEM_FOPS
+    - btrfs: qgroup: set a more sane default value for subtree drop threshold
+    - btrfs: clear force-compress on remount when compress mount option is given
+    - x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h-70h
+    - x86/amd_nb: Add new PCI ID for AMD family 1Ah model 20h
+    - btrfs: reject ro->rw reconfiguration if there are hard ro requirements
+    - xfs: don't fail repairs on metadata files with no attr fork
+    - drm/bridge: Fix assignment of the of_node of the parent to aux bridge
+    - platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid
+      addresses
+    - fgraph: Fix missing unlock in register_ftrace_graph()
+    - fgraph: Change the name of cpuhp state to "fgraph:online"
+    - ASoC: SOF: Intel: hda: Always clean up link DMA during stop
+    - ASoC: dapm: avoid container_of() to get component
+    - ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc
+    - ASoC: qcom: sdm845: add missing soundwire runtime stream alloc
+    - soundwire: intel_ace2x: Send PDI stream number during prepare
+    - x86: support user address masking instead of non-speculative conditional
+    - ASoC: qcom: Select missing common Soundwire module code on SDM845
+    - SAUCE: Revert "iio: adc: ti-lmp92064: add missing select
+      IIO_(TRIGGERED_)BUFFER in Kconfig"
+    - Upstream stable to v6.6.58, v6.6.59, v6.11.6
+  * CVE-2025-21756
+    - vsock: Keep the binding until socket destruction
+    - vsock: Orphan socket after transport release
+  * Fix NIC name changes for ice (LP: #2100264)
+    - ice: Remove ndo_get_phys_port_name
+  * CVE-2024-50256
+    - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
+  * CVE-2025-21702
+    - pfifo_tail_enqueue: Drop new packet when sch->limit == 0
+  * CVE-2024-50167
+    - be2net: fix potential memory leak in be_xmit()
+  * Fix line-out playback on some platforms with Cirrus Logic “Dolphin” hardware
+    (LP: #2099880)
+    - ALSA: hda/cirrus: Correct the full scale volume set logic
+  * Enable Large Language Model (LLM) workloads using Intel NPU (LP: #2098972)
+    - accel/ivpu: Increase DMA address range
+  * Patchset for TUXEDO devices (LP: #2098104)
+    - wifi: ath12k: add fallback board name without variant while searching
+      board-2.bin
+    - wifi: ath12k: remove unused ATH12K_BD_IE_BOARD_EXT
+    - wifi: ath12k: add support to search regdb data in board-2.bin for WCN7850
+    - wifi: ath12k: support default regdb while searching board-2.bin for WCN7850
+    - ACPI: resource: Use IRQ override on Maibenben X565
+    - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
+    - ALSA: hda/realtek: Fix headset mic on TUXEDO Gemini 17 Gen3
+    - ALSA: hda/realtek: Fix headset mic on TUXEDO Stellaris 16 Gen6 mb1
+    - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
+    - nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
+    - nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
+  * Introduce and use sendpages_ok() instead of sendpage_ok() in nvme-tcp and
+    drbd (LP: #2093871)
+    - net: introduce helper sendpages_ok()
+    - nvme-tcp: use sendpages_ok() instead of sendpage_ok()
+    - drbd: use sendpages_ok() instead of sendpage_ok()
+  * CVE-2024-56765
+    - powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
+  * CVE-2025-21700
+    - net: sched: Disallow replacing of child qdisc from one parent to another
+  * CVE-2024-56615
+    - bpf: fix OOB devmap writes when deleting elements
+  * CVE-2024-56651
+    - can: hi311x: hi3110_can_ist(): fix potential use-after-free
+  * CVE-2024-56627
+    - ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
+  * CVE-2024-56600
+    - net: inet6: do not leave a dangling sk pointer in inet6_create()
+  * CVE-2024-56661
+    - tipc: fix NULL deref in cleanup_bearer()
+  * CVE-2024-56642
+    - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
+  * CVE-2024-53227
+    - scsi: bfa: Fix use-after-free in bfad_im_module_exit()
+  * CVE-2024-53237
+    - Bluetooth: fix use-after-free in device_for_each_child()
+  * CVE-2024-53166
+    - block, bfq: fix bfqq uaf in bfq_limit_depth()
+  * CVE-2024-50265
+    - ocfs2: remove entry once instead of null-ptr-dereference in
+      ocfs2_xa_remove()
+  * CVE-2024-50249
+    - ACPI: CPPC: Make rmw_lock a raw_spin_lock
+  * iBFT iSCSI out-of-bounds shift UBSAN warning (LP: #2097824)
+    - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
+  * [Ubuntu 24.04] MultiVM - L2 guest(s) running stress-ng getting stuck at
+    booting after triggering crash (LP: #2077722)
+    - KVM: PPC: Book3S HV: Mask off LPCR_MER for a vCPU before running it to avoid
+      spurious interrupts
+  * btrfs will WARN_ON() in btrfs_remove_qgroup() unnecessarily (LP: #2091719)
+    - btrfs: improve the warning and error message for btrfs_remove_qgroup()
+  * CVE-2024-50248
+    - ntfs3: Add bounds checking to mi_enum_attr()
+    - fs/ntfs3: Sequential field availability check in mi_enum_attr()
+  * CVE-2025-21701
+    - net: avoid race between device unregistration and ethnl ops
+  * CVE-2024-57798
+    - drm/dp_mst: Ensure mst_primary pointer is valid in
+      drm_dp_mst_handle_up_req()
+  * CVE-2024-56672
+    - blk-cgroup: Fix UAF in blkcg_unpin_online()
+  * CVE-2024-56658
+    - net: defer final 'struct net' free in netns dismantle
+  * CVE-2024-56598
+    - jfs: array-index-out-of-bounds fix in dtReadFirst
+  * CVE-2024-56595
+    - jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
+  * CVE-2024-53140
+    - netlink: terminate outstanding dump on socket close
+  * CVE-2024-53063
+    - media: dvbdev: prevent the risk of out of memory access
+  * CVE-2024-50302
+    - HID: core: zero-initialize the report buffer
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 04 Jun 2025 20:20:57 +0900
+
+linux-qcom (6.8.0-1042.42) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1042.42 -proposed tracker (LP: #2112174)
+
+  * Miscellaneous Ubuntu changes
+    - [configs] change CONFIG_HWSPINLOCK_QCOM to y
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 30 May 2025 17:59:33 +0900
+
+linux-qcom (6.8.0-1041.41) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1041.41 -proposed tracker (LP: #2111886)
+
+  * [RB3][x02] spf core errors found in dmesg
+    - SAUCE: qcom: spf-core: use pr_info() for successful logs
+
+  * [RB3][x03] va_macro error found in dmesg
+    - SAUCE: ASoC: lpass-va-macro: change dt entry missing to dev_info()
+
+  * [RB8][x02] spmi errors found in dmesg
+    - SAUCE: arm64: sa8775: remove allow-set-time property from rtc
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: switch WIFI firmware to *.mbn from *.mdt
+
+  * Miscellaneous upstream changes
+    - msm: camera: icp: Remove Redundant Structure Field
+    - msm: camera: uapi: Adding flex array support to fix UBSAN kernel panic
+    - PENDING: rpmsg: glink: do not serve intent request if no callback present
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 28 May 2025 16:55:09 +0900
+
+linux-qcom (6.8.0-1040.40) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1040.40 -proposed tracker (LP: #2110187)
+
+  * "[6490][x02] tc956x_pci-eth errors found in dmesg"
+    - Ubuntu: SAUCE: change phy detection log-level from alert to info
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: follow-up renaming from qcs9075-rb8 to qcs9075-iq-9075-evk
+
+  * Miscellaneous upstream changes
+    - PENDING: qcom: ice: Add ice probe
+    - PENDING: arm64: dts: qcom: Rename qcs9075-rb8 to qcs9075-iq-9075-evk
+    - QCLINUX: arm64: dts: qcom: qcs9075-addons: Rename rb8 to iq-9075-evk
+    - PENDING: tty: serial: qcom-geni-serial: fix CTS control for UART in loopback
+      mode
+    - QCLINUX: arm64: deconfig: enable CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT
+    - PENDING: misc: fastrpc: Remove PD status check
+    - Revert "FROMLIST: arm64: dts: qcom: sa8775p: Add CPUs to psci power domain"
+    - Revert "BACKPORT: UPSTREAM: arm64: dts: qcom: sa8775p: add CPU idle states"
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 09 May 2025 17:00:23 +0900
+
+linux-qcom (6.8.0-1039.39) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1039.39 -proposed tracker (LP: #2108955)
+
+  * [RB8][x02] hd3ss3220 not boud to the device
+    - Revert "usb: dwc3: core: set force_gen1 bit in USB31 devices if max speed is
+      SS"
+
+  * "[RB8][x02] The firmware for i2c_qcom_geni (qupv3fw.elf) not in
+    initramfs" // "[RB8][x02] qcom_geni_serial errors found in dmesg"
+    - SAUCE: qcom-geni-se.c: add MODULE_FIRMWARE() to copy firmware to initrd
+
+  * Miscellaneous upstream changes
+    - kgsl: Read DDR type from device tree node
+    - qcom: qtee_shmbridge: change pr_err() to pr_info() for bridge size
+    - qcom: qtee_shmbridge: change pr_err() to pr_info() for bridge size
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 24 Apr 2025 12:47:31 +0900
+
+linux-qcom (6.8.0-1038.38) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1038.38 -proposed tracker (LP: #2107286)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.qcom/dkms-versions -- update from kernel-versions
+      (main/d2025.04.13)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: fix firmware for rb8
+
+  * Miscellaneous upstream changes
+    - kgsl: Fix UBSAN warning in kgsl_get_page_size
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 14 Apr 2025 02:26:32 +0900
+
+linux-qcom (6.8.0-1037.37) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1037.37 -proposed tracker (LP: #2106781)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: add QCS6490 industrical kit dt to compiled-dtb.dtb
+    - [Config] Disable CONFIG_DRM_MSM_VALIDATE_XML
+
+  * Miscellaneous upstream changes
+    - QCLINUX: arm64: dts: qcom: qcm6490-graphics: Don't disable drm gpu/gmu nodes
+    - QCLINUX: arm64: dts: qcom: qcs9100-graphics: Don't disable drm gpu/gmu nodes
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 11 Apr 2025 08:22:42 +0900
+
+linux-qcom (6.8.0-1036.36) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1036.36 -proposed tracker (LP: #2105444)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.qcom/dkms-versions -- update from kernel-versions
+      (main/d2025.03.31)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Add Makefile code to apply overlays for GA1.4
+    - [Packaging] build zfs
+
+  * Miscellaneous upstream changes
+    - PENDING: drm/msm/dsi: Add DSI support for SA8775P
+    - PENDING: drm/msm/dsi: add DSI PHY configuration for SA8775P
+    - QCLINUX: Revert "PENDING: drm/bridge: anx7625: Fix circular dependency"
+    - PENDING: arm64: dts: qcom: sa8775p: add DSI CTRL and PHY support
+    - PENDING: ASoC: dt-bindings: q6dsp: Add High Speed Audio DAI ID support for
+      MI2S and TDM
+    - PENDING: net: pcs: Add 5G baseR changes in PCS driver
+    - PENDING: net: stmmac: Add support for 5GbaseR to configure mac
+    - PENDING: ASoC: qcom: q6dsp: Add SDR High speed DAI support for MI2S and TDM
+    - PENDING: ASoC: qcom: qcm9100: Add machine driver for qcs9100-ride and
+      qcs9075-rb8 boards
+    - PENDING: net: phy: aquantia: Add support for 5GbaseR
+    - PENDING: arm64: dts: qcom: sa8775p: add anx7625 DSI to DP bridge nodes
+    - PENDING: drm/bridge: anx7625: vote for pm runtime during bridge attach
+    - PENDING: drm/bridge: anx7625: update bridge_ops and sink detect logic
+    - PENDING: arm64: defconfig: qcom_gen5auto: Enable TSC
+    - PENDING: arm64: dts: qcom: qcs8300: Add support for camss
+    - PENDING: media: qcom: camss: Add support for camss driver on qcs8300
+    - PENDING: media: qcom: camss: add TPG support on camss for qcs8300
+    - PENDING: net: stmmac: Enable PTP Packet id based timestamping
+    - PENDING: net: PCS: Call PCS link up sequence for 10GBASER
+    - PENDING: net: stmmac: Add support for 10GBASER mode within Mac link up
+    - PENDING: ARM: dts: msm: Add RPMh stats for 8255p
+    - QCLINUX: arm64: dts: qcom: Update the DAI ID for SDR High Speed dailinks
+    - QCLINUX: Revert "PENDING: tty: serial: qcom-geni-serial: Increase Rx buffer
+      size"
+    - UPSTREAM: BACKPORT: arm64: dts: qcm6490: Add interconnect for CDSP
+      remoteproc
+    - BACKPORT: FROMLIST: remoteproc: qcom: Add iommu map_unmap helper function
+    - BACKPORT: FROMLIST: remoteproc: qcom: Add helper function to support IOMMU
+      devmem translation
+    - BACKPORT: FROMLIST: remoteproc: qcom: Add support to parse qcom,devmem
+      property
+    - BACKPORT: FROMLIST: remoteproc: qcom: Add support of SHM bridge to enable
+      memory protection
+    - BACKPORT: FROMLIST: remoteproc: qcom: Enable map/unmap and SHM bridge
+      support
+    - QCLINUX: drm/msm: Remove changes made to prevent gpu probe
+    - FROMLIST: arm64: dts: qcom: sa8775p: Add gpu and gmu nodes
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Don't disable drm gpu/gmu nodes
+    - QCLINUX: arm64: dts: qcom: qcs615: addons: Add coresight nodes
+    - PENDING: arm64: dts: qcom: sa8255p: Update hysteresis to 10degC
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add EL2 dtb support
+    - QCLINUX: arm64: dts: qcom: qcs615: addons: Add memory dump table
+    - QCLINUX: arm64: defconfig: qcom: Enable QCS9100 machine driver config
+    - PENDING: arm64: dts: qcom: sa7255p: Disable USB U1/U2 entry
+    - FROMGIT: arm64: dts: qcom: sc8280xp: Disable USB U1/U2 entry
+    - FROMGIT: arm64: dts: qcom: sc8180x: Disable USB U1/U2 entry
+    - PENDING: Coresight: Add an integer array to tmc driver data
+    - PENDING: pinctrl: qcom: fix sa8775p lpass lpi quad pinctrl setting
+    - FROMLIST: arm64: dts: qcom: sa8775p: Remove extra entries from the iommus
+      property
+    - QCLINUX: arm64: dts: qcom: add hs0 mi2s dai for qcs9075-rb8
+    - QCLINUX: arm64: dts: qcom: qcs615: addons: Enable DCC
+    - PENDING: usb: dwc3: qcom: Adding GPIO-based regulator functionality for VBUS
+    - PENDING: arm64: dts: configs: Enable HD3SS322 USB Type-C DRP port controller
+      driver on QCS9075 RB8
+    - PENDING: arm64: dts: qcom: Flatten USB DT node for USB0 on QCS9075 RB8
+      Platform
+    - PENDING: arm64: dts: qcom: Add DRD mode support for USB0 on QCS9075 RB8
+    - PENDING: arm64: dts: qcom: Flatten USB DT node for USB1 on QCS9075 RB8
+      Platform
+    - PENDING: arm64: dts: qcom: Add host mode support for USB1 on QCS9075 RB8
+    - FROMLIST: dt-bindings: clock: Add Qualcomm QCS615 Camera clock controller
+    - FROMLIST: clk: qcom: camcc-qcs615: Add QCS615 camera clock controller driver
+    - FROMLIST: dt-bindings: clock: Add Qualcomm QCS615 Display clock controller
+    - FROMLIST: clk: qcom: dispcc-qcs615: Add QCS615 display clock controller
+      driver
+    - FROMLIST: dt-bindings: clock: Add Qualcomm QCS615 Graphics clock controller
+    - FROMLIST: clk: qcom: gpucc-qcs615: Add QCS615 graphics clock controller
+      driver
+    - FROMLIST: dt-bindings: clock: Add Qualcomm QCS615 Video clock controller
+    - FROMLIST: clk: qcom: videocc-qcs615: Add QCS615 video clock controller
+      driver
+    - FROMLIST: arm64: defconfig: Enable QCS615 clock controllers
+    - PENDING: ASoC: qcom: q6dsp: Update formats and max rate for Primary i2s
+    - QCLINUX: arm64: defconfigs: Disable TBU support
+    - FROMLIST: arm64: dts: qcom: sa8775p-ride: Add firmware-name in BT node
+    - QCLINUX: Revert "PENDING: arm64: qcs9075-rb8: disable uart bt en pin in DTS"
+    - FROMLIST: arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10
+    - FROMLIST: arm64: dts: qcom: qcs8300-ride: Add firmware-name in BT node
+    - PENDING: arm64: dts: qcom: qcs8300: enable DSI-DP bridge port on QCS8300
+    - PENDING: driver: bluetooth: hci_qca: fix SSR unable to wake up bug
+    - QCLINUX: arm64: deconfig: Enable QCS615 clock controllers
+    - FROMLIST: arm64: dts: qcom: Add clock nodes for multimedia clock
+    - FROMLIST: arm64: dts: qcom: Add cpu scaling clock node
+    - QCLINUX: ASoC: qcom: common: Add qcom_snd_parse_of_v2 support
+    - QCLINUX: arm64: defconfigs: Enable CONFIG_PM_DEBUG
+    - PENDING: serial: qcom-geni: Optimize qcom_geni_uart_ports and increase UART
+      ports to 5
+    - QCLINUX: firmware: qcom_tzmem: Use ns_vmid_num to set self owner bit
+    - QCLINUX: arm64: dts: qcom: sa8775p: Fix cdsp1 node properties
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add EL2 dtb support for ride board
+    - PENDING: ASoC: qcom: q6dsp: Update rates for Primary i2s rx
+    - QCLINUX: arm64: dts: Remove unused pcie1 QPS615 phy node for QEP8121
+    - PENDING: arm64: dts: qcom: qcs9075: Add displayport1 device node
+    - PENDING: serial: qcom-geni-serial: Enable support for
+    - PENDING: net: stmmac: dwmac-qcom-ethqos: Configure host DMA width for
+      SA8797P
+    - QCLINUX: arm64: dts: Replace AQR113c phy with RTL8211 phy
+    - QCLINUX: arm64: defconfig: enable Novatek NT36672E and Lontium lt9611UXC
+      configs
+    - PENDING: net: stmmac: Fix NULL pointer access for GPTP packets
+    - PENDING: arm64: dts: qcom: qcs9075: Change phy-mode to SGMII
+    - QCLINUX: ASoC: qcom: qcm6490: Use qcom_snd_parse_of_v2 to support common
+      dailink data
+    - PENDING: ASoC: qcom: qcm9100: Fix the dapm routings for qcs8300
+    - QCLINUX: duplicate msm/ to msm_default/
+    - QCLINUX: Add support to compile msm_display.ko
+    - Ubuntu: [Config] update CONFIGs for GA 1.4
+
+  [ Ubuntu: 6.8.0-56.58 ]
+
+  * noble/linux: 6.8.0-56.58 -proposed tracker (LP: #2098244)
+  * Noble update: upstream stable patchset 2024-07-19 (LP: #2073603)
+    - Revert "drm: Make drivers depends on DRM_DW_HDMI"
+    - Revert "UBUNTU: [Config] Drivers now depend on DRM_DW_HDMI"
+  * drm/amd/display: Add check for granularity in dml ceil/floor helpers
+    (LP: #2098080)
+    - drm/amd/display: Add check for granularity in dml ceil/floor helpers
+  * optimized default EPP for GNR family (LP: #2097554)
+    - cpufreq: intel_pstate: Update Balance-performance EPP for Granite Rapids
+  * Incorrect LAPIC/x2APIC parsing order (LP: #2097455)
+    - x86/acpi: Fix LAPIC/x2APIC parsing order
+  * MGLRU: page allocation failure on NUMA-enabled systems (LP: #2097214)
+    - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
+  * Upstream commit 65357e2c164a: "RDMA/mana_ib: set node_guid" applied
+    incorrectly (LP: #2096885)
+    - Revert "RDMA/mana_ib: set node_guid"
+  * AppArmor early policy load not funcitoning (LP: #2095370)
+    - SAUCE: Revert "UBUNTU: SAUCE: apparmor4.0.0 [67/90]: userns - add the
+      ability to reference a global variable for a feature value"
+  * apparmor unconfined profile blocks pivot_root (LP: #2067900)
+    - SAUCE: Revert "UBUNTU: SAUCE: apparmor4.0.0 [81/90]: apparmor: convert easy
+      uses of unconfined() to label_mediates()"
+  * CVE-2024-50117
+    - drm/amd: Guard against bad data for ATIF ACPI method
+  * CVE-2024-56582
+    - btrfs: fix use-after-free in btrfs_encoded_read_endio()
+  * CVE-2024-53165
+    - sh: intc: Fix use-after-free bug in register_intc_controller()
+  * CVE-2024-53156
+    - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
+  * CVE-2024-56663
+    - wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
+  * CVE-2024-56614
+    - xsk: fix OOB map writes when deleting elements
+  * VM boots slowly with large-BAR GPU Passthrough due to pci/probe.c redundancy
+    (LP: #2097389)
+    - PCI: Batch BAR sizing operations
+  * Noble update: upstream stable patchset 2025-02-04 (LP: #2097393)
+    - Revert "PCI/MSI: Provide stubs for IMS functions"
+    - gfs2: Revert "introduce qd_bh_get_or_undo"
+    - gfs2: qd_check_sync cleanups
+    - gfs2: Revert "ignore negated quota changes"
+    - Revert "powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2"
+    - tracing: Have saved_cmdlines arrays all in one allocation
+    - spi: spi-fsl-lpspi: remove redundant spi_controller_put call
+    - ata: ahci: Add mask_port_map module parameter
+    - ASoC: tas2781: mark dvc_tlv with __maybe_unused
+    - scsi: sd: Do not repeat the starting disk message
+    - bootconfig: Fix the kerneldoc of _xbc_exit()
+    - perf sched: Move start_work_mutex and work_done_wait_mutex initialization to
+      perf_sched__replay()
+    - perf sched: Fix memory leak in perf_sched__map()
+    - perf sched: Move curr_thread initialization to perf_sched__map()
+    - perf sched: Move curr_pid and cpu_last_switched initialization to
+      perf_sched__{lat|map|replay}()
+    - libsubcmd: Don't free the usage string
+    - selftests: Introduce Makefile variable to list shared bash scripts
+    - jbd2: fix kernel-doc for j_transaction_overhead_buffers
+    - lib/build_OID_registry: avoid non-destructive substitution for Perl < 5.13.2
+      compat
+    - drm/amd/display: Remove a redundant check in authenticated_dp
+    - drm/amd/display: Revert "Check HDCP returned status"
+    - zram: don't free statically defined names
+    - x86/amd_nb: Add new PCI IDs for AMD family 0x1a
+    - rtnetlink: change nlk->cb_mutex role
+    - rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag
+    - mpls: no longer hold RTNL in mpls_netconf_dump_devconf()
+    - phonet: no longer hold RTNL in route_dumpit()
+    - rcu/nocb: Make IRQs disablement symmetric
+    - HID: asus: add ROG Ally N-Key ID and keycodes
+    - HID: asus: add ROG Z13 lightbar
+    - hid-asus: add ROG Ally X prod ID to quirk list
+    - scsi: Revert "scsi: sd: Do not repeat the starting disk message"
+    - btrfs: fix uninitialized pointer free in add_inode_ref()
+    - btrfs: fix uninitialized pointer free on read_alloc_one_name() error
+    - ksmbd: fix user-after-free from session log off
+    - ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2
+    - mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow
+    - net: enetc: remove xdp_drops statistic from enetc_xdp_drop()
+    - net: enetc: block concurrent XDP transmissions during ring reconfiguration
+    - net: enetc: disable Tx BD rings after they are empty
+    - net: enetc: disable NAPI after all rings are disabled
+    - net: enetc: add missing static descriptor and inline keyword
+    - posix-clock: Fix missing timespec64 check in pc_clock_settime()
+    - udp: Compute L4 checksum as usual when not segmenting the skb
+    - arm64: probes: Remove broken LDR (literal) uprobe support
+    - arm64: probes: Fix simulate_ldr*_literal()
+    - arm64: probes: Fix uprobes for big-endian kernels
+    - net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-
+      link PHY
+    - net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()
+    - maple_tree: correct tree corruption on spanning store
+    - nilfs2: propagate directory read errors from nilfs_find_entry()
+    - fat: fix uninitialized variable
+    - mm/mremap: fix move_normal_pmd/retract_page_tables race
+    - mm/swapfile: skip HugeTLB pages for unuse_vma
+    - mm/damon/tests/sysfs-kunit.h: fix memory leak in
+      damon_sysfs_test_add_targets()
+    - tcp: fix mptcp DSS corruption due to large pmtu xmit
+    - net: fec: Move `fec_ptp_read()` to the top of the file
+    - net: fec: Remove duplicated code
+    - mptcp: prevent MPC handshake on port-based signal endpoints
+    - iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
+    - s390/sclp: Deactivate sclp after all its users
+    - s390/sclp_vt220: Convert newlines to CRLF instead of LFCR
+    - KVM: s390: gaccess: Check if guest address is in memslot
+    - KVM: s390: Change virtual to physical address access in diag 0x258 handler
+    - x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
+    - x86/cpufeatures: Add a IBPB_NO_RET BUG flag
+    - x86/entry: Have entry_ibpb() invalidate return predictions
+    - x86/bugs: Skip RSB fill at VMEXIT
+    - x86/bugs: Do not use UNTRAIN_RET with IBPB on entry
+    - fgraph: Use CPU hotplug mechanism to initialize idle shadow stacks
+    - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
+    - io_uring/sqpoll: close race on waiting for sqring entries
+    - blk-mq: setup queue ->tag_set before initializing hctx
+    - ublk: don't allow user copy for unprivileged device
+    - selftest: hid: add the missing tests directory
+    - Input: xpad - add support for MSI Claw A1M
+    - scsi: mpi3mr: Correct a test in mpi3mr_sas_port_add()
+    - scsi: mpi3mr: Validate SAS port assignments
+    - scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down
+    - scsi: ufs: core: Fix the issue of ICU failure
+    - scsi: ufs: core: Requeue aborted request
+    - drm/radeon: Fix encoder->possible_clones
+    - drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation
+    - drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible
+      mode
+    - drm/xe/xe_sync: initialise ufence.signalled
+    - drm/xe/ufence: ufence can be signaled right after wait_woken
+    - drm/vmwgfx: Cleanup kms setup without 3d
+    - drm/vmwgfx: Handle surface check failure correctly
+    - drm/amdgpu/pm: Fix code alignment issue
+    - drm/amdgpu/smu13: always apply the powersave optimization
+    - drm/amdgpu/swsmu: Only force workload setup on init
+    - iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig
+    - iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig
+    - iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig
+    - iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: hid-sensors: Fix an error handling path in
+      _hid_sensor_set_report_latency()
+    - iio: light: veml6030: fix ALS sensor resolution
+    - iio: light: veml6030: fix IIO device retrieval from embedded device
+    - iio: light: opt3001: add missing full-scale range value
+    - iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig
+    - iio: frequency: adf4377: add missing select REMAP_SPI in Kconfig
+    - iio: light: bu27008: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: resolver: ad2s1210 add missing select REGMAP in Kconfig
+    - iio: pressure: bm1390: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: adc: ti-lmp92064: add missing select REGMAP_SPI in Kconfig
+    - iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - iio: resolver: ad2s1210: add missing select (TRIGGERED_)BUFFER in Kconfig
+    - iio: accel: kx022a: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+    - Bluetooth: Call iso_exit() on module unload
+    - Bluetooth: Remove debugfs directory on module init failure
+    - Bluetooth: ISO: Fix multiple init when debugfs is disabled
+    - Bluetooth: btusb: Fix not being able to reconnect after suspend
+    - Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
+    - vt: prevent kernel-infoleak in con_font_get()
+    - xhci: tegra: fix checked USB2 port number
+    - xhci: Fix incorrect stream context type macro
+    - xhci: Mitigate failed set dequeue pointer commands
+    - USB: serial: option: add support for Quectel EG916Q-GL
+    - USB: serial: option: add Telit FN920C04 MBIM compositions
+    - usb: typec: qcom-pmic-typec: fix sink status being overwritten with RP_DEF
+    - usb: dwc3: Wait for EndXfer completion before restoring GUSB2PHYCFG
+    - misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for EEPROM
+      device
+    - misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for OTP device
+    - serial: imx: Update mctrl old_status on RTSD interrupt
+    - parport: Proper fix for array out-of-bounds access
+    - x86/resctrl: Annotate get_mem_config() functions as __init
+    - x86/apic: Always explicitly disarm TSC-deadline timer
+    - x86/CPU/AMD: Only apply Zenbleed fix for Zen2 during late microcode load
+    - x86/entry_32: Do not clobber user EFLAGS.ZF
+    - x86/entry_32: Clear CPU buffers after register restore in NMI return
+    - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
+    - x86/bugs: Use code segment selector for VERW operand
+    - pinctrl: intel: platform: fix error path in device_for_each_child_node()
+    - pinctrl: ocelot: fix system hang on level based interrupts
+    - pinctrl: stm32: check devm_kasprintf() returned value
+    - pinctrl: apple: check devm_kasprintf() returned value
+    - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
+    - irqchip/sifive-plic: Unmask interrupt in plic_irq_enable()
+    - serial: qcom-geni: fix polled console initialisation
+    - serial: qcom-geni: revert broken hibernation support
+    - serial: qcom-geni: fix shutdown race
+    - serial: qcom-geni: fix dma rx cancellation
+    - serial: qcom-geni: fix receiver enable
+    - mm: vmscan.c: fix OOM on swap stress test
+    - ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne
+      1000 G2
+    - Upstream stable to v6.6.57, v6.11.5
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301)
+    - Revert "perf callchain: Fix stitch LBR memory leaks"
+    - ASoC: amd: acp: add ZSC control register programming sequence
+    - virtio: rename virtio_config_enabled to virtio_config_core_enabled
+    - virtio: allow driver to disable the configure change notification
+    - virtio-net: synchronize operstate with admin state on up/down
+    - virtio-net: synchronize probe with ndo_set_features
+    - wifi: rtw89: limit the PPDU length for VHT rate to 0x40000
+    - af_unix: Don't call skb_get() for OOB skb.
+    - af_unix: Remove single nest in manage_oob().
+    - af_unix: Rename unlinked_skb in manage_oob().
+    - af_unix: Move spin_lock() in manage_oob().
+    - iommu/amd: Move allocation of the top table into v1_alloc_pgtable
+    - iommu/amd: Set the pgsize_bitmap correctly
+    - drm/xe: Move and export xe_hw_engine lookup.
+    - drm/msm/dp: rename wide_bus_en to wide_bus_supported
+    - drm/msm/dp: enable widebus on all relevant chipsets
+    - bpf, arm64: Fix tailcall hierarchy
+    - libbpf: Don't take direct pointers into BTF data from st_ops
+    - s390/entry: Move early program check handler to entry.S
+    - selftests/bpf: fix to avoid __msg tag de-duplication by clang
+    - libbpf: Ensure new BTF objects inherit input endianness
+    - PCI: dwc: ep: Rename dw_pcie_ep_exit() to dw_pcie_ep_deinit()
+    - PCI: qcom-ep: Enable controller resources like PHY only after refclk is
+      available
+    - net: ravb: Fix maximum TX frame size for GbEth devices
+    - ravb: Make it clear the information relates to maximum frame size
+    - net: ravb: Fix R-Car RX frame size limit
+    - netfilter: nf_tables: missing objects with no memcg accounting
+    - PCI: dra7xx: Fix error handling when IRQ request fails in probe
+    - KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)
+    - intel_idle: fix ACPI _CST matching for newer Xeon platforms
+    - wifi: mt76: mt7925: fix a potential association failure upon resuming
+    - cifs: Remove intermediate object of failed create reparse call
+    - drm/amd/display: Disable replay if VRR capability is false
+    - drm/amd/display: Fix VRR cannot enable
+    - l2tp: free sessions using rcu
+    - net: skbuff: sprinkle more __GFP_NOWARN on ingress allocs
+    - nvme: fix metadata handling in nvme-passthrough
+    - wifi: wilc1000: Do not operate uninitialized hardware during suspend/resume
+    - x86/apic: Remove logical destination mode for 64-bit
+    - pmdomain: core: Use dev_name() instead of kobject_get_path() in debugfs
+    - drm/xe: Name and document Wa_14019789679
+    - drm/xe: Add timeout to preempt fences
+    - drm/amd/display: Fix possible overflow in integer multiplication
+    - ext4: fix error message when rejecting the default hash
+    - power: supply: Drop use_cnt check from power_supply_property_is_writeable()
+    - ALSA: hda/realtek: fix mute/micmute LED for HP mt645 G8
+    - drm/xe: Generate oob before compiling anything
+    - clk: qcom: gcc-sc8180x: Register QUPv3 RCGs for DFS on sc8180x
+    - drm/amd/display: Restore Optimized pbn Value if Failed to Disable DSC
+    - Revert "drm/amd/display: Skip Recompute DSC Params if no Stream on Link"
+    - pmdomain: core: Reduce debug summary table width
+    - fs/ntfs3: Do not call file_modified if collapse range failed
+    - fs/ntfs3: Optimize large writes into sparse file
+    - fs/ntfs3: Fix sparse warning in ni_fiemap
+    - fs/ntfs3: Refactor enum_rstbl to suppress static checker
+    - virtio_console: fix misc probe bugs
+    - ntfs3: Change to non-blocking allocation in ntfs_d_hash
+    - bpf: Call the missed btf_record_free() when map creation fails
+    - selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
+    - bpf: Check percpu map value size first
+    - s390/facility: Disable compile time optimization for decompressor code
+    - s390/mm: Add cond_resched() to cmm_alloc/free_pages()
+    - bpf, x64: Fix a jit convergence issue
+    - ext4: nested locking for xattr inode
+    - s390/cpum_sf: Remove WARN_ON_ONCE statements
+    - ktest.pl: Avoid false positives with grub2 skip regex
+    - soundwire: intel_bus_common: enable interrupts before exiting reset
+    - PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
+    - clk: bcm: bcm53573: fix OF node leak in init
+    - PCI: Add ACS quirk for Qualcomm SA8775P
+    - i2c: i801: Use a different adapter-name for IDF adapters
+    - PCI: Mark Creative Labs EMU20k2 INTx masking as broken
+    - RISC-V: Don't have MAX_PHYSMEM_BITS exceed phys_addr_t
+    - mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less strict
+    - mfd: intel-lpss: Add Intel Arrow Lake-H LPSS PCI IDs
+    - mfd: intel-lpss: Rename SPI intel_lpss_platform_info structs
+    - mfd: intel-lpss: Add Intel Panther Lake LPSS PCI IDs
+    - riscv: Omit optimized string routines when using KASAN
+    - riscv: avoid Imbalance in RAS
+    - RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
+    - PCI: qcom: Disable mirroring of DBI and iATU register space in BAR region
+    - PCI: endpoint: Assign PCI domain number for endpoint controllers
+    - soundwire: cadence: re-check Peripheral status with delayed_work
+    - riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16
+      unknown
+    - media: videobuf2-core: clear memory related fields in
+      __vb2_plane_dmabuf_put()
+    - remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
+    - usb: chipidea: udc: enable suspend interrupt after usb reset
+    - usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the
+      Crashkernel Scenario
+    - xhci: dbc: Fix STALL transfer event handling
+    - usb: host: xhci-plat: Parse xhci-missing_cas_quirk and apply quirk
+    - comedi: ni_routing: tools: Check when the file could not be opened
+    - LoongArch: Fix memleak in pci_acpi_scan_root()
+    - netfilter: nf_nat: don't try nat source port reallocation for reverse dir
+      clash
+    - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
+    - tools/iio: Add memory allocation failure check for trigger_name
+    - staging: vme_user: added bound check to geoid
+    - driver core: bus: Return -EIO instead of 0 when show/store invalid bus
+      attribute
+    - scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in
+      lpfc_els_flush_cmd()
+    - scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR to
+      KERN_WARNING
+    - NFSD: Mark filecache "down" if init fails
+    - nfsd: nfsd_destroy_serv() must call svc_destroy() even if nfsd_startup_net()
+      failed
+    - ice: set correct dst VSI in only LAN filters
+    - ice: clear port vlan config during reset
+    - ice: disallow DPLL_PIN_STATE_SELECTABLE for dpll output pins
+    - ice: fix VLAN replay after reset
+    - SUNRPC: Fix integer overflow in decode_rc_list()
+    - tcp: fix to allow timestamp undo if no retransmits were sent
+    - tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
+    - tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out
+    - rxrpc: Fix uninitialised variable in rxrpc_send_data()
+    - selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids()
+      test
+    - Bluetooth: btusb: Don't fail external suspend requests
+    - net: phy: bcm84881: Fix some error handling paths
+    - Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
+    - net: ethernet: adi: adin1110: Fix some error handling path in
+      adin1110_read_fifo()
+    - net: dsa: b53: fix jumbo frame mtu check
+    - net: dsa: b53: fix max MTU for 1g switches
+    - net: dsa: b53: fix max MTU for BCM5325/BCM5365
+    - net: dsa: b53: allow lower MTUs on BCM5325/5365
+    - net: dsa: b53: fix jumbo frames on 10/100 ports
+    - drm/nouveau: pass cli to nouveau_channel_new() instead of drm+device
+    - nouveau/dmem: Fix privileged error in copy engine channel
+    - gpio: aspeed: Add the flush write to ensure the write complete.
+    - gpio: aspeed: Use devm_clk api to manage clock source
+    - powercap: intel_rapl_tpmi: Ignore minor version change
+    - ice: Fix netif_is_ice() in Safe Mode
+    - ice: Flush FDB entries before reset
+    - e1000e: change I219 (19) devices to ADP
+    - net: ibm: emac: mal: fix wrong goto
+    - btrfs: zoned: fix missing RCU locking in error message when loading zone
+      info
+    - sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
+    - netfilter: fib: check correct rtable in vrf setups
+    - net: ibm: emac: mal: add dcr_unmap to _remove
+    - net: dsa: refuse cross-chip mirroring operations
+    - rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
+    - vxlan: Handle error of rtnl_register_module().
+    - bridge: Handle error of rtnl_register_module().
+    - mctp: Handle error of rtnl_register_module().
+    - mpls: Handle error of rtnl_register_module().
+    - phonet: Handle error of rtnl_register_module().
+    - rcu/nocb: Fix rcuog wake-up from offline softirq
+    - x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h
+    - HID: multitouch: Add support for lenovo Y9000P Touchpad
+    - hwmon: intel-m10-bmc-hwmon: relabel Columbiaville to CVL Die Temperature
+    - hwmon: (tmp513) Add missing dependency on REGMAP_I2C
+    - hwmon: (mc34vr500) Add missing dependency on REGMAP_I2C
+    - hwmon: (adm9240) Add missing dependency on REGMAP_I2C
+    - hwmon: (adt7470) Add missing dependency on REGMAP_I2C
+    - hwmon: (ltc2991) Add missing dependency on REGMAP_I2C
+    - HID: plantronics: Workaround for an unexcepted opposite volume key
+    - Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
+    - usb: dwc3: core: Stop processing of pending events if controller is halted
+    - usb: xhci: Fix problem with xhci resume from suspend
+    - usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
+    - usb: dwc3: re-enable runtime PM after failed resume
+    - usb: gadget: core: force synchronous registration
+    - hid: intel-ish-hid: Fix uninitialized variable 'rv' in
+      ish_fw_xfer_direct_dma
+    - ACPI: resource: Make Asus ExpertBook B2402 matches cover more models
+    - ACPI: resource: Make Asus ExpertBook B2502 matches cover more models
+    - drm/amdkfd: Fix an eviction fence leak
+    - drm/amd/display: fix hibernate entry for DCN35+
+    - drm/xe/guc_submit: fix xa_store() error checking
+    - drm/i915/hdcp: fix connector refcounting
+    - drm/xe/ct: fix xa_store() error checking
+    - scsi: ufs: Use pre-calculated offsets in ufshcd_init_lrb()
+    - mmc: sdhci-of-dwcmshc: Prevent stale command interrupt handling
+    - mptcp: fallback when MPTCP opts are dropped after 1st data
+    - ata: libata: avoid superfluous disk spin down + spin up during hibernation
+    - OPP: fix error code in dev_pm_opp_set_config()
+    - net: dsa: lan9303: ensure chip reset and wait for READY status
+    - mptcp: pm: do not remove closing subflows
+    - powercap: intel_rapl_tpmi: Fix bogus register reading
+    - selftests/mm: fix incorrect buffer->mirror size in hmm2 double_map test
+    - selftests/rseq: Fix mm_cid test failure
+    - btrfs: split remaining space to discard in chunks
+    - btrfs: add cancellation points to trim loops
+    - fs/proc/kcore.c: allow translation of physical memory addresses
+    - io_uring/rw: fix cflags posting for single issue multishot read
+    - Upstream stable to v6.6.56, v6.11.1, v6.11.2, v6.11.3, v6.11.4
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50182
+    - secretmem: disable memfd_secret() if arch cannot set direct map
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50019
+    - kthread: unpark only parked kthread
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50096
+    - nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50020
+    - ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50021
+    - ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50022
+    - device-dax: correct pgoff align in dax_set_mapping()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50185
+    - mptcp: handle consistently DSS corruption
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50023
+    - net: phy: Remove LED entry from LEDs list on unregister
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50024
+    - net: Fix an unsafe loop on the list
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50186
+    - net: explicitly clear the sk pointer, when pf->create fails
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50025
+    - scsi: fnic: Move flush_work initialization out of if block
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50026
+    - scsi: wd33c93: Don't use stale scsi_pointer value
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50027
+    - thermal: core: Free tzp copy along with the thermal zone
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50028
+    - thermal: core: Reference count the zone in thermal_zone_get_by_id()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50029
+    - Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50030
+    - drm/xe/ct: prevent UAF in send_recv()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50187
+    - drm/vc4: Stop the active perfmon before being destroyed
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50031
+    - drm/v3d: Stop the active perfmon before being destroyed
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50189
+    - HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50033
+    - slip: make slhc_remember() more robust against malicious packets
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50035
+    - ppp: fix ppp_async_encode() illegal access
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50036
+    - net: do not delay dst_entries_add() in dst_release()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50038
+    - netfilter: xtables: avoid NFPROTO_UNSPEC where needed
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50039
+    - net/sched: accept TCA_STAB only for root qdisc
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50040
+    - igb: Do not bring the device up after non-fatal error
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50041
+    - i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50042
+    - ice: Fix increasing MSI-X on VF
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50093
+    - thermal: intel: int340x: processor: Fix warning during module unload
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50044
+    - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50045
+    - netfilter: br_netfilter: fix panic with metadata_dst skb
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50188
+    - net: phy: dp83869: fix memory corruption when enabling fiber
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50046
+    - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50180
+    - fbdev: sisfb: Fix strbuf array overflow
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50047
+    - smb: client: fix UAF in async decryption
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50048
+    - fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50049
+    - drm/amd/display: Check null pointer before dereferencing se
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50090
+    - drm/xe/oa: Fix overflow in oa batch buffer
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50183
+    - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV
+      instance
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50055
+    - driver core: bus: Fix double free in driver API bus_register()
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50056
+    - usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50184
+    - virtio_pmem: Check device status before requesting flush
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50057
+    - usb: typec: tipd: Free IRQ only if it was requested before
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50058
+    - serial: protect uart_port_dtr_rts() in uart_shutdown() too
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50181
+    - clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50059
+    - ntb: ntb_hw_switchtec: Fix use after free vulnerability in
+      switchtec_ntb_remove due to race condition
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50060
+    - io_uring: check if we need to reschedule during overflow flush
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50061
+    - i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master
+      Driver Due to Race Condition
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50062
+    - RDMA/rtrs-srv: Avoid null pointer deref during path establishment
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50095
+    - RDMA/mad: Improve handling of timed out WRs of mad agent
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50063
+    - bpf: Prevent tail call between progs attached to different hooks
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50191
+    - ext4: don't set SB_RDONLY after filesystem errors
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50064
+    - zram: free secondary algorithms names
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50089
+    - unicode: Don't special case ignorable code points
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49865
+    - drm/xe/vm: move xa_alloc to prevent UAF
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49968
+    - ext4: filesystems without casefold feature cannot be mounted with siphash
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49893
+    - drm/amd/display: Check stream_status before it is used
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49972
+    - drm/amd/display: Deallocate DML memory if allocation fails
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49914
+    - drm/amd/display: Add null check for pipe_ctx->plane_state in
+      dcn20_program_pipe
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49920
+    - drm/amd/display: Check null pointers before multiple uses
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-49921
+    - drm/amd/display: Check null pointers before used
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-50009
+    - cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-47726
+    - f2fs: fix to wait dio completion
+  * Noble update: upstream stable patchset 2025-02-03 (LP: #2097301) //
+    CVE-2024-47711
+    - af_unix: Don't return OOB skb in manage_oob().
+  * CVE-2024-53170
+    - block: fix uaf for flush rq while iterating tags
+  * CVE-2024-50148
+    - Bluetooth: bnep: fix wild-memory-access in proto_unregister
+  * CVE-2024-50134
+    - drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real
+      VLA
+  * CVE-2024-50171
+    - net: systemport: fix potential memory leak in bcm_sysport_xmit()
+  * CVE-2024-50229
+    - nilfs2: fix potential deadlock with newly created symlinks
+  * CVE-2024-50233
+    - staging: iio: frequency: ad9832: fix division by zero in
+      ad9832_calc_freqreg()
+  * [Lenovo Ubuntu 24.04 Bug] dmesg show "spi-nor: probe of spi0.0 failed with
+    error -95" (LP: #2070339)
+    - mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported
+    - mtd: core: Align comment with an action in mtd_otp_nvmem_add()
+  * python perf module missing in realtime kernel (LP: #2089411)
+    - [Packaging] linux-tools: Add missing python perf symlink
+    - [Packaging] linux-tools: Fix python perf library packaging
+    - [Packaging] linux-tools: Fall back to old python perf path
+  * CVE-2024-53104
+    - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in
+      uvc_parse_format
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 31 Mar 2025 03:30:47 +0900
+
+linux-qcom (6.8.0-1035.35) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1034.34 -proposed tracker (LP: #2103614)
+
+  * [RB8] iris_vpu module crashes the kernel
+    - Ubuntu: [Config] enable CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT
+
+  * Miscellaneous upstream changes
+    - kgsl: Add support for using compatible string "qcom,kgsl"
+    - ARM: dts: msm: Don't allow drm driver probe kgsl nodes
+    - QCLINUX: drm/msm: Remove changes made to prevent gpu probe
+    - FROMLIST: arm64: dts: qcom: sa8775p: Add gpu and gmu nodes
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Don't disable drm gpu/gmu nodes
+    - BACKPORT: arm64: dts: qcom: sc7280: don't enable GPU on unsupported devices
+    - QCLINUX: arm64: deconfig: enable CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT
+    - QCLINUX: Add support to compile msm_display.ko
+    - Ubuntu: [Config] enable CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 19 Mar 2025 23:02:25 +0900
+
+linux-qcom (6.8.0-1033.33) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1033.33 -proposed tracker (LP: #2101706)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: arm64: dts: disable iris_vpu on RB8 board for now
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Sun, 09 Mar 2025 13:41:59 +0900
+
+linux-qcom (6.8.0-1032.32) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1032.32 -proposed tracker (LP: #2100991)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: build camera drivers for qcm6490/qcs9100 separately
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy() (take 2)
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+      (take 2)
+    - SAUCE: ubuntu/qcom/camera: remove camera_banner
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: hack modpost to allow multiple exports
+    - SAUCE: fix phy-mode for RB8 board
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 06 Mar 2025 11:34:29 +0900
+
+linux-qcom (6.8.0-1031.31) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1031.31 -proposed tracker (LP: #2099991)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: add qcs9075-addons-rb8-ovl.dtb
+
+  * Miscellaneous upstream changes
+    - PENDING: arm64: dts: qcom: qcs9075: Enable ethernet on QCS9075 RB8
+    - video: driver: fix life cycle of a buffer shared across multiple clients
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 25 Feb 2025 23:33:35 +0900
+
+linux-qcom (6.8.0-1030.30) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1030.30 -proposed tracker (LP: #2098733)
+
+  * "[RB3] tc956x_pci-eth errors found in dmesg"
+    - SAUCE: ubuntu/qcom/qps615: suppress false alerts
+    - SAUCE: ubuntu/qcom/qps615: use INFO level for logging
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import external DT from GA 1.3.1
+    - SAUCE: Add Makefile code to apply overlays for GA1.2
+    - SAUCE: ubuntu/qcom/graphics: import qcm6490 graphics driver code from
+      GA1.3.1
+    - SAUCE: ubuntu/qcom/camera: import qcm6490 camera driver code from GA1.3.1
+    - SAUCE: ubuntu/qcom/qps615: import ethernet driver from GA1.3.1
+    - SAUCE: ubuntu/qcom/video: import video driver from GA 1.3.1
+    - SAUCE: ubuntu/qcom: build external drivers
+    - SAUCE: ubuntu/qcom/camera: fix build warnings and errors
+    - SAUCE: rename qcom,phy-rst-gpio to qcom,phy-rst-gpio-id
+    - SAUCE: suppress unneeded build logs
+    - SAUCE: ubuntu/qcom: suppress Wno-enum-int-mismatch warning
+    - SAUCE: ubuntu/qcom/graphics: change strtobool() to kstrtobool()
+    - SAUCE: ubuntu/qcom/graphics: dynamically allocate the kgsl-pool shrinker for
+      kernel>=6.7
+    - SAUCE: ubuntu/qcom/camera: remove unused camera_banner
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/video: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: auto-load module
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: disable downstream display driver
+    - [Config] update config options for GA 1.3.2
+    - SAUCE: import external DT from GA 1.3.2
+    - SAUCE: merge two msm-camera.h
+    - [Packaging] update contents of linux-libc-dev-qcom package
+
+  * Miscellaneous upstream changes
+    - PENDING: arm64: dts: qcom: sa8255p-ride: Disable aoss_qmp
+    - FROMLIST: clk: qcom: Update the support for alpha mode configuration
+    - FROMLIST: clk: qcom: clk-alpha-pll: Add support for dynamic update for
+      slewing PLLs
+    - FROMLIST: phy: qcom: qmp-usbc: Add qmp configuration for QCS615
+    - FROMLIST: mmc: sdhci-msm: Enable MMC_CAP_AGGRESSIVE_PM for qualcomm
+      controllers
+    - QCLINUX: arm64: defconfig: Enable Ftrace for Gen5 Auto targets
+    - FROMLIST: net: stmmac: dwmac-qcom-ethqos: add support for EMAC on qcs615
+      platforms
+    - FROMLIST: arm64: dts: qcom: qcs615: add ethernet node
+    - FROMLIST: arm64: dts: qcom: qcs615-ride: Enable ethernet node
+    - FROMLIST: net: stmmac: qcom-ethqos: Enable RX programmable swap on qcs615
+    - FROMLIST: arm64: dts: qcom: qcs615-ride: Enable RX programmable swap on
+      qcs615-ride
+    - PENDING: net: stmmac: Create new mdio for every emac instance
+    - PENDING: arm64: dts: qcom: Add coresight nodes for QCS615
+    - PENDING: media: qcom: camss: Add support for camss driver on sa8775p
+    - PENDING: arm64: dts: qcom: sa8775p: Add support for camss
+    - PENDING: add TPG driver on camss for sa8775p
+    - QCLINUX: arm64: defconfig: Enable GS_USB
+    - QCLINUX: firmware: qcom_scm: Set SHE scm to atomic
+    - PENDING: ptp: qcom: Add support for Time Stamp Counter(TSC) driver
+    - PENDING: ptp: ptp_qcom_tsc: Add nsecs support for adjtime
+    - QCLINUX: arm64: dts: qcom: add lpi-quad mi2s/tdm dai for qcs9075-rb8
+    - PENDING: clk: qcom: videocc-sa8775p: Add HW_CTRL for video_cc_mvs0_gdsc
+    - QCLINUX: arm64: qcs9075-rb8: disable uart bt en pin in DTS
+    - FROMGIT: arm64: dts: qcom: sa8775p: Disable USB U1/U2 entry
+    - QCLINUX: arm64: defconfig: Enable MHI driver for Gen5auto targets
+    - QCLINUX: arm64: dts: qcom: add support for GPIO expander on rb8 board
+    - PENDING: net: PCS: Fix USXGMII reset sequence to poll for proper bit
+    - PENDING: drm/msm/dpu: remove duplicate formats from wb_formats list
+    - BACKPORT: UPSTREAM: phy: add NXP PTN3222 eUSB2 to USB2 redriver
+    - QCLINUX: ASoC: qcom: qdsp6: Increase the timeout to 20 secs
+    - Revert "PENDING: arm64: dts: qcom: qcs9075: Update memory map for qcs9075"
+    - PENDING: arm64: dts: qcom: qcs9xxx: Update memory map for qcs9xxx boards
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 18 Feb 2025 17:04:47 +0900
+
+linux-qcom (6.8.0-1029.29) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1028.28 -proposed tracker (LP: #2098058)
+
+  * Add list of source files to linux-buildinfo (LP: #2086606)
+    - [Packaging] Add list of used source files to buildinfo package
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: disable downstream display driver
+
+  * Miscellaneous upstream changes
+    - kernel: Enable upstream display on qcm6490 rgb3gen2
+
+  [ Ubuntu: 6.8.0-54.56 ]
+
+  * CVE-2025-0927
+    - SAUCE: fs: hfs/hfsplus: add key_len boundary check to hfs_bnode_read_key
+
+  [ Ubuntu: 6.8.0-53.55 ]
+
+  * noble/linux: 6.8.0-53.55 -proposed tracker (LP: #2093677)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2025.01.13)
+  * generate and ship vmlinux.h to allow packages to build BPF CO-RE
+    (LP: #2050083)
+    - [Packaging] add linux-bpf-dev package
+    - [Packaging] do not attempt to generate BTF header on armhf
+  * Unable to boot as a guest on VMware ESX (LP: #2091941)
+    - ptp/vmware: Use VMware hypercall API
+    - input/vmmouse: Use VMware hypercall API
+    - drm/vmwgfx: Use VMware hypercall API
+    - x86/vmware: Use VMware hypercall API
+    - x86/vmware: Correct macro names
+    - x86/vmware: Remove legacy VMWARE_HYPERCALL* macros
+  * When /dev/vmbus/hv_kvp is not present, disable hv-kvp-daemon (LP: #2091744)
+    - [Packaging] disable hv-kvp-daemon if needed
+  * Backport "netkit: Add option for scrubbing skb meta data" to 6.8
+    (LP: #2091184)
+    - netkit: Add option for scrubbing skb meta data
+  * KVM: Cache CPUID at KVM.ko module init to reduce latency of VM-Enter and VM-
+    Exit (LP: #2093146)
+    - KVM: x86: Cache CPUID.0xD XSTATE offsets+sizes during module init
+  * [SRU] add support of QCA BT 0489:e0fc (LP: #2085406)
+    - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x
+  * ice driver RTNL assertion failed warning on shutdown/reboot (LP: #2091107)
+    - ice: Remove and readd netdev during devlink reload
+  * vfio_pci soft lockup on VM start while using PCIe passthrough (LP: #2089306)
+    - SAUCE: Revert "vfio/pci: Insert full vma on mmap'd MMIO fault"
+    - SAUCE: Revert "vfio/pci: Use unmap_mapping_range()"
+  * [SRU] Fix error of resume on rtl8168fp (LP: #2087507)
+    - r8169: avoid unsolicited interrupts
+  * [SRU] power: intel_pstate: HWP interrupt support for maximum ratio changed
+    (LP: #2090852)
+    - x86/cpufeatures: Add HWP highest perf change feature flag
+    - cpufreq: intel_pstate: Support highest performance change interrupt
+  * Noble update: upstream stable patchset 2024-11-29 (LP: #2089884)
+    - static_call: Handle module init failure correctly in
+      static_call_del_module()
+    - static_call: Replace pointless WARN_ON() in static_call_module_notify()
+    - jump_label: Simplify and clarify static_key_fast_inc_cpus_locked()
+    - jump_label: Fix static_key_slow_dec() yet again
+    - scsi: st: Fix input/output error on empty drive reset
+    - scsi: pm8001: Do not overwrite PCI queue mapping
+    - drm/amdgpu: Fix get each xcp macro
+    - mailbox: rockchip: fix a typo in module autoloading
+    - mailbox: bcm2835: Fix timeout during suspend mode
+    - ceph: remove the incorrect Fw reference check when dirtying pages
+    - ieee802154: Fix build error
+    - net: sparx5: Fix invalid timestamps
+    - net/mlx5: Fix error path in multi-packet WQE transmit
+    - net/mlx5: Added cond_resched() to crdump collection
+    - net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
+    - net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
+    - netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
+    - net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
+    - net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
+    - selftests: netfilter: Fix nft_audit.sh for newer nft binaries
+    - netfilter: nf_tables: prevent nf_skb_duplicated corruption
+    - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
+    - Bluetooth: MGMT: Fix possible deadlocks
+    - Bluetooth: L2CAP: Fix uaf in l2cap_connect
+    - Bluetooth: hci_core: Fix calling mgmt_device_connected
+    - Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
+    - net: Add netif_get_gro_max_size helper for GRO
+    - net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_size
+    - net: ethernet: lantiq_etop: fix memory disclosure
+    - net: fec: Restart PPS after link state change
+    - net: fec: Reload PTP registers after link-state change
+    - net: avoid potential underflow in qdisc_pkt_len_init() with UFO
+    - net: add more sanity checks to qdisc_pkt_len_init()
+    - net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
+    - ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
+    - net: test for not too small csum_start in virtio_net_hdr_to_skb()
+    - ppp: do not assume bh is held in ppp_channel_bridge_input()
+    - iomap: constrain the file range passed to iomap_file_unshare
+    - dt-bindings: net: xlnx,axi-ethernet: Add missing reg minItems
+    - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
+    - i2c: xiic: improve error message when transfer fails to start
+    - i2c: xiic: Try re-initialization on bus busy timeout
+    - loop: don't set QUEUE_FLAG_NOMERGES
+    - ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is
+      uninitialized
+    - ALSA: mixer_oss: Remove some incorrect kfree_const() usages
+    - ALSA: hda/realtek: Fix the push button function for the ALC257
+    - ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
+    - ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
+    - cifs: Fix buffer overflow when parsing NFS reparse points
+    - cifs: Do not convert delimiter when parsing NFS-style symlinks
+    - ALSA: gus: Fix some error handling paths related to get_bpos() usage
+    - ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
+    - wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
+    - wifi: rtw89: avoid to add interface to list twice when SER
+    - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
+    - crypto: x86/sha256 - Add parentheses around macros' single arguments
+    - crypto: octeontx - Fix authenc setkey
+    - crypto: octeontx2 - Fix authenc setkey
+    - ice: Adjust over allocation of memory in ice_sched_add_root_node() and
+      ice_sched_add_node()
+    - wifi: iwlwifi: mvm: Fix a race in scan abort flow
+    - wifi: iwlwifi: mvm: drop wrong STA selection in TX
+    - wifi: cfg80211: Set correct chandef when starting CAC
+    - net/xen-netback: prevent UAF in xenvif_flush_hash()
+    - net: hisilicon: hip04: fix OF node leak in probe()
+    - net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
+    - net: hisilicon: hns_mdio: fix OF node leak in probe()
+    - ACPI: PAD: fix crash in exit_round_robin()
+    - ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
+    - ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
+    - e1000e: avoid failing the system during pm_suspend
+    - wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
+    - net: sched: consistently use rcu_replace_pointer() in taprio_change()
+    - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
+    - Bluetooth: btrtl: Set msft ext address filter quirk for RTL8852B
+    - ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
+    - ACPI: CPPC: Add support for setting EPP register in FFH
+    - blk_iocost: fix more out of bound shifts
+    - wifi: ath12k: fix array out-of-bound access in SoC stats
+    - wifi: ath11k: fix array out-of-bound access in SoC stats
+    - wifi: rtw88: select WANT_DEV_COREDUMP
+    - ACPI: EC: Do not release locks during operation region accesses
+    - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in
+      acpi_db_convert_to_package()
+    - tipc: guard against string buffer overrun
+    - net: mvpp2: Increase size of queue_name buffer
+    - bnxt_en: Extend maximum length of version string by 1 byte
+    - ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
+    - wifi: rtw89: correct base HT rate mask for firmware
+    - ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
+    - net: atlantic: Avoid warning about potential string truncation
+    - crypto: simd - Do not call crypto_alloc_tfm during registration
+    - netpoll: Ensure clean state on setup failures
+    - tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
+    - wifi: iwlwifi: mvm: use correct key iteration
+    - wifi: iwlwifi: mvm: avoid NULL pointer dereference
+    - ACPICA: iasl: handle empty connection_node
+    - proc: add config & param to block forcing mem writes
+    - [Config] updateconfigs to select PROC_MEM_ALWAYS_FORCE
+    - drivers/perf: arm_spe: Use perf_allow_kernel() for permissions
+    - can: netlink: avoid call to do_set_data_bittiming callback with stale
+      can_priv::ctrlmode
+    - wifi: mt76: mt7915: add dummy HW offload of IEEE 802.11 fragmentation
+    - wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
+    - wifi: mwifiex: Fix memcpy() field-spanning write warning in
+      mwifiex_cmd_802_11_scan_ext()
+    - nfp: Use IRQF_NO_AUTOEN flag in request_irq()
+    - ALSA: usb-audio: Add input value sanity checks for standard types
+    - x86/ioapic: Handle allocation failures gracefully
+    - ALSA: usb-audio: Define macros for quirk table entries
+    - ALSA: usb-audio: Replace complex quirk lines with macros
+    - ALSA: usb-audio: Add logitech Audio profile quirk
+    - ASoC: codecs: wsa883x: Handle reading version failure
+    - tools/x86/kcpuid: Protect against faulty "max subleaf" values
+    - x86/pkeys: Add PKRU as a parameter in signal handling functions
+    - x86/pkeys: Restore altstack access in sigreturn()
+    - x86/kexec: Add EFI config table identity mapping for kexec kernel
+    - ALSA: asihpi: Fix potential OOB array access
+    - ALSA: hdsp: Break infinite MIDI input flush loop
+    - tools/nolibc: powerpc: limit stack-protector workaround to GCC
+    - selftests/nolibc: avoid passing NULL to printf("%s")
+    - x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
+    - hwmon: (nct6775) add G15CF to ASUS WMI monitoring list
+    - fbdev: efifb: Register sysfs groups through driver core
+    - fbdev: pxafb: Fix possible use after free in pxafb_task()
+    - rcuscale: Provide clear error when async specified without primitives
+    - power: reset: brcmstb: Do not go into infinite loop if reset fails
+    - iommu/vt-d: Always reserve a domain ID for identity setup
+    - iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
+    - drm/stm: Avoid use-after-free issues with crtc and plane
+    - drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
+    - drm/amdgpu: prevent BO_HANDLES error from being overwritten
+    - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
+    - drm/amd/display: Add null check for top_pipe_to_program in
+      commit_planes_for_stream
+    - ata: pata_serverworks: Do not use the term blacklist
+    - ata: sata_sil: Rename sil_blacklist to sil_quirks
+    - HID: Ignore battery for all ELAN I2C-HID devices
+    - drm/amd/display: Handle null 'stream_status' in
+      'planes_changed_for_existing_stream'
+    - drm/amd/display: Check null pointers before using dc->clk_mgr
+    - drm/amd/display: Add null check for 'afb' in
+      amdgpu_dm_plane_handle_cursor_update (v2)
+    - drm/amd/display: fix double free issue during amdgpu module unload
+    - jfs: UBSAN: shift-out-of-bounds in dbFindBits
+    - jfs: Fix uaf in dbFreeBits
+    - jfs: check if leafidx greater than num leaves per dmap tree
+    - scsi: smartpqi: correct stream detection
+    - drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
+    - jfs: Fix uninit-value access of new_ea in ea_buffer
+    - drm/amdgpu: add raven1 gfxoff quirk
+    - drm/amdgpu: enable gfxoff quirk on HP 705G4
+    - drm/amdkfd: Fix resource leak in criu restore queue
+    - HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
+    - platform/x86: touchscreen_dmi: add nanote-next quirk
+    - drm/stm: ltdc: reset plane transparency after plane disable
+    - drm/amd/display: Check stream before comparing them
+    - drm/amd/display: Check link_res->hpo_dp_link_enc before using it
+    - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format
+      translation
+    - drm/amd/display: Fix index out of bounds in degamma hardware format
+      translation
+    - drm/amd/display: Fix index out of bounds in DCN30 color transformation
+    - drm/amd/display: Avoid overflow assignment in link_dp_cts
+    - drm/amd/display: Initialize get_bytes_per_element's default to 1
+    - drm/printer: Allow NULL data in devcoredump printer
+    - perf,x86: avoid missing caller address in stack traces captured in uprobe
+    - scsi: lpfc: Update PRLO handling in direct attached topology
+    - drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
+    - perf: Fix event_function_call() locking
+    - scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
+    - drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
+    - drm/amdgpu: Block MMR_READ IOCTL in reset
+    - drm/amdgpu/gfx9: use rlc safe mode for soft recovery
+    - drm/amd/pm: ensure the fw_info is not null before using it
+    - of/irq: Refer to actual buffer size in of_irq_parse_one()
+    - powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
+    - drm/amdgpu/gfx11: use rlc safe mode for soft recovery
+    - drm/amdgpu/gfx10: use rlc safe mode for soft recovery
+    - platform/x86: lenovo-ymc: Ignore the 0x0 state
+    - ksmbd: add refcnt to ksmbd_conn struct
+    - ksmbd: fix use-after-free in SMB request handling
+    - bpf: Make the pointer returned by iter next method valid
+    - ext4: ext4_search_dir should return a proper error
+    - ext4: avoid use-after-free in ext4_ext_show_leaf()
+    - ext4: fix i_data_sem unlock order in ext4_ind_migrate()
+    - bpftool: Fix undefined behavior caused by shifting into the sign bit
+    - iomap: handle a post-direct I/O invalidate race in
+      iomap_write_delalloc_release
+    - bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
+    - spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - spi: spi-cadence: Fix missing spi_controller_is_target() check
+    - selftest: hid: add missing run-hid-tools-tests.sh
+    - spi: s3c64xx: fix timeout counters in flush_fifo
+    - selftests: breakpoints: use remaining time to check if suspend succeed
+    - accel/ivpu: Add missing MODULE_FIRMWARE metadata
+    - spi: rpc-if: Add missing MODULE_DEVICE_TABLE
+    - perf: Really fix event_function_call() locking
+    - selftests: vDSO: fix vDSO name for powerpc
+    - selftests: vDSO: fix vdso_config for powerpc
+    - selftests: vDSO: fix vDSO symbols lookup for powerpc64
+    - powerpc/vdso: Flag VDSO64 entry points as functions
+    - selftests/mm: fix charge_reserved_hugetlb.sh test
+    - powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
+    - selftests: vDSO: fix ELF hash table entry size for s390x
+    - selftests: vDSO: fix vdso_config for s390
+    - Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
+    - platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
+    - i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
+    - i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
+    - i2c: xiic: Wait for TX empty to avoid missed TX NAKs
+    - media: i2c: ar0521: Use cansleep version of gpiod_set_value()
+    - i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
+    - i2c: designware: fix controller is holding SCL low while ENABLE bit is
+      disabled
+    - rust: sync: require `T: Sync` for `LockedBy::access`
+    - ovl: fail if trusted xattrs are needed but caller lacks permission
+    - firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
+    - memory: tegra186-emc: drop unused to_tegra186_emc()
+    - dt-bindings: clock: exynos7885: Fix duplicated binding
+    - spi: bcm63xx: Fix module autoloading
+    - spi: bcm63xx: Fix missing pm_runtime_disable()
+    - power: supply: hwmon: Fix missing temp1_max_alarm attribute
+    - perf/core: Fix small negative period being ignored
+    - parisc: Fix itlb miss handler for 64-bit programs
+    - drm/mediatek: ovl_adaptor: Add missing of_node_put()
+    - drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
+    - ALSA: hda/tas2781: Add new quirk for Lenovo Y990 Laptop
+    - ALSA: core: add isascii() check to card ID generator
+    - ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
+    - ALSA: usb-audio: Add native DSD support for Luxman D-08u
+    - ALSA: line6: add hw monitor volume control to POD HD500X
+    - ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
+    - ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
+    - ext4: correct encrypted dentry name hash when not casefolded
+    - ext4: fix slab-use-after-free in ext4_split_extent_at()
+    - ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
+    - ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible()
+    - ext4: dax: fix overflowing extents beyond inode size when partially writing
+    - ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
+    - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
+    - ext4: aovid use-after-free in ext4_ext_insert_extent()
+    - ext4: fix double brelse() the buffer of the extents path
+    - ext4: fix timer use-after-free on failed mount
+    - ext4: update orig_path in ext4_find_extent()
+    - ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
+    - ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list()
+    - ext4: fix fast commit inode enqueueing during a full journal commit
+    - ext4: use handle to mark fc as ineligible in __track_dentry_update()
+    - ext4: mark fc as ineligible using an handle in ext4_xattr_set()
+    - parisc: Fix 64-bit userspace syscall path
+    - parisc: Allow mmap(MAP_STACK) memory to automatically expand upwards
+    - parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
+    - drm/rockchip: vop: clear DMA stop bit on RK3066
+    - of: address: Report error on resource bounds overflow
+    - of/irq: Support #msi-cells=<0> in of_msi_get_domain
+    - drm: omapdrm: Add missing check for alloc_ordered_workqueue
+    - resource: fix region_intersects() vs add_memory_driver_managed()
+    - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
+    - jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
+    - mm: krealloc: consider spare memory for __GFP_ZERO
+    - mm: krealloc: Fix MTE false alarm in __do_krealloc
+    - ocfs2: fix the la space leak when unmounting an ocfs2 volume
+    - ocfs2: fix uninit-value in ocfs2_get_block()
+    - ocfs2: reserve space for inline xattr before attaching reflink tree
+    - ocfs2: cancel dqi_sync_work before freeing oinfo
+    - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
+    - ocfs2: fix null-ptr-deref when journal load failed.
+    - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
+    - arm64: fix selection of HAVE_DYNAMIC_FTRACE_WITH_ARGS
+    - arm64: Subscribe Microsoft Azure Cobalt 100 to erratum 3194386
+    - riscv: define ILLEGAL_POINTER_VALUE for 64bit
+    - [Config] updateconfigs to set ILLEGAL_POINTER_VALUE for riscv64
+    - exfat: fix memory leak in exfat_load_bitmap()
+    - perf python: Disable -Wno-cast-function-type-mismatch if present on clang
+    - perf hist: Update hist symbol when updating maps
+    - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
+    - nfsd: map the EBADMSG to nfserr_io to avoid warning
+    - NFSD: Fix NFSv4's PUTPUBFH operation
+    - i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver
+      Due to Race Condition
+    - RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page
+    - riscv: Fix kernel stack size when KASAN is enabled
+    - aoe: fix the potential use-after-free problem in more places
+    - media: ov5675: Fix power on/off delay timings
+    - clk: rockchip: fix error for unknown clocks
+    - remoteproc: k3-r5: Fix error handling when power-up failed
+    - clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
+    - media: sun4i_csi: Implement link validate for sun4i_csi subdev
+    - clk: qcom: gcc-sm8450: Do not turn off PCIe GDSCs during gdsc_disable()
+    - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
+    - clk: qcom: clk-rpmh: Fix overflow in BCM vote
+    - clk: samsung: exynos7885: Update CLKS_NR_FSYS after bindings fix
+    - clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src
+    - media: venus: fix use after free bug in venus_remove due to race condition
+    - clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
+    - media: qcom: camss: Remove use_count guard in stop_streaming
+    - media: qcom: camss: Fix ordering of pm_runtime_enable
+    - clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table
+    - clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL
+    - smb: client: use actual path when queryfs
+    - smb3: fix incorrect mode displayed for read-only files
+    - iio: magnetometer: ak8975: Fix reading for ak099xx sensors
+    - vrf: revert "vrf: Remove unnecessary RCU-bh critical section"
+    - gso: fix udp gso fraglist segmentation after pull from frag_list
+    - tomoyo: fallback to realpath if symlink's pathname does not exist
+    - net: stmmac: Fix zero-division error when disabling tc cbs
+    - rtc: at91sam9: fix OF node leak in probe() error path
+    - Input: adp5589-keys - fix NULL pointer dereference
+    - Input: adp5589-keys - fix adp5589_gpio_get_value()
+    - cachefiles: fix dentry leak in cachefiles_open_file()
+    - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
+    - btrfs: send: fix invalid clone operation for file that got its size
+      decreased
+    - btrfs: wait for fixup workers before stopping cleaner kthread during umount
+    - cpufreq: Avoid a bad reference count on CPU node
+    - gpio: davinci: fix lazy disable
+    - net: pcs: xpcs: fix the wrong register that was written back
+    - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
+    - mac802154: Fix potential RCU dereference issue in mac802154_scan_worker
+    - ceph: fix cap ref leak via netfs init_request
+    - tracing/hwlat: Fix a race during cpuhp processing
+    - tracing/timerlat: Drop interface_lock in stop_kthread()
+    - tracing/timerlat: Fix a race during cpuhp processing
+    - tracing/timerlat: Fix duplicated kthread creation due to CPU online/offline
+    - rtla: Fix the help text in osnoise and timerlat top tools
+    - drm/i915/gem: fix bitwise and logical AND mixup
+    - drm/sched: Add locking to drm_sched_entity_modify_sched
+    - drm/amd/display: Add HDR workaround for specific eDP
+    - cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock
+    - kconfig: qconf: fix buffer overflow in debug links
+    - platform/x86: x86-android-tablets: Fix use after free on
+      platform_device_register() errors
+    - i2c: core: Lock address during client device instantiation
+    - i2c: synquacer: Remove a clk reference from struct synquacer_i2c
+    - i2c: synquacer: Deal with optional PCLK correctly
+    - arm64: cputype: Add Neoverse-N3 definitions
+    - arm64: errata: Expand speculative SSBS workaround once more
+    - io_uring/net: harden multishot termination case for recv
+    - uprobes: fix kernel info leak via "[uprobes]" vma
+    - mm: z3fold: deprecate CONFIG_Z3FOLD
+    - [Config] updateconfigs for deprecated CONFIG_Z3FOLD
+    - drm/amd/display: Allow backlight to go below
+      `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT`
+    - build-id: require program headers to be right after ELF header
+    - lib/buildid: harden build ID parsing logic
+    - sched: psi: fix bogus pressure spikes from aggregation race
+    - net: mana: Enable MANA driver on ARM64 with 4K page size
+    - net: mana: Add support for page sizes other than 4KB on ARM64
+    - [Config] updateconfigs for MICROSOFT_MANA
+    - RDMA/mana_ib: use the correct page table index based on hardware page size
+    - media: imx335: Fix reset-gpio handling
+    - remoteproc: k3-r5: Acquire mailbox handle during probe routine
+    - remoteproc: k3-r5: Delay notification of wakeup event
+    - dt-bindings: clock: qcom: Add missing UFS QREF clocks
+    - dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
+    - iio: pressure: bmp280: Improve indentation and line wrapping
+    - iio: pressure: bmp280: Use BME prefix for BME280 specifics
+    - iio: pressure: bmp280: Fix regmap for BMP280 device
+    - iio: pressure: bmp280: Fix waiting time for BMP3xx configuration
+    - r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
+    - r8169: add tally counter fields added with RTL8125
+    - clk: qcom: gcc-sc8180x: Add GPLL9 support
+    - ACPI: battery: Simplify battery hook locking
+    - ACPI: battery: Fix possible crash when unregistering a battery hook
+    - btrfs: drop the backref cache during relocation if we commit
+    - drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
+    - rxrpc: Fix a race between socket set up and I/O thread creation
+    - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
+    - crypto: octeontx* - Select CRYPTO_AUTHENC
+    - drm/amd/display: Revert Avoid overflow assignment
+    - perf report: Fix segfault when 'sym' sort key is not used
+    - drm/amd/display: enable_hpo_dp_link_output: Check link_res->hpo_dp_link_enc
+      before using it
+    - Revert "ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path"
+    - perf python: Allow checking for the existence of warning options in clang
+    - drm/i915/dp: Fix AUX IO power enabling for eDP PSR
+    - drm/amd/display: handle nulled pipe context in DCE110's set_drr()
+    - selftests: netfilter: Add missing return value
+    - afs: Fix the setting of the server responding flag
+    - net: dsa: improve shutdown sequence
+    - bridge: mcast: Fail MDB get request on empty entry
+    - net/ncsi: Disable the ncsi work before freeing the associated structure
+    - drm/xe: Restore pci state upon resume
+    - drm/xe: Resume TDR after GT reset
+    - drm/xe: Prevent null pointer access in xe_migrate_copy
+    - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Go E1404GAB
+    - nvme-keyring: restrict match length for version '1' identifiers
+    - nvme-tcp: sanitize TLS key handling
+    - nvme-fabrics: typo in nvmf_parse_key()
+    - nvme-tcp: check for invalidated or revoked key
+    - net: fec: don't save PTP state if PTP is unsupported
+    - wifi: mac80211: fix RCU list iterations
+    - netdev-genl: Set extack and fix error on napi-get
+    - block: fix integer overflow in BLKSECDISCARD
+    - arm64: trans_pgd: mark PTEs entries as valid to avoid dead kexec()
+    - net: phy: Check for read errors in SIOCGMIIREG
+    - wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
+    - x86/bugs: Add missing NO_SSB flag
+    - x86/bugs: Fix handling when SRSO mitigation is disabled
+    - net: napi: Prevent overflow of napi_defer_hard_irqs
+    - crypto: hisilicon - fix missed error branch
+    - ALSA: usb-audio: Add quirk for RME Digiface USB
+    - ALSA: usb-audio: Add mixer quirk for RME Digiface USB
+    - ALSA: control: Use automatic cleanup of kfree()
+    - ALSA: control: Fix unannotated kfree() cleanup
+    - ALSA: control: Use guard() for locking
+    - ALSA: control: Take power_ref lock primarily
+    - x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
+    - ASoC: Intel: boards: always check the result of
+      acpi_dev_get_first_match_dev()
+    - rcu-tasks: Add data to eliminate RCU-tasks/do_exit() deadlocks
+    - rcu-tasks: Initialize data to eliminate RCU-tasks/do_exit() deadlocks
+    - rcu-tasks: Fix access non-existent percpu rtpcp variable in
+      rcu_tasks_need_gpcb()
+    - pmdomain: core: Don't hold the genpd-lock when calling dev_pm_domain_set()
+    - iommu/vt-d: Unconditionally flush device TLB for pasid table updates
+    - iommu/arm-smmu-v3: Do not use devm for the cd table allocations
+    - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
+    - drm/amd/display: Check null pointers before using them
+    - drm/amd/display: Add null check for head_pipe in
+      dcn201_acquire_free_pipe_for_layer
+    - drm/amd/display: Add null check for head_pipe in
+      dcn32_acquire_idle_pipe_for_head_pipe_in_layer
+    - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in
+      dcn30_init_hw
+    - drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
+    - drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces
+    - scsi: smartpqi: Add new controller PCI IDs
+    - drm/amd/display: Add NULL check for function pointer in
+      dcn20_set_output_transfer_func
+    - drm/amd/display: Add NULL check for function pointer in
+      dcn32_set_output_transfer_func
+    - scsi: smartpqi: add new controller PCI IDs
+    - drm/amd/display: Check null-initialized variables
+    - drm/amd/display: Check phantom_stream before it is used
+    - drm/amdgpu/gfx9: properly handle error ints on all pipes
+    - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata
+      paths
+    - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached
+      topology
+    - drm/amdgpu: check PS, WS index
+    - drm/amdgpu: fix wrong sizeof argument
+    - drm/amdgpu: fix unchecked return value warning for amdgpu_atombios
+    - drm/amdgpu/gfx11: enter safe mode before touching CP_INT_CNTL
+    - drm/xe: Invert page fault queue head / tail
+    - drm/xe: Add helper macro to loop each DSS
+    - drm/xe: fix multicast support for Xe_LP platforms
+    - drm/xe: Use topology to determine page fault queue size
+    - drm/xe: Drop warn on xe_guc_pc_gucrc_disable in guc pc fini
+    - ovl: fsync after metadata copy-up
+    - HID: i2c-hid: ensure various commands do not interfere with each other
+    - platform/mellanox: mlxbf-pmc: Replace uintN_t with kernel-style types
+    - platform/mellanox: mlxbf-pmc: Cleanup signed/unsigned mix-up
+    - platform/mellanox: mlxbf-pmc: fix signedness bugs
+    - platform/mellanox: mlxbf-pmc: fix lockdep warning
+    - bpf: Fix a sdiv overflow issue
+    - ALSA: control: Fix power_ref lock order for compat code, too
+    - perf callchain: Fix stitch LBR memory leaks
+    - drm/xe: fixup xe_alloc_pf_queue
+    - drm/xe: Fix memory leak on xe_alloc_pf_queue failure
+    - nvme-tcp: fix link failure for TCP auth
+    - f2fs: fix zoned block device information initialization
+    - f2fs: add write priority option based on zone UFS
+    - f2fs: make BG GC more aggressive for zoned devices
+    - f2fs: introduce migration_window_granularity
+    - f2fs: increase BG GC migration window granularity when boosted for zoned
+      devices
+    - f2fs: do FG_GC when GC boosting is required for zoned devices
+    - f2fs: forcibly migrate to secure space for zoned device file pinning
+    - mm, slub: avoid zeroing kmalloc redzone
+    - drm/v3d: Prevent out of bounds access in performance query extensions
+    - ext4: fix access to uninitialised lock in fc replay path
+    - ext4: fix off by one issue in alloc_flex_gd()
+    - scripts/gdb: add iteration function for rbtree
+    - scripts/gdb: fix lx-mounts command error
+    - sched/deadline: Comment sched_dl_entity::dl_server variable
+    - sched/core: Add clearing of ->dl_server in put_prev_task_balance()
+    - sched/core: Clear prev->dl_server in CFS pick fast path
+    - drivers/perf: riscv: Align errno for unsupported perf event
+    - ACPI: resource: Remove duplicate Asus E1504GAB IRQ override
+    - ACPI: resource: Loosen the Asus E1404GAB DMI match to also cover the E1404GA
+    - ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
+    - ACPI: resource: Add Asus ExpertBook B2502CVA to
+      irq1_level_low_skip_override[]
+    - firmware/sysfb: Disable sysfb for firmware buffers with unknown parent
+    - close_range(): fix the logics in descriptor table trimming
+    - drm/sched: Fix dynamic job-flow control race
+    - drm/sched: Always wake up correct scheduler in drm_sched_entity_push_job
+    - drm/sched: Always increment correct scheduler score
+    - drm/xe: Delete unused GuC submission_state.suspend
+    - drm/xe: Use ordered wq for preempt fence waiting
+    - drm/xe: fix UAF around queue destruction
+    - sunrpc: change sp_nrthreads from atomic_t to unsigned int.
+    - NFSD: Async COPY result needs to return a write verifier
+    - NFSD: Limit the number of concurrent async COPY operations
+    - NFSD: Initialize struct nfsd4_copy earlier
+    - NFSD: Never decrement pending_async_copies on error
+    - drm/sched: revert "Always increment correct scheduler score"
+    - ALSA: control: Fix leftover snd_power_unref()
+    - Upstream stable to v6.6.55, v6.10.14
+  * By always inlining _compound_head(), clone() sees 3%+ performance increase
+    (LP: #2089327)
+    - mm: always inline _compound_head() with
+      CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+  * Random flickering with Intel i915 (Comet Lake and Kaby Lake) on Linux 6.8+
+    (LP: #2086587)
+    - SAUCE: iommu/intel: disable DMAR for KBL and CML integrated gfx
+  * Add list of source files to linux-buildinfo (LP: #2086606)
+    - [Packaging] Sort build dependencies alphabetically
+    - [Packaging] Add list of used source files to buildinfo package
+  * UFS: uspi->s_3apb UBSAN: shift-out-of-bounds (LP: #2087853)
+    - ufs: ufs_sb_private_info: remove unused s_{2, 3}apb fields
+  * Mute/mic LEDs don't function on HP EliteBook 645 G10 (LP: #2087983)
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP EliteBook 645 G10
+  * Noble update: upstream stable patchset 2024-11-22 (LP: #2089340)
+    - EDAC/synopsys: Fix ECC status and IRQ control race condition
+    - EDAC/synopsys: Fix error injection on Zynq UltraScale+
+    - wifi: rtw88: always wait for both firmware loading attempts
+    - crypto: xor - fix template benchmarking
+    - ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
+    - wifi: brcmfmac: export firmware interface functions
+    - wifi: brcmfmac: introducing fwil query functions
+    - wifi: ath9k: Remove error checks when creating debugfs entries
+    - wifi: ath12k: fix BSS chan info request WMI command
+    - wifi: ath12k: match WMI BSS chan info structure with firmware definition
+    - wifi: ath12k: fix invalid AMPDU factor calculation in
+      ath12k_peer_assoc_h_he()
+    - net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
+    - arm64: signal: Fix some under-bracketed UAPI macros
+    - wifi: rtw88: remove CPT execution branch never used
+    - RISC-V: KVM: Fix sbiret init before forwarding to userspace
+    - RISC-V: KVM: Allow legacy PMU access from guest
+    - RISC-V: KVM: Fix to allow hpmcounter31 from the guest
+    - mount: handle OOM on mnt_warn_timestamp_expiry
+    - ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros
+    - powercap: intel_rapl: Fix off by one in get_rpi()
+    - kselftest/arm64: signal: fix/refactor SVE vector length enumeration
+    - drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
+    - wifi: mac80211: don't use rate mask for offchannel TX either
+    - wifi: iwlwifi: remove AX101, AX201 and AX203 support from LNL
+    - wifi: iwlwifi: config: label 'gl' devices as discrete
+    - wifi: iwlwifi: mvm: increase the time between ranging measurements
+    - padata: Honor the caller's alignment in case of chunk_size 0
+    - drivers/perf: hisi_pcie: Record hardware counts correctly
+    - drivers/perf: hisi_pcie: Fix TLP headers bandwidth counting
+    - kselftest/arm64: Actually test SME vector length changes via sigreturn
+    - can: j1939: use correct function name in comment
+    - ACPI: CPPC: Fix MASK_VAL() usage
+    - netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
+    - netfilter: nf_tables: reject element expiration with no timeout
+    - netfilter: nf_tables: reject expiration higher than timeout
+    - netfilter: nf_tables: remove annotation to access set timeout while holding
+      lock
+    - perf/arm-cmn: Improve debugfs pretty-printing for large configs
+    - perf/arm-cmn: Refactor node ID handling. Again.
+    - perf/arm-cmn: Fix CCLA register offset
+    - perf/arm-cmn: Ensure dtm_idx is big enough
+    - cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
+    - wifi: mt76: mt7915: fix oops on non-dbdc mt7986
+    - wifi: mt76: mt7996: use hweight16 to get correct tx antenna
+    - wifi: mt76: mt7996: fix traffic delay when switching back to working channel
+    - wifi: mt76: mt7996: fix wmm set of station interface to 3
+    - wifi: mt76: mt7996: fix HE and EHT beamforming capabilities
+    - wifi: mt76: mt7996: fix EHT beamforming capability check
+    - x86/sgx: Fix deadlock in SGX NUMA node search
+    - pm:cpupower: Add missing powercap_set_enabled() stub function
+    - crypto: hisilicon/hpre - mask cluster timeout error
+    - crypto: hisilicon/qm - reset device before enabling it
+    - crypto: hisilicon/qm - inject error before stopping queue
+    - wifi: mt76: mt7603: fix mixed declarations and code
+    - wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
+    - wifi: mt76: mt7915: fix rx filter setting for bfee functionality
+    - wifi: mt76: mt7996: ensure 4-byte alignment for beacon commands
+    - wifi: mt76: mt7996: fix uninitialized TLV data
+    - wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
+    - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
+    - wifi: wilc1000: fix potential RCU dereference issue in
+      wilc_parse_join_bss_param
+    - Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
+    - Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
+    - sock_map: Add a cond_resched() in sock_hash_free()
+    - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
+    - can: m_can: enable NAPI before enabling interrupts
+    - can: m_can: m_can_close(): stop clocks after device has been shut down
+    - Bluetooth: btusb: Fix not handling ZPL/short-transfer
+    - bareudp: Pull inner IP header in bareudp_udp_encap_recv().
+    - bareudp: Pull inner IP header on xmit.
+    - net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
+    - net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
+    - net: tipc: avoid possible garbage value
+    - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
+    - ublk: move zone report data out of request pdu
+    - nbd: fix race between timeout and normal completion
+    - block, bfq: fix possible UAF for bfqq->bic with merge chain
+    - block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
+    - block, bfq: don't break merge chain in bfq_split_bfqq()
+    - cachefiles: Fix non-taking of sb_writers around set/removexattr
+    - erofs: fix incorrect symlink detection in fast symlink
+    - block, bfq: fix uaf for accessing waker_bfqq after splitting
+    - block, bfq: fix procress reference leakage for bfqq in merge chain
+    - io_uring/io-wq: do not allow pinning outside of cpuset
+    - io_uring/io-wq: inherit cpuset of cgroup in io worker
+    - block: fix potential invalid pointer dereference in blk_add_partition
+    - spi: ppc4xx: handle irq_of_parse_and_map() errors
+    - arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
+    - arm64: dts: mediatek: mt8186: Fix supported-hw mask for GPU OPPs
+    - firmware: arm_scmi: Fix double free in OPTEE transport
+    - spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
+    - regulator: Return actual error in of_regulator_bulk_get_all()
+    - arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
+    - arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
+    - arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
+    - ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
+    - arm64: dts: rockchip: Correct vendor prefix for Hardkernel ODROID-M1
+    - arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
+    - arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations
+    - spi: bcmbca-hsspi: Fix missing pm_runtime_disable()
+    - ARM: dts: microchip: sama7g5: Fix RTT clock
+    - ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
+    - ARM: versatile: fix OF node leak in CPUs prepare
+    - reset: berlin: fix OF node leak in probe() error path
+    - reset: k210: fix OF node leak in probe() error path
+    - clocksource/drivers/qcom: Add missing iounmap() on errors in
+      msm_dt_timer_init()
+    - arm64: dts: mediatek: mt8195: Correct clock order for dp_intf*
+    - x86/mm: Use IPIs to synchronize LAM enablement
+    - ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the error
+    - ASoC: tas2781: remove unused acpi_subysystem_id
+    - ASoC: tas2781: Use of_property_read_reg()
+    - ASoC: tas2781-i2c: Drop weird GPIO code
+    - ASoC: tas2781-i2c: Get the right GPIO line
+    - selftests/ftrace: Add required dependency for kprobe tests
+    - ALSA: hda: cs35l41: fix module autoloading
+    - m68k: Fix kernel_clone_args.flags in m68k_clone()
+    - ASoC: loongson: fix error release
+    - hwmon: (max16065) Fix overflows seen when writing limits
+    - hwmon: (max16065) Remove use of i2c_match_id()
+    - hwmon: (max16065) Fix alarm attributes
+    - mtd: slram: insert break after errors in parsing the map
+    - hwmon: (ntc_thermistor) fix module autoloading
+    - power: supply: axp20x_battery: Remove design from min and max voltage
+    - power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
+    - fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
+    - iommu/amd: Do not set the D bit on AMD v2 table entries
+    - mtd: powernv: Add check devm_kasprintf() returned value
+    - rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
+    - mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
+    - mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
+    - mtd: rawnand: mtk: Fix init error path
+    - iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
+    - iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K pages
+    - iommu/arm-smmu-qcom: apply num_context_bank fixes for SDM630 / SDM660
+    - pmdomain: core: Harden inter-column space in debug summary
+    - drm/stm: Fix an error handling path in stm_drm_platform_probe()
+    - drm/stm: ltdc: check memory returned by devm_kzalloc()
+    - drm/amd/display: Add null check for set_output_gamma in
+      dcn30_set_output_transfer_func
+    - drm/amdgpu: properly handle vbios fake edid sizing
+    - drm/radeon: properly handle vbios fake edid sizing
+    - scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly
+    - scsi: NCR5380: Check for phase match during PDMA fixup
+    - drm/amd/amdgpu: Properly tune the size of struct
+    - drm/rockchip: vop: Allow 4096px width scaling
+    - drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
+    - drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
+    - drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()
+    - drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
+    - scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
+    - jfs: fix out-of-bounds in dbNextAG() and diAlloc()
+    - drm/mediatek: Fix missing configuration flags in mtk_crtc_ddp_config()
+    - drm/mediatek: Use spin_lock_irqsave() for CRTC event lock
+    - powerpc/8xx: Fix initial memory mapping
+    - powerpc/8xx: Fix kernel vs user address comparison
+    - powerpc/vdso: Inconditionally use CFUNC macro
+    - drm/msm: Fix incorrect file name output in adreno_request_fw()
+    - drm/msm/a5xx: disable preemption in submits by default
+    - drm/msm/a5xx: properly clear preemption records on resume
+    - drm/msm/a5xx: fix races in preemption evaluation stage
+    - drm/msm/a5xx: workaround early ring-buffer emptiness check
+    - ipmi: docs: don't advertise deprecated sysfs entries
+    - drm/msm/dsi: correct programming sequence for SM8350 / SM8450
+    - drm/msm: fix %s null argument error
+    - drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
+    - xen: use correct end address of kernel for conflict checking
+    - HID: wacom: Support sequence numbers smaller than 16-bit
+    - HID: wacom: Do not warn about dropped packets for first packet
+    - ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data
+    - minmax: avoid overly complex min()/max() macro arguments in xen
+    - xen: introduce generic helper checking for memory map conflicts
+    - xen: move max_pfn in xen_memory_setup() out of function scope
+    - xen: add capability to remap non-RAM pages to different PFNs
+    - xen: tolerate ACPI NVS memory overlapping with Xen allocated memory
+    - xen/swiotlb: add alignment check for dma buffers
+    - xen/swiotlb: fix allocated size
+    - tpm: Clean up TPM space after command failure
+    - sched/fair: Make SCHED_IDLE entity be preempted in strict hierarchy
+    - selftests/bpf: Workaround strict bpf_lsm return value check.
+    - selftests/bpf: Fix error linking uprobe_multi on mips
+    - bpf: Use -Wno-error in certain tests when building with GCC
+    - bpf: Disable some `attribute ignored' warnings in GCC
+    - bpf: Temporarily define BPF_NO_PRESEVE_ACCESS_INDEX for GCC
+    - selftests/bpf: Add CFLAGS per source file and runner
+    - selftests/bpf: Fix wrong binary in Makefile log output
+    - tools/runqslower: Fix LDFLAGS and add LDLIBS support
+    - selftests/bpf: Use pid_t consistently in test_progs.c
+    - selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
+    - selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc
+    - selftests/bpf: Drop unneeded error.h includes
+    - selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
+    - selftests/bpf: Fix missing UINT_MAX definitions in benchmarks
+    - selftests/bpf: Fix missing BUILD_BUG_ON() declaration
+    - selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test
+    - selftests/bpf: Refactor out some functions in ns_current_pid_tgid test
+    - selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test
+    - selftests/bpf: Fix include of <sys/fcntl.h>
+    - selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc
+    - selftests/bpf: Fix compiling kfree_skb.c with musl-libc
+    - selftests/bpf: Fix compiling flow_dissector.c with musl-libc
+    - selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
+    - selftests/bpf: Fix compiling core_reloc.c with musl-libc
+    - selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc
+    - selftests/bpf: Fix errors compiling decap_sanity.c with musl libc
+    - selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
+    - selftests/bpf: Fix arg parsing in veristat, test_progs
+    - selftests/bpf: Fix error compiling test_lru_map.c
+    - selftests/bpf: Fix C++ compile error from missing _Bool type
+    - selftests/bpf: Fix flaky selftest lwt_redirect/lwt_reroute
+    - selftests/bpf: Fix redefinition errors compiling lwt_reroute.c
+    - selftests/bpf: Fix compile if backtrace support missing in libc
+    - selftests/bpf: Fix error compiling tc_redirect.c with musl libc
+    - samples/bpf: Fix compilation errors with cf-protection option
+    - bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
+    - xz: cleanup CRC32 edits from 2018
+    - kthread: fix task state in kthread worker if being frozen
+    - ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
+    - smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
+    - ext4: avoid buffer_head leak in ext4_mark_inode_used()
+    - ext4: avoid potential buffer_head leak in __ext4_new_inode()
+    - ext4: avoid negative min_clusters in find_group_orlov()
+    - ext4: return error on ext4_find_inline_entry
+    - ext4: avoid OOB when system.data xattr changes underneath the filesystem
+    - ext4: check stripe size compatibility on remount as well
+    - sched/numa: Fix the vma scan starving issue
+    - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
+    - nilfs2: determine empty node blocks as corrupted
+    - nilfs2: fix potential oob read in nilfs_btree_check_delete()
+    - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
+    - bpf: Fix helper writes to read-only maps
+    - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
+    - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
+    - perf mem: Free the allocated sort string, fixing a leak
+    - perf inject: Fix leader sampling inserting additional samples
+    - perf report: Fix --total-cycles --stdio output error
+    - perf sched timehist: Fix missing free of session in perf_sched__timehist()
+    - perf stat: Display iostat headers correctly
+    - perf sched timehist: Fixed timestamp error when unable to confirm event
+      sched_in time
+    - perf time-utils: Fix 32-bit nsec parsing
+    - clk: imx: clk-audiomix: Correct parent clock for earc_phy and audpll
+    - clk: imx: imx6ul: fix default parent for enet*_ref_sel
+    - clk: imx: composite-8m: Less function calls in __imx8m_clk_hw_composite()
+      after error detection
+    - clk: imx: composite-8m: Enable gate clk with mcore_booted
+    - clk: imx: composite-93: keep root clock on when mcore enabled
+    - clk: imx: composite-7ulp: Check the PCC present bit
+    - clk: imx: fracn-gppll: fix fractional part of PLL getting lost
+    - clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
+    - clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
+    - clk: imx: imx8qxp: Parent should be initialized earlier than the clock
+    - remoteproc: imx_rproc: Correct ddr alias for i.MX8M
+    - remoteproc: imx_rproc: Initialize workqueue earlier
+    - clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
+    - clk: qcom: dispcc-sm8550: fix several supposed typos
+    - clk: qcom: dispcc-sm8550: use rcg2_ops for mdss_dptx1_aux_clk_src
+    - clk: qcom: dispcc-sm8650: Update the GDSC flags
+    - clk: qcom: dispcc-sm8550: use rcg2_shared_ops for ESC RCGs
+    - leds: bd2606mvv: Fix device child node usage in bd2606mvv_probe()
+    - pinctrl: ti: iodelay: Use scope based of_node_put() cleanups
+    - pinctrl: ti: ti-iodelay: Fix some error handling paths
+    - Input: ilitek_ts_i2c - avoid wrong input subsystem sync
+    - Input: ilitek_ts_i2c - add report id message validation
+    - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
+    - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
+    - PCI: Wait for Link before restoring Downstream Buses
+    - firewire: core: correct range of block for case of switch statement
+    - PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
+    - clk: qcom: ipq5332: Register gcc_qdss_tsctr_clk_src
+    - clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL
+    - leds: leds-pca995x: Add support for NXP PCA9956B
+    - leds: pca995x: Use device_for_each_child_node() to access device child nodes
+    - leds: pca995x: Fix device child node usage in pca995x_probe()
+    - x86/PCI: Check pcie_find_root_port() return for NULL
+    - nvdimm: Fix devs leaks in scan_labels()
+    - PCI: xilinx-nwl: Fix register misspelling
+    - PCI: xilinx-nwl: Clean up clock on probe failure/removal
+    - media: platform: rzg2l-cru: rzg2l-csi2: Add missing MODULE_DEVICE_TABLE
+    - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
+    - pinctrl: single: fix missing error code in pcs_probe()
+    - clk: at91: sama7g5: Allocate only the needed amount of memory for PLLs
+    - media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
+    - media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
+    - media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
+    - RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer
+    - RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
+    - clk: ti: dra7-atl: Fix leak of of_nodes
+    - clk: starfive: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync()
+      usage
+    - clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p
+    - nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
+    - nfsd: fix refcount leak when file is unhashed after being found
+    - pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
+    - IB/core: Fix ib_cache_setup_one error flow cleanup
+    - PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
+    - RDMA/erdma: Return QP state in erdma_query_qp
+    - RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache
+    - watchdog: imx_sc_wdt: Don't disable WDT in suspend
+    - RDMA/hns: Don't modify rq next block addr in HIP09 QPC
+    - RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
+    - RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
+    - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
+    - RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
+    - RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
+    - RDMA/hns: Optimize hem allocation performance
+    - RDMA/hns: Fix restricted __le16 degrades to integer issue
+    - RDMA/mlx5: Obtain upper net device only when needed
+    - riscv: Fix fp alignment bug in perf_callchain_user()
+    - RDMA/cxgb4: Added NULL check for lookup_atid
+    - RDMA/irdma: fix error message in irdma_modify_qp_roce()
+    - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
+    - ntb_perf: Fix printk format
+    - ntb: Force physically contiguous allocation of rx ring buffers
+    - nfsd: call cache_put if xdr_reserve_space returns NULL
+    - nfsd: return -EINVAL when namelen is 0
+    - crypto: caam - Pad SG length when allocating hash edesc
+    - crypto: powerpc/p10-aes-gcm - Disable CRYPTO_AES_GCM_P10
+    - f2fs: atomic: fix to avoid racing w/ GC
+    - f2fs: reduce expensive checkpoint trigger frequency
+    - f2fs: fix to avoid racing in between read and OPU dio write
+    - f2fs: Create COW inode from parent dentry for atomic write
+    - f2fs: fix to wait page writeback before setting gcing flag
+    - f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation
+    - f2fs: support .shutdown in f2fs_sops
+    - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
+    - f2fs: compress: don't redirty sparse cluster during {,de}compress
+    - f2fs: prevent atomic file from being dirtied before commit
+    - f2fs: get rid of online repaire on corrupted directory
+    - f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()
+    - spi: atmel-quadspi: Undo runtime PM changes at driver exit time
+    - spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
+    - lib/sbitmap: define swap_lock as raw_spinlock_t
+    - spi: atmel-quadspi: Avoid overwriting delay register settings
+    - nvme-multipath: system fails to create generic nvme device
+    - iio: adc: ad7606: fix oversampling gpio array
+    - iio: adc: ad7606: fix standby gpio state to match the documentation
+    - driver core: Fix error handling in driver API device_rename()
+    - ABI: testing: fix admv8818 attr description
+    - iio: chemical: bme680: Fix read/write ops to device by adding mutexes
+    - iio: magnetometer: ak8975: drop incorrect AK09116 compatible
+    - dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible
+    - driver core: Fix a potential null-ptr-deref in module_add_driver()
+    - serial: 8250: omap: Cleanup on error in request_irq
+    - coresight: tmc: sg: Do not leak sg_table
+    - interconnect: icc-clk: Add missed num_nodes initialization
+    - cxl/pci: Fix to record only non-zero ranges
+    - vhost_vdpa: assign irq bypass producer token correctly
+    - ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
+    - Revert "dm: requeue IO if mapping table not yet available"
+    - net: xilinx: axienet: Schedule NAPI in two steps
+    - net: xilinx: axienet: Fix packet counting
+    - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
+    - net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race
+      Condition
+    - net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
+    - tcp: check skb is non-NULL in tcp_rto_delta_us()
+    - net: qrtr: Update packets cloning when broadcasting
+    - bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
+    - virtio_net: Fix mismatched buf address when unmapping for small packets
+    - netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
+    - netfilter: ctnetlink: compile ctnetlink_label_size with
+      CONFIG_NF_CONNTRACK_EVENTS
+    - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump
+      path
+    - io_uring/sqpoll: do not allow pinning outside of cpuset
+    - io_uring: check for presence of task_work rather than TIF_NOTIFY_SIGNAL
+    - mm: call the security_mmap_file() LSM hook in remap_file_pages()
+    - drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
+    - Revert "net: libwx: fix alloc msix vectors failed"
+    - xen: move checks for e820 conflicts further up
+    - xen: allow mapping ACPI data using a different physical address
+    - io_uring/sqpoll: retain test for whether the CPU is valid
+    - io_uring/sqpoll: do not put cpumask on stack
+    - Remove *.orig pattern from .gitignore
+    - PCI: Revert to the original speed after PCIe failed link retraining
+    - PCI: Clear the LBMS bit after a link retrain
+    - PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ
+    - PCI: imx6: Fix missing call to phy_power_off() in error handling
+    - PCI: Correct error reporting with PCIe failed link retraining
+    - PCI: Use an error code with PCIe failed link retraining
+    - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
+    - Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible"
+    - ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
+    - soc: fsl: cpm1: tsa: Fix tsa_write8()
+    - soc: versatile: integrator: fix OF node leak in probe() error path
+    - Revert "media: tuners: fix error return code of
+      hybrid_tuner_request_state()"
+    - iommufd: Protect against overflow of ALIGN() during iova allocation
+    - Input: adp5588-keys - fix check on return code
+    - Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
+    - Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
+    - Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
+    - KVM: arm64: Add memory length checks and remove inline in do_ffa_mem_xfer
+    - KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits
+    - KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode()
+    - KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock
+    - drm/amd/display: Add HDMI DSC native YCbCr422 support
+    - drm/amd/display: Round calculated vtotal
+    - drm/amd/display: Validate backlight caps are sane
+    - KEYS: prevent NULL pointer dereference in find_asymmetric_key()
+    - powerpc/atomic: Use YZ constraints for DS-form instructions
+    - fs: Create a generic is_dot_dotdot() utility
+    - ksmbd: make __dir_empty() compatible with POSIX
+    - ksmbd: allow write with FILE_APPEND_DATA
+    - ksmbd: handle caseless file creation
+    - ata: libata-scsi: Fix ata_msense_control() CDL page reporting
+    - scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
+    - scsi: ufs: qcom: Update MODE_MAX cfg_bw value
+    - scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages
+    - scsi: mac_scsi: Refactor polling loop
+    - scsi: mac_scsi: Disallow bus errors during PDMA send
+    - can: esd_usb: Remove CAN_CTRLMODE_3_SAMPLES for CAN-USB/3-FD
+    - wifi: rtw88: Fix USB/SDIO devices not transmitting beacons
+    - usbnet: fix cyclical race on disconnect with work queue
+    - USB: appledisplay: close race between probe and completion handler
+    - USB: misc: cypress_cy7c63: check for short transfer
+    - USB: class: CDC-ACM: fix race between get_serial and set_serial
+    - usb: cdnsp: Fix incorrect usb_request status
+    - usb: dwc2: drd: fix clock gating on USB role switch
+    - bus: integrator-lm: fix OF node leak in probe()
+    - bus: mhi: host: pci_generic: Fix the name for the Telit FE990A
+    - firmware_loader: Block path traversal
+    - tty: rp2: Fix reset with non forgiving PCIe host bridges
+    - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
+    - serial: qcom-geni: fix fifo polling timeout
+    - crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
+    - drbd: Fix atomicity violation in drbd_uuid_set_bm()
+    - drbd: Add NULL check for net_conf to prevent dereference in state validation
+    - ACPI: sysfs: validate return type of _STR method
+    - ACPI: resource: Add another DMI match for the TongFang GMxXGxx
+    - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
+    - perf/x86/intel/pt: Fix sampling synchronization
+    - wifi: mt76: mt7921: Check devm_kasprintf() returned value
+    - wifi: mt76: mt7915: check devm_kasprintf() returned value
+    - wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he
+    - wifi: rtw88: 8821cu: Remove VID/PID 0bda:c82c
+    - wifi: rtw88: 8822c: Fix reported RX band width
+    - wifi: mt76: mt7615: check devm_kasprintf() returned value
+    - debugobjects: Fix conditions in fill_pool()
+    - btrfs: tree-checker: fix the wrong output of data backref objectid
+    - btrfs: always update fstrim_range on failure in FITRIM ioctl
+    - f2fs: fix several potential integer overflows in file offsets
+    - f2fs: prevent possible int overflow in dir_block_index()
+    - f2fs: avoid potential int overflow in sanity_check_area_boundary()
+    - f2fs: Require FMODE_WRITE for atomic write ioctls
+    - f2fs: fix to check atomic_file in f2fs ioctl interfaces
+    - hwrng: mtk - Use devm_pm_runtime_enable
+    - hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init
+    - hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
+    - arm64: esr: Define ESR_ELx_EC_* constants as UL
+    - arm64: errata: Enable the AC03_CPU_38 workaround for ampere1a
+    - arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
+    - arm64: dts: qcom: sa8775p: Mark APPS and PCIe SMMUs as DMA coherent
+    - arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
+    - vfs: fix race between evice_inodes() and find_inode()&iput()
+    - fs: Fix file_set_fowner LSM hook inconsistencies
+    - nfs: fix memory leak in error path of nfs4_do_reclaim
+    - EDAC/igen6: Fix conversion of system address to physical memory address
+    - icmp: change the order of rate limits
+    - cpuidle: riscv-sbi: Use scoped device node handling to fix missing
+      of_node_put
+    - padata: use integer wrap around to prevent deadlock on seq_nr overflow
+    - spi: fspi: involve lut_num for struct nxp_fspi_devtype_data
+    - ARM: dts: imx6ul-geam: fix fsl,pins property in tscgrp pinctrl
+    - soc: versatile: realview: fix memory leak during device remove
+    - soc: versatile: realview: fix soc_dev leak during device remove
+    - USB: misc: yurex: fix race between read and write
+    - xhci: Add a quirk for writing ERST in high-low order
+    - usb: xhci: fix loss of data on Cadence xHC
+    - pps: remove usage of the deprecated ida_simple_xx() API
+    - pps: add an error check in parport_attach
+    - serial: don't use uninitialized value in uart_poll_init()
+    - x86/idtentry: Incorporate definitions/declarations of the FRED entries
+    - x86/entry: Remove unwanted instrumentation in common_interrupt()
+    - lib/bitmap: add bitmap_{read,write}()
+    - btrfs: subpage: fix the bitmap dump which can cause bitmap corruption
+    - btrfs: fix race setting file private on concurrent lseek using same fd
+    - dt-bindings: spi: nxp-fspi: support i.MX93 and i.MX95
+    - dt-bindings: spi: nxp-fspi: add imx8ulp support
+    - thunderbolt: Improve DisplayPort tunnel setup process to be more robust
+    - bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0
+    - dm-verity: restart or panic on an I/O error
+    - lockdep: fix deadlock issue between lockdep and rcu
+    - mm: only enforce minimum stack gap size if it's sensible
+    - spi: fspi: add support for imx8ulp
+    - module: Fix KCOV-ignored file name
+    - mm/damon/vaddr: protect vma traversal in __damon_va_thre_regions() with rcu
+      read lock
+    - i2c: aspeed: Update the stop sw state when the bus recovery occurs
+    - i2c: isch: Add missed 'else'
+    - Documentation: KVM: fix warning in "make htmldocs"
+    - bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
+    - wifi: brcmfmac: add linefeed at end of file
+    - x86/tdx: Fix "in-kernel MMIO" check
+    - spi: atmel-quadspi: Fix wrong register value written to MR
+    - Revert: "dm-verity: restart or panic on an I/O error"
+    - wifi: ath11k: use work queue to process beacon tx event
+    - crypto: qat - disable IOV in adf_dev_stop()
+    - crypto: qat - fix recovery flow for VFs
+    - crypto: qat - ensure correct order in VF restarting handler
+    - crypto: iaa - Fix potential use after free bug
+    - autofs: fix missing fput for FSCONFIG_SET_FD
+    - arm64: smp: smp_send_stop() and crash_smp_send_stop() should try non-NMI
+      first
+    - thermal: core: Fold two functions into their respective callers
+    - thermal: core: Fix rounding of delay jiffies
+    - perf/dwc_pcie: Fix registration issue in multi PCIe controller instances
+    - perf/dwc_pcie: Always register for PCIe bus notifier
+    - ACPI: video: force native for some T2 macbooks
+    - ACPI: video: force native for Apple MacbookPro9,2
+    - wifi: cfg80211: fix bug of mapping AF3x to incorrect User Priority
+    - wifi: mac80211: fix the comeback long retry times
+    - ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
+    - ACPICA: executer/exsystem: Don't nag user about every Stall() violating the
+      spec
+    - netfilter: nft_dynset: annotate data-races around set timeout
+    - wifi: mt76: mt7921: fix wrong UNII-4 freq range check for the channel usage
+    - crypto: ccp - do not request interrupt on cmd completion when irqs disabled
+    - wifi: mt76: connac: fix checksum offload fields of connac3 RXD
+    - net: hsr: Use the seqnr lock for frames received via interlink port.
+    - crypto: n2 - Set err to EINVAL if snprintf fails for hmac
+    - firmware: qcom: scm: Disable SDI and write no dump to dump mode
+    - arm64: dts: renesas: r9a08g045: Correct GICD and GICR sizes
+    - arm64: tegra: Correct location of power-sensors for IGX Orin
+    - arm64: dts: ti: k3-am654-idk: Fix dtbs_check warning in ICSSG dmas
+    - selftests/ftrace: Fix eventfs ownership testcase to find mount point
+    - iommu/amd: Introduce struct protection_domain.pd_mode
+    - iommu/amd: Allocate the page table root using GFP_KERNEL
+    - iommu/amd: Convert comma to semicolon
+    - platform/x86: ideapad-laptop: Make the scope_guard() clear of its scope
+    - kselftest: dt: Ignore nodes that have ancestors disabled
+    - bpf, x64: Fix tailcall hierarchy
+    - bpf, lsm: Add check for BPF LSM return value
+    - bpf: Fix compare error in function retval_range_within
+    - bpf: Fail verification for sign-extension of packet data/data_end/data_meta
+    - selftests/bpf: Support checks against a regular expression
+    - selftests/bpf: no need to track next_match_pos in struct test_loader
+    - selftests/bpf: extract test_loader->expect_msgs as a data structure
+    - selftests/bpf: allow checking xlated programs in verifier_* tests
+    - selftests/bpf: __arch_* macro to limit test cases to specific archs
+    - libbpf: Fix bpf_object__open_skeleton()'s mishandling of options
+    - s390/ap: Fix deadlock caused by recursive lock of the AP bus scan mutex
+    - sched/deadline: Fix schedstats vs deadline servers
+    - perf scripts python cs-etm: Restore first sample log in verbose mode
+    - perf lock contention: Change stack_id type to s32
+    - quota: avoid missing put_quota_format when DQUOT_SUSPENDED is passed
+    - media: staging: media: starfive: camss: Drop obsolete return value
+      documentation
+    - leds: gpio: Set num_leds after allocation
+    - iommufd/selftest: Fix buffer read overrrun in the dirty test
+    - iommufd: Check the domain owner of the parent before creating a nesting
+      domain
+    - RDMA/mlx5: Fix counter update on MR cache mkey creation
+    - RDMA/mlx5: Drop redundant work canceling from clean_keys()
+    - RDMA/mlx5: Fix MR cache temp entries cleanup
+    - RDMA/hns: Fix ah error counter in sw stat not increasing
+    - Coresight: Set correct cs_mode for TPDM to fix disable issue
+    - Coresight: Set correct cs_mode for dummy source to fix disable issue
+    - interconnect: qcom: sm8250: Enable sync_state
+    - vdpa/mlx5: Fix invalid mr resource destroy
+    - net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled
+    - selftests: netfilter: Avoid hanging ipvs.sh
+    - io_uring/rw: treat -EOPNOTSUPP for IOCB_NOWAIT like -EAGAIN
+    - mm: migrate: annotate data-race in migrate_folio_unmap()
+    - selftests/bpf: correctly move 'log' upon successful match
+    - soc: fsl: cpm1: qmc: Update TRNSYNC only in transparent mode
+    - drm/amdgpu/vcn: enable AV1 on both instances
+    - drm/amd/display: Clean up dsc blocks in accelerated mode
+    - drm/amd/display: Skip to enable dsc if it has been off
+    - arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled
+    - usb: xHCI: add XHCI_RESET_ON_RESUME quirk for Phytium xHCI host
+    - serial: qcom-geni: fix false console tx restart
+    - crypto: qcom-rng - fix support for ACPI-based systems
+    - ACPI: resource: Do IRQ override on MECHREV GM7XG0M
+    - perf/x86/intel: Allow to setup LBR for counting event for BPF
+    - f2fs: check discard support for conventional zones
+    - netfs: Delete subtree of 'fs/netfs' when netfs module exits
+    - md: Don't flush sync_work in md_write_start()
+    - tools/nolibc: include arch.h from string.h
+    - KVM: x86: Make x2APIC ID 100% readonly
+    - x86/mm/cpa: Warn for set_memory_XXcrypted() VMM fails
+    - x86/mm: Make x86_platform.guest.enc_status_change_*() return an error
+    - x86/tdx: Account shared memory
+    - x86/mm: Add callbacks to prepare encrypted memory for kexec
+    - x86/tdx: Convert shared memory back to private on kexec
+    - soc: qcom: geni-se: add GP_LENGTH/IRQ_EN_SET/IRQ_EN_CLEAR registers
+    - serial: qcom-geni: fix arg types for qcom_geni_serial_poll_bit()
+    - serial: qcom-geni: introduce qcom_geni_serial_poll_bitfield()
+    - idpf: stop using macros for accessing queue descriptors
+    - fs_parse: add uid & gid option option parsing helpers
+    - compiler.h: specify correct attribute for .rodata..c_jump_table
+    - exfat: resolve memory leak from exfat_create_upcase_table()
+    - s390/ftrace: Avoid calling unwinder in ftrace_return_address()
+    - fbdev: xen-fbfront: Assign fb_info->device
+    - [Config] update configs for CONFIG_CRYPTO_AES_GCM_P10
+    - Upstream stable to v6.6.54, v6.10.13
+  * Backport some AppArmor complain-mode profile bugfixes from Oracular
+    (LP: #2086210)
+    - SAUCE: apparmor4.0.0 [94/99]: apparmor: allocate xmatch for nullpdf inside
+      aa_alloc_null
+    - SAUCE: apparmor4.0.0 [95/99]: apparmor: properly handle cx/px lookup failure
+      for complain mode profiles
+  * Noble update: upstream stable patchset 2024-11-08 (LP: #2087519)
+    - ASoC: SOF: mediatek: Add missing board compatible
+    - ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile
+    - ASoC: allow module autoloading for table db1200_pids
+    - ASoC: allow module autoloading for table board_ids
+    - scsi: lpfc: Fix overflow build issue
+    - pinctrl: at91: make it work with current gpiolib
+    - hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
+    - microblaze: don't treat zero reserved memory regions as error
+    - platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F DMI match
+      less strict
+    - net: ftgmac100: Ensure tx descriptor updates are visible
+    - LoongArch: Define ARCH_IRQ_INIT_FLAGS as IRQ_NOPROBE
+    - wifi: iwlwifi: lower message level for FW buffer destination
+    - wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
+    - wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
+    - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
+    - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
+    - wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap()
+    - wifi: iwlwifi: clear trans->state earlier upon error
+    - can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing configuration
+    - ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict
+    - ASoC: intel: fix module autoloading
+    - ASoC: google: fix module autoloading
+    - ASoC: tda7419: fix module autoloading
+    - ASoC: fix module autoloading
+    - spi: spidev: Add an entry for elgin,jg10309-01
+    - ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
+    - ALSA: hda: add HDMI codec ID for Intel PTL
+    - drm: komeda: Fix an issue related to normalized zpos
+    - spi: bcm63xx: Enable module autoloading
+    - smb: client: fix hang in wait_for_response() for negproto
+    - x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
+    - tools: hv: rm .*.cmd when make clean
+    - spi: spidev: Add missing spi_device_id for jg10309-01
+    - ocfs2: add bounds checking to ocfs2_xattr_find_entry()
+    - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
+    - drm: Use XArray instead of IDR for minors
+    - accel: Use XArray instead of IDR for minors
+    - drm: Expand max DRM device number to full MINORBITS
+    - powercap/intel_rapl: Add support for AMD family 1Ah
+    - netfilter: nft_socket: make cgroupsv2 matching work with namespaces
+    - netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in
+      nft_socket_cgroup_subtree_level()
+    - nvme-pci: qdepth 1 quirk
+    - x86/mm: Switch to new Intel CPU model defines
+    - can: mcp251xfd: properly indent labels
+    - can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
+      mcp251xfd_chip_start/stop()
+    - USB: serial: pl2303: add device id for Macrosilicon MS3020
+    - USB: usbtmc: prevent kernel-usb-infoleak
+    - platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA
+    - ASoC: mediatek: mt8188-mt6359: Modify key
+    - clk: qcom: gcc-sm8650: Don't use shared clk_ops for QUPs
+    - ice: check for XDP rings instead of bpf program when unconfiguring
+    - powercap/intel_rapl: Fix the energy-pkg event for AMD CPUs
+    - powercap: intel_rapl: Change an error pointer to NULL
+    - Upstream stable to v6.6.53, v6.10.12
+
+  [ Ubuntu: 6.8.0-52.53 ]
+
+  * noble/linux: 6.8.0-52.53 -proposed tracker (LP: #2093521)
+  * CVE-2024-53164
+    - net: sched: fix ordering of qlen adjustment
+  * CVE-2024-53141
+    - netfilter: ipset: add missing range check in bitmap_ip_uadt
+  * CVE-2024-53103
+    - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
+
+  [ Ubuntu: 6.8.0-51.52 ]
+
+  * noble/linux: 6.8.0-51.52 -proposed tracker (LP: #2090369)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] update variants
+  * MGLRU: kswapd uses 100% CPU when MGLRU is enabled and under memory pressure
+    (LP: #2087886)
+    - mm/mglru: only clear kswapd_failures if reclaimable
+  * CVE-2024-50264
+    - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
+  * CVE-2024-53057
+    - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
+  * CVE-2024-49967
+    - ext4: no need to continue when the number of entries is 1
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 12 Feb 2025 21:04:42 +0900
+
+linux-qcom (6.8.0-1027.27) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1027.27 -proposed tracker (LP: #2097551)
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 07 Feb 2025 00:20:45 +0900
+
+linux-qcom (6.8.0-1025.25) noble; urgency=medium
+
+  * noble/linux-qcom: 6.8.0-1025.25 -proposed tracker (LP: #2097247)
+    - [Packaging] switch from jammy to noble
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 03 Feb 2025 22:35:26 +0900
+
+linux-qcom (6.8.0-1023.23) jammy; urgency=medium
+
+  * jammy/linux-qcom: 6.8.0-1023.23 -proposed tracker (LP: #2097246)
+
+  * Miscellaneous upstream changes
+    - PENDING: iommu/arm-smmu: add ACTLR data and support for sa7255p
+    - QCLINUX: arm64: dts: qcom: Enable gpu tsens mitigation for sa8775p variants
+    - PENDING: arm64: dts: qcom: sa8255p: Add ICE node
+    - QCLINUX: arm64: defconfigs: Enable PCIe EP configuration
+    - QCLINUX: firmware: qtee_shmbridge: Fix stubs
+    - FROMLIST: firmware: qcom: scm: add a call for deriving the software secret
+    - FROMLIST: firmware: qcom: scm: add calls for creating, preparing and
+      importing keys
+    - QCLINUX: arm64: qcom_defconfig: enable SHM Bridge support for the TZ memory
+      allocator
+    - QCLINUX: firmware: qtee_shmbrige: Disable bridge enablement call
+    - PENDING: firmware: qcom_tzmem: Add register/deregister interfaces
+    - PENDING: firmware: qcom: tz_log: Migrate to qcom_tzmem interfaces
+    - PENDING: soc: qcom: memory_dump: Use qcom_tzmem interfaces
+    - PENDING: arm64: defconfig: qcom: Enable MMC crypto
+    - QCLINUX: soc: qcom: smem: Switch partitions to xarray
+    - QCLINUX: soc: qcom: smem: Ignore multi remote host partitions
+    - PENDING: arm64: dts: qcom: sa8255p: Add PCIe EP nodes
+    - PENDING: qcom: ice: enable ufs clock scaling
+    - PENDING: arm64: dts: qcom: qcs9075-rb8: Add PON resin support
+    - PENDING: arm64: dts: qcom: Add duplicate funnel device
+    - PENDING: clk: qcom: videocc-sa8775p: Remove HW_CTRL for video_cc_mvs0_gdsc
+    - PENDING: arm64: dts: qcom: Add cpufreq_hw support on sa7255p
+    - QCLINUX: ASoC: qcom: qdsp6: msm_audio_mem: Fix excessive logging in
+      msm_audio_mem_ioctl fun
+    - BACKPORT: FROMLIST: arm64: dts: qcom: qcs9100: Update memory map for QCS9100
+      Ride and QCS9100 Ride Rev3
+    - QCLINUX: firmware: qcom_scm: Fix indentation for ice scm calls
+    - FROMLIST: PCI: epf-mhi: Update device id for SA8775P
+    - FROMLIST: bus: mhi: host: pci_generic: Add supoprt for SA8775P target
+    - QCLINUX: usb: dwc3: qcom: export core_exit_mode and free_event_buffers
+    - FROMLIST: net: Add MHI Endpoint network driver
+    - PENDING: arm64: dts: qcom: Add MXC power domain to camcc node on QCS8300
+    - PENDING: arm64: dts: qcom: sa7255p: Add pcie nodes
+    - PENDING: net: phy: aquantia: AQR113c fix up PMA capabilities
+    - QCLINUX: arm64: dts: qcom: Add nodes for Data Capture and Compare
+    - QCLINUX: arm64: dts: qcom: Update the size for swao-etf node
+    - PENDING: thermal: qcom: add support for nsp1 qmi tmd devices
+    - PENDING: arm64: dts: qcom: Disable idle injection cooling device for cpu0
+    - QCLINUX: arm64: dts: qcom: Enable cdsp qmi tmd devices for sa8775p variants
+    - QCLINUX: arm64: dts: qcom: use 2nd trip for gpu passive cooling mitigation
+    - PENDING: net: stmmac: Add sa8797p support within ethqos driver
+    - PENDING: net: stmmac: Add 4k Virtualization support to Emac registers
+    - PENDING: net: stmmac: Add IO macro configuration for USXGMII
+    - PENDING: arm64: dts: qcom: Enable EUD on QCS9075 RB8
+    - PENDING: arm64: dts: qcom: sa7255p: Add ICE node
+    - QCLINUX: arm64: defconfig: enable scmi-cpufreq and cpucp mbox
+    - PENDING: net: stmmac: Add Qcom specific changes for HDMA
+    - QCLINUX: arm64: defconfigs: Enable MHI configs for PCIE RC and EP
+    - FROMLIST: drm/msm/dpu: fix the intf_type of MST interfaces
+    - FROMLIST: drm/msm/dp: split msm_dp_panel_read_sink_caps() into two parts
+    - FROMLIST: drm/msm/dp: add a helper to read mst caps for dp_panel
+    - FROMLIST: drm/msm/dp: remove dp_display's dp_mode and use dp_panel's instead
+    - FROMLIST: drm/msm/dp: break up dp_display_enable into two parts
+    - FROMLIST: drm/msm/dp: re-arrange dp_display_disable() into functional parts
+    - FROMLIST: drm/msm/dp: allow dp_ctrl stream APIs to use any panel passed to
+      it
+    - PENDING: net: stmmac: Add missing 25GMAC link capabilities
+    - PENDING: phy: qcom: qmp: Add default Type-C reverse orientation flag
+    - PENDING: net: stmmac: Move desc cache compute within HDMA
+    - PENDING: net: PCS: Add Qualcomm XPCS driver
+    - PENDING: arm64: dts: qcom: qcs8300: add support for steam 1
+    - FROMLIST: nvmem: qfprom: Add constraint read for some SoCs
+    - FROMLIST: arm64/dts/qcom: add mst support for stream 1 clk
+    - FROMLIST: drm/msm/dp: move the pixel clock control to its own API
+    - PENDING: net: stmmac: Use new Qualcomm XPCS driver
+    - QCLINUX: arm64: defconfig: Remove HVC console for Gen5auto targets
+    - PENDING: ASoC: codecs: wcd937x: fix aux playback issue
+    - FROMLIST: arm64: dts: qcom: sa8775p: Add CPUs to psci power domain
+    - QCLINUX: arm64: dts: qcom: Disable HCI uart for Industrial mezz kit
+    - PENDING: soc: qcom: smcinvoke: Remove mem-buf dependency for PVM
+    - QCLINUX: ASoC: qcom: qcm6490: fix the probe defer issue
+    - FROMLIST: drm/msm/dp: split dp_ctrl_off() into stream and link parts
+    - FROMLIST: drm/msm/dp: make bridge helpers use dp_display to allow re-use
+    - FROMLIST: drm/msm/dp: separate dp_display_prepare() into its own API
+    - FROMLIST: drm/msm/dp: introduce stream_id for each DP panel
+    - FROMLIST: drm/msm/dp: convert dp_display_set_mode() to use dp_panel argument
+    - FROMLIST: drm/msm/dp: add support for programming p1 register block
+    - FROMLIST: drm/msm/dp: use stream_id to change offsets in dp_catalog
+    - FROMLIST: drm/msm/dp: add support to send ACT packets for MST
+    - FROMLIST: drm/msm/dp: add support to program mst support in mainlink
+    - FROMLIST: drm/msm/dp: no need to update tu calculation for mst
+    - FROMLIST: drm/msm/dp: add support for mst channel slot allocation
+    - FROMLIST: drm/msm/dp: add support to send vcpf packets in dp controller
+    - FROMLIST: drm/msm/dp: always program MST_FIFO_CONSTANT_FILL for MST
+    - FROMLIST: drm/msm/dp: abstract out the dp_display stream helpers to accept a
+      panel
+    - FROMLIST: drm/msm/dp: move link related operations to dp_display_unprepare()
+    - FROMLIST: drm/msm/dp: replace power_on with active_stream_cnt for dp_display
+    - FROMLIST: drm/msm/dp: make the SST bridge disconnected when
+    - PENDING: drm/msm/dp: make the mst disable call separate
+    - FROMLIST: drm/msm/dp: add an API to initialize MST on sink side
+    - FROMLIST: drm/msm/dp: skip reading the EDID for MST cases
+    - FROMLIST: drm/msm/dp: add dp_display_get_panel() to initialize DP panel
+    - FROMLIST: drm/msm/dp: add dp_mst_drm to manage DP MST bridge operations
+    - FROMLIST: drm/msm/dp: add connector abstraction for DP MST
+    - FROMLIST: drm/msm/dp: add irq hpd callback for dp mst
+    - PENDING: drm/msm/dp: use the max_streams from dp catalog
+    - FROMLIST: drm/msm/dp: add support to re-use and clear the panel edid
+    - FROMLIST: drm/msm/dp: add a mst session mutex to protect bridge ops
+    - FROMLIST: drm/msm/dp: propagate hpd state changes to dp mst module
+    - PENDING: drm/msm/dp: make the changes for hpd to work
+    - FROMLIST: drm/msm: add support for non-blocking commits
+    - FROMLIST: drm/msm: initialize DRM MST encoders for DP controllers
+    - FROMLIST: drm/msm/dp: initialize dp_mst module for each DP MST controller
+    - FROMLIST: drm/msm: add a stream to intf map for DP controller
+    - FROMLIST: drm/msm/dpu: use msm_dp_get_mst_intf_id() to get the intf id
+    - FROMLIST: drm/msm/dp: populate the max_streams for sa8775 mst controller
+    - PENDING: drm/msm/dpu: make max h_display split to 2560 to allow 4 streams
+    - PENDING: drm/msm/dp: populate the max streams for DP1
+    - FROMLIST: drm: allow encoder mode_set even when connectors change for crtc
+    - PENDING: drm/msm/dp: fix up the hpd state machine for mst cases
+    - PENDING: drm/msm/dp: use stream id for streams clk on
+    - PENDING: drm/msm/dp: populate the max_streams for qcs8300
+    - FROMLIST: arm64/dts/qcom: add mst support for stream 0 clk
+    - FROMLIST: irqchip: gic-v3: Handle failure case of CPU enters low power state
+    - PENDING: arm64: dts: qcom: qcs8300: Fix quirks being added to usb node
+    - QCLINUX: arm64: dts: qcom: remove unused tlmm gpio entry
+    - FROMLIST: Revert "PENDING: Bluetooth: hci_sync: Fix disconnect
+    - PENDING: arm64: dts: qcom: Add L3 interconnect device for QCS8300
+    - PENDING: arm64: dts: qcom: Add static vote for QCS8300
+    - QCLINUX: arm64: defconfig: Enable additional debug configs for gen5auto
+    - QCLINUX: arm64: dts: qcom: Add reserved regions
+    - PENDING: arm64: dts: qcom: qcs8300: Add support to scale DDR/L3
+    - PENDING: arm64: dts: qcom: qcs8300: Add LMH interrupts for cpufreq_hw node
+    - PENDING: clk: qcom: gdsc: Increase the GDSC status poll timeout
+    - QCLINUX: firmware: shmbridge/tzmem: Improve error reporting
+    - QCLINUX: ASoC: qcom: qdsp6: Increase the timeout to 5 secs
+    - PENDING: net: stmmac: enable SGMII loopback for DMA reset
+    - QCLINUX: arm64: dts: qcom: Add addons support for QCS615 RIDE
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for QCS615
+    - QCLINUX: arm64: deconfig: enable clock controller, interconnect and pinctrl
+      for QCS615
+    - BACKPORT: FROMGIT: clk: qcom: rpmhcc: Add support for QCS615 Clocks
+    - BACKPORT: FROMGIT: clk: qcom: gcc: Add support for QCS615 GCC clocks
+    - FROMLIST: pinctrl: qcom: correct the ngpios entry for QCS615
+    - PENDING: net: stmmac: Support 10GBaseR iomacro configuration
+    - QCLINUX: arm64: defconfig: enable carveout heaps
+    - FROMLIST: misc: fastrpc: Fix race condition in MUNMAP
+    - PENDING: net: PCS: Add 10GBaseR support in XPCS driver
+    - PENDING: arm64: dts: qcom: qcs9075: Update memory map for qcs9075
+    - Ubuntu: [Config] update CONFIG options for Yocto GA 1.3.1
+    - drm/i915: convert remaining intel_dp_vsc_sdp_pack
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 03 Feb 2025 17:53:58 +0900
+
+linux-qcom (6.8.0-1019.19) jammy; urgency=medium
+
+  * jammy/linux-qcom: 6.8.0-1019.19 -proposed tracker (LP: #2095417)
+
+  * "[RB3] tc956x_pci-eth errors found in dmesg"
+    - SAUCE: ubuntu/qcom/qps615: suppress false alerts
+    - SAUCE: ubuntu/qcom/qps615: use INFO level for logging
+
+  * [RB3] drm sde error/ msm-dsi-error found in dmesg
+    - SAUCE: do not show error on EPROBE_DEFER
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import external DT from GA 1.3
+    - SAUCE: Add Makefile code to apply overlays for GA1.2
+    - SAUCE: ubuntu/qcom/display: import qcm6490 display code from GA1.3
+    - SAUCE: ubuntu/qcom/graphics: import qcm6490 graphics driver code from GA1.3
+    - SAUCE: ubuntu/qcom/camera: import qcm6490 camera driver code from GA1.3
+    - SAUCE: ubuntu/qcom/qps615: import ethernet driver from GA1.3
+    - SAUCE: ubuntu/qcom/video: import video driver from GA 1.3
+    - SAUCE: ubuntu/qcom: build external drivers
+    - SAUCE: ubuntu/qcom/camera: fix build warnings and errors
+    - SAUCE: suppress unneeded build logs
+    - SAUCE: ubuntu/qcom: suppress Wno-enum-int-mismatch warning
+    - SAUCE: ubuntu/qcom/graphics: change strtobool() to kstrtobool()
+    - SAUCE: ubuntu/qcom/graphics: dynamically allocate the kgsl-pool shrinker for
+      kernel>=6.7
+    - SAUCE: ubuntu/qcom/camera: remove unused camera_banner
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/video: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: auto-load module
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: ubuntu/qcom/display: Rename min_buffers_needed to min_queued_buffers
+    - SAUCE: ubuntu/qcom: remove DRM_UNLOCKED
+    - SAUCE: ubuntu/qcom/display: suppress EPROBE_DEFER error log
+    - SAUCE: Add Makefile code to apply qcs5430 overlays for GA1.2
+    - SAUCE: rename qcom,phy-rst-gpio to qcom,phy-rst-gpio-id
+    - SAUCE: comment out BUILD_TIMESTAMP
+    - SAUCE: add more DT to combined-dtb.dtb
+
+  * Miscellaneous upstream changes
+    - PENDING: usb: typec: ucsi_glink: Search current directory for headers
+    - PENDING: iommu/arm-smmu-qcom: Add SA8255p SMMUv2
+    - FROMLIST: usb: misc: qcom_eud: Access mode manager through secure calls
+    - FROMLIST: arm64: dts: qcom: sc7280: Update eud compatible string
+    - PENDING: arm64: dts: qcom: sa8775p: Add EUD dt node
+    - QCLINUX: arm64: dts: qcom: Add DT configuration
+    - PENDING: phy: qcom: Add support for eDP PHY on qcs8300
+    - UPSTREAM: wifi: ath11k: fix connection failure due to unexpected peer delete
+    - PENDING: arm64: dts: qcom: sa8775p-ride: Enable gpi-dma and qup node
+    - FROMLIST: wifi: ath11k: enable fw_wmi_diag_event hw param for WCN6750
+    - PENDING: Bluetooth: mgmt: Verify cmd pending status before removing it
+    - QCLINUX: firmware: qcom_scm: Add new scm to update Camera QoS
+    - QCLINUX: arm64: defconfig: Enable usb5807 driver
+    - QCLINUX: arm64: defconfigs: Add configs for Auto targets
+    - PENDING: drm/msm/dpu: Add QCS8300 support
+    - PENDING: arm64: dts: qcom: qcs8300: Add CDSP and ADSP fastrpc nodes
+    - PENDING: net: stmmac: Add the missing programming sequence for Split header
+      feature
+    - QCLINUX: firmware: qcom_scm_addon: Fix qcom_she_op missing arginfo and res
+    - UPSTREAM: arm64: mm: Batch dsb and isb when populating pgtables
+    - UPSTREAM: arm64: mm: Don't remap pgtables for allocate vs populate
+    - PENDING: drm/msm/dp: Add DisplayPort controller for QCS8300
+    - PENDING: arm64: dts: qcom: sa8775p: Enable EUD function
+    - PENDING: arm64: dts: qcom: qcs8300: Add BWMON instances
+    - PENDING: Bluetooth: mgmt: Verify command pending status before removing it
+    - PENDING: pinctrl: qcom: Add qcs8300 lpass lpi pinctrl driver
+    - QCLINUX: ASoC: qcm6490: Add sound card support for QCS8300
+    - QCLINUX: qcom: qtee_shmbridge: Register dma bridge
+    - PENDING: drm/msm: mdss: Add QCS8300 support
+    - QCLINUX: arm64: deconfig: qcom: disable CONFIG_ARM_SCMI_CPUFREQ
+    - PENDING: net: phy: aquantia: Fix aquantia driver to support 2.5Gbps
+    - QCLINUX: arm64: defconfig: Enable LPASS LPI QCS8300 pinctrl
+    - PENDING: arm64: dts: qcom: Add on-board PMICs for qcs8300
+    - PENDING: arm64: dts: qcom: Add PMIC GPIO devices for qcs8300
+    - PENDING: arm64: dts: qcom: Add PMIC RTC device for qcs8300
+    - PENDING: arm64: dts: qcom: qcs8300-ride: Add Bluetooth support
+    - PENDING: arm64: dts: qcom: sa8775p: Enable high bandwidth for hs isoc eps
+    - PENDING: arm64: dts: qcom: sa8255p-ride: Disable USB wakeup capability
+    - PENDING: usb: dwc3: Update nominal max votes for qcom usb
+    - PENDING: tty: serial: qcom-geni-serial: Increase Rx buffer size
+    - PENDING: arm64: dts: qcom: qcs8300: add display dt nodes
+    - QCLINUX: ARM64: configs: Remove Gunyah in-tree drivers
+    - PENDING: arm64: dts: qcom: qcs8300: Add gpr device tree node for ADSP
+    - QCLINUX: arm64: dts: qcom: qcs8300: Add lpass_tlmm node for lpi pinctrl
+    - QCLINUX: arm64: dts: qcom: qcs8300: Add sound node for qcs8300 ridesx target
+    - PENDING: arm64: dts: qcom: qcs8300: Add DisplayPort device node
+    - PENDING: usb: dwc3: Reserve Higher Bandwidth for HS Periodic EPs
+    - QCLINUX: arm64: defconfig: Add configs for Gen5auto targets
+    - QCLINUX: soc: qcom: Fix showing watchdog device attr "disable"
+    - PENDING: QCLINUX: arm64: PCI: qcom: Add support for QCS8300 SoC
+    - QCLINUX: secure-buffer: Minor cleanup
+    - PENDING: phy: qcom-qmp-pcie: add dual lane PHY support for QCS8300
+    - PENDING: pinctrl: qcom: add tlmm driver for sa7255p platform
+    - QCLINUX: arm64: defconfigs: Enable SA7255P Pinctrl
+    - PENDING: ARM64: dts: qcom: Update camera PIL memory to 7MB
+    - PENDING: arm64: dts: qcom: Add dcvsh interrupts
+    - QCLINUX: arm64: dts: qcom: addons: Add TGU components
+    - PENDING: arm64: dts: qcom: Add lpass_stm device
+    - PENDING: arm64: dts: qcom: qcs8300: Add EUD dt node
+    - QCLINUX: arm64: configs: Disable the console for perf build
+    - PENDING: arm64: dts: qcom: qcs8300: enable pcie0 for QCS8300
+    - PENDING: arm64: dts: qcom: qcs8300: Correct IRQ number of EL2 non-secure
+      physical timer
+    - PENDING: QCLINUX: arm64: dts: add pmu node for WCN6855
+    - PENDING: arm64: dts: qcom: qcs8300: add Watchdog
+    - QCLINUX: dcc: Configure the correct bit for MEM_MAP_VER3
+    - QCLINUX: arm64: defconfig: Enable EFI runtime service
+    - QCLINUX: rpmsg: glink: Get reference of channel objects in rx path
+    - PENDING: arm64: dts: qcom: Add support for SA7255p Ride platform
+    - PENDING: arm64: dts: qcom: sa7255p: Add UFS node
+    - PENDING: arm64: dts: qcom: sa7255p: Add USB nodes
+    - QCLINUX: arm64: dts: qcom: Add/Modify board-id and msm-id for V1,v2 and V3
+    - PENDING: arm64: dts: qcom: add the PCIE SMMU node
+    - PENDING: arm64: dts: qcom: Add nodes for Data Capture and Compare
+    - QCLINUX: secure-buffer: Roll-back failed assigns
+    - QCLINUX: dma-heap: qcom: Reclaim pages we failed to hyp-assign
+    - QCLINUX: arm64: dts: qcom: sa8775p: add ride r3 addons dts support
+    - QCLINUX: arm64: dts: qcom: qcs9100: add addons ride dts support
+    - PENDING: pinctrl: qcom: add pdc wakeup irq map for sa7255p
+    - PENDING: slimbus: messaging: Free transaction ID in delayed interrupt
+      scenario
+    - PENDING: clk: qcom: videocc-sa8775p: Increase mvs0c divider to div-3
+    - PENDING: arm64: dts: qcom: Add support for tsens and thermal for SA7255p
+    - PENDING: net: stmmac: dwmac-qcom-ethqos: Add ethernet support for sa8620
+    - PENDING: net: stmmac: Fix SPH feature to support AV packets
+    - PENDING: arm64: dts: qcom: sa8255p: Add PCIe nodes
+    - PENDING: arm64: dts: qcom: Add PCIe SMMU node for SA7255P
+    - QCLINUX: arm64: dts: qcom: addons: Correct the dcc version
+    - QCLINUX: Revert "PENDING: net: phy: aquantia: Fix aquantia driver to
+    - QCLINUX: arm64: dts: qcom: addons: add periphid for TGU
+    - PENDING: arm64: dts: qcom: Add the Adreno SMMU node for SA7255P
+    - QCLINUX: arm64: defconfig: Enable Intel IXGBE driver
+    - PENDING: dt-bindings: arm: qcom,ids: add SoC ID for SA7255P
+    - PENDING: soc: qcom: socinfo: add support for SA7255P SoC
+    - PENDING: arm64: dts: qcom: qcs8300: enable pcie1 for QCS8300
+    - PENDING: arm64: dts: qcom: add support for ipcc
+    - PENDING: arm64: dts: qcom: Add WDT device node for SA7255
+    - PENDING: arm64: dts: qcom: sa8775p: Enable DPTX1 on MDSS0 for SA8775P target
+    - PENDING: arm64: dts: qcom: sa8775p: Enable DPTX1 on MDSS0 for SA8775P target
+    - QCLINUX: arm64: deconfig: enable dm-verity configs
+    - QCLINUX: arm64: deconfig: qcom: disable SOC_DEBUG CONFIG
+    - QCLINUX: arm64: dts: qcom: qcs6490-addons-rb3gen2: Enable camera subsystem
+    - FROMLIST: arm64: dts: qcom: Disable TPDM_GCC for QCS8300
+    - QCLINUX: arm64: defconfig: Enable Aquantia Phy
+    - PENDING: arm64: dts: qcom: sc7280: Update camss driver properties
+    - QCLINUX: usb: dwc3: qcom: Add shutdown callback for qcom wrapper
+    - QCLINUX: drivers: thermal: Add dummy set hysteresis operation for all
+      sensors
+    - PENDING: arm64: dts: qcom: sa7255p: Enable i2c15 for audio
+    - QCLINUX: arm64: deconfig: qcom: enable IOMMU_DEFAULT_DMA_LAZY
+    - PENDING: arm64: dts: qcom: qcs8300: update videocc compatible
+    - PENDING: arm64: dts: qcom: qcs8300: add rdbg nodes
+    - PENDING: arm64: dts: qcom: qcs8300: add TRNG node
+    - QCLINUX: arm64: dts: qcom: Add msm-id/board-id for SA7255P
+    - PENDING: arm64: dts: qcom: sa8775p: Define interconnect bandwidth value in
+      dtsi
+    - PENDING: arm64: qcom: dts: Add psci sys_reset2 modes for SA8255P & SA7255P
+    - PENDING: Bluetooth: Increase settling time for baudrate change VSC
+    - QCLINUX: arm64: dts: qcom: Enable TPM device
+    - PENDING: arm64: dts: qcom: qcs8300: add ICE node
+    - BACKPORT: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
+    - QCLINUX: arm64: dts: qcom: qcs6490-rb3gen2: Move the msm-id and board-id
+    - QCLINUX: arm64: defconfigs: Add configs for Auto targets
+    - FROMLIST: wifi: ath11k: Fix unexpected return buffer manager error for
+      WCN6750/WCN6855
+    - PENDING: soc: qcom: qup_fw: QUP SE Firmware load from Linux
+    - FROMLIST: arm64: dts: qcom: qcs8300: Add PMU support for QCS8300
+    - BACKPORT: FROMLIST: io_uring: Do not set iowait before sleeping
+    - PENDING: dt-bindings: arm: qcom,ids: add SoC ID for SA8797P
+    - PENDING: soc: qcom: socinfo: add support for SA8797P SoC
+    - PENDING: arm64: dts: qcom: qcs8300: Add tz-log node
+    - QCLINUX: arm64: dts: qcom: qcs8300: add dcodec and macro clk
+    - QCLINUX: ASoC: qcm6490: Add AIF3 and AIF4 for qcs8300
+    - PENDING: arm64: dts: qcom: qcs8300: Add spi dev node for qcs8300 ridesx
+      target
+    - PENDING: arm64: dts: qcom: qcs8300: Enable i2c15 node for qcs8300 ridesx
+      target
+    - QCLINUX: arm64: dts: qcom: qcs8300: Enable HS MI2S
+    - PENDING: arm64: dts: qcom: qcs8300: Add shmbridge and smcinvoke nodes
+    - PENDING: arm64: dts: qcom: qcs8300-addons: Add CMA heap
+    - PENDING: drivers: char: fix rdbg driver init sequence
+    - PENDING: arm64: dts: qcom: qcs8300: add QCrypto nodes
+    - QCLINUX: arm64: dts: qcom: addons: Enable mem-buf and secure-buffer for
+      qcs8300
+    - PENDING: clk: qcom: common: Add support to attach multiple power domains
+    - PENDING: clk: qcom: gdsc: Add support to link multiple PDs as GDSC parents
+    - PENDING: clk: qcom: camcc-sa8775p: Add support to attach multiple pds
+    - PENDING: arm64: dts: qcom: Add MXC power domain to camcc node on SA8775P
+    - PENDING: arm64: qcom: dts: qcs8300: Add psci sys_reset2 modes
+    - FROMLIST: dt-bindings: arm: qcom,ids: add SoC ID for QCS9075
+    - FROMLIST: soc: qcom: socinfo: add QCS9075 SoC ID
+    - FROMLIST: arm64: dts: qcom: Add support for QCS9075 RB8
+    - FROMLIST: arm64: dts: qcom: Add support for QCS9075 Ride & Ride-r3
+    - QCLINUX: arm64: dts: qcom: Add msm-id & board-id for qcs9075-rb8
+    - QCLINUX: arm64: dts: qcom: qcs9075: Add msm-id & board-id for ride/ride-r3
+    - PENDING: ARM: dts: qcom: Add ADC thermistor support for SA8775P
+    - PENDING: arm64: dts: qcom: qcs8300: Add adsp memory-region and vmids
+    - PENDING: arm64: dts: qcom: qcs9075-rb8: Add support for remoteproc instances
+    - PENDING: arm64: dts: qcom: qcs9075-rb8: Enable llcc node
+    - FROMLIST: net: stmmac: Add snps_id, dev_id to struct plat_stmmacenet_data
+    - FROMLIST: net: stmmac: Integrate dw25gmac into stmmac hwif handling
+    - QCLINUX:arm64:defconfigs: Enable NO_HZ_FULL for better rcu performance
+    - PENDING: serial: qcom-geni: Support of uart firmware load from Linux
+    - PENDING: spi: geni-qcom: Load spi Firmware from driver probe
+    - PENDING: i2c: qcom-geni: Load i2c Firmware from driver probe
+    - PENDING: arm64: dts: qcom: Disable USB U1/U2 entry for QCS9100/QCS8300
+    - FROMLIST: net: stmmac: Add basic dw25gmac support in stmmac core
+    - QCLINUX: arm64: dts: qcom: qcs9100: Enable DISPLAY-PORT
+    - PENDING: misc: fastrpc: Add support for invoke v2
+    - PENDING: wifi: ath11k: fix wrong overriding for VHT Beamformee STS
+      Capability
+    - QCLINUX: arm64: dts: qcom: Add QPS615 and PHY devicetree config for RC0 for
+      RB3Gen2 ia-mezz
+    - QCLINUX: arm64: dts: qcom: Add support for Eth0 and Eth1 on QPS615 for
+      RB3Gen2 ia-mezz
+    - QCLINUX: arm64: dts: qcom: Add QPS615 and PHY devicestree config for RC1 for
+      RB3gen2 IPC board
+    - QCLINUX: arm64: dts: qcom: Add QPS615 Ethernet support for RC1 for RB3gen2
+      IPC board
+    - PENDING: ARM: dts: qcom: Add support for PMIC peripherals for qcs8300
+    - PENDING: arm64: dts: qcom: sa8775p: Add dma heap for cdsp_secure_heap_mem
+    - PENDING: spi: spi-geni-qcom: Add immediate DMA support
+    - PENDING: arm64: dts: qcom: qcs8300: Add dma heap for cdsp_secure_heap_mem
+    - QCLINUX: ASoC: qcs9100: add HDMI/DP Jack
+    - QCLINUX: arm64: dts: qcom: qcs6490-rb3gen2: disable camss driver
+    - PENDING: net: stmmac: pass stmmac_priv in some callbacks
+    - FROMLIST: arm64: dts: qcom: sa8775p: Update iommu-map entry
+    - PENDING: Bluetooth: clear cmd_sync_work_list when power off
+    - QCLINUX: dma-heap: qcom: Snapshot of dma-buf-carveout-heap
+    - PENDING: clk: qcom: Add support for qdss_xo clock for QCS8300
+    - PENDING: arm64: dts: qcom: Fix dr_mode for secondary port
+    - PENDING: arm64: qcs9075-rb8: Enable PCIe0 & PCIe1 nodes
+    - BACKPORT: PCI: Add ACS quirk for Qualcomm SA8775P
+    - PENDING: Bluetooth: hci_sync: Fix disconnect complete event timeout issue
+    - PENDING: arm64: dts: qcom: qcs8300: Delete duplicate cdsp fastrpc nodes
+    - BACKPORT: PCI: qcom-ep: Add HDMA support for SA8775P SoC
+    - QCLINUX: arm64: defconfigs: convert usb configs to module
+    - PENDING: arm64: dts: qcom: sa8775p: Define interconnect bandwidth value in
+      dtsi
+    - PENDING: arm64: dts: qcom: Enable cpu idle injection for cpu tsens for
+      qcs9100
+    - PENDING: pinctrl: sa8775p: Enable egpio function for pingroups
+    - PENDING: arm64: dts: qcom: Memory map for qcs8300 v1 approved
+    - PENDING: arm-smmu-qcom: program actlr earlier in init to include GPU and GMU
+    - QCLINUX: arm64: defconfig: qcom: Enable EMC2305 Sensor driver
+    - QCLINUX: arm64: dts: qcom: qcs9075: Add support for rb8 addons
+    - QCLINUX: arm64: dts: qcom: qcs9075: Add support for ride/ride-r3 addons
+    - PENDING: arm64: dts: qcom: Add wlan support for qcs9075-rb8
+    - PENDING: arm64: qcs9075-rb8: Config BT bootstrap pin in DTS
+    - FROMLIST: qcom: llcc/edac: Correct interrupt enable register configuration
+    - PENDING: arm64: dts: qcom: Enable cpu idle injection for cpu tsens for
+      qcs9075
+    - QCLINUX: arm64: dts: qcom: Fix dr_mode for non-primary ports
+    - QCLINUX: arm64: dts: qcom: qcs6490-rb3gen2: disable camss driver
+    - BACKPORT: PCI: epf-mhi: Add "pci_epf_mhi_" prefix to the function names
+    - QCLINUX: rpmsg: Align channel objects reference in rx path
+    - QCLINUX: arm64: dts: qcom: qcs6490-addons-rb3gen2: Enable camera subsystem"
+    - PENDING: qcom: ice: Remove ice probe
+    - PENDING: arm64: dts: qcom: qcs9100-rb8: QUP Firmware load from Linux
+    - QCLINUX: arm64: dts: qcom: Enable usb controller on QCS9075 RB8
+    - QCLINUX: arm64: dts: qcom: qcs9075: Add UFS support for QCS9075 RB8
+    - PENDING: arm64: dts: qcom: qcs9075: Add displayport device node
+    - QCLINUX: arm64: dts: qcom: add audio support for qcs9075-rb8
+    - QCLINUX: ASoC: qcm6490: Add support for QCS9075 RB8
+    - QCLINUX: clk: qcom: videocc-sa8775: disable HW CTRL for video GDSC
+    - PENDING: arm64: dts: qcom: update power-domain for display-controller
+    - PENDING: hwmon: Add I2C detection and initialization for EMC2303
+    - BACKPORT: FROMLIST: arm64: dts: qcom: qcs9100: Update memory map  for
+      QCS9100 Ride and QCS9100 Ride Rev3
+    - FROMLIST: usb: misc: usb5807: Add driver
+    - PENDING: USB: Adapt USB5807 driver for IPC hardware design
+    - PENDING: wifi: ath11k: add support for MU EDCA
+    - PENDING: ARM: dts: qcom: Update thermal zone names for qcs8300
+    - PENDING: pinctrl: qcs8300: Update function and group binding
+    - QCLINUX: drm/msm: Avoid probing gpu device
+    - QCLINUX: arm64: dts: qcom: qcs6490-rb3gen2: enable camera sensor
+    - PENDING: arm64: dts: qcom: qcs8300: Add capacity and DPC properties
+    - Revert: ICE eMMC and probe
+    - QCLINUX: arm64: defconfig: Enable GPUCC SA8775P driver as static module
+    - Ubuntu: [Config] update CONFIG options for GA 1.3
+    - Ubuntu: [Config] change CONFIG_USB_DWC3 to y
+    - Ubuntu: [Config] change CONFIG_SENSORS_EMC2305 to y
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 22 Jan 2025 07:54:04 +0900
+
+linux-qcom (6.8.0-1018.18) jammy; urgency=medium
+
+  * "[Canonical][RB3] [ftmdaemon] WlanSetPhyRFMode fail by ftmdaemon tool"
+    - [Config] Enable CONFIG_NL80211_TESTMODE
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 19 Dec 2024 21:02:17 +0900
+
+linux-qcom (6.8.0-1017.17) jammy; urgency=medium
+
+  * Miscellaneous upstream changes
+    - scsi: ufs: qcom: revive the enabled check in ufs_qcom_host_clk_get()
+    - Revert "usb: typec: fsa4480: Relax CHIP_ID check"
+    - Revert "usb: typec: fsa4480: Check if the chip is really there"
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 17 Dec 2024 04:05:48 +0900
+
+linux-qcom (6.8.0-1016.16) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Add Makefile code to apply qcs5430 overlays for GA1.2
+
+  * Miscellaneous upstream changes
+    - msm: camera: isp: Fix warnings
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 10 Dec 2024 15:45:41 +0900
+
+linux-qcom (6.8.0-1015.15) jammy; urgency=medium
+
+  * Noble update: upstream stable patchset 2024-10-02 (LP: #2083488)
+    - [Config] Update CONFIG_SCREEN_INFO
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+
+  * [RB3] CONFIG_KASAN_GENERIC report potential memory bug in tc956x_pcie_eth
+    - SAUCE: ubuntu/qcom/qps615: suppress KASAN error
+
+  * Miscellaneous Ubuntu changes
+    - [Config] set CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND
+
+  [ Ubuntu: 6.8.0-50.51 ]
+
+  * noble/linux: 6.8.0-50.51 -proposed tracker (LP: #2086301)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.10.28)
+  * Noble update: upstream stable patchset 2024-10-31 (LP: #2086138)
+    - device property: Add cleanup.h based fwnode_handle_put() scope based
+      cleanup.
+    - device property: Introduce device_for_each_child_node_scoped()
+    - iio: adc: ad7124: Switch from of specific to fwnode based property handling
+    - ksmbd: override fsids for share path check
+    - ksmbd: override fsids for smb2_query_info()
+    - usbnet: ipheth: remove extraneous rx URB length check
+    - usbnet: ipheth: drop RX URBs with no payload
+    - usbnet: ipheth: do not stop RX on failing RX callback
+    - usbnet: ipheth: fix carrier detection in modes 1 and 4
+    - net: ethernet: use ip_hdrlen() instead of bit shift
+    - drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero
+    - drm: panel-orientation-quirks: Add quirk for Ayn Loki Max
+    - net: phy: vitesse: repair vsc73xx autonegotiation
+    - powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
+    - wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
+    - net: hns3: use correct release function during uninitialization
+    - btrfs: update target inode's ctime on unlink
+    - Input: ads7846 - ratelimit the spi_sync error message
+    - Input: synaptics - enable SMBus for HP Elitebook 840 G2
+    - HID: multitouch: Add support for GT7868Q
+    - scripts: kconfig: merge_config: config files: add a trailing newline
+    - platform/surface: aggregator_registry: Add Support for Surface Pro 10
+    - platform/surface: aggregator_registry: Add support for Surface Laptop Go 3
+    - drm/msm/adreno: Fix error return if missing firmware-name
+    - Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
+    - smb/server: fix return value of smb2_open()
+    - NFSv4: Fix clearing of layout segments in layoutreturn
+    - NFS: Avoid unnecessary rescanning of the per-server delegation list
+    - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
+    - platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array
+    - mptcp: pm: Fix uaf in __timer_delete_sync
+    - arm64: dts: rockchip: fix eMMC/SPI corruption when audio has been used on
+      RK3399 Puma
+    - arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399
+      Puma
+    - minmax: reduce min/max macro expansion in atomisp driver
+    - net: tighten bad gso csum offset check in virtio_net_hdr
+    - dm-integrity: fix a race condition when accessing recalc_sector
+    - x86/hyperv: fix kexec crash due to VP assist page corruption
+    - mm: avoid leaving partial pfn mappings around in error case
+    - arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E
+    - drm/amd/display: Disable error correction if it's not supported
+    - drm/amd/display: Fix FEC_READY write on DP LT
+    - eeprom: digsy_mtc: Fix 93xx46 driver probe failure
+    - cxl/core: Fix incorrect vendor debug UUID define
+    - selftests/bpf: Support SOCK_STREAM in unix_inet_redir_to_connected()
+    - hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >=
+      1.2
+    - ice: Fix lldp packets dropping after changing the number of channels
+    - ice: fix accounting for filters shared by multiple VSIs
+    - ice: fix VSI lists confusion when adding VLANs
+    - igb: Always call igb_xdp_ring_update_tail() under Tx lock
+    - net/mlx5: Update the list of the PCI supported devices
+    - net/mlx5e: Add missing link modes to ptys2ethtool_map
+    - net/mlx5e: Add missing link mode to ptys2ext_ethtool_map
+    - net/mlx5: Explicitly set scheduling element and TSAR type
+    - net/mlx5: Add missing masks and QoS bit masks for scheduling elements
+    - net/mlx5: Correct TASR typo into TSAR
+    - net/mlx5: Verify support for scheduling element and TSAR type
+    - net/mlx5: Fix bridge mode operations when there are no VFs
+    - fou: fix initialization of grc
+    - octeontx2-af: Modify SMQ flush sequence to drop packets
+    - net: ftgmac100: Enable TX interrupt to avoid TX timeout
+    - selftests: net: csum: Fix checksums for packets with non-zero padding
+    - netfilter: nft_socket: fix sk refcount leaks
+    - net: dsa: felix: ignore pending status of TAS module when it's disabled
+    - net: dpaa: Pad packets to ETH_ZLEN
+    - tracing/osnoise: Fix build when timerlat is not enabled
+    - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
+    - drm/syncobj: Fix syncobj leak in drm_syncobj_eventfd_ioctl
+    - dma-buf: heaps: Fix off-by-one in CMA heap fault handler
+    - drm/nouveau/fb: restore init() for ramgp102
+    - drm/amdgpu/atomfirmware: Silence UBSAN warning
+    - drm/amd/amdgpu: apply command submission parser for JPEG v1
+    - spi: geni-qcom: Undo runtime PM changes at driver exit time
+    - spi: geni-qcom: Fix incorrect free_irq() sequence
+    - drm/i915/guc: prevent a possible int overflow in wq offsets
+    - ASoC: codecs: avoid possible garbage value in peb2466_reg_read()
+    - cifs: Fix signature miscalculation
+    - pinctrl: meteorlake: Add Arrow Lake-H/U ACPI ID
+    - ASoC: meson: axg-card: fix 'use-after-free'
+    - drm/mediatek: Set sensible cursor width/height values to fix crash
+    - Input: edt-ft5x06 - add support for FocalTech FT5452 and FT8719
+    - Input: edt-ft5x06 - add support for FocalTech FT8201
+    - cgroup/cpuset: Eliminate unncessary sched domains rebuilds in hotplug
+    - spi: zynqmp-gqspi: Scale timeout by data size
+    - drm/xe: use devm instead of drmm for managed bo
+    - net: libwx: fix number of Rx and Tx descriptors
+    - clocksource: hyper-v: Use lapic timer in a TDX VM without paravisor
+    - bcachefs: Fix bch2_extents_match() false positive
+    - bcachefs: Don't delete open files in online fsck
+    - firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire()
+    - riscv: dts: starfive: jh7110-common: Fix lower rate of CPUfreq by setting
+      PLL0 rate to 1.5GHz
+    - cxl: Restore XOR'd position bits during address translation
+    - netlink: specs: mptcp: fix port endianness
+    - drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct()
+    - drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct()
+    - drm/amd/amdgpu: apply command submission parser for JPEG v2+
+    - drm/xe/client: fix deadlock in show_meminfo()
+    - drm/xe/client: remove bogus rcu list usage
+    - drm/xe/client: add missing bo locking in show_meminfo()
+    - tracing/kprobes: Fix build error when find_module() is not available
+    - drm/xe/display: fix compat IS_DISPLAY_STEP() range end
+    - Upstream stable to v6.6.52, v6.10.11
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849)
+    - KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
+    - KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing
+    - ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius
+      devices
+    - ALSA: hda/realtek: add patch for internal mic in Lenovo V145
+    - ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
+    - ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
+    - ata: libata: Fix memory leak for error path in ata_host_alloc()
+    - irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
+    - x86/kaslr: Expose and use the end of the physical memory address space
+    - nvme-pci: Add sleep quirk for Samsung 990 Evo
+    - rust: types: Make Opaque::get const
+    - rust: macros: provide correct provenance when constructing THIS_MODULE
+    - Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
+    - Bluetooth: MGMT: Ignore keys being loaded with invalid type
+    - mmc: core: apply SD quirks earlier during probe
+    - mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
+    - mmc: sdhci-of-aspeed: fix module autoloading
+    - mmc: cqhci: Fix checking of CQHCI_HALT state
+    - fuse: update stats for pages in dropped aux writeback list
+    - fuse: use unsigned type for getxattr/listxattr size truncation
+    - fuse: fix memory leak in fuse_create_open
+    - clk: starfive: jh7110-sys: Add notifier for PLL0 clock
+    - clk: qcom: clk-alpha-pll: Fix the pll post div mask
+    - clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
+    - kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y
+    - tracing: Avoid possible softlockup in tracing_iter_reset()
+    - tracing/timerlat: Add interface_lock around clearing of kthread in
+      stop_kthread()
+    - net: mctp-serial: Fix missing escapes on transmit
+    - x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported
+    - x86/apic: Make x2apic_disable() work correctly
+    - drm/i915: Do not attempt to load the GSC multiple times
+    - ALSA: control: Apply sanity check of input values for user elements
+    - ALSA: hda: Add input value sanity checks to HDMI channel map controls
+    - wifi: ath12k: fix uninitialize symbol error on ath12k_peer_assoc_h_he()
+    - smack: unix sockets: fix accept()ed socket label
+    - bpf, verifier: Correct tail_call_reachable for bpf prog
+    - accel/habanalabs/gaudi2: unsecure edma max outstanding register
+    - irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
+    - af_unix: Remove put_pid()/put_cred() in copy_peercred().
+    - x86/kmsan: Fix hook for unaligned accesses
+    - iommu: sun50i: clear bypass register
+    - netfilter: nf_conncount: fix wrong variable type
+    - fs/ntfs3: One more reason to mark inode bad
+    - riscv: kprobes: Use patch_text_nosync() for insn slots
+    - media: vivid: fix wrong sizeimage value for mplane
+    - leds: spi-byte: Call of_node_put() on error path
+    - wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
+    - usb: uas: set host status byte on data completion error
+    - drm/amd/display: Check HDCP returned status
+    - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts
+    - media: vivid: don't set HDMI TX controls if there are no HDMI outputs
+    - vfio/spapr: Always clear TCEs before unsetting the window
+    - ice: Check all ice_vsi_rebuild() errors in function
+    - Input: ili210x - use kvmalloc() to allocate buffer for firmware update
+    - media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
+    - pcmcia: Use resource_size function on resource object
+    - drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
+    - can: m_can: Release irq on error in m_can_open
+    - can: mcp251xfd: fix ring configuration when switching from CAN-CC to CAN-FD
+      mode
+    - rust: kbuild: fix export of bss symbols
+    - cifs: Fix FALLOC_FL_ZERO_RANGE to preflush buffered part of target region
+    - igb: Fix not clearing TimeSync interrupts for 82580
+    - platform/x86: dell-smbios: Fix error path in dell_smbios_init()
+    - regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR
+    - can: kvaser_pciefd: Skip redundant NULL pointer check in ISR
+    - can: kvaser_pciefd: Remove unnecessary comment
+    - can: kvaser_pciefd: Rename board_irq to pci_irq
+    - can: kvaser_pciefd: Move reset of DMA RX buffers to the end of the ISR
+    - can: kvaser_pciefd: Use a single write when releasing RX buffers
+    - Bluetooth: qca: If memdump doesn't work, re-enable IBS
+    - Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once
+    - Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT
+    - igc: Unlock on error in igc_io_resume()
+    - ice: do not bring the VSI up, if it was down before the XDP setup
+    - usbnet: modern method to get random MAC
+    - bpf, net: Fix a potential race in do_sock_getsockopt()
+    - bareudp: Fix device stats updates.
+    - r8152: fix the firmware doesn't work
+    - net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
+    - net: dsa: vsc73xx: fix possible subblocks range of CAPT block
+    - selftests: net: enable bind tests
+    - firmware: cs_dsp: Don't allow writes to read-only controls
+    - phy: zynqmp: Take the phy mutex in xlate
+    - ASoC: topology: Properly initialize soc_enum values
+    - dm init: Handle minors larger than 255
+    - iommu/vt-d: Handle volatile descriptor status read
+    - cgroup: Protect css->cgroup write under css_set_lock
+    - devres: Initialize an uninitialized struct member
+    - virtio_ring: fix KMSAN error for premapped mode
+    - crypto: qat - fix unintentional re-enabling of error interrupts
+    - ASoc: TAS2781: replace beXX_to_cpup with get_unaligned_beXX for potentially
+      broken alignment
+    - libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
+    - drm/amdgpu: Set no_hw_access when VF request full GPU fails
+    - ext4: fix possible tid_t sequence overflows
+    - jbd2: avoid mount failed when commit block is partial submitted
+    - dma-mapping: benchmark: Don't starve others when doing the test
+    - drm/amdgpu: reject gang submit on reserved VMIDs
+    - smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
+    - fs/ntfs3: Check more cases when directory is corrupted
+    - btrfs: replace BUG_ON with ASSERT in walk_down_proc()
+    - cxl/region: Verify target positions using the ordered target list
+    - riscv: set trap vector earlier
+    - tcp: Don't drop SYN+ACK for simultaneous connect().
+    - net: dpaa: avoid on-stack arrays of NR_CPUS elements
+    - LoongArch: Use correct API to map cmdline in relocate_kernel()
+    - regmap: maple: work around gcc-14.1 false-positive warning
+    - vfs: Fix potential circular locking through setxattr() and removexattr()
+    - i3c: master: svc: resend target address when get NACK
+    - kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
+    - btrfs: initialize location to fix -Wmaybe-uninitialized in
+      btrfs_lookup_dentry()
+    - s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
+    - usbnet: ipheth: race between ipheth_close and error handling
+    - spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register
+    - ata: pata_macio: Use WARN instead of BUG
+    - NFSv4: Add missing rescheduling points in
+      nfs_client_return_marked_delegations
+    - ACPI: CPPC: Add helper to get the highest performance value
+    - cpufreq: amd-pstate: Enable amd-pstate preferred core support
+    - cpufreq: amd-pstate: fix the highest frequency issue which limits
+      performance
+    - tcp: process the 3rd ACK with sk_socket for TFO/MPTCP
+    - iio: buffer-dmaengine: fix releasing dma channel on error
+    - iio: fix scale application in iio_convert_raw_to_processed_unlocked
+    - iio: adc: ad7124: fix config comparison
+    - iio: adc: ad7606: remove frstdata check for serial mode
+    - iio: adc: ad7124: fix chip ID mismatch
+    - usb: dwc3: core: update LC timer as per USB Spec V3.2
+    - usb: cdns2: Fix controller reset issue
+    - usb: dwc3: Avoid waking up gadget during startxfer
+    - nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
+    - Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
+    - clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
+    - clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
+    - clocksource/drivers/timer-of: Remove percpu irq related code
+    - uprobes: Use kzalloc to allocate xol area
+    - Revert "mm: skip CMA pages when they are not available"
+    - workqueue: wq_watchdog_touch is always called with valid CPU
+    - workqueue: Improve scalability of workqueue watchdog touch
+    - ACPI: processor: Return an error if acpi_processor_get_info() fails in
+      processor_add()
+    - ACPI: processor: Fix memory leaks in error paths of processor_add()
+    - arm64: acpi: Move get_cpu_for_acpi_id() to a header
+    - can: mcp251xfd: mcp251xfd_handle_rxif_ring_uinc(): factor out in separate
+      function
+    - can: mcp251xfd: rx: prepare to workaround broken RX FIFO head index erratum
+    - can: mcp251xfd: clarify the meaning of timestamp
+    - can: mcp251xfd: rx: add workaround for erratum DS80000789E 6 of mcp2518fd
+    - drm/amd: Add gfx12 swizzle mode defs
+    - drm/amdgpu: handle gfx12 in amdgpu_display_verify_sizes
+    - ata: libata-scsi: Remove redundant sense_buffer memsets
+    - ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf
+    - crypto: starfive - Align rsa input data to 32-bit
+    - crypto: starfive - Fix nent assignment in rsa dec
+    - clk: qcom: ipq9574: Update the alpha PLL type for GPLLs
+    - powerpc/64e: remove unused IBM HTW code
+    - powerpc/64e: split out nohash Book3E 64-bit code
+    - powerpc/64e: Define mmu_pte_psize static
+    - powerpc/vdso: Don't discard rela sections
+    - ASoC: tegra: Fix CBB error during probe()
+    - nvme-pci: allocate tagset on reset if necessary
+    - ASoc: SOF: topology: Clear SOF link platform name upon unload
+    - ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
+    - clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs
+    - clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time
+    - drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
+    - drm/i915/fence: Mark debug_fence_free() with __maybe_unused
+    - gpio: rockchip: fix OF node leak in probe()
+    - gpio: modepin: Enable module autoloading
+    - riscv: Fix toolchain vector detection
+    - riscv: Do not restrict memory size because of linear mapping on nommu
+    - membarrier: riscv: Add full memory barrier in switch_mm()
+    - [Config] updateconfigs for ARCH_HAS_MEMBARRIER_CALLBACKS
+    - x86/mm: Fix PTI for i386 some more
+    - btrfs: fix race between direct IO write and fsync when using same fd
+    - spi: spi-fsl-lpspi: Fix off-by-one in prescale max
+    - ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx
+    - ALSA: hda/realtek - Fix inactive headset mic jack for ASUS Vivobook 15
+      X1504VAP
+    - fuse: clear PG_uptodate when using a stolen page
+    - riscv: misaligned: remove CONFIG_RISCV_M_MODE specific code
+    - parisc: Delay write-protection until mark_rodata_ro() call
+    - pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now
+    - maple_tree: remove rcu_read_lock() from mt_validate()
+    - Revert "wifi: ath11k: restore country code during resume"
+    - btrfs: qgroup: don't use extent changeset when not needed
+    - btrfs: zoned: handle broken write pointer on zones
+    - drm/xe/gsc: Do not attempt to load the GSC multiple times
+    - drm/amdgpu: always allocate cleared VRAM for GEM allocations
+    - drm/amd/display: Lock DC and exit IPS when changing backlight
+    - ALSA: hda/realtek: extend quirks for Clevo V5[46]0
+    - cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition
+    - virt: sev-guest: Mark driver struct with __refdata to prevent section
+      mismatch
+    - media: b2c2: flexcop-usb: fix flexcop_usb_memory_req
+    - gve: Add adminq mutex lock
+    - wifi: rtw89: wow: prevent to send unexpected H2C during download Firmware
+    - drm/amdgpu: add missing error handling in function
+      amdgpu_gmc_flush_gpu_tlb_pasid
+    - crypto: qat - initialize user_input.lock for rate_limiting
+    - locking: Add rwsem_assert_held() and rwsem_assert_held_write()
+    - fs: don't copy to userspace under namespace semaphore
+    - fs: relax permissions for statmount()
+    - seccomp: release task filters when the task exits
+    - drm/amdgpu/display: handle gfx12 in amdgpu_dm_plane_format_mod_supported
+    - can: m_can: Remove m_can_rx_peripheral indirection
+    - can: m_can: Do not cancel timer from within timer
+    - mm: Provide a means of invalidation without using launder_folio
+    - cifs: Fix copy offload to flush destination region
+    - hwmon: ltc2991: fix register bits defines
+    - scripts: fix gfp-translate after ___GFP_*_BITS conversion to an enum
+    - ptp: ocp: convert serial ports to array
+    - ptp: ocp: adjust sysfs entries to expose tty information
+    - ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
+    - ice: remove ICE_CFG_BUSY locking from AF_XDP code
+    - net: xilinx: axienet: Fix race in axienet_stop
+    - iommu/vt-d: Remove control over Execute-Requested requests
+    - block: don't call bio_uninit from bio_endio
+    - tracing/kprobes: Add symbol counting check when module loads
+    - perf/x86/intel: Hide Topdown metrics events if the feature is not enumerated
+    - PCI: qcom: Override NO_SNOOP attribute for SA8775P RC
+    - staging: vchiq_core: Bubble up wait_event_interruptible() return value
+    - watchdog: imx7ulp_wdt: keep already running watchdog enabled
+    - btrfs: slightly loosen the requirement for qgroup removal
+    - drm/amdgpu: add PSP RAS address query command
+    - drm/amdgpu: add mutex to protect ras shared memory
+    - s390/boot: Do not assume the decompressor range is reserved
+    - drm/amdgpu: Fix two reset triggered in a row
+    - drm/amdgpu: Add reset_context flag for host FLR
+    - drm/amdgpu: Fix amdgpu_device_reset_sriov retry logic
+    - fs: only copy to userspace on success in listmount()
+    - iio: adc: ad7124: fix DT configuration parsing
+    - nvmem: u-boot-env: error if NVMEM device is too small
+    - mm: zswap: rename is_zswap_enabled() to zswap_is_enabled()
+    - mm/memcontrol: respect zswap.writeback setting from parent cg too
+    - path: add cleanup helper
+    - fs: simplify error handling
+    - fs: relax permissions for listmount()
+    - hid: bpf: add BPF_JIT dependency
+    - net/mlx5e: SHAMPO, Use KSMs instead of KLMs
+    - net/mlx5e: SHAMPO, Fix page leak
+    - drm/xe/xe2: Add workaround 14021402888
+    - drm/xe/xe2lpg: Extend workaround 14021402888
+    - clk: qcom: gcc-x1e80100: Fix USB 0 and 1 PHY GDSC pwrsts flags
+    - clk: qcom: gcc-x1e80100: Don't use parking clk_ops for QUPs
+    - nouveau: fix the fwsec sb verification register.
+    - riscv: Add tracepoints for SBI calls and returns
+    - riscv: Improve sbi_ecall() code generation by reordering arguments
+    - riscv: Fix RISCV_ALTERNATIVE_EARLY
+    - cifs: Fix zero_point init on inode initialisation
+    - nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err
+    - nvme: fix status magic numbers
+    - nvme: rename CDR/MORE/DNR to NVME_STATUS_*
+    - nvmet: Identify-Active Namespace ID List command should reject invalid nsid
+    - drm/i915/display: Add mechanism to use sink model when applying quirk
+    - drm/i915/display: Increase Fast Wake Sync length as a quirk
+    - LoongArch: Use accessors to page table entries instead of direct dereference
+    - Upstream stable to v6.6.51, v6.10.10
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46823
+    - kunit/overflow: Fix UB in overflow_allocation_test
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46834
+    - ethtool: fail closed if we can't get max channel used in indirection tables
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46751
+    - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46753
+    - btrfs: handle errors from btrfs_dec_ref() properly
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46841
+    - btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in
+      walk_down_proc()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46754
+    - bpf: Remove tst_run from lwt_seg6local_prog_ops.
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46824
+    - iommufd: Require drivers to supply the cache_invalidate_user ops
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46842
+    - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46766
+    - ice: move netif_queue_set_napi to rtnl-protected sections
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46772
+    - drm/amd/display: Check denominator crb_pipes before used
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46774
+    - powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46775
+    - drm/amd/display: Validate function returns
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46778
+    - drm/amd/display: Check UnboundedRequestEnabled's value
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46779
+    - drm/imagination: Free pvr_vm_gpuva after unlink
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46792
+    - riscv: misaligned: Restrict user access to kernel memory
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46793
+    - ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46735
+    - ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46737
+    - nvmet-tcp: fix kernel crash if commands allocation fails
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46822
+    - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46713
+    - perf/aux: Fix AUX buffer serialization
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46739
+    - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46740
+    - binder: fix UAF caused by offsets overwrite
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46741
+    - misc: fastrpc: Fix double free of 'buf' in error path
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47663
+    - staging: iio: frequency: ad9834: Validate frequency parameter value
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46832
+    - MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47668
+    - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46744
+    - Squashfs: sanity check symbolic link size
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46745
+    - Input: uinput - reject requests with unreasonable number of slots
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46746
+    - HID: amd_sfh: free driver_data after destroying hid device
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47664
+    - spi: hisi-kunpeng: Add verification for the max_frequency provided by the
+      firmware
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47665
+    - i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46749
+    - Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46750
+    - PCI: Add missing bridge lock to pci_bus_lock()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46752
+    - btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46840
+    - btrfs: clean up our handling of refs == 0 in snapshot delete
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46755
+    - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47666
+    - scsi: pm80xx: Set phy->enable_completion only when we wait for it
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46843
+    - scsi: ufs: core: Remove SCSI host only if added
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46760
+    - wifi: rtw88: usb: schedule rx work after everything is set up
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46761
+    - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46844
+    - um: line: always fill *error_out in setup_one_line()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46762
+    - xen: privcmd: Fix possible access to a freed kirqfd instance
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46763
+    - fou: Fix null-ptr-deref in GRO.
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46765
+    - ice: protect XDP configuration with a mutex
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46767
+    - net: phy: Fix missing of_node_put() for leds
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46768
+    - hwmon: (hp-wmi-sensors) Check if WMI event data exists
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46770
+    - ice: Add netif_device_attach/detach into PF reset flow
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46771
+    - can: bcm: Remove proc entry when dev is unregistered.
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46773
+    - drm/amd/display: Check denominator pbn_div before used
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47667
+    - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46835
+    - drm/amdgpu: Fix smatch static checker warning
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46776
+    - drm/amd/display: Run DC_LOG_DC after checking link->link_enc
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46836
+    - usb: gadget: aspeed_udc: validate endpoint index for ast udc
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46777
+    - udf: Avoid excessive partition lengths
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46825
+    - wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46826
+    - ELF: fix kernel.randomize_va_space double read
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46827
+    - wifi: ath12k: fix firmware crash due to invalid peer nss
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-47669
+    - nilfs2: fix state management in error path of log writing function
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46780
+    - nilfs2: protect references to superblock parameters exposed in sysfs
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46781
+    - nilfs2: fix missing cleanup on rollforward recovery error
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46828
+    - sched: sch_cake: fix bulk flow accounting logic for host fairness
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46782
+    - ila: call nf_unregister_net_hooks() sooner
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46783
+    - tcp_bpf: fix return value of tcp_bpf_sendmsg()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46784
+    - net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46785
+    - eventfs: Use list_del_rcu() for SRCU protected list variable
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46786
+    - fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46787
+    - userfaultfd: fix checks for huge PMDs
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46838
+    - userfaultfd: don't BUG_ON() if khugepaged yanks our page table
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46845
+    - tracing/timerlat: Only clear timer if a kthread exists
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46788
+    - tracing/osnoise: Use a cpumask to know what threads are kthreads
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46846
+    - spi: rockchip: Resolve unbalanced runtime PM / system PM handling
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46847
+    - mm: vmalloc: ensure vmap_block is initialised before adding to queue
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46791
+    - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46829
+    - rtmutex: Drop rt_mutex::wait_lock before scheduling
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46848
+    - perf/x86/intel: Limit the period on Haswell
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46794
+    - x86/tdx: Fix data leak in mmio_read()
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46795
+    - ksmbd: unset the binding mark of a reused connection
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46797
+    - powerpc/qspinlock: Fix deadlock in MCS queue
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46830
+    - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46798
+    - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
+  * Noble update: upstream stable patchset 2024-10-29 (LP: #2085849) //
+    CVE-2024-46831
+    - net: microchip: vcap: Fix use-after-free error in kunit test
+  * Navi24 RX6300 light up issue on 6.8 kernel (LP: #2084513)
+    - drm/amd/display: Ensure populate uclk in bb construction
+  * Noble update: upstream stable patchset 2024-10-18 (LP: #2084941)
+    - drm/fb-helper: Don't schedule_work() to flush frame buffer during panic()
+    - drm: panel-orientation-quirks: Add quirk for OrangePi Neo
+    - scsi: ufs: core: Check LSDBS cap when !mcq
+    - scsi: ufs: core: Bypass quick recovery if force reset is needed
+    - btrfs: tree-checker: validate dref root and objectid
+    - ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
+    - ALSA: hda/conexant: Mute speakers at suspend / shutdown
+    - ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
+    - ALSA: ump: Explicitly reset RPN with Null RPN
+    - ALSA: seq: ump: Use the common RPN/bank conversion context
+    - ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
+    - ALSA: seq: ump: Explicitly reset RPN with Null RPN
+    - net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule
+    - ASoC: amd: yc: Support mic on HP 14-em0002la
+    - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
+    - i2c: Fix conditional for substituting empty ACPI functions
+    - dma-debug: avoid deadlock between dma debug vs printk and netconsole
+    - net: usb: qmi_wwan: add MeiG Smart SRM825L
+    - ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
+    - ASoC: codecs: ES8326: button detect issue
+    - selftests: mptcp: userspace pm create id 0 subflow
+    - selftests: mptcp: dump userspace addrs list
+    - selftests: mptcp: userspace pm get addr tests
+    - selftests: mptcp: declare event macros in mptcp_lib
+    - selftests: mptcp: join: cannot rm sf if closed
+    - selftests: mptcp: add explicit test case for remove/readd
+    - selftests: mptcp: join: check re-using ID of unused ADD_ADDR
+    - selftests: mptcp: join: check re-adding init endp with != id
+    - selftests: mptcp: add mptcp_lib_events helper
+    - selftests: mptcp: join: validate event numbers
+    - selftests: mptcp: join: check re-re-adding ID 0 signal
+    - selftests: mptcp: join: test for flush/re-add endpoints
+    - selftests: mptcp: join: disable get and dump addr checks
+    - selftests: mptcp: join: stop transfer when check is done (part 2.2)
+    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
+    - drm/amd/display: Assign linear_pitch_alignment even for VM
+    - drm/amdgpu: fix overflowed array index read warning
+    - drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
+    - drm/amd/pm: fix uninitialized variable warning
+    - drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
+    - drm/amd/pm: fix warning using uninitialized value of max_vid_step
+    - drm/amd/pm: Fix negative array index read
+    - drm/amd/pm: fix the Out-of-bounds read warning
+    - drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
+    - drm/amdgpu: avoid reading vf2pf info size from FB
+    - drm/amd/display: Check gpio_id before used as array index
+    - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
+    - drm/amd/display: Check index for aux_rd_interval before using
+    - drm/amd/display: Add array index check for hdcp ddc access
+    - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
+    - drm/amd/display: Check msg_id before processing transcation
+    - drm/amd/display: Fix Coverity INTERGER_OVERFLOW within
+      construct_integrated_info
+    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
+      dal_gpio_service_create
+    - drm/amd/display: Spinlock before reading event
+    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
+      decide_fallback_link_setting_max_bw_policy
+    - drm/amd/display: Ensure index calculation will not overflow
+    - drm/amd/display: Skip inactive planes within
+      ModeSupportAndSystemConfiguration
+    - drm/amd/display: Fix index may exceed array range within
+      fpu_update_bw_bounding_box
+    - drm/amd/amdgpu: Check tbo resource pointer
+    - drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
+    - drm/amdgpu/pm: Fix uninitialized variable warning for smu10
+    - drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
+    - drm/amdgpu: Fix the uninitialized variable warning
+    - drm/amdkfd: Check debug trap enable before write dbg_ev_file
+    - drm/amdkfd: Reconcile the definition and use of oem_id in struct
+      kfd_topology_device
+    - apparmor: fix possible NULL pointer dereference
+    - wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem()
+    - wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem()
+    - drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy
+      SOCs
+    - drm/amdgpu: Fix the warning division or modulo by zero
+    - drm/amdgpu: fix dereference after null check
+    - drm/amdgpu: fix the waring dereferencing hive
+    - drm/amd/pm: check specific index for aldebaran
+    - drm/amd/pm: check specific index for smu13
+    - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
+    - drm/amd/pm: check negtive return for table entries
+    - wifi: rtw89: ser: avoid multiple deinit on same CAM
+    - drm/kfd: Correct pinned buffer handling at kfd restore and validate process
+    - drm/amdgpu: update type of buf size to u32 for eeprom functions
+    - wifi: iwlwifi: remove fw_running op
+    - cpufreq: scmi: Avoid overflow of target_freq in fast switch
+    - PCI: al: Check IORESOURCE_BUS existence during probe
+    - wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
+    - hwspinlock: Introduce hwspin_lock_bust()
+    - soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
+    - RDMA/efa: Properly handle unexpected AQ completions
+    - ionic: fix potential irq name truncation
+    - pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
+    - rcu/nocb: Remove buggy bypass lock contention mitigation
+    - media: v4l2-cci: Always assign *val
+    - usbip: Don't submit special requests twice
+    - usb: typec: ucsi: Fix null pointer dereference in trace
+    - fsnotify: clear PARENT_WATCHED flags lazily
+    - net: remove NULL-pointer net parameter in ip_metrics_convert
+    - drm/amdgu: fix Unintentional integer overflow for mall size
+    - regmap: spi: Fix potential off-by-one when calculating reserved size
+    - smack: tcp: ipv4, fix incorrect labeling
+    - platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
+    - net/mlx5e: SHAMPO, Fix incorrect page release
+    - drm/meson: plane: Add error handling
+    - crypto: stm32/cryp - call finalize with bh disabled
+    - gfs2: Revert "Add quota_change type"
+    - drm/bridge: tc358767: Check if fully initialized before signalling HPD event
+      via IRQ
+    - dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while invoking
+      callbacks
+    - dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
+    - hwmon: (k10temp) Check return value of amd_smn_read()
+    - wifi: cfg80211: make hash table duplicates more survivable
+    - f2fs: fix to do sanity check on blocks for inline_data inode
+    - driver: iio: add missing checks on iio_info's callback access
+    - block: remove the blk_flush_integrity call in blk_integrity_unregister
+    - drm/amdgpu: add skip_hw_access checks for sriov
+    - drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
+    - drm/amdgpu: add lock in kfd_process_dequeue_from_device
+    - drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay
+    - drm/amd/display: added NULL check at start of dc_validate_stream
+    - drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
+    - drm/amd/display: use preferred link settings for dp signal only
+    - drm/amd/display: Check BIOS images before it is used
+    - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
+    - media: uvcvideo: Enforce alignment of frame and interval
+    - virtio_net: Fix napi_skb_cache_put warning
+    - i2c: Use IS_REACHABLE() for substituting empty ACPI functions
+    - btrfs: factor out stripe length calculation into a helper
+    - btrfs: scrub: update last_physical after scrubbing one stripe
+    - btrfs: fix qgroup reserve leaks in cow_file_range
+    - virtio-net: check feature before configuring the vq coalescing command
+    - drm/amd/display: Handle the case which quad_part is equal 0
+    - drm/amdgpu: Handle sg size limit for contiguous allocation
+    - drm/amd/pm: fix uninitialized variable warning for smu_v13
+    - drm/amdgpu: fix uninitialized scalar variable warning
+    - drm/amd/display: Ensure array index tg_inst won't be -1
+    - drm/amd/display: handle invalid connector indices
+    - drm/amd/display: Increase MAX_LINKS by 2
+    - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than
+      max_links
+    - drm/amd/display: Fix incorrect size calculation for loop
+    - drm/amd/display: Use kcalloc() instead of kzalloc()
+    - drm/amd/display: Add missing NULL pointer check within
+      dpcd_extend_address_range
+    - drm/amd/display: Release state memory if amdgpu_dm_create_color_properties
+      fail
+    - drm/amd/display: Check link_index before accessing dc->links[]
+    - drm/amd/display: Add otg_master NULL check within
+      resource_log_pipe_topology_update
+    - drm/amd/display: Release clck_src memory if clk_src_construct fails
+    - drm/amd/display: Fix writeback job lock evasion within dm_crtc_high_irq
+    - drm/xe: Demote CCS_MODE info to debug only
+    - drm/drm-bridge: Drop conditionals around of_node pointers
+    - drm/amdgpu: fix uninitialized variable warning for amdgpu_xgmi
+    - drm/amdgpu: fix uninitialized variable warning for jpeg_v4
+    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_info_ioctl
+    - wifi: ath12k: initialize 'ret' in ath12k_dp_rxdma_ring_sel_config_wcn7850()
+    - drm/amdgpu/pm: Check input value for power profile setting on smu11, smu13
+      and smu14
+    - drm/xe: Fix the warning conditions
+    - drm/amd/display: Fix pipe addition logic in calc_blocks_to_ungate DCN35
+    - wifi: cfg80211: restrict operation during radar detection
+    - remoteproc: qcom_q6v5_pas: Add hwspinlock bust on stop
+    - tcp: annotate data-races around tw->tw_ts_recent and tw->tw_ts_recent_stamp
+    - drm/xe: Don't overmap identity VRAM mapping
+    - net: tcp/dccp: prepare for tw_timer un-pinning
+    - drm/xe: Ensure caller uses sole domain for xe_force_wake_assert_held
+    - drm/xe: Check valid domain is passed in xe_force_wake_ref
+    - thermal: trip: Use READ_ONCE() for lockless access to trip properties
+    - drm/xe: Add GuC state asserts to deregister_exec_queue
+    - drm/amdgpu: fix overflowed constant warning in mmhub_set_clockgating()
+    - drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection
+    - drm/amd/display: Disable DMCUB timeout for DCN35
+    - drm/amd/display: Avoid overflow from uint32_t to uint8_t
+    - pinctrl: core: reset gpio_device in loop in pinctrl_pins_show()
+    - Upstream stable to v6.6.50, v6.10.9
+  * CVE-2024-46747
+    - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
+  * CVE-2024-46725
+    - drm/amdgpu: Fix out-of-bounds write warning
+  * CVE-2024-46724
+    - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
+  * [SRU] Fix AST DP output after resume (LP: #2083022)
+    - drm/ast: Inline drm_simple_encoder_init()
+    - drm/ast: Implement atomic enable/disable for encoders
+    - drm/ast: Program mode for AST DP in atomic_mode_set
+    - drm/ast: Move mode-setting code into mode_set_nofb CRTC helper
+    - drm/ast: Handle primary-plane format setup in atomic_update
+    - drm/ast: Remove gamma LUT updates from DPMS code
+    - drm/ast: Only set VGA SCREEN_DISABLE bit in CRTC code
+    - drm/ast: Inline ast_crtc_dpms() into callers
+    - drm/ast: Use drm_atomic_helper_commit_tail() helper
+  * UBSAN array-index-out-of-bounds reported with N-6.8 on P9 node baltar
+    (LP: #2078038)
+    - scripts/kernel-doc: reindent
+    - compiler_types: add Endianness-dependent __counted_by_{le, be}
+    - scsi: aacraid: union aac_init: Replace 1-element array with flexible array
+    - scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array with
+      flexible array
+    - scsi: aacraid: Rearrange order of struct aac_srb_unit
+    - scsi: aacraid: struct {user, }sgmap{, 64, raw}: Replace 1-element arrays
+      with flexible arrays
+  * r8169: transmit queue 0 timed out error when re-plugging the Ethernet cable
+    (LP: #2084526)
+    - r8169: disable ALDPS per default for RTL8125
+  * [SRU] cpufreq: intel_pstate: Support Emerald Rapids OOB mode (LP: #2084834)
+    - cpufreq: intel_pstate: Support Emerald Rapids OOB mode
+  * CVE-2024-46723
+    - drm/amdgpu: fix ucode out-of-bounds read warning
+  * CVE-2024-46743
+    - of/irq: Prevent device address out-of-bounds read in interrupt map walk
+  * CVE-2024-46757
+    - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
+  * [SRU] Ubuntu 24.04 - GPU cannot be installed with DL380a Gen12 (2P, SRF-SP)
+    (LP: #2081079)
+    - perf/x86/uncore: Save the unit control address of all units
+    - perf/x86/uncore: Support per PMU cpumask
+    - perf/x86/uncore: Retrieve the unit ID from the unit control RB tree
+    - perf/x86/uncore: Apply the unit control RB tree to MMIO uncore units
+    - perf/x86/uncore: Apply the unit control RB tree to MSR uncore units
+    - perf/x86/uncore: Apply the unit control RB tree to PCI uncore units
+    - perf/x86/uncore: Cleanup unused unit structure
+    - perf/x86/intel/uncore: Support HBM and CXL PMON counters
+  * Noble update: upstream stable patchset 2024-10-11 (LP: #2084225)
+    - ALSA: seq: Skip event type filtering for UMP events
+    - LoongArch: Remove the unused dma-direct.h
+    - btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()
+    - btrfs: run delayed iputs when flushing delalloc
+    - smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
+    - pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
+    - pinctrl: single: fix potential NULL dereference in pcs_get_function()
+    - wifi: wfx: repair open network AP mode
+    - wifi: mwifiex: duplicate static structs used in driver instances
+    - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
+    - mptcp: close subflow when receiving TCP+FIN
+    - mptcp: sched: check both backup in retrans
+    - mptcp: pm: reuse ID 0 after delete and re-add
+    - mptcp: pm: skip connecting to already established sf
+    - mptcp: pm: reset MPC endp ID when re-added
+    - mptcp: pm: send ACK on an active subflow
+    - mptcp: pm: do not remove already closed subflows
+    - mptcp: pm: fix ID 0 endp usage after multiple re-creations
+    - mptcp: pm: ADD_ADDR 0 is not a new address
+    - selftests: mptcp: join: check removing ID 0 endpoint
+    - selftests: mptcp: join: no extra msg if no counter
+    - selftests: mptcp: join: check re-re-adding ID 0 endp
+    - drm/amdgpu/swsmu: always force a state reprogram on init
+    - drm/vmwgfx: Fix prime with external buffers
+    - usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister
+      existing source caps before re-registration"
+    - ASoC: amd: acp: fix module autoloading
+    - ASoC: SOF: amd: Fix for acp init sequence
+    - pinctrl: mediatek: common-v2: Fix broken bias-disable for
+      PULL_PU_PD_RSEL_TYPE
+    - pinctrl: starfive: jh7110: Correct the level trigger configuration of iev
+      register
+    - ovl: pass string to ovl_parse_layer()
+    - ovl: fix wrong lowerdir number check for parameter Opt_lowerdir
+    - ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err
+    - mm: Fix missing folio invalidation calls during truncation
+    - cifs: Fix FALLOC_FL_PUNCH_HOLE support
+    - selinux,smack: don't bypass permissions check in inode_setsecctx hook
+    - iommufd: Do not allow creating areas without READ or WRITE
+    - phy: fsl-imx8mq-usb: fix tuning parameter name
+    - dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA
+    - dmaengine: dw-edma: Do not enable watermark interrupts for HDMA
+    - phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
+    - dmaengine: dw: Add peripheral bus width verification
+    - dmaengine: dw: Add memory bus width verification
+    - Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test
+    - Bluetooth: btnxpuart: Handle FW Download Abort scenario
+    - Bluetooth: btnxpuart: Fix random crash seen while removing driver
+    - Bluetooth: hci_core: Fix not handling hibernation actions
+    - iommu: Do not return 0 from map_pages if it doesn't do anything
+    - netfilter: nf_tables: restore IP sanity checks for netdev/egress
+    - wifi: iwlwifi: fw: fix wgds rev 3 exact size
+    - ethtool: check device is present when getting link settings
+    - netfilter: nf_tables_ipv6: consider network offset in netdev/egress
+      validation
+    - selftests: forwarding: no_forwarding: Down ports on cleanup
+    - selftests: forwarding: local_termination: Down ports on cleanup
+    - bonding: implement xdo_dev_state_free and call it after deletion
+    - bonding: extract the use of real_device into local variable
+    - bonding: change ipsec_lock from spin lock to mutex
+    - gtp: fix a potential NULL pointer dereference
+    - sctp: fix association labeling in the duplicate COOKIE-ECHO case
+    - drm/amd/display: avoid using null object of framebuffer
+    - net: busy-poll: use ktime_get_ns() instead of local_clock()
+    - nfc: pn533: Add poll mod list filling check
+    - soc: qcom: cmd-db: Map shared memory as WC, not WB
+    - soc: qcom: pmic_glink: Actually communicate when remote goes down
+    - soc: qcom: pmic_glink: Fix race during initialization
+    - cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
+    - scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress
+    - USB: serial: option: add MeiG Smart SRM825L
+    - ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design
+    - usb: dwc3: omap: add missing depopulate in probe error path
+    - usb: dwc3: core: Prevent USB core invalid event buffer address access
+    - usb: dwc3: st: fix probed platform device ref count on probe error path
+    - usb: dwc3: st: add missing depopulate in probe error path
+    - usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
+      remove_power_attributes()
+    - usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
+    - usb: cdnsp: fix for Link TRB with TC
+    - ARM: dts: omap3-n900: correct the accelerometer orientation
+    - arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962
+    - arm64: dts: imx93: add nvmem property for fec1
+    - arm64: dts: imx93: add nvmem property for eqos
+    - arm64: dts: imx93: update default value for snps,clk-csr
+    - arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges
+    - arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo
+    - scsi: aacraid: Fix double-free on probe failure
+    - apparmor: fix policy_unpack_test on big endian systems
+    - mptcp: pr_debug: add missing \n at the end
+    - mptcp: make pm_remove_addrs_and_subflows static
+    - mptcp: pm: fix RM_ADDR ID for the initial subflow
+    - mptcp: avoid duplicated SUB_CLOSED events
+    - drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict
+    - drm/vmwgfx: Prevent unmapping active read buffers
+    - drm/vmwgfx: Disable coherent dumb buffers without 3d
+    - firmware/sysfb: Set firmware-framebuffer parent device
+    - firmware/sysfb: Create firmware device only for enabled PCI devices
+    - video/aperture: optionally match the device in sysfb_disable()
+    - drm/xe: Prepare display for D3Cold
+    - drm/xe/display: Make display suspend/resume work on discrete
+    - drm/xe/vm: Simplify if condition
+    - drm/xe/exec_queue: Rename xe_exec_queue::compute to xe_exec_queue::lr
+    - drm/xe: prevent UAF around preempt fence
+    - pinctrl: qcom: x1e80100: Update PDC hwirq map
+    - ASoC: SOF: amd: move iram-dram fence register programming sequence
+    - nfsd: ensure that nfsd4_fattr_args.context is zeroed out
+    - backing-file: convert to using fops->splice_write
+    - pinctrl: qcom: x1e80100: Fix special pin offsets
+    - afs: Fix post-setattr file edit to do truncation correctly
+    - netfs: Fix netfs_release_folio() to say no if folio dirty
+    - netfs: Fix missing iterator reset on retry of short read
+    - dmaengine: ti: omap-dma: Initialize sglen after allocation
+    - pktgen: use cpus_read_lock() in pg_net_init()
+    - net_sched: sch_fq: fix incorrect behavior for small weights
+    - tcp: fix forever orphan socket caused by tcp_abort
+    - drm/xe/hwmon: Fix WRITE_I1 param from u32 to u16
+    - usb: typec: fsa4480: Relax CHIP_ID check
+    - firmware: qcom: scm: Mark get_wq_ctx() as atomic call
+    - usb: gadget: uvc: queue pump work in uvcg_video_enable()
+    - usb: dwc3: xilinx: add missing depopulate in probe error path
+    - usb: typec: ucsi: Move unregister out of atomic section
+    - firmware: microchip: fix incorrect error report of programming:timeout on
+      success
+    - Upstream stable to v6.6.49, v6.10.8
+  * Fix blank screen on external display after reconnecting the USB type-C
+    (LP: #2081786) // Noble update: upstream stable patchset 2024-10-11
+    (LP: #2084225)
+    - drm/i915/display: add intel_display -> drm_device backpointer
+    - drm/i915/display: add generic to_intel_display() macro
+    - drm/i915/dp_mst: Fix MST state after a sink reset
+  * Noble update: upstream stable patchset 2024-10-09 (LP: #2084005)
+    - tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
+    - tty: atmel_serial: use the correct RTS flag.
+    - Revert "ACPI: EC: Evaluate orphan _REG under EC device"
+    - Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"
+    - Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET"
+    - selinux: revert our use of vma_is_initial_heap()
+    - fuse: Initialize beyond-EOF page contents before setting uptodate
+    - char: xillybus: Don't destroy workqueue from work item running on it
+    - char: xillybus: Refine workqueue handling
+    - char: xillybus: Check USB endpoints when probing device
+    - ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
+    - ALSA: usb-audio: Support Yamaha P-125 quirk entry
+    - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
+    - thunderbolt: Mark XDomain as unplugged when router is removed
+    - ALSA: hda/tas2781: fix wrong calibrated data order
+    - s390/dasd: fix error recovery leading to data corruption on ESE devices
+    - KVM: s390: fix validity interception issue when gisa is switched off
+    - riscv: change XIP's kernel_map.size to be size of the entire kernel
+    - i2c: tegra: Do not mark ACPI devices as irq safe
+    - ACPICA: Add a depth argument to acpi_execute_reg_methods()
+    - ACPI: EC: Evaluate _REG outside the EC scope more carefully
+    - arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to
+      NUMA_NO_NODE
+    - dm resume: don't return EINVAL when signalled
+    - dm persistent data: fix memory allocation failure
+    - fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
+    - s390/cio: rename bitmap_size() -> idset_bitmap_size()
+    - btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
+    - bitmap: introduce generic optimized bitmap_size()
+    - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
+    - i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
+    - rtla/osnoise: Prevent NULL dereference in error handling
+    - net: mana: Fix RX buf alloc_size alignment and atomic op panic
+    - net: mana: Fix doorbell out of order violation and avoid unnecessary
+      doorbell rings
+    - wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
+    - selinux: fix potential counting error in avc_add_xperms_decision()
+    - selinux: add the processing of the failure of avc_add_xperms_decision()
+    - mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu
+    - btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type
+    - btrfs: zoned: properly take lock to read/update block group's zoned
+      variables
+    - btrfs: tree-checker: add dev extent item checks
+    - drm/amdgpu: Actually check flags for all context ops.
+    - memcg_write_event_control(): fix a user-triggerable oops
+    - drm/amdgpu/jpeg2: properly set atomics vmid field
+    - drm/amdgpu/jpeg4: properly set atomics vmid field
+    - s390/uv: Panic for set and remove shared access UVC errors
+    - bpf: Fix updating attached freplace prog in prog_array map
+    - igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
+    - igc: Fix qbv_config_change_errors logics
+    - igc: Fix reset adapter logics when tx mode change
+    - net/mlx5e: Take state lock during tx timeout reporter
+    - net/mlx5e: Correctly report errors for ethtool rx flows
+    - net: axienet: Fix register defines comment description
+    - net: dsa: vsc73xx: pass value in phy_write operation
+    - net: dsa: vsc73xx: use read_poll_timeout instead delay loop
+    - net: dsa: vsc73xx: check busy flag in MDIO operations
+    - net: ethernet: mtk_wed: fix use-after-free panic in
+      mtk_wed_setup_tc_block_cb()
+    - mlxbf_gige: disable RX filters until RX path initialized
+    - mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
+    - tcp: Update window clamping condition
+    - netfilter: allow ipv6 fragments to arrive on different devices
+    - netfilter: flowtable: initialise extack before use
+    - netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
+    - netfilter: nf_tables: Audit log dump reset after the fact
+    - netfilter: nf_tables: Introduce nf_tables_getobj_single
+    - netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests
+    - vsock: fix recursive ->recvmsg calls
+    - selftests: net: lib: ignore possible errors
+    - selftests: net: lib: kill PIDs before del netns
+    - net: hns3: fix wrong use of semaphore up
+    - net: hns3: use the user's cfg after reset
+    - net: hns3: fix a deadlock problem when config TC during resetting
+    - gpio: mlxbf3: Support shutdown() function
+    - ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
+    - rust: work around `bindgen` 0.69.0 issue
+    - rust: suppress error messages from CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
+    - rust: fix the default format for CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
+    - cpu/SMT: Enable SMT only if a core is online
+    - powerpc/topology: Check if a core is online
+    - arm64: Fix KASAN random tag seed initialization
+    - block: Fix lockdep warning in blk_mq_mark_tag_wait
+    - wifi: ath12k: Add missing qmi_txn_cancel() calls
+    - quota: Remove BUG_ON from dqget()
+    - riscv: blacklist assembly symbols for kprobe
+    - kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
+    - media: pci: cx23885: check cx23885_vdev_init() return
+    - fs: binfmt_elf_efpic: don't use missing interpreter's properties
+    - scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
+    - media: drivers/media/dvb-core: copy user arrays safely
+    - wifi: iwlwifi: mvm: avoid garbage iPN
+    - net/sun3_82586: Avoid reading past buffer in debug output
+    - drm/lima: set gp bus_stop bit before hard reset
+    - gpio: sysfs: extend the critical section for unregistering sysfs devices
+    - hrtimer: Select housekeeping CPU during migration
+    - virtiofs: forbid newlines in tags
+    - accel/habanalabs: fix debugfs files permissions
+    - clocksource/drivers/arm_global_timer: Guard against division by zero
+    - tick: Move got_idle_tick away from common flags
+    - netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
+    - md: clean up invalid BUG_ON in md_ioctl
+    - x86: Increase brk randomness entropy for 64-bit systems
+    - memory: stm32-fmc2-ebi: check regmap_read return value
+    - parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
+    - rxrpc: Don't pick values out of the wire header when setting up security
+    - f2fs: stop checkpoint when get a out-of-bounds segment
+    - powerpc/boot: Handle allocation failure in simple_realloc()
+    - powerpc/boot: Only free if realloc() succeeds
+    - btrfs: delayed-inode: drop pointless BUG_ON in __btrfs_remove_delayed_item()
+    - btrfs: defrag: change BUG_ON to assertion in btrfs_defrag_leaves()
+    - btrfs: change BUG_ON to assertion when checking for delayed_node root
+    - btrfs: push errors up from add_async_extent()
+    - btrfs: handle invalid root reference found in may_destroy_subvol()
+    - btrfs: send: handle unexpected data in header buffer in begin_cmd()
+    - btrfs: send: handle unexpected inode in header process_recorded_refs()
+    - btrfs: change BUG_ON to assertion in tree_move_down()
+    - btrfs: delete pointless BUG_ON check on quota root in
+      btrfs_qgroup_account_extent()
+    - f2fs: fix to do sanity check in update_sit_entry
+    - usb: gadget: fsl: Increase size of name buffer for endpoints
+    - nvme: clear caller pointer on identify failure
+    - Bluetooth: bnep: Fix out-of-bound access
+    - firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid
+    - rtc: nct3018y: fix possible NULL dereference
+    - net: hns3: add checking for vf id of mailbox
+    - nvmet-tcp: do not continue for invalid icreq
+    - NFS: avoid infinite loop in pnfs_update_layout.
+    - openrisc: Call setup_memory() earlier in the init sequence
+    - s390/iucv: fix receive buffer virtual vs physical address confusion
+    - irqchip/renesas-rzg2l: Do not set TIEN and TINT source at the same time
+    - platform/x86: lg-laptop: fix %s null argument warning
+    - usb: dwc3: core: Skip setting event buffers for host only controllers
+    - irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
+    - ext4: set the type of max_zeroout to unsigned int to avoid overflow
+    - nvmet-rdma: fix possible bad dereference when freeing rsps
+    - selftests/bpf: Fix a few tests for GCC related warnings.
+    - Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
+    - nvme: use srcu for iterating namespace list
+    - drm/amdgpu: fix dereference null return value for the function
+      amdgpu_vm_pt_parent
+    - hrtimer: Prevent queuing of hrtimer without a function callback
+    - nvme: fix namespace removal list
+    - gtp: pull network headers in gtp_dev_xmit()
+    - riscv: entry: always initialize regs->a0 to -ENOSYS
+    - smb3: fix lock breakage for cached writes
+    - dm suspend: return -ERESTARTSYS instead of -EINTR
+    - selftests: memfd_secret: don't build memfd_secret test on unsupported arches
+    - mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order
+      fallback to order 0
+    - btrfs: send: allow cloning non-aligned extent if it ends at i_size
+    - drm/amd/amdgpu: command submission parser for JPEG
+    - platform/surface: aggregator: Fix warning when controller is destroyed in
+      probe
+    - ALSA: hda/tas2781: Use correct endian conversion
+    - Bluetooth: hci_core: Fix LE quote calculation
+    - Bluetooth: SMP: Fix assumption of Central always being Initiator
+    - net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and
+      register injection
+    - net: mscc: ocelot: fix QoS class for injected packets with "ocelot-8021q"
+    - net: mscc: ocelot: serialize access to the injection/extraction groups
+    - tc-testing: don't access non-existent variable on exception
+    - selftests: udpgro: report error when receive failed
+    - tcp/dccp: bypass empty buckets in inet_twsk_purge()
+    - tcp/dccp: do not care about families in inet_twsk_purge()
+    - tcp: prevent concurrent execution of tcp_sk_exit_batch
+    - net: mctp: test: Use correct skb for route input check
+    - kcm: Serialise kcm_sendmsg() for the same socket.
+    - netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
+    - netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
+    - ip6_tunnel: Fix broken GRO
+    - bonding: fix bond_ipsec_offload_ok return type
+    - bonding: fix null pointer deref in bond_ipsec_offload_ok
+    - bonding: fix xfrm real_dev null pointer dereference
+    - bonding: fix xfrm state handling when clearing active slave
+    - ice: fix page reuse when PAGE_SIZE is over 8k
+    - ice: fix ICE_LAST_OFFSET formula
+    - ice: fix truesize operations for PAGE_SIZE >= 8192
+    - dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
+    - igb: cope with large MAX_SKB_FRAGS
+    - net: dsa: mv88e6xxx: Fix out-of-bound access
+    - udp: fix receiving fraglist GSO packets
+    - ipv6: fix possible UAF in ip6_finish_output2()
+    - ipv6: prevent possible UAF in ip6_xmit()
+    - bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
+    - netfilter: flowtable: validate vlan header
+    - octeontx2-af: Fix CPT AF register offset calculation
+    - net: xilinx: axienet: Always disable promiscuous mode
+    - net: xilinx: axienet: Fix dangling multicast addresses
+    - net: ovs: fix ovs_drop_reasons error
+    - drm/msm/dpu: don't play tricks with debug macros
+    - drm/msm/dp: fix the max supported bpp logic
+    - drm/msm/dpu: split dpu_encoder_wait_for_event into two functions
+    - drm/msm/dpu: capture snapshot on the first commit_done timeout
+    - drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()
+    - drm/msm/dp: reset the link phy params before link training
+    - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
+    - drm/msm/dpu: take plane rotation into account for wide planes
+    - drm/msm: fix the highest_bank_bit for sc7180
+    - mmc: mmc_test: Fix NULL dereference on allocation failure
+    - Bluetooth: MGMT: Add error handling to pair_device()
+    - scsi: core: Fix the return value of scsi_logical_block_count()
+    - ksmbd: the buffer of smb2 query dir response has at least 1 byte
+    - drm/amdgpu: Validate TA binary size
+    - net: dsa: microchip: fix PTP config failure when using multiple ports
+    - MIPS: Loongson64: Set timer mode in cpu-probe
+    - HID: wacom: Defer calculation of resolution until resolution_code is known
+    - Input: i8042 - add forcenorestore quirk to leave controller untouched even
+      on s3
+    - Input: i8042 - use new forcenorestore quirk to replace old buggy quirk
+      combination
+    - cxgb4: add forgotten u64 ivlan cast before shift
+    - KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
+    - mmc: mtk-sd: receive cmd8 data when hs400 tuning fail
+    - mmc: dw_mmc: allow biu and ciu clocks to defer
+    - smb3: fix broken cached reads when posix locks
+    - pmdomain: imx: scu-pd: Remove duplicated clocks
+    - pmdomain: imx: wait SSAR when i.MX93 power domain on
+    - nouveau/firmware: use dma non-coherent allocator
+    - mptcp: pm: re-using ID of unused removed ADD_ADDR
+    - mptcp: pm: re-using ID of unused removed subflows
+    - mptcp: pm: re-using ID of unused flushed subflows
+    - mptcp: pm: remove mptcp_pm_remove_subflow()
+    - mptcp: pm: only mark 'subflow' endp as available
+    - mptcp: pm: only decrement add_addr_accepted for MPJ req
+    - mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
+    - mptcp: pm: only in-kernel cannot have entries with ID 0
+    - mptcp: pm: fullmesh: select the right ID later
+    - mptcp: pm: avoid possible UaF when selecting endp
+    - selftests: mptcp: join: validate fullmesh endp on 1st sf
+    - selftests: mptcp: join: restrict fullmesh endp on 1st sf
+    - selftests: mptcp: join: check re-using ID of closed subflow
+    - tcp: do not export tcp_twsk_purge()
+    - drm/msm/mdss: specify cfg bandwidth for SDM670
+    - drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels
+    - igc: Fix qbv tx latency by setting gtxoffset
+    - ALSA: timer: Relax start tick time check for slave timer elements
+    - bpf: Fix a kernel verifier crash in stacksafe()
+    - selftests/bpf: Add a test to verify previous stacksafe() fix
+    - Revert "s390/dasd: Establish DMA alignment"
+    - Input: MT - limit max slots
+    - tools: move alignment-related macros to new <linux/align.h>
+    - Revert "serial: 8250_omap: Set the console genpd always on if no console
+      suspend"
+    - usb: misc: ljca: Add Lunar Lake ljca GPIO HID to ljca_gpio_hids[]
+    - usb: xhci: Check for xhci->interrupters being allocated in
+      xhci_mem_clearup()
+    - vfs: Don't evict inode under the inode lru traversing context
+    - tracing: Return from tracing_buffers_read() if the file has been closed
+    - mm: fix endless reclaim on machines with unaccepted memory
+    - fs/netfs/fscache_cookie: add missing "n_accesses" check
+    - mm/numa: no task_numa_fault() call if PMD is changed
+    - mm/numa: no task_numa_fault() call if PTE is changed
+    - btrfs: check delayed refs when we're checking if a ref exists
+    - drm/amd/display: Adjust cursor position
+    - drm/amd/display: fix s2idle entry for DCN3.5+
+    - drm/amd/display: Enable otg synchronization logic for DCN321
+    - drm/amd/display: fix cursor offset on rotation 180
+    - netfs: Fault in smaller chunks for non-large folio mappings
+    - libfs: fix infinite directory reads for offset dir
+    - kallsyms: Avoid weak references for kallsyms symbols
+    - kbuild: avoid unneeded kallsyms step 3
+    - kbuild: refactor variables in scripts/link-vmlinux.sh
+    - kbuild: remove PROVIDE() for kallsyms symbols
+    - kallsyms: get rid of code for absolute kallsyms
+    - [Config] Remove CONFIG_KALLSYMS_BASE_RELATIVE
+    - kallsyms: Do not cleanup .llvm.<hash> suffix before sorting symbols
+    - bpf: Replace deprecated strncpy with strscpy
+    - kallsyms: replace deprecated strncpy with strscpy
+    - kallsyms: rework symbol lookup return codes
+    - kallsyms: Match symbols exactly with CONFIG_LTO_CLANG
+    - drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()`
+    - drm/amd/display: Don't register panel_power_savings on OLED panels
+    - wifi: ath12k: use 128 bytes aligned iova in transmit path for WCN7850
+    - kbuild: merge temporary vmlinux for BTF and kallsyms
+    - kbuild: avoid scripts/kallsyms parsing /dev/null
+    - Bluetooth: HCI: Invert LE State quirk to be opt-out rather then opt-in
+    - net/mlx5: Fix IPsec RoCE MPV trace call
+    - selftests: udpgro: no need to load xdp for gro
+    - ice: use internal pf id instead of function number
+    - drm/msm/dpu: limit QCM2290 to RGB formats only
+    - drm/msm/dpu: relax YUV requirements
+    - spi: spi-cadence-quadspi: Fix OSPI NOR failures during system resume
+    - drm/xe/display: stop calling domains_driver_remove twice
+    - drm/xe: Fix opregion leak
+    - drm/xe/mmio: move mmio_fini over to devm
+    - drm/xe: reset mmio mappings with devm
+    - drm/xe: Fix tile fini sequence
+    - drm/xe: Fix missing workqueue destroy in xe_gt_pagefault
+    - drm/xe: Free job before xe_exec_queue_put
+    - thermal/debugfs: Fix the NULL vs IS_ERR() confusion in debugfs_create_dir()
+    - nvme: move stopping keep-alive into nvme_uninit_ctrl()
+    - drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1
+    - s390/ap: Refine AP bus bindings complete processing
+    - net: ngbe: Fix phy mode set to external phy
+    - iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace()
+    - cgroup/cpuset: fix panic caused by partcmd_update
+    - cgroup/cpuset: Clear effective_xcpus on cpus_allowed clearing only if
+      cpus.exclusive not set
+    - of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put()
+      handling
+    - thermal: of: Fix OF node leak in thermal_of_trips_init() error path
+    - thermal: of: Fix OF node leak in thermal_of_zone_register()
+    - thermal: of: Fix OF node leak in of_thermal_zone_find() error paths
+    - Upstream stable to v6.6.48, v6.10.7
+  * Unable to list directories using CIFS on 6.8 kernel (LP: #2082423) // Noble
+    update: upstream stable patchset 2024-10-09 (LP: #2084005)
+    - smb: client: ignore unhandled reparse tags
+  * CVE-2024-46759
+    - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
+  * CVE-2024-46758
+    - hwmon: (lm95234) Fix underflows seen when writing limit attributes
+  * CVE-2024-46756
+    - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
+  * CVE-2024-46738
+    - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
+  * CVE-2024-46722
+    - drm/amdgpu: fix mc_data out-of-bounds read warning
+  * LXD fan bridge causes blocked tasks (LP: #2064176)
+    - SAUCE: fan: release rcu_read_lock on skb discard path
+    - SAUCE: fan: fix racy device stat update
+  * x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (LP: #2081863)
+    - x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
+  * UBSAN: array-index-out-of-bounds in module mt76 (LP: #2081785)
+    - wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc
+  * The system hangs after resume with thunderbolt monitor(AMD GPU [1002:1900])
+    (LP: #2083182)
+    - SAUCE: drm/amd/display: Fix system hang while resume with TBT monitor
+  * [SRU] GPU: support additional device ids for DG2 driver (LP: #2083701)
+    - drm/i915: Add new PCI IDs to DG2 platform in driver
+  * [SRU]Intel Arrow Lake IBECC feature backport request for ubuntu 22.04.5 and
+    24.04.1 server (LP: #2077861)
+    - EDAC/igen6: Add Intel Arrow Lake-U/H SoCs support
+  * Noble update: upstream stable patchset 2024-10-07 (LP: #2083794)
+    - ASoC: topology: Clean up route loading
+    - ASoC: topology: Fix route memory corruption
+    - LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h
+    - sunrpc: don't change ->sv_stats if it doesn't exist
+    - nfsd: stop setting ->pg_stats for unused stats
+    - sunrpc: pass in the sv_stats struct through svc_create_pooled
+    - sunrpc: remove ->pg_stats from svc_program
+    - nfsd: remove nfsd_stats, make th_cnt a global counter
+    - nfsd: make svc_stat per-network namespace instead of global
+    - mm: gup: stop abusing try_grab_folio
+    - nvme/pci: Add APST quirk for Lenovo N60z laptop
+    - genirq/cpuhotplug: Skip suspended interrupts when restoring affinity
+    - genirq/cpuhotplug: Retry with cpu_online_mask when migration fails
+    - quota: Detect loops in quota tree
+    - bpf: Replace bpf_lpm_trie_key 0-length array with flexible array
+    - fs: Annotate struct file_handle with __counted_by() and use struct_size()
+    - mISDN: fix MISDN_TIME_STAMP handling
+    - mm/page_table_check: support userfault wr-protect entries
+    - bpf, net: Use DEV_STAT_INC()
+    - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
+    - f2fs: fix to cover read extent cache access with lock
+    - fou: remove warn in gue_gro_receive on unsupported protocol
+    - jfs: fix null ptr deref in dtInsertEntry
+    - jfs: Fix shift-out-of-bounds in dbDiscardAG
+    - fs/ntfs3: Do copy_to_user out of run_lock
+    - ALSA: usb: Fix UBSAN warning in parse_audio_unit()
+    - binfmt_flat: Fix corruption when not offsetting data start
+    - mm/debug_vm_pgtable: drop RANDOM_ORVALUE trick
+    - KVM: arm64: Don't defer TLB invalidation when zapping table entries
+    - KVM: arm64: Don't pass a TLBI level hint when zapping table entries
+    - drm/amd/display: Defer handling mst up request in resume
+    - drm/amd/display: Guard cursor idle reallow by DC debug option
+    - drm/amd/display: Separate setting and programming of cursor
+    - drm/amd/display: Prevent IPX From Link Detect and Set Mode
+    - ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
+    - platform/x86/amd/pmf: Fix to Update HPD Data When ALS is Disabled
+    - platform/x86: ideapad-laptop: introduce a generic notification chain
+    - platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc
+    - platform/x86: ideapad-laptop: add a mutex to synchronize VPC commands
+    - drm/amd/display: Solve mst monitors blank out problem after resume
+    - drm/amdgpu/display: Fix null pointer dereference in
+      dc_stream_program_cursor_position
+    - Upstream stable to v6.6.47, v6.10.6
+  * Noble update: upstream stable patchset 2024-10-04 (LP: #2083656)
+    - irqchip/mbigen: Fix mbigen node address layout
+    - platform/x86/intel/ifs: Initialize union ifs_status to zero
+    - jump_label: Fix the fix, brown paper bags galore
+    - x86/mm: Fix pti_clone_pgtable() alignment assumption
+    - x86/mm: Fix pti_clone_entry_text() for i386
+    - smb: client: move most of reparse point handling code to common file
+    - smb: client: set correct d_type for reparse DFS/DFSR and mount point
+    - smb: client: handle lack of FSCTL_GET_REPARSE_POINT support
+    - sctp: Fix null-ptr-deref in reuseport_add_sock().
+    - net: usb: qmi_wwan: fix memory leak for not ip packets
+    - net: bridge: mcast: wait for previous gc cycles when removing port
+    - net: linkwatch: use system_unbound_wq
+    - ice: Fix reset handler
+    - Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
+    - Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv
+      monitor
+    - net/smc: add the max value of fallback reason count
+    - net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
+    - l2tp: fix lockdep splat
+    - net: bcmgenet: Properly overlay PHY and MAC Wake-on-LAN capabilities
+    - net: fec: Stop PPS on driver remove
+    - gpio: prevent potential speculation leaks in gpio_device_get_desc()
+    - hwmon: corsair-psu: add USB id of HX1200i Series 2023 psu
+    - rcutorture: Fix rcu_torture_fwd_cb_cr() data race
+    - md: do not delete safemode_timer in mddev_suspend
+    - md/raid5: avoid BUG_ON() while continue reshape after reassembling
+    - block: change rq_integrity_vec to respect the iterator
+    - rcu: Fix rcu_barrier() VS post CPUHP_TEARDOWN_CPU invocation
+    - clocksource/drivers/sh_cmt: Address race condition for clock events
+    - ACPI: battery: create alarm sysfs attribute atomically
+    - ACPI: SBS: manage alarm sysfs attribute through psy core
+    - xen: privcmd: Switch from mutex to spinlock for irqfds
+    - wifi: nl80211: disallow setting special AP channel widths
+    - wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup()
+    - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
+    - selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
+    - af_unix: Don't retry after unix_state_lock_nested() in
+      unix_stream_connect().
+    - PCI: Add Edimax Vendor ID to pci_ids.h
+    - udf: prevent integer overflow in udf_bitmap_free_blocks()
+    - wifi: nl80211: don't give key data to userspace
+    - can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index
+      erratum
+    - can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of
+      mcp2518fd
+    - net: stmmac: qcom-ethqos: enable SGMII loopback during DMA reset on
+      sa8775p-ride-r3
+    - btrfs: do not clear page dirty inside extent_write_locked_range()
+    - btrfs: fix invalid mapping of extent xarray state
+    - btrfs: fix bitmap leak when loading free space cache on duplicate entry
+    - Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver
+      unloading
+    - drm/amd/display: Add delay to improve LTTPR UHBR interop
+    - drm/amdgpu: fix potential resource leak warning
+    - drm/amdgpu/pm: Fix the param type of set_power_profile_mode
+    - drm/amdgpu/pm: Fix the null pointer dereference for smu7
+    - drm/amdgpu: Fix the null pointer dereference to ras_manager
+    - drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
+    - drm/admgpu: fix dereferencing null pointer context
+    - drm/amdgpu: Add lock around VF RLCG interface
+    - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
+    - media: amphion: Remove lock in s_ctrl callback
+    - drm/amd/display: Add null checker before passing variables
+    - media: uvcvideo: Ignore empty TS packets
+    - media: uvcvideo: Fix the bandwdith quirk on USB 3.x
+    - media: xc2028: avoid use-after-free in load_firmware_cb()
+    - ext4: fix uninitialized variable in ext4_inlinedir_to_tree
+    - jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
+    - s390/sclp: Prevent release of buffer in I/O
+    - SUNRPC: Fix a race to wake a sync task
+    - profiling: remove profile=sleep support
+    - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
+    - irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to
+      'raw_spinlock_t'
+    - irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq()
+    - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
+    - net: drop bad gso csum_start and offset in virtio_net_hdr
+    - arm64: Add Neoverse-V2 part
+    - arm64: barrier: Restore spec_bar() macro
+    - arm64: cputype: Add Cortex-X4 definitions
+    - arm64: cputype: Add Neoverse-V3 definitions
+    - arm64: errata: Add workaround for Arm errata 3194386 and 3312417
+    - arm64: cputype: Add Cortex-X3 definitions
+    - arm64: cputype: Add Cortex-A720 definitions
+    - arm64: cputype: Add Cortex-X925 definitions
+    - arm64: errata: Unify speculative SSBS errata logic
+    - [Config] Set ARM64_ERRATUM_3194386=y
+    - arm64: errata: Expand speculative SSBS workaround
+    - arm64: cputype: Add Cortex-X1C definitions
+    - arm64: cputype: Add Cortex-A725 definitions
+    - arm64: errata: Expand speculative SSBS workaround (again)
+    - i2c: smbus: Improve handling of stuck alerts
+    - ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
+    - ASoC: codecs: wsa881x: Correct Soundwire ports mask
+    - ASoC: codecs: wsa883x: parse port-mapping information
+    - ASoC: codecs: wsa883x: Correct Soundwire ports mask
+    - ASoC: codecs: wsa884x: parse port-mapping information
+    - ASoC: codecs: wsa884x: Correct Soundwire ports mask
+    - ASoC: sti: add missing probe entry for player and reader
+    - spi: spidev: Add missing spi_device_id for bh2228fv
+    - ASoC: SOF: Remove libraries from topology lookups
+    - i2c: smbus: Send alert notifications to all devices if source not found
+    - bpf: kprobe: remove unused declaring of bpf_kprobe_override
+    - kprobes: Fix to check symbol prefixes correctly
+    - i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume
+    - i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
+    - spi: spi-fsl-lpspi: Fix scldiv calculation
+    - ALSA: usb-audio: Re-add ScratchAmp quirk entries
+    - ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
+    - cifs: cifs_inval_name_dfs_link_error: correct the check for fullpath
+    - module: warn about excessively long module waits
+    - module: make waiting for a concurrent module loader interruptible
+    - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
+    - drm/amd/display: Skip Recompute DSC Params if no Stream on Link
+    - drm/amdgpu: Forward soft recovery errors to userspace
+    - drm/i915/gem: Adjust vma offset for framebuffer mmap offset
+    - drm/client: fix null pointer dereference in drm_client_modeset_probe
+    - ALSA: line6: Fix racy access to midibuf
+    - ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
+    - ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks
+    - ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
+    - usb: vhci-hcd: Do not drop references before new references are gained
+    - USB: serial: debug: do not echo input by default
+    - usb: gadget: core: Check for unset descriptor
+    - usb: gadget: midi2: Fix the response for FB info with block 0xff
+    - usb: gadget: u_serial: Set start_delayed during suspend
+    - usb: gadget: u_audio: Check return codes from usb_ep_enable and
+      config_ep_by_speed.
+    - scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES
+    - scsi: ufs: core: Do not set link to OFF state while waking up from
+      hibernation
+    - scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
+    - tick/broadcast: Move per CPU pointer access into the atomic section
+    - vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
+    - ntp: Clamp maxerror and esterror to operating range
+    - clocksource: Scale the watchdog read retries automatically
+    - clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
+    - driver core: Fix uevent_show() vs driver detach race
+    - tracefs: Fix inode allocation
+    - tracefs: Use generic inode RCU for synchronizing freeing
+    - ntp: Safeguard against time_constant overflow
+    - timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex()
+    - serial: core: check uartclk for zero to avoid divide by zero
+    - memcg: protect concurrent access to mem_cgroup_idr
+    - parisc: fix unaligned accesses in BPF
+    - parisc: fix a possible DMA corruption
+    - ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx
+    - kcov: properly check for softirq context
+    - irqchip/xilinx: Fix shift out of bounds
+    - genirq/irqdesc: Honor caller provided affinity in alloc_desc()
+    - LoongArch: Enable general EFI poweroff method
+    - power: supply: qcom_battmgr: return EAGAIN when firmware service is not up
+    - power: supply: axp288_charger: Fix constant_charge_voltage writes
+    - power: supply: axp288_charger: Round constant_charge_voltage writes down
+    - tracing: Fix overflow in get_free_elt()
+    - padata: Fix possible divide-by-0 panic in padata_mt_helper()
+    - smb3: fix setting SecurityFlags when encryption is required
+    - eventfs: Don't return NULL in eventfs_create_dir()
+    - eventfs: Use SRCU for freeing eventfs_inodes
+    - selftests: mm: add s390 to ARCH check
+    - btrfs: avoid using fixed char array size for tree names
+    - x86/paravirt: Fix incorrect virt spinlock setting on bare metal
+    - x86/mtrr: Check if fixed MTRRs exist before saving them
+    - sched/smt: Introduce sched_smt_present_inc/dec() helper
+    - sched/smt: Fix unbalance sched_smt_present dec/inc
+    - sched/core: Introduce sched_set_rq_on/offline() helper
+    - sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate()
+    - drm/bridge: analogix_dp: properly handle zero sized AUX transactions
+    - drm/dp_mst: Skip CSN if topology probing is not done yet
+    - drm/lima: Mark simple_ondemand governor as softdep
+    - drm/mgag200: Set DDC timeout in milliseconds
+    - drm/mgag200: Bind I2C lifetime to DRM device
+    - drm/radeon: Remove __counted_by from StateArray.states[]
+    - mptcp: fully established after ADD_ADDR echo on MPJ
+    - mptcp: pm: deny endp with signal + subflow + port
+    - block: use the right type for stub rq_integrity_vec()
+    - btrfs: fix corruption after buffer fault in during direct IO append write
+    - tools headers arm64: Sync arm64's cputype.h with the kernel sources
+    - mm/hugetlb: fix potential race in __update_and_free_hugetlb_folio()
+    - xfs: fix log recovery buffer allocation for the legacy h_size fixup
+    - mptcp: pm: reduce indentation blocks
+    - mptcp: pm: don't try to create sf if alloc failed
+    - mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set
+    - selftests: mptcp: join: ability to invert ADD_ADDR check
+    - selftests: mptcp: join: test both signal & subflow
+    - Revert "selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky"
+    - btrfs: fix double inode unlock for direct IO sync writes
+    - perf/x86/intel/cstate: Switch to new Intel CPU model defines
+    - perf/x86/intel/cstate: Add Arrowlake support
+    - perf/x86/intel/cstate: Add Lunarlake support
+    - perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest
+    - platform/x86: intel-vbtn: Protect ACPI notify handler against recursion
+    - perf/x86/amd: Use try_cmpxchg() in events/amd/{un,}core.c
+    - perf/x86/intel: Support the PEBS event mask
+    - perf/x86: Support counter mask
+    - perf/x86: Fix smp_processor_id()-in-preemptible warnings
+    - virtio-net: unbreak vq resizing when coalescing is not negotiated
+    - net: dsa: microchip: Fix Wake-on-LAN check to not return an error
+    - net: dsa: microchip: disable EEE for KSZ8567/KSZ9567/KSZ9896/KSZ9897.
+    - regmap: kunit: Use a KUnit action to call regmap_exit()
+    - regmap: kunit: Replace a kmalloc/kfree() pair with KUnit-managed alloc
+    - regmap: kunit: Fix memory leaks in gen_regmap() and gen_raw_regmap()
+    - debugobjects: Annotate racy debug variables
+    - nvme: apple: fix device reference counting
+    - cpufreq: amd-pstate: Allow users to write 'default' EPP string
+    - cpufreq: amd-pstate: auto-load pstate driver by default
+    - soc: qcom: icc-bwmon: Allow for interrupts to be shared across instances
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MU
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MJ
+    - thermal: intel: hfi: Give HFI instances package scope
+    - wifi: ath12k: fix race due to setting ATH12K_FLAG_EXT_IRQ_ENABLED too early
+    - wifi: rtlwifi: handle return value of usb init TX/RX
+    - wifi: rtw89: pci: fix RX tag race condition resulting in wrong RX length
+    - wifi: mac80211: fix NULL dereference at band check in starting tx ba session
+    - bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory
+      accesses
+    - mlxsw: pci: Lock configuration space of upstream bridge during reset
+    - btrfs: do not BUG_ON() when freeing tree block after error
+    - btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info()
+    - btrfs: fix data race when accessing the last_trans field of a root
+    - drm/xe/preempt_fence: enlarge the fence critical section
+    - drm/amd/display: Handle HPD_IRQ for internal link
+    - drm/amd/amdkfd: Fix a resource leak in svm_range_validate_and_map()
+    - drm/xe/xe_guc_submit: Fix exec queue stop race condition
+    - drm/amd/display: Add null checks for 'stream' and 'plane' before
+      dereferencing
+    - drm/amd/display: Wake DMCUB before sending a command for replay feature
+    - drm/amd/display: reduce ODM slice count to initial new dc state only when
+      needed
+    - of: Add cleanup.h based auto release via __free(device_node) markings
+    - media: i2c: ov5647: replacing of_node_put with __free(device_node)
+    - drm/amd/display: Fix null pointer deref in dcn20_resource.c
+    - ext4: sanity check for NULL pointer after ext4_force_shutdown
+    - mm, slub: do not call do_slab_free for kfence object
+    - ASoC: cs35l56: Revert support for dual-ownership of ASP registers
+    - drm/atomic: allow no-op FB_ID updates for async flips
+    - drm/amd/display: Replace dm_execute_dmub_cmd with
+      dc_wake_and_execute_dmub_cmd
+    - drm/xe/rtp: Fix off-by-one when processing rules
+    - drm/xe: Use dma_fence_chain_free in chain fence unused as a sync
+    - drm/xe/hwmon: Fix PL1 disable flow in xe_hwmon_power_max_write
+    - drm/xe: Move lrc snapshot capturing to xe_lrc.c
+    - drm/xe: Minor cleanup in LRC handling
+    - drm/test: fix the gem shmem test to map the sg table.
+    - usb: typec: pd: no opencoding of FIELD_GET
+    - usb: typec: fsa4480: Check if the chip is really there
+    - PM: runtime: Simplify pm_runtime_get_if_active() usage
+    - scsi: ufs: core: Fix deadlock during RTC update
+    - serial: sc16is7xx: fix invalid FIFO access with special register set
+    - tracing: Have format file honor EVENT_FILE_FL_FREED
+    - mm: list_lru: fix UAF for memory cgroup
+    - net/tcp: Disable TCP-AO static key after RCU grace period
+    - Revert "drm/amd/display: Handle HPD_IRQ for internal link"
+    - idpf: fix memleak in vport interrupt configuration
+    - drm/amd/display: Add null check in resource_log_pipe_topology_update
+    - Upstream stable to v6.6.46, v6.10.5
+  * Noble update: upstream stable patchset 2024-10-02 (LP: #2083488)
+    - sysctl: allow change system v ipc sysctls inside ipc namespace
+    - sysctl: allow to change limits for posix messages queues
+    - sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)
+    - ext4: factor out a common helper to query extent map
+    - ext4: check the extent status again before inserting delalloc block
+    - leds: trigger: Store brightness set by led_trigger_event()
+    - leds: trigger: Call synchronize_rcu() before calling trig->activate()
+    - KVM: VMX: Move posted interrupt descriptor out of VMX code
+    - fbdev/vesafb: Replace references to global screen_info by local pointer
+    - video: Add helpers for decoding screen_info
+    - [Config] Update CONFIG_SCREEN_INFO
+    - video: Provide screen_info_get_pci_dev() to find screen_info's PCI device
+    - firmware/sysfb: Update screen_info for relocated EFI framebuffers
+    - mm: page_alloc: control latency caused by zone PCP draining
+    - mm/page_alloc: fix pcp->count race between drain_pages_zone() vs
+      __rmqueue_pcplist()
+    - f2fs: fix to avoid use SSR allocate when do defragment
+    - f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid
+    - dmaengine: fsl-edma: add address for channel mux register in fsl_edma_chan
+    - dmaengine: fsl-edma: add i.MX8ULP edma support
+    - perf: imx_perf: fix counter start and config sequence
+    - MIPS: Loongson64: DTS: Fix PCIe port nodes for ls7a
+    - MIPS: dts: loongson: Fix liointc IRQ polarity
+    - MIPS: dts: loongson: Fix ls2k1000-rtc interrupt
+    - ARM: 9406/1: Fix callchain_trace() return value
+    - HID: amd_sfh: Move sensor discovery before HID device initialization
+    - perf tool: fix dereferencing NULL al->maps
+    - drm/nouveau: prime: fix refcount underflow
+    - drm/vmwgfx: Fix overlay when using Screen Targets
+    - drm/vmwgfx: Trigger a modeset when the screen moves
+    - sched: act_ct: take care of padding in struct zones_ht_key
+    - wifi: cfg80211: fix reporting failed MLO links status with
+      cfg80211_connect_done
+    - net: phy: realtek: add support for RTL8366S Gigabit PHY
+    - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode
+    - Bluetooth: btintel: Fail setup on error
+    - Bluetooth: hci_sync: Fix suspending with wrong filter policy
+    - tcp: annotate data-races around tp->window_clamp
+    - tcp: Adjust clamping window for applications specifying SO_RCVBUF
+    - net: axienet: start napi before enabling Rx/Tx
+    - rtnetlink: Don't ignore IFLA_TARGET_NETNSID when ifname is specified in
+      rtnl_dellink().
+    - i915/perf: Remove code to update PWR_CLK_STATE for gen12
+    - ice: respect netif readiness in AF_XDP ZC related ndo's
+    - ice: don't busy wait for Rx queue disable in ice_qp_dis()
+    - ice: replace synchronize_rcu with synchronize_net
+    - ice: add missing WRITE_ONCE when clearing ice_rx_ring::xdp_prog
+    - drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro
+    - net: mvpp2: Don't re-use loop iterator
+    - net: phy: micrel: Fix the KSZ9131 MDI-X status issue
+    - ALSA: hda: Conditionally use snooping for AMD HDMI
+    - netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().
+    - netfilter: iptables: Fix potential null-ptr-deref in
+      ip6table_nat_table_init().
+    - net/mlx5: Always drain health in shutdown callback
+    - net/mlx5: Fix error handling in irq_pool_request_irq
+    - net/mlx5: Lag, don't use the hardcoded value of the first port
+    - net/mlx5: Fix missing lock on sync reset reload
+    - net/mlx5e: Require mlx5 tc classifier action support for IPsec prio
+      capability
+    - net/mlx5e: Fix CT entry update leaks of modify header context
+    - net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
+    - igc: Fix double reset adapter triggered from a single taprio cmd
+    - ipv6: fix ndisc_is_useropt() handling for PIO
+    - perf: riscv: Fix selecting counters in legacy mode
+    - riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
+    - riscv: Fix linear mapping checks for non-contiguous memory regions
+    - arm64: jump_label: Ensure patched jump_labels are visible to all CPUs
+    - rust: SHADOW_CALL_STACK is incompatible with Rust
+    - platform/chrome: cros_ec_proto: Lock device when updating MKBP version
+    - HID: wacom: Modify pen IDs
+    - btrfs: zoned: fix zone_unusable accounting on making block group read-write
+      again
+    - btrfs: do not subtract delalloc from avail bytes
+    - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
+    - mptcp: sched: check both directions for backup
+    - ALSA: usb-audio: Correct surround channels in UAC1 channel map
+    - ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
+    - ALSA: seq: ump: Optimize conversions from SysEx to UMP
+    - Revert "ALSA: firewire-lib: obsolete workqueue for period update"
+    - Revert "ALSA: firewire-lib: operate for period elapse event in process
+      context"
+    - drm/vmwgfx: Fix a deadlock in dma buf fence polling
+    - drm/virtio: Fix type of dma-fence context variable
+    - drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll()
+    - net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
+    - r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
+    - mptcp: fix user-space PM announced address accounting
+    - mptcp: distinguish rcv vs sent backup flag in requests
+    - mptcp: fix NL PM announced address accounting
+    - mptcp: mib: count MPJ with backup flag
+    - mptcp: fix bad RCVPRUNED mib accounting
+    - mptcp: pm: only set request_bkup flag when sending MP_PRIO
+    - mptcp: fix duplicate data handling
+    - selftests: mptcp: always close input's FD if opened
+    - selftests: mptcp: join: validate backup in MPJ
+    - selftests: mptcp: join: check backup support in signal endp
+    - mm/huge_memory: mark racy access onhuge_anon_orders_always
+    - mm: fix khugepaged activation policy
+    - x86/cpu/vfm: Add/initialize x86_vfm field to struct cpuinfo_x86
+    - perf/x86/intel: Switch to new Intel CPU model defines
+    - perf/x86/intel: Add a distinct name for Granite Rapids
+    - drm/gpuvm: fix missing dependency to DRM_EXEC
+    - netlink: specs: correct the spec of ethtool
+    - ethtool: rss: echo the context number back
+    - wifi: cfg80211: correct S1G beacon length calculation
+    - ethtool: fix setting key and resetting indir at once
+    - ice: modify error handling when setting XSK pool in ndo_bpf
+    - ice: toggle netif_carrier when setting up XSK pool
+    - ice: improve updating ice_{t,r}x_ring::xsk_pool
+    - ice: xsk: fix txq interrupt mapping
+    - drm/atomic: Allow userspace to use explicit sync with atomic async flips
+    - drm/atomic: Allow userspace to use damage clips with async flips
+    - riscv/purgatory: align riscv_kernel_entry
+    - perf arch events: Fix duplicate RISC-V SBI firmware event name
+    - RISC-V: Enable the IPI before workqueue_online_cpu()
+    - ceph: force sending a cap update msg back to MDS for revoke op
+    - drm/vmwgfx: Remove unused code
+    - drm/vmwgfx: Fix handling of dumb buffers
+    - drm/v3d: Prevent out of bounds access in performance query extensions
+    - drm/v3d: Fix potential memory leak in the timestamp extension
+    - drm/v3d: Fix potential memory leak in the performance extension
+    - drm/v3d: Validate passed in drm syncobj handles in the timestamp extension
+    - drm/v3d: Validate passed in drm syncobj handles in the performance extension
+    - nouveau: set placement to original placement on uvmm validate.
+    - wifi: ath12k: fix soft lockup on suspend
+    - mptcp: pm: fix backup support in signal endpoints
+    - selftests: mptcp: fix error path
+    - Upstream stable to v6.6.45, v6.10.4
+  * [SRU] Fix AST DP output after resume (LP: #2083022) // Noble update:
+    upstream stable patchset 2024-10-02 (LP: #2083488)
+    - drm/ast: astdp: Wake up during connector status detection
+    - drm/ast: Fix black screen after resume
+  * [SRU]Fail to locate the LED of NVME disk behind  Intel VMD (LP: #2077287) //
+    Noble update: upstream stable patchset 2024-10-02 (LP: #2083488)
+    - PCI: pciehp: Retain Power Indicator bits for userspace indicators
+  * Noble update: upstream stable patchset 2024-09-30 (LP: #2083196)
+    - powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
+    - spi: spi-microchip-core: Fix the number of chip selects supported
+    - spi: atmel-quadspi: Add missing check for clk_prepare
+    - EDAC, i10nm: make skx_common.o a separate module
+    - rcu/tasks: Fix stale task snaphot for Tasks Trace
+    - platform/chrome: cros_ec_debugfs: fix wrong EC message version
+    - ubd: refactor the interrupt handler
+    - ubd: untagle discard vs write zeroes not support handling
+    - block: initialize integrity buffer to zero before writing it to media
+    - x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS
+    - hfsplus: fix to avoid false alarm of circular locking
+    - x86/of: Return consistent error type from x86_of_pci_irq_enable()
+    - x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
+    - x86/pci/xen: Fix PCIBIOS_* return code handling
+    - x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
+    - cgroup/cpuset: Prevent UAF in proc_cpuset_show()
+    - hwmon: (adt7475) Fix default duty on fan is disabled
+    - block: Call .limit_depth() after .hctx has been set
+    - block/mq-deadline: Fix the tag reservation code
+    - md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl
+    - pwm: stm32: Always do lazy disabling
+    - nvmet-auth: fix nvmet_auth hash error handling
+    - drm/meson: fix canvas release in bind function
+    - pwm: atmel-tcb: Fix race condition and convert to guards
+    - hwmon: (max6697) Fix underflow when writing limit attributes
+    - hwmon: (max6697) Fix swapped temp{1,8} critical alarms
+    - arm64: dts: qcom: sc8180x: Correct PCIe slave ports
+    - arm64: dts: qcom: sc8180x: add power-domain to UFS PHY
+    - arm64: dts: qcom: sdm845: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm6115: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm6350: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm8250: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm8350: add power-domain to UFS PHY
+    - arm64: dts: qcom: sm8450: add power-domain to UFS PHY
+    - arm64: dts: qcom: msm8996-xiaomi-common: drop excton from the USB PHY
+    - arm64: dts: qcom: sdm850-lenovo-yoga-c630: fix IPA firmware path
+    - arm64: dts: qcom: msm8998: enable adreno_smmu by default
+    - soc: qcom: pmic_glink: Handle the return value of pmic_glink_init
+    - soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data()
+      callers
+    - arm64: dts: rockchip: Add sdmmc related properties on rk3308-rock-pi-s
+    - arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s
+    - arm64: dts: rockchip: Add mdio and ethernet-phy nodes to rk3308-rock-pi-s
+    - arm64: dts: rockchip: Update WIFi/BT related nodes on rk3308-rock-pi-s
+    - arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
+    - arm64: dts: qcom: sa8775p: mark ethernet devices as DMA-coherent
+    - soc: xilinx: rename cpu_number1 to dummy_cpu_number
+    - ARM: dts: sunxi: remove duplicated entries in makefile
+    - ARM: dts: stm32: Add arm,no-tick-in-suspend to STM32MP15xx STGEN timer
+    - arm64: dts: qcom: qrb4210-rb2: make L9A always-on
+    - cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe()
+    - OPP: ti: Fix ti_opp_supply_probe wrong return values
+    - memory: fsl_ifc: Make FSL_IFC config visible and selectable
+    - arm64: dts: ti: k3-am62x: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am625-beagleplay: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am62-verdin: Drop McASP AFIFOs
+    - arm64: dts: qcom: qdu1000: Add secure qfprom node
+    - soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove
+    - soc: qcom: pdr: protect locator_addr with the main mutex
+    - soc: qcom: pdr: fix parsing of domains lists
+    - arm64: dts: rockchip: Increase VOP clk rate on RK3328
+    - arm64: dts: amlogic: sm1: fix spdif compatibles
+    - ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
+    - ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
+    - ARM: dts: imx6qdl-kontron-samx6i: fix board reset
+    - ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
+    - ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
+    - arm64: dts: mediatek: mt8195: Fix GPU thermal zone name for SVS
+    - arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
+    - arm64: dts: mediatek: mt8192-asurada: Add off-on-delay-us for
+      pp3300_mipibrdg
+    - arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
+    - arm64: dts: mediatek: mt8183-kukui: Fix the value of `dlg,jack-det-rate`
+      mismatch
+    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add ports node for anx7625
+    - arm64: dts: amlogic: gx: correct hdmi clocks
+    - arm64: dts: amlogic: add power domain to hdmitx
+    - arm64: dts: amlogic: setup hdmi system clock
+    - arm64: dts: rockchip: Drop invalid mic-in-differential on rk3568-rock-3a
+    - arm64: dts: rockchip: Fix mic-in-differential usage on rk3566-roc-pc
+    - arm64: dts: rockchip: Fix mic-in-differential usage on rk3568-evb1-v10
+    - arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r8a779f0: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r8a779g0: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r9a07g043u: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r9a07g044: Add missing hypervisor virtual timer IRQ
+    - arm64: dts: renesas: r9a07g054: Add missing hypervisor virtual timer IRQ
+    - m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
+    - arm64: dts: imx8mp: Fix pgc_mlmix location
+    - arm64: dts: imx8mp: add HDMI power-domains
+    - arm64: dts: imx8mp: Fix pgc vpu locations
+    - x86/xen: Convert comma to semicolon
+    - arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu
+    - arm64: dts: rockchip: fix regulator name for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: fix usb regulator for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: fix pmu_io supply for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: remove unused usb2 nodes for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: disable display subsystem for Lunzn Fastrhino R6xS
+    - arm64: dts: rockchip: fixes PHY reset for Lunzn Fastrhino R68S
+    - arm64: dts: qcom: sm6350: Add missing qcom,non-secure-domain property
+    - cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC
+      systems
+    - m68k: cmpxchg: Fix return value for default case in __arch_xchg()
+    - ARM: spitz: fix GPIO assignment for backlight
+    - vmlinux.lds.h: catch .bss..L* sections into BSS")
+    - firmware: turris-mox-rwtm: Do not complete if there are no waiters
+    - firmware: turris-mox-rwtm: Fix checking return value of
+      wait_for_completion_timeout()
+    - firmware: turris-mox-rwtm: Initialize completion before mailbox
+    - wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
+    - wifi: ath12k: Correct 6 GHz frequency value in rx status
+    - wifi: ath12k: Fix tx completion ring (WBM2SW) setup failure
+    - bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer
+    - selftests/bpf: Fix prog numbers in test_sockmap
+    - net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
+    - wifi: ath12k: change DMA direction while mapping reinjected packets
+    - wifi: ath12k: fix invalid memory access while processing fragmented packets
+    - wifi: ath12k: fix firmware crash during reo reinject
+    - wifi: ath11k: fix wrong definition of CE ring's base address
+    - wifi: ath12k: fix wrong definition of CE ring's base address
+    - tcp: add tcp_done_with_error() helper
+    - tcp: fix race in tcp_write_err()
+    - tcp: fix races in tcp_v[46]_err()
+    - net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when
+      CONFIG_ARCH_NO_SG_CHAIN is defined
+    - selftests/bpf: Check length of recv in test_sockmap
+    - udf: Fix lock ordering in udf_evict_inode()
+    - lib: objagg: Fix general protection fault
+    - mlxsw: spectrum_acl_erp: Fix object nesting warning
+    - mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
+    - perf/x86: Serialize set_attr_rdpmc()
+    - jump_label: Fix concurrency issues in static_key_slow_dec()
+    - wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
+    - wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
+    - wifi: cfg80211: handle 2x996 RU allocation in
+      cfg80211_calculate_bitrate_he()
+    - udf: Fix bogus checksum computation in udf_rename()
+    - net: fec: Refactor: #define magic constants
+    - net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
+    - libbpf: Checking the btf_type kind when fixing variable offsets
+    - xfrm: Fix unregister netdevice hang on hardware offload.
+    - ipvs: Avoid unnecessary calls to skb_is_gso_sctp
+    - netfilter: nf_tables: rise cap on SELinux secmark context
+    - wifi: rtw89: 8852b: fix definition of KIP register number
+    - wifi: rtl8xxxu: 8188f: Limit TX power index
+    - xfrm: Export symbol xfrm_dev_state_delete.
+    - bpftool: Mount bpffs when pinmaps path not under the bpffs
+    - perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
+    - perf: Fix perf_aux_size() for greater-than 32-bit size
+    - perf: Prevent passing zero nr_pages to rb_alloc_aux()
+    - perf: Fix default aux_watermark calculation
+    - perf/x86/intel/cstate: Fix Alderlake/Raptorlake/Meteorlake
+    - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()
+    - xfrm: fix netdev reference count imbalance
+    - xfrm: call xfrm_dev_policy_delete when kill policy
+    - wifi: virt_wifi: avoid reporting connection success with wrong SSID
+    - gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
+    - wifi: virt_wifi: don't use strlen() in const context
+    - locking/rwsem: Add __always_inline annotation to __down_write_common() and
+      inlined callers
+    - selftests/bpf: Close fd in error path in drop_on_reuseport
+    - selftests/bpf: Null checks for links in bpf_tcp_ca
+    - selftests/bpf: Close obj in error path in xdp_adjust_tail
+    - selftests/resctrl: Convert perror() to ksft_perror() or ksft_print_msg()
+    - selftests/resctrl: Fix closing IMC fds on error and open-code R+W instead of
+      loops
+    - bpf: annotate BTF show functions with __printf
+    - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
+    - bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
+    - bpf: Fix null pointer dereference in resolve_prog_type() for
+      BPF_PROG_TYPE_EXT
+    - selftests: forwarding: devlink_lib: Wait for udev events after reloading
+    - Bluetooth: hci_bcm4377: Use correct unit for timeouts
+    - Bluetooth: btintel: Refactor btintel_set_ppag()
+    - Bluetooth: btnxpuart: Add handling for boot-signature timeout errors
+    - xdp: fix invalid wait context of page_pool_destroy()
+    - net: bridge: mst: Check vlan state for egress decision
+    - drm/rockchip: vop2: Fix the port mux of VP2
+    - drm/arm/komeda: Fix komeda probe failing if there are no links in the
+      secondary pipeline
+    - drm/amdkfd: Fix CU Masking for GFX 9.4.3
+    - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq()
+    - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_generic_write_seq()
+    - drm/amd/pm: Fix aldebaran pcie speed reporting
+    - drm/amdgpu: Fix memory range calculation
+    - drm/amdgpu: Check if NBIO funcs are NULL in amdgpu_device_baco_exit
+    - drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1
+    - drm/panel: himax-hx8394: Handle errors from mipi_dsi_dcs_set_display_on()
+      better
+    - drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before
+      regulators
+    - drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
+    - drm/bridge: Fixed a DP link training bug
+    - drm/bridge: it6505: fix hibernate to resume no display issue
+    - media: pci: ivtv: Add check for DMA map result
+    - media: imon: Fix race getting ictx->lock
+    - media: i2c: Fix imx412 exposure control
+    - media: v4l: async: Fix NULL pointer dereference in adding ancillary links
+    - s390/mm: Convert make_page_secure to use a folio
+    - s390/mm: Convert gmap_make_secure to use a folio
+    - s390/uv: Don't call folio_wait_writeback() without a folio reference
+    - media: mediatek: vcodec: Handle invalid decoder vsi
+    - x86/shstk: Make return uprobe work with shadow stack
+    - ipmi: ssif_bmc: prevent integer overflow on 32bit systems
+    - saa7134: Unchecked i2c_transfer function result fixed
+    - media: i2c: imx219: fix msr access command sequence
+    - media: uvcvideo: Disable autosuspend for Insta360 Link
+    - media: uvcvideo: Quirk for invalid dev_sof in Logitech C922
+    - media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920
+    - media: uvcvideo: Override default flags
+    - drm: zynqmp_dpsub: Fix an error handling path in zynqmp_dpsub_probe()
+    - drm: zynqmp_kms: Fix AUX bus not getting unregistered
+    - media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2
+    - media: rcar-csi2: Disable runtime_pm in probe error
+    - media: rcar-csi2: Cleanup subdevice in remove()
+    - media: renesas: vsp1: Fix _irqsave and _irq mix
+    - media: renesas: vsp1: Store RPF partition configuration per RPF instance
+    - drm/mediatek: Add missing plane settings when async update
+    - drm/mediatek: Use 8-bit alpha in ETHDR
+    - drm/mediatek: Fix XRGB setting error in OVL
+    - drm/mediatek: Fix XRGB setting error in Mixer
+    - drm/mediatek: Fix destination alpha error in OVL
+    - drm/mediatek: Turn off the layers with zero width or height
+    - drm/mediatek: Add OVL compatible name for MT8195
+    - media: imx-jpeg: Drop initial source change event if capture has been setup
+    - leds: trigger: Unregister sysfs attributes before calling deactivate()
+    - drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC
+    - drm/msm/dpu: drop validity checks for clear_pending_flush() ctl op
+    - perf test: Make test_arm_callgraph_fp.sh more robust
+    - perf pmus: Fixes always false when compare duplicates aliases
+    - perf report: Fix condition in sort__sym_cmp()
+    - drm/etnaviv: fix DMA direction handling for cached RW buffers
+    - drm/qxl: Add check for drm_cvt_mode
+    - Revert "leds: led-core: Fix refcount leak in of_led_get()"
+    - drm/mediatek: Remove less-than-zero comparison of an unsigned value
+    - ext4: fix infinite loop when replaying fast_commit
+    - drm/mediatek/dp: switch to ->edid_read callback
+    - drm/mediatek/dp: Fix spurious kfree()
+    - media: venus: flush all buffers in output plane streamoff
+    - perf intel-pt: Fix aux_watermark calculation for 64-bit size
+    - perf intel-pt: Fix exclude_guest setting
+    - mfd: rsmu: Split core code into separate module
+    - mfd: omap-usb-tll: Use struct_size to allocate tll
+    - xprtrdma: Fix rpcrdma_reqs_reset()
+    - SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
+    - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server
+    - ext4: don't track ranges in fast_commit if inode has inlined data
+    - ext4: avoid writing unitialized memory to disk in EA inodes
+    - leds: flash: leds-qcom-flash: Test the correct variable in init
+    - sparc64: Fix incorrect function signature and add prototype for
+      prom_cif_init
+    - SUNRPC: Fixup gss_status tracepoint error output
+    - iio: Fix the sorting functionality in iio_gts_build_avail_time_table
+    - PCI: Fix resource double counting on remove & rescan
+    - PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode()
+    - PCI: keystone: Don't enable BAR 0 for AM654x
+    - PCI: keystone: Fix NULL pointer dereference in case of DT error in
+      ks_pcie_setup_rc_app_regs()
+    - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()
+    - scsi: ufs: mcq: Fix missing argument 'hba' in MCQ_OPR_OFFSET_n
+    - clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock
+    - clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs
+    - iio: frequency: adrf6780: rm clk provider include
+    - coresight: Fix ref leak when of_coresight_parse_endpoint() fails
+    - RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE
+    - ASoc: tas2781: Enable RCA-based playback without DSP firmware download
+    - ASoC: cs35l56: Accept values greater than 0 as IRQ numbers
+    - usb: typec-mux: nb7vpq904m: unregister typec switch on probe error and
+      remove
+    - RDMA/cache: Release GID table even if leak is detected
+    - clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable
+    - clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags
+    - clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags
+    - clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable
+    - clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's
+    - interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID
+    - Input: qt1050 - handle CHIP_ID reading error
+    - RDMA/mlx4: Fix truncated output warning in mad.c
+    - RDMA/mlx4: Fix truncated output warning in alias_GUID.c
+    - RDMA/mlx5: Use sq timestamp as QP timestamp when RoCE is disabled
+    - RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
+    - ASoC: qcom: Adjust issues in case of DT error in
+      asoc_qcom_lpass_cpu_platform_probe()
+    - scsi: lpfc: Fix a possible null pointer dereference
+    - hwrng: core - Fix wrong quality calculation at hw rng registration
+    - powerpc/prom: Add CPU info to hardware description string later
+    - ASoC: max98088: Check for clk_prepare_enable() error
+    - mtd: make mtd_test.c a separate module
+    - RDMA/device: Return error earlier if port in not valid
+    - Input: elan_i2c - do not leave interrupt disabled on suspend failure
+    - ASoC: amd: Adjust error handling in case of absent codec device
+    - PCI: endpoint: Clean up error handling in vpci_scan_bus()
+    - PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup()
+    - vhost/vsock: always initialize seqpacket_allow
+    - net: missing check virtio
+    - nvmem: rockchip-otp: set add_legacy_fixed_of_cells config option
+    - crypto: qat - extend scope of lock in adf_cfg_add_key_value_param()
+    - clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error
+    - clk: qcom: Park shared RCGs upon registration
+    - clk: en7523: fix rate divider for slic and spi clocks
+    - MIPS: Octeron: remove source file executable bit
+    - PCI: qcom-ep: Disable resources unconditionally during PERST# assert
+    - PCI: dwc: Fix index 0 incorrectly being interpreted as a free ATU slot
+    - powerpc/xmon: Fix disassembly CPU feature checks
+    - macintosh/therm_windtunnel: fix module unload.
+    - RDMA/hns: Check atomic wr length
+    - RDMA/hns: Fix unmatch exception handling when init eq table fails
+    - RDMA/hns: Fix missing pagesize and alignment check in FRMR
+    - RDMA/hns: Fix shift-out-bounds when max_inline_data is 0
+    - RDMA/hns: Fix undifined behavior caused by invalid max_sge
+    - RDMA/hns: Fix insufficient extend DB for VFs.
+    - iommu/vt-d: Fix identity map bounds in si_domain_init()
+    - RDMA/core: Remove NULL check before dev_{put, hold}
+    - RDMA: Fix netdev tracker in ib_device_set_netdev
+    - bnxt_re: Fix imm_data endianness
+    - netfilter: ctnetlink: use helper function to calculate expect ID
+    - netfilter: nf_set_pipapo: fix initial map fill
+    - ipvs: properly dereference pe in ip_vs_add_service
+    - gve: Fix XDP TX completion handling when counters overflow
+    - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
+    - ipv4: Fix incorrect TOS in route get reply
+    - ipv4: Fix incorrect TOS in fibmatch route get reply
+    - net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
+    - net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
+    - fs/ntfs3: Merge synonym COMPRESSION_UNIT and NTFS_LZNT_CUNIT
+    - fs/ntfs3: Fix transform resident to nonresident for compressed files
+    - fs/ntfs3: Deny getting attr data block in compressed frame
+    - fs/ntfs3: Missed NI_FLAG_UPDATE_PARENT setting
+    - fs/ntfs3: Fix getting file type
+    - fs/ntfs3: Add missing .dirty_folio in address_space_operations
+    - pinctrl: rockchip: update rk3308 iomux routes
+    - pinctrl: core: fix possible memory leak when pinctrl_enable() fails
+    - pinctrl: single: fix possible memory leak when pinctrl_enable() fails
+    - pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable()
+      fails
+    - pinctrl: freescale: mxs: Fix refcount of child
+    - fs/ntfs3: Replace inode_trylock with inode_lock
+    - fs/ntfs3: Correct undo if ntfs_create_inode failed
+    - fs/ntfs3: Drop stray '\' (backslash) in formatting string
+    - fs/ntfs3: Fix field-spanning write in INDEX_HDR
+    - pinctrl: renesas: r8a779g0: Fix CANFD5 suffix
+    - pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes
+    - pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes
+    - pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes
+    - pinctrl: renesas: r8a779g0: Fix IRQ suffixes
+    - pinctrl: renesas: r8a779g0: FIX PWM suffixes
+    - pinctrl: renesas: r8a779g0: Fix TCLK suffixes
+    - pinctrl: renesas: r8a779g0: Fix TPU suffixes
+    - fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
+    - fs/proc/task_mmu.c: add_to_pagemap: remove useless parameter addr
+    - fs/proc/task_mmu: don't indicate PM_MMAP_EXCLUSIVE without PM_PRESENT
+    - fs/proc/task_mmu: properly detect PM_MMAP_EXCLUSIVE per page of PMD-mapped
+      THPs
+    - nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
+    - rtc: interface: Add RTC offset to alarm after fix-up
+    - fs/ntfs3: Fix the format of the "nocase" mount option
+    - fs/ntfs3: Missed error return
+    - fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP
+    - powerpc/8xx: fix size given to set_huge_pte_at()
+    - s390/dasd: fix error checks in dasd_copy_pair_store()
+    - sbitmap: use READ_ONCE to access map->word
+    - sbitmap: fix io hung due to race on sbitmap_word::cleared
+    - LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint
+    - landlock: Don't lose track of restrictions on cred_transfer
+    - hugetlb: force allocating surplus hugepages on mempolicy allowed nodes
+    - mm/hugetlb: fix possible recursive locking detected warning
+    - mm/mglru: fix div-by-zero in vmpressure_calc_level()
+    - mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer
+    - mm/mglru: fix overshooting shrinker memory
+    - x86/efistub: Avoid returning EFI_SUCCESS on error
+    - x86/efistub: Revert to heap allocated boot_params for PE entrypoint
+    - exfat: fix potential deadlock on __exfat_get_dentry_set
+    - dt-bindings: thermal: correct thermal zone node name limit
+    - tick/broadcast: Make takeover of broadcast hrtimer reliable
+    - net: netconsole: Disable target before netpoll cleanup
+    - af_packet: Handle outgoing VLAN packets without hardware offloading
+    - btrfs: fix extent map use-after-free when adding pages to compressed bio
+    - kernel: rerun task_work while freezing in get_signal()
+    - ipv4: fix source address selection with route leak
+    - ipv6: take care of scope when choosing the src addr
+    - NFSD: Support write delegations in LAYOUTGET
+    - sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE
+      tasks
+    - fuse: verify {g,u}id mount options correctly
+    - ata: libata-scsi: Fix offsets for the fixed format sense data
+    - char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
+    - media: venus: fix use after free in vdec_close
+    - ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1
+    - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
+    - ext2: Verify bitmap and itable block numbers before using them
+    - io_uring/io-wq: limit retrying worker initialisation
+    - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
+    - drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
+    - scsi: qla2xxx: Fix optrom version displayed in FDMI
+    - drm/amd/display: Check for NULL pointer
+    - apparmor: use kvfree_sensitive to free data->data
+    - cifs: fix potential null pointer use in destroy_workqueue in init_cifs error
+      path
+    - cifs: fix reconnect with SMB1 UNIX Extensions
+    - cifs: mount with "unix" mount option for SMB1 incorrectly handled
+    - task_work: s/task_work_cancel()/task_work_cancel_func()/
+    - task_work: Introduce task_work_cancel() again
+    - udf: Avoid using corrupted block bitmap buffer
+    - m68k: amiga: Turn off Warp1260 interrupts during boot
+    - ext4: check dot and dotdot of dx_root before making dir indexed
+    - ext4: make sure the first directory block is not a hole
+    - io_uring: tighten task exit cancellations
+    - trace/pid_list: Change gfp flags in pid_list_fill_irq()
+    - selftests/landlock: Add cred_transfer test
+    - wifi: mwifiex: Fix interface type change
+    - wifi: rtw88: usb: Fix disconnection after beacon loss
+    - drivers: soc: xilinx: check return status of get_api_version()
+    - leds: ss4200: Convert PCIBIOS_* return codes to errnos
+    - leds: mt6360: Fix memory leak in mt6360_init_isnk_properties()
+    - media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
+    - jbd2: make jbd2_journal_get_max_txn_bufs() internal
+    - jbd2: precompute number of transaction descriptor blocks
+    - jbd2: avoid infinite transaction commit loop
+    - media: uvcvideo: Fix integer overflow calculating timestamp
+    - KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
+    - KVM: nVMX: Request immediate exit iff pending nested event needs injection
+    - ALSA: ump: Don't update FB name for static blocks
+    - ALSA: ump: Force 1 Group for MIDI1 FBs
+    - ALSA: usb-audio: Fix microphone sound on HD webcam.
+    - ALSA: usb-audio: Move HD Webcam quirk to the right place
+    - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
+    - tools/memory-model: Fix bug in lock.cat
+    - hwrng: amd - Convert PCIBIOS_* return codes to errnos
+    - parisc: Fix warning at drivers/pci/msi/msi.h:121
+    - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
+    - PCI: dw-rockchip: Fix initial PERST# GPIO value
+    - PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
+    - PCI: loongson: Enable MSI in LS7A Root Complex
+    - binder: fix hang of unregistered readers
+    - hostfs: fix dev_t handling
+    - efi/libstub: Zero initialize heap allocated struct screen_info
+    - fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
+    - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
+    - ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
+    - f2fs: fix to force buffered IO on inline_data inode
+    - f2fs: fix to don't dirty inode for readonly filesystem
+    - f2fs: fix return value of f2fs_convert_inline_inode()
+    - f2fs: use meta inode for GC of atomic file
+    - f2fs: use meta inode for GC of COW file
+    - clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
+    - ubi: eba: properly rollback inside self_check_eba
+    - block: fix deadlock between sd_remove & sd_release
+    - mm: fix old/young bit handling in the faulting path
+    - decompress_bunzip2: fix rare decompression failure
+    - kbuild: Fix '-S -c' in x86 stack protector scripts
+    - ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA on unprepare
+    - ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2
+    - kobject_uevent: Fix OOB access within zap_modalias_env()
+    - gve: Fix an edge case for TSO skb validity check
+    - ice: Add a per-VF limit on number of FDIR filters
+    - devres: Fix devm_krealloc() wasting memory
+    - devres: Fix memory leakage caused by driver API devm_free_percpu()
+    - irqdomain: Fixed unbalanced fwnode get and put
+    - irqchip/imx-irqsteer: Handle runtime power management correctly
+    - mm/numa_balancing: teach mpol_to_str about the balancing mode
+    - rtc: cmos: Fix return value of nvmem callbacks
+    - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE
+      state
+    - scsi: qla2xxx: During vport delete send async logout explicitly
+    - scsi: qla2xxx: Unable to act on RSCN for port online
+    - scsi: qla2xxx: Fix for possible memory corruption
+    - scsi: qla2xxx: Use QP lock to search for bsg
+    - scsi: qla2xxx: Reduce fabric scan duplicate code
+    - scsi: qla2xxx: Fix flash read failure
+    - scsi: qla2xxx: Complete command early within lock
+    - scsi: qla2xxx: validate nvme_local_port correctly
+    - perf: Fix event leak upon exit
+    - perf: Fix event leak upon exec and file release
+    - perf stat: Fix the hard-coded metrics calculation on the hybrid
+    - perf/x86/intel/uncore: Fix the bits of the CHA extended umask for SPR
+    - perf/x86/intel/ds: Fix non 0 retire latency on Raptorlake
+    - perf/x86/intel/pt: Fix topa_entry base length
+    - perf/x86/intel/pt: Fix a topa_entry base address calculation
+    - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8
+    - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell
+    - drm/udl: Remove DRM_CONNECTOR_POLL_HPD
+    - drm/dp_mst: Fix all mstb marked as not probed after suspend/resume
+    - drm/amdgpu: reset vm state machine after gpu reset(vram lost)
+    - drm/amd/amdgpu: Fix uninitialized variable warnings
+    - drm/i915/dp: Reset intel_dp->link_trained before retraining the link
+    - drm/i915/dp: Don't switch the LTTPR mode on an active link
+    - rtc: isl1208: Fix return value of nvmem callbacks
+    - rtc: abx80x: Fix return value of nvmem callback on read
+    - watchdog/perf: properly initialize the turbo mode timestamp and rearm
+      counter
+    - platform: mips: cpu_hwmon: Disable driver on unsupported hardware
+    - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
+    - selftests/sigaltstack: Fix ppc64 GCC build
+    - dm-verity: fix dm_is_verity_target() when dm-verity is builtin
+    - rbd: don't assume rbd_is_lock_owner() for exclusive mappings
+    - remoteproc: stm32_rproc: Fix mailbox interrupts queuing
+    - remoteproc: imx_rproc: Skip over memory region when node value is NULL
+    - remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init
+    - MIPS: dts: loongson: Add ISA node
+    - MIPS: ip30: ip30-console: Add missing include
+    - MIPS: dts: loongson: Fix GMAC phy node
+    - MIPS: Loongson64: env: Hook up Loongsson-2K
+    - MIPS: Loongson64: Remove memory node for builtin-dtb
+    - MIPS: Loongson64: reset: Prioritise firmware service
+    - MIPS: Loongson64: Test register availability before use
+    - drm/etnaviv: don't block scheduler when GPU is still active
+    - drm/panfrost: Mark simple_ondemand governor as softdep
+    - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
+    - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
+    - lib/build_OID_registry: don't mention the full path of the script in output
+    - video: logo: Drop full path of the input filename in generated file
+    - Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
+    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
+    - minmax: scsi: fix mis-use of 'clamp()' in sr.c
+    - mm/mglru: fix ineffective protection calculation
+    - PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
+    - f2fs: fix to truncate preallocated blocks in f2fs_file_open()
+    - kdb: address -Wformat-security warnings
+    - kdb: Use the passed prompt in kdb_position_cursor()
+    - dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels
+    - phy: cadence-torrent: Check return value on register read
+    - phy: zynqmp: Enable reference clock correctly
+    - um: time-travel: fix time-travel-start option
+    - um: time-travel: fix signal blocking race/hang
+    - f2fs: fix start segno of large section
+    - watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get()
+    - watchdog: rzg2l_wdt: Check return status of pm_runtime_put()
+    - f2fs: fix to update user block counts in block_operations()
+    - kbuild: avoid build error when single DTB is turned into composite DTB
+    - selftests/bpf: fexit_sleep: Fix stack allocation for arm64
+    - libbpf: Fix no-args func prototype BTF dumping syntax
+    - af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash
+    - dma: fix call order in dmam_free_coherent
+    - bpf, events: Use prog to emit ksymbol event for main program
+    - tools/resolve_btfids: Fix comparison of distinct pointer types warning in
+      resolve_btfids
+    - MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
+    - ipv4: Fix incorrect source address in Record Route option
+    - net: bonding: correctly annotate RCU in bond_should_notify_peers()
+    - ice: Fix recipe read procedure
+    - netfilter: nft_set_pipapo_avx2: disable softinterrupts
+    - net: stmmac: Correct byte order of perfect_match
+    - net: nexthop: Initialize all fields in dumped nexthops
+    - bpf: Fix a segment issue when downgrading gso_size
+    - apparmor: Fix null pointer deref when receiving skb during sock creation
+    - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
+    - lirc: rc_dev_get_from_fd(): fix file leak
+    - auxdisplay: ht16k33: Drop reference after LED registration
+    - ASoC: SOF: imx8m: Fix DSP control regmap retrieval
+    - spi: microchip-core: fix the issues in the isr
+    - spi: microchip-core: defer asserting chip select until just before write to
+      TX FIFO
+    - spi: microchip-core: only disable SPI controller when register value change
+      requires it
+    - spi: microchip-core: fix init function not setting the master and motorola
+      modes
+    - spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer
+    - nvme-pci: Fix the instructions for disabling power management
+    - ASoC: sof: amd: fix for firmware reload failure in Vangogh platform
+    - spi: spidev: add correct compatible for Rohm BH2228FV
+    - ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
+    - ASoC: TAS2781: Fix tasdev_load_calibrated_data()
+    - ceph: fix incorrect kmalloc size of pagevec mempool
+    - s390/pci: Refactor arch_setup_msi_irqs()
+    - s390/pci: Allow allocation of more than 1 MSI interrupt
+    - s390/cpum_cf: Fix endless loop in CF_DIAG event stop
+    - iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
+    - io_uring: fix io_match_task must_hold
+    - nvme-pci: add missing condition check for existence of mapped data
+    - fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
+    - md/raid0: don't free conf on raid0_run failure
+    - md/raid1: don't free conf on raid0_run failure
+    - io_uring: Fix probe of disabled operations
+    - cgroup/cpuset: Optimize isolated partition only generate_sched_domains()
+      calls
+    - cgroup/cpuset: Fix remote root partition creation problem
+    - x86/syscall: Mark exit[_group] syscall handlers __noreturn
+    - perf: arm_pmuv3: Avoid assigning fixed cycle counter with threshold
+    - md/raid5: recheck if reshape has finished with device_lock held
+    - hwmon: (ltc2991) re-order conditions to fix off by one bug
+    - arm64: smp: Fix missing IPI statistics
+    - arm64: dts: qcom: sc7280: Remove CTS/RTS configuration
+    - ARM: dts: qcom: msm8226-microsoft-common: Enable smbb explicitly
+    - OPP: Fix missing cleanup on error in _opp_attach_genpd()
+    - arm64: dts: qcom: sc8280xp-*: Remove thermal zone polling delays
+    - arm64: dts: ti: k3-am62-main: Fix the reg-range for main_pktdma
+    - arm64: dts: ti: k3-am62a-main: Fix the reg-range for main_pktdma
+    - arm64: dts: ti: k3-am62p-main: Fix the reg-range for main_pktdma
+    - arm64: dts: ti: k3-am62a7: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am62p5: Drop McASP AFIFOs
+    - arm64: dts: ti: k3-am62p5-sk: Fix pinmux for McASP1 TX
+    - arm64: dts: qcom: sc7180-trogdor: Disable pwmleds node where unused
+    - arm64: dts: mediatek: mt8192: Fix GPU thermal zone name for SVS
+    - arm64: dts: mediatek: mt8183-pico6: Fix wake-on-X event node names
+    - arm64: dts: renesas: r9a08g045: Add missing hypervisor virtual timer IRQ
+    - cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons
+    - wifi: mac80211: cancel multi-link reconf work on disconnect
+    - wifi: ath11k: refactor setting country code logic
+    - wifi: ath11k: restore country code during resume
+    - net: ethernet: cortina: Restore TSO support
+    - tcp: fix races in tcp_abort()
+    - hns3: avoid linking objects into multiple modules
+    - sched/core: Move preempt_model_*() helpers from sched.h to preempt.h
+    - sched/core: Drop spinlocks on contention iff kernel is preemptible
+    - net: dsa: ksz_common: Allow only up to two HSR HW offloaded ports for
+      KSZ9477
+    - libbpf: Skip base btf sanity checks
+    - wifi: mac80211: add ieee80211_tdls_sta_link_id()
+    - wifi: iwlwifi: fix iwl_mvm_get_valid_rx_ant()
+    - wifi: ath12k: advertise driver capabilities for MBSSID and EMA
+    - riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
+    - perf/x86/amd/uncore: Avoid PMU registration if counters are unavailable
+    - perf/x86/amd/uncore: Fix DF and UMC domain identification
+    - NFSD: Fix nfsdcld warning
+    - net: page_pool: fix warning code
+    - bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
+    - Bluetooth: hci_event: Set QoS encryption from BIGInfo report
+    - Bluetooth: hci_core, hci_sync: cleanup struct discovery_state
+    - Bluetooth: Fix usage of __hci_cmd_sync_status
+    - tcp: Don't access uninit tcp_rsk(req)->ao_keyid in
+      tcp_create_openreq_child().
+    - drm/panel: ilitek-ili9882t: If prepare fails, disable GPIO before regulators
+    - drm/panel: ilitek-ili9882t: Check for errors on the NOP in prepare()
+    - drm/amd/display: Move 'struct scaler_data' off stack
+    - media: i2c: hi846: Fix V4L2_SUBDEV_FORMAT_TRY get_selection()
+    - drm/msm/dpu: fix encoder irq wait skip
+    - drm/msm/dpu: drop duplicate drm formats from wb2_formats arrays
+    - drm/msm/dp: fix runtime_pm handling in dp_wait_hpd_asserted
+    - perf maps: Switch from rbtree to lazily sorted array for addresses
+    - perf maps: Fix use after free in __maps__fixup_overlap_and_insert
+    - drm/bridge: samsung-dsim: Set P divider based on min/max of fin pll
+    - drm/i915/psr: Print Panel Replay status instead of frame lock status
+    - drm/mediatek: Set DRM mode configs accordingly
+    - drm/msm/dsi: set video mode widebus enable bit when widebus is enabled
+    - tools/perf: Fix the string match for "/tmp/perf-$PID.map" files in dso__load
+    - drm/amd/display: Add null check before access structs
+    - nfs: pass explicit offset/count to trace events
+    - PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in
+      pci_epf_test_core_init()
+    - PCI: tegra194: Set EP alignment restriction for inbound ATU
+    - riscv: smp: fail booting up smp if inconsistent vlen is detected
+    - clk: meson: s4: fix fixed_pll_dco clock
+    - clk: meson: s4: fix pwm_j_div parent clock
+    - usb: typec-mux: ptn36502: unregister typec switch on probe error and remove
+    - mtd: spi-nor: winbond: fix w25q128 regression
+    - iommufd/selftest: Fix dirty bitmap tests with u8 bitmaps
+    - iommufd/selftest: Fix iommufd_test_dirty() to handle <u8 bitmaps
+    - iommufd/selftest: Add tests for <= u8 bitmap sizes
+    - iommufd/selftest: Fix tests to use MOCK_PAGE_SIZE based buffer sizes
+    - iommufd/iova_bitmap: Check iova_bitmap_done() after set ahead
+    - clk: qcom: gcc-x1e80100: Fix halt_check for all pipe clocks
+    - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
+    - kvm: s390: Reject memory region operations for ucontrol VMs
+    - eeprom: ee1004: Call i2c_new_scanned_device to instantiate thermal sensor
+    - clk: qcom: gcc-x1e80100: Set parent rate for USB3 sec and tert PHY pipe clks
+    - workqueue: Introduce from_work() helper for cleaner callback declarations
+    - RDMA/hns: Fix mbx timing out before CMD execution is completed
+    - crypto: mxs-dcp - Ensure payload is zero when using key slot
+    - RDMA/mana_ib: Enable RoCE on port 1
+    - RDMA/mana_ib: set node_guid
+    - rtc: tps6594: Fix memleak in probe
+    - selftests/damon/access_memory: use user-defined region size
+    - md-cluster: fix hanging issue while a new disk adding
+    - power: supply: ab8500: Fix error handling when calling
+      iio_read_channel_processed()
+    - power: supply: ingenic: Fix some error handling paths in
+      ingenic_battery_get_property()
+    - remoteproc: mediatek: Don't attempt to remap l1tcm memory if missing
+    - remoteproc: k3-r5: Fix IPC-only mode detection
+    - mailbox: imx: fix TXDB_V2 channel race condition
+    - mailbox: mtk-cmdq: Move devm_mbox_controller_register() after
+      devm_pm_runtime_enable()
+    - mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit
+      machines
+    - mm/huge_memory: avoid PMD-size page cache if needed
+    - thermal/drivers/broadcom: Fix race between removal and clock disable
+    - workqueue: Always queue work items to the newest PWQ for order workqueues
+    - ipv6: fix source address selection with route leak
+    - drm/xe: Use write-back caching mode for system memory on DGFX
+    - md/raid5: fix spares errors about rcu usage
+    - media: stm32: dcmipp: correct error handling in dcmipp_create_subdevs
+    - tpm_tis_spi: add missing attpm20p SPI device ID entry
+    - sysctl: always initialize i_uid/i_gid
+    - media: i2c: Kconfig: Fix missing firmware upload config select
+    - genirq: Set IRQF_COND_ONESHOT in request_irq()
+    - cpufreq: qcom-nvmem: fix memory leaks in probe error paths
+    - leds: triggers: Flush pending brightness before activating trigger
+    - media: i2c: alvium: Move V4L2_CID_GAIN to V4L2_CID_ANALOG_GAIN
+    - KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector
+    - KVM: nVMX: Check for pending posted interrupts when looking for nested
+      events
+    - ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
+    - fbdev: vesafb: Detect VGA compatibility from screen info's VESA attributes
+    - drm/fbdev-dma: Fix framebuffer mode for big endian devices
+    - xhci: Apply XHCI_RESET_TO_DEFAULT quirk to TGL
+    - dmaengine: fsl-edma: clean up unused "fsl,imx8qm-adma" compatible string
+    - dmaengine: fsl-edma: change the memory access from local into remote mode in
+      i.MX 8QM
+    - clk: samsung: fix getting Exynos4 fin_pll rate from external clocks
+    - bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone
+    - ASoC: SOF: ipc4-topology: Use correct queue_id for requesting input pin
+      format
+    - arch: um: rust: Use the generated target.json again
+    - f2fs: fix null reference error when checking end of zone
+    - selftests: forwarding: skip if kernel not support setting bridge fdb
+      learning limit
+    - xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len
+    - drm/xe/exec: Fix minor bug related to xe_sync_entry_cleanup
+    - thermal: trip: Split thermal_zone_device_set_mode()
+    - apparmor: unpack transition table if dfa is not present
+    - i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1
+    - selinux,smack: remove the capability checks in the removexattr hooks
+    - selftests/bpf: DENYLIST.aarch64: Skip fexit_sleep again
+    - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
+    - Upstream stable to v6.6.44, v6.10.3
+  * Noble update: upstream stable patchset 2024-09-30 (LP: #2083196) //
+    CVE-2024-42284
+    - tipc: Return non-zero value from tipc_udp_addr2str() on error
+  * CVE-2024-44987
+    - ipv6: prevent UAF in ip6_send_skb()
+  * CVE-2024-42301
+    - dev/parport: fix the array out-of-bounds risk
+  * CVE-2024-44998
+    - atm: idt77252: prevent use after free in dequeue_rx()
+
+  [ Ubuntu: 6.8.0-49.49 ]
+
+  * noble/linux: 6.8.0-49.49 -proposed tracker (LP: #2085942)
+  * CVE-2024-46800
+    - sch/netem: fix use after free in netem_dequeue
+  * mm/folios: xfs hangs with hung task timeouts with corrupted folio pointer
+    lists (LP: #2085495)
+    - lib/xarray: introduce a new helper xas_get_order
+    - mm/filemap: return early if failed to allocate memory for split
+    - mm/filemap: optimize filemap folio adding
+  * CVE-2024-43882
+    - exec: Fix ToCToU between perm check and set-uid/gid usage
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 04 Dec 2024 13:04:13 +0900
+
+linux-qcom (6.8.0-1014.14) jammy; urgency=medium
+
+  * [RB3] CONFIG_KASAN_GENERIC report potential memory bug in tc956x_pcie_eth
+    - SAUCE: ubuntu/qcom/qps615: suppress KASAN error
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: arm64: dts: qcom: remove redundant code in qcs6490.dtsi
+
+  * Miscellaneous upstream changes
+    - QCLINUX: data-eth: qps615: Properly set HW address assign type property
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 24 Oct 2024 22:10:11 +0900
+
+linux-qcom (6.8.0-1013.13) jammy; urgency=medium
+
+  * "[RB3] tc956x_pci-eth errors found in dmesg"
+    - SAUCE: ubuntu/qcom/qps615: suppress false alerts
+    - SAUCE: ubuntu/qcom/qps615: use INFO level for logging
+
+  * [RB3] drm sde error/ msm-dsi-error found in dmesg
+    - SAUCE: do not show error on EPROBE_DEFER
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: arm64: dts: qcom: enable WIFI
+    - SAUCE: import external DT from GA 1.2
+    - SAUCE: Add Makefile code to apply overlays for GA1.2
+    - SAUCE: ubuntu/qcom/display: import qcm6490 display code from GA1.2
+    - SAUCE: ubuntu/qcom/graphics: import qcm6490 graphics driver code from GA1.2
+    - SAUCE: ubuntu/qcom/camera: import qcm6490 camera driver code from GA1.2
+    - SAUCE: ubuntu/qcom/qps615: import ethernet driver from GA1.2
+    - SAUCE: ubuntu/qcom/video: import video driver from GA 1.2
+    - SAUCE: ubuntu/qcom/touch: import touch driver from GA 1.2
+    - SAUCE: ubuntu/qcom: build external drivers
+    - SAUCE: ubuntu/qcom/camera: fix build warnings and errors
+    - SAUCE: suppress unneeded build logs
+    - SAUCE: ubuntu/qcom: suppress warning and error
+    - SAUCE: ubuntu/qcom/graphics: change strtobool() to kstrtobool()
+    - SAUCE: ubuntu/qcom/graphics: dynamically allocate the kgsl-pool shrinker for
+      kernel>=6.7
+    - SAUCE: ubuntu/qcom/camera: remove unused camera_banner
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/video: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/touch: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: auto-load module
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: ubuntu/qcom/display: Rename min_buffers_needed to min_queued_buffers
+    - SAUCE: ubuntu/qcom: remove DRM_UNLOCKED
+    - SAUCE: ubuntu/qcom/display: suppress EPROBE_DEFER error log
+    - SAUCE: rename qcom,phy-rst-gpio to qcom,phy-rst-gpio-id
+    - SAUCE: Revert "PENDING: arm64: dts: qcom: qcs6490-rb3gen2: Enable IMX577
+      camera sensor"
+    - SAUCE: ASoC: wsa883x:  suppress noisy pr_err
+
+  * Miscellaneous upstream changes
+    - Revert "rpmsg: glink: Introduce packet tracepoints"
+    - PENDING: arm64: dts: qcom: sa8775p: add TBU support
+    - QCLINUX: coresight: add etr ATID filter function support
+    - PENDING: ASOC: WSA883X: Add swr slave dev number kcontrol
+    - FROMLIST: arm64: dts: qcom: sc7280: Add PCIe0 node
+    - QCLINUX: arm64: defconfig: qcom: Enable BT_BNEP
+    - QCLINUX: arm64: dts: qcom: sa8775p-ride: add board id and msm id support
+    - PENDING: coresight: tmc: Fix byte-cntr irq count mismatch issue
+    - QCLINUX: arm64: qcom_debug: Enable ATH trace
+    - QCLINUX: arm64: dts: qcom: sa8775p: Disable gunyah watchdog
+    - PENDING: arm64: dts: qcom: sa8775p: Add tz-log node
+    - QCLINUX: arm64: defconfig: qcom: Enable UINPUT
+    - PENDING: arm64: dts: qcom: sa8775: add QCrypto nodes
+    - PENDING: arm64: dts: qcom: sa8775p: add coresight components
+    - QCLINUX: arm64: dts: qcom: sa8775p: addons: add coresight components
+    - QCLINUX: net: can: Add support for mcp25xxfd driver
+    - BACKPORT: FROMLIST: wifi: ath11k: Add firmware coredump collection support
+    - QCLINUX: arm64: defconfig: Enable ATH reg setting
+    - PENDING: media: qcom: camss: Designate lite subdevices in resources
+    - PENDING: thermal: qcom: Add support for MBG Temp monitor
+    - FROMLIST: soc: qcom: icc-bwmon: Allow for interrupts to be shared across
+      instances
+    - PENDING: dt-bindings: iio: Add ADC5 GEN3 Channel macros
+    - PENDING: arm64: dts: qcom: sa8775p: Add cpu and llcc BWMON
+    - QCLINUX: ASoC: qcom: qcm6490: Add sound card compatible for qcs6490 rb3gen2
+      mezzanine boards
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add uart4 node for RB3GEN2 video-
+      mezz
+    - BACKPORT: FROMLIST: iio: adc: Add support for QCOM PMIC5 Gen3 ADC
+    - PENDING: arm64: dts: qcom: sc7280: Add support for camss
+    - PENDING: arm64: dts: qcom: sa8775p: add remaining coresight components
+    - QCLINUX: arm64: dts: qcom: Remove iommu enc dec data from venus node
+    - PENDING: ARM: dts: qcom: Add support for MBG TM for pm8775
+    - PENDING: dt-bindings: clock: qcom: Add qdss_xo clock SA8775P
+    - PENDING: clk: qcom: Add support for qdss_xo clock for SA8775P
+    - PENDING: arm64: dts: qcom: sa8775p: add dma-coherent for smmu
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add dcc device tree node
+    - QCLINUX: arm64: dts: qcom: Add memory dump table on SA8775p
+    - PENDING: arm64: dts: qcom: sa8775p: Add fastrpc nsession property
+    - PENDING: arm64: dts: qcom: qcs6490-rb3gen2: Enable IMX577 camera sensor
+    - PENDING: i2c: Enable IMX577 camera sensor for qcm6490
+    - QCLINUX: arm64: defconfig: qcom: Enable IMX577 module support
+    - QCLINUX: arm64: qcom_debug: Enable ath11k coredump
+    - QCLINUX: ASoC: qcom: qcm6490: Update widgets for rb3gen2-ia-mezz board
+    - PENDING: misc: dcc: Fix invalid character issue
+    - QCLINUX: ASoC: qcm6490: Add sound card support for QCS9100
+    - PENDING: arm64: dts: qcom: sa8775p: add NSP0 fastrpc-compute-cb nodes
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for Rb3Gen2
+    - PENDING: arm64: dts: qcom: sa8775p: Add QFPROM node
+    - PENDING: arm64: dts: qcom: sa8775p: Correct the device name for TPDM and CTI
+    - QCLINUX: arm64: defconfig: Update memory configs
+    - PENDING: arm64: dts: qcom: sa8775p: Add memory region for audioPD
+    - FROMLIST: coresight: Add support to get preferred id for system trace
+      sources
+    - FROMLIST: coresight: dummy: Add reserve atid support for dummy source
+    - QCLINUX: virt: gunyah: Zero state_data after vcpu_run
+    - QCLINUX: arm64: defconfig: qcom: Enable MBG TM and ADC5 Gen3
+    - QCLINUX: arm64: dts: qcom: sa8775p: addons: Correct the device name for
+    - QCLINUX: arm64: dts: qcom: Add trace-id of modem_diag for qcm6490
+    - PENDING: misc: fastrpc: Fix registered buffer page address
+    - PENDING: arm64: dts: qcom: qcm6490: Use existing tcsr_2 node from sc7280
+    - PENDING: pinctrl: qcom: Add sa8775p lpass lpi pinctrl driver
+    - PENDING: opp: add a new helper set_opp api
+    - PENDING: can: mcp251xfd: enable CAN transceiver using gpio_0
+    - PENDING: arm64: config: Enable MCP251x CAN Device
+    - QCLINUX: ASoC: codecs: msm-stub: Add AIF2 dai support for LPI MI2S interface
+    - PENDING: arm64: dts: qcom: Add MCP251xFD CAN Controller
+    - PENDING: firmware: arm_scmi: add qcom smc xport descriptor
+    - QCLINUX: arm64: dts: qcom: sa8775p: Remove status override for watchdog node
+    - PENDING: arm64: dts: qcom: sc7280: Add device name for CTIs
+    - QCLINUX: arm64: defconfig: Enable LPASS LPI SA8775P pinctrl
+    - PENDING: crypto: qce - Add command descriptor support for crypto driver
+    - QCLINUX: usb: dwc3: core: Set driver data before core init
+    - QCLINUX: ASoC: qcom: qcm6490: Remove LPASS_CDC_DMA_TX3 dai id from
+      qcm6490_snd_init
+    - QCLINUX: ASoC: codecs: wcd937x: Add conditional regulator control for
+      wcd937x
+    - QCLINUX: coresight: tpdm: Correct the TPDA Key
+    - QCLINUX: arm64: dts: qcom: Bringup wcd9375 headphone on rb3gen2-ia-mezz
+      board
+    - PENDING: soc: qcom: socinfo: add SoC Info support for QCS9100 platform
+    - PENDING: dt-bindings: arm: qcom,ids: Add SoC ID for QCS9100
+    - PENDING: arm64: dts: qcom: sa8775p: Add gpr device tree node for ADSP
+    - PENDING: soc: qcom: socinfo: add SoC Info support for QCM6490 and QCS6490
+      platform
+    - PENDING: dt-bindings: arm: qcom,ids: Add SoC ID for QCM6490 and QCS6490
+    - PENDING: pinctrl: sa8775p: Update function and group binding
+    - QCLINUX: ASoC: qcom: qcm6490: Add AIF2 dapm pinctrl widget for QCS9100
+    - PENDING: arm64: dts: qcom: sa8775p: Add TCSR halt register space
+    - QCLINUX: soc: qcom: Update soc wdt node only for sc7280
+    - PENDING: arm64: qcom: dts: sa8775p: Add psci sys_reset2 modes
+    - QCLINUX: soc: qcom: Add documentation to align with code
+    - PENDING: arm64: dts: qcom: sa8775p: add rdbg nodes
+    - PENDING: gunyah: Add support for tracking Guest VM run time
+    - QCLINUX: arm64: dts: qcom: Add qcm6490 IDP dts file
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add lpass_tlmm node for lpi pinctrl
+    - PENDING: drivers: char: add remote debugger driver support for cDSP1
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add sound node for qcs9100 ridesx target
+    - PENDING: coresight: tmc: Remove duplicated ETR disable HW
+    - PENDING: arm64: dts: qcom: sc7280: Add msr properties to TPDMs
+    - QCLINUX: arm64: dts: qcom: Enable the uart for Rb3gen2-IA-MEZZ board
+    - QCLINUX: arm64: dts: qcom: Bring up LED-GPIO for Rb3gen2-IA-MEZZ board
+    - PENDING: ARM: dts: qcom: sa8775p: Update VADC interrupt-name
+    - QCLINUX: arm64: dts: qcom: Bring up I2C switch for Rb3gen2-IA-MEZZ board
+    - QCLINUX: arm64: deconfig: qcom: Enable vfio driver
+    - QCLINUX: arm64: deconfig: qcom: Enable mhi_bus_ep driver
+    - FROMLIST: iommu/arm-smmu-qcom: NULL pointer check for driver data
+    - QCLINUX: Revert "QCLINUX: net: can: Add support for mcp25xxfd driver"
+    - QCLINUX: qcom: tz_log: enable tz_log support hypervisor
+    - QCLINUX: coresight: Use desc name to get the CSR node
+    - QCLINUX: arm64: dts: qcom: Bring up TPM for Rb3gen2-IA-MEZZ board
+    - QCLINUX: arm64: defconfig: Enable NULL TTY for VM's
+    - QCLINUX: arm64: deconfig: qcom: disable smccc_trng driver
+    - QCLINUX: coresight: Enable ETR ATID filter for remote-etm
+    - PENDING: coresight: Disable RTB for coresight-stm
+    - PENDING: arm64: dts: qcom: sa8775p: Add protection-domain support for APM
+      and PRM
+    - PENDING: wifi: ath11k: fix vmalloc-out-of-bounds
+    - PENDING: arm64: dts: qcom: qcs6490-rb3gen2: Update the io-channels
+    - QCLINUX: arm64: defconfig: Remove unused VM config
+    - QCLINUX: coresight: Add extended CTI support
+    - QCLINUX: coresight: Remote-etm can probe successfully without ATID
+    - PENDING: iommu/arm-smmu-qcom: Fix compilation error
+    - QCLINUX: arm64: defconfig: Update VM memory and cpu configs
+    - QCLINUX: firmware: qcom_scm_addon:  Add qcom_she_op and
+      qcom_scm_ddrbw_profiler scm calls
+    - FROMLIST: arm64: dts: qcom: sa8775p: Add capacity and DPC properties
+    - QCLINUX: arm64: dts: restore wlan_ce_mem node
+    - QCLINUX: clk: qcom: dispcc1-sa8775p: Reparent dptx crypto RCG's to XO
+    - PENDING: arm64: dts: qcom: sa8775p: Correct the names of TPDMs
+    - PENDING: ath11k: Send pdev suspend before sending qmi mode off
+    - PENDING: dt-bindings: arm: qcom: add the SoC ID for SA8255P
+    - PENDING: soc: qcom: socinfo: add support for SA8255P
+    - PENDING: ARM64: dts: qcom: sa8775p: change camera PIL memory to 7MB
+    - PENDING: iommu/arm-smmu: add ACTLR data and support for sa8775p
+    - PENDING: arm64: dts: qcom: Add L3 interconnect device for SA8775P
+    - PENDING: interconnect: qcom: Add EPSS L3 support on SA8775P
+    - PENDING: usb: dwc3: Redesign flattening implementation
+    - PENDING: pinctrl: sa8775p: Add support for SA8255p SoC
+    - QCLINUX: smcinvoke: Add support hypervisor of shmbridge
+    - BACKPORT: wifi: mac80211: track capability/opmode NSS separately
+    - QCLINUX: drm/msm: Avoid probing gpu device
+    - QCLINUX: arm64: dts: qcom: sa8775p: addons: Enable byte-cntr for ETR1
+    - dt-bindings: net: Document QCA808x PHYs
+    - PENDING: dt-bindings: arm: qcom,ids: add SoC ID for QCS8300/QCS8275
+    - PENDING: soc: qcom: socinfo: add QCS8300/QCS8275 SoC ID
+    - PENDING: dt-bindings: pinctrl: describe qcs8300-tlmm
+    - PENDING: dt-bindings: qcom,pdc: document QCS8300 Power Domain Controller
+    - PENDING: arm64: dts: qcom: Add L3/DDR freq scaling from cpufreq on SA8775P
+    - QCLINUX: arm64: defconfig: qcom: Enable WLAN debug configs
+    - PENDING: pinctrl: qcom: add the tlmm driver for QCS8300 platforms
+    - FROMLIST: arm64: dts: qcom: sa8775p-ride: Add QCS9100 compatible
+    - PENDING: dt-bindings: clock: qcom: Add GCC clocks for QCS8300
+    - PENDING: clk: qcom: Add support for Global Clock Controller on QCS8300
+    - PENDING: dt-bindings: interconnect: Add Qualcomm QCS8300 DT bindings
+    - QCLINUX: arm64: defconfig: enable arm64 pmem
+    - PENDING: interconnect: qcom: add QCS8300 interconnect provider driver
+    - PENDING: dt-bindings: clock: qcom: Add GPU clocks for QCS8300
+    - PENDING: dt-bindings: power: qcom,rpmpd: document qcs8300
+    - PENDING: arm64: dts: qcom: Add static vote for SA8775P
+    - PENDING: arm64: dts: qcom: add initial support for QCS8300 DTSI
+    - PENDING: arm64: dts: qcom: add base QCS8300 RIDE dts
+    - QCLINUX: arm64: dts: qcom: Add addons support for QCS8300
+    - PENDING: arm64: dts: qcom: qcs8300: Add IMEM, PIL info and download mode
+      region
+    - QCLINUX: arm64: dts: qcom: qcs8300: define kaslr offset and mem dump table
+      regions
+    - QCLINUX: arm64: dts: qcom: qcs8300: addons: Add CSR device
+    - QCLINUX: arm64: deconfig: enable clock controller, interconnect and pinctrl
+      for QCS8300
+    - PENDING: soc: qcom: llcc: add errata to get bank num
+    - PENDING: soc: qcom: llcc: Add llcc configuration support for the QCS8300
+      platform
+    - PENDING:arm64: dts: qcom: qcs8300: Add qmp device nodes
+    - PENDING: arm64: dts: qcom: qcs8300: Add llcc support for the QCS8300
+      platform
+    - PENDING: drivers: phy: qualcomm: qmp-ufs qcs8300 compatible
+    - PENDING: dt-bindings: clock: qcom: Add CAMCC clocks for QCS8300
+    - QCLINUX: arm64: dts: qcom: Add qcs5430 dts support
+    - PENDING: arm64: dts: qcom: qcs8300: Add interconnect device nodes
+    - PENDING: arm64: dts: qcom: qcs8300: Add support for cpufreq hw
+    - QCLINUX: arm64: defconfig: Add Aquantia AQR115C config
+    - PENDING: net: stmmac: dwmac-qcom-ethqos: add support for emac4 on qcs8300
+      platforms
+    - PENDING: arm64: dts: qcom: qcs8300: add the SGMII PHY node
+    - FROMGIT: Bluetooth: SMP: Fix assumption of Central always being Initiator
+    - QCLINUX: arm64: dts: qcom: qcs8300: Add dma-buf heaps support
+    - PENDING: arm64: dts: qcom: qcs8300: add rpmhpd dts node
+    - PENDING: arm64: dts: qcom: qcs8300: Add regulators dts node
+    - PENDING: phy: qcom: add support for SGMII SerDes PHY on qcs8300 platform
+    - PENDING: clk: qcom: Add support for Camera Clock Controller on QCS8300
+    - PENDING: clk: qcom: Add support for GPU Clock Controller on QCS8300
+    - PENDING: arm64: dts: qcom: qcs8300: add coresight components
+    - QCLINUX: arm64: dts: qcom: qcs8300: Add dcc device tree node
+    - PENDING: arm64: dts: qcom: qcs8300: add the first 1Gb ethernet interface
+    - PENDING: arm64: dts: qcom: qcs8300-ride: enable the SerDes PHY
+    - PENDING: arm64: dts: qcom: qcs8300-ride: add pin functions for ethernet0
+    - PENDING: arm64: dts: qcom: qcs8300-ride: enable ethernet0
+    - PENDING: arm64: dts: qcom: qcs8300: add UFS nodes
+    - PENDING: arm64: dts: qcom: qcs8300: add the pcie smmu node
+    - PENDING: arm64: dts: qcom: qcs8300-ride: Add ufs mem
+    - PENDING: dmaengine: qcom: bam_dma: Correct descriptor FIFO size
+    - PENDING: arm64: dts: qcom: qcs8300: Add clock controllers support
+    - PENDING: remoteproc: qcom: pas: Add QCS8300 CDSP support
+    - PENDING: remoteproc: qcom: disable remoteproc auto boot for wpss
+    - PENDING: ARM: dt: add extended SPI specifier
+    - PENDING: arm64: dts: qcom: Add support for SA8255p Ride platform
+    - PENDING: arm64: dts: QCS8300: Add device node for gfx_smmu
+    - FROMLIST: misc: fastrpc: Add support for multiple PD from one process
+    - PENDING: arm64: dts: qcom: qcs8300: add CDSP support
+    - PENDING: arm64: dts: qcom: qcs8300-ride: enable CDSP for QCS8300
+    - PENDING: phy: qcom: Add support for eDP PHY on sa8775p
+    - PENDING: arm64: dts: qcom: qcs8300: add ADSP GPDSP support
+    - PENDING: arm64: dts: qcom: qcs8300-ride: enable ADSP GPDSP for QCS8300
+    - PENDING: arm64: dts: qcom: qcs8300: Add spmi bus
+    - QCLINUX: arm64: dts: qcom: qcs8300: addons: Add memory dump table
+    - PENDING: clk: qcom: gcc-qcs8300: Fixup the copyright
+    - PENDING: drm/msm/dp: Add DisplayPort controller for SA8775P
+    - PENDING: arm64: dts: qcom: mark ethernet devices as DMA-coherent
+    - PENDING: arm64: dts: qcom: sa8255p: enable safety IRQ
+    - PENDING: remoteproc: qcom: pas: Add QCS8300 ADSP GPDSP support
+    - FROMLIST: misc: fastrpc: Save actual DMA size in fastrpc_map structure
+    - FROMLIST: misc: fastrpc: Fix fastrpc_map_lookup operation
+    - FROMLIST: misc: fastrpc: Skip reference for DMA handles
+    - PENDING: phy: qcom: qmp: Add qmp conifguration for QCS8300
+    - PENDING: drm/msm: mdss: Add SA8775P support
+    - PENDING: drm/msm/dpu: Add SA8775P support
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add uart4 node for RB3GEN2 vision-
+      mezz
+    - PENDING: arm64: dts: qcom: qcs8300: add "clock-names" property
+    - PENDING:wifi: ath11k: support DBS and DFS compatibility
+    - PENDING: pmdomain: qcom: rpmhpd: Add qcs8300 power domains
+    - QCLINUX: arm64: defconfig: Revert Add Aquantia AQR115C config
+    - QCLINUX: qcom: tz_log: differentiate hlos and hypversior of creating
+      shmbridge
+    - BACKPORT: FROMGIT: soc: qcom: smp2p: Introduce tracepoint support
+    - FROMLIST: wifi: ath11k: Fix double free issue during SRNG deinit
+    - PENDING: arm64: dts: qcom: Add support for usb nodes on QCS8300
+    - PENDING: arm64: dts: qcom: sa8775p: add display dt nodes
+    - QCLINUX: coresight: Correct the loglevel of the log info
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add spi dev node for qcs100 ridesx
+      target
+    - PENDING: arm64: dts: qcom: qcs8300: Add QUPv3 configuration
+    - PENDING: arm64: dts: qcom: sa8775p: Add DisplayPort device node
+    - PENDING: arm64: dts: qcom: Enable USB controllers for QCS8300
+    - PENDING: smcinvoke: Decrement the server object ref count in mutex context
+    - QCLINUX: defconfig: Enable SKBEDIT AND CLS TC utilities
+    - PENDING: coresight: tmc: flush remaining data when ETR is disabled
+    - QCLINUX: Revert "drivers: core: synchronize really_probe() and dev_uevent()"
+    - PENDING: drm/bridge: anx7625: change the gpio_set_value API
+    - PENDING: Bluetooth: mgmt: Verify cmd pending status before removing it
+    - PENDING: remoteproc: qcom: pas: fix QCS8300 GPDSP support
+    - PENDING: Bluetooth: mgmt: Verify command pending status before removing it
+    - QCLINUX: arm64: dts: qcom: sa8775p: Enable HS MI2S
+    - QCLINUX: ASoC: qcm6490: Add AIF0 and AIF3 for qcs9100
+    - QCLINUX: ASoC: codecs: msm-stub: Add AIF0 and AIF3 DAIs
+    - QCLINUX: ASoC: qcm6490: add macro and dcodec clk for qcs9100
+    - QCLINUX: arm64: dts: qcom: sa8775p: add dcodec and macro clk
+    - QCLINUX: arm64: dts: qcom: Add HSP dts support
+    - QCLINUX: arm64: dts: qcom: Add HSP BT dts support
+    - QCLINUX: arm64: dts: qcom: Disable MPSS on HSP dts
+    - QCLINUX: arm64: dts: qcom: Add PCIe node on HSP
+    - PENDING: arm64: dts: qcom: sc7280: add ICE node
+    - PENDING: qcom: ice: Remove ice probe
+    - QCLINUX: mmc: host: support wrapped keys in mmc
+    - PENDING: mmc: host: add support to derive software secret
+    - PENDING: mmc: host: add support for generate, import and prepare keys
+    - PENDING: mmc: host: wrapped keys support in mmc qcom
+    - PENDING: mmc: host: implement derive sw secret vop in mmc qcom
+    - PENDING: mmc: host: support for generate, import and prepare key
+    - PENDING: arm64: defconfig: qcom: Enable MMC crypto
+    - QCLINUX: net: qrtr: mhi: synchronize qrtr and mhi preparation
+    - PENDING: ath11k: Fix CE offset address calculation for WCN6750 in SSR
+    - QCLINUX: rpmsg: glink: multi enter for unregister path
+    - PENDING: arm64: dts: qcom: sa8775p: Update memory map for SA8775P
+    - Ubuntu: [Config] update CONFIG options for GA 1.2
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 18 Oct 2024 18:49:17 +0900
+
+linux-qcom (6.8.0-1012.12) jammy; urgency=medium
+
+  * perf build disables tracepoint support (LP: #2076190)
+    - [Packaging] add libtraceevent as dependency
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 04 Oct 2024 12:13:50 +0900
+
+linux-qcom (6.8.0-1011.11) jammy; urgency=medium
+
+  * "[RB3] tc956x_pci-eth errors found in dmesg"
+    - SAUCE: ubuntu/qcom/qps615: suppress false alerts
+    - SAUCE: ubuntu/qcom/qps615: use INFO level for logging
+
+  * "[RB3] slim-ngd-ctrl error found in dmesg"
+    - SAUCE: qcom-ngd-ctrl: suppress "QMI handle is NULL" error
+    - SAUCE: qcom-ngd-ctrl: fix race condition for completion
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] remove modules-extra package
+
+  [ Ubuntu: 6.8.0-48.48 ]
+
+  * noble/linux: 6.8.0-48.48 -proposed tracker (LP: #2082437)
+  * [SRU][Noble] Bad EPP defaults cause performance regressions on select Intel
+    CPUs (LP: #2077470)
+    - x86/cpu/vfm: Update arch/x86/include/asm/intel-family.h
+    - cpufreq: intel_pstate: Allow model specific EPPs
+    - cpufreq: intel_pstate: Update default EPPs for Meteor Lake
+    - cpufreq: intel_pstate: Switch to new Intel CPU model defines
+    - cpufreq: intel_pstate: Update Meteor Lake EPPs
+    - cpufreq: intel_pstate: Use Meteor Lake EPPs for Arrow Lake
+    - cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids
+  * power: Enable intel_rapl driver (LP: #2078834)
+    - powercap: intel_rapl: Add support for ArrowLake-H platform
+  * x86/vmware: Add TDX hypercall support (LP: #2077729)
+    - x86/vmware: Introduce VMware hypercall API
+    - x86/vmware: Add TDX hypercall support
+  * Guest crashes post migration with migrate_misplaced_folio+0x4cc/0x5d0
+    (LP: #2076866)
+    - mm/mempolicy: use numa_node_id() instead of cpu_to_node()
+    - mm/numa_balancing: allow migrate on protnone reference with
+      MPOL_PREFERRED_MANY policy
+    - mm: convert folio_estimated_sharers() to folio_likely_mapped_shared()
+    - mm: factor out the numa mapping rebuilding into a new helper
+    - mm: support multi-size THP numa balancing
+    - mm/migrate: make migrate_misplaced_folio() return 0 on success
+    - mm/migrate: move NUMA hinting fault folio isolation + checks under PTL
+    - mm: fix possible OOB in numa_rebuild_large_mapping()
+  * Add 'mm: hold PTL from the first PTE while reclaiming a large folio' to fix
+    L2 Guest hang during LTP Test (LP: #2076147)
+    - mm: hold PTL from the first PTE while reclaiming a large folio
+  * KOP L2 guest fails to boot with 1 core - SMT8 topology (LP: #2070329)
+    - KVM: PPC: Book3S HV nestedv2: Add DPDES support in helper library for Guest
+      state buffer
+    - KVM: PPC: Book3S HV nestedv2: Fix doorbell emulation
+  * L2 Guest migration: continuously dumping while running NFS guest migration
+    (LP: #2076406)
+    - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3
+    - KVM: PPC: Book3S HV: Fix the get_one_reg of SDAR
+    - KVM: PPC: Book3S HV: Add one-reg interface for DEXCR register
+    - KVM: PPC: Book3S HV nestedv2: Keep nested guest DEXCR in sync
+    - KVM: PPC: Book3S HV: Add one-reg interface for HASHKEYR register
+    - KVM: PPC: Book3S HV nestedv2: Keep nested guest HASHKEYR in sync
+    - KVM: PPC: Book3S HV: Add one-reg interface for HASHPKEYR register
+    - KVM: PPC: Book3S HV nestedv2: Keep nested guest HASHPKEYR in sync
+  * perf build disables tracepoint support (LP: #2076190)
+    - [Packaging] perf: reenable libtraceevent
+  * Please backport the more restrictive XSAVES deactivation for  Zen1/2 arch
+    (LP: #2077321)
+    - x86/CPU/AMD: Improve the erratum 1386 workaround
+  * Fix alsa scarlett2 driver in 6.8  (LP: #2076402)
+    - ALSA: scarlett2: Move initialisation code lower in the source
+    - ALSA: scarlett2: Implement handling of the ACK notification
+  * rtw89: reset IDMEM mode to prevent download firmware failure (LP: #2077396)
+    - wifi: rtw89: 885xb: reset IDMEM mode to prevent download firmware failure
+  * CVE-2024-43858
+    - jfs: Fix array-index-out-of-bounds in diFree
+  * CVE-2024-42280
+    - mISDN: Fix a use after free in hfcmulti_tx()
+  * CVE-2024-42271
+    - net/iucv: fix use after free in iucv_sock_close()
+  * [Ubuntu-24.04] FADump with recommended crash size is making the L1 hang
+    (LP: #2060039)
+    - powerpc/64s/radix/kfence: map __kfence_pool at page granularity
+  * Noble update: upstream stable patchset 2024-09-09 (LP: #2079945)
+    - ocfs2: add bounds checking to ocfs2_check_dir_entry()
+    - jfs: don't walk off the end of ealist
+    - fs/ntfs3: Add a check for attr_names and oatbl
+    - fs/ntfs3: Validate ff offset
+    - usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup
+    - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
+    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
+    - arm64: dts: qcom: qrb4210-rb2: switch I2C2 to i2c-gpio
+    - arm64: dts: qcom: msm8996: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: sm6350: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: ipq6018: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: sdm630: Disable SS instance in Parkmode for USB
+    - ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused
+    - ALSA: seq: ump: Skip useless ports for static blocks
+    - filelock: Fix fcntl/close race recovery compat path
+    - tun: add missing verification for short frame
+    - tap: add missing verification for short frame
+    - s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()
+    - ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop
+    - arm64: dts: qcom: sc7180: Disable SuperSpeed instances in park mode
+    - arm64: dts: qcom: sc7280: Disable SuperSpeed instances in park mode
+    - arm64: dts: qcom: qrb2210-rb1: switch I2C2 to i2c-gpio
+    - arm64: dts: qcom: msm8998: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: ipq8074: Disable SS instance in Parkmode for USB
+    - arm64: dts: qcom: sdm845: Disable SS instance in Parkmode for USB
+    - Upstream stable to v6.6.43, v6.9.12
+  * Noble update: upstream stable patchset 2024-09-02 (LP: #2078304)
+    - filelock: Remove locks reliably when fcntl/close race is detected
+    - scsi: core: alua: I/O errors for ALUA state transitions
+    - scsi: sr: Fix unintentional arithmetic wraparound
+    - scsi: qedf: Don't process stag work during unload and recovery
+    - scsi: qedf: Wait for stag work during unload
+    - scsi: qedf: Set qed_slowpath_params to zero before use
+    - efi/libstub: zboot.lds: Discard .discard sections
+    - ACPI: EC: Abort address space access upon error
+    - ACPI: EC: Avoid returning AE_OK on errors in address space handler
+    - tools/power/cpupower: Fix Pstate frequency reporting on AMD Family 1Ah CPUs
+    - wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata
+    - wifi: mac80211: apply mcast rate only if interface is up
+    - wifi: mac80211: handle tasklet frames before stopping
+    - wifi: cfg80211: fix 6 GHz scan request building
+    - wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup
+    - wifi: iwlwifi: mvm: remove stale STA link data during restart
+    - wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd
+    - wifi: iwlwifi: mvm: handle BA session teardown in RF-kill
+    - wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe option
+    - wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill
+    - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
+    - selftests: cachestat: Fix build warnings on ppc64
+    - selftests/openat2: Fix build warnings on ppc64
+    - selftests/futex: pass _GNU_SOURCE without a value to the compiler
+    - of/irq: Factor out parsing of interrupt-map parent phandle+args from
+      of_irq_parse_raw()
+    - Input: silead - Always support 10 fingers
+    - net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
+    - ila: block BH in ila_output()
+    - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
+    - null_blk: fix validation of block size
+    - kconfig: gconf: give a proper initial state to the Save button
+    - kconfig: remove wrong expr_trans_bool()
+    - input: Add event code for accessibility key
+    - input: Add support for "Do Not Disturb"
+    - HID: Ignore battery for ELAN touchscreens 2F2C and 4116
+    - NFSv4: Fix memory leak in nfs4_set_security_label
+    - nfs: propagate readlink errors in nfs_symlink_filler
+    - nfs: Avoid flushing many pages with NFS_FILE_SYNC
+    - nfs: don't invalidate dentries on transient errors
+    - cachefiles: add consistency check for copen/cread
+    - cachefiles: Set object to close if ondemand_id < 0 in copen
+    - cachefiles: make on-demand read killable
+    - fs/file: fix the check in find_next_fd()
+    - mei: demote client disconnect warning on suspend to debug
+    - iomap: Fix iomap_adjust_read_range for plen calculation
+    - drm/exynos: dp: drop driver owner initialization
+    - drm: panel-orientation-quirks: Add quirk for Aya Neo KUN
+    - drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time
+    - nvme: avoid double free special payload
+    - nvmet: always initialize cqe.result
+    - ALSA: hda: cs35l56: Fix lifecycle of codec pointer
+    - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
+    - ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5
+    - KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
+    - drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency
+    - ALSA: hda/realtek: Add more codec ID to no shutup pins list
+    - spi: Fix OCTAL mode support
+    - cpumask: limit FORCE_NR_CPUS to just the UP case
+    - [Config] Remove FORCE_NR_CPUS
+    - selftests: openvswitch: Set value to nla flags.
+    - drm/amdgpu: Indicate CU havest info to CP
+    - ALSA: hda: cs35l56: Select SERIAL_MULTI_INSTANTIATE
+    - mips: fix compat_sys_lseek syscall
+    - Input: elantech - fix touchpad state on resume for Lenovo N24
+    - Input: i8042 - add Ayaneo Kun to i8042 quirk table
+    - ASoC: rt722-sdca-sdw: add silence detection register as volatile
+    - Input: xpad - add support for ASUS ROG RAIKIRI PRO
+    - ASoC: topology: Fix references to freed memory
+    - ASoC: topology: Do not assign fields that are already set
+    - bytcr_rt5640 : inverse jack detect for Archos 101 cesium
+    - ALSA: dmaengine: Synchronize dma channel after drop()
+    - ASoC: ti: davinci-mcasp: Set min period size using FIFO config
+    - ASoC: ti: omap-hdmi: Fix too long driver name
+    - ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on error rollback
+    - ASoC: rt722-sdca-sdw: add debounce time for type detection
+    - nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA.
+    - Input: ads7846 - use spi_device_id table
+    - can: kvaser_usb: fix return value for hif_usb_send_regout
+    - gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
+    - octeontx2-pf: Fix coverity and klockwork issues in octeon PF driver
+    - s390/sclp: Fix sclp_init() cleanup on failure
+    - platform/mellanox: nvsw-sn2201: Add check for platform_device_add_resources
+    - platform/x86: wireless-hotkey: Add support for LG Airplane Button
+    - platform/x86: lg-laptop: Remove LGEX0815 hotkey handling
+    - platform/x86: lg-laptop: Change ACPI device id
+    - platform/x86: lg-laptop: Use ACPI device handle when evaluating WMAB/WMBB
+    - btrfs: qgroup: fix quota root leak after quota disable failure
+    - ibmvnic: Add tx check to prevent skb leak
+    - ALSA: PCM: Allow resume only for suspended streams
+    - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
+    - ALSA: dmaengine_pcm: terminate dmaengine before synchronize
+    - ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA
+    - net: usb: qmi_wwan: add Telit FN912 compositions
+    - net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and
+      DEV_STATS_ADD()
+    - powerpc/pseries: Whitelist dtl slub object for copying to userspace
+    - powerpc/eeh: avoid possible crash when edev->pdev changes
+    - scsi: libsas: Fix exp-attached device scan after probe failure scanned in
+      again after probe failed
+    - tee: optee: ffa: Fix missing-field-initializers warning
+    - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
+    - Bluetooth: btnxpuart: Enable Power Save feature on startup
+    - bluetooth/l2cap: sync sock recv cb and release
+    - erofs: ensure m_llen is reset to 0 if metadata is invalid
+    - drm/amd/display: Add refresh rate range check
+    - drm/amd/display: Account for cursor prefetch BW in DML1 mode support
+    - drm/amd/display: Fix refresh rate range for some panel
+    - drm/radeon: check bo_va->bo is non-NULL before using it
+    - fs: better handle deep ancestor chains in is_subdir()
+    - wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK
+    - drivers/perf: riscv: Reset the counter to hpmevent mapping while starting
+      cpus
+    - riscv: stacktrace: fix usage of ftrace_graph_ret_addr()
+    - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
+    - ksmbd: return FILE_DEVICE_DISK instead of super magic
+    - ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods by
+      MAX_BDL_ENTRIES
+    - selftest/timerns: fix clang build failures for abs() calls
+    - selftests/vDSO: fix clang build errors and warnings
+    - hfsplus: fix uninit-value in copy_name
+    - selftests/bpf: Extend tcx tests to cover late tcx_entry release
+    - spi: mux: set ctlr->bits_per_word_mask
+    - ALSA: hda: Use imply for suggesting CONFIG_SERIAL_MULTI_INSTANTIATE
+    - [Config] Update CONFIG_SERIAL_MULTI_INSTANTIATE
+    - cifs: fix noisy message on copy_file_range
+    - Bluetooth: L2CAP: Fix deadlock
+    - of/irq: Disable "interrupt-map" parsing for PASEMI Nemo
+    - wifi: cfg80211: wext: set ssids=NULL for passive scans
+    - wifi: mac80211: disable softirqs for queued frame handling
+    - wifi: iwlwifi: mvm: don't wake up rx_sync_waitq upon RFKILL
+    - cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
+    - cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
+    - btrfs: ensure fast fsync waits for ordered extents after a write failure
+    - PNP: Hide pnp_bus_type from the non-PNP code
+    - ACPI: AC: Properly notify powermanagement core about changes
+    - selftests/overlayfs: Fix build error on ppc64
+    - nvme-fabrics: use reserved tag for reg read/write command
+    - LoongArch: Fix GMAC's phy-mode definitions in dts
+    - io_uring: fix possible deadlock in io_register_iowq_max_workers()
+    - vfio: Create vfio_fs_type with inode per device
+    - vfio/pci: Use unmap_mapping_range()
+    - parport: amiga: Mark driver struct with __refdata to prevent section
+      mismatch
+    - drm: renesas: shmobile: Call drm_atomic_helper_shutdown() at shutdown time
+    - vfio/pci: Insert full vma on mmap'd MMIO fault
+    - ALSA: hda: cs35l41: Support Lenovo Thinkbook 16P Gen 5
+    - ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 4
+    - ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 4
+    - wifi: mac80211: Avoid address calculations via out of bounds array indexing
+    - drm/amd/display: change dram_clock_latency to 34us for dcn35
+    - closures: Change BUG_ON() to WARN_ON()
+    - ASoC: codecs: ES8326: Solve headphone detection issue
+    - ASoC: Intel: avs: Fix route override
+    - net: mvpp2: fill-in dev_port attribute
+    - btrfs: scrub: handle RST lookup error correctly
+    - clk: qcom: apss-ipq-pll: remove 'config_ctl_hi_val' from Stromer pll configs
+    - drm/amd/display: Update efficiency bandwidth for dcn351
+    - drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport
+    - btrfs: fix uninitialized return value in the ref-verify tool
+    - spi: davinci: Unset POWERDOWN bit when releasing resources
+    - mm: page_ref: remove folio_try_get_rcu()
+    - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Lenovo ThinBook 13x
+      Gen4
+    - netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume()
+    - Upstream stable to v6.6.42, v6.9.11
+  * CVE-2024-27022
+    - Revert "Revert "fork: defer linking file vma until vma is fully
+      initialized""
+  * UBSAN: array-index-out-of-bounds in /build/linux-Z1RxaK/linux-
+    6.8.0/drivers/gpu/drm/amd/amdgpu/../pm/powerplay/hwmgr/processpptables.c:124
+    9:61 (LP: #2078041)
+    - drm/amdgpu/pptable: convert some variable sized arrays to [] style
+    - drm/amdgpu: convert some variable sized arrays to [] style
+    - drm/amdgpu/pptable: Fix UBSAN array-index-out-of-bounds
+  * alsa: Headphone and Speaker couldn't output sound intermittently
+    (LP: #2077690)
+    - ALSA: hda/realtek - Fixed ALC256 headphone no sound
+    - ALSA: hda/realtek - FIxed ALC285 headphone no sound
+  * Fix ethernet performance on JSL and EHL (LP: #2077858)
+    - intel_idle: Disable promotion to C1E on Jasper Lake and Elkhart Lake
+  * Noble update: upstream stable patchset 2024-08-29 (LP: #2078289)
+    - Revert "usb: xhci: prevent potential failure in handle_tx_event() for
+      Transfer events without TRB"
+    - Compiler Attributes: Add __uninitialized macro
+    - mm: prevent derefencing NULL ptr in pfn_section_valid()
+    - scsi: ufs: core: Fix ufshcd_clear_cmd racing issue
+    - scsi: ufs: core: Fix ufshcd_abort_one racing issue
+    - vfio/pci: Init the count variable in collecting hot-reset devices
+    - cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop
+    - cachefiles: stop sending new request when dropping object
+    - cachefiles: cancel all requests for the object that is being dropped
+    - cachefiles: wait for ondemand_object_worker to finish when dropping object
+    - cachefiles: cyclic allocation of msg_id to avoid reuse
+    - cachefiles: add missing lock protection when polling
+    - dsa: lan9303: Fix mapping between DSA port number and PHY address
+    - filelock: fix potential use-after-free in posix_lock_inode
+    - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
+    - vfs: don't mod negative dentry count when on shrinker list
+    - net: bcmasp: Fix error code in probe()
+    - tcp: fix incorrect undo caused by DSACK of TLP retransmit
+    - bpf: Fix too early release of tcx_entry
+    - net: phy: microchip: lan87xx: reinit PHY after cable test
+    - skmsg: Skip zero length skb in sk_msg_recvmsg
+    - octeontx2-af: Fix incorrect value output on error path in
+      rvu_check_rsrc_availability()
+    - net: fix rc7's __skb_datagram_iter()
+    - i40e: Fix XDP program unloading while removing the driver
+    - net: ethernet: lantiq_etop: fix double free in detach
+    - bpf: fix order of args in call to bpf_map_kvcalloc
+    - bpf: make timer data struct more generic
+    - bpf: replace bpf_timer_init with a generic helper
+    - bpf: Fail bpf_timer_cancel when callback is being cancelled
+    - net: ethernet: mtk-star-emac: set mac_managed_pm when probing
+    - ppp: reject claimed-as-LCP but actually malformed packets
+    - ethtool: netlink: do not return SQI value if link is down
+    - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
+    - net, sunrpc: Remap EPERM in case of connection failure in
+      xs_tcp_setup_socket
+    - s390: Mark psw in __load_psw_mask() as __unitialized
+    - arm64: dts: qcom: sc8180x: Fix LLCC reg property again
+    - firmware: cs_dsp: Fix overflow checking of wmfw header
+    - firmware: cs_dsp: Return error if block header overflows file
+    - firmware: cs_dsp: Validate payload length before processing block
+    - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
+    - ASoC: SOF: Intel: hda: fix null deref on system suspend entry
+    - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
+    - ARM: davinci: Convert comma to semicolon
+    - octeontx2-af: replace cpt slot with lf id on reg write
+    - octeontx2-af: fix a issue with cpt_lf_alloc mailbox
+    - octeontx2-af: fix detection of IP layer
+    - octeontx2-af: fix issue with IPv6 ext match for RSS
+    - octeontx2-af: fix issue with IPv4 match for RSS
+    - cifs: fix setting SecurityFlags to true
+    - Revert "sched/fair: Make sure to try to detach at least one movable task"
+    - tcp: avoid too many retransmit packets
+    - net: ks8851: Fix deadlock with the SPI chip variant
+    - net: ks8851: Fix potential TX stall after interface reopen
+    - USB: serial: option: add Telit generic core-dump composition
+    - USB: serial: option: add Telit FN912 rmnet compositions
+    - USB: serial: option: add Fibocom FM350-GL
+    - USB: serial: option: add support for Foxconn T99W651
+    - USB: serial: option: add Netprisma LCUK54 series modules
+    - USB: serial: option: add Rolling RW350-GL variants
+    - USB: serial: mos7840: fix crash on resume
+    - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
+    - usb: dwc3: pci: add support for the Intel Panther Lake
+    - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
+    - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the
+      descriptor
+    - misc: microchip: pci1xxxx: Fix return value of nvmem callbacks
+    - hpet: Support 32-bit userspace
+    - xhci: always resume roothubs if xHC was reset during resume
+    - s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()
+    - mm: vmalloc: check if a hash-index is in cpu_possible_mask
+    - mm/filemap: skip to create PMD-sized page cache if needed
+    - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
+    - ksmbd: discard write access to the directory open
+    - iio: trigger: Fix condition for own trigger
+    - arm64: dts: qcom: sa8775p: Correct IRQ number of EL2 non-secure physical
+      timer
+    - arm64: dts: qcom: sc8280xp-x13s: fix touchscreen power on
+    - nvmem: rmem: Fix return value of rmem_read()
+    - nvmem: meson-efuse: Fix return value of nvmem callbacks
+    - nvmem: core: only change name to fram for current attribute
+    - platform/x86: toshiba_acpi: Fix array out-of-bounds access
+    - tty: serial: ma35d1: Add a NULL check for of_node
+    - ALSA: hda/realtek: add quirk for Clevo V5[46]0TU
+    - ALSA: hda/realtek: Enable Mute LED on HP 250 G7
+    - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
+    - Fix userfaultfd_api to return EINVAL as expected
+    - pmdomain: qcom: rpmhpd: Skip retention level for Power Domains
+    - libceph: fix race between delayed_work() and ceph_monc_stop()
+    - ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
+    - cpufreq: ACPI: Mark boost policy as enabled when setting boost
+    - cpufreq: Allow drivers to advertise boost enabled
+    - wireguard: selftests: use acpi=off instead of -no-acpi for recent QEMU
+    - wireguard: allowedips: avoid unaligned 64-bit memory accesses
+    - wireguard: queueing: annotate intentional data race in cpu round robin
+    - wireguard: send: annotate intentional data race in checking empty queue
+    - misc: fastrpc: Fix DSP capabilities request
+    - misc: fastrpc: Avoid updating PD type for capability request
+    - misc: fastrpc: Copy the complete capability structure to user
+    - misc: fastrpc: Fix memory leak in audio daemon attach operation
+    - misc: fastrpc: Fix ownership reassignment of remote heap
+    - misc: fastrpc: Restrict untrusted app to attach to privileged PD
+    - mm/shmem: disable PMD-sized page cache if needed
+    - mm/damon/core: merge regions aggressively when max_nr_regions is unmet
+    - selftests/net: fix gro.c compilation failure due to non-existent
+      opt_ipproto_off
+    - ext4: avoid ptr null pointer dereference
+    - sched: Move psi_account_irqtime() out of update_rq_clock_task() hotpath
+    - i2c: rcar: bring hardware to known state when probing
+    - i2c: mark HostNotify target address as used
+    - i2c: rcar: ensure Gen3+ reset does not disturb local targets
+    - i2c: testunit: avoid re-issued work after read message
+    - i2c: rcar: clear NO_RXDMA flag after resetting
+    - x86/bhi: Avoid warning in #DB handler due to BHI mitigation
+    - kbuild: Make ld-version.sh more robust against version string changes
+    - spi: axi-spi-engine: fix sleep calculation
+    - minixfs: Fix minixfs_rename with HIGHMEM
+    - bpf: Defer work in bpf_timer_cancel_and_free
+    - netfilter: nf_tables: prefer nft_chain_validate
+    - arm64: dts: qcom: x1e80100-*: Allocate some CMA buffers
+    - arm64: dts: qcom: sm6115: add iommu for sdhc_1
+    - arm64: dts: qcom: qdu1000: Fix LLCC reg property
+    - net: ethtool: Fix RSS setting
+    - nilfs2: fix kernel bug on rename operation of broken directory
+    - cachestat: do not flush stats in recency check
+    - mm: fix crashes from deferred split racing folio migration
+    - nvmem: core: limit cell sysfs permissions to main attribute ones
+    - serial: imx: ensure RTS signal is not left active after shutdown
+    - mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE
+    - mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length
+    - mm/readahead: limit page cache size in page_cache_ra_order()
+    - Revert "dt-bindings: cache: qcom,llcc: correct QDU1000 reg entries"
+    - sched/deadline: Fix task_struct reference leak
+    - Upstream stable to v6.6.40, v6.6.41, v6.9.10
+  * [SRU][HPE 24.04] Intel FVL NIC FW flash fails with inbox driver, causing
+    driver not detected (LP: #2076675) // Noble update: upstream stable patchset
+    2024-08-29 (LP: #2078289)
+    - i40e: fix: remove needless retries of NVM update
+  * CVE-2024-41022
+    - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
+  *  Deadlock occurs while suspending md raid  (LP: #2073695)
+    - md: change the return value type of md_write_start to void
+    - md: fix deadlock between mddev_suspend and flush bio
+  * Lenovo X12 Detachable Gen 2 unresponsive under light load (LP: #2076361)
+    - drm/i915: Enable Wa_16019325821
+    - drm/i915/guc: Add support for w/a KLVs
+    - drm/i915/guc: Enable Wa_14019159160
+  * Regression: unable to reach low idle states on Tiger Lake (LP: #2072679)
+    - SAUCE: PCI: ASPM: Allow OS to configure ASPM where BIOS is incapable of
+    - SAUCE: PCI: vmd: Let OS control ASPM for devices under VMD domain
+  * Noble update: upstream stable patchset 2024-08-22 (LP: #2077600)
+    - locking/mutex: Introduce devm_mutex_init()
+    - leds: an30259a: Use devm_mutex_init() for mutex initialization
+    - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
+    - drm/lima: fix shared irq handling on driver remove
+    - powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
+    - media: dvb: as102-fe: Fix as10x_register_addr packing
+    - media: dvb-usb: dib0700_devices: Add missing release_firmware()
+    - IB/core: Implement a limit on UMAD receive List
+    - scsi: qedf: Make qedf_execute_tmf() non-preemptible
+    - selftests/bpf: adjust dummy_st_ops_success to detect additional error
+    - selftests/bpf: do not pass NULL for non-nullable params in dummy_st_ops
+    - selftests/bpf: dummy_st_ops should reject 0 for non-nullable params
+    - RISC-V: KVM: Fix the initial sample period value
+    - crypto: aead,cipher - zeroize key buffer after use
+    - media: mediatek: vcodec: Only free buffer VA that is not NULL
+    - drm/amdgpu: Fix uninitialized variable warnings
+    - drm/amdgpu: Initialize timestamp for some legacy SOCs
+    - drm/amd/display: Check index msg_id before read or write
+    - drm/amd/display: Check pipe offset before setting vblank
+    - drm/amd/display: Skip finding free audio for unknown engine_id
+    - drm/amd/display: Fix uninitialized variables in DM
+    - drm/amdgpu: fix uninitialized scalar variable warning
+    - drm/amdgpu: fix the warning about the expression (int)size - len
+    - media: dw2102: Don't translate i2c read into write
+    - riscv: Apply SiFive CIP-1200 workaround to single-ASID sfence.vma
+    - sctp: prefer struct_size over open coded arithmetic
+    - firmware: dmi: Stop decoding on broken entry
+    - Input: ff-core - prefer struct_size over open coded arithmetic
+    - wifi: mt76: replace skb_put with skb_put_zero
+    - wifi: mt76: mt7996: add sanity checks for background radar trigger
+    - thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
+    - media: dvb-frontends: tda18271c2dd: Remove casting during div
+    - media: s2255: Use refcount_t instead of atomic_t for num_channels
+    - media: dvb-frontends: tda10048: Fix integer overflow
+    - i2c: i801: Annotate apanel_addr as __ro_after_init
+    - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
+    - orangefs: fix out-of-bounds fsid access
+    - kunit: Fix timeout message
+    - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
+    - selftests/net: fix uninitialized variables
+    - igc: fix a log entry using uninitialized netdev
+    - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
+    - serial: imx: Raise TX trigger level to 8
+    - jffs2: Fix potential illegal address access in jffs2_free_inode
+    - s390/pkey: Wipe sensitive data on failure
+    - btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation
+      warning
+    - cdrom: rearrange last_media_change check to avoid unintentional overflow
+    - tools/power turbostat: Remember global max_die_id
+    - vhost: Use virtqueue mutex for swapping worker
+    - vhost: Release worker mutex during flushes
+    - vhost_task: Handle SIGKILL by flushing work and exiting
+    - mac802154: fix time calculation in ieee802154_configure_durations()
+    - net: phy: phy_device: Fix PHY LED blinking code comment
+    - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
+    - net/mlx5: E-switch, Create ingress ACL when needed
+    - net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup()
+    - Bluetooth: hci_event: Fix setting of unicast qos interval
+    - Bluetooth: Ignore too large handle values in BIG
+    - Bluetooth: ISO: Check socket flag instead of hcon
+    - bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
+    - KVM: s390: fix LPSWEY handling
+    - e1000e: Fix S0ix residency on corporate systems
+    - gpiolib: of: fix lookup quirk for MIPS Lantiq
+    - net: allow skb_datagram_iter to be called from any context
+    - net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
+    - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from
+      __netif_rx()
+    - gpio: mmio: do not calculate bgpio_bits via "ngpios"
+    - wifi: wilc1000: fix ies_len type in connect path
+    - riscv: kexec: Avoid deadlock in kexec crash path
+    - netfilter: nf_tables: unconditionally flush pending work before notifier
+    - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
+    - selftests: fix OOM in msg_zerocopy selftest
+    - selftests: make order checking verbose in msg_zerocopy selftest
+    - inet_diag: Initialize pad field in struct inet_diag_req_v2
+    - mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI
+      file
+    - gpiolib: of: add polarity quirk for TSC2005
+    - cpu: Fix broken cmdline "nosmp" and "maxcpus=0"
+    - platform/x86: toshiba_acpi: Fix quickstart quirk handling
+    - Revert "igc: fix a log entry using uninitialized netdev"
+    - nilfs2: fix inode number range checks
+    - nilfs2: add missing check for inode numbers on directory entries
+    - mm: optimize the redundant loop of mm_update_owner_next()
+    - mm: avoid overflows in dirty throttling logic
+    - btrfs: fix adding block group to a reclaim list and the unused list during
+      reclaim
+    - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add()
+    - Bluetooth: hci_bcm4377: Fix msgid release
+    - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
+    - can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
+    - fsnotify: Do not generate events for O_PATH file descriptors
+    - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(),
+      again"
+    - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
+    - drm/amdgpu/atomfirmware: silence UBSAN warning
+    - drm: panel-orientation-quirks: Add quirk for Valve Galileo
+    - clk: qcom: gcc-ipq9574: Add BRANCH_HALT_VOTED flag
+    - clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common
+    - powerpc/pseries: Fix scv instruction crash with kexec
+    - powerpc/64s: Fix unnecessary copy to 0 when kernel is booted at address 0
+    - mtd: rawnand: Ensure ECC configuration is propagated to upper layers
+    - mtd: rawnand: Fix the nand_read_data_op() early check
+    - mtd: rawnand: Bypass a couple of sanity checks during NAND identification
+    - mtd: rawnand: rockchip: ensure NVDDR timings are rejected
+    - net: stmmac: dwmac-qcom-ethqos: fix error array size
+    - arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model B
+    - media: dw2102: fix a potential buffer overflow
+    - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents
+    - clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs
+    - clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
+    - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
+    - fs/ntfs3: Mark volume as dirty if xattr is broken
+    - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
+    - vhost-scsi: Handle vhost_vq_work_queue failures for events
+    - nvme-multipath: find NUMA path only for online numa-node
+    - dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails
+    - connector: Fix invalid conversion in cn_proc.h
+    - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
+    - regmap-i2c: Subtract reg size from max_write
+    - platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6"
+      tablet
+    - platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
+    - nvmet: fix a possible leak when destroy a ctrl during qp establishment
+    - kbuild: fix short log for AS in link-vmlinux.sh
+    - nfc/nci: Add the inconsistency check between the input data length and count
+    - spi: cadence: Ensure data lines set to low during dummy-cycle period
+    - ALSA: ump: Set default protocol when not given explicitly
+    - drm/amdgpu: silence UBSAN warning
+    - null_blk: Do not allow runt zone with zone capacity smaller then zone size
+    - nilfs2: fix incorrect inode allocation from reserved inodes
+    - leds: mlxreg: Use devm_mutex_init() for mutex initialization
+    - net: dql: Avoid calling BUG() when WARN() is enough
+    - drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf
+    - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
+    - drm/amdgpu: fix double free err_addr pointer warnings
+    - drm/amd/display: Fix overlapping copy within dml_core_mode_programming
+    - drm/amd/display: update pipe topology log to support subvp
+    - drm/amd/display: Do not return negative stream id for array
+    - drm/amd/display: ASSERT when failing to find index by plane/stream id
+    - usb: xhci: prevent potential failure in handle_tx_event() for Transfer
+      events without TRB
+    - media: i2c: st-mipid02: Use the correct div function
+    - media: tc358746: Use the correct div_ function
+    - crypto: hisilicon/sec2 - fix for register offset
+    - s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
+    - s390/pkey: Wipe copies of clear-key structures on failure
+    - s390/pkey: Wipe copies of protected- and secure-keys
+    - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
+    - wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
+    - net: txgbe: remove separate irq request for MSI and INTx
+    - net: txgbe: add extra handle for MSI/INTx into thread irq handle
+    - net: txgbe: free isb resources at the right time
+    - btrfs: always do the basic checks for btrfs_qgroup_inherit structure
+    - net: phy: aquantia: add missing include guards
+    - drm/fbdev-generic: Fix framebuffer on big endian devices
+    - net: stmmac: enable HW-accelerated VLAN stripping for gmac4 only
+    - net: rswitch: Avoid use-after-free in rswitch_poll()
+    - ice: use proper macro for testing bit
+    - drm/xe/mcr: Avoid clobbering DSS steering
+    - tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO.
+    - btrfs: zoned: fix calc_available_free_space() for zoned mode
+    - btrfs: fix folio refcount in __alloc_dummy_extent_buffer()
+    - Bluetooth: Add quirk to ignore reserved PHY bits in LE Extended Adv Report
+    - drm/xe: fix error handling in xe_migrate_update_pgtables
+    - drm/ttm: Always take the bo delayed cleanup path for imported bos
+    - fs: don't misleadingly warn during thaw operations
+    - drm/amdkfd: Let VRAM allocations go to GTT domain on small APUs
+    - drm/amdgpu: correct hbm field in boot status
+    - Upstream stable to v6.6.38, v6.6.39, v6.9.9
+  * Panels show garbage or flickering when i915.psr2 enabled (LP: #2069993)
+    - SAUCE: drm/i915/display/psr: add a psr2 disable quirk table
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x4d_0x10_0x93_0x15
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x30_0xe4_0x8b_0x07
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x30_0xe4_0x78_0x07
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x30_0xe4_0x8c_0x07
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x06_0xaf_0x9a_0xf9
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x4d_0x10_0x8f_0x15
+    - SAUCE: drm/i915/display/psr: disable psr2 for panel_0x06_0xaf_0xa3_0xc3
+  * Random flickering with Intel i915 (Gen9 GPUs in 6th-8th gen CPUs) on Linux
+    6.8 (LP: #2062951)
+    - SAUCE: iommu/intel: disable DMAR for SKL integrated gfx
+  * [SRU][22.04.5]: mpi3mr driver update (LP: #2073583)
+    - scsi: mpi3mr: HDB allocation and posting for hardware and firmware buffers
+    - scsi: mpi3mr: Trigger support
+    - scsi: mpi3mr: Add ioctl support for HDB
+    - scsi: mpi3mr: Support PCI Error Recovery callback handlers
+    - scsi: mpi3mr: Prevent PCI writes from driver during PCI error recovery
+    - scsi: mpi3mr: Driver version update
+  * Fix power consumption while using HW accelerated video decode on AMD
+    platforms (LP: #2073282)
+    - drm/amdgpu/vcn: identify unified queue in sw init
+    - drm/amdgpu/vcn: not pause dpg for unified queue
+  * Noble update: upstream stable patchset 2024-08-09 (LP: #2076435)
+    - usb: typec: ucsi: Never send a lone connector change ack
+    - usb: typec: ucsi: Ack also failed Get Error commands
+    - Input: ili210x - fix ili251x_read_touch_data() return value
+    - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
+    - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
+    - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
+    - pinctrl: rockchip: use dedicated pinctrl type for RK3328
+    - pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
+    - MIPS: pci: lantiq: restore reset gpio polarity
+    - ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right mclk
+    - ASoC: mediatek: mt8183-da7219-max98357: Fix kcontrol name collision
+    - ASoC: atmel: atmel-classd: Re-add dai_link->platform to fix card init
+    - workqueue: Increase worker desc's length to 32
+    - ASoC: q6apm-lpass-dai: close graph on prepare errors
+    - bpf: Add missed var_off setting in set_sext32_default_val()
+    - bpf: Add missed var_off setting in coerce_subreg_to_size_sx()
+    - s390/pci: Add missing virt_to_phys() for directed DIBV
+    - ASoC: amd: acp: add a null check for chip_pdev structure
+    - ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
+    - ASoC: fsl-asoc-card: set priv->pdev before using it
+    - net: dsa: microchip: fix initial port flush problem
+    - openvswitch: get related ct labels from its master if it is not confirmed
+    - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
+    - ibmvnic: Free any outstanding tx skbs during scrq reset
+    - net: phy: micrel: add Microchip KSZ 9477 to the device table
+    - net: dsa: microchip: use collision based back pressure mode
+    - ice: Rebuild TC queues on VSI queue reconfiguration
+    - xdp: Remove WARN() from __xdp_reg_mem_model()
+    - netfilter: fix undefined reference to 'netfilter_lwtunnel_*' when
+      CONFIG_SYSCTL=n
+    - btrfs: use NOFS context when getting inodes during logging and log replay
+    - Fix race for duplicate reqsk on identical SYN
+    - ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2 messages
+    - net: dsa: microchip: fix wrong register write when masking interrupt
+    - sparc: fix old compat_sys_select()
+    - sparc: fix compat recv/recvfrom syscalls
+    - parisc: use correct compat recv/recvfrom syscalls
+    - powerpc: restore some missing spu syscalls
+    - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
+    - ALSA: seq: Fix missing MSB in MIDI2 SPP conversion
+    - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data
+      registers
+    - net: mana: Fix possible double free in error handling path
+    - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
+    - vduse: validate block features only with block devices
+    - vduse: Temporarily fail if control queue feature requested
+    - x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
+    - mtd: partitions: redboot: Added conversion of operands to a larger type
+    - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
+    - bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
+    - RDMA/restrack: Fix potential invalid address access
+    - net/iucv: Avoid explicit cpumask var allocation on stack
+    - net/dpaa2: Avoid explicit cpumask var allocation on stack
+    - crypto: ecdh - explicitly zeroize private_key
+    - ALSA: emux: improve patch ioctl data validation
+    - media: dvbdev: Initialize sbuf
+    - irqchip/loongson: Select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP for
+      IRQ_LOONGARCH_CPU
+    - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
+    - gfs2: Fix NULL pointer dereference in gfs2_log_flush
+    - drm/radeon/radeon_display: Decrease the size of allocated memory
+    - nvme: fixup comment for nvme RDMA Provider Type
+    - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
+    - gpio: davinci: Validate the obtained number of IRQs
+    - RISC-V: fix vector insn load/store width mask
+    - drm/amdgpu: Fix pci state save during mode-1 reset
+    - riscv: stacktrace: convert arch_stack_walk() to noinstr
+    - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
+    - randomize_kstack: Remove non-functional per-arch entropy filtering
+    - x86: stop playing stack games in profile_pc()
+    - parisc: use generic sys_fanotify_mark implementation
+    - Revert "MIPS: pci: lantiq: restore reset gpio polarity"
+    - pinctrl: qcom: spmi-gpio: drop broken pm8008 support
+    - ocfs2: fix DIO failure due to insufficient transaction credits
+    - nfs: drop the incorrect assertion in nfs_swap_rw()
+    - mm: fix incorrect vbq reference in purge_fragmented_block
+    - mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos
+    - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
+    - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
+    - mmc: sdhci: Do not invert write-protect twice
+    - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
+    - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
+    - counter: ti-eqep: enable clock at probe
+    - kbuild: doc: Update default INSTALL_MOD_DIR from extra to updates
+    - kbuild: Fix build target deb-pkg: ln: failed to create hard link
+    - i2c: testunit: don't erase registers after STOP
+    - i2c: testunit: discard write requests while old command is running
+    - ata: libata-core: Fix null pointer dereference on error
+    - ata,scsi: libata-core: Do not leak memory for ata_port struct members
+    - iio: adc: ad7266: Fix variable checking bug
+    - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
+    - iio: chemical: bme680: Fix pressure value output
+    - iio: chemical: bme680: Fix calibration data variable
+    - iio: chemical: bme680: Fix overflows in compensate() functions
+    - iio: chemical: bme680: Fix sensor data read operation
+    - net: usb: ax88179_178a: improve link status logs
+    - usb: gadget: printer: SS+ support
+    - usb: gadget: printer: fix races against disable
+    - usb: musb: da8xx: fix a resource leak in probe()
+    - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
+    - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to
+      avoid deadlock
+    - usb: gadget: aspeed_udc: fix device address configuration
+    - usb: typec: ucsi: glink: fix child node release in probe function
+    - usb: ucsi: stm32: fix command completion handling
+    - usb: dwc3: core: Add DWC31 version 2.00a controller
+    - usb: dwc3: core: Workaround for CSR read timeout
+    - Revert "serial: core: only stop transmit when HW fifo is empty"
+    - serial: 8250_omap: Implementation of Errata i2310
+    - serial: imx: set receiver level before starting uart
+    - serial: core: introduce uart_port_tx_limited_flags()
+    - serial: bcm63xx-uart: fix tx after conversion to uart_port_tx_limited()
+    - tty: mcf: MCF54418 has 10 UARTS
+    - net: can: j1939: Initialize unused data in j1939_send_one()
+    - net: can: j1939: recover socket queue on CAN bus error during BAM
+      transmission
+    - net: can: j1939: enhanced error handling for tightly received RTS messages
+      in xtp_rx_rts_session_new
+    - PCI/MSI: Fix UAF in msi_capability_init
+    - cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
+    - irqchip/loongson-eiointc: Use early_cpu_to_node() instead of cpu_to_node()
+    - cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
+    - irqchip/loongson-liointc: Set different ISRs for different cores
+    - kbuild: Install dtb files as 0644 in Makefile.dtbinst
+    - sh: rework sync_file_range ABI
+    - btrfs: zoned: fix initial free space detection
+    - csky, hexagon: fix broken sys_sync_file_range
+    - hexagon: fix fadvise64_64 calling conventions
+    - drm/drm_file: Fix pid refcounting race
+    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
+    - drm/fbdev-dma: Only set smem_start is enable per module option
+    - drm/amdgpu: avoid using null object of framebuffer
+    - drm/i915/gt: Fix potential UAF by revoke of fence registers
+    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
+    - drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if LTTPR is
+      present
+    - drm/amdgpu/atomfirmware: fix parsing of vram_info
+    - batman-adv: Don't accept TT entries for out-of-spec VIDs
+    - can: mcp251xfd: fix infinite loop when xmit fails
+    - ata: ahci: Clean up sysfs file on error
+    - ata: libata-core: Fix double free on error
+    - ftruncate: pass a signed offset
+    - syscalls: fix compat_sys_io_pgetevents_time64 usage
+    - syscalls: fix sys_fanotify_mark prototype
+    - Revert "cpufreq: amd-pstate: Fix the inconsistency in max frequency units"
+    - mm/page_alloc: Separate THP PCP into movable and non-movable categories
+    - arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s
+    - arm64: dts: rockchip: Rename LED related pinctrl nodes on rk3308-rock-pi-s
+    - arm64: dts: rockchip: Fix the value of `dlg,jack-det-rate` mismatch on
+      rk3399-gru
+    - ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node
+    - arm64: dts: rockchip: make poweroff(8) work on Radxa ROCK 5A
+    - arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E
+    - arm64: dts: rockchip: Add sound-dai-cells for RK3368
+    - cxl/region: Move cxl_dpa_to_region() work to the region driver
+    - cxl/region: Avoid null pointer dereference in region lookup
+    - cxl/region: check interleave capability
+    - serial: imx: only set receiver level if it is zero
+    - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
+    - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
+    - pwm: stm32: Improve precision of calculation in .apply()
+    - pwm: stm32: Fix for settings using period > UINT32_MAX
+    - pwm: stm32: Calculate prescaler with a division instead of a loop
+    - pwm: stm32: Refuse too small period requests
+    - ASoC: cs42l43: Increase default type detect time and button delay
+    - ASoC: amd: acp: move chip->flag variable assignment
+    - bonding: fix incorrect software timestamping report
+    - mlxsw: pci: Fix driver initialization with Spectrum-4
+    - vxlan: Pull inner IP header in vxlan_xmit_one().
+    - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link
+    - af_unix: Stop recv(MSG_PEEK) at consumed OOB skb.
+    - af_unix: Don't stop recv(MSG_DONTWAIT) if consumed OOB skb is at the head.
+    - af_unix: Don't stop recv() at consumed ex-OOB skb.
+    - af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.
+    - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
+    - bpf: Take return from set_memory_rox() into account with
+      bpf_jit_binary_lock_ro()
+    - drm/xe: Fix potential integer overflow in page size calculation
+    - drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init
+    - drm/amd/display: correct hostvm flag
+    - drm/amd/display: Skip pipe if the pipe idx not set properly
+    - bpf: Add a check for struct bpf_fib_lookup size
+    - drm/xe/xe_devcoredump: Check NULL before assignments
+    - iommu/arm-smmu-v3: Do not allow a SVA domain to be set on the wrong PASID
+    - evm: Enforce signatures on unsupported filesystem for EVM_INIT_X509
+    - drm/xe: Check pat.ops before dumping PAT settings
+    - nvmet: do not return 'reserved' for empty TSAS values
+    - nvmet: make 'tsas' attribute idempotent for RDMA
+    - iommu/amd: Fix GT feature enablement again
+    - gpiolib: cdev: Ignore reconfiguration without direction
+    - kasan: fix bad call to unpoison_slab_object
+    - mm/memory: don't require head page for do_set_pmd()
+    - SUNRPC: Fix backchannel reply, again
+    - Revert "usb: gadget: u_ether: Re-attach netif device to mirror detachment"
+    - Revert "usb: gadget: u_ether: Replace netif_stop_queue with
+      netif_device_detach"
+    - tty: serial: 8250: Fix port count mismatch with the device
+    - tty: mxser: Remove __counted_by from mxser_board.ports[]
+    - nvmet-fc: Remove __counted_by from nvmet_fc_tgt_queue.fod[]
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for all Crucial BX SSD1 models
+    - bcachefs: Fix sb_field_downgrade validation
+    - bcachefs: Fix sb-downgrade validation
+    - bcachefs: Fix bch2_sb_downgrade_update()
+    - bcachefs: Fix setting of downgrade recovery passes/errors
+    - bcachefs: btree_gc can now handle unknown btrees
+    - pwm: stm32: Fix calculation of prescaler
+    - pwm: stm32: Fix error message to not describe the previous error path
+    - cxl/region: Convert cxl_pmem_region_alloc to scope-based resource management
+    - cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
+    - arm64: dts: rockchip: Fix the i2c address of es8316 on Cool Pi 4B
+    - netfs: Fix netfs_page_mkwrite() to check folio->mapping is valid
+    - netfs: Fix netfs_page_mkwrite() to flush conflicting data, not wait
+    - Upstream stable to v6.6.37, v6.9.8
+  * [UBUNTU 22.04] s390/cpum_cf: make crypto counters upward compatible
+    (LP: #2074380)
+    - s390/cpum_cf: make crypto counters upward compatible across machine types
+  * CVE-2024-45016
+    - netem: fix return value if duplicate enqueue fails
+
+  [ Ubuntu: 6.8.0-45.45 ]
+
+  * noble/linux: 6.8.0-45.45 -proposed tracker (LP: #2078100)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/s2024.08.05)
+  * Noble update: upstream stable patchset 2024-08-09 (LP: #2076435) //
+    CVE-2024-41009
+    - bpf: Fix overrunning reservations in ringbuf
+  * CVE-2024-42160
+    - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
+    - f2fs: Add inline to f2fs_build_fault_attr() stub
+  * Noble update: upstream stable patchset 2024-08-22 (LP: #2077600) //
+    CVE-2024-42224
+    - net: dsa: mv88e6xxx: Correct check for empty list
+  * Noble update: upstream stable patchset 2024-08-22 (LP: #2077600) //
+    CVE-2024-42154
+    - tcp_metrics: validate source addr length
+  * CVE-2024-42228
+    - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
+  * CVE-2024-42159
+    - scsi: mpi3mr: Sanitise num_phys
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 03 Oct 2024 23:24:01 +0900
+
+linux-qcom (6.8.0-1010.10) jammy; urgency=medium
+
+  * jammy/linux-qcom: 6.8.0-1010.10 -proposed tracker (LP: #2081038)
+
+  * Disable PCI_DYNAMIC_OF_NODES in Ubuntu (LP: #2074376)
+    - [Config] Disable PCI_DYNAMIC_OF_NODES
+
+  * Reenable CONFIG_UBSAN for noble (LP: #2076650)
+    - [Config] Remove CONFIG_UBSAN_SANITIZE_ALL
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update update.conf
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] create linux-libc-dev-qcom package
+    - SAUCE: rdbg: include <linux/platform_device.h>
+    - SAUCE: add empty dkms-versions
+
+  * Miscellaneous upstream changes
+    - Ubuntu: [Config] enable more CONFIG options based on GA 1.1
+
+  [ Ubuntu: 6.8.0-44.44 ]
+
+  * noble/linux: 6.8.0-44.44 -proposed tracker (LP: #2076647)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.08.05)
+  * Disable PCI_DYNAMIC_OF_NODES in Ubuntu (LP: #2074376)
+    - [Config] Disable PCI_DYNAMIC_OF_NODES
+  * [SRU] Turbostat support for Arrow Lake H (LP: #2074372)
+    - tools/power turbostat: Enhance ARL/LNL support
+    - x86/cpu: Add model number for another Intel Arrow Lake mobile processor
+    - tools/power turbostat: Add ARL-H support
+  * Noble update: upstream stable patchset 2024-07-30 (LP: #2075154)
+    - fs/writeback: bail out if there is no more inodes for IO and queued once
+    - padata: Disable BH when taking works lock on MT path
+    - crypto: hisilicon/sec - Fix memory leak for sec resource release
+    - crypto: hisilicon/qm - Add the err memory release process to qm uninit
+    - io_uring/sqpoll: work around a potential audit memory leak
+    - rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
+    - rcutorture: Make stall-tasks directly exit when rcutorture tests end
+    - rcutorture: Fix invalid context warning when enable srcu barrier testing
+    - block/ioctl: prefer different overflow check
+    - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
+    - selftests/bpf: Prevent client connect before server bind in
+      test_tc_tunnel.sh
+    - selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
+    - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
+    - wifi: ath9k: work around memset overflow warning
+    - af_packet: avoid a false positive warning in packet_setsockopt()
+    - ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
+    - drop_monitor: replace spin_lock by raw_spin_lock
+    - scsi: qedi: Fix crash while reading debugfs attribute
+    - net: sfp: add quirk for ATS SFP-GE-T 1000Base-TX module
+    - net/sched: fix false lockdep warning on qdisc root lock
+    - kselftest: arm64: Add a null pointer check
+    - net: dsa: realtek: keep default LED state in rtl8366rb
+    - netpoll: Fix race condition in netpoll_owner_active
+    - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
+    - HID: Add quirk for Logitech Casa touchpad
+    - HID: asus: fix more n-key report descriptors if n-key quirked
+    - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
+    - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
+    - drm/amd/display: Exit idle optimizations before HDCP execution
+    - platform/x86: toshiba_acpi: Add quirk for buttons on Z830
+    - ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
+    - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F
+    - drm/lima: add mask irq callback to gp and pp
+    - drm/lima: mask irqs in timeout path before hard reset
+    - ALSA: hda/realtek: Add quirks for Lenovo 13X
+    - powerpc/pseries: Enforce hcall result buffer validity and size
+    - media: intel/ipu6: Fix build with !ACPI
+    - media: mtk-vcodec: potential null pointer deference in SCP
+    - powerpc/io: Avoid clang null pointer arithmetic warnings
+    - platform/x86: p2sb: Don't init until unassigned resources have been assigned
+    - power: supply: cros_usbpd: provide ID table for avoiding fallback match
+    - iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
+    - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
+    - kprobe/ftrace: bail out if ftrace was killed
+    - usb: gadget: uvc: configfs: ensure guid to be valid before set
+    - f2fs: remove clear SB_INLINECRYPT flag in default_options
+    - usb: misc: uss720: check for incompatible versions of the Belkin F5U002
+    - Avoid hw_desc array overrun in dw-axi-dmac
+    - usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on Lenovo Yoga
+      Tab2 1380
+    - usb: typec: ucsi_glink: drop special handling for CCI_BUSY
+    - udf: udftime: prevent overflow in udf_disk_stamp_to_time()
+    - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
+    - f2fs: don't set RO when shutting down f2fs
+    - MIPS: Octeon: Add PCIe link status check
+    - serial: imx: Introduce timeout when waiting on transmitter empty
+    - serial: exar: adding missing CTI and Exar PCI ids
+    - usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
+    - tty: add the option to have a tty reject a new ldisc
+    - vfio/pci: Collect hot-reset devices to local buffer
+    - cpufreq: amd-pstate: fix memory leak on CPU EPP exit
+    - ACPI: EC: Install address space handler at the namespace root
+    - PCI: Do not wait for disconnected devices when resuming
+    - ALSA: hda: cs35l41: Possible null pointer dereference in
+      cs35l41_hda_unbind()
+    - ALSA: seq: ump: Fix missing System Reset message handling
+    - MIPS: Routerboard 532: Fix vendor retry check code
+    - mips: bmips: BCM6358: make sure CBR is correctly set
+    - tracing: Build event generation tests only as modules
+    - ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
+    - ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
+    - ice: avoid IRQ collision to fix init failure on ACPI S3 resume
+    - btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
+    - net: mvpp2: use slab_build_skb for oversized frames
+    - cipso: fix total option length computation
+    - ALSA: hda: cs35l56: Component should be unbound before deconstruction
+    - ALSA: hda: tas2781: Component should be unbound before deconstruction
+    - bpf: Avoid splat in pskb_pull_reason
+    - ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
+    - netrom: Fix a memory leak in nr_heartbeat_expiry()
+    - ipv6: prevent possible NULL deref in fib6_nh_init()
+    - ipv6: prevent possible NULL dereference in rt6_probe()
+    - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
+    - netns: Make get_net_ns() handle zero refcount net
+    - qca_spi: Make interrupt remembering atomic
+    - net: lan743x: disable WOL upon resume to restore full data path operation
+    - net: lan743x: Support WOL at both the PHY and MAC appropriately
+    - net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
+    - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
+    - tipc: force a dst refcount before doing decryption
+    - sched: act_ct: add netns into the key of tcf_ct_flow_table
+    - ptp: fix integer overflow in max_vclocks_store
+    - selftests: openvswitch: Use bash as interpreter
+    - net: stmmac: No need to calculate speed divider when offload is disabled
+    - virtio_net: checksum offloading handling fix
+    - virtio_net: fixing XDP for fully checksummed packets handling
+    - octeontx2-pf: Add error handling to VLAN unoffload handling
+    - octeontx2-pf: Fix linking objects into multiple modules
+    - netfilter: ipset: Fix suspicious rcu_dereference_protected()
+    - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6
+      behaviors
+    - netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core
+    - ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
+    - bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
+    - net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
+    - RDMA/bnxt_re: Fix the max msix vectors macro
+    - spi: cs42l43: Correct SPI root clock speed
+    - RDMA/rxe: Fix responder length checking for UD request packets
+    - regulator: core: Fix modpost error "regulator_get_regmap" undefined
+    - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
+    - dmaengine: ioatdma: Fix leaking on version mismatch
+    - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
+    - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
+    - dmaengine: fsl-edma: avoid linking both modules
+    - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
+    - regulator: bd71815: fix ramp values
+    - thermal/drivers/mediatek/lvts_thermal: Return error in case of invalid efuse
+      data
+    - arm64: dts: imx8mp: Fix TC9595 input clock on DH i.MX8M Plus DHCOM SoM
+    - arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix BT shutdown GPIO
+    - arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property
+    - arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
+    - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is
+      fine."
+    - spi: spi-imx: imx51: revert burst length calculation back to bits_per_word
+    - io_uring/rsrc: fix incorrect assignment of iter->nr_segs in io_import_fixed
+    - firmware: psci: Fix return value from psci_system_suspend()
+    - RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init
+    - RDMA/mlx5: Add check for srq max_sge attribute
+    - RDMA/mana_ib: Ignore optional access flags for MRs
+    - ACPI: EC: Evaluate orphan _REG under EC device
+    - arm64: defconfig: enable the vf610 gpio driver
+    - ext4: avoid overflow when setting values via sysfs
+    - ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
+    - net: stmmac: Assign configured channel value to EXTTS event
+    - net: usb: ax88179_178a: improve reset check
+    - net: do not leave a dangling sk pointer, when socket creation fails
+    - btrfs: retry block group reclaim without infinite loop
+    - scsi: ufs: core: Free memory allocated for model before reinit
+    - cifs: fix typo in module parameter enable_gcm_256
+    - LoongArch: Fix watchpoint setting error
+    - LoongArch: Trigger user-space watchpoints correctly
+    - LoongArch: Fix multiple hardware watchpoint issues
+    - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
+    - KVM: arm64: Disassociate vcpus from redistributor region on teardown
+    - KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
+    - RDMA/rxe: Fix data copy for IB_SEND_INLINE
+    - RDMA/mlx5: Remove extra unlock on error path
+    - RDMA/mlx5: Follow rb_key.ats when creating new mkeys
+    - ovl: fix encoding fid for lower only root
+    - ALSA: hda/realtek: Limit mic boost on N14AP7
+    - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9
+    - drm/i915/mso: using joiner is not possible with eDP MSO
+    - drm/radeon: fix UBSAN warning in kv_dpm.c
+    - drm/amdgpu: fix UBSAN warning in kv_dpm.c
+    - dt-bindings: dma: fsl-edma: fix dma-channels constraints
+    - ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()
+    - ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
+    - gcov: add support for GCC 14
+    - kcov: don't lose track of remote references during softirqs
+    - efi/x86: Free EFI memory map only when installing a new one.
+    - serial: 8250_dw: Revert "Move definitions to the shared header"
+    - mm: mmap: allow for the maximum number of bits for randomizing mmap_base by
+      default
+    - tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
+    - mm/page_table_check: fix crash on ZONE_DEVICE
+    - i2c: ocores: set IACK bit after core is enabled
+    - dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema
+    - dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller
+      schema
+    - spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup()
+    - arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
+    - spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4
+    - perf: script: add raw|disasm arguments to --insn-trace option
+    - nbd: Improve the documentation of the locking assumptions
+    - nbd: Fix signal handling
+    - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
+    - x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
+    - x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
+    - drm/amd/display: revert Exit idle optimizations before HDCP execution
+    - ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk
+    - net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path
+    - kprobe/ftrace: fix build error due to bad function definition
+    - hid: asus: asus_report_fixup: fix potential read out of bounds
+    - Revert "mm: mmap: allow for the maximum number of bits for randomizing
+      mmap_base by default"
+    - platform/chrome: cros_usbpd_logger: provide ID table for avoiding fallback
+      match
+    - platform/chrome: cros_usbpd_notify: provide ID table for avoiding fallback
+      match
+    - ubsan: Avoid i386 UBSAN handler crashes with Clang
+    - arm64: defconfig: select INTERCONNECT_QCOM_SM6115 as built-in
+    - bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.
+    - devlink: use kvzalloc() to allocate devlink instance resources
+    - wifi: rtw89: 8852c: add quirk to set PCI BER for certain platforms
+    - clocksource: Make watchdog and suspend-timing multiplication overflow safe
+    - ACPI: resource: Do IRQ override on GMxBGxx (XMG APEX 17 M23)
+    - wifi: ath12k: add string type to search board data in board-2.bin for
+      WCN7850
+    - wifi: ath12k: add firmware-2.bin support
+    - wifi: ath12k: fix kernel crash during resume
+    - arm64/sysreg: Update PIE permission encodings
+    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MV
+    - wifi: ath12k: fix the problem that down grade phy mode operation
+    - bpf: avoid uninitialized warnings in verifier_global_subprogs.c
+    - selftests: net: fix timestamp not arriving in cmsg_time.sh
+    - net: ena: Add validation for completion descriptors consistency
+    - drm/amd/display: Workaround register access in idle race with cursor
+    - cgroup/cpuset: Make cpuset hotplug processing synchronous
+    - platform/x86: x86-android-tablets: Unregister devices in reverse order
+    - platform/x86: x86-android-tablets: Add Lenovo Yoga Tablet 2 Pro 1380F/L data
+    - ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41
+    - ext4: fold quota accounting into ext4_xattr_inode_lookup_create()
+    - ext4: do not create EA inode under buffer lock
+    - f2fs: fix to detect inconsistent nat entry during truncation
+    - usb: typec: ucsi_glink: rework quirks implementation
+    - xhci: remove XHCI_TRUST_TX_LENGTH quirk
+    - clk: Add a devm variant of clk_rate_exclusive_get()
+    - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
+    - i2c: lpi2c: Avoid calling clk_get_rate during transfer
+    - cxl: Add post-reset warning if reset results in loss of previously committed
+      HDM decoders
+    - OPP: Fix required_opp_tables for multiple genpds using same table
+    - wifi: iwlwifi: mvm: fix ROC version check
+    - wifi: mac80211: Recalc offload when monitor stop
+    - ice: fix 200G link speed message log
+    - ice: implement AQ download pkg retry
+    - bpf: Fix reg_set_min_max corruption of fake_reg
+    - ALSA: hda: cs35l41: Component should be unbound before deconstruction
+    - netdev-genl: fix error codes when outputting XDP features
+    - arm64: dts: freescale: imx8mm-verdin: Fix GPU speed
+    - phy: qcom-qmp: qserdes-txrx: Add missing registers offsets
+    - phy: qcom-qmp: pcs: Add missing v6 N4 register offsets
+    - phy: qcom: qmp-combo: Switch from V6 to V6 N4 register offsets
+    - powerpc/crypto: Add generated P8 asm to .gitignore
+    - spi: Exctract spi_dev_check_cs() helper
+    - spi: Fix SPI slave probe failure
+    - net: phy: dp83tg720: wake up PHYs in managed mode
+    - net: phy: dp83tg720: get master/slave configuration in link down state
+    - RDMA/mlx5: Ensure created mkeys always have a populated rb_key
+    - drm/amdgpu: fix locking scope when flushing tlb
+    - drm/amd/display: Remove redundant idle optimization check
+    - drm/amd/display: Attempt to avoid empty TUs when endpoint is DPIA
+    - ata: ahci: Do not enable LPM if no LPM states are supported by the HBA
+    - dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()
+    - net/tcp_ao: Don't leak ao_info on error-path
+    - mm: shmem: fix getting incorrect lruvec when replacing a shmem folio
+    - selftests: mptcp: print_test out of verify_listener_events
+    - selftests: mptcp: userspace_pm: fixed subtest names
+    - ima: Avoid blocking in RCU read-side critical section
+    - virt: guest_memfd: fix reference leak on hwpoisoned page
+    - thermal: int340x: processor_thermal: Support shared interrupts
+    - thermal: core: Change PM notifier priority to the minimum
+    - wifi: ath12k: check M3 buffer size as well whey trying to reuse it
+    - Upstream stable to v6.6.36, v6.9.7
+  * [SRU] Add Dynamic Tuning Technology (DTT)  support for Lunar Lake
+    (LP: #2073961)
+    - thermal: int340x: processor_thermal: Add Lunar Lake-M PCI ID
+  * Kubuntu 24.04 freezes after plugging in ethernet cable (LP: #2073358)
+    - e1000e: move force SMBUS near the end of enable_ulp function
+    - e1000e: fix force smbus during suspend flow
+  * Noble update: upstream stable patchset 2024-07-25 (LP: #2074091)
+    - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
+    - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
+    - wifi: cfg80211: fully move wiphy work to unbound workqueue
+    - wifi: cfg80211: Lock wiphy in cfg80211_get_station
+    - wifi: cfg80211: pmsr: use correct nla_get_uX functions
+    - wifi: iwlwifi: mvm: don't initialize csa_work twice
+    - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
+    - wifi: iwlwifi: mvm: set properly mac header
+    - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
+    - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
+    - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
+    - wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
+    - scsi: ufs: mcq: Fix error output and clean up ufshcd_mcq_abort()
+    - RISC-V: KVM: No need to use mask when hart-index-bit is 0
+    - RISC-V: KVM: Fix incorrect reg_subtype labels in
+      kvm_riscv_vcpu_set_reg_isa_ext function
+    - ax25: Fix refcount imbalance on inbound connections
+    - ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()
+    - net/ncsi: Fix the multi thread manner of NCSI driver
+    - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume
+    - bpf: Fix a potential use-after-free in bpf_link_free()
+    - KVM: SEV-ES: Disallow SEV-ES guests when X86_FEATURE_LBRV is absent
+    - KVM: SEV-ES: Delegate LBR virtualization to the processor
+    - vmxnet3: disable rx data ring on dma allocation failure
+    - ipv6: ioam: block BH from ioam6_output()
+    - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
+    - net: tls: fix marking packets as decrypted
+    - bpf: Set run context for rawtp test_run callback
+    - octeontx2-af: Always allocate PF entries from low prioriy zone
+    - net/smc: avoid overwriting when adjusting sock bufsizes
+    - net: phy: Micrel KSZ8061: fix errata solution not taking effect problem
+    - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
+    - vxlan: Fix regression when dropping packets due to invalid src addresses
+    - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
+    - mptcp: count CLOSE-WAIT sockets for MPTCP_MIB_CURRESTAB
+    - net/mlx5: Stop waiting for PCI if pci channel is offline
+    - net/mlx5: Always stop health timer during driver removal
+    - net/mlx5: Fix tainted pointer delete is case of flow rules creation fail
+    - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
+    - ptp: Fix error message on failed pin verification
+    - ice: fix iteration of TLVs in Preserved Fields Area
+    - ice: remove af_xdp_zc_qps bitmap
+    - ice: add flag to distinguish reset from .ndo_bpf in XDP rings config
+    - net: wwan: iosm: Fix tainted pointer delete is case of region creation fail
+    - af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted
+      peer.
+    - af_unix: Annodate data-races around sk->sk_state for writers.
+    - af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
+    - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and
+      poll().
+    - af_unix: Annotate data-race of sk->sk_state in unix_stream_connect().
+    - af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
+    - af_unix: Annotate data-race of sk->sk_state in unix_stream_read_skb().
+    - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
+    - af_unix: Annotate data-races around sk->sk_sndbuf.
+    - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
+    - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
+    - af_unix: Use skb_queue_empty_lockless() in unix_release_sock().
+    - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
+    - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
+    - ipv6: fix possible race in __fib6_drop_pcpu_from()
+    - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
+    - selftests/mm: log a consistent test name for check_compaction
+    - irqchip/riscv-intc: Allow large non-standard interrupt number
+    - irqchip/riscv-intc: Introduce Andes hart-level interrupt controller
+    - eventfs: Update all the eventfs_inodes from the events descriptor
+    - io_uring/rsrc: don't lock while !TASK_RUNNING
+    - io_uring: check for non-NULL file pointer in io_file_can_poll()
+    - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
+    - USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected
+    - usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps
+    - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
+    - mei: me: release irq in mei_me_pci_resume error path
+    - tty: n_tty: Fix buffer offsets when lookahead is used
+    - serial: port: Don't block system suspend even if bytes are left to xmit
+    - landlock: Fix d_parent walk
+    - jfs: xattr: fix buffer overflow for invalid xattr
+    - xhci: Set correct transferred length for cancelled bulk transfers
+    - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
+    - xhci: Handle TD clearing for multiple streams case
+    - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
+    - thunderbolt: debugfs: Fix margin debugfs node creation condition
+    - scsi: core: Disable CDL by default
+    - scsi: mpi3mr: Fix ATA NCQ priority support
+    - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
+    - scsi: sd: Use READ(16) when reading block zero on large capacity disks
+    - gve: Clear napi->skb before dev_kfree_skb_any()
+    - powerpc/uaccess: Fix build errors seen with GCC 13/14
+    - HID: nvidia-shield: Add missing check for input_ff_create_memless
+    - cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c
+    - cxl/region: Fix memregion leaks in devm_cxl_add_region()
+    - cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd
+    - cachefiles: remove requests from xarray during flushing requests
+    - cachefiles: add spin_lock for cachefiles_ondemand_info
+    - cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()
+    - cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
+    - cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read()
+    - cachefiles: never get a new anonymous fd if ondemand_id is valid
+    - cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
+    - cachefiles: flush all requests after setting CACHEFILES_DEAD
+    - selftests/ftrace: Fix to check required event file
+    - clk: sifive: Do not register clkdevs for PRCI clocks
+    - NFSv4.1 enforce rootpath check in fs_location query
+    - SUNRPC: return proper error from gss_wrap_req_priv
+    - NFS: add barriers when testing for NFS_FSDATA_BLOCKED
+    - selftests/tracing: Fix event filter test to retry up to 10 times
+    - nvme: fix nvme_pr_* status code parsing
+    - drm/panel: sitronix-st7789v: Add check for of_drm_get_panel_orientation
+    - platform/x86: dell-smbios: Fix wrong token data in sysfs
+    - gpio: tqmx86: fix typo in Kconfig label
+    - gpio: tqmx86: introduce shadow register for GPIO output value
+    - gpio: tqmx86: store IRQ trigger type and unmask status separately
+    - gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type
+    - HID: core: remove unnecessary WARN_ON() in implement()
+    - iommu/amd: Fix sysfs leak in iommu init
+    - iommu: Return right value in iommu_sva_bind_device()
+    - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
+    - io_uring/io-wq: avoid garbage value of 'match' in io_wq_enqueue()
+    - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
+    - drm/vmwgfx: Refactor drm connector probing for display modes
+    - drm/vmwgfx: Filter modes which exceed graphics memory
+    - drm/vmwgfx: 3D disabled should not effect STDU memory limits
+    - drm/vmwgfx: Remove STDU logic from generic mode_valid function
+    - drm/vmwgfx: Don't memcmp equivalent pointers
+    - af_unix: Annotate data-race of sk->sk_state in unix_accept().
+    - modpost: do not warn about missing MODULE_DESCRIPTION() for vmlinux.o
+    - net: sfp: Always call `sfp_sm_mod_remove()` on remove
+    - net: hns3: fix kernel crash problem in concurrent scenario
+    - net: hns3: add cond_resched() to hns3 ring buffer init process
+    - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
+    - net: stmmac: dwmac-qcom-ethqos: Configure host DMA width
+    - drm/komeda: check for error-valued pointer
+    - drm/bridge/panel: Fix runtime warning on panel bridge release
+    - tcp: fix race in tcp_v6_syn_recv_sock()
+    - net dsa: qca8k: fix usages of device_get_named_child_node()
+    - geneve: Fix incorrect inner network header offset when innerprotoinherit is
+      set
+    - net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN)
+      packets
+    - Bluetooth: fix connection setup in l2cap_connect
+    - netfilter: nft_inner: validate mandatory meta and payload
+    - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set
+      type
+    - x86/asm: Use %c/%n instead of %P operand modifier in asm templates
+    - x86/uaccess: Fix missed zeroing of ia32 u64 get_user() range checking
+    - scsi: ufs: core: Quiesce request queues before checking pending cmds
+    - net: pse-pd: Use EOPNOTSUPP error code instead of ENOTSUPP
+    - gve: ignore nonrelevant GSO type bits when processing TSO headers
+    - net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs
+      parameters
+    - block: sed-opal: avoid possible wrong address reference in
+      read_sed_opal_key()
+    - block: fix request.queuelist usage in flush
+    - nvmet-passthru: propagate status from id override functions
+    - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
+    - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
+    - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
+    - ionic: fix use after netif_napi_del()
+    - af_unix: Read with MSG_PEEK loops if the first unread byte is OOB
+    - bnxt_en: Adjust logging of firmware messages in case of released token in
+      __hwrm_send()
+    - misc: microchip: pci1xxxx: fix double free in the error handling of
+      gp_aux_bus_probe()
+    - ksmbd: move leading slash check to smb2_get_name()
+    - ksmbd: fix missing use of get_write in in smb2_set_ea()
+    - x86/boot: Don't add the EFI stub to targets, again
+    - iio: adc: ad9467: fix scan type sign
+    - iio: dac: ad5592r: fix temperature channel scaling value
+    - iio: invensense: fix odr switching to same value
+    - iio: imu: inv_icm42600: delete unneeded update watermark call
+    - drivers: core: synchronize really_probe() and dev_uevent()
+    - parisc: Try to fix random segmentation faults in package builds
+    - ACPI: x86: Force StorageD3Enable on more products
+    - drm/exynos/vidi: fix memory leak in .get_modes()
+    - drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
+    - mptcp: ensure snd_una is properly initialized on connect
+    - mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
+    - mptcp: pm: update add_addr counters after connect
+    - clkdev: Update clkdev id usage to allow for longer names
+    - irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
+    - x86/kexec: Fix bug with call depth tracking
+    - x86/amd_nb: Check for invalid SMN reads
+    - perf/core: Fix missing wakeup when waiting for context reference
+    - perf auxtrace: Fix multiple use of --itrace option
+    - riscv: fix overlap of allocated page and PTR_ERR
+    - tracing/selftests: Fix kprobe event name test for .isra. functions
+    - kheaders: explicitly define file modes for archived headers
+    - null_blk: Print correct max open zones limit in null_init_zoned_dev()
+    - sock_map: avoid race between sock_map_close and sk_psock_put
+    - dma-buf: handle testing kthreads creation failure
+    - vmci: prevent speculation leaks by sanitizing event in event_deliver()
+    - spmi: hisi-spmi-controller: Do not override device identifier
+    - knfsd: LOOKUP can return an illegal error value
+    - fs/proc: fix softlockup in __read_vmcore
+    - ocfs2: use coarse time for new created files
+    - ocfs2: fix races between hole punching and AIO+DIO
+    - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
+    - dmaengine: axi-dmac: fix possible race in remove()
+    - remoteproc: k3-r5: Wait for core0 power-up before powering up core1
+    - remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs
+    - iio: adc: axi-adc: make sure AXI clock is enabled
+    - iio: invensense: fix interrupt timestamp alignment
+    - riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
+    - rtla/timerlat: Simplify "no value" printing on top
+    - rtla/auto-analysis: Replace \t with spaces
+    - drm/i915/gt: Disarm breadcrumbs if engines are already idle
+    - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
+    - drm/i915/dpt: Make DPT object unshrinkable
+    - drm/i915: Fix audio component initialization
+    - intel_th: pci: Add Meteor Lake-S support
+    - pmdomain: ti-sci: Fix duplicate PD referrals
+    - btrfs: zoned: fix use-after-free due to race with dev replace
+    - xfs: fix imprecise logic in xchk_btree_check_block_owner
+    - xfs: fix scrub stats file permissions
+    - xfs: fix SEEK_HOLE/DATA for regions with active COW extents
+    - xfs: shrink failure needs to hold AGI buffer
+    - xfs: ensure submit buffers on LSN boundaries in error handlers
+    - xfs: allow sunit mount option to repair bad primary sb stripe values
+    - xfs: don't use current->journal_info
+    - xfs: allow cross-linking special files without project quota
+    - swiotlb: Enforce page alignment in swiotlb_alloc()
+    - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE
+    - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary
+    - tick/nohz_full: Don't abuse smp_call_function_single() in
+      tick_setup_device()
+    - mm/huge_memory: don't unpoison huge_zero_folio
+    - serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
+    - Revert "fork: defer linking file vma until vma is fully initialized"
+    - remoteproc: k3-r5: Jump to error handling labels in start/stop errors
+    - greybus: Fix use-after-free bug in gb_interface_release due to race
+      condition.
+    - ima: Fix use-after-free on a dentry's dname.name
+    - serial: core: Add UPIO_UNKNOWN constant for unknown port type
+    - serial: port: Introduce a common helper to read properties
+    - serial: 8250_dw: Switch to use uart_read_port_properties()
+    - serial: 8250_dw: Replace ACPI device check by a quirk
+    - serial: 8250_dw: Don't use struct dw8250_data outside of 8250_dw
+    - usb-storage: alauda: Check whether the media is initialized
+    - misc: microchip: pci1xxxx: Fix a memory leak in the error handling of
+      gp_aux_bus_probe()
+    - i2c: at91: Fix the functionality flags of the slave-only interface
+    - i2c: designware: Fix the functionality flags of the slave-only interface
+    - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
+    - wifi: ath11k: fix WCN6750 firmware crash caused by 17 num_vdevs
+    - cpufreq: amd-pstate: Unify computation of
+      {max,min,nominal,lowest_nonlinear}_freq
+    - cpufreq: amd-pstate: Add quirk for the pstate CPPC capabilities missing
+    - cpufreq: amd-pstate: remove global header file
+    - virtio_net: fix possible dim status unrecoverable
+    - net: ethernet: mtk_eth_soc: handle dma buffer size soc specific
+    - ice: fix reads from NVM Shadow RAM on E830 and E825-C devices
+    - ice: map XDP queues to vectors in ice_vsi_map_rings_to_vectors()
+    - x86/cpu: Get rid of an unnecessary local variable in get_cpu_address_sizes()
+    - x86/cpu: Provide default cache line size if not enumerated
+    - selftests/mm: ksft_exit functions do not return
+    - selftests/mm: compaction_test: fix bogus test success and reduce probability
+      of OOM-killer invocation
+    - .editorconfig: remove trim_trailing_whitespace option
+    - kcov, usb: disable interrupts in kcov_remote_start_usb_softirq
+    - ata: libata-scsi: Set the RMB bit only for removable media devices
+    - powerpc/85xx: fix compile error without CONFIG_CRASH_DUMP
+    - kselftest/alsa: Ensure _GNU_SOURCE is defined
+    - thermal: core: Do not fail cdev registration because of invalid initial
+      state
+    - Bluetooth: hci_sync: Fix not using correct handle
+    - net/sched: initialize noop_qdisc owner
+    - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
+    - drm/nouveau: don't attempt to schedule hpd_work on headless cards
+    - drm/xe/xe_gt_idle: use GT forcewake domain assertion
+    - drm/xe: flush engine buffers before signalling user fence on all engines
+    - drm/xe: Remove mem_access from guc_pc calls
+    - drm/xe: move disable_c6 call
+    - bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response
+    - iio: imu: bmi323: Fix trigger notification in case of error
+    - iio: pressure: bmp280: Fix BMP580 temperature reading
+    - iio: temperature: mlx90635: Fix ERR_PTR dereference in mlx90635_probe()
+    - thermal: ACPI: Invalidate trip points with temperature of 0 or below
+    - x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
+    - memblock: make memblock_set_node() also warn about use of MAX_NUMNODES
+    - perf script: Show also errors for --insn-trace option
+    - wifi: cfg80211: validate HE operation element parsing
+    - wifi: rtlwifi: Ignore IEEE80211_CONF_CHANGE_RETRY_LIMITS
+    - locking/atomic: scripts: fix ${atomic}_sub_and_test() kerneldoc
+    - ata: ahci: Do not apply Intel PCS quirk on Intel Alder Lake
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for Apacer AS340
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for Crucial CT240BX500SSD1
+    - ata: libata-core: Add ATA_HORKAGE_NOLPM for AMD Radeon S3 SSD
+    - kexec: fix the unexpected kexec_dprintk() macro
+    - ocfs2: update inode fsync transaction id in ocfs2_unlink and ocfs2_link
+    - dm-integrity: set discard_granularity to logical block size
+    - drm/bridge: aux-hpd-bridge: correct devm_drm_dp_hpd_bridge_add() stub
+    - iio: temperature: mcp9600: Fix temperature reading for negative values
+    - drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2
+    - riscv: force PAGE_SIZE linear mapping if debug_pagealloc is enabled
+    - drm/xe: Properly handle alloc_guc_id() failure
+    - wifi: iwlwifi: mvm: support iwl_dev_tx_power_cmd_v8
+    - wifi: iwlwifi: mvm: fix a crash on 7265
+    - mei: vsc: Fix wrong invocation of ACPI SID method
+    - Upstream stable to v6.6.35, v6.9.6
+  * [SRU] Add support for intel trace hub for last platforms (LP: #2073926) //
+    Noble update: upstream stable patchset 2024-07-25 (LP: #2074091)
+    - intel_th: pci: Add Granite Rapids support
+    - intel_th: pci: Add Granite Rapids SOC support
+    - intel_th: pci: Add Sapphire Rapids SOC support
+    - intel_th: pci: Add Lunar Lake support
+  * Fix L2CAP/LE/CPU/BV-02-C bluetooth certification failure (LP: #2072858) //
+    Noble update: upstream stable patchset 2024-07-25 (LP: #2074091)
+    - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
+  * Noble update: upstream stable patchset 2024-07-22 (LP: #2073788)
+    - drm/i915/hwmon: Get rid of devm
+    - afs: Don't cross .backup mountpoint from backup volume
+    - erofs: avoid allocating DEFLATE streams before mounting
+    - vxlan: Fix regression when dropping packets due to invalid src addresses
+    - drm/sun4i: hdmi: Convert encoder to atomic
+    - drm/sun4i: hdmi: Move mode_set into enable
+    - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
+    - media: lgdt3306a: Add a check against null-pointer-def
+    - drm/amdgpu: add error handle to avoid out-of-bounds
+    - wifi: rtw89: correct aSIFSTime for 6GHz band
+    - ata: pata_legacy: make legacy_exit() work again
+    - fsverity: use register_sysctl_init() to avoid kmemleak warning
+    - proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission
+      operation
+    - platform/chrome: cros_ec: Handle events during suspend after resume
+      completion
+    - thermal/drivers/qcom/lmh: Check for SCM availability at probe
+    - soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request
+    - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
+    - arm64: tegra: Correct Tegra132 I2C alias
+    - arm64: dts: qcom: qcs404: fix bluetooth device address
+    - md/raid5: fix deadlock that raid5d() wait for itself to clear
+      MD_SB_CHANGE_PENDING
+    - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
+    - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
+    - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
+    - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
+    - arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP
+    - arm64: dts: hi3798cv200: fix the size of GICR
+    - arm64: dts: ti: verdin-am62: Set memory size to 2gb
+    - media: mc: Fix graph walk in media_pipeline_start
+    - media: mc: mark the media devnode as registered from the, start
+    - media: mxl5xx: Move xpt structures off stack
+    - media: v4l2-core: hold videodev_lock until dev reg, finishes
+    - media: v4l: async: Properly re-initialise notifier entry in unregister
+    - media: v4l: async: Don't set notifier's V4L2 device if registering fails
+    - media: v4l: async: Fix notifier list entry init
+    - mmc: core: Add mmc_gpiod_set_cd_config() function
+    - mmc: sdhci: Add support for "Tuning Error" interrupts
+    - mmc: sdhci-acpi: Sort DMI quirks alphabetically
+    - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working
+    - mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A
+    - mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect GPIO on Asus
+      T100TA
+    - drm/fbdev-generic: Do not set physical framebuffer address
+    - fbdev: savage: Handle err return when savagefb_check_var failed
+    - drm/amdgpu/atomfirmware: add intergrated info v2.3 table
+    - 9p: add missing locking around taking dentry fid list
+    - drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms
+    - Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices"
+    - KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
+    - KVM: arm64: Fix AArch32 register narrowing on userspace write
+    - KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
+    - KVM: arm64: AArch32: Fix spurious trapping of conditional instructions
+    - LoongArch: Add all CPUs enabled by fdt to NUMA node 0
+    - LoongArch: Override higher address bits in JUMP_VIRT_ADDR
+    - clk: bcm: dvp: Assign ->num before accessing ->hws
+    - clk: bcm: rpi: Assign ->num before accessing ->hws
+    - clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs
+    - crypto: ecdsa - Fix module auto-load on add-key
+    - crypto: ecrdsa - Fix module auto-load on add_key
+    - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
+    - kbuild: Remove support for Clang's ThinLTO caching
+    - mm: fix race between __split_huge_pmd_locked() and GUP-fast
+    - filemap: add helper mapping_max_folio_size()
+    - iomap: fault in smaller chunks for non-large folio mappings
+    - i2c: acpi: Unbind mux adapters before delete
+    - HID: i2c-hid: elan: fix reset suspend current leakage
+    - scsi: core: Handle devices which return an unusually large VPD page count
+    - net/ipv6: Fix route deleting failure when metric equals 0
+    - net/9p: fix uninit-value in p9_client_rpc()
+    - mm/ksm: fix ksm_pages_scanned accounting
+    - mm/ksm: fix ksm_zero_pages accounting
+    - kmsan: do not wipe out origin when doing partial unpoisoning
+    - tpm_tis: Do *not* flush uninitialized work
+    - intel_th: pci: Add Meteor Lake-S CPU support
+    - rtla/timerlat: Fix histogram report when a cpu count is 0
+    - sparc64: Fix number of online CPUs
+    - mm/cma: drop incorrect alignment check in cma_init_reserved_mem
+    - mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid
+    - mm: /proc/pid/smaps_rollup: avoid skipping vma after getting mmap_lock again
+    - mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL
+    - selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages
+    - selftests/mm: fix build warnings on ppc64
+    - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin
+    - bonding: fix oops during rmmod
+    - wifi: ath10k: fix QCOM_RPROC_COMMON dependency
+    - kdb: Fix buffer overflow during tab-complete
+    - kdb: Use format-strings rather than '\0' injection in kdb_read()
+    - kdb: Fix console handling when editing and tab-completing commands
+    - kdb: Merge identical case statements in kdb_read()
+    - kdb: Use format-specifiers rather than memset() for padding in kdb_read()
+    - sparc: move struct termio to asm/termios.h
+    - drm/amdkfd: handle duplicate BOs in reserve_bo_and_cond_vms
+    - ext4: Fixes len calculation in mpage_journal_page_buffers
+    - ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow
+    - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
+    - riscv: dts: starfive: Remove PMIC interrupt info for Visionfive 2 board
+    - ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
+    - ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
+    - ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
+    - parisc: Define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
+    - parisc: Define sigset_t in parisc uapi header
+    - s390/ap: Fix crash in AP internal function modify_bitmap()
+    - s390/cpacf: Split and rework cpacf query functions
+    - s390/cpacf: Make use of invalid opcode produce a link error
+    - i3c: master: svc: fix invalidate IBI type and miss call client IBI handler
+    - genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
+    - ASoC: SOF: ipc4-topology: Fix input format query of process modules without
+      base extension
+    - ALSA: ump: Don't clear bank selection after sending a program change
+    - ALSA: ump: Don't accept an invalid UMP protocol number
+    - EDAC/amd64: Convert PCIBIOS_* return codes to errnos
+    - EDAC/igen6: Convert PCIBIOS_* return codes to errnos
+    - nfs: fix undefined behavior in nfs_block_bits()
+    - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
+    - eventfs: Fix a possible null pointer dereference in eventfs_find_events()
+    - eventfs: Keep the directories from having the same inode number as files
+    - tracefs: Clear EVENT_INODE flag in tracefs_drop_inode()
+    - btrfs: fix crash on racing fsync and size-extending write into prealloc
+    - btrfs: fix leak of qgroup extent records after transaction abort
+    - ALSA: seq: Fix incorrect UMP type for system messages
+    - powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH
+    - smb: client: fix deadlock in smb2_find_smb_tcon()
+    - smp: Provide 'setup_max_cpus' definition on UP too
+    - drm/xe/bb: assert width in xe_bb_create_job()
+    - crypto: starfive - Do not free stack buffer
+    - btrfs: qgroup: fix initialization of auto inherit array
+    - wifi: rtl8xxxu: enable MFP support with security flag of RX descriptor
+    - media: mgb4: Fix double debugfs remove
+    - media: ov2740: Fix LINK_FREQ and PIXEL_RATE control value reporting
+    - firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails
+    - LoongArch: Fix built-in DTB detection
+    - LoongArch: Fix entry point in kernel image header
+    - clk: qcom: apss-ipq-pll: use stromer ops for IPQ5018 to fix boot failure
+    - net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED
+    - selftests: net: lib: support errexit with busywait
+    - selftests: net: lib: avoid error removing empty netns name
+    - cpufreq: amd-pstate: Fix the inconsistency in max frequency units
+    - mm/memory-failure: fix handling of dissolved but not taken off from buddy
+      pages
+    - selftests/mm: compaction_test: fix bogus test success on Aarch64
+    - irqchip/riscv-intc: Prevent memory leak when riscv_intc_init_common() fails
+    - Revert "perf record: Reduce memory for recording PERF_RECORD_LOST_SAMPLES
+      event"
+    - hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
+    - riscv: enable HAVE_ARCH_HUGE_VMAP for XIP kernel
+    - btrfs: qgroup: update rescan message levels and error codes
+    - btrfs: qgroup: fix qgroup id collision across mounts
+    - btrfs: cache folio size and shift in extent_buffer
+    - btrfs: protect folio::private when attaching extent buffer folios
+    - bpf: fix multi-uprobe PID filtering logic
+    - powerpc/64/bpf: fix tail calls for PCREL addressing
+    - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
+    - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
+    - Upstream stable to v6.6.34, v6.9.5
+  * Noble update: upstream stable patchset 2024-07-19 (LP: #2073603)
+    - perf record: Delete session after stopping sideband thread
+    - perf probe: Add missing libgen.h header needed for using basename()
+    - iio: core: Leave private pointer NULL when no private data supplied
+    - greybus: lights: check return of get_channel_from_mode
+    - phy: qcom: qmp-combo: fix duplicate return in qmp_v4_configure_dp_phy
+    - f2fs: multidev: fix to recognize valid zero block address
+    - f2fs: fix to wait on page writeback in __clone_blkaddrs()
+    - fpga: manager: add owner module and take its refcount
+    - fpga: bridge: add owner module and take its refcount
+    - counter: linux/counter.h: fix Excess kernel-doc description warning
+    - perf annotate: Get rid of duplicate --group option item
+    - usb: typec: ucsi: always register a link to USB PD device
+    - usb: typec: ucsi: simplify partner's PD caps registration
+    - perf stat: Do not fail on metrics on s390 z/VM systems
+    - soundwire: cadence: fix invalid PDI offset
+    - dmaengine: idma64: Add check for dma_set_max_seg_size
+    - firmware: dmi-id: add a release callback function
+    - perf annotate: Fix annotation_calc_lines() to pass correct address to
+      get_srcline()
+    - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
+    - serial: max3100: Update uart_driver_registered on driver removal
+    - serial: max3100: Fix bitwise types
+    - greybus: arche-ctrl: move device table to its right location
+    - PCI: tegra194: Fix probe path for Endpoint mode
+    - serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
+    - module: don't ignore sysfs_create_link() failures
+    - interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment
+    - arm64: dts: meson: fix S4 power-controller node
+    - perf tests: Make "test data symbol" more robust on Neoverse N1
+    - perf tests: Apply attributes to all events in object code reading test
+    - perf record: Fix debug message placement for test consumption
+    - dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties
+    - perf bench uprobe: Remove lib64 from libc.so.6 binary path
+    - f2fs: compress: fix to relocate check condition in
+      f2fs_{release,reserve}_compress_blocks()
+    - f2fs: compress: fix to relocate check condition in
+      f2fs_ioc_{,de}compress_file()
+    - f2fs: fix to relocate check condition in f2fs_fallocate()
+    - f2fs: fix to check pinfile flag in f2fs_move_file_range()
+    - iio: adc: stm32: Fixing err code to not indicate success
+    - riscv: dts: starfive: visionfive 2: Remove non-existing TDM hardware
+    - coresight: etm4x: Fix unbalanced pm_runtime_enable()
+    - perf docs: Document bpf event modifier
+    - perf test shell arm_coresight: Increase buffer size for Coresight basic
+      tests
+    - iio: pressure: dps310: support negative temperature values
+    - iio: buffer-dmaengine: export buffer alloc and free functions
+    - iio: add the IIO backend framework
+    - [CONFIG] Update CONFIG_IIO_BACKEND
+    - iio: adc: ad9467: convert to backend framework
+    - [Config] Update CONFIG_AD9467
+    - iio: adc: adi-axi-adc: move to backend framework
+    - [Config] Update CONFIG_ADI_AXI_ADC
+    - iio: adc: adi-axi-adc: only error out in major version mismatch
+    - coresight: etm4x: Do not hardcode IOMEM access for register restore
+    - coresight: etm4x: Do not save/restore Data trace control registers
+    - coresight: etm4x: Safe access for TRCQCLTR
+    - coresight: etm4x: Fix access to resource selector registers
+    - vfio/pci: fix potential memory leak in vfio_intx_enable()
+    - fpga: region: add owner module and take its refcount
+    - udf: Remove GFP_NOFS allocation in udf_expand_file_adinicb()
+    - udf: Convert udf_expand_file_adinicb() to use a folio
+    - microblaze: Remove gcc flag for non existing early_printk.c file
+    - microblaze: Remove early printk call from cpuinfo-static.c
+    - PCI: Wait for Link Training==0 before starting Link retrain
+    - perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer)
+    - leds: pwm: Disable PWM when going to suspend
+    - ovl: remove upper umask handling from ovl_create_upper()
+    - PCI: of_property: Return error for int_map allocation failure
+    - VMCI: Fix an error handling path in vmci_guest_probe_device()
+    - dt-bindings: pinctrl: mediatek: mt7622: fix array properties
+    - pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs
+    - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
+    - watchdog: bd9576: Drop "always-running" property
+    - watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe()
+    - dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains
+    - dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x
+    - dmaengine: idxd: Avoid unnecessary destruction of file_ida
+    - usb: gadget: u_audio: Fix race condition use of controls after free during
+      gadget unbind.
+    - usb: gadget: u_audio: Clear uac pointer when freed.
+    - stm class: Fix a double free in stm_register_device()
+    - ppdev: Add an error check in register_device
+    - i2c: cadence: Avoid fifo clear after start
+    - i2c: synquacer: Fix an error handling path in synquacer_i2c_probe()
+    - perf bench internals inject-build-id: Fix trap divide when collecting just
+      one DSO
+    - perf ui browser: Don't save pointer to stack memory
+    - extcon: max8997: select IRQ_DOMAIN instead of depending on it
+    - dt-bindings: spmi: hisilicon,hisi-spmi-controller: fix binding references
+    - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
+    - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
+    - f2fs: support printk_ratelimited() in f2fs_printk()
+    - f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC
+    - f2fs: separate f2fs_gc_range() to use GC for a range
+    - f2fs: kill heap-based allocation
+    - f2fs: support file pinning for zoned devices
+    - f2fs: fix block migration when section is not aligned to pow2
+    - perf ui browser: Avoid SEGV on title
+    - perf report: Avoid SEGV in report__setup_sample_type()
+    - perf thread: Fixes to thread__new() related to initializing comm
+    - perf symbols: Fix ownership of string in dso__load_vmlinux()
+    - f2fs: compress: fix to update i_compr_blocks correctly
+    - f2fs: deprecate io_bits
+    - f2fs: introduce get_available_block_count() for cleanup
+    - f2fs: compress: fix error path of inc_valid_block_count()
+    - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem
+      lock
+    - f2fs: fix to release node block count in error path of f2fs_new_node_page()
+    - f2fs: compress: don't allow unaligned truncation on released compress inode
+    - serial: sh-sci: protect invalidating RXDMA on shutdown
+    - libsubcmd: Fix parse-options memory leak
+    - perf daemon: Fix file leak in daemon_session__control
+    - f2fs: fix to add missing iput() in gc_data_segment()
+    - usb: fotg210: Add missing kernel doc description
+    - perf stat: Don't display metric header for non-leader uncore events
+    - perf tools: Use pmus to describe type from attribute
+    - perf tools: Add/use PMU reverse lookup from config to name
+    - perf pmu: Assume sysfs events are always the same case
+    - perf pmu: Count sys and cpuid JSON events separately
+    - LoongArch: Fix callchain parse error with kernel tracepoint events again
+    - s390/vdso64: filter out munaligned-symbols flag for vdso
+    - s390/vdso: Generate unwind information for C modules
+    - s390/vdso: Create .build-id links for unstripped vdso files
+    - s390/vdso: Use standard stack frame layout
+    - s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
+    - s390/ipl: Fix incorrect initialization of nvme dump block
+    - s390/boot: Remove alt_stfle_fac_list from decompressor
+    - dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios
+    - gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node
+      match
+    - eventfs: Do not differentiate the toplevel events directory
+    - eventfs: Create eventfs_root_inode to store dentry
+    - eventfs/tracing: Add callback for release of an eventfs_inode
+    - eventfs: Free all of the eventfs_inode after RCU
+    - eventfs: Have "events" directory get permissions from its parent
+    - dt-bindings: adc: axi-adc: update bindings for backend framework
+    - dt-bindings: adc: axi-adc: add clocks property
+    - Input: ims-pcu - fix printf string overflow
+    - mmc: sdhci_am654: Add tuning algorithm for delay chain
+    - mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
+    - mmc: sdhci_am654: Add OTAP/ITAP delay enable
+    - mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
+    - mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
+    - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
+    - media: v4l: Don't turn on privacy LED if streamon fails
+    - media: ov2680: Clear the 'ret' variable on success
+    - media: ov2680: Allow probing if link-frequencies is absent
+    - media: ov2680: Do not fail if data-lanes property is absent
+    - drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk
+    - drm/msm/dpu: Always flush the slave INTF on the CTL
+    - drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
+    - drm/meson: gate px_clk when setting rate
+    - um: Fix return value in ubd_init()
+    - um: vector: fix bpfflash parameter evaluation
+    - fs/ntfs3: Check 'folio' pointer for NULL
+    - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
+    - fs/ntfs3: Use variable length array instead of fixed size
+    - drm/msm/dpu: Add callback function pointer check before its call
+    - drm/bridge: tc358775: fix support for jeida-18 and jeida-24
+    - media: stk1160: fix bounds checking in stk1160_copy_video()
+    - Input: cyapa - add missing input core locking to suspend/resume functions
+    - drm/amdgpu: init microcode chip name from ip versions
+    - drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and
+      rlc_microcode()
+    - media: mediatek: vcodec: fix possible unbalanced PM counter
+    - tools/arch/x86/intel_sdsi: Fix maximum meter bundle length
+    - tools/arch/x86/intel_sdsi: Fix meter_show display
+    - tools/arch/x86/intel_sdsi: Fix meter_certificate decoding
+    - platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit()
+    - media: flexcop-usb: fix sanity check of bNumEndpoints
+    - powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
+    - um: Fix the -Wmissing-prototypes warning for __switch_mm
+    - um: Fix the -Wmissing-prototypes warning for get_thread_reg
+    - um: Fix the declaration of kasan_map_memory
+    - cxl/trace: Correct DPA field masks for general_media & dram events
+    - cxl/region: Fix cxlr_pmem leaks
+    - media: sunxi: a83-mips-csi2: also select GENERIC_PHY
+    - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
+    - media: cec: cec-api: add locking in cec_release()
+    - media: cec: core: avoid recursive cec_claim_log_addrs
+    - media: cec: core: avoid confusing "transmit timed out" message
+    - Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
+    - drm: zynqmp_dpsub: Always register bridge
+    - selftests/powerpc/dexcr: Add -no-pie to hashchk tests
+    - drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
+    - ASoC: tas2781: Fix a warning reported by robot kernel test
+    - null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
+    - ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
+    - ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance
+    - ASoC: mediatek: mt8192: fix register configuration for tdm
+    - drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations
+    - blk-cgroup: fix list corruption from resetting io stat
+    - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
+    - blk-cgroup: Properly propagate the iostat update up the hierarchy
+    - regulator: bd71828: Don't overwrite runtime voltages
+    - xen/x86: add extra pages to unpopulated-alloc if available
+    - perf/arm-dmc620: Fix lockdep assert in ->event_init()
+    - x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when
+      UNWINDER_FRAME_POINTER=y
+    - [Config] Update CONFIG_ARCH_WANT_FRAME_POINTERS
+    - net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
+    - ipv6: sr: fix missing sk_buff release in seg6_input_core
+    - selftests: net: kill smcrouted in the cleanup logic in amt.sh
+    - nfc: nci: Fix uninit-value in nci_rx_work
+    - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
+    - ASoC: tas2781: Fix wrong loading calibrated data sequence
+    - NFSv4: Fixup smatch warning for ambiguous return
+    - nfs: keep server info for remounts
+    - sunrpc: fix NFSACL RPC retry on soft mount
+    - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
+    - regulator: pickable ranges: don't always cache vsel
+    - regulator: tps6287x: Force writing VSEL bit
+    - af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
+    - ipv6: sr: fix memleak in seg6_hmac_init_algo
+    - regulator: tps6594-regulator: Correct multi-phase configuration
+    - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
+    - pNFS/filelayout: fixup pNfs allocation modes
+    - openvswitch: Set the skbuff pkt_type for proper pmtud support.
+    - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
+    - rv: Update rv_en(dis)able_monitor doc to match kernel-doc
+    - net: lan966x: Remove ptp traps in case the ptp is not enabled.
+    - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
+    - i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame
+    - Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI"
+    - net: fec: avoid lock evasion when reading pps_enable
+    - tls: fix missing memory barrier in tls_init
+    - net: relax socket state check at accept time.
+    - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
+    - drivers/xen: Improve the late XenStore init protocol
+    - ice: Interpret .set_channels() input differently
+    - kasan, fortify: properly rename memintrinsics
+    - tracing/probes: fix error check in parse_btf_field()
+    - tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
+    - netfilter: nfnetlink_queue: acquire rcu_read_lock() in
+      instance_destroy_rcu()
+    - netfilter: ipset: Add list flush to cancel_gc
+    - netfilter: nft_payload: restore vlan q-in-q match support
+    - spi: Don't mark message DMA mapped when no transfer in it is
+    - dma-mapping: benchmark: fix up kthread-related error handling
+    - dma-mapping: benchmark: fix node id validation
+    - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
+    - nvme-multipath: fix io accounting on failover
+    - nvmet: fix ns enable/disable possible hang
+    - drm/amd/display: Enable colorspace property for MST connectors
+    - net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061
+    - net/mlx5: Lag, do bond only if slaves agree on roce state
+    - net/mlx5: Fix MTMP register capability offset in MCAM register
+    - net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules
+    - net/mlx5e: Fix IPsec tunnel mode offload feature check
+    - net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer
+      exhaustion
+    - net/mlx5e: Fix UDP GSO for encapsulated packets
+    - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
+    - bpf: Fix potential integer overflow in resolve_btfids
+    - ALSA: jack: Use guard() for locking
+    - ALSA: core: Remove debugfs at disconnection
+    - ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
+    - enic: Validate length of nl attributes in enic_set_vf_port
+    - af_unix: Annotate data-race around unix_sk(sk)->addr.
+    - af_unix: Read sk->sk_hash under bindlock during bind().
+    - Octeontx2-pf: Free send queue buffers incase of leaf to inner
+    - net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
+    - ASoC: cs42l43: Only restrict 44.1kHz for the ASP
+    - bpf: Allow delete from sockmap/sockhash only if update is allowed
+    - net:fec: Add fec_enet_deinit()
+    - net: micrel: Fix lan8841_config_intr after getting out of sleep mode
+    - ice: fix accounting if a VLAN already exists
+    - selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky
+    - selftests: mptcp: add ms units for tc-netem delay
+    - selftests: mptcp: join: mark 'fail' tests as flaky
+    - ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion
+    - ALSA: seq: Don't clear bank selection at event -> UMP MIDI2 conversion
+    - net: ti: icssg-prueth: Fix start counter for ft1 filter
+    - netfilter: nft_payload: skbuff vlan metadata mangle support
+    - netfilter: tproxy: bail out if IP has been disabled on the device
+    - netfilter: nft_fib: allow from forward/input without iif selector
+    - net/sched: taprio: make q->picos_per_byte available to fill_sched_entry()
+    - net/sched: taprio: extend minimum interval restriction to entire cycle too
+    - kconfig: fix comparison to constant symbols, 'm', 'n'
+    - drm/i915/guc: avoid FIELD_PREP warning
+    - kheaders: use `command -v` to test for existence of `cpio`
+    - spi: stm32: Don't warn about spurious interrupts
+    - net: dsa: microchip: fix RGMII error in KSZ DSA driver
+    - net: ena: Reduce lines with longer column width boundary
+    - net: ena: Fix redundant device NUMA node override
+    - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
+    - ALSA: seq: Fix yet another spot for system message conversion
+    - powerpc/pseries/lparcfg: drop error message from guest name lookup
+    - drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel
+    - drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel
+    - drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel
+    - hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor
+    - hwmon: (shtc1) Fix property misspelling
+    - ALSA: seq: ump: Fix swapped song position pointer data
+    - ALSA: timer: Set lower bound of start tick time
+    - x86/efistub: Omit physical KASLR when memory reservations exist
+    - efi: libstub: only free priv.runtime_map when allocated
+    - x86/pci: Skip early E820 check for ECAM region
+    - KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID
+    - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
+    - platform/x86/intel/tpmi: Handle error from tpmi_process_info()
+    - platform/x86/intel-uncore-freq: Don't present root domain on error
+    - perf sched timehist: Fix -g/--call-graph option failure
+    - f2fs: write missing last sum blk of file pinning section
+    - f2fs: use f2fs_{err,info}_ratelimited() for cleanup
+    - SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
+    - riscv: prevent pt_regs corruption for secondary idle threads
+    - riscv: stacktrace: fixed walk_stackframe()
+    - perf build: Fix out of tree build related to installation of sysreg-defs
+    - dt-bindings: pinctrl: qcom: update functions to match with driver
+    - usb: typec: ucsi: allow non-partner GET_PDOS for Qualcomm devices
+    - perf report: Fix PAI counter names for s390 virtual machines
+    - PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host
+    - perf map: Remove kernel map before updating start and end addresses
+    - riscv: dts: starfive: visionfive 2: Remove non-existing I2S hardware
+    - pinctrl: renesas: rzg2l: Limit 2.5V power supply to Ethernet interfaces
+    - riscv: Flush the instruction cache during SMP bringup
+    - usb: xhci: check if 'requested segments' exceeds ERST capacity
+    - spmi: pmic-arb: Replace three IS_ERR() calls by null pointer checks in
+      spmi_pmic_arb_probe()
+    - perf symbols: Remove map from list before updating addresses
+    - perf symbols: Update kcore map before merging in remaining symbols
+    - s390/ftrace: Use unwinder instead of __builtin_return_address()
+    - s390/stacktrace: Merge perf_callchain_user() and arch_stack_walk_user()
+    - s390/stacktrace: Skip first user stack frame
+    - s390/stacktrace: Improve detection of invalid instruction pointers
+    - s390/vdso: Introduce and use struct stack_frame_vdso_wrapper
+    - s390/stackstrace: Detect vdso stack frames
+    - s390/ap: Fix bind complete udev event sent after each AP bus scan
+    - ocfs2: correctly use ocfs2_find_next_zero_bit()
+    - mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown
+    - Input: ioc3kbd - add device table
+    - phy: qcom: qmp-combo: fix sm8650 voltage swing table
+    - media: ti: j721e-csi2rx: Fix races while restarting DMA
+    - drm/msm/dpu: Allow configuring multiple active DSC blocks
+    - drm: Make drivers depends on DRM_DW_HDMI
+    - [Config] Drivers now depend on DRM_DW_HDMI
+    - string: Prepare to merge strscpy_kunit.c into string_kunit.c
+    - string: Prepare to merge strcat KUnit tests into string_kunit.c
+    - drm/msm/adreno: fix CP cycles stat retrieval on a7xx
+    - printk: Fix LOG_CPU_MAX_BUF_SHIFT when BASE_SMALL is enabled
+    - powerpc/bpf/32: Fix failing test_bpf tests
+    - KVM: PPC: Book3S HV nestedv2: Cancel pending DEC exception
+    - KVM: PPC: Book3S HV nestedv2: Fix an error handling path in
+      gs_msg_ops_kvmhv_nestedv2_config_fill_info()
+    - KVM: arm64: Destroy mpidr_data for 'late' vCPU creation
+    - Bluetooth: ISO: Handle PA sync when no BIGInfo reports are generated
+    - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
+    - ubsan: Restore dependency on ARCH_HAS_UBSAN
+    - selftests: forwarding: Have RET track kselftest framework constants
+    - selftests: forwarding: Convert log_test() to recognize RET values
+    - selftests: net: Unify code of busywait() and slowwait()
+    - selftests/net: use tc rule to filter the na packet
+    - virtio_balloon: Give the balloon its own wakeup source
+    - riscv: cpufeature: Fix thead vector hwcap removal
+    - riscv: cpufeature: Fix extension subset checking
+    - riscv: selftests: Add hwprobe binaries to .gitignore
+    - idpf: Interpret .set_channels() input differently
+    - null_blk: fix null-ptr-dereference while configuring 'power' and
+      'submit_queues'
+    - netfs: Fix setting of BDP_ASYNC from iocb flags
+    - cifs: Set zero_point in the copy_file_range() and remap_file_range()
+    - cifs: Fix missing set of remote_i_size
+    - selftests: net: lib: set 'i' as local
+    - nvme: fix multipath batched completion accounting
+    - netkit: Fix setting mac address in l2 mode
+    - netkit: Fix pkt_type override upon netkit pass verdict
+    - null_blk: Fix return value of nullb_device_power_store()
+    - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers
+    - selftests: mptcp: join: mark 'fastclose' tests as flaky
+    - drm/xe: Add dbg messages on the suspend resume functions.
+    - drm/xe: check pcode init status only on root gt of root tile
+    - drm/xe: Change pcode timeout to 50msec while polling again
+    - drm/xe: Only use reserved BCS instances for usm migrate exec queue
+    - sd: also set max_user_sectors when setting max_sectors
+    - block: stack max_user_sectors
+    - ipv6: introduce dst_rt6_info() helper
+    - inet: introduce dst_rtable() helper
+    - net: fix __dst_negative_advice() race
+    - ice: fix 200G PHY types to link speed mapping
+    - x86/topology/intel: Unlock CPUID before evaluating anything
+    - Upstream stable to v6.6.33, v6.9.4
+  * Reenable CONFIG_UBSAN for noble (LP: #2076650)
+    - ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL
+    - [Config] Remove CONFIG_UBSAN_SANITIZE_ALL
+  * Dangling symlink to linux-lib-rust when Rust is disabled (LP: #2072592)
+    - [Packaging] Check do_lib_rust before linking Rust lib files
+  * kdump doesn't work with UEFI secure boot and kernel lockdown enabled on
+    ARM64 (LP: #2033007)
+    - [Config]: Enable CONFIG_KEXEC_IMAGE_VERIFY_SIG on arm64
+  * net/sched: Fix conntrack use-after-free (LP: #2073092)
+    - net/sched: Fix UAF when resolving a clash
+  * No sound on Huawei Matebook D14  AMD since Linux 6.8.0-38 [regression]
+    (LP: #2073049)
+    - ASoC: amd: acp: fix for acp platform device creation failure
+  * i915: Fixup regressions introduced with enabling single CCS engine
+    (LP: #2072755)
+    - drm/i915/gt: Fix CCS id's calculation for CCS mode setting
+  * [Ubuntu 24.04] FW1060.00 (NH1060_026) sosreport is running to Kernel OOPS
+    crash (LP: #2070358)
+    - nfsd: initialise nfsd_info.mutex early.
+  * 6.8 generic & amdpgu / polaris (LP: #2072428)
+    - drm/amdgpu: Adjust logic in amdgpu_device_partner_bandwidth()
+  * md: nvme over tcp with a striped underlying md raid device leads to data
+    corruption (LP: #2075110)
+    - md/md-bitmap: fix writing non bitmap pages
+  * Linux 6.8 fails to boot on ARM64 if any param is more than 146 chars
+    (LP: #2069534)
+    - SAUCE: arm64: v6.8: cmdline param >= 146 chars kills kernel
+  * CVE-2024-39484
+    - mmc: davinci: Don't strip remove function when driver is builtin
+  * CVE-2024-39292
+    - um: Add winch to winch_handlers before registering winch IRQ
+  * Miscellaneous upstream changes
+    - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 18 Sep 2024 21:04:33 +0900
+
+linux-qcom (6.8.0-1009.9) jammy; urgency=medium
+
+  * [RB3] Kernel call trace while inserting storage to type-c USB port
+    - SAUCE: usb3: dwc3-qcom: Fix calltrace for USB host mode
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 02 Sep 2024 10:37:50 +0900
+
+linux-qcom (6.8.0-1008.8) jammy; urgency=medium
+
+  * [RB3] drm sde error/ msm-dsi-error found in dmesg
+    - SAUCE: do not show error on EPROBE_DEFER
+
+  * [RB3] slim-ngd-ctrl error found in dmesg
+    - SAUCE: dma: qcom: bam_dma: set DMA_PRIVATE
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: generate combined-dtb.dtb at compile time
+    - SAUCE: rename qcom,phy-rst-gpio to qcom,phy-rst-gpio-id
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 21 Aug 2024 03:11:39 +0900
+
+linux-qcom (6.8.0-1007.7) jammy; urgency=medium
+
+  * [RB3] gpi 900000.dma-controller error found in dmesg
+    - dmaengine: qcom: gpi: set DMA_PRIVATE flag
+
+  * [RB3] btfm_slime error message found in dmesg
+    - SAUCE: ubuntu/qcom: fix bogus error message
+
+  * [RB3] Bluetooth device is not detected
+    - SAUCE: Set local-bd-address to fix bluetooth detection
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: ubuntu/qcom/video: import video driver from GA 1.1
+    - SAUCE: ubuntu/qcom/touch: import touch driver from GA 1.1
+    - SAUCE: ubuntu/qcom/video: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/touch: replace strlcpy() with strscpy()
+    - SAUCE: build video and touch external drivers
+
+  [ Ubuntu: 6.8.0-40.40 ]
+
+  * noble/linux: 6.8.0-40.40 -proposed tracker (LP: #2072201)
+  * FPS of glxgear with fullscreen is too low on MTL platform (LP: #2069380)
+    - drm/i915: Bypass LMEMBAR/GTTMMADR for MTL stolen memory access
+  * a critical typo in the code managing the ASPM  settings for PCI Express
+    devices (LP: #2071889)
+    - PCI/ASPM: Restore parent state to parent, child state to child
+  * [UBUNTU 24.04] IOMMU DMA mode changed in kernel config causes massive
+    throughput degradation for PCI-related network workloads (LP: #2071471)
+    - [Config] Set IOMMU_DEFAULT_DMA_STRICT=n and IOMMU_DEFAULT_DMA_LAZY=yes for
+      s390x
+  * UBSAN: array-index-out-of-bounds in
+    /build/linux-D15vQj/linux-6.5.0/drivers/md/bcache/bset.c:1098:3
+    (LP: #2039368)
+    - bcache: fix variable length array abuse in btree_iter
+  * Mute/mic LEDs and speaker no function on EliteBook 645/665 G11
+    (LP: #2071296)
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665
+      G11.
+  * failed to enable IPU6 camera sensor on kernel >= 6.8: ivsc_ace
+    intel_vsc-5db76cf6-0a68-4ed6-9b78-0361635e2447: switch camera to host
+    failed: -110 (LP: #2067364)
+    - mei: vsc: Don't stop/restart mei device during system suspend/resume
+    - SAUCE: media: ivsc: csi: don't count privacy on as error
+    - SAUCE: media: ivsc: csi: add separate lock for v4l2 control handler
+    - SAUCE: media: ivsc: csi: remove privacy status in struct mei_csi
+    - SAUCE: mei: vsc: Enhance IVSC chipset stability during warm reboot
+    - SAUCE: mei: vsc: Enhance SPI transfer of IVSC rom
+    - SAUCE: mei: vsc: Utilize the appropriate byte order swap function
+    - SAUCE: mei: vsc: Prevent timeout error with added delay post-firmware
+      download
+  * failed to probe camera sensor on Dell XPS 9315: ov01a10 i2c-OVTI01A0:00:
+    failed to check hwcfg: -22 (LP: #2070251)
+    - ACPI: utils: Make acpi_handle_path() not static
+    - ACPI: property: Ignore bad graph port nodes on Dell XPS 9315
+    - ACPI: property: Polish ignoring bad data nodes
+    - ACPI: scan: Ignore camera graph port nodes on all Dell Tiger, Alder and
+      Raptor Lake models
+  * Update amd_sfh for AMD strix series (LP: #2058331)
+    - HID: amd_sfh: Increase sensor command timeout
+    - HID: amd_sfh: Improve boot time when SFH is available
+    - HID: amd_sfh: Extend MP2 register access to SFH
+    - HID: amd_sfh: Set the AMD SFH driver to depend on x86
+  * RFIM and SAGV Linux Support for G10 models (LP: #2070158)
+    - drm/i915/display: Add meaningful traces for QGV point info error handling
+    - drm/i915/display: Extract code required to calculate max qgv/psf gv point
+    - drm/i915/display: extract code to prepare qgv points mask
+    - drm/i915/display: Disable SAGV on bw init, to force QGV point recalculation
+    - drm/i915/display: handle systems with duplicate psf gv points
+    - drm/i915/display: force qgv check after the hw state readout
+  * Update amd-pmf for AMD strix series (LP: #2058330)
+    - platform/x86/amd/pmf: Differentiate PMF ACPI versions
+    - platform/x86/amd/pmf: Disable debugfs support for querying power thermals
+    - platform/x86/amd/pmf: Add support to get sbios requests in PMF driver
+    - platform/x86/amd/pmf: Add support to notify sbios heart beat event
+    - platform/x86/amd/pmf: Add support to get APTS index numbers for static
+      slider
+    - platform/x86/amd/pmf: Add support to get sps default APTS index values
+    - platform/x86/amd/pmf: Update sps power thermals according to the platform-
+      profiles
+  * noble:linux: ADT ubuntu-regression-suite misses fakeroot dependency
+    (LP: #2070042)
+    - [DEP-8] Add missing fakeroot dependency
+  * Noble update: v6.8.12 upstream stable release (LP: #2071621)
+    - sunrpc: use the struct net as the svc proc private
+    - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
+    - selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly
+    - ftrace: Fix possible use-after-free issue in ftrace_location()
+    - Revert "arm64: fpsimd: Implement lazy restore for kernel mode FPSIMD"
+    - arm64/fpsimd: Avoid erroneous elide of user state reload
+    - Reapply "arm64: fpsimd: Implement lazy restore for kernel mode FPSIMD"
+    - tty: n_gsm: fix missing receive state reset after mode switch
+    - speakup: Fix sizeof() vs ARRAY_SIZE() bug
+    - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
+    - serial: 8250_bcm7271: use default_mux_rate if possible
+    - serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
+    - Input: try trimming too long modalias strings
+    - io_uring: fail NOP if non-zero op flags is passed in
+    - Revert "r8169: don't try to disable interrupts if NAPI is, scheduled
+      already"
+    - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
+    - ring-buffer: Fix a race between readers and resize checks
+    - net: mana: Fix the extra HZ in mana_hwc_send_request
+    - tools/latency-collector: Fix -Wformat-security compile warns
+    - tools/nolibc/stdlib: fix memory error in realloc()
+    - net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()
+    - net: lan966x: remove debugfs directory in probe() error path
+    - net: smc91x: Fix m68k kernel compilation for ColdFire CPU
+    - nilfs2: fix use-after-free of timer for log writer thread
+    - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
+    - nilfs2: fix potential hang in nilfs_detach_log_writer()
+    - fs/ntfs3: Remove max link count info display during driver init
+    - fs/ntfs3: Taking DOS names into account during link counting
+    - fs/ntfs3: Fix case when index is reused during tree transformation
+    - fs/ntfs3: Break dir enumeration if directory contents error
+    - ksmbd: avoid to send duplicate oplock break notifications
+    - ksmbd: ignore trailing slashes in share paths
+    - ALSA: core: Fix NULL module pointer assignment at card init
+    - ALSA: Fix deadlocks with kctl removals at disconnection
+    - KEYS: asymmetric: Add missing dependency on CRYPTO_SIG
+    - [Config] updateconfigs for CRYPTO_SIG
+    - KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST
+    - HID: nintendo: Fix N64 controller being identified as mouse
+    - dmaengine: xilinx: xdma: Clarify kdoc in XDMA driver
+    - wifi: mac80211: don't use rate mask for scanning
+    - wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon
+      timestamp field
+    - wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt
+      class
+    - dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
+    - HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled
+    - net: usb: qmi_wwan: add Telit FN920C04 compositions
+    - drm/amd/display: Set color_mgmt_changed to true on unsuspend
+    - drm/amdgpu: Update BO eviction priorities
+    - drm/amd/pm: Restore config space after reset
+    - drm/amdkfd: Add VRAM accounting for SVM migration
+    - drm/amdgpu: Fix the ring buffer size for queue VM flush
+    - Revert "net: txgbe: fix i2c dev name cannot match clkdev"
+    - Revert "net: txgbe: fix clk_name exceed MAX_DEV_ID limits"
+    - cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n
+    - LoongArch: Lately init pmu after smp is online
+    - drm/etnaviv: fix tx clock gating on some GC7000 variants
+    - selftests: sud_test: return correct emulated syscall value on RISC-V
+    - riscv: thead: Rename T-Head PBMT to MAE
+    - [Config] updateconfigs for ERRATA_THEAD_MAE
+    - riscv: T-Head: Test availability bit before enabling MAE errata
+    - sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU
+    - ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too
+    - regulator: irq_helpers: duplicate IRQ name
+    - ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot()
+    - ASoC: SOF: ipc4-pcm: Use consistent name for snd_sof_pcm_stream pointer
+    - ASoC: SOF: ipc4-pcm: Use consistent name for sof_ipc4_timestamp_info pointer
+    - ASoC: SOF: ipc4-pcm: Introduce generic sof_ipc4_pcm_stream_priv
+    - ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3
+    - ASoC: acp: Support microphone from device Acer 315-24p
+    - ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
+    - ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
+    - ASoC: rt722-sdca: modify channel number to support 4 channels
+    - ASoC: rt722-sdca: add headset microphone vrefo setting
+    - regulator: qcom-refgen: fix module autoloading
+    - regulator: vqmmc-ipq4019: fix module autoloading
+    - ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config
+    - ASoC: rt715: add vendor clear control register
+    - ASoC: rt715-sdca: volume step modification
+    - KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF
+    - Input: xpad - add support for ASUS ROG RAIKIRI
+    - btrfs: take the cleaner_mutex earlier in qgroup disable
+    - EDAC/versal: Do not register for NOC errors
+    - fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
+    - bpf, x86: Fix PROBE_MEM runtime load check
+    - ALSA: emu10k1: make E-MU FPGA writes potentially more reliable
+    - softirq: Fix suspicious RCU usage in __do_softirq()
+    - platform/x86: ISST: Add Grand Ridge to HPM CPU list
+    - ASoC: da7219-aad: fix usage of device_get_named_child_node()
+    - ASoC: cs35l56: fix usages of device_get_named_child_node()
+    - ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection
+    - Input: amimouse - mark driver struct with __refdata to prevent section
+      mismatch
+    - drm/amdgpu: Fix VRAM memory accounting
+    - drm/amd/display: Ensure that dmcub support flag is set for DCN20
+    - drm/amd/display: Add dtbclk access to dcn315
+    - drm/amd/display: Allocate zero bw after bw alloc enable
+    - drm/amd/display: Add VCO speed parameter for DCN31 FPU
+    - drm/amd/display: Fix DC mode screen flickering on DCN321
+    - drm/amd/display: Disable seamless boot on 128b/132b encoding
+    - drm/amdkfd: Flush the process wq before creating a kfd_process
+    - x86/mm: Remove broken vsyscall emulation code from the page fault code
+    - nvme: find numa distance only if controller has valid numa id
+    - nvmet-auth: return the error code to the nvmet_auth_host_hash() callers
+    - nvmet-auth: replace pr_debug() with pr_err() to report an error.
+    - nvme: cancel pending I/O if nvme controller is in terminal state
+    - nvmet-tcp: fix possible memory leak when tearing down a controller
+    - nvmet: fix nvme status code when namespace is disabled
+    - nvme-tcp: strict pdu pacing to avoid send stalls on TLS
+    - epoll: be better about file lifetimes
+    - nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
+    - openpromfs: finish conversion to the new mount API
+    - crypto: bcm - Fix pointer arithmetic
+    - firmware: qcom: qcm: fix unused qcom_scm_qseecom_allowlist
+    - mm/slub, kunit: Use inverted data to corrupt kmem cache
+    - firmware: raspberrypi: Use correct device for DMA mappings
+    - ecryptfs: Fix buffer size for tag 66 packet
+    - nilfs2: fix out-of-range warning
+    - parisc: add missing export of __cmpxchg_u8()
+    - crypto: ccp - drop platform ifdef checks
+    - crypto: x86/nh-avx2 - add missing vzeroupper
+    - crypto: x86/sha256-avx2 - add missing vzeroupper
+    - crypto: x86/sha512-avx2 - add missing vzeroupper
+    - s390/cio: fix tracepoint subchannel type field
+    - io_uring: use the right type for work_llist empty check
+    - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
+    - rcu: Fix buffer overflow in print_cpu_stall_info()
+    - ARM: configs: sunxi: Enable DRM_DW_HDMI
+    - jffs2: prevent xattr node from overflowing the eraseblock
+    - libfs: Re-arrange locking in offset_iterate_dir()
+    - libfs: Define a minimum directory offset
+    - libfs: Add simple_offset_empty()
+    - maple_tree: Add mtree_alloc_cyclic()
+    - libfs: Convert simple directory offsets to use a Maple Tree
+    - libfs: Fix simple_offset_rename_exchange()
+    - libfs: Add simple_offset_rename() API
+    - shmem: Fix shmem_rename2()
+    - io-wq: write next_work before dropping acct_lock
+    - mm/userfaultfd: Do not place zeropages when zeropages are disallowed
+    - s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests
+    - crypto: octeontx2 - add missing check for dma_map_single
+    - crypto: qat - improve error message in adf_get_arbiter_mapping()
+    - crypto: qat - improve error logging to be consistent across features
+    - soc: qcom: pmic_glink: don't traverse clients list without a lock
+    - soc: qcom: pmic_glink: notify clients about the current state
+    - firmware: qcom: scm: Fix __scm and waitq completion variable initialization
+    - soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
+    - null_blk: Fix missing mutex_destroy() at module removal
+    - crypto: qat - validate slices count returned by FW
+    - hwrng: stm32 - use logical OR in conditional
+    - hwrng: stm32 - put IP into RPM suspend on failure
+    - hwrng: stm32 - repair clock handling
+    - kunit/fortify: Fix mismatched kvalloc()/vfree() usage
+    - io_uring/net: remove dependency on REQ_F_PARTIAL_IO for sr->done_io
+    - io_uring/net: fix sendzc lazy wake polling
+    - soc: qcom: pmic_glink: Make client-lock non-sleeping
+    - lkdtm: Disable CFI checking for perms functions
+    - md: fix resync softlockup when bitmap size is less than array size
+    - crypto: qat - specify firmware files for 402xx
+    - block: refine the EOF check in blkdev_iomap_begin
+    - block: fix and simplify blkdevparts= cmdline parsing
+    - block: support to account io_ticks precisely
+    - wifi: ath10k: poll service ready message before failing
+    - wifi: brcmfmac: pcie: handle randbuf allocation failure
+    - wifi: ath11k: don't force enable power save on non-running vdevs
+    - bpftool: Fix missing pids during link show
+    - libbpf: Prevent null-pointer dereference when prog to load has no BTF
+    - wifi: ath12k: use correct flag field for 320 MHz channels
+    - wifi: mt76: mt7915: workaround too long expansion sparse warnings
+    - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
+    - wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok()
+    - wifi: iwlwifi: mvm: Do not warn on invalid link on scan complete
+    - wifi: iwlwifi: mvm: allocate STA links only for active links
+    - wifi: mac80211: don't select link ID if not provided in scan request
+    - wifi: iwlwifi: implement can_activate_links callback
+    - wifi: iwlwifi: mvm: fix active link counting during recovery
+    - wifi: iwlwifi: mvm: select STA mask only for active links
+    - wifi: iwlwifi: reconfigure TLC during HW restart
+    - wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask
+    - sched/fair: Add EAS checks before updating root_domain::overutilized
+    - ACPI: bus: Indicate support for _TFP thru _OSC
+    - ACPI: bus: Indicate support for more than 16 p-states thru _OSC
+    - ACPI: bus: Indicate support for the Generic Event Device thru _OSC
+    - ACPI: Fix Generic Initiator Affinity _OSC bit
+    - ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC
+    - enetc: avoid truncating error message
+    - qed: avoid truncating work queue length
+    - mlx5: avoid truncating error message
+    - mlx5: stop warning for 64KB pages
+    - bitops: add missing prototype check
+    - dlm: fix user space lock decision to copy lvb
+    - wifi: carl9170: re-fix fortified-memset warning
+    - bpftool: Mount bpffs on provided dir instead of parent dir
+    - bpf: Pack struct bpf_fib_lookup
+    - bpf: prevent r10 register from being marked as precise
+    - x86/microcode/AMD: Avoid -Wformat warning with clang-15
+    - scsi: ufs: qcom: Perform read back after writing reset bit
+    - scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
+    - scsi: ufs: qcom: Perform read back after writing unipro mode
+    - scsi: ufs: qcom: Perform read back after writing CGC enable
+    - scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
+    - scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H
+    - scsi: ufs: core: Perform read back after disabling interrupts
+    - scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
+    - ACPI: LPSS: Advertise number of chip selects via property
+    - EDAC/skx_common: Allow decoding of SGX addresses
+    - locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128()
+    - irqchip/alpine-msi: Fix off-by-one in allocation error path
+    - irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
+    - ACPI: disable -Wstringop-truncation
+    - gfs2: Don't forget to complete delayed withdraw
+    - gfs2: Fix "ignore unlock failures after withdraw"
+    - arm64: Remove unnecessary irqflags alternative.h include
+    - x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57
+    - selftests/bpf: Fix umount cgroup2 error in test_sockmap
+    - tcp: increase the default TCP scaling ratio
+    - cpufreq: exit() callback is optional
+    - x86/pat: Introduce lookup_address_in_pgd_attr()
+    - x86/pat: Restructure _lookup_address_cpa()
+    - x86/pat: Fix W^X violation false-positives when running as Xen PV guest
+    - udp: Avoid call to compute_score on multiple sites
+    - openrisc: traps: Don't send signals to kernel mode threads
+    - cppc_cpufreq: Fix possible null pointer dereference
+    - wifi: iwlwifi: mvm: init vif works only once
+    - scsi: libsas: Fix the failure of adding phy with zero-address to port
+    - scsi: hpsa: Fix allocation size for Scsi_Host private data
+    - x86/purgatory: Switch to the position-independent small code model
+    - wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
+    - thermal/drivers/mediatek/lvts_thermal: Add coeff for mt8192
+    - thermal/drivers/tsens: Fix null pointer dereference
+    - dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 compatible
+    - dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible
+      definition
+    - wifi: ath10k: Fix an error code problem in
+      ath10k_dbg_sta_write_peer_debug_trigger()
+    - gfs2: Remove ill-placed consistency check
+    - gfs2: Fix potential glock use-after-free on unmount
+    - gfs2: finish_xmote cleanup
+    - gfs2: do_xmote fixes
+    - thermal/debugfs: Avoid excessive updates of trip point statistics
+    - selftests/bpf: Fix a fd leak in error paths in open_netns
+    - scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search()
+    - cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations
+    - wifi: ath10k: populate board data for WCN3990
+    - net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset
+      handlers
+    - net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family
+      switches
+    - tcp: avoid premature drops in tcp_add_backlog()
+    - thermal/debugfs: Create records for cdev states as they get used
+    - thermal/debugfs: Pass cooling device state to thermal_debug_cdev_add()
+    - pwm: sti: Prepare removing pwm_chip from driver data
+    - pwm: sti: Simplify probe function using devm functions
+    - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
+    - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
+    - drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
+    - net: give more chances to rcu in netdev_wait_allrefs_any()
+    - macintosh/via-macii: Fix "BUG: sleeping function called from invalid
+      context"
+    - wifi: carl9170: add a proper sanity check for endpoints
+    - bpf: Fix verifier assumptions about socket->sk
+    - selftests/bpf: Run cgroup1_hierarchy test in own mount namespace
+    - wifi: ar5523: enable proper endpoint verification
+    - pwm: Drop useless member .of_pwm_n_cells of struct pwm_chip
+    - pwm: Let the of_xlate callbacks accept references without period
+    - pwm: Drop duplicate check against chip->npwm in of_pwm_xlate_with_flags()
+    - pwm: Reorder symbols in core.c
+    - pwm: Provide an inline function to get the parent device of a given chip
+    - pwm: meson: Change prototype of a few helpers to prepare further changes
+    - pwm: meson: Make use of pwmchip_parent() accessor
+    - pwm: meson: Add check for error from clk_round_rate()
+    - pwm: meson: Use mul_u64_u64_div_u64() for frequency calculating
+    - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
+    - sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
+    - Revert "sh: Handle calling csum_partial with misaligned data"
+    - wifi: mt76: mt7603: fix tx queue of loopback packets
+    - wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
+    - wifi: mt76: mt7996: fix size of txpower MCU command
+    - wifi: mt76: mt7925: ensure 4-byte alignment for suspend & wow command
+    - wifi: mt76: mt7996: fix uninitialized variable in mt7996_irq_tasklet()
+    - wifi: mt76: mt7996: fix potential memory leakage when reading chip
+      temperature
+    - libbpf: Fix error message in attach_kprobe_multi
+    - wifi: nl80211: Avoid address calculations via out of bounds array indexing
+    - wifi: rtw89: wow: refine WoWLAN flows of HCI interrupts and low power mode
+    - selftests/binderfs: use the Makefile's rules, not Make's implicit rules
+    - selftests/resctrl: fix clang build failure: use LOCAL_HDRS
+    - selftests: default to host arch for LLVM builds
+    - kunit: Fix kthread reference
+    - kunit: unregister the device on error
+    - kunit: bail out early in __kunit_test_suites_init() if there are no suites
+      to test
+    - selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect
+    - HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
+    - scsi: bfa: Ensure the copied buf is NUL terminated
+    - scsi: qedf: Ensure the copied buf is NUL terminated
+    - scsi: qla2xxx: Fix debugfs output for fw_resource_count
+    - gpio: nuvoton: Fix sgpio irq handle error
+    - x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks()
+    - wifi: mwl8k: initialize cmd->addr[] properly
+    - HID: amd_sfh: Handle "no sensors" in PM operations
+    - usb: aqc111: stop lying about skb->truesize
+    - net: usb: sr9700: stop lying about skb->truesize
+    - m68k: Fix spinlock race in kernel thread creation
+    - m68k: mac: Fix reboot hang on Mac IIci
+    - dm-delay: fix workqueue delay_timer race
+    - dm-delay: fix hung task introduced by kthread mode
+    - dm-delay: fix max_delay calculations
+    - ptp: ocp: fix DPLL functions
+    - net: ipv6: fix wrong start position when receive hop-by-hop fragment
+    - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
+    - selftests: net: add missing config for amt.sh
+    - selftests: net: move amt to socat for better compatibility
+    - net: ethernet: mediatek: split tx and rx fields in mtk_soc_data struct
+    - net: ethernet: mediatek: use ADMAv1 instead of ADMAv2.0 on MT7981 and MT7986
+    - ice: Fix package download algorithm
+    - net: ethernet: cortina: Locking fixes
+    - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
+    - net: usb: smsc95xx: stop lying about skb->truesize
+    - net: openvswitch: fix overwriting ct original tuple for ICMPv6
+    - ipv6: sr: add missing seg6_local_exit
+    - ipv6: sr: fix incorrect unregister order
+    - ipv6: sr: fix invalid unregister error path
+    - net/mlx5: Fix peer devlink set for SF representor devlink port
+    - net/mlx5: Reload only IB representors upon lag disable/enable
+    - net/mlx5: Add a timeout to acquire the command queue semaphore
+    - net/mlx5: Discard command completions in internal error
+    - s390/bpf: Emit a barrier for BPF_FETCH instructions
+    - riscv, bpf: make some atomic operations fully ordered
+    - ax25: Use kernel universal linked list to implement ax25_dev_list
+    - ax25: Fix reference count leak issues of ax25_dev
+    - ax25: Fix reference count leak issue of net_device
+    - dpll: fix return value check for kmemdup
+    - net: fec: remove .ndo_poll_controller to avoid deadlocks
+    - mptcp: SO_KEEPALIVE: fix getsockopt support
+    - mptcp: cleanup writer wake-up
+    - mptcp: avoid some duplicate code in socket option handling
+    - mptcp: implement TCP_NOTSENT_LOWAT support
+    - mptcp: cleanup SOL_TCP handling
+    - mptcp: fix full TCP keep-alive support
+    - net: stmmac: Offload queueMaxSDU from tc-taprio
+    - net: stmmac: est: Per Tx-queue error count for HLBF
+    - net: stmmac: Report taprio offload status
+    - net: stmmac: move the EST lock to struct stmmac_priv
+    - net: micrel: Fix receiving the timestamp in the frame for lan8841
+    - Bluetooth: compute LE flow credits based on recvbuf space
+    - Bluetooth: qca: Fix error code in qca_read_fw_build_info()
+    - Bluetooth: ISO: Add hcon for listening bis sk
+    - Bluetooth: ISO: Clean up returns values in iso_connect_ind()
+    - Bluetooth: ISO: Make iso_get_sock_listen generic
+    - Bluetooth: Remove usage of the deprecated ida_simple_xx() API
+    - Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS
+    - Bluetooth: HCI: Remove HCI_AMP support
+    - ice: make ice_vsi_cfg_rxq() static
+    - ice: make ice_vsi_cfg_txq() static
+    - overflow: Change DEFINE_FLEX to take __counted_by member
+    - Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings
+    - Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1
+    - drm/bridge: Fix improper bridge init order with pre_enable_prev_first
+    - drm/ci: update device type for volteer devices
+    - drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer()
+    - drm/omapdrm: Fix console by implementing fb_dirty
+    - drm/omapdrm: Fix console with deferred ops
+    - printk: Let no_printk() use _printk()
+    - dev_printk: Add and use dev_no_printk()
+    - drm/lcdif: Do not disable clocks on already suspended hardware
+    - drm/dp: Don't attempt AUX transfers when eDP panels are not powered
+    - drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't
+      assert
+    - drm/amd/display: Fix potential index out of bounds in color transformation
+      function
+    - drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate()
+    - ASoC: Intel: Disable route checks for Skylake boards
+    - ASoC: Intel: avs: ssm4567: Do not ignore route checks
+    - mtd: core: Report error if first mtd_otp_size() call fails in
+      mtd_otp_nvmem_add()
+    - mtd: rawnand: hynix: fixed typo
+    - drm/imagination: avoid -Woverflow warning
+    - ASoC: mediatek: Assign dummy when codec not specified for a DAI link
+    - drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W flags
+    - drm/panel: ltk050h3146w: drop duplicate commands from LTK050H3148W init
+    - fbdev: shmobile: fix snprintf truncation
+    - ASoC: kirkwood: Fix potential NULL dereference
+    - drm/meson: vclk: fix calculation of 59.94 fractional rates
+    - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
+    - drm/mediatek: Init `ddp_comp` with devm_kcalloc()
+    - ASoC: SOF: Intel: hda-dai: fix channel map configuration for aggregated
+      dailink
+    - powerpc/fsl-soc: hide unused const variable
+    - ASoC: SOF: Intel: mtl: Correct rom_status_reg
+    - ASoC: SOF: Intel: lnl: Correct rom_status_reg
+    - ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed
+    - ASoC: SOF: Intel: mtl: Implement firmware boot state check
+    - fbdev: sisfb: hide unused variables
+    - selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 mounted
+      without nsdelegate
+    - ASoC: Intel: avs: Restore stream decoupling on prepare
+    - ASoC: Intel: avs: Fix ASRC module initialization
+    - ASoC: Intel: avs: Fix potential integer overflow
+    - ASoC: Intel: avs: Test result of avs_get_module_entry()
+    - media: ngene: Add dvb_ca_en50221_init return value check
+    - staging: media: starfive: Remove links when unregistering devices
+    - media: rcar-vin: work around -Wenum-compare-conditional warning
+    - media: radio-shark2: Avoid led_names truncations
+    - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
+    - platform/x86: xiaomi-wmi: Fix race condition when reporting key events
+    - drm/msm/dp: allow voltage swing / pre emphasis of 3
+    - drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected
+    - media: ipu3-cio2: Request IRQ earlier
+    - media: dt-bindings: ovti,ov2680: Fix the power supply names
+    - media: i2c: et8ek8: Don't strip remove function when driver is builtin
+    - media: v4l2-subdev: Fix stream handling for crop API
+    - fbdev: sh7760fb: allow modular build
+    - media: atomisp: ssh_css: Fix a null-pointer dereference in
+      load_video_binaries
+    - drm/arm/malidp: fix a possible null pointer dereference
+    - drm: vc4: Fix possible null pointer dereference
+    - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
+    - drm/bridge: anx7625: Don't log an error when DSI host can't be found
+    - drm/bridge: icn6211: Don't log an error when DSI host can't be found
+    - drm/bridge: lt8912b: Don't log an error when DSI host can't be found
+    - drm/bridge: lt9611: Don't log an error when DSI host can't be found
+    - drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found
+    - drm/bridge: tc358775: Don't log an error when DSI host can't be found
+    - drm/bridge: dpc3433: Don't log an error when DSI host can't be found
+    - drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found
+    - drm/bridge: anx7625: Update audio status while detecting
+    - drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
+    - ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim 7 16ARHA7
+    - drm/mipi-dsi: use correct return type for the DSC functions
+    - media: uvcvideo: Add quirk for Logitech Rally Bar
+    - drm/rockchip: vop2: Do not divide height twice for YUV
+    - drm/edid: Parse topology block for all DispID structure v1.x
+    - media: cadence: csi2rx: configure DPHY before starting source stream
+    - clk: samsung: exynosautov9: fix wrong pll clock id value
+    - RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent
+    - RDMA/mlx5: Change check for cacheable mkeys
+    - RDMA/mlx5: Adding remote atomic access flag to updatable flags
+    - clk: mediatek: pllfh: Don't log error for missing fhctl node
+    - iommu: Undo pasid attachment only for the devices that have succeeded
+    - RDMA/hns: Fix return value in hns_roce_map_mr_sg
+    - RDMA/hns: Fix deadlock on SRQ async events.
+    - RDMA/hns: Fix UAF for cq async event
+    - RDMA/hns: Fix GMV table pagesize
+    - RDMA/hns: Use complete parentheses in macros
+    - RDMA/hns: Modify the print level of CQE error
+    - clk: mediatek: mt8365-mm: fix DPI0 parent
+    - clk: rs9: fix wrong default value for clock amplitude
+    - clk: qcom: clk-alpha-pll: remove invalid Stromer register offset
+    - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
+    - RDMA/rxe: Allow good work requests to be executed
+    - RDMA/rxe: Fix incorrect rxe_put in error path
+    - IB/mlx5: Use __iowrite64_copy() for write combining stores
+    - clk: renesas: r8a779a0: Fix CANFD parent clock
+    - clk: renesas: r9a07g043: Add clock and reset entry for PLIC
+    - lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
+    - mm/ksm: fix ksm exec support for prctl
+    - clk: qcom: dispcc-sm8450: fix DisplayPort clocks
+    - clk: qcom: dispcc-sm6350: fix DisplayPort clocks
+    - clk: qcom: dispcc-sm8550: fix DisplayPort clocks
+    - clk: qcom: dispcc-sm8650: fix DisplayPort clocks
+    - clk: qcom: mmcc-msm8998: fix venus clock issue
+    - x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
+    - x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS
+    - ext4: avoid excessive credit estimate in ext4_tmpfile()
+    - RDMA/mana_ib: Introduce helpers to create and destroy mana queues
+    - RDMA/mana_ib: Use struct mana_ib_queue for CQs
+    - RDMA/mana_ib: boundary check before installing cq callbacks
+    - virt: acrn: stop using follow_pfn
+    - drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
+    - sunrpc: removed redundant procp check
+    - nfsd: don't create nfsv4recoverydir in nfsdfs when not used.
+    - ext4: fix potential unnitialized variable
+    - ext4: remove the redundant folio_wait_stable()
+    - clk: qcom: Fix SC_CAMCC_8280XP dependencies
+    - [Config] updateconfigs for SC_CAMCC_8280XP
+    - clk: qcom: Fix SM_GPUCC_8650 dependencies
+    - [Config] updateconfigs for SM_GPUCC_8650
+    - clk: qcom: apss-ipq-pll: fix PLL rate for IPQ5018
+    - of: module: add buffer overflow check in of_modalias()
+    - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
+    - SUNRPC: Fix gss_free_in_token_pages()
+    - selftests/damon/_damon_sysfs: check errors from nr_schemes file reads
+    - selftests/kcmp: remove unused open mode
+    - RDMA/IPoIB: Fix format truncation compilation errors
+    - RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use
+      siw
+    - samples/landlock: Fix incorrect free in populate_ruleset_net
+    - tracing/user_events: Prepare find/delete for same name events
+    - tracing/user_events: Fix non-spaced field matching
+    - modules: Drop the .export_symbol section from the final modules
+    - net: bridge: xmit: make sure we have at least eth header len bytes
+    - selftests: net: bridge: increase IGMP/MLD exclude timeout membership
+      interval
+    - net: bridge: mst: fix vlan use-after-free
+    - net: qrtr: ns: Fix module refcnt
+    - selftests/net/lib: no need to record ns name if it already exist
+    - idpf: don't skip over ethtool tcp-data-split setting
+    - netrom: fix possible dead-lock in nr_rt_ioctl()
+    - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
+    - sched/fair: Allow disabling sched_balance_newidle with
+      sched_relax_domain_level
+    - sched/core: Fix incorrect initialization of the 'burst' parameter in
+      cpu_max_write()
+    - net: wangxun: fix to change Rx features
+    - net: wangxun: match VLAN CTAG and STAG features
+    - net: txgbe: move interrupt codes to a separate file
+    - net: txgbe: use irq_domain for interrupt controller
+    - net: txgbe: fix to control VLAN strip
+    - l2tp: fix ICMP error handling for UDP-encap sockets
+    - io_uring/net: ensure async prep handlers always initialize ->done_io
+    - pwm: Fix setting period with #pwm-cells = <1> and of_pwm_single_xlate()
+    - net: txgbe: fix to clear interrupt status after handling IRQ
+    - net: txgbe: fix GPIO interrupt blocking
+    - Linux 6.8.12
+  * Noble update: v6.8.11 upstream stable release (LP: #2070355)
+    - drm/amd/display: Fix division by zero in setup_dsc_config
+    - net: ks8851: Fix another TX stall caused by wrong ISR flag handling
+    - ice: pass VSI pointer into ice_vc_isvalid_q_id
+    - ice: remove unnecessary duplicate checks for VF VSI ID
+    - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
+    - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
+    - KEYS: trusted: Fix memory leak in tpm2_key_encode()
+    - erofs: get rid of erofs_fs_context
+    - erofs: reliably distinguish block based and fscache mode
+    - binder: fix max_thread type inconsistency
+    - usb: dwc3: Wait unconditionally after issuing EndXfer command
+    - net: usb: ax88179_178a: fix link status when link is set to down/up
+    - usb: typec: ucsi: displayport: Fix potential deadlock
+    - usb: typec: tipd: fix event checking for tps25750
+    - usb: typec: tipd: fix event checking for tps6598x
+    - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
+    - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
+    - KEYS: trusted: Do not use WARN when encode fails
+    - admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
+    - docs: kernel_include.py: Cope with docutils 0.21
+    - Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching
+      sysfs file
+    - block: add a disk_has_partscan helper
+    - block: add a partscan sysfs attribute for disks
+    - Linux 6.8.11
+  * Noble update: v6.8.10 upstream stable release (LP: #2070349)
+    - rust: module: place generated init_module() function in .init.text
+    - rust: macros: fix soundness issue in `module!` macro
+    - wifi: nl80211: don't free NULL coalescing rule
+    - pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
+    - pinctrl/meson: fix typo in PDM's pin name
+    - pinctrl: core: delete incorrect free in pinctrl_enable()
+    - pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
+    - pinctrl: mediatek: paris: Rework support for
+      PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
+    - sunrpc: add a struct rpc_stats arg to rpc_create_args
+    - nfs: expose /proc/net/sunrpc/nfs in net namespaces
+    - nfs: make the rpc_stat per net namespace
+    - nfs: Handle error of rpc_proc_register() in nfs_net_init().
+    - pinctrl: baytrail: Fix selecting gpio pinctrl state
+    - power: rt9455: hide unused rt9455_boost_voltage_values
+    - power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
+    - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
+    - nfsd: rename NFSD_NET_* to NFSD_STATS_*
+    - nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
+    - nfsd: make all of the nfsd stats per-network namespace
+    - NFSD: add support for CB_GETATTR callback
+    - NFSD: Fix nfsd4_encode_fattr4() crasher
+    - regulator: mt6360: De-capitalize devicetree regulator subnodes
+    - regulator: change stubbed devm_regulator_get_enable to return Ok
+    - regulator: change devm_regulator_get_enable_optional() stub to return Ok
+    - bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
+    - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
+    - regmap: Add regmap_read_bypassed()
+    - ASoC: SOF: Intel: add default firmware library path for LNL
+    - nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
+    - bpf: Fix a verifier verbose message
+    - spi: axi-spi-engine: use common AXI macros
+    - spi: axi-spi-engine: fix version format string
+    - spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
+    - bpf, arm64: Fix incorrect runtime stats
+    - riscv, bpf: Fix incorrect runtime stats
+    - ASoC: Intel: avs: Set name of control as in topology
+    - ASoC: codecs: wsa881x: set clk_stop_mode1 flag
+    - s390/mm: Fix storage key clearing for guest huge pages
+    - s390/mm: Fix clearing storage keys for huge pages
+    - arm32, bpf: Reimplement sign-extension mov instruction
+    - xdp: use flags field to disambiguate broadcast redirect
+    - efi/unaccepted: touch soft lockup during memory accept
+    - ice: ensure the copied buf is NUL terminated
+    - bna: ensure the copied buf is NUL terminated
+    - octeontx2-af: avoid off-by-one read from userspace
+    - thermal/debugfs: Free all thermal zone debug memory on zone removal
+    - thermal/debugfs: Fix two locking issues with thermal zone debug
+    - nsh: Restore skb->{protocol,data,mac_header} for outer header in
+      nsh_gso_segment().
+    - net l2tp: drop flow hash on forward
+    - thermal/debugfs: Prevent use-after-free from occurring after cdev removal
+    - s390/vdso: Add CFI for RA register to asm macro vdso_func
+    - Fix a potential infinite loop in extract_user_to_sg()
+    - ALSA: emu10k1: fix E-MU card dock presence monitoring
+    - ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()
+    - ALSA: emu10k1: move the whole GPIO event handling to the workqueue
+    - ALSA: emu10k1: fix E-MU dock initialization
+    - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
+    - net: qede: use return from qede_parse_flow_attr() for flower
+    - net: qede: use return from qede_parse_flow_attr() for flow_spec
+    - net: qede: use return from qede_parse_actions()
+    - vxlan: Fix racy device stats updates.
+    - vxlan: Add missing VNI filter counter update in arp_reduce().
+    - ASoC: meson: axg-fifo: use FIELD helpers
+    - ASoC: meson: axg-fifo: use threaded irq to check periods
+    - ASoC: meson: axg-card: make links nonatomic
+    - ASoC: meson: axg-tdm-interface: manage formatters in trigger
+    - ASoC: meson: cards: select SND_DYNAMIC_MINORS
+    - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
+    - s390/cio: Ensure the copied buf is NUL terminated
+    - cxgb4: Properly lock TX queue for the selftest.
+    - net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
+    - drm/amdgpu: fix doorbell regression
+    - spi: fix null pointer dereference within spi_sync
+    - net: bridge: fix multicast-to-unicast with fraglist GSO
+    - net: core: reject skb_copy(_expand) for fraglist GSO skbs
+    - rxrpc: Clients must accept conn from any address
+    - tipc: fix a possible memleak in tipc_buf_append
+    - vxlan: Pull inner IP header in vxlan_rcv().
+    - s390/qeth: Fix kernel panic after setting hsuid
+    - drm/panel: ili9341: Correct use of device property APIs
+    - [Config] updateconfigs for DRM_PANEL_ILITEK_ILI9341
+    - drm/panel: ili9341: Respect deferred probe
+    - drm/panel: ili9341: Use predefined error codes
+    - ipv4: Fix uninit-value access in __ip_make_skb()
+    - net: gro: fix udp bad offset in socket lookup by adding
+      {inner_}network_offset to napi_gro_cb
+    - net: gro: add flush check in udp_gro_receive_segment
+    - drm/xe/display: Fix ADL-N detection
+    - clk: qcom: smd-rpm: Restore msm8976 num_clk
+    - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
+    - powerpc/pseries: make max polling consistent for longer H_CALLs
+    - powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
+    - EDAC/versal: Do not log total error counts
+    - swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
+    - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
+    - exfat: fix timing of synchronizing bitmap and inode
+    - firmware: microchip: don't unconditionally print validation success
+    - scsi: ufs: core: Fix MCQ MAC configuration
+    - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
+    - scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling
+    - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
+    - scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
+    - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
+    - scsi: lpfc: Use a dedicated lock for ras_fwlog state
+    - gfs2: Fix invalid metadata access in punch_hole
+    - fs/9p: fix uninitialized values during inode evict
+    - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
+    - wifi: cfg80211: fix rdev_dump_mpp() arguments order
+    - wifi: mac80211: fix prep_connection error path
+    - wifi: iwlwifi: read txq->read_ptr under lock
+    - wifi: iwlwifi: mvm: guard against invalid STA ID on removal
+    - net: mark racy access on sk->sk_rcvbuf
+    - drm/xe: Fix END redefinition
+    - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
+    - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
+    - btrfs: return accurate error code on open failure in open_fs_devices()
+    - drm/amdkfd: Check cgroup when returning DMABuf info
+    - drm/amdkfd: range check cp bad op exception interrupts
+    - bpf: Check bloom filter map value size
+    - selftests/ftrace: Fix event filter target_func selection
+    - kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
+    - ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3
+      suspend
+    - regulator: tps65132: Add of_match table
+    - OSS: dmasound/paula: Mark driver struct with __refdata to prevent section
+      mismatch
+    - scsi: ufs: core: WLUN suspend dev/link state error recovery
+    - scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN
+    - scsi: ufs: core: Fix MCQ mode dev command timeout
+    - ALSA: line6: Zero-initialize message buffers
+    - block: fix overflow in blk_ioctl_discard()
+    - ASoC: codecs: ES8326: Solve error interruption issue
+    - ASoC: codecs: ES8326: modify clock table
+    - net: bcmgenet: Reset RBUF on first open
+    - vboxsf: explicitly deny setlease attempts
+    - ata: sata_gemini: Check clk_enable() result
+    - firewire: ohci: mask bus reset interrupts between ISR and bottom half
+    - tools/power turbostat: Fix added raw MSR output
+    - tools/power turbostat: Increase the limit for fd opened
+    - tools/power turbostat: Fix Bzy_MHz documentation typo
+    - tools/power turbostat: Do not print negative LPI residency
+    - tools/power turbostat: Expand probe_intel_uncore_frequency()
+    - tools/power turbostat: Print ucode revision only if valid
+    - tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read
+    - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
+    - btrfs: always clear PERTRANS metadata during commit
+    - memblock tests: fix undefined reference to `early_pfn_to_nid'
+    - memblock tests: fix undefined reference to `panic'
+    - memblock tests: fix undefined reference to `BIT'
+    - nouveau/gsp: Avoid addressing beyond end of rpc->entries
+    - scsi: target: Fix SELinux error when systemd-modules loads the target module
+    - scsi: hisi_sas: Handle the NCQ error returned by D2H frame
+    - blk-iocost: avoid out of bounds shift
+    - accel/ivpu: Remove d3hot_after_power_off WA
+    - accel/ivpu: Improve clarity of MMU error messages
+    - accel/ivpu: Fix missed error message after VPU rename
+    - platform/x86: acer-wmi: Add support for Acer PH18-71
+    - gpu: host1x: Do not setup DMA for virtual devices
+    - MIPS: scall: Save thread_info.syscall unconditionally on entry
+    - tools/power/turbostat: Fix uncore frequency file string
+    - net: add copy_safe_from_sockptr() helper
+    - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
+    - drm/amdgpu: Refine IB schedule error logging
+    - drm/amd/display: add DCN 351 version for microcode load
+    - drm/amdgpu: add smu 14.0.1 discovery support
+    - drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
+    - drm/amd/display: Skip on writeback when it's not applicable
+    - drm/amd/pm: fix the high voltage issue after unload
+    - drm/amdgpu: Fix VCN allocation in CPX partition
+    - amd/amdkfd: sync all devices to wait all processes being evicted
+    - selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
+    - Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
+    - Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
+    - hv_netvsc: Don't free decrypted memory
+    - uio_hv_generic: Don't free decrypted memory
+    - Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
+    - drm/xe/xe_migrate: Cast to output precision before multiplying operands
+    - drm/xe: Label RING_CONTEXT_CONTROL as masked
+    - smb3: fix broken reconnect when password changing on the server by allowing
+      password rotation
+    - iommu: mtk: fix module autoloading
+    - fs/9p: only translate RWX permissions for plain 9P2000
+    - fs/9p: translate O_TRUNC into OTRUNC
+    - fs/9p: fix the cache always being enabled on files with qid flags
+    - 9p: explicitly deny setlease attempts
+    - powerpc/crypto/chacha-p10: Fix failure on non Power10
+    - gpio: wcove: Use -ENOTSUPP consistently
+    - gpio: crystalcove: Use -ENOTSUPP consistently
+    - clk: Don't hold prepare_lock when calling kref_put()
+    - fs/9p: remove erroneous nlink init from legacy stat2inode
+    - fs/9p: drop inodes immediately on non-.L too
+    - gpio: lpc32xx: fix module autoloading
+    - drm/nouveau/dp: Don't probe eDP ports twice harder
+    - platform/x86/amd: pmf: Decrease error message to debug
+    - platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
+    - drm/radeon: silence UBSAN warning (v3)
+    - net:usb:qmi_wwan: support Rolling modules
+    - blk-iocost: do not WARN if iocg was already offlined
+    - SUNRPC: add a missing rpc_stat for TCP TLS
+    - qibfs: fix dentry leak
+    - xfrm: Preserve vlan tags for transport mode software GRO
+    - ARM: 9381/1: kasan: clear stale stack poison
+    - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
+    - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
+    - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
+    - Bluetooth: msft: fix slab-use-after-free in msft_do_close()
+    - arm64: dts: mediatek: mt8183-pico6: Fix bluetooth node
+    - Bluetooth: HCI: Fix potential null-ptr-deref
+    - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
+    - net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
+    - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
+    - hwmon: (corsair-cpro) Use a separate buffer for sending commands
+    - hwmon: (corsair-cpro) Use complete_all() instead of complete() in
+      ccp_raw_event()
+    - hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
+    - phonet: fix rtm_phonet_notify() skb allocation
+    - netlink: specs: Add missing bridge linkinfo attrs
+    - nfc: nci: Fix kcov check in nci_rx_work()
+    - net: bridge: fix corrupted ethernet header on multicast-to-unicast
+    - ipv6: Fix potential uninit-value access in __ip6_make_skb()
+    - selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC
+    - rxrpc: Fix the names of the fields in the ACK trailer struct
+    - rxrpc: Fix congestion control algorithm
+    - rxrpc: Only transmit one ACK per jumbo packet received
+    - dt-bindings: net: mediatek: remove wrongly added clocks and SerDes
+    - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
+    - net-sysfs: convert dev->operstate reads to lockless ones
+    - hsr: Simplify code for announcing HSR nodes timer setup
+    - ipv6: annotate data-races around cnf.disable_ipv6
+    - ipv6: prevent NULL dereference in ip6_output()
+    - net/smc: fix neighbour and rtable leak in smc_ib_find_route()
+    - net: hns3: using user configure after hardware reset
+    - net: hns3: direct return when receive a unknown mailbox message
+    - net: hns3: change type of numa_node_mask as nodemask_t
+    - net: hns3: release PTP resources if pf initialization failed
+    - net: hns3: use appropriate barrier function after setting a bit value
+    - net: hns3: fix port vlan filter not disabled issue
+    - net: hns3: fix kernel crash when devlink reload during initialization
+    - net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family
+    - drm/meson: dw-hdmi: power up phy on device init
+    - drm/meson: dw-hdmi: add bandgap setting for g12
+    - drm/connector: Add \n to message about demoting connector force-probes
+    - dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11
+      users
+    - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
+    - gpiolib: cdev: fix uninitialised kfifo
+    - drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible
+    - drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
+    - firewire: nosy: ensure user_length is taken into account when fetching
+      packet contents
+    - Reapply "drm/qxl: simplify qxl_fence_wait"
+    - usb: typec: ucsi: Check for notifications after init
+    - usb: typec: ucsi: Fix connector check on init
+    - usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed
+      device
+    - usb: ohci: Prevent missed ohci interrupts
+    - USB: core: Fix access violation during port device removal
+    - usb: gadget: composite: fix OS descriptors w_value logic
+    - usb: gadget: uvc: use correct buffer size when parsing configfs lists
+    - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
+    - usb: gadget: f_fs: Fix a race condition when processing setup packets.
+    - usb: xhci-plat: Don't include xhci.h
+    - usb: dwc3: core: Prevent phy suspend during init
+    - usb: typec: tcpm: clear pd_event queue in PORT_RESET
+    - usb: typec: tcpm: unregister existing source caps before re-registration
+    - usb: typec: tcpm: Check for port partner validity before consuming it
+    - ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
+    - ALSA: hda/realtek: Fix conflicting PCI SSID 17aa:386f for Lenovo Legion
+      models
+    - firewire: ohci: fulfill timestamp for some local asynchronous transaction
+    - mm/slub: avoid zeroing outside-object freepointer for single free
+    - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
+    - btrfs: set correct ram_bytes when splitting ordered extent
+    - btrfs: qgroup: do not check qgroup inherit if qgroup is disabled
+    - btrfs: make sure that WRITTEN is set on all metadata blocks
+    - maple_tree: fix mas_empty_area_rev() null pointer dereference
+    - mm/slab: make __free(kfree) accept error pointers
+    - mptcp: ensure snd_nxt is properly initialized on connect
+    - mptcp: only allow set existing scheduler for net.mptcp.scheduler
+    - workqueue: Fix selection of wake_cpu in kick_pool()
+    - dt-bindings: iio: health: maxim,max30102: fix compatible check
+    - iio:imu: adis16475: Fix sync mode setting
+    - iio: pressure: Fixes BME280 SPI driver data
+    - iio: pressure: Fixes SPI support for BMP3xx devices
+    - iio: accel: mxc4005: Interrupt handling fixes
+    - iio: accel: mxc4005: Reset chip on probe() and resume()
+    - kmsan: compiler_types: declare __no_sanitize_or_inline
+    - e1000e: change usleep_range to udelay in PHY mdic access
+    - tipc: fix UAF in error path
+    - xtensa: fix MAKE_PC_FROM_RA second argument
+    - net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
+    - net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
+    - net: bcmgenet: synchronize UMAC_CMD access
+    - ASoC: tegra: Fix DSPK 16-bit playback
+    - ASoC: ti: davinci-mcasp: Fix race condition during probe
+    - dyndbg: fix old BUG_ON in >control parser
+    - slimbus: qcom-ngd-ctrl: Add timeout for wait operation
+    - clk: samsung: Revert "clk: Use device_get_match_data()"
+    - clk: sunxi-ng: common: Support minimum and maximum rate
+    - clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI
+    - mei: me: add lunar lake point M DID
+    - drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()
+    - Revert "drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()"
+    - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
+    - drm/ttm: Print the memory decryption status just once
+    - drm/vmwgfx: Fix Legacy Display Unit
+    - drm/vmwgfx: Fix invalid reads in fence signaled events
+    - drm/imagination: Ensure PVR_MIPS_PT_PAGE_COUNT is never zero
+    - drm/amd/display: Fix idle optimization checks for multi-display and dual eDP
+    - drm/nouveau/gsp: Use the sg allocator for level 2 of radix3
+    - drm/i915/gt: Automate CCS Mode setting during engine resets
+    - drm/i915/bios: Fix parsing backlight BDB data
+    - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
+    - drm/amd/display: Fix incorrect DSC instance for MST
+    - arm64: dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration
+    - iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()
+    - net: fix out-of-bounds access in ops_init
+    - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
+    - misc/pvpanic-pci: register attributes via pci_driver
+    - x86/apic: Don't access the APIC when disabling x2APIC
+    - selftests/mm: fix powerpc ARCH check
+    - mm: use memalloc_nofs_save() in page_cache_ra_order()
+    - mm/userfaultfd: reset ptes when close() for wr-protected ones
+    - iommu/amd: Enhance def_domain_type to handle untrusted device
+    - fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan
+    - fs/proc/task_mmu: fix uffd-wp confusion in pagemap_scan_pmd_entry()
+    - nvme-pci: Add quirk for broken MSIs
+    - regulator: core: fix debugfs creation regression
+    - spi: microchip-core-qspi: fix setting spi bus clock rate
+    - ksmbd: off ipv6only for both ipv4/ipv6 binding
+    - ksmbd: avoid to send duplicate lease break notifications
+    - ksmbd: do not grant v2 lease if parent lease key and epoch are not set
+    - tracefs: Reset permissions on remount if permissions are options
+    - tracefs: Still use mount point as default permissions for instances
+    - eventfs: Do not treat events directory different than other directories
+    - Bluetooth: qca: fix invalid device address check
+    - Bluetooth: qca: fix wcn3991 device address check
+    - Bluetooth: qca: add missing firmware sanity checks
+    - Bluetooth: qca: fix NVM configuration parsing
+    - Bluetooth: qca: generalise device address check
+    - Bluetooth: qca: fix info leak when fetching board id
+    - Bluetooth: qca: fix info leak when fetching fw build id
+    - Bluetooth: qca: fix firmware check error path
+    - keys: Fix overwrite of key expiration on instantiation
+    - Linux 6.8.10
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337)
+    - cifs: Fix reacquisition of volume cookie on still-live connection
+    - smb: client: fix rename(2) regression against samba
+    - cifs: reinstate original behavior again for forceuid/forcegid
+    - HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc
+    - HID: logitech-dj: allow mice to use all types of reports
+    - arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f
+    - arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 Puma
+    - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
+    - arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
+    - arm64: dts: rockchip: Fix the i2c address of es8316 on Cool Pi CM5
+    - arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts
+    - arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
+    - arm64: dts: mediatek: mt8192: Add missing gce-client-reg to mutex
+    - arm64: dts: mediatek: mt8195: Add missing gce-client-reg to vpp/vdosys
+    - arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex
+    - arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex1
+    - arm64: dts: mediatek: cherry: Describe CPU supplies
+    - arm64: dts: mediatek: mt8192-asurada: Update min voltage constraint for
+      MT6315
+    - arm64: dts: mediatek: mt8195-cherry: Update min voltage constraint for
+      MT6315
+    - arm64: dts: mediatek: mt8183-kukui: Use default min voltage for MT6358
+    - arm64: dts: mediatek: mt7622: fix clock controllers
+    - arm64: dts: mediatek: mt7622: fix IR nodename
+    - arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
+    - arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
+    - arm64: dts: mediatek: mt7986: reorder properties
+    - arm64: dts: mediatek: mt7986: drop invalid properties from ethsys
+    - arm64: dts: mediatek: mt7986: drop "#reset-cells" from Ethernet controller
+    - arm64: dts: mediatek: mt7986: reorder nodes
+    - arm64: dts: mediatek: mt7986: drop invalid thermal block clock
+    - arm64: dts: mediatek: mt7986: prefix BPI-R3 cooling maps with "map-"
+    - arm64: dts: mediatek: mt2712: fix validation errors
+    - arm64: dts: rockchip: mark system power controller and fix typo on
+      orangepi-5-plus
+    - arm64: dts: rockchip: regulator for sd needs to be always on for BPI-R2Pro
+    - block: fix module reference leakage from bdev_open_by_dev error path
+    - arm64: dts: qcom: Fix type of "wdog" IRQs for remoteprocs
+    - arm64: dts: qcom: x1e80100: Fix the compatible for cluster idle states
+    - arm64: dts: qcom: sc8180x: Fix ss_phy_irq for secondary USB controller
+    - gpio: tangier: Use correct type for the IRQ chip data
+    - ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
+    - wifi: mac80211: clean up assignments to pointer cache.
+    - wifi: mac80211: split mesh fast tx cache into local/proxied/forwarded
+    - wifi: iwlwifi: mvm: remove old PASN station when adding a new one
+    - wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd
+    - drm/gma500: Remove lid code
+    - wifi: mac80211_hwsim: init peer measurement result
+    - wifi: mac80211: remove link before AP
+    - wifi: mac80211: fix unaligned le16 access
+    - net: libwx: fix alloc msix vectors failed
+    - vxlan: drop packets from invalid src-address
+    - net: bcmasp: fix memory leak when bringing down interface
+    - mlxsw: core: Unregister EMAD trap using FORWARD action
+    - mlxsw: core_env: Fix driver initialization with old firmware
+    - mlxsw: pci: Fix driver initialization with old firmware
+    - ARM: dts: microchip: at91-sama7g5ek: Replace regulator-suspend-voltage with
+      the valid property
+    - icmp: prevent possible NULL dereferences from icmp_build_probe()
+    - bridge/br_netlink.c: no need to return void function
+    - bnxt_en: refactor reset close code
+    - bnxt_en: Fix the PCI-AER routines
+    - bnxt_en: Fix error recovery for 5760X (P7) chips
+    - cxl/core: Fix potential payload size confusion in cxl_mem_get_poison()
+    - net: dsa: mv88e6xx: fix supported_interfaces setup in
+      mv88e6250_phylink_get_caps()
+    - NFC: trf7970a: disable all regulators on removal
+    - netfs: Fix writethrough-mode error handling
+    - ax25: Fix netdev refcount issue
+    - soc: mediatek: mtk-svs: Append "-thermal" to thermal zone names
+    - tools: ynl: don't ignore errors in NLMSG_DONE messages
+    - net: usb: ax88179_178a: stop lying about skb->truesize
+    - tcp: Fix Use-After-Free in tcp_ao_connect_init
+    - net: gtp: Fix Use-After-Free in gtp_dellink
+    - net: phy: mediatek-ge-soc: follow netdev LED trigger semantics
+    - gpio: tegra186: Fix tegra186_gpio_is_accessible() check
+    - drm/xe: Remove sysfs only once on action add failure
+    - drm/xe: call free_gsc_pkt only once on action add failure
+    - Bluetooth: hci_event: Use HCI error defines instead of magic values
+    - Bluetooth: hci_conn: Only do ACL connections sequentially
+    - Bluetooth: Remove pending ACL connection attempts
+    - Bluetooth: hci_conn: Always use sk_timeo as conn_timeout
+    - Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync
+    - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue
+    - Bluetooth: hci_sync: Attempt to dequeue connection attempt
+    - Bluetooth: ISO: Reassemble PA data for bcast sink
+    - Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync
+    - Bluetooth: btusb: Fix triggering coredump implementation for QCA
+    - Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE
+    - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID
+    - Bluetooth: btusb: mediatek: Fix double free of skb in coredump
+    - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor
+    - Bluetooth: qca: set power_ctrl_enabled on NULL returned by
+      gpiod_get_optional()
+    - ipvs: Fix checksumming on GSO of SCTP packets
+    - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
+    - mlxsw: Use refcount_t for reference counting
+    - mlxsw: spectrum_acl_tcam: Fix race in region ID allocation
+    - mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
+    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
+    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
+    - mlxsw: spectrum_acl_tcam: Rate limit error message
+    - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
+    - mlxsw: spectrum_acl_tcam: Fix warning during rehash
+    - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
+    - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
+    - eth: bnxt: fix counting packets discarded due to OOM and netpoll
+    - ARM: dts: imx6ull-tarragon: fix USB over-current polarity
+    - netfilter: nf_tables: honor table dormant flag from netdev release event
+      path
+    - net: phy: dp83869: Fix MII mode failure
+    - net: ti: icssg-prueth: Fix signedness bug in prueth_init_rx_chns()
+    - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
+    - i40e: Report MFS in decimal base instead of hex
+    - iavf: Fix TC config comparison with existing adapter TC config
+    - ice: fix LAG and VF lock dependency in ice_reset_vf()
+    - net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
+    - octeontx2-af: fix the double free in rvu_npc_freemem()
+    - dpll: check that pin is registered in __dpll_pin_unregister()
+    - dpll: fix dpll_pin_on_pin_register() for multiple parent pins
+    - tls: fix lockless read of strp->msg_ready in ->poll
+    - af_unix: Suppress false-positive lockdep splat for spin_lock() in
+      __unix_gc().
+    - netfs: Fix the pre-flush when appending to a file in writethrough mode
+    - drm/amd/display: Check DP Alt mode DPCS state via DMUB
+    - Revert "drm/amd/display: fix USB-C flag update after enc10 feature init"
+    - xhci: move event processing for one interrupter to a separate function
+    - usb: xhci: correct return value in case of STS_HCE
+    - KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled
+    - KVM: x86/pmu: Set enable bits for GP counters in PERF_GLOBAL_CTRL at "RESET"
+    - drm: add drm_gem_object_is_shared_for_memory_stats() helper
+    - drm/amdgpu: add shared fdinfo stats
+    - drm/amdgpu: fix visible VRAM handling during faults
+    - Revert "UBUNTU: SAUCE: selftests/seccomp: fix check of fds being assigned"
+    - selftests/seccomp: user_notification_addfd check nextfd is available
+    - selftests/seccomp: Change the syscall used in KILL_THREAD test
+    - selftests/seccomp: Handle EINVAL on unshare(CLONE_NEWPID)
+    - x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range
+    - x86/cpu: Fix check for RDPKRU in __show_regs()
+    - rust: phy: implement `Send` for `Registration`
+    - rust: kernel: require `Send` for `Module` implementations
+    - rust: don't select CONSTRUCTORS
+    - [Config] updateconfigs to drop CONSTRUCTORS for rust
+    - rust: init: remove impl Zeroable for Infallible
+    - rust: make mutually exclusive with CFI_CLANG
+    - kbuild: rust: remove unneeded `@rustc_cfg` to avoid ICE
+    - kbuild: rust: force `alloc` extern to allow "empty" Rust files
+    - rust: remove `params` from `module` macro example
+    - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
+    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
+    - Bluetooth: qca: fix NULL-deref on non-serdev suspend
+    - Bluetooth: qca: fix NULL-deref on non-serdev setup
+    - mtd: rawnand: qcom: Fix broken OP_RESET_DEVICE command in
+      qcom_misc_cmd_type_exec()
+    - mm/hugetlb: fix missing hugetlb_lock for resv uncharge
+    - mmc: sdhci-msm: pervent access to suspended controller
+    - mmc: sdhci-of-dwcmshc: th1520: Increase tuning loop count to 128
+    - mm: create FOLIO_FLAG_FALSE and FOLIO_TYPE_OPS macros
+    - mm: support page_mapcount() on page_has_type() pages
+    - mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
+    - smb: client: Fix struct_group() usage in __packed structs
+    - smb3: missing lock when picking channel
+    - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result
+    - btrfs: fallback if compressed IO fails for ENOSPC
+    - btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range()
+    - btrfs: scrub: run relocation repair when/only needed
+    - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
+    - x86/tdx: Preserve shared bit on mprotect()
+    - cpu: Re-enable CPU mitigations by default for !X86 architectures
+    - [Config] updateconfigs for CPU_MITIGATIONS
+    - eeprom: at24: fix memory corruption race condition
+    - LoongArch: Fix callchain parse error with kernel tracepoint events
+    - LoongArch: Fix access error when read fault on a write-only VMA
+    - arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP
+    - arm64: dts: qcom: sm8450: Fix the msi-map entries
+    - arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
+    - dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
+    - dmaengine: xilinx: xdma: Fix wrong offsets in the buffers addresses in dma
+      descriptor
+    - dmaengine: xilinx: xdma: Fix synchronization issue
+    - drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
+    - drm/amdgpu: Assign correct bits for SDMA HDP flush
+    - drm/atomic-helper: fix parameter order in drm_format_conv_state_copy() call
+    - drm/amdgpu/pm: Remove gpu_od if it's an empty directory
+    - drm/amdgpu/umsch: don't execute umsch test when GPU is in reset/suspend
+    - drm/amdgpu: Fix leak when GPU memory allocation fails
+    - drm/amdkfd: Fix rescheduling of restore worker
+    - drm/amdkfd: Fix eviction fence handling
+    - irqchip/gic-v3-its: Prevent double free on error
+    - ACPI: CPPC: Use access_width over bit_width for system memory accesses
+    - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
+    - ACPI: CPPC: Fix access width used for PCC registers
+    - net/mlx5e: Advertise mlx5 ethernet driver updates sk_buff md_dst for MACsec
+    - ethernet: Add helper for assigning packet type when dest address does not
+      match device address
+    - net: b44: set pause params only when interface is up
+    - macsec: Enable devices to advertise whether they update sk_buff md_dst
+      during offloads
+    - macsec: Detect if Rx skb is macsec-related for offloading devices that
+      update md_dst
+    - stackdepot: respect __GFP_NOLOCKDEP allocation flag
+    - fbdev: fix incorrect address computation in deferred IO
+    - udp: preserve the connected status if only UDP cmsg
+    - mtd: limit OTP NVMEM cell parse to non-NAND devices
+    - mtd: diskonchip: work around ubsan link failure
+    - firmware: qcom: uefisecapp: Fix memory related IO errors and crashes
+    - phy: qcom: qmp-combo: Fix register base for QSERDES_DP_PHY_MODE
+    - phy: qcom: qmp-combo: Fix VCO div offset on v3
+    - mm: turn folio_test_hugetlb into a PageType
+    - mm: zswap: fix shrinker NULL crash with cgroup_disable=memory
+    - dmaengine: owl: fix register access functions
+    - dmaengine: tegra186: Fix residual calculation
+    - idma64: Don't try to serve interrupts when device is powered off
+    - soundwire: amd: fix for wake interrupt handling for clockstop mode
+    - phy: marvell: a3700-comphy: Fix hardcoded array size
+    - phy: freescale: imx8m-pcie: fix pcie link-up instability
+    - phy: rockchip-snps-pcie3: fix bifurcation on rk3588
+    - phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits
+    - phy: rockchip: naneng-combphy: Fix mux on rk3588
+    - phy: qcom: m31: match requested regulator name with dt schema
+    - dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue
+    - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
+    - riscv: Fix TASK_SIZE on 64-bit NOMMU
+    - riscv: Fix loading 64-bit NOMMU kernels past the start of RAM
+    - phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered
+    - dt-bindings: eeprom: at24: Fix ST M24C64-D compatible schema
+    - sched/eevdf: Always update V if se->on_rq when reweighting
+    - sched/eevdf: Fix miscalculation in reweight_entity() when se is not curr
+    - riscv: hwprobe: fix invalid sign extension for RISCV_HWPROBE_EXT_ZVFHMIN
+    - RISC-V: selftests: cbo: Ensure asm operands match constraints, take 2
+    - phy: qcom: qmp-combo: fix VCO div offset on v5_5nm and v6
+    - bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
+    - Bluetooth: hci_sync: Fix UAF in hci_acl_create_conn_sync
+    - Bluetooth: hci_sync: Fix UAF on create_le_conn_complete
+    - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync
+    - Linux 6.8.9
+  * amdgpu hangs on DCN 3.5 at bootup: RIP:
+    0010:dcn35_clk_mgr_construct+0x183/0x2210 [amdgpu] (LP: #2066233)
+    - drm/amd/display: Atom Integrated System Info v2_2 for DCN35
+  * [MTL] ACPI: PM: s2idle: Backport Linux ACPI s2idle patches to fix
+    suspend/resume issue (LP: #2069231)
+    - ACPI: PM: s2idle: Enable Low-Power S0 Idle MSFT UUID for non-AMD systems
+    - ACPI: PM: s2idle: Evaluate all Low-Power S0 Idle _DSM functions
+  * Removing legacy virtio-pci devices causes kernel panic (LP: #2067862)
+    - virtio-pci: Check if is_avq is NULL
+  * Mute/mic LEDs no function on ProBook 445/465 G11 (LP: #2069664)
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465 G11.
+  * Mute/mic LEDs no function on  ProBook 440/460 G11 (LP: #2067669)
+    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11.
+  * rtw89_8852ce - Lost WIFI connection after suspend  (LP: #2065128)
+    - wifi: rtw89: reset AFEDIG register in power off sequence
+    - wifi: rtw89: 8852c: refine power sequence to imporve power consumption
+  * CVE-2024-25742
+    - x86/sev: Harden #VC instruction emulation somewhat
+    - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337) //
+    CVE-2024-35984
+    - i2c: smbus: fix NULL function pointer dereference
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337) //
+    CVE-2024-35990
+    - dma: xilinx_dpdma: Fix locking
+  * Noble update: v6.8.9 upstream stable release (LP: #2070337) //
+    CVE-2024-35997
+    - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
+  * CVE-2024-36016
+    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
+  * CVE-2024-36008
+    - ipv4: check for NULL idev in ip_route_use_hint()
+  * CVE-2024-35992
+    - phy: marvell: a3700-comphy: Fix out of bounds read
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 12 Aug 2024 10:40:26 +0900
+
+linux-qcom (6.8.0-1006.6) jammy; urgency=medium
+
+  * [qcom alpha] Suppress noisy logs
+    - SAUCE: ubuntu/qcom/wlan: supress noisy logs
+    - SAUCE: ubuntu/qcom/wlan: supress noisy logs (take 2)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: ubuntu/qcom/wlan: import wlan qclacld driver code from GA1.1
+    - SAUCE: ubuntu/qcom/display: import qcm6490 display code from GA1.1
+    - SAUCE: ubuntu/qcom/graphics: import qcm6490 graphics driver code from GA1.1
+    - SAUCE: ubuntu/qcom/camera: import qcm6490 camera driver code from GA1.1
+    - SAUCE: ubuntu/qcom/bt: import qcm6490 bluetooth driver from GA1.1
+    - SAUCE: ubuntu/qcom/qps615: import ethernet driver from GA1.1
+    - SAUCE: ubuntu/qcom: build external drivers
+    - SAUCE: ubuntu/qcom: suppress warning and error
+    - SAUCE: ubuntu/qcom/wlan: fix build warnings and errors in WLAN driver
+    - SAUCE: ubuntu/qcom/graphics: change strtobool() to kstrtobool()
+    - SAUCE: ubuntu/qcom/graphics: dynamically allocate the kgsl-pool shrinker for
+      kernel>=6.7
+    - SAUCE: ubuntu/qcom/camera: remove unused camera_banner
+    - SAUCE: ubuntu/qcom/camera: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: ubuntu/qcom/camera: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: replace strlcpy() with strscpy()
+    - SAUCE: ubuntu/qcom/qps615: auto-load module
+    - SAUCE: ubuntu/qcom: add missing inclusion
+    - SAUCE: ubuntu/qcom/display: Rename min_buffers_needed to min_queued_buffers
+    - SAUCE: ubuntu/qcom: remove DRM_UNLOCKED
+    - SAUCE: ubuntu/qcom/display: suppress EPROBE_DEFER error log
+    - SAUCE: qcom/bt: support uevent module loading
+    - SAUCE: qcom/bt: add sentinel to MODULE_DEVICE_TABLE()
+    - SAUCE: import external DT from GA 1.1
+    - SAUCE: Add Makefile code to apply overlays for GA1
+
+  * Miscellaneous upstream changes
+    - QCLINUX: regulator: qcom-rpmh-regulator: Add debug-regulator support
+    - PENDING: arm64: dts: qcom: qcs8550-rb5gen2: enable PMIC Volume and Power
+      buttons
+    - FROMLIST: dt-bindings: arm: qcom,ids: Add SoC ID for SM8650P
+    - FROMLIST: soc: qcom: socinfo: Add SM8650P SoC ID table entry
+    - PENDING: slimbus: messaging: use memcpy_fromio for io mapped memory
+    - FROMLIST: arm64: dts: qcom: sm8650p: introduce sm8650p dtsi
+    - FROMLIST: arm64: dts: qcom: add base AIM500 dtsi
+    - FROMLIST: arm64: dts: qcom: add AIM500 AIoT
+    - PENDING: arm64: qcom: dts: qcs8550: Add modem rproc node
+    - QCLINUX: soc: qcom: f_qdss: Initialize qdss channel with NULL
+    - PENDING: misc: fastrpc: Check for static PD status
+    - QCLINUX: soc: qcom: Use SoC watchdog when Linux boots in hyp mode
+    - QCLINUX: arm64: dts: qcom: qcm6490: Leave SoC watchdog enabled
+    - QCLINUX: arm64: Enable watchdog configuration through sysfs
+    - QCLINUX: soc: qcom: Make SoC debug module as builtin module
+    - FROMLIST: soc: qcom: aoss: Add tracepoints in qmp_send()
+    - PENDING: arm64: dts: qcom: sc7280: Add gpio for sec MI2S mclk
+    - QCLINUX: arm64: dts: qcom: Add addons support for AIM500 AIoT
+    - QCLINUX: arm64: defconfig: qcom: enable SM8650 related config
+    - QCLINUX: arm64: dts: qcom: aim300: Add board-id and msm-id support
+    - PENDING: misc: fastrpc: Fix use after free on devices
+    - PENDING: arm64: dts: qcom: qcs8550-rb5gen2: Add definition for three LEDs
+    - PENDING: arm64: dts: qcom: qcs8550-rb5gen2: Add definitions for flash leds
+    - PENDING: iommu/arm-smmu-qcom: Fix an empty list_head accessing
+    - PENDING: trece: buses: Change __assign_str to __assign_str_len
+    - PENDING: spi: spi-geni-qcom: add trace log support
+    - Revert "QCLINUX: arm64: configs: qcom_defconfig: Disable NVMEM_REBOOT_MODE"
+    - PENDING: i2c: i2c-qcom-geni: Add trace log support
+    - PENDING: arm64: dts: qcom: sm8550: add slimbus DT node
+    - PENDING: arm64: dts: qcm6490: Disable nvmem-reboot-mode
+    - QCLINUX: usb: dwc3: Initialize variable ret to 0
+    - QCLINUX: usb: dwc3: qcom: Take wakelock to block pm suspend in autosleep
+    - PENDING: soc: qcom: memory_dump: initialize initialized value
+    - PENDING: arm64: dts: qcom: qcs6490-rb3gen2: disable ipa node on qcs6490
+    - PENDING: arm64: dts: qcom: Enable PCIe1 on aim500
+    - QCLINUX: arm64: dts: qcom: Add support for qps615 switch
+    - QCLINUX: arm64: defconfig: Enable ARM64_VA=39
+    - PENDING: arm64: dts: qcom: qcs6490-rb3gen2: Modify DVT device USB2
+    - QCLINUX: virt: gunyah: Use kvcalloc for tracking large number of pages
+    - PENDING: firmware: Error handling in qcom_scm_prepare_ice_key
+    - PENDING: arm64: dts: qcom: sa8775p: Add UART node
+    - QCLINUX: arm64: dts: qcom: Rename regulators for QCM6490
+    - PENDING: power: supply: qcom_battmgr: Add support to configure USB ICL
+    - QCLINUX: soc: qcom: Don't assume that soc watchdog is enabled by default
+    - PENDING: arm64: dts: Add missing clkreq pin configuration
+    - PENDING: arm64: dts: qcom: sa8775p: Add GPI configuration
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for Rb3Gen2
+    - QCLINUX: arm64: defconfig: Add AQC107 config
+    - QCLINUX: usb: dwc3: qcom: Avoid PM Resume if device is RT suspended
+    - PENDING: Bluetooth: Increase settling time for baudrate change VSC
+    - PENDING: remoteproc: qcom: pas: Add SA8775p remoteproc support
+    - PENDING: arm64: dts: qcom: sa8775p: add ADSP and CDSP support
+    - QCLINUX: arm64: dts: qcom: sa8775p: add addons dts support for sa8775p
+    - PENDING: arm64: dts: qcom: sa8775p: enable CDSP for SA8775p
+    - PENDING: remoteproc: qcom: pas: Add SA8775p CDSP1 remoteproc support
+    - PENDING: arm64: dts: qcom: sa8775p: add CDSP1 support
+    - PENDING: arm64: dts: qcom: sa8775p: enable CDSP1 for SA8775p
+    - PENDING: dt-bindings: mailbox: qcom-ipcc: Add GPDSP0 and GPDSP1 client
+    - PENDING: remoteproc: qcom: pas: Add SA8775p GPDSP0 and GPDSP1 remoteproc
+      support
+    - PENDING: arm64: dts: qcom: sa8775p: add GPDSP0 and GPDSP1 support
+    - QCLINUX: arm64: defconfig: Enable STMMAC eth and Marvell phy config
+    - PENDING: uapi: add userspace interface file to uapi
+    - PENDING: soc: qcom: llcc: add llcc config support for SA8775p platform
+    - PENDING: arm64: dts: qcom: sa8775p: Add llcc support for SA8775p platform
+    - PENDING: arm64: dts: qcom: sa8775p-ride: Enable llcc function
+    - QCLINUX: arm64: defconfig: qcom: Enable i3c support
+    - PENDING: soc: qcom: smem: Add boundary checks for partitions
+    - PENDING: crypto: qce - Fetch interconnect bandwidth value from dtsi
+    - PENDING: arm64: dts: qcom: sc7280: Define interconnect bandwidth value in
+      dtsi
+    - QCLINUX: rpmsg: glink: replace deprecated 'strcpy' with 'strscpy'
+    - QCLINUX: arm64: defconfig: enable configs required for kubernetes
+    - PENDING: slimbus: ngd: Add check before memory free
+    - QCLINUX: arm64: dts: qcom: sa8775p: add dma-buf heaps
+    - QCLINUX: arm64: dts: qcom: sa8775p: add secure buffer device
+    - QCLINUX: arm64: dts: qcom: sa8775p: add mem-buf device
+    - QCLINUX: arm64: dts: qcm6490-addons: Update memory dump table
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add gunyah watchdog support
+    - PENDING: pcie: Save & restore configuration space for qps615
+    - QCLINUX: thermal: qcom: Add support to update tsens trip based on nvmem data
+    - PENDING: arm64: dts: qcom: sa8775p: Add IMEM and PIL info region
+    - QCLINUX: arm64: dts: qcom: sa8775p: define kaslr offset and mem dump table
+      regions
+    - QCLINUX: arm64: dts: qcom: sa8775p-ride: Add board-id and msm-id support
+    - QCLINUX: arm64: dts: qcom: sa8775p: Add shmbridge and smcinvoke nodes
+    - FROMLIST: arm64: dts: qcom: qcm8550: introduce qcs8550 dtsi
+    - PENDING: arm64: qcom: dts: qcs8550: Update included dtsi name for rb5gen2
+    - QCLINUX: arm64: dts: qcom: qcs8550: update qcs8550 addons dtsi file name
+    - PENDING: arm64: dts: qcom: sa8775p: enable ADSP and GPDSP for SA8775p
+    - PENDING: USB: pci-quirks: skip usb_early_handoff for Renesas PCI USB
+    - PENDING: coresight-tmc-etf: fix failure to disable/enable ETF after reading
+    - QCLINUX: PCI: qcom: Enable powering up upd controller
+    - QCLINUX: ASoC: qcm6490: Update channel slot number for slimbus codec dai
+    - PENDING: arm64: dts: qcom: aim500: Add more reserved gpio pins
+    - PENDING: soc: qcom: ice: Handle ice probe return
+    - PENDING: usb: dwc3: core: Handle failure of get sync during cable disconnect
+    - PENDING: arm64: dts: qcom: sa8775p: Enable smp2p-sleepstate
+    - QCLINUX: clk: qcom: gcc-sa8775p: Remove the HW control clocks on SA8775P
+    - PENDING: iris: Disable slice mode for VBR rate control
+    - PENDING: usb: dwc3: qcom: Introduce post-connection done vendor hook
+    - PENDING: misc: fastrpc: Add support for cdsp1 remoteproc
+    - QCLINUX: arm64: dts: qcom: Enable tsens dynamic trip update for qcm6490
+    - PENDING: crypto: qce - Bam crash during suspend-shutdown scenario
+    - PENDING: arm64: dts: qcom: sa8775p-ride: add Bluetooth support
+    - PENDING: arm64: dts: qcom: sa8775p: add CDSP1 fastrpc-compute-cb nodes
+    - PENDING: dt-bindings: clock: qcom: Add SA8775P video clock controller
+    - PENDING: clk: qcom: Add support for Video clock controller on SA8775P
+    - PENDING: dt-bindings: clock: qcom: Add SA8775P camera controller
+    - PENDING: clk: qcom: Add support for Camera Clock Controller on SA8775P
+    - PENDING: dt-bindings: clock: qcom: Add SA8775P display controller
+    - PENDING: clk: qcom: Add support for Display Controllers on SA8775P
+    - PENDING: clk: qcom: Remove the CLK_IS_CRITICAL flag for SA8775P
+    - QCLINUX: arm64: defconfig: enable Clock controllers SA8775P
+    - PENDING: arm64: dts: qcom: sa8775p: add clock controllers support
+    - QCLINUX: arm64: dts: qcs5430-rb3: Enable PCIE1
+    - FROMLIST: PCI: hold the rescan mutex when scanning for the first time
+    - FROMLIST: PCI/pwrctl: reuse the OF node for power controlled devices
+    - FROMLIST: PCI/pwrctl: create platform devices for child OF nodes of the port
+      node
+    - FROMLIST: PCI/pwrctl: add PCI power control core code
+    - FROMLIST: power: sequencing: implement the pwrseq core
+    - FROMLIST: power: pwrseq: add a driver for the PMU module on the QCom WCN
+      chipsets
+    - FROMLIST: PCI/pwrctl: add a PCI power control driver for power sequenced
+      devices
+    - PENDING: PCI/pwrctl: enable power control for WCN6855
+    - PENDING: power: pwrseq: add WCN6855 PMU support
+    - PENDING: arm64: dts: qcom: sa8775p-ride: add pmu node for WCN6855
+    - PENDING: Bluetooth: hci_qca: Drop unused event during BT on
+    - config: enable PCA953x PCA954x and ANX7625 driver
+    - PENDING: drm/bridge: anx7625: Fix circular dependency
+    - PENDING: iris: devicetree: remove iommu and video enc dec nodes
+    - PENDING: videocc: remove HW_CTRL from mvs0 gdsc
+    - PENDING: interconnect: qcom: sa8775p: enable qos programming
+    - PENDING: arm64: dts: qcom: sa8775p: Add reg field & clocks to program QoS
+    - PENDING: arm64: dts: qcom: Add SD Card node for qcm6490-rb3
+    - QCLINUX: arm64: dts: qcom: qcs6490: Add PCIe bridge and endpoint nodes
+    - QCLINUX: arm64: dts: qcom:Add QPS615 and PHY devicestree config
+    - QCLINUX: arm64: configs: qcom_defconfig: Enable NVMEM_REBOOT_MODE
+    - QCLINUX: arm64: defconfig: qcom: Disable ASPM
+    - PENDING: usb: dwc3: qcom: Check if driver is resumed before reg access
+    - PENDING: arm64: dts: qcom: sa8775p-ride: Change swctrl-gpios in BT
+    - PENDING: arm64: dts: qcom: sa8775p-pmics: enable rtc
+    - QCLINUX: arm64: dts: qcom: sa8775p-addons: Add CMA heap
+    - QCLINUX: arm64: defconfig: Enable vsock support
+    - QCLINUX: arm64: defconfig: Host kernel accelerator for virtio net
+    - QCLINUX: arm64: defconfig: Enable required virtio configs for VM
+    - QCLINUX: arm64: defconfig: Enable watchdog drivers for VM
+    - FROMLIST: drivers: qcom: icc-bwmon: Change zone1_thres_count to 3
+    - PENDING: crypto: qce - remove return values from qce_crypto_probe()
+    - thermal: re-add thermal_zone_set_trip()
+    - thermal: tsens: remove use of thermal_zone_device_exec()
+    - Revert "net: phylink: remove .validate() method"
+    - Ubuntu [Config] update configs for GA 1.1
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 23 Jul 2024 17:25:21 +0900
+
+linux-qcom (6.8.0-1005.5) jammy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] drop getabis data
+
+  * [RB3] Kernel back trace while audio play
+    - Revert "ASoC: qcom: Move Soundwire runtime stream alloc to soundcards"
+
+  * [qcom alpha] Suppress noisy logs
+    - SAUCE: ubuntu/qcom/wlan: supress noisy logs (take 2)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: qcom/bt: support uevent module loading
+    - SAUCE: qcom/bt: add sentinel to MODULE_DEVICE_TABLE()
+
+  [ Ubuntu: 6.8.0-38.38 ]
+
+  * noble/linux: 6.8.0-38.38 -proposed tracker (LP: #2068318)
+  * race_sched in ubuntu_stress_smoke_test will cause kernel panic on 6.8 with
+    Azure Standard_A2_v2 instance (LP: #2068024)
+    - sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()
+  * Noble: btrfs: re-introduce 'norecovery' mount option (LP: #2068591)
+    - btrfs: re-introduce 'norecovery' mount option
+  * Fix system hang while entering suspend with AMD Navi3x graphics
+    (LP: #2063417)
+    - drm/amdgpu/mes: fix use-after-free issue
+  * Noble update: v6.8.8 upstream stable release (LP: #2068087)
+    - io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64()
+      failure
+    - drm/i915/cdclk: Fix voltage_level programming edge case
+    - Revert "vmgenid: emit uevent when VMGENID updates"
+    - SUNRPC: Fix rpcgss_context trace event acceptor field
+    - selftests/ftrace: Limit length in subsystem-enable tests
+    - random: handle creditable entropy from atomic process context
+    - scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING
+    - net: usb: ax88179_178a: avoid writing the mac address before first reading
+    - btrfs: do not wait for short bulk allocation
+    - btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
+    - r8169: fix LED-related deadlock on module removal
+    - r8169: add missing conditional compiling for call to r8169_remove_leds
+    - scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5
+    - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
+    - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
+    - netfilter: br_netfilter: skip conntrack input hook for promisc packets
+    - netfilter: nft_set_pipapo: constify lookup fn args where possible
+    - netfilter: nft_set_pipapo: walk over current view on netlink dump
+    - netfilter: flowtable: validate pppoe header
+    - netfilter: flowtable: incorrect pppoe tuple
+    - af_unix: Call manage_oob() for every skb in unix_stream_read_generic().
+    - af_unix: Don't peek OOB data without MSG_OOB.
+    - net: sparx5: flower: fix fragment flags handling
+    - net/mlx5: Lag, restore buckets number to default after hash LAG deactivation
+    - net/mlx5: Restore mistakenly dropped parts in register devlink flow
+    - net/mlx5e: Prevent deadlock while disabling aRFS
+    - net: change maximum number of UDP segments to 128
+    - octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation
+    - selftests/tcp_ao: Make RST tests less flaky
+    - selftests/tcp_ao: Zero-init tcp_ao_info_opt
+    - selftests/tcp_ao: Fix fscanf() call for format-security
+    - selftests/tcp_ao: Printing fixes to confirm with format-security
+    - net: stmmac: Apply half-duplex-less constraint for DW QoS Eth only
+    - net: stmmac: Fix max-speed being ignored on queue re-init
+    - net: stmmac: Fix IP-cores specific MAC capabilities
+    - ice: tc: check src_vsi in case of traffic from VF
+    - ice: tc: allow zero flags in parsing tc flower
+    - ice: Fix checking for unsupported keys on non-tunnel device
+    - tun: limit printing rate when illegal packet received by tun dev
+    - net: dsa: mt7530: fix mirroring frames received on local port
+    - net: dsa: mt7530: fix port mirroring for MT7988 SoC switch
+    - s390/ism: Properly fix receive message buffer allocation
+    - netfilter: nf_tables: missing iterator type in lookup walk
+    - netfilter: nf_tables: restore set elements when delete set fails
+    - gpiolib: swnode: Remove wrong header inclusion
+    - netfilter: nf_tables: fix memleak in map from abort path
+    - net/sched: Fix mirred deadlock on device recursion
+    - net: ethernet: mtk_eth_soc: fix WED + wifi reset
+    - ravb: Group descriptor types used in Rx ring
+    - net: ravb: Count packets instead of descriptors in R-Car RX path
+    - net: ravb: Allow RX loop to move past DMA mapping errors
+    - net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them
+    - NFSD: fix endianness issue in nfsd4_encode_fattr4
+    - RDMA/rxe: Fix the problem "mutex_destroy missing"
+    - RDMA/cm: Print the old state when cm_destroy_id gets timeout
+    - RDMA/mlx5: Fix port number for counter query in multi-port configuration
+    - perf annotate: Make sure to call symbol__annotate2() in TUI
+    - perf lock contention: Add a missing NULL check
+    - s390/qdio: handle deferred cc1
+    - s390/cio: fix race condition during online processing
+    - iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest
+    - iommufd: Add config needed for iommufd_fail_nth
+    - drm: nv04: Fix out of bounds access
+    - drm/v3d: Don't increment `enabled_ns` twice
+    - userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE
+    - thunderbolt: Introduce tb_port_reset()
+    - thunderbolt: Introduce tb_path_deactivate_hop()
+    - thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4
+      routers
+    - thunderbolt: Reset topology created by the boot firmware
+    - drm/panel: visionox-rm69299: don't unregister DSI device
+    - drm/radeon: make -fstrict-flex-arrays=3 happy
+    - ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4
+    - thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()
+    - platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes
+    - interconnect: qcom: x1e80100: Remove inexistent ACV_PERF BCM
+    - interconnect: Don't access req_list while it's being manipulated
+    - clk: Remove prepare_lock hold assertion in __clk_release()
+    - clk: Initialize struct clk_core kref earlier
+    - clk: Get runtime PM before walking tree during disable_unused
+    - clk: Get runtime PM before walking tree for clk_summary
+    - clk: mediatek: Do a runtime PM get on controllers during probe
+    - clk: mediatek: mt7988-infracfg: fix clocks for 2nd PCIe port
+    - selftests/powerpc/papr-vpd: Fix missing variable initialization
+    - x86/bugs: Fix BHI retpoline check
+    - x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
+    - block: propagate partition scanning errors to the BLKRRPART ioctl
+    - net/mlx5: E-switch, store eswitch pointer before registering devlink_param
+    - ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages
+    - ALSA: hda/tas2781: correct the register for pow calibrated data
+    - ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N
+    - ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC
+    - usb: misc: onboard_usb_hub: Disable the USB hub clock on failure
+    - misc: rtsx: Fix rts5264 driver status incorrect when card removed
+    - thunderbolt: Avoid notify PM core about runtime PM resume
+    - thunderbolt: Fix wake configurations after device unplug
+    - thunderbolt: Do not create DisplayPort tunnels on adapters of the same
+      router
+    - comedi: vmk80xx: fix incomplete endpoint checking
+    - serial: mxs-auart: add spinlock around changing cts state
+    - serial/pmac_zilog: Remove flawed mitigation for rx irq flood
+    - serial: 8250_dw: Revert: Do not reclock if already at correct rate
+    - serial: stm32: Return IRQ_NONE in the ISR if no handling happend
+    - serial: stm32: Reset .throttled state in .startup()
+    - serial: core: Fix regression when runtime PM is not enabled
+    - serial: core: Clearing the circular buffer before NULLifying it
+    - serial: core: Fix missing shutdown and startup for serial base port
+    - USB: serial: option: add Fibocom FM135-GL variants
+    - USB: serial: option: add support for Fibocom FM650/FG650
+    - USB: serial: option: add Lonsung U8300/U9300 product
+    - USB: serial: option: support Quectel EM060K sub-models
+    - USB: serial: option: add Rolling RW101-GL and RW135-GL support
+    - USB: serial: option: add Telit FN920C04 rmnet compositions
+    - Revert "usb: cdc-wdm: close race between read and workqueue"
+    - usb: dwc2: host: Fix dereference issue in DDMA completion flow.
+    - usb: Disable USB3 LPM at shutdown
+    - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport
+      error
+    - usb: typec: tcpm: Correct the PDO counting in pd_set
+    - mei: me: disable RPL-S on SPS and IGN firmwares
+    - speakup: Avoid crash on very long word
+    - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
+    - sched: Add missing memory barrier in switch_mm_cid
+    - KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible
+    - KVM: x86/pmu: Disable support for adaptive PEBS
+    - KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms
+    - KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes
+    - KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
+    - arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H
+    - arm64: hibernate: Fix level3 translation fault in swsusp_save()
+    - init/main.c: Fix potential static_command_line memory overflow
+    - mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly
+    - mm/userfaultfd: allow hugetlb change protection upon poison entry
+    - mm,swapops: update check in is_pfn_swap_entry for hwpoison entries
+    - mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled
+    - mm/shmem: inline shmem_is_huge() for disabled transparent hugepages
+    - fuse: fix leaked ENOSYS error on first statx call
+    - drm/amdkfd: Fix memory leak in create_process failure
+    - drm/amdgpu: remove invalid resource->start check v2
+    - drm/ttm: stop pooling cached NUMA pages v2
+    - drm/xe: Fix bo leak in intel_fb_bo_framebuffer_init
+    - drm/vmwgfx: Fix prime import/export
+    - drm/vmwgfx: Sort primary plane formats by order of preference
+    - drm/vmwgfx: Fix crtc's atomic check conditional
+    - nouveau: fix instmem race condition around ptr stores
+    - bootconfig: use memblock_free_late to free xbc memory to buddy
+    - Squashfs: check the inode number is not the invalid value of zero
+    - nilfs2: fix OOB in nilfs_set_de_type
+    - fork: defer linking file vma until vma is fully initialized
+    - net: dsa: mt7530: fix improper frames on all 25MHz and 40MHz XTAL MT7530
+    - net: dsa: mt7530: fix enabling EEE on MT7531 switch on all boards
+    - ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
+    - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
+    - ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
+    - ksmbd: common: use struct_group_attr instead of struct_group for
+      network_open_info
+    - thunderbolt: Reset only non-USB4 host routers in resume
+    - Linux 6.8.8
+  * Fix inaudible HDMI/DP audio on USB-C MST dock (LP: #2064689)
+    - drm/i915/audio: Fix audio time stamp programming for DP
+  * Add Cirrus Logic CS35L56 amplifier support (LP: #2062135)
+    - ALSA: hda: realtek: Re-work CS35L41 fixups to re-use for other amps
+    - ALSA: hda/realtek: Add quirks for HP G11 Laptops using CS35L56
+  * net:fib_rule_tests.sh in ubuntu_kselftests_net fails on Noble (LP: #2066332)
+    - Revert "UBUNTU: SAUCE: selftests: net: fix "from" match test in
+      fib_rule_tests.sh"
+  * mtk_t7xx WWAN module fails to probe with: Invalid device status 0x1
+    (LP: #2049358)
+    - Revert "UBUNTU: SAUCE: net: wwan: t7xx: PCIe reset rescan"
+    - Revert "UBUNTU: SAUCE: net: wwan: t7xx: Add AP CLDMA"
+    - net: wwan: t7xx: Add AP CLDMA
+    - wwan: core: Add WWAN fastboot port type
+    - net: wwan: t7xx: Add sysfs attribute for device state machine
+    - net: wwan: t7xx: Infrastructure for early port configuration
+    - net: wwan: t7xx: Add fastboot WWAN port
+  * Pull-request to address TPM bypass issue (LP: #2037688)
+    - [Config]: Configure TPM drivers as builtins for arm64 in annotations
+  * re-enable Ubuntu FAN in the Noble kernel (LP: #2064508)
+    - SAUCE: fan: add VXLAN implementation
+    - SAUCE: fan: Fix NULL pointer dereference
+    - SAUCE: fan: support vxlan strict length validation
+  * update for V3 kernel bits and improved multiple fan slice support
+    (LP: #1470091) // re-enable Ubuntu FAN in the Noble kernel (LP: #2064508)
+    - SAUCE: fan: tunnel multiple mapping mode (v3)
+  * TCP memory  leak, slow network (arm64) (LP: #2045560)
+    - net: make SK_MEMORY_PCPU_RESERV tunable
+    - net: fix sk_memory_allocated_{add|sub} vs softirqs
+  * panel flickering after the i915.psr2 is enabled (LP: #2046315)
+    - drm/i915/alpm: Add ALPM register definitions
+    - drm/i915/psr: Add alpm_parameters struct
+    - drm/i915/alpm: Calculate ALPM Entry check
+    - drm/i915/alpm: Alpm aux wake configuration for lnl
+    - drm/i915/display: Make intel_dp_aux_fw_sync_len available for PSR code
+    - drm/i915/psr: Improve fast and IO wake lines calculation
+    - drm/i915/psr: Calculate IO wake and fast wake lines for DISPLAY_VER < 12
+    - drm/i915/display: Increase number of fast wake precharge pulses
+  * I2C HID device sometimes fails to initialize causing touchpad to not work
+    (LP: #2061040)
+    - HID: i2c-hid: Revert to await reset ACK before reading report descriptor
+  * Fix the RTL8852CE BT FW Crash based on SER false alarm (LP: #2060904)
+    - wifi: rtw89: disable txptctrl IMR to avoid flase alarm
+    - wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of
+      firmware command
+  * [X13s] Fingerprint reader is not working (LP: #2065376)
+    - SAUCE: arm64: dts: qcom: sc8280xp: Add USB DWC3 Multiport controller
+    - SAUCE: arm64: dts: qcom: sc8280xp-x13s: enable USB MP and fingerprint reader
+  * Fix random HuC/GuC initialization failure of Intel i915 driver
+    (LP: #2061049)
+    - drm/i915/huc: Allow for very slow HuC loading
+  * Add support of TAS2781 amp of audio (LP: #2064064)
+    - ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad
+      ICE-1
+  * Noble update: v6.8.7 upstream stable release (LP: #2065912)
+    - smb3: fix Open files on server counter going negative
+    - ata: libata-core: Allow command duration limits detection for ACS-4 drives
+    - ata: libata-scsi: Fix ata_scsi_dev_rescan() error path
+    - drm/amdgpu/vpe: power on vpe when hw_init
+    - batman-adv: Avoid infinite loop trying to resize local TT
+    - ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE
+    - ceph: switch to use cap_delay_lock for the unlink delay list
+    - virtio_net: Do not send RSS key if it is not supported
+    - arm64: tlb: Fix TLBI RANGE operand
+    - ARM: dts: imx7s-warp: Pass OV2680 link-frequencies
+    - raid1: fix use-after-free for original bio in raid1_write_request()
+    - ring-buffer: Only update pages_touched when a new page is touched
+    - Bluetooth: Fix memory leak in hci_req_sync_complete()
+    - drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11
+    - platform/chrome: cros_ec_uart: properly fix race condition
+    - ACPI: scan: Do not increase dep_unmet for already met dependencies
+    - PM: s2idle: Make sure CPUs will wakeup directly on resume
+    - media: cec: core: remove length check of Timer Status
+    - btrfs: tests: allocate dummy fs_info and root in test_find_delalloc()
+    - ARM: OMAP2+: fix bogus MMC GPIO labels on Nokia N8x0
+    - ARM: OMAP2+: fix N810 MMC gpiod table
+    - mmc: omap: fix broken slot switch lookup
+    - mmc: omap: fix deferred probe
+    - mmc: omap: restore original power up/down steps
+    - ARM: OMAP2+: fix USB regression on Nokia N8x0
+    - firmware: arm_ffa: Fix the partition ID check in ffa_notification_info_get()
+    - firmware: arm_scmi: Make raw debugfs entries non-seekable
+    - cxl/mem: Fix for the index of Clear Event Record Handle
+    - cxl/core/regs: Fix usage of map->reg_type in cxl_decode_regblock() before
+      assigned
+    - arm64: dts: freescale: imx8mp-venice-gw72xx-2x: fix USB vbus regulator
+    - arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix USB vbus regulator
+    - drm/msm: Add newlines to some debug prints
+    - drm/msm/dpu: don't allow overriding data from catalog
+    - drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more
+      sensible
+    - dt-bindings: display/msm: sm8150-mdss: add DP node
+    - arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order
+    - cxl/core: Fix initialization of mbox_cmd.size_out in get event
+    - Revert "drm/qxl: simplify qxl_fence_wait"
+    - nouveau: fix function cast warning
+    - drm/msm/adreno: Set highest_bank_bit for A619
+    - scsi: hisi_sas: Modify the deadline for ata_wait_after_reset()
+    - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
+    - net: openvswitch: fix unwanted error log on timeout policy probing
+    - u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
+    - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
+    - octeontx2-pf: Fix transmit scheduler resource leak
+    - block: fix q->blkg_list corruption during disk rebind
+    - lib: checksum: hide unused expected_csum_ipv6_magic[]
+    - geneve: fix header validation in geneve[6]_xmit_skb
+    - s390/ism: fix receive message buffer allocation
+    - bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()
+    - bnxt_en: Fix error recovery for RoCE ulp client
+    - bnxt_en: Reset PTP tx_avail after possible firmware reset
+    - ACPI: bus: allow _UID matching for integer zero
+    - base/node / ACPI: Enumerate node access class for 'struct access_coordinate'
+    - ACPI: HMAT: Introduce 2 levels of generic port access class
+    - ACPI: HMAT / cxl: Add retrieval of generic port coordinates for both access
+      classes
+    - cxl: Split out combine_coordinates() for common shared usage
+    - cxl: Split out host bridge access coordinates
+    - cxl: Remove checking of iter in cxl_endpoint_get_perf_coordinates()
+    - cxl: Fix retrieving of access_coordinates in PCIe path
+    - net: ks8851: Inline ks8851_rx_skb()
+    - net: ks8851: Handle softirqs at the end of IRQ thread to fix hang
+    - af_unix: Clear stale u->oob_skb.
+    - octeontx2-af: Fix NIX SQ mode and BP config
+    - ipv6: fib: hide unused 'pn' variable
+    - ipv4/route: avoid unused-but-set-variable warning
+    - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
+    - pds_core: use pci_reset_function for health reset
+    - pds_core: Fix pdsc_check_pci_health function to use work thread
+    - Bluetooth: ISO: Align broadcast sync_timeout with connection timeout
+    - Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters are unset
+    - Bluetooth: hci_sync: Use QoS to determine which PHY to scan
+    - Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY
+    - Bluetooth: SCO: Fix not validating setsockopt user input
+    - Bluetooth: RFCOMM: Fix not validating setsockopt user input
+    - Bluetooth: L2CAP: Fix not validating setsockopt user input
+    - Bluetooth: ISO: Fix not validating setsockopt user input
+    - Bluetooth: hci_sock: Fix not validating setsockopt user input
+    - Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit
+    - netfilter: complete validation of user input
+    - net/mlx5: SF, Stop waiting for FW as teardown was called
+    - net/mlx5: Register devlink first under devlink lock
+    - net/mlx5: offset comp irq index in name by one
+    - net/mlx5: Properly link new fs rules into the tree
+    - net/mlx5: Correctly compare pkt reformat ids
+    - net/mlx5e: RSS, Block changing channels number when RXFH is configured
+    - net/mlx5e: Fix mlx5e_priv_init() cleanup flow
+    - net/mlx5e: HTB, Fix inconsistencies with QoS SQs number
+    - net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit
+    - net: sparx5: fix wrong config being used when reconfiguring PCS
+    - Revert "s390/ism: fix receive message buffer allocation"
+    - net: dsa: mt7530: trap link-local frames regardless of ST Port State
+    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
+    - af_unix: Fix garbage collector racing against connect()
+    - net: ena: Fix potential sign extension issue
+    - net: ena: Wrong missing IO completions check order
+    - net: ena: Fix incorrect descriptor free behavior
+    - net: ena: Set tx_info->xdpf value to NULL
+    - drm/xe/display: Fix double mutex initialization
+    - drm/xe/hwmon: Cast result to output precision on left shift of operand
+    - tracing: hide unused ftrace_event_id_fops
+    - iommu/vt-d: Fix wrong use of pasid config
+    - iommu/vt-d: Allocate local memory for page request queue
+    - iommu/vt-d: Fix WARN_ON in iommu probe path
+    - io_uring: refactor DEFER_TASKRUN multishot checks
+    - io_uring: disable io-wq execution of multishot NOWAIT requests
+    - btrfs: qgroup: correctly model root qgroup rsv in convert
+    - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
+    - btrfs: record delayed inode root in transaction
+    - btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans
+    - io_uring/net: restore msg_control on sendzc retry
+    - kprobes: Fix possible use-after-free issue on kprobe registration
+    - fs/proc: remove redundant comments from /proc/bootconfig
+    - fs/proc: Skip bootloader comment if no embedded kernel parameters
+    - scsi: sg: Avoid sg device teardown race
+    - scsi: sg: Avoid race in error handling & drop bogus warn
+    - accel/ivpu: Check return code of ipc->lock init
+    - accel/ivpu: Fix PCI D0 state entry in resume
+    - accel/ivpu: Put NPU back to D3hot after failed resume
+    - accel/ivpu: Return max freq for DRM_IVPU_PARAM_CORE_CLOCK_RATE
+    - accel/ivpu: Fix deadlock in context_xa
+    - drm/vmwgfx: Enable DMA mappings with SEV
+    - drm/i915/vrr: Disable VRR when using bigjoiner
+    - drm/amdkfd: Reset GPU on queue preemption failure
+    - drm/ast: Fix soft lockup
+    - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
+    - drm/client: Fully protect modes[] with dev->mode_config.mutex
+    - drm/msm/dp: fix runtime PM leak on disconnect
+    - drm/msm/dp: fix runtime PM leak on connect failure
+    - drm/amdgpu/umsch: reinitialize write pointer in hw init
+    - arm64: dts: imx8qm-ss-dma: fix can lpcg indices
+    - arm64: dts: imx8-ss-dma: fix can lpcg indices
+    - arm64: dts: imx8-ss-dma: fix adc lpcg indices
+    - arm64: dts: imx8-ss-conn: fix usb lpcg indices
+    - arm64: dts: imx8-ss-dma: fix pwm lpcg indices
+    - arm64: dts: imx8-ss-lsio: fix pwm lpcg indices
+    - arm64: dts: imx8-ss-dma: fix spi lpcg indices
+    - vhost: Add smp_rmb() in vhost_vq_avail_empty()
+    - vhost: Add smp_rmb() in vhost_enable_notify()
+    - perf/x86: Fix out of range data
+    - x86/cpu: Actually turn off mitigations by default for
+      SPECULATION_MITIGATIONS=n
+    - selftests/timers/posix_timers: Reimplement check_timer_distribution()
+    - selftests: timers: Fix posix_timers ksft_print_msg() warning
+    - selftests: timers: Fix abs() warning in posix_timers test
+    - selftests: kselftest: Mark functions that unconditionally call exit() as
+      __noreturn
+    - x86/apic: Force native_apic_mem_read() to use the MOV instruction
+    - irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
+    - selftests: kselftest: Fix build failure with NOLIBC
+    - kernfs: annotate different lockdep class for of->mutex of writable files
+    - x86/bugs: Fix return type of spectre_bhi_state()
+    - x86/bugs: Fix BHI documentation
+    - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
+    - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
+    - x86/bugs: Fix BHI handling of RRSBA
+    - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
+    - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto
+    - [Config] updateconfigs to remove obsolete SPECTRE_BHI_AUTO
+    - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with
+      CONFIG_MITIGATION_SPECTRE_BHI
+    - [Config] updateconfigs to enable new MITIGATION_SPECTRE_BHI
+    - drm/i915/cdclk: Fix CDCLK programming order when pipes are active
+    - drm/i915/psr: Disable PSR when bigjoiner is used
+    - drm/i915: Disable port sync when bigjoiner is used
+    - drm/i915: Disable live M/N updates when using bigjoiner
+    - drm/amdgpu: Reset dGPU if suspend got aborted
+    - drm/amdgpu: always force full reset for SOC21
+    - drm/amdgpu: fix incorrect number of active RBs for gfx11
+    - drm/amdgpu: differentiate external rev id for gfx 11.5.0
+    - drm/amd/display: Program VSC SDP colorimetry for all DP sinks >= 1.4
+    - drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST
+    - drm/amd/display: Do not recursively call manual trigger programming
+    - drm/amd/display: Return max resolution supported by DWB
+    - drm/amd/display: always reset ODM mode in context when adding first plane
+    - drm/amd/display: fix disable otg wa logic in DCN316
+    - Linux 6.8.7
+  * Noble update: v6.8.6 upstream stable release (LP: #2065899)
+    - amdkfd: use calloc instead of kzalloc to avoid integer overflow
+    - wifi: ath9k: fix LNA selection in ath_ant_try_scan()
+    - wifi: rtw89: fix null pointer access when abort scan
+    - bnx2x: Fix firmware version string character counts
+    - net: stmmac: dwmac-starfive: Add support for JH7100 SoC
+    - net: phy: phy_device: Prevent nullptr exceptions on ISR
+    - wifi: rtw89: pci: validate RX tag for RXQ and RPQ
+    - wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor
+    - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
+    - wifi: iwlwifi: pcie: Add the PCI device id for new hardware
+    - arm64: dts: qcom: qcm6490-idp: Add definition for three LEDs
+    - net: dsa: qca8k: put MDIO controller OF node if unavailable
+    - arm64: dts: qcom: qrb2210-rb1: disable cluster power domains
+    - printk: For @suppress_panic_printk check for other CPU in panic
+    - panic: Flush kernel log buffer at the end
+    - dump_stack: Do not get cpu_sync for panic CPU
+    - wifi: iwlwifi: pcie: Add new PCI device id and CNVI
+    - cpuidle: Avoid potential overflow in integer multiplication
+    - ARM: dts: rockchip: fix rk3288 hdmi ports node
+    - ARM: dts: rockchip: fix rk322x hdmi ports node
+    - arm64: dts: rockchip: fix rk3328 hdmi ports node
+    - arm64: dts: rockchip: fix rk3399 hdmi ports node
+    - net: add netdev_lockdep_set_classes() to virtual drivers
+    - arm64: dts: qcom: qcs6490-rb3gen2: Declare GCC clocks protected
+    - pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
+    - pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain
+    - ACPI: resource: Add IRQ override quirk for ASUS ExpertBook B2502FBA
+    - ionic: set adminq irq affinity
+    - net: skbuff: add overflow debug check to pull/push helpers
+    - firmware: tegra: bpmp: Return directly after a failed kzalloc() in
+      get_filename()
+    - wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro
+    - wifi: mt76: mt7915: add locking for accessing mapped registers
+    - wifi: mt76: mt7996: disable AMSDU for non-data frames
+    - wifi: mt76: mt7996: add locking for accessing mapped registers
+    - ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of
+      CONFIG_X86_ANDROID_TABLETS
+    - ACPI: x86: Add DELL0501 handling to acpi_quirk_skip_serdev_enumeration()
+    - pstore/zone: Add a null pointer check to the psz_kmsg_read
+    - tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
+    - net: pcs: xpcs: Return EINVAL in the internal methods
+    - dma-direct: Leak pages on dma_set_decrypted() failure
+    - wifi: ath11k: decrease MHI channel buffer length to 8KB
+    - iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev
+    - cpufreq: Don't unregister cpufreq cooling on CPU hotplug
+    - overflow: Allow non-type arg to type_max() and type_min()
+    - wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm
+    - wifi: cfg80211: check A-MSDU format more carefully
+    - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
+    - btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
+    - btrfs: send: handle path ref underflow in header iterate_inode_ref()
+    - ice: use relative VSI index for VFs instead of PF VSI number
+    - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
+    - netdev: let netlink core handle -EMSGSIZE errors
+    - Bluetooth: btintel: Fix null ptr deref in btintel_read_version
+    - Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922
+    - Bluetooth: Add new quirk for broken read key length on ATS2851
+    - drm/vc4: don't check if plane->state->fb == state->fb
+    - drm/ci: uprev mesa version: fix kdl commit fetch
+    - drm/amdgpu: Skip do PCI error slot reset during RAS recovery
+    - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
+    - drm: panel-orientation-quirks: Add quirk for GPD Win Mini
+    - ASoC: SOF: amd: Optimize quirk for Valve Galileo
+    - drm/ttm: return ENOSPC from ttm_bo_mem_space v3
+    - scsi: ufs: qcom: Avoid re-init quirk when gears match
+    - drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz
+    - pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
+    - sysv: don't call sb_bread() with pointers_lock held
+    - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
+    - drm/amd/display: Disable idle reallow as part of command/gpint execution
+    - isofs: handle CDs with bad root inode but good Joliet root directory
+    - ASoC: Intel: sof_rt5682: dmi quirk cleanup for mtl boards
+    - ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710)
+      laptops
+    - rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()
+    - rcu-tasks: Repair RCU Tasks Trace quiescence check
+    - Julia Lawall reported this null pointer dereference, this should fix it.
+    - media: sta2x11: fix irq handler cast
+    - ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block
+      counter
+    - drm/panel: simple: Add BOE BP082WX1-100 8.2" panel
+    - x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o
+    - ASoC: Intel: avs: Populate board selection with new I2S entries
+    - ext4: add a hint for block bitmap corrupt state in mb_groups
+    - ext4: forbid commit inconsistent quota data when errors=remount-ro
+    - drm/amd/display: Fix nanosec stat overflow
+    - accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings
+    - i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC
+    - HID: input: avoid polling stylus battery on Chromebook Pompom
+    - drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
+    - drm: Check output polling initialized before disabling
+    - drm: Check polling initialized before enabling in
+      drm_helper_probe_single_connector_modes
+    - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned
+      int
+    - PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge
+    - Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
+    - libperf evlist: Avoid out-of-bounds access
+    - crypto: iaa - Fix async_disable descriptor leak
+    - input/touchscreen: imagis: Correct the maximum touch area value
+    - drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09
+    - block: prevent division by zero in blk_rq_stat_sum()
+    - RDMA/cm: add timeout to cm_destroy_id wait
+    - Input: imagis - use FIELD_GET where applicable
+    - Input: allocate keycode for Display refresh rate toggle
+    - platform/x86: acer-wmi: Add support for Acer PH16-71
+    - platform/x86: acer-wmi: Add predator_v4 module parameter
+    - platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi
+      Vi8 tablet
+    - perf/x86/amd/lbr: Discard erroneous branch entries
+    - ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9
+    - ktest: force $buildonly = 1 for 'make_warnings_file' test type
+    - Input: xpad - add support for Snakebyte GAMEPADs
+    - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent
+      environment
+    - tools: iio: replace seekdir() in iio_generic_buffer
+    - bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state
+    - kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in
+      kernfs_find_and_get_node_by_id()
+    - usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk
+    - thunderbolt: Calculate DisplayPort tunnel bandwidth after DPRX capabilities
+      read
+    - usb: gadget: uvc: refactor the check for a valid buffer in the pump worker
+    - usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR
+    - usb: typec: ucsi: Limit read size on v1.2
+    - serial: 8250_of: Drop quirk fot NPCM from 8250_port
+    - thunderbolt: Keep the domain powered when USB4 port is in redrive mode
+    - usb: typec: tcpci: add generic tcpci fallback compatible
+    - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
+    - ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE
+    - thermal/of: Assume polling-delay(-passive) 0 when absent
+    - ASoC: soc-core.c: Skip dummy codec when adding platforms
+    - x86/xen: attempt to inflate the memory balloon on PVH
+    - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
+    - io_uring: clear opcode specific data for an early failure
+    - modpost: fix null pointer dereference
+    - drivers/nvme: Add quirks for device 126f:2262
+    - fbmon: prevent division by zero in fb_videomode_from_videomode()
+    - ALSA: hda/realtek: Add quirks for some Clevo laptops
+    - drm/amdgpu: Init zone device and drm client after mode-1 reset on reload
+    - gcc-plugins/stackleak: Avoid .head.text section
+    - media: mediatek: vcodec: Fix oops when HEVC init fails
+    - media: mediatek: vcodec: adding lock to protect decoder context list
+    - media: mediatek: vcodec: adding lock to protect encoder context list
+    - randomize_kstack: Improve entropy diffusion
+    - platform/x86/intel/hid: Don't wake on 5-button releases
+    - platform/x86: intel-vbtn: Update tablet mode switch at end of probe
+    - nouveau: fix devinit paths to only handle display on GSP.
+    - Bluetooth: btintel: Fixe build regression
+    - net: mpls: error out if inner headers are not set
+    - VMCI: Fix possible memcpy() run-time warning in
+      vmci_datagram_invoke_guest_handler()
+    - x86/vdso: Fix rethunk patching for vdso-image-x32.o too
+    - Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in
+      amdgpu_device_init()"
+    - Linux 6.8.6
+  * Noble update: v6.8.5 upstream stable release (LP: #2065400)
+    - scripts/bpf_doc: Use silent mode when exec make cmd
+    - xsk: Don't assume metadata is always requested in TX completion
+    - s390/bpf: Fix bpf_plt pointer arithmetic
+    - bpf, arm64: fix bug in BPF_LDX_MEMSX
+    - dma-buf: Fix NULL pointer dereference in sanitycheck()
+    - arm64: bpf: fix 32bit unconditional bswap
+    - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
+    - nfsd: Fix error cleanup path in nfsd_rename()
+    - tools: ynl: fix setting presence bits in simple nests
+    - mlxbf_gige: stop PHY during open() error paths
+    - wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
+    - wifi: iwlwifi: mvm: rfi: fix potential response leaks
+    - wifi: iwlwifi: mvm: include link ID when releasing frames
+    - ALSA: hda: cs35l56: Set the init_done flag before component_add()
+    - ice: Refactor FW data type and fix bitmap casting issue
+    - ice: fix memory corruption bug with suspend and rebuild
+    - ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
+    - igc: Remove stale comment about Tx timestamping
+    - drm/xe: Remove unused xe_bo->props struct
+    - drm/xe: Add exec_queue.sched_props.job_timeout_ms
+    - drm/xe/guc_submit: use jiffies for job timeout
+    - drm/xe/queue: fix engine_class bounds check
+    - drm/xe/device: fix XE_MAX_GT_PER_TILE check
+    - drm/xe/device: fix XE_MAX_TILES_PER_DEVICE check
+    - dpll: indent DPLL option type by a tab
+    - s390/qeth: handle deferred cc1
+    - net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
+    - tcp: properly terminate timers for kernel sockets
+    - net: wwan: t7xx: Split 64bit accesses to fix alignment issues
+    - drm/rockchip: vop2: Remove AR30 and AB30 format support
+    - selftests: vxlan_mdb: Fix failures with old libnet
+    - gpiolib: Fix debug messaging in gpiod_find_and_request()
+    - ACPICA: debugger: check status of acpi_evaluate_object() in
+      acpi_db_walk_for_fields()
+    - net: hns3: fix index limit to support all queue stats
+    - net: hns3: fix kernel crash when devlink reload during pf initialization
+    - net: hns3: mark unexcuted loopback test result as UNEXECUTED
+    - tls: recv: process_rx_list shouldn't use an offset with kvec
+    - tls: adjust recv return with async crypto and failed copy to userspace
+    - tls: get psock ref after taking rxlock to avoid leak
+    - mlxbf_gige: call request_irq() after NAPI initialized
+    - drm/amd/display: Update P010 scaling cap
+    - drm/amd/display: Send DTBCLK disable message on first commit
+    - bpf: Protect against int overflow for stack access size
+    - cifs: Fix duplicate fscache cookie warnings
+    - netfilter: nf_tables: reject destroy command to remove basechain hooks
+    - netfilter: nf_tables: reject table flag and netdev basechain updates
+    - netfilter: nf_tables: skip netdev hook unregistration if table is dormant
+    - iommu: Validate the PASID in iommu_attach_device_pasid()
+    - net: bcmasp: Bring up unimac after PHY link up
+    - net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips
+    - Octeontx2-af: fix pause frame configuration in GMP mode
+    - inet: inet_defrag: prevent sk release while still in use
+    - drm/i915: Stop doing double audio enable/disable on SDVO and g4x+ DP
+    - drm/i915/display: Disable AuxCCS framebuffers if built for Xe
+    - drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74
+    - drm/i915/mtl: Update workaround 14018575942
+    - drm/i915: Do not print 'pxp init failed with 0' when it succeed
+    - dm integrity: fix out-of-range warning
+    - modpost: do not make find_tosym() return NULL
+    - kbuild: make -Woverride-init warnings more consistent
+    - mm/treewide: replace pud_large() with pud_leaf()
+    - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be
+      mapped."
+    - gpio: cdev: sanitize the label before requesting the interrupt
+    - RISC-V: KVM: Fix APLIC setipnum_le/be write emulation
+    - RISC-V: KVM: Fix APLIC in_clrip[x] read emulation
+    - KVM: arm64: Fix host-programmed guest events in nVHE
+    - KVM: arm64: Fix out-of-IPA space translation fault handling
+    - selinux: avoid dereference of garbage after mount failure
+    - r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
+    - x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
+    - x86/bpf: Fix IP after emitting call depth accounting
+    - Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
+    - arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
+    - Bluetooth: qca: fix device-address endianness
+    - Bluetooth: add quirk for broken address properties
+    - Bluetooth: hci_event: set the conn encrypted before conn establishes
+    - Bluetooth: Fix TOCTOU in HCI debugfs implementation
+    - netfilter: nf_tables: release batch on table validation from abort path
+    - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
+    - selftests: mptcp: join: fix dev in check_endpoint
+    - net/rds: fix possible cp null dereference
+    - net: usb: ax88179_178a: avoid the interface always configured as random
+      address
+    - net: mana: Fix Rx DMA datasize and skb_over_panic
+    - vsock/virtio: fix packet delivery to tap device
+    - netfilter: nf_tables: reject new basechain after table flag update
+    - netfilter: nf_tables: flush pending destroy work before exit_net release
+    - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
+    - netfilter: nf_tables: discard table flag update with pending basechain
+      deletion
+    - netfilter: validate user input for expected length
+    - vboxsf: Avoid an spurious warning if load_nls_xxx() fails
+    - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
+    - mptcp: prevent BPF accessing lowat from a subflow socket.
+    - x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for
+      !SRSO
+    - KVM: arm64: Use TLBI_TTL_UNKNOWN in __kvm_tlb_flush_vmid_range()
+    - KVM: arm64: Ensure target address is granule-aligned for range TLBI
+    - net/sched: act_skbmod: prevent kernel-infoleak
+    - net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45()
+    - net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
+    - net: stmmac: fix rx queue priority assignment
+    - net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping
+    - net: txgbe: fix i2c dev name cannot match clkdev
+    - net: fec: Set mac_managed_pm during probe
+    - net: phy: micrel: Fix potential null pointer dereference
+    - net: dsa: mv88e6xxx: fix usable ports on 88e6020
+    - selftests: net: gro fwd: update vxlan GRO test expectations
+    - gro: fix ownership transfer
+    - idpf: fix kernel panic on unknown packet types
+    - ice: fix enabling RX VLAN filtering
+    - i40e: Fix VF MAC filter removal
+    - tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-
+      wildcard addresses.
+    - erspan: make sure erspan_base_hdr is present in skb->head
+    - selftests: reuseaddr_conflict: add missing new line at the end of the output
+    - tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6) non-
+      wildcard addresses.
+    - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
+    - e1000e: Workaround for sporadic MDI error on Meteor Lake systems
+    - ipv6: Fix infinite recursion in fib6_dump_done().
+    - mlxbf_gige: stop interface during shutdown
+    - r8169: skip DASH fw status checks when DASH is disabled
+    - udp: do not accept non-tunnel GSO skbs landing in a tunnel
+    - udp: do not transition UDP GRO fraglist partial checksums to unnecessary
+    - udp: prevent local UDP tunnel packets from being GROed
+    - octeontx2-af: Fix issue with loading coalesced KPU profiles
+    - octeontx2-pf: check negative error code in otx2_open()
+    - octeontx2-af: Add array index check
+    - i40e: fix i40e_count_filters() to count only active/new filters
+    - i40e: fix vf may be used uninitialized in this function warning
+    - i40e: Enforce software interrupt during busy-poll exit
+    - drm/amd: Flush GFXOFF requests in prepare stage
+    - e1000e: Minor flow correction in e1000_shutdown function
+    - e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue
+    - mean_and_variance: Drop always failing tests
+    - net: ravb: Let IP-specific receive function to interrogate descriptors
+    - net: ravb: Always process TX descriptor ring
+    - net: ravb: Always update error counters
+    - KVM: SVM: Use unsigned integers when dealing with ASIDs
+    - KVM: SVM: Add support for allowing zero SEV ASIDs
+    - selftests: mptcp: connect: fix shellcheck warnings
+    - selftests: mptcp: use += operator to append strings
+    - mptcp: don't account accept() of non-MPC client as fallback to TCP
+    - 9p: Fix read/write debug statements to report server reply
+    - ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl()
+    - ASoC: cs42l43: Correct extraction of data pointer in suspend/resume
+    - riscv: mm: Fix prototype to avoid discarding const
+    - riscv: hwprobe: do not produce frtace relocation
+    - drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported
+    - block: count BLK_OPEN_RESTRICT_WRITES openers
+    - RISC-V: Update AT_VECTOR_SIZE_ARCH for new AT_MINSIGSTKSZ
+    - ASoC: amd: acp: fix for acp pdm configuration check
+    - regmap: maple: Fix cache corruption in regcache_maple_drop()
+    - ALSA: hda: cs35l56: Add ACPI device match tables
+    - drm/panfrost: fix power transition timeout warnings
+    - nouveau/uvmm: fix addr/range calcs for remap operations
+    - drm/prime: Unbreak virtgpu dma-buf export
+    - ASoC: rt5682-sdw: fix locking sequence
+    - ASoC: rt711-sdca: fix locking sequence
+    - ASoC: rt711-sdw: fix locking sequence
+    - ASoC: rt712-sdca-sdw: fix locking sequence
+    - ASoC: rt722-sdca-sdw: fix locking sequence
+    - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
+    - spi: s3c64xx: Extract FIFO depth calculation to a dedicated macro
+    - spi: s3c64xx: sort headers alphabetically
+    - spi: s3c64xx: explicitly include <linux/bits.h>
+    - spi: s3c64xx: remove else after return
+    - spi: s3c64xx: define a magic value
+    - spi: s3c64xx: allow full FIFO masks
+    - spi: s3c64xx: determine the fifo depth only once
+    - spi: s3c64xx: Use DMA mode from fifo size
+    - ASoC: amd: acp: fix for acp_init function error handling
+    - regmap: maple: Fix uninitialized symbol 'ret' warnings
+    - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
+    - scsi: mylex: Fix sysfs buffer lengths
+    - scsi: sd: Unregister device if device_add_disk() failed in sd_probe()
+    - Revert "ALSA: emu10k1: fix synthesizer sample playback position and caching"
+    - drm/i915/dp: Fix DSC state HW readout for SST connectors
+    - cifs: Fix caching to try to do open O_WRONLY as rdwr on server
+    - spi: mchp-pci1xxx: Fix a possible null pointer dereference in
+      pci1xxx_spi_probe
+    - s390/pai: fix sampling event removal for PMU device driver
+    - thermal: gov_power_allocator: Allow binding without cooling devices
+    - thermal: gov_power_allocator: Allow binding without trip points
+    - drm/i915/gt: Limit the reserved VM space to only the platforms that need it
+    - ata: sata_mv: Fix PCI device ID table declaration compilation warning
+    - ASoC: SOF: amd: fix for false dsp interrupts
+    - SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
+    - riscv: use KERN_INFO in do_trap
+    - riscv: Fix warning by declaring arch_cpu_idle() as noinstr
+    - riscv: Disable preemption when using patch_map()
+    - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
+    - lib/stackdepot: move stack_record struct definition into the header
+    - stackdepot: rename pool_index to pool_index_plus_1
+    - x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk
+    - Revert "drm/amd/display: Send DTBCLK disable message on first commit"
+    - gpio: cdev: check for NULL labels when sanitizing them for irqs
+    - gpio: cdev: fix missed label sanitizing in debounce_setup()
+    - ksmbd: don't send oplock break if rename fails
+    - ksmbd: validate payload size in ipc response
+    - ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
+    - ALSA: hda: Add pplcllpl/u members to hdac_ext_stream
+    - ALSA: hda/realtek - Fix inactive headset mic jack
+    - ALSA: hda/realtek: Add sound quirks for Lenovo Legion slim 7 16ARHA7 models
+    - ALSA: hda/realtek: cs35l41: Support ASUS ROG G634JYR
+    - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with
+      microphone
+    - io_uring/kbuf: get rid of lower BGID lists
+    - io_uring/kbuf: get rid of bl->is_ready
+    - io_uring/kbuf: protect io_buffer_list teardown with a reference
+    - io_uring/rw: don't allow multishot reads without NOWAIT support
+    - io_uring: use private workqueue for exit work
+    - io_uring/kbuf: hold io_buffer_list reference over mmap
+    - ASoC: SOF: Add dsp_max_burst_size_in_ms member to snd_sof_pcm_stream
+    - ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs
+    - ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint
+    - ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)
+    - ASoC: SOF: Intel: mtl/lnl: Use the generic get_stream_position callback
+    - ASoC: SOF: Introduce a new callback pair to be used for PCM delay reporting
+    - ASoC: SOF: Intel: Set the dai/host get frame/byte counter callbacks
+    - ASoC: SOF: Intel: hda-common-ops: Do not set the get_stream_position
+      callback
+    - ASoC: SOF: ipc4-pcm: Use the snd_sof_pcm_get_dai_frame_counter() for
+      pcm_delay
+    - ASoC: SOF: Remove the get_stream_position callback
+    - ASoC: SOF: ipc4-pcm: Move struct sof_ipc4_timestamp_info definition locally
+    - ASoC: SOF: ipc4-pcm: Combine the SOF_IPC4_PIPE_PAUSED cases in pcm_trigger
+    - ASoC: SOF: ipc4-pcm: Invalidate the stream_start_offset in PAUSED state
+    - ASoC: SOF: sof-pcm: Add pointer callback to sof_ipc_pcm_ops
+    - ASoC: SOF: ipc4-pcm: Correct the delay calculation
+    - ASoC: SOF: Intel: hda: Compensate LLP in case it is not reset
+    - driver core: Introduce device_link_wait_removal()
+    - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
+    - of: module: prevent NULL pointer dereference in vsnprintf()
+    - x86/mm/pat: fix VM_PAT handling in COW mappings
+    - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
+    - x86/coco: Require seeding RNG with RDRAND on CoCo systems
+    - perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last PEBS event
+    - riscv: Fix vector state restore in rt_sigreturn()
+    - arm64/ptrace: Use saved floating point state type to determine SVE layout
+    - mm/secretmem: fix GUP-fast succeeding on secretmem folios
+    - selftests/mm: include strings.h for ffsl
+    - s390/entry: align system call table on 8 bytes
+    - riscv: Fix spurious errors from __get/put_kernel_nofault
+    - riscv: process: Fix kernel gp leakage
+    - smb: client: fix UAF in smb2_reconnect_server()
+    - smb: client: guarantee refcounted children from parent session
+    - smb: client: refresh referral without acquiring refpath_lock
+    - smb: client: handle DFS tcons in cifs_construct_tcon()
+    - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex
+    - smb3: retrying on failed server close
+    - smb: client: fix potential UAF in cifs_debug_files_proc_show()
+    - smb: client: fix potential UAF in cifs_stats_proc_write()
+    - smb: client: fix potential UAF in cifs_stats_proc_show()
+    - smb: client: fix potential UAF in cifs_dump_full_key()
+    - smb: client: fix potential UAF in smb2_is_valid_oplock_break()
+    - smb: client: fix potential UAF in smb2_is_valid_lease_break()
+    - smb: client: fix potential UAF in is_valid_oplock_break()
+    - smb: client: fix potential UAF in smb2_is_network_name_deleted()
+    - smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
+    - drm/i915/mst: Limit MST+DSC to TGL+
+    - drm/i915/mst: Reject FEC+MST on ICL
+    - drm/i915/dp: Fix the computation for compressed_bpp for DISPLAY < 13
+    - drm/i915/gt: Disable HW load balancing for CCS
+    - drm/i915/gt: Do not generate the command streamer for all the CCS
+    - drm/i915/gt: Enable only one CCS for compute workload
+    - drm/xe: Use ring ops TLB invalidation for rebinds
+    - drm/xe: Rework rebinding
+    - Revert "x86/mpparse: Register APIC address only once"
+    - bpf: put uprobe link's path and task in release callback
+    - bpf: support deferring bpf_link dealloc to after RCU grace period
+    - efi/libstub: Add generic support for parsing mem_encrypt=
+    - x86/boot: Move mem_encrypt= parsing to the decompressor
+    - x86/sme: Move early SME kernel encryption handling into .head.text
+    - x86/sev: Move early startup code into .head.text section
+    - Linux 6.8.5
+  * CVE-2024-26926
+    - binder: check offset alignment in binder_get_object()
+  * CVE-2024-26922
+    - drm/amdgpu: validate the parameters of bo mapping operations more clearly
+  * CVE-2024-26924
+    - netfilter: nft_set_pipapo: do not free live element
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 05 Jul 2024 13:25:34 +0900
+
+linux-qcom (6.8.0-1004.4) jammy; urgency=medium
+
+  * [RB3] bluetooth hci0 failure found in dmesg
+    - SAUCE: bluetooth/hci_qca: fix timing
+
+  * ftrace:test.d--dynevent--add_remove_btfarg.tc in ubuntu_kselftests_ftrace
+    failed on some architectures (LP: #2067291)
+    - selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly
+
+  [ Ubuntu: 6.8.0-35.35 ]
+
+  * noble/linux: 6.8.0-35.35 -proposed tracker (LP: #2065886)
+  * CVE-2024-21823
+    - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
+    - dmaengine: idxd: add a new security check to deal with a hardware erratum
+    - dmaengine: idxd: add a write() method for applications to submit work
+
+  [ Ubuntu: 6.8.0-34.34 ]
+
+  * noble/linux: 6.8.0-34.34 -proposed tracker (LP: #2065167)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.04.29)
+
+  [ Ubuntu: 6.8.0-32.32 ]
+
+  * noble/linux: 6.8.0-32.32 -proposed tracker (LP: #2064344)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] drop getabis data
+    - [Packaging] update variants
+    - [Packaging] update annotations scripts
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/2024.04.29)
+  * Enable Nezha board (LP: #1975592)
+    - [Config] Enable CONFIG_REGULATOR_FIXED_VOLTAGE on riscv64
+  * Enable Nezha board (LP: #1975592) // Enable StarFive VisionFive 2 board
+    (LP: #2013232)
+    - [Config] Enable CONFIG_SERIAL_8250_DW on riscv64
+  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
+    - [Config] Sync riscv64 config with other architectures
+  * obsolete out-of-tree ivsc dkms in favor of in-tree one (LP: #2061747)
+    - ACPI: scan: Defer enumeration of devices with a _DEP pointing to IVSC device
+    - Revert "mei: vsc: Call wake_up() in the threaded IRQ handler"
+    - mei: vsc: Unregister interrupt handler for system suspend
+    - media: ipu-bridge: Add ov01a10 in Dell XPS 9315
+    - SAUCE: media: ipu-bridge: Support more sensors
+  * Fix after-suspend-mediacard/sdhc-insert test failed (LP: #2042500)
+    - PCI/ASPM: Move pci_configure_ltr() to aspm.c
+    - PCI/ASPM: Always build aspm.c
+    - PCI/ASPM: Move pci_save_ltr_state() to aspm.c
+    - PCI/ASPM: Save L1 PM Substates Capability for suspend/resume
+    - PCI/ASPM: Call pci_save_ltr_state() from pci_save_pcie_state()
+    - PCI/ASPM: Disable L1 before configuring L1 Substates
+    - PCI/ASPM: Update save_state when configuration changes
+  * RTL8852BE fw security fail then lost WIFI function during suspend/resume
+    cycle (LP: #2063096)
+    - wifi: rtw89: download firmware with five times retry
+  * intel_rapl_common: Add support for ARL and LNL (LP: #2061953)
+    - powercap: intel_rapl: Add support for Lunar Lake-M paltform
+    - powercap: intel_rapl: Add support for Arrow Lake
+  * Kernel panic during checkbox stress_ng_test on Grace running noble 6.8
+    (arm64+largemem) kernel (LP: #2058557)
+    - aio: Fix null ptr deref in aio_complete() wakeup
+  * Avoid creating non-working backlight sysfs knob from ASUS board
+    (LP: #2060422)
+    - platform/x86: asus-wmi: Consider device is absent when the read is ~0
+  * Include cifs.ko in linux-modules package (LP: #2042546)
+    - [Packaging] Replace fs/cifs with fs/smb/client in inclusion list
+  * Add Real-time Linux Analysis tool (rtla) to linux-tools (LP: #2059080)
+    - SAUCE: rtla: fix deb build
+    - [Packaging] add Real-time Linux Analysis tool (rtla) to linux-tools
+    - [Packaging] update dependencies for rtla
+  * Noble update: v6.8.4 upstream stable release (LP: #2060533)
+    - Revert "workqueue: Shorten events_freezable_power_efficient name"
+    - Revert "workqueue: Don't call cpumask_test_cpu() with -1 CPU in
+      wq_update_node_max_active()"
+    - Revert "workqueue: Implement system-wide nr_active enforcement for unbound
+      workqueues"
+    - Revert "workqueue: Introduce struct wq_node_nr_active"
+    - Revert "workqueue: RCU protect wq->dfl_pwq and implement accessors for it"
+    - Revert "workqueue: Make wq_adjust_max_active() round-robin pwqs while
+      activating"
+    - Revert "workqueue: Move nr_active handling into helpers"
+    - Revert "workqueue: Replace pwq_activate_inactive_work() with
+      [__]pwq_activate_work()"
+    - Revert "workqueue: Factor out pwq_is_empty()"
+    - Revert "workqueue: Move pwq->max_active to wq->max_active"
+    - Revert "workqueue.c: Increase workqueue name length"
+    - Linux 6.8.4
+  * Noble update: v6.8.3 upstream stable release (LP: #2060531)
+    - drm/vmwgfx: Unmap the surface before resetting it on a plane state
+    - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
+    - wifi: brcmfmac: avoid invalid list operation when vendor attach fails
+    - media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
+    - arm64: dts: qcom: sc7280: Add additional MSI interrupts
+    - remoteproc: virtio: Fix wdg cannot recovery remote processor
+    - clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
+    - smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
+    - smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
+    - arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
+    - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
+    - arm64: dts: qcom: sm8450-hdk: correct AMIC4 and AMIC5 microphones
+    - serial: max310x: fix NULL pointer dereference in I2C instantiation
+    - drm/vmwgfx: Fix the lifetime of the bo cursor memory
+    - pci_iounmap(): Fix MMIO mapping leak
+    - media: xc4000: Fix atomicity violation in xc4000_get_frequency
+    - media: mc: Add local pad to pipeline regardless of the link state
+    - media: mc: Fix flags handling when creating pad links
+    - media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access
+    - media: mc: Add num_links flag to media_pad
+    - media: mc: Rename pad variable to clarify intent
+    - media: mc: Expand MUST_CONNECT flag to always require an enabled link
+    - media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT
+    - md: use RCU lock to protect traversal in md_spares_need_change()
+    - KVM: Always flush async #PF workqueue when vCPU is being destroyed
+    - arm64: dts: qcom: sm8550-qrd: correct WCD9385 TX port mapping
+    - arm64: dts: qcom: sm8550-mtp: correct WCD9385 TX port mapping
+    - cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf()
+    - thermal/intel: Fix intel_tcc_get_temp() to support negative CPU temperature
+    - powercap: intel_rapl: Fix a NULL pointer dereference
+    - powercap: intel_rapl: Fix locking in TPMI RAPL
+    - powercap: intel_rapl_tpmi: Fix a register bug
+    - powercap: intel_rapl_tpmi: Fix System Domain probing
+    - powerpc/smp: Adjust nr_cpu_ids to cover all threads of a core
+    - powerpc/smp: Increase nr_cpu_ids to include the boot CPU
+    - sparc64: NMI watchdog: fix return value of __setup handler
+    - sparc: vDSO: fix return value of __setup handler
+    - selftests/mqueue: Set timeout to 180 seconds
+    - pinctrl: qcom: sm8650-lpass-lpi: correct Kconfig name
+    - ext4: correct best extent lstart adjustment logic
+    - drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects'
+    - block: Clear zone limits for a non-zoned stacked queue
+    - kasan/test: avoid gcc warning for intentional overflow
+    - bounds: support non-power-of-two CONFIG_NR_CPUS
+    - fat: fix uninitialized field in nostale filehandles
+    - fuse: fix VM_MAYSHARE and direct_io_allow_mmap
+    - mfd: twl: Select MFD_CORE
+    - ubifs: Set page uptodate in the correct place
+    - ubi: Check for too small LEB size in VTBL code
+    - ubi: correct the calculation of fastmap size
+    - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
+    - mtd: rawnand: meson: fix scrambling mode value in command macro
+    - md/md-bitmap: fix incorrect usage for sb_index
+    - x86/nmi: Fix the inverse "in NMI handler" check
+    - parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
+    - parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt
+      macros
+    - parisc: Fix ip_fast_csum
+    - parisc: Fix csum_ipv6_magic on 32-bit systems
+    - parisc: Fix csum_ipv6_magic on 64-bit systems
+    - parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
+    - md/raid5: fix atomicity violation in raid5_cache_count
+    - iio: adc: rockchip_saradc: fix bitmask for channels on SARADCv2
+    - iio: adc: rockchip_saradc: use mask for write_enable bitfield
+    - docs: Restore "smart quotes" for quotes
+    - cpufreq: Limit resolving a frequency to policy min/max
+    - PM: suspend: Set mem_sleep_current during kernel command line setup
+    - vfio/pds: Always clear the save/restore FDs on reset
+    - clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays
+    - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
+    - clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
+    - clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays
+    - clk: qcom: camcc-sc8280xp: fix terminating of frequency table arrays
+    - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
+    - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
+    - usb: xhci: Add error handling in xhci_map_urb_for_dma
+    - powerpc/fsl: Fix mfpmr build errors with newer binutils
+    - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
+    - USB: serial: add device ID for VeriFone adapter
+    - USB: serial: cp210x: add ID for MGP Instruments PDS100
+    - wifi: mac80211: track capability/opmode NSS separately
+    - USB: serial: option: add MeiG Smart SLM320 product
+    - KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled
+    - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
+    - PM: sleep: wakeirq: fix wake irq warning in system suspend
+    - mmc: tmio: avoid concurrent runs of mmc_request_done()
+    - fuse: replace remaining make_bad_inode() with fuse_make_bad()
+    - fuse: fix root lookup with nonzero generation
+    - fuse: don't unhash root
+    - usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
+    - usb: dwc3-am62: fix module unload/reload behavior
+    - usb: dwc3-am62: Disable wakeup at remove
+    - serial: core: only stop transmit when HW fifo is empty
+    - serial: Lock console when calling into driver before registration
+    - btrfs: qgroup: always free reserved space for extent records
+    - btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
+    - wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU
+    - docs: Makefile: Add dependency to $(YNL_INDEX) for targets other than
+      htmldocs
+    - PCI/PM: Drain runtime-idle callbacks before driver removal
+    - PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
+    - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
+    - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume
+    - md: export helpers to stop sync_thread
+    - md: export helper md_is_rdwr()
+    - md: add a new helper reshape_interrupted()
+    - dm-raid: really frozen sync_thread during suspend
+    - md/dm-raid: don't call md_reap_sync_thread() directly
+    - dm-raid: add a new helper prepare_suspend() in md_personality
+    - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent
+      with reshape
+    - dm-raid: fix lockdep waring in "pers->hot_add_disk"
+    - powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
+    - mac802154: fix llsec key resources release in mac802154_llsec_key_del
+    - mm: swap: fix race between free_swap_and_cache() and swapoff()
+    - mmc: core: Fix switch on gp3 partition
+    - Bluetooth: btnxpuart: Fix btnxpuart_close
+    - leds: trigger: netdev: Fix kernel panic on interface rename trig notify
+    - drm/etnaviv: Restore some id values
+    - landlock: Warn once if a Landlock action is requested while disabled
+    - io_uring: fix mshot read defer taskrun cqe posting
+    - hwmon: (amc6821) add of_match table
+    - io_uring: fix io_queue_proc modifying req->flags
+    - ext4: fix corruption during on-line resize
+    - nvmem: meson-efuse: fix function pointer type mismatch
+    - slimbus: core: Remove usage of the deprecated ida_simple_xx() API
+    - phy: tegra: xusb: Add API to retrieve the port number of phy
+    - usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
+    - speakup: Fix 8bit characters from direct synth
+    - debugfs: fix wait/cancellation handling during remove
+    - PCI/AER: Block runtime suspend when handling errors
+    - io_uring/net: correctly handle multishot recvmsg retry setup
+    - io_uring: fix mshot io-wq checks
+    - PCI: qcom: Disable ASPM L0s for sc8280xp, sa8540p and sa8295p
+    - sparc32: Fix parport build with sparc32
+    - nfs: fix UAF in direct writes
+    - NFS: Read unlock folio on nfs_page_create_from_folio() error
+    - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
+    - PCI: qcom: Enable BDF to SID translation properly
+    - PCI: dwc: endpoint: Fix advertised resizable BAR size
+    - PCI: hv: Fix ring buffer size calculation
+    - cifs: prevent updating file size from server if we have a read/write lease
+    - cifs: allow changing password during remount
+    - thermal/drivers/mediatek: Fix control buffer enablement on MT7896
+    - vfio/pci: Disable auto-enable of exclusive INTx IRQ
+    - vfio/pci: Lock external INTx masking ops
+    - vfio/platform: Disable virqfds on cleanup
+    - vfio/platform: Create persistent IRQ handlers
+    - vfio/fsl-mc: Block calling interrupt handler without trigger
+    - tpm,tpm_tis: Avoid warning splat at shutdown
+    - ksmbd: replace generic_fillattr with vfs_getattr
+    - ksmbd: retrieve number of blocks using vfs_getattr in
+      set_file_allocation_info
+    - platform/x86/intel/tpmi: Change vsec offset to u64
+    - io_uring/rw: return IOU_ISSUE_SKIP_COMPLETE for multishot retry
+    - io_uring: clean rings on NO_MMAP alloc fail
+    - ring-buffer: Do not set shortest_full when full target is hit
+    - ring-buffer: Fix full_waiters_pending in poll
+    - ring-buffer: Use wait_event_interruptible() in ring_buffer_wait()
+    - tracing/ring-buffer: Fix wait_on_pipe() race
+    - dlm: fix user space lkb refcounting
+    - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
+    - soc: fsl: qbman: Use raw spinlock for cgr_lock
+    - s390/zcrypt: fix reference counting on zcrypt card objects
+    - drm/probe-helper: warn about negative .get_modes()
+    - drm/panel: do not return negative error codes from drm_panel_get_modes()
+    - drm/exynos: do not return negative values from .get_modes()
+    - drm/imx/ipuv3: do not return negative values from .get_modes()
+    - drm/vc4: hdmi: do not return negative values from .get_modes()
+    - clocksource/drivers/timer-riscv: Clear timer interrupt on timer
+      initialization
+    - memtest: use {READ,WRITE}_ONCE in memory scanning
+    - Revert "block/mq-deadline: use correct way to throttling write requests"
+    - lsm: use 32-bit compatible data types in LSM syscalls
+    - lsm: handle the NULL buffer case in lsm_fill_user_ctx()
+    - f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag
+    - f2fs: truncate page cache before clearing flags when aborting atomic write
+    - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
+    - nilfs2: prevent kernel bug at submit_bh_wbc()
+    - cifs: make sure server interfaces are requested only for SMB3+
+    - cifs: reduce warning log level for server not advertising interfaces
+    - cifs: open_cached_dir(): add FILE_READ_EA to desired access
+    - mtd: rawnand: Fix and simplify again the continuous read derivations
+    - mtd: rawnand: Add a helper for calculating a page index
+    - mtd: rawnand: Ensure all continuous terms are always in sync
+    - mtd: rawnand: Constrain even more when continuous reads are enabled
+    - cpufreq: dt: always allocate zeroed cpumask
+    - io_uring/futex: always remove futex entry for cancel all
+    - io_uring/waitid: always remove waitid entry for cancel all
+    - x86/CPU/AMD: Update the Zenbleed microcode revisions
+    - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
+    - net: esp: fix bad handling of pages from page_pool
+    - NFSD: Fix nfsd_clid_class use of __string_len() macro
+    - drm/i915: Add missing ; to __assign_str() macros in tracepoint code
+    - net: hns3: tracing: fix hclgevf trace event strings
+    - cxl/trace: Properly initialize cxl_poison region name
+    - ksmbd: fix potencial out-of-bounds when buffer offset is invalid
+    - virtio: reenable config if freezing device failed
+    - LoongArch: Change __my_cpu_offset definition to avoid mis-optimization
+    - LoongArch: Define the __io_aw() hook as mmiowb()
+    - LoongArch/crypto: Clean up useless assignment operations
+    - wireguard: netlink: check for dangling peer via is_dead instead of empty
+      list
+    - wireguard: netlink: access device through ctx instead of peer
+    - wireguard: selftests: set RISCV_ISA_FALLBACK on riscv{32,64}
+    - ahci: asm1064: asm1166: don't limit reported ports
+    - drm/amd/display: Change default size for dummy plane in DML2
+    - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
+    - drm/amdgpu/pm: Fix NULL pointer dereference when get power limit
+    - drm/amdgpu/pm: Check the validity of overdiver power limit
+    - drm/amd/display: Override min required DCFCLK in dml1_validate
+    - drm/amd/display: Allow dirty rects to be sent to dmub when abm is active
+    - drm/amd/display: Init DPPCLK from SMU on dcn32
+    - drm/amd/display: Update odm when ODM combine is changed on an otg master
+      pipe with no plane
+    - drm/amd/display: Fix idle check for shared firmware state
+    - drm/amd/display: Amend coasting vtotal for replay low hz
+    - drm/amd/display: Lock all enabled otg pipes even with no planes
+    - drm/amd/display: Implement wait_for_odm_update_pending_complete
+    - drm/amd/display: Return the correct HDCP error code
+    - drm/amd/display: Add a dc_state NULL check in dc_state_release
+    - drm/amd/display: Fix noise issue on HDMI AV mute
+    - dm snapshot: fix lockup in dm_exception_table_exit
+    - x86/pm: Work around false positive kmemleak report in msr_build_context()
+    - wifi: brcmfmac: add per-vendor feature detection callback
+    - wifi: brcmfmac: cfg80211: Use WSEC to set SAE password
+    - wifi: brcmfmac: Demote vendor-specific attach/detach messages to info
+    - drm/ttm: Make sure the mapped tt pages are decrypted when needed
+    - drm/amd/display: Unify optimize_required flags and VRR adjustments
+    - drm/amd/display: Add more checks for exiting idle in DC
+    - btrfs: add set_folio_extent_mapped() helper
+    - btrfs: replace sb::s_blocksize by fs_info::sectorsize
+    - btrfs: add helpers to get inode from page/folio pointers
+    - btrfs: add helpers to get fs_info from page/folio pointers
+    - btrfs: add helper to get fs_info from struct inode pointer
+    - btrfs: qgroup: validate btrfs_qgroup_inherit parameter
+    - vfio: Introduce interface to flush virqfd inject workqueue
+    - vfio/pci: Create persistent INTx handler
+    - drm/bridge: add ->edid_read hook and drm_bridge_edid_read()
+    - drm/bridge: lt8912b: use drm_bridge_edid_read()
+    - drm/bridge: lt8912b: clear the EDID property on failures
+    - drm/bridge: lt8912b: do not return negative values from .get_modes()
+    - drm/amd/display: Remove pixle rate limit for subvp
+    - drm/amd/display: Revert Remove pixle rate limit for subvp
+    - workqueue: Shorten events_freezable_power_efficient name
+    - drm/amd/display: Use freesync when `DRM_EDID_FEATURE_CONTINUOUS_FREQ` found
+    - netfilter: nf_tables: reject constant set with timeout
+    - Revert "crypto: pkcs7 - remove sha1 support"
+    - x86/efistub: Call mixed mode boot services on the firmware's stack
+    - ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2"
+    - ASoC: amd: yc: Revert "add new YC platform variant (0x63) support"
+    - Fix memory leak in posix_clock_open()
+    - wifi: rtw88: 8821cu: Fix connection failure
+    - x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
+    - x86/sev: Fix position dependent variable references in startup code
+    - clocksource/drivers/arm_global_timer: Fix maximum prescaler value
+    - ARM: 9352/1: iwmmxt: Remove support for PJ4/PJ4B cores
+    - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
+    - entry: Respect changes to system call number by trace_sys_enter()
+    - swiotlb: Fix double-allocation of slots due to broken alignment handling
+    - swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc()
+    - swiotlb: Fix alignment checks when both allocation and DMA masks are present
+    - iommu/dma: Force swiotlb_max_mapping_size on an untrusted device
+    - printk: Update @console_may_schedule in console_trylock_spinning()
+    - irqchip/renesas-rzg2l: Flush posted write in irq_eoi()
+    - irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi()
+    - irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi()
+    - irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type
+    - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
+    - efi/libstub: fix efi_random_alloc() to allocate memory at alloc_min or
+      higher address
+    - x86/mpparse: Register APIC address only once
+    - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
+    - efi: fix panic in kdump kernel
+    - pwm: img: fix pwm clock lookup
+    - selftests/mm: Fix build with _FORTIFY_SOURCE
+    - btrfs: handle errors returned from unpin_extent_cache()
+    - btrfs: fix warning messages not printing interval at unpin_extent_range()
+    - btrfs: do not skip re-registration for the mounted device
+    - mfd: intel-lpss: Switch to generalized quirk table
+    - mfd: intel-lpss: Introduce QUIRK_CLOCK_DIVIDER_UNITY for XPS 9530
+    - drm/i915: Replace a memset() with zero initialization
+    - drm/i915: Try to preserve the current shared_dpll for fastset on type-c
+      ports
+    - drm/i915: Include the PLL name in the debug messages
+    - drm/i915: Suppress old PLL pipe_mask checks for MG/TC/TBT PLLs
+    - crypto: iaa - Fix nr_cpus < nr_iaa case
+    - drm/amd/display: Prevent crash when disable stream
+    - ALSA: hda/tas2781: remove digital gain kcontrol
+    - ALSA: hda/tas2781: add locks to kcontrols
+    - mm: zswap: fix writeback shinker GFP_NOIO/GFP_NOFS recursion
+    - init: open /initrd.image with O_LARGEFILE
+    - x86/efistub: Add missing boot_params for mixed mode compat entry
+    - efi/libstub: Cast away type warning in use of max()
+    - x86/efistub: Reinstate soft limit for initrd loading
+    - prctl: generalize PR_SET_MDWE support check to be per-arch
+    - ARM: prctl: reject PR_SET_MDWE on pre-ARMv6
+    - tmpfs: fix race on handling dquot rbtree
+    - btrfs: validate device maj:min during open
+    - btrfs: fix race in read_extent_buffer_pages()
+    - btrfs: zoned: don't skip block groups with 100% zone unusable
+    - btrfs: zoned: use zone aware sb location for scrub
+    - btrfs: zoned: fix use-after-free in do_zone_finish()
+    - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
+    - wifi: cfg80211: add a flag to disable wireless extensions
+    - wifi: iwlwifi: mvm: disable MLO for the time being
+    - wifi: iwlwifi: fw: don't always use FW dump trig
+    - wifi: iwlwifi: mvm: handle debugfs names more carefully
+    - Revert "drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP
+      displays without PSR"
+    - fbdev: Select I/O-memory framebuffer ops for SBus
+    - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
+    - hexagon: vmlinux.lds.S: handle attributes section
+    - mm: cachestat: fix two shmem bugs
+    - selftests/mm: sigbus-wp test requires UFFD_FEATURE_WP_HUGETLBFS_SHMEM
+    - selftests/mm: fix ARM related issue with fork after pthread_create
+    - mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc
+      HS200 mode
+    - mmc: core: Initialize mmc_blk_ioc_data
+    - mmc: core: Avoid negative index with array access
+    - sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove()
+    - block: Do not force full zone append completion in req_bio_endio()
+    - thermal: devfreq_cooling: Fix perf state when calculate dfc res_util
+    - Revert "thermal: core: Don't update trip points inside the hysteresis range"
+    - nouveau/dmem: handle kcalloc() allocation failure
+    - net: ll_temac: platform_get_resource replaced by wrong function
+    - net: wan: framer: Add missing static inline qualifiers
+    - net: phy: qcom: at803x: fix kernel panic with at8031_probe
+    - drm/xe/query: fix gt_id bounds check
+    - drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau
+    - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
+    - drm/amdkfd: fix TLB flush after unmap for GFX9.4.2
+    - drm/amdgpu: fix deadlock while reading mqd from debugfs
+    - drm/amd/display: Remove MPC rate control logic from DCN30 and above
+    - drm/amd/display: Set DCN351 BB and IP the same as DCN35
+    - drm/i915/hwmon: Fix locking inversion in sysfs getter
+    - drm/i915/vma: Fix UAF on destroy against retire race
+    - drm/i915/bios: Tolerate devdata==NULL in
+      intel_bios_encoder_supports_dp_dual_mode()
+    - drm/i915/vrr: Generate VRR "safe window" for DSB
+    - drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly
+    - drm/i915/dsb: Fix DSB vblank waits when using VRR
+    - drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed()
+    - drm/i915: Pre-populate the cursor physical dma address
+    - drm/i915/gt: Reset queue_priority_hint on parking
+    - drm/amd/display: Fix bounds check for dcn35 DcfClocks
+    - Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
+    - mtd: spinand: Add support for 5-byte IDs
+    - Revert "usb: phy: generic: Get the vbus supply"
+    - usb: cdc-wdm: close race between read and workqueue
+    - usb: misc: ljca: Fix double free in error handling path
+    - USB: UAS: return ENODEV when submit urbs fail with device not attached
+    - vfio/pds: Make sure migration file isn't accessed after reset
+    - ring-buffer: Make wake once of ring_buffer_wait() more robust
+    - btrfs: fix extent map leak in unexpected scenario at unpin_extent_cache()
+    - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
+    - scsi: ufs: qcom: Provide default cycles_in_1us value
+    - scsi: sd: Fix TCG OPAL unlock on system resume
+    - scsi: core: Fix unremoved procfs host directory regression
+    - staging: vc04_services: changen strncpy() to strscpy_pad()
+    - staging: vc04_services: fix information leak in create_component()
+    - genirq: Introduce IRQF_COND_ONESHOT and use it in pinctrl-amd
+    - usb: dwc3: Properly set system wakeup
+    - USB: core: Fix deadlock in usb_deauthorize_interface()
+    - USB: core: Add hub_get() and hub_put() routines
+    - USB: core: Fix deadlock in port "disable" sysfs attribute
+    - usb: dwc2: host: Fix remote wakeup from hibernation
+    - usb: dwc2: host: Fix hibernation flow
+    - usb: dwc2: host: Fix ISOC flow in DDMA mode
+    - usb: dwc2: gadget: Fix exiting from clock gating
+    - usb: dwc2: gadget: LPM flow fix
+    - usb: udc: remove warning when queue disabled ep
+    - usb: typec: ucsi: Fix race between typec_switch and role_switch
+    - usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()
+    - usb: typec: tcpm: Correct port source pdo array in pd_set callback
+    - usb: typec: tcpm: Update PD of Type-C port upon pd_set
+    - usb: typec: Return size of buffer if pd_set operation succeeds
+    - usb: typec: ucsi: Clear EVENT_PENDING under PPM lock
+    - usb: typec: ucsi: Ack unsupported commands
+    - usb: typec: ucsi_acpi: Refactor and fix DELL quirk
+    - usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
+    - scsi: qla2xxx: Prevent command send on chip reset
+    - scsi: qla2xxx: Fix N2N stuck connection
+    - scsi: qla2xxx: Split FCE|EFT trace control
+    - scsi: qla2xxx: Update manufacturer detail
+    - scsi: qla2xxx: NVME|FCP prefer flag not being honored
+    - scsi: qla2xxx: Fix command flush on cable pull
+    - scsi: qla2xxx: Fix double free of the ha->vp_map pointer
+    - scsi: qla2xxx: Fix double free of fcport
+    - scsi: qla2xxx: Change debug message during driver unload
+    - scsi: qla2xxx: Delay I/O Abort on PCI error
+    - x86/bugs: Fix the SRSO mitigation on Zen3/4
+    - crash: use macro to add crashk_res into iomem early for specific arch
+    - drm/amd/display: fix IPX enablement
+    - x86/bugs: Use fixed addressing for VERW operand
+    - Revert "x86/bugs: Use fixed addressing for VERW operand"
+    - usb: dwc3: pci: Drop duplicate ID
+    - scsi: lpfc: Correct size for cmdwqe/rspwqe for memset()
+    - scsi: lpfc: Correct size for wqe for memset()
+    - scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
+    - scsi: libsas: Fix disk not being scanned in after being removed
+    - perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and
+      later
+    - x86/sev: Skip ROM range scans and validation for SEV-SNP guests
+    - tools/resolve_btfids: fix build with musl libc
+    - drm/amdgpu: fix use-after-free bug
+    - drm/sched: fix null-ptr-deref in init entity
+    - Linux 6.8.3
+    - [Config] updateconfigs following v6.8.3 import
+  * Noble update: v6.8.3 upstream stable release (LP: #2060531) //
+    [Ubuntu-24.04] Hugepage memory is not getting released even after destroying
+    the guest! (LP: #2062556)
+    - block: Fix page refcounts for unaligned buffers in __bio_release_pages()
+  *  [SPR][EMR][GNR] TDX: efi: TD Measurement support for kernel cmdline/initrd
+    sections from EFI stub  (LP: #2060130)
+    - efi/libstub: Use TPM event typedefs from the TCG PC Client spec
+    - efi/tpm: Use symbolic GUID name from spec for final events table
+    - efi/libstub: Add Confidential Computing (CC) measurement typedefs
+    - efi/libstub: Measure into CC protocol if TCG2 protocol is absent
+    - efi/libstub: Add get_event_log() support for CC platforms
+    - x86/efistub: Remap kernel text read-only before dropping NX attribute
+  * Fix acpi_power_meter accessing IPMI region before it's ready (LP: #2059263)
+    - ACPI: IPMI: Add helper to wait for when SMI is selected
+    - hwmon: (acpi_power_meter) Ensure IPMI space handler is ready on Dell systems
+  * Drop fips-checks script from trees (LP: #2055083)
+    - [Packaging] Remove fips-checks script
+  * alsa/realtek: adjust max output valume for headphone on 2 LG machines
+    (LP: #2058573)
+    - ALSA: hda/realtek: fix the hp playback volume issue for LG machines
+  * Noble update: v6.8.2 upstream stable release (LP: #2060097)
+    - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
+    - workqueue.c: Increase workqueue name length
+    - workqueue: Move pwq->max_active to wq->max_active
+    - workqueue: Factor out pwq_is_empty()
+    - workqueue: Replace pwq_activate_inactive_work() with [__]pwq_activate_work()
+    - workqueue: Move nr_active handling into helpers
+    - workqueue: Make wq_adjust_max_active() round-robin pwqs while activating
+    - workqueue: RCU protect wq->dfl_pwq and implement accessors for it
+    - workqueue: Introduce struct wq_node_nr_active
+    - workqueue: Implement system-wide nr_active enforcement for unbound
+      workqueues
+    - workqueue: Don't call cpumask_test_cpu() with -1 CPU in
+      wq_update_node_max_active()
+    - iomap: clear the per-folio dirty bits on all writeback failures
+    - fs: Fix rw_hint validation
+    - io_uring: remove looping around handling traditional task_work
+    - io_uring: remove unconditional looping in local task_work handling
+    - s390/dasd: Use dev_*() for device log messages
+    - s390/dasd: fix double module refcount decrement
+    - fs/hfsplus: use better @opf description
+    - md: fix kmemleak of rdev->serial
+    - rcu/exp: Fix RCU expedited parallel grace period kworker allocation failure
+      recovery
+    - rcu/exp: Handle RCU expedited grace period kworker allocation failure
+    - fs/select: rework stack allocation hack for clang
+    - block: fix deadlock between bd_link_disk_holder and partition scan
+    - md: Don't clear MD_CLOSING when the raid is about to stop
+    - kunit: Setup DMA masks on the kunit device
+    - ovl: Always reject mounting over case-insensitive directories
+    - kunit: test: Log the correct filter string in executor_test
+    - lib/cmdline: Fix an invalid format specifier in an assertion msg
+    - lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg
+    - time: test: Fix incorrect format specifier
+    - rtc: test: Fix invalid format specifier.
+    - net: test: Fix printf format specifier in skb_segment kunit test
+    - drm/xe/tests: Fix printf format specifiers in xe_migrate test
+    - drm: tests: Fix invalid printf format specifiers in KUnit tests
+    - md/raid1: factor out helpers to add rdev to conf
+    - md/raid1: record nonrot rdevs while adding/removing rdevs to conf
+    - md/raid1: fix choose next idle in read_balance()
+    - io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
+    - io_uring/net: move receive multishot out of the generic msghdr path
+    - io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
+    - nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()
+    - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
+    - x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type
+    - x86/resctrl: Remove hard-coded memory bandwidth limit
+    - x86/resctrl: Read supported bandwidth sources from CPUID
+    - x86/resctrl: Implement new mba_MBps throttling heuristic
+    - x86/sme: Fix memory encryption setting if enabled by default and not
+      overridden
+    - timekeeping: Fix cross-timestamp interpolation on counter wrap
+    - timekeeping: Fix cross-timestamp interpolation corner case decision
+    - timekeeping: Fix cross-timestamp interpolation for non-x86
+    - x86/asm: Remove the __iomem annotation of movdir64b()'s dst argument
+    - sched/fair: Take the scheduling domain into account in select_idle_smt()
+    - sched/fair: Take the scheduling domain into account in select_idle_core()
+    - wifi: ath10k: fix NULL pointer dereference in
+      ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
+    - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
+    - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
+    - wifi: b43: Stop correct queue in DMA worker when QoS is disabled
+    - wifi: b43: Disable QoS for bcm4331
+    - wifi: wilc1000: fix declarations ordering
+    - wifi: wilc1000: fix RCU usage in connect path
+    - wifi: ath11k: add support to select 6 GHz regulatory type
+    - wifi: ath11k: store cur_regulatory_info for each radio
+    - wifi: ath11k: fix a possible dead lock caused by ab->base_lock
+    - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
+    - wifi: wilc1000: do not realloc workqueue everytime an interface is added
+    - wifi: wilc1000: fix multi-vif management when deleting a vif
+    - wifi: mwifiex: debugfs: Drop unnecessary error check for
+      debugfs_create_dir()
+    - ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate
+    - arm64: dts: qcom: x1e80100: drop qcom,drv-count
+    - arm64: dts: qcom: sc8180x: Hook up VDD_CX as GCC parent domain
+    - arm64: dts: qcom: sc8180x: Fix up big CPU idle state entry latency
+    - arm64: dts: qcom: sc8180x: Add missing CPU off state
+    - arm64: dts: qcom: sc8180x: Fix eDP PHY power-domains
+    - arm64: dts: qcom: sc8180x: Don't hold MDP core clock at FMAX
+    - arm64: dts: qcom: sc8180x: Require LOW_SVS vote for MMCX if DISPCC is on
+    - arm64: dts: qcom: sc8180x: Add missing CPU<->MDP_CFG path
+    - arm64: dts: qcom: sc8180x: Shrink aoss_qmp register space size
+    - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
+    - cpufreq: mediatek-hw: Wait for CPU supplies before probing
+    - sock_diag: annotate data-races around sock_diag_handlers[family]
+    - inet_diag: annotate data-races around inet_diag_table[]
+    - bpftool: Silence build warning about calloc()
+    - selftests/bpf: Fix potential premature unload in bpf_testmod
+    - libbpf: Apply map_set_def_max_entries() for inner_maps on creation
+    - selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values
+    - bpftool: Fix wrong free call in do_show_link
+    - wifi: ath12k: Fix issues in channel list update
+    - selftests/bpf: Fix the flaky tc_redirect_dtime test
+    - selftests/bpf: Wait for the netstamp_needed_key static key to be turned on
+    - wifi: cfg80211: add RNR with reporting AP information
+    - wifi: mac80211: use deflink and fix typo in link ID check
+    - wifi: iwlwifi: change link id in time event to s8
+    - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
+    - arm64: dts: qcom: sm8450: Add missing interconnects to serial
+    - soc: qcom: socinfo: rename PM2250 to PM4125
+    - arm64: dts: qcom: sc7280: Add static properties to cryptobam
+    - arm64: dts: qcom: qcm6490-fairphone-fp5: Add missing reserved-memory
+    - arm64: dts: qcom: sdm845-oneplus-common: improve DAI node naming
+    - arm64: dts: qcom: rename PM2250 to PM4125
+    - cpufreq: mediatek-hw: Don't error out if supply is not found
+    - libbpf: Fix faccessat() usage on Android
+    - libbpf: fix __arg_ctx type enforcement for perf_event programs
+    - pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl
+    - arm64: dts: qcom: sa8540p: Drop gfx.lvl as power-domain for gpucc
+    - arm64: dts: renesas: r8a779g0: Restore sort order
+    - arm64: dts: renesas: r8a779g0: Add missing SCIF_CLK2
+    - selftests/bpf: Disable IPv6 for lwt_redirect test
+    - arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S i.MX8MM
+    - arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM
+    - arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL
+      OSM-S board
+    - arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL
+      board
+    - arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL
+      OSM-S board
+    - arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL
+      board
+    - arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module
+    - arm64: dts: imx8qm: Align edma3 power-domains resources indentation
+    - arm64: dts: imx8qm: Correct edma3 power-domains and interrupt numbers
+    - libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API
+    - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
+    - wifi: ath11k: change to move WMI_VDEV_PARAM_SET_HEMU_MODE before
+      WMI_PEER_ASSOC_CMDID
+    - wifi: ath12k: fix fetching MCBC flag for QCN9274
+    - wifi: iwlwifi: mvm: report beacon protection failures
+    - wifi: iwlwifi: dbg-tlv: ensure NUL termination
+    - wifi: iwlwifi: acpi: fix WPFC reading
+    - wifi: iwlwifi: mvm: initialize rates in FW earlier
+    - wifi: iwlwifi: fix EWRD table validity check
+    - wifi: iwlwifi: mvm: d3: fix IPN byte order
+    - wifi: iwlwifi: always have 'uats_enabled'
+    - wifi: iwlwifi: mvm: fix the TLC command after ADD_STA
+    - wifi: iwlwifi: read BIOS PNVM only for non-Intel SKU
+    - gpio: vf610: allow disabling the vf610 driver
+    - selftests/bpf: trace_helpers.c: do not use poisoned type
+    - bpf: make sure scalar args don't accept __arg_nonnull tag
+    - bpf: don't emit warnings intended for global subprogs for static subprogs
+    - arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
+    - pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
+    - net: blackhole_dev: fix build warning for ethh set but not used
+    - spi: consolidate setting message->spi
+    - spi: move split xfers for CS_WORD emulation
+    - arm64: dts: ti: k3-am62p5-sk: Enable CPSW MDIO node
+    - arm64: dts: ti: k3-j721s2: Fix power domain for VTM node
+    - arm64: dts: ti: k3-j784s4: Fix power domain for VTM node
+    - wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use
+    - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
+    - arm64: dts: ti: k3-am69-sk: remove assigned-clock-parents for unused VP
+    - libbpf: fix return value for PERF_EVENT __arg_ctx type fix up check
+    - arm64: dts: ti: k3-am62p-mcu/wakeup: Disable MCU and wakeup R5FSS nodes
+    - arm64: dts: qcom: x1e80100-qcp: Fix supplies for LDOs 3E and 2J
+    - libbpf: Use OPTS_SET() macro in bpf_xdp_query()
+    - wifi: wfx: fix memory leak when starting AP
+    - arm64: dts: qcom: qcm2290: declare VLS CLAMP register for USB3 PHY
+    - arm64: dts: qcom: sm6115: declare VLS CLAMP register for USB3 PHY
+    - arm64: dts: qcom: sm8650: Fix UFS PHY clocks
+    - wifi: ath12k: fix incorrect logic of calculating vdev_stats_id
+    - printk: nbcon: Relocate 32bit seq macros
+    - printk: ringbuffer: Do not skip non-finalized records with prb_next_seq()
+    - printk: Wait for all reserved records with pr_flush()
+    - printk: Add this_cpu_in_panic()
+    - printk: ringbuffer: Cleanup reader terminology
+    - printk: ringbuffer: Skip non-finalized records in panic
+    - printk: Disable passing console lock owner completely during panic()
+    - pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
+    - tools/resolve_btfids: Refactor set sorting with types from btf_ids.h
+    - tools/resolve_btfids: Fix cross-compilation to non-host endianness
+    - wifi: iwlwifi: support EHT for WH
+    - wifi: iwlwifi: properly check if link is active
+    - wifi: iwlwifi: mvm: fix erroneous queue index mask
+    - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK
+    - wifi: iwlwifi: mvm: don't set replay counters to 0xff
+    - s390/pai: fix attr_event_free upper limit for pai device drivers
+    - s390/vdso: drop '-fPIC' from LDFLAGS
+    - arm64: dts: qcom: qcm6490-idp: Correct the voltage setting for vph_pwr
+    - arm64: dts: qcom: qcs6490-rb3gen2: Correct the voltage setting for vph_pwr
+    - selftests: forwarding: Add missing config entries
+    - selftests: forwarding: Add missing multicast routing config entries
+    - arm64: dts: qcom: sm6115: drop pipe clock selection
+    - ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
+    - arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs
+    - arm64: dts: mediatek: mt7986: fix reference to PWM in fan node
+    - arm64: dts: mediatek: mt7986: drop crypto's unneeded/invalid clock name
+    - arm64: dts: mediatek: mt7986: fix SPI bus width properties
+    - arm64: dts: mediatek: mt7986: fix SPI nodename
+    - arm64: dts: mediatek: mt7986: drop "#clock-cells" from PWM
+    - arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg
+    - arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection node
+    - arm64: dts: mediatek: mt8192: fix vencoder clock name
+    - arm64: dts: mediatek: mt8186: fix VENC power domain clocks
+    - arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
+    - can: m_can: Start/Cancel polling timer together with interrupts
+    - wifi: iwlwifi: mvm: Fix the listener MAC filter flags
+    - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
+    - arm64: dts: qcom: sdm845: Use the Low Power Island CX/MX for SLPI
+    - soc: qcom: llcc: Check return value on Broadcast_OR reg read
+    - ARM: dts: qcom: msm8974: correct qfprom node size
+    - arm64: dts: mediatek: mt8186: Add missing clocks to ssusb power domains
+    - arm64: dts: mediatek: mt8186: Add missing xhci clock to usb controllers
+    - arm64: dts: ti: am65x: Fix dtbs_install for Rocktech OLDI overlay
+    - cpufreq: qcom-hw: add CONFIG_COMMON_CLK dependency
+    - wifi: wilc1000: prevent use-after-free on vif when cleaning up all
+      interfaces
+    - pwm: dwc: use pm_sleep_ptr() macro
+    - arm64: dts: ti: k3-am69-sk: fix PMIC interrupt number
+    - arm64: dts: ti: k3-j721e-sk: fix PMIC interrupt number
+    - arm64: dts: ti: k3-am62-main: disable usb lpm
+    - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
+    - bus: tegra-aconnect: Update dependency to ARCH_TEGRA
+    - iommu/amd: Mark interrupt as managed
+    - wifi: brcmsmac: avoid function pointer casts
+    - arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios
+    - arm64: dts: qcom: sm8150: correct PCIe wake-gpios
+    - powercap: dtpm_cpu: Fix error check against freq_qos_add_request()
+    - net: ena: Remove ena_select_queue
+    - arm64: dts: ti: k3-j7200-common-proc-board: Modify Pinmux for wkup_uart0 and
+      mcu_uart0
+    - arm64: dts: ti: k3-j7200-common-proc-board: Remove clock-frequency from
+      mcu_uart0
+    - arm64: dts: ti: k3-j721s2-common-proc-board: Remove Pinmux for CTS and RTS
+      in wkup_uart0
+    - arm64: dts: ti: k3-j784s4-evm: Remove Pinmux for CTS and RTS in wkup_uart0
+    - arm64: dts: ti: k3-am64-main: Fix ITAP/OTAP values for MMC
+    - arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow
+    - arm64: dts: ti: Add common1 register space for AM65x SoC
+    - arm64: dts: ti: Add common1 register space for AM62x SoC
+    - firmware: arm_scmi: Fix double free in SMC transport cleanup path
+    - wifi: cfg80211: set correct param change count in ML element
+    - arm64: dts: ti: k3-j721e: Fix mux-reg-masks in hbmc_mux
+    - arm64: dts: ti: k3-j784s4-main: Fix mux-reg-masks in serdes_ln_ctrl
+    - arm64: dts: ti: k3-am62p: Fix memory ranges for DMSS
+    - wifi: wilc1000: revert reset line logic flip
+    - ARM: dts: arm: realview: Fix development chip ROM compatible value
+    - memory: tegra: Correct DLA client names
+    - wifi: mt76: mt7996: fix fw loading timeout
+    - wifi: mt76: mt7925: fix connect to 80211b mode fail in 2Ghz band
+    - wifi: mt76: mt7925: fix SAP no beacon issue in 5Ghz and 6Ghz band
+    - wifi: mt76: mt7925: fix mcu query command fail
+    - wifi: mt76: mt7925: fix wmm queue mapping
+    - wifi: mt76: mt7925: fix fw download fail
+    - wifi: mt76: mt7925: fix WoW failed in encrypted mode
+    - wifi: mt76: mt7925: fix the wrong header translation config
+    - wifi: mt76: mt7925: add flow to avoid chip bt function fail
+    - wifi: mt76: mt7925: add support to set ifs time by mcu command
+    - wifi: mt76: mt7925: update PCIe DMA settings
+    - wifi: mt76: mt7996: check txs format before getting skb by pid
+    - wifi: mt76: mt7996: fix TWT issues
+    - wifi: mt76: mt7996: fix incorrect interpretation of EHT MCS caps
+    - wifi: mt76: mt7996: fix HE beamformer phy cap for station vif
+    - wifi: mt76: mt7996: fix efuse reading issue
+    - wifi: mt76: mt7996: fix HIF_TXD_V2_1 value
+    - wifi: mt76: mt792x: fix ethtool warning
+    - wifi: mt76: mt7921e: fix use-after-free in free_irq()
+    - wifi: mt76: mt7925e: fix use-after-free in free_irq()
+    - wifi: mt76: mt7921: fix incorrect type conversion for CLC command
+    - wifi: mt76: mt792x: fix a potential loading failure of the 6Ghz channel
+      config from ACPI
+    - wifi: mt76: fix the issue of missing txpwr settings from ch153 to ch177
+    - arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes
+    - arm64: dts: renesas: r9a08g045: Add missing interrupts to IRQC node
+    - arm64: dts: renesas: rzg3s-smarc-som: Guard Ethernet IRQ GPIO hogs
+    - arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
+    - arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes
+    - net: mctp: copy skb ext data when fragmenting
+    - pstore: inode: Only d_invalidate() is needed
+    - arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF
+    - ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
+    - ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
+    - arm64: dts: imx8mp: Set SPI NOR to max 40 MHz on Data Modul i.MX8M Plus eDM
+      SBC
+    - arm64: dts: imx8mp-evk: Fix hdmi@3d node
+    - regulator: userspace-consumer: add module device table
+    - gpiolib: Pass consumer device through to core in
+      devm_fwnode_gpiod_get_index()
+    - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
+    - ACPI: resource: Do IRQ override on Lunnen Ground laptops
+    - ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
+    - ACPI: scan: Fix device check notification handling
+    - arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu
+    - arm64: dts: rockchip: fix reset-names for rk356x i2s2 controller
+    - arm64: dts: rockchip: drop rockchip,trcm-sync-tx-only from rk3588 i2s
+    - objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks
+    - x86, relocs: Ignore relocations in .notes section
+    - SUNRPC: fix a memleak in gss_import_v2_context
+    - SUNRPC: fix some memleaks in gssx_dec_option_array
+    - arm64: dts: qcom: sm8550: Fix SPMI channels size
+    - arm64: dts: qcom: sm8650: Fix SPMI channels size
+    - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove
+      function
+    - ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors
+    - btrfs: fix race when detecting delalloc ranges during fiemap
+    - wifi: rtw88: 8821cu: Fix firmware upload fail
+    - wifi: rtw88: 8821c: Fix beacon loss and disconnect
+    - wifi: rtw88: 8821c: Fix false alarm count
+    - wifi: brcm80211: handle pmk_op allocation failure
+    - riscv: dts: starfive: jh7100: fix root clock names
+    - PCI: Make pci_dev_is_disconnected() helper public for other drivers
+    - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
+    - iommu/vt-d: Use rbtree to track iommu probed devices
+    - iommu/vt-d: Improve ITE fault handling if target device isn't present
+    - iommu/vt-d: Use device rbtree in iopf reporting path
+    - iommu: Add static iommu_ops->release_domain
+    - iommu/vt-d: Fix NULL domain on device release
+    - igc: Fix missing time sync events
+    - igb: Fix missing time sync events
+    - ice: fix stats being updated by way too large values
+    - Bluetooth: Remove HCI_POWER_OFF_TIMEOUT
+    - Bluetooth: mgmt: Remove leftover queuing of power_off work
+    - Bluetooth: Remove superfluous call to hci_conn_check_pending()
+    - Bluetooth: Remove BT_HS
+    - Bluetooth: hci_event: Fix not indicating new connection for BIG Sync
+    - Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
+    - Bluetooth: hci_core: Cancel request on command timeout
+    - Bluetooth: hci_sync: Fix overwriting request callback
+    - Bluetooth: hci_h5: Add ability to allocate memory for private data
+    - Bluetooth: btrtl: fix out of bounds memory access
+    - Bluetooth: hci_core: Fix possible buffer overflow
+    - Bluetooth: msft: Fix memory leak
+    - Bluetooth: btusb: Fix memory leak
+    - Bluetooth: af_bluetooth: Fix deadlock
+    - Bluetooth: fix use-after-free in accessing skb after sending it
+    - sr9800: Add check for usbnet_get_endpoints
+    - s390/cache: prevent rebuild of shared_cpu_list
+    - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
+    - bpf: Fix hashtab overflow check on 32-bit arches
+    - bpf: Fix stackmap overflow check on 32-bit arches
+    - net: dsa: microchip: make sure drive strength configuration is not lost by
+      soft reset
+    - dpll: spec: use proper enum for pin capabilities attribute
+    - iommu: Fix compilation without CONFIG_IOMMU_INTEL
+    - ipv6: fib6_rules: flush route cache when rule is changed
+    - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
+    - octeontx2-af: Fix devlink params
+    - net: phy: fix phy_get_internal_delay accessing an empty array
+    - dpll: fix dpll_xa_ref_*_del() for multiple registrations
+    - net: hns3: fix wrong judgment condition issue
+    - net: hns3: fix kernel crash when 1588 is received on HIP08 devices
+    - net: hns3: fix port duplex configure error in IMP reset
+    - Bluetooth: Fix eir name length
+    - net: phy: dp83822: Fix RGMII TX delay configuration
+    - erofs: fix lockdep false positives on initializing erofs_pseudo_mnt
+    - OPP: debugfs: Fix warning around icc_get_name()
+    - tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
+    - ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt()
+      function
+    - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
+      function
+    - udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
+    - net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
+    - net/x25: fix incorrect parameter validation in the x25_getsockopt() function
+    - devlink: Fix length of eswitch inline-mode
+    - r8152: fix unknown device for choose_configuration
+    - nfp: flower: handle acti_netdevs allocation failure
+    - bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
+    - dm raid: fix false positive for requeue needed during reshape
+    - dm: call the resume method on internal suspend
+    - fbdev/simplefb: change loglevel when the power domains cannot be parsed
+    - drm/tegra: dsi: Add missing check for of_find_device_by_node
+    - drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
+    - drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
+    - drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path
+      of tegra_dsi_probe()
+    - drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe()
+    - drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
+    - drm/tegra: rgb: Fix missing clk_put() in the error handling paths of
+      tegra_dc_rgb_probe()
+    - drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths
+      of tegra_output_probe()
+    - drm/rockchip: inno_hdmi: Fix video timing
+    - drm: Don't treat 0 as -1 in drm_fixp2int_ceil
+    - drm/vkms: Avoid reading beyond LUT array
+    - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
+    - drm/rockchip: lvds: do not overwrite error code
+    - drm/rockchip: lvds: do not print scary message when probing defer
+    - drm/panel-edp: use put_sync in unprepare
+    - drm/lima: fix a memleak in lima_heap_alloc
+    - ASoC: amd: acp: Add missing error handling in sof-mach
+    - ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe()
+    - ASoC: SOF: core: Skip firmware test for custom loaders
+    - ASoC: SOF: amd: Compute file paths on firmware load
+    - soundwire: stream: add missing const to Documentation
+    - dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
+    - media: tc358743: register v4l2 async device only after successful setup
+    - media: cadence: csi2rx: use match fwnode for media link
+    - PCI/DPC: Print all TLP Prefixes, not just the first
+    - perf record: Fix possible incorrect free in record__switch_output()
+    - perf record: Check conflict between '--timestamp-filename' option and pipe
+      mode before recording
+    - HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
+    - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
+    - perf pmu: Treat the msr pmu as software
+    - crypto: qat - avoid memcpy() overflow warning
+    - ALSA: hda: cs35l41: Set Channel Index correctly when system is missing _DSD
+    - drm/amd/display: Fix potential NULL pointer dereferences in
+      'dcn10_set_output_transfer_func()'
+    - ASoC: sh: rz-ssi: Fix error message print
+    - drm/vmwgfx: Fix vmw_du_get_cursor_mob fencing of newly-created MOBs
+    - clk: renesas: r8a779g0: Fix PCIe clock name
+    - pinctrl: renesas: rzg2l: Fix locking in rzg2l_dt_subnode_to_map()
+    - pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function
+    - clk: samsung: exynos850: Propagate SPI IPCLK rate change
+    - media: v4l2: cci: print leading 0 on error
+    - perf evsel: Fix duplicate initialization of data->id in
+      evsel__parse_sample()
+    - perf bpf: Clean up the generated/copied vmlinux.h
+    - clk: meson: Add missing clocks to axg_clk_regmaps
+    - media: em28xx: annotate unchecked call to media_device_register()
+    - media: v4l2-tpg: fix some memleaks in tpg_alloc
+    - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
+    - media: dt-bindings: techwell,tw9900: Fix port schema ref
+    - mtd: spinand: esmt: Extend IDs to 5 bytes
+    - media: edia: dvbdev: fix a use-after-free
+    - pinctrl: mediatek: Drop bogus slew rate register range for MT8186
+    - pinctrl: mediatek: Drop bogus slew rate register range for MT8192
+    - drm/amdgpu: Fix potential out-of-bounds access in
+      'amdgpu_discovery_reg_base_init()'
+    - clk: qcom: reset: Commonize the de/assert functions
+    - clk: qcom: reset: Ensure write completion on reset de/assertion
+    - quota: Fix potential NULL pointer dereference
+    - quota: Fix rcu annotations of inode dquot pointers
+    - quota: Properly annotate i_dquot arrays with __rcu
+    - ASoC: Intel: ssp-common: Add stub for sof_ssp_get_codec_name
+    - PCI/P2PDMA: Fix a sleeping issue in a RCU read section
+    - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
+    - crypto: xilinx - call finalize with bh disabled
+    - drivers/ps3: select VIDEO to provide cmdline functions
+    - perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
+    - perf srcline: Add missed addr2line closes
+    - dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible
+    - drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN
+    - drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled
+    - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
+    - drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
+    - clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks
+    - clk: renesas: r8a779f0: Correct PFC/GPIO parent clock
+    - clk: renesas: r9a07g04[34]: Use SEL_SDHI1_STS status configuration for SD1
+      mux
+    - ALSA: seq: fix function cast warnings
+    - perf expr: Fix "has_event" function for metric style events
+    - perf stat: Avoid metric-only segv
+    - perf metric: Don't remove scale from counts
+    - ASoC: meson: aiu: fix function pointer type mismatch
+    - ASoC: meson: t9015: fix function pointer type mismatch
+    - powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
+    - ASoC: SOF: Add some bounds checking to firmware data
+    - drm: ci: use clk_ignore_unused for apq8016
+    - NTB: fix possible name leak in ntb_register_device()
+    - media: cedrus: h265: Fix configuring bitstream size
+    - media: sun8i-di: Fix coefficient writes
+    - media: sun8i-di: Fix power on/off sequences
+    - media: sun8i-di: Fix chroma difference threshold
+    - staging: media: starfive: Set 16 bpp for capture_raw device
+    - media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
+    - media: go7007: add check of return value of go7007_read_addr()
+    - media: pvrusb2: remove redundant NULL check
+    - media: videobuf2: Add missing doc comment for waiting_in_dqbuf
+    - media: pvrusb2: fix pvr2_stream_callback casts
+    - clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
+    - drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'
+    - drm/panel: boe-tv101wum-nl6: make use of prepare_prev_first
+    - drm/msm/dpu: finalise global state object
+    - drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
+    - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
+    - drm/bridge: adv7511: fix crash on irq during probe
+    - pinctrl: renesas: Allow the compiler to optimize away sh_pfc_pm
+    - clk: hisilicon: hi3519: Release the correct number of gates in
+      hi3519_clk_unregister()
+    - clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
+    - clk: mediatek: mt8135: Fix an error handling path in
+      clk_mt8135_apmixed_probe()
+    - clk: mediatek: mt7622-apmixedsys: Fix an error handling path in
+      clk_mt8135_apmixed_probe()
+    - clk: mediatek: mt8183: Correct parent of CLK_INFRA_SSPM_32K_SELF
+    - clk: mediatek: mt7981-topckgen: flag SGM_REG_SEL as critical
+    - drm/tegra: put drm_gem_object ref on error in tegra_fb_create
+    - tty: mips_ejtag_fdc: Fix passing incompatible pointer type warning
+    - media: ivsc: csi: Swap SINK and SOURCE pads
+    - media: i2c: imx290: Fix IMX920 typo
+    - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
+    - mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a
+      ref
+    - perf print-events: make is_event_supported() more robust
+    - crypto: arm/sha - fix function cast warnings
+    - crypto: ccp - Avoid discarding errors in psp_send_platform_access_msg()
+    - crypto: qat - remove unused macros in qat_comp_alg.c
+    - crypto: qat - removed unused macro in adf_cnv_dbgfs.c
+    - crypto: qat - avoid division by zero
+    - crypto: qat - remove double initialization of value
+    - crypto: qat - fix ring to service map for dcc in 4xxx
+    - crypto: qat - fix ring to service map for dcc in 420xx
+    - crypto: jitter - fix CRYPTO_JITTERENTROPY help text
+    - drm/tidss: Fix initial plane zpos values
+    - drm/tidss: Fix sync-lost issue with two displays
+    - clk: imx: imx8mp: Fix SAI_MCLK_SEL definition
+    - mtd: maps: physmap-core: fix flash size larger than 32-bit
+    - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
+    - mtd: rawnand: brcmnand: exec_op helper functions return type fixes
+    - ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
+    - ASoC: meson: axg-tdm-interface: add frame rate constraint
+    - drm/msm/a6xx: specify UBWC config for sc7180
+    - drm/msm/a7xx: Fix LLC typo
+    - dt-bindings: arm-smmu: fix SM8[45]50 GPU SMMU if condition
+    - perf pmu: Fix a potential memory leak in perf_pmu__lookup()
+    - HID: amd_sfh: Update HPD sensor structure elements
+    - HID: amd_sfh: Avoid disabling the interrupt
+    - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
+    - media: pvrusb2: fix uaf in pvr2_context_set_notify
+    - media: dvb-frontends: avoid stack overflow warnings with clang
+    - media: go7007: fix a memleak in go7007_load_encoder
+    - media: ttpci: fix two memleaks in budget_av_attach
+    - media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
+    - arm64: ftrace: Don't forbid CALL_OPS+CC_OPTIMIZE_FOR_SIZE with Clang
+    - drm/tests: helpers: Include missing drm_drv header
+    - drm/amd/pm: Fix esm reg mask use to get pcie speed
+    - gpio: nomadik: fix offset bug in nmk_pmx_set()
+    - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
+    - mfd: cs42l43: Fix wrong register defaults
+    - powerpc/32: fix ADB_CUDA kconfig warning
+    - powerpc/pseries: Fix potential memleak in papr_get_attr()
+    - powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
+    - clk: qcom: gcc-ipq5018: fix 'enable_reg' offset of 'gcc_gmac0_sys_clk'
+    - clk: qcom: gcc-ipq5018: fix 'halt_reg' offset of 'gcc_pcie1_pipe_clk'
+    - clk: qcom: gcc-ipq5018: fix register offset for GCC_UBI0_AXI_ARES reset
+    - perf vendor events amd: Fix Zen 4 cache latency events
+    - drm/msm/dpu: allow certain formats for CDM for DP
+    - drm/msm/dpu: add division of drm_display_mode's hskew parameter
+    - media: usbtv: Remove useless locks in usbtv_video_free()
+    - drm/xe: Fix ref counting leak on page fault
+    - drm/xe: Replace 'grouped target' in Makefile with pattern rule
+    - lib/stackdepot: fix first entry having a 0-handle
+    - lib/stackdepot: off by one in depot_fetch_stack()
+    - modules: wait do_free_init correctly
+    - mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults
+    - power: supply: mm8013: fix "not charging" detection
+    - powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
+    - powerpc/4xx: Fix warp_gpio_leds build failure
+    - RISC-V: KVM: Forward SEED CSR access to user space
+    - leds: aw2013: Unlock mutex before destroying it
+    - leds: sgm3140: Add missing timer cleanup and flash gpio control
+    - backlight: hx8357: Fix potential NULL pointer dereference
+    - backlight: ktz8866: Correct the check for of_property_read_u32
+    - backlight: lm3630a: Initialize backlight_properties on init
+    - backlight: lm3630a: Don't set bl->props.brightness in get_brightness
+    - backlight: da9052: Fully initialize backlight_properties during probe
+    - backlight: lm3639: Fully initialize backlight_properties during probe
+    - backlight: lp8788: Fully initialize backlight_properties during probe
+    - sparc32: Use generic cmpdi2/ucmpdi2 variants
+    - mtd: maps: sun_uflash: Declare uflash_devinit static
+    - sparc32: Do not select GENERIC_ISA_DMA
+    - sparc32: Fix section mismatch in leon_pci_grpci
+    - clk: Fix clk_core_get NULL dereference
+    - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
+    - PCI: brcmstb: Fix broken brcm_pcie_mdio_write() polling
+    - cifs: Fix writeback data corruption
+    - ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
+    - ALSA: hda/tas2781: use dev_dbg in system_resume
+    - ALSA: hda/tas2781: add lock to system_suspend
+    - ALSA: hda/tas2781: do not reset cur_* values in runtime_suspend
+    - ALSA: hda/tas2781: do not call pm_runtime_force_* in system_resume/suspend
+    - ALSA: hda/tas2781: restore power state after system_resume
+    - ALSA: scarlett2: Fix Scarlett 4th Gen 4i4 low-voltage detection
+    - ALSA: scarlett2: Fix Scarlett 4th Gen autogain status values
+    - ALSA: scarlett2: Fix Scarlett 4th Gen input gain range
+    - ALSA: scarlett2: Fix Scarlett 4th Gen input gain range again
+    - mips: cm: Convert __mips_cm_l2sync_phys_base() to weak function
+    - platform/x86/intel/pmc/lnl: Remove SSRAM support
+    - platform/x86/intel/pmc/arl: Put GNA device in D3
+    - platform/x86/amd/pmf: Do not use readl() for policy buffer access
+    - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
+    - phy: qcom: qmp-usb: split USB-C PHY driver
+    - phy: qcom: qmp-usbc: add support for the Type-C handling
+    - phy: qcom: qmp-usbc: handle CLAMP register in a correct way
+    - scsi: hisi_sas: Fix a deadlock issue related to automatic dump
+    - RDMA/irdma: Remove duplicate assignment
+    - RDMA/srpt: Do not register event handler until srpt device is fully setup
+    - f2fs: compress: fix to guarantee persisting compressed blocks by CP
+    - f2fs: compress: fix to cover normal cluster write with cp_rwsem
+    - f2fs: compress: fix to check unreleased compressed cluster
+    - f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode
+    - f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic
+    - f2fs: zone: fix to wait completion of last bio in zone correctly
+    - f2fs: fix NULL pointer dereference in f2fs_submit_page_write()
+    - f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem
+    - f2fs: fix to avoid potential panic during recovery
+    - scsi: csiostor: Avoid function pointer casts
+    - i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling
+    - RDMA/hns: Fix mis-modifying default congestion control algorithm
+    - RDMA/device: Fix a race between mad_client and cm_client init
+    - RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
+    - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
+    - f2fs: fix to create selinux label during whiteout initialization
+    - f2fs: compress: fix to check zstd compress level correctly in mount option
+    - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
+    - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
+    - NFSv4.2: fix listxattr maximum XDR buffer size
+    - f2fs: compress: fix to check compress flag w/ .i_sem lock
+    - f2fs: check number of blocks in a current section
+    - watchdog: starfive: Check pm_runtime_enabled() before decrementing usage
+      counter
+    - watchdog: stm32_iwdg: initialize default timeout
+    - f2fs: fix to use correct segment type in f2fs_allocate_data_block()
+    - f2fs: ro: compress: fix to avoid caching unaligned extent
+    - RDMA/mana_ib: Fix bug in creation of dma regions
+    - RDMA/mana_ib: Introduce mdev_to_gc helper function
+    - RDMA/mana_ib: Introduce mana_ib_get_netdev helper function
+    - RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function
+    - RDMA/mana_ib: Use virtual address in dma regions for MRs
+    - Input: iqs7222 - add support for IQS7222D v1.1 and v1.2
+    - NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt
+    - NFS: Fix an off by one in root_nfs_cat()
+    - NFSv4.1/pnfs: fix NFS with TLS in pnfs
+    - ACPI: HMAT: Remove register of memory node for generic target
+    - f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks
+    - f2fs: compress: fix reserve_cblocks counting error when out of space
+    - f2fs: fix to truncate meta inode pages forcely
+    - f2fs: zone: fix to remove pow2 check condition for zoned block device
+    - cxl: Fix the incorrect assignment of SSLBIS entry pointer initial location
+    - perf/x86/amd/core: Avoid register reset when CPU is dead
+    - afs: Revert "afs: Hide silly-rename files from userspace"
+    - afs: Don't cache preferred address
+    - afs: Fix occasional rmdir-then-VNOVNODE with generic/011
+    - f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
+    - nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
+    - ovl: relax WARN_ON in ovl_verify_area()
+    - io_uring/net: correct the type of variable
+    - remoteproc: stm32: Fix incorrect type in assignment for va
+    - remoteproc: stm32: Fix incorrect type assignment returned by
+      stm32_rproc_get_loaded_rsc_tablef
+    - iio: pressure: mprls0025pa fix off-by-one enum
+    - usb: phy: generic: Get the vbus supply
+    - tty: vt: fix 20 vs 0x20 typo in EScsiignore
+    - serial: max310x: fix syntax error in IRQ error message
+    - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
+    - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
+    - coresight: Fix issue where a source device's helpers aren't disabled
+    - coresight: etm4x: Set skip_power_up in etm4_init_arch_data function
+    - xhci: Add interrupt pending autoclear flag to each interrupter
+    - xhci: make isoc_bei_interval variable interrupter specific.
+    - xhci: remove unnecessary event_ring_deq parameter from xhci_handle_event()
+    - xhci: update event ring dequeue pointer position to controller correctly
+    - coccinelle: device_attr_show: Remove useless expression STR
+    - kconfig: fix infinite loop when expanding a macro at the end of file
+    - iio: gts-helper: Fix division loop
+    - bus: mhi: ep: check the correct variable in mhi_ep_register_controller()
+    - hwtracing: hisi_ptt: Move type check to the beginning of
+      hisi_ptt_pmu_event_init()
+    - rtc: mt6397: select IRQ_DOMAIN instead of depending on it
+    - rtc: max31335: fix interrupt status reg
+    - serial: 8250_exar: Don't remove GPIO device on suspend
+    - staging: greybus: fix get_channel_from_mode() failure path
+    - mei: vsc: Call wake_up() in the threaded IRQ handler
+    - mei: vsc: Don't use sleeping condition in wait_event_timeout()
+    - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
+    - char: xilinx_hwicap: Fix NULL vs IS_ERR() bug
+    - x86/hyperv: Use per cpu initial stack for vtl context
+    - ASoC: tlv320adc3xxx: Don't strip remove function when driver is builtin
+    - thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error
+      handling path
+    - thermal/drivers/qoriq: Fix getting tmu range
+    - io_uring: don't save/restore iowait state
+    - spi: lpspi: Avoid potential use-after-free in probe()
+    - spi: Restore delays for non-GPIO chip select
+    - ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates
+    - nouveau: reset the bo resource bus info after an eviction
+    - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
+    - rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
+    - octeontx2-af: Use matching wake_up API variant in CGX command interface
+    - s390/vtime: fix average steal time calculation
+    - net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
+    - devlink: Fix devlink parallel commands processing
+    - riscv: Only check online cpus for emulated accesses
+    - soc: fsl: dpio: fix kcalloc() argument order
+    - cpufreq: Fix per-policy boost behavior on SoCs using cpufreq_boost_set_sw()
+    - io_uring: Fix release of pinned pages when __io_uaddr_map fails
+    - tcp: Fix refcnt handling in __inet_hash_connect().
+    - vmxnet3: Fix missing reserved tailroom
+    - hsr: Fix uninit-value access in hsr_get_node()
+    - net: txgbe: fix clk_name exceed MAX_DEV_ID limits
+    - spi: spi-mem: add statistics support to ->exec_op() calls
+    - spi: Fix error code checking in spi_mem_exec_op()
+    - nvme: fix reconnection fail due to reserved tag allocation
+    - drm/xe: Invalidate userptr VMA on page pin fault
+    - drm/xe: Skip VMAs pin when requesting signal to the last XE_EXEC
+    - net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
+    - net: ethernet: mtk_eth_soc: fix PPE hanging issue
+    - io_uring: fix poll_remove stalled req completion
+    - ASoC: SOF: amd: Move signed_fw_image to struct acp_quirk_entry
+    - ASoC: SOF: amd: Skip IRAM/DRAM size modification for Steam Deck OLED
+    - riscv: Fix compilation error with FAST_GUP and rv32
+    - xen/evtchn: avoid WARN() when unbinding an event channel
+    - xen/events: increment refcnt only if event channel is refcounted
+    - packet: annotate data-races around ignore_outgoing
+    - xfrm: Allow UDP encapsulation only in offload modes
+    - net: veth: do not manipulate GRO when using XDP
+    - net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
+    - spi: spi-imx: fix off-by-one in mx51 CPU mode burst length
+    - drm: Fix drm_fixp2int_round() making it add 0.5
+    - virtio: uapi: Drop __packed attribute in linux/virtio_pci.h
+    - vdpa_sim: reset must not run
+    - vdpa/mlx5: Allow CVQ size changes
+    - virtio: packed: fix unmap leak for indirect desc table
+    - net: move dev->state into net_device_read_txrx group
+    - wireguard: receive: annotate data-race around receiving_counter.counter
+    - rds: introduce acquire/release ordering in acquire/release_in_xmit()
+    - hsr: Handle failures in module init
+    - ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels
+    - nouveau/gsp: don't check devinit disable on GSP.
+    - ceph: stop copying to iter at EOF on sync reads
+    - net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
+    - dm-integrity: fix a memory leak when rechecking the data
+    - net/bnx2x: Prevent access to a freed page in page_pool
+    - devlink: fix port new reply cmd type
+    - octeontx2: Detect the mbox up or down message via register
+    - octeontx2-pf: Wait till detach_resources msg is complete
+    - octeontx2-pf: Use default max_active works instead of one
+    - octeontx2-pf: Send UP messages to VF only when VF is up.
+    - octeontx2-af: Use separate handlers for interrupts
+    - drm/amdgpu: add MMHUB 3.3.1 support
+    - drm/amdgpu: fix mmhub client id out-of-bounds access
+    - drm/amdgpu: drop setting buffer funcs in sdma442
+    - netfilter: nft_set_pipapo: release elements in clone only from destroy path
+    - netfilter: nf_tables: do not compare internal table flags on updates
+    - rcu: add a helper to report consolidated flavor QS
+    - net: report RCU QS on threaded NAPI repolling
+    - bpf: report RCU QS in cpumap kthread
+    - net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
+    - net: dsa: mt7530: fix handling of all link-local frames
+    - netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
+    - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
+    - selftests: forwarding: Fix ping failure due to short timeout
+    - dm io: Support IO priority
+    - dm-integrity: align the outgoing bio in integrity_recheck
+    - x86/efistub: Clear decompressor BSS in native EFI entrypoint
+    - x86/efistub: Don't clear BSS twice in mixed mode
+    - printk: Adjust mapping for 32bit seq macros
+    - printk: Use prb_first_seq() as base for 32bit seq macros
+    - Linux 6.8.2
+    - [Config] updateconfig following v6.8.2 import
+  * Provide python perf module (LP: #2051560)
+    - [Packaging] enable perf python module
+    - [Packaging] provide a wrapper module for python-perf
+  * To support AMD Adaptive Backlight Management (ABM) for power profiles daemon
+    >= 2.0 (LP: #2056716)
+    - drm/amd/display: add panel_power_savings sysfs entry to eDP connectors
+    - drm/amdgpu: respect the abmlevel module parameter value if it is set
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable StarFive JH7100 support
+    - [Config] Disable Renesas RZ/Five support
+    - [Config] Disable BINFMT_FLAT for riscv64
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Mon, 03 Jun 2024 17:15:49 +0900
+
+linux-qcom (6.8.0-1003.3) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - Fix PCIe bus error
+    - Fix GPU regression
+    - Fix qps615 firmware load
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Fri, 10 May 2024 14:41:07 +0900
+
+linux-qcom (6.8.0-1002.2) jammy; urgency=medium
+
+  [ Ubuntu: 6.8.0-31.31 ]
+
+  * noble/linux: 6.8.0-31.31 -proposed tracker (LP: #2062933)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.04.04)
+
+  [ Ubuntu: 6.8.0-30.30 ]
+
+  * noble/linux: 6.8.0-30.30 -proposed tracker (LP: #2061893)
+  * System unstable, kernel ring buffer flooded with "BUG: Bad page state in
+    process swapper/0" (LP: #2056706)
+    - xen-netfront: Add missing skb_mark_for_recycle
+
+  [ Ubuntu: 6.8.0-29.29 ]
+
+  * noble/linux: 6.8.0-29.29 -proposed tracker (LP: #2061888)
+  * [24.04 FEAT] [SEC2353] zcrypt: extend error recovery to deal with device
+    scans (LP: #2050019)
+    - s390/zcrypt: harmonize debug feature calls and defines
+    - s390/zcrypt: introduce dynamic debugging for AP and zcrypt code
+    - s390/pkey: harmonize pkey s390 debug feature calls
+    - s390/pkey: introduce dynamic debugging for pkey
+    - s390/ap: add debug possibility for AP messages
+    - s390/zcrypt: add debug possibility for CCA and EP11 messages
+    - s390/ap: rearm APQNs bindings complete completion
+    - s390/ap: clarify AP scan bus related functions and variables
+    - s390/ap: rework ap_scan_bus() to return true on config change
+    - s390/ap: introduce mutex to lock the AP bus scan
+    - s390/zcrypt: introduce retries on in-kernel send CPRB functions
+    - s390/zcrypt: improve zcrypt retry behavior
+    - s390/pkey: improve pkey retry behavior
+  * [24.04 FEAT] Memory hotplug vmem pages (s390x) (LP: #2051835)
+    - mm/memory_hotplug: introduce MEM_PREPARE_ONLINE/MEM_FINISH_OFFLINE notifiers
+    - s390/mm: allocate vmemmap pages from self-contained memory range
+    - s390/sclp: remove unhandled memory notifier type
+    - s390/mm: implement MEM_PREPARE_ONLINE/MEM_FINISH_OFFLINE notifiers
+    - s390: enable MHP_MEMMAP_ON_MEMORY
+    - [Config] enable CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE and
+      CONFIG_MHP_MEMMAP_ON_MEMORY for s390x
+
+  [ Ubuntu: 6.8.0-28.28 ]
+
+  * noble/linux: 6.8.0-28.28 -proposed tracker (LP: #2061867)
+  * linux-gcp 6.8.0-1005.5 (+ others) Noble kernel regression iwth new apparmor
+    profiles/features (LP: #2061851)
+    - SAUCE: apparmor4.0.0 [92/90]: fix address mapping for recvfrom
+
+  [ Ubuntu: 6.8.0-25.25 ]
+
+  * noble/linux: 6.8.0-25.25 -proposed tracker (LP: #2061083)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.04.04)
+  * Apply mitigations for the native BHI hardware vulnerabilty (LP: #2060909)
+    - x86/cpufeatures: Add new word for scattered features
+    - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file
+    - x86/syscall: Don't force use of indirect calls for system calls
+    - x86/bhi: Add support for clearing branch history at syscall entry
+    - x86/bhi: Define SPEC_CTRL_BHI_DIS_S
+    - x86/bhi: Enumerate Branch History Injection (BHI) bug
+    - x86/bhi: Add BHI mitigation knob
+    - x86/bhi: Mitigate KVM by default
+    - KVM: x86: Add BHI_NO
+    - x86: set SPECTRE_BHI_ON as default
+    - [Config] enable spectre_bhi=auto by default
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/90]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/90]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/90]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/90]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/90]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/90]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/90]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/90]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/90]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/90]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/90]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/90]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/90]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/90]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/90]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/90]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/90]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/90]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/90]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/90]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/90]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/90]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/90]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [31/90]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/90]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/90]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/90]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/90]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/90]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/90]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/90]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/90]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/90]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/90]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/90]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [43/90]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/90]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/90]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/90]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/90]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/90]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/90]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/90]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/90]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/90]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/90]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/90]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/90]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/90]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/90]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/90]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/90]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/90]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/90]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/90]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/90]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/90]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [65/90] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [69/90]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [70/90]: apparmor: fix oops when racing to retrieve
+      notification
+    - SAUCE: apparmor4.0.0 [71/90]: apparmor: fix notification header size
+    - SAUCE: apparmor4.0.0 [72/90]: apparmor: fix request field from a prompt
+      reply that denies all access
+    - SAUCE: apparmor4.0.0 [73/90]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+    - SAUCE: apparmor4.0.0 [74/90]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/90]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/90]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/90]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/90]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/90]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/90]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/90]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/90]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/90]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/90]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/90]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/90]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/90]: fixup notify
+    - SAUCE: apparmor4.0.0 [88/90]: apparmor: add fine grained ipv4/ipv6 mediation
+    - SAUCE: apparmor4.0.0 [89/90]:apparmor: disable tailglob responses for now
+    - SAUCE: apparmor4.0.0 [90/90]: apparmor: Fix notify build warnings
+    - SAUCE: apparmor4.0.0: fix reserved mem for when we save ipv6 addresses
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/90]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/90]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/90]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+  * [MTL] x86: Fix Cache info sysfs is not populated (LP: #2049793)
+    - SAUCE: cacheinfo: Check for null last-level cache info
+    - SAUCE: cacheinfo: Allocate memory for memory if not done from the primary
+      CPU
+    - SAUCE: x86/cacheinfo: Delete global num_cache_leaves
+    - SAUCE: x86/cacheinfo: Clean out init_cache_level()
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor4.0.0: LSM stacking v39: fix build error with
+      CONFIG_SECURITY=n
+    - [Config] toolchain version update
+
+  [ Ubuntu: 6.8.0-22.22 ]
+
+  * noble/linux: 6.8.0-22.22 -proposed tracker (LP: #2060238)
+
+  [ Ubuntu: 6.8.0-21.21 ]
+
+  * noble/linux: 6.8.0-21.21 -proposed tracker (LP: #2060225)
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain version in annotations
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 01 May 2024 13:45:36 +0900
+
+linux-qcom (6.8.0-1001.1) jammy; urgency=medium
+
+  * Import GA1
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 09 Apr 2024 01:46:04 +0900
+
+linux-qcom (6.8.0-1000.0) jammy; urgency=medium
+
+  [ Ubuntu: 6.8.0-20.20 ]
+
+  * noble/linux: 6.8.0-20.20 -proposed tracker (LP: #2058221)
+  * Noble update: v6.8.1 upstream stable release (LP: #2058224)
+    - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
+    - Documentation/hw-vuln: Add documentation for RFDS
+    - x86/rfds: Mitigate Register File Data Sampling (RFDS)
+    - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
+    - Linux 6.8.1
+  * Autopkgtest failures on amd64 (LP: #2048768)
+    - [Packaging] update to clang-18
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor4.0.0: LSM stacking v39: fix build error with
+      CONFIG_SECURITY=n
+    - [Config] amd64: MITIGATION_RFDS=y
+
+  [ Ubuntu: 6.8.0-19.19 ]
+
+  * noble/linux: 6.8.0-19.19 -proposed tracker (LP: #2057910)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-introduce linux-doc as an empty package
+
+  [ Ubuntu: 6.8.0-18.18 ]
+
+  * noble/linux: 6.8.0-18.18 -proposed tracker (LP: #2057456)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] drop dependency on libclang-17
+
+  [ Ubuntu: 6.8.0-17.17 ]
+
+  * noble/linux: 6.8.0-17.17 -proposed tracker (LP: #2056745)
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Add debian/control sanity check"
+
+  [ Ubuntu: 6.8.0-16.16 ]
+
+  * noble/linux: 6.8.0-16.16 -proposed tracker (LP: #2056738)
+  * left-over ceph debugging printks (LP: #2056616)
+    - Revert "UBUNTU: SAUCE: ceph: make sure all the files successfully put before
+      unmounting"
+  * qat: Improve error recovery flows (LP: #2056354)
+    - crypto: qat - add heartbeat error simulator
+    - crypto: qat - disable arbitration before reset
+    - crypto: qat - update PFVF protocol for recovery
+    - crypto: qat - re-enable sriov after pf reset
+    - crypto: qat - add fatal error notification
+    - crypto: qat - add auto reset on error
+    - crypto: qat - limit heartbeat notifications
+    - crypto: qat - improve aer error reset handling
+    - crypto: qat - change SLAs cleanup flow at shutdown
+    - crypto: qat - resolve race condition during AER recovery
+    - Documentation: qat: fix auto_reset section
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/87]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/87]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/87]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/87]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/87]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/87]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/87]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/87]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/87]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/87]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/87]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/87]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/87]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/87]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/87]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/87]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/87]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/87]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/87]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/87]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/87]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [31/87]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/87]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/87]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/87]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/87]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/87]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/87]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/87]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/87]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/87]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/87]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/87]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [43/87]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/87]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/87]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/87]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/87]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/87]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/87]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/87]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/87]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/87]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/87]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/87]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/87]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/87]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/87]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/87]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/87]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/87]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/87]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/87]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/87]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/87]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [65/87] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [69/87]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [70/87]: apparmor: fix oops when racing to retrieve
+      notification
+    - SAUCE: apparmor4.0.0 [71/87]: apparmor: fix notification header size
+    - SAUCE: apparmor4.0.0 [72/87]: apparmor: fix request field from a prompt
+      reply that denies all access
+    - SAUCE: apparmor4.0.0 [73/87]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+    - SAUCE: apparmor4.0.0 [74/87]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/87]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/87]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/87]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/87]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/87]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/87]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/87]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/87]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/87]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/87]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/87]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/87]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/87]: fixup notify
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/87]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/87]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/87]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+  * Enable lowlatency settings in the generic kernel (LP: #2051342)
+    - [Config] enable low-latency settings
+  * hwmon: (coretemp) Fix core count limitation (LP: #2056126)
+    - hwmon: (coretemp) Introduce enum for attr index
+    - hwmon: (coretemp) Remove unnecessary dependency of array index
+    - hwmon: (coretemp) Replace sensor_device_attribute with device_attribute
+    - hwmon: (coretemp) Remove redundant pdata->cpu_map[]
+    - hwmon: (coretemp) Abstract core_temp helpers
+    - hwmon: (coretemp) Split package temp_data and core temp_data
+    - hwmon: (coretemp) Remove redundant temp_data->is_pkg_data
+    - hwmon: (coretemp) Use dynamic allocated memory for core temp_data
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION
+    - [Packaging] remove debian/scripts/misc/arch-has-odm-enabled.sh
+    - rebase on v6.8
+    - [Config] toolchain version update
+  * Miscellaneous upstream changes
+    - crypto: qat - add fatal error notify method
+  * Rebase on v6.8
+
+  [ Ubuntu: 6.8.0-15.15 ]
+
+  * noble/linux: 6.8.0-15.15 -proposed tracker (LP: #2055871)
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.8-rc7
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Transition laptop-23.10 to generic"
+  * Rebase on v6.8-rc7
+
+  [ Ubuntu: 6.8.0-14.14 ]
+
+  * noble/linux: 6.8.0-14.14 -proposed tracker (LP: #2055551)
+  * Please change CONFIG_CONSOLE_LOGLEVEL_QUIET to 3 (LP: #2049390)
+    - [Config] reduce verbosity when booting in quiet mode
+  * linux: please move erofs.ko (CONFIG_EROFS for EROFS support) from linux-
+    modules-extra to linux-modules (LP: #2054809)
+    - UBUNTU [Packaging]: Include erofs in linux-modules instead of linux-modules-
+      extra
+  * linux: please move dmi-sysfs.ko (CONFIG_DMI_SYSFS for SMBIOS support) from
+    linux-modules-extra to linux-modules (LP: #2045561)
+    - [Packaging] Move dmi-sysfs.ko into linux-modules
+  * Enable CONFIG_INTEL_IOMMU_DEFAULT_ON and
+    CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON (LP: #1951440)
+    - [Config] enable Intel DMA remapping by default
+  * disable Intel DMA remapping by default (LP: #1971699)
+    - [Config] update tracking bug for CONFIG_INTEL_IOMMU_DEFAULT_ON
+  * Packaging resync (LP: #1786013)
+    - debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.02.29)
+  * Miscellaneous Ubuntu changes
+    - SAUCE: modpost: Replace 0-length array with flex-array member
+    - [packaging] do not include debian/ directory in a binary package
+    - [packaging] remove debian/stamps/keep-dir
+
+  [ Ubuntu: 6.8.0-13.13 ]
+
+  * noble/linux: 6.8.0-13.13 -proposed tracker (LP: #2055421)
+  * Packaging resync (LP: #1786013)
+    - debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.02.29)
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.8-rc6
+    - [Config] updateconfifs following v6.8-rc6 rebase
+  * Rebase on v6.8-rc6
+
+  [ Ubuntu: 6.8.0-12.12 ]
+
+  * linux-tools-common: man page of usbip[d] is misplaced (LP: #2054094)
+    - [Packaging] rules: Put usbip manpages in the correct directory
+  * Validate connection interval to pass Bluetooth Test Suite (LP: #2052005)
+    - Bluetooth: Enforce validation on max value of connection interval
+  * Turning COMPAT_32BIT_TIME off on s390x (LP: #2038583)
+    - [Config] Turn off 31-bit COMPAT on s390x
+  * Don't produce linux-source binary package (LP: #2043994)
+    - [Packaging] Add debian/control sanity check
+  * Don't produce linux-*-source-<version> package (LP: #2052439)
+    - [Packaging] Move linux-source package stub to debian/control.d
+    - [Packaging] Build linux-source package only for the main kernel
+  * Don't produce linux-*-cloud-tools-common, linux-*-tools-common and
+    linux-*-tools-host binary packages (LP: #2048183)
+    - [Packaging] Move indep tools package stubs to debian/control.d
+    - [Packaging] Build indep tools packages only for the main kernel
+  * Enable CONFIG_INTEL_IOMMU_DEFAULT_ON and
+    CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON (LP: #1951440)
+    - [Config] enable Intel DMA remapping by default
+  * disable Intel DMA remapping by default (LP: #1971699)
+    - [Config] update tracking bug for CONFIG_INTEL_IOMMU_DEFAULT_ON
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Transition laptop-23.10 to generic
+
+  [ Ubuntu: 6.8.0-11.11 ]
+
+  * noble/linux: 6.8.0-11.11 -proposed tracker (LP: #2053094)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] riscv64: disable building unnecessary binary debs
+
+  [ Ubuntu: 6.8.0-10.10 ]
+
+  * noble/linux: 6.8.0-10.10 -proposed tracker (LP: #2053015)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] add Rust build-deps for riscv64
+  * Miscellaneous upstream changes
+    - Revert "Revert "UBUNTU: [Packaging] temporarily disable Rust dependencies on
+      riscv64""
+
+  [ Ubuntu: 6.8.0-9.9 ]
+
+  * noble/linux: 6.8.0-9.9 -proposed tracker (LP: #2052945)
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable Rust dependencies on
+      riscv64"
+
+  [ Ubuntu: 6.8.0-8.8 ]
+
+  * noble/linux: 6.8.0-8.8 -proposed tracker (LP: #2052918)
+  * Miscellaneous Ubuntu changes
+    - [Packaging] riscv64: enable linux-libc-dev build
+    - v6.8-rc4 rebase
+  * Rebase on v6.8-rc4
+
+  [ Ubuntu: 6.8.0-7.7 ]
+
+  * noble/linux: 6.8.0-7.7 -proposed tracker (LP: #2052691)
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/87]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/87]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/87]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/87]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/87]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/87]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/87]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/87]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/87]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/87]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/87]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/87]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/87]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/87]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/87]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/87]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/87]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/87]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/87]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/87]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/87]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [31/87]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/87]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/87]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/87]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/87]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/87]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/87]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/87]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/87]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/87]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/87]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/87]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [43/87]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/87]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/87]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/87]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/87]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/87]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/87]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/87]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/87]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/87]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/87]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/87]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/87]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/87]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/87]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/87]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/87]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/87]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/87]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/87]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/87]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/87]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [65/87] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [69/87]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [70/87]: apparmor: fix oops when racing to retrieve
+      notification
+    - SAUCE: apparmor4.0.0 [71/87]: apparmor: fix notification header size
+    - SAUCE: apparmor4.0.0 [72/87]: apparmor: fix request field from a prompt
+      reply that denies all access
+    - SAUCE: apparmor4.0.0 [73/87]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+    - SAUCE: apparmor4.0.0 [74/87]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/87]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/87]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/87]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/87]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/87]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/87]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/87]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/87]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/87]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/87]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/87]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/87]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/87]: fixup notify
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/87]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/87]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/87]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+
+  [ Ubuntu: 6.8.0-6.6 ]
+
+  * noble/linux: 6.8.0-6.6 -proposed tracker (LP: #2052592)
+  * Packaging resync (LP: #1786013)
+    - debian.master/dkms-versions -- update from kernel-versions
+      (main/d2024.02.07)
+    - [Packaging] update variants
+  * FIPS kernels should default to fips mode (LP: #2049082)
+    - SAUCE: Enable fips mode by default, in FIPS kernels only
+  * Fix snapcraftyaml.yaml for jammy:linux-raspi (LP: #2051468)
+    - [Packaging] Remove old snapcraft.yaml
+  * Azure: Fix regression introduced in LP: #2045069 (LP: #2052453)
+    - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove in-tree abi checks
+    - [Packaging] drop abi files with clean
+    - [Packaging] Remove do_full_source variable (fixup)
+    - [Packaging] Remove update-dkms-versions and move dkms-versions
+    - [Config] updateconfigs following v6.8-rc3 rebase
+    - [packaging] rename to linux
+    - [packaging] rebase on v6.8-rc3
+    - [packaging] disable signing for ppc64el
+  * Rebase on v6.8-rc3
+
+  [ Ubuntu: 6.8.0-5.5 ]
+
+  * noble/linux-unstable: 6.8.0-5.5 -proposed tracker (LP: #2052136)
+  * Miscellaneous upstream changes
+    - Revert "mm/sparsemem: fix race in accessing memory_section->usage"
+
+  [ Ubuntu: 6.8.0-4.4 ]
+
+  * noble/linux-unstable: 6.8.0-4.4 -proposed tracker (LP: #2051502)
+  * Migrate from fbdev drivers to simpledrm and DRM fbdev emulation layer
+    (LP: #1965303)
+    - [Config] enable simpledrm and DRM fbdev emulation layer
+  * Miscellaneous Ubuntu changes
+    - [Config] toolchain update
+  * Miscellaneous upstream changes
+    - rust: upgrade to Rust 1.75.0
+
+  [ Ubuntu: 6.8.0-3.3 ]
+
+  * noble/linux-unstable: 6.8.0-3.3 -proposed tracker (LP: #2051488)
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [43/87]: LSM stacking v39: UBUNTU: SAUCE: apparmor4.0.0
+      [12/95]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [44/87]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [45/87]: add unpriviled user ns mediation
+    - SAUCE: apparmor4.0.0 [46/87]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [47/87]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [48/87]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [49/87]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [50/87]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/87]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/87]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/87]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [54/87]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [55/87]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [56/87]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [57/87]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [58/87]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [59/87]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [60/87]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [61/87]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [62/87]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [63/87]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [64/87]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [69/87]: add io_uring mediation
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+  * apparmor restricts read access of user namespace mediation sysctls to root
+    (LP: #2040194)
+    - SAUCE: apparmor4.0.0 [73/87]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+  * AppArmor spams kernel log with assert when auditing (LP: #2040192)
+    - SAUCE: apparmor4.0.0 [72/87]: apparmor: fix request field from a prompt
+      reply that denies all access
+  * apparmor notification files verification (LP: #2040250)
+    - SAUCE: apparmor4.0.0 [71/87]: apparmor: fix notification header size
+  * apparmor oops when racing to retrieve a notification (LP: #2040245)
+    - SAUCE: apparmor4.0.0 [70/87]: apparmor: fix oops when racing to retrieve
+      notification
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [66/87]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [67/87]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [68/87]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor4.0.0 [01/87]: LSM stacking v39: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [02/87]: LSM stacking v39: SM: Infrastructure
+      management of the sock security
+    - SAUCE: apparmor4.0.0 [03/87]: LSM stacking v39: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [04/87]: LSM stacking v39: IMA: avoid label collisions
+      with stacked LSMs
+    - SAUCE: apparmor4.0.0 [05/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [06/87]: LSM stacking v39: LSM: Add lsmblob_to_secctx
+      hook
+    - SAUCE: apparmor4.0.0 [07/87]: LSM stacking v39: Audit: maintain an lsmblob
+      in audit_context
+    - SAUCE: apparmor4.0.0 [08/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [09/87]: LSM stacking v39: Audit: Update shutdown LSM
+      data
+    - SAUCE: apparmor4.0.0 [10/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [11/87]: LSM stacking v39: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [12/87]: LSM stacking v39: Audit: use an lsmblob in
+      audit_names
+    - SAUCE: apparmor4.0.0 [13/87]: LSM stacking v39: LSM: Create new
+      security_cred_getlsmblob LSM hook
+    - SAUCE: apparmor4.0.0 [14/87]: LSM stacking v39: Audit: Change context data
+      from secid to lsmblob
+    - SAUCE: apparmor4.0.0 [15/87]: LSM stacking v39: Netlabel: Use lsmblob for
+      audit data
+    - SAUCE: apparmor4.0.0 [16/87]: LSM stacking v39: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [17/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [18/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_lsmblob_to_secctx
+    - SAUCE: apparmor4.0.0 [19/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [20/87]: LSM stacking v39: LSM: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [21/87]: LSM stacking v39: LSM:
+      security_lsmblob_to_secctx module selection
+    - SAUCE: apparmor4.0.0 [22/87]: LSM stacking v39: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [23/87]: LSM stacking v39: Audit: Allow multiple
+      records in an audit_buffer
+    - SAUCE: apparmor4.0.0 [24/87]: LSM stacking v39: Audit: Add record for
+      multiple task security contexts
+    - SAUCE: apparmor4.0.0 [25/87]: LSM stacking v39: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [26/87]: LSM stacking v39: Audit: Add record for
+      multiple object contexts
+    - SAUCE: apparmor4.0.0 [27/87]: LSM stacking v39: LSM: Remove unused
+      lsmcontext_init()
+    - SAUCE: apparmor4.0.0 [28/87]: LSM stacking v39: LSM: Improve logic in
+      security_getprocattr
+    - SAUCE: apparmor4.0.0 [29/87]: LSM stacking v39: LSM: secctx provider check
+      on release
+    - SAUCE: apparmor4.0.0 [30/87]: LSM stacking v39: LSM: Single calls in
+      socket_getpeersec hooks
+    - SAUCE: apparmor4.0.0 [31/87]: LSM stacking v39: LSM: Exclusive secmark usage
+    - SAUCE: apparmor4.0.0 [32/87]: LSM stacking v39: LSM: Identify which LSM
+      handles the context string
+    - SAUCE: apparmor4.0.0 [33/87]: LSM stacking v39: AppArmor: Remove the
+      exclusive flag
+    - SAUCE: apparmor4.0.0 [34/87]: LSM stacking v39: LSM: Add mount opts blob
+      size tracking
+    - SAUCE: apparmor4.0.0 [35/87]: LSM stacking v39: LSM: allocate mnt_opts blobs
+      instead of module specific data
+    - SAUCE: apparmor4.0.0 [36/87]: LSM stacking v39: LSM: Infrastructure
+      management of the key security blob
+    - SAUCE: apparmor4.0.0 [37/87]: LSM stacking v39: LSM: Infrastructure
+      management of the mnt_opts security blob
+    - SAUCE: apparmor4.0.0 [38/87]: LSM stacking v39: LSM: Correct handling of
+      ENOSYS in inode_setxattr
+    - SAUCE: apparmor4.0.0 [39/87]: LSM stacking v39: LSM: Remove lsmblob
+      scaffolding
+    - SAUCE: apparmor4.0.0 [40/87]: LSM stacking v39: LSM: Allow reservation of
+      netlabel
+    - SAUCE: apparmor4.0.0 [41/87]: LSM stacking v39: LSM: restrict
+      security_cred_getsecid() to a single LSM
+    - SAUCE: apparmor4.0.0 [42/87]: LSM stacking v39: Smack: Remove
+      LSM_FLAG_EXCLUSIVE
+    - SAUCE: apparmor4.0.0 [65/87] v6.8 prompt:fixup interruptible
+    - SAUCE: apparmor4.0.0 [74/87]: apparmor: cleanup attachment perm lookup to
+      use lookup_perms()
+    - SAUCE: apparmor4.0.0 [75/87]: apparmor: remove redundant unconfined check.
+    - SAUCE: apparmor4.0.0 [76/87]: apparmor: switch signal mediation to using
+      RULE_MEDIATES
+    - SAUCE: apparmor4.0.0 [77/87]: apparmor: ensure labels with more than one
+      entry have correct flags
+    - SAUCE: apparmor4.0.0 [78/87]: apparmor: remove explicit restriction that
+      unconfined cannot use change_hat
+    - SAUCE: apparmor4.0.0 [79/87]: apparmor: cleanup: refactor file_perm() to
+      provide semantics of some checks
+    - SAUCE: apparmor4.0.0 [80/87]: apparmor: carry mediation check on label
+    - SAUCE: apparmor4.0.0 [81/87]: apparmor: convert easy uses of unconfined() to
+      label_mediates()
+    - SAUCE: apparmor4.0.0 [82/87]: apparmor: add additional flags to extended
+      permission.
+    - SAUCE: apparmor4.0.0 [83/87]: apparmor: add support for profiles to define
+      the kill signal
+    - SAUCE: apparmor4.0.0 [84/87]: apparmor: fix x_table_lookup when stacking is
+      not the first entry
+    - SAUCE: apparmor4.0.0 [85/87]: apparmor: allow profile to be transitioned
+      when a user ns is created
+    - SAUCE: apparmor4.0.0 [86/87]: apparmor: add ability to mediate caps with
+      policy state machine
+    - SAUCE: apparmor4.0.0 [87/87]: fixup notify
+    - [Config] updateconfigs following v6.8-rc2 rebase
+
+  [ Ubuntu: 6.8.0-2.2 ]
+
+  * noble/linux-unstable: 6.8.0-2.2 -proposed tracker (LP: #2051110)
+  * Miscellaneous Ubuntu changes
+    - [Config] toolchain update
+    - [Config] enable Rust
+
+  [ Ubuntu: 6.8.0-1.1 ]
+
+  * noble/linux-unstable: 6.8.0-1.1 -proposed tracker (LP: #2051102)
+  * Miscellaneous Ubuntu changes
+    - [packaging] move to v6.8-rc1
+    - [Config] updateconfigs following v6.8-rc1 rebase
+    - SAUCE: export file_close_fd() instead of close_fd_get_file()
+    - SAUCE: cpufreq: s/strlcpy/strscpy/
+    - debian/dkms-versions -- temporarily disable zfs dkms
+    - debian/dkms-versions -- temporarily disable ipu6 and isvsc dkms
+    - debian/dkms-versions -- temporarily disable v4l2loopback
+
+  [ Ubuntu: 6.8.0-0.0 ]
+
+  * Empty entry.
+
+  [ Ubuntu: 6.7.0-7.7 ]
+
+  * noble/linux-unstable: 6.7.0-7.7 -proposed tracker (LP: #2049357)
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable signing for s390x and ppc64el
+
+  [ Ubuntu: 6.7.0-6.6 ]
+
+  * Empty entry.
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 27 Mar 2024 23:23:18 +0900
+
+linux-qcom (6.7.0-1012.12) jammy; urgency=medium
+
+  * [qcom alpha] Suppress noisy logs
+    - SAUCE: icnss2: supress noisy logs
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: update apply overlay application for pre-GA
+    - SAUCE: update graphics DT overlay to pre-GA
+    - SAUCE: update display DT overlay to pre-GA
+    - SAUCE: update camera overlay to pre-GA
+    - SAUCE: update bluetooth DT overlay to pre-GA
+    - SAUCE: update wlan DT overlay to pre-GA
+    - [config] Disable CONFIG_EFI_ZBOOT
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 21 Mar 2024 02:17:22 +0900
+
+linux-qcom (6.7.0-1011.11) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: update wlan qclacld driver code to pre-GA
+    - SAUCE: update qcm6490 display code to pre-GA
+    - SAUCE: fix build warnings and errors in WLAN driver
+    - SAUCE: import qcm6490 graphics driver code
+    - SAUCE: dynamically allocate the kgsl-pool shrinker for kernel>=6.7
+    - SAUCE: change strtobool() to kstrtobool()
+    - SAUCE: update qcm6490 camera driver code to pre-GA
+    - SAUCE: use sizeof() instead of V4L2_SUBDEV_NAME_SIZE
+    - SAUCE: remove unused camera_banner
+    - Config: Update config after applying Pre-GA patches
+    - Packaging: Update module list after merging pre-ga patches
+
+  * Miscellaneous upstream changes
+    - QCLINUX: arm64: defconfig: qcom: Enable UVC/UAC related configs
+    - FROMGIT: scsi: ufs: qcom: Add support to Configure
+      PA_VS_CORE_CLK_40NS_CYCLES
+    - FROMLIST: iommu/arm-smmu: add ACTLR data and support for SC7280
+    - FROMLIST: iommu/arm-smmu: re-enable context caching in smmu reset operation
+    - PENDING: soundwire: qcom: add channel mask port configuration for soundwire
+      master
+    - PENDING: dt-bindings: soundwire: qcom: Document the port channel mask
+      property
+    - PENDING: arm64: dts: qcom: sc7280: add channel mask ports for tx soundwire
+    - FROMGIT: iio: adc: Add PM7325 PMIC7 ADC bindings
+    - PENDING: iris: fix LTR_COUNT configuration to firmware
+    - PENDING: i2c: i2c-qcom-geni: Add Multi EE feature support
+    - FROMLIST: dt-bindings: misc: qcom,dcc: Add the dtschema
+    - PENDING: ASoC: qcom: qcm6490: Fix clock freq for mi2s and tdm
+    - FROMLIST: misc: dcc: Add driver support for Data Capture and Compare
+      unit(DCC)
+    - PENDING: misc: fastrpc: Release PDR handle
+    - QCLINUX: arm64: configs: qcom: Enable TRACE_MMIO_ACCESS
+    - PENDING: arm64: dts: qcom: sc7280: Correct the compatible of dcc
+    - QCLINUX: arm64: defconfig: Enable DCC config
+    - QCLINUX: arm64: defconfig: qcom: Disable DEBUG_INFO_REDUCED
+    - PENDING: scsi: ufs: host: Bugfix evict key call in ufs host
+    - FROMLIST: soc: qcom: ice: support for hardware wrapped keys
+    - PENDING: iris: change the default value of HEADER_MODE config
+    - QCLINUX: ASoC: qcom: audio-pkt: avoid duplicate sysfs during ssr
+    - QCLINUX: ASoC: qcom: qdsp6: Add support to create CMA heap
+    - QCLINUX: soc: qcom: Implement a driver to write kaslr addr to imem
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add reserved memory for audio ml
+    - QCLINUX: arm64: defconfig: Enable smp2p_sleepstate
+    - FROMGIT: dt-bindings: soc: qcom,aoss-qmp: document the SM8560 Always-On
+      Subsystem side channel
+    - FROMGIT: dt-bindings: interconnect: qcom-bwmon: document SM8650 BWMONs
+    - FROMGIT: dt-bindings: usb: qcom,dwc3: document the SM8560 SuperSpeed DWC3
+      USB controller
+    - FROMGIT: dt-bindings: dma: qcom,gpi: document the SM8650 GPI DMA Engine
+    - FROMGIT: dt-bindings: crypto: qcom,inline-crypto-engine: document the SM8650
+      ICE
+    - FROMGIT: dt-bindings: qcom,pdc: Add compatible for SM8550
+    - FROMGIT: arm64: dts: qcom: sm8550: add TRNG node
+    - FROMGIT: dt-bindings: qcom,pdc: document the SM8650 Power Domain Controller
+    - FROMGIT: dt-bindings: soc: qcom: pmic-glink: document SM8650 compatible
+    - FROMGIT: dt-bindings: crypto: qcom,prng: document SM8650
+    - FROMGIT: dt-bindings: firmware: qcom,scm: document SM8650 SCM Firmware
+      Interface
+    - FROMGIT: dt-bindings: iommu: arm,smmu: document the SM8650 System MMU
+    - FROMGIT: dt-bindings: thermal: qcom-tsens: document the SM8650 Temperature
+      Sensor
+    - FROMGIT: dt-bindings: clock: qcom: document the SM8650 TCSR Clock Controller
+    - FROMGIT: dt-bindings: clock: qcom: document the SM8650 General Clock
+      Controller
+    - FROMGIT: dt-bindings: clock: qcom: document the SM8650 Display Clock
+      Controller
+    - FROMGIT: dt-bindings: clock: qcom: document the SM8650 GPU Clock Controller
+    - FROMGIT: clk: qcom: add the SM8650 Global Clock Controller driver, part 1
+    - FROMGIT: clk: qcom: add the SM8650 Global Clock Controller driver, part 2
+    - FROMGIT: clk: qcom: add the SM8650 TCSR Clock Controller driver
+    - FROMGIT: clk: qcom: add the SM8650 Display Clock Controller driver
+    - FROMGIT: clk: qcom: add the SM8650 GPU Clock Controller driver
+    - FROMGIT: clk: qcom: rpmh: add clocks for SM8650
+    - FROMGIT: dt-bindings: interconnect: document the RPMh Network-On-Chip
+      Interconnect in Qualcomm SM8650 SoC
+    - FROMGIT: interconnect: qcom: introduce RPMh Network-On-Chip Interconnect on
+      SM8650 SoC
+    - FROMGIT: dt-bindings: cache: qcom,llcc: Document the SM8650 Last Level Cache
+      Controller
+    - FROMGIT: soc: qcom: llcc: Add configuration data for SM8650
+    - FROMGIT: drm/msm/dpu: enable smartdma on sm8350
+    - FROMGIT: drm/msm/dpu: enable SmartDMA on SM8450
+    - FROMGIT: drm/msm/dpu: populate SSPP scaler block version
+    - FROMGIT: drm/msm/dpu: Drop unused get_scaler_ver callback from SSPP
+    - FROMGIT: drm/msm/dpu: Drop unused qseed_type from catalog dpu_caps
+    - FROMGIT: drm/msm/dpu: drop the `id' field from DPU_HW_SUBBLK_INFO
+    - FROMGIT: drm/msm/dpu: drop the `smart_dma_priority' field from struct
+      dpu_sspp_sub_blks
+    - FROMGIT: drm/msm/dpu: deduplicate some (most) of SSPP sub-blocks
+    - FROMGIT: drm/msm/dpu: drop DPU_HW_SUBBLK_INFO macro
+    - FROMGIT: drm/msm/dpu: rewrite scaler and CSC presense checks
+    - FROMGIT: drm/msm/dpu: merge DPU_SSPP_SCALER_QSEED3, QSEED3LITE, QSEED4
+    - FROMGIT: drm/msm/gpu: drop duplicating VIG feature masks
+    - FROMGIT: dt-bindings: display: msm-dsi-phy-7nm: document the SM8650 DSI PHY
+    - FROMGIT: dt-bindings: display: msm-dsi-controller-main: document the SM8650
+      DSI Controller
+    - FROMGIT: dt-bindings: display: msm: document the SM8650 DPU
+    - FROMGIT: dt-bindings: display: msm: document the SM8650 Mobile Display
+      Subsystem
+    - FROMGIT: drm/msm/dpu: add support for SM8650 DPU
+    - FROMGIT: drm/msm: mdss: add support for SM8650
+    - FROMGIT: drm/msm: dsi: add support for DSI-PHY on SM8650
+    - FROMGIT: drm/msm: dsi: add support for DSI 2.8.0
+    - FROMGIT: dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: document the SM8650
+      QMP UFS PHY
+    - FROMGIT: dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: document the SM8650
+      QMP PCIe PHYs
+    - FROMGIT: dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: document the
+      SM8650 QMP USB/DP Combo PHY
+    - FROMGIT: dt-bindings: phy: qcom,snps-eusb2: document the SM8650 Synopsys
+      eUSB2 PHY
+    - FROMGIT: phy: qcom: qmp-ufs: add QMP UFS PHY tables for SM8650
+    - FROMGIT: phy: qcom: qmp-pcie: add QMP PCIe PHY tables for SM8650
+    - FROMGIT: phy: qcom: qmp-combo: add QMP USB3/DP PHY tables for SM8650
+    - FROMGIT: dt-bindings: pinctrl: document the SM8650 Top Level Mode
+      Multiplexer
+    - FROMGIT: pinctrl: qcom: handle intr_target_reg wakeup_present/enable bits
+    - FROMGIT: pinctrl: qcom: sm8650-lpass-lpi: add SM8650 LPASS
+    - FROMGIT: pinctrl: qcom: Introduce the SM8650 Top Level Mode Multiplexer
+      driver
+    - FROMGIT: dt-bindings: arm: qcom,ids: Add SoC ID for SM8650
+    - FROMGIT: soc: qcom: socinfo: Add SM8650 SoC ID table entry
+    - FROMGIT: dt-bindings: arm: qcom: document SM8650 and the reference boards
+    - FROMGIT: arm64: dts: qcom: add initial SM8650 dtsi
+    - FROMGIT: arm64: dts: qcom: pm8550ve: make PMK8550VE SID configurable
+    - FROMGIT: arm64: dts: qcom: sm8650: add initial SM8650 MTP dts
+    - FROMGIT: arm64: dts: qcom: sm8650: add initial SM8650 QRD dts
+    - FROMGIT: arm64: dts: qcom: sm8650: add interconnect dependent device nodes
+    - FROMGIT: arm64: dts: qcom: sm8650-mtp: add interconnect dependent device
+      nodes
+    - FROMGIT: arm64: dts: qcom: sm8650-qrd: add interconnect dependent device
+      nodes
+    - FROMGIT: dt-bindings: clock: qcom: Document the SM8650 RPMH Clock Controller
+    - QCLINUX: ASoC: qcm6490: Initialize slimbus dais
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add sound node for RB3 Gen2 nav mezz
+    - PENDING: videocc: enable HW_CTRL for mvs0 gdsc
+    - PENDING: iris: switch vcodec gdsc mode before handling vcodec clocks
+    - PENDING: arm64: dts: qcom: qcm6490-rb3g2: Add PCIe nodes
+    - QCLINUX: dt-bindings: pci: qps615: Add qps615 QCOM PCIe switch
+    - QCLINUX: arm64: dts: qcm6490-rb3: Add support for qps615 switch
+    - QCLINUX: pci: controller: misc: Add qcom qps615 switch driver
+    - QCLINUX: soc: qcom: Register a panic_notifier to cause wdt bite on panic
+    - PENDING: arm64: boot: dts: qcm6490: Add CMA heap for smcinvoke
+    - PENDING: soundwire: qcom: Add support for multiple sample rates
+    - PENDING: ASoC: codecs: lpass: Add macro and dcodec clock disable in suspend
+    - QCLINUX: arm64: defconfig: qcom: Enable CONFIG_SCHED_DEBUG
+    - PENDING: iris: fix bitrate mode setting to firmware
+    - PENDING: i2c: i2c-qcom-geni: Correct I2C TRE sequence
+    - QCLINUX: Revert "QCLINUX: soc: qcom: smcinvoke: Add hardcoded mem-buf API
+      values"
+    - PENDING: dt-bindings: phy: qcom,qmp: Add PCIe qcom,refclk-always-on property
+    - PENDING: phy: qcom-qmp-pcie: Add endpoint refclk control register offset
+    - BACKPORT: FROMGIT: dt-bindings: power: rpmpd: Update part number to X1E80100
+    - FROMGIT: pmdomain: qcom: rpmhpd: Update part number to X1E80100
+    - FROMGIT: dt-bindings: pinctrl: qcom: Add X1E80100 pinctrl
+    - FROMGIT: pinctrl: qcom: Add X1E80100 pinctrl driver
+    - BACKPORT: FROMGIT: dt-bindings: cache: qcom,llcc: Add X1E80100 compatible
+    - FROMGIT: dt-bindings: arm: qcom-soc: extend pattern for matching existing
+      SoCs
+    - FROMGIT: dt-bindings: arm: qcom-soc: extend pattern matching for X1E80100
+      SoC
+    - FROMGIT: dt-bindings: firmware: qcom,scm: document SCM on X1E80100 SoCs
+    - FROMGIT: dt-bindings: clock: qcom: Add X1E80100 GCC clocks
+    - FROMGIT: dt-bindings: clock: qcom-rpmhcc: Add RPMHCC bindings for X1E80100
+    - FROMGIT: clk: qcom: Add Global Clock controller (GCC) driver for X1E80100
+    - FROMGIT: clk: qcom: rpmh: Add support for X1E80100 rpmh clocks
+    - FROMGIT: dt-bindings: arm: cpus: Add qcom,oryon compatible
+    - FROMGIT: dt-bindings: arm: qcom: Document X1E80100 SoC and boards
+    - FROMGIT: dt-bindings: arm-smmu: Add compatible for X1E80100 SoC
+    - FROMGIT: dt-bindings: dma: qcom: gpi: add compatible for X1E80100
+    - FROMGIT: dt-bindings: interrupt-controller: qcom,pdc: document pdc on
+      X1E80100
+    - FROMGIT: dt-bindings: interconnect: Add Qualcomm X1E80100 SoC
+    - FROMGIT: interconnect: qcom: Add X1E80100 interconnect provider driver
+    - FROMGIT: arm64: dts: qcom: Add base X1E80100 dtsi and the QCP dts
+    - UPSTREAM: arm64: dts: qcom: x1e80100: Add Compute Reference Device
+    - QCLINUX: Add audio support for rb3gen2 video mezzanine boards
+    - PENDING: phy: qcom-qmp-pcie: Add support for keeping refclk always on
+    - QCLINUX: arm64: configs: qcom: Disable QCOM_FORCE_WDOG_BITE_ON_PANIC
+    - QCLINUX: arm64: configs: qcom: Enable QCOM_SOC_DEBUG driver
+    - Revert "QCLINUX: virt: gunyah: Write KASLR addr to IMEM"
+    - PENDING: Revert "PENDING: soc: qcom: smcinvoke: Add custom CMA heap support"
+    - PENDING: ASoC: qcom: q6dsp: Add support for multiple sample rates
+    - PENDING: i2c: i2c-qcom-geni: Add support to identify NACK in GSI Mode
+    - PENDING: pinctrl: qcom: lpass-lpi: Add suspend and resume runtime pm ops
+    - PENDING: arm64: dts: qcom: Enable support for pcie1 clocks on rb3 board
+    - QCLINUX: arm64: defconfig: qcom: Add support for NB7VPQ904M on AIM300
+    - QCLINUX: arm64: defconfig: qcom: Enable PCIe related configs
+    - QCLINUX: arm64: defconfig: qcom: Auto update configs
+    - QCLINUX: arm64: defconfig: qcom: Enable MODULE_SIG config
+    - PENDING: arm64: dts: qcom: Enable and update ipa to load gsi fw
+    - PENDING: drivers: smp2p: Add snapshot of smp2p_sleepstate driver
+    - PENDING: ARM: msm: Add support for smp2p_sleepstate
+    - QCLINUX: Revert "QCLINUX: arm64: dts: qcm6490-rb3: Add support for PM8008
+      PMIC"
+    - PENDING: firmware: shmbridge: Set dma capabilities 32bit by default
+    - PENDING: arm64: dts: qcom: qcm6490-addons: Enable smp2p-sleepstate
+    - PENDING: soc: qcom: qmi_encdec: out of bound check for input buffer
+    - PENDING: iris: configure work mode to STAGE 1 in CBR use case
+    - FROMLIST: arm64: dts: qcom: sc7280: Add additional MSI interrupts
+    - QCLINUX: soc: glink_altmode: Add API to notify hpd-irq & orientation
+    - PENDING: arm64: dts: qcom: sm8550: Add dma-coherent property
+    - QCLINUX: arm64: defconfig: qcom: Enable testmode config for QCM6490
+    - FROMGIT: arm64: dts: qcom: pm8550: drop PWM address/size cells
+    - FROMLIST: dt-bindings: arm: qcom: Document QCM8550, QCS8550 SoC and board
+    - FROMLIST: dt-bindings: arm: qcom,ids: add SoC ID for QCM8550 and QCS8550
+    - FROMLIST: soc: qcom: socinfo: add SoC Info support for QCM8550 and QCS8550
+      platform
+    - FROMGIT: ASoC: dt-bindings: qcom,sm8250: add SM8550 sound card
+    - FROMLIST: arm64: dts: qcom: qcm8550: introduce qcm8550 dtsi
+    - FROMLIST: arm64: dts: qcom: add base AIM300 dtsi
+    - FROMLIST: arm64: dts: qcom: aim300: add AIM300 AIoT
+    - FROMGIT: arm64: dts: qcom: sm8550: Add GPU nodes
+    - QCLINUX: arm64: defconfig: Add VM configs for qcm6490
+    - FROMLIST: misc: fastrpc: Mark all sessions as invalid in cb_remove
+    - PENDING: wil6210: Drop unicast sub frame if part of a multicast amsdu
+    - QCLINUX: arm64: defconfig: Add support for USB mouse&keyboard on AIM300
+    - QCLINUX: arm64: defconfig: Add qcom vm configs
+    - QCLINUX: dt-bindings: arm: qcom: Add X1E80100 addons support
+    - QCLINUX: arm64: defconfig: Add configs for Radar enumeration over USB
+    - QCLINUX: arm64: dts: qcm6490-idp: Add label for pmic-glink DT node
+    - PENDING: iris: replace dev_info with dev_dbg
+    - PENDING: iris: add support for dynamic resolution flag
+    - FROMLIST: media: v4l2-ctrls: add encoder maximum bitrate control
+    - QCLINUX: arm64: dts: Add x1e80100-addons CRD and QCP
+    - QCLINUX: arm64: defconfig: Enable X1E80100 base configs
+    - QCLINUX: arm64: defconfig: qcom: enable SM8550 GPUCC/CAMCC
+    - QCLINUX: arm64: dts: qcm6490-addons: Add label for pmic-glink DT node
+    - FROMGIT: soc: qcom: add ADSP PDCharger ULOG driver
+    - PENDING: soc: qcom: add snapshot for panel event notifier
+    - QCLINUX: arm64: defconfig: enable panel_event_notifier
+    - PENDING: iris: add new rate control type MBR for encoder
+    - QCLINUX: arm64: defconfig: qcom: enable flash led device
+    - PENDING: qcom: defconfig: enable module compilation of videoCC 8550
+    - PENDING: arm64: boot: dts: Add Support for nb7vpq904m on QCM6490 RB3
+    - QCLINUX: dt-bindings: arm: qcom: Add QCS8550 addons support
+    - PENDING:arm64:defconfig:add realtek config
+    - FROMLIST: phy: qcom: qmp-pcie: Update PCIe1 PHY settings for SM8550
+    - FROMLIST: arm64: dts: qcom: sm8550: Increase supported MSI interrupts
+    - FROMLIST: phy: qcom: qmp-pcie: Update PCIe0 PHY settings for SM8550
+    - FROMLIST: arm64: dts: qcom: aim300: Enable PCIe0 for WLAN
+    - PENDING: arm64: dts: qcom: aim300: Add smmu id for each BDF
+    - QCLINUX: arm64: dts: qcom: Add addons support for AIM300 AIOT
+    - QCLINUX: arm64: dts: qcom: aim300: Add support for qps615 switch
+    - PENDING: arm64: dts: qcom: qcs8550: overwrite video attribute in qcs8550
+    - PENDING: arm64: dts: qcom: sm8550: fix this issue of ICE HW generate key
+    - PENDING: arm64: dts: qcom: sm8550: add iris DT node
+    - FROMGIT: ufs: core: Add CPU latency QoS support for ufs driver
+    - QCLINUX: arm64: defconfig: Prune qcom_defconfig
+    - QCLINUX: arm64: defconfig: enable displayport config
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add sound node for RB3 Gen2 video
+      mezz
+    - QCLINUX: dt-bindings: soc: qcom: Add secure buffer doc
+    - PENDING: slimbus: qcom-ngd-ctrl: Add null check for dma descriptor
+    - PENDING: slimbus: qcom-ngd-ctrl: Add timeout for wait operation
+    - QCLINUX: ASoC: codecs: msm-stub: Add input and output dapm widget
+    - QCLINUX: ASoC: qcom: qcm6490: Modify dapm routings for pinctrl widget
+    - QCLINUX: arm64: defconfig: qcom: Enable CEC support
+    - PENDING: arm64: dts: qcom: aim300: update PIL firmware path and name
+    - PENDING: arm64: dts: qcom: Disable the lpasscc node on qcm6490
+    - PENDING: dt-bindings: arm: qcom: Document rb5gen2-hdk board
+    - PENDING: arm64: dts: qcom: Add initial support for rb5gen2 SOM
+    - QCLINUX: arm64: dts: qcom: Add tz-log node
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Update the MI2S pinctrl name
+    - PENDING: arm64: dts: qcom: Add initial support for rb5gen2 HDK board
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for qcs8550-rb5gen2-HDK
+    - PENDING: iris: add to support max input buffer count
+    - PENDING: iris: update firmware path for SM8550
+    - FROMLIST: coresight: etm4x: Set skip_power_up in etm4_init_arch_data
+      function
+    - FROMGIT: coresight-tpdm: Remove the unnecessary lock
+    - FROMGIT: dt-bindings: arm: Add support for DSB element size
+    - FROMGIT: coresight-tpdm: Introduce TPDM subtype to TPDM driver
+    - FROMGIT: coresight-tpda: Add DSB dataset support
+    - FROMGIT: coresight-tpdm: Initialize DSB subunit configuration
+    - FROMGIT: coresight-tpdm: Add reset node to TPDM node
+    - FROMGIT: coresight-tpdm: Add nodes to set trigger timestamp and type
+    - FROMGIT: coresight-tpdm: Add node to set dsb programming mode
+    - PENDING: ASoC: dt-bindings: qcom,lpass-rx-macro: Document the rx_mclk muxsel
+      property
+    - PENDING: dt-bindings: soc: qcom: Add documentation for memory-dump
+    - FROMGIT: coresight-tpdm: Add nodes for dsb edge control
+    - FROMGIT: coresight-tpdm: Add nodes to configure pattern match output
+    - FROMGIT: coresight-tpdm: Add nodes for timestamp request
+    - FROMGIT: dt-bindings: arm: Add support for DSB MSR register
+    - FROMLIST: coresight: core: Add device name support
+    - FROMGIT: coresight-tpdm: Add nodes for dsb msr support
+    - FROMGIT: coresight-tpdm: Correct the property name of MSR number
+    - FROMLIST: coresight-tpdm: Optimize the store function of tpdm simple dataset
+    - FROMLIST: coresight-tpdm: Optimize the useage of tpdm_has_dsb_dataset
+    - FROMLIST: dt-bindings: arm: qcom,coresight-tpdm: Add support for CMB element
+      size
+    - FROMLIST: coresight-tpdm: Add CMB dataset support
+    - FROMLIST: coresight-tpda: Add support to configure CMB element
+    - FROMLIST: coresight-tpdm: Add support to configure CMB
+    - FROMLIST: coresight-tpdm: Add pattern registers support for CMB
+    - FROMLIST: coresight-tpdm: Add timestamp control register support for the CMB
+    - FROMLIST: dt-bindings: arm: qcom,coresight-tpdm: Add support for TPDM CMB
+      MSR register
+    - FROMLIST: coresight-tpdm: Add msr register support for CMB
+    - QCLINUX: arm64: defconfig: Align qcm6490 configs
+    - QCLINUX: arm64: defconfig: Enable zram for qcm6490
+    - QCLINUX: arm64: defconfig: Enable UIO for qcm6490
+    - PENDING: soundwire: stream: Skip asynchronous mode support
+    - PENDING: ASoC: codec: lpass-rx-macro: Add native sample rate headset
+      playback support
+    - PENDING: ASoC: qcom: q6dsp: Update channels and max rate for TDM
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add MI2S Data1 line support
+    - QCLINUX: ASoC: qcom: qcm6490: Remove clock set in machine driver
+    - QCLINUX: ASoC: codecs: Update channels and sample rate for stub codec
+    - QCLINUX: drivers: soc: qcom: Add support for qcom secure buffer driver
+    - QCLINUX: drivers: dma-buf: heaps: Use hyp_assign_table implementation
+    - QCLINUX: arm64: configs: qcom: Enable secure buffer driver
+    - PENDING: ASoC: qcom: q6dsp: Add support for multiple sample rates
+    - PENDING: slimbus: qcom-ngd-ctrl: Reduce autosuspend delay to 100msec
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Disable drm gpu/gmu nodes
+    - PENDING: arm64: dts: qcom: qcm6490: Add vi-feedback dai-link for qcm6490 idp
+      & rb3 platform
+    - PENDING: ASoC: qcom: qcm6490: Add handling for WSA Codec DMA TX
+    - PENDING: dt-bindings: wsa883x: Document port mapping property
+    - PENDING: ASoC: wsa883x: Add Speaker Protection Support
+    - PENDING: soundwire: qcom: Update Port Reading logic from DT node
+    - PENDING: ASoC: wsa883x: Add Get temperature control
+    - FROMLIST: dt-bindings: arm: Add device-name in the coresight components
+    - PENDING: arm64: dts: qcom: Add label for timer node
+    - PENDING: Revert "silmbus: ngd: register controller after power up."
+    - PENDING: arm64: dts: qcom: qcm6490: Add rx-mclk and rx-npl clock support
+    - PENDING: soc: qcom: Add snapshot of memory dump driver
+    - PENDING: dt-bindings: soc: qcom: Add memory dump table bindings
+    - FROMLIST: soc: qcom: mdt_loader: Add Upperbounds check for program header
+      access
+    - PENDING: slimbus: qcom-ngd-ctrl: validate dma descriptor tx base address
+    - PENDING: gunyah: vm_mgr: Add lent memory
+    - PENDING: iris: fix sfr handling logic
+    - QCLINUX: arm64: defconfig: qcom: Enable USB Audio/MIDI driver
+    - PENDING: iris: fix logic to switch gdsc mode
+    - PENDING: slimbus: stream: Fix null pointer dereference of stream
+    - PENDING: slimbus: qcom-ngd-ctrl: Synchronize suspend/resume routine with
+      mutex
+    - PENDING: slimbus: qcom-ngd-ctrl: Return for channel disconnect/removal
+      during SSR
+    - PENDING: slimbus: qcom-ngd-ctrl: Handle race condition between SSR and qmi
+      request
+    - PENDING: slimbus: qcom-ngd-ctrl: Re-order platform driver registration
+    - PENDING: shmbridge/tz_log/smcinvoke: Adapt generic VMID/PERM entries
+    - PENDING: slimbus: qcom-ngd-ctrl: enable/disable ngd interrupt in runtime ops
+    - PENDING: slimbus: qcom-ngd-ctrl: Move qmi_handle_release to
+      QCOM_SSR_AFTER_SHUTDOWN
+    - PENDING: slimbus: qcom-ngd-ctrl: Avoid deadlock in SSR/PDR path
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add the secure-buffer device
+    - PENDING: ASoC: codecs: lpass-va-macro: Add sleep after digitial unmute to
+      avoid pop issue
+    - PENDING: crypto: qce - Implement suspend/resume for crypto driver
+    - PENDING: slimbus: qcom-ngd-ctrl: Register QMI service once resources are
+      available
+    - PENDING: slimbus: qcom-ngd: Handle SSR and xfer message scenario
+    - UPSTREAM: regulator: qcom-rpmh: extend to support multiple linear voltage
+      ranges
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add dummy msm_gpu node
+    - QCLINUX: arm64: dts: qcm6490-addons: Add nodes for memory dump
+    - QCLINUX: arm64: defconfig: Enable memory dump
+    - Revert "ASoC: codecs: wsa883x: make use of new mute_unmute_on_trigger flag"
+    - UPSTREAM: regulator: qcom-rpmh: add support for pm8010 regulators
+    - UPSTREAM: regulator: dt-bindings: qcom,rpmh: add compatible for pm8010
+    - PENDING: slimbus: qcom-ngd-ctrl: Return from cb if TX capability exchange
+      timeout
+    - QCLINUX: arm64: configs: qcom: Enable EFI_DISABLE_RUNTIME
+    - QCLINUX: ASoC: qcom: qdsp6: Cleanup APM during audio_pkt release
+    - PENDING: iris: fix min and max fps values in enum_frameintervals
+    - QCLINUX: arm64: dts: qcm6490-addons: Add label for typec-retimer
+    - PENDING: dt-bindings: soc: qcom: Replace "_" with "-" for memory dump
+    - FROMLIST: remoteproc: qcom: probe all child devices
+    - PENDING: misc: fastrpc: Fix memory corruption in DSP capabilities
+    - PENDING: iommu/arm-smmu-qcom: Fix use-after-free issue in qcom_smmu_create()
+    - QCLINUX: Revert "FROMLIST: sched/pelt: Introduce PELT multiplier"
+    - FROMLIST: sched/pelt: Introduce PELT multiplier
+    - FROMLIST: firmware/psci: Move psci_init_system_suspend() to late_initcall()
+    - FROMGIT: arm64: dts: qcom: sc7280: Add static properties to cryptobam
+    - QCLINUX: arm64: defconfig: Enable autosleep and wakelocks
+    - BACKPORT: FROMLIST: arm64: dts: qcom: sc7280: Add power-domains for cpuidle
+      states
+    - BACKPORT: FROMLIST: arm64: dts: qcom: sc7280: Update domain-idle-states for
+      cluster sleep
+    - PENDING: firmware: shmbridge: Defer probe if qcom_scm is not up
+    - Revert "PENDING: wil6210: Drop unicast sub frame if part of a multicast
+      amsdu"
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Sat, 16 Mar 2024 13:26:39 +0800
+
+linux-qcom (6.7.0-1010.10) jammy; urgency=medium
+
+  * Add camera driver
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Thu, 08 Feb 2024 10:48:07 +0900
+
+linux-qcom (6.7.0-1009.9) jammy; urgency=medium
+
+  * Enable display driver
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 07 Feb 2024 01:13:11 +0900
+
+linux-qcom (6.7.0-1008.8) jammy; urgency=medium
+
+  * Enable wlan driver
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Wed, 24 Jan 2024 14:53:34 +0900
+
+linux-qcom (6.7.0-1007.7) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] sync
+    - Revert "arm64: dts: qcom: sc7280: Add power-domains for cpuidle states"
+
+ -- Masahiro Yamada <masahiro.yamada@canonical.com>  Tue, 16 Jan 2024 13:01:33 +0900
+
+linux-qcom (6.7.0-1005.5) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: drivers: dma-buf: qcom: adjust shrinker since api changed
+    - SAUCE: firmware: qcom_scm: fix building error
+    - [Config]: enable kconfigs in the qcom_addons of alpha release
+    - [Packaging]: update abi after kconfig is changed
+
+ -- Hui Wang <hui.wang@canonical.com>  Sat, 13 Jan 2024 18:58:00 +0800
+
+linux-qcom (6.7.0-1004.4) jammy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config]: Update annotations after merge alpha patches
+    - [Packaging]: Update abi
+
+  * Miscellaneous upstream changes
+    - FROMLIST: dma-heap: Add proper kref handling on dma-buf heaps
+    - FROMLIST: dma-heap: Provide accessors so that in-kernel drivers can allocate
+      dmabufs from specific heaps
+    - QCLINUX: arm64: defconfig: qcom: Enable POWERCAP, IDLE_INJECT and
+      CPU_IDLE_THERMAL
+    - PENDING: arm64: dts: qcom: qcm6490: add fastrpc nodes
+    - PENDING: misc: fastrpc: Avoid ref count increment for invoke context
+    - PENDING: dt-bindings: soc: qcom,apr: Add audio-pkt and spf-core compatible
+      support
+    - PENDING: ASoC: dt-bindings: Add compatible for wcd9370 codec
+    - PENDING: arm64: dts: qcom: qcm6490: Add memory region for audioPD
+    - FROMLIST: soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
+    - FROMLIST: arm64: dts: qcom: sc7280: Add capacity and DPC properties
+    - FROMLIST: iommu: Allow passing custom allocators to pgtable drivers
+    - FROMLIST: iommu: Extend LPAE page table format to support custom allocators
+    - QCLINUX: dt-bindings: qcom: Add IMEM nodes
+    - PENDING: clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs
+    - PENDING: dt-bindings: media: Add sm8550 dt schema
+    - PENDING: MAINTAINERS: Add Qualcomm Iris video accelerator driver
+    - PENDING: iris: register video device to platform driver
+    - PENDING: iris: initialize power resources
+    - PENDING: iris: introduce state machine for iris core
+    - PENDING: iris: introduce shared queues for host and firmware communication
+    - PENDING: iris: add PIL functionality for video firmware
+    - PENDING: iris: introduce packetization layer for creating HFI packets
+    - PENDING: iris: add video processing unit(VPU) specific register handling
+    - PENDING: iris: introduce platform specific capabilities for core and
+      instance
+    - PENDING: iris: implement iris v4l2 file ops
+    - PENDING: iris: add handling for interrupt service routine(ISR) invoked by
+      hardware
+    - PENDING: iris: implement iris v4l2_ctrl_ops and prepare capabilities
+    - PENDING: iris: introduce memory pool for buffer management
+    - PENDING: iris: implement vb2_ops queue setup
+    - PENDING: iris: introduce and implement iris vb2 mem ops
+    - PENDING: iris: implement HFI to queue and release buffers
+    - PENDING: iris: add video hardware internal buffer count and size calculation
+    - PENDING: iris: implement internal buffer management
+    - PENDING: iris: introduce instance states
+    - PENDING: iris: implement iris v4l2 ioctl ops supported by decoder
+    - PENDING: iris: subscribe input and output properties to firmware
+    - PENDING: iris: subscribe src change and handle firmware responses
+    - PENDING: iris: implement vb2 streaming ops on capture and output planes
+    - QCLINUX: arm64: configs: qcom: Enable QCOM_WDT_CORE
+    - QCLINUX: arm64: configs: qcom: Enable PANIC ON BITE
+    - QCLINUX: soc: qcom: Add support for watchdog framework
+    - PENDING: iris: implement vb2 ops for buf_queue and firmware response
+    - PENDING: iris: add instance sub states and implement DRC and Drain sequence
+    - PENDING: iris: implement power management
+    - FROMLIST: docs: gunyah: Introduce Gunyah Hypervisor
+    - FROMLIST: dt-bindings: Add binding for gunyah hypervisor
+    - FROMLIST: gunyah: Common types and error codes for Gunyah hypercalls
+    - FROMLIST: arm-smmu: Add iommu support to share pgtable
+    - PENDING: iris: register video encoder device to platform driver
+    - FROMLIST: virt: gunyah: Add hypercalls to identify Gunyah
+    - FROMLIST: virt: gunyah: msgq: Add hypercalls to send and receive messages
+    - FROMLIST: mailbox: Add Gunyah message queue mailbox
+    - FROMLIST: gunyah: rsc_mgr: Add resource manager RPC core
+    - FROMLIST: gunyah: rsc_mgr: Add VM lifecycle RPC
+    - FROMLIST: gunyah: vm_mgr: Introduce basic VM Manager
+    - FROMLIST: gunyah: rsc_mgr: Add RPC for sharing memory
+    - FROMLIST: gunyah: vm_mgr: Add/remove user memory regions
+    - FROMLIST: gunyah: vm_mgr: Add ioctls to support basic non-proxy VM boot
+    - FROMLIST: samples: Add sample userspace Gunyah VM Manager
+    - FROMLIST: gunyah: rsc_mgr: Add platform ops on mem_lend/mem_reclaim
+    - FROMLIST: virt: gunyah: Add Qualcomm Gunyah platform ops
+    - FROMLIST: docs: gunyah: Document Gunyah VM Manager
+    - FROMLIST: virt: gunyah: Translate gh_rm_hyp_resource into gunyah_resource
+    - FROMLIST: gunyah: vm_mgr: Add framework for VM Functions
+    - FROMLIST: virt: gunyah: Add resource tickets
+    - FROMLIST: virt: gunyah: Add IO handlers
+    - FROMLIST: virt: gunyah: Add proxy-scheduled vCPUs
+    - FROMLIST: virt: gunyah: Add hypercalls for sending doorbell
+    - FROMLIST: virt: gunyah: Add irqfd interface
+    - FROMLIST: virt: gunyah: Add ioeventfd
+    - FROMLIST: MAINTAINERS: Add Gunyah hypervisor drivers section
+    - PENDING: iris: add platform specific instance capabilities for encoder
+    - PENDING: iris: implement iris v4l2 ioctl ops supported by encoder
+    - PENDING: iris: add vb2 streaming and buffer ops for encoder
+    - PENDING: iris: add power management for encoder
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add node for gh_watchdog
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Add node for IMEM
+    - QCLINUX: dt-bindings: watchdog: Add qcom,gh-watchdog
+    - QCLINUX: virt: gunyah: Gunyah virtual watchdog driver
+    - QCLINUX: virt: gunyah: Write KASLR addr to IMEM
+    - QCLINUX: arm64: configs: qcom: Enable GH_VIRT_WATCHDOG
+    - PENDING: misc: fastrpc: Redesign remote heap management
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: Disable wdt-sc7280
+    - PENDING: dt-bindings: media: Add qcm6490 dt schema
+    - PENDING: ASoC: dt-bindings: Add compatibles for qcm6490
+    - PENDING: arm64: dts: qcom: qcm6490: update venus node
+    - PENDING: qcom: defconfig: auto update of defconfig
+    - PENDING: qcom: defconfig: enable module compilation of iris
+    - PENDING: videocc: remove HW_CTRL from mvs0 gdsc
+    - FROMLIST: scsi: ufs: qcom: dt-bindings: Add SC7280 compatible string
+    - PENDING: iris: change interconnect name and correct few api
+    - PENDING: iris: add qcm6490 platform support
+    - PENDING: iris: add internal buffer calculation for iris2
+    - PENDING: iris: add power up/down sequence and bandwidth calculation
+    - FROMLIST: stm: class: Add MIPI OST protocol support
+    - PENDING: arm64: dts: qcom: qcm6490: Enable remoteprocs for RB3 Gen2
+    - FROMLIST: MAINTAINERS: Add the entry for DCC(Data Capture and Compare)
+      driver support
+    - PENDING: regulator: add a regulator driver for the PM8008 PMIC
+    - QCLINUX: drivers: regulator: Add snapshot of qpnp-lcdb regulator driver
+    - QCLINUX: mfd: introduce I2C PMIC controller
+    - FROMLIST: arm64: dts: qcom: sc7280: Add slimbus DT node
+    - QCLINUX: arm64: defconfig: disable display configs
+    - PENDING: ASoC: qcom: qcm6490: Add machine driver
+    - PENDING: arm64: dts: Increase min voltage of l1b and l10c rails
+    - QCLINUX: arm64: configs: Sort entries in qcom_addons
+    - QCLINUX: regulator: add debug control library
+    - QCLINUX: regulator: add proxy consumer library
+    - FROMGIT: arm64: dts: qcom: sc7280: add TRNG node
+    - QCLINUX: dt-bindings: arm: qcom: Add QCM6490 addons support
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add addons support for RB3
+    - PENDING: arm64: qcom: dts: Enable pmk8350 RTC for qcm6490-idp
+    - PENDING: arm64: dts: qcom: sc7280: Add cti nodes
+    - PENDING: arm64: dts: qcom: qcm6490: overwrite video attribute in qcm6490
+    - QCLINUX: defconfig: Enable qcom-wled & qpnp-lcdb-regulator for qcm6490
+    - QCLINUX: pinctrl: qcom: spmi-gpio: Add PM7325b support
+    - PENDING: iris: update video firmware path for qcm6490
+    - QCLINUX: backlight: qcom-wled: Add support for PM7325b compatible
+    - QCLINUX: dt-bindings: backlight: qcom-wled: Add PM7325B support
+    - QCLINUX: arm64: dts: qcom: Add support for PM7325b PMIC
+    - QCLINUX: soc: qcom: apr: GPR support for audioreach solution
+    - PENDING: ASoC: codecs: lpass-macro: Add support for channel map mixer
+      control
+    - PENDING: ASoC: codecs: wcd937x: Add wcd937x codec driver
+    - PENDING: ASoC: dt-bindings: Add property to support cpu dai with dummy ops
+    - FROMLIST: dma-buf: heaps: Introduce cma_heap_add() for non-default CMA heap
+    - FROMLIST: drm/drm_mode_object: increase max objects to accommodate new color
+      props
+    - PENDING: arm64: qcom: dts: qcm6490-idp: Add BT node
+    - PENDING: misc: fastrpc: Fix DSP capabilities request
+    - PENDING: arm64: dts: qcom: qcm6490-idp: Add definition for three LEDs
+    - PENDING: arm64: qcom: dts: Support refgen regulator for qcm6490
+    - FROMGIT: scsi: ufs: ufs-sysfs: Expose UFS power info
+    - QCLINUX: defconfig: Enable LEICA regulator and proxy-consumer
+    - QCLINUX: defconfig: Enable refgen regulator for qcm6490
+    - PENDING: arm64: qcom: dts: qcm6490-rb3: Add BT node
+    - PENDING: arm64: dts: qcom: qcm6490-idp: add die temp ADC channel
+    - PENDING: defconfig: enable VADC, LPG and SPMI-TEMP-ALARM driver
+    - QCLINUX: ASoC: dt-bindings: qcom,spf-core-platform: Add msm audio mem for
+      spf core platform
+    - FROMLIST: iommu/arm-smmu: introduction of ACTLR for custom prefetcher
+      settings
+    - FROMLIST: iommu/arm-smmu: add ACTLR data and support for SM8550
+    - PENDING: ASoC: qcom: qdsp6: Add support for cpu dai with dummy ops
+    - PENDING: arm64: dts: qcom: qcm6490: Add gpr device tree node for ADSP
+    - QCLINUX: ASoC: qcom: qdsp6: Add spf-core, audio-pkt and msm-audio driver
+      support
+    - PENDING: arm64: dts: qcom: qcm6490-addons: Add shmbridge node
+    - PENDING: firmware: qcom: Add tz_log debug driver support
+    - PENDING: dt-bindings: firmware: Add tz-log doc
+    - PENDING: dt-bindings: soc: qcom: Add shmbridge doc
+    - PENDING: arm64: dts: qcom: qcm6490-addons: Add tz-log node
+    - PENDING: firmware: shmbridge: Add new driver support
+    - PENDING: arm64: dts: qcom: qcm6490: Add WSA codec macro for qcm6490 SoC
+    - PENDING: arm64: qcom: dts: qcm6490-rb3: Add remoteproc nodes
+    - QCLINUX: remoteproc: qcom: pas: disable auto boot for wpss
+    - PENDING: Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT
+    - PENDING: arm64: dts: qcom: qcm6490-idp: Add wcd9370 codec device tree node
+    - QCLINUX: arm64: dts: qcom: Add support for PM8008 PMIC
+    - QCLINUX: arm64: dts: qcom: Add PM7325b PMIC support for qcm6490-idp
+    - QCLINUX: arm64: defconfig: Enable QDSS configs
+    - QCLINUX: arm64: defconfig: qcom: Enable BT_RFCOMM
+    - QCLINUX: dt-bindings: arm: msm: Add remote debugger doc
+    - FROMLIST: usb: dwc3: qcom: Rename dwc3 platform_device reference
+    - FROMLIST: usb: dwc3: qcom: Merge resources from urs_usb device
+    - FROMLIST: usb: dwc3: Expose core driver as library
+    - FROMLIST: usb: dwc3: Override end of dwc3 memory resource
+    - FROMLIST: usb: dwc3: qcom: Add dwc3 core reference in driver state
+    - FROMLIST: usb: dwc3: qcom: Instantiate dwc3 core directly
+    - FROMLIST: usb: dwc3: qcom: Inline the qscratch constants
+    - QCLINUX: arm64: defconfig: qcom: Add USB defconfigs in qcom_defconfig
+    - FROMLIST: usb: dwc3: qcom: Flatten the Qualcomm dwc3 binding and
+      implementation
+    - FROMLIST: usb: dwc3: core: Register vendor hooks for dwc3-qcom
+    - FROMLIST: usb: dwc3: qcom: Enable autosuspend for host mode
+    - FROMLIST: usb: dwc3: core: Skip set_mode notification if cable is
+      disconnected
+    - PENDING: arm64: dts: qcom: qcm6490-idp: Enable pmic-glink and clients
+    - PENDING: arm64: dts: qcom: qcm6490: Add VMID for adsp mem heap
+    - FROMLIST: dt-bindings: input: qcom,pm8xxx-vib: add new SPMI vibrator module
+    - QCLINUX: drivers: char: add remote debugger driver
+    - PENDING: arm64: dts: qcom: qcm6490-idp: enable pon_key and pon_resin key
+    - QCLINUX: arm64: defconfig: Enable Audio support configs for QCM6490
+    - PENDING: arm64: dts: qcom: Flatten USB DT node for QCM6490
+    - PENDING: arm64: boot: dts: Add Type-c orientation support for QCM6490 IDP
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add dt nodes for audio memory, audio-pkt
+      router and spf
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: add die temp ADC channel
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: Add definition for three LEDs
+    - PENDING: arm64: dts: qcom: qcm6490-idp: Add sound node for qcm6490 idp
+      platform
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: Add sound node for RB3 Gen2
+    - PENDING: misc: fastrpc: Add support for unsigned PD
+    - PENDING: arm64: dts: qcm6490-idp: orientation-gpio support in pmic-glink
+    - QCLINUX: dt-bindings: qcom: Add msm stub audio codec documentation
+    - QCLINUX: arm64: dts: qcom: Add bindings for qcom-i2c-pmic and PM8008 devices
+    - FROMLIST: input: pm8xxx-vib: refactor to easily support new SPMI vibrator
+    - QCLINUX: arm64: defconfig: Add RDBG support for qcom_addons_debug
+    - PENDING: misc: fastrpc: Add static PD restart support
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: Enable pmic-glink and clients
+    - QCLINUX: arm64: dts: qcm6490-rb3: Add support for PM8008 PMIC
+    - PENDING: dt-bindings: soc: qcom: Add mem-buf doc
+    - PENDING: drivers: soc: qcom: Add mem_buf driver support
+    - QCLINUX: arm64: configs: qcom: Enable QTEE_SHM_BRIDGE
+    - QCLINUX: arm64: configs: qcom: Enable CONFIG_QTI_TZ_LOG
+    - PENDING: firmware: shmbridge: Drop KP memory protection
+    - QCLINUX: arm64: configs: qcom: Enable PANIC_ON_OOPS
+    - FROMLIST: input: pm8xxx-vibrator: add new SPMI vibrator support
+    - PENDING: arm64: dts: qcom: qcm6490: Add mem-buf device nodes
+    - QCLINUX: arm64: defconfig: qcom: Enable mem-buf
+    - PENDING: dt-bindings: arm: msm: Add dmabuf heaps doc
+    - QCLINUX: drivers: dma-buf: Add QCOM Heaps
+    - FROMLIST: dt-bindings: iommu: Add Translation Buffer Unit bindings
+    - BACKPORT: FROMLIST: iommu/arm-smmu-qcom: Add support for TBUs
+    - FROMLIST: iommu/arm-smmu-qcom: Add Qualcomm TBU driver
+    - PENDING: iris: Fix copy of vb2 buf details to iris buf
+    - PENDING: misc: fastrpc: Pass proper arguments to scm call
+    - QCLINUX: drivers: dma-buf: heaps: Remove support for unused heaps and add
+      replacement for hyp_assign_table api
+    - QCLINUX: dt-bindings: arm: qcom: Add dt-bindings soft link for devicetree
+      constants
+    - FROMLIST: iommu/arm-smmu: Allow using a threaded handler for context
+      interrupts
+    - BACKPORT: FROMLIST: iommu/arm-smmu-qcom: Use a custom context fault handler
+      for sdm845
+    - PENDING: arm64: dts: qcom: sc7280: Add TBU support
+    - PENDING: arm64: dts: qcom: qcm6490-rb3: enable pon_key pon_resin & rtc
+    - QCLINUX: arm64: defconfig: qcom: Enable TBU support
+    - PENDING: iris: add support to set MAX input buffer count to firmware
+    - QCLINUX: dt-bindings: arm: qcom: Correct the symlink for
+      qcom_dma_heap_dt_constants
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add dma-buf heaps support
+    - QCLINUX: arm64: defconfig: qcom: Enable QCOM Heaps
+    - PENDING: arm64: dts: qcom: qm6490-addons: Add smcinvoke node
+    - PENDING: dt-bindings: firmware: Add smcinvoke doc
+    - QCLINUX: defconfig: Enable ufs bsg node
+    - PENDING: iris: add cache management operation
+    - PENDING: dt-bindings: firmware: smcinvoke: Add memory-region
+    - PENDING: arm64: dts: qcm6490: Add memory-region for smcinvoke
+    - PENDING: dt-bindings: interconnect: Add QCOM_ICC_TAG_PERF_MODE macro
+    - FROMGIT: dt-bindings: phy: Add QMP UFS PHY comptible for SC7280
+    - PENDING: soc: qcom: Add smcinvoke driver support
+    - PENDING: soc: qcom: smcinvoke: Add custom CMA heap support
+    - PENDING: interconnect: qcom: Add support for PERF_MODE on RPMh targets
+    - QCLINUX: arm64: configs: qcom: Enable QCOM_SMCINVOKE
+    - PENDING: arm64: dts: qcom: qcm6490: Add dma-coherent property
+    - PENDING: interconnect: qcom: icc-rpmh: Add QoS config support
+    - PENDING: interconnect: qcom: sc7280: enable qos programming
+    - PENDING: arm64: dts: qcm6490-rb3: Increase min voltage of l1b & l10c rail
+    - PENDING: usb: dwc3: qcom: De-assert BCR upon resume
+    - PENDING: arm64: dts: qcom: sc7280: Add clocks for QOS programming
+    - QCLINUX: arm64: dts: qcom: qcm6490-idp: Add MI2S and TDM dai-link support
+    - PENDING: ASoC: qdsp6: q6apm: Add mi2s and tdm audio support
+    - PENDING: dt-bindings: Document the qcom,prmcc_clk property
+    - QCLINUX: ASoC: codecs: Add msm stub codec for audio usecase
+    - PENDING: iris: update output crop offset calculation for encoder
+    - QCLINUX: arm64: defconfig: qcom: Enable MSM_STUB config for QCM6490
+    - QCLINUX: arm64: dts: qcom: qcm6490-addons: add rdbg nodes
+    - FROMLIST: blk-crypto: add basic hardware-wrapped key support
+    - FROMLIST: blk-crypto: show supported key types in sysfs
+    - FROMLIST: blk-crypto: add ioctls to create and prepare hardware-wrapped keys
+    - PENDING: arm64: dts: qcom: sc7280: add ICE node
+    - QCLINUX: dt-bindings: pinctrl: qcom-pmic-gpio: Add pm7325b support
+    - FROMLIST: dt-bindings: crypto: ice: document the hwkm property
+    - PENDING: arm64: dts: qcm6490-rb3: Add LDO vibrator support
+    - QCLINUX: defconfig: Enable ldo vibrator driver config for qcm6490
+    - QCLINUX: arm64: defconfig: qcom: enable ICE driver
+    - QCLINUX: remoteproc: qcom: pas: Enable auto boot for wpss
+    - PENDING: ASoC: qcom: qdsp6: q6prm: Update the TDM clock id values
+    - QCLINUX: arm64: dts: qcom: qcm6490-rb3: Add MI2S and TDM dai-link support
+    - PENDING: misc: fastrpc: Add rpdev check in device_open
+    - FROMLIST: fscrypt: add support for hardware-wrapped keys
+    - FROMLIST: ice, ufs, mmc: use blk_crypto_key for program_key
+    - FROMLIST: qcom_scm: scm call for deriving a software secret
+    - FROMLIST: soc: qcom: ice: add hwkm support in ice
+    - FROMLIST: soc: qcom: ice: support for hardware wrapped keys
+    - QCLINUX: firmware: qcom_scm_addon: Add function qcom_scm_spin_cpu
+    - FROMLIST: ufs: core: support wrapped keys in ufs core
+    - FROMLIST: ufs: host: wrapped keys support in ufs qcom
+    - FROMGIT: dt-bindings: crypto: qcom-qce: document the SM8650 crypto engine
+    - FROMLIST: rpmsg: glink: smem: validate index before fifo read write
+    - PENDING: iris: update set bitrate api
+    - QCLINUX: arm64: defconfig: qcom: enable CRYPTO_USER_API
+    - FROMLIST: dt-bindings: crypto: qcom-qce: document the SC7280 crypto engine
+    - FROMLIST: arm64: dts: qcom: sc7280: add QCrypto nodes
+    - PENDING: iris: fix checks while handling the output buffers
+    - FROMLIST: qcom_scm: scm call for create, prepare and import keys
+    - FROMLIST: ufs: core: add support for generate, import and prepare keys
+    - FROMLIST: soc: qcom: support for generate, import and prepare key
+    - FROMLIST: ufs: host: support for generate, import and prepare key
+    - QCLINUX: arm64: defconfig: qcom: Enable KPROBE
+    - PENDING: iris: replace do_div with div64_u64
+    - PENDING: iris: fix rotation angle configuration to firmware
+    - QCLINUX: dt-bindings: arm: Add mezz board support on QCM6490
+    - PENDING: dt-bindings: arm: qcom: Add rb3gen2 mezzanine board support on
+      QCM6490
+    - PENDING: arm64: dts: qcom: Add qcm6490 rb3gen2 mezzanine board support
+    - FROMLIST: sched/pelt: Introduce PELT multiplier
+    - PENDING: wil6210: Drop plaintext frames on secure network
+    - PENDING: wil6210: check integrity of received AMSDU packets
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add rb3gen2 board support
+    - QCLINUX: remoteproc: Panic on remoteproc crash
+    - QCLINUX: Add audio support for rb3gen2 vision mezzanine boards
+    - PENDING: arm64: dts: qcom: Flatten USB DT node on QCM6490 RB3 Platform
+    - PENDING: arm64: boot: dts: Add Type-c orientation support for QCM6490 RB3
+    - PENDING: firmware: qcom_scm: Make smcinvoke scm calls non-atomic
+    - PENDING: soc: qcom: ice: fix return value as per qcom-scm driver change
+    - PENDING: soc: qcom: ice: bugfix for HWKMv1 targets
+    - PENDING: firmware: qcom_smc-smc: Use qtee_shmbridge if available
+    - PENDING: include: linux: qtee_shmbridge: Add additional stubs
+    - PENDING: usb: dwc3: Add vendor hook for run_stop notification
+    - PENDING: arm64: dts: qcm6490-rb3: Update compatible string of pmic-glink
+    - PENDING: iris: add bit depth source change event for avc decoder
+    - QCLINUX: soc: qcom: smcinvoke: Add hardcoded mem-buf API values
+    - FROMLIST: soc: qcom: ice: bugfix for HWKMv1 targets
+    - FROMLIST: firmware: qcom_scm: scm call for deriving a software secret
+    - PENDING: firmware: qcom_scm: add FBE SCM calls with shmbridge
+    - QCLINUX: drivers: dmabuf: heaps: Remove alias for qcom system heap
+    - PENDING: iris: fix out of boundary hfi queue access
+    - QCLINUX: arm64: defconfig: Prune qcom_defconfig
+    - Revert "arm64: dts: qcom: sc7280: switch USB+DP QMP PHY to new style of
+      bindings"
+    - PENDING: arm64: dts: qcom: Add remote endpoints for QMP and USB nodes
+    - Revert "PENDING: wil6210: Drop plaintext frames on secure network"
+    - Revert "PENDING: wil6210: check integrity of received AMSDU packets"
+
+ -- Hui Wang <hui.wang@canonical.com>  Thu, 11 Jan 2024 14:22:29 +0800
+
+linux-qcom (6.7.0-1003.3) jammy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] remove helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - Config: fix the environment for building in jammy
+    - [Packaging]: Update getabis for jammy
+    - [Config]: update annotations
+    - [Config]: Update config after cranky close
+    - [Packaging]: Update modules
+
+ -- Hui Wang <hui.wang@canonical.com>  Wed, 10 Jan 2024 22:28:08 +0800
+
+linux-qcom (6.7.0-1001.1) jammy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update Ubuntu.md
+    - [Packaging] update update.conf
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Init linux-qcom kernel creation
+    - Config: compose the init kconfig for linux-qcom
+    - [Packaing] adjust kernel modules
+    - Config: cleanup by running check-config
+
+  * Miscellaneous upstream changes
+    - QCLINUX: arm64: defconfig: Add qcom configs
+    - QCLINUX: arm64: dts: qcom: qcm6490: Add qcm6490 board support
+    - QCLINUX: arm64: defconfig: Enable dmabuf heaps for qcm6490
+    - QCLINUX: arm64: defconfig: qcom: Enable FTRACE
+    - QCLINUX: arm64: defconfig: Add DWC3_QCOM support in qcom_defconfig
+    - QCLINUX: arm64: defconfig: qcom: Enable zram
+    - QCLINUX: Revert "QCLINUX: arm64: dts: qcom: qcm6490: Add qcm6490 board
+      support"
+    - FROMLIST: arm64: dts: qcom: Add qcm6490 dts file
+    - QCLINUX: arm64: dts: qcom: Add qcm6490 addons support
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for QCM6490
+    - FROMLIST: dt-bindings: arm: qcom: Add QCM6490 IDP board
+    - PENDING: arm64: dts: qcom: Remove voltage vote support for UFS
+    - QCLINUX: arm64: defconfig: Enable Config for Phy and Controller
+    - PENDING: arm64: dts: qcm6490: Remove voltage voting for USB rails
+    - QCLINUX: arm64: dts: qcom: qcm6490: disable sdhc1 for ufs target
+    - QCLINUX: arm64: defconfig: Enable memory features
+    - FROMLIST: arm64: dts: qcom: sc7280: Add UFS nodes for sc7280 soc
+    - PENDING: arm64: dts: qcom: qcm6490: Add UFS nodes
+    - QCLINUX: arm64: defconfig: qcom: Enable SLAB_FREELIST_RANDOM
+    - QCLINUX: arm64: defconfig: qcom: Enable FORTIFY_SOURCE
+    - QCLINUX: arm64: dts: qcom: qcm6490: FIX: qcm6490 addons
+    - QCLINUX: arm64: defconfig: qcom: Disable DEVMEM and STRICT_DEVMEM
+    - PENDING: remoteproc: qcom: pas: Add ADSP, CDSP and WPSS support on SC7280
+      SoC
+    - PENDING: arm64: dts: qcom: qcm6490: Add ADSP, CDSP remoteproc support
+    - PENDING: arm64: dts: qcom: qcm6490: Update WPSS node to use PAS
+    - PENDING: dt-bindings: remoteproc: qcom: Add SC7280 ADSP, CDSP and WPSS
+      support
+    - PENDING: arm64: dts: qcom: qcm6490: Enable ADSP, CDSP, MPSS and WPSS support
+    - QCLINUX: arm64: defconfig: qcom: Enable SECURITY_SELINUX and
+      SECURITY_NETWORK
+    - QCLINUX: arm64: defconfig: qcom: Enable HARDENED_USERCOPY
+    - QCLINUX: arm64: defconfig: qcom: Enable SLAB_FREELIST_HARDENED
+    - QCLINUX: arm64: defconfig: qcom: Enable ARM64_SW_TTBR0_PAN
+    - PENDING: clk: qcom: gcc: Enable the force mem core for UFS ICE clock
+    - PENDING: arm64: dts: qcom: qcm6490: Add gpio-reserved-ranges
+    - FROMGIT: misc: fastrpc: Free DMA handles for RPC calls with no arguments
+    - PENDING: dt-bindings: clock: Add "qcom,adsp-skip-pll" property
+    - PENDING: clk: qcom: lpassaudiocc: Add support to skip PLL configuration
+    - QCLINUX: firmware: qcom_scm: provisioning addon scm call
+    - QCLINUX: arm64: defconfig: qcom: Auto update configs
+    - PENDING: dt-bindings: arm: qcom: Add QCM6490 RB3 board
+    - PENDING: arm64: dts: qcom: Add qcm6490 rb3 support
+    - QCLINUX: arm64: dts: qcom: Add board-id and msm-id for qcm6490-rb3
+    - PENDING: arm64: dts: qcm6490: Update the protected clocks for QCM6490
+    - QCLINUX: arm64: defconfig: Add clock controller configs for SC7280
+    - QCLINUX: arm64: configs: qcom: Disable CONFIG_QCOM_WDT
+    - FROMGIT: misc: fastrpc: Clean buffers on remote invocation failures
+    - QCLINUX: arm64: configs: qcom: Enable QCOM_SCM_ADDON
+    - QCLINUX: arm64: defconfig: qcom: Enable UCLAMP and SCHEDSTATS
+    - PENDING: arm64: dts: qcom: Remove voltage vote support for UFS
+    - PENDING: arm64: dts: qcm6490-rb3: Remove voltage voting for USB rails
+    - PENDING: arm64: dts: qcom: Add UFS nodes for qcm6490-rb3
+    - PENDING: arm64: dts: qcom: qcm6490: add phandle & modify adsp node
+    - PENDING: arm64: dts: qcom: sc7280: Add interconnect paths to UFSHC
+    - QCLINUX: arm64: defconfig: qcom: Enable bootconfig
+    - PENDING: arm64: dts: qcom: qcm6490: update memory map
+    - FROMLIST: arm64: dts: qcom: Update memorymap for qcm6490
+    - QCLINUX: arm64: dts: qcom: qcm6490: disable video fw attribute in qcm6490
+
+ -- Hui Wang <hui.wang@canonical.com>  Fri, 15 Dec 2023 08:12:34 +0800
+
+linux-qcom (6.7.0-1000.0) jammy; urgency=medium
+
+  * Init creation of linux-qcom
+
+ -- Hui Wang <hui.wang@canonical.com>  Wed, 13 Dec 2023 21:37:16 +0800
+
+linux-unstable (6.7.0-3.3) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-3.3 -proposed tracker (LP: #2046060)
+
+  * enable CONFIG_INTEL_TDX_HOST in linux >= 6.7 for noble (LP: #2046040)
+    - [Config] enable CONFIG_INTEL_TDX_HOST
+
+  * linux tools packages for derived kernels refuse to install simultaneously
+    due to libcpupower name collision (LP: #2035971)
+    - [Packaging] Statically link libcpupower into cpupower tool
+
+  * make lazy RCU a boot time option (LP: #2045492)
+    - SAUCE: rcu: Provide a boot time parameter to control lazy RCU
+
+  * Build failure if run in a console (LP: #2044512)
+    - [Packaging] Fix kernel module compression failures
+
+  * Turning COMPAT_32BIT_TIME off on arm64 (64k & derivatives) (LP: #2038582)
+    - [Config] y2038: Turn off COMPAT and COMPAT_32BIT_TIME on arm64 64k
+
+  * Turning COMPAT_32BIT_TIME off on riscv64 (LP: #2038584)
+    - [Config] y2038: Disable COMPAT_32BIT_TIME on riscv64
+
+  * Turning COMPAT_32BIT_TIME off on ppc64el (LP: #2038587)
+    - [Config] y2038: Disable COMPAT and COMPAT_32BIT_TIME on ppc64le
+
+  * [UBUNTU 23.04] Kernel config option missing for s390x PCI passthrough
+    (LP: #2042853)
+    - [Config] CONFIG_VFIO_PCI_ZDEV_KVM=y
+
+  * back-out zstd module compression automatic for backports (LP: #2045593)
+    - [Packaging] make ZSTD module compression conditional
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove do_full_source variable
+    - [Packaging] Remove obsolete config handling
+    - [Packaging] Remove support for sub-flavors
+    - [Packaging] Remove old linux-libc-dev version hack
+    - [Packaging] Remove obsolete scripts
+    - [Packaging] Remove README.inclusion-list
+    - [Packaging] make $(stampdir)/stamp-build-perarch depend on build-arch
+    - [Packaging] Enable rootless builds
+    - [Packaging] Allow to run debian/rules without (fake)root
+    - [Packaging] remove unneeded trailing slash for INSTALL_MOD_PATH
+    - [Packaging] override KERNELRELEASE instead of KERNELVERSION
+    - [Config] update toolchain versions in annotations
+    - [Packaging] drop useless linux-doc
+    - [Packaging] scripts: Rewrite insert-ubuntu-changes in Python
+    - [Packaging] enable riscv64 builds
+    - [Packaging] remove the last sub-flavours bit
+    - [Packaging] check debian.env to determine do_libc_dev_package
+    - [Packaging] remove debian.*/variants
+    - [Packaging] remove do_libc_dev_package variable
+    - [Packaging] move linux-libc-dev.stub to debian/control.d/
+    - [Packaging] Update check to build linux-libc-dev to the source package name
+    - [Packaging] rules: Remove startnewrelease target
+    - [Packaging] Remove debian/commit-templates
+    - [Config] update annotations after rebase to v6.7-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 11 Dec 2023 15:56:11 +0100
+
+linux-unstable (6.7.0-2.2) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-2.2 -proposed tracker (LP: #2045107)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable Rust
+    - [Config] enable Rust in annotations
+    - [Packaging] Remove do_enforce_all variable
+    - [Config] disable Softlogic 6x10 capture card driver on armhf
+    - [Packaging] disable Rust support
+    - [Config] update annotations after rebase to v6.7-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 29 Nov 2023 07:51:17 +0100
+
+linux-unstable (6.7.0-1.1) noble; urgency=medium
+
+  * noble/linux-unstable: 6.7.0-1.1 -proposed tracker (LP: #2044069)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update annotations scripts
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations after rebase to v6.7-rc2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.7-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 21 Nov 2023 10:45:24 +0100
+
+linux-unstable (6.7.0-0.0) noble; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 21 Nov 2023 07:26:46 +0100
+
+linux-unstable (6.6.0-12.12) noble; urgency=medium
+
+  * noble/linux-unstable: 6.6.0-12.12 -proposed tracker (LP: #2043664)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable zfs dkms
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 16 Nov 2023 10:20:26 +0100
+
+linux-unstable (6.6.0-11.11) noble; urgency=medium
+
+  * noble/linux-unstable: 6.6.0-11.11 -proposed tracker (LP: #2043480)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] resync update-dkms-versions helper
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.11.14)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move to Noble
+    - [Config] toolchain version update
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 15 Nov 2023 14:50:40 +0100
+
+linux-unstable (6.6.0-10.10) noble; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-10.10 -proposed tracker (LP: #2043088)
+
+  * Bump arm64's CONFIG_NR_CPUS to 512 (LP: #2042897)
+    - [Config] Bump CONFIG_NR_CPUS to 512 for arm64
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Include a note for the NR_CPUS setting on riscv64
+    - SAUCE: apparmor4.0.0 [83/83]: Fix inode_init for changed prototype
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 09 Nov 2023 12:05:11 +0200
+
+linux-unstable (6.6.0-9.9) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-9.9 -proposed tracker (LP: #2041852)
+
+  * Switch IMA default hash to sha256 (LP: #2041735)
+    - [Config] Switch IMA_DEFAULT_HASH from sha1 to sha256
+
+  * apparmor restricts read access of user namespace mediation sysctls to root
+    (LP: #2040194)
+    - SAUCE: apparmor4.0.0 [82/82]: apparmor: open userns related sysctl so lxc
+      can check if restriction are in place
+
+  * AppArmor spams kernel log with assert when auditing (LP: #2040192)
+    - SAUCE: apparmor4.0.0 [81/82]: apparmor: fix request field from a prompt
+      reply that denies all access
+
+  * apparmor notification files verification (LP: #2040250)
+    - SAUCE: apparmor4.0.0 [80/82]: apparmor: fix notification header size
+
+  * apparmor oops when racing to retrieve a notification (LP: #2040245)
+    - SAUCE: apparmor4.0.0 [79/82]: apparmor: fix oops when racing to retrieve
+      notification
+
+  * Disable restricting unprivileged change_profile by default, due to LXD
+    latest/stable not yet compatible with this new apparmor feature
+    (LP: #2038567)
+    - SAUCE: apparmor4.0.0 [78/82]: apparmor: Make
+      apparmor_restrict_unprivileged_unconfined opt-in
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [01/82]: add/use fns to print hash string hex value
+    - SAUCE: apparmor4.0.0 [02/82]: rename SK_CTX() to aa_sock and make it an
+      inline fn
+    - SAUCE: apparmor4.0.0 [03/82]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor4.0.0 [04/82]: add user namespace creation mediation
+    - SAUCE: apparmor4.0.0 [05/82]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor4.0.0 [06/82]: af_unix mediation
+    - SAUCE: apparmor4.0.0 [07/82]: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor4.0.0 [08/82]: Stacking v38: LSM: Identify modules by more
+      than name
+    - SAUCE: apparmor4.0.0 [09/82]: Stacking v38: LSM: Add an LSM identifier for
+      external use
+    - SAUCE: apparmor4.0.0 [10/82]: Stacking v38: LSM: Identify the process
+      attributes for each module
+    - SAUCE: apparmor4.0.0 [11/82]: Stacking v38: LSM: Maintain a table of LSM
+      attribute data
+    - SAUCE: apparmor4.0.0 [12/82]: Stacking v38: proc: Use lsmids instead of lsm
+      names for attrs
+    - SAUCE: apparmor4.0.0 [13/82]: Stacking v38: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor4.0.0 [14/82]: Stacking v38: LSM: Infrastructure management
+      of the sock security
+    - SAUCE: apparmor4.0.0 [15/82]: Stacking v38: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor4.0.0 [16/82]: Stacking v38: LSM: provide lsm name and id
+      slot mappings
+    - SAUCE: apparmor4.0.0 [17/82]: Stacking v38: IMA: avoid label collisions with
+      stacked LSMs
+    - SAUCE: apparmor4.0.0 [18/82]: Stacking v38: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor4.0.0 [19/82]: Stacking v38: LSM: Use lsmblob in
+      security_kernel_act_as
+    - SAUCE: apparmor4.0.0 [20/82]: Stacking v38: LSM: Use lsmblob in
+      security_secctx_to_secid
+    - SAUCE: apparmor4.0.0 [21/82]: Stacking v38: LSM: Use lsmblob in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [22/82]: Stacking v38: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor4.0.0 [23/82]: Stacking v38: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor4.0.0 [24/82]: Stacking v38: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor4.0.0 [25/82]: Stacking v38: LSM: Use lsmblob in
+      security_cred_getsecid
+    - SAUCE: apparmor4.0.0 [26/82]: Stacking v38: LSM: Specify which LSM to
+      display
+    - SAUCE: apparmor4.0.0 [28/82]: Stacking v38: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor4.0.0 [29/82]: Stacking v38: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor4.0.0 [30/82]: Stacking v38: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor4.0.0 [31/82]: Stacking v38: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor4.0.0 [32/82]: Stacking v38: LSM: security_secid_to_secctx in
+      netlink netfilter
+    - SAUCE: apparmor4.0.0 [33/82]: Stacking v38: NET: Store LSM netlabel data in
+      a lsmblob
+    - SAUCE: apparmor4.0.0 [34/82]: Stacking v38: binder: Pass LSM identifier for
+      confirmation
+    - SAUCE: apparmor4.0.0 [35/82]: Stacking v38: LSM: security_secid_to_secctx
+      module selection
+    - SAUCE: apparmor4.0.0 [36/82]: Stacking v38: Audit: Keep multiple LSM data in
+      audit_names
+    - SAUCE: apparmor4.0.0 [37/82]: Stacking v38: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor4.0.0 [38/82]: Stacking v38: LSM: Add a function to report
+      multiple LSMs
+    - SAUCE: apparmor4.0.0 [39/82]: Stacking v38: Audit: Allow multiple records in
+      an audit_buffer
+    - SAUCE: apparmor4.0.0 [40/82]: Stacking v38: Audit: Add record for multiple
+      task security contexts
+    - SAUCE: apparmor4.0.0 [41/82]: Stacking v38: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor4.0.0 [42/82]: Stacking v38: Audit: Add record for multiple
+      object contexts
+    - SAUCE: apparmor4.0.0 [43/82]: Stacking v38: netlabel: Use a struct lsmblob
+      in audit data
+    - SAUCE: apparmor4.0.0 [44/82]: Stacking v38: LSM: Removed scaffolding
+      function lsmcontext_init
+    - SAUCE: apparmor4.0.0 [45/82]: Stacking v38: AppArmor: Remove the exclusive
+      flag
+    - SAUCE: apparmor4.0.0 [46/82]: combine common_audit_data and
+      apparmor_audit_data
+    - SAUCE: apparmor4.0.0 [47/82]: setup slab cache for audit data
+    - SAUCE: apparmor4.0.0 [48/82]: rename audit_data->label to
+      audit_data->subj_label
+    - SAUCE: apparmor4.0.0 [49/82]: pass cred through to audit info.
+    - SAUCE: apparmor4.0.0 [50/82]: Improve debug print infrastructure
+    - SAUCE: apparmor4.0.0 [51/82]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor4.0.0 [52/82]: enable userspace upcall for mediation
+    - SAUCE: apparmor4.0.0 [53/82]: cache buffers on percpu list if there is lock
+      contention
+    - SAUCE: apparmor4.0.0 [54/82]: advertise availability of exended perms
+    - SAUCE: apparmor4.0.0 [56/82]: cleanup: provide separate audit messages for
+      file and policy checks
+    - SAUCE: apparmor4.0.0 [57/82]: prompt - lock down prompt interface
+    - SAUCE: apparmor4.0.0 [58/82]: prompt - ref count pdb
+    - SAUCE: apparmor4.0.0 [59/82]: prompt - allow controlling of caching of a
+      prompt response
+    - SAUCE: apparmor4.0.0 [60/82]: prompt - add refcount to audit_node in prep or
+      reuse and delete
+    - SAUCE: apparmor4.0.0 [61/82]: prompt - refactor to moving caching to
+      uresponse
+    - SAUCE: apparmor4.0.0 [62/82]: prompt - Improve debug statements
+    - SAUCE: apparmor4.0.0 [63/82]: prompt - fix caching
+    - SAUCE: apparmor4.0.0 [64/82]: prompt - rework build to use append fn, to
+      simplify adding strings
+    - SAUCE: apparmor4.0.0 [65/82]: prompt - refcount notifications
+    - SAUCE: apparmor4.0.0 [66/82]: prompt - add the ability to reply with a
+      profile name
+    - SAUCE: apparmor4.0.0 [67/82]: prompt - fix notification cache when updating
+    - SAUCE: apparmor4.0.0 [68/82]: prompt - add tailglob on name for cache
+      support
+    - SAUCE: apparmor4.0.0 [69/82]: prompt - allow profiles to set prompts as
+      interruptible
+    - SAUCE: apparmor4.0.0 [74/82]: advertise disconnected.path is available
+    - SAUCE: apparmor4.0.0 [75/82]: fix invalid reference on profile->disconnected
+    - SAUCE: apparmor4.0.0 [76/82]: add io_uring mediation
+    - SAUCE: apparmor4.0.0 [77/82]: apparmor: Fix regression in mount mediation
+
+  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
+    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
+    (LP: #2032602)
+    - SAUCE: apparmor4.0.0 [70/82]: prompt - add support for advanced filtering of
+      notifications
+    - SAUCE: apparmor4.0.0 [71/82]: userns - add the ability to reference a global
+      variable for a feature value
+    - SAUCE: apparmor4.0.0 [72/82]: userns - make it so special unconfined
+      profiles can mediate user namespaces
+    - SAUCE: apparmor4.0.0 [73/82]: userns - allow restricting unprivileged
+      change_profile
+
+  * LSM stacking and AppArmor for 6.2: additional fixes (LP: #2017903) // update
+    apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [55/82]: fix profile verification and enable it
+
+  * udev fails to make prctl() syscall with apparmor=0 (as used by maas by
+    default) (LP: #2016908) // update apparmor and LSM stacking patch set
+    (LP: #2028253)
+    - SAUCE: apparmor4.0.0 [27/82]: Stacking v38: Fix prctl() syscall with
+      apparmor=0
+
+  * Miscellaneous Ubuntu changes
+    - [Config] SECURITY_APPARMOR_RESTRICT_USERNS=y
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 03 Nov 2023 11:59:12 +0100
+
+linux-unstable (6.6.0-8.8) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-8.8 -proposed tracker (LP: #2040243)
+
+  * Miscellaneous Ubuntu changes
+    - abi: gc reference to phy-rtk-usb2/phy-rtk-usb3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 24 Oct 2023 10:55:34 +0200
+
+linux-unstable (6.6.0-7.7) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-7.7 -proposed tracker (LP: #2040147)
+
+  * test_021_aslr_dapper_libs from ubuntu_qrt_kernel_security failed on K-5.19 /
+    J-OEM-6.1 / J-6.2 AMD64 (LP: #1983357)
+    - [Config]: set ARCH_MMAP_RND_{COMPAT_, }BITS to the maximum
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs following v6.6-rc7 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 23 Oct 2023 11:51:14 +0200
+
+linux-unstable (6.6.0-6.6) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-6.6 -proposed tracker (LP: #2039780)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.6-rc6
+    - [Config] updateconfigs following v6.6-rc6 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 19 Oct 2023 12:09:16 +0200
+
+linux-unstable (6.6.0-5.5) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-5.5 -proposed tracker (LP: #2038899)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.6-rc5
+    - [Config] updateconfigs following v6.6-rc5 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 10 Oct 2023 11:18:41 +0200
+
+linux-unstable (6.6.0-4.4) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-4.4 -proposed tracker (LP: #2038423)
+
+  * Miscellaneous Ubuntu changes
+    - rebase on v6.6-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 04 Oct 2023 11:16:25 +0200
+
+linux-unstable (6.6.0-3.3) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.6.0-3.3 -proposed tracker (LP: #2037622)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs following v6.6-rc3 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: enforce rust availability only on x86_64"
+    - arm64: rust: Enable Rust support for AArch64
+    - arm64: rust: Enable PAC support for Rust.
+    - arm64: Restrict Rust support to little endian only.
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 28 Sep 2023 10:45:38 +0200
+
+linux-unstable (6.6.0-2.2) mantic; urgency=medium
+
+  * Miscellaneous upstream changes
+    - UBUBNTU: [Config] build all COMEDI drivers as modules
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 Sep 2023 14:42:56 +0200
+
+linux-unstable (6.6.0-1.1) mantic; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move linux to linux-unstable
+    - [Packaging] rebase on v6.6-rc1
+    - [Config] updateconfigs following v6.6-rc1 rebase
+    - [packaging] skip ABI, modules and retpoline checks
+    - update dropped.txt
+    - [Config] SHIFT_FS FTBFS with Linux 6.6, disable it
+    - [Config] DELL_UART_BACKLIGHT FTBFS with Linux 6.6, disable it
+    - [Packaging] debian/dkms-versions: temporarily disable dkms
+    - [Packaging] temporarily disable signing for s390x
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.6-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 15 Sep 2023 14:42:18 +0200
+
+linux-unstable (6.6.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 14 Sep 2023 15:03:19 +0200
+
+linux (6.5.0-5.5) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-5.5 -proposed tracker (LP: #2034546)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.08.23)
+
+
+linux (6.5.0-4.4) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-4.4 -proposed tracker (LP: #2034042)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.08.23)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Sep 2023 16:55:44 +0200
+
+linux (6.5.0-3.3) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-3.3 -proposed tracker (LP: #2033904)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.08.23)
+
+  * [23.10] Please test secure-boot and lockdown on the early 6.5 kernel (s390x)
+    (LP: #2026833)
+    - [Packaging] re-enable signing for s390x
+
+  * Miscellaneous upstream changes
+    - module/decompress: use vmalloc() for zstd decompression workspace
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 01 Sep 2023 16:15:33 +0200
+
+linux (6.5.0-2.2) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-2.2 -proposed tracker (LP: #2033240)
+
+  * Soundwire support for Dell SKU0C87 devices (LP: #2029281)
+    - SAUCE: ASoC: Intel: soc-acpi: add support for Dell SKU0C87 devices
+
+  * Fix numerous AER related issues (LP: #2033025)
+    - SAUCE: PCI/AER: Disable AER service during suspend, again
+    - SAUCE: PCI/DPC: Disable DPC service during suspend, again
+
+  * Support Realtek RTL8852CE WiFi 6E/BT Combo (LP: #2025672)
+    - wifi: rtw89: debug: Fix error handling in rtw89_debug_priv_btc_manual_set()
+    - Bluetooth: btrtl: Load FW v2 otherwise FW v1 for RTL8852C
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Aug 2023 08:53:19 +0200
+
+linux (6.5.0-1.1) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-1.1 -proposed tracker (LP: #2032750)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/d2023.07.26)
+
+  * ceph: support idmapped mounts (LP: #2032959)
+    - SAUCE: libceph: add spinlock around osd->o_requests
+    - SAUCE: libceph: define struct ceph_sparse_extent and add some helpers
+    - SAUCE: libceph: new sparse_read op, support sparse reads on msgr2 crc
+      codepath
+    - SAUCE: libceph: support sparse reads on msgr2 secure codepath
+    - SAUCE: libceph: add sparse read support to msgr1
+    - SAUCE: libceph: add sparse read support to OSD client
+    - SAUCE: ceph: add new mount option to enable sparse reads
+    - SAUCE: ceph: preallocate inode for ops that may create one
+    - SAUCE: ceph: make ceph_msdc_build_path use ref-walk
+    - SAUCE: libceph: add new iov_iter-based ceph_msg_data_type and
+      ceph_osd_data_type
+    - SAUCE: ceph: use osd_req_op_extent_osd_iter for netfs reads
+    - SAUCE: ceph: fscrypt_auth handling for ceph
+    - SAUCE: ceph: implement -o test_dummy_encryption mount option
+    - SAUCE: ceph: add fscrypt ioctls and ceph.fscrypt.auth vxattr
+    - SAUCE: ceph: make ioctl cmds more readable in debug log
+    - SAUCE: ceph: add base64 endcoding routines for encrypted names
+    - SAUCE: ceph: encode encrypted name in ceph_mdsc_build_path and dentry
+      release
+    - SAUCE: ceph: send alternate_name in MClientRequest
+    - SAUCE: ceph: decode alternate_name in lease info
+    - SAUCE: ceph: set DCACHE_NOKEY_NAME flag in ceph_lookup/atomic_open()
+    - SAUCE: ceph: make d_revalidate call fscrypt revalidator for encrypted
+      dentries
+    - SAUCE: ceph: add helpers for converting names for userland presentation
+    - SAUCE: ceph: make ceph_fill_trace and ceph_get_name decrypt names
+    - SAUCE: ceph: pass the request to parse_reply_info_readdir()
+    - SAUCE: ceph: add support to readdir for encrypted names
+    - SAUCE: ceph: create symlinks with encrypted and base64-encoded targets
+    - SAUCE: ceph: add some fscrypt guardrails
+    - SAUCE: ceph: allow encrypting a directory while not having Ax caps
+    - SAUCE: ceph: mark directory as non-complete after loading key
+    - SAUCE: ceph: size handling in MClientRequest, cap updates and inode traces
+    - SAUCE: ceph: handle fscrypt fields in cap messages from MDS
+    - SAUCE: ceph: add infrastructure for file encryption and decryption
+    - SAUCE: libceph: add CEPH_OSD_OP_ASSERT_VER support
+    - SAUCE: libceph: allow ceph_osdc_new_request to accept a multi-op read
+    - SAUCE: ceph: add object version support for sync read
+    - SAUCE: ceph: add truncate size handling support for fscrypt
+    - SAUCE: ceph: don't use special DIO path for encrypted inodes
+    - SAUCE: ceph: align data in pages in ceph_sync_write
+    - SAUCE: ceph: add read/modify/write to ceph_sync_write
+    - SAUCE: ceph: add encryption support to writepage and writepages
+    - SAUCE: ceph: plumb in decryption during reads
+    - SAUCE: ceph: invalidate pages when doing direct/sync writes
+    - SAUCE: ceph: add support for encrypted snapshot names
+    - SAUCE: ceph: prevent snapshot creation in encrypted locked directories
+    - SAUCE: ceph: update documentation regarding snapshot naming limitations
+    - SAUCE: ceph: drop messages from MDS when unmounting
+    - SAUCE: ceph: wait for OSD requests' callbacks to finish when unmounting
+    - SAUCE: ceph: fix updating i_truncate_pagecache_size for fscrypt
+    - SAUCE: ceph: switch ceph_lookup/atomic_open() to use new fscrypt helper
+    - SAUCE: libceph: do not include crypto/algapi.h
+    - SAUCE: rbd: bump RBD_MAX_PARENT_CHAIN_LEN to 128
+    - SAUCE: ceph: dump info about cap flushes when we're waiting too long for
+      them
+    - SAUCE: mm: BUG if filemap_alloc_folio gives us a folio with a non-NULL
+      ->private
+    - SAUCE: ceph: make sure all the files successfully put before unmounting
+    - SAUCE: ceph: BUG if MDS changed truncate_seq with client caps still
+      outstanding
+    - SAUCE: ceph: add the *_client debug macros support
+    - SAUCE: ceph: pass the mdsc to several helpers
+    - SAUCE: ceph: rename _to_client() to _to_fs_client()
+    - SAUCE: ceph: move mdsmap.h to fs/ceph/
+    - SAUCE: ceph: add ceph_inode_to_client() helper support
+    - SAUCE: ceph: print the client global_id in all the debug logs
+    - SAUCE: ceph: make the members in struct ceph_mds_request_args_ext an union
+    - SAUCE: ceph: make num_fwd and num_retry to __u32
+    - SAUCE: fs: export mnt_idmap_get/mnt_idmap_put
+    - SAUCE: ceph: stash idmapping in mdsc request
+    - SAUCE: ceph: handle idmapped mounts in create_request_message()
+    - SAUCE: ceph: add enable_unsafe_idmap module parameter
+    - SAUCE: ceph: pass an idmapping to mknod/symlink/mkdir
+    - SAUCE: ceph: allow idmapped getattr inode op
+    - SAUCE: ceph: allow idmapped permission inode op
+    - SAUCE: ceph: pass idmap to __ceph_setattr
+    - SAUCE: ceph: allow idmapped setattr inode op
+    - SAUCE: ceph/acl: allow idmapped set_acl inode op
+    - SAUCE: ceph/file: allow idmapped atomic_open inode op
+    - SAUCE: ceph: allow idmapped mounts
+
+  * Got soft lockup CPU if dell_uart_backlight is probed (LP: #2032174)
+    - SAUCE: platform/x86: dell-uart-backlight: replace chars_in_buffer() with
+      flush_chars()
+
+  * Fix ACPI TAD  on some Intel based systems (LP: #2032767)
+    - ACPI: TAD: Install SystemCMOS address space handler for ACPI000E
+
+  * Fix unreliable ethernet cable detection on I219 NIC (LP: #2028122)
+    - e1000e: Use PME poll to circumvent unreliable ACPI wake
+
+  * Fix panel brightness issues on HP laptops (LP: #2032704)
+    - ACPI: video: Put ACPI video and its child devices into D0 on boot
+
+  * FATAL:credentials.cc(127)] Check failed: . : Permission denied (13)
+    (LP: #2017980)
+    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * Support initrdless boot on default qemu virt models and openstack
+    (LP: #2030745)
+    - [Config] set VIRTIO_BLK=y for default qemu/openstack boot
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] rust: use Rust 1.68.2
+    - [Packaging] depend on clang/libclang-15 for Rust
+    - [Config] update toolchain versions in annotations
+    - [Config] update annotations after rebase to v6.5-rc6
+    - [Config] update toolchain version in annotations
+    - [Packaging] temporarily disable Rust support
+    - [Packaging] temporarily disable signing for ppc64el
+    - [Packaging] temporarily disable signing for s390x
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 24 Aug 2023 17:47:10 +0200
+
+linux (6.5.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 23 Aug 2023 08:14:48 +0200
+
+linux-unstable (6.5.0-4.4) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-4.4 -proposed tracker (LP: #2029086)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Add .NOTPARALLEL
+    - [Packaging] Remove meaningless $(header_arch)
+    - [Packaging] Fix File exists error in install-arch-headers
+    - [Packaging] clean debian/linux-* directories
+    - [Packaging] remove hmake
+    - [Packaging] install headers to debian/linux-libc-dev directly
+    - [Config] define CONFIG options for arm64 instead of arm64-generic
+    - [Config] update annotations after rebase to v6.5-rc4
+    - [Packaging] temporarily disable Rust support
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 31 Jul 2023 08:41:59 +0200
+
+linux-unstable (6.5.0-3.3) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-3.3 -proposed tracker (LP: #2028779)
+
+  * enable Rust support in the kernel (LP: #2007654)
+    - SAUCE: rust: support rustc-1.69.0
+    - [Packaging] depend on rustc-1.69.0
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+    - [Packaging] resync getabis
+
+  * Fix UBSAN in Intel EDAC driver (LP: #2028746)
+    - EDAC/i10nm: Skip the absent memory controllers
+
+  * Ship kernel modules Zstd compressed (LP: #2028568)
+    - SAUCE: Support but do not require compressed modules
+    - [Config] Enable support for ZSTD compressed modules
+    - [Packaging] ZSTD compress modules
+
+  * update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [02/60]: rename SK_CTX() to aa_sock and make it an
+      inline fn
+    - SAUCE: apparmor3.2.0 [05/60]: Add sysctls for additional controls of unpriv
+      userns restrictions
+    - SAUCE: apparmor3.2.0 [08/60]: Stacking v38: LSM: Identify modules by more
+      than name
+    - SAUCE: apparmor3.2.0 [09/60]: Stacking v38: LSM: Add an LSM identifier for
+      external use
+    - SAUCE: apparmor3.2.0 [10/60]: Stacking v38: LSM: Identify the process
+      attributes for each module
+    - SAUCE: apparmor3.2.0 [11/60]: Stacking v38: LSM: Maintain a table of LSM
+      attribute data
+    - SAUCE: apparmor3.2.0 [12/60]: Stacking v38: proc: Use lsmids instead of lsm
+      names for attrs
+    - SAUCE: apparmor3.2.0 [13/60]: Stacking v38: integrity: disassociate
+      ima_filter_rule from security_audit_rule
+    - SAUCE: apparmor3.2.0 [14/60]: Stacking v38: LSM: Infrastructure management
+      of the sock security
+    - SAUCE: apparmor3.2.0 [15/60]: Stacking v38: LSM: Add the lsmblob data
+      structure.
+    - SAUCE: apparmor3.2.0 [16/60]: Stacking v38: LSM: provide lsm name and id
+      slot mappings
+    - SAUCE: apparmor3.2.0 [17/60]: Stacking v38: IMA: avoid label collisions with
+      stacked LSMs
+    - SAUCE: apparmor3.2.0 [18/60]: Stacking v38: LSM: Use lsmblob in
+      security_audit_rule_match
+    - SAUCE: apparmor3.2.0 [19/60]: Stacking v38: LSM: Use lsmblob in
+      security_kernel_act_as
+    - SAUCE: apparmor3.2.0 [20/60]: Stacking v38: LSM: Use lsmblob in
+      security_secctx_to_secid
+    - SAUCE: apparmor3.2.0 [21/60]: Stacking v38: LSM: Use lsmblob in
+      security_secid_to_secctx
+    - SAUCE: apparmor3.2.0 [22/60]: Stacking v38: LSM: Use lsmblob in
+      security_ipc_getsecid
+    - SAUCE: apparmor3.2.0 [23/60]: Stacking v38: LSM: Use lsmblob in
+      security_current_getsecid
+    - SAUCE: apparmor3.2.0 [24/60]: Stacking v38: LSM: Use lsmblob in
+      security_inode_getsecid
+    - SAUCE: apparmor3.2.0 [25/60]: Stacking v38: LSM: Use lsmblob in
+      security_cred_getsecid
+    - SAUCE: apparmor3.2.0 [26/60]: Stacking v38: LSM: Specify which LSM to
+      display
+    - SAUCE: apparmor3.2.0 [28/60]: Stacking v38: LSM: Ensure the correct LSM
+      context releaser
+    - SAUCE: apparmor3.2.0 [29/60]: Stacking v38: LSM: Use lsmcontext in
+      security_secid_to_secctx
+    - SAUCE: apparmor3.2.0 [30/60]: Stacking v38: LSM: Use lsmcontext in
+      security_inode_getsecctx
+    - SAUCE: apparmor3.2.0 [31/60]: Stacking v38: Use lsmcontext in
+      security_dentry_init_security
+    - SAUCE: apparmor3.2.0 [32/60]: Stacking v38: LSM: security_secid_to_secctx in
+      netlink netfilter
+    - SAUCE: apparmor3.2.0 [33/60]: Stacking v38: NET: Store LSM netlabel data in
+      a lsmblob
+    - SAUCE: apparmor3.2.0 [34/60]: Stacking v38: binder: Pass LSM identifier for
+      confirmation
+    - SAUCE: apparmor3.2.0 [35/60]: Stacking v38: LSM: security_secid_to_secctx
+      module selection
+    - SAUCE: apparmor3.2.0 [36/60]: Stacking v38: Audit: Keep multiple LSM data in
+      audit_names
+    - SAUCE: apparmor3.2.0 [37/60]: Stacking v38: Audit: Create audit_stamp
+      structure
+    - SAUCE: apparmor3.2.0 [38/60]: Stacking v38: LSM: Add a function to report
+      multiple LSMs
+    - SAUCE: apparmor3.2.0 [39/60]: Stacking v38: Audit: Allow multiple records in
+      an audit_buffer
+    - SAUCE: apparmor3.2.0 [40/60]: Stacking v38: Audit: Add record for multiple
+      task security contexts
+    - SAUCE: apparmor3.2.0 [41/60]: Stacking v38: audit: multiple subject lsm
+      values for netlabel
+    - SAUCE: apparmor3.2.0 [42/60]: Stacking v38: Audit: Add record for multiple
+      object contexts
+    - SAUCE: apparmor3.2.0 [43/60]: Stacking v38: netlabel: Use a struct lsmblob
+      in audit data
+    - SAUCE: apparmor3.2.0 [44/60]: Stacking v38: LSM: Removed scaffolding
+      function lsmcontext_init
+    - SAUCE: apparmor3.2.0 [45/60]: Stacking v38: AppArmor: Remove the exclusive
+      flag
+    - SAUCE: apparmor3.2.0 [46/60]: combine common_audit_data and
+      apparmor_audit_data
+    - SAUCE: apparmor3.2.0 [47/60]: setup slab cache for audit data
+    - SAUCE: apparmor3.2.0 [48/60]: rename audit_data->label to
+      audit_data->subj_label
+    - SAUCE: apparmor3.2.0 [49/60]: pass cred through to audit info.
+    - SAUCE: apparmor3.2.0 [50/60]: Improve debug print infrastructure
+    - SAUCE: apparmor3.2.0 [51/60]: add the ability for profiles to have a
+      learning cache
+    - SAUCE: apparmor3.2.0 [52/60]: enable userspace upcall for mediation
+    - SAUCE: apparmor3.2.0 [53/60]: cache buffers on percpu list if there is lock
+      contention
+    - SAUCE: apparmor3.2.0 [55/60]: advertise availability of exended perms
+    - SAUCE: apparmor3.2.0 [60/60]: [Config] enable
+      CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * LSM stacking and AppArmor for 6.2: additional fixes (LP: #2017903) // update
+    apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [57/60]: fix profile verification and enable it
+
+  * udev fails to make prctl() syscall with apparmor=0 (as used by maas by
+    default) (LP: #2016908) // update apparmor and LSM stacking patch set
+    (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [27/60]: Stacking v38: Fix prctl() syscall with
+      apparmor=0
+
+  * kinetic: apply new apparmor and LSM stacking patch set (LP: #1989983) //
+    update apparmor and LSM stacking patch set (LP: #2028253)
+    - SAUCE: apparmor3.2.0 [01/60]: add/use fns to print hash string hex value
+    - SAUCE: apparmor3.2.0 [03/60]: patch to provide compatibility with v2.x net
+      rules
+    - SAUCE: apparmor3.2.0 [04/60]: add user namespace creation mediation
+    - SAUCE: apparmor3.2.0 [06/60]: af_unix mediation
+    - SAUCE: apparmor3.2.0 [07/60]: Add fine grained mediation of posix mqueues
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Use consistent llvm/clang for rust
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 28 Jul 2023 07:44:20 +0200
+
+linux-unstable (6.5.0-2.2) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-2.2 -proposed tracker (LP: #2027953)
+
+  * Remove non-LPAE kernel flavor (LP: #2025265)
+    - [Packaging] Rename armhf generic-lpae flavor to generic
+
+  * Please enable Renesas RZ platform serial installer (LP: #2022361)
+    - [Config] enable hihope RZ/G2M serial console
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] snap: Remove old configs handling
+    - [Packaging] checks/final-checks: Remove old configs handling
+    - [Packaging] checks/final-checks: check existance of Makefile first
+    - [Packaging] checks/final-checks: Fix shellcheck issues
+    - [Packaging] add libstdc++-dev to the build dependencies
+    - [Config] update annotations after rebase to v6.5-rc2
+
+  * Miscellaneous upstream changes
+    - kbuild: rust: avoid creating temporary files
+    - rust: fix bindgen build error with UBSAN_BOUNDS_STRICT
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 18 Jul 2023 10:14:14 +0200
+
+linux-unstable (6.5.0-1.1) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.5.0-1.1 -proposed tracker (LP: #2026689)
+
+  * CVE-2023-31248
+    - netfilter: nf_tables: do not ignore genmask when looking up chain by id
+
+  * CVE-2023-35001
+    - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
+
+  * HDMI output with More than one child device for port B in VBT error
+    (LP: #2025195)
+    - SAUCE: drm/i915/quirks: Add multiple VBT quirk for HP ZBook Power G10
+
+  * CVE-2023-2640 // CVE-2023-32629
+    - SAUCE: overlayfs: default to userxattr when mounted from non initial user
+      namespace
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+
+  * enable Rust support in the kernel (LP: #2007654)
+    - SAUCE: btf, scripts: rust: drop is_rust_module.sh
+    - [Packaging] add rust dependencies
+
+  * CVE-2023-2612
+    - SAUCE: shiftfs: prevent lock unbalance in shiftfs_create_object()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: shiftfs: support linux 6.5
+    - [Config] update annotations after rebase to v6.5-rc1
+    - [Config] temporarily disable Rust
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.5-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 10 Jul 2023 09:15:26 +0200
+
+linux-unstable (6.5.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 05 Jul 2023 12:48:39 +0200
+
+linux-unstable (6.4.0-8.8) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-8.8 -proposed tracker (LP: #2025018)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain version (gcc) in annotations
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 26 Jun 2023 09:14:02 +0200
+
+linux-unstable (6.4.0-7.7) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-7.7 -proposed tracker (LP: #2024338)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 19 Jun 2023 08:51:27 +0200
+
+linux-unstable (6.4.0-6.6) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-6.6 -proposed tracker (LP: #2023966)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update annotations scripts
+
+  * enable multi-gen LRU by default (LP: #2023629)
+    - [Config] enable multi-gen LRU by default
+
+  * Fix Monitor lost after replug WD19TBS to SUT port with VGA/DVI to type-C
+    dongle (LP: #2021949)
+    - thunderbolt: Do not touch CL state configuration during discovery
+    - thunderbolt: Increase DisplayPort Connection Manager handshake timeout
+
+  * Neuter signing tarballs (LP: #2012776)
+    - [Packaging] remove the signing tarball support
+
+  * Enable Tracing Configs for OSNOISE and TIMERLAT (LP: #2018591)
+    - [Config] Enable OSNOISE_TRACER and TIMERLAT_TRACER configs
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Add CONFIG_AS_HAS_NON_CONST_LEB128 on riscv64
+    - [Packaging] introduce do_lib_rust and enable it only on generic amd64
+    - [Config] update annotations after rebase to v6.4-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 15 Jun 2023 20:11:07 +0200
+
+linux-unstable (6.4.0-5.5) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-5.5 -proposed tracker (LP: #2022886)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] update getabis to support linux-unstable
+    - UBUNTU [Config]: disable hibernation on riscv64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 06 Jun 2023 08:18:01 +0200
+
+linux-unstable (6.4.0-4.4) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-4.4 -proposed tracker (LP: #2021597)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] udpate annotations after rebase to v6.4-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 30 May 2023 11:55:41 +0200
+
+linux-unstable (6.4.0-3.3) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-3.3 -proposed tracker (LP: #2021497)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] resync getabis
+
+  * support python < 3.9 with annotations (LP: #2020531)
+    - [Packaging] kconfig/annotations.py: support older way of merging dicts
+
+  * generate linux-lib-rust only on amd64 (LP: #2020356)
+    - [Packaging] generate linux-lib-rust only on amd64
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: never drop configs that have notes different than
+      the parent
+    - [Config] drop CONFIG_SMBFS_COMMON from annotations
+    - [Packaging] perf: build without libtraceevent
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 30 May 2023 08:38:10 +0200
+
+linux-unstable (6.4.0-2.2) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-2.2 -proposed tracker (LP: #2020330)
+
+  * Computer with Intel Atom CPU will  not boot with Kernel 6.2.0-20
+    (LP: #2017444)
+    - [Config]: Disable CONFIG_INTEL_ATOMISP
+
+  * Fix NVME storage with RAID ON disappeared under Dell factory WINPE
+    environment (LP: #2011768)
+    - SAUCE: PCI: vmd: Reset VMD config register between soft reboots
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Drop support of old config handling
+    - [Config] update annotations after rebase to v6.4-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 May 2023 11:22:14 +0200
+
+linux-unstable (6.4.0-1.1) mantic; urgency=medium
+
+  * mantic/linux-unstable: 6.4.0-1.1 -proposed tracker (LP: #2019965)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] update helper scripts
+
+  * Kernel 6.1 bumped the disk consumption on default images by 15%
+    (LP: #2015867)
+    - [Packaging] introduce a separate linux-lib-rust package
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable CONFIG_BLK_DEV_UBLK on amd64
+    - [Packaging] annotations: use python3 in the shebang
+    - SAUCE: blk-throttle: Fix io statistics for cgroup v1
+    - [Packaging] move to v6.4 and rename to linux-unstable
+    - [Config] update annotations after rebase to v6.4-rc1
+    - [Packaging] temporarily disable perf
+    - [Packaging] temporarily disable bpftool
+    - [Config] ppc64el: reduce CONFIG_ARCH_FORCE_MAX_ORDER from 9 to 8
+    - SAUCE: perf: explicitly disable libtraceevent
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.4-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 18 May 2023 07:34:09 +0200
+
+linux-unstable (6.4.0-0.0) mantic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 May 2023 15:29:25 +0200
+
+linux-unstable (6.3.0-2.2) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.3.0-2.2 -proposed tracker (LP: #2017788)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move python3-dev to build-depends
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 26 Apr 2023 21:52:12 +0200
+
+linux-unstable (6.3.0-1.1) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.3.0-1.1 -proposed tracker (LP: #2017776)
+
+  * RFC: virtio and virtio-scsi should be built in (LP: #1685291)
+    - [Config] Mark CONFIG_SCSI_VIRTIO built-in
+
+  * Debian autoreconstruct Fix restoration of execute permissions (LP: #2015498)
+    - [Debian] autoreconstruct - fix restoration of execute permissions
+
+  * [SRU][Jammy] CONFIG_PCI_MESON is not enabled (LP: #2007745)
+    - [Config] arm64: Enable PCI_MESON module
+
+  * vmd may fail to create sysfs entry while `pci_rescan_bus()` called in some
+    other drivers like wwan (LP: #2011389)
+    - SAUCE: PCI: vmd: guard device addition and removal
+
+  * Lunar update: v6.2.9 upstream stable release (LP: #2016877)
+    - [Config] ppc64: updateconfigs following v6.2.9 stable updates
+
+  * Lunar update: v6.2.8 upstream stable release (LP: #2016876)
+    - [Config] ppc64: updateconfigs following v6.2.8 stable updates
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Move final-checks script to debian/scripts/checks
+    - [Packaging] checks/final-checks: Honor 'do_skip_checks'
+    - [Packaging] Drop wireguard DKMS
+    - [Packaging] Remove update-version-dkms
+    - [Packaging] debian/rules: Add DKMS info to 'printenv' output
+    - [Packaging] ignore KBUILD_VERBOSE in arch-has-odm-enabled.sh
+    - SAUCE: shiftfs: support linux 6.3
+    - [Packaging] move to v6.3 and rename to linux-unstable
+    - [Config] latency-related optimizations
+    - [Config] update annotations after rebase to v6.3
+    - [Packaging] temporarily disable dkms
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 26 Apr 2023 14:53:52 +0200
+
+linux-unstable (6.3.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 25 Apr 2023 10:24:12 +0200
+
+linux (6.2.0-21.21) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-21.21 -proposed tracker (LP: #2016249)
+
+  * efivarfs:efivarfs.sh in ubuntu_kernel_selftests crash L-6.2 ARM64 node
+    dazzle (rcu_preempt detected stalls) (LP: #2015741)
+    - efi/libstub: smbios: Use length member instead of record struct size
+    - arm64: efi: Use SMBIOS processor version to key off Ampere quirk
+    - efi/libstub: smbios: Drop unused 'recsize' parameter
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/bpf: ignore pointer types check with clang
+    - SAUCE: selftests/bpf: avoid conflicting data types in profiler.inc.h
+    - [Packaging] get rid of unnecessary artifacts in linux-headers
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: Revert "efi: random: refresh non-volatile random seed
+      when RNG is initialized""
+    - Revert "UBUNTU: SAUCE: Revert "efi: random: fix NULL-deref when refreshing
+      seed""
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 14 Apr 2023 12:11:49 +0200
+
+linux (6.2.0-20.20) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-20.20 -proposed tracker (LP: #2015429)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * FTBFS with different dkms or when makeflags are set (LP: #2015361)
+    - [Packaging] FTBFS with different dkms or when makeflags are set
+
+  * expoline.o is packaged unconditionally for s390x (LP: #2013209)
+    - [Packaging] Copy expoline.o only when produced by the build
+
+  * net:l2tp.sh failure with lunar:linux 6.2 (LP: #2013014)
+    - SAUCE: l2tp: generate correct module alias strings
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: prevent duplicate include lines
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 06 Apr 2023 08:33:14 +0200
+
+linux (6.2.0-19.19) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-19.19 -proposed tracker (LP: #2012488)
+
+  * Neuter signing tarballs (LP: #2012776)
+    - [Packaging] neuter the signing tarball
+
+  * LSM stacking and AppArmor refresh for 6.2 kernel (LP: #2012136)
+    - Revert "UBUNTU: [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS"
+    - Revert "UBUNTU: SAUCE: apparmor: add user namespace creation mediation"
+    - Revert "UBUNTU: SAUCE: apparmor: Add fine grained mediation of posix
+      mqueues"
+    - Revert "UBUNTU: SAUCE: Revert "apparmor: make __aa_path_perm() static""
+    - Revert "UBUNTU: SAUCE: LSM: Specify which LSM to display (using struct cred
+      as input)"
+    - Revert "UBUNTU: SAUCE: apparmor: Fix build error, make sk parameter const"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in smk_netlbl_mls()"
+    - Revert "UBUNTU: SAUCE: LSM: change ima_read_file() to use lsmblob"
+    - Revert "UBUNTU: SAUCE: apparmor: rename kzfree() to kfree_sensitive()"
+    - Revert "UBUNTU: SAUCE: AppArmor: Remove the exclusive flag"
+    - Revert "UBUNTU: SAUCE: LSM: Add /proc attr entry for full LSM context"
+    - Revert "UBUNTU: SAUCE: Audit: Fix incorrect static inline function
+      declration."
+    - Revert "UBUNTU: SAUCE: Audit: Fix for missing NULL check"
+    - Revert "UBUNTU: SAUCE: Audit: Add a new record for multiple object LSM
+      attributes"
+    - Revert "UBUNTU: SAUCE: Audit: Add new record for multiple process LSM
+      attributes"
+    - Revert "UBUNTU: SAUCE: NET: Store LSM netlabel data in a lsmblob"
+    - Revert "UBUNTU: SAUCE: LSM: security_secid_to_secctx in netlink netfilter"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmcontext in security_inode_getsecctx"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmcontext in security_secid_to_secctx"
+    - Revert "UBUNTU: SAUCE: LSM: Ensure the correct LSM context releaser"
+    - Revert "UBUNTU: SAUCE: LSM: Specify which LSM to display"
+    - Revert "UBUNTU: SAUCE: IMA: Change internal interfaces to use lsmblobs"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_cred_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_inode_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_task_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_ipc_getsecid"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_secid_to_secctx"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_secctx_to_secid"
+    - Revert "UBUNTU: SAUCE: net: Prepare UDS for security module stacking"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_kernel_act_as"
+    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in security_audit_rule_match"
+    - Revert "UBUNTU: SAUCE: LSM: Create and manage the lsmblob data structure."
+    - Revert "UBUNTU: SAUCE: LSM: Infrastructure management of the sock security"
+    - Revert "UBUNTU: SAUCE: apparmor: LSM stacking: switch from SK_CTX() to
+      aa_sock()"
+    - Revert "UBUNTU: SAUCE: apparmor: rename aa_sock() to aa_unix_sk()"
+    - Revert "UBUNTU: SAUCE: apparmor: disable showing the mode as part of a secid
+      to secctx"
+    - Revert "UBUNTU: SAUCE: apparmor: fix use after free in sk_peer_label"
+    - Revert "UBUNTU: SAUCE: apparmor: af_unix mediation"
+    - Revert "UBUNTU: SAUCE: apparmor: patch to provide compatibility with v2.x
+      net rules"
+    - Revert "UBUNTU: SAUCE: apparmor: add/use fns to print hash string hex value"
+    - SAUCE: apparmor: rename SK_CTX() to aa_sock and make it an inline fn
+    - SAUCE: apparmor: Add sysctls for additional controls of unpriv userns
+      restrictions
+    - SAUCE: Stacking v38: LSM: Identify modules by more than name
+    - SAUCE: Stacking v38: LSM: Add an LSM identifier for external use
+    - SAUCE: Stacking v38: LSM: Identify the process attributes for each module
+    - SAUCE: Stacking v38: LSM: Maintain a table of LSM attribute data
+    - SAUCE: Stacking v38: proc: Use lsmids instead of lsm names for attrs
+    - SAUCE: Stacking v38: integrity: disassociate ima_filter_rule from
+      security_audit_rule
+    - SAUCE: Stacking v38: LSM: Infrastructure management of the sock security
+    - SAUCE: Stacking v38: LSM: Add the lsmblob data structure.
+    - SAUCE: Stacking v38: LSM: provide lsm name and id slot mappings
+    - SAUCE: Stacking v38: IMA: avoid label collisions with stacked LSMs
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_audit_rule_match
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_kernel_act_as
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_secctx_to_secid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_secid_to_secctx
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_ipc_getsecid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_current_getsecid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_inode_getsecid
+    - SAUCE: Stacking v38: LSM: Use lsmblob in security_cred_getsecid
+    - SAUCE: Stacking v38: LSM: Specify which LSM to display
+    - SAUCE: Stacking v38: LSM: Ensure the correct LSM context releaser
+    - SAUCE: Stacking v38: LSM: Use lsmcontext in security_secid_to_secctx
+    - SAUCE: Stacking v38: LSM: Use lsmcontext in security_inode_getsecctx
+    - SAUCE: Stacking v38: Use lsmcontext in security_dentry_init_security
+    - SAUCE: Stacking v38: LSM: security_secid_to_secctx in netlink netfilter
+    - SAUCE: Stacking v38: NET: Store LSM netlabel data in a lsmblob
+    - SAUCE: Stacking v38: binder: Pass LSM identifier for confirmation
+    - SAUCE: Stacking v38: LSM: security_secid_to_secctx module selection
+    - SAUCE: Stacking v38: Audit: Keep multiple LSM data in audit_names
+    - SAUCE: Stacking v38: Audit: Create audit_stamp structure
+    - SAUCE: Stacking v38: LSM: Add a function to report multiple LSMs
+    - SAUCE: Stacking v38: Audit: Allow multiple records in an audit_buffer
+    - SAUCE: Stacking v38: Audit: Add record for multiple task security contexts
+    - SAUCE: Stacking v38: audit: multiple subject lsm values for netlabel
+    - SAUCE: Stacking v38: Audit: Add record for multiple object contexts
+    - SAUCE: Stacking v38: netlabel: Use a struct lsmblob in audit data
+    - SAUCE: Stacking v38: LSM: Removed scaffolding function lsmcontext_init
+    - SAUCE: Stacking v38: AppArmor: Remove the exclusive flag
+    - SAUCE: apparmor: combine common_audit_data and apparmor_audit_data
+    - SAUCE: apparmor: setup slab cache for audit data
+    - SAUCE: apparmor: rename audit_data->label to audit_data->subj_label
+    - SAUCE: apparmor: pass cred through to audit info.
+    - SAUCE: apparmor: Improve debug print infrastructure
+    - SAUCE: apparmor: add the ability for profiles to have a learning cache
+    - SAUCE: apparmor: enable userspace upcall for mediation
+    - SAUCE: apparmor: cache buffers on percpu list if there is lock contention
+    - SAUCE: apparmor: fix policy_compat permission remap with extended
+      permissions
+    - SAUCE: apparmor: advertise availability of exended perms
+    - [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+
+  * kinetic: apply new apparmor and LSM stacking patch set (LP: #1989983) // LSM
+    stacking and AppArmor refresh for 6.2 kernel (LP: #2012136)
+    - SAUCE: apparmor: add/use fns to print hash string hex value
+    - SAUCE: apparmor: patch to provide compatibility with v2.x net rules
+    - SAUCE: apparmor: add user namespace creation mediation
+    - SAUCE: apparmor: af_unix mediation
+    - SAUCE: apparmor: Add fine grained mediation of posix mqueues
+
+  * devlink_port_split from ubuntu_kernel_selftests.net fails on hirsute
+    (KeyError: 'flavour') (LP: #1937133)
+    - selftests: net: devlink_port_split.py: skip test if no suitable device
+      available
+
+  * NFS deathlock with last Kernel 5.4.0-144.161 and 5.15.0-67.74 (LP: #2009325)
+    - NFS: Correct timing for assigning access cache timestamp
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Sat, 25 Mar 2023 07:37:30 +0100
+
+linux (6.2.0-18.18) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-18.18 -proposed tracker (LP: #2011750)
+
+  * lunar/linux 6.2 fails to boot on arm64 (LP: #2011748)
+    - SAUCE: Revert "efi: random: fix NULL-deref when refreshing seed"
+    - SAUCE: Revert "efi: random: refresh non-volatile random seed when RNG is
+      initialized"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 15 Mar 2023 23:54:18 +0100
+
+linux (6.2.0-17.17) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-17.17 -proposed tracker (LP: #2011593)
+
+  * lunar/linux 6.2 fails to boot on ppc64el (LP: #2011413)
+    - SAUCE: Revert "powerpc: remove STACK_FRAME_OVERHEAD"
+    - SAUCE: Revert "powerpc/pseries: hvcall stack frame overhead"
+
+  * Speaker / Audio/Mic mute LED don't work on a HP platform (LP: #2011379)
+    - SAUCE: ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP
+      platform
+
+  * Some QHD panels fail to refresh when PSR2 enabled (LP: #2009014)
+    - SAUCE: drm/i915/psr: Use calculated io and fast wake lines
+
+  * Lunar update: v6.2.6 upstream stable release (LP: #2011431)
+    - tpm: disable hwrng for fTPM on some AMD designs
+    - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
+    - staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script
+    - staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh
+    - Linux 6.2.6
+
+  * Lunar update: v6.2.5 upstream stable release (LP: #2011430)
+    - net/sched: Retire tcindex classifier
+    - auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
+    - fs/jfs: fix shift exponent db_agl2size negative
+    - driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()
+    - f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin
+    - f2fs: fix to avoid potential deadlock
+    - objtool: Fix memory leak in create_static_call_sections()
+    - soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on
+    - soc: qcom: socinfo: Fix soc_id order
+    - memory: renesas-rpc-if: Split-off private data from struct rpcif
+    - memory: renesas-rpc-if: Move resource acquisition to .probe()
+    - soc: mediatek: mtk-svs: Enable the IRQ later
+    - pwm: sifive: Always let the first pwm_apply_state succeed
+    - pwm: stm32-lp: fix the check on arr and cmp registers update
+    - f2fs: introduce trace_f2fs_replace_atomic_write_block
+    - f2fs: clear atomic_write_task in f2fs_abort_atomic_write()
+    - soc: mediatek: mtk-svs: restore default voltages when svs_init02() fail
+    - soc: mediatek: mtk-svs: reset svs when svs_resume() fail
+    - soc: mediatek: mtk-svs: Use pm_runtime_resume_and_get() in svs_init01()
+    - f2fs: fix to do sanity check on extent cache correctly
+    - fs: f2fs: initialize fsdata in pagecache_write()
+    - f2fs: allow set compression option of files without blocks
+    - f2fs: fix to abort atomic write only during do_exist()
+    - um: vector: Fix memory leak in vector_config
+    - ubi: ensure that VID header offset + VID header size <= alloc, size
+    - ubifs: Fix build errors as symbol undefined
+    - ubifs: Fix memory leak in ubifs_sysfs_init()
+    - ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
+    - ubifs: Rectify space budget for ubifs_xrename()
+    - ubifs: Fix wrong dirty space budget for dirty inode
+    - ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
+    - ubifs: Reserve one leb for each journal head while doing budget
+    - ubi: Fix use-after-free when volume resizing failed
+    - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
+    - ubifs: Fix memory leak in alloc_wbufs()
+    - ubi: Fix possible null-ptr-deref in ubi_free_volume()
+    - ubifs: Re-statistic cleaned znode count if commit failed
+    - ubifs: dirty_cow_znode: Fix memleak in error handling path
+    - ubifs: ubifs_writepage: Mark page dirty after writing inode failed
+    - ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
+    - ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling
+      fastmap
+    - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
+    - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
+    - f2fs: fix to handle F2FS_IOC_START_ATOMIC_REPLACE in f2fs_compat_ioctl()
+    - f2fs: fix to avoid potential memory corruption in __update_iostat_latency()
+    - f2fs: fix to update age extent correctly during truncation
+    - f2fs: fix to update age extent in f2fs_do_zero_range()
+    - soc: qcom: stats: Populate all subsystem debugfs files
+    - f2fs: introduce IS_F2FS_IPU_* macro
+    - f2fs: fix to set ipu policy
+    - ext4: use ext4_fc_tl_mem in fast-commit replay path
+    - ext4: don't show commit interval if it is zero
+    - netfilter: nf_tables: allow to fetch set elements when table has an owner
+    - x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
+    - um: virtio_uml: free command if adding to virtqueue failed
+    - um: virtio_uml: mark device as unregistered when breaking it
+    - um: virtio_uml: move device breaking into workqueue
+    - um: virt-pci: properly remove PCI device from bus
+    - f2fs: synchronize atomic write aborts
+    - watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks
+    - watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M
+    - watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in
+      error path
+    - watchdog: Fix kmemleak in watchdog_cdev_register
+    - watchdog: pcwd_usb: Fix attempting to access uninitialized memory
+    - watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
+    - netfilter: ctnetlink: fix possible refcount leak in
+      ctnetlink_create_conntrack()
+    - netfilter: conntrack: fix rmmod double-free race
+    - netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
+    - netfilter: ebtables: fix table blob use-after-free
+    - netfilter: xt_length: use skb len to match in length_mt6
+    - netfilter: ctnetlink: make event listener tracking global
+    - netfilter: x_tables: fix percpu counter block leak on error path when
+      creating new netns
+    - swiotlb: mark swiotlb_memblock_alloc() as __init
+    - ptp: vclock: use mutex to fix "sleep on atomic" bug
+    - drm/i915: move a Kconfig symbol to unbreak the menu presentation
+    - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
+    - drm/i915/xelpmp: Consider GSI offset when doing MCR lookups
+    - octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet
+    - net: sunhme: Fix region request
+    - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
+    - octeontx2-pf: Use correct struct reference in test condition
+    - net: fix __dev_kfree_skb_any() vs drop monitor
+    - 9p/xen: fix version parsing
+    - 9p/xen: fix connection sequence
+    - 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
+    - spi: tegra210-quad: Fix validate combined sequence
+    - mlx5: fix skb leak while fifo resync and push
+    - mlx5: fix possible ptp queue fifo use-after-free
+    - net/mlx5: ECPF, wait for VF pages only after disabling host PFs
+    - net/mlx5e: Verify flow_source cap before using it
+    - net/mlx5: Geneve, Fix handling of Geneve object id as error code
+    - ext4: fix incorrect options show of original mount_opt and extend mount_opt2
+    - nfc: fix memory leak of se_io context in nfc_genl_se_io
+    - net/sched: transition act_pedit to rcu and percpu stats
+    - net/sched: act_pedit: fix action bind logic
+    - net/sched: act_mpls: fix action bind logic
+    - net/sched: act_sample: fix action bind logic
+    - net: dsa: seville: ignore mscc-miim read errors from Lynx PCS
+    - net: dsa: felix: fix internal MDIO controller resource length
+    - ARM: dts: aspeed: p10bmc: Update battery node name
+    - ARM: dts: spear320-hmi: correct STMPE GPIO compatible
+    - tcp: tcp_check_req() can be called from process context
+    - vc_screen: modify vcs_size() handling in vcs_read()
+    - spi: tegra210-quad: Fix iterator outside loop
+    - rtc: sun6i: Always export the internal oscillator
+    - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
+    - scsi: ipr: Work around fortify-string warning
+    - scsi: mpi3mr: Fix an issue found by KASAN
+    - scsi: mpi3mr: Use number of bits to manage bitmap sizes
+    - rtc: allow rtc_read_alarm without read_alarm callback
+    - io_uring: fix size calculation when registering buf ring
+    - loop: loop_set_status_from_info() check before assignment
+    - ASoC: adau7118: don't disable regulators on device unbind
+    - ASoC: apple: mca: Fix final status read on SERDES reset
+    - ASoC: apple: mca: Fix SERDES reset sequence
+    - ASoC: apple: mca: Improve handling of unavailable DMA channels
+    - nvme: bring back auto-removal of deleted namespaces during sequential scan
+    - nvme-tcp: don't access released socket during error recovery
+    - nvme-fabrics: show well known discovery name
+    - ASoC: zl38060 add gpiolib dependency
+    - ASoC: mediatek: mt8195: add missing initialization
+    - thermal: intel: quark_dts: fix error pointer dereference
+    - thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
+    - cpufreq: apple-soc: Fix an IS_ERR() vs NULL check
+    - tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
+    - kernel/printk/index.c: fix memory leak with using debugfs_lookup()
+    - firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
+    - bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC
+      support
+    - mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
+    - IB/hfi1: Update RMT size calculation
+    - iommu: Remove deferred attach check from __iommu_detach_device()
+    - PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3()
+    - media: uvcvideo: Remove format descriptions
+    - media: uvcvideo: Handle cameras with invalid descriptors
+    - media: uvcvideo: Handle errors from calls to usb_string
+    - media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
+    - media: uvcvideo: Silence memcpy() run-time false positive warnings
+    - USB: fix memory leak with using debugfs_lookup()
+    - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
+    - usb: fotg210: List different variants
+    - dt-bindings: usb: Add device id for Genesys Logic hub controller
+    - staging: emxx_udc: Add checks for dma_alloc_coherent()
+    - tty: fix out-of-bounds access in tty_driver_lookup_tty()
+    - tty: serial: fsl_lpuart: disable the CTS when send break signal
+    - serial: sc16is7xx: setup GPIO controller later in probe
+    - mei: bus-fixup:upon error print return values of send and receive
+    - tools/iio/iio_utils:fix memory leak
+    - bus: mhi: ep: Fix the debug message for MHI_PKT_TYPE_RESET_CHAN_CMD cmd
+    - iio: accel: mma9551_core: Prevent uninitialized variable in
+      mma9551_read_status_word()
+    - iio: accel: mma9551_core: Prevent uninitialized variable in
+      mma9551_read_config_word()
+    - media: uvcvideo: Add GUID for BGRA/X 8:8:8:8
+    - soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
+    - PCI/portdrv: Prevent LS7A Bus Master clearing on shutdown
+    - PCI: loongson: Prevent LS7A MRRS increases
+    - staging: pi433: fix memory leak with using debugfs_lookup()
+    - USB: dwc3: fix memory leak with using debugfs_lookup()
+    - USB: chipidea: fix memory leak with using debugfs_lookup()
+    - USB: ULPI: fix memory leak with using debugfs_lookup()
+    - USB: uhci: fix memory leak with using debugfs_lookup()
+    - USB: sl811: fix memory leak with using debugfs_lookup()
+    - USB: fotg210: fix memory leak with using debugfs_lookup()
+    - USB: isp116x: fix memory leak with using debugfs_lookup()
+    - USB: isp1362: fix memory leak with using debugfs_lookup()
+    - USB: gadget: gr_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()
+    - USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()
+    - usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer
+      math
+    - USB: ene_usb6250: Allocate enough memory for full object
+    - usb: uvc: Enumerate valid values for color matching
+    - usb: gadget: uvc: Make bSourceID read/write
+    - PCI: Align extra resources for hotplug bridges properly
+    - PCI: Take other bus devices into account when distributing resources
+    - PCI: Distribute available resources for root buses, too
+    - tty: pcn_uart: fix memory leak with using debugfs_lookup()
+    - misc: vmw_balloon: fix memory leak with using debugfs_lookup()
+    - drivers: base: component: fix memory leak with using debugfs_lookup()
+    - drivers: base: dd: fix memory leak with using debugfs_lookup()
+    - kernel/fail_function: fix memory leak with using debugfs_lookup()
+    - PCI: loongson: Add more devices that need MRRS quirk
+    - PCI: Add ACS quirk for Wangxun NICs
+    - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
+    - phy: rockchip-typec: Fix unsigned comparison with less than zero
+    - RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size
+    - soundwire: cadence: Remove wasted space in response_buf
+    - soundwire: cadence: Drain the RX FIFO after an IO timeout
+    - eth: fealnx: bring back this old driver
+    - net: tls: avoid hanging tasks on the tx_lock
+    - x86/resctl: fix scheduler confusion with 'current'
+    - vDPA/ifcvf: decouple hw features manipulators from the adapter
+    - vDPA/ifcvf: decouple config space ops from the adapter
+    - vDPA/ifcvf: alloc the mgmt_dev before the adapter
+    - vDPA/ifcvf: decouple vq IRQ releasers from the adapter
+    - vDPA/ifcvf: decouple config IRQ releaser from the adapter
+    - vDPA/ifcvf: decouple vq irq requester from the adapter
+    - vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the
+      adapter
+    - vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw
+    - vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev
+    - vDPA/ifcvf: allocate the adapter in dev_add()
+    - drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state()
+    - drm/display/dp_mst: Fix down/up message handling after sink disconnect
+    - drm/display/dp_mst: Fix down message handling after a packet reception error
+    - drm/display/dp_mst: Fix payload addition on a disconnected sink
+    - drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs
+    - drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload()
+    - drm/i915/dp_mst: Fix payload removal during output disabling
+    - drm/i915: Fix system suspend without fbdev being initialized
+    - media: uvcvideo: Fix race condition with usb_kill_urb
+    - arm64: efi: Make efi_rt_lock a raw_spinlock
+    - usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
+    - Linux 6.2.5
+
+  * Lunar update: v6.2.4 upstream stable release (LP: #2011428)
+    - Revert "blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and
+      blkcg_deactivate_policy()"
+    - Revert "blk-cgroup: dropping parent refcount after pd_free_fn() is done"
+    - Linux 6.2.4
+
+  * Lunar update: v6.2.3 upstream stable release (LP: #2011425)
+    - HID: asus: use spinlock to protect concurrent accesses
+    - HID: asus: use spinlock to safely schedule workers
+    - iommu/amd: Fix error handling for pdev_pri_ats_enable()
+    - iommu/amd: Skip attach device domain is same as new domain
+    - iommu/amd: Improve page fault error reporting
+    - iommu: Attach device group to old domain in error path
+    - powerpc/mm: Rearrange if-else block to avoid clang warning
+    - ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller"
+    - ARM: OMAP2+: Fix memory leak in realtime_counter_init()
+    - arm64: dts: qcom: qcs404: use symbol names for PCIe resets
+    - arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
+    - arm64: dts: qcom: sm6115: Fix UFS node
+    - arm64: dts: qcom: sm6115: Provide xo clk to rpmcc
+    - arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k
+    - arm64: dts: qcom: pmi8950: Correct rev_1250v channel label to mv
+    - arm64: dts: qcom: sm6350: Fix up the ramoops node
+    - arm64: dts: qcom: sdm670-google-sargo: keep pm660 ldo8 on
+    - arm64: dts: qcom: Re-enable resin on MSM8998 and SDM845 boards
+    - arm64: dts: qcom: sm8350-sagami: Configure SLG51000 PMIC on PDX215
+    - arm64: dts: qcom: sm8350-sagami: Add GPIO line names for PMIC GPIOs
+    - arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys
+    - arm64: dts: qcom: sm6350-lena: Flatten gpio-keys pinctrl state
+    - arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
+    - arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume down)
+    - arm64: dts: imx8m: Align SoC unique ID node unit address
+    - ARM: zynq: Fix refcount leak in zynq_early_slcr_init
+    - fs: dlm: fix return value check in dlm_memory_init()
+    - arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 T-PHY
+    - arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
+    - arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock description
+    - arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock description
+    - arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock description
+    - arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
+    - arm64: dts: qcom: sdm845-xiaomi-beryllium: fix audio codec interrupt pin
+      name
+    - x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC
+    - arm64: dts: qcom: sc7180: correct SPMI bus address cells
+    - arm64: dts: qcom: sc7280: correct SPMI bus address cells
+    - arm64: dts: qcom: sc8280xp: correct SPMI bus address cells
+    - arm64: dts: qcom: sm8450: correct Soundwire wakeup interrupt name
+    - arm64: dts: qcom: sdm845: make DP node follow the schema
+    - arm64: dts: qcom: msm8996-oneplus-common: drop vdda-supply from DSI PHY
+    - arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers
+    - arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node
+    - arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name
+    - arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node names
+    - arm64: dts: meson-gx: Fix Ethernet MAC address unit name
+    - arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
+    - arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
+    - cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*
+    - arm64: dts: ti: k3-am62-main: Fix clocks for McSPI
+    - arm64: tegra: Fix duplicate regulator on Jetson TX1
+    - arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size
+    - arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem
+    - arm64: dts: qcom: msm8956: use SoC-specific compat for tsens
+    - arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
+    - arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
+    - arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
+    - arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
+    - arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
+    - arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
+    - arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
+    - ARM: OMAP1: call platform_device_put() in error case in
+      omap1_dm_timer_init()
+    - arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken
+    - ARM: bcm2835_defconfig: Enable the framebuffer
+    - ARM: s3c: fix s3c64xx_set_timer_source prototype
+    - arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
+    - ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
+    - ARM: imx: Call ida_simple_remove() for ida_simple_get
+    - arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
+    - arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
+    - arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
+    - arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix supply name of USB
+      controller node
+    - arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names
+      property
+    - arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
+    - arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix invalid rtc
+      node name
+    - arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix invalid rtc node
+      name
+    - arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node
+      name
+    - arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
+    - arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names
+    - arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
+    - arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
+    - arm64: dts: amlogic: meson-g12b-odroid-go-ultra: fix rk818 pmic properties
+    - arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip
+    - locking/rwsem: Disable preemption in all down_read*() and up_read() code
+      paths
+    - arm64: tegra: Mark host1x as dma-coherent on Tegra194/234
+    - arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
+    - arm64: dts: meson: radxa-zero: allow usb otg mode
+    - arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
+    - ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
+    - ublk_drv: remove nr_aborted_queues from ublk_device
+    - ublk_drv: don't probe partitions if the ubq daemon isn't trusted
+    - ARM: dts: imx7s: correct iomuxc gpr mux controller cells
+    - sbitmap: remove redundant check in __sbitmap_queue_get_batch
+    - sbitmap: correct wake_batch recalculation to avoid potential IO hung
+    - arm64: dts: mt8195: Fix CPU map for single-cluster SoC
+    - arm64: dts: mt8192: Fix CPU map for single-cluster SoC
+    - arm64: dts: mt8186: Fix CPU map for single-cluster SoC
+    - arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
+    - arm64: dts: mediatek: mt8186: Fix watchdog compatible
+    - arm64: dts: mediatek: mt8195: Fix watchdog compatible
+    - arm64: dts: mediatek: mt7986: Fix watchdog compatible
+    - ARM: dts: stm32: Update part number NVMEM description on stm32mp131
+    - arm64: dts: qcom: sm8450-nagara: Correct firmware paths
+    - blk-mq: avoid sleep in blk_mq_alloc_request_hctx
+    - blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
+    - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
+    - blk-mq: Fix potential io hung for shared sbitmap per tagset
+    - blk-mq: correct stale comment of .get_budget
+    - arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input
+    - arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC
+    - arm64: dts: qcom: sm8350: drop incorrect cells from serial
+    - arm64: dts: qcom: sm8450: drop incorrect cells from serial
+    - arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM
+      and MPSS memory regions
+    - arm64: dts: qcom: msm8953: correct TLMM gpio-ranges
+    - arm64: dts: qcom: sm6115: correct TLMM gpio-ranges
+    - arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators
+    - s390/dasd: Fix potential memleak in dasd_eckd_init()
+    - io_uring,audit: don't log IORING_OP_MADVISE
+    - sched/rt: pick_next_rt_entity(): check list_entry
+    - perf/x86/intel/ds: Fix the conversion from TSC to perf time
+    - x86/perf/zhaoxin: Add stepping check for ZXC
+    - KEYS: asymmetric: Fix ECDSA use via keyctl uapi
+    - block: ublk: check IO buffer based on flag need_get_data
+    - arm64: dts: qcom: pmk8350: Use the correct PON compatible
+    - erofs: relinquish volume with mutex held
+    - block: sync mixed merged request's failfast with 1st bio's
+    - block: Fix io statistics for cgroup in throttle path
+    - block: bio-integrity: Copy flags when bio_integrity_payload is cloned
+    - block: use proper return value from bio_failfast()
+    - wifi: mt76: mt7915: add missing of_node_put()
+    - wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host
+    - wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks
+    - wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_ie_countdown()
+    - wifi: mt76: mt7996: fix insecure data handling of
+      mt7996_mcu_rx_radar_detected()
+    - wifi: mt76: mt7996: fix integer handling issue of mt7996_rf_regval_set()
+    - wifi: mt76: mt7915: check return value before accessing free_block_num
+    - wifi: mt76: mt7996: check return value before accessing free_block_num
+    - wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr()
+    - wifi: mt76: mt7996: drop always true condition of __mt7996_reg_addr()
+    - wifi: mt76: mt7996: fix endianness warning in mt7996_mcu_sta_he_tlv
+    - wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
+    - wifi: mt76: mt7996: fix unintended sign extension of mt7996_hw_queue_read()
+    - wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read()
+    - wifi: mt76: fix coverity uninit_use_in_call in
+      mt76_connac2_reverse_frag0_hdr_trans()
+    - wifi: mt76: mt7921: resource leaks at mt7921_check_offload_capability()
+    - wifi: rsi: Fix memory leak in rsi_coex_attach()
+    - wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: fix memory leak in lbs_init_adapter()
+    - wifi: rtl8xxxu: Fix assignment to bit field priv->pi_enabled
+    - wifi: rtl8xxxu: Fix assignment to bit field priv->cck_agc_report_type
+    - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
+    - wifi: rtw89: 8852c: rfk: correct DACK setting
+    - wifi: rtw89: 8852c: rfk: correct DPK settings
+    - wifi: rtlwifi: Fix global-out-of-bounds bug in
+      _rtl8812ae_phy_set_txpower_limit()
+    - libbpf: Fix single-line struct definition output in btf_dump
+    - libbpf: Fix btf__align_of() by taking into account field offsets
+    - wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
+    - wifi: ipw2200: fix memory leak in ipw_wdev_init()
+    - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
+    - wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()
+    - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
+    - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
+    - wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
+    - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
+    - libbpf: Fix invalid return address register in s390
+    - crypto: x86/ghash - fix unaligned access in ghash_setkey()
+    - crypto: ux500 - update debug config after ux500 cryp driver removal
+    - ACPICA: Drop port I/O validation for some regions
+    - genirq: Fix the return type of kstat_cpu_irqs_sum()
+    - rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
+    - rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
+    - rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
+    - lib/mpi: Fix buffer overrun when SG is too long
+    - crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
+    - platform/chrome: cros_ec_typec: Update port DP VDO
+    - ACPICA: nsrepair: handle cases without a return value correctly
+    - libbpf: Fix map creation flags sanitization
+    - bpf_doc: Fix build error with older python versions
+    - selftests/xsk: print correct payload for packet dump
+    - selftests/xsk: print correct error codes when exiting
+    - arm64/cpufeature: Fix field sign for DIT hwcap detection
+    - arm64/sysreg: Fix errors in 32 bit enumeration values
+    - kselftest/arm64: Fix syscall-abi for systems without 128 bit SME
+    - workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex
+    - s390/early: fix sclp_early_sccb variable lifetime
+    - s390/vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue()
+    - x86/signal: Fix the value returned by strict_sas_size()
+    - thermal/drivers/tsens: Drop msm8976-specific defines
+    - thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
+    - thermal/drivers/tsens: fix slope values for msm8939
+    - thermal/drivers/tsens: limit num_sensors to 9 for msm8939
+    - wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()
+    - wifi: rtw89: Add missing check for alloc_workqueue
+    - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
+    - wifi: orinoco: check return value of hermes_write_wordrec()
+    - wifi: rtw88: Use rtw_iterate_vifs() for rtw_vif_watch_dog_iter()
+    - wifi: rtw88: Use non-atomic sta iterator in rtw_ra_mask_info_update()
+    - thermal/drivers/imx_sc_thermal: Fix the loop condition
+    - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback
+      function
+    - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
+    - wifi: ath9k: Fix potential stack-out-of-bounds write in
+      ath9k_wmi_rsp_callback()
+    - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
+    - wifi: cfg80211: Fix extended KCK key length check in
+      nl80211_set_rekey_data()
+    - ACPI: battery: Fix missing NUL-termination with large strings
+    - selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m
+    - crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
+    - crypto: essiv - Handle EBUSY correctly
+    - crypto: seqiv - Handle EBUSY correctly
+    - powercap: fix possible name leak in powercap_register_zone()
+    - bpf: Fix state pruning for STACK_DYNPTR stack slots
+    - bpf: Fix missing var_off check for ARG_PTR_TO_DYNPTR
+    - bpf: Fix partial dynptr stack slot reads/writes
+    - x86/microcode: Add a parameter to microcode_check() to store CPU
+      capabilities
+    - x86/microcode: Check CPU capabilities after late microcode update correctly
+    - x86/microcode: Adjust late loading result reporting message
+    - net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action
+    - selftests/bpf: Fix vmtest static compilation error
+    - crypto: xts - Handle EBUSY correctly
+    - leds: led-class: Add missing put_device() to led_put()
+    - drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size
+    - s390/bpf: Add expoline to tail calls
+    - wifi: iwlwifi: mei: fix compilation errors in rfkill()
+    - kselftest/arm64: Fix enumeration of systems without 128 bit SME
+    - can: rcar_canfd: Fix R-Car V3U CAN mode selection
+    - can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses
+    - selftests/bpf: Initialize tc in xdp_synproxy
+    - crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
+    - bpftool: profile online CPUs instead of possible
+    - wifi: mt76: mt7921: fix deadlock in mt7921_abort_roc
+    - wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after
+      init_work
+    - wifi: mt76: mt7915: rework mt7915_mcu_set_thermal_throttling
+    - wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
+    - wifi: mt76: mt7921: fix channel switch fail in monitor mode
+    - wifi: mt76: mt7996: fix chainmask calculation in mt7996_set_antenna()
+    - wifi: mt76: mt7996: update register for CFEND_RATE
+    - wifi: mt76: connac: fix POWER_CTRL command name typo
+    - wifi: mt76: mt7921: fix invalid remain_on_channel duration
+    - wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit
+    - wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit
+    - wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup
+    - wifi: mt76: fix switch default case in mt7996_reverse_frag0_hdr_trans
+    - wifi: mt76: mt7915: fix WED TxS reporting
+    - wifi: mt76: add memory barrier to SDIO queue kick
+    - wifi: mt76: mt7996: rely on mt76_connac2_mac_tx_rate_val
+    - net/mlx5: Enhance debug print in page allocation failure
+    - irqchip: Fix refcount leak in platform_irqchip_probe
+    - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
+    - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
+    - irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
+    - s390/mem_detect: fix detect_memory() error handling
+    - s390/vmem: fix empty page tables cleanup under KASAN
+    - s390/boot: cleanup decompressor header files
+    - s390/mem_detect: rely on diag260() if sclp_early_get_memsize() fails
+    - s390/boot: fix mem_detect extended area allocation
+    - net: add sock_init_data_uid()
+    - tun: tun_chr_open(): correctly initialize socket uid
+    - tap: tap_open(): correctly initialize socket uid
+    - rxrpc: Fix overwaking on call poking
+    - OPP: fix error checking in opp_migrate_dentry()
+    - cpufreq: davinci: Fix clk use after free
+    - Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds
+    - Bluetooth: L2CAP: Fix potential user-after-free
+    - Bluetooth: hci_qca: get wakeup status from serdev device handle
+    - net: ipa: generic command param fix
+    - s390: vfio-ap: tighten the NIB validity check
+    - s390/ap: fix status returned by ap_aqic()
+    - s390/ap: fix status returned by ap_qact()
+    - libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
+    - xen/grant-dma-iommu: Implement a dummy probe_device() callback
+    - rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
+    - crypto: rsa-pkcs1pad - Use akcipher_request_complete
+    - m68k: /proc/hardware should depend on PROC_FS
+    - RISC-V: time: initialize hrtimer based broadcast clock event device
+    - clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first
+      use
+    - wifi: iwl3945: Add missing check for create_singlethread_workqueue
+    - wifi: iwl4965: Add missing check for create_singlethread_workqueue()
+    - wifi: brcmfmac: Rename Cypress 89459 to BCM4355
+    - wifi: brcmfmac: pcie: Add IDs/properties for BCM4355
+    - wifi: brcmfmac: pcie: Add IDs/properties for BCM4377
+    - wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection
+    - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
+    - wifi: rtw89: fix parsing offset for MCC C2H
+    - selftests/bpf: Fix out-of-srctree build
+    - ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
+    - ACPI: resource: Do IRQ override on all TongFang GMxRGxx
+    - crypto: octeontx2 - Fix objects shared between several modules
+    - crypto: crypto4xx - Call dma_unmap_page when done
+    - vfio/ccw: remove WARN_ON during shutdown
+    - wifi: mac80211: move color collision detection report in a delayed work
+    - wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
+    - wifi: mac80211: fix non-MLO station association
+    - wifi: mac80211: Don't translate MLD addresses for multicast
+    - wifi: mac80211: avoid u32_encode_bits() warning
+    - wifi: mac80211: fix off-by-one link setting
+    - tools/lib/thermal: Fix thermal_sampling_exit()
+    - thermal/drivers/hisi: Drop second sensor hi3660
+    - selftests/bpf: Fix map_kptr test.
+    - wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta()
+    - bpf: Zeroing allocated object from slab in bpf memory allocator
+    - selftests/bpf: Fix xdp_do_redirect on s390x
+    - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a
+      bus error
+    - can: esd_usb: Make use of can_change_state() and relocate checking skb for
+      NULL
+    - xsk: check IFF_UP earlier in Tx path
+    - LoongArch, bpf: Use 4 instructions for function address in JIT
+    - bpf: Fix global subprog context argument resolution logic
+    - irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
+    - irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
+    - net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
+    - net/smc: fix application data exception
+    - selftests/net: Interpret UDP_GRO cmsg data as an int value
+    - l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
+    - net: bcmgenet: fix MoCA LED control
+    - net: lan966x: Fix possible deadlock inside PTP
+    - net/mlx4_en: Introduce flexible array to silence overflow warning
+    - net/mlx5e: Align IPsec ASO result memory to be as required by hardware
+    - selftest: fib_tests: Always cleanup before exit
+    - sefltests: netdevsim: wait for devlink instance after netns removal
+    - drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
+    - drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
+    - drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec
+    - drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC
+    - drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
+    - drm/bridge: megachips: Fix error handling in i2c_register_driver()
+    - drm/vkms: Fix memory leak in vkms_init()
+    - drm/vkms: Fix null-ptr-deref in vkms_release()
+    - drm/modes: Use strscpy() to copy command-line mode name
+    - drm/vc4: dpi: Fix format mapping for RGB565
+    - drm/bridge: it6505: Guard bridge power in IRQ handler
+    - drm: tidss: Fix pixel format definition
+    - gpu: ipu-v3: common: Add of_node_put() for reference returned by
+      of_graph_get_port_by_id()
+    - drm/ast: Init iosys_map pointer as I/O memory for damage handling
+    - drm/vc4: drop all currently held locks if deadlock happens
+    - hwmon: (ftsteutates) Fix scaling of measurements
+    - drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()
+    - drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
+    - pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
+    - pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
+    - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
+    - drm/vc4: hvs: Configure the HVS COB allocations
+    - drm/vc4: hvs: Set AXI panic modes
+    - drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4
+    - drm/vc4: hvs: Correct interrupt masking bit assignment for HVS5
+    - drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
+    - drm/vc4: hdmi: Correct interlaced timings again
+    - drm/msm: clean event_thread->worker in case of an error
+    - drm/panel-edp: fix name for IVO product id 854b
+    - scsi: qla2xxx: Fix exchange oversubscription
+    - scsi: qla2xxx: Fix exchange oversubscription for management commands
+    - scsi: qla2xxx: edif: Fix clang warning
+    - ASoC: fsl_sai: initialize is_dsp_mode flag
+    - drm/bridge: tc358767: Set default CLRSIPO count
+    - drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
+    - ALSA: hda/ca0132: minor fix for allocation size
+    - drm/amdgpu: Use the sched from entity for amdgpu_cs trace
+    - drm/msm/gem: Add check for kmalloc
+    - drm/msm/dpu: Disallow unallocated resources to be returned
+    - drm/bridge: lt9611: fix sleep mode setup
+    - drm/bridge: lt9611: fix HPD reenablement
+    - drm/bridge: lt9611: fix polarity programming
+    - drm/bridge: lt9611: fix programming of video modes
+    - drm/bridge: lt9611: fix clock calculation
+    - drm/bridge: lt9611: pass a pointer to the of node
+    - regulator: tps65219: use IS_ERR() to detect an error pointer
+    - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
+    - drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
+    - drm/msm/dsi: Allow 2 CTRLs on v2.5.0
+    - scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096
+    - drm/msm/dpu: sc7180: add missing WB2 clock control
+    - drm/msm: use strscpy instead of strncpy
+    - drm/msm/dpu: Add check for cstate
+    - drm/msm/dpu: Add check for pstates
+    - drm/msm/mdp5: Add check for kzalloc
+    - habanalabs: bugs fixes in timestamps buff alloc
+    - pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
+    - pinctrl: mediatek: Initialize variable pullen and pullup to zero
+    - pinctrl: mediatek: Initialize variable *buf to zero
+    - gpu: host1x: Fix mask for syncpoint increment register
+    - gpu: host1x: Don't skip assigning syncpoints to channels
+    - drm/tegra: firewall: Check for is_addr_reg existence in IMM check
+    - drm/i915/mtl: Add initial gt workarounds
+    - drm/i915/xehp: GAM registers don't need to be re-applied on engine resets
+    - pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as interrupts
+    - drm/i915/xehp: Annotate a couple more workaround registers as MCR
+    - drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update()
+    - drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
+    - drm/mediatek: Use NULL instead of 0 for NULL pointer
+    - drm/mediatek: Drop unbalanced obj unref
+    - drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
+    - drm/mediatek: Clean dangling pointer on bind error path
+    - ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
+    - dt-bindings: display: mediatek: Fix the fallback for mediatek,mt8186-disp-
+      ccorr
+    - gpio: pca9570: rename platform_data to chip_data
+    - gpio: vf610: connect GPIO label to dev name
+    - ASoC: topology: Properly access value coming from topology file
+    - spi: dw_bt1: fix MUX_MMIO dependencies
+    - ASoC: mchp-spdifrx: fix controls which rely on rsr register
+    - ASoC: mchp-spdifrx: fix return value in case completion times out
+    - ASoC: mchp-spdifrx: fix controls that works with completion mechanism
+    - ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
+    - dm: improve shrinker debug names
+    - regmap: apply reg_base and reg_downshift for single register ops
+    - accel: fix CONFIG_DRM dependencies
+    - ASoC: rsnd: fixup #endif position
+    - ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
+    - ASoC: dt-bindings: meson: fix gx-card codec node regex
+    - regulator: tps65219: use generic set_bypass()
+    - hwmon: (asus-ec-sensors) add missing mutex path
+    - hwmon: (ltc2945) Handle error case in ltc2945_value_store
+    - ALSA: hda: Fix the control element identification for multiple codecs
+    - drm/amdgpu: fix enum odm_combine_mode mismatch
+    - scsi: mpt3sas: Fix a memory leak
+    - scsi: aic94xx: Add missing check for dma_map_single()
+    - HID: multitouch: Add quirks for flipped axes
+    - HID: retain initial quirks set up when creating HID devices
+    - ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared
+    - ASoC: qcom: q6apm-dai: fix race condition while updating the position
+      pointer
+    - ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag
+    - ASoC: codecs: lpass: register mclk after runtime pm
+    - ASoC: codecs: lpass: fix incorrect mclk rate
+    - drm/amd/display: don't call dc_interrupt_set() for disabled crtcs
+    - HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support
+    - spi: bcm63xx-hsspi: Fix multi-bit mode setting
+    - hwmon: (mlxreg-fan) Return zero speed for broken fan
+    - ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
+    - dm: remove flush_scheduled_work() during local_exit()
+    - nfs4trace: fix state manager flag printing
+    - NFS: fix disabling of swap
+    - drm/i915/pvc: Implement recommended caching policy
+    - drm/i915/pvc: Annotate two more workaround/tuning registers as MCR
+    - drm/i915: Fix GEN8_MISCCPCTL
+    - spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
+    - ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
+    - HID: bigben: use spinlock to protect concurrent accesses
+    - HID: bigben_worker() remove unneeded check on report_field
+    - HID: bigben: use spinlock to safely schedule workers
+    - hid: bigben_probe(): validate report count
+    - ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks
+    - drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
+    - NFSD: enhance inter-server copy cleanup
+    - NFSD: fix leaked reference count of nfsd4_ssc_umount_item
+    - nfsd: fix race to check ls_layouts
+    - nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
+    - NFSD: fix problems with cleanup on errors in nfsd4_copy
+    - nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open
+    - nfsd: don't fsync nfsd_files on last close
+    - NFSD: copy the whole verifier in nfsd_copy_write_verifier
+    - cifs: Fix lost destroy smbd connection when MR allocate failed
+    - cifs: Fix warning and UAF when destroy the MR list
+    - cifs: use tcon allocation functions even for dummy tcon
+    - gfs2: jdata writepage fix
+    - perf llvm: Fix inadvertent file creation
+    - leds: led-core: Fix refcount leak in of_led_get()
+    - leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest()
+    - leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing driver
+    - tools/tracing/rtla: osnoise_hist: use total duration for average calculation
+    - perf inject: Use perf_data__read() for auxtrace
+    - perf intel-pt: Do not try to queue auxtrace data on pipe
+    - perf stat: Hide invalid uncore event output for aggr mode
+    - perf jevents: Correct bad character encoding
+    - perf test bpf: Skip test if kernel-debuginfo is not present
+    - perf tools: Fix auto-complete on aarch64
+    - perf stat: Avoid merging/aggregating metric counts twice
+    - sparc: allow PM configs for sparc32 COMPILE_TEST
+    - selftests: find echo binary to use -ne options
+    - selftests/ftrace: Fix bash specific "==" operator
+    - selftests: use printf instead of echo -ne
+    - perf record: Fix segfault with --overwrite and --max-size
+    - printf: fix errname.c list
+    - perf tests stat_all_metrics: Change true workload to sleep workload for
+      system wide check
+    - objtool: add UACCESS exceptions for __tsan_volatile_read/write
+    - selftests/ftrace: Fix probepoint testcase to ignore __pfx_* symbols
+    - sysctl: fix proc_dobool() usability
+    - mfd: rk808: Re-add rk808-clkout to RK818
+    - mfd: cs5535: Don't build on UML
+    - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
+    - dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
+    - RDMA/erdma: Fix refcount leak in erdma_mmap
+    - dmaengine: HISI_DMA should depend on ARCH_HISI
+    - RDMA/hns: Fix refcount leak in hns_roce_mmap
+    - iio: light: tsl2563: Do not hardcode interrupt trigger type
+    - usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe()
+    - i2c: designware: fix i2c_dw_clk_rate() return size to be u32
+    - i2c: qcom-geni: change i2c_master_hub to static
+    - soundwire: cadence: Don't overflow the command FIFOs
+    - driver core: fix potential null-ptr-deref in device_add()
+    - kobject: Fix slab-out-of-bounds in fill_kobj_path()
+    - alpha/boot/tools/objstrip: fix the check for ELF header
+    - media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
+    - media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU
+    - media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX
+    - media: uvcvideo: Refactor power_line_frequency_controls_limited
+    - coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
+    - coresight: cti: Prevent negative values of enable count
+    - coresight: cti: Add PM runtime call in enable_store
+    - usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count
+    - PCI/IOV: Enlarge virtfn sysfs name buffer
+    - PCI: switchtec: Return -EFAULT for copy_to_user() errors
+    - PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws kernel-doc
+    - hwtracing: hisi_ptt: Only add the supported devices to the filters list
+    - tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
+    - tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown()
+    - serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init()
+    - Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in
+      set_protocol"
+    - eeprom: idt_89hpesx: Fix error handling in idt_init()
+    - applicom: Fix PCI device refcount leak in applicom_init()
+    - firmware: stratix10-svc: add missing gen_pool_destroy() in
+      stratix10_svc_drv_probe()
+    - firmware: stratix10-svc: fix error handle while alloc/add device failed
+    - VMCI: check context->notify_page after call to get_user_pages_fast() to
+      avoid GPF
+    - mei: pxp: Use correct macros to initialize uuid_le
+    - misc/mei/hdcp: Use correct macros to initialize uuid_le
+    - misc: fastrpc: Fix an error handling path in fastrpc_rpmsg_probe()
+    - iommu/exynos: Fix error handling in exynos_iommu_init()
+    - driver core: fix resource leak in device_add()
+    - driver core: location: Free struct acpi_pld_info *pld before return false
+    - drivers: base: transport_class: fix possible memory leak
+    - drivers: base: transport_class: fix resource leak when
+      transport_add_device() fails
+    - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
+    - selftests: iommu: Fix test_cmd_destroy_access() call in user_copy
+    - iommufd: Add three missing structures in ucmd_buffer
+    - fotg210-udc: Add missing completion handler
+    - dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers
+    - fpga: microchip-spi: move SPI I/O buffers out of stack
+    - fpga: microchip-spi: rewrite status polling in a time measurable way
+    - usb: early: xhci-dbc: Fix a potential out-of-bound memory access
+    - tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case
+    - RDMA/cxgb4: add null-ptr-check after ip_dev_find()
+    - usb: musb: mediatek: don't unregister something that wasn't registered
+    - usb: gadget: configfs: Restrict symlink creation is UDC already binded
+    - phy: mediatek: remove temporary variable @mask_
+    - PCI: mt7621: Delay phy ports initialization
+    - iommu/vt-d: Set No Execute Enable bit in PASID table entry
+    - power: supply: remove faulty cooling logic
+    - RDMA/siw: Fix user page pinning accounting
+    - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
+    - usb: max-3421: Fix setting of I/O pins
+    - RDMA/irdma: Cap MSIX used to online CPUs + 1
+    - serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
+    - tty: serial: imx: disable Ageing Timer interrupt request irq
+    - driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
+    - driver core: fw_devlink: Don't purge child fwnode's consumer links
+    - driver core: fw_devlink: Allow marking a fwnode link as being part of a
+      cycle
+    - driver core: fw_devlink: Consolidate device link flag computation
+    - driver core: fw_devlink: Improve check for fwnode with no device/driver
+    - driver core: fw_devlink: Make cycle detection more robust
+    - mtd: mtdpart: Don't create platform device that'll never probe
+    - usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev
+    - dmaengine: dw-edma: Fix readq_ch() return value truncation
+    - PCI: Fix dropping valid root bus resources with .end = zero
+    - phy: rockchip-typec: fix tcphy_get_mode error case
+    - PCI: qcom: Fix host-init error handling
+    - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
+    - iommu: Fix error unwind in iommu_group_alloc()
+    - iommu/amd: Do not identity map v2 capable device when snp is enabled
+    - dmaengine: sf-pdma: pdma_desc memory leak fix
+    - dmaengine: dw-axi-dmac: Do not dereference NULL structure
+    - dmaengine: ptdma: check for null desc before calling pt_cmd_callback
+    - iommu/vt-d: Fix error handling in sva enable/disable paths
+    - iommu/vt-d: Allow to use flush-queue when first level is default
+    - RDMA/rxe: Cleanup mr_check_range
+    - RDMA/rxe: Move rxe_map_mr_sg to rxe_mr.c
+    - RDMA-rxe: Isolate mr code from atomic_reply()
+    - RDMA-rxe: Isolate mr code from atomic_write_reply()
+    - RDMA/rxe: Cleanup page variables in rxe_mr.c
+    - RDMA/rxe: Replace rxe_map and rxe_phys_buf by xarray
+    - Subject: RDMA/rxe: Handle zero length rdma
+    - RDMA/mana_ib: Fix a bug when the PF indicates more entries for registering
+      memory on first packet
+    - RDMA/rxe: Fix missing memory barriers in rxe_queue.h
+    - IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
+    - IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
+    - Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after
+      use"
+    - remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
+    - media: ti: cal: fix possible memory leak in cal_ctx_create()
+    - media: platform: ti: Add missing check for devm_regulator_get
+    - media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in
+      imx7_csi_init()
+    - powerpc: Remove linker flag from KBUILD_AFLAGS
+    - s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64
+    - builddeb: clean generated package content
+    - media: max9286: Fix memleak in max9286_v4l2_register()
+    - media: ov2740: Fix memleak in ov2740_init_controls()
+    - media: ov5675: Fix memleak in ov5675_init_controls()
+    - media: i2c: tc358746: fix missing return assignment
+    - media: i2c: tc358746: fix ignoring read error in g_register callback
+    - media: i2c: tc358746: fix possible endianness issue
+    - media: ov5640: Fix soft reset sequence and timings
+    - media: ov5640: Handle delays when no reset_gpio set
+    - media: mc: Get media_device directly from pad
+    - media: i2c: ov772x: Fix memleak in ov772x_probe()
+    - media: i2c: imx219: Split common registers from mode tables
+    - media: i2c: imx219: Fix binning for RAW8 capture
+    - media: platform: mtk-mdp3: Fix return value check in mdp_probe()
+    - media: camss: csiphy-3ph: avoid undefined behavior
+    - media: platform: mtk-mdp3: fix Kconfig dependencies
+    - media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
+    - media: v4l2-jpeg: ignore the unknown APP14 marker
+    - media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399
+    - media: imx-jpeg: Apply clk_bulk api instead of operating specific clk
+    - media: amphion: correct the unspecified color space
+    - media: drivers/media/v4l2-core/v4l2-h264 : add detection of null pointers
+    - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
+    - media: atomisp: fix videobuf2 Kconfig depenendency
+    - media: atomisp: Only set default_run_mode on first open of a stream/asd
+    - media: i2c: ov7670: 0 instead of -EINVAL was returned
+    - media: usb: siano: Fix use after free bugs caused by do_submit_urb
+    - media: saa7134: Use video_unregister_device for radio_dev
+    - rpmsg: glink: Avoid infinite loop on intent for missing channel
+    - rpmsg: glink: Release driver_override
+    - ARM: OMAP2+: omap4-common: Fix refcount leak bug
+    - arm64: dts: qcom: msm8996: Add additional A2NoC clocks
+    - udf: Define EFSCORRUPTED error code
+    - context_tracking: Fix noinstr vs KASAN
+    - exit: Detect and fix irq disabled state in oops
+    - ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
+    - fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
+    - blk-iocost: fix divide by 0 error in calc_lcoefs()
+    - blk-cgroup: dropping parent refcount after pd_free_fn() is done
+    - blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and
+      blkcg_deactivate_policy()
+    - trace/blktrace: fix memory leak with using debugfs_lookup()
+    - btrfs: scrub: improve tree block error reporting
+    - arm64: zynqmp: Enable hs termination flag for USB dwc3 controller
+    - cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE
+    - x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads
+    - cpuidle: drivers: firmware: psci: Dont instrument suspend code
+    - cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG
+    - perf/x86/intel/uncore: Add Meteor Lake support
+    - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
+    - wifi: ath11k: fix monitor mode bringup crash
+    - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
+    - rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
+    - rcu: Suppress smp_processor_id() complaint in
+      synchronize_rcu_expedited_wait()
+    - srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
+    - rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
+    - rcu-tasks: Handle queue-shrink/callback-enqueue race condition
+    - wifi: ath11k: debugfs: fix to work with multiple PCI devices
+    - thermal: intel: Fix unsigned comparison with less than zero
+    - timers: Prevent union confusion from unexpected restart_syscall()
+    - x86/bugs: Reset speculation control settings on init
+    - bpftool: Always disable stack protection for BPF objects
+    - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-
+      of-bounds
+    - wifi: rtw89: fix assignation of TX BD RAM table
+    - wifi: mt7601u: fix an integer underflow
+    - inet: fix fast path in __inet_hash_connect()
+    - ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
+    - ice: add missing checks for PF vsi type
+    - Compiler attributes: GCC cold function alignment workarounds
+    - ACPI: Don't build ACPICA with '-Os'
+    - bpf, docs: Fix modulo zero, division by zero, overflow, and underflow
+    - thermal: intel: intel_pch: Add support for Wellsburg PCH
+    - clocksource: Suspend the watchdog temporarily when high read latency
+      detected
+    - crypto: hisilicon: Wipe entire pool on error
+    - net: bcmgenet: Add a check for oversized packets
+    - m68k: Check syscall_trace_enter() return code
+    - s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping
+    - netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
+    - can: isotp: check CAN address family in isotp_bind()
+    - gcc-plugins: drop -std=gnu++11 to fix GCC 13 build
+    - tools/power/x86/intel-speed-select: Add Emerald Rapid quirk
+    - platform/x86: dell-ddv: Add support for interface version 3
+    - wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
+    - ACPI: video: Fix Lenovo Ideapad Z570 DMI match
+    - net/mlx5: fw_tracer: Fix debug print
+    - coda: Avoid partial allocation of sig_inputArgs
+    - uaccess: Add minimum bounds check on kernel buffer size
+    - s390/idle: mark arch_cpu_idle() noinstr
+    - time/debug: Fix memory leak with using debugfs_lookup()
+    - PM: domains: fix memory leak with using debugfs_lookup()
+    - PM: EM: fix memory leak with using debugfs_lookup()
+    - Bluetooth: Fix issue with Actions Semi ATS2851 based devices
+    - Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921
+    - Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
+    - wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30
+    - hv_netvsc: Check status in SEND_RNDIS_PKT completion message
+    - s390/kfence: fix page fault reporting
+    - devlink: Fix TP_STRUCT_entry in trace of devlink health report
+    - scm: add user copy checks to put_cmsg()
+    - drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F
+    - drm: panel-orientation-quirks: Add quirk for DynaBook K50
+    - drm/amd/display: Reduce expected sdp bandwidth for dcn321
+    - drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h
+      write
+    - drm/amd/display: Fix potential null-deref in dm_resume
+    - drm/omap: dsi: Fix excessive stack usage
+    - HID: Add Mapping for System Microphone Mute
+    - drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
+    - drm/amd/display: Defer DIG FIFO disable after VID stream enable
+    - drm/radeon: free iio for atombios when driver shutdown
+    - drm/amd: Avoid BUG() for case of SRIOV missing IP version
+    - drm/amdkfd: Page aligned memory reserve size
+    - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
+    - Revert "fbcon: don't lose the console font across generic->chip driver
+      switch"
+    - drm/amd: Avoid ASSERT for some message failures
+    - drm: amd: display: Fix memory leakage
+    - drm/amd/display: fix mapping to non-allocated address
+    - HID: uclogic: Add frame type quirk
+    - HID: uclogic: Add battery quirk
+    - HID: uclogic: Add support for XP-PEN Deco Pro SW
+    - HID: uclogic: Add support for XP-PEN Deco Pro MW
+    - drm/msm/dsi: Add missing check for alloc_ordered_workqueue
+    - drm: rcar-du: Add quirk for H3 ES1.x pclk workaround
+    - drm: rcar-du: Fix setting a reserved bit in DPLLCR
+    - drm/drm_print: correct format problem
+    - drm/amd/display: Set hvm_enabled flag for S/G mode
+    - drm/client: Test for connectors before sending hotplug event
+    - habanalabs: extend fatal messages to contain PCI info
+    - habanalabs: fix bug in timestamps registration code
+    - docs/scripts/gdb: add necessary make scripts_gdb step
+    - drm/msm/dpu: Add DSC hardware blocks to register snapshot
+    - ASoC: soc-compress: Reposition and add pcm_mutex
+    - ASoC: kirkwood: Iterate over array indexes instead of using pointer math
+    - regulator: max77802: Bounds check regulator id against opmode
+    - regulator: s5m8767: Bounds check id indexing into arrays
+    - Revert "drm/amdgpu: TA unload messages are not actually sent to psp when
+      amdgpu is uninstalled"
+    - drm/amd/display: fix FCLK pstate change underflow
+    - gfs2: Improve gfs2_make_fs_rw error handling
+    - hwmon: (coretemp) Simplify platform device handling
+    - hwmon: (nct6775) Directly call ASUS ACPI WMI method
+    - hwmon: (nct6775) B650/B660/X670 ASUS boards support
+    - pinctrl: at91: use devm_kasprintf() to avoid potential leaks
+    - drm/amd/display: Do not commit pipe when updating DRR
+    - scsi: snic: Fix memory leak with using debugfs_lookup()
+    - scsi: ufs: core: Fix device management cmd timeout flow
+    - HID: logitech-hidpp: Don't restart communication if not necessary
+    - drm/amd/display: Enable P-state validation checks for DCN314
+    - drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
+    - drm/amd/display: Disable HUBP/DPP PG on DCN314 for now
+    - drm/amd/display: disable SubVP + DRR to prevent underflow
+    - dm thin: add cond_resched() to various workqueue loops
+    - dm cache: add cond_resched() to various workqueue loops
+    - nfsd: zero out pointers after putting nfsd_files on COPY setup error
+    - nfsd: don't hand out delegation on setuid files being opened for write
+    - cifs: prevent data race in smb2_reconnect()
+    - drm/i915/mtl: Correct implementation of Wa_18018781329
+    - drm/shmem-helper: Revert accidental non-GPL export
+    - driver core: fw_devlink: Avoid spurious error message
+    - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
+    - firmware: coreboot: framebuffer: Ignore reserved pixel color bits
+    - block: don't allow multiple bios for IOCB_NOWAIT issue
+    - block: clear bio->bi_bdev when putting a bio back in the cache
+    - block: be a bit more careful in checking for NULL bdev while polling
+    - rtc: pm8xxx: fix set-alarm race
+    - ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms'
+    - ipmi:ssif: resend_msg() cannot fail
+    - ipmi_ssif: Rename idle state and check
+    - ipmi:ssif: Add a timer between request retries
+    - io_uring: Replace 0-length array with flexible array
+    - io_uring: use user visible tail in io_uring_poll()
+    - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
+    - io_uring: add a conditional reschedule to the IOPOLL cancelation loop
+    - io_uring: add reschedule point to handle_tw_list()
+    - io_uring/rsrc: disallow multi-source reg buffers
+    - io_uring: remove MSG_NOSIGNAL from recvmsg
+    - io_uring/poll: allow some retries for poll triggering spuriously
+    - io_uring: fix fget leak when fs don't support nowait buffered read
+    - s390/extmem: return correct segment type in __segment_load()
+    - s390: discard .interp section
+    - s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
+    - s390/kprobes: fix current_kprobe never cleared after kprobes reenter
+    - KVM: s390: disable migration mode when dirty tracking is disabled
+    - cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID
+    - cifs: Fix uninitialized memory read in smb3_qfs_tcon()
+    - cifs: Fix uninitialized memory reads for oparms.mode
+    - cifs: fix mount on old smb servers
+    - cifs: introduce cifs_io_parms in smb2_async_writev()
+    - cifs: split out smb3_use_rdma_offload() helper
+    - cifs: don't try to use rdma offload on encrypted connections
+    - cifs: Check the lease context if we actually got a lease
+    - cifs: return a single-use cfid if we did not get a lease
+    - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization
+    - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()
+    - scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi
+    - btrfs: hold block group refcount during async discard
+    - btrfs: sysfs: update fs features directory asynchronously
+    - locking/rwsem: Prevent non-first waiter from spinning in down_write()
+      slowpath
+    - ksmbd: fix wrong data area length for smb2 lock request
+    - ksmbd: do not allow the actual frame length to be smaller than the rfc1002
+      length
+    - ksmbd: fix possible memory leak in smb2_lock()
+    - torture: Fix hang during kthread shutdown phase
+    - ARM: dts: exynos: correct HDMI phy compatible in Exynos4
+    - io_uring: mark task TASK_RUNNING before handling resume/task work
+    - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
+    - fs: hfsplus: fix UAF issue in hfsplus_put_super
+    - exfat: fix reporting fs error when reading dir beyond EOF
+    - exfat: fix unexpected EOF while reading dir
+    - exfat: redefine DIR_DELETED as the bad cluster number
+    - exfat: fix inode->i_blocks for non-512 byte sector size device
+    - fs: dlm: start midcomms before scand
+    - fs: dlm: fix use after free in midcomms commit
+    - fs: dlm: be sure to call dlm_send_queue_flush()
+    - fs: dlm: fix race setting stop tx flag
+    - fs: dlm: don't set stop rx flag after node reset
+    - fs: dlm: move sending fin message into state change handling
+    - fs: dlm: send FIN ack back in right cases
+    - f2fs: fix information leak in f2fs_move_inline_dirents()
+    - f2fs: retry to update the inode page given data corruption
+    - f2fs: fix cgroup writeback accounting with fs-layer encryption
+    - f2fs: fix kernel crash due to null io->bio
+    - f2fs: Revert "f2fs: truncate blocks in batch in __complete_revoke_list()"
+    - ocfs2: fix defrag path triggering jbd2 ASSERT
+    - ocfs2: fix non-auto defrag path not working issue
+    - fs/cramfs/inode.c: initialize file_ra_state
+    - selftests/landlock: Skip overlayfs tests when not supported
+    - selftests/landlock: Test ptrace as much as possible with Yama
+    - udf: Truncate added extents on failed expansion
+    - udf: Do not bother merging very long extents
+    - udf: Do not update file length for failed writes to inline files
+    - udf: Preserve link count of system files
+    - udf: Detect system inodes linked into directory hierarchy
+    - udf: Fix file corruption when appending just after end of preallocated
+      extent
+    - md: don't update recovery_cp when curr_resync is ACTIVE
+    - KVM: Destroy target device if coalesced MMIO unregistration fails
+    - KVM: VMX: Fix crash due to uninitialized current_vmcs
+    - KVM: Register /dev/kvm as the _very_ last thing during initialization
+    - KVM: x86: Purge "highest ISR" cache when updating APICv state
+    - KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps
+    - KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is disabled
+    - KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID
+    - KVM: SVM: Flush the "current" TLB when activating AVIC
+    - KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target
+    - KVM: SVM: Don't put/load AVIC when setting virtual APIC mode
+    - KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
+    - KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32
+    - KVM: SVM: Fix potential overflow in SEV's send|receive_update_data()
+    - KVM: SVM: hyper-v: placate modpost section mismatch error
+    - selftests: x86: Fix incorrect kernel headers search path
+    - x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
+    - x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
+    - x86/reboot: Disable virtualization in an emergency if SVM is supported
+    - x86/reboot: Disable SVM, not just VMX, when stopping CPUs
+    - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
+    - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe
+      range
+    - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
+    - x86/microcode/AMD: Add a @cpu parameter to the reloading functions
+    - x86/microcode/AMD: Fix mixed steppings support
+    - x86/speculation: Allow enabling STIBP with legacy IBRS
+    - Documentation/hw-vuln: Document the interaction between IBRS and STIBP
+    - virt/sev-guest: Return -EIO if certificate buffer is not large enough
+    - brd: mark as nowait compatible
+    - brd: return 0/-error from brd_insert_page()
+    - brd: check for REQ_NOWAIT and set correct page allocation mask
+    - ima: fix error handling logic when file measurement failed
+    - ima: Align ima_file_mmap() parameters with mmap_file LSM hook
+    - selftests/powerpc: Fix incorrect kernel headers search path
+    - selftests/ftrace: Fix eprobe syntax test case to check filter support
+    - selftests: sched: Fix incorrect kernel headers search path
+    - selftests: core: Fix incorrect kernel headers search path
+    - selftests: pid_namespace: Fix incorrect kernel headers search path
+    - selftests: arm64: Fix incorrect kernel headers search path
+    - selftests: clone3: Fix incorrect kernel headers search path
+    - selftests: pidfd: Fix incorrect kernel headers search path
+    - selftests: membarrier: Fix incorrect kernel headers search path
+    - selftests: kcmp: Fix incorrect kernel headers search path
+    - selftests: media_tests: Fix incorrect kernel headers search path
+    - selftests: gpio: Fix incorrect kernel headers search path
+    - selftests: filesystems: Fix incorrect kernel headers search path
+    - selftests: user_events: Fix incorrect kernel headers search path
+    - selftests: ptp: Fix incorrect kernel headers search path
+    - selftests: sync: Fix incorrect kernel headers search path
+    - selftests: rseq: Fix incorrect kernel headers search path
+    - selftests: move_mount_set_group: Fix incorrect kernel headers search path
+    - selftests: mount_setattr: Fix incorrect kernel headers search path
+    - selftests: perf_events: Fix incorrect kernel headers search path
+    - selftests: ipc: Fix incorrect kernel headers search path
+    - selftests: futex: Fix incorrect kernel headers search path
+    - selftests: drivers: Fix incorrect kernel headers search path
+    - selftests: dmabuf-heaps: Fix incorrect kernel headers search path
+    - selftests: vm: Fix incorrect kernel headers search path
+    - selftests: seccomp: Fix incorrect kernel headers search path
+    - irqdomain: Fix association race
+    - irqdomain: Fix disassociation race
+    - irqdomain: Look for existing mapping only once
+    - irqdomain: Drop bogus fwspec-mapping error handling
+    - irqdomain: Refactor __irq_domain_alloc_irqs()
+    - irqdomain: Fix mapping-creation race
+    - irqdomain: Fix domain registration race
+    - crypto: qat - fix out-of-bounds read
+    - mm/damon/paddr: fix missing folio_put()
+    - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
+    - ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
+    - jbd2: fix data missing when reusing bh which is ready to be checkpointed
+    - ext4: optimize ea_inode block expansion
+    - ext4: refuse to create ea block when umounted
+    - cxl/pmem: Fix nvdimm registration races
+    - Input: exc3000 - properly stop timer on shutdown
+    - mtd: spi-nor: sfdp: Fix index value for SCCR dwords
+    - mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
+    - dm: send just one event on resize, not two
+    - dm: add cond_resched() to dm_wq_work()
+    - dm: add cond_resched() to dm_wq_requeue_work()
+    - wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice
+    - wifi: rtl8xxxu: Use a longer retry limit of 48
+    - wifi: ath11k: allow system suspend to survive ath11k
+    - wifi: cfg80211: Fix use after free for wext
+    - wifi: cfg80211: Set SSID if it is not already set
+    - cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies
+    - qede: fix interrupt coalescing configuration
+    - thermal: intel: powerclamp: Fix cur_state for multi package system
+    - dm flakey: fix logic when corrupting a bio
+    - dm cache: free background tracker's queued work in btracker_destroy
+    - dm flakey: don't corrupt the zero page
+    - dm flakey: fix a bug with 32-bit highmem systems
+    - hwmon: (peci/cputemp) Fix off-by-one in coretemp_label allocation
+    - hwmon: (nct6775) Fix incorrect parenthesization in nct6775_write_fan_div()
+    - spi: intel: Check number of chip selects after reading the descriptor
+    - ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for IOMMU node
+    - ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node
+    - ARM: dts: exynos: correct TMU phandle in Exynos4210
+    - ARM: dts: exynos: correct TMU phandle in Exynos4
+    - ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
+    - ARM: dts: exynos: correct TMU phandle in Exynos5250
+    - ARM: dts: exynos: correct TMU phandle in Odroid XU
+    - ARM: dts: exynos: correct TMU phandle in Odroid HC1
+    - arm64: acpi: Fix possible memory leak of ffh_ctxt
+    - arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP
+    - arm64: Reset KASAN tag in copy_highpage with HW tags only
+    - fuse: add inode/permission checks to fileattr_get/fileattr_set
+    - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
+    - ceph: update the time stamps and try to drop the suid/sgid
+    - regulator: core: Use ktime_get_boottime() to determine how long a regulator
+      was off
+    - panic: fix the panic_print NMI backtrace setting
+    - mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON
+    - genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced
+    - genirq/msi: Take the per-device MSI lock before validating the control
+      structure
+    - spi: spi-sn-f-ospi: fix duplicate flag while assigning to mode_bits
+    - alpha: fix FEN fault handling
+    - dax/kmem: Fix leak of memory-hotplug resources
+    - mips: fix syscall_get_nr
+    - media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
+    - remoteproc/mtk_scp: Move clk ops outside send_lock
+    - vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd
+    - docs: gdbmacros: print newest record
+    - mm: memcontrol: deprecate charge moving
+    - mm/thp: check and bail out if page in deferred queue already
+    - ktest.pl: Give back console on Ctrt^C on monitor
+    - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
+    - ktest.pl: Fix missing "end_monitor" when machine check fails
+    - ktest.pl: Add RUN_TIMEOUT option with default unlimited
+    - memory tier: release the new_memtier in find_create_memory_tier()
+    - ring-buffer: Handle race between rb_move_tail and rb_check_pages
+    - tools/bootconfig: fix single & used for logical condition
+    - tracing/eprobe: Fix to add filter on eprobe description in README file
+    - iommu/amd: Add a length limitation for the ivrs_acpihid command-line
+      parameter
+    - scsi: aacraid: Allocate cmd_priv with scsicmd
+    - scsi: qla2xxx: Fix link failure in NPIV environment
+    - scsi: qla2xxx: Check if port is online before sending ELS
+    - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
+    - scsi: qla2xxx: Remove unintended flag clearing
+    - scsi: qla2xxx: Fix erroneous link down
+    - scsi: qla2xxx: Remove increment of interface err cnt
+    - scsi: ses: Don't attach if enclosure has no components
+    - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
+    - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
+    - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
+    - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
+    - RISC-V: add a spin_shadow_stack declaration
+    - riscv: Avoid enabling interrupts in die()
+    - riscv: mm: fix regression due to update_mmu_cache change
+    - riscv: jump_label: Fixup unaligned arch_static_branch function
+    - riscv: ftrace: Fixup panic by disabling preemption
+    - riscv, mm: Perform BPF exhandler fixup on page fault
+    - riscv: ftrace: Remove wasted nops for !RISCV_ISA_C
+    - riscv: ftrace: Reduce the detour code size to half
+    - MIPS: DTS: CI20: fix otg power gpio
+    - PCI/PM: Observe reset delay irrespective of bridge_d3
+    - PCI: Unify delay handling for reset and resume
+    - PCI: hotplug: Allow marking devices as disconnected during bind/unbind
+    - PCI: Avoid FLR for AMD FCH AHCI adapters
+    - PCI/DPC: Await readiness of secondary bus after reset
+    - bus: mhi: ep: Only send -ENOTCONN status if client driver is available
+    - bus: mhi: ep: Move chan->lock to the start of processing queued ch ring
+    - bus: mhi: ep: Save channel state locally during suspend and resume
+    - iommufd: Make sure to zero vfio_iommu_type1_info before copying to user
+    - iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
+    - iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode
+    - iommu/vt-d: Fix PASID directory pointer coherency
+    - vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR
+    - vfio/type1: prevent underflow of locked_vm via exec()
+    - vfio/type1: track locked_vm per dma
+    - vfio/type1: restore locked_vm
+    - drm/amd: Fix initialization for nbio 7.5.1
+    - drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
+    - drm/radeon: Fix eDP for single-display iMac11,2
+    - drm/i915: Don't use stolen memory for ring buffers with LLC
+    - drm/i915: Don't use BAR mappings for ring buffers with LLC
+    - drm/gud: Fix UBSAN warning
+    - drm/edid: fix AVI infoframe aspect ratio handling
+    - drm/edid: fix parsing of 3D modes from HDMI VSDB
+    - qede: avoid uninitialized entries in coal_entry array
+    - brd: use radix_tree_maybe_preload instead of radix_tree_preload
+    - net: avoid double iput when sock_alloc_file fails
+    - Linux 6.2.3
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations after applying 6.2.3 stable patches
+    - [Config] update annotations after applying 6.2.6 stable patches
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 14 Mar 2023 16:43:44 +0100
+
+linux (6.2.0-16.16) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-16.16 -proposed tracker (LP: #2009914)
+
+  * linux-libc-dev is no longer multi-arch safe (LP: #2009355)
+    - Revert "UBUNTU: [Packaging] install headers to debian/linux-libc-dev
+      directly"
+
+  * linux: CONFIG_SERIAL_8250_MID=y (LP: #2009283)
+    - [Config] enable CONFIG_SERIAL_8250_MID=y
+
+  * cpufreq: intel_pstate: Update Balance performance EPP for Sapphire Rapids
+    (LP: #2008519)
+    - cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Mar 2023 18:34:28 +0100
+
+linux (6.2.0-15.15) lunar; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: document annotations headers
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Mar 2023 07:36:59 +0100
+
+linux (6.2.0-14.14) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-14.14 -proposed tracker (LP: #2009856)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] rust: add rust build dependencies to all arches
+    - [Packaging] Support skipped dkms modules
+    - [Packaging] actually enforce set -e in dkms-build--nvidia-N
+    - [Packaging] Preserve the correct log file variable value
+    - [Packaging] update getabis
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 09 Mar 2023 16:40:36 +0100
+
+linux (6.2.0-13.13) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-13.13 -proposed tracker (LP: #2009704)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * mt7921: add support of MTFG table (LP: #2009642)
+    - wifi: mt76: mt7921: add support to update fw capability with MTFG table
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 14:40:25 +0100
+
+linux (6.2.0-12.12) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-12.12 -proposed tracker (LP: #2009698)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: enforce rust availability only on x86_64
+    - [Config] update CONFIG_RUST_IS_AVAILABLE
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 12:50:15 +0100
+
+linux (6.2.0-11.11) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-11.11 -proposed tracker (LP: #2009697)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] do not stop the build if rust is not available
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 12:24:55 +0100
+
+linux (6.2.0-10.10) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-10.10 -proposed tracker (LP: #2009673)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * enable Rust support in the kernel (LP: #2007654)
+    - [Packaging] propagate makefile variables to kernelconfig
+    - SAUCE: rust: fix regexp in scripts/is_rust_module.sh
+    - SAUCE: scripts: rust: drop is_rust_module.sh
+    - SAUCE: rust: allow to use INIT_STACK_ALL_ZERO
+    - SAUCE: scripts: Exclude Rust CUs with pahole
+    - SAUCE: modpost: support arbitrary symbol length in modversion
+    - SAUCE: allows to enable Rust with modversions
+    - SAUCE: rust: properly detect the version of libclang used by bindgen
+    - [Packaging] rust: add the proper make flags to enable rust support
+    - [Packaging] add rust dependencies
+    - [Packaging] bpftool: always use vmlinux to generate headers
+    - [Packaging] run rustavailable target as debugging before build
+    - [Config] enable Rust support
+
+  * Fail to output sound to external monitor which connects via docking station
+    (LP: #2009024)
+    - [Config] Enable CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Makefile: replace rsync with tar
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Mar 2023 12:01:56 +0100
+
+linux (6.2.0-1.1) lunar; urgency=medium
+
+  * lunar/linux: 6.2.0-1.1 -proposed tracker (LP: #2009621)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * kinetic: apply new apparmor and LSM stacking patch set (LP: #1989983)
+    - SAUCE: apparmor: Add fine grained mediation of posix mqueues
+    - SAUCE: apparmor: add user namespace creation mediation
+
+  * Lunar update: v6.2.2 upstream stable release (LP: #2009358)
+    - ALSA: hda: cs35l41: Correct error condition handling
+    - crypto: arm64/sm4-gcm - Fix possible crash in GCM cryption
+    - bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
+    - vc_screen: don't clobber return value in vcs_read
+    - drm/amd/display: Move DCN314 DOMAIN power control to DMCUB
+    - drm/amd/display: Properly reuse completion structure
+    - scripts/tags.sh: fix incompatibility with PCRE2
+    - wifi: rtw88: usb: Set qsel correctly
+    - wifi: rtw88: usb: send Zero length packets if necessary
+    - wifi: rtw88: usb: drop now unnecessary URB size check
+    - usb: dwc3: pci: add support for the Intel Meteor Lake-M
+    - USB: serial: option: add support for VW/Skoda "Carstick LTE"
+    - usb: gadget: u_serial: Add null pointer check in gserial_resume
+    - arm64: dts: uniphier: Fix property name in PXs3 USB node
+    - usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO
+    - USB: core: Don't hold device lock while reading the "descriptors" sysfs file
+    - Linux 6.2.2
+
+  * Lunar update: v6.2.1 upstream stable release (LP: #2009127)
+    - uaccess: Add speculation barrier to copy_from_user()
+    - x86/alternatives: Introduce int3_emulate_jcc()
+    - x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions
+    - x86/static_call: Add support for Jcc tail-calls
+    - HID: mcp-2221: prevent UAF in delayed work
+    - wifi: mwifiex: Add missing compatible string for SD8787
+    - audit: update the mailing list in MAINTAINERS
+    - platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY
+    - platform/x86: nvidia-wmi-ec-backlight: Add force module parameter
+    - ext4: Fix function prototype mismatch for ext4_feat_ktype
+    - randstruct: disable Clang 15 support
+    - bpf: add missing header file include
+    - Linux 6.2.1
+
+  * Fix mediatek wifi driver crash when loading wrong SAR table (LP: #2009118)
+    - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read
+
+  * overlayfs mounts as R/O over idmapped mount (LP: #2009065)
+    - SAUCE: overlayfs: handle idmapped mounts in ovl_do_(set|remove)xattr
+
+  * RaptorLake: Fix the Screen is shaking by onboard HDMI port in mirror mode
+    (LP: #1993561)
+    - drm/i915/display: Drop check for doublescan mode in modevalid
+    - drm/i915/display: Prune Interlace modes for Display >=12
+
+  * screen flicker after PSR2 enabled (LP: #2007516)
+    - SAUCE: drm/i915/display/psr: Disable PSR2 sel fetch on panel SHP 5457
+
+  * [23.04 FEAT] Support for new IBM Z Hardware (IBM z16) - Reset DAT-Protection
+    facility support (LP: #1982378)
+    - s390/mm: add support for RDP (Reset DAT-Protection)
+
+  * [23.04 FEAT] zcrypt DD: AP command filtering (LP: #2003637)
+    - s390/zcrypt: introduce ctfm field in struct CPRBX
+
+  * rtcpie in timers from ubuntu_kernel_selftests randomly failing
+    (LP: #1814234)
+    - SAUCE: selftest: rtcpie: Force passing unreliable subtest
+
+  * [23.04 FEAT] Support for List-Directed IPL and re-IPL from ECKD DASD
+    (LP: #2003394)
+    - s390/ipl: add DEFINE_GENERIC_LOADPARM()
+    - s390/ipl: add loadparm parameter to eckd ipl/reipl data
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: drm/i915/sseu: fix max_subslices array-index-out-of-bounds access
+    - SAUCE: mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
+    - SAUCE: Revert "fbdev: Make registered_fb[] private to fbmem.c"
+    - [Packaging] disable signing for ppc64el
+    - [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS
+    - SAUCE: Revert "arm64/fpsimd: Make kernel_neon_ API _GPL"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 07 Mar 2023 18:45:31 +0100
+
+linux (6.2.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 03 Mar 2023 08:42:43 +0100
+
+linux-unstable (6.2.0-10.10) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-10.10 -proposed tracker (LP: #2007818)
+
+  * Built-in camera device dies after runtime suspended (LP: #2007530)
+    - SAUCE: usb: xhci: Workaround for runpm issue on AMD xHC
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations after rebase to v6.2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Feb 2023 10:36:20 +0100
+
+linux-unstable (6.2.0-9.9) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-9.9 -proposed tracker (LP: #2007069)
+
+  * Move kernel ADT tests to python3 (LP: #2004429)
+    - [Debian] Use a python3 compatable kernel-testing repo
+
+  * Mediatek FM350-GL wwan module failed to init: Invalid device status 0x1
+    (LP: #2002089)
+    - SAUCE: Revert "net: wwan: t7xx: Add AP CLDMA"
+    - SAUCE: net: wwan: t7xx: Add AP CLDMA
+    - SAUCE: net: wwan: t7xx: Infrastructure for early port configuration
+    - SAUCE: net: wwan: t7xx: PCIe reset rescan
+    - SAUCE: net: wwan: t7xx: Enable devlink based fw flashing and coredump
+      collection
+    - SAUCE: net: wwan: t7xx: Devlink documentation
+
+  * LXD containers using shiftfs on ZFS or TMPFS broken on 5.15.0-48.54
+    (LP: #1990849)
+    - SAUCE: shiftfs: fix -EOVERFLOW inside the container
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: do not drop undefined configs in derivatives
+    - [Packaging]: annotations: fix _remove_entry() logic
+    - [Packaging] rsync no longer available on lunar
+    - [Packaging] annotations: Handle single-line annoation rules
+    - [Packaging] annotations: Preserve single-line annotation rules
+    - [Packaging] annotations: Fix linter errors
+    - [Packaging] annotations: Clean up policy writes
+    - [Packaging] annotations: Handle tabs in annotations file
+    - [Packaging] annotations: Fail on invalid lines
+    - [Packaging] annotations: Write out annotations with notes first
+    - [Packaging] annotations: Check validity of FLAVOUR_DEP
+    - [Config] update annotations to split configs with/without notes
+    - [Packaging] annotations: various code cleanups
+    - [Config] update annotations after rebase to v6.2-rc8
+
+  * Miscellaneous upstream changes
+    - selftests/net: mv bpf/nat6to4.c to net folder
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Feb 2023 09:32:18 +0100
+
+linux-unstable (6.2.0-8.8) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-8.8 -proposed tracker (LP: #2004229)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] re-enable signing for ppc64el and s390x
+    - SAUCE: s390/decompressor: specify __decompress() buf len to avoid overflow
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 31 Jan 2023 08:21:21 +0100
+
+linux-unstable (6.2.0-7.7) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-7.7 -proposed tracker (LP: #2004142)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 30 Jan 2023 10:23:15 +0100
+
+linux-unstable (6.2.0-6.6) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-6.6 -proposed tracker (LP: #2004138)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] debian/rules: Bring back 'editconfigs'
+    - [Packaging] debian/rules: 1-maintainer.mk -- Use make's if-else
+    - [Packaging] annotations: make sure to always drop undefined configs
+    - [Config] update annotations after rebase to v6.2-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 30 Jan 2023 09:20:26 +0100
+
+linux-unstable (6.2.0-5.5) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-5.5 -proposed tracker (LP: #2003682)
+
+  * [23.04] Kernel 6.2 does not boot on s390x (LP: #2003348)
+    - SAUCE Revert "zstd: import usptream v1.5.2"
+    - SAUCE: Revert "zstd: Move zstd-common module exports to
+      zstd_common_module.c"
+
+  * Revoke & rotate to new signing key (LP: #2002812)
+    - [Packaging] Revoke and rotate to new signing key
+
+  * CVE-2023-0179
+    - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
+
+  * [23.04] net/smc: Alibaba patches about tunable buffer sizes may cause errors
+    and need to be removed (kernel 6.2) (LP: #2003547)
+    - SAUCE: Revert "net/smc: Unbind r/w buffer size from clcsock and make them
+      tunable"
+    - SAUCE: Revert "net/smc: Introduce a specific sysctl for TEST_LINK time"
+
+  * 5.15 stuck at boot on c4.large (LP: #1956780)
+    - SAUCE: Revert "PCI/MSI: Mask MSI-X vectors only on success"
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] scripts/misc/kernelconfig: Disable config checks for mainline
+      builds
+    - [Packaging] annotations: add CONFIG_GCC_VERSION to the list of ignored
+      configs
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 Jan 2023 08:20:26 +0100
+
+linux-unstable (6.2.0-4.4) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-4.4 -proposed tracker (LP: #2003051)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] add python3 as a build dependency
+    - [Packaging] scripts/misc/kernelconfig: Rewrite
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 17 Jan 2023 09:18:54 +0100
+
+linux-unstable (6.2.0-3.3) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-3.3 -proposed tracker (LP: #2002939)
+
+  * Enable kernel config for P2PDMA (LP: #1987394)
+    - [Config] Enable CONFIG_HSA_AMD_P2P
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (no-up) Remove obj- += foo.o hack
+    - SAUCE: (no-up) re-add ubuntu/ directory
+    - [Config] enable EFI handover protocol
+    - [Packaging] Fix module-check error when modules are compressed
+    - SAUCE: (no-up) do not remove debian directory by 'make mrproper'
+    - [Packaging] debian/rules: Drop AUTOBUILD
+    - [Packaging] debian/rules: Drop NOKERNLOG and PRINTSHAS env variables
+    - [Packaging] debian/rules: Replace skip<foo> variables with skip_checks
+    - [Packaging] checks/retpoline-check: Make 'skipretpoline' argument optional
+    - [Packaging] checks/module-signature-check: Add 'skip_checks' argument
+    - [Packaging] debian/rules: Rename 'skip_dbg' to 'do_dbgsym_package'
+    - [Packaging] debian/rules: Rename 'skip_checks' to 'do_skip_checks'
+    - [Packaging] debian/rules: Rename 'full_build' to 'do_full_build'
+    - [Packaging] debian/rules: Fix PPA debug package builds
+    - [Packaging] debian/rules: Remove debug package install directory earlier
+    - [Packaging] debian/rules: Remove unnecessary 'lockme_<foo>' variables
+    - [Packaging] debian/rules: Remove unused target 'diffupstream'
+    - [Packaging] debian/rules: Mark PHONY targets individually
+    - [Packaging] debian/rules: Clean up 'help' target output
+    - [Packaging] debian/rules: Clean up 'printenv' target output
+    - [Packaging] debian/rules: Add missing 'do_<foo>' variables to 'printenv'
+    - [Config] update annotations after rebase to v6.2-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 16 Jan 2023 16:01:40 +0100
+
+linux-unstable (6.2.0-2.2) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-2.2 -proposed tracker (LP: #2001892)
+
+  * Soundwire support for the Intel RPL Gen 0C40/0C11 platforms (LP: #2000030)
+    - SAUCE: ASoC: Intel: soc-acpi: add configuration for variant of 0C40 product
+    - SAUCE: ASoC: Intel: soc-acpi: add configuration for variant of 0C11 product
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain version in annotations
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Support skipped dkms modules"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 05 Jan 2023 09:19:55 +0100
+
+linux-unstable (6.2.0-1.1) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.2.0-1.1 -proposed tracker (LP: #2000904)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: remove configs that are undefined across all
+      arches/flavours
+    - SAUCE: Revert "apparmor: make __aa_path_perm() static"
+    - [Packaging] abi-check: ignore failures when abi check is skipped
+    - [Packaging] temporarily disable zfs dkms
+    - [Config] update annotations after rebase to 6.2-rc1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 04 Jan 2023 12:08:32 +0100
+
+linux-unstable (6.2.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Sun, 01 Jan 2023 10:16:00 +0100
+
+linux (6.1.0-11.11) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-11.11 -proposed tracker (LP: #2000704)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Lunar update: v6.1.1 upstream stable release (LP: #2000706)
+    - x86/vdso: Conditionally export __vdso_sgx_enter_enclave()
+    - libbpf: Fix uninitialized warning in btf_dump_dump_type_data
+    - PCI: mt7621: Add sentinel to quirks table
+    - mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem
+    - mips: ralink: mt7621: soc queries and tests as functions
+    - mips: ralink: mt7621: do not use kzalloc too early
+    - irqchip/ls-extirq: Fix endianness detection
+    - udf: Discard preallocation before extending file with a hole
+    - udf: Fix preallocation discarding at indirect extent boundary
+    - udf: Do not bother looking for prealloc extents if i_lenExtents matches
+      i_size
+    - udf: Fix extending file within last block
+    - usb: gadget: uvc: Prevent buffer overflow in setup handler
+    - USB: serial: option: add Quectel EM05-G modem
+    - USB: serial: cp210x: add Kamstrup RF sniffer PIDs
+    - USB: serial: f81232: fix division by zero on line-speed change
+    - USB: serial: f81534: fix division by zero on line-speed change
+    - xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N
+    - staging: r8188eu: fix led register settings
+    - igb: Initialize mailbox message for VF reset
+    - usb: typec: ucsi: Resume in separate work
+    - usb: dwc3: pci: Update PCIe device ID for USB3 controller on CPU sub-system
+      for Raptor Lake
+    - cifs: fix oops during encryption
+    - KEYS: encrypted: fix key instantiation with user-provided data
+    - Linux 6.1.1
+
+  * Expose built-in trusted and revoked certificates (LP: #1996892)
+    - [Packaging] Expose built-in trusted and revoked certificates
+
+  * Fix System cannot detect bluetooth after running suspend stress test
+    (LP: #1998727)
+    - wifi: rtw88: 8821c: enable BT device recovery mechanism
+
+  * Gnome doesn't run smooth when performing normal usage with RPL-P CPU
+    (LP: #1998419)
+    - drm/i915/rpl-p: Add stepping info
+
+  * Mute/mic LEDs no function on a HP platfrom (LP: #1998882)
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
+
+  * Add additional Mediatek MT7922 BT device ID (LP: #1998885)
+    - Bluetooth: btusb: Add a new VID/PID 0489/e0f2 for MT7922
+
+  * Support Icicle Kit reference design v2022.10 (LP: #1993148)
+    - SAUCE: riscv: dts: microchip: Disable PCIe on the Icicle Kit
+
+  * Add iommu passthrough quirk for Intel IPU6 on RaptorLake (LP: #1989041)
+    - SAUCE: iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs on Raptor
+      Lake
+
+  * Enable Intel FM350 wwan CCCI driver port logging (LP: #1997686)
+    - net: wwan: t7xx: use union to group port type specific data
+    - net: wwan: t7xx: Add port for modem logging
+
+  * TEE Support for CCP driver (LP: #1991608)
+    - crypto: ccp - Add support for TEE for PCI ID 0x14CA
+
+  * Kinetic update: v5.19.17 upstream stable release (LP: #1994179)
+    - Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
+    - kbuild: Add skip_encoding_btf_enum64 option to pahole
+
+  * Kinetic update: v5.19.15 upstream stable release (LP: #1994078)
+    - Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5"
+
+  * support independent clock and LED GPIOs for Intel IPU6 platforms
+    (LP: #1989046)
+    - SAUCE: platform/x86: int3472: support independent clock and LED GPIOs
+
+  * Kernel livepatch support for for s390x (LP: #1639924)
+    - [Config] Enable EXPOLINE_EXTERN on s390x
+
+  * Kinetic update: v5.19.7 upstream stable release (LP: #1988733)
+    - Revert "PCI/portdrv: Don't disable AER reporting in
+      get_port_device_capability()"
+
+  * Kinetic update: v5.19.3 upstream stable release (LP: #1987345)
+    - Revert "mm: kfence: apply kmemleak_ignore_phys on early allocated pool"
+
+  * Fix non-working e1000e device after resume (LP: #1951861)
+    - SAUCE: Revert "e1000e: Add polling mechanism to indicate CSME DPG exit"
+
+  * Add additional Mediatek MT7921 WiFi/BT device IDs (LP: #1937004)
+    - SAUCE: Bluetooth: btusb: Add support for Foxconn Mediatek Chip
+
+  * Fix system sleep on TGL systems with Intel ME (LP: #1919321)
+    - SAUCE: PCI: Serialize TGL e1000e PM ops
+
+  * Fix broken e1000e device after S3 (LP: #1897755)
+    - SAUCE: e1000e: Increase polling timeout on MDIC ready bit
+
+  * Fix unusable USB hub on Dell TB16 after S3 (LP: #1855312)
+    - SAUCE: USB: core: Make port power cycle a seperate helper function
+    - SAUCE: USB: core: Attempt power cycle port when it's in eSS.Disabled state
+
+  * Set explicit CC in the headers package (LP: #1999750)
+    - [Packaging] Set explicit CC in the headers package
+
+  * commit cf58599cded35cf4affed1e659c0e2c742d3fda7 seems to be missing in
+    kinetic master to remove "hio" reference from Makefile (LP: #1999556)
+    - SAUCE: remove leftover reference to ubuntu/hio driver
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] kernelconfig: always complete all config checks
+    - [Packaging] annotations: unify same rule across all flavour within the same
+      arch
+    - [Config] annotations: compact annotations file
+    - [Config] disable EFI_ZBOOT
+    - SAUCE: input: i8042: fix section mismatch warning
+    - debian/dkms-versions -- re-enable zfs
+    - [Packaging] old-kernelconfig: update config-check path
+    - [Packaging] update getabis
+    - [Packaging] update Ubuntu.md
+
+  * Miscellaneous upstream changes
+    - Revert "drm/i915/opregion: check port number bounds for SWSCI display power
+      state"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 30 Dec 2022 11:23:16 +0100
+
+linux (6.1.0-10.10) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-10.10 -proposed tracker (LP: #1999569)
+
+  * Soundwire support for the Intel RPL Gen platforms (LP: #1997944)
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C10 product
+    - ASoC: Intel: soc-acpi: add SKU 0C10 SoundWire configuration
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C40 product
+    - ASoC: Intel: soc-acpi: add SKU 0C40 SoundWire configuration
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C4F product
+    - ASoC: rt1318: Add RT1318 SDCA vendor-specific driver
+    - ASoC: intel: sof_sdw: add rt1318 codec support.
+    - ASoC: Intel: sof_sdw: Add support for SKU 0C11 product
+    - ASoC: Intel: soc-acpi: add SKU 0C11 SoundWire configuration
+    - SAUCE: ASoC: Intel: soc-acpi: update codec addr on 0C11/0C4F product
+    - [Config] enable CONFIG_SND_SOC_RT1318_SDW
+
+  * Virtual GPU driver packaging regression (LP: #1996112)
+    - [Packaging] Reintroduce VM DRM drivers into modules
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 13 Dec 2022 22:14:08 +0100
+
+linux (6.1.0-9.9) lunar; urgency=medium
+
+  * Empty entry (ABI bump)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 13 Dec 2022 21:31:08 +0100
+
+linux (6.1.0-3.3) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-3.3 -proposed tracker (LP: #1999534)
+
+  * [DEP-8] Run ADT regression suite for lowlatency kernels Jammy and later
+    (LP: #1999528)
+    - [DEP-8] Fix regression suite to run on lowlatency
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: do not add constraints on toolchain versions
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 13 Dec 2022 16:45:59 +0100
+
+linux (6.1.0-2.2) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-2.2 -proposed tracker (LP: #1999411)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: do not enforce toolchain versions
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Dec 2022 17:05:59 +0100
+
+linux (6.1.0-1.1) lunar; urgency=medium
+
+  * lunar/linux: 6.1.0-1.1 -proposed tracker (LP: #1999373)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] annotations: set and delete configs from command line
+    - [Packaging] migrateconfigs: ignore README.rst if it doesn't exist
+    - [Packaging] migrate-annotations: properly determine arches in derivatives
+    - [Packaging] annotations: allow to set note to config options directly
+    - [Packaging] annotations: assume --query as default command
+    - [Packaging] annotations: allow to query using CONFIG_<option> or <option>
+    - [Packaging] annotations: support flavour inheritance
+    - [Packaging] annotations: properly merge configs with includes
+    - [Packaging] annotations: accept config options with or without CONFIG_
+      prefix
+    - [Packaging] annotations: clarify error message with --import
+    - [Packaging] annotations: properly support multiple levels of inclusion
+    - [Packaging] annotations: catch syntax errors in annotations
+    - [Packaging] kernelconfig: report arch and flavour in config-check log
+    - [Packaging] annotations: prevent generating .pyc files on import
+    - [Packaging] annotations: prevent python broken pipe errors
+    - [Packaging] annotations: allow to specify --write and --note at the same
+      time
+    - [Packaging] annotations: add an option to enable config autocompletion in
+      bash
+    - [Packaging] annotations: introduce --source
+    - [Packaging] annotations: add missing CONFIG_ prefix in main()
+    - [Packaging] Remove obsolete etc/kernelconfig
+    - [Packaging] Rewrite debian/scripts/abi-check in Python
+    - [Packaging] Simplify debian/scripts/module-check
+    - [Packaging] Clean up debian/scripts/module-check
+    - [Packaging] Move checker scripts to debian/scripts/checks
+    - [Packaging] mark phony targets
+    - [Packaging] Make the compiler for fix-filenames explicit
+    - [Packaging] add -rR MAKEFLAGS to clear implicit rules
+    - [Packaging] use dpkg-parsechangelog to get package name and series
+    - [Packaging] simplify revision/release
+    - [Packaging] simplify custom_override
+    - [Packaging] Remove meaningless code in install-arch-headers
+    - [Packaging] use olddefconfig in stamp-prepare-tree
+    - [Packaging] use parralel builds in more places
+    - [Packaging] install headers to debian/linux-libc-dev directly
+    - [Packaging] simplify abinum and uploadnum definitions
+    - [Packaging] Remove unused INSTALL_FW_PATH
+    - [Packaging] Merge install commands
+    - [Config] clean up deprecated notes in annotations
+    - [Packaging] automatically apply changes to annotations and drop
+      importconfigs
+    - [Packaging] kernelconfig: drop listnewconfigs
+    - [Packaging] annotations: do not hijack CONFIGS/* to update annotations
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Dec 2022 10:05:03 +0100
+
+linux (6.1.0-0.0) lunar; urgency=medium
+
+  * Empty entry
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Dec 2022 09:42:01 +0100
+
+linux-unstable (6.1.0-9.9) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-9.9 -proposed tracker (LP: #1998078)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Set ARM64_ERRATUM_2077057=y
+    - SAUCE: add python cached bytecode to .gitignore
+    - [Packaging] config-check: ignore values that are not defined in annotations
+    - [Packaging] config-check: do not strictly enforce CONFIG_CC_VERSION_TEXT
+    - [Packaging] config-check: support annotations format 4
+    - [Packaging] introduce annotations script
+    - [Packaging] add a README.rst to document the new annotations schema
+    - [Packaging] kernelconfig: automatically generate configs from annotations
+    - [Packaging] drop deprecated script tristate.sh
+    - [Packaging] use annotations to generate initial configs check them
+    - [Packaging] simplify kernelconfig
+    - [Packaging] kernelconfig: always keep configs
+    - [Packaging] kernelconfig: provide listnewconfigs
+    - [Packaging] kernelconfig: introduce importconfigs
+    - [Packaging] snap: support new annotations with snapcraft
+    - [Packaging] final-checks: support new annotations
+    - [Packaging] introduce migrate-annotations
+    - [Packaging] re-introduce previous kernelconfig as old-kernelconfig
+    - [Packaging] provide migrateconfigs debian/rules target
+    - [Packaging] correctly propagate errors during updateconfigs
+    - [Packaging] annotations: report failed config checks in alphabetic order
+    - [Config] merge configs into annotations
+    - [Config] udpate annotations after rebase to v6.1-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Nov 2022 11:25:44 +0100
+
+linux-unstable (6.1.0-8.8) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-8.8 -proposed tracker (LP: #1997357)
+
+  *  Fibocom WWAN FM350-GL suspend error (notebook not suspend) (LP: #1990700)
+    - net: wwan: t7xx: Add AP CLDMA
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v6.1-rc6
+    - [Config] update configs following v6.1-rc6 rebase
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs following v6.1-rc6 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 22 Nov 2022 11:56:26 +0100
+
+linux-unstable (6.1.0-7.7) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-7.7 -proposed tracker (LP: #1996731)
+
+  * Miscellaneous Ubuntu changes
+    - ppc64el: remove missing module
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 16 Nov 2022 11:37:05 +0100
+
+linux-unstable (6.1.0-6.6) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-6.6 -proposed tracker (LP: #1996616)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs following v6.1-rc5 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 15 Nov 2022 15:55:33 +0100
+
+linux-unstable (6.1.0-5.5) lunar; urgency=medium
+
+  * lunar/linux-unstable: 6.1.0-5.5 -proposed tracker (LP: #1995875)
+
+  * Please have linux-tools-common Provide: bpftool (LP: #1981089)
+    - [Packaging] let linux-tools-common provides bpftool
+
+  * Miscellaneous Ubuntu changes
+    - packaging: switch to lunar series
+    - Rebase to v6.1-rc4
+    - [Config] toolchian update
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 07 Nov 2022 16:43:21 +0100
+
+linux-unstable (6.1.0-4.4) lunar; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-4.4 -proposed tracker (LP: #1995500)
+
+  * Fix ath11k deadlock on WCN6855 (LP: #1995041)
+    - SAUCE: wifi: ath11k: avoid deadlock during regulatory update in
+      ath11k_regd_update()
+
+  * Bump (kernel) '-mtune' to z16 / arch14 with 23.04 (LP: #1982833)
+    - [Config] Enable mtune z16
+
+  * armhf kernel compiled with gcc-12 fails to boot on pi 3/2 (LP: #1993120)
+    - [Packaging] Support arch-specific compilers in updateconfigs
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs after rebase to 6.1-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 03 Nov 2022 14:00:41 +0100
+
+linux-unstable (6.1.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-3.3 -proposed tracker (LP: #1994037)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Support skipped dkms modules
+    - [Config] update configs after rebase to 6.1-rc2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 24 Oct 2022 15:53:11 +0200
+
+linux-unstable (6.1.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-2.2 -proposed tracker (LP: #1993350)
+
+  * Populating Hyper-V MSR for Ubuntu 13.10 (LP: #1193172)
+    - SAUCE: (no-up) hv: Supply vendor ID and package ABI
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: perf tools: Fix man page build wrt perf-arm-coresight.txt
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 18 Oct 2022 23:02:31 +0200
+
+linux-unstable (6.1.0-1.1) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.1.0-1.1 -proposed tracker (LP: #1993118)
+
+  * Raise CONFIG_NR_CPUS (LP: #1967889)
+    - [Config] Raise riscv64 CONFIG_NR_CPUS to 32
+
+  * rcu_sched detected stalls on CPUs/tasks (LP: #1967130)
+    - [Config] Disable VMAP_STACK on riscv64
+
+  * Disable sv57 as the userspace is not ready (LP: #1991790)
+    - SAUCE: riscv: mm: Force disable sv57
+
+  * earlyconsole prints question marks on 5.19.0-1002-generic (LP: #1988984)
+    - [Config] Set CONFIG_PWM_SIFIVE=m for riscv64
+
+  * RCU stalls (LP: #1991951)
+    - [Config] Harmonize RCU_CPU_STALL_TIMEOUT
+
+  * backport dkms fixes to build modules correctly for hwe-5.19+ kernels with
+    custom compiler (LP: #1991664)
+    - [Packaging] use versioned gcc-12
+    - [Packaging] Update configs with versioned compiler version
+
+  * FTBFS on kinetic (LP: #1990964)
+    - SAUCE: uapi: Fixup strace compile error
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] sameport -- add support for sameport versioning
+    - [Packaging] move to kernel 6.1
+    - SAUCE: platform/x86: dell-uart-backlight: remove
+      acpi_video_set_dmi_backlight_type()
+    - SAUCE: shiftfs: support kernel 6.1
+    - [Config] update configs and annotations after rebase to 6.1-rc1
+    - debian/dkms-versions -- temporarily disable dkms builds
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.1-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 18 Oct 2022 17:21:43 +0200
+
+linux-unstable (6.1.0-0.0) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 17 Oct 2022 08:57:58 +0200
+
+linux-unstable (6.0.0-9.9) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-9.9 -proposed tracker (LP: #1991521)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update toolchain configs after rebase to 6.0
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 03 Oct 2022 15:51:57 +0200
+
+linux-unstable (6.0.0-8.8) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-8.8 -proposed tracker (LP: #1990101)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 20 Sep 2022 10:22:14 +0200
+
+linux-unstable (6.0.0-7.7) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-7.7 -proposed tracker (LP: #1989331)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+    - [Packaging] resync getabis
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Please enable CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU (LP: #1980861)
+    - [Config] Switch from DECOMP_SINGLE to DECOMP_MULTI_PERCPU
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Pass kernel build_arch to dkms
+    - [Packaging[ get rid of unnecessary 'set -x'
+    - [Config] update configs and annotations after rebase to 6.0-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Sep 2022 14:03:55 +0200
+
+linux-unstable (6.0.0-6.6) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-6.6 -proposed tracker (LP: #1988706)
+
+  * Support Intel TDX guest attestation driver (LP: #1988120)
+    - SAUCE: x86/tdx: Add TDX Guest attestation interface driver
+    - SAUCE: selftests: tdx: Test GetReport TDX attestation feature
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable signing for ppc64el and s390x
+    - [Config] enable security-related configs
+    - [Config] update toolchain versions
+    - [Packaging] fix URLs used to retrieve kernel ABI
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 05 Sep 2022 16:59:40 +0200
+
+linux-unstable (6.0.0-5.5) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-5.5 -proposed tracker (LP: #1988019)
+
+  * LSM: Configuring Too Many LSMs Causes Kernel Panic on Boot (LP: #1987998)
+    - SAUCE: LSM: Change Landlock from LSMBLOB_NEEDED to LSMBLOB_NOT_NEEDED
+
+  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
+    - [Config] Align riscv64 CONFIG_LSM with other architectures
+    - [Config] Enable CONFIG_DRM_RCAR_USE_LVDS for riscv64
+    - [Config] Enable CONFIG_DTPM for riscv64
+    - [Config] Set CONFIG_MTD_RAW_NAND=m for riscv64
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging]: always use fully qualified <triplet>-gcc-VER toolchain
+    - [Packaging] use unversioned default gcc
+    - [Packaging] Remove circular dependency between image & modules
+    - [Config] update configs after rebase to 6.0-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 29 Aug 2022 09:18:39 +0200
+
+linux-unstable (6.0.0-4.4) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-4.4 -proposed tracker (LP: #1987517)
+
+  * Fix invalid MAC address after hotplug tbt dock (LP: #1942999)
+    - SAUCE: igc: wait for the MAC copy when enabled MAC passthrough
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] getabis: Add modules.builtin to the ABI
+
+  * Miscellaneous upstream changes
+    - perf tools: Fix compile error for x86
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 24 Aug 2022 15:10:24 +0200
+
+linux-unstable (6.0.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-3.3 -proposed tracker (LP: #1987241)
+
+  * [22.04 FEAT] Deactivitate  CONFIG_QETH_OSX kernel config option
+    (LP: #1959890)
+    - [Config] disable CONFIG_QETH_OSX on s390x
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Make stamp-install-<flavor> target reentrant
+    - [Config] update toolchain version
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 Aug 2022 09:09:26 +0200
+
+linux-unstable (6.0.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-2.2 -proposed tracker (LP: #1986844)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "perf tools: Use Python devtools for version autodetection
+      rather than runtime"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 Aug 2022 19:40:07 +0200
+
+linux-unstable (6.0.0-1.1) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 6.0.0-1.1 -proposed tracker (LP: #1986784)
+
+  * refactoring of overlayfs fix to properly support shiftfs (LP: #1983640)
+    - SAUCE: for aufs mmap: print the virtual file path
+    - SAUCE: overlayfs: fix incorrect mnt_id of files opened from map_files
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move to kernel 6.0
+    - [Config] update configs and annotations after rebase to 6.0-rc1
+    - [Packaging] temporarily disable dkms
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v6.0-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 Aug 2022 16:56:18 +0200
+
+linux-unstable (6.0.0-0.0) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 17 Aug 2022 10:23:42 +0200
+
+linux (5.19.0-15.15) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-15.15 -proposed tracker (LP: #1983335)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations to support both gcc-11 and gcc-12
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 02 Aug 2022 09:23:01 +0200
+
+linux (5.19.0-14.14) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-14.14 -proposed tracker (LP: #1983273)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] module-signature-check: Check debian.<foo>/signature-inclusion
+    - [Packaging] Introduce debian/scripts/sign-module
+    - SAUCE: Switch to using debian/scripts/sign-module
+    - [Config] update configs/annotations after rebase to 5.19
+    - [Config] update configs after moving to gcc-12
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging]: always use fully qualified <triplet>-gcc-VER
+      toolchain"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 01 Aug 2022 17:19:01 +0200
+
+linux (5.19.0-13.13) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-13.13 -proposed tracker (LP: #1983033)
+
+  * network-manager/1.36.4-2ubuntu1 ADT test failure with linux/5.15.0-28.29
+    (LP: #1971418)
+    - Revert "rfkill: make new event layout opt-in"
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Tighten up LP bug links in annotations
+    - [Config] Use mark<ENFORCED> for CONFIG_DEVTMPFS
+    - [Config] Use flag<DEPRECATED> for CONFIG_HIPPI
+    - [Config] Use note<> for CONFIG_XEN_ACPI_PROCESSOR
+    - [Config] Fix DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING annotation
+    - [Config] Fix CONFIG_CPU_LITTLE_ENDIAN annotation
+    - SAUCE: x86/bugs: Do not enable IBPB at firmware entry when IBPB is not
+      available
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 28 Jul 2022 17:04:33 +0200
+
+linux (5.19.0-12.12) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-12.12 -proposed tracker (LP: #1982741)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging]: always use fully qualified <triplet>-gcc-VER toolchain
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 26 Jul 2022 15:07:13 +0200
+
+linux (5.19.0-11.11) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-11.11 -proposed tracker (LP: #1982726)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * GPIO character device v1 API not enabled in kernel (LP: #1953613)
+    - [Config] Enable CONFIG_GPIO_CDEV_V1
+
+  * Use kernel-testing repo from launchpad for ADT tests (LP: #1968016)
+    - [Debian] Use kernel-testing repo from launchpad
+
+  * Support AMD P-State cpufreq control mechanism (LP: #1956509)
+    - [Config] enable X86_AMD_PSTATE as built-in on amd64
+
+  * PCIE LnkCtl ASPM not enabled under VMD mode for Alder Lake platforms
+    (LP: #1942160)
+    - SAUCE: PCI/ASPM: Enable ASPM for links under VMD domain
+    - SAUCE: PCI/ASPM: Enable LTR for endpoints behind VMD
+    - SAUCE: vmd: fixup bridge ASPM by driver name instead
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Double the speed of updateconfigs
+    - Remove ubuntu/hio driver
+    - [Config] update config after rebase to 5.19-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 25 Jul 2022 08:54:21 +0200
+
+linux (5.19.0-10.10) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-10.10 -proposed tracker (LP: #1982013)
+
+  * enable config for fixing 5.17 kernel won't load mok (LP: #1972802)
+    - [Config] enable configs for fixing kernel won't load mok
+
+  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
+    - [Config] Disable CONFIG_CXL_MEM_RAW_COMMANDS on riscv64
+    - [Config] Disable CONFIG_EROFS_FS_ZIP_LZMA on riscv64
+    - [Config] Disable CONFIG_FONT_6x8 on riscv64
+    - [Config] Disable CONFIG_NTFS3_64BIT_CLUSTER on riscv64
+    - [Config] Disable CONFIG_SCSI_IZIP_EPP16 on riscv64
+    - [Config] Disable CONFIG_SCSI_UFS_HWMON on riscv64
+    - [Config] Disable CONFIG_SPI_AX88796C_COMPRESSION on riscv64
+    - [Config] Disable CONFIG_VIDEO_ZORAN on riscv64
+    - [Config] Enable CONFIG_BPF_KPROBE_OVERRIDE on riscv64
+    - [Config] Enable CONFIG_CACHEFILES_ERROR_INJECTION on riscv64
+    - [Config] Enable CONFIG_DRM_AMD_DC_SI on riscv64
+    - [Config] Enable CONFIG_NUMA_BALANCING on riscv64
+    - [Config] Enable CONFIG_PROC_VMCORE_DEVICE_DUMP on riscv64
+    - [Config] Enable CONFIG_WLAN_VENDOR_MICROCHIP on riscv64
+    - [Config] Set CONFIG_MHI_WWAN_CTRL=m on riscv64
+    - [Config] Set CONFIG_NFC_S3FWRN82_UART=m on riscv64
+    - [Config] Enable CONFIG_EFIVAR_FS on riscv64
+    - [Config] Enable CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES on riscv64
+    - [Config] Enable CONFIG_STRICT_DEVMEM on riscv64
+    - [Config] Enable CONFIG_VMAP_STACK on riscv64
+    - [Config] Enable CONFIG_KEXEC_FILE on riscv64
+    - [Config] Set CONFIG_MTD_PSTORE=m on riscv64
+    - [Config] Set CONFIG_KFENCE_SAMPLE_INTERVAL=0 on riscv64
+    - [Config] Enable CONFIG_KEXEC_FILE on s390x
+
+  * Ubuntu 22.04 and 20.04 DPC Fixes for Failure Cases of DownPort Containment
+    events (LP: #1965241)
+    - Enable config option CONFIG_PCIE_EDR
+    - Correct CONFIG_PCIE_EDR annotation on arm64
+
+  * config CONFIG_HISI_PMU for  kunpeng920 (LP: #1956086)
+    - [Config] CONFIG_HISI_PMU=m
+
+  * Skip setting ethernet LED on Dell EMC board (LP: #1971667)
+    - SAUCE: net: phy: marvell: Skip setting LED on Dell EMC board
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] ignore warnings from the output of ld.bfd
+    - [Packaging] Fix bashism in dkms-build script
+    - [Packaging] Always catch errors in dkms-build scripts
+    - [Packaging] Fix dkms builds with linker @module.mod files
+    - [Packaging] mark dkms-build-configure--zfs executable
+    - [Config] update configs and annotations after rebase to 5.19-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 18 Jul 2022 23:45:28 +0200
+
+linux (5.19.0-9.9) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-9.9 -proposed tracker (LP: #1980622)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update config after rebase to 5.19-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Jul 2022 12:05:04 +0200
+
+linux (5.19.0-8.8) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-8.8 -proposed tracker (LP: #1980482)
+
+  * temporarily disable CONFIG_X86_KERNEL_IBT (LP: #1980484)
+    - [Config] temporarily disable CONFIG_X86_KERNEL_IBT
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 01 Jul 2022 11:58:56 +0200
+
+linux (5.19.0-7.7) kinetic; urgency=medium
+
+  * kinetic/linux: 5.19.0-7.7 -proposed tracker (LP: #1980056)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * RISC-V enables CONFIG_COMPAT in the unstable branch (LP: #1980061)
+    - [Config] Disable CONFIG_COMPAT on RISC-V
+
+  * No RISC-V configuration in the unstable tree (LP: #1979647)
+    - [Config] Merge riscv64 config and annotations
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 28 Jun 2022 12:25:48 +0200
+
+linux (5.19.0-6.6) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 28 Jun 2022 07:50:17 +0200
+
+linux-unstable (5.19.0-6.6) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-6.6 -proposed tracker (LP: #1979948)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove 'family=ubuntu' concept
+    - [Packaging] final-checks: Remove useless sourcing of kernelconfig
+    - [Config] update config after rebase to 5.19-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 27 Jun 2022 09:16:40 +0200
+
+linux-unstable (5.19.0-5.5) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-5.5 -proposed tracker (LP: #1979611)
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable signing for ppc64el and
+      s390x"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 23 Jun 2022 11:13:32 +0200
+
+linux-unstable (5.19.0-4.4) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-4.4 -proposed tracker (LP: #1979177)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs after rebase to 5.19-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Jun 2022 09:02:58 +0200
+
+linux-unstable (5.19.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-3.3 -proposed tracker (LP: #1978439)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations for 5.19
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.19-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Jun 2022 07:16:32 +0200
+
+linux-unstable (5.19.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.19.0-2.2 -proposed tracker (LP: #1978313)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Jun 2022 15:17:20 +0200
+
+linux-unstable (5.19.0-1.1) kinetic; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * linux: Staging modules should be unsigned (LP: #1642368)
+    - [Packaging] Move and update signature inclusion list
+    - [Packaging] Strip signatures from untrusted staging modules
+    - [Packaging] Add module-signature-check
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to 5.19-rc1
+    - [Packaging] move to kernel 5.19
+    - [Packaging] workaround missing python3-dev dependency
+    - SAUCE: Revert "perf tools: Use Python devtools for version autodetection
+      rather than runtime"
+    - SAUCE: watchdog: gxp: Add missing MODULE_LICENSE
+    - [Packaging] add python3-dev as build dependency
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 10 Jun 2022 14:43:46 +0200
+
+linux-unstable (5.19.0-0.0) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 09 Jun 2022 12:13:06 +0200
+
+linux (5.18.0-6.6) kinetic; urgency=medium
+
+  * kinetic/linux: 5.18.0-6.6 -proposed tracker (LP: #1976327)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] temporarily disable signing for ppc64el and s390x
+    - [Config] update toolchain versions
+    - [Config] enable CONFIG_X86_KERNEL_IBT
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 31 May 2022 11:05:51 +0200
+
+linux (5.18.0-5.5) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 May 2022 16:59:47 +0200
+
+linux-unstable (5.18.0-5.5) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-5.5 -proposed tracker (LP: #1975458)
+
+  * enable CONFIG_DEVTMPFS_SAFE (LP: #1974442)
+    - [Config] enable CONFIG_DEVTMPFS_SAFE
+
+  * build backport-iwlwifi-dkms as linux-modules-iwlwifi-ABI (LP: #1969434)
+    - [Packaging] drop do_<mod> arch specific configs
+
+  * prevent kernel panic with overlayfs + shiftfs (LP: #1973620)
+    - SAUCE: overlayfs: prevent dereferencing struct file in ovl_vm_prfile_set()
+
+  * linux-image-5.0.0-35-generic breaks checkpointing of container
+    (LP: #1857257) // re-apply missing overlayfs SAUCE patch (LP: #1967924)
+    - SAUCE: overlayfs: fix incorrect mnt_id of files opened from map_files
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 May 2022 11:21:38 +0200
+
+linux-unstable (5.18.0-4.4) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-4.4 -proposed tracker (LP: #1973587)
+
+  * build backport-iwlwifi-dkms as linux-modules-iwlwifi-ABI (LP: #1969434)
+    - [Packaging] support standalone dkms module builds
+
+  * Enable speakup kernel modules to allow the speakup screen reader to function
+    (LP: #1967702)
+    - [Config] CONFIG_SPEAKUP=m for all but s390x
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable v4l2loopback"
+    - Revert "UBUNTU: [Packaging] temporarily disable zfs"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 16 May 2022 14:15:35 +0200
+
+linux-unstable (5.18.0-3.3) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-3.3 -proposed tracker (LP: #1972162)
+
+  * disable Intel DMA remapping by default (LP: #1971699)
+    - Revert "UBUNTU: [Config] enable Intel DMA remapping options by default"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 May 2022 12:15:39 +0200
+
+linux-unstable (5.18.0-2.2) kinetic; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-2.2 -proposed tracker (LP: #1971340)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs after rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 03 May 2022 12:24:49 +0200
+
+linux-unstable (5.18.0-1.1) kinetic; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 03 May 2022 09:38:06 +0200
+
+linux-unstable (5.18.0-1.1) jammy; urgency=medium
+
+  * kinetic/linux-unstable: 5.18.0-1.1 -proposed tracker (LP: #1969476)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to 5.18
+    - [Packaging] temporarily disable zfs
+    - [Packaging] temporarily disable v4l2loopback
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.18-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 27 Apr 2022 20:26:42 +0200
+
+linux-unstable (5.18.0-0.0) jammy; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 19 Apr 2022 16:20:00 +0200
+
+linux-unstable (5.17.0-8.8) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-8.8 -proposed tracker (LP: #1969016)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Apr 2022 10:30:39 +0200
+
+linux-unstable (5.17.0-7.7) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-7.7 -proposed tracker (LP: #1968988)
+
+  * zfcpdump-kernel update to v5.15 (LP: #1965766)
+    - SAUCE: Audit: Fix incorrect static inline function declration.
+
+  * intel_iommu breaks Intel IPU6 camera: isys port open ready failed -16
+    (LP: #1958004)
+    - SAUCE: iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs
+
+  * Jammy update: v5.17.3 upstream stable release (LP: #1968986)
+    - lib/logic_iomem: correct fallback config references
+    - um: fix and optimize xor select template for CONFIG64 and timetravel mode
+    - rtc: wm8350: Handle error for wm8350_register_irq
+    - net: dsa: felix: fix possible NULL pointer dereference
+    - mm: kfence: fix objcgs vector allocation
+    - KVM: x86/pmu: Use different raw event masks for AMD and Intel
+    - KVM: SVM: Fix kvm_cache_regs.h inclusions for is_guest_mode()
+    - KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
+    - KVM: x86/pmu: Fix and isolate TSX-specific performance event logic
+    - KVM: x86/emulator: Emulate RDPID only if it is enabled in guest
+    - drm: Add orientation quirk for GPD Win Max
+    - Bluetooth: hci_sync: Fix compilation warning
+    - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
+    - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
+    - drm/amd/display: Add signal type check when verify stream backends same
+    - drm/amdkfd: enable heavy-weight TLB flush on Arcturus
+    - drm/edid: remove non_desktop quirk for HPN-3515 and LEN-B800.
+    - drm/edid: improve non-desktop quirk logging
+    - Bluetooth: hci_event: Ignore multiple conn complete events
+    - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
+    - drm/amd/display: Fix memory leak
+    - drm/amd/display: Use PSR version selected during set_psr_caps
+    - usb: gadget: tegra-xudc: Do not program SPARAM
+    - usb: gadget: tegra-xudc: Fix control endpoint's definitions
+    - usb: cdnsp: fix cdnsp_decode_trb function to properly handle ret value
+    - ptp: replace snprintf with sysfs_emit
+    - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set
+    - selftests, xsk: Fix bpf_res cleanup test
+    - net/mlx5e: TC, Hold sample_attr on stack instead of pointer
+    - drm/amdkfd: Don't take process mutex for svm ioctls
+    - drm/amdkfd: Ensure mm remain valid in svm deferred_list work
+    - drm/amdkfd: svm range restore work deadlock when process exit
+    - drm/amdgpu: Fix an error message in rmmod
+    - mlxsw: spectrum: Guard against invalid local ports
+    - RDMA/rtrs-clt: Do stop and failover outside reconnect work.
+    - powerpc/xive: Export XIVE IPI information for online-only processors.
+    - powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
+    - ath11k: fix kernel panic during unload/load ath11k modules
+    - ath11k: pci: fix crash on suspend if board file is not found
+    - ath11k: mhi: use mhi_sync_power_up()
+    - net/smc: Send directly when TCP_CORK is cleared
+    - drm/bridge: Add missing pm_runtime_put_sync
+    - bpf: Make dst_port field in struct bpf_sock 16-bit wide
+    - scsi: mvsas: Replace snprintf() with sysfs_emit()
+    - scsi: bfa: Replace snprintf() with sysfs_emit()
+    - drm/v3d: fix missing unlock
+    - power: supply: axp20x_battery: properly report current when discharging
+    - mt76: mt7921: fix crash when startup fails.
+    - mt76: dma: initialize skip_unmap in mt76_dma_rx_fill
+    - i40e: Add sending commands in atomic context
+    - cfg80211: don't add non transmitted BSS to 6GHz scanned channels
+    - libbpf: Fix build issue with llvm-readelf
+    - ipv6: make mc_forwarding atomic
+    - ref_tracker: implement use-after-free detection
+    - net: initialize init_net earlier
+    - powerpc: Set crashkernel offset to mid of RMA region
+    - drm/amdgpu: Fix recursive locking warning
+    - scsi: smartpqi: Fix rmmod stack trace
+    - scsi: smartpqi: Fix kdump issue when controller is locked up
+    - PCI: aardvark: Fix support for MSI interrupts
+    - kvm: selftests: aarch64: fix assert in gicv3_access_reg
+    - kvm: selftests: aarch64: pass vgic_irq guest args as a pointer
+    - kvm: selftests: aarch64: fix the failure check in
+      kvm_set_gsi_routing_irqchip_check
+    - kvm: selftests: aarch64: fix some vgic related comments
+    - kvm: selftests: aarch64: use a tighter assert in vgic_poke_irq()
+    - iommu/arm-smmu-v3: fix event handling soft lockup
+    - usb: ehci: add pci device support for Aspeed platforms
+    - KVM: arm64: Do not change the PMU event filter after a VCPU has run
+    - libbpf: Fix accessing syscall arguments on powerpc
+    - libbpf: Fix accessing the first syscall argument on arm64
+    - libbpf: Fix accessing the first syscall argument on s390
+    - PCI: endpoint: Fix alignment fault error in copy tests
+    - tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH.
+    - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
+    - scsi: mpi3mr: Fix deadlock while canceling the fw event
+    - scsi: mpi3mr: Fix reporting of actual data transfer size
+    - scsi: mpi3mr: Fix memory leaks
+    - powerpc/set_memory: Avoid spinlock recursion in change_page_attr()
+    - power: supply: axp288-charger: Set Vhold to 4.4V
+    - drm/sprd: fix potential NULL dereference
+    - drm/sprd: check the platform_get_resource() return value
+    - drm/amd/display: reset lane settings after each PHY repeater LT
+    - net/mlx5e: Disable TX queues before registering the netdev
+    - HID: apple: Report Magic Keyboard 2021 battery over USB
+    - HID: apple: Report Magic Keyboard 2021 with fingerprint reader battery over
+      USB
+    - usb: dwc3: pci: Set the swnode from inside dwc3_pci_quirks()
+    - iwlwifi: mvm: Correctly set fragmented EBS
+    - iwlwifi: fix small doc mistake for iwl_fw_ini_addr_val
+    - iwlwifi: mvm: move only to an enabled channel
+    - ipv6: annotate some data-races around sk->sk_prot
+    - drm/msm/dsi: Remove spurious IRQF_ONESHOT flag
+    - x86/mce: Work around an erratum on fast string copy instructions
+    - rtw89: fix RCU usage in rtw89_core_txq_push()
+    - ath11k: Fix frames flush failure caused by deadlock
+    - ipv4: Invalidate neighbour for broadcast address upon address addition
+    - rtw88: change rtw_info() to proper message level
+    - dm ioctl: prevent potential spectre v1 gadget
+    - dm: requeue IO if mapping table not yet available
+    - drm/amdkfd: make CRAT table missing message informational only
+    - vfio/pci: Stub vfio_pci_vga_rw when !CONFIG_VFIO_PCI_VGA
+    - scsi: pm8001: Fix pm80xx_pci_mem_copy() interface
+    - scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
+    - scsi: pm8001: Fix tag values handling
+    - scsi: pm8001: Fix task leak in pm8001_send_abort_all()
+    - scsi: pm8001: Fix tag leaks on error
+    - scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req()
+    - mt76: mt7915: fix injected MPDU transmission to not use HW A-MSDU
+    - mctp: make __mctp_dev_get() take a refcount hold
+    - powerpc/64s/hash: Make hash faults work in NMI context
+    - mt76: mt7615: Fix assigning negative values to unsigned variable
+    - power: supply: axp288_charger: Use acpi_quirk_skip_acpi_ac_and_battery()
+    - power: supply: axp288_fuel_gauge: Use acpi_quirk_skip_acpi_ac_and_battery()
+    - scsi: aha152x: Fix aha152x_setup() __setup handler return value
+    - scsi: hisi_sas: Free irq vectors in order for v3 HW
+    - scsi: hisi_sas: Limit users changing debugfs BIST count value
+    - net/smc: correct settings of RMB window update limit
+    - mips: ralink: fix a refcount leak in ill_acc_of_setup()
+    - iavf: stop leaking iavf_status as "errno" values
+    - macvtap: advertise link netns via netlink
+    - platform/x86: thinkpad_acpi: Add dual fan probe
+    - tuntap: add sanity checks about msg_controllen in sendmsg
+    - Bluetooth: mediatek: fix the conflict between mtk and msft vendor event
+    - Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg}
+    - Bluetooth: use memset avoid memory leaks
+    - bnxt_en: Eliminate unintended link toggle during FW reset
+    - PCI: endpoint: Fix misused goto label
+    - MIPS: fix fortify panic when copying asm exception handlers
+    - powerpc/code-patching: Pre-map patch area
+    - powerpc/64e: Tie PPC_BOOK3E_64 to PPC_FSL_BOOK3E
+    - powerpc/secvar: fix refcount leak in format_show()
+    - scsi: libfc: Fix use after free in fc_exch_abts_resp()
+    - platform/x86: x86-android-tablets: Depend on EFI and SPI
+    - can: isotp: set default value for N_As to 50 micro seconds
+    - can: etas_es58x: es58x_fd_rx_event_msg(): initialize rx_event_msg before
+      calling es58x_check_msg_len()
+    - riscv: Fixed misaligned memory access. Fixed pointer comparison.
+    - net: account alternate interface name memory
+    - net: limit altnames to 64k total
+    - net/mlx5e: Remove overzealous validations in netlink EEPROM query
+    - platform/x86: hp-wmi: Fix SW_TABLET_MODE detection method
+    - platform/x86: hp-wmi: Fix 0x05 error code reported by several WMI calls
+    - net: sfp: add 2500base-X quirk for Lantech SFP module
+    - usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
+    - xen/usb: harden xen_hcd against malicious backends
+    - mt76: fix monitor mode crash with sdio driver
+    - xtensa: fix DTC warning unit_address_format
+    - iwlwifi: mei: fix building iwlmei
+    - MIPS: ingenic: correct unit node address
+    - Bluetooth: Fix use after free in hci_send_acl
+    - netfilter: conntrack: revisit gc autotuning
+    - netlabel: fix out-of-bounds memory accesses
+    - ceph: fix inode reference leakage in ceph_get_snapdir()
+    - ceph: fix memory leak in ceph_readdir when note_last_dentry returns error
+    - lib/Kconfig.debug: add ARCH dependency for FUNCTION_ALIGN option
+    - init/main.c: return 1 from handled __setup() functions
+    - minix: fix bug when opening a file with O_DIRECT
+    - clk: si5341: fix reported clk_rate when output divider is 2
+    - clk: mediatek: Fix memory leaks on probe
+    - staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances
+    - staging: vchiq_core: handle NULL result of find_service_by_handle
+    - phy: amlogic: phy-meson-gxl-usb2: fix shared reset controller use
+    - phy: amlogic: meson8b-usb2: Use dev_err_probe()
+    - phy: amlogic: meson8b-usb2: fix shared reset control use
+    - clk: rockchip: drop CLK_SET_RATE_PARENT from dclk_vop* on rk3568
+    - cpufreq: CPPC: Fix performance/frequency conversion
+    - opp: Expose of-node's name in debugfs
+    - staging: wfx: apply the necessary SDIO quirks for the Silabs WF200
+    - staging: wfx: fix an error handling in wfx_init_common()
+    - w1: w1_therm: fixes w1_seq for ds28ea00 sensors
+    - NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify()
+    - NFSv4: Protect the state recovery thread against direct reclaim
+    - habanalabs: fix possible memory leak in MMU DR fini
+    - habanalabs: reject host map with mmu disabled
+    - habanalabs/gaudi: handle axi errors from NIC engines
+    - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32
+    - clk: ti: Preserve node in ti_dt_clocks_register()
+    - clk: Enforce that disjoints limits are invalid
+    - SUNRPC/xprt: async tasks mustn't block waiting for memory
+    - SUNRPC: remove scheduling boost for "SWAPPER" tasks.
+    - NFS: swap IO handling is slightly different for O_DIRECT IO
+    - NFS: swap-out must always use STABLE writes.
+    - x86: Annotate call_on_stack()
+    - x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy
+    - serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
+    - virtio_console: eliminate anonymous module_init & module_exit
+    - jfs: prevent NULL deref in diFree
+    - SUNRPC: Fix socket waits for write buffer space
+    - NFS: nfsiod should not block forever in mempool_alloc()
+    - NFS: Avoid writeback threads getting stuck in mempool_alloc()
+    - selftests: net: Add tls config dependency for tls selftests
+    - parisc: Fix CPU affinity for Lasi, WAX and Dino chips
+    - parisc: Fix patch code locking and flushing
+    - mm: fix race between MADV_FREE reclaim and blkdev direct IO read
+    - drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire()
+    - Drivers: hv: vmbus: Fix initialization of device object in
+      vmbus_device_register()
+    - Drivers: hv: vmbus: Fix potential crash on module unload
+    - netfilter: bitwise: fix reduce comparisons
+    - Revert "NFSv4: Handle the special Linux file open access mode"
+    - NFSv4: fix open failure with O_ACCMODE flag
+    - scsi: core: scsi_logging: Fix a BUG
+    - scsi: sr: Fix typo in CDROM(CLOSETRAY|EJECT) handling
+    - scsi: core: Fix sbitmap depth in scsi_realloc_sdev_budget_map()
+    - scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
+    - vdpa: mlx5: prevent cvq work from hogging CPU
+    - net: sfc: add missing xdp queue reinitialization
+    - net/tls: fix slab-out-of-bounds bug in decrypt_internal
+    - vrf: fix packet sniffing for traffic originating from ip tunnels
+    - skbuff: fix coalescing for page_pool fragment recycling
+    - Revert "net: dsa: stop updating master MTU from master.c"
+    - ice: Clear default forwarding VSI during VSI release
+    - ice: Fix MAC address setting
+    - mctp: Fix check for dev_hard_header() result
+    - mctp: Use output netdev to allocate skb headroom
+    - net: ipv4: fix route with nexthop object delete warning
+    - net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
+    - drm/imx: imx-ldb: Check for null pointer after calling kmemdup
+    - drm/imx: Fix memory leak in imx_pd_connector_get_modes
+    - drm/imx: dw_hdmi-imx: Fix bailout in error cases of probe
+    - regulator: rtq2134: Fix missing active_discharge_on setting
+    - spi: rpc-if: Fix RPM imbalance in probe error path
+    - regulator: atc260x: Fix missing active_discharge_on setting
+    - arch/arm64: Fix topology initialization for core scheduling
+    - bnxt_en: Synchronize tx when xdp redirects happen on same ring
+    - bnxt_en: reserve space inside receive page for skb_shared_info
+    - bnxt_en: Prevent XDP redirect from running when stopping TX queue
+    - sfc: Do not free an empty page_ring
+    - RDMA/mlx5: Don't remove cache MRs when a delay is needed
+    - RDMA/mlx5: Add a missing update of cache->last_add
+    - IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD
+    - cifs: fix potential race with cifsd thread
+    - IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition
+    - sctp: count singleton chunks in assoc user stats
+    - dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe
+    - ice: Set txq_teid to ICE_INVAL_TEID on ring creation
+    - ice: Do not skip not enabled queues in ice_vc_dis_qs_msg
+    - ipv6: Fix stats accounting in ip6_pkt_drop
+    - ice: synchronize_rcu() when terminating rings
+    - ice: xsk: fix VSI state check in ice_xsk_wakeup()
+    - ice: clear cmd_type_offset_bsz for TX rings
+    - net: openvswitch: don't send internal clone attribute to the userspace.
+    - net: ethernet: mv643xx: Fix over zealous checking of_get_mac_address()
+    - net: openvswitch: fix leak of nested actions
+    - rxrpc: fix a race in rxrpc_exit_net()
+    - net: sfc: fix using uninitialized xdp tx_queue
+    - net: phy: mscc-miim: reject clause 45 register accesses
+    - qede: confirm skb is allocated before using
+    - spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op()
+    - drm/amd/display: Fix for dmub outbox notification enable
+    - drm/amd/display: Remove redundant dsc power gating from init_hw
+    - bpf: Support dual-stack sockets in bpf_tcp_check_syncookie
+    - drbd: Fix five use after free bugs in get_initial_state
+    - scsi: sd: sd_read_cpr() requires VPD pages
+    - scsi: ufs: ufshpb: Fix a NULL check on list iterator
+    - io_uring: nospec index for tags on files update
+    - io_uring: don't touch scm_fp_list after queueing skb
+    - SUNRPC: Handle ENOMEM in call_transmit_status()
+    - SUNRPC: Handle low memory situations in call_status()
+    - SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec()
+    - iommu/omap: Fix regression in probe for NULL pointer dereference
+    - perf unwind: Don't show unwind error messages when augmenting frame pointer
+      stack
+    - perf: arm-spe: Fix perf report --mem-mode
+    - perf tools: Fix perf's libperf_print callback
+    - perf session: Remap buf if there is no space for event
+    - arm64: Add part number for Arm Cortex-A78AE
+    - scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove()
+    - scsi: ufs: ufs-pci: Add support for Intel MTL
+    - Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
+    - mmc: block: Check for errors after write on SPI
+    - mmc: mmci: stm32: correctly check all elements of sg list
+    - mmc: renesas_sdhi: special 4tap settings only apply to HS400
+    - mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is
+      complete
+    - mmc: core: Fixup support for writeback-cache for eMMC and SD
+    - lz4: fix LZ4_decompress_safe_partial read out of bound
+    - highmem: fix checks in __kmap_local_sched_{in,out}
+    - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
+    - mm/mempolicy: fix mpol_new leak in shared_policy_replace
+    - io_uring: don't check req->file in io_fsync_prep()
+    - io_uring: defer splice/tee file validity check until command issue
+    - io_uring: implement compat handling for IORING_REGISTER_IOWQ_AFF
+    - io_uring: fix race between timeout flush and removal
+    - x86/pm: Save the MSR validity status at context setup
+    - x86/speculation: Restore speculation related MSRs during S3 resume
+    - perf/x86/intel: Update the FRONTEND MSR mask on Sapphire Rapids
+    - btrfs: fix qgroup reserve overflow the qgroup limit
+    - btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone
+    - btrfs: remove device item and update super block in the same transaction
+    - btrfs: avoid defragging extents whose next extents are not targets
+    - btrfs: prevent subvol with swapfile from being deleted
+    - spi: core: add dma_map_dev for __spi_unmap_msg()
+    - cifs: force new session setup and tcon for dfs
+    - qed: fix ethtool register dump
+    - arm64: patch_text: Fixup last cpu should be master
+    - RDMA/hfi1: Fix use-after-free bug for mm struct
+    - drbd: fix an invalid memory access caused by incorrect use of list iterator
+    - gpio: Restrict usage of GPIO chip irq members before initialization
+    - x86/msi: Fix msi message data shadow struct
+    - x86/mm/tlb: Revert retpoline avoidance approach
+    - perf/x86/intel: Don't extend the pseudo-encoding to GP counters
+    - ata: sata_dwc_460ex: Fix crash due to OOB write
+    - perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
+    - perf/core: Inherit event_caps
+    - irqchip/gic-v3: Fix GICR_CTLR.RWP polling
+    - fbdev: Fix unregistering of framebuffers without device
+    - amd/display: set backlight only if required
+    - drm/panel: ili9341: fix optional regulator handling
+    - drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw
+    - drm/amdgpu/display: change pipe policy for DCN 2.1
+    - drm/amdgpu/smu10: fix SoC/fclk units in auto mode
+    - drm/amdgpu/vcn: Fix the register setting for vcn1
+    - drm/nouveau/pmu: Add missing callbacks for Tegra devices
+    - drm/amdkfd: Create file descriptor after client is added to smi_clients list
+    - drm/amdgpu: don't use BACO for reset in S3
+    - SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
+    - Revert "ACPI: processor: idle: Only flush cache on entering C3"
+    - drm/amdkfd: Fix variable set but not used warning
+    - net/smc: send directly on setting TCP_NODELAY
+    - Revert "selftests: net: Add tls config dependency for tls selftests"
+    - bpf: Make remote_port field in struct bpf_sk_lookup 16-bit wide
+    - selftests/bpf: Fix u8 narrow load checks for bpf_sk_lookup remote_port
+    - bpf: Treat bpf_sk_lookup remote_port as a 2-byte field
+    - perf build: Don't use -ffat-lto-objects in the python feature test when
+      building with clang-13
+    - perf python: Fix probing for some clang command line options
+    - tools build: Filter out options and warnings not supported by clang
+    - tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
+    - dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
+    - KVM: avoid NULL pointer dereference in kvm_dirty_ring_push
+    - Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb()
+    - powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit
+    - Revert "powerpc: Set max_mapnr correctly"
+    - x86/bug: Prevent shadowing in __WARN_FLAGS
+    - objtool: Fix SLS validation for kcov tail-call replacement
+    - sched/core: Fix forceidle balancing
+    - sched: Teach the forced-newidle balancer about CPU affinity limitation.
+    - x86,static_call: Fix __static_call_return0 for i386
+    - x86/extable: Prefer local labels in .set directives
+    - irqchip/gic-v4: Wait for GICR_VPENDBASER.Dirty to clear before descheduling
+    - powerpc/64: Fix build failure with allyesconfig in book3s_64_entry.S
+    - irqchip/gic, gic-v3: Prevent GSI to SGI translations
+    - mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
+    - static_call: Don't make __static_call_return0 static
+    - io_uring: move read/write file prep state into actual opcode handler
+    - io_uring: propagate issue_flags state down to file assignment
+    - io_uring: defer file assignment
+    - io_uring: drop the old style inflight file tracking
+    - Linux 5.17.3
+
+  * Jammy update: v5.17.2 upstream stable release Edit (LP: #1968984)
+    - Revert "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
+    - USB: serial: pl2303: add IBM device IDs
+    - dt-bindings: usb: hcd: correct usb-device path
+    - USB: serial: pl2303: fix GS type detection
+    - USB: serial: simple: add Nokia phone driver
+    - mm: kfence: fix missing objcg housekeeping for SLAB
+    - locking/lockdep: Avoid potential access of invalid memory in lock_class
+    - drm/amdgpu: move PX checking into amdgpu_device_ip_early_init
+    - drm/amdgpu: only check for _PR3 on dGPUs
+    - iommu/iova: Improve 32-bit free space estimate
+    - block: flush plug based on hardware and software queue order
+    - block: ensure plug merging checks the correct queue at least once
+    - usb: typec: tipd: Forward plug orientation to typec subsystem
+    - USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
+    - xhci: fix garbage USBSTS being logged in some cases
+    - xhci: fix runtime PM imbalance in USB2 resume
+    - xhci: make xhci_handshake timeout for xhci_reset() adjustable
+    - xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx()
+    - mei: me: disable driver on the ign firmware
+    - mei: me: add Alder Lake N device id.
+    - mei: avoid iterator usage outside of list_for_each_entry
+    - bus: mhi: pci_generic: Add mru_default for Quectel EM1xx series
+    - bus: mhi: Fix pm_state conversion to string
+    - bus: mhi: Fix MHI DMA structure endianness
+    - docs: sphinx/requirements: Limit jinja2<3.1
+    - coresight: Fix TRCCONFIGR.QE sysfs interface
+    - coresight: syscfg: Fix memleak on registration failure in
+      cscfg_create_device
+    - dt-bindings: iio: adc: zynqmp_ams: Add clock entry
+    - iio: adc: xilinx-ams: Fix single channel switching sequence
+    - iio: accel: mma8452: use the correct logic to get mma8452_data
+    - iio: adc: aspeed: Add divider flag to fix incorrect voltage reading.
+    - iio: imu: st_lsm6dsx: use dev_to_iio_dev() to get iio_dev struct
+    - iio: afe: rescale: use s64 for temporary scale calculations
+    - iio: adc: xilinx-ams: Fixed missing PS channels
+    - iio: adc: xilinx-ams: Fixed wrong sequencer register settings
+    - iio: inkern: apply consumer scale on IIO_VAL_INT cases
+    - iio: inkern: apply consumer scale when no channel scale is available
+    - iio: inkern: make a best effort on offset calculation
+    - greybus: svc: fix an error handling bug in gb_svc_hello()
+    - clk: rockchip: re-add rational best approximation algorithm to the
+      fractional divider
+    - clk: uniphier: Fix fixed-rate initialization
+    - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
+    - cifs: truncate the inode and mapping when we simulate fcollapse
+    - cifs: fix handlecache and multiuser
+    - cifs: we do not need a spinlock around the tree access during umount
+    - KEYS: fix length validation in keyctl_pkey_params_get_2()
+    - KEYS: asymmetric: enforce that sig algo matches key algo
+    - KEYS: asymmetric: properly validate hash_algo and encoding
+    - Documentation: add link to stable release candidate tree
+    - Documentation: update stable tree link
+    - firmware: stratix10-svc: add missing callback parameter on RSU
+    - firmware: sysfb: fix platform-device leak in error path
+    - HID: intel-ish-hid: Use dma_alloc_coherent for firmware update
+    - SUNRPC: avoid race between mod_timer() and del_timer_sync()
+    - SUNRPC: Do not dereference non-socket transports in sysfs
+    - NFS: NFSv2/v3 clients should never be setting NFS_CAP_XATTR
+    - NFSD: prevent underflow in nfssvc_decode_writeargs()
+    - NFSD: prevent integer overflow on 32 bit systems
+    - f2fs: fix to unlock page correctly in error path of is_alive()
+    - f2fs: quota: fix loop condition at f2fs_quota_sync()
+    - f2fs: fix to do sanity check on .cp_pack_total_block_count
+    - remoteproc: Fix count check in rproc_coredump_write()
+    - mm/mlock: fix two bugs in user_shm_lock()
+    - pinctrl: ingenic: Fix regmap on X series SoCs
+    - pinctrl: samsung: drop pin banks references on error paths
+    - net: bnxt_ptp: fix compilation error
+    - spi: mxic: Fix the transmit path
+    - mtd: spi-nor: Skip erase logic when SPI_NOR_NO_ERASE is set
+    - mtd: rawnand: protect access to rawnand devices while in suspend
+    - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
+    - can: m_can: m_can_tx_handler(): fix use after free of skb
+    - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error
+      path
+    - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
+    - jffs2: fix memory leak in jffs2_do_mount_fs
+    - jffs2: fix memory leak in jffs2_scan_medium
+    - mm: fs: fix lru_cache_disabled race in bh_lru
+    - mm: don't skip swap entry even if zap_details specified
+    - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
+    - mm: invalidate hwpoison page cache page in fault path
+    - mempolicy: mbind_range() set_policy() after vma_merge()
+    - scsi: core: sd: Add silence_suspend flag to suppress some PM messages
+    - scsi: ufs: Fix runtime PM messages never-ending cycle
+    - scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters
+    - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
+    - qed: display VF trust config
+    - qed: validate and restrict untrusted VFs vlan promisc mode
+    - riscv: dts: canaan: Fix SPI3 bus width
+    - riscv: Fix fill_callchain return value
+    - riscv: Increase stack size under KASAN
+    - RISC-V: Declare per cpu boot data as static
+    - Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
+    - cifs: do not skip link targets when an I/O fails
+    - cifs: fix incorrect use of list iterator after the loop
+    - cifs: prevent bad output lengths in smb2_ioctl_query_info()
+    - cifs: fix NULL ptr dereference in smb2_ioctl_query_info()
+    - ALSA: cs4236: fix an incorrect NULL check on list iterator
+    - ALSA: hda: Avoid unsol event during RPM suspending
+    - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
+    - ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020
+    - rtc: mc146818-lib: fix locking in mc146818_set_time
+    - rtc: pl031: fix rtc features null pointer dereference
+    - io_uring: ensure that fsnotify is always called
+    - ocfs2: fix crash when mount with quota enabled
+    - drm/simpledrm: Add "panel orientation" property on non-upright mounted LCD
+      panels
+    - mm: madvise: skip unmapped vma holes passed to process_madvise
+    - mm: madvise: return correct bytes advised with process_madvise
+    - Revert "mm: madvise: skip unmapped vma holes passed to process_madvise"
+    - mm,hwpoison: unmap poisoned page before invalidation
+    - mm: only re-generate demotion targets when a numa node changes its N_CPU
+      state
+    - mm/kmemleak: reset tag when compare object pointer
+    - dm stats: fix too short end duration_ns when using precise_timestamps
+    - dm: fix use-after-free in dm_cleanup_zoned_dev()
+    - dm: interlock pending dm_io and dm_wait_for_bios_completion
+    - dm: fix double accounting of flush with data
+    - dm integrity: set journal entry unused when shrinking device
+    - tracing: Have trace event string test handle zero length strings
+    - drbd: fix potential silent data corruption
+    - can: isotp: sanitize CAN ID checks in isotp_bind()
+    - PCI: fu740: Force 2.5GT/s for initial device probe
+    - arm64: signal: nofpsimd: Do not allocate fp/simd context when not available
+    - arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory
+      zones
+    - arm64: dts: qcom: sm8250: Fix MSI IRQ for PCIe1 and PCIe2
+    - arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-am64: Fix gic-v3 compatible regs
+    - arm64: dts: ti: k3-j721s2: Fix gic-v3 compatible regs
+    - ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
+    - mmc: core: use sysfs_emit() instead of sprintf()
+    - Revert "ACPI: Pass the same capabilities to the _OSC regardless of the query
+      flag"
+    - ACPI: properties: Consistently return -ENOENT if there are no more
+      references
+    - coredump: Also dump first pages of non-executable ELF libraries
+    - ext4: fix ext4_fc_stats trace point
+    - ext4: fix fs corruption when tring to remove a non-empty directory with IO
+      error
+    - ext4: make mb_optimize_scan option work with set/unset mount cmd
+    - ext4: make mb_optimize_scan performance mount option work with extents
+    - samples/landlock: Fix path_list memory leak
+    - landlock: Use square brackets around "landlock-ruleset"
+    - mailbox: tegra-hsp: Flush whole channel
+    - btrfs: zoned: put block group after final usage
+    - block: fix rq-qos breakage from skipping rq_qos_done_bio()
+    - block: limit request dispatch loop duration
+    - block: don't merge across cgroup boundaries if blkcg is enabled
+    - drm/edid: check basic audio support on CEA extension block
+    - fbdev: Hot-unplug firmware fb devices on forced removal
+    - video: fbdev: sm712fb: Fix crash in smtcfb_read()
+    - video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
+    - rfkill: make new event layout opt-in
+    - ARM: dts: at91: sama7g5: Remove unused properties in i2c nodes
+    - ARM: dts: at91: sama5d2: Fix PMERRLOC resource size
+    - ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
+    - ARM: dts: exynos: add missing HDMI supplies on SMDK5250
+    - ARM: dts: exynos: add missing HDMI supplies on SMDK5420
+    - mgag200 fix memmapsl configuration in GCTL6 register
+    - carl9170: fix missing bit-wise or operator for tx_params
+    - pstore: Don't use semaphores in always-atomic-context code
+    - thermal: int340x: Increase bitmap size
+    - lib/raid6/test: fix multiple definition linking error
+    - exec: Force single empty string when argv is empty
+    - crypto: rsa-pkcs1pad - only allow with rsa
+    - crypto: rsa-pkcs1pad - correctly get hash from source scatterlist
+    - crypto: rsa-pkcs1pad - restore signature length check
+    - crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete()
+    - bcache: fixup multiple threads crash
+    - PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove()
+    - DEC: Limit PMAX memory probing to R3k systems
+    - media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC
+    - media: omap3isp: Use struct_group() for memcpy() region
+    - media: venus: vdec: fixed possible memory leak issue
+    - media: venus: hfi_cmds: List HDR10 property as unsupported for v1 and v3
+    - media: venus: venc: Fix h264 8x8 transform control
+    - media: davinci: vpif: fix unbalanced runtime PM get
+    - media: davinci: vpif: fix unbalanced runtime PM enable
+    - media: davinci: vpif: fix use-after-free on driver unbind
+    - mips: Always permit to build u-boot images
+    - btrfs: zoned: mark relocation as writing
+    - btrfs: extend locking to all space_info members accesses
+    - btrfs: verify the tranisd of the to-be-written dirty extent buffer
+    - xtensa: define update_mmu_tlb function
+    - xtensa: fix stop_machine_cpuslocked call in patch_text
+    - xtensa: fix xtensa_wsr always writing 0
+    - KVM: s390x: fix SCK locking
+    - drm/syncobj: flatten dma_fence_chains on transfer
+    - drm/nouveau/backlight: Fix LVDS backlight detection on some laptops
+    - drm/nouveau/backlight: Just set all backlight types as RAW
+    - drm/fb-helper: Mark screen buffers in system memory with FBINFO_VIRTFB
+    - brcmfmac: firmware: Allocate space for default boardrev in nvram
+    - brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path
+    - brcmfmac: pcie: Declare missing firmware files in pcie.c
+    - brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
+    - brcmfmac: pcie: Fix crashes due to early IRQs
+    - drm/i915/opregion: check port number bounds for SWSCI display power state
+    - drm/i915/gem: add missing boundary check in vm_access
+    - PCI: imx6: Allow to probe when dw_pcie_wait_for_link() fails
+    - PCI: pciehp: Clear cmd_busy bit in polling mode
+    - PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup"
+    - PCI: xgene: Revert "PCI: xgene: Fix IB window setup"
+    - regulator: qcom_smd: fix for_each_child.cocci warnings
+    - selinux: access superblock_security_struct in LSM blob way
+    - selinux: check return value of sel_make_avc_files
+    - crypto: ccp - Ensure psp_ret is always init'd in
+      __sev_platform_init_locked()
+    - crypto: qat - fix a signedness bug in get_service_enabled()
+    - hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER
+    - crypto: sun8i-ss - really disable hash on A80
+    - crypto: kdf - Select hmac in addition to sha256
+    - crypto: qat - fix access to PFVF interrupt registers for GEN4
+    - crypto: authenc - Fix sleep in atomic context in decrypt_tail
+    - crypto: octeontx2 - select CONFIG_NET_DEVLINK
+    - crypto: mxs-dcp - Fix scatterlist processing
+    - selinux: Fix selinux_sb_mnt_opts_compat()
+    - thermal: int340x: Check for NULL after calling kmemdup()
+    - crypto: octeontx2 - remove CONFIG_DM_CRYPT check
+    - spi: tegra114: Add missing IRQ check in tegra_spi_probe
+    - spi: tegra210-quad: Fix missin IRQ check in tegra_qspi_probe
+    - perf: MARVELL_CN10K_TAD_PMU should depend on ARCH_THUNDER
+    - selftests/sgx: Fix NULL-pointer-dereference upon early test failure
+    - selftests/sgx: Do not attempt enclave build without valid enclave
+    - selftests/sgx: Ensure enclave data available during debug print
+    - stack: Constrain and fix stack offset randomization with Clang builds
+    - arm64/mm: avoid fixmap race condition when create pud mapping
+    - security: add sctp_assoc_established hook
+    - blk-cgroup: set blkg iostat after percpu stat aggregation
+    - selftests/x86: Add validity check and allow field splitting
+    - selftests/sgx: Treat CC as one argument
+    - crypto: rockchip - ECB does not need IV
+    - block: update io_ticks when io hang
+    - audit: log AUDIT_TIME_* records only from rules
+    - EVM: fix the evm= __setup handler return value
+    - crypto: ccree - don't attempt 0 len DMA mappings
+    - crypto: hisilicon/sec - fix the aead software fallback for engine
+    - spi: pxa2xx-pci: Balance reference count for PCI DMA device
+    - hwmon: (pmbus) Add mutex to regulator ops
+    - hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
+    - nvme: cleanup __nvme_check_ids
+    - nvme: fix the check for duplicate unique identifiers
+    - block: don't delete queue kobject before its children
+    - PM: hibernate: fix __setup handler error handling
+    - PM: suspend: fix return value of __setup handler
+    - spi: spi-zynqmp-gqspi: Handle error for dma_set_mask
+    - hwrng: atmel - disable trng on failure path
+    - crypto: sun8i-ss - call finalize with bh disabled
+    - crypto: sun8i-ce - call finalize with bh disabled
+    - crypto: amlogic - call finalize with bh disabled
+    - crypto: gemini - call finalize with bh disabled
+    - crypto: vmx - add missing dependencies
+    - clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix
+    - clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts
+    - clocksource/drivers/timer-microchip-pit64b: Use notrace
+    - clocksource/drivers/timer-of: Check return value of of_iomap in
+      timer_of_base_init()
+    - arm64: prevent instrumentation of bp hardening callbacks
+    - perf/arm-cmn: Hide XP PUB events for CMN-600
+    - perf/arm-cmn: Update watchpoint format
+    - KEYS: trusted: Fix trusted key backends when building as module
+    - KEYS: trusted: Avoid calling null function trusted_key_exit
+    - ACPI: APEI: fix return value of __setup handlers
+    - crypto: ccp - ccp_dmaengine_unregister release dma channels
+    - crypto: ccree - Fix use after free in cc_cipher_exit()
+    - crypto: qat - fix initialization of pfvf cap_msg structures
+    - crypto: qat - fix initialization of pfvf rts_map_msg structures
+    - hwrng: nomadik - Change clk_disable to clk_disable_unprepare
+    - hwmon: (pmbus) Add Vin unit off handling
+    - clocksource: acpi_pm: fix return value of __setup handler
+    - io_uring: don't check unrelated req->open.how in accept request
+    - io_uring: terminate manual loop iterator loop correctly for non-vecs
+    - watch_queue: Fix NULL dereference in error cleanup
+    - watch_queue: Actually free the watch
+    - f2fs: fix to enable ATGC correctly via gc_idle sysfs interface
+    - sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
+    - sched/core: Export pelt_thermal_tp
+    - sched/sugov: Ignore 'busy' filter when rq is capped by uclamp_max
+    - sched/uclamp: Fix iowait boost escaping uclamp restriction
+    - rseq: Remove broken uapi field layout on 32-bit little endian
+    - perf/core: Fix address filter parser for multiple filters
+    - perf/x86/intel/pt: Fix address filter config for 32-bit kernel
+    - sched/fair: Improve consistency of allowed NUMA balance calculations
+    - f2fs: fix missing free nid in f2fs_handle_failed_inode
+    - ext4: fix remount with 'abort' option
+    - nfsd: more robust allocation failure handling in nfsd_file_cache_init
+    - sched/cpuacct: Fix charge percpu cpuusage
+    - sched/rt: Plug rt_mutex_setprio() vs push_rt_task() race
+    - f2fs: fix to avoid potential deadlock
+    - btrfs: fix unexpected error path when reflinking an inline extent
+    - iomap: Fix iomap_invalidatepage tracepoint
+    - fs: erofs: add sanity check for kobject in erofs_unregister_sysfs
+    - f2fs: fix compressed file start atomic write may cause data corruption
+    - cifs: use a different reconnect helper for non-cifsd threads
+    - selftests, x86: fix how check_cc.sh is being invoked
+    - drivers/base/memory: add memory block to memory group after registration
+      succeeded
+    - kunit: make kunit_test_timeout compatible with comment
+    - pinctrl: samsung: Remove EINT handler for Exynos850 ALIVE and CMGP gpios
+    - media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size
+    - media: camss: csid-170: fix non-10bit formats
+    - media: camss: csid-170: don't enable unused irqs
+    - media: camss: csid-170: set the right HALT_CMD when disabled
+    - media: camss: vfe-170: fix "VFE halt timeout" error
+    - media: staging: media: imx: imx7-mipi-csis: Make subdev name unique
+    - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
+    - media: mtk-vcodec: potential dereference of null pointer
+    - media: imx: imx8mq-mipi-csi2: remove wrong irq config write operation
+    - media: imx: imx8mq-mipi_csi2: fix system resume
+    - media: bttv: fix WARNING regression on tunerless devices
+    - media: atmel: atmel-sama7g5-isc: fix ispck leftover
+    - ASoC: sh: rz-ssi: Drop calling rz_ssi_pio_recv() recursively
+    - ASoC: codecs: Check for error pointer after calling devm_regmap_init_mmio
+    - ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting
+    - ASoC: simple-card-utils: Set sysclk on all components
+    - memory: tegra20-emc: Correct memory device mask
+    - media: coda: Fix missing put_device() call in coda_get_vdoa_data
+    - media: meson: vdec: potential dereference of null pointer
+    - media: hantro: Fix overfill bottom register field name
+    - media: ov6650: Fix set format try processing path
+    - media: v4l: Avoid unaligned access warnings when printing 4cc modifiers
+    - media: ov5648: Don't pack controls struct
+    - media: ov2740: identify module after subdev initialisation
+    - media: aspeed: Correct value for h-total-pixels
+    - video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to
+      avoid black screen
+    - video: fbdev: controlfb: Fix COMPILE_TEST build
+    - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
+    - video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe()
+    - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
+    - ARM: dts: Fix OpenBMC flash layout label addresses
+    - ASoC: max98927: add missing header file
+    - arm64: dts: qcom: sc7280: Fix gmu unit address
+    - firmware: qcom: scm: Remove reassignment to desc following initializer
+    - ARM: dts: qcom: ipq4019: fix sleep clock
+    - soc: qcom: rpmpd: Check for null return of devm_kcalloc
+    - soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem
+    - soc: qcom: aoss: Fix missing put_device call in qmp_get
+    - soc: qcom: aoss: remove spurious IRQF_ONESHOT flags
+    - arm64: dts: qcom: sdm845: fix microphone bias properties and values
+    - arm64: dts: qcom: sm8250: fix PCIe bindings to follow schema
+    - arm64: dts: qcom: msm8916-j5: Fix typo
+    - arm64: dts: broadcom: bcm4908: use proper TWD binding
+    - arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc
+    - arm64: dts: qcom: sm8350: Correct TCS configuration for apps rsc
+    - arm64: dts: qcom: sm8450: Update cpuidle states parameters
+    - arm64: dts: qcom: msm8994: Provide missing "xo_board" and "sleep_clk" to GCC
+    - arm64: dts: qcom: ipq6018: fix usb reference period
+    - firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not
+      defined
+    - soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
+    - cpuidle: qcom-spm: Check if any CPU is managed by SPM
+    - ARM: dts: sun8i: v3s: Move the csi1 block to follow address order
+    - ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
+    - vsprintf: Fix potential unaligned access
+    - ARM: dts: qcom: sdx55: Fix the address used for PCIe EP local addr space
+    - ARM: dts: imx: Add missing LVDS decoder on M53Menlo
+    - media: mexon-ge2d: fixup frames size in registers
+    - media: video/hdmi: handle short reads of hdmi info frame.
+    - media: ti-vpe: cal: Fix a NULL pointer dereference in
+      cal_ctx_v4l2_init_formats()
+    - media: em28xx: initialize refcount before kref_get
+    - media: uapi: Init VP9 stateless decode params
+    - media: usb: go7007: s2250-board: fix leak in probe()
+    - media: cedrus: H265: Fix neighbour info buffer size
+    - media: cedrus: h264: Fix neighbour info buffer size
+    - arm64: dts: ti: k3-j721s2-mcu-wakeup: Fix the interrupt-parent for
+      wkup_gpioX instances
+    - ASoC: codecs: rx-macro: fix accessing compander for aux
+    - ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type
+    - ASoC: codecs: va-macro: fix accessing array out of bounds for enum type
+    - ASoC: codecs: wc938x: fix accessing array out of bounds for enum type
+    - ASoC: codecs: wcd938x: fix kcontrol max values
+    - ASoC: codecs: wcd934x: fix kcontrol max values
+    - ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put
+    - media: v4l2-core: Initialize h264 scaling matrix
+    - media: hantro: sunxi: Fix VP9 steps
+    - media: ov5640: Fix set format, v4l2_mbus_pixelcode not updated
+    - selftests: vm: remove dependecy from internal kernel macros
+    - selftests/lkdtm: Add UBSAN config
+    - vsprintf: Fix %pK with kptr_restrict == 0
+    - uaccess: fix nios2 and microblaze get_user_8()
+    - ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp()
+    - ASoC: acp: check the return value of devm_kzalloc() in
+      acp_legacy_dai_links_create()
+    - soc: mediatek: pm-domains: Add wakeup capacity support in power domain
+    - mmc: sdhci_am654: Fix the driver data of AM64 SoC
+    - ASoC: ti: davinci-i2s: Add check for clk_enable()
+    - ALSA: spi: Add check for clk_enable()
+    - arm64: dts: ns2: Fix spi-cpol and spi-cpha property
+    - arm64: dts: broadcom: Fix sata nodename
+    - printk: fix return value of printk.devkmsg __setup handler
+    - ASoC: mxs-saif: Handle errors for clk_enable
+    - ASoC: atmel_ssc_dai: Handle errors for clk_enable
+    - ASoC: dwc-i2s: Handle errors for clk_enable
+    - ASoC: soc-compress: prevent the potentially use of null pointer
+    - media: i2c: Fix pixel array positions in ov8865
+    - memory: emif: Add check for setup_interrupts
+    - memory: emif: check the pointer temp in get_device_details()
+    - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
+    - arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly
+    - m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined
+    - media: stk1160: If start stream fails, return buffers with
+      VB2_BUF_STATE_QUEUED
+    - media: vidtv: Check for null return of vzalloc
+    - ASoC: cs35l41: Fix GPIO2 configuration
+    - ASoC: cs35l41: Fix max number of TX channels
+    - ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
+    - ASoC: wm8350: Handle error for wm8350_register_irq
+    - ASoC: fsi: Add check for clk_enable
+    - video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
+    - media: saa7134: fix incorrect use to determine if list is empty
+    - ivtv: fix incorrect device_caps for ivtvfb
+    - ASoC: atmel: Fix error handling in snd_proto_probe
+    - ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in
+      rockchip_i2s_probe
+    - ASoC: SOF: Add missing of_node_put() in imx8m_probe
+    - ASoC: mediatek: mt8192-mt6359: Fix error handling in mt8192_mt6359_dev_probe
+    - ASoC: rk817: Fix missing clk_disable_unprepare() in rk817_platform_probe
+    - ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
+    - ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
+    - ASoC: fsl_spdif: Disable TX clock when stop
+    - ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
+    - ASoC: SOF: Intel: enable DMI L1 for playback streams
+    - ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in
+      msm8916_wcd_digital_probe
+    - mmc: davinci_mmc: Handle error for clk_enable
+    - rtla/osnoise: Fix osnoise hist stop tracing message
+    - ASoC: rockchip: Fix PM usage reference of rockchip_i2s_tdm_resume
+    - ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe
+    - ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe
+    - ASoC: mediatek: mt8195: Fix error handling in
+      mt8195_mt6359_rt1019_rt5682_dev_probe
+    - ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data
+    - ASoC: amd: Fix reference to PCM buffer address
+    - ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS
+    - ARM: configs: multi_v5_defconfig: re-enable DRM_PANEL and FB_xxx
+    - drm/bridge: sn65dsi83: Fix an error handling path in sn65dsi83_probe()
+    - drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops
+    - drm/meson: Fix error handling when afbcd.ops->init fails
+    - drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
+    - drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe
+    - drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe
+    - drm: bridge: adv7511: Fix ADV7535 HPD enablement
+    - ath11k: add missing of_node_put() to avoid leak
+    - ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
+    - drm/v3d/v3d_drv: Check for error num after setting mask
+    - Bluetooth: hci_sync: unlock on error in hci_inquiry_result_with_rssi_evt()
+    - ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855
+    - drm/panfrost: Check for error num after setting mask
+    - bpftool: Fix error check when calling hashmap__new()
+    - libbpf: Fix possible NULL pointer dereference when destroying skeleton
+    - bpftool: Only set obj->skeleton on complete success
+    - ath11k: fix error code in ath11k_qmi_assign_target_mem_chunk()
+    - udmabuf: validate ubuf->pagecount
+    - bpf: Fix UAF due to race between btf_try_get_module and load_module
+    - drm/selftests/test-drm_dp_mst_helper: Fix memory leak in
+      sideband_msg_req_encode_decode
+    - drm/locking: fix drm_modeset_acquire_ctx kernel-doc
+    - selftests: bpf: Fix bind on used port
+    - Bluetooth: btintel: Fix WBS setting for Intel legacy ROM products
+    - Bluetooth: hci_serdev: call init_rwsem() before p->open()
+    - Bluetooth: mt7921s: fix firmware coredump retrieve
+    - Bluetooth: mt7921s: fix bus hang with wrong privilege
+    - Bluetooth: btmtksdio: refactor btmtksdio_runtime_[suspend|resume]()
+    - Bluetooth: mt7921s: fix btmtksdio_[drv|fw]_pmctrl()
+    - Bluetooth: btmtksdio: mask out interrupt status
+    - mtd: onenand: Check for error irq
+    - mtd: rawnand: gpmi: fix controller timings setting
+    - selftests, xsk: Fix rx_full stats test
+    - drm/edid: Don't clear formats if using deep color
+    - drm/edid: Split deep color modes between RGB and YUV444
+    - ionic: fix type complaint in ionic_dev_cmd_clean()
+    - ionic: start watchdog after all is setup
+    - ionic: Don't send reset commands if FW isn't running
+    - ionic: fix up printing of timeout error
+    - ionic: Correctly print AQ errors if completions aren't received
+    - net: dsa: Move VLAN filtering syncing out of dsa_switch_bridge_leave
+    - net: dsa: Avoid cross-chip syncing of VLAN filtering
+    - Bluetooth: hci_event: Fix HCI_EV_VENDOR max_len
+    - drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl()
+    - drm/amd/display: Call dc_stream_release for remove link enc assignment
+    - drm/amd/display: Fix a NULL pointer dereference in
+      amdgpu_dm_connector_add_common_modes()
+    - drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function
+    - net: phy: at803x: move page selection fix to config_init
+    - selftests/bpf/test_xdp_redirect_multi: use temp netns for testing
+    - ath9k_htc: fix uninit value bugs
+    - ath11k: set WMI_PEER_40MHZ while peer assoc for 6 GHz
+    - RDMA/core: Set MR type in ib_reg_user_mr
+    - KVM: PPC: Fix vmx/vsx mixup in mmio emulation
+    - selftests/net: timestamping: Fix bind_phc check
+    - rtw88: check for validity before using a pointer
+    - rtw88: fix idle mode flow for hw scan
+    - rtw88: fix memory overrun and memory leak during hw_scan
+    - drm/bridge: lt9611: Fix an error handling path in lt9611_probe()
+    - i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - i40e: respect metadata on XSK Rx to skb
+    - ice: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - ice: respect metadata on XSK Rx to skb
+    - igc: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - ixgbe: pass bi->xdp to ixgbe_construct_skb_zc() directly
+    - ixgbe: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+    - ixgbe: respect metadata on XSK Rx to skb
+    - power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
+    - ray_cs: Check ioremap return value
+    - powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch
+    - KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init
+    - powerpc/perf: Don't use perf_hw_context for trace IMC PMU
+    - mt76: connac: fix sta_rec_wtbl tag len
+    - mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta
+      mode
+    - mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv
+    - mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error
+    - mt76: mt7921: set EDCA parameters with the MCU CE command
+    - mt76: mt7921: do not always disable fw runtime-pm
+    - mt76: mt7921: fix a leftover race in runtime-pm
+    - mt76: mt7615: fix a leftover race in runtime-pm
+    - mt76: mt7915: fix ht mcs in mt7915_mac_add_txs_skb()
+    - mt76: mt7921: fix ht mcs in mt7921_mac_add_txs_skb()
+    - mt76: mt7921s: fix mt7921s_mcu_[fw|drv]_pmctrl
+    - mt76: mt7921e: fix possible probe failure after reboot
+    - mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update
+    - mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update
+    - mt76: mt7915: fix possible memory leak in mt7915_mcu_add_sta
+    - mt76: mt7921s: fix a possible memory leak in mt7921_load_patch
+    - mt76: mt7915: fix mcs_map in mt7915_mcu_set_sta_he_mcs()
+    - mt76: mt7915: fix the nss setting in bitrates
+    - ptp: unregister virtual clocks when unregistering physical clock.
+    - net: dsa: mv88e6xxx: Enable port policy support on 6097
+    - bpf: Fix a btf decl_tag bug when tagging a function
+    - mac80211: limit bandwidth in HE capabilities
+    - scripts/dtc: Call pkg-config POSIXly correct
+    - livepatch: Fix build failure on 32 bits processors
+    - net: asix: add proper error handling of usb read errors
+    - i2c: bcm2835: Fix the error handling in 'bcm2835_i2c_probe()'
+    - mtd: mchp23k256: Add SPI ID table
+    - mtd: mchp48l640: Add SPI ID table
+    - selftests/bpf: Extract syscall wrapper
+    - selftests/bpf: Use "__se_" prefix on architectures without syscall wrapper
+    - igc: avoid kernel warning when changing RX ring parameters
+    - igb: refactor XDP registration
+    - drm/amdgpu: Don't offset by 2 in FRU EEPROM
+    - PCI: aardvark: Fix reading MSI interrupt number
+    - PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge
+    - RDMA/rxe: Check the last packet by RXE_END_MASK
+    - libbpf: Fix signedness bug in btf_dump_array_data()
+    - libbpf: Fix riscv register names
+    - cxl/core: Fix cxl_probe_component_regs() error message
+    - tools/testing/cxl: Fix root port to host bridge assignment
+    - cxl/regs: Fix size of CXL Capability Header Register
+    - Netvsc: Call hv_unmap_memory() in the netvsc_device_remove()
+    - net:enetc: allocate CBD ring data memory using DMA coherent methods
+    - libbpf: Fix compilation warning due to mismatched printf format
+    - rtw88: fix use after free in rtw_hw_scan_update_probe_req()
+    - drm/bridge: dw-hdmi: use safe format when first in bridge chain
+    - power: supply: ab8500: Swap max and overvoltage
+    - libbpf: Fix libbpf.map inheritance chain for LIBBPF_0.7.0
+    - libbpf: Use dynamically allocated buffer when receiving netlink messages
+    - power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
+    - HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
+    - iommu/ipmmu-vmsa: Check for error num after setting mask
+    - drm/bridge: anx7625: Fix overflow issue on reading EDID
+    - ath11k: fix uninitialized rate_idx in ath11k_dp_tx_update_txcompl()
+    - i2c: pasemi: Drop I2C classes from platform driver variant
+    - bpftool: Fix the error when lookup in no-btf maps
+    - drm/amd/pm: enable pm sysfs write for one VF mode
+    - drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug
+    - bpftool: Fix pretty print dump for maps without BTF loaded
+    - libbpf: Fix memleak in libbpf_netlink_recv()
+    - IB/cma: Allow XRC INI QPs to set their local ACK timeout
+    - cxl/core/port: Rename bus.c to port.c
+    - cxl/port: Hold port reference until decoder release
+    - dax: make sure inodes are flushed before destroy cache
+    - selftests: mptcp: add csum mib check for mptcp_connect
+    - iwlwifi: mvm: Don't call iwl_mvm_sta_from_mac80211() with NULL sta
+    - iwlwifi: mvm: don't iterate unadded vifs when handling FW SMPS req
+    - iwlwifi: mvm: align locking in D3 test debugfs
+    - iwlwifi: yoyo: remove DBGI_SRAM address reset writing
+    - iwlwifi: yoyo: Avoid using dram data if allocation failed
+    - iwlwifi: mvm: fix off by one in iwl_mvm_stat_iterator_all_macs()
+    - iwlwifi: Fix -EIO error code that is never returned
+    - iwlwifi: mvm: Fix an error code in iwl_mvm_up()
+    - mtd: rawnand: pl353: Set the nand chip node as the flash node
+    - drm/msm/dp: do not initialize phy until plugin interrupt received
+    - drm/msm/dp: populate connector of struct dp_panel
+    - drm/msm/dp: stop link training after link training 2 failed
+    - drm/msm/dp: always add fail-safe mode into connector mode list
+    - drm/msm/dsi: Use "ref" fw clock instead of global name for VCO parent
+    - drm/msm/dsi/phy: fix 7nm v4.0 settings for C-PHY mode
+    - drm/msm/dpu: add DSPP blocks teardown
+    - drm/msm/dpu: fix dp audio condition
+    - drm/msm/dpu: remove msm_dp cached in dpu_encoder_virt
+    - drm/msm/dp: fix panel bridge attachment
+    - i40e: remove dead stores on XSK hotpath
+    - ath11k: Invalidate cached reo ring entry before accessing it
+    - mips: Enable KCSAN
+    - dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
+    - vfio/pci: fix memory leak during D3hot to D0 transition
+    - vfio/pci: wake-up devices around reset functions
+    - scsi: fnic: Fix a tracing statement
+    - scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
+    - scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
+    - scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
+    - scsi: pm8001: Fix le32 values handling in
+      pm80xx_set_sas_protocol_timer_config()
+    - scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update()
+    - scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req()
+    - scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req()
+    - scsi: pm8001: Fix NCQ NON DATA command task initialization
+    - scsi: pm8001: Fix NCQ NON DATA command completion handling
+    - scsi: pm8001: Fix abort all task initialization
+    - mt76: do not always copy ethhdr in reverse_frag0_hdr_trans
+    - mt76: fix endianness errors in reverse_frag0_hdr_trans
+    - mt76: mt7921s: fix missing fc type/sub-type for 802.11 pkts
+    - net: dsa: realtek-smi: fix kdoc warnings
+    - net: dsa: realtek-smi: move to subdirectory
+    - RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR
+    - drm/amd/display: Remove vupdate_int_entry definition
+    - TOMOYO: fix __setup handlers return values
+    - power: supply: sbs-charger: Don't cancel work that is not initialized
+    - mt76: mt7915: enlarge wcid size to 544
+    - mt76: mt7915: fix the muru tlv issue
+    - drm/dp: Fix OOB read when handling Post Cursor2 register
+    - ext2: correct max file size computing
+    - drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
+    - power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false
+      return
+    - scsi: hisi_sas: Change permission of parameter prot_mask
+    - drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt
+    - bpf, arm64: Call build_prologue() first in first JIT pass
+    - bpf, arm64: Feed byte-offset into bpf line info
+    - xsk: Fix race at socket teardown
+    - RDMA/irdma: Fix netdev notifications for vlan's
+    - RDMA/irdma: Fix Passthrough mode in VM
+    - RDMA/irdma: Remove incorrect masking of PD
+    - libbpf: Fix BPF_MAP_TYPE_PERF_EVENT_ARRAY auto-pinning
+    - gpu: host1x: Fix an error handling path in 'host1x_probe()'
+    - gpu: host1x: Fix a memory leak in 'host1x_remove()'
+    - libbpf: Skip forward declaration when counting duplicated type names
+    - powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties()
+    - powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit
+    - KVM: x86: Fix emulation in writing cr8
+    - KVM: x86/emulator: Defer not-present segment check in
+      __load_segment_descriptor()
+    - KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors
+    - hv_balloon: rate-limit "Unhandled message" warning
+    - KVM: arm64: Enable Cortex-A510 erratum 2077057 by default
+    - i2c: xiic: Make bus names unique
+    - net: phy: micrel: Fix concurrent register access
+    - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync()
+    - Bluetooth: Fix skb allocation in mgmt_remote_name() &
+      mgmt_device_connected()
+    - power: supply: wm8350-power: Handle error for wm8350_register_irq
+    - power: supply: wm8350-power: Add missing free in free_charger_irq
+    - IB/hfi1: Allow larger MTU without AIP
+    - RDMA/core: Fix ib_qp_usecnt_dec() called when error
+    - PCI: Reduce warnings on possible RW1C corruption
+    - net: axienet: fix RX ring refill allocation failure handling
+    - drm/msm/a6xx: Fix missing ARRAY_SIZE() check
+    - mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n
+    - MIPS: Sanitise Cavium switch cases in TLB handler synthesizers
+    - powerpc/sysdev: fix incorrect use to determine if list is empty
+    - powerpc/64s: Don't use DSISR for SLB faults
+    - mfd: mc13xxx: Add check for mc13xxx_irq_request
+    - libbpf: Unmap rings when umem deleted
+    - selftests/bpf: Make test_lwt_ip_encap more stable and faster
+    - platform/x86: huawei-wmi: check the return value of device_create_file()
+    - scsi: mpt3sas: Fix incorrect 4GB boundary check
+    - powerpc: 8xx: fix a return value error in mpc8xx_pic_init
+    - xtensa: add missing XCHAL_HAVE_WINDOWED check
+    - iwlwifi: pcie: fix SW error MSI-X mapping
+    - vxcan: enable local echo for sent CAN frames
+    - ath10k: Fix error handling in ath10k_setup_msa_resources
+    - mips: cdmm: Fix refcount leak in mips_cdmm_phys_base
+    - MIPS: RB532: fix return value of __setup handler
+    - MIPS: pgalloc: fix memory leak caused by pgd_free()
+    - mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
+    - power: ab8500_chargalg: Use CLOCK_MONOTONIC
+    - RDMA/irdma: Prevent some integer underflows
+    - Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error"
+    - RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
+    - bpf, sockmap: Fix memleak in sk_psock_queue_msg
+    - bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
+    - bpf, sockmap: Fix more uncharged while msg has more_data
+    - bpf, sockmap: Fix double uncharge the mem of sk_msg
+    - samples/bpf, xdpsock: Fix race when running for fix duration of time
+    - USB: storage: ums-realtek: fix error code in rts51x_read_mem()
+    - drm/amd/display: Fix double free during GPU reset on DC streams
+    - RDMA/rxe: Change variable and function argument to proper type
+    - RDMA/rxe: Fix ref error in rxe_av.c
+    - powerpc/xive: fix return value of __setup handler
+    - powerpc/time: Fix KVM host re-arming a timer beyond decrementer range
+    - drm/i915/display: Fix HPD short pulse handling for eDP
+    - drm/i915/display: Do not re-enable PSR after it was marked as not reliable
+    - netfilter: flowtable: Fix QinQ and pppoe support for inet table
+    - mt76: mt7921: fix mt7921_queues_acq implementation
+    - can: isotp: return -EADDRNOTAVAIL when reading from unbound socket
+    - can: isotp: support MSG_TRUNC flag when reading from socket
+    - bareudp: use ipv6_mod_enabled to check if IPv6 enabled
+    - PCI: imx6: Invoke the PHY exit function after PHY power off
+    - PCI: imx6: Assert i.MX8MM CLKREQ# even if no device present
+    - ibmvnic: fix race between xmit and reset
+    - af_unix: Fix some data-races around unix_sk(sk)->oob_skb.
+    - selftests/bpf: Fix error reporting from sock_fields programs
+    - Bluetooth: hci_uart: add missing NULL check in h5_enqueue
+    - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed
+    - Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
+    - RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit()
+    - ipv4: Fix route lookups when handling ICMP redirects and PMTU updates
+    - mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release
+      skb
+    - af_netlink: Fix shift out of bounds in group mask calculation
+    - i2c: meson: Fix wrong speed use from probe
+    - netfilter: conntrack: Add and use nf_ct_set_auto_assign_helper_warned()
+    - i2c: mux: demux-pinctrl: do not deactivate a master that is not active
+    - powerpc/pseries: Fix use after free in remove_phb_dynamic()
+    - ax25: Fix refcount leaks caused by ax25_cb_del()
+    - ax25: Fix NULL pointer dereferences in ax25 timers
+    - drm/i915: Fix renamed struct field
+    - selftests/bpf/test_lirc_mode2.sh: Exit with proper code
+    - bpftool: Fix print error when show bpf map
+    - PCI: Avoid broken MSI on SB600 USB devices
+    - net: bcmgenet: Use stronger register read/writes to assure ordering
+    - tcp: ensure PMTU updates are processed during fastopen
+    - openvswitch: always update flow key after nat
+    - net: dsa: fix panic on shutdown if multi-chip tree failed to probe
+    - net: wwan: qcom_bam_dmux: fix wrong pointer passed to IS_ERR()
+    - tipc: fix the timer expires after interval 100ms
+    - mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
+    - ice: fix 'scheduling while atomic' on aux critical err interrupt
+    - ice: don't allow to run ice_send_event_to_aux() in atomic ctx
+    - drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via
+      ethtool
+    - kernel/resource: fix kfree() of bootmem memory again
+    - clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3
+    - staging: r8188eu: release_firmware is not called if allocation fails
+    - mxser: fix xmit_buf leak in activate when LSR == 0xff
+    - fsi: scom: Fix error handling
+    - fsi: scom: Remove retries in indirect scoms
+    - pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
+    - pps: clients: gpio: Propagate return value from pps_gpio_probe
+    - fsi: Aspeed: Fix a potential double free
+    - misc: alcor_pci: Fix an error handling path
+    - cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse
+    - soundwire: intel: fix wrong register name in intel_shim_wake
+    - clk: qcom: ipq8074: fix PCI-E clock oops
+    - dmaengine: idxd: restore traffic class defaults after wq reset
+    - iio: mma8452: Fix probe failing when an i2c_device_id is used
+    - staging: qlge: add unregister_netdev in qlge_probe
+    - serial: 8250_aspeed_vuart: add PORT_ASPEED_VUART port type
+    - staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
+    - clk: renesas: r8a779f0: Fix RSW2 clock divider
+    - pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel
+    - pinctrl: renesas: checker: Fix miscalculation of number of states
+    - clk: qcom: ipq8074: Use floor ops for SDCC1 clock
+    - phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure})
+    - phy: phy-brcm-usb: fixup BCM4908 support
+    - serial: 8250_mid: Balance reference count for PCI DMA device
+    - serial: 8250_lpss: Balance reference count for PCI DMA device
+    - NFS: Use of mapping_set_error() results in spurious errors
+    - serial: 8250: Fix race condition in RTS-after-send handling
+    - iio: adc: Add check for devm_request_threaded_irq
+    - habanalabs: Add check for pci_enable_device
+    - NFS: Return valid errors from nfs2/3_decode_dirent()
+    - staging: r8188eu: fix endless loop in recv_func
+    - dma-debug: fix return value of __setup handlers
+    - clk: imx7d: Remove audio_mclk_root_clk
+    - clk: imx: off by one in imx_lpcg_parse_clks_from_dt()
+    - clk: at91: sama7g5: fix parents of PDMCs' GCLK
+    - clk: qcom: clk-rcg2: Update logic to calculate D value for RCG
+    - clk: qcom: clk-rcg2: Update the frac table for pixel clock
+    - clk: starfive: jh7100: Don't round divisor up twice
+    - clk: starfive: jh7100: Handle audio_div clock properly
+    - dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma
+    - remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region
+    - remoteproc: qcom_wcnss: Add missing of_node_put() in
+      wcnss_alloc_memory_region
+    - remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region
+    - nvdimm/region: Fix default alignment for small regions
+    - clk: actions: Terminate clk_div_table with sentinel element
+    - clk: loongson1: Terminate clk_div_table with sentinel element
+    - clk: hisilicon: Terminate clk_div_table with sentinel element
+    - clk: clps711x: Terminate clk_div_table with sentinel element
+    - clk: Fix clk_hw_get_clk() when dev is NULL
+    - clk: tegra: tegra124-emc: Fix missing put_device() call in
+      emc_ensure_emc_driver
+    - mailbox: imx: fix crash in resume on i.mx8ulp
+    - NFS: remove unneeded check in decode_devicenotify_args()
+    - staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
+    - staging: mt7621-dts: fix formatting
+    - staging: mt7621-dts: fix pinctrl properties for ethernet
+    - staging: mt7621-dts: fix GB-PC2 devicetree
+    - pinctrl: ocelot: fix confops resource index
+    - pinctrl: ocelot: fix duplicate debugfs entry
+    - pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
+    - pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback
+    - pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get()
+    - pinctrl: mediatek: paris: Fix pingroup pin config state readback
+    - pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual
+      GPIOs
+    - pinctrl: ocelot: Fix interrupt parsing
+    - pinctrl: microchip-sgpio: lock RMW access
+    - pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
+    - pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
+    - clk: visconti: prevent array overflow in visconti_clk_register_gates()
+    - tty: hvc: fix return value of __setup handler
+    - kgdboc: fix return value of __setup handler
+    - serial: 8250: fix XOFF/XON sending when DMA is used
+    - virt: acrn: obtain pa from VMA with PFNMAP flag
+    - virt: acrn: fix a memory leak in acrn_dev_ioctl()
+    - kgdbts: fix return value of __setup handler
+    - firmware: google: Properly state IOMEM dependency
+    - driver core: dd: fix return value of __setup handler
+    - perf test arm64: Test unwinding using fame-pointer (fp) mode
+    - jfs: fix divide error in dbNextAG
+    - SUNRPC/call_alloc: async tasks mustn't block waiting for memory
+    - SUNRPC: improve 'swap' handling: scheduling and PF_MEMALLOC
+    - SUNRPC: Don't call connect() more than once on a TCP socket
+    - perf parse-events: Move slots only with topdown
+    - netfilter: egress: Report interface as outgoing
+    - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
+    - SUNRPC don't resend a task on an offlined transport
+    - NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error
+    - kdb: Fix the putarea helper function
+    - perf stat: Fix forked applications enablement of counters
+    - net: stmmac: dwmac-qcom-ethqos: Enable RGMII functional clock on resume
+    - clk: qcom: gcc-msm8994: Fix gpll4 width
+    - vsock/virtio: initialize vdev->priv before using VQs
+    - vsock/virtio: read the negotiated features before using VQs
+    - vsock/virtio: enable VQs early on probe
+    - clk: Initialize orphan req_rate
+    - xen: fix is_xen_pmu()
+    - net: enetc: report software timestamping via SO_TIMESTAMPING
+    - net: hns3: fix bug when PF set the duplicate MAC address for VFs
+    - net: hns3: fix port base vlan add fail when concurrent with reset
+    - net: hns3: add vlan list lock to protect vlan list
+    - net: hns3: refine the process when PF set VF VLAN
+    - net: phy: broadcom: Fix brcm_fet_config_init()
+    - selftests: test_vxlan_under_vrf: Fix broken test case
+    - NFS: Don't loop forever in nfs_do_recoalesce()
+    - libperf tests: Fix typo in perf_evlist__open() failure error messages
+    - net: hns3: fix ethtool tx copybreak buf size indicating not aligned issue
+    - net: hns3: add max order judgement for tx spare buffer
+    - net: hns3: clean residual vf config after disable sriov
+    - net: hns3: add netdev reset check for hns3_set_tunable()
+    - net: hns3: add NULL pointer check for hns3_set/get_ringparam()
+    - net: hns3: fix phy can not link up when autoneg off and reset
+    - net: sparx5: depends on PTP_1588_CLOCK_OPTIONAL
+    - qlcnic: dcb: default to returning -EOPNOTSUPP
+    - net/x25: Fix null-ptr-deref caused by x25_disconnect
+    - net: sparx5: switchdev: fix possible NULL pointer dereference
+    - octeontx2-af: initialize action variable
+    - selftests: tls: skip cmsg_to_pipe tests with TLS=n
+    - net/sched: act_ct: fix ref leak when switching zones
+    - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
+    - net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator
+    - fs: fd tables have to be multiples of BITS_PER_LONG
+    - lib/test: use after free in register_test_dev_kmod()
+    - fs: fix fd table size alignment properly
+    - LSM: general protection fault in legacy_parse_param
+    - regulator: rpi-panel: Handle I2C errors/timing to the Atmel
+    - crypto: hisilicon/qm - cleanup warning in qm_vf_read_qos
+    - crypto: octeontx2 - CN10K CPT to RNM workaround
+    - gcc-plugins/stackleak: Exactly match strings instead of prefixes
+    - rcu: Kill rnp->ofl_seq and use only rcu_state.ofl_lock for exclusion
+    - pinctrl: npcm: Fix broken references to chip->parent_device
+    - rcu: Mark writes to the rcu_segcblist structure's ->flags field
+    - block: throttle split bio in case of iops limit
+    - memstick/mspro_block: fix handling of read-only devices
+    - block/bfq_wf2q: correct weight to ioprio
+    - crypto: xts - Add softdep on ecb
+    - crypto: hisilicon/sec - not need to enable sm4 extra mode at HW V3
+    - block, bfq: don't move oom_bfqq
+    - selinux: use correct type for context length
+    - powercap/dtpm_cpu: Reset per_cpu variable in the release function
+    - arm64: module: remove (NOLOAD) from linker script
+    - selinux: allow FIOCLEX and FIONCLEX with policy capability
+    - loop: use sysfs_emit() in the sysfs xxx show()
+    - Fix incorrect type in assignment of ipv6 port for audit
+    - irqchip/qcom-pdc: Fix broken locking
+    - irqchip/nvic: Release nvic_base upon failure
+    - fs/binfmt_elf: Fix AT_PHDR for unusual ELF files
+    - hwrng: cavium - fix NULL but dereferenced coccicheck error
+    - bfq: fix use-after-free in bfq_dispatch_request
+    - ACPICA: Avoid walking the ACPI Namespace if it is not there
+    - ACPI / x86: Add skip i2c clients quirk for Nextbook Ares 8
+    - ACPI / x86: Add skip i2c clients quirk for Lenovo Yoga Tablet 1050F/L
+    - lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3
+    - Revert "Revert "block, bfq: honor already-setup queue merges""
+    - ACPI/APEI: Limit printable size of BERT table data
+    - PM: core: keep irq flags in device_pm_check_callbacks()
+    - parisc: Fix non-access data TLB cache flush faults
+    - parisc: Fix handling off probe non-access faults
+    - nvme-tcp: lockdep: annotate in-kernel sockets
+    - spi: tegra20: Use of_device_get_match_data()
+    - spi: fsi: Implement a timeout for polling status
+    - atomics: Fix atomic64_{read_acquire,set_release} fallbacks
+    - locking/lockdep: Iterate lock_classes directly when reading lockdep files
+    - ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb
+    - ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit
+    - sched/tracing: Report TASK_RTLOCK_WAIT tasks as TASK_UNINTERRUPTIBLE
+    - ext4: don't BUG if someone dirty pages without asking ext4 first
+    - f2fs: fix to do sanity check on curseg->alloc_type
+    - NFSD: Fix nfsd_breaker_owns_lease() return values
+    - f2fs: don't get FREEZE lock in f2fs_evict_inode in frozen fs
+    - btrfs: harden identification of a stale device
+    - btrfs: make search_csum_tree return 0 if we get -EFBIG
+    - btrfs: handle csum lookup errors properly on reads
+    - btrfs: do not double complete bio on errors during compressed reads
+    - btrfs: do not clean up repair bio if submit fails
+    - f2fs: use spin_lock to avoid hang
+    - f2fs: compress: fix to print raw data size in error path of lz4
+      decompression
+    - Adjust cifssb maximum read size
+    - ntfs: add sanity check on allocation size
+    - media: staging: media: zoran: move videodev alloc
+    - media: staging: media: zoran: calculate the right buffer number for
+      zoran_reap_stat_com
+    - media: staging: media: zoran: fix various V4L2 compliance errors
+    - media: atmel: atmel-isc-base: report frame sizes as full supported range
+    - media: ir_toy: free before error exiting
+    - ASoC: sh: rz-ssi: Make the data structures available before registering the
+      handlers
+    - ASoC: cs42l42: Report full jack status when plug is detected
+    - ASoC: SOF: Intel: match sdw version on link_slaves_found
+    - media: imx-jpeg: Prevent decoding NV12M jpegs into single-planar buffers
+    - ASoC: SOF: Intel: hda: Remove link assignment limitation
+    - media: iommu/mediatek-v1: Free the existed fwspec if the master dev already
+      has
+    - media: iommu/mediatek: Return ENODEV if the device is NULL
+    - media: iommu/mediatek: Add device_link between the consumer and the larb
+      devices
+    - video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
+    - video: fbdev: w100fb: Reset global state
+    - video: fbdev: cirrusfb: check pixclock to avoid divide by zero
+    - video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
+    - ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
+    - ARM: dts: bcm2837: Add the missing L1/L2 cache information
+    - ASoC: madera: Add dependencies on MFD
+    - media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator
+      off on some boards
+    - media: atomisp: fix dummy_ptr check to avoid duplicate active_bo
+    - ARM: ftrace: avoid redundant loads or clobbering IP
+    - ALSA: hda: Fix driver index handling at re-binding
+    - ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk
+    - arm64: defconfig: build imx-sdma as a module
+    - video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
+    - video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of
+      snprintf()
+    - video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit
+    - ARM: dts: bcm2711: Add the missing L1/L2 cache information
+    - ASoC: soc-core: skip zero num_dai component in searching dai name
+    - ASoC: Intel: sof_es8336: add quirk for Huawei D15 2021
+    - media: imx-jpeg: fix a bug of accessing array out of bounds
+    - media: cx88-mpeg: clear interrupt status register before streaming video
+    - ASoC: rt5682s: Fix the wrong jack type detected
+    - ARM: tegra: transformer: Drop reg-shift for Tegra HS UART
+    - uaccess: fix type mismatch warnings from access_ok()
+    - lib/test_lockup: fix kernel pointer check for separate address spaces
+    - ARM: tegra: tamonten: Fix I2C3 pad setting
+    - ARM: mmp: Fix failure to remove sram device
+    - ASoC: amd: vg: fix for pm resume callback sequence
+    - ASoC: amd: vangogh: fix uninitialized symbol warning in machine driver
+    - video: fbdev: sm712fb: Fix crash in smtcfb_write()
+    - media: i2c: ov5648: Fix lockdep error
+    - media: Revert "media: em28xx: add missing em28xx_close_extension"
+    - media: hdpvr: initialize dev->worker at hdpvr_register_videodev
+    - ASoC: SOF: debug: clarify operator precedence
+    - ASoC: Intel: sof_sdw: fix quirks for 2022 HP Spectre x360 13"
+    - ASoC: SOF: Intel: hda: retrieve DMIC number for I2S boards
+    - ALSA: intel-nhlt: add helper to detect SSP link mask
+    - ALSA: intel-dsp-config: add more ACPI HIDs for ES83x6 devices
+    - ASoC: Intel: soc-acpi: add more ACPI HIDs for ES83x6 devices
+    - ALSA: intel-dspconfig: add ES8336 support for CNL
+    - ASoC: Intel: Revert "ASoC: Intel: sof_es8336: add quirk for Huawei D15 2021"
+    - ASoC: Intel: sof_es8336: log all quirks
+    - tracing: Have TRACE_DEFINE_ENUM affect trace event types as well
+    - mmc: host: Return an error when ->enable_sdio_irq() ops is missing
+    - ASoC: mediatek: Fix error handling in mt8183_da7219_max98357_dev_probe
+    - media: atomisp: fix bad usage at error handling logic
+    - ALSA: hda/realtek: Add alc256-samsung-headphone fixup
+    - KVM: SVM: Allow AVIC support on system w/ physical APIC ID > 255
+    - KVM: x86: Reinitialize context if host userspace toggles EFER.LME
+    - KVM: x86/mmu: Use common TDP MMU zap helper for MMU notifier unmap hook
+    - KVM: x86/mmu: Move "invalid" check out of kvm_tdp_mmu_get_root()
+    - KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU
+    - KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU
+    - KVM: x86: hyper-v: Drop redundant 'ex' parameter from kvm_hv_send_ipi()
+    - KVM: x86: hyper-v: Drop redundant 'ex' parameter from kvm_hv_flush_tlb()
+    - KVM: x86: hyper-v: Fix the maximum number of sparse banks for XMM fast TLB
+      flush hypercalls
+    - KVM: x86: hyper-v: HVCALL_SEND_IPI_EX is an XMM fast hypercall
+    - powerpc/kasan: Fix early region not updated correctly
+    - powerpc/tm: Fix more userspace r13 corruption
+    - powerpc/lib/sstep: Fix 'sthcx' instruction
+    - powerpc/lib/sstep: Fix build errors with newer binutils
+    - powerpc: Add set_memory_{p/np}() and remove set_memory_attr()
+    - powerpc: Fix build errors with newer binutils
+    - drm/dp: Fix off-by-one in register cache size
+    - drm/i915: Treat SAGV block time 0 as SAGV disabled
+    - drm/i915: Fix PSF GV point mask when SAGV is not possible
+    - drm/i915: Reject unsupported TMDS rates on ICL+
+    - scsi: qla2xxx: Refactor asynchronous command initialization
+    - scsi: qla2xxx: Implement ref count for SRB
+    - scsi: qla2xxx: Fix stuck session in gpdb
+    - scsi: qla2xxx: Fix warning message due to adisc being flushed
+    - scsi: qla2xxx: Fix scheduling while atomic
+    - scsi: qla2xxx: Fix premature hw access after PCI error
+    - scsi: qla2xxx: Fix wrong FDMI data for 64G adapter
+    - scsi: qla2xxx: Fix warning for missing error code
+    - scsi: qla2xxx: Fix device reconnect in loop topology
+    - scsi: qla2xxx: edif: Fix clang warning
+    - scsi: qla2xxx: Fix T10 PI tag escape and IP guard options for 28XX adapters
+    - scsi: qla2xxx: Add devids and conditionals for 28xx
+    - scsi: qla2xxx: Check for firmware dump already collected
+    - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
+    - scsi: qla2xxx: Fix disk failure to rediscover
+    - scsi: qla2xxx: Fix incorrect reporting of task management failure
+    - scsi: qla2xxx: Fix hang due to session stuck
+    - scsi: qla2xxx: Fix laggy FC remote port session recovery
+    - scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests
+    - scsi: qla2xxx: Fix crash during module load unload test
+    - scsi: qla2xxx: Fix N2N inconsistent PLOGI
+    - scsi: qla2xxx: Fix stuck session of PRLI reject
+    - scsi: qla2xxx: Reduce false trigger to login
+    - scsi: qla2xxx: Use correct feature type field during RFF_ID processing
+    - platform: chrome: Split trace include file
+    - MIPS: crypto: Fix CRC32 code
+    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
+    - KVM: x86: Avoid theoretical NULL pointer dereference in
+      kvm_irq_delivery_to_apic_fast()
+    - KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
+    - KVM: x86/mmu: do compare-and-exchange of gPTE via the user address
+    - KVM: Prevent module exit until all VMs are freed
+    - KVM: x86: fix sending PV IPI
+    - KVM: SVM: fix panic on out-of-bounds guest IRQ
+    - KVM: avoid double put_page with gfn-to-pfn cache
+    - ubifs: rename_whiteout: Fix double free for whiteout_ui->data
+    - ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
+    - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
+    - ubifs: Rename whiteout atomically
+    - ubifs: Fix 'ui->dirty' race between do_tmpfile() and writeback work
+    - ubifs: Rectify space amount budget for mkdir/tmpfile operations
+    - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
+    - ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
+    - ubifs: Fix to add refcount once page is set private
+    - ubifs: rename_whiteout: correct old_dir size computing
+    - nvme: allow duplicate NSIDs for private namespaces
+    - nvme: fix the read-only state for zoned namespaces with unsupposed features
+    - wireguard: queueing: use CFI-safe ptr_ring cleanup function
+    - wireguard: socket: free skb in send6 when ipv6 is disabled
+    - wireguard: socket: ignore v6 endpoints when ipv6 is disabled
+    - XArray: Fix xas_create_range() when multi-order entry present
+    - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
+    - can: mcba_usb: properly check endpoint type
+    - can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value
+    - XArray: Include bitmap.h from xarray.h
+    - XArray: Update the LRU list in xas_split()
+    - modpost: restore the warning message for missing symbol versions
+    - rtc: gamecube: Fix refcount leak in gamecube_rtc_read_offset_from_sram
+    - rtc: check if __rtc_read_time was successful
+    - loop: fix ioctl calls using compat_loop_info
+    - gfs2: gfs2_setattr_size error path fix
+    - gfs2: Fix gfs2_file_buffered_write endless loop workaround
+    - gfs2: Make sure FITRIM minlen is rounded up to fs block size
+    - net: hns3: fix the concurrency between functions reading debugfs
+    - net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware
+    - rxrpc: fix some null-ptr-deref bugs in server_key.c
+    - rxrpc: Fix call timer start racing with call destruction
+    - mailbox: imx: fix wakeup failure from freeze mode
+    - crypto: x86/poly1305 - Fixup SLS
+    - crypto: arm/aes-neonbs-cbc - Select generic cbc and aes
+    - watch_queue: Free the page array when watch_queue is dismantled
+    - pinctrl: pinconf-generic: Print arguments for bias-pull-*
+    - watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function
+    - net: sparx5: uses, depends on BRIDGE or !BRIDGE
+    - pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR()
+    - pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE()
+    - ASoC: rockchip: i2s_tdm: Fixup config for SND_SOC_DAIFMT_DSP_A/B
+    - ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs
+    - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
+    - ARM: iop32x: offset IRQ numbers by 1
+    - block: Fix the maximum minor value is blk_alloc_ext_minor()
+    - block: restore the old set_task_ioprio() behaviour wrt PF_EXITING
+    - Revert "virtio-pci: harden INTX interrupts"
+    - Revert "virtio_pci: harden MSI-X interrupts"
+    - virtio: use virtio_device_ready() in virtio_device_restore()
+    - io_uring: remove poll entry from list when canceling all
+    - io_uring: bump poll refs to full 31-bits
+    - io_uring: fix memory leak of uid in files registration
+    - riscv module: remove (NOLOAD)
+    - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
+    - vhost: handle error while adding split ranges to iotlb
+    - spi: Fix Tegra QSPI example
+    - platform/chrome: cros_ec_typec: Check for EC device
+    - platform/x86: asus-wmi: Fix regression when probing for fan curve control
+    - can: isotp: restore accidentally removed MSG_PEEK feature
+    - proc: bootconfig: Add null pointer check
+    - x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation
+    - x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO
+    - drm/connector: Fix typo in documentation
+    - scsi: qla2xxx: Add qla2x00_async_done() for async routines
+    - staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet
+    - docs: fix 'make htmldocs' warning in SCTP.rst
+    - arm64: mm: Drop 'const' from conditional arm64_dma_phys_limit definition
+    - ASoC: soc-compress: Change the check for codec_dai
+    - KVM: x86: SVM: fix avic spec based definitions again
+    - ax25: fix UAF bug in ax25_send_control()
+    - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
+    - tracing: Have type enum modifications copy the strings
+    - mips: Enable KCSAN - take 2
+    - net: add skb_set_end_offset() helper
+    - mm/mmap: return 1 from stack_guard_gap __setup() handler
+    - ARM: 9187/1: JIVE: fix return value of __setup handler
+    - mm/memcontrol: return 1 from cgroup.memory __setup() handler
+    - mm/usercopy: return 1 from hardened_usercopy __setup() handler
+    - af_unix: Support POLLPRI for OOB.
+    - libbpf: Define BTF_KIND_* constants in btf.h to avoid compilation errors
+    - bpf: Adjust BPF stack helper functions to accommodate skip > 0
+    - bpf: Fix comment for helper bpf_current_task_under_cgroup()
+    - nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
+    - mmc: rtsx: Use pm_runtime_{get,put}() to handle runtime PM
+    - dt-bindings: mtd: nand-controller: Fix the reg property description
+    - dt-bindings: mtd: nand-controller: Fix a comment in the examples
+    - dt-bindings: spi: mxic: The interrupt property is not mandatory
+    - media: dt-binding: media: hynix,hi846: use $defs/port-base port description
+    - media: dt-bindings: media: hynix,hi846: add link-frequencies description
+    - dt-bindings: memory: mtk-smi: Rename clock to clocks
+    - dt-bindings: memory: mtk-smi: No need mediatek,larb-id for mt8167
+    - dt-bindings: memory: mtk-smi: Correct minItems to 2 for the gals clocks
+    - dt-bindings: pinctrl: mt8195: fix bias-pull-{up,down} checks
+    - dt-bindings: pinctrl: pinctrl-microchip-sgpio: Fix example
+    - ubi: fastmap: Return error code if memory allocation fails in add_aeb()
+    - net: preserve skb_end_offset() in skb_unclone_keeptruesize()
+    - ASoC: SOF: Intel: Fix build error without SND_SOC_SOF_PCI_DEV
+    - ASoC: topology: Allow TLV control to be either read or write
+    - perf vendor events: Update metrics for SkyLake Server
+    - media: ov6650: Add try support to selection API operations
+    - media: ov6650: Fix crop rectangle affected by set format
+    - pinctrl: canonical rsel resistance selection property
+    - spi: mediatek: support tick_delay without enhance_timing
+    - ARM: dts: spear1340: Update serial node properties
+    - ARM: dts: spear13xx: Update SPI dma properties
+    - arm64: dts: ls1043a: Update i2c dma properties
+    - arm64: dts: ls1046a: Update i2c node dma properties
+    - um: Fix uml_mconsole stop/go
+    - docs: sysctl/kernel: add missing bit to panic_print
+    - xsk: Do not write NULL in SW ring at allocation failure
+    - ice: xsk: Fix indexing in ice_tx_xsk_pool()
+    - vdpa/mlx5: Avoid processing works if workqueue was destroyed
+    - openvswitch: Fixed nd target mask field in the flow dump.
+    - torture: Make torture.sh help message match reality
+    - n64cart: convert bi_disk to bi_bdev->bd_disk fix build
+    - Revert "nbd: fix possible overflow on 'first_minor' in nbd_dev_add()"
+    - mmc: rtsx: Let MMC core handle runtime PM
+    - mmc: rtsx: Fix build errors/warnings for unused variable
+    - coredump: Snapshot the vmas in do_coredump
+    - coredump: Remove the WARN_ON in dump_vma_snapshot
+    - coredump/elf: Pass coredump_params into fill_note_info
+    - coredump: Use the vma snapshot in fill_files_note
+    - Linux 5.17.2
+
+  * Jammy update: v5.17.1 upstream stable release (LP: #1968982)
+    - tpm: Fix error handling in async work
+    - Bluetooth: btusb: Add another Realtek 8761BU
+    - llc: fix netdevice reference leaks in llc_ui_bind()
+    - ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call
+    - ALSA: oss: Fix PCM OSS buffer allocation overflow
+    - ALSA: usb-audio: add mapping for new Corsair Virtuoso SE
+    - ALSA: hda/realtek: Add quirk for Clevo NP70PNJ
+    - ALSA: hda/realtek: Add quirk for Clevo NP50PNJ
+    - ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671
+    - ALSA: hda/realtek: Add quirk for ASUS GA402
+    - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
+    - ALSA: pcm: Fix races among concurrent read/write and buffer changes
+    - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
+    - ALSA: pcm: Fix races among concurrent prealloc proc writes
+    - ALSA: pcm: Add stream lock during PCM reset ioctl operations
+    - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
+    - ALSA: cmipci: Restore aux vol on suspend/resume
+    - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
+    - drivers: net: xgene: Fix regression in CRC stripping
+    - netfilter: nf_tables: initialize registers in nft_do_chain()
+    - netfilter: nf_tables: validate registers coming from userspace.
+    - ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
+    - ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
+    - ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
+    - crypto: qat - disable registration of algorithms
+    - Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE
+    - Bluetooth: hci_sync: Add a new quirk to skip HCI_FLT_CLEAR_ALL
+    - Bluetooth: btusb: Use quirk to skip HCI_FLT_CLEAR_ALL on fake CSR
+      controllers
+    - Revert "ath: add support for special 0x0 regulatory domain"
+    - drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()
+    - jbd2: fix use-after-free of transaction_t race
+    - rcu: Don't deboost before reporting expedited quiescent state
+    - uaccess: fix integer overflow on access_ok()
+    - mac80211: fix potential double free on mesh join
+    - tpm: fix reference counting for struct tpm_chip
+    - tpm: use try_get_ops() in tpm-space.c
+    - wcn36xx: Differentiate wcn3660 from wcn3620
+    - m68k: fix access_ok for coldfire
+    - nds32: fix access_ok() checks in get/put_user
+    - drm/msm/gpu: Fix crash on devices without devfreq support (v2)
+    - llc: only change llc->dev when bind() succeeds
+    - Linux 5.17.1
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: shiftfs: always rely on init_user_ns
+    - [Config] update configs and annotations after stable updates
+    - SAUCE: sfc: The size of the RX recycle ring should be more flexible
+    - [Packaging] remove references to lowlatency flavor
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Apr 2022 08:45:40 +0200
+
+linux-unstable (5.17.0-6.6) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-6.6 -proposed tracker (LP: #1965731)
+
+  * dependency on crda obsolete according to Debian (LP: #1958918)
+    - [Packaging] switch dependency from crda to wireless-regdb
+
+  * Miscellaneous Ubuntu changes
+    - [Config] disable CONFIG_SYSFB_SIMPLEFB on amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Mar 2022 09:46:03 +0100
+
+linux-unstable (5.17.0-5.5) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-5.5 -proposed tracker (LP: #1964766)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync dkms-build{,--nvidia-N} from LRMv5
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to v5.17-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17-rc8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Mar 2022 13:15:50 +0100
+
+linux-unstable (5.17.0-4.4) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-4.4 -proposed tracker (LP: #1963880)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 07 Mar 2022 10:20:48 +0100
+
+linux-unstable (5.17.0-3.3) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-3.3 -proposed tracker (LP: #1962450)
+
+  * 5.15 stuck at boot on c4.large (LP: #1956780)
+    - Revert "PCI/MSI: Mask MSI-X vectors only on success"
+
+  * [22.04 FEAT] KVM: Enable storage key checking for intercepted instruction
+    handled by userspace (LP: #1933179)
+    - s390/uaccess: Add copy_from/to_user_key functions
+    - KVM: s390: Honor storage keys when accessing guest memory
+    - KVM: s390: handle_tprot: Honor storage keys
+    - KVM: s390: Add optional storage key checking to MEMOP IOCTL
+    - KVM: s390: Add vm IOCTL for key checked guest absolute memory access
+    - KVM: s390: Rename existing vcpu memop functions
+    - KVM: s390: Update api documentation for memop ioctl
+    - KVM: s390: Clarify key argument for MEM_OP in api docs
+    - KVM: s390: Add missing vm MEM_OP size check
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.17-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Feb 2022 09:42:32 +0100
+
+linux-unstable (5.17.0-2.2) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.17.0-2.2 -proposed tracker (LP: #1962137)
+
+  * CVE-2022-25636
+    - netfilter: nf_tables_offload: incorrect flow offload action array size
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+    - [Packaging] update Ubuntu.md
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Jammy update: v5.15.22 upstream stable release (LP: #1960516)
+    - Revert "ASoC: mediatek: Check for error clk pointer"
+    - [Config] disable FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION
+
+  * Jammy update: v5.15.20 upstream stable release (LP: #1960509)
+    - Revert "UBUNTU: SAUCE: Revert "e1000e: Additional PHY power saving in S0ix""
+
+  * Jammy update: v5.15.19 upstream stable release (LP: #1959879)
+    - drm/etnaviv: relax submit size limits
+
+  * Jammy update: v5.15.17 upstream stable release (LP: #1959376)
+    - net: dsa: hellcreek: Allow PTP P2P measurements on blocked ports
+    - rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC
+    - ASoC: mediatek: Check for error clk pointer
+    - regulator: da9121: Prevent current limit change when enabled
+    - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
+    - drm/etnaviv: limit submit sizes
+    - Bluetooth: hci_sync: Fix not setting adv set duration
+    - net: axienet: Wait for PhyRstCmplt after core reset
+
+  * rtw88_8821ce causes freeze (LP: #1927808) // Jammy update: v5.15.17 upstream
+    stable release (LP: #1959376)
+    - rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
+
+  * Jammy update: v5.15.15 upstream stable release (LP: #1958418)
+    - Bluetooth: btusb: Add support for Foxconn MT7922A
+    - Bluetooth: btbcm: disable read tx power for MacBook Air 8,1 and 8,2
+    - platform/x86/intel: hid: add quirk to support Surface Go 3
+
+  * Support USB4 DP alt mode for AMD Yellow Carp graphics card (LP: #1953008)
+    - SAUCE: drm/amd/display: Fixup previous PSR policy commit
+
+  * alsa/sdw: add sdw audio machine driver for several ADL machines
+    (LP: #1951563)
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B11 product
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B13 product
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B29 product
+    - ASoC: Intel: sof_sdw: Add support for SKU 0B12 product
+
+  * Improve performance and idle power consumption (LP: #1941893)
+    - x86: ACPI: cstate: Optimize C3 entry on AMD CPUs
+
+  * Fix spurious wakeup caused by Intel 7560 WWAN (LP: #1956443)
+    - net: wwan: iosm: Keep device at D0 for s2idle case
+
+  * Jammy update: v5.15.13 upstream stable release (LP: #1956926)
+    - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
+    - net/mlx5: Fix tc max supported prio for nic mode
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Update dependency of pahole / dwarves
+    - [packaging] unhook lowlatency flavours from the build
+    - [Packaging] use default zstd compression
+    - [Packaging] do not use compression for image packages
+    - [Packaging] use xz compression for ddebs
+    - SAUCE: Makefile: Remove inclusion of lbm header files
+    - SAUCE: Makefile: Fix compiler warnings
+    - [Config] drop unused lowlatency configs
+    - [Config] update configs and annotations after rebase to v5.17-rc5
+
+  * Miscellaneous upstream changes
+    - Revert "rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE"
+    - MAINTAINERS: Add scripts/pahole-flags.sh to BPF section
+    - kbuild: Add CONFIG_PAHOLE_VERSION
+    - lib/Kconfig.debug: Use CONFIG_PAHOLE_VERSION
+    - lib/Kconfig.debug: Allow BTF + DWARF5 with pahole 1.21+
+    - Revert "UBUNTU: [Packaging] temporarily disable zfs"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 24 Feb 2022 09:41:40 +0100
+
+linux-unstable (5.17.0-1.1) jammy; urgency=medium
+
+  * Rebase to 5.17-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Feb 2022 08:22:18 +0100
+
+linux-unstable (5.17.0-0.0) jammy; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 28 Jan 2022 17:14:13 +0100
+
+linux (5.15.0-18.18) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-18.18 -proposed tracker (LP: #1958638)
+
+  * CVE-2021-4155
+    - xfs: map unwritten blocks in XFS_IOC_{ALLOC, FREE}SP just like fallocate
+
+  * CVE-2022-0185
+    - SAUCE: vfs: test that one given mount param is not larger than PAGE_SIZE
+
+  * [UBUNTU 20.04] KVM hardware diagnose data improvements for guest kernel -
+    kernel part (LP: #1953334)
+    - KVM: s390: add debug statement for diag 318 CPNC data
+
+  * OOB write on BPF_RINGBUF (LP: #1956585)
+    - SAUCE: bpf: prevent helper argument PTR_TO_ALLOC_MEM to have offset other
+      than 0
+
+  * Miscellaneous Ubuntu changes
+    - [Config] re-enable shiftfs
+    - [SAUCE] shiftfs: support kernel 5.15
+    - [Config] update toolchain versions
+
+  * Miscellaneous upstream changes
+    - vfs: fs_context: fix up param length parsing in legacy_parse_param
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 21 Jan 2022 13:32:27 +0100
+
+linux (5.15.0-17.17) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-17.17 -proposed tracker (LP: #1957809)
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 13 Jan 2022 17:11:21 +0100
+
+linux (5.15.0-16.16) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-16.16 -proposed tracker (LP: #1956820)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * 5.15 stuck at boot on c4.large (LP: #1956780)
+    - Revert "PCI/MSI: Mask MSI-X vectors only on success"
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] temporarily disable signed v4l2loopback"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Sat, 08 Jan 2022 10:57:58 +0100
+
+linux (5.15.0-15.15) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-15.15 -proposed tracker (LP: #1956314)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * rtw88_8821ce causes freeze (LP: #1927808)
+    - rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
+
+  * alsa/sdw: fix the  audio sdw codec parsing logic in the acpi table
+    (LP: #1955686)
+    - ALSA: hda: intel-sdw-acpi: go through HDAS ACPI at max depth of 2
+    - ALSA: hda: intel-sdw-acpi: harden detection of controller
+
+  * Got black screen when resume from s2idle with AMD dGPU (LP: #1955790)
+    - SAUCE: drm/amdgpu: put SMU into proper state on runpm suspending for BOCO
+      capable platform
+    - SAUCE: drm/amdgpu: always reset the asic in suspend (v2)
+
+  *  Fix USB3 detection on HP dock (LP: #1955443)
+    - usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
+
+  * support signed v4l2loopback dkms build (LP: #1938531)
+    - enable v4l2loopback builds on amd64 kernels
+    - support v4l2loopback dkms build
+
+  * Jammy update: v5.15.12 upstream stable release (LP: #1956305)
+    - arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd
+    - net: usb: lan78xx: add Allied Telesis AT29M2-AF
+    - ext4: prevent partial update of the extent blocks
+    - ext4: check for out-of-order index extents in ext4_valid_extent_entries()
+    - ext4: check for inconsistent extents between index and leaf block
+    - selftests: KVM: Fix non-x86 compiling
+    - HID: holtek: fix mouse probing
+    - HID: potential dereference of null pointer
+    - NFSD: Fix READDIR buffer overflow
+    - PM: sleep: Fix error handling in dpm_prepare()
+    - arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode
+    - bus: sunxi-rsb: Fix shutdown
+    - spi: change clk_disable_unprepare to clk_unprepare
+    - ucounts: Fix rlimit max values check
+    - drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf
+    - ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent()
+    - RDMA/hns: Fix RNR retransmission issue for HIP08
+    - IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
+    - RDMA/hns: Replace kfree() with kvfree()
+    - netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
+    - netfilter: fix regression in looped (broad|multi)cast's MAC handling
+    - ARM: dts: imx6qdl-wandboard: Fix Ethernet support
+    - ice: Use xdp_buf instead of rx_buf for xsk zero-copy
+    - ice: xsk: return xsk buffers back to pool when cleaning the ring
+    - net: marvell: prestera: fix incorrect return of port_find
+    - net: marvell: prestera: fix incorrect structure access
+    - qlcnic: potential dereference null pointer of rx_queue->page_ring
+    - tcp: move inet->rx_dst_ifindex to sk->sk_rx_dst_ifindex
+    - ipv6: move inet6_sk(sk)->rx_dst_cookie to sk->sk_rx_dst_cookie
+    - inet: fully convert sk->sk_rx_dst to RCU rules
+    - net: accept UFOv6 packages in virtio_net_hdr_to_skb
+    - net: skip virtio_net_hdr_set_proto if protocol already set
+    - igb: fix deadlock caused by taking RTNL in RPM resume path
+    - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
+    - gpio: virtio: remove timeout
+    - bonding: fix ad_actor_system option setting to default
+    - fjes: Check for error irq
+    - drivers: net: smc911x: Check for error irq
+    - net: ks8851: Check for error irq
+    - sfc: Check null pointer of rx_queue->page_ring
+    - sfc: falcon: Check null pointer of rx_queue->page_ring
+    - asix: fix uninit-value in asix_mdio_read()
+    - asix: fix wrong return value in asix_check_host_enable()
+    - io_uring: zero iocb->ki_pos for stream file types
+    - veth: ensure skb entering GRO are not cloned.
+    - net: stmmac: ptp: fix potentially overflowing expression
+    - net: bridge: Use array_size() helper in copy_to_user()
+    - net: bridge: fix ioctl old_deviceless bridge argument
+    - r8152: fix the force speed doesn't work for RTL8156
+    - net: stmmac: dwmac-visconti: Fix value of ETHER_CLK_SEL_FREQ_SEL_2P5M
+    - pinctrl: bcm2835: Change init order for gpio hogs
+    - hwmon: (lm90) Fix usage of CONFIG2 register in detect function
+    - hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations
+    - hwmon: (lm90) Introduce flag indicating extended temperature support
+    - hwmon: (lm90) Add basic support for TI TMP461
+    - hwmon: (lm90) Drop critical attribute support for MAX6654
+    - ARM: 9160/1: NOMMU: Reload __secondary_data after PROCINFO_INITFUNC
+    - uapi: Fix undefined __always_inline on non-glibc systems
+    - compiler.h: Fix annotation macro misplacement with Clang
+    - platform/x86/intel: Remove X86_PLATFORM_DRIVERS_INTEL
+    - kernel/crash_core: suppress unknown crashkernel parameter warning
+    - Revert "x86/boot: Pull up cmdline preparation and early param parsing"
+    - x86/boot: Move EFI range reservation after cmdline parsing
+    - ALSA: jack: Check the return value of kstrdup()
+    - ALSA: drivers: opl3: Fix incorrect use of vp->state
+    - ALSA: rawmidi - fix the uninitalized user_pversion
+    - ALSA: hda/hdmi: Disable silent stream on GLK
+    - ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
+    - ALSA: hda/realtek: Add new alc285-hp-amp-init model
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
+    - ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
+    - ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s
+    - ASoC: tegra: Add DAPM switches for headphones and mic jack
+    - ASoC: tegra: Restore headphones jack name on Nyan Big
+    - Input: atmel_mxt_ts - fix double free in mxt_read_info_block
+    - ipmi: bail out if init_srcu_struct fails
+    - ipmi: ssif: initialize ssif_info->client early
+    - ipmi: fix initialization when workqueue allocation fails
+    - parisc: Correct completer in lws start
+    - parisc: Fix mask used to select futex spinlock
+    - tee: handle lookup of shm with reference count 0
+    - x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
+    - platform/x86: amd-pmc: only use callbacks for suspend
+    - platform/x86: intel_pmc_core: fix memleak on registration failure
+    - KVM: x86: Always set kvm_run->if_flag
+    - KVM: x86/mmu: Don't advance iterator after restart due to yielding
+    - KVM: nVMX: Synthesize TRIPLE_FAULT for L2 if emulation is required
+    - KVM: VMX: Always clear vmx->fail on emulation_required
+    - KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU
+    - pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines
+    - gpio: dln2: Fix interrupts when replugging the device
+    - mmc: sdhci-tegra: Fix switch to HS400ES mode
+    - mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands
+    - mmc: core: Disable card detect during shutdown
+    - mmc: mmci: stm32: clear DLYB_CR after sending tuning command
+    - ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
+    - ksmbd: fix error code in ndr_read_int32()
+    - ksmbd: fix uninitialized symbol 'pntsd_size'
+    - ksmbd: disable SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
+    - mac80211: fix locking in ieee80211_start_ap error path
+    - mm: mempolicy: fix THP allocations escaping mempolicy restrictions
+    - mm, hwpoison: fix condition in free hugetlb page path
+    - mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
+    - mm/damon/dbgfs: protect targets destructions with kdamond_lock
+    - tee: optee: Fix incorrect page free bug
+    - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
+    - netfs: fix parameter of cleanup()
+    - KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
+    - arm64: dts: lx2160a: fix scl-gpios property name
+    - kfence: fix memory leak when cat kfence objects
+    - Input: iqs626a - prohibit inlining of channel parsing functions
+    - Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
+    - Input: goodix - add id->model mapping for the "9111" model
+    - ASoC: tas2770: Fix setting of high sample rates
+    - ASoC: SOF: Intel: pci-tgl: add new ADL-P variant
+    - ASoC: SOF: Intel: pci-tgl: add ADL-N support
+    - ASoC: rt5682: fix the wrong jack type detected
+    - pinctrl: mediatek: fix global-out-of-bounds issue
+    - hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
+    - hwmon: (lm90) Do not report 'busy' status bit as alarm
+    - r8152: sync ocp base
+    - ax25: NPD bug when detaching AX25 device
+    - hamradio: defer ax25 kfree after unregister_netdev
+    - hamradio: improve the incomplete fix to avoid NPD
+    - tun: avoid double free in tun_free_netdev
+    - phonet/pep: refuse to enable an unbound pipe
+    - Linux 5.15.12
+
+  * Thinkpad E14 Gen2: Kernel panic with trackpad and trackpoint enabled
+    (LP: #1945590) // Jammy update: v5.15.12 upstream stable release
+    (LP: #1956305)
+    - Input: elantech - fix stack out of bound access in
+      elantech_change_report_id()
+
+  * Jammy update: v5.15.11 upstream stable release (LP: #1956302)
+    - reset: tegra-bpmp: Revert Handle errors in BPMP response
+    - KVM: VMX: clear vmx_x86_ops.sync_pir_to_irr if APICv is disabled
+    - KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE
+    - KVM: downgrade two BUG_ONs to WARN_ON_ONCE
+    - x86/kvm: remove unused ack_notifier callbacks
+    - KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid()
+    - mac80211: fix rate control for retransmitted frames
+    - mac80211: fix regression in SSN handling of addba tx
+    - mac80211: mark TX-during-stop for TX in in_reconfig
+    - mac80211: send ADDBA requests using the tid/queue of the aggregation session
+    - mac80211: validate extended element ID is present
+    - firmware: arm_scpi: Fix string overflow in SCPI genpd driver
+    - bpf: Fix kernel address leakage in atomic fetch
+    - bpf, selftests: Add test case for atomic fetch on spilled pointer
+    - bpf: Fix signed bounds propagation after mov32
+    - bpf: Make 32->64 bounds propagation slightly more robust
+    - bpf, selftests: Add test case trying to taint map value pointer
+    - bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg
+    - bpf, selftests: Update test case for atomic cmpxchg on r0 with pointer
+    - vduse: fix memory corruption in vduse_dev_ioctl()
+    - vduse: check that offset is within bounds in get_config()
+    - virtio_ring: Fix querying of maximum DMA mapping size for virtio device
+    - vdpa: check that offsets are within bounds
+    - s390/entry: fix duplicate tracking of irq nesting level
+    - recordmcount.pl: look for jgnop instruction as well as bcrl on s390
+    - arm64: dts: ten64: remove redundant interrupt declaration for gpio-keys
+    - ceph: fix up non-directory creation in SGID directories
+    - dm btree remove: fix use after free in rebalance_children()
+    - audit: improve robustness of the audit queue handling
+    - btrfs: convert latest_bdev type to btrfs_device and rename
+    - btrfs: use latest_dev in btrfs_show_devname
+    - btrfs: update latest_dev when we create a sprout device
+    - btrfs: remove stale comment about the btrfs_show_devname
+    - scsi: ufs: core: Retry START_STOP on UNIT_ATTENTION
+    - arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-
+      edge
+    - arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply
+    - arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
+    - arm64: dts: rockchip: fix audio-supply for Rock Pi 4
+    - arm64: dts: rockchip: fix poweroff on helios64
+    - dmaengine: idxd: add halt interrupt support
+    - dmaengine: idxd: fix calling wq quiesce inside spinlock
+    - mac80211: track only QoS data frames for admission control
+    - tee: amdtee: fix an IS_ERR() vs NULL bug
+    - ceph: fix duplicate increment of opened_inodes metric
+    - ceph: initialize pathlen variable in reconnect_caps_cb
+    - ARM: socfpga: dts: fix qspi node compatible
+    - arm64: dts: imx8mq: remove interconnect property from lcdif
+    - clk: Don't parent clks until the parent is fully registered
+    - soc: imx: Register SoC device only on i.MX boards
+    - iwlwifi: mvm: don't crash on invalid rate w/o STA
+    - virtio: always enter drivers/virtio/
+    - virtio/vsock: fix the transport to work with VMADDR_CID_ANY
+    - vdpa: Consider device id larger than 31
+    - Revert "drm/fb-helper: improve DRM fbdev emulation device names"
+    - selftests: net: Correct ping6 expected rc from 2 to 1
+    - s390/kexec_file: fix error handling when applying relocations
+    - sch_cake: do not call cake_destroy() from cake_init()
+    - inet_diag: fix kernel-infoleak for UDP sockets
+    - netdevsim: don't overwrite read only ethtool parms
+    - selftests: icmp_redirect: pass xfail=0 to log_test()
+    - net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
+    - net: hns3: fix race condition in debugfs
+    - selftests: Add duplicate config only for MD5 VRF tests
+    - selftests: Fix raw socket bind tests with VRF
+    - selftests: Fix IPv6 address bind tests
+    - dmaengine: idxd: fix missed completion on abort path
+    - dmaengine: st_fdma: fix MODULE_ALIAS
+    - drm: simpledrm: fix wrong unit with pixel clock
+    - net/sched: sch_ets: don't remove idle classes from the round-robin list
+    - selftests/net: toeplitz: fix udp option
+    - net: dsa: mv88e6xxx: Unforce speed & duplex in mac_link_down()
+    - selftest/net/forwarding: declare NETIFS p9 p10
+    - mptcp: never allow the PM to close a listener subflow
+    - drm/ast: potential dereference of null pointer
+    - drm/i915/display: Fix an unsigned subtraction which can never be negative.
+    - mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
+    - cfg80211: Acquire wiphy mutex on regulatory work
+    - mac80211: fix lookup when adding AddBA extension element
+    - net: stmmac: fix tc flower deletion for VLAN priority Rx steering
+    - flow_offload: return EOPNOTSUPP for the unsupported mpls action type
+    - rds: memory leak in __rds_conn_create()
+    - ice: Use div64_u64 instead of div_u64 in adjfine
+    - ice: Don't put stale timestamps in the skb
+    - drm/amd/display: Set exit_optimized_pwr_state for DCN31
+    - drm/amd/pm: fix a potential gpu_metrics_table memory leak
+    - mptcp: remove tcp ulp setsockopt support
+    - mptcp: clear 'kern' flag from fallback sockets
+    - mptcp: fix deadlock in __mptcp_push_pending()
+    - soc/tegra: fuse: Fix bitwise vs. logical OR warning
+    - igb: Fix removal of unicast MAC filters of VFs
+    - igbvf: fix double free in `igbvf_probe`
+    - igc: Fix typo in i225 LTR functions
+    - ixgbe: Document how to enable NBASE-T support
+    - ixgbe: set X550 MDIO speed before talking to PHY
+    - netdevsim: Zero-initialize memory for new map's value in function
+      nsim_bpf_map_alloc
+    - net/packet: rx_owner_map depends on pg_vec
+    - net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup
+    - sfc_ef100: potential dereference of null pointer
+    - dsa: mv88e6xxx: fix debug print for SPEED_UNFORCED
+    - net: Fix double 0x prefix print in SKB dump
+    - net/smc: Prevent smc_release() from long blocking
+    - net: systemport: Add global locking for descriptor lifecycle
+    - sit: do not call ipip6_dev_free() from sit_init_net()
+    - afs: Fix mmap
+    - arm64: kexec: Fix missing error code 'ret' warning in load_other_segments()
+    - bpf: Fix extable fixup offset.
+    - bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
+    - powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n
+    - USB: gadget: bRequestType is a bitfield, not a enum
+    - Revert "usb: early: convert to readl_poll_timeout_atomic()"
+    - KVM: x86: Drop guest CPUID check for host initiated writes to
+      MSR_IA32_PERF_CAPABILITIES
+    - tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
+    - USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
+    - usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe
+    - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
+    - PCI/MSI: Mask MSI-X vectors only on success
+    - usb: xhci-mtk: fix list_del warning when enable list debug
+    - usb: xhci: Extend support for runtime power management for AMD's Yellow
+      carp.
+    - usb: cdnsp: Fix incorrect status for control request
+    - usb: cdnsp: Fix incorrect calling of cdnsp_died function
+    - usb: cdnsp: Fix issue in cdnsp_log_ep trace event
+    - usb: cdnsp: Fix lack of spin_lock_irqsave/spin_lock_restore
+    - usb: typec: tcpm: fix tcpm unregister port but leave a pending timer
+    - usb: gadget: u_ether: fix race in setting MAC address in setup phase
+    - USB: serial: cp210x: fix CP2105 GPIO registration
+    - USB: serial: option: add Telit FN990 compositions
+    - selinux: fix sleeping function called from invalid context
+    - btrfs: fix memory leak in __add_inode_ref()
+    - btrfs: fix double free of anon_dev after failure to create subvolume
+    - btrfs: check WRITE_ERR when trying to read an extent buffer
+    - btrfs: fix missing blkdev_put() call in btrfs_scan_one_device()
+    - zonefs: add MODULE_ALIAS_FS
+    - iocost: Fix divide-by-zero on donation from low hweight cgroup
+    - serial: 8250_fintek: Fix garbled text for console
+    - timekeeping: Really make sure wall_to_monotonic isn't positive
+    - cifs: sanitize multiple delimiters in prepath
+    - locking/rtmutex: Fix incorrect condition in rtmutex_spin_on_owner()
+    - riscv: dts: unleashed: Add gpio card detect to mmc-spi-slot
+    - riscv: dts: unmatched: Add gpio card detect to mmc-spi-slot
+    - perf inject: Fix segfault due to close without open
+    - perf inject: Fix segfault due to perf_data__fd() without open
+    - libata: if T_LENGTH is zero, dma direction should be DMA_NONE
+    - powerpc/module_64: Fix livepatching for RO modules
+    - drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
+    - drm/amdgpu: don't override default ECO_BITs setting
+    - drm/amd/pm: fix reading SMU FW version from amdgpu_firmware_info on YC
+    - Revert "can: m_can: remove support for custom bit timing"
+    - can: m_can: make custom bittiming fields const
+    - can: m_can: pci: use custom bit timings for Elkhart Lake
+    - ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
+    - xsk: Do not sleep in poll() when need_wakeup set
+    - mptcp: add missing documented NL params
+    - bpf, x64: Factor out emission of REX byte in more cases
+    - bpf: Fix extable address check.
+    - USB: core: Make do_proc_control() and do_proc_bulk() killable
+    - media: mxl111sf: change mutex_init() location
+    - fuse: annotate lock in fuse_reverse_inval_entry()
+    - ovl: fix warning in ovl_create_real()
+    - scsi: scsi_debug: Don't call kcalloc() if size arg is zero
+    - scsi: scsi_debug: Fix type in min_t to avoid stack OOB
+    - scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
+    - io-wq: remove spurious bit clear on task_work addition
+    - io-wq: check for wq exit after adding new worker task_work
+    - rcu: Mark accesses to rcu_state.n_force_qs
+    - io-wq: drop wqe lock before creating new worker
+    - bus: ti-sysc: Fix variable set but not used warning for reinit_modules
+    - selftests/damon: test debugfs file reads/writes with huge count
+    - Revert "xsk: Do not sleep in poll() when need_wakeup set"
+    - xen/blkfront: harden blkfront against event channel storms
+    - xen/netfront: harden netfront against event channel storms
+    - xen/console: harden hvc_xen against event channel storms
+    - xen/netback: fix rx queue stall detection
+    - xen/netback: don't queue unlimited number of packages
+    - Linux 5.15.11
+
+  * Jammy update: v5.15.10 upstream stable release (LP: #1956301)
+    - nfc: fix segfault in nfc_genl_dump_devices_done
+    - hwmon: (corsair-psu) fix plain integer used as NULL pointer
+    - RDMA: Fix use-after-free in rxe_queue_cleanup
+    - RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow
+    - mtd: rawnand: Fix nand_erase_op delay
+    - mtd: rawnand: Fix nand_choose_best_timings() on unsupported interface
+    - inet: use #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING consistently
+    - dt-bindings: media: nxp,imx7-mipi-csi2: Drop bad if/then schema
+    - clk: qcom: sm6125-gcc: Swap ops of ice and apps on sdcc1
+    - perf bpf_skel: Do not use typedef to avoid error on old clang
+    - netfs: Fix lockdep warning from taking sb_writers whilst holding mmap_lock
+    - RDMA/irdma: Fix a user-after-free in add_pble_prm
+    - RDMA/irdma: Fix a potential memory allocation issue in
+      'irdma_prm_add_pble_mem()'
+    - RDMA/irdma: Report correct WC errors
+    - RDMA/irdma: Don't arm the CQ more than two times if no CE for this CQ
+    - ice: fix FDIR init missing when reset VF
+    - vmxnet3: fix minimum vectors alloc issue
+    - i2c: virtio: fix completion handling
+    - drm/msm: Fix null ptr access msm_ioctl_gem_submit()
+    - drm/msm/a6xx: Fix uinitialized use of gpu_scid
+    - drm/msm/dsi: set default num_data_lanes
+    - drm/msm/dp: Avoid unpowered AUX xfers that caused crashes
+    - KVM: arm64: Save PSTATE early on exit
+    - s390/test_unwind: use raw opcode instead of invalid instruction
+    - Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
+    - net/mlx4_en: Update reported link modes for 1/10G
+    - loop: Use pr_warn_once() for loop_control_remove() warning
+    - ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
+    - ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
+    - parisc/agp: Annotate parisc agp init functions with __init
+    - i2c: rk3x: Handle a spurious start completion interrupt flag
+    - net: netlink: af_netlink: Prevent empty skb by adding a check on len.
+    - drm/amdgpu: cancel the correct hrtimer on exit
+    - drm/amdgpu: check atomic flag to differeniate with legacy path
+    - drm/amd/display: Fix for the no Audio bug with Tiled Displays
+    - drm/amdkfd: fix double free mem structure
+    - drm/amd/display: add connector type check for CRC source set
+    - drm/amdkfd: process_info lock not needed for svm
+    - tracing: Fix a kmemleak false positive in tracing_map
+    - staging: most: dim2: use device release method
+    - fuse: make sure reclaim doesn't write the inode
+    - perf inject: Fix itrace space allowed for new attributes
+    - Linux 5.15.10
+
+  * Jammy update: v5.15.9 upstream stable release (LP: #1955161)
+    - netfilter: selftest: conntrack_vrf.sh: fix file permission
+    - Linux 5.15.9
+
+  * [SRU][I/J/OEM-5.13/OEM-5.14] Fix pci port lost when hotplug dock
+    (LP: #1954646)
+    - PCI: Re-enable Downstream Port LTR after reset or hotplug
+
+  * Add support for NVIDIA EC backlight (LP: #1953286)
+    - platform/x86: Add driver for ACPI WMAA EC-based backlight control
+    - platform/x86: Remove "WMAA" from identifier names in wmaa-backlight-wmi.c
+    - platform/x86: Rename wmaa-backlight-wmi to nvidia-wmi-ec-backlight
+    - [Config] NVIDIA_WMI_EC_BACKLIGHT=m
+
+  * Improve USB Type-C support (LP: #1950974)
+    - usb: typec: ucsi: Always cancel the command if PPM reports BUSY condition
+    - usb: typec: ucsi: Don't stop alt mode registration on busy condition
+    - usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode
+      checking
+    - usb: typec: ucsi: acpi: Reduce the command completion timeout
+    - usb: typec: ucsi: Check the partner alt modes always if there is PD contract
+    - usb: typec: ucsi: Read the PDOs in separate work
+    - usb: typec: ucsi: Better fix for missing unplug events issue
+
+  *  Fix power button wakeup with shared IRQs on AMD platforms (LP: #1953540)
+    - pinctrl: amd: Fix wakeups when IRQ is shared with SCI
+
+  * AMD: Suspend not working when some cores are disabled through cpufreq
+    (LP: #1954930)
+    - ACPI: processor idle: Allow playing dead in C3 state
+
+  * Jammy update: v5.15.8 upstream stable release (LP: #1954931)
+    - Revert "UBUNTU: SAUCE: selftests: fib_tests: assign address to dummy1 for
+      rp_filter tests"
+    - usb: gadget: uvc: fix multiple opens
+    - HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
+    - HID: google: add eel USB id
+    - HID: intel-ish-hid: ipc: only enable IRQ wakeup when requested
+    - HID: add hid_is_usb() function to make it simpler for USB detection
+    - HID: add USB_HID dependancy to hid-prodikeys
+    - HID: add USB_HID dependancy to hid-chicony
+    - HID: add USB_HID dependancy on some USB HID drivers
+    - HID: bigbenff: prevent null pointer dereference
+    - HID: wacom: fix problems when device is not a valid USB device
+    - HID: check for valid USB device for many HID drivers
+    - mtd: dataflash: Add device-tree SPI IDs
+    - mmc: spi: Add device-tree SPI IDs
+    - HID: sony: fix error path in probe
+    - HID: Ignore battery for Elan touchscreen on Asus UX550VE
+    - platform/x86/intel: hid: add quirk to support Surface Go 3
+    - nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups
+    - IB/hfi1: Insure use of smp_processor_id() is preempt disabled
+    - IB/hfi1: Fix early init panic
+    - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
+    - can: kvaser_usb: get CAN clock frequency from device
+    - can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct
+      stats->{rx,tx}_errors counter
+    - can: sja1000: fix use after free in ems_pcmcia_add_card()
+    - can: pch_can: pch_can_rx_normal: fix use after free
+    - can: m_can: m_can_read_fifo: fix memory leak in error branch
+    - can: m_can: pci: fix incorrect reference clock rate
+    - can: m_can: pci: fix iomap_read_fifo() and iomap_write_fifo()
+    - can: m_can: Disable and ignore ELO interrupt
+    - net: dsa: mv88e6xxx: fix "don't use PHY_DETECT on internal PHY's"
+    - net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
+    - x86/sme: Explicitly map new EFI memmap table as encrypted
+    - platform/x86: amd-pmc: Fix s2idle failures on certain AMD laptops
+    - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
+    - selftests: netfilter: add a vrf+conntrack testcase
+    - vrf: don't run conntrack on vrf with !dflt qdisc
+    - bpf, x86: Fix "no previous prototype" warning
+    - bpf, sockmap: Attach map progs to psock early for feature probes
+    - bpf: Make sure bpf_disable_instrumentation() is safe vs preemption.
+    - bpf: Fix the off-by-two error in range markings
+    - ice: ignore dropped packets during init
+    - ethtool: do not perform operations on net devices being unregistered
+    - bonding: make tx_rebalance_counter an atomic
+    - nfp: Fix memory leak in nfp_cpp_area_cache_add()
+    - udp: using datalen to cap max gso segments
+    - netfilter: nft_exthdr: break evaluation if setting TCP option fails
+    - netfilter: conntrack: annotate data-races around ct->timeout
+    - iavf: restore MSI state on reset
+    - iavf: Fix reporting when setting descriptor count
+    - IB/hfi1: Correct guard on eager buffer deallocation
+    - devlink: fix netns refcount leak in devlink_nl_cmd_reload()
+    - net: bcm4908: Handle dma_set_coherent_mask error codes
+    - net: dsa: mv88e6xxx: error handling for serdes_power functions
+    - net: dsa: felix: Fix memory leak in felix_setup_mmio_filtering
+    - net/sched: fq_pie: prevent dismantle issue
+    - net: mvpp2: fix XDP rx queues registering
+    - KVM: x86: Don't WARN if userspace mucks with RCX during string I/O exit
+    - KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI req
+    - KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush
+      hypercall
+    - timers: implement usleep_idle_range()
+    - mm/damon/core: fix fake load reports due to uninterruptible sleeps
+    - mm/slub: fix endianness bug for alloc/free_traces attributes
+    - mm: bdi: initialize bdi_min_ratio when bdi is unregistered
+    - ALSA: ctl: Fix copy of updated id with element read/write
+    - ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
+    - ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
+    - ALSA: pcm: oss: Fix negative period/buffer sizes
+    - ALSA: pcm: oss: Limit the period size to 16MB
+    - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
+    - cifs: Fix crash on unload of cifs_arc4.ko
+    - scsi: qla2xxx: Format log strings only if needed
+    - btrfs: clear extent buffer uptodate when we fail to write it
+    - btrfs: fix re-dirty process of tree-log nodes
+    - btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
+    - btrfs: free exchange changeset on failures
+    - perf intel-pt: Fix some PGE (packet generation enable/control flow packets)
+      usage
+    - perf intel-pt: Fix sync state when a PSB (synchronization) packet is found
+    - perf intel-pt: Fix intel_pt_fup_event() assumptions about setting state type
+    - perf intel-pt: Fix state setting when receiving overflow (OVF) packet
+    - perf intel-pt: Fix next 'err' value, walking trace
+    - perf intel-pt: Fix missing 'instruction' events with 'q' option
+    - perf intel-pt: Fix error timestamp setting on the decoder error path
+    - md: fix update super 1.0 on rdev size change
+    - nfsd: fix use-after-free due to delegation race
+    - nfsd: Fix nsfd startup race (again)
+    - tracefs: Have new files inherit the ownership of their parent
+    - selftests: KVM: avoid failures due to reserved HyperTransport region
+    - hwmon: (pwm-fan) Ensure the fan going on in .probe()
+    - mmc: renesas_sdhi: initialize variable properly when tuning
+    - clk: qcom: regmap-mux: fix parent clock lookup
+    - thermal: int340x: Fix VCoRefLow MMIO bit offset for TGL
+    - drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
+    - libata: add horkage for ASMedia 1092
+    - io_uring: ensure task_work gets run as part of cancelations
+    - wait: add wake_up_pollfree()
+    - binder: use wake_up_pollfree()
+    - signalfd: use wake_up_pollfree()
+    - aio: keep poll requests on waitqueue until completed
+    - aio: fix use-after-free due to missing POLLFREE handling
+    - tracefs: Set all files to the same group ownership as the mount option
+    - i2c: mpc: Use atomic read and fix break condition
+    - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
+    - scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
+    - scsi: scsi_debug: Fix buffer size of REPORT ZONES command
+    - ALSA: usb-audio: Reorder snd_djm_devices[] entries
+    - qede: validate non LSO skb length
+    - PM: runtime: Fix pm_runtime_active() kerneldoc comment
+    - ASoC: rt5682: Fix crash due to out of scope stack vars
+    - ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer
+    - ASoC: codecs: wsa881x: fix return values from kcontrol put
+    - ASoC: codecs: wcd934x: handle channel mappping list correctly
+    - ASoC: codecs: wcd934x: return correct value from mixer put
+    - RDMA/hns: Do not halt commands during reset until later
+    - RDMA/hns: Do not destroy QP resources in the hw resetting phase
+    - hwmon: (dell-smm) Fix warning on /proc/i8k creation error
+    - clk: imx: use module_platform_driver
+    - clk: qcom: clk-alpha-pll: Don't reconfigure running Trion
+    - i40e: Fix failed opcode appearing if handling messages from VF
+    - i40e: Fix pre-set max number of queues for VF
+    - mtd: rawnand: fsmc: Take instruction delay into account
+    - mtd: rawnand: fsmc: Fix timing computation
+    - bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap
+    - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
+    - Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge"
+    - drm/amd/display: Fix DPIA outbox timeout after S3/S4/reset
+    - perf tools: Fix SMT detection fast read path
+    - Documentation/locking/locktypes: Update migrate_disable() bits.
+    - dt-bindings: net: Reintroduce PHY no lane swap binding
+    - tools build: Remove needless libpython-version feature check that breaks
+      test-all fast path
+    - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
+    - net: altera: set a couple error code in probe()
+    - net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
+    - net, neigh: clear whole pneigh_entry at alloc time
+    - net/qla3xxx: fix an error code in ql_adapter_up()
+    - selftests/fib_tests: Rework fib_rp_filter_test()
+    - USB: gadget: detect too-big endpoint 0 requests
+    - USB: gadget: zero allocate endpoint 0 buffers
+    - Revert "usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by default"
+    - usb: core: config: fix validation of wMaxPacketValue entries
+    - usb: core: config: using bit mask instead of individual bits
+    - xhci: avoid race between disable slot command and host runtime suspend
+    - iio: gyro: adxrs290: fix data signedness
+    - iio: trigger: Fix reference counting
+    - iio: trigger: stm32-timer: fix MODULE_ALIAS
+    - iio: stk3310: Don't return error code in interrupt handler
+    - iio: mma8452: Fix trigger reference couting
+    - iio: ltr501: Don't return error code in trigger handler
+    - iio: kxsd9: Don't return error code in trigger handler
+    - iio: itg3200: Call iio_trigger_notify_done() on error
+    - iio: dln2-adc: Fix lockdep complaint
+    - iio: dln2: Check return value of devm_iio_trigger_register()
+    - iio: at91-sama5d2: Fix incorrect sign extension
+    - iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
+    - iio: adc: axp20x_adc: fix charging current reporting on AXP22x
+    - iio: ad7768-1: Call iio_trigger_notify_done() on error
+    - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
+    - nvmem: eeprom: at25: fix FRAM byte_len
+    - bus: mhi: pci_generic: Fix device recovery failed issue
+    - bus: mhi: core: Add support for forced PM resume
+    - csky: fix typo of fpu config macro
+    - irqchip/aspeed-scu: Replace update_bits with write_bits.
+    - irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
+    - irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
+    - aio: Fix incorrect usage of eventfd_signal_allowed()
+    - irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
+    - irqchip: nvic: Fix offset for Interrupt Priority Offsets
+    - misc: fastrpc: fix improper packet size calculation
+    - clocksource/drivers/dw_apb_timer_of: Fix probe failure
+    - bpf: Add selftests to cover packet access corner cases
+    - Linux 5.15.8
+
+  * Can't read/write SD card after running CPU offline test in 5.11.0 and 5.13.0
+    (LP: #1951784) // Jammy update: v5.15.8 upstream stable release
+    (LP: #1954931)
+    - misc: rtsx: Avoid mangling IRQ during runtime PM
+
+  * Enable Landlock by default (LP: #1953192)
+    - [Config] Enable Landlock by default
+
+  * Add s0i3 RTC wake up for AMD systems (LP: #1950013)
+    - platform/x86: amd-pmc: Export Idlemask values based on the APU
+    - platform/x86: amd-pmc: adjust arguments for `amd_pmc_send_cmd`
+    - platform/x86: amd-pmc: Add special handling for timer based S0i3 wakeup
+
+  * Fix runtime power management on USB controller with XHCI_RESET_ON_RESUME
+    flag (LP: #1954369)
+    - SAUCE: xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime
+      suspending
+
+  * Fix System hangs on black screen when reboot (LP: #1949321)
+    - drm/i915/hdmi: convert intel_hdmi_to_dev to intel_hdmi_to_i915
+    - drm/i915: Don't request GMBUS to generate irqs when called while irqs are
+      off
+    - drm/i915/hdmi: Turn DP++ TMDS output buffers back on in encoder->shutdown()
+
+  * require CAP_NET_ADMIN to attach N_HCI ldisc (LP: #1949516)
+    - Bluetooth: hci_ldisc: require CAP_NET_ADMIN to attach N_HCI ldisc
+
+  * mt7921e: Failed to start WM firmware (LP: #1954300)
+    - SAUCE: Bluetooth: btusb: Handle download_firmware failure cases
+    - SAUCE: Bluetooth: btusb: Return error code when getting patch status failed
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Add list of built-in modules to the ABI
+    - [Packaging] abi-check: Process modules.builtin
+    - SAUCE: allow to use __wake_up_pollfree() from GPL modules
+    - [Packaging] enforce xz compression for debs
+    - [Config] update config after v5.15.12
+    - [Packaging] temporarily disable signed v4l2loopback
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 04 Jan 2022 11:22:10 +0100
+
+linux (5.15.0-14.14) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-14.14 -proposed tracker (LP: #1954627)
+
+  * Jammy update: v5.15.7 upstream stable release (LP: #1953731)
+    - ALSA: usb-audio: Restrict rates for the shared clocks
+    - ALSA: usb-audio: Rename early_playback_start flag with lowlatency_playback
+    - ALSA: usb-audio: Disable low-latency playback for free-wheel mode
+    - ALSA: usb-audio: Disable low-latency mode for implicit feedback sync
+    - ALSA: usb-audio: Check available frames for the next packet size
+    - ALSA: usb-audio: Add spinlock to stop_urbs()
+    - ALSA: usb-audio: Improved lowlatency playback support
+    - ALSA: usb-audio: Avoid killing in-flight URBs during draining
+    - ALSA: usb-audio: Fix packet size calculation regression
+    - ALSA: usb-audio: Less restriction for low-latency playback mode
+    - ALSA: usb-audio: Switch back to non-latency mode at a later point
+    - ALSA: usb-audio: Don't start stream for capture at prepare
+    - gfs2: release iopen glock early in evict
+    - gfs2: Fix length of holes reported at end-of-file
+    - powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for
+      persistent memory"
+    - powerpc/pseries/ddw: Do not try direct mapping with persistent memory and
+      one window
+    - drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY
+    - mac80211: do not access the IV when it was stripped
+    - mac80211: fix throughput LED trigger
+    - x86/hyperv: Move required MSRs check to initial platform probing
+    - net/smc: Transfer remaining wait queue entries during fallback
+    - atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
+    - net: return correct error code
+    - pinctrl: qcom: fix unmet dependencies on GPIOLIB for GPIOLIB_IRQCHIP
+    - platform/x86: dell-wmi-descriptor: disable by default
+    - platform/x86: thinkpad_acpi: Add support for dual fan control
+    - platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
+    - s390/setup: avoid using memblock_enforce_memory_limit
+    - btrfs: silence lockdep when reading chunk tree during mount
+    - btrfs: check-integrity: fix a warning on write caching disabled disk
+    - thermal: core: Reset previous low and high trip during thermal zone init
+    - scsi: iscsi: Unblock session then wake up error handler
+    - drm/amd/pm: Remove artificial freq level on Navi1x
+    - drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
+    - drm/amd/amdgpu: fix potential memleak
+    - ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
+    - ata: libahci: Adjust behavior when StorageD3Enable _DSD is set
+    - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in
+      hns_dsaf_ge_srst_by_port()
+    - ipv6: check return value of ipv6_skip_exthdr
+    - net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of
+      bound
+    - net: ethernet: dec: tulip: de4x5: fix possible array overflows in
+      type3_infoblock()
+    - perf sort: Fix the 'weight' sort key behavior
+    - perf sort: Fix the 'ins_lat' sort key behavior
+    - perf sort: Fix the 'p_stage_cyc' sort key behavior
+    - perf inject: Fix ARM SPE handling
+    - perf hist: Fix memory leak of a perf_hpp_fmt
+    - perf report: Fix memory leaks around perf_tip()
+    - tracing: Don't use out-of-sync va_list in event printing
+    - net/smc: Avoid warning of possible recursive locking
+    - ACPI: Add stubs for wakeup handler functions
+    - net/tls: Fix authentication failure in CCM mode
+    - vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
+    - kprobes: Limit max data_size of the kretprobe instances
+    - ALSA: hda/cs8409: Set PMSG_ON earlier inside cs8409 driver
+    - rt2x00: do not mark device gone on EPROTO errors during start
+    - ipmi: Move remove_work to dedicated workqueue
+    - cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
+    - iwlwifi: mvm: retry init flow if failed
+    - dma-buf: system_heap: Use 'for_each_sgtable_sg' in pages free flow
+    - s390/pci: move pseudo-MMIO to prevent MIO overlap
+    - fget: check that the fd still exists after getting a ref to it
+    - sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
+    - sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
+    - scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO
+    - scsi: ufs: ufs-pci: Add support for Intel ADL
+    - ipv6: fix memory leak in fib6_rule_suppress
+    - drm/amd/display: Allow DSC on supported MST branch devices
+    - drm/i915/dp: Perform 30ms delay after source OUI write
+    - KVM: fix avic_set_running for preemptable kernels
+    - KVM: Disallow user memslot with size that exceeds "unsigned long"
+    - KVM: x86/mmu: Fix TLB flush range when handling disconnected pt
+    - KVM: Ensure local memslot copies operate on up-to-date arch-specific data
+    - KVM: x86: ignore APICv if LAPIC is not enabled
+    - KVM: nVMX: Emulate guest TLB flush on nested VM-Enter with new vpid12
+    - KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST
+    - KVM: nVMX: Abide to KVM_REQ_TLB_FLUSH_GUEST request on nested vmentry/vmexit
+    - KVM: VMX: prepare sync_pir_to_irr for running with APICv disabled
+    - KVM: x86: Use a stable condition around all VT-d PI paths
+    - KVM: MMU: shadow nested paging does not have PKU
+    - KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1
+    - KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
+    - KVM: x86: check PIR even for vCPUs with disabled APICv
+    - tracing/histograms: String compares should not care about signed values
+    - net: dsa: mv88e6xxx: Fix application of erratum 4.8 for 88E6393X
+    - net: dsa: mv88e6xxx: Drop unnecessary check in
+      mv88e6393x_serdes_erratum_4_6()
+    - net: dsa: mv88e6xxx: Save power by disabling SerDes trasmitter and receiver
+    - net: dsa: mv88e6xxx: Add fix for erratum 5.2 of 88E6393X family
+    - net: dsa: mv88e6xxx: Fix inband AN for 2500base-x on 88E6393X family
+    - net: dsa: mv88e6xxx: Link in pcs_get_state() if AN is bypassed
+    - wireguard: selftests: increase default dmesg log size
+    - wireguard: allowedips: add missing __rcu annotation to satisfy sparse
+    - wireguard: selftests: actually test for routing loops
+    - wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST
+    - wireguard: device: reset peer src endpoint when netns exits
+    - wireguard: receive: use ring buffer for incoming handshakes
+    - wireguard: receive: drop handshakes if queue lock is contended
+    - wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
+    - i2c: stm32f7: flush TX FIFO upon transfer errors
+    - i2c: stm32f7: recover the bus on access timeout
+    - i2c: stm32f7: stop dma transfer in case of NACK
+    - i2c: cbus-gpio: set atomic transfer callback
+    - natsemi: xtensa: fix section mismatch warnings
+    - tcp: fix page frag corruption on page fault
+    - net: qlogic: qlcnic: Fix a NULL pointer dereference in
+      qlcnic_83xx_add_rings()
+    - net: mpls: Fix notifications when deleting a device
+    - siphash: use _unaligned version by default
+    - arm64: ftrace: add missing BTIs
+    - iwlwifi: fix warnings produced by kernel debug options
+    - net/mlx5e: IPsec: Fix Software parser inner l3 type setting in case of
+      encapsulation
+    - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
+    - selftests: net: Correct case name
+    - net: dsa: b53: Add SPI ID table
+    - mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
+    - ASoC: tegra: Fix wrong value type in ADMAIF
+    - ASoC: tegra: Fix wrong value type in I2S
+    - ASoC: tegra: Fix wrong value type in DMIC
+    - ASoC: tegra: Fix wrong value type in DSPK
+    - ASoC: tegra: Fix kcontrol put callback in ADMAIF
+    - ASoC: tegra: Fix kcontrol put callback in I2S
+    - ASoC: tegra: Fix kcontrol put callback in DMIC
+    - ASoC: tegra: Fix kcontrol put callback in DSPK
+    - ASoC: tegra: Fix kcontrol put callback in AHUB
+    - rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
+    - rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
+    - ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec
+    - net: stmmac: Avoid DMA_CHAN_CONTROL write if no Split Header support
+    - net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ
+      is available
+    - net: marvell: mvpp2: Fix the computation of shared CPUs
+    - dpaa2-eth: destroy workqueue at the end of remove function
+    - octeontx2-af: Fix a memleak bug in rvu_mbox_init()
+    - net: annotate data-races on txq->xmit_lock_owner
+    - ipv4: convert fib_num_tclassid_users to atomic_t
+    - net/smc: fix wrong list_del in smc_lgr_cleanup_early
+    - net/rds: correct socket tunable error in rds_tcp_tune()
+    - net/smc: Keep smc_close_final rc during active close
+    - drm/msm/a6xx: Allocate enough space for GMU registers
+    - drm/msm: Do hw_init() before capturing GPU state
+    - drm/vc4: kms: Wait for the commit before increasing our clock rate
+    - drm/vc4: kms: Fix return code check
+    - drm/vc4: kms: Add missing drm_crtc_commit_put
+    - drm/vc4: kms: Clear the HVS FIFO commit pointer once done
+    - drm/vc4: kms: Don't duplicate pending commit
+    - drm/vc4: kms: Fix previous HVS commit wait
+    - atlantic: Increase delay for fw transactions
+    - atlatnic: enable Nbase-t speeds with base-t
+    - atlantic: Fix to display FW bundle version instead of FW mac version.
+    - atlantic: Add missing DIDs and fix 115c.
+    - Remove Half duplex mode speed capabilities.
+    - atlantic: Fix statistics logic for production hardware
+    - atlantic: Remove warn trace message.
+    - KVM: x86/mmu: Skip tlb flush if it has been done in zap_gfn_range()
+    - KVM: x86/mmu: Pass parameter flush as false in
+      kvm_tdp_mmu_zap_collapsible_sptes()
+    - drm/msm/devfreq: Fix OPP refcnt leak
+    - drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP
+    - drm/msm: Fix wait_fence submitqueue leak
+    - drm/msm: Restore error return on invalid fence
+    - ASoC: rk817: Add module alias for rk817-codec
+    - iwlwifi: Fix memory leaks in error handling path
+    - KVM: X86: Fix when shadow_root_level=5 && guest root_level<4
+    - KVM: SEV: initialize regions_list of a mirror VM
+    - net/mlx5e: Fix missing IPsec statistics on uplink representor
+    - net/mlx5: Move MODIFY_RQT command to ignore list in internal error state
+    - net/mlx5: E-switch, Respect BW share of the new group
+    - net/mlx5: E-Switch, fix single FDB creation on BlueField
+    - net/mlx5: E-Switch, Check group pointer before reading bw_share value
+    - KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
+    - KVM: VMX: Set failure code in prepare_vmcs02()
+    - mctp: Don't let RTM_DELROUTE delete local routes
+    - Revert "drm/i915: Implement Wa_1508744258"
+    - io-wq: don't retry task_work creation failure on fatal conditions
+    - x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
+    - x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
+    - x86/entry: Use the correct fence macro after swapgs in kernel CR3
+    - x86/xen: Add xenpv_restore_regs_and_return_to_usermode()
+    - preempt/dynamic: Fix setup_preempt_mode() return value
+    - sched/uclamp: Fix rq->uclamp_max not set on first enqueue
+    - KVM: SEV: Return appropriate error codes if SEV-ES scratch setup fails
+    - KVM: x86/mmu: Rename slot_handle_leaf to slot_handle_level_4k
+    - KVM: x86/mmu: Remove spurious TLB flushes in TDP MMU zap collapsible path
+    - net/mlx5e: Rename lro_timeout to packet_merge_timeout
+    - net/mlx5e: Rename TIR lro functions to TIR packet merge functions
+    - net/mlx5e: Sync TIR params updates against concurrent create/modify
+    - serial: 8250_bcm7271: UART errors after resuming from S2
+    - parisc: Fix KBUILD_IMAGE for self-extracting kernel
+    - parisc: Fix "make install" on newer debian releases
+    - parisc: Mark cr16 CPU clocksource unstable on all SMP machines
+    - vgacon: Propagate console boot parameters before calling `vc_resize'
+    - xhci: Fix commad ring abort, write all 64 bits to CRCR register.
+    - USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
+    - usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
+    - usb: cdns3: gadget: fix new urb never complete if ep cancel previous
+      requests
+    - usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()
+    - x86/tsc: Add a timer to make sure TSC_adjust is always checked
+    - x86/tsc: Disable clocksource watchdog for TSC on qualified platorms
+    - x86/64/mm: Map all kernel memory into trampoline_pgd
+    - tty: serial: msm_serial: Deactivate RX DMA for polling support
+    - serial: pl011: Add ACPI SBSA UART match id
+    - serial: tegra: Change lower tolerance baud rate limit for tegra20 and
+      tegra30
+    - serial: core: fix transmit-buffer reset and memleak
+    - serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
+    - serial: 8250_pci: rewrite pericom_do_set_divisor()
+    - serial: 8250: Fix RTS modem control while in rs485 mode
+    - serial: liteuart: Fix NULL pointer dereference in ->remove()
+    - serial: liteuart: fix use-after-free and memleak on unbind
+    - serial: liteuart: fix minor-number leak on probe errors
+    - ipmi: msghandler: Make symbol 'remove_work_wq' static
+    - Linux 5.15.7
+
+  * Updates to ib_peer_memory requested by Nvidia (LP: #1947206)
+    - SAUCE: RDMA/core: Updated ib_peer_memory
+    - SAUCE: RDMA/core: ib_peer_memory fix build errors
+
+  * Jammy update: v5.15.6 upstream stable release (LP: #1953370)
+    - scsi: sd: Fix sd_do_mode_sense() buffer length handling
+    - ACPI: Get acpi_device's parent from the parent field
+    - ACPI: CPPC: Add NULL pointer check to cppc_get_perf()
+    - USB: serial: pl2303: fix GC type detection
+    - USB: serial: option: add Telit LE910S1 0x9200 composition
+    - USB: serial: option: add Fibocom FM101-GL variants
+    - usb: dwc2: gadget: Fix ISOC flow for elapsed frames
+    - usb: dwc2: hcd_queue: Fix use of floating point literal
+    - usb: dwc3: leave default DMA for PCI devices
+    - usb: dwc3: core: Revise GHWPARAMS9 offset
+    - usb: dwc3: gadget: Ignore NoStream after End Transfer
+    - usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer
+    - usb: dwc3: gadget: Fix null pointer exception
+    - net: usb: Correct PHY handling of smsc95xx
+    - net: nexthop: fix null pointer dereference when IPv6 is not enabled
+    - usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe
+    - usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts
+    - usb: xhci: tegra: Check padctrl interrupt presence in device tree
+    - usb: hub: Fix usb enumeration issue due to address0 race
+    - usb: hub: Fix locking issues with address0_mutex
+    - binder: fix test regression due to sender_euid change
+    - ALSA: ctxfi: Fix out-of-range access
+    - ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100
+    - ALSA: hda/realtek: Fix LED on HP ProBook 435 G7
+    - media: cec: copy sequence field for the reply
+    - Revert "parisc: Fix backtrace to always include init funtion names"
+    - HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts
+    - staging/fbtft: Fix backlight
+    - staging: greybus: Add missing rwsem around snd_ctl_remove() calls
+    - staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
+    - staging: r8188eu: Use kzalloc() with GFP_ATOMIC in atomic context
+    - staging: r8188eu: Fix breakage introduced when 5G code was removed
+    - staging: r8188eu: use GFP_ATOMIC under spinlock
+    - staging: r8188eu: fix a memory leak in rtw_wx_read32()
+    - fuse: release pipe buf after last use
+    - xen: don't continue xenstore initialization in case of errors
+    - xen: detect uninitialized xenbus in xenbus_init
+    - io_uring: correct link-list traversal locking
+    - io_uring: fail cancellation for EXITING tasks
+    - io_uring: fix link traversal locking
+    - drm/amdgpu: IH process reset count when restart
+    - drm/amdgpu/pm: fix powerplay OD interface
+    - drm/nouveau: recognise GA106
+    - ksmbd: downgrade addition info error msg to debug in smb2_get_info_sec()
+    - ksmbd: contain default data stream even if xattr is empty
+    - ksmbd: fix memleak in get_file_stream_info()
+    - KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB
+    - tracing/uprobe: Fix uprobe_perf_open probes iteration
+    - tracing: Fix pid filtering when triggers are attached
+    - mmc: sdhci-esdhc-imx: disable CMDQ support
+    - mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB
+    - mdio: aspeed: Fix "Link is Down" issue
+    - arm64: mm: Fix VM_BUG_ON(mm != &init_mm) for trans_pgd
+    - cpufreq: intel_pstate: Fix active mode offline/online EPP handling
+    - powerpc/32: Fix hardlockup on vmap stack overflow
+    - iomap: Fix inline extent handling in iomap_readpage
+    - NFSv42: Fix pagecache invalidation after COPY/CLONE
+    - PCI: aardvark: Deduplicate code in advk_pcie_rd_conf()
+    - PCI: aardvark: Implement re-issuing config requests on CRS response
+    - PCI: aardvark: Simplify initialization of rootcap on virtual bridge
+    - PCI: aardvark: Fix link training
+    - drm/amd/display: Fix OLED brightness control on eDP
+    - proc/vmcore: fix clearing user buffer by properly using clear_user()
+    - ASoC: SOF: Intel: hda: fix hotplug when only codec is suspended
+    - netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY
+    - netfilter: ctnetlink: do not erase error code with EINVAL
+    - netfilter: ipvs: Fix reuse connection if RS weight is 0
+    - netfilter: flowtable: fix IPv6 tunnel addr match
+    - media: v4l2-core: fix VIDIOC_DQEVENT handling on non-x86
+    - firmware: arm_scmi: Fix null de-reference on error path
+    - ARM: dts: BCM5301X: Fix I2C controller interrupt
+    - ARM: dts: BCM5301X: Add interrupt properties to GPIO node
+    - ARM: dts: bcm2711: Fix PCIe interrupts
+    - ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer
+    - ASoC: qdsp6: q6asm: fix q6asm_dai_prepare error handling
+    - ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
+    - ASoC: codecs: wcd938x: fix volatile register range
+    - ASoC: codecs: wcd934x: return error code correctly from hw_params
+    - ASoC: codecs: lpass-rx-macro: fix HPHR setting CLSH mask
+    - net: ieee802154: handle iftypes as u32
+    - firmware: arm_scmi: Fix base agent discover response
+    - firmware: arm_scmi: pm: Propagate return value to caller
+    - ASoC: stm32: i2s: fix 32 bits channel length without mclk
+    - NFSv42: Don't fail clone() unless the OP_CLONE operation failed
+    - ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
+    - drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks
+    - scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo()
+    - scsi: mpt3sas: Fix kernel panic during drive powercycle test
+    - scsi: mpt3sas: Fix system going into read-only mode
+    - scsi: mpt3sas: Fix incorrect system timestamp
+    - drm/vc4: fix error code in vc4_create_object()
+    - drm/aspeed: Fix vga_pw sysfs output
+    - net: marvell: prestera: fix brige port operation
+    - net: marvell: prestera: fix double free issue on err path
+    - HID: input: Fix parsing of HID_CP_CONSUMER_CONTROL fields
+    - HID: input: set usage type to key on keycode remap
+    - HID: magicmouse: prevent division by 0 on scroll
+    - iavf: Prevent changing static ITR values if adaptive moderation is on
+    - iavf: Fix refreshing iavf adapter stats on ethtool request
+    - iavf: Fix VLAN feature flags after VFR
+    - x86/pvh: add prototype for xen_pvh_init()
+    - xen/pvh: add missing prototype to header
+    - ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec
+    - mptcp: fix delack timer
+    - mptcp: use delegate action to schedule 3rd ack retrans
+    - af_unix: fix regression in read after shutdown
+    - firmware: smccc: Fix check for ARCH_SOC_ID not implemented
+    - ipv6: fix typos in __ip6_finish_output()
+    - nfp: checking parameter process for rx-usecs/tx-usecs is invalid
+    - net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls
+    - net: ipv6: add fib6_nh_release_dsts stub
+    - net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group
+    - ice: fix vsi->txq_map sizing
+    - ice: avoid bpf_prog refcount underflow
+    - scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
+    - scsi: scsi_debug: Zero clear zones at reset write pointer
+    - erofs: fix deadlock when shrink erofs slab
+    - i2c: virtio: disable timeout handling
+    - net/smc: Ensure the active closing peer first closes clcsock
+    - mlxsw: spectrum: Protect driver from buggy firmware
+    - net: ipa: directly disable ipa-setup-ready interrupt
+    - net: ipa: separate disabling setup from modem stop
+    - net: ipa: kill ipa_cmd_pipeline_clear()
+    - net: marvell: mvpp2: increase MTU limit when XDP enabled
+    - cpufreq: intel_pstate: Add Ice Lake server to out-of-band IDs
+    - nvmet-tcp: fix incomplete data digest send
+    - drm/hyperv: Fix device removal on Gen1 VMs
+    - arm64: uaccess: avoid blocking within critical sections
+    - net/ncsi : Add payload to be 32-bit aligned to fix dropped packets
+    - PM: hibernate: use correct mode for swsusp_close()
+    - drm/amd/display: Fix DPIA outbox timeout after GPU reset
+    - drm/amd/display: Set plane update flags for all planes in reset
+    - tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited
+      flows
+    - lan743x: fix deadlock in lan743x_phy_link_status_change()
+    - net: phylink: Force link down and retrigger resolve on interface change
+    - net: phylink: Force retrigger in case of latched link-fail indicator
+    - net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
+    - net/smc: Fix loop in smc_listen
+    - nvmet: use IOCB_NOWAIT only if the filesystem supports it
+    - igb: fix netpoll exit with traffic
+    - MIPS: loongson64: fix FTLB configuration
+    - MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
+    - tls: splice_read: fix record type check
+    - tls: splice_read: fix accessing pre-processed records
+    - tls: fix replacing proto_ops
+    - net: stmmac: Disable Tx queues when reconfiguring the interface
+    - net/sched: sch_ets: don't peek at classes beyond 'nbands'
+    - ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
+    - net: vlan: fix underflow for the real_dev refcnt
+    - net/smc: Don't call clcsock shutdown twice when smc shutdown
+    - net: hns3: fix VF RSS failed problem after PF enable multi-TCs
+    - net: hns3: fix incorrect components info of ethtool --reset command
+    - net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP
+    - net: mscc: ocelot: correctly report the timestamping RX filters in ethtool
+    - locking/rwsem: Make handoff bit handling more consistent
+    - perf: Ignore sigtrap for tracepoints destined for other tasks
+    - sched/scs: Reset task stack state in bringup_cpu()
+    - iommu/rockchip: Fix PAGE_DESC_HI_MASKs for RK3568
+    - iommu/vt-d: Fix unmap_pages support
+    - f2fs: quota: fix potential deadlock
+    - f2fs: set SBI_NEED_FSCK flag when inconsistent node block found
+    - riscv: dts: microchip: fix board compatible
+    - riscv: dts: microchip: drop duplicated MMC/SDHC node
+    - cifs: nosharesock should not share socket with future sessions
+    - ceph: properly handle statfs on multifs setups
+    - iommu/amd: Clarify AMD IOMMUv2 initialization messages
+    - vdpa_sim: avoid putting an uninitialized iova_domain
+    - vhost/vsock: fix incorrect used length reported to the guest
+    - ksmbd: Fix an error handling path in 'smb2_sess_setup()'
+    - tracing: Check pid filtering when creating events
+    - cifs: nosharesock should be set on new server
+    - io_uring: fix soft lockup when call __io_remove_buffers
+    - firmware: arm_scmi: Fix type error assignment in voltage protocol
+    - firmware: arm_scmi: Fix type error in sensor protocol
+    - docs: accounting: update delay-accounting.rst reference
+    - blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and
+      disk_release()
+    - block: avoid to quiesce queue in elevator_init_mq
+    - drm/amdgpu/gfx10: add wraparound gpu counter check for APUs as well
+    - drm/amdgpu/gfx9: switch to golden tsc registers for renoir+
+    - Linux 5.15.6
+
+  * Fix bogus HDMI audio interface  (LP: #1953208)
+    - ALSA: hda/hdmi: Consider ELD is invalid when no SAD is present
+
+  * Miscellaneous Ubuntu changes
+    - [Config] re-enabled UBSAN without TRAP
+    - SAUCE: ipv6: fix NULL pointer dereference in ip6_output()
+    - SAUCE: RDMA/core: Introduce peer memory interface
+    - [Config] toolchain version update
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] Temporarily disable signing for ppc64el and s390x"
+    - Revert "UBUNTU: SAUCE: vt -- maintain bootloader screen mode and content
+      until vt switch"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 13 Dec 2021 12:13:17 +0100
+
+linux (5.15.0-13.13) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-13.13 -proposed tracker (LP: #1952583)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync update-dkms-versions helper
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Jammy update: v5.15.5 upstream stable release (LP: #1952579)
+    - arm64: zynqmp: Do not duplicate flash partition label property
+    - arm64: zynqmp: Fix serial compatible string
+    - clk: sunxi-ng: Unregister clocks/resets when unbinding
+    - ARM: dts: sunxi: Fix OPPs node name
+    - arm64: dts: allwinner: h5: Fix GPU thermal zone node name
+    - arm64: dts: allwinner: a100: Fix thermal zone node name
+    - staging: wfx: ensure IRQ is ready before enabling it
+    - ARM: dts: BCM5301X: Fix nodes names
+    - ARM: dts: BCM5301X: Fix MDIO mux binding
+    - ARM: dts: NSP: Fix mpcore, mmc node names
+    - arm64: dts: broadcom: bcm4908: Move reboot syscon out of bus
+    - scsi: pm80xx: Fix memory leak during rmmod
+    - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
+    - ASoC: mediatek: mt8195: Add missing of_node_put()
+    - arm64: dts: rockchip: Disable CDN DP on Pinebook Pro
+    - arm64: dts: hisilicon: fix arm,sp805 compatible string
+    - RDMA/bnxt_re: Check if the vlan is valid before reporting
+    - bus: ti-sysc: Add quirk handling for reinit on context lost
+    - bus: ti-sysc: Use context lost quirk for otg
+    - usb: musb: tusb6010: check return value after calling
+      platform_get_resource()
+    - usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
+    - ARM: dts: ux500: Skomer regulator fixes
+    - staging: rtl8723bs: remove possible deadlock when disconnect (v2)
+    - staging: rtl8723bs: remove a second possible deadlock
+    - staging: rtl8723bs: remove a third possible deadlock
+    - ARM: BCM53016: Specify switch ports for Meraki MR32
+    - arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency
+    - arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property
+    - arm64: dts: qcom: ipq8074: Fix qcom,controlled-remotely property
+    - arm64: dts: qcom: sdm845: Fix qcom,controlled-remotely property
+    - arm64: dts: freescale: fix arm,sp805 compatible string
+    - arm64: dts: ls1012a: Add serial alias for ls1012a-rdb
+    - RDMA/rxe: Separate HW and SW l/rkeys
+    - ASoC: SOF: Intel: hda-dai: fix potential locking issue
+    - scsi: core: Fix scsi_mode_sense() buffer length handling
+    - ALSA: usb-audio: disable implicit feedback sync for Behringer UFX1204 and
+      UFX1604
+    - clk: imx: imx6ul: Move csi_sel mux to correct base register
+    - ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
+    - ASoC: rt5651: Use IRQF_NO_AUTOEN when requesting the IRQ
+    - ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect
+    - scsi: advansys: Fix kernel pointer leak
+    - scsi: smartpqi: Add controller handshake during kdump
+    - arm64: dts: imx8mm-kontron: Fix reset delays for ethernet PHY
+    - ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336
+      codec
+    - ASoC: Intel: soc-acpi: add missing quirk for TGL SDCA single amp
+    - ASoC: Intel: sof_sdw: add missing quirk for Dell SKU 0A45
+    - firmware_loader: fix pre-allocated buf built-in firmware use
+    - HID: multitouch: disable sticky fingers for UPERFECT Y
+    - ALSA: usb-audio: Add support for the Pioneer DJM 750MK2 Mixer/Soundcard
+    - ARM: dts: omap: fix gpmc,mux-add-data type
+    - usb: host: ohci-tmio: check return value after calling
+      platform_get_resource()
+    - ASoC: rt5682: fix a little pop while playback
+    - ARM: dts: ls1021a: move thermal-zones node out of soc/
+    - ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash
+    - ALSA: ISA: not for M68K
+    - iommu/vt-d: Do not falsely log intel_iommu is unsupported kernel option
+    - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
+    - MIPS: sni: Fix the build
+    - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
+    - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
+    - scsi: target: Fix ordered tag handling
+    - scsi: target: Fix alua_tg_pt_gps_count tracking
+    - iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr()
+    - RDMA/core: Use kvzalloc when allocating the struct ib_port
+    - scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
+    - scsi: lpfc: Fix link down processing to address NULL pointer dereference
+    - scsi: lpfc: Allow fabric node recovery if recovery is in progress before
+      devloss
+    - memory: tegra20-emc: Add runtime dependency on devfreq governor module
+    - powerpc/5200: dts: fix memory node unit name
+    - ARM: dts: qcom: fix memory and mdio nodes naming for RB3011
+    - arm64: dts: qcom: Fix node name of rpm-msg-ram device nodes
+    - ALSA: gus: fix null pointer dereference on pointer block
+    - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
+    - clk: at91: sama7g5: remove prescaler part of master clock
+    - iommu/dart: Initialize DART_STREAMS_ENABLE
+    - powerpc/dcr: Use cmplwi instead of 3-argument cmpli
+    - powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST
+    - sh: check return code of request_irq
+    - maple: fix wrong return value of maple_bus_init().
+    - f2fs: fix up f2fs_lookup tracepoints
+    - f2fs: fix to use WHINT_MODE
+    - f2fs: fix wrong condition to trigger background checkpoint correctly
+    - sh: fix kconfig unmet dependency warning for FRAME_POINTER
+    - sh: math-emu: drop unused functions
+    - sh: define __BIG_ENDIAN for math-emu
+    - f2fs: compress: disallow disabling compress on non-empty compressed file
+    - f2fs: fix incorrect return value in f2fs_sanity_check_ckpt()
+    - clk: ingenic: Fix bugs with divided dividers
+    - clk/ast2600: Fix soc revision for AHB
+    - clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk
+    - KVM: arm64: Fix host stage-2 finalization
+    - mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
+    - MIPS: boot/compressed/: add __bswapdi2() to target for ZSTD decompression
+    - sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
+    - sched/fair: Prevent dead task groups from regaining cfs_rq's
+    - perf/x86/vlbr: Add c->flags to vlbr event constraints
+    - blkcg: Remove extra blkcg_bio_issue_init
+    - tracing/histogram: Do not copy the fixed-size char array field over the
+      field size
+    - perf bpf: Avoid memory leak from perf_env__insert_btf()
+    - perf bench futex: Fix memory leak of perf_cpu_map__new()
+    - perf tests: Remove bash construct from record+zstd_comp_decomp.sh
+    - drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame
+    - bpf: Fix inner map state pruning regression.
+    - samples/bpf: Fix summary per-sec stats in xdp_sample_user
+    - samples/bpf: Fix incorrect use of strlen in xdp_redirect_cpu
+    - selftests: net: switch to socat in the GSO GRE test
+    - net/ipa: ipa_resource: Fix wrong for loop range
+    - tcp: Fix uninitialized access in skb frags array for Rx 0cp.
+    - tracing: Add length protection to histogram string copies
+    - nl80211: fix radio statistics in survey dump
+    - mac80211: fix monitor_sdata RCU/locking assertions
+    - net: ipa: HOLB register sometimes must be written twice
+    - net: ipa: disable HOLB drop when updating timer
+    - selftests: gpio: fix gpio compiling error
+    - net: bnx2x: fix variable dereferenced before check
+    - bnxt_en: reject indirect blk offload when hw-tc-offload is off
+    - tipc: only accept encrypted MSG_CRYPTO msgs
+    - sock: fix /proc/net/sockstat underflow in sk_clone_lock()
+    - net/smc: Make sure the link_id is unique
+    - NFSD: Fix exposure in nfsd4_decode_bitmap()
+    - iavf: Fix return of set the new channel count
+    - iavf: check for null in iavf_fix_features
+    - iavf: free q_vectors before queues in iavf_disable_vf
+    - iavf: don't clear a lock we don't hold
+    - iavf: Fix failure to exit out from last all-multicast mode
+    - iavf: prevent accidental free of filter structure
+    - iavf: validate pointers
+    - iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
+    - iavf: Fix for setting queues to 0
+    - iavf: Restore VLAN filters after link down
+    - bpf: Fix toctou on read-only map's constant scalar tracking
+    - MIPS: generic/yamon-dt: fix uninitialized variable error
+    - mips: bcm63xx: add support for clk_get_parent()
+    - mips: lantiq: add support for clk_get_parent()
+    - gpio: rockchip: needs GENERIC_IRQ_CHIP to fix build errors
+    - platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
+    - platform/x86: think-lmi: Abort probe on analyze failure
+    - udp: Validate checksum in udp_read_sock()
+    - btrfs: make 1-bit bit-fields of scrub_page unsigned int
+    - RDMA/core: Set send and receive CQ before forwarding to the driver
+    - net/mlx5e: kTLS, Fix crash in RX resync flow
+    - net/mlx5e: Wait for concurrent flow deletion during neigh/fib events
+    - net/mlx5: E-Switch, Fix resetting of encap mode when entering switchdev
+    - net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
+    - net/mlx5: Update error handler for UCTX and UMEM
+    - net/mlx5: E-Switch, rebuild lag only when needed
+    - net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
+    - net/mlx5: Lag, update tracker when state change event received
+    - net/mlx5: E-Switch, return error if encap isn't supported
+    - scsi: ufs: core: Improve SCSI abort handling
+    - scsi: core: sysfs: Fix hang when device state is set via sysfs
+    - scsi: ufs: core: Fix task management completion timeout race
+    - scsi: ufs: core: Fix another task management completion race
+    - net: mvmdio: fix compilation warning
+    - net: sched: act_mirred: drop dst for the direction from egress to ingress
+    - net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
+    - net: virtio_net_hdr_to_skb: count transport header in UFO
+    - i40e: Fix correct max_pkt_size on VF RX queue
+    - i40e: Fix NULL ptr dereference on VSI filter sync
+    - i40e: Fix changing previously set num_queue_pairs for PFs
+    - i40e: Fix ping is lost after configuring ADq on VF
+    - RDMA/mlx4: Do not fail the registration on port stats
+    - i40e: Fix warning message and call stack during rmmod i40e driver
+    - i40e: Fix creation of first queue by omitting it if is not power of two
+    - i40e: Fix display error code in dmesg
+    - NFC: reorganize the functions in nci_request
+    - NFC: reorder the logic in nfc_{un,}register_device
+    - NFC: add NCI_UNREG flag to eliminate the race
+    - e100: fix device suspend/resume
+    - ptp: ocp: Fix a couple NULL vs IS_ERR() checks
+    - tools build: Fix removal of feature-sync-compare-and-swap feature detection
+    - riscv: fix building external modules
+    - KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr()
+    - powerpc: clean vdso32 and vdso64 directories
+    - powerpc/pseries: rename numa_dist_table to form2_distances
+    - powerpc/pseries: Fix numa FORM2 parsing fallback code
+    - pinctrl: qcom: sdm845: Enable dual edge errata
+    - pinctrl: qcom: sm8350: Correct UFS and SDC offsets
+    - perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
+    - perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
+    - perf/x86/intel/uncore: Fix IIO event constraints for Snowridge
+    - s390/kexec: fix return code handling
+    - blk-cgroup: fix missing put device in error path from blkg_conf_pref()
+    - dmaengine: remove debugfs #ifdef
+    - tun: fix bonding active backup with arp monitoring
+    - Revert "mark pstore-blk as broken"
+    - pstore/blk: Use "%lu" to format unsigned long
+    - hexagon: export raw I/O routines for modules
+    - hexagon: clean up timer-regs.h
+    - tipc: check for null after calling kmemdup
+    - ipc: WARN if trying to remove ipc object which is absent
+    - shm: extend forced shm destroy to support objects from several IPC nses
+    - mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
+    - hugetlb, userfaultfd: fix reservation restore on userfaultfd error
+    - kmap_local: don't assume kmap PTEs are linear arrays in memory
+    - mm/damon/dbgfs: use '__GFP_NOWARN' for user-specified size buffer allocation
+    - mm/damon/dbgfs: fix missed use of damon_dbgfs_lock
+    - x86/boot: Pull up cmdline preparation and early param parsing
+    - x86/sgx: Fix free page accounting
+    - x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
+    - KVM: x86: Assume a 64-bit hypercall for guests with protected state
+    - KVM: x86: Fix uninitialized eoi_exit_bitmap usage in vcpu_load_eoi_exitmap()
+    - KVM: x86/mmu: include EFER.LMA in extended mmu role
+    - KVM: x86/xen: Fix get_attr of KVM_XEN_ATTR_TYPE_SHARED_INFO
+    - powerpc/signal32: Fix sigset_t copy
+    - powerpc/xive: Change IRQ domain to a tree domain
+    - powerpc/8xx: Fix pinned TLBs with CONFIG_STRICT_KERNEL_RWX
+    - Revert "drm/i915/tgl/dsi: Gate the ddi clocks after pll mapping"
+    - Revert "parisc: Reduce sigreturn trampoline to 3 instructions"
+    - ata: libata: improve ata_read_log_page() error message
+    - ata: libata: add missing ata_identify_page_supported() calls
+    - scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id()
+    - pinctrl: ralink: include 'ralink_regs.h' in 'pinctrl-mt7620.c'
+    - s390/setup: avoid reserving memory above identity mapping
+    - s390/boot: simplify and fix kernel memory layout setup
+    - s390/vdso: filter out -mstack-guard and -mstack-size
+    - s390/kexec: fix memory leak of ipl report buffer
+    - s390/dump: fix copying to user-space of swapped kdump oldmem
+    - block: Check ADMIN before NICE for IOPRIO_CLASS_RT
+    - fbdev: Prevent probing generic drivers if a FB is already registered
+    - KVM: SEV: Disallow COPY_ENC_CONTEXT_FROM if target has created vCPUs
+    - KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested
+      state load
+    - drm/cma-helper: Release non-coherent memory with dma_free_noncoherent()
+    - printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces
+    - udf: Fix crash after seekdir
+    - spi: fix use-after-free of the add_lock mutex
+    - net: stmmac: socfpga: add runtime suspend/resume callback for stratix10
+      platform
+    - Drivers: hv: balloon: Use VMBUS_RING_SIZE() wrapper for dm_ring_size
+    - btrfs: fix memory ordering between normal and ordered work functions
+    - fs: handle circular mappings correctly
+    - net: stmmac: Fix signed/unsigned wreckage
+    - parisc/sticon: fix reverse colors
+    - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
+    - mac80211: fix radiotap header generation
+    - mac80211: drop check for DONT_REORDER in __ieee80211_select_queue
+    - drm/amd/display: Update swizzle mode enums
+    - drm/amd/display: Limit max DSC target bpp for specific monitors
+    - drm/i915/guc: Fix outstanding G2H accounting
+    - drm/i915/guc: Don't enable scheduling on a banned context, guc_id invalid,
+      not registered
+    - drm/i915/guc: Workaround reset G2H is received after schedule done G2H
+    - drm/i915/guc: Don't drop ce->guc_active.lock when unwinding context
+    - drm/i915/guc: Unwind context requests in reverse order
+    - drm/udl: fix control-message timeout
+    - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
+    - drm/nouveau: Add a dedicated mutex for the clients list
+    - drm/nouveau: use drm_dev_unplug() during device removal
+    - drm/nouveau: clean up all clients on device removal
+    - drm/i915/dp: Ensure sink rate values are always valid
+    - drm/i915/dp: Ensure max link params are always valid
+    - drm/i915: Fix type1 DVI DP dual mode adapter heuristic for modern platforms
+    - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga
+      and dvi connectors
+    - drm/amd/pm: avoid duplicate powergate/ungate setting
+    - signal: Implement force_fatal_sig
+    - exit/syscall_user_dispatch: Send ordinary signals on failure
+    - signal/powerpc: On swapcontext failure force SIGSEGV
+    - signal/s390: Use force_sigsegv in default_trap_handler
+    - signal/sparc32: Exit with a fatal signal when try_to_clear_window_buffer
+      fails
+    - signal/sparc32: In setup_rt_frame and setup_fram use force_fatal_sig
+    - signal/vm86_32: Properly send SIGSEGV when the vm86 state cannot be saved.
+    - signal/x86: In emulate_vsyscall force a signal instead of calling do_exit
+    - signal: Replace force_sigsegv(SIGSEGV) with force_fatal_sig(SIGSEGV)
+    - signal: Don't always set SA_IMMUTABLE for forced signals
+    - signal: Replace force_fatal_sig with force_exit_sig when in doubt
+    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare
+    - RDMA/netlink: Add __maybe_unused to static inline in C file
+    - bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs
+    - selinux: fix NULL-pointer dereference when hashtab allocation fails
+    - ASoC: DAPM: Cover regression by kctl change notification fix
+    - ASoC: rsnd: fixup DMAEngine API
+    - usb: max-3421: Use driver data instead of maintaining a list of bound
+      devices
+    - ice: Fix VF true promiscuous mode
+    - ice: Delete always true check of PF pointer
+    - fs: export an inode_update_time helper
+    - btrfs: update device path inode time instead of bd_inode
+    - net: add and use skb_unclone_keeptruesize() helper
+    - x86/Kconfig: Fix an unused variable error in dell-smm-hwmon
+    - ALSA: hda: hdac_ext_stream: fix potential locking issues
+    - ALSA: hda: hdac_stream: fix potential locking issue in
+      snd_hdac_stream_assign()
+    - Linux 5.15.5
+
+  * Fix non-working e1000e device after resume (LP: #1951861)
+    - SAUCE: Revert "e1000e: Additional PHY power saving in S0ix"
+    - SAUCE: Revert "e1000e: Add polling mechanism to indicate CSME DPG exit"
+    - SAUCE: Revert "e1000e: Add handshake with the CSME to support S0ix"
+
+  * [SRU][I/OEM-5.13/OEM-5.14] Add MAC passthrough support for more Lenovo docks
+    (LP: #1951767)
+    - net: usb: r8152: Add MAC passthrough support for more Lenovo Docks
+
+  * [amdgpu] USB4 support for DP tunneling (LP: #1951868)
+    - drm/amd/display: Support for DMUB HPD interrupt handling
+    - drm/amd/display: Update link encoder object creation.
+    - drm/amd/display: USB4 DPIA enumeration and AUX Tunneling
+    - drm/amd/display: Support for DMUB HPD and HPD RX interrupt handling
+    - drm/amd/display: Set DPIA link endpoint type
+    - drm/amd/display: Stub out DPIA link training call
+    - drm/amd/display: Add stub to get DPIA tunneling device data
+    - drm/amd/display: Skip DPCD read for DPTX-to-DPIA hop
+    - drm/amd/display: Train DPIA links with fallback
+    - drm/amd/display: Implement DPIA training loop
+    - drm/amd/display: Implement DPIA link configuration
+    - drm/amd/display: Implement DPIA clock recovery phase
+    - drm/amd/display: Implement DPIA equalisation phase
+    - drm/amd/display: Implement end of training for hop in DPIA display path
+    - drm/amd/display: Support for SET_CONFIG processing with DMUB
+    - drm/amd/display: isolate link training setting override to its own function
+    - drm/amd/display: Read USB4 DP tunneling data from DPCD.
+    - drm/amd/display: Add dpia debug options
+    - drm/amd/display: Support for SET_CONFIG processing with DMUB
+    - drm/amd/display: Add DPCD writes at key points
+    - drm/amd/display: Fix DIG_HPD_SELECT for USB4 display endpoints.
+    - drm/amd/display: Add helper for blanking all dp displays
+    - drm/amd/display: Fix link training fallback logic
+    - drm/amd/display: Add debug flags for USB4 DP link training.
+    - drm/amd/display: Fix dynamic link encoder access.
+    - drm/amd/display: Fix concurrent dynamic encoder assignment
+    - drm/amd/display: Fix dynamic encoder reassignment
+    - drm/amd/display: Fix for access for ddc pin and aux engine.
+    - drm/amd/display: Deadlock/HPD Status/Crash Bug Fix
+    - drm/amd/display: Fix USB4 Aux via DMUB terminate unexpectedly
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Rewrite debian/scripts/module-check in Python
+    - [Config] update config and annotations after applying v5.15.5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 29 Nov 2021 09:25:37 +0100
+
+linux (5.15.0-12.12) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-12.12 -proposed tracker (LP: #1951810)
+
+  * Jammy update: v5.15.4 upstream stable release (LP: #1951820)
+    - string: uninline memcpy_and_pad
+    - Revert "drm: fb_helper: improve CONFIG_FB dependency"
+    - Revert "drm: fb_helper: fix CONFIG_FB dependency"
+    - KVM: Fix steal time asm constraints
+    - btrfs: introduce btrfs_is_data_reloc_root
+    - btrfs: zoned: add a dedicated data relocation block group
+    - btrfs: zoned: only allow one process to add pages to a relocation inode
+    - btrfs: zoned: use regular writes for relocation
+    - btrfs: check for relocation inodes on zoned btrfs in should_nocow
+    - btrfs: zoned: allow preallocation for relocation inodes
+    - fortify: Explicitly disable Clang support
+    - block: Add a helper to validate the block size
+    - loop: Use blk_validate_block_size() to validate block size
+    - Bluetooth: btusb: Add support for TP-Link UB500 Adapter
+    - parisc/entry: fix trace test in syscall exit path
+    - PCI/MSI: Deal with devices lying about their MSI mask capability
+    - PCI: Add MSI masking quirk for Nvidia ION AHCI
+    - perf/core: Avoid put_page() when GUP fails
+    - thermal: Fix NULL pointer dereferences in of_thermal_ functions
+    - Revert "ACPI: scan: Release PM resources blocked by unused objects"
+    - Linux 5.15.4
+
+  * Jammy update: v5.15.3 upstream stable release (LP: #1951822)
+    - xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good
+      delay
+    - usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform
+    - Input: iforce - fix control-message timeout
+    - Input: elantench - fix misreporting trackpoint coordinates
+    - Input: i8042 - Add quirk for Fujitsu Lifebook T725
+    - libata: fix read log timeout value
+    - ocfs2: fix data corruption on truncate
+    - scsi: scsi_ioctl: Validate command size
+    - scsi: core: Avoid leaving shost->last_reset with stale value if EH does not
+      run
+    - scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd()
+    - scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding
+    - scsi: lpfc: Fix FCP I/O flush functionality for TMF routines
+    - scsi: qla2xxx: Fix crash in NVMe abort path
+    - scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file
+    - scsi: qla2xxx: Fix use after free in eh_abort path
+    - ce/gf100: fix incorrect CE0 address calculation on some GPUs
+    - char: xillybus: fix msg_ep UAF in xillyusb_probe()
+    - mmc: mtk-sd: Add wait dma stop done flow
+    - mmc: dw_mmc: Dont wait for DRTO on Write RSP error
+    - exfat: fix incorrect loading of i_blocks for large files
+    - io-wq: remove worker to owner tw dependency
+    - parisc: Fix set_fixmap() on PA1.x CPUs
+    - parisc: Fix ptrace check on syscall return
+    - tpm: Check for integer overflow in tpm2_map_response_body()
+    - firmware/psci: fix application of sizeof to pointer
+    - crypto: s5p-sss - Add error handling in s5p_aes_probe()
+    - media: rkvdec: Do not override sizeimage for output format
+    - media: ite-cir: IR receiver stop working after receive overflow
+    - media: rkvdec: Support dynamic resolution changes
+    - media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
+    - media: v4l2-ioctl: Fix check_ext_ctrls
+    - ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14
+    - ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED
+    - ALSA: hda/realtek: Add quirk for Clevo PC70HS
+    - ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ
+    - ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N
+    - ALSA: hda/realtek: Add quirk for ASUS UX550VE
+    - ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED
+    - ALSA: ua101: fix division by zero at probe
+    - ALSA: 6fire: fix control and bulk message timeouts
+    - ALSA: line6: fix control and interrupt message timeouts
+    - ALSA: mixer: oss: Fix racy access to slots
+    - ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
+    - ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk
+    - ALSA: usb-audio: Add registration quirk for JBL Quantum 400
+    - ALSA: hda: Free card instance properly at probe errors
+    - ALSA: synth: missing check for possible NULL after the call to kstrdup
+    - ALSA: pci: rme: Fix unaligned buffer addresses
+    - ALSA: PCM: Fix NULL dereference at mmap checks
+    - ALSA: timer: Fix use-after-free problem
+    - ALSA: timer: Unconditionally unlink slave instances, too
+    - Revert "ext4: enforce buffer head state assertion in ext4_da_map_blocks"
+    - ext4: fix lazy initialization next schedule time computation in more
+      granular unit
+    - ext4: ensure enough credits in ext4_ext_shift_path_extents
+    - ext4: refresh the ext4_ext_path struct after dropping i_data_sem.
+    - fuse: fix page stealing
+    - x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
+    - x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
+    - x86/irq: Ensure PI wakeup handler is unregistered before module unload
+    - x86/iopl: Fake iopl(3) CLI/STI usage
+    - btrfs: clear MISSING device status bit in btrfs_close_one_device
+    - btrfs: fix lost error handling when replaying directory deletes
+    - btrfs: call btrfs_check_rw_degradable only if there is a missing device
+    - KVM: x86/mmu: Drop a redundant, broken remote TLB flush
+    - KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup
+    - KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ
+      handling
+    - ia64: kprobes: Fix to pass correct trampoline address to the handler
+    - selinux: fix race condition when computing ocontext SIDs
+    - ipmi:watchdog: Set panic count to proper value on a panic
+    - md/raid1: only allocate write behind bio for WriteMostly device
+    - hwmon: (pmbus/lm25066) Add offset coefficients
+    - regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is
+      disabled
+    - regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-
+      dvs-idx property
+    - EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
+    - mwifiex: fix division by zero in fw download path
+    - ath6kl: fix division by zero in send path
+    - ath6kl: fix control-message timeout
+    - ath10k: fix control-message timeout
+    - ath10k: fix division by zero in send path
+    - PCI: Mark Atheros QCA6174 to avoid bus reset
+    - rtl8187: fix control-message timeouts
+    - evm: mark evm_fixmode as __ro_after_init
+    - ifb: Depend on netfilter alternatively to tc
+    - platform/surface: aggregator_registry: Add support for Surface Laptop Studio
+    - mt76: mt7615: fix skb use-after-free on mac reset
+    - HID: surface-hid: Use correct event registry for managing HID events
+    - HID: surface-hid: Allow driver matching for target ID 1 devices
+    - wcn36xx: Fix HT40 capability for 2Ghz band
+    - wcn36xx: Fix tx_status mechanism
+    - wcn36xx: Fix (QoS) null data frame bitrate/modulation
+    - PM: sleep: Do not let "syscore" devices runtime-suspend during system
+      transitions
+    - mwifiex: Read a PCI register after writing the TX ring write pointer
+    - mwifiex: Try waking the firmware until we get an interrupt
+    - libata: fix checking of DMA state
+    - dma-buf: fix and rework dma_buf_poll v7
+    - wcn36xx: handle connection loss indication
+    - rsi: fix occasional initialisation failure with BT coex
+    - rsi: fix key enabled check causing unwanted encryption for vap_id > 0
+    - rsi: fix rate mask set leading to P2P failure
+    - rsi: Fix module dev_oper_mode parameter description
+    - perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server
+    - perf/x86/intel/uncore: Fix invalid unit check
+    - perf/x86/intel/uncore: Fix Intel ICX IIO event constraints
+    - RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
+    - ASoC: tegra: Set default card name for Trimslice
+    - ASoC: tegra: Restore AC97 support
+    - signal: Remove the bogus sigkill_pending in ptrace_stop
+    - memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode
+    - signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
+    - soc: samsung: exynos-pmu: Fix compilation when nothing selects
+      CONFIG_MFD_CORE
+    - soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
+    - soc: fsl: dpio: use the combined functions to protect critical zone
+    - mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines
+    - mctp: handle the struct sockaddr_mctp padding fields
+    - power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
+    - power: supply: max17042_battery: use VFSOC for capacity when no rsns
+    - iio: core: fix double free in iio_device_unregister_sysfs()
+    - iio: core: check return value when calling dev_set_name()
+    - KVM: arm64: Extract ESR_ELx.EC only
+    - KVM: x86: Fix recording of guest steal time / preempted status
+    - KVM: x86: Add helper to consolidate core logic of SET_CPUID{2} flows
+    - KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use
+    - KVM: nVMX: Handle dynamic MSR intercept toggling
+    - can: peak_usb: always ask for BERR reporting for PCAN-USB devices
+    - can: mcp251xfd: mcp251xfd_irq(): add missing
+      can_rx_offload_threaded_irq_finish() in case of bus off
+    - can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport
+    - can: j1939: j1939_can_recv(): ignore messages with invalid source address
+    - can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
+    - iio: adc: tsc2046: fix scan interval warning
+    - powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
+    - io_uring: honour zeroes as io-wq worker limits
+    - ring-buffer: Protect ring_buffer_reset() from reentrancy
+    - serial: core: Fix initializing and restoring termios speed
+    - ifb: fix building without CONFIG_NET_CLS_ACT
+    - xen/balloon: add late_initcall_sync() for initial ballooning done
+    - ovl: fix use after free in struct ovl_aio_req
+    - ovl: fix filattr copy-up failure
+    - PCI: pci-bridge-emul: Fix emulation of W1C bits
+    - PCI: cadence: Add cdns_plat_pcie_probe() missing return
+    - cxl/pci: Fix NULL vs ERR_PTR confusion
+    - PCI: aardvark: Do not clear status bits of masked interrupts
+    - PCI: aardvark: Fix checking for link up via LTSSM state
+    - PCI: aardvark: Do not unmask unused interrupts
+    - PCI: aardvark: Fix reporting Data Link Layer Link Active
+    - PCI: aardvark: Fix configuring Reference clock
+    - PCI: aardvark: Fix return value of MSI domain .alloc() method
+    - PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
+    - PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated
+      bridge
+    - PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge
+    - PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge
+    - PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge
+    - quota: check block number when reading the block in quota file
+    - quota: correct error number in free_dqentry()
+    - cifs: To match file servers, make sure the server hostname matches
+    - cifs: set a minimum of 120s for next dns resolution
+    - mfd: simple-mfd-i2c: Select MFD_CORE to fix build error
+    - pinctrl: core: fix possible memory leak in pinctrl_enable()
+    - coresight: cti: Correct the parameter for pm_runtime_put
+    - coresight: trbe: Fix incorrect access of the sink specific data
+    - coresight: trbe: Defer the probe on offline CPUs
+    - iio: buffer: check return value of kstrdup_const()
+    - iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask()
+    - iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
+    - iio: buffer: Fix memory leak in iio_buffer_register_legacy_sysfs_groups()
+    - drivers: iio: dac: ad5766: Fix dt property name
+    - iio: dac: ad5446: Fix ad5622_write() return value
+    - iio: ad5770r: make devicetree property reading consistent
+    - Documentation:devicetree:bindings:iio:dac: Fix val
+    - USB: serial: keyspan: fix memleak on probe errors
+    - serial: 8250: fix racy uartclk update
+    - ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION
+    - io-wq: serialize hash clear with wakeup
+    - serial: 8250: Fix reporting real baudrate value in c_ospeed field
+    - Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
+    - most: fix control-message timeouts
+    - USB: iowarrior: fix control-message timeouts
+    - USB: chipidea: fix interrupt deadlock
+    - power: supply: max17042_battery: Clear status bits in interrupt handler
+    - component: do not leave master devres group open after bind
+    - dma-buf: WARN on dmabuf release with pending attachments
+    - drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)
+    - drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
+    - drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6
+    - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
+    - Bluetooth: fix use-after-free error in lock_sock_nested()
+    - Bluetooth: call sock_hold earlier in sco_conn_del
+    - drm/panel-orientation-quirks: add Valve Steam Deck
+    - rcutorture: Avoid problematic critical section nesting on PREEMPT_RT
+    - platform/x86: wmi: do not fail if disabling fails
+    - drm/amdgpu: move iommu_resume before ip init/resume
+    - MIPS: lantiq: dma: add small delay after reset
+    - MIPS: lantiq: dma: reset correct number of channel
+    - locking/lockdep: Avoid RCU-induced noinstr fail
+    - net: sched: update default qdisc visibility after Tx queue cnt changes
+    - rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop
+    - smackfs: Fix use-after-free in netlbl_catmap_walk()
+    - ath11k: Align bss_chan_info structure with firmware
+    - crypto: aesni - check walk.nbytes instead of err
+    - x86/mm/64: Improve stack overflow warnings
+    - x86: Increase exception stack sizes
+    - mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
+    - mwifiex: Properly initialize private structure on interface type changes
+    - spi: Check we have a spi_device_id for each DT compatible
+    - fscrypt: allow 256-bit master keys with AES-256-XTS
+    - drm/amdgpu: Fix MMIO access page fault
+    - drm/amd/display: Fix null pointer dereference for encoders
+    - selftests: net: fib_nexthops: Wait before checking reported idle time
+    - ath11k: Avoid reg rules update during firmware recovery
+    - ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
+    - ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets
+    - ath10k: high latency fixes for beacon buffer
+    - octeontx2-pf: Enable promisc/allmulti match MCAM entries.
+    - media: mt9p031: Fix corrupted frame after restarting stream
+    - media: netup_unidvb: handle interrupt properly according to the firmware
+    - media: atomisp: Fix error handling in probe
+    - media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()
+    - media: uvcvideo: Set capability in s_param
+    - media: uvcvideo: Return -EIO for control errors
+    - media: uvcvideo: Set unique vdev name based in type
+    - media: vidtv: Fix memory leak in remove
+    - media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
+    - media: s5p-mfc: Add checking to s5p_mfc_probe().
+    - media: videobuf2: rework vb2_mem_ops API
+    - media: imx: set a media_device bus_info string
+    - media: rcar-vin: Use user provided buffers when starting
+    - media: mceusb: return without resubmitting URB in case of -EPROTO error.
+    - ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
+    - rtw88: fix RX clock gate setting while fifo dump
+    - brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet
+    - media: rcar-csi2: Add checking to rcsi2_start_receiver()
+    - ipmi: Disable some operations during a panic
+    - fs/proc/uptime.c: Fix idle time reporting in /proc/uptime
+    - kselftests/sched: cleanup the child processes
+    - ACPICA: Avoid evaluating methods too early during system resume
+    - cpufreq: Make policy min/max hard requirements
+    - ice: Move devlink port to PF/VF struct
+    - media: imx-jpeg: Fix possible null pointer dereference
+    - media: ipu3-imgu: imgu_fmt: Handle properly try
+    - media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info
+    - media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
+    - net-sysfs: try not to restart the syscall if it will fail eventually
+    - drm/amdkfd: rm BO resv on validation to avoid deadlock
+    - tracefs: Have tracefs directories not set OTH permission bits by default
+    - tracing: Disable "other" permission bits in the tracefs files
+    - ath: dfs_pattern_detector: Fix possible null-pointer dereference in
+      channel_detector_create()
+    - KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall
+    - mmc: moxart: Fix reference count leaks in moxart_probe
+    - iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value
+    - ACPI: battery: Accept charges over the design capacity as full
+    - ACPI: scan: Release PM resources blocked by unused objects
+    - drm/amd/display: fix null pointer deref when plugging in display
+    - drm/amdkfd: fix resume error when iommu disabled in Picasso
+    - net: phy: micrel: make *-skew-ps check more lenient
+    - leaking_addresses: Always print a trailing newline
+    - thermal/core: Fix null pointer dereference in thermal_release()
+    - drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture()
+    - thermal/drivers/tsens: Add timeout to get_temp_tsens_valid
+    - block: bump max plugged deferred size from 16 to 32
+    - floppy: fix calling platform_device_unregister() on invalid drives
+    - md: update superblock after changing rdev flags in state_store
+    - memstick: r592: Fix a UAF bug when removing the driver
+    - locking/rwsem: Disable preemption for spinning region
+    - lib/xz: Avoid overlapping memcpy() with invalid input with in-place
+      decompression
+    - lib/xz: Validate the value before assigning it to an enum variable
+    - workqueue: make sysfs of unbound kworker cpumask more clever
+    - tracing/cfi: Fix cmp_entries_* functions signature mismatch
+    - mt76: mt7915: fix an off-by-one bound check
+    - mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
+    - iwlwifi: change all JnP to NO-160 configuration
+    - block: remove inaccurate requeue check
+    - media: allegro: ignore interrupt if mailbox is not initialized
+    - drm/amdgpu/pm: properly handle sclk for profiling modes on vangogh
+    - nvmet: fix use-after-free when a port is removed
+    - nvmet-rdma: fix use-after-free when a port is removed
+    - nvmet-tcp: fix use-after-free when a port is removed
+    - nvme: drop scan_lock and always kick requeue list when removing namespaces
+    - samples/bpf: Fix application of sizeof to pointer
+    - arm64: vdso32: suppress error message for 'make mrproper'
+    - PM: hibernate: Get block device exclusively in swsusp_check()
+    - selftests: kvm: fix mismatched fclose() after popen()
+    - selftests/bpf: Fix perf_buffer test on system with offline cpus
+    - iwlwifi: mvm: disable RX-diversity in powersave
+    - smackfs: use __GFP_NOFAIL for smk_cipso_doi()
+    - ARM: clang: Do not rely on lr register for stacktrace
+    - gre/sit: Don't generate link-local addr if addr_gen_mode is
+      IN6_ADDR_GEN_MODE_NONE
+    - can: bittiming: can_fixup_bittiming(): change type of tseg1 and alltseg to
+      unsigned int
+    - gfs2: Cancel remote delete work asynchronously
+    - gfs2: Fix glock_hash_walk bugs
+    - ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
+    - tools/latency-collector: Use correct size when writing queue_full_warning
+    - vrf: run conntrack only in context of lower/physdev for locally generated
+      packets
+    - net: annotate data-race in neigh_output()
+    - ACPI: AC: Quirk GK45 to skip reading _PSR
+    - ACPI: resources: Add one more Medion model in IRQ override quirk
+    - btrfs: reflink: initialize return value to 0 in btrfs_extent_same()
+    - btrfs: do not take the uuid_mutex in btrfs_rm_device
+    - spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in
+      bcm_qspi_probe()
+    - wcn36xx: Correct band/freq reporting on RX
+    - wcn36xx: Fix packet drop on resume
+    - Revert "wcn36xx: Enable firmware link monitoring"
+    - ftrace: do CPU checking after preemption disabled
+    - inet: remove races in inet{6}_getname()
+    - x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
+    - drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled
+    - perf/x86/intel: Fix ICL/SPR INST_RETIRED.PREC_DIST encodings
+    - parisc: fix warning in flush_tlb_all
+    - task_stack: Fix end_of_stack() for architectures with upwards-growing stack
+    - erofs: don't trigger WARN() when decompression fails
+    - parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
+    - parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
+    - netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream
+      state
+    - selftests/bpf: Fix strobemeta selftest regression
+    - fbdev/efifb: Release PCI device's runtime PM ref during FB destroy
+    - drm/bridge: anx7625: Propagate errors from sp_tx_rst_aux()
+    - perf/x86/intel/uncore: Fix Intel SPR CHA event constraints
+    - perf/x86/intel/uncore: Fix Intel SPR IIO event constraints
+    - perf/x86/intel/uncore: Fix Intel SPR M2PCIE event constraints
+    - perf/x86/intel/uncore: Fix Intel SPR M3UPI event constraints
+    - drm/bridge: it66121: Initialize {device,vendor}_ids
+    - drm/bridge: it66121: Wait for next bridge to be probed
+    - Bluetooth: fix init and cleanup of sco_conn.timeout_work
+    - libbpf: Don't crash on object files with no symbol tables
+    - Bluetooth: hci_uart: fix GPF in h5_recv
+    - rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()
+    - MIPS: lantiq: dma: fix burst length for DEU
+    - x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
+    - objtool: Handle __sanitize_cov*() tail calls
+    - net/mlx5: Publish and unpublish all devlink parameters at once
+    - drm/v3d: fix wait for TMU write combiner flush
+    - crypto: sm4 - Do not change section of ck and sbox
+    - virtio-gpu: fix possible memory allocation failure
+    - lockdep: Let lock_is_held_type() detect recursive read as read
+    - net: net_namespace: Fix undefined member in key_remove_domain()
+    - net: phylink: don't call netif_carrier_off() with NULL netdev
+    - drm: bridge: it66121: Fix return value it66121_probe
+    - spi: Fixed division by zero warning
+    - cgroup: Make rebind_subsystems() disable v2 controllers all at once
+    - wcn36xx: Fix Antenna Diversity Switching
+    - wilc1000: fix possible memory leak in cfg_scan_result()
+    - Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
+    - drm/amdgpu: Fix crash on device remove/driver unload
+    - drm/amd/display: Pass display_pipe_params_st as const in DML
+    - drm/amdgpu: move amdgpu_virt_release_full_gpu to fini_early stage
+    - crypto: caam - disable pkc for non-E SoCs
+    - crypto: qat - power up 4xxx device
+    - Bluetooth: hci_h5: Fix (runtime)suspend issues on RTL8723BS HCIs
+    - bnxt_en: Check devlink allocation and registration status
+    - qed: Don't ignore devlink allocation failures
+    - rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()
+    - mptcp: do not shrink snd_nxt when recovering
+    - fortify: Fix dropped strcpy() compile-time write overflow check
+    - mac80211: twt: don't use potentially unaligned pointer
+    - cfg80211: always free wiphy specific regdomain
+    - net/mlx5: Accept devlink user input after driver initialization complete
+    - net: dsa: rtl8366rb: Fix off-by-one bug
+    - net: dsa: rtl8366: Fix a bug in deleting VLANs
+    - bpf/tests: Fix error in tail call limit tests
+    - ath11k: fix some sleeping in atomic bugs
+    - ath11k: Avoid race during regd updates
+    - ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status
+    - ath11k: Fix memory leak in ath11k_qmi_driver_event_work
+    - gve: DQO: avoid unused variable warnings
+    - ath10k: Fix missing frame timestamp for beacon/probe-resp
+    - ath10k: sdio: Add missing BH locking around napi_schdule()
+    - drm/ttm: stop calling tt_swapin in vm_access
+    - arm64: mm: update max_pfn after memory hotplug
+    - drm/amdgpu: fix warning for overflow check
+    - libbpf: Fix skel_internal.h to set errno on loader retval < 0
+    - media: em28xx: add missing em28xx_close_extension
+    - media: meson-ge2d: Fix rotation parameter changes detection in
+      'ge2d_s_ctrl()'
+    - media: cxd2880-spi: Fix a null pointer dereference on error handling path
+    - media: ttusb-dec: avoid release of non-acquired mutex
+    - media: dvb-usb: fix ununit-value in az6027_rc_query
+    - media: imx258: Fix getting clock frequency
+    - media: v4l2-ioctl: S_CTRL output the right value
+    - media: mtk-vcodec: venc: fix return value when start_streaming fails
+    - media: TDA1997x: handle short reads of hdmi info frame.
+    - media: mtk-vpu: Fix a resource leak in the error handling path of
+      'mtk_vpu_probe()'
+    - media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()'
+    - media: i2c: ths8200 needs V4L2_ASYNC
+    - media: sun6i-csi: Allow the video device to be open multiple times
+    - media: radio-wl1273: Avoid card name truncation
+    - media: si470x: Avoid card name truncation
+    - media: tm6000: Avoid card name truncation
+    - media: cx23885: Fix snd_card_free call on null card pointer
+    - media: atmel: fix the ispck initialization
+    - scs: Release kasan vmalloc poison in scs_free process
+    - kprobes: Do not use local variable when creating debugfs file
+    - crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency
+    - drm: fb_helper: fix CONFIG_FB dependency
+    - cpuidle: Fix kobject memory leaks in error paths
+    - media: em28xx: Don't use ops->suspend if it is NULL
+    - ath10k: Don't always treat modem stop events as crashes
+    - ath9k: Fix potential interrupt storm on queue reset
+    - PM: EM: Fix inefficient states detection
+    - x86/insn: Use get_unaligned() instead of memcpy()
+    - EDAC/amd64: Handle three rank interleaving mode
+    - rcu: Always inline rcu_dynticks_task*_{enter,exit}()
+    - rcu: Fix rcu_dynticks_curr_cpu_in_eqs() vs noinstr
+    - netfilter: nft_dynset: relax superfluous check on set updates
+    - media: venus: fix vpp frequency calculation for decoder
+    - media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
+    - crypto: ccree - avoid out-of-range warnings from clang
+    - crypto: qat - detect PFVF collision after ACK
+    - crypto: qat - disregard spurious PFVF interrupts
+    - hwrng: mtk - Force runtime pm ops for sleep ops
+    - ima: fix deadlock when traversing "ima_default_rules".
+    - b43legacy: fix a lower bounds test
+    - b43: fix a lower bounds test
+    - gve: Recover from queue stall due to missed IRQ
+    - gve: Track RX buffer allocation failures
+    - mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
+    - mmc: sdhci-omap: Fix context restore
+    - memstick: avoid out-of-range warning
+    - memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
+    - net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE
+    - hwmon: Fix possible memleak in __hwmon_device_register()
+    - hwmon: (pmbus/lm25066) Let compiler determine outer dimension of
+      lm25066_coeff
+    - ath10k: fix max antenna gain unit
+    - kernel/sched: Fix sched_fork() access an invalid sched_task_group
+    - net: fealnx: fix build for UML
+    - net: intel: igc_ptp: fix build for UML
+    - net: tulip: winbond-840: fix build for UML
+    - tcp: switch orphan_count to bare per-cpu counters
+    - crypto: octeontx2 - set assoclen in aead_do_fallback()
+    - thermal/core: fix a UAF bug in __thermal_cooling_device_register()
+    - drm/msm/dsi: do not enable irq handler before powering up the host
+    - drm/msm: Fix potential Oops in a6xx_gmu_rpmh_init()
+    - drm/msm: potential error pointer dereference in init()
+    - drm/msm: unlock on error in get_sched_entity()
+    - drm/msm: fix potential NULL dereference in cleanup
+    - drm/msm: uninitialized variable in msm_gem_import()
+    - net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
+    - thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM
+    - mailbox: Remove WARN_ON for async_cb.cb in cmdq_exec_done
+    - media: ivtv: fix build for UML
+    - media: ir_toy: assignment to be16 should be of correct type
+    - mmc: mxs-mmc: disable regulator on error and in the remove function
+    - io-wq: Remove duplicate code in io_workqueue_create()
+    - block: ataflop: fix breakage introduced at blk-mq refactoring
+    - platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
+    - mailbox: mtk-cmdq: Validate alias_id on probe
+    - mailbox: mtk-cmdq: Fix local clock ID usage
+    - ACPI: PM: Turn off unused wakeup power resources
+    - ACPI: PM: Fix sharing of wakeup power resources
+    - drm/amdkfd: Fix an inappropriate error handling in allloc memory of gpu
+    - mt76: mt7921: fix endianness in mt7921_mcu_tx_done_event
+    - mt76: mt7915: fix endianness warning in mt7915_mac_add_txs_skb
+    - mt76: mt7921: fix endianness warning in mt7921_update_txs
+    - mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi
+    - mt76: mt7915: fix info leak in mt7915_mcu_set_pre_cal()
+    - mt76: connac: fix mt76_connac_gtk_rekey_tlv usage
+    - mt76: fix build error implicit enumeration conversion
+    - mt76: mt7921: fix survey-dump reporting
+    - mt76: mt76x02: fix endianness warnings in mt76x02_mac.c
+    - mt76: mt7921: Fix out of order process by invalid event pkt
+    - mt76: mt7915: fix potential overflow of eeprom page index
+    - mt76: mt7915: fix bit fields for HT rate idx
+    - mt76: mt7921: fix dma hang in rmmod
+    - mt76: connac: fix GTK rekey offload failure on WPA mixed mode
+    - mt76: overwrite default reg_ops if necessary
+    - mt76: mt7921: report HE MU radiotap
+    - mt76: mt7921: fix firmware usage of RA info using legacy rates
+    - mt76: mt7921: fix kernel warning from cfg80211_calculate_bitrate
+    - mt76: mt7921: always wake device if necessary in debugfs
+    - mt76: mt7915: fix hwmon temp sensor mem use-after-free
+    - mt76: mt7615: fix hwmon temp sensor mem use-after-free
+    - mt76: mt7915: fix possible infinite loop release semaphore
+    - mt76: mt7921: fix retrying release semaphore without end
+    - mt76: mt7615: fix monitor mode tear down crash
+    - mt76: connac: fix possible NULL pointer dereference in
+      mt76_connac_get_phy_mode_v2
+    - mt76: mt7915: fix sta_rec_wtbl tag len
+    - mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req()
+    - rsi: stop thread firstly in rsi_91x_init() error handling
+    - mwifiex: Send DELBA requests according to spec
+    - iwlwifi: mvm: reset PM state on unsuccessful resume
+    - iwlwifi: pnvm: don't kmemdup() more than we have
+    - iwlwifi: pnvm: read EFI data only if long enough
+    - net: enetc: unmap DMA in enetc_send_cmd()
+    - phy: micrel: ksz8041nl: do not use power down mode
+    - nbd: Fix use-after-free in pid_show
+    - nvme-rdma: fix error code in nvme_rdma_setup_ctrl
+    - PM: hibernate: fix sparse warnings
+    - clocksource/drivers/timer-ti-dm: Select TIMER_OF
+    - x86/sev: Fix stack type check in vc_switch_off_ist()
+    - drm/msm: Fix potential NULL dereference in DPU SSPP
+    - drm/msm/dsi: fix wrong type in msm_dsi_host
+    - crypto: tcrypt - fix skcipher multi-buffer tests for 1420B blocks
+    - smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
+    - KVM: selftests: Fix nested SVM tests when built with clang
+    - libbpf: Fix memory leak in btf__dedup()
+    - bpftool: Avoid leaking the JSON writer prepared for program metadata
+    - libbpf: Fix overflow in BTF sanity checks
+    - libbpf: Fix BTF header parsing checks
+    - mt76: mt7615: mt7622: fix ibss and meshpoint
+    - s390/gmap: validate VMA in __gmap_zap()
+    - s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
+    - s390/mm: validate VMA in PGSTE manipulation functions
+    - s390/mm: fix VMA and page table handling code in storage key handling
+      functions
+    - s390/uv: fully validate the VMA before calling follow_page()
+    - KVM: s390: pv: avoid double free of sida page
+    - KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm
+    - irq: mips: avoid nested irq_enter()
+    - net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error
+    - ARM: 9142/1: kasan: work around LPAE build warning
+    - ath10k: fix module load regression with iram-recovery feature
+    - block: ataflop: more blk-mq refactoring fixes
+    - blk-cgroup: synchronize blkg creation against policy deactivation
+    - libbpf: Fix off-by-one bug in bpf_core_apply_relo()
+    - tpm: fix Atmel TPM crash caused by too frequent queries
+    - tpm_tis_spi: Add missing SPI ID
+    - libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED()
+    - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
+    - tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks
+    - cpufreq: intel_pstate: Fix cpu->pstate.turbo_freq initialization
+    - spi: spi-rpc-if: Check return value of rpcif_sw_init()
+    - samples/kretprobes: Fix return value if register_kretprobe() failed
+    - KVM: s390: Fix handle_sske page fault handling
+    - libertas_tf: Fix possible memory leak in probe and disconnect
+    - libertas: Fix possible memory leak in probe and disconnect
+    - wcn36xx: add proper DMA memory barriers in rx path
+    - wcn36xx: Fix discarded frames due to wrong sequence number
+    - bpf: Avoid races in __bpf_prog_run() for 32bit arches
+    - bpf: Fixes possible race in update_prog_stats() for 32bit arches
+    - wcn36xx: Channel list update before hardware scan
+    - drm/amdgpu: fix a potential memory leak in amdgpu_device_fini_sw()
+    - drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
+    - selftests/bpf: Fix fd cleanup in sk_lookup test
+    - selftests/bpf: Fix memory leak in test_ima
+    - sctp: allow IP fragmentation when PLPMTUD enters Error state
+    - sctp: reset probe_timer in sctp_transport_pl_update
+    - sctp: subtract sctphdr len in sctp_transport_pl_hlen
+    - sctp: return true only for pathmtu update in sctp_transport_pl_toobig
+    - net: amd-xgbe: Toggle PLL settings during rate change
+    - ipmi: kcs_bmc: Fix a memory leak in the error handling path of
+      'kcs_bmc_serio_add_device()'
+    - nfp: fix NULL pointer access when scheduling dim work
+    - nfp: fix potential deadlock when canceling dim work
+    - net: phylink: avoid mvneta warning when setting pause parameters
+    - net: bridge: fix uninitialized variables when BRIDGE_CFM is disabled
+    - selftests: net: bridge: update IGMP/MLD membership interval value
+    - crypto: pcrypt - Delay write to padata->info
+    - selftests/bpf: Fix fclose/pclose mismatch in test_progs
+    - udp6: allow SO_MARK ctrl msg to affect routing
+    - ibmvnic: don't stop queue in xmit
+    - ibmvnic: Process crqs after enabling interrupts
+    - ibmvnic: delay complete()
+    - selftests: mptcp: fix proto type in link_failure tests
+    - skmsg: Lose offset info in sk_psock_skb_ingress
+    - cgroup: Fix rootcg cpu.stat guest double counting
+    - bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.
+    - bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.
+    - of: unittest: fix EXPECT text for gpio hog errors
+    - cpufreq: Fix parameter in parse_perf_domain()
+    - staging: r8188eu: fix memory leak in rtw_set_key
+    - arm64: dts: meson: sm1: add Ethernet PHY reset line for ODROID-C4/HC4
+    - iio: st_sensors: disable regulators after device unregistration
+    - RDMA/rxe: Fix wrong port_cap_flags
+    - ARM: dts: BCM5301X: Fix memory nodes names
+    - arm64: dts: broadcom: bcm4908: Fix UART clock name
+    - clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths
+    - scsi: pm80xx: Fix lockup in outbound queue management
+    - scsi: qla2xxx: edif: Use link event to wake up app
+    - scsi: lpfc: Fix NVMe I/O failover to non-optimized path
+    - ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
+    - arm64: dts: rockchip: Fix GPU register width for RK3328
+    - ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY
+    - RDMA/bnxt_re: Fix query SRQ failure
+    - arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes
+    - arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe
+    - arm64: dts: ti: j7200-main: Fix "vendor-id"/"device-id" properties of pcie
+      node
+    - arm64: dts: ti: j7200-main: Fix "bus-range" upto 256 bus number for PCIe
+    - arm64: dts: meson-g12a: Fix the pwm regulator supply properties
+    - arm64: dts: meson-g12b: Fix the pwm regulator supply properties
+    - arm64: dts: meson-sm1: Fix the pwm regulator supply properties
+    - bus: ti-sysc: Fix timekeeping_suspended warning on resume
+    - ARM: dts: at91: tse850: the emac<->phy interface is rmii
+    - arm64: dts: qcom: sc7180: Base dynamic CPU power coefficients in reality
+    - soc: qcom: llcc: Disable MMUHWT retention
+    - arm64: dts: qcom: sc7280: fix display port phy reg property
+    - scsi: dc395: Fix error case unwinding
+    - MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
+    - JFS: fix memleak in jfs_mount
+    - pinctrl: renesas: rzg2l: Fix missing port register 21h
+    - ASoC: wcd9335: Use correct version to initialize Class H
+    - arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock
+    - arm64: dts: renesas: beacon: Fix Ethernet PHY mode
+    - iommu/mediatek: Fix out-of-range warning with clang
+    - arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000
+    - iommu/dma: Fix sync_sg with swiotlb
+    - iommu/dma: Fix arch_sync_dma for map
+    - ALSA: hda: Reduce udelay() at SKL+ position reporting
+    - ALSA: hda: Use position buffer for SKL+ again
+    - ALSA: usb-audio: Fix possible race at sync of urb completions
+    - soundwire: debugfs: use controller id and link_id for debugfs
+    - power: reset: at91-reset: check properly the return value of devm_of_iomap
+    - scsi: ufs: core: Fix ufshcd_probe_hba() prototype to match the definition
+    - scsi: ufs: core: Stop clearing UNIT ATTENTIONS
+    - scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and
+      real interrupt
+    - scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp()
+    - driver core: Fix possible memory leak in device_link_add()
+    - arm: dts: omap3-gta04a4: accelerometer irq fix
+    - ASoC: SOF: topology: do not power down primary core during topology removal
+    - iio: st_pressure_spi: Add missing entries SPI to device ID table
+    - soc/tegra: Fix an error handling path in tegra_powergate_power_up()
+    - memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
+    - clk: at91: check pmc node status before registering syscore ops
+    - powerpc/mem: Fix arch/powerpc/mm/mem.c:53:12: error: no previous prototype
+      for 'create_section_mapping'
+    - video: fbdev: chipsfb: use memset_io() instead of memset()
+    - powerpc: fix unbalanced node refcount in check_kvm_guest()
+    - powerpc/paravirt: correct preempt debug splat in vcpu_is_preempted()
+    - serial: 8250_dw: Drop wrong use of ACPI_PTR()
+    - usb: gadget: hid: fix error code in do_config()
+    - power: supply: rt5033_battery: Change voltage values to µV
+    - power: supply: max17040: fix null-ptr-deref in max17040_probe()
+    - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
+    - RDMA/mlx4: Return missed an error if device doesn't support steering
+    - usb: musb: select GENERIC_PHY instead of depending on it
+    - staging: most: dim2: do not double-register the same device
+    - staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC
+    - RDMA/core: Set sgtable nents when using ib_dma_virt_map_sg()
+    - dyndbg: make dyndbg a known cli param
+    - powerpc/perf: Fix cycles/instructions as PM_CYC/PM_INST_CMPL in power10
+    - pinctrl: renesas: checker: Fix off-by-one bug in drive register check
+    - ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz
+    - ARM: dts: stm32: fix STUSB1600 Type-C irq level on stm32mp15xx-dkx
+    - ARM: dts: stm32: fix SAI sub nodes register range
+    - ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
+    - ASoC: cs42l42: Always configure both ASP TX channels
+    - ASoC: cs42l42: Correct some register default values
+    - ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
+    - soc: qcom: rpmhpd: Make power_on actually enable the domain
+    - soc: qcom: socinfo: add two missing PMIC IDs
+    - iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask()
+    - usb: typec: STUSB160X should select REGMAP_I2C
+    - iio: adis: do not disabe IRQs in 'adis_init()'
+    - soundwire: bus: stop dereferencing invalid slave pointer
+    - scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer
+    - scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset
+    - serial: imx: fix detach/attach of serial console
+    - usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init
+    - usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled
+    - usb: dwc2: drd: reset current session before setting the new one
+    - powerpc/booke: Disable STRICT_KERNEL_RWX, DEBUG_PAGEALLOC and KFENCE
+    - usb: dwc3: gadget: Skip resizing EP's TX FIFO if already resized
+    - firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()
+    - soc: qcom: rpmhpd: fix sm8350_mxc's peer domain
+    - soc: qcom: apr: Add of_node_put() before return
+    - arm64: dts: qcom: pmi8994: Fix "eternal"->"external" typo in WLED node
+    - arm64: dts: qcom: sdm845: Use RPMH_CE_CLK macro directly
+    - arm64: dts: qcom: sdm845: Fix Qualcomm crypto engine bus clock
+    - pinctrl: equilibrium: Fix function addition in multiple groups
+    - ASoC: topology: Fix stub for snd_soc_tplg_component_remove()
+    - phy: qcom-qusb2: Fix a memory leak on probe
+    - phy: ti: gmii-sel: check of_get_address() for failure
+    - phy: qcom-qmp: another fix for the sc8180x PCIe definition
+    - phy: qcom-snps: Correct the FSEL_MASK
+    - phy: Sparx5 Eth SerDes: Fix return value check in sparx5_serdes_probe()
+    - serial: xilinx_uartps: Fix race condition causing stuck TX
+    - clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL
+    - clk: at91: clk-master: check if div or pres is zero
+    - clk: at91: clk-master: fix prescaler logic
+    - HID: u2fzero: clarify error check and length calculations
+    - HID: u2fzero: properly handle timeouts in usb_submit_urb
+    - powerpc/nohash: Fix __ptep_set_access_flags() and ptep_set_wrprotect()
+    - powerpc/book3e: Fix set_memory_x() and set_memory_nx()
+    - powerpc/44x/fsp2: add missing of_node_put
+    - powerpc/xmon: fix task state output
+    - ALSA: oxfw: fix functional regression for Mackie Onyx 1640i in v5.14 or
+      later
+    - iommu/dma: Fix incorrect error return on iommu deferred attach
+    - powerpc: Don't provide __kernel_map_pages() without
+      ARCH_SUPPORTS_DEBUG_PAGEALLOC
+    - ASoC: cs42l42: Correct configuring of switch inversion from ts-inv
+    - RDMA/hns: Fix initial arm_st of CQ
+    - RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility
+    - ASoC: rsnd: Fix an error handling path in 'rsnd_node_count()'
+    - serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE
+    - virtio_ring: check desc == NULL when using indirect with packed
+    - vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit
+    - mips: cm: Convert to bitfield API to fix out-of-bounds access
+    - power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
+    - RDMA/core: Require the driver to set the IOVA correctly during rereg_mr
+    - apparmor: fix error check
+    - rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
+    - mtd: rawnand: intel: Fix potential buffer overflow in probe
+    - nfsd: don't alloc under spinlock in rpc_parse_scope_id
+    - rtc: ds1302: Add SPI ID table
+    - rtc: ds1390: Add SPI ID table
+    - rtc: pcf2123: Add SPI ID table
+    - remoteproc: imx_rproc: Fix TCM io memory type
+    - i2c: i801: Use PCI bus rescan mutex to protect P2SB access
+    - dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside
+      submission
+    - rtc: mcp795: Add SPI ID table
+    - Input: ariel-pwrbutton - add SPI device ID table
+    - i2c: mediatek: fixing the incorrect register offset
+    - NFS: Default change_attr_type to NFS4_CHANGE_TYPE_IS_UNDEFINED
+    - NFS: Don't set NFS_INO_DATA_INVAL_DEFER and NFS_INO_INVALID_DATA
+    - NFS: Ignore the directory size when marking for revalidation
+    - NFS: Fix dentry verifier races
+    - pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
+    - drm/bridge/lontium-lt9611uxc: fix provided connector suport
+    - drm/plane-helper: fix uninitialized variable reference
+    - PCI: aardvark: Don't spam about PIO Response Status
+    - PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge
+    - opp: Fix return in _opp_add_static_v2()
+    - NFS: Fix deadlocks in nfs_scan_commit_list()
+    - sparc: Add missing "FORCE" target when using if_changed
+    - fs: orangefs: fix error return code of orangefs_revalidate_lookup()
+    - Input: st1232 - increase "wait ready" timeout
+    - drm/bridge: nwl-dsi: Add atomic_get_input_bus_fmts
+    - mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
+    - PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation
+    - mtd: rawnand: arasan: Prevent an unsupported configuration
+    - mtd: core: don't remove debugfs directory if device is in use
+    - remoteproc: Fix a memory leak in an error handling path in
+      'rproc_handle_vdev()'
+    - rtc: rv3032: fix error handling in rv3032_clkout_set_rate()
+    - dmaengine: at_xdmac: call at_xdmac_axi_config() on resume path
+    - dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
+    - dmaengine: stm32-dma: fix stm32_dma_get_max_width
+    - NFS: Fix up commit deadlocks
+    - NFS: Fix an Oops in pnfs_mark_request_commit()
+    - Fix user namespace leak
+    - auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
+    - auxdisplay: ht16k33: Connect backlight to fbdev
+    - auxdisplay: ht16k33: Fix frame buffer device blanking
+    - soc: fsl: dpaa2-console: free buffer before returning from
+      dpaa2_console_read
+    - netfilter: nfnetlink_queue: fix OOB when mac header was cleared
+    - dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
+    - dmaengine: tegra210-adma: fix pm runtime unbalance
+    - dmanegine: idxd: fix resource free ordering on driver removal
+    - dmaengine: idxd: reconfig device after device reset command
+    - signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)
+    - m68k: set a default value for MEMORY_RESERVE
+    - watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
+    - ar7: fix kernel builds for compiler test
+    - scsi: target: core: Remove from tmr_list during LUN unlink
+    - scsi: qla2xxx: Relogin during fabric disturbance
+    - scsi: qla2xxx: Fix gnl list corruption
+    - scsi: qla2xxx: Turn off target reset during issue_lip
+    - scsi: qla2xxx: edif: Fix app start fail
+    - scsi: qla2xxx: edif: Fix app start delay
+    - scsi: qla2xxx: edif: Flush stale events and msgs on session down
+    - scsi: qla2xxx: edif: Increase ELS payload
+    - scsi: qla2xxx: edif: Fix EDIF bsg
+    - NFSv4: Fix a regression in nfs_set_open_stateid_locked()
+    - dmaengine: idxd: fix resource leak on dmaengine driver disable
+    - i2c: xlr: Fix a resource leak in the error handling path of
+      'xlr_i2c_probe()'
+    - gpio: realtek-otto: fix GPIO line IRQ offset
+    - xen-pciback: Fix return in pm_ctrl_init()
+    - nbd: fix max value for 'first_minor'
+    - nbd: fix possible overflow for 'first_minor' in nbd_dev_add()
+    - io-wq: fix max-workers not correctly set on multi-node system
+    - net: davinci_emac: Fix interrupt pacing disable
+    - kselftests/net: add missed icmp.sh test to Makefile
+    - kselftests/net: add missed setup_loopback.sh/setup_veth.sh to Makefile
+    - kselftests/net: add missed SRv6 tests
+    - kselftests/net: add missed vrf_strict_mode_test.sh test to Makefile
+    - kselftests/net: add missed toeplitz.sh/toeplitz_client.sh to Makefile
+    - ethtool: fix ethtool msg len calculation for pause stats
+    - openrisc: fix SMP tlb flush NULL pointer dereference
+    - net: vlan: fix a UAF in vlan_dev_real_dev()
+    - net: dsa: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge
+    - ice: Fix replacing VF hardware MAC to existing MAC filter
+    - ice: Fix not stopping Tx queues for VFs
+    - kdb: Adopt scheduler's task classification
+    - ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
+    - PCI: j721e: Fix j721e_pcie_probe() error path
+    - nvdimm/btt: do not call del_gendisk() if not needed
+    - scsi: bsg: Fix errno when scsi_bsg_register_queue() fails
+    - scsi: ufs: ufshpb: Use proper power management API
+    - scsi: ufs: core: Fix NULL pointer dereference
+    - scsi: ufs: ufshpb: Properly handle max-single-cmd
+    - drm/nouveau/svm: Fix refcount leak bug and missing check against null bug
+    - nvdimm/pmem: cleanup the disk if pmem_release_disk() is yet assigned
+    - block/ataflop: use the blk_cleanup_disk() helper
+    - block/ataflop: add registration bool before calling del_gendisk()
+    - block/ataflop: provide a helper for cleanup up an atari disk
+    - ataflop: remove ataflop_probe_lock mutex
+    - PCI: Do not enable AtomicOps on VFs
+    - cpufreq: intel_pstate: Clear HWP desired on suspend/shutdown and offline
+    - net: phy: fix duplex out of sync problem while changing settings
+    - block: fix device_add_disk() kobject_create_and_add() error handling
+    - drm/ttm: remove ttm_bo_vm_insert_huge()
+    - bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
+    - octeontx2-pf: select CONFIG_NET_DEVLINK
+    - ALSA: memalloc: Catch call with NULL snd_dma_buffer pointer
+    - mfd: core: Add missing of_node_put for loop iteration
+    - mfd: cpcap: Add SPI device ID table
+    - mfd: sprd: Add SPI device ID table
+    - mfd: altera-sysmgr: Fix a mistake caused by resource_size conversion
+    - ACPI: PM: Fix device wakeup power reference counting error
+    - libbpf: Fix lookup_and_delete_elem_flags error reporting
+    - selftests/bpf/xdp_redirect_multi: Put the logs to tmp folder
+    - selftests/bpf/xdp_redirect_multi: Use arping to accurate the arp number
+    - selftests/bpf/xdp_redirect_multi: Give tcpdump a chance to terminate cleanly
+    - selftests/bpf/xdp_redirect_multi: Limit the tests in netns
+    - drm: fb_helper: improve CONFIG_FB dependency
+    - Revert "drm/imx: Annotate dma-fence critical section in commit path"
+    - drm/amdgpu/powerplay: fix sysfs_emit/sysfs_emit_at handling
+    - can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path
+    - can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for
+      mcp251xfd_chip_rx_int_enable()
+    - mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and
+      zs_unregister_migration()
+    - zram: off by one in read_block_state()
+    - perf bpf: Add missing free to bpf_event__print_bpf_prog_info()
+    - llc: fix out-of-bound array index in llc_sk_dev_hash()
+    - nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
+    - litex_liteeth: Fix a double free in the remove function
+    - arm64: arm64_ftr_reg->name may not be a human-readable string
+    - arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
+    - bpf, sockmap: Remove unhash handler for BPF sockmap usage
+    - bpf, sockmap: Fix race in ingress receive verdict with redirect to self
+    - bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
+    - bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg
+    - dmaengine: stm32-dma: fix burst in case of unaligned memory address
+    - dmaengine: stm32-dma: avoid 64-bit division in stm32_dma_get_max_width
+    - gve: Fix off by one in gve_tx_timeout()
+    - drm/i915/fb: Fix rounding error in subsampled plane size calculation
+    - init: make unknown command line param message clearer
+    - seq_file: fix passing wrong private data
+    - drm/amdgpu: fix uvd crash on Polaris12 during driver unloading
+    - net: dsa: mv88e6xxx: Don't support >1G speeds on 6191X on ports other than
+      10
+    - net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any
+    - net: hns3: fix ROCE base interrupt vector initialization bug
+    - net: hns3: fix pfc packet number incorrect after querying pfc parameters
+    - net: hns3: fix kernel crash when unload VF while it is being reset
+    - net: hns3: allow configure ETS bandwidth of all TCs
+    - net: stmmac: allow a tc-taprio base-time of zero
+    - net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory
+    - net: marvell: mvpp2: Fix wrong SerDes reconfiguration order
+    - vsock: prevent unnecessary refcnt inc for nonblocking connect
+    - net/smc: fix sk_refcnt underflow on linkdown and fallback
+    - cxgb4: fix eeprom len when diagnostics not implemented
+    - selftests/net: udpgso_bench_rx: fix port argument
+    - thermal: int340x: fix build on 32-bit targets
+    - smb3: do not error on fsync when readonly
+    - ARM: 9155/1: fix early early_iounmap()
+    - ARM: 9156/1: drop cc-option fallbacks for architecture selection
+    - parisc: Fix backtrace to always include init funtion names
+    - parisc: Flush kernel data mapping in set_pte_at() when installing pte for
+      user page
+    - MIPS: fix duplicated slashes for Platform file path
+    - MIPS: fix *-pkg builds for loongson2ef platform
+    - MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL
+    - x86/mce: Add errata workaround for Skylake SKX37
+    - PCI/MSI: Move non-mask check back into low level accessors
+    - PCI/MSI: Destroy sysfs before freeing entries
+    - KVM: x86: move guest_pv_has out of user_access section
+    - posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()
+    - irqchip/sifive-plic: Fixup EOI failed when masked
+    - f2fs: should use GFP_NOFS for directory inodes
+    - f2fs: include non-compressed blocks in compr_written_block
+    - f2fs: fix UAF in f2fs_available_free_memory
+    - ceph: fix mdsmap decode when there are MDS's beyond max_mds
+    - erofs: fix unsafe pagevec reuse of hooked pclusters
+    - drm/i915/guc: Fix blocked context accounting
+    - block: Hold invalidate_lock in BLKDISCARD ioctl
+    - block: Hold invalidate_lock in BLKZEROOUT ioctl
+    - block: Hold invalidate_lock in BLKRESETZONE ioctl
+    - ksmbd: Fix buffer length check in fsctl_validate_negotiate_info()
+    - ksmbd: don't need 8byte alignment for request length in ksmbd_check_message
+    - dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail
+    - dmaengine: ti: k3-udma: Set r/tchan or rflow to NULL if request fail
+    - dmaengine: bestcomm: fix system boot lockups
+    - net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
+    - 9p/net: fix missing error check in p9_check_errors
+    - mm/filemap.c: remove bogus VM_BUG_ON
+    - memcg: prohibit unconditional exceeding the limit of dying tasks
+    - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
+    - mm, oom: do not trigger out_of_memory from the #PF
+    - mm, thp: lock filemap when truncating page cache
+    - mm, thp: fix incorrect unmap behavior for private pages
+    - mfd: dln2: Add cell for initializing DLN2 ADC
+    - video: backlight: Drop maximum brightness override for brightness zero
+    - bcache: fix use-after-free problem in bcache_device_free()
+    - bcache: Revert "bcache: use bvec_virt"
+    - PM: sleep: Avoid calling put_device() under dpm_list_mtx
+    - s390/cpumf: cpum_cf PMU displays invalid value after hotplug remove
+    - s390/cio: check the subchannel validity for dev_busid
+    - s390/tape: fix timer initialization in tape_std_assign()
+    - s390/ap: Fix hanging ioctl caused by orphaned replies
+    - s390/cio: make ccw_device_dma_* more robust
+    - remoteproc: elf_loader: Fix loading segment when is_iomem true
+    - remoteproc: Fix the wrong default value of is_iomem
+    - remoteproc: imx_rproc: Fix ignoring mapping vdev regions
+    - remoteproc: imx_rproc: Fix rsc-table name
+    - mtd: rawnand: fsmc: Fix use of SM ORDER
+    - mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines
+    - mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines
+    - powerpc/vas: Fix potential NULL pointer dereference
+    - powerpc/bpf: Fix write protecting JIT code
+    - powerpc/32e: Ignore ESR in instruction storage interrupt handler
+    - powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload
+    - powerpc/security: Use a mutex for interrupt exit code patching
+    - powerpc/64s/interrupt: Fix check_return_regs_valid() false positive
+    - powerpc/pseries/mobility: ignore ibm, platform-facilities updates
+    - powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n
+    - drm/sun4i: Fix macros in sun8i_csc.h
+    - PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
+    - PCI: aardvark: Fix PCIe Max Payload Size setting
+    - SUNRPC: Partial revert of commit 6f9f17287e78
+    - drm/amd/display: Look at firmware version to determine using dmub on dcn21
+    - media: vidtv: move kfree(dvb) to vidtv_bridge_dev_release()
+    - cifs: fix memory leak of smb3_fs_context_dup::server_hostname
+    - ath10k: fix invalid dma_addr_t token assignment
+    - mmc: moxart: Fix null pointer dereference on pointer host
+    - selftests/x86/iopl: Adjust to the faked iopl CLI/STI usage
+    - selftests/bpf: Fix also no-alu32 strobemeta selftest
+    - arch/cc: Introduce a function to check for confidential computing features
+    - x86/sev: Add an x86 version of cc_platform_has()
+    - x86/sev: Make the #VC exception stacks part of the default stacks storage
+    - media: videobuf2: always set buffer vb2 pointer
+    - media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference
+    - Linux 5.15.3
+
+  * kernel panic: NULL pointer dereference in wb_timer_f() (LP: #1947557) //
+    Jammy update: v5.15.3 upstream stable release (LP: #1951822)
+    - blk-wbt: prevent NULL pointer dereference in wb_timer_fn
+
+  * Medion Notebook Keyboard not working (LP: #1909814) // Jammy update: v5.15.3
+    upstream stable release (LP: #1951822)
+    - ACPI: resources: Add DMI-based legacy IRQ override quirk
+
+  * Enable CONFIG_INTEL_IOMMU_DEFAULT_ON and
+    CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON on jammy 5.15 (LP: #1951440)
+    - [Config] enable Intel DMA remapping options by default
+
+  * Thinkpad E14 Gen2: Kernel panic with trackpad and trackpoint enabled
+    (LP: #1945590)
+    - SAUCE: Input: elantech - Fix stack out of bound access in
+      elantech_change_report_id()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: LSM: Specify which LSM to display (using struct cred as input)
+    - SAUCE: selftests/seccomp: fix check of fds being assigned
+    - [Config] enable SUNRPC_DISABLE_INSECURE_ENCTYPES
+    - [Config] updateconfigs following v5.15.3, v5.15.4 import
+
+  * Miscellaneous upstream changes
+    - binder: use cred instead of task for selinux checks
+    - binder: use cred instead of task for getsecid
+    - Revert "UBUNTU: SAUCE: storvsc: use small sg_tablesize on x86"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 22 Nov 2021 13:14:15 +0100
+
+linux (5.15.0-11.11) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-11.11 -proposed tracker (LP: #1950948)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * OOPs on boot: invalid opcode: 0000 [#1] SMP NOPTI (LP: #1942215)
+    - SAUCE: ACPICA: prevent out-of-bound access with buggy DSDT
+    - [Config] disable UBSAN
+    - SAUCE: ACPICA: avoid accessing operands out-of-bounds
+
+  * Jammy update: v5.15.2 upstream stable release (LP: #1950949)
+    - KVM: x86: avoid warning with -Wbitwise-instead-of-logical
+    - Revert "x86/kvm: fix vcpu-id indexed array sizes"
+    - usb: ehci: handshake CMD_RUN instead of STS_HALT
+    - usb: gadget: Mark USB_FSL_QE broken on 64-bit
+    - usb: musb: Balance list entry in musb_gadget_queue
+    - usb-storage: Add compatibility quirk flags for iODD 2531/2541
+    - Revert "proc/wchan: use printk format instead of lookup_symbol_name()"
+    - binder: use euid from cred instead of using task
+    - binder: don't detect sender/target during buffer cleanup
+    - kfence: always use static branches to guard kfence_alloc()
+    - kfence: default to dynamic branch instead of static keys mode
+    - btrfs: fix lzo_decompress_bio() kmap leakage
+    - staging: rtl8712: fix use-after-free in rtl8712_dl_fw
+    - isofs: Fix out of bound access for corrupted isofs image
+    - comedi: dt9812: fix DMA buffers on stack
+    - comedi: ni_usb6501: fix NULL-deref in command paths
+    - comedi: vmk80xx: fix transfer-buffer overflows
+    - comedi: vmk80xx: fix bulk-buffer overflow
+    - comedi: vmk80xx: fix bulk and interrupt message timeouts
+    - staging: r8712u: fix control-message timeout
+    - staging: rtl8192u: fix control-message timeouts
+    - staging: r8188eu: fix memleak in rtw_wx_set_enc_ext
+    - media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
+    - rsi: fix control-message timeout
+    - Linux 5.15.2
+
+  * reuseport_bpf_numa in net from ubuntu_kernel_selftests fails on ppc64le
+    (LP: #1867570)
+    - selftests/net: Fix reuseport_bpf_numa by skipping unavailable nodes
+
+  * Miscellaneous Ubuntu changes
+    - packaging: switch getabis to the linux package name
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (no-up) rename the adv7511 drm driver to adv7511_drm"
+    - Revert "UBUNTU: SAUCE: drm/i915/dp: Use max params for older panels"
+    - Revert "UBUNTU: SAUCE: i915: Fix build error due to missing struct
+      definition"
+    - selftests/core: fix conflicting types compile error for close_range()
+    - selftests: net: test_vxlan_under_vrf: fix HV connectivity test
+    - Revert "UBUNTU: SAUCE: ACPICA: prevent out-of-bound access with buggy DSDT"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 15 Nov 2021 10:12:47 +0100
+
+linux (5.15.0-10.10) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-10.10 -proposed tracker (LP: #1950133)
+
+  * Jammy update: v5.15.1 upstream stable release (LP: #1950131)
+    - sfc: Fix reading non-legacy supported link modes
+    - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
+    - Revert "xhci: Set HCD flag to defer primary roothub registration"
+    - Revert "usb: core: hcd: Add support for deferring roothub registration"
+    - drm/amdkfd: fix boot failure when iommu is disabled in Picasso.
+    - Revert "soc: imx: gpcv2: move reset assert after requesting domain power up"
+    - ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
+    - Revert "wcn36xx: Disable bmps when encryption is disabled"
+    - drm/amdgpu: revert "Add autodump debugfs node for gpu reset v8"
+    - drm/amd/display: Revert "Directly retrain link from debugfs"
+    - Revert "drm/i915/gt: Propagate change in error status to children on unhold"
+    - ALSA: usb-audio: Add quirk for Audient iD14
+    - Linux 5.15.1
+
+  * Miscellaneous Ubuntu changes
+    - packaging: fixup previous ABI/spin to -9.9
+    - [Packaging] Drop unused d-i build-deps and packaging
+    - [Packaging] Drop now unsupported d-i/ input files
+
+  * Miscellaneous upstream changes
+    - selftests: net: properly support IPv6 in GSO GRE test
+    - signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 08 Nov 2021 14:43:24 +0100
+
+linux (5.15.0-9.9) jammy; urgency=medium
+
+  * jammy/linux: 5.15.0-1.1 -proposed tracker (LP: #1949876)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+    - [Packaging] update Ubuntu.md
+
+  * Add F81966 watchdog support (LP: #1949063)
+    - SAUCE: ODM: watchdog: f71808e_wdt: Add F81966 support
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Rewrite debian/scripts/misc/insert-changes.pl in Python
+    - [Packaging] change source package name to linux
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 04 Nov 2021 18:47:19 +0100
+
+linux (5.15.0-0.0) jammy; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 04 Nov 2021 16:47:16 +0100
+
+linux-unstable (5.15.0-8.8) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.15.0-8.8 -proposed tracker (LP: #1949436)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Drop "UBUNTU: SAUCE: cachefiles: Page leaking in
+    cachefiles_read_backing_file while vmscan is active" (LP: #1947709)
+    - Revert "UBUNTU: SAUCE: cachefiles: Page leaking in
+      cachefiles_read_backing_file while vmscan is active"
+
+  * Add l2tp.sh in net from ubuntu_kernel_selftests back (LP: #1934293)
+    - Revert "UBUNTU: SAUCE: selftests/net -- disable l2tp.sh test"
+
+  * Check for changes relevant for security certifications (LP: #1945989)
+    - [Packaging] Add fips-checks as part of finalchecks
+
+  * Add final-checks to check certificates (LP: #1947174)
+    - [Packaging] Add system trusted and revocation keys final check
+
+  * Can only reach PC3 when ethernet is plugged r8169 (LP: #1946433)
+    - r8169: Enable chip-specific ASPM regardless of PCIe ASPM status
+    - PCI/ASPM: Introduce a new helper to report ASPM capability
+    - r8169: Implement dynamic ASPM mechanism
+
+  * rtw89 kernel module for Realtek 8852 wifi is missing (LP: #1945967)
+    - rtw89: add Realtek 802.11ax driver
+    - rtw89: Remove redundant check of ret after call to rtw89_mac_enable_bb_rf
+    - rtw89: fix return value check in rtw89_cam_send_sec_key_cmd()
+    - rtw89: remove unneeded semicolon
+    - [Config] RTW89=m
+
+  * Fix A yellow screen pops up in an instant (< 1 second) and then disappears
+    before loading the system (LP: #1945932)
+    - drm/i915: Stop force enabling pipe bottom color gammma/csc
+
+  * disable CONFIG_KFENCE_STATIC_KEYS in linux 5.15 (LP: #1948038)
+    - [Config] disable CONFIG_KFENCE_STATIC_KEYS
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Remove old and unused firmware helper scripts
+    - [Packaging] Replace Perl oneliner with Bash statements
+    - rebase to v5.15
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 02 Nov 2021 08:29:45 +0100
+
+linux-unstable (5.15.0-7.7) jammy; urgency=medium
+
+  * jammy/linux-unstable: 5.15.0-7.7 -proposed tracker (LP: #1948770)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Temporarily disable signing for ppc64el and s390x
+    - packaging: switch release to Jammy
+    - rebase to v5.15-rc7
+    - [Config] GCC version update
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 26 Oct 2021 11:38:14 +0200
+
+linux-unstable (5.15.0-6.6) jammy; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-6.6 -proposed tracker (LP: #1947565)
+
+  * [impish] Remove the downstream xr-usb-uart driver (LP: #1945938)
+    - SAUCE: xr-usb-serial: remove driver
+    - [Config] update modules list
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc6
+    - [Config] update config & annotations following v5.15-rc6 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: xr-usb-serial: switch to tty_alloc_driver() and
+      tty_driver_kref_put()"
+    - Revert "UBUNTU: SAUCE: xr-usb-serial: update return code for
+      xr_usb_serial_tty_write_room() and xr_usb_serial_tty_chars_in_buffer()"
+    - Revert "UBUNTU: [Packaging] FTBFS: disable zfs"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 Oct 2021 12:24:45 +0200
+
+linux-unstable (5.15.0-5.5) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-5.5 -proposed tracker (LP: #1946338)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc5
+    - [Config] FB_SIMPLE=m
+    - [Config] update annotations
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 11 Oct 2021 12:14:02 +0200
+
+linux-unstable (5.15.0-4.4) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-4.4 -proposed tracker (LP: #1945953)
+
+  * Fix missing HDMI audio on Intel RKL (LP: #1945556)
+    - drm/i915/audio: Use BIOS provided value for RKL HDA link
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: media: atomisp: add missing return type (fix -Werror=return-type)
+    - SAUCE: xr-usb-serial: switch to tty_alloc_driver() and tty_driver_kref_put()
+    - rebase to v5.15-rc4
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] FTBFS: disable INTEL_ATOMISP"
+    - Revert "UBUNTU: [Config] FTBFS: disable xr-usb-serial"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 04 Oct 2021 10:52:41 +0200
+
+linux-unstable (5.15.0-3.3) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-3.3 -proposed tracker (LP: #1944944)
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc3
+    - [Config] updateconfigs following v5.15-rc3 rebase
+    - [Packaging] correctly evaluate release in update-dkms-versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 27 Sep 2021 16:48:03 +0200
+
+linux-unstable (5.15.0-2.2) impish; urgency=medium
+
+  * impish/linux-unstable: 5.15.0-2.2 -proposed tracker (LP: #1944423)
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.15-rc2
+    - [Config] updateconfigs following v5.15-rc2 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 21 Sep 2021 11:46:59 +0200
+
+linux-unstable (5.15.0-1.1) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - debian/dkms-versions -- update from kernel-versions (main/master)
+
+  *  LRMv5: switch primary version handling to kernel-versions data set
+    (LP: #1928921)
+    - [Packaging] switch to kernel-versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] remove remaining references to ports
+    - [Packaging] drop x32 architecture configs
+    - [Config] mark CONFIG_BPF_UNPRIV_DEFAULT_OFF enforced
+    - [Packaging] bump kernel version to 5.15
+    - rebase to v5.15-rc1
+    - [Config] updateconfigs following v5.15-rc1 rebase
+    - [Config] FTBFS: disable INTEL_ATOMISP
+    - [Config] FTBFS: disable xr-usb-serial
+    - [Packaging] FTBFS: disable zfs
+
+  * Miscellaneous upstream changes
+    - Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables
+      ASPM"
+    - Revert "UBUNTU: SAUCE: RDMA/core: Introduce peer memory interface"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.15-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 17 Sep 2021 11:42:25 +0200
+
+linux-unstable (5.15.0-0.0) impish; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 15 Sep 2021 11:54:10 +0200
+
+linux-unstable (5.14.0-9.9) impish; urgency=medium
+
+  * impish/linux-unstable: 5.14.0-9.9 -proposed tracker (LP: #1943022)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] NVIDIA -- Add the NVIDIA 470 driver
+    - [Packaging] NVIDIA: transition -460 and -465 to -470, transition -460-server
+      to -470-server
+
+  * Miscellaneous upstream changes
+    - vt_kdsetmode: extend console locking
+    - Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
+    - net: dsa: mt7530: fix VLAN traffic leaks again
+    - btrfs: fix NULL pointer dereference when deleting device by invalid id
+    - Revert "floppy: reintroduce O_NDELAY fix"
+    - fscrypt: add fscrypt_symlink_getattr() for computing st_size
+    - ext4: report correct st_size for encrypted symlinks
+    - f2fs: report correct st_size for encrypted symlinks
+    - ubifs: report correct st_size for encrypted symlinks
+    - net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
+    - audit: move put_tree() to avoid trim_trees refcount underflow and UAF
+    - Linux 5.14.1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 08 Sep 2021 12:20:18 +0200
+
+linux-unstable (5.14.0-8.8) impish; urgency=medium
+
+  * impish/linux-unstable: 5.14.0-8.8 -proposed tracker (LP: #1941887)
+
+  * Fix  Intel AC9560 BT function cannot turn on if BT turn off before S3 entry
+    (LP: #1941696)
+    - SAUCE: Bluetooth: btusb: add a reject table to disable msft
+
+  *  Add USB4 support for AMD SoC (LP: #1941036)
+    - thunderbolt: Add vendor specific NHI quirk for auto-clearing interrupt
+      status
+    - thunderbolt: Handle ring interrupt by reading interrupt status register
+    - thunderbolt: Do not read control adapter config space
+    - thunderbolt: Fix port linking by checking all adapters
+
+  * Support builtin revoked certificates (LP: #1932029)
+    - [Config] Enforce SYSTEM_TRUSTED_KEYS and SYSTEM_REVOCATION_KEYS
+
+  * GPIO error logs in start and dmesg after update of kernel (LP: #1937897)
+    - ODM: mfd: Check AAEON BFPI version before adding device
+
+  * initramfs-tools & kernel: use zstd as the default compression method
+    (LP: #1931725)
+    - [Config] enforce ZSTD compression
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.14
+    - [Config] RESET_MCHP_SPARX5 depends on ARCH_SPARX5
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] FTBFS: disable zfs"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 30 Aug 2021 12:57:19 +0200
+
+linux-unstable (5.14.0-7.7) impish; urgency=medium
+
+  * Please enable CONFIG_UBSAN_BOUNDS (LP: #1914685)
+    - [Config] Enable CONFIG_UBSAN_BOUNDS
+
+  * CONFIG_HARDENED_USERCOPY_FALLBACK should be disabled (LP: #1855340)
+    - [Config] Disable CONFIG_HARDENED_USERCOPY_FALLBACK
+
+  * fs: removing mandatory locks (LP: #1940392)
+    - [Config] Disable CONFIG_MANDATORY_FILE_LOCKING
+
+  * Fix kernel panic caused by legacy devices on AMD platforms (LP: #1936682)
+    - SAUCE: iommu/amd: Keep swiotlb enabled to ensure devices with 32bit DMA
+      still work
+
+  * ALSA: hda/cs8409: Add support for dolphin (LP: #1939541)
+    - ALSA: hda/cirrus: Move CS8409 HDA bridge to separate module
+    - ALSA: hda/cs8409: Move arrays of configuration to a new file
+    - ALSA: hda/cs8409: Use enums for register names and coefficients
+    - ALSA: hda/cs8409: Mask all CS42L42 interrupts on initialization
+    - ALSA: hda/cs8409: Reduce HS pops/clicks for Cyborg
+    - ALSA: hda/cs8409: Disable unnecessary Ring Sense for Cyborg/Warlock/Bullseye
+    - ALSA: hda/cs8409: Disable unsolicited responses during suspend
+    - ALSA: hda/cs8409: Disable unsolicited response for the first boot
+    - ALSA: hda/cs8409: Mask CS42L42 wake events
+    - ALSA: hda/cs8409: Simplify CS42L42 jack detect.
+    - ALSA: hda/cs8409: Prevent I2C access during suspend time
+    - ALSA: hda/cs8409: Generalize volume controls
+    - ALSA: hda/cs8409: Dont disable I2C clock between consecutive accesses
+    - ALSA: hda/cs8409: Avoid setting the same I2C address for every access
+    - ALSA: hda/cs8409: Avoid re-setting the same page as the last access
+    - ALSA: hda/cs8409: Support i2c bulk read/write functions
+    - ALSA: hda/cs8409: Separate CS8409, CS42L42 and project functions
+    - ALSA: hda/cs8409: Move codec properties to its own struct
+    - ALSA: hda/cs8409: Support multiple sub_codecs for Suspend/Resume/Unsol
+      events
+    - ALSA: hda/cs8409: Add Support to disable jack type detection for CS42L42
+    - ALSA: hda/cs8409: Add support for dolphin
+    - ALSA: hda/cs8409: Enable Full Scale Volume for Line Out Codec on Dolphin
+    - ALSA: hda/cs8409: Set fixed sample rate of 48kHz for CS42L42
+    - ALSA: hda/cs8409: Use timeout rather than retries for I2C transaction waits
+    - ALSA: hda/cs8409: Remove unnecessary delays
+    - ALSA: hda/cs8409: Follow correct CS42L42 power down sequence for suspend
+    - ALSA: hda/cs8409: Unmute/Mute codec when stream starts/stops
+    - ALSA: hda/cs8409: Prevent pops and clicks during suspend
+    - SAUCE: ALSA: hda/cs8409: Prevent pops and clicks during reboot
+    - [Config] Enable Cirrus Logic HDA bridge support
+
+  * e1000e: add handshake with the Intel CSME to support S0ix (LP: #1937252)
+    - SAUCE: e1000e: Add handshake with the CSME to support S0ix
+    - SAUCE: e1000e: Add polling mechanism to indicate CSME DPG exit
+    - SAUCE: e1000e: Additional PHY power saving in S0ix
+
+  * AMDGPU: Fix System hang after resume from suspend (LP: #1940204)
+    - SAUCE: drm/amdgpu: disable BACO support for 699F:C7 polaris12 SKU
+      temporarily
+
+  * [Regression] Audio card [8086:9d71] not detected after upgrade from linux
+    5.4 to 5.8 (LP: #1915117)
+    - [Config] set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.14-rc7
+    - [Config] updateconfigs following 5.14-rc7 rebase
+    - [Config] Enable CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT
+    - [Config] annotations: set CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT to y
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] annotations: set
+      CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y"
+    - Revert "UBUNTU: [Config] set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to
+      y"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 24 Aug 2021 10:32:31 +0200
+
+linux-unstable (5.14.0-6.6) impish; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - no changes upload (to avoid picking up libc6 from -proposed)
+
+  * No changes upload (to avoid picking up libc6 from -proposed)
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 18 Aug 2021 13:41:16 +0200
+
+linux-unstable (5.14.0-5.5) impish; urgency=medium
+
+  * disable “CONFIG_HISI_DMA” config for ubuntu version (LP: #1936771)
+    - [Config] Disable CONFIG_HISI_DMA
+
+  * Dell XPS 17 (9710) PCI/internal sound card not detected  (LP: #1935850)
+    - ASoC: Intel: sof_sdw: include rt711.h for RT711 JD mode
+    - ASoC: Intel: sof_sdw: add quirk for Dell XPS 9710
+
+  * [regression] USB device is not detected during boot (LP: #1939638)
+    - SAUCE: Revert "usb: core: reduce power-on-good delay time of root hub"
+
+  * armhf build failure (LP: #1939308)
+    - SAUCE: arm: Fix instruction set selection for GCC 11
+
+  * REGRESSION: shiftfs lets sendfile fail with EINVAL (LP: #1939301)
+    - SAUCE: shiftfs: fix sendfile() invocations
+
+  * Wobbly graphics on built-in display since linux-image-5.11.0-22-generic
+    (LP: #1936708)
+    - SAUCE: drm/i915/dp: Use max params for older panels
+
+  * [SRU][H/OEM-5.10/OEM-5.13/U] Fix system hang after unplug tbt dock
+    (LP: #1938689)
+    - SAUCE: igc: fix page fault when thunderbolt is unplugged
+
+  * e1000e blocks the boot process when it tried to write checksum to its NVM
+    (LP: #1936998)
+    - SAUCE: e1000e: Do not take care about recovery NVM checksum
+
+  * [Regression] Audio card [8086:9d71] not detected after upgrade from linux
+    5.4 to 5.8 (LP: #1915117)
+    - [Config] set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y
+    - [Config] annotations: set CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC to y
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs following 5.14-rc6 rebase
+    - rebase to v5.14-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 17 Aug 2021 17:49:15 +0200
+
+linux-unstable (5.14.0-4.4) impish; urgency=medium
+
+  * impish/linux-unstable: 5.14.0-4.4 -proposed tracker (LP: #1938566)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous upstream changes
+    - Revert "riscv: Get CPU manufacturer information"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 03 Aug 2021 14:50:27 +0200
+
+linux-unstable (5.14.0-3.3) impish; urgency=medium
+
+  * Add additional Mediatek MT7921 WiFi/BT device IDs (LP: #1937004)
+    - SAUCE: Bluetooth: btusb: Add Mediatek MT7921 support for Foxconn
+    - SAUCE: Bluetooth: btusb: Add Mediatek MT7921 support for IMC Network
+    - SAUCE: Bluetooth: btusb: Add support for Foxconn Mediatek Chip
+
+  * Fix display output on HP hybrid GFX laptops (LP: #1936296)
+    - drm/i915: Invoke another _DSM to enable MUX on HP Workstation laptops
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.14-rc3
+    - [Config] updateconfigs following 5.14-rc3 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 26 Jul 2021 12:52:38 +0200
+
+linux-unstable (5.14.0-2.2) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: xr-usb-serial: update return code for xr_usb_serial_tty_write_room()
+      and xr_usb_serial_tty_chars_in_buffer()
+    - SAUCE: platform/x86: dell-uart-backlight: update return code for
+      uart_chars_in_buffer(()
+    - [Config] updateconfigs following 5.14-rc2 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] FTBFS: disable ubuntu/xr-usb-serial"
+    - Revert "UBUNTU: [Config] FTBFS: disable DELL_UART_BACKLIGHT"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 22 Jul 2021 11:03:28 +0200
+
+linux-unstable (5.14.0-1.1) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] bump kernel version to 5.14
+    - [Config] updateconfigs following 5.14-rc1 rebase
+    - [Config] update annotations
+    - [Packaging] FTBFS: disable zfs
+    - [Config] FTBFS: disable DELL_UART_BACKLIGHT
+    - [Config] FTBFS: disable ubuntu/xr-usb-serial
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] update variants"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.14-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 16 Jul 2021 15:20:04 +0200
+
+linux-unstable (5.14.0-0.0) impish; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 13 Jul 2021 12:15:35 +0200
+
+linux (5.13.0-11.11) impish; urgency=medium
+
+  * impish/linux: 5.13.0-11.11 -proposed tracker (LP: #1933854)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Support builtin revoked certificates (LP: #1932029)
+    - [Packaging] build canonical-revoked-certs.pem from branch/arch certs
+    - [Packaging] Revoke 2012 UEFI signing certificate as built-in
+    - [Config] Configure CONFIG_SYSTEM_REVOCATION_KEYS with revoked keys
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Change source package name to linux
+
+  * Miscellaneous upstream changes
+    - mm/page_alloc: Correct return value of populated elements if bulk array is
+      populated
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 29 Jun 2021 07:50:25 +0200
+
+linux (5.13.0-10.10) impish; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Jun 2021 08:40:05 +0200
+
+linux-unstable (5.13.0-10.10) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-10.10 -proposed tracker (LP: #1933795)
+
+  * Pixel format change broken for Elgato Cam Link 4K (LP: #1932367)
+    - media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
+
+  * initramfs-tools & kernel: use zstd as the default compression method
+    (LP: #1931725)
+    - s390/decompressor: correct BOOT_HEAP_SIZE condition
+    - s390/boot: add zstd support
+    - [Packaging] use ZSTD to compress s390 kernels
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: tls: fix chacha+bidir tests
+    - SAUCE: selftests: icmp_redirect: support expected failures
+    - [Config] update configs and annotations after rebase to 5.13
+
+  * Miscellaneous upstream changes
+    - tls: prevent oversized sendfile() hangs by ignoring MSG_MORE
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 28 Jun 2021 08:40:05 +0200
+
+linux-unstable (5.13.0-9.9) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-9.9 -proposed tracker (LP: #1933070)
+
+  * Add support for selective build of special drivers (LP: #1912789)
+    - [Packaging] Add support for ODM drivers
+    - [Packaging] Turn on ODM support for amd64
+    - [Packaging] Fix ODM support in actual build
+    - [Packaging] Fix ODM DRIVERS Kconfig
+
+  * Add support for IO functions of AAEON devices (LP: #1929504)
+    - ODM: [Config] update config for AAEON devices
+    - ODM: hwmon: add driver for AAEON devices
+    - ODM: leds: add driver for AAEON devices
+    - ODM: watchdog: add driver for AAEON devices
+    - ODM: gpio: add driver for AAEON devices
+    - ODM: mfd: Add support for IO functions of AAEON devices
+
+  * Disable hv-kvp-daemon.service on certain instance types (LP: #1932081)
+    - [Packaging]: Add kernel command line condition to hv-kvp-daemon service
+
+  * Fix non-working GPU on Some HP desktops (LP: #1931147)
+    - PCI: Coalesce host bridge contiguous apertures
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: seccomp: bump up timeout to 5min
+    - SAUCE: Revert "net/tls(TLS_SW): Add selftest for 'chunked' sendfile test"
+    - [Config] update annotations after rebase to 5.13-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Jun 2021 10:55:36 +0200
+
+linux-unstable (5.13.0-8.8) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-8.8 -proposed tracker (LP: #1932018)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * initramfs-tools & kernel: use zstd as the default compression method
+    (LP: #1931725)
+    - [Config] use ZSTD to compress amd64 kernels
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable signing for ppc64el
+    - SAUCE: powerpc: Fix initrd corruption with relative jump labels
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 15 Jun 2021 15:07:34 +0200
+
+linux-unstable (5.13.0-7.7) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-7.7 -proposed tracker (LP: #1931840)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+    - [Packaging] resync getabis
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  * Intel ADL-S graphics feature enabling (LP: #1931240)
+    - SAUCE: drm/i915/adl_s: ADL-S platform Update PCI ids for Mobile BGA
+
+  * Kernel package builds running out of space on builders (LP: #1930713)
+    - [Config] CONFIG_DEBUG_INFO_COMPRESSED=n
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] remove nvidia dkms build support
+    - [Config] remove now unsued do_dkms_nvidia* build variables
+    - [Config] enable signing for s390x
+    - [Config] update annotations after configs review
+    - [Config] update toolchain versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Jun 2021 11:53:08 +0200
+
+linux-unstable (5.13.0-6.6) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-6.6 -proposed tracker (LP: #1931071)
+
+  * Kernel package builds running out of space on builders (LP: #1930713)
+    - [Debian] use stamps for flavour install targets
+    - [Debian] run install-$(flavour) targets during build phase
+    - [Debian] remove dh_testroot from install targets
+    - [Debian] dkms-build -- use fakeroot if not running as root
+    - [Debian] exclude $(DEBIAN)/__abi.current from linux-source
+
+  * [UBUNTU 21.04] tools/kvm_stat: Add restart delay (LP: #1921870)
+    - [Debian] install kvm_stat systemd service
+
+  * Debugging symbols (dbgsym) packages are missing GDB kernel scripts
+    (LP: #1928715)
+    - [Packaging] Build and include GDB Python scripts into debug packages
+
+  * Can't detect intel wifi 6235 (LP: #1920180)
+    - SAUCE: iwlwifi: add new pci id for 6235
+
+  * Select correct boot VGA when BIOS doesn't do it properly (LP: #1929217)
+    - vgaarb: Use ACPI HID name to find integrated GPU
+
+  * Fix kernel panic on Intel Bluetooth (LP: #1928838)
+    - Bluetooth: Shutdown controller after workqueues are flushed or cancelled
+
+  * build module CONFIG_SND_SOC_INTEL_SOUNDWIRE_SOF_MACH=m for 5.11,  5.13-rc2
+    and later (LP: #1921632)
+    - [Config] enable soundwire audio mach driver
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_SND_SOC_RT1308 can only be enabled on amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 07 Jun 2021 10:45:13 +0200
+
+linux-unstable (5.13.0-5.5) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-5.5 -proposed tracker (LP: #1930205)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] set CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 31 May 2021 12:32:38 +0200
+
+linux-unstable (5.13.0-4.4) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-4.4 -proposed tracker (LP: #1929404)
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Support importing mokx keys into revocation list from the mok table
+    (LP: #1928679)
+    - SAUCE: integrity: add informational messages when revoking certs
+
+  * Support importing mokx keys into revocation list from the mok table
+    (LP: #1928679) // CVE-2020-26541 when certificates are revoked via
+    MokListXRT.
+    - SAUCE: integrity: Load mokx certs from the EFI MOK config table
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Temporarily disable signing for ppc64el and s390x
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Be more careful about copying up
+      sxid files"
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Propogate nosuid from lower and
+      upper mounts"
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Enable user namespace mounts"
+    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: ensure mounter privileges when
+      reading directories"
+    - SAUCE: Revert "UBUNTU: SAUCE: fs: Move SB_I_NOSUID to the top of s_iflags"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 24 May 2021 13:06:17 +0200
+
+linux-unstable (5.13.0-3.3) impish; urgency=medium
+
+  * impish/linux-unstable: 5.13.0-3.3 -proposed tracker (LP: #1928655)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 17 May 2021 11:55:02 +0200
+
+linux-unstable (5.13.0-2.2) impish; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable CONFIG_DEBUG_INFO_COMPRESSED
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] temporarily disable BPF JIT"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Fri, 14 May 2021 09:19:02 +0200
+
+linux-unstable (5.13.0-1.1) impish; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.13-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 12 May 2021 11:35:23 +0200
+
+linux-unstable (5.13.0-0.0) impish; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 11 May 2021 08:40:09 +0200
+
+linux-unstable (5.12.0-11.11) impish; urgency=medium
+
+  * Impish update: v5.12.1 upstream stable release (LP: #1927094)
+    - net: hso: fix NULL-deref on disconnect regression
+    - USB: CDC-ACM: fix poison/unpoison imbalance
+    - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
+    - cfg80211: fix locking in netlink owner interface destruction
+    - mei: me: add Alder Lake P device id.
+    - Linux 5.12.1
+
+  * Packaging resync (LP: #1786013) // Impish update: v5.12.1 upstream stable
+    release (LP: #1927094)
+    - update dkms package versions
+
+  * Gigabyte R120-T33 (ARM ThunderX SoC) fails to boot in ACPI mode
+    (LP: #1925075) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure
+
+  * Fix kernel panic at boot on dual GFX systems (LP: #1926792) // Impish
+    update: v5.12.1 upstream stable release (LP: #1927094)
+    - drm/amdgpu: Register VGA clients after init can no longer fail
+
+  * On TGL platforms screen shows garbage when browsing website by scrolling
+    mouse (LP: #1926579) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - SAUCE: drm/i915/display: Disable PSR2 if TGL Display stepping is B1 from A0
+
+  * CirrusLogic: Cracking noises appears in built-in speaker when output volume
+    is set >80% (LP: #1924997) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - SAUCE: ALSA: hda/cirrus: Use CS8409 Equalizer to fix abnormal sounds on
+      Bullseye
+
+  * Enable mute/micmute LEDs and limit mic boost on EliteBook 845 G8
+    (LP: #1925415) // Impish update: v5.12.1 upstream stable release
+    (LP: #1927094)
+    - ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook
+      845 G8
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: PCI: Disable broken RTIT_BAR of Intel TH"
+    - Revert "UBUNTU: [Config] temporarily disable ZFS"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 04 May 2021 18:35:54 +0200
+
+linux-unstable (5.12.0-10.10) impish; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Drop versioned ABI directory names
+    - [Packaging] getabis: Download ABIs into an unversioned directory
+    - [Packaging] final-checks: Handle unversioned ABI directories
+    - bump to impish
+    - [Config] GCC version update
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 29 Apr 2021 12:27:20 +0200
+
+linux-unstable (5.12.0-9.9) impish; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Apr 2021 11:14:16 -0500
+
+linux-unstable (5.12.0-8.8) hirsute; urgency=medium
+
+  * CVE-2021-3492
+    - SAUCE: shiftfs: free allocated memory in shiftfs_btrfs_ioctl_fd_replace()
+      error paths
+    - SAUCE: shiftfs: handle copy_to_user() return values correctly
+
+  * Fix no picture from HDMI when it's plugged after boot (LP: #1924238)
+    - drm/i915/display: Handle lane polarity for DDI port
+
+  * hirsute beta desktop AMD64 ISO kernel panic on boot when booting using UEFI
+    (LP: #1922403)
+    - SAUCE: efifb: Check efifb_pci_dev before using it
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.12-rc8
+    - [Config] updateconfigs following 5.12-rc8 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc8
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 19 Apr 2021 11:37:27 +0200
+
+linux-unstable (5.12.0-7.7) hirsute; urgency=medium
+
+  * drm/i915: Drop force_probe requirement for Rocket Lake (LP: #1905466)
+    - drm/i915/rkl: Remove require_force_probe protection
+
+  * HP m400 cartridges fail to find NIC when deploying hirsute (LP: #1918793)
+    - PCI: xgene: Fix cfg resource mapping
+
+  * Update - Fix no screen show on display after S3 on CML-R  (LP: #1922768)
+    - drm/i915/gen9bc: Handle TGP PCH during suspend/resume
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: RDMA/core: Introduce peer memory interface
+    - Rebase to v5.12-rc7
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 12 Apr 2021 11:48:07 +0200
+
+linux-unstable (5.12.0-6.6) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * i915 doesn't support some high pixel clock 4k * 60Hz monitors (LP: #1922372)
+    - drm/i915/vbt: update DP max link rate table
+
+  * Tegra "mmc0: Timeout waiting for hardware interrupt" (LP: #1921140)
+    - SAUCE: mmc: host: Add required callbacks to set/clear CQE_EN bit
+
+  * Enable ath11k debugfs/tracing (LP: #1922033)
+    - [Config] enable ath11k debugfs/tracing
+
+  * Fix mic on P620 after S3 resume (LP: #1921757)
+    - ALSA: usb-audio: Carve out connector value checking into a helper
+    - ALSA: usb-audio: Check connector value on resume
+
+  * Miscellaneous Ubuntu changes
+    - [Config] amd64,arm64: build KFENCE support but disable it by default
+      (KFENCE_SAMPLE_INTERVAL=0)
+    - Rebase to v5.12-rc6
+
+  * Miscellaneous upstream changes
+    - drm/dp: add MSO related DPCD registers
+    - drm/i915/edp: reject modes with dimensions other than fixed mode
+    - drm/i915/edp: always add fixed mode to probed modes in ->get_modes()
+    - drm/i915/edp: read sink MSO configuration for eDP 1.4+
+    - drm/i915/reg: add stream splitter configuration definitions
+    - drm/i915/mso: add splitter state readout for platforms that support it
+    - drm/i915/mso: add splitter state check
+    - drm/i915/edp: modify fixed and downclock modes for MSO
+    - drm/i915/edp: enable eDP MSO during link training
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 07 Apr 2021 11:42:55 +0200
+
+linux-unstable (5.12.0-5.5) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * alsa/realtek: extend the delay time in the  determine_headset_type for a
+    Dell AIO (LP: #1920747)
+    - SAUCE: ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO
+
+  * power off stress test will hang on the TGL machines (LP: #1919930)
+    - SAUCE: ASoC: SOF: Intel: TGL: set shutdown callback to hda_dsp_shutdown
+    - [Config] set SND_SOC_SOF_HDA_ALWAYS_ENABLE_DMI_L1 to n
+
+  * lockdown on power (LP: #1855668)
+    - SAUCE: (lockdown) powerpc: lock down kernel in secure boot mode
+
+  * Miscellaneous Ubuntu changes
+    - [Config] arm64 -- unify build_image and kernel_file values
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: xr-usb-serial: clean up indentation
+    - SAUCE: xr-usb-serial: clean up build warnings
+    - SAUCE: apparmor: Fix build error, make sk parameter const
+    - Rebase to v5.12-rc5
+    - [Config] updateconfigs following v5.12-rc5 rebase
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (lockdown) s390: Lock down the kernel when the IPL
+      secure flag is set"
+    - Revert "UBUNTU: SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to
+      indicate secure boot mode"
+    - Revert "UBUNTU: SAUCE: (lockdown) powerpc: lock down kernel in secure boot
+      mode"
+    - Revert "UBUNTU: SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic"
+    - Revert "UBUNTU: SAUCE: (lockdown) arm64: Allow locking down the kernel under
+      EFI secure boot"
+    - Revert "UBUNTU: SAUCE: (lockdown) KEYS: Make use of platform keyring for
+      module signature verify"
+    - Revert "UBUNTU: SAUCE: (lockdown) efi: Lock down the kernel if booted in
+      secure boot mode"
+    - Revert "UBUNTU: SAUCE: (lockdown) security: lockdown: expose a hook to lock
+      the kernel down"
+    - Revert "UBUNTU: SAUCE: (lockdown) Make get_cert_list() use
+      efi_status_to_str() to print error messages."
+    - Revert "UBUNTU: SAUCE: (lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err()."
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 29 Mar 2021 12:59:38 +0200
+
+linux-unstable (5.12.0-4.4) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Fix broken efifb on graphics device without driver (LP: #1914411)
+    - SAUCE: efifb: Ensure graphics device for efifb stays at PCI D0
+
+  * Fix system sleep on TGL systems with Intel ME (LP: #1919321)
+    - SAUCE: PCI: Serialize TGL e1000e PM ops
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.12-rc4
+    - [Config] updateconfigs following v5.12-rc4 rebase
+
+  * Miscellaneous upstream changes
+    - riscv: dts: fu740: fix cache-controller interrupts
+    - riscv: sifive: fu740: cpu{1, 2, 3, 4} set compatible to sifive, u74-mc
+    - riscv: sifive: unmatched: update for 16GB rev3
+    - riscv: Add 3 SBI wrapper functions to get cpu manufacturer information
+    - riscv: Get CPU manufacturer information
+    - riscv: Introduce alternative mechanism to apply errata solution
+    - riscv: sifive: apply errata "cip-453" patch
+    - clk: sifive: Add pcie_aux clock in prci driver for PCIe driver
+    - clk: sifive: Use reset-simple in prci driver for PCIe driver
+    - MAINTAINERS: Add maintainers for SiFive FU740 PCIe driver
+    - dt-bindings: PCI: Add SiFive FU740 PCIe host controller
+    - PCI: designware: Add SiFive FU740 PCIe host controller driver
+    - riscv: dts: Add PCIe support for the SiFive FU740-C000 SoC
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc4
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 22 Mar 2021 12:43:14 +0100
+
+linux-unstable (5.12.0-3.3) hirsute; urgency=medium
+
+  *  riscv: revert SiFive Unleashed CPUFreq (LP: #1917433)
+    - SAUCE: Revert "SiFive Unleashed CPUFreq"
+
+  * Dell Precision 5550 takes up to 10 seconds to respond when coming out of
+    sleep (LP: #1919123)
+    - SAUCE: Input: i8042 - add dmi quirk
+
+  * LRMv4: switch to signing nvidia modules via the Ubuntu Modules signing key
+    (LP: #1918134)
+    - [Packaging] sync dkms-build et al from LRMv4
+
+  * curtin: install flash-kernel in arm64 UEFI unexpected (LP: #1918427)
+    - [Packaging] Allow grub-efi-arm* to satisfy recommends on ARM
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Enable Tegra support in arm64 for NVIDIA Jetson (LP: #1918471)
+    - [Config] enable ARCH_TEGRA and all Tegra SOC's
+    - [Packaging] include modern Tegra modules
+
+  * Cirrus Audio Codec CS8409/CS42L42: Input Device does not switch to headset
+    Mic when a headset is inserted (LP: #1918378)
+    - SAUCE: ALSA: hda/cirrus: Fix Headset Mic volume control name
+
+  * Cirrus Audio Codec CS8409/CS42L42 support (LP: #1916554)
+    - ALSA: hda/cirrus: Increase AUTO_CFG_MAX_INS from 8 to 18
+    - ALSA: hda/cirrus: Add support for CS8409 HDA bridge and CS42L42 companion
+      codec.
+    - ALSA: hda/cirrus: Add jack detect interrupt support from CS42L42 companion
+      codec.
+    - ALSA: hda/cirrus: Add Headphone and Headset MIC Volume Control
+
+  * drm/i915: Drop force_probe requirement for JSL (LP: #1917843)
+    - SAUCE: drm/i915: Drop require_force_probe from JSL
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Skip d-i code if udebs are disabled
+    - [Packaging] Disable udebs if $DEBIAN/d-i doesn't exist
+    - [Packaging] remove dh-systemd build dependency
+    - [Config] fix several annotaions with enforcement typos
+    - [Config] refresh annotations
+    - [Config] updateconfigs following v5.12-rc3 rebase
+    - annotations: fixup after v5.12-rc3 rebase
+    - Rebase to v5.12-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 16 Mar 2021 18:43:03 +0100
+
+linux-unstable (5.12.0-2.2) hirsute; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.12-rc2
+    - [Config] updateconfigs following v5.12-rc2 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 08 Mar 2021 11:22:04 +0100
+
+linux-unstable (5.12.0-1.1) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Support no udeb profile (LP: #1916095)
+    - [Packaging] replace custom filter script with dctrl-tools
+    - [Packaging] correctly implement noudeb build profiles.
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] dkms-versions -- remove nvidia-graphics-drivers-440-server
+    - [Debian] run ubuntu-regression-suite for linux-unstable
+    - [Packaging] remove Provides: aufs-dkms
+    - [Config] update config and annotations following v5.12-rc1 rebase
+    - [Config] disable nvidia and nvidia_server builds
+    - [Config] temporarily disable ZFS
+    - temporarily disable modules check
+    - annotations: s390: temporarily remove CONFIG_KMSG_IDS
+    - [Config] amd64: FTBFS: disable HIO
+    - [Config] FTBFS: disable SHIFT_FS
+    - [Config] s390: temporarily remove CONFIG_KMSG_IDS
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] disable nvidia and nvidia_server builds"
+    - Revert "UBUNTU: SAUCE: s390: kernel message catalog"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.12-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 04 Mar 2021 18:26:12 +0100
+
+linux-unstable (5.12.0-0.0) hirsute; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 04 Mar 2021 18:17:32 +0100
+
+linux-unstable (5.11.0-10.11) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Support CML-S CPU + TGP PCH (LP: #1909457)
+    - drm/i915/rkl: new rkl ddc map for different PCH
+    - SAUCE: drm/i915/gen9_bc : Add TGP PCH support
+
+  * Use DCPD to control HP DreamColor panel (LP: #1911001)
+    - SAUCE: drm/dp: Another HP DreamColor panel brigntness fix
+
+  * Update nvidia dkms build for module linker script changes
+    - [Packaging] build-dkms--nvidia-N -- Update for preprocessed module linker
+      script
+
+  * Please trust Canonical Livepatch Service kmod signing key (LP: #1898716)
+    - [Config] enable CONFIG_MODVERSIONS=y
+    - [Packaging] build canonical-certs.pem from branch/arch certs
+    - [Config] add Canonical Livepatch Service key to SYSTEM_TRUSTED_KEYS
+    - [Config] add ubuntu-drivers key to SYSTEM_TRUSTED_KEYS
+
+  * Miscellaneous Ubuntu changes
+    - [Config] re-enable nvidia dkms
+    - SAUCE: selftests: memory-hotplug: bump timeout to 10min
+    - [Debian] update-aufs.sh -- Don't apply tmpfs-idr.patch
+    - [Config] Update configs
+    - [Config] disable nvidia and nvidia_server builds
+    - SAUCE: Import aufs driver
+    - [Config] CONFIG_AUFS_FS=n
+    - [Config] refresh annotations file
+    - [Config] set CONFIG_MIPI_I3C_HCI=m consistently
+    - [Config] set CONFIG_PINCTRL_MSM8953=m on armhf generic-lpae
+    - [Packaging] Change source package name to linux-unstable
+    - [Config] update LD_VERSION in config due to toolchain update
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: tmpfs: Don't use 64-bit inodes by defulat with 32-bit
+      ino_t"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 Feb 2021 07:18:07 +0100
+
+linux-unstable (5.11.0-9.10) hirsute; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 22 Feb 2021 07:02:45 +0100
+
+linux (5.11.0-9.10) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs/annotations after rebase to 5.11
+    - zfs-modules.ignore: add zzstd
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 15 Feb 2021 16:29:36 +0100
+
+linux (5.11.0-8.9) hirsute; urgency=medium
+
+  * Missing device id for Intel TGL-H ISH [8086:43fc] in intel-ish-hid driver
+    (LP: #1914543)
+    - SAUCE: HID: intel-ish-hid: ipc: Add Tiger Lake H PCI device ID
+
+  *  Add support for new Realtek ethernet NIC (LP: #1914604)
+    - r8169: Add support for another RTL8168FP
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: tmpfs: Don't use 64-bit inodes by defulat with 32-bit ino_t
+    - [Config] Set CONFIG_TMPFS_INODE64=n for s390x
+    - [Config] re-enable ZFS
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 08 Feb 2021 11:56:23 +0100
+
+linux (5.11.0-7.8) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  *  Boot fails: failed to validate module [nls_iso8859_1] BTF: -22
+    (LP: #1911359)
+    - SAUCE: x86/entry: build thunk_$(BITS) only if CONFIG_PREEMPTION=y
+
+  * Remove scary stack trace from Realtek WiFi driver (LP: #1913263)
+    - rtw88: reduce the log level for failure of tx report
+
+  * Fix unexpected AER/DPC on PCH400 and PCH500 (LP: #1913691)
+    - Revert "UBUNTU: SAUCE: PCI: Enable ACS quirk on all CML root ports"
+    - Revert "UBUNTU: SAUCE: PCI: Enable ACS quirk on CML root port"
+    - SAUCE: PCI/AER: Disable AER interrupt during suspend
+    - SAUCE: PCI/DPC: Disable DPC interrupt during suspend
+
+  * switch to an autogenerated nvidia series based core via dkms-versions
+    (LP: #1912803)
+    - [Packaging] nvidia -- use dkms-versions to define versions built
+    - [Packaging] update-version-dkms -- maintain flags fields
+
+  * Introduce the new NVIDIA 460-server series and update the 460 series
+    (LP: #1913200)
+    - [Config] dkms-versions -- add the 460-server nvidia driver
+
+  * Fix the video can't output through WD19TB connected with TGL platform during
+    cold-boot (LP: #1910211)
+    - SAUCE: drm/i915/dp: Prevent setting LTTPR mode if no LTTPR is detected
+
+  * Stop using get_scalar_status command in Dell AIO uart backlight driver
+    (LP: #1865402)
+    - SAUCE: platform/x86: dell-uart-backlight: add get_display_mode command
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/seccomp: Accept any valid fd in user_notification_addfd
+    - [Packaging] Don't disable CONFIG_DEBUG_INFO in headers packages
+    - [Config] update configs/annotations after rebase to 5.11-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 01 Feb 2021 10:27:52 +0100
+
+linux (5.11.0-6.7) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Prevent thermal shutdown during boot process (LP: #1906168)
+    - thermal/drivers/acpi: Use hot and critical ops
+    - thermal/core: Remove notify ops
+    - thermal: int340x: Fix unexpected shutdown at critical temperature
+    - thermal: intel: pch: Fix unexpected shutdown at critical temperature
+
+  * riscv: backport support for SiFive Unmatched (LP: #1910965)
+    - RISC-V: Update l2 cache DT documentation to add support for SiFive FU740
+    - RISC-V: sifive_l2_cache: Update L2 cache driver to support SiFive FU740
+    - dt-bindings: riscv: Update DT binding docs to support SiFive FU740 SoC
+    - riscv: dts: add initial support for the SiFive FU740-C000 SoC
+    - dt-bindings: riscv: Update YAML doc to support SiFive HiFive Unmatched board
+    - riscv: dts: add initial board data for the SiFive HiFive Unmatched
+    - PCI: microsemi: Add host driver for Microsemi PCIe controller
+    - Microsemi PCIe expansion board DT entry.
+    - SiFive Unleashed CPUFreq
+    - SiFive HiFive Unleashed: Add PWM LEDs (D1, D2, D3, D4)
+
+  * initramfs unpacking failed (LP: #1835660)
+    - lib/decompress_unlz4.c: correctly handle zero-padding around initrds.
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to 5.11-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 25 Jan 2021 09:31:31 +0100
+
+linux (5.11.0-5.6) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update config and annotations after rebase to 5.11-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 18 Jan 2021 10:46:10 +0100
+
+linux (5.11.0-4.5) hirsute; urgency=medium
+
+  *  Boot fails: failed to validate module [nls_iso8859_1] BTF: -22
+    (LP: #1911359)
+    - SAUCE: x86/entry: build thunk_$(BITS) only if CONFIG_PREEMPTION=y
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Jan 2021 12:53:26 +0100
+
+linux (5.11.0-3.4) hirsute; urgency=medium
+
+  *  Boot fails: failed to validate module [nls_iso8859_1] BTF: -22
+    (LP: #1911359)
+    - bpf: Allow empty module BTFs
+    - libbpf: Allow loading empty BTFs
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 14 Jan 2021 07:43:45 +0100
+
+linux (5.11.0-2.3) hirsute; urgency=medium
+
+  * DMI entry syntax fix for Pegatron / ByteSpeed C15B (LP: #1910639)
+    - Input: i8042 - unbreak Pegatron C15B
+
+  * SYNA30B4:00 06CB:CE09 Mouse  on HP EliteBook 850 G7 not working at all
+    (LP: #1908992)
+    - HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device
+
+  * debian/scripts/file-downloader does not handle positive failures correctly
+    (LP: #1878897)
+    - [Packaging] file-downloader not handling positive failures correctly
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * CVE-2021-1052 // CVE-2021-1053
+    - [Packaging] NVIDIA -- Add the NVIDIA 460 driver
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Remove nvidia-455 dkms build
+    - SAUCE: ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP
+      machines
+    - [Config] update configs and annotations after rebase to 5.11-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 11 Jan 2021 09:52:27 +0100
+
+linux (5.11.0-1.2) hirsute; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 07 Jan 2021 16:57:01 +0100
+
+linux (5.11.0-0.1) hirsute; urgency=medium
+
+  * dep-8 ubuntu-regression-suite tests are not run for all linux-hwe-* kernels
+    (LP: #1908529)
+    - [dep-8] Allow all hwe kernels
+
+  * Fix reading speed and duplex sysfs on igc device (LP: #1906851)
+    - igc: Report speed and duplex as unknown when device is runtime suspended
+
+  * rtwpci driver blocks the system to enter PC10, stuck at PC3 (LP: #1907200)
+    - SAUCE: rtw88: 8723de: let cpu enter c10
+
+  * [21.04 FEAT] Deactivate CONFIG_QETH_OSN kernel config option (LP: #1906370)
+    - [Config] Deactivate CONFIG_QETH_OSN kernel config option
+
+  * Add dpcd backlight control for 0x4c83 0x4f41 (LP: #1905663)
+    - SAUCE: drm/dp: Add dpcd backlight control for 0x4c83 0x4f41
+
+  * disable building bpf selftests (LP: #1908144)
+    - SAUCE: selftests/bpf: Clarify build error if no vmlinux
+    - SAUCE: selftests: Skip BPF selftests by default
+    - disable building bpf selftests (no VMLINUX_BTF)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - [Config] update configs and annotations after rebase to v5.11-rc1
+    - hio: fix build error with kernel 5.11
+    - SAUCE: shiftfs: fix build error with 5.11
+    - [Config] temporarily disable ZFS
+    - check-aliases: do not error if modules.alias does not exist
+    - ppc64el: don't build stripped vdso
+
+  * Miscellaneous upstream changes
+    - irq: export irq_check_status_bit
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.11-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Jan 2021 09:17:48 +0100
+
+linux (5.11.0-0.0) hirsute; urgency=medium
+
+  * Empty entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 30 Dec 2020 09:04:41 +0100
+
+linux (5.10.0-9.10) hirsute; urgency=medium
+
+  * Use INTx for Pericom USB controllers (LP: #1906839)
+    - PCI: Disable MSI for Pericom PCIe-USB adapter
+
+  * disable building bpf selftests (LP: #1908144)
+    - SAUCE: selftests/bpf: clarify build error if no vmlinux
+    - SAUCE: selftests: Skip BPF seftests by default
+    - disable building bpf selftests (no VMLINUX_BTF)
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Enable CONFIG_BPF_LSM
+
+  * Miscellaneous upstream changes
+    - Revert "md: change mddev 'chunk_sectors' from int to unsigned"
+    - Revert "dm raid: fix discard limits for raid1 and raid10"
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 15 Dec 2020 10:16:14 +0100
+
+linux (5.10.0-8.9) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Fix bpf selftest compilation with clang 11
+    - bpf: Fix selftest compilation on clang 11
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update configs and annotations after rebase to v5.10
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Dec 2020 08:57:57 +0100
+
+linux (5.10.0-7.8) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Fix linux-libc-dev build for hirsute forward port kernels (LP: #1904067)
+    - [Debian] Build linux-libc-dev for debian.master* branches
+
+  * Update kernel packaging to support forward porting kernels (LP: #1902957)
+    - [Debian] Update for leader included in BACKPORT_SUFFIX
+
+  * Introduce the new NVIDIA 455 series (LP: #1897751)
+    - [Packaging] NVIDIA -- Add signed modules for the 455 driver
+
+  * 5.10 kernel fails to boot with secure boot disabled (LP: #1904906)
+    - [Config] CONFIG_RCU_SCALE_TEST=n
+
+  * Miscellaneous Ubuntu changes
+    - [Config] s390x: disable GPIO_CDEV
+    - [Config] ARM_CMN=m
+    - [Config] disable GPIO_CDEV_V1
+    - [Config] Reorder annotations after 5.10-rc6 rebase
+    - [Packaging] Remove nvidia-435 dkms build
+    - [Packaging] Change source package name to linux
+    - [Config] Update configs and annotations after rebase to v5.10-rc7
+    - SAUCE: Revert "mm/filemap: add static for function
+      __add_to_page_cache_locked"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 07 Dec 2020 00:15:20 -0600
+
+linux (5.10.0-6.7) hirsute; urgency=medium
+
+  * Empty entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 06 Dec 2020 22:13:46 -0600
+
+linux-5.10 (5.10.0-6.7) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Avoid double newline when running insertchanges (LP: #1903293)
+    - [Packaging] insertchanges: avoid double newline
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging]: linux-modules should depend on linux-image
+    - [Packaging]: linux-image should suggest linux-modules-extra
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 30 Nov 2020 07:47:34 +0100
+
+linux-5.10 (5.10.0-5.6) hirsute; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] add CONFIG_INFINIBAND_VIRT_DMA
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 23 Nov 2020 13:17:44 +0100
+
+linux-5.10 (5.10.0-4.5) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] reduce the size required to build packages
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 16 Nov 2020 08:33:54 +0100
+
+linux-5.10 (5.10.0-3.4) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * e1000e: fix issues with S0ix (LP: #1902687)
+    - SAUCE: e1000e: fix S0ix flow to allow S0i3.2 subset entry
+    - SAUCE: e1000e: allow turning s0ix flows on for systems with ME
+    - SAUCE: e1000e: Add Dell's Comet Lake systems into s0ix heuristics
+    - SAUCE: e1000e: Add more Dell CML systems into s0ix heuristics
+    - [Config] Update CONFIG_E1000E for ppc64el in annotations
+
+  * perf: Add support for Rocket Lake (LP: #1902004)
+    - SAUCE: perf/x86/intel: Add Rocket Lake CPU support
+    - SAUCE: perf/x86/cstate: Add Rocket Lake CPU support
+    - SAUCE: perf/x86/msr: Add Rocket Lake CPU support
+    - SAUCE: perf/x86/intel/uncore: Add Rocket Lake support
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE
+    - [Config] update CONFIG_MST_IRQ after rebase to 5.10-rc3
+    - [Config] drop obsolete SND_SST_IPC options
+    - [Config] re-enable ZFS
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Nov 2020 09:37:08 +0100
+
+linux-5.10 (5.10.0-2.3) hirsute; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Switch arm64 default cpufreq governor to ondemand
+    - [Debian] Include scripts/module.lds from builddir in headers package
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 03 Nov 2020 21:01:52 -0600
+
+linux-5.10 (5.10.0-1.2) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Fix non-working Intel NVMe after S3 (LP: #1900847)
+    - SAUCE: PCI: Enable ACS quirk on all CML root ports
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] move to hirsute
+    - [Config] Update configs and annotations after rebase to 5.10-rc2
+    - [Config] Update numerous configs to conform with policy
+    - [Config] Switch default CPUFreq governer for arm64/armhf to schedultil
+    - [Config] Temporarily disable DEBUG_INFO_BTF for armhf
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 02 Nov 2020 13:18:27 -0600
+
+linux-5.10 (5.10.0-0.1) hirsute; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update configs and annotations for v5.10-rc1
+    - SAUCE: platform/x86: dell-uart-backlight: rename kzfree() to
+      kfree_sensitive()
+    - SAUCE: apparmor: rename kzfree() to kfree_sensitive()
+    - SAUCE: LSM: change ima_read_file() to use lsmblob
+    - SAUCE: LSM: Use lsmblob in smk_netlbl_mls()
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Packaging] Change source package name to linux-5.10"
+    - s390: correct __bootdata / __bootdata_preserved macros
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.10-rc1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 27 Oct 2020 16:57:07 +0100
+
+linux-5.10 (5.10.0-0.0) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 26 Oct 2020 14:55:48 +0100
+
+linux-5.9 (5.9.0-2.3) groovy; urgency=medium
+
+  * Fix system reboot when disconnecting WiFi (LP: #1899726)
+    - iwlwifi: msix: limit max RX queues for 9000 family
+
+  * booting linux-generic-lpae armhf kernel under qemu results in relocation out
+    of range, and thus no modules can be loaded (LP: #1899519)
+    - [Config] armhf: ARM_MODULE_PLTS=y
+
+  * Fix broken MSI interrupt after HDA controller was suspended (LP: #1899586)
+    - ALSA: hda: fix jack detection with Realtek codecs when in D3
+
+  * CVE-2020-16119
+    - SAUCE: dccp: avoid double free of ccid on child socket
+
+  * python3-venv is gone (LP: #1896801)
+    - SAUCE: doc: remove python3-venv dependency
+
+  * *-tools-common packages descriptions have typo "PGKVER" (LP: #1898903)
+    - [Packaging] Fix typo in -tools template s/PGKVER/PKGVER/
+
+  * Enable brightness control on HP DreamColor panel (LP: #1898865)
+    - SAUCE: drm/i915/dpcd_bl: Skip testing control capability with force DPCD
+      quirk
+    - SAUCE: drm/dp: HP DreamColor panel brigntness fix
+
+  * HP Zbook Studio G7 boots into corrupted screen with PSR featured panel
+    (LP: #1897501)
+    - SAUCE: drm/i915/psr: allow overriding PSR disable param by quirk
+    - SAUCE: drm/dp: add DP_QUIRK_FORCE_PSR_CHIP_DEFAULT quirk to CMN prod-ID
+      19-15
+
+  * Fix broken e1000e device after S3 (LP: #1897755)
+    - SAUCE: e1000e: Increase polling timeout on MDIC ready bit
+
+  * Wakeup the system by touching the touchpad (LP: #1888331)
+    - HID: i2c-hid: Enable wakeup capability from Suspend-to-Idle
+
+  * Enable LTR for endpoints behind VMD (LP: #1896598)
+    - SAUCE: PCI/ASPM: Enable LTR for endpoints behind VMD
+
+  * [SRU] [Focal/OEM-5.6/Groovy]Fix AMD usb host controller lost after stress S3
+    (LP: #1893914)
+    - SAUCE: xhci: workaround for S3 issue on AMD SNPS 3.0 xHC
+
+  * debian/rules editconfigs does not work on s390x to change s390x only configs
+    (LP: #1863116)
+    - [Packaging] kernelconfig -- only update/edit configurations on architectures
+      we have compiler support
+
+  * Fix non-working NVMe after S3 (LP: #1895718)
+    - SAUCE: PCI: Enable ACS quirk on CML root port
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: bpf: Check CONFIG_BPF option for resolve_btfids
+    - SAUCE: tools resolve_btfids: Always force HOSTARCH
+    - packaging: arm64: add a 64KB mem pages flavour called 'generic-64k'
+    - packaging: arm64: generic-64k: skip ABI, modules and retpoline checks
+    - SAUCE: drm/i915/display: Fix null deref in intel_psr_atomic_check()
+    - [Config] Update toolchain versions
+    - [Config] Refresh annotations
+    - Add ubuntu-host module
+    - CONFIG_UBUNTU_HOST=m
+    - SAUCE: apparmor: drop prefixing abs root labels with '='
+    - SAUCE: apparmor: disable showing the mode as part of a secid to secctx
+    - SAUCE: apparmor: rename aa_sock() to aa_unix_sk()
+    - SAUCE: apparmor: LSM stacking: switch from SK_CTX() to aa_sock()
+    - SAUCE: LSM: Infrastructure management of the sock security
+    - SAUCE: LSM: Create and manage the lsmblob data structure.
+    - SAUCE: LSM: Use lsmblob in security_audit_rule_match
+    - SAUCE: LSM: Use lsmblob in security_kernel_act_as
+    - SAUCE: net: Prepare UDS for security module stacking
+    - SAUCE: LSM: Use lsmblob in security_secctx_to_secid
+    - SAUCE: LSM: Use lsmblob in security_secid_to_secctx
+    - SAUCE: LSM: Use lsmblob in security_ipc_getsecid
+    - SAUCE: LSM: Use lsmblob in security_task_getsecid
+    - SAUCE: LSM: Use lsmblob in security_inode_getsecid
+    - SAUCE: LSM: Use lsmblob in security_cred_getsecid
+    - SAUCE: IMA: Change internal interfaces to use lsmblobs
+    - SAUCE: LSM: Specify which LSM to display
+    - SAUCE: LSM: Ensure the correct LSM context releaser
+    - SAUCE: LSM: Use lsmcontext in security_secid_to_secctx
+    - SAUCE: LSM: Use lsmcontext in security_inode_getsecctx
+    - SAUCE: LSM: security_secid_to_secctx in netlink netfilter
+    - SAUCE: NET: Store LSM netlabel data in a lsmblob
+    - SAUCE: LSM: Verify LSM display sanity in binder
+    - SAUCE: Audit: Add new record for multiple process LSM attributes
+    - SAUCE: Audit: Add a new record for multiple object LSM
+    - SAUCE: LSM: Add /proc attr entry for full LSM context
+    - SAUCE: AppArmor: Remove the exclusive flag
+    - SAUCE: Audit: Fix for missing NULL check
+
+  * Miscellaneous upstream changes
+    - tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup()
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.9
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 14 Oct 2020 13:31:18 -0500
+
+linux-5.9 (5.9.0-1.2) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update configs after rebase to 5.9-rc6
+    - SAUCE: dax: Fix compilation for CONFIG_DAX && !CONFIG_FS_DAX
+    - SAUCE: bpf: Use --no-fail option if CONFIG_BPF is not enabled
+    - SAUCE: tools resolve_btfids: Always force HOSTARCH
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.9-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 21 Sep 2020 14:39:34 -0500
+
+linux-5.9 (5.9.0-0.1) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update configs and annotations for v5.9-rc1
+    - SAUCE: i915: Fix build error due to missing struct definition
+    - hio -- Update blk_queue_split() calls for changes in 5.9-rc1
+    - hio -- Updates for move of make_request_fn to struct block_device_operations
+    - [Config] Disable zfs dkms build
+    - [Config] Disable nvidia dkms build
+    - [Config] Disable nvidia server dkms builds
+    - SAUCE: remoteproc: qcom: Use div_u64() for 64-bit division
+    - SAUCE: PCI/ASPM: Enable ASPM for links under VMD domain
+    - [Packaging] Bind hv_vss_daemon startup to hv_vss device
+    - [Packaging] bind hv_fcopy_daemon startup to hv_fcopy device
+    - [Config] Re-enable UEFI signing for arm64
+    - SAUCE: Revert "UBUNTU: SAUCE: export __get_vm_area_caller() and map_kernel_range()"
+    - [Config] Set the default CPU governor to ONDEMAND
+    - [Packaging] update variants
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.9-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 17 Sep 2020 15:01:21 -0500
+
+linux-5.9 (5.9.0-0.0) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 18 Aug 2020 16:48:03 -0500
+
+linux (5.8.0-16.17) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-16.17 -proposed tracker (LP: #1891233)
+
+  * Miscellaneous Ubuntu changes
+    - hio -- Update to use bio_{start,end}_io_acct with 5.8+
+    - Enable hio driver
+    - [Packaging] Temporarily disable building doc package contents
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 11 Aug 2020 15:32:58 -0500
+
+linux (5.8.0-15.16) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-15.16 -proposed tracker (LP: #1891177)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Documentation: import error c_funcptr_sig_re, c_sig_re (sphinx-
+      doc/sphinx@0f49e30c)
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 11 Aug 2020 09:29:58 -0500
+
+linux (5.8.0-14.15) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-14.15 -proposed tracker (LP: #1891085)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * msg_zerocopy.sh in net from ubuntu_kernel_selftests failed (LP: #1812620)
+    - selftests/net: relax cpu affinity requirement in msg_zerocopy test
+
+  * Fix missing HDMI/DP Audio on an HP Desktop (LP: #1890441)
+    - ALSA: hda/hdmi: Add quirk to force connectivity
+
+  * Add initial audio support for Lenovo ThinkStation P620 (LP: #1890317)
+    - ALSA: usb-audio: Add support for Lenovo ThinkStation P620
+
+  * Fix IOMMU error on AMD Radeon Pro W5700 (LP: #1890306)
+    - PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
+
+  * Enlarge hisi_sec2 capability (LP: #1890222)
+    - crypto: hisilicon - update SEC driver module parameter
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Re-enable signing for ppc64el
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 10 Aug 2020 15:26:46 -0500
+
+linux (5.8.0-13.14) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Remove i386 configs
+    - SAUCE: apply a workaround to re-enable CONFIG_CRYPTO_AEGIS128_SIMD
+    - SAUCE: export __get_vm_area_caller() and map_kernel_range()
+    - [Config] drop CONFIG_BINFMT_AOUT enforcement
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] disable CONFIG_CRYPTO_AEGIS128_SIMD"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 04 Aug 2020 09:51:50 +0200
+
+linux (5.8.0-12.13) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-12.13 -proposed tracker (LP: #1889481)
+
+  * Fix right speaker of HP laptop (LP: #1889375)
+    - SAUCE: hda/realtek: Fix right speaker of HP laptop
+
+  * blk_update_request error when mount nvme partition (LP: #1872383)
+    - SAUCE: nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
+
+  * Add support for Atlantic NIC firmware v4 (LP: #1886908)
+    - Revert "UBUNTU: SAUCE: net: atlantic: Add support for firmware v4"
+    - net: atlantic: align return value of ver_match function with function name
+    - net: atlantic: add support for FW 4.x
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Fix debian/tests for linux-5.8 -> linux rename
+    - SAUCE: selftests/powerpc: return skip code for spectre_v2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 29 Jul 2020 16:58:47 -0500
+
+linux (5.8.0-11.12) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-11.12 -proposed tracker (LP: #1889336)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] dwarves is not required for linux-libc-dev or stage1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Jul 2020 22:33:24 -0500
+
+linux (5.8.0-10.11) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-10.11 -proposed tracker (LP: #1889316)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Add more packages to Build-Depends-Indep for docs
+    - [Debian] Specify python executable in kmake
+    - [Debian] Don't treat warnings as errors during perf builds
+    - [Config] Disable signing for ppc64el
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Jul 2020 17:09:52 -0500
+
+linux (5.8.0-9.10) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-9.10 -proposed tracker (LP: #1889140)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Fix s390x compile error on F32 utils/stat-display.c
+    - [Packaging] Add python3-venv to Build-Depends-Indep
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Jul 2020 21:01:46 -0500
+
+linux (5.8.0-8.9) groovy; urgency=medium
+
+  * groovy/linux: 5.8.0-8.9 -proposed tracker (LP: #1889104)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+    - [Packaging] update variants
+
+  * Introduce the new NVIDIA 450-server and the 450 UDA series (LP: #1887674)
+    - [Packaging] NVIDIA -- Add signed modules for 450 450-server
+
+  * Introduce the new NVIDIA 418-server and 440-server series, and update the
+    current NVIDIA drivers (LP: #1881137)
+    - [packaging] add signed modules for the 418-server and the 440-server
+      flavours
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "radix-tree: Use local_lock for protection"
+    - [Config] CONFIG_DEBUG_INFO_COMPRESSED=n
+    - [Config] disable CONFIG_CRYPTO_AEGIS128_SIMD
+    - [Config] Enable nvidia dkms build
+
+  * Miscellaneous upstream changes
+    - usbip: tools: fix build error for multiple definition
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Jul 2020 11:18:12 -0500
+
+linux (5.8.0-7.8) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Jul 2020 09:22:19 +0200
+
+linux-5.8 (5.8.0-7.8) groovy; urgency=medium
+
+  * soc/amd/renoir: detect dmic from acpi table (LP: #1887734)
+    - ASoC: amd: add logic to check dmic hardware runtime
+    - ASoC: amd: add ACPI dependency check
+    - ASoC: amd: fixed kernel warnings
+
+  * linux 4.15.0-109-generic network DoS regression vs -108 (LP: #1886668)
+    - SAUCE: Revert "netprio_cgroup: Fix unlimited memory leak of v2 cgroups"
+
+  * Add support for Atlantic NIC firmware v4 (LP: #1886908)
+    - SAUCE: net: atlantic: Add support for firmware v4
+
+  * MGA G200e doesn't work under GDM Wayland (LP: #1886140)
+    - drm/mgag200: Remove HW cursor
+    - drm/mgag200: Clean up mga_set_start_address()
+    - drm/mgag200: Clean up mga_crtc_do_set_base()
+    - drm/mgag200: Move mode-setting code into separate helper function
+    - drm/mgag200: Split MISC register update into PLL selection, SYNC and I/O
+    - drm/mgag200: Update mode registers after plane registers
+    - drm/mgag200: Set pitch in a separate helper function
+    - drm/mgag200: Set primary plane's format in separate helper function
+    - drm/mgag200: Move TAGFIFO reset into separate function
+    - drm/mgag200: Move hiprilvl setting into separate functions
+    - drm/mgag200: Move register initialization into separate function
+    - drm/mgag200: Remove out-commented suspend/resume helpers
+    - drm/mgag200: Use simple-display data structures
+    - drm/mgag200: Convert to simple KMS helper
+    - drm/mgag200: Replace VRAM helpers with SHMEM helpers
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: s390/bpf: fix sign extension in branch_ku
+    - SAUCE: selftests: net: ip_defrag: modprobe missing nf_defrag_ipv6 support
+    - SAUCE: selftests: fib_nexthop_multiprefix: fix cleanup() netns deletion
+    - [packaging] debhelper-compat (= 10) (and retire debian/compat)
+    - [Config] Update configs after rebase to 5.8-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Jul 2020 09:55:47 +0200
+
+linux-5.8 (5.8.0-6.7) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * perf build broken after updating to bintuils 2.34.90.20200706-1ubuntu1
+    (LP: #1887397)
+    - SAUCE: libtraceevent: Strip symbol version from nm output
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 13 Jul 2020 14:07:53 -0500
+
+linux-5.8 (5.8.0-5.6) groovy; urgency=medium
+
+  * linux-libc-dev broken for crossbuilding, Multi-Arch:same violation
+    (LP: #1886188)
+    - [Packaging] Produce linux-libc-deb package for riscv64
+    - [Debian] Disallow building linux-libc-dev from linux-riscv
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "UBUNTU: SAUCE: test_bpf: remove expected fail for Ctx heavy
+      transformations test on s390"
+    - SAUCE: Revert "test_bpf: flag tests that cannot be jited on s390"
+    - [Config] Update configs (gcc update)
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Jul 2020 08:42:14 +0200
+
+linux-5.8 (5.8.0-4.5) groovy; urgency=medium
+
+  * Add generic LED class support for audio LED (LP: #1885896)
+    - ALSA: hda: generic: Always call led-trigger for mic mute LED
+    - ALSA: hda: generic: Add a helper for mic-mute LED with LED classdev
+    - ALSA: hda/realtek: Convert to cdev-variant of mic-mute LED controls
+    - ALSA: hda/conexant: Convert to cdev-variant of mic-mute LED controls
+    - ALSA: hda/sigmatel: Convert to cdev-variant of mic-mute LED controls
+    - ALSA: hda: generic: Drop unused snd_hda_gen_fixup_micmute_led()
+    - ALSA: hda: generic: Drop the old mic-mute LED hook
+    - ALSA: hda: generic: Add vmaster mute LED helper
+    - ALSA: hda/realtek: Use the new vmaster mute LED helper
+    - ALSA: hda/conexant: Use the new vmaster mute LED helper
+    - ALSA: hda/sigmatel: Use the new vmaster mute LED helper
+    - ALSA: hda/realtek: Unify LED helper code
+    - ALSA: hda: Let LED cdev handling suspend/resume
+
+  * seccomp_bpf fails on powerpc (LP: #1885757)
+    - SAUCE: selftests/seccomp: fix ptrace tests on powerpc
+
+  * CVE-2020-11935
+    - SAUCE: aufs: do not call i_readcount_inc()
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Update aufs to 5.x-rcN 20200622
+    - [Config] Update configs to set CONFIG_SND_HDA_GENERIC_LEDS value
+    - [Config] CONFIG_SECURITY_DMESG_RESTRICT=y
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Jul 2020 08:14:28 -0500
+
+linux-5.8 (5.8.0-3.4) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  * lxc 1:4.0.2-0ubuntu1 ADT test failure with linux-5.8 5.8.0-1.2
+    (LP: #1884635)
+    - SAUCE: overlayfs: fix faulty rebase
+
+  * shiftfs: O_TMPFILE reports ESTALE (LP: #1872757)
+    - SAUCE: shiftfs: prevent ESTALE for LOOKUP_JUMP lookups
+
+  * shiftfs: fix btrfs regression (LP: #1884767)
+    - SAUCE: Revert "UBUNTU: SAUCE: shiftfs: fix dentry revalidation"
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_DEBUG_INFO_COMPRESSED=y
+    - SAUCE: regulator: rename da903x to da903x-regulator
+    - [Config] Add da903x to modules.ignore
+    - [Config] Update configs for rebase to 5.8-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jun 2020 08:48:25 -0500
+
+linux-5.8 (5.8.0-2.3) groovy; urgency=medium
+
+  * Support Audio Mute LED for two new HP laptops (LP: #1884251)
+    - ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems
+
+  * CVE-2019-16089
+    - SAUCE: nbd_genl_status: null check for nla_nest_start
+
+  * tpm: fix TIS locality timeout problems (LP: #1881710)
+    - SAUCE: tpm: fix TIS locality timeout problems
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: security,perf: Allow further restriction of perf_event_open
+    - [Config] CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
+    - [Config] Update configs and annotations for 5.8-rc2
+    - [Config] Enable zfs
+    - [Config] Enable CONFIG_DEBUG_INFO_BTF
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jun 2020 15:05:54 -0500
+
+linux-5.8 (5.8.0-1.2) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Support linux-x.y in udeb package names
+    - [Packaging] Use SRCPKGNAME for udeb packages
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 17 Jun 2020 19:34:32 -0500
+
+linux-5.8 (5.8.0-0.1) groovy; urgency=medium
+
+  * Docker registry doesn't stay up and keeps restarting (LP: #1879690)
+    - Revert "UBUNTU: SAUCE: overlayfs: use shiftfs hacks only with shiftfs as underlay"
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Update source package name to linux-5.8
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: (lockdown) powerpc: lock down kernel in secure boot mode
+    - SAUCE: Import aufs driver
+    - [Config] Update configs for v5.8-rc1
+    - [Config] Update annotations for v5.8-rc1 config changes
+    - SAUCE: shiftfs -- Fix build errors from missing fiemap definitions
+    - Disable hio driver
+
+  * Miscellaneous upstream changes
+    - acpi: disallow loading configfs acpi tables when locked down
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.8-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 17 Jun 2020 11:54:24 -0500
+
+linux-5.8 (5.8.0-0.0) groovy; urgency=medium
+
+  * Empty entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 14 Jun 2020 22:40:35 -0500
+
+linux-5.7 (5.7.0-8.9) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Enforce all config annotations (LP: #1879327)
+    - [Config]: do not enforce CONFIG_VERSION_SIGNATURE
+    - [Config]: prepare to enforce all
+    - [Config]: enforce all config options
+
+  * Miscellaneous Ubuntu changes
+    - [Config]: annotations review after 5.7 rebase
+    - [Config] annotations: IXP4XX* depends on ARCH_IXP4XX
+    - [Config] THERMAL_GOV_POWER_ALLOCATOR=y
+    - [Config] annotations: SOC_CAMERA is marked as BROKEN
+    - [Config] annotations: NFSD_V4_2_INTER_SSC depends on NFS_FS=y
+    - [Config] annotations: CRYPTO_DEV_CHELSIO_TLS depends on legacy (and largely
+      unmantained) TLS_TOE
+    - [Config] annotations: SERIO_OLPC_APSP depends on ARCH_MMP
+    - [Config] RTW88_DEBUG=y
+    - [Config] annotations: ISDN_CAPI is a bool, and BT_CMTP depends on  it
+    - [Config] annotations SND_SOC_SOF_DEVELOPER_SUPPORT depends on
+      SND_SOC_SOF_DEVELOPER_SUPPORT
+    - [Config] annotations: SND_SOC_SOF_BAYTRAIL_SUPPORT is mutually exclusive
+      with SND_SST_ATOM_HIFI2_PLATFORM_ACPI
+    - [Config] annotations: DEBUG_IMX_UART_PORT is defined only any
+      DEBUG_IMX*_UART is enabled
+    - [Config] annotations: HW_RANDOM_IMX_RNGC depends on SOC_IMX25
+    - [Config] annotations: armhf: VIRTUALIZATION support was removed for arm32
+    - [Config] annotations: arm64: remove DEBUG_ALIGN_RODATA
+    - [Config] annotations: ppc64: DATA_SHIFT defaults to PPC_PAGE_SHIFT
+    - [Config] arm64: enforce ARM64_USE_LSE_ATOMICS
+    - [Config] s390x: MOST is not set
+    - [Config] s390x: BCM84881_PHY is not set
+    - [Config] s390x: XILINX_LL_TEMAC is not set
+    - [Config] s390x: PHY_INTEL_EMMC requires GENERIC_PHY (off by default on
+      s390x)
+    - [Config] s390x: CHECK_STACK conflicts with VMAP_STACK
+    - [Config] annotations: s390x: NODES_SHIFT=1
+    - [Config] annotations: import new symbols
+    - [Config] annotations: remove unmatched menu and options
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 12 Jun 2020 12:03:01 +0200
+
+linux-5.7 (5.7.0-7.8) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+    - [Packaging] update helper scripts
+
+  * [UBUNTU 20.04] s390x/pci: fix linking between PF and VF for multifunction
+    devices (LP: #1879704)
+    - PCI/IOV: Introduce pci_iov_sysfs_link() function
+    - s390/pci: create links between PFs and VFs
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Disable UEFI signing for arm64
+    - Rebase to v5.7.1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7.1
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 08 Jun 2020 11:16:58 +0200
+
+linux-5.7 (5.7.0-6.7) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+
+  * shiftfs: fix btrfs snapshot deletion (LP: #1879688)
+    - SAUCE: shiftfs: let userns root destroy subvolumes from other users
+
+  * seccomp_benchmark times out on eoan (LP: #1881576)
+    - SAUCE: selftests/seccomp: use 90s as timeout
+
+  * Realtek 8723DE [10ec:d723] subsystem [10ec:d738]  disconnects unsolicitedly
+    when Bluetooth is paired: Reason: 23=IEEE8021X_FAILED (LP: #1878147)
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: Move driver IQK to set channel before
+      association for 11N chip"
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: fix rate for a while after being
+      connected"
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: No retry and report for auth and assoc"
+    - SAUCE: Revert "UBUNTU: SAUCE: rtw88: 8723d: Add coex support"
+    - rtw88: 8723d: Add coex support
+    - SAUCE: rtw88: coex: 8723d: set antanna control owner
+    - SAUCE: rtw88: coex: 8723d: handle BT inquiry cases
+    - SAUCE: rtw88: fix EAPOL 4-way failure by finish IQK earlier
+
+  * ASoC/amd: add audio driver for amd renoir (LP: #1881046)
+    - ASoC: amd: add Renoir ACP3x IP register header
+    - ASoC: amd: add Renoir ACP PCI driver
+    - ASoC: amd: add acp init/de-init functions
+    - ASoC: amd: create acp3x pdm platform device
+    - ASoC: amd: add ACP3x PDM platform driver
+    - ASoC: amd: irq handler changes for ACP3x PDM dma driver
+    - ASoC: amd: add acp3x pdm driver dma ops
+    - ASoC: amd: add ACP PDM DMA driver dai ops
+    - ASoC: amd: add Renoir ACP PCI driver PM ops
+    - ASoC: amd: add ACP PDM DMA driver pm ops
+    - ASoC: amd: enable Renoir acp3x drivers build
+    - ASoC: amd: create platform devices for Renoir
+    - ASoC: amd: RN machine driver using dmic
+    - ASoC: amd: enable build for RN machine driver
+    - ASoC: amd: fix kernel warning
+    - ASoC: amd: refactoring dai_hw_params() callback
+    - ASoC: amd: return error when acp de-init fails
+    - [Config]: enable amd renoir ASoC audio
+
+  * Slow send speed with Intel I219-V on Ubuntu 18.04.1 (LP: #1802691)
+    - e1000e: Disable TSO for buffer overrun workaround
+
+  * Fix incorrect speed/duplex when I210 device is runtime suspended
+    (LP: #1880656)
+    - igb: Report speed and duplex as unknown when device is runtime suspended
+
+  * Fix Pericom USB controller OHCI/EHCI PME# defect (LP: #1879321)
+    - serial: 8250_pci: Move Pericom IDs to pci_ids.h
+    - PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect
+
+  * [UBUNTU 20.04] s390x/pci: enumerate pci functions per physical adapter
+    (LP: #1874056)
+    - s390/pci: Expose new port attribute for PCIe functions
+    - s390/pci: adaptation of iommu to multifunction
+    - s390/pci: define kernel parameters for PCI multifunction
+    - s390/pci: define RID and RID available
+    - s390/pci: create zPCI bus
+    - s390/pci: adapt events for zbus
+    - s390/pci: Handling multifunctions
+    - s390/pci: Do not disable PF when VFs exist
+    - s390/pci: Documentation for zPCI
+    - s390/pci: removes wrong PCI multifunction assignment
+
+  * add 16-bit width registers support for EEPROM at24 device (LP: #1876699)
+    - regmap-i2c: add 16-bit width registers support
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Enable virtualbox guest and shared-folder modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 01 Jun 2020 16:11:24 -0500
+
+linux-5.7 (5.7.0-5.6) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * [UBUNTU 20.04] PSI generates overhead on s390x (LP: #1876044)
+    - Ubuntu: [Config] CONFIG_PSI is enabled by default, but creates additional
+      overhead on s390x, hence should be disabled by default on s390x only.
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v5.7-rc7
+    - [Config] ppc64el: disable STRICT_KERNEL_RWX
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 25 May 2020 11:44:09 +0200
+
+linux-5.7 (5.7.0-4.5) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * update-initramfs complains of missing amdgpu firmware files (LP: #1873325)
+    - SAUCE: drm/amdgpu: Remove unreleased arcturus and navi12 firmware from
+      modinfo
+
+  * Support DMIC micmute LED on HP platforms (LP: #1876859)
+    - ALSA: hda/realtek - Introduce polarity for micmute LED GPIO
+    - ALSA: hda/realtek - Enable micmute LED on and HP system
+    - ALSA: hda/realtek - Add LED class support for micmute LED
+    - ALSA: hda/realtek - Fix unused variable warning w/o
+      CONFIG_LEDS_TRIGGER_AUDIO
+    - ASoC: SOF: Update correct LED status at the first time usage of
+      update_mute_led()
+
+  * Killer(R) Wi-Fi 6 AX1650i 160MHz Wireless Network Adapter (201NGW),
+    REV=0x354 [8086:a0f0] subsystem id [1a56:1651] wireless adapter not found
+    due to firmware crash (LP: #1874685)
+    - SAUCE: iwlwifi: pcie: handle QuZ configs with killer NICs as well
+
+  * rtkit-daemon[*]: Failed to make ourselves RT: Operation not permitted after
+    upgrade to 20.04 (LP: #1875665)
+    - [Config] Turn off CONFIG_RT_GROUP_SCHED everywhere
+
+  * Unable to handle kernel pointer dereference in virtual kernel address space
+    on Eoan (LP: #1876645)
+    - SAUCE: overlayfs: fix shitfs special-casing
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: skip building selftest 'runqslower' if kernel not built
+    - Rebase to v5.7-rc6
+    - [Config] updateconfigs after 5.7-rc6 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc6
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 18 May 2020 11:27:25 +0200
+
+linux-5.7 (5.7.0-3.4) groovy; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc5
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * getitimer returns it_value=0 erroneously (LP: #1349028)
+    - [Config] CONTEXT_TRACKING_FORCE policy should be unset
+
+  * lockdown on power (LP: #1855668) // Ubuntu Kernel Support for OpenPOWER NV
+    Secure & Trusted Boot (LP: #1866909)
+    - [Config] Enable configs for OpenPOWER NV Secure & Trusted Boot
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - [Config] Enable aufs
+    - [Config] annotations: remove SND_SOC_SOF_HDA_COMMON_HDMI_CODEC
+    - [Config] Remove CONFIG_SND_HDA_INTEL_DETECT_DMIC from annotations
+    - [Debian] final-checks -- Do not remove ~* from abi
+    - [Config] Enable 5-level page table support for x86
+    - [Config] updateconfigs after 5.7-rc5 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 11 May 2020 10:25:42 +0200
+
+linux-5.7 (5.7.0-2.3) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - update dkms package versions
+    - [Packaging] update helper scripts
+
+  * ASUS T100HAN boots to a blank screen with a cursor [i965: Failed to submit
+    batchbuffer: Input/output error] (LP: #1860754)
+    - [Config] CONFIG_PMIC_OPREGION=y and CONFIG_GPIO_CRYSTAL_COVE=y for amd64
+
+  * ubuntu/focal64 fails to mount Vagrant shared folders  (LP: #1873506)
+    - [Packaging] Move virtualbox modules to linux-modules
+    - [Packaging] Remove vbox and zfs modules from generic.inclusion-list
+
+  * built-using constraints preventing uploads (LP: #1875601)
+    - temporarily drop Built-Using data
+
+  * dkms artifacts may expire from the pool (LP: #1850958)
+    - [Packaging] autoreconstruct -- manage executable debian files
+    - [packaging] handle downloads from the librarian better
+
+  * Add signed modules for the 435 NVIDIA driver (LP: #1875888)
+    - [Packaging] NVIDIA -- add signed modules for the 435 NVIDIA driver
+
+  * [Selftests] Apply various fixes and improvements (LP: #1870543)
+    - SAUCE: selftests/seccomp -- Disable timeout for seccomp tests
+
+  * [17.04 FEAT] Integrate kernel message catalogue for s390x into Ubuntu
+    distribution (LP: #1628889)
+    - SAUCE: s390: kernel message catalog
+
+  * Overlayfs in user namespace leaks directory content of inaccessible
+    directories (LP: #1793458) // CVE-2018-6559
+    - SAUCE: overlayfs: ensure mounter privileges when reading directories
+
+  * suspend only works once on ThinkPad X1 Carbon gen 7 (LP: #1865570)
+    - SAUCE: e1000e: Disable s0ix flow for X1 Carbon 7th
+
+  * [ICL] TC port in legacy/static mode can't be detected due TCCOLD
+    (LP: #1868936)
+    - drm/i915/display: Move out code to return the digital_port of the aux ch
+    - drm/i915/display: Add intel_legacy_aux_to_power_domain()
+    - drm/i915/display: Split hsw_power_well_enable() into two
+    - drm/i915/tc/icl: Implement TC cold sequences
+    - drm/i915/tc: Skip ref held check for TC legacy aux power wells
+    - drm/i915/tc/tgl: Implement TC cold sequences
+    - drm/i915/tc: Catch TC users accessing FIA registers without enable aux
+    - drm/i915/tc: Do not warn when aux power well of static TC ports timeout
+
+  * Touchpad doesn't work on Dell Inspiron 7000 2-in-1 (LP: #1851901)
+    - Revert "UBUNTU: SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390
+      2-in-1"
+
+  * 'Elan touchpad' not detected on 'Lenovo ThinkBook 15 IIL' (LP: #1861610)
+    - SAUCE: Input: elan_i2c - add more hardware ID for Lenovo laptop
+
+  * linux-image-5.0.0-35-generic breaks checkpointing of container
+    (LP: #1857257)
+    - SAUCE: overlayfs: use shiftfs hacks only with shiftfs as underlay
+
+  * alsa/sof: kernel oops on the machine without Intel hdmi audio codec (a
+    regression in the  asoc machine driver) (LP: #1874359)
+    - ASoC: intel/skl/hda - fix oops on systems without i915 audio codec
+
+  * Add debian/rules targets to compile/run kernel selftests (LP: #1874286)
+    - [Packaging] add support to compile/run selftests
+
+  * 5.4.0-24.28 does not seem to apply rtprio, whereas -21 does. (LP: #1873315)
+    - [Config] lowlatency: turn off RT_GROUP_SCHED
+
+  * alsa/sof: external mic can't be deteced on Lenovo and HP laptops
+    (LP: #1872569)
+    - SAUCE: ASoC: intel/skl/hda - set autosuspend timeout for hda codecs
+
+  * shiftfs: O_TMPFILE reports ESTALE (LP: #1872757)
+    - SAUCE: shiftfs: fix dentry revalidation
+
+  * shiftfs: broken shiftfs nesting (LP: #1872094)
+    - SAUCE: shiftfs: record correct creator credentials
+
+  * lockdown on power (LP: #1855668)
+    - SAUCE: (lockdown) powerpc: lock down kernel in secure boot mode
+
+  * Add support for Realtek 8723DE wireless adapter (LP: #1780590)
+    - SAUCE: rtw88: add adaptivity support for EU/JP regulatory
+    - SAUCE: rtw88: update tx descriptor of mgmt and rsvd page packets
+    - SAUCE: rtw88: sar: dump sar information via debugfs
+    - SAUCE: rtw88: 8723d: add IQ calibration
+    - SAUCE: rtw88: 8723d: Add power tracking
+    - SAUCE: rtw88: 8723d: implement flush queue
+    - SAUCE: rtw88: 8723d: set ltecoex register address in chip_info
+    - SAUCE: rtw88: 8723d: Add coex support
+    - SAUCE: rtw88: 8723d: Add shutdown callback to disable BT USB suspend
+
+  * Fix authentication fail on Realtek WiFi 8723de (LP: #1871300)
+    - SAUCE: rtw88: No retry and report for auth and assoc
+    - SAUCE: rtw88: fix rate for a while after being connected
+    - SAUCE: rtw88: Move driver IQK to set channel before association for 11N chip
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: rtw88: fix 'const' mismatch in power suequence hooks
+    - SAUCE: rtw88: fix 'const' mismatch in
+      __priority_queue_cfg_legacy()/__priority_queue_cfg()
+    - [Config] RTW88=m
+    - SAUCE: (lockdown) Revert carried-forward lockdown patches
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - [Config] Add back CONFIG_LOCK_DOWN_IN_SECURE_BOOT annotation for ppc64el
+    - [Config] CONFIG_RT_GROUP_SCHED=y
+    - [Packaging] Include modules.builtin.modinfo in linux-modules
+    - SAUCE: LSM: Infrastructure management of the sock security
+    - SAUCE: Fix-up af_unix mediation for sock infrastructure management
+    - SAUCE: Revert "apparmor: Allow filtering based on secmark policy"
+    - SAUCE: Revert "apparmor: Parse secmark policy"
+    - SAUCE: Revert "apparmor: Add a wildcard secid"
+    - SAUCE: Revert "apparmor: fixup secid map conversion to using IDR"
+    - SAUCE: Revert "apparmor: Use an IDR to allocate apparmor secids"
+    - SAUCE: Revert "apparmor: add support for mapping secids and using secctxes"
+    - Update dropped.txt for restored apparmor patches
+    - Remove lockdown patches from dropped.txt
+    - SAUCE: powerpc/ima: require IMA module signatures only if MODULE_SIG is not
+      enabled
+    - SAUCE: selftests/ftrace: Use printf instead of echo in kprobe syntax error
+      tests
+    - SAUCE: selftests/net -- disable l2tp.sh test
+    - SAUCE: selftests/net -- disable timeout
+    - SAUCE: tools: hv: Update shebang to use python3 instead of python
+    - Remove dropped.txt
+    - [Packaging] move linux-doc and linux-libc-dev stubs to debian.master
+    - [Debian] Support generating configs for riscv64
+    - [Config] CONFIG_KMSG_IDS=y for s390x
+    - [Packaging] add libcap-dev dependency
+    - [Config] CONFIG_AD5770R=m
+    - [Config] CONFIG_AL3010=m
+    - [Config] CONFIG_APPLE_MFI_FASTCHARGE=m
+    - [Config] CONFIG_BAREUDP=m
+    - [Config] CONFIG_CRYPTO_DEV_OCTEONTX_CPT=m
+    - [Config] CONFIG_CRYPTO_DEV_ZYNQMP_AES=m
+    - [Config] CONFIG_DRM_DISPLAY_CONNECTOR=m
+    - [Config] CONFIG_DRM_PANEL_BOE_TV101WUM_NL6=m
+    - [Config] CONFIG_DRM_PANEL_ELIDA_KD35T133=m
+    - [Config] CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02=m
+    - [Config] CONFIG_DRM_PANEL_NOVATEK_NT35510=m
+    - [Config] CONFIG_DRM_PANEL_SAMSUNG_S6E88A0_AMS452EF01=m
+    - [Config] CONFIG_DRM_PARADE_PS8640=m
+    - [Config] CONFIG_DRM_SIMPLE_BRIDGE=m
+    - [Config] CONFIG_DRM_TIDSS=m
+    - [Config] CONFIG_DRM_TI_TPD12S015=m
+    - [Config] CONFIG_DRM_TOSHIBA_TC358768=m
+    - [Config] CONFIG_EDAC_DMC520=m
+    - [Config] CONFIG_EXFAT_FS=m
+    - [Config] CONFIG_GP2AP002=m
+    - [Config] CONFIG_GPIO_MLXBF2=m
+    - [Config] CONFIG_HID_GLORIOUS=m
+    - [Config] CONFIG_HID_MCP2221=m
+    - [Config] CONFIG_HMC425=m
+    - [Config] CONFIG_ICP10100=m
+    - [Config] CONFIG_IMX8MM_THERMAL=m
+    - [Config] CONFIG_IMX_SC_THERMAL=m
+    - [Config] CONFIG_INTERCONNECT_QCOM_OSM_L3=m
+    - [Config] CONFIG_INTERCONNECT_QCOM_SC7180=m
+    - [Config] CONFIG_K3_RTI_WATCHDOG=m
+    - [Config] CONFIG_MDIO_IPQ8064=m
+    - [Config] CONFIG_MDIO_MVUSB=m
+    - [Config] CONFIG_MHI_BUS=m
+    - [Config] CONFIG_OCTEONTX2_VF=m
+    - [Config] CONFIG_PHY_CADENCE_TORRENT=m
+    - [Config] CONFIG_PHY_QCOM_USB_HS_28NM=m
+    - [Config] CONFIG_PHY_QCOM_USB_SS=m
+    - [Config] CONFIG_PINCTRL_DA9062=m
+    - [Config] CONFIG_PINCTRL_IPQ6018=m
+    - [Config] CONFIG_PTP_1588_CLOCK_IDT82P33=m
+    - [Config] CONFIG_PTP_1588_CLOCK_VMW=m
+    - [Config] CONFIG_QCOM_IPA=m
+    - [Config] CONFIG_REGULATOR_MP5416=m
+    - [Config] CONFIG_REGULATOR_MP886X=m
+    - [Config] CONFIG_RN5T618_ADC=m
+    - [Config] CONFIG_RTC_DRV_MT2712=m
+    - [Config] CONFIG_RTC_DRV_RC5T619=m
+    - [Config] CONFIG_SC_MSS_7180=m
+    - [Config] CONFIG_SENSORS_AXI_FAN_CONTROL=m
+    - [Config] CONFIG_SM_GCC_8250=m
+    - [Config] CONFIG_SND_BCM63XX_I2S_WHISTLER=m
+    - [Config] CONFIG_SND_MESON_AIU=m
+    - [Config] CONFIG_SND_MESON_G12A_TOACODEC=m
+    - [Config] CONFIG_SND_MESON_GX_SOUND_CARD=m
+    - [Config] CONFIG_SND_SOC_AMD_RV_RT5682_MACH=m
+    - [Config] CONFIG_SND_SOC_INTEL_SOF_PCM512x_MACH=m
+    - [Config] CONFIG_SND_SOC_MESON_T9015=m
+    - [Config] CONFIG_SND_SOC_RT5682_SDW=m
+    - [Config] CONFIG_SND_SOC_TLV320ADCX140=m
+    - [Config] CONFIG_SPI_FSI=m
+    - [Config] CONFIG_SPI_MTK_NOR=m
+    - [Config] CONFIG_SPI_MUX=m
+    - [Config] CONFIG_SPRD_THERMAL=m
+    - [Config] CONFIG_SURFACE_3_POWER_OPREGION=m
+    - [Config] CONFIG_TINYDRM_ILI9486=m
+    - [Config] CONFIG_TI_K3_AM65_CPSW_NUSS=m
+    - [Config] CONFIG_TYPEC_MUX_INTEL_PMC=m
+    - [Config] CONFIG_UACCE=m
+    - [Config] CONFIG_UNIPHIER_XDMAC=m
+    - [Config] CONFIG_USB_MAX3420_UDC=m
+    - [Config] CONFIG_USB_RAW_GADGET=m
+    - [Config] CONFIG_VHOST_VDPA=m
+    - [Config] CONFIG_VIDEO_IMX219=m
+    - [Config] CONFIG_VIDEO_SUN8I_ROTATE=m
+    - [Config] CONFIG_VIRTIO_VDPA=m
+    - [Config] CONFIG_MOST_COMPONENTS=m
+    - [Config] CONFIG_MFD_IQS62X=m
+    - packaging: getabis: switch to ckt-ppa:bootstrap/linux-5.7
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: rtw88: add rtw_read8_mask and rtw_read16_mask"
+    - Revert "UBUNTU: SAUCE: drm/i915/fbc: disable framebuffer compression on
+      IceLake"
+    - Revert "UBUNTU: SAUCE: platform/x86: dell-uart-backlight: move retry block"
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 04 May 2020 10:48:48 +0200
+
+linux-5.7 (5.7.0-1.2) groovy; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: hio: pass make_request ptr directly to blk_alloc_queue()
+    - SAUCE: hio: locally define disk_map_sector_rcu()
+    - SAUCE: hio: Revert "block: unexport disk_map_sector_rcu"
+    - SAUCE: hio: include <linux/part_stat.h>
+    - [Config] amd64: i386: HIO=m
+    - [Config] updateconfigs after 5.7-rc3 rebase
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 27 Apr 2020 11:31:38 +0200
+
+linux-5.7 (5.7.0-0.1) groovy; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.7-rc1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.7-rc1
+  * Rebase to v5.7-rc2
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 16 Apr 2020 11:53:58 +0200
+
+linux-5.7 (5.7.0-0.0) focal; urgency=medium
+
+  * Dummy entry
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 16 Apr 2020 11:53:58 +0200
+
+linux-5.6 (5.6.0-7.7) focal; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - update dkms package versions
+
+  * Kernel Oops - general protection fault: 0000 [#1] SMP PTI after
+    disconnecting thunderbolt docking station (LP: #1864754)
+    - SAUCE: ptp: free ptp clock properly
+
+  * swap storms kills interactive use (LP: #1861359)
+    - SAUCE: mm/page_alloc.c: disable memory reclaim watermark boosting by default
+
+  * sysfs: incorrect network device permissions on network namespace change
+    (LP: #1865359)
+    - sysfs: add sysfs_file_change_owner()
+    - sysfs: add sysfs_link_change_owner()
+    - sysfs: add sysfs_group{s}_change_owner()
+    - sysfs: add sysfs_change_owner()
+    - device: add device_change_owner()
+    - drivers/base/power: add dpm_sysfs_change_owner()
+    - net-sysfs: add netdev_change_owner()
+    - net-sysfs: add queue_change_owner()
+    - net: fix sysfs permssions when device changes network namespace
+    - sysfs: fix static inline declaration of sysfs_groups_change_owner()
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 31 Mar 2020 10:45:09 +0200
+
+linux-5.6 (5.6.0-6.6) focal; urgency=medium
+
+  * suspend only works once on ThinkPad X1 Carbon gen 7 (LP: #1865570)
+    - SAUCE: e1000e: Disable s0ix flow for X1 Carbon 7th
+
+  *  Make Dell WD19 dock more reliable after suspend (LP: #1868217)
+    - xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3
+    - xhci: Wait until link state trainsits to U0 after setting USB_SS_PORT_LS_U0
+    - xhci: Finetune host initiated USB3 rootport link suspend and resume
+
+  * update-version-dkms doesn't add a BugLink (LP: #1867790)
+    - [Packaging] Add BugLink to update-version-dkms commit
+
+  * Add support for Realtek 8723DE wireless adapter (LP: #1780590)
+    - SAUCE: rtw88: add regulatory process strategy for different chipset
+    - SAUCE: rtw88: support dynamic user regulatory setting
+    - SAUCE: rtw88: Use secondary channel offset enumeration
+    - SAUCE: rtw88: 8822c: modify rf protection setting
+    - SAUCE: rtw88: disable TX-AMSDU on 2.4G band
+    - SAUCE: Revert "rtw88: disable TX-AMSDU on 2.4G band"
+    - SAUCE: rtw88: disable TX-AMSDU on 2.4G band
+    - SAUCE: rtw88: remove unused parameter vif in rtw_lps_pg_info_get()
+    - SAUCE: rtw88: add rtw_read8_mask and rtw_read16_mask
+    - SAUCE: rtw88: pci: 8822c should set clock delay to zero
+    - SAUCE: rtw88: move rtw_enter_ips() to the last when config
+    - SAUCE: rtw88: avoid holding mutex for cancel_delayed_work_sync()
+    - SAUCE: rtw88: add ciphers to suppress error message
+    - SAUCE: rtw88: 8822c: update power sequence to v16
+    - SAUCE: rtw88: Fix incorrect beamformee role setting
+    - SAUCE: rtw88: don't hold all IRQs disabled for PS operations
+    - SAUCE: rtw88: extract alloc rsvd_page and h2c skb routines
+    - SAUCE: rtw88: associate reserved pages with each vif
+    - SAUCE: rtw88: add adaptivity support for EU/JP regulatory
+    - SAUCE: rtw88: 8723d: Add basic chip capabilities
+    - SAUCE: rtw88: 8723d: add beamform wrapper functions
+    - SAUCE: rtw88: 8723d: Add power sequence
+    - SAUCE: rtw88: 8723d: Add RF read/write ops
+    - SAUCE: rtw88: 8723d: Add mac/bb/rf/agc/power_limit tables
+    - SAUCE: rtw88: 8723d: Add cfg_ldo25 to control LDO25
+    - SAUCE: rtw88: 8723d: Add new chip op efuse_grant() to control efuse access
+    - SAUCE: rtw88: 8723d: Add read_efuse to recognize efuse info from map
+    - SAUCE: rtw88: add legacy firmware download for 8723D devices
+    - SAUCE: rtw88: no need to send additional information to legacy firmware
+    - SAUCE: rtw88: 8723d: Add mac power-on/-off function
+    - SAUCE: rtw88: decompose while(1) loop of power sequence polling command
+    - SAUCE: rtw88: 8723d: 11N chips don't support H2C queue
+    - SAUCE: rtw88: 8723d: implement set_tx_power_index ops
+    - SAUCE: rtw88: 8723d: Organize chip TX/RX FIFO
+    - SAUCE: rtw88: 8723d: initialize mac/bb/rf basic functions
+    - SAUCE: rtw88: 8723d: Add DIG parameter
+    - SAUCE: rtw88: 8723d: Add query_rx_desc
+    - SAUCE: rtw88: 8723d: Add set_channel
+    - SAUCE: rtw88: handle C2H_CCX_TX_RPT to know if packet TX'ed successfully
+    - SAUCE: rtw88: 8723d: 11N chips don't support LDPC
+    - SAUCE: rtw88: set default port to firmware
+    - SAUCE: rtw88: update tx descriptor of mgmt and rsvd page packets
+    - SAUCE: rtw88: sar: add SAR of TX power limit
+    - SAUCE: rtw88: sar: Load static SAR table from ACPI WRDS method
+    - SAUCE: rtw88: sar: Load dynamic SAR table from ACPI methods
+    - SAUCE: rtw88: sar: apply dynamic SAR table to tx power limit
+    - SAUCE: rtw88: sar: add sar_work to poll if dynamic SAR table is changed
+    - SAUCE: rtw88: sar: dump sar information via debugfs
+    - SAUCE: rtw88: 8723d: Add chip_ops::false_alarm_statistics
+    - SAUCE: rtw88: 8723d: Set IG register for CCK rate
+    - SAUCE: rtw88: 8723d: add interface configurations table
+    - SAUCE: rtw88: 8723d: Add LC calibration
+    - SAUCE: rtw88: 8723d: add IQ calibration
+    - SAUCE: rtw88: 8723d: Add power tracking
+    - SAUCE: rtw88: 8723d: Add shutdown callback to disable BT USB suspend
+    - SAUCE: rtw88: 8723d: implement flush queue
+    - SAUCE: rtw88: 8723d: set ltecoex register address in chip_info
+    - SAUCE: rtw88: 8723d: Add coex support
+    - SAUCE: rtw88: fill zeros to words 0x06 and 0x07 of security cam entry
+    - SAUCE: rtw88: 8723d: Add 8723DE to Kconfig and Makefile
+    - [Config] CONFIG_RTW88_8723DE=y
+
+  * [Ubuntu 20.04] Unset HIBERNATION and PM kernel config options for focal
+    (LP: #1867753)
+    - [Config] CONFIG_HIBERNATION=n and CONFIG_PM=n for s390x
+
+  * [20.04 FEAT] Base KVM setup for secure guests - kernel part (LP: #1835531)
+    - s390/protvirt: introduce host side setup
+    - s390/protvirt: add ultravisor initialization
+    - s390/mm: provide memory management functions for protected KVM guests
+    - s390/mm: add (non)secure page access exceptions handlers
+    - s390/protvirt: Add sysfs firmware interface for Ultravisor information
+    - KVM: s390/interrupt: do not pin adapter interrupt pages
+    - KVM: s390: protvirt: Add UV debug trace
+    - KVM: s390: add new variants of UV CALL
+    - KVM: s390: protvirt: Add initial vm and cpu lifecycle handling
+    - KVM: s390: protvirt: Secure memory is not mergeable
+    - KVM: s390/mm: Make pages accessible before destroying the guest
+    - KVM: s390: protvirt: Handle SE notification interceptions
+    - KVM: s390: protvirt: Instruction emulation
+    - KVM: s390: protvirt: Implement interrupt injection
+    - KVM: s390: protvirt: Add SCLP interrupt handling
+    - KVM: s390: protvirt: Handle spec exception loops
+    - KVM: s390: protvirt: Add new gprs location handling
+    - KVM: S390: protvirt: Introduce instruction data area bounce buffer
+    - KVM: s390: protvirt: handle secure guest prefix pages
+    - KVM: s390/mm: handle guest unpin events
+    - KVM: s390: protvirt: Write sthyi data to instruction data area
+    - KVM: s390: protvirt: STSI handling
+    - KVM: s390: protvirt: disallow one_reg
+    - KVM: s390: protvirt: Do only reset registers that are accessible
+    - KVM: s390: protvirt: Only sync fmt4 registers
+    - KVM: s390: protvirt: Add program exception injection
+    - KVM: s390: protvirt: UV calls in support of diag308 0, 1
+    - KVM: s390: protvirt: Report CPU state to Ultravisor
+    - KVM: s390: protvirt: Support cmd 5 operation state
+    - KVM: s390: protvirt: Mask PSW interrupt bits for interception 104 and 112
+    - KVM: s390: protvirt: do not inject interrupts after start
+    - KVM: s390: protvirt: Add UV cpu reset calls
+    - DOCUMENTATION: Protected virtual machine introduction and IPL
+    - KVM: s390: protvirt: introduce and enable KVM_CAP_S390_PROTECTED
+    - KVM: s390: protvirt: Add KVM api documentation
+    - mm/gup/writeback: add callbacks for inaccessible pages
+
+  * All PS/2 ports on PS/2 Serial add-in bracket are not working after S3
+    (LP: #1866734)
+    - SAUCE: Input: i8042 - fix the selftest retry logic
+
+  * Sys oopsed with sysfs test in ubuntu_stress_smoke_test on X-hwe ARM64
+    (LP: #1866772)
+    - ACPI: sysfs: copy ACPI data using io memory copying
+
+  * Miscellaneous Ubuntu changes
+    - hio -- remove duplicated MODULE_DEVICE_TABLE declaration
+    - SAUCE: r8169: disable ASPM L1.1
+    - [Config] update annotations from configs
+    - [Config] update configs after annotation file review
+    - SAUCE: Revert "tools/power turbostat: Fix 32-bit capabilities warning"
+
+  * Miscellaneous upstream changes
+    - drm/i915: Fix eDP DPCD aux max backlight calculations
+    - drm/dp: Introduce EDID-based quirks
+    - drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED panel
+    - drm/i915: Force DPCD backlight mode for some Dell CML 2020 panels
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 25 Mar 2020 18:09:13 +0100
+
+linux-5.6 (5.6.0-5.5) focal; urgency=medium
+
+  * please help enable CONFIG_EROFS_FS_ZIP (LP: #1867099)
+    - [Config] CONFIG_EROFS_FS_ZIP=y
+    - [Config] CONFIG_EROFS_FS_CLUSTER_PAGE_LIMIT=1
+
+  * Miscellaneous Ubuntu changes
+    - Config: Fix SND_HDA_PREALLOC_SIZE annotations
+    - Config: Fix DATA_SHIFT annotations
+    - Config: remove ANDROID_VSOC from annotations
+    - Config: remove arm arch from annotations
+    - Config: Update SOC_R8A7796X annotations
+    - Config: Update CLK_R8A7796X annotations
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 18 Mar 2020 17:25:30 +0100
+
+linux-5.6 (5.6.0-4.4) focal; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+    - [Packaging] update helper scripts
+
+  * Add sysfs attribute to show remapped NVMe (LP: #1863621)
+    - SAUCE: ata: ahci: Add sysfs attribute to show remapped NVMe device count
+
+  * [20.04 FEAT] Compression improvements in Linux kernel (LP: #1830208)
+    - [Config] Introducing s390x specific kernel config option CONFIG_ZLIB_DFLTCC
+
+  * [UBUNTU 20.04] s390x/pci: increase CONFIG_PCI_NR_FUNCTIONS to 512 in kernel
+    config (LP: #1866056)
+    - [Config] Increase CONFIG_PCI_NR_FUNCTIONS from 64 to 512 starting with focal
+      on s390x
+
+  * CONFIG_IP_MROUTE_MULTIPLE_TABLES is not set (LP: #1865332)
+    - [Config] CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+
+  * [UBUNTU 20.04] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x
+    starting with focal (LP: #1865452)
+    - [Config] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x starting
+      with focal
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "UBUNTU: SAUCE: blk/core: Gracefully handle unset
+      make_request_fn"
+    - [Packaging] prevent duplicated entries in modules.ignore
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc5
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Mar 2020 09:42:06 +0100
+
+linux-5.6 (5.6.0-3.3) focal; urgency=medium
+
+  * nsleep-lat / set-timer-lat / inconsistency-check / raw_skew from timer in
+    ubuntu_kernel_selftests timeout on 5.3 / 5.4 (LP: #1864626)
+    - selftests/timers: Turn off timeout setting
+
+  * Update kernel options CONFIG_NR_CPUS and CONFIG_NUMA_EMU for focal
+    (LP: #1864198)
+    - Ubuntu: [Config] Update kernel options CONFIG_NR_CPUS and CONFIG_NUMA_EMU
+
+  * alsa/hda/realtek: fix a mute led regression on Lenovo X1 Carbon
+    (LP: #1864576)
+    - SAUCE: ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1
+
+  * r8152 init may take up to 40 seconds at initialization with Dell WD19/WD19DC
+    during hotplug (LP: #1864284)
+    - UBUNTU SAUCE: r8151: check disconnect status after long sleep
+
+  * Another Dell AIO backlight issue (LP: #1863880)
+    - SAUCE: platform/x86: dell-uart-backlight: move retry block
+
+  * Backport GetFB2 ioctl (LP: #1863874)
+    - SAUCE: drm: Add getfb2 ioctl
+
+  * Focal Fossa (20.04) feature request - Enable CONFIG_X86_UV (LP: #1863810)
+    - [Config] CONFIG_X86_UV=y
+
+  * Miscellaneous Ubuntu changes
+    - debian: remove snapdragon config, rules and flavour
+    - remove snapdragon abi files
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc4
+
+  * Miscellaneous upstream changes
+    - updateconfigs following snapdragon removal
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 04 Mar 2020 08:21:10 +0100
+
+linux-5.6 (5.6.0-2.2) focal; urgency=medium
+
+  * Sometimes can't adjust brightness on Dell AIO (LP: #1862885)
+    - SAUCE: platform/x86: dell-uart-backlight: increase retry times
+
+  * Dell XPS 13 (7390) Display Flickering - 19.10  (LP: #1849947)
+    - SAUCE: drm/i915: Disable PSR by default on all platforms
+
+  * Miscellaneous Ubuntu changes
+    - [debian] ignore missing wireguard module
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) s390: Lock down the kernel when the IPL secure flag is set
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - [Config] CONFIG_LOCK_DOWN_IN_SECURE_BOOT=y
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.6-rc3
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (lockdown) s390/ipl: lockdown kernel when booted
+      secure"
+    - Revert "UBUNTU: SAUCE: (lockdown) KEYS: Make use of platform keyring for
+      module signature verify"
+    - Revert "UBUNTU: SAUCE: (lockdown) Add a SysRq option to lift kernel
+      lockdown"
+    - Revert "UBUNTU: SAUCE: (lockdown) security: lockdown: expose a hook to lock
+      the kernel down"
+    - Revert "UBUNTU: SAUCE: (lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err()."
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 24 Feb 2020 18:57:22 +0100
+
+linux-5.6 (5.6.0-1.1) focal; urgency=medium
+
+  *  Integrate Intel SGX driver into linux-azure (LP: #1844245)
+    - [Packaging] Add systemd service to load intel_sgx
+
+  * QAT drivers for C3XXX and C62X not included as modules (LP: #1845959)
+    - [Config] CRYPTO_DEV_QAT_C3XXX=m, CRYPTO_DEV_QAT_C62X=m and
+      CRYPTO_DEV_QAT_DH895xCC=m
+
+  * 5.4.0-11 crash on cryptsetup open (LP: #1860231)
+    - SAUCE: blk/core: Gracefully handle unset make_request_fn
+
+  * multi-zone raid0 corruption (LP: #1850540)
+    - SAUCE: md/raid0: Use kernel specific layout
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - update dropped.txt after rebase to v5.6-rc1
+    - [Config] updateconfigs after rebase to 5.6-rc1
+    - hio -- proc_create() requires a "struct proc_ops" in 5.6
+    - SAUCE: arm: fix build error in kvm tracepoint
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: [Config] Disable the uselib system call"
+    - Revert "UBUNTU: [Config] Disable legacy PTY naming"
+    - Revert "UBUNTU: [Config] Enforce filtered access to iomem"
+    - Revert "UBUNTU: [Config] Enable notifier call chain validations"
+    - Revert "UBUNTU: [Config] Enable scatterlist validation"
+    - Revert "UBUNTU: [Config] Enable cred sanity checks"
+    - Revert "UBUNTU: [Config] Enable linked list manipulation checks"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.6-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 13 Feb 2020 17:20:27 +0100
+
+linux-5.6 (5.6.0-0.0) focal; urgency=medium
+
+  * Dummy entry
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 10 Feb 2020 11:06:18 +0100
+
+linux-5.5 (5.5.0-7.8) focal; urgency=medium
+
+  * CONFIG_USELIB should be disabled (LP: #1855341)
+    - [Config] Disable the uselib system call
+
+  * CONFIG_LEGACY_PTYS should be disabled (LP: #1855339)
+    - [Config] Disable legacy PTY naming
+
+  * CONFIG_IO_STRICT_DEVMEM should be enabled (LP: #1855338)
+    - [Config] Enforce filtered access to iomem
+
+  * CONFIG_DEBUG_NOTIFIERS should be enabled (LP: #1855337)
+    - [Config] Enable notifier call chain validations
+
+  * CONFIG_DEBUG_SG should be enabled (LP: #1855336)
+    - [Config] Enable scatterlist validation
+
+  * CONFIG_DEBUG_CREDENTIALS should be enabled (LP: #1855335)
+    - [Config] Enable cred sanity checks
+
+  * CONFIG_DEBUG_LIST should be enabled (LP: #1855334)
+    - [Config] Enable linked list manipulation checks
+
+  * shiftfs: prevent lower dentries from going negative during unlink
+    (LP: #1860041)
+    - SAUCE: shiftfs: prevent lower dentries from going negative during unlink
+
+  * [SRU][B/OEM-B/OEM-OSP1/D/E/Unstable] UBUNTU: SAUCE: Use native backlight on
+    Lenovo E41-25/45 (LP: #1859561)
+    - SAUCE: ACPI: video: Use native backlight on Lenovo E41-25/45
+
+  * USB key cannot be detected by hotplug on Sunix USB Type-A 3.1 Gen 2 card
+    [1b21:2142]  (LP: #1858988)
+    - SAUCE: PCI: Avoid ASMedia XHCI USB PME# from D0 defect
+
+  * Dell AIO can't adjust brightness (LP: #1858761)
+    - SAUCE: platform/x86: dell-uart-backlight: add retry for get scalar status
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Fix typo in annotations file
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 27 Jan 2020 11:39:38 +0100
+
+linux-5.5 (5.5.0-6.7) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Update ubuntu-regression-suite dependency to python2
+    - [Packaging] Fix ubuntu-regression-suite python dependency for hwe kernel
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 20 Jan 2020 10:16:01 +0100
+
+linux-5.5 (5.5.0-5.6) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 13 Jan 2020 15:50:12 +0100
+
+linux-5.5 (5.5.0-4.5) focal; urgency=medium
+
+  * linux build and autopkg tests need to use python2 instead of python
+    (LP: #1858487)
+    - [Packaging] Remove python-dev build dependency
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Jan 2020 16:00:26 +0100
+
+linux-5.5 (5.5.0-3.4) focal; urgency=medium
+
+  * [SRU][B/OEM-B/OEM-OSP1/D/E/F] Add LG I2C touchscreen multitouch support
+    (LP: #1857541)
+    - SAUCE: HID: multitouch: Add LG MELF0410 I2C touchscreen support
+
+  * Make vfio-pci built-in or xhci_hcd optional (LP: #1770845)
+    - [Config]: built-in VFIO_PCI for amd64
+
+  * multi-zone raid0 corruption (LP: #1850540)
+    - SAUCE: md/raid0: Link to wiki with guidance on multi-zone RAID0 layout
+      migration
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update variants
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Change source package to linux-5.5
+    - [Packaging] Don't use SRCPKGNAME for linux-libc-dev
+    - [Packaging] Remove linux-source-3 Provides: from linux-source
+    - [Packaging] Fix linux-doc in linux-image Suggests:
+    - [Debian] Read variants list into a variable
+    - [Packaging] Generate linux-libc-dev package only for primary variant
+    - [Packaging] Generate linux-doc for only the primary variant
+    - [Debian] Update linux source package name in debian/tests/*
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.5-rc3
+    - [Config] disable PCI_MESON
+    - [Config] Add pinctrl-equilibrium to modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.5-rc5
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Wed, 08 Jan 2020 11:28:43 +0100
+
+linux-5.5 (5.5.0-2.3) focal; urgency=medium
+
+  * Empty entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 17 Dec 2019 22:33:59 -0600
+
+linux (5.5.0-2.3) focal; urgency=medium
+
+  * Support DPCD aux brightness control (LP: #1856134)
+    - SAUCE: drm/i915: Fix eDP DPCD aux max backlight calculations
+    - SAUCE: drm/i915: Assume 100% brightness when not in DPCD control mode
+    - SAUCE: drm/i915: Fix DPCD register order in intel_dp_aux_enable_backlight()
+    - SAUCE: drm/i915: Auto detect DPCD backlight support by default
+    - SAUCE: drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED
+      panel
+    - USUNTU: SAUCE: drm/i915: Force DPCD backlight mode on Dell Precision 4K sku
+
+  * change kconfig of the soundwire bus driver from y to m (LP: #1855685)
+    - [Config]: SOUNDWIRE=m
+
+  * Fix unusable USB hub on Dell TB16 after S3 (LP: #1855312)
+    - SAUCE: USB: core: Make port power cycle a seperate helper function
+    - SAUCE: USB: core: Attempt power cycle port when it's in eSS.Disabled state
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] add python depends to ubuntu-regression-suite
+    - SAUCE: selftests: net: tls: remove recv_rcvbuf test
+    - update dkms package versions
+
+  * Miscellaneous upstream changes
+    - [Config] updateconfigs after rebase to 5.5-rc2
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Tue, 17 Dec 2019 16:02:43 +0100
+
+linux (5.5.0-1.2) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] disable nvidia dkms build
+    - [Config] disable virtualbox dkms build
+    - [Config] disable zfs dkms build
+    - update dropped.txt after rebase to v5.5-rc1
+    - SAUCE: (lockdown) Make get_cert_list() not complain about cert lists that
+      aren't present.
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: (lockdown) s390/ipl: lockdown kernel when booted secure
+    - [Config] Enable lockdown under secure boot
+    - update dkms package versions
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Thu, 12 Dec 2019 16:54:41 +0100
+
+linux (5.5.0-0.1) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.5-rc1
+
+   [ Upstream Kernel Changes ]
+
+   * Rebase to v5.5-rc1
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Dec 2019 19:03:35 +0100
+
+linux (5.5.0-0.0) focal; urgency=medium
+
+  * Dummy entry.
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 09 Dec 2019 15:14:37 +0100
+
+linux (5.4.0-8.11) focal; urgency=medium
+
+  * focal/linux: 5.4.0-8.9 -proposed tracker (LP: #1855448)
+
+  * update ENA driver for DIMLIB dynamic interrupt moderation (LP: #1853180)
+    - SAUCE: net: ena: fix issues in setting interrupt moderation params in
+      ethtool
+    - SAUCE: net: ena: fix too long default tx interrupt moderation interval
+
+  * Kernel build log filled with "/bin/bash: line 5: warning: command
+    substitution: ignored null byte in input" (LP: #1853843)
+    - [Debian] Fix warnings when checking for modules signatures
+
+  * hwe-edge kernel 5.3.0-23.25 kernel does not boot on Precision 5720 AIO
+    (LP: #1852581)
+    - [Packaging] Fix module signing with older modinfo
+
+  * Fix MST support on Ice Lake (LP: #1854432)
+    - drm/i915: fix port checks for MST support on gen >= 11
+
+  * headphone has noise as not mute on dell machines with alc236/256
+    (LP: #1854401)
+    - SAUCE: ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236
+
+  * [CML-S62] Need enable intel_pmc_core driver patch for Comet lake- S 6+2
+    (LP: #1847450)
+    - SAUCE: platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support
+      to intel_pmc_core driver
+
+  * CVE-2019-14901
+    - SAUCE: mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
+
+  * CVE-2019-14896 // CVE-2019-14897
+    - SAUCE: libertas: Fix two buffer overflows at parsing bss descriptor
+
+  * CVE-2019-14895
+    - SAUCE: mwifiex: fix possible heap overflow in mwifiex_process_country_ie()
+
+  * [CML-S62] Need enable intel_rapl patch support for Comet lake- S 6+2
+    (LP: #1847454)
+    - powercap/intel_rapl: add support for CometLake Mobile
+    - powercap/intel_rapl: add support for Cometlake desktop
+
+  * External microphone can't work on some dell machines with the codec alc256
+    or alc236 (LP: #1853791)
+    - SAUCE: ALSA: hda/realtek - Move some alc256 pintbls to fallback table
+    - SAUCE: ALSA: hda/realtek - Move some alc236 pintbls to fallback table
+
+  * remount of multilower moved pivoted-root overlayfs root, results in I/O
+    errors on some modified files (LP: #1824407)
+    - SAUCE: ovl: fix lookup failure on multi lower squashfs
+
+  * [CML-S62] Need enable turbostat patch support for Comet lake- S 6+2
+    (LP: #1847451)
+    - SAUCE: tools/power turbostat: Add Cometlake support
+
+  * CONFIG_ARCH_ROCKCHIP is not set in ubuntu 18.04 aarch64,arm64 (LP: #1825222)
+    - [Config] Enable ROCKCHIP support for arm64
+
+  * [broadwell-rt286, playback] Since Linux 5.2rc2 audio playback no longer
+    works on Dell Venue 11 Pro 7140 (LP: #1846539)
+    - SAUCE: ASoC: SOF: Intel: Broadwell: clarify mutual exclusion with legacy
+      driver
+
+  * i40e: general protection fault in i40e_config_vf_promiscuous_mode
+    (LP: #1852663)
+    - SAUCE: i40e Fix GPF when deleting VMs
+
+  * libbpf check_abi fails on ppc64el (LP: #1854974)
+    - libbpf: Fix readelf output parsing on powerpc with recent binutils
+
+  * CVE-2019-19050
+    - crypto: user - fix memory leak in crypto_reportstat
+
+  * Make hotplugging docking station to Thunderbolt port more reliable
+    (LP: #1853991)
+    - PCI/PM: Add pcie_wait_for_link_delay()
+    - PCI/PM: Add missing link delays required by the PCIe spec
+
+  * i915: Display flickers (monitor loses signal briefly) during "flickerfree"
+    boot, while showing the BIOS logo on a black background (LP: #1836858)
+    - [Config] FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER=y
+
+  * [CML] New device id's for CMP-H (LP: #1846335)
+    - i2c: i801: Add support for Intel Comet Lake PCH-H
+    - mtd: spi-nor: intel-spi: Add support for Intel Comet Lake-H SPI serial flash
+    - mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs
+
+  * Focal update: v5.4.2 upstream stable release (LP: #1855326)
+    - io_uring: async workers should inherit the user creds
+    - net: separate out the msghdr copy from ___sys_{send,recv}msg()
+    - net: disallow ancillary data for __sys_{send,recv}msg_file()
+    - crypto: inside-secure - Fix stability issue with Macchiatobin
+    - driver core: platform: use the correct callback type for bus_find_device
+    - usb: dwc2: use a longer core rest timeout in dwc2_core_reset()
+    - staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param()
+    - staging: rtl8192e: fix potential use after free
+    - staging: rtl8723bs: Drop ACPI device ids
+    - staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
+    - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
+    - mei: bus: prefix device names on bus with the bus name
+    - mei: me: add comet point V device id
+    - thunderbolt: Power cycle the router if NVM authentication fails
+    - x86/fpu: Don't cache access to fpu_fpregs_owner_ctx
+    - gve: Fix the queue page list allocated pages count
+    - macvlan: schedule bc_work even if error
+    - mdio_bus: don't use managed reset-controller
+    - net: dsa: sja1105: fix sja1105_parse_rgmii_delays()
+    - net: macb: add missed tasklet_kill
+    - net: psample: fix skb_over_panic
+    - net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
+    - openvswitch: fix flow command message size
+    - sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
+    - slip: Fix use-after-free Read in slip_open
+    - sctp: cache netns in sctp_ep_common
+    - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
+    - openvswitch: remove another BUG_ON()
+    - net/tls: take into account that bpf_exec_tx_verdict() may free the record
+    - net/tls: free the record on encryption error
+    - net: skmsg: fix TLS 1.3 crash with full sk_msg
+    - selftests/tls: add a test for fragmented messages
+    - net/tls: remove the dead inplace_crypto code
+    - net/tls: use sg_next() to walk sg entries
+    - selftests: bpf: test_sockmap: handle file creation failures gracefully
+    - selftests: bpf: correct perror strings
+    - tipc: fix link name length check
+    - selftests: pmtu: use -oneline for ip route list cache
+    - r8169: fix jumbo configuration for RTL8168evl
+    - r8169: fix resume on cable plug-in
+    - ext4: add more paranoia checking in ext4_expand_extra_isize handling
+    - Revert "jffs2: Fix possible null-pointer dereferences in
+      jffs2_add_frag_to_fragtree()"
+    - crypto: talitos - Fix build error by selecting LIB_DES
+    - HID: core: check whether Usage Page item is after Usage ID items
+    - platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
+    - platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size
+    - Linux 5.4.2
+
+  * no HDMI video output since GDM greeter after linux-oem-osp1 version
+    5.0.0-1026 (LP: #1852386)
+    - drm/i915: Add new CNL PCH ID seen on a CML platform
+    - SAUCE: drm/i915: Fix detection for a CMP-V PCH
+
+  * Please add patch fixing RK818 ID detection (LP: #1853192)
+    - SAUCE: mfd: rk808: Fix RK818 ID template
+
+  * Raydium Touchscreen on ThinkPad L390 does not work (LP: #1849721)
+    - HID: i2c-hid: fix no irq after reset on raydium 3118
+
+  * Touchpad doesn't work on Dell Inspiron 7000 2-in-1 (LP: #1851901)
+    - Revert "UBUNTU: SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390
+      2-in-1"
+    - lib: devres: add a helper function for ioremap_uc
+    - mfd: intel-lpss: Use devm_ioremap_uc for MMIO
+
+  * Lenovo dock MAC Address pass through doesn't work in Ubuntu  (LP: #1827961)
+    - r8152: Add macpassthru support for ThinkPad Thunderbolt 3 Dock Gen 2
+
+  * Disable unreliable HPET on CFL-H system (LP: #1852216)
+    - SAUCE: x86/intel: Disable HPET on Intel Coffe Lake H platforms
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] Enable virtualbox dkms build
+    - [Config] update annotations to match current configs
+    - SAUCE: Add exfat module to signature inclusion list
+
+  * Miscellaneous upstream changes
+    - Bluetooth: Fix invalid-free in bcsp_close()
+    - ath9k_hw: fix uninitialized variable data
+    - ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe
+    - ath10k: Fix HOST capability QMI incompatibility
+    - ath10k: restore QCA9880-AR1A (v1) detection
+    - Revert "Bluetooth: hci_ll: set operational frequency earlier"
+    - Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues"
+    - md/raid10: prevent access of uninitialized resync_pages offset
+    - x86/insn: Fix awk regexp warnings
+    - x86/speculation: Fix incorrect MDS/TAA mitigation status
+    - x86/speculation: Fix redundant MDS mitigation message
+    - nbd: prevent memory leak
+    - x86/stackframe/32: Repair 32-bit Xen PV
+    - x86/xen/32: Make xen_iret_crit_fixup() independent of frame layout
+    - x86/xen/32: Simplify ring check in xen_iret_crit_fixup()
+    - x86/doublefault/32: Fix stack canaries in the double fault handler
+    - x86/pti/32: Size initial_page_table correctly
+    - x86/cpu_entry_area: Add guard page for entry stack on 32bit
+    - x86/entry/32: Fix IRET exception
+    - x86/entry/32: Use %ss segment where required
+    - x86/entry/32: Move FIXUP_FRAME after pushing %fs in SAVE_ALL
+    - x86/entry/32: Unwind the ESPFIX stack earlier on exception entry
+    - x86/entry/32: Fix NMI vs ESPFIX
+    - selftests/x86/mov_ss_trap: Fix the SYSENTER test
+    - selftests/x86/sigreturn/32: Invalidate DS and ES when abusing the kernel
+    - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make
+      the CPU_ENTRY_AREA_PAGES assert precise
+    - x86/entry/32: Fix FIXUP_ESPFIX_STACK with user CR3
+    - futex: Prevent robust futex exit race
+    - ALSA: usb-audio: Fix NULL dereference at parsing BADD
+    - ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data
+    - media: vivid: Set vid_cap_streaming and vid_out_streaming to true
+    - media: vivid: Fix wrong locking that causes race conditions on streaming
+      stop
+    - media: usbvision: Fix invalid accesses after device disconnect
+    - media: usbvision: Fix races among open, close, and disconnect
+    - cpufreq: Add NULL checks to show() and store() methods of cpufreq
+    - futex: Move futex exit handling into futex code
+    - futex: Replace PF_EXITPIDONE with a state
+    - exit/exec: Seperate mm_release()
+    - futex: Split futex_mm_release() for exit/exec
+    - futex: Set task::futex_state to DEAD right after handling futex exit
+    - futex: Mark the begin of futex exit explicitly
+    - futex: Sanitize exit state handling
+    - futex: Provide state handling for exec() as well
+    - futex: Add mutex around futex exit
+    - futex: Provide distinct return value when owner is exiting
+    - futex: Prevent exit livelock
+    - media: uvcvideo: Fix error path in control parsing failure
+    - media: b2c2-flexcop-usb: add sanity checking
+    - media: cxusb: detect cxusb_ctrl_msg error in query
+    - media: imon: invalid dereference in imon_touch_event
+    - media: mceusb: fix out of bounds read in MCE receiver buffer
+    - ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs
+    - USBIP: add config dependency for SGL_ALLOC
+    - usbip: tools: fix fd leakage in the function of read_attr_usbip_status
+    - usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit()
+    - usb-serial: cp201x: support Mark-10 digital force gauge
+    - USB: chaoskey: fix error case of a timeout
+    - appledisplay: fix error handling in the scheduled work
+    - USB: serial: mos7840: add USB ID to support Moxa UPort 2210
+    - USB: serial: mos7720: fix remote wakeup
+    - USB: serial: mos7840: fix remote wakeup
+    - USB: serial: option: add support for DW5821e with eSIM support
+    - USB: serial: option: add support for Foxconn T77W968 LTE modules
+    - staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
+    - powerpc/book3s64: Fix link stack flush on context switch
+    - KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel
+    - Linux 5.4.1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 06 Dec 2019 15:53:53 -0600
+
+linux (5.4.0-7.8) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/bpf: Comment out BPF_CORE_READ's which cause clang to
+      segfault
+    - Update nvidia-430 to nvidia-440
+    - [Config] Enable nvidia dkms build
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 25 Nov 2019 15:02:30 +0100
+
+linux (5.4.0-6.7) focal; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.4-rc8
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc7
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 18 Nov 2019 12:08:01 +0100
+
+linux (5.4.0-5.6) focal; urgency=medium
+
+  * refcount underflow and type confusion in shiftfs (LP: #1850867) //
+    CVE-2019-15793
+    - SAUCE: shiftfs: Correct id translation for lower fs operations
+
+  * refcount underflow and type confusion in shiftfs (LP: #1850867) //
+    CVE-2019-15792
+    - SAUCE: shiftfs: prevent type confusion
+
+  * refcount underflow and type confusion in shiftfs (LP: #1850867) //
+    CVE-2019-15791
+    - SAUCE: shiftfs: Fix refcount underflow in btrfs ioctl handling
+
+  * Some EFI systems fail to boot in efi_init() when booted via maas
+    (LP: #1851810)
+    - SAUCE: efi: efi_get_memory_map -- increase map headroom
+
+  * seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test (LP: #1849281)
+    - SAUCE: seccomp: rework define for SECCOMP_USER_NOTIF_FLAG_CONTINUE
+    - SAUCE: seccomp: avoid overflow in implicit constant conversion
+
+  * dkms artifacts may expire from the pool (LP: #1850958)
+    - [Packaging] dkms -- try launchpad librarian for pool downloads
+    - [Packaging] dkms -- dkms-build quieten wget verbiage
+
+  * tsc marked unstable after entered PC10 on Intel CoffeeLake (LP: #1840239)
+    - SAUCE: x86/intel: Disable HPET on Intel Coffe Lake platforms
+    - SAUCE: x86/intel: Disable HPET on Intel Ice Lake platforms
+
+  * shiftfs: prevent exceeding project quotas (LP: #1849483)
+    - SAUCE: shiftfs: drop CAP_SYS_RESOURCE from effective capabilities
+
+  * shiftfs: fix fallocate() (LP: #1849482)
+    - SAUCE: shiftfs: setup correct s_maxbytes limit
+
+  * The alsa hda driver is not loaded due to the missing of PCIID for Comet
+    Lake-S [8086:a3f0] (LP: #1852070)
+    - SAUCE: ALSA: hda: Add Cometlake-S PCI ID
+
+  * Can't adjust brightness on DELL UHD dGPU AIO (LP: #1813877)
+    - SAUCE: platform/x86: dell-uart-backlight: add missing status command
+    - SAUCE: platform/x86: dell-uart-backlight: load driver by scalar status
+    - SAUCE: platform/x86: dell-uart-backlight: add force parameter
+    - SAUCE: platform/x86: dell-uart-backlight: add quirk for old platforms
+
+  * s_iflags overlap prevents unprivileged overlayfs mounts (LP: #1851677)
+    - SAUCE: fs: Move SB_I_NOSUID to the top of s_iflags
+
+  * ubuntu-aufs-modified mmap_region() breaks refcounting in overlayfs/shiftfs
+    error path (LP: #1850994) // CVE-2019-15794
+    - SAUCE: shiftfs: Restore vm_file value when lower fs mmap fails
+    - SAUCE: ovl: Restore vm_file value when lower fs mmap fails
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Convert update-aufs.sh to use aufs5
+    - SAUCE: import aufs driver
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 13 Nov 2019 11:56:35 -0800
+
+linux (5.4.0-4.5) focal; urgency=medium
+
+  * High power consumption using 5.0.0-25-generic (LP: #1840835)
+    - PCI: Add a helper to check Power Resource Requirements _PR3 existence
+    - ALSA: hda: Allow HDA to be runtime suspended when dGPU is not bound to a
+      driver
+    - PCI: Fix missing inline for pci_pr3_present()
+
+  * Fix signing of staging modules in eoan (LP: #1850234)
+    - [Packaging] Leave unsigned modules unsigned after adding .gnu_debuglink
+
+  * [20.04 FEAT] Set Architecture Level (ALS) to z13 (LP: #1837525)
+    - [Config] s390x bump march to z13, with tune to z15
+
+  * Miscellaneous Ubuntu changes
+    - [Debian]: do not skip tests for linux-hwe-edge
+    - update dkms package versions
+    - [Config] re-enable zfs
+    - [Config] rename module virtio_fs to virtiofs
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc6
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 04 Nov 2019 15:12:02 +0100
+
+linux (5.4.0-3.4) focal; urgency=medium
+
+  * seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test (LP: #1849281)
+    - SAUCE: seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test
+
+  * cloudimg: no iavf/i40evf module so no network available with SR-IOV enabled
+    cloud (LP: #1848481)
+    - [Packaging] include iavf/i40evf in generic
+
+  * CVE-2019-17666
+    - SAUCE: rtlwifi: Fix potential overflow on P2P code
+
+  * Change Config Option CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE for s390x from yes
+    to no (LP: #1848492)
+    - [Config] Change Config Option CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE for s390x
+      from yes to no
+
+  * Add Intel Comet Lake ethernet support (LP: #1848555)
+    - SAUCE: e1000e: Add support for Comet Lake
+
+  * seccomp: add SECCOMP_USER_NOTIF_FLAG_CONTINUE    (LP: #1847744)
+    - SAUCE: seccomp: add SECCOMP_USER_NOTIF_FLAG_CONTINUE
+    - SAUCE: seccomp: test SECCOMP_USER_NOTIF_FLAG_CONTINUE
+
+  * drm/i915: Fix the issue of "azx_get_response timeout" for hdmi audio on ICL
+    platforms (LP: #1847192)
+    - SAUCE: drm/i915: Fix audio power up sequence for gen10+ display
+    - SAUCE: drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms
+
+  * PM / hibernate: fix potential memory corruption (LP: #1847118)
+    - SAUCE: PM / hibernate: memory_bm_find_bit -- tighten node optimisation
+
+  * [regression] NoNewPrivileges incompatible with Apparmor (LP: #1844186)
+    - SAUCE: apparmor: fix nnp subset test for unconfined
+
+  * overlayfs: allow with shiftfs as underlay (LP: #1846272)
+    - SAUCE: overlayfs: allow with shiftfs as underlay
+
+  * eoan: alsa/sof: Enable SOF_HDA link and codec (LP: #1848490)
+    - [Config] Fix SOF Kconfig options
+
+  * linux won't build when new virtualbox version is present on the archive
+    (LP: #1848788)
+    - [Packaging]: download virtualbox from sources
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations from configs
+    - [Config] updateconfigs after rebase to 5.4-rc5
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 29 Oct 2019 12:01:27 -0500
+
+linux (5.4.0-2.3) eoan; urgency=medium
+
+  * Add installer support for iwlmvm adapters (LP: #1848236)
+    - d-i: Add iwlmvm to nic-modules
+
+  * shiftfs: rework how shiftfs opens files (LP: #1846265)
+    - SAUCE: shiftfs: rework how shiftfs opens files
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.4-rc4
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc4
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 21 Oct 2019 17:31:26 +0200
+
+linux (5.4.0-1.2) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] updateconfigs after rebase to 5.4-rc3
+    - [Config] add flexfb, fbtft_device and rio500 to modules.ignore
+    - [Config] amd64: ignore fbtft and all dependent modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc3
+
+ -- Andrea Righi <andrea.righi@canonical.com>  Mon, 14 Oct 2019 19:48:52 +0200
+
+linux (5.4.0-0.1) eoan; urgency=medium
+
+  * Enable the Dragonboards out of Eoan/master arm64 kernel (LP: #1846704)
+    - [Packaging] arm64: snapdragon: introduce a snapdragon flavour
+    - [Packaging] arm64: snapdragon: switch kernel format to Image
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8916=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8994=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8996=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8998=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_RPMH=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_BAM_DMA=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_HIDMA_MGMT=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_HIDMA=y
+    - [Config] arm64: snapdragon: CONFIG_COMMON_CLK_QCOM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_RPMH=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8916=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8994=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_MMCC_8996=y
+    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8998=y
+    - [Config] arm64: snapdragon: CONFIG_HWSPINLOCK_QCOM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_APCS_IPC=y
+    - [Config] arm64: snapdragon: CONFIG_RPMSG_QCOM_GLINK_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_GENI_SE=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMEM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMD_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMP2P=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_SMSM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_QFPROM=y
+    - [Config] arm64: snapdragon: CONFIG_SERIAL_QCOM_GENI=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_TSENS=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_SMD_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_SMD_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_RPMSG_QCOM_SMD=y
+    - [Config] arm64: snapdragon: CONFIG_MFD_QCOM_RPM=y
+    - [Config] arm64: snapdragon: CONFIG_SCSI_UFSHCD=y
+    - [Config] arm64: snapdragon: CONFIG_SCSI_UFSHCD_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_SCSI_UFS_HISI=y
+    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI=y
+    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI_PLTFM=y
+    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI_MSM=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_SPMI=y
+    - [Config] arm64: snapdragon: CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_USB_HS=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_QMP=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_UFS=y
+    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_USB_HSIC=y
+    - [Config] arm64: snapdragon: CONFIG_USB_CHIPIDEA_OF=y
+    - [Config] arm64: snapdragon: CONFIG_USB_EHCI_HCD_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_EXTCON_USB_GPIO=y
+    - [Config] arm64: snapdragon: CONFIG_REGULATOR_FIXED_VOLTAGE=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_GPIO=y
+    - [Config] arm64: snapdragon: CONFIG_USB_HSIC_USB3503=y
+    - [Config] arm64: snapdragon: CONFIG_USB_NET_DRIVERS=y
+    - [Config] arm64: snapdragon: CONFIG_USB_OTG=y
+    - [Config] arm64: snapdragon: CONFIG_USB_XHCI_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_USB_OHCI_HCD_PLATFORM=y
+    - [Config] arm64: snapdragon: CONFIG_USB_MUSB_HDRC=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3_PCI=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3_OF_SIMPLE=y
+    - [Config] arm64: snapdragon: CONFIG_USB_DWC3_QCOM=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_PWM=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+    - [Config] arm64: snapdragon: CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_A53PLL=y
+    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_APCS_MSM8916=y
+    - [Config] arm64: snapdragon: CONFIG_NLS_ISO8859_1=y
+    - [Config] arm64: snapdragon: CONFIG_USB_USBNET=y
+    - [Config] arm64: snapdragon: CONFIG_CRYPTO_DEV_QCOM_RNG=y
+    - [Config] arm64: snapdragon: CONFIG_POWER_RESET_QCOM_PON=y
+    - [Config] arm64: snapdragon: CONFIG_INPUT_PM8941_PWRKEY=y
+    - [Config] arm64: snapdragon: CONFIG_KEYBOARD_GPIO=y
+    - [Config] arm64: snapdragon: CONFIG_RTC_DRV_PM8XXX=y
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after rebase to 5.4-rc2
+    - SAUCE: (lockdown) Make get_cert_list() not complain about cert lists that
+      aren't present.
+    - SAUCE: (lockdown) Add efi_status_to_str() and rework efi_status_to_err().
+    - SAUCE: (lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down
+    - SAUCE: (lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
+      mode
+    - SAUCE: (lockdown) efi: Lock down the kernel if booted in secure boot mode
+    - SAUCE: (lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature
+      verify
+    - SAUCE: (lockdown) arm64: Allow locking down the kernel under EFI secure boot
+    - SAUCE: (lockdown) security: lockdown: Make
+      CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT more generic
+    - SAUCE: (lockdown) s390/ipl: lockdown kernel when booted secure
+    - [Config] Enable lockdown under secure boot
+    - SAUCE: import aufs driver
+    - SAUCE: aufs: rwsem owner changed to atmoic_long_t in 5.3
+    - SAUCE: aufs: add "WITH Linux-syscall-note" to SPDX tag of uapi headers
+    - [Config] enable aufs
+    - update dkms package versions
+    - [Config] disable zfs
+    - [Config] disable nvidia dkms build
+    - [Config] disable virtualbox dkms build
+    - [Debian] Generate stub reconstruct for -rc kernels
+    - Revert "UBUNTU: SAUCE: (namespace) block_dev: Forbid unprivileged mounting
+      when device is opened for writing"
+    - Revert "UBUNTU: SAUCE: (namespace) ext4: Add module parameter to enable user
+      namespace mounts"
+    - Revert "UBUNTU: SAUCE: (namespace) ext4: Add support for unprivileged mounts
+      from user namespaces"
+    - Revert "UBUNTU: SAUCE: (namespace) mtd: Check permissions towards mtd block
+      device inode when mounting"
+    - Revert "UBUNTU: SAUCE: (namespace) block_dev: Check permissions towards
+      block device inode when mounting"
+    - Revert "UBUNTU: SAUCE: (namespace) block_dev: Support checking inode
+      permissions in lookup_bdev()"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.4-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 11 Oct 2019 16:42:41 -0500
+
+linux (5.4.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 08 Oct 2019 09:59:00 -0500
+
+linux (5.3.0-17.18) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-17.18 -proposed tracker (LP: #1846641)
+
+  * CVE-2019-17056
+    - nfc: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17055
+    - mISDN: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17054
+    - appletalk: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17053
+    - ieee802154: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-17052
+    - ax25: enforce CAP_NET_RAW for raw sockets
+
+  * CVE-2019-15098
+    - ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()
+
+  * xHCI on AMD Stoney Ridge cannot detect USB 2.0 or 1.1 devices.
+    (LP: #1846470)
+    - x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect
+
+  * Re-enable linux-libc-dev build on i386 (LP: #1846508)
+    - [Packaging] Build only linux-libc-dev for i386
+    - [Debian] final-checks -- ignore archtictures with no binaries
+
+  * arm64: loop on boot after installing linux-generic-hwe-18.04-edge/bionic-
+    proposed (LP: #1845820)
+    - [Config] Disable CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT
+
+  * Revert ESE DASD discard support (LP: #1846219)
+    - SAUCE: Revert "s390/dasd: Add discard support for ESE volumes"
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 03 Oct 2019 16:57:05 -0500
+
+linux (5.3.0-16.17) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-16.17 -proposed tracker (LP: #1846204)
+
+  * zfs fails to build on s390x  with debug symbols enabled (LP: #1846143)
+    - SAUCE: s390: Mark atomic const ops always inline
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 01 Oct 2019 07:46:43 -0500
+
+linux (5.3.0-15.16) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-15.16 -proposed tracker (LP: #1845987)
+
+  * Drop i386 build for 19.10 (LP: #1845714)
+    - [Packaging] Remove x32 arch references from control files
+    - [Debian] final-checks -- Get arch list from debian/control
+
+  * ZFS kernel modules lack debug symbols (LP: #1840704)
+    - [Debian] Fix conditional for setting zfs debug package path
+
+  * Use pyhon3-sphinx instead of python-sphinx for building html docs
+    (LP: #1845808)
+    - [Packaging] Update sphinx build dependencies to python3 packages
+
+  * Kernel panic with 19.10 beta image (LP: #1845454)
+    - efi/tpm: Don't access event->count when it isn't mapped.
+    - efi/tpm: don't traverse an event log with no events
+    - efi/tpm: only set efi_tpm_final_log_size after successful event log parsing
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 30 Sep 2019 11:57:20 -0500
+
+linux (5.3.0-14.15) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-14.15 -proposed tracker (LP: #1845728)
+
+  * Drop i386 build for 19.10 (LP: #1845714)
+    - [Debian] Remove support for producing i386 kernels
+    - [Debian] Don't use CROSS_COMPILE for i386 configs
+
+  * udevadm trigger will fail when trying to add /sys/devices/vio/
+    (LP: #1845572)
+    - SAUCE: powerpc/vio: drop bus_type from parent device
+
+  * Trying to online dasd drive results in invalid input/output from the kernel
+    on z/VM (LP: #1845323)
+    - SAUCE: s390/dasd: Fix error handling during online processing
+
+  * intel-lpss driver conflicts with write-combining MTRR region (LP: #1845584)
+    - SAUCE: mfd: intel-lpss: add quirk for Dell XPS 13 7390 2-in-1
+
+  * Support Hi1620 zip hw accelerator (LP: #1845355)
+    - [Config] Enable HiSilicon QM/ZIP as modules
+    - crypto: hisilicon - add queue management driver for HiSilicon QM module
+    - crypto: hisilicon - add hardware SGL support
+    - crypto: hisilicon - add HiSilicon ZIP accelerator support
+    - crypto: hisilicon - add SRIOV support for ZIP
+    - Documentation: Add debugfs doc for hisi_zip
+    - crypto: hisilicon - add debugfs for ZIP and QM
+    - MAINTAINERS: add maintainer for HiSilicon QM and ZIP controller driver
+    - crypto: hisilicon - fix kbuild warnings
+    - crypto: hisilicon - add dependency for CRYPTO_DEV_HISI_ZIP
+    - crypto: hisilicon - init curr_sgl_dma to fix compile warning
+    - crypto: hisilicon - add missing single_release
+    - crypto: hisilicon - fix error handle in hisi_zip_create_req_q
+    - crypto: hisilicon - Fix warning on printing %p with dma_addr_t
+    - crypto: hisilicon - Fix return value check in hisi_zip_acompress()
+    - crypto: hisilicon - avoid unused function warning
+
+  * SafeSetID LSM should be built but disabled by default (LP: #1845391)
+    - LSM: SafeSetID: Stop releasing uninitialized ruleset
+    - [Config] Build SafeSetID LSM but don't enable it by default
+
+  * CONFIG_LSM should not specify loadpin since it is not built (LP: #1845383)
+    - [Config] loadpin shouldn't be in CONFIG_LSM
+
+  * Add new pci-id's for CML-S, ICL (LP: #1845317)
+    - drm/i915/icl: Add missing device ID
+    - drm/i915/cml: Add Missing PCI IDs
+
+  * Thunderbolt support for ICL (LP: #1844680)
+    - thunderbolt: Correct path indices for PCIe tunnel
+    - thunderbolt: Move NVM upgrade support flag to struct icm
+    - thunderbolt: Use 32-bit writes when writing ring producer/consumer
+    - thunderbolt: Do not fail adding switch if some port is not implemented
+    - thunderbolt: Hide switch attributes that are not set
+    - thunderbolt: Expose active parts of NVM even if upgrade is not supported
+    - thunderbolt: Add support for Intel Ice Lake
+    - ACPI / property: Add two new Thunderbolt property GUIDs to the list
+
+  * Ubuntu 19.10 -  Additional PCI patch and fix (LP: #1844668)
+    - s390/pci: fix MSI message data
+
+  * Enhanced Hardware Support - Finalize Naming (LP: #1842774)
+    - s390: add support for IBM z15 machines
+    - [Config] CONFIG_MARCH_Z15=n, CONFIG_TUNE_Z15=n
+
+  * Eoan update: v5.3.1 upstream stable release (LP: #1845642)
+    - USB: usbcore: Fix slab-out-of-bounds bug during device reset
+    - media: tm6000: double free if usb disconnect while streaming
+    - phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
+    - ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit
+    - net/sched: fix race between deactivation and dequeue for NOLOCK qdisc
+    - net_sched: let qdisc_put() accept NULL pointer
+    - udp: correct reuseport selection with connected sockets
+    - xen-netfront: do not assume sk_buff_head list is empty in error handling
+    - net: dsa: Fix load order between DSA drivers and taggers
+    - net: stmmac: Hold rtnl lock in suspend/resume callbacks
+    - KVM: coalesced_mmio: add bounds checking
+    - Documentation: sphinx: Add missing comma to list of strings
+    - firmware: google: check if size is valid when decoding VPD data
+    - serial: sprd: correct the wrong sequence of arguments
+    - tty/serial: atmel: reschedule TX after RX was started
+    - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
+    - Revert "arm64: Remove unnecessary ISBs from set_{pte,pmd,pud}"
+    - ovl: fix regression caused by overlapping layers detection
+    - phy: qcom-qmp: Correct ready status, again
+    - floppy: fix usercopy direction
+    - media: technisat-usb2: break out of loop at end of buffer
+    - Linux 5.3.1
+
+  * ZFS kernel modules lack debug symbols (LP: #1840704)
+    - [Debian]: Remove hardcoded $(pkgdir) in debug symbols handling
+    - [Debian]: Handle debug symbols for modules in extras too
+    - [Debian]: Check/link modules with debug symbols after DKMS modules
+    - [Debian]: Warn about modules without debug symbols
+    - [Debian]: dkms-build: new parameter for debug package directory
+    - [Debian]: dkms-build: zfs: support for debug symbols
+    - [Debian]: dkms-build: Avoid executing post-processor scripts twice
+    - [Debian]: dkms-build: Move zfs special-casing into configure script
+
+  * /proc/self/maps paths missing on live session (was vlc won't start; eoan
+    19.10 & bionic 18.04 ubuntu/lubuntu/kubuntu/xubuntu/ubuntu-mate dailies)
+    (LP: #1842382)
+    - SAUCE: Revert "UBUNTU: SAUCE: shiftfs: enable overlayfs on shiftfs"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 27 Sep 2019 16:08:06 -0500
+
+linux (5.3.0-13.14) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-13.14 -proposed tracker (LP: #1845105)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Remove binutils-dev build dependency
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 23 Sep 2019 19:26:43 -0500
+
+linux (5.3.0-12.13) eoan; urgency=medium
+
+  * Change kernel compression method to improve boot speed (LP: #1840934)
+    - [Packaging] Add lz4 build dependency for s390x
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Remove spl and zfs source
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 17 Sep 2019 13:36:26 +0200
+
+linux (5.3.0-11.12) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-11.12 -proposed tracker (LP: #1844144)
+
+  *  Suspend to RAM(S3) does not wake up for latest megaraid and mpt3sas
+    adapters(SAS3.5 onwards) (LP: #1838751)
+    - PCI: Restore Resizable BAR size bits correctly for 1MB BARs
+
+  * s390/setup: Actually init kernel lock down (LP: #1843961)
+    - SAUCE: (lockdown) s390/setup: Actually init kernel lock down
+
+  * cherrypick has_sipl fix (LP: #1843960)
+    - SAUCE: s390/sclp: Fix bit checked for has_sipl
+
+  * Change kernel compression method to improve boot speed (LP: #1840934)
+    - [Config]: Switch kernel compression from LZO to LZ4 on s390x
+
+  * Installation fails on eoan/PowerVM : missing /dev/nvram (LP: #1837726)
+    - [Config] CONFIG_NVRAM=y for ppc64el
+
+  * Miscellaneous Ubuntu changes
+    - [Config]: remove nvram from ppc64el modules ABI
+    - [Config] Update annotations for recent config changes
+    - SAUCE: sched: Add __ASSEMBLY__ guards around struct clone_args
+    - SAUCE: i2c: qcom-geni: Disable DMA processing on the Lenovo Yoga C630
+    - SAUCE: arm64: dts: qcom: Add Lenovo Yoga C630
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 16 Sep 2019 16:18:27 +0200
+
+linux (5.3.0-10.11) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-10.11 -proposed tracker (LP: #1843232)
+
+  * No sound inputs from the external microphone and headset on a Dell machine
+    (LP: #1842265)
+    - SAUCE: ALSA: hda - Expand pin_match function to match upcoming new tbls
+    - SAUCE: ALSA: hda - Define a fallback_pin_fixup_tbl for alc269 family
+
+  * Horizontal corrupted line at top of screen caused by framebuffer compression
+    (LP: #1840236)
+    - SAUCE: drm/i915/fbc: disable framebuffer compression on IceLake
+
+  * Add bpftool to linux-tools-common (LP: #1774815)
+    - [Debian] package bpftool in linux-tools-common
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc8
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 09 Sep 2019 10:00:41 +0200
+
+linux (5.3.0-9.10) eoan; urgency=medium
+
+  * eoan/linux: 5.3.0-9.10 -proposed tracker (LP: #1842393)
+
+  * shiftfs: mark kmem_cache as reclaimable (LP: #1842059)
+    - SAUCE: shiftfs: mark slab objects SLAB_RECLAIM_ACCOUNT
+
+  * shiftfs: drop entries from cache on unlink (LP: #1841977)
+    - SAUCE: shiftfs: fix buggy unlink logic
+
+  * Fix touchpad IRQ storm after S3 (LP: #1841396)
+    - pinctrl: intel: remap the pin number to gpio offset for irq enabled pin
+
+  * Please include DTBs for arm64 laptops (LP: #1842050)
+    - arm64: dts: qcom: Add Lenovo Miix 630
+    - arm64: dts: qcom: Add HP Envy x2
+    - arm64: dts: qcom: Add Asus NovaGo TP370QL
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import aufs driver
+    - [Packaging]: ignore vbox modules when vbox is disabled
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc7
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 03 Sep 2019 10:27:33 +0200
+
+linux (5.3.0-8.9) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+
+  * Change kernel compression method to improve boot speed (LP: #1840934)
+    - [Config] change kernel compression method to improve boot speed
+    - [Packaging] add build dependencies for compression algorithms
+
+  * realtek r8822be kernel module fails after update to linux kernel-headers
+    5.0.0-21 (LP: #1838133)
+    - rtw88: Fix misuse of GENMASK macro
+    - rtw88: pci: Rearrange the memory usage for skb in RX ISR
+    - rtw88: pci: Use DMA sync instead of remapping in RX ISR
+    - rtw88: debug: dump tx power indexes in use
+    - rtw88: use txpwr_lmt_cfg_pair struct, not arrays
+    - rtw88: pci: remove set but not used variable 'ip_sel'
+    - rtw88: allow c2h operation in irq context
+    - rtw88: enclose c2h cmd handle with mutex
+    - rtw88: add BT co-existence support
+    - SAUCE: rtw88: pci: enable MSI interrupt
+
+  * VIMC module not available (CONFIG_VIDEO_VIMC not set) (LP: #1831482)
+    - [Config] Enable VIMC module
+
+  * Goodix touchpad may drop first input event (LP: #1840075)
+    - Revert "UBUNTU: SAUCE: i2c: designware: add G3 3590 into i2c quirk"
+    - Revert "UBUNTU: SAUCE: i2c: designware: add Inpiron 7591 into i2c quirk"
+    - Revert "UBUNTU: SAUCE: i2c: designware: add Inpiron/Vostro 7590 into i2c
+      quirk"
+    - Revert "UBUNTU: SAUCE: i2c: designware: Add disable runtime pm quirk"
+    - mfd: intel-lpss: Remove D3cold delay
+
+  * Include Sunix serial/parallel driver (LP: #1826716)
+    - serial: 8250_pci: Add support for Sunix serial boards
+    - parport: parport_serial: Add support for Sunix Multi I/O boards
+
+  * enable lockdown on s390x when Secure IPL is performed (LP: #1839622)
+    - SAUCE: (lockdown) s390/ipl: lockdown kernel when booted secure
+    - Ubuntu: [Config] Enable CONFIG_LOCK_DOWN_KERNEL on s390x.
+
+  * UBUNTU: SAUCE: shiftfs: pass correct point down (LP: #1837231)
+    - SAUCE: shiftfs: pass correct point down
+
+  * shiftfs: add O_DIRECT support (LP: #1837223)
+    - SAUCE: shiftfs: add O_DIRECT support
+
+  * Miscellaneous Ubuntu changes
+    - [Config] enable secureboot signing on s390x
+    - [Config] CONFIG_TEST_BLACKHOLE_DEV=m
+    - SAUCE: selftests: fib_tests: assign address to dummy1 for rp_filter tests
+    - [Debian] disable dkms builds for autopktest rebuilds
+    - update dkms package versions
+    - [Config] updateconfigs after v5.3-rc6 rebase
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 26 Aug 2019 10:09:42 +0200
+
+linux (5.3.0-7.8) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+
+  * Miscellaneous Ubuntu changes
+    - [Config] updateconfigs after v5.3-rc5 rebase
+    - remove missing module after updateconfigs
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc5
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 19 Aug 2019 15:31:24 +0200
+
+linux (5.3.0-6.7) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/bpf: prevent headers to be compiled as C code
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 14 Aug 2019 13:25:01 -0500
+
+linux (5.3.0-5.6) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Config] enable zfs build
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 13 Aug 2019 09:16:06 -0500
+
+linux (5.3.0-4.5) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync getabis
+    - [Packaging] update helper scripts
+
+  * bcache: bch_allocator_thread(): hung task timeout (LP: #1784665) // Tight
+    timeout for bcache removal causes spurious failures (LP: #1796292)
+    - SAUCE: bcache: fix deadlock in bcache_allocator
+
+  * shiftfs: allow overlayfs (LP: #1838677)
+    - SAUCE: shiftfs: enable overlayfs on shiftfs
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "kbuild: modpost: do not parse unnecessary rules for vmlinux
+      modpost"
+    - update dkms package versions
+    - enable nvidia dkms build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 12 Aug 2019 10:41:27 -0500
+
+linux (5.3.0-3.4) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - SAUCE: aufs: add "WITH Linux-syscall-note" to SPDX tag of uapi headers
+    - [Config] add mux-* to modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc3
+
+ -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 05 Aug 2019 18:17:09 +0200
+
+linux (5.3.0-2.3) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] add build dependincy on fontconfig
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jul 2019 12:18:46 -0400
+
+linux (5.3.0-1.2) eoan; urgency=medium
+
+  * System does not auto detect disconnection of external monitor (LP: #1835001)
+    - SAUCE: drm/i915: Add support for retrying hotplug
+    - SAUCE: drm/i915: Enable hotplug retry
+
+  * Please enable CONFIG_SCSI_UFS_QCOM as a module on arm64 (LP: #1837332)
+    - [Config] Enable CONFIG_SCSI_UFS_QCOM as a module on arm64.
+
+  * Add arm64 CONFIG_ARCH_MESON=y and related configs Edit (LP: #1820530)
+    - [Config] enable ARCH_MESON
+    - remove missing module
+    - [Config] update annotations after enabling ARCH_MESON for arm64
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: KVM: PPC: comment implicit fallthrough
+    - update dkms package versions
+    - [Config] enable vbox dkms build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 28 Jul 2019 23:10:16 -0400
+
+linux (5.3.0-0.1) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and
+      KEXEC_SIG_FORCE
+    - SAUCE: (efi-lockdown) kexec_file: Restrict at runtime if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) lockdown: Print current->comm in restriction messages
+    - SAUCE: (efi-lockdown) kexec: Allow kexec_file() with appropriate IMA policy
+      when locked down
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) KEYS: Make use of platform keyring for module
+      signature verify
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) furter KEXEC_VERIFY_SIG -> KEXEC_SIG updates
+    - SAUCE: (efi-lockdown) arm64: add kernel config option to lock down when in
+      Secure Boot mode
+    - SAUCE: import aufs driver
+    - SAUCE: aufs: rwsem owner changed to atmoic_long_t in 5.3
+    - [Config] disable zfs dkms build
+    - [Config] disable nvidia dkms build
+    - [Config] disable vbox dkms build
+    - SAUCE: perf diff: use llabs for s64 vaules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.3-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 23 Jul 2019 21:45:44 -0500
+
+linux (5.3.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jul 2019 10:19:04 -0500
+
+linux (5.2.0-9.10) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * input/mouse: alps trackpoint-only device doesn't work (LP: #1836752)
+    - SAUCE: Input: alps - don't handle ALPS cs19 trackpoint-only device
+    - SAUCE: Input: alps - fix a mismatch between a condition check and its
+      comment
+
+  * System does not auto detect disconnection of external monitor (LP: #1835001)
+    - SAUCE: drm/i915: Add support for retrying hotplug
+    - SAUCE: drm/i915: Enable hotplug retry
+
+  * alsa/hdmi: add icelake hdmi audio support for a Dell machine (LP: #1836916)
+    - SAUCE: ALSA: hda/hdmi - Remove duplicated define
+    - SAUCE: ALSA: hda/hdmi - Fix i915 reverse port/pin mapping
+
+  * First click on Goodix touchpad doesn't be recognized after runtime suspended
+    (LP: #1836836)
+    - SAUCE: i2c: designware: add G3 3590 into i2c quirk
+
+  * ixgbe{vf} - Physical Function gets IRQ when VF checks link state
+    (LP: #1836760)
+    - ixgbevf: Use cached link state instead of re-reading the value for ethtool
+
+  * Doing multiple squashfs (and other loop?) mounts in parallel breaks
+    (LP: #1836914)
+    - SAUCE: Revert "loop: Don't change loop device under exclusive opener"
+
+  * hibmc-drm Causes Unreadable Display for Huawei amd64 Servers (LP: #1762940)
+    - SAUCE: Make CONFIG_DRM_HISI_HIBMC depend on ARM64
+    - [Config] Set CONFIG_DRM_HISI_HIBMC to arm64 only
+    - [Config] add hibmc-drm to modules.ignore
+
+  * hda/realtek: can't detect external mic on a Dell machine (LP: #1836755)
+    - ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine
+
+  * Enable Armada SOCs and MVPP2 NIC driver for disco/generic arm64
+    (LP: #1835054)
+    - [Config] Enable Armada SOCs and MVPP2 NIC driver for disco/generic arm64
+
+  * Unhide Nvidia HDA audio controller (LP: #1836308)
+    - PCI: Enable NVIDIA HDA controllers
+
+  * Intel ethernet I219 may wrongly detect connection speed as 10Mbps
+    (LP: #1836177)
+    - e1000e: Make watchdog use delayed work
+
+  * Sometimes touchpad(goodix) can't use tap function (LP: #1836020)
+    - SAUCE: i2c: designware: add Inpiron/Vostro 7590 into i2c quirk
+    - SAUCE: i2c: designware: add Inpiron 7591 into i2c quirk
+
+  * Intel ethernet I219 has slow RX speed (LP: #1836152)
+    - e1000e: add workaround for possible stalled packet
+    - e1000e: disable force K1-off feature
+
+  * bcache: risk of data loss on I/O errors in backing or caching devices
+    (LP: #1829563)
+    - Revert "bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()"
+
+  * bnx2x driver causes 100% CPU load (LP: #1832082)
+    - bnx2x: Prevent ptp_task to be rescheduled indefinitely
+
+  * fcf-protection=none patch with new version
+    - Revert "UBUNTU: SAUCE: kbuild: add -fcf-protection=none to retpoline flags"
+    - SAUCE: kbuild: add -fcf-protection=none when using retpoline flags
+
+  * CVE-2019-12614
+    - powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property()
+
+  * Eoan update: v5.2.1 upstream stable release (LP: #1836622)
+    - crypto: lrw - use correct alignmask
+    - crypto: talitos - rename alternative AEAD algos.
+    - fscrypt: don't set policy for a dead directory
+    - udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
+    - media: stv0297: fix frequency range limit
+    - ALSA: usb-audio: Fix parse of UAC2 Extension Units
+    - ALSA: hda/realtek - Headphone Mic can't record after S3
+    - tpm: Actually fail on TPM errors during "get random"
+    - tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations
+    - block: fix .bi_size overflow
+    - block, bfq: NULL out the bic when it's no longer valid
+    - perf intel-pt: Fix itrace defaults for perf script
+    - perf auxtrace: Fix itrace defaults for perf script
+    - perf intel-pt: Fix itrace defaults for perf script intel-pt documentation
+    - perf pmu: Fix uncore PMU alias list for ARM64
+    - perf thread-stack: Fix thread stack return from kernel for kernel-only case
+    - perf header: Assign proper ff->ph in perf_event__synthesize_features()
+    - x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
+    - x86/tls: Fix possible spectre-v1 in do_get_thread_area()
+    - Documentation: Add section about CPU vulnerabilities for Spectre
+    - Documentation/admin: Remove the vsyscall=native documentation
+    - mwifiex: Don't abort on small, spec-compliant vendor IEs
+    - USB: serial: ftdi_sio: add ID for isodebug v1
+    - USB: serial: option: add support for GosunCn ME3630 RNDIS mode
+    - Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
+    - p54usb: Fix race between disconnect and firmware loading
+    - usb: gadget: f_fs: data_len used before properly set
+    - usb: gadget: ether: Fix race between gether_disconnect and rx_submit
+    - usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset()
+    - usb: renesas_usbhs: add a workaround for a race condition of workqueue
+    - drivers/usb/typec/tps6598x.c: fix portinfo width
+    - drivers/usb/typec/tps6598x.c: fix 4CC cmd write
+    - p54: fix crash during initialization
+    - staging: comedi: dt282x: fix a null pointer deref on interrupt
+    - staging: wilc1000: fix error path cleanup in wilc_wlan_initialize()
+    - staging: bcm2835-camera: Restore return behavior of ctrl_set_bitrate()
+    - staging: comedi: amplc_pci230: fix null pointer deref on interrupt
+    - staging: mt7621-pci: fix PCIE_FTS_NUM_LO macro
+    - HID: Add another Primax PIXART OEM mouse quirk
+    - lkdtm: support llvm-objcopy
+    - binder: fix memory leak in error path
+    - binder: return errors from buffer copy functions
+    - iio: adc: stm32-adc: add missing vdda-supply
+    - coresight: Potential uninitialized variable in probe()
+    - coresight: etb10: Do not call smp_processor_id from preemptible
+    - coresight: tmc-etr: Do not call smp_processor_id() from preemptible
+    - coresight: tmc-etr: alloc_perf_buf: Do not call smp_processor_id from
+      preemptible
+    - coresight: tmc-etf: Do not call smp_processor_id from preemptible
+    - carl9170: fix misuse of device driver API
+    - Revert "x86/build: Move _etext to actual end of .text"
+    - VMCI: Fix integer overflow in VMCI handle arrays
+    - staging: vchiq_2835_arm: revert "quit using custom down_interruptible()"
+    - staging: vchiq: make wait events interruptible
+    - staging: vchiq: revert "switch to wait_for_completion_killable"
+    - staging: fsl-dpaa2/ethsw: fix memory leak of switchdev_work
+    - staging: bcm2835-camera: Replace spinlock protecting context_map with mutex
+    - staging: bcm2835-camera: Ensure all buffers are returned on disable
+    - staging: bcm2835-camera: Remove check of the number of buffers supplied
+    - staging: bcm2835-camera: Handle empty EOS buffers whilst streaming
+    - staging: rtl8712: reduce stack usage, again
+    - Linux 5.2.1
+    - [Config] updateconfigs after v5.2.1 stable update
+
+  * fcf-protection=none patch with upstream version
+    - Revert "UBUNTU: SAUCE: add -fcf-protection=none to retpoline flags"
+    - SAUCE: kbuild: add -fcf-protection=none to retpoline flags
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/ftrace: avoid failure when trying to probe a notrace
+      function
+    - SAUCE: selftests/powerpc/ptrace: fix build failure
+    - update dkms package versions
+    - [Packaging] add zlua to zfs-modules.ignore
+    - update dkms package versions
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 19 Jul 2019 15:04:45 -0500
+
+linux (5.2.0-8.9) eoan; urgency=medium
+
+  * linux: 5.2.0-8.9 -proposed tracker (LP: #1835700)
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] replace zfs and spl build with zfs 0.8.1-1ubuntu1
+    - SAUCE: test_bpf: remove expected fail for Ctx heavy transformations test on
+      s390
+    - SAUCE: add -fcf-protection=none to retpoline flags
+    - SAUCE: usbip: ensure strings copied using strncpy are null-terminated
+    - SAUCE: usbip: add -Wno-address-of-packed-member to EXTRA_CFLAGS
+    - SAUCE: perf jvmti: ensure strncpy result is null-terminated
+    - update dkms package versions
+    - add removed zfs modules to modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 08 Jul 2019 07:13:41 -0500
+
+linux (5.2.0-7.8) eoan; urgency=medium
+
+  * Kernel panic upon resetting ixgbe SR-IOV VFIO virtual function using 5.0
+    kernel (LP: #1829652)
+    - SAUCE: ixgbe: Avoid NULL pointer dereference with VF on non-IPsec hw
+
+  * Hi1620 driver updates from upstream 5.2 merge window (LP: #1830815)
+    - net: hns3: initialize CPU reverse mapping
+    - net: hns3: refine the flow director handle
+    - net: hns3: add aRFS support for PF
+    - net: hns3: fix for FEC configuration
+    - RDMA/hns: Remove unnecessary print message in aeq
+    - RDMA/hns: Update CQE specifications
+    - RDMA/hns: Move spin_lock_irqsave to the correct place
+    - RDMA/hns: Remove jiffies operation in disable interrupt context
+    - RDMA/hns: Replace magic numbers with #defines
+    - net: hns3: fix compile warning without CONFIG_RFS_ACCEL
+    - net: hns3: fix for HNS3_RXD_GRO_SIZE_M macro
+    - net: hns3: add support for dump firmware statistics by debugfs
+    - net: hns3: use HCLGE_STATE_NIC_REGISTERED to indicate PF NIC client has
+      registered
+    - net: hns3: use HCLGE_STATE_ROCE_REGISTERED to indicate PF ROCE client has
+      registered
+    - net: hns3: use HCLGEVF_STATE_NIC_REGISTERED to indicate VF NIC client has
+      registered
+    - net: hns3: modify hclge_init_client_instance()
+    - net: hns3: modify hclgevf_init_client_instance()
+    - net: hns3: add handshake with hardware while doing reset
+    - net: hns3: stop schedule reset service while unloading driver
+    - net: hns3: adjust hns3_uninit_phy()'s location in the hns3_client_uninit()
+    - net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector
+    - RDMA/hns: Bugfix for posting multiple srq work request
+    - net: hns3: remove redundant core reset
+    - net: hns3: don't configure new VLAN ID into VF VLAN table when it's full
+    - net: hns3: fix VLAN filter restore issue after reset
+    - net: hns3: set the port shaper according to MAC speed
+    - net: hns3: add a check to pointer in error_detected and slot_reset
+    - net: hns3: set ops to null when unregister ad_dev
+    - net: hns3: add handling of two bits in MAC tunnel interrupts
+    - net: hns3: remove setting bit of reset_requests when handling mac tunnel
+      interrupts
+    - net: hns3: add opcode about query and clear RAS & MSI-X to special opcode
+    - net: hns3: delay and separate enabling of NIC and ROCE HW errors
+    - RDMA/hns: fix inverted logic of readl read and shift
+    - RDMA/hns: Bugfix for filling the sge of srq
+    - net: hns3: log detail error info of ROCEE ECC and AXI errors
+    - net: hns3: fix wrong size of mailbox responding data
+    - net: hns3: make HW GRO handling compliant with SW GRO
+    - net: hns3: replace numa_node_id with numa_mem_id for buffer reusing
+    - net: hns3: refactor hns3_get_new_int_gl function
+    - net: hns3: trigger VF reset if a VF has an over_8bd_nfe_err
+    - net: hns3: delete the redundant user NIC codes
+    - net: hns3: small changes for magic numbers
+    - net: hns3: use macros instead of magic numbers
+    - net: hns3: refactor PF/VF RSS hash key configuration
+    - net: hns3: some modifications to simplify and optimize code
+    - net: hns3: fix some coding style issues
+    - net: hns3: delay setting of reset level for hw errors until slot_reset is
+      called
+    - net: hns3: fix avoid unnecessary resetting for the H/W errors which do not
+      require reset
+    - net: hns3: process H/W errors occurred before HNS dev initialization
+    - net: hns3: add recovery for the H/W errors occurred before the HNS dev
+      initialization
+    - net: hns3: some changes of MSI-X bits in PPU(RCB)
+    - net: hns3: extract handling of mpf/pf msi-x errors into functions
+    - net: hns3: clear restting state when initializing HW device
+    - net: hns3: free irq when exit from abnormal branch
+    - net: hns3: fix for dereferencing before null checking
+    - net: hns3: fix for skb leak when doing selftest
+    - net: hns3: delay ring buffer clearing during reset
+    - net: hns3: some variable modification
+    - net: hns3: fix dereference of ae_dev before it is null checked
+    - scsi: hisi_sas: Delete PHY timers when rmmod or probe failed
+    - scsi: hisi_sas: Fix the issue of argument mismatch of printing ecc errors
+    - scsi: hisi_sas: Reduce HISI_SAS_SGE_PAGE_CNT in size
+    - scsi: hisi_sas: Change the type of some numbers to unsigned
+    - scsi: hisi_sas: Ignore the error code between phy down to phy up
+    - scsi: hisi_sas: Disable stash for v3 hw
+    - net: hns3: Add missing newline at end of file
+    - RDMa/hns: Don't stuck in endless timeout loop
+
+  * Sometimes touchpad automatically trigger double click (LP: #1833484)
+    - SAUCE: i2c: designware: Add disable runtime pm quirk
+
+  * Add pointstick support on HP ZBook 17 G5 (LP: #1833387)
+    - Revert "HID: multitouch: Support ALPS PTP stick with pid 0x120A"
+
+  * depmod may prefer unsigned l-r-m nvidia modules to signed modules
+    (LP: #1834479)
+    - [Packaging] dkms-build--nvidia-N -- clean up unsigned ko files
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/powerpc: disable signal_fuzzer test
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 01 Jul 2019 07:22:18 -0500
+
+linux (5.2.0-6.7) eoan; urgency=medium
+
+  * hinic: fix oops due to race in set_rx_mode (LP: #1832048)
+    - hinic: fix a bug in set rx mode
+
+  * Miscellaneous Ubuntu changes
+    - rebase to v5.2-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 23 Jun 2019 23:36:11 -0500
+
+linux (5.2.0-5.6) eoan; urgency=medium
+
+  * QCA9377 isn't being recognized sometimes (LP: #1757218)
+    - SAUCE: USB: Disable USB2 LPM at shutdown
+
+  * shiftfs: allow changing ro/rw for subvolumes (LP: #1832316)
+    - SAUCE: shiftfs: allow changing ro/rw for subvolumes
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - [Packaging] replace nvidia-418 dkms build with nvidia-430
+    - SAUCE: import aufs driver
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 17 Jun 2019 15:04:12 -0500
+
+linux (5.2.0-4.5) eoan; urgency=medium
+
+  * arm64: cma_alloc errors at boot (LP: #1823753)
+    - [Config] Bump CMA_SIZE_MBYTES to 32 on arm64
+    - dma-contiguous: add dma_{alloc,free}_contiguous() helpers
+    - dma-contiguous: use fallback alloc_pages for single pages
+    - dma-contiguous: fix !CONFIG_DMA_CMA version of dma_{alloc,
+      free}_contiguous()
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_MFD_TQMX86=n for s390x
+    - [Config] CONFIG_GPIO_AMD_FCH=n for s390x
+    - [Config] CONFIG_BACKLIGHT_CLASS_DEVICE=n on s390x
+    - [Config] CONFIG_LCD_CLASS_DEVICE=n for s390x
+    - [Config] CONFIG_DRM_ETNAVIV=m for armhf generic-lpae
+    - [Config] CONFIG_DRM_NOUVEAU_SVM=n
+    - [Config] CONFIG_HWMON=n for s390x
+    - [Config] CONFIG_NEW_LEDS=n for s390x
+    - [Config] CONFIG_MTD_NAND_OMAP2=y for armhf
+    - [Config] CONFIG_VOP_BUS=n for non-amd64 arches
+    - [Config] CONFIG_TI_CPSW_PHY_SEL=n
+    - [Config] CONFIG_INTERCONNECT=n for s390x
+    - [Config] CONFIG_SCSI_GDTH=n for s390x
+    - [Config] CONFIG_PACKING=n for s390x
+    - [Config] CONFIG_ARCH_MILBEAUT=y for armhf
+    - [Config] update annotations following config review
+    - update dkms package versions
+    - [Config] enable nvidia dkms build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 10 Jun 2019 07:00:11 -0500
+
+linux (5.2.0-3.4) eoan; urgency=medium
+
+  * [18.04/18.10] File libperf-jvmti.so is missing in linux-tools-common deb on
+    Ubuntu (LP: #1761379)
+    - [Packaging] Support building libperf-jvmti.so
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Revert "bpf, selftest: test global data/bss/rodata sections"
+    - update dkms package versions
+    - [Config] enable zfs
+    - rebase to v5.2-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 02 Jun 2019 21:48:50 -0500
+
+linux (5.2.0-2.3) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: perf arm64: Fix mksyscalltbl when system kernel headers are ahead of
+      the kernel
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 May 2019 07:12:39 -0500
+
+linux (5.2.0-1.2) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_INTEGRITY_PLATFORM_KEYRING=y
+    - update dkms package versions
+    - [Config] enable vbox dkms build
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 May 2019 21:11:27 -0500
+
+linux (5.2.0-0.1) eoan; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: import aufs driver
+    - [Packaging] disable ZFS
+    - [Packaging] disable nvidia
+    - [Packaging] dkms-build -- expand paths searched for make.log files
+    - add virtualbox-guest-dkms dkms package build
+    - enable vbox dkms build for amd64 and i386
+    - update dkms package versions
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and
+      KEXEC_SIG_FORCE
+    - SAUCE: (efi-lockdown) kexec_file: Restrict at runtime if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) lockdown: Print current->comm in restriction messages
+    - SAUCE: (efi-lockdown) kexec: Allow kexec_file() with appropriate IMA policy
+      when locked down
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) KEYS: Make use of platform keyring for module
+      signature verify
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) furter KEXEC_VERIFY_SIG -> KEXEC_SIG updates
+    - SAUCE: (efi-lockdown) arm64: add kernel config option to lock down when in
+      Secure Boot mode
+    - update dkms package versions
+    - [Config] disable vbox build
+    - SAUCE: s390: mark __cpacf_check_opcode() and cpacf_query_func() as
+      __always_inline
+    - SAUCE: IB/mlx5: use size_t instead of u64 when dividing
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.2-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 21 May 2019 11:18:43 -0500
+
+linux (5.2.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 21 May 2019 07:34:43 -0500
+
+linux (5.1.0-2.2) eoan; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+
+  * Eoan update: v5.1.2 upstream stable release (LP: #1829050)
+    - x86/msr-index: Cleanup bit defines
+    - x86/speculation: Consolidate CPU whitelists
+    - x86/speculation/mds: Add basic bug infrastructure for MDS
+    - x86/speculation/mds: Add BUG_MSBDS_ONLY
+    - x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
+    - x86/speculation/mds: Add mds_clear_cpu_buffers()
+    - x86/speculation/mds: Clear CPU buffers on exit to user
+    - x86/kvm/vmx: Add MDS protection when L1D Flush is not active
+    - x86/speculation/mds: Conditionally clear CPU buffers on idle entry
+    - x86/speculation/mds: Add mitigation control for MDS
+    - x86/speculation/mds: Add sysfs reporting for MDS
+    - x86/speculation/mds: Add mitigation mode VMWERV
+    - Documentation: Move L1TF to separate directory
+    - Documentation: Add MDS vulnerability documentation
+    - x86/speculation/mds: Add mds=full,nosmt cmdline option
+    - x86/speculation: Move arch_smt_update() call to after mitigation decisions
+    - x86/speculation/mds: Add SMT warning message
+    - x86/speculation/mds: Fix comment
+    - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
+    - cpu/speculation: Add 'mitigations=' cmdline option
+    - x86/speculation: Support 'mitigations=' cmdline option
+    - powerpc/speculation: Support 'mitigations=' cmdline option
+    - s390/speculation: Support 'mitigations=' cmdline option
+    - x86/speculation/mds: Add 'mitigations=' support for MDS
+    - x86/mds: Add MDSUM variant to the MDS documentation
+    - Documentation: Correct the possible MDS sysfs values
+    - x86/speculation/mds: Fix documentation typo
+    - Linux 5.1.2
+
+  * Eoan update: v5.1.1 upstream stable release (LP: #1829046)
+    - Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in hv_synic_cleanup()
+    - ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings
+    - staging: greybus: power_supply: fix prop-descriptor request size
+    - staging: wilc1000: Avoid GFP_KERNEL allocation from atomic context.
+    - staging: most: cdev: fix chrdev_region leak in mod_exit
+    - staging: most: sound: pass correct device when creating a sound card
+    - usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON
+    - usb: dwc3: Fix default lpm_nyet_threshold value
+    - USB: serial: f81232: fix interrupt worker not stop
+    - USB: cdc-acm: fix unthrottle races
+    - usb-storage: Set virt_boundary_mask to avoid SG overflows
+    - genirq: Prevent use-after-free and work list corruption
+    - intel_th: pci: Add Comet Lake support
+    - iio: adc: qcom-spmi-adc5: Fix of-based module autoloading
+    - cpufreq: armada-37xx: fix frequency calculation for opp
+    - ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for
+      hibernate
+    - soc: sunxi: Fix missing dependency on REGMAP_MMIO
+    - scsi: lpfc: change snprintf to scnprintf for possible overflow
+    - scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines
+    - scsi: qla2xxx: Set remote port devloss timeout to 0
+    - scsi: qla2xxx: Fix device staying in blocked state
+    - Bluetooth: hidp: fix buffer overflow
+    - Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
+    - Bluetooth: Fix not initializing L2CAP tx_credits
+    - Bluetooth: hci_bcm: Fix empty regulator supplies for Intel Macs
+    - UAS: fix alignment of scatter/gather segments
+    - ASoC: Intel: avoid Oops if DMA setup fails
+    - i3c: Fix a shift wrap bug in i3c_bus_set_addr_slot_status()
+    - locking/futex: Allow low-level atomic operations to return -EAGAIN
+    - arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP
+    - Linux 5.1.1
+
+  * shiftfs: lock security sensitive superblock flags (LP: #1827122)
+    - SAUCE: shiftfs: lock down certain superblock flags
+
+  * Please package libbpf (which is done out of the kernel src) in Debian [for
+    19.10] (LP: #1826410)
+    - SAUCE: tools -- fix add ability to disable libbfd
+
+  * ratelimit cma_alloc messages (LP: #1828092)
+    - SAUCE: cma: ratelimit cma_alloc error messages
+
+  * Headphone jack switch sense is inverted: plugging in headphones disables
+    headphone output (LP: #1824259)
+    - ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board
+
+  * There are 4 HDMI/Displayport audio output listed in sound setting without
+    attach any HDMI/DP monitor (LP: #1827967)
+    - ALSA: hda/hdmi - Read the pin sense from register when repolling
+    - ALSA: hda/hdmi - Consider eld_valid when reporting jack event
+
+  * CONFIG_LOG_BUF_SHIFT set to 14 is too low on arm64 (LP: #1824864)
+    - [Config] CONFIG_LOG_BUF_SHIFT=18 on all 64bit arches
+
+  * CTAUTO:DevOps:860.50:devops4fp1:Error occurred during LINUX Dmesg error
+    Checking for all LINUX clients for devops4p10 (LP: #1766201)
+    - SAUCE: integrity: downgrade error to warning
+
+  * linux-buildinfo: pull out ABI information into its own package
+    (LP: #1806380)
+    - [Packaging] autoreconstruct -- base tag is always primary mainline version
+
+  * [SRU] Please sync vbox modules from virtualbox 6.0.6 on next kernel update
+    (LP: #1825210)
+    - vbox-update: updates for renamed makefiles
+    - ubuntu: vbox -- update to 6.0.6-dfsg-1
+
+  * autofs kernel module missing (LP: #1824333)
+    - [Config] Update autofs4 path in inclusion list
+
+  * The Realtek card reader does not enter PCIe 1.1/1.2 (LP: #1825487)
+    - SAUCE: misc: rtsx: Fixed rts5260 power saving parameter and sd glitch
+
+  * CVE-2019-3874
+    - sctp: implement memory accounting on tx path
+    - sctp: implement memory accounting on rx path
+
+  * apparmor does not start in Disco LXD containers (LP: #1824812)
+    - SAUCE: shiftfs: use separate llseek method for directories
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] autoreconstruct -- remove for -rc kernels
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) furter KEXEC_VERIFY_SIG -> KEXEC_SIG updates
+    - [Config] (efi-lockdown): update configs after efi lockdown patch refresh
+    - [Packaging] don't delete efi_parser.c
+    - vbox-update -- do not fix up KERN_DIR or KBUILD_EXTMOD
+    - ubuntu: vbox -- update to 6.0.6-dfsg-2
+    - add nvidia-418 dkms build
+    - remove virtualbox guest drivers
+    - [Packaging] dkms-build -- expand paths searched for make.log files
+    - add virtualbox-guest-dkms dkms package build
+    - enable vbox dkms build for amd64 and i386
+    - [Config] update configs for v5.1(-rc7)? rebase
+    - update dkms package versions
+    - Add the ability to lock down access to the running kernel image
+    - Enforce module signatures if the kernel is locked down
+    - Restrict /dev/{mem,kmem,port} when the kernel is locked down
+    - kexec_load: Disable at runtime if the kernel is locked down
+    - Copy secure_boot flag in boot params across kexec reboot
+    - kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE
+    - kexec_file: Restrict at runtime if the kernel is locked down
+    - hibernate: Disable when the kernel is locked down
+    - uswsusp: Disable when the kernel is locked down
+    - PCI: Lock down BAR access when the kernel is locked down
+    - x86: Lock down IO port access when the kernel is locked down
+    - x86/msr: Restrict MSR access when the kernel is locked down
+    - ACPI: Limit access to custom_method when the kernel is locked down
+    - acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down
+    - acpi: Disable ACPI table override if the kernel is locked down
+    - acpi: Disable APEI error injection if the kernel is locked down
+    - Prohibit PCMCIA CIS storage when the kernel is locked down
+    - Lock down TIOCSSERIAL
+    - Lock down module params that specify hardware parameters (eg. ioport)
+    - x86/mmiotrace: Lock down the testmmiotrace module
+    - Lock down /proc/kcore
+    - Lock down kprobes
+    - bpf: Restrict kernel image access functions when the kernel is locked down
+    - Lock down perf
+    - debugfs: Restrict debugfs when the kernel is locked down
+    - lockdown: Print current->comm in restriction messages
+    - kexec: Allow kexec_file() with appropriate IMA policy when locked down
+    - Make get_cert_list() not complain about cert lists that aren't present.
+    - Add efi_status_to_str() and rework efi_status_to_err().
+    - Make get_cert_list() use efi_status_to_str() to print error messages.
+    - efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
+    - efi: Lock down the kernel if booted in secure boot mode
+    - KEYS: Make use of platform keyring for module signature verify
+
+  * Miscellaneous upstream changes
+    - ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14)
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 14 May 2019 12:32:56 -0500
+
+linux (5.1.0-1.1) eoan; urgency=medium
+
+  * bionic: fork out linux-snapdragon into its own topic kernel (LP: #1820868)
+    - [Packaging]: really drop snapdragon
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: fix vbox use of MAP_SHARED
+    - SAUCE: fix vbox use of vm_fault_t
+    - [Packaging] disable ZFS
+    - [Packaging] disable nvidia
+    - SAUCE: perf annotate: Fix build on 32 bit for BPF annotation
+    - [Config]: updateconfig after rebase to v5.1-rc
+    - [Config]: build ETNAVIV only on arm platforms
+    - [Config]: Disable CMA on non-arm platforms
+    - [Config]: MMC_CQHCI is needed by some built-in drivers
+    - [Config]: a.out support has been deprecated
+    - [Config]: R3964 was marked as BROKEN
+    - [Config]: Add SENSIRION_SGP30 module
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: tools: lib/bpf -- add generated headers to search
+      path"
+    - Revert "UBUNTU: SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK"
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 25 Apr 2019 10:03:25 -0300
+
+linux (5.1.0-0.0) eoan; urgency=medium
+
+  * Dummy entry.
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Thu, 25 Apr 2019 09:49:47 -0300
+
+linux (5.0.0-13.14) disco; urgency=medium
+
+  * linux: 5.0.0-13.14 -proposed tracker (LP: #1824819)
+
+  * Display only has 640x480 (LP: #1824677)
+    - Revert "UBUNTU: SAUCE: drm/nouveau: Disable nouveau driver by default"
+
+  * shiftfs: use after free when checking mount options (LP: #1824735)
+    - SAUCE: shiftfs: prevent use-after-free when verifying mount options
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 15 Apr 2019 09:11:23 -0500
+
+linux (5.0.0-12.13) disco; urgency=medium
+
+  * linux: 5.0.0-12.13 -proposed tracker (LP: #1824726)
+
+  * Linux 5.0 black screen on boot, display flickers (i915 regression with
+    certain laptop panels) (LP: #1824216)
+    - drm/i915/dp: revert back to max link rate and lane count on eDP
+
+  * kernel BUG at fs/attr.c:287 when using shiftfs (LP: #1824717)
+    - SAUCE: shiftfs: fix passing of attrs to underaly for setattr
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 14 Apr 2019 13:38:05 -0500
+
+linux (5.0.0-11.12) disco; urgency=medium
+
+  * linux: 5.0.0-11.12 -proposed tracker (LP: #1824383)
+
+  * hns3: PPU_PF_ABNORMAL_INT_ST over_8bd_no_fe found [error status=0x1]
+    (LP: #1824194)
+    - net: hns3: fix for not calculating tx bd num correctly
+
+  * disco: unable to use iptables/enable ufw under -virtual kernel
+    (LP: #1823862)
+    - [Packaging] add bpfilter to linux-modules
+
+  * Make shiftfs a module rather than built-in (LP: #1824354)
+    - [Config] CONFIG_SHIFT_FS=m
+
+  * shiftfs: chown sets untranslated ids in lower fs (LP: #1824350)
+    - SAUCE: shiftfs: use translated ids when chaning lower fs attrs
+
+  * [Hyper-V] KVP daemon fails to start on first boot of disco VM (LP: #1820063)
+    - [Packaging] bind hv_kvp_daemon startup to hv_kvp device
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 11 Apr 2019 10:17:19 -0500
+
+linux (5.0.0-10.11) disco; urgency=medium
+
+  * linux: 5.0.0-10.11 -proposed tracker (LP: #1823936)
+
+  * Apparmor enforcement failure in lxc selftests (LP: #1823379)
+    - SAUCE: apparmor: Restore Y/N in /sys for apparmor's "enabled"
+
+  * systemd cause kernel trace "BUG: unable to handle kernel paging request at
+    6db23a14" on Cosmic i386 (LP: #1813244)
+    - openvswitch: fix flow actions reallocation
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 09 Apr 2019 08:30:38 -0500
+
+linux (5.0.0-9.10) disco; urgency=medium
+
+  * linux: 5.0.0-9.10 -proposed tracker (LP: #1823228)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] resync git-ubuntu-log
+    - [Packaging] update helper scripts
+    - [Packaging] resync retpoline extraction
+
+  * Huawei Hi1822 NIC has poor performance (LP: #1820187)
+    - net-next/hinic: replace disable_irq_nosync/enable_irq
+
+  * Add uid shifting overlay filesystem (shiftfs) (LP: #1823186)
+    - shiftfs: uid/gid shifting bind mount
+    - shiftfs: rework and extend
+    - shiftfs: support some btrfs ioctls
+    - [Config] enable shiftfs
+
+  * Cannot boot or install - have to use nomodeset (LP: #1821820)
+    - Revert "drm/i915/fbdev: Actually configure untiled displays"
+
+  * Disco update: v5.0.6 upstream stable release (LP: #1823060)
+    - netfilter: nf_tables: fix set double-free in abort path
+    - dccp: do not use ipv6 header for ipv4 flow
+    - genetlink: Fix a memory leak on error path
+    - gtp: change NET_UDP_TUNNEL dependency to select
+    - ipv6: make ip6_create_rt_rcu return ip6_null_entry instead of NULL
+    - mac8390: Fix mmio access size probe
+    - mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
+    - net: aquantia: fix rx checksum offload for UDP/TCP over IPv6
+    - net: datagram: fix unbounded loop in __skb_try_recv_datagram()
+    - net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec
+    - net: phy: meson-gxl: fix interrupt support
+    - net: rose: fix a possible stack overflow
+    - net: stmmac: fix memory corruption with large MTUs
+    - net-sysfs: call dev_hold if kobject_init_and_add success
+    - net: usb: aqc111: Extend HWID table by QNAP device
+    - packets: Always register packet sk in the same order
+    - rhashtable: Still do rehash when we get EEXIST
+    - sctp: get sctphdr by offset in sctp_compute_cksum
+    - sctp: use memdup_user instead of vmemdup_user
+    - tcp: do not use ipv6 header for ipv4 flow
+    - tipc: allow service ranges to be connect()'ed on RDM/DGRAM
+    - tipc: change to check tipc_own_id to return in tipc_net_stop
+    - tipc: fix cancellation of topology subscriptions
+    - tun: properly test for IFF_UP
+    - vrf: prevent adding upper devices
+    - vxlan: Don't call gro_cells_destroy() before device is unregistered
+    - thunderx: enable page recycling for non-XDP case
+    - thunderx: eliminate extra calls to put_page() for pages held for recycling
+    - net: dsa: mv88e6xxx: fix few issues in mv88e6390x_port_set_cmode
+    - net: mii: Fix PAUSE cap advertisement from linkmode_adv_to_lcl_adv_t()
+      helper
+    - net: phy: don't clear BMCR in genphy_soft_reset
+    - r8169: fix cable re-plugging issue
+    - ila: Fix rhashtable walker list corruption
+    - tun: add a missing rcu_read_unlock() in error path
+    - powerpc/fsl: Fix the flush of branch predictor.
+    - Btrfs: fix incorrect file size after shrinking truncate and fsync
+    - btrfs: remove WARN_ON in log_dir_items
+    - btrfs: don't report readahead errors and don't update statistics
+    - btrfs: Fix bound checking in qgroup_trace_new_subtree_blocks
+    - btrfs: Avoid possible qgroup_rsv_size overflow in
+      btrfs_calculate_inode_block_rsv_size
+    - Btrfs: fix assertion failure on fsync with NO_HOLES enabled
+    - locks: wake any locks blocked on request before deadlock check
+    - tracing: initialize variable in create_dyn_event()
+    - ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time
+    - powerpc: bpf: Fix generation of load/store DW instructions
+    - vfio: ccw: only free cp on final interrupt
+    - NFS: Fix nfs4_lock_state refcounting in nfs4_alloc_{lock,unlock}data()
+    - NFS: fix mount/umount race in nlmclnt.
+    - NFSv4.1 don't free interrupted slot on open
+    - net: dsa: qca8k: remove leftover phy accessors
+    - ALSA: rawmidi: Fix potential Spectre v1 vulnerability
+    - ALSA: seq: oss: Fix Spectre v1 vulnerability
+    - ALSA: pcm: Fix possible OOB access in PCM oss plugins
+    - ALSA: pcm: Don't suspend stream in unrecoverable PCM state
+    - ALSA: hda/realtek - Fixed Headset Mic JD not stable
+    - ALSA: hda/realtek: merge alc_fixup_headset_jack to alc295_fixup_chromebook
+    - ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO
+    - ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB
+    - ALSA: hda/realtek: Enable headset MIC of Acer AIO with ALC286
+    - ALSA: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286
+    - ALSA: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic
+    - ALSA: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256
+    - ALSA: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256
+    - ALSA: hda/realtek: Enable headset MIC of ASUS X430UN and X512DK with ALC256
+    - ALSA: hda/realtek - Fix speakers on Acer Predator Helios 500 Ryzen laptops
+    - kbuild: modversions: Fix relative CRC byte order interpretation
+    - fs/open.c: allow opening only regular files during execve()
+    - ocfs2: fix inode bh swapping mixup in ocfs2_reflink_inodes_lock
+    - scsi: sd: Fix a race between closing an sd device and sd I/O
+    - scsi: sd: Quiesce warning if device does not report optimal I/O size
+    - scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host
+    - scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP
+      devices
+    - drm/rockchip: vop: reset scale mode when win is disabled
+    - tty/serial: atmel: Add is_half_duplex helper
+    - tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
+    - tty: mxs-auart: fix a potential NULL pointer dereference
+    - tty: atmel_serial: fix a potential NULL pointer dereference
+    - tty: serial: qcom_geni_serial: Initialize baud in qcom_geni_console_setup
+    - staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest
+    - staging: olpc_dcon_xo_1: add missing 'const' qualifier
+    - staging: speakup_soft: Fix alternate speech with other synths
+    - staging: vt6655: Remove vif check from vnt_interrupt
+    - staging: vt6655: Fix interrupt race condition on device start up.
+    - staging: erofs: fix to handle error path of erofs_vmap()
+    - staging: erofs: fix error handling when failed to read compresssed data
+    - staging: erofs: keep corrupted fs from crashing kernel in erofs_readdir()
+    - serial: max310x: Fix to avoid potential NULL pointer dereference
+    - serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference
+    - serial: sh-sci: Fix setting SCSCR_TIE while transferring data
+    - USB: serial: cp210x: add new device id
+    - USB: serial: ftdi_sio: add additional NovaTech products
+    - USB: serial: mos7720: fix mos_parport refcount imbalance on error path
+    - USB: serial: option: set driver_info for SIM5218 and compatibles
+    - USB: serial: option: add support for Quectel EM12
+    - USB: serial: option: add Olicard 600
+    - ACPI / CPPC: Fix guaranteed performance handling
+    - Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc
+    - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
+    - drivers/block/zram/zram_drv.c: fix idle/writeback string compare
+    - blk-mq: fix sbitmap ws_active for shared tags
+    - cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency
+    - cpufreq: scpi: Fix use after free
+    - drm/vgem: fix use-after-free when drm_gem_handle_create() fails
+    - drm/vkms: fix use-after-free when drm_gem_handle_create() fails
+    - drm/i915: Mark AML 0x87CA as ULX
+    - drm/i915/gvt: Fix MI_FLUSH_DW parsing with correct index check
+    - drm/i915/icl: Fix the TRANS_DDI_FUNC_CTL2 bitfield macro
+    - gpio: exar: add a check for the return value of ida_simple_get fails
+    - gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
+    - phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs
+    - usb: mtu3: fix EXTCON dependency
+    - USB: gadget: f_hid: fix deadlock in f_hidg_write()
+    - usb: common: Consider only available nodes for dr_mode
+    - mm/memory.c: fix modifying of page protection by insert_pfn()
+    - usb: host: xhci-rcar: Add XHCI_TRUST_TX_LENGTH quirk
+    - xhci: Fix port resume done detection for SS ports with LPM enabled
+    - usb: xhci: dbc: Don't free all memory with spinlock held
+    - xhci: Don't let USB3 ports stuck in polling state prevent suspend
+    - usb: cdc-acm: fix race during wakeup blocking TX traffic
+    - usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 source-caps
+    - usb: typec: Fix unchecked return value
+    - mm/hotplug: fix offline undo_isolate_page_range()
+    - mm: add support for kmem caches in DMA32 zone
+    - iommu/io-pgtable-arm-v7s: request DMA32 memory, and improve debugging
+    - mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
+    - mm/debug.c: fix __dump_page when mapping->host is not set
+    - mm/memory_hotplug.c: fix notification in offline error path
+    - mm/page_isolation.c: fix a wrong flag in set_migratetype_isolate()
+    - mm/migrate.c: add missing flush_dcache_page for non-mapped page migrate
+    - perf pmu: Fix parser error for uncore event alias
+    - perf intel-pt: Fix TSC slip
+    - objtool: Query pkg-config for libelf location
+    - powerpc/pseries/energy: Use OF accessor functions to read ibm,drc-indexes
+    - powerpc/64: Fix memcmp reading past the end of src/dest
+    - powerpc/pseries/mce: Fix misleading print for TLB mutlihit
+    - watchdog: Respect watchdog cpumask on CPU hotplug
+    - cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n
+    - x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y
+    - KVM: Reject device ioctls from processes other than the VM's creator
+    - KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts
+    - KVM: x86: update %rip after emulating IO
+    - bpf: do not restore dst_reg when cur_state is freed
+    - mt76x02u: use usb_bulk_msg to upload firmware
+    - Linux 5.0.6
+
+  * RDMA/hns updates for disco (LP: #1822897)
+    - RDMA/hns: Fix the bug with updating rq head pointer when flush cqe
+    - RDMA/hns: Bugfix for the scene without receiver queue
+    - RDMA/hns: Add constraint on the setting of local ACK timeout
+    - RDMA/hns: Modify the pbl ba page size for hip08
+    - RDMA/hns: RDMA/hns: Assign rq head pointer when enable rq record db
+    - RDMA/hns: Add the process of AEQ overflow for hip08
+    - RDMA/hns: Add SCC context allocation support for hip08
+    - RDMA/hns: Add SCC context clr support for hip08
+    - RDMA/hns: Add timer allocation support for hip08
+    - RDMA/hns: Remove set but not used variable 'rst'
+    - RDMA/hns: Make some function static
+    - RDMA/hns: Fix the Oops during rmmod or insmod ko when reset occurs
+    - RDMA/hns: Fix the chip hanging caused by sending mailbox&CMQ during reset
+    - RDMA/hns: Fix the chip hanging caused by sending doorbell during reset
+    - RDMA/hns: Limit minimum ROCE CQ depth to 64
+    - RDMA/hns: Fix the state of rereg mr
+    - RDMA/hns: Set allocated memory to zero for wrid
+    - RDMA/hns: Delete useful prints for aeq subtype event
+    - RDMA/hns: Configure capacity of hns device
+    - RDMA/hns: Modify qp&cq&pd specification according to UM
+    - RDMA/hns: Bugfix for set hem of SCC
+    - RDMA/hns: Use GFP_ATOMIC in hns_roce_v2_modify_qp
+
+  * autopkgtests run too often, too much and don't skip enough (LP: #1823056)
+    - Set +x on rebuild testcase.
+    - Skip rebuild test, for regression-suite deps.
+    - Make ubuntu-regression-suite skippable on unbootable kernels.
+    - make rebuild use skippable error codes when skipping.
+    - Only run regression-suite, if requested to.
+
+  * touchpad not working on lenovo yoga 530 (LP: #1787775)
+    - Revert "UBUNTU: SAUCE: i2c:amd Depends on ACPI"
+    - Revert "UBUNTU: SAUCE: i2c:amd move out pointer in union i2c_event_base"
+    - i2c: add extra check to safe DMA buffer helper
+    - i2c: Add drivers for the AMD PCIe MP2 I2C controller
+    - [Config] Update config for AMD MP2 I2C driver
+
+  * Detect SMP PHY control command errors (LP: #1822680)
+    - scsi: libsas: Check SMP PHY control function result
+
+  * disable a.out support (LP: #1818552)
+    - [Config] Disable a.out support
+    - [Config] remove binfmt_aout from abi for i386 lowlatency
+
+  * bionic: fork out linux-snapdragon into its own topic kernel (LP: #1820868)
+    - [Packaging] remove snapdragon flavour support
+    - Revert "UBUNTU: SAUCE: (snapdragon) drm/msm/adv7511: wrap hacks under
+      CONFIG_ADV7511_SNAPDRAGON_HACKS #ifdefs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) media: ov5645: skip address change if dt
+      addr == default addr"
+    - Revert "UBUNTU: SAUCE: (snapdragon) DT: leds: Add Qualcomm Light Pulse
+      Generator binding"
+    - Revert "UBUNTU: SAUCE: (snapdragon) MAINTAINERS: Add Qualcomm Camera Control
+      Interface driver"
+    - Revert "UBUNTU: SAUCE: (snapdragon) dt-bindings: media: Binding document for
+      Qualcomm Camera Control Interface driver"
+    - Revert "UBUNTU: SAUCE: (snapdragon) leds: Add driver for Qualcomm LPG"
+    - Revert "UBUNTU: SAUCE: (snapdragon) HACK: drm/msm/adv7511: Don't rely on
+      interrupts for EDID parsing"
+    - Revert "UBUNTU: SAUCE: (snapdragon) drm/bridge/adv7511: Delay clearing of
+      HPD interrupt status"
+    - Revert "UBUNTU: SAUCE: (snapdragon) media: ov5645: Fix I2C address"
+    - Revert "UBUNTU: SAUCE: (snapdragon) i2c-qcom-cci: Fix I2C address bug"
+    - Revert "UBUNTU: SAUCE: (snapdragon) i2c-qcom-cci: Fix run queue completion
+      timeout"
+    - Revert "UBUNTU: SAUCE: (snapdragon) camss: Do not register if no cameras are
+      present"
+    - Revert "UBUNTU: SAUCE: (snapdragon) i2c: Add Qualcomm Camera Control
+      Interface driver"
+    - Revert "UBUNTU: SAUCE: (snapdragon) ov5645: I2C address change"
+    - Revert "UBUNTU: SAUCE: (snapdragon) regulator: smd: Allow
+      REGULATOR_QCOM_SMD_RPM=m"
+    - Revert "UBUNTU: SAUCE: (snapdragon) cpufreq: Add apq8016 to cpufreq-dt-
+      platdev blacklist"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: Add a helper to get an opp
+      regulator for device"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: HACK: Allow to set regulator
+      without opp_list"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: Drop RCU usage in
+      dev_pm_opp_adjust_voltage()"
+    - Revert "UBUNTU: SAUCE: (snapdragon) PM / OPP: Support adjusting OPP voltages
+      at runtime"
+    - Revert "UBUNTU: SAUCE: (snapdragon) regulator: smd: Add floor and corner
+      operations"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: cpr: Register with cpufreq-
+      dt"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: cpr: fix with new
+      reg_sequence structures"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: cpr: Use raw mem access for
+      qfprom"
+    - Revert "UBUNTU: SAUCE: (snapdragon) power: avs: Add support for CPR (Core
+      Power Reduction)"
+    - Revert "UBUNTU: SAUCE: (snapdragon) HACK: drm/msm/iommu: Remove runtime_put
+      calls in map/unmap"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable LEDS_QCOM_LPG"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable 'BBR' TCP
+      congestion algorithm"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable 'fq' and
+      'fq_codel' qdiscs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable
+      'schedutil' CPUfreq governor"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: set USB_CONFIG_F_FS in
+      distro.config"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable
+      CONFIG_USB_CONFIGFS_F_FS by default"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: add freq stat to sysfs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: Enable camera drivers"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: disable ANALOG_TV and
+      DIGITAL_TV"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: add more USB net
+      drivers"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: enable BT_QCOMSMD"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable
+      CFG80211_DEFAULT_PS by default"
+    - Revert "UBUNTU: SAUCE: (snapdragon) Force the SMD regulator driver to be
+      compiled-in"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs: enable dm_mod and
+      dm_crypt"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: Enable a53/apcs and
+      avs"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: enable QCOM Venus"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: distro.config: enable debug
+      friendly USB network adpater"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: configs: enable WCN36xx"
+    - Revert "UBUNTU: SAUCE: (snapdragon) kernel: configs; add distro.config"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable QCOM audio
+      drivers for APQ8016 and DB410c"
+    - Revert "UBUNTU: SAUCE: (snapdragon) arm64: defconfig: enable REMOTEPROC"
+    - [Config] fix abi for remove i2c-qcom-cci module
+    - [Config] update annotations
+    - [Config] update configs following snapdragon removal
+
+  * Disco update: v5.0.5 upstream stable release (LP: #1822671)
+    - Revert "ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec"
+    - ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist
+    - ALSA: firewire-motu: use 'version' field of unit directory to identify model
+    - mmc: pxamci: fix enum type confusion
+    - mmc: alcor: fix DMA reads
+    - mmc: mxcmmc: "Revert mmc: mxcmmc: handle highmem pages"
+    - mmc: renesas_sdhi: limit block count to 16 bit for old revisions
+    - drm/amdgpu: fix invalid use of change_bit
+    - drm/vmwgfx: Don't double-free the mode stored in par->set_mode
+    - drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's
+    - iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
+    - iommu/iova: Fix tracking of recently failed iova address
+    - libceph: wait for latest osdmap in ceph_monc_blacklist_add()
+    - udf: Fix crash on IO error during truncate
+    - mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction.
+    - MIPS: Ensure ELF appended dtb is relocated
+    - MIPS: Fix kernel crash for R6 in jump label branch function
+    - powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038
+    - powerpc/security: Fix spectre_v2 reporting
+    - net/mlx5: Fix DCT creation bad flow
+    - scsi: core: Avoid that a kernel warning appears during system resume
+    - scsi: qla2xxx: Fix FC-AL connection target discovery
+    - scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton
+    - scsi: ibmvscsi: Fix empty event pool access during host removal
+    - futex: Ensure that futex address is aligned in handle_futex_death()
+    - perf probe: Fix getting the kernel map
+    - objtool: Move objtool_file struct off the stack
+    - irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp
+    - clocksource/drivers/riscv: Fix clocksource mask
+    - ALSA: ac97: Fix of-node refcount unbalance
+    - ext4: fix NULL pointer dereference while journal is aborted
+    - ext4: fix data corruption caused by unaligned direct AIO
+    - ext4: brelse all indirect buffer in ext4_ind_remove_space()
+    - media: v4l2-ctrls.c/uvc: zero v4l2_event
+    - Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf()
+    - Bluetooth: Fix decrementing reference count twice in releasing socket
+    - Bluetooth: hci_ldisc: Initialize hci_dev before open()
+    - Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in
+      hci_uart_set_proto()
+    - drm/vkms: Fix flush_work() without INIT_WORK().
+    - RDMA/cma: Rollback source IP address if failing to acquire device
+    - f2fs: fix to avoid deadlock of atomic file operations
+    - aio: simplify - and fix - fget/fput for io_submit()
+    - netfilter: ebtables: remove BUGPRINT messages
+    - loop: access lo_backing_file only when the loop device is Lo_bound
+    - x86/unwind: Handle NULL pointer calls better in frame unwinder
+    - x86/unwind: Add hardcoded ORC entry for NULL
+    - locking/lockdep: Add debug_locks check in __lock_downgrade()
+    - ALSA: hda - Record the current power state before suspend/resume calls
+    - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec
+    - Linux 5.0.5
+
+  * hisi_sas updates for disco (LP: #1822385)
+    - scsi: hisi_sas: send primitive NOTIFY to SSP situation only
+    - scsi: hisi_sas: shutdown axi bus to avoid exception CQ returned
+    - scsi: hisi_sas: remove the check of sas_dev status in
+      hisi_sas_I_T_nexus_reset()
+    - scsi: hisi_sas: Remove unused parameter of function hisi_sas_alloc()
+    - scsi: hisi_sas: Reject setting programmed minimum linkrate > 1.5G
+    - scsi: hisi_sas: Fix losing directly attached disk when hot-plug
+    - scsi: hisi_sas: Correct memory allocation size for DQ debugfs
+    - scsi: hisi_sas: Some misc tidy-up
+    - scsi: hisi_sas: Fix to only call scsi_get_prot_op() for non-NULL scsi_cmnd
+    - scsi: hisi_sas: Add missing seq_printf() call in hisi_sas_show_row_32()
+    - scsi: hisi_sas: Add support for DIX feature for v3 hw
+    - scsi: hisi_sas: Add manual trigger for debugfs dump
+    - scsi: hisi_sas: change queue depth from 512 to 4096
+    - scsi: hisi_sas: Issue internal abort on all relevant queues
+    - scsi: hisi_sas: Use pci_irq_get_affinity() for v3 hw as experimental
+    - scsi: hisi_sas: Do some more tidy-up
+    - scsi: hisi_sas: Change return variable type in phy_up_v3_hw()
+    - scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO
+    - scsi: hisi_sas: print PHY RX errors count for later revision of v3 hw
+    - scsi: hisi_sas: Set PHY linkrate when disconnected
+    - scsi: hisi_sas: Send HARD RESET to clear the previous affiliation of STP
+      target port
+    - scsi: hisi_sas: Change SERDES_CFG init value to increase reliability of
+      HiLink
+    - scsi: hisi_sas: Add softreset in hisi_sas_I_T_nexus_reset()
+
+  * [Patch][Raven 2] kernel 5.0.0 cannot boot because of psp response
+    (LP: #1822267)
+    - drm/amdgpu/psp: Fix can't detect psp INVOKE command failed
+    - drm/amdgpu/psp: ignore psp response status
+
+  * 3b080b2564287be91605bfd1d5ee985696e61d3c in ubuntu_btrfs_kernel_fixes
+    triggers system hang on i386 (LP: #1812845)
+    - btrfs: raid56: properly unmap parity page in finish_parity_scrub()
+
+  * enable CONFIG_DRM_BOCHS (LP: #1795857)
+    - [Config] Reenable DRM_BOCHS as module
+
+  * [Dell Precision 7530/5530 with Nvidia Quadro P1000] Live USB freezes or
+    cannot complete install when nouveau driver is loaded (crashing in GP100
+    code) (LP: #1822026)
+    - SAUCE: drm/nouveau: Disable nouveau driver by default
+
+  * Need to add Intel CML related pci-id's (LP: #1821863)
+    - drm/i915/cml: Add CML PCI IDS
+    - drm/i915/cml: Introduce Comet Lake PCH
+
+  * ARM: Add support for the SDEI interface (LP: #1822005)
+    - ACPI / APEI: Don't wait to serialise with oops messages when panic()ing
+    - ACPI / APEI: Remove silent flag from ghes_read_estatus()
+    - ACPI / APEI: Switch estatus pool to use vmalloc memory
+    - ACPI / APEI: Make hest.c manage the estatus memory pool
+    - ACPI / APEI: Make estatus pool allocation a static size
+    - ACPI / APEI: Don't store CPER records physical address in struct ghes
+    - ACPI / APEI: Remove spurious GHES_TO_CLEAR check
+    - ACPI / APEI: Don't update struct ghes' flags in read/clear estatus
+    - ACPI / APEI: Generalise the estatus queue's notify code
+    - ACPI / APEI: Don't allow ghes_ack_error() to mask earlier errors
+    - ACPI / APEI: Move NOTIFY_SEA between the estatus-queue and NOTIFY_NMI
+    - ACPI / APEI: Switch NOTIFY_SEA to use the estatus queue
+    - KVM: arm/arm64: Add kvm_ras.h to collect kvm specific RAS plumbing
+    - arm64: KVM/mm: Move SEA handling behind a single 'claim' interface
+    - ACPI / APEI: Move locking to the notification helper
+    - ACPI / APEI: Let the notification helper specify the fixmap slot
+    - ACPI / APEI: Pass ghes and estatus separately to avoid a later copy
+    - ACPI / APEI: Make GHES estatus header validation more user friendly
+    - ACPI / APEI: Split ghes_read_estatus() to allow a peek at the CPER length
+    - ACPI / APEI: Only use queued estatus entry during in_nmi_queue_one_entry()
+    - ACPI / APEI: Use separate fixmap pages for arm64 NMI-like notifications
+    - firmware: arm_sdei: Add ACPI GHES registration helper
+    - ACPI / APEI: Add support for the SDEI GHES Notification type
+
+  * CVE-2019-9857
+    - inotify: Fix fsnotify_mark refcount leak in inotify_update_existing_watch()
+
+  * scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+    discovery (LP: #1821408)
+    - scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+      discovery
+
+  * Qualcomm Atheros QCA9377 wireless does not work (LP: #1818204)
+    - platform/x86: ideapad-laptop: Add Ideapad 530S-14ARR to no_hw_rfkill list
+
+  * Lenovo ideapad 330-15ICH Wifi rfkill hard blocked (LP: #1811815)
+    - platform/x86: ideapad: Add ideapad 330-15ICH to no_hw_rfkill
+
+  * hid-sensor-hub spamming dmesg in 4.20 (LP: #1818547)
+    - HID: Increase maximum report size allowed by hid_field_extract()
+
+  * [disco] [5.0.0-7.8] can't mount guest cifs share (LP: #1821053)
+    - cifs: allow guest mounts to work for smb3.11
+    - SMB3: Fix SMB3.1.1 guest mounts to Samba
+
+  * Add HiSilicon SoC quirk for cpufreq (LP: #1821620)
+    - ACPI / CPPC: Add a helper to get desired performance
+    - cpufreq / cppc: Work around for Hisilicon CPPC cpufreq
+
+  * Disco update: v5.0.4 upstream stable release (LP: #1821607)
+    - 9p: use inode->i_lock to protect i_size_write() under 32-bit
+    - 9p/net: fix memory leak in p9_client_create
+    - ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
+    - ASoC: codecs: pcm186x: fix wrong usage of DECLARE_TLV_DB_SCALE()
+    - ASoC: codecs: pcm186x: Fix energysense SLEEP bit
+    - iio: adc: exynos-adc: Fix NULL pointer exception on unbind
+    - iio: adc: exynos-adc: Use proper number of channels for Exynos4x12
+    - mei: hbm: clean the feature flags on link reset
+    - mei: bus: move hw module get/put to probe/release
+    - stm class: Prevent division by zero
+    - stm class: Fix an endless loop in channel allocation
+    - crypto: caam - fix hash context DMA unmap size
+    - crypto: ccree - fix missing break in switch statement
+    - crypto: caam - fixed handling of sg list
+    - crypto: caam - fix DMA mapping of stack memory
+    - crypto: ccree - fix free of unallocated mlli buffer
+    - crypto: ccree - unmap buffer before copying IV
+    - crypto: ccree - don't copy zero size ciphertext
+    - crypto: cfb - add missing 'chunksize' property
+    - crypto: cfb - remove bogus memcpy() with src == dest
+    - crypto: ofb - fix handling partial blocks and make thread-safe
+    - crypto: ahash - fix another early termination in hash walk
+    - crypto: rockchip - fix scatterlist nents error
+    - crypto: rockchip - update new iv to device in multiple operations
+    - dax: Flush partial PMDs correctly
+    - nfit: Fix nfit_intel_shutdown_status() command submission
+    - nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
+    - acpi/nfit: Fix bus command validation
+    - nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot
+    - nfit/ars: Attempt short-ARS even in the no_init_ars case
+    - libnvdimm/label: Clear 'updating' flag after label-set update
+    - libnvdimm, pfn: Fix over-trim in trim_pfn_device()
+    - libnvdimm/pmem: Honor force_raw for legacy pmem regions
+    - libnvdimm: Fix altmap reservation size calculation
+    - fix cgroup_do_mount() handling of failure exits
+    - crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
+    - crypto: aegis - fix handling chunked inputs
+    - crypto: arm/crct10dif - revert to C code for short inputs
+    - crypto: arm64/aes-neonbs - fix returning final keystream block
+    - crypto: arm64/crct10dif - revert to C code for short inputs
+    - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
+    - crypto: morus - fix handling chunked inputs
+    - crypto: pcbc - remove bogus memcpy()s with src == dest
+    - crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
+    - crypto: testmgr - skip crc32c context test for ahash algorithms
+    - crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP
+    - crypto: x86/aesni-gcm - fix crash on empty plaintext
+    - crypto: x86/morus - fix handling chunked inputs and MAY_SLEEP
+    - crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
+    - crypto: arm64/aes-ccm - fix bugs in non-NEON fallback routine
+    - CIFS: Fix leaking locked VFS cache pages in writeback retry
+    - CIFS: Do not reset lease state to NONE on lease break
+    - CIFS: Do not skip SMB2 message IDs on send failures
+    - CIFS: Fix read after write for files with read caching
+    - smb3: make default i/o size for smb3 mounts larger
+    - tracing: Use strncpy instead of memcpy for string keys in hist triggers
+    - tracing: Do not free iter->trace in fail path of tracing_open_pipe()
+    - tracing/perf: Use strndup_user() instead of buggy open-coded version
+    - vmw_balloon: release lock on error in vmballoon_reset()
+    - xen: fix dom0 boot on huge systems
+    - ACPI / device_sysfs: Avoid OF modalias creation for removed device
+    - mmc: sdhci-esdhc-imx: fix HS400 timing issue
+    - mmc: renesas_sdhi: Fix card initialization failure in high speed mode
+    - mmc:fix a bug when max_discard is 0
+    - spi: ti-qspi: Fix mmap read when more than one CS in use
+    - spi: pxa2xx: Setup maximum supported DMA transfer length
+    - spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
+    - spi: spi-gpio: fix SPI_CS_HIGH capability
+    - regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
+    - regulator: max77620: Initialize values for DT properties
+    - regulator: s2mpa01: Fix step values for some LDOs
+    - mt76: fix corrupted software generated tx CCMP PN
+    - clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
+    - clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
+    - clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer
+      instability
+    - s390: vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem
+    - s390/setup: fix early warning messages
+    - s390/virtio: handle find on invalid queue gracefully
+    - scsi: virtio_scsi: don't send sc payload with tmfs
+    - scsi: aacraid: Fix performance issue on logical drives
+    - scsi: sd: Optimal I/O size should be a multiple of physical block size
+    - scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
+    - scsi: qla2xxx: Fix LUN discovery if loop id is not assigned yet by firmware
+    - scsi: qla2xxx: Avoid PCI IRQ affinity mapping when multiqueue is not
+      supported
+    - scsi: qla2xxx: Use complete switch scan for RSCN events
+    - fs/devpts: always delete dcache dentry-s in dput()
+    - splice: don't merge into linked buffers
+    - ovl: During copy up, first copy up data and then xattrs
+    - ovl: Do not lose security.capability xattr over metadata file copy-up
+    - m68k: Add -ffreestanding to CFLAGS
+    - Btrfs: setup a nofs context for memory allocation at btrfs_create_tree()
+    - Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl
+    - btrfs: scrub: fix circular locking dependency warning
+    - btrfs: drop the lock on error in btrfs_dev_replace_cancel
+    - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
+    - btrfs: init csum_list before possible free
+    - Btrfs: fix corruption reading shared and compressed extents after hole
+      punching
+    - Btrfs: fix deadlock between clone/dedupe and rename
+    - soc: qcom: rpmh: Avoid accessing freed memory from batch API
+    - libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer
+    - irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table
+    - irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code
+    - x86/kprobes: Prohibit probing on optprobe template code
+    - cpufreq: kryo: Release OPP tables on module removal
+    - cpufreq: tegra124: add missing of_node_put()
+    - cpufreq: pxa2xx: remove incorrect __init annotation
+    - ext4: fix check of inode in swap_inode_boot_loader
+    - ext4: cleanup pagecache before swap i_data
+    - mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
+    - mm/vmalloc: fix size check for remap_vmalloc_range_partial()
+    - mm/memory.c: do_fault: avoid usage of stale vm_area_struct
+    - kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
+    - nvmem: core: don't check the return value of notifier chain call
+    - device property: Fix the length used in PROPERTY_ENTRY_STRING()
+    - intel_th: Don't reference unassigned outputs
+    - parport_pc: fix find_superio io compare code, should use equal test.
+    - i2c: tegra: fix maximum transfer size
+    - i2c: tegra: update maximum transfer size
+    - media: i2c: ov5640: Fix post-reset delay
+    - gpio: pca953x: Fix dereference of irq data in shutdown
+    - ext4: update quota information while swapping boot loader inode
+    - ext4: add mask of ext4 flags to swap
+    - ext4: fix crash during online resizing
+    - dma: Introduce dma_max_mapping_size()
+    - swiotlb: Introduce swiotlb_max_mapping_size()
+    - swiotlb: Add is_swiotlb_active() function
+    - PCI/ASPM: Use LTR if already enabled by platform
+    - PCI/DPC: Fix print AER status in DPC event handling
+    - PCI: qcom: Don't deassert reset GPIO during probe
+    - PCI: dwc: skip MSI init if MSIs have been explicitly disabled
+    - PCI: pci-bridge-emul: Create per-bridge copy of register behavior
+    - PCI: pci-bridge-emul: Extend pci_bridge_emul_init() with flags
+    - IB/hfi1: Close race condition on user context disable and close
+    - IB/rdmavt: Fix loopback send with invalidate ordering
+    - IB/rdmavt: Fix concurrency panics in QP post_send and modify to error
+    - cxl: Wrap iterations over afu slices inside 'afu_list_lock'
+    - ext2: Fix underflow in ext2_max_size()
+    - clk: uniphier: Fix update register for CPU-gear
+    - clk: clk-twl6040: Fix imprecise external abort for pdmclk
+    - clk: samsung: exynos5: Fix possible NULL pointer exception on
+      platform_device_alloc() failure
+    - clk: samsung: exynos5: Fix kfree() of const memory on setting
+      driver_override
+    - clk: ingenic: Fix round_rate misbehaving with non-integer dividers
+    - clk: ingenic: Fix doc of ingenic_cgu_div_info
+    - usb: chipidea: tegra: Fix missed ci_hdrc_remove_device()
+    - usb: typec: tps6598x: handle block writes separately with plain-I2C adapters
+    - dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
+    - serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO
+    - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
+    - serial: 8250_pci: Fix number of ports for ACCES serial cards
+    - serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954
+      chip use the pci_pericom_setup()
+    - jbd2: clear dirty flag when revoking a buffer from an older transaction
+    - jbd2: fix compile warning when using JBUFFER_TRACE
+    - selinux: add the missing walk_size + len check in selinux_sctp_bind_connect
+    - security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock
+    - powerpc/32: Clear on-stack exception marker upon exception return
+    - powerpc/wii: properly disable use of BATs when requested.
+    - powerpc/powernv: Make opal log only readable by root
+    - powerpc/83xx: Also save/restore SPRG4-7 during suspend
+    - powerpc/kvm: Save and restore host AMR/IAMR/UAMOR
+    - powerpc/powernv: Don't reprogram SLW image on every KVM guest entry/exit
+    - powerpc/64s/hash: Fix assert_slb_presence() use of the slbfee. instruction
+    - powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
+    - powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
+    - powerpc/hugetlb: Don't do runtime allocation of 16G pages in LPAR
+      configuration
+    - powerpc/smp: Fix NMI IPI timeout
+    - powerpc/smp: Fix NMI IPI xmon timeout
+    - powerpc/traps: fix recoverability of machine check handling on book3s/32
+    - powerpc/traps: Fix the message printed when stack overflows
+    - ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
+    - arm64: Fix HCR.TGE status for NMI contexts
+    - arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
+    - arm64: debug: Ensure debug handlers check triggering exception level
+    - arm64: KVM: Fix architecturally invalid reset value for FPEXC32_EL2
+    - Revert "KVM/MMU: Flush tlb directly in the kvm_zap_gfn_range()"
+    - ipmi_si: Fix crash when using hard-coded device
+    - ipmi_si: fix use-after-free of resource->name
+    - dm: fix to_sector() for 32bit
+    - dm integrity: limit the rate of error messages
+    - media: cx25840: mark pad sig_types to fix cx231xx init
+    - mfd: sm501: Fix potential NULL pointer dereference
+    - cpcap-charger: generate events for userspace
+    - cpuidle: governor: Add new governors to cpuidle_governors again
+    - NFS: Fix I/O request leakages
+    - NFS: Fix an I/O request leakage in nfs_do_recoalesce
+    - NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
+    - nfsd: fix performance-limiting session calculation
+    - nfsd: fix memory corruption caused by readdir
+    - nfsd: fix wrong check in write_v4_end_grace()
+    - NFSv4.1: Reinitialise sequence results before retransmitting a request
+    - svcrpc: fix UDP on servers with lots of threads
+    - PM / wakeup: Rework wakeup source timer cancellation
+    - PM / OPP: Update performance state when freq == old_freq
+    - bcache: treat stale && dirty keys as bad keys
+    - bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata
+    - stable-kernel-rules.rst: add link to networking patch queue
+    - vt: perform safe console erase in the right order
+    - x86/unwind/orc: Fix ORC unwind table alignment
+    - perf intel-pt: Fix CYC timestamp calculation after OVF
+    - perf tools: Fix split_kallsyms_for_kcore() for trampoline symbols
+    - perf auxtrace: Define auxtrace record alignment
+    - perf intel-pt: Fix overlap calculation for padding
+    - perf/x86/intel/uncore: Fix client IMC events return huge result
+    - perf intel-pt: Fix divide by zero when TSC is not available
+    - md: Fix failed allocation of md_register_thread
+    - x86/kvmclock: set offset for kvm unstable clock
+    - x86/ftrace: Fix warning and considate ftrace_jmp_replace() and
+      ftrace_call_replace()
+    - tpm/tpm_crb: Avoid unaligned reads in crb_recv()
+    - tpm: Unify the send callback behaviour
+    - rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
+    - media: imx: prpencvf: Stop upstream before disabling IDMA channel
+    - media: lgdt330x: fix lock status reporting
+    - media: sun6i: Fix CSI regmap's max_register
+    - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
+    - media: vimc: Add vimc-streamer for stream control
+    - media: imx-csi: Input connections to CSI should be optional
+    - media: imx: csi: Disable CSI immediately after last EOF
+    - media: imx: csi: Stop upstream before disabling IDMA channel
+    - drm/fb-helper: generic: Fix drm_fbdev_client_restore()
+    - drm/radeon/evergreen_cs: fix missing break in switch statement
+    - drm/amd/powerplay: correct power reading on fiji
+    - drm/amd/display: don't call dm_pp_ function from an fpu block
+    - KVM: Call kvm_arch_memslots_updated() before updating memslots
+    - KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run
+    - KVM: VMX: Zero out *all* general purpose registers after VM-Exit
+    - KVM: x86/mmu: Detect MMIO generation wrap in any address space
+    - KVM: x86/mmu: Do not cache MMIO accesses while memslots are in flux
+    - KVM: nVMX: Sign extend displacements of VMX instr's mem operands
+    - KVM: nVMX: Apply addr size mask to effective address for VMX instructions
+    - KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
+    - KVM: nVMX: Check a single byte for VMCS "launched" in nested early checks
+    - net: dsa: lantiq_gswip: fix use-after-free on failed probe
+    - net: dsa: lantiq_gswip: fix OF child-node lookups
+    - s390/setup: fix boot crash for machine without EDAT-1
+    - SUNRPC: Prevent thundering herd when the socket is not connected
+    - SUNRPC: Fix up RPC back channel transmission
+    - SUNRPC: Respect RPC call timeouts when retrying transmission
+    - Linux 5.0.4
+    - [Config] update configs for 5.0.4 stable update
+
+  * New Intel Wireless-AC 9260 [8086:2526] card not correctly probed in Ubuntu
+    system (LP: #1821271)
+    - iwlwifi: add new card for 9260 series
+
+  * [CONFIG] please enable highdpi font FONT_TER16x32 (LP: #1819881)
+    - [Config]: enable highdpi Terminus 16x32 font support
+
+  * [SRU][B/B-OEM/C/D] Fix AMD IOMMU NULL dereference (LP: #1820990)
+    - iommu/amd: Fix NULL dereference bug in match_hid_uid
+
+  * some codecs stop working after S3 (LP: #1820930)
+    - ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec
+    - ALSA: hda - Don't trigger jackpoll_work in azx_resume
+
+  * tcm_loop.ko: move from modules-extra into main modules package
+    (LP: #1817786)
+    - [Packaging] move tcm_loop.lo to main linux-modules package
+
+  * C++ demangling support missing from perf (LP: #1396654)
+    - [Packaging] fix a mistype
+
+  * r8169 doesn't get woken up by ethernet cable plugging, no PME generated
+    (LP: #1817676)
+    - PCI: pciehp: Disable Data Link Layer State Changed event on suspend
+
+  * Disco update: v5.0.3 upstream stable release (LP: #1821074)
+    - connector: fix unsafe usage of ->real_parent
+    - fou, fou6: avoid uninit-value in gue_err() and gue6_err()
+    - gro_cells: make sure device is up in gro_cells_receive()
+    - ipv4/route: fail early when inet dev is missing
+    - l2tp: fix infoleak in l2tp_ip6_recvmsg()
+    - lan743x: Fix RX Kernel Panic
+    - lan743x: Fix TX Stall Issue
+    - net: hsr: fix memory leak in hsr_dev_finalize()
+    - net/hsr: fix possible crash in add_timer()
+    - net: sit: fix UBSAN Undefined behaviour in check_6rd
+    - net/x25: fix use-after-free in x25_device_event()
+    - net/x25: reset state in x25_connect()
+    - pptp: dst_release sk_dst_cache in pptp_sock_destruct
+    - ravb: Decrease TxFIFO depth of Q3 and Q2 to one
+    - route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
+    - rxrpc: Fix client call queueing, waiting for channel
+    - sctp: remove sched init from sctp_stream_init
+    - tcp: do not report TCP_CM_INQ of 0 for closed connections
+    - tcp: Don't access TCP_SKB_CB before initializing it
+    - tcp: handle inet_csk_reqsk_queue_add() failures
+    - vxlan: Fix GRO cells race condition between receive and link delete
+    - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
+    - net/mlx4_core: Fix reset flow when in command polling mode
+    - net/mlx4_core: Fix locking in SRIOV mode when switching between events and
+      polling
+    - net/mlx4_core: Fix qp mtt size calculation
+    - net: dsa: mv88e6xxx: Set correct interface mode for CPU/DSA ports
+    - vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock
+    - net: sched: flower: insert new filter to idr after setting its mask
+    - f2fs: wait on atomic writes to count F2FS_CP_WB_DATA
+    - perf/x86: Fixup typo in stub functions
+    - ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against
+      Liquid Saffire 56
+    - ALSA: firewire-motu: fix construction of PCM frame for capture direction
+    - ALSA: hda: Extend i915 component bind timeout
+    - ALSA: hda - add more quirks for HP Z2 G4 and HP Z240
+    - ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294
+    - ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone
+    - ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with
+      ALC255
+    - perf/x86/intel: Fix memory corruption
+    - perf/x86/intel: Make dev_attr_allow_tsx_force_abort static
+    - It's wrong to add len to sector_nr in raid10 reshape twice
+    - drm: Block fb changes for async plane updates
+    - Linux 5.0.3
+
+  * Disco update: v5.0.2 upstream stable release (LP: #1820318)
+    - media: uvcvideo: Fix 'type' check leading to overflow
+    - Input: wacom_serial4 - add support for Wacom ArtPad II tablet
+    - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
+    - iscsi_ibft: Fix missing break in switch statement
+    - scsi: aacraid: Fix missing break in switch statement
+    - x86/PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub
+    - arm64: dts: zcu100-revC: Give wifi some time after power-on
+    - arm64: dts: hikey: Give wifi some time after power-on
+    - arm64: dts: hikey: Revert "Enable HS200 mode on eMMC"
+    - ARM: dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3
+    - ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
+    - ARM: dts: exynos: Fix max voltage for buck8 regulator on Odroid XU3/XU4
+    - drm: disable uncached DMA optimization for ARM and arm64
+    - media: Revert "media: rc: some events are dropped by userspace"
+    - Revert "PCI/PME: Implement runtime PM callbacks"
+    - bpf: Stop the psock parser before canceling its work
+    - gfs2: Fix missed wakeups in find_insert_glock
+    - staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()
+    - staging: erofs: compressed_pages should not be accessed again after freed
+    - scripts/gdb: replace flags (MS_xyz -> SB_xyz)
+    - ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom
+    - perf/x86/intel: Make cpuc allocations consistent
+    - perf/x86/intel: Generalize dynamic constraint creation
+    - x86: Add TSX Force Abort CPUID/MSR
+    - perf/x86/intel: Implement support for TSX Force Abort
+    - Linux 5.0.2
+
+  * Linux security module stacking support
+    - LSM: Introduce LSM_FLAG_LEGACY_MAJOR
+    - LSM: Provide separate ordered initialization
+    - LSM: Plumb visibility into optional "enabled" state
+    - LSM: Lift LSM selection out of individual LSMs
+    - LSM: Build ordered list of LSMs to initialize
+    - LSM: Introduce CONFIG_LSM
+    - LSM: Introduce "lsm=" for boottime LSM selection
+    - LSM: Tie enabling logic to presence in ordered list
+    - LSM: Prepare for reorganizing "security=" logic
+    - LSM: Refactor "security=" in terms of enable/disable
+    - LSM: Separate idea of "major" LSM from "exclusive" LSM
+    - apparmor: Remove SECURITY_APPARMOR_BOOTPARAM_VALUE
+    - selinux: Remove SECURITY_SELINUX_BOOTPARAM_VALUE
+    - LSM: Add all exclusive LSMs to ordered initialization
+    - LSM: Split LSM preparation from initialization
+    - LoadPin: Initialize as ordered LSM
+    - Yama: Initialize as ordered LSM
+    - LSM: Introduce enum lsm_order
+    - capability: Initialize as LSM_ORDER_FIRST
+    - procfs: add smack subdir to attrs
+    - Smack: Abstract use of cred security blob
+    - SELinux: Abstract use of cred security blob
+    - SELinux: Remove cred security blob poisoning
+    - SELinux: Remove unused selinux_is_enabled
+    - AppArmor: Abstract use of cred security blob
+    - TOMOYO: Abstract use of cred security blob
+    - Infrastructure management of the cred security blob
+    - SELinux: Abstract use of file security blob
+    - Smack: Abstract use of file security blob
+    - LSM: Infrastructure management of the file security
+    - SELinux: Abstract use of inode security blob
+    - Smack: Abstract use of inode security blob
+    - LSM: Infrastructure management of the inode security
+    - LSM: Infrastructure management of the task security
+    - SELinux: Abstract use of ipc security blobs
+    - Smack: Abstract use of ipc security blobs
+    - LSM: Infrastructure management of the ipc security blob
+    - TOMOYO: Update LSM flags to no longer be exclusive
+    - LSM: generalize flag passing to security_capable
+    - LSM: Make lsm_early_cred() and lsm_early_task() local functions.
+    - LSM: Make some functions static
+    - apparmor: Adjust offset when accessing task blob.
+    - LSM: Ignore "security=" when "lsm=" is specified
+    - LSM: Update list of SECURITYFS users in Kconfig
+    - apparmor: delete the dentry in aafs_remove() to avoid a leak
+    - apparmor: fix double free when unpack of secmark rules fails
+    - SAUCE: LSM: Infrastructure management of the sock security
+    - SAUCE: LSM: Limit calls to certain module hooks
+    - SAUCE: LSM: Special handling for secctx lsm hooks
+    - SAUCE: LSM: Specify which LSM to display with /proc/self/attr/display
+    - SAUCE: Fix-up af_unix mediation for sock infrastructure management
+    - SAUCE: Revert "apparmor: Fix warning about unused function
+      apparmor_ipv6_postroute"
+    - SAUCE: Revert "apparmor: fix checkpatch error in Parse secmark policy"
+    - SAUCE: Revert "apparmor: add #ifdef checks for secmark filtering"
+    - SAUCE: Revert "apparmor: Allow filtering based on secmark policy"
+    - SAUCE: Revert "apparmor: Parse secmark policy"
+    - SAUCE: Revert "apparmor: Add a wildcard secid"
+    - SAUCE: Revert "apparmor: fix bad debug check in apparmor_secid_to_secctx()"
+    - SAUCE: Revert "apparmor: fixup secid map conversion to using IDR"
+    - SAUCE: Revert "apparmor: Use an IDR to allocate apparmor secids"
+    - SAUCE: Revert "apparmor: Fix memory leak of rule on error exit path"
+    - SAUCE: Revert "apparmor: modify audit rule support to support profile
+      stacks"
+    - SAUCE: Revert "apparmor: Add support for audit rule filtering"
+    - SAUCE: Revert "apparmor: add the ability to get a task's secid"
+    - SAUCE: Revert "apparmor: add support for mapping secids and using secctxes"
+    - SAUCE: apparmor: add proc subdir to attrs
+    - SAUCE: apparmor: add an apparmorfs entry to access current attrs
+    - SAUCE: apparmor: update flags to no longer be exclusive
+    - SAUCE: update configs and annotations for LSM stacking
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_EARLY_PRINTK_USB_XDBC=y
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - [Config] CONFIG_RANDOM_TRUST_CPU=y
+    - [Config] refresh annotations for recent config changes
+    - ubuntu: vbox -- update to 6.0.4-dfsg-7
+    - Revert "UBUNTU: SAUCE: i2c:amd I2C Driver based on PCI Interface for
+      upcoming platform"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 04 Apr 2019 14:49:59 -0500
+
+linux (5.0.0-8.9) disco; urgency=medium
+
+  * linux: 5.0.0-8.9 -proposed tracker (LP: #1819759)
+
+  * hisi_sas: add debugfs support (LP: #1819500)
+    - scsi: hisi_sas: Create root and device debugfs directories
+    - scsi: hisi_sas: Alloc debugfs snapshot buffer memory for all registers
+    - scsi: hisi_sas: Take debugfs snapshot for all regs
+    - scsi: hisi_sas: Debugfs global register create file and add file operations
+    - scsi: hisi_sas: Add debugfs for port registers
+    - scsi: hisi_sas: Add debugfs CQ file and add file operations
+    - scsi: hisi_sas: Add debugfs DQ file and add file operations
+    - scsi: hisi_sas: Add debugfs IOST file and add file operations
+    - scsi: hisi_sas: No need to check return value of debugfs_create functions
+    - scsi: hisi_sas: Fix type casting and missing static qualifier in debugfs
+      code
+    - scsi: hisi_sas: Add debugfs ITCT file and add file operations
+
+  * [disco] hns driver updates from 5.1 merge window (LP: #1819535)
+    - net: hns: Use struct_size() in devm_kzalloc()
+    - net: hns3: modify enet reinitialization interface
+    - net: hns3: remove unused member in struct hns3_enet_ring
+    - net: hns3: remove unnecessary hns3_adjust_tqps_num
+    - net: hns3: reuse reinitialization interface in the hns3_set_channels
+    - net: hns3: add interface hclge_tm_bp_setup
+    - net: hns3: modify parameter checks in the hns3_set_channels
+    - net: hns3: remove redundant codes in hclge_knic_setup
+    - net: hns3: fix user configuration loss for ethtool -L
+    - net: hns3: adjust the use of alloc_tqps and num_tqps
+    - net: hns3: fix wrong combined count returned by ethtool -l
+    - net: hns3: do reinitialization while ETS configuration changed
+    - net: hns3: add HNAE3_RESTORE_CLIENT interface in enet module
+    - net: hns3: add calling roce callback function when link status change
+    - net: hns3: add rx multicast packets statistic
+    - net: hns3: refactor the statistics updating for netdev
+    - net: hns3: fix rss configuration lost problem when setting channel
+    - net: hns3: fix for shaper not setting when TC num changes
+    - net: hns3: fix bug of ethtool_ops.get_channels for VF
+    - net: hns3: clear param in ring when free ring
+    - net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED
+    - net: hns3: do not return GE PFC setting err when initializing
+    - net: hns3: add ETS TC weight setting in SSU module
+    - net: hns3: add statistics for PFC frames and MAC control frames
+    - net: hns3: fix PFC not setting problem for DCB module
+    - net: hns3: don't update packet statistics for packets dropped by hardware
+    - net: hns3: clear pci private data when unload hns3 driver
+    - net: hns3: add error handling in hclge_ieee_setets
+    - net: hns3: fix return value handle issue for hclge_set_loopback()
+    - net: hns3: fix broadcast promisc issue for revision 0x20
+    - net: hns3: After setting the loopback, add the status of getting MAC
+    - net: hns3: do reinitialization while mqprio configuration changed
+    - net: hns3: remove dcb_ops->map_update in hclge_dcb
+    - net: hns3: call hns3_nic_set_real_num_queue with netdev down
+    - net: hns3: add 8 BD limit for tx flow
+    - net: hns3: add initialization for nic state
+    - net: hns3: don't allow vf to enable promisc mode
+    - net: hns3: reuse the definition of l3 and l4 header info union
+    - net: hns3: fix VF dump register issue
+    - net: hns3: use the correct interface to stop|open port
+    - net: hns3: change hnae3_register_ae_dev() to int
+    - net: hns3: only support tc 0 for VF
+    - net: hns3: Fix NULL deref when unloading driver
+    - net: hns3: fix netif_napi_del() not do problem when unloading
+    - net: hns3: fix for rss result nonuniform
+    - net: hns3: fix improper error handling in the hclge_init_ae_dev()
+    - net: hns3: fix an issue for hclgevf_ae_get_hdev
+    - net: hns3: stop sending keep alive msg to PF when VF is resetting
+    - net: hns3: keep flow director state unchanged when reset
+    - net: hns3: Check for allocation failure
+    - net: hns3: fix a code style issue for hns3_update_new_int_gl()
+    - net: hns3: fix an issue for hns3_update_new_int_gl
+    - net: hns3: Modify parameter type from int to bool in set_gro_en
+    - net: hns3: code optimization for hclge_rx_buffer_calc
+    - net: hns3: add hclge_cmd_check_retval() to parse comman's return value
+    - net: hns3: move some set_bit statement into hclge_prepare_mac_addr
+    - net: hns3: fix a wrong checking in the hclge_tx_buffer_calc()
+    - net: hns3: fix the problem that the supported port is empty
+    - net: hns3: optimize the maximum TC macro
+    - net: hns3: don't allow user to change vlan filter state
+    - net: hns3: modify the upper limit judgment condition
+    - net: hns3: MAC table entry count function increases operation 0 value
+      protection measures
+    - net: hns3: make function hclge_set_all_vf_rst() static
+    - net: hns3: add pointer checking at the beginning of the exported functions.
+    - net: hns3: Check variable is valid before assigning it to another
+    - net: hns3: convert mac advertize and supported from u32 to link mode
+    - net: hns3: fix port info query issue for copper port
+    - net: hns3: modify print message of ssu common ecc errors
+    - net: hns3: some bugfix of ppu(rcb) ras errors
+    - net: hns3: enable 8~11th bit of mac common msi-x error
+    - net: hns3: fix 6th bit of ppp mpf abnormal errors
+    - net: hns3: Record VF unicast and multicast tables
+    - net: hns3: Record VF vlan tables
+    - net: hns3: uninitialize command queue while unloading PF driver
+    - net: hns3: clear command queue's registers when unloading VF driver
+    - net: hns3: add xps setting support for hns3 driver
+    - net: hns3: avoid mult + div op in critical data path
+    - net: hns3: limit some variable scope in critical data path
+    - net: hns3: remove some ops in struct hns3_nic_ops
+    - net: hns3: add unlikely for error handling in data path
+    - net: hns3: replace hnae3_set_bit and hnae3_set_field in data path
+    - net: hns3: remove hnae3_get_bit in data path
+    - net: hns3: add support to config depth for tx|rx ring separately
+    - net: hns3: enable VF VLAN filter for each VF when initializing
+    - net: hns3: fix get VF RSS issue
+    - net: hns3: fix setting of the hns reset_type for rdma hw errors
+    - net: hns3: fix improper error handling for hns3_client_start
+    - net: hns: use struct_size() in devm_kzalloc()
+    - net: hns3: Fix a logical vs bitwise typo
+    - net: hns3: add dma_rmb() for rx description
+    - net: hns3: fix to stop multiple HNS reset due to the AER changes
+
+  * Build Nvidia drivers in conjunction with kernel (LP: #1764792)
+    - [Packaging] dkms-build -- support building against packages in PPAs
+    - [Packaging] dkms-build: do not redownload files on subsequent passes
+    - [Packaging] dkms-build -- elide partial Built-Using information
+    - [Packaging] dkms-build -- remove retpoline data from final binary packages
+    - [Packaging] dkms-build--nvidia* -- check gcc version against primary build
+    - [Packaging] dkms-build -- add support for unversioned overrides
+    - [Packaging] dkms-build--nvidia-* -- convert to generic -N form
+    - [Packaging] fix-filenames -- handle exact string removal
+    - [Packaging] dkms-build--nvidia-N -- remove GCC versions
+
+  * Disco update: v5.0.1 upstream stable release (LP: #1819515)
+    - cpufreq: Use struct kobj_attribute instead of struct global_attr
+    - staging: erofs: fix mis-acted TAIL merging behavior
+    - binder: create node flag to request sender's security context
+    - USB: serial: option: add Telit ME910 ECM composition
+    - USB: serial: cp210x: add ID for Ingenico 3070
+    - USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
+    - driver core: Postpone DMA tear-down until after devres release
+    - staging: erofs: fix fast symlink w/o xattr when fs xattr is on
+    - staging: erofs: fix memleak of inode's shared xattr array
+    - staging: erofs: fix race of initializing xattrs of a inode at the same time
+    - staging: erofs: fix illegal address access under memory pressure
+    - staging: comedi: ni_660x: fix missing break in switch statement
+    - staging: wilc1000: fix to set correct value for 'vif_num'
+    - staging: android: ion: fix sys heap pool's gfp_flags
+    - staging: android: ashmem: Don't call fallocate() with ashmem_mutex held.
+    - staging: android: ashmem: Avoid range_alloc() allocation with ashmem_mutex
+      held.
+    - ip6mr: Do not call __IP6_INC_STATS() from preemptible context
+    - net: dsa: mv88e6xxx: add call to mv88e6xxx_ports_cmode_init to probe for new
+      DSA framework
+    - net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in
+      mv88e6xxx_port_set_duplex
+    - net: dsa: mv8e6xxx: fix number of internal PHYs for 88E6x90 family
+    - net: mscc: Enable all ports in QSGMII
+    - net: sched: put back q.qlen into a single location
+    - net-sysfs: Fix mem leak in netdev_register_kobject
+    - qmi_wwan: Add support for Quectel EG12/EM12
+    - sctp: call iov_iter_revert() after sending ABORT
+    - team: Free BPF filter when unregistering netdev
+    - tipc: fix RDM/DGRAM connect() regression
+    - x86/CPU/AMD: Set the CPB bit unconditionally on F17h
+    - x86/boot/compressed/64: Do not read legacy ROM on EFI system
+    - tracing: Fix event filters and triggers to handle negative numbers
+    - xhci: tegra: Prevent error pointer dereference
+    - usb: xhci: Fix for Enabling USB ROLE SWITCH QUIRK on
+      INTEL_SUNRISEPOINT_LP_XHCI
+    - applicom: Fix potential Spectre v1 vulnerabilities
+    - alpha: wire up io_pgetevents system call
+    - MIPS: irq: Allocate accurate order pages for irq stack
+    - aio: Fix locking in aio_poll()
+    - xtensa: fix get_wchan
+    - gnss: sirf: fix premature wakeup interrupt enable
+    - USB: serial: cp210x: fix GPIO in autosuspend
+    - Revert "selftests: firmware: add CONFIG_FW_LOADER_USER_HELPER_FALLBACK to
+      config"
+    - Revert "selftests: firmware: remove use of non-standard diff -Z option"
+    - selftests: firmware: fix verify_reqs() return value
+    - Bluetooth: btrtl: Restore old logic to assume firmware is already loaded
+    - Bluetooth: Fix locking in bt_accept_enqueue() for BH context
+    - Linux 5.0.1
+
+  * sky2 ethernet card doesn't work after returning from suspend
+    (LP: #1807259) // sky2 ethernet card link not up after suspend
+    (LP: #1809843) // Disco update: v5.0.1 upstream stable release
+    (LP: #1819515)
+    - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
+
+  * tls selftest failures/hangs on i386 (LP: #1813607)
+    - [Config] CONFIG_TLS=n for i386
+
+  * CVE-2019-8980
+    - exec: Fix mem leak in kernel_read_file
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: net: Use 'ipproto ipv6-icmp' to match ICMPv6 headers
+    - [Config] enable nvidia build
+    - [Config] update gcc version to 8.3
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: selftests: pmtu: disable accept_dad for tests"
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 12 Mar 2019 16:15:44 -0300
+
+linux (5.0.0-7.8) disco; urgency=medium
+
+  * linux: 5.0.0-7.8 -proposed tracker (LP: #1818519)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * unnecessary request_queue freeze (LP: #1815733)
+    - block: avoid setting nr_requests to current value
+    - block: avoid setting none scheduler if it's already none
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: net: Don't fail test_vxlan_under_vrf on xfail
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 04 Mar 2019 08:46:10 -0600
+
+linux (5.0.0-6.7) disco; urgency=medium
+
+  * linux: 5.0.0-6.7 -proposed tracker (LP: #1817585)
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+    - [Packaging] resync getabis
+
+  * installer does not support iSCSI iBFT (LP: #1817321)
+    - d-i: add iscsi_ibft to scsi-modules
+
+  * Silent "Unknown key" message when pressing keyboard backlight hotkey
+    (LP: #1817063)
+    - platform/x86: dell-wmi: Ignore new keyboard backlight change event
+
+  * Fix I219 doesn't get woken up after plugging ethernet cable (LP: #1817058)
+    - e1000e: Disable runtime PM on CNP+
+
+  * efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted (LP: #1814982)
+    - efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted
+
+  * CVE-2019-3460
+    - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt
+
+  * CVE-2019-3459
+    - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer
+
+  * kernel net tls selftest fails on 5.0 (LP: #1816716)
+    - SAUCE: Revert "selftests/tls: Add test for recv(PEEK) spanning across
+      multiple records"
+
+  * Please enable CONFIG_DMA_CMA=y on arm64 (LP: #1803206)
+    - [Config] annotations -- enforce CONFIG_DMA_CMA and update notes
+
+  * [19.04 FEAT] [LS1801] PCI Virtual function enablement (LP: #1814684)
+    - s390/pci: map IOV resources
+    - s390/pci: improve bar check
+
+  * glibc 2.28-0ubuntu1 ADT test failure with linux 5.0.0-1.2 (LP: #1813060)
+    - SAUCE: prevent a glibc test failure when looking for obsolete types on
+      headers
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Enforce CONFIG_ZCRYPT_MULTIDEVNODES in annotations
+    - SAUCE: selftests: pmtu: disable accept_dad for tests
+    - SAUCE: arm64: add kernel config option to lock down when in Secure Boot mode
+    - SAUCE: selftests: net: Make test for VXLAN underlay in non-default VRF an
+      expected failure
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 25 Feb 2019 09:37:36 -0600
+
+linux (5.0.0-5.6) disco; urgency=medium
+
+  * [ALSA] [PATCH] System76 darp5 and oryp5 fixups (LP: #1815831)
+    - ALSA: hda/realtek - Headset microphone and internal speaker support for
+      System76 oryp5
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Fix aufs menus in annotations file
+    - [Config] CONFIG_SAMPLE_TRACE_PRINTK=m
+    - [Config] Update annotations based on configs
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 18 Feb 2019 10:04:11 +0100
+
+linux (5.0.0-4.5) disco; urgency=medium
+
+  * linux-buildinfo: pull out ABI information into its own package
+    (LP: #1806380)
+    - [Packaging] autoreconstruct -- base tag is always primary mainline version
+
+  * [Packaging] Allow overlay of config annotations (LP: #1752072)
+    - [Packaging] config-check: Add an include directive
+
+  * Miscellaneous Ubuntu changes
+    - hio -- stub out BIOVEC_PHYS_MERGEABLE for 4.20+
+    - hio -- replace use of do_gettimeofday()
+    - hio -- part_round_stats() removed in 5.0
+    - hio -- device_add_disk() grew a 'groups' argument in 4.20
+    - enable hio build
+    - Revert "UBUNTU: [Packaging] autoreconstruct -- base tag is always primary
+      mainline version"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 12 Feb 2019 08:15:32 -0600
+
+linux (5.0.0-3.4) disco; urgency=medium
+
+  * CONFIG_TEST_BPF is disabled (LP: #1813955)
+    - [Config]: Reenable TEST_BPF
+
+  * Ignore "incomplete report" from Elan touchpanels (LP: #1813733)
+    - HID: i2c-hid: Ignore input report if there's no data present on Elan
+      touchpanels
+
+  * SecureBoot support for arm64 (LP: #1804481)
+    - Build signed kernels for arm64
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests: net: fix "from" match test in fib_rule_tests.sh
+    - [Config] CONFIG_PCMCIA=n for arm64 and s390x
+    - [Config] CONFIG_SERIAL_SC16IS7XX=n for s390x
+    - [Config] disable I2C TPM drivers for s390x
+    - [Config] CONFIG_RAPIDIO=n for s390x
+    - [Config] CONFIG_DMADEVICES=n for s390x
+    - [Config] disable gpio drivers for s390x
+    - [Config] CONFIG_SENSORS_OCC_P8_I2C=m for ppc64el
+    - [Config] disable I2C hardware drivers for s390x
+    - [Config] CONFIG_I3C=n for s390x
+    - [Config] CONFIG_SERIO=n for s390x
+    - [Config] disable misc drivers for s390x
+    - [Config] disable EEPROM drivers for s390x
+    - [Config] disable MFD drivers for s390x
+    - [Config] CONFIG_NVMEM=n for s390x
+    - [Config] CONFIG_MLXSW_I2C=n for s390x
+    - [Config] CONFIG_NET_VENDOR_MICROCHIP=n for s390x
+    - [Config] CONFIG_PPP=n for s390x
+    - [Config] CONFIG_PCCARD=n for s390x
+    - [Config] CONFIG_PCI_MESON=y
+    - [Config] CONFIG_SCSI_MYRB=n for s390x
+    - [Config] CONFIG_REGULATOR=n for s390x
+    - [Config] CONFIG_ZIIRAVE_WATCHDOG=n for s390x
+    - [Config] CONFIG_NCSI_OEM_CMD_GET_MAC=y
+    - [Config] update annotations following config review
+    - [Packaging] remove handoff check for uefi signing
+    - [Packaging] decompress gzipped efi images in signing tarball
+    - vbox-update: allow leading whitespace when fixing up KERN_DIR
+    - ubuntu: vbox -- update to 6.0.4-dfsg-3
+    - vbox: remove remount check in sf_read_super_aux()
+    - enable vbox build
+    - [Config] CONFIG_ANDROID_BINDER_DEVICES=""
+    - SAUCE: import aufs driver
+    - [Config]: Enable aufs
+    - [Config] relocate aufs annotations to menu
+    - [Config] remove unmatched configs from annotations
+    - [Config] fix up abi for removed modules
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) module: remove support for having IMA validate modules
+    - SAUCE: (efi-lockdown) Move EFI signature blob parser to shared location
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - [Config] (efi-lockdown) enable importing of efi certificates for module sig
+      verification
+
+  * Miscellaneous upstream changes
+    - binder: fix CONFIG_ANDROID_BINDER_DEVICES
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 05 Feb 2019 14:26:12 -0600
+
+linux (5.0.0-2.3) disco; urgency=medium
+
+  * kernel oops in bcache module (LP: #1793901)
+    - SAUCE: bcache: never writeback a discard operation
+
+  * Enable sound card power saving by default (LP: #1804265)
+    - [Config] CONFIG_SND_HDA_POWER_SAVE_DEFAULT=1
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: selftests: disable some failing networking tests"
+    - SAUCE: ashmem: turn into module
+    - SAUCE: binder: turn into module
+    - SAUCE: binder: give binder_alloc its own debug mask file
+    - [Config] enable binder and ashmem as modules
+    - SAUCE: selftests: net: replace AF_MAX with INT_MAX in socket.c
+    - SAUCE: selftests/ftrace: Fix tab expansion in trace_marker snapshot trigger
+      test
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 29 Jan 2019 06:57:32 -0600
+
+linux (5.0.0-1.2) disco; urgency=medium
+
+  * Fix non-working QCA Rome Bluetooth after S3 (LP: #1812812)
+    - USB: Add new USB LPM helpers
+    - USB: Consolidate LPM checks to avoid enabling LPM twice
+
+  * bluetooth controller not detected with 4.15 kernel (LP: #1810797)
+    - SAUCE: btqcomsmd: introduce BT_QCOMSMD_HACK
+    - [Config] arm64: snapdragon: BT_QCOMSMD_HACK=y
+
+  * [19.04 FEAT| Enable virtio-gpu for s390x (LP: #1799467)
+    - [Config] enable virtio-gpu for s390x
+
+  * Crash on "ip link add foo type ipip" (LP: #1811803)
+    - SAUCE: fan: Fix NULL pointer dereference
+
+  * Fix not working Goodix touchpad (LP: #1811929)
+    - HID: i2c-hid: Disable runtime PM on Goodix touchpad
+
+  * Miscellaneous Ubuntu changes
+    - update dkms package versions
+    - enable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 22 Jan 2019 13:56:17 -0600
+
+linux (5.0.0-0.1) disco; urgency=medium
+
+  * Build Nvidia drivers in conjunction with kernel (LP: #1764792)
+    - [Packaging] dkms -- add per package post-process step
+    - [Packaging] dkms -- switch to a consistent build prefix length and strip
+    - [Packaging] nvidia -- build and sign nvidia packages and ship signatures
+    - [Packaging] nvidia -- make nvidia package version explicit
+
+  * Add support for ALC3277 codec on new Dell edge gateways (LP: #1807334)
+    - [Config] CONFIG_SND_SOC_INTEL_KBL_RT5660_MACH=m
+
+  * RTL8822BE WiFi Disabled in Kernel 4.18.0-12 (LP: #1806472)
+    - [Config] CONFIG_RTLWIFI_DEBUG_ST=n
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu -- disable vbox build
+    - ubuntu -- disable hio build
+    - Disable zfs build
+    - SAUCE: import aufs driver
+    - update dkms package versions
+    - [Config] disable aufs config options
+    - [Config] disable nvidia build
+    - update dropped.txt
+    - [Packaging] disable nvidia dkms builds for mainline
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) debugfs: avoid EPERM when no open file operation
+      defined
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - [Config] set config options for efi lockdown
+    - Revert "UBUNTU: SAUCE: import aufs driver"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v5.0-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 17 Jan 2019 12:31:29 -0600
+
+linux (5.0.0-0.0) disco; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 16 Jan 2019 14:48:05 -0600
+
+linux (4.20.0-2.3) disco; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.20
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 03 Jan 2019 12:11:43 -0600
+
+linux (4.20.0-1.2) disco; urgency=medium
+
+  * Packaging resync (LP: #1786013)
+    - [Packaging] update helper scripts
+
+  * Power leakage at S5 with Qualcomm Atheros QCA9377 802.11ac Wireless Network
+    Adapter (LP: #1805607)
+    - SAUCE: ath10k: provide reset function for QCA9377 chip
+
+  * zfs/spl build in conjunction with the kernel from DKMS source (LP: #1807378)
+    - [Packaging] dkms -- dkms package build packaging support
+    - [Packaging] dkms -- save build objects artifacts for validation
+    - [Packaging] dkms -- add general Built-Using: support
+    - [Packaging] simplify Provides comma handling
+    - [Packaging] zfs/spl -- remove packaging support for incorporated source
+    - [Packaging] zfs/spl -- remove incorporated source
+    - [Packaging] zfs/spl -- build via dkms
+    - [Packaging] zfs/spl -- make zfs package version explicit
+    - [Packaging] update-version-dkms -- sync archive versions to package
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] update-version-dkms -- fix getting distrbution from changelog
+    - update dkms package versions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.20-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 11 Dec 2018 11:33:08 -0600
+
+linux (4.20.0-0.1) disco; urgency=medium
+
+  * Overlayfs in user namespace leaks directory content of inaccessible
+    directories (LP: #1793458) // CVE-2018-6559
+    - Revert "ovl: relax permission checking on underlying layers"
+    - SAUCE: overlayfs: ensure mounter privileges when reading directories
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) Fix for module sig verification
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: Import aufs driver
+    - ubuntu: vbox -- update to 5.2.22-dfsg-2
+    - ubuntu -- disable vbox build
+    - ubuntu -- disable hio build
+    - Disable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.20-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 07 Dec 2018 07:13:42 -0600
+
+linux (4.20.0-0.0) disco; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 06 Dec 2018 10:20:19 -0600
+
+linux (4.19.0-8.9) disco; urgency=medium
+
+  * linux: 4.19.0-8.9 -proposed tracker (LP: #1806952)
+
+  * Workaround CSS timeout on AMD SNPS 3.0 xHC (LP: #1806838)
+    - xhci: workaround CSS timeout on AMD SNPS 3.0 xHC
+
+  * Fix Intel I210 doesn't work when ethernet cable gets plugged (LP: #1806818)
+    - igb: Fix an issue that PME is not enabled during runtime suspend
+
+  * The line-out on the Dell Dock station can't work (LP: #1806532)
+    - ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock
+
+  * CVE-2018-19407
+    - KVM: X86: Fix scan ioapic use-before-initialization
+
+  * PC SN720 NVMe WDC 256GB consumes more power in S2Idle than during long idle
+    (LP: #1805775)
+    - SAUCE: pci/nvme: prevent WDC PC SN720 NVMe from entering D3 and being
+      disabled
+
+  * Disco update: 4.19.6 upstream stable release (LP: #1806909)
+    - HID: steam: remove input device when a hid client is running.
+    - efi/libstub: arm: support building with clang
+    - usb: core: Fix hub port connection events lost
+    - usb: dwc3: gadget: fix ISOC TRB type on unaligned transfers
+    - usb: dwc3: gadget: Properly check last unaligned/zero chain TRB
+    - usb: dwc3: core: Clean up ULPI device
+    - usb: dwc3: Fix NULL pointer exception in dwc3_pci_remove()
+    - xhci: Fix leaking USB3 shared_hcd at xhci removal
+    - xhci: handle port status events for removed USB3 hcd
+    - xhci: Add check for invalid byte size error when UAS devices are connected.
+    - usb: xhci: fix uninitialized completion when USB3 port got wrong status
+    - usb: xhci: fix timeout for transition from RExit to U0
+    - xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc
+    - usb: xhci: Prevent bus suspend if a port connect change or polling state is
+      detected
+    - ALSA: oss: Use kvzalloc() for local buffer allocations
+    - MAINTAINERS: Add Sasha as a stable branch maintainer
+    - Documentation/security-bugs: Clarify treatment of embargoed information
+    - Documentation/security-bugs: Postpone fix publication in exceptional cases
+    - mmc: sdhci-pci: Try "cd" for card-detect lookup before using NULL
+    - mmc: sdhci-pci: Workaround GLK firmware failing to restore the tuning value
+    - gpio: don't free unallocated ida on gpiochip_add_data_with_key() error path
+    - iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE
+    - iwlwifi: mvm: support sta_statistics() even on older firmware
+    - iwlwifi: mvm: fix regulatory domain update when the firmware starts
+    - iwlwifi: mvm: don't use SAR Geo if basic SAR is not used
+    - brcmfmac: fix reporting support for 160 MHz channels
+    - opp: ti-opp-supply: Dynamically update u_volt_min
+    - opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call
+    - tools/power/cpupower: fix compilation with STATIC=true
+    - v9fs_dir_readdir: fix double-free on p9stat_read error
+    - selinux: Add __GFP_NOWARN to allocation at str_read()
+    - Input: synaptics - avoid using uninitialized variable when probing
+    - bfs: add sanity check at bfs_fill_super()
+    - sctp: clear the transport of some out_chunk_list chunks in
+      sctp_assoc_rm_peer
+    - gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
+    - llc: do not use sk_eat_skb()
+    - mm: don't warn about large allocations for slab
+    - mm/memory.c: recheck page table entry with page table lock held
+    - tcp: do not release socket ownership in tcp_close()
+    - drm/fb-helper: Blacklist writeback when adding connectors to fbdev
+    - drm/amdgpu: Add missing firmware entry for HAINAN
+    - drm/vc4: Set ->legacy_cursor_update to false when doing non-async updates
+    - drm/amdgpu: Fix oops when pp_funcs->switch_power_profile is unset
+    - drm/i915: Disable LP3 watermarks on all SNB machines
+    - drm/ast: change resolution may cause screen blurred
+    - drm/ast: fixed cursor may disappear sometimes
+    - drm/ast: Remove existing framebuffers before loading driver
+    - can: flexcan: Unlock the MB unconditionally
+    - can: dev: can_get_echo_skb(): factor out non sending code to
+      __can_get_echo_skb()
+    - can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to
+      access frame length
+    - can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb
+      is accessed out of bounds
+    - can: dev: __can_get_echo_skb(): print error message, if trying to echo non
+      existing skb
+    - can: rx-offload: introduce can_rx_offload_get_echo_skb() and
+      can_rx_offload_queue_sorted() functions
+    - can: rx-offload: rename can_rx_offload_irq_queue_err_skb() to
+      can_rx_offload_queue_tail()
+    - can: flexcan: use can_rx_offload_queue_sorted() for flexcan_irq_bus_*()
+    - can: flexcan: handle tx-complete CAN frames via rx-offload infrastructure
+    - can: raw: check for CAN FD capable netdev in raw_sendmsg()
+    - can: hi311x: Use level-triggered interrupt
+    - can: flexcan: Always use last mailbox for TX
+    - can: flexcan: remove not needed struct flexcan_priv::tx_mb and struct
+      flexcan_priv::tx_mb_idx
+    - ACPICA: AML interpreter: add region addresses in global list during
+      initialization
+    - IB/hfi1: Eliminate races in the SDMA send error path
+    - fsnotify: generalize handling of extra event flags
+    - fanotify: fix handling of events on child sub-directory
+    - pinctrl: meson: fix pinconf bias disable
+    - pinctrl: meson: fix gxbb ao pull register bits
+    - pinctrl: meson: fix gxl ao pull register bits
+    - pinctrl: meson: fix meson8 ao pull register bits
+    - pinctrl: meson: fix meson8b ao pull register bits
+    - tools/testing/nvdimm: Fix the array size for dimm devices.
+    - scsi: lpfc: fix remoteport access
+    - scsi: hisi_sas: Remove set but not used variable 'dq_list'
+    - KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
+    - cpufreq: imx6q: add return value check for voltage scale
+    - rtc: cmos: Do not export alarm rtc_ops when we do not support alarms
+    - rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write
+    - crypto: simd - correctly take reqsize of wrapped skcipher into account
+    - floppy: fix race condition in __floppy_read_block_0()
+    - powerpc/io: Fix the IO workarounds code to work with Radix
+    - sched/fair: Fix cpu_util_wake() for 'execl' type workloads
+    - perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs
+    - block: copy ioprio in __bio_clone_fast() and bounce
+    - SUNRPC: Fix a bogus get/put in generic_key_to_expire()
+    - riscv: add missing vdso_install target
+    - RISC-V: Silence some module warnings on 32-bit
+    - drm/amdgpu: fix bug with IH ring setup
+    - kdb: Use strscpy with destination buffer size
+    - NFSv4: Fix an Oops during delegation callbacks
+    - powerpc/numa: Suppress "VPHN is not supported" messages
+    - efi/arm: Revert deferred unmap of early memmap mapping
+    - z3fold: fix possible reclaim races
+    - mm, memory_hotplug: check zone_movable in has_unmovable_pages
+    - tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
+    - mm, page_alloc: check for max order in hot path
+    - dax: Avoid losing wakeup in dax_lock_mapping_entry
+    - include/linux/pfn_t.h: force '~' to be parsed as an unary operator
+    - tty: wipe buffer.
+    - tty: wipe buffer if not echoing data
+    - gfs2: Fix iomap buffer head reference counting bug
+    - rcu: Make need_resched() respond to urgent RCU-QS needs
+    - media: ov5640: Re-work MIPI startup sequence
+    - media: ov5640: Fix timings setup code
+    - media: ov5640: fix exposure regression
+    - media: ov5640: fix auto gain & exposure when changing mode
+    - media: ov5640: fix wrong binning value in exposure calculation
+    - media: ov5640: fix auto controls values when switching to manual mode
+    - Linux 4.19.6
+
+  * linux-buildinfo: pull out ABI information into its own package
+    (LP: #1806380)
+    - [Packaging] limit preparation to linux-libc-dev in headers
+    - [Packaging] commonise debhelper invocation
+    - [Packaging] ABI -- accumulate abi information at the end of the build
+    - [Packaging] buildinfo -- add basic build information
+    - [Packaging] buildinfo -- add firmware information to the flavour ABI
+    - [Packaging] buildinfo -- add compiler information to the flavour ABI
+    - [Packaging] buildinfo -- add buildinfo support to getabis
+    - [Packaging] getabis -- handle all known package combinations
+    - [Packaging] getabis -- support parsing a simple version
+
+  * linux packages should own /usr/lib/linux/triggers (LP: #1770256)
+    - [Packaging] own /usr/lib/linux/triggers
+
+  * Miscellaneous upstream changes
+    - blk-mq: fix corruption with direct issue
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 05 Dec 2018 09:18:30 -0600
+
+linux (4.19.0-7.8) disco; urgency=medium
+
+  * linux: 4.19.0-7.8 -proposed tracker (LP: #1805465)
+
+  * Fix and issue that LG I2C touchscreen stops working after reboot
+    (LP: #1805085)
+    - HID: i2c-hid: Disable runtime PM for LG touchscreen
+
+  * click/pop noise in the headphone on several lenovo laptops (LP: #1805079) //
+    click/pop noise in the headphone on several lenovo laptops (LP: #1805079)
+    - ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops
+
+  * Regression: hinic performance degrades over time (LP: #1805248)
+    - Revert "net-next/hinic: add checksum offload and TSO support"
+
+  * Disco update: 4.19.5 upstream stable release (LP: #1805461)
+    - drm/i915: Replace some PAGE_SIZE with I915_GTT_PAGE_SIZE
+    - cifs: don't dereference smb_file_target before null check
+    - cifs: fix return value for cifs_listxattr
+    - arm64: kprobe: make page to RO mode when allocate it
+    - block: brd: associate with queue until adding disk
+    - net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset()
+    - net: hns3: bugfix for rtnl_lock's range in the hclge_reset()
+    - net: hns3: bugfix for handling mailbox while the command queue reinitialized
+    - net: hns3: bugfix for the initialization of command queue's spin lock
+    - ixgbe: fix MAC anti-spoofing filter after VFLR
+    - reiserfs: propagate errors from fill_with_dentries() properly
+    - hfs: prevent btree data loss on root split
+    - hfsplus: prevent btree data loss on root split
+    - perf unwind: Take pgoff into account when reporting elf to libdwfl
+    - um: Give start_idle_thread() a return code
+    - drm/edid: Add 6 bpc quirk for BOE panel.
+    - afs: Handle EIO from delivery function
+    - platform/x86: intel_telemetry: report debugfs failure
+    - clk: fixed-rate: fix of_node_get-put imbalance
+    - perf symbols: Set PLT entry/header sizes properly on Sparc
+    - fs/exofs: fix potential memory leak in mount option parsing
+    - clk: samsung: exynos5420: Enable PERIS clocks for suspend
+    - apparmor: Fix uninitialized value in aa_split_fqname
+    - x86/earlyprintk: Add a force option for pciserial device
+    - platform/x86: acerhdf: Add BIOS entry for Gateway LT31 v1.3307
+    - clk: meson-axg: pcie: drop the mpll3 clock parent
+    - arm64: percpu: Initialize ret in the default case
+    - clk: meson: clk-pll: drop CLK_GET_RATE_NOCACHE where unnecessary
+    - clk: renesas: r9a06g032: Fix UART34567 clock rate
+    - clk: ti: fix OF child-node lookup
+    - serial: sh-sci: Fix receive on SCIFA/SCIFB variants with DMA
+    - netfilter: ipv6: fix oops when defragmenting locally generated fragments
+    - netfilter: bridge: define INT_MIN & INT_MAX in userspace
+    - s390/decompressor: add missing FORCE to build targets
+    - s390/vdso: add missing FORCE to build targets
+    - HID: i2c-hid: Add a small delay after sleep command for Raydium touchpanel
+    - Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS"
+    - HID: alps: allow incoming reports when only the trackstick is opened
+    - Revert "netfilter: nft_numgen: add map lookups for numgen random operations"
+    - netfilter: ipset: list:set: Decrease refcount synchronously on deletion and
+      replace
+    - netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net
+    - netfilter: ipset: fix ip_set_list allocation failure
+    - s390/mm: fix mis-accounting of pgtable_bytes
+    - s390/mm: Fix ERROR: "__node_distance" undefined!
+    - bpf: fix bpf_prog_get_info_by_fd to return 0 func_lens for unpriv
+    - netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment()
+    - netfilter: xt_IDLETIMER: add sysfs filename checking routine
+    - netfilter: ipset: Fix calling ip_set() macro at dumping
+    - netfilter: nft_compat: ebtables 'nat' table is normal chain type
+    - s390/qeth: fix HiperSockets sniffer
+    - s390/qeth: unregister netdevice only when registered
+    - net: hns3: Fix for out-of-bounds access when setting pfc back pressure
+    - hwmon: (ibmpowernv) Remove bogus __init annotations
+    - ARM: dts: imx6sll: fix typo for fsl,imx6sll-i2c node
+    - ARM: dts: fsl: Fix improperly quoted stdout-path values
+    - Revert "drm/exynos/decon5433: implement frame counter"
+    - arm64: dts: renesas: r8a7795: add missing dma-names on hscif2
+    - arm64: dts: renesas: condor: switch from EtherAVB to GEther
+    - xen/grant-table: Fix incorrect gnttab_dma_free_pages() pr_debug message
+    - clk: fixed-factor: fix of_node_get-put imbalance
+    - mtd: nand: Fix nanddev_pos_next_page() kernel-doc header
+    - lib/raid6: Fix arm64 test build
+    - drm/amd/display: Stop leaking planes
+    - block: Clear kernel memory before copying to user
+    - drm/amd/display: Drop reusing drm connector for MST
+    - drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder()
+    - s390/perf: Change CPUM_CF return code in event init function
+    - ceph: quota: fix null pointer dereference in quota check
+    - of/device: Really only set bus DMA mask when appropriate
+    - nvme: make sure ns head inherits underlying device limits
+    - i2c: omap: Enable for ARCH_K3
+    - i2c: qcom-geni: Fix runtime PM mismatch with child devices
+    - sched/core: Take the hotplug lock in sched_init_smp()
+    - perf tools: Fix undefined symbol scnprintf in libperf-jvmti.so
+    - perf tools: Do not zero sample_id_all for group members
+    - ice: Fix dead device link issue with flow control
+    - ice: Fix the bytecount sent to netdev_tx_sent_queue
+    - ice: Change req_speeds to be u16
+    - i40e: restore NETIF_F_GSO_IPXIP[46] to netdev features
+    - qed: Fix memory/entry leak in qed_init_sp_request()
+    - qed: Fix blocking/unlimited SPQ entries leak
+    - qed: Fix SPQ entries not returned to pool in error flows
+    - qed: Fix potential memory corruption
+    - net: stmmac: Fix RX packet size > 8191
+    - net: aquantia: fix potential IOMMU fault after driver unbind
+    - net: aquantia: fixed enable unicast on 32 macvlan
+    - net: aquantia: invalid checksumm offload implementation
+    - kbuild: deb-pkg: fix too low build version number
+    - Revert "scripts/setlocalversion: git: Make -dirty check more robust"
+    - SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer()
+    - x86/mm: Move LDT remap out of KASLR region on 5-level paging
+    - x86/ldt: Unmap PTEs for the slot before freeing LDT pages
+    - x86/ldt: Remove unused variable in map_ldt_struct()
+    - media: v4l: event: Add subscription to list before calling "add" operation
+    - MIPS: OCTEON: cavium_octeon_defconfig: re-enable OCTEON USB driver
+    - RISC-V: Fix raw_copy_{to,from}_user()
+    - uio: Fix an Oops on load
+    - ALSA: hda/realtek - Add quirk entry for HP Pavilion 15
+    - ALSA: hda/ca0132 - Call pci_iounmap() instead of iounmap()
+    - can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit()
+    - can: kvaser_usb: Fix potential uninitialized variable use
+    - usb: cdc-acm: add entry for Hiro (Conexant) modem
+    - USB: Wait for extra delay time after USB_PORT_FEAT_RESET for quirky hub
+    - usb: quirks: Add delay-init quirk for Corsair K70 LUX RGB
+    - misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
+    - USB: misc: appledisplay: add 20" Apple Cinema Display
+    - gnss: serial: fix synchronous write timeout
+    - gnss: sirf: fix synchronous write timeout
+    - mtd: rawnand: atmel: fix OF child-node lookup
+    - drivers/misc/sgi-gru: fix Spectre v1 vulnerability
+    - ACPI / platform: Add SMB0001 HID to forbidden_id_list
+    - HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges
+    - HID: Add quirk for Primax PIXART OEM mice
+    - HID: Add quirk for Microsoft PIXART OEM mouse
+    - libceph: fall back to sendmsg for slab pages
+    - mt76x0: run vco calibration for each channel configuration
+    - Linux 4.19.5
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: Build signed kernels for arm64"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 27 Nov 2018 10:38:34 -0600
+
+linux (4.19.0-6.7) disco; urgency=medium
+
+  * linux: 4.19.0-6.7 -proposed tracker (LP: #1805195)
+
+  * SecureBoot support for arm64 (LP: #1804481)
+    - Build signed kernels for arm64
+
+  * Add pointstick support for Cirque Touchpad (LP: #1805081)
+    - HID: multitouch: Add pointstick support for Cirque Touchpad
+
+  * Power consumption during s2idle is higher than long idle (Intel SSDPEKKF)
+    (LP: #1804588)
+    - SAUCE: pci: prevent Intel NVMe SSDPEKKF from entering D3
+    - SAUCE: nvme: add quirk to not call disable function when suspending
+
+  * Disco update: 4.19.4 upstream stable release (LP: #1805159)
+    - flow_dissector: do not dissect l4 ports for fragments
+    - ibmvnic: fix accelerated VLAN handling
+    - ip_tunnel: don't force DF when MTU is locked
+    - ipv6: fix a dst leak when removing its exception
+    - ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF
+    - net: bcmgenet: protect stop from timeout
+    - net-gro: reset skb->pkt_type in napi_reuse_skb()
+    - sctp: not allow to set asoc prsctp_enable by sockopt
+    - tcp: Fix SOF_TIMESTAMPING_RX_HARDWARE to use the latest timestamp during TCP
+      coalescing
+    - tg3: Add PHY reset for 5717/5719/5720 in change ring and flow control paths
+    - tipc: don't assume linear buffer when reading ancillary data
+    - tipc: fix lockdep warning when reinitilaizing sockets
+    - tuntap: fix multiqueue rx
+    - net: systemport: Protect stop from timeout
+    - net/sched: act_pedit: fix memory leak when IDR allocation fails
+    - net: sched: cls_flower: validate nested enc_opts_policy to avoid warning
+    - tipc: fix link re-establish failure
+    - net/mlx5e: Don't match on vlan non-existence if ethertype is wildcarded
+    - net/mlx5e: Claim TC hw offloads support only under a proper build config
+    - net/mlx5e: Adjust to max number of channles when re-attaching
+    - net/mlx5e: RX, verify received packet size in Linear Striding RQ
+    - Revert "sctp: remove sctp_transport_pmtu_check"
+    - net/mlx5e: Always use the match level enum when parsing TC rule match
+    - net/mlx5e: Fix selftest for small MTUs
+    - net/mlx5e: Removed unnecessary warnings in FEC caps query
+    - inet: frags: better deal with smp races
+    - l2tp: fix a sock refcnt leak in l2tp_tunnel_register
+    - net/mlx5: IPSec, Fix the SA context hash key
+    - net/mlx5e: IPoIB, Reset QP after channels are closed
+    - net: dsa: mv88e6xxx: Fix clearing of stats counters
+    - net: phy: realtek: fix RTL8201F sysfs name
+    - sctp: define SCTP_SS_DEFAULT for Stream schedulers
+    - net: qualcomm: rmnet: Fix incorrect assignment of real_dev
+    - net: dsa: microchip: initialize mutex before use
+    - sctp: fix strchange_flags name for Stream Change Event
+    - net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs
+    - sctp: not increase stream's incnt before sending addstrm_in request
+    - mlxsw: spectrum: Fix IP2ME CPU policer configuration
+    - net: smsc95xx: Fix MTU range
+    - rxrpc: Fix lockup due to no error backoff after ack transmit error
+    - usbnet: smsc95xx: disable carrier check while suspending
+    - Revert "x86/speculation: Enable cross-hyperthread spectre v2 STIBP
+      mitigation"
+    - Linux 4.19.4
+
+  * Disco update: 4.19.3 upstream stable release (LP: #1805158)
+    - powerpc/traps: restore recoverability of machine_check interrupts
+    - powerpc/64/module: REL32 relocation range check
+    - powerpc/mm: Fix page table dump to work on Radix
+    - powerpc/mm: fix always true/false warning in slice.c
+    - drm/amd/display: fix bug of accessing invalid memory
+    - Input: wm97xx-ts - fix exit path
+    - powerpc/Makefile: Fix PPC_BOOK3S_64 ASFLAGS
+    - powerpc/eeh: Fix possible null deref in eeh_dump_dev_log()
+    - tty: check name length in tty_find_polling_driver()
+    - tracing/kprobes: Check the probe on unloaded module correctly
+    - drm/nouveau/secboot/acr: fix memory leak
+    - drm/amdgpu/powerplay: fix missing break in switch statements
+    - ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL
+    - powerpc/nohash: fix undefined behaviour when testing page size support
+    - drm/msm/gpu: fix parameters in function msm_gpu_crashstate_capture
+    - drm/msm/disp/dpu: Use proper define for drm_encoder_init() 'encoder_type'
+    - drm/msm: dpu: Allow planes to extend past active display
+    - powerpc/mm: Don't report hugepage tables as memory leaks when using kmemleak
+    - drm/omap: fix memory barrier bug in DMM driver
+    - drm/amd/display: Raise dispclk value for dce120 by 15%
+    - drm/amd/display: fix gamma not being applied
+    - drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer
+    - media: pci: cx23885: handle adding to list failure
+    - media: coda: don't overwrite h.264 profile_idc on decoder instance
+    - MIPS: kexec: Mark CPU offline before disabling local IRQ
+    - powerpc/boot: Ensure _zimage_start is a weak symbol
+    - powerpc/memtrace: Remove memory in chunks
+    - MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS
+    - staging: erofs: fix a missing endian conversion
+    - serial: 8250_of: Fix for lack of interrupt support
+    - sc16is7xx: Fix for multi-channel stall
+    - media: tvp5150: fix width alignment during set_selection()
+    - powerpc/selftests: Wait all threads to join
+    - staging:iio:ad7606: fix voltage scales
+    - drm: rcar-du: Update Gen3 output limitations
+    - drm/amdgpu: Fix SDMA TO after GPU reset v3
+    - staging: most: video: fix registration of an empty comp core_component
+    - 9p locks: fix glock.client_id leak in do_lock
+    - udf: Prevent write-unsupported filesystem to be remounted read-write
+    - ARM: dts: imx6ull: keep IMX6UL_ prefix for signals on both i.MX6UL and
+      i.MX6ULL
+    - media: ov5640: fix mode change regression
+    - 9p: clear dangling pointers in p9stat_free
+    - drm/amdgpu: fix integer overflow test in amdgpu_bo_list_create()
+    - media: ov5640: fix restore of last mode set
+    - cdrom: fix improper type cast, which can leat to information leak.
+    - ovl: fix error handling in ovl_verify_set_fh()
+    - ovl: fix recursive oi->lock in ovl_link()
+    - ovl: check whiteout in ovl_create_over_whiteout()
+    - ovl: automatically enable redirect_dir on metacopy=on
+    - serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout
+    - scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
+    - scsi: qla2xxx: Fix process response queue for ISP26XX and above
+    - scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx
+    - scsi: qla2xxx: Fix early srb free on abort
+    - scsi: qla2xxx: shutdown chip if reset fail
+    - scsi: qla2xxx: Reject bsg request if chip is down.
+    - scsi: qla2xxx: Fix re-using LoopID when handle is in use
+    - scsi: qla2xxx: Fix for double free of SRB structure
+    - scsi: qla2xxx: Fix NVMe session hang on unload
+    - scsi: qla2xxx: Fix NVMe Target discovery
+    - scsi: qla2xxx: Fix duplicate switch database entries
+    - scsi: qla2xxx: Fix driver hang when FC-NVMe LUNs are configured
+    - vfs: fix FIGETBSZ ioctl on an overlayfs file
+    - fuse: Fix use-after-free in fuse_dev_do_read()
+    - fuse: Fix use-after-free in fuse_dev_do_write()
+    - fuse: fix blocked_waitq wakeup
+    - fuse: set FR_SENT while locked
+    - drm/msm: fix OF child-node lookup
+    - arm64: dts: stratix10: Support Ethernet Jumbo frame
+    - arm64: dts: stratix10: fix multicast filtering
+    - clk: meson-gxbb: set fclk_div3 as CLK_IS_CRITICAL
+    - clk: meson: axg: mark fdiv2 and fdiv3 as critical
+    - zram: close udev startup race condition as default groups
+    - MIPS: Loongson-3: Fix CPU UART irq delivery problem
+    - MIPS: Loongson-3: Fix BRIDGE irq delivery problem
+    - xtensa: add NOTES section to the linker script
+    - xtensa: make sure bFLT stack is 16 byte aligned
+    - xtensa: fix boot parameters address translation
+    - um: Drop own definition of PTRACE_SYSEMU/_SINGLESTEP
+    - clk: s2mps11: Fix matching when built as module and DT node contains
+      compatible
+    - clk: at91: Fix division by zero in PLL recalc_rate()
+    - clk: sunxi-ng: h6: fix bus clocks' divider position
+    - clk: rockchip: fix wrong mmc sample phase shift for rk3328
+    - clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call
+    - libceph: bump CEPH_MSG_MAX_DATA_LEN
+    - Revert "ceph: fix dentry leak in splice_dentry()"
+    - thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs
+    - mach64: fix display corruption on big endian machines
+    - mach64: fix image corruption due to reading accelerator registers
+    - acpi/nfit, x86/mce: Handle only uncorrectable machine checks
+    - acpi/nfit, x86/mce: Validate a MCE's address before using it
+    - acpi, nfit: Fix ARS overflow continuation
+    - reset: hisilicon: fix potential NULL pointer dereference
+    - crypto: hisilicon - Fix NULL dereference for same dst and src
+    - crypto: hisilicon - Fix reference after free of memories on error path
+    - vhost/scsi: truncate T10 PI iov_iter to prot_bytes
+    - scsi: qla2xxx: Initialize port speed to avoid setting lower speed
+    - SCSI: fix queue cleanup race before queue initialization is done
+    - Revert "powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED for
+      CONFIG_SWAP"
+    - soc: ti: QMSS: Fix usage of irq_set_affinity_hint
+    - ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry
+    - ocfs2: free up write context when direct IO failed
+    - mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
+    - memory_hotplug: cond_resched in __remove_pages
+    - netfilter: conntrack: fix calculation of next bucket number in early_drop
+    - ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm
+    - bonding/802.3ad: fix link_failure_count tracking
+    - mtd: spi-nor: cadence-quadspi: Return error code in
+      cqspi_direct_read_execute()
+    - mtd: nand: Fix nanddev_neraseblocks()
+    - mtd: docg3: don't set conflicting BCH_CONST_PARAMS option
+    - hwmon: (core) Fix double-free in __hwmon_device_register()
+    - perf cs-etm: Correct CPU mode for samples
+    - perf stat: Handle different PMU names with common prefix
+    - perf callchain: Honour the ordering of PERF_CONTEXT_{USER,KERNEL,etc}
+    - perf intel-pt/bts: Calculate cpumode for synthesized samples
+    - perf intel-pt: Insert callchain context into synthesized callchains
+    - of, numa: Validate some distance map rules
+    - x86/cpu/vmware: Do not trace vmware_sched_clock()
+    - x86/hyper-v: Enable PIT shutdown quirk
+    - termios, tty/tty_baudrate.c: fix buffer overrun
+    - arch/alpha, termios: implement BOTHER, IBSHIFT and termios2
+    - watchdog/core: Add missing prototypes for weak functions
+    - btrfs: fix pinned underflow after transaction aborted
+    - Btrfs: fix missing data checksums after a ranged fsync (msync)
+    - Btrfs: fix cur_offset in the error case for nocow
+    - Btrfs: fix infinite loop on inode eviction after deduplication of eof block
+    - Btrfs: fix data corruption due to cloning of eof block
+    - btrfs: tree-checker: Fix misleading group system information
+    - clockevents/drivers/i8253: Add support for PIT shutdown quirk
+    - ext4: add missing brelse() update_backups()'s error path
+    - ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path
+    - ext4: add missing brelse() add_new_gdb_meta_bg()'s error path
+    - ext4: avoid potential extra brelse in setup_new_flex_group_blocks()
+    - ext4: missing !bh check in ext4_xattr_inode_write()
+    - ext4: fix possible inode leak in the retry loop of ext4_resize_fs()
+    - ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty()
+    - ext4: avoid buffer leak in ext4_orphan_add() after prior errors
+    - ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing
+    - ext4: avoid possible double brelse() in add_new_gdb() on error path
+    - ext4: fix possible leak of sbi->s_group_desc_leak in error path
+    - ext4: fix possible leak of s_journal_flag_rwsem in error path
+    - ext4: fix buffer leak in ext4_xattr_get_block() on error path
+    - ext4: release bs.bh before re-using in ext4_xattr_block_find()
+    - ext4: fix buffer leak in ext4_xattr_move_to_block() on error path
+    - ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path
+    - ext4: fix buffer leak in __ext4_read_dirblock() on error path
+    - mount: Prevent MNT_DETACH from disconnecting locked mounts
+    - mnt: fix __detach_mounts infinite loop
+    - uapi: fix linux/kfd_ioctl.h userspace compilation errors
+    - ARM: cpuidle: Don't register the driver when back-end init returns -ENXIO
+    - kdb: use correct pointer when 'btc' calls 'btt'
+    - kdb: print real address of pointers instead of hashed addresses
+    - sunrpc: correct the computation for page_ptr when truncating
+    - NFSv4: Don't exit the state manager without clearing
+      NFS4CLNT_MANAGER_RUNNING
+    - nfsd: COPY and CLONE operations require the saved filehandle to be set
+    - rtc: hctosys: Add missing range error reporting
+    - fuse: fix use-after-free in fuse_direct_IO()
+    - fuse: fix leaked notify reply
+    - fuse: fix possibly missed wake-up after abort
+    - selinux: check length properly in SCTP bind hook
+    - gfs2: Put bitmap buffers in put_super
+    - gfs2: Fix metadata read-ahead during truncate (2)
+    - libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD
+    - crypto: user - fix leaking uninitialized memory to userspace
+    - lib/ubsan.c: don't mark __ubsan_handle_builtin_unreachable as noreturn
+    - hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444!
+    - mm/swapfile.c: use kvzalloc for swap_info_struct allocation
+    - efi/arm/libstub: Pack FDT after populating it
+    - mm: don't reclaim inodes with many attached pages
+    - scripts/spdxcheck.py: make python3 compliant
+    - drm/rockchip: Allow driver to be shutdown on reboot/kexec
+    - drm/amdgpu: Fix typo in amdgpu_vmid_mgr_init
+    - drm/amdgpu: add missing CHIP_HAINAN in amdgpu_ucode_get_load_type
+    - drm/amdgpu: Suppress keypresses from ACPI_VIDEO events
+    - drm/nouveau: Check backlight IDs are >= 0, not > 0
+    - drm/nouveau: Fix nv50_mstc->best_encoder()
+    - drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD
+    - drm/etnaviv: fix bogus fence complete check in timeout handler
+    - drm/dp_mst: Check if primary mstb is null
+    - drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003)
+    - drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit
+      panel's native mode
+    - drm/i915: Use the correct crtc when sanitizing plane mapping
+    - drm/i915: Restore vblank interrupts earlier
+    - drm/i915: Don't unset intel_connector->mst_port
+    - drm/i915: Skip vcpi allocation for MSTB ports that are gone
+    - drm/i915: Large page offsets for pread/pwrite
+    - drm/i915/dp: Fix link retraining comment in intel_dp_long_pulse()
+    - drm/i915/dp: Restrict link retrain workaround to external monitors
+    - drm/i915/icl: Fix the macros for DFLEXDPMLE register bits
+    - drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values
+    - drm/i915: Mark up GTT sizes as u64
+    - drm/i915: Fix error handling for the NV12 fb dimensions check
+    - drm/i915: Fix ilk+ watermarks when disabling pipes
+    - drm/i915: Compare user's 64b GTT offset even on 32b
+    - drm/i915: Don't oops during modeset shutdown after lpe audio deinit
+    - drm/i915: Mark pin flags as u64
+    - drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5
+    - drm/i915/execlists: Force write serialisation into context image vs
+      execution
+    - drm/i915: Fix possible race in intel_dp_add_mst_connector()
+    - drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST
+    - drm/i915: Fix hpd handling for pins with two encoders
+    - CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM
+    - Revert "ACPICA: AML interpreter: add region addresses in global list during
+      initialization"
+    - Linux 4.19.3
+
+  * glibc 2.28-0ubuntu1 ADT test failure with linux 4.19.0-5.6 (LP: #1805154)
+    - SAUCE: Revert "x86: vdso: Use $LD instead of $CC to link"
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.12-1ubuntu1, zfs to 0.7.12-1ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Nov 2018 11:44:00 -0600
+
+linux (4.19.0-5.6) disco; urgency=medium
+
+  * crash in ENA driver on removing an interface (LP: #1802341)
+    - SAUCE: net: ena: fix crash during ena_remove()
+
+  * Ubuntu 18.04.1 - [s390x] Kernel panic while stressing network bonding
+    (LP: #1797367)
+    - s390/qeth: sanitize strings in debug messages
+
+  * Disco update: 4.19.2 upstream stable release (LP: #1803410)
+    - bpf: fix partial copy of map_ptr when dst is scalar
+    - MIPS: VDSO: Reduce VDSO_RANDOMIZE_SIZE to 64MB for 64bit
+    - gpio: mxs: Get rid of external API call
+    - mtd: rawnand: marvell: fix the IRQ handler complete() condition
+    - mtd: maps: gpio-addr-flash: Fix ioremapped size
+    - mtd: spi-nor: fsl-quadspi: fix read error for flash size larger than 16MB
+    - mtd: spi-nor: intel-spi: Add support for Intel Ice Lake SPI serial flash
+    - mtd: spi-nor: fsl-quadspi: Don't let -EINVAL on the bus
+    - spi: spi-mem: Adjust op len based on message/transfer size limitations
+    - spi: bcm-qspi: switch back to reading flash using smaller chunks
+    - spi: bcm-qspi: fix calculation of address length
+    - bcache: trace missed reading by cache_missed
+    - bcache: fix ioctl in flash device
+    - bcache: correct dirty data statistics
+    - bcache: fix miss key refill->end in writeback
+    - hwmon: (pmbus) Fix page count auto-detection.
+    - jffs2: free jffs2_sb_info through jffs2_kill_sb()
+    - block: setup bounce bio_sets properly
+    - block: make sure discard bio is aligned with logical block size
+    - block: make sure writesame bio is aligned with logical block size
+    - cpufreq: conservative: Take limits changes into account properly
+    - dma-mapping: fix panic caused by passing empty cma command line argument
+    - pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
+    - ACPI / OSL: Use 'jiffies' as the time bassis for acpi_os_get_timer()
+    - ACPICA: AML interpreter: add region addresses in global list during
+      initialization
+    - ACPICA: AML Parser: fix parse loop to correctly skip erroneous extended
+      opcodes
+    - acpi, nfit: Fix Address Range Scrub completion tracking
+    - kprobes/x86: Use preempt_enable() in optimized_callback()
+    - mailbox: PCC: handle parse error
+    - parisc: Fix address in HPMC IVA
+    - parisc: Fix map_pages() to not overwrite existing pte entries
+    - parisc: Fix exported address of os_hpmc handler
+    - ALSA: hda - Add quirk for ASUS G751 laptop
+    - ALSA: hda - Fix headphone pin config for ASUS G751
+    - ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905)
+    - ALSA: hda: Add 2 more models to the power_save blacklist
+    - ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops
+    - ALSA: hda - Fix incorrect clearance of thinkpad_acpi hooks
+    - x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
+    - x86/xen: Fix boot loader version reported for PVH guests
+    - x86/corruption-check: Fix panic in memory_corruption_check() when boot
+      option without value is provided
+    - x86/kvm/nVMX: allow bare VMXON state migration
+    - x86/mm/pat: Disable preemption around __flush_tlb_all()
+    - x86/numa_emulation: Fix uniform-split numa emulation
+    - ARM: dts: exynos: Disable pull control for MAX8997 interrupts on Origen
+    - net: socionext: Reset tx queue in ndo_stop
+    - net: loopback: clear skb->tstamp before netif_rx()
+    - locking/lockdep: Fix debug_locks off performance problem
+    - netfilter: xt_nat: fix DNAT target for shifted portmap ranges
+    - ataflop: fix error handling during setup
+    - swim: fix cleanup on setup error
+    - arm64: cpufeature: ctr: Fix cpu capability check for late CPUs
+    - hv_netvsc: fix vf serial matching with pci slot info
+    - nfp: devlink port split support for 1x100G CXP NIC
+    - tun: Consistently configure generic netdev params via rtnetlink
+    - s390/sthyi: Fix machine name validity indication
+    - hwmon: (pwm-fan) Set fan speed to 0 on suspend
+    - lightnvm: pblk: fix race on sysfs line state
+    - lightnvm: pblk: fix two sleep-in-atomic-context bugs
+    - lightnvm: pblk: fix race condition on metadata I/O
+    - spi: spi-ep93xx: Use dma_data_direction for ep93xx_spi_dma_{finish,prepare}
+    - perf tools: Free temporary 'sys' string in read_event_files()
+    - perf tools: Cleanup trace-event-info 'tdata' leak
+    - perf tools: Free 'printk' string in parse_ftrace_printk()
+    - perf strbuf: Match va_{add,copy} with va_end
+    - cpupower: Fix coredump on VMWare
+    - bcache: Populate writeback_rate_minimum attribute
+    - mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01
+    - sdhci: acpi: add free_slot callback
+    - mtd: rawnand: denali: set SPARE_AREA_SKIP_BYTES register to 8 if unset
+    - iwlwifi: pcie: avoid empty free RB queue
+    - iwlwifi: mvm: clear HW_RESTART_REQUESTED when stopping the interface
+    - iwlwifi: mvm: check for n_profiles validity in EWRD ACPI
+    - x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC
+    - wlcore: Fix BUG with clear completion on timeout
+    - ACPI/PPTT: Handle architecturally unknown cache types
+    - ACPI / PM: LPIT: Register sysfs attributes based on FADT
+    - ACPI / processor: Fix the return value of acpi_processor_ids_walk()
+    - cpufreq: dt: Try freeing static OPPs only if we have added them
+    - x86/intel_rdt: Show missing resctrl mount options
+    - mtd: rawnand: atmel: Fix potential NULL pointer dereference
+    - nvme: call nvme_complete_rq when nvmf_check_ready fails for mpath I/O
+    - ath10k: fix tx status flag setting for management frames
+    - signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
+    - ice: fix changing of ring descriptor size (ethtool -G)
+    - ice: update fw version check logic
+    - net: hns3: Fix for packet buffer setting bug
+    - Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth
+    - Bluetooth: hci_qca: Remove hdev dereference in qca_close().
+    - x86: boot: Fix EFI stub alignment
+    - net: hns3: Add nic state check before calling netif_tx_wake_queue
+    - net: hns3: Fix ets validate issue
+    - pinctrl: sunxi: fix 'pctrl->functions' allocation in
+      sunxi_pinctrl_build_state
+    - pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux
+    - brcmfmac: fix for proper support of 160MHz bandwidth
+    - net: hns3: Check hdev state when getting link status
+    - net: hns3: Set STATE_DOWN bit of hdev state when stopping net
+    - net: phy: phylink: ensure the carrier is off when starting phylink
+    - block, bfq: correctly charge and reset entity service in all cases
+    - arm64: entry: Allow handling of undefined instructions from EL1
+    - kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
+    - spi: gpio: No MISO does not imply no RX
+    - ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers
+    - pinctrl: qcom: spmi-mpp: Fix drive strength setting
+    - bpf/verifier: fix verifier instability
+    - failover: Add missing check to validate 'slave_dev' in
+      net_failover_slave_unregister
+    - perf tests: Fix record+probe_libc_inet_pton.sh without ping's debuginfo
+    - pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant
+    - pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant
+    - net: hns3: Preserve vlan 0 in hardware table
+    - net: hns3: Fix ping exited problem when doing lp selftest
+    - net: hns3: Fix for vf vlan delete failed problem
+    - net: dsa: mv88e6xxx: Fix writing to a PHY page.
+    - mt76x2u: run device cleanup routine if resume fails
+    - rsi: fix memory alignment issue in ARM32 platforms
+    - libertas_tf: prevent underflow in process_cmdrequest()
+    - iwlwifi: mvm: fix BAR seq ctrl reporting
+    - gpio: brcmstb: allow 0 width GPIO banks
+    - ixgbe: disallow IPsec Tx offload when in SR-IOV mode
+    - ixgbevf: VF2VF TCP RSS
+    - wil6210: fix RX buffers release and unmap
+    - ath10k: schedule hardware restart if WMI command times out
+    - libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9
+    - thermal: rcar_thermal: Prevent doing work after unbind
+    - thermal: da9062/61: Prevent hardware access during system suspend
+    - cifs: fix a credits leak for compund commands
+    - cgroup, netclassid: add a preemption point to write_classid
+    - net: stmmac: dwmac-sun8i: fix OF child-node lookup
+    - f2fs: fix to account IO correctly for cgroup writeback
+    - MD: Memory leak when flush bio size is zero
+    - md: fix memleak for mempool
+    - of: Add missing exports of node name compare functions
+    - scsi: esp_scsi: Track residual for PIO transfers
+    - scsi: ufs: Schedule clk gating work on correct queue
+    - UAPI: ndctl: Fix g++-unsupported initialisation in headers
+    - KVM: nVMX: Clear reserved bits of #DB exit qualification
+    - scsi: megaraid_sas: fix a missing-check bug
+    - RDMA/core: Do not expose unsupported counters
+    - RDMA/cm: Respect returned status of cm_init_av_by_path
+    - IB/ipoib: Clear IPCB before icmp_send
+    - RDMA/bnxt_re: Avoid accessing nq->bar_reg_iomem in failure case
+    - RDMA/bnxt_re: Fix recursive lock warning in debug kernel
+    - usb: host: ohci-at91: fix request of irq for optional gpio
+    - PCI: mediatek: Fix mtk_pcie_find_port() endpoint/port matching logic
+    - PCI: cadence: Use AXI region 0 to signal interrupts from EP
+    - usb: typec: tcpm: Report back negotiated PPS voltage and current
+    - tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated
+    - f2fs: clear PageError on the read path
+    - Drivers: hv: vmbus: Use cpumask_var_t for on-stack cpu mask
+    - VMCI: Resource wildcard match fixed
+    - PCI / ACPI: Enable wake automatically for power managed bridges
+    - xprtrdma: Reset credit grant properly after a disconnect
+    - irqchip/pdc: Setup all edge interrupts as rising edge at GIC
+    - usb: dwc2: fix call to vbus supply exit routine, call it unlocked
+    - usb: dwc2: fix a race with external vbus supply
+    - usb: gadget: udc: atmel: handle at91sam9rl PMC
+    - ext4: fix argument checking in EXT4_IOC_MOVE_EXT
+    - MD: fix invalid stored role for a disk
+    - PCI: cadence: Correct probe behaviour when failing to get PHY
+    - nvmem: check the return value of nvmem_add_cells()
+    - xhci: Avoid USB autosuspend when resuming USB2 ports.
+    - scsi: qla2xxx: Fix recursive mailbox timeout
+    - f2fs: fix to recover inode's crtime during POR
+    - f2fs: fix to recover inode's i_flags during POR
+    - PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice
+    - coresight: etb10: Fix handling of perf mode
+    - PCI: dwc: pci-dra7xx: Enable errata i870 for both EP and RC mode
+    - crypto: caam - fix implicit casts in endianness helpers
+    - usb: chipidea: Prevent unbalanced IRQ disable
+    - Smack: ptrace capability use fixes
+    - driver/dma/ioat: Call del_timer_sync() without holding prep_lock
+    - ASoC: AMD: Fix capture unstable in beginning for some runs
+    - firmware: coreboot: Unmap ioregion after device population
+    - IB/ipoib: Use dev_port to expose network interface port numbers
+    - IB/mlx5: Allow transition of DCI QP to reset
+    - uio: ensure class is registered before devices
+    - scsi: lpfc: Correct soft lockup when running mds diagnostics
+    - scsi: lpfc: Correct race with abort on completion path
+    - f2fs: avoid sleeping under spin_lock
+    - f2fs: report error if quota off error during umount
+    - signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace
+      init
+    - f2fs: fix to flush all dirty inodes recovered in readonly fs
+    - mfd: menelaus: Fix possible race condition and leak
+    - dmaengine: dma-jz4780: Return error if not probed from DT
+    - IB/rxe: fix for duplicate request processing and ack psns
+    - ALSA: hda: Check the non-cached stream buffers more explicitly
+    - cpupower: Fix AMD Family 0x17 msr_pstate size
+    - Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()"
+    - f2fs: fix missing up_read
+    - f2fs: fix to recover cold bit of inode block during POR
+    - f2fs: fix to account IO correctly
+    - OPP: Free OPP table properly on performance state irregularities
+    - ARM: dts: exynos: Convert exynos5250.dtsi to opp-v2 bindings
+    - ARM: dts: exynos: Mark 1 GHz CPU OPP as suspend OPP on Exynos5250
+    - xen-swiotlb: use actually allocated size on check physical continuous
+    - tpm: Restore functionality to xen vtpm driver.
+    - xen/blkfront: avoid NULL blkfront_info dereference on device removal
+    - xen/balloon: Support xend-based toolstack
+    - xen: fix race in xen_qlock_wait()
+    - xen: make xen_qlock_wait() nestable
+    - xen/pvh: increase early stack size
+    - xen/pvh: don't try to unplug emulated devices
+    - libertas: don't set URB_ZERO_PACKET on IN USB transfer
+    - usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten
+    - usb: typec: tcpm: Fix APDO PPS order checking to be based on voltage
+    - usb: gadget: udc: renesas_usb3: Fix b-device mode for "workaround"
+    - mt76: mt76x2: fix multi-interface beacon configuration
+    - iwlwifi: mvm: check return value of rs_rate_from_ucode_rate()
+    - net/ipv4: defensive cipso option parsing
+    - dmaengine: ppc4xx: fix off-by-one build failure
+    - scsi: sched/wait: Add wait_event_lock_irq_timeout for TASK_UNINTERRUPTIBLE
+      usage
+    - scsi: target: Fix target_wait_for_sess_cmds breakage with active signals
+    - libnvdimm: Hold reference on parent while scheduling async init
+    - libnvdimm, region: Fail badblocks listing for inactive regions
+    - libnvdimm, pmem: Fix badblocks population for 'raw' namespaces
+    - ASoC: intel: skylake: Add missing break in skl_tplg_get_token()
+    - ASoC: sta32x: set ->component pointer in private struct
+    - IB/mlx5: Fix MR cache initialization
+    - IB/rxe: Revise the ib_wr_opcode enum
+    - jbd2: fix use after free in jbd2_log_do_checkpoint()
+    - gfs2_meta: ->mount() can get NULL dev_name
+    - ext4: fix EXT4_IOC_SWAP_BOOT
+    - ext4: initialize retries variable in ext4_da_write_inline_data_begin()
+    - ext4: fix setattr project check in fssetxattr ioctl
+    - ext4: propagate error from dquot_initialize() in EXT4_IOC_FSSETXATTR
+    - ext4: fix use-after-free race in ext4_remount()'s error path
+    - selinux: fix mounting of cgroup2 under older policies
+    - HID: wacom: Work around HID descriptor bug in DTK-2451 and DTH-2452
+    - HID: hiddev: fix potential Spectre v1
+    - EDAC, amd64: Add Family 17h, models 10h-2fh support
+    - EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting
+    - EDAC, skx_edac: Fix logical channel intermediate decoding
+    - ARM: dts: dra7: Fix up unaligned access setting for PCIe EP
+    - PCI/ASPM: Fix link_state teardown on device removal
+    - PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk
+    - signal/GenWQE: Fix sending of SIGKILL
+    - signal: Guard against negative signal numbers in copy_siginfo_from_user32
+    - crypto: lrw - Fix out-of bounds access on counter overflow
+    - crypto: tcrypt - fix ghash-generic speed test
+    - crypto: aesni - don't use GFP_ATOMIC allocation if the request doesn't cross
+      a page in gcm
+    - crypto: morus/generic - fix for big endian systems
+    - crypto: aegis/generic - fix for big endian systems
+    - crypto: speck - remove Speck
+    - mm: /proc/pid/smaps_rollup: fix NULL pointer deref in smaps_pte_range()
+    - userfaultfd: disable irqs when taking the waitqueue lock
+    - ima: fix showing large 'violations' or 'runtime_measurements_count'
+    - ima: open a new file instance if no read permissions
+    - hugetlbfs: dirty pages as they are added to pagecache
+    - mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly
+    - mm/hmm: fix race between hmm_mirror_unregister() and mmu_notifier callback
+    - KVM: arm/arm64: Ensure only THP is candidate for adjustment
+    - KVM: arm64: Fix caching of host MDCR_EL2 value
+    - kbuild: fix kernel/bounds.c 'W=1' warning
+    - iio: ad5064: Fix regulator handling
+    - iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs()
+    - iio: adc: at91: fix acking DRDY irq on simple conversions
+    - iio: adc: at91: fix wrong channel number in triggered buffer mode
+    - w1: omap-hdq: fix missing bus unregister at removal
+    - smb3: allow stats which track session and share reconnects to be reset
+    - smb3: do not attempt cifs operation in smb3 query info error path
+    - smb3: on kerberos mount if server doesn't specify auth type use krb5
+    - printk: Fix panic caused by passing log_buf_len to command line
+    - genirq: Fix race on spurious interrupt detection
+    - tpm: fix response size validation in tpm_get_random()
+    - NFC: nfcmrvl_uart: fix OF child-node lookup
+    - NFSv4.1: Fix the r/wsize checking
+    - nfs: Fix a missed page unlock after pg_doio()
+    - nfsd: correctly decrement odstate refcount in error path
+    - nfsd: Fix an Oops in free_session()
+    - lockd: fix access beyond unterminated strings in prints
+    - dm ioctl: harden copy_params()'s copy_from_user() from malicious users
+    - dm zoned: fix metadata block ref counting
+    - dm zoned: fix various dmz_get_mblock() issues
+    - media: ov7670: make "xclk" clock optional
+    - fsnotify: Fix busy inodes during unmount
+    - powerpc64/module elfv1: Set opd addresses after module relocation
+    - powerpc/msi: Fix compile error on mpc83xx
+    - powerpc/tm: Fix HFSCR bit for no suspend case
+    - powerpc/64s/hash: Do not use PPC_INVALIDATE_ERAT on CPUs before POWER9
+    - MIPS: OCTEON: fix out of bounds array access on CN68XX
+    - rtc: ds1307: fix ds1339 wakealarm support
+    - rtc: cmos: Fix non-ACPI undefined reference to `hpet_rtc_interrupt'
+    - rtc: cmos: Remove the `use_acpi_alarm' module parameter for !ACPI
+    - power: supply: twl4030-charger: fix OF sibling-node lookup
+    - ocxl: Fix access to the AFU Descriptor Data
+    - iommu/arm-smmu: Ensure that page-table updates are visible before TLBI
+    - TC: Set DMA masks for devices
+    - net: bcmgenet: fix OF child-node lookup
+    - media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
+    - Revert "media: dvbsky: use just one mutex for serializing device R/W ops"
+    - kgdboc: Passing ekgdboc to command line causes panic
+    - remoteproc: qcom: q6v5: Propagate EPROBE_DEFER
+    - media: cec: make cec_get_edid_spa_location() an inline function
+    - media: cec: integrate cec_validate_phys_addr() in cec-api.c
+    - xen: fix xen_qlock_wait()
+    - xen: remove size limit of privcmd-buf mapping interface
+    - xen-blkfront: fix kernel panic with negotiate_mq error path
+    - media: cec: add new tx/rx status bits to detect aborts/timeouts
+    - media: cec: fix the Signal Free Time calculation
+    - media: cec: forgot to cancel delayed work
+    - media: em28xx: use a default format if TRY_FMT fails
+    - media: tvp5150: avoid going past array on v4l2_querymenu()
+    - media: em28xx: fix input name for Terratec AV 350
+    - media: em28xx: make v4l2-compliance happier by starting sequence on zero
+    - media: em28xx: fix handler for vidioc_s_input()
+    - media: adv7604: when the EDID is cleared, unconfigure CEC as well
+    - media: adv7842: when the EDID is cleared, unconfigure CEC as well
+    - drm/mediatek: fix OF sibling-node lookup
+    - media: media colorspaces*.rst: rename AdobeRGB to opRGB
+    - media: replace ADOBERGB by OPRGB
+    - media: hdmi.h: rename ADOBE_RGB to OPRGB and ADOBE_YCC to OPYCC
+    - arm64: lse: remove -fcall-used-x0 flag
+    - rpmsg: smd: fix memory leak on channel create
+    - Cramfs: fix abad comparison when wrap-arounds occur
+    - ARM: dts: socfpga: Fix SDRAM node address for Arria10
+    - arm64: dts: stratix10: Correct System Manager register size
+    - soc: qcom: rmtfs-mem: Validate that scm is available
+    - soc/tegra: pmc: Fix child-node lookup
+    - selftests/ftrace: Fix synthetic event test to delete event correctly
+    - selftests/powerpc: Fix ptrace tm failure
+    - tracing: Return -ENOENT if there is no target synthetic event
+    - btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled
+    - btrfs: Handle owner mismatch gracefully when walking up tree
+    - btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock
+    - btrfs: fix error handling in free_log_tree
+    - btrfs: fix error handling in btrfs_dev_replace_start
+    - btrfs: Enhance btrfs_trim_fs function to handle error better
+    - btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
+    - btrfs: iterate all devices during trim, instead of fs_devices::alloc_list
+    - btrfs: don't attempt to trim devices that don't support it
+    - btrfs: keep trim from interfering with transaction commits
+    - btrfs: wait on caching when putting the bg cache
+    - Btrfs: don't clean dirty pages during buffered writes
+    - btrfs: release metadata before running delayed refs
+    - btrfs: protect space cache inode alloc with GFP_NOFS
+    - btrfs: reset max_extent_size on clear in a bitmap
+    - btrfs: make sure we create all new block groups
+    - Btrfs: fix warning when replaying log after fsync of a tmpfile
+    - Btrfs: fix wrong dentries after fsync of file that got its parent replaced
+    - btrfs: qgroup: Dirty all qgroups before rescan
+    - Btrfs: fix null pointer dereference on compressed write path error
+    - Btrfs: fix assertion on fsync of regular file when using no-holes feature
+    - Btrfs: fix deadlock when writing out free space caches
+    - btrfs: reset max_extent_size properly
+    - btrfs: set max_extent_size properly
+    - btrfs: don't use ctl->free_space for max_extent_size
+    - btrfs: only free reserved extent if we didn't insert it
+    - btrfs: fix insert_reserved error handling
+    - btrfs: don't run delayed_iputs in commit
+    - btrfs: move the dio_sem higher up the callchain
+    - Btrfs: fix use-after-free during inode eviction
+    - Btrfs: fix use-after-free when dumping free space
+    - net: sched: Remove TCA_OPTIONS from policy
+    - vt: fix broken display when running aptitude
+    - bpf: wait for running BPF programs when updating map-in-map
+    - vga_switcheroo: Fix missing gpu_bound call at audio client registration
+    - MD: fix invalid stored role for a disk - try2
+    - Linux 4.19.2
+
+  * [FEAT] Guest-dedicated Crypto Adapters (LP: #1787405)
+    - KVM: s390: vsie: simulate VCPU SIE entry/exit
+    - KVM: s390: introduce and use KVM_REQ_VSIE_RESTART
+    - KVM: s390: refactor crypto initialization
+    - s390: vfio-ap: base implementation of VFIO AP device driver
+    - s390: vfio-ap: register matrix device with VFIO mdev framework
+    - s390: vfio-ap: sysfs interfaces to configure adapters
+    - s390: vfio-ap: sysfs interfaces to configure domains
+    - s390: vfio-ap: sysfs interfaces to configure control domains
+    - s390: vfio-ap: sysfs interface to view matrix mdev matrix
+    - KVM: s390: interface to clear CRYCB masks
+    - s390: vfio-ap: implement mediated device open callback
+    - s390: vfio-ap: implement VFIO_DEVICE_GET_INFO ioctl
+    - s390: vfio-ap: zeroize the AP queues
+    - s390: vfio-ap: implement VFIO_DEVICE_RESET ioctl
+    - KVM: s390: Clear Crypto Control Block when using vSIE
+    - KVM: s390: vsie: Do the CRYCB validation first
+    - KVM: s390: vsie: Make use of CRYCB FORMAT2 clear
+    - KVM: s390: vsie: Allow CRYCB FORMAT-2
+    - KVM: s390: vsie: allow CRYCB FORMAT-1
+    - KVM: s390: vsie: allow CRYCB FORMAT-0
+    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-1
+    - KVM: s390: vsie: allow guest FORMAT-1 CRYCB on host FORMAT-2
+    - KVM: s390: vsie: allow guest FORMAT-0 CRYCB on host FORMAT-2
+    - KVM: s390: device attrs to enable/disable AP interpretation
+    - KVM: s390: CPU model support for AP virtualization
+    - s390: doc: detailed specifications for AP virtualization
+    - KVM: s390: fix locking for crypto setting error path
+    - KVM: s390: Tracing APCB changes
+    - s390: vfio-ap: setup APCB mask using KVM dedicated function
+    - [Config:] Enable CONFIG_S390_AP_IOMMU and set CONFIG_VFIO_AP to module.
+
+  * Bypass of mount visibility through userns + mount propagation (LP: #1789161)
+    - mount: Retest MNT_LOCKED in do_umount
+    - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts
+
+  *  CVE-2018-18955: nested user namespaces with more than five extents
+    incorrectly grant privileges over inode (LP: #1801924) // CVE-2018-18955
+    - userns: also map extents in the reverse map to kernel IDs
+
+  * kdump fail due to an IRQ storm (LP: #1797990)
+    - SAUCE: x86/PCI: Export find_cap() to be used in early PCI code
+    - SAUCE: x86/quirks: Add parameter to clear MSIs early on boot
+    - SAUCE: x86/quirks: Scan all busses for early PCI quirks
+
+  * Disable LPM for Raydium Touchscreens (LP: #1802248)
+    - USB: quirks: Add no-lpm quirk for Raydium touchscreens
+
+  * Power consumption during s2idle is higher than long idle(sk hynix)
+    (LP: #1801875)
+    - SAUCE: pci: prevent sk hynix nvme from entering D3
+    - SAUCE: nvme: add quirk to not call disable function when suspending
+
+  * Disco update: v4.19.1 upstream stable release (LP: #1801739)
+    - bridge: do not add port to router list when receives query with source
+      0.0.0.0
+    - ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are
+      called
+    - net/mlx5e: fix csum adjustments caused by RXFCS
+    - net: sched: gred: pass the right attribute to gred_change_table_def()
+    - net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
+    - net: udp: fix handling of CHECKSUM_COMPLETE packets
+    - Revert "net: simplify sock_poll_wait"
+    - rtnetlink: Disallow FDB configuration for non-Ethernet device
+    - vhost: Fix Spectre V1 vulnerability
+    - bonding: fix length of actor system
+    - openvswitch: Fix push/pop ethernet validation
+    - net/ipv6: Allow onlink routes to have a device mismatch if it is the default
+      route
+    - net/smc: fix smc_buf_unuse to use the lgr pointer
+    - mlxsw: spectrum_switchdev: Don't ignore deletions of learned MACs
+    - mlxsw: core: Fix devlink unregister flow
+    - net: drop skb on failure in ip_check_defrag()
+    - net: Properly unlink GRO packets on overflow.
+    - r8169: fix broken Wake-on-LAN from S5 (poweroff)
+    - Revert "be2net: remove desc field from be_eq_obj"
+    - sctp: check policy more carefully when getting pr status
+    - sparc64: Export __node_distance.
+    - sparc64: Make corrupted user stacks more debuggable.
+    - sparc64: Wire up compat getpeername and getsockname.
+    - net: bridge: remove ipv6 zero address check in mcast queries
+    - Linux 4.19.1
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.11-1ubuntu1, zfs to 0.7.11-3ubuntu1
+    - [Config] updateconfigs after 4.19.2 stable update
+    - [Config] Disable unneded options for s390
+    - [Config] Update annotations for 4.19
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 15 Nov 2018 09:55:37 -0800
+
+linux (4.19.0-4.5) disco; urgency=medium
+
+  * Add checksum offload and TSO support for HiNIC adapters (LP: #1800664)
+    - net-next/hinic: add checksum offload and TSO support
+
+  * [Bionic][Cosmic] Fix to ipmi to support vendor specific messages greater
+    than 255 bytes (LP: #1799794)
+    - ipmi:ssif: Add support for multi-part transmit messages > 2 parts
+
+  * Packaging resync (LP: #1786013)
+    - [Package] add support for specifying the primary makefile
+
+  * Update ENA driver to version 2.0.1K (LP: #1798182)
+    - net: ena: minor performance improvement
+    - net: ena: complete host info to match latest ENA spec
+    - net: ena: introduce Low Latency Queues data structures according to ENA spec
+    - net: ena: add functions for handling Low Latency Queues in ena_com
+    - net: ena: add functions for handling Low Latency Queues in ena_netdev
+    - net: ena: use CSUM_CHECKED device indication to report skb's checksum status
+    - net: ena: explicit casting and initialization, and clearer error handling
+    - net: ena: limit refill Rx threshold to 256 to avoid latency issues
+    - net: ena: change rx copybreak default to reduce kernel memory pressure
+    - net: ena: remove redundant parameter in ena_com_admin_init()
+    - net: ena: update driver version to 2.0.1
+    - net: ena: fix indentations in ena_defs for better readability
+    - net: ena: Fix Kconfig dependency on X86
+    - net: ena: enable Low Latency Queues
+    - net: ena: fix compilation error in xtensa architecture
+
+  * [Bionic][Cosmic]  ipmi: Fix timer race with module unload (LP: #1799281)
+    - ipmi: Fix timer race with module unload
+
+  * Overlayfs in user namespace leaks directory content of inaccessible
+    directories (LP: #1793458) // CVE-2018-6559
+    - SAUCE: overlayfs: ensure mounter privileges when reading directories
+
+  * not able to unwind the stack from within __kernel_clock_gettime in the Linux
+    vDSO (LP: #1797963)
+    - powerpc/vdso: Correct call frame information
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Don't print secure boot state
+      from the efi stub"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Make get_cert_list() use
+      efi_status_to_str() to print error messages."
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err()."
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Make get_cert_list() not complain
+      about cert lists that aren't present."
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable
+      to be suppressed"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI
+      Secure Boot"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add EFI signature data types"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time
+      addition of keys to secondary keyring"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in
+      secure boot mode"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to
+      indicate secure boot mode"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Copy secure_boot flag in boot params
+      across kexec reboot"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down perf"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) bpf: Restrict kernel image access
+      functions when the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down kprobes"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down /proc/kcore"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the
+      testmmiotrace module"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down module params that specify
+      hardware parameters (eg. ioport)"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down TIOCSSERIAL"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) acpi: Disable APEI error injection if
+      the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) acpi: Disable ACPI table override if
+      the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param
+      when the kernel has been locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) ACPI: Limit access to custom_method
+      when the kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) x86: Lock down IO port access when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) PCI: Lock down BAR access when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is
+      locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) hibernate: Disable when the kernel is
+      locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Enforce module signatures if the
+      kernel is locked down"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add a SysRq option to lift kernel
+      lockdown"
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) Add the ability to lock down access to
+      the running kernel image"
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) efi/x86: Call efi_parse_options() from efi_main()
+    - SAUCE: (efi-lockdown) Fix for module sig verification
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) module: remove support for having IMA validate modules
+    - [Packaging] generate Vcs-Git url from changelog
+    - [Config] CONFIG_SCSI_MQ_DEFAULT=y
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 02 Nov 2018 14:22:55 -0500
+
+linux (4.19.0-3.4) cosmic; urgency=medium
+
+  * Support Edge Gateway's Bluetooth LED (LP: #1798332)
+    - SAUCE: Bluetooth: Support for LED on Edge Gateways
+
+  * Support Edge Gateway's WIFI LED (LP: #1798330)
+    - SAUCE: mwifiex: Switch WiFi LED state according to the device status
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Oct 2018 09:13:39 -0500
+
+linux (4.19.0-2.3) cosmic; urgency=medium
+
+  * fscache: bad refcounting in fscache_op_complete leads to OOPS (LP: #1797314)
+    - SAUCE: fscache: Fix race in decrementing refcount of op->npages
+
+  * Provide mode where all vCPUs on a core must be the same VM (LP: #1792957)
+    - KVM: PPC: Book3S HV: Provide mode where all vCPUs on a core must be the same
+      VM
+
+  * The front MIC can't work on the Lenovo M715 (LP: #1797292)
+    - ALSA: hda/realtek - Fix the problem of the front MIC on the Lenovo M715
+
+  * arm64: snapdragon: WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1016
+    gic_irq_domain_translate (LP: #1797143)
+    - SAUCE: arm64: dts: msm8916: camms: fix gic_irq_domain_translate warnings
+
+  * Dell new AIO requires a new uart backlight driver (LP: #1727235)
+    - SAUCE: platform/x86: dell-uart-backlight: new backlight driver for DELL AIO
+    - updateconfigs for Dell UART backlight driver
+
+  * Please make CONFIG_PWM_LPSS_PCI and CONFIG_PWM_LPSS_PLATFORM built in to
+    make brightness adjustment working on various BayTrail/CherryTrail-based
+    devices (LP: #1783964)
+    - [Config]: Make PWM_LPSS_* built-in
+
+  * check and fix zkey required kernel modules locations in debs, udebs, and
+    initramfs (LP: #1794346)
+    - [Config] add s390 crypto modules to crypt-modules udeb
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_VBOXGUEST=n
+    - ubuntu: vbox -- update to 5.2.18-dfsg-2
+    - ubuntu: enable vbox build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 15 Oct 2018 10:52:04 -0500
+
+linux (4.19.0-1.2) cosmic; urgency=medium
+
+  * Page leaking in cachefiles_read_backing_file while vmscan is active
+    (LP: #1793430)
+    - SAUCE: cachefiles: Page leaking in cachefiles_read_backing_file while vmscan
+      is active
+
+  * SRU: Enable middle button of touchpad on ThinkPad P72 (LP: #1793463)
+    - Input: elantech - enable middle button of touchpad on ThinkPad P72
+
+  * Improvements to the kernel source package preparation (LP: #1793461)
+    - [Packaging] startnewrelease: add support for backport kernels
+
+  * Fix unusable NVIDIA GPU after S3 (LP: #1793338)
+    - SAUCE: PCI: Reprogram bridge prefetch registers on resume
+
+  * Error reported when creating ZFS pool with "-t" option, despite successful
+    pool creation (LP: #1769937)
+    - SAUCE: (noup) Update zfs to 0.7.9-3ubuntu6
+
+  * device hotplug of vfio devices can lead to deadlock in vfio_pci_release
+    (LP: #1792099)
+    - SAUCE: vfio -- release device lock before userspace requests
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] retpoline -- fix temporary filenaming
+    - CONFIG_BCH_CONST_PARAMS=n
+    - Packaging: final-checks: remove trailing backport suffix
+    - SAUCE: import aufs driver
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 25 Sep 2018 16:32:24 -0500
+
+linux (4.19.0-0.1) cosmic; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu -- disable vbox build
+    - Disable zfs build
+    - SAUCE: Import aufs driver
+    - Update dropped.txt
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.19-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 13 Sep 2018 07:54:47 -0500
+
+linux (4.19.0-0.0) cosmic; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 13 Sep 2018 06:44:09 -0500
+
+linux (4.18.0-8.9) cosmic; urgency=medium
+
+  * linux: 4.18.0-8.9 -proposed tracker (LP: #1791663)
+
+  * Cosmic update to v4.18.7 stable release (LP: #1791660)
+    - rcu: Make expedited GPs handle CPU 0 being offline
+    - net: 6lowpan: fix reserved space for single frames
+    - net: mac802154: tx: expand tailroom if necessary
+    - 9p/net: Fix zero-copy path in the 9p virtio transport
+    - spi: davinci: fix a NULL pointer dereference
+    - spi: pxa2xx: Add support for Intel Ice Lake
+    - spi: spi-fsl-dspi: Fix imprecise abort on VF500 during probe
+    - spi: cadence: Change usleep_range() to udelay(), for atomic context
+    - mmc: block: Fix unsupported parallel dispatch of requests
+    - mmc: renesas_sdhi_internal_dmac: mask DMAC interrupts
+    - mmc: renesas_sdhi_internal_dmac: fix #define RST_RESERVED_BITS
+    - readahead: stricter check for bdi io_pages
+    - block: fix infinite loop if the device loses discard capability
+    - block: blk_init_allocated_queue() set q->fq as NULL in the fail case
+    - block: really disable runtime-pm for blk-mq
+    - blkcg: Introduce blkg_root_lookup()
+    - block: Introduce blk_exit_queue()
+    - block: Ensure that a request queue is dissociated from the cgroup controller
+    - apparmor: fix bad debug check in apparmor_secid_to_secctx()
+    - dma-buf: Move BUG_ON from _add_shared_fence to _add_shared_inplace
+    - libertas: fix suspend and resume for SDIO connected cards
+    - media: Revert "[media] tvp5150: fix pad format frame height"
+    - mailbox: xgene-slimpro: Fix potential NULL pointer dereference
+    - Replace magic for trusting the secondary keyring with #define
+    - Fix kexec forbidding kernels signed with keys in the secondary keyring to
+      boot
+    - powerpc/fadump: handle crash memory ranges array index overflow
+    - powerpc/64s: Fix page table fragment refcount race vs speculative references
+    - powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.
+    - powerpc/pkeys: Give all threads control of their key permissions
+    - powerpc/pkeys: Deny read/write/execute by default
+    - powerpc/pkeys: key allocation/deallocation must not change pkey registers
+    - powerpc/pkeys: Save the pkey registers before fork
+    - powerpc/pkeys: Fix calculation of total pkeys.
+    - powerpc/pkeys: Preallocate execute-only key
+    - powerpc/nohash: fix pte_access_permitted()
+    - powerpc64/ftrace: Include ftrace.h needed for enable/disable calls
+    - powerpc/powernv/pci: Work around races in PCI bridge enabling
+    - cxl: Fix wrong comparison in cxl_adapter_context_get()
+    - IB/mlx5: Honor cnt_set_id_valid flag instead of set_id
+    - IB/mlx5: Fix leaking stack memory to userspace
+    - IB/srpt: Fix srpt_cm_req_recv() error path (1/2)
+    - IB/srpt: Fix srpt_cm_req_recv() error path (2/2)
+    - IB/srpt: Support HCAs with more than two ports
+    - overflow.h: Add arithmetic shift helper
+    - RDMA/mlx5: Fix shift overflow in mlx5_ib_create_wq
+    - ib_srpt: Fix a use-after-free in srpt_close_ch()
+    - ib_srpt: Fix a use-after-free in __srpt_close_all_ch()
+    - RDMA/rxe: Set wqe->status correctly if an unexpected response is received
+    - 9p: fix multiple NULL-pointer-dereferences
+    - fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr failed
+    - 9p/virtio: fix off-by-one error in sg list bounds check
+    - net/9p/client.c: version pointer uninitialized
+    - net/9p/trans_fd.c: fix race-condition by flushing workqueue before the
+      kfree()
+    - dm integrity: change 'suspending' variable from bool to int
+    - dm thin: stop no_space_timeout worker when switching to write-mode
+    - dm cache metadata: save in-core policy_hint_size to on-disk superblock
+    - dm cache metadata: set dirty on all cache blocks after a crash
+    - dm crypt: don't decrease device limits
+    - dm writecache: fix a crash due to reading past end of dirty_bitmap
+    - uart: fix race between uart_put_char() and uart_shutdown()
+    - Drivers: hv: vmbus: Fix the offer_in_progress in vmbus_process_offer()
+    - Drivers: hv: vmbus: Reset the channel callback in vmbus_onoffer_rescind()
+    - iio: sca3000: Fix missing return in switch
+    - iio: ad9523: Fix displayed phase
+    - iio: ad9523: Fix return value for ad952x_store()
+    - extcon: Release locking when sending the notification of connector state
+    - eventpoll.h: wrap casts in () properly
+    - vmw_balloon: fix inflation of 64-bit GFNs
+    - vmw_balloon: do not use 2MB without batching
+    - vmw_balloon: VMCI_DOORBELL_SET does not check status
+    - vmw_balloon: fix VMCI use when balloon built into kernel
+    - rtc: omap: fix resource leak in registration error path
+    - rtc: omap: fix potential crash on power off
+    - tracing: Do not call start/stop() functions when tracing_on does not change
+    - tracing/blktrace: Fix to allow setting same value
+    - printk/tracing: Do not trace printk_nmi_enter()
+    - livepatch: Validate module/old func name length
+    - uprobes: Use synchronize_rcu() not synchronize_sched()
+    - mfd: hi655x: Fix regmap area declared size for hi655x
+    - ovl: fix wrong use of impure dir cache in ovl_iterate()
+    - ACPICA: AML Parser: skip opcodes that open a scope upon parse failure
+    - ACPICA: Clear status of all events when entering sleep states
+    - drivers/block/zram/zram_drv.c: fix bug storing backing_dev
+    - sched: idle: Avoid retaining the tick when it has been stopped
+    - cpuidle: menu: Handle stopped tick more aggressively
+    - cpufreq: governor: Avoid accessing invalid governor_data
+    - PM / sleep: wakeup: Fix build error caused by missing SRCU support
+    - ALSA: ac97: fix device initialization in the compat layer
+    - ALSA: ac97: fix check of pm_runtime_get_sync failure
+    - ALSA: ac97: fix unbalanced pm_runtime_enable
+    - i2c: designware: Re-init controllers with pm_disabled set on resume
+    - KVM: VMX: fixes for vmentry_l1d_flush module parameter
+    - KVM: PPC: Book3S: Fix guest DMA when guest partially backed by THP pages
+    - xtensa: limit offsets in __loop_cache_{all,page}
+    - xtensa: increase ranges in ___invalidate_{i,d}cache_all
+    - block, bfq: return nbytes and not zero from struct cftype .write() method
+    - pnfs/blocklayout: off by one in bl_map_stripe()
+    - nfsd: fix leaked file lock with nfs exported overlayfs
+    - NFSv4 client live hangs after live data migration recovery
+    - NFSv4: Fix locking in pnfs_generic_recover_commit_reqs
+    - NFSv4: Fix a sleep in atomic context in nfs4_callback_sequence()
+    - ARM: tegra: Fix Tegra30 Cardhu PCA954x reset
+    - ARM: dts: am57xx-idk: Enable dual role for USB2 port
+    - pwm: omap-dmtimer: Return -EPROBE_DEFER if no dmtimer platform data
+    - mm/tlb: Remove tlb_remove_table() non-concurrent condition
+    - iommu/ipmmu-vmsa: Don't register as BUS IOMMU if machine doesn't have IPMMU-
+      VMSA
+    - iommu/vt-d: Add definitions for PFSID
+    - iommu/vt-d: Fix dev iotlb pfsid use
+    - sys: don't hold uts_sem while accessing userspace memory
+    - userns: move user access out of the mutex
+    - ubifs: Fix memory leak in lprobs self-check
+    - Revert "UBIFS: Fix potential integer overflow in allocation"
+    - ubifs: Check data node size before truncate
+    - ubifs: xattr: Don't operate on deleted inodes
+    - ubifs: Fix directory size calculation for symlinks
+    - ubifs: Fix synced_i_size calculation for xattr inodes
+    - pwm: tiehrpwm: Don't use emulation mode bits to control PWM output
+    - pwm: tiehrpwm: Fix disabling of output of PWMs
+    - fb: fix lost console when the user unplugs a USB adapter
+    - udlfb: fix semaphore value leak
+    - udlfb: fix display corruption of the last line
+    - udlfb: don't switch if we are switching to the same videomode
+    - udlfb: set optimal write delay
+    - udlfb: make a local copy of fb_ops
+    - udlfb: handle allocation failure
+    - udlfb: set line_length in dlfb_ops_set_par
+    - getxattr: use correct xattr length
+    - libnvdimm: Use max contiguous area for namespace size
+    - libnvdimm: fix ars_status output length calculation
+    - bcache: release dc->writeback_lock properly in bch_writeback_thread()
+    - kconfig: fix "Can't open ..." in parallel build
+    - perf auxtrace: Fix queue resize
+    - crypto: vmx - Fix sleep-in-atomic bugs
+    - crypto: aesni - Use unaligned loads from gcm_context_data
+    - crypto: arm64/sm4-ce - check for the right CPU feature bit
+    - crypto: caam - fix DMA mapping direction for RSA forms 2 & 3
+    - crypto: caam/jr - fix descriptor DMA unmapping
+    - crypto: caam/qi - fix error path in xts setkey
+    - fs/quota: Fix spectre gadget in do_quotactl
+    - udf: Fix mounting of Win7 created UDF filesystems
+    - cpuidle: menu: Retain tick when shallow state is selected
+    - arm64: mm: always enable CONFIG_HOLES_IN_ZONE
+    - Linux 4.18.7
+
+  * CVE-2017-5715
+    - s390: detect etoken facility
+    - KVM: s390: add etoken support for guests
+
+  * Missing Intel GPU pci-id's (LP: #1789924)
+    - drm/i915/whl: Introducing Whiskey Lake platform
+    - drm/i915/aml: Introducing Amber Lake platform
+    - drm/i915/cfl: Add a new CFL PCI ID.
+
+  * [18.10 FEAT] Add kernel config options for SMC-R/D (LP: #1789934)
+    - s390/ism: add device driver for internal shared memory
+    - CONFIG_ISM=y for s390
+
+  * Cosmic update to v4.18.6 stable release (LP: #1791105)
+    - PATCH scripts/kernel-doc
+    - scripts/kernel-doc: Escape all literal braces in regexes
+    - scsi: libsas: dynamically allocate and free ata host
+    - xprtrdma: Fix disconnect regression
+    - mei: don't update offset in write
+    - cifs: add missing support for ACLs in SMB 3.11
+    - CIFS: fix uninitialized ptr deref in smb2 signing
+    - cifs: add missing debug entries for kconfig options
+    - cifs: use a refcount to protect open/closing the cached file handle
+    - cifs: check kmalloc before use
+    - smb3: enumerating snapshots was leaving part of the data off end
+    - smb3: Do not send SMB3 SET_INFO if nothing changed
+    - smb3: don't request leases in symlink creation and query
+    - smb3: fill in statfs fsid and correct namelen
+    - btrfs: use correct compare function of dirty_metadata_bytes
+    - btrfs: don't leak ret from do_chunk_alloc
+    - Btrfs: fix mount failure after fsync due to hard link recreation
+    - Btrfs: fix btrfs_write_inode vs delayed iput deadlock
+    - Btrfs: fix send failure when root has deleted files still open
+    - Btrfs: send, fix incorrect file layout after hole punching beyond eof
+    - hwmon: (k10temp) 27C Offset needed for Threadripper2
+    - bpf, arm32: fix stack var offset in jit
+    - regulator: arizona-ldo1: Use correct device to get enable GPIO
+    - iommu/arm-smmu: Error out only if not enough context interrupts
+    - printk: Split the code for storing a message into the log buffer
+    - printk: Create helper function to queue deferred console handling
+    - printk/nmi: Prevent deadlock when accessing the main log buffer in NMI
+    - kprobes/arm64: Fix %p uses in error messages
+    - arm64: Fix mismatched cache line size detection
+    - arm64: Handle mismatched cache type
+    - arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid()
+    - arm64: dts: rockchip: corrected uart1 clock-names for rk3328
+    - KVM: arm/arm64: Fix potential loss of ptimer interrupts
+    - KVM: arm/arm64: Fix lost IRQs from emulated physcial timer when blocked
+    - KVM: arm/arm64: Skip updating PMD entry if no change
+    - KVM: arm/arm64: Skip updating PTE entry if no change
+    - s390/kvm: fix deadlock when killed by oom
+    - perf kvm: Fix subcommands on s390
+    - stop_machine: Reflow cpu_stop_queue_two_works()
+    - stop_machine: Atomically queue and wake stopper threads
+    - ext4: check for NUL characters in extended attribute's name
+    - ext4: use ext4_warning() for sb_getblk failure
+    - ext4: sysfs: print ext4_super_block fields as little-endian
+    - ext4: reset error code in ext4_find_entry in fallback
+    - ext4: fix race when setting the bitmap corrupted flag
+    - x86/gpu: reserve ICL's graphics stolen memory
+    - platform/x86: wmi: Do not mix pages and kmalloc
+    - platform/x86: ideapad-laptop: Apply no_hw_rfkill to Y20-15IKBM, too
+    - mm: move tlb_table_flush to tlb_flush_mmu_free
+    - mm/tlb, x86/mm: Support invalidating TLB caches for RCU_TABLE_FREE
+    - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
+    - x86/speculation/l1tf: Fix off-by-one error when warning that system has too
+      much RAM
+    - x86/speculation/l1tf: Suggest what to do on systems with too much RAM
+    - x86/vdso: Fix vDSO build if a retpoline is emitted
+    - x86/process: Re-export start_thread()
+    - KVM: x86: ensure all MSRs can always be KVM_GET/SET_MSR'd
+    - KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled
+    - fuse: Don't access pipe->buffers without pipe_lock()
+    - fuse: fix initial parallel dirops
+    - fuse: fix double request_end()
+    - fuse: fix unlocked access to processing queue
+    - fuse: umount should wait for all requests
+    - fuse: Fix oops at process_init_reply()
+    - fuse: Add missed unlock_page() to fuse_readpages_fill()
+    - lib/vsprintf: Do not handle %pO[^F] as %px
+    - udl-kms: change down_interruptible to down
+    - udl-kms: handle allocation failure
+    - udl-kms: fix crash due to uninitialized memory
+    - udl-kms: avoid division
+    - b43legacy/leds: Ensure NUL-termination of LED name string
+    - b43/leds: Ensure NUL-termination of LED name string
+    - ASoC: dpcm: don't merge format from invalid codec dai
+    - ASoC: zte: Fix incorrect PCM format bit usages
+    - ASoC: sirf: Fix potential NULL pointer dereference
+    - ASoC: wm_adsp: Correct DSP pointer for preloader control
+    - soc: qcom: rmtfs-mem: fix memleak in probe error paths
+    - pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show()
+    - scsi: qla2xxx: Fix stalled relogin
+    - x86/vdso: Fix lsl operand order
+    - x86/nmi: Fix NMI uaccess race against CR3 switching
+    - x86/irqflags: Mark native_restore_fl extern inline
+    - x86/spectre: Add missing family 6 check to microcode check
+    - x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
+    - hwmon: (nct6775) Fix potential Spectre v1
+    - x86/entry/64: Wipe KASAN stack shadow before rewind_stack_do_exit()
+    - x86: Allow generating user-space headers without a compiler
+    - s390/mm: fix addressing exception after suspend/resume
+    - s390/lib: use expoline for all bcr instructions
+    - s390: fix br_r1_trampoline for machines without exrl
+    - s390/qdio: reset old sbal_state flags
+    - s390/numa: move initial setup of node_to_cpumask_map
+    - s390/purgatory: Fix crash with expoline enabled
+    - s390/purgatory: Add missing FORCE to Makefile targets
+    - kprobes: Show blacklist addresses as same as kallsyms does
+    - kprobes: Replace %p with other pointer types
+    - kprobes/arm: Fix %p uses in error messages
+    - kprobes: Make list and blacklist root user read only
+    - MIPS: Correct the 64-bit DSP accumulator register size
+    - MIPS: memset.S: Fix byte_fixup for MIPSr6
+    - MIPS: Always use -march=<arch>, not -<arch> shortcuts
+    - MIPS: Change definition of cpu_relax() for Loongson-3
+    - MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7
+    - tpm: Return the actual size when receiving an unsupported command
+    - tpm: separate cmd_ready/go_idle from runtime_pm
+    - scsi: mpt3sas: Fix calltrace observed while running IO & reset
+    - scsi: mpt3sas: Fix _transport_smp_handler() error path
+    - scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
+    - scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock
+    - iscsi target: fix session creation failure handling
+    - mtd: rawnand: hynix: Use ->exec_op() in hynix_nand_reg_write_op()
+    - mtd: rawnand: fsmc: Stop using chip->read_buf()
+    - mtd: rawnand: marvell: add suspend and resume hooks
+    - mtd: rawnand: qcom: wait for desc completion in all BAM channels
+    - clk: rockchip: fix clk_i2sout parent selection bits on rk3399
+    - clk: npcm7xx: fix memory allocation
+    - PM / clk: signedness bug in of_pm_clk_add_clks()
+    - power: generic-adc-battery: fix out-of-bounds write when copying channel
+      properties
+    - power: generic-adc-battery: check for duplicate properties copied from iio
+      channels
+    - watchdog: Mark watchdog touch functions as notrace
+    - cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status
+    - x86/dumpstack: Don't dump kernel memory based on usermode RIP
+    - Linux 4.18.6
+    - updateconfigs after v4.18.6 stable update
+
+  * random oopses on s390 systems using NVMe devices (LP: #1790480)
+    - s390/pci: fix out of bounds access during irq setup
+
+  * [18.10 FEAT] zcrypt DD: introduce APQN tags to support deterministic driver
+    binding (LP: #1784331)
+    - s390/zcrypt: code beautify
+    - s390/zcrypt: AP bus support for alternate driver(s)
+    - s390/zcrypt: hex string mask improvements for apmask and aqmask.
+
+  * performance drop with ATS enabled (LP: #1788097)
+    - powerpc/powernv: Fix concurrency issue with npu->mmio_atsd_usage
+
+  * Fix MCE handling for user access of poisoned device-dax mapping
+    (LP: #1774366)
+    - device-dax: Convert to vmf_insert_mixed and vm_fault_t
+    - device-dax: Enable page_mapping()
+    - device-dax: Set page->index
+    - filesystem-dax: Set page->index
+    - mm, madvise_inject_error: Disable MADV_SOFT_OFFLINE for ZONE_DEVICE pages
+    - mm, dev_pagemap: Do not clear ->mapping on final put
+    - mm, madvise_inject_error: Let memory_failure() optionally take a page
+      reference
+    - mm, memory_failure: Collect mapping size in collect_procs()
+    - filesystem-dax: Introduce dax_lock_mapping_entry()
+    - mm, memory_failure: Teach memory_failure() about dev_pagemap pages
+    - x86/mm/pat: Prepare {reserve, free}_memtype() for "decoy" addresses
+    - x86/memory_failure: Introduce {set, clear}_mce_nospec()
+    - libnvdimm, pmem: Restore page attributes when clearing errors
+
+  * Reconcile hns3 SAUCE patches with upstream (LP: #1787477)
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix comments for
+      hclge_get_ring_chain_from_mbx"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for using wrong mask and
+      shift in hclge_get_ring_chain_from_mbx"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for reset_level default
+      assignment probelm"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unnecessary ring
+      configuration operation while resetting"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix return value error in
+      hns3_reset_notify_down_enet"
+    - Revert "UBUNTU: SAUCE: net: hns3: Fix for phy link issue when using marvell
+      phy driver"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: separate roce from nic when
+      resetting"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: correct reset event status
+      register"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: prevent to request reset
+      frequently"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: reset net device with rtnl_lock"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify the order of initializeing
+      command queue register"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: prevent sending command during
+      global or core reset"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Use roce handle when calling roce
+      callback function"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove the warning when clear
+      reset cause"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix get_vector ops in
+      hclgevf_main module"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix warning bug when doing lp
+      selftest"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add configure for mac minimal
+      frame size"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for mailbox message truncated
+      problem"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for l4 checksum offload bug"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for waterline not setting
+      correctly"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix for mac pause not disable in
+      pfc mode"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix tc setup when netdev is first
+      up"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add calling roce callback
+      function when link status change"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: optimize the process of notifying
+      roce client"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add pf reset for hip08 RoCE"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: Add SPDX tags to hns3 driver"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused struct member and
+      definition"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix mislead parameter name"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify inconsistent bit mask
+      macros"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use decimal for bit offset
+      macros"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: fix unreasonable code comments"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove extra space and brackets"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: standardize the handle of return
+      value"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some redundant
+      assignments"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: modify hnae_ to hnae3_"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use dma_zalloc_coherent instead
+      of kzalloc/dma_map_single"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: give default option while
+      dependency HNS3 set"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some unused members of
+      some structures"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove a redundant
+      hclge_cmd_csq_done"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: using modulo for cyclic counters
+      in hclge_cmd_send"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: simplify hclge_cmd_csq_clean"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove some redundant
+      assignments"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove useless code in
+      hclge_cmd_send"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused
+      hclge_ring_to_dma_dir"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: use lower_32_bits and
+      upper_32_bits"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove back in struct hclge_hw"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add unlikely for error check"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove the Redundant put_vector
+      in hns3_client_uninit"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: print the ret value in error
+      information"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: extraction an interface for state
+      state init|uninit"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove unused head file in
+      hnae3.c"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add l4_type check for both ipv4
+      and ipv6"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add vector status check before
+      free vector"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: rename the interface for
+      init_client_instance and uninit_client_instance"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: remove hclge_get_vector_index
+      from hclge_bind_ring_with_vector"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: RX BD information valid only in
+      last BD except VLD bit and buffer size"
+    - Revert "UBUNTU: SAUCE: {topost} net: hns3: add support for serdes loopback
+      selftest"
+    - net: hns3: Updates RX packet info fetch in case of multi BD
+    - net: hns3: remove hclge_get_vector_index from hclge_bind_ring_with_vector
+    - net: hns3: rename the interface for init_client_instance and
+      uninit_client_instance
+    - net: hns3: add vector status check before free vector
+    - net: hns3: add l4_type check for both ipv4 and ipv6
+    - net: hns3: add unlikely for error check
+    - net: hns3: remove unused head file in hnae3.c
+    - net: hns3: extraction an interface for state init|uninit
+    - net: hns3: print the ret value in error information
+    - net: hns3: remove the Redundant put_vector in hns3_client_uninit
+    - net: hns3: remove back in struct hclge_hw
+    - net: hns3: use lower_32_bits and upper_32_bits
+    - net: hns3: remove unused hclge_ring_to_dma_dir
+    - net: hns3: remove useless code in hclge_cmd_send
+    - net: hns3: remove some redundant assignments
+    - net: hns3: simplify hclge_cmd_csq_clean
+    - net: hns3: remove a redundant hclge_cmd_csq_done
+    - net: hns3: remove some unused members of some structures
+    - net: hns3: give default option while dependency HNS3 set
+    - net: hns3: use dma_zalloc_coherent instead of kzalloc/dma_map_single
+    - net: hns3: modify hnae_ to hnae3_
+    - net: hns3: Fix tc setup when netdev is first up
+    - net: hns3: Fix for mac pause not disable in pfc mode
+    - net: hns3: Fix for waterline not setting correctly
+    - net: hns3: Fix for l4 checksum offload bug
+    - net: hns3: Fix for mailbox message truncated problem
+    - net: hns3: Add configure for mac minimal frame size
+    - net: hns3: Fix warning bug when doing lp selftest
+    - net: hns3: Fix get_vector ops in hclgevf_main module
+    - net: hns3: Remove the warning when clear reset cause
+    - net: hns3: Prevent sending command during global or core reset
+    - net: hns3: Modify the order of initializing command queue register
+    - net: hns3: Reset net device with rtnl_lock
+    - net: hns3: Prevent to request reset frequently
+    - net: hns3: Correct reset event status register
+    - net: hns3: Fix return value error in hns3_reset_notify_down_enet
+    - net: hns3: remove unnecessary ring configuration operation while resetting
+    - net: hns3: Fix for reset_level default assignment probelm
+    - net: hns3: Fix for using wrong mask and shift in
+      hclge_get_ring_chain_from_mbx
+    - net: hns3: Fix comments for hclge_get_ring_chain_from_mbx
+    - net: hns3: Remove some redundant assignments
+    - net: hns3: Standardize the handle of return value
+    - net: hns3: Remove extra space and brackets
+    - net: hns3: Correct unreasonable code comments
+    - net: hns3: Use decimal for bit offset macros
+    - net: hns3: Modify inconsistent bit mask macros
+    - net: hns3: Fix misleading parameter name
+    - net: hns3: Remove unused struct member and definition
+    - net: hns3: Add SPDX tags to HNS3 PF driver
+    - net: hns3: Add support for serdes loopback selftest
+    - net: hns3: Fix for phy link issue when using marvell phy driver
+
+  * [Regression] kernel crashdump fails on arm64 (LP: #1786878)
+    - arm64: export memblock_reserve()d regions via /proc/iomem
+    - drivers: acpi: add dependency of EFI for arm64
+    - efi/arm: preserve early mapping of UEFI memory map longer for BGRT
+    - efi/arm: map UEFI memory map even w/o runtime services enabled
+    - arm64: acpi: fix alignment fault in accessing ACPI
+    - [Config] CONFIG_ARCH_SUPPORTS_ACPI=y
+    - arm64: fix ACPI dependencies
+    - ACPI: fix menuconfig presentation of ACPI submenu
+
+  * TB 16 issue on Dell Lattitude 7490 with large amount of data (LP: #1785780)
+    - r8152: disable RX aggregation on new Dell TB16 dock
+
+  * Support Power Management for Thunderbolt Controller  (LP: #1789358)
+    - thunderbolt: Use 64-bit DMA mask if supported by the platform
+    - thunderbolt: Do not unnecessarily call ICM get route
+    - thunderbolt: No need to take tb->lock in domain suspend/complete
+    - thunderbolt: Use correct ICM commands in system suspend
+    - thunderbolt: Add support for runtime PM
+
+  * Enable AMD PCIe MP2 for AMDI0011 (LP: #1773940)
+    - SAUCE: i2c:amd I2C Driver based on PCI Interface for upcoming platform
+    - SAUCE: i2c:amd move out pointer in union i2c_event_base
+    - SAUCE: i2c:amd Depends on ACPI
+    - [Config] i2c: CONFIG_I2C_AMD_MP2=y on x86
+
+  * Microphone cannot be detected with front panel audio combo jack on HP Z8-G4
+    machine (LP: #1789145)
+    - ALSA: hda/realtek - Fix HP Headset Mic can't record
+
+  * Please enable CONFIG_PAGE_POISONING (LP: #1783651)
+    - [Config] Enable CONFIG_PAGE_POISONING configs
+
+  * Tango platform uses __initcall without further checks (LP: #1787945)
+    - [Config] disable ARCH_TANGO
+
+  * [18.10 FEAT] SMC-Direct (LP: #1786902)
+    - net/smc: determine port attributes independent from pnet table
+    - net/smc: add pnetid support
+    - net/smc: add base infrastructure for SMC-D and ISM
+    - net/smc: add pnetid support for SMC-D and ISM
+    - net/smc: add SMC-D support in CLC messages
+    - net/smc: add SMC-D support in data transfer
+    - net/smc: add SMC-D support in af_smc
+    - net/smc: add SMC-D diag support
+    - net/smc: provide smc mode in smc_diag.c
+    - net/smc: eliminate cursor read and write calls
+    - net/smc: add function to get link group from link
+    - net/smc: use DECLARE_BITMAP for rtokens_used_mask
+    - net/smc: remove local variable page in smc_rx_splice()
+    - net/smc: Remove a WARN_ON() statement
+    - net/smc: Simplify ib_post_(send|recv|srq_recv)() calls
+    - net/smc: fewer parameters for smc_llc_send_confirm_link()
+    - net/smc: use correct vlan gid of RoCE device
+    - net/smc: provide fallback reason code
+    - net/smc: improve delete link processing
+    - net: simplify sock_poll_wait
+    - net/smc: send response to test link signal
+
+  * Miscellaneous Ubuntu changes
+    - [Config] update annotations for CONFIG_CRYPTO_SPECK_NEON
+    - [Config] fix up annotatios for CONFIG_CRYPTO_SPECK
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 10 Sep 2018 07:08:38 -0500
+
+linux (4.18.0-7.8) cosmic; urgency=medium
+
+  * linux: 4.18.0-7.8 -proposed tracker (LP: #1789459)
+
+  * pmtu.sh fails on 4.18 kernel (LP: #1789436)
+    - SAUCE: Revert "vti6: fix PMTU caching and reporting on xmit"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Aug 2018 11:08:51 -0500
+
+linux (4.18.0-6.7) cosmic; urgency=medium
+
+  * linux: 4.18.0-6.7 -proposed tracker (LP: #1788881)
+
+  * systemd 237-3ubuntu10 ADT test failure with linux 4.18.0-5.6 (LP: #1787440)
+    - Config: Disable BPF_JIT_ALWAYS_ON on i386
+
+  * execveat03 in ubuntu_ltp_syscalls failed on X/B (LP: #1786729)
+    - cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()
+
+  * Cosmic update to v4.18.5 stable release (LP: #1788874)
+    - EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[]
+    - pty: fix O_CLOEXEC for TIOCGPTPEER
+    - mm: Allow non-direct-map arguments to free_reserved_area()
+    - x86/mm/init: Pass unconverted symbol addresses to free_init_pages()
+    - x86/mm/init: Add helper for freeing kernel image pages
+    - x86/mm/init: Remove freed kernel image areas from alias mapping
+    - powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2
+    - ext4: fix spectre gadget in ext4_mb_regular_allocator()
+    - drm/i915/kvmgt: Fix potential Spectre v1
+    - drm/amdgpu/pm: Fix potential Spectre v1
+    - parisc: Remove unnecessary barriers from spinlock.h
+    - parisc: Remove ordered stores from syscall.S
+    - PCI: Restore resized BAR state on resume
+    - PCI / ACPI / PM: Resume all bridges on suspend-to-RAM
+    - PCI: hotplug: Don't leak pci_slot on registration failure
+    - PCI: aardvark: Size bridges before resources allocation
+    - PCI: Skip MPS logic for Virtual Functions (VFs)
+    - PCI: pciehp: Fix use-after-free on unplug
+    - PCI: pciehp: Fix unprotected list iteration in IRQ handler
+    - i2c: core: ACPI: Properly set status byte to 0 for multi-byte writes
+    - i2c: imx: Fix race condition in dma read
+    - reiserfs: fix broken xattr handling (heap corruption, bad retval)
+    - Linux 4.18.5
+
+  * [18.10 FEAT] Add kernel config option "CONFIG_SCLP_OFB" (LP: #1787898)
+    - [Config] CONFIG_SCLP_OFB=y for s390x
+
+  * errors when scanning partition table of corrupted AIX disk (LP: #1787281)
+    - partitions/aix: fix usage of uninitialized lv_info and lvname structures
+    - partitions/aix: append null character to print data from disk
+
+  * Apply NVMe bugfix from Google that bjf asked for (LP: #1787635)
+    - nvme-pci: add a memory barrier to nvme_dbbuf_update_and_check_event
+
+  * ThinkPad systems have no HDMI sound when using the nvidia GPU (LP: #1787058)
+    - ACPI / OSI: Add OEM _OSI string to enable NVidia HDMI audio
+
+  * Cosmic update to v4.18.4 stable release (LP: #1788454)
+    - l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache
+    - net_sched: fix NULL pointer dereference when delete tcindex filter
+    - net_sched: Fix missing res info when create new tc_index filter
+    - r8169: don't use MSI-X on RTL8168g
+    - ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs
+    - ALSA: hda - Turn CX8200 into D3 as well upon reboot
+    - ALSA: vx222: Fix invalid endian conversions
+    - ALSA: virmidi: Fix too long output trigger loop
+    - ALSA: cs5535audio: Fix invalid endian conversion
+    - ALSA: dice: fix wrong copy to rx parameters for Alesis iO26
+    - ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry
+    - ALSA: memalloc: Don't exceed over the requested size
+    - ALSA: vxpocket: Fix invalid endian conversions
+    - ALSA: seq: Fix poll() error return
+    - media: gl861: fix probe of dvb_usb_gl861
+    - USB: serial: sierra: fix potential deadlock at close
+    - USB: serial: pl2303: add a new device id for ATEN
+    - USB: option: add support for DW5821e
+    - ACPI / PM: save NVS memory for ASUS 1025C laptop
+    - tty: serial: 8250: Revert NXP SC16C2552 workaround
+    - serial: 8250_exar: Read INT0 from slave device, too
+    - serial: 8250_dw: always set baud rate in dw8250_set_termios
+    - serial: 8250_dw: Add ACPI support for uart on Broadcom SoC
+    - uio: fix wrong return value from uio_mmap()
+    - misc: sram: fix resource leaks in probe error path
+    - Revert "uio: use request_threaded_irq instead"
+    - Bluetooth: avoid killing an already killed socket
+    - isdn: Disable IIOCDBGVAR
+    - net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd()
+    - hv/netvsc: Fix NULL dereference at single queue mode fallback
+    - r8169: don't use MSI-X on RTL8106e
+    - ip_vti: fix a null pointer deferrence when create vti fallback tunnel
+    - net: ethernet: mvneta: Fix napi structure mixup on armada 3700
+    - net: mvneta: fix mvneta_config_rss on armada 3700
+    - cls_matchall: fix tcf_unbind_filter missing
+    - Linux 4.18.4
+
+  * Cosmic update to v4.18.3 stable release (LP: #1788453)
+    - x86/speculation/l1tf: Exempt zeroed PTEs from inversion
+    - Linux 4.18.3
+
+  * Cosmic update to v4.18.2 stable release (LP: #1788452)
+    - x86/l1tf: Fix build error seen if CONFIG_KVM_INTEL is disabled
+    - x86: i8259: Add missing include file
+    - x86/hyper-v: Check for VP_INVAL in hyperv_flush_tlb_others()
+    - x86/platform/UV: Mark memblock related init code and data correctly
+    - x86/mm/pti: Clear Global bit more aggressively
+    - xen/pv: Call get_cpu_address_sizes to set x86_virt/phys_bits
+    - x86/mm: Disable ioremap free page handling on x86-PAE
+    - kbuild: verify that $DEPMOD is installed
+    - crypto: ccree - fix finup
+    - crypto: ccree - fix iv handling
+    - crypto: ccp - Check for NULL PSP pointer at module unload
+    - crypto: ccp - Fix command completion detection race
+    - crypto: x86/sha256-mb - fix digest copy in sha256_mb_mgr_get_comp_job_avx2()
+    - crypto: vmac - require a block cipher with 128-bit block size
+    - crypto: vmac - separate tfm and request context
+    - crypto: blkcipher - fix crash flushing dcache in error path
+    - crypto: ablkcipher - fix crash flushing dcache in error path
+    - crypto: skcipher - fix aligning block size in skcipher_copy_iv()
+    - crypto: skcipher - fix crash flushing dcache in error path
+    - ioremap: Update pgtable free interfaces with addr
+    - x86/mm: Add TLB purge to free pmd/pte page interfaces
+    - Linux 4.18.2
+
+  * Cosmic update to v4.18.2 stable release (LP: #1788452) // CVE-2018-9363
+    - Bluetooth: hidp: buffer overflow in hidp_process_report
+
+  * linux-cloud-tools-common: Ensure hv-kvp-daemon.service starts before
+    walinuxagent.service (LP: #1739107)
+    - [Debian] hyper-v -- Ensure that hv-kvp-daemon.service starts before
+      walinuxagent.service
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: ipvs: remove nbsp characters from Kconfig
+    - [Config] CONFIG_MPROFILE_KERNEL=y for ppc64el
+    - [Config] CONFIG_DRM_RCAR_LVDS=m for snapdragon
+    - [Config] CONFIG_MDIO_MSCC_MIIM=n for s390x
+    - [Config] CONFIG_NET_VENDOR_MICROSEMI=n, CONFIG_NET_VENDOR_NI=n for s390x
+    - [Config] update annotations following config review
+    - [Debian] set CROSS_COMPILE when generating kernel configs
+    - [Config] Disable the Speck cipher
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 24 Aug 2018 14:18:15 -0500
+
+linux (4.18.0-5.6) cosmic; urgency=medium
+
+  * Cosmic update to v4.18.1 stable release (LP: #1787264)
+    - x86/paravirt: Fix spectre-v2 mitigations for paravirt guests
+    - x86/speculation: Protect against userspace-userspace spectreRSB
+    - kprobes/x86: Fix %p uses in error messages
+    - x86/irqflags: Provide a declaration for native_save_fl
+    - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
+    - x86/speculation/l1tf: Change order of offset/type in swap entry
+    - x86/speculation/l1tf: Protect swap entries against L1TF
+    - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
+    - x86/speculation/l1tf: Make sure the first page is always reserved
+    - x86/speculation/l1tf: Add sysfs reporting for l1tf
+    - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
+    - x86/speculation/l1tf: Limit swap file size to MAX_PA/2
+    - x86/bugs: Move the l1tf function and define pr_fmt properly
+    - sched/smt: Update sched_smt_present at runtime
+    - x86/smp: Provide topology_is_primary_thread()
+    - x86/topology: Provide topology_smt_supported()
+    - cpu/hotplug: Make bringup/teardown of smp threads symmetric
+    - cpu/hotplug: Split do_cpu_down()
+    - cpu/hotplug: Provide knobs to control SMT
+    - x86/cpu: Remove the pointless CPU printout
+    - x86/cpu/AMD: Remove the pointless detect_ht() call
+    - x86/cpu/common: Provide detect_ht_early()
+    - x86/cpu/topology: Provide detect_extended_topology_early()
+    - x86/cpu/intel: Evaluate smp_num_siblings early
+    - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info
+    - x86/cpu/AMD: Evaluate smp_num_siblings early
+    - x86/apic: Ignore secondary threads if nosmt=force
+    - x86/speculation/l1tf: Extend 64bit swap file size limit
+    - x86/cpufeatures: Add detection of L1D cache flush support.
+    - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings
+    - x86/speculation/l1tf: Protect PAE swap entries against L1TF
+    - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
+    - Revert "x86/apic: Ignore secondary threads if nosmt=force"
+    - cpu/hotplug: Boot HT siblings at least once
+    - x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present
+    - x86/KVM/VMX: Add module argument for L1TF mitigation
+    - x86/KVM/VMX: Add L1D flush algorithm
+    - x86/KVM/VMX: Add L1D MSR based flush
+    - x86/KVM/VMX: Add L1D flush logic
+    - x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers
+    - x86/KVM/VMX: Add find_msr() helper function
+    - x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting
+    - x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
+    - x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
+    - cpu/hotplug: Online siblings when SMT control is turned on
+    - x86/litf: Introduce vmx status variable
+    - x86/kvm: Drop L1TF MSR list approach
+    - x86/l1tf: Handle EPT disabled state proper
+    - x86/kvm: Move l1tf setup function
+    - x86/kvm: Add static key for flush always
+    - x86/kvm: Serialize L1D flush parameter setter
+    - x86/kvm: Allow runtime control of L1D flush
+    - cpu/hotplug: Expose SMT control init function
+    - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early
+    - x86/bugs, kvm: Introduce boot-time control of L1TF mitigations
+    - Documentation: Add section about CPU vulnerabilities
+    - x86/speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures
+    - x86/KVM/VMX: Initialize the vmx_l1d_flush_pages' content
+    - Documentation/l1tf: Fix typos
+    - cpu/hotplug: detect SMT disabled by BIOS
+    - x86/KVM/VMX: Don't set l1tf_flush_l1d to true from vmx_l1d_flush()
+    - x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond'
+    - x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush()
+    - x86/irq: Demote irq_cpustat_t::__softirq_pending to u16
+    - x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d
+    - x86: Don't include linux/irq.h from asm/hardirq.h
+    - x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d
+    - x86/KVM/VMX: Don't set l1tf_flush_l1d from vmx_handle_external_intr()
+    - Documentation/l1tf: Remove Yonah processors from not vulnerable list
+    - x86/speculation: Simplify sysfs report of VMX L1TF vulnerability
+    - x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry
+    - KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry
+    - cpu/hotplug: Fix SMT supported evaluation
+    - x86/speculation/l1tf: Invert all not present mappings
+    - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
+    - x86/mm/pat: Make set_memory_np() L1TF safe
+    - x86/mm/kmmio: Make the tracer robust against L1TF
+    - tools headers: Synchronise x86 cpufeatures.h for L1TF additions
+    - x86/microcode: Allow late microcode loading with SMT disabled
+    - x86/smp: fix non-SMP broken build due to redefinition of
+      apic_id_is_primary_thread
+    - cpu/hotplug: Non-SMP machines do not make use of booted_once
+    - x86/init: fix build with CONFIG_SWAP=n
+    - Linux 4.18.1
+    - [Config] updateconfigs after v4.18.1 stable update
+
+  * Consider enabling CONFIG_NETWORK_PHY_TIMESTAMPING (LP: #1785816)
+    - [Config] Enable timestamping in network PHY devices
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_SYSCTL_SYSCALL=n
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 15 Aug 2018 14:20:59 -0500
+
+linux (4.18.0-4.5) cosmic; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Aug 2018 13:54:02 -0500
+
+linux (4.18.0-3.4) cosmic; urgency=medium
+
+  * Suspend fails in Ubuntu and Kubuntu 18.04 but works fine in Ubuntu and
+    Kubuntu 17.10 (and on Kubuntu 18.04 using kernel 4.14.47) (LP: #1774950)
+    - ACPI / LPSS: Avoid PM quirks on suspend and resume from hibernation
+
+  * hinic interfaces aren't getting predictable names (LP: #1783138)
+    - hinic: Link the logical network device to the pci device in sysfs
+
+  * libvirtd is unable to configure bridge devices inside of LXD containers
+    (LP: #1784501)
+    - kernfs: allow creating kernfs objects with arbitrary uid/gid
+    - sysfs, kobject: allow creating kobject belonging to arbitrary users
+    - kobject: kset_create_and_add() - fetch ownership info from parent
+    - driver core: set up ownership of class devices in sysfs
+    - net-sysfs: require net admin in the init ns for setting tx_maxrate
+    - net-sysfs: make sure objects belong to container's owner
+    - net: create reusable function for getting ownership info of sysfs inodes
+    - bridge: make sure objects belong to container's owner
+    - sysfs: Fix regression when adding a file to an existing group
+
+  * locking sockets broken due to missing AppArmor socket mediation patches
+    (LP: #1780227)
+    - UBUNTU SAUCE: apparmor: fix apparmor mediating locking non-fs, unix sockets
+
+  * Update2 for ocxl driver (LP: #1781436)
+    - ocxl: Fix page fault handler in case of fault on dying process
+
+  * HDMI/DP audio can't work on the laptop of Dell Latitude 5495 (LP: #1782689)
+    - ALSA: hda: use PCI_BASE_CLASS_DISPLAY to replace PCI_CLASS_DISPLAY_VGA
+    - vga_switcheroo: set audio client id according to bound GPU id
+
+  * Allow Raven Ridge's audio controller to be runtime suspended (LP: #1782540)
+    - ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge
+
+  * Invoking obsolete 'firmware_install' target breaks snap build (LP: #1782166)
+    - snapcraft.yaml: stop invoking the obsolete (and non-existing)
+      'firmware_install' target
+
+  * snapcraft.yaml: missing ubuntu-retpoline-extract-one script breaks the build
+    (LP: #1782116)
+    - snapcraft.yaml: copy retpoline-extract-one to scripts before build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 01 Aug 2018 08:49:40 -0500
+
+linux (4.18.0-2.3) cosmic; urgency=medium
+
+  * Kernel error "task zfs:pid blocked for more than 120 seconds" (LP: #1781364)
+    - SAUCE: (noup) zfs to 0.7.9-3ubuntu4
+
+  * [Regression] EXT4-fs error (device sda1): ext4_validate_inode_bitmap:99:
+    comm stress-ng: Corrupt inode bitmap (LP: #1780137)
+    - SAUCE: ext4: fix ext4_validate_inode_bitmap: comm stress-ng: Corrupt inode
+      bitmap
+
+  * Cloud-init causes potentially huge boot delays with 4.15 kernels
+    (LP: #1780062)
+    - random: Make getrandom() ready earlier
+
+  * hisi_sas_v3_hw: internal task abort: timeout and not done. (LP: #1777736)
+    - scsi: hisi_sas: Update a couple of register settings for v3 hw
+
+  * hisi_sas: Add missing PHY spinlock init (LP: #1777734)
+    - scsi: hisi_sas: Add missing PHY spinlock init
+
+  * hisi_sas: improve read performance by pre-allocating slot DMA buffers
+    (LP: #1777727)
+    - scsi: hisi_sas: Use dmam_alloc_coherent()
+    - scsi: hisi_sas: Pre-allocate slot DMA buffers
+
+  * hisi_sas: Failures during host reset (LP: #1777696)
+    - scsi: hisi_sas: Only process broadcast change in phy_bcast_v3_hw()
+    - scsi: hisi_sas: Fix the conflict between dev gone and host reset
+    - scsi: hisi_sas: Adjust task reject period during host reset
+    - scsi: hisi_sas: Add a flag to filter PHY events during reset
+    - scsi: hisi_sas: Release all remaining resources in clear nexus ha
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.9-3ubuntu2, zfs to 0.7.9-3ubuntu3
+    - SAUCE: mm: Fix exports that inadvertently make put_page() EXPORT_SYMBOL_GPL
+    - Enable zfs build
+    - SAUCE: Import aufs driver
+    - Revert "UBUNTU: [Config]: set CONFIG_EDAC_DEBUG=y for ARM64"
+    - [Config] retpoline -- review and accept retpoline changes
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc5
+  * Rebase to v4.18-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 24 Jul 2018 08:41:22 -0500
+
+linux (4.18.0-1.2) cosmic; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 09 Jul 2018 07:36:31 -0500
+
+linux (4.18.0-0.1) cosmic; urgency=medium
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu -- disable vbox build
+    - Disable zfs build
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown
+    - SAUCE: (efi-lockdown) ima: require secure_boot rules in lockdown mode
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/{mem,kmem,port} when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) kexec_load: Disable at runtime if the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86/msr: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Lock down module params that specify hardware
+      parameters (eg. ioport)
+    - SAUCE: (efi-lockdown) x86/mmiotrace: Lock down the testmmiotrace module
+    - SAUCE: (efi-lockdown) Lock down /proc/kcore
+    - SAUCE: (efi-lockdown) Lock down kprobes
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) Lock down perf
+    - SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) Make get_cert_list() not complain about cert lists
+      that aren't present.
+    - SAUCE: (efi-lockdown) Add efi_status_to_str() and rework
+      efi_status_to_err().
+    - SAUCE: (efi-lockdown) Make get_cert_list() use efi_status_to_str() to print
+      error messages.
+    - SAUCE: (efi-lockdown) lockdown: fix coordination of kernel module signature
+      verification
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Don't print secure boot state from the efi stub
+    - SAUCE: (namespace) block_dev: Support checking inode permissions in
+      lookup_bdev()
+    - SAUCE: (namespace) block_dev: Check permissions towards block device inode
+      when mounting
+    - SAUCE: (namespace) mtd: Check permissions towards mtd block device inode
+      when mounting
+    - SAUCE: (namespace) ext4: Add support for unprivileged mounts from user
+      namespaces
+    - SAUCE: (namespace) ext4: Add module parameter to enable user namespace
+      mounts
+    - SAUCE: (namespace) block_dev: Forbid unprivileged mounting when device is
+      opened for writing
+    - SAUCE: Import aufs driver
+    - Update dropped.txt
+    - [Config] updateconfigs after 4.18-rc3 rebase
+    - SAUCE: (no-up): ASoC: Intel: bytcr-rt5660: Remove snd_soc_codec use for 4.18
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.18-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 06 Jul 2018 10:46:37 -0500
+
+linux (4.18.0-0.0) cosmic; urgency=medium
+
+  * Dummy entry.
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 03 Jul 2018 11:10:33 -0500
+
+linux (4.17.0-4.5) cosmic; urgency=medium
+
+  * linux: 4.17.0-4.5 -proposed tracker (LP: #1779399)
+
+  * Update to ocxl driver for 18.04.1 (LP: #1775786)
+    - powerpc: Add TIDR CPU feature for POWER9
+    - powerpc: Use TIDR CPU feature to control TIDR allocation
+    - powerpc: use task_pid_nr() for TID allocation
+    - ocxl: Rename pnv_ocxl_spa_remove_pe to clarify it's action
+    - ocxl: Expose the thread_id needed for wait on POWER9
+    - ocxl: Add an IOCTL so userspace knows what OCXL features are available
+    - ocxl: Document new OCXL IOCTLs
+    - ocxl: Fix missing unlock on error in afu_ioctl_enable_p9_wait()
+
+  * Please include ax88179_178a and r8152 modules in d-i udeb (LP: #1771823)
+    - [Config:] d-i: Add ax88179_178a and r8152 to nic-modules
+
+  * glibc pkeys test fail on powerpc (LP: #1776967)
+    - [Config] Temporarily disable CONFIG_PPC_MEM_KEYS
+
+  * After update to 4.13-43 Intel Graphics are Laggy (LP: #1773520)
+    - Revert "drm/i915/edp: Allow alternate fixed mode for eDP if available."
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.9-3ubuntu1, zfs to 0.7.9-3ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 29 Jun 2018 13:37:52 -0500
+
+linux (4.17.0-3.4) cosmic; urgency=medium
+
+  * linux: 4.17.0-3.4 -proposed tracker (LP: #1779124)
+
+  * Cosmic update to v4.17.3 stable release (LP: #1778997)
+    - net: aquantia: fix unsigned numvecs comparison with less than zero
+    - bonding: re-evaluate force_primary when the primary slave name changes
+    - cdc_ncm: avoid padding beyond end of skb
+    - ipv6: allow PMTU exceptions to local routes
+    - net: dsa: add error handling for pskb_trim_rcsum
+    - net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620
+    - net/sched: act_simple: fix parsing of TCA_DEF_DATA
+    - tcp: verify the checksum of the first data segment in a new connection
+    - tls: fix use-after-free in tls_push_record
+    - tls: fix waitall behavior in tls_sw_recvmsg
+    - socket: close race condition between sock_close() and sockfs_setattr()
+    - udp: fix rx queue len reported by diag and proc interface
+    - net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds
+      vlan
+    - hv_netvsc: Fix a network regression after ifdown/ifup
+    - ACPICA: AML parser: attempt to continue loading table after error
+    - ext4: fix hole length detection in ext4_ind_map_blocks()
+    - ext4: update mtime in ext4_punch_hole even if no blocks are released
+    - ext4: do not allow external inodes for inline data
+    - ext4: bubble errors from ext4_find_inline_data_nolock() up to ext4_iget()
+    - ext4: correctly handle a zero-length xattr with a non-zero e_value_offs
+    - ext4: fix fencepost error in check for inode count overflow during resize
+    - driver core: Don't ignore class_dir_create_and_add() failure.
+    - Btrfs: allow empty subvol= again
+    - Btrfs: fix clone vs chattr NODATASUM race
+    - Btrfs: fix memory and mount leak in btrfs_ioctl_rm_dev_v2()
+    - btrfs: return error value if create_io_em failed in cow_file_range
+    - btrfs: scrub: Don't use inode pages for device replace
+    - ALSA: usb-audio: Disable the quirk for Nura headset
+    - ALSA: hda/conexant - Add fixup for HP Z2 G4 workstation
+    - ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
+    - ALSA: hda: add dock and led support for HP EliteBook 830 G5
+    - ALSA: hda: add dock and led support for HP ProBook 640 G4
+    - x86/MCE: Fix stack out-of-bounds write in mce-inject.c: Flags_read()
+    - smb3: fix various xid leaks
+    - smb3: on reconnect set PreviousSessionId field
+    - CIFS: 511c54a2f69195b28afb9dd119f03787b1625bb4 adds a check for session
+      expiry
+    - cifs: For SMB2 security informaion query, check for minimum sized security
+      descriptor instead of sizeof FileAllInformation class
+    - nbd: fix nbd device deletion
+    - nbd: update size when connected
+    - nbd: use bd_set_size when updating disk size
+    - blk-mq: reinit q->tag_set_list entry only after grace period
+    - bdi: Move cgroup bdi_writeback to a dedicated low concurrency workqueue
+    - cpufreq: Fix new policy initialization during limits updates via sysfs
+    - cpufreq: ti-cpufreq: Fix an incorrect error return value
+    - cpufreq: governors: Fix long idle detection logic in load calculation
+    - libata: zpodd: small read overflow in eject_tray()
+    - libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
+    - nvme/pci: Sync controller reset for AER slot_reset
+    - w1: mxc_w1: Enable clock before calling clk_get_rate() on it
+    - x86/vector: Fix the args of vector_alloc tracepoint
+    - x86/apic/vector: Prevent hlist corruption and leaks
+    - x86/apic: Provide apic_ack_irq()
+    - x86/ioapic: Use apic_ack_irq()
+    - x86/platform/uv: Use apic_ack_irq()
+    - irq_remapping: Use apic_ack_irq()
+    - genirq/generic_pending: Do not lose pending affinity update
+    - genirq/affinity: Defer affinity setting if irq chip is busy
+    - genirq/migration: Avoid out of line call if pending is not set
+    - x86/intel_rdt: Enable CMT and MBM on new Skylake stepping
+    - media: uvcvideo: Prevent setting unavailable flags
+    - media: rc: ensure input/lirc device can be opened after register
+    - iwlwifi: fw: harden page loading code
+    - orangefs: set i_size on new symlink
+    - orangefs: report attributes_mask and attributes for statx
+    - HID: intel_ish-hid: ipc: register more pm callbacks to support hibernation
+    - HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large
+    - vhost: fix info leak due to uninitialized memory
+    - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
+    - Linux 4.17.3
+
+  * Use-after-free in sk_peer_label (LP: #1778646)
+    - SAUCE: apparmor: fix use after free in sk_peer_label
+
+  * kernel: Fix memory leak on CCA and EP11 CPRB processing. (LP: #1775390)
+    - s390/zcrypt: Fix CCA and EP11 CPRB processing failure memory leak.
+
+  * Various fixes for CXL kernel module (LP: #1774471)
+    - cxl: Configure PSL to not use APC virtual machines
+    - cxl: Disable prefault_mode in Radix mode
+
+  * Bluetooth not working (LP: #1764645)
+    - Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
+
+  * Fake SAS addresses for SATA disks on HiSilicon D05 are non-unique
+    (LP: #1776750)
+    - scsi: hisi_sas: make SAS address of SATA disks unique
+
+  * linux-snapdragon: wcn36xx: mac address generation on boot (LP: #1776491)
+    - [Config] arm64: snapdragon: WCN36XX_SNAPDRAGON_HACKS=y
+    - SAUCE: wcn36xx: read MAC from file or randomly generate one
+
+  * Lenovo V330 needs patch in ideapad_laptop module for rfkill (LP: #1774636)
+    - SAUCE: Add Lenovo V330 to the ideapad_laptop rfkill blacklist
+
+  * register on binfmt_misc may overflow and crash the system (LP: #1775856)
+    - fs/binfmt_misc.c: do not allow offset overflow
+
+  * Network installs fail on SocioNext board (LP: #1775884)
+    - net: socionext: reset hardware in ndo_stop
+    - net: netsec: enable tx-irq during open callback
+
+  * Fix several bugs in RDMA/hns driver (LP: #1770974)
+    - RDMA/hns: Drop local zgid in favor of core defined variable
+    - RDMA/hns: Add 64KB page size support for hip08
+    - RDMA/hns: Rename the idx field of db
+    - RDMA/hns: Modify uar allocation algorithm to avoid bitmap exhaust
+    - RDMA/hns: Increase checking CMQ status timeout value
+    - RDMA/hns: Add reset process for RoCE in hip08
+    - RDMA/hns: Fix the illegal memory operation when cross page
+    - RDMA/hns: Implement the disassociate_ucontext API
+
+  * powerpc/livepatch: Implement reliable stack tracing for the consistency
+    model (LP: #1771844)
+    - powerpc/livepatch: Implement reliable stack tracing for the consistency
+      model
+
+  * Adding back alx WoL feature (LP: #1772610)
+    - SAUCE: Revert "alx: remove WoL support"
+    - SAUCE: alx: add enable_wol paramenter
+
+  * Lancer A0 Asic HBA's won't boot with 18.04 (LP: #1768103)
+    - scsi: lpfc: Fix WQ/CQ creation for older asic's.
+    - scsi: lpfc: Fix 16gb hbas failing cq create.
+
+  * [LTCTest][OPAL][OP920] cpupower idle-info is not listing stop4 and stop5
+    idle states when all CORES are guarded (LP: #1771780)
+    - powerpc/powernv/cpuidle: Init all present cpus for deep states
+
+  * Huawei 25G/100G Network Adapters Unsupported (LP: #1770970)
+    - net-next/hinic: add pci device ids for 25ge and 100ge card
+
+  * Expose arm64 CPU topology to userspace (LP: #1770231)
+    - drivers: base: cacheinfo: move cache_setup_of_node()
+    - drivers: base: cacheinfo: setup DT cache properties early
+    - cacheinfo: rename of_node to fw_token
+    - arm64/acpi: Create arch specific cpu to acpi id helper
+    - ACPI/PPTT: Add Processor Properties Topology Table parsing
+    - [Config] CONFIG_ACPI_PPTT=y
+    - ACPI: Enable PPTT support on ARM64
+    - drivers: base cacheinfo: Add support for ACPI based firmware tables
+    - arm64: Add support for ACPI based firmware tables
+    - arm64: topology: rename cluster_id
+    - arm64: topology: enable ACPI/PPTT based CPU topology
+    - ACPI: Add PPTT to injectable table list
+    - arm64: topology: divorce MC scheduling domain from core_siblings
+
+  * Vcs-Git header on bionic linux source package points to zesty git tree
+    (LP: #1766055)
+    - [Packaging]: Update Vcs-Git
+
+  * Request to revert SAUCE patches in the 18.04 SRU and update with upstream
+    version (LP: #1768431)
+    - scsi: cxlflash: Handle spurious interrupts
+    - scsi: cxlflash: Remove commmands from pending list on timeout
+    - scsi: cxlflash: Synchronize reset and remove ops
+    - SAUCE: (no-up) cxlflash: OCXL diff between v2 and v3
+
+  * hisi_sas robustness fixes (LP: #1774466)
+    - scsi: hisi_sas: delete timer when removing hisi_sas driver
+    - scsi: hisi_sas: print device id for errors
+    - scsi: hisi_sas: Add some checks to avoid free'ing a sas_task twice
+    - scsi: hisi_sas: check host frozen before calling "done" function
+    - scsi: hisi_sas: check sas_dev gone earlier in hisi_sas_abort_task()
+    - scsi: hisi_sas: stop controller timer for reset
+    - scsi: hisi_sas: update PHY linkrate after a controller reset
+    - scsi: hisi_sas: change slot index allocation mode
+    - scsi: hisi_sas: Change common allocation mode of device id
+    - scsi: hisi_sas: Reset disks when discovered
+    - scsi: hisi_sas: Create a scsi_host_template per HW module
+    - scsi: hisi_sas: Init disks after controller reset
+    - scsi: hisi_sas: Try wait commands before before controller reset
+    - scsi: hisi_sas: Include TMF elements in struct hisi_sas_slot
+    - scsi: hisi_sas: Add v2 hw force PHY function for internal ATA command
+    - scsi: hisi_sas: Terminate STP reject quickly for v2 hw
+    - scsi: hisi_sas: Fix return value when get_free_slot() failed
+    - scsi: hisi_sas: Mark PHY as in reset for nexus reset
+
+  * hisi_sas: Support newer v3 hardware (LP: #1774467)
+    - scsi: hisi_sas: update RAS feature for later revision of v3 HW
+    - scsi: hisi_sas: check IPTT is valid before using it for v3 hw
+    - scsi: hisi_sas: fix PI memory size
+    - scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw
+    - scsi: hisi_sas: remove redundant handling to event95 for v3
+    - scsi: hisi_sas: add readl poll timeout helper wrappers
+    - scsi: hisi_sas: workaround a v3 hw hilink bug
+    - scsi: hisi_sas: Add LED feature for v3 hw
+
+  * hisi_sas: improve performance by optimizing DQ locking (LP: #1774472)
+    - scsi: hisi_sas: optimise the usage of DQ locking
+    - scsi: hisi_sas: relocate smp sg map
+    - scsi: hisi_sas: make return type of prep functions void
+    - scsi: hisi_sas: allocate slot buffer earlier
+    - scsi: hisi_sas: Don't lock DQ for complete task sending
+    - scsi: hisi_sas: Use device lock to protect slot alloc/free
+    - scsi: hisi_sas: add check of device in hisi_sas_task_exec()
+    - scsi: hisi_sas: fix a typo in hisi_sas_task_prep()
+
+  * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336)
+    - SAUCE: CacheFiles: fix a read_waiter/read_copier race
+
+  * enable mic-mute hotkey and led on Lenovo M820z and M920z (LP: #1774306)
+    - ALSA: hda/realtek - Enable mic-mute hotkey for several Lenovo AIOs
+
+  * hns3 driver updates (LP: #1768670)
+    - net: hns3: Remove error log when getting pfc stats fails
+    - net: hns3: fix to correctly fetch l4 protocol outer header
+    - net: hns3: Fixes the out of bounds access in hclge_map_tqp
+    - net: hns3: Fixes the error legs in hclge_init_ae_dev function
+    - net: hns3: fix for phy_addr error in hclge_mac_mdio_config
+    - net: hns3: Fix to support autoneg only for port attached with phy
+    - net: hns3: fix a dead loop in hclge_cmd_csq_clean
+    - net: hns3: Fix for packet loss due wrong filter config in VLAN tbls
+    - net: hns3: Remove packet statistics in the range of 8192~12287
+    - net: hns3: Add support of hardware rx-vlan-offload to HNS3 VF driver
+    - net: hns3: Fix for setting mac address when resetting
+    - net: hns3: remove add/del_tunnel_udp in hns3_enet module
+    - net: hns3: fix for cleaning ring problem
+    - net: hns3: refactor the loopback related function
+    - net: hns3: Fix for deadlock problem occurring when unregistering ae_algo
+    - net: hns3: Fix for the null pointer problem occurring when initializing
+      ae_dev failed
+    - net: hns3: Add a check for client instance init state
+    - net: hns3: Change return type of hnae3_register_ae_dev
+    - net: hns3: Change return type of hnae3_register_ae_algo
+    - net: hns3: Change return value in hnae3_register_client
+    - net: hns3: Fixes the back pressure setting when sriov is enabled
+    - net: hns3: Fix for fiber link up problem
+    - net: hns3: Add support of .sriov_configure in HNS3 driver
+    - net: hns3: Fixes the missing PCI iounmap for various legs
+    - net: hns3: Fixes error reported by Kbuild and internal review
+    - net: hns3: Fixes API to fetch ethernet header length with kernel default
+    - net: hns3: cleanup of return values in hclge_init_client_instance()
+    - net: hns3: Fix the missing client list node initialization
+    - net: hns3: Fix for hns3 module is loaded multiple times problem
+    - net: hns3: Use enums instead of magic number in hclge_is_special_opcode
+    - net: hns3: Fix for netdev not running problem after calling net_stop and
+      net_open
+    - net: hns3: Fixes kernel panic issue during rmmod hns3 driver
+    - net: hns3: Fix for CMDQ and Misc. interrupt init order problem
+    - net: hns3: Updates RX packet info fetch in case of multi BD
+    - net: hns3: Add support for tx_accept_tag2 and tx_accept_untag2 config
+    - net: hns3: Add STRP_TAGP field support for hardware revision 0x21
+    - net: hns3: Add support to enable TX/RX promisc mode for H/W rev(0x21)
+    - net: hns3: Fix for PF mailbox receving unknown message
+    - net: hns3: Fixes the state to indicate client-type initialization
+    - net: hns3: Fixes the init of the VALID BD info in the descriptor
+    - net: hns3: Removes unnecessary check when clearing TX/RX rings
+    - net: hns3: Clear TX/RX rings when stopping port & un-initializing client
+    - net: hns3: Remove unused led control code
+    - net: hns3: Adds support for led locate command for copper port
+    - net: hns3: Fixes initalization of RoCE handle and makes it conditional
+    - net: hns3: Disable vf vlan filter when vf vlan table is full
+    - net: hns3: Add support for IFF_ALLMULTI flag
+    - net: hns3: Add repeat address checking for setting mac address
+    - net: hns3: Fix setting mac address error
+    - net: hns3: Fix for service_task not running problem after resetting
+    - net: hns3: Fix for hclge_reset running repeatly problem
+    - net: hns3: Fix for phy not link up problem after resetting
+    - net: hns3: Add missing break in misc_irq_handle
+    - net: hns3: Fix for vxlan tx checksum bug
+    - net: hns3: Optimize the PF's process of updating multicast MAC
+    - net: hns3: Optimize the VF's process of updating multicast MAC
+    - SAUCE: {topost} net: hns3: add support for serdes loopback selftest
+    - SAUCE: {topost} net: hns3: RX BD information valid only in last BD except
+      VLD bit and buffer size
+    - SAUCE: {topost} net: hns3: remove hclge_get_vector_index from
+      hclge_bind_ring_with_vector
+    - SAUCE: {topost} net: hns3: rename the interface for init_client_instance and
+      uninit_client_instance
+    - SAUCE: {topost} net: hns3: add vector status check before free vector
+    - SAUCE: {topost} net: hns3: add l4_type check for both ipv4 and ipv6
+    - SAUCE: {topost} net: hns3: remove unused head file in hnae3.c
+    - SAUCE: {topost} net: hns3: extraction an interface for state state
+      init|uninit
+    - SAUCE: {topost} net: hns3: print the ret value in error information
+    - SAUCE: {topost} net: hns3: remove the Redundant put_vector in
+      hns3_client_uninit
+    - SAUCE: {topost} net: hns3: add unlikely for error check
+    - SAUCE: {topost} net: hns3: remove back in struct hclge_hw
+    - SAUCE: {topost} net: hns3: use lower_32_bits and upper_32_bits
+    - SAUCE: {topost} net: hns3: remove unused hclge_ring_to_dma_dir
+    - SAUCE: {topost} net: hns3: remove useless code in hclge_cmd_send
+    - SAUCE: {topost} net: hns3: remove some redundant assignments
+    - SAUCE: {topost} net: hns3: simplify hclge_cmd_csq_clean
+    - SAUCE: {topost} net: hns3: using modulo for cyclic counters in
+      hclge_cmd_send
+    - SAUCE: {topost} net: hns3: remove a redundant hclge_cmd_csq_done
+    - SAUCE: {topost} net: hns3: remove some unused members of some structures
+    - SAUCE: {topost} net: hns3: give default option while dependency HNS3 set
+    - SAUCE: {topost} net: hns3: use dma_zalloc_coherent instead of
+      kzalloc/dma_map_single
+    - SAUCE: {topost} net: hns3: modify hnae_ to hnae3_
+    - SAUCE: {topost} net: hns3: fix unused function warning in VF driver
+    - SAUCE: {topost} net: hns3: remove some redundant assignments
+    - SAUCE: {topost} net: hns3: standardize the handle of return value
+    - SAUCE: {topost} net: hns3: remove extra space and brackets
+    - SAUCE: {topost} net: hns3: fix unreasonable code comments
+    - SAUCE: {topost} net: hns3: use decimal for bit offset macros
+    - SAUCE: {topost} net: hns3: modify inconsistent bit mask macros
+    - SAUCE: {topost} net: hns3: fix mislead parameter name
+    - SAUCE: {topost} net: hns3: remove unused struct member and definition
+    - SAUCE: {topost} net: hns3: Add SPDX tags to hns3 driver
+    - SAUCE: {topost} net: hns3: Add pf reset for hip08 RoCE
+    - SAUCE: {topost} net: hns3: optimize the process of notifying roce client
+    - SAUCE: {topost} net: hns3: Add calling roce callback function when link
+      status change
+    - SAUCE: {topost} net: hns3: fix tc setup when netdev is first up
+    - SAUCE: {topost} net: hns3: fix for mac pause not disable in pfc mode
+    - SAUCE: {topost} net: hns3: fix for waterline not setting correctly
+    - SAUCE: {topost} net: hns3: fix for l4 checksum offload bug
+    - SAUCE: {topost} net: hns3: fix for mailbox message truncated problem
+    - SAUCE: {topost} net: hns3: Add configure for mac minimal frame size
+    - SAUCE: {topost} net: hns3: fix warning bug when doing lp selftest
+    - SAUCE: {topost} net: hns3: fix get_vector ops in hclgevf_main module
+    - SAUCE: {topost} net: hns3: remove the warning when clear reset cause
+    - SAUCE: {topost} net: hns3: Use roce handle when calling roce callback
+      function
+    - SAUCE: {topost} net: hns3: prevent sending command during global or core
+      reset
+    - SAUCE: {topost} net: hns3: modify the order of initializeing command queue
+      register
+    - SAUCE: {topost} net: hns3: reset net device with rtnl_lock
+    - SAUCE: {topost} net: hns3: prevent to request reset frequently
+    - SAUCE: {topost} net: hns3: correct reset event status register
+    - SAUCE: {topost} net: hns3: separate roce from nic when resetting
+    - SAUCE: net: hns3: Fix for phy link issue when using marvell phy driver
+    - SAUCE: {topost} net: hns3: fix return value error in
+      hns3_reset_notify_down_enet
+    - SAUCE: {topost} net: hns3: remove unnecessary ring configuration operation
+      while resetting
+    - SAUCE: {topost} net: hns3: fix for reset_level default assignment probelm
+    - SAUCE: {topost} net: hns3: fix for using wrong mask and shift in
+      hclge_get_ring_chain_from_mbx
+    - SAUCE: {topost} net: hns3: fix comments for hclge_get_ring_chain_from_mbx
+    - SAUCE: net: hns3: Fix for VF mailbox cannot receiving PF response
+    - SAUCE: net: hns3: Fix for VF mailbox receiving unknown message
+    - SAUCE: net: hns3: Optimize PF CMDQ interrupt switching process
+
+  * CVE-2018-7755
+    - SAUCE: floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
+
+  * Incorrect blacklist of bcm2835_wdt (LP: #1766052)
+    - [Packaging] Fix missing watchdog for Raspberry Pi
+
+  * kernel: Fix arch random implementation (LP: #1775391)
+    - s390/archrandom: Rework arch random implementation.
+
+  * [Ubuntu 1804][boston][ixgbe] EEH causes kernel BUG at /build/linux-
+    jWa1Fv/linux-4.15.0/drivers/pci/msi.c:352 (i2S) (LP: #1776389)
+    - ixgbe/ixgbevf: Free IRQ when PCI error recovery removes the device
+
+  * Cosmic update to v4.17.2 stable release (LP: #1779117)
+    - crypto: chelsio - request to HW should wrap
+    - blkdev_report_zones_ioctl(): Use vmalloc() to allocate large buffers
+    - KVM: X86: Fix reserved bits check for MOV to CR3
+    - KVM: x86: introduce linear_{read,write}_system
+    - kvm: fix typo in flag name
+    - kvm: nVMX: Enforce cpl=0 for VMX instructions
+    - KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and
+      kvm_write_guest_virt_system
+    - kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access
+    - staging: android: ion: Switch to pr_warn_once in ion_buffer_destroy
+    - NFC: pn533: don't send USB data off of the stack
+    - usbip: vhci_sysfs: fix potential Spectre v1
+    - usb-storage: Add support for FL_ALWAYS_SYNC flag in the UAS driver
+    - usb-storage: Add compatibility quirk flags for G-Technologies G-Drive
+    - Input: xpad - add GPD Win 2 Controller USB IDs
+    - phy: qcom-qusb2: Fix crash if nvmem cell not specified
+    - usb: core: message: remove extra endianness conversion in
+      usb_set_isoch_delay
+    - usb: typec: wcove: Remove dependency on HW FSM
+    - usb: gadget: function: printer: avoid wrong list handling in printer_write()
+    - usb: gadget: udc: renesas_usb3: fix double phy_put()
+    - usb: gadget: udc: renesas_usb3: should remove debugfs
+    - usb: gadget: udc: renesas_usb3: should call pm_runtime_enable() before add
+      udc
+    - usb: gadget: udc: renesas_usb3: should call devm_phy_get() before add udc
+    - usb: gadget: udc: renesas_usb3: should fail if devm_phy_get() returns error
+    - usb: gadget: udc: renesas_usb3: disable the controller's irqs for
+      reconnecting
+    - serial: sh-sci: Stop using printk format %pCr
+    - tty/serial: atmel: use port->name as name in request_irq()
+    - serial: samsung: fix maxburst parameter for DMA transactions
+    - serial: 8250: omap: Fix idling of clocks for unused uarts
+    - vmw_balloon: fixing double free when batching mode is off
+    - doc: fix sysfs ABI documentation
+    - arm64: defconfig: Enable CONFIG_PINCTRL_MT7622 by default
+    - tty: pl011: Avoid spuriously stuck-off interrupts
+    - crypto: ccree - correct host regs offset
+    - Input: goodix - add new ACPI id for GPD Win 2 touch screen
+    - Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID
+    - crypto: caam - strip input zeros from RSA input buffer
+    - crypto: caam - fix DMA mapping dir for generated IV
+    - crypto: caam - fix IV DMA mapping and updating
+    - crypto: caam/qi - fix IV DMA mapping and updating
+    - crypto: caam - fix size of RSA prime factor q
+    - crypto: cavium - Fix fallout from CONFIG_VMAP_STACK
+    - crypto: cavium - Limit result reading attempts
+    - crypto: vmx - Remove overly verbose printk from AES init routines
+    - crypto: vmx - Remove overly verbose printk from AES XTS init
+    - crypto: omap-sham - fix memleak
+    - Linux 4.17.2
+
+  * Cosmic update to v4.17.1 stable release (LP: #1779116)
+    - netfilter: nf_flow_table: attach dst to skbs
+    - bnx2x: use the right constant
+    - ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds
+    - ipv6: omit traffic class when calculating flow hash
+    - l2tp: fix refcount leakage on PPPoL2TP sockets
+    - netdev-FAQ: clarify DaveM's position for stable backports
+    - net: metrics: add proper netlink validation
+    - net/packet: refine check for priv area size
+    - rtnetlink: validate attributes in do_setlink()
+    - sctp: not allow transport timeout value less than HZ/5 for hb_timer
+    - team: use netdev_features_t instead of u32
+    - vrf: check the original netdevice for generating redirect
+    - net: dsa: b53: Fix for brcm tag issue in Cygnus SoC
+    - ipmr: fix error path when ipmr_new_table fails
+    - PCI: hv: Do not wait forever on a device that has disappeared
+    - Linux 4.17.1
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: crypto: thunderx_zip: Fix fallout from
+      CONFIG_VMAP_STACK"
+    - Revert "UBUNTU: SAUCE: cred: Add clone_cred() interface"
+    - SAUCE: apparmor: userspace queries
+    - SAUCE: apparmor: patch to provide compatibility with v2.x net rules
+    - SAUCE: apparmor: af_unix mediation
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 28 Jun 2018 08:03:32 -0500
+
+linux (4.17.0-2.3) cosmic; urgency=medium
+
+  * linux: 4.17.0-2.3 -proposed tracker (LP: #1776276)
+
+  * Miscellaneous Ubuntu changes
+    - Config: remove IrDA from annotations
+    - Config: remove scsi drivers from annotations
+    - Config: remove BT_HCIBTUART from annotations
+    - Config: pstore zlib support was renamed
+    - Config: disable NVRAM for armhf on annotations
+    - Config: Disable VT on s390x
+    - Config: Update SSB and B43/B44 options
+    - Config: some options not supported on some arches anymore
+    - Config: renamed and removed options
+    - Config: TCG_CRB is required for IMA on ACPI systems
+    - Config: EXTCON_AXP288 depends on X86
+    - Config: CONFIG_FSI depends on OF
+    - Config: DRM_RCAR_LVDS now depends on DRM
+    - CONFIG: Allow CONFIG_LEDS_MLXCPLD for i386
+    - Config: Enable HINIC on arm64
+    - Config: Set PPS and PTP_1588_CLOCK as y
+    - Config: Some NF_TABLES options are built-in now
+    - Config: GENERIC_CPU for ppc64el
+    - Config: KEXEC_FILE=n for s390x
+    - Config: CRYPTO_DEFLATE is needed by PSTORE_DEFLATE_COMPRESS
+    - Config: Disable STM32 support
+    - Config: Enable FORTIFY_SOURCE for armhf
+    - Config: use STRONG instead of AUTO for CC_STACKPROTECTOR
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.17
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 11 Jun 2018 15:22:10 -0300
+
+linux (4.17.0-1.2) cosmic; urgency=medium
+
+  [ Seth Forshee ]
+  * [Config] enable EDAC_DEBUG on ARM64 (LP: #1772516)
+    - [Config]: set CONFIG_EDAC_DEBUG=y for ARM64
+
+  * Ubuntu 18.04 kernel crashed while in degraded mode (LP: #1770849)
+    - SAUCE: powerpc/perf: Fix memory allocation for core-imc based on
+      num_possible_cpus()
+
+  * Integrated Webcam Realtek Integrated_Webcam_HD (0bda:58f4) not working in
+    DELL XPS 13 9370 with firmware 1.50 (LP: #1763748)
+    - SAUCE: media: uvcvideo: Support realtek's UVC 1.5 device
+
+  * Switch Build-Depends: transfig to fig2dev (LP: #1770770)
+    - [Config] update Build-Depends: transfig to fig2dev
+
+  * update-initramfs not adding i915 GuC firmware for Kaby Lake, firmware fails
+    to load (LP: #1728238)
+    - Revert "UBUNTU: SAUCE: (no-up) i915: Remove MODULE_FIRMWARE statements for
+      unreleased firmware"
+
+  * No driver for Huawei network adapters on arm64 (LP: #1769899)
+    - net-next/hinic: add arm64 support
+
+  * linux-snapdragon: reduce EPROBEDEFER noise during boot (LP: #1768761)
+    - [Config] snapdragon: DRM_I2C_ADV7511=y
+
+  * Add d-i support for Huawei NICs (LP: #1767490)
+    - d-i: add hinic to nic-modules udeb
+
+  * Acer Swift sf314-52 power button not managed  (LP: #1766054)
+    - SAUCE: platform/x86: acer-wmi: add another KEY_POWER keycode
+
+  * Include nfp driver in linux-modules (LP: #1768526)
+    - [Config] Add nfp.ko to generic inclusion list
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - [Config] Enable AUFS config options
+    - SAUCE: (efi-lockdown) Fix for module sig verification
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) efi: Add an EFI_SECURE_BOOT flag to indicate secure
+      boot mode
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Don't print secure boot state from the efi stub
+    - [Config] CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
+    - SAUCE: (efi-lockdown) really lock down kernel under EFI secure boot
+    - SAUCE: (noup) Update spl to 0.7.5-1ubuntu3, zfs to 0.7.5-1ubuntu17
+    - enable zfs build
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) ima: require secure_boot rules in
+      lockdown mode"
+    - Rebased to v4.17-rc6
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 22 May 2018 14:48:13 -0300
+
+linux (4.17.0-0.1) bionic; urgency=medium
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.17-rc4
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 08 May 2018 16:38:51 -0300
+
+linux (4.17.0-0.0) bionic; urgency=medium
+
+  * Dummy entry.
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 27 Apr 2018 11:01:13 -0300
+
+linux (4.16.0-4.5) bionic; urgency=medium
+
+  * [18.04 FEAT] Add kvm_stat from kernel tree (LP: #1734130)
+    - tools/kvm_stat: Fix python3 syntax
+    - tools/kvm_stat: Don't use deprecated file()
+    - tools/kvm_stat: Remove unused function
+    - [Packaging] Add linux-tools-host package for VM host tools
+    - [Config] do_tools_host=true for amd64
+
+  * [Featire] CNL: Enable RAPL support (LP: #1685712)
+    - powercap: RAPL: Add support for Cannon Lake
+
+  * Bionic update to v4.16.2 stable release (LP: #1763388)
+    - sparc64: Oracle DAX driver depends on SPARC64
+    - arp: fix arp_filter on l3slave devices
+    - net: dsa: Discard frames from unused ports
+    - net/ipv6: Increment OUTxxx counters after netfilter hook
+    - net/sched: fix NULL dereference in the error path of tcf_bpf_init()
+    - pptp: remove a buggy dst release in pptp_connect()
+    - sctp: do not leak kernel memory to user space
+    - sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
+    - vlan: also check phy_driver ts_info for vlan's real device
+    - net: fool proof dev_valid_name()
+    - ip_tunnel: better validate user provided tunnel names
+    - ipv6: sit: better validate user provided tunnel names
+    - ip6_gre: better validate user provided tunnel names
+    - ip6_tunnel: better validate user provided tunnel names
+    - vti6: better validate user provided tunnel names
+    - net_sched: fix a missing idr_remove() in u32_delete_key()
+    - nfp: use full 40 bits of the NSP buffer address
+    - Linux 4.16.2
+
+  * sky2 gigabit ethernet driver sometimes stops working after lid-open resume
+    from sleep (88E8055) (LP: #1758507) // Bionic update to v4.16.2 stable
+    release (LP: #1763388)
+    - sky2: Increase D3 delay to sky2 stops working after suspend
+
+  * Merge the linux-snapdragon kernel into bionic master/snapdragon
+    (LP: #1763040)
+    - arm64: defconfig: enable REMOTEPROC
+    - arm64: defconfig: enable QCOM audio drivers for APQ8016 and DB410c
+    - kernel: configs; add distro.config
+    - arm64: configs: enable WCN36xx
+    - kernel: distro.config: enable debug friendly USB network adpater
+    - arm64: configs: enable QCOM Venus
+    - arm64: defconfig: Enable a53/apcs and avs
+    - arm64: defconfig: enable ondemand governor as default
+    - arm64: defconfig: enable QCOM_TSENS
+    - kernel: configs: enable dm_mod and dm_crypt
+    - Force the SMD regulator driver to be compiled-in
+    - arm64: defconfig: enable CFG80211_DEFAULT_PS by default
+    - arm64: configs: enable BT_QCOMSMD
+    - kernel: configs: add more USB net drivers
+    - arm64: defconfig: disable ANALOG_TV and DIGITAL_TV
+    - arm64: configs: Enable camera drivers
+    - kernel: configs: add freq stat to sysfs
+    - arm64: defconfig: enable CONFIG_USB_CONFIGFS_F_FS by default
+    - arm64: defconfig: Enable QRTR features
+    - kernel: configs: set USB_CONFIG_F_FS in distro.config
+    - kernel: distro.config: enable 'schedutil' CPUfreq governor
+    - kernel: distro.config: enable 'fq' and 'fq_codel' qdiscs
+    - kernel: distro.config: enable 'BBR' TCP congestion algorithm
+    - arm64: defconfig: enable LEDS_QCOM_LPG
+    - HACK: drm/msm/iommu: Remove runtime_put calls in map/unmap
+    - power: avs: Add support for CPR (Core Power Reduction)
+    - power: avs: cpr: Use raw mem access for qfprom
+    - power: avs: cpr: fix with new reg_sequence structures
+    - power: avs: cpr: Register with cpufreq-dt
+    - regulator: smd: Add floor and corner operations
+    - PM / OPP: Support adjusting OPP voltages at runtime
+    - PM / OPP: Drop RCU usage in dev_pm_opp_adjust_voltage()
+    - PM / OPP: HACK: Allow to set regulator without opp_list
+    - PM / OPP: Add a helper to get an opp regulator for device
+    - cpufreq: Add apq8016 to cpufreq-dt-platdev blacklist
+    - regulator: smd: Allow REGULATOR_QCOM_SMD_RPM=m
+    - ov5645: I2C address change
+    - i2c: Add Qualcomm Camera Control Interface driver
+    - camss: vfe: Skip first four frames from sensor
+    - camss: Do not register if no cameras are present
+    - i2c-qcom-cci: Fix run queue completion timeout
+    - i2c-qcom-cci: Fix I2C address bug
+    - media: ov5645: Fix I2C address
+    - drm/bridge/adv7511: Delay clearing of HPD interrupt status
+    - HACK: drm/msm/adv7511: Don't rely on interrupts for EDID parsing
+    - leds: Add driver for Qualcomm LPG
+    - wcn36xx: Fix warning due to duplicate scan_completed notification
+    - arm64: dts: Add CPR DT node for msm8916
+    - arm64: dts: add spmi-regulator nodes
+    - arm64: dts: msm8916: Add cpufreq support
+    - arm64: dts: msm8916: Add a shared CPU opp table
+    - arm64: dts: msm8916: Add cpu cooling maps
+    - arm64: dts: pm8916: Mark the s2 regulator as always-on
+    - arm64: dts: qcom: msm8916: Add msm8916 A53 PLL DT node
+    - arm64: dts: qcom: msm8916: Use the new APCS mailbox driver
+    - arm64: dts: qcom: msm8916: Add clock properties to the APCS node
+    - dt-bindings: media: Binding document for Qualcomm Camera Control Interface
+      driver
+    - MAINTAINERS: Add Qualcomm Camera Control Interface driver
+    - DT: leds: Add Qualcomm Light Pulse Generator binding
+    - arm64: dts: qcom: msm8996: Add mpp and lpg blocks
+    - arm64: dts: qcom: Add pwm node for pm8916
+    - arm64: dts: qcom: Add user LEDs on db820c
+    - arm64: dts: qcom: Add WiFI/BT LEDs on db820c
+    - ARM: dts: qcom: Add LPG node to pm8941
+    - ARM: dts: qcom: honami: Add LPG node and RGB LED
+    - arm64: dts: qcom: Add Camera Control Interface support
+    - arm64: dts: qcom: Add apps_iommu vfe child node
+    - arm64: dts: qcom: Add camss device node
+    - arm64: dts: qcom: Add ov5645 device nodes
+    - arm64: dts: msm8916: Fix camera sensors I2C addresses
+    - arm: dts: qcom: db410c: Enable PWM signal on MPP4
+    - packaging: arm64: add a uboot flavour - part1
+    - packaging: arm64: add a uboot flavour - part2
+    - packaging: arm64: add a uboot flavour - part3
+    - packaging: arm64: add a uboot flavour - part4
+    - packaging: arm64: add a uboot flavour - part5
+    - packaging: arm64: rename uboot flavour to snapdragon
+    - [Config] updateconfigs after qcomlt import
+    - [Config] arm64: snapdragon: COMMON_CLK_QCOM=y
+    - [Config] arm64: snapdragon: MSM_GCC_8916=y
+    - [Config] arm64: snapdragon: REGULATOR_FIXED_VOLTAGE=y
+    - [Config] arm64: snapdragon: PINCTRL_MSM8916=y
+    - [Config] arm64: snapdragon: HWSPINLOCK_QCOM=y
+    - [Config] arm64: snapdragon: SPMI=y, SPMI_MSM_PMIC_ARB=y
+    - [Config] arm64: snapdragon: REGMAP_SPMI=y, PINCTRL_QCOM_SPMI_PMIC=y
+    - [Config] arm64: snapdragon: REGULATOR_QCOM_SPMI=y
+    - [Config] arm64: snapdragon: MFD_SPMI_PMIC=y
+    - [Config] arm64: snapdragon: QCOM_SMEM=y
+    - [Config] arm64: snapdragon: RPMSG=y, RPMSG_QCOM_SMD=y
+    - [Config] arm64: snapdragon: QCOM_SMD_RPM=y, REGULATOR_QCOM_SMD_RPM=y
+    - [Config] arm64: snapdragon: QCOM_CLK_SMD_RPM=y
+    - [Config] arm64: snapdragon: QCOM_BAM_DMA=y
+    - [Config] arm64: snapdragon: QCOM_HIDMA=y, QCOM_HIDMA_MGMT=y
+    - [Config] arm64: snapdragon: QCOM_CPR=y
+    - [Config] arm64: snapdragon: QCOM_QFPROM=y, QCOM_TSENS=y
+    - [Config] arm64: snapdragon: MMC_SDHCI=y, MMC_SDHCI_PLTFM=y, MMC_SDHCI_MSM=y
+    - [Config] turn off DRM_MSM_REGISTER_LOGGING
+    - [Config] arm64: snapdragon: I2C_QUP=y
+    - [Config] arm64: snapdragon: SPI_QUP=y
+    - [Config] arm64: snapdragon: USB_ULPI_BUS=y, PHY_QCOM_USB_HS=y
+    - [Config] arm64: snapdragon: QCOM_APCS_IPC=y
+    - [Config] arm64: snapdragon: QCOM_WCNSS_CTRL=y
+    - [Config] arm64: snapdragon: QCOM_SMSM=y
+    - [Config] arm64: snapdragon: QCOM_SMP2P=y
+    - [Config] arm64: snapdragon: DRM_MSM=y
+    - [Config] arm64: snapdragon: SND_SOC=y
+    - [Config] arm64: snapdragon: QCOM_WCNSS_PIL=m
+    - [Config] arm64: snapdragon: INPUT_PM8941_PWRKEY=y
+    - [Config] arm64: snapdragon: MEDIA_SUBDRV_AUTOSELECT=y, VIDEO_OV5645=m
+    - [Config] arm64: snapdragon: SND_SOC_APQ8016_SBC=y, SND_SOC_LPASS_APQ8016=y
+    - [Config] arm64: snapdragon: SND_SOC_MSM8916_WCD_ANALOG=y,
+      SND_SOC_MSM8916_WCD_DIGITAL=y
+    - SAUCE: media: ov5645: skip address change if dt addr == default addr
+    - SAUCE: drm/msm/adv7511: wrap hacks under CONFIG_ADV7511_SNAPDRAGON_HACKS
+      #ifdefs
+    - [Config] arm64: snapdragon: ADV7511_SNAPDRAGON_HACKS=y
+    - [Packaging] fix up snapdragon abi paths
+
+  * LSM stacking patches for bionic (LP: #1763062)
+    - SAUCE: LSM stacking: procfs: add smack subdir to attrs
+    - SAUCE: LSM stacking: LSM: Manage credential security blobs
+    - SAUCE: LSM stacking: LSM: Manage file security blobs
+    - SAUCE: LSM stacking: LSM: Manage task security blobs
+    - SAUCE: LSM stacking: LSM: Manage remaining security blobs
+    - SAUCE: LSM stacking: LSM: General stacking
+    - SAUCE: LSM stacking: fixup initialize task->security
+    - SAUCE: LSM stacking: fixup: alloc_task_ctx is dead code
+    - SAUCE: LSM stacking: add support for stacking getpeersec_stream
+    - SAUCE: LSM stacking: add stacking support to apparmor network hooks
+    - SAUCE: LSM stacking: fixup apparmor stacking enablement
+    - SAUCE: LSM stacking: fixup stacking kconfig
+    - SAUCE: LSM stacking: allow selecting multiple LSMs using kernel boot params
+    - SAUCE: LSM stacking: provide prctl interface for setting context
+    - SAUCE: LSM stacking: inherit current display LSM
+    - SAUCE: LSM stacking: keep an index for each registered LSM
+    - SAUCE: LSM stacking: verify display LSM
+    - SAUCE: LSM stacking: provide a way to specify the default display lsm
+    - SAUCE: LSM stacking: make sure LSM blob align on 64 bit boundaries
+    - SAUCE: LSM stacking: add /proc/<pid>/attr/display_lsm
+    - SAUCE: LSM stacking: add Kconfig to set default display LSM
+    - SAUCE: LSM stacking: add configs for LSM stacking
+    - SAUCE: LSM stacking: add apparmor and selinux proc dirs
+    - SAUCE: LSM stacking: remove procfs context interface
+
+  * linux 4.13.0-13.14 ADT test failure with linux 4.13.0-13.14
+    (LP: #1720779) // LSM stacking patches for bionic (LP: #1763062)
+    - SAUCE: LSM stacking: check for invalid zero sized writes
+
+  * Support cq/rq record doorbell for RDMA on HSilicon hip08 systems
+    (LP: #1762755)
+    - RDMA/hns: Support rq record doorbell for the user space
+    - RDMA/hns: Support cq record doorbell for the user space
+    - RDMA/hns: Support rq record doorbell for kernel space
+    - RDMA/hns: Support cq record doorbell for kernel space
+    - RDMA/hns: Fix cqn type and init resp
+    - RDMA/hns: Fix init resp when alloc ucontext
+    - RDMA/hns: Fix cq record doorbell enable in kernel
+
+  * Replace LPC patchset with upstream version (LP: #1762758)
+    - Revert "UBUNTU: SAUCE: MAINTAINERS: Add maintainer for HiSilicon LPC driver"
+    - Revert "UBUNTU: SAUCE: HISI LPC: Add ACPI support"
+    - Revert "UBUNTU: SAUCE: ACPI / scan: do not enumerate Indirect IO host
+      children"
+    - Revert "UBUNTU: SAUCE: HISI LPC: Support the LPC host on Hip06/Hip07 with DT
+      bindings"
+    - Revert "UBUNTU: SAUCE: OF: Add missing I/O range exception for indirect-IO
+      devices"
+    - Revert "UBUNTU: SAUCE: PCI: Apply the new generic I/O management on PCI IO
+      hosts"
+    - Revert "UBUNTU: SAUCE: PCI: Add fwnode handler as input param of
+      pci_register_io_range()"
+    - Revert "UBUNTU: SAUCE: PCI: Remove unused __weak attribute in
+      pci_register_io_range()"
+    - Revert "UBUNTU: SAUCE: LIB: Introduce a generic PIO mapping method"
+    - lib: Add generic PIO mapping method
+    - PCI: Remove __weak tag from pci_register_io_range()
+    - PCI: Add fwnode handler as input param of pci_register_io_range()
+    - PCI: Apply the new generic I/O management on PCI IO hosts
+    - of: Add missing I/O range exception for indirect-IO devices
+    - HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings
+    - ACPI / scan: Rename acpi_is_serial_bus_slave() for more general use
+    - ACPI / scan: Do not enumerate Indirect IO host children
+    - HISI LPC: Add ACPI support
+    - MAINTAINERS: Add John Garry as maintainer for HiSilicon LPC driver
+
+  * Enable Tunneled Operations on POWER9 (LP: #1762448)
+    - powerpc/powernv: Enable tunneled operations
+    - cxl: read PHB indications from the device tree
+
+  * PSL traces reset after PERST for debug AFU image (LP: #1762462)
+    - cxl: Enable NORST bit in PSL_DEBUG register for PSL9
+
+  * NFS + sec=krb5 is broken (LP: #1759791)
+    - sunrpc: remove incorrect HMAC request initialization
+
+  * Raspberry Pi 3 microSD support missing from the installer (LP: #1729128)
+    - d-i: add bcm2835 to block-modules
+
+  * Backport USB core quirks (LP: #1762695)
+    - usb: core: Add "quirks" parameter for usbcore
+    - usb: core: Copy parameter string correctly and remove superfluous null check
+    - usb: core: Add USB_QUIRK_DELAY_CTRL_MSG to usbcore quirks
+
+  * [Ubuntu 18.04] cryptsetup: 'device-mapper: reload ioctl on  failed' when
+    setting up a second end-to-end encrypted disk (LP: #1762353)
+    - SAUCE: s390/crypto: Adjust s390 aes and paes cipher
+
+  * System Z {kernel} UBUNTU18.04 wrong kernel config (LP: #1762719)
+    - s390: move nobp parameter functions to nospec-branch.c
+    - s390: add automatic detection of the spectre defense
+    - s390: report spectre mitigation via syslog
+    - s390: add sysfs attributes for spectre
+    - [Config] CONFIG_EXPOLINE_AUTO=y, CONFIG_KERNEL_NOBP=n for s390
+    - s390: correct nospec auto detection init order
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5715
+    - powerpc/64s: Wire up cpu_show_spectre_v2()
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5753
+    - powerpc/64s: Wire up cpu_show_spectre_v1()
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5754
+    - powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code
+    - powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again
+    - powerpc/rfi-flush: Always enable fallback flush on pseries
+    - powerpc/rfi-flush: Differentiate enabled and patched flush types
+    - powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration
+    - powerpc/64s: Move cpu_show_meltdown()
+    - powerpc/64s: Enhance the information in cpu_show_meltdown()
+    - powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()
+    - powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()
+
+  * Additional spectre and meltdown patches (LP: #1760099) // CVE-2017-5715 //
+    CVE-2017-5753 // CVE-2017-5754
+    - powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
+    - powerpc: Add security feature flags for Spectre/Meltdown
+    - powerpc/pseries: Set or clear security feature flags
+    - powerpc/powernv: Set or clear security feature flags
+
+  * Hisilicon network subsystem 3 support (LP: #1761610)
+    - net: hns3: export pci table of hclge and hclgevf to userspace
+    - d-i: Add hns3 drivers to nic-modules
+
+  * "ip a" command on a guest VM shows UNKNOWN status (LP: #1761534)
+    - virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS
+
+  * perf vendor events arm64: Enable JSON events for ThunderX2 B0 (LP: #1760712)
+    - perf vendor events: Drop incomplete multiple mapfile support
+    - perf vendor events: Fix error code in json_events()
+    - perf vendor events: Drop support for unused topic directories
+    - perf vendor events: Add support for pmu events vendor subdirectory
+    - perf vendor events arm64: Relocate ThunderX2 JSON to cavium subdirectory
+    - perf vendor events arm64: Relocate Cortex A53 JSONs to arm subdirectory
+    - perf vendor events: Add support for arch standard events
+    - perf vendor events arm64: Add armv8-recommended.json
+    - perf vendor events arm64: Fixup ThunderX2 to use recommended events
+    - perf vendor events arm64: fixup A53 to use recommended events
+    - perf vendor events arm64: add HiSilicon hip08 JSON file
+    - perf vendor events arm64: Enable JSON events for ThunderX2 B0
+
+  * Warning "cache flush timed out!" seen when unloading the cxl driver
+    (LP: #1762367)
+    - cxl: Check if PSL data-cache is available before issue flush request
+
+  * Bionic update to v4.16.1 stable release (LP: #1763170)
+    - bitmap: fix memset optimization on big-endian systems
+    - USB: serial: ftdi_sio: add RT Systems VX-8 cable
+    - USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
+    - USB: serial: cp210x: add ELDAT Easywave RX09 id
+    - serial: 8250: Add Nuvoton NPCM UART
+    - mei: remove dev_err message on an unsupported ioctl
+    - /dev/mem: Avoid overwriting "err" in read_mem()
+    - media: usbtv: prevent double free in error case
+    - parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
+    - crypto: lrw - Free rctx->ext with kzfree
+    - crypto: ccp - Fill the result buffer only on digest, finup, and final ops
+    - crypto: talitos - don't persistently map req_ctx->hw_context and
+      req_ctx->buf
+    - crypto: inside-secure - fix clock management
+    - crypto: testmgr - Fix incorrect values in PKCS#1 test vector
+    - crypto: talitos - fix IPsec cipher in length
+    - crypto: ahash - Fix early termination in hash walk
+    - crypto: caam - Fix null dereference at error path
+    - crypto: ccp - return an actual key size from RSA max_size callback
+    - crypto: arm,arm64 - Fix random regeneration of S_shipped
+    - crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
+    - Bluetooth: hci_bcm: Add 6 new ACPI HIDs
+    - Btrfs: fix unexpected cow in run_delalloc_nocow
+    - siox: fix possible buffer overflow in device_add_store
+    - staging: comedi: ni_mio_common: ack ai fifo error interrupts.
+    - Revert "base: arch_topology: fix section mismatch build warnings"
+    - Input: ALPS - fix TrackStick detection on Thinkpad L570 and Latitude 7370
+    - Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
+    - Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
+    - vt: change SGR 21 to follow the standards
+    - Fix slab name "biovec-(1<<(21-12))"
+    - signal: Correct the offset of si_pkey and si_lower in struct siginfo on m68k
+    - Linux 4.16.1
+
+  * [18.04][config] regression: nvme and nvme_core couldn't be built as modules
+    starting 4.15-rc2 (LP: #1759893)
+    - SAUCE: Revert "lightnvm: include NVM Express driver if OCSSD is selected for
+      build"
+    - [Config] CONFIG_BLK_DEV_NMVE=m
+
+  * FFe: Enable configuring resume offset via sysfs (LP: #1760106)
+    - PM / hibernate: Make passing hibernate offsets more friendly
+
+  * Ubuntu18.04:POWER9:DD2.2 - Unable to start a KVM guest with default machine
+    type(pseries-bionic) complaining "KVM implementation does not support
+    Transactional Memory, try cap-htm=off" (kvm) (LP: #1752026)
+    - powerpc: Use feature bit for RTC presence rather than timebase presence
+    - powerpc: Book E: Remove unused CPU_FTR_L2CSR bit
+    - powerpc: Free up CPU feature bits on 64-bit machines
+    - powerpc: Add CPU feature bits for TM bug workarounds on POWER9 v2.2
+    - powerpc/powernv: Provide a way to force a core into SMT4 mode
+    - KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9
+    - KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode
+    - KVM: PPC: Book3S HV: Work around TEXASR bug in fake suspend state
+
+  * [Feature][CFL][ICL] [CNL]Thunderbolt support (Titan Ridge) (LP: #1730775)
+    - thunderbolt: Resume control channel after hibernation image is created
+    - thunderbolt: Serialize PCIe tunnel creation with PCI rescan
+    - thunderbolt: Handle connecting device in place of host properly
+    - thunderbolt: Do not overwrite error code when domain adding fails
+    - thunderbolt: Wait a bit longer for root switch config space
+    - thunderbolt: Wait a bit longer for ICM to authenticate the active NVM
+    - thunderbolt: Handle rejected Thunderbolt devices
+    - thunderbolt: Factor common ICM add and update operations out
+    - thunderbolt: Correct function name in kernel-doc comment
+    - thunderbolt: Add tb_switch_get()
+    - thunderbolt: Add tb_switch_find_by_route()
+    - thunderbolt: Add tb_xdomain_find_by_route()
+    - thunderbolt: Add constant for approval timeout
+    - thunderbolt: Move driver ready handling to struct icm
+    - thunderbolt: Add 'boot' attribute for devices
+    - thunderbolt: Add support for preboot ACL
+    - thunderbolt: Introduce USB only (SL4) security level
+    - thunderbolt: Add support for Intel Titan Ridge
+
+  * QCA9377 requires more IRAM banks for its new firmware (LP: #1748345)
+    - ath10k: update the IRAM bank number for QCA9377
+
+  * Fix an issue that when system in S3, USB keyboard can't wake up the system.
+    (LP: #1759511)
+    - ACPI / PM: Allow deeper wakeup power states with no _SxD nor _SxW
+
+  * cxl: Fix timebase synchronization status on POWER9 missing (CAPI)
+    (LP: #1757228)
+    - cxl: Fix timebase synchronization status on P9
+
+  * [Feature]Update Ubuntu 18.04 lpfc FC driver with 32/64GB HBA support and bug
+    fixes (LP: #1752182)
+    - scsi: lpfc: Fix frequency of Release WQE CQEs
+    - scsi: lpfc: Increase CQ and WQ sizes for SCSI
+    - scsi: lpfc: move placement of target destroy on driver detach
+    - scsi: lpfc: correct debug counters for abort
+    - scsi: lpfc: Add WQ Full Logic for NVME Target
+    - scsi: lpfc: Fix PRLI handling when topology type changes
+    - scsi: lpfc: Fix IO failure during hba reset testing with nvme io.
+    - scsi: lpfc: Fix RQ empty firmware trap
+    - scsi: lpfc: Allow set of maximum outstanding SCSI cmd limit for a target
+    - scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing
+    - scsi: lpfc: Fix issue_lip if link is disabled
+    - scsi: lpfc: Indicate CONF support in NVMe PRLI
+    - scsi: lpfc: Fix SCSI io host reset causing kernel crash
+    - scsi: lpfc: Validate adapter support for SRIU option
+    - scsi: lpfc: Fix header inclusion in lpfc_nvmet
+    - scsi: lpfc: Treat SCSI Write operation Underruns as an error
+    - scsi: lpfc: Fix nonrecovery of NVME controller after cable swap.
+    - scsi: lpfc: update driver version to 11.4.0.7
+    - scsi: lpfc: Update 11.4.0.7 modified files for 2018 Copyright
+    - scsi: lpfc: Rework lpfc to allow different sli4 cq and eq handlers
+    - scsi: lpfc: Rework sli4 doorbell infrastructure
+    - scsi: lpfc: Add SLI-4 if_type=6 support to the code base
+    - scsi: lpfc: Add push-to-adapter support to sli4
+    - scsi: lpfc: Add PCI Ids for if_type=6 hardware
+    - scsi: lpfc: Add 64G link speed support
+    - scsi: lpfc: Add if_type=6 support for cycling valid bits
+    - scsi: lpfc: Enable fw download on if_type=6 devices
+    - scsi: lpfc: Add embedded data pointers for enhanced performance
+    - scsi: lpfc: Fix nvme embedded io length on new hardware
+    - scsi: lpfc: Work around NVME cmd iu SGL type
+    - scsi: lpfc: update driver version to 12.0.0.0
+    - scsi: lpfc: Change Copyright of 12.0.0.0 modified files to 2018
+    - scsi: lpfc: use __raw_writeX on DPP copies
+    - scsi: lpfc: Add missing unlock in WQ full logic
+
+  * /dev/bcache/by-uuid links not created after reboot (LP: #1729145)
+    - SAUCE: (no-up) bcache: decouple emitting a cached_dev CHANGE uevent
+
+  * DKMS driver builds fail with: Cannot use CONFIG_STACK_VALIDATION=y, please
+    install libelf-dev, libelf-devel or elfutils-libelf-devel (LP: #1760876)
+    - [Packaging] include the retpoline extractor in the headers
+
+  * Use med_with_dipm SATA LPM to save more power for mobile platforms
+    (LP: #1759547)
+    - [Config] CONFIG_SATA_MOBILE_LPM_POLICY=3
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] Only install cloud init files when do_tools_common=true
+    - SAUCE: Import aufs driver
+    - [Config] Enable AUFS config options
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 12 Apr 2018 09:30:56 -0500
+
+linux (4.16.0-3.4) bionic; urgency=medium
+
+  * Allow multiple mounts of zfs datasets (LP: #1759848)
+    - SAUCE: Allow mounting datasets more than once (LP: #1759848)
+
+  * zfs system process hung on container stop/delete (LP: #1754584)
+    - SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)
+    - Revert "UBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)"
+    - SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)
+
+  * ubuntu_zram_smoke test will cause soft lockup on Artful ThunderX ARM64
+    (LP: #1755073)
+    - SAUCE: crypto: thunderx_zip: Fix fallout from CONFIG_VMAP_STACK
+
+  * CAPI Flash (cxlflash) update (LP: #1752672)
+    - SAUCE: cxlflash: Preserve number of interrupts for master contexts
+    - SAUCE: cxlflash: Avoid clobbering context control register value
+    - SAUCE: cxlflash: Add argument identifier names
+    - SAUCE: cxlflash: Introduce OCXL backend
+    - SAUCE: cxlflash: Hardware AFU for OCXL
+    - SAUCE: cxlflash: Read host function configuration
+    - SAUCE: cxlflash: Setup function acTag range
+    - SAUCE: cxlflash: Read host AFU configuration
+    - SAUCE: cxlflash: Setup AFU acTag range
+    - SAUCE: cxlflash: Setup AFU PASID
+    - SAUCE: cxlflash: Adapter context support for OCXL
+    - SAUCE: cxlflash: Use IDR to manage adapter contexts
+    - SAUCE: cxlflash: Support adapter file descriptors for OCXL
+    - SAUCE: cxlflash: Support adapter context discovery
+    - SAUCE: cxlflash: Support image reload policy modification
+    - SAUCE: cxlflash: MMIO map the AFU
+    - SAUCE: cxlflash: Support starting an adapter context
+    - SAUCE: cxlflash: Support process specific mappings
+    - SAUCE: cxlflash: Support AFU state toggling
+    - SAUCE: cxlflash: Support reading adapter VPD data
+    - SAUCE: cxlflash: Setup function OCXL link
+    - SAUCE: cxlflash: Setup OCXL transaction layer
+    - SAUCE: cxlflash: Support process element lifecycle
+    - SAUCE: cxlflash: Support AFU interrupt management
+    - SAUCE: cxlflash: Support AFU interrupt mapping and registration
+    - SAUCE: cxlflash: Support starting user contexts
+    - SAUCE: cxlflash: Support adapter context polling
+    - SAUCE: cxlflash: Support adapter context reading
+    - SAUCE: cxlflash: Support adapter context mmap and release
+    - SAUCE: cxlflash: Support file descriptor mapping
+    - SAUCE: cxlflash: Introduce object handle fop
+    - SAUCE: cxlflash: Setup LISNs for user contexts
+    - SAUCE: cxlflash: Setup LISNs for master contexts
+    - SAUCE: cxlflash: Update synchronous interrupt status bits
+    - SAUCE: cxlflash: Introduce OCXL context state machine
+    - SAUCE: cxlflash: Register for translation errors
+    - SAUCE: cxlflash: Support AFU reset
+    - SAUCE: cxlflash: Enable OCXL operations
+
+  * [Artful][Wyse 3040] System hang when trying to enable an offlined CPU core
+    (LP: #1736393)
+    - SAUCE: drm/i915:Don't set chip specific data
+    - SAUCE: drm/i915: make previous commit affects Wyse 3040 only
+
+  * zed process consuming 100% cpu (LP: #1751796)
+    - SAUCE: Fix ioctl loop-spin in zed (LP: #1751796)
+
+  * Ubuntu18.04:PowerPC - Set Transparent Huge Pages (THP) by default to
+    "always" (LP: #1753708)
+    - Config: Set TRANSPARENT_HUGEPAGE_ALWAYS=y on ppc64el
+
+  * retpoline hints: primary infrastructure and initial hints (LP: #1758856)
+    - [Packaging] retpoline -- add safe usage hint support
+    - [Packaging] retpoline-check -- only report additions
+    - [Packaging] retpoline -- widen indirect call/jmp detection
+    - [Packaging] retpoline -- elide %rip relative indirections
+    - [Packaging] retpoline -- clear hint information from packages
+    - SAUCE: apm -- annotate indirect calls within
+      firmware_restrict_branch_speculation_{start,end}
+    - SAUCE: EFI -- annotate indirect calls within
+      firmware_restrict_branch_speculation_{start,end}
+    - SAUCE: early/late -- annotate indirect calls in early/late initialisation
+      code
+    - SAUCE: vga_set_mode -- avoid jump tables
+    - [Config] retpoine -- switch to new format
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] final-checks -- remove check for empty retpoline files
+    - [Packaging] skip cloud tools packaging when not building package
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 02 Apr 2018 16:15:36 -0500
+
+linux (4.16.0-2.3) bionic; urgency=medium
+
+  * devpts: handle bind-mounts (LP: #1755857)
+    - SAUCE: devpts: hoist out check for DEVPTS_SUPER_MAGIC
+    - SAUCE: devpts: resolve devpts bind-mounts
+    - SAUCE: devpts: comment devpts_mntget()
+    - SAUCE: selftests: add devpts selftests
+
+  * [bionic][arm64] d-i: add hisi_sas_v3_hw to scsi-modules (LP: #1756103)
+    - d-i: add hisi_sas_v3_hw to scsi-modules
+
+  * [Bionic][ARM64] PCI and SAS driver patches for hip08 SoCs (LP: #1756094)
+    - SAUCE: scsi: hisi_sas: config for hip08 ES
+    - SAUCE: scsi: hisi_sas: export device table of v3 hw to userspace
+
+  * s390/crypto: Fix kernel crash on aes_s390 module remove (LP: #1753424)
+    - SAUCE: s390/crypto: Fix kernel crash on aes_s390 module remove.
+
+  * Fix ARC hit rate (LP: #1755158)
+    - SAUCE: Fix ARC hit rate (LP: #1755158)
+
+  * ZFS setgid broken on 0.7 (LP: #1753288)
+    - SAUCE: Fix ZFS setgid
+
+  * CONFIG_EFI=y on armhf (LP: #1726362)
+    - [Config] CONFIG_EFI=y on armhf, reconcile secureboot EFI settings
+
+  * [Feature] Add xHCI debug device support in the driver (LP: #1730832)
+    - [Config] CONFIG_USB_XHCI_DBGCAP=y
+
+  * retpoline: ignore %cs:0xNNN constant indirections (LP: #1752655)
+    - [Packaging] retpoline -- elide %cs:0xNNNN constants on i386
+    - [Config] retpoline -- clean up i386 retpoline files
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] retpoline-extract: flag *0xNNN(%reg) branches
+    - [Config] fix up retpoline abi files
+    - [Config] fix up retpoline abi files
+    - d-i: Add netsec to nic-modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 19 Mar 2018 14:09:49 -0500
+
+linux (4.16.0-1.2) bionic; urgency=medium
+
+  * Driver not found in Ubuntu kernel does not detect interface (LP: #1745927)
+    - d-i: add cxgb4 to nic-modules
+
+  * Support low-pin-count devices on Hisilicon SoCs (LP: #1677319)
+    - [Config] CONFIG_INDIRECT_PIO=y
+    - SAUCE: LIB: Introduce a generic PIO mapping method
+    - SAUCE: PCI: Remove unused __weak attribute in pci_register_io_range()
+    - SAUCE: PCI: Add fwnode handler as input param of pci_register_io_range()
+    - SAUCE: PCI: Apply the new generic I/O management on PCI IO hosts
+    - SAUCE: OF: Add missing I/O range exception for indirect-IO devices
+    - [Config] CONFIG_HISILICON_LPC=y
+    - SAUCE: HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings
+    - SAUCE: ACPI / scan: do not enumerate Indirect IO host children
+    - SAUCE: HISI LPC: Add ACPI support
+    - SAUCE: MAINTAINERS: Add maintainer for HiSilicon LPC driver
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: tools: use CC for linking acpi tools
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 28 Feb 2018 10:17:23 -0600
+
+linux (4.16.0-0.1) bionic; urgency=medium
+
+  * retpoline abi files are empty on i386 (LP: #1751021)
+    - [Packaging] retpoline-extract -- instantiate retpoline files for i386
+    - [Packaging] final-checks -- sanity checking ABI contents
+    - [Packaging] final-checks -- check for empty retpoline files
+
+  * Miscellaneous upstream changes
+    - disable vbox build
+    - Disable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.16-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 22 Feb 2018 08:58:57 -0600
+
+linux (4.16.0-0.0) bionic; urgency=medium
+
+  * Dummy entry
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 21 Feb 2018 14:33:13 -0600
+
+linux (4.15.0-10.11) bionic; urgency=medium
+
+  * linux: 4.15.0-10.11 -proposed tracker (LP: #1749250)
+
+  * "swiotlb: coherent allocation failed" dmesg spam with linux 4.15.0-9.10
+    (LP: #1749202)
+    - swiotlb: suppress warning when __GFP_NOWARN is set
+    - drm/ttm: specify DMA_ATTR_NO_WARN for huge page pools
+
+  * linux-tools: perf incorrectly linking libbfd (LP: #1748922)
+    - SAUCE: tools -- add ability to disable libbfd
+    - [Packaging] correct disablement of libbfd
+
+  * [Artful] Realtek ALC225: 2 secs noise when a headset plugged in
+    (LP: #1744058)
+    - ALSA: hda/realtek - update ALC225 depop optimize
+
+  * [Artful] Support headset mode for DELL WYSE (LP: #1723913)
+    - SAUCE: ALSA: hda/realtek - Add support headset mode for DELL WYSE
+
+  * headset mic can't be detected on two Dell machines (LP: #1748807)
+    - ALSA: hda/realtek - Support headset mode for ALC215/ALC285/ALC289
+    - ALSA: hda - Fix headset mic detection problem for two Dell machines
+
+  * Bionic update to v4.15.3 stable release (LP: #1749191)
+    - ip6mr: fix stale iterator
+    - net: igmp: add a missing rcu locking section
+    - qlcnic: fix deadlock bug
+    - qmi_wwan: Add support for Quectel EP06
+    - r8169: fix RTL8168EP take too long to complete driver initialization.
+    - tcp: release sk_frag.page in tcp_disconnect
+    - vhost_net: stop device during reset owner
+    - ipv6: addrconf: break critical section in addrconf_verify_rtnl()
+    - ipv6: change route cache aging logic
+    - Revert "defer call to mem_cgroup_sk_alloc()"
+    - net: ipv6: send unsolicited NA after DAD
+    - rocker: fix possible null pointer dereference in
+      rocker_router_fib_event_work
+    - tcp_bbr: fix pacing_gain to always be unity when using lt_bw
+    - cls_u32: add missing RCU annotation.
+    - ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only
+    - soreuseport: fix mem leak in reuseport_add_sock()
+    - net_sched: get rid of rcu_barrier() in tcf_block_put_ext()
+    - net: sched: fix use-after-free in tcf_block_put_ext
+    - media: mtk-vcodec: add missing MODULE_LICENSE/DESCRIPTION
+    - media: soc_camera: soc_scale_crop: add missing
+      MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - media: tegra-cec: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - gpio: uniphier: fix mismatch between license text and MODULE_LICENSE
+    - crypto: tcrypt - fix S/G table for test_aead_speed()
+    - Linux 4.15.3
+
+  * bnx2x_attn_int_deasserted3:4323 MC assert! (LP: #1715519) //
+    CVE-2018-1000026
+    - net: create skb_gso_validate_mac_len()
+    - bnx2x: disable GSO where gso_size is too big for hardware
+
+  * ethtool -p fails to light NIC LED on HiSilicon D05 systems (LP: #1748567)
+    - net: hns: add ACPI mode support for ethtool -p
+
+  * CVE-2017-5715 (Spectre v2 Intel)
+    - [Packaging] retpoline files must be sorted
+    - [Packaging] pull in retpoline files
+
+  * [Feature] PXE boot with Intel Omni-Path (LP: #1712031)
+    - d-i: Add hfi1 to nic-modules
+
+  * CVE-2017-5715 (Spectre v2 retpoline)
+    - [Packaging] retpoline -- add call site validation
+    - [Config] disable retpoline checks for first upload
+
+  * Do not duplicate changelog entries assigned to more than one bug or CVE
+    (LP: #1743383)
+    - [Packaging] git-ubuntu-log -- handle multiple bugs/cves better
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 13 Feb 2018 11:33:58 -0600
+
+linux (4.15.0-9.10) bionic; urgency=medium
+
+  * linux: 4.15.0-9.10 -proposed tracker (LP: #1748244)
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] tests -- remove gcc-multilib dependency for arm64
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 08 Feb 2018 11:25:04 -0600
+
+linux (4.15.0-8.9) bionic; urgency=medium
+
+  * linux: 4.15.0-8.9 -proposed tracker (LP: #1748075)
+
+  * Bionic update to v4.15.2 stable release (LP: #1748072)
+    - KVM: x86: Make indirect calls in emulator speculation safe
+    - KVM: VMX: Make indirect call speculation safe
+    - module/retpoline: Warn about missing retpoline in module
+    - x86/cpufeatures: Add CPUID_7_EDX CPUID leaf
+    - x86/cpufeatures: Add Intel feature bits for Speculation Control
+    - x86/cpufeatures: Add AMD feature bits for Speculation Control
+    - x86/msr: Add definitions for new speculation control MSRs
+    - x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown
+    - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes
+    - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support
+    - x86/alternative: Print unadorned pointers
+    - x86/nospec: Fix header guards names
+    - x86/bugs: Drop one "mitigation" from dmesg
+    - x86/cpu/bugs: Make retpoline module warning conditional
+    - x86/cpufeatures: Clean up Spectre v2 related CPUID flags
+    - x86/retpoline: Simplify vmexit_fill_RSB()
+    - x86/speculation: Simplify indirect_branch_prediction_barrier()
+    - auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - iio: adc/accel: Fix up module licenses
+    - pinctrl: pxa: pxa2xx: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - KVM: nVMX: Eliminate vmcs02 pool
+    - KVM: VMX: introduce alloc_loaded_vmcs
+    - objtool: Improve retpoline alternative handling
+    - objtool: Add support for alternatives at the end of a section
+    - objtool: Warn on stripped section symbol
+    - x86/mm: Fix overlap of i386 CPU_ENTRY_AREA with FIX_BTMAP
+    - x86/spectre: Check CONFIG_RETPOLINE in command line parser
+    - x86/entry/64: Remove the SYSCALL64 fast path
+    - x86/entry/64: Push extra regs right away
+    - x86/asm: Move 'status' from thread_struct to thread_info
+    - Documentation: Document array_index_nospec
+    - array_index_nospec: Sanitize speculative array de-references
+    - x86: Implement array_index_mask_nospec
+    - x86: Introduce barrier_nospec
+    - x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec
+    - x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end}
+    - x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec
+    - x86/get_user: Use pointer masking to limit speculation
+    - x86/syscall: Sanitize syscall table de-references under speculation
+    - vfs, fdtable: Prevent bounds-check bypass via speculative execution
+    - nl80211: Sanitize array index in parse_txq_params
+    - x86/spectre: Report get_user mitigation for spectre_v1
+    - x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable"
+    - x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel
+    - x86/speculation: Use Indirect Branch Prediction Barrier in context switch
+    - x86/paravirt: Remove 'noreplace-paravirt' cmdline option
+    - KVM: VMX: make MSR bitmaps per-VCPU
+    - x86/kvm: Update spectre-v1 mitigation
+    - x86/retpoline: Avoid retpolines for built-in __init functions
+    - x86/spectre: Simplify spectre_v2 command line parsing
+    - x86/pti: Mark constant arrays as __initconst
+    - x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL
+    - KVM/x86: Update the reverse_cpuid list to include CPUID_7_EDX
+    - KVM/x86: Add IBPB support
+    - KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES
+    - KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL
+    - KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL
+    - serial: core: mark port as initialized after successful IRQ change
+    - fpga: region: release of_parse_phandle nodes after use
+    - Linux 4.15.2
+
+  * Add support for the NIC on SynQuacer E-Series boards (LP: #1747792)
+    - net: phy: core: remove now uneeded disabling of interrupts
+    - [Config] CONFIG_NET_VENDOR_SOCIONEXT=y & CONFIG_SNI_NETSEC=m
+    - net: socionext: Add Synquacer NetSec driver
+    - net: socionext: include linux/io.h to fix build
+    - net: socionext: Fix error return code in netsec_netdev_open()
+
+  * [Artful/Bionic] [Config] enable EDAC_GHES for ARM64 (LP: #1747746)
+    - [Config] CONFIG_EDAC_GHES=y
+
+  * support thunderx2 vendor pmu events (LP: #1747523)
+    - perf pmu: Pass pmu as a parameter to get_cpuid_str()
+    - perf tools arm64: Add support for get_cpuid_str function.
+    - perf pmu: Add helper function is_pmu_core to detect PMU CORE devices
+    - perf vendor events arm64: Add ThunderX2 implementation defined pmu core
+      events
+    - perf pmu: Add check for valid cpuid in perf_pmu__find_map()
+
+  * linux 4.14.0-7.9 ADT test failure with linux 4.14.0-7.9 (LP: #1732463)
+    - SAUCE: mm: disable vma based swap readahead by default
+    - SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Fix CONFIG_PROFILE_ALL_BRANCHES annotations
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 07 Feb 2018 21:13:27 -0600
+
+linux (4.15.0-7.8) bionic; urgency=medium
+
+  * Bionic update to v4.15.1 stable release (LP: #1747169)
+    - Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops
+    - tools/gpio: Fix build error with musl libc
+    - gpio: stmpe: i2c transfer are forbiden in atomic context
+    - gpio: Fix kernel stack leak to userspace
+    - ALSA: hda - Reduce the suspend time consumption for ALC256
+    - crypto: ecdh - fix typo in KPP dependency of CRYPTO_ECDH
+    - crypto: aesni - handle zero length dst buffer
+    - crypto: aesni - fix typo in generic_gcmaes_decrypt
+    - crypto: aesni - add wrapper for generic gcm(aes)
+    - crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-
+      aesni
+    - crypto: aesni - Fix out-of-bounds access of the AAD buffer in generic-gcm-
+      aesni
+    - crypto: inside-secure - fix hash when length is a multiple of a block
+    - crypto: inside-secure - avoid unmapping DMA memory that was not mapped
+    - crypto: sha3-generic - fixes for alignment and big endian operation
+    - crypto: af_alg - whitelist mask and type
+    - HID: wacom: EKR: ensure devres groups at higher indexes are released
+    - HID: wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events
+    - power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - gpio: iop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE
+    - mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
+    - igb: Free IRQs when device is hotplugged
+    - ima/policy: fix parsing of fsuuid
+    - scsi: aacraid: Fix udev inquiry race condition
+    - scsi: aacraid: Fix hang in kdump
+    - scsi: storvsc: missing error code in storvsc_probe()
+    - staging: lustre: separate a connection destroy from free struct kib_conn
+    - staging: ccree: NULLify backup_info when unused
+    - staging: ccree: fix fips event irq handling build
+    - tty: fix data race between tty_init_dev and flush of buf
+    - usb: option: Add support for FS040U modem
+    - USB: serial: pl2303: new device id for Chilitag
+    - USB: cdc-acm: Do not log urb submission errors on disconnect
+    - CDC-ACM: apply quirk for card reader
+    - USB: serial: io_edgeport: fix possible sleep-in-atomic
+    - usbip: prevent bind loops on devices attached to vhci_hcd
+    - usbip: list: don't list devices attached to vhci_hcd
+    - USB: serial: simple: add Motorola Tetra driver
+    - usb: f_fs: Prevent gadget unbind if it is already unbound
+    - usb: uas: unconditionally bring back host after reset
+    - usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc()
+    - ANDROID: binder: remove waitqueue when thread exits.
+    - android: binder: use VM_ALLOC to get vm area
+    - mei: me: allow runtime pm for platform with D0i3
+    - serial: 8250_of: fix return code when probe function fails to get reset
+    - serial: 8250_uniphier: fix error return code in uniphier_uart_probe()
+    - serial: 8250_dw: Revert "Improve clock rate setting"
+    - serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS
+    - spi: imx: do not access registers while clocks disabled
+    - iio: adc: stm32: fix scan of multiple channels with DMA
+    - iio: chemical: ccs811: Fix output of IIO_CONCENTRATION channels
+    - test_firmware: fix missing unlock on error in config_num_requests_store()
+    - Input: synaptics-rmi4 - unmask F03 interrupts when port is opened
+    - Input: synaptics-rmi4 - do not delete interrupt memory too early
+    - x86/efi: Clarify that reset attack mitigation needs appropriate userspace
+    - Linux 4.15.1
+
+  * Dell XPS 13 9360 bluetooth (Atheros) won't connect after resume
+    (LP: #1744712)
+    - Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
+    - Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten"
+      version
+
+  * apparmor profile load in stacked policy container fails (LP: #1746463)
+    - SAUCE: apparmor: fix display of .ns_name for containers
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 04 Feb 2018 11:56:32 +0100
+
+linux (4.15.0-6.7) bionic; urgency=low
+
+  * upload urgency should be medium by default (LP: #1745338)
+    - [Packaging] update urgency to medium by default
+
+  * Shutdown hang on 16.04 with iscsi targets (LP: #1569925)
+    - scsi: libiscsi: Allow sd_shutdown on bad transport
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.5-1ubuntu1, zfs to 0.7.5-1ubuntu1
+    - Revert "UBUNTU: SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM"
+    - Revert "UBUNTU: SAUCE: mm: disable vma based swap readahead by default"
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 Jan 2018 08:47:07 -0600
+
+linux (4.15.0-5.6) bionic; urgency=low
+
+  * $(LOCAL_ENV_CC) and $(LOCAL_ENV_DISTCC_HOSTS) should be properly quoted
+    (LP: #1744077)
+    - [Debian] pass LOCAL_ENV_CC and LOCAL_ENV_DISTCC_HOSTS properly
+
+  * Missing install-time driver for QLogic QED 25/40/100Gb Ethernet NIC
+    (LP: #1743638)
+    - [d-i] Add qede to nic-modules udeb
+
+  * boot failure on AMD Raven + WesternXT (LP: #1742759)
+    - SAUCE: drm/amdgpu: add atpx quirk handling (v2)
+
+  * Unable to handle kernel NULL pointer dereference at isci_task_abort_task
+    (LP: #1726519)
+    - SAUCE: Revert "scsi: libsas: allow async aborts"
+
+  * Update Ubuntu-4.15.0 config to support Intel Atom devices (LP: #1739939)
+    - [Config] CONFIG_SERIAL_DEV_BUS=y, CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+
+  * Miscellaneous Ubuntu changes
+    - Rebase to v4.15-rc7
+    - [Config] CONFIG_CPU_ISOLATION=y
+    - [Config] Update annotations following config review
+    - Revert "UBUNTU: SAUCE: Import aufs driver"
+    - SAUCE: Import aufs driver
+    - ubuntu: vbox -- update to 5.2.6-dfsg-1
+    - ubuntu: vbox: build fixes for 4.15
+    - ubuntu: vbox -- update to 5.2.6-dfsg-2
+    - hio: updates for timer api changes in 4.15
+    - enable hio build
+    - Rebase to v4.15-rc9
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc9
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 22 Jan 2018 10:16:05 -0600
+
+linux (4.15.0-4.5) bionic; urgency=low
+
+  * [0cf3:e010] QCA6174A XR failed to pair with bt 4.0 device  (LP: #1741166)
+    - SAUCE: Bluetooth: btusb: Add support for 0cf3:e010
+
+  * External HDMI monitor failed to show screen on Lenovo X1 series
+    (LP: #1738523)
+    - SAUCE: drm/i915: Disable writing of TMDS_OE on Lenovo ThinkPad X1 series
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] autoreconstruct - add resoration of execute permissions
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 10 Jan 2018 10:24:22 -0600
+
+linux (4.15.0-3.4) bionic; urgency=low
+
+  * ubuntu/xr-usb-serial didn't get built in zesty and artful (LP: #1733281)
+    - SAUCE: make sure ubuntu/xr-usb-serial builds for x86
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 03 Jan 2018 20:20:43 -0600
+
+linux (4.15.0-2.3) bionic; urgency=low
+
+  * nvidia-graphics-drivers-384 384.90-0ubuntu6 ADT test failure with linux
+    4.15.0-1.2 (LP: #1737752)
+    - x86/mm: Unbreak modules that use the DMA API
+
+  * Ubuntu 17.10 corrupting BIOS - many LENOVO laptops models (LP: #1734147)
+    - [Config] CONFIG_SPI_INTEL_SPI_*=n
+
+  * power: commonise configs IBMVETH/IBMVSCSI and ensure both are in linux-image
+    and udebs (LP: #1521712)
+    - [Config] Include ibmvnic in nic-modules
+
+  * Enable arm64 emulation of removed ARMv7 instructions (LP: #1545542)
+    - [Config] Enable support for emulation of deprecated ARMv8 instructions
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl with 4.15 compat fix (LP:#1737761)
+    - Enable zfs build
+    - [Debian] add icp to zfs-modules.ignore
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 18 Dec 2017 09:27:13 -0600
+
+linux (4.15.0-1.2) bionic; urgency=low
+
+  * Disabling zfs does not always disable module checks for the zfs modules
+    (LP: #1737176)
+    - [Packaging] disable zfs module checks when zfs is disabled
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_UNWINDER_FRAME_POINTER=y for amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 10 Dec 2017 22:07:19 -0600
+
+linux (4.15.0-0.1) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu: vbox -- update to 5.2.2-dfsg-2
+    - ubuntu: vbox: build fixes for 4.15
+    - disable hio build
+    - [Config] Update kernel lockdown options to fix build errors
+    - Disable zfs build
+    - SAUCE: Import aufs driver
+    - [Config] Enable AUFS config options
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.15-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 08 Dec 2017 13:55:42 -0600
+
+linux (4.14.0-11.13) bionic; urgency=low
+
+  * linux: 4.14.0-11.13 -proposed tracker (LP: #1736168)
+
+  * CVE-2017-1000405
+    - mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
+
+  * linux 4.14.0-7.9 ADT test failure with linux 4.14.0-7.9 (LP: #1732463)
+    - SAUCE: mm: disable vma based swap readahead by default
+    - SAUCE: mm: fix memory hotplug in ZONE_HIGHMEM
+
+  * Bionic update to v4.14.3 stable release (LP: #1735843)
+    - s390: fix transactional execution control register handling
+    - s390/noexec: execute kexec datamover without DAT
+    - s390/runtime instrumention: fix possible memory corruption
+    - s390/guarded storage: fix possible memory corruption
+    - s390/disassembler: add missing end marker for e7 table
+    - s390/disassembler: increase show_code buffer size
+    - ACPI / PM: Fix acpi_pm_notifier_lock vs flush_workqueue() deadlock
+    - ACPI / EC: Fix regression related to triggering source of EC event handling
+    - cpufreq: schedutil: Reset cached_raw_freq when not in sync with next_freq
+    - serdev: fix registration of second slave
+    - sched: Make resched_cpu() unconditional
+    - lib/mpi: call cond_resched() from mpi_powm() loop
+    - x86/boot: Fix boot failure when SMP MP-table is based at 0
+    - x86/decoder: Add new TEST instruction pattern
+    - x86/entry/64: Fix entry_SYSCALL_64_after_hwframe() IRQ tracing
+    - x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
+    - perf/x86/intel: Hide TSX events when RTM is not supported
+    - arm64: Implement arch-specific pte_access_permitted()
+    - ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
+    - ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
+    - uapi: fix linux/tls.h userspace compilation error
+    - uapi: fix linux/rxrpc.h userspace compilation errors
+    - MIPS: cmpxchg64() and HAVE_VIRT_CPU_ACCOUNTING_GEN don't work for 32-bit SMP
+    - MIPS: ralink: Fix MT7628 pinmux
+    - MIPS: ralink: Fix typo in mt7628 pinmux function
+    - net: mvneta: fix handling of the Tx descriptor counter
+    - nbd: wait uninterruptible for the dead timeout
+    - nbd: don't start req until after the dead connection logic
+    - PM / OPP: Add missing of_node_put(np)
+    - PCI/ASPM: Account for downstream device's Port Common_Mode_Restore_Time
+    - PCI/ASPM: Use correct capability pointer to program LTR_L1.2_THRESHOLD
+    - PCI: hv: Use effective affinity mask
+    - PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
+    - PCI: Apply Cavium ThunderX ACS quirk to more Root Ports
+    - ALSA: hda: Add Raven PCI ID
+    - dm integrity: allow unaligned bv_offset
+    - dm cache: fix race condition in the writeback mode overwrite_bio
+      optimisation
+    - dm crypt: allow unaligned bv_offset
+    - dm zoned: ignore last smaller runt zone
+    - dm mpath: remove annoying message of 'blk_get_request() returned -11'
+    - dm bufio: fix integer overflow when limiting maximum cache size
+    - ovl: Put upperdentry if ovl_check_origin() fails
+    - dm: allocate struct mapped_device with kvzalloc
+    - sched/rt: Simplify the IPI based RT balancing logic
+    - MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
+    - dm: fix race between dm_get_from_kobject() and __dm_destroy()
+    - dm: discard support requires all targets in a table support discards
+    - MIPS: Fix odd fp register warnings with MIPS64r2
+    - MIPS: Fix MIPS64 FP save/restore on 32-bit kernels
+    - MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
+    - MIPS: Fix an n32 core file generation regset support regression
+    - MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
+    - MIPS: math-emu: Fix final emulation phase for certain instructions
+    - rt2x00usb: mark device removed when get ENOENT usb error
+    - mm/z3fold.c: use kref to prevent page free/compact race
+    - autofs: don't fail mount for transient error
+    - nilfs2: fix race condition that causes file system corruption
+    - fscrypt: lock mutex before checking for bounce page pool
+    - eCryptfs: use after free in ecryptfs_release_messaging()
+    - libceph: don't WARN() if user tries to add invalid key
+    - bcache: check ca->alloc_thread initialized before wake up it
+    - fs: guard_bio_eod() needs to consider partitions
+    - fanotify: fix fsnotify_prepare_user_wait() failure
+    - isofs: fix timestamps beyond 2027
+    - btrfs: change how we decide to commit transactions during flushing
+    - f2fs: expose some sectors to user in inline data or dentry case
+    - NFS: Fix typo in nomigration mount option
+    - NFS: Revert "NFS: Move the flock open mode check into nfs_flock()"
+    - nfs: Fix ugly referral attributes
+    - NFS: Avoid RCU usage in tracepoints
+    - NFS: revalidate "." etc correctly on "open".
+    - nfsd: deal with revoked delegations appropriately
+    - rtlwifi: rtl8192ee: Fix memory leak when loading firmware
+    - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
+    - iwlwifi: fix firmware names for 9000 and A000 series hw
+    - md: fix deadlock error in recent patch.
+    - md: don't check MD_SB_CHANGE_CLEAN in md_allow_write
+    - Bluetooth: btqcomsmd: Add support for BD address setup
+    - md/bitmap: revert a patch
+    - fsnotify: clean up fsnotify_prepare/finish_user_wait()
+    - fsnotify: pin both inode and vfsmount mark
+    - fsnotify: fix pinning group in fsnotify_prepare_user_wait()
+    - ata: fixes kernel crash while tracing ata_eh_link_autopsy event
+    - ext4: fix interaction between i_size, fallocate, and delalloc after a crash
+    - ext4: prevent data corruption with inline data + DAX
+    - ext4: prevent data corruption with journaling + DAX
+    - ALSA: pcm: update tstamp only if audio_tstamp changed
+    - ALSA: usb-audio: Add sanity checks to FE parser
+    - ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
+    - ALSA: usb-audio: Add sanity checks in v2 clock parsers
+    - ALSA: timer: Remove kernel warning at compat ioctl error paths
+    - ALSA: hda/realtek - Fix ALC275 no sound issue
+    - ALSA: hda: Fix too short HDMI/DP chmap reporting
+    - ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization
+    - ALSA: hda/realtek - Fix ALC700 family no sound issue
+    - ASoC: sun8i-codec: Invert Master / Slave condition
+    - ASoC: sun8i-codec: Fix left and right channels inversion
+    - ASoC: sun8i-codec: Set the BCLK divider
+    - mfd: lpc_ich: Avoton/Rangeley uses SPI_BYT method
+    - fix a page leak in vhost_scsi_iov_to_sgl() error recovery
+    - 9p: Fix missing commas in mount options
+    - fs/9p: Compare qid.path in v9fs_test_inode
+    - net/9p: Switch to wait_event_killable()
+    - scsi: qla2xxx: Suppress a kernel complaint in qla_init_base_qpair()
+    - scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics()
+    - scsi: lpfc: fix pci hot plug crash in timer management routines
+    - scsi: lpfc: fix pci hot plug crash in list_add call
+    - scsi: lpfc: Fix crash receiving ELS while detaching driver
+    - scsi: lpfc: Fix FCP hba_wqidx assignment
+    - scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails
+    - iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref
+    - iscsi-target: Fix non-immediate TMR reference leak
+    - target: fix null pointer regression in core_tmr_drain_tmr_list
+    - target: fix buffer offset in core_scsi3_pri_read_full_status
+    - target: Fix QUEUE_FULL + SCSI task attribute handling
+    - target: Fix caw_sem leak in transport_generic_request_failure
+    - target: Fix quiese during transport_write_pending_qf endless loop
+    - target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK
+    - mtd: Avoid probe failures when mtd->dbg.dfs_dir is invalid
+    - mtd: nand: Export nand_reset() symbol
+    - mtd: nand: atmel: Actually use the PM ops
+    - mtd: nand: omap2: Fix subpage write
+    - mtd: nand: Fix writing mtdoops to nand flash.
+    - mtd: nand: mtk: fix infinite ECC decode IRQ issue
+    - mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush sequence
+    - p54: don't unregister leds when they are not initialized
+    - block: Fix a race between blk_cleanup_queue() and timeout handling
+    - raid1: prevent freeze_array/wait_all_barriers deadlock
+    - genirq: Track whether the trigger type has been set
+    - irqchip/gic-v3: Fix ppi-partitions lookup
+    - lockd: double unregister of inetaddr notifiers
+    - KVM: PPC: Book3S HV: Don't call real-mode XICS hypercall handlers if not
+      enabled
+    - KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
+    - KVM: SVM: obey guest PAT
+    - kvm: vmx: Reinstate support for CPUs without virtual NMI
+    - dax: fix PMD faults on zero-length files
+    - dax: fix general protection fault in dax_alloc_inode
+    - SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
+    - clk: ti: dra7-atl-clock: fix child-node lookups
+    - libnvdimm, dimm: clear 'locked' status on successful DIMM enable
+    - libnvdimm, pfn: make 'resource' attribute only readable by root
+    - libnvdimm, namespace: fix label initialization to use valid seq numbers
+    - libnvdimm, region : make 'resource' attribute only readable by root
+    - libnvdimm, namespace: make 'resource' attribute only readable by root
+    - svcrdma: Preserve CB send buffer across retransmits
+    - IB/srpt: Do not accept invalid initiator port names
+    - IB/cm: Fix memory corruption in handling CM request
+    - IB/hfi1: Fix incorrect available receive user context count
+    - IB/srp: Avoid that a cable pull can trigger a kernel crash
+    - IB/core: Avoid crash on pkey enforcement failed in received MADs
+    - IB/core: Only maintain real QPs in the security lists
+    - NFC: fix device-allocation error return
+    - spi-nor: intel-spi: Fix broken software sequencing codes
+    - i40e: Use smp_rmb rather than read_barrier_depends
+    - igb: Use smp_rmb rather than read_barrier_depends
+    - igbvf: Use smp_rmb rather than read_barrier_depends
+    - ixgbevf: Use smp_rmb rather than read_barrier_depends
+    - i40evf: Use smp_rmb rather than read_barrier_depends
+    - fm10k: Use smp_rmb rather than read_barrier_depends
+    - ixgbe: Fix skb list corruption on Power systems
+    - parisc: Fix validity check of pointer size argument in new CAS
+      implementation
+    - powerpc: Fix boot on BOOK3S_32 with CONFIG_STRICT_KERNEL_RWX
+    - powerpc/mm/radix: Fix crashes on Power9 DD1 with radix MMU and STRICT_RWX
+    - powerpc/perf/imc: Use cpu_to_node() not topology_physical_package_id()
+    - powerpc/signal: Properly handle return value from uprobe_deny_signal()
+    - powerpc/64s: Fix masking of SRR1 bits on instruction fault
+    - powerpc/64s/radix: Fix 128TB-512TB virtual address boundary case allocation
+    - powerpc/64s/hash: Fix 512T hint detection to use >= 128T
+    - powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case allocation
+    - powerpc/64s/hash: Fix fork() with 512TB process address space
+    - powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary
+    - media: Don't do DMA on stack for firmware upload in the AS102 driver
+    - media: rc: check for integer overflow
+    - media: rc: nec decoder should not send both repeat and keycode
+    - cx231xx-cards: fix NULL-deref on missing association descriptor
+    - media: v4l2-ctrl: Fix flags field on Control events
+    - media: venus: fix wrong size on dma_free
+    - media: venus: venc: fix bytesused v4l2_plane field
+    - media: venus: reimplement decoder stop command
+    - ARM64: dts: meson-gxl: Add alternate ARM Trusted Firmware reserved memory
+      zone
+    - iwlwifi: fix wrong struct for a000 device
+    - iwlwifi: add a new a000 device
+    - iwlwifi: pcie: sort IDs for the 9000 series for easier comparisons
+    - iwlwifi: add new cards for a000 series
+    - iwlwifi: add new cards for 8265 series
+    - iwlwifi: add new cards for 8260 series
+    - iwlwifi: fix PCI IDs and configuration mapping for 9000 series
+    - iwlwifi: mvm: support version 7 of the SCAN_REQ_UMAC FW command
+    - e1000e: Fix error path in link detection
+    - e1000e: Fix return value test
+    - e1000e: Separate signaling for link check/link up
+    - e1000e: Avoid receiver overrun interrupt bursts
+    - e1000e: fix buffer overrun while the I219 is processing DMA transactions
+    - Linux 4.14.3
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: s390/topology: don't inline cpu_to_node
+    - SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to 0.7.3-1ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 04 Dec 2017 09:08:07 -0600
+
+linux (4.14.0-10.12) bionic; urgency=low
+
+  * linux: 4.14.0-10.12 -proposed tracker (LP: #1734901)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Enable the ACPI kernel debugger and acpidbg tool
+    - [Packaging] Include arch/arm64/kernel/ftrace-mod.o in headers package
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 28 Nov 2017 08:46:49 -0600
+
+linux (4.14.0-9.11) bionic; urgency=low
+
+  * linux: 4.14.0-9.11 -proposed tracker (LP: #1734728)
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to
+      0.7.3-1ubuntu1"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Nov 2017 12:44:48 -0600
+
+linux (4.14.0-8.10) bionic; urgency=low
+
+  * linux: 4.14.0-8.10 -proposed tracker (LP: #1734695)
+
+  * Bionic update to v4.14.2 stable release (LP: #1734694)
+    - bio: ensure __bio_clone_fast copies bi_partno
+    - af_netlink: ensure that NLMSG_DONE never fails in dumps
+    - vxlan: fix the issue that neigh proxy blocks all icmpv6 packets
+    - net: cdc_ncm: GetNtbFormat endian fix
+    - fealnx: Fix building error on MIPS
+    - net/sctp: Always set scope_id in sctp_inet6_skb_msgname
+    - ima: do not update security.ima if appraisal status is not INTEGRITY_PASS
+    - serial: omap: Fix EFR write on RTS deassertion
+    - serial: 8250_fintek: Fix finding base_port with activated SuperIO
+    - tpm-dev-common: Reject too short writes
+    - rcu: Fix up pending cbs check in rcu_prepare_for_idle
+    - mm/pagewalk.c: report holes in hugetlb ranges
+    - ocfs2: fix cluster hang after a node dies
+    - ocfs2: should wait dio before inode lock in ocfs2_setattr()
+    - ipmi: fix unsigned long underflow
+    - mm/page_alloc.c: broken deferred calculation
+    - mm/page_ext.c: check if page_ext is not prepared
+    - coda: fix 'kernel memory exposure attempt' in fsync
+    - ipmi: Prefer ACPI system interfaces over SMBIOS ones
+    - Linux 4.14.2
+
+  * Bionic update to v4.14.1 stable release (LP: #1734693)
+    - EDAC, sb_edac: Don't create a second memory controller if HA1 is not present
+    - dmaengine: dmatest: warn user when dma test times out
+    - media: imon: Fix null-ptr-deref in imon_probe
+    - media: dib0700: fix invalid dvb_detach argument
+    - crypto: dh - Fix double free of ctx->p
+    - crypto: dh - Don't permit 'p' to be 0
+    - crypto: dh - Don't permit 'key' or 'g' size longer than 'p'
+    - crypto: brcm - Explicity ACK mailbox message
+    - USB: early: Use new USB product ID and strings for DbC device
+    - USB: usbfs: compute urb->actual_length for isochronous
+    - USB: Add delay-init quirk for Corsair K70 LUX keyboards
+    - usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
+    - USB: serial: metro-usb: stop I/O after failed open
+    - USB: serial: Change DbC debug device binding ID
+    - USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update
+    - USB: serial: garmin_gps: fix I/O after failed probe and remove
+    - USB: serial: garmin_gps: fix memory leak on probe errors
+    - selftests/x86/protection_keys: Fix syscall NR redefinition warnings
+    - x86/MCE/AMD: Always give panic severity for UC errors in kernel context
+    - platform/x86: peaq-wmi: Add DMI check before binding to the WMI interface
+    - platform/x86: peaq_wmi: Fix missing terminating entry for peaq_dmi_table
+    - HID: cp2112: add HIDRAW dependency
+    - HID: wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection
+    - rpmsg: glink: Add missing MODULE_LICENSE
+    - staging: wilc1000: Fix bssid buffer offset in Txq
+    - staging: sm750fb: Fix parameter mistake in poke32
+    - staging: ccree: fix 64 bit scatter/gather DMA ops
+    - staging: greybus: spilib: fix use-after-free after deregistration
+    - staging: rtl8188eu: Revert 4 commits breaking ARP
+    - spi: fix use-after-free at controller deregistration
+    - sparc32: Add cmpxchg64().
+    - sparc64: mmu_context: Add missing include files
+    - sparc64: Fix page table walk for PUD hugepages
+    - Linux 4.14.1
+
+  * Set PANIC_TIMEOUT=10 on Power Systems (LP: #1730660)
+    - [Config]: Set PANIC_TIMEOUT=10 on ppc64el
+
+  * enable CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH easily confuse users
+    (LP: #1732627)
+    - [Config] CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH=n
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.7.3-1ubuntu1, zfs to 0.7.3-1ubuntu1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 27 Nov 2017 07:43:44 -0600
+
+linux (4.14.0-7.9) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor: add base infastructure for socket mediation
+    - SAUCE: apparmor: af_unix mediation
+    - SAUCE: LSM stacking: procfs: add smack subdir to attrs
+    - SAUCE: LSM stacking: LSM: manage credential security blobs
+    - SAUCE: LSM stacking: LSM: Manage file security blobs
+    - SAUCE: LSM stacking: LSM: manage task security blobs
+    - SAUCE: LSM stacking: LSM: Infrastructure management of the remaining blobs
+    - SAUCE: LSM stacking: LSM: general but not extreme module stacking
+    - SAUCE: LSM stacking: LSM: Complete task_alloc hook
+    - SAUCE: LSM stacking: fixup procsfs: add smack subdir to attrs
+    - SAUCE: LSM stacking: fixup initialize task->security
+    - SAUCE: LSM stacking: fixup: alloc_task_ctx is dead code
+    - SAUCE: LSM stacking: add support for stacking getpeersec_stream
+    - SAUCE: LSM stacking: add stacking support to apparmor network hooks
+    - SAUCE: LSM stacking: fixup apparmor stacking enablement
+    - SAUCE: LSM stacking: fixup stacking kconfig
+    - SAUCE: LSM stacking: allow selecting multiple LSMs using kernel boot params
+    - SAUCE: LSM stacking: provide prctl interface for setting context
+    - SAUCE: LSM stacking: inherit current display LSM
+    - SAUCE: LSM stacking: keep an index for each registered LSM
+    - SAUCE: LSM stacking: verify display LSM
+    - SAUCE: LSM stacking: provide a way to specify the default display lsm
+    - SAUCE: LSM stacking: make sure LSM blob align on 64 bit boundaries
+    - SAUCE: LSM stacking: add /proc/<pid>/attr/display_lsm
+    - SAUCE: LSM stacking: add Kconfig to set default display LSM
+    - SAUCE: LSM stacking: add configs for LSM stacking
+    - SAUCE: LSM stacking: check for invalid zero sized writes
+    - [Config] Run updateconfigs after merging LSM stacking
+    - [Config] CONFIG_AMD_MEM_ENCRYPT=y
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 13 Nov 2017 08:12:08 -0600
+
+linux (4.14.0-6.8) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: add workarounds to enable ZFS for 4.14
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 06 Nov 2017 11:39:00 -0600
+
+linux (4.14.0-5.7) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Fix invocation of dh_prep for dbgsym packages
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 31 Oct 2017 07:07:23 -0500
+
+linux (4.14.0-4.5) bionic; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Packaging] virtualbox -- reduce in kernel module versions
+    - vbox-update: Fix up KERN_DIR definitions
+    - ubuntu: vbox -- update to 5.2.0-dfsg-2
+    - [Config] CONFIG_AMD_MEM_ENCRYPT=n
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 30 Oct 2017 13:29:20 -0500
+
+linux (4.14.0-3.4) artful; urgency=low
+
+  * Touchpad and TrackPoint Dose Not Work on Lenovo X1C6 and X280 (LP: #1723986)
+    - SAUCE: Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3
+    - SAUCE: Input: synaptics - Lenovo X1 Carbon 5 should use SMBUS/RMI
+    - SAUCE: Input: synaptics - add Intertouch support on X1 Carbon 6th and X280
+
+  * powerpc/64s: Add workaround for P9 vector CI load issuenext (LP: #1721070)
+    - powerpc/64s: Add workaround for P9 vector CI load issue
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: staging: vboxvideo: Fix reporting invalid suggested-offset-properties
+    - [Config] CONFIG_DRM_VBOXVIDEO=m
+    - SAUCE: Import aufs driver
+    - [Config] Enable aufs
+    - [Config] Reorder annotations file after enabling aufs
+    - vbox-update: Disable imported vboxvideo module
+    - ubuntu: vbox -- update to 5.1.30-dfsg-1
+    - Enable vbox
+    - hio: Use correct sizes when initializing ssd_index_bits* arrays
+    - hio: Update io stat accounting for 4.14
+    - Enable hio
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc5
+  * Rebase to v4.14-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 23 Oct 2017 13:53:52 -0500
+
+linux (4.14.0-2.3) artful; urgency=low
+
+  * [Bug] USB controller failed to respond on Denverton after loading
+    intel_th_pci module (LP: #1715833)
+    - SAUCE: PCI: Disable broken RTIT_BAR of Intel TH
+
+  * CONFIG_DEBUG_FS is not enabled by "make zfcpdump_defconfig" with Ubuntu
+    17.10 (kernel 4.13) (LP: #1719290)
+    - SAUCE: s390: update zfcpdump_defconfig
+
+  * Add installer support for Broadcom BCM573xx network drivers. (LP: #1720466)
+    - d-i: Add bnxt_en to nic-modules.
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Update annotations for 4.14-rc2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc3
+  * Rebase to v4.14-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 11 Oct 2017 16:04:27 -0500
+
+linux (4.14.0-1.2) artful; urgency=low
+
+  * [Bug] USB 3.1 Gen2 works as 5Gbps (LP: #1720045)
+    - xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
+
+  * Please make linux-libc-dev Provide: aufs-dev (LP: #1716091)
+    - [Packaging] Add aufs-dev to the Provides: for linux-libc-dev
+
+  * Upgrade to 4.13.0-11.12 in artful amd64 VM breaks display on wayland
+    (LP: #1718679)
+    - [Config] CONFIG_DRM_VBOXVIDEO=n
+
+  * ipmmu-vmsa driver breaks arm64 boots (LP: #1718734)
+    - [Config] Disable CONFIG_IPMMU_VMSA on arm64
+
+  * autopkgtest profile fails to build on armhf (LP: #1717920)
+    - [Packaging] autopkgtest -- disable d-i when dropping flavours
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_I2C_XLP9XX=m
+    - [Packaging] Use SRCPKGNAME rather than hard-coding the source package name
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 29 Sep 2017 09:09:11 -0400
+
+linux (4.14.0-0.1) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - Disable vbox build
+    - Disable hio build
+    - Disable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.14-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 19 Sep 2017 20:22:29 -0500
+
+linux (4.13.0-11.12) artful; urgency=low
+
+  * linux: 4.13.0-11.12 -proposed tracker (LP: #1716699)
+
+  * kernel panic -not syncing: Fatal exception: panic_on_oops (LP: #1708399)
+    - s390/mm: fix local TLB flushing vs. detach of an mm address space
+    - s390/mm: fix race on mm->context.flush_mm
+
+  * CVE-2017-1000251
+    - Bluetooth: Properly check L2CAP config option output buffer length
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 12 Sep 2017 10:18:38 -0500
+
+linux (4.13.0-10.11) artful; urgency=low
+
+  * linux: 4.13.0-10.11 -proposed tracker (LP: #1716287)
+
+  * please add aufs-dkms to the Provides: for the kernel packages (LP: #1716093)
+    - [Packaging] Add aufs-dkms to the Provides: for kernel packages
+
+  * Artful update to v4.13.1 stable release (LP: #1716284)
+    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
+    - USB: serial: option: add support for D-Link DWM-157 C1
+    - usb: Add device quirk for Logitech HD Pro Webcam C920-C
+    - usb:xhci:Fix regression when ATI chipsets detected
+    - USB: musb: fix external abort on suspend
+    - ANDROID: binder: add padding to binder_fd_array_object.
+    - ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES.
+    - USB: core: Avoid race of async_completed() w/ usbdev_release()
+    - staging/rts5208: fix incorrect shift to extract upper nybble
+    - staging: ccree: save ciphertext for CTS IV
+    - staging: fsl-dpaa2/eth: fix off-by-one FD ctrl bitmaks
+    - iio: adc: ti-ads1015: fix incorrect data rate setting update
+    - iio: adc: ti-ads1015: fix scale information for ADS1115
+    - iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set
+    - iio: adc: ti-ads1015: avoid getting stale result after runtime resume
+    - iio: adc: ti-ads1015: don't return invalid value from buffer setup callbacks
+    - iio: adc: ti-ads1015: add adequate wait time to get correct conversion
+    - driver core: bus: Fix a potential double free
+    - HID: wacom: Do not completely map WACOM_HID_WD_TOUCHRINGSTATUS usage
+    - binder: free memory on error
+    - crypto: caam/qi - fix compilation with CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
+    - crypto: caam/qi - fix compilation with DEBUG enabled
+    - thunderbolt: Fix reset response_type
+    - fpga: altera-hps2fpga: fix multiple init of l3_remap_lock
+    - intel_th: pci: Add Cannon Lake PCH-H support
+    - intel_th: pci: Add Cannon Lake PCH-LP support
+    - ath10k: fix memory leak in rx ring buffer allocation
+    - drm/vgem: Pin our pages for dmabuf exports
+    - drm/ttm: Fix accounting error when fail to get pages for pool
+    - drm/dp/mst: Handle errors from drm_atomic_get_private_obj_state() correctly
+    - rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
+    - Bluetooth: Add support of 13d3:3494 RTL8723BE device
+    - iwlwifi: pci: add new PCI ID for 7265D
+    - dlm: avoid double-free on error path in dlm_device_{register,unregister}
+    - mwifiex: correct channel stat buffer overflows
+    - MCB: add support for SC31 to mcb-lpc
+    - s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs
+    - drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
+    - drm/nouveau: Fix error handling in nv50_disp_atomic_commit
+    - workqueue: Fix flag collision
+    - ahci: don't use MSI for devices with the silly Intel NVMe remapping scheme
+    - cs5536: add support for IDE controller variant
+    - scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
+    - scsi: sg: recheck MMAP_IO request length with lock held
+    - of/device: Prevent buffer overflow in of_device_modalias()
+    - rtlwifi: Fix memory leak when firmware request fails
+    - rtlwifi: Fix fallback firmware loading
+    - Linux 4.13.1
+
+  * Kernel has trouble recognizing Corsair Strafe RGB keyboard (LP: #1678477)
+    - usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
+
+  * SRIOV: warning if unload VFs (LP: #1715073)
+    - PCI: Disable VF decoding before pcibios_sriov_disable() updates resources
+
+  * [Patch] network-i40e:NVM bug fixes (cherrypick from 4.14) (LP: #1715578)
+    - i40e: avoid NVM acquire deadlock during NVM update
+    - i40e: point wb_desc at the nvm_wb_desc during i40e_read_nvm_aq
+
+  * [P9,POwer NV] Perf PMU event : pm_br_2path and pm_ld_miss_l1 is counted
+    twice when perf stat is done (perf:) (LP: #1714571)
+    - perf vendor events powerpc: Remove duplicate events
+
+  * Unable to install Ubuntu on the NVMe disk under VMD PCI domain
+    (LP: #1703339)
+    - [Config] Include vmd in storage-core-modules udeb
+
+  * 17.10 fails to boot on POWER9 DD2.0 with Deep stop states (LP: #1715064)
+    - powerpc/powernv: Save/Restore additional SPRs for stop4 cpuidle
+    - powerpc/powernv: Clear PECE1 in LPCR via stop-api only on Hotplug
+    - SAUCE: powerpc/powernv: Clear LPCR[PECE1] via stop-api only for deep state
+      offline
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: selftests/seccomp: Support glibc 2.26 siginfo_t.h
+    - Revert "UBUNTU: SAUCE: Import aufs driver"
+    - SAUCE: Import aufs driver
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 10 Sep 2017 17:48:59 -0500
+
+linux (4.13.0-9.10) artful; urgency=low
+
+  * linux: 4.13.0-9.10 -proposed tracker (LP: #1715145)
+
+  * EDAC sbridge: Failed to register device with error -22. (LP: #1714112)
+    - [Config] CONFIG_EDAC_GHES=n
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu: vbox -- update to 5.1.26-dfsg-2
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 05 Sep 2017 07:51:19 -0500
+
+linux (4.13.0-8.9) artful; urgency=low
+
+  * snapd 2.27.3+17.10 ADT test failure with linux 4.13.0-6.7 (LP: #1713103)
+    - SAUCE: apparmor: fix apparmorfs DAC access, permissions
+
+  * enable ARCH_SUNXI (and friends) in arm64 kernel .config (LP: #1701137)
+    - [Config] Enable CONFIG_ARCH_SUNXI and related options for arm64
+
+  * [Bug] Harrisonville: pnd2_edac always fail to load on B1 stepping
+    Harrisonville SDP (LP: #1709257)
+    - EDAC, pnd2: Build in a minimal sideband driver for Apollo Lake
+    - EDAC, pnd2: Mask off the lower four bits of a BAR
+    - EDAC, pnd2: Conditionally unhide/hide the P2SB PCI device to read BAR
+    - EDAC, pnd2: Properly toggle hidden state for P2SB PCI device
+    - SAUCE: i2c: i801: Restore the presence state of P2SB PCI device after
+      reading BAR
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: Import aufs driver"
+    - SAUCE: Import aufs driver
+    - SAUCE: selftests/powerpc: Disable some ptrace selftests
+    - [Config] CONFIG_CRYPTO_DEV_NITROX_CNN55XX=n for s390x
+    - [Config] CONFIG_I2C_SLAVE=n for amd64, i386, ppc64el
+    - [Config] Disable CONFIG_MDIO_* options for s390x
+    - [Config] CONFIG_SCSI_MQ_DEFAULT=n for s390x
+    - [Config] Update annotations for 4.13
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 31 Aug 2017 14:27:09 -0500
+
+linux (4.13.0-7.8) artful; urgency=low
+
+  * linux 4.12.0-11.12 ADT test failure with linux 4.12.0-11.12 (LP: #1710904)
+    - SAUCE: selftests/powerpc: Use snprintf to construct DSCR sysfs interface
+      paths
+
+  * Miscellaneous Ubuntu changes
+    - Revert "UBUNTU: SAUCE: seccomp: log actions even when audit is disabled"
+
+  * Miscellaneous upstream changes
+    - seccomp: Provide matching filter for introspection
+    - seccomp: Sysctl to display available actions
+    - seccomp: Operation for checking if an action is available
+    - seccomp: Sysctl to configure actions that are allowed to be logged
+    - seccomp: Selftest for detection of filter flag support
+    - seccomp: Filter flag to log all actions except SECCOMP_RET_ALLOW
+    - seccomp: Action to log before allowing
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 28 Aug 2017 08:12:24 -0500
+
+linux (4.13.0-6.7) artful; urgency=low
+
+  * HID: multitouch: Support ALPS PTP Stick and Touchpad devices (LP: #1712481)
+    - SAUCE: HID: multitouch: Support ALPS PTP stick with pid 0x120A
+
+  * sort ABI files with C.UTF-8 locale (LP: #1712345)
+    - [Packaging] sort ABI files with C.UTF-8 locale
+
+  * igb: Support using Broadcom 54616 as PHY (LP: #1712024)
+    - SAUCE: igb: add support for using Broadcom 54616 as PHY
+
+  * RPT related fixes missing in Ubuntu 16.04.3 (LP: #1709220)
+    - powerpc/mm/radix: Improve _tlbiel_pid to be usable for PWC flushes
+    - powerpc/mm/radix: Improve TLB/PWC flushes
+    - powerpc/mm/radix: Avoid flushing the PWC on every flush_tlb_range
+
+  * Linux 4.12 refuses to load self-signed modules under Secure Boot with
+    properly enrolled keys (LP: #1712168)
+    - SAUCE: (efi-lockdown) MODSIGN: Fix module signature verification
+
+  * [17.10 FEAT] Enable NVMe driver - kernel (LP: #1708432)
+    - [Config] CONFIG_BLK_DEV_NVME=m for s390
+
+  * Artful: 4.12.0-11.12: Boot panic in vlv2_plat_configure_clock+0x3b/0xa0
+    (LP: #1711298)
+    - [Config] CONFIG_INTEL_ATOMISP=n
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: apparmor: af_unix mediation
+
+  * Miscellaneous upstream changes
+    - apparmor: Fix shadowed local variable in unpack_trans_table()
+    - apparmor: Fix logical error in verify_header()
+    - apparmor: Fix an error code in aafs_create()
+    - apparmor: Redundant condition: prev_ns. in [label.c:1498]
+    - apparmor: add the ability to mediate signals
+    - apparmor: add mount mediation
+    - apparmor: cleanup conditional check for label in label_print
+    - apparmor: add support for absolute root view based labels
+    - apparmor: make policy_unpack able to audit different info messages
+    - apparmor: add more debug asserts to apparmorfs
+    - apparmor: add base infastructure for socket mediation
+    - apparmor: move new_null_profile to after profile lookup fns()
+    - apparmor: fix race condition in null profile creation
+    - apparmor: ensure unconfined profiles have dfas initialized
+    - apparmor: fix incorrect type assignment when freeing proxies
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 23 Aug 2017 08:10:38 -0500
+
+linux (4.13.0-5.6) artful; urgency=low
+
+  * Ubuntu17.10 - perf: Update Power9 PMU event JSON files (LP: #1708630)
+    - perf pmu-events: Support additional POWER8+ PVR in mapfile
+    - perf vendor events: Add POWER9 PMU events
+    - perf vendor events: Add POWER9 PVRs to mapfile
+    - SAUCE: perf vendor events powerpc: remove suffix in mapfile
+    - SAUCE: perf vendor events powerpc: Update POWER9 events
+
+  * Disable CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE (LP: #1709171)
+    - [Config] CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=n for ppc64el
+
+  * Please only recommend or suggest initramfs-tools | linux-initramfs-tool for
+    kernels able to boot without initramfs (LP: #1700972)
+    - [Debian] Don't depend on initramfs-tools
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - SAUCE: aufs -- Add missing argument to loop_switch() call
+    - [Config] Enable aufs
+    - SAUCE: (noup) Update spl to 0.6.5.11-ubuntu1, zfs to 0.6.5.11-1ubuntu3
+    - Enable zfs build
+    - SAUCE: powerpc: Always initialize input array when calling epapr_hypercall()
+    - [Packaging] switch up to debhelper 9
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 15 Aug 2017 09:24:16 -0500
+
+linux (4.13.0-4.5) artful; urgency=low
+
+  * Lenovo Yoga 910 Sensors (LP: #1708120)
+    - SAUCE: (no-up) HID: Add quirk for Lenovo Yoga 910 with ITE Chips
+
+  * Unable to install Ubuntu on the NVMe disk under VMD PCI domain
+    (LP: #1703339)
+    - [Config] Add vmd driver to generic inclusion list
+
+  * Set CONFIG_SATA_HIGHBANK=y on armhf (LP: #1703430)
+    - [Config] CONFIG_SATA_HIGHBANK=y
+
+  * Miscellaneous Ubuntu changes
+    - ubuntu: vbox -- update to 5.1.26-dfsg-1
+    - SAUCE: hio: Build fixes for 4.13
+    - Enable hio build
+    - SAUCE: (noup) Update spl to 0.6.5.11-1, zfs to 0.6.5.11-1ubuntu1
+    - [debian] use all rather than amd64 dkms debs for sync
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc4
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 08 Aug 2017 11:31:48 -0500
+
+linux (4.13.0-3.4) artful; urgency=low
+
+  * Adt tests of src:linux time out often on armhf lxc containers (LP: #1705495)
+    - [Packaging] tests -- reduce rebuild test to one flavour
+    - [Packaging] tests -- reduce rebuild test to one flavour -- use filter
+
+  * snapd 2.26.8+17.10 ADT test failure with linux 4.12.0-6.7 (LP: #1704158)
+    - SAUCE: virtio_net: Revert mergeable buffer handling rework
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 31 Jul 2017 10:08:16 -0500
+
+linux (4.13.0-2.3) artful; urgency=low
+
+  * Change CONFIG_IBMVETH to module (LP: #1704479)
+    - [Config] CONFIG_IBMVETH=m
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 24 Jul 2017 13:58:08 -0500
+
+linux (4.13.0-1.2) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Support sphinx-based kernel documentation
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Thu, 20 Jul 2017 09:18:33 -0500
+
+linux (4.13.0-0.1) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - Disable hio
+    - Disable zfs build
+    - ubuntu: vbox -- update to 5.1.24-dfsg-1
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.13-rc1
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 19 Jul 2017 15:09:31 -0500
+
+linux (4.12.0-7.8) artful; urgency=low
+
+  * ThunderX: soft lockup on 4.8+ kernels when running qemu-efi with vhost=on
+    (LP: #1673564)
+    - arm64: Add a facility to turn an ESR syndrome into a sysreg encoding
+    - KVM: arm/arm64: vgic-v3: Add accessors for the ICH_APxRn_EL2 registers
+    - KVM: arm64: Make kvm_condition_valid32() accessible from EL2
+    - KVM: arm64: vgic-v3: Add hook to handle guest GICv3 sysreg accesses at EL2
+    - KVM: arm64: vgic-v3: Add ICV_BPR1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_IGRPEN1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_IAR1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_EOIR1_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_AP1Rn_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_HPPIR1_EL1 handler
+    - KVM: arm64: vgic-v3: Enable trapping of Group-1 system registers
+    - KVM: arm64: Enable GICv3 Group-1 sysreg trapping via command-line
+    - KVM: arm64: vgic-v3: Add ICV_BPR0_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_IGNREN0_EL1 handler
+    - KVM: arm64: vgic-v3: Add misc Group-0 handlers
+    - KVM: arm64: vgic-v3: Enable trapping of Group-0 system registers
+    - KVM: arm64: Enable GICv3 Group-0 sysreg trapping via command-line
+    - arm64: Add MIDR values for Cavium cn83XX SoCs
+    - arm64: Add workaround for Cavium Thunder erratum 30115
+    - KVM: arm64: vgic-v3: Add ICV_DIR_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_RPR_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_CTLR_EL1 handler
+    - KVM: arm64: vgic-v3: Add ICV_PMR_EL1 handler
+    - KVM: arm64: Enable GICv3 common sysreg trapping via command-line
+    - KVM: arm64: vgic-v3: Log which GICv3 system registers are trapped
+    - KVM: arm64: Log an error if trapping a read-from-write-only GICv3 access
+    - KVM: arm64: Log an error if trapping a write-to-read-only GICv3 access
+
+  * hns: under heavy load, NIC may fail and require reboot (LP: #1704146)
+    - net: hns: Bugfix for Tx timeout handling in hns driver
+
+  * New ACPI identifiers for ThunderX SMMU (LP: #1703437)
+    - iommu/arm-smmu: Plumb in new ACPI identifiers
+
+  * Transparent hugepages should default to enabled=madvise (LP: #1703742)
+    - SAUCE: use CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y as default
+
+  * Artful update to v4.12.1 stable release (LP: #1703858)
+    - driver core: platform: fix race condition with driver_override
+    - RDMA/uverbs: Check port number supplied by user verbs cmds
+    - usb: dwc3: replace %p with %pK
+    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
+    - usb: usbip: set buffer pointers to NULL after free
+    - Add USB quirk for HVR-950q to avoid intermittent device resets
+    - usb: Fix typo in the definition of Endpoint[out]Request
+    - USB: core: fix device node leak
+    - USB: serial: option: add two Longcheer device ids
+    - USB: serial: qcserial: new Sierra Wireless EM7305 device ID
+    - xhci: Limit USB2 port wake support for AMD Promontory hosts
+    - gfs2: Fix glock rhashtable rcu bug
+    - Add "shutdown" to "struct class".
+    - tpm: Issue a TPM2_Shutdown for TPM2 devices.
+    - tpm: fix a kernel memory leak in tpm-sysfs.c
+    - powerpc/powernv: Fix CPU_HOTPLUG=n idle.c compile error
+    - x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
+    - sched/fair, cpumask: Export for_each_cpu_wrap()
+    - sched/core: Implement new approach to scale select_idle_cpu()
+    - sched/numa: Use down_read_trylock() for the mmap_sem
+    - sched/numa: Override part of migrate_degrades_locality() when idle balancing
+    - sched/fair: Simplify wake_affine() for the single socket case
+    - sched/numa: Implement NUMA node level wake_affine()
+    - sched/fair: Remove effective_load()
+    - sched/numa: Hide numa_wake_affine() from UP build
+    - xen: avoid deadlock in xenbus driver
+    - crypto: drbg - Fixes panic in wait_for_completion call
+    - Linux 4.12.1
+
+  * cxlflash update request in the Xenial SRU stream (LP: #1702521)
+    - scsi: cxlflash: Combine the send queue locks
+    - scsi: cxlflash: Update cxlflash_afu_sync() to return errno
+    - scsi: cxlflash: Reset hardware queue context via specified register
+    - scsi: cxlflash: Schedule asynchronous reset of the host
+    - scsi: cxlflash: Handle AFU sync failures
+    - scsi: cxlflash: Track pending scsi commands in each hardware queue
+    - scsi: cxlflash: Flush pending commands in cleanup path
+    - scsi: cxlflash: Add scsi command abort handler
+    - scsi: cxlflash: Create character device to provide host management interface
+    - scsi: cxlflash: Separate AFU internal command handling from AFU sync
+      specifics
+    - scsi: cxlflash: Introduce host ioctl support
+    - scsi: cxlflash: Refactor AFU capability checking
+    - scsi: cxlflash: Support LUN provisioning
+    - scsi: cxlflash: Support AFU debug
+    - scsi: cxlflash: Support WS16 unmap
+    - scsi: cxlflash: Remove zeroing of private command data
+    - scsi: cxlflash: Update TMF command processing
+    - scsi: cxlflash: Avoid double free of character device
+    - scsi: cxlflash: Update send_tmf() parameters
+    - scsi: cxlflash: Update debug prints in reset handlers
+
+  * make snap-pkg support (LP: #1700747)
+    - make snap-pkg support
+
+  * Quirk for non-compliant PCI bridge on HiSilicon D05 board (LP: #1698706)
+    - SAUCE: PCI: Support hibmc VGA cards behind a misbehaving HiSilicon bridge
+
+  * arm64: fix crash reading /proc/kcore (LP: #1702749)
+    - fs/proc: kcore: use kcore_list type to check for vmalloc/module address
+    - arm64: mm: select CONFIG_ARCH_PROC_KCORE_TEXT
+
+  * Opal and POWER9 DD2 (LP: #1702159)
+    - SAUCE: powerpc/powernv: Tell OPAL about our MMU mode on POWER9
+
+  * Data corruption with hio driver  (LP: #1701316)
+    - SAUCE: hio: Fix incorrect use of enum req_opf values
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.6.5.10-1, zfs to 0.6.5.10-1ubuntu2
+    - snapcraft.yaml: Sync with xenial
+    - [Config] CONFIG_CAVIUM_ERRATUM_30115=y
+
+  * Miscellaneous upstream changes
+    - Revert "UBUNTU: SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and
+      MokSBState"
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 14 Jul 2017 15:25:41 -0500
+
+linux (4.12.0-6.7) artful; urgency=low
+
+  * update ENA driver to 1.2.0k from net-next (LP: #1701575)
+    - net: ena: change return value for unsupported features unsupported return
+      value
+    - net: ena: add hardware hints capability to the driver
+    - net: ena: change sizeof() argument to be the type pointer
+    - net: ena: add reset reason for each device FLR
+    - net: ena: add support for out of order rx buffers refill
+    - net: ena: allow the driver to work with small number of msix vectors
+    - net: ena: use napi_schedule_irqoff when possible
+    - net: ena: separate skb allocation to dedicated function
+    - net: ena: use lower_32_bits()/upper_32_bits() to split dma address
+    - net: ena: update driver's rx drop statistics
+    - net: ena: update ena driver to version 1.2.0
+
+  * APST gets enabled against explicit kernel option (LP: #1699004)
+    - nvme: explicitly disable APST on quirked devices
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: hio: Update to Huawei ES3000_V2 (2.1.0.40)
+    - SAUCE: hio updates for 4.12
+    - SAUCE: Enable hio build
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 05 Jul 2017 14:23:20 -0500
+
+linux (4.12.0-5.6) artful; urgency=low
+
+  * ERAT invalidate on context switch removal (LP: #1700819)
+    - powerpc: Only do ERAT invalidate on radix context switch on P9 DD1
+
+  * powerpc: Invalidate ERAT on powersave wakeup for POWER9 (LP: #1700521)
+    - SAUCE: powerpc: Invalidate ERAT on powersave wakeup for POWER9
+
+  * Miscellaneous Ubuntu changes
+    - d-i: Move qcom-emac from arm64 to shared nic-modules
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 03 Jul 2017 07:52:02 -0500
+
+linux (4.12.0-4.5) artful; urgency=low
+
+  * aacraid driver may return uninitialized stack data to userspace
+    (LP: #1700077)
+    - SAUCE: scsi: aacraid: Don't copy uninitialized stack memory to userspace
+
+  * KILLER1435-S[0489:e0a2] BT cannot search BT 4.0 device (LP: #1699651)
+    - Bluetooth: btusb: Add support for 0489:e0a2 QCA_ROME device
+
+  * AACRAID for power9 platform (LP: #1689980)
+    - scsi: aacraid: Remove __GFP_DMA for raw srb memory
+    - scsi: aacraid: Fix DMAR issues with iommu=pt
+    - scsi: aacraid: Added 32 and 64 queue depth for arc natives
+    - scsi: aacraid: Set correct Queue Depth for HBA1000 RAW disks
+    - scsi: aacraid: Remove reset support from check_health
+    - scsi: aacraid: Change wait time for fib completion
+    - scsi: aacraid: Log count info of scsi cmds before reset
+    - scsi: aacraid: Print ctrl status before eh reset
+    - scsi: aacraid: Using single reset mask for IOP reset
+    - scsi: aacraid: Rework IOP reset
+    - scsi: aacraid: Add periodic checks to see IOP reset status
+    - scsi: aacraid: Rework SOFT reset code
+    - scsi: aacraid: Rework aac_src_restart
+    - scsi: aacraid: Use correct function to get ctrl health
+    - scsi: aacraid: Make sure ioctl returns on controller reset
+    - scsi: aacraid: Enable ctrl reset for both hba and arc
+    - scsi: aacraid: Add reset debugging statements
+    - scsi: aacraid: Remove reference to Series-9
+    - scsi: aacraid: Update driver version to 50834
+
+  * hibmc driver does not include "pci:" prefix in bus ID (LP: #1698700)
+    - SAUCE: drm: hibmc: Use set_busid function from drm core
+
+  * HiSilicon D05: installer doesn't appear on VGA (LP: #1698954)
+    - d-i: Add hibmc-drm to kernel-image udeb
+
+  * Fix /proc/cpuinfo revision for POWER9 DD2 (LP: #1698844)
+    - SAUCE: powerpc: Fix /proc/cpuinfo revision for POWER9 DD2
+
+  * Miscellaneous Ubuntu changes
+    - [Config] CONFIG_SATA_MV=n and CONFIG_GENERIC_PHY=n for s390x
+    - [Config] CONFIG_ATA=n for s390x
+    - [Config] Update annotations for 4.12
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 26 Jun 2017 11:27:29 -0500
+
+linux (4.12.0-3.4) artful; urgency=low
+
+  * Miscellaneous upstream changes
+    - ufs: fix the logics for tail relocation
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc6
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 19 Jun 2017 14:50:39 -0500
+
+linux (4.12.0-2.3) artful; urgency=low
+
+  * CVE-2014-9900
+    - SAUCE: (no-up) net: Zeroing the structure ethtool_wolinfo in
+      ethtool_get_wol()
+
+  * System doesn't boot properly on Gigabyte AM4 motherboards (AMD Ryzen)
+    (LP: #1671360)
+    - pinctrl/amd: Use regular interrupt instead of chained
+
+  * extend-diff-ignore should use exact matches (LP: #1693504)
+    - [Packaging] exact extend-diff-ignore matches
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: efi: Don't print secure boot state from the efi stub
+    - ubuntu: vbox -- Update to 5.1.22-dfsg-1
+    - SAUCE: vbox fixes for 4.12
+    - Re-enable virtualbox build
+    - [Config] CONFIG_ORANGEFS_FS=m
+    - SAUCE: (noup) Update spl to 0.6.5.9-1ubuntu2, zfs to 0.6.5.9-5ubuntu7
+    - Enable zfs build
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc4
+  * Rebase to v4.12-rc5
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 11 Jun 2017 22:25:13 -0500
+
+linux (4.12.0-1.2) artful; urgency=low
+
+  * Enable Matrox driver for Ubuntu 16.04.3 (LP: #1693337)
+    - [Config] Enable CONFIG_DRM_MGAG200 as module
+
+  * Support low-pin-count devices on Hisilicon SoCs (LP: #1677319)
+    - [Config] CONFIG_LIBIO=y on arm64 only
+    - SAUCE: LIBIO: Introduce a generic PIO mapping method
+    - SAUCE: OF: Add missing I/O range exception for indirect-IO devices
+    - [Config] CONFIG_HISILICON_LPC=y
+    - SAUCE: LPC: Support the device-tree LPC host on Hip06/Hip07
+    - SAUCE: LIBIO: Support the dynamically logical PIO registration of ACPI host
+      I/O
+    - SAUCE: LPC: Add the ACPI LPC support
+    - SAUCE: PCI: Apply the new generic I/O management on PCI IO hosts
+    - SAUCE: PCI: Restore codepath for !CONFIG_LIBIO
+
+  * POWER9: Additional patches for TTY and CPU_IDLE (LP: #1674325)
+    - SAUCE: tty: Fix ldisc crash on reopened tty
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Add build-dep on libnuma-dev to enable 'perf bench numa'
+    - Rebase to v4.12-rc3
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc3
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Mon, 29 May 2017 20:56:29 -0500
+
+linux (4.12.0-0.1) artful; urgency=low
+
+  * please enable CONFIG_ARM64_LSE_ATOMICS (LP: #1691614)
+    - [Config] CONFIG_ARM64_LSE_ATOMICS=y
+
+  * [Regression] NUMA_BALANCING disabled on arm64 (LP: #1690914)
+    - [Config] CONFIG_NUMA_BALANCING{,_DEFAULT_ENABLED}=y on arm64
+
+  * exec'ing a setuid binary from a threaded program sometimes fails to setuid
+    (LP: #1672819)
+    - SAUCE: exec: ensure file system accounting in check_unsafe_exec is correct
+
+  * Miscellaneous Ubuntu changes
+    - Update find-missing-sauce.sh to compare to artful
+    - Update dropped.txt
+    - SAUCE: (efi-lockdown) efi: Add EFI_SECURE_BOOT bit
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/mem and /dev/kmem when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Add a sysrq option to exit secure boot mode
+    - SAUCE: (efi-lockdown) kexec: Disable at runtime if the kernel is locked down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: Disable at runtime if securelevel has been
+      set
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) asus-wmi: Restrict debugfs interface when the kernel
+      is locked down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Enable cold boot attack mitigation
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) scsi: Lock down the eata driver
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) KEYS: Allow unrestricted boot-time addition of keys to
+      secondary keyring
+    - SAUCE: (efi-lockdown) efi: Add EFI signature data types
+    - SAUCE: (efi-lockdown) efi: Add an EFI signature blob parser
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Allow the "db" UEFI variable to be suppressed
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Add secure_boot state and status bit for
+      MokSBState
+    - SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and MokSBState
+    - [Config] Set values for UEFI secure boot lockdown options
+    - Disable virtualbox build
+    - Disable hio build
+    - SAUCE: securityfs: Replace CURRENT_TIME with current_time()
+    - Disable zfs build
+    - [Debian] Work out upstream tag for use with gen-auto-reconstruct
+    - SAUCE: Import aufs driver
+    - SAUCE: aufs -- Include linux/mm.h in fs/aufs/file.h
+    - [Config] Enable aufs
+    - SAUCE: perf callchain: Include errno.h on x86 unconditinally
+
+  [ Upstream Kernel Changes ]
+
+  * Rebase to v4.12-rc2
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Sun, 21 May 2017 23:44:44 -0500
+
+linux (4.11.0-3.8) artful; urgency=low
+
+  [ Seth Forshee ]
+
+  * Release Tracking Bug
+    - LP: #1690999
+
+  * apparmor_parser hangs indefinitely when called by multiple threads
+    (LP: #1645037)
+    - SAUCE: apparmor: fix lock ordering for mkdir
+
+  * apparmor leaking securityfs pin count (LP: #1660846)
+    - SAUCE: apparmor: fix leak on securityfs pin count
+
+  * apparmor reference count leak when securityfs_setup_d_inode\ () fails
+    (LP: #1660845)
+    - SAUCE: apparmor: fix reference count leak when securityfs_setup_d_inode()
+      fails
+
+  * apparmor not checking error if security_pin_fs() fails (LP: #1660842)
+    - SAUCE: apparmor: fix not handling error case when securityfs_pin_fs() fails
+
+  * libvirt profile is blocking global setrlimit despite having no rlimit rule
+    (LP: #1679704)
+    - SAUCE: apparmor: fix complain mode failure for rlimit mediation
+    - apparmor: update auditing of rlimit check to provide capability information
+
+  * apparmor: does not provide a way to detect policy updataes (LP: #1678032)
+    - SAUCE: apparmor: add policy revision file interface
+
+  * apparmor does not make support of query data visible (LP: #1678023)
+    - SAUCE: apparmor: add label data availability to the feature set
+
+  * apparmor query interface does not make supported query info available
+    (LP: #1678030)
+    - SAUCE: apparmor: add information about the query inteface to the feature set
+
+  * change_profile incorrect when using namespaces with a compound stack
+    (LP: #1677959)
+    - SAUCE: apparmor: fix label parse for stacked labels
+
+  * Regression in 4.4.0-65-generic causes very frequent system crashes
+    (LP: #1669611)
+    - apparmor: sync of apparmor 3.6+ (17.04)
+
+  * Artful update to 4.11.1 stable release (LP: #1690814)
+    - dm ioctl: prevent stack leak in dm ioctl call
+    - drm/sti: fix GDP size to support up to UHD resolution
+    - power: supply: lp8788: prevent out of bounds array access
+    - brcmfmac: Ensure pointer correctly set if skb data location changes
+    - brcmfmac: Make skb header writable before use
+    - sparc64: fix fault handling in NGbzero.S and GENbzero.S
+    - refcount: change EXPORT_SYMBOL markings
+    - net: macb: fix phy interrupt parsing
+    - tcp: fix access to sk->sk_state in tcp_poll()
+    - geneve: fix incorrect setting of UDP checksum flag
+    - bpf: enhance verifier to understand stack pointer arithmetic
+    - bpf, arm64: fix jit branch offset related to ldimm64
+    - tcp: fix wraparound issue in tcp_lp
+    - net: ipv6: Do not duplicate DAD on link up
+    - net: usb: qmi_wwan: add Telit ME910 support
+    - tcp: do not inherit fastopen_req from parent
+    - ipv4, ipv6: ensure raw socket message is big enough to hold an IP header
+    - rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
+    - ipv6: initialize route null entry in addrconf_init()
+    - ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
+    - tcp: randomize timestamps on syncookies
+    - bnxt_en: allocate enough space for ->ntp_fltr_bmap
+    - bpf: don't let ldimm64 leak map addresses on unprivileged
+    - net: mdio-mux: bcm-iproc: call mdiobus_free() in error path
+    - f2fs: sanity check segment count
+    - xen/arm,arm64: fix xen_dma_ops after 815dd18 "Consolidate get_dma_ops..."
+    - xen: Revert commits da72ff5bfcb0 and 72a9b186292d
+    - block: get rid of blk_integrity_revalidate()
+    - Linux 4.11.1
+
+  * Module signing exclusion for staging drivers does not work properly
+    (LP: #1690908)
+    - SAUCE: Fix module signing exclusion in package builds
+
+  * perf: qcom: Add L3 cache PMU driver (LP: #1689856)
+    - [Config] CONFIG_QCOM_L3_PMU=y
+    - perf: qcom: Add L3 cache PMU driver
+
+  * No PMU support for ACPI-based arm64 systems (LP: #1689661)
+    - drivers/perf: arm_pmu: rework per-cpu allocation
+    - drivers/perf: arm_pmu: manage interrupts per-cpu
+    - drivers/perf: arm_pmu: split irq request from enable
+    - drivers/perf: arm_pmu: remove pointless PMU disabling
+    - drivers/perf: arm_pmu: define armpmu_init_fn
+    - drivers/perf: arm_pmu: fold init into alloc
+    - drivers/perf: arm_pmu: factor out pmu registration
+    - drivers/perf: arm_pmu: simplify cpu_pmu_request_irqs()
+    - drivers/perf: arm_pmu: handle no platform_device
+    - drivers/perf: arm_pmu: rename irq request/free functions
+    - drivers/perf: arm_pmu: split cpu-local irq request/free
+    - drivers/perf: arm_pmu: move irq request/free into probe
+    - drivers/perf: arm_pmu: split out platform device probe logic
+    - arm64: add function to get a cpu's MADT GICC table
+    - [Config] CONFIG_ARM_PMU_ACPI=y
+    - drivers/perf: arm_pmu: add ACPI framework
+    - arm64: pmuv3: handle !PMUv3 when probing
+    - arm64: pmuv3: use arm_pmu ACPI framework
+
+  * Fix NVLINK2 TCE route (LP: #1690155)
+    - powerpc/powernv: Fix TCE kill on NVLink2
+
+  * CVE-2017-0605
+    - tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline()
+
+  * Miscellaneous Ubuntu changes
+    - [Config] Restore powerpc arch to annotations file
+    - [Config] Disable runtime testing modules
+    - [Config] Disable drivers not needed on s390x
+    - [Config] Update annotations for 4.11
+    - [Config] updateconfigs after apparmor updates
+
+  * Miscellaneous upstream changes
+    - apparmor: use SHASH_DESC_ON_STACK
+    - apparmor: fix invalid reference to index variable of iterator line 836
+    - apparmor: fix parameters so that the permission test is bypassed at boot
+    - apparmor: Make path_max parameter readonly
+    - apparmorfs: Combine two function calls into one in aa_fs_seq_raw_abi_show()
+    - apparmorfs: Use seq_putc() in two functions
+    - apparmor: provide information about path buffer size at boot
+    - apparmor: add/use fns to print hash string hex value
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 16 May 2017 00:39:13 -0500
+
+linux (4.11.0-2.7) artful; urgency=low
+
+  * kernel-wedge fails in artful due to leftover squashfs-modules d-i files
+    (LP: #1688259)
+    - Remove squashfs-modules files from d-i
+    - [Config] as squashfs-modules is builtin kernel-image must Provides: it
+
+  * [Zesty] d-i: replace msm_emac with qcom_emac (LP: #1677297)
+    - Revert "UBUNTU: d-i: initrd needs msm_emac on amberwing platform."
+    - d-i: initrd needs qcom_emac on amberwing platform.
+
+  * update for V3 kernel bits and improved multiple fan slice support
+    (LP: #1470091)
+    - SAUCE: fan: tunnel multiple mapping mode (v3)
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: (noup) Update spl to 0.6.5.9-1ubuntu1, zfs to 0.6.5.9-5ubuntu5
+    - Enable zfs
+    - SAUCE: fan: add VXLAN implementation
+    - SAUCE: (efi-lockdown) efi: Add EFI_SECURE_BOOT bit
+    - SAUCE: (efi-lockdown) Add the ability to lock down access to the running
+      kernel image
+    - SAUCE: (efi-lockdown) efi: Lock down the kernel if booted in secure boot
+      mode
+    - SAUCE: (efi-lockdown) Enforce module signatures if the kernel is locked down
+    - SAUCE: (efi-lockdown) Restrict /dev/mem and /dev/kmem when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Add a sysrq option to exit secure boot mode
+    - SAUCE: (efi-lockdown) kexec: Disable at runtime if the kernel is locked down
+    - SAUCE: (efi-lockdown) Copy secure_boot flag in boot params across kexec
+      reboot
+    - SAUCE: (efi-lockdown) kexec_file: Disable at runtime if securelevel has been
+      set
+    - SAUCE: (efi-lockdown) hibernate: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) uswsusp: Disable when the kernel is locked down
+    - SAUCE: (efi-lockdown) PCI: Lock down BAR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) x86: Lock down IO port access when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) x86: Restrict MSR access when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) asus-wmi: Restrict debugfs interface when the kernel
+      is locked down
+    - SAUCE: (efi-lockdown) ACPI: Limit access to custom_method when the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Ignore acpi_rsdp kernel param when the kernel
+      has been locked down
+    - SAUCE: (efi-lockdown) acpi: Disable ACPI table override if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) acpi: Disable APEI error injection if the kernel is
+      locked down
+    - SAUCE: (efi-lockdown) Enable cold boot attack mitigation
+    - SAUCE: (efi-lockdown) bpf: Restrict kernel image access functions when the
+      kernel is locked down
+    - SAUCE: (efi-lockdown) scsi: Lock down the eata driver
+    - SAUCE: (efi-lockdown) Prohibit PCMCIA CIS storage when the kernel is locked
+      down
+    - SAUCE: (efi-lockdown) Lock down TIOCSSERIAL
+    - SAUCE: (efi-lockdown) Add EFI signature data types
+    - SAUCE: (efi-lockdown) Add an EFI signature blob parser and key loader.
+    - SAUCE: (efi-lockdown) KEYS: Add a system blacklist keyring
+    - SAUCE: (efi-lockdown) MODSIGN: Import certificates from UEFI Secure Boot
+    - SAUCE: (efi-lockdown) MODSIGN: Support not importing certs from db
+    - SAUCE: (efi-lockdown) MODSIGN: Don't try secure boot if EFI runtime is
+      disabled
+    - SAUCE: (efi-lockdown) efi: Sanitize boot_params in efi stub
+    - SAUCE: (efi-lockdown) efi: Add secure_boot state and status bit for
+      MokSBState
+    - SAUCE: (efi-lockdown) efi: Add sysctls for secureboot and MokSBState
+    - [Config] Set values for UEFI secure boot lockdown options
+    - Update dropped.txt
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Fri, 05 May 2017 07:43:14 -0500
+
+linux (4.11.0-1.6) artful; urgency=low
+
+  * Miscellaneous Ubuntu changes
+    - [Debian] Use default compression for all packages
+    - SAUCE: (namespace) block_dev: Support checking inode permissions in
+      lookup_bdev()
+    - SAUCE: (namespace) block_dev: Check permissions towards block device inode
+      when mounting
+    - SAUCE: (namespace) mtd: Check permissions towards mtd block device inode
+      when mounting
+    - SAUCE: (namespace) fs: Allow superblock owner to change ownership of inodes
+    - SAUCE: (namespace) fs: Don't remove suid for CAP_FSETID for userns root
+    - SAUCE: (namespace) fs: Allow superblock owner to access do_remount_sb()
+    - SAUCE: (namespace) capabilities: Allow privileged user in s_user_ns to set
+      security.* xattrs
+    - SAUCE: (namespace) fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw
+      filesystems
+    - SAUCE: (namespace) fuse: Add support for pid namespaces
+    - SAUCE: (namespace) fuse: Support fuse filesystems outside of init_user_ns
+    - SAUCE: (namespace) fuse: Restrict allow_other to the superblock's namespace
+      or a descendant
+    - SAUCE: (namespace) fuse: Allow user namespace mounts
+    - SAUCE: (namespace) ext4: Add support for unprivileged mounts from user
+      namespaces
+    - SAUCE: (namespace) evm: Don't update hmacs in user ns mounts
+    - SAUCE: (namespace) ext4: Add module parameter to enable user namespace
+      mounts
+    - SAUCE: (namespace) block_dev: Forbid unprivileged mounting when device is
+      opened for writing
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Wed, 26 Apr 2017 10:08:29 -0500
+
+linux (4.11.0-0.5) artful; urgency=low
+
+  * [Hyper-V][SAUCE] pci-hyperv: Use only 16 bit integer for PCI domain
+    (LP: #1684971)
+    - SAUCE: pci-hyperv: Use only 16 bit integer for PCI domain
+
+  * [Hyper-V] Ubuntu 14.04.2 LTS Generation 2 SCSI Errors on VSS Based Backups
+    (LP: #1470250)
+    - SAUCE: Tools: hv: vss: Thaw the filesystem and continue after freeze fails
+
+  * Enable virtual scsi server driver for Power (LP: #1615665)
+    - SAUCE: Return TCMU-generated sense data to fabric module
+
+  * include/linux/security.h header syntax error with !CONFIG_SECURITYFS
+    (LP: #1630990)
+    - SAUCE: (no-up) include/linux/security.h -- fix syntax error with
+      CONFIG_SECURITYFS=n
+
+  * Miscellaneous Ubuntu changes
+    - SAUCE: Import aufs driver
+    - [Config] Enable aufs
+    - [Debian] Add script to update virtualbox
+    - ubuntu: vbox -- Update to 5.1.20-dfsg-2
+    - Enable vbox
+    - SAUCE: aufs -- Include linux/mm.h in fs/aufs/file.h
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc8
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 25 Apr 2017 13:42:54 -0500
+
+linux (4.11.0-0.4) zesty; urgency=low
+
+  * POWER9: Improve performance on memory management (LP: #1681429)
+    - SAUCE: powerpc/mm/radix: Don't do page walk cache flush when doing full mm
+      flush
+    - SAUCE: powerpc/mm/radix: Remove unnecessary ptesync
+
+  * Miscellaneous Ubuntu changes
+    - find-missing-sauce.sh
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc7
+
+ -- Seth Forshee <seth.forshee@canonical.com>  Tue, 18 Apr 2017 08:19:43 -0500
+
+linux (4.11.0-0.3) zesty; urgency=low
+
+  * Disable CONFIG_HVC_UDBG on ppc64el (LP: #1680888)
+    - [Config] Disable CONFIG_HVC_UDBG on ppc64el
+
+  * smartpqi driver needed in initram disk and installer (LP: #1680156)
+    - [Config] Add smartpqi to d-i
+
+  * Disable CONFIG_SECURITY_SELINUX_DISABLE (LP: #1680315)
+    - [Config] CONFIG_SECURITY_SELINUX_DISABLE=n
+
+  * Miscellaneous Ubuntu changes
+    - [Config] flash-kernel should be a Breaks
+    - [Config] drop the info directory
+    - [Config] drop NOTES as obsolete
+    - [Config] drop changelog.historical as obsolete
+    - rebase to v4.11-rc6
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc6
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Tue, 11 Apr 2017 07:16:52 -0600
+
+linux (4.11.0-0.2) zesty; urgency=low
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc5
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 03 Apr 2017 08:26:07 +0100
+
+linux (4.11.0-0.1) zesty; urgency=low
+
+  [ Upstream Kernel Changes ]
+
+  * rebase to v4.11-rc4
+    - LP: #1591053
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 20 Mar 2017 05:15:32 -0600
+
+linux (4.11.0-0.0) zesty; urgency=low
+
+  * dummy entry
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 20 Mar 2017 05:15:32 -0600
--- linux-qcom-6.8.0.orig/debian/cloud-tools/hv_get_dhcp_info
+++ linux-qcom-6.8.0/debian/cloud-tools/hv_get_dhcp_info
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# This example script retrieves the DHCP state of a given interface.
+# In the interest of keeping the KVP daemon code free of distro specific
+# information; the kvp daemon code invokes this external script to gather
+# DHCP setting for the specific interface.
+#
+# Input: Name of the interface
+#
+# Output: The script prints the string "Enabled" to stdout to indicate
+#	that DHCP is enabled on the interface. If DHCP is not enabled,
+#	the script prints the string "Disabled" to stdout.
+#
+# Each Distro is expected to implement this script in a distro specific
+# fashion. 
+
+#set -x
+
+IF_FILE="/etc/network/interfaces"
+NMCMD="nmcli"
+
+function checknetworkmanager {
+	#Assumes if $NMCMD exists, inteface exists and interface is not
+	#  in $IF_FILE then dhcp is being used by NM
+        if  hash $NMCMD >/dev/null 2>&1  ; then
+                if  $NMCMD  dev status |grep -q $1  ; then
+                        echo "Enabled"
+                else
+                        echo "Disabled"
+                fi
+        else
+                #Give up
+                echo "Disabled"
+        fi
+}
+
+if [ -z $1 ]  ; then echo "Disabled"; exit; fi
+
+if [ -e $IF_FILE ]; then
+	if grep -v -e "^#" $IF_FILE|grep -q $1 ; then
+		#interface exists so
+		if grep -q -e $1\.\*dhcp $IF_FILE; then 
+			echo "Enabled"; exit;
+		else
+			echo "Disabled"; exit;
+		fi
+	else
+		checknetworkmanager $1
+		exit
+	fi
+else
+	checknetworkmanager $1
+	exit
+fi
+
--- linux-qcom-6.8.0.orig/debian/cloud-tools/hv_get_dns_info
+++ linux-qcom-6.8.0/debian/cloud-tools/hv_get_dns_info
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# This example script parses /etc/resolv.conf to retrive DNS information.
+# In the interest of keeping the KVP daemon code free of distro specific
+# information; the kvp daemon code invokes this external script to gather
+# DNS information.
+# This script is expected to print the nameserver values to stdout.
+# Each Distro is expected to implement this script in a distro specific
+# fashion. For instance on Distros that ship with Network Manager enabled,
+# this script can be based on the Network Manager APIs for retrieving DNS
+# entries.
+
+cat /etc/resolv.conf 2>/dev/null | awk '/^nameserver/ { print $2 }'
--- linux-qcom-6.8.0.orig/debian/cloud-tools/hv_set_ifconfig
+++ linux-qcom-6.8.0/debian/cloud-tools/hv_set_ifconfig
@@ -0,0 +1,288 @@
+#!/usr/bin/python3
+#
+# hv_set_ifconfig <config> -- take the hv_kvp_daemon generated configuration
+#                             file and apply it to the Ubuntu configuration.
+#
+
+# CONFIG example:
+# HWADDR=11:22:33:44:55:66
+# DEVICE=foo1
+# DHCP=yes
+
+# CONFIG example:
+# HWADDR=11:22:33:44:55:66
+# DEVICE=foo1
+# IPADDR=192.168.99.10
+# GATEWAY=192.168.99.1
+# DNS1=192.168.88.250
+# IPADDR2=192.168.99.11
+# IPV6ADDR=2001:DB8:99::10
+# IPV6NETMASK=64
+# IPV6_DEFAULTGW=2001:DB8:99::10
+
+# set interfaces in hv_kvp_daemon style
+import fileinput
+import sys
+import errno
+import os
+import shutil
+import tempfile
+import subprocess
+
+if_filename="/etc/network/interfaces"
+
+# Drop our output (XXX?)
+sys.stdout = open(os.devnull, 'w')
+sys.stderr = open(os.devnull, 'w')
+
+# Confirm we can open the network configuration.
+try:
+    if_file=open(if_filename,"r+")
+except IOError as e:
+    exit(e.errno)
+else:
+    if_file.close()
+
+# Usage: hv_set_ifconfig <config>
+if len(sys.argv) != 2 :
+    exit(errno.EINVAL)
+
+#
+# Here is the format of the ip configuration file:
+#
+# HWADDR=macaddr
+# DEVICE=interface name
+# BOOTPROTO=<protocol> (where <protocol> is "dhcp" if DHCP is configured
+#                       or "none" if no boot-time protocol should be used)
+#
+# IPADDR0=ipaddr1
+# IPADDR1=ipaddr2
+# IPADDRx=ipaddry (where y = x + 1)
+#
+# NETMASK0=netmask1
+# NETMASKx=netmasky (where y = x + 1)
+#
+# GATEWAY=ipaddr1
+# GATEWAYx=ipaddry (where y = x + 1)
+#
+# DNSx=ipaddrx (where first DNS address is tagged as DNS1 etc)
+#
+# IPV6 addresses will be tagged as IPV6ADDR, IPV6 gateway will be
+# tagged as IPV6_DEFAULTGW and IPV6 NETMASK will be tagged as
+# IPV6NETMASK.
+#
+
+kvp=dict(line.strip().split("=") for line in fileinput.input())
+
+# Setting the hwaddress to something azure is not expecting is fatal
+# to networking.
+if not "HWADDR" in kvp :
+    exit(errno.EPROTO)
+
+# Confirm we have a device specified.
+if not "DEVICE" in kvp :
+    exit(1)
+
+autolist = []
+output=[]
+basename=kvp["DEVICE"]
+
+# DNS entries will go with the first interface and there can be a max
+# of three.  These will be emitted with the first interface.
+dns = []
+for count in (1, 2, 3):
+    key = "DNS" + str(count)
+    if key in kvp:
+        dns += [kvp[key]]
+dns_emitted = False
+
+# IPV4 may either be dhcp or static.
+if ("DHCP" in kvp and kvp["DHCP"] == "yes") or \
+   ("BOOTPROTO" in kvp and kvp["BOOTPROTO"] == "dhcp"):
+    autolist.append(basename)
+    output += ["iface " + basename  + " inet dhcp"]
+    output += [""]
+else:
+    # Matchup the interface specific lines
+
+    # No real max for the number of interface + aliases ...
+    # only required is the address (but mate everything up that comes in.
+
+    # IPv4 -- ensure we sort by numeric suffixes.
+    v4names = [ int(name[6:]) for name in kvp.keys() if name.startswith("IPADDR") ]
+    v4names.sort()
+
+    for if_count in v4names:
+        ifname = basename
+        which = str(if_count)
+
+        if if_count:
+            ifname += ":" + str(if_count)
+            which_gw = which
+        else:
+            which_gw = ""
+
+        if not ifname in autolist:
+            autolist += [ifname]
+
+        output += [ "iface " + ifname + " inet static" ]
+        output += [ "\t" + "address " + kvp["IPADDR" + which] ]
+        if "NETMASK" + which in kvp:
+            output += [ "\tnetmask " + kvp["NETMASK" + which] ]
+        if "GATEWAY" + which_gw in kvp:
+            output += ["\tgateway " + kvp["GATEWAY" + which_gw]]
+
+        if not dns_emitted:
+            dns_emitted = True
+            output += ["\tdns-nameservers " + ' '.join(dns)]
+        output += [""]
+
+# IPv6 requires a netmask
+# If an ipv6 exists, you'll want to turn off /proc/sys/net/ipv6/conf/all/autoconf with
+# echo 0 > /proc/sys/net/ipv6/conf/all/autoconf
+v6names = [ int(name[8:]) for name in kvp.keys() if name.startswith("IPV6ADDR") ]
+v6names.sort()
+
+for if6_count in v6names:
+    ifname = basename
+    which = str(if6_count)
+
+    if if6_count:
+        ifname += ":" + str(if6_count)
+        which_gw = which
+    else:
+        which_gw = ""
+
+    if not ifname in autolist:
+        autolist += [ifname]
+
+    if "IPV6NETMASK" + which in kvp:
+        output += [ "iface " + ifname + " inet6 static"]
+        output += [ "\taddress " + kvp["IPV6ADDR" + which]]
+        output += [ "\tnetmask " + kvp["IPV6NETMASK" + which]]
+        if "IPV6_DEFAULTGW" + which_gw in kvp:
+            output += [ "\tgateway " + kvp["IPV6_DEFAULTGW" + which_gw] ]
+        if not dns_emitted:
+            dns_emitted = True
+            output += ["\tdns-nameservers " + ' '.join(dns)]
+        output += [""]
+
+# Mark this new interface for automatic up.
+if len(autolist):
+    output = ["auto "+" ".join(autolist)] + output
+
+print("===================================")
+print(output)
+print("===================================")
+
+
+# Time to clean out the existing interface file
+
+# Markers.
+start_mark = "# The following stanza(s) added by hv_set_ifconfig"
+end_mark = "#End of hv_set_ifconfig stanzas"
+
+f=open(if_filename,"r")
+flines=f.readlines()
+f.close()
+newfile=[]
+pitchstanza=0
+inastanza=0
+stanza=[]
+prev_line=None
+for line in flines:
+    if line.startswith("auto"):
+        if inastanza:
+            if not pitchstanza:
+                newfile.extend(stanza)
+            stanza=[]
+        inastanza=0
+        newline=""
+        autoline=line.strip().split(" ")
+        for word in autoline:
+            if (not word == basename) and (not word.startswith(basename+":")):
+                newline+=word + " "
+        newline = newline.strip()
+        if not newline == "auto":
+            newfile += [newline.strip()]
+    elif line.startswith(("iface","mapping","source")):
+        '''Read a stanza'''
+        '''A Stanza can also start with allow- ie allow-hotplug'''
+        if inastanza:
+            if not pitchstanza:
+                newfile.extend(stanza)
+            stanza=[]
+        inastanza=1
+        pitchstanza=0
+        autoline=line.strip().split(" ")
+        for word in autoline:
+            if (word == basename) or (word.startswith(basename+":")):
+                pitchstanza=1
+        if not pitchstanza:
+            stanza+=[line.strip()]
+    elif line.strip() in (start_mark, end_mark):
+        if inastanza:
+            if not pitchstanza:
+                newfile.extend(stanza)
+            stanza=[]
+        inastanza = 0
+        pitchstanza = 0
+        # Deduplicate markers.
+        if line != prev_line:
+            newfile += [line.strip()]
+    else:
+        if inastanza:
+            if not pitchstanza:
+                stanza+=[line.strip()]
+        else:
+            if not pitchstanza:
+                newfile += [line.strip()]
+    prev_line=line
+
+# Include pending stanza if any.
+if inastanza and not pitchstanza:
+    newfile.extend(stanza)
+
+
+def emit(line):
+    print(line)
+    output = line + "\n"
+    os.write(fd, output.encode('utf-8'))
+
+# Insert the new output at the end and inside the existing markers if found.
+emitted = False
+fd, path = tempfile.mkstemp()
+for line in newfile:
+    if line == end_mark:
+        emit("\n".join(output))
+        emitted = True
+    emit(line)
+if not emitted:
+    emit(start_mark)
+    emit("\n".join(output))
+    emit(end_mark)
+os.close(fd)
+
+shutil.copy(path,if_filename)
+os.chmod(if_filename,0o644)
+
+#print("TMPFILE is at: " + path)
+#print("Copied file is at: " + if_filename)
+
+try:
+    retcode = subprocess.call("ifdown "+basename , shell=True)
+    if retcode < 0:
+        print("Child was terminated by signal", -retcode, file=sys.stderr)
+    else:
+        print("Child returned", retcode, file=sys.stderr)
+except OSError as e:
+    print("Execution failed:", e, file=sys.stderr)
+
+try:
+    retcode = subprocess.call("ifup "+basename , shell=True)
+    if retcode < 0:
+        print("Child was terminated by signal", -retcode, file=sys.stderr)
+    else:
+        print("Child returned", retcode, file=sys.stderr)
+except OSError as e:
+    print("Execution failed:", e, file=sys.stderr)
--- linux-qcom-6.8.0.orig/debian/control
+++ linux-qcom-6.8.0/debian/control
@@ -0,0 +1,229 @@
+Source: linux-qcom
+Section: devel
+Priority: optional
+Maintainer: Ubuntu Kernel Team <kernel-team@lists.ubuntu.com>
+XSC-Ubuntu-Compatible-Signing: ubuntu/4 pro/3
+Rules-Requires-Root: no
+Standards-Version: 3.9.4.0
+Build-Depends:
+ gcc-13, gcc-13-aarch64-linux-gnu [arm64] <cross>, gcc-13-arm-linux-gnueabihf [armhf] <cross>, gcc-13-powerpc64le-linux-gnu [ppc64el] <cross>, gcc-13-riscv64-linux-gnu [riscv64] <cross>, gcc-13-s390x-linux-gnu [s390x] <cross>, gcc-13-x86-64-linux-gnu [amd64] <cross>,
+ debhelper-compat (= 10),
+ cpio,
+ kmod <!stage1>,
+ makedumpfile [amd64] <!stage1>,
+ libcap-dev <!stage1>,
+ libelf-dev <!stage1>,
+ libnewt-dev <!stage1>,
+ libiberty-dev <!stage1>,
+ default-jdk-headless <!stage1>,
+ java-common <!stage1>,
+ rsync [!i386] <!stage1>,
+ libdw-dev <!stage1>,
+ libpci-dev <!stage1>,
+ pkg-config <!stage1>,
+ python3 <!stage1>,
+ python3-dev <!stage1>,
+ python3-setuptools <!stage1>,
+ flex <!stage1>,
+ bison <!stage1>,
+ libunwind8-dev [amd64 arm64 armhf ppc64el] <!stage1>,
+ liblzma-dev <!stage1>,
+ openssl <!stage1>,
+ libssl-dev <!stage1>,
+ libaudit-dev <!stage1>,
+ bc <!stage1>,
+ gawk <!stage1>,
+ libudev-dev <!stage1>,
+ autoconf <!stage1>,
+ automake <!stage1>,
+ libtool <!stage1>,
+ uuid-dev <!stage1>,
+ libnuma-dev [amd64 arm64 ppc64el s390x] <!stage1>,
+ libtraceevent-dev [amd64 arm64 armhf ppc64el s390x riscv64] <!stage1>,
+ libtracefs-dev [amd64 arm64 armhf ppc64el s390x riscv64] <!stage1>,
+ dkms <!stage1>,
+ dwarfdump <!stage1>,
+ curl <!stage1>,
+ zstd <!stage1>,
+ pahole [amd64 arm64 armhf ppc64el s390x riscv64] | dwarves (>= 1.21) [amd64 arm64 armhf ppc64el s390x riscv64] <!stage1>,
+ clang-18 [amd64 arm64 armhf ppc64el riscv64 s390x],
+ rustc [amd64 arm64 armhf ppc64el riscv64 s390x],
+ rust-src [amd64 arm64 armhf ppc64el riscv64 s390x],
+ rustfmt [amd64 arm64 armhf ppc64el riscv64 s390x],
+ bindgen-0.65 [amd64 arm64 armhf ppc64el riscv64 s390x],
+ libstdc++-dev,
+Build-Depends-Indep:
+ xmlto <!stage1>,
+ bzip2 <!stage1>,
+ sharutils <!stage1>,
+ asciidoc <!stage1>,
+ python3-docutils <!stage1>,
+Vcs-Git: git://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-qcom/+git/noble
+XS-Testsuite: autopkgtest
+#XS-Testsuite-Depends: gcc-4.7 binutils
+
+Package: linux-qcom-headers-6.8.0-1046
+Build-Profiles: <!stage1>
+Architecture: all
+Multi-Arch: foreign
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, coreutils
+Description: Header files related to Linux kernel version 6.8.0
+ This package provides kernel header files for version 6.8.0, for sites
+ that want the latest kernel headers. Please read
+ /usr/share/doc/linux-qcom-headers-6.8.0-1046/debian.README.gz for details
+
+Package: linux-qcom-tools-6.8.0-1046
+Build-Profiles: <!stage1>
+Architecture: arm64
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}, linux-tools-common
+Description: Linux kernel version specific tools for version 6.8.0-1046
+ This package provides the architecture dependant parts for kernel
+ version locked tools (such as perf and x86_energy_perf_policy) for
+ version 6.8.0-1046 on
+ .
+ You probably want to install linux-tools-6.8.0-1046-<flavour>.
+
+Package: linux-libc-dev-qcom
+Architecture: all
+Depends: ${misc:Depends}
+Description: Linux Kernel Headers for development
+ This package provides additional downstream headers from the Linux kernel.
+ These headers are used by the installed headers for GNU glibc and other system
+ libraries. They are NOT meant to be used to build third-party modules for
+ your kernel. Use linux-qcom-headers-* packages for that.
+
+
+Package: linux-image-6.8.0-1046-qcom
+Build-Profiles: <!stage1>
+Architecture: arm64
+Section: kernel
+Priority: optional
+Provides: linux-image, fuse-module, kvm-api-4, redhat-cluster-modules, ivtv-modules, virtualbox-guest-modules [amd64], ${linux:rprovides}
+Depends: ${misc:Depends}, ${shlibs:Depends}, kmod, linux-base (>= 4.5ubuntu1~16.04.1), linux-modules-6.8.0-1046-qcom
+Recommends: grub-pc [amd64] | grub-efi-amd64 [amd64] | grub-efi-ia32 [amd64] | grub [amd64] | lilo [amd64] | flash-kernel [armhf arm64] | grub-efi-arm64 [arm64] | grub-efi-arm [armhf] | grub-ieee1275 [ppc64el], initramfs-tools | linux-initramfs-tool
+Breaks: flash-kernel (<< 3.90ubuntu2) [arm64 armhf], s390-tools (<< 2.3.0-0ubuntu3) [s390x]
+Conflicts: linux-image-unsigned-6.8.0-1046-qcom
+Suggests: fdutils, linux-qcom-tools, linux-headers-6.8.0-1046-qcom
+Description: Linux kernel image for version 6.8.0 on  SMP
+ This package contains the Linux kernel image for version 6.8.0 on
+  SMP.
+ .
+ Supports Qualcomm SoC processors.
+ .
+ Geared toward desktop and server systems.
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-qcom meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-modules-6.8.0-1046-qcom
+Build-Profiles: <!stage1>
+Architecture: arm64
+Section: kernel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Built-Using: ${linux:BuiltUsing}
+Description: Linux kernel modules for version 6.8.0 on  SMP
+ Contains the corresponding System.map file, the modules built by the
+ packager, and scripts that try to ensure that the system is not left in an
+ unbootable state after an update.
+ .
+ Supports Qualcomm SoC processors.
+ .
+ Geared toward desktop and server systems.
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-qcom meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-headers-6.8.0-1046-qcom
+Build-Profiles: <!stage1>
+Architecture: arm64
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, linux-qcom-headers-6.8.0-1046, ${shlibs:Depends}
+Provides: linux-headers, linux-headers-3.0
+Description: Linux kernel headers for version 6.8.0 on  SMP
+ This package provides kernel header files for version 6.8.0 on
+  SMP.
+ .
+ This is for sites that want the latest kernel headers.  Please read
+ /usr/share/doc/linux-headers-6.8.0-1046/debian.README.gz for details.
+
+Package: linux-qcom-lib-rust-6.8.0-1046-qcom
+Build-Profiles: <!stage1>
+Architecture: arm64
+Multi-Arch: foreign
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, coreutils
+Description: Rust library files related to Linux kernel version 6.8.0
+ This package provides kernel library files for version 6.8.0, that allow to
+ compile out-of-tree kernel modules written in Rust.
+
+Package: linux-image-6.8.0-1046-qcom-dbgsym
+Build-Profiles: <!stage1>
+Architecture: arm64
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}
+Provides: linux-debug
+Description: Linux kernel debug image for version 6.8.0 on  SMP
+ This package provides the kernel debug image for version 6.8.0 on
+  SMP.
+ .
+ This is for sites that wish to debug the kernel.
+ .
+ The kernel image contained in this package is NOT meant to boot from. It
+ is uncompressed, and unstripped. This package also includes the
+ unstripped modules.
+
+Package: linux-tools-6.8.0-1046-qcom
+Build-Profiles: <!stage1>
+Architecture: arm64
+Section: devel
+Priority: optional
+Depends: ${misc:Depends}, linux-qcom-tools-6.8.0-1046
+Description: Linux kernel version specific tools for version 6.8.0-1046
+ This package provides the architecture dependant parts for kernel
+ version locked tools (such as perf and x86_energy_perf_policy) for
+ version 6.8.0-1046 on
+ .
+
+
+Package: linux-buildinfo-6.8.0-1046-qcom
+Build-Profiles: <!stage1>
+Architecture: arm64
+Section: kernel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Built-Using: ${linux:BuiltUsing}
+Description: Linux kernel buildinfo for version 6.8.0 on  SMP
+ This package contains the Linux kernel buildinfo for version 6.8.0 on
+  SMP.
+ .
+ You likely do not want to install this package.
+
+
+Package: linux-modules-iwlwifi-6.8.0-1046-qcom
+Build-Profiles: <!stage1>
+Architecture: arm64
+Section: kernel
+Priority: optional
+Depends:
+ ${misc:Depends},
+ linux-image-6.8.0-1046-qcom | linux-image-unsigned-6.8.0-1046-qcom,
+Built-Using: ${linux:BuiltUsing}
+Description: Linux kernel iwlwifi modules for version 6.8.0-1046
+ This package provides the Linux kernel iwlwifi modules for version
+ 6.8.0-1046.
+ .
+ You likely do not want to install this package directly. Instead, install the
+ one of the linux-modules-iwlwifi-qcom* meta-packages,
+ which will ensure that upgrades work correctly, and that supporting packages are
+ also installed.
+
--- linux-qcom-6.8.0.orig/debian/control.d/flavour-buildinfo.stub
+++ linux-qcom-6.8.0/debian/control.d/flavour-buildinfo.stub
@@ -0,0 +1,14 @@
+
+Package: linux-buildinfo-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: kernel
+Priority: optional
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Built-Using: ${linux:BuiltUsing}
+Description: Linux kernel buildinfo for version PKGVER on DESC
+ This package contains the Linux kernel buildinfo for version PKGVER on
+ DESC.
+ .
+ You likely do not want to install this package.
+
--- linux-qcom-6.8.0.orig/debian/control.d/flavour-module.stub
+++ linux-qcom-6.8.0/debian/control.d/flavour-module.stub
@@ -0,0 +1,19 @@
+
+Package: linux-modules-MODULE-PKGVER-ABINUM-FLAVOUR
+Build-Profiles: <!stage1>
+Architecture: ARCH
+Section: kernel
+Priority: optional
+Depends:
+ ${misc:Depends},
+ linux-image-PKGVER-ABINUM-FLAVOUR | linux-image-unsigned-PKGVER-ABINUM-FLAVOUR,
+Built-Using: ${linux:BuiltUsing}
+Description: Linux kernel MODULE modules for version PKGVER-ABINUM
+ This package provides the Linux kernel MODULE modules for version
+ PKGVER-ABINUM.
+ .
+ You likely do not want to install this package directly. Instead, install the
+ one of the linux-modules-MODULE-FLAVOUR* meta-packages,
+ which will ensure that upgrades work correctly, and that supporting packages are
+ also installed.
+
--- linux-qcom-6.8.0.orig/debian/control.d/linux-bpf-dev.stub
+++ linux-qcom-6.8.0/debian/control.d/linux-bpf-dev.stub
@@ -0,0 +1,7 @@
+Package: linux-bpf-dev
+Architecture: amd64 armhf arm64 i386 ppc64el riscv64 s390x
+Depends: ${misc:Depends}
+Multi-Arch: same
+Description: Headers for BPF development
+ The vmlinux.h header is provided to allow userspace to build BPF CO-RE
+ programs targeting the packaged kernel.
--- linux-qcom-6.8.0.orig/debian/control.d/linux-cloud-tools-common.stub
+++ linux-qcom-6.8.0/debian/control.d/linux-cloud-tools-common.stub
@@ -0,0 +1,10 @@
+Package: linux-cloud-tools-common
+Build-Profiles: <!stage1>
+Architecture: all
+Multi-Arch: foreign
+Section: kernel
+Priority: optional
+Depends: ${misc:Depends}
+Description: Linux kernel version specific cloud tools for version PKGVER
+ This package provides the architecture independent parts for kernel
+ version locked tools for cloud tools for version PKGVER.
--- linux-qcom-6.8.0.orig/debian/control.d/linux-doc.stub
+++ linux-qcom-6.8.0/debian/control.d/linux-doc.stub
@@ -0,0 +1,8 @@
+Package: linux-doc
+Build-Profiles: <!stage1>
+Architecture: all
+Section: doc
+Priority: optional
+Description: Linux kernel specific documentation for version PKGVER
+ This package is deprecated and it is temporarily provided only for
+ compatibility reasons. It will be dropped in the future.
--- linux-qcom-6.8.0.orig/debian/control.d/linux-libc-dev.stub
+++ linux-qcom-6.8.0/debian/control.d/linux-libc-dev.stub
@@ -0,0 +1,12 @@
+Package: linux-libc-dev
+Architecture: amd64 armhf arm64 i386 ppc64el riscv64 s390x
+Depends: ${misc:Depends}
+Conflicts: linux-kernel-headers
+Replaces: linux-kernel-headers
+Provides: linux-kernel-headers, aufs-dev
+Multi-Arch: same
+Description: Linux Kernel Headers for development
+ This package provides headers from the Linux kernel.  These headers
+ are used by the installed headers for GNU glibc and other system
+ libraries. They are NOT meant to be used to build third-party modules for
+ your kernel. Use SRCPKGNAME-headers-* packages for that.
--- linux-qcom-6.8.0.orig/debian/control.d/linux-source.stub
+++ linux-qcom-6.8.0/debian/control.d/linux-source.stub
@@ -0,0 +1,23 @@
+Package: linux-source-PKGVER
+Build-Profiles: <!stage1>
+Architecture: all
+Section: devel
+Priority: optional
+Provides: linux-source
+Depends: ${misc:Depends}, binutils, bzip2, coreutils
+Recommends: libc-dev, gcc, make
+Suggests: libncurses-dev | ncurses-dev, kernel-package, libqt3-dev
+Description: Linux kernel source for version PKGVER with Ubuntu patches
+ This package provides the source code for the Linux kernel version
+ PKGVER.
+ .
+ This package is mainly meant for other packages to use, in order to build
+ custom flavours.
+ .
+ If you wish to use this package to create a custom Linux kernel, then it
+ is suggested that you investigate the package kernel-package, which has
+ been designed to ease the task of creating kernel image packages.
+ .
+ If you are simply trying to build third-party modules for your kernel,
+ you do not want this package. Install the appropriate linux-headers
+ package instead.
--- linux-qcom-6.8.0.orig/debian/control.d/linux-tools-common.stub
+++ linux-qcom-6.8.0/debian/control.d/linux-tools-common.stub
@@ -0,0 +1,12 @@
+Package: linux-tools-common
+Build-Profiles: <!stage1>
+Architecture: all
+Multi-Arch: foreign
+Section: kernel
+Priority: optional
+Provides: bpftool
+Depends: ${misc:Depends}, lsb-release, hwdata
+Description: Linux kernel version specific tools for version PKGVER
+ This package provides the architecture independent parts for kernel
+ version locked tools (such as perf and x86_energy_perf_policy) for
+ version PKGVER.
--- linux-qcom-6.8.0.orig/debian/control.d/linux-tools-host.stub
+++ linux-qcom-6.8.0/debian/control.d/linux-tools-host.stub
@@ -0,0 +1,9 @@
+Package: linux-tools-host
+Build-Profiles: <!stage1>
+Architecture: all
+Multi-Arch: foreign
+Section: kernel
+Priority: optional
+Depends: ${misc:Depends}, python3
+Description: Linux kernel VM host tools
+ This package provides kernel tools useful for VM hosts.
--- linux-qcom-6.8.0.orig/debian/copyright
+++ linux-qcom-6.8.0/debian/copyright
@@ -0,0 +1,29 @@
+This is the Ubuntu prepackaged version of the Linux kernel.
+Linux was written by Linus Torvalds <Linus.Torvalds@cs.Helsinki.FI>
+and others.
+
+This package was put together by the Ubuntu Kernel Team, from
+sources retrieved from upstream linux git.
+The sources may be found at most Linux ftp sites, including 
+ftp://ftp.kernel.org/pub/linux/kernel/
+
+This package is currently maintained by the
+Ubuntu Kernel Team <ubuntu-kernel@lists.ubuntu.com>
+
+Linux is copyrighted by Linus Torvalds and others.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 dated June, 1991.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+On Ubuntu Linux systems, the complete text of the GNU General
+Public License v2 can be found in `/usr/share/common-licenses/GPL-2'.
--- linux-qcom-6.8.0.orig/debian/debian.env
+++ linux-qcom-6.8.0/debian/debian.env
@@ -0,0 +1 @@
+DEBIAN=debian.qcom
--- linux-qcom-6.8.0.orig/debian/gbp.conf
+++ linux-qcom-6.8.0/debian/gbp.conf
@@ -0,0 +1,2 @@
+[buildpackage]
+debian-tag = Ubuntu-%(version)s
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.hv-fcopy-daemon.service
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.hv-fcopy-daemon.service
@@ -0,0 +1,14 @@
+# On Azure/Hyper-V systems start the hv_fcopy_daemon
+#
+# author "Andy Whitcroft <apw@canonical.com>"
+[Unit]
+Description=Hyper-V File Copy Protocol Daemon
+ConditionVirtualization=microsoft
+ConditionPathExists=/dev/vmbus/hv_fcopy
+BindsTo=sys-devices-virtual-misc-vmbus\x21hv_fcopy.device
+
+[Service]
+ExecStart=/usr/sbin/hv_fcopy_daemon -n
+
+[Install]
+WantedBy=multi-user.target
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.hv-fcopy-daemon.udev
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.hv-fcopy-daemon.udev
@@ -0,0 +1 @@
+SUBSYSTEM=="misc", KERNEL=="vmbus/hv_fcopy", TAG+="systemd", ENV{SYSTEMD_WANTS}+="hv-fcopy-daemon.service"
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.hv-fcopy-daemon.upstart
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.hv-fcopy-daemon.upstart
@@ -0,0 +1,22 @@
+# On Azure/Hyper-V systems start the hv_fcopy_daemon
+#
+description "Hyper-V File Copy Protocol Daemon"
+author "Andy Whitcroft <apw@canonical.com>"
+
+start on runlevel [2345]
+stop on runlevel [!2345]
+console log
+
+pre-start script
+        if [ -e "/etc/default/hv-kvp-daemon-init" ]; then
+                . /etc/default/hv-kvp-daemon-init
+        fi
+        [ "$RUN_FCOPY_DAEMON" -eq 0 ] && { stop; exit 0; }
+	if [ -d /sys/class/dmi/id/. ]; then
+		read company </sys/class/dmi/id/sys_vendor
+		read product </sys/class/dmi/id/product_name
+		[ "$company:$product" = 'Microsoft Corporation:Virtual Machine' ] || { stop; exit 0; }
+	fi
+end script
+
+exec /usr/sbin/hv_fcopy_daemon -n
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.hv-kvp-daemon.service
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.hv-kvp-daemon.service
@@ -0,0 +1,20 @@
+# On Azure/Hyper-V systems start the hv_kvp_daemon
+#
+# author "Andy Whitcroft <apw@canonical.com>"
+[Unit]
+Description=Hyper-V KVP Protocol Daemon
+ConditionVirtualization=microsoft
+ConditionKernelCommandLine=!snapd_recovery_mode
+DefaultDependencies=no
+BindsTo=sys-devices-virtual-misc-vmbus\x21hv_kvp.device
+After=sys-devices-virtual-misc-vmbus\x21hv_kvp.device systemd-remount-fs.service
+Before=shutdown.target cloud-init-local.service walinuxagent.service
+Conflicts=shutdown.target
+RequiresMountsFor=/var/lib/hyperv
+ConditionPathExists=/dev/vmbus/hv_kvp
+
+[Service]
+ExecStart=/usr/sbin/hv_kvp_daemon -n
+
+[Install]
+WantedBy=multi-user.target
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.hv-kvp-daemon.udev
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.hv-kvp-daemon.udev
@@ -0,0 +1 @@
+SUBSYSTEM=="misc", KERNEL=="vmbus/hv_kvp", TAG+="systemd", ENV{SYSTEMD_WANTS}+="hv-kvp-daemon.service"
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.hv-kvp-daemon.upstart
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.hv-kvp-daemon.upstart
@@ -0,0 +1,22 @@
+# On Azure/Hyper-V systems start the hv_kvp_daemon
+#
+description "Hyper-V KVP Protocol Daemon"
+author "Adam Conrad <adconrad@canonical.com>"
+
+start on runlevel [2345]
+stop on runlevel [!2345]
+console log
+
+pre-start script
+        if [ -e "/etc/default/hv-kvp-daemon-init" ]; then
+                . /etc/default/hv-kvp-daemon-init
+        fi
+        [ "$RUN_KVP_DAEMON" = 0 ] && { stop; exit 0; }
+	if [ -d /sys/class/dmi/id/. ]; then
+		read company </sys/class/dmi/id/sys_vendor
+		read product </sys/class/dmi/id/product_name
+		[ "$company:$product" = 'Microsoft Corporation:Virtual Machine' ] || { stop; exit 0; }
+	fi
+end script
+
+exec /usr/sbin/hv_kvp_daemon -n
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.hv-vss-daemon.service
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.hv-vss-daemon.service
@@ -0,0 +1,14 @@
+# On Azure/Hyper-V systems start the hv_vss_daemon
+#
+# author "Andy Whitcroft <apw@canonical.com>"
+[Unit]
+Description=Hyper-V VSS Protocol Daemon
+ConditionVirtualization=microsoft
+ConditionPathExists=/dev/vmbus/hv_vss
+BindsTo=sys-devices-virtual-misc-vmbus\x21hv_vss.device
+
+[Service]
+ExecStart=/usr/sbin/hv_vss_daemon -n
+
+[Install]
+WantedBy=multi-user.target
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.hv-vss-daemon.udev
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.hv-vss-daemon.udev
@@ -0,0 +1 @@
+SUBSYSTEM=="misc", KERNEL=="vmbus/hv_vss", TAG+="systemd", ENV{SYSTEMD_WANTS}+="hv-vss-daemon.service"
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.hv-vss-daemon.upstart
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.hv-vss-daemon.upstart
@@ -0,0 +1,22 @@
+# On Azure/Hyper-V systems start the hv_vss_daemon
+#
+description "Hyper-V VSS Protocol Daemon"
+author "Ben Howard <ben.howard@canonical.com>"
+
+start on runlevel [2345]
+stop on runlevel [!2345]
+console log
+
+pre-start script
+        if [ -e "/etc/default/hv-kvp-daemon-init" ]; then
+                . /etc/default/hv-kvp-daemon-init
+        fi
+        [ "$RUN_VSS_DAEMON" -eq 0 ] && { stop; exit 0; }
+	if [ -d /sys/class/dmi/id/. ]; then
+		read company </sys/class/dmi/id/sys_vendor
+		read product </sys/class/dmi/id/product_name
+		[ "$company:$product" = 'Microsoft Corporation:Virtual Machine' ] || { stop; exit 0; }
+	fi
+end script
+
+exec /usr/sbin/hv_vss_daemon -n
--- linux-qcom-6.8.0.orig/debian/linux-cloud-tools-common.intel-sgx-load-module.service
+++ linux-qcom-6.8.0/debian/linux-cloud-tools-common.intel-sgx-load-module.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Install SGX kernel module
+DefaultDependencies=false
+ConditionVirtualization=microsoft
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+ExecStart=/sbin/modprobe intel_sgx
+ExecStop=/sbin/modprobe -r intel_sgx
+
+[Install]
+WantedBy=multi-user.target
--- linux-qcom-6.8.0.orig/debian/revoked-certs/canonical-uefi-2012-all.pem
+++ linux-qcom-6.8.0/debian/revoked-certs/canonical-uefi-2012-all.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Apr 12 11:39:08 2012 GMT
+            Not After : Apr 11 11:39:08 2042 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c9:5f:9b:62:8f:0b:b0:64:82:ac:be:c9:e2:62:
+                    e3:4b:d2:9f:1e:8a:d5:61:1a:2b:5d:38:f4:b7:ce:
+                    b9:9a:b8:43:b8:43:97:77:ab:4f:7f:0c:70:46:0b:
+                    fc:7f:6d:c6:6d:ea:80:5e:01:d2:b7:66:1e:87:de:
+                    0d:6d:d0:41:97:a8:a5:af:0c:63:4f:f7:7c:c2:52:
+                    cc:a0:31:a9:bb:89:5d:99:1e:46:6f:55:73:b9:76:
+                    69:ec:d7:c1:fc:21:d6:c6:07:e7:4f:bd:22:de:e4:
+                    a8:5b:2d:db:95:34:19:97:d6:28:4b:21:4c:ca:bb:
+                    1d:79:a6:17:7f:5a:f9:67:e6:5c:78:45:3d:10:6d:
+                    b0:17:59:26:11:c5:57:e3:7f:4e:82:ba:f6:2c:4e:
+                    c8:37:4d:ff:85:15:84:47:e0:ed:3b:7c:7f:bc:af:
+                    e9:01:05:a7:0c:6f:c3:e9:8d:a3:ce:be:a6:e3:cd:
+                    3c:b5:58:2c:9e:c2:03:1c:60:22:37:39:ff:41:02:
+                    c1:29:a4:65:51:ff:33:34:aa:42:15:f9:95:78:fc:
+                    2d:f5:da:8a:85:7c:82:9d:fb:37:2c:6b:a5:a8:df:
+                    7c:55:0b:80:2e:3c:b0:63:e1:cd:38:48:89:e8:14:
+                    06:0b:82:bc:fd:d4:07:68:1b:0f:3e:d9:15:dd:94:
+                    11:1b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                61:48:2A:A2:83:0D:0A:B2:AD:5A:F1:0B:72:50:DA:90:33:DD:CE:F0
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        8f:8a:a1:06:1f:29:b7:0a:4a:d5:c5:fd:81:ab:25:ea:c0:7d:
+        e2:fc:6a:96:a0:79:93:67:ee:05:0e:25:12:25:e4:5a:f6:aa:
+        1a:f1:12:f3:05:8d:87:5e:f1:5a:5c:cb:8d:23:73:65:1d:15:
+        b9:de:22:6b:d6:49:67:c9:a3:c6:d7:62:4e:5c:b5:f9:03:83:
+        40:81:dc:87:9c:3c:3f:1c:0d:51:9f:94:65:0a:84:48:67:e4:
+        a2:f8:a6:4a:f0:e7:cd:cd:bd:94:e3:09:d2:5d:2d:16:1b:05:
+        15:0b:cb:44:b4:3e:61:42:22:c4:2a:5c:4e:c5:1d:a3:e2:e0:
+        52:b2:eb:f4:8b:2b:dc:38:39:5d:fb:88:a1:56:65:5f:2b:4f:
+        26:ff:06:78:10:12:eb:8c:5d:32:e3:c6:45:af:25:9b:a0:ff:
+        8e:ef:47:09:a3:e9:8b:37:92:92:69:76:7e:34:3b:92:05:67:
+        4e:b0:25:ed:bc:5e:5f:8f:b4:d6:ca:40:ff:e4:e2:31:23:0c:
+        85:25:ae:0c:55:01:ec:e5:47:5e:df:5b:bc:14:33:e3:c6:f5:
+        18:b6:d9:f7:dd:b3:b4:a1:31:d3:5a:5c:5d:7d:3e:bf:0a:e4:
+        e4:e8:b4:59:7d:3b:b4:8c:a3:1b:b5:20:a3:b9:3e:84:6f:8c:
+        21:00:c3:39
+-----BEGIN CERTIFICATE-----
+MIIEIDCCAwigAwIBAgIBATANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMjA0MTIxMTM5MDhaFw00MjA0MTEx
+MTM5MDhaMH8xCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEXMBUG
+A1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MSswKQYD
+VQQDDCJDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyV+bYo8LsGSCrL7J4mLjS9KfHorVYRor
+XTj0t865mrhDuEOXd6tPfwxwRgv8f23GbeqAXgHSt2Yeh94NbdBBl6ilrwxjT/d8
+wlLMoDGpu4ldmR5Gb1VzuXZp7NfB/CHWxgfnT70i3uSoWy3blTQZl9YoSyFMyrsd
+eaYXf1r5Z+ZceEU9EG2wF1kmEcVX439Ogrr2LE7IN03/hRWER+DtO3x/vK/pAQWn
+DG/D6Y2jzr6m4808tVgsnsIDHGAiNzn/QQLBKaRlUf8zNKpCFfmVePwt9dqKhXyC
+nfs3LGulqN98VQuALjywY+HNOEiJ6BQGC4K8/dQHaBsPPtkV3ZQRGwIDAQABo4Gg
+MIGdMAwGA1UdEwEB/wQCMAAwHwYDVR0lBBgwFgYIKwYBBQUHAwMGCisGAQQBgjcK
+AwYwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl
+MB0GA1UdDgQWBBRhSCqigw0Ksq1a8QtyUNqQM93O8DAfBgNVHSMEGDAWgBStkZkL
+wiqx9RcEjCO2ZVomjjRaYzANBgkqhkiG9w0BAQsFAAOCAQEAj4qhBh8ptwpK1cX9
+gasl6sB94vxqlqB5k2fuBQ4lEiXkWvaqGvES8wWNh17xWlzLjSNzZR0Vud4ia9ZJ
+Z8mjxtdiTly1+QODQIHch5w8PxwNUZ+UZQqESGfkovimSvDnzc29lOMJ0l0tFhsF
+FQvLRLQ+YUIixCpcTsUdo+LgUrLr9Isr3Dg5XfuIoVZlXytPJv8GeBAS64xdMuPG
+Ra8lm6D/ju9HCaPpizeSkml2fjQ7kgVnTrAl7bxeX4+01spA/+TiMSMMhSWuDFUB
+7OVHXt9bvBQz48b1GLbZ992ztKEx01pcXX0+vwrk5Oi0WX07tIyjG7Ugo7k+hG+M
+IQDDOQ==
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/revoked-certs/canonical-uefi-2017-all.pem
+++ linux-qcom-6.8.0/debian/revoked-certs/canonical-uefi-2017-all.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 26 21:52:11 2017 GMT
+            Not After : Sep 25 21:52:11 2047 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2017)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ef:9f:fa:9f:19:3a:9d:38:23:91:cc:c4:f9:42:
+                    e0:f8:54:12:82:dc:97:2c:d6:5b:c1:35:eb:ff:4a:
+                    74:06:b5:9d:32:aa:7b:f3:fc:31:5a:34:3e:a1:a4:
+                    44:db:7b:6d:16:af:35:76:e0:9b:99:ad:21:11:c6:
+                    12:4b:ae:24:8f:bb:d3:b2:00:fe:c5:1d:9b:3a:1a:
+                    4a:6c:ca:fa:16:37:85:22:f9:ff:22:fc:40:e0:58:
+                    35:c1:39:27:b4:c6:42:1a:96:d8:a5:c5:95:2e:f7:
+                    c5:1e:21:6e:36:84:f7:a9:a1:e1:f1:03:08:96:65:
+                    71:f8:eb:83:cf:82:f7:9a:44:58:72:00:14:39:29:
+                    4b:e9:78:2f:65:20:b3:80:76:3b:ba:0d:2d:46:f6:
+                    37:05:e7:05:fe:bd:6c:c7:a2:65:b5:06:6e:07:24:
+                    99:a1:c1:cf:e1:0e:5e:49:41:71:17:a8:50:e7:38:
+                    99:e5:6e:b6:db:9f:63:db:56:f4:9c:7d:89:f6:d2:
+                    03:6c:99:83:e0:99:23:39:36:bd:cb:b5:26:7c:7d:
+                    b0:c6:fe:82:7c:52:ed:f9:2c:8f:79:71:3d:a9:2f:
+                    b5:aa:7e:77:a0:fd:69:f9:97:10:a8:b2:c6:7d:88:
+                    9e:a2:19:bd:31:b8:02:2d:34:4d:9d:98:60:82:ad:
+                    04:ff
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                24:2A:DE:75:AC:4A:15:E5:0D:50:C8:4B:0D:45:FF:3E:AE:70:7A:03
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        00:b2:b7:57:b5:2b:5d:16:d3:04:88:6a:d7:77:d5:0d:89:f1:
+        d2:6e:11:d1:8e:f5:62:05:c4:6a:57:df:eb:d2:86:68:f2:fd:
+        a7:37:11:3c:f4:ce:5d:fe:32:5f:31:a2:6b:3a:da:28:c2:88:
+        fa:7f:70:b5:25:99:ea:27:9a:56:6a:9d:b2:0f:14:99:e2:b7:
+        c6:39:1e:8e:a7:76:31:d9:ed:c5:05:8d:48:ae:1b:68:18:14:
+        51:a1:7d:f6:c7:df:cb:9d:eb:a4:3b:0b:ff:c2:07:c5:42:bc:
+        0d:b2:11:fa:37:17:2b:1c:b5:84:48:2d:f9:31:4a:57:49:8e:
+        61:a6:82:11:06:4c:34:ea:9c:2a:47:4d:eb:e0:26:af:da:d2:
+        c2:08:a0:37:35:7b:73:71:de:0b:c4:ba:c8:34:de:20:04:03:
+        6f:46:26:0d:b9:91:02:5b:71:76:cc:45:e4:08:d0:a6:dd:a4:
+        50:d3:d9:04:91:2b:d9:5c:34:88:fc:c2:37:fd:c6:d4:3e:57:
+        f7:6b:ba:7b:d7:02:7a:84:0c:c8:c1:19:cc:bc:fa:52:d5:7f:
+        b3:35:c4:53:5d:70:0a:f6:44:60:8d:a9:11:7a:1b:7d:ae:7b:
+        20:5a:4c:8d:44:f6:c1:a9:61:cb:dc:cb:90:37:d5:28:24:73:
+        87:d0:e0:d8
+-----BEGIN CERTIFICATE-----
+MIIEKDCCAxCgAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNzA5MjYyMTUyMTFaFw00NzA5MjUy
+MTUyMTFaMIGGMQswCQYDVQQGEwJHQjEUMBIGA1UECAwLSXNsZSBvZiBNYW4xFzAV
+BgNVBAoMDkNhbm9uaWNhbCBMdGQuMRQwEgYDVQQLDAtTZWN1cmUgQm9vdDEyMDAG
+A1UEAwwpQ2Fub25pY2FsIEx0ZC4gU2VjdXJlIEJvb3QgU2lnbmluZyAoMjAxNykw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDvn/qfGTqdOCORzMT5QuD4
+VBKC3Jcs1lvBNev/SnQGtZ0yqnvz/DFaND6hpETbe20WrzV24JuZrSERxhJLriSP
+u9OyAP7FHZs6GkpsyvoWN4Ui+f8i/EDgWDXBOSe0xkIaltilxZUu98UeIW42hPep
+oeHxAwiWZXH464PPgveaRFhyABQ5KUvpeC9lILOAdju6DS1G9jcF5wX+vWzHomW1
+Bm4HJJmhwc/hDl5JQXEXqFDnOJnlbrbbn2PbVvScfYn20gNsmYPgmSM5Nr3LtSZ8
+fbDG/oJ8Uu35LI95cT2pL7Wqfneg/Wn5lxCossZ9iJ6iGb0xuAItNE2dmGCCrQT/
+AgMBAAGjgaAwgZ0wDAYDVR0TAQH/BAIwADAfBgNVHSUEGDAWBggrBgEFBQcDAwYK
+KwYBBAGCNwoDBjAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2Vy
+dGlmaWNhdGUwHQYDVR0OBBYEFCQq3nWsShXlDVDISw1F/z6ucHoDMB8GA1UdIwQY
+MBaAFK2RmQvCKrH1FwSMI7ZlWiaONFpjMA0GCSqGSIb3DQEBCwUAA4IBAQAAsrdX
+tStdFtMEiGrXd9UNifHSbhHRjvViBcRqV9/r0oZo8v2nNxE89M5d/jJfMaJrOtoo
+woj6f3C1JZnqJ5pWap2yDxSZ4rfGOR6Op3Yx2e3FBY1IrhtoGBRRoX32x9/Lneuk
+Owv/wgfFQrwNshH6NxcrHLWESC35MUpXSY5hpoIRBkw06pwqR03r4Cav2tLCCKA3
+NXtzcd4LxLrINN4gBANvRiYNuZECW3F2zEXkCNCm3aRQ09kEkSvZXDSI/MI3/cbU
+Plf3a7p71wJ6hAzIwRnMvPpS1X+zNcRTXXAK9kRgjakReht9rnsgWkyNRPbBqWHL
+3MuQN9UoJHOH0ODY
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/revoked-certs/canonical-uefi-2018-all.pem
+++ linux-qcom-6.8.0/debian/revoked-certs/canonical-uefi-2018-all.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Oct 26 18:31:14 2018 GMT
+            Not After : Oct 24 18:31:14 2048 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (ESM 2018)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bf:6a:e5:6d:55:7a:ec:7a:11:37:45:9c:4c:8f:
+                    6b:2d:56:d3:74:2b:32:ac:84:2d:ba:cb:cc:ec:8d:
+                    92:22:69:48:a5:d4:f6:75:11:66:2f:cb:b2:fd:9e:
+                    56:ab:e6:f1:52:8e:75:3e:50:bd:25:b3:50:fc:ef:
+                    3d:76:f3:3f:7f:03:f6:e2:a1:25:69:5c:14:98:54:
+                    bd:11:bf:e9:a5:ac:46:91:4b:1d:de:b7:18:2b:c8:
+                    22:83:15:a7:4a:00:8d:9d:e4:c0:da:f7:41:02:fd:
+                    9f:5f:79:93:56:cc:86:e1:b5:e0:39:0e:3c:a2:5b:
+                    fe:c0:56:f0:92:50:5a:2b:67:67:93:56:d7:7a:75:
+                    99:6a:25:b4:63:a8:5f:69:7e:3a:49:58:2a:a7:80:
+                    f6:5a:b4:be:b2:be:a8:8c:45:41:c9:f2:fc:76:a8:
+                    65:ef:99:29:0d:c9:9c:54:6b:0a:f0:4a:0e:61:0d:
+                    ed:99:32:af:12:e2:12:7b:9f:7b:ec:05:c4:e0:b6:
+                    d5:c3:71:28:ae:dd:0b:ba:97:ad:68:0b:76:e9:bf:
+                    e7:01:7e:64:54:39:23:85:36:c8:9d:dd:27:a1:ff:
+                    df:46:36:14:7e:cb:cc:a1:cd:49:0b:6d:c2:0c:45:
+                    99:56:58:7c:87:0d:59:9a:dc:4a:39:3b:1d:d9:15:
+                    2e:b5
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                36:51:88:C1:D3:74:D6:B0:7C:3C:8F:24:0F:8E:F7:22:43:3D:6A:8B
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        4c:0f:cd:77:60:b4:6f:53:87:f3:3c:4f:e6:81:5f:a7:1c:cc:
+        60:29:b6:34:6c:4d:08:9b:e2:d2:bd:f6:17:1a:62:79:b8:17:
+        bc:a2:60:59:fd:03:51:c3:b7:6b:de:73:b3:48:95:f5:0b:aa:
+        b6:3c:b4:34:dc:1d:0b:c4:97:62:87:e7:48:d5:8f:c9:ea:e8:
+        91:8f:2a:40:cd:b7:b3:ee:b2:98:9e:fb:37:31:29:e6:8e:2f:
+        0a:39:99:1e:c6:aa:b8:05:62:85:d3:a8:3e:60:38:98:0f:f0:
+        fe:c7:ab:01:a5:6a:a5:7f:70:a6:26:94:76:23:2f:08:89:74:
+        97:c2:2a:ca:22:3e:7a:ea:22:22:08:07:f4:bb:f6:bc:69:9c:
+        4e:44:33:e2:8e:70:17:b0:9b:cb:33:94:66:6d:ff:9a:7d:e9:
+        50:b2:e8:90:14:e4:2b:91:cb:a0:c5:2e:0e:cf:19:ef:44:ef:
+        84:f0:bd:57:9e:26:c2:63:3d:df:fc:a1:84:de:5c:d7:5f:3b:
+        fb:94:61:f0:93:89:1f:cf:c3:b2:d1:90:97:35:7d:b9:8a:ad:
+        e6:05:f0:e8:3b:a1:7c:af:2b:c4:af:18:33:2e:5e:87:db:9d:
+        80:b5:04:fd:00:d0:60:ab:ff:85:77:0f:cb:47:22:c9:b2:85:
+        a8:48:16:e2
+-----BEGIN CERTIFICATE-----
+MIIELDCCAxSgAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xODEwMjYxODMxMTRaFw00ODEwMjQx
+ODMxMTRaMIGKMQswCQYDVQQGEwJHQjEUMBIGA1UECAwLSXNsZSBvZiBNYW4xFzAV
+BgNVBAoMDkNhbm9uaWNhbCBMdGQuMRQwEgYDVQQLDAtTZWN1cmUgQm9vdDE2MDQG
+A1UEAwwtQ2Fub25pY2FsIEx0ZC4gU2VjdXJlIEJvb3QgU2lnbmluZyAoRVNNIDIw
+MTgpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2rlbVV67HoRN0Wc
+TI9rLVbTdCsyrIQtusvM7I2SImlIpdT2dRFmL8uy/Z5Wq+bxUo51PlC9JbNQ/O89
+dvM/fwP24qElaVwUmFS9Eb/ppaxGkUsd3rcYK8gigxWnSgCNneTA2vdBAv2fX3mT
+VsyG4bXgOQ48olv+wFbwklBaK2dnk1bXenWZaiW0Y6hfaX46SVgqp4D2WrS+sr6o
+jEVByfL8dqhl75kpDcmcVGsK8EoOYQ3tmTKvEuISe5977AXE4LbVw3Eort0Lupet
+aAt26b/nAX5kVDkjhTbInd0nof/fRjYUfsvMoc1JC23CDEWZVlh8hw1ZmtxKOTsd
+2RUutQIDAQABo4GgMIGdMAwGA1UdEwEB/wQCMAAwHwYDVR0lBBgwFgYIKwYBBQUH
+AwMGCisGAQQBgjcKAwYwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVk
+IENlcnRpZmljYXRlMB0GA1UdDgQWBBQ2UYjB03TWsHw8jyQPjvciQz1qizAfBgNV
+HSMEGDAWgBStkZkLwiqx9RcEjCO2ZVomjjRaYzANBgkqhkiG9w0BAQsFAAOCAQEA
+TA/Nd2C0b1OH8zxP5oFfpxzMYCm2NGxNCJvi0r32FxpiebgXvKJgWf0DUcO3a95z
+s0iV9Quqtjy0NNwdC8SXYofnSNWPyerokY8qQM23s+6ymJ77NzEp5o4vCjmZHsaq
+uAVihdOoPmA4mA/w/serAaVqpX9wpiaUdiMvCIl0l8IqyiI+euoiIggH9Lv2vGmc
+TkQz4o5wF7CbyzOUZm3/mn3pULLokBTkK5HLoMUuDs8Z70TvhPC9V54mwmM93/yh
+hN5c1187+5Rh8JOJH8/DstGQlzV9uYqt5gXw6DuhfK8rxK8YMy5eh9udgLUE/QDQ
+YKv/hXcPy0ciybKFqEgW4g==
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/revoked-certs/canonical-uefi-2019-all.pem
+++ linux-qcom-6.8.0/debian/revoked-certs/canonical-uefi-2019-all.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4 (0x4)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 18 16:10:17 2019 GMT
+            Not After : Sep 16 16:10:17 2049 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2019)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e6:47:d8:75:e5:87:59:26:87:83:7d:5b:7a:b8:
+                    58:3d:7c:ef:36:f8:a0:7a:b7:14:56:58:7d:01:f1:
+                    1c:3b:8c:e6:5b:03:77:7d:a0:ed:47:0a:45:e6:75:
+                    5c:de:95:38:0d:38:fa:41:79:89:56:31:87:e7:a3:
+                    9a:36:70:b6:cf:24:2f:99:26:89:08:39:0e:14:c3:
+                    35:be:02:8b:52:e1:8e:7b:0c:a6:9d:78:ff:01:60:
+                    d7:f5:c3:d5:f0:5e:dc:e4:23:09:59:72:93:d3:b5:
+                    22:af:7c:cd:e0:84:0f:af:11:2d:bc:c6:72:42:af:
+                    ea:67:63:c4:10:41:78:02:80:62:0d:43:74:b4:1c:
+                    ed:50:d7:94:f1:b0:bb:f9:57:80:e4:69:0f:83:4b:
+                    a2:e6:2c:4a:9a:e1:7d:7c:62:19:29:27:97:1f:4c:
+                    f1:85:f0:39:f5:31:9f:3a:39:0e:d4:4d:07:3a:40:
+                    55:4b:a6:6c:9d:04:89:51:2d:7c:b0:ef:40:b5:42:
+                    29:16:cc:65:73:38:62:21:f6:e3:2c:17:50:9d:74:
+                    34:4e:df:7c:4a:33:a4:bb:40:cf:d5:e5:ed:05:07:
+                    cd:4c:f9:af:7f:a6:5c:b9:f7:c5:16:45:4e:44:40:
+                    d7:85:32:de:ac:e5:75:ad:9b:d7:c0:26:33:1f:77:
+                    a5:37
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                C0:74:6F:D6:C5:DA:3A:E8:27:86:46:51:AD:66:AE:47:FE:24:B3:E8
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        aa:12:6c:d1:9d:6a:da:f0:ec:7c:17:46:3b:57:b8:d6:76:5f:
+        24:e6:06:a2:0a:55:1f:2f:d3:5e:8f:de:cf:02:f2:ff:e0:dd:
+        d3:c7:bd:75:59:aa:cd:34:f3:28:80:73:cc:28:69:e7:a2:70:
+        88:a2:c7:dc:66:f0:92:0e:ff:64:bf:30:04:54:01:1b:96:ad:
+        15:c5:61:fd:32:61:d7:5e:b5:ba:91:fd:31:fc:6b:15:df:ee:
+        22:d9:e4:1f:f3:cc:8b:0c:9f:f5:e8:f7:e2:62:3f:40:52:c9:
+        f0:f1:1c:63:fc:6c:90:e1:5b:74:03:b9:df:d1:3e:a8:ec:db:
+        2b:6e:83:6f:9f:7f:ba:b4:79:fc:3d:e7:12:2f:4a:e7:17:8c:
+        2b:77:a5:90:74:3c:bd:cf:75:83:0d:1a:95:d5:56:ef:07:9b:
+        a6:b3:31:e3:8c:97:ce:68:11:b5:7b:25:03:72:1c:ea:67:e9:
+        7c:3e:73:c7:7c:3e:fc:f5:ae:8a:b2:07:0d:15:6a:66:09:d7:
+        23:b9:5d:80:7a:26:d6:b6:22:30:aa:84:af:c0:42:e9:75:c3:
+        59:ab:a3:84:87:6b:0c:b7:ab:4e:92:69:ae:2c:82:6f:ab:01:
+        24:ab:ff:78:6d:59:85:c2:3b:23:c0:bd:0d:d8:6e:3a:29:82:
+        e1:c4:5f:db
+-----BEGIN CERTIFICATE-----
+MIIEKDCCAxCgAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xOTA5MTgxNjEwMTdaFw00OTA5MTYx
+NjEwMTdaMIGGMQswCQYDVQQGEwJHQjEUMBIGA1UECAwLSXNsZSBvZiBNYW4xFzAV
+BgNVBAoMDkNhbm9uaWNhbCBMdGQuMRQwEgYDVQQLDAtTZWN1cmUgQm9vdDEyMDAG
+A1UEAwwpQ2Fub25pY2FsIEx0ZC4gU2VjdXJlIEJvb3QgU2lnbmluZyAoMjAxOSkw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDmR9h15YdZJoeDfVt6uFg9
+fO82+KB6txRWWH0B8Rw7jOZbA3d9oO1HCkXmdVzelTgNOPpBeYlWMYfno5o2cLbP
+JC+ZJokIOQ4UwzW+AotS4Y57DKadeP8BYNf1w9XwXtzkIwlZcpPTtSKvfM3ghA+v
+ES28xnJCr+pnY8QQQXgCgGINQ3S0HO1Q15TxsLv5V4DkaQ+DS6LmLEqa4X18Yhkp
+J5cfTPGF8Dn1MZ86OQ7UTQc6QFVLpmydBIlRLXyw70C1QikWzGVzOGIh9uMsF1Cd
+dDRO33xKM6S7QM/V5e0FB81M+a9/ply598UWRU5EQNeFMt6s5XWtm9fAJjMfd6U3
+AgMBAAGjgaAwgZ0wDAYDVR0TAQH/BAIwADAfBgNVHSUEGDAWBggrBgEFBQcDAwYK
+KwYBBAGCNwoDBjAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2Vy
+dGlmaWNhdGUwHQYDVR0OBBYEFMB0b9bF2jroJ4ZGUa1mrkf+JLPoMB8GA1UdIwQY
+MBaAFK2RmQvCKrH1FwSMI7ZlWiaONFpjMA0GCSqGSIb3DQEBCwUAA4IBAQCqEmzR
+nWra8Ox8F0Y7V7jWdl8k5gaiClUfL9Nej97PAvL/4N3Tx711WarNNPMogHPMKGnn
+onCIosfcZvCSDv9kvzAEVAEblq0VxWH9MmHXXrW6kf0x/GsV3+4i2eQf88yLDJ/1
+6PfiYj9AUsnw8Rxj/GyQ4Vt0A7nf0T6o7NsrboNvn3+6tHn8PecSL0rnF4wrd6WQ
+dDy9z3WDDRqV1VbvB5umszHjjJfOaBG1eyUDchzqZ+l8PnPHfD789a6KsgcNFWpm
+CdcjuV2AeibWtiIwqoSvwELpdcNZq6OEh2sMt6tOkmmuLIJvqwEkq/94bVmFwjsj
+wL0N2G46KYLhxF/b
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/revoked-certs/canonical-uefi-2021v1-all.pem
+++ linux-qcom-6.8.0/debian/revoked-certs/canonical-uefi-2021v1-all.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 6 (0x6)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 23 19:29:32 2021 GMT
+            Not After : Sep 22 19:29:32 2051 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2021 v1)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:aa:b8:34:5b:b6:ae:44:bf:41:e1:78:11:b9:7a:
+                    c8:88:b3:b0:26:50:10:9c:98:d1:f3:98:9f:23:50:
+                    64:f6:39:dd:50:3a:23:44:53:65:fc:f3:9f:f5:a5:
+                    8b:ae:8b:df:47:9f:e9:d5:a0:92:19:f1:21:ea:cc:
+                    59:3a:74:df:45:71:bc:de:64:15:a5:f6:db:ca:71:
+                    fa:19:d4:44:0d:12:ec:47:3a:43:e2:f2:dd:8b:fe:
+                    0d:7b:dc:4d:db:53:06:22:61:e5:8b:35:49:b6:33:
+                    c4:0a:69:5f:5b:81:09:84:6b:42:33:18:09:9d:a0:
+                    35:f7:9c:1e:de:6e:de:90:69:1a:e8:32:e4:49:ad:
+                    c3:31:e9:f8:4a:a2:28:1d:db:0d:29:b6:48:0a:44:
+                    93:86:41:62:8f:73:97:60:10:8a:74:46:66:55:fe:
+                    a0:95:35:9e:ef:9f:af:11:fa:5b:a3:7c:c2:35:64:
+                    11:67:28:1e:14:0a:7d:68:61:9c:cd:c7:46:39:30:
+                    31:79:94:56:b3:45:16:9a:b5:77:66:fe:41:43:0f:
+                    00:48:6e:99:dd:0c:d4:47:2c:86:8c:50:04:61:20:
+                    dd:aa:8e:73:4f:21:b4:ee:09:4d:d3:40:01:d0:f2:
+                    a7:5b:7d:05:3d:c1:e7:65:26:aa:8c:9a:58:5a:7c:
+                    6d:6f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                A8:D5:4B:BB:38:25:CF:B9:4F:A1:3C:9F:8A:59:4A:19:5C:10:7B:8D
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        24:25:25:7e:01:a5:c8:3d:54:8c:1b:05:73:d1:06:d8:db:d4:
+        3a:71:d5:19:9d:97:1c:85:3c:ca:38:5a:0c:25:25:39:1a:67:
+        bc:6c:9d:98:6c:f3:7d:5f:b7:40:f9:73:a0:f5:7b:40:a8:66:
+        a5:f1:53:b1:78:80:24:3f:19:50:2f:02:09:ec:a1:8a:e6:0d:
+        df:c4:ae:24:9e:69:0d:5c:dc:44:4c:38:3a:53:4e:4b:a1:4b:
+        92:9f:43:a4:9d:1e:76:33:18:1b:bf:62:e5:f5:bc:93:3c:4e:
+        21:d5:5b:20:69:11:28:c1:c5:93:b5:8e:96:1d:1b:ca:72:79:
+        24:de:67:2a:50:9d:ce:8b:41:dd:3e:82:dd:a5:04:75:54:fb:
+        35:70:98:87:b4:f3:ea:41:23:23:80:0e:99:d7:03:16:ee:7e:
+        11:e2:c8:29:ab:73:c5:6d:5c:a8:2f:32:03:9f:8e:66:d6:cb:
+        54:84:55:75:ab:9a:dd:95:fd:05:1e:11:85:37:1e:63:d2:f4:
+        7f:34:64:32:a1:63:91:91:50:39:14:1a:ea:54:78:e6:0d:04:
+        23:c7:83:51:c5:25:27:07:6c:f8:65:b7:da:95:89:76:83:cc:
+        f3:7e:06:74:d3:6c:ef:e9:17:de:29:1e:ab:5c:d7:ec:df:f1:
+        98:b8:e9:66
+-----BEGIN CERTIFICATE-----
+MIIELTCCAxWgAwIBAgIBBjANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAgFw0yMTA5MjMxOTI5MzJaGA8yMDUxMDky
+MjE5MjkzMlowgYkxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MTUw
+MwYDVQQDDCxDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nICgyMDIx
+IHYxKTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKq4NFu2rkS/QeF4
+Ebl6yIizsCZQEJyY0fOYnyNQZPY53VA6I0RTZfzzn/Wli66L30ef6dWgkhnxIerM
+WTp030VxvN5kFaX228px+hnURA0S7Ec6Q+Ly3Yv+DXvcTdtTBiJh5Ys1SbYzxApp
+X1uBCYRrQjMYCZ2gNfecHt5u3pBpGugy5EmtwzHp+EqiKB3bDSm2SApEk4ZBYo9z
+l2AQinRGZlX+oJU1nu+frxH6W6N8wjVkEWcoHhQKfWhhnM3HRjkwMXmUVrNFFpq1
+d2b+QUMPAEhumd0M1EcshoxQBGEg3aqOc08htO4JTdNAAdDyp1t9BT3B52Umqoya
+WFp8bW8CAwEAAaOBoDCBnTAMBgNVHRMBAf8EAjAAMB8GA1UdJQQYMBYGCCsGAQUF
+BwMDBgorBgEEAYI3CgMGMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRl
+ZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUqNVLuzglz7lPoTyfillKGVwQe40wHwYD
+VR0jBBgwFoAUrZGZC8IqsfUXBIwjtmVaJo40WmMwDQYJKoZIhvcNAQELBQADggEB
+ACQlJX4Bpcg9VIwbBXPRBtjb1Dpx1RmdlxyFPMo4WgwlJTkaZ7xsnZhs831ft0D5
+c6D1e0CoZqXxU7F4gCQ/GVAvAgnsoYrmDd/EriSeaQ1c3ERMODpTTkuhS5KfQ6Sd
+HnYzGBu/YuX1vJM8TiHVWyBpESjBxZO1jpYdG8pyeSTeZypQnc6LQd0+gt2lBHVU
++zVwmIe08+pBIyOADpnXAxbufhHiyCmrc8VtXKgvMgOfjmbWy1SEVXWrmt2V/QUe
+EYU3HmPS9H80ZDKhY5GRUDkUGupUeOYNBCPHg1HFJScHbPhlt9qViXaDzPN+BnTT
+bO/pF94pHqtc1+zf8Zi46WY=
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/revoked-certs/canonical-uefi-2021v2-all.pem
+++ linux-qcom-6.8.0/debian/revoked-certs/canonical-uefi-2021v2-all.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7 (0x7)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 23 19:29:42 2021 GMT
+            Not After : Sep 22 19:29:42 2051 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2021 v2)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ba:06:8b:ee:58:b7:8b:49:7b:53:7a:d1:df:02:
+                    e3:f2:d8:b0:8c:03:5c:f4:2d:0b:d8:18:3b:23:fa:
+                    68:b0:e8:e9:9d:dc:a2:eb:5e:d3:06:a9:28:d4:9f:
+                    14:b6:1e:1c:1d:ef:69:0e:7f:44:f2:cc:4a:f1:b1:
+                    d0:71:30:6a:50:1e:b0:d3:f8:a4:19:d0:4a:f1:e3:
+                    eb:7a:e5:57:4c:a1:fb:d1:87:b9:48:e0:55:37:52:
+                    f9:de:99:2e:95:85:36:ce:d3:1d:67:2f:14:cb:7f:
+                    05:82:75:21:b6:aa:a5:14:ac:da:4a:f4:fe:fa:5c:
+                    33:49:3d:6f:de:fd:9d:75:ba:e2:c4:02:38:b5:69:
+                    f5:ff:a8:67:4b:3a:e0:34:f6:3b:07:03:a5:7e:59:
+                    6f:3a:d2:28:a4:2f:25:ac:d8:a9:1f:59:52:5d:24:
+                    36:58:51:b5:f0:12:a8:d3:78:56:57:b1:e0:a9:df:
+                    14:05:65:7c:b5:a5:00:f0:88:39:14:44:18:85:2d:
+                    0c:28:69:7b:b9:b4:1c:47:6f:43:66:4c:22:ad:f7:
+                    f6:19:75:e1:14:2c:0d:33:3f:c1:3f:fc:73:56:b2:
+                    68:05:b5:92:03:9b:65:6b:81:80:92:35:03:9b:66:
+                    68:58:c5:66:11:b6:8c:7f:05:09:9a:45:a6:0e:5e:
+                    5f:bf
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                4C:F0:46:89:2D:6F:D3:C9:A5:B0:3F:98:D8:45:F9:08:51:DC:6A:8C
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        93:9d:49:7d:9f:3e:3e:27:79:97:d9:c2:fc:0b:f7:30:b7:f4:
+        78:b2:c9:e4:5e:42:d3:27:26:70:cf:88:96:d1:f2:ea:a0:75:
+        7e:3c:f6:b7:d2:e7:95:30:e3:a6:67:a7:ee:b9:53:8f:fd:b2:
+        cb:db:e1:98:32:be:98:79:09:46:c6:63:6a:57:87:4d:b2:26:
+        46:f6:34:5e:18:75:ca:82:80:8e:33:c2:1d:c7:76:d7:14:57:
+        ef:2e:0e:9e:58:5c:81:8e:ed:53:2c:07:46:0a:8a:fc:2f:f5:
+        b2:c8:58:f5:fa:fa:bb:f9:7d:47:13:39:f0:f2:1c:15:9c:75:
+        90:40:bd:08:04:b3:6a:de:c2:cd:34:21:7e:ba:31:48:bc:a1:
+        23:bc:ee:93:b2:62:96:27:30:86:c2:d4:f7:b4:e6:3c:71:47:
+        37:84:ff:3d:0c:1e:ec:f3:0e:da:6b:dc:64:7a:b8:c0:7e:45:
+        13:09:bf:02:b3:b7:5b:6d:09:2d:6a:4e:0b:93:94:29:4c:a6:
+        c3:c7:05:fa:69:08:04:53:3c:4c:64:c0:7e:89:00:91:1b:a6:
+        c2:d7:ea:c4:db:86:38:fe:66:03:85:7b:fc:39:24:99:4c:2a:
+        3e:10:8b:91:c3:6e:20:9d:0c:ee:51:70:b5:98:58:f3:5c:ac:
+        16:98:7b:ce
+-----BEGIN CERTIFICATE-----
+MIIELTCCAxWgAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAgFw0yMTA5MjMxOTI5NDJaGA8yMDUxMDky
+MjE5Mjk0MlowgYkxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MTUw
+MwYDVQQDDCxDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nICgyMDIx
+IHYyKTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALoGi+5Yt4tJe1N6
+0d8C4/LYsIwDXPQtC9gYOyP6aLDo6Z3coute0wapKNSfFLYeHB3vaQ5/RPLMSvGx
+0HEwalAesNP4pBnQSvHj63rlV0yh+9GHuUjgVTdS+d6ZLpWFNs7THWcvFMt/BYJ1
+IbaqpRSs2kr0/vpcM0k9b979nXW64sQCOLVp9f+oZ0s64DT2OwcDpX5ZbzrSKKQv
+JazYqR9ZUl0kNlhRtfASqNN4Vlex4KnfFAVlfLWlAPCIORREGIUtDChpe7m0HEdv
+Q2ZMIq339hl14RQsDTM/wT/8c1ayaAW1kgObZWuBgJI1A5tmaFjFZhG2jH8FCZpF
+pg5eX78CAwEAAaOBoDCBnTAMBgNVHRMBAf8EAjAAMB8GA1UdJQQYMBYGCCsGAQUF
+BwMDBgorBgEEAYI3CgMGMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRl
+ZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUTPBGiS1v08mlsD+Y2EX5CFHcaowwHwYD
+VR0jBBgwFoAUrZGZC8IqsfUXBIwjtmVaJo40WmMwDQYJKoZIhvcNAQELBQADggEB
+AJOdSX2fPj4neZfZwvwL9zC39HiyyeReQtMnJnDPiJbR8uqgdX489rfS55Uw46Zn
+p+65U4/9ssvb4Zgyvph5CUbGY2pXh02yJkb2NF4YdcqCgI4zwh3HdtcUV+8uDp5Y
+XIGO7VMsB0YKivwv9bLIWPX6+rv5fUcTOfDyHBWcdZBAvQgEs2rews00IX66MUi8
+oSO87pOyYpYnMIbC1Pe05jxxRzeE/z0MHuzzDtpr3GR6uMB+RRMJvwKzt1ttCS1q
+TguTlClMpsPHBfppCARTPExkwH6JAJEbpsLX6sTbhjj+ZgOFe/w5JJlMKj4Qi5HD
+biCdDO5RcLWYWPNcrBaYe84=
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/revoked-certs/canonical-uefi-2021v3-all.pem
+++ linux-qcom-6.8.0/debian/revoked-certs/canonical-uefi-2021v3-all.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8 (0x8)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Sep 23 19:30:02 2021 GMT
+            Not After : Sep 22 19:30:02 2051 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2021 v3)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d6:29:96:87:ae:07:42:45:bb:65:09:b2:9b:de:
+                    5d:8e:78:61:10:d5:6d:ae:ae:26:08:6a:06:ec:4a:
+                    dd:2b:e7:1a:a9:ad:78:e3:fc:cf:8f:d1:47:bd:1e:
+                    33:d8:7a:e3:66:9b:e9:73:c1:5f:42:e2:fe:bc:c3:
+                    41:f7:cd:d7:85:d7:42:c9:ea:31:e5:47:b1:93:5b:
+                    43:2b:07:51:b8:75:08:ad:0f:e7:0d:81:38:5a:21:
+                    df:b1:43:5b:db:37:c5:ac:aa:14:3a:33:19:6a:26:
+                    e0:05:fe:cd:41:31:af:5d:a8:ab:31:77:44:fc:da:
+                    00:e2:7a:44:33:c3:a7:ed:13:54:9f:19:5d:c9:98:
+                    a2:3b:af:4d:0d:87:29:9c:90:9e:42:9e:9a:06:6a:
+                    70:27:c5:aa:f7:a2:f2:88:e0:b9:66:9a:72:a0:f6:
+                    61:7e:30:8f:14:9f:44:0d:dd:54:ae:47:c8:82:ba:
+                    d2:b2:db:6f:24:c1:f4:0a:81:07:90:47:49:5f:57:
+                    d6:3f:bf:2a:73:98:f2:f6:24:1a:74:03:d7:35:f0:
+                    42:d8:14:c5:94:27:5d:3c:49:0c:b0:f0:7a:61:1b:
+                    d7:5a:e3:a3:40:57:e9:a4:07:ee:02:a3:32:27:94:
+                    bb:f3:36:c5:5f:ef:d3:07:04:3a:80:4c:9c:0a:b7:
+                    88:9f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                10:04:37:BB:6D:E6:E4:69:B5:81:E6:1C:D6:6B:CE:3E:F4:ED:53:AF
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        3b:37:d6:a8:8d:cd:d2:df:13:35:ac:8c:92:d6:b0:ac:d1:38:
+        a8:00:97:47:59:b8:4a:84:8c:80:a5:1d:c7:29:bf:00:66:e5:
+        10:40:26:2e:31:f5:e1:13:c0:1b:29:f3:0b:7e:2d:71:d8:db:
+        e1:32:8f:79:8e:e3:97:0c:40:a9:a0:12:c1:fc:c2:50:88:72:
+        44:c5:bc:8b:45:6e:28:fd:d2:37:d6:db:17:cf:4e:61:33:08:
+        5a:5d:08:94:73:44:e2:76:00:44:1b:b8:00:a1:86:00:64:8a:
+        f1:42:32:3c:28:11:67:7c:8b:aa:06:34:74:58:e8:b3:3a:36:
+        8d:f6:04:5d:37:f5:66:52:c9:48:b0:a7:6f:34:09:dd:60:2a:
+        86:b9:14:f1:09:f6:06:16:56:e0:51:b1:e8:75:7f:fa:37:dc:
+        e0:98:a7:69:ae:7b:1a:73:89:0d:06:67:cc:01:ef:80:31:45:
+        9e:bb:03:2a:eb:89:70:d6:19:b2:c7:ce:bc:81:df:da:c8:6f:
+        a9:4b:2d:d7:a7:e1:af:c6:e8:fb:f0:61:c9:cd:d2:91:cd:8b:
+        c2:6c:ef:e0:b6:7f:f1:c4:81:f9:bb:76:9c:26:e3:fa:a1:a0:
+        cd:5e:05:de:ee:f9:1b:5b:50:0a:8b:0f:47:e3:90:32:ac:2a:
+        e7:65:02:80
+-----BEGIN CERTIFICATE-----
+MIIELTCCAxWgAwIBAgIBCDANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAgFw0yMTA5MjMxOTMwMDJaGA8yMDUxMDky
+MjE5MzAwMlowgYkxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MTUw
+MwYDVQQDDCxDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nICgyMDIx
+IHYzKTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANYploeuB0JFu2UJ
+spveXY54YRDVba6uJghqBuxK3SvnGqmteOP8z4/RR70eM9h642ab6XPBX0Li/rzD
+QffN14XXQsnqMeVHsZNbQysHUbh1CK0P5w2BOFoh37FDW9s3xayqFDozGWom4AX+
+zUExr12oqzF3RPzaAOJ6RDPDp+0TVJ8ZXcmYojuvTQ2HKZyQnkKemgZqcCfFqvei
+8ojguWaacqD2YX4wjxSfRA3dVK5HyIK60rLbbyTB9AqBB5BHSV9X1j+/KnOY8vYk
+GnQD1zXwQtgUxZQnXTxJDLDwemEb11rjo0BX6aQH7gKjMieUu/M2xV/v0wcEOoBM
+nAq3iJ8CAwEAAaOBoDCBnTAMBgNVHRMBAf8EAjAAMB8GA1UdJQQYMBYGCCsGAQUF
+BwMDBgorBgEEAYI3CgMGMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRl
+ZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUEAQ3u23m5Gm1geYc1mvOPvTtU68wHwYD
+VR0jBBgwFoAUrZGZC8IqsfUXBIwjtmVaJo40WmMwDQYJKoZIhvcNAQELBQADggEB
+ADs31qiNzdLfEzWsjJLWsKzROKgAl0dZuEqEjIClHccpvwBm5RBAJi4x9eETwBsp
+8wt+LXHY2+Eyj3mO45cMQKmgEsH8wlCIckTFvItFbij90jfW2xfPTmEzCFpdCJRz
+ROJ2AEQbuAChhgBkivFCMjwoEWd8i6oGNHRY6LM6No32BF039WZSyUiwp280Cd1g
+Koa5FPEJ9gYWVuBRseh1f/o33OCYp2muexpziQ0GZ8wB74AxRZ67AyrriXDWGbLH
+zryB39rIb6lLLden4a/G6PvwYcnN0pHNi8Js7+C2f/HEgfm7dpwm4/qhoM1eBd7u
++RtbUAqLD0fjkDKsKudlAoA=
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/revoked-certs/canonical-uefi-uc2019-all.pem
+++ linux-qcom-6.8.0/debian/revoked-certs/canonical-uefi-uc2019-all.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = GB, ST = Isle of Man, L = Douglas, O = Canonical Ltd., CN = Canonical Ltd. Master Certificate Authority
+        Validity
+            Not Before: Mar  4 10:27:14 2020 GMT
+            Not After : Mar  3 10:27:14 2050 GMT
+        Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (Ubuntu Core 2019)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b9:10:47:2e:75:5d:f3:10:23:bb:a0:75:d2:fa:
+                    02:2d:ff:22:df:c1:e6:cd:38:7c:36:0f:ae:74:15:
+                    6e:a5:34:52:2b:c3:a4:3a:60:d7:06:ee:1d:99:93:
+                    ff:66:91:a3:18:52:2c:8c:58:e6:b4:2f:4b:c5:fb:
+                    83:e6:f3:19:bd:1b:ca:23:ec:97:1f:d8:f1:9a:f1:
+                    04:da:da:10:04:53:4b:ec:1d:b6:26:47:7c:bb:8f:
+                    a7:0a:6e:2e:e8:91:e6:c4:bb:64:34:78:3c:fa:09:
+                    15:1c:8f:9e:eb:04:99:36:22:c6:8d:07:15:0f:b9:
+                    69:08:fa:ff:4b:45:bd:ba:2b:cd:01:0e:e7:01:23:
+                    c9:e5:7a:39:3b:91:b0:45:3c:d5:77:ba:ca:f9:29:
+                    3d:11:3f:1c:6b:5b:8e:6c:4b:3f:c9:29:05:cb:59:
+                    d6:b1:c1:c0:2d:56:88:70:27:fa:73:05:5c:c2:11:
+                    d4:27:11:f7:0b:c2:d5:68:d3:1a:cd:ed:d0:e4:10:
+                    ff:34:cb:b7:45:70:34:2c:23:53:b6:9c:30:70:b4:
+                    5c:d1:e2:64:18:82:8f:62:b1:5e:aa:0b:d4:89:f2:
+                    1c:53:c4:32:7d:ef:53:ee:9b:6e:02:ab:78:bd:25:
+                    67:8b:39:36:d8:84:3b:06:99:02:d6:75:73:4e:f2:
+                    f6:b9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                Code Signing, 1.3.6.1.4.1.311.10.3.6
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                C1:D5:7B:8F:6B:74:3F:23:EE:41:F4:F7:EE:29:2F:06:EE:CA:DF:B9
+            X509v3 Authority Key Identifier: 
+                AD:91:99:0B:C2:2A:B1:F5:17:04:8C:23:B6:65:5A:26:8E:34:5A:63
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        2d:b5:11:a8:d2:a0:af:81:a0:18:22:18:2c:08:d0:f4:63:e8:
+        8f:9a:f4:f5:20:dd:eb:22:77:19:9a:1a:09:3d:7f:aa:7d:c9:
+        81:bc:26:98:65:94:46:30:4b:c2:51:7c:f7:21:41:63:87:31:
+        fc:a4:c9:41:28:c7:2e:2a:2e:d8:a8:75:7a:72:77:3b:1b:9f:
+        72:15:0d:0c:96:8d:8b:51:f3:ce:37:b6:ca:9f:ca:59:40:4a:
+        fc:73:7a:94:12:99:aa:c2:8d:52:ce:91:19:2e:b4:da:ff:e5:
+        2c:67:74:d9:58:47:38:2f:61:88:c5:cf:a7:48:e1:08:ba:bc:
+        ec:d5:3a:47:d9:8c:dc:c3:bc:cb:98:2b:79:7a:02:46:ef:85:
+        19:2f:03:4b:05:84:eb:56:98:5f:6d:cf:a5:8b:a2:b6:e5:50:
+        51:7c:33:44:bd:7a:94:2e:0d:90:39:39:3e:62:60:ae:3a:e2:
+        f5:17:fa:f1:94:06:1d:ae:a3:f8:19:20:7f:4b:4c:07:c4:e6:
+        2d:0d:e5:94:84:51:6d:6f:0f:c4:c6:79:1d:f0:e8:0e:23:9e:
+        fd:f9:46:2c:b9:ec:97:38:56:7e:b8:13:f6:d2:e1:8e:a5:93:
+        02:7b:6e:dd:33:9a:bf:10:a8:1b:3d:fa:c4:f2:15:f0:27:73:
+        26:a6:94:d1
+-----BEGIN CERTIFICATE-----
+MIIENjCCAx6gAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCR0Ix
+FDASBgNVBAgMC0lzbGUgb2YgTWFuMRAwDgYDVQQHDAdEb3VnbGFzMRcwFQYDVQQK
+DA5DYW5vbmljYWwgTHRkLjE0MDIGA1UEAwwrQ2Fub25pY2FsIEx0ZC4gTWFzdGVy
+IENlcnRpZmljYXRlIEF1dGhvcml0eTAgFw0yMDAzMDQxMDI3MTRaGA8yMDUwMDMw
+MzEwMjcxNFowgZIxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9mIE1hbjEX
+MBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4xFDASBgNVBAsMC1NlY3VyZSBCb290MT4w
+PAYDVQQDDDVDYW5vbmljYWwgTHRkLiBTZWN1cmUgQm9vdCBTaWduaW5nIChVYnVu
+dHUgQ29yZSAyMDE5KTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALkQ
+Ry51XfMQI7ugddL6Ai3/It/B5s04fDYPrnQVbqU0UivDpDpg1wbuHZmT/2aRoxhS
+LIxY5rQvS8X7g+bzGb0byiPslx/Y8ZrxBNraEARTS+wdtiZHfLuPpwpuLuiR5sS7
+ZDR4PPoJFRyPnusEmTYixo0HFQ+5aQj6/0tFvborzQEO5wEjyeV6OTuRsEU81Xe6
+yvkpPRE/HGtbjmxLP8kpBctZ1rHBwC1WiHAn+nMFXMIR1CcR9wvC1WjTGs3t0OQQ
+/zTLt0VwNCwjU7acMHC0XNHiZBiCj2KxXqoL1InyHFPEMn3vU+6bbgKreL0lZ4s5
+NtiEOwaZAtZ1c07y9rkCAwEAAaOBoDCBnTAMBgNVHRMBAf8EAjAAMB8GA1UdJQQY
+MBYGCCsGAQUFBwMDBgorBgEEAYI3CgMGMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM
+IEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUwdV7j2t0PyPuQfT37ikv
+Bu7K37kwHwYDVR0jBBgwFoAUrZGZC8IqsfUXBIwjtmVaJo40WmMwDQYJKoZIhvcN
+AQELBQADggEBAC21EajSoK+BoBgiGCwI0PRj6I+a9PUg3esidxmaGgk9f6p9yYG8
+JphllEYwS8JRfPchQWOHMfykyUEoxy4qLtiodXpydzsbn3IVDQyWjYtR8843tsqf
+yllASvxzepQSmarCjVLOkRkutNr/5SxndNlYRzgvYYjFz6dI4Qi6vOzVOkfZjNzD
+vMuYK3l6AkbvhRkvA0sFhOtWmF9tz6WLorblUFF8M0S9epQuDZA5OT5iYK464vUX
++vGUBh2uo/gZIH9LTAfE5i0N5ZSEUW1vD8TGeR3w6A4jnv35Riy57Jc4Vn64E/bS
+4Y6lkwJ7bt0zmr8QqBs9+sTyFfAncyamlNE=
+-----END CERTIFICATE-----
--- linux-qcom-6.8.0.orig/debian/rules
+++ linux-qcom-6.8.0/debian/rules
@@ -0,0 +1,241 @@
+#!/usr/bin/make -f
+#
+# $(DEBIAN)/rules for Ubuntu linux
+#
+# Use this however you want, just give credit where credit is due.
+#
+# Copyright (c) 2007 Ben Collins <bcollins@ubuntu.com>
+#
+
+# Do not use make's built-in rules and variables
+# (this increases performance and avoids hard-to-debug behaviour)
+MAKEFLAGS += -rR
+
+# Allow to run debian/rules directly without root
+export DEB_RULES_REQUIRES_ROOT := no
+
+.NOTPARALLEL:
+
+DEBIAN=$(shell awk -F= '($$1 == "DEBIAN") { print $$2 }' <debian/debian.env)
+
+# dpkg-buildpackage passes options that are incomptatible
+# with the kernel build.
+unexport CFLAGS
+unexport LDFLAGS
+
+export LC_ALL=C
+export SHELL=/bin/bash -e
+
+# Where do we find the common configuration.
+export DROOT=debian
+
+# Temporary workaround to fix build issues if only python2 runtime is installed
+# (without python3-dev).
+export PYTHON=python3
+
+# Common variables for all architectures
+include $(DROOT)/rules.d/0-common-vars.mk
+
+# Pull in some arch specific stuff
+-include $(DEBIAN)/rules.d/$(arch).mk
+
+# Pull in some branch specific stuff
+-include $(DEBIAN)/rules.d/hooks.mk
+
+# Maintainer targets
+include $(DROOT)/rules.d/1-maintainer.mk
+
+do_linux_tools=$(sort $(filter-out false,$(do_tools_usbip) $(do_tools_cpupower) $(do_tools_perf) $(do_tools_bpftool) $(do_tools_x86)))
+do_cloud_tools=$(sort $(filter-out false,$(do_tools_hyperv)))
+do_tools_perf_jvmti?=false
+do_tools_perf_python?=false
+
+# Indep tools packages may only be built for the main linux source package
+ifeq ($(src_pkg_name),linux)
+	do_tools_common = true
+	do_tools_host = true
+endif
+
+# The linux-source package may only be built for the linux source package
+# We need to explicitly turn this off here to override any (incorrect)
+# statement in any of the above included makefile snippets
+ifneq ($(src_pkg_name),linux)
+	do_source_package = false
+endif
+
+# Default settings for DKMS modules.
+$(foreach _m,$(all_dkms_modules), \
+  $(eval do_$(_m) ?= $(if $(filter $(_m),$(filter-out $(dkms_exclude),$(dkms_include) $(subst any,$(_m),$(subst $(arch),$(_m),$(dkms_$(_m)_archs))))),true,false)) \
+)
+
+# Don't build tools in a cross compile environment.
+ifneq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
+	do_tools=false
+endif
+
+# Are any of the kernel signing options enabled.
+any_signed=$(sort $(filter-out false,$(uefi_signed) $(opal_signed) $(sipl_signed)))
+ifeq ($(any_signed),true)
+bin_pkg_name=$(bin_pkg_name_unsigned)
+else
+bin_pkg_name=$(bin_pkg_name_signed)
+endif
+
+# Stages -- support both DEB_STAGE=stage1 and DEB_BUILD_PROFILE=bootstrap
+ifeq ($(DEB_STAGE),stage1)
+    DEB_BUILD_PROFILES=stage1
+endif
+ifneq ($(DEB_BUILD_PROFILE),)
+    DEB_BUILD_PROFILES=$(DEB_BUILD_PROFILE)
+endif
+ifneq ($(filter stage1,$(DEB_BUILD_PROFILES)),)
+    do_tools=false
+    do_source_package=false
+    do_flavour_image_package=false
+    do_flavour_header_package=false
+endif
+
+# autopkgtest -- rebuild support
+#  - only build the first flavour on the assumption it is representative
+#  - disable dkms builds as the versions used may have been deleted
+ifneq ($(filter autopkgtest,$(DEB_BUILD_PROFILES)),)
+	flavours := $(firstword $(flavours))
+$(foreach _m,$(all_dkms_modules),$(eval do_$(_m) = false))
+endif
+
+# Being used to build a mainline build -- turn off things which do not work.
+ifeq ($(do_mainline_build),true)
+	do_extras_package=false
+	do_tools=false
+	no_dumpfile=1
+$(foreach _m,$(all_dkms_modules),$(eval do_$(_m) = false))
+	do_skip_checks=true
+endif
+
+# Disable tools build and packaging if do_tools != true
+ifneq ($(do_tools),true)
+	do_linux_tools=
+	do_cloud_tools=
+	do_tools_common=
+	do_tools_host=
+endif
+
+# Either tools package needs the common source preparation
+do_any_tools=$(sort $(filter-out false,$(do_linux_tools) $(do_cloud_tools)))
+
+# Debian Build System targets
+.PHONY: binary
+binary: binary-indep binary-arch
+
+.PHONY: build
+build: build-arch build-indep
+
+.PHONY: clean
+clean: debian/control debian/canonical-certs.pem debian/canonical-revoked-certs.pem
+	dh_testdir
+	dh_testroot
+	dh_clean
+
+	# normal build junk
+	rm -rf $(DEBIAN)/abi
+	rm -rf $(builddir) $(stampdir)
+	rm -rf debian/linux-*/
+
+	cp $(DEBIAN)/changelog debian/changelog
+
+	# Install the copyright information.
+	cp $(DEBIAN)/copyright debian/copyright
+
+	# If we have a reconstruct script use it.
+	[ -f $(DEBIAN)/reconstruct ] && bash $(DEBIAN)/reconstruct || true
+
+	# Remove generated intermediate files
+	rm -f $(DROOT)/control.stub $(DEBIAN)/control.stub
+	rm -f $(DROOT)/scripts/fix-filenames
+
+.PHONY: distclean
+distclean: clean
+	rm -rf $(DROOT)/control debian/changelog \
+		debian/control debian/control.stub debian/copyright
+
+# Builds the image, arch headers and debug packages
+include $(DROOT)/rules.d/2-binary-arch.mk
+
+# Builds the source and linux-headers indep packages
+include $(DROOT)/rules.d/3-binary-indep.mk
+
+# Various checks to be performed on builds
+include $(DROOT)/rules.d/4-checks.mk
+
+control_files := $(DEBIAN)/control.stub.in
+ifeq ($(src_pkg_name),linux)
+	control_files += debian/control.d/linux-libc-dev.stub
+	control_files += debian/control.d/linux-tools-common.stub
+	control_files += debian/control.d/linux-cloud-tools-common.stub
+	control_files += debian/control.d/linux-tools-host.stub
+	control_files += debian/control.d/linux-source.stub
+	control_files += debian/control.d/linux-doc.stub
+	control_files += debian/control.d/linux-bpf-dev.stub
+endif
+
+# Calculate Ubuntu Compatible Signing levels
+UBUNTU_COMPATIBLE_SIGNING=$(shell grep -qx ' *Subject: C = GB, ST = Isle of Man, O = Canonical Ltd., OU = Secure Boot, CN = Canonical Ltd. Secure Boot Signing (2021 v3)' debian/canonical-revoked-certs.pem && echo ubuntu/4 pro/3)
+
+# Misc stuff
+.PHONY: $(DEBIAN)/control.stub
+$(DEBIAN)/control.stub: 				\
+		$(DROOT)/scripts/control-create		\
+		$(control_files)			\
+		debian/canonical-revoked-certs.pem	\
+		$(DROOT)/control.d/flavour-module.stub	\
+		$(DEBIAN)/changelog			\
+		$(wildcard $(DEBIAN)/control.d/*)
+	for i in $(control_files); do                                           \
+	  cat $$i;                                                              \
+	  echo "";                                                              \
+	done | sed -e 's/PKGVER/$(release)/g'                                   \
+	        -e 's/ABINUM/$(abinum)/g'                                       \
+		-e 's/SRCPKGNAME/$(src_pkg_name)/g'                             \
+		-e 's/=HUMAN=/$(human_arch)/g'                                  \
+		-e 's/=SERIES=/$(series)/g'                                     \
+		-e 's|\(^Maintainer:.*\)|\1\nXSC-Ubuntu-Compatible-Signing: $(UBUNTU_COMPATIBLE_SIGNING)|g' \
+		-e 's/\(^Build-Depends:$$\)/\1\n$(GCC_BUILD_DEPENDS)/g'         \
+	  > $(DEBIAN)/control.stub;
+	flavours="$(sort $(wildcard $(DEBIAN)/control.d/vars.*))";\
+	for i in $$flavours; do							\
+	  $(SHELL) $(DROOT)/scripts/control-create $$i "$(any_signed)" |	\
+		sed -e 's/PKGVER/$(release)/g'                                  \
+		-e 's/ABINUM/$(abinum)/g'                                       \
+		-e 's/SRCPKGNAME/$(src_pkg_name)/g'                             \
+		-e 's/=HUMAN=/$(human_arch)/g'                                  \
+		-e 's/=SERIES=/$(series)/g'                                     \
+		>> $(DEBIAN)/control.stub;                                      \
+	done
+
+.PHONY: debian/control
+debian/control: $(DEBIAN)/control.stub
+	cp $(DEBIAN)/control.stub debian/control
+
+debian/canonical-certs.pem: $(wildcard $(DROOT)/certs/*-all.pem) $(wildcard $(DROOT)/certs/*-$(arch).pem) $(wildcard $(DEBIAN)/certs/*-all.pem) $(wildcard $(DEBIAN)/certs/*-$(arch).pem)
+	for cert in $(sort $(notdir $^));					\
+	do									\
+		for dir in $(DEBIAN) $(DROOT);					\
+		do								\
+			if [ -f "$$dir/certs/$$cert" ]; then			\
+				cat "$$dir/certs/$$cert";			\
+				break;						\
+			fi;							\
+		done;								\
+	done >"$@"
+
+debian/canonical-revoked-certs.pem: $(wildcard $(DROOT)/revoked-certs/*-all.pem) $(wildcard $(DROOT)/revoked-certs/*-$(arch).pem) $(wildcard $(DEBIAN)/revoked-certs/*-all.pem) $(wildcard $(DEBIAN)/revoked-certs/*-$(arch).pem)
+	for cert in $(sort $(notdir $^));					\
+	do									\
+		for dir in $(DEBIAN) $(DROOT);					\
+		do								\
+			if [ -f "$$dir/revoked-certs/$$cert" ]; then		\
+				cat "$$dir/revoked-certs/$$cert";		\
+				break;						\
+			fi;							\
+		done;								\
+	done >"$@"
--- linux-qcom-6.8.0.orig/debian/rules.d/0-common-vars.mk
+++ linux-qcom-6.8.0/debian/rules.d/0-common-vars.mk
@@ -0,0 +1,269 @@
+# Used when you need to 'escape' a comma.
+comma = ,
+empty :=
+space := $(empty) $(empty)
+
+#
+# The source package name will be the first token from $(DEBIAN)/changelog
+#
+src_pkg_name := $(shell dpkg-parsechangelog -l$(DEBIAN)/changelog -S source)
+
+# Get the series
+series := $(shell dpkg-parsechangelog -l$(DEBIAN)/changelog -S distribution | sed -e 's/-\(security\|updates\|proposed\)$$//')
+
+# Get some version info
+version := $(shell dpkg-parsechangelog -l$(DEBIAN)/changelog -S version)
+revision ?= $(lastword $(subst -,$(space),$(version)))
+release := $(patsubst %-$(revision),%,$(version))
+
+prev_fullver ?= $(shell dpkg-parsechangelog -l$(DEBIAN)/changelog -o1 -c1 -S version)
+prev_revision := $(lastword 0.0 $(subst -,$(space),$(prev_fullver)))
+
+# Get upstream version info
+upstream_version := $(shell sed -n 's/^VERSION = \(.*\)$$/\1/p' Makefile)
+upstream_patchlevel := $(shell sed -n 's/^PATCHLEVEL = \(.*\)$$/\1/p' Makefile)
+upstream_tag := "v$(upstream_version).$(upstream_patchlevel)"
+
+# Get the kernels own extra version to be added to the release signature.
+raw_kernelversion=$(shell make kernelversion)
+
+packages_enabled := $(shell dh_listpackages 2>/dev/null)
+define if_package
+$(if $(filter $(1),$(packages_enabled)),$(2))
+endef
+
+stamp = [ -d $(dir $@) ] || mkdir $(dir $@); touch $@
+
+#
+# do_full_build -- are we doing a full buildd style build, i.e., are we
+#                  building in a PPA
+#
+ifeq ($(wildcard /CurrentlyBuilding),)
+	do_full_build ?= false
+else
+	do_full_build ?= true
+endif
+
+#
+# The debug packages are ginormous, so you probably want to skip
+# building them (as a developer).
+#
+do_dbgsym_package = true
+ifeq ($(do_full_build),false)
+	do_dbgsym_package = false
+endif
+ifeq ($(filter $(DEB_BUILD_OPTIONS),noautodbgsym),noautodbgsym)
+	# Disable debug package builds if we're building in a PPA that has the
+	# 'Build debug symbols' option disabled
+	do_dbgsym_package = false
+endif
+
+abinum		:= $(firstword $(subst .,$(space),$(revision)))
+prev_abinum	:= $(firstword $(subst .,$(space),$(prev_revision)))
+abi_release	:= $(release)-$(abinum)
+
+uploadnum	:= $(patsubst $(abinum).%,%,$(revision))
+ifneq ($(do_full_build),false)
+  uploadnum	:= $(uploadnum)-Ubuntu
+endif
+
+DEB_HOST_MULTIARCH = $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
+DEB_HOST_GNU_TYPE  = $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+DEB_BUILD_GNU_TYPE = $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
+DEB_HOST_ARCH = $(shell dpkg-architecture -qDEB_HOST_ARCH)
+DEB_BUILD_ARCH = $(shell dpkg-architecture -qDEB_BUILD_ARCH)
+
+#
+# Detect invocations of the form 'fakeroot debian/rules binary arch=armhf'
+# within an x86'en schroot. This only gets you part of the way since the
+# packaging phase fails, but you can at least compile the kernel quickly.
+#
+arch := $(DEB_HOST_ARCH)
+CROSS_COMPILE ?= $(DEB_HOST_GNU_TYPE)-
+
+#
+# Set consistent toolchain
+# If a given kernel wants to change this, they can do so via their own
+# $(DEBIAN)/rules.d/hooks.mk and $(DEBIAN)/rules.d/$(arch).mk files
+#
+export gcc?=gcc-13
+GCC_BUILD_DEPENDS=\ $(gcc), $(gcc)-aarch64-linux-gnu [arm64] <cross>, $(gcc)-arm-linux-gnueabihf [armhf] <cross>, $(gcc)-powerpc64le-linux-gnu [ppc64el] <cross>, $(gcc)-riscv64-linux-gnu [riscv64] <cross>, $(gcc)-s390x-linux-gnu [s390x] <cross>, $(gcc)-x86-64-linux-gnu [amd64] <cross>,
+
+abidir		:= $(CURDIR)/$(DEBIAN)/__abi.current/$(arch)
+commonconfdir	:= $(CURDIR)/$(DEBIAN)/config
+archconfdir	:= $(CURDIR)/$(DEBIAN)/config/$(arch)
+sharedconfdir	:= $(CURDIR)/debian.master/config
+builddir	:= $(CURDIR)/debian/build
+stampdir	:= $(CURDIR)/debian/stamps
+
+#
+# The binary package name always starts with linux-image-$KVER-$ABI.$UPLOAD_NUM. There
+# are places that you'll find linux-image hard coded, but I guess thats OK since the
+# assumption that the binary package always starts with linux-image will never change.
+#
+bin_pkg_name_signed=linux-image-$(abi_release)
+bin_pkg_name_unsigned=linux-image-unsigned-$(abi_release)
+mods_pkg_name=linux-modules-$(abi_release)
+mods_extra_pkg_name=linux-modules-extra-$(abi_release)
+bldinfo_pkg_name=linux-buildinfo-$(abi_release)
+hdrs_pkg_name=linux-headers-$(abi_release)
+rust_pkg_name=$(src_pkg_name)-lib-rust-$(abi_release)
+indep_hdrs_pkg_name=$(src_pkg_name)-headers-$(abi_release)
+indep_lib_rust_pkg_name=$(src_pkg_name)-lib-rust-$(abi_release)
+
+#
+# Similarly with the linux-source package, you need not build it as a developer. Its
+# somewhat I/O intensive and utterly useless.
+#
+do_source_package=true
+do_source_package_content=true
+ifeq ($(do_full_build),false)
+do_source_package_content=false
+endif
+
+# common headers normally is built as an indep package, but may be arch
+do_common_headers_indep=true
+
+# build tools
+ifneq ($(wildcard $(CURDIR)/tools),)
+	ifeq ($(do_tools),)
+		ifneq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
+			do_tools=false
+		endif
+	endif
+	do_tools?=true
+else
+	do_tools?=false
+endif
+tools_pkg_name=$(src_pkg_name)-tools-$(abi_release)
+tools_common_pkg_name=linux-tools-common
+tools_flavour_pkg_name=linux-tools-$(abi_release)
+cloud_pkg_name=$(src_pkg_name)-cloud-tools-$(abi_release)
+cloud_common_pkg_name=linux-cloud-tools-common
+cloud_flavour_pkg_name=linux-cloud-tools-$(abi_release)
+hosttools_pkg_name=linux-tools-host
+
+# The general flavour specific image package.
+do_flavour_image_package=true
+
+# The general flavour specific header package.
+do_flavour_header_package=true
+
+# DTBs
+do_dtbs=false
+
+# ZSTD compressed kernel modules
+do_zstd_ko=true
+ifeq ($(series),jammy)
+do_zstd_ko=
+endif
+
+# Support parallel=<n> in DEB_BUILD_OPTIONS (see #209008)
+#
+# These 2 environment variables set the -j value of the kernel build. For example,
+# CONCURRENCY_LEVEL=16 fakeroot $(DEBIAN)/rules binary-debs
+# or
+# DEB_BUILD_OPTIONS=parallel=16 fakeroot $(DEBIAN)/rules binary-debs
+#
+# The default is to use the number of CPUs.
+#
+COMMA=,
+DEB_BUILD_OPTIONS_PARA = $(subst parallel=,,$(filter parallel=%,$(subst $(COMMA), ,$(DEB_BUILD_OPTIONS))))
+ifneq (,$(DEB_BUILD_OPTIONS_PARA))
+  CONCURRENCY_LEVEL := $(DEB_BUILD_OPTIONS_PARA)
+endif
+
+ifeq ($(CONCURRENCY_LEVEL),)
+  # Check the environment
+  CONCURRENCY_LEVEL := $(shell echo $$CONCURRENCY_LEVEL)
+  # No? Then build with the number of CPUs on the host.
+  ifeq ($(CONCURRENCY_LEVEL),)
+      CONCURRENCY_LEVEL := $(shell expr `getconf _NPROCESSORS_ONLN` \* 1)
+  endif
+  # Oh hell, give 'em one
+  ifeq ($(CONCURRENCY_LEVEL),)
+    CONCURRENCY_LEVEL := 1
+  endif
+endif
+
+conc_level		= -j$(CONCURRENCY_LEVEL)
+
+PYTHON ?= $(firstword $(wildcard /usr/bin/python3) $(wildcard /usr/bin/python2) $(wildcard /usr/bin/python))
+
+HOSTCC ?= $(DEB_BUILD_GNU_TYPE)-$(gcc)
+
+# target_flavour is filled in for each step
+kmake = make ARCH=$(build_arch) \
+	CROSS_COMPILE=$(CROSS_COMPILE) \
+	HOSTCC=$(HOSTCC) \
+	CC=$(CROSS_COMPILE)$(gcc) \
+	BINDGEN=bindgen-0.65 \
+	KERNELRELEASE=$(abi_release)-$(target_flavour) \
+	CONFIG_DEBUG_SECTION_MISMATCH=y \
+	KBUILD_BUILD_VERSION="$(uploadnum)" \
+	CFLAGS_MODULE="-DPKG_ABI=$(abinum)" \
+	PYTHON=$(PYTHON)
+ifneq ($(LOCAL_ENV_CC),)
+kmake += CC="$(LOCAL_ENV_CC)" DISTCC_HOSTS="$(LOCAL_ENV_DISTCC_HOSTS)"
+endif
+
+# Locking is required in parallel builds to prevent loss of contents
+# of the debian/files.
+lockme = flock -w 60 $(CURDIR)/debian/.LOCK
+
+# Don't fail if a link already exists.
+LN = ln -sf
+
+# Checks if a var is overriden by the custom rules. Called with var and
+# flavour as arguments.
+custom_override = $(or $($(1)_$(2)),$($(1)))
+
+# selftests that Ubuntu cares about
+ubuntu_selftests = breakpoints cpu-hotplug efivarfs memfd memory-hotplug mount net ptrace seccomp timers powerpc user ftrace
+
+# DKMS
+all_dkms_modules =
+
+subst_paired = $(subst $(firstword $(subst =, ,$(1))),$(lastword $(subst =, ,$(1))),$(2))
+recursive_call = $(if $(2),$(call recursive_call,$(1),$(wordlist 2,$(words $(2)),$(2)),$(call $(1),$(firstword $(2)),$(3))),$(3))
+
+$(foreach _line,$(shell gawk '{ OFS = "!"; $$1 = $$1; print }' $(DEBIAN)/dkms-versions), \
+  $(eval _params = $(subst !, ,$(_line))) \
+  $(eval _deb_pkgname = $(firstword $(_params))) \
+  $(eval _deb_version = $(word 2,$(_params))) \
+  $(if $(filter modulename=%,$(_params)), \
+    $(eval _m = $(word 2,$(subst =, ,$(filter modulename=%,$(_params))))) \
+    , \
+    $(info modulename for $(_deb_pkgname) not specified in dkms-versions. Assume $(_deb_pkgname).) \
+    $(eval _m = $(_deb_pkgname)) \
+  ) \
+  $(eval all_dkms_modules += $(_m)) \
+  $(eval dkms_$(_m)_version = $(_deb_version)) \
+  $(foreach _p,$(patsubst debpath=%,%,$(filter debpath=%,$(_params))), \
+    $(eval dkms_$(_m)_debpath += $(strip \
+      $(call recursive_call,subst_paired, \
+        %module%=$(_m) \
+        %package%=$(_deb_pkgname) \
+        %version%=$(lastword $(subst :, ,$(_deb_version))) \
+        , \
+        $(_p) \
+      ) \
+    )) \
+  ) \
+  $(if $(dkms_$(_m)_debpath),,$(error debpath for $(_deb_pkgname) not specified.)) \
+  $(if $(filter arch=%,$(_params)), \
+    $(eval dkms_$(_m)_archs = $(patsubst arch=%,%,$(filter arch=%,$(_params)))) \
+    , \
+    $(eval dkms_$(_m)_archs = any) \
+  ) \
+  $(eval dkms_$(_m)_rprovides = $(patsubst rprovides=%,%,$(filter rprovides=%,$(_params)))) \
+  $(eval dkms_$(_m)_type = $(word 1,$(patsubst type=%,%,$(filter type=%,$(_params))) built-in)) \
+  $(eval all_$(dkms_$(_m)_type)_dkms_modules += $(_m)) \
+  $(if $(filter standalone,$(dkms_$(_m)_type)), \
+    $(eval dkms_$(_m)_pkg_name = linux-modules-$(_m)-$(abi_release)) \
+    $(eval dkms_$(_m)_subdir = ubuntu) \
+    , \
+    $(eval dkms_$(_m)_pkg_name = $(mods_pkg_name)) \
+    $(eval dkms_$(_m)_subdir = kernel) \
+  ) \
+)
--- linux-qcom-6.8.0.orig/debian/rules.d/1-maintainer.mk
+++ linux-qcom-6.8.0/debian/rules.d/1-maintainer.mk
@@ -0,0 +1,135 @@
+# The following targets are for the maintainer only! do not run if you don't
+# know what they do.
+
+.PHONY: help
+help:
+	@echo "These are the targets in addition to the normal $(DEBIAN) ones:"
+	@echo
+	@echo "  printenv            : Print some variables used in the build"
+	@echo "  updateconfigs       : Update core arch configs"
+	@echo "  defaultconfigs      : Update core arch configs using defaults"
+	@echo "  genconfigs          : Generate core arch configs in CONFIGS/*"
+	@echo "  editconfigs         : Edit core arch configs"
+	@echo "  printchanges        : Print the current changelog entries (from git)"
+	@echo "  insertchanges       : Insert current changelog entries (from git)"
+	@echo "  compileselftests    : Only compile the selftests listed on ubuntu_selftests variable"
+	@echo "  runselftests        : Run the selftests listed on ubuntu_selftests variable"
+	@echo
+	@echo "Environment variables:"
+	@echo
+	@echo "  CONCURRENCY_LEVEL=X : Use -jX for kernel compile"
+
+.PHONY: printdebian
+printdebian:
+	@echo "$(DEBIAN)"
+
+configs-targets := updateconfigs defaultconfigs genconfigs editconfigs
+
+.PHONY: $(configs-targets)
+$(configs-targets):
+	dh_testdir
+	kmake='$(kmake)' skip_checks=$(do_skip_checks) conc_level=$(conc_level) \
+		$(SHELL) $(DROOT)/scripts/misc/kernelconfig $@
+
+.PHONY: printenv
+printenv:
+	@dh_testdir
+	@echo "src_pkg_name              = $(src_pkg_name)"
+	@echo "series                    = $(series)"
+	@echo "release                   = $(release)"
+	@echo "revision                  = $(revision)"
+	@echo "uploadnum                 = $(uploadnum)"
+	@echo "prev_revision             = $(prev_revision)"
+	@echo "abinum                    = $(abinum)"
+	@echo "upstream_tag              = $(upstream_tag)"
+	@echo "flavours                  = $(flavours)"
+	@echo "bin_pkg_name              = $(bin_pkg_name)"
+	@echo "hdr_pkg_name              = $(hdrs_pkg_name)"
+	@echo "rust_pkg_name             = $(rust_pkg_name)"
+	@echo "ubuntu_selftests          = $(ubuntu_selftests)"
+	@echo "arch                      = $(arch)"
+	@echo "kmake                     = $(kmake)"
+	@echo
+	@echo "CONCURRENCY_LEVEL         = $(CONCURRENCY_LEVEL)"
+	@echo "DEB_HOST_GNU_TYPE         = $(DEB_HOST_GNU_TYPE)"
+	@echo "DEB_BUILD_GNU_TYPE        = $(DEB_BUILD_GNU_TYPE)"
+	@echo "DEB_HOST_ARCH             = $(DEB_HOST_ARCH)"
+	@echo "DEB_BUILD_ARCH            = $(DEB_BUILD_ARCH)"
+	@echo
+	@echo "any_signed                = $(any_signed)"
+	@echo " uefi_signed              = $(uefi_signed)"
+	@echo " opal_signed              = $(opal_signed)"
+	@echo " sipl_signed              = $(sipl_signed)"
+	@echo
+	@echo "do_skip_checks            = $(do_skip_checks)"
+	@echo "do_full_build             = $(do_full_build)"
+	@echo "do_mainline_build         = $(do_mainline_build)"
+	@echo "do_dbgsym_package         = $(do_dbgsym_package)"
+	@echo "do_dtbs                   = $(do_dtbs)"
+	@echo "do_source_package         = $(do_source_package)"
+	@echo "do_source_package_content = $(do_source_package_content)"
+	@echo "do_extras_package         = $(do_extras_package)"
+	@echo "do_flavour_image_package  = $(do_flavour_image_package)"
+	@echo "do_flavour_header_package = $(do_flavour_header_package)"
+	@echo "do_common_headers_indep   = $(do_common_headers_indep)"
+	@echo "do_lib_rust               = $(do_lib_rust)"
+	@echo "do_tools                  = $(do_tools)"
+	@echo "do_tools_common           = $(do_tools_common)"
+	@echo "do_any_tools              = $(do_any_tools)"
+	@echo "do_linux_tools            = $(do_linux_tools)"
+	@echo " do_tools_acpidbg         = $(do_tools_acpidbg)"
+	@echo " do_tools_bpftool         = $(do_tools_bpftool)"
+	@echo " do_tools_cpupower        = $(do_tools_cpupower)"
+	@echo " do_tools_host            = $(do_tools_host)"
+	@echo " do_tools_perf            = $(do_tools_perf)"
+	@echo " do_tools_perf_jvmti      = $(do_tools_perf_jvmti)"
+	@echo " do_tools_perf_python     = $(do_tools_perf_python)"
+	@echo " do_tools_usbip           = $(do_tools_usbip)"
+	@echo " do_tools_x86             = $(do_tools_x86)"
+	@echo "do_cloud_tools            = $(do_cloud_tools)"
+	@echo " do_tools_hyperv          = $(do_tools_hyperv)"
+	@echo
+	@echo "all_dkms_modules          = $(all_dkms_modules)"
+	@$(foreach mod,$(all_dkms_modules),$(foreach var,$(do_$(mod)),\
+		printf " %-24s = %s\n" "do_$(mod)" "$(var)";))
+
+.PHONY: printchanges
+printchanges:
+	@baseCommit=$$(git log --pretty=format:'%H %s' | \
+		gawk '/UBUNTU: '".*Ubuntu-.*`echo $(prev_fullver) | sed 's/+/\\\\+/'`"'(~.*)?$$/ { print $$1; exit }'); \
+	if [ -z "$$baseCommit" ]; then \
+		echo "WARNING: couldn't find a commit for the previous version. Using the lastest one." >&2; \
+		baseCommit=$$(git log --pretty=format:'%H %s' | \
+			gawk '/UBUNTU:\s*Ubuntu-.*$$/ { print $$1; exit }'); \
+	fi; \
+	git log "$$baseCommit"..HEAD | \
+	$(DROOT)/scripts/misc/git-ubuntu-log
+
+.PHONY: insertchanges
+insertchanges: autoreconstruct finalchecks
+	$(DROOT)/scripts/misc/insert-changes $(DROOT) $(DEBIAN)
+
+.PHONY: autoreconstruct
+autoreconstruct:
+	# No need for reconstruct for -rc kernels since we don't upload an
+	# orig tarball, so just remove it.
+	if grep -q "^EXTRAVERSION = -rc[0-9]\+$$" Makefile; then \
+		echo "exit 0" >$(DEBIAN)/reconstruct; \
+	else \
+		$(DROOT)/scripts/misc/gen-auto-reconstruct $(upstream_tag) $(DEBIAN)/reconstruct $(DROOT)/source/options; \
+	fi
+
+.PHONY: finalchecks
+finalchecks: debian/control
+	$(DROOT)/scripts/checks/final-checks "$(DEBIAN)" "$(prev_fullver)" $(do_skip_checks)
+
+.PHONY: compileselftests
+compileselftests:
+	# a loop is needed here to fail on errors
+	for test in $(ubuntu_selftests); do \
+		$(kmake) -C tools/testing/selftests TARGETS="$$test"; \
+	done;
+
+.PHONY: runselftests
+runselftests:
+	$(kmake) -C tools/testing/selftests TARGETS="$(ubuntu_selftests)" run_tests
--- linux-qcom-6.8.0.orig/debian/rules.d/2-binary-arch.mk
+++ linux-qcom-6.8.0/debian/rules.d/2-binary-arch.mk
@@ -0,0 +1,803 @@
+# We don't want make removing intermediary stamps
+.SECONDARY :
+
+# TODO this is probably wrong, and should be using $(DEB_HOST_MULTIARCH)
+shlibdeps_opts = $(if $(CROSS_COMPILE),-- -l$(CROSS_COMPILE:%-=/usr/%)/lib)
+
+debian/scripts/fix-filenames: debian/scripts/fix-filenames.c
+	$(HOSTCC) $^ -o $@
+
+$(stampdir)/stamp-prepare-%: config-prepare-check-%
+	@echo Debug: $@
+	$(stamp)
+
+$(stampdir)/stamp-prepare-tree-%: target_flavour = $*
+$(stampdir)/stamp-prepare-tree-%: debian/scripts/fix-filenames
+	@echo Debug: $@
+	install -d $(builddir)/build-$*
+	touch $(builddir)/build-$*/ubuntu-build
+	python3 debian/scripts/misc/annotations --export --arch $(arch) --flavour $(target_flavour) > $(builddir)/build-$*/.config
+	sed -i 's/.*CONFIG_VERSION_SIGNATURE.*/CONFIG_VERSION_SIGNATURE="Ubuntu $(release)-$(revision)-$* $(raw_kernelversion)"/' $(builddir)/build-$*/.config
+	find $(builddir)/build-$* -name "*.ko" | xargs rm -f
+	$(kmake) O=$(builddir)/build-$* $(conc_level) rustavailable || true
+	$(kmake) O=$(builddir)/build-$* $(conc_level) olddefconfig
+	$(stamp)
+
+# Used by developers as a shortcut to prepare a tree for compilation.
+prepare-%: $(stampdir)/stamp-prepare-%
+	@echo Debug: $@
+# Used by developers to allow efficient pre-building without fakeroot.
+build-%: $(stampdir)/stamp-install-%
+	@echo Debug: $@
+
+# Do the actual build, including image and modules
+$(stampdir)/stamp-build-%: target_flavour = $*
+$(stampdir)/stamp-build-%: bldimg = $(call custom_override,build_image,$*)
+$(stampdir)/stamp-build-%: $(stampdir)/stamp-prepare-%
+	@echo Debug: $@ build_image $(build_image) bldimg $(bldimg)
+	$(kmake) O=$(builddir)/build-$* $(conc_level) $(bldimg) modules $(if $(filter true,$(do_dtbs)),dtbs)
+
+ifeq ($(do_dbgsym_package),true)
+	# The target scripts_gdb is part of "all", so we need to call it manually
+	if grep -q CONFIG_GDB_SCRIPTS=y $(builddir)/build-$*/.config; then \
+		$(kmake) O=$(builddir)/build-$* $(conc_level) scripts_gdb ; \
+	fi
+endif
+
+	# Collect the list of kernel source files used for this build. Need to do this early before
+	# modules are stripped. Fail if the resulting file is empty.
+	find $(builddir)/build-$* -name vmlinux -o -name \*.ko -exec dwarfdump -i {} \; | \
+		grep -E 'DW_AT_(call|decl)_file' | sed -n 's|.*\s/|/|p' | sort -u > \
+		$(builddir)/build-$*/sources.list
+	test -s $(builddir)/build-$*/sources.list
+
+	$(stamp)
+
+define build_dkms_sign =
+	$(shell set -x; if grep -q CONFIG_MODULE_SIG=y $(1)/.config; then
+			echo $(1)/scripts/sign-file $(MODHASHALGO) $(MODSECKEY) $(MODPUBKEY);
+		else
+			echo "-";
+		fi
+	)
+endef
+define build_dkms =
+	rc=0; unset MAKEFLAGS; ARCH=$(build_arch) CROSS_COMPILE=$(CROSS_COMPILE) $(SHELL) $(DROOT)/scripts/dkms-build $(dkms_dir) $(abi_release)-$* '$(call build_dkms_sign,$(builddir)/build-$*)' $(1) $(2) $(3) $(4) $(5) || rc=$$?; if [ "$$rc" = "9" -o "$$rc" = "77" ]; then echo do_$(4)_$*=false >> $(builddir)/skipped-dkms.mk; rc=0; fi; if [ "$$rc" != "0" ]; then exit $$rc; fi
+endef
+
+define install_control =
+	for which in $(3);							\
+	do									\
+		template="$(DROOT)/templates/$(2).$$which.in";			\
+		script="$(DROOT)/$(1).$$which";					\
+		sed -e 's/@abiname@/$(abi_release)/g'				\
+		    -e 's/@localversion@/-$*/g'					\
+		    -e 's/@image-stem@/$(instfile)/g'				\
+			<"$$template" >"$$script";				\
+	done
+endef
+
+# Ensure the directory prefix is exactly 140 characters long so pathnames are the
+# exact same length in any binary files produced by the builds.  These will be
+# commonised later.
+dkms_20d=....................
+dkms_140d=$(dkms_20d)$(dkms_20d)$(dkms_20d)$(dkms_20d)$(dkms_20d)$(dkms_20d)$(dkms_20d)
+dkms_140c=$(shell echo '$(dkms_140d)' | sed -e 's/\./_/g')
+define dkms_dir_prefix =
+$(shell echo $(1)/$(dkms_140c) | \
+	sed -e 's/\($(dkms_140d)\).*/\1/' -e 's/^\(.*\)....$$/\1dkms/')
+endef
+
+# Install the finished build
+$(stampdir)/stamp-install-%: pkgdir_bin = $(CURDIR)/debian/$(bin_pkg_name)-$*
+$(stampdir)/stamp-install-%: pkgdir = $(CURDIR)/debian/$(mods_pkg_name)-$*
+$(stampdir)/stamp-install-%: pkgdir_ex = $(CURDIR)/debian/$(mods_extra_pkg_name)-$*
+$(stampdir)/stamp-install-%: pkgdir_bldinfo = $(CURDIR)/debian/$(bldinfo_pkg_name)-$*
+$(stampdir)/stamp-install-%: bindoc = $(pkgdir)/usr/share/doc/$(bin_pkg_name)-$*
+$(stampdir)/stamp-install-%: dbgpkgdir = $(CURDIR)/debian/$(bin_pkg_name)-$*-dbgsym
+$(stampdir)/stamp-install-%: signingv = $(CURDIR)/debian/$(bin_pkg_name)-signing/$(release)-$(revision)
+$(stampdir)/stamp-install-%: toolspkgdir = $(CURDIR)/debian/$(tools_flavour_pkg_name)-$*
+$(stampdir)/stamp-install-%: cloudpkgdir = $(CURDIR)/debian/$(cloud_flavour_pkg_name)-$*
+$(stampdir)/stamp-install-%: basepkg = $(hdrs_pkg_name)
+$(stampdir)/stamp-install-%: baserustpkg = $(rust_pkg_name)
+$(stampdir)/stamp-install-%: indeppkg = $(indep_hdrs_pkg_name)
+$(stampdir)/stamp-install-%: kernfile = $(call custom_override,kernel_file,$*)
+$(stampdir)/stamp-install-%: instfile = $(call custom_override,install_file,$*)
+$(stampdir)/stamp-install-%: hdrdir = $(CURDIR)/debian/$(basepkg)-$*/usr/src/$(basepkg)-$*
+$(stampdir)/stamp-install-%: rustdir = $(CURDIR)/debian/$(baserustpkg)-$*/usr/src/$(baserustpkg)-$*
+$(stampdir)/stamp-install-%: target_flavour = $*
+$(stampdir)/stamp-install-%: MODHASHALGO=sha512
+$(stampdir)/stamp-install-%: MODSECKEY=$(builddir)/build-$*/certs/signing_key.pem
+$(stampdir)/stamp-install-%: MODPUBKEY=$(builddir)/build-$*/certs/signing_key.x509
+$(stampdir)/stamp-install-%: build_dir=$(builddir)/build-$*
+$(stampdir)/stamp-install-%: dkms_dir=$(call dkms_dir_prefix,$(builddir)/build-$*)
+$(foreach _m,$(all_dkms_modules), \
+  $(eval $$(stampdir)/stamp-install-%: enable_$(_m) = $$(filter true,$$(call custom_override,do_$(_m),$$*))) \
+  $(eval $$(stampdir)/stamp-install-%: dkms_$(_m)_pkgdir = $$(CURDIR)/debian/$(dkms_$(_m)_pkg_name)-$$*) \
+)
+$(stampdir)/stamp-install-%: dbgpkgdir_dkms = $(if $(filter true,$(do_dbgsym_package)),$(dbgpkgdir)/usr/lib/debug/lib/modules/$(abi_release)-$*/kernel,"")
+$(stampdir)/stamp-install-%: $(stampdir)/stamp-build-% $(stampdir)/stamp-install-headers
+	@echo Debug: $@ kernel_file $(kernel_file) kernfile $(kernfile) install_file $(install_file) instfile $(instfile)
+	dh_testdir
+	dh_prep -p$(bin_pkg_name)-$*
+	dh_prep -p$(mods_pkg_name)-$*
+	dh_prep -p$(hdrs_pkg_name)-$*
+ifeq ($(do_lib_rust),true)
+	dh_prep -p$(rust_pkg_name)-$*
+endif
+	$(foreach _m,$(all_standalone_dkms_modules), \
+	  $(if $(enable_$(_m)),dh_prep -p$(dkms_$(_m)_pkg_name)-$*;)\
+	)
+ifeq ($(do_dbgsym_package),true)
+	dh_prep -p$(bin_pkg_name)-$*-dbgsym
+endif
+ifeq ($(do_extras_package),true)
+	dh_prep -p$(mods_extra_pkg_name)-$*
+endif
+
+	# The main image
+	# compress_file logic required because not all architectures
+	# generate a zImage automatically out of the box
+ifeq ($(compress_file),)
+	install -m600 -D $(builddir)/build-$*/$(kernfile) \
+		$(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$*
+else
+	install -d $(pkgdir_bin)/boot
+	gzip -c9v $(builddir)/build-$*/$(kernfile) > \
+		$(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$*
+	chmod 600 $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$*
+endif
+	install -d $(pkgdir)/boot
+	install -m644 $(builddir)/build-$*/.config \
+		$(pkgdir)/boot/config-$(abi_release)-$*
+	install -m600 $(builddir)/build-$*/System.map \
+		$(pkgdir)/boot/System.map-$(abi_release)-$*
+
+ifeq ($(do_dtbs),true)
+	$(kmake) O=$(builddir)/build-$* $(conc_level) dtbs_install \
+		INSTALL_DTBS_PATH=$(pkgdir)/lib/firmware/$(abi_release)-$*/device-tree
+endif
+
+ifeq ($(no_dumpfile),)
+	makedumpfile -g $(pkgdir)/boot/vmcoreinfo-$(abi_release)-$* \
+		-x $(builddir)/build-$*/vmlinux
+	chmod 0600 $(pkgdir)/boot/vmcoreinfo-$(abi_release)-$*
+endif
+
+	$(kmake) O=$(builddir)/build-$* $(conc_level) modules_install $(vdso) \
+		INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=$(pkgdir)
+
+	#
+	# Build module blacklists:
+	#  - blacklist all watchdog drivers (LP:1432837)
+	#
+	install -d $(pkgdir)/lib/modprobe.d
+	echo "# Kernel supplied blacklist for $(src_pkg_name) $(abi_release)-$* $(arch)" \
+		>$(pkgdir)/lib/modprobe.d/blacklist_$(src_pkg_name)_$(abi_release)-$*.conf
+	for conf in $(arch)-$* $(arch) common.conf; do \
+		if [ -f $(DEBIAN)/modprobe.d/$$conf ]; then \
+			echo "# modprobe.d/$$conf"; \
+			cat $(DEBIAN)/modprobe.d/$$conf; \
+		fi; \
+	done >>$(pkgdir)/lib/modprobe.d/blacklist_$(src_pkg_name)_$(abi_release)-$*.conf
+	echo "# Autogenerated watchdog blacklist" \
+		>>$(pkgdir)/lib/modprobe.d/blacklist_$(src_pkg_name)_$(abi_release)-$*.conf
+	ls -1 $(pkgdir)/lib/modules/$(abi_release)-$*/kernel/drivers/watchdog/ | \
+		grep -v '^bcm2835_wdt$$' | \
+		sed -e 's/^/blacklist /' -e 's/.ko$$//' | \
+		sort -u \
+		>>$(pkgdir)/lib/modprobe.d/blacklist_$(src_pkg_name)_$(abi_release)-$*.conf
+
+ifeq ($(do_extras_package),true)
+	#
+	# Remove all modules not in the inclusion list.
+	#
+	if [ -f $(DEBIAN)/control.d/$(target_flavour).inclusion-list ] ; then \
+		/sbin/depmod -v -b $(pkgdir) $(abi_release)-$* | \
+			sed -e "s@$(pkgdir)/lib/modules/$(abi_release)-$*/kernel/@@g" | \
+			awk '{ print $$1 " " $$NF}' >$(build_dir)/module-inclusion.depmap; \
+		mkdir -p $(pkgdir_ex)/lib/modules/$(abi_release)-$*; \
+		mv $(pkgdir)/lib/modules/$(abi_release)-$*/kernel \
+			$(pkgdir_ex)/lib/modules/$(abi_release)-$*/kernel; \
+		$(SHELL) $(DROOT)/scripts/module-inclusion --master \
+			$(pkgdir_ex)/lib/modules/$(abi_release)-$*/kernel \
+			$(pkgdir)/lib/modules/$(abi_release)-$*/kernel \
+			$(DEBIAN)/control.d/$(target_flavour).inclusion-list \
+			$(build_dir)/module-inclusion.depmap 2>&1 | \
+				tee $(target_flavour).inclusion-list.log; \
+		/sbin/depmod -b $(pkgdir) -ea -F $(pkgdir)/boot/System.map-$(abi_release)-$* \
+			$(abi_release)-$* 2>&1 |tee $(target_flavour).depmod.log; \
+		if [ `grep -c 'unknown symbol' $(target_flavour).depmod.log` -gt 0 ]; then \
+			echo "EE: Unresolved module dependencies in base package!"; \
+			exit 1; \
+		fi \
+	fi
+endif
+
+ifeq ($(no_dumpfile),)
+	makedumpfile -g $(pkgdir)/boot/vmcoreinfo-$(abi_release)-$* \
+		-x $(builddir)/build-$*/vmlinux
+	chmod 0600 $(pkgdir)/boot/vmcoreinfo-$(abi_release)-$*
+endif
+	rm -f $(pkgdir)/lib/modules/$(abi_release)-$*/build
+	rm -f $(pkgdir)/lib/modules/$(abi_release)-$*/source
+
+	# Some initramfs-tools specific modules
+	install -d $(pkgdir)/lib/modules/$(abi_release)-$*/initrd
+	if [ -f $(pkgdir)/lib/modules/$(abi_release)-$*/kernel/drivers/video/vesafb.ko ]; then\
+	  $(LN) $(pkgdir)/lib/modules/$(abi_release)-$*/kernel/drivers/video/vesafb.ko \
+		$(pkgdir)/lib/modules/$(abi_release)-$*/initrd/; \
+	fi
+
+	echo "interest linux-update-$(abi_release)-$*" >"$(DROOT)/$(bin_pkg_name)-$*.triggers"
+	install -d $(pkgdir_bin)/usr/lib/linux/triggers
+	$(call install_control,$(bin_pkg_name)-$*,image,postinst postrm preinst prerm)
+	install -d $(pkgdir)/usr/lib/linux/triggers
+	$(call install_control,$(mods_pkg_name)-$*,extra,postinst postrm)
+ifeq ($(do_extras_package),true)
+	# Install the postinit/postrm scripts in the extras package.
+	if [ -f $(DEBIAN)/control.d/$(target_flavour).inclusion-list ] ; then	\
+		install -d $(pkgdir_ex)/usr/lib/linux/triggers; \
+		$(call install_control,$(mods_extra_pkg_name)-$*,extra,postinst postrm); \
+	fi
+endif
+	$(foreach _m,$(all_standalone_dkms_modules), \
+	  $(if $(enable_$(_m)), \
+	    install -d $(dkms_$(_m)_pkgdir)/usr/lib/linux/triggers; \
+	    $(call install_control,$(dkms_$(_m)_pkg_name)-$*,extra,postinst postrm); \
+	  ) \
+	)
+
+ifeq ($(do_dbgsym_package),true)
+	# Debug image is simple
+	install -m644 -D $(builddir)/build-$*/vmlinux \
+		$(dbgpkgdir)/usr/lib/debug/boot/vmlinux-$(abi_release)-$*
+	if [ -d $(builddir)/build-$*/scripts/gdb/linux ]; then \
+		install -m644 -D $(builddir)/build-$*/vmlinux-gdb.py \
+			$(dbgpkgdir)/usr/share/gdb/auto-load/boot/vmlinux-$(abi_release)-$*/vmlinuz-$(abi_release)-$*-gdb.py; \
+		install -m644 -D $(builddir)/build-$*/scripts/gdb/linux/* \
+			--target-directory=$(dbgpkgdir)/usr/share/gdb/auto-load/boot/vmlinux-$(abi_release)-$*/scripts/gdb/linux; \
+	fi
+	$(kmake) O=$(builddir)/build-$* modules_install $(vdso) \
+		INSTALL_MOD_PATH=$(dbgpkgdir)/usr/lib/debug
+	# Add .gnu_debuglink sections only after all/DKMS modules are built.
+	rm -f $(dbgpkgdir)/usr/lib/debug/lib/modules/$(abi_release)-$*/build
+	rm -f $(dbgpkgdir)/usr/lib/debug/lib/modules/$(abi_release)-$*/source
+	rm -f $(dbgpkgdir)/usr/lib/debug/lib/modules/$(abi_release)-$*/modules.*
+	rm -fr $(dbgpkgdir)/usr/lib/debug/lib/firmware
+endif
+ifeq ($(do_tools_bpftool),true)
+	cp $(builddir)/build-$*/vmlinux tools/bpf/bpftool/
+endif
+
+	# The flavour specific headers image
+	# TODO: Would be nice if we didn't have to dupe the original builddir
+	install -d -m755 $(hdrdir)
+	cp $(builddir)/build-$*/.config $(hdrdir)
+	chmod 644 $(hdrdir)/.config
+	$(kmake) O=$(hdrdir) -j1 syncconfig prepare scripts
+	# Makefile may need per-arch-flavour CC settings, which are
+	# normally set via $(kmake) during build
+	rm -f $(hdrdir)/Makefile
+	cp -a $(indep_hdrdir)/Makefile $(hdrdir)/Makefile
+	sed -i 's|\(^HOSTCC	= \)gcc$$|\1$(gcc)|' $(hdrdir)/Makefile
+	sed -i 's|\(^CC		= $$(CROSS_COMPILE)\)gcc$$|\1$(gcc)|' $(hdrdir)/Makefile
+	# Quick check for successful substitutions
+	grep '^HOSTCC	.*$(gcc)$$' $(hdrdir)/Makefile
+	grep '^CC	.*$(gcc)$$' $(hdrdir)/Makefile
+	rm -rf $(hdrdir)/include2 $(hdrdir)/source
+	# Copy over the compilation version.
+	cp "$(builddir)/build-$*/include/generated/compile.h" \
+		"$(hdrdir)/include/generated/compile.h"
+	# Add UTS_UBUNTU_RELEASE_ABI since UTS_RELEASE is difficult to parse.
+	echo "#define UTS_UBUNTU_RELEASE_ABI $(abinum)" >> $(hdrdir)/include/generated/utsrelease.h
+	# powerpc kernel arch seems to need some .o files for external module linking. Add them in.
+ifeq ($(build_arch),powerpc)
+	mkdir -p $(hdrdir)/arch/powerpc/lib
+	cp $(builddir)/build-$*/arch/powerpc/lib/*.o $(hdrdir)/arch/powerpc/lib
+endif
+ifeq ($(build_arch),s390)
+	if [ -n "$$(find $(builddir)/build-$*/arch/s390/lib/expoline -maxdepth 1 -name '*.o' -print -quit)" ]; then \
+		mkdir -p $(hdrdir)/arch/s390/lib/expoline/; \
+		cp $(builddir)/build-$*/arch/s390/lib/expoline/*.o $(hdrdir)/arch/s390/lib/expoline/; \
+	fi
+endif
+	# Copy over scripts/module.lds for building external modules
+	cp $(builddir)/build-$*/scripts/module.lds $(hdrdir)/scripts
+	# Script to symlink everything up
+	$(SHELL) $(DROOT)/scripts/link-headers "$(hdrdir)" "$(indeppkg)" "$*"
+	# The build symlink
+	install -d debian/$(basepkg)-$*/lib/modules/$(abi_release)-$*
+	$(LN) /usr/src/$(basepkg)-$* \
+		debian/$(basepkg)-$*/lib/modules/$(abi_release)-$*/build
+	# And finally the symvers
+	install -m644 $(builddir)/build-$*/Module.symvers \
+		$(hdrdir)/Module.symvers
+
+	# Now the header scripts
+	$(call install_control,$(hdrs_pkg_name)-$*,headers,postinst)
+
+	# At the end of the package prep, call the tests
+	DPKG_ARCH="$(arch)" KERN_ARCH="$(build_arch)" FLAVOUR="$*"	\
+	 VERSION="$(abi_release)" REVISION="$(revision)"		\
+	 PREV_REVISION="$(prev_revision)" ABI_NUM="$(abinum)"		\
+	 PREV_ABI_NUM="$(prev_abinum)" BUILD_DIR="$(builddir)/build-$*"	\
+	 INSTALL_DIR="$(pkgdir)" SOURCE_DIR="$(CURDIR)"			\
+	 run-parts -v $(DROOT)/tests-build
+
+	#
+	# Remove files which are generated at installation by postinst,
+	# except for modules.order and modules.builtin
+	#
+	# NOTE: need to keep this list in sync with postrm
+	#
+	mkdir $(pkgdir)/lib/modules/$(abi_release)-$*/_
+	mv $(pkgdir)/lib/modules/$(abi_release)-$*/modules.order \
+		$(pkgdir)/lib/modules/$(abi_release)-$*/_
+	if [ -f $(pkgdir)/lib/modules/$(abi_release)-$*/modules.builtin ] ; then \
+	    mv $(pkgdir)/lib/modules/$(abi_release)-$*/modules.builtin \
+		$(pkgdir)/lib/modules/$(abi_release)-$*/_; \
+	fi
+	if [ -f $(pkgdir)/lib/modules/$(abi_release)-$*/modules.builtin.modinfo ] ; then \
+	    mv $(pkgdir)/lib/modules/$(abi_release)-$*/modules.builtin.modinfo \
+		$(pkgdir)/lib/modules/$(abi_release)-$*/_; \
+	fi
+	rm -f $(pkgdir)/lib/modules/$(abi_release)-$*/modules.*
+	mv $(pkgdir)/lib/modules/$(abi_release)-$*/_/* \
+		$(pkgdir)/lib/modules/$(abi_release)-$*
+	rmdir $(pkgdir)/lib/modules/$(abi_release)-$*/_
+
+ifeq ($(do_linux_tools),true)
+	# Create the linux-tools tool links
+	install -d $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+ifeq ($(do_tools_usbip),true)
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/usbip $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/usbipd $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+endif
+ifeq ($(do_tools_acpidbg),true)
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/acpidbg $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+endif
+ifeq ($(do_tools_cpupower),true)
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/cpupower $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+endif
+ifeq ($(do_tools_rtla),true)
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/rtla $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+endif
+ifeq ($(do_tools_perf),true)
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/perf $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+ifeq ($(do_tools_perf_jvmti),true)
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/libperf-jvmti.so $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+endif
+ifeq ($(do_tools_perf_python),true)
+	# Link the subdirectory that contains the .so rather than the file itself. Its name is
+	# pseudo-random and can't be determined easily and reliably.
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/lib $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+endif
+endif
+ifeq ($(do_tools_bpftool),true)
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/bpftool $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+endif
+ifeq ($(do_tools_x86),true)
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/x86_energy_perf_policy $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/turbostat $(toolspkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+endif
+endif
+ifeq ($(do_cloud_tools),true)
+ifeq ($(do_tools_hyperv),true)
+	# Create the linux-hyperv tool links
+	install -d $(cloudpkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/hv_kvp_daemon $(cloudpkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/hv_vss_daemon $(cloudpkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/hv_fcopy_daemon $(cloudpkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+	$(LN) ../../$(src_pkg_name)-tools-$(abi_release)/lsvmbus $(cloudpkgdir)/usr/lib/linux-tools/$(abi_release)-$*
+endif
+endif
+
+	# Build a temporary "installed headers" directory.
+	install -d $(dkms_dir) $(dkms_dir)/headers $(dkms_dir)/build $(dkms_dir)/source
+	cp -rp "$(hdrdir)" "$(indep_hdrdir)" "$(dkms_dir)/headers"
+
+	$(foreach _m,$(all_dkms_modules), \
+	  $(if $(enable_$(_m)), \
+	    $(call build_dkms,$(dkms_$(_m)_pkg_name)-$*,$(dkms_$(_m)_pkgdir)/lib/modules/$(abi_release)-$*/$(dkms_$(_m)_subdir),$(dbgpkgdir_dkms),$(_m),$(dkms_$(_m)_debpath)); \
+	  ) \
+	)
+
+
+ifeq ($(do_dbgsym_package),true)
+	# Add .gnu_debuglink sections to each stripped .ko
+	# pointing to unstripped verson
+	find $(pkgdir) \
+	  $(if $(filter true,$(do_extras_package)),$(pkgdir_ex)) \
+	  -name '*.ko' | while read path_module ; do \
+		module="/lib/modules/$${path_module#*/lib/modules/}"; \
+		if [[ -f "$(dbgpkgdir)/usr/lib/debug/$$module" ]] ; then \
+			while IFS= read -r -d '' signature < <(tail -c 28 "$$path_module"); do \
+				break; \
+			done; \
+			$(CROSS_COMPILE)objcopy \
+				--add-gnu-debuglink=$(dbgpkgdir)/usr/lib/debug/$$module \
+				$$path_module; \
+			if grep -q CONFIG_MODULE_SIG=y $(builddir)/build-$*/.config && \
+			   [ "$$signature" = $$'~Module signature appended~\n' ]; then \
+				$(builddir)/build-$*/scripts/sign-file $(MODHASHALGO) \
+					$(MODSECKEY) \
+					$(MODPUBKEY) \
+					$$path_module; \
+			fi; \
+		else \
+			echo "WARNING: Missing debug symbols for module '$$module'."; \
+		fi; \
+	done
+endif
+
+	# Build the final ABI information.
+	install -d $(abidir)
+	sed -e 's/^\(.\+\)[[:space:]]\+\(.\+\)[[:space:]]\(.\+\)$$/\3 \2 \1/'	\
+		$(builddir)/build-$*/Module.symvers | sort > $(abidir)/$*
+
+	# Build the final ABI modules information.
+	find $(pkgdir_bin) $(pkgdir) $(pkgdir_ex) \( -name '*.ko' -o -name '*.ko.*' \) | \
+		sed -e 's/.*\/\([^\/]*\)\.ko.*/\1/' | sort > $(abidir)/$*.modules
+
+	# Build the final ABI built-in modules information.
+	if [ -f $(pkgdir)/lib/modules/$(abi_release)-$*/modules.builtin ] ; then \
+		sed -e 's/.*\/\([^\/]*\)\.ko/\1/' $(pkgdir)/lib/modules/$(abi_release)-$*/modules.builtin | \
+			sort > $(abidir)/$*.modules.builtin; \
+	fi
+
+	# Build the final ABI firmware information.
+	find $(pkgdir_bin) $(pkgdir) $(pkgdir_ex) -name \*.ko | \
+	while read ko; do \
+		/sbin/modinfo $$ko | grep ^firmware || true; \
+	done | sort -u >$(abidir)/$*.fwinfo
+
+	# Build the final ABI built-in firmware information.
+	if [ -f $(pkgdir)/lib/modules/$(abi_release)-$*/modules.builtin.modinfo ] ; then \
+		cat $(pkgdir)/lib/modules/$(abi_release)-$*/modules.builtin.modinfo | \
+			tr '\0' '\n' | sed -n 's/^.*firmware=/firmware: /p' | \
+			sort -u > $(abidir)/$*.fwinfo.builtin; \
+	fi
+
+	# Build the final ABI compiler information.
+	ko=$$(find $(pkgdir_bin) $(pkgdir) $(pkgdir_ex) -name \*.ko | head -1); \
+	readelf -p .comment "$$ko" | gawk ' \
+		($$1 == "[") { \
+			printf("%s", $$3); \
+			for (n=4; n<=NF; n++) { \
+				printf(" %s", $$n); \
+			} \
+			print "" \
+		}' | sort -u >$(abidir)/$*.compiler
+
+	# Build the buildinfo package content.
+	install -d $(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*
+	install -m644 $(builddir)/build-$*/.config \
+		$(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/config
+	install -m644 $(abidir)/$* \
+		$(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/abi
+	install -m644 $(abidir)/$*.modules \
+		$(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/modules
+	install -m644 $(abidir)/$*.fwinfo \
+		$(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/fwinfo
+	install -m644 $(abidir)/$*.compiler \
+		$(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/compiler
+	if [ -f $(abidir)/$*.modules.builtin ] ; then \
+		install -m644 $(abidir)/$*.modules.builtin \
+			$(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/modules.builtin; \
+	fi
+	if [ -f $(abidir)/$*.fwinfo.builtin ] ; then \
+		install -m644 $(abidir)/$*.fwinfo.builtin \
+			$(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/fwinfo.builtin; \
+	fi
+	install -m644 $(DROOT)/canonical-certs.pem $(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/canonical-certs.pem
+	install -m644 $(DROOT)/canonical-revoked-certs.pem $(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/canonical-revoked-certs.pem
+	# List of source files used for this build
+	install -m644 $(builddir)/build-$*/sources.list $(pkgdir_bldinfo)/usr/lib/linux/$(abi_release)-$*/sources
+
+	# Get rid of .o and .cmd artifacts in headers
+	find $(hdrdir) -name \*.o -or -name \*.cmd -exec rm -f {} \;
+	# Strip .so files (e.g., rust/libmacros.so) to reduce size even more
+	find $(hdrdir) -name libmacros.so -exec strip -s {} \;
+
+ifeq ($(do_lib_rust),true)
+	# Generate Rust lib files
+	install -d -m755 $(rustdir)
+	mv $(hdrdir)/rust $(rustdir)
+	# Generate symlink for Rust lib directory in headers
+	$(SHELL) $(DROOT)/scripts/link-lib-rust "$(hdrdir)" "$(indeppkg)" "$*"
+endif
+
+ifneq ($(do_full_build),false)
+	# Clean out this flavours build directory.
+	rm -rf $(builddir)/build-$*
+endif
+	$(call if_package, linux-libc-dev-$*, \
+		cp $(DEBIAN)/linux-libc-dev-$*.install debian/; \
+		dh_prep -p linux-libc-dev-$*; \
+		dh_install -p linux-libc-dev-$*)
+	$(stamp)
+
+headers_tmp := $(CURDIR)/debian/tmp-headers
+headers_dir := $(CURDIR)/debian/linux-libc-dev
+
+.PHONY: install-arch-headers
+install-arch-headers:
+	@echo Debug: $@
+	dh_testdir
+	dh_testroot
+	$(call if_package, linux-libc-dev, dh_prep -plinux-libc-dev)
+	rm -rf $(headers_tmp) $(headers_dir)
+	$(kmake) O=$(headers_tmp) INSTALL_HDR_PATH=$(headers_dir)/usr $(conc_level) headers_install
+	mkdir $(headers_dir)/usr/include/$(DEB_HOST_MULTIARCH)
+	mv $(headers_dir)/usr/include/asm $(headers_dir)/usr/include/$(DEB_HOST_MULTIARCH)/
+	rm -rf $(headers_tmp)
+
+define dh_all
+	dh_installchangelogs -p$(1)
+	dh_installdocs -p$(1)
+	dh_compress -p$(1)
+	# Compress kernel modules, on mantic+
+	$(if $(do_zstd_ko),find debian/$(1) -name '*.ko' -print0 | xargs -0 -n1 -P $(CONCURRENCY_LEVEL) -r zstd -19 --quiet --rm, true)
+	dh_fixperms -p$(1) -X/boot/
+	dh_shlibdeps -p$(1) $(shlibdeps_opts)
+	dh_installdeb -p$(1)
+	dh_installdebconf -p$(1)
+	$(lockme) dh_gencontrol -p$(1) -- -Vlinux:rprovides='$(rprovides)' $(2)
+	dh_md5sums -p$(1)
+	dh_builddeb -p$(1)
+endef
+define newline
+
+
+endef
+define dh_all_inline
+        $(subst ${newline},; \${newline},$(call dh_all,$(1),$(2)))
+endef
+
+.PHONY: binary-arch-headers
+binary-arch-headers: install-arch-headers
+	@echo Debug: $@
+	dh_testdir
+	dh_testroot
+	$(call if_package, linux-libc-dev, $(call dh_all,linux-libc-dev))
+
+-include $(builddir)/skipped-dkms.mk
+binary-%: pkgimg = $(bin_pkg_name)-$*
+binary-%: pkgimg_mods = $(mods_pkg_name)-$*
+binary-%: pkgimg_ex = $(mods_extra_pkg_name)-$*
+binary-%: pkgdir_ex = $(CURDIR)/debian/$(extra_pkg_name)-$*
+binary-%: pkgbldinfo = $(bldinfo_pkg_name)-$*
+binary-%: pkghdr = $(hdrs_pkg_name)-$*
+binary-%: pkgrust = $(rust_pkg_name)-$*
+binary-%: dbgpkg = $(bin_pkg_name)-$*-dbgsym
+binary-%: dbgpkgdir = $(CURDIR)/debian/$(bin_pkg_name)-$*-dbgsym
+binary-%: pkgtools = $(tools_flavour_pkg_name)-$*
+binary-%: pkgcloud = $(cloud_flavour_pkg_name)-$*
+$(foreach _m,$(all_dkms_modules), \
+  $(eval binary-%: enable_$(_m) = $$(filter true,$$(call custom_override,do_$(_m),$$*))) \
+)
+binary-%: rprovides = $(foreach _m,$(all_built-in_dkms_modules),$(if $(enable_$(_m)),$(foreach _r,$(dkms_$(_m)_rprovides),$(_r)$(comma) )))
+binary-%: target_flavour = $*
+binary-%: checks-%
+	@echo Debug: $@
+	dh_testdir
+	dh_testroot
+
+	$(call dh_all,$(pkgimg)) -- -Znone
+	$(call dh_all,$(pkgimg_mods))$(if $(do_zstd_ko), -- -Znone)
+
+ifeq ($(do_extras_package),true)
+  ifeq ($(ship_extras_package),false)
+	# If $(ship_extras_package) is explicitly set to false, then do not
+	# construct the linux-image-extra package; instead just log all of the
+	# "extra" modules which were pointlessly built yet won't be shipped.
+	find $(pkgdir_ex) -name '*.ko' | sort \
+		| sed 's|^$(pkgdir_ex)/|NOT-SHIPPED |' \
+		| tee -a $(target_flavour).not-shipped.log;
+  else
+	if [ -f $(DEBIAN)/control.d/$(target_flavour).inclusion-list ] ; then \
+		$(call dh_all_inline,$(pkgimg_ex))$(if $(do_zstd_ko), -- -Znone); \
+	fi
+  endif
+endif
+
+	$(foreach _m,$(all_standalone_dkms_modules), \
+	  $(if $(enable_$(_m)),$(call dh_all,$(dkms_$(_m)_pkg_name)-$*)$(if $(do_zstd_ko), -- -Znone);)\
+	)
+
+	$(call dh_all,$(pkgbldinfo))
+	$(call dh_all,$(pkghdr))
+ifeq ($(do_lib_rust),true)
+	$(call dh_all,$(pkgrust))
+endif
+
+ifeq ($(do_dbgsym_package),true)
+	$(call dh_all,$(dbgpkg)) -- -Zxz
+
+	# Hokay...here's where we do a little twiddling...
+	# Renaming the debug package prevents it from getting into
+	# the primary archive, and therefore prevents this very large
+	# package from being mirrored. It is instead, through some
+	# archive admin hackery, copied to http://ddebs.ubuntu.com.
+	#
+	mv ../$(dbgpkg)_$(release)-$(revision)_$(arch).deb \
+		../$(dbgpkg)_$(release)-$(revision)_$(arch).ddeb
+	$(lockme) sed -i '/^$(dbgpkg)_/s/\.deb /.ddeb /' debian/files
+	# Now, the package wont get into the archive, but it will get put
+	# into the debug system.
+
+	# Clean out the debugging package source directory.
+	rm -rf $(dbgpkgdir)
+endif
+
+ifeq ($(do_linux_tools),true)
+	$(call dh_all,$(pkgtools))
+endif
+ifeq ($(do_cloud_tools),true)
+	$(call dh_all,$(pkgcloud))
+endif
+ifeq ($(do_tools_bpftool),true)
+	$(call if_package, linux-bpf-dev, $(call dh_all,linux-bpf-dev))
+endif
+	$(call if_package, linux-libc-dev-$*, $(call dh_all,linux-libc-dev-$*))
+
+#
+# per-architecture packages
+#
+builddirpa = $(builddir)/tools-perarch
+
+$(stampdir)/stamp-prepare-perarch:
+	@echo Debug: $@
+ifeq ($(do_any_tools),true)
+	rm -rf $(builddirpa)
+	install -d $(builddirpa)
+	rsync -a --exclude debian --exclude debian.master --exclude $(DEBIAN) --exclude .git -a ./ $(builddirpa)/
+endif
+	$(stamp)
+
+$(stampdir)/stamp-build-perarch: $(stampdir)/stamp-prepare-perarch install-arch-headers build-arch
+	@echo Debug: $@
+ifeq ($(do_linux_tools),true)
+ifeq ($(do_tools_usbip),true)
+	chmod 755 $(builddirpa)/tools/usb/usbip/autogen.sh
+	cd $(builddirpa)/tools/usb/usbip && ./autogen.sh
+	chmod 755 $(builddirpa)/tools/usb/usbip/configure
+	cd $(builddirpa)/tools/usb/usbip && ./configure --prefix=$(builddirpa)/tools/usb/usbip/bin
+	cd $(builddirpa)/tools/usb/usbip && make install CFLAGS="-g -O2 -static" CROSS_COMPILE=$(CROSS_COMPILE)
+endif
+ifeq ($(do_tools_acpidbg),true)
+	cd $(builddirpa)/tools/power/acpi && make clean && make CFLAGS="-g -O2 -static -I$(builddirpa)/include" CROSS_COMPILE=$(CROSS_COMPILE) acpidbg
+endif
+ifeq ($(do_tools_rtla),true)
+	cd $(builddirpa)/tools/tracing/rtla && make clean && make CFLAGS='-g -O -Wall -I/usr/include/tracefs -I/usr/include/traceevent -DVERSION="\"6.8.1\""' static
+endif
+ifeq ($(do_tools_cpupower),true)
+	make -C $(builddirpa)/tools/power/cpupower \
+		CROSS_COMPILE=$(CROSS_COMPILE) \
+		CROSS=$(CROSS_COMPILE) \
+		STATIC=true \
+		CPUFREQ_BENCH=false
+endif
+ifeq ($(do_tools_perf),true)
+	cd $(builddirpa) && $(kmake) $(defconfig)
+	mv $(builddirpa)/.config $(builddirpa)/.config.old
+	sed -e 's/^# \(CONFIG_MODVERSIONS\) is not set$$/\1=y/' \
+	  -e 's/.*CONFIG_LOCALVERSION_AUTO.*/# CONFIG_LOCALVERSION_AUTO is not set/' \
+	  $(builddirpa)/.config.old > $(builddirpa)/.config
+	cd $(builddirpa) && $(kmake) syncconfig
+	cd $(builddirpa) && $(kmake) prepare
+	cd $(builddirpa)/tools/perf && \
+		$(kmake) prefix=/usr HAVE_CPLUS_DEMANGLE_SUPPORT=1 CROSS_COMPILE=$(CROSS_COMPILE) NO_LIBPERL=1 WERROR=0
+endif
+ifeq ($(do_tools_bpftool),true)
+	mv $(builddirpa)/tools/bpf/bpftool/vmlinux $(builddirpa)/vmlinux
+	$(kmake) CROSS_COMPILE=$(CROSS_COMPILE) -C $(builddirpa)/tools/bpf/bpftool
+ifneq ($(do_tools_bpftool_stub),true)
+	$(builddirpa)/tools/bpf/bpftool/bpftool btf dump file $(builddirpa)/vmlinux format c > $(builddirpa)/vmlinux.h
+else
+	echo '#error "Kernel does not support CONFIG_DEBUG_INFO_BTF"' > $(builddirpa)/vmlinux.h
+endif
+	rm -f $(builddirpa)/vmlinux
+endif
+ifeq ($(do_tools_x86),true)
+	cd $(builddirpa)/tools/power/x86/x86_energy_perf_policy && make CROSS_COMPILE=$(CROSS_COMPILE)
+	cd $(builddirpa)/tools/power/x86/turbostat && make CROSS_COMPILE=$(CROSS_COMPILE)
+endif
+endif
+ifeq ($(do_cloud_tools),true)
+ifeq ($(do_tools_hyperv),true)
+	cd $(builddirpa)/tools/hv && make CFLAGS="-I$(headers_dir)/usr/include -I$(headers_dir)/usr/include/$(DEB_HOST_MULTIARCH)" CROSS_COMPILE=$(CROSS_COMPILE) hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon
+endif
+endif
+	$(stamp)
+
+.PHONY: install-perarch
+install-perarch: toolspkgdir = $(CURDIR)/debian/$(tools_pkg_name)
+install-perarch: cloudpkgdir = $(CURDIR)/debian/$(cloud_pkg_name)
+install-perarch: $(stampdir)/stamp-build-perarch
+	@echo Debug: $@
+	# Add the tools.
+ifeq ($(do_linux_tools),true)
+	install -d $(toolspkgdir)/usr/lib
+	install -d $(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+ifeq ($(do_tools_usbip),true)
+	install -m755 $(addprefix $(builddirpa)/tools/usb/usbip/bin/sbin/, usbip usbipd) \
+		$(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+endif
+ifeq ($(do_tools_acpidbg),true)
+	install -m755 $(builddirpa)/tools/power/acpi/acpidbg \
+		$(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+endif
+ifeq ($(do_tools_cpupower),true)
+	install -m755 $(builddirpa)/tools/power/cpupower/cpupower \
+		$(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+endif
+ifeq ($(do_tools_rtla),true)
+	install -m755 $(builddirpa)/tools/tracing/rtla/rtla-static \
+		$(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)/rtla
+endif
+ifeq ($(do_tools_perf),true)
+	install -m755 $(builddirpa)/tools/perf/perf $(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+ifeq ($(do_tools_perf_jvmti),true)
+	install -m755 $(builddirpa)/tools/perf/libperf-jvmti.so $(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+endif
+ifeq ($(do_tools_perf_python),true)
+	install -d $(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)/lib
+	install -m644 $(builddirpa)/tools/perf/python/perf.*.so $(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)/lib
+endif
+endif
+ifeq ($(do_tools_bpftool),true)
+	install -m755 $(builddirpa)/tools/bpf/bpftool/bpftool $(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+endif
+ifeq ($(do_tools_bpftool),true)
+	install -d -m755 $(CURDIR)/debian/linux-bpf-dev/usr/include/$(DEB_HOST_MULTIARCH)/linux/
+	install -m644 $(builddirpa)/vmlinux.h $(CURDIR)/debian/linux-bpf-dev/usr/include/$(DEB_HOST_MULTIARCH)/linux/vmlinux.h
+endif
+ifeq ($(do_tools_x86),true)
+	install -m755 \
+		$(addprefix $(builddirpa)/tools/power/x86/, x86_energy_perf_policy/x86_energy_perf_policy turbostat/turbostat) \
+		$(toolspkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+endif
+endif
+ifeq ($(do_cloud_tools),true)
+ifeq ($(do_tools_hyperv),true)
+	install -d $(cloudpkgdir)/usr/lib
+	install -d $(cloudpkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+	install -m755 $(addprefix $(builddirpa)/tools/hv/, hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon lsvmbus) \
+		$(cloudpkgdir)/usr/lib/$(src_pkg_name)-tools-$(abi_release)
+endif
+endif
+
+.PHONY: binary-perarch
+binary-perarch: toolspkg = $(tools_pkg_name)
+binary-perarch: cloudpkg = $(cloud_pkg_name)
+binary-perarch: install-perarch
+	@echo Debug: $@
+ifeq ($(do_linux_tools),true)
+	$(call dh_all,$(toolspkg))
+endif
+ifeq ($(do_cloud_tools),true)
+	$(call dh_all,$(cloudpkg))
+endif
+
+.PHONY: binary-debs
+binary-debs: binary-perarch $(addprefix binary-,$(flavours))
+	@echo Debug: $@
+
+build-arch-deps-$(do_flavour_image_package) += $(addprefix $(stampdir)/stamp-install-,$(flavours))
+
+.PHONY: build-arch
+build-arch: $(build-arch-deps-true)
+	@echo Debug: $@
+
+binary-arch-deps-$(do_flavour_image_package) += binary-debs
+binary-arch-deps-true += binary-arch-headers
+ifneq ($(do_common_headers_indep),true)
+binary-arch-deps-$(do_flavour_header_package) += binary-headers
+endif
+
+.PHONY: binary-arch
+binary-arch: $(binary-arch-deps-true)
+	@echo Debug: $@
+
--- linux-qcom-6.8.0.orig/debian/rules.d/3-binary-indep.mk
+++ linux-qcom-6.8.0/debian/rules.d/3-binary-indep.mk
@@ -0,0 +1,213 @@
+.PHONY: build-indep
+build-indep:
+	@echo Debug: $@
+
+# The binary-indep dependency chain is:
+#
+# install-headers <- install-source <- install-tools <- install-indep <- binary-indep
+# install-headers <- binary-headers
+#
+indep_hdrpkg = $(indep_hdrs_pkg_name)
+indep_hdrdir = $(CURDIR)/debian/$(indep_hdrpkg)/usr/src/$(indep_hdrpkg)
+
+$(stampdir)/stamp-install-headers: $(stampdir)/stamp-prepare-indep
+	@echo Debug: $@
+	dh_testdir
+
+ifeq ($(do_flavour_header_package),true)
+	install -d $(indep_hdrdir)
+	find . -path './debian' -prune -o -path './$(DEBIAN)' -prune \
+	  -o -path './include/*' -prune \
+	  -o -path './scripts/*' -prune -o -type f \
+	  \( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \
+	     -name '*.sh' -o -name '*.pl' -o -name '*.lds' \) \
+	  -print | cpio -pd --preserve-modification-time $(indep_hdrdir)
+	cp -a scripts include $(indep_hdrdir)
+	(find arch -name include -type d -print | \
+		xargs -n1 -i: find : -type f) | \
+		cpio -pd --preserve-modification-time $(indep_hdrdir)
+	# Do not ship .o and .cmd artifacts in headers
+	find $(indep_hdrdir) -name \*.o -or -name \*.cmd -exec rm -f {} \;
+endif
+	$(stamp)
+
+srcpkg = linux-source-$(release)
+srcdir = $(CURDIR)/debian/$(srcpkg)/usr/src/$(srcpkg)
+balldir = $(CURDIR)/debian/$(srcpkg)/usr/src/$(srcpkg)/$(srcpkg)
+install-source: $(stampdir)/stamp-prepare-indep
+	@echo Debug: $@
+ifeq ($(do_source_package),true)
+
+	install -d $(srcdir)
+ifeq ($(do_source_package_content),true)
+	find . -path './debian' -prune -o -path './$(DEBIAN)' -prune -o \
+		-path './.*' -prune -o -print | \
+		cpio -pd --preserve-modification-time $(balldir)
+	(cd $(srcdir); tar cf - $(srcpkg)) | bzip2 -9c > \
+		$(srcdir)/$(srcpkg).tar.bz2
+	rm -rf $(balldir)
+	$(LN) $(srcpkg)/$(srcpkg).tar.bz2 $(srcdir)/..
+endif
+endif
+
+.PHONY: install-tools
+install-tools: toolspkg = $(tools_common_pkg_name)
+install-tools: toolsbin = $(CURDIR)/debian/$(toolspkg)/usr/bin
+install-tools: toolssbin = $(CURDIR)/debian/$(toolspkg)/usr/sbin
+install-tools: toolsman = $(CURDIR)/debian/$(toolspkg)/usr/share/man
+install-tools: toolspython = $(CURDIR)/debian/$(toolspkg)/usr/lib/python3/dist-packages
+install-tools: toolsbashcomp = $(CURDIR)/debian/$(toolspkg)/usr/share/bash-completion/completions
+install-tools: hosttoolspkg = $(hosttools_pkg_name)
+install-tools: hosttoolsbin = $(CURDIR)/debian/$(hosttoolspkg)/usr/bin
+install-tools: hosttoolsman = $(CURDIR)/debian/$(hosttoolspkg)/usr/share/man
+install-tools: hosttoolssystemd = $(CURDIR)/debian/$(hosttoolspkg)/lib/systemd/system
+install-tools: cloudpkg = $(cloud_common_pkg_name)
+install-tools: cloudbin = $(CURDIR)/debian/$(cloudpkg)/usr/bin
+install-tools: cloudsbin = $(CURDIR)/debian/$(cloudpkg)/usr/sbin
+install-tools: cloudman = $(CURDIR)/debian/$(cloudpkg)/usr/share/man
+install-tools: $(stampdir)/stamp-prepare-indep $(stampdir)/stamp-build-perarch
+	@echo Debug: $@
+
+ifeq ($(do_tools_common),true)
+	rm -rf $(builddir)/tools
+	install -d $(builddir)/tools
+	for i in *; do $(LN) $(CURDIR)/$$i $(builddir)/tools/; done
+	rm $(builddir)/tools/tools
+	rsync -a tools/ $(builddir)/tools/tools/
+
+	install -d $(toolsbin)
+	install -d $(toolssbin)
+	install -d $(toolsman)/man1
+	install -d $(toolsman)/man8
+	install -d $(toolsbashcomp)
+	install -d $(toolspython)
+
+	install -m755 debian/tools/generic $(toolsbin)/usbip
+	install -m755 debian/tools/generic $(toolsbin)/usbipd
+	install -m644 $(CURDIR)/tools/usb/usbip/doc/*.8 $(toolsman)/man8/
+
+	install -m755 debian/tools/generic $(toolsbin)/cpupower
+	install -m644 $(CURDIR)/tools/power/cpupower/man/*.1 $(toolsman)/man1/
+
+	install -m755 debian/tools/generic $(toolsbin)/rtla
+
+	install -m755 debian/tools/generic $(toolsbin)/perf
+
+	install -m755 debian/tools/generic $(toolssbin)/bpftool
+	make -C $(builddir)/tools/tools/bpf/bpftool doc
+	install -m644 $(builddir)/tools/tools/bpf/bpftool/Documentation/*.8 \
+		$(toolsman)/man8
+	install -m644 $(builddir)/tools/tools/bpf/bpftool/bash-completion/bpftool \
+		$(toolsbashcomp)
+
+	install -m755 debian/tools/generic $(toolsbin)/x86_energy_perf_policy
+	install -m755 debian/tools/generic $(toolsbin)/turbostat
+
+	cd $(builddir)/tools/tools/perf && make man
+	install -m644 $(builddir)/tools/tools/perf/Documentation/*.1 \
+		$(toolsman)/man1
+
+	install -m644 $(CURDIR)/tools/power/x86/x86_energy_perf_policy/*.8 $(toolsman)/man8
+	install -m644 $(CURDIR)/tools/power/x86/turbostat/*.8 $(toolsman)/man8
+
+ifeq ($(do_tools_perf_python),true)
+	# Python wrapper module for python-perf
+	install -d $(toolspython)/perf
+	install -m644 debian/tools/python-perf.py $(toolspython)/perf/__init__.py
+endif
+ifeq ($(do_cloud_tools),true)
+ifeq ($(do_tools_hyperv),true)
+	install -d $(cloudsbin)
+	install -m755 debian/tools/generic $(cloudsbin)/hv_kvp_daemon
+	install -m755 debian/tools/generic $(cloudsbin)/hv_vss_daemon
+	install -m755 debian/tools/generic $(cloudsbin)/hv_fcopy_daemon
+	install -m755 debian/tools/generic $(cloudsbin)/lsvmbus
+	install -m755 debian/cloud-tools/hv_get_dhcp_info $(cloudsbin)
+	install -m755 debian/cloud-tools/hv_get_dns_info $(cloudsbin)
+	install -m755 debian/cloud-tools/hv_set_ifconfig $(cloudsbin)
+
+	install -d $(cloudman)/man8
+	install -m644 $(CURDIR)/tools/hv/*.8 $(cloudman)/man8
+endif
+endif
+
+ifeq ($(do_tools_acpidbg),true)
+	install -m755 debian/tools/generic $(toolsbin)/acpidbg
+endif
+
+endif
+
+ifeq ($(do_tools_host),true)
+	install -d $(hosttoolsbin)
+	install -d $(hosttoolsman)/man1
+	install -d $(hosttoolssystemd)
+
+	install -m 755 $(CURDIR)/tools/kvm/kvm_stat/kvm_stat $(hosttoolsbin)/
+	install -m 644 $(CURDIR)/tools/kvm/kvm_stat/kvm_stat.service \
+		$(hosttoolssystemd)/
+
+	cd $(builddir)/tools/tools/kvm/kvm_stat && make man
+	install -m644 $(builddir)/tools/tools/kvm/kvm_stat/*.1 \
+		$(hosttoolsman)/man1
+endif
+
+$(stampdir)/stamp-prepare-indep:
+	@echo Debug: $@
+	dh_prep -i
+	$(stamp)
+
+.PHONY: install-indep
+install-indep: $(stampdir)/stamp-install-headers install-source install-tools
+	@echo Debug: $@
+
+# This is just to make it easy to call manually. Normally done in
+# binary-indep target during builds.
+.PHONY: binary-headers
+binary-headers: $(stampdir)/stamp-prepare-indep $(stampdir)/stamp-install-headers
+	@echo Debug: $@
+	dh_installchangelogs -p$(indep_hdrpkg)
+	dh_installdocs -p$(indep_hdrpkg)
+	dh_compress -p$(indep_hdrpkg)
+	dh_fixperms -p$(indep_hdrpkg)
+	dh_installdeb -p$(indep_hdrpkg)
+	$(lockme) dh_gencontrol -p$(indep_hdrpkg)
+	dh_md5sums -p$(indep_hdrpkg)
+	dh_builddeb -p$(indep_hdrpkg)
+
+binary-indep: cloudpkg = $(cloud_common_pkg_name)
+binary-indep: hosttoolspkg = $(hosttools_pkg_name)
+binary-indep: install-indep
+	@echo Debug: $@
+	dh_installchangelogs -i
+	dh_installdocs -i
+	dh_compress -i
+	dh_fixperms -i
+ifeq ($(do_tools_common),true)
+ifeq ($(do_cloud_tools),true)
+ifeq ($(do_tools_hyperv),true)
+	dh_installinit -p$(cloudpkg) -n --name hv-kvp-daemon
+	dh_installinit -p$(cloudpkg) -n --name hv-vss-daemon
+	dh_installinit -p$(cloudpkg) -n --name hv-fcopy-daemon
+	dh_installudev -p$(cloudpkg) -n --name hv-kvp-daemon
+	dh_installudev -p$(cloudpkg) -n --name hv-vss-daemon
+	dh_installudev -p$(cloudpkg) -n --name hv-fcopy-daemon
+	dh_systemd_enable -p$(cloudpkg)
+	dh_installinit -p$(cloudpkg) -o --name hv-kvp-daemon
+	dh_installinit -p$(cloudpkg) -o --name hv-vss-daemon
+	dh_installinit -p$(cloudpkg) -o --name hv-fcopy-daemon
+	dh_systemd_start -p$(cloudpkg)
+endif
+	# Keep intel_sgx service disabled by default, so add it after dh_systemd_enable
+	# and dh_systemd_start are called:
+	dh_installinit -p$(cloudpkg) --no-start --no-enable --name intel-sgx-load-module
+endif
+endif
+ifeq ($(do_tools_host),true)
+	# Keep kvm_stat.service disabled by default (after dh_systemd_enable
+	# and dh_systemd_start:
+	dh_installinit -p$(hosttoolspkg) --no-enable --no-start --name kvm_stat
+endif
+	dh_installdeb -i
+	$(lockme) dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
--- linux-qcom-6.8.0.orig/debian/rules.d/4-checks.mk
+++ linux-qcom-6.8.0/debian/rules.d/4-checks.mk
@@ -0,0 +1,18 @@
+# Check the signature of staging modules
+module-signature-check-%: $(stampdir)/stamp-install-%
+	@echo Debug: $@
+	$(DROOT)/scripts/checks/module-signature-check "$*" \
+		"$(DROOT)/$(mods_pkg_name)-$*" \
+		"$(DROOT)/$(mods_extra_pkg_name)-$*" \
+		$(do_skip_checks)
+
+checks-%: module-signature-check-%
+	@echo Debug: $@
+
+# Check the config against the known options list.
+config-prepare-check-%: $(stampdir)/stamp-prepare-tree-%
+	@echo Debug: $@
+ifneq ($(do_skip_checks),true)
+	python3 $(DROOT)/scripts/misc/annotations -f $(commonconfdir)/annotations \
+		--arch $(arch) --flavour $* --check $(builddir)/build-$*/.config
+endif
--- linux-qcom-6.8.0.orig/debian/scripts/checks/final-checks
+++ linux-qcom-6.8.0/debian/scripts/checks/final-checks
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+debian="$1"
+abi="$2"
+
+archs=$(awk '/^Architecture:/ { $1=""; for (i=1; i<=NF; i++) { if ($i != "all") { print $i }}}' debian/control | sort -u)
+
+fail=0
+
+failure()
+{
+	echo "EE: $*" 1>&2
+	fail=1
+}
+
+for arch in $archs
+do
+	if [ ! -f "$debian/rules.d/$arch.mk" ]; then
+		continue
+	fi
+
+	image_pkg=$(awk -F '\\s*=\\s*' '$1 == "do_flavour_image_package" { print $2 }' "$debian/rules.d/$arch.mk")
+	if [ "$image_pkg" = "false" ]; then
+		continue
+	fi
+
+	flavours=$(
+		awk '/^\s*flavours\s*=/{
+			sub(/^\s*flavours\s*=\s*/, "");
+			print
+		}' "$debian/rules.d/$arch.mk")
+	for flavour in $flavours
+	do
+		if [ -d debian/certs ]; then
+			if ! python3 debian/scripts/misc/annotations --export -c CONFIG_SYSTEM_TRUSTED_KEYS --arch "$arch" --flavour "$flavour" | grep -q '^CONFIG_SYSTEM_TRUSTED_KEYS="debian/canonical-certs.pem"$' ; then
+				failure "'CONFIG_SYSTEM_TRUSTED_KEYS=\"debian/canonical-certs.pem\"' is required"
+			fi
+		fi
+		if [ -d debian/revoked-certs ]; then
+			if ! python3 debian/scripts/misc/annotations --export -c CONFIG_SYSTEM_REVOCATION_KEYS --arch "$arch" --flavour "$flavour" | grep -q '^CONFIG_SYSTEM_REVOCATION_KEYS="debian/canonical-revoked-certs.pem"$' ; then
+				failure "'CONFIG_SYSTEM_REVOCATION_KEYS=\"debian/canonical-revoked-certs.pem\"' is required"
+			fi
+		fi
+	done
+done
+
+exit "$fail"
--- linux-qcom-6.8.0.orig/debian/scripts/checks/module-signature-check
+++ linux-qcom-6.8.0/debian/scripts/checks/module-signature-check
@@ -0,0 +1,91 @@
+#!/bin/bash -eu
+
+flavor="${1}"
+mods_dir="${2}"
+mods_extra_dir="${3}"
+
+skip_checks=${4:-}
+case "${skip_checks,,}" in
+        1|true|yes) skip_checks=1 ;;
+        *) skip_checks=0 ;;
+esac
+
+echo "II: Checking signature of staging modules for ${flavor}..."
+
+root=$(dirname "$(realpath -e "${0}")")/../../..
+. "${root}"/debian/debian.env
+
+# Collect the signature-inclusion files
+sig_incs=()
+for d in debian "${DEBIAN}" ; do
+	if [ -f "${root}"/"${d}"/signature-inclusion ] ; then
+		sig_incs+=("${root}"/"${d}"/signature-inclusion)
+	fi
+done
+
+if [ "${#sig_incs[@]}" -gt 0 ] ; then
+	echo "II: Use signature inclusion file(s):"
+	printf "    %s\n" "${sig_incs[@]}"
+	sig_all=0
+else
+	echo "WW: Signature inclusion file(s) missing"
+	echo "II: All modules must be signed"
+	sig_all=1
+fi
+
+if ! [ -d "${mods_dir}" ] ; then
+	echo "EE: Modules directory missing:"
+	echo "    ${mods_dir}"
+	if [ ${skip_checks} -eq 1 ] ; then
+		echo "WW: Explicitly asked to ignore failures"
+		echo "II: Done"
+		exit 0
+	fi
+	exit 1
+fi
+
+echo "II: Checking modules directory:"
+echo "    ${mods_dir}"
+mods_dirs=("${mods_dir}")
+
+if [ -d "${mods_extra_dir}" ] ; then
+	echo "    ${mods_extra_dir}"
+	mods_dirs+=("${mods_extra_dir}")
+fi
+
+pass=0
+fail=0
+while IFS= read -r mod ; do
+	is=0
+	if /sbin/modinfo "${mod}" | grep -q "^signature:" ; then
+		# Module is signed
+		is=1
+	fi
+
+	must=0
+	if [ ${sig_all} -eq 1 ] || grep -qFx "${mod##*/}" "${sig_incs[@]}" ; then
+		# Module must be signed
+		must=1
+	fi
+
+	case "${is}${must}" in
+		00) echo "    PASS (unsigned) : ${mod##*/}" ; pass=$((pass + 1)) ;;
+		01) echo "    FAIL (unsigned) : ${mod##*/}" ; fail=$((fail + 1)) ;;
+		10) echo "    FAIL (signed)   : ${mod##*/}" ; fail=$((fail + 1)) ;;
+		11) echo "    PASS (signed)   : ${mod##*/}" ; pass=$((pass + 1)) ;;
+	esac
+done < <(find "${mods_dirs[@]}" -path '*/drivers/staging/*.ko' | sort)
+
+echo "II: Checked $((pass + fail)) modules : ${pass} PASS, ${fail} FAIL"
+
+if [ ${fail} -ne 0 ] ; then
+	if [ ${skip_checks} -eq 1 ] ; then
+		echo "WW: Explicitly asked to ignore failures"
+	else
+		echo "EE: Modules signature failures"
+		exit 1
+	fi
+fi
+
+echo "II: Done"
+exit 0
--- linux-qcom-6.8.0.orig/debian/scripts/control-create
+++ linux-qcom-6.8.0/debian/scripts/control-create
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+. debian/debian.env
+
+vars=$1
+any_signed=$2
+
+. $vars
+
+[ "$provides" != '' ] && provides="$provides, "
+
+flavour=$(basename $vars | sed 's/.*\.//')
+stub="${DEBIAN}/control.d/flavour-control.stub debian/control.d/flavour-buildinfo.stub"
+if [ "$any_signed" = 'true' ]; then
+	sign_me_pkg="-unsigned"
+	sign_me_txt=" unsigned"
+	sign_peer_pkg=""
+else
+	sign_me_pkg=""
+	sign_me_txt=""
+	sign_peer_pkg="-unsigned"
+fi
+
+cat $stub | grep -v '^#' | sed \
+	-e "s#FLAVOUR#$flavour#g"		\
+	-e "s#DESC#$desc#g"			\
+	-e "s#ARCH#$arch#g"			\
+	-e "s#SUPPORTED#$supported#g"		\
+	-e "s#TARGET#$target#g"			\
+	-e "s#BOOTLOADER#$bootloader#g" 	\
+	-e "s#=PROVIDES=#$provides#g"		\
+	-e "s#=CONFLICTS=#$conflicts#g"		\
+	-e "s#=SIGN-ME-PKG=#$sign_me_pkg#g"	\
+	-e "s#=SIGN-ME-TXT=#$sign_me_txt#g"	\
+	-e "s#=SIGN-PEER-PKG=#$sign_peer_pkg#g"
+
+while read package version extras
+do
+	module="$package"
+	module_type=
+
+	# Module arch parameters are skipped here, so a package section will
+	# be generated for each flavour, and its Architecture will be set to
+	# all architectures with that flavour. Even that is being generated,
+	# it doesn't follow all of them will be built. That's to work-around
+	# dkms_exclude/dkms_include that manipulates supported architectures
+	# in $(DEBIAN)/rules.d/$(arch).mk.
+	for param in $extras; do
+		case "$param" in
+		modulename=*) module="${param#modulename=}" ;;
+		type=*) module_type="${param#type=}" ;;
+		*) continue ;;
+		esac
+	done
+
+	[ "$module_type" = "standalone" ] || continue
+
+	cat debian/control.d/flavour-module.stub | grep -v '^#' | sed	\
+		-e "s#ARCH#$arch#g"		\
+		-e "s#MODULE#$module#g"		\
+		-e "s#FLAVOUR#$flavour#g"
+done <"${DEBIAN}/dkms-versions"
--- linux-qcom-6.8.0.orig/debian/scripts/dkms-build
+++ linux-qcom-6.8.0/debian/scripts/dkms-build
@@ -0,0 +1,271 @@
+#!/bin/sh
+set -e
+
+dkms_dir="$1"
+abi_flavour="$2"
+sign="$3"
+pkgname="$4"
+pkgdir="$5"
+dbgpkgdir="$6"
+package="$7"
+shift 7
+
+here=$(dirname "$(readlink -f "${0}")")
+
+srcdir=$(pwd)
+cd "$dkms_dir" || exit 1
+
+built_using_record()
+{
+	local subst="$1"
+	local built_using="$2"
+	if [ ! -f "$subst" ]; then
+		touch "$subst"
+	fi
+	if ! grep -q -s "^linux:BuiltUsing=" "$subst"; then
+		echo "linux:BuiltUsing=" >>"$subst"
+	fi
+	sed -i -e "s/^\(linux:BuiltUsing=.*\)/\1$built_using, /" "$subst"
+}
+
+# ABI: returns present in $? and located path in lpackage_path when found.
+package_present()
+{
+	for lpackage_path in "$1"_*.deb
+	do
+		break
+	done
+	[ -f "$lpackage_path" ]
+}
+
+# Download and extract the DKMS package -- note there may be more
+# than one package to install.
+for package_path in "$@"
+do
+	package_file=$(basename "$package_path")
+	echo "II: dkms-build downloading $package ($package_file)"
+	rpackage=$( echo "$package_path" | sed -e 's@.*/@@' -e 's@_.*@@' )
+	lpackage=$( echo "$rpackage" | sed -e 's@=.*@@' )
+
+	while true
+	do
+		if package_present "$lpackage"; then
+			break
+		fi
+		case "$package_path" in
+		pool/*)
+			# Attempt download from the launchpad librarian first.
+			"$here/file-downloader" "https://launchpad.net/ubuntu/+archive/primary/+files/$package_file" || true
+			if package_present "$lpackage"; then
+				break
+			fi
+
+			# Download from the available pools.
+			for pool in $( grep -h '^deb ' /etc/apt/sources.list /etc/apt/sources.list.d/*.list | awk '{print $2}' | sort -u )
+			do
+				if package_present "$lpackage"; then
+					break
+				fi
+				url="$pool/$package_path"
+				"$here/file-downloader" "$url" && break || true
+				# No components in PPAs.
+				url=$(echo "$url" | sed -e 's@/pool/[^/]*/@/pool/main/@')
+				"$here/file-downloader" "$url" && break || true
+			done
+			;;
+		http*:*)
+			"$here/file-downloader" "$package_path"
+			;;
+		*/*)
+			cp -p "$package_path" .
+			;;
+		*)
+			apt-get download "$rpackage"
+			;;
+		esac
+		break
+	done
+	if ! package_present "$lpackage"; then
+		echo "EE: $lpackage not found"
+		exit 1
+	fi
+
+	dpkg -x "$lpackage"_*.deb "$package"
+
+	lversion=$( echo "$lpackage_path" | sed -e 's@.*/@@' -e 's@_[^_]*$@@' -e 's@.*_@@')
+	#built_using_record "$srcdir/debian/$pkgname.substvars" "$built_using$lpackage (= $lversion)"
+done
+
+# Pick out the package/version from the dkms.conf.
+for dkms_conf in "$package/usr/src"/*/"dkms.conf"
+do
+	break
+done
+
+# It seems some packages have a # in the name which works fine if the
+# package is installed directly, but not so much if we build it out
+# of the normal location.
+sed -i -e '/^PACKAGE_NAME=/ s/#//g' "$dkms_conf"
+
+# Run any dkms-package specfic configuration steps
+dkms_config_specific="$srcdir/$0-configure--$package"
+dkms_config_generic=$(echo "$dkms_config_specific" | sed -e 's/-[0-9][0-9]*$/-N/')
+for dkms_config in "$dkms_config_specific" "$dkms_config_generic"
+do
+	if [ -z "$dkms_config" -o ! -e "$dkms_config" ]; then
+		continue
+	fi
+	echo "II: dkms-build-configure $(basename "$dkms_config") found, executing"
+	"$dkms_config" \
+		"$srcdir" \
+		"$dkms_conf" \
+		"$dkms_dir" \
+		"$abi_flavour" \
+		"$sign" \
+		"$pkgname" \
+		"$pkgdir" \
+		"$dbgpkgdir" \
+		"$package" \
+		"$@" || exit 1
+	break
+done
+
+cat - <<'EOF' >>"$dkms_conf"
+POST_BUILD="ubuntu-save-objects ${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build ${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/objects $POST_BUILD"
+EOF
+ubuntu_script="$(dirname "$dkms_conf")/ubuntu-save-objects"
+cat - <<'EOF' >"$ubuntu_script"
+#!/bin/sh
+from="$1"
+to="$2"
+script="$3"
+shift 2
+
+# Copy the objects.
+echo "II: copying objects to '$to'"
+mkdir -p "$to"
+(cd "$from" && find -name \*.o -o -name \*.mod | cpio -Lpd "$to")
+
+# Call the original post_install script if there is one.
+[ "$script" = '' ] && exit 0
+
+shift
+exec "$(dirname "$0")/$script" "$@"
+EOF
+chmod +x "$ubuntu_script"
+dkms_package=$( sed -ne 's/PACKAGE_NAME="\(.*\)"/\1/p' "$dkms_conf" )
+dkms_version=$( sed -ne 's/PACKAGE_VERSION="\(.*\)"/\1/p' "$dkms_conf" )
+
+# Build the DKMS binaries.
+echo "II: dkms-build building $package"
+fakeroot=""
+[ $(id -u) -ne 0 ] && fakeroot="/usr/bin/fakeroot"
+rc=0
+$fakeroot /usr/sbin/dkms build --no-prepare-kernel --no-clean-kernel \
+	-k "$abi_flavour" ${ARCH:+-a $ARCH} \
+	--sourcetree "$dkms_dir/source" \
+	--dkmstree "$dkms_dir/build" \
+	--kernelsourcedir "$dkms_dir/headers/linux-headers-$abi_flavour" \
+	"$dkms_conf" || rc=$?
+
+# Find the log and add it to our own.
+for log in "$dkms_dir/build/$dkms_package/$dkms_version/$abi_flavour"/*/"log/make.log" "$dkms_dir/build/$dkms_package/$dkms_version/build/make.log"
+do
+	if [ -f "$log" ]; then
+		sed -e "s@$dkms_dir@<<DKMSDIR>>@g" <"$log"
+		break
+	fi
+done
+
+# If this build failed then exit here.
+[ "$rc" != 0 ] && exit "$rc"
+
+# Install the modules with debug symbols we possibly built,
+# and strip the original modules for the next install step.
+if [ -n "$dbgpkgdir" ]; then
+	dbgpkgdir="$dbgpkgdir/$package"
+	echo "II: dkms-build installing $package into $dbgpkgdir (debug symbols)"
+	install -d "$dbgpkgdir"
+	find "$dkms_dir/build/$dkms_package/$dkms_version/$abi_version" -name \*.ko |
+	while read module; do
+		vmodule=$( basename "$module" )
+
+		# Check for '.debug_info' section in order to copy module.
+		# Useful if debug symbols are requested but not built for
+		# any reason (including not yet supported by DKMS package).
+		# Strip module just in case even if section isn't present.
+		if ${CROSS_COMPILE}objdump -h -j '.debug_info' "$module" >/dev/null 2>&1
+		then
+			echo "copying $vmodule"
+			cp "$module" "$dbgpkgdir"
+		else
+			echo "ignoring $vmodule (missing debug symbols)"
+		fi
+
+		# Just 'strip -g' as '/usr/sbin/dkms' does.
+		echo "stripping $vmodule"
+		strip -g "$module"
+	done
+fi
+
+# Install and optionally sign the modules we have built.
+pkgdir="$pkgdir/$package"
+echo "II: dkms-build installing $package into $pkgdir"
+install -d "$pkgdir"
+find "$dkms_dir/build/$dkms_package/$dkms_version/$abi_version" -name \*.ko |
+while read module; do
+	vmodule=$( basename "$module" )
+	case "$sign" in
+	--*)
+		echo "copying $vmodule"
+		cp "$module" "$pkgdir"
+		;;
+	*)
+		echo "signing $vmodule"
+		$sign "$module" "$pkgdir/$vmodule"
+		;;
+	esac
+done
+
+find "$dkms_dir/build/$dkms_package/$dkms_version/objects" -name \*.o -print | \
+while read object
+do
+	"$srcdir/debian/scripts/fix-filenames" "$object" "$dkms_dir"
+done
+
+# This assumes that .mod files are in the top level build tree
+# If there are ever .mod files in sub-directories, the dirname of objectlist needs to be stripped as well
+find "$dkms_dir/build/$dkms_package/$dkms_version/objects" -name \*.mod -print | \
+while read objectlist
+do
+	sed "s|^$dkms_dir/build/$dkms_package/$dkms_version/build/||" -i $objectlist
+done
+
+# Finally see if there is a dkms-package specific post processor present.  Hand
+# it the original source directory, destination package directory, the objects
+# as squirreled away, and the log in case it is useful.  Finally pass a formed
+# signing command line in case we need to do that.
+dkms_build_specific="$srcdir/$0--$package"
+dkms_build_generic=$(echo "$dkms_build_specific" | sed -n -e 's/-[0-9][0-9]*[a-z]*$/-N/p')
+for dkms_build in "$dkms_build_specific" "$dkms_build_generic"
+do
+	if [ -z "$dkms_build" -o ! -e "$dkms_build" ]; then
+		continue
+	fi
+	echo "II: dkms-build override $(basename "$dkms_build") found, executing"
+	"$dkms_build" \
+		"$srcdir" \
+		"$dkms_dir/build/$dkms_package/$dkms_version/objects" \
+		"$log" \
+		"$dkms_dir" \
+		"$abi_flavour" \
+		"$sign" \
+		"$pkgname" \
+		"$pkgdir" \
+		"$dbgpkgdir" \
+		"$package" \
+		"$@" || exit 1
+	break
+done
+
+echo "II: dkms-build build $package complete"
--- linux-qcom-6.8.0.orig/debian/scripts/dkms-build--nvidia-N
+++ linux-qcom-6.8.0/debian/scripts/dkms-build--nvidia-N
@@ -0,0 +1,112 @@
+#!/bin/sh
+set -e
+
+srcdir="$1"
+objects="$2"
+log="$3"
+shift 3
+
+dkms_dir="$1"
+abi_flavour="$2"
+sign="$3"
+pkgname="$4"
+pkgdir="$5"
+dbgpkgdir="$6"
+package="$7"
+shift 7
+
+build="$( dirname "$objects" )/build"
+
+# Copy over the objects ready for reconstruction.  The objects copy
+# contains the *.o files. For our purposes we only want the *.o files,
+# elide the rest. And .mod files for ld linking in recentish kernels.
+mkdir -p "$pkgdir/bits/scripts"
+(
+	gcc_variant1=$(gcc --version | head -1 | sed -e 's/^gcc/GCC:/')
+	gcc_variant2=$(gcc --version | head -1 | sed -e 's/^\(gcc\) \((.*)\) \(.*\)$/\1 version \3 \2/')
+	cd "$objects" || exit 1
+	find -name \*.o -o -name \*.mod | \
+	while read file
+	do
+		cp --parents "$file" "$pkgdir/bits"
+		"$srcdir/debian/scripts/fix-filenames" "$pkgdir/bits/$file" "$gcc_variant1"
+		"$srcdir/debian/scripts/fix-filenames" "$pkgdir/bits/$file" "$gcc_variant2"
+	done
+)
+
+# Install the support files we need.
+echo "II: copying support files ..."
+for lds_src in \
+	"$dkms_dir/headers/linux-headers-$abi_flavour/scripts/module.lds" \
+	"/usr/src/linux-headers-$abi_flavour/scripts/module.lds" \
+	"$dkms_dir/headers/linux-headers-$abi_flavour/scripts/module-common.lds" \
+	"/usr/src/linux-headers-$abi_flavour/scripts/module-common.lds"
+do
+	[ ! -f "$lds_src" ] && continue
+	echo "II: copying support files ... found $lds_src"
+	cp "$lds_src" "$pkgdir/bits/scripts"
+	break
+done
+
+# Build helper scripts.
+cat - <<'EOL' >"$pkgdir/bits/BUILD"
+[ "$1" = "unsigned" ] && { signed_only=:; shift; }
+[ "$1" = "nocheck" ] && { check_only=:; shift; }
+EOL
+grep /usr/bin/ld.bfd "$log" | grep -v scripts/genksyms/genksyms | grep -v "warning:\|NOTE:" | sed -e "s@$build/@@g" >>"$pkgdir/bits/BUILD"
+sed -e 's/.*-o  *\([^ ]*\) .*/rm -f \1/g' <"$pkgdir/bits/BUILD" >"$pkgdir/bits/CLEAN"
+
+# As the builds contain the absolute filenames as used.  Use RECONSTRUCT to
+# rebuild the .ko's, sign them, pull off the signatures and then finally clean
+# up again.
+(
+	cd "$pkgdir/bits"
+
+	# Add checksum check.
+	echo "\$check_only sha256sum -c SHA256SUMS || exit 1" >>"$pkgdir/bits/BUILD"
+
+	# Add .ko handling to the CLEAN/BUILD dance.
+	for ko in "$pkgdir"/*.ko
+	do
+		ko=$(basename "$ko")
+		echo "\$signed_only cat '$ko' '$ko.sig' >'../$ko'" >>"$pkgdir/bits/BUILD"
+		echo "\$signed_only rm -f '$ko'" >>"$pkgdir/bits/BUILD"
+		echo "rm -f '../$ko'" >>"$pkgdir/bits/CLEAN"
+	done
+
+	# Clear out anything we are not going to distribute and build unsigned .kos.
+	sh ./CLEAN
+	sh ./BUILD unsigned nocheck
+
+	if [ "$sign" = "--custom" ]; then
+		# We are building for and archive custom signing upload.  Keep everything.
+		:
+	elif [ "$sign" = "--lrm" ]; then
+		# We are in the LRM build; grab sha256 checksums and clean up.
+		sha256sum -b *.ko >"SHA256SUMS"
+		sh ./CLEAN
+
+	else
+		# We are in the main kernel, put the .kos together as we will
+		# on the users machine, sign them, and keep just the signature.
+		: >"SHA256SUMS"
+		for ko in *.ko
+		do
+			echo "detached-signature $ko"
+			$sign "$ko" "$ko.signed"
+			length=$( stat --format %s "$ko" )
+			dd if="$ko.signed" of="$ko.sig" bs=1 skip="$length" 2>/dev/null
+
+			rm -f "$ko.signed"
+			# Keep a checksum of the pre-signed object so we can check it is
+			# built correctly in LRM.
+			sha256sum -b "$ko" >>"SHA256SUMS"
+		done
+
+		# Clean out anything which not a signature.
+		mv "$pkgdir/bits/"*.sig "$pkgdir"
+		mv "$pkgdir/bits/SHA256SUMS" "$pkgdir"
+		find "$pkgdir" -name \*.sig -prune -o -name SHA256SUMS -prune -o -type f -print | xargs rm -f
+		find "$pkgdir" -depth -type d -print | xargs rmdir --ignore-fail-on-non-empty
+	fi
+)
--- linux-qcom-6.8.0.orig/debian/scripts/dkms-build-configure--zfs
+++ linux-qcom-6.8.0/debian/scripts/dkms-build-configure--zfs
@@ -0,0 +1,24 @@
+#!/bin/sh
+set -e
+
+srcdir="$1"
+dkms_conf="$2"
+shift 2
+
+dkms_dir="$1"
+abi_flavour="$2"
+sign="$3"
+pkgname="$4"
+pkgdir="$5"
+dbgpkgdir="$6"
+package="$7"
+shift 7
+
+# ZFS debug symbols are enabled in dkms.conf via PACKAGE_CONFIG file.
+if [ -n "$dbgpkgdir" ]; then
+	echo "enable zfs debug symbols"
+	pkg_cfg="$(dirname "$dkms_conf")/pkg_cfg"
+	echo 'ZFS_DKMS_ENABLE_DEBUGINFO=yes' >"$pkg_cfg"
+	echo 'ZFS_DKMS_DISABLE_STRIP=yes'   >>"$pkg_cfg"
+	sed -i "s,^\(PACKAGE_CONFIG=\).*,\1$pkg_cfg," $dkms_conf
+fi
--- linux-qcom-6.8.0.orig/debian/scripts/file-downloader
+++ linux-qcom-6.8.0/debian/scripts/file-downloader
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+if [ "$#" -ne 1 ]; then
+	echo "Usage: $0 <url>" 1>&2
+	exit 1
+fi
+url="$1"
+
+to=$(basename "$url")
+
+count=0
+what='fetching'
+while :
+do
+	if [ "$count" -eq 20 ]; then
+		echo "EE: excessive redirects" 1>&2
+		exit 1
+	fi
+	count=$(($count+1))
+
+	echo "II: $what $url"
+
+	curl --silent --fail --show-error "$url" -o "$to" -D "$to.hdr" || exit 1
+	redirect=$(awk '/^Location: / {gsub(/^[[:space:]]+|[[:space:]]+$/,"",$2); print $2;}' "$to.hdr")
+	[ -z "$redirect" ] && break
+	what='  following'
+
+	url=$(echo "$redirect" | sed -e 's@https://launchpadlibrarian.net/@http://launchpadlibrarian.net/@')
+	if [ "$redirect" != "$url" ]; then
+		echo "II:   fixing $redirect"
+	fi
+done
+
+exit 0
--- linux-qcom-6.8.0.orig/debian/scripts/fix-filenames.c
+++ linux-qcom-6.8.0/debian/scripts/fix-filenames.c
@@ -0,0 +1,80 @@
+/*
+ * fix-filenames: find a specified pathname prefix and remove it from
+ *                C strings.
+ *
+ * Copyright (C) 2018 Canonical Ltd.
+ * Author: Andy Whitcroft <apw@canonical.com>
+ */
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+int
+main(int argc, char *argv[])
+{
+	int rc;
+	char *in_name;
+	char *prefix;
+	int prefix_len;
+	int in_fd;
+	struct stat in_info;
+	char *in;
+	off_t size;
+	int length;
+
+	if (argc != 3) {
+		fprintf(stderr, "Usage: %s <file> <prefix>\n", argv[0]);
+		exit(1);
+	}
+	in_name    = argv[1];
+	prefix     = argv[2];
+	prefix_len = strlen(prefix);
+
+	in_fd = open(in_name, O_RDWR);
+	if (in_fd < 0) {
+		perror("open input failed");
+		exit(1);
+	}
+
+	rc = fstat(in_fd, &in_info);
+	if (rc < 0) {
+		perror("fstat input failed");
+		exit(1);
+	}
+	size = in_info.st_size;
+
+	in = mmap((void *)0, size, PROT_READ|PROT_WRITE, MAP_SHARED, in_fd, (off_t)0);
+	if (!in) {
+		perror("mmap failed");
+		exit(1);
+	}
+
+	for (; size > 0; size--, in++) {
+		if (*in != *prefix)
+			continue;
+		if (strncmp(in, prefix, prefix_len) != 0)
+			continue;
+		/* In the case of an exact match there there is nothing to move. */
+		if (in[prefix_len] == '\0')
+			length = 0;
+		/* If this is a filename, strip the leading slash. */
+		else if (in[prefix_len] == '/')
+			length = strlen(in + prefix_len + 1) + 1;
+		/* Otherwise just keep the suffix. */
+		else
+			length = strlen(in + prefix_len) + 1;
+
+		/*
+		 * Copy the suffix portion down to the start and clear
+		 * the remainder of the space to 0.
+		 */
+		memmove(in, in + prefix_len + 1, length);
+		memset(in + length, '\0', prefix_len);
+	}
+}
--- linux-qcom-6.8.0.orig/debian/scripts/link-headers
+++ linux-qcom-6.8.0/debian/scripts/link-headers
@@ -0,0 +1,42 @@
+#!/bin/bash -e
+
+. debian/debian.env
+
+hdrdir="$1"
+symdir="$2"
+flavour="$3"
+
+echo "Symlinking and copying headers for $flavour..."
+
+excludes="( -path ./debian -prune -o -path ./${DEBIAN} -prune -o -path ./.git ) -prune -o"
+
+(
+find . $excludes  -type f \
+	\( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \
+	-name '*.sh' -o -name '*.pl' -o -name '*.lds' \) -print
+find ./include ./scripts -name .gitignore -prune -o -type f -print
+find ./include -mindepth 1 -maxdepth 1 $excludes -type d -print
+) | (
+while read file; do
+	dir=$file
+	lastdir=$file
+
+	if [ -e "$hdrdir/$file" -o -L "$hdrdir/$file" ]; then
+		continue
+	fi
+
+	while [ ! -e "$hdrdir/$dir" -a ! -L "$hdrdir/$dir" ]; do
+		lastdir=$dir
+		dir=`dirname $dir`
+	done
+	# If the last item to exist is a symlink we assume all is good
+	if [ ! -L "$hdrdir/$dir" ]; then
+		# Turns things like "./foo" into "../"
+		deref="`echo -n $lastdir | sed -e 's/^\.//' -e's,/[^/]*,../,g'`"
+		item="`echo -n $lastdir | sed -e 's/^\.\///'`"
+		ln -s $deref$symdir/$item $hdrdir/$item
+	fi
+done
+)
+
+exit
--- linux-qcom-6.8.0.orig/debian/scripts/link-lib-rust
+++ linux-qcom-6.8.0/debian/scripts/link-lib-rust
@@ -0,0 +1,17 @@
+#!/bin/bash -e
+
+. debian/debian.env
+
+hdrdir="$1"
+symdir="$2"
+flavour="$3"
+
+echo "Symlinking and copying Rust files for $flavour..."
+
+# Symlink Rust folder
+item=rust
+relpath=$(echo $symdir | sed s/headers/lib-rust/)-$flavour/$item
+echo ln -s ../$relpath $hdrdir/$item
+ln -s ../$relpath $hdrdir/$item
+
+exit
--- linux-qcom-6.8.0.orig/debian/scripts/misc/annotations
+++ linux-qcom-6.8.0/debian/scripts/misc/annotations
@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+# -*- mode: python -*-
+
+# This file is not installed; it's just to run annotations from inside a source
+# distribution without installing it in the system.
+
+import sys
+
+# Prevent generating .pyc files on import
+#
+# We may end up adding these files to our git repos by mistake, so simply
+# prevent generating them in advance.
+#
+# There's a tiny performance penalty with this, because python needs to
+# re-generate the bytecode on-the-fly every time the script is executed, but
+# this overhead is absolutely negligible compared the rest of the kernel build
+# time.
+sys.dont_write_bytecode = True
+
+import os  # noqa: E402 Import not at top of file
+from kconfig import run  # noqa: E402 Import not at top of file
+
+
+# Update PATH to make sure that annotations can be executed directly from the
+# source directory.
+def update_path():
+    script_dir = os.path.dirname(os.path.abspath(__file__))
+    current_path = os.environ.get("PATH", "")
+    new_path = f"{script_dir}:{current_path}"
+    os.environ["PATH"] = new_path
+
+
+update_path()
+exit(run.main())
--- linux-qcom-6.8.0.orig/debian/scripts/misc/find-missing-sauce.sh
+++ linux-qcom-6.8.0/debian/scripts/misc/find-missing-sauce.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+#
+# Find the 'UBUNTU: SAUCE:' patches that have been dropped from
+# the previous release.
+#
+PREV_REL=focal
+PREV_REPO=git://kernel.ubuntu.com/ubuntu/ubuntu-${PREV_REL}.git
+
+git fetch ${PREV_REPO} master-next
+git log --pretty=oneline FETCH_HEAD|grep SAUCE|while read c m;do echo $m;done |sort > $$.prev-rel
+git log --pretty=oneline |grep SAUCE|while read c m;do echo $m;done |sort > $$.curr-rel
+
+diff -u $$.prev-rel $$.curr-rel |grep "^-"
+rm -f $$.prev-rel $$.curr-rel
+
--- linux-qcom-6.8.0.orig/debian/scripts/misc/gen-auto-reconstruct
+++ linux-qcom-6.8.0/debian/scripts/misc/gen-auto-reconstruct
@@ -0,0 +1,89 @@
+#!/bin/bash
+
+if [ "$#" -ne 3 ]; then
+	echo "Usage: $0 <orig tag>|<base release> <reconstruct> <options>" 1>&2
+	exit 1
+fi
+tag="$1"
+reconstruct="$2"
+options="$3"
+
+case "$tag" in
+v*)	;;
+*)	tag="v${tag%.*}" ;;
+esac
+
+# Validate the tag.
+count=$( git tag -l "$tag" | wc -l )
+if [ "$count" != 1 ]; then
+	echo "$0: $tag: tag invalid" 1>&2
+	exit 1
+fi
+
+#git ls-tree -r --full-tree HEAD | grep ^120 | \
+#while read mode type blobid name
+
+(
+	# Identify all new symlinks since the proffered tag.
+	echo "# Recreate any symlinks created since the orig."
+	git diff "$tag.." --raw --no-renames | awk '(/^:000000 120000/ && $5 == "A") { print $NF }' | \
+	while read name
+	do
+		link=$( readlink "$name" )
+
+		echo "[ ! -L '$name' ] && ln -sf '$link' '$name'"
+	done
+
+	# Identify files with execute permissions added since the proffered tag.
+	git diff "$tag.." --raw --no-renames | awk -F '[: \t]' '{print $2, $3, $NF }' | \
+	while IFS=" " read old new name
+	do
+		old=$( printf "0%s" $old )
+		new=$( printf "0%s" $new )
+		changed=$(( (old ^ new) & 0111 ))
+		if [ "$changed" -ne 0 ]; then
+			added=$(( new & 0111 ))
+			if [ "$added" -ne 0 ]; then
+				echo "chmod +x '$name'"
+                       elif [ "$new" -ne 0 ]; then
+				echo "chmod -x '$name'"
+			fi
+		fi
+	done
+
+       # Identify all removed files since the proffered tag.
+	echo "# Remove any files deleted from the orig."
+	git diff "$tag.." --raw --no-renames | awk '(/^:/ && $5 == "D") { print $NF }' | \
+	while read name
+	do
+		echo "rm -f '$name'"
+	done
+
+	# All done, make sure this does not complete in error.
+	echo "exit 0"
+) >"$reconstruct"
+
+(
+	# Identify all new symlinks since the proffered tag.
+	echo "# Ignore any symlinks created since the orig which are rebuilt by reconstruct."
+	git diff "$tag.." --raw --no-renames | awk '(/^:000000 120000/ && $5 == "A") { print $NF }' | \
+	while read name
+	do
+		echo "extend-diff-ignore=^$name\$"
+	done
+) >"$options.update"
+
+
+head='^## autoreconstruct -- begin$'
+foot='^## autoreconstruct -- end$'
+sed -i -e "
+	/$head/,/$foot/{
+		/$head/{
+			p;
+			r $options.update
+		};
+		/$foot/p;
+		d
+	}
+" "$options"
+rm -f "$options.update"
--- linux-qcom-6.8.0.orig/debian/scripts/misc/git-ubuntu-log
+++ linux-qcom-6.8.0/debian/scripts/misc/git-ubuntu-log
@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+
+import sys
+
+import codecs
+import urllib.request
+import json
+
+import textwrap
+
+sys.stdin = codecs.getreader("utf-8")(sys.stdin.detach())
+sys.stdout = codecs.getwriter("utf-8")(sys.stdout.detach())
+
+entries = []
+
+
+def add_entry(entry):
+    global tracking_bug
+
+    if entry and 'ignore' not in entry:
+        combo = []
+        for bug in set(entry.get('bugs', [])):
+            combo.append(bug)
+        for cve in set(entry.get('cves', [])):
+            combo.append(cve)
+        combo = sorted(combo)
+
+        if len(combo) == 0:
+            if entry.get('subject', "").startswith('UBUNTU'):
+                combo = '__packaging__'
+            else:
+                combo = '__mainline__'
+        else:
+            if entry.get('subject', "") == 'UBUNTU: link-to-tracker: update tracking bug':
+                tracking_bug = combo
+            if combo not in keys:
+                keys.append(combo)
+
+        entry['key'] = combo
+        entries.append(entry)
+
+
+# Suck up the git log output and extract the information we need.
+keys = []
+tracking_bug = None
+entry = None
+subject_wait = False
+for line in sys.stdin:
+    if line.startswith('commit '):
+        add_entry(entry)
+        entry = {}
+        subject_wait = True
+
+    elif line.startswith('Author: '):
+        bits = line.strip().split(maxsplit=1)
+        entry['author'] = bits[1]
+
+    elif subject_wait and line.startswith('    '):
+        subject_wait = False
+        entry['subject'] = line.strip()
+
+    elif line.startswith('    BugLink: '):
+        bits = line.strip().split(maxsplit=2)
+        if len(bits) > 2:
+            # There is text after the URL, so use that (after stripping the
+            # enclosing characters)
+            entry.setdefault('bugs', []).append(bits[2][1:-1])
+        elif 'launchpad.net' in bits[1]:
+            # Extract the bug number from the launchpad URL
+            bits = bits[1].split('/')
+            entry.setdefault('bugs', []).append(bits[-1])
+
+    elif line.startswith('    CVE-'):
+        entry.setdefault('cves', []).append(line.strip())
+
+    elif line.startswith('    Ignore:'):
+        entry['ignore'] = True
+
+    elif line.startswith('    Properties:'):
+        for prop in line.strip().split()[1:]:
+            if prop in ('ignore', 'no-changelog'):
+                entry['ignore'] = True
+
+add_entry(entry)
+
+entries.reverse()
+
+# Go through the entries and clear out authors for upstream commits.
+for entry in entries:
+    if entry['subject'].startswith('UBUNTU:'):
+        entry['subject'] = entry['subject'][7:].strip()
+    else:
+        del entry['author']
+
+# Lump everything without a bug at the bottom.
+keys.append('__packaging__')
+keys.append('__mainline__')
+
+# Ensure we list the tracking bug updates first.
+if tracking_bug is not None:
+    keys.remove(tracking_bug)
+    keys.insert(0, tracking_bug)
+
+emit_nl = False
+for key in keys:
+    if key == '__packaging__':
+        title_set = ['Miscellaneous Ubuntu changes']
+    elif key == '__mainline__':
+        title_set = ['Miscellaneous upstream changes']
+    else:
+        title_set = []
+        for bug in key:
+            if bug.startswith('CVE-'):
+                title_set.append(bug)
+            elif bug.isdigit():
+                # Assume that it is an LP bug number if 'bug' contains only digits
+                bug_info = None
+
+                try:
+                    # urllib.request.urlcleanup()
+                    request = urllib.request.Request('https://api.launchpad.net/devel/bugs/' + bug)
+                    request.add_header('Cache-Control', 'no-cache')
+                    with urllib.request.urlopen(request) as response:
+                        data = response.read()
+                        bug_info = json.loads(data.decode('utf-8'))
+
+                    title = bug_info['title']
+                    if 'description' in bug_info:
+                        for line in bug_info['description'].split('\n'):
+                            if line.startswith('Kernel-Description:'):
+                                title = line.split(' ', 1)[1]
+
+                except urllib.error.HTTPError:
+                    title = 'INVALID or PRIVATE BUG'
+
+                title += ' (LP###' + bug + ')'
+                title_set.append(title)
+            else:
+                # Finally treat 'bug' itself as the title
+                title_set.append(bug)
+
+    emit_title = True
+    for entry in entries:
+        if entry['key'] != key:
+            continue
+
+        if emit_title:
+            if emit_nl:
+                print('')
+            emit_nl = True
+
+            title_lines = textwrap.wrap('#// '.join(title_set), 76)
+            print('  * ' + title_lines[0].replace('LP###', 'LP: #').replace('#//', ' //'))
+            for line in title_lines[1:]:
+                line = line.replace('LP###', 'LP: #').replace('#//', ' //')
+                print('    ' + line)
+
+            emit_title = False
+
+        if key != tracking_bug or (key == tracking_bug and entry['subject'] != "link-to-tracker: update tracking bug"):
+            title_lines = textwrap.wrap(entry['subject'], 76)
+            print('    - ' + title_lines[0])
+            for line in title_lines[1:]:
+                line = line.replace('LP###', 'LP: #')
+                print('      ' + line)
--- linux-qcom-6.8.0.orig/debian/scripts/misc/insert-changes
+++ linux-qcom-6.8.0/debian/scripts/misc/insert-changes
@@ -0,0 +1,42 @@
+#!/usr/bin/python3
+
+import os
+import sys
+
+from subprocess import check_output
+
+droot = 'debian'
+if len(sys.argv) > 1:
+    droot = sys.argv[1]
+
+debian = 'debian.master'
+if len(sys.argv) > 2:
+    debian = sys.argv[2]
+
+rules = os.path.join(droot, 'rules')
+changelog = os.path.join(debian, 'changelog')
+changelog_new = os.path.join(debian, 'changelog.new')
+
+# Generate the list of new changes
+changes = check_output(['make', '-s', '-f', rules, 'printchanges']).decode('UTF-8')
+
+# Insert the new changes into the changelog
+with open(changelog) as orig, open(changelog_new, 'w') as new:
+    printed = False
+    skip_newline = False
+    for line in orig:
+        if line.startswith('  CHANGELOG: '):
+            if not printed:
+                printed = True
+                if changes == '':
+                    skip_newline = True
+                    continue
+                new.write(changes)
+        else:
+            if skip_newline and line.strip() == '':
+                skip_newline = False
+                continue
+            new.write(line)
+
+# Replace the original changelog with the new one
+os.rename(changelog_new, changelog)
--- linux-qcom-6.8.0.orig/debian/scripts/misc/insert-ubuntu-changes
+++ linux-qcom-6.8.0/debian/scripts/misc/insert-ubuntu-changes
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+import re
+import os
+import sys
+
+def version_cmp(a, b):
+    a = re.split(r"[\.-]+", a)
+    b = re.split(r"[\.-]+", b)
+    i = 0
+    while True:
+        if len(a) <= i:
+            if len(b) <= i:
+                return 0
+            return -1
+        if len(b) <= i:
+            return 1
+        if int(a[i]) < int(b[i]):
+            return -1
+        if int(a[i]) > int(b[i]):
+            return 1
+        i += 1
+
+if len(sys.argv) == 4:
+    sys.argv.append("debian.master/changelog")
+
+if len(sys.argv) == 5:
+    changelog, end, start, source_changelog = sys.argv[1:]
+else:
+    print("Usage: insert-ubuntu-changes <changelog> <stop at> <start at> [<source changelog>]")
+    sys.exit(1)
+
+changes = []
+output = False
+with open(source_changelog) as fh:
+    for line in fh:
+        m = re.match(r"^\S+\s+\((.*)\)", line)
+        if m:
+            if version_cmp(m.group(1), end) <= 0:
+                break
+            if m.group(1) == start:
+                output = True
+            if output:
+                changes.append("\n")
+                changes.append("  [ Ubuntu: {} ]\n".format(m.group(1)))
+                changes.append("\n")
+                continue
+
+        if output and re.match(r"^(  * |    |      )\S", line):
+            changes.append(line)
+
+printed = 3
+with open(changelog + ".new", "w") as fh_new:
+    with open(changelog) as fh:
+        for line in fh:
+            if line.startswith("  CHANGELOG: "):
+                printed -= 1
+                fh_new.write(line)
+                if printed == 0:
+                    fh_new.write("".join(changes))
+                continue
+            fh_new.write(line)
+
+os.rename(changelog + ".new", changelog)
--- linux-qcom-6.8.0.orig/debian/scripts/misc/kconfig/annotations.py
+++ linux-qcom-6.8.0/debian/scripts/misc/kconfig/annotations.py
@@ -0,0 +1,522 @@
+# -*- mode: python -*-
+# python module to manage Ubuntu kernel .config and annotations
+# Copyright © 2022 Canonical Ltd.
+
+import json
+import re
+import shutil
+import tempfile
+
+from abc import abstractmethod
+from ast import literal_eval
+from os.path import dirname, abspath
+
+from kconfig.version import ANNOTATIONS_FORMAT_VERSION
+
+
+class Config:
+    def __init__(self, fname, do_include=True):
+        """
+        Basic configuration file object
+        """
+        self.fname = fname
+        self.config = {}
+        self.do_include = do_include
+
+        raw_data = self._load(fname)
+        self._parse(raw_data)
+
+    @staticmethod
+    def _load(fname: str) -> str:
+        with open(fname, "rt", encoding="utf-8") as fd:
+            data = fd.read()
+        return data.rstrip()
+
+    def __str__(self):
+        """Return a JSON representation of the config"""
+        return json.dumps(self.config, indent=4)
+
+    @abstractmethod
+    def _parse(self, data: str):
+        pass
+
+
+class KConfig(Config):
+    """
+    Parse a .config file, individual config options can be accessed via
+    .config[<CONFIG_OPTION>]
+    """
+
+    def _parse(self, data: str):
+        self.config = {}
+        for line in data.splitlines():
+            m = re.match(r"^# (CONFIG_.*) is not set$", line)
+            if m:
+                self.config[m.group(1)] = literal_eval("'n'")
+                continue
+            m = re.match(r"^(CONFIG_[A-Za-z0-9_]+)=(.*)$", line)
+            if m:
+                self.config[m.group(1)] = literal_eval("'" + m.group(2) + "'")
+                continue
+
+
+class Annotation(Config):
+    """
+    Parse body of annotations file
+    """
+
+    def __init__(self, fname, do_include=True, do_json=False):
+        self.do_json = do_json
+        super().__init__(fname, do_include=True)
+
+    def _parse_body(self, data: str, parent=True):
+        for line in data.splitlines():
+            # Replace tabs with spaces, squeeze multiple into singles and
+            # remove leading and trailing spaces
+            line = line.replace("\t", " ")
+            line = re.sub(r" +", " ", line)
+            line = line.strip()
+
+            # Ignore empty lines
+            if not line:
+                continue
+
+            # Catpure flavors of included files
+            if line.startswith("# FLAVOUR: "):
+                self.include_flavour += line.split(" ")[2:]
+                continue
+
+            # Ignore comments
+            if line.startswith("#"):
+                continue
+
+            # Handle includes (recursively)
+            m = re.match(r'^include\s+"?([^"]*)"?', line)
+            if m:
+                if parent:
+                    self.include.append(m.group(1))
+                if self.do_include:
+                    include_fname = dirname(abspath(self.fname)) + "/" + m.group(1)
+                    include_data = self._load(include_fname)
+                    self._parse_body(include_data, parent=False)
+                continue
+
+            # Handle policy and note lines
+            if re.match(r".* (policy|note)<", line):
+                try:
+                    conf = line.split(" ")[0]
+                    if conf in self.config:
+                        entry = self.config[conf]
+                    else:
+                        entry = {"policy": {}}
+
+                    match = False
+                    m = re.match(r".* policy<(.*?)>", line)
+                    if m:
+                        match = True
+                        # Update the previous entry considering potential overrides:
+                        #  - if the new entry is adding a rule for a new
+                        #    arch/flavour, simply add that
+                        #  - if the new entry is overriding a previous
+                        #    arch-flavour item, then overwrite that item
+                        #  - if the new entry is overriding a whole arch, then
+                        #    remove all the previous flavour rules of that arch
+                        new_entry = literal_eval(m.group(1))
+                        for key in new_entry:
+                            if key in self.arch:
+                                for flavour_key in list(entry["policy"].keys()):
+                                    if flavour_key.startswith(key):
+                                        del entry["policy"][flavour_key]
+                                entry["policy"][key] = new_entry[key]
+                            else:
+                                entry["policy"][key] = new_entry[key]
+
+                    m = re.match(r".* note<(.*?)>", line)
+                    if m:
+                        entry["oneline"] = match
+                        match = True
+                        entry["note"] = "'" + m.group(1).replace("'", "") + "'"
+
+                    if not match:
+                        raise SyntaxError("syntax error")
+                    self.config[conf] = entry
+                except Exception as e:
+                    raise SyntaxError(str(e) + f", line = {line}") from e
+                continue
+
+            # Invalid line
+            raise SyntaxError(f"invalid line: {line}")
+
+    def _legacy_parse(self, data: str):
+        """
+        Parse main annotations file, individual config options can be accessed
+        via self.config[<CONFIG_OPTION>]
+        """
+        self.config = {}
+        self.arch = []
+        self.flavour = []
+        self.flavour_dep = {}
+        self.include = []
+        self.header = ""
+        self.include_flavour = []
+
+        # Parse header (only main header will considered, headers in includes
+        # will be treated as comments)
+        for line in data.splitlines():
+            if re.match(r"^#.*", line):
+                m = re.match(r"^# ARCH: (.*)", line)
+                if m:
+                    self.arch = list(m.group(1).split(" "))
+                m = re.match(r"^# FLAVOUR: (.*)", line)
+                if m:
+                    self.flavour = list(m.group(1).split(" "))
+                m = re.match(r"^# FLAVOUR_DEP: (.*)", line)
+                if m:
+                    self.flavour_dep = literal_eval(m.group(1))
+                self.header += line + "\n"
+            else:
+                break
+
+        # Return an error if architectures are not defined
+        if not self.arch:
+            raise SyntaxError("ARCH not defined in annotations")
+        # Return an error if flavours are not defined
+        if not self.flavour:
+            raise SyntaxError("FLAVOUR not defined in annotations")
+
+        # Parse body
+        self._parse_body(data)
+
+        # Sanity check: Verify that all FLAVOUR_DEP flavors are valid
+        if self.do_include:
+            for src, tgt in self.flavour_dep.items():
+                if src not in self.flavour:
+                    raise SyntaxError(f"Invalid source flavour in FLAVOUR_DEP: {src}")
+                if tgt not in self.include_flavour:
+                    raise SyntaxError(f"Invalid target flavour in FLAVOUR_DEP: {tgt}")
+
+    def _json_parse(self, data, is_included=False):
+        data = json.loads(data)
+
+        # Check if version is supported
+        version = data["attributes"]["_version"]
+        if version > ANNOTATIONS_FORMAT_VERSION:
+            raise SyntaxError(f"annotations format version {version} not supported")
+
+        # Check for top-level annotations vs imported annotations
+        if not is_included:
+            self.config = data["config"]
+            self.arch = data["attributes"]["arch"]
+            self.flavour = data["attributes"]["flavour"]
+            self.flavour_dep = data["attributes"]["flavour_dep"]
+            self.include = data["attributes"]["include"]
+            self.include_flavour = []
+        else:
+            # We are procesing an imported annotations, so merge all the
+            # configs and attributes.
+            try:
+                self.config = data["config"] | self.config
+            except TypeError:
+                self.config = {**self.config, **data["config"]}
+            self.arch = list(set(self.arch) | set(data["attributes"]["arch"]))
+            self.flavour = list(set(self.flavour) | set(data["attributes"]["flavour"]))
+            self.include_flavour = list(set(self.include_flavour) | set(data["attributes"]["flavour"]))
+            self.flavour_dep = self.flavour_dep | data["attributes"]["flavour_dep"]
+
+        # Handle recursive inclusions
+        if self.do_include:
+            for f in data["attributes"]["include"]:
+                include_fname = dirname(abspath(self.fname)) + "/" + f
+                data = self._load(include_fname)
+                self._json_parse(data, is_included=True)
+
+    def _parse(self, data: str):
+        if self.do_json:
+            self._json_parse(data, is_included=False)
+        else:
+            self._legacy_parse(data)
+
+    def _remove_entry(self, config: str):
+        if self.config[config]:
+            del self.config[config]
+
+    def remove(self, config: str, arch: str = None, flavour: str = None):
+        if config not in self.config:
+            return
+        if arch is not None:
+            if flavour is not None:
+                flavour = f"{arch}-{flavour}"
+            else:
+                flavour = arch
+            del self.config[config]["policy"][flavour]
+            if not self.config[config]["policy"]:
+                self._remove_entry(config)
+        else:
+            self._remove_entry(config)
+
+    def set(
+        self,
+        config: str,
+        arch: str = None,
+        flavour: str = None,
+        value: str = None,
+        note: str = None,
+    ):
+        if value is not None:
+            if config not in self.config:
+                self.config[config] = {"policy": {}}
+            if arch is not None:
+                if flavour is not None:
+                    flavour = f"{arch}-{flavour}"
+                else:
+                    flavour = arch
+                self.config[config]["policy"][flavour] = value
+            else:
+                for a in self.arch:
+                    self.config[config]["policy"][a] = value
+        if note is not None:
+            self.config[config]["note"] = "'" + note.replace("'", "") + "'"
+
+    def update(self, c: KConfig, arch: str, flavour: str = None, configs: list = None):
+        """Merge configs from a Kconfig object into Annotation object"""
+
+        # Determine if we need to import all configs or a single config
+        if not configs:
+            configs = c.config.keys()
+            try:
+                configs |= self.search_config(arch=arch, flavour=flavour).keys()
+            except TypeError:
+                configs = {
+                    **configs,
+                    **self.search_config(arch=arch, flavour=flavour).keys(),
+                }
+
+        # Import configs from the Kconfig object into Annotations
+        flavour_arg = flavour
+        if flavour is not None:
+            flavour = arch + f"-{flavour}"
+        else:
+            flavour = arch
+        for conf in configs:
+            if conf in c.config:
+                val = c.config[conf]
+            else:
+                val = "-"
+            if conf in self.config:
+                if "policy" in self.config[conf]:
+                    # Add a TODO if a config with a note is changing and print
+                    # a warning
+                    old_val = self.search_config(config=conf, arch=arch, flavour=flavour_arg)
+                    if old_val:
+                        old_val = old_val[conf]
+                    if val != old_val and "note" in self.config[conf]:
+                        self.config[conf]["note"] = "TODO: update note"
+                        print(f"WARNING: {conf} changed from {old_val} to {val}, updating note")
+                    self.config[conf]["policy"][flavour] = val
+                else:
+                    self.config[conf]["policy"] = {flavour: val}
+            else:
+                self.config[conf] = {"policy": {flavour: val}}
+
+    def _compact(self):
+        # Try to remove redundant settings: if the config value of a flavour is
+        # the same as the one of the main arch simply drop it.
+        for conf in self.config.copy():
+            if "policy" not in self.config[conf]:
+                continue
+            for flavour in self.flavour:
+                if flavour not in self.config[conf]["policy"]:
+                    continue
+                m = re.match(r"^(.*?)-(.*)$", flavour)
+                if not m:
+                    continue
+                arch = m.group(1)
+                if arch in self.config[conf]["policy"]:
+                    if self.config[conf]["policy"][flavour] == self.config[conf]["policy"][arch]:
+                        del self.config[conf]["policy"][flavour]
+                        continue
+                if flavour not in self.flavour_dep:
+                    continue
+                generic = self.flavour_dep[flavour]
+                if generic in self.config[conf]["policy"]:
+                    if self.config[conf]["policy"][flavour] == self.config[conf]["policy"][generic]:
+                        del self.config[conf]["policy"][flavour]
+                        continue
+            # Remove rules for flavours / arches that are not supported (not
+            # listed in the annotations header).
+            for flavour in self.config[conf]["policy"].copy():
+                if flavour not in list(set(self.arch + self.flavour)):
+                    del self.config[conf]["policy"][flavour]
+            # Remove configs that are all undefined across all arches/flavours
+            # (unless we have includes)
+            if not self.include:
+                if "policy" in self.config[conf]:
+                    if list(set(self.config[conf]["policy"].values())) == ["-"]:
+                        self.config[conf]["policy"] = {}
+            # Drop empty rules
+            if not self.config[conf]["policy"]:
+                del self.config[conf]
+            else:
+                # Compact same value across all flavour within the same arch
+                for arch in self.arch:
+                    arch_flavours = [i for i in self.flavour if i.startswith(arch)]
+                    value = None
+                    for flavour in arch_flavours:
+                        if flavour not in self.config[conf]["policy"]:
+                            break
+                        if value is None:
+                            value = self.config[conf]["policy"][flavour]
+                        elif value != self.config[conf]["policy"][flavour]:
+                            break
+                    else:
+                        for flavour in arch_flavours:
+                            del self.config[conf]["policy"][flavour]
+                        self.config[conf]["policy"][arch] = value
+        # After the first round of compaction we may end up having configs that
+        # are undefined across all arches, so do another round of compaction to
+        # drop these settings that are not needed anymore
+        # (unless we have includes).
+        if not self.include:
+            for conf in self.config.copy():
+                # Remove configs that are all undefined across all arches/flavours
+                if "policy" in self.config[conf]:
+                    if list(set(self.config[conf]["policy"].values())) == ["-"]:
+                        self.config[conf]["policy"] = {}
+                # Drop empty rules
+                if not self.config[conf]["policy"]:
+                    del self.config[conf]
+
+    @staticmethod
+    def _sorted(config):
+        """Sort configs alphabetically but return configs with a note first"""
+        w_note = []
+        wo_note = []
+        for c in sorted(config):
+            if "note" in config[c]:
+                w_note.append(c)
+            else:
+                wo_note.append(c)
+        return w_note + wo_note
+
+    def save(self, fname: str):
+        """Save annotations data to the annotation file"""
+        # Compact annotations structure
+        self._compact()
+
+        # Save annotations to disk
+        with tempfile.NamedTemporaryFile(mode="w+t", delete=False) as tmp:
+            # Write header
+            tmp.write(self.header + "\n")
+
+            # Write includes
+            for i in self.include:
+                tmp.write(f'include "{i}"\n')
+            if self.include:
+                tmp.write("\n")
+
+            # Write config annotations and notes
+            tmp.flush()
+            shutil.copy(tmp.name, fname)
+            tmp_a = Annotation(fname)
+
+            # Only save local differences (preserve includes)
+            marker = False
+            for conf in self._sorted(self.config):
+                new_val = self.config[conf]
+                if "policy" not in new_val:
+                    continue
+
+                # If new_val is a subset of old_val, skip it unless there are
+                # new notes that are different than the old ones.
+                old_val = tmp_a.config.get(conf)
+                if old_val and "policy" in old_val:
+                    try:
+                        can_skip = old_val["policy"] == old_val["policy"] | new_val["policy"]
+                    except TypeError:
+                        can_skip = old_val["policy"] == {
+                            **old_val["policy"],
+                            **new_val["policy"],
+                        }
+                    if can_skip:
+                        if "note" not in new_val:
+                            continue
+                        if "note" in old_val and "note" in new_val:
+                            if old_val["note"] == new_val["note"]:
+                                continue
+
+                # Write out the policy (and note) line(s)
+                val = dict(sorted(new_val["policy"].items()))
+                line = f"{conf: <47} policy<{val}>"
+                if "note" in new_val:
+                    val = new_val["note"]
+                    if new_val.get("oneline", False):
+                        # Single line
+                        line += f" note<{val}>"
+                    else:
+                        # Separate policy and note lines,
+                        # followed by an empty line
+                        line += f"\n{conf: <47} note<{val}>\n"
+                elif not marker:
+                    # Write out a marker indicating the start of annotations
+                    # without notes
+                    tmp.write("\n# ---- Annotations without notes ----\n\n")
+                    marker = True
+                tmp.write(line + "\n")
+
+            # Replace annotations with the updated version
+            tmp.flush()
+            shutil.move(tmp.name, fname)
+
+    def search_config(self, config: str = None, arch: str = None, flavour: str = None) -> dict:
+        """Return config value of a specific config option or architecture"""
+        if flavour is None:
+            flavour = "generic"
+        flavour = f"{arch}-{flavour}"
+        if flavour in self.flavour_dep:
+            generic = self.flavour_dep[flavour]
+        else:
+            generic = flavour
+        if config is None and arch is None:
+            # Get all config options for all architectures
+            return self.config
+        if config is None and arch is not None:
+            # Get config options of a specific architecture
+            ret = {}
+            for c, val in self.config.items():
+                if "policy" not in val:
+                    continue
+                if flavour in val["policy"]:
+                    ret[c] = val["policy"][flavour]
+                elif generic != flavour and generic in val["policy"]:
+                    ret[c] = val["policy"][generic]
+                elif arch in val["policy"]:
+                    ret[c] = val["policy"][arch]
+            return ret
+        if config is not None and arch is None:
+            # Get a specific config option for all architectures
+            return self.config[config] if config in self.config else None
+        if config is not None and arch is not None:
+            # Get a specific config option for a specific architecture
+            if config in self.config:
+                if "policy" in self.config[config]:
+                    if flavour in self.config[config]["policy"]:
+                        return {config: self.config[config]["policy"][flavour]}
+                    if generic != flavour and generic in self.config[config]["policy"]:
+                        return {config: self.config[config]["policy"][generic]}
+                    if arch in self.config[config]["policy"]:
+                        return {config: self.config[config]["policy"][arch]}
+        return None
+
+    @staticmethod
+    def to_config(data: dict) -> str:
+        """Convert annotations data to .config format"""
+        s = ""
+        for c in data:
+            v = data[c]
+            if v == "n":
+                s += f"# {c} is not set\n"
+            elif v == "-":
+                pass
+            else:
+                s += f"{c}={v}\n"
+        return s.rstrip()
--- linux-qcom-6.8.0.orig/debian/scripts/misc/kconfig/run.py
+++ linux-qcom-6.8.0/debian/scripts/misc/kconfig/run.py
@@ -0,0 +1,370 @@
+# -*- mode: python -*-
+# Manage Ubuntu kernel .config and annotations
+# Copyright © 2022 Canonical Ltd.
+
+import sys
+import os
+import argparse
+import json
+from signal import signal, SIGPIPE, SIG_DFL
+
+try:
+    from argcomplete import autocomplete
+except ModuleNotFoundError:
+    # Allow to run this program also when argcomplete is not available
+    def autocomplete(_unused):
+        pass
+
+
+from kconfig.annotations import Annotation, KConfig  # noqa: E402 Import not at top of file
+from kconfig.utils import autodetect_annotations, arg_fail  # noqa: E402 Import not at top of file
+from kconfig.version import VERSION, ANNOTATIONS_FORMAT_VERSION  # noqa: E402 Import not at top of file
+
+
+SKIP_CONFIGS = (
+    # CONFIG_VERSION_SIGNATURE is dynamically set during the build
+    "CONFIG_VERSION_SIGNATURE",
+    # Allow to use a different versions of toolchain tools
+    "CONFIG_GCC_VERSION",
+    "CONFIG_CC_VERSION_TEXT",
+    "CONFIG_AS_VERSION",
+    "CONFIG_LD_VERSION",
+    "CONFIG_LLD_VERSION",
+    "CONFIG_CLANG_VERSION",
+    "CONFIG_PAHOLE_VERSION",
+    "CONFIG_RUSTC_VERSION_TEXT",
+    "CONFIG_BINDGEN_VERSION_TEXT",
+)
+
+
+def make_parser():
+    parser = argparse.ArgumentParser(
+        description="Manage Ubuntu kernel .config and annotations",
+    )
+    parser.add_argument("--version", "-v", action="version", version=f"%(prog)s {VERSION}")
+
+    parser.add_argument(
+        "--file",
+        "-f",
+        action="store",
+        help="Pass annotations or .config file to be parsed",
+    )
+    parser.add_argument("--arch", "-a", action="store", help="Select architecture")
+    parser.add_argument("--flavour", "-l", action="store", help='Select flavour (default is "generic")')
+    parser.add_argument("--config", "-c", action="store", help="Select a specific config option")
+    parser.add_argument("--query", "-q", action="store_true", help="Query annotations")
+    parser.add_argument(
+        "--note",
+        "-n",
+        action="store",
+        help="Write a specific note to a config option in annotations",
+    )
+    parser.add_argument(
+        "--autocomplete",
+        action="store_true",
+        help="Enable config bash autocomplete: `source <(annotations --autocomplete)`",
+    )
+    parser.add_argument(
+        "--source",
+        "-t",
+        action="store_true",
+        help="Jump to a config definition in the kernel source code",
+    )
+    parser.add_argument(
+        "--no-include",
+        action="store_true",
+        help="Do not process included annotations (stop at the main file)",
+    )
+    parser.add_argument(
+        "--json",
+        action="store_true",
+        help="Try to parse annotations file in pure JSON format",
+    )
+
+    ga = parser.add_argument_group(title="Action").add_mutually_exclusive_group(required=False)
+    ga.add_argument(
+        "--write",
+        "-w",
+        action="store",
+        metavar="VALUE",
+        dest="value",
+        help="Set a specific config value in annotations (use 'null' to remove)",
+    )
+    ga.add_argument(
+        "--export",
+        "-e",
+        action="store_true",
+        help="Convert annotations to .config format",
+    )
+    ga.add_argument(
+        "--import",
+        "-i",
+        action="store",
+        metavar="FILE",
+        dest="import_file",
+        help="Import a full .config for a specific arch and flavour into annotations",
+    )
+    ga.add_argument(
+        "--update",
+        "-u",
+        action="store",
+        metavar="FILE",
+        dest="update_file",
+        help="Import a partial .config into annotations (only resync configs specified in FILE)",
+    )
+    ga.add_argument(
+        "--check",
+        "-k",
+        action="store",
+        metavar="FILE",
+        dest="check_file",
+        help="Validate kernel .config with annotations",
+    )
+    return parser
+
+
+_ARGPARSER = make_parser()
+
+
+def export_result(data):
+    # Dump metadata / attributes first
+    out = '{\n  "attributes": {\n'
+    for key, value in sorted(data["attributes"].items()):
+        out += f'     "{key}": {json.dumps(value)},\n'
+    out = out.rstrip(",\n")
+    out += "\n  },"
+    print(out)
+
+    configs_with_note = {key: value for key, value in data["config"].items() if "note" in value}
+    configs_without_note = {key: value for key, value in data["config"].items() if "note" not in value}
+
+    # Dump configs, sorted alphabetically, showing items with a note first
+    out = '  "config": {\n'
+    for key in sorted(configs_with_note) + sorted(configs_without_note):
+        policy = data["config"][key]["policy"]
+        if "note" in data["config"][key]:
+            note = data["config"][key]["note"]
+            out += f'    "{key}": {{"policy": {json.dumps(policy)}, "note": {json.dumps(note)}}},\n'
+        else:
+            out += f'    "{key}": {{"policy": {json.dumps(policy)}}},\n'
+    out = out.rstrip(",\n")
+    out += "\n  }\n}"
+    print(out)
+
+
+def print_result(config, data):
+    if data is not None and config is not None and config not in data:
+        data = {config: data}
+    print(json.dumps(data, sort_keys=True, indent=2))
+
+
+def do_query(args):
+    if args.arch is None and args.flavour is not None:
+        arg_fail(_ARGPARSER, "error: --flavour requires --arch")
+    a = Annotation(args.file, do_include=(not args.no_include), do_json=args.json)
+    res = a.search_config(config=args.config, arch=args.arch, flavour=args.flavour)
+    # If no arguments are specified dump the whole annotations structure
+    if args.config is None and args.arch is None and args.flavour is None:
+        res = {
+            "attributes": {
+                "arch": a.arch,
+                "flavour": a.flavour,
+                "flavour_dep": a.flavour_dep,
+                "include": a.include,
+                "_version": ANNOTATIONS_FORMAT_VERSION,
+            },
+            "config": res,
+        }
+        export_result(res)
+    else:
+        print_result(args.config, res)
+
+
+def do_autocomplete(args):
+    a = Annotation(args.file)
+    res = (c.removeprefix("CONFIG_") for c in a.search_config())
+    res_str = " ".join(res)
+    print(f'complete -W "{res_str}" annotations')
+
+
+def do_source(args):
+    if args.config is None:
+        arg_fail(_ARGPARSER, "error: --source requires --config")
+    if not os.path.exists("tags"):
+        print("tags not found in the current directory, try: `make tags`")
+        sys.exit(1)
+    os.system(f"vim -t {args.config}")
+
+
+def do_note(args):
+    if args.config is None:
+        arg_fail(_ARGPARSER, "error: --note requires --config")
+
+    # Set the note in annotations
+    a = Annotation(args.file)
+    a.set(args.config, note=args.note)
+
+    # Save back to annotations
+    a.save(args.file)
+
+    # Query and print back the value
+    a = Annotation(args.file)
+    res = a.search_config(config=args.config)
+    print_result(args.config, res)
+
+
+def do_write(args):
+    if args.config is None:
+        arg_fail(_ARGPARSER, "error: --write requires --config")
+
+    # Set the value in annotations ('null' means remove)
+    a = Annotation(args.file)
+    if args.value == "null":
+        a.remove(args.config, arch=args.arch, flavour=args.flavour)
+    else:
+        a.set(
+            args.config,
+            arch=args.arch,
+            flavour=args.flavour,
+            value=args.value,
+            note=args.note,
+        )
+
+    # Save back to annotations
+    a.save(args.file)
+
+    # Query and print back the value
+    a = Annotation(args.file)
+    res = a.search_config(config=args.config)
+    print_result(args.config, res)
+
+
+def do_export(args):
+    if args.arch is None:
+        arg_fail(_ARGPARSER, "error: --export requires --arch")
+    a = Annotation(args.file)
+    conf = a.search_config(config=args.config, arch=args.arch, flavour=args.flavour)
+    if conf:
+        print(a.to_config(conf))
+
+
+def do_import(args):
+    if args.arch is None:
+        arg_fail(_ARGPARSER, "error: --arch is required with --import")
+    if args.flavour is None:
+        arg_fail(_ARGPARSER, "error: --flavour is required with --import")
+    if args.config is not None:
+        arg_fail(_ARGPARSER, "error: --config cannot be used with --import (try --update)")
+
+    # Merge with the current annotations
+    a = Annotation(args.file)
+    c = KConfig(args.import_file)
+    a.update(c, arch=args.arch, flavour=args.flavour)
+
+    # Save back to annotations
+    a.save(args.file)
+
+
+def do_update(args):
+    if args.arch is None:
+        arg_fail(_ARGPARSER, "error: --arch is required with --update")
+
+    # Merge with the current annotations
+    a = Annotation(args.file)
+    c = KConfig(args.update_file)
+    if args.config is None:
+        configs = list(set(c.config.keys()) - set(SKIP_CONFIGS))
+    if configs:
+        a.update(c, arch=args.arch, flavour=args.flavour, configs=configs)
+
+    # Save back to annotations
+    a.save(args.file)
+
+
+def do_check(args):
+    # Determine arch and flavour
+    if args.arch is None:
+        arg_fail(_ARGPARSER, "error: --arch is required with --check")
+
+    print(f"check-config: loading annotations from {args.file}")
+    total = good = ret = 0
+
+    # Load annotations settings
+    a = Annotation(args.file)
+    a_configs = a.search_config(arch=args.arch, flavour=args.flavour).keys()
+
+    # Parse target .config
+    c = KConfig(args.check_file)
+    c_configs = c.config.keys()
+
+    # Validate .config against annotations
+    for conf in sorted(a_configs | c_configs):
+        if conf in SKIP_CONFIGS:
+            continue
+        entry = a.search_config(config=conf, arch=args.arch, flavour=args.flavour)
+        expected = entry[conf] if entry else "-"
+        value = c.config[conf] if conf in c.config else "-"
+        if value != expected:
+            policy = a.config[conf] if conf in a.config else "undefined"
+            if "policy" in policy:
+                policy = f"policy<{policy['policy']}>"
+            print(f"check-config: {conf} changed from {expected} to {value}: {policy})")
+            ret = 1
+        else:
+            good += 1
+        total += 1
+
+    num = total - good
+    if ret:
+        if os.path.exists(".git"):
+            print(f"check-config: {num} config options have been changed, review them with `git diff`")
+        else:
+            print(f"check-config: {num} config options have changed")
+    else:
+        print("check-config: all good")
+    sys.exit(ret)
+
+
+def main():
+    # Prevent broken pipe errors when showing output in pipe to other tools
+    # (less for example)
+    signal(SIGPIPE, SIG_DFL)
+
+    # Main annotations program
+    autocomplete(_ARGPARSER)
+    args = _ARGPARSER.parse_args()
+
+    if args.file is None:
+        args.file = autodetect_annotations()
+        if args.file is None:
+            arg_fail(
+                _ARGPARSER,
+                "error: could not determine DEBDIR, try using: --file/-f",
+                show_usage=False,
+            )
+
+    if args.config and not args.config.startswith("CONFIG_"):
+        args.config = "CONFIG_" + args.config
+
+    if args.value:
+        do_write(args)
+    elif args.note:
+        do_note(args)
+    elif args.export:
+        do_export(args)
+    elif args.import_file:
+        do_import(args)
+    elif args.update_file:
+        do_update(args)
+    elif args.check_file:
+        do_check(args)
+    elif args.autocomplete:
+        do_autocomplete(args)
+    elif args.source:
+        do_source(args)
+    else:
+        do_query(args)
+
+
+if __name__ == "__main__":
+    main()
--- linux-qcom-6.8.0.orig/debian/scripts/misc/kconfig/utils.py
+++ linux-qcom-6.8.0/debian/scripts/misc/kconfig/utils.py
@@ -0,0 +1,20 @@
+# -*- mode: python -*-
+# Misc helpers for Kconfig and annotations
+# Copyright © 2023 Canonical Ltd.
+
+import sys
+
+
+def autodetect_annotations():
+    try:
+        with open("debian/debian.env", "rt", encoding="utf-8") as fd:
+            return fd.read().rstrip().split("=")[1] + "/config/annotations"
+    except (FileNotFoundError, IndexError):
+        return None
+
+
+def arg_fail(parser, message, show_usage=True):
+    print(message)
+    if show_usage:
+        parser.print_usage()
+    sys.exit(1)
--- linux-qcom-6.8.0.orig/debian/scripts/misc/kconfig/version.py
+++ linux-qcom-6.8.0/debian/scripts/misc/kconfig/version.py
@@ -0,0 +1,10 @@
+# -*- mode: python -*-
+# version of annotations module
+# Copyright © 2022 Canonical Ltd.
+
+VERSION = "0.1"
+
+ANNOTATIONS_FORMAT_VERSION = 5
+
+if __name__ == "__main__":
+    print(VERSION)
--- linux-qcom-6.8.0.orig/debian/scripts/misc/kernelconfig
+++ linux-qcom-6.8.0/debian/scripts/misc/kernelconfig
@@ -0,0 +1,178 @@
+#!/bin/bash -u
+#
+# Manage kernel config annotations
+#
+# Supported environment variales:
+#   conc_level  : Concurrency level for upstream make (-jX)
+#   skip_checks : Skip config checks if set to 'true'
+#   gcc         : Default gcc to use (mandatory)
+#
+
+function cleanup()
+{
+	rm -rf build "${TMP_DIR}"
+}
+
+# We have to be in the top level Ubuntu kernel source directory
+if ! [ -e debian/debian.env ] ; then
+	echo "ERROR: This is not an Ubuntu kernel source directory" >&2
+	exit 1
+fi
+
+if [ -z "${gcc:-}" ] ; then
+	echo "ERROR: 'gcc' environment variable must be set" >&2
+	exit 1
+fi
+
+if [ ${#} -ne 1 ] ; then
+	echo "Usage: $0 updateconfigs|defaultconfigs|genconfigs|editconfigs"
+	exit 2
+fi
+
+mode=${1}
+
+case "${mode}" in
+	updateconfigs)  target="syncconfig" ;;
+	defaultconfigs) target="olddefconfig" ;;
+	genconfigs)     target="oldconfig" ;;
+	editconfigs)    ;;  # Target is set later based on user input
+	*) echo "ERROR: Invalid mode: ${1}" >&2
+	   exit 1 ;;
+esac
+
+. debian/debian.env
+
+annotations_file=${DEBIAN}/config/annotations
+warning_partial=()
+
+TMP_DIR=$(mktemp -d)
+trap cleanup EXIT
+
+# Use annotations to generate configs
+FLAVOURS=$(sed -ne 's/^# FLAVOUR: //p' "${annotations_file}")
+
+for arch_flavour in ${FLAVOURS} ; do
+	arch=${arch_flavour%%-*}
+	flavour=${arch_flavour#*-}
+	tmp_conf_file=${TMP_DIR}/${arch}-config.flavour.${flavour}
+
+	# Map debian archs to kernel archs
+	case "${arch}" in
+		amd64)   kern_arch="x86_64" ;;
+		arm64)   kern_arch="arm64" ;;
+		armhf)   kern_arch="arm" ;;
+		ppc64el) kern_arch="powerpc" ;;
+		riscv64) kern_arch="riscv" ;;
+		s390x)   kern_arch="s390" ;;
+		*)       echo "WARNING: Unsupported architecture: ${arch}"
+		         warning_partial+=("${arch}")
+		         continue ;;
+	esac
+
+	# Determine cross toolchain to use for Kconfig compiler tests
+	cross_compile="$(dpkg-architecture -qDEB_HOST_GNU_TYPE -a"${arch}" 2>/dev/null)-"
+
+	# Arch-specific compiler, if any
+	arch_gcc=$(cat <<EOF | make -s -f - all
+include ${DEBIAN}/rules.d/${arch}.mk
+all:
+	@echo \$(if \$(gcc),\$(gcc),${gcc})
+EOF
+			)
+	gcc_path=$(which "${cross_compile}${arch_gcc}" || true)
+	if [ -z "${gcc_path}" ] ; then
+		echo "WARNING: ${cross_compile}${arch_gcc} not installed"
+		warning_partial+=("${arch}")
+		continue
+	fi
+
+	if [ "${mode}" = "editconfigs" ] ; then
+		while true ; do
+			echo -n "Do you want to edit configs for ${arch}-${flavour}? [Y/n] "
+			read -r choice
+			case "${choice,,}" in
+				y|"") target="menuconfig" ; break ;;
+				n)    target="syncconfig" ; break ;;
+			esac
+		done
+	fi
+
+	rm -rf build
+	mkdir build
+
+	# Generate .config from annotations
+	python3 debian/scripts/misc/annotations -f "${annotations_file}" \
+			--arch "${arch}" --flavour "${flavour}" --export > build/.config
+
+	# Environment variables for 'make *config'
+	env=(ARCH="${kern_arch}"
+		 DEB_ARCH="${arch}"
+		 CROSS_COMPILE="${cross_compile}"
+		 CC="${gcc_path}")
+
+	# Concurrency level
+	if [ -n "${conc_level:-}" ] ; then
+		env+=("${conc_level}")
+	fi
+
+	# Call config target
+	echo
+	echo "* Run ${target} on ${arch}/${flavour} ..."
+	${kmake} O=build "${env[@]}" "${target}"
+
+	# Move config for further processing
+	mv build/.config "${tmp_conf_file}"
+done
+
+rc=0
+
+if [ "${skip_checks:-}" = "true" ] ; then
+	echo
+	echo "Skipping config-check (skip_checks=${skip_checks}) ..."
+else
+	echo
+	echo "Running config-check for all configurations ..."
+	fail=0
+	for arch_flavour in ${FLAVOURS} ; do
+		arch=${arch_flavour%%-*}
+		flavour=${arch_flavour#*-}
+		tmp_conf_file=${TMP_DIR}/${arch}-config.flavour.${flavour}
+
+		echo
+		echo "* Run config-check for ${arch}-${flavour} ..."
+		python3 debian/scripts/misc/annotations -f "${annotations_file}" \
+				--arch "${arch}" --flavour "${flavour}" --check "${tmp_conf_file}" || \
+			fail=$((fail + 1))
+	done
+
+	if [ ${fail} -gt 0 ] ; then
+		rc=1
+		echo "ERROR: ${fail} config-check failures detected" >&2
+	fi
+fi
+
+if [ ${#warning_partial[@]} -gt 0 ] ; then
+	rc=1
+	echo "ERROR: Config operation not applied to all architectures (skipped ${warning_partial[*]})" >&2
+fi
+
+# Recreate the annotations file
+if [ "${mode}" = "genconfigs" ] ; then
+	rm -rf CONFIGS
+	mv "${TMP_DIR}" CONFIGS
+else
+	echo
+	echo "Importing all configurations ..."
+	echo
+	for arch_flavour in ${FLAVOURS} ; do
+		arch=${arch_flavour%%-*}
+		flavour=${arch_flavour#*-}
+		tmp_conf_file=${TMP_DIR}/${arch}-config.flavour.${flavour}
+
+		echo "* Import configs for ${arch}-${flavour} ..."
+		python3 debian/scripts/misc/annotations -f "${annotations_file}" \
+				--arch "${arch}" --flavour "${flavour}" --import "${tmp_conf_file}"
+	done
+fi
+
+exit "${rc}"
--- linux-qcom-6.8.0.orig/debian/scripts/module-inclusion
+++ linux-qcom-6.8.0/debian/scripts/module-inclusion
@@ -0,0 +1,104 @@
+#!/bin/bash
+
+#
+# Build a new directory of modules based on an inclusion list.
+# The includsion list format must be a bash regular expression.
+#
+# usage: $0 ROOT INCLUSION_LIST
+# example: $0 \
+#       debian/build/build-virtual-ALL debian/build/build-virtual \
+#	debian.master/control.d/virtual.inclusion-list \
+#	virtual.depmap
+master=0
+if [ "$1" = "--master" ]; then
+	master=1
+	shift
+fi
+
+ROOT=$1
+NROOT=$2
+ILIST=$3
+DEPMAP=$4
+
+tmp="/tmp/module-inclusion.$$"
+
+#
+# Prep a destination directory.
+#
+mkdir -p ${NROOT}
+
+{
+	# Copy over the framework into the master package.
+	if  [ "$master" -eq 1 ]; then
+		(cd ${ROOT}; find . ! -name "*.ko" -type f)
+	fi
+
+	# Copy over modules by name or pattern.
+	while read -r i
+	do
+		#
+		# 'find' blurts a warning if it cannot find any ko files.
+		#
+		case "$i" in
+		\!*)
+			(cd ${ROOT}; ${i#!} || true)
+			;;
+		*\**)
+			(cd ${ROOT}; eval find "${i}" -name "*.ko" || true)
+			;;
+		*)
+			echo "$i"
+			;;
+		esac
+	done <"${ILIST}"
+} >"$tmp"
+
+# Copy over the listed modules.
+while read i
+do
+	# If this is already moved over, all is good.
+	if [ -f "${NROOT}/$i" ]; then
+		:
+
+	# If present in the source, moved it over.
+	elif [ -f "${ROOT}/$i" ]; then
+		mkdir -p "${NROOT}/`dirname $i`"
+		mv "${ROOT}/$i" "${NROOT}/$i"
+
+	# Otherwise, it is missing.
+	else
+		echo "Warning: Could not find ${ROOT}/$i" 1>&2
+	fi
+done <"$tmp"
+
+# Copy over any dependancies, note if those are missing
+# we know they are in a pre-requisite package as they must
+# have existed at depmap generation time, and can only have
+# moved into a package.
+let n=0 || true
+while [ -s "$tmp" ]
+do
+	let n="$n+1" || true
+	[ "$n" = "20" ] && break || true
+
+	echo "NOTE: pass $n: dependency scan" 1>&2
+
+	while read i
+	do
+		grep "^$i " "$DEPMAP" | \
+		while read m d
+		do
+			if [ -f "${ROOT}/$d" ]; then
+				echo "NOTE: pass $n: ${i} pulls in ${d}" 1>&2
+				echo "$d"
+				mkdir -p "${NROOT}/`dirname $d`"
+				mv "${ROOT}/$d" "${NROOT}/$d"
+			fi
+		done
+	done <"$tmp" >"$tmp.new"
+	mv -f "$tmp.new" "$tmp"
+done
+
+rm -f "$tmp"
+
+exit 0
--- linux-qcom-6.8.0.orig/debian/scripts/sign-module
+++ linux-qcom-6.8.0/debian/scripts/sign-module
@@ -0,0 +1,40 @@
+#!/bin/bash -eu
+#
+# Staging drivers must not be signed if they are not listed in a
+# signature-inclusion file to prevent loading of 'unsafe' drivers in a
+# Secure Boot environment.
+#
+# Exit with status 0 if the provided module needs to be signed, 1 otherwise
+#
+
+mod=${1}
+
+# Sign the module if not a staging driver
+if [ "${mod/\/drivers\/staging\//}" = "${mod}" ] ; then
+	exit 0
+fi
+
+root=$(dirname "$(realpath -e "${0}")")/../..
+. "${root}"/debian/debian.env
+
+# Collect the signature-inclusion files
+sig_incls=()
+for d in debian "${DEBIAN}" ; do
+	if [ -f "${root}"/"${d}"/signature-inclusion ] ; then
+		sig_incls+=("${root}"/"${d}"/signature-inclusion)
+	fi
+done
+
+# Sign the module if no signature-inclusion files
+if [ ${#sig_incls[@]} -eq 0 ] ; then
+	exit 0
+fi
+
+# Sign the module if listed in signature-inclusion files
+if grep -qFx "${mod##*/}" "${sig_incls[@]}" ; then
+	exit 0
+fi
+
+# Don't sign the module
+echo "UBUNTU: Not signing ${1}"
+exit 1
--- linux-qcom-6.8.0.orig/debian/signature-inclusion
+++ linux-qcom-6.8.0/debian/signature-inclusion
@@ -0,0 +1,12 @@
+#
+# This file lists the staging drivers that are safe for signing
+# and loading in a secure boot environment with signed module enforcement.
+#
+r8188eu.ko
+r8192e_pci.ko
+r8192u_usb.ko
+r8712u.ko
+rtllib_crypt_ccmp.ko
+rtllib_crypt_tkip.ko
+rtllib_crypt_wep.ko
+rtllib.ko
--- linux-qcom-6.8.0.orig/debian/snapcraft.mk
+++ linux-qcom-6.8.0/debian/snapcraft.mk
@@ -0,0 +1,11 @@
+ifeq ($(ARCH),)
+  arch := $(shell uname -m | sed -e s/i.86/i386/ -e s/x86_64/amd64/ \
+            -e s/arm.*/armhf/ -e s/s390/s390x/ -e s/ppc.*/powerpc/ \
+            -e s/aarch64.*/arm64/ )
+else ifeq ($(ARCH),arm)
+  arch := armhf
+else
+  arch := $(ARCH)
+endif
+config:
+	python3 debian/scripts/misc/annotations --export --arch $(arch) --flavour $(flavour) >.config
--- linux-qcom-6.8.0.orig/debian/source/format
+++ linux-qcom-6.8.0/debian/source/format
@@ -0,0 +1 @@
+1.0
--- linux-qcom-6.8.0.orig/debian/source/options
+++ linux-qcom-6.8.0/debian/source/options
@@ -0,0 +1,9 @@
+# Ignore vbox symlinks, we will regenerate these at clean (LP:1426113)
+## autoreconstruct -- begin
+# Ignore any symlinks created since the orig which are rebuilt by reconstruct.
+extend-diff-ignore=^include/dt-bindings/arm/qcom_dma_heap_dt_constants.h$
+## autoreconstruct -- end
+
+# force "dpkg-source -I -i" behavior
+diff-ignore
+tar-ignore
--- linux-qcom-6.8.0.orig/debian/templates/extra.postinst.in
+++ linux-qcom-6.8.0/debian/templates/extra.postinst.in
@@ -0,0 +1,20 @@
+#!/bin/sh
+set -e
+
+version=@abiname@@localversion@
+image_path=/boot/@image-stem@-$version
+
+if [ "$1" != configure ]; then
+    exit 0
+fi
+
+depmod -a -F /boot/System.map-$version $version || true
+if [ -d /etc/kernel/postinst.d ]; then
+    cat - >/usr/lib/linux/triggers/$version <<EOF
+DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
+	    --arg="$image_path" /etc/kernel/postinst.d
+EOF
+    dpkg-trigger --no-await linux-update-$version
+fi
+
+exit 0
--- linux-qcom-6.8.0.orig/debian/templates/extra.postrm.in
+++ linux-qcom-6.8.0/debian/templates/extra.postrm.in
@@ -0,0 +1,31 @@
+#!/bin/sh
+set -e
+
+version=@abiname@@localversion@
+image_path=/boot/@image-stem@-$version
+
+if [ "$1" != remove ]; then
+    exit 0
+fi
+
+depmod -a -F /boot/System.map-$version $version 2>/dev/null || true
+#
+# We should be rebuilding the initramfs here on removal to pare down the
+# initramfs if it contains any of the objects we just removed.  But people
+# commonly remove kernels in order to free space in /boot, and rebuilding the
+# initramfs now risks ENOSPC when we are trying to make space.  The files we
+# leave lying about could be confusing, but we trade that against safety on
+# removal.
+#
+#if [ -d /etc/kernel/postinst.d ]; then
+#    # We want to behave as if linux-image (without us) was installed, therefore
+#    # we do not want the postinst support to know we are being removed, claim
+#    # this is an installation event.
+#    cat - >/usr/lib/linux/triggers/$version <<EOF
+#DEB_MAINT_PARAMS="configure" run-parts --report --exit-on-error --arg=$version \
+#	--arg="$image_path" /etc/kernel/postinst.d
+#EOF
+#    dpkg-trigger --no-await linux-update-$version
+#fi
+
+exit 0
--- linux-qcom-6.8.0.orig/debian/templates/headers.postinst.in
+++ linux-qcom-6.8.0/debian/templates/headers.postinst.in
@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+version=@abiname@@localversion@
+
+if [ "$1" != configure ]; then
+    exit 0
+fi
+
+if [ -d /etc/kernel/header_postinst.d ]; then
+    DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
+		/etc/kernel/header_postinst.d
+fi
+
+exit 0
--- linux-qcom-6.8.0.orig/debian/templates/image.postinst.in
+++ linux-qcom-6.8.0/debian/templates/image.postinst.in
@@ -0,0 +1,62 @@
+#!/bin/sh
+set -e
+
+version=@abiname@@localversion@
+image_path=/boot/@image-stem@-$version
+
+#
+# When we install linux-image we have to run kernel postinst.d support to
+# generate the initramfs, create links etc.  Should it have an associated
+# linux-image-extra package and we install that we also need to run kernel
+# postinst.d, to regenerate the initramfs.  If we are installing both at the
+# same time, we necessarily trigger kernel postinst.d twice. As this includes
+# rebuilding the initramfs and reconfiguring the boot loader this is very time
+# consuming.
+#
+# Similarly for removal when we remove the linux-image-extra package we need to
+# run kernel postinst.d handling in order to pare down the initramfs to
+# linux-image contents only.  When we remove the linux-image need to remove the
+# now redundant initramfs.  If we are removing both at the same time, then
+# we will rebuilt the initramfs and then immediatly remove it.
+#
+# Switches to using a trigger against the linux-image package for all
+# postinst.d and postrm.d handling.  On installation postinst.d gets triggered
+# twice once by linux-image and once by linux-image-extra.  As triggers are
+# non-cumulative we will only run this processing once.  When removing both
+# packages we will trigger postinst.d from linux-image-extra and then in
+# linux-image postrm.d we effectivly ignore the pending trigger and simply run
+# the postrm.d.  This prevents us from rebuilding the initramfs.
+#
+if [ "$1" = triggered ]; then
+    trigger=/usr/lib/linux/triggers/$version
+    if [ -f "$trigger" ]; then
+	sh "$trigger"
+	rm -f "$trigger"
+    fi
+    exit 0
+fi
+
+if [ "$1" != configure ]; then
+    exit 0
+fi
+
+depmod $version
+
+if [ -f /lib/modules/$version/.fresh-install ]; then
+    change=install
+else
+    change=upgrade
+fi
+linux-update-symlinks $change $version $image_path
+rm -f /lib/modules/$version/.fresh-install
+
+if [ -d /etc/kernel/postinst.d ]; then
+    mkdir -p /usr/lib/linux/triggers
+    cat - >/usr/lib/linux/triggers/$version <<EOF
+DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
+      --arg=$image_path /etc/kernel/postinst.d
+EOF
+    dpkg-trigger --no-await linux-update-$version
+fi
+
+exit 0
--- linux-qcom-6.8.0.orig/debian/templates/image.postrm.in
+++ linux-qcom-6.8.0/debian/templates/image.postrm.in
@@ -0,0 +1,40 @@
+#!/bin/sh
+set -e
+
+version=@abiname@@localversion@
+image_path=/boot/@image-stem@-$version
+
+rm -f /lib/modules/$version/.fresh-install
+
+if [ "$1" != upgrade ] && command -v linux-update-symlinks >/dev/null; then
+    linux-update-symlinks remove $version $image_path
+fi
+
+if [ -d /etc/kernel/postrm.d ]; then
+    # We cannot trigger ourselves as at the end of this we will no longer
+    # exist and can no longer respond to the trigger.  The trigger would
+    # then become lost.  Therefore we clear any pending trigger and apply
+    # postrm directly.
+    if [ -f /usr/lib/linux/triggers/$version ]; then
+	echo "$0 ... removing pending trigger"
+	rm -f /usr/lib/linux/triggers/$version
+    fi
+    DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
+	      --arg=$image_path /etc/kernel/postrm.d
+fi
+
+if [ "$1" = purge ]; then
+    for extra_file in modules.dep modules.isapnpmap modules.pcimap \
+                      modules.usbmap modules.parportmap \
+                      modules.generic_string modules.ieee1394map \
+                      modules.ieee1394map modules.pnpbiosmap \
+                      modules.alias modules.ccwmap modules.inputmap \
+                      modules.symbols modules.ofmap \
+                      modules.seriomap modules.\*.bin \
+		      modules.softdep modules.devname; do
+	eval rm -f /lib/modules/$version/$extra_file
+    done
+    rmdir /lib/modules/$version || true
+fi
+
+exit 0
--- linux-qcom-6.8.0.orig/debian/templates/image.preinst.in
+++ linux-qcom-6.8.0/debian/templates/image.preinst.in
@@ -0,0 +1,22 @@
+#!/bin/sh
+set -e
+
+version=@abiname@@localversion@
+image_path=/boot/@image-stem@-$version
+
+if [ "$1" = abort-upgrade ]; then
+    exit 0
+fi
+
+if [ "$1" = install ]; then
+    # Create a flag file for postinst
+    mkdir -p /lib/modules/$version
+    touch /lib/modules/$version/.fresh-install
+fi
+
+if [ -d /etc/kernel/preinst.d ]; then
+    DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
+	      --arg=$image_path /etc/kernel/preinst.d
+fi
+
+exit 0
--- linux-qcom-6.8.0.orig/debian/templates/image.prerm.in
+++ linux-qcom-6.8.0/debian/templates/image.prerm.in
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -e
+
+version=@abiname@@localversion@
+image_path=/boot/@image-stem@-$version
+
+if [ "$1" != remove ]; then
+    exit 0
+fi
+
+linux-check-removal $version
+
+if [ -d /etc/kernel/prerm.d ]; then
+    DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
+	      --arg=$image_path /etc/kernel/prerm.d
+fi
+
+exit 0
--- linux-qcom-6.8.0.orig/debian/tests-build/README
+++ linux-qcom-6.8.0/debian/tests-build/README
@@ -0,0 +1,21 @@
+Scripts placed in this directory get called one at a time by run-parts(8).
+The scripts are expected to perform some sort of sanity checks on the
+finished build. Scripts will be called once for each flavour.
+
+Some environment variables are exported to make life a little easier:
+
+DPKG_ARCH     : The dpkg architecture (e.g. "amd64")
+KERN_ARCH     : The kernel architecture (e.g. "x86_64")
+FLAVOUR       : The specific flavour for this run (e.g. "generic")
+VERSION       : The full version of this build (e.g. 2.6.22-1)
+REVISION      : The exact revision of this build (e.g. 1.3)
+PREV_REVISION : The revision prior to this one
+ABI_NUM       : The specific ABI number for this build (e.g. 2)
+PREV_ABI_NUM  : The previous ABI number. Can be the same as ABI_NUM.
+BUILD_DIR     : The directory where this build took place
+INSTALL_DIR   : The directory where the package is prepared
+SOURCE_DIR    : Where the main kernel source is
+
+Scripts are expected to have a zero exit status when no problems occur,
+and non-zero when an error occurs that should stop the build. Scripts
+should print whatever info they deem needed to deduce the problem.
--- linux-qcom-6.8.0.orig/debian/tests-build/check-aliases
+++ linux-qcom-6.8.0/debian/tests-build/check-aliases
@@ -0,0 +1,26 @@
+#!/usr/bin/perl -w
+
+my %map;
+
+print "Checking for dupe aliases in $ENV{'FLAVOUR'}...\n";
+
+$aliases =
+  "$ENV{'INSTALL_DIR'}/lib/modules/$ENV{'VERSION'}-$ENV{'FLAVOUR'}/modules.alias";
+
+exit 0 unless (-e $aliases);
+
+open(ALIASES, "< $aliases") or die "Could not open $aliases";
+
+while (<ALIASES>) {
+	chomp;
+	my ($junk, $alias, $module) = split;
+
+	if (defined($map{$alias})) {
+		printf("%s %20s / %-20s : %s \n", ("$map{$alias}" eq "$module")
+			? "INT" : "   ", $map{$alias}, $module, $alias);
+	} else {
+		$map{$alias} = $module;
+	}
+}
+
+exit(0);
--- linux-qcom-6.8.0.orig/debian/tests/control
+++ linux-qcom-6.8.0/debian/tests/control
@@ -0,0 +1,7 @@
+Tests: rebuild
+Depends: @builddeps@, fakeroot
+Restrictions: allow-stderr, skippable
+
+Tests: ubuntu-regression-suite
+Depends: build-essential, fakeroot, gcc-multilib [amd64 armhf i386], gdb, git, python3
+Restrictions: allow-stderr, isolation-machine, breaks-testbed, skippable
--- linux-qcom-6.8.0.orig/debian/tests/rebuild
+++ linux-qcom-6.8.0/debian/tests/rebuild
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# If we are triggering for just linux or linux-meta we know we have
+# just built the kernel and there is no point in repeating that
+# build, it just wastes time.  (LP: #1498862)
+build_needed=0
+for trigger in ${ADT_TEST_TRIGGERS:-force}
+do
+	case "$trigger" in
+	linux/*|linux-lts-*/*|linux-meta*/*|linux-oem*/*|fakeroot/*|gdb/*|git/*|bzr/*|gcc-multilib/*)	;;
+	*)						build_needed=1 ;;
+	esac
+done
+if [ "$build_needed" -eq 0 ]; then
+	echo "rebuild: short circuiting build for '${ADT_TEST_TRIGGERS}'"
+	exit 77
+fi
+
+set -e
+dpkg-buildpackage -rfakeroot -us -uc -b -Pautopkgtest
--- linux-qcom-6.8.0.orig/debian/tests/ubuntu-regression-suite
+++ linux-qcom-6.8.0/debian/tests/ubuntu-regression-suite
@@ -0,0 +1,46 @@
+#!/bin/sh
+set -e
+
+# Only run regression-suite on kernels we can boot in canonistack
+source=`dpkg-parsechangelog -SSource`
+case $source in
+    linux|linux-unstable|linux-hwe*|linux-lowlatency*|linux-kvm|linux-oem)
+	;;
+    *)
+	echo "ubuntu-regression-suite is pointless, if one cannot boot the kernel"
+	exit 77
+	;;
+esac
+
+# Only run regression-suite if we were requested to
+have_meta=0
+for trigger in ${ADT_TEST_TRIGGERS}
+do
+    case "$trigger" in
+	linux-meta/*|linux-meta-*/*)
+	    have_meta=1
+	    ;;
+    esac
+done
+if [ -n "$ADT_TEST_TRIGGERS" ] && [ "$have_meta" -eq 0 ]; then
+    echo "ubuntu-regression-suite is not requested, as there is no linux-meta trigger"
+    exit 77
+fi
+
+sver=`dpkg-parsechangelog -SVersion`
+read x rver x </proc/version_signature
+
+flavour=${rver#*-*-}
+rver=${rver%-$flavour}
+
+echo "Source Package Version: $sver"
+echo "Running Kernel Version: $rver"
+
+if [ "$sver" != "$rver" ]; then
+    echo "ERROR: running version does not match source package" 1>&2
+    exit 1
+fi
+
+git clone --depth=1 -b autotest3 git://git.launchpad.net/~canonical-kernel-team/+git/kernel-testing
+git -C kernel-testing/ show HEAD -q
+kernel-testing/run-dep8-tests
--- linux-qcom-6.8.0.orig/debian/tools/generic
+++ linux-qcom-6.8.0/debian/tools/generic
@@ -0,0 +1,60 @@
+#!/bin/bash
+full_version=`uname -r`
+
+# First check for a fully qualified version.
+this="/usr/lib/linux-tools/$full_version/`basename $0`"
+if [ -f "$this" ]; then
+	exec "$this" "$@"
+fi
+
+# Removing flavour from version i.e. generic or server.
+flavour_abi=${full_version#*-}
+flavour=${flavour_abi#*-}
+version=${full_version%-$flavour}
+this="$0_$version"
+if [ -f "$this" ]; then
+	exec "$this" "$@"
+fi
+
+# Before saucy kernels we had no flavour linkage.
+if dpkg --compare-versions "$version" lt "3.11.0"; then
+	flavour=''
+else
+	flavour="-$flavour"
+fi
+# Hint at the cloud tools if they exist (trusty and later)
+if dpkg --compare-versions "$version" ge "3.13.0"; then
+	cld=""
+else
+	cld=":"
+fi
+# Work out if this is an LTS backport or not.
+codename=`lsb_release -cs`
+case "$codename" in
+precise)	base='3.2.0-9999' ;;
+trusty)		base='3.13.0-9999' ;;
+*)		base='' ;;
+esac
+std=""
+lts=":"
+if [ "$base" != "" ]; then
+	if dpkg --compare-versions "$version" gt "$base"; then
+		std=":"
+		lts=""
+	fi
+fi
+
+# Give them a hint as to what to install.
+		echo "WARNING: `basename $0` not found for kernel $version" >&2
+		echo "" >&2
+		echo "  You may need to install the following packages for this specific kernel:" >&2
+		echo "    linux-tools-$version$flavour" >&2
+$cld		echo "    linux-cloud-tools-$version$flavour" >&2
+		echo "" >&2
+		echo "  You may also want to install one of the following packages to keep up to date:" >&2
+$std		echo "    linux-tools$flavour" >&2
+$std $cld	echo "    linux-cloud-tools$flavour" >&2
+$lts		echo "    linux-tools$flavour-lts-<series>" >&2
+$lts $cld	echo "    linux-cloud-tools$flavour-lts-<series>" >&2
+
+exit 2
--- linux-qcom-6.8.0.orig/debian/tools/python-perf.py
+++ linux-qcom-6.8.0/debian/tools/python-perf.py
@@ -0,0 +1,34 @@
+import os
+import importlib.util
+from glob import glob
+
+
+class KernelNotFoundError(Exception):
+    def __init__(self):
+        kernel_version = os.uname().release
+        flavor = kernel_version.split("-", 2)[2]
+        super().__init__(
+            f"\nWARNING: python perf module not found for kernel {kernel_version}\n\n"
+            f"  You may need to install the following package for this specific kernel:\n"
+            f"    linux-tools-{kernel_version}\n\n"
+            f"  You may also want to install the following package to keep up to date:\n"
+            f"    linux-tools-{flavor}"
+        )
+
+
+# Load the actual python-perf module for the running kernel
+_kernel_version = os.uname().release
+_perf_dir = f"/usr/lib/linux-tools/{_kernel_version}/lib"
+if not os.path.exists(_perf_dir):
+    _abi_version = "-".join(_kernel_version.split("-")[0:2])
+    _perf_dir = f"/usr/lib/python3/dist-packages/linux-tools-{_abi_version}"
+    if not os.path.exists(_perf_dir):
+        raise KernelNotFoundError()
+_perf_lib = glob(os.path.join(_perf_dir, "perf.*.so"))[-1]
+
+_spec = importlib.util.spec_from_file_location("perf", _perf_lib)
+_perf = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_perf)
+
+# Expose the 'perf' module.
+__all__ = ["perf"]
--- linux-qcom-6.8.0.orig/debian/v4l2loopback-modules.ignore
+++ linux-qcom-6.8.0/debian/v4l2loopback-modules.ignore
@@ -0,0 +1 @@
+v4l2loopback
--- linux-qcom-6.8.0.orig/debian/zfs-modules.ignore
+++ linux-qcom-6.8.0/debian/zfs-modules.ignore
@@ -0,0 +1,11 @@
+icp
+spl
+splat
+zavl
+zcommon
+zfs
+zlua
+znvpair
+zpios
+zunicode
+zzstd
--- linux-qcom-6.8.0.orig/drivers/Makefile
+++ linux-qcom-6.8.0/drivers/Makefile
@@ -66,14 +66,9 @@
 # iommu/ comes before gpu as gpu are using iommu controllers
 obj-y				+= iommu/
 
-# gpu/ comes after char for AGP vs DRM startup and after iommu
-obj-y				+= gpu/
 
 obj-$(CONFIG_CONNECTOR)		+= connector/
 
-# i810fb depends on char/agp/
-obj-$(CONFIG_FB_I810)           += video/fbdev/i810/
-
 obj-$(CONFIG_PARPORT)		+= parport/
 obj-y				+= base/ block/ misc/ mfd/ nfc/
 obj-$(CONFIG_LIBNVDIMM)		+= nvdimm/
@@ -85,6 +80,11 @@
 obj-y				+= scsi/
 obj-y				+= nvme/
 obj-$(CONFIG_ATA)		+= ata/
+
+# gpu/ comes after char for AGP vs DRM startup and after iommu
+obj-y				+= gpu/
+# i810fb depends on char/agp/
+obj-$(CONFIG_FB_I810)           += video/fbdev/i810/
 obj-$(CONFIG_TARGET_CORE)	+= target/
 obj-$(CONFIG_MTD)		+= mtd/
 obj-$(CONFIG_SPI)		+= spi/
--- linux-qcom-6.8.0.orig/drivers/accel/drm_accel.c
+++ linux-qcom-6.8.0/drivers/accel/drm_accel.c
@@ -8,7 +8,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/device.h>
-#include <linux/idr.h>
+#include <linux/xarray.h>
 
 #include <drm/drm_accel.h>
 #include <drm/drm_auth.h>
@@ -18,8 +18,7 @@
 #include <drm/drm_ioctl.h>
 #include <drm/drm_print.h>
 
-static DEFINE_SPINLOCK(accel_minor_lock);
-static struct idr accel_minors_idr;
+DEFINE_XARRAY_ALLOC(accel_minors_xa);
 
 static struct dentry *accel_debugfs_root;
 
@@ -118,99 +117,6 @@
 }
 
 /**
- * accel_minor_alloc() - Allocates a new accel minor
- *
- * This function access the accel minors idr and allocates from it
- * a new id to represent a new accel minor
- *
- * Return: A new id on success or error code in case idr_alloc failed
- */
-int accel_minor_alloc(void)
-{
-	unsigned long flags;
-	int r;
-
-	spin_lock_irqsave(&accel_minor_lock, flags);
-	r = idr_alloc(&accel_minors_idr, NULL, 0, ACCEL_MAX_MINORS, GFP_NOWAIT);
-	spin_unlock_irqrestore(&accel_minor_lock, flags);
-
-	return r;
-}
-
-/**
- * accel_minor_remove() - Remove an accel minor
- * @index: The minor id to remove.
- *
- * This function access the accel minors idr and removes from
- * it the member with the id that is passed to this function.
- */
-void accel_minor_remove(int index)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&accel_minor_lock, flags);
-	idr_remove(&accel_minors_idr, index);
-	spin_unlock_irqrestore(&accel_minor_lock, flags);
-}
-
-/**
- * accel_minor_replace() - Replace minor pointer in accel minors idr.
- * @minor: Pointer to the new minor.
- * @index: The minor id to replace.
- *
- * This function access the accel minors idr structure and replaces the pointer
- * that is associated with an existing id. Because the minor pointer can be
- * NULL, we need to explicitly pass the index.
- *
- * Return: 0 for success, negative value for error
- */
-void accel_minor_replace(struct drm_minor *minor, int index)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&accel_minor_lock, flags);
-	idr_replace(&accel_minors_idr, minor, index);
-	spin_unlock_irqrestore(&accel_minor_lock, flags);
-}
-
-/*
- * Looks up the given minor-ID and returns the respective DRM-minor object. The
- * refence-count of the underlying device is increased so you must release this
- * object with accel_minor_release().
- *
- * The object can be only a drm_minor that represents an accel device.
- *
- * As long as you hold this minor, it is guaranteed that the object and the
- * minor->dev pointer will stay valid! However, the device may get unplugged and
- * unregistered while you hold the minor.
- */
-static struct drm_minor *accel_minor_acquire(unsigned int minor_id)
-{
-	struct drm_minor *minor;
-	unsigned long flags;
-
-	spin_lock_irqsave(&accel_minor_lock, flags);
-	minor = idr_find(&accel_minors_idr, minor_id);
-	if (minor)
-		drm_dev_get(minor->dev);
-	spin_unlock_irqrestore(&accel_minor_lock, flags);
-
-	if (!minor) {
-		return ERR_PTR(-ENODEV);
-	} else if (drm_dev_is_unplugged(minor->dev)) {
-		drm_dev_put(minor->dev);
-		return ERR_PTR(-ENODEV);
-	}
-
-	return minor;
-}
-
-static void accel_minor_release(struct drm_minor *minor)
-{
-	drm_dev_put(minor->dev);
-}
-
-/**
  * accel_open - open method for ACCEL file
  * @inode: device inode
  * @filp: file pointer.
@@ -227,7 +133,7 @@
 	struct drm_minor *minor;
 	int retcode;
 
-	minor = accel_minor_acquire(iminor(inode));
+	minor = drm_minor_acquire(&accel_minors_xa, iminor(inode));
 	if (IS_ERR(minor))
 		return PTR_ERR(minor);
 
@@ -246,7 +152,7 @@
 
 err_undo:
 	atomic_dec(&dev->open_count);
-	accel_minor_release(minor);
+	drm_minor_release(minor);
 	return retcode;
 }
 EXPORT_SYMBOL_GPL(accel_open);
@@ -257,7 +163,7 @@
 	struct drm_minor *minor;
 	int err;
 
-	minor = accel_minor_acquire(iminor(inode));
+	minor = drm_minor_acquire(&accel_minors_xa, iminor(inode));
 	if (IS_ERR(minor))
 		return PTR_ERR(minor);
 
@@ -274,7 +180,7 @@
 		err = 0;
 
 out:
-	accel_minor_release(minor);
+	drm_minor_release(minor);
 
 	return err;
 }
@@ -290,15 +196,13 @@
 	unregister_chrdev(ACCEL_MAJOR, "accel");
 	debugfs_remove(accel_debugfs_root);
 	accel_sysfs_destroy();
-	idr_destroy(&accel_minors_idr);
+	WARN_ON(!xa_empty(&accel_minors_xa));
 }
 
 int __init accel_core_init(void)
 {
 	int ret;
 
-	idr_init(&accel_minors_idr);
-
 	ret = accel_sysfs_init();
 	if (ret < 0) {
 		DRM_ERROR("Cannot create ACCEL class: %d\n", ret);
--- linux-qcom-6.8.0.orig/drivers/accel/habanalabs/common/debugfs.c
+++ linux-qcom-6.8.0/drivers/accel/habanalabs/common/debugfs.c
@@ -1643,19 +1643,19 @@
 				&hl_data64b_fops);
 
 	debugfs_create_file("set_power_state",
-				0200,
+				0644,
 				root,
 				dev_entry,
 				&hl_power_fops);
 
 	debugfs_create_file("device",
-				0200,
+				0644,
 				root,
 				dev_entry,
 				&hl_device_fops);
 
 	debugfs_create_file("clk_gate",
-				0200,
+				0644,
 				root,
 				dev_entry,
 				&hl_clk_gate_fops);
@@ -1667,13 +1667,13 @@
 				&hl_stop_on_err_fops);
 
 	debugfs_create_file("dump_security_violations",
-				0644,
+				0400,
 				root,
 				dev_entry,
 				&hl_security_violations_fops);
 
 	debugfs_create_file("dump_razwi_events",
-				0644,
+				0400,
 				root,
 				dev_entry,
 				&hl_razwi_check_fops);
@@ -1706,7 +1706,7 @@
 				&hdev->reset_info.skip_reset_on_timeout);
 
 	debugfs_create_file("state_dump",
-				0600,
+				0644,
 				root,
 				dev_entry,
 				&hl_state_dump_fops);
@@ -1724,7 +1724,7 @@
 
 	for (i = 0, entry = dev_entry->entry_arr ; i < count ; i++, entry++) {
 		debugfs_create_file(hl_debugfs_list[i].name,
-					0444,
+					0644,
 					root,
 					entry,
 					&hl_debugfs_fops);
--- linux-qcom-6.8.0.orig/drivers/accel/habanalabs/common/habanalabs.h
+++ linux-qcom-6.8.0/drivers/accel/habanalabs/common/habanalabs.h
@@ -2547,7 +2547,7 @@
  * DEVICES
  */
 
-#define HL_STR_MAX	32
+#define HL_STR_MAX	64
 
 #define HL_DEV_STS_MAX (HL_DEVICE_STATUS_LAST + 1)
 
--- linux-qcom-6.8.0.orig/drivers/accel/habanalabs/gaudi2/gaudi2_security.c
+++ linux-qcom-6.8.0/drivers/accel/habanalabs/gaudi2/gaudi2_security.c
@@ -479,6 +479,7 @@
 	mmDCORE0_EDMA0_CORE_CTX_TE_NUMROWS,
 	mmDCORE0_EDMA0_CORE_CTX_IDX,
 	mmDCORE0_EDMA0_CORE_CTX_IDX_INC,
+	mmDCORE0_EDMA0_CORE_WR_COMP_MAX_OUTSTAND,
 	mmDCORE0_EDMA0_CORE_RD_LBW_RATE_LIM_CFG,
 	mmDCORE0_EDMA0_QM_CQ_CFG0_0,
 	mmDCORE0_EDMA0_QM_CQ_CFG0_1,
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_drv.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_drv.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (C) 2020-2023 Intel Corporation
+ * Copyright (C) 2020-2024 Intel Corporation
  */
 
 #include <linux/firmware.h>
@@ -131,22 +131,6 @@
 	return 0;
 }
 
-static int ivpu_get_core_clock_rate(struct ivpu_device *vdev, u64 *clk_rate)
-{
-	int ret;
-
-	ret = ivpu_rpm_get_if_active(vdev);
-	if (ret < 0)
-		return ret;
-
-	*clk_rate = ret ? ivpu_hw_reg_pll_freq_get(vdev) : 0;
-
-	if (ret)
-		ivpu_rpm_put(vdev);
-
-	return 0;
-}
-
 static int ivpu_get_param_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
 {
 	struct ivpu_file_priv *file_priv = file->driver_priv;
@@ -170,7 +154,7 @@
 		args->value = vdev->platform;
 		break;
 	case DRM_IVPU_PARAM_CORE_CLOCK_RATE:
-		ret = ivpu_get_core_clock_rate(vdev, &args->value);
+		args->value = ivpu_hw_ratio_to_freq(vdev, vdev->hw->pll.max_ratio);
 		break;
 	case DRM_IVPU_PARAM_NUM_CONTEXTS:
 		args->value = ivpu_get_context_count(vdev);
@@ -387,12 +371,15 @@
 {
 	int ret;
 
-	ivpu_prepare_for_reset(vdev);
+	/* Save PCI state before powering down as it sometimes gets corrupted if NPU hangs */
+	pci_save_state(to_pci_dev(vdev->drm.dev));
 
 	ret = ivpu_hw_power_down(vdev);
 	if (ret)
 		ivpu_warn(vdev, "Failed to power down HW: %d\n", ret);
 
+	pci_set_power_state(to_pci_dev(vdev->drm.dev), PCI_D3hot);
+
 	return ret;
 }
 
@@ -530,7 +517,7 @@
 	vdev->context_xa_limit.min = IVPU_USER_CONTEXT_MIN_SSID;
 	vdev->context_xa_limit.max = IVPU_USER_CONTEXT_MAX_SSID;
 	atomic64_set(&vdev->unique_id_counter, 0);
-	xa_init_flags(&vdev->context_xa, XA_FLAGS_ALLOC);
+	xa_init_flags(&vdev->context_xa, XA_FLAGS_ALLOC | XA_FLAGS_LOCK_IRQ);
 	xa_init_flags(&vdev->submitted_jobs_xa, XA_FLAGS_ALLOC1);
 	lockdep_set_class(&vdev->submitted_jobs_xa.xa_lock, &submitted_jobs_xa_lock_class_key);
 	INIT_LIST_HEAD(&vdev->bo_list);
@@ -559,11 +546,11 @@
 	/* Power up early so the rest of init code can access VPU registers */
 	ret = ivpu_hw_power_up(vdev);
 	if (ret)
-		goto err_power_down;
+		goto err_shutdown;
 
 	ret = ivpu_mmu_global_context_init(vdev);
 	if (ret)
-		goto err_power_down;
+		goto err_shutdown;
 
 	ret = ivpu_mmu_init(vdev);
 	if (ret)
@@ -600,10 +587,8 @@
 	ivpu_mmu_reserved_context_fini(vdev);
 err_mmu_gctx_fini:
 	ivpu_mmu_global_context_fini(vdev);
-err_power_down:
-	ivpu_hw_power_down(vdev);
-	if (IVPU_WA(d3hot_after_power_off))
-		pci_set_power_state(to_pci_dev(vdev->drm.dev), PCI_D3hot);
+err_shutdown:
+	ivpu_shutdown(vdev);
 err_xa_destroy:
 	xa_destroy(&vdev->submitted_jobs_xa);
 	xa_destroy(&vdev->context_xa);
@@ -626,9 +611,8 @@
 static void ivpu_dev_fini(struct ivpu_device *vdev)
 {
 	ivpu_pm_disable(vdev);
+	ivpu_prepare_for_reset(vdev);
 	ivpu_shutdown(vdev);
-	if (IVPU_WA(d3hot_after_power_off))
-		pci_set_power_state(to_pci_dev(vdev->drm.dev), PCI_D3hot);
 
 	ivpu_jobs_abort_all(vdev);
 	ivpu_job_done_consumer_fini(vdev);
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_drv.h
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_drv.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Copyright (C) 2020-2023 Intel Corporation
+ * Copyright (C) 2020-2024 Intel Corporation
  */
 
 #ifndef __IVPU_DRV_H__
@@ -87,7 +87,6 @@
 struct ivpu_wa_table {
 	bool punit_disabled;
 	bool clear_runtime_mem;
-	bool d3hot_after_power_off;
 	bool interrupt_clear_with_0;
 	bool disable_clock_relinquish;
 	bool disable_d0i3_msg;
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_fw.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_fw.c
@@ -60,6 +60,10 @@
 	{ IVPU_HW_40XX, "intel/vpu/vpu_40xx_v0.0.bin" },
 };
 
+/* Production fw_names from the table above */
+MODULE_FIRMWARE("intel/vpu/vpu_37xx_v0.0.bin");
+MODULE_FIRMWARE("intel/vpu/vpu_40xx_v0.0.bin");
+
 static int ivpu_fw_request(struct ivpu_device *vdev)
 {
 	int ret = -ENOENT;
@@ -519,8 +523,10 @@
 	boot_params->ipc_payload_area_start = ipc_mem_rx->vpu_addr + ivpu_bo_size(ipc_mem_rx) / 2;
 	boot_params->ipc_payload_area_size = ivpu_bo_size(ipc_mem_rx) / 2;
 
-	boot_params->global_aliased_pio_base = vdev->hw->ranges.user.start;
-	boot_params->global_aliased_pio_size = ivpu_hw_range_size(&vdev->hw->ranges.user);
+	if (ivpu_hw_gen(vdev) == IVPU_HW_37XX) {
+		boot_params->global_aliased_pio_base = vdev->hw->ranges.user.start;
+		boot_params->global_aliased_pio_size = ivpu_hw_range_size(&vdev->hw->ranges.user);
+	}
 
 	/* Allow configuration for L2C_PAGE_TABLE with boot param value */
 	boot_params->autoconfig = 1;
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_gem.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_gem.c
@@ -402,7 +402,7 @@
 	mutex_lock(&bo->lock);
 
 	drm_printf(p, "%-9p %-3u 0x%-12llx %-10lu 0x%-8x %-4u",
-		   bo, bo->ctx->id, bo->vpu_addr, bo->base.base.size,
+		   bo, bo->ctx ? bo->ctx->id : 0, bo->vpu_addr, bo->base.base.size,
 		   bo->flags, kref_read(&bo->base.base.refcount));
 
 	if (bo->base.pages)
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_hw.h
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_hw.h
@@ -21,6 +21,7 @@
 	u32 (*profiling_freq_get)(struct ivpu_device *vdev);
 	void (*profiling_freq_drive)(struct ivpu_device *vdev, bool enable);
 	u32 (*reg_pll_freq_get)(struct ivpu_device *vdev);
+	u32 (*ratio_to_freq)(struct ivpu_device *vdev, u32 ratio);
 	u32 (*reg_telemetry_offset_get)(struct ivpu_device *vdev);
 	u32 (*reg_telemetry_size_get)(struct ivpu_device *vdev);
 	u32 (*reg_telemetry_enable_get)(struct ivpu_device *vdev);
@@ -130,6 +131,11 @@
 	return vdev->hw->ops->reg_pll_freq_get(vdev);
 };
 
+static inline u32 ivpu_hw_ratio_to_freq(struct ivpu_device *vdev, u32 ratio)
+{
+	return vdev->hw->ops->ratio_to_freq(vdev, ratio);
+}
+
 static inline u32 ivpu_hw_reg_telemetry_offset_get(struct ivpu_device *vdev)
 {
 	return vdev->hw->ops->reg_telemetry_offset_get(vdev);
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_hw_37xx.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_hw_37xx.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (C) 2020-2023 Intel Corporation
+ * Copyright (C) 2020-2024 Intel Corporation
  */
 
 #include "ivpu_drv.h"
@@ -75,7 +75,6 @@
 {
 	vdev->wa.punit_disabled = false;
 	vdev->wa.clear_runtime_mem = false;
-	vdev->wa.d3hot_after_power_off = true;
 
 	REGB_WR32(VPU_37XX_BUTTRESS_INTERRUPT_STAT, BUTTRESS_ALL_IRQ_MASK);
 	if (REGB_RD32(VPU_37XX_BUTTRESS_INTERRUPT_STAT) == BUTTRESS_ALL_IRQ_MASK) {
@@ -86,7 +85,6 @@
 
 	IVPU_PRINT_WA(punit_disabled);
 	IVPU_PRINT_WA(clear_runtime_mem);
-	IVPU_PRINT_WA(d3hot_after_power_off);
 	IVPU_PRINT_WA(interrupt_clear_with_0);
 }
 
@@ -595,9 +593,9 @@
 	ivpu_pll_init_frequency_ratios(vdev);
 
 	ivpu_hw_init_range(&hw->ranges.global, 0x80000000, SZ_512M);
-	ivpu_hw_init_range(&hw->ranges.user,   0xc0000000, 255 * SZ_1M);
+	ivpu_hw_init_range(&hw->ranges.user,   0x88000000, 511 * SZ_1M);
 	ivpu_hw_init_range(&hw->ranges.shave, 0x180000000, SZ_2G);
-	ivpu_hw_init_range(&hw->ranges.dma,   0x200000000, SZ_8G);
+	ivpu_hw_init_range(&hw->ranges.dma,   0x200000000, SZ_128G);
 
 	vdev->platform = IVPU_PLATFORM_SILICON;
 	ivpu_hw_wa_init(vdev);
@@ -805,12 +803,12 @@
 	/* Profiling freq - is a debug feature. Unavailable on VPU 37XX. */
 }
 
-static u32 ivpu_hw_37xx_pll_to_freq(u32 ratio, u32 config)
+static u32 ivpu_hw_37xx_ratio_to_freq(struct ivpu_device *vdev, u32 ratio)
 {
 	u32 pll_clock = PLL_REF_CLK_FREQ * ratio;
 	u32 cpu_clock;
 
-	if ((config & 0xff) == PLL_RATIO_4_3)
+	if ((vdev->hw->config & 0xff) == PLL_RATIO_4_3)
 		cpu_clock = pll_clock * 2 / 4;
 	else
 		cpu_clock = pll_clock * 2 / 5;
@@ -829,7 +827,7 @@
 	if (!ivpu_is_silicon(vdev))
 		return PLL_SIMULATION_FREQ;
 
-	return ivpu_hw_37xx_pll_to_freq(pll_curr_ratio, vdev->hw->config);
+	return ivpu_hw_37xx_ratio_to_freq(vdev, pll_curr_ratio);
 }
 
 static u32 ivpu_hw_37xx_reg_telemetry_offset_get(struct ivpu_device *vdev)
@@ -1052,6 +1050,7 @@
 	.profiling_freq_get = ivpu_hw_37xx_profiling_freq_get,
 	.profiling_freq_drive = ivpu_hw_37xx_profiling_freq_drive,
 	.reg_pll_freq_get = ivpu_hw_37xx_reg_pll_freq_get,
+	.ratio_to_freq = ivpu_hw_37xx_ratio_to_freq,
 	.reg_telemetry_offset_get = ivpu_hw_37xx_reg_telemetry_offset_get,
 	.reg_telemetry_size_get = ivpu_hw_37xx_reg_telemetry_size_get,
 	.reg_telemetry_enable_get = ivpu_hw_37xx_reg_telemetry_enable_get,
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_hw_40xx.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_hw_40xx.c
@@ -730,9 +730,9 @@
 	ivpu_pll_init_frequency_ratios(vdev);
 
 	ivpu_hw_init_range(&vdev->hw->ranges.global, 0x80000000, SZ_512M);
-	ivpu_hw_init_range(&vdev->hw->ranges.user,   0x80000000, SZ_256M);
-	ivpu_hw_init_range(&vdev->hw->ranges.shave,  0x80000000 + SZ_256M, SZ_2G - SZ_256M);
-	ivpu_hw_init_range(&vdev->hw->ranges.dma,   0x200000000, SZ_8G);
+	ivpu_hw_init_range(&vdev->hw->ranges.shave,  0x80000000, SZ_2G);
+	ivpu_hw_init_range(&vdev->hw->ranges.user,  0x100000000, SZ_256G);
+	vdev->hw->ranges.dma = vdev->hw->ranges.user;
 
 	ivpu_hw_read_platform(vdev);
 	ivpu_hw_wa_init(vdev);
@@ -980,6 +980,11 @@
 	return PLL_RATIO_TO_FREQ(pll_curr_ratio);
 }
 
+static u32 ivpu_hw_40xx_ratio_to_freq(struct ivpu_device *vdev, u32 ratio)
+{
+	return PLL_RATIO_TO_FREQ(ratio);
+}
+
 static u32 ivpu_hw_40xx_reg_telemetry_offset_get(struct ivpu_device *vdev)
 {
 	return REGB_RD32(VPU_40XX_BUTTRESS_VPU_TELEMETRY_OFFSET);
@@ -1230,6 +1235,7 @@
 	.profiling_freq_get = ivpu_hw_40xx_profiling_freq_get,
 	.profiling_freq_drive = ivpu_hw_40xx_profiling_freq_drive,
 	.reg_pll_freq_get = ivpu_hw_40xx_reg_pll_freq_get,
+	.ratio_to_freq = ivpu_hw_40xx_ratio_to_freq,
 	.reg_telemetry_offset_get = ivpu_hw_40xx_reg_telemetry_offset_get,
 	.reg_telemetry_size_get = ivpu_hw_40xx_reg_telemetry_size_get,
 	.reg_telemetry_enable_get = ivpu_hw_40xx_reg_telemetry_enable_get,
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_ipc.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_ipc.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (C) 2020-2023 Intel Corporation
+ * Copyright (C) 2020-2024 Intel Corporation
  */
 
 #include <linux/genalloc.h>
@@ -292,15 +292,16 @@
 	return ret;
 }
 
-static int
+int
 ivpu_ipc_send_receive_internal(struct ivpu_device *vdev, struct vpu_jsm_msg *req,
 			       enum vpu_ipc_msg_type expected_resp_type,
-			       struct vpu_jsm_msg *resp, u32 channel,
-			       unsigned long timeout_ms)
+			       struct vpu_jsm_msg *resp, u32 channel, unsigned long timeout_ms)
 {
 	struct ivpu_ipc_consumer cons;
 	int ret;
 
+	drm_WARN_ON(&vdev->drm, pm_runtime_status_suspended(vdev->drm.dev));
+
 	ivpu_ipc_consumer_add(vdev, &cons, channel, NULL);
 
 	ret = ivpu_ipc_send(vdev, &cons, req);
@@ -326,19 +327,21 @@
 	return ret;
 }
 
-int ivpu_ipc_send_receive_active(struct ivpu_device *vdev, struct vpu_jsm_msg *req,
-				 enum vpu_ipc_msg_type expected_resp, struct vpu_jsm_msg *resp,
-				 u32 channel, unsigned long timeout_ms)
+int ivpu_ipc_send_receive(struct ivpu_device *vdev, struct vpu_jsm_msg *req,
+			  enum vpu_ipc_msg_type expected_resp, struct vpu_jsm_msg *resp,
+			  u32 channel, unsigned long timeout_ms)
 {
 	struct vpu_jsm_msg hb_req = { .type = VPU_JSM_MSG_QUERY_ENGINE_HB };
 	struct vpu_jsm_msg hb_resp;
 	int ret, hb_ret;
 
-	drm_WARN_ON(&vdev->drm, pm_runtime_status_suspended(vdev->drm.dev));
+	ret = ivpu_rpm_get(vdev);
+	if (ret < 0)
+		return ret;
 
 	ret = ivpu_ipc_send_receive_internal(vdev, req, expected_resp, resp, channel, timeout_ms);
 	if (ret != -ETIMEDOUT)
-		return ret;
+		goto rpm_put;
 
 	hb_ret = ivpu_ipc_send_receive_internal(vdev, &hb_req, VPU_JSM_MSG_QUERY_ENGINE_HB_DONE,
 						&hb_resp, VPU_IPC_CHAN_ASYNC_CMD,
@@ -346,21 +349,7 @@
 	if (hb_ret == -ETIMEDOUT)
 		ivpu_pm_trigger_recovery(vdev, "IPC timeout");
 
-	return ret;
-}
-
-int ivpu_ipc_send_receive(struct ivpu_device *vdev, struct vpu_jsm_msg *req,
-			  enum vpu_ipc_msg_type expected_resp, struct vpu_jsm_msg *resp,
-			  u32 channel, unsigned long timeout_ms)
-{
-	int ret;
-
-	ret = ivpu_rpm_get(vdev);
-	if (ret < 0)
-		return ret;
-
-	ret = ivpu_ipc_send_receive_active(vdev, req, expected_resp, resp, channel, timeout_ms);
-
+rpm_put:
 	ivpu_rpm_put(vdev);
 	return ret;
 }
@@ -501,7 +490,11 @@
 	spin_lock_init(&ipc->cons_lock);
 	INIT_LIST_HEAD(&ipc->cons_list);
 	INIT_LIST_HEAD(&ipc->cb_msg_list);
-	drmm_mutex_init(&vdev->drm, &ipc->lock);
+	ret = drmm_mutex_init(&vdev->drm, &ipc->lock);
+	if (ret) {
+		ivpu_err(vdev, "Failed to initialize ipc->lock, ret %d\n", ret);
+		goto err_free_rx;
+	}
 	ivpu_ipc_reset(vdev);
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_ipc.h
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_ipc.h
@@ -99,10 +99,9 @@
 int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,
 		     struct ivpu_ipc_hdr *ipc_buf, struct vpu_jsm_msg *jsm_msg,
 		     unsigned long timeout_ms);
-
-int ivpu_ipc_send_receive_active(struct ivpu_device *vdev, struct vpu_jsm_msg *req,
-				 enum vpu_ipc_msg_type expected_resp, struct vpu_jsm_msg *resp,
-				 u32 channel, unsigned long timeout_ms);
+int ivpu_ipc_send_receive_internal(struct ivpu_device *vdev, struct vpu_jsm_msg *req,
+				   enum vpu_ipc_msg_type expected_resp_type,
+				   struct vpu_jsm_msg *resp, u32 channel, unsigned long timeout_ms);
 int ivpu_ipc_send_receive(struct ivpu_device *vdev, struct vpu_jsm_msg *req,
 			  enum vpu_ipc_msg_type expected_resp, struct vpu_jsm_msg *resp,
 			  u32 channel, unsigned long timeout_ms);
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_jsm_msg.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_jsm_msg.c
@@ -273,9 +273,8 @@
 
 	req.payload.pwr_d0i3_enter.send_response = 1;
 
-	ret = ivpu_ipc_send_receive_active(vdev, &req, VPU_JSM_MSG_PWR_D0I3_ENTER_DONE,
-					   &resp, VPU_IPC_CHAN_GEN_CMD,
-					   vdev->timeout.d0i3_entry_msg);
+	ret = ivpu_ipc_send_receive_internal(vdev, &req, VPU_JSM_MSG_PWR_D0I3_ENTER_DONE, &resp,
+					     VPU_IPC_CHAN_GEN_CMD, vdev->timeout.d0i3_entry_msg);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_mmu.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_mmu.c
@@ -278,7 +278,7 @@
 	case IVPU_MMU_EVT_F_VMS_FETCH:
 		return "Fetch of VMS caused external abort";
 	default:
-		return "Unknown CMDQ command";
+		return "Unknown event";
 	}
 }
 
@@ -286,15 +286,15 @@
 {
 	switch (err) {
 	case IVPU_MMU_CERROR_NONE:
-		return "No CMDQ Error";
+		return "No error";
 	case IVPU_MMU_CERROR_ILL:
 		return "Illegal command";
 	case IVPU_MMU_CERROR_ABT:
-		return "External abort on CMDQ read";
+		return "External abort on command queue read";
 	case IVPU_MMU_CERROR_ATC_INV_SYNC:
 		return "Sync failed to complete ATS invalidation";
 	default:
-		return "Unknown CMDQ Error";
+		return "Unknown error";
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_mmu_context.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_mmu_context.c
@@ -461,8 +461,8 @@
 		start = vdev->hw->ranges.global.start;
 		end = vdev->hw->ranges.shave.end;
 	} else {
-		start = vdev->hw->ranges.user.start;
-		end = vdev->hw->ranges.dma.end;
+		start = min_t(u64, vdev->hw->ranges.user.start, vdev->hw->ranges.shave.start);
+		end = max_t(u64, vdev->hw->ranges.user.end, vdev->hw->ranges.dma.end);
 	}
 
 	drm_mm_init(&ctx->mm, start, end - start);
--- linux-qcom-6.8.0.orig/drivers/accel/ivpu/ivpu_pm.c
+++ linux-qcom-6.8.0/drivers/accel/ivpu/ivpu_pm.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (C) 2020-2023 Intel Corporation
+ * Copyright (C) 2020-2024 Intel Corporation
  */
 
 #include <linux/highmem.h>
@@ -58,14 +58,11 @@
 {
 	int ret;
 
-	/* Save PCI state before powering down as it sometimes gets corrupted if NPU hangs */
-	pci_save_state(to_pci_dev(vdev->drm.dev));
+	ivpu_prepare_for_reset(vdev);
 
 	ret = ivpu_shutdown(vdev);
 	if (ret)
-		ivpu_err(vdev, "Failed to shutdown VPU: %d\n", ret);
-
-	pci_set_power_state(to_pci_dev(vdev->drm.dev), PCI_D3hot);
+		ivpu_err(vdev, "Failed to shutdown NPU: %d\n", ret);
 
 	return ret;
 }
@@ -74,10 +71,10 @@
 {
 	int ret;
 
-	pci_set_power_state(to_pci_dev(vdev->drm.dev), PCI_D0);
+retry:
 	pci_restore_state(to_pci_dev(vdev->drm.dev));
+	pci_set_power_state(to_pci_dev(vdev->drm.dev), PCI_D0);
 
-retry:
 	ret = ivpu_hw_power_up(vdev);
 	if (ret) {
 		ivpu_err(vdev, "Failed to power up HW: %d\n", ret);
@@ -100,6 +97,7 @@
 	ivpu_mmu_disable(vdev);
 err_power_down:
 	ivpu_hw_power_down(vdev);
+	pci_set_power_state(to_pci_dev(vdev->drm.dev), PCI_D3hot);
 
 	if (!ivpu_fw_is_cold_boot(vdev)) {
 		ivpu_pm_prepare_cold_boot(vdev);
@@ -309,7 +307,7 @@
 {
 	int ret;
 
-	ret = pm_runtime_get_if_active(vdev->drm.dev, false);
+	ret = pm_runtime_get_if_in_use(vdev->drm.dev);
 	drm_WARN_ON(&vdev->drm, ret < 0);
 
 	return ret;
@@ -378,6 +376,7 @@
 
 	pm_runtime_use_autosuspend(dev);
 	pm_runtime_set_autosuspend_delay(dev, delay);
+	pm_runtime_set_active(dev);
 
 	ivpu_dbg(vdev, PM, "Autosuspend delay = %d\n", delay);
 }
@@ -392,7 +391,6 @@
 {
 	struct device *dev = vdev->drm.dev;
 
-	pm_runtime_set_active(dev);
 	pm_runtime_allow(dev);
 	pm_runtime_mark_last_busy(dev);
 	pm_runtime_put_autosuspend(dev);
--- linux-qcom-6.8.0.orig/drivers/accel/qaic/qaic_control.c
+++ linux-qcom-6.8.0/drivers/accel/qaic/qaic_control.c
@@ -496,7 +496,7 @@
 	nents = sgt->nents;
 	nents_dma = nents;
 	*size = QAIC_MANAGE_EXT_MSG_LENGTH - msg_hdr_len - sizeof(**out_trans);
-	for_each_sgtable_sg(sgt, sg, i) {
+	for_each_sgtable_dma_sg(sgt, sg, i) {
 		*size -= sizeof(*asp);
 		/* Save 1K for possible follow-up transactions. */
 		if (*size < SZ_1K) {
--- linux-qcom-6.8.0.orig/drivers/accel/qaic/qaic_data.c
+++ linux-qcom-6.8.0/drivers/accel/qaic/qaic_data.c
@@ -179,7 +179,7 @@
 	nents = 0;
 
 	size = size ? size : PAGE_SIZE;
-	for (sg = sgt_in->sgl; sg; sg = sg_next(sg)) {
+	for_each_sgtable_dma_sg(sgt_in, sg, j) {
 		len = sg_dma_len(sg);
 
 		if (!len)
@@ -216,7 +216,7 @@
 
 	/* copy relevant sg node and fix page and length */
 	sgn = sgf;
-	for_each_sgtable_sg(sgt, sg, j) {
+	for_each_sgtable_dma_sg(sgt, sg, j) {
 		memcpy(sg, sgn, sizeof(*sg));
 		if (sgn == sgf) {
 			sg_dma_address(sg) += offf;
@@ -296,7 +296,7 @@
 	 * fence.
 	 */
 	dev_addr = req->dev_addr;
-	for_each_sgtable_sg(slice->sgt, sg, i) {
+	for_each_sgtable_dma_sg(slice->sgt, sg, i) {
 		slice->reqs[i].cmd = cmd;
 		slice->reqs[i].src_addr = cpu_to_le64(slice->dir == DMA_TO_DEVICE ?
 						      sg_dma_address(sg) : dev_addr);
--- linux-qcom-6.8.0.orig/drivers/accel/qaic/qaic_drv.c
+++ linux-qcom-6.8.0/drivers/accel/qaic/qaic_drv.c
@@ -32,6 +32,7 @@
 
 MODULE_IMPORT_NS(DMA_BUF);
 
+#define PCI_DEV_AIC080			0xa080
 #define PCI_DEV_AIC100			0xa100
 #define QAIC_NAME			"qaic"
 #define QAIC_DESC			"Qualcomm Cloud AI Accelerators"
@@ -322,7 +323,7 @@
 		return NULL;
 
 	qdev->dev_state = QAIC_OFFLINE;
-	if (id->device == PCI_DEV_AIC100) {
+	if (id->device == PCI_DEV_AIC080 || id->device == PCI_DEV_AIC100) {
 		qdev->num_dbc = 16;
 		qdev->dbc = devm_kcalloc(&pdev->dev, qdev->num_dbc, sizeof(*qdev->dbc), GFP_KERNEL);
 		if (!qdev->dbc)
@@ -561,6 +562,7 @@
 };
 
 static const struct pci_device_id qaic_ids[] = {
+	{ PCI_DEVICE(PCI_VENDOR_ID_QCOM, PCI_DEV_AIC080), },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QCOM, PCI_DEV_AIC100), },
 	{ }
 };
--- linux-qcom-6.8.0.orig/drivers/accessibility/speakup/main.c
+++ linux-qcom-6.8.0/drivers/accessibility/speakup/main.c
@@ -574,7 +574,7 @@
 	}
 	attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr);
 	buf[cnt++] = attr_ch;
-	while (tmpx < vc->vc_cols - 1) {
+	while (tmpx < vc->vc_cols - 1 && cnt < ARRAY_SIZE(buf) - 1) {
 		tmp_pos += 2;
 		tmpx++;
 		ch = get_char(vc, (u_short *)tmp_pos, &temp);
--- linux-qcom-6.8.0.orig/drivers/accessibility/speakup/synth.c
+++ linux-qcom-6.8.0/drivers/accessibility/speakup/synth.c
@@ -208,8 +208,10 @@
 	wake_up_process(speakup_task);
 }
 
-void synth_write(const char *buf, size_t count)
+void synth_write(const char *_buf, size_t count)
 {
+	const unsigned char *buf = (const unsigned char *) _buf;
+
 	while (count--)
 		synth_buffer_add(*buf++);
 	synth_start();
--- linux-qcom-6.8.0.orig/drivers/acpi/ac.c
+++ linux-qcom-6.8.0/drivers/acpi/ac.c
@@ -145,7 +145,7 @@
 						  dev_name(&adev->dev), event,
 						  (u32) ac->state);
 		acpi_notifier_call_chain(adev, event, (u32) ac->state);
-		kobject_uevent(&ac->charger->dev.kobj, KOBJ_CHANGE);
+		power_supply_changed(ac->charger);
 	}
 }
 
@@ -268,7 +268,7 @@
 	if (acpi_ac_get_state(ac))
 		return 0;
 	if (old_state != ac->state)
-		kobject_uevent(&ac->charger->dev.kobj, KOBJ_CHANGE);
+		power_supply_changed(ac->charger);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/acpi/acpi_ipmi.c
+++ linux-qcom-6.8.0/drivers/acpi/acpi_ipmi.c
@@ -22,6 +22,8 @@
 /* the IPMI timeout is 5s */
 #define IPMI_TIMEOUT			(5000)
 #define ACPI_IPMI_MAX_MSG_LENGTH	64
+/* 2s should be suffient for SMI being selected */
+#define ACPI_IPMI_SMI_SELECTION_TIMEOUT	(2 * HZ)
 
 struct acpi_ipmi_device {
 	/* the device list attached to driver_data.ipmi_devices */
@@ -54,6 +56,7 @@
 	 * to this selected global IPMI system interface.
 	 */
 	struct acpi_ipmi_device *selected_smi;
+	struct completion smi_selection_done;
 };
 
 struct acpi_ipmi_msg {
@@ -463,8 +466,10 @@
 		if (temp->handle == handle)
 			goto err_lock;
 	}
-	if (!driver_data.selected_smi)
+	if (!driver_data.selected_smi) {
 		driver_data.selected_smi = ipmi_device;
+		complete(&driver_data.smi_selection_done);
+	}
 	list_add_tail(&ipmi_device->head, &driver_data.ipmi_devices);
 	mutex_unlock(&driver_data.ipmi_lock);
 
@@ -578,6 +583,20 @@
 	return status;
 }
 
+int acpi_wait_for_acpi_ipmi(void)
+{
+	long ret;
+
+	ret = wait_for_completion_interruptible_timeout(&driver_data.smi_selection_done,
+							ACPI_IPMI_SMI_SELECTION_TIMEOUT);
+
+	if (ret <= 0)
+		return -ETIMEDOUT;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(acpi_wait_for_acpi_ipmi);
+
 static int __init acpi_ipmi_init(void)
 {
 	int result;
@@ -586,6 +605,8 @@
 	if (acpi_disabled)
 		return 0;
 
+	init_completion(&driver_data.smi_selection_done);
+
 	status = acpi_install_address_space_handler(ACPI_ROOT_OBJECT,
 						    ACPI_ADR_SPACE_IPMI,
 						    &acpi_ipmi_space_handler,
--- linux-qcom-6.8.0.orig/drivers/acpi/acpi_lpss.c
+++ linux-qcom-6.8.0/drivers/acpi/acpi_lpss.c
@@ -325,6 +325,7 @@
 
 static const struct property_entry bsw_spi_properties[] = {
 	PROPERTY_ENTRY_U32("intel,spi-pxa2xx-type", LPSS_BSW_SSP),
+	PROPERTY_ENTRY_U32("num-cs", 2),
 	{ }
 };
 
--- linux-qcom-6.8.0.orig/drivers/acpi/acpi_pad.c
+++ linux-qcom-6.8.0/drivers/acpi/acpi_pad.c
@@ -132,8 +132,10 @@
 {
 	struct cpumask *pad_busy_cpus = to_cpumask(pad_busy_cpus_bits);
 
-	cpumask_clear_cpu(tsk_in_cpu[tsk_index], pad_busy_cpus);
-	tsk_in_cpu[tsk_index] = -1;
+	if (tsk_in_cpu[tsk_index] != -1) {
+		cpumask_clear_cpu(tsk_in_cpu[tsk_index], pad_busy_cpus);
+		tsk_in_cpu[tsk_index] = -1;
+	}
 }
 
 static unsigned int idle_pct = 5; /* percentage */
--- linux-qcom-6.8.0.orig/drivers/acpi/acpi_processor.c
+++ linux-qcom-6.8.0/drivers/acpi/acpi_processor.c
@@ -397,7 +397,7 @@
 
 	result = acpi_processor_get_info(device);
 	if (result) /* Processor is not physically present or unavailable */
-		return 0;
+		goto err_clear_driver_data;
 
 	BUG_ON(pr->id >= nr_cpu_ids);
 
@@ -412,7 +412,7 @@
 			"BIOS reported wrong ACPI id %d for the processor\n",
 			pr->id);
 		/* Give up, but do not abort the namespace scan. */
-		goto err;
+		goto err_clear_driver_data;
 	}
 	/*
 	 * processor_device_array is not cleared on errors to allow buggy BIOS
@@ -424,12 +424,12 @@
 	dev = get_cpu_device(pr->id);
 	if (!dev) {
 		result = -ENODEV;
-		goto err;
+		goto err_clear_per_cpu;
 	}
 
 	result = acpi_bind_one(dev, device);
 	if (result)
-		goto err;
+		goto err_clear_per_cpu;
 
 	pr->dev = dev;
 
@@ -440,10 +440,11 @@
 	dev_err(dev, "Processor driver could not be attached\n");
 	acpi_unbind_one(dev);
 
- err:
-	free_cpumask_var(pr->throttling.shared_cpu_map);
-	device->driver_data = NULL;
+ err_clear_per_cpu:
 	per_cpu(processors, pr->id) = NULL;
+ err_clear_driver_data:
+	device->driver_data = NULL;
+	free_cpumask_var(pr->throttling.shared_cpu_map);
  err_free_pr:
 	kfree(pr);
 	return result;
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/Makefile
+++ linux-qcom-6.8.0/drivers/acpi/acpica/Makefile
@@ -5,6 +5,7 @@
 
 ccflags-y			:= -D_LINUX -DBUILDING_ACPICA
 ccflags-$(CONFIG_ACPI_DEBUG)	+= -DACPI_DEBUG_OUTPUT
+CFLAGS_tbfind.o 		+= $(call cc-disable-warning, stringop-truncation)
 
 # use acpi.o to put all files here into acpi.o modparam namespace
 obj-y	+= acpi.o
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/acevents.h
+++ linux-qcom-6.8.0/drivers/acpi/acpica/acevents.h
@@ -188,7 +188,7 @@
 		      u8 acpi_ns_is_locked);
 
 void
-acpi_ev_execute_reg_methods(struct acpi_namespace_node *node,
+acpi_ev_execute_reg_methods(struct acpi_namespace_node *node, u32 max_depth,
 			    acpi_adr_space_type space_id, u32 function);
 
 acpi_status
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/dbconvert.c
+++ linux-qcom-6.8.0/drivers/acpi/acpica/dbconvert.c
@@ -174,6 +174,8 @@
 	elements =
 	    ACPI_ALLOCATE_ZEROED(DB_DEFAULT_PKG_ELEMENTS *
 				 sizeof(union acpi_object));
+	if (!elements)
+		return (AE_NO_MEMORY);
 
 	this = string;
 	for (i = 0; i < (DB_DEFAULT_PKG_ELEMENTS - 1); i++) {
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/dbnames.c
+++ linux-qcom-6.8.0/drivers/acpi/acpica/dbnames.c
@@ -550,8 +550,12 @@
 	ACPI_FREE(buffer.pointer);
 
 	buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER;
-	acpi_evaluate_object(obj_handle, NULL, NULL, &buffer);
-
+	status = acpi_evaluate_object(obj_handle, NULL, NULL, &buffer);
+	if (ACPI_FAILURE(status)) {
+		acpi_os_printf("Could Not evaluate object %p\n",
+			       obj_handle);
+		return (AE_OK);
+	}
 	/*
 	 * Since this is a field unit, surround the output in braces
 	 */
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/dswexec.c
+++ linux-qcom-6.8.0/drivers/acpi/acpica/dswexec.c
@@ -397,11 +397,11 @@
 
 			/* Resolve all operands */
 
+			union acpi_operand_object **stack_ptr = NULL;
+			if (walk_state->num_operands > 0)
+				stack_ptr = ACPI_WALK_OPERANDS;
 			status = acpi_ex_resolve_operands(walk_state->opcode,
-							  &(walk_state->
-							    operands
-							    [walk_state->
-							     num_operands - 1]),
+							  stack_ptr,
 							  walk_state);
 		}
 
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/evregion.c
+++ linux-qcom-6.8.0/drivers/acpi/acpica/evregion.c
@@ -65,6 +65,7 @@
 						acpi_gbl_default_address_spaces
 						[i])) {
 			acpi_ev_execute_reg_methods(acpi_gbl_root_node,
+						    ACPI_UINT32_MAX,
 						    acpi_gbl_default_address_spaces
 						    [i], ACPI_REG_CONNECT);
 		}
@@ -672,6 +673,7 @@
  * FUNCTION:    acpi_ev_execute_reg_methods
  *
  * PARAMETERS:  node            - Namespace node for the device
+ *              max_depth       - Depth to which search for _REG
  *              space_id        - The address space ID
  *              function        - Passed to _REG: On (1) or Off (0)
  *
@@ -683,7 +685,7 @@
  ******************************************************************************/
 
 void
-acpi_ev_execute_reg_methods(struct acpi_namespace_node *node,
+acpi_ev_execute_reg_methods(struct acpi_namespace_node *node, u32 max_depth,
 			    acpi_adr_space_type space_id, u32 function)
 {
 	struct acpi_reg_walk_info info;
@@ -717,7 +719,7 @@
 	 * regions and _REG methods. (i.e. handlers must be installed for all
 	 * regions of this Space ID before we can run any _REG methods)
 	 */
-	(void)acpi_ns_walk_namespace(ACPI_TYPE_ANY, node, ACPI_UINT32_MAX,
+	(void)acpi_ns_walk_namespace(ACPI_TYPE_ANY, node, max_depth,
 				     ACPI_NS_WALK_UNLOCK, acpi_ev_reg_run, NULL,
 				     &info, NULL);
 
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/evxfregn.c
+++ linux-qcom-6.8.0/drivers/acpi/acpica/evxfregn.c
@@ -85,7 +85,8 @@
 	/* Run all _REG methods for this address space */
 
 	if (run_reg) {
-		acpi_ev_execute_reg_methods(node, space_id, ACPI_REG_CONNECT);
+		acpi_ev_execute_reg_methods(node, ACPI_UINT32_MAX, space_id,
+					    ACPI_REG_CONNECT);
 	}
 
 unlock_and_exit:
@@ -231,8 +232,6 @@
 
 			/* Now we can delete the handler object */
 
-			acpi_os_release_mutex(handler_obj->address_space.
-					      context_mutex);
 			acpi_ut_remove_reference(handler_obj);
 			goto unlock_and_exit;
 		}
@@ -263,6 +262,7 @@
  * FUNCTION:    acpi_execute_reg_methods
  *
  * PARAMETERS:  device          - Handle for the device
+ *              max_depth       - Depth to which search for _REG
  *              space_id        - The address space ID
  *
  * RETURN:      Status
@@ -271,7 +271,8 @@
  *
  ******************************************************************************/
 acpi_status
-acpi_execute_reg_methods(acpi_handle device, acpi_adr_space_type space_id)
+acpi_execute_reg_methods(acpi_handle device, u32 max_depth,
+			 acpi_adr_space_type space_id)
 {
 	struct acpi_namespace_node *node;
 	acpi_status status;
@@ -296,7 +297,8 @@
 
 		/* Run all _REG methods for this address space */
 
-		acpi_ev_execute_reg_methods(node, space_id, ACPI_REG_CONNECT);
+		acpi_ev_execute_reg_methods(node, max_depth, space_id,
+					    ACPI_REG_CONNECT);
 	} else {
 		status = AE_BAD_PARAMETER;
 	}
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/exprep.c
+++ linux-qcom-6.8.0/drivers/acpi/acpica/exprep.c
@@ -437,6 +437,9 @@
 
 		if (info->connection_node) {
 			second_desc = info->connection_node->object;
+			if (second_desc == NULL) {
+				break;
+			}
 			if (!(second_desc->common.flags & AOPOBJ_DATA_VALID)) {
 				status =
 				    acpi_ds_get_buffer_arguments(second_desc);
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/exregion.c
+++ linux-qcom-6.8.0/drivers/acpi/acpica/exregion.c
@@ -44,7 +44,6 @@
 	struct acpi_mem_mapping *mm = mem_info->cur_mm;
 	u32 length;
 	acpi_size map_length;
-	acpi_size page_boundary_map_length;
 #ifdef ACPI_MISALIGNMENT_NOT_SUPPORTED
 	u32 remainder;
 #endif
@@ -138,26 +137,8 @@
 		map_length = (acpi_size)
 		    ((mem_info->address + mem_info->length) - address);
 
-		/*
-		 * If mapping the entire remaining portion of the region will cross
-		 * a page boundary, just map up to the page boundary, do not cross.
-		 * On some systems, crossing a page boundary while mapping regions
-		 * can cause warnings if the pages have different attributes
-		 * due to resource management.
-		 *
-		 * This has the added benefit of constraining a single mapping to
-		 * one page, which is similar to the original code that used a 4k
-		 * maximum window.
-		 */
-		page_boundary_map_length = (acpi_size)
-		    (ACPI_ROUND_UP(address, ACPI_DEFAULT_PAGE_SIZE) - address);
-		if (page_boundary_map_length == 0) {
-			page_boundary_map_length = ACPI_DEFAULT_PAGE_SIZE;
-		}
-
-		if (map_length > page_boundary_map_length) {
-			map_length = page_boundary_map_length;
-		}
+		if (map_length > ACPI_DEFAULT_PAGE_SIZE)
+			map_length = ACPI_DEFAULT_PAGE_SIZE;
 
 		/* Create a new mapping starting at the address given */
 
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/exsystem.c
+++ linux-qcom-6.8.0/drivers/acpi/acpica/exsystem.c
@@ -133,14 +133,15 @@
 		 * (ACPI specifies 100 usec as max, but this gives some slack in
 		 * order to support existing BIOSs)
 		 */
-		ACPI_ERROR((AE_INFO,
-			    "Time parameter is too large (%u)", how_long_us));
+		ACPI_ERROR_ONCE((AE_INFO,
+				 "Time parameter is too large (%u)",
+				 how_long_us));
 		status = AE_AML_OPERAND_VALUE;
 	} else {
 		if (how_long_us > 100) {
-			ACPI_WARNING((AE_INFO,
-				      "Time parameter %u us > 100 us violating ACPI spec, please fix the firmware.",
-				      how_long_us));
+			ACPI_WARNING_ONCE((AE_INFO,
+					   "Time parameter %u us > 100 us violating ACPI spec, please fix the firmware.",
+					   how_long_us));
 		}
 		acpi_os_stall(how_long_us);
 	}
--- linux-qcom-6.8.0.orig/drivers/acpi/acpica/psargs.c
+++ linux-qcom-6.8.0/drivers/acpi/acpica/psargs.c
@@ -25,6 +25,8 @@
 static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
 						       *parser_state);
 
+static void acpi_ps_free_field_list(union acpi_parse_object *start);
+
 /*******************************************************************************
  *
  * FUNCTION:    acpi_ps_get_next_package_length
@@ -685,6 +687,39 @@
 
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_ps_free_field_list
+ *
+ * PARAMETERS:  start               - First Op in field list
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Free all Op objects inside a field list.
+ *
+ ******************************************************************************/
+
+static void acpi_ps_free_field_list(union acpi_parse_object *start)
+{
+	union acpi_parse_object *cur = start;
+	union acpi_parse_object *next;
+	union acpi_parse_object *arg;
+
+	while (cur) {
+		next = cur->common.next;
+
+		/* AML_INT_CONNECTION_OP can have a single argument */
+
+		arg = acpi_ps_get_arg(cur, 0);
+		if (arg) {
+			acpi_ps_free_op(arg);
+		}
+
+		acpi_ps_free_op(cur);
+		cur = next;
+	}
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_ps_get_next_arg
  *
  * PARAMETERS:  walk_state          - Current state
@@ -751,6 +786,10 @@
 			while (parser_state->aml < parser_state->pkg_end) {
 				field = acpi_ps_get_next_field(parser_state);
 				if (!field) {
+					if (arg) {
+						acpi_ps_free_field_list(arg);
+					}
+
 					return_ACPI_STATUS(AE_NO_MEMORY);
 				}
 
@@ -820,6 +859,10 @@
 			    acpi_ps_get_next_namepath(walk_state, parser_state,
 						      arg,
 						      ACPI_NOT_METHOD_CALL);
+			if (ACPI_FAILURE(status)) {
+				acpi_ps_free_op(arg);
+				return_ACPI_STATUS(status);
+			}
 		} else {
 			/* Single complex argument, nothing returned */
 
@@ -854,6 +897,10 @@
 			    acpi_ps_get_next_namepath(walk_state, parser_state,
 						      arg,
 						      ACPI_POSSIBLE_METHOD_CALL);
+			if (ACPI_FAILURE(status)) {
+				acpi_ps_free_op(arg);
+				return_ACPI_STATUS(status);
+			}
 
 			if (arg->common.aml_opcode == AML_INT_METHODCALL_OP) {
 
--- linux-qcom-6.8.0.orig/drivers/acpi/arm64/gtdt.c
+++ linux-qcom-6.8.0/drivers/acpi/arm64/gtdt.c
@@ -283,7 +283,7 @@
 		if (frame->virt_irq > 0)
 			acpi_unregister_gsi(gtdt_frame->virtual_timer_interrupt);
 		frame->virt_irq = 0;
-	} while (i-- >= 0 && gtdt_frame--);
+	} while (i-- > 0 && gtdt_frame--);
 
 	return -EINVAL;
 }
--- linux-qcom-6.8.0.orig/drivers/acpi/arm64/iort.c
+++ linux-qcom-6.8.0/drivers/acpi/arm64/iort.c
@@ -1712,6 +1712,15 @@
 	/* HiSilicon Hip09 Platform */
 	{"HISI  ", "HIP09   ", 0, ACPI_SIG_IORT, greater_than_or_equal,
 	 "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09},
+	{"HISI  ", "HIP09A  ", 0, ACPI_SIG_IORT, greater_than_or_equal,
+	 "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09},
+	/* HiSilicon Hip10/11 Platform uses the same SMMU IP with Hip09 */
+	{"HISI  ", "HIP10   ", 0, ACPI_SIG_IORT, greater_than_or_equal,
+	 "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09},
+	{"HISI  ", "HIP10C  ", 0, ACPI_SIG_IORT, greater_than_or_equal,
+	 "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09},
+	{"HISI  ", "HIP11   ", 0, ACPI_SIG_IORT, greater_than_or_equal,
+	 "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09},
 	{ }
 };
 
--- linux-qcom-6.8.0.orig/drivers/acpi/battery.c
+++ linux-qcom-6.8.0/drivers/acpi/battery.c
@@ -678,12 +678,18 @@
 	return count;
 }
 
-static const struct device_attribute alarm_attr = {
+static struct device_attribute alarm_attr = {
 	.attr = {.name = "alarm", .mode = 0644},
 	.show = acpi_battery_alarm_show,
 	.store = acpi_battery_alarm_store,
 };
 
+static struct attribute *acpi_battery_attrs[] = {
+	&alarm_attr.attr,
+	NULL
+};
+ATTRIBUTE_GROUPS(acpi_battery);
+
 /*
  * The Battery Hooking API
  *
@@ -697,28 +703,35 @@
 static LIST_HEAD(battery_hook_list);
 static DEFINE_MUTEX(hook_mutex);
 
-static void __battery_hook_unregister(struct acpi_battery_hook *hook, int lock)
+static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook)
 {
 	struct acpi_battery *battery;
+
 	/*
 	 * In order to remove a hook, we first need to
 	 * de-register all the batteries that are registered.
 	 */
-	if (lock)
-		mutex_lock(&hook_mutex);
 	list_for_each_entry(battery, &acpi_battery_list, list) {
 		if (!hook->remove_battery(battery->bat, hook))
 			power_supply_changed(battery->bat);
 	}
-	list_del(&hook->list);
-	if (lock)
-		mutex_unlock(&hook_mutex);
+	list_del_init(&hook->list);
+
 	pr_info("extension unregistered: %s\n", hook->name);
 }
 
 void battery_hook_unregister(struct acpi_battery_hook *hook)
 {
-	__battery_hook_unregister(hook, 1);
+	mutex_lock(&hook_mutex);
+	/*
+	 * Ignore already unregistered battery hooks. This might happen
+	 * if a battery hook was previously unloaded due to an error when
+	 * adding a new battery.
+	 */
+	if (!list_empty(&hook->list))
+		battery_hook_unregister_unlocked(hook);
+
+	mutex_unlock(&hook_mutex);
 }
 EXPORT_SYMBOL_GPL(battery_hook_unregister);
 
@@ -727,7 +740,6 @@
 	struct acpi_battery *battery;
 
 	mutex_lock(&hook_mutex);
-	INIT_LIST_HEAD(&hook->list);
 	list_add(&hook->list, &battery_hook_list);
 	/*
 	 * Now that the driver is registered, we need
@@ -744,7 +756,7 @@
 			 * hooks.
 			 */
 			pr_err("extension failed to load: %s", hook->name);
-			__battery_hook_unregister(hook, 0);
+			battery_hook_unregister_unlocked(hook);
 			goto end;
 		}
 
@@ -783,7 +795,7 @@
 			 */
 			pr_err("error in extension, unloading: %s",
 					hook_node->name);
-			__battery_hook_unregister(hook_node, 0);
+			battery_hook_unregister_unlocked(hook_node);
 		}
 	}
 	mutex_unlock(&hook_mutex);
@@ -816,14 +828,17 @@
 	 * need to remove the hooks.
 	 */
 	list_for_each_entry_safe(hook, ptr, &battery_hook_list, list) {
-		__battery_hook_unregister(hook, 1);
+		battery_hook_unregister(hook);
 	}
 	mutex_destroy(&hook_mutex);
 }
 
 static int sysfs_add_battery(struct acpi_battery *battery)
 {
-	struct power_supply_config psy_cfg = { .drv_data = battery, };
+	struct power_supply_config psy_cfg = {
+		.drv_data = battery,
+		.attr_grp = acpi_battery_groups,
+	};
 	bool full_cap_broken = false;
 
 	if (!ACPI_BATTERY_CAPACITY_VALID(battery->full_charge_capacity) &&
@@ -868,7 +883,7 @@
 		return result;
 	}
 	battery_hook_add_battery(battery);
-	return device_create_file(&battery->bat->dev, &alarm_attr);
+	return 0;
 }
 
 static void sysfs_remove_battery(struct acpi_battery *battery)
@@ -879,7 +894,6 @@
 		return;
 	}
 	battery_hook_remove_battery(battery);
-	device_remove_file(&battery->bat->dev, &alarm_attr);
 	power_supply_unregister(battery->bat);
 	battery->bat = NULL;
 	mutex_unlock(&battery->sysfs_lock);
--- linux-qcom-6.8.0.orig/drivers/acpi/bus.c
+++ linux-qcom-6.8.0/drivers/acpi/bus.c
@@ -316,9 +316,14 @@
 		capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_PAD_SUPPORT;
 	if (IS_ENABLED(CONFIG_ACPI_PROCESSOR))
 		capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_PPC_OST_SUPPORT;
+	if (IS_ENABLED(CONFIG_ACPI_THERMAL))
+		capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_FAST_THERMAL_SAMPLING_SUPPORT;
 
 	capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_OST_SUPPORT;
 	capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_PCLPI_SUPPORT;
+	capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_OVER_16_PSTATES_SUPPORT;
+	capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_GED_SUPPORT;
+	capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_IRQ_RESOURCE_SOURCE_SUPPORT;
 	if (IS_ENABLED(CONFIG_ACPI_PRMT))
 		capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_PRM_SUPPORT;
 	if (IS_ENABLED(CONFIG_ACPI_FFH))
--- linux-qcom-6.8.0.orig/drivers/acpi/button.c
+++ linux-qcom-6.8.0/drivers/acpi/button.c
@@ -130,6 +130,17 @@
 		},
 		.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
 	},
+	{
+		/*
+		 * Samsung galaxybook2 ,initial _LID device notification returns
+		 * lid closed.
+		 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "750XED"),
+		},
+		.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
+	},
 	{}
 };
 
--- linux-qcom-6.8.0.orig/drivers/acpi/cppc_acpi.c
+++ linux-qcom-6.8.0/drivers/acpi/cppc_acpi.c
@@ -103,6 +103,11 @@
 				(cpc)->cpc_entry.reg.space_id ==	\
 				ACPI_ADR_SPACE_PLATFORM_COMM)
 
+/* Check if a CPC register is in FFH */
+#define CPC_IN_FFH(cpc) ((cpc)->type == ACPI_TYPE_BUFFER &&		\
+				(cpc)->cpc_entry.reg.space_id ==	\
+				ACPI_ADR_SPACE_FIXED_HARDWARE)
+
 /* Check if a CPC register is in SystemMemory */
 #define CPC_IN_SYSTEM_MEMORY(cpc) ((cpc)->type == ACPI_TYPE_BUFFER &&	\
 				(cpc)->cpc_entry.reg.space_id ==	\
@@ -166,6 +171,16 @@
 show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf);
 show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);
 
+/* Check for valid access_width, otherwise, fallback to using bit_width */
+#define GET_BIT_WIDTH(reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width)
+
+/* Shift and apply the mask for CPC reads/writes */
+#define MASK_VAL_READ(reg, val) (((val) >> (reg)->bit_offset) &				\
+					GENMASK(((reg)->bit_width) - 1, 0))
+#define MASK_VAL_WRITE(reg, prev_val, val)						\
+	((((val) & GENMASK(((reg)->bit_width) - 1, 0)) << (reg)->bit_offset) |		\
+	((prev_val) & ~(GENMASK(((reg)->bit_width) - 1, 0) << (reg)->bit_offset)))	\
+
 static ssize_t show_feedback_ctrs(struct kobject *kobj,
 		struct kobj_attribute *attr, char *buf)
 {
@@ -780,6 +795,7 @@
 			} else if (gas_t->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
 				if (gas_t->address) {
 					void __iomem *addr;
+					size_t access_width;
 
 					if (!osc_cpc_flexible_adr_space_confirmed) {
 						pr_debug("Flexible address space capability not supported\n");
@@ -787,7 +803,8 @@
 							goto out_free;
 					}
 
-					addr = ioremap(gas_t->address, gas_t->bit_width/8);
+					access_width = GET_BIT_WIDTH(gas_t) / 8;
+					addr = ioremap(gas_t->address, access_width);
 					if (!addr)
 						goto out_free;
 					cpc_ptr->cpc_regs[i-2].sys_mem_vaddr = addr;
@@ -846,6 +863,7 @@
 
 	/* Store CPU Logical ID */
 	cpc_ptr->cpu_id = pr->id;
+	raw_spin_lock_init(&cpc_ptr->rmw_lock);
 
 	/* Parse PSD data for this CPU */
 	ret = acpi_get_psd(cpc_ptr, handle);
@@ -983,6 +1001,7 @@
 static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val)
 {
 	void __iomem *vaddr = NULL;
+	int size;
 	int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
 	struct cpc_reg *reg = &reg_res->cpc_entry.reg;
 
@@ -992,14 +1011,14 @@
 	}
 
 	*val = 0;
+	size = GET_BIT_WIDTH(reg);
 
 	if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
-		u32 width = 8 << (reg->access_width - 1);
 		u32 val_u32;
 		acpi_status status;
 
 		status = acpi_os_read_port((acpi_io_address)reg->address,
-					   &val_u32, width);
+					   &val_u32, size);
 		if (ACPI_FAILURE(status)) {
 			pr_debug("Error: Failed to read SystemIO port %llx\n",
 				 reg->address);
@@ -1008,17 +1027,24 @@
 
 		*val = val_u32;
 		return 0;
-	} else if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >= 0)
+	} else if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >= 0) {
+		/*
+		 * For registers in PCC space, the register size is determined
+		 * by the bit width field; the access size is used to indicate
+		 * the PCC subspace id.
+		 */
+		size = reg->bit_width;
 		vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id);
+	}
 	else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
 		vaddr = reg_res->sys_mem_vaddr;
 	else if (reg->space_id == ACPI_ADR_SPACE_FIXED_HARDWARE)
 		return cpc_read_ffh(cpu, reg, val);
 	else
 		return acpi_os_read_memory((acpi_physical_address)reg->address,
-				val, reg->bit_width);
+				val, size);
 
-	switch (reg->bit_width) {
+	switch (size) {
 	case 8:
 		*val = readb_relaxed(vaddr);
 		break;
@@ -1032,27 +1058,40 @@
 		*val = readq_relaxed(vaddr);
 		break;
 	default:
-		pr_debug("Error: Cannot read %u bit width from PCC for ss: %d\n",
-			 reg->bit_width, pcc_ss_id);
+		if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
+			pr_debug("Error: Cannot read %u bit width from system memory: 0x%llx\n",
+				size, reg->address);
+		} else if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM) {
+			pr_debug("Error: Cannot read %u bit width from PCC for ss: %d\n",
+				size, pcc_ss_id);
+		}
 		return -EFAULT;
 	}
 
+	if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+		*val = MASK_VAL_READ(reg, *val);
+
 	return 0;
 }
 
 static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)
 {
 	int ret_val = 0;
+	int size;
+	u64 prev_val;
 	void __iomem *vaddr = NULL;
 	int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
 	struct cpc_reg *reg = &reg_res->cpc_entry.reg;
+	struct cpc_desc *cpc_desc;
+	unsigned long flags;
+
+	size = GET_BIT_WIDTH(reg);
 
 	if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
-		u32 width = 8 << (reg->access_width - 1);
 		acpi_status status;
 
 		status = acpi_os_write_port((acpi_io_address)reg->address,
-					    (u32)val, width);
+					    (u32)val, size);
 		if (ACPI_FAILURE(status)) {
 			pr_debug("Error: Failed to write SystemIO port %llx\n",
 				 reg->address);
@@ -1060,17 +1099,52 @@
 		}
 
 		return 0;
-	} else if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >= 0)
+	} else if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >= 0) {
+		/*
+		 * For registers in PCC space, the register size is determined
+		 * by the bit width field; the access size is used to indicate
+		 * the PCC subspace id.
+		 */
+		size = reg->bit_width;
 		vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id);
+	}
 	else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
 		vaddr = reg_res->sys_mem_vaddr;
 	else if (reg->space_id == ACPI_ADR_SPACE_FIXED_HARDWARE)
 		return cpc_write_ffh(cpu, reg, val);
 	else
 		return acpi_os_write_memory((acpi_physical_address)reg->address,
-				val, reg->bit_width);
+				val, size);
 
-	switch (reg->bit_width) {
+	if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
+		cpc_desc = per_cpu(cpc_desc_ptr, cpu);
+		if (!cpc_desc) {
+			pr_debug("No CPC descriptor for CPU:%d\n", cpu);
+			return -ENODEV;
+		}
+
+		raw_spin_lock_irqsave(&cpc_desc->rmw_lock, flags);
+		switch (size) {
+		case 8:
+			prev_val = readb_relaxed(vaddr);
+			break;
+		case 16:
+			prev_val = readw_relaxed(vaddr);
+			break;
+		case 32:
+			prev_val = readl_relaxed(vaddr);
+			break;
+		case 64:
+			prev_val = readq_relaxed(vaddr);
+			break;
+		default:
+			raw_spin_unlock_irqrestore(&cpc_desc->rmw_lock, flags);
+			return -EFAULT;
+		}
+		val = MASK_VAL_WRITE(reg, prev_val, val);
+	}
+
+	switch (size) {
 	case 8:
 		writeb_relaxed(val, vaddr);
 		break;
@@ -1084,12 +1158,20 @@
 		writeq_relaxed(val, vaddr);
 		break;
 	default:
-		pr_debug("Error: Cannot write %u bit width to PCC for ss: %d\n",
-			 reg->bit_width, pcc_ss_id);
+		if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
+			pr_debug("Error: Cannot write %u bit width to system memory: 0x%llx\n",
+				size, reg->address);
+		} else if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM) {
+			pr_debug("Error: Cannot write %u bit width to PCC for ss: %d\n",
+				size, pcc_ss_id);
+		}
 		ret_val = -EFAULT;
 		break;
 	}
 
+	if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+		raw_spin_unlock_irqrestore(&cpc_desc->rmw_lock, flags);
+
 	return ret_val;
 }
 
@@ -1158,6 +1240,19 @@
 }
 
 /**
+ * cppc_get_highest_perf - Get the highest performance register value.
+ * @cpunum: CPU from which to get highest performance.
+ * @highest_perf: Return address.
+ *
+ * Return: 0 for success, -EIO otherwise.
+ */
+int cppc_get_highest_perf(int cpunum, u64 *highest_perf)
+{
+	return cppc_get_perf(cpunum, HIGHEST_PERF, highest_perf);
+}
+EXPORT_SYMBOL_GPL(cppc_get_highest_perf);
+
+/**
  * cppc_get_epp_perf - Get the epp register value.
  * @cpunum: CPU from which to get epp preference value.
  * @epp_perf: Return address.
@@ -1427,9 +1522,12 @@
 		/* after writing CPC, transfer the ownership of PCC to platform */
 		ret = send_pcc_cmd(pcc_ss_id, CMD_WRITE);
 		up_write(&pcc_ss_data->pcc_lock);
+	} else if (osc_cpc_flexible_adr_space_confirmed &&
+		   CPC_SUPPORTED(epp_set_reg) && CPC_IN_FFH(epp_set_reg)) {
+		ret = cpc_write(cpu, epp_set_reg, perf_ctrls->energy_perf);
 	} else {
 		ret = -ENOTSUPP;
-		pr_debug("_CPC in PCC is not supported\n");
+		pr_debug("_CPC in PCC and _CPC in FFH are not supported\n");
 	}
 
 	return ret;
@@ -1814,9 +1912,15 @@
 	u64 mul, div;
 
 	if (caps->lowest_freq && caps->nominal_freq) {
-		mul = caps->nominal_freq - caps->lowest_freq;
+		/* Avoid special case when nominal_freq is equal to lowest_freq */
+		if (caps->lowest_freq == caps->nominal_freq) {
+			mul = caps->nominal_freq;
+			div = caps->nominal_perf;
+		} else {
+			mul = caps->nominal_freq - caps->lowest_freq;
+			div = caps->nominal_perf - caps->lowest_perf;
+		}
 		mul *= KHZ_PER_MHZ;
-		div = caps->nominal_perf - caps->lowest_perf;
 		offset = caps->nominal_freq * KHZ_PER_MHZ -
 			 div64_u64(caps->nominal_perf * mul, div);
 	} else {
@@ -1837,11 +1941,17 @@
 {
 	s64 retval, offset = 0;
 	static u64 max_khz;
-	u64  mul, div;
+	u64 mul, div;
 
 	if (caps->lowest_freq && caps->nominal_freq) {
-		mul = caps->nominal_perf - caps->lowest_perf;
-		div = caps->nominal_freq - caps->lowest_freq;
+		/* Avoid special case when nominal_freq is equal to lowest_freq */
+		if (caps->lowest_freq == caps->nominal_freq) {
+			mul = caps->nominal_perf;
+			div = caps->nominal_freq;
+		} else {
+			mul = caps->nominal_perf - caps->lowest_perf;
+			div = caps->nominal_freq - caps->lowest_freq;
+		}
 		/*
 		 * We don't need to convert to kHz for computing offset and can
 		 * directly use nominal_freq and lowest_freq as the div64_u64
--- linux-qcom-6.8.0.orig/drivers/acpi/device_sysfs.c
+++ linux-qcom-6.8.0/drivers/acpi/device_sysfs.c
@@ -540,8 +540,9 @@
 	 * If device has _STR, 'description' file is created
 	 */
 	if (acpi_has_method(dev->handle, "_STR")) {
-		status = acpi_evaluate_object(dev->handle, "_STR",
-					NULL, &buffer);
+		status = acpi_evaluate_object_typed(dev->handle, "_STR",
+						    NULL, &buffer,
+						    ACPI_TYPE_BUFFER);
 		if (ACPI_FAILURE(status))
 			buffer.pointer = NULL;
 		dev->pnp.str_obj = buffer.pointer;
--- linux-qcom-6.8.0.orig/drivers/acpi/ec.c
+++ linux-qcom-6.8.0/drivers/acpi/ec.c
@@ -783,6 +783,9 @@
 	unsigned long tmp;
 	int ret = 0;
 
+	if (t->rdata)
+		memset(t->rdata, 0, t->rlen);
+
 	/* start transaction */
 	spin_lock_irqsave(&ec->lock, tmp);
 	/* Enable GPE for command processing (IBF=0/OBF=1) */
@@ -819,8 +822,6 @@
 
 	if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))
 		return -EINVAL;
-	if (t->rdata)
-		memset(t->rdata, 0, t->rlen);
 
 	mutex_lock(&ec->mutex);
 	if (ec->global_lock) {
@@ -847,7 +848,7 @@
 				.wdata = NULL, .rdata = &d,
 				.wlen = 0, .rlen = 1};
 
-	return acpi_ec_transaction(ec, &t);
+	return acpi_ec_transaction_unlocked(ec, &t);
 }
 
 static int acpi_ec_burst_disable(struct acpi_ec *ec)
@@ -857,7 +858,7 @@
 				.wlen = 0, .rlen = 0};
 
 	return (acpi_ec_read_status(ec) & ACPI_EC_FLAG_BURST) ?
-				acpi_ec_transaction(ec, &t) : 0;
+				acpi_ec_transaction_unlocked(ec, &t) : 0;
 }
 
 static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 *data)
@@ -873,6 +874,19 @@
 	return result;
 }
 
+static int acpi_ec_read_unlocked(struct acpi_ec *ec, u8 address, u8 *data)
+{
+	int result;
+	u8 d;
+	struct transaction t = {.command = ACPI_EC_COMMAND_READ,
+				.wdata = &address, .rdata = &d,
+				.wlen = 1, .rlen = 1};
+
+	result = acpi_ec_transaction_unlocked(ec, &t);
+	*data = d;
+	return result;
+}
+
 static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)
 {
 	u8 wdata[2] = { address, data };
@@ -883,6 +897,16 @@
 	return acpi_ec_transaction(ec, &t);
 }
 
+static int acpi_ec_write_unlocked(struct acpi_ec *ec, u8 address, u8 data)
+{
+	u8 wdata[2] = { address, data };
+	struct transaction t = {.command = ACPI_EC_COMMAND_WRITE,
+				.wdata = wdata, .rdata = NULL,
+				.wlen = 2, .rlen = 0};
+
+	return acpi_ec_transaction_unlocked(ec, &t);
+}
+
 int ec_read(u8 addr, u8 *val)
 {
 	int err;
@@ -1323,6 +1347,7 @@
 	struct acpi_ec *ec = handler_context;
 	int result = 0, i, bytes = bits / 8;
 	u8 *value = (u8 *)value64;
+	u32 glk;
 
 	if ((address > 0xFF) || !value || !handler_context)
 		return AE_BAD_PARAMETER;
@@ -1330,17 +1355,38 @@
 	if (function != ACPI_READ && function != ACPI_WRITE)
 		return AE_BAD_PARAMETER;
 
+	mutex_lock(&ec->mutex);
+
+	if (ec->global_lock) {
+		acpi_status status;
+
+		status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
+		if (ACPI_FAILURE(status)) {
+			result = -ENODEV;
+			goto unlock;
+		}
+	}
+
 	if (ec->busy_polling || bits > 8)
 		acpi_ec_burst_enable(ec);
 
-	for (i = 0; i < bytes; ++i, ++address, ++value)
+	for (i = 0; i < bytes; ++i, ++address, ++value) {
 		result = (function == ACPI_READ) ?
-			acpi_ec_read(ec, address, value) :
-			acpi_ec_write(ec, address, *value);
+			acpi_ec_read_unlocked(ec, address, value) :
+			acpi_ec_write_unlocked(ec, address, *value);
+		if (result < 0)
+			break;
+	}
 
 	if (ec->busy_polling || bits > 8)
 		acpi_ec_burst_disable(ec);
 
+	if (ec->global_lock)
+		acpi_release_global_lock(glk);
+
+unlock:
+	mutex_unlock(&ec->mutex);
+
 	switch (result) {
 	case -EINVAL:
 		return AE_BAD_PARAMETER;
@@ -1348,8 +1394,10 @@
 		return AE_NOT_FOUND;
 	case -ETIME:
 		return AE_TIME;
-	default:
+	case 0:
 		return AE_OK;
+	default:
+		return AE_ERROR;
 	}
 }
 
@@ -1487,8 +1535,10 @@
 	acpi_ec_start(ec, false);
 
 	if (!test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
+		acpi_handle scope_handle = ec == first_ec ? ACPI_ROOT_OBJECT : ec->handle;
+
 		acpi_ec_enter_noirq(ec);
-		status = acpi_install_address_space_handler_no_reg(ec->handle,
+		status = acpi_install_address_space_handler_no_reg(scope_handle,
 								   ACPI_ADR_SPACE_EC,
 								   &acpi_ec_space_handler,
 								   NULL, ec);
@@ -1497,11 +1547,10 @@
 			return -ENODEV;
 		}
 		set_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags);
-		ec->address_space_handler_holder = ec->handle;
 	}
 
 	if (call_reg && !test_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags)) {
-		acpi_execute_reg_methods(ec->handle, ACPI_ADR_SPACE_EC);
+		acpi_execute_reg_methods(ec->handle, ACPI_UINT32_MAX, ACPI_ADR_SPACE_EC);
 		set_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags);
 	}
 
@@ -1553,10 +1602,13 @@
 
 static void ec_remove_handlers(struct acpi_ec *ec)
 {
+	acpi_handle scope_handle = ec == first_ec ? ACPI_ROOT_OBJECT : ec->handle;
+
 	if (test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
 		if (ACPI_FAILURE(acpi_remove_address_space_handler(
-					ec->address_space_handler_holder,
-					ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
+						scope_handle,
+						ACPI_ADR_SPACE_EC,
+						&acpi_ec_space_handler)))
 			pr_err("failed to remove space handler\n");
 		clear_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags);
 	}
@@ -1595,14 +1647,18 @@
 {
 	int ret;
 
-	ret = ec_install_handlers(ec, device, call_reg);
-	if (ret)
-		return ret;
-
 	/* First EC capable of handling transactions */
 	if (!first_ec)
 		first_ec = ec;
 
+	ret = ec_install_handlers(ec, device, call_reg);
+	if (ret) {
+		if (ec == first_ec)
+			first_ec = NULL;
+
+		return ret;
+	}
+
 	pr_info("EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n", ec->command_addr,
 		ec->data_addr);
 
@@ -1709,6 +1765,12 @@
 	}
 }
 
+void acpi_ec_register_opregions(struct acpi_device *adev)
+{
+	if (first_ec && first_ec->handle != adev->handle)
+		acpi_execute_reg_methods(adev->handle, 1, ACPI_ADR_SPACE_EC);
+}
+
 static acpi_status
 ec_parse_io_ports(struct acpi_resource *resource, void *context)
 {
--- linux-qcom-6.8.0.orig/drivers/acpi/internal.h
+++ linux-qcom-6.8.0/drivers/acpi/internal.h
@@ -184,7 +184,6 @@
 
 struct acpi_ec {
 	acpi_handle handle;
-	acpi_handle address_space_handler_holder;
 	int gpe;
 	int irq;
 	unsigned long command_addr;
@@ -222,6 +221,7 @@
 			      acpi_handle handle, acpi_ec_query_func func,
 			      void *data);
 void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit);
+void acpi_ec_register_opregions(struct acpi_device *adev);
 
 #ifdef CONFIG_PM_SLEEP
 void acpi_ec_flush_work(void);
@@ -301,5 +301,10 @@
 void acpi_mipi_scan_crs_csi2(void);
 void acpi_mipi_init_crs_csi2_swnodes(void);
 void acpi_mipi_crs_csi2_cleanup(void);
+#ifdef CONFIG_X86
+bool acpi_graph_ignore_port(acpi_handle handle);
+#else
+static inline bool acpi_graph_ignore_port(acpi_handle handle) { return false; }
+#endif
 
 #endif /* _ACPI_INTERNAL_H_ */
--- linux-qcom-6.8.0.orig/drivers/acpi/mipi-disco-img.c
+++ linux-qcom-6.8.0/drivers/acpi/mipi-disco-img.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/acpi.h>
+#include <linux/dmi.h>
 #include <linux/limits.h>
 #include <linux/list.h>
 #include <linux/module.h>
@@ -723,3 +724,83 @@
 	list_for_each_entry_safe(csi2, csi2_tmp, &acpi_mipi_crs_csi2_list, entry)
 		acpi_mipi_del_crs_csi2(csi2);
 }
+
+#ifdef CONFIG_X86
+#include <asm/cpu_device_id.h>
+#include <asm/intel-family.h>
+
+/* CPU matches for Dell generations with broken ACPI MIPI DISCO info */
+static const struct x86_cpu_id dell_broken_mipi_disco_cpu_gens[] = {
+	X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE, NULL),
+	X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE_L, NULL),
+	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE, NULL),
+	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, NULL),
+	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, NULL),
+	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, NULL),
+	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, NULL),
+	{}
+};
+
+static const char *strnext(const char *s1, const char *s2)
+{
+	s1 = strstr(s1, s2);
+
+	if (!s1)
+		return NULL;
+
+	return s1 + strlen(s2);
+}
+
+/**
+ * acpi_graph_ignore_port - Tell whether a port node should be ignored
+ * @handle: The ACPI handle of the node (which may be a port node)
+ *
+ * Return: true if a port node should be ignored and the data to that should
+ * come from other sources instead (Windows ACPI definitions and
+ * ipu-bridge). This is currently used to ignore bad port nodes related to IPU6
+ * ("IPU?") and camera sensor devices ("LNK?") in certain Dell systems with
+ * Intel VSC.
+ */
+bool acpi_graph_ignore_port(acpi_handle handle)
+{
+	const char *path = NULL, *orig_path;
+	static bool dmi_tested, ignore_port;
+
+	if (!dmi_tested) {
+		if (dmi_name_in_vendors("Dell Inc.") &&
+		    x86_match_cpu(dell_broken_mipi_disco_cpu_gens))
+			ignore_port = true;
+
+		dmi_tested = true;
+	}
+
+	if (!ignore_port)
+		return false;
+
+	/* Check if the device is either "IPU" or "LNK" (sensor). */
+	orig_path = acpi_handle_path(handle);
+	if (!orig_path)
+		return false;
+	path = strnext(orig_path, "IPU");
+	if (!path)
+		path = strnext(orig_path, "LNK");
+	if (!path)
+		goto out_free;
+
+	if (!(isdigit(path[0]) && path[1] == '.'))
+		goto out_free;
+
+	/* Check if the node has a "PRT" prefix. */
+	path = strnext(path, "PRT");
+	if (path && isdigit(path[0]) && !path[1]) {
+		acpi_handle_debug(handle, "ignoring data node\n");
+
+		kfree(orig_path);
+		return true;
+	}
+
+out_free:
+	kfree(orig_path);
+	return false;
+}
+#endif
--- linux-qcom-6.8.0.orig/drivers/acpi/nfit/core.c
+++ linux-qcom-6.8.0/drivers/acpi/nfit/core.c
@@ -454,8 +454,13 @@
 	if (cmd_rc)
 		*cmd_rc = -EINVAL;
 
-	if (cmd == ND_CMD_CALL)
+	if (cmd == ND_CMD_CALL) {
+		if (!buf || buf_len < sizeof(*call_pkg))
+			return -EINVAL;
+
 		call_pkg = buf;
+	}
+
 	func = cmd_to_func(nfit_mem, cmd, call_pkg, &family);
 	if (func < 0)
 		return func;
--- linux-qcom-6.8.0.orig/drivers/acpi/numa/hmat.c
+++ linux-qcom-6.8.0/drivers/acpi/numa/hmat.c
@@ -59,9 +59,8 @@
 };
 
 enum {
-	NODE_ACCESS_CLASS_0 = 0,
-	NODE_ACCESS_CLASS_1,
-	NODE_ACCESS_CLASS_GENPORT_SINK,
+	NODE_ACCESS_CLASS_GENPORT_SINK_LOCAL = ACCESS_COORDINATE_MAX,
+	NODE_ACCESS_CLASS_GENPORT_SINK_CPU,
 	NODE_ACCESS_CLASS_MAX,
 };
 
@@ -127,7 +126,8 @@
 /**
  * acpi_get_genport_coordinates - Retrieve the access coordinates for a generic port
  * @uid: ACPI unique id
- * @coord: The access coordinates written back out for the generic port
+ * @coord: The access coordinates written back out for the generic port.
+ *	   Expect 2 levels array.
  *
  * Return: 0 on success. Errno on failure.
  *
@@ -143,7 +143,10 @@
 	if (!target)
 		return -ENOENT;
 
-	*coord = target->coord[NODE_ACCESS_CLASS_GENPORT_SINK];
+	coord[ACCESS_COORDINATE_LOCAL] =
+		target->coord[NODE_ACCESS_CLASS_GENPORT_SINK_LOCAL];
+	coord[ACCESS_COORDINATE_CPU] =
+		target->coord[NODE_ACCESS_CLASS_GENPORT_SINK_CPU];
 
 	return 0;
 }
@@ -374,11 +377,11 @@
 
 	if (target && target->processor_pxm == init_pxm) {
 		hmat_update_target_access(target, type, value,
-					  NODE_ACCESS_CLASS_0);
+					  ACCESS_COORDINATE_LOCAL);
 		/* If the node has a CPU, update access 1 */
 		if (node_state(pxm_to_node(init_pxm), N_CPU))
 			hmat_update_target_access(target, type, value,
-						  NODE_ACCESS_CLASS_1);
+						  ACCESS_COORDINATE_CPU);
 	}
 }
 
@@ -697,7 +700,8 @@
 	int i;
 
 	/* Don't update for generic port if there's no device handle */
-	if (access == NODE_ACCESS_CLASS_GENPORT_SINK &&
+	if ((access == NODE_ACCESS_CLASS_GENPORT_SINK_LOCAL ||
+	     access == NODE_ACCESS_CLASS_GENPORT_SINK_CPU) &&
 	    !(*(u16 *)target->gen_port_device_handle))
 		return;
 
@@ -709,7 +713,8 @@
 	 */
 	if (target->processor_pxm != PXM_INVAL) {
 		cpu_nid = pxm_to_node(target->processor_pxm);
-		if (access == 0 || node_state(cpu_nid, N_CPU)) {
+		if (access == ACCESS_COORDINATE_LOCAL ||
+		    node_state(cpu_nid, N_CPU)) {
 			set_bit(target->processor_pxm, p_nodes);
 			return;
 		}
@@ -737,7 +742,9 @@
 		list_for_each_entry(initiator, &initiators, node) {
 			u32 value;
 
-			if (access == 1 && !initiator->has_cpu) {
+			if ((access == ACCESS_COORDINATE_CPU ||
+			     access == NODE_ACCESS_CLASS_GENPORT_SINK_CPU) &&
+			    !initiator->has_cpu) {
 				clear_bit(initiator->processor_pxm, p_nodes);
 				continue;
 			}
@@ -770,20 +777,24 @@
 	}
 }
 
-static void hmat_register_generic_target_initiators(struct memory_target *target)
+static void hmat_update_generic_target(struct memory_target *target)
 {
 	static DECLARE_BITMAP(p_nodes, MAX_NUMNODES);
 
-	__hmat_register_target_initiators(target, p_nodes,
-					  NODE_ACCESS_CLASS_GENPORT_SINK);
+	hmat_update_target_attrs(target, p_nodes,
+				 NODE_ACCESS_CLASS_GENPORT_SINK_LOCAL);
+	hmat_update_target_attrs(target, p_nodes,
+				 NODE_ACCESS_CLASS_GENPORT_SINK_CPU);
 }
 
 static void hmat_register_target_initiators(struct memory_target *target)
 {
 	static DECLARE_BITMAP(p_nodes, MAX_NUMNODES);
 
-	__hmat_register_target_initiators(target, p_nodes, 0);
-	__hmat_register_target_initiators(target, p_nodes, 1);
+	__hmat_register_target_initiators(target, p_nodes,
+					  ACCESS_COORDINATE_LOCAL);
+	__hmat_register_target_initiators(target, p_nodes,
+					  ACCESS_COORDINATE_CPU);
 }
 
 static void hmat_register_target_cache(struct memory_target *target)
@@ -835,7 +846,7 @@
 	 */
 	mutex_lock(&target_lock);
 	if (*(u16 *)target->gen_port_device_handle) {
-		hmat_register_generic_target_initiators(target);
+		hmat_update_generic_target(target);
 		target->registered = true;
 	}
 	mutex_unlock(&target_lock);
@@ -854,8 +865,8 @@
 	if (!target->registered) {
 		hmat_register_target_initiators(target);
 		hmat_register_target_cache(target);
-		hmat_register_target_perf(target, NODE_ACCESS_CLASS_0);
-		hmat_register_target_perf(target, NODE_ACCESS_CLASS_1);
+		hmat_register_target_perf(target, ACCESS_COORDINATE_LOCAL);
+		hmat_register_target_perf(target, ACCESS_COORDINATE_CPU);
 		target->registered = true;
 	}
 	mutex_unlock(&target_lock);
@@ -927,7 +938,7 @@
 		return NOTIFY_OK;
 
 	mutex_lock(&target_lock);
-	hmat_update_target_attrs(target, p_nodes, 1);
+	hmat_update_target_attrs(target, p_nodes, ACCESS_COORDINATE_CPU);
 	mutex_unlock(&target_lock);
 
 	perf = &target->coord[1];
--- linux-qcom-6.8.0.orig/drivers/acpi/numa/srat.c
+++ linux-qcom-6.8.0/drivers/acpi/numa/srat.c
@@ -206,6 +206,11 @@
 	return acpi_numa < 0;
 }
 
+__weak int __init numa_fill_memblks(u64 start, u64 end)
+{
+	return NUMA_NO_MEMBLK;
+}
+
 #if defined(CONFIG_X86) || defined(CONFIG_ARM64) || defined(CONFIG_LOONGARCH)
 /*
  * Callback for SLIT parsing.  pxm_to_node() returns NUMA_NO_NODE for
--- linux-qcom-6.8.0.orig/drivers/acpi/osi.c
+++ linux-qcom-6.8.0/drivers/acpi/osi.c
@@ -444,6 +444,77 @@
 	},
 
 	/*
+	 * The following Lenovo models have a broken workaround in the
+	 * acpi_video backlight implementation to meet the Windows 8
+	 * requirement of 101 backlight levels. Reverting to pre-Win8
+	 * behavior fixes the problem.
+	 */
+	{
+	.callback = dmi_disable_osi_win8,
+	.ident = "Lenovo ThinkPad L430",
+	.matches = {
+		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L430"),
+		},
+	},
+	{
+	.callback = dmi_disable_osi_win8,
+	.ident = "Lenovo ThinkPad T430",
+	.matches = {
+		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430"),
+		},
+	},
+	{
+	.callback = dmi_disable_osi_win8,
+	.ident = "Lenovo ThinkPad T430s",
+	.matches = {
+		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430s"),
+		},
+	},
+	{
+	.callback = dmi_disable_osi_win8,
+	.ident = "Lenovo ThinkPad T530",
+	.matches = {
+		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T530"),
+		},
+	},
+	{
+	.callback = dmi_disable_osi_win8,
+	.ident = "Lenovo ThinkPad W530",
+	.matches = {
+		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W530"),
+		},
+	},
+	{
+	.callback = dmi_disable_osi_win8,
+	.ident = "Lenovo ThinkPad X1 Carbon",
+	.matches = {
+		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X1 Carbon"),
+		},
+	},
+	{
+	.callback = dmi_disable_osi_win8,
+	.ident = "Lenovo ThinkPad X230",
+	.matches = {
+		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X230"),
+		},
+	},
+	{
+	.callback = dmi_disable_osi_win8,
+	.ident = "Lenovo ThinkPad Edge E330",
+	.matches = {
+		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Edge E330"),
+		},
+	},
+
+	/*
 	 * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
 	 * Linux ignores it, except for the machines enumerated below.
 	 */
--- linux-qcom-6.8.0.orig/drivers/acpi/pmic/tps68470_pmic.c
+++ linux-qcom-6.8.0/drivers/acpi/pmic/tps68470_pmic.c
@@ -376,10 +376,8 @@
 	struct tps68470_pmic_opregion *opregion;
 	acpi_status status;
 
-	if (!dev || !tps68470_regmap) {
-		dev_warn(dev, "dev or regmap is NULL\n");
-		return -EINVAL;
-	}
+	if (!tps68470_regmap)
+		return dev_err_probe(dev, -EINVAL, "regmap is missing\n");
 
 	if (!handle) {
 		dev_warn(dev, "acpi handle is NULL\n");
--- linux-qcom-6.8.0.orig/drivers/acpi/prmt.c
+++ linux-qcom-6.8.0/drivers/acpi/prmt.c
@@ -52,7 +52,7 @@
 static LIST_HEAD(prm_module_list);
 
 struct prm_handler_info {
-	guid_t guid;
+	efi_guid_t guid;
 	efi_status_t (__efiapi *handler_addr)(u64, void *);
 	u64 static_data_buffer_addr;
 	u64 acpi_param_buffer_addr;
@@ -72,17 +72,21 @@
 	struct prm_handler_info handlers[] __counted_by(handler_count);
 };
 
-static u64 efi_pa_va_lookup(u64 pa)
+static u64 efi_pa_va_lookup(efi_guid_t *guid, u64 pa)
 {
 	efi_memory_desc_t *md;
 	u64 pa_offset = pa & ~PAGE_MASK;
 	u64 page = pa & PAGE_MASK;
 
 	for_each_efi_memory_desc(md) {
-		if (md->phys_addr < pa && pa < md->phys_addr + PAGE_SIZE * md->num_pages)
+		if ((md->attribute & EFI_MEMORY_RUNTIME) &&
+		    (md->phys_addr < pa && pa < md->phys_addr + PAGE_SIZE * md->num_pages)) {
 			return pa_offset + md->virt_addr + page - md->phys_addr;
+		}
 	}
 
+	pr_warn("Failed to find VA for GUID: %pUL, PA: 0x%llx", guid, pa);
+
 	return 0;
 }
 
@@ -148,9 +152,15 @@
 		th = &tm->handlers[cur_handler];
 
 		guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
-		th->handler_addr = (void *)efi_pa_va_lookup(handler_info->handler_address);
-		th->static_data_buffer_addr = efi_pa_va_lookup(handler_info->static_data_buffer_address);
-		th->acpi_param_buffer_addr = efi_pa_va_lookup(handler_info->acpi_param_buffer_address);
+		th->handler_addr =
+			(void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+
+		th->static_data_buffer_addr =
+			efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+
+		th->acpi_param_buffer_addr =
+			efi_pa_va_lookup(&th->guid, handler_info->acpi_param_buffer_address);
+
 	} while (++cur_handler < tm->handler_count && (handler_info = get_next_handler(handler_info)));
 
 	return 0;
@@ -253,6 +263,13 @@
 		if (!handler || !module)
 			goto invalid_guid;
 
+		if (!handler->handler_addr ||
+		    !handler->static_data_buffer_addr ||
+		    !handler->acpi_param_buffer_addr) {
+			buffer->prm_status = PRM_HANDLER_ERROR;
+			return AE_OK;
+		}
+
 		ACPI_COPY_NAMESEG(context.signature, "PRMC");
 		context.revision = 0x0;
 		context.reserved = 0x0;
--- linux-qcom-6.8.0.orig/drivers/acpi/processor_idle.c
+++ linux-qcom-6.8.0/drivers/acpi/processor_idle.c
@@ -16,7 +16,6 @@
 #include <linux/acpi.h>
 #include <linux/dmi.h>
 #include <linux/sched.h>       /* need_resched() */
-#include <linux/sort.h>
 #include <linux/tick.h>
 #include <linux/cpuidle.h>
 #include <linux/cpu.h>
@@ -386,25 +385,24 @@
 	acpi_write_bit_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
 }
 
-static int acpi_cst_latency_cmp(const void *a, const void *b)
+static void acpi_cst_latency_sort(struct acpi_processor_cx *states, size_t length)
 {
-	const struct acpi_processor_cx *x = a, *y = b;
+	int i, j, k;
 
-	if (!(x->valid && y->valid))
-		return 0;
-	if (x->latency > y->latency)
-		return 1;
-	if (x->latency < y->latency)
-		return -1;
-	return 0;
-}
-static void acpi_cst_latency_swap(void *a, void *b, int n)
-{
-	struct acpi_processor_cx *x = a, *y = b;
+	for (i = 1; i < length; i++) {
+		if (!states[i].valid)
+			continue;
 
-	if (!(x->valid && y->valid))
-		return;
-	swap(x->latency, y->latency);
+		for (j = i - 1, k = i; j >= 0; j--) {
+			if (!states[j].valid)
+				continue;
+
+			if (states[j].latency > states[k].latency)
+				swap(states[j].latency, states[k].latency);
+
+			k = j;
+		}
+	}
 }
 
 static int acpi_processor_power_verify(struct acpi_processor *pr)
@@ -449,10 +447,7 @@
 
 	if (buggy_latency) {
 		pr_notice("FW issue: working around C-state latencies out of order\n");
-		sort(&pr->power.states[1], max_cstate,
-		     sizeof(struct acpi_processor_cx),
-		     acpi_cst_latency_cmp,
-		     acpi_cst_latency_swap);
+		acpi_cst_latency_sort(&pr->power.states[1], max_cstate);
 	}
 
 	lapic_timer_propagate_broadcast(pr);
@@ -1430,6 +1425,8 @@
 		acpi_processor_registered--;
 		if (acpi_processor_registered == 0)
 			cpuidle_unregister_driver(&acpi_idle_driver);
+
+		kfree(dev);
 	}
 
 	pr->flags.power_setup_done = 0;
--- linux-qcom-6.8.0.orig/drivers/acpi/property.c
+++ linux-qcom-6.8.0/drivers/acpi/property.c
@@ -80,6 +80,9 @@
 	struct acpi_data_node *dn;
 	bool result;
 
+	if (acpi_graph_ignore_port(handle))
+		return false;
+
 	dn = kzalloc(sizeof(*dn), GFP_KERNEL);
 	if (!dn)
 		return false;
--- linux-qcom-6.8.0.orig/drivers/acpi/resource.c
+++ linux-qcom-6.8.0/drivers/acpi/resource.c
@@ -250,6 +250,9 @@
 	switch (addr->resource_type) {
 	case ACPI_MEMORY_RANGE:
 		acpi_dev_memresource_flags(res, len, wp);
+
+		if (addr->info.mem.caching == ACPI_PREFETCHABLE_MEMORY)
+			res->flags |= IORESOURCE_PREFETCH;
 		break;
 	case ACPI_IO_RANGE:
 		acpi_dev_ioresource_flags(res, len, iodec,
@@ -265,9 +268,6 @@
 	if (addr->producer_consumer == ACPI_PRODUCER)
 		res->flags |= IORESOURCE_WINDOW;
 
-	if (addr->info.mem.caching == ACPI_PREFETCHABLE_MEMORY)
-		res->flags |= IORESOURCE_PREFETCH;
-
 	return !(res->flags & IORESOURCE_DISABLED);
 }
 
@@ -441,6 +441,20 @@
 		},
 	},
 	{
+		/* Asus Vivobook X1504VAP */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "X1504VAP"),
+		},
+	},
+	{
+		/* Asus Vivobook X1704VAP */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "X1704VAP"),
+		},
+	},
+	{
 		/* Asus ExpertBook B1402CBA */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
@@ -469,38 +483,38 @@
 		},
 	},
 	{
-		/* Asus ExpertBook B2402CBA */
+		/* Asus ExpertBook B2402 (B2402CBA / B2402FBA / B2402CVA / B2402FVA) */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-			DMI_MATCH(DMI_BOARD_NAME, "B2402CBA"),
+			DMI_MATCH(DMI_BOARD_NAME, "B2402"),
 		},
 	},
 	{
-		/* Asus ExpertBook B2402FBA */
+		/* Asus ExpertBook B2502 (B2502CBA / B2502FBA / B2502CVA / B2502FVA) */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-			DMI_MATCH(DMI_BOARD_NAME, "B2402FBA"),
+			DMI_MATCH(DMI_BOARD_NAME, "B2502"),
 		},
 	},
 	{
-		/* Asus ExpertBook B2502 */
+		/* Asus Vivobook Go E1404GA* */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-			DMI_MATCH(DMI_BOARD_NAME, "B2502CBA"),
+			DMI_MATCH(DMI_BOARD_NAME, "E1404GA"),
 		},
 	},
 	{
-		/* Asus Vivobook E1504GA */
+		/* Asus Vivobook E1504GA* */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
 			DMI_MATCH(DMI_BOARD_NAME, "E1504GA"),
 		},
 	},
 	{
-		/* Asus Vivobook E1504GAB */
+		/* Asus Vivobook Pro N6506M* */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-			DMI_MATCH(DMI_BOARD_NAME, "E1504GAB"),
+			DMI_MATCH(DMI_BOARD_NAME, "N6506M"),
 		},
 	},
 	{
@@ -510,6 +524,25 @@
 			DMI_MATCH(DMI_BOARD_NAME, "17U70P"),
 		},
 	},
+	{
+		/* TongFang GXxHRXx/TUXEDO InfinityBook Pro Gen9 AMD */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GXxHRXx"),
+		},
+	},
+	{
+		/* TongFang GMxHGxx/TUXEDO Stellaris Slim Gen1 AMD */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"),
+		},
+	},
+	{
+		/* LG Electronics 16T90SP */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+			DMI_MATCH(DMI_BOARD_NAME, "16T90SP"),
+		},
+	},
 	{ }
 };
 
@@ -520,6 +553,18 @@
  */
 static const struct dmi_system_id irq1_edge_low_force_override[] = {
 	{
+		/* MECHREV Jiaolong17KS Series GM7XG0M */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GM7XG0M"),
+		},
+	},
+	{
+		/* XMG APEX 17 (M23) */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GMxBGxx"),
+		},
+	},
+	{
 		/* TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"),
@@ -532,6 +577,12 @@
 		},
 	},
 	{
+		/* TongFang GMxXGxX/TUXEDO Polaris 15 Gen5 AMD */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"),
+		},
+	},
+	{
 		/* TongFang GMxXGxx sold as Eluktronics Inc. RP-15 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."),
@@ -588,6 +639,57 @@
 			DMI_MATCH(DMI_BOARD_NAME, "GM5RGEE0016COM"),
 		},
 	},
+	{
+		/* Lunnen Ground 15 / AMD Ryzen 5 5500U */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Lunnen"),
+			DMI_MATCH(DMI_BOARD_NAME, "LLL5DAW"),
+		},
+	},
+	{
+		/* Lunnen Ground 16 / AMD Ryzen 7 5800U */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Lunnen"),
+			DMI_MATCH(DMI_BOARD_NAME, "LL6FA"),
+		},
+	},
+	{
+		/* MAIBENBEN X577 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "MAIBENBEN"),
+			DMI_MATCH(DMI_BOARD_NAME, "X577"),
+		},
+	},
+	{
+		/* Maibenben X565 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "MAIBENBEN"),
+			DMI_MATCH(DMI_BOARD_NAME, "X565"),
+		},
+	},
+	{
+		/* TongFang GXxHRXx/TUXEDO InfinityBook Pro Gen9 AMD */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GXxHRXx"),
+		},
+	},
+	{
+		/* TongFang GMxHGxx/TUXEDO Stellaris Slim Gen1 AMD */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"),
+		},
+	},
+	{
+		/*
+		 * TongFang GM5HG0A in case of the SKIKK Vanaheim relabel the
+		 * board-name is changed, so check OEM strings instead. Note
+		 * OEM string matches are always exact matches.
+		 * https://bugzilla.kernel.org/show_bug.cgi?id=219614
+		 */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_OEM_STRING, "GM5HG0A"),
+		},
+	},
 	{ }
 };
 
@@ -613,11 +715,11 @@
 	for (i = 0; i < ARRAY_SIZE(override_table); i++) {
 		const struct irq_override_cmp *entry = &override_table[i];
 
-		if (dmi_check_system(entry->system) &&
-		    entry->irq == gsi &&
+		if (entry->irq == gsi &&
 		    entry->triggering == triggering &&
 		    entry->polarity == polarity &&
-		    entry->shareable == shareable)
+		    entry->shareable == shareable &&
+		    dmi_check_system(entry->system))
 			return entry->override;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/acpi/sbs.c
+++ linux-qcom-6.8.0/drivers/acpi/sbs.c
@@ -77,7 +77,6 @@
 	u16 spec;
 	u8 id;
 	u8 present:1;
-	u8 have_sysfs_alarm:1;
 };
 
 #define to_acpi_battery(x) power_supply_get_drvdata(x)
@@ -462,12 +461,18 @@
 	return count;
 }
 
-static const struct device_attribute alarm_attr = {
+static struct device_attribute alarm_attr = {
 	.attr = {.name = "alarm", .mode = 0644},
 	.show = acpi_battery_alarm_show,
 	.store = acpi_battery_alarm_store,
 };
 
+static struct attribute *acpi_battery_attrs[] = {
+	&alarm_attr.attr,
+	NULL
+};
+ATTRIBUTE_GROUPS(acpi_battery);
+
 /* --------------------------------------------------------------------------
                                  Driver Interface
    -------------------------------------------------------------------------- */
@@ -518,7 +523,10 @@
 static int acpi_battery_add(struct acpi_sbs *sbs, int id)
 {
 	struct acpi_battery *battery = &sbs->battery[id];
-	struct power_supply_config psy_cfg = { .drv_data = battery, };
+	struct power_supply_config psy_cfg = {
+		.drv_data = battery,
+		.attr_grp = acpi_battery_groups,
+	};
 	int result;
 
 	battery->id = id;
@@ -548,10 +556,6 @@
 		goto end;
 	}
 
-	result = device_create_file(&battery->bat->dev, &alarm_attr);
-	if (result)
-		goto end;
-	battery->have_sysfs_alarm = 1;
       end:
 	pr_info("%s [%s]: Battery Slot [%s] (battery %s)\n",
 	       ACPI_SBS_DEVICE_NAME, acpi_device_bid(sbs->device),
@@ -563,11 +567,8 @@
 {
 	struct acpi_battery *battery = &sbs->battery[id];
 
-	if (battery->bat) {
-		if (battery->have_sysfs_alarm)
-			device_remove_file(&battery->bat->dev, &alarm_attr);
+	if (battery->bat)
 		power_supply_unregister(battery->bat);
-	}
 }
 
 static int acpi_charger_add(struct acpi_sbs *sbs)
@@ -610,7 +611,7 @@
 	if (sbs->charger_exists) {
 		acpi_ac_get_present(sbs);
 		if (sbs->charger_present != saved_charger_state)
-			kobject_uevent(&sbs->charger->dev.kobj, KOBJ_CHANGE);
+			power_supply_changed(sbs->charger);
 	}
 
 	if (sbs->manager_present) {
@@ -622,7 +623,7 @@
 			acpi_battery_read(bat);
 			if (saved_battery_state == bat->present)
 				continue;
-			kobject_uevent(&bat->bat->dev.kobj, KOBJ_CHANGE);
+			power_supply_changed(bat->bat);
 		}
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/acpi/scan.c
+++ linux-qcom-6.8.0/drivers/acpi/scan.c
@@ -314,18 +314,14 @@
 		 * again).
 		 */
 		if (adev->handler) {
-			dev_warn(&adev->dev, "Already enumerated\n");
-			return -EALREADY;
+			dev_dbg(&adev->dev, "Already enumerated\n");
+			return 0;
 		}
 		error = acpi_bus_scan(adev->handle);
 		if (error) {
 			dev_warn(&adev->dev, "Namespace scan failure\n");
 			return error;
 		}
-		if (!adev->handler) {
-			dev_warn(&adev->dev, "Enumeration failure\n");
-			error = -ENODEV;
-		}
 	} else {
 		error = acpi_scan_device_not_enumerated(adev);
 	}
@@ -798,6 +794,7 @@
 	"INTC1059", /* IVSC (TGL) driver must be loaded to allow i2c access to camera sensors */
 	"INTC1095", /* IVSC (ADL) driver must be loaded to allow i2c access to camera sensors */
 	"INTC100A", /* IVSC (RPL) driver must be loaded to allow i2c access to camera sensors */
+	"INTC10CF", /* IVSC (MTL) driver must be loaded to allow i2c access to camera sensors */
 	NULL
 };
 
@@ -1806,7 +1803,8 @@
 			if (dep->honor_dep)
 				adev->flags.honor_deps = 1;
 
-			adev->dep_unmet++;
+			if (!dep->met)
+				adev->dep_unmet++;
 		}
 	}
 }
@@ -2226,6 +2224,8 @@
 	if (device->handler)
 		goto ok;
 
+	acpi_ec_register_opregions(device);
+
 	if (!device->flags.initialized) {
 		device->flags.power_manageable =
 			device->power.states[ACPI_STATE_D0].flags.valid;
--- linux-qcom-6.8.0.orig/drivers/acpi/sleep.c
+++ linux-qcom-6.8.0/drivers/acpi/sleep.c
@@ -385,18 +385,6 @@
 		DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"),
 		},
 	},
-	/*
-	 * ASUS B1400CEAE hangs on resume from suspend (see
-	 * https://bugzilla.kernel.org/show_bug.cgi?id=215742).
-	 */
-	{
-	.callback = init_default_s3,
-	.ident = "ASUS B1400CEAE",
-	.matches = {
-		DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-		DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK B1400CEAE"),
-		},
-	},
 	{},
 };
 
--- linux-qcom-6.8.0.orig/drivers/acpi/thermal.c
+++ linux-qcom-6.8.0/drivers/acpi/thermal.c
@@ -167,11 +167,17 @@
 
 static int acpi_thermal_temp(struct acpi_thermal *tz, int temp_deci_k)
 {
+	int temp;
+
 	if (temp_deci_k == THERMAL_TEMP_INVALID)
 		return THERMAL_TEMP_INVALID;
 
-	return deci_kelvin_to_millicelsius_with_offset(temp_deci_k,
+	temp = deci_kelvin_to_millicelsius_with_offset(temp_deci_k,
 						       tz->kelvin_offset);
+	if (temp <= 0)
+		return THERMAL_TEMP_INVALID;
+
+	return temp;
 }
 
 static bool acpi_thermal_trip_valid(struct acpi_thermal_trip *acpi_trip)
--- linux-qcom-6.8.0.orig/drivers/acpi/utils.c
+++ linux-qcom-6.8.0/drivers/acpi/utils.c
@@ -559,7 +559,7 @@
  *
  * Caller must free the returned buffer
  */
-static char *acpi_handle_path(acpi_handle handle)
+char *acpi_handle_path(acpi_handle handle)
 {
 	struct acpi_buffer buffer = {
 		.length = ACPI_ALLOCATE_BUFFER,
--- linux-qcom-6.8.0.orig/drivers/acpi/video_detect.c
+++ linux-qcom-6.8.0/drivers/acpi/video_detect.c
@@ -252,6 +252,14 @@
 		DMI_MATCH(DMI_PRODUCT_NAME, "PCG-FRV35"),
 		},
 	},
+	{
+	 .callback = video_detect_force_vendor,
+	 /* Panasonic Toughbook CF-18 */
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Matsushita Electric Industrial"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "CF-18"),
+		},
+	},
 
 	/*
 	 * Toshiba models with Transflective display, these need to use
@@ -499,6 +507,14 @@
 	},
 	{
 	 .callback = video_detect_force_native,
+	 /* Lenovo Slim 7 16ARH7 */
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "82UX"),
+		},
+	},
+	{
+	 .callback = video_detect_force_native,
 	 /* Lenovo ThinkPad X131e (3371 AMD version) */
 	 .matches = {
 		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
@@ -532,6 +548,38 @@
 		},
 	},
 	{
+	 .callback = video_detect_force_native,
+	 /* Apple MacBook Air 7,2 */
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir7,2"),
+		},
+	},
+	{
+	 .callback = video_detect_force_native,
+	 /* Apple MacBook Air 9,1 */
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"),
+		},
+	},
+	{
+	 .callback = video_detect_force_native,
+	 /* Apple MacBook Pro 9,2 */
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro9,2"),
+		},
+	},
+	{
+	 .callback = video_detect_force_native,
+	 /* Apple MacBook Pro 11,2 */
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro11,2"),
+		},
+	},
+	{
 	 /* https://bugzilla.redhat.com/show_bug.cgi?id=1217249 */
 	 .callback = video_detect_force_native,
 	 /* Apple MacBook Pro 12,1 */
@@ -542,6 +590,14 @@
 	},
 	{
 	 .callback = video_detect_force_native,
+	 /* Apple MacBook Pro 16,2 */
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
+		},
+	},
+	{
+	 .callback = video_detect_force_native,
 	 /* Dell Inspiron N4010 */
 	 .matches = {
 		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
@@ -894,6 +950,7 @@
 	static DEFINE_MUTEX(init_mutex);
 	static bool nvidia_wmi_ec_present;
 	static bool apple_gmux_present;
+	static bool dell_uart_backlight_present;
 	static bool native_available;
 	static bool init_done;
 	static long video_caps;
@@ -908,6 +965,7 @@
 				    &video_caps, NULL);
 		nvidia_wmi_ec_present = nvidia_wmi_ec_supported();
 		apple_gmux_present = apple_gmux_detect(NULL, NULL);
+		dell_uart_backlight_present = acpi_dev_found("DELL0501");
 		init_done = true;
 	}
 	if (native)
@@ -938,6 +996,9 @@
 	if (apple_gmux_present)
 		return acpi_backlight_apple_gmux;
 
+	if (dell_uart_backlight_present)
+		return acpi_backlight_vendor;
+
 	/* Use ACPI video if available, except when native should be preferred. */
 	if ((video_caps & ACPI_VIDEO_BACKLIGHT) &&
 	     !(native_available && prefer_native_over_acpi_video()))
--- linux-qcom-6.8.0.orig/drivers/acpi/x86/s2idle.c
+++ linux-qcom-6.8.0/drivers/acpi/x86/s2idle.c
@@ -488,7 +488,19 @@
 		rev_id = 1;
 		lps0_dsm_func_mask = validate_dsm(adev->handle,
 					ACPI_LPS0_DSM_UUID, rev_id, &lps0_dsm_guid);
-		lps0_dsm_func_mask_microsoft = -EINVAL;
+		if (lps0_dsm_func_mask > 0 && lps0_dsm_func_mask_microsoft > 0) {
+			unsigned int func_mask;
+
+			/*
+			 * Log a message if the _DSM function sets for two
+			 * different UUIDs overlap.
+			 */
+			func_mask = lps0_dsm_func_mask & lps0_dsm_func_mask_microsoft;
+			if (func_mask)
+				acpi_handle_info(adev->handle,
+						 "Duplicate LPS0 _DSM functions (mask: 0x%x)\n",
+						 func_mask);
+		}
 	}
 
 	if (lps0_dsm_func_mask < 0 && lps0_dsm_func_mask_microsoft < 0)
@@ -549,19 +561,22 @@
 				lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
 
 	/* LPS0 entry */
-	if (lps0_dsm_func_mask > 0)
-		acpi_sleep_run_lps0_dsm(acpi_s2idle_vendor_amd() ?
-					ACPI_LPS0_ENTRY_AMD :
-					ACPI_LPS0_ENTRY,
+	if (lps0_dsm_func_mask > 0 && acpi_s2idle_vendor_amd())
+		acpi_sleep_run_lps0_dsm(ACPI_LPS0_ENTRY_AMD,
 					lps0_dsm_func_mask, lps0_dsm_guid);
+
 	if (lps0_dsm_func_mask_microsoft > 0) {
-		/* modern standby entry */
+		/* Modern Standby entry */
 		acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_ENTRY,
 				lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
 		acpi_sleep_run_lps0_dsm(ACPI_LPS0_ENTRY,
 				lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
 	}
 
+	if (lps0_dsm_func_mask > 0 && !acpi_s2idle_vendor_amd())
+		acpi_sleep_run_lps0_dsm(ACPI_LPS0_ENTRY,
+					lps0_dsm_func_mask, lps0_dsm_guid);
+
 	list_for_each_entry(handler, &lps0_s2idle_devops_head, list_node) {
 		if (handler->prepare)
 			handler->prepare();
@@ -600,14 +615,14 @@
 					ACPI_LPS0_EXIT_AMD :
 					ACPI_LPS0_EXIT,
 					lps0_dsm_func_mask, lps0_dsm_guid);
-	if (lps0_dsm_func_mask_microsoft > 0)
+
+	if (lps0_dsm_func_mask_microsoft > 0) {
 		acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT,
 				lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
-
-	/* Modern standby exit */
-	if (lps0_dsm_func_mask_microsoft > 0)
+		/* Modern Standby exit */
 		acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_EXIT,
 				lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
+	}
 
 	/* Screen on */
 	if (lps0_dsm_func_mask_microsoft > 0)
--- linux-qcom-6.8.0.orig/drivers/acpi/x86/utils.c
+++ linux-qcom-6.8.0/drivers/acpi/x86/utils.c
@@ -12,6 +12,7 @@
 
 #include <linux/acpi.h>
 #include <linux/dmi.h>
+#include <linux/pci.h>
 #include <linux/platform_device.h>
 #include <asm/cpu_device_id.h>
 #include <asm/intel-family.h>
@@ -197,16 +198,16 @@
 }
 
 /*
- * AMD systems from Renoir and Lucienne *require* that the NVME controller
+ * AMD systems from Renoir onwards *require* that the NVME controller
  * is put into D3 over a Modern Standby / suspend-to-idle cycle.
  *
  * This is "typically" accomplished using the `StorageD3Enable`
  * property in the _DSD that is checked via the `acpi_storage_d3` function
- * but this property was introduced after many of these systems launched
- * and most OEM systems don't have it in their BIOS.
+ * but some OEM systems still don't have it in their BIOS.
  *
  * The Microsoft documentation for StorageD3Enable mentioned that Windows has
- * a hardcoded allowlist for D3 support, which was used for these platforms.
+ * a hardcoded allowlist for D3 support as well as a registry key to override
+ * the BIOS, which has been used for these cases.
  *
  * This allows quirking on Linux in a similar fashion.
  *
@@ -219,19 +220,15 @@
  *    https://bugzilla.kernel.org/show_bug.cgi?id=216773
  *    https://bugzilla.kernel.org/show_bug.cgi?id=217003
  * 2) On at least one HP system StorageD3Enable is missing on the second NVME
-      disk in the system.
+ *    disk in the system.
+ * 3) On at least one HP Rembrandt system StorageD3Enable is missing on the only
+ *    NVME device.
  */
-static const struct x86_cpu_id storage_d3_cpu_ids[] = {
-	X86_MATCH_VENDOR_FAM_MODEL(AMD, 23, 24, NULL),  /* Picasso */
-	X86_MATCH_VENDOR_FAM_MODEL(AMD, 23, 96, NULL),	/* Renoir */
-	X86_MATCH_VENDOR_FAM_MODEL(AMD, 23, 104, NULL),	/* Lucienne */
-	X86_MATCH_VENDOR_FAM_MODEL(AMD, 25, 80, NULL),	/* Cezanne */
-	{}
-};
-
 bool force_storage_d3(void)
 {
-	return x86_match_cpu(storage_d3_cpu_ids);
+	if (!cpu_feature_enabled(X86_FEATURE_ZEN))
+		return false;
+	return acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0;
 }
 
 /*
@@ -260,9 +257,10 @@
 #define ACPI_QUIRK_SKIP_I2C_CLIENTS				BIT(0)
 #define ACPI_QUIRK_UART1_SKIP					BIT(1)
 #define ACPI_QUIRK_UART1_TTY_UART2_SKIP				BIT(2)
-#define ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY			BIT(3)
-#define ACPI_QUIRK_USE_ACPI_AC_AND_BATTERY			BIT(4)
-#define ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS			BIT(5)
+#define ACPI_QUIRK_PNP_UART1_SKIP				BIT(3)
+#define ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY			BIT(4)
+#define ACPI_QUIRK_USE_ACPI_AC_AND_BATTERY			BIT(5)
+#define ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS			BIT(6)
 
 static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
 	/*
@@ -289,6 +287,7 @@
 	/*
 	 * 2. Devices which also have the skip i2c/serdev quirks and which
 	 *    need the x86-android-tablets module to properly work.
+	 *    Sorted alphabetically.
 	 */
 #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS)
 	{
@@ -302,6 +301,19 @@
 					ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
 	},
 	{
+		/* Acer Iconia One 8 A1-840 (non FHD version) */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "BayTrail"),
+			/* Above strings are too generic also match BIOS date */
+			DMI_MATCH(DMI_BIOS_DATE, "04/01/2014"),
+		},
+		.driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
+					ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
+					ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+	},
+	{
+		/* Asus ME176C tablet */
 		.matches = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ME176C"),
@@ -312,23 +324,24 @@
 					ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
 	},
 	{
-		/* Lenovo Yoga Book X90F/L */
+		/* Asus TF103C transformer 2-in-1 */
 		.matches = {
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"),
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "TF103C"),
 		},
 		.driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
-					ACPI_QUIRK_UART1_SKIP |
 					ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
 					ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
 	},
 	{
+		/* Lenovo Yoga Book X90F/L */
 		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "TF103C"),
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"),
 		},
 		.driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
+					ACPI_QUIRK_UART1_SKIP |
 					ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
 					ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
 	},
@@ -342,6 +355,7 @@
 			DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21"),
 		},
 		.driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
+					ACPI_QUIRK_PNP_UART1_SKIP |
 					ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY),
 	},
 	{
@@ -386,6 +400,19 @@
 					ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY),
 	},
 	{
+		/* Vexia Edu Atla 10 tablet 9V version */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
+			DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
+			/* Above strings are too generic, also match on BIOS date */
+			DMI_MATCH(DMI_BIOS_DATE, "08/25/2014"),
+		},
+		.driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
+					ACPI_QUIRK_UART1_SKIP |
+					ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
+					ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+	},
+	{
 		/* Whitelabel (sold as various brands) TM800A550L */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
@@ -405,6 +432,7 @@
 	{ "10EC5640", 0 }, /* RealTek ALC5640 audio codec */
 	{ "10EC5651", 0 }, /* RealTek ALC5651 audio codec */
 	{ "INT33F4", 0 },  /* X-Powers AXP288 PMIC */
+	{ "INT33F5", 0 },  /* TI Dollar Cove PMIC */
 	{ "INT33FD", 0 },  /* Intel Crystal Cove PMIC */
 	{ "INT34D3", 0 },  /* Intel Whiskey Cove PMIC */
 	{ "NPCE69A", 0 },  /* Asus Transformer keyboard dock */
@@ -428,27 +456,46 @@
 }
 EXPORT_SYMBOL_GPL(acpi_quirk_skip_i2c_client_enumeration);
 
-int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip)
+static int acpi_dmi_skip_serdev_enumeration(struct device *controller_parent, bool *skip)
 {
 	struct acpi_device *adev = ACPI_COMPANION(controller_parent);
 	const struct dmi_system_id *dmi_id;
 	long quirks = 0;
-	u64 uid;
-	int ret;
+	u64 uid = 0;
 
-	*skip = false;
-
-	ret = acpi_dev_uid_to_integer(adev, &uid);
-	if (ret)
+	dmi_id = dmi_first_match(acpi_quirk_skip_dmi_ids);
+	if (!dmi_id)
 		return 0;
 
-	/* to not match on PNP enumerated debug UARTs */
-	if (!dev_is_platform(controller_parent))
+	quirks = (unsigned long)dmi_id->driver_data;
+
+	/* uid is left at 0 on errors and 0 is not a valid UART UID */
+	acpi_dev_uid_to_integer(adev, &uid);
+
+	/* For PCI UARTs without an UID */
+	if (!uid && dev_is_pci(controller_parent)) {
+		struct pci_dev *pdev = to_pci_dev(controller_parent);
+
+		/*
+		 * Devfn values for PCI UARTs on Bay Trail SoCs, which are
+		 * the only devices where this fallback is necessary.
+		 */
+		if (pdev->devfn == PCI_DEVFN(0x1e, 3))
+			uid = 1;
+		else if (pdev->devfn == PCI_DEVFN(0x1e, 4))
+			uid = 2;
+	}
+
+	if (!uid)
 		return 0;
 
-	dmi_id = dmi_first_match(acpi_quirk_skip_dmi_ids);
-	if (dmi_id)
-		quirks = (unsigned long)dmi_id->driver_data;
+	if (!dev_is_platform(controller_parent) && !dev_is_pci(controller_parent)) {
+		/* PNP enumerated UARTs */
+		if ((quirks & ACPI_QUIRK_PNP_UART1_SKIP) && uid == 1)
+			*skip = true;
+
+		return 0;
+	}
 
 	if ((quirks & ACPI_QUIRK_UART1_SKIP) && uid == 1)
 		*skip = true;
@@ -463,7 +510,6 @@
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(acpi_quirk_skip_serdev_enumeration);
 
 bool acpi_quirk_skip_gpio_event_handlers(void)
 {
@@ -478,8 +524,41 @@
 	return (quirks & ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS);
 }
 EXPORT_SYMBOL_GPL(acpi_quirk_skip_gpio_event_handlers);
+#else
+static int acpi_dmi_skip_serdev_enumeration(struct device *controller_parent, bool *skip)
+{
+	return 0;
+}
 #endif
 
+int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip)
+{
+	struct acpi_device *adev = ACPI_COMPANION(controller_parent);
+
+	*skip = false;
+
+	/*
+	 * The DELL0501 ACPI HID represents an UART (CID is set to PNP0501) with
+	 * a backlight-controller attached. There is no separate ACPI device with
+	 * an UartSerialBusV2() resource to model the backlight-controller.
+	 * Set skip to true so that the tty core creates a serdev ctrl device.
+	 * The backlight driver will manually create the serdev client device.
+	 */
+	if (adev && acpi_dev_hid_match(adev, "DELL0501")) {
+		*skip = true;
+		/*
+		 * Create a platform dev for dell-uart-backlight to bind to.
+		 * This is a static device, so no need to store the result.
+		 */
+		platform_device_register_simple("dell-uart-backlight", PLATFORM_DEVID_NONE,
+						NULL, 0);
+		return 0;
+	}
+
+	return acpi_dmi_skip_serdev_enumeration(controller_parent, skip);
+}
+EXPORT_SYMBOL_GPL(acpi_quirk_skip_serdev_enumeration);
+
 /* Lists of PMIC ACPI HIDs with an (often better) native charger driver */
 static const struct {
 	const char *hid;
--- linux-qcom-6.8.0.orig/drivers/android/Kconfig
+++ linux-qcom-6.8.0/drivers/android/Kconfig
@@ -2,7 +2,7 @@
 menu "Android"
 
 config ANDROID_BINDER_IPC
-	bool "Android Binder IPC Driver"
+	tristate "Android Binder IPC Driver"
 	depends on MMU
 	default n
 	help
@@ -14,8 +14,8 @@
 	  between said processes.
 
 config ANDROID_BINDERFS
-	bool "Android Binderfs filesystem"
-	depends on ANDROID_BINDER_IPC
+	tristate "Android Binderfs filesystem"
+	depends on (ANDROID_BINDER_IPC=y) || (ANDROID_BINDER_IPC=m && m)
 	default n
 	help
 	  Binderfs is a pseudo-filesystem for the Android Binder IPC driver
--- linux-qcom-6.8.0.orig/drivers/android/Makefile
+++ linux-qcom-6.8.0/drivers/android/Makefile
@@ -1,6 +1,10 @@
 # SPDX-License-Identifier: GPL-2.0-only
 ccflags-y += -I$(src)			# needed for trace events
 
-obj-$(CONFIG_ANDROID_BINDERFS)		+= binderfs.o
-obj-$(CONFIG_ANDROID_BINDER_IPC)	+= binder.o binder_alloc.o
-obj-$(CONFIG_ANDROID_BINDER_IPC_SELFTEST) += binder_alloc_selftest.o
+binder_linux-y := binder.o binder_alloc.o
+obj-$(CONFIG_ANDROID_BINDER_IPC) += binder_linux.o
+binder_linux-$(CONFIG_ANDROID_BINDERFS) += binderfs.o
+binder_linux-$(CONFIG_ANDROID_BINDER_IPC_SELFTEST) += binder_alloc_selftest.o
+
+# binder-$(CONFIG_ANDROID_BINDER_IPC) := binder.o binder_alloc.o
+# binder-$(CONFIG_ANDROID_BINDERFS) += binderfs.o
--- linux-qcom-6.8.0.orig/drivers/android/binder.c
+++ linux-qcom-6.8.0/drivers/android/binder.c
@@ -570,9 +570,7 @@
 static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)
 {
 	return !thread->transaction_stack &&
-		binder_worklist_empty_ilocked(&thread->todo) &&
-		(thread->looper & (BINDER_LOOPER_STATE_ENTERED |
-				   BINDER_LOOPER_STATE_REGISTERED));
+		binder_worklist_empty_ilocked(&thread->todo);
 }
 
 static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,
@@ -1708,8 +1706,10 @@
 	size_t object_size = 0;
 
 	read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
-	if (offset > buffer->data_size || read_size < sizeof(*hdr))
+	if (offset > buffer->data_size || read_size < sizeof(*hdr) ||
+	    !IS_ALIGNED(offset, sizeof(u32)))
 		return 0;
+
 	if (u) {
 		if (copy_from_user(object, u + offset, read_size))
 			return 0;
@@ -2930,8 +2930,7 @@
 	struct binder_context *context = proc->context;
 	int t_debug_id = atomic_inc_return(&binder_last_id);
 	ktime_t t_start_time = ktime_get();
-	char *secctx = NULL;
-	u32 secctx_sz = 0;
+	struct lsmcontext lsmctx;
 	struct list_head sgc_head;
 	struct list_head pf_head;
 	const void __user *user_buffer = (const void __user *)
@@ -3210,8 +3209,8 @@
 		size_t added_size;
 
 		security_cred_getsecid(proc->cred, &secid);
-		ret = security_secid_to_secctx(secid, &secctx, &secctx_sz);
-		if (ret) {
+		ret = security_secid_to_secctx(secid, &lsmctx);
+		if (ret < 0) {
 			binder_txn_error("%d:%d failed to get security context\n",
 				thread->pid, proc->pid);
 			return_error = BR_FAILED_REPLY;
@@ -3219,7 +3218,7 @@
 			return_error_line = __LINE__;
 			goto err_get_secctx_failed;
 		}
-		added_size = ALIGN(secctx_sz, sizeof(u64));
+		added_size = ALIGN(lsmctx.len, sizeof(u64));
 		extra_buffers_size += added_size;
 		if (extra_buffers_size < added_size) {
 			binder_txn_error("%d:%d integer overflow of extra_buffers_size\n",
@@ -3253,23 +3252,23 @@
 		t->buffer = NULL;
 		goto err_binder_alloc_buf_failed;
 	}
-	if (secctx) {
+	if (lsmctx.context) {
 		int err;
 		size_t buf_offset = ALIGN(tr->data_size, sizeof(void *)) +
 				    ALIGN(tr->offsets_size, sizeof(void *)) +
 				    ALIGN(extra_buffers_size, sizeof(void *)) -
-				    ALIGN(secctx_sz, sizeof(u64));
+				    ALIGN(lsmctx.len, sizeof(u64));
 
 		t->security_ctx = t->buffer->user_data + buf_offset;
 		err = binder_alloc_copy_to_buffer(&target_proc->alloc,
 						  t->buffer, buf_offset,
-						  secctx, secctx_sz);
+						  lsmctx.context, lsmctx.len);
 		if (err) {
 			t->security_ctx = 0;
 			WARN_ON(1);
 		}
-		security_release_secctx(secctx, secctx_sz);
-		secctx = NULL;
+		security_release_secctx(&lsmctx);
+		lsmctx.context = NULL;
 	}
 	t->buffer->debug_id = t->debug_id;
 	t->buffer->transaction = t;
@@ -3313,7 +3312,7 @@
 	off_end_offset = off_start_offset + tr->offsets_size;
 	sg_buf_offset = ALIGN(off_end_offset, sizeof(void *));
 	sg_buf_end_offset = sg_buf_offset + extra_buffers_size -
-		ALIGN(secctx_sz, sizeof(u64));
+		ALIGN(lsmctx.len, sizeof(u64));
 	off_min = 0;
 	for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
 	     buffer_offset += sizeof(binder_size_t)) {
@@ -3342,6 +3341,7 @@
 		 */
 		copy_size = object_offset - user_offset;
 		if (copy_size && (user_offset > object_offset ||
+				object_offset > tr->data_size ||
 				binder_alloc_copy_user_to_buffer(
 					&target_proc->alloc,
 					t->buffer, user_offset,
@@ -3691,8 +3691,8 @@
 	binder_alloc_free_buf(&target_proc->alloc, t->buffer);
 err_binder_alloc_buf_failed:
 err_bad_extra_size:
-	if (secctx)
-		security_release_secctx(secctx, secctx_sz);
+	if (lsmctx.context)
+		security_release_secctx(&lsmctx);
 err_get_secctx_failed:
 	kfree(tcomplete);
 	binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
@@ -5365,7 +5365,7 @@
 			goto err;
 		break;
 	case BINDER_SET_MAX_THREADS: {
-		int max_threads;
+		u32 max_threads;
 
 		if (copy_from_user(&max_threads, ubuf,
 				   sizeof(max_threads))) {
@@ -6631,9 +6631,20 @@
 	return ret;
 }
 
-device_initcall(binder_init);
+module_init(binder_init);
+/*
+ * binder will have no exit function since binderfs instances can be mounted
+ * multiple times and also in user namespaces finding and destroying them all
+ * is not feasible without introducing insane locking. Just ignoring existing
+ * instances on module unload also wouldn't work since we would loose track of
+ * what major numer was dynamically allocated and also what minor numbers are
+ * already given out. So this would get us into all kinds of issues with device
+ * number reuse. So simply don't allow unloading unless we are forced to do so.
+ */
+
+MODULE_AUTHOR("Google, Inc.");
+MODULE_DESCRIPTION("Driver for Android binder device");
+MODULE_LICENSE("GPL v2");
 
 #define CREATE_TRACE_POINTS
 #include "binder_trace.h"
-
-MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/drivers/android/binder_alloc.c
+++ linux-qcom-6.8.0/drivers/android/binder_alloc.c
@@ -38,8 +38,7 @@
 };
 static uint32_t binder_alloc_debug_mask = BINDER_DEBUG_USER_ERROR;
 
-module_param_named(debug_mask, binder_alloc_debug_mask,
-		   uint, 0644);
+module_param_named(alloc_debug_mask, binder_alloc_debug_mask, uint, 0644);
 
 #define binder_alloc_debug(mask, x...) \
 	do { \
--- linux-qcom-6.8.0.orig/drivers/android/binder_alloc.h
+++ linux-qcom-6.8.0/drivers/android/binder_alloc.h
@@ -6,6 +6,7 @@
 #ifndef _LINUX_BINDER_ALLOC_H
 #define _LINUX_BINDER_ALLOC_H
 
+#include <linux/kconfig.h>
 #include <linux/rbtree.h>
 #include <linux/list.h>
 #include <linux/mm.h>
@@ -111,7 +112,7 @@
 	bool oneway_spam_detected;
 };
 
-#ifdef CONFIG_ANDROID_BINDER_IPC_SELFTEST
+#if IS_ENABLED(CONFIG_ANDROID_BINDER_IPC_SELFTEST)
 void binder_selftest_alloc(struct binder_alloc *alloc);
 #else
 static inline void binder_selftest_alloc(struct binder_alloc *alloc) {}
--- linux-qcom-6.8.0.orig/drivers/android/binder_internal.h
+++ linux-qcom-6.8.0/drivers/android/binder_internal.h
@@ -5,6 +5,7 @@
 
 #include <linux/export.h>
 #include <linux/fs.h>
+#include <linux/kconfig.h>
 #include <linux/list.h>
 #include <linux/miscdevice.h>
 #include <linux/mutex.h>
@@ -77,7 +78,7 @@
 
 extern char *binder_devices_param;
 
-#ifdef CONFIG_ANDROID_BINDERFS
+#if IS_ENABLED(CONFIG_ANDROID_BINDERFS)
 extern bool is_binderfs_device(const struct inode *inode);
 extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name,
 					   const struct file_operations *fops,
@@ -98,7 +99,7 @@
 static inline void binderfs_remove_file(struct dentry *dentry) {}
 #endif
 
-#ifdef CONFIG_ANDROID_BINDERFS
+#if IS_ENABLED(CONFIG_ANDROID_BINDERFS)
 extern int __init init_binderfs(void);
 #else
 static inline int __init init_binderfs(void)
@@ -421,7 +422,7 @@
 	struct list_head todo;
 	struct binder_stats stats;
 	struct list_head delivered_death;
-	int max_threads;
+	u32 max_threads;
 	int requested_threads;
 	int requested_threads_started;
 	int tmp_ref;
--- linux-qcom-6.8.0.orig/drivers/android/binderfs.c
+++ linux-qcom-6.8.0/drivers/android/binderfs.c
@@ -120,7 +120,7 @@
 	struct super_block *sb = ref_inode->i_sb;
 	struct binderfs_info *info = sb->s_fs_info;
 #if defined(CONFIG_IPC_NS)
-	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
+	bool use_reserve = (info->ipc_ns == show_init_ipc_ns());
 #else
 	bool use_reserve = true;
 #endif
@@ -397,7 +397,7 @@
 	struct dentry *root = sb->s_root;
 	struct binderfs_info *info = sb->s_fs_info;
 #if defined(CONFIG_IPC_NS)
-	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
+	bool use_reserve = (info->ipc_ns == show_init_ipc_ns());
 #else
 	bool use_reserve = true;
 #endif
@@ -683,7 +683,7 @@
 		return -ENOMEM;
 	info = sb->s_fs_info;
 
-	info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
+	info->ipc_ns = get_ipc_ns_exported(current->nsproxy->ipc_ns);
 
 	info->root_gid = make_kgid(sb->s_user_ns, 0);
 	if (!gid_valid(info->root_gid))
--- linux-qcom-6.8.0.orig/drivers/ata/ahci.c
+++ linux-qcom-6.8.0/drivers/ata/ahci.c
@@ -431,7 +431,6 @@
 	{ PCI_VDEVICE(INTEL, 0x02d7), board_ahci_low_power }, /* Comet Lake PCH RAID */
 	/* Elkhart Lake IDs 0x4b60 & 0x4b62 https://sata-io.org/product/8803 not tested yet */
 	{ PCI_VDEVICE(INTEL, 0x4b63), board_ahci_low_power }, /* Elkhart Lake AHCI */
-	{ PCI_VDEVICE(INTEL, 0x7ae2), board_ahci_low_power }, /* Alder Lake-P AHCI */
 
 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
@@ -668,22 +667,90 @@
 module_param(mobile_lpm_policy, int, 0644);
 MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets");
 
-static void ahci_pci_save_initial_config(struct pci_dev *pdev,
-					 struct ahci_host_priv *hpriv)
+static char *ahci_mask_port_map;
+module_param_named(mask_port_map, ahci_mask_port_map, charp, 0444);
+MODULE_PARM_DESC(mask_port_map,
+		 "32-bits port map masks to ignore controllers ports. "
+		 "Valid values are: "
+		 "\"<mask>\" to apply the same mask to all AHCI controller "
+		 "devices, and \"<pci_dev>=<mask>,<pci_dev>=<mask>,...\" to "
+		 "specify different masks for the controllers specified, "
+		 "where <pci_dev> is the PCI ID of an AHCI controller in the "
+		 "form \"domain:bus:dev.func\"");
+
+static void ahci_apply_port_map_mask(struct device *dev,
+				     struct ahci_host_priv *hpriv, char *mask_s)
 {
-	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA) {
-		switch (pdev->device) {
-		case 0x1166:
-			dev_info(&pdev->dev, "ASM1166 has only six ports\n");
-			hpriv->saved_port_map = 0x3f;
+	unsigned int mask;
+
+	if (kstrtouint(mask_s, 0, &mask)) {
+		dev_err(dev, "Invalid port map mask\n");
+		return;
+	}
+
+	hpriv->mask_port_map = mask;
+}
+
+static void ahci_get_port_map_mask(struct device *dev,
+				   struct ahci_host_priv *hpriv)
+{
+	char *param, *end, *str, *mask_s;
+	char *name;
+
+	if (!strlen(ahci_mask_port_map))
+		return;
+
+	str = kstrdup(ahci_mask_port_map, GFP_KERNEL);
+	if (!str)
+		return;
+
+	/* Handle single mask case */
+	if (!strchr(str, '=')) {
+		ahci_apply_port_map_mask(dev, hpriv, str);
+		goto free;
+	}
+
+	/*
+	 * Mask list case: parse the parameter to apply the mask only if
+	 * the device name matches.
+	 */
+	param = str;
+	end = param + strlen(param);
+	while (param && param < end && *param) {
+		name = param;
+		param = strchr(name, '=');
+		if (!param)
 			break;
-		case 0x1064:
-			dev_info(&pdev->dev, "ASM1064 has only four ports\n");
-			hpriv->saved_port_map = 0xf;
+
+		*param = '\0';
+		param++;
+		if (param >= end)
 			break;
+
+		if (strcmp(dev_name(dev), name) != 0) {
+			param = strchr(param, ',');
+			if (param)
+				param++;
+			continue;
+		}
+
+		mask_s = param;
+		param = strchr(mask_s, ',');
+		if (param) {
+			*param = '\0';
+			param++;
 		}
+
+		ahci_apply_port_map_mask(dev, hpriv, mask_s);
 	}
 
+free:
+	kfree(str);
+}
+
+static void ahci_pci_save_initial_config(struct pci_dev *pdev,
+					 struct ahci_host_priv *hpriv)
+{
 	if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) {
 		dev_info(&pdev->dev, "JMB361 has only one port\n");
 		hpriv->saved_port_map = 1;
@@ -703,6 +770,10 @@
 			  "Disabling your PATA port. Use the boot option 'ahci.marvell_enable=0' to avoid this.\n");
 	}
 
+	/* Handle port map masks passed as module parameter. */
+	if (ahci_mask_port_map)
+		ahci_get_port_map_mask(&pdev->dev, hpriv);
+
 	ahci_save_initial_config(&pdev->dev, hpriv);
 }
 
@@ -1660,6 +1731,14 @@
 	if (!(hpriv->flags & AHCI_HFLAG_USE_LPM_POLICY))
 		return;
 
+	/* If no LPM states are supported by the HBA, do not bother with LPM */
+	if ((ap->host->flags & ATA_HOST_NO_PART) &&
+	    (ap->host->flags & ATA_HOST_NO_SSC) &&
+	    (ap->host->flags & ATA_HOST_NO_DEVSLP)) {
+		ata_port_dbg(ap, "no LPM states supported, not enabling LPM\n");
+		return;
+	}
+
 	/* user modified policy via module param */
 	if (mobile_lpm_policy != -1) {
 		policy = mobile_lpm_policy;
@@ -1904,8 +1983,10 @@
 	n_ports = max(ahci_nr_ports(hpriv->cap), fls(hpriv->port_map));
 
 	host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports);
-	if (!host)
-		return -ENOMEM;
+	if (!host) {
+		rc = -ENOMEM;
+		goto err_rm_sysfs_file;
+	}
 	host->private_data = hpriv;
 
 	if (ahci_init_msi(pdev, n_ports, hpriv) < 0) {
@@ -1958,11 +2039,11 @@
 	/* initialize adapter */
 	rc = ahci_configure_dma_masks(pdev, hpriv);
 	if (rc)
-		return rc;
+		goto err_rm_sysfs_file;
 
 	rc = ahci_pci_reset_controller(host);
 	if (rc)
-		return rc;
+		goto err_rm_sysfs_file;
 
 	ahci_pci_init_controller(host);
 	ahci_pci_print_info(host);
@@ -1971,10 +2052,15 @@
 
 	rc = ahci_host_activate(host, &ahci_sht);
 	if (rc)
-		return rc;
+		goto err_rm_sysfs_file;
 
 	pm_runtime_put_noidle(&pdev->dev);
 	return 0;
+
+err_rm_sysfs_file:
+	sysfs_remove_file_from_group(&pdev->dev.kobj,
+				     &dev_attr_remapped_nvme.attr, NULL);
+	return rc;
 }
 
 static void ahci_shutdown_one(struct pci_dev *pdev)
--- linux-qcom-6.8.0.orig/drivers/ata/libahci.c
+++ linux-qcom-6.8.0/drivers/ata/libahci.c
@@ -2082,13 +2082,6 @@
 	struct ahci_port_priv *pp = qc->ap->private_data;
 	u8 *rx_fis = pp->rx_fis;
 
-	/*
-	 * rtf may already be filled (e.g. for successful NCQ commands).
-	 * If that is the case, we have nothing to do.
-	 */
-	if (qc->flags & ATA_QCFLAG_RTF_FILLED)
-		return;
-
 	if (pp->fbs_enabled)
 		rx_fis += qc->dev->link->pmp * AHCI_RX_FIS_SZ;
 
@@ -2102,7 +2095,6 @@
 	    !(qc->flags & ATA_QCFLAG_EH)) {
 		ata_tf_from_fis(rx_fis + RX_FIS_PIO_SETUP, &qc->result_tf);
 		qc->result_tf.status = (rx_fis + RX_FIS_PIO_SETUP)[15];
-		qc->flags |= ATA_QCFLAG_RTF_FILLED;
 		return;
 	}
 
@@ -2125,12 +2117,10 @@
 		 */
 		qc->result_tf.status = fis[2];
 		qc->result_tf.error = fis[3];
-		qc->flags |= ATA_QCFLAG_RTF_FILLED;
 		return;
 	}
 
 	ata_tf_from_fis(rx_fis + RX_FIS_D2H_REG, &qc->result_tf);
-	qc->flags |= ATA_QCFLAG_RTF_FILLED;
 }
 
 static void ahci_qc_ncq_fill_rtf(struct ata_port *ap, u64 done_mask)
@@ -2165,6 +2155,7 @@
 			if (qc && ata_is_ncq(qc->tf.protocol)) {
 				qc->result_tf.status = status;
 				qc->result_tf.error = error;
+				qc->result_tf.flags = qc->tf.flags;
 				qc->flags |= ATA_QCFLAG_RTF_FILLED;
 			}
 			done_mask &= ~(1ULL << tag);
@@ -2189,6 +2180,7 @@
 			fis += RX_FIS_SDB;
 			qc->result_tf.status = fis[2];
 			qc->result_tf.error = fis[3];
+			qc->result_tf.flags = qc->tf.flags;
 			qc->flags |= ATA_QCFLAG_RTF_FILLED;
 		}
 		done_mask &= ~(1ULL << tag);
--- linux-qcom-6.8.0.orig/drivers/ata/libata-core.c
+++ linux-qcom-6.8.0/drivers/ata/libata-core.c
@@ -2539,7 +2539,7 @@
 	bool cdl_enabled;
 	u64 val;
 
-	if (ata_id_major_version(dev->id) < 12)
+	if (ata_id_major_version(dev->id) < 11)
 		goto not_supported;
 
 	if (!ata_log_supported(dev, ATA_LOG_IDENTIFY_DEVICE) ||
@@ -4180,8 +4180,8 @@
 	{ "PIONEER BD-RW   BDR-207M",	NULL,	ATA_HORKAGE_NOLPM },
 	{ "PIONEER BD-RW   BDR-205",	NULL,	ATA_HORKAGE_NOLPM },
 
-	/* Crucial BX100 SSD 500GB has broken LPM support */
-	{ "CT500BX100SSD1",		NULL,	ATA_HORKAGE_NOLPM },
+	/* Crucial devices with broken LPM support */
+	{ "CT*0BX*00SSD1",		NULL,	ATA_HORKAGE_NOLPM },
 
 	/* 512GB MX100 with MU01 firmware has both queued TRIM and LPM issues */
 	{ "Crucial_CT512MX100*",	"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
@@ -4199,6 +4199,12 @@
 						ATA_HORKAGE_ZERO_AFTER_TRIM |
 						ATA_HORKAGE_NOLPM },
 
+	/* Apacer models with LPM issues */
+	{ "Apacer AS340*",		NULL,	ATA_HORKAGE_NOLPM },
+
+	/* AMD Radeon devices with broken LPM support */
+	{ "R3SL240G",			NULL,	ATA_HORKAGE_NOLPM },
+
 	/* These specific Samsung models/firmware-revs do not handle LPM well */
 	{ "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM },
 	{ "SAMSUNG SSD PM830 mSATA *",  "CXM13D1Q", ATA_HORKAGE_NOLPM },
@@ -4838,8 +4844,16 @@
 {
 	struct ata_port *ap = qc->ap;
 
+	/*
+	 * rtf may already be filled (e.g. for successful NCQ commands).
+	 * If that is the case, we have nothing to do.
+	 */
+	if (qc->flags & ATA_QCFLAG_RTF_FILLED)
+		return;
+
 	qc->result_tf.flags = qc->tf.flags;
 	ap->ops->qc_fill_rtf(qc);
+	qc->flags |= ATA_QCFLAG_RTF_FILLED;
 }
 
 static void ata_verify_xfer(struct ata_queued_cmd *qc)
@@ -5527,6 +5541,18 @@
 	return ap;
 }
 
+void ata_port_free(struct ata_port *ap)
+{
+	if (!ap)
+		return;
+
+	kfree(ap->pmp_link);
+	kfree(ap->slave_link);
+	kfree(ap->ncq_sense_buf);
+	kfree(ap);
+}
+EXPORT_SYMBOL_GPL(ata_port_free);
+
 static void ata_devres_release(struct device *gendev, void *res)
 {
 	struct ata_host *host = dev_get_drvdata(gendev);
@@ -5553,12 +5579,7 @@
 	int i;
 
 	for (i = 0; i < host->n_ports; i++) {
-		struct ata_port *ap = host->ports[i];
-
-		kfree(ap->pmp_link);
-		kfree(ap->slave_link);
-		kfree(ap->ncq_sense_buf);
-		kfree(ap);
+		ata_port_free(host->ports[i]);
 		host->ports[i] = NULL;
 	}
 	kfree(host);
@@ -5608,12 +5629,16 @@
 	if (!host)
 		return NULL;
 
-	if (!devres_open_group(dev, NULL, GFP_KERNEL))
-		goto err_free;
+	if (!devres_open_group(dev, NULL, GFP_KERNEL)) {
+		kfree(host);
+		return NULL;
+	}
 
 	dr = devres_alloc(ata_devres_release, 0, GFP_KERNEL);
-	if (!dr)
+	if (!dr) {
+		kfree(host);
 		goto err_out;
+	}
 
 	devres_add(dev, dr);
 	dev_set_drvdata(dev, host);
@@ -5641,8 +5666,6 @@
 
  err_out:
 	devres_release_group(dev, NULL);
- err_free:
-	kfree(host);
 	return NULL;
 }
 EXPORT_SYMBOL_GPL(ata_host_alloc);
@@ -5941,7 +5964,7 @@
 	 * allocation time.
 	 */
 	for (i = host->n_ports; host->ports[i]; i++)
-		kfree(host->ports[i]);
+		ata_port_free(host->ports[i]);
 
 	/* give ports names and add SCSI hosts */
 	for (i = 0; i < host->n_ports; i++) {
--- linux-qcom-6.8.0.orig/drivers/ata/libata-eh.c
+++ linux-qcom-6.8.0/drivers/ata/libata-eh.c
@@ -630,6 +630,14 @@
 	list_for_each_entry_safe(scmd, tmp, eh_work_q, eh_entry) {
 		struct ata_queued_cmd *qc;
 
+		/*
+		 * If the scmd was added to EH, via ata_qc_schedule_eh() ->
+		 * scsi_timeout() -> scsi_eh_scmd_add(), scsi_timeout() will
+		 * have set DID_TIME_OUT (since libata does not have an abort
+		 * handler). Thus, to clear DID_TIME_OUT, clear the host byte.
+		 */
+		set_host_byte(scmd, DID_OK);
+
 		ata_qc_for_each_raw(ap, qc, i) {
 			if (qc->flags & ATA_QCFLAG_ACTIVE &&
 			    qc->scsicmd == scmd)
@@ -640,6 +648,7 @@
 			/* the scmd has an associated qc */
 			if (!(qc->flags & ATA_QCFLAG_EH)) {
 				/* which hasn't failed yet, timeout */
+				set_host_byte(scmd, DID_TIME_OUT);
 				qc->err_mask |= AC_ERR_TIMEOUT;
 				qc->flags |= ATA_QCFLAG_EH;
 				nr_timedout++;
@@ -712,8 +721,10 @@
 				ehc->saved_ncq_enabled |= 1 << devno;
 
 			/* If we are resuming, wake up the device */
-			if (ap->pflags & ATA_PFLAG_RESUMING)
+			if (ap->pflags & ATA_PFLAG_RESUMING) {
+				dev->flags |= ATA_DFLAG_RESUMING;
 				ehc->i.dev_action[devno] |= ATA_EH_SET_ACTIVE;
+			}
 		}
 	}
 
@@ -3169,6 +3180,7 @@
 	return 0;
 
  err:
+	dev->flags &= ~ATA_DFLAG_RESUMING;
 	*r_failed_dev = dev;
 	return rc;
 }
@@ -4048,10 +4060,20 @@
 
 	WARN_ON(ap->pflags & ATA_PFLAG_SUSPENDED);
 
-	/* Set all devices attached to the port in standby mode */
-	ata_for_each_link(link, ap, HOST_FIRST) {
-		ata_for_each_dev(dev, link, ENABLED)
-			ata_dev_power_set_standby(dev);
+	/*
+	 * We will reach this point for all of the PM events:
+	 * PM_EVENT_SUSPEND (if runtime pm, PM_EVENT_AUTO will also be set)
+	 * PM_EVENT_FREEZE, and PM_EVENT_HIBERNATE.
+	 *
+	 * We do not want to perform disk spin down for PM_EVENT_FREEZE.
+	 * (Spin down will be performed by the subsequent PM_EVENT_HIBERNATE.)
+	 */
+	if (!(ap->pm_mesg.event & PM_EVENT_FREEZE)) {
+		/* Set all devices attached to the port in standby mode */
+		ata_for_each_link(link, ap, HOST_FIRST) {
+			ata_for_each_dev(dev, link, ENABLED)
+				ata_dev_power_set_standby(dev);
+		}
 	}
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/ata/libata-scsi.c
+++ linux-qcom-6.8.0/drivers/ata/libata-scsi.c
@@ -230,6 +230,87 @@
 				   SCSI_SENSE_BUFFERSIZE, information);
 }
 
+/**
+ *	ata_scsi_set_passthru_sense_fields - Set ATA fields in sense buffer
+ *	@qc: ATA PASS-THROUGH command.
+ *
+ *	Populates "ATA Status Return sense data descriptor" / "Fixed format
+ *	sense data" with ATA taskfile fields.
+ *
+ *	LOCKING:
+ *	None.
+ */
+static void ata_scsi_set_passthru_sense_fields(struct ata_queued_cmd *qc)
+{
+	struct ata_device *dev = qc->dev;
+	struct scsi_cmnd *cmd = qc->scsicmd;
+	struct ata_taskfile *tf = &qc->result_tf;
+	unsigned char *sb = cmd->sense_buffer;
+
+	if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) {
+		ata_dev_dbg(dev,
+			    "missing result TF: can't set ATA PT sense fields\n");
+		return;
+	}
+
+	if ((sb[0] & 0x7f) >= 0x72) {
+		unsigned char *desc;
+		u8 len;
+
+		/* descriptor format */
+		len = sb[7];
+		desc = (char *)scsi_sense_desc_find(sb, len + 8, 9);
+		if (!desc) {
+			if (SCSI_SENSE_BUFFERSIZE < len + 14)
+				return;
+			sb[7] = len + 14;
+			desc = sb + 8 + len;
+		}
+		desc[0] = 9;
+		desc[1] = 12;
+		/*
+		 * Copy registers into sense buffer.
+		 */
+		desc[2] = 0x00;
+		desc[3] = tf->error;
+		desc[5] = tf->nsect;
+		desc[7] = tf->lbal;
+		desc[9] = tf->lbam;
+		desc[11] = tf->lbah;
+		desc[12] = tf->device;
+		desc[13] = tf->status;
+
+		/*
+		 * Fill in Extend bit, and the high order bytes
+		 * if applicable.
+		 */
+		if (tf->flags & ATA_TFLAG_LBA48) {
+			desc[2] |= 0x01;
+			desc[4] = tf->hob_nsect;
+			desc[6] = tf->hob_lbal;
+			desc[8] = tf->hob_lbam;
+			desc[10] = tf->hob_lbah;
+		}
+	} else {
+		/* Fixed sense format */
+		sb[0] |= 0x80;
+		sb[3] = tf->error;
+		sb[4] = tf->status;
+		sb[5] = tf->device;
+		sb[6] = tf->nsect;
+		if (tf->flags & ATA_TFLAG_LBA48)  {
+			sb[8] |= 0x80;
+			if (tf->hob_nsect)
+				sb[8] |= 0x40;
+			if (tf->hob_lbal || tf->hob_lbam || tf->hob_lbah)
+				sb[8] |= 0x20;
+		}
+		sb[9] = tf->lbal;
+		sb[10] = tf->lbam;
+		sb[11] = tf->lbah;
+	}
+}
+
 static void ata_scsi_set_invalid_field(struct ata_device *dev,
 				       struct scsi_cmnd *cmd, u16 field, u8 bit)
 {
@@ -837,10 +918,8 @@
  *	ata_gen_passthru_sense - Generate check condition sense block.
  *	@qc: Command that completed.
  *
- *	This function is specific to the ATA descriptor format sense
- *	block specified for the ATA pass through commands.  Regardless
- *	of whether the command errored or not, return a sense
- *	block. Copy all controller registers into the sense
+ *	This function is specific to the ATA pass through commands.
+ *	Regardless of whether the command errored or not, return a sense
  *	block. If there was no error, we get the request from an ATA
  *	passthrough command, so we use the following sense data:
  *	sk = RECOVERED ERROR
@@ -852,13 +931,16 @@
  */
 static void ata_gen_passthru_sense(struct ata_queued_cmd *qc)
 {
+	struct ata_device *dev = qc->dev;
 	struct scsi_cmnd *cmd = qc->scsicmd;
 	struct ata_taskfile *tf = &qc->result_tf;
-	unsigned char *sb = cmd->sense_buffer;
-	unsigned char *desc = sb + 8;
 	u8 sense_key, asc, ascq;
 
-	memset(sb, 0, SCSI_SENSE_BUFFERSIZE);
+	if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) {
+		ata_dev_dbg(dev,
+			    "missing result TF: can't generate ATA PT sense data\n");
+		return;
+	}
 
 	/*
 	 * Use ata_to_sense_error() to map status register bits
@@ -876,62 +958,6 @@
 		 */
 		scsi_build_sense(cmd, 1, RECOVERED_ERROR, 0, 0x1D);
 	}
-
-	if ((cmd->sense_buffer[0] & 0x7f) >= 0x72) {
-		u8 len;
-
-		/* descriptor format */
-		len = sb[7];
-		desc = (char *)scsi_sense_desc_find(sb, len + 8, 9);
-		if (!desc) {
-			if (SCSI_SENSE_BUFFERSIZE < len + 14)
-				return;
-			sb[7] = len + 14;
-			desc = sb + 8 + len;
-		}
-		desc[0] = 9;
-		desc[1] = 12;
-		/*
-		 * Copy registers into sense buffer.
-		 */
-		desc[2] = 0x00;
-		desc[3] = tf->error;
-		desc[5] = tf->nsect;
-		desc[7] = tf->lbal;
-		desc[9] = tf->lbam;
-		desc[11] = tf->lbah;
-		desc[12] = tf->device;
-		desc[13] = tf->status;
-
-		/*
-		 * Fill in Extend bit, and the high order bytes
-		 * if applicable.
-		 */
-		if (tf->flags & ATA_TFLAG_LBA48) {
-			desc[2] |= 0x01;
-			desc[4] = tf->hob_nsect;
-			desc[6] = tf->hob_lbal;
-			desc[8] = tf->hob_lbam;
-			desc[10] = tf->hob_lbah;
-		}
-	} else {
-		/* Fixed sense format */
-		desc[0] = tf->error;
-		desc[1] = tf->status;
-		desc[2] = tf->device;
-		desc[3] = tf->nsect;
-		desc[7] = 0;
-		if (tf->flags & ATA_TFLAG_LBA48)  {
-			desc[8] |= 0x80;
-			if (tf->hob_nsect)
-				desc[8] |= 0x40;
-			if (tf->hob_lbal || tf->hob_lbam || tf->hob_lbah)
-				desc[8] |= 0x20;
-		}
-		desc[9] = tf->lbal;
-		desc[10] = tf->lbam;
-		desc[11] = tf->lbah;
-	}
 }
 
 /**
@@ -953,14 +979,19 @@
 	u64 block;
 	u8 sense_key, asc, ascq;
 
-	memset(sb, 0, SCSI_SENSE_BUFFERSIZE);
-
 	if (ata_dev_disabled(dev)) {
 		/* Device disabled after error recovery */
 		/* LOGICAL UNIT NOT READY, HARD RESET REQUIRED */
 		ata_scsi_set_sense(dev, cmd, NOT_READY, 0x04, 0x21);
 		return;
 	}
+
+	if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) {
+		ata_dev_dbg(dev,
+			    "missing result TF: can't generate sense data\n");
+		return;
+	}
+
 	/* Use ata_to_sense_error() to map status register bits
 	 * onto sense key, asc & ascq.
 	 */
@@ -1629,26 +1660,29 @@
 {
 	struct scsi_cmnd *cmd = qc->scsicmd;
 	u8 *cdb = cmd->cmnd;
-	int need_sense = (qc->err_mask != 0) &&
-		!(qc->flags & ATA_QCFLAG_SENSE_VALID);
+	bool have_sense = qc->flags & ATA_QCFLAG_SENSE_VALID;
+	bool is_ata_passthru = cdb[0] == ATA_16 || cdb[0] == ATA_12;
+	bool is_ck_cond_request = cdb[2] & 0x20;
+	bool is_error = qc->err_mask != 0;
 
 	/* For ATA pass thru (SAT) commands, generate a sense block if
 	 * user mandated it or if there's an error.  Note that if we
-	 * generate because the user forced us to [CK_COND =1], a check
+	 * generate because the user forced us to [CK_COND=1], a check
 	 * condition is generated and the ATA register values are returned
 	 * whether the command completed successfully or not. If there
-	 * was no error, we use the following sense data:
+	 * was no error, and CK_COND=1, we use the following sense data:
 	 * sk = RECOVERED ERROR
 	 * asc,ascq = ATA PASS-THROUGH INFORMATION AVAILABLE
 	 */
-	if (((cdb[0] == ATA_16) || (cdb[0] == ATA_12)) &&
-	    ((cdb[2] & 0x20) || need_sense))
-		ata_gen_passthru_sense(qc);
-	else if (need_sense)
+	if (is_ata_passthru && (is_ck_cond_request || is_error || have_sense)) {
+		if (!have_sense)
+			ata_gen_passthru_sense(qc);
+		ata_scsi_set_passthru_sense_fields(qc);
+		if (is_ck_cond_request)
+			set_status_byte(qc->scsicmd, SAM_STAT_CHECK_CONDITION);
+	} else if (is_error && !have_sense) {
 		ata_gen_ata_sense(qc);
-	else
-		/* Keep the SCSI ML and status byte, clear host byte. */
-		cmd->result &= 0x0000ffff;
+	}
 
 	ata_qc_done(qc);
 }
@@ -1828,11 +1862,11 @@
 		2
 	};
 
-	/* set scsi removable (RMB) bit per ata bit, or if the
-	 * AHCI port says it's external (Hotplug-capable, eSATA).
+	/*
+	 * Set the SCSI Removable Media Bit (RMB) if the ATA removable media
+	 * device bit (obsolete since ATA-8 ACS) is set.
 	 */
-	if (ata_id_removable(args->id) ||
-	    (args->dev->link->ap->pflags & ATA_PFLAG_EXTERNAL))
+	if (ata_id_removable(args->id))
 		hdr[1] |= (1 << 7);
 
 	if (args->dev->class == ATA_DEV_ZAC) {
@@ -2313,7 +2347,7 @@
 	case ALL_SUB_MPAGES:
 		n = ata_msense_control_spg0(dev, buf, changeable);
 		n += ata_msense_control_spgt2(dev, buf + n, CDL_T2A_SUB_MPAGE);
-		n += ata_msense_control_spgt2(dev, buf + n, CDL_T2A_SUB_MPAGE);
+		n += ata_msense_control_spgt2(dev, buf + n, CDL_T2B_SUB_MPAGE);
 		n += ata_msense_control_ata_feature(dev, buf + n);
 		return n;
 	default:
@@ -2587,14 +2621,8 @@
 	/* handle completion from EH */
 	if (unlikely(err_mask || qc->flags & ATA_QCFLAG_SENSE_VALID)) {
 
-		if (!(qc->flags & ATA_QCFLAG_SENSE_VALID)) {
-			/* FIXME: not quite right; we don't want the
-			 * translation of taskfile registers into a
-			 * sense descriptors, since that's only
-			 * correct for ATA, not ATAPI
-			 */
+		if (!(qc->flags & ATA_QCFLAG_SENSE_VALID))
 			ata_gen_passthru_sense(qc);
-		}
 
 		/* SCSI EH automatically locks door if sdev->locked is
 		 * set.  Sometimes door lock request continues to
@@ -4730,6 +4758,7 @@
 	struct ata_link *link;
 	struct ata_device *dev;
 	unsigned long flags;
+	bool do_resume;
 	int ret = 0;
 
 	mutex_lock(&ap->scsi_scan_mutex);
@@ -4744,25 +4773,34 @@
 			 * bail out.
 			 */
 			if (ap->pflags & ATA_PFLAG_SUSPENDED)
-				goto unlock;
+				goto unlock_ap;
 
 			if (!sdev)
 				continue;
 			if (scsi_device_get(sdev))
 				continue;
 
+			do_resume = dev->flags & ATA_DFLAG_RESUMING;
+
 			spin_unlock_irqrestore(ap->lock, flags);
+			if (do_resume) {
+				ret = scsi_resume_device(sdev);
+				if (ret == -EWOULDBLOCK)
+					goto unlock_scan;
+				dev->flags &= ~ATA_DFLAG_RESUMING;
+			}
 			ret = scsi_rescan_device(sdev);
 			scsi_device_put(sdev);
 			spin_lock_irqsave(ap->lock, flags);
 
 			if (ret)
-				goto unlock;
+				goto unlock_ap;
 		}
 	}
 
-unlock:
+unlock_ap:
 	spin_unlock_irqrestore(ap->lock, flags);
+unlock_scan:
 	mutex_unlock(&ap->scsi_scan_mutex);
 
 	/* Reschedule with a delay if scsi_rescan_device() returned an error */
--- linux-qcom-6.8.0.orig/drivers/ata/pata_legacy.c
+++ linux-qcom-6.8.0/drivers/ata/pata_legacy.c
@@ -173,8 +173,6 @@
 static struct legacy_probe probe_list[NR_HOST];
 static struct legacy_data legacy_data[NR_HOST];
 static struct ata_host *legacy_host[NR_HOST];
-static int nr_legacy_host;
-
 
 /**
  *	legacy_probe_add	-	Add interface to probe list
@@ -1276,9 +1274,11 @@
 {
 	int i;
 
-	for (i = 0; i < nr_legacy_host; i++) {
+	for (i = 0; i < NR_HOST; i++) {
 		struct legacy_data *ld = &legacy_data[i];
-		ata_host_detach(legacy_host[i]);
+
+		if (legacy_host[i])
+			ata_host_detach(legacy_host[i]);
 		platform_device_unregister(ld->platform_dev);
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/ata/pata_macio.c
+++ linux-qcom-6.8.0/drivers/ata/pata_macio.c
@@ -541,7 +541,8 @@
 
 		while (sg_len) {
 			/* table overflow should never happen */
-			BUG_ON (pi++ >= MAX_DCMDS);
+			if (WARN_ON_ONCE(pi >= MAX_DCMDS))
+				return AC_ERR_SYSTEM;
 
 			len = (sg_len < MAX_DBDMA_SEG) ? sg_len : MAX_DBDMA_SEG;
 			table->command = cpu_to_le16(write ? OUTPUT_MORE: INPUT_MORE);
@@ -553,11 +554,13 @@
 			addr += len;
 			sg_len -= len;
 			++table;
+			++pi;
 		}
 	}
 
 	/* Should never happen according to Tejun */
-	BUG_ON(!pi);
+	if (WARN_ON_ONCE(!pi))
+		return AC_ERR_SYSTEM;
 
 	/* Convert the last command to an input/output */
 	table--;
--- linux-qcom-6.8.0.orig/drivers/ata/pata_serverworks.c
+++ linux-qcom-6.8.0/drivers/ata/pata_serverworks.c
@@ -46,10 +46,11 @@
 #define SVWKS_CSB5_REVISION_NEW	0x92 /* min PCI_REVISION_ID for UDMA5 (A2.0) */
 #define SVWKS_CSB6_REVISION	0xa0 /* min PCI_REVISION_ID for UDMA4 (A1.0) */
 
-/* Seagate Barracuda ATA IV Family drives in UDMA mode 5
- * can overrun their FIFOs when used with the CSB5 */
-
-static const char *csb_bad_ata100[] = {
+/*
+ * Seagate Barracuda ATA IV Family drives in UDMA mode 5
+ * can overrun their FIFOs when used with the CSB5.
+ */
+static const char * const csb_bad_ata100[] = {
 	"ST320011A",
 	"ST340016A",
 	"ST360021A",
@@ -163,10 +164,11 @@
  *	@adev: ATA device
  *	@mask: Mask of proposed modes
  *
- *	Check the blacklist and disable UDMA5 if matched
+ *	Check the list of devices with broken UDMA5 and
+ *	disable UDMA5 if matched.
  */
-
-static unsigned int serverworks_csb_filter(struct ata_device *adev, unsigned int mask)
+static unsigned int serverworks_csb_filter(struct ata_device *adev,
+					   unsigned int mask)
 {
 	const char *p;
 	char model_num[ATA_ID_PROD_LEN + 1];
--- linux-qcom-6.8.0.orig/drivers/ata/sata_gemini.c
+++ linux-qcom-6.8.0/drivers/ata/sata_gemini.c
@@ -200,7 +200,10 @@
 		pclk = sg->sata0_pclk;
 	else
 		pclk = sg->sata1_pclk;
-	clk_enable(pclk);
+	ret = clk_enable(pclk);
+	if (ret)
+		return ret;
+
 	msleep(10);
 
 	/* Do not keep clocking a bridge that is not online */
--- linux-qcom-6.8.0.orig/drivers/ata/sata_highbank.c
+++ linux-qcom-6.8.0/drivers/ata/sata_highbank.c
@@ -348,6 +348,7 @@
 			phy_nodes[phy] = phy_data.np;
 			cphy_base[phy] = of_iomap(phy_nodes[phy], 0);
 			if (cphy_base[phy] == NULL) {
+				of_node_put(phy_data.np);
 				return 0;
 			}
 			phy_count += 1;
--- linux-qcom-6.8.0.orig/drivers/ata/sata_mv.c
+++ linux-qcom-6.8.0/drivers/ata/sata_mv.c
@@ -787,37 +787,6 @@
 	},
 };
 
-static const struct pci_device_id mv_pci_tbl[] = {
-	{ PCI_VDEVICE(MARVELL, 0x5040), chip_504x },
-	{ PCI_VDEVICE(MARVELL, 0x5041), chip_504x },
-	{ PCI_VDEVICE(MARVELL, 0x5080), chip_5080 },
-	{ PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
-	/* RocketRAID 1720/174x have different identifiers */
-	{ PCI_VDEVICE(TTI, 0x1720), chip_6042 },
-	{ PCI_VDEVICE(TTI, 0x1740), chip_6042 },
-	{ PCI_VDEVICE(TTI, 0x1742), chip_6042 },
-
-	{ PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
-	{ PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
-	{ PCI_VDEVICE(MARVELL, 0x6042), chip_6042 },
-	{ PCI_VDEVICE(MARVELL, 0x6080), chip_608x },
-	{ PCI_VDEVICE(MARVELL, 0x6081), chip_608x },
-
-	{ PCI_VDEVICE(ADAPTEC2, 0x0241), chip_604x },
-
-	/* Adaptec 1430SA */
-	{ PCI_VDEVICE(ADAPTEC2, 0x0243), chip_7042 },
-
-	/* Marvell 7042 support */
-	{ PCI_VDEVICE(MARVELL, 0x7042), chip_7042 },
-
-	/* Highpoint RocketRAID PCIe series */
-	{ PCI_VDEVICE(TTI, 0x2300), chip_7042 },
-	{ PCI_VDEVICE(TTI, 0x2310), chip_7042 },
-
-	{ }			/* terminate list */
-};
-
 static const struct mv_hw_ops mv5xxx_ops = {
 	.phy_errata		= mv5_phy_errata,
 	.enable_leds		= mv5_enable_leds,
@@ -4303,6 +4272,36 @@
 static int mv_pci_device_resume(struct pci_dev *pdev);
 #endif
 
+static const struct pci_device_id mv_pci_tbl[] = {
+	{ PCI_VDEVICE(MARVELL, 0x5040), chip_504x },
+	{ PCI_VDEVICE(MARVELL, 0x5041), chip_504x },
+	{ PCI_VDEVICE(MARVELL, 0x5080), chip_5080 },
+	{ PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
+	/* RocketRAID 1720/174x have different identifiers */
+	{ PCI_VDEVICE(TTI, 0x1720), chip_6042 },
+	{ PCI_VDEVICE(TTI, 0x1740), chip_6042 },
+	{ PCI_VDEVICE(TTI, 0x1742), chip_6042 },
+
+	{ PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
+	{ PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
+	{ PCI_VDEVICE(MARVELL, 0x6042), chip_6042 },
+	{ PCI_VDEVICE(MARVELL, 0x6080), chip_608x },
+	{ PCI_VDEVICE(MARVELL, 0x6081), chip_608x },
+
+	{ PCI_VDEVICE(ADAPTEC2, 0x0241), chip_604x },
+
+	/* Adaptec 1430SA */
+	{ PCI_VDEVICE(ADAPTEC2, 0x0243), chip_7042 },
+
+	/* Marvell 7042 support */
+	{ PCI_VDEVICE(MARVELL, 0x7042), chip_7042 },
+
+	/* Highpoint RocketRAID PCIe series */
+	{ PCI_VDEVICE(TTI, 0x2300), chip_7042 },
+	{ PCI_VDEVICE(TTI, 0x2310), chip_7042 },
+
+	{ }			/* terminate list */
+};
 
 static struct pci_driver mv_pci_driver = {
 	.name			= DRV_NAME,
@@ -4315,6 +4314,7 @@
 #endif
 
 };
+MODULE_DEVICE_TABLE(pci, mv_pci_tbl);
 
 /**
  *      mv_print_info - Dump key info to kernel log for perusal.
@@ -4487,7 +4487,6 @@
 MODULE_AUTHOR("Brett Russ");
 MODULE_DESCRIPTION("SCSI low-level driver for Marvell SATA controllers");
 MODULE_LICENSE("GPL v2");
-MODULE_DEVICE_TABLE(pci, mv_pci_tbl);
 MODULE_VERSION(DRV_VERSION);
 MODULE_ALIAS("platform:" DRV_NAME);
 
--- linux-qcom-6.8.0.orig/drivers/ata/sata_sil.c
+++ linux-qcom-6.8.0/drivers/ata/sata_sil.c
@@ -128,7 +128,7 @@
 static const struct sil_drivelist {
 	const char *product;
 	unsigned int quirk;
-} sil_blacklist [] = {
+} sil_quirks[] = {
 	{ "ST320012AS",		SIL_QUIRK_MOD15WRITE },
 	{ "ST330013AS",		SIL_QUIRK_MOD15WRITE },
 	{ "ST340017AS",		SIL_QUIRK_MOD15WRITE },
@@ -600,8 +600,8 @@
  *	list, and apply the fixups to only the specific
  *	devices/hosts/firmwares that need it.
  *
- *	20040111 - Seagate drives affected by the Mod15Write bug are blacklisted
- *	The Maxtor quirk is in the blacklist, but I'm keeping the original
+ *	20040111 - Seagate drives affected by the Mod15Write bug are quirked
+ *	The Maxtor quirk is in sil_quirks, but I'm keeping the original
  *	pessimistic fix for the following reasons...
  *	- There seems to be less info on it, only one device gleaned off the
  *	Windows	driver, maybe only one is affected.  More info would be greatly
@@ -620,9 +620,9 @@
 
 	ata_id_c_string(dev->id, model_num, ATA_ID_PROD, sizeof(model_num));
 
-	for (n = 0; sil_blacklist[n].product; n++)
-		if (!strcmp(sil_blacklist[n].product, model_num)) {
-			quirks = sil_blacklist[n].quirk;
+	for (n = 0; sil_quirks[n].product; n++)
+		if (!strcmp(sil_quirks[n].product, model_num)) {
+			quirks = sil_quirks[n].quirk;
 			break;
 		}
 
--- linux-qcom-6.8.0.orig/drivers/ata/sata_sx4.c
+++ linux-qcom-6.8.0/drivers/ata/sata_sx4.c
@@ -957,8 +957,7 @@
 
 	offset -= (idx * window_size);
 	idx++;
-	dist = ((long) (window_size - (offset + size))) >= 0 ? size :
-		(long) (window_size - offset);
+	dist = min(size, window_size - offset);
 	memcpy_fromio(psource, dimm_mmio + offset / 4, dist);
 
 	psource += dist;
@@ -1005,8 +1004,7 @@
 	readl(mmio + PDC_DIMM_WINDOW_CTLR);
 	offset -= (idx * window_size);
 	idx++;
-	dist = ((long)(s32)(window_size - (offset + size))) >= 0 ? size :
-		(long) (window_size - offset);
+	dist = min(size, window_size - offset);
 	memcpy_toio(dimm_mmio + offset / 4, psource, dist);
 	writel(0x01, mmio + PDC_GENERAL_CTLR);
 	readl(mmio + PDC_GENERAL_CTLR);
--- linux-qcom-6.8.0.orig/drivers/atm/idt77252.c
+++ linux-qcom-6.8.0/drivers/atm/idt77252.c
@@ -1118,8 +1118,8 @@
 	rpp->len += skb->len;
 
 	if (stat & SAR_RSQE_EPDU) {
+		unsigned int len, truesize;
 		unsigned char *l1l2;
-		unsigned int len;
 
 		l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6);
 
@@ -1189,14 +1189,15 @@
 		ATM_SKB(skb)->vcc = vcc;
 		__net_timestamp(skb);
 
+		truesize = skb->truesize;
 		vcc->push(vcc, skb);
 		atomic_inc(&vcc->stats->rx);
 
-		if (skb->truesize > SAR_FB_SIZE_3)
+		if (truesize > SAR_FB_SIZE_3)
 			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
-		else if (skb->truesize > SAR_FB_SIZE_2)
+		else if (truesize > SAR_FB_SIZE_2)
 			add_rx_skb(card, 2, SAR_FB_SIZE_2, 1);
-		else if (skb->truesize > SAR_FB_SIZE_1)
+		else if (truesize > SAR_FB_SIZE_1)
 			add_rx_skb(card, 1, SAR_FB_SIZE_1, 1);
 		else
 			add_rx_skb(card, 0, SAR_FB_SIZE_0, 1);
--- linux-qcom-6.8.0.orig/drivers/auxdisplay/ht16k33.c
+++ linux-qcom-6.8.0/drivers/auxdisplay/ht16k33.c
@@ -506,6 +506,7 @@
 	led->max_brightness = MAX_BRIGHTNESS;
 
 	err = devm_led_classdev_register_ext(dev, led, &init_data);
+	fwnode_handle_put(init_data.fwnode);
 	if (err)
 		dev_err(dev, "Failed to register LED\n");
 
--- linux-qcom-6.8.0.orig/drivers/base/base.h
+++ linux-qcom-6.8.0/drivers/base/base.h
@@ -192,11 +192,14 @@
 void devices_kset_move_last(struct device *dev);
 
 #if defined(CONFIG_MODULES) && defined(CONFIG_SYSFS)
-void module_add_driver(struct module *mod, struct device_driver *drv);
+int module_add_driver(struct module *mod, struct device_driver *drv);
 void module_remove_driver(struct device_driver *drv);
 #else
-static inline void module_add_driver(struct module *mod,
-				     struct device_driver *drv) { }
+static inline int module_add_driver(struct module *mod,
+				    struct device_driver *drv)
+{
+	return 0;
+}
 static inline void module_remove_driver(struct device_driver *drv) { }
 #endif
 
--- linux-qcom-6.8.0.orig/drivers/base/bus.c
+++ linux-qcom-6.8.0/drivers/base/bus.c
@@ -152,7 +152,8 @@
 {
 	struct bus_attribute *bus_attr = to_bus_attr(attr);
 	struct subsys_private *subsys_priv = to_subsys_private(kobj);
-	ssize_t ret = 0;
+	/* return -EIO for reading a bus attribute without show() */
+	ssize_t ret = -EIO;
 
 	if (bus_attr->show)
 		ret = bus_attr->show(subsys_priv->bus, buf);
@@ -164,7 +165,8 @@
 {
 	struct bus_attribute *bus_attr = to_bus_attr(attr);
 	struct subsys_private *subsys_priv = to_subsys_private(kobj);
-	ssize_t ret = 0;
+	/* return -EIO for writing a bus attribute without store() */
+	ssize_t ret = -EIO;
 
 	if (bus_attr->store)
 		ret = bus_attr->store(subsys_priv->bus, buf, count);
@@ -674,7 +676,12 @@
 		if (error)
 			goto out_del_list;
 	}
-	module_add_driver(drv->owner, drv);
+	error = module_add_driver(drv->owner, drv);
+	if (error) {
+		printk(KERN_ERR "%s: failed to create module links for %s\n",
+			__func__, drv->name);
+		goto out_detach;
+	}
 
 	error = driver_create_file(drv, &driver_attr_uevent);
 	if (error) {
@@ -699,6 +706,8 @@
 
 	return 0;
 
+out_detach:
+	driver_detach(drv);
 out_del_list:
 	klist_del(&priv->knode_bus);
 out_unregister:
@@ -913,6 +922,8 @@
 	bus_remove_file(bus, &bus_attr_uevent);
 bus_uevent_fail:
 	kset_unregister(&priv->subsys);
+	/* Above kset_unregister() will kfree @priv */
+	priv = NULL;
 out:
 	kfree(priv);
 	return retval;
--- linux-qcom-6.8.0.orig/drivers/base/cacheinfo.c
+++ linux-qcom-6.8.0/drivers/base/cacheinfo.c
@@ -61,6 +61,9 @@
 	if (!cache_leaves(cpu))
 		return false;
 
+	if (!per_cpu_cacheinfo(cpu))
+		return false;
+
 	llc = per_cpu_cacheinfo_idx(cpu, cache_leaves(cpu) - 1);
 
 	return (llc->attributes & CACHE_ID) || !!llc->fw_token;
@@ -554,7 +557,11 @@
 	 */
 	ci_cacheinfo(cpu)->early_ci_levels = false;
 
-	if (cache_leaves(cpu) <= early_leaves)
+	/*
+	 * Some architectures (e.g., x86) do not use early initialization.
+	 * Allocate memory now in such case.
+	 */
+	if (cache_leaves(cpu) <= early_leaves && per_cpu_cacheinfo(cpu))
 		return 0;
 
 	kfree(per_cpu_cacheinfo(cpu));
--- linux-qcom-6.8.0.orig/drivers/base/core.c
+++ linux-qcom-6.8.0/drivers/base/core.c
@@ -44,6 +44,7 @@
 static void __fw_devlink_link_to_consumers(struct device *dev);
 static bool fw_devlink_drv_reg_done;
 static bool fw_devlink_best_effort;
+static struct workqueue_struct *device_link_wq;
 
 /**
  * __fwnode_link_add - Create a link between two fwnode_handles.
@@ -532,12 +533,26 @@
 	/*
 	 * It may take a while to complete this work because of the SRCU
 	 * synchronization in device_link_release_fn() and if the consumer or
-	 * supplier devices get deleted when it runs, so put it into the "long"
-	 * workqueue.
+	 * supplier devices get deleted when it runs, so put it into the
+	 * dedicated workqueue.
 	 */
-	queue_work(system_long_wq, &link->rm_work);
+	queue_work(device_link_wq, &link->rm_work);
 }
 
+/**
+ * device_link_wait_removal - Wait for ongoing devlink removal jobs to terminate
+ */
+void device_link_wait_removal(void)
+{
+	/*
+	 * devlink removal jobs are queued in the dedicated work queue.
+	 * To be sure that all removal jobs are terminated, ensure that any
+	 * scheduled work has run to completion.
+	 */
+	flush_workqueue(device_link_wq);
+}
+EXPORT_SYMBOL_GPL(device_link_wait_removal);
+
 static struct class devlink_class = {
 	.name = "devlink",
 	.dev_groups = devlink_groups,
@@ -1011,7 +1026,8 @@
 		return NULL;
 
 	list_for_each_entry(link, &fwnode->suppliers, c_hook)
-		if (!(link->flags & FWLINK_FLAG_CYCLE))
+		if (!(link->flags &
+		      (FWLINK_FLAG_CYCLE | FWLINK_FLAG_IGNORE)))
 			return link->supplier;
 
 	return NULL;
@@ -1921,10 +1937,10 @@
  *
  * Return true if one or more cycles were found. Otherwise, return false.
  */
-static bool __fw_devlink_relax_cycles(struct device *con,
+static bool __fw_devlink_relax_cycles(struct fwnode_handle *con_handle,
 				 struct fwnode_handle *sup_handle)
 {
-	struct device *sup_dev = NULL, *par_dev = NULL;
+	struct device *sup_dev = NULL, *par_dev = NULL, *con_dev = NULL;
 	struct fwnode_link *link;
 	struct device_link *dev_link;
 	bool ret = false;
@@ -1941,28 +1957,31 @@
 
 	sup_handle->flags |= FWNODE_FLAG_VISITED;
 
-	sup_dev = get_dev_from_fwnode(sup_handle);
-
 	/* Termination condition. */
-	if (sup_dev == con) {
+	if (sup_handle == con_handle) {
 		pr_debug("----- cycle: start -----\n");
 		ret = true;
 		goto out;
 	}
 
+	sup_dev = get_dev_from_fwnode(sup_handle);
+	con_dev = get_dev_from_fwnode(con_handle);
 	/*
 	 * If sup_dev is bound to a driver and @con hasn't started binding to a
 	 * driver, sup_dev can't be a consumer of @con. So, no need to check
 	 * further.
 	 */
 	if (sup_dev && sup_dev->links.status ==  DL_DEV_DRIVER_BOUND &&
-	    con->links.status == DL_DEV_NO_DRIVER) {
+	    con_dev && con_dev->links.status == DL_DEV_NO_DRIVER) {
 		ret = false;
 		goto out;
 	}
 
 	list_for_each_entry(link, &sup_handle->suppliers, c_hook) {
-		if (__fw_devlink_relax_cycles(con, link->supplier)) {
+		if (link->flags & FWLINK_FLAG_IGNORE)
+			continue;
+
+		if (__fw_devlink_relax_cycles(con_handle, link->supplier)) {
 			__fwnode_link_cycle(link);
 			ret = true;
 		}
@@ -1977,7 +1996,7 @@
 	else
 		par_dev = fwnode_get_next_parent_dev(sup_handle);
 
-	if (par_dev && __fw_devlink_relax_cycles(con, par_dev->fwnode)) {
+	if (par_dev && __fw_devlink_relax_cycles(con_handle, par_dev->fwnode)) {
 		pr_debug("%pfwf: cycle: child of %pfwf\n", sup_handle,
 			 par_dev->fwnode);
 		ret = true;
@@ -1995,7 +2014,7 @@
 		    !(dev_link->flags & DL_FLAG_CYCLE))
 			continue;
 
-		if (__fw_devlink_relax_cycles(con,
+		if (__fw_devlink_relax_cycles(con_handle,
 					      dev_link->supplier->fwnode)) {
 			pr_debug("%pfwf: cycle: depends on %pfwf\n", sup_handle,
 				 dev_link->supplier->fwnode);
@@ -2008,6 +2027,7 @@
 out:
 	sup_handle->flags &= ~FWNODE_FLAG_VISITED;
 	put_device(sup_dev);
+	put_device(con_dev);
 	put_device(par_dev);
 	return ret;
 }
@@ -2040,10 +2060,8 @@
 	int ret = 0;
 	u32 flags;
 
-	if (con->fwnode == link->consumer)
-		flags = fw_devlink_get_flags(link->flags);
-	else
-		flags = FW_DEVLINK_FLAGS_PERMISSIVE;
+	if (link->flags & FWLINK_FLAG_IGNORE)
+		return 0;
 
 	/*
 	 * In some cases, a device P might also be a supplier to its child node
@@ -2065,25 +2083,23 @@
 		return -EINVAL;
 
 	/*
-	 * SYNC_STATE_ONLY device links don't block probing and supports cycles.
-	 * So, one might expect that cycle detection isn't necessary for them.
-	 * However, if the device link was marked as SYNC_STATE_ONLY because
-	 * it's part of a cycle, then we still need to do cycle detection. This
-	 * is because the consumer and supplier might be part of multiple cycles
-	 * and we need to detect all those cycles.
+	 * Don't try to optimize by not calling the cycle detection logic under
+	 * certain conditions. There's always some corner case that won't get
+	 * detected.
 	 */
-	if (!device_link_flag_is_sync_state_only(flags) ||
-	    flags & DL_FLAG_CYCLE) {
-		device_links_write_lock();
-		if (__fw_devlink_relax_cycles(con, sup_handle)) {
-			__fwnode_link_cycle(link);
-			flags = fw_devlink_get_flags(link->flags);
-			pr_debug("----- cycle: end -----\n");
-			dev_info(con, "Fixed dependency cycle(s) with %pfwf\n",
-				 sup_handle);
-		}
-		device_links_write_unlock();
+	device_links_write_lock();
+	if (__fw_devlink_relax_cycles(link->consumer, sup_handle)) {
+		__fwnode_link_cycle(link);
+		pr_debug("----- cycle: end -----\n");
+		pr_info("%pfwf: Fixed dependency cycle(s) with %pfwf\n",
+			link->consumer, sup_handle);
 	}
+	device_links_write_unlock();
+
+	if (con->fwnode == link->consumer)
+		flags = fw_devlink_get_flags(link->flags);
+	else
+		flags = FW_DEVLINK_FLAGS_PERMISSIVE;
 
 	if (sup_handle->flags & FWNODE_FLAG_NOT_DEVICE)
 		sup_dev = fwnode_get_next_parent_dev(sup_handle);
@@ -2657,8 +2673,11 @@
 	if (!env)
 		return -ENOMEM;
 
+	/* Synchronize with really_probe() */
+	device_lock(dev);
 	/* let the kset specific function add its keys */
 	retval = kset->uevent_ops->uevent(&dev->kobj, env);
+	device_unlock(dev);
 	if (retval)
 		goto out;
 
@@ -4002,6 +4021,41 @@
 EXPORT_SYMBOL_GPL(device_for_each_child_reverse);
 
 /**
+ * device_for_each_child_reverse_from - device child iterator in reversed order.
+ * @parent: parent struct device.
+ * @from: optional starting point in child list
+ * @fn: function to be called for each device.
+ * @data: data for the callback.
+ *
+ * Iterate over @parent's child devices, starting at @from, and call @fn
+ * for each, passing it @data. This helper is identical to
+ * device_for_each_child_reverse() when @from is NULL.
+ *
+ * @fn is checked each iteration. If it returns anything other than 0,
+ * iteration stop and that value is returned to the caller of
+ * device_for_each_child_reverse_from();
+ */
+int device_for_each_child_reverse_from(struct device *parent,
+				       struct device *from, const void *data,
+				       int (*fn)(struct device *, const void *))
+{
+	struct klist_iter i;
+	struct device *child;
+	int error = 0;
+
+	if (!parent->p)
+		return 0;
+
+	klist_iter_init_node(&parent->p->klist_children, &i,
+			     (from ? &from->p->knode_parent : NULL));
+	while ((child = prev_device(&i)) && !error)
+		error = fn(child, data);
+	klist_iter_exit(&i);
+	return error;
+}
+EXPORT_SYMBOL_GPL(device_for_each_child_reverse_from);
+
+/**
  * device_find_child - device iterator for locating a particular device.
  * @parent: parent struct device
  * @match: Callback function to check device
@@ -4098,9 +4152,14 @@
 	sysfs_dev_char_kobj = kobject_create_and_add("char", dev_kobj);
 	if (!sysfs_dev_char_kobj)
 		goto char_kobj_err;
+	device_link_wq = alloc_workqueue("device_link_wq", 0, 0);
+	if (!device_link_wq)
+		goto wq_err;
 
 	return 0;
 
+ wq_err:
+	kobject_put(sysfs_dev_char_kobj);
  char_kobj_err:
 	kobject_put(sysfs_dev_block_kobj);
  block_kobj_err:
@@ -4467,9 +4526,11 @@
  */
 int device_rename(struct device *dev, const char *new_name)
 {
+	struct subsys_private *sp = NULL;
 	struct kobject *kobj = &dev->kobj;
 	char *old_device_name = NULL;
 	int error;
+	bool is_link_renamed = false;
 
 	dev = get_device(dev);
 	if (!dev)
@@ -4484,7 +4545,7 @@
 	}
 
 	if (dev->class) {
-		struct subsys_private *sp = class_to_subsys(dev->class);
+		sp = class_to_subsys(dev->class);
 
 		if (!sp) {
 			error = -EINVAL;
@@ -4493,16 +4554,19 @@
 
 		error = sysfs_rename_link_ns(&sp->subsys.kobj, kobj, old_device_name,
 					     new_name, kobject_namespace(kobj));
-		subsys_put(sp);
 		if (error)
 			goto out;
+
+		is_link_renamed = true;
 	}
 
 	error = kobject_rename(kobj, new_name);
-	if (error)
-		goto out;
-
 out:
+	if (error && is_link_renamed)
+		sysfs_rename_link_ns(&sp->subsys.kobj, kobj, new_name,
+				     old_device_name, kobject_namespace(kobj));
+	subsys_put(sp);
+
 	put_device(dev);
 
 	kfree(old_device_name);
--- linux-qcom-6.8.0.orig/drivers/base/cpu.c
+++ linux-qcom-6.8.0/drivers/base/cpu.c
@@ -588,6 +588,7 @@
 CPU_SHOW_VULN_FALLBACK(retbleed);
 CPU_SHOW_VULN_FALLBACK(spec_rstack_overflow);
 CPU_SHOW_VULN_FALLBACK(gds);
+CPU_SHOW_VULN_FALLBACK(reg_file_data_sampling);
 
 static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
 static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
@@ -602,6 +603,7 @@
 static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL);
 static DEVICE_ATTR(spec_rstack_overflow, 0444, cpu_show_spec_rstack_overflow, NULL);
 static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL);
+static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL);
 
 static struct attribute *cpu_root_vulnerabilities_attrs[] = {
 	&dev_attr_meltdown.attr,
@@ -617,6 +619,7 @@
 	&dev_attr_retbleed.attr,
 	&dev_attr_spec_rstack_overflow.attr,
 	&dev_attr_gather_data_sampling.attr,
+	&dev_attr_reg_file_data_sampling.attr,
 	NULL
 };
 
--- linux-qcom-6.8.0.orig/drivers/base/devres.c
+++ linux-qcom-6.8.0/drivers/base/devres.c
@@ -567,6 +567,7 @@
 	grp->id = grp;
 	if (id)
 		grp->id = id;
+	grp->color = 0;
 
 	spin_lock_irqsave(&dev->devres_lock, flags);
 	add_dr(dev, &grp->node[0]);
@@ -896,9 +897,12 @@
 	/*
 	 * Otherwise: allocate new, larger chunk. We need to allocate before
 	 * taking the lock as most probably the caller uses GFP_KERNEL.
+	 * alloc_dr() will call check_dr_size() to reserve extra memory
+	 * for struct devres automatically, so size @new_size user request
+	 * is delivered to it directly as devm_kmalloc() does.
 	 */
 	new_dr = alloc_dr(devm_kmalloc_release,
-			  total_new_size, gfp, dev_to_node(dev));
+			  new_size, gfp, dev_to_node(dev));
 	if (!new_dr)
 		return NULL;
 
@@ -1222,7 +1226,11 @@
  */
 void devm_free_percpu(struct device *dev, void __percpu *pdata)
 {
-	WARN_ON(devres_destroy(dev, devm_percpu_release, devm_percpu_match,
+	/*
+	 * Use devres_release() to prevent memory leakage as
+	 * devm_free_pages() does.
+	 */
+	WARN_ON(devres_release(dev, devm_percpu_release, devm_percpu_match,
 			       (__force void *)pdata));
 }
 EXPORT_SYMBOL_GPL(devm_free_percpu);
--- linux-qcom-6.8.0.orig/drivers/base/firmware_loader/main.c
+++ linux-qcom-6.8.0/drivers/base/firmware_loader/main.c
@@ -825,19 +825,18 @@
 	shash->tfm = alg;
 
 	if (crypto_shash_digest(shash, fw->data, fw->size, sha256buf) < 0)
-		goto out_shash;
+		goto out_free;
 
 	for (int i = 0; i < SHA256_DIGEST_SIZE; i++)
 		sprintf(&outbuf[i * 2], "%02x", sha256buf[i]);
 	outbuf[SHA256_BLOCK_SIZE] = 0;
 	dev_dbg(device, "Loaded FW: %s, sha256: %s\n", name, outbuf);
 
-out_shash:
-	crypto_free_shash(alg);
 out_free:
 	kfree(shash);
 	kfree(outbuf);
 	kfree(sha256buf);
+	crypto_free_shash(alg);
 }
 #else
 static void fw_log_firmware_info(const struct firmware *fw, const char *name,
@@ -845,6 +844,26 @@
 {}
 #endif
 
+/*
+ * Reject firmware file names with ".." path components.
+ * There are drivers that construct firmware file names from device-supplied
+ * strings, and we don't want some device to be able to tell us "I would like to
+ * be sent my firmware from ../../../etc/shadow, please".
+ *
+ * Search for ".." surrounded by either '/' or start/end of string.
+ *
+ * This intentionally only looks at the firmware name, not at the firmware base
+ * directory or at symlink contents.
+ */
+static bool name_contains_dotdot(const char *name)
+{
+	size_t name_len = strlen(name);
+
+	return strcmp(name, "..") == 0 || strncmp(name, "../", 3) == 0 ||
+	       strstr(name, "/../") != NULL ||
+	       (name_len >= 3 && strcmp(name+name_len-3, "/..") == 0);
+}
+
 /* called from request_firmware() and request_firmware_work_func() */
 static int
 _request_firmware(const struct firmware **firmware_p, const char *name,
@@ -865,6 +884,14 @@
 		goto out;
 	}
 
+	if (name_contains_dotdot(name)) {
+		dev_warn(device,
+			 "Firmware load for '%s' refused, path contains '..' component\n",
+			 name);
+		ret = -EINVAL;
+		goto out;
+	}
+
 	ret = _request_firmware_prepare(&fw, name, device, buf, size,
 					offset, opt_flags);
 	if (ret <= 0) /* error or already assigned */
@@ -942,6 +969,8 @@
  *      @name will be used as $FIRMWARE in the uevent environment and
  *      should be distinctive enough not to be confused with any other
  *      firmware image for this or any other device.
+ *	It must not contain any ".." path components - "foo/bar..bin" is
+ *	allowed, but "foo/../bar.bin" is not.
  *
  *	Caller must hold the reference count of @device.
  *
--- linux-qcom-6.8.0.orig/drivers/base/memory.c
+++ linux-qcom-6.8.0/drivers/base/memory.c
@@ -188,6 +188,7 @@
 	unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr);
 	unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block;
 	unsigned long nr_vmemmap_pages = 0;
+	struct memory_notify arg;
 	struct zone *zone;
 	int ret;
 
@@ -207,9 +208,19 @@
 	if (mem->altmap)
 		nr_vmemmap_pages = mem->altmap->free;
 
+	arg.altmap_start_pfn = start_pfn;
+	arg.altmap_nr_pages = nr_vmemmap_pages;
+	arg.start_pfn = start_pfn + nr_vmemmap_pages;
+	arg.nr_pages = nr_pages - nr_vmemmap_pages;
 	mem_hotplug_begin();
+	ret = memory_notify(MEM_PREPARE_ONLINE, &arg);
+	ret = notifier_to_errno(ret);
+	if (ret)
+		goto out_notifier;
+
 	if (nr_vmemmap_pages) {
-		ret = mhp_init_memmap_on_memory(start_pfn, nr_vmemmap_pages, zone);
+		ret = mhp_init_memmap_on_memory(start_pfn, nr_vmemmap_pages,
+						zone, mem->altmap->inaccessible);
 		if (ret)
 			goto out;
 	}
@@ -231,7 +242,11 @@
 					  nr_vmemmap_pages);
 
 	mem->zone = zone;
+	mem_hotplug_done();
+	return ret;
 out:
+	memory_notify(MEM_FINISH_OFFLINE, &arg);
+out_notifier:
 	mem_hotplug_done();
 	return ret;
 }
@@ -244,6 +259,7 @@
 	unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr);
 	unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block;
 	unsigned long nr_vmemmap_pages = 0;
+	struct memory_notify arg;
 	int ret;
 
 	if (!mem->zone)
@@ -275,6 +291,11 @@
 		mhp_deinit_memmap_on_memory(start_pfn, nr_vmemmap_pages);
 
 	mem->zone = NULL;
+	arg.altmap_start_pfn = start_pfn;
+	arg.altmap_nr_pages = nr_vmemmap_pages;
+	arg.start_pfn = start_pfn + nr_vmemmap_pages;
+	arg.nr_pages = nr_pages - nr_vmemmap_pages;
+	memory_notify(MEM_FINISH_OFFLINE, &arg);
 out:
 	mem_hotplug_done();
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/base/module.c
+++ linux-qcom-6.8.0/drivers/base/module.c
@@ -30,14 +30,14 @@
 	mutex_unlock(&drivers_dir_mutex);
 }
 
-void module_add_driver(struct module *mod, struct device_driver *drv)
+int module_add_driver(struct module *mod, struct device_driver *drv)
 {
 	char *driver_name;
-	int no_warn;
 	struct module_kobject *mk = NULL;
+	int ret;
 
 	if (!drv)
-		return;
+		return 0;
 
 	if (mod)
 		mk = &mod->mkobj;
@@ -56,17 +56,41 @@
 	}
 
 	if (!mk)
-		return;
+		return 0;
+
+	ret = sysfs_create_link(&drv->p->kobj, &mk->kobj, "module");
+	if (ret)
+		return ret;
 
-	/* Don't check return codes; these calls are idempotent */
-	no_warn = sysfs_create_link(&drv->p->kobj, &mk->kobj, "module");
 	driver_name = make_driver_name(drv);
-	if (driver_name) {
-		module_create_drivers_dir(mk);
-		no_warn = sysfs_create_link(mk->drivers_dir, &drv->p->kobj,
-					    driver_name);
-		kfree(driver_name);
+	if (!driver_name) {
+		ret = -ENOMEM;
+		goto out_remove_kobj;
+	}
+
+	module_create_drivers_dir(mk);
+	if (!mk->drivers_dir) {
+		ret = -EINVAL;
+		goto out_free_driver_name;
 	}
+
+	ret = sysfs_create_link(mk->drivers_dir, &drv->p->kobj, driver_name);
+	if (ret)
+		goto out_remove_drivers_dir;
+
+	kfree(driver_name);
+
+	return 0;
+
+out_remove_drivers_dir:
+	sysfs_remove_link(mk->drivers_dir, driver_name);
+
+out_free_driver_name:
+	kfree(driver_name);
+
+out_remove_kobj:
+	sysfs_remove_link(&drv->p->kobj, "module");
+	return ret;
 }
 
 void module_remove_driver(struct device_driver *drv)
--- linux-qcom-6.8.0.orig/drivers/base/node.c
+++ linux-qcom-6.8.0/drivers/base/node.c
@@ -126,7 +126,7 @@
 }
 
 static struct node_access_nodes *node_init_node_access(struct node *node,
-						       unsigned int access)
+						       enum access_coordinate_class access)
 {
 	struct node_access_nodes *access_node;
 	struct device *dev;
@@ -191,7 +191,7 @@
  * @access: The access class the for the given attributes
  */
 void node_set_perf_attrs(unsigned int nid, struct access_coordinate *coord,
-			 unsigned int access)
+			 enum access_coordinate_class access)
 {
 	struct node_access_nodes *c;
 	struct node *node;
@@ -689,7 +689,7 @@
  */
 int register_memory_node_under_compute_node(unsigned int mem_nid,
 					    unsigned int cpu_nid,
-					    unsigned int access)
+					    enum access_coordinate_class access)
 {
 	struct node *init_node, *targ_node;
 	struct node_access_nodes *initiator, *target;
--- linux-qcom-6.8.0.orig/drivers/base/power/common.c
+++ linux-qcom-6.8.0/drivers/base/power/common.c
@@ -168,6 +168,115 @@
 EXPORT_SYMBOL_GPL(dev_pm_domain_attach_by_name);
 
 /**
+ * dev_pm_domain_attach_list - Associate a device with its PM domains.
+ * @dev: The device used to lookup the PM domains for.
+ * @data: The data used for attaching to the PM domains.
+ * @list: An out-parameter with an allocated list of attached PM domains.
+ *
+ * This function helps to attach a device to its multiple PM domains. The
+ * caller, which is typically a driver's probe function, may provide a list of
+ * names for the PM domains that we should try to attach the device to, but it
+ * may also provide an empty list, in case the attach should be done for all of
+ * the available PM domains.
+ *
+ * Callers must ensure proper synchronization of this function with power
+ * management callbacks.
+ *
+ * Returns the number of attached PM domains or a negative error code in case of
+ * a failure. Note that, to detach the list of PM domains, the driver shall call
+ * dev_pm_domain_detach_list(), typically during the remove phase.
+ */
+int dev_pm_domain_attach_list(struct device *dev,
+			      const struct dev_pm_domain_attach_data *data,
+			      struct dev_pm_domain_list **list)
+{
+	struct device_node *np = dev->of_node;
+	struct dev_pm_domain_list *pds;
+	struct device *pd_dev = NULL;
+	int ret, i, num_pds = 0;
+	bool by_id = true;
+	u32 pd_flags = data ? data->pd_flags : 0;
+	u32 link_flags = pd_flags & PD_FLAG_NO_DEV_LINK ? 0 :
+			DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME;
+
+	if (dev->pm_domain)
+		return -EEXIST;
+
+	/* For now this is limited to OF based platforms. */
+	if (!np)
+		return 0;
+
+	if (data && data->pd_names) {
+		num_pds = data->num_pd_names;
+		by_id = false;
+	} else {
+		num_pds = of_count_phandle_with_args(np, "power-domains",
+						     "#power-domain-cells");
+	}
+
+	if (num_pds <= 0)
+		return 0;
+
+	pds = devm_kzalloc(dev, sizeof(*pds), GFP_KERNEL);
+	if (!pds)
+		return -ENOMEM;
+
+	pds->pd_devs = devm_kcalloc(dev, num_pds, sizeof(*pds->pd_devs),
+				    GFP_KERNEL);
+	if (!pds->pd_devs)
+		return -ENOMEM;
+
+	pds->pd_links = devm_kcalloc(dev, num_pds, sizeof(*pds->pd_links),
+				     GFP_KERNEL);
+	if (!pds->pd_links)
+		return -ENOMEM;
+
+	if (link_flags && pd_flags & PD_FLAG_DEV_LINK_ON)
+		link_flags |= DL_FLAG_RPM_ACTIVE;
+
+	for (i = 0; i < num_pds; i++) {
+		if (by_id)
+			pd_dev = dev_pm_domain_attach_by_id(dev, i);
+		else
+			pd_dev = dev_pm_domain_attach_by_name(dev,
+							data->pd_names[i]);
+		if (IS_ERR_OR_NULL(pd_dev)) {
+			ret = pd_dev ? PTR_ERR(pd_dev) : -ENODEV;
+			goto err_attach;
+		}
+
+		if (link_flags) {
+			struct device_link *link;
+
+			link = device_link_add(dev, pd_dev, link_flags);
+			if (!link) {
+				ret = -ENODEV;
+				goto err_link;
+			}
+
+			pds->pd_links[i] = link;
+		}
+
+		pds->pd_devs[i] = pd_dev;
+	}
+
+	pds->num_pds = num_pds;
+	*list = pds;
+	return num_pds;
+
+err_link:
+	dev_pm_domain_detach(pd_dev, true);
+err_attach:
+	while (--i >= 0) {
+		if (pds->pd_links[i])
+			device_link_del(pds->pd_links[i]);
+		dev_pm_domain_detach(pds->pd_devs[i], true);
+	}
+	return ret;
+}
+EXPORT_SYMBOL_GPL(dev_pm_domain_attach_list);
+
+/**
  * dev_pm_domain_detach - Detach a device from its PM domain.
  * @dev: Device to detach.
  * @power_off: Used to indicate whether we should power off the device.
@@ -188,6 +297,31 @@
 EXPORT_SYMBOL_GPL(dev_pm_domain_detach);
 
 /**
+ * dev_pm_domain_detach_list - Detach a list of PM domains.
+ * @list: The list of PM domains to detach.
+ *
+ * This function reverse the actions from dev_pm_domain_attach_list().
+ * Typically it should be invoked during the remove phase from drivers.
+ *
+ * Callers must ensure proper synchronization of this function with power
+ * management callbacks.
+ */
+void dev_pm_domain_detach_list(struct dev_pm_domain_list *list)
+{
+	int i;
+
+	if (!list)
+		return;
+
+	for (i = 0; i < list->num_pds; i++) {
+		if (list->pd_links[i])
+			device_link_del(list->pd_links[i]);
+		dev_pm_domain_detach(list->pd_devs[i], true);
+	}
+}
+EXPORT_SYMBOL_GPL(dev_pm_domain_detach_list);
+
+/**
  * dev_pm_domain_start - Start the device through its PM domain.
  * @dev: Device to start.
  *
--- linux-qcom-6.8.0.orig/drivers/base/power/runtime.c
+++ linux-qcom-6.8.0/drivers/base/power/runtime.c
@@ -1176,7 +1176,7 @@
 EXPORT_SYMBOL_GPL(__pm_runtime_resume);
 
 /**
- * pm_runtime_get_if_active - Conditionally bump up device usage counter.
+ * pm_runtime_get_conditional - Conditionally bump up device usage counter.
  * @dev: Device to handle.
  * @ign_usage_count: Whether or not to look at the current usage counter value.
  *
@@ -1197,7 +1197,7 @@
  * The caller is responsible for decrementing the runtime PM usage counter of
  * @dev after this function has returned a positive value for it.
  */
-int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count)
+static int pm_runtime_get_conditional(struct device *dev, bool ign_usage_count)
 {
 	unsigned long flags;
 	int retval;
@@ -1218,9 +1218,40 @@
 
 	return retval;
 }
+
+/**
+ * pm_runtime_get_if_active - Bump up runtime PM usage counter if the device is
+ *			      in active state
+ * @dev: Target device.
+ *
+ * Increment the runtime PM usage counter of @dev if its runtime PM status is
+ * %RPM_ACTIVE, in which case it returns 1. If the device is in a different
+ * state, 0 is returned. -EINVAL is returned if runtime PM is disabled for the
+ * device, in which case also the usage_count will remain unmodified.
+ */
+int pm_runtime_get_if_active(struct device *dev)
+{
+	return pm_runtime_get_conditional(dev, true);
+}
 EXPORT_SYMBOL_GPL(pm_runtime_get_if_active);
 
 /**
+ * pm_runtime_get_if_in_use - Conditionally bump up runtime PM usage counter.
+ * @dev: Target device.
+ *
+ * Increment the runtime PM usage counter of @dev if its runtime PM status is
+ * %RPM_ACTIVE and its runtime PM usage counter is greater than 0, in which case
+ * it returns 1. If the device is in a different state or its usage_count is 0,
+ * 0 is returned. -EINVAL is returned if runtime PM is disabled for the device,
+ * in which case also the usage_count will remain unmodified.
+ */
+int pm_runtime_get_if_in_use(struct device *dev)
+{
+	return pm_runtime_get_conditional(dev, false);
+}
+EXPORT_SYMBOL_GPL(pm_runtime_get_if_in_use);
+
+/**
  * __pm_runtime_set_status - Set runtime PM status of a device.
  * @dev: Device to handle.
  * @status: New runtime PM status of the device.
--- linux-qcom-6.8.0.orig/drivers/base/power/wakeirq.c
+++ linux-qcom-6.8.0/drivers/base/power/wakeirq.c
@@ -313,8 +313,10 @@
 		return;
 
 	if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED &&
-	    wirq->status & WAKE_IRQ_DEDICATED_REVERSE)
+	    wirq->status & WAKE_IRQ_DEDICATED_REVERSE) {
 		enable_irq(wirq->irq);
+		wirq->status |= WAKE_IRQ_DEDICATED_ENABLED;
+	}
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/base/regmap/internal.h
+++ linux-qcom-6.8.0/drivers/base/regmap/internal.h
@@ -59,6 +59,7 @@
 			unsigned long raw_spinlock_flags;
 		};
 	};
+	struct lock_class_key *lock_key;
 	regmap_lock lock;
 	regmap_unlock unlock;
 	void *lock_arg; /* This is passed to lock/unlock functions */
--- linux-qcom-6.8.0.orig/drivers/base/regmap/regcache-maple.c
+++ linux-qcom-6.8.0/drivers/base/regmap/regcache-maple.c
@@ -110,9 +110,10 @@
 	struct maple_tree *mt = map->cache;
 	MA_STATE(mas, mt, min, max);
 	unsigned long *entry, *lower, *upper;
-	unsigned long lower_index, lower_last;
+	/* initialized to work around false-positive -Wuninitialized warning */
+	unsigned long lower_index = 0, lower_last = 0;
 	unsigned long upper_index, upper_last;
-	int ret;
+	int ret = 0;
 
 	lower = NULL;
 	upper = NULL;
@@ -145,7 +146,7 @@
 			upper_index = max + 1;
 			upper_last = mas.last;
 
-			upper = kmemdup(&entry[max + 1],
+			upper = kmemdup(&entry[max - mas.index + 1],
 					((mas.last - max) *
 					 sizeof(unsigned long)),
 					map->alloc_flags);
@@ -244,7 +245,7 @@
 	unsigned long lmin = min;
 	unsigned long lmax = max;
 	unsigned int r, v, sync_start;
-	int ret;
+	int ret = 0;
 	bool sync_needed = false;
 
 	map->cache_bypass = true;
@@ -355,6 +356,9 @@
 
 	mt_init(mt);
 
+	if (!mt_external_lock(mt) && map->lock_key)
+		lockdep_set_class_and_subclass(&mt->ma_lock, map->lock_key, 1);
+
 	if (!map->num_reg_defaults)
 		return 0;
 
--- linux-qcom-6.8.0.orig/drivers/base/regmap/regmap-i2c.c
+++ linux-qcom-6.8.0/drivers/base/regmap/regmap-i2c.c
@@ -350,7 +350,8 @@
 
 		if (quirks->max_write_len &&
 		    (bus->max_raw_write == 0 || bus->max_raw_write > quirks->max_write_len))
-			max_write = quirks->max_write_len;
+			max_write = quirks->max_write_len -
+				(config->reg_bits + config->pad_bits) / BITS_PER_BYTE;
 
 		if (max_read || max_write) {
 			ret_bus = kmemdup(bus, sizeof(*bus), GFP_KERNEL);
--- linux-qcom-6.8.0.orig/drivers/base/regmap/regmap-irq.c
+++ linux-qcom-6.8.0/drivers/base/regmap/regmap-irq.c
@@ -514,12 +514,16 @@
 		return IRQ_NONE;
 }
 
+static struct lock_class_key regmap_irq_lock_class;
+static struct lock_class_key regmap_irq_request_class;
+
 static int regmap_irq_map(struct irq_domain *h, unsigned int virq,
 			  irq_hw_number_t hw)
 {
 	struct regmap_irq_chip_data *data = h->host_data;
 
 	irq_set_chip_data(virq, data);
+	irq_set_lockdep_class(virq, &regmap_irq_lock_class, &regmap_irq_request_class);
 	irq_set_chip(virq, &data->irq_chip);
 	irq_set_nested_thread(virq, 1);
 	irq_set_parent(virq, data->irq);
--- linux-qcom-6.8.0.orig/drivers/base/regmap/regmap-kunit.c
+++ linux-qcom-6.8.0/drivers/base/regmap/regmap-kunit.c
@@ -4,11 +4,14 @@
 //
 // Copyright 2023 Arm Ltd
 
+#include <kunit/resource.h>
 #include <kunit/test.h>
 #include "internal.h"
 
 #define BLOCK_TEST_SIZE 12
 
+KUNIT_DEFINE_ACTION_WRAPPER(regmap_exit_action, regmap_exit, struct regmap *);
+
 static void get_changed_bytes(void *orig, void *new, size_t size)
 {
 	char *o = orig;
@@ -70,9 +73,9 @@
 				 struct regmap_ram_data **data)
 {
 	unsigned int *buf;
-	struct regmap *ret;
+	struct regmap *ret = ERR_PTR(-ENOMEM);
 	size_t size = (config->max_register + 1) * sizeof(unsigned int);
-	int i;
+	int i, error;
 	struct reg_default *defaults;
 
 	config->disable_locking = config->cache_type == REGCACHE_RBTREE ||
@@ -86,15 +89,17 @@
 
 	*data = kzalloc(sizeof(**data), GFP_KERNEL);
 	if (!(*data))
-		return ERR_PTR(-ENOMEM);
+		goto out_free;
 	(*data)->vals = buf;
 
 	if (config->num_reg_defaults) {
-		defaults = kcalloc(config->num_reg_defaults,
-				   sizeof(struct reg_default),
-				   GFP_KERNEL);
+		defaults = kunit_kcalloc(test,
+					 config->num_reg_defaults,
+					 sizeof(struct reg_default),
+					 GFP_KERNEL);
 		if (!defaults)
-			return ERR_PTR(-ENOMEM);
+			goto out_free;
+
 		config->reg_defaults = defaults;
 
 		for (i = 0; i < config->num_reg_defaults; i++) {
@@ -104,10 +109,19 @@
 	}
 
 	ret = regmap_init_ram(config, *data);
-	if (IS_ERR(ret)) {
-		kfree(buf);
-		kfree(*data);
-	}
+	if (IS_ERR(ret))
+		goto out_free;
+
+	/* This calls regmap_exit() on failure, which frees buf and *data */
+	error = kunit_add_action_or_reset(test, regmap_exit_action, ret);
+	if (error)
+		ret = ERR_PTR(error);
+
+	return ret;
+
+out_free:
+	kfree(buf);
+	kfree(*data);
 
 	return ret;
 }
@@ -142,8 +156,6 @@
 
 	/* If using a cache the cache satisfied the read */
 	KUNIT_EXPECT_EQ(test, t->type == REGCACHE_NONE, data->read[0]);
-
-	regmap_exit(map);
 }
 
 static void bulk_write(struct kunit *test)
@@ -179,8 +191,6 @@
 	/* If using a cache the cache satisfied the read */
 	for (i = 0; i < BLOCK_TEST_SIZE; i++)
 		KUNIT_EXPECT_EQ(test, t->type == REGCACHE_NONE, data->read[i]);
-
-	regmap_exit(map);
 }
 
 static void bulk_read(struct kunit *test)
@@ -212,8 +222,6 @@
 	/* If using a cache the cache satisfied the read */
 	for (i = 0; i < BLOCK_TEST_SIZE; i++)
 		KUNIT_EXPECT_EQ(test, t->type == REGCACHE_NONE, data->read[i]);
-
-	regmap_exit(map);
 }
 
 static void write_readonly(struct kunit *test)
@@ -247,8 +255,6 @@
 	/* Did that match what we see on the device? */
 	for (i = 0; i < BLOCK_TEST_SIZE; i++)
 		KUNIT_EXPECT_EQ(test, i != 5, data->written[i]);
-
-	regmap_exit(map);
 }
 
 static void read_writeonly(struct kunit *test)
@@ -287,8 +293,6 @@
 
 	/* Did we trigger a hardware access? */
 	KUNIT_EXPECT_FALSE(test, data->read[5]);
-
-	regmap_exit(map);
 }
 
 static void reg_defaults(struct kunit *test)
@@ -401,8 +405,6 @@
 			break;
 		}
 	}
-
-	regmap_exit(map);
 }
 
 static void stride(struct kunit *test)
@@ -444,8 +446,6 @@
 			KUNIT_EXPECT_TRUE(test, data->written[i]);
 		}
 	}
-
-	regmap_exit(map);
 }
 
 static struct regmap_range_cfg test_range = {
@@ -546,8 +546,6 @@
 		KUNIT_EXPECT_FALSE(test, data->read[i]);
 		KUNIT_EXPECT_FALSE(test, data->written[i]);
 	}
-
-	regmap_exit(map);
 }
 
 /* Try to stress dynamic creation of cache data structures */
@@ -601,8 +599,6 @@
 		KUNIT_EXPECT_EQ(test, rval, vals[i]);
 		KUNIT_EXPECT_EQ(test, t->type == REGCACHE_NONE, data->read[i]);
 	}
-
-	regmap_exit(map);
 }
 
 static void cache_bypass(struct kunit *test)
@@ -639,8 +635,6 @@
 	regcache_cache_bypass(map, false);
 	KUNIT_EXPECT_EQ(test, 0, regmap_read(map, 0, &rval));
 	KUNIT_EXPECT_EQ(test, val, rval);
-
-	regmap_exit(map);
 }
 
 static void cache_sync(struct kunit *test)
@@ -677,8 +671,6 @@
 	KUNIT_EXPECT_MEMEQ(test, data->vals, val, sizeof(val));
 	for (i = 0; i < BLOCK_TEST_SIZE; i++)
 		KUNIT_EXPECT_EQ(test, true, data->written[i]);
-
-	regmap_exit(map);
 }
 
 static void cache_sync_defaults(struct kunit *test)
@@ -713,8 +705,6 @@
 	/* Did we just sync the one register we touched? */
 	for (i = 0; i < BLOCK_TEST_SIZE; i++)
 		KUNIT_EXPECT_EQ(test, i == 2, data->written[i]);
-
-	regmap_exit(map);
 }
 
 static void cache_sync_readonly(struct kunit *test)
@@ -754,8 +744,6 @@
 	/* Did that match what we see on the device? */
 	for (i = 0; i < BLOCK_TEST_SIZE; i++)
 		KUNIT_EXPECT_EQ(test, i != 5, data->written[i]);
-
-	regmap_exit(map);
 }
 
 static void cache_sync_patch(struct kunit *test)
@@ -815,8 +803,6 @@
 			break;
 		}
 	}
-
-	regmap_exit(map);
 }
 
 static void cache_drop(struct kunit *test)
@@ -857,8 +843,6 @@
 	for (i = 0; i < BLOCK_TEST_SIZE; i++)
 		KUNIT_EXPECT_EQ(test, data->read[i], i >= 3 && i <= 5);
 	KUNIT_EXPECT_MEMEQ(test, data->vals, rval, sizeof(rval));
-
-	regmap_exit(map);
 }
 
 static void cache_present(struct kunit *test)
@@ -896,8 +880,6 @@
 	/* Now everything should be cached */
 	for (i = 0; i < BLOCK_TEST_SIZE; i++)
 		KUNIT_ASSERT_TRUE(test, regcache_reg_cached(map, i));
-
-	regmap_exit(map);
 }
 
 /* Check that caching the window register works with sync */
@@ -1002,9 +984,9 @@
 				     struct regmap_ram_data **data)
 {
 	u16 *buf;
-	struct regmap *ret;
+	struct regmap *ret = ERR_PTR(-ENOMEM);
 	size_t size = (config->max_register + 1) * config->reg_bits / 8;
-	int i;
+	int i, error;
 	struct reg_default *defaults;
 
 	config->cache_type = test_type->cache_type;
@@ -1020,15 +1002,16 @@
 
 	*data = kzalloc(sizeof(**data), GFP_KERNEL);
 	if (!(*data))
-		return ERR_PTR(-ENOMEM);
+		goto out_free;
 	(*data)->vals = (void *)buf;
 
 	config->num_reg_defaults = config->max_register + 1;
-	defaults = kcalloc(config->num_reg_defaults,
-			   sizeof(struct reg_default),
-			   GFP_KERNEL);
+	defaults = kunit_kcalloc(test,
+				 config->num_reg_defaults,
+				 sizeof(struct reg_default),
+				 GFP_KERNEL);
 	if (!defaults)
-		return ERR_PTR(-ENOMEM);
+		goto out_free;
 	config->reg_defaults = defaults;
 
 	for (i = 0; i < config->num_reg_defaults; i++) {
@@ -1041,7 +1024,8 @@
 			defaults[i].def = be16_to_cpu(buf[i]);
 			break;
 		default:
-			return ERR_PTR(-EINVAL);
+			ret = ERR_PTR(-EINVAL);
+			goto out_free;
 		}
 	}
 
@@ -1053,10 +1037,19 @@
 		config->num_reg_defaults = 0;
 
 	ret = regmap_init_raw_ram(config, *data);
-	if (IS_ERR(ret)) {
-		kfree(buf);
-		kfree(*data);
-	}
+	if (IS_ERR(ret))
+		goto out_free;
+
+	/* This calls regmap_exit() on failure, which frees buf and *data */
+	error = kunit_add_action_or_reset(test, regmap_exit_action, ret);
+	if (error)
+		ret = ERR_PTR(error);
+
+	return ret;
+
+out_free:
+	kfree(buf);
+	kfree(*data);
 
 	return ret;
 }
@@ -1082,8 +1075,6 @@
 		KUNIT_EXPECT_EQ(test, 0, regmap_read(map, i, &rval));
 		KUNIT_EXPECT_EQ(test, config.reg_defaults[i].def, rval);
 	}
-
-	regmap_exit(map);
 }
 
 static void raw_read_defaults(struct kunit *test)
@@ -1105,7 +1096,7 @@
 		return;
 
 	val_len = sizeof(*rval) * (config.max_register + 1);
-	rval = kmalloc(val_len, GFP_KERNEL);
+	rval = kunit_kmalloc(test, val_len, GFP_KERNEL);
 	KUNIT_ASSERT_TRUE(test, rval != NULL);
 	if (!rval)
 		return;
@@ -1120,9 +1111,6 @@
 			KUNIT_EXPECT_EQ(test, def, le16_to_cpu(rval[i]));
 		}
 	}
-	
-	kfree(rval);
-	regmap_exit(map);
 }
 
 static void raw_write_read_single(struct kunit *test)
@@ -1147,8 +1135,6 @@
 	KUNIT_EXPECT_EQ(test, 0, regmap_write(map, 0, val));
 	KUNIT_EXPECT_EQ(test, 0, regmap_read(map, 0, &rval));
 	KUNIT_EXPECT_EQ(test, val, rval);
-
-	regmap_exit(map);
 }
 
 static void raw_write(struct kunit *test)
@@ -1199,8 +1185,6 @@
 
 	/* The values should appear in the "hardware" */
 	KUNIT_EXPECT_MEMEQ(test, &hw_buf[2], val, sizeof(val));
-
-	regmap_exit(map);
 }
 
 static bool reg_zero(struct device *dev, unsigned int reg)
@@ -1259,8 +1243,6 @@
 	/* Make sure we didn't touch the register after the noinc register */
 	KUNIT_EXPECT_EQ(test, 0, regmap_read(map, 1, &val));
 	KUNIT_ASSERT_EQ(test, val_test, val);
-
-	regmap_exit(map);
 }
 
 static void raw_sync(struct kunit *test)
@@ -1337,8 +1319,6 @@
 
 	/* The values should now appear in the "hardware" */
 	KUNIT_EXPECT_MEMEQ(test, &hw_buf[2], &val[0], sizeof(val));
-
-	regmap_exit(map);
 }
 
 static struct kunit_case regmap_test_cases[] = {
--- linux-qcom-6.8.0.orig/drivers/base/regmap/regmap-spi.c
+++ linux-qcom-6.8.0/drivers/base/regmap/regmap-spi.c
@@ -122,8 +122,7 @@
 			return ERR_PTR(-ENOMEM);
 
 		max_msg_size = spi_max_message_size(spi);
-		reg_reserve_size = config->reg_bits / BITS_PER_BYTE
-				 + config->pad_bits / BITS_PER_BYTE;
+		reg_reserve_size = (config->reg_bits + config->pad_bits) / BITS_PER_BYTE;
 		if (max_size + reg_reserve_size > max_msg_size)
 			max_size -= reg_reserve_size;
 
--- linux-qcom-6.8.0.orig/drivers/base/regmap/regmap.c
+++ linux-qcom-6.8.0/drivers/base/regmap/regmap.c
@@ -598,6 +598,17 @@
 }
 EXPORT_SYMBOL_GPL(regmap_attach_dev);
 
+static int dev_get_regmap_match(struct device *dev, void *res, void *data);
+
+static int regmap_detach_dev(struct device *dev, struct regmap *map)
+{
+	if (!dev)
+		return 0;
+
+	return devres_release(dev, dev_get_regmap_release,
+			      dev_get_regmap_match, (void *)map->name);
+}
+
 static enum regmap_endian regmap_get_reg_endian(const struct regmap_bus *bus,
 					const struct regmap_config *config)
 {
@@ -745,6 +756,7 @@
 						   lock_key, lock_name);
 		}
 		map->lock_arg = map;
+		map->lock_key = lock_key;
 	}
 
 	/*
@@ -1050,13 +1062,13 @@
 
 		/* Sanity check */
 		if (range_cfg->range_max < range_cfg->range_min) {
-			dev_err(map->dev, "Invalid range %d: %d < %d\n", i,
+			dev_err(map->dev, "Invalid range %d: %u < %u\n", i,
 				range_cfg->range_max, range_cfg->range_min);
 			goto err_range;
 		}
 
 		if (range_cfg->range_max > map->max_register) {
-			dev_err(map->dev, "Invalid range %d: %d > %d\n", i,
+			dev_err(map->dev, "Invalid range %d: %u > %u\n", i,
 				range_cfg->range_max, map->max_register);
 			goto err_range;
 		}
@@ -1442,6 +1454,7 @@
 {
 	struct regmap_async *async;
 
+	regmap_detach_dev(map->dev, map);
 	regcache_exit(map);
 	regmap_debugfs_exit(map);
 	regmap_range_exit(map);
@@ -2837,6 +2850,43 @@
 EXPORT_SYMBOL_GPL(regmap_read);
 
 /**
+ * regmap_read_bypassed() - Read a value from a single register direct
+ *			    from the device, bypassing the cache
+ *
+ * @map: Register map to read from
+ * @reg: Register to be read from
+ * @val: Pointer to store read value
+ *
+ * A value of zero will be returned on success, a negative errno will
+ * be returned in error cases.
+ */
+int regmap_read_bypassed(struct regmap *map, unsigned int reg, unsigned int *val)
+{
+	int ret;
+	bool bypass, cache_only;
+
+	if (!IS_ALIGNED(reg, map->reg_stride))
+		return -EINVAL;
+
+	map->lock(map->lock_arg);
+
+	bypass = map->cache_bypass;
+	cache_only = map->cache_only;
+	map->cache_bypass = true;
+	map->cache_only = false;
+
+	ret = _regmap_read(map, reg, val);
+
+	map->cache_bypass = bypass;
+	map->cache_only = cache_only;
+
+	map->unlock(map->lock_arg);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(regmap_read_bypassed);
+
+/**
  * regmap_raw_read() - Read raw data from the device
  *
  * @map: Register map to read from
--- linux-qcom-6.8.0.orig/drivers/base/topology.c
+++ linux-qcom-6.8.0/drivers/base/topology.c
@@ -27,9 +27,17 @@
 			   loff_t off, size_t count)				\
 {										\
 	struct device *dev = kobj_to_dev(kobj);                                 \
+	cpumask_var_t mask;							\
+	ssize_t n;								\
 										\
-	return cpumap_print_bitmask_to_buf(buf, topology_##mask(dev->id),	\
-					   off, count);                         \
+	if (!alloc_cpumask_var(&mask, GFP_KERNEL))				\
+		return -ENOMEM;							\
+										\
+	cpumask_copy(mask, topology_##mask(dev->id));				\
+	n = cpumap_print_bitmask_to_buf(buf, mask, off, count);			\
+	free_cpumask_var(mask);							\
+										\
+	return n;								\
 }										\
 										\
 static ssize_t name##_list_read(struct file *file, struct kobject *kobj,	\
@@ -37,9 +45,17 @@
 				loff_t off, size_t count)			\
 {										\
 	struct device *dev = kobj_to_dev(kobj);					\
+	cpumask_var_t mask;							\
+	ssize_t n;								\
+										\
+	if (!alloc_cpumask_var(&mask, GFP_KERNEL))				\
+		return -ENOMEM;							\
+										\
+	cpumask_copy(mask, topology_##mask(dev->id));				\
+	n = cpumap_print_list_to_buf(buf, mask, off, count);			\
+	free_cpumask_var(mask);							\
 										\
-	return cpumap_print_list_to_buf(buf, topology_##mask(dev->id),		\
-					off, count);				\
+	return n;								\
 }
 
 define_id_show_func(physical_package_id, "%d");
--- linux-qcom-6.8.0.orig/drivers/base/trace.h
+++ linux-qcom-6.8.0/drivers/base/trace.h
@@ -24,18 +24,18 @@
 		__field(struct device *, dev)
 		__field(const char *, op)
 		__field(void *, node)
-		__field(const char *, name)
+		__string(name, name)
 		__field(size_t, size)
 	),
 	TP_fast_assign(
 		__assign_str(devname, dev_name(dev));
 		__entry->op = op;
 		__entry->node = node;
-		__entry->name = name;
+		__assign_str(name, name);
 		__entry->size = size;
 	),
 	TP_printk("%s %3s %p %s (%zu bytes)", __get_str(devname),
-		  __entry->op, __entry->node, __entry->name, __entry->size)
+		  __entry->op, __entry->node, __get_str(name), __entry->size)
 );
 
 DEFINE_EVENT(devres, devres_log,
--- linux-qcom-6.8.0.orig/drivers/block/aoe/aoecmd.c
+++ linux-qcom-6.8.0/drivers/block/aoe/aoecmd.c
@@ -361,6 +361,7 @@
 	}
 
 	ah->cmdstat = ATA_CMD_PIO_READ | writebit | extbit;
+	dev_hold(t->ifp->nd);
 	skb->dev = t->ifp->nd;
 }
 
@@ -401,6 +402,8 @@
 		__skb_queue_head_init(&queue);
 		__skb_queue_tail(&queue, skb);
 		aoenet_xmit(&queue);
+	} else {
+		dev_put(f->t->ifp->nd);
 	}
 	return 1;
 }
@@ -419,13 +422,16 @@
 	rcu_read_lock();
 	for_each_netdev_rcu(&init_net, ifp) {
 		dev_hold(ifp);
-		if (!is_aoe_netif(ifp))
-			goto cont;
+		if (!is_aoe_netif(ifp)) {
+			dev_put(ifp);
+			continue;
+		}
 
 		skb = new_skb(sizeof *h + sizeof *ch);
 		if (skb == NULL) {
 			printk(KERN_INFO "aoe: skb alloc failure\n");
-			goto cont;
+			dev_put(ifp);
+			continue;
 		}
 		skb_put(skb, sizeof *h + sizeof *ch);
 		skb->dev = ifp;
@@ -440,9 +446,6 @@
 		h->major = cpu_to_be16(aoemajor);
 		h->minor = aoeminor;
 		h->cmd = AOECMD_CFG;
-
-cont:
-		dev_put(ifp);
 	}
 	rcu_read_unlock();
 }
@@ -483,10 +486,13 @@
 	memcpy(h->dst, t->addr, sizeof h->dst);
 	memcpy(h->src, t->ifp->nd->dev_addr, sizeof h->src);
 
+	dev_hold(t->ifp->nd);
 	skb->dev = t->ifp->nd;
 	skb = skb_clone(skb, GFP_ATOMIC);
-	if (skb == NULL)
+	if (skb == NULL) {
+		dev_put(t->ifp->nd);
 		return;
+	}
 	f->sent = ktime_get();
 	__skb_queue_head_init(&queue);
 	__skb_queue_tail(&queue, skb);
@@ -617,6 +623,8 @@
 		__skb_queue_head_init(&queue);
 		__skb_queue_tail(&queue, skb);
 		aoenet_xmit(&queue);
+	} else {
+		dev_put(f->t->ifp->nd);
 	}
 }
 
@@ -1395,6 +1403,7 @@
 	ah->cmdstat = ATA_CMD_ID_ATA;
 	ah->lba3 = 0xa0;
 
+	dev_hold(t->ifp->nd);
 	skb->dev = t->ifp->nd;
 
 	d->rttavg = RTTAVG_INIT;
@@ -1404,6 +1413,8 @@
 	skb = skb_clone(skb, GFP_ATOMIC);
 	if (skb)
 		f->sent = ktime_get();
+	else
+		dev_put(t->ifp->nd);
 
 	return skb;
 }
--- linux-qcom-6.8.0.orig/drivers/block/aoe/aoenet.c
+++ linux-qcom-6.8.0/drivers/block/aoe/aoenet.c
@@ -63,6 +63,7 @@
 			pr_warn("aoe: packet could not be sent on %s.  %s\n",
 				ifp ? ifp->name : "netif",
 				"consider increasing tx_queue_len");
+		dev_put(ifp);
 		spin_lock_irq(&txlock);
 	}
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/block/brd.c
+++ linux-qcom-6.8.0/drivers/block/brd.c
@@ -310,8 +310,40 @@
  * (should share code eventually).
  */
 static LIST_HEAD(brd_devices);
+static DEFINE_MUTEX(brd_devices_mutex);
 static struct dentry *brd_debugfs_dir;
 
+static struct brd_device *brd_find_or_alloc_device(int i)
+{
+	struct brd_device *brd;
+
+	mutex_lock(&brd_devices_mutex);
+	list_for_each_entry(brd, &brd_devices, brd_list) {
+		if (brd->brd_number == i) {
+			mutex_unlock(&brd_devices_mutex);
+			return ERR_PTR(-EEXIST);
+		}
+	}
+
+	brd = kzalloc(sizeof(*brd), GFP_KERNEL);
+	if (!brd) {
+		mutex_unlock(&brd_devices_mutex);
+		return ERR_PTR(-ENOMEM);
+	}
+	brd->brd_number	= i;
+	list_add_tail(&brd->brd_list, &brd_devices);
+	mutex_unlock(&brd_devices_mutex);
+	return brd;
+}
+
+static void brd_free_device(struct brd_device *brd)
+{
+	mutex_lock(&brd_devices_mutex);
+	list_del(&brd->brd_list);
+	mutex_unlock(&brd_devices_mutex);
+	kfree(brd);
+}
+
 static int brd_alloc(int i)
 {
 	struct brd_device *brd;
@@ -319,14 +351,9 @@
 	char buf[DISK_NAME_LEN];
 	int err = -ENOMEM;
 
-	list_for_each_entry(brd, &brd_devices, brd_list)
-		if (brd->brd_number == i)
-			return -EEXIST;
-	brd = kzalloc(sizeof(*brd), GFP_KERNEL);
-	if (!brd)
-		return -ENOMEM;
-	brd->brd_number		= i;
-	list_add_tail(&brd->brd_list, &brd_devices);
+	brd = brd_find_or_alloc_device(i);
+	if (IS_ERR(brd))
+		return PTR_ERR(brd);
 
 	xa_init(&brd->brd_pages);
 
@@ -369,8 +396,7 @@
 out_cleanup_disk:
 	put_disk(disk);
 out_free_dev:
-	list_del(&brd->brd_list);
-	kfree(brd);
+	brd_free_device(brd);
 	return err;
 }
 
@@ -389,8 +415,7 @@
 		del_gendisk(brd->brd_disk);
 		put_disk(brd->brd_disk);
 		brd_free_pages(brd);
-		list_del(&brd->brd_list);
-		kfree(brd);
+		brd_free_device(brd);
 	}
 }
 
@@ -417,16 +442,6 @@
 {
 	int err, i;
 
-	brd_check_and_reset_par();
-
-	brd_debugfs_dir = debugfs_create_dir("ramdisk_pages", NULL);
-
-	for (i = 0; i < rd_nr; i++) {
-		err = brd_alloc(i);
-		if (err)
-			goto out_free;
-	}
-
 	/*
 	 * brd module now has a feature to instantiate underlying device
 	 * structure on-demand, provided that there is an access dev node.
@@ -442,11 +457,18 @@
 	 *	dynamically.
 	 */
 
+	brd_check_and_reset_par();
+
+	brd_debugfs_dir = debugfs_create_dir("ramdisk_pages", NULL);
+
 	if (__register_blkdev(RAMDISK_MAJOR, "ramdisk", brd_probe)) {
 		err = -EIO;
 		goto out_free;
 	}
 
+	for (i = 0; i < rd_nr; i++)
+		brd_alloc(i);
+
 	pr_info("brd: module loaded\n");
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/block/drbd/drbd_main.c
+++ linux-qcom-6.8.0/drivers/block/drbd/drbd_main.c
@@ -1550,7 +1550,7 @@
 	 * put_page(); and would cause either a VM_BUG directly, or
 	 * __page_cache_release a page that would actually still be referenced
 	 * by someone, leading to some obscure delayed Oops somewhere else. */
-	if (!drbd_disable_sendpage && sendpage_ok(page))
+	if (!drbd_disable_sendpage && sendpages_ok(page, len, offset))
 		msg.msg_flags |= MSG_NOSIGNAL | MSG_SPLICE_PAGES;
 
 	drbd_update_congested(peer_device->connection);
@@ -3392,10 +3392,12 @@
 void drbd_uuid_set_bm(struct drbd_device *device, u64 val) __must_hold(local)
 {
 	unsigned long flags;
-	if (device->ldev->md.uuid[UI_BITMAP] == 0 && val == 0)
+	spin_lock_irqsave(&device->ldev->md.uuid_lock, flags);
+	if (device->ldev->md.uuid[UI_BITMAP] == 0 && val == 0) {
+		spin_unlock_irqrestore(&device->ldev->md.uuid_lock, flags);
 		return;
+	}
 
-	spin_lock_irqsave(&device->ldev->md.uuid_lock, flags);
 	if (val == 0) {
 		drbd_uuid_move_history(device);
 		device->ldev->md.uuid[UI_HISTORY_START] = device->ldev->md.uuid[UI_BITMAP];
--- linux-qcom-6.8.0.orig/drivers/block/drbd/drbd_state.c
+++ linux-qcom-6.8.0/drivers/block/drbd/drbd_state.c
@@ -876,7 +876,7 @@
 		  ns.disk == D_OUTDATED)
 		rv = SS_CONNECTED_OUTDATES;
 
-	else if ((ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) &&
+	else if (nc && (ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) &&
 		 (nc->verify_alg[0] == 0))
 		rv = SS_NO_VERIFY_ALG;
 
--- linux-qcom-6.8.0.orig/drivers/block/loop.c
+++ linux-qcom-6.8.0/drivers/block/loop.c
@@ -211,13 +211,10 @@
 	if (lo->lo_state == Lo_bound)
 		blk_mq_freeze_queue(lo->lo_queue);
 	lo->use_dio = use_dio;
-	if (use_dio) {
-		blk_queue_flag_clear(QUEUE_FLAG_NOMERGES, lo->lo_queue);
+	if (use_dio)
 		lo->lo_flags |= LO_FLAGS_DIRECT_IO;
-	} else {
-		blk_queue_flag_set(QUEUE_FLAG_NOMERGES, lo->lo_queue);
+	else
 		lo->lo_flags &= ~LO_FLAGS_DIRECT_IO;
-	}
 	if (lo->lo_state == Lo_bound)
 		blk_mq_unfreeze_queue(lo->lo_queue);
 }
@@ -2036,14 +2033,6 @@
 	blk_queue_max_hw_sectors(lo->lo_queue, 2560u);
 
 	/*
-	 * By default, we do buffer IO, so it doesn't make sense to enable
-	 * merge because the I/O submitted to backing file is handled page by
-	 * page. For directio mode, merge does help to dispatch bigger request
-	 * to underlayer disk. We will enable merge once directio is enabled.
-	 */
-	blk_queue_flag_set(QUEUE_FLAG_NOMERGES, lo->lo_queue);
-
-	/*
 	 * Disable partition scanning by default. The in-kernel partition
 	 * scanning can be requested individually per-device during its
 	 * setup. Userspace can always add and remove partitions from all
--- linux-qcom-6.8.0.orig/drivers/block/nbd.c
+++ linux-qcom-6.8.0/drivers/block/nbd.c
@@ -181,6 +181,17 @@
 {
 	struct request *req = blk_mq_rq_from_pdu(cmd);
 
+	lockdep_assert_held(&cmd->lock);
+
+	/*
+	 * Clear INFLIGHT flag so that this cmd won't be completed in
+	 * normal completion path
+	 *
+	 * INFLIGHT flag will be set when the cmd is queued to nbd next
+	 * time.
+	 */
+	__clear_bit(NBD_CMD_INFLIGHT, &cmd->flags);
+
 	if (!test_and_set_bit(NBD_CMD_REQUEUED, &cmd->flags))
 		blk_mq_requeue_request(req, true);
 }
@@ -459,8 +470,8 @@
 					nbd_mark_nsock_dead(nbd, nsock, 1);
 				mutex_unlock(&nsock->tx_lock);
 			}
-			mutex_unlock(&cmd->lock);
 			nbd_requeue_cmd(cmd);
+			mutex_unlock(&cmd->lock);
 			nbd_config_put(nbd);
 			return BLK_EH_DONE;
 		}
@@ -567,7 +578,10 @@
 	return result == -ERESTARTSYS || result == -EINTR;
 }
 
-/* always call with the tx_lock held */
+/*
+ * Returns BLK_STS_RESOURCE if the caller should retry after a delay. Returns
+ * -EAGAIN if the caller should requeue @cmd. Returns -EIO if sending failed.
+ */
 static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
 {
 	struct request *req = blk_mq_rq_from_pdu(cmd);
@@ -584,6 +598,9 @@
 	u32 nbd_cmd_flags = 0;
 	int sent = nsock->sent, skip = 0;
 
+	lockdep_assert_held(&cmd->lock);
+	lockdep_assert_held(&nsock->tx_lock);
+
 	iov_iter_kvec(&from, ITER_SOURCE, &iov, 1, sizeof(request));
 
 	type = req_to_nbd_cmd_type(req);
@@ -648,7 +665,7 @@
 				nsock->sent = sent;
 			}
 			set_bit(NBD_CMD_REQUEUED, &cmd->flags);
-			return BLK_STS_RESOURCE;
+			return (__force int)BLK_STS_RESOURCE;
 		}
 		dev_err_ratelimited(disk_to_dev(nbd->disk),
 			"Send control failed (result %d)\n", result);
@@ -689,7 +706,7 @@
 					nsock->pending = req;
 					nsock->sent = sent;
 					set_bit(NBD_CMD_REQUEUED, &cmd->flags);
-					return BLK_STS_RESOURCE;
+					return (__force int)BLK_STS_RESOURCE;
 				}
 				dev_err(disk_to_dev(nbd->disk),
 					"Send data failed (result %d)\n",
@@ -986,7 +1003,7 @@
 	return !test_bit(NBD_RT_DISCONNECTED, &config->runtime_flags);
 }
 
-static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+static blk_status_t nbd_handle_cmd(struct nbd_cmd *cmd, int index)
 {
 	struct request *req = blk_mq_rq_from_pdu(cmd);
 	struct nbd_device *nbd = cmd->nbd;
@@ -994,18 +1011,20 @@
 	struct nbd_sock *nsock;
 	int ret;
 
+	lockdep_assert_held(&cmd->lock);
+
 	config = nbd_get_config_unlocked(nbd);
 	if (!config) {
 		dev_err_ratelimited(disk_to_dev(nbd->disk),
 				    "Socks array is empty\n");
-		return -EINVAL;
+		return BLK_STS_IOERR;
 	}
 
 	if (index >= config->num_connections) {
 		dev_err_ratelimited(disk_to_dev(nbd->disk),
 				    "Attempted send on invalid socket\n");
 		nbd_config_put(nbd);
-		return -EINVAL;
+		return BLK_STS_IOERR;
 	}
 	cmd->status = BLK_STS_OK;
 again:
@@ -1028,7 +1047,7 @@
 			 */
 			sock_shutdown(nbd);
 			nbd_config_put(nbd);
-			return -EIO;
+			return BLK_STS_IOERR;
 		}
 		goto again;
 	}
@@ -1041,7 +1060,7 @@
 	blk_mq_start_request(req);
 	if (unlikely(nsock->pending && nsock->pending != req)) {
 		nbd_requeue_cmd(cmd);
-		ret = 0;
+		ret = BLK_STS_OK;
 		goto out;
 	}
 	/*
@@ -1060,19 +1079,19 @@
 				    "Request send failed, requeueing\n");
 		nbd_mark_nsock_dead(nbd, nsock, 1);
 		nbd_requeue_cmd(cmd);
-		ret = 0;
+		ret = BLK_STS_OK;
 	}
 out:
 	mutex_unlock(&nsock->tx_lock);
 	nbd_config_put(nbd);
-	return ret;
+	return ret < 0 ? BLK_STS_IOERR : (__force blk_status_t)ret;
 }
 
 static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
 			const struct blk_mq_queue_data *bd)
 {
 	struct nbd_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
-	int ret;
+	blk_status_t ret;
 
 	/*
 	 * Since we look at the bio's to send the request over the network we
@@ -1092,10 +1111,6 @@
 	 * appropriate.
 	 */
 	ret = nbd_handle_cmd(cmd, hctx->queue_num);
-	if (ret < 0)
-		ret = BLK_STS_IOERR;
-	else if (!ret)
-		ret = BLK_STS_OK;
 	mutex_unlock(&cmd->lock);
 
 	return ret;
@@ -2433,6 +2448,12 @@
 	}
 
 	dev_list = nla_nest_start_noflag(reply, NBD_ATTR_DEVICE_LIST);
+	if (!dev_list) {
+		nlmsg_free(reply);
+		ret = -EMSGSIZE;
+		goto out;
+	}
+
 	if (index == -1) {
 		ret = idr_for_each(&nbd_index_idr, &status_cb, reply);
 		if (ret) {
--- linux-qcom-6.8.0.orig/drivers/block/null_blk/main.c
+++ linux-qcom-6.8.0/drivers/block/null_blk/main.c
@@ -392,13 +392,25 @@
 static int nullb_apply_submit_queues(struct nullb_device *dev,
 				     unsigned int submit_queues)
 {
-	return nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues);
+	int ret;
+
+	mutex_lock(&lock);
+	ret = nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues);
+	mutex_unlock(&lock);
+
+	return ret;
 }
 
 static int nullb_apply_poll_queues(struct nullb_device *dev,
 				   unsigned int poll_queues)
 {
-	return nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues);
+	int ret;
+
+	mutex_lock(&lock);
+	ret = nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues);
+	mutex_unlock(&lock);
+
+	return ret;
 }
 
 NULLB_DEVICE_ATTR(size, ulong, NULL);
@@ -444,28 +456,32 @@
 	if (ret < 0)
 		return ret;
 
+	ret = count;
+	mutex_lock(&lock);
 	if (!dev->power && newp) {
 		if (test_and_set_bit(NULLB_DEV_FL_UP, &dev->flags))
-			return count;
+			goto out;
+
 		ret = null_add_dev(dev);
 		if (ret) {
 			clear_bit(NULLB_DEV_FL_UP, &dev->flags);
-			return ret;
+			goto out;
 		}
 
 		set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
 		dev->power = newp;
+		ret = count;
 	} else if (dev->power && !newp) {
 		if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) {
-			mutex_lock(&lock);
 			dev->power = newp;
 			null_del_dev(dev->nullb);
-			mutex_unlock(&lock);
 		}
 		clear_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
 	}
 
-	return count;
+out:
+	mutex_unlock(&lock);
+	return ret;
 }
 
 CONFIGFS_ATTR(nullb_device_, power);
@@ -2033,8 +2049,8 @@
 		return -EINVAL;
 	}
 
-	dev->blocksize = round_down(dev->blocksize, 512);
-	dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096);
+	if (blk_validate_block_size(dev->blocksize))
+		return -EINVAL;
 
 	if (dev->queue_mode == NULL_Q_MQ && dev->use_per_node_hctx) {
 		if (dev->submit_queues != nr_online_nodes)
@@ -2173,15 +2189,12 @@
 	nullb->q->queuedata = nullb;
 	blk_queue_flag_set(QUEUE_FLAG_NONROT, nullb->q);
 
-	mutex_lock(&lock);
 	rv = ida_alloc(&nullb_indexes, GFP_KERNEL);
-	if (rv < 0) {
-		mutex_unlock(&lock);
+	if (rv < 0)
 		goto out_cleanup_zone;
-	}
+
 	nullb->index = rv;
 	dev->index = rv;
-	mutex_unlock(&lock);
 
 	blk_queue_logical_block_size(nullb->q, dev->blocksize);
 	blk_queue_physical_block_size(nullb->q, dev->blocksize);
@@ -2205,9 +2218,7 @@
 	if (rv)
 		goto out_ida_free;
 
-	mutex_lock(&lock);
 	list_add_tail(&nullb->list, &nullb_list);
-	mutex_unlock(&lock);
 
 	pr_info("disk %s created\n", nullb->disk_name);
 
@@ -2256,7 +2267,9 @@
 	if (!dev)
 		return -ENOMEM;
 
+	mutex_lock(&lock);
 	ret = null_add_dev(dev);
+	mutex_unlock(&lock);
 	if (ret) {
 		null_free_dev(dev);
 		return ret;
@@ -2372,10 +2385,13 @@
 
 	if (g_queue_mode == NULL_Q_MQ && shared_tags)
 		blk_mq_free_tag_set(&tag_set);
+
+	mutex_destroy(&lock);
 }
 
 module_init(null_init);
 module_exit(null_exit);
 
 MODULE_AUTHOR("Jens Axboe <axboe@kernel.dk>");
+MODULE_DESCRIPTION("multi queue aware block test driver");
 MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/block/null_blk/zoned.c
+++ linux-qcom-6.8.0/drivers/block/null_blk/zoned.c
@@ -83,6 +83,17 @@
 		return -EINVAL;
 	}
 
+	/*
+	 * If a smaller zone capacity was requested, do not allow a smaller last
+	 * zone at the same time as such zone configuration does not correspond
+	 * to any real zoned device.
+	 */
+	if (dev->zone_capacity != dev->zone_size &&
+	    dev->size & (dev->zone_size - 1)) {
+		pr_err("A smaller last zone is not allowed with zone capacity smaller than zone size.\n");
+		return -EINVAL;
+	}
+
 	zone_capacity_sects = mb_to_sects(dev->zone_capacity);
 	dev_capacity_sects = mb_to_sects(dev->size);
 	dev->zone_size_sects = mb_to_sects(dev->zone_size);
@@ -112,7 +123,7 @@
 	if (dev->zone_max_active && dev->zone_max_open > dev->zone_max_active) {
 		dev->zone_max_open = dev->zone_max_active;
 		pr_info("changed the maximum number of open zones to %u\n",
-			dev->nr_zones);
+			dev->zone_max_open);
 	} else if (dev->zone_max_open >= dev->nr_zones - dev->zone_nr_conv) {
 		dev->zone_max_open = 0;
 		pr_info("zone_max_open limit disabled, limit >= zone count\n");
--- linux-qcom-6.8.0.orig/drivers/block/rbd.c
+++ linux-qcom-6.8.0/drivers/block/rbd.c
@@ -89,7 +89,7 @@
 #define RBD_MINORS_PER_MAJOR		256
 #define RBD_SINGLE_MAJOR_PART_SHIFT	4
 
-#define RBD_MAX_PARENT_CHAIN_LEN	16
+#define RBD_MAX_PARENT_CHAIN_LEN	128
 
 #define RBD_SNAP_DEV_NAME_PREFIX	"snap_"
 #define RBD_MAX_SNAP_NAME_LEN	\
@@ -362,7 +362,7 @@
 enum rbd_lock_state {
 	RBD_LOCK_STATE_UNLOCKED,
 	RBD_LOCK_STATE_LOCKED,
-	RBD_LOCK_STATE_RELEASING,
+	RBD_LOCK_STATE_QUIESCING,
 };
 
 /* WatchNotify::ClientId */
@@ -422,7 +422,7 @@
 	struct list_head	running_list;
 	struct completion	acquire_wait;
 	int			acquire_err;
-	struct completion	releasing_wait;
+	struct completion	quiescing_wait;
 
 	spinlock_t		object_map_lock;
 	u8			*object_map;
@@ -525,7 +525,7 @@
 	lockdep_assert_held(&rbd_dev->lock_rwsem);
 
 	return rbd_dev->lock_state == RBD_LOCK_STATE_LOCKED ||
-	       rbd_dev->lock_state == RBD_LOCK_STATE_RELEASING;
+	       rbd_dev->lock_state == RBD_LOCK_STATE_QUIESCING;
 }
 
 static bool rbd_is_lock_owner(struct rbd_device *rbd_dev)
@@ -3457,13 +3457,14 @@
 	lockdep_assert_held(&rbd_dev->lock_rwsem);
 	spin_lock(&rbd_dev->lock_lists_lock);
 	if (!list_empty(&img_req->lock_item)) {
+		rbd_assert(!list_empty(&rbd_dev->running_list));
 		list_del_init(&img_req->lock_item);
-		need_wakeup = (rbd_dev->lock_state == RBD_LOCK_STATE_RELEASING &&
+		need_wakeup = (rbd_dev->lock_state == RBD_LOCK_STATE_QUIESCING &&
 			       list_empty(&rbd_dev->running_list));
 	}
 	spin_unlock(&rbd_dev->lock_lists_lock);
 	if (need_wakeup)
-		complete(&rbd_dev->releasing_wait);
+		complete(&rbd_dev->quiescing_wait);
 }
 
 static int rbd_img_exclusive_lock(struct rbd_img_request *img_req)
@@ -3476,11 +3477,6 @@
 	if (rbd_lock_add_request(img_req))
 		return 1;
 
-	if (rbd_dev->opts->exclusive) {
-		WARN_ON(1); /* lock got released? */
-		return -EROFS;
-	}
-
 	/*
 	 * Note the use of mod_delayed_work() in rbd_acquire_lock()
 	 * and cancel_delayed_work() in wake_lock_waiters().
@@ -4181,16 +4177,16 @@
 	/*
 	 * Ensure that all in-flight IO is flushed.
 	 */
-	rbd_dev->lock_state = RBD_LOCK_STATE_RELEASING;
-	rbd_assert(!completion_done(&rbd_dev->releasing_wait));
+	rbd_dev->lock_state = RBD_LOCK_STATE_QUIESCING;
+	rbd_assert(!completion_done(&rbd_dev->quiescing_wait));
 	if (list_empty(&rbd_dev->running_list))
 		return true;
 
 	up_write(&rbd_dev->lock_rwsem);
-	wait_for_completion(&rbd_dev->releasing_wait);
+	wait_for_completion(&rbd_dev->quiescing_wait);
 
 	down_write(&rbd_dev->lock_rwsem);
-	if (rbd_dev->lock_state != RBD_LOCK_STATE_RELEASING)
+	if (rbd_dev->lock_state != RBD_LOCK_STATE_QUIESCING)
 		return false;
 
 	rbd_assert(list_empty(&rbd_dev->running_list));
@@ -4601,6 +4597,10 @@
 			rbd_warn(rbd_dev, "failed to update lock cookie: %d",
 				 ret);
 
+		if (rbd_dev->opts->exclusive)
+			rbd_warn(rbd_dev,
+			     "temporarily releasing lock on exclusive mapping");
+
 		/*
 		 * Lock cookie cannot be updated on older OSDs, so do
 		 * a manual release and queue an acquire.
@@ -5382,7 +5382,7 @@
 	INIT_LIST_HEAD(&rbd_dev->acquiring_list);
 	INIT_LIST_HEAD(&rbd_dev->running_list);
 	init_completion(&rbd_dev->acquire_wait);
-	init_completion(&rbd_dev->releasing_wait);
+	init_completion(&rbd_dev->quiescing_wait);
 
 	spin_lock_init(&rbd_dev->object_map_lock);
 
@@ -6588,11 +6588,6 @@
 	if (ret)
 		return ret;
 
-	/*
-	 * The lock may have been released by now, unless automatic lock
-	 * transitions are disabled.
-	 */
-	rbd_assert(!rbd_dev->opts->exclusive || rbd_is_lock_owner(rbd_dev));
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/block/ublk_drv.c
+++ linux-qcom-6.8.0/drivers/block/ublk_drv.c
@@ -68,9 +68,6 @@
 	struct llist_node node;
 
 	struct kref ref;
-	__u64 sector;
-	__u32 operation;
-	__u32 nr_zones;
 };
 
 struct ublk_uring_cmd_pdu {
@@ -211,6 +208,33 @@
 
 #ifdef CONFIG_BLK_DEV_ZONED
 
+struct ublk_zoned_report_desc {
+	__u64 sector;
+	__u32 operation;
+	__u32 nr_zones;
+};
+
+static DEFINE_XARRAY(ublk_zoned_report_descs);
+
+static int ublk_zoned_insert_report_desc(const struct request *req,
+		struct ublk_zoned_report_desc *desc)
+{
+	return xa_insert(&ublk_zoned_report_descs, (unsigned long)req,
+			    desc, GFP_KERNEL);
+}
+
+static struct ublk_zoned_report_desc *ublk_zoned_erase_report_desc(
+		const struct request *req)
+{
+	return xa_erase(&ublk_zoned_report_descs, (unsigned long)req);
+}
+
+static struct ublk_zoned_report_desc *ublk_zoned_get_report_desc(
+		const struct request *req)
+{
+	return xa_load(&ublk_zoned_report_descs, (unsigned long)req);
+}
+
 static int ublk_get_nr_zones(const struct ublk_device *ub)
 {
 	const struct ublk_param_basic *p = &ub->params.basic;
@@ -317,7 +341,7 @@
 		unsigned int zones_in_request =
 			min_t(unsigned int, remaining_zones, max_zones_per_request);
 		struct request *req;
-		struct ublk_rq_data *pdu;
+		struct ublk_zoned_report_desc desc;
 		blk_status_t status;
 
 		memset(buffer, 0, buffer_length);
@@ -328,20 +352,23 @@
 			goto out;
 		}
 
-		pdu = blk_mq_rq_to_pdu(req);
-		pdu->operation = UBLK_IO_OP_REPORT_ZONES;
-		pdu->sector = sector;
-		pdu->nr_zones = zones_in_request;
+		desc.operation = UBLK_IO_OP_REPORT_ZONES;
+		desc.sector = sector;
+		desc.nr_zones = zones_in_request;
+		ret = ublk_zoned_insert_report_desc(req, &desc);
+		if (ret)
+			goto free_req;
 
 		ret = blk_rq_map_kern(disk->queue, req, buffer, buffer_length,
 					GFP_KERNEL);
-		if (ret) {
-			blk_mq_free_request(req);
-			goto out;
-		}
+		if (ret)
+			goto erase_desc;
 
 		status = blk_execute_rq(req, 0);
 		ret = blk_status_to_errno(status);
+erase_desc:
+		ublk_zoned_erase_report_desc(req);
+free_req:
 		blk_mq_free_request(req);
 		if (ret)
 			goto out;
@@ -375,7 +402,7 @@
 {
 	struct ublksrv_io_desc *iod = ublk_get_iod(ubq, req->tag);
 	struct ublk_io *io = &ubq->ios[req->tag];
-	struct ublk_rq_data *pdu = blk_mq_rq_to_pdu(req);
+	struct ublk_zoned_report_desc *desc;
 	u32 ublk_op;
 
 	switch (req_op(req)) {
@@ -398,12 +425,15 @@
 		ublk_op = UBLK_IO_OP_ZONE_RESET_ALL;
 		break;
 	case REQ_OP_DRV_IN:
-		ublk_op = pdu->operation;
+		desc = ublk_zoned_get_report_desc(req);
+		if (!desc)
+			return BLK_STS_IOERR;
+		ublk_op = desc->operation;
 		switch (ublk_op) {
 		case UBLK_IO_OP_REPORT_ZONES:
 			iod->op_flags = ublk_op | ublk_req_build_flags(req);
-			iod->nr_zones = pdu->nr_zones;
-			iod->start_sector = pdu->sector;
+			iod->nr_zones = desc->nr_zones;
+			iod->start_sector = desc->sector;
 			return BLK_STS_OK;
 		default:
 			return BLK_STS_IOERR;
@@ -680,12 +710,21 @@
 	return ublk_get_queue(ub, q_id)->io_cmd_buf;
 }
 
+static inline int __ublk_queue_cmd_buf_size(int depth)
+{
+	return round_up(depth * sizeof(struct ublksrv_io_desc), PAGE_SIZE);
+}
+
 static inline int ublk_queue_cmd_buf_size(struct ublk_device *ub, int q_id)
 {
 	struct ublk_queue *ubq = ublk_get_queue(ub, q_id);
 
-	return round_up(ubq->q_depth * sizeof(struct ublksrv_io_desc),
-			PAGE_SIZE);
+	return __ublk_queue_cmd_buf_size(ubq->q_depth);
+}
+
+static int ublk_max_cmd_buf_size(void)
+{
+	return __ublk_queue_cmd_buf_size(UBLK_MAX_QUEUE_DEPTH);
 }
 
 static inline bool ublk_queue_can_use_recovery_reissue(
@@ -1338,7 +1377,7 @@
 {
 	struct ublk_device *ub = filp->private_data;
 	size_t sz = vma->vm_end - vma->vm_start;
-	unsigned max_sz = UBLK_MAX_QUEUE_DEPTH * sizeof(struct ublksrv_io_desc);
+	unsigned max_sz = ublk_max_cmd_buf_size();
 	unsigned long pfn, end, phys_off = vma->vm_pgoff << PAGE_SHIFT;
 	int q_id, ret = 0;
 
@@ -1606,6 +1645,21 @@
 	blk_mq_kick_requeue_list(ub->ub_disk->queue);
 }
 
+static struct gendisk *ublk_detach_disk(struct ublk_device *ub)
+{
+	struct gendisk *disk;
+
+	/* Sync with ublk_abort_queue() by holding the lock */
+	spin_lock(&ub->lock);
+	disk = ub->ub_disk;
+	ub->dev_info.state = UBLK_S_DEV_DEAD;
+	ub->dev_info.ublksrv_pid = -1;
+	ub->ub_disk = NULL;
+	spin_unlock(&ub->lock);
+
+	return disk;
+}
+
 static void ublk_stop_dev(struct ublk_device *ub)
 {
 	struct gendisk *disk;
@@ -1619,14 +1673,7 @@
 		ublk_unquiesce_dev(ub);
 	}
 	del_gendisk(ub->ub_disk);
-
-	/* Sync with ublk_abort_queue() by holding the lock */
-	spin_lock(&ub->lock);
-	disk = ub->ub_disk;
-	ub->dev_info.state = UBLK_S_DEV_DEAD;
-	ub->dev_info.ublksrv_pid = -1;
-	ub->ub_disk = NULL;
-	spin_unlock(&ub->lock);
+	disk = ublk_detach_disk(ub);
 	put_disk(disk);
  unlock:
 	mutex_unlock(&ub->mutex);
@@ -2259,7 +2306,7 @@
 
 out_put_cdev:
 	if (ret) {
-		ub->dev_info.state = UBLK_S_DEV_DEAD;
+		ublk_detach_disk(ub);
 		ublk_put_device(ub);
 	}
 out_put_disk:
@@ -2354,10 +2401,19 @@
 	 * TODO: provide forward progress for RECOVERY handler, so that
 	 * unprivileged device can benefit from it
 	 */
-	if (info.flags & UBLK_F_UNPRIVILEGED_DEV)
+	if (info.flags & UBLK_F_UNPRIVILEGED_DEV) {
 		info.flags &= ~(UBLK_F_USER_RECOVERY_REISSUE |
 				UBLK_F_USER_RECOVERY);
 
+		/*
+		 * For USER_COPY, we depends on userspace to fill request
+		 * buffer by pwrite() to ublk char device, which can't be
+		 * used for unprivileged device
+		 */
+		if (info.flags & UBLK_F_USER_COPY)
+			return -EINVAL;
+	}
+
 	/* the created device is always owned by current user */
 	ublk_store_owner_uid_gid(&info.owner_uid, &info.owner_gid);
 
@@ -2666,6 +2722,8 @@
 	mutex_lock(&ub->mutex);
 	if (!ublk_can_use_recovery(ub))
 		goto out_unlock;
+	if (!ub->nr_queues_ready)
+		goto out_unlock;
 	/*
 	 * START_RECOVERY is only allowd after:
 	 *
@@ -2925,7 +2983,7 @@
 		ret = ublk_ctrl_end_recovery(ub, cmd);
 		break;
 	default:
-		ret = -ENOTSUPP;
+		ret = -EOPNOTSUPP;
 		break;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/block/virtio_blk.c
+++ linux-qcom-6.8.0/drivers/block/virtio_blk.c
@@ -471,18 +471,18 @@
 	return virtblk_prep_rq(req->mq_hctx, vblk, req, vbr) == BLK_STS_OK;
 }
 
-static bool virtblk_add_req_batch(struct virtio_blk_vq *vq,
+static void virtblk_add_req_batch(struct virtio_blk_vq *vq,
 					struct request **rqlist)
 {
+	struct request *req;
 	unsigned long flags;
-	int err;
 	bool kick;
 
 	spin_lock_irqsave(&vq->lock, flags);
 
-	while (!rq_list_empty(*rqlist)) {
-		struct request *req = rq_list_pop(rqlist);
+	while ((req = rq_list_pop(rqlist))) {
 		struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);
+		int err;
 
 		err = virtblk_add_req(vq->vq, vbr);
 		if (err) {
@@ -495,37 +495,33 @@
 	kick = virtqueue_kick_prepare(vq->vq);
 	spin_unlock_irqrestore(&vq->lock, flags);
 
-	return kick;
+	if (kick)
+		virtqueue_notify(vq->vq);
 }
 
 static void virtio_queue_rqs(struct request **rqlist)
 {
-	struct request *req, *next, *prev = NULL;
+	struct request *submit_list = NULL;
 	struct request *requeue_list = NULL;
+	struct request **requeue_lastp = &requeue_list;
+	struct virtio_blk_vq *vq = NULL;
+	struct request *req;
 
-	rq_list_for_each_safe(rqlist, req, next) {
-		struct virtio_blk_vq *vq = get_virtio_blk_vq(req->mq_hctx);
-		bool kick;
-
-		if (!virtblk_prep_rq_batch(req)) {
-			rq_list_move(rqlist, &requeue_list, req, prev);
-			req = prev;
-			if (!req)
-				continue;
-		}
+	while ((req = rq_list_pop(rqlist))) {
+		struct virtio_blk_vq *this_vq = get_virtio_blk_vq(req->mq_hctx);
 
-		if (!next || req->mq_hctx != next->mq_hctx) {
-			req->rq_next = NULL;
-			kick = virtblk_add_req_batch(vq, rqlist);
-			if (kick)
-				virtqueue_notify(vq->vq);
-
-			*rqlist = next;
-			prev = NULL;
-		} else
-			prev = req;
+		if (vq && vq != this_vq)
+			virtblk_add_req_batch(vq, &submit_list);
+		vq = this_vq;
+
+		if (virtblk_prep_rq_batch(req))
+			rq_list_add(&submit_list, req); /* reverse order */
+		else
+			rq_list_add_tail(&requeue_lastp, req);
 	}
 
+	if (vq)
+		virtblk_add_req_batch(vq, &submit_list);
 	*rqlist = requeue_list;
 }
 
@@ -1592,9 +1588,12 @@
 static int virtblk_freeze(struct virtio_device *vdev)
 {
 	struct virtio_blk *vblk = vdev->priv;
+	struct request_queue *q = vblk->disk->queue;
 
 	/* Ensure no requests in virtqueues before deleting vqs. */
-	blk_mq_freeze_queue(vblk->disk->queue);
+	blk_mq_freeze_queue(q);
+	blk_mq_quiesce_queue_nowait(q);
+	blk_mq_unfreeze_queue(q);
 
 	/* Ensure we don't receive any more interrupts */
 	virtio_reset_device(vdev);
@@ -1618,8 +1617,8 @@
 		return ret;
 
 	virtio_device_ready(vdev);
+	blk_mq_unquiesce_queue(vblk->disk->queue);
 
-	blk_mq_unfreeze_queue(vblk->disk->queue);
 	return 0;
 }
 #endif
--- linux-qcom-6.8.0.orig/drivers/block/zram/zram_drv.c
+++ linux-qcom-6.8.0/drivers/block/zram/zram_drv.c
@@ -297,17 +297,30 @@
 		/*
 		 * Do not mark ZRAM_UNDER_WB slot as ZRAM_IDLE to close race.
 		 * See the comment in writeback_store.
+		 *
+		 * Also do not mark ZRAM_SAME slots as ZRAM_IDLE, because no
+		 * post-processing (recompress, writeback) happens to the
+		 * ZRAM_SAME slot.
+		 *
+		 * And ZRAM_WB slots simply cannot be ZRAM_IDLE.
 		 */
 		zram_slot_lock(zram, index);
-		if (zram_allocated(zram, index) &&
-				!zram_test_flag(zram, index, ZRAM_UNDER_WB)) {
+		if (!zram_allocated(zram, index) ||
+		    zram_test_flag(zram, index, ZRAM_WB) ||
+		    zram_test_flag(zram, index, ZRAM_UNDER_WB) ||
+		    zram_test_flag(zram, index, ZRAM_SAME)) {
+			zram_slot_unlock(zram, index);
+			continue;
+		}
+
 #ifdef CONFIG_ZRAM_TRACK_ENTRY_ACTIME
-			is_idle = !cutoff || ktime_after(cutoff,
-							 zram->table[index].ac_time);
+		is_idle = !cutoff ||
+			ktime_after(cutoff, zram->table[index].ac_time);
 #endif
-			if (is_idle)
-				zram_set_flag(zram, index, ZRAM_IDLE);
-		}
+		if (is_idle)
+			zram_set_flag(zram, index, ZRAM_IDLE);
+		else
+			zram_clear_flag(zram, index, ZRAM_IDLE);
 		zram_slot_unlock(zram, index);
 	}
 }
@@ -522,6 +535,12 @@
 	}
 
 	nr_pages = i_size_read(inode) >> PAGE_SHIFT;
+	/* Refuse to use zero sized device (also prevents self reference) */
+	if (!nr_pages) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	bitmap_sz = BITS_TO_LONGS(nr_pages) * sizeof(long);
 	bitmap = kvzalloc(bitmap_sz, GFP_KERNEL);
 	if (!bitmap) {
@@ -640,6 +659,12 @@
 		goto release_init_lock;
 	}
 
+	/* Do not permit concurrent post-processing actions. */
+	if (atomic_xchg(&zram->pp_in_progress, 1)) {
+		up_read(&zram->init_lock);
+		return -EAGAIN;
+	}
+
 	if (!zram->backing_dev) {
 		ret = -ENODEV;
 		goto release_init_lock;
@@ -766,6 +791,7 @@
 		free_block_bdev(zram, blk_idx);
 	__free_page(page);
 release_init_lock:
+	atomic_set(&zram->pp_in_progress, 0);
 	up_read(&zram->init_lock);
 
 	return ret;
@@ -1216,12 +1242,16 @@
 	size_t num_pages = disksize >> PAGE_SHIFT;
 	size_t index;
 
+	if (!zram->table)
+		return;
+
 	/* Free all pages that are still in this zram device */
 	for (index = 0; index < num_pages; index++)
 		zram_free_page(zram, index);
 
 	zs_destroy_pool(zram->mem_pool);
 	vfree(zram->table);
+	zram->table = NULL;
 }
 
 static bool zram_meta_alloc(struct zram *zram, u64 disksize)
@@ -1236,6 +1266,7 @@
 	zram->mem_pool = zs_create_pool(zram->disk->disk_name);
 	if (!zram->mem_pool) {
 		vfree(zram->table);
+		zram->table = NULL;
 		return false;
 	}
 
@@ -1596,6 +1627,13 @@
 	if (ret)
 		return ret;
 
+	/*
+	 * We touched this entry so mark it as non-IDLE. This makes sure that
+	 * we don't preserve IDLE flag and don't incorrectly pick this entry
+	 * for different post-processing type (e.g. writeback).
+	 */
+	zram_clear_flag(zram, index, ZRAM_IDLE);
+
 	class_index_old = zs_lookup_class_index(zram->mem_pool, comp_len_old);
 	/*
 	 * Iterate the secondary comp algorithms list (in order of priority)
@@ -1758,6 +1796,12 @@
 		goto release_init_lock;
 	}
 
+	/* Do not permit concurrent post-processing actions. */
+	if (atomic_xchg(&zram->pp_in_progress, 1)) {
+		up_read(&zram->init_lock);
+		return -EAGAIN;
+	}
+
 	if (algo) {
 		bool found = false;
 
@@ -1822,6 +1866,7 @@
 	__free_page(page);
 
 release_init_lock:
+	atomic_set(&zram->pp_in_progress, 0);
 	up_read(&zram->init_lock);
 	return ret;
 }
@@ -1979,6 +2024,13 @@
 		zcomp_destroy(comp);
 		zram->num_active_comps--;
 	}
+
+	for (prio = ZRAM_PRIMARY_COMP; prio < ZRAM_MAX_COMPS; prio++) {
+		/* Do not free statically defined compression algorithms */
+		if (zram->comp_algs[prio] != default_compressor)
+			kfree(zram->comp_algs[prio]);
+		zram->comp_algs[prio] = NULL;
+	}
 }
 
 static void zram_reset_device(struct zram *zram)
@@ -1987,11 +2039,6 @@
 
 	zram->limit_pages = 0;
 
-	if (!init_done(zram)) {
-		up_write(&zram->init_lock);
-		return;
-	}
-
 	set_capacity_and_notify(zram->disk, 0);
 	part_stat_set_all(zram->disk->part0, 0);
 
@@ -2000,6 +2047,7 @@
 	zram->disksize = 0;
 	zram_destroy_comps(zram);
 	memset(&zram->stats, 0, sizeof(zram->stats));
+	atomic_set(&zram->pp_in_progress, 0);
 	reset_bdev(zram);
 
 	comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor);
@@ -2210,6 +2258,8 @@
 	zram->disk->fops = &zram_devops;
 	zram->disk->private_data = zram;
 	snprintf(zram->disk->disk_name, 16, "zram%d", device_id);
+	atomic_set(&zram->pp_in_progress, 0);
+	comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor);
 
 	/* Actual capacity set using sysfs (/sys/block/zram<id>/disksize */
 	set_capacity(zram->disk, 0);
@@ -2244,8 +2294,6 @@
 	if (ret)
 		goto out_cleanup_disk;
 
-	comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor);
-
 	zram_debugfs_register(zram);
 	pr_info("Added device: %s\n", zram->disk->disk_name);
 	return device_id;
--- linux-qcom-6.8.0.orig/drivers/block/zram/zram_drv.h
+++ linux-qcom-6.8.0/drivers/block/zram/zram_drv.h
@@ -139,5 +139,6 @@
 #ifdef CONFIG_ZRAM_MEMORY_TRACKING
 	struct dentry *debugfs_dir;
 #endif
+	atomic_t pp_in_progress;
 };
 #endif
--- linux-qcom-6.8.0.orig/drivers/bluetooth/ath3k.c
+++ linux-qcom-6.8.0/drivers/bluetooth/ath3k.c
@@ -3,7 +3,6 @@
  * Copyright (c) 2008-2009 Atheros Communications Inc.
  */
 
-
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -128,7 +127,6 @@
  * for AR3012
  */
 static const struct usb_device_id ath3k_blist_tbl[] = {
-
 	/* Atheros AR3012 with sflash firmware*/
 	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
@@ -202,7 +200,7 @@
 #define TIMEGAP_USEC_MAX	100
 
 static int ath3k_load_firmware(struct usb_device *udev,
-				const struct firmware *firmware)
+			       const struct firmware *firmware)
 {
 	u8 *send_buf;
 	int len = 0;
@@ -237,9 +235,9 @@
 		memcpy(send_buf, firmware->data + sent, size);
 
 		err = usb_bulk_msg(udev, pipe, send_buf, size,
-					&len, 3000);
+				   &len, 3000);
 
-		if (err || (len != size)) {
+		if (err || len != size) {
 			ath3k_log_failed_loading(err, len, size, count);
 			goto error;
 		}
@@ -262,7 +260,7 @@
 }
 
 static int ath3k_get_version(struct usb_device *udev,
-			struct ath3k_version *version)
+			     struct ath3k_version *version)
 {
 	return usb_control_msg_recv(udev, 0, ATH3K_GETVERSION,
 				    USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
@@ -271,7 +269,7 @@
 }
 
 static int ath3k_load_fwfile(struct usb_device *udev,
-		const struct firmware *firmware)
+			     const struct firmware *firmware)
 {
 	u8 *send_buf;
 	int len = 0;
@@ -310,8 +308,8 @@
 		memcpy(send_buf, firmware->data + sent, size);
 
 		err = usb_bulk_msg(udev, pipe, send_buf, size,
-					&len, 3000);
-		if (err || (len != size)) {
+				   &len, 3000);
+		if (err || len != size) {
 			ath3k_log_failed_loading(err, len, size, count);
 			kfree(send_buf);
 			return err;
@@ -425,7 +423,6 @@
 	}
 
 	switch (fw_version.ref_clock) {
-
 	case ATH3K_XTAL_FREQ_26M:
 		clk_value = 26;
 		break;
@@ -441,7 +438,7 @@
 	}
 
 	snprintf(filename, ATH3K_NAME_LEN, "ar3k/ramps_0x%08x_%d%s",
-		le32_to_cpu(fw_version.rom_version), clk_value, ".dfu");
+		 le32_to_cpu(fw_version.rom_version), clk_value, ".dfu");
 
 	ret = request_firmware(&firmware, filename, &udev->dev);
 	if (ret < 0) {
@@ -456,7 +453,7 @@
 }
 
 static int ath3k_probe(struct usb_interface *intf,
-			const struct usb_device_id *id)
+		       const struct usb_device_id *id)
 {
 	const struct firmware *firmware;
 	struct usb_device *udev = interface_to_usbdev(intf);
@@ -505,10 +502,10 @@
 	if (ret < 0) {
 		if (ret == -ENOENT)
 			BT_ERR("Firmware file \"%s\" not found",
-							ATH3K_FIRMWARE);
+			       ATH3K_FIRMWARE);
 		else
 			BT_ERR("Firmware file \"%s\" request failed (err=%d)",
-							ATH3K_FIRMWARE, ret);
+			       ATH3K_FIRMWARE, ret);
 		return ret;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btbcm.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btbcm.c
@@ -540,13 +540,12 @@
 static const char *btbcm_get_board_name(struct device *dev)
 {
 #ifdef CONFIG_OF
-	struct device_node *root;
+	struct device_node *root __free(device_node) = of_find_node_by_path("/");
 	char *board_type;
 	const char *tmp;
 	int len;
 	int i;
 
-	root = of_find_node_by_path("/");
 	if (!root)
 		return NULL;
 
@@ -561,7 +560,6 @@
 		if (board_type[i] == '/')
 			board_type[i] = '-';
 	}
-	of_node_put(root);
 
 	return board_type;
 #else
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btintel.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btintel.c
@@ -26,21 +26,11 @@
 #define ECDSA_OFFSET		644
 #define ECDSA_HEADER_LEN	320
 
-#define BTINTEL_PPAG_NAME   "PPAG"
-
 enum {
 	DSM_SET_WDISABLE2_DELAY = 1,
 	DSM_SET_RESET_METHOD = 3,
 };
 
-/* structure to store the PPAG data read from ACPI table */
-struct btintel_ppag {
-	u32	domain;
-	u32     mode;
-	acpi_status status;
-	struct hci_dev *hdev;
-};
-
 #define CMD_WRITE_BOOT_PARAMS	0xfc0e
 struct cmd_write_boot_params {
 	__le32 boot_addr;
@@ -441,7 +431,7 @@
 		return PTR_ERR(skb);
 	}
 
-	if (skb->len != sizeof(*ver)) {
+	if (!skb || skb->len != sizeof(*ver)) {
 		bt_dev_err(hdev, "Intel version event size mismatch");
 		kfree_skb(skb);
 		return -EILSEQ;
@@ -1317,65 +1307,6 @@
 	return 0;
 }
 
-static acpi_status btintel_ppag_callback(acpi_handle handle, u32 lvl, void *data,
-					 void **ret)
-{
-	acpi_status status;
-	size_t len;
-	struct btintel_ppag *ppag = data;
-	union acpi_object *p, *elements;
-	struct acpi_buffer string = {ACPI_ALLOCATE_BUFFER, NULL};
-	struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
-	struct hci_dev *hdev = ppag->hdev;
-
-	status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &string);
-	if (ACPI_FAILURE(status)) {
-		bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status));
-		return status;
-	}
-
-	len = strlen(string.pointer);
-	if (len < strlen(BTINTEL_PPAG_NAME)) {
-		kfree(string.pointer);
-		return AE_OK;
-	}
-
-	if (strncmp((char *)string.pointer + len - 4, BTINTEL_PPAG_NAME, 4)) {
-		kfree(string.pointer);
-		return AE_OK;
-	}
-	kfree(string.pointer);
-
-	status = acpi_evaluate_object(handle, NULL, NULL, &buffer);
-	if (ACPI_FAILURE(status)) {
-		ppag->status = status;
-		bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status));
-		return status;
-	}
-
-	p = buffer.pointer;
-	ppag = (struct btintel_ppag *)data;
-
-	if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) {
-		kfree(buffer.pointer);
-		bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d",
-			    p->type, p->package.count);
-		ppag->status = AE_ERROR;
-		return AE_ERROR;
-	}
-
-	elements = p->package.elements;
-
-	/* PPAG table is located at element[1] */
-	p = &elements[1];
-
-	ppag->domain = (u32)p->package.elements[0].integer.value;
-	ppag->mode = (u32)p->package.elements[1].integer.value;
-	ppag->status = AE_OK;
-	kfree(buffer.pointer);
-	return AE_CTRL_TERMINATE;
-}
-
 static int btintel_set_debug_features(struct hci_dev *hdev,
 			       const struct intel_debug_features *features)
 {
@@ -2404,10 +2335,13 @@
 
 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver)
 {
-	struct btintel_ppag ppag;
 	struct sk_buff *skb;
 	struct hci_ppag_enable_cmd ppag_cmd;
 	acpi_handle handle;
+	struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
+	union acpi_object *p, *elements;
+	u32 domain, mode;
+	acpi_status status;
 
 	/* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */
 	switch (ver->cnvr_top & 0xFFF) {
@@ -2425,22 +2359,34 @@
 		return;
 	}
 
-	memset(&ppag, 0, sizeof(ppag));
-
-	ppag.hdev = hdev;
-	ppag.status = AE_NOT_FOUND;
-	acpi_walk_namespace(ACPI_TYPE_PACKAGE, handle, 1, NULL,
-			    btintel_ppag_callback, &ppag, NULL);
-
-	if (ACPI_FAILURE(ppag.status)) {
-		if (ppag.status == AE_NOT_FOUND) {
+	status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer);
+	if (ACPI_FAILURE(status)) {
+		if (status == AE_NOT_FOUND) {
 			bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found");
 			return;
 		}
+		bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status));
 		return;
 	}
 
-	if (ppag.domain != 0x12) {
+	p = buffer.pointer;
+	if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) {
+		bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d",
+			    p->type, p->package.count);
+		kfree(buffer.pointer);
+		return;
+	}
+
+	elements = p->package.elements;
+
+	/* PPAG table is located at element[1] */
+	p = &elements[1];
+
+	domain = (u32)p->package.elements[0].integer.value;
+	mode = (u32)p->package.elements[1].integer.value;
+	kfree(buffer.pointer);
+
+	if (domain != 0x12) {
 		bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware");
 		return;
 	}
@@ -2451,19 +2397,22 @@
 	 * BIT 1 : 0 Disabled in China
 	 *         1 Enabled in China
 	 */
-	if ((ppag.mode & 0x01) != BIT(0) && (ppag.mode & 0x02) != BIT(1)) {
-		bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in CB/BIOS");
+	mode &= 0x03;
+
+	if (!mode) {
+		bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS");
 		return;
 	}
 
-	ppag_cmd.ppag_enable_flags = cpu_to_le32(ppag.mode);
+	ppag_cmd.ppag_enable_flags = cpu_to_le32(mode);
 
-	skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), &ppag_cmd, HCI_CMD_TIMEOUT);
+	skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd),
+			     &ppag_cmd, HCI_CMD_TIMEOUT);
 	if (IS_ERR(skb)) {
 		bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb));
 		return;
 	}
-	bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", ppag.mode);
+	bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode);
 	kfree_skb(skb);
 }
 
@@ -2771,9 +2720,6 @@
 					       INTEL_ROM_LEGACY_NO_WBS_SUPPORT))
 				set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 					&hdev->quirks);
-			if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22)
-				set_bit(HCI_QUIRK_VALID_LE_STATES,
-					&hdev->quirks);
 
 			err = btintel_legacy_rom_setup(hdev, &ver);
 			break;
@@ -2782,7 +2728,6 @@
 		case 0x12:      /* ThP */
 		case 0x13:      /* HrP */
 		case 0x14:      /* CcP */
-			set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
 			fallthrough;
 		case 0x0c:	/* WsP */
 			/* Apply the device specific HCI quirks
@@ -2869,9 +2814,6 @@
 		/* These variants don't seem to support LE Coded PHY */
 		set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks);
 
-		/* Set Valid LE States quirk */
-		set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
-
 		/* Setup MSFT Extension support */
 		btintel_set_msft_opcode(hdev, ver.hw_variant);
 
@@ -2892,15 +2834,15 @@
 		 */
 		set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
 
-		/* Apply LE States quirk from solar onwards */
-		set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
-
 		/* Setup MSFT Extension support */
 		btintel_set_msft_opcode(hdev,
 					INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
 		btintel_set_dsm_reset_method(hdev, &ver_tlv);
 
 		err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
+		if (err)
+			goto exit_error;
+
 		btintel_register_devcoredump_support(hdev);
 		break;
 	default:
@@ -2981,13 +2923,12 @@
 	case INTEL_TLV_TEST_EXCEPTION:
 		/* Generate devcoredump from exception */
 		if (!hci_devcd_init(hdev, skb->len)) {
-			hci_devcd_append(hdev, skb);
+			hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
 			hci_devcd_complete(hdev);
 		} else {
 			bt_dev_err(hdev, "Failed to generate devcoredump");
-			kfree_skb(skb);
 		}
-		return 0;
+	break;
 	default:
 		bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]);
 	}
@@ -3014,7 +2955,8 @@
 				 * indicating that the bootup completed.
 				 */
 				btintel_bootup(hdev, ptr, len);
-				break;
+				kfree_skb(skb);
+				return 0;
 			case 0x06:
 				/* When the firmware loading completes the
 				 * device sends out a vendor specific event
@@ -3022,7 +2964,8 @@
 				 * loading.
 				 */
 				btintel_secure_send_result(hdev, ptr, len);
-				break;
+				kfree_skb(skb);
+				return 0;
 			}
 		}
 
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btmrvl_main.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btmrvl_main.c
@@ -121,13 +121,6 @@
 				((event->data[2] == MODULE_BROUGHT_UP) ||
 				(event->data[2] == MODULE_ALREADY_UP)) ?
 				"Bring-up succeed" : "Bring-up failed");
-
-			if (event->length > 3 && event->data[3])
-				priv->btmrvl_dev.dev_type = HCI_AMP;
-			else
-				priv->btmrvl_dev.dev_type = HCI_PRIMARY;
-
-			BT_DBG("dev_type: %d", priv->btmrvl_dev.dev_type);
 		} else if (priv->btmrvl_dev.sendcmdflag &&
 				event->data[1] == MODULE_SHUTDOWN_REQ) {
 			BT_DBG("EVENT:%s", (event->data[2]) ?
@@ -686,8 +679,6 @@
 	hdev->wakeup = btmrvl_wakeup;
 	SET_HCIDEV_DEV(hdev, &card->func->dev);
 
-	hdev->dev_type = priv->btmrvl_dev.dev_type;
-
 	ret = hci_register_dev(hdev);
 	if (ret < 0) {
 		BT_ERR("Can not register HCI device");
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btmrvl_sdio.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btmrvl_sdio.c
@@ -92,7 +92,7 @@
 		} else {
 			ret = devm_request_irq(dev, cfg->irq_bt,
 					       btmrvl_wake_irq_bt,
-					       0, "bt_wake", card);
+					       IRQF_NO_AUTOEN, "bt_wake", card);
 			if (ret) {
 				dev_err(dev,
 					"Failed to request irq_bt %d (%d)\n",
@@ -101,7 +101,6 @@
 
 			/* Configure wakeup (enabled by default) */
 			device_init_wakeup(dev, true);
-			disable_irq(cfg->irq_bt);
 		}
 	}
 
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btmtk.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btmtk.c
@@ -371,15 +371,20 @@
 {
 	struct btmediatek_data *data = hci_get_priv(hdev);
 	int err;
+	bool complete = false;
 
-	if (!IS_ENABLED(CONFIG_DEV_COREDUMP))
+	if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) {
+		kfree_skb(skb);
 		return 0;
+	}
 
 	switch (data->cd_info.state) {
 	case HCI_DEVCOREDUMP_IDLE:
 		err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE);
-		if (err < 0)
+		if (err < 0) {
+			kfree_skb(skb);
 			break;
+		}
 		data->cd_info.cnt = 0;
 
 		/* It is supposed coredump can be done within 5 seconds */
@@ -388,26 +393,26 @@
 		fallthrough;
 	case HCI_DEVCOREDUMP_ACTIVE:
 	default:
+		/* Mediatek coredump data would be more than MTK_COREDUMP_NUM */
+		if (data->cd_info.cnt >= MTK_COREDUMP_NUM &&
+		    skb->len > MTK_COREDUMP_END_LEN)
+			if (!memcmp((char *)&skb->data[skb->len - MTK_COREDUMP_END_LEN],
+				    MTK_COREDUMP_END, MTK_COREDUMP_END_LEN - 1))
+				complete = true;
+
 		err = hci_devcd_append(hdev, skb);
 		if (err < 0)
 			break;
 		data->cd_info.cnt++;
 
-		/* Mediatek coredump data would be more than MTK_COREDUMP_NUM */
-		if (data->cd_info.cnt > MTK_COREDUMP_NUM &&
-		    skb->len > MTK_COREDUMP_END_LEN)
-			if (!memcmp((char *)&skb->data[skb->len - MTK_COREDUMP_END_LEN],
-				    MTK_COREDUMP_END, MTK_COREDUMP_END_LEN - 1)) {
-				bt_dev_info(hdev, "Mediatek coredump end");
-				hci_devcd_complete(hdev);
-			}
+		if (complete) {
+			bt_dev_info(hdev, "Mediatek coredump end");
+			hci_devcd_complete(hdev);
+		}
 
 		break;
 	}
 
-	if (err < 0)
-		kfree_skb(skb);
-
 	return err;
 }
 EXPORT_SYMBOL_GPL(btmtk_process_coredump);
@@ -420,5 +425,6 @@
 MODULE_FIRMWARE(FIRMWARE_MT7622);
 MODULE_FIRMWARE(FIRMWARE_MT7663);
 MODULE_FIRMWARE(FIRMWARE_MT7668);
+MODULE_FIRMWARE(FIRMWARE_MT7922);
 MODULE_FIRMWARE(FIRMWARE_MT7961);
 MODULE_FIRMWARE(FIRMWARE_MT7925);
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btmtk.h
+++ linux-qcom-6.8.0/drivers/bluetooth/btmtk.h
@@ -4,6 +4,7 @@
 #define FIRMWARE_MT7622		"mediatek/mt7622pr2h.bin"
 #define FIRMWARE_MT7663		"mediatek/mt7663pr2h.bin"
 #define FIRMWARE_MT7668		"mediatek/mt7668pr2h.bin"
+#define FIRMWARE_MT7922		"mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
 #define FIRMWARE_MT7961		"mediatek/BT_RAM_CODE_MT7961_1_2_hdr.bin"
 #define FIRMWARE_MT7925		"mediatek/mt7925/BT_RAM_CODE_MT7925_1_1_hdr.bin"
 
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btmtksdio.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btmtksdio.c
@@ -1144,9 +1144,6 @@
 			}
 		}
 
-		/* Valid LE States quirk for MediaTek 7921 */
-		set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
-
 		break;
 	case 0x7663:
 	case 0x7668:
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btnxpuart.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btnxpuart.c
@@ -29,6 +29,7 @@
 #define BTNXPUART_CHECK_BOOT_SIGNATURE	3
 #define BTNXPUART_SERDEV_OPEN		4
 #define BTNXPUART_IR_IN_PROGRESS	5
+#define BTNXPUART_FW_DOWNLOAD_ABORT	6
 
 /* NXP HW err codes */
 #define BTNXPUART_IR_HW_ERR		0xb0
@@ -126,6 +127,7 @@
 	struct hci_dev *hdev;
 	struct work_struct work;
 	struct timer_list ps_timer;
+	struct mutex ps_lock;
 };
 
 struct wakeup_cmd_payload {
@@ -158,6 +160,7 @@
 	u8 fw_name[MAX_FW_FILE_NAME_LEN];
 	u32 fw_dnld_v1_offset;
 	u32 fw_v1_sent_bytes;
+	u32 fw_dnld_v3_offset;
 	u32 fw_v3_offset_correction;
 	u32 fw_v1_expected_len;
 	u32 boot_reg_offset;
@@ -186,6 +189,11 @@
 #define NXP_NAK_V3		0x7b
 #define NXP_CRC_ERROR_V3	0x7c
 
+/* Bootloader signature error codes */
+#define NXP_ACK_RX_TIMEOUT	0x0002	/* ACK not received from host */
+#define NXP_HDR_RX_TIMEOUT	0x0003	/* FW Header chunk not received */
+#define NXP_DATA_RX_TIMEOUT	0x0004	/* FW Data chunk not received */
+
 #define HDR_LEN			16
 
 #define NXP_RECV_CHIP_VER_V1 \
@@ -276,11 +284,22 @@
 	__be32 crc;
 } __packed;
 
+struct nxp_v3_rx_timeout_nak {
+	u8 nak;
+	__le32 offset;
+	u8 crc;
+} __packed;
+
+union nxp_v3_rx_timeout_nak_u {
+	struct nxp_v3_rx_timeout_nak pkt;
+	u8 buf[6];
+};
+
 static u8 crc8_table[CRC8_TABLE_SIZE];
 
 /* Default configurations */
 #define DEFAULT_H2C_WAKEUP_MODE	WAKEUP_METHOD_BREAK
-#define DEFAULT_PS_MODE		PS_MODE_DISABLE
+#define DEFAULT_PS_MODE		PS_MODE_ENABLE
 #define FW_INIT_BAUDRATE	HCI_NXP_PRI_BAUDRATE
 
 static struct sk_buff *nxp_drv_send_cmd(struct hci_dev *hdev, u16 opcode,
@@ -317,6 +336,9 @@
 
 	if (psdata->cur_psmode == PS_MODE_ENABLE)
 		mod_timer(&psdata->ps_timer, jiffies + msecs_to_jiffies(psdata->h2c_ps_interval));
+
+	if (psdata->ps_state == PS_STATE_AWAKE && psdata->ps_cmd == PS_CMD_ENTER_PS)
+		cancel_work_sync(&psdata->work);
 }
 
 static void ps_cancel_timer(struct btnxpuart_dev *nxpdev)
@@ -324,7 +346,7 @@
 	struct ps_data *psdata = &nxpdev->psdata;
 
 	flush_work(&psdata->work);
-	del_timer_sync(&psdata->ps_timer);
+	timer_shutdown_sync(&psdata->ps_timer);
 }
 
 static void ps_control(struct hci_dev *hdev, u8 ps_state)
@@ -337,6 +359,7 @@
 	    !test_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state))
 		return;
 
+	mutex_lock(&psdata->ps_lock);
 	switch (psdata->cur_h2c_wakeupmode) {
 	case WAKEUP_METHOD_DTR:
 		if (ps_state == PS_STATE_AWAKE)
@@ -350,12 +373,15 @@
 			status = serdev_device_break_ctl(nxpdev->serdev, 0);
 		else
 			status = serdev_device_break_ctl(nxpdev->serdev, -1);
+		msleep(20); /* Allow chip to detect UART-break and enter sleep */
 		bt_dev_dbg(hdev, "Set UART break: %s, status=%d",
 			   str_on_off(ps_state == PS_STATE_SLEEP), status);
 		break;
 	}
 	if (!status)
 		psdata->ps_state = ps_state;
+	mutex_unlock(&psdata->ps_lock);
+
 	if (ps_state == PS_STATE_AWAKE)
 		btnxpuart_tx_wakeup(nxpdev);
 }
@@ -391,17 +417,42 @@
 
 	psdata->hdev = hdev;
 	INIT_WORK(&psdata->work, ps_work_func);
+	mutex_init(&psdata->ps_lock);
 	timer_setup(&psdata->ps_timer, ps_timeout_func, 0);
 }
 
-static void ps_wakeup(struct btnxpuart_dev *nxpdev)
+static bool ps_wakeup(struct btnxpuart_dev *nxpdev)
 {
 	struct ps_data *psdata = &nxpdev->psdata;
+	u8 ps_state;
 
-	if (psdata->ps_state != PS_STATE_AWAKE) {
+	mutex_lock(&psdata->ps_lock);
+	ps_state = psdata->ps_state;
+	mutex_unlock(&psdata->ps_lock);
+
+	if (ps_state != PS_STATE_AWAKE) {
 		psdata->ps_cmd = PS_CMD_EXIT_PS;
 		schedule_work(&psdata->work);
+		return true;
 	}
+	return false;
+}
+
+static void ps_cleanup(struct btnxpuart_dev *nxpdev)
+{
+	struct ps_data *psdata = &nxpdev->psdata;
+	u8 ps_state;
+
+	mutex_lock(&psdata->ps_lock);
+	ps_state = psdata->ps_state;
+	mutex_unlock(&psdata->ps_lock);
+
+	if (ps_state != PS_STATE_AWAKE)
+		ps_control(psdata->hdev, PS_STATE_AWAKE);
+
+	ps_cancel_timer(nxpdev);
+	cancel_work_sync(&psdata->work);
+	mutex_destroy(&psdata->ps_lock);
 }
 
 static int send_ps_cmd(struct hci_dev *hdev, void *data)
@@ -534,6 +585,7 @@
 	nxpdev->fw_v1_sent_bytes = 0;
 	nxpdev->fw_v1_expected_len = HDR_LEN;
 	nxpdev->boot_reg_offset = 0;
+	nxpdev->fw_dnld_v3_offset = 0;
 	nxpdev->fw_v3_offset_correction = 0;
 	nxpdev->baudrate_changed = false;
 	nxpdev->timeout_changed = false;
@@ -548,14 +600,23 @@
 					       !test_bit(BTNXPUART_FW_DOWNLOADING,
 							 &nxpdev->tx_state),
 					       msecs_to_jiffies(60000));
+
+	release_firmware(nxpdev->fw);
+	memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
+
 	if (err == 0) {
-		bt_dev_err(hdev, "FW Download Timeout.");
+		bt_dev_err(hdev, "FW Download Timeout. offset: %d",
+				nxpdev->fw_dnld_v1_offset ?
+				nxpdev->fw_dnld_v1_offset :
+				nxpdev->fw_dnld_v3_offset);
 		return -ETIMEDOUT;
 	}
+	if (test_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state)) {
+		bt_dev_err(hdev, "FW Download Aborted");
+		return -EINTR;
+	}
 
 	serdev_device_set_flow_control(nxpdev->serdev, true);
-	release_firmware(nxpdev->fw);
-	memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
 
 	/* Allow the downloaded FW to initialize */
 	msleep(1200);
@@ -883,6 +944,32 @@
 	return 0;
 }
 
+static void nxp_handle_fw_download_error(struct hci_dev *hdev, struct v3_data_req *req)
+{
+	struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
+	__u32 offset = __le32_to_cpu(req->offset);
+	__u16 err = __le16_to_cpu(req->error);
+	union nxp_v3_rx_timeout_nak_u nak_tx_buf;
+
+	switch (err) {
+	case NXP_ACK_RX_TIMEOUT:
+	case NXP_HDR_RX_TIMEOUT:
+	case NXP_DATA_RX_TIMEOUT:
+		nak_tx_buf.pkt.nak = NXP_NAK_V3;
+		nak_tx_buf.pkt.offset = __cpu_to_le32(offset);
+		nak_tx_buf.pkt.crc = crc8(crc8_table, nak_tx_buf.buf,
+				      sizeof(nak_tx_buf) - 1, 0xff);
+		serdev_device_write_buf(nxpdev->serdev, nak_tx_buf.buf,
+					sizeof(nak_tx_buf));
+		break;
+	default:
+		bt_dev_dbg(hdev, "Unknown bootloader error code: %d", err);
+		break;
+
+	}
+
+}
+
 static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb)
 {
 	struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
@@ -897,7 +984,12 @@
 	if (!req || !nxpdev->fw)
 		goto free_skb;
 
-	nxp_send_ack(NXP_ACK_V3, hdev);
+	if (!req->error) {
+		nxp_send_ack(NXP_ACK_V3, hdev);
+	} else {
+		nxp_handle_fw_download_error(hdev, req);
+		goto free_skb;
+	}
 
 	len = __le16_to_cpu(req->len);
 
@@ -924,9 +1016,6 @@
 		wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
 		goto free_skb;
 	}
-	if (req->error)
-		bt_dev_dbg(hdev, "FW Download received err 0x%02x from chip",
-			   req->error);
 
 	offset = __le32_to_cpu(req->offset);
 	if (offset < nxpdev->fw_v3_offset_correction) {
@@ -938,8 +1027,9 @@
 		goto free_skb;
 	}
 
-	serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data + offset -
-				nxpdev->fw_v3_offset_correction, len);
+	nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction;
+	serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
+				nxpdev->fw_dnld_v3_offset, len);
 
 free_skb:
 	kfree_skb(skb);
@@ -1171,7 +1261,6 @@
 {
 	struct btnxpuart_dev *nxpdev = (struct btnxpuart_dev *)data;
 
-	ps_wakeup(nxpdev);
 	ps_start_timer(nxpdev);
 	return skb_dequeue(&nxpdev->txq);
 }
@@ -1186,8 +1275,12 @@
 	struct sk_buff *skb;
 	int len;
 
+	if (ps_wakeup(nxpdev))
+		return;
+
 	while ((skb = nxp_dequeue(nxpdev))) {
 		len = serdev_device_write_buf(serdev, skb->data, skb->len);
+		serdev_device_wait_until_sent(serdev, 0);
 		hdev->stat.byte_tx += len;
 
 		skb_pull(skb, len);
@@ -1232,8 +1325,12 @@
 {
 	struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
 
-	ps_wakeup(nxpdev);
 	serdev_device_close(nxpdev->serdev);
+	skb_queue_purge(&nxpdev->txq);
+	if (!IS_ERR_OR_NULL(nxpdev->rx_skb)) {
+		kfree_skb(nxpdev->rx_skb);
+		nxpdev->rx_skb = NULL;
+	}
 	clear_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
 	return 0;
 }
@@ -1248,8 +1345,10 @@
 
 	cancel_work_sync(&nxpdev->tx_work);
 
-	kfree_skb(nxpdev->rx_skb);
-	nxpdev->rx_skb = NULL;
+	if (!IS_ERR_OR_NULL(nxpdev->rx_skb)) {
+		kfree_skb(nxpdev->rx_skb);
+		nxpdev->rx_skb = NULL;
+	}
 
 	return 0;
 }
@@ -1364,16 +1463,22 @@
 	struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
 	struct hci_dev *hdev = nxpdev->hdev;
 
-	/* Restore FW baudrate to fw_init_baudrate if changed.
-	 * This will ensure FW baudrate is in sync with
-	 * driver baudrate in case this driver is re-inserted.
-	 */
-	if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) {
-		nxpdev->new_baudrate = nxpdev->fw_init_baudrate;
-		nxp_set_baudrate_cmd(hdev, NULL);
+	if (is_fw_downloading(nxpdev)) {
+		set_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state);
+		clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
+		wake_up_interruptible(&nxpdev->check_boot_sign_wait_q);
+		wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
+	} else {
+		/* Restore FW baudrate to fw_init_baudrate if changed.
+		 * This will ensure FW baudrate is in sync with
+		 * driver baudrate in case this driver is re-inserted.
+		 */
+		if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) {
+			nxpdev->new_baudrate = nxpdev->fw_init_baudrate;
+			nxp_set_baudrate_cmd(hdev, NULL);
+		}
 	}
-
-	ps_cancel_timer(nxpdev);
+	ps_cleanup(nxpdev);
 	hci_unregister_dev(hdev);
 	hci_free_dev(hdev);
 }
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btqca.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btqca.c
@@ -13,8 +13,6 @@
 
 #include "btqca.h"
 
-#define VERSION "0.1"
-
 int qca_read_soc_version(struct hci_dev *hdev, struct qca_btsoc_version *ver,
 			 enum qca_btsoc_type soc_type)
 {
@@ -55,11 +53,6 @@
 	}
 
 	edl = (struct edl_event_hdr *)(skb->data);
-	if (!edl) {
-		bt_dev_err(hdev, "QCA TLV with no header");
-		err = -EILSEQ;
-		goto out;
-	}
 
 	if (edl->cresp != EDL_CMD_REQ_RES_EVT ||
 	    edl->rtype != rtype) {
@@ -99,7 +92,8 @@
 {
 	struct sk_buff *skb;
 	struct edl_event_hdr *edl;
-	char cmd, build_label[QCA_FW_BUILD_VER_LEN];
+	char *build_label;
+	char cmd;
 	int build_lbl_len, err = 0;
 
 	bt_dev_dbg(hdev, "QCA read fw build info");
@@ -114,13 +108,13 @@
 		return err;
 	}
 
-	edl = (struct edl_event_hdr *)(skb->data);
-	if (!edl) {
-		bt_dev_err(hdev, "QCA read fw build info with no header");
+	if (skb->len < sizeof(*edl)) {
 		err = -EILSEQ;
 		goto out;
 	}
 
+	edl = (struct edl_event_hdr *)(skb->data);
+
 	if (edl->cresp != EDL_CMD_REQ_RES_EVT ||
 	    edl->rtype != EDL_GET_BUILD_INFO_CMD) {
 		bt_dev_err(hdev, "QCA Wrong packet received %d %d", edl->cresp,
@@ -129,14 +123,27 @@
 		goto out;
 	}
 
+	if (skb->len < sizeof(*edl) + 1) {
+		err = -EILSEQ;
+		goto out;
+	}
+
 	build_lbl_len = edl->data[0];
-	if (build_lbl_len <= QCA_FW_BUILD_VER_LEN - 1) {
-		memcpy(build_label, edl->data + 1, build_lbl_len);
-		*(build_label + build_lbl_len) = '\0';
+
+	if (skb->len < sizeof(*edl) + 1 + build_lbl_len) {
+		err = -EILSEQ;
+		goto out;
+	}
+
+	build_label = kstrndup(&edl->data[1], build_lbl_len, GFP_KERNEL);
+	if (!build_label) {
+		err = -ENOMEM;
+		goto out;
 	}
 
 	hci_set_fw_info(hdev, "%s", build_label);
 
+	kfree(build_label);
 out:
 	kfree_skb(skb);
 	return err;
@@ -166,11 +173,6 @@
 	}
 
 	edl = (struct edl_event_hdr *)(skb->data);
-	if (!edl) {
-		bt_dev_err(hdev, "QCA Patch config with no header");
-		err = -EILSEQ;
-		goto out;
-	}
 
 	if (edl->cresp != EDL_PATCH_CONFIG_RES_EVT || edl->rtype != EDL_PATCH_CONFIG_CMD) {
 		bt_dev_err(hdev, "QCA Wrong packet received %d %d", edl->cresp,
@@ -235,6 +237,11 @@
 		goto out;
 	}
 
+	if (skb->len < 3) {
+		err = -EILSEQ;
+		goto out;
+	}
+
 	*bid = (edl->data[1] << 8) + edl->data[2];
 	bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid);
 
@@ -265,9 +272,43 @@
 }
 EXPORT_SYMBOL_GPL(qca_send_pre_shutdown_cmd);
 
-static void qca_tlv_check_data(struct hci_dev *hdev,
+static bool qca_filename_has_extension(const char *filename)
+{
+	const char *suffix = strrchr(filename, '.');
+
+	/* File extensions require a dot, but not as the first or last character */
+	if (!suffix || suffix == filename || *(suffix + 1) == '\0')
+		return 0;
+
+	/* Avoid matching directories with names that look like files with extensions */
+	return !strchr(suffix, '/');
+}
+
+static bool qca_get_alt_nvm_file(char *filename, size_t max_size)
+{
+	char fwname[64];
+	const char *suffix;
+
+	/* nvm file name has an extension, replace with .bin */
+	if (qca_filename_has_extension(filename)) {
+		suffix = strrchr(filename, '.');
+		strscpy(fwname, filename, suffix - filename + 1);
+		snprintf(fwname + (suffix - filename),
+		       sizeof(fwname) - (suffix - filename), ".bin");
+		/* If nvm file is already the default one, return false to skip the retry. */
+		if (strcmp(fwname, filename) == 0)
+			return false;
+
+		snprintf(filename, max_size, "%s", fwname);
+		return true;
+	}
+	return false;
+}
+
+static int qca_tlv_check_data(struct hci_dev *hdev,
 			       struct qca_fw_config *config,
-		u8 *fw_data, enum qca_btsoc_type soc_type)
+			       u8 *fw_data, size_t fw_size,
+			       enum qca_btsoc_type soc_type)
 {
 	const u8 *data;
 	u32 type_len;
@@ -277,12 +318,16 @@
 	struct tlv_type_patch *tlv_patch;
 	struct tlv_type_nvm *tlv_nvm;
 	uint8_t nvm_baud_rate = config->user_baud_rate;
+	u8 type;
 
 	config->dnld_mode = QCA_SKIP_EVT_NONE;
 	config->dnld_type = QCA_SKIP_EVT_NONE;
 
 	switch (config->type) {
 	case ELF_TYPE_PATCH:
+		if (fw_size < 7)
+			return -EINVAL;
+
 		config->dnld_mode = QCA_SKIP_EVT_VSE_CC;
 		config->dnld_type = QCA_SKIP_EVT_VSE_CC;
 
@@ -291,6 +336,9 @@
 		bt_dev_dbg(hdev, "File version      : 0x%x", fw_data[6]);
 		break;
 	case TLV_TYPE_PATCH:
+		if (fw_size < sizeof(struct tlv_type_hdr) + sizeof(struct tlv_type_patch))
+			return -EINVAL;
+
 		tlv = (struct tlv_type_hdr *)fw_data;
 		type_len = le32_to_cpu(tlv->type_len);
 		tlv_patch = (struct tlv_type_patch *)tlv->data;
@@ -330,25 +378,64 @@
 		break;
 
 	case TLV_TYPE_NVM:
+		if (fw_size < sizeof(struct tlv_type_hdr))
+			return -EINVAL;
+
 		tlv = (struct tlv_type_hdr *)fw_data;
 
 		type_len = le32_to_cpu(tlv->type_len);
-		length = (type_len >> 8) & 0x00ffffff;
+		length = type_len >> 8;
+		type = type_len & 0xff;
 
-		BT_DBG("TLV Type\t\t : 0x%x", type_len & 0x000000ff);
+		/* Some NVM files have more than one set of tags, only parse
+		 * the first set when it has type 2 for now. When there is
+		 * more than one set there is an enclosing header of type 4.
+		 */
+		if (type == 4) {
+			if (fw_size < 2 * sizeof(struct tlv_type_hdr))
+				return -EINVAL;
+
+			tlv++;
+
+			type_len = le32_to_cpu(tlv->type_len);
+			length = type_len >> 8;
+			type = type_len & 0xff;
+		}
+
+		BT_DBG("TLV Type\t\t : 0x%x", type);
 		BT_DBG("Length\t\t : %d bytes", length);
 
+		if (type != 2)
+			break;
+
+		if (fw_size < length + (tlv->data - fw_data))
+			return -EINVAL;
+
 		idx = 0;
 		data = tlv->data;
-		while (idx < length) {
+		while (idx < length - sizeof(struct tlv_type_nvm)) {
 			tlv_nvm = (struct tlv_type_nvm *)(data + idx);
 
 			tag_id = le16_to_cpu(tlv_nvm->tag_id);
 			tag_len = le16_to_cpu(tlv_nvm->tag_len);
 
+			if (length < idx + sizeof(struct tlv_type_nvm) + tag_len)
+				return -EINVAL;
+
 			/* Update NVM tags as needed */
 			switch (tag_id) {
+			case EDL_TAG_ID_BD_ADDR:
+				if (tag_len != sizeof(bdaddr_t))
+					return -EINVAL;
+
+				memcpy(&config->bdaddr, tlv_nvm->data, sizeof(bdaddr_t));
+
+				break;
+
 			case EDL_TAG_ID_HCI:
+				if (tag_len < 3)
+					return -EINVAL;
+
 				/* HCI transport layer parameters
 				 * enabling software inband sleep
 				 * onto controller side.
@@ -364,6 +451,9 @@
 				break;
 
 			case EDL_TAG_ID_DEEP_SLEEP:
+				if (tag_len < 1)
+					return -EINVAL;
+
 				/* Sleep enable mask
 				 * enabling deep sleep feature on controller.
 				 */
@@ -372,14 +462,16 @@
 				break;
 			}
 
-			idx += (sizeof(u16) + sizeof(u16) + 8 + tag_len);
+			idx += sizeof(struct tlv_type_nvm) + tag_len;
 		}
 		break;
 
 	default:
 		BT_ERR("Unknown TLV type %d", config->type);
-		break;
+		return -EINVAL;
 	}
+
+	return 0;
 }
 
 static int qca_tlv_send_segment(struct hci_dev *hdev, int seg_size,
@@ -428,11 +520,6 @@
 	}
 
 	edl = (struct edl_event_hdr *)(skb->data);
-	if (!edl) {
-		bt_dev_err(hdev, "TLV with no header");
-		err = -EILSEQ;
-		goto out;
-	}
 
 	if (edl->cresp != EDL_CMD_REQ_RES_EVT || edl->rtype != rtype) {
 		bt_dev_err(hdev, "QCA TLV with error stat 0x%x rtype 0x%x",
@@ -510,6 +597,19 @@
 					   config->fwname, ret);
 				return ret;
 			}
+		}
+		/* If the board-specific file is missing, try loading the default
+		 * one, unless that was attempted already.
+		 */
+		else if (config->type == TLV_TYPE_NVM &&
+			 qca_get_alt_nvm_file(config->fwname, sizeof(config->fwname))) {
+			bt_dev_info(hdev, "QCA Downloading %s", config->fwname);
+			ret = request_firmware(&fw, config->fwname, &hdev->dev);
+			if (ret) {
+				bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
+					   config->fwname, ret);
+				return ret;
+			}
 		} else {
 			bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
 				   config->fwname, ret);
@@ -529,7 +629,9 @@
 	memcpy(data, fw->data, size);
 	release_firmware(fw);
 
-	qca_tlv_check_data(hdev, config, data, soc_type);
+	ret = qca_tlv_check_data(hdev, config, data, size, soc_type);
+	if (ret)
+		goto out;
 
 	segment = data;
 	remain = size;
@@ -612,28 +714,77 @@
 }
 EXPORT_SYMBOL_GPL(qca_set_bdaddr_rome);
 
-static void qca_generate_hsp_nvm_name(char *fwname, size_t max_size,
+static int qca_check_bdaddr(struct hci_dev *hdev, const struct qca_fw_config *config)
+{
+	struct hci_rp_read_bd_addr *bda;
+	struct sk_buff *skb;
+	int err;
+
+	if (bacmp(&hdev->public_addr, BDADDR_ANY))
+		return 0;
+
+	skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
+			     HCI_INIT_TIMEOUT);
+	if (IS_ERR(skb)) {
+		err = PTR_ERR(skb);
+		bt_dev_err(hdev, "Failed to read device address (%d)", err);
+		return err;
+	}
+
+	if (skb->len != sizeof(*bda)) {
+		bt_dev_err(hdev, "Device address length mismatch");
+		kfree_skb(skb);
+		return -EIO;
+	}
+
+	bda = (struct hci_rp_read_bd_addr *)skb->data;
+	if (!bacmp(&bda->bdaddr, &config->bdaddr))
+		set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
+
+	kfree_skb(skb);
+
+	return 0;
+}
+
+static void qca_get_nvm_name_by_board(char *fwname, size_t max_size,
+		const char *stem, enum qca_btsoc_type soc_type,
 		struct qca_btsoc_version ver, u8 rom_ver, u16 bid)
 {
 	const char *variant;
+	const char *prefix;
 
-	/* hsp gf chip */
-	if ((le32_to_cpu(ver.soc_id) & QCA_HSP_GF_SOC_MASK) == QCA_HSP_GF_SOC_ID)
-		variant = "g";
-	else
-		variant = "";
+	/* Set the default value to variant and prefix */
+	variant = "";
+	prefix = "b";
 
-	if (bid == 0x0)
-		snprintf(fwname, max_size, "qca/hpnv%02x%s.bin", rom_ver, variant);
-	else
-		snprintf(fwname, max_size, "qca/hpnv%02x%s.%x", rom_ver, variant, bid);
+	if (soc_type == QCA_QCA2066)
+		prefix = "";
+
+	if (soc_type == QCA_WCN6855 || soc_type == QCA_QCA2066) {
+		/* If the chip is manufactured by GlobalFoundries */
+		if ((le32_to_cpu(ver.soc_id) & QCA_HSP_GF_SOC_MASK) == QCA_HSP_GF_SOC_ID)
+			variant = "g";
+	}
+
+	if (rom_ver != 0) {
+		if (bid == 0x0 || bid == 0xffff)
+			snprintf(fwname, max_size, "qca/%s%02x%s.bin", stem, rom_ver, variant);
+		else
+			snprintf(fwname, max_size, "qca/%s%02x%s.%s%02x", stem, rom_ver,
+						variant, prefix, bid);
+	} else {
+		if (bid == 0x0 || bid == 0xffff)
+			snprintf(fwname, max_size, "qca/%s%s.bin", stem, variant);
+		else
+			snprintf(fwname, max_size, "qca/%s%s.%s%02x", stem, variant, prefix, bid);
+	}
 }
 
 int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 		   enum qca_btsoc_type soc_type, struct qca_btsoc_version ver,
-		   const char *firmware_name)
+		   const char *firmware_name, const char *rampatch_name)
 {
-	struct qca_fw_config config;
+	struct qca_fw_config config = {};
 	int err;
 	u8 rom_ver = 0;
 	u32 soc_ver;
@@ -655,49 +806,54 @@
 	else
 		rom_ver = ((soc_ver & 0x00000f00) >> 0x04) | (soc_ver & 0x0000000f);
 
-	if (soc_type == QCA_WCN6750)
+	if (soc_type == QCA_WCN6750) {
 		qca_send_patch_config_cmd(hdev);
+	}
 
 	/* Download rampatch file */
 	config.type = TLV_TYPE_PATCH;
-	switch (soc_type) {
-	case QCA_WCN3990:
-	case QCA_WCN3991:
-	case QCA_WCN3998:
-		snprintf(config.fwname, sizeof(config.fwname),
-			 "qca/crbtfw%02x.tlv", rom_ver);
-		break;
-	case QCA_WCN3988:
-		snprintf(config.fwname, sizeof(config.fwname),
-			 "qca/apbtfw%02x.tlv", rom_ver);
-		break;
-	case QCA_QCA2066:
-		snprintf(config.fwname, sizeof(config.fwname),
-			 "qca/hpbtfw%02x.tlv", rom_ver);
-		break;
-	case QCA_QCA6390:
-		snprintf(config.fwname, sizeof(config.fwname),
-			 "qca/htbtfw%02x.tlv", rom_ver);
-		break;
-	case QCA_WCN6750:
-		/* Choose mbn file by default.If mbn file is not found
-		 * then choose tlv file
-		 */
-		config.type = ELF_TYPE_PATCH;
-		snprintf(config.fwname, sizeof(config.fwname),
-			 "qca/msbtfw%02x.mbn", rom_ver);
-		break;
-	case QCA_WCN6855:
-		snprintf(config.fwname, sizeof(config.fwname),
-			 "qca/hpbtfw%02x.tlv", rom_ver);
-		break;
-	case QCA_WCN7850:
-		snprintf(config.fwname, sizeof(config.fwname),
-			 "qca/hmtbtfw%02x.tlv", rom_ver);
-		break;
-	default:
-		snprintf(config.fwname, sizeof(config.fwname),
-			 "qca/rampatch_%08x.bin", soc_ver);
+	if (rampatch_name) {
+		snprintf(config.fwname, sizeof(config.fwname), "qca/%s", rampatch_name);
+	} else {
+		switch (soc_type) {
+		case QCA_WCN3990:
+		case QCA_WCN3991:
+		case QCA_WCN3998:
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/crbtfw%02x.tlv", rom_ver);
+			break;
+		case QCA_WCN3988:
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/apbtfw%02x.tlv", rom_ver);
+			break;
+		case QCA_QCA2066:
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/hpbtfw%02x.tlv", rom_ver);
+			break;
+		case QCA_QCA6390:
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/htbtfw%02x.tlv", rom_ver);
+			break;
+		case QCA_WCN6750:
+			/* Choose mbn file by default.If mbn file is not found
+			 * then choose tlv file
+			 */
+			config.type = ELF_TYPE_PATCH;
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/msbtfw%02x.mbn", rom_ver);
+			break;
+		case QCA_WCN6855:
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/hpbtfw%02x.tlv", rom_ver);
+			break;
+		case QCA_WCN7850:
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/hmtbtfw%02x.tlv", rom_ver);
+			break;
+		default:
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/rampatch_%08x.bin", soc_ver);
+		}
 	}
 
 	err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
@@ -709,14 +865,20 @@
 	/* Give the controller some time to get ready to receive the NVM */
 	msleep(10);
 
-	if (soc_type == QCA_QCA2066)
+	if (soc_type == QCA_QCA2066 || soc_type == QCA_WCN7850)
 		qca_read_fw_board_id(hdev, &boardid);
 
 	/* Download NVM configuration */
 	config.type = TLV_TYPE_NVM;
 	if (firmware_name) {
-		snprintf(config.fwname, sizeof(config.fwname),
-			 "qca/%s", firmware_name);
+		/* The firmware name has an extension, use it directly */
+		if (qca_filename_has_extension(firmware_name)) {
+			snprintf(config.fwname, sizeof(config.fwname), "qca/%s", firmware_name);
+		} else {
+			qca_read_fw_board_id(hdev, &boardid);
+			qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname),
+				 firmware_name, soc_type, ver, 0, boardid);
+		}
 	} else {
 		switch (soc_type) {
 		case QCA_WCN3990:
@@ -735,8 +897,9 @@
 				 "qca/apnv%02x.bin", rom_ver);
 			break;
 		case QCA_QCA2066:
-			qca_generate_hsp_nvm_name(config.fwname,
-				sizeof(config.fwname), ver, rom_ver, boardid);
+			qca_get_nvm_name_by_board(config.fwname,
+				sizeof(config.fwname), "hpnv", soc_type, ver,
+				rom_ver, boardid);
 			break;
 		case QCA_QCA6390:
 			snprintf(config.fwname, sizeof(config.fwname),
@@ -747,14 +910,14 @@
 				 "qca/msnv%02x.bin", rom_ver);
 			break;
 		case QCA_WCN6855:
-			snprintf(config.fwname, sizeof(config.fwname),
-				 "qca/hpnv%02x.bin", rom_ver);
+			qca_read_fw_board_id(hdev, &boardid);
+			qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname),
+						  "hpnv", soc_type, ver, rom_ver, boardid);
 			break;
 		case QCA_WCN7850:
-			snprintf(config.fwname, sizeof(config.fwname),
-				 "qca/hmtnv%02x.bin", rom_ver);
+			qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname),
+				 "hmtnv", soc_type, ver, rom_ver, boardid);
 			break;
-
 		default:
 			snprintf(config.fwname, sizeof(config.fwname),
 				 "qca/nvm_%08x.bin", soc_ver);
@@ -818,6 +981,10 @@
 		break;
 	}
 
+	err = qca_check_bdaddr(hdev, &config);
+	if (err)
+		return err;
+
 	bt_dev_info(hdev, "QCA setup on UART is completed");
 
 	return 0;
@@ -826,11 +993,15 @@
 
 int qca_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 {
+	bdaddr_t bdaddr_swapped;
 	struct sk_buff *skb;
 	int err;
 
-	skb = __hci_cmd_sync_ev(hdev, EDL_WRITE_BD_ADDR_OPCODE, 6, bdaddr,
-				HCI_EV_VENDOR, HCI_INIT_TIMEOUT);
+	baswap(&bdaddr_swapped, bdaddr);
+
+	skb = __hci_cmd_sync_ev(hdev, EDL_WRITE_BD_ADDR_OPCODE, 6,
+				&bdaddr_swapped, HCI_EV_VENDOR,
+				HCI_INIT_TIMEOUT);
 	if (IS_ERR(skb)) {
 		err = PTR_ERR(skb);
 		bt_dev_err(hdev, "QCA Change address cmd failed (%d)", err);
@@ -845,6 +1016,5 @@
 
 
 MODULE_AUTHOR("Ben Young Tae Kim <ytkim@qca.qualcomm.com>");
-MODULE_DESCRIPTION("Bluetooth support for Qualcomm Atheros family ver " VERSION);
-MODULE_VERSION(VERSION);
+MODULE_DESCRIPTION("Bluetooth support for Qualcomm Atheros family");
 MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btqca.h
+++ linux-qcom-6.8.0/drivers/bluetooth/btqca.h
@@ -29,6 +29,7 @@
 #define EDL_PATCH_CONFIG_RES_EVT	(0x00)
 #define QCA_DISABLE_LOGGING_SUB_OP	(0x14)
 
+#define EDL_TAG_ID_BD_ADDR		2
 #define EDL_TAG_ID_HCI			(17)
 #define EDL_TAG_ID_DEEP_SLEEP		(27)
 
@@ -47,7 +48,6 @@
 #define get_soc_ver(soc_id, rom_ver)	\
 	((le32_to_cpu(soc_id) << 16) | (le16_to_cpu(rom_ver)))
 
-#define QCA_FW_BUILD_VER_LEN		255
 #define QCA_HSP_GF_SOC_ID			0x1200
 #define QCA_HSP_GF_SOC_MASK			0x0000ff00
 
@@ -94,6 +94,7 @@
 	uint8_t user_baud_rate;
 	enum qca_tlv_dnld_mode dnld_mode;
 	enum qca_tlv_dnld_mode dnld_type;
+	bdaddr_t bdaddr;
 };
 
 struct edl_event_hdr {
@@ -160,7 +161,7 @@
 int qca_set_bdaddr_rome(struct hci_dev *hdev, const bdaddr_t *bdaddr);
 int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 		   enum qca_btsoc_type soc_type, struct qca_btsoc_version ver,
-		   const char *firmware_name);
+		   const char *firmware_name, const char *rampatch_name);
 int qca_read_soc_version(struct hci_dev *hdev, struct qca_btsoc_version *ver,
 			 enum qca_btsoc_type);
 int qca_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr);
@@ -175,7 +176,8 @@
 static inline int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 				 enum qca_btsoc_type soc_type,
 				 struct qca_btsoc_version ver,
-				 const char *firmware_name)
+				 const char *firmware_name,
+				 const char *rampatch_name)
 {
 	return -EOPNOTSUPP;
 }
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btrsi.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btrsi.c
@@ -134,7 +134,6 @@
 		hdev->bus = HCI_USB;
 
 	hci_set_drvdata(hdev, h_adapter);
-	hdev->dev_type = HCI_PRIMARY;
 	hdev->open = rsi_hci_open;
 	hdev->close = rsi_hci_close;
 	hdev->flush = rsi_hci_flush;
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btrtl.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btrtl.c
@@ -1275,7 +1275,6 @@
 	case CHIP_ID_8852B:
 	case CHIP_ID_8852C:
 	case CHIP_ID_8851B:
-		set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
 		set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
 
 		/* RTL8852C needs to transmit mSBC data continuously without
@@ -1285,6 +1284,7 @@
 			btrealtek_set_flag(hdev, REALTEK_ALT6_CONTINUOUS_TX_CHIP);
 
 		if (btrtl_dev->project_id == CHIP_ID_8852A ||
+		    btrtl_dev->project_id == CHIP_ID_8852B ||
 		    btrtl_dev->project_id == CHIP_ID_8852C)
 			set_bit(HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER, &hdev->quirks);
 
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btsdio.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btsdio.c
@@ -32,9 +32,6 @@
 	/* Generic Bluetooth Type-B SDIO device */
 	{ SDIO_DEVICE_CLASS(SDIO_CLASS_BT_B) },
 
-	/* Generic Bluetooth AMP controller */
-	{ SDIO_DEVICE_CLASS(SDIO_CLASS_BT_AMP) },
-
 	{ }	/* Terminating entry */
 };
 
@@ -319,11 +316,6 @@
 	hdev->bus = HCI_SDIO;
 	hci_set_drvdata(hdev, data);
 
-	if (id->class == SDIO_CLASS_BT_AMP)
-		hdev->dev_type = HCI_AMP;
-	else
-		hdev->dev_type = HCI_PRIMARY;
-
 	data->hdev = hdev;
 
 	SET_HCIDEV_DEV(hdev, &func->dev);
--- linux-qcom-6.8.0.orig/drivers/bluetooth/btusb.c
+++ linux-qcom-6.8.0/drivers/bluetooth/btusb.c
@@ -14,6 +14,7 @@
 #include <linux/iopoll.h>
 #include <linux/of_device.h>
 #include <linux/of_irq.h>
+#include <linux/pci.h>
 #include <linux/suspend.h>
 #include <linux/gpio/consumer.h>
 #include <linux/debugfs.h>
@@ -407,6 +408,9 @@
 	{ USB_DEVICE(0x0cf3, 0xe700), .driver_info = BTUSB_QCA_WCN6855 |
 						     BTUSB_WIDEBAND_SPEECH |
 						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x0489, 0xe0fc), .driver_info = BTUSB_QCA_WCN6855 |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
 
 	/* Broadcom BCM2035 */
 	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
@@ -538,10 +542,14 @@
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 
 	/* Realtek 8852BE Bluetooth devices */
 	{ USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x0bda, 0x4853), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x0bda, 0x887b), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x0bda, 0xb85b), .driver_info = BTUSB_REALTEK |
@@ -552,6 +560,12 @@
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3572), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x13d3, 0x3591), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x0489, 0xe123), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 
 	/* Realtek Bluetooth devices */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
@@ -583,6 +597,9 @@
 	{ USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
 						     BTUSB_WIDEBAND_SPEECH |
 						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x0489, 0xe0cd), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
 	{ USB_DEVICE(0x0489, 0xe0e0), .driver_info = BTUSB_MEDIATEK |
 						     BTUSB_WIDEBAND_SPEECH |
 						     BTUSB_VALID_LE_STATES },
@@ -613,6 +630,9 @@
 	{ USB_DEVICE(0x0e8d, 0x0608), .driver_info = BTUSB_MEDIATEK |
 						     BTUSB_WIDEBAND_SPEECH |
 						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x13d3, 0x3606), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
 
 	/* MediaTek MT7922A Bluetooth devices */
 	{ USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK |
@@ -654,6 +674,52 @@
 	{ USB_DEVICE(0x35f5, 0x7922), .driver_info = BTUSB_MEDIATEK |
 						     BTUSB_WIDEBAND_SPEECH |
 						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x13d3, 0x3614), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x13d3, 0x3615), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x04ca, 0x38e4), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x13d3, 0x3605), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x13d3, 0x3607), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+
+	/* Additional MediaTek MT7925 Bluetooth devices */
+	{ USB_DEVICE(0x0489, 0xe111), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x0489, 0xe113), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x0489, 0xe124), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x0489, 0xe14f), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x0489, 0xe150), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x0489, 0xe151), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+	{ USB_DEVICE(0x13d3, 0x3603), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
+
+	/* Additional MediaTek MT7925 Bluetooth devices */
+	{ USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH |
+						     BTUSB_VALID_LE_STATES },
 
 	/* Additional Realtek 8723AE Bluetooth devices */
 	{ USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
@@ -854,6 +920,10 @@
 
 	int (*setup_on_usb)(struct hci_dev *hdev);
 
+	int (*suspend)(struct hci_dev *hdev);
+	int (*resume)(struct hci_dev *hdev);
+	int (*disconnect)(struct hci_dev *hdev);
+
 	int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
 	unsigned cmd_timeout_cnt;
 
@@ -1352,7 +1422,15 @@
 	if (!urb)
 		return -ENOMEM;
 
-	size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
+	if (le16_to_cpu(data->udev->descriptor.idVendor)  == 0x0a12 &&
+	    le16_to_cpu(data->udev->descriptor.idProduct) == 0x0001)
+		/* Fake CSR devices don't seem to support sort-transter */
+		size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
+	else
+		/* Use maximum HCI Event size so the USB stack handles
+		 * ZPL/short-transfer automatically.
+		 */
+		size = HCI_MAX_EVENT_SIZE;
 
 	buf = kmalloc(size, mem_flags);
 	if (!buf) {
@@ -3273,7 +3351,6 @@
 {
 	struct btusb_data *data = hci_get_drvdata(hdev);
 	u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
-	struct sk_buff *skb_cd;
 
 	switch (handle) {
 	case 0xfc6f:		/* Firmware dump from device */
@@ -3286,9 +3363,12 @@
 		 * for backward compatibility, so we have to clone the packet
 		 * extraly for the in-kernel coredump support.
 		 */
-		skb_cd = skb_clone(skb, GFP_ATOMIC);
-		if (skb_cd)
-			btmtk_process_coredump(hdev, skb_cd);
+		if (IS_ENABLED(CONFIG_DEV_COREDUMP)) {
+			struct sk_buff *skb_cd = skb_clone(skb, GFP_ATOMIC);
+
+			if (skb_cd)
+				btmtk_process_coredump(hdev, skb_cd);
+		}
 
 		fallthrough;
 	case 0x05ff:		/* Firmware debug logging 1 */
@@ -3366,6 +3446,35 @@
 	return 0;
 }
 
+#define BTUSB_EDGE_LED_COMMAND		0xfc77
+
+static void btusb_edge_set_led(struct hci_dev *hdev, bool state)
+{
+	struct sk_buff *skb;
+	u8 config_led[] = { 0x09, 0x00, 0x01, 0x01 };
+
+	if (state)
+		config_led[1] = 0x01;
+
+	skb = __hci_cmd_sync(hdev, BTUSB_EDGE_LED_COMMAND, sizeof(config_led), config_led, HCI_INIT_TIMEOUT);
+	if (IS_ERR(skb))
+		BT_ERR("%s fail to set LED (%ld)", hdev->name, PTR_ERR(skb));
+	else
+		kfree_skb(skb);
+}
+
+static int btusb_edge_post_init(struct hci_dev *hdev)
+{
+	btusb_edge_set_led(hdev, true);
+	return 0;
+}
+
+static int btusb_edge_shutdown(struct hci_dev *hdev)
+{
+	btusb_edge_set_led(hdev, false);
+	return 0;
+}
+
 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
 				    const bdaddr_t *bdaddr)
 {
@@ -3461,13 +3570,12 @@
 
 static void btusb_coredump_qca(struct hci_dev *hdev)
 {
+	int err;
 	static const u8 param[] = { 0x26 };
-	struct sk_buff *skb;
 
-	skb = __hci_cmd_sync(hdev, 0xfc0c, 1, param, HCI_CMD_TIMEOUT);
-	if (IS_ERR(skb))
-		bt_dev_err(hdev, "%s: triggle crash failed (%ld)", __func__, PTR_ERR(skb));
-	kfree_skb(skb);
+	err = __hci_cmd_send(hdev, 0xfc0c, 1, param);
+	if (err < 0)
+		bt_dev_err(hdev, "%s: triggle crash failed (%d)", __func__, err);
 }
 
 /*
@@ -4311,11 +4419,6 @@
 	hdev->bus = HCI_USB;
 	hci_set_drvdata(hdev, data);
 
-	if (id->driver_info & BTUSB_AMP)
-		hdev->dev_type = HCI_AMP;
-	else
-		hdev->dev_type = HCI_PRIMARY;
-
 	data->hdev = hdev;
 
 	SET_HCIDEV_DEV(hdev, &intf->dev);
@@ -4398,8 +4501,18 @@
 			btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED);
 	}
 
-	if (id->driver_info & BTUSB_MARVELL)
+	if (id->driver_info & BTUSB_MARVELL) {
+		struct pci_dev *pdev;
 		hdev->set_bdaddr = btusb_set_bdaddr_marvell;
+		pdev = pci_get_subsys(PCI_ANY_ID, PCI_ANY_ID, 0x1028, 0x0720, NULL);
+		if (!pdev)
+			pdev = pci_get_subsys(PCI_ANY_ID, PCI_ANY_ID, 0x1028, 0x0733, NULL);
+		if (pdev) {
+			pci_dev_put(pdev);
+			hdev->post_init = btusb_edge_post_init;
+			hdev->shutdown = btusb_edge_shutdown;
+		}
+	}
 
 	if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) &&
 	    (id->driver_info & BTUSB_MEDIATEK)) {
@@ -4481,6 +4594,9 @@
 		set_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks);
 		set_bit(HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT, &hdev->quirks);
 		set_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &hdev->quirks);
+		set_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks);
+		set_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, &hdev->quirks);
+		set_bit(HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT, &hdev->quirks);
 	}
 
 	if (!reset)
@@ -4497,8 +4613,8 @@
 	if (id->driver_info & BTUSB_WIDEBAND_SPEECH)
 		set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
 
-	if (id->driver_info & BTUSB_VALID_LE_STATES)
-		set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
+	if (!(id->driver_info & BTUSB_VALID_LE_STATES))
+		set_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks);
 
 	if (id->driver_info & BTUSB_DIGIANSWER) {
 		data->cmdreq_type = USB_TYPE_VENDOR;
@@ -4598,6 +4714,9 @@
 	if (data->diag)
 		usb_set_intfdata(data->diag, NULL);
 
+	if (data->disconnect)
+		data->disconnect(hdev);
+
 	hci_unregister_dev(hdev);
 
 	if (intf == data->intf) {
@@ -4631,8 +4750,10 @@
 
 	BT_DBG("intf %p", intf);
 
-	/* Don't suspend if there are connections */
-	if (hci_conn_count(data->hdev))
+	/* Don't auto-suspend if there are connections; external suspend calls
+	 * shall never fail.
+	 */
+	if (PMSG_IS_AUTO(message) && hci_conn_count(data->hdev))
 		return -EBUSY;
 
 	if (data->suspend_count++)
@@ -4650,6 +4771,9 @@
 
 	cancel_work_sync(&data->work);
 
+	if (data->suspend)
+		data->suspend(data->hdev);
+
 	btusb_stop_traffic(data);
 	usb_kill_anchored_urbs(&data->tx_anchor);
 
@@ -4753,6 +4877,9 @@
 			btusb_submit_isoc_urb(hdev, GFP_NOIO);
 	}
 
+	if (data->resume)
+		data->resume(hdev);
+
 	spin_lock_irq(&data->txlock);
 	play_deferred(data);
 	clear_bit(BTUSB_SUSPENDING, &data->flags);
--- linux-qcom-6.8.0.orig/drivers/bluetooth/hci_bcm4377.c
+++ linux-qcom-6.8.0/drivers/bluetooth/hci_bcm4377.c
@@ -32,7 +32,7 @@
 #define BCM4378_DEVICE_ID 0x5f69
 #define BCM4387_DEVICE_ID 0x5f71
 
-#define BCM4377_TIMEOUT 1000
+#define BCM4377_TIMEOUT msecs_to_jiffies(1000)
 
 /*
  * These devices only support DMA transactions inside a 32bit window
@@ -495,6 +495,10 @@
  *                  extended scanning
  * broken_mws_transport_config: Set to true if the chip erroneously claims to
  *                              support MWS Transport Configuration
+ * broken_le_ext_adv_report_phy: Set to true if this chip stuffs flags inside
+ *                               reserved bits of Primary/Secondary_PHY inside
+ *                               LE Extended Advertising Report events which
+ *                               have to be ignored
  * send_calibration: Optional callback to send calibration data
  * send_ptb: Callback to send "PTB" regulatory/calibration data
  */
@@ -513,6 +517,7 @@
 	unsigned long broken_ext_scan : 1;
 	unsigned long broken_mws_transport_config : 1;
 	unsigned long broken_le_coded : 1;
+	unsigned long broken_le_ext_adv_report_phy : 1;
 
 	int (*send_calibration)(struct bcm4377_data *bcm4377);
 	int (*send_ptb)(struct bcm4377_data *bcm4377,
@@ -716,7 +721,7 @@
 		ring->events[msgid] = NULL;
 	}
 
-	bitmap_release_region(ring->msgids, msgid, ring->n_entries);
+	bitmap_release_region(ring->msgids, msgid, 0);
 
 unlock:
 	spin_unlock_irqrestore(&ring->lock, flags);
@@ -2361,7 +2366,6 @@
 	bcm4377->hdev = hdev;
 
 	hdev->bus = HCI_PCI;
-	hdev->dev_type = HCI_PRIMARY;
 	hdev->open = bcm4377_hci_open;
 	hdev->close = bcm4377_hci_close;
 	hdev->send = bcm4377_hci_send_frame;
@@ -2374,6 +2378,8 @@
 		set_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &hdev->quirks);
 	if (bcm4377->hw->broken_le_coded)
 		set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks);
+	if (bcm4377->hw->broken_le_ext_adv_report_phy)
+		set_bit(HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY, &hdev->quirks);
 
 	pci_set_drvdata(pdev, bcm4377);
 	hci_set_drvdata(hdev, bcm4377);
@@ -2478,6 +2484,7 @@
 		.clear_pciecfg_subsystem_ctrl_bit19 = true,
 		.broken_mws_transport_config = true,
 		.broken_le_coded = true,
+		.broken_le_ext_adv_report_phy = true,
 		.send_calibration = bcm4387_send_calibration,
 		.send_ptb = bcm4378_send_ptb,
 	},
--- linux-qcom-6.8.0.orig/drivers/bluetooth/hci_h5.c
+++ linux-qcom-6.8.0/drivers/bluetooth/hci_h5.c
@@ -113,6 +113,7 @@
 	int (*suspend)(struct h5 *h5);
 	int (*resume)(struct h5 *h5);
 	const struct acpi_gpio_mapping *acpi_gpio_map;
+	int sizeof_priv;
 };
 
 struct h5_device_data {
@@ -863,7 +864,8 @@
 	if (IS_ERR(h5->device_wake_gpio))
 		return PTR_ERR(h5->device_wake_gpio);
 
-	return hci_uart_register_device(&h5->serdev_hu, &h5p);
+	return hci_uart_register_device_priv(&h5->serdev_hu, &h5p,
+					     h5->vnd->sizeof_priv);
 }
 
 static void h5_serdev_remove(struct serdev_device *serdev)
@@ -1070,6 +1072,7 @@
 	.suspend	= h5_btrtl_suspend,
 	.resume		= h5_btrtl_resume,
 	.acpi_gpio_map	= acpi_btrtl_gpios,
+	.sizeof_priv    = sizeof(struct btrealtek_data),
 };
 
 static const struct h5_device_data h5_data_rtl8822cs = {
--- linux-qcom-6.8.0.orig/drivers/bluetooth/hci_ldisc.c
+++ linux-qcom-6.8.0/drivers/bluetooth/hci_ldisc.c
@@ -667,11 +667,6 @@
 	if (!test_bit(HCI_UART_RESET_ON_INIT, &hu->hdev_flags))
 		set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
 
-	if (test_bit(HCI_UART_CREATE_AMP, &hu->hdev_flags))
-		hdev->dev_type = HCI_AMP;
-	else
-		hdev->dev_type = HCI_PRIMARY;
-
 	/* Only call open() for the protocol after hdev is fully initialized as
 	 * open() (or a timer/workqueue it starts) may attempt to reference it.
 	 */
@@ -722,7 +717,6 @@
 {
 	unsigned long valid_flags = BIT(HCI_UART_RAW_DEVICE) |
 				    BIT(HCI_UART_RESET_ON_INIT) |
-				    BIT(HCI_UART_CREATE_AMP) |
 				    BIT(HCI_UART_INIT_PENDING) |
 				    BIT(HCI_UART_EXT_CONFIG) |
 				    BIT(HCI_UART_VND_DETECT);
--- linux-qcom-6.8.0.orig/drivers/bluetooth/hci_qca.c
+++ linux-qcom-6.8.0/drivers/bluetooth/hci_qca.c
@@ -7,7 +7,7 @@
  *
  *  Copyright (C) 2007 Texas Instruments, Inc.
  *  Copyright (c) 2010, 2012, 2018 The Linux Foundation. All rights reserved.
- *  Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *  Copyright (c) 2023, 2024  Qualcomm Innovation Center, Inc. All rights reserved.
  *
  *  Acknowledgements:
  *  This file is based on hci_ll.c, which was...
@@ -226,7 +226,8 @@
 	struct qca_power *bt_power;
 	u32 init_speed;
 	u32 oper_speed;
-	const char *firmware_name;
+	bool bdaddr_property_broken;
+	const char *firmware_name[2];
 };
 
 static int qca_regulator_enable(struct qca_serdev *qcadev);
@@ -256,7 +257,18 @@
 	if (hu->serdev) {
 		struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
 
-		return qsd->firmware_name;
+		return qsd->firmware_name[0];
+	} else {
+		return NULL;
+	}
+}
+
+static const char *qca_get_rampatch_name(struct hci_uart *hu)
+{
+	if (hu->serdev) {
+		struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
+
+		return qsd->firmware_name[1];
 	} else {
 		return NULL;
 	}
@@ -1090,6 +1102,8 @@
 				qca->memdump_state = QCA_MEMDUMP_COLLECTED;
 				cancel_delayed_work(&qca->ctrl_memdump_timeout);
 				clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
+				clear_bit(QCA_IBS_DISABLED, &qca->flags);
+				wake_up_bit(&qca->flags, QCA_MEMDUMP_COLLECTION);
 				mutex_unlock(&qca->hci_memdump_lock);
 				return;
 			}
@@ -1167,6 +1181,7 @@
 			qca->qca_memdump = NULL;
 			qca->memdump_state = QCA_MEMDUMP_COLLECTED;
 			clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
+			wake_up_bit(&qca->flags, QCA_MEMDUMP_COLLECTION);
 		}
 
 		mutex_unlock(&qca->hci_memdump_lock);
@@ -1205,7 +1220,15 @@
 		 * vendor command).
 		 */
 
-		if (hdr->evt == HCI_EV_VENDOR)
+		/* For the WCN6750/WCN6855/WCN7850, like the WCN3990, the
+		 * vendor command for a baudrate change command isn't sent as
+		 * synchronous HCI command, the controller sends the corresponding
+		 * command complete event with the new baudrate. The event is
+		 * received and properly decoded after changing the baudrate of
+		 * the host port. It needs to be dropped.
+		 */
+
+		if (hdr->evt == HCI_EV_VENDOR || hdr->evt == HCI_EV_CMD_COMPLETE)
 			complete(&qca->drop_ev_comp);
 
 		kfree_skb(skb);
@@ -1356,10 +1379,12 @@
 	case QCA_WCN3990:
 	case QCA_WCN3991:
 	case QCA_WCN3998:
+		usleep_range(1000, 10000);
+		break;
 	case QCA_WCN6750:
 	case QCA_WCN6855:
 	case QCA_WCN7850:
-		usleep_range(1000, 10000);
+		msleep(30);
 		break;
 
 	default:
@@ -1496,6 +1521,9 @@
 
 		switch (soc_type) {
 		case QCA_WCN3990:
+		case QCA_WCN6750:
+		case QCA_WCN6855:
+		case QCA_WCN7850:
 			reinit_completion(&qca->drop_ev_comp);
 			set_bit(QCA_DROP_VENDOR_EVENT, &qca->flags);
 			break;
@@ -1530,6 +1558,9 @@
 
 		switch (soc_type) {
 		case QCA_WCN3990:
+		case QCA_WCN6750:
+		case QCA_WCN6855:
+		case QCA_WCN7850:
 			/* Wait for the controller to send the vendor event
 			 * for the baudrate change command.
 			 */
@@ -1582,7 +1613,7 @@
 	struct qca_data *qca = hu->priv;
 
 	wait_on_bit_timeout(&qca->flags, QCA_MEMDUMP_COLLECTION,
-			    TASK_UNINTERRUPTIBLE, MEMDUMP_TIMEOUT_MS);
+			    TASK_UNINTERRUPTIBLE, msecs_to_jiffies(MEMDUMP_TIMEOUT_MS));
 
 	clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
 }
@@ -1672,6 +1703,9 @@
 	struct hci_uart *hu = hci_get_drvdata(hdev);
 	bool wakeup;
 
+	if (!hu->serdev)
+		return true;
+
 	/* BT SoC attached through the serial bus is handled by the serdev driver.
 	 * So we need to use the device handle of the serdev driver to get the
 	 * status of device may wakeup.
@@ -1841,8 +1875,10 @@
 	unsigned int retries = 0;
 	enum qca_btsoc_type soc_type = qca_soc_type(hu);
 	const char *firmware_name = qca_get_firmware_name(hu);
+	const char *rampatch_name = qca_get_rampatch_name(hu);
 	int ret;
 	struct qca_btsoc_version ver;
+	struct qca_serdev *qcadev;
 	const char *soc_name;
 
 	ret = qca_check_speeds(hu);
@@ -1904,16 +1940,9 @@
 	case QCA_WCN6750:
 	case QCA_WCN6855:
 	case QCA_WCN7850:
-
-		/* Set BDA quirk bit for reading BDA value from fwnode property
-		 * only if that property exist in DT.
-		 */
-		if (fwnode_property_present(dev_fwnode(hdev->dev.parent), "local-bd-address")) {
-			set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
-			bt_dev_info(hdev, "setting quirk bit to read BDA from fwnode later");
-		} else {
-			bt_dev_dbg(hdev, "local-bd-address` is not present in the devicetree so not setting quirk bit for BDA");
-		}
+		qcadev = serdev_device_get_drvdata(hu->serdev);
+		if (qcadev->bdaddr_property_broken)
+			set_bit(HCI_QUIRK_BDADDR_PROPERTY_BROKEN, &hdev->quirks);
 
 		hci_set_aosp_capable(hdev);
 
@@ -1935,7 +1964,6 @@
 
 		qca_baudrate = qca_get_baudrate_value(speed);
 	}
-
 	switch (soc_type) {
 	case QCA_WCN3988:
 	case QCA_WCN3990:
@@ -1955,14 +1983,16 @@
 
 	/* Setup patch / NVM configurations */
 	ret = qca_uart_setup(hdev, qca_baudrate, soc_type, ver,
-			firmware_name);
+			firmware_name, rampatch_name);
 	if (!ret) {
 		clear_bit(QCA_IBS_DISABLED, &qca->flags);
 		qca_debugfs_init(hdev);
 		hu->hdev->hw_error = qca_hw_error;
 		hu->hdev->cmd_timeout = qca_cmd_timeout;
-		if (device_can_wakeup(hu->serdev->ctrl->dev.parent))
-			hu->hdev->wakeup = qca_wakeup;
+		if (hu->serdev) {
+			if (device_can_wakeup(hu->serdev->ctrl->dev.parent))
+				hu->hdev->wakeup = qca_wakeup;
+		}
 	} else if (ret == -ENOENT) {
 		/* No patch/nvm-config found, run with original fw/config */
 		set_bit(QCA_ROM_FW, &qca->flags);
@@ -2161,6 +2191,7 @@
 
 	case QCA_WCN6750:
 	case QCA_WCN6855:
+	case QCA_WCN7850:
 		gpiod_set_value_cansleep(qcadev->bt_en, 0);
 		msleep(100);
 		qca_regulator_disable(qcadev);
@@ -2288,13 +2319,16 @@
 	qcadev->serdev_hu.serdev = serdev;
 	data = device_get_match_data(&serdev->dev);
 	serdev_device_set_drvdata(serdev, qcadev);
-	device_property_read_string(&serdev->dev, "firmware-name",
-					 &qcadev->firmware_name);
+	device_property_read_string_array(&serdev->dev, "firmware-name",
+					 qcadev->firmware_name, ARRAY_SIZE(qcadev->firmware_name));
 	device_property_read_u32(&serdev->dev, "max-speed",
 				 &qcadev->oper_speed);
 	if (!qcadev->oper_speed)
 		BT_DBG("UART will pick default operating speed");
 
+	qcadev->bdaddr_property_broken = device_property_read_bool(&serdev->dev,
+			"qcom,local-bd-address-broken");
+
 	if (data)
 		qcadev->btsoc_type = data->soc_type;
 	else
@@ -2326,20 +2360,25 @@
 
 		qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
 					       GPIOD_OUT_LOW);
-		if (IS_ERR_OR_NULL(qcadev->bt_en) &&
+		if (IS_ERR(qcadev->bt_en) &&
 		    (data->soc_type == QCA_WCN6750 ||
 		     data->soc_type == QCA_WCN6855)) {
 			dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n");
-			power_ctrl_enabled = false;
+			return PTR_ERR(qcadev->bt_en);
 		}
 
+		if (!qcadev->bt_en)
+			power_ctrl_enabled = false;
+
 		qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl",
 					       GPIOD_IN);
-		if (IS_ERR_OR_NULL(qcadev->sw_ctrl) &&
+		if (IS_ERR(qcadev->sw_ctrl) &&
 		    (data->soc_type == QCA_WCN6750 ||
 		     data->soc_type == QCA_WCN6855 ||
-		     data->soc_type == QCA_WCN7850))
-			dev_warn(&serdev->dev, "failed to acquire SW_CTRL gpio\n");
+		     data->soc_type == QCA_WCN7850)) {
+			dev_err(&serdev->dev, "failed to acquire SW_CTRL gpio\n");
+			return PTR_ERR(qcadev->sw_ctrl);
+		}
 
 		qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
 		if (IS_ERR(qcadev->susclk)) {
@@ -2357,11 +2396,14 @@
 	default:
 		qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
 					       GPIOD_OUT_LOW);
-		if (IS_ERR_OR_NULL(qcadev->bt_en)) {
-			dev_warn(&serdev->dev, "failed to acquire enable gpio\n");
-			power_ctrl_enabled = false;
+		if (IS_ERR(qcadev->bt_en)) {
+			dev_err(&serdev->dev, "failed to acquire enable gpio\n");
+			return PTR_ERR(qcadev->bt_en);
 		}
 
+		if (!qcadev->bt_en)
+			power_ctrl_enabled = false;
+
 		qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
 		if (IS_ERR(qcadev->susclk)) {
 			dev_warn(&serdev->dev, "failed to acquire clk\n");
@@ -2398,8 +2440,8 @@
 			set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 				&hdev->quirks);
 
-		if (data->capabilities & QCA_CAP_VALID_LE_STATES)
-			set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
+		if (!(data->capabilities & QCA_CAP_VALID_LE_STATES))
+			set_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks);
 	}
 
 	return 0;
@@ -2440,15 +2482,27 @@
 	struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
 	struct hci_uart *hu = &qcadev->serdev_hu;
 	struct hci_dev *hdev = hu->hdev;
-	struct qca_data *qca = hu->priv;
 	const u8 ibs_wake_cmd[] = { 0xFD };
 	const u8 edl_reset_soc_cmd[] = { 0x01, 0x00, 0xFC, 0x01, 0x05 };
 
 	if (qcadev->btsoc_type == QCA_QCA6390) {
-		if (test_bit(QCA_BT_OFF, &qca->flags) ||
-		    !test_bit(HCI_RUNNING, &hdev->flags))
+		/* The purpose of sending the VSC is to reset SOC into a initial
+		 * state and the state will ensure next hdev->setup() success.
+		 * if HCI_QUIRK_NON_PERSISTENT_SETUP is set, it means that
+		 * hdev->setup() can do its job regardless of SoC state, so
+		 * don't need to send the VSC.
+		 * if HCI_SETUP is set, it means that hdev->setup() was never
+		 * invoked and the SOC is already in the initial state, so
+		 * don't also need to send the VSC.
+		 */
+		if (test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks) ||
+		    hci_dev_test_flag(hdev, HCI_SETUP))
 			return;
 
+		/* The serdev must be in open state when conrol logic arrives
+		 * here, so also fix the use-after-free issue caused by that
+		 * the serdev is flushed or wrote after it is closed.
+		 */
 		serdev_device_write_flush(serdev);
 		ret = serdev_device_write_buf(serdev, ibs_wake_cmd,
 					      sizeof(ibs_wake_cmd));
--- linux-qcom-6.8.0.orig/drivers/bluetooth/hci_serdev.c
+++ linux-qcom-6.8.0/drivers/bluetooth/hci_serdev.c
@@ -300,8 +300,9 @@
 	.write_wakeup = hci_uart_write_wakeup,
 };
 
-int hci_uart_register_device(struct hci_uart *hu,
-			     const struct hci_uart_proto *p)
+int hci_uart_register_device_priv(struct hci_uart *hu,
+			     const struct hci_uart_proto *p,
+			     int sizeof_priv)
 {
 	int err;
 	struct hci_dev *hdev;
@@ -325,7 +326,7 @@
 	set_bit(HCI_UART_PROTO_READY, &hu->flags);
 
 	/* Initialize and register HCI device */
-	hdev = hci_alloc_dev();
+	hdev = hci_alloc_dev_priv(sizeof_priv);
 	if (!hdev) {
 		BT_ERR("Can't allocate HCI device");
 		err = -ENOMEM;
@@ -365,11 +366,6 @@
 	if (test_bit(HCI_UART_EXT_CONFIG, &hu->hdev_flags))
 		set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks);
 
-	if (test_bit(HCI_UART_CREATE_AMP, &hu->hdev_flags))
-		hdev->dev_type = HCI_AMP;
-	else
-		hdev->dev_type = HCI_PRIMARY;
-
 	if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags))
 		return 0;
 
@@ -394,7 +390,7 @@
 	percpu_free_rwsem(&hu->proto_lock);
 	return err;
 }
-EXPORT_SYMBOL_GPL(hci_uart_register_device);
+EXPORT_SYMBOL_GPL(hci_uart_register_device_priv);
 
 void hci_uart_unregister_device(struct hci_uart *hu)
 {
--- linux-qcom-6.8.0.orig/drivers/bluetooth/hci_uart.h
+++ linux-qcom-6.8.0/drivers/bluetooth/hci_uart.h
@@ -37,7 +37,6 @@
 
 #define HCI_UART_RAW_DEVICE	0
 #define HCI_UART_RESET_ON_INIT	1
-#define HCI_UART_CREATE_AMP	2
 #define HCI_UART_INIT_PENDING	3
 #define HCI_UART_EXT_CONFIG	4
 #define HCI_UART_VND_DETECT	5
@@ -97,7 +96,17 @@
 
 int hci_uart_register_proto(const struct hci_uart_proto *p);
 int hci_uart_unregister_proto(const struct hci_uart_proto *p);
-int hci_uart_register_device(struct hci_uart *hu, const struct hci_uart_proto *p);
+
+int hci_uart_register_device_priv(struct hci_uart *hu,
+				  const struct hci_uart_proto *p,
+				  int sizeof_priv);
+
+static inline int hci_uart_register_device(struct hci_uart *hu,
+					   const struct hci_uart_proto *p)
+{
+	return hci_uart_register_device_priv(hu, p, 0);
+}
+
 void hci_uart_unregister_device(struct hci_uart *hu);
 
 int hci_uart_tx_wakeup(struct hci_uart *hu);
--- linux-qcom-6.8.0.orig/drivers/bluetooth/hci_vhci.c
+++ linux-qcom-6.8.0/drivers/bluetooth/hci_vhci.c
@@ -384,17 +384,10 @@
 {
 	struct hci_dev *hdev;
 	struct sk_buff *skb;
-	__u8 dev_type;
 
 	if (data->hdev)
 		return -EBADFD;
 
-	/* bits 0-1 are dev_type (Primary or AMP) */
-	dev_type = opcode & 0x03;
-
-	if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP)
-		return -EINVAL;
-
 	/* bits 2-5 are reserved (must be zero) */
 	if (opcode & 0x3c)
 		return -EINVAL;
@@ -412,7 +405,6 @@
 	data->hdev = hdev;
 
 	hdev->bus = HCI_VIRTUAL;
-	hdev->dev_type = dev_type;
 	hci_set_drvdata(hdev, data);
 
 	hdev->open  = vhci_open_dev;
@@ -433,8 +425,6 @@
 	if (opcode & 0x80)
 		set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
 
-	set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
-
 	if (hci_register_dev(hdev) < 0) {
 		BT_ERR("Can't register HCI device");
 		hci_free_dev(hdev);
@@ -634,7 +624,7 @@
 	struct vhci_data *data = container_of(work, struct vhci_data,
 					      open_timeout.work);
 
-	vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY);
+	vhci_create_device(data, 0x00);
 }
 
 static int vhci_open(struct inode *inode, struct file *file)
--- linux-qcom-6.8.0.orig/drivers/bluetooth/virtio_bt.c
+++ linux-qcom-6.8.0/drivers/bluetooth/virtio_bt.c
@@ -274,7 +274,6 @@
 
 	switch (type) {
 	case VIRTIO_BT_CONFIG_TYPE_PRIMARY:
-	case VIRTIO_BT_CONFIG_TYPE_AMP:
 		break;
 	default:
 		return -EINVAL;
@@ -303,7 +302,6 @@
 	vbt->hdev = hdev;
 
 	hdev->bus = HCI_VIRTIO;
-	hdev->dev_type = type;
 	hci_set_drvdata(hdev, vbt);
 
 	hdev->open  = virtbt_open;
--- linux-qcom-6.8.0.orig/drivers/bus/Kconfig
+++ linux-qcom-6.8.0/drivers/bus/Kconfig
@@ -186,11 +186,12 @@
 
 config TEGRA_ACONNECT
 	tristate "Tegra ACONNECT Bus Driver"
-	depends on ARCH_TEGRA_210_SOC
+	depends on ARCH_TEGRA
 	depends on OF && PM
 	help
 	  Driver for the Tegra ACONNECT bus which is used to interface with
-	  the devices inside the Audio Processing Engine (APE) for Tegra210.
+	  the devices inside the Audio Processing Engine (APE) for
+	  Tegra210 and later.
 
 config TEGRA_GMI
 	tristate "Tegra Generic Memory Interface bus driver"
--- linux-qcom-6.8.0.orig/drivers/bus/arm-integrator-lm.c
+++ linux-qcom-6.8.0/drivers/bus/arm-integrator-lm.c
@@ -85,6 +85,7 @@
 		return -ENODEV;
 	}
 	map = syscon_node_to_regmap(syscon);
+	of_node_put(syscon);
 	if (IS_ERR(map)) {
 		dev_err(dev,
 			"could not find Integrator/AP system controller\n");
--- linux-qcom-6.8.0.orig/drivers/bus/mhi/ep/main.c
+++ linux-qcom-6.8.0/drivers/bus/mhi/ep/main.c
@@ -90,7 +90,7 @@
 	struct mhi_ring_element *event;
 	int ret;
 
-	event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA);
+	event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL);
 	if (!event)
 		return -ENOMEM;
 
@@ -109,7 +109,7 @@
 	struct mhi_ring_element *event;
 	int ret;
 
-	event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA);
+	event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL);
 	if (!event)
 		return -ENOMEM;
 
@@ -127,7 +127,7 @@
 	struct mhi_ring_element *event;
 	int ret;
 
-	event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA);
+	event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL);
 	if (!event)
 		return -ENOMEM;
 
@@ -146,7 +146,7 @@
 	struct mhi_ring_element *event;
 	int ret;
 
-	event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA);
+	event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL);
 	if (!event)
 		return -ENOMEM;
 
@@ -438,7 +438,7 @@
 		read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left;
 		write_offset = len - buf_left;
 
-		buf_addr = kmem_cache_zalloc(mhi_cntrl->tre_buf_cache, GFP_KERNEL | GFP_DMA);
+		buf_addr = kmem_cache_zalloc(mhi_cntrl->tre_buf_cache, GFP_KERNEL);
 		if (!buf_addr)
 			return -ENOMEM;
 
@@ -1480,14 +1480,14 @@
 
 	mhi_cntrl->ev_ring_el_cache = kmem_cache_create("mhi_ep_event_ring_el",
 							sizeof(struct mhi_ring_element), 0,
-							SLAB_CACHE_DMA, NULL);
+							0, NULL);
 	if (!mhi_cntrl->ev_ring_el_cache) {
 		ret = -ENOMEM;
 		goto err_free_cmd;
 	}
 
 	mhi_cntrl->tre_buf_cache = kmem_cache_create("mhi_ep_tre_buf", MHI_EP_DEFAULT_MTU, 0,
-						      SLAB_CACHE_DMA, NULL);
+						      0, NULL);
 	if (!mhi_cntrl->tre_buf_cache) {
 		ret = -ENOMEM;
 		goto err_destroy_ev_ring_el_cache;
@@ -1496,7 +1496,7 @@
 	mhi_cntrl->ring_item_cache = kmem_cache_create("mhi_ep_ring_item",
 							sizeof(struct mhi_ep_ring_item), 0,
 							0, NULL);
-	if (!mhi_cntrl->ev_ring_el_cache) {
+	if (!mhi_cntrl->ring_item_cache) {
 		ret = -ENOMEM;
 		goto err_destroy_tre_buf_cache;
 	}
--- linux-qcom-6.8.0.orig/drivers/bus/mhi/host/init.c
+++ linux-qcom-6.8.0/drivers/bus/mhi/host/init.c
@@ -62,6 +62,7 @@
 	[MHI_PM_STATE_FW_DL_ERR] = "Firmware Download Error",
 	[MHI_PM_STATE_SYS_ERR_DETECT] = "SYS ERROR Detect",
 	[MHI_PM_STATE_SYS_ERR_PROCESS] = "SYS ERROR Process",
+	[MHI_PM_STATE_SYS_ERR_FAIL] = "SYS ERROR Failure",
 	[MHI_PM_STATE_SHUTDOWN_PROCESS] = "SHUTDOWN Process",
 	[MHI_PM_STATE_LD_ERR_FATAL_DETECT] = "Linkdown or Error Fatal Detect",
 };
--- linux-qcom-6.8.0.orig/drivers/bus/mhi/host/internal.h
+++ linux-qcom-6.8.0/drivers/bus/mhi/host/internal.h
@@ -88,6 +88,7 @@
 	MHI_PM_STATE_FW_DL_ERR,
 	MHI_PM_STATE_SYS_ERR_DETECT,
 	MHI_PM_STATE_SYS_ERR_PROCESS,
+	MHI_PM_STATE_SYS_ERR_FAIL,
 	MHI_PM_STATE_SHUTDOWN_PROCESS,
 	MHI_PM_STATE_LD_ERR_FATAL_DETECT,
 	MHI_PM_STATE_MAX
@@ -104,14 +105,16 @@
 #define MHI_PM_FW_DL_ERR				BIT(7)
 #define MHI_PM_SYS_ERR_DETECT				BIT(8)
 #define MHI_PM_SYS_ERR_PROCESS				BIT(9)
-#define MHI_PM_SHUTDOWN_PROCESS				BIT(10)
+#define MHI_PM_SYS_ERR_FAIL				BIT(10)
+#define MHI_PM_SHUTDOWN_PROCESS				BIT(11)
 /* link not accessible */
-#define MHI_PM_LD_ERR_FATAL_DETECT			BIT(11)
+#define MHI_PM_LD_ERR_FATAL_DETECT			BIT(12)
 
 #define MHI_REG_ACCESS_VALID(pm_state)			((pm_state & (MHI_PM_POR | MHI_PM_M0 | \
 						MHI_PM_M2 | MHI_PM_M3_ENTER | MHI_PM_M3_EXIT | \
 						MHI_PM_SYS_ERR_DETECT | MHI_PM_SYS_ERR_PROCESS | \
-						MHI_PM_SHUTDOWN_PROCESS | MHI_PM_FW_DL_ERR)))
+						MHI_PM_SYS_ERR_FAIL | MHI_PM_SHUTDOWN_PROCESS |  \
+						MHI_PM_FW_DL_ERR)))
 #define MHI_PM_IN_ERROR_STATE(pm_state)			(pm_state >= MHI_PM_FW_DL_ERR)
 #define MHI_PM_IN_FATAL_STATE(pm_state)			(pm_state == MHI_PM_LD_ERR_FATAL_DETECT)
 #define MHI_DB_ACCESS_VALID(mhi_cntrl)			(mhi_cntrl->pm_state & mhi_cntrl->db_access)
--- linux-qcom-6.8.0.orig/drivers/bus/mhi/host/pci_generic.c
+++ linux-qcom-6.8.0/drivers/bus/mhi/host/pci_generic.c
@@ -239,6 +239,19 @@
 		.channel = ch_num,		\
 	}
 
+static const struct mhi_channel_config modem_qcom_v2_mhi_channels[] = {
+	MHI_CHANNEL_CONFIG_UL(46, "IP_SW0", 2048, 1),
+	MHI_CHANNEL_CONFIG_DL(47, "IP_SW0", 2048, 2),
+};
+
+static struct mhi_event_config modem_qcom_v2_mhi_events[] = {
+	/* first ring is control+data ring */
+	MHI_EVENT_CONFIG_CTRL(0, 64),
+	/* Software channels dedicated event ring */
+	MHI_EVENT_CONFIG_SW_DATA(1, 64),
+	MHI_EVENT_CONFIG_SW_DATA(2, 64),
+};
+
 static const struct mhi_channel_config modem_qcom_v1_mhi_channels[] = {
 	MHI_CHANNEL_CONFIG_UL(4, "DIAG", 16, 1),
 	MHI_CHANNEL_CONFIG_DL(5, "DIAG", 16, 1),
@@ -279,6 +292,15 @@
 	.event_cfg = modem_qcom_v1_mhi_events,
 };
 
+static const struct mhi_controller_config modem_qcom_v3_mhiv_config = {
+	.max_channels = 128,
+	.timeout_ms = 8000,
+	.num_channels = ARRAY_SIZE(modem_qcom_v2_mhi_channels),
+	.ch_cfg = modem_qcom_v2_mhi_channels,
+	.num_events = ARRAY_SIZE(modem_qcom_v2_mhi_events),
+	.event_cfg = modem_qcom_v2_mhi_events,
+};
+
 static const struct mhi_controller_config modem_qcom_v1_mhiv_config = {
 	.max_channels = 128,
 	.timeout_ms = 8000,
@@ -295,6 +317,14 @@
 	.config = &modem_qcom_v2_mhiv_config,
 	.bar_num = MHI_PCI_DEFAULT_BAR_NUM,
 	.dma_data_width = 32,
+};
+
+static const struct mhi_pci_dev_info mhi_qcom_sa8775p_info = {
+	.name = "qcom-sa8775p",
+	.config = &modem_qcom_v3_mhiv_config,
+	.bar_num = MHI_PCI_DEFAULT_BAR_NUM,
+	.dma_data_width = 32,
+	.mru_default = 32768,
 	.sideband_wake = false,
 };
 
@@ -598,8 +628,19 @@
 	.mru_default = 32768,
 };
 
+static const struct mhi_pci_dev_info mhi_telit_fe990a_info = {
+	.name = "telit-fe990a",
+	.config = &modem_telit_fn990_config,
+	.bar_num = MHI_PCI_DEFAULT_BAR_NUM,
+	.dma_data_width = 32,
+	.sideband_wake = false,
+	.mru_default = 32768,
+};
+
 /* Keep the list sorted based on the PID. New VID should be added as the last entry */
 static const struct pci_device_id mhi_pci_id_table[] = {
+	{PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0116),
+		.driver_data = (kernel_ulong_t) &mhi_qcom_sa8775p_info },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0304),
 		.driver_data = (kernel_ulong_t) &mhi_qcom_sdx24_info },
 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0306, PCI_VENDOR_ID_QCOM, 0x010c),
@@ -615,9 +656,9 @@
 	/* Telit FN990 */
 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, 0x1c5d, 0x2010),
 		.driver_data = (kernel_ulong_t) &mhi_telit_fn990_info },
-	/* Telit FE990 */
+	/* Telit FE990A */
 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, 0x1c5d, 0x2015),
-		.driver_data = (kernel_ulong_t) &mhi_telit_fn990_info },
+		.driver_data = (kernel_ulong_t) &mhi_telit_fe990a_info },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0308),
 		.driver_data = (kernel_ulong_t) &mhi_qcom_sdx65_info },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0309),
--- linux-qcom-6.8.0.orig/drivers/bus/mhi/host/pm.c
+++ linux-qcom-6.8.0/drivers/bus/mhi/host/pm.c
@@ -36,7 +36,10 @@
  *     M0 <--> M0
  *     M0 -> FW_DL_ERR
  *     M0 -> M3_ENTER -> M3 -> M3_EXIT --> M0
- * L1: SYS_ERR_DETECT -> SYS_ERR_PROCESS --> POR
+ * L1: SYS_ERR_DETECT -> SYS_ERR_PROCESS
+ *     SYS_ERR_PROCESS -> SYS_ERR_FAIL
+ *     SYS_ERR_FAIL -> SYS_ERR_DETECT
+ *     SYS_ERR_PROCESS --> POR
  * L2: SHUTDOWN_PROCESS -> LD_ERR_FATAL_DETECT
  *     SHUTDOWN_PROCESS -> DISABLE
  * L3: LD_ERR_FATAL_DETECT <--> LD_ERR_FATAL_DETECT
@@ -93,7 +96,12 @@
 	},
 	{
 		MHI_PM_SYS_ERR_PROCESS,
-		MHI_PM_POR | MHI_PM_SHUTDOWN_PROCESS |
+		MHI_PM_POR | MHI_PM_SYS_ERR_FAIL | MHI_PM_SHUTDOWN_PROCESS |
+		MHI_PM_LD_ERR_FATAL_DETECT
+	},
+	{
+		MHI_PM_SYS_ERR_FAIL,
+		MHI_PM_SYS_ERR_DETECT | MHI_PM_SHUTDOWN_PROCESS |
 		MHI_PM_LD_ERR_FATAL_DETECT
 	},
 	/* L2 States */
@@ -629,7 +637,13 @@
 					!in_reset, timeout);
 		if (!ret || in_reset) {
 			dev_err(dev, "Device failed to exit MHI Reset state\n");
-			goto exit_sys_error_transition;
+			write_lock_irq(&mhi_cntrl->pm_lock);
+			cur_state = mhi_tryset_pm_state(mhi_cntrl,
+							MHI_PM_SYS_ERR_FAIL);
+			write_unlock_irq(&mhi_cntrl->pm_lock);
+			/* Shutdown may have occurred, otherwise cleanup now */
+			if (cur_state != MHI_PM_SYS_ERR_FAIL)
+				goto exit_sys_error_transition;
 		}
 
 		/*
--- linux-qcom-6.8.0.orig/drivers/cdrom/cdrom.c
+++ linux-qcom-6.8.0/drivers/cdrom/cdrom.c
@@ -282,7 +282,7 @@
 /* default compatibility mode */
 static bool autoclose=1;
 static bool autoeject;
-static bool lockdoor = 1;
+static bool lockdoor = 0;
 /* will we ever get to use this... sigh. */
 static bool check_media_type;
 /* automatically restart mrw format */
@@ -2313,7 +2313,7 @@
 		return -EINVAL;
 
 	/* Prevent arg from speculatively bypassing the length check */
-	barrier_nospec();
+	arg = array_index_nospec(arg, cdi->capacity);
 
 	info = kmalloc(sizeof(*info), GFP_KERNEL);
 	if (!info)
@@ -2358,7 +2358,7 @@
 		return -EFAULT;
 
 	tmp_info.media_flags = 0;
-	if (tmp_info.last_media_change - cdi->last_media_change_ms < 0)
+	if (cdi->last_media_change_ms > tmp_info.last_media_change)
 		tmp_info.media_flags |= MEDIA_CHANGED_FLAG;
 
 	tmp_info.last_media_change = cdi->last_media_change_ms;
--- linux-qcom-6.8.0.orig/drivers/char/Kconfig
+++ linux-qcom-6.8.0/drivers/char/Kconfig
@@ -410,6 +410,14 @@
 
 source "drivers/char/xillybus/Kconfig"
 
+config MSM_RDBG
+	tristate "QTI Remote debug driver"
+	help
+	Implements a shared memory based transport mechanism that allows
+	for a debugger running on a host PC to communicate with a remote
+	stub running on peripheral subsystems such as the ADSP, MODEM etc.
+		Say M if you want to enable this module.
+
 config ADI
 	tristate "SPARC Privileged ADI driver"
 	depends on SPARC64
--- linux-qcom-6.8.0.orig/drivers/char/Makefile
+++ linux-qcom-6.8.0/drivers/char/Makefile
@@ -43,3 +43,4 @@
 obj-$(CONFIG_XILLYBUS_CLASS)	+= xillybus/
 obj-$(CONFIG_POWERNV_OP_PANEL)	+= powernv-op-panel.o
 obj-$(CONFIG_ADI)		+= adi.o
+obj-$(CONFIG_MSM_RDBG)		+= rdbg.o
--- linux-qcom-6.8.0.orig/drivers/char/hpet.c
+++ linux-qcom-6.8.0/drivers/char/hpet.c
@@ -270,8 +270,13 @@
 	if (!devp->hd_ireqfreq)
 		return -EIO;
 
-	if (count < sizeof(unsigned long))
-		return -EINVAL;
+	if (in_compat_syscall()) {
+		if (count < sizeof(compat_ulong_t))
+			return -EINVAL;
+	} else {
+		if (count < sizeof(unsigned long))
+			return -EINVAL;
+	}
 
 	add_wait_queue(&devp->hd_waitqueue, &wait);
 
@@ -295,9 +300,16 @@
 		schedule();
 	}
 
-	retval = put_user(data, (unsigned long __user *)buf);
-	if (!retval)
-		retval = sizeof(unsigned long);
+	if (in_compat_syscall()) {
+		retval = put_user(data, (compat_ulong_t __user *)buf);
+		if (!retval)
+			retval = sizeof(compat_ulong_t);
+	} else {
+		retval = put_user(data, (unsigned long __user *)buf);
+		if (!retval)
+			retval = sizeof(unsigned long);
+	}
+
 out:
 	__set_current_state(TASK_RUNNING);
 	remove_wait_queue(&devp->hd_waitqueue, &wait);
@@ -652,12 +664,24 @@
 	unsigned short hi_timer;
 };
 
+/* 32-bit types would lead to different command codes which should be
+ * translated into 64-bit ones before passed to hpet_ioctl_common
+ */
+#define COMPAT_HPET_INFO       _IOR('h', 0x03, struct compat_hpet_info)
+#define COMPAT_HPET_IRQFREQ    _IOW('h', 0x6, compat_ulong_t)
+
 static long
 hpet_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	struct hpet_info info;
 	int err;
 
+	if (cmd == COMPAT_HPET_INFO)
+		cmd = HPET_INFO;
+
+	if (cmd == COMPAT_HPET_IRQFREQ)
+		cmd = HPET_IRQFREQ;
+
 	mutex_lock(&hpet_mutex);
 	err = hpet_ioctl_common(file->private_data, cmd, arg, &info);
 	mutex_unlock(&hpet_mutex);
--- linux-qcom-6.8.0.orig/drivers/char/hw_random/amd-rng.c
+++ linux-qcom-6.8.0/drivers/char/hw_random/amd-rng.c
@@ -143,8 +143,10 @@
 
 found:
 	err = pci_read_config_dword(pdev, 0x58, &pmbase);
-	if (err)
+	if (err) {
+		err = pcibios_err_to_errno(err);
 		goto put_dev;
+	}
 
 	pmbase &= 0x0000FF00;
 	if (pmbase == 0) {
--- linux-qcom-6.8.0.orig/drivers/char/hw_random/bcm2835-rng.c
+++ linux-qcom-6.8.0/drivers/char/hw_random/bcm2835-rng.c
@@ -94,8 +94,10 @@
 		return ret;
 
 	ret = reset_control_reset(priv->reset);
-	if (ret)
+	if (ret) {
+		clk_disable_unprepare(priv->clk);
 		return ret;
+	}
 
 	if (priv->mask_interrupts) {
 		/* mask the interrupt */
--- linux-qcom-6.8.0.orig/drivers/char/hw_random/cctrng.c
+++ linux-qcom-6.8.0/drivers/char/hw_random/cctrng.c
@@ -622,6 +622,7 @@
 	/* wait for Cryptocell reset completion */
 	if (!cctrng_wait_for_reset_completion(drvdata)) {
 		dev_err(dev, "Cryptocell reset not completed");
+		clk_disable_unprepare(drvdata->clk);
 		return -EBUSY;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/char/hw_random/core.c
+++ linux-qcom-6.8.0/drivers/char/hw_random/core.c
@@ -174,7 +174,6 @@
 	reinit_completion(&rng->cleanup_done);
 
 skip_init:
-	rng->quality = min_t(u16, min_t(u16, default_quality, 1024), rng->quality ?: 1024);
 	current_quality = rng->quality; /* obsolete */
 
 	return 0;
@@ -563,6 +562,9 @@
 	complete(&rng->cleanup_done);
 	init_completion(&rng->dying);
 
+	/* Adjust quality field to always have a proper value */
+	rng->quality = min_t(u16, min_t(u16, default_quality, 1024), rng->quality ?: 1024);
+
 	if (!current_rng ||
 	    (!cur_rng_set_by_user && rng->quality > current_rng->quality)) {
 		/*
--- linux-qcom-6.8.0.orig/drivers/char/hw_random/mtk-rng.c
+++ linux-qcom-6.8.0/drivers/char/hw_random/mtk-rng.c
@@ -142,7 +142,7 @@
 	dev_set_drvdata(&pdev->dev, priv);
 	pm_runtime_set_autosuspend_delay(&pdev->dev, RNG_AUTOSUSPEND_TIMEOUT);
 	pm_runtime_use_autosuspend(&pdev->dev);
-	pm_runtime_enable(&pdev->dev);
+	devm_pm_runtime_enable(&pdev->dev);
 
 	dev_info(&pdev->dev, "registered RNG driver\n");
 
--- linux-qcom-6.8.0.orig/drivers/char/hw_random/stm32-rng.c
+++ linux-qcom-6.8.0/drivers/char/hw_random/stm32-rng.c
@@ -220,7 +220,8 @@
 				if (err && i > RNG_NB_RECOVER_TRIES) {
 					dev_err((struct device *)priv->rng.priv,
 						"Couldn't recover from seed error\n");
-					return -ENOTRECOVERABLE;
+					retval = -ENOTRECOVERABLE;
+					goto exit_rpm;
 				}
 
 				continue;
@@ -238,7 +239,8 @@
 			if (err && i > RNG_NB_RECOVER_TRIES) {
 				dev_err((struct device *)priv->rng.priv,
 					"Couldn't recover from seed error");
-				return -ENOTRECOVERABLE;
+				retval = -ENOTRECOVERABLE;
+				goto exit_rpm;
 			}
 
 			continue;
@@ -250,6 +252,7 @@
 		max -= sizeof(u32);
 	}
 
+exit_rpm:
 	pm_runtime_mark_last_busy((struct device *) priv->rng.priv);
 	pm_runtime_put_sync_autosuspend((struct device *) priv->rng.priv);
 
@@ -353,13 +356,15 @@
 	err = readl_relaxed_poll_timeout_atomic(priv->base + RNG_SR, reg,
 						reg & RNG_SR_DRDY,
 						10, 100000);
-	if (err | (reg & ~RNG_SR_DRDY)) {
+	if (err || (reg & ~RNG_SR_DRDY)) {
 		clk_disable_unprepare(priv->clk);
 		dev_err((struct device *)priv->rng.priv,
 			"%s: timeout:%x SR: %x!\n", __func__, err, reg);
 		return -EINVAL;
 	}
 
+	clk_disable_unprepare(priv->clk);
+
 	return 0;
 }
 
@@ -384,6 +389,11 @@
 static int __maybe_unused stm32_rng_suspend(struct device *dev)
 {
 	struct stm32_rng_private *priv = dev_get_drvdata(dev);
+	int err;
+
+	err = clk_prepare_enable(priv->clk);
+	if (err)
+		return err;
 
 	if (priv->data->has_cond_reset) {
 		priv->pm_conf.nscr = readl_relaxed(priv->base + RNG_NSCR);
@@ -465,6 +475,8 @@
 		writel_relaxed(reg, priv->base + RNG_CR);
 	}
 
+	clk_disable_unprepare(priv->clk);
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/char/ipmi/ssif_bmc.c
+++ linux-qcom-6.8.0/drivers/char/ipmi/ssif_bmc.c
@@ -177,13 +177,15 @@
 	unsigned long flags;
 	ssize_t ret;
 
-	if (count > sizeof(struct ipmi_ssif_msg))
+	if (count < sizeof(msg.len) ||
+	    count > sizeof(struct ipmi_ssif_msg))
 		return -EINVAL;
 
 	if (copy_from_user(&msg, buf, count))
 		return -EFAULT;
 
-	if (!msg.len || count < sizeof_field(struct ipmi_ssif_msg, len) + msg.len)
+	if (!msg.len || msg.len > IPMI_SSIF_PAYLOAD_MAX ||
+	    count < sizeof_field(struct ipmi_ssif_msg, len) + msg.len)
 		return -EINVAL;
 
 	spin_lock_irqsave(&ssif_bmc->lock, flags);
--- linux-qcom-6.8.0.orig/drivers/char/ppdev.c
+++ linux-qcom-6.8.0/drivers/char/ppdev.c
@@ -296,28 +296,35 @@
 	if (!port) {
 		pr_warn("%s: no associated port!\n", name);
 		rc = -ENXIO;
-		goto err;
+		goto err_free_name;
 	}
 
 	index = ida_alloc(&ida_index, GFP_KERNEL);
+	if (index < 0) {
+		pr_warn("%s: failed to get index!\n", name);
+		rc = index;
+		goto err_put_port;
+	}
+
 	memset(&ppdev_cb, 0, sizeof(ppdev_cb));
 	ppdev_cb.irq_func = pp_irq;
 	ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;
 	ppdev_cb.private = pp;
 	pdev = parport_register_dev_model(port, name, &ppdev_cb, index);
-	parport_put_port(port);
 
 	if (!pdev) {
 		pr_warn("%s: failed to register device!\n", name);
 		rc = -ENXIO;
 		ida_free(&ida_index, index);
-		goto err;
+		goto err_put_port;
 	}
 
 	pp->pdev = pdev;
 	pp->index = index;
 	dev_dbg(&pdev->dev, "registered pardevice\n");
-err:
+err_put_port:
+	parport_put_port(port);
+err_free_name:
 	kfree(name);
 	return rc;
 }
--- linux-qcom-6.8.0.orig/drivers/char/random.c
+++ linux-qcom-6.8.0/drivers/char/random.c
@@ -702,7 +702,7 @@
 
 static void __cold _credit_init_bits(size_t bits)
 {
-	static struct execute_work set_ready;
+	static DECLARE_WORK(set_ready, crng_set_ready);
 	unsigned int new, orig, add;
 	unsigned long flags;
 
@@ -718,8 +718,8 @@
 
 	if (orig < POOL_READY_BITS && new >= POOL_READY_BITS) {
 		crng_reseed(NULL); /* Sets crng_init to CRNG_READY under base_crng.lock. */
-		if (static_key_initialized)
-			execute_in_process_context(crng_set_ready, &set_ready);
+		if (static_key_initialized && system_unbound_wq)
+			queue_work(system_unbound_wq, &set_ready);
 		atomic_notifier_call_chain(&random_ready_notifier, 0, NULL);
 		wake_up_interruptible(&crng_init_wait);
 		kill_fasync(&fasync, SIGIO, POLL_IN);
@@ -890,8 +890,8 @@
 
 	/*
 	 * If we were initialized by the cpu or bootloader before jump labels
-	 * are initialized, then we should enable the static branch here, where
-	 * it's guaranteed that jump labels have been initialized.
+	 * or workqueues are initialized, then we should enable the static
+	 * branch here, where it's guaranteed that these have been initialized.
 	 */
 	if (!static_branch_likely(&crng_is_ready) && crng_init >= CRNG_READY)
 		crng_set_ready(NULL);
--- linux-qcom-6.8.0.orig/drivers/char/rdbg.c
+++ linux-qcom-6.8.0/drivers/char/rdbg.c
@@ -0,0 +1,1221 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2013-2021, The Linux Foundation. All rights reserved.
+ * ​​​​Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/of_gpio.h>
+#include <linux/soc/qcom/smem.h>
+#include <linux/uaccess.h>
+#include <linux/interrupt.h>
+#include <linux/soc/qcom/smem_state.h>
+#include <linux/of_irq.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+
+#define SMP2P_NUM_PROCS				16
+#define MAX_RETRIES				20
+
+#define SM_VERSION				1
+#define SM_BLOCKSIZE				128
+
+#define SMQ_MAGIC_INIT				0xFF00FF00
+#define SMQ_MAGIC_PRODUCER			(SMQ_MAGIC_INIT | 0x1)
+#define SMQ_MAGIC_CONSUMER			(SMQ_MAGIC_INIT | 0x2)
+
+#define SMEM_LC_DEBUGGER 470
+
+static DECLARE_COMPLETION(rdbg_driver_probe_done);
+
+enum SMQ_STATUS {
+	SMQ_SUCCESS    =  0,
+	SMQ_ENOMEMORY  = -1,
+	SMQ_EBADPARM   = -2,
+	SMQ_UNDERFLOW  = -3,
+	SMQ_OVERFLOW   = -4
+};
+
+enum smq_type {
+	PRODUCER = 1,
+	CONSUMER = 2,
+	INVALID  = 3
+};
+
+struct smq_block_map {
+	uint32_t index_read;
+	uint32_t num_blocks;
+	uint8_t *map;
+};
+
+struct smq_node {
+	uint16_t index_block;
+	uint16_t num_blocks;
+} __packed;
+
+struct smq_hdr {
+	uint8_t producer_version;
+	uint8_t consumer_version;
+} __packed;
+
+struct smq_out_state {
+	uint32_t init;
+	uint32_t index_check_queue_for_reset;
+	uint32_t index_sent_write;
+	uint32_t index_free_read;
+} __packed;
+
+struct smq_out {
+	struct smq_out_state s;
+	struct smq_node sent[];
+};
+
+struct smq_in_state {
+	uint32_t init;
+	uint32_t index_check_queue_for_reset_ack;
+	uint32_t index_sent_read;
+	uint32_t index_free_write;
+} __packed;
+
+struct smq_in {
+	struct smq_in_state s;
+	struct smq_node free[];
+};
+
+struct smq {
+	struct smq_hdr *hdr;
+	struct smq_out *out;
+	struct smq_in *in;
+	uint8_t *blocks;
+	uint32_t num_blocks;
+	struct mutex *lock;
+	uint32_t initialized;
+	struct smq_block_map block_map;
+	enum smq_type type;
+};
+
+struct gpio_info {
+	int gpio_base_id;
+	int irq_base_id;
+	unsigned int smem_bit;
+	struct qcom_smem_state *smem_state;
+};
+
+struct rdbg_data {
+	struct device *device;
+	struct completion work;
+	struct gpio_info in;
+	struct gpio_info out;
+	bool   device_initialized;
+	int    gpio_out_offset;
+	bool   device_opened;
+	void   *smem_addr;
+	size_t smem_size;
+	struct smq    producer_smrb;
+	struct smq    consumer_smrb;
+	struct mutex  write_mutex;
+	int smp2p_data[32];
+};
+
+struct rdbg_device {
+	struct cdev cdev;
+	struct class *class;
+	dev_t dev_no;
+	int num_devices;
+	struct rdbg_data *rdbg_data;
+};
+
+static struct rdbg_device g_rdbg_instance = {
+	.class = NULL,
+	.dev_no = 0,
+	.num_devices = SMP2P_NUM_PROCS,
+	.rdbg_data = NULL,
+};
+
+struct processor_specific_info {
+	char *name;
+	unsigned int smem_buffer_addr;
+	size_t smem_buffer_size;
+};
+
+static struct processor_specific_info proc_info[SMP2P_NUM_PROCS] = {
+		{0},	/*APPS*/
+		{"rdbg_modem", 0, 0},	/*MODEM*/
+		{"rdbg_adsp", SMEM_LC_DEBUGGER, 16*1024},	/*ADSP*/
+		{0},	/*SMP2P_RESERVED_PROC_1*/
+		{"rdbg_wcnss", 0, 0},		/*WCNSS*/
+		{"rdbg_cdsp", SMEM_LC_DEBUGGER, 16*1024},		/*CDSP*/
+		{NULL},	/*SMP2P_POWER_PROC*/
+		{NULL},	/*SMP2P_TZ_PROC*/
+		{NULL},	/*EMPTY*/
+		{NULL},	/*EMPTY*/
+		{NULL},	/*EMPTY*/
+		{NULL},	/*EMPTY*/
+		{"rdbg_cdsp1", SMEM_LC_DEBUGGER, 16*1024},		/*CDSP1*/
+		{NULL},	/*EMPTY*/
+		{NULL},	/*EMPTY*/
+		{NULL}	/*SMP2P_REMOTE_MOCK_PROC*/
+};
+
+static int smq_blockmap_get(struct smq_block_map *block_map,
+	uint32_t *block_index, uint32_t n)
+{
+	uint32_t start;
+	uint32_t mark = 0;
+	uint32_t found = 0;
+	uint32_t i = 0;
+
+	start = block_map->index_read;
+
+	if (n == 1) {
+		do {
+			if (!block_map->map[block_map->index_read]) {
+				*block_index = block_map->index_read;
+				block_map->map[block_map->index_read] = 1;
+				block_map->index_read++;
+				block_map->index_read %= block_map->num_blocks;
+				return SMQ_SUCCESS;
+			}
+			block_map->index_read++;
+		} while (start != (block_map->index_read %=
+			block_map->num_blocks));
+	} else {
+		mark = block_map->num_blocks;
+
+		do {
+			if (!block_map->map[block_map->index_read]) {
+				if (mark > block_map->index_read) {
+					mark = block_map->index_read;
+					start = block_map->index_read;
+					found = 0;
+				}
+
+				found++;
+				if (found == n) {
+					*block_index = mark;
+					for (i = 0; i < n; i++)
+						block_map->map[mark + i] =
+							(uint8_t)(n - i);
+					block_map->index_read += block_map->map
+						[block_map->index_read] - 1;
+					return SMQ_SUCCESS;
+				}
+			} else {
+				found = 0;
+				block_map->index_read += block_map->map
+					[block_map->index_read] - 1;
+				mark = block_map->num_blocks;
+			}
+			block_map->index_read++;
+		} while (start != (block_map->index_read %=
+			block_map->num_blocks));
+	}
+
+	return SMQ_ENOMEMORY;
+}
+
+static void smq_blockmap_put(struct smq_block_map *block_map, uint32_t i)
+{
+	uint32_t num_blocks = block_map->map[i];
+
+	while (num_blocks--) {
+		block_map->map[i] = 0;
+		i++;
+	}
+}
+
+static int smq_blockmap_reset(struct smq_block_map *block_map)
+{
+	if (!block_map->map)
+		return SMQ_ENOMEMORY;
+	memset(block_map->map, 0, block_map->num_blocks + 1);
+	block_map->index_read = 0;
+
+	return SMQ_SUCCESS;
+}
+
+static int smq_blockmap_ctor(struct smq_block_map *block_map,
+	uint32_t num_blocks)
+{
+	if (num_blocks <= 1)
+		return SMQ_ENOMEMORY;
+
+	block_map->map = kcalloc(num_blocks, sizeof(uint8_t), GFP_KERNEL);
+	if (!block_map->map)
+		return SMQ_ENOMEMORY;
+
+	block_map->num_blocks = num_blocks - 1;
+	smq_blockmap_reset(block_map);
+
+	return SMQ_SUCCESS;
+}
+
+static void smq_blockmap_dtor(struct smq_block_map *block_map)
+{
+	kfree(block_map->map);
+	block_map->map = NULL;
+}
+
+static int smq_free(struct smq *smq, void *data)
+{
+	struct smq_node node;
+	uint32_t index_block;
+	int err = SMQ_SUCCESS;
+
+	if (smq->lock)
+		mutex_lock(smq->lock);
+
+	if ((smq->hdr->producer_version != SM_VERSION) &&
+		(smq->out->s.init != SMQ_MAGIC_PRODUCER)) {
+		err = SMQ_UNDERFLOW;
+		goto bail;
+	}
+
+	index_block = ((uint8_t *)data - smq->blocks) / SM_BLOCKSIZE;
+	if (index_block >= smq->num_blocks) {
+		err = SMQ_EBADPARM;
+		goto bail;
+	}
+
+	node.index_block = (uint16_t)index_block;
+	node.num_blocks = 0;
+	*((struct smq_node *)(smq->in->free +
+		smq->in->s.index_free_write)) = node;
+
+	smq->in->s.index_free_write = (smq->in->s.index_free_write + 1)
+		% smq->num_blocks;
+
+bail:
+	if (smq->lock)
+		mutex_unlock(smq->lock);
+	return err;
+}
+
+static int smq_receive(struct smq *smq, void **pp, int *pnsize, int *pbmore)
+{
+	struct smq_node *node;
+	int err = SMQ_SUCCESS;
+	int more = 0;
+
+	if ((smq->hdr->producer_version != SM_VERSION) &&
+		(smq->out->s.init != SMQ_MAGIC_PRODUCER))
+		return SMQ_UNDERFLOW;
+
+	if (smq->in->s.index_sent_read == smq->out->s.index_sent_write) {
+		err = SMQ_UNDERFLOW;
+		goto bail;
+	}
+
+	node = (struct smq_node *)(smq->out->sent + smq->in->s.index_sent_read);
+	if (node->index_block >= smq->num_blocks) {
+		err = SMQ_EBADPARM;
+		goto bail;
+	}
+
+	smq->in->s.index_sent_read = (smq->in->s.index_sent_read + 1)
+		% smq->num_blocks;
+
+	*pp = smq->blocks + (node->index_block * SM_BLOCKSIZE);
+	*pnsize = SM_BLOCKSIZE * node->num_blocks;
+
+	/*
+	 * Ensure that the reads and writes are updated in the memory
+	 * when they are done and not cached. Also, ensure that the reads
+	 * and writes are not reordered as they are shared between two cores.
+	 */
+	rmb();
+	if (smq->in->s.index_sent_read != smq->out->s.index_sent_write)
+		more = 1;
+
+bail:
+	*pbmore = more;
+	return err;
+}
+
+static int smq_alloc_send(struct smq *smq, const uint8_t *pcb, int nsize)
+{
+	void *pv = 0;
+	int num_blocks;
+	uint32_t index_block = 0;
+	int err = SMQ_SUCCESS;
+	struct smq_node *node = NULL;
+
+	mutex_lock(smq->lock);
+
+	if ((smq->in->s.init == SMQ_MAGIC_CONSUMER) &&
+	 (smq->hdr->consumer_version == SM_VERSION)) {
+		if (smq->out->s.index_check_queue_for_reset ==
+			smq->in->s.index_check_queue_for_reset_ack) {
+			while (smq->out->s.index_free_read !=
+				smq->in->s.index_free_write) {
+				node = (struct smq_node *)(
+					smq->in->free +
+					smq->out->s.index_free_read);
+				if (node->index_block >= smq->num_blocks) {
+					err = SMQ_EBADPARM;
+					goto bail;
+				}
+
+				smq->out->s.index_free_read =
+					(smq->out->s.index_free_read + 1)
+						% smq->num_blocks;
+
+				smq_blockmap_put(&smq->block_map,
+					node->index_block);
+				/*
+				 * Ensure that the reads and writes are
+				 * updated in the memory when they are done
+				 * and not cached. Also, ensure that the reads
+				 * and writes are not reordered as they are
+				 * shared between two cores.
+				 */
+				rmb();
+			}
+		}
+	}
+
+	num_blocks = ALIGN(nsize, SM_BLOCKSIZE)/SM_BLOCKSIZE;
+	err = smq_blockmap_get(&smq->block_map, &index_block, num_blocks);
+	if (err != SMQ_SUCCESS)
+		goto bail;
+
+	pv = smq->blocks + (SM_BLOCKSIZE * index_block);
+
+	err = copy_from_user((void *)pv, (void *)pcb, nsize);
+	if (err != 0)
+		goto bail;
+
+	((struct smq_node *)(smq->out->sent +
+		smq->out->s.index_sent_write))->index_block
+			= (uint16_t)index_block;
+	((struct smq_node *)(smq->out->sent +
+		smq->out->s.index_sent_write))->num_blocks
+			= (uint16_t)num_blocks;
+
+	smq->out->s.index_sent_write = (smq->out->s.index_sent_write + 1)
+		% smq->num_blocks;
+
+bail:
+	if (err != SMQ_SUCCESS) {
+		if (pv)
+			smq_blockmap_put(&smq->block_map, index_block);
+	}
+	mutex_unlock(smq->lock);
+	return err;
+}
+
+static int smq_reset_producer_queue_internal(struct smq *smq,
+	uint32_t reset_num)
+{
+	int retval = 0;
+	uint32_t i;
+
+	if (smq->type != PRODUCER)
+		goto bail;
+
+	mutex_lock(smq->lock);
+	if (smq->out->s.index_check_queue_for_reset != reset_num) {
+		smq->out->s.index_check_queue_for_reset = reset_num;
+		for (i = 0; i < smq->num_blocks; i++)
+			(smq->out->sent + i)->index_block = 0xFFFF;
+
+		smq_blockmap_reset(&smq->block_map);
+		smq->out->s.index_sent_write = 0;
+		smq->out->s.index_free_read = 0;
+		retval = 1;
+	}
+	mutex_unlock(smq->lock);
+
+bail:
+	return retval;
+}
+
+static int smq_check_queue_reset(struct smq *p_cons, struct smq *p_prod)
+{
+	int retval = 0;
+	uint32_t reset_num, i;
+
+	if ((p_cons->type != CONSUMER) ||
+		(p_cons->out->s.init != SMQ_MAGIC_PRODUCER) ||
+		(p_cons->hdr->producer_version != SM_VERSION))
+		goto bail;
+
+	reset_num = p_cons->out->s.index_check_queue_for_reset;
+	if (p_cons->in->s.index_check_queue_for_reset_ack != reset_num) {
+		p_cons->in->s.index_check_queue_for_reset_ack = reset_num;
+		for (i = 0; i < p_cons->num_blocks; i++)
+			(p_cons->in->free + i)->index_block = 0xFFFF;
+
+		p_cons->in->s.index_sent_read = 0;
+		p_cons->in->s.index_free_write = 0;
+
+		retval = smq_reset_producer_queue_internal(p_prod, reset_num);
+	}
+
+bail:
+	return retval;
+}
+
+static int check_subsystem_debug_enabled(void *base_addr, int size)
+{
+	int num_blocks;
+	uint8_t *pb_orig;
+	uint8_t *pb;
+	struct smq smq;
+	int err = 0;
+
+	pb = pb_orig = (uint8_t *)base_addr;
+	pb += sizeof(struct smq_hdr);
+	pb = PTR_ALIGN(pb, 8);
+	size -= pb - (uint8_t *)pb_orig;
+	num_blocks = (int)((size - sizeof(struct smq_out_state) -
+		sizeof(struct smq_in_state))/(SM_BLOCKSIZE +
+		sizeof(struct smq_node) * 2));
+	if (num_blocks <= 0) {
+		err = SMQ_EBADPARM;
+		goto bail;
+	}
+
+	pb += num_blocks * SM_BLOCKSIZE;
+	smq.out = (struct smq_out *)pb;
+	pb += sizeof(struct smq_out_state) + (num_blocks *
+		sizeof(struct smq_node));
+	smq.in = (struct smq_in *)pb;
+
+	if (smq.in->s.init != SMQ_MAGIC_CONSUMER) {
+		pr_err("%s, smq in consumer not initialized\n", __func__);
+		err = -ECOMM;
+	}
+
+bail:
+	return err;
+}
+
+static void smq_dtor(struct smq *smq)
+{
+	if (smq->initialized == SMQ_MAGIC_INIT) {
+		switch (smq->type) {
+		case PRODUCER:
+			smq->out->s.init = 0;
+			smq_blockmap_dtor(&smq->block_map);
+			break;
+		case CONSUMER:
+			smq->in->s.init = 0;
+			break;
+		default:
+		case INVALID:
+			break;
+		}
+
+		smq->initialized = 0;
+	}
+}
+
+/*
+ * The shared memory is used as a circular ring buffer in each direction.
+ * Thus we have a bi-directional shared memory channel between the AP
+ * and a subsystem. We call this SMQ. Each memory channel contains a header,
+ * data and a control mechanism that is used to synchronize read and write
+ * of data between the AP and the remote subsystem.
+ *
+ * Overall SMQ memory view:
+ *
+ *    +------------------------------------------------+
+ *    | SMEM buffer                                    |
+ *    |-----------------------+------------------------|
+ *    |Producer: LA           | Producer: Remote       |
+ *    |Consumer: Remote       |           subsystem    |
+ *    |          subsystem    | Consumer: LA           |
+ *    |                       |                        |
+ *    |               Producer|                Consumer|
+ *    +-----------------------+------------------------+
+ *    |                       |
+ *    |                       |
+ *    |                       +--------------------------------------+
+ *    |                                                              |
+ *    |                                                              |
+ *    v                                                              v
+ *    +--------------------------------------------------------------+
+ *    |   Header  |       Data      |            Control             |
+ *    +-----------+---+---+---+-----+----+--+--+-----+---+--+--+-----+
+ *    |           | b | b | b |     | S  |n |n |     | S |n |n |     |
+ *    |  Producer | l | l | l |     | M  |o |o |     | M |o |o |     |
+ *    |    Ver    | o | o | o |     | Q  |d |d |     | Q |d |d |     |
+ *    |-----------| c | c | c | ... |    |e |e | ... |   |e |e | ... |
+ *    |           | k | k | k |     | O  |  |  |     | I |  |  |     |
+ *    |  Consumer |   |   |   |     | u  |0 |1 |     | n |0 |1 |     |
+ *    |    Ver    | 0 | 1 | 2 |     | t  |  |  |     |   |  |  |     |
+ *    +-----------+---+---+---+-----+----+--+--+-----+---+--+--+-----+
+ *                                       |           |
+ *                                       +           |
+ *                                                   |
+ *                          +------------------------+
+ *                          |
+ *                          v
+ *                        +----+----+----+----+
+ *                        | SMQ Nodes         |
+ *                        |----|----|----|----|
+ *                 Node # |  0 |  1 |  2 | ...|
+ *                        |----|----|----|----|
+ * Starting Block Index # |  0 |  3 |  8 | ...|
+ *                        |----|----|----|----|
+ *            # of blocks |  3 |  5 |  1 | ...|
+ *                        +----+----+----+----+
+ *
+ * Header: Contains version numbers for software compatibility to ensure
+ * that both producers and consumers on the AP and subsystems know how to
+ * read from and write to the queue.
+ * Both the producer and consumer versions are 1.
+ *     +---------+-------------------+
+ *     | Size    | Field             |
+ *     +---------+-------------------+
+ *     | 1 byte  | Producer Version  |
+ *     +---------+-------------------+
+ *     | 1 byte  | Consumer Version  |
+ *     +---------+-------------------+
+ *
+ * Data: The data portion contains multiple blocks [0..N] of a fixed size.
+ * The block size SM_BLOCKSIZE is fixed to 128 bytes for header version #1.
+ * Payload sent from the debug agent app is split (if necessary) and placed
+ * in these blocks. The first data block is placed at the next 8 byte aligned
+ * address after the header.
+ *
+ * The number of blocks for a given SMEM allocation is derived as follows:
+ *   Number of Blocks = ((Total Size - Alignment - Size of Header
+ *		- Size of SMQIn - Size of SMQOut)/(SM_BLOCKSIZE))
+ *
+ * The producer maintains a private block map of each of these blocks to
+ * determine which of these blocks in the queue is available and which are free.
+ *
+ * Control:
+ * The control portion contains a list of nodes [0..N] where N is number
+ * of available data blocks. Each node identifies the data
+ * block indexes that contain a particular debug message to be transferred,
+ * and the number of blocks it took to hold the contents of the message.
+ *
+ * Each node has the following structure:
+ *     +---------+-------------------+
+ *     | Size    | Field             |
+ *     +---------+-------------------+
+ *     | 2 bytes |Staring Block Index|
+ *     +---------+-------------------+
+ *     | 2 bytes |Number of Blocks   |
+ *     +---------+-------------------+
+ *
+ * The producer and the consumer update different parts of the control channel
+ * (SMQOut / SMQIn) respectively. Each of these control data structures contains
+ * information about the last node that was written / read, and the actual nodes
+ * that were written/read.
+ *
+ * SMQOut Structure (R/W by producer, R by consumer):
+ *     +---------+-------------------+
+ *     | Size    | Field             |
+ *     +---------+-------------------+
+ *     | 4 bytes | Magic Init Number |
+ *     +---------+-------------------+
+ *     | 4 bytes | Reset             |
+ *     +---------+-------------------+
+ *     | 4 bytes | Last Sent Index   |
+ *     +---------+-------------------+
+ *     | 4 bytes | Index Free Read   |
+ *     +---------+-------------------+
+ *
+ * SMQIn Structure (R/W by consumer, R by producer):
+ *     +---------+-------------------+
+ *     | Size    | Field             |
+ *     +---------+-------------------+
+ *     | 4 bytes | Magic Init Number |
+ *     +---------+-------------------+
+ *     | 4 bytes | Reset ACK         |
+ *     +---------+-------------------+
+ *     | 4 bytes | Last Read Index   |
+ *     +---------+-------------------+
+ *     | 4 bytes | Index Free Write  |
+ *     +---------+-------------------+
+ *
+ * Magic Init Number:
+ * Both SMQ Out and SMQ In initialize this field with a predefined magic
+ * number so as to make sure that both the consumer and producer blocks
+ * have fully initialized and have valid data in the shared memory control area.
+ *	Producer Magic #: 0xFF00FF01
+ *	Consumer Magic #: 0xFF00FF02
+ */
+static int smq_ctor(struct smq *smq, void *base_addr, int size,
+	enum smq_type type, struct mutex *lock_ptr)
+{
+	int num_blocks;
+	uint8_t *pb_orig;
+	uint8_t *pb;
+	uint32_t i;
+	int err;
+
+	if (smq->initialized == SMQ_MAGIC_INIT) {
+		err = SMQ_EBADPARM;
+		goto bail;
+	}
+
+	if (!base_addr || !size) {
+		err = SMQ_EBADPARM;
+		goto bail;
+	}
+
+	if (type == PRODUCER)
+		smq->lock = lock_ptr;
+
+	pb_orig = (uint8_t *)base_addr;
+	smq->hdr = (struct smq_hdr *)pb_orig;
+	pb = pb_orig;
+	pb += sizeof(struct smq_hdr);
+	pb = PTR_ALIGN(pb, 8);
+	size -= pb - (uint8_t *)pb_orig;
+	num_blocks = (int)((size - sizeof(struct smq_out_state) -
+		sizeof(struct smq_in_state))/(SM_BLOCKSIZE +
+		sizeof(struct smq_node) * 2));
+	if (num_blocks <= 0) {
+		err = SMQ_ENOMEMORY;
+		goto bail;
+	}
+
+	smq->blocks = pb;
+	smq->num_blocks = num_blocks;
+	pb += num_blocks * SM_BLOCKSIZE;
+	smq->out = (struct smq_out *)pb;
+	pb += sizeof(struct smq_out_state) + (num_blocks *
+		sizeof(struct smq_node));
+	smq->in = (struct smq_in *)pb;
+	smq->type = type;
+	if (type == PRODUCER) {
+		smq->hdr->producer_version = SM_VERSION;
+		for (i = 0; i < smq->num_blocks; i++)
+			(smq->out->sent + i)->index_block = 0xFFFF;
+
+		err = smq_blockmap_ctor(&smq->block_map, smq->num_blocks);
+		if (err != SMQ_SUCCESS)
+			goto bail;
+
+		smq->out->s.index_sent_write = 0;
+		smq->out->s.index_free_read = 0;
+		if (smq->out->s.init == SMQ_MAGIC_PRODUCER) {
+			smq->out->s.index_check_queue_for_reset += 1;
+		} else {
+			smq->out->s.index_check_queue_for_reset = 1;
+			smq->out->s.init = SMQ_MAGIC_PRODUCER;
+		}
+	} else {
+		smq->hdr->consumer_version = SM_VERSION;
+		for (i = 0; i < smq->num_blocks; i++)
+			(smq->in->free + i)->index_block = 0xFFFF;
+
+		smq->in->s.index_sent_read = 0;
+		smq->in->s.index_free_write = 0;
+		if (smq->out->s.init == SMQ_MAGIC_PRODUCER) {
+			smq->in->s.index_check_queue_for_reset_ack =
+				smq->out->s.index_check_queue_for_reset;
+		} else {
+			smq->in->s.index_check_queue_for_reset_ack = 0;
+		}
+
+		smq->in->s.init = SMQ_MAGIC_CONSUMER;
+	}
+	smq->initialized = SMQ_MAGIC_INIT;
+	err = SMQ_SUCCESS;
+
+bail:
+	return err;
+}
+
+static void send_interrupt_to_subsystem(struct rdbg_data *rdbgdata)
+{
+	unsigned int offset = rdbgdata->gpio_out_offset;
+	unsigned int val;
+
+	val = (rdbgdata->smp2p_data[offset]) ^ (BIT(rdbgdata->out.smem_bit+offset));
+	qcom_smem_state_update_bits(rdbgdata->out.smem_state,
+			BIT(rdbgdata->out.smem_bit+offset), val);
+	rdbgdata->smp2p_data[offset] = val;
+	rdbgdata->gpio_out_offset = (offset + 1) % 32;
+}
+
+static irqreturn_t on_interrupt_from(int irq, void *ptr)
+{
+	struct rdbg_data *rdbgdata = (struct rdbg_data *) ptr;
+
+	dev_dbg(rdbgdata->device, "%s: Received interrupt %d from subsystem\n",
+		__func__, irq);
+	complete(&(rdbgdata->work));
+	return IRQ_HANDLED;
+}
+
+static int initialize_smq(struct rdbg_data *rdbgdata)
+{
+	int err = 0;
+	unsigned char *smem_consumer_buffer = rdbgdata->smem_addr;
+
+	smem_consumer_buffer += (rdbgdata->smem_size/2);
+
+	if (smq_ctor(&(rdbgdata->producer_smrb), (void *)(rdbgdata->smem_addr),
+		((rdbgdata->smem_size)/2), PRODUCER, &rdbgdata->write_mutex)) {
+		dev_err(rdbgdata->device, "%s: smq producer allocation failed\n",
+			__func__);
+		err = -ENOMEM;
+		goto bail;
+	}
+
+	if (smq_ctor(&(rdbgdata->consumer_smrb), (void *)smem_consumer_buffer,
+		((rdbgdata->smem_size)/2), CONSUMER, NULL)) {
+		dev_err(rdbgdata->device, "%s: smq consumer allocation failed\n",
+			__func__);
+		err = -ENOMEM;
+	}
+
+bail:
+	return err;
+
+}
+
+static int rdbg_open(struct inode *inode, struct file *filp)
+{
+	int device_id = -1;
+	struct rdbg_device *device = &g_rdbg_instance;
+	struct rdbg_data *rdbgdata = NULL;
+	int err = 0;
+
+	if (!inode || !device->rdbg_data) {
+		pr_err("Memory not allocated yet\n");
+		err = -ENODEV;
+		goto bail;
+	}
+
+	device_id = MINOR(inode->i_rdev);
+	rdbgdata = &device->rdbg_data[device_id];
+
+	if (rdbgdata->device_opened) {
+		dev_err(rdbgdata->device, "%s: Device already opened\n",
+			__func__);
+		err = -EEXIST;
+		goto bail;
+	}
+
+	rdbgdata->smem_size = proc_info[device_id].smem_buffer_size;
+	if (!rdbgdata->smem_size) {
+		dev_err(rdbgdata->device, "%s: smem not initialized\n",
+			 __func__);
+		err = -ENOMEM;
+		goto bail;
+	}
+
+	rdbgdata->smem_addr = qcom_smem_get(QCOM_SMEM_HOST_ANY,
+			      proc_info[device_id].smem_buffer_addr,
+			      &(rdbgdata->smem_size));
+
+	if (IS_ERR(rdbgdata->smem_addr)) {
+		pr_err("rdbg: Can't retrieve data from common SMEM region.\n"
+				"Retrieving data from device specific partition.\n");
+		if (PTR_ERR(rdbgdata->smem_addr) == -ENOENT) {
+			rdbgdata->smem_addr = qcom_smem_get(device_id,
+					proc_info[device_id].smem_buffer_addr,
+					&(rdbgdata->smem_size));
+		}
+	}
+	if (!rdbgdata->smem_addr) {
+		dev_err(rdbgdata->device, "%s: Could not allocate smem memory\n",
+			__func__);
+		err = -ENOMEM;
+		pr_err("rdbg:Could not allocate smem memory\n");
+		goto bail;
+	}
+	dev_dbg(rdbgdata->device, "%s: SMEM address=0x%lx smem_size=%d\n",
+		__func__, (unsigned long)rdbgdata->smem_addr,
+		(unsigned int)rdbgdata->smem_size);
+
+	if (check_subsystem_debug_enabled(rdbgdata->smem_addr,
+		rdbgdata->smem_size/2)) {
+		dev_err(rdbgdata->device, "%s: Subsystem %s is not debug enabled\n",
+			__func__, proc_info[device_id].name);
+		pr_err("rdbg:Sub system debug is not enabled\n");
+		err = -ECOMM;
+		goto bail;
+	}
+
+	init_completion(&rdbgdata->work);
+
+	err = request_threaded_irq(rdbgdata->in.irq_base_id, NULL,
+	      on_interrupt_from,
+	      IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+	      proc_info[device_id].name, (void *)&device->rdbg_data[device_id]);
+	if (err) {
+		dev_err(rdbgdata->device,
+			"%s: Failed to register interrupt.Err=%d,irqid=%d.\n",
+			__func__, err, rdbgdata->in.irq_base_id);
+		pr_err("rdbg : Failed to register interrupt %d\n", err);
+		goto bail;
+	}
+
+	mutex_init(&rdbgdata->write_mutex);
+
+	err = initialize_smq(rdbgdata);
+	if (err) {
+		dev_err(rdbgdata->device, "Error initializing smq. Err=%d\n",
+			err);
+		pr_err("rdbg: initialize_smq() failed with err %d\n", err);
+		goto smq_bail;
+	}
+
+	rdbgdata->device_opened = true;
+
+	filp->private_data = (void *)rdbgdata;
+	return 0;
+
+smq_bail:
+	smq_dtor(&(rdbgdata->producer_smrb));
+	smq_dtor(&(rdbgdata->consumer_smrb));
+	mutex_destroy(&rdbgdata->write_mutex);
+bail:
+	return err;
+}
+
+static int rdbg_release(struct inode *inode, struct file *filp)
+{
+	int device_id = -1;
+	struct rdbg_device *rdbgdevice = &g_rdbg_instance;
+	struct rdbg_data *rdbgdata = NULL;
+	int err = 0;
+
+	if (!inode || !rdbgdevice->rdbg_data) {
+		pr_err("Memory not allocated yet\n");
+		err = -ENODEV;
+		goto bail;
+	}
+
+	device_id = MINOR(inode->i_rdev);
+	rdbgdata = &rdbgdevice->rdbg_data[device_id];
+
+	if (rdbgdata->device_opened) {
+		dev_dbg(rdbgdata->device, "%s: Destroying %s.\n", __func__,
+			proc_info[device_id].name);
+		rdbgdata->device_opened = false;
+		complete(&(rdbgdata->work));
+		if (rdbgdevice->rdbg_data[device_id].producer_smrb.initialized)
+			smq_dtor(&(
+			rdbgdevice->rdbg_data[device_id].producer_smrb));
+		if (rdbgdevice->rdbg_data[device_id].consumer_smrb.initialized)
+			smq_dtor(&(
+			rdbgdevice->rdbg_data[device_id].consumer_smrb));
+		mutex_destroy(&rdbgdata->write_mutex);
+	}
+
+	filp->private_data = NULL;
+
+bail:
+	return err;
+}
+
+static ssize_t rdbg_read(struct file *filp, char __user *buf, size_t size,
+	loff_t *offset)
+{
+	int err = 0;
+	struct rdbg_data *rdbgdata = filp->private_data;
+	void *p_sent_buffer = NULL;
+	int nsize = 0;
+	int more = 0;
+
+	if (!rdbgdata) {
+		pr_err("Invalid argument\n");
+		err = -EINVAL;
+		goto bail;
+	}
+
+	dev_dbg(rdbgdata->device, "%s: In receive\n", __func__);
+	err = wait_for_completion_interruptible(&(rdbgdata->work));
+	if (err) {
+		dev_err(rdbgdata->device, "%s: Error in wait\n", __func__);
+		goto bail;
+	}
+
+	smq_check_queue_reset(&(rdbgdata->consumer_smrb),
+		&(rdbgdata->producer_smrb));
+	if (smq_receive(&(rdbgdata->consumer_smrb), &p_sent_buffer,
+			&nsize, &more) != SMQ_SUCCESS) {
+		dev_err(rdbgdata->device, "%s: Error in smq_recv(). Err code = %d\n",
+			__func__, err);
+		err = -ENODATA;
+		goto bail;
+	}
+	size = ((size < nsize) ? size : nsize);
+	err = copy_to_user(buf, p_sent_buffer, size);
+	if (err != 0) {
+		dev_err(rdbgdata->device, "%s: Error in copy_to_user(). Err code = %d\n",
+			__func__, err);
+		err = -ENODATA;
+		goto bail;
+	}
+	smq_free(&(rdbgdata->consumer_smrb), p_sent_buffer);
+	err = size;
+	dev_dbg(rdbgdata->device, "%s: Read data to buffer with address 0x%lx\n",
+		__func__, (unsigned long) buf);
+
+bail:
+	return err;
+}
+
+static ssize_t rdbg_write(struct file *filp, const char __user *buf,
+	size_t size, loff_t *offset)
+{
+	int err = 0;
+	int num_retries = 0;
+	struct rdbg_data *rdbgdata = filp->private_data;
+
+	if (!rdbgdata) {
+		pr_err("Invalid argument\n");
+		err = -EINVAL;
+		goto bail;
+	}
+
+	do {
+		err = smq_alloc_send(&(rdbgdata->producer_smrb), buf, size);
+		dev_dbg(rdbgdata->device, "%s, smq_alloc_send returned %d.\n",
+			__func__, err);
+	} while (err != 0 && num_retries++ < MAX_RETRIES);
+
+	if (err != 0) {
+		pr_err("rdbg: send_interrupt_to_subsystem failed\n");
+		err = -ECOMM;
+		goto bail;
+	}
+
+	send_interrupt_to_subsystem(rdbgdata);
+
+	err = size;
+
+bail:
+	return err;
+}
+
+static const struct file_operations rdbg_fops = {
+	.open = rdbg_open,
+	.read =  rdbg_read,
+	.write =  rdbg_write,
+	.release = rdbg_release,
+};
+
+static int register_smp2p_out(struct device *dev, char *node_name,
+			struct gpio_info *gpio_info_ptr)
+{
+	struct device_node *node = dev->of_node;
+
+	if (gpio_info_ptr) {
+		if (of_find_property(node, "qcom,smem-states", NULL)) {
+			gpio_info_ptr->smem_state =
+				    qcom_smem_state_get(dev, "rdbg-smp2p-out",
+						&gpio_info_ptr->smem_bit);
+			if (IS_ERR_OR_NULL(gpio_info_ptr->smem_state)) {
+				pr_err("rdbg: failed get smem state\n");
+				return PTR_ERR(gpio_info_ptr->smem_state);
+			}
+		}
+		return 0;
+	}
+	return -EINVAL;
+}
+
+static int register_smp2p_in(struct device *dev, char *node_name,
+			struct gpio_info *gpio_info_ptr)
+{
+	int id = 0;
+	struct device_node *node = dev->of_node;
+
+	if (gpio_info_ptr) {
+		id = of_irq_get_byname(node, "rdbg-smp2p-in");
+		gpio_info_ptr->gpio_base_id = id;
+		gpio_info_ptr->irq_base_id = id;
+		return 0;
+	}
+	return -EINVAL;
+}
+
+static int rdbg_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct rdbg_device *rdbgdevice = &g_rdbg_instance;
+	int minor = 0;
+	int err = 0;
+	char *rdbg_compatible_string = "qcom,smp2p-interrupt-rdbg-";
+	int max_len = strlen(rdbg_compatible_string) + strlen("xxx-out");
+	char *node_name = kcalloc(max_len, sizeof(char), GFP_KERNEL);
+
+	if (!node_name) {
+		err = -ENOMEM;
+		goto bail;
+	}
+	for (minor = 0; minor < rdbgdevice->num_devices; minor++) {
+		if (!proc_info[minor].name)
+			continue;
+		if (snprintf(node_name, max_len, "%s%d-out",
+			rdbg_compatible_string, minor) <= 0) {
+			pr_err("Error in snprintf\n");
+			err = -ENOMEM;
+			goto bail;
+		}
+
+		if (of_device_is_compatible(dev->of_node, node_name)) {
+			err = register_smp2p_out(dev, node_name,
+			&rdbgdevice->rdbg_data[minor].out);
+			if (err) {
+				pr_err("%s: register_smp2p_out failed for %s\n",
+				__func__, proc_info[minor].name);
+				goto bail;
+			}
+			rdbgdevice->rdbg_data[minor].device_initialized = true;
+		}
+		if (snprintf(node_name, max_len, "%s%d-in",
+			rdbg_compatible_string, minor) <= 0) {
+			pr_err("Error in snprintf\n");
+			err = -ENOMEM;
+			goto bail;
+		}
+
+		if (of_device_is_compatible(dev->of_node, node_name)) {
+			if (register_smp2p_in(dev, node_name,
+			    &rdbgdevice->rdbg_data[minor].in)) {
+				pr_err("register_smp2p_in failed for %s\n",
+				proc_info[minor].name);
+			}
+		}
+	}
+bail:
+	kfree(node_name);
+	complete(&rdbg_driver_probe_done);
+	return err;
+}
+
+static const struct of_device_id rdbg_match_table[] = {
+	{ .compatible = "qcom,smp2p-interrupt-rdbg-2-out", },
+	{ .compatible = "qcom,smp2p-interrupt-rdbg-2-in", },
+	{ .compatible = "qcom,smp2p-interrupt-rdbg-5-out", },
+	{ .compatible = "qcom,smp2p-interrupt-rdbg-5-in", },
+	{ .compatible = "qcom,smp2p-interrupt-rdbg-12-out", },
+	{ .compatible = "qcom,smp2p-interrupt-rdbg-12-in", },
+	{}
+};
+
+static struct platform_driver rdbg_driver = {
+	.probe = rdbg_probe,
+	.driver = {
+		.name = "rdbg",
+		.of_match_table = rdbg_match_table,
+	},
+};
+
+static int __init rdbg_init(void)
+{
+	struct rdbg_device *rdbgdevice = &g_rdbg_instance;
+	int minor = 0;
+	int major = 0;
+	int minor_nodes_created = 0;
+	int err = 0;
+
+	if (rdbgdevice->num_devices < 1 ||
+		rdbgdevice->num_devices > SMP2P_NUM_PROCS) {
+		pr_err("rgdb: invalid num_devices\n");
+		err = -EDOM;
+		goto bail;
+	}
+	rdbgdevice->rdbg_data = kcalloc(rdbgdevice->num_devices,
+		sizeof(struct rdbg_data), GFP_KERNEL);
+	if (!rdbgdevice->rdbg_data) {
+		err = -ENOMEM;
+		goto bail;
+	}
+	err = alloc_chrdev_region(&rdbgdevice->dev_no, 0,
+		rdbgdevice->num_devices, "rdbgctl");
+	if (err) {
+		pr_err("Error in alloc_chrdev_region.\n");
+		goto data_bail;
+	}
+	major = MAJOR(rdbgdevice->dev_no);
+
+	cdev_init(&rdbgdevice->cdev, &rdbg_fops);
+	rdbgdevice->cdev.owner = THIS_MODULE;
+	err = cdev_add(&rdbgdevice->cdev, MKDEV(major, 0),
+		rdbgdevice->num_devices);
+	if (err) {
+		pr_err("Error in cdev_add\n");
+		goto chrdev_bail;
+	}
+	rdbgdevice->class = class_create("rdbg");
+	if (IS_ERR(rdbgdevice->class)) {
+		err = PTR_ERR(rdbgdevice->class);
+		pr_err("Error in class_create\n");
+		goto cdev_bail;
+	}
+	err = platform_driver_register(&rdbg_driver);
+	if (err)
+		goto bail;
+	wait_for_completion(&rdbg_driver_probe_done);
+	for (minor = 0; minor < rdbgdevice->num_devices; minor++) {
+		if (!proc_info[minor].name || !rdbgdevice->rdbg_data[minor].device_initialized)
+			continue;
+		rdbgdevice->rdbg_data[minor].device = device_create(
+			rdbgdevice->class, NULL, MKDEV(major, minor),
+			NULL, "%s", proc_info[minor].name);
+		if (IS_ERR(rdbgdevice->rdbg_data[minor].device)) {
+			err = PTR_ERR(rdbgdevice->rdbg_data[minor].device);
+			pr_err("Error in device_create\n");
+			goto device_bail;
+		}
+		minor_nodes_created++;
+		dev_dbg(rdbgdevice->rdbg_data[minor].device,
+			"%s: created /dev/%s c %d %d'\n", __func__,
+			proc_info[minor].name, major, minor);
+	}
+	if (!minor_nodes_created) {
+		pr_err("No device tree entries found\n");
+		err = -EINVAL;
+		goto class_bail;
+	}
+
+	goto bail;
+
+device_bail:
+	for (--minor; minor >= 0; minor--) {
+		if (rdbgdevice->rdbg_data[minor].device_initialized)
+			device_destroy(rdbgdevice->class,
+				MKDEV(MAJOR(rdbgdevice->dev_no), minor));
+	}
+class_bail:
+	class_destroy(rdbgdevice->class);
+cdev_bail:
+	cdev_del(&rdbgdevice->cdev);
+chrdev_bail:
+	unregister_chrdev_region(rdbgdevice->dev_no, rdbgdevice->num_devices);
+data_bail:
+	kfree(rdbgdevice->rdbg_data);
+bail:
+	return err;
+}
+module_init(rdbg_init);
+
+static void __exit rdbg_exit(void)
+{
+	struct rdbg_device *rdbgdevice = &g_rdbg_instance;
+	int minor;
+
+	for (minor = 0; minor < rdbgdevice->num_devices; minor++) {
+		if (rdbgdevice->rdbg_data[minor].device_initialized) {
+			device_destroy(rdbgdevice->class,
+				MKDEV(MAJOR(rdbgdevice->dev_no), minor));
+		}
+	}
+	class_destroy(rdbgdevice->class);
+	cdev_del(&rdbgdevice->cdev);
+	unregister_chrdev_region(rdbgdevice->dev_no, 1);
+	kfree(rdbgdevice->rdbg_data);
+}
+module_exit(rdbg_exit);
+
+MODULE_DESCRIPTION("rdbg module");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/char/tpm/eventlog/common.c
+++ linux-qcom-6.8.0/drivers/char/tpm/eventlog/common.c
@@ -47,6 +47,8 @@
 	if (!err) {
 		seq = file->private_data;
 		seq->private = chip;
+	} else {
+		put_device(&chip->dev);
 	}
 
 	return err;
--- linux-qcom-6.8.0.orig/drivers/char/tpm/tpm-chip.c
+++ linux-qcom-6.8.0/drivers/char/tpm/tpm-chip.c
@@ -519,10 +519,6 @@
 {
 	struct tpm_chip *chip = container_of(rng, struct tpm_chip, hwrng);
 
-	/* Give back zero bytes, as TPM chip has not yet fully resumed: */
-	if (chip->flags & TPM_CHIP_FLAG_SUSPENDED)
-		return 0;
-
 	return tpm_get_random(chip, data, max);
 }
 
--- linux-qcom-6.8.0.orig/drivers/char/tpm/tpm-dev-common.c
+++ linux-qcom-6.8.0/drivers/char/tpm/tpm-dev-common.c
@@ -47,6 +47,8 @@
 
 	if (!ret)
 		ret = tpm2_commit_space(chip, space, buf, &len);
+	else
+		tpm2_flush_space(chip);
 
 out_rc:
 	return ret ? ret : len;
--- linux-qcom-6.8.0.orig/drivers/char/tpm/tpm-interface.c
+++ linux-qcom-6.8.0/drivers/char/tpm/tpm-interface.c
@@ -394,6 +394,13 @@
 	if (!chip)
 		return -ENODEV;
 
+	rc = tpm_try_get_ops(chip);
+	if (rc) {
+		/* Can be safely set out of locks, as no action cannot race: */
+		chip->flags |= TPM_CHIP_FLAG_SUSPENDED;
+		goto out;
+	}
+
 	if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED)
 		goto suspended;
 
@@ -401,19 +408,18 @@
 	    !pm_suspend_via_firmware())
 		goto suspended;
 
-	rc = tpm_try_get_ops(chip);
-	if (!rc) {
-		if (chip->flags & TPM_CHIP_FLAG_TPM2)
-			tpm2_shutdown(chip, TPM2_SU_STATE);
-		else
-			rc = tpm1_pm_suspend(chip, tpm_suspend_pcr);
-
-		tpm_put_ops(chip);
+	if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+		tpm2_shutdown(chip, TPM2_SU_STATE);
+		goto suspended;
 	}
 
+	rc = tpm1_pm_suspend(chip, tpm_suspend_pcr);
+
 suspended:
 	chip->flags |= TPM_CHIP_FLAG_SUSPENDED;
+	tpm_put_ops(chip);
 
+out:
 	if (rc)
 		dev_err(dev, "Ignoring error %d while suspending\n", rc);
 	return 0;
@@ -462,11 +468,18 @@
 	if (!chip)
 		return -ENODEV;
 
+	/* Give back zero bytes, as TPM chip has not yet fully resumed: */
+	if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) {
+		rc = 0;
+		goto out;
+	}
+
 	if (chip->flags & TPM_CHIP_FLAG_TPM2)
 		rc = tpm2_get_random(chip, out, max);
 	else
 		rc = tpm1_get_random(chip, out, max);
 
+out:
 	tpm_put_ops(chip);
 	return rc;
 }
--- linux-qcom-6.8.0.orig/drivers/char/tpm/tpm2-space.c
+++ linux-qcom-6.8.0/drivers/char/tpm/tpm2-space.c
@@ -166,6 +166,9 @@
 	struct tpm_space *space = &chip->work_space;
 	int i;
 
+	if (!space)
+		return;
+
 	for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++)
 		if (space->context_tbl[i] && ~space->context_tbl[i])
 			tpm2_flush_context(chip, space->context_tbl[i]);
--- linux-qcom-6.8.0.orig/drivers/char/tpm/tpm_tis_core.c
+++ linux-qcom-6.8.0/drivers/char/tpm/tpm_tis_core.c
@@ -919,8 +919,6 @@
 	int rc;
 	u32 int_status;
 
-	INIT_WORK(&priv->free_irq_work, tpm_tis_free_irq_func);
-
 	rc = devm_request_threaded_irq(chip->dev.parent, irq, NULL,
 				       tis_int_handler, IRQF_ONESHOT | flags,
 				       dev_name(&chip->dev), chip);
@@ -1022,7 +1020,8 @@
 		interrupt = 0;
 
 	tpm_tis_write32(priv, reg, ~TPM_GLOBAL_INT_ENABLE & interrupt);
-	flush_work(&priv->free_irq_work);
+	if (priv->free_irq_work.func)
+		flush_work(&priv->free_irq_work);
 
 	tpm_tis_clkrun_enable(chip, false);
 
@@ -1132,6 +1131,7 @@
 	priv->phy_ops = phy_ops;
 	priv->locality_count = 0;
 	mutex_init(&priv->locality_count_mutex);
+	INIT_WORK(&priv->free_irq_work, tpm_tis_free_irq_func);
 
 	dev_set_drvdata(&chip->dev, priv);
 
--- linux-qcom-6.8.0.orig/drivers/char/tpm/tpm_tis_spi_main.c
+++ linux-qcom-6.8.0/drivers/char/tpm/tpm_tis_spi_main.c
@@ -37,6 +37,7 @@
 #include "tpm_tis_spi.h"
 
 #define MAX_SPI_FRAMESIZE 64
+#define SPI_HDRSIZE 4
 
 /*
  * TCG SPI flow control is documented in section 6.4 of the spec[1]. In short,
@@ -247,7 +248,7 @@
 int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy,
 		     int irq, const struct tpm_tis_phy_ops *phy_ops)
 {
-	phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL);
+	phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL);
 	if (!phy->iobuf)
 		return -ENOMEM;
 
@@ -317,6 +318,7 @@
 }
 
 static const struct spi_device_id tpm_tis_spi_id[] = {
+	{ "attpm20p", (unsigned long)tpm_tis_spi_probe },
 	{ "st33htpm-spi", (unsigned long)tpm_tis_spi_probe },
 	{ "slb9670", (unsigned long)tpm_tis_spi_probe },
 	{ "tpm_tis_spi", (unsigned long)tpm_tis_spi_probe },
--- linux-qcom-6.8.0.orig/drivers/char/virtio_console.c
+++ linux-qcom-6.8.0/drivers/char/virtio_console.c
@@ -2016,25 +2016,27 @@
 		multiport = true;
 	}
 
-	err = init_vqs(portdev);
-	if (err < 0) {
-		dev_err(&vdev->dev, "Error %d initializing vqs\n", err);
-		goto free_chrdev;
-	}
-
 	spin_lock_init(&portdev->ports_lock);
 	INIT_LIST_HEAD(&portdev->ports);
 	INIT_LIST_HEAD(&portdev->list);
 
-	virtio_device_ready(portdev->vdev);
-
 	INIT_WORK(&portdev->config_work, &config_work_handler);
 	INIT_WORK(&portdev->control_work, &control_work_handler);
 
 	if (multiport) {
 		spin_lock_init(&portdev->c_ivq_lock);
 		spin_lock_init(&portdev->c_ovq_lock);
+	}
 
+	err = init_vqs(portdev);
+	if (err < 0) {
+		dev_err(&vdev->dev, "Error %d initializing vqs\n", err);
+		goto free_chrdev;
+	}
+
+	virtio_device_ready(portdev->vdev);
+
+	if (multiport) {
 		err = fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
 		if (err < 0) {
 			dev_err(&vdev->dev,
--- linux-qcom-6.8.0.orig/drivers/char/xilinx_hwicap/xilinx_hwicap.c
+++ linux-qcom-6.8.0/drivers/char/xilinx_hwicap/xilinx_hwicap.c
@@ -639,8 +639,8 @@
 	dev_set_drvdata(dev, (void *)drvdata);
 
 	drvdata->base_address = devm_platform_ioremap_resource(pdev, 0);
-	if (!drvdata->base_address) {
-		retval = -ENODEV;
+	if (IS_ERR(drvdata->base_address)) {
+		retval = PTR_ERR(drvdata->base_address);
 		goto failed;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/char/xillybus/xillyusb.c
+++ linux-qcom-6.8.0/drivers/char/xillybus/xillyusb.c
@@ -50,6 +50,7 @@
 static const char xillyname[] = "xillyusb";
 
 static unsigned int fifo_buf_order;
+static struct workqueue_struct *wakeup_wq;
 
 #define USB_VENDOR_ID_XILINX		0x03fd
 #define USB_VENDOR_ID_ALTERA		0x09fb
@@ -569,10 +570,6 @@
  * errors if executed. The mechanism relies on that xdev->error is assigned
  * a non-zero value by report_io_error() prior to queueing wakeup_all(),
  * which prevents bulk_in_work() from calling process_bulk_in().
- *
- * The fact that wakeup_all() and bulk_in_work() are queued on the same
- * workqueue makes their concurrent execution very unlikely, however the
- * kernel's API doesn't seem to ensure this strictly.
  */
 
 static void wakeup_all(struct work_struct *work)
@@ -627,7 +624,7 @@
 
 	if (do_once) {
 		kref_get(&xdev->kref); /* xdev is used by work item */
-		queue_work(xdev->workq, &xdev->wakeup_workitem);
+		queue_work(wakeup_wq, &xdev->wakeup_workitem);
 	}
 }
 
@@ -1906,6 +1903,13 @@
 
 static int xillyusb_setup_base_eps(struct xillyusb_dev *xdev)
 {
+	struct usb_device *udev = xdev->udev;
+
+	/* Verify that device has the two fundamental bulk in/out endpoints */
+	if (usb_pipe_type_check(udev, usb_sndbulkpipe(udev, MSG_EP_NUM)) ||
+	    usb_pipe_type_check(udev, usb_rcvbulkpipe(udev, IN_EP_NUM)))
+		return -ENODEV;
+
 	xdev->msg_ep = endpoint_alloc(xdev, MSG_EP_NUM | USB_DIR_OUT,
 				      bulk_out_work, 1, 2);
 	if (!xdev->msg_ep)
@@ -1935,14 +1939,15 @@
 			  __le16 *chandesc,
 			  int num_channels)
 {
-	struct xillyusb_channel *chan;
+	struct usb_device *udev = xdev->udev;
+	struct xillyusb_channel *chan, *new_channels;
 	int i;
 
 	chan = kcalloc(num_channels, sizeof(*chan), GFP_KERNEL);
 	if (!chan)
 		return -ENOMEM;
 
-	xdev->channels = chan;
+	new_channels = chan;
 
 	for (i = 0; i < num_channels; i++, chan++) {
 		unsigned int in_desc = le16_to_cpu(*chandesc++);
@@ -1971,6 +1976,15 @@
 		 */
 
 		if ((out_desc & 0x80) && i < 14) { /* Entry is valid */
+			if (usb_pipe_type_check(udev,
+						usb_sndbulkpipe(udev, i + 2))) {
+				dev_err(xdev->dev,
+					"Missing BULK OUT endpoint %d\n",
+					i + 2);
+				kfree(new_channels);
+				return -ENODEV;
+			}
+
 			chan->writable = 1;
 			chan->out_synchronous = !!(out_desc & 0x40);
 			chan->out_seekable = !!(out_desc & 0x20);
@@ -1980,6 +1994,7 @@
 		}
 	}
 
+	xdev->channels = new_channels;
 	return 0;
 }
 
@@ -2096,9 +2111,11 @@
 	 * just after responding with the IDT, there is no reason for any
 	 * work item to be running now. To be sure that xdev->channels
 	 * is updated on anything that might run in parallel, flush the
-	 * workqueue, which rarely does anything.
+	 * device's workqueue and the wakeup work item. This rarely
+	 * does anything.
 	 */
 	flush_workqueue(xdev->workq);
+	flush_work(&xdev->wakeup_workitem);
 
 	xdev->num_channels = num_channels;
 
@@ -2258,6 +2275,10 @@
 {
 	int rc = 0;
 
+	wakeup_wq = alloc_workqueue(xillyname, 0, 0);
+	if (!wakeup_wq)
+		return -ENOMEM;
+
 	if (LOG2_INITIAL_FIFO_BUF_SIZE > PAGE_SHIFT)
 		fifo_buf_order = LOG2_INITIAL_FIFO_BUF_SIZE - PAGE_SHIFT;
 	else
@@ -2265,12 +2286,17 @@
 
 	rc = usb_register(&xillyusb_driver);
 
+	if (rc)
+		destroy_workqueue(wakeup_wq);
+
 	return rc;
 }
 
 static void __exit xillyusb_exit(void)
 {
 	usb_deregister(&xillyusb_driver);
+
+	destroy_workqueue(wakeup_wq);
 }
 
 module_init(xillyusb_init);
--- linux-qcom-6.8.0.orig/drivers/clk/at91/sama7g5.c
+++ linux-qcom-6.8.0/drivers/clk/at91/sama7g5.c
@@ -66,6 +66,7 @@
 	PLL_COMPID_FRAC,
 	PLL_COMPID_DIV0,
 	PLL_COMPID_DIV1,
+	PLL_COMPID_MAX,
 };
 
 /*
@@ -165,7 +166,7 @@
 	u8 t;
 	u8 eid;
 	u8 safe_div;
-} sama7g5_plls[][PLL_ID_MAX] = {
+} sama7g5_plls[][PLL_COMPID_MAX] = {
 	[PLL_ID_CPU] = {
 		[PLL_COMPID_FRAC] = {
 			.n = "cpupll_fracck",
@@ -1038,7 +1039,7 @@
 	sama7g5_pmc->chws[PMC_MAIN] = hw;
 
 	for (i = 0; i < PLL_ID_MAX; i++) {
-		for (j = 0; j < 3; j++) {
+		for (j = 0; j < PLL_COMPID_MAX; j++) {
 			struct clk_hw *parent_hw;
 
 			if (!sama7g5_plls[i][j].n)
--- linux-qcom-6.8.0.orig/drivers/clk/bcm/clk-bcm2711-dvp.c
+++ linux-qcom-6.8.0/drivers/clk/bcm/clk-bcm2711-dvp.c
@@ -56,6 +56,8 @@
 	if (ret)
 		return ret;
 
+	data->num = NR_CLOCKS;
+
 	data->hws[0] = clk_hw_register_gate_parent_data(&pdev->dev,
 							"hdmi0-108MHz",
 							&clk_dvp_parent, 0,
@@ -76,7 +78,6 @@
 		goto unregister_clk0;
 	}
 
-	data->num = NR_CLOCKS;
 	ret = of_clk_add_hw_provider(pdev->dev.of_node, of_clk_hw_onecell_get,
 				     data);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/clk/bcm/clk-bcm53573-ilp.c
+++ linux-qcom-6.8.0/drivers/clk/bcm/clk-bcm53573-ilp.c
@@ -112,7 +112,7 @@
 		goto err_free_ilp;
 	}
 
-	ilp->regmap = syscon_node_to_regmap(of_get_parent(np));
+	ilp->regmap = syscon_node_to_regmap(np->parent);
 	if (IS_ERR(ilp->regmap)) {
 		err = PTR_ERR(ilp->regmap);
 		goto err_free_ilp;
--- linux-qcom-6.8.0.orig/drivers/clk/bcm/clk-raspberrypi.c
+++ linux-qcom-6.8.0/drivers/clk/bcm/clk-raspberrypi.c
@@ -371,8 +371,8 @@
 			if (IS_ERR(hw))
 				return PTR_ERR(hw);
 
-			data->hws[clks->id] = hw;
 			data->num = clks->id + 1;
+			data->hws[clks->id] = hw;
 		}
 
 		clks++;
--- linux-qcom-6.8.0.orig/drivers/clk/clk-apple-nco.c
+++ linux-qcom-6.8.0/drivers/clk/clk-apple-nco.c
@@ -297,6 +297,9 @@
 		memset(&init, 0, sizeof(init));
 		init.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
 						"%s-%d", np->name, i);
+		if (!init.name)
+			return -ENOMEM;
+
 		init.ops = &applnco_ops;
 		init.parent_data = &pdata;
 		init.num_parents = 1;
--- linux-qcom-6.8.0.orig/drivers/clk/clk-axi-clkgen.c
+++ linux-qcom-6.8.0/drivers/clk/clk-axi-clkgen.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/platform_device.h>
+#include <linux/clk.h>
 #include <linux/clk-provider.h>
 #include <linux/slab.h>
 #include <linux/io.h>
@@ -512,6 +513,7 @@
 	struct clk_init_data init;
 	const char *parent_names[2];
 	const char *clk_name;
+	struct clk *axi_clk;
 	unsigned int i;
 	int ret;
 
@@ -528,8 +530,24 @@
 		return PTR_ERR(axi_clkgen->base);
 
 	init.num_parents = of_clk_get_parent_count(pdev->dev.of_node);
-	if (init.num_parents < 1 || init.num_parents > 2)
-		return -EINVAL;
+
+	axi_clk = devm_clk_get_enabled(&pdev->dev, "s_axi_aclk");
+	if (!IS_ERR(axi_clk)) {
+		if (init.num_parents < 2 || init.num_parents > 3)
+			return -EINVAL;
+
+		init.num_parents -= 1;
+	} else {
+		/*
+		 * Legacy... So that old DTs which do not have clock-names still
+		 * work. In this case we don't explicitly enable the AXI bus
+		 * clock.
+		 */
+		if (PTR_ERR(axi_clk) != -ENOENT)
+			return PTR_ERR(axi_clk);
+		if (init.num_parents < 1 || init.num_parents > 2)
+			return -EINVAL;
+	}
 
 	for (i = 0; i < init.num_parents; i++) {
 		parent_names[i] = of_clk_get_parent_name(pdev->dev.of_node, i);
--- linux-qcom-6.8.0.orig/drivers/clk/clk-en7523.c
+++ linux-qcom-6.8.0/drivers/clk/clk-en7523.c
@@ -40,6 +40,7 @@
 	u8 div_shift;
 	u16 div_val0;
 	u8 div_step;
+	u8 div_offset;
 };
 
 struct en_clk_gate {
@@ -67,6 +68,7 @@
 		.div_bits = 3,
 		.div_shift = 0,
 		.div_step = 1,
+		.div_offset = 1,
 	}, {
 		.id = EN7523_CLK_EMI,
 		.name = "emi",
@@ -80,6 +82,7 @@
 		.div_bits = 3,
 		.div_shift = 0,
 		.div_step = 1,
+		.div_offset = 1,
 	}, {
 		.id = EN7523_CLK_BUS,
 		.name = "bus",
@@ -93,6 +96,7 @@
 		.div_bits = 3,
 		.div_shift = 0,
 		.div_step = 1,
+		.div_offset = 1,
 	}, {
 		.id = EN7523_CLK_SLIC,
 		.name = "slic",
@@ -133,13 +137,14 @@
 		.div_bits = 3,
 		.div_shift = 0,
 		.div_step = 1,
+		.div_offset = 1,
 	}, {
 		.id = EN7523_CLK_CRYPTO,
 		.name = "crypto",
 
 		.base_reg = REG_CRYPTO_CLKSRC,
 		.base_bits = 1,
-		.base_shift = 8,
+		.base_shift = 0,
 		.base_values = emi_base,
 		.n_base_values = ARRAY_SIZE(emi_base),
 	}
@@ -184,7 +189,7 @@
 	if (!val && desc->div_val0)
 		return desc->div_val0;
 
-	return (val + 1) * desc->div_step;
+	return (val + desc->div_offset) * desc->div_step;
 }
 
 static int en7523_pci_is_enabled(struct clk_hw *hw)
@@ -279,6 +284,8 @@
 	u32 rate;
 	int i;
 
+	clk_data->num = EN7523_NUM_CLOCKS;
+
 	for (i = 0; i < ARRAY_SIZE(en7523_base_clks); i++) {
 		const struct en_clk_desc *desc = &en7523_base_clks[i];
 
@@ -297,8 +304,6 @@
 
 	hw = en7523_register_pcie_clk(dev, np_base);
 	clk_data->hws[EN7523_CLK_PCIE] = hw;
-
-	clk_data->num = EN7523_NUM_CLOCKS;
 }
 
 static int en7523_clk_probe(struct platform_device *pdev)
--- linux-qcom-6.8.0.orig/drivers/clk/clk-renesas-pcie.c
+++ linux-qcom-6.8.0/drivers/clk/clk-renesas-pcie.c
@@ -25,10 +25,12 @@
 #define RS9_REG_SS_AMP_0V7			0x1
 #define RS9_REG_SS_AMP_0V8			0x2
 #define RS9_REG_SS_AMP_0V9			0x3
+#define RS9_REG_SS_AMP_DEFAULT			RS9_REG_SS_AMP_0V8
 #define RS9_REG_SS_AMP_MASK			0x3
 #define RS9_REG_SS_SSC_100			0
 #define RS9_REG_SS_SSC_M025			(1 << 3)
 #define RS9_REG_SS_SSC_M050			(3 << 3)
+#define RS9_REG_SS_SSC_DEFAULT			RS9_REG_SS_SSC_100
 #define RS9_REG_SS_SSC_MASK			(3 << 3)
 #define RS9_REG_SS_SSC_LOCK			BIT(5)
 #define RS9_REG_SR				0x2
@@ -205,8 +207,8 @@
 	int ret;
 
 	/* Set defaults */
-	rs9->pll_amplitude = RS9_REG_SS_AMP_0V7;
-	rs9->pll_ssc = RS9_REG_SS_SSC_100;
+	rs9->pll_amplitude = RS9_REG_SS_AMP_DEFAULT;
+	rs9->pll_ssc = RS9_REG_SS_SSC_DEFAULT;
 
 	/* Output clock amplitude */
 	ret = of_property_read_u32(np, "renesas,out-amplitude-microvolt",
@@ -247,13 +249,13 @@
 	int i;
 
 	/* If amplitude is non-default, update it. */
-	if (rs9->pll_amplitude != RS9_REG_SS_AMP_0V7) {
+	if (rs9->pll_amplitude != RS9_REG_SS_AMP_DEFAULT) {
 		regmap_update_bits(rs9->regmap, RS9_REG_SS, RS9_REG_SS_AMP_MASK,
 				   rs9->pll_amplitude);
 	}
 
 	/* If SSC is non-default, update it. */
-	if (rs9->pll_ssc != RS9_REG_SS_SSC_100) {
+	if (rs9->pll_ssc != RS9_REG_SS_SSC_DEFAULT) {
 		regmap_update_bits(rs9->regmap, RS9_REG_SS, RS9_REG_SS_SSC_MASK,
 				   rs9->pll_ssc);
 	}
--- linux-qcom-6.8.0.orig/drivers/clk/clk.c
+++ linux-qcom-6.8.0/drivers/clk/clk.c
@@ -37,6 +37,10 @@
 static HLIST_HEAD(clk_orphan_list);
 static LIST_HEAD(clk_notifier_list);
 
+/* List of registered clks that use runtime PM */
+static HLIST_HEAD(clk_rpm_list);
+static DEFINE_MUTEX(clk_rpm_list_lock);
+
 static const struct hlist_head *all_lists[] = {
 	&clk_root_list,
 	&clk_orphan_list,
@@ -59,6 +63,7 @@
 	struct clk_hw		*hw;
 	struct module		*owner;
 	struct device		*dev;
+	struct hlist_node	rpm_node;
 	struct device_node	*of_node;
 	struct clk_core		*parent;
 	struct clk_parent_map	*parents;
@@ -122,6 +127,89 @@
 	pm_runtime_put_sync(core->dev);
 }
 
+/**
+ * clk_pm_runtime_get_all() - Runtime "get" all clk provider devices
+ *
+ * Call clk_pm_runtime_get() on all runtime PM enabled clks in the clk tree so
+ * that disabling unused clks avoids a deadlock where a device is runtime PM
+ * resuming/suspending and the runtime PM callback is trying to grab the
+ * prepare_lock for something like clk_prepare_enable() while
+ * clk_disable_unused_subtree() holds the prepare_lock and is trying to runtime
+ * PM resume/suspend the device as well.
+ *
+ * Context: Acquires the 'clk_rpm_list_lock' and returns with the lock held on
+ * success. Otherwise the lock is released on failure.
+ *
+ * Return: 0 on success, negative errno otherwise.
+ */
+static int clk_pm_runtime_get_all(void)
+{
+	int ret;
+	struct clk_core *core, *failed;
+
+	/*
+	 * Grab the list lock to prevent any new clks from being registered
+	 * or unregistered until clk_pm_runtime_put_all().
+	 */
+	mutex_lock(&clk_rpm_list_lock);
+
+	/*
+	 * Runtime PM "get" all the devices that are needed for the clks
+	 * currently registered. Do this without holding the prepare_lock, to
+	 * avoid the deadlock.
+	 */
+	hlist_for_each_entry(core, &clk_rpm_list, rpm_node) {
+		ret = clk_pm_runtime_get(core);
+		if (ret) {
+			failed = core;
+			pr_err("clk: Failed to runtime PM get '%s' for clk '%s'\n",
+			       dev_name(failed->dev), failed->name);
+			goto err;
+		}
+	}
+
+	return 0;
+
+err:
+	hlist_for_each_entry(core, &clk_rpm_list, rpm_node) {
+		if (core == failed)
+			break;
+
+		clk_pm_runtime_put(core);
+	}
+	mutex_unlock(&clk_rpm_list_lock);
+
+	return ret;
+}
+
+/**
+ * clk_pm_runtime_put_all() - Runtime "put" all clk provider devices
+ *
+ * Put the runtime PM references taken in clk_pm_runtime_get_all() and release
+ * the 'clk_rpm_list_lock'.
+ */
+static void clk_pm_runtime_put_all(void)
+{
+	struct clk_core *core;
+
+	hlist_for_each_entry(core, &clk_rpm_list, rpm_node)
+		clk_pm_runtime_put(core);
+	mutex_unlock(&clk_rpm_list_lock);
+}
+
+static void clk_pm_runtime_init(struct clk_core *core)
+{
+	struct device *dev = core->dev;
+
+	if (dev && pm_runtime_enabled(dev)) {
+		core->rpm_enabled = true;
+
+		mutex_lock(&clk_rpm_list_lock);
+		hlist_add_head(&core->rpm_node, &clk_rpm_list);
+		mutex_unlock(&clk_rpm_list_lock);
+	}
+}
+
 /***           locking             ***/
 static void clk_prepare_lock(void)
 {
@@ -418,6 +506,9 @@
 	if (IS_ERR(hw))
 		return ERR_CAST(hw);
 
+	if (!hw)
+		return NULL;
+
 	return hw->core;
 }
 
@@ -939,6 +1030,25 @@
 }
 EXPORT_SYMBOL_GPL(clk_rate_exclusive_get);
 
+static void devm_clk_rate_exclusive_put(void *data)
+{
+	struct clk *clk = data;
+
+	clk_rate_exclusive_put(clk);
+}
+
+int devm_clk_rate_exclusive_get(struct device *dev, struct clk *clk)
+{
+	int ret;
+
+	ret = clk_rate_exclusive_get(clk);
+	if (ret)
+		return ret;
+
+	return devm_add_action_or_reset(dev, devm_clk_rate_exclusive_put, clk);
+}
+EXPORT_SYMBOL_GPL(devm_clk_rate_exclusive_get);
+
 static void clk_core_unprepare(struct clk_core *core)
 {
 	lockdep_assert_held(&prepare_lock);
@@ -1359,9 +1469,6 @@
 	if (core->flags & CLK_IGNORE_UNUSED)
 		return;
 
-	if (clk_pm_runtime_get(core))
-		return;
-
 	if (clk_core_is_prepared(core)) {
 		trace_clk_unprepare(core);
 		if (core->ops->unprepare_unused)
@@ -1370,8 +1477,6 @@
 			core->ops->unprepare(core->hw);
 		trace_clk_unprepare_complete(core);
 	}
-
-	clk_pm_runtime_put(core);
 }
 
 static void __init clk_disable_unused_subtree(struct clk_core *core)
@@ -1387,9 +1492,6 @@
 	if (core->flags & CLK_OPS_PARENT_ENABLE)
 		clk_core_prepare_enable(core->parent);
 
-	if (clk_pm_runtime_get(core))
-		goto unprepare_out;
-
 	flags = clk_enable_lock();
 
 	if (core->enable_count)
@@ -1414,8 +1516,6 @@
 
 unlock_out:
 	clk_enable_unlock(flags);
-	clk_pm_runtime_put(core);
-unprepare_out:
 	if (core->flags & CLK_OPS_PARENT_ENABLE)
 		clk_core_disable_unprepare(core->parent);
 }
@@ -1431,6 +1531,7 @@
 static int __init clk_disable_unused(void)
 {
 	struct clk_core *core;
+	int ret;
 
 	if (clk_ignore_unused) {
 		pr_warn("clk: Not disabling unused clocks\n");
@@ -1439,6 +1540,13 @@
 
 	pr_info("clk: Disabling unused clocks\n");
 
+	ret = clk_pm_runtime_get_all();
+	if (ret)
+		return ret;
+	/*
+	 * Grab the prepare lock to keep the clk topology stable while iterating
+	 * over clks.
+	 */
 	clk_prepare_lock();
 
 	hlist_for_each_entry(core, &clk_root_list, child_node)
@@ -1455,6 +1563,8 @@
 
 	clk_prepare_unlock();
 
+	clk_pm_runtime_put_all();
+
 	return 0;
 }
 late_initcall_sync(clk_disable_unused);
@@ -3230,9 +3340,7 @@
 {
 	struct clk_core *child;
 
-	clk_pm_runtime_get(c);
 	clk_summary_show_one(s, c, level);
-	clk_pm_runtime_put(c);
 
 	hlist_for_each_entry(child, &c->children, child_node)
 		clk_summary_show_subtree(s, child, level + 1);
@@ -3242,11 +3350,15 @@
 {
 	struct clk_core *c;
 	struct hlist_head **lists = s->private;
+	int ret;
 
 	seq_puts(s, "                                 enable  prepare  protect                                duty  hardware                            connection\n");
 	seq_puts(s, "   clock                          count    count    count        rate   accuracy phase  cycle    enable   consumer                         id\n");
 	seq_puts(s, "---------------------------------------------------------------------------------------------------------------------------------------------\n");
 
+	ret = clk_pm_runtime_get_all();
+	if (ret)
+		return ret;
 
 	clk_prepare_lock();
 
@@ -3255,6 +3367,7 @@
 			clk_summary_show_subtree(s, c, 0);
 
 	clk_prepare_unlock();
+	clk_pm_runtime_put_all();
 
 	return 0;
 }
@@ -3302,8 +3415,14 @@
 	struct clk_core *c;
 	bool first_node = true;
 	struct hlist_head **lists = s->private;
+	int ret;
+
+	ret = clk_pm_runtime_get_all();
+	if (ret)
+		return ret;
 
 	seq_putc(s, '{');
+
 	clk_prepare_lock();
 
 	for (; *lists; lists++) {
@@ -3316,6 +3435,7 @@
 	}
 
 	clk_prepare_unlock();
+	clk_pm_runtime_put_all();
 
 	seq_puts(s, "}\n");
 	return 0;
@@ -3959,8 +4079,6 @@
 	}
 
 	clk_core_reparent_orphans_nolock();
-
-	kref_init(&core->ref);
 out:
 	clk_pm_runtime_put(core);
 unlock:
@@ -4189,6 +4307,22 @@
 	kfree(core->parents);
 }
 
+/* Free memory allocated for a struct clk_core */
+static void __clk_release(struct kref *ref)
+{
+	struct clk_core *core = container_of(ref, struct clk_core, ref);
+
+	if (core->rpm_enabled) {
+		mutex_lock(&clk_rpm_list_lock);
+		hlist_del(&core->rpm_node);
+		mutex_unlock(&clk_rpm_list_lock);
+	}
+
+	clk_core_free_parent_map(core);
+	kfree_const(core->name);
+	kfree(core);
+}
+
 static struct clk *
 __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw)
 {
@@ -4209,6 +4343,8 @@
 		goto fail_out;
 	}
 
+	kref_init(&core->ref);
+
 	core->name = kstrdup_const(init->name, GFP_KERNEL);
 	if (!core->name) {
 		ret = -ENOMEM;
@@ -4221,9 +4357,8 @@
 	}
 	core->ops = init->ops;
 
-	if (dev && pm_runtime_enabled(dev))
-		core->rpm_enabled = true;
 	core->dev = dev;
+	clk_pm_runtime_init(core);
 	core->of_node = np;
 	if (dev && dev->driver)
 		core->owner = dev->driver->owner;
@@ -4263,12 +4398,10 @@
 	hw->clk = NULL;
 
 fail_create_clk:
-	clk_core_free_parent_map(core);
 fail_parents:
 fail_ops:
-	kfree_const(core->name);
 fail_name:
-	kfree(core);
+	kref_put(&core->ref, __clk_release);
 fail_out:
 	return ERR_PTR(ret);
 }
@@ -4348,18 +4481,6 @@
 }
 EXPORT_SYMBOL_GPL(of_clk_hw_register);
 
-/* Free memory allocated for a clock. */
-static void __clk_release(struct kref *ref)
-{
-	struct clk_core *core = container_of(ref, struct clk_core, ref);
-
-	lockdep_assert_held(&prepare_lock);
-
-	clk_core_free_parent_map(core);
-	kfree_const(core->name);
-	kfree(core);
-}
-
 /*
  * Empty clk_ops for unregistered clocks. These are used temporarily
  * after clk_unregister() was called on a clock and until last clock
@@ -4450,7 +4571,8 @@
 	if (ops == &clk_nodrv_ops) {
 		pr_err("%s: unregistered clock: %s\n", __func__,
 		       clk->core->name);
-		goto unlock;
+		clk_prepare_unlock();
+		return;
 	}
 	/*
 	 * Assign empty clock ops for consumers that might still hold
@@ -4484,11 +4606,10 @@
 	if (clk->core->protect_count)
 		pr_warn("%s: unregistering protected clock: %s\n",
 					__func__, clk->core->name);
+	clk_prepare_unlock();
 
 	kref_put(&clk->core->ref, __clk_release);
 	free_clk(clk);
-unlock:
-	clk_prepare_unlock();
 }
 EXPORT_SYMBOL_GPL(clk_unregister);
 
@@ -4647,13 +4768,11 @@
 	if (clk->min_rate > 0 || clk->max_rate < ULONG_MAX)
 		clk_set_rate_range_nolock(clk, 0, ULONG_MAX);
 
-	owner = clk->core->owner;
-	kref_put(&clk->core->ref, __clk_release);
-
 	clk_prepare_unlock();
 
+	owner = clk->core->owner;
+	kref_put(&clk->core->ref, __clk_release);
 	module_put(owner);
-
 	free_clk(clk);
 }
 
--- linux-qcom-6.8.0.orig/drivers/clk/clkdev.c
+++ linux-qcom-6.8.0/drivers/clk/clkdev.c
@@ -144,7 +144,7 @@
 	mutex_unlock(&clocks_mutex);
 }
 
-#define MAX_DEV_ID	20
+#define MAX_DEV_ID	24
 #define MAX_CON_ID	16
 
 struct clk_lookup_alloc {
--- linux-qcom-6.8.0.orig/drivers/clk/davinci/da8xx-cfgchip.c
+++ linux-qcom-6.8.0/drivers/clk/davinci/da8xx-cfgchip.c
@@ -508,7 +508,7 @@
 	const char * const parent_names[] = { "usb_refclkin", "pll0_auxclk" };
 	struct clk *fck_clk;
 	struct da8xx_usb0_clk48 *usb0;
-	struct clk_init_data init;
+	struct clk_init_data init = {};
 	int ret;
 
 	fck_clk = devm_clk_get(dev, "fck");
@@ -583,7 +583,7 @@
 {
 	const char * const parent_names[] = { "usb0_clk48", "usb_refclkin" };
 	struct da8xx_usb1_clk48 *usb1;
-	struct clk_init_data init;
+	struct clk_init_data init = {};
 	int ret;
 
 	usb1 = devm_kzalloc(dev, sizeof(*usb1), GFP_KERNEL);
--- linux-qcom-6.8.0.orig/drivers/clk/hisilicon/clk-hi3519.c
+++ linux-qcom-6.8.0/drivers/clk/hisilicon/clk-hi3519.c
@@ -130,7 +130,7 @@
 	of_clk_del_provider(pdev->dev.of_node);
 
 	hisi_clk_unregister_gate(hi3519_gate_clks,
-				ARRAY_SIZE(hi3519_mux_clks),
+				ARRAY_SIZE(hi3519_gate_clks),
 				crg->clk_data);
 	hisi_clk_unregister_mux(hi3519_mux_clks,
 				ARRAY_SIZE(hi3519_mux_clks),
--- linux-qcom-6.8.0.orig/drivers/clk/hisilicon/clk-hi3559a.c
+++ linux-qcom-6.8.0/drivers/clk/hisilicon/clk-hi3559a.c
@@ -491,7 +491,6 @@
 
 		clk = clk_register(NULL, &p_clk->hw);
 		if (IS_ERR(clk)) {
-			devm_kfree(dev, p_clk);
 			dev_err(dev, "%s: failed to register clock %s\n",
 			       __func__, clks[i].name);
 			continue;
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-composite-7ulp.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-composite-7ulp.c
@@ -14,6 +14,7 @@
 #include "../clk-fractional-divider.h"
 #include "clk.h"
 
+#define PCG_PR_MASK		BIT(31)
 #define PCG_PCS_SHIFT	24
 #define PCG_PCS_MASK	0x7
 #define PCG_CGC_SHIFT	30
@@ -78,6 +79,12 @@
 	struct clk_hw *hw;
 	u32 val;
 
+	val = readl(reg);
+	if (!(val & PCG_PR_MASK)) {
+		pr_info("PCC PR is 0 for clk:%s, bypass\n", name);
+		return 0;
+	}
+
 	if (mux_present) {
 		mux = kzalloc(sizeof(*mux), GFP_KERNEL);
 		if (!mux)
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-composite-8m.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-composite-8m.c
@@ -204,6 +204,34 @@
 	.determine_rate = imx8m_clk_composite_mux_determine_rate,
 };
 
+static int imx8m_clk_composite_gate_enable(struct clk_hw *hw)
+{
+	struct clk_gate *gate = to_clk_gate(hw);
+	unsigned long flags;
+	u32 val;
+
+	spin_lock_irqsave(gate->lock, flags);
+
+	val = readl(gate->reg);
+	val |= BIT(gate->bit_idx);
+	writel(val, gate->reg);
+
+	spin_unlock_irqrestore(gate->lock, flags);
+
+	return 0;
+}
+
+static void imx8m_clk_composite_gate_disable(struct clk_hw *hw)
+{
+	/* composite clk requires the disable hook */
+}
+
+static const struct clk_ops imx8m_clk_composite_gate_ops = {
+	.enable = imx8m_clk_composite_gate_enable,
+	.disable = imx8m_clk_composite_gate_disable,
+	.is_enabled = clk_gate_is_enabled,
+};
+
 struct clk_hw *__imx8m_clk_hw_composite(const char *name,
 					const char * const *parent_names,
 					int num_parents, void __iomem *reg,
@@ -217,10 +245,11 @@
 	struct clk_mux *mux = NULL;
 	const struct clk_ops *divider_ops;
 	const struct clk_ops *mux_ops;
+	const struct clk_ops *gate_ops;
 
 	mux = kzalloc(sizeof(*mux), GFP_KERNEL);
 	if (!mux)
-		goto fail;
+		return ERR_CAST(hw);
 
 	mux_hw = &mux->hw;
 	mux->reg = reg;
@@ -230,7 +259,7 @@
 
 	div = kzalloc(sizeof(*div), GFP_KERNEL);
 	if (!div)
-		goto fail;
+		goto free_mux;
 
 	div_hw = &div->hw;
 	div->reg = reg;
@@ -257,28 +286,32 @@
 	div->flags = CLK_DIVIDER_ROUND_CLOSEST;
 
 	/* skip registering the gate ops if M4 is enabled */
-	if (!mcore_booted) {
-		gate = kzalloc(sizeof(*gate), GFP_KERNEL);
-		if (!gate)
-			goto fail;
-
-		gate_hw = &gate->hw;
-		gate->reg = reg;
-		gate->bit_idx = PCG_CGC_SHIFT;
-		gate->lock = &imx_ccm_lock;
-	}
+	gate = kzalloc(sizeof(*gate), GFP_KERNEL);
+	if (!gate)
+		goto free_div;
+
+	gate_hw = &gate->hw;
+	gate->reg = reg;
+	gate->bit_idx = PCG_CGC_SHIFT;
+	gate->lock = &imx_ccm_lock;
+	if (!mcore_booted)
+		gate_ops = &clk_gate_ops;
+	else
+		gate_ops = &imx8m_clk_composite_gate_ops;
 
 	hw = clk_hw_register_composite(NULL, name, parent_names, num_parents,
 			mux_hw, mux_ops, div_hw,
-			divider_ops, gate_hw, &clk_gate_ops, flags);
+			divider_ops, gate_hw, gate_ops, flags);
 	if (IS_ERR(hw))
-		goto fail;
+		goto free_gate;
 
 	return hw;
 
-fail:
+free_gate:
 	kfree(gate);
+free_div:
 	kfree(div);
+free_mux:
 	kfree(mux);
 	return ERR_CAST(hw);
 }
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-composite-93.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-composite-93.c
@@ -76,6 +76,13 @@
 
 static void imx93_clk_composite_gate_disable(struct clk_hw *hw)
 {
+	/*
+	 * Skip disable the root clock gate if mcore enabled.
+	 * The root clock may be used by the mcore.
+	 */
+	if (mcore_booted)
+		return;
+
 	imx93_clk_composite_gate_endisable(hw, 0);
 }
 
@@ -222,7 +229,7 @@
 		hw = clk_hw_register_composite(NULL, name, parent_names, num_parents,
 					       mux_hw, &clk_mux_ro_ops, div_hw,
 					       &clk_divider_ro_ops, NULL, NULL, flags);
-	} else if (!mcore_booted) {
+	} else {
 		gate = kzalloc(sizeof(*gate), GFP_KERNEL);
 		if (!gate)
 			goto fail;
@@ -238,12 +245,6 @@
 					       &imx93_clk_composite_divider_ops, gate_hw,
 					       &imx93_clk_composite_gate_ops,
 					       flags | CLK_SET_RATE_NO_REPARENT);
-	} else {
-		hw = clk_hw_register_composite(NULL, name, parent_names, num_parents,
-					       mux_hw, &imx93_clk_composite_mux_ops, div_hw,
-					       &imx93_clk_composite_divider_ops, NULL,
-					       &imx93_clk_composite_gate_ops,
-					       flags | CLK_SET_RATE_NO_REPARENT);
 	}
 
 	if (IS_ERR(hw))
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-fracn-gppll.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-fracn-gppll.c
@@ -252,9 +252,11 @@
 	pll_div = FIELD_PREP(PLL_RDIV_MASK, rate->rdiv) | rate->odiv |
 		FIELD_PREP(PLL_MFI_MASK, rate->mfi);
 	writel_relaxed(pll_div, pll->base + PLL_DIV);
+	readl(pll->base + PLL_DIV);
 	if (pll->flags & CLK_FRACN_GPPLL_FRACN) {
 		writel_relaxed(rate->mfd, pll->base + PLL_DENOMINATOR);
 		writel_relaxed(FIELD_PREP(PLL_MFN_MASK, rate->mfn), pll->base + PLL_NUMERATOR);
+		readl(pll->base + PLL_NUMERATOR);
 	}
 
 	/* Wait for 5us according to fracn mode pll doc */
@@ -263,6 +265,7 @@
 	/* Enable Powerup */
 	tmp |= POWERUP_MASK;
 	writel_relaxed(tmp, pll->base + PLL_CTRL);
+	readl(pll->base + PLL_CTRL);
 
 	/* Wait Lock */
 	ret = clk_fracn_gppll_wait_lock(pll);
@@ -291,19 +294,24 @@
 	if (val & POWERUP_MASK)
 		return 0;
 
+	if (pll->flags & CLK_FRACN_GPPLL_FRACN)
+		writel_relaxed(readl_relaxed(pll->base + PLL_NUMERATOR),
+			       pll->base + PLL_NUMERATOR);
+
 	val |= CLKMUX_BYPASS;
 	writel_relaxed(val, pll->base + PLL_CTRL);
 
 	val |= POWERUP_MASK;
 	writel_relaxed(val, pll->base + PLL_CTRL);
-
-	val |= CLKMUX_EN;
-	writel_relaxed(val, pll->base + PLL_CTRL);
+	readl(pll->base + PLL_CTRL);
 
 	ret = clk_fracn_gppll_wait_lock(pll);
 	if (ret)
 		return ret;
 
+	val |= CLKMUX_EN;
+	writel_relaxed(val, pll->base + PLL_CTRL);
+
 	val &= ~CLKMUX_BYPASS;
 	writel_relaxed(val, pll->base + PLL_CTRL);
 
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-imx6ul.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-imx6ul.c
@@ -542,8 +542,8 @@
 
 	clk_set_parent(hws[IMX6UL_CLK_ENFC_SEL]->clk, hws[IMX6UL_CLK_PLL2_PFD2]->clk);
 
-	clk_set_parent(hws[IMX6UL_CLK_ENET1_REF_SEL]->clk, hws[IMX6UL_CLK_ENET_REF]->clk);
-	clk_set_parent(hws[IMX6UL_CLK_ENET2_REF_SEL]->clk, hws[IMX6UL_CLK_ENET2_REF]->clk);
+	clk_set_parent(hws[IMX6UL_CLK_ENET1_REF_SEL]->clk, hws[IMX6UL_CLK_ENET1_REF_125M]->clk);
+	clk_set_parent(hws[IMX6UL_CLK_ENET2_REF_SEL]->clk, hws[IMX6UL_CLK_ENET2_REF_125M]->clk);
 
 	imx_register_uart_clocks();
 }
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-imx7d.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-imx7d.c
@@ -498,9 +498,9 @@
 	hws[IMX7D_ENET_AXI_ROOT_SRC] = imx_clk_hw_mux2_flags("enet_axi_src", base + 0x8900, 24, 3, enet_axi_sel, ARRAY_SIZE(enet_axi_sel), CLK_SET_PARENT_GATE);
 	hws[IMX7D_NAND_USDHC_BUS_ROOT_SRC] = imx_clk_hw_mux2_flags("nand_usdhc_src", base + 0x8980, 24, 3, nand_usdhc_bus_sel, ARRAY_SIZE(nand_usdhc_bus_sel), CLK_SET_PARENT_GATE);
 	hws[IMX7D_DRAM_PHYM_ROOT_SRC] = imx_clk_hw_mux2_flags("dram_phym_src", base + 0x9800, 24, 1, dram_phym_sel, ARRAY_SIZE(dram_phym_sel), CLK_SET_PARENT_GATE);
-	hws[IMX7D_DRAM_ROOT_SRC] = imx_clk_hw_mux2_flags("dram_src", base + 0x9880, 24, 1, dram_sel, ARRAY_SIZE(dram_sel), CLK_SET_PARENT_GATE);
+	hws[IMX7D_DRAM_ROOT_SRC] = imx_clk_hw_mux2("dram_src", base + 0x9880, 24, 1, dram_sel, ARRAY_SIZE(dram_sel));
 	hws[IMX7D_DRAM_PHYM_ALT_ROOT_SRC] = imx_clk_hw_mux2_flags("dram_phym_alt_src", base + 0xa000, 24, 3, dram_phym_alt_sel, ARRAY_SIZE(dram_phym_alt_sel), CLK_SET_PARENT_GATE);
-	hws[IMX7D_DRAM_ALT_ROOT_SRC]  = imx_clk_hw_mux2_flags("dram_alt_src", base + 0xa080, 24, 3, dram_alt_sel, ARRAY_SIZE(dram_alt_sel), CLK_SET_PARENT_GATE);
+	hws[IMX7D_DRAM_ALT_ROOT_SRC]  = imx_clk_hw_mux2("dram_alt_src", base + 0xa080, 24, 3, dram_alt_sel, ARRAY_SIZE(dram_alt_sel));
 	hws[IMX7D_USB_HSIC_ROOT_SRC] = imx_clk_hw_mux2_flags("usb_hsic_src", base + 0xa100, 24, 3, usb_hsic_sel, ARRAY_SIZE(usb_hsic_sel), CLK_SET_PARENT_GATE);
 	hws[IMX7D_PCIE_CTRL_ROOT_SRC] = imx_clk_hw_mux2_flags("pcie_ctrl_src", base + 0xa180, 24, 3, pcie_ctrl_sel, ARRAY_SIZE(pcie_ctrl_sel), CLK_SET_PARENT_GATE);
 	hws[IMX7D_PCIE_PHY_ROOT_SRC] = imx_clk_hw_mux2_flags("pcie_phy_src", base + 0xa200, 24, 3, pcie_phy_sel, ARRAY_SIZE(pcie_phy_sel), CLK_SET_PARENT_GATE);
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-imx8-acm.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-imx8-acm.c
@@ -289,9 +289,9 @@
 							 DL_FLAG_STATELESS |
 							 DL_FLAG_PM_RUNTIME |
 							 DL_FLAG_RPM_ACTIVE);
-		if (IS_ERR(dev_pm->pd_dev_link[i])) {
+		if (!dev_pm->pd_dev_link[i]) {
 			dev_pm_domain_detach(dev_pm->pd_dev[i], false);
-			ret = PTR_ERR(dev_pm->pd_dev_link[i]);
+			ret = -EINVAL;
 			goto detach_pm;
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-imx8mp-audiomix.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-imx8mp-audiomix.c
@@ -18,7 +18,12 @@
 
 #define CLKEN0			0x000
 #define CLKEN1			0x004
-#define SAI_MCLK_SEL(n)		(0x300 + 4 * (n))	/* n in 0..5 */
+#define SAI1_MCLK_SEL		0x300
+#define SAI2_MCLK_SEL		0x304
+#define SAI3_MCLK_SEL		0x308
+#define SAI5_MCLK_SEL		0x30C
+#define SAI6_MCLK_SEL		0x310
+#define SAI7_MCLK_SEL		0x314
 #define PDM_SEL			0x318
 #define SAI_PLL_GNRL_CTL	0x400
 
@@ -95,13 +100,13 @@
 		IMX8MP_CLK_AUDIOMIX_SAI##n##_MCLK1_SEL, {},		\
 		clk_imx8mp_audiomix_sai##n##_mclk1_parents,		\
 		ARRAY_SIZE(clk_imx8mp_audiomix_sai##n##_mclk1_parents), \
-		SAI_MCLK_SEL(n), 1, 0					\
+		SAI##n##_MCLK_SEL, 1, 0					\
 	}, {								\
 		"sai"__stringify(n)"_mclk2_sel",			\
 		IMX8MP_CLK_AUDIOMIX_SAI##n##_MCLK2_SEL, {},		\
 		clk_imx8mp_audiomix_sai_mclk2_parents,			\
 		ARRAY_SIZE(clk_imx8mp_audiomix_sai_mclk2_parents),	\
-		SAI_MCLK_SEL(n), 4, 1					\
+		SAI##n##_MCLK_SEL, 4, 1					\
 	}, {								\
 		"sai"__stringify(n)"_ipg_cg",				\
 		IMX8MP_CLK_AUDIOMIX_SAI##n##_IPG,			\
@@ -141,6 +146,15 @@
 		PDM_SEL, 2, 0						\
 	}
 
+#define CLK_GATE_PARENT(gname, cname, pname)						\
+	{								\
+		gname"_cg",						\
+		IMX8MP_CLK_AUDIOMIX_##cname,				\
+		{ .fw_name = pname, .name = pname }, NULL, 1,		\
+		CLKEN0 + 4 * !!(IMX8MP_CLK_AUDIOMIX_##cname / 32),	\
+		1, IMX8MP_CLK_AUDIOMIX_##cname % 32			\
+	}
+
 struct clk_imx8mp_audiomix_sel {
 	const char			*name;
 	int				clkid;
@@ -158,14 +172,14 @@
 	CLK_GATE("earc", EARC_IPG),
 	CLK_GATE("ocrama", OCRAMA_IPG),
 	CLK_GATE("aud2htx", AUD2HTX_IPG),
-	CLK_GATE("earc_phy", EARC_PHY),
+	CLK_GATE_PARENT("earc_phy", EARC_PHY, "sai_pll_out_div2"),
 	CLK_GATE("sdma2", SDMA2_ROOT),
 	CLK_GATE("sdma3", SDMA3_ROOT),
 	CLK_GATE("spba2", SPBA2_ROOT),
 	CLK_GATE("dsp", DSP_ROOT),
 	CLK_GATE("dspdbg", DSPDBG_ROOT),
 	CLK_GATE("edma", EDMA_ROOT),
-	CLK_GATE("audpll", AUDPLL_ROOT),
+	CLK_GATE_PARENT("audpll", AUDPLL_ROOT, "osc_24m"),
 	CLK_GATE("mu2", MU2_ROOT),
 	CLK_GATE("mu3", MU3_ROOT),
 	CLK_PDM,
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-imx8mp.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-imx8mp.c
@@ -551,8 +551,8 @@
 
 	hws[IMX8MP_CLK_IPG_ROOT] = imx_clk_hw_divider2("ipg_root", "ahb_root", ccm_base + 0x9080, 0, 1);
 
-	hws[IMX8MP_CLK_DRAM_ALT] = imx8m_clk_hw_composite("dram_alt", imx8mp_dram_alt_sels, ccm_base + 0xa000);
-	hws[IMX8MP_CLK_DRAM_APB] = imx8m_clk_hw_composite_critical("dram_apb", imx8mp_dram_apb_sels, ccm_base + 0xa080);
+	hws[IMX8MP_CLK_DRAM_ALT] = imx8m_clk_hw_fw_managed_composite("dram_alt", imx8mp_dram_alt_sels, ccm_base + 0xa000);
+	hws[IMX8MP_CLK_DRAM_APB] = imx8m_clk_hw_fw_managed_composite_critical("dram_apb", imx8mp_dram_apb_sels, ccm_base + 0xa080);
 	hws[IMX8MP_CLK_VPU_G1] = imx8m_clk_hw_composite("vpu_g1", imx8mp_vpu_g1_sels, ccm_base + 0xa100);
 	hws[IMX8MP_CLK_VPU_G2] = imx8m_clk_hw_composite("vpu_g2", imx8mp_vpu_g2_sels, ccm_base + 0xa180);
 	hws[IMX8MP_CLK_CAN1] = imx8m_clk_hw_composite("can1", imx8mp_can1_sels, ccm_base + 0xa200);
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-imx8qxp.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-imx8qxp.c
@@ -170,8 +170,8 @@
 	imx_clk_scu("pwm_clk",   IMX_SC_R_LCD_0_PWM_0, IMX_SC_PM_CLK_PER);
 	imx_clk_scu("elcdif_pll", IMX_SC_R_ELCDIF_PLL, IMX_SC_PM_CLK_PLL);
 	imx_clk_scu2("lcd_clk", lcd_sels, ARRAY_SIZE(lcd_sels), IMX_SC_R_LCD_0, IMX_SC_PM_CLK_PER);
-	imx_clk_scu2("lcd_pxl_clk", lcd_pxl_sels, ARRAY_SIZE(lcd_pxl_sels), IMX_SC_R_LCD_0, IMX_SC_PM_CLK_MISC0);
 	imx_clk_scu("lcd_pxl_bypass_div_clk", IMX_SC_R_LCD_0, IMX_SC_PM_CLK_BYPASS);
+	imx_clk_scu2("lcd_pxl_clk", lcd_pxl_sels, ARRAY_SIZE(lcd_pxl_sels), IMX_SC_R_LCD_0, IMX_SC_PM_CLK_MISC0);
 
 	/* Audio SS */
 	imx_clk_scu("audio_pll0_clk", IMX_SC_R_AUDIO_PLL_0, IMX_SC_PM_CLK_PLL);
@@ -206,18 +206,18 @@
 	imx_clk_scu("usb3_lpm_div", IMX_SC_R_USB_2, IMX_SC_PM_CLK_MISC);
 
 	/* Display controller SS */
-	imx_clk_scu2("dc0_disp0_clk", dc0_sels, ARRAY_SIZE(dc0_sels), IMX_SC_R_DC_0, IMX_SC_PM_CLK_MISC0);
-	imx_clk_scu2("dc0_disp1_clk", dc0_sels, ARRAY_SIZE(dc0_sels), IMX_SC_R_DC_0, IMX_SC_PM_CLK_MISC1);
 	imx_clk_scu("dc0_pll0_clk", IMX_SC_R_DC_0_PLL_0, IMX_SC_PM_CLK_PLL);
 	imx_clk_scu("dc0_pll1_clk", IMX_SC_R_DC_0_PLL_1, IMX_SC_PM_CLK_PLL);
 	imx_clk_scu("dc0_bypass0_clk", IMX_SC_R_DC_0_VIDEO0, IMX_SC_PM_CLK_BYPASS);
+	imx_clk_scu2("dc0_disp0_clk", dc0_sels, ARRAY_SIZE(dc0_sels), IMX_SC_R_DC_0, IMX_SC_PM_CLK_MISC0);
+	imx_clk_scu2("dc0_disp1_clk", dc0_sels, ARRAY_SIZE(dc0_sels), IMX_SC_R_DC_0, IMX_SC_PM_CLK_MISC1);
 	imx_clk_scu("dc0_bypass1_clk", IMX_SC_R_DC_0_VIDEO1, IMX_SC_PM_CLK_BYPASS);
 
-	imx_clk_scu2("dc1_disp0_clk", dc1_sels, ARRAY_SIZE(dc1_sels), IMX_SC_R_DC_1, IMX_SC_PM_CLK_MISC0);
-	imx_clk_scu2("dc1_disp1_clk", dc1_sels, ARRAY_SIZE(dc1_sels), IMX_SC_R_DC_1, IMX_SC_PM_CLK_MISC1);
 	imx_clk_scu("dc1_pll0_clk", IMX_SC_R_DC_1_PLL_0, IMX_SC_PM_CLK_PLL);
 	imx_clk_scu("dc1_pll1_clk", IMX_SC_R_DC_1_PLL_1, IMX_SC_PM_CLK_PLL);
 	imx_clk_scu("dc1_bypass0_clk", IMX_SC_R_DC_1_VIDEO0, IMX_SC_PM_CLK_BYPASS);
+	imx_clk_scu2("dc1_disp0_clk", dc1_sels, ARRAY_SIZE(dc1_sels), IMX_SC_R_DC_1, IMX_SC_PM_CLK_MISC0);
+	imx_clk_scu2("dc1_disp1_clk", dc1_sels, ARRAY_SIZE(dc1_sels), IMX_SC_R_DC_1, IMX_SC_PM_CLK_MISC1);
 	imx_clk_scu("dc1_bypass1_clk", IMX_SC_R_DC_1_VIDEO1, IMX_SC_PM_CLK_BYPASS);
 
 	/* MIPI-LVDS SS */
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-lpcg-scu.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-lpcg-scu.c
@@ -6,10 +6,12 @@
 
 #include <linux/bits.h>
 #include <linux/clk-provider.h>
+#include <linux/delay.h>
 #include <linux/err.h>
 #include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
+#include <linux/units.h>
 
 #include "clk-scu.h"
 
@@ -41,6 +43,29 @@
 
 #define to_clk_lpcg_scu(_hw) container_of(_hw, struct clk_lpcg_scu, hw)
 
+/* e10858 -LPCG clock gating register synchronization errata */
+static void lpcg_e10858_writel(unsigned long rate, void __iomem *reg, u32 val)
+{
+	writel(val, reg);
+
+	if (rate >= 24 * HZ_PER_MHZ || rate == 0) {
+		/*
+		 * The time taken to access the LPCG registers from the AP core
+		 * through the interconnect is longer than the minimum delay
+		 * of 4 clock cycles required by the errata.
+		 * Adding a readl will provide sufficient delay to prevent
+		 * back-to-back writes.
+		 */
+		readl(reg);
+	} else {
+		/*
+		 * For clocks running below 24MHz, wait a minimum of
+		 * 4 clock cycles.
+		 */
+		ndelay(4 * (DIV_ROUND_UP(1000 * HZ_PER_MHZ, rate)));
+	}
+}
+
 static int clk_lpcg_scu_enable(struct clk_hw *hw)
 {
 	struct clk_lpcg_scu *clk = to_clk_lpcg_scu(hw);
@@ -57,7 +82,8 @@
 		val |= CLK_GATE_SCU_LPCG_HW_SEL;
 
 	reg |= val << clk->bit_idx;
-	writel(reg, clk->reg);
+
+	lpcg_e10858_writel(clk_hw_get_rate(hw), clk->reg, reg);
 
 	spin_unlock_irqrestore(&imx_lpcg_scu_lock, flags);
 
@@ -74,7 +100,7 @@
 
 	reg = readl_relaxed(clk->reg);
 	reg &= ~(CLK_GATE_SCU_LPCG_MASK << clk->bit_idx);
-	writel(reg, clk->reg);
+	lpcg_e10858_writel(clk_hw_get_rate(hw), clk->reg, reg);
 
 	spin_unlock_irqrestore(&imx_lpcg_scu_lock, flags);
 }
@@ -145,13 +171,8 @@
 {
 	struct clk_lpcg_scu *clk = dev_get_drvdata(dev);
 
-	/*
-	 * FIXME: Sometimes writes don't work unless the CPU issues
-	 * them twice
-	 */
-
-	writel(clk->state, clk->reg);
 	writel(clk->state, clk->reg);
+	lpcg_e10858_writel(0, clk->reg, clk->state);
 	dev_dbg(dev, "restore lpcg state 0x%x\n", clk->state);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/clk/imx/clk-scu.c
+++ linux-qcom-6.8.0/drivers/clk/imx/clk-scu.c
@@ -596,7 +596,7 @@
 		clk->rate = clk_scu_recalc_rate(&clk->hw, 0);
 	else
 		clk->rate = clk_hw_get_rate(&clk->hw);
-	clk->is_enabled = clk_hw_is_enabled(&clk->hw);
+	clk->is_enabled = clk_hw_is_prepared(&clk->hw);
 
 	if (clk->parent)
 		dev_dbg(dev, "save parent %s idx %u\n", clk_hw_get_name(clk->parent),
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/Kconfig
+++ linux-qcom-6.8.0/drivers/clk/mediatek/Kconfig
@@ -887,13 +887,6 @@
 	help
 	  This driver supports MediaTek MT8195 AI Processor Unit System clocks.
 
-config COMMON_CLK_MT8195_AUDSYS
-	tristate "Clock driver for MediaTek MT8195 audsys"
-	depends on COMMON_CLK_MT8195
-	default COMMON_CLK_MT8195
-	help
-	  This driver supports MediaTek MT8195 audsys clocks.
-
 config COMMON_CLK_MT8195_IMP_IIC_WRAP
 	tristate "Clock driver for MediaTek MT8195 imp_iic_wrap"
 	depends on COMMON_CLK_MT8195
@@ -908,14 +901,6 @@
 	help
 	  This driver supports MediaTek MT8195 mfgcfg clocks.
 
-config COMMON_CLK_MT8195_MSDC
-	tristate "Clock driver for MediaTek MT8195 msdc"
-	depends on COMMON_CLK_MT8195
-	default COMMON_CLK_MT8195
-	help
-	  This driver supports MediaTek MT8195 MMC and SD Controller's
-	  msdc and msdc_top clocks.
-
 config COMMON_CLK_MT8195_SCP_ADSP
 	tristate "Clock driver for MediaTek MT8195 scp_adsp"
 	depends on COMMON_CLK_MT8195
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-mt7622-apmixedsys.c
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-mt7622-apmixedsys.c
@@ -127,7 +127,6 @@
 	of_clk_del_provider(node);
 	mtk_clk_unregister_gates(apmixed_clks, ARRAY_SIZE(apmixed_clks), clk_data);
 	mtk_clk_unregister_plls(plls, ARRAY_SIZE(plls), clk_data);
-	mtk_free_clk_data(clk_data);
 }
 
 static const struct of_device_id of_match_clk_mt7622_apmixed[] = {
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-mt7981-topckgen.c
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-mt7981-topckgen.c
@@ -357,8 +357,9 @@
 	MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_325M_SEL, "sgm_325m_sel",
 			     sgm_325m_parents, 0x050, 0x054, 0x058, 8, 1, 15,
 			     0x1C0, 21),
-	MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_REG_SEL, "sgm_reg_sel", sgm_reg_parents,
-			     0x050, 0x054, 0x058, 16, 1, 23, 0x1C0, 22),
+	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_SGM_REG_SEL, "sgm_reg_sel", sgm_reg_parents,
+				   0x050, 0x054, 0x058, 16, 1, 23, 0x1C0, 22,
+				   CLK_IS_CRITICAL | CLK_SET_RATE_PARENT),
 	MUX_GATE_CLR_SET_UPD(CLK_TOP_EIP97B_SEL, "eip97b_sel", eip97b_parents,
 			     0x050, 0x054, 0x058, 24, 3, 31, 0x1C0, 23),
 	/* CLK_CFG_6 */
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-mt7988-infracfg.c
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-mt7988-infracfg.c
@@ -152,7 +152,7 @@
 	GATE_INFRA0(CLK_INFRA_PCIE_PERI_26M_CK_P1, "infra_pcie_peri_ck_26m_ck_p1",
 		    "csw_infra_f26m_sel", 8),
 	GATE_INFRA0(CLK_INFRA_PCIE_PERI_26M_CK_P2, "infra_pcie_peri_ck_26m_ck_p2",
-		    "csw_infra_f26m_sel", 9),
+		    "infra_pcie_peri_ck_26m_ck_p3", 9),
 	GATE_INFRA0(CLK_INFRA_PCIE_PERI_26M_CK_P3, "infra_pcie_peri_ck_26m_ck_p3",
 		    "csw_infra_f26m_sel", 10),
 	/* INFRA1 */
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-mt8135-apmixedsys.c
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-mt8135-apmixedsys.c
@@ -59,7 +59,7 @@
 
 	ret = mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
 	if (ret)
-		return ret;
+		goto free_clk_data;
 
 	ret = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
 	if (ret)
@@ -69,6 +69,8 @@
 
 unregister_plls:
 	mtk_clk_unregister_plls(plls, ARRAY_SIZE(plls), clk_data);
+free_clk_data:
+	mtk_free_clk_data(clk_data);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-mt8183-mfgcfg.c
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-mt8183-mfgcfg.c
@@ -29,6 +29,7 @@
 static const struct mtk_clk_desc mfg_desc = {
 	.clks = mfg_clks,
 	.num_clks = ARRAY_SIZE(mfg_clks),
+	.need_runtime_pm = true,
 };
 
 static const struct of_device_id of_match_clk_mt8183_mfg[] = {
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-mt8183.c
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-mt8183.c
@@ -790,7 +790,7 @@
 	/* infra_sspm_26m_self is main clock in co-processor, should not be closed in Linux. */
 	GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_26M_SELF, "infra_sspm_26m_self", "f_f26m_ck", 3, CLK_IS_CRITICAL),
 	/* infra_sspm_32k_self is main clock in co-processor, should not be closed in Linux. */
-	GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_32K_SELF, "infra_sspm_32k_self", "f_f26m_ck", 4, CLK_IS_CRITICAL),
+	GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_32K_SELF, "infra_sspm_32k_self", "clk32k", 4, CLK_IS_CRITICAL),
 	GATE_INFRA3(CLK_INFRA_UFS_AXI, "infra_ufs_axi", "axi_sel", 5),
 	GATE_INFRA3(CLK_INFRA_I2C6, "infra_i2c6", "i2c_sel", 6),
 	GATE_INFRA3(CLK_INFRA_AP_MSDC0, "infra_ap_msdc0", "msdc50_hclk_sel", 7),
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-mt8365-mm.c
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-mt8365-mm.c
@@ -53,7 +53,7 @@
 	GATE_MM0(CLK_MM_MM_DSI0, "mm_dsi0", "mm_sel", 17),
 	GATE_MM0(CLK_MM_MM_DISP_RDMA1, "mm_disp_rdma1", "mm_sel", 18),
 	GATE_MM0(CLK_MM_MM_MDP_RDMA1, "mm_mdp_rdma1", "mm_sel", 19),
-	GATE_MM0(CLK_MM_DPI0_DPI0, "mm_dpi0_dpi0", "vpll_dpix", 20),
+	GATE_MM0(CLK_MM_DPI0_DPI0, "mm_dpi0_dpi0", "dpi0_sel", 20),
 	GATE_MM0(CLK_MM_MM_FAKE, "mm_fake", "mm_sel", 21),
 	GATE_MM0(CLK_MM_MM_SMI_COMMON, "mm_smi_common", "mm_sel", 22),
 	GATE_MM0(CLK_MM_MM_SMI_LARB0, "mm_smi_larb0", "mm_sel", 23),
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-mtk.c
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-mtk.c
@@ -13,6 +13,7 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/slab.h>
 
 #include "clk-mtk.h"
@@ -494,6 +495,18 @@
 			return IS_ERR(base) ? PTR_ERR(base) : -ENOMEM;
 	}
 
+
+	if (mcd->need_runtime_pm) {
+		devm_pm_runtime_enable(&pdev->dev);
+		/*
+		 * Do a pm_runtime_resume_and_get() to workaround a possible
+		 * deadlock between clk_register() and the genpd framework.
+		 */
+		r = pm_runtime_resume_and_get(&pdev->dev);
+		if (r)
+			return r;
+	}
+
 	/* Calculate how many clk_hw_onecell_data entries to allocate */
 	num_clks = mcd->num_clks + mcd->num_composite_clks;
 	num_clks += mcd->num_fixed_clks + mcd->num_factor_clks;
@@ -574,6 +587,9 @@
 			goto unregister_clks;
 	}
 
+	if (mcd->need_runtime_pm)
+		pm_runtime_put(&pdev->dev);
+
 	return r;
 
 unregister_clks:
@@ -604,6 +620,9 @@
 free_base:
 	if (mcd->shared_io && base)
 		iounmap(base);
+
+	if (mcd->need_runtime_pm)
+		pm_runtime_put(&pdev->dev);
 	return r;
 }
 
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-mtk.h
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-mtk.h
@@ -237,6 +237,8 @@
 
 	int (*clk_notifier_func)(struct device *dev, struct clk *clk);
 	unsigned int mfg_clk_idx;
+
+	bool need_runtime_pm;
 };
 
 int mtk_clk_pdev_probe(struct platform_device *pdev);
--- linux-qcom-6.8.0.orig/drivers/clk/mediatek/clk-pllfh.c
+++ linux-qcom-6.8.0/drivers/clk/mediatek/clk-pllfh.c
@@ -68,7 +68,7 @@
 
 	node = of_find_compatible_node(NULL, NULL, compatible_node);
 	if (!node) {
-		pr_err("cannot find \"%s\"\n", compatible_node);
+		pr_warn("cannot find \"%s\"\n", compatible_node);
 		return;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/clk/meson/axg.c
+++ linux-qcom-6.8.0/drivers/clk/meson/axg.c
@@ -2142,7 +2142,9 @@
 	&axg_vclk_input,
 	&axg_vclk2_input,
 	&axg_vclk_div,
+	&axg_vclk_div1,
 	&axg_vclk2_div,
+	&axg_vclk2_div1,
 	&axg_vclk_div2_en,
 	&axg_vclk_div4_en,
 	&axg_vclk_div6_en,
--- linux-qcom-6.8.0.orig/drivers/clk/meson/s4-peripherals.c
+++ linux-qcom-6.8.0/drivers/clk/meson/s4-peripherals.c
@@ -2978,7 +2978,7 @@
 		.name = "pwm_j_div",
 		.ops = &clk_regmap_divider_ops,
 		.parent_hws = (const struct clk_hw *[]) {
-			&s4_pwm_h_mux.hw
+			&s4_pwm_j_mux.hw
 		},
 		.num_parents = 1,
 		.flags = CLK_SET_RATE_PARENT,
--- linux-qcom-6.8.0.orig/drivers/clk/meson/s4-pll.c
+++ linux-qcom-6.8.0/drivers/clk/meson/s4-pll.c
@@ -38,6 +38,11 @@
 			.shift   = 0,
 			.width   = 8,
 		},
+		.frac = {
+			.reg_off = ANACTRL_FIXPLL_CTRL1,
+			.shift   = 0,
+			.width   = 17,
+		},
 		.n = {
 			.reg_off = ANACTRL_FIXPLL_CTRL0,
 			.shift   = 10,
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/Kconfig
+++ linux-qcom-6.8.0/drivers/clk/qcom/Kconfig
@@ -20,6 +20,24 @@
 
 if COMMON_CLK_QCOM
 
+config CLK_X1E80100_CAMCC
+	tristate "X1E80100 Camera Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select CLK_X1E80100_GCC
+	help
+	  Support for the camera clock controller on X1E80100 devices.
+	  Say Y if you want to support camera devices and camera functionality.
+
+config CLK_X1E80100_DISPCC
+	tristate "X1E80100 Display Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select CLK_X1E80100_GCC
+	help
+	  Support for the two display clock controllers on Qualcomm
+	  Technologies, Inc. X1E80100 devices.
+	  Say Y if you want to support display devices and functionality such as
+	  splash screen.
+
 config CLK_X1E80100_GCC
 	tristate "X1E80100 Global Clock Controller"
 	depends on ARM64 || COMPILE_TEST
@@ -30,6 +48,15 @@
 	  Say Y if you want to use peripheral devices such as UART, SPI, I2C,
 	  USB, UFS, SD/eMMC, PCIe, etc.
 
+config CLK_X1E80100_GPUCC
+	tristate "X1E80100 Graphics Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select CLK_X1E80100_GCC
+	help
+	  Support for the graphics clock controller on X1E80100 devices.
+	  Say Y if you want to support graphics controller devices and
+	  functionality such as 3D graphics.
+
 config QCOM_A53PLL
 	tristate "MSM8916 A53 PLL"
 	help
@@ -410,6 +437,25 @@
 	  Say Y if you want to support display devices and functionality such as
 	  splash screen.
 
+config QCS_DISPCC_615
+	tristate "QCS615 Display Clock Controller"
+	select QCM_GCC_615
+	help
+	  Support for the display clock controller on Qualcomm Technologies, Inc
+	  QCS615 devices.
+	  Say Y if you want to support display devices and functionality such as
+	  splash screen.
+
+config QCS_CAMCC_615
+	tristate "QCS615 Camera Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select QCS_GCC_615
+	help
+	  Support for the camera clock controller on Qualcomm Technologies, Inc
+	  QCS615 devices.
+	  Say Y if you want to support camera devices and functionality such as
+	  capturing pictures.
+
 config QCS_GCC_404
 	tristate "QCS404 Global Clock Controller"
 	help
@@ -417,6 +463,53 @@
 	  Say Y if you want to use multimedia devices or peripheral
 	  devices such as UART, SPI, I2C, USB, SD/eMMC, PCIe etc.
 
+config SA_CAMCC_8775P
+	tristate "SA8775P Camera Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select SA_GCC_8775P
+	help
+	  Support for the camera clock controller on Qualcomm Technologies, Inc
+	  SA8775P devices.
+	  Say Y if you want to support camera devices and functionality such as
+	  capturing pictures.
+
+config QCS_GPUCC_615
+	tristate "QCS615 Graphics clock controller"
+	depends on ARM64 || COMPILE_TEST
+	select QCS_GCC_615
+	help
+	  Support for the graphics clock controller on QCS615 devices.
+	  Say Y if you want to support graphics controller devices and
+	  functionality such as 3D graphics.
+
+config QCS_VIDEOCC_615
+	tristate "QCS615 Video Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select QCS_GCC_615
+	help
+	  Support for the video clock controller on QCS615 devices.
+	  Say Y if you want to support video devices and functionality such as
+	  video encode and decode.
+
+config QCS_GCC_8300
+	tristate "QCS8300 Global Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select QCOM_GDSC
+	help
+	  Support for the global clock controller on Qualcomm Technologies, Inc
+	  QCS8300 devices.
+	  Say Y if you want to use peripheral devices such as UART,
+	  SPI, I2C, USB, SD/UFS, PCIe etc.
+
+config QCS_GCC_615
+	tristate "QCS615 Global Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select QCOM_GDSC
+	help
+	  Support for the global clock controller on QCS615 devices.
+	  Say Y if you want to use multimedia devices or peripheral
+	  devices such as UART, SPI, I2C, USB, SD/eMMC, PCIe etc.
+
 config SC_CAMCC_7180
 	tristate "SC7180 Camera Clock Controller"
 	depends on ARM64 || COMPILE_TEST
@@ -439,6 +532,7 @@
 
 config SC_CAMCC_8280XP
 	tristate "SC8280XP Camera Clock Controller"
+	depends on ARM64 || COMPILE_TEST
 	select SC_GCC_8280XP
 	help
 	  Support for the camera clock controller on Qualcomm Technologies, Inc
@@ -446,6 +540,16 @@
 	  Say Y if you want to support camera devices and functionality such as
 	  capturing pictures.
 
+config SA_DISPCC_8775P
+	tristate "SA8775P Display Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select SA_GCC_8775P
+	help
+	  Support for the two display clock controllers on Qualcomm Technologies, Inc.
+	  SA8775P devices.
+	  Say Y if you want to support display devices and functionality such as
+	  splash screen.
+
 config SC_DISPCC_7180
 	tristate "SC7180 Display Clock Controller"
 	depends on ARM64 || COMPILE_TEST
@@ -777,6 +881,14 @@
 	  Support for the camera clock controller on SM6350 devices.
 	  Say Y if you want to support camera devices and camera functionality.
 
+config SM_CAMCC_7150
+	tristate "SM7150 Camera Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select SM_GCC_7150
+	help
+	  Support for the camera clock controller on SM7150 devices.
+	  Say Y if you want to support camera devices and camera functionality.
+
 config SM_CAMCC_8250
 	tristate "SM8250 Camera Clock Controller"
 	depends on ARM64 || COMPILE_TEST
@@ -821,6 +933,16 @@
 	  Say Y if you want to support display devices and functionality such as
 	  splash screen
 
+config SM_DISPCC_7150
+	tristate "SM7150 Display Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	depends on SM_GCC_7150
+	help
+	  Support for the display clock controller on Qualcomm Technologies, Inc
+	  SM7150 devices.
+	  Say Y if you want to support display devices and functionality such as
+	  splash screen.
+
 config SM_DISPCC_8250
 	tristate "SM8150/SM8250/SM8350 Display Clock Controller"
 	depends on ARM64 || COMPILE_TEST
@@ -1069,6 +1191,7 @@
 
 config SM_GPUCC_8650
 	tristate "SM8650 Graphics Clock Controller"
+	depends on ARM64 || COMPILE_TEST
 	select SM_GCC_8650
 	help
 	  Support for the graphics clock controller on SM8650 devices.
@@ -1091,6 +1214,27 @@
 	  Support for the TCSR clock controller on SM8650 devices.
 	  Say Y if you want to use peripheral devices such as SD/UFS.
 
+config SA_VIDEOCC_8775P
+	tristate "SA8775P Video Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select SA_GCC_8775P
+	select QCOM_GDSC
+	help
+	  Support for the video clock controller on Qualcomm Technologies, Inc.
+	  SA8775P devices.
+	  Say Y if you want to support video devices and functionality such as
+	  video encode/decode.
+
+config SM_VIDEOCC_7150
+	tristate "SM7150 Video Clock Controller"
+	depends on ARM64 || COMPILE_TEST
+	select SM_GCC_7150
+	select QCOM_GDSC
+	help
+	  Support for the video clock controller on SM7150 devices.
+	  Say Y if you want to support video devices and functionality such as
+	  video encode and decode.
+
 config SM_VIDEOCC_8150
 	tristate "SM8150 Video Clock Controller"
 	depends on ARM64 || COMPILE_TEST
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/Makefile
+++ linux-qcom-6.8.0/drivers/clk/qcom/Makefile
@@ -21,7 +21,10 @@
 obj-$(CONFIG_APQ_GCC_8084) += gcc-apq8084.o
 obj-$(CONFIG_APQ_MMCC_8084) += mmcc-apq8084.o
 obj-$(CONFIG_CLK_GFM_LPASS_SM8250) += lpass-gfm-sm8250.o
+obj-$(CONFIG_CLK_X1E80100_CAMCC) += camcc-x1e80100.o
+obj-$(CONFIG_CLK_X1E80100_DISPCC) += dispcc-x1e80100.o
 obj-$(CONFIG_CLK_X1E80100_GCC) += gcc-x1e80100.o
+obj-$(CONFIG_CLK_X1E80100_GPUCC) += gpucc-x1e80100.o
 obj-$(CONFIG_IPQ_APSS_PLL) += apss-ipq-pll.o
 obj-$(CONFIG_IPQ_APSS_6018) += apss-ipq6018.o
 obj-$(CONFIG_IPQ_GCC_4019) += gcc-ipq4019.o
@@ -63,7 +66,13 @@
 obj-$(CONFIG_QCOM_CLK_SMD_RPM) += clk-smd-rpm.o
 obj-$(CONFIG_QCM_GCC_2290) += gcc-qcm2290.o
 obj-$(CONFIG_QCM_DISPCC_2290) += dispcc-qcm2290.o
+obj-$(CONFIG_QCS_DISPCC_615) += dispcc-qcs615.o
+obj-$(CONFIG_QCS_CAMCC_615) += camcc-qcs615.o
 obj-$(CONFIG_QCS_GCC_404) += gcc-qcs404.o
+obj-$(CONFIG_QCS_GCC_615) += gcc-qcs615.o
+obj-$(CONFIG_QCS_GPUCC_615) += gpucc-qcs615.o
+obj-$(CONFIG_QCS_VIDEOCC_615) += videocc-qcs615.o
+obj-$(CONFIG_QCS_GCC_8300) += gcc-qcs8300.o
 obj-$(CONFIG_QCS_Q6SSTOP_404) += q6sstop-qcs404.o
 obj-$(CONFIG_QCS_TURING_404) += turingcc-qcs404.o
 obj-$(CONFIG_QDU_ECPRICC_1000) += ecpricc-qdu1000.o
@@ -71,11 +80,14 @@
 obj-$(CONFIG_SC_CAMCC_7180) += camcc-sc7180.o
 obj-$(CONFIG_SC_CAMCC_7280) += camcc-sc7280.o
 obj-$(CONFIG_SC_CAMCC_8280XP) += camcc-sc8280xp.o
+obj-$(CONFIG_SA_DISPCC_8775P) += dispcc0-sa8775p.o dispcc1-sa8775p.o
 obj-$(CONFIG_SC_DISPCC_7180) += dispcc-sc7180.o
 obj-$(CONFIG_SC_DISPCC_7280) += dispcc-sc7280.o
 obj-$(CONFIG_SC_DISPCC_8280XP) += dispcc-sc8280xp.o
+obj-$(CONFIG_SA_CAMCC_8775P) += camcc-sa8775p.o
 obj-$(CONFIG_SA_GCC_8775P) += gcc-sa8775p.o
 obj-$(CONFIG_SA_GPUCC_8775P) += gpucc-sa8775p.o
+obj-$(CONFIG_SA_VIDEOCC_8775P) += videocc-sa8775p.o
 obj-$(CONFIG_SC_GCC_7180) += gcc-sc7180.o
 obj-$(CONFIG_SC_GCC_7280) += gcc-sc7280.o
 obj-$(CONFIG_SC_GCC_8180X) += gcc-sc8180x.o
@@ -103,6 +115,7 @@
 obj-$(CONFIG_SDX_GCC_65) += gcc-sdx65.o
 obj-$(CONFIG_SDX_GCC_75) += gcc-sdx75.o
 obj-$(CONFIG_SM_CAMCC_6350) += camcc-sm6350.o
+obj-$(CONFIG_SM_CAMCC_7150) += camcc-sm7150.o
 obj-$(CONFIG_SM_CAMCC_8250) += camcc-sm8250.o
 obj-$(CONFIG_SM_CAMCC_8450) += camcc-sm8450.o
 obj-$(CONFIG_SM_CAMCC_8550) += camcc-sm8550.o
@@ -110,6 +123,7 @@
 obj-$(CONFIG_SM_DISPCC_6125) += dispcc-sm6125.o
 obj-$(CONFIG_SM_DISPCC_6350) += dispcc-sm6350.o
 obj-$(CONFIG_SM_DISPCC_6375) += dispcc-sm6375.o
+obj-$(CONFIG_SM_DISPCC_7150) += dispcc-sm7150.o
 obj-$(CONFIG_SM_DISPCC_8250) += dispcc-sm8250.o
 obj-$(CONFIG_SM_DISPCC_8450) += dispcc-sm8450.o
 obj-$(CONFIG_SM_DISPCC_8550) += dispcc-sm8550.o
@@ -138,6 +152,7 @@
 obj-$(CONFIG_SM_GPUCC_8650) += gpucc-sm8650.o
 obj-$(CONFIG_SM_TCSRCC_8550) += tcsrcc-sm8550.o
 obj-$(CONFIG_SM_TCSRCC_8650) += tcsrcc-sm8650.o
+obj-$(CONFIG_SM_VIDEOCC_7150) += videocc-sm7150.o
 obj-$(CONFIG_SM_VIDEOCC_8150) += videocc-sm8150.o
 obj-$(CONFIG_SM_VIDEOCC_8250) += videocc-sm8250.o
 obj-$(CONFIG_SM_VIDEOCC_8350) += videocc-sm8350.o
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/apss-ipq-pll.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/apss-ipq-pll.c
@@ -55,6 +55,29 @@
 	},
 };
 
+static struct clk_alpha_pll ipq_pll_stromer = {
+	.offset = 0x0,
+	/*
+	 * Reuse CLK_ALPHA_PLL_TYPE_STROMER_PLUS register offsets.
+	 * Although this is a bit confusing, but the offset values
+	 * are correct nevertheless.
+	 */
+	.regs = ipq_pll_offsets[CLK_ALPHA_PLL_TYPE_STROMER_PLUS],
+	.flags = SUPPORTS_DYNAMIC_UPDATE,
+	.clkr = {
+		.enable_reg = 0x0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "a53pll",
+			.parent_data = &(const struct clk_parent_data) {
+				.fw_name = "xo",
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_stromer_ops,
+		},
+	},
+};
+
 static struct clk_alpha_pll ipq_pll_stromer_plus = {
 	.offset = 0x0,
 	.regs = ipq_pll_offsets[CLK_ALPHA_PLL_TYPE_STROMER_PLUS],
@@ -73,10 +96,10 @@
 	},
 };
 
+/* 1.008 GHz configuration */
 static const struct alpha_pll_config ipq5018_pll_config = {
-	.l = 0x32,
+	.l = 0x2a,
 	.config_ctl_val = 0x4001075b,
-	.config_ctl_hi_val = 0x304,
 	.main_output_mask = BIT(0),
 	.aux_output_mask = BIT(1),
 	.early_output_mask = BIT(3),
@@ -90,7 +113,6 @@
 static const struct alpha_pll_config ipq5332_pll_config = {
 	.l = 0x2d,
 	.config_ctl_val = 0x4001075b,
-	.config_ctl_hi_val = 0x304,
 	.main_output_mask = BIT(0),
 	.aux_output_mask = BIT(1),
 	.early_output_mask = BIT(3),
@@ -144,8 +166,8 @@
 };
 
 static const struct apss_pll_data ipq5018_pll_data = {
-	.pll_type = CLK_ALPHA_PLL_TYPE_STROMER_PLUS,
-	.pll = &ipq_pll_stromer_plus,
+	.pll_type = CLK_ALPHA_PLL_TYPE_STROMER,
+	.pll = &ipq_pll_stromer,
 	.pll_config = &ipq5018_pll_config,
 };
 
@@ -203,7 +225,8 @@
 
 	if (data->pll_type == CLK_ALPHA_PLL_TYPE_HUAYRA)
 		clk_alpha_pll_configure(data->pll, regmap, data->pll_config);
-	else if (data->pll_type == CLK_ALPHA_PLL_TYPE_STROMER_PLUS)
+	else if (data->pll_type == CLK_ALPHA_PLL_TYPE_STROMER ||
+		 data->pll_type == CLK_ALPHA_PLL_TYPE_STROMER_PLUS)
 		clk_stromer_pll_configure(data->pll, regmap, data->pll_config);
 
 	ret = devm_clk_register_regmap(dev, &data->pll->clkr);
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/apss-ipq6018.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/apss-ipq6018.c
@@ -123,7 +123,7 @@
 	if (!regmap)
 		return -ENODEV;
 
-	ret = qcom_cc_really_probe(pdev, &apss_ipq6018_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &apss_ipq6018_desc, regmap);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-qcs615.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-qcs615.c
@@ -0,0 +1,1591 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,qcs615-camcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_BI_TCXO,
+};
+
+enum {
+	P_BI_TCXO,
+	P_CAM_CC_PLL0_OUT_AUX,
+	P_CAM_CC_PLL1_OUT_AUX,
+	P_CAM_CC_PLL2_OUT_AUX2,
+	P_CAM_CC_PLL2_OUT_EARLY,
+	P_CAM_CC_PLL3_OUT_MAIN,
+};
+
+static const struct pll_vco brammo_vco[] = {
+	{ 500000000, 1250000000, 0 },
+};
+
+static const struct pll_vco spark_vco[] = {
+	{ 1000000000, 2100000000, 0 },
+	{ 750000000, 1500000000, 1 },
+	{ 500000000, 1000000000, 2 },
+	{ 300000000, 500000000, 3 },
+	{ 550000000, 1100000000, 4 },
+};
+
+/* 600MHz configuration VCO - 2 */
+static const struct alpha_pll_config cam_cc_pll0_config = {
+	.l = 0x1f,
+	.alpha_hi = 0x40,
+	.alpha_en_mask = BIT(24),
+	.vco_val = BIT(21),
+	.vco_mask = GENMASK(21, 20),
+	.aux_output_mask = BIT(1),
+	.config_ctl_val = 0x4001055b,
+	.test_ctl_hi_val = 0x1,
+	.test_ctl_hi_mask = 0x1,
+};
+
+static struct clk_alpha_pll cam_cc_pll0 = {
+	.offset = 0x0,
+	.vco_table = spark_vco,
+	.num_vco = ARRAY_SIZE(spark_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+/* 808MHz configuration VCO - 2 */
+static struct alpha_pll_config cam_cc_pll1_config = {
+	.l = 0x2a,
+	.alpha_hi = 0x15,
+	.alpha = 0x55555555,
+	.alpha_en_mask = BIT(24),
+	.vco_val = BIT(21),
+	.vco_mask = GENMASK(21, 20),
+	.aux_output_mask = BIT(1),
+	.config_ctl_val = 0x4001055b,
+	.test_ctl_hi_val = 0x1,
+	.test_ctl_hi_mask = 0x1,
+};
+
+static struct clk_alpha_pll cam_cc_pll1 = {
+	.offset = 0x1000,
+	.vco_table = spark_vco,
+	.num_vco = ARRAY_SIZE(spark_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+/* 960MHz configuration VCO - 0 */
+static struct alpha_pll_config cam_cc_pll2_config = {
+	.l = 0x32,
+	.vco_val = 0x0,
+	.vco_mask = GENMASK(21, 20),
+	.early_output_mask = BIT(3),
+	.aux2_output_mask = BIT(2),
+	.post_div_val = 0x1 << 8,
+	.post_div_mask = 0x3 << 8,
+	.config_ctl_val = 0x04289,
+	.test_ctl_val = 0x08000000,
+	.test_ctl_mask = 0x08000000,
+};
+
+static struct clk_alpha_pll cam_cc_pll2 = {
+	.offset = 0x2000,
+	.vco_table = brammo_vco,
+	.num_vco = ARRAY_SIZE(brammo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_BRAMMO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll2",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll2_out_aux2[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll2_out_aux2 = {
+	.offset = 0x2000,
+	.post_div_shift = 8,
+	.post_div_table = post_div_table_cam_cc_pll2_out_aux2,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll2_out_aux2),
+	.width = 2,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_BRAMMO],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll2_out_aux2",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll2.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_alpha_pll_postdiv_ops,
+	},
+};
+
+/* 1080MHz configuration - VCO - 0 */
+static struct alpha_pll_config cam_cc_pll3_config = {
+	.l = 0x38,
+	.alpha_hi = 0x40,
+	.alpha_en_mask = BIT(24),
+	.vco_val = 0x0,
+	.vco_mask = GENMASK(21, 20),
+	.main_output_mask = BIT(0),
+	.config_ctl_val = 0x4001055b,
+	.test_ctl_hi_val = 0x1,
+	.test_ctl_hi_mask = 0x1,
+};
+
+static struct clk_alpha_pll cam_cc_pll3 = {
+	.offset = 0x3000,
+	.vco_table = spark_vco,
+	.num_vco = ARRAY_SIZE(spark_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll3",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+static const struct parent_map cam_cc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL1_OUT_AUX, 2 },
+	{ P_CAM_CC_PLL0_OUT_AUX, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll1.clkr.hw },
+	{ .hw = &cam_cc_pll0.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL2_OUT_EARLY, 4 },
+	{ P_CAM_CC_PLL3_OUT_MAIN, 5 },
+	{ P_CAM_CC_PLL0_OUT_AUX, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll2.clkr.hw },
+	{ .hw = &cam_cc_pll3.clkr.hw },
+	{ .hw = &cam_cc_pll0.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL1_OUT_AUX, 2 },
+	{ P_CAM_CC_PLL2_OUT_EARLY, 4 },
+	{ P_CAM_CC_PLL3_OUT_MAIN, 5 },
+	{ P_CAM_CC_PLL0_OUT_AUX, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll1.clkr.hw },
+	{ .hw = &cam_cc_pll2.clkr.hw },
+	{ .hw = &cam_cc_pll3.clkr.hw },
+	{ .hw = &cam_cc_pll0.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL2_OUT_AUX2, 1 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll2_out_aux2.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL3_OUT_MAIN, 5 },
+	{ P_CAM_CC_PLL0_OUT_AUX, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll3.clkr.hw },
+	{ .hw = &cam_cc_pll0.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL0_OUT_AUX, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll0.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_6[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL1_OUT_AUX, 2 },
+	{ P_CAM_CC_PLL3_OUT_MAIN, 5 },
+	{ P_CAM_CC_PLL0_OUT_AUX, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_6[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll1.clkr.hw },
+	{ .hw = &cam_cc_pll3.clkr.hw },
+	{ .hw = &cam_cc_pll0.clkr.hw },
+};
+
+static const struct freq_tbl ftbl_cam_cc_bps_clk_src[] = {
+	F(200000000, P_CAM_CC_PLL0_OUT_AUX, 3, 0, 0),
+	F(360000000, P_CAM_CC_PLL3_OUT_MAIN, 3, 0, 0),
+	F(432000000, P_CAM_CC_PLL3_OUT_MAIN, 2.5, 0, 0),
+	F(480000000, P_CAM_CC_PLL2_OUT_EARLY, 2, 0, 0),
+	F(540000000, P_CAM_CC_PLL3_OUT_MAIN, 2, 0, 0),
+	F(600000000, P_CAM_CC_PLL0_OUT_AUX, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_bps_clk_src = {
+	.cmd_rcgr = 0x6010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_bps_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_bps_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_cci_clk_src[] = {
+	F(37500000, P_CAM_CC_PLL0_OUT_AUX, 16, 0, 0),
+	F(50000000, P_CAM_CC_PLL0_OUT_AUX, 12, 0, 0),
+	F(100000000, P_CAM_CC_PLL0_OUT_AUX, 6, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_cci_clk_src = {
+	.cmd_rcgr = 0xb0d8,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_5,
+	.freq_tbl = ftbl_cam_cc_cci_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cci_clk_src",
+		.parent_data = cam_cc_parent_data_5,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_5),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_cphy_rx_clk_src[] = {
+	F(100000000, P_CAM_CC_PLL0_OUT_AUX, 6, 0, 0),
+	F(200000000, P_CAM_CC_PLL0_OUT_AUX, 3, 0, 0),
+	F(269333333, P_CAM_CC_PLL1_OUT_AUX, 3, 0, 0),
+	F(320000000, P_CAM_CC_PLL2_OUT_EARLY, 3, 0, 0),
+	F(384000000, P_CAM_CC_PLL2_OUT_EARLY, 2.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_cphy_rx_clk_src = {
+	.cmd_rcgr = 0x9064,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_2,
+	.freq_tbl = ftbl_cam_cc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cphy_rx_clk_src",
+		.parent_data = cam_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_2),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_csi0phytimer_clk_src[] = {
+	F(100000000, P_CAM_CC_PLL0_OUT_AUX, 6, 0, 0),
+	F(200000000, P_CAM_CC_PLL0_OUT_AUX, 3, 0, 0),
+	F(269333333, P_CAM_CC_PLL1_OUT_AUX, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_csi0phytimer_clk_src = {
+	.cmd_rcgr = 0x5004,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi0phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi1phytimer_clk_src = {
+	.cmd_rcgr = 0x5028,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi1phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi2phytimer_clk_src = {
+	.cmd_rcgr = 0x504c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi2phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_fast_ahb_clk_src[] = {
+	F(100000000, P_CAM_CC_PLL0_OUT_AUX, 6, 0, 0),
+	F(200000000, P_CAM_CC_PLL0_OUT_AUX, 3, 0, 0),
+	F(300000000, P_CAM_CC_PLL0_OUT_AUX, 2, 0, 0),
+	F(404000000, P_CAM_CC_PLL1_OUT_AUX, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_fast_ahb_clk_src = {
+	.cmd_rcgr = 0x603c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_fast_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_fast_ahb_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_icp_clk_src[] = {
+	F(240000000, P_CAM_CC_PLL0_OUT_AUX, 2.5, 0, 0),
+	F(360000000, P_CAM_CC_PLL3_OUT_MAIN, 3, 0, 0),
+	F(432000000, P_CAM_CC_PLL3_OUT_MAIN, 2.5, 0, 0),
+	F(480000000, P_CAM_CC_PLL2_OUT_EARLY, 2, 0, 0),
+	F(540000000, P_CAM_CC_PLL3_OUT_MAIN, 2, 0, 0),
+	F(600000000, P_CAM_CC_PLL0_OUT_AUX, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_icp_clk_src = {
+	.cmd_rcgr = 0xb088,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_icp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_icp_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ife_0_clk_src[] = {
+	F(240000000, P_CAM_CC_PLL0_OUT_AUX, 2.5, 0, 0),
+	F(360000000, P_CAM_CC_PLL3_OUT_MAIN, 3, 0, 0),
+	F(432000000, P_CAM_CC_PLL3_OUT_MAIN, 2.5, 0, 0),
+	F(540000000, P_CAM_CC_PLL3_OUT_MAIN, 2, 0, 0),
+	F(600000000, P_CAM_CC_PLL0_OUT_AUX, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ife_0_clk_src = {
+	.cmd_rcgr = 0x9010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_4,
+	.freq_tbl = ftbl_cam_cc_ife_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_0_clk_src",
+		.parent_data = cam_cc_parent_data_4,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_4),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ife_0_csid_clk_src[] = {
+	F(100000000, P_CAM_CC_PLL0_OUT_AUX, 6, 0, 0),
+	F(200000000, P_CAM_CC_PLL0_OUT_AUX, 3, 0, 0),
+	F(320000000, P_CAM_CC_PLL2_OUT_EARLY, 3, 0, 0),
+	F(404000000, P_CAM_CC_PLL1_OUT_AUX, 2, 0, 0),
+	F(480000000, P_CAM_CC_PLL2_OUT_EARLY, 2, 0, 0),
+	F(540000000, P_CAM_CC_PLL3_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ife_0_csid_clk_src = {
+	.cmd_rcgr = 0x903c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_2,
+	.freq_tbl = ftbl_cam_cc_ife_0_csid_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_0_csid_clk_src",
+		.parent_data = cam_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_2),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_ife_1_clk_src = {
+	.cmd_rcgr = 0xa010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_4,
+	.freq_tbl = ftbl_cam_cc_ife_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_1_clk_src",
+		.parent_data = cam_cc_parent_data_4,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_4),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_ife_1_csid_clk_src = {
+	.cmd_rcgr = 0xa034,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_2,
+	.freq_tbl = ftbl_cam_cc_ife_0_csid_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_1_csid_clk_src",
+		.parent_data = cam_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_2),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_ife_lite_clk_src = {
+	.cmd_rcgr = 0xb004,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_4,
+	.freq_tbl = ftbl_cam_cc_ife_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_lite_clk_src",
+		.parent_data = cam_cc_parent_data_4,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_4),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_ife_lite_csid_clk_src = {
+	.cmd_rcgr = 0xb024,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_2,
+	.freq_tbl = ftbl_cam_cc_ife_0_csid_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_lite_csid_clk_src",
+		.parent_data = cam_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_2),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_ipe_0_clk_src = {
+	.cmd_rcgr = 0x7010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_icp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ipe_0_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_jpeg_clk_src[] = {
+	F(66666667, P_CAM_CC_PLL0_OUT_AUX, 9, 0, 0),
+	F(133333333, P_CAM_CC_PLL0_OUT_AUX, 4.5, 0, 0),
+	F(216000000, P_CAM_CC_PLL3_OUT_MAIN, 5, 0, 0),
+	F(320000000, P_CAM_CC_PLL2_OUT_EARLY, 3, 0, 0),
+	F(480000000, P_CAM_CC_PLL2_OUT_EARLY, 2, 0, 0),
+	F(600000000, P_CAM_CC_PLL0_OUT_AUX, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_jpeg_clk_src = {
+	.cmd_rcgr = 0xb04c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_jpeg_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_jpeg_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_lrme_clk_src[] = {
+	F(200000000, P_CAM_CC_PLL0_OUT_AUX, 3, 0, 0),
+	F(216000000, P_CAM_CC_PLL3_OUT_MAIN, 5, 0, 0),
+	F(300000000, P_CAM_CC_PLL0_OUT_AUX, 2, 0, 0),
+	F(404000000, P_CAM_CC_PLL1_OUT_AUX, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_lrme_clk_src = {
+	.cmd_rcgr = 0xb0f8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_6,
+	.freq_tbl = ftbl_cam_cc_lrme_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_lrme_clk_src",
+		.parent_data = cam_cc_parent_data_6,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_6),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_mclk0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(24000000, P_CAM_CC_PLL2_OUT_AUX2, 10, 1, 2),
+	F(34285714, P_CAM_CC_PLL2_OUT_AUX2, 14, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_mclk0_clk_src = {
+	.cmd_rcgr = 0x4004,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_3,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk0_clk_src",
+		.parent_data = cam_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_3),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk1_clk_src = {
+	.cmd_rcgr = 0x4024,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_3,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk1_clk_src",
+		.parent_data = cam_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_3),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk2_clk_src = {
+	.cmd_rcgr = 0x4044,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_3,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk2_clk_src",
+		.parent_data = cam_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_3),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk3_clk_src = {
+	.cmd_rcgr = 0x4064,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_3,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk3_clk_src",
+		.parent_data = cam_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_3),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_slow_ahb_clk_src[] = {
+	F(80000000, P_CAM_CC_PLL0_OUT_AUX, 7.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_slow_ahb_clk_src = {
+	.cmd_rcgr = 0x6058,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_slow_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_slow_ahb_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_branch cam_cc_bps_ahb_clk = {
+	.halt_reg = 0x6070,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6070,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_bps_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_bps_areg_clk = {
+	.halt_reg = 0x6054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_bps_areg_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_bps_axi_clk = {
+	.halt_reg = 0x6038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_bps_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_bps_clk = {
+	.halt_reg = 0x6028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_bps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_bps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_camnoc_axi_clk = {
+	.halt_reg = 0xb124,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb124,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_camnoc_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cci_clk = {
+	.halt_reg = 0xb0f0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb0f0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cci_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cci_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_core_ahb_clk = {
+	.halt_reg = 0xb144,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xb144,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_core_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ahb_clk = {
+	.halt_reg = 0xb11c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb11c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi0phytimer_clk = {
+	.halt_reg = 0x501c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x501c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi0phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi0phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi1phytimer_clk = {
+	.halt_reg = 0x5040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x5040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi1phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi1phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi2phytimer_clk = {
+	.halt_reg = 0x5064,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x5064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi2phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi2phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy0_clk = {
+	.halt_reg = 0x5020,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x5020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy1_clk = {
+	.halt_reg = 0x5044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x5044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy2_clk = {
+	.halt_reg = 0x5068,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x5068,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_icp_clk = {
+	.halt_reg = 0xb0a0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb0a0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_icp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_icp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_axi_clk = {
+	.halt_reg = 0x9080,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9080,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_clk = {
+	.halt_reg = 0x9028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_cphy_rx_clk = {
+	.halt_reg = 0x907c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x907c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_cphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_csid_clk = {
+	.halt_reg = 0x9054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_dsp_clk = {
+	.halt_reg = 0x9038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_dsp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_axi_clk = {
+	.halt_reg = 0xa058,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa058,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_clk = {
+	.halt_reg = 0xa028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_cphy_rx_clk = {
+	.halt_reg = 0xa054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_cphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_csid_clk = {
+	.halt_reg = 0xa04c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa04c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_dsp_clk = {
+	.halt_reg = 0xa030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_dsp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_clk = {
+	.halt_reg = 0xb01c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb01c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_lite_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_cphy_rx_clk = {
+	.halt_reg = 0xb044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_cphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_csid_clk = {
+	.halt_reg = 0xb03c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb03c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_lite_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_0_ahb_clk = {
+	.halt_reg = 0x7040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x7040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_0_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_0_areg_clk = {
+	.halt_reg = 0x703c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x703c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_0_areg_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_0_axi_clk = {
+	.halt_reg = 0x7038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x7038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_0_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_0_clk = {
+	.halt_reg = 0x7028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x7028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ipe_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_jpeg_clk = {
+	.halt_reg = 0xb064,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_jpeg_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_jpeg_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_lrme_clk = {
+	.halt_reg = 0xb110,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb110,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_lrme_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_lrme_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk0_clk = {
+	.halt_reg = 0x401c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x401c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk1_clk = {
+	.halt_reg = 0x403c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x403c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk2_clk = {
+	.halt_reg = 0x405c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x405c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk3_clk = {
+	.halt_reg = 0x407c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x407c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_soc_ahb_clk = {
+	.halt_reg = 0xb140,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb140,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_soc_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_sys_tmr_clk = {
+	.halt_reg = 0xb0a8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb0a8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_sys_tmr_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc titan_top_gdsc = {
+	.gdscr = 0xb134,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "titan_top_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR,
+};
+
+static struct gdsc bps_gdsc = {
+	.gdscr = 0x6004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "bps_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &titan_top_gdsc.pd,
+	.flags = POLL_CFG_GDSCR,
+};
+
+static struct gdsc ife_0_gdsc = {
+	.gdscr = 0x9004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "ife_0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &titan_top_gdsc.pd,
+	.flags = POLL_CFG_GDSCR,
+};
+
+static struct gdsc ife_1_gdsc = {
+	.gdscr = 0xa004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "ife_1_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &titan_top_gdsc.pd,
+	.flags = POLL_CFG_GDSCR,
+};
+
+static struct gdsc ipe_0_gdsc = {
+	.gdscr = 0x7004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "ipe_0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &titan_top_gdsc.pd,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+};
+
+static struct clk_regmap *cam_cc_qcs615_clocks[] = {
+	[CAM_CC_BPS_AHB_CLK] = &cam_cc_bps_ahb_clk.clkr,
+	[CAM_CC_BPS_AREG_CLK] = &cam_cc_bps_areg_clk.clkr,
+	[CAM_CC_BPS_AXI_CLK] = &cam_cc_bps_axi_clk.clkr,
+	[CAM_CC_BPS_CLK] = &cam_cc_bps_clk.clkr,
+	[CAM_CC_BPS_CLK_SRC] = &cam_cc_bps_clk_src.clkr,
+	[CAM_CC_CAMNOC_AXI_CLK] = &cam_cc_camnoc_axi_clk.clkr,
+	[CAM_CC_CCI_CLK] = &cam_cc_cci_clk.clkr,
+	[CAM_CC_CCI_CLK_SRC] = &cam_cc_cci_clk_src.clkr,
+	[CAM_CC_CORE_AHB_CLK] = &cam_cc_core_ahb_clk.clkr,
+	[CAM_CC_CPAS_AHB_CLK] = &cam_cc_cpas_ahb_clk.clkr,
+	[CAM_CC_CPHY_RX_CLK_SRC] = &cam_cc_cphy_rx_clk_src.clkr,
+	[CAM_CC_CSI0PHYTIMER_CLK] = &cam_cc_csi0phytimer_clk.clkr,
+	[CAM_CC_CSI0PHYTIMER_CLK_SRC] = &cam_cc_csi0phytimer_clk_src.clkr,
+	[CAM_CC_CSI1PHYTIMER_CLK] = &cam_cc_csi1phytimer_clk.clkr,
+	[CAM_CC_CSI1PHYTIMER_CLK_SRC] = &cam_cc_csi1phytimer_clk_src.clkr,
+	[CAM_CC_CSI2PHYTIMER_CLK] = &cam_cc_csi2phytimer_clk.clkr,
+	[CAM_CC_CSI2PHYTIMER_CLK_SRC] = &cam_cc_csi2phytimer_clk_src.clkr,
+	[CAM_CC_CSIPHY0_CLK] = &cam_cc_csiphy0_clk.clkr,
+	[CAM_CC_CSIPHY1_CLK] = &cam_cc_csiphy1_clk.clkr,
+	[CAM_CC_CSIPHY2_CLK] = &cam_cc_csiphy2_clk.clkr,
+	[CAM_CC_FAST_AHB_CLK_SRC] = &cam_cc_fast_ahb_clk_src.clkr,
+	[CAM_CC_ICP_CLK] = &cam_cc_icp_clk.clkr,
+	[CAM_CC_ICP_CLK_SRC] = &cam_cc_icp_clk_src.clkr,
+	[CAM_CC_IFE_0_AXI_CLK] = &cam_cc_ife_0_axi_clk.clkr,
+	[CAM_CC_IFE_0_CLK] = &cam_cc_ife_0_clk.clkr,
+	[CAM_CC_IFE_0_CLK_SRC] = &cam_cc_ife_0_clk_src.clkr,
+	[CAM_CC_IFE_0_CPHY_RX_CLK] = &cam_cc_ife_0_cphy_rx_clk.clkr,
+	[CAM_CC_IFE_0_CSID_CLK] = &cam_cc_ife_0_csid_clk.clkr,
+	[CAM_CC_IFE_0_CSID_CLK_SRC] = &cam_cc_ife_0_csid_clk_src.clkr,
+	[CAM_CC_IFE_0_DSP_CLK] = &cam_cc_ife_0_dsp_clk.clkr,
+	[CAM_CC_IFE_1_AXI_CLK] = &cam_cc_ife_1_axi_clk.clkr,
+	[CAM_CC_IFE_1_CLK] = &cam_cc_ife_1_clk.clkr,
+	[CAM_CC_IFE_1_CLK_SRC] = &cam_cc_ife_1_clk_src.clkr,
+	[CAM_CC_IFE_1_CPHY_RX_CLK] = &cam_cc_ife_1_cphy_rx_clk.clkr,
+	[CAM_CC_IFE_1_CSID_CLK] = &cam_cc_ife_1_csid_clk.clkr,
+	[CAM_CC_IFE_1_CSID_CLK_SRC] = &cam_cc_ife_1_csid_clk_src.clkr,
+	[CAM_CC_IFE_1_DSP_CLK] = &cam_cc_ife_1_dsp_clk.clkr,
+	[CAM_CC_IFE_LITE_CLK] = &cam_cc_ife_lite_clk.clkr,
+	[CAM_CC_IFE_LITE_CLK_SRC] = &cam_cc_ife_lite_clk_src.clkr,
+	[CAM_CC_IFE_LITE_CPHY_RX_CLK] = &cam_cc_ife_lite_cphy_rx_clk.clkr,
+	[CAM_CC_IFE_LITE_CSID_CLK] = &cam_cc_ife_lite_csid_clk.clkr,
+	[CAM_CC_IFE_LITE_CSID_CLK_SRC] = &cam_cc_ife_lite_csid_clk_src.clkr,
+	[CAM_CC_IPE_0_AHB_CLK] = &cam_cc_ipe_0_ahb_clk.clkr,
+	[CAM_CC_IPE_0_AREG_CLK] = &cam_cc_ipe_0_areg_clk.clkr,
+	[CAM_CC_IPE_0_AXI_CLK] = &cam_cc_ipe_0_axi_clk.clkr,
+	[CAM_CC_IPE_0_CLK] = &cam_cc_ipe_0_clk.clkr,
+	[CAM_CC_IPE_0_CLK_SRC] = &cam_cc_ipe_0_clk_src.clkr,
+	[CAM_CC_JPEG_CLK] = &cam_cc_jpeg_clk.clkr,
+	[CAM_CC_JPEG_CLK_SRC] = &cam_cc_jpeg_clk_src.clkr,
+	[CAM_CC_LRME_CLK] = &cam_cc_lrme_clk.clkr,
+	[CAM_CC_LRME_CLK_SRC] = &cam_cc_lrme_clk_src.clkr,
+	[CAM_CC_MCLK0_CLK] = &cam_cc_mclk0_clk.clkr,
+	[CAM_CC_MCLK0_CLK_SRC] = &cam_cc_mclk0_clk_src.clkr,
+	[CAM_CC_MCLK1_CLK] = &cam_cc_mclk1_clk.clkr,
+	[CAM_CC_MCLK1_CLK_SRC] = &cam_cc_mclk1_clk_src.clkr,
+	[CAM_CC_MCLK2_CLK] = &cam_cc_mclk2_clk.clkr,
+	[CAM_CC_MCLK2_CLK_SRC] = &cam_cc_mclk2_clk_src.clkr,
+	[CAM_CC_MCLK3_CLK] = &cam_cc_mclk3_clk.clkr,
+	[CAM_CC_MCLK3_CLK_SRC] = &cam_cc_mclk3_clk_src.clkr,
+	[CAM_CC_PLL0] = &cam_cc_pll0.clkr,
+	[CAM_CC_PLL1] = &cam_cc_pll1.clkr,
+	[CAM_CC_PLL2] = &cam_cc_pll2.clkr,
+	[CAM_CC_PLL2_OUT_AUX2] = &cam_cc_pll2_out_aux2.clkr,
+	[CAM_CC_PLL3] = &cam_cc_pll3.clkr,
+	[CAM_CC_SLOW_AHB_CLK_SRC] = &cam_cc_slow_ahb_clk_src.clkr,
+	[CAM_CC_SOC_AHB_CLK] = &cam_cc_soc_ahb_clk.clkr,
+	[CAM_CC_SYS_TMR_CLK] = &cam_cc_sys_tmr_clk.clkr,
+};
+
+static struct gdsc *cam_cc_qcs615_gdscs[] = {
+	[BPS_GDSC] = &bps_gdsc,
+	[IFE_0_GDSC] = &ife_0_gdsc,
+	[IFE_1_GDSC] = &ife_1_gdsc,
+	[IPE_0_GDSC] = &ipe_0_gdsc,
+	[TITAN_TOP_GDSC] = &titan_top_gdsc,
+};
+
+static const struct qcom_reset_map cam_cc_qcs615_resets[] = {
+	[CAM_CC_BPS_BCR] = { 0x6000 },
+	[CAM_CC_CAMNOC_BCR] = { 0xb120 },
+	[CAM_CC_CCI_BCR] = { 0xb0d4 },
+	[CAM_CC_CPAS_BCR] = { 0xb118 },
+	[CAM_CC_CSI0PHY_BCR] = { 0x5000 },
+	[CAM_CC_CSI1PHY_BCR] = { 0x5024 },
+	[CAM_CC_CSI2PHY_BCR] = { 0x5048 },
+	[CAM_CC_ICP_BCR] = { 0xb074 },
+	[CAM_CC_IFE_0_BCR] = { 0x9000 },
+	[CAM_CC_IFE_1_BCR] = { 0xa000 },
+	[CAM_CC_IFE_LITE_BCR] = { 0xb000 },
+	[CAM_CC_IPE_0_BCR] = { 0x7000 },
+	[CAM_CC_JPEG_BCR] = { 0xb048 },
+	[CAM_CC_LRME_BCR] = { 0xb0f4 },
+	[CAM_CC_MCLK0_BCR] = { 0x4000 },
+	[CAM_CC_MCLK1_BCR] = { 0x4020 },
+	[CAM_CC_MCLK2_BCR] = { 0x4040 },
+	[CAM_CC_MCLK3_BCR] = { 0x4060 },
+	[CAM_CC_TITAN_TOP_BCR] = { 0xb130 },
+};
+
+static const struct regmap_config cam_cc_qcs615_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0xd004,
+	.fast_io = true,
+};
+
+static const struct qcom_cc_desc cam_cc_qcs615_desc = {
+	.config = &cam_cc_qcs615_regmap_config,
+	.clks = cam_cc_qcs615_clocks,
+	.num_clks = ARRAY_SIZE(cam_cc_qcs615_clocks),
+	.resets = cam_cc_qcs615_resets,
+	.num_resets = ARRAY_SIZE(cam_cc_qcs615_resets),
+	.gdscs = cam_cc_qcs615_gdscs,
+	.num_gdscs = ARRAY_SIZE(cam_cc_qcs615_gdscs),
+};
+
+static const struct of_device_id cam_cc_qcs615_match_table[] = {
+	{ .compatible = "qcom,qcs615-camcc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, cam_cc_qcs615_match_table);
+
+static int cam_cc_qcs615_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+
+	regmap = qcom_cc_map(pdev, &cam_cc_qcs615_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	clk_alpha_pll_configure(&cam_cc_pll0, regmap, &cam_cc_pll0_config);
+	clk_alpha_pll_configure(&cam_cc_pll1, regmap, &cam_cc_pll1_config);
+	clk_alpha_pll_configure(&cam_cc_pll2, regmap, &cam_cc_pll2_config);
+	clk_alpha_pll_configure(&cam_cc_pll3, regmap, &cam_cc_pll3_config);
+
+	return qcom_cc_really_probe(&pdev->dev, &cam_cc_qcs615_desc, regmap);
+}
+
+static struct platform_driver cam_cc_qcs615_driver = {
+	.probe = cam_cc_qcs615_probe,
+	.driver = {
+		.name = "camcc-qcs615",
+		.of_match_table = cam_cc_qcs615_match_table,
+	},
+};
+
+module_platform_driver(cam_cc_qcs615_driver);
+
+MODULE_DESCRIPTION("QTI CAMCC QCS615 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sa8775p.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sa8775p.c
@@ -0,0 +1,1967 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,sa8775p-camcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_IFACE,
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+	DT_SLEEP_CLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_BI_TCXO_AO,
+	P_CAM_CC_PLL0_OUT_EVEN,
+	P_CAM_CC_PLL0_OUT_MAIN,
+	P_CAM_CC_PLL0_OUT_ODD,
+	P_CAM_CC_PLL2_OUT_EVEN,
+	P_CAM_CC_PLL2_OUT_MAIN,
+	P_CAM_CC_PLL3_OUT_EVEN,
+	P_CAM_CC_PLL4_OUT_EVEN,
+	P_CAM_CC_PLL5_OUT_EVEN,
+	P_SLEEP_CLK,
+};
+
+static const struct pll_vco lucid_evo_vco[] = {
+	{ 249600000, 2020000000, 0 },
+};
+
+static const struct pll_vco rivian_evo_vco[] = {
+	{ 864000000, 1056000000, 0 },
+};
+
+static const struct alpha_pll_config cam_cc_pll0_config = {
+	.l = 0x3e,
+	.alpha = 0x8000,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00008400,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll cam_cc_pll0 = {
+	.offset = 0x0,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll0_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll0_out_even = {
+	.offset = 0x0,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll0_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll0_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll0_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll0.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_evo_ops,
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll0_out_odd[] = {
+	{ 0x2, 3 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll0_out_odd = {
+	.offset = 0x0,
+	.post_div_shift = 14,
+	.post_div_table = post_div_table_cam_cc_pll0_out_odd,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll0_out_odd),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll0_out_odd",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll0.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_evo_ops,
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll2_config = {
+	.l = 0x32,
+	.alpha = 0x0,
+	.config_ctl_val = 0x90008820,
+	.config_ctl_hi_val = 0x00890263,
+	.config_ctl_hi1_val = 0x00000247,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00400000,
+};
+
+static struct clk_alpha_pll cam_cc_pll2 = {
+	.offset = 0x1000,
+	.vco_table = rivian_evo_vco,
+	.num_vco = ARRAY_SIZE(rivian_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_RIVIAN_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll2",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_rivian_evo_ops,
+		},
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll3_config = {
+	.l = 0x32,
+	.alpha = 0x0,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00000400,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll cam_cc_pll3 = {
+	.offset = 0x2000,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll3",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll3_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll3_out_even = {
+	.offset = 0x2000,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll3_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll3_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll3_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll3.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_evo_ops,
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll4_config = {
+	.l = 0x32,
+	.alpha = 0x0,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00000400,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll cam_cc_pll4 = {
+	.offset = 0x3000,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll4",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll4_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll4_out_even = {
+	.offset = 0x3000,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll4_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll4_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll4_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll4.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_evo_ops,
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll5_config = {
+	.l = 0x32,
+	.alpha = 0x0,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00000400,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll cam_cc_pll5 = {
+	.offset = 0x4000,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll5",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll5_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll5_out_even = {
+	.offset = 0x4000,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll5_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll5_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll5_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll5.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_evo_ops,
+	},
+};
+
+static const struct parent_map cam_cc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL0_OUT_MAIN, 1 },
+	{ P_CAM_CC_PLL0_OUT_EVEN, 2 },
+	{ P_CAM_CC_PLL0_OUT_ODD, 3 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll0.clkr.hw },
+	{ .hw = &cam_cc_pll0_out_even.clkr.hw },
+	{ .hw = &cam_cc_pll0_out_odd.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL2_OUT_EVEN, 3 },
+	{ P_CAM_CC_PLL2_OUT_MAIN, 5 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll2.clkr.hw },
+	{ .hw = &cam_cc_pll2.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL4_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll4_out_even.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL5_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll5_out_even.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL3_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll3_out_even.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_5[] = {
+	{ P_SLEEP_CLK, 0 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_5[] = {
+	{ .index = DT_SLEEP_CLK },
+};
+
+static const struct parent_map cam_cc_parent_map_6_ao[] = {
+	{ P_BI_TCXO_AO, 0 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_6_ao[] = {
+	{ .index = DT_BI_TCXO_AO },
+};
+
+static const struct freq_tbl ftbl_cam_cc_camnoc_axi_clk_src[] = {
+	F(400000000, P_CAM_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_camnoc_axi_clk_src = {
+	.cmd_rcgr = 0x13170,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_camnoc_axi_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_camnoc_axi_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_cci_0_clk_src[] = {
+	F(37500000, P_CAM_CC_PLL0_OUT_MAIN, 16, 1, 2),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_cci_0_clk_src = {
+	.cmd_rcgr = 0x130a0,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cci_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cci_0_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_cci_1_clk_src = {
+	.cmd_rcgr = 0x130bc,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cci_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cci_1_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_cci_2_clk_src = {
+	.cmd_rcgr = 0x130d8,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cci_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cci_2_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_cci_3_clk_src = {
+	.cmd_rcgr = 0x130f4,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cci_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cci_3_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_cphy_rx_clk_src[] = {
+	F(400000000, P_CAM_CC_PLL0_OUT_ODD, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_cphy_rx_clk_src = {
+	.cmd_rcgr = 0x11034,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cphy_rx_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi0phytimer_clk_src = {
+	.cmd_rcgr = 0x15074,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi0phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi1phytimer_clk_src = {
+	.cmd_rcgr = 0x15098,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi1phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi2phytimer_clk_src = {
+	.cmd_rcgr = 0x150b8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi2phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi3phytimer_clk_src = {
+	.cmd_rcgr = 0x150d8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi3phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csid_clk_src = {
+	.cmd_rcgr = 0x13150,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csid_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_fast_ahb_clk_src[] = {
+	F(300000000, P_CAM_CC_PLL0_OUT_MAIN, 4, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_fast_ahb_clk_src = {
+	.cmd_rcgr = 0x13120,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_fast_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_fast_ahb_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_icp_clk_src[] = {
+	F(480000000, P_CAM_CC_PLL0_OUT_MAIN, 2.5, 0, 0),
+	F(600000000, P_CAM_CC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_icp_clk_src = {
+	.cmd_rcgr = 0x1307c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_icp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_icp_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ife_0_clk_src[] = {
+	F(480000000, P_CAM_CC_PLL4_OUT_EVEN, 1, 0, 0),
+	F(600000000, P_CAM_CC_PLL4_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ife_0_clk_src = {
+	.cmd_rcgr = 0x11004,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_2,
+	.freq_tbl = ftbl_cam_cc_ife_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_0_clk_src",
+		.parent_data = cam_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ife_1_clk_src[] = {
+	F(480000000, P_CAM_CC_PLL5_OUT_EVEN, 1, 0, 0),
+	F(600000000, P_CAM_CC_PLL5_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ife_1_clk_src = {
+	.cmd_rcgr = 0x12004,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_3,
+	.freq_tbl = ftbl_cam_cc_ife_1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_1_clk_src",
+		.parent_data = cam_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ife_lite_clk_src[] = {
+	F(400000000, P_CAM_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(480000000, P_CAM_CC_PLL0_OUT_MAIN, 2.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ife_lite_clk_src = {
+	.cmd_rcgr = 0x13000,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_ife_lite_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_lite_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_ife_lite_csid_clk_src = {
+	.cmd_rcgr = 0x13020,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_lite_csid_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ipe_clk_src[] = {
+	F(480000000, P_CAM_CC_PLL3_OUT_EVEN, 1, 0, 0),
+	F(600000000, P_CAM_CC_PLL3_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ipe_clk_src = {
+	.cmd_rcgr = 0x10004,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_4,
+	.freq_tbl = ftbl_cam_cc_ipe_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ipe_clk_src",
+		.parent_data = cam_cc_parent_data_4,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_mclk0_clk_src[] = {
+	F(19200000, P_CAM_CC_PLL2_OUT_MAIN, 1, 1, 50),
+	F(24000000, P_CAM_CC_PLL2_OUT_MAIN, 10, 1, 4),
+	F(64000000, P_CAM_CC_PLL2_OUT_MAIN, 15, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_mclk0_clk_src = {
+	.cmd_rcgr = 0x15004,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk0_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk1_clk_src = {
+	.cmd_rcgr = 0x15020,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk1_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk2_clk_src = {
+	.cmd_rcgr = 0x1503c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk2_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk3_clk_src = {
+	.cmd_rcgr = 0x15058,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk3_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_sleep_clk_src[] = {
+	F(32000, P_SLEEP_CLK, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_sleep_clk_src = {
+	.cmd_rcgr = 0x131f0,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_5,
+	.freq_tbl = ftbl_cam_cc_sleep_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_sleep_clk_src",
+		.parent_data = cam_cc_parent_data_5,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_5),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_slow_ahb_clk_src[] = {
+	F(80000000, P_CAM_CC_PLL0_OUT_EVEN, 7.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_slow_ahb_clk_src = {
+	.cmd_rcgr = 0x13138,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_slow_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_slow_ahb_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_xo_clk_src[] = {
+	F(19200000, P_BI_TCXO_AO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_xo_clk_src = {
+	.cmd_rcgr = 0x131d4,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_6_ao,
+	.freq_tbl = ftbl_cam_cc_xo_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_xo_clk_src",
+		.parent_data = cam_cc_parent_data_6_ao,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_6_ao),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_branch cam_cc_camnoc_axi_clk = {
+	.halt_reg = 0x13188,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13188,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_camnoc_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_camnoc_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_camnoc_dcd_xo_clk = {
+	.halt_reg = 0x13190,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13190,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_camnoc_dcd_xo_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_qdss_debug_xo_clk = {
+	.halt_reg = 0x131b8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x131b8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_qdss_debug_xo_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cci_0_clk = {
+	.halt_reg = 0x130b8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x130b8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cci_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cci_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cci_1_clk = {
+	.halt_reg = 0x130d4,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x130d4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cci_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cci_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cci_2_clk = {
+	.halt_reg = 0x130f0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x130f0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cci_2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cci_2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cci_3_clk = {
+	.halt_reg = 0x1310c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1310c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cci_3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cci_3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_core_ahb_clk = {
+	.halt_reg = 0x131d0,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x131d0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_core_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ahb_clk = {
+	.halt_reg = 0x13110,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13110,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_fast_ahb_clk = {
+	.halt_reg = 0x13118,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13118,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ife_0_clk = {
+	.halt_reg = 0x11024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x11024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ife_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ife_1_clk = {
+	.halt_reg = 0x12024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x12024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ife_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ife_lite_clk = {
+	.halt_reg = 0x1301c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1301c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ife_lite_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_lite_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ipe_clk = {
+	.halt_reg = 0x10024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x10024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ipe_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ipe_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_sfe_lite_0_clk = {
+	.halt_reg = 0x13050,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13050,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_sfe_lite_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_sfe_lite_1_clk = {
+	.halt_reg = 0x13068,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13068,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_sfe_lite_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi0phytimer_clk = {
+	.halt_reg = 0x1508c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1508c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi0phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi0phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi1phytimer_clk = {
+	.halt_reg = 0x150b0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150b0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi1phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi1phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi2phytimer_clk = {
+	.halt_reg = 0x150d0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150d0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi2phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi2phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi3phytimer_clk = {
+	.halt_reg = 0x150f0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150f0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi3phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi3phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csid_clk = {
+	.halt_reg = 0x13168,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13168,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csid_csiphy_rx_clk = {
+	.halt_reg = 0x15094,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15094,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csid_csiphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy0_clk = {
+	.halt_reg = 0x15090,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15090,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy1_clk = {
+	.halt_reg = 0x150b4,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150b4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy2_clk = {
+	.halt_reg = 0x150d4,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150d4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy3_clk = {
+	.halt_reg = 0x150f4,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150f4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_icp_ahb_clk = {
+	.halt_reg = 0x1309c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1309c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_icp_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_icp_clk = {
+	.halt_reg = 0x13094,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13094,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_icp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_icp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_clk = {
+	.halt_reg = 0x1101c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1101c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_fast_ahb_clk = {
+	.halt_reg = 0x11030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x11030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_clk = {
+	.halt_reg = 0x1201c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1201c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_fast_ahb_clk = {
+	.halt_reg = 0x12030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x12030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_ahb_clk = {
+	.halt_reg = 0x13044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_clk = {
+	.halt_reg = 0x13018,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_lite_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_cphy_rx_clk = {
+	.halt_reg = 0x13040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_cphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_csid_clk = {
+	.halt_reg = 0x13038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_lite_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_ahb_clk = {
+	.halt_reg = 0x10030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x10030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_clk = {
+	.halt_reg = 0x1001c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1001c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ipe_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_fast_ahb_clk = {
+	.halt_reg = 0x10034,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x10034,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk0_clk = {
+	.halt_reg = 0x1501c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1501c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk1_clk = {
+	.halt_reg = 0x15038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk2_clk = {
+	.halt_reg = 0x15054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk3_clk = {
+	.halt_reg = 0x15070,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15070,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_sfe_lite_0_clk = {
+	.halt_reg = 0x1304c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1304c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_sfe_lite_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_sfe_lite_0_fast_ahb_clk = {
+	.halt_reg = 0x1305c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1305c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_sfe_lite_0_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_sfe_lite_1_clk = {
+	.halt_reg = 0x13064,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_sfe_lite_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_sfe_lite_1_fast_ahb_clk = {
+	.halt_reg = 0x13074,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13074,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_sfe_lite_1_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_sm_obs_clk = {
+	.halt_reg = 0x1510c,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x1510c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_sm_obs_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_titan_top_accu_shift_clk = {
+	.halt_reg = 0x131f0,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x131f0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_titan_top_accu_shift_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc cam_cc_titan_top_gdsc = {
+	.gdscr = 0x131bc,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "cam_cc_titan_top_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+};
+
+static struct clk_regmap *cam_cc_sa8775p_clocks[] = {
+	[CAM_CC_CAMNOC_AXI_CLK] = &cam_cc_camnoc_axi_clk.clkr,
+	[CAM_CC_CAMNOC_AXI_CLK_SRC] = &cam_cc_camnoc_axi_clk_src.clkr,
+	[CAM_CC_CAMNOC_DCD_XO_CLK] = &cam_cc_camnoc_dcd_xo_clk.clkr,
+	[CAM_CC_CCI_0_CLK] = &cam_cc_cci_0_clk.clkr,
+	[CAM_CC_CCI_0_CLK_SRC] = &cam_cc_cci_0_clk_src.clkr,
+	[CAM_CC_CCI_1_CLK] = &cam_cc_cci_1_clk.clkr,
+	[CAM_CC_CCI_1_CLK_SRC] = &cam_cc_cci_1_clk_src.clkr,
+	[CAM_CC_CCI_2_CLK] = &cam_cc_cci_2_clk.clkr,
+	[CAM_CC_CCI_2_CLK_SRC] = &cam_cc_cci_2_clk_src.clkr,
+	[CAM_CC_CCI_3_CLK] = &cam_cc_cci_3_clk.clkr,
+	[CAM_CC_CCI_3_CLK_SRC] = &cam_cc_cci_3_clk_src.clkr,
+	[CAM_CC_CORE_AHB_CLK] = &cam_cc_core_ahb_clk.clkr,
+	[CAM_CC_CPAS_AHB_CLK] = &cam_cc_cpas_ahb_clk.clkr,
+	[CAM_CC_CPAS_FAST_AHB_CLK] = &cam_cc_cpas_fast_ahb_clk.clkr,
+	[CAM_CC_CPAS_IFE_0_CLK] = &cam_cc_cpas_ife_0_clk.clkr,
+	[CAM_CC_CPAS_IFE_1_CLK] = &cam_cc_cpas_ife_1_clk.clkr,
+	[CAM_CC_CPAS_IFE_LITE_CLK] = &cam_cc_cpas_ife_lite_clk.clkr,
+	[CAM_CC_CPAS_IPE_CLK] = &cam_cc_cpas_ipe_clk.clkr,
+	[CAM_CC_CPAS_SFE_LITE_0_CLK] = &cam_cc_cpas_sfe_lite_0_clk.clkr,
+	[CAM_CC_CPAS_SFE_LITE_1_CLK] = &cam_cc_cpas_sfe_lite_1_clk.clkr,
+	[CAM_CC_CPHY_RX_CLK_SRC] = &cam_cc_cphy_rx_clk_src.clkr,
+	[CAM_CC_CSI0PHYTIMER_CLK] = &cam_cc_csi0phytimer_clk.clkr,
+	[CAM_CC_CSI0PHYTIMER_CLK_SRC] = &cam_cc_csi0phytimer_clk_src.clkr,
+	[CAM_CC_CSI1PHYTIMER_CLK] = &cam_cc_csi1phytimer_clk.clkr,
+	[CAM_CC_CSI1PHYTIMER_CLK_SRC] = &cam_cc_csi1phytimer_clk_src.clkr,
+	[CAM_CC_CSI2PHYTIMER_CLK] = &cam_cc_csi2phytimer_clk.clkr,
+	[CAM_CC_CSI2PHYTIMER_CLK_SRC] = &cam_cc_csi2phytimer_clk_src.clkr,
+	[CAM_CC_CSI3PHYTIMER_CLK] = &cam_cc_csi3phytimer_clk.clkr,
+	[CAM_CC_CSI3PHYTIMER_CLK_SRC] = &cam_cc_csi3phytimer_clk_src.clkr,
+	[CAM_CC_CSID_CLK] = &cam_cc_csid_clk.clkr,
+	[CAM_CC_CSID_CLK_SRC] = &cam_cc_csid_clk_src.clkr,
+	[CAM_CC_CSID_CSIPHY_RX_CLK] = &cam_cc_csid_csiphy_rx_clk.clkr,
+	[CAM_CC_CSIPHY0_CLK] = &cam_cc_csiphy0_clk.clkr,
+	[CAM_CC_CSIPHY1_CLK] = &cam_cc_csiphy1_clk.clkr,
+	[CAM_CC_CSIPHY2_CLK] = &cam_cc_csiphy2_clk.clkr,
+	[CAM_CC_CSIPHY3_CLK] = &cam_cc_csiphy3_clk.clkr,
+	[CAM_CC_FAST_AHB_CLK_SRC] = &cam_cc_fast_ahb_clk_src.clkr,
+	[CAM_CC_ICP_AHB_CLK] = &cam_cc_icp_ahb_clk.clkr,
+	[CAM_CC_ICP_CLK] = &cam_cc_icp_clk.clkr,
+	[CAM_CC_ICP_CLK_SRC] = &cam_cc_icp_clk_src.clkr,
+	[CAM_CC_IFE_0_CLK] = &cam_cc_ife_0_clk.clkr,
+	[CAM_CC_IFE_0_CLK_SRC] = &cam_cc_ife_0_clk_src.clkr,
+	[CAM_CC_IFE_0_FAST_AHB_CLK] = &cam_cc_ife_0_fast_ahb_clk.clkr,
+	[CAM_CC_IFE_1_CLK] = &cam_cc_ife_1_clk.clkr,
+	[CAM_CC_IFE_1_CLK_SRC] = &cam_cc_ife_1_clk_src.clkr,
+	[CAM_CC_IFE_1_FAST_AHB_CLK] = &cam_cc_ife_1_fast_ahb_clk.clkr,
+	[CAM_CC_IFE_LITE_AHB_CLK] = &cam_cc_ife_lite_ahb_clk.clkr,
+	[CAM_CC_IFE_LITE_CLK] = &cam_cc_ife_lite_clk.clkr,
+	[CAM_CC_IFE_LITE_CLK_SRC] = &cam_cc_ife_lite_clk_src.clkr,
+	[CAM_CC_IFE_LITE_CPHY_RX_CLK] = &cam_cc_ife_lite_cphy_rx_clk.clkr,
+	[CAM_CC_IFE_LITE_CSID_CLK] = &cam_cc_ife_lite_csid_clk.clkr,
+	[CAM_CC_IFE_LITE_CSID_CLK_SRC] = &cam_cc_ife_lite_csid_clk_src.clkr,
+	[CAM_CC_IPE_AHB_CLK] = &cam_cc_ipe_ahb_clk.clkr,
+	[CAM_CC_IPE_CLK] = &cam_cc_ipe_clk.clkr,
+	[CAM_CC_IPE_CLK_SRC] = &cam_cc_ipe_clk_src.clkr,
+	[CAM_CC_IPE_FAST_AHB_CLK] = &cam_cc_ipe_fast_ahb_clk.clkr,
+	[CAM_CC_MCLK0_CLK] = &cam_cc_mclk0_clk.clkr,
+	[CAM_CC_MCLK0_CLK_SRC] = &cam_cc_mclk0_clk_src.clkr,
+	[CAM_CC_MCLK1_CLK] = &cam_cc_mclk1_clk.clkr,
+	[CAM_CC_MCLK1_CLK_SRC] = &cam_cc_mclk1_clk_src.clkr,
+	[CAM_CC_MCLK2_CLK] = &cam_cc_mclk2_clk.clkr,
+	[CAM_CC_MCLK2_CLK_SRC] = &cam_cc_mclk2_clk_src.clkr,
+	[CAM_CC_MCLK3_CLK] = &cam_cc_mclk3_clk.clkr,
+	[CAM_CC_MCLK3_CLK_SRC] = &cam_cc_mclk3_clk_src.clkr,
+	[CAM_CC_PLL0] = &cam_cc_pll0.clkr,
+	[CAM_CC_PLL0_OUT_EVEN] = &cam_cc_pll0_out_even.clkr,
+	[CAM_CC_PLL0_OUT_ODD] = &cam_cc_pll0_out_odd.clkr,
+	[CAM_CC_PLL2] = &cam_cc_pll2.clkr,
+	[CAM_CC_PLL3] = &cam_cc_pll3.clkr,
+	[CAM_CC_PLL3_OUT_EVEN] = &cam_cc_pll3_out_even.clkr,
+	[CAM_CC_PLL4] = &cam_cc_pll4.clkr,
+	[CAM_CC_PLL4_OUT_EVEN] = &cam_cc_pll4_out_even.clkr,
+	[CAM_CC_PLL5] = &cam_cc_pll5.clkr,
+	[CAM_CC_PLL5_OUT_EVEN] = &cam_cc_pll5_out_even.clkr,
+	[CAM_CC_SFE_LITE_0_CLK] = &cam_cc_sfe_lite_0_clk.clkr,
+	[CAM_CC_SFE_LITE_0_FAST_AHB_CLK] = &cam_cc_sfe_lite_0_fast_ahb_clk.clkr,
+	[CAM_CC_SFE_LITE_1_CLK] = &cam_cc_sfe_lite_1_clk.clkr,
+	[CAM_CC_SFE_LITE_1_FAST_AHB_CLK] = &cam_cc_sfe_lite_1_fast_ahb_clk.clkr,
+	[CAM_CC_SLEEP_CLK_SRC] = &cam_cc_sleep_clk_src.clkr,
+	[CAM_CC_SLOW_AHB_CLK_SRC] = &cam_cc_slow_ahb_clk_src.clkr,
+	[CAM_CC_SM_OBS_CLK] = &cam_cc_sm_obs_clk.clkr,
+	[CAM_CC_TITAN_TOP_ACCU_SHIFT_CLK] = NULL,
+	[CAM_CC_XO_CLK_SRC] = &cam_cc_xo_clk_src.clkr,
+	[CAM_CC_QDSS_DEBUG_XO_CLK] = &cam_cc_qdss_debug_xo_clk.clkr,
+};
+
+static struct gdsc *cam_cc_sa8775p_gdscs[] = {
+	[CAM_CC_TITAN_TOP_GDSC] = &cam_cc_titan_top_gdsc,
+};
+
+static const struct qcom_reset_map cam_cc_sa8775p_resets[] = {
+	[CAM_CC_ICP_BCR] = { 0x13078 },
+	[CAM_CC_IFE_0_BCR] = { 0x11000 },
+	[CAM_CC_IFE_1_BCR] = { 0x12000 },
+	[CAM_CC_IPE_0_BCR] = { 0x10000 },
+	[CAM_CC_SFE_LITE_0_BCR] = { 0x13048 },
+	[CAM_CC_SFE_LITE_1_BCR] = { 0x13060 },
+};
+
+static const struct regmap_config cam_cc_sa8775p_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0x16218,
+	.fast_io = true,
+};
+
+static struct qcom_cc_desc cam_cc_sa8775p_desc = {
+	.config = &cam_cc_sa8775p_regmap_config,
+	.clks = cam_cc_sa8775p_clocks,
+	.num_clks = ARRAY_SIZE(cam_cc_sa8775p_clocks),
+	.resets = cam_cc_sa8775p_resets,
+	.num_resets = ARRAY_SIZE(cam_cc_sa8775p_resets),
+	.gdscs = cam_cc_sa8775p_gdscs,
+	.num_gdscs = ARRAY_SIZE(cam_cc_sa8775p_gdscs),
+};
+
+static const struct of_device_id cam_cc_sa8775p_match_table[] = {
+	{ .compatible = "qcom,qcs8300-camcc" },
+	{ .compatible = "qcom,sa8775p-camcc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, cam_cc_sa8775p_match_table);
+
+static int cam_cc_sa8775p_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+	int ret;
+
+	ret = qcom_cc_attach_pds(&pdev->dev, &cam_cc_sa8775p_desc);
+	if (ret)
+		return ret;
+
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		return ret;
+
+	ret = pm_runtime_resume_and_get(&pdev->dev);
+	if (ret)
+		return ret;
+
+	regmap = qcom_cc_map(pdev, &cam_cc_sa8775p_desc);
+	if (IS_ERR(regmap)) {
+		pm_runtime_put(&pdev->dev);
+		return PTR_ERR(regmap);
+	}
+
+	clk_lucid_evo_pll_configure(&cam_cc_pll0, regmap, &cam_cc_pll0_config);
+	clk_rivian_evo_pll_configure(&cam_cc_pll2, regmap, &cam_cc_pll2_config);
+	clk_lucid_evo_pll_configure(&cam_cc_pll3, regmap, &cam_cc_pll3_config);
+	clk_lucid_evo_pll_configure(&cam_cc_pll4, regmap, &cam_cc_pll4_config);
+	clk_lucid_evo_pll_configure(&cam_cc_pll5, regmap, &cam_cc_pll5_config);
+
+	if (of_device_is_compatible(pdev->dev.of_node, "qcom,qcs8300-camcc")) {
+		cam_cc_camnoc_axi_clk_src.cmd_rcgr = 0x13154;
+		cam_cc_camnoc_axi_clk.halt_reg = 0x1316c;
+		cam_cc_camnoc_axi_clk.clkr.enable_reg = 0x1316c;
+		cam_cc_camnoc_dcd_xo_clk.halt_reg = 0x13174;
+		cam_cc_camnoc_dcd_xo_clk.clkr.enable_reg = 0x13174;
+
+		cam_cc_csi0phytimer_clk_src.cmd_rcgr = 0x15054;
+		cam_cc_csi1phytimer_clk_src.cmd_rcgr = 0x15078;
+		cam_cc_csi2phytimer_clk_src.cmd_rcgr = 0x15098;
+		cam_cc_csid_clk_src.cmd_rcgr = 0x13134;
+
+		cam_cc_mclk0_clk_src.cmd_rcgr = 0x15000;
+		cam_cc_mclk1_clk_src.cmd_rcgr = 0x1501c;
+		cam_cc_mclk2_clk_src.cmd_rcgr = 0x15038;
+
+		cam_cc_fast_ahb_clk_src.cmd_rcgr = 0x13104;
+		cam_cc_slow_ahb_clk_src.cmd_rcgr = 0x1311c;
+		cam_cc_xo_clk_src.cmd_rcgr = 0x131b8;
+		cam_cc_sleep_clk_src.cmd_rcgr = 0x131d4;
+
+		cam_cc_core_ahb_clk.halt_reg = 0x131b4;
+		cam_cc_core_ahb_clk.clkr.enable_reg = 0x131b4;
+
+		cam_cc_cpas_ahb_clk.halt_reg = 0x130f4;
+		cam_cc_cpas_ahb_clk.clkr.enable_reg = 0x130f4;
+		cam_cc_cpas_fast_ahb_clk.halt_reg = 0x130fc;
+		cam_cc_cpas_fast_ahb_clk.clkr.enable_reg = 0x130fc;
+
+		cam_cc_csi0phytimer_clk.halt_reg = 0x1506c;
+		cam_cc_csi0phytimer_clk.clkr.enable_reg = 0x1506c;
+		cam_cc_csi1phytimer_clk.halt_reg = 0x15090;
+		cam_cc_csi1phytimer_clk.clkr.enable_reg = 0x15090;
+		cam_cc_csi2phytimer_clk.halt_reg = 0x150b0;
+		cam_cc_csi2phytimer_clk.clkr.enable_reg = 0x150b0;
+		cam_cc_csid_clk.halt_reg = 0x1314c;
+		cam_cc_csid_clk.clkr.enable_reg = 0x1314c;
+		cam_cc_csid_csiphy_rx_clk.halt_reg = 0x15074;
+		cam_cc_csid_csiphy_rx_clk.clkr.enable_reg = 0x15074;
+		cam_cc_csiphy0_clk.halt_reg = 0x15070;
+		cam_cc_csiphy0_clk.clkr.enable_reg = 0x15070;
+		cam_cc_csiphy1_clk.halt_reg = 0x15094;
+		cam_cc_csiphy1_clk.clkr.enable_reg = 0x15094;
+		cam_cc_csiphy2_clk.halt_reg = 0x150b4;
+		cam_cc_csiphy2_clk.clkr.enable_reg = 0x150b4;
+
+		cam_cc_mclk0_clk.halt_reg = 0x15018;
+		cam_cc_mclk0_clk.clkr.enable_reg = 0x15018;
+		cam_cc_mclk1_clk.halt_reg = 0x15034;
+		cam_cc_mclk1_clk.clkr.enable_reg = 0x15034;
+		cam_cc_mclk2_clk.halt_reg = 0x15050;
+		cam_cc_mclk2_clk.clkr.enable_reg = 0x15050;
+		cam_cc_qdss_debug_xo_clk.halt_reg = 0x1319c;
+		cam_cc_qdss_debug_xo_clk.clkr.enable_reg = 0x1319c;
+
+		cam_cc_titan_top_gdsc.gdscr = 0x131a0;
+
+		cam_cc_sa8775p_clocks[CAM_CC_CCI_3_CLK] = NULL;
+		cam_cc_sa8775p_clocks[CAM_CC_CCI_3_CLK_SRC] = NULL;
+		cam_cc_sa8775p_clocks[CAM_CC_CSI3PHYTIMER_CLK] = NULL;
+		cam_cc_sa8775p_clocks[CAM_CC_CSI3PHYTIMER_CLK_SRC] = NULL;
+		cam_cc_sa8775p_clocks[CAM_CC_CSIPHY3_CLK] = NULL;
+		cam_cc_sa8775p_clocks[CAM_CC_MCLK3_CLK] = NULL;
+		cam_cc_sa8775p_clocks[CAM_CC_MCLK3_CLK_SRC] = NULL;
+		cam_cc_sa8775p_clocks[CAM_CC_SM_OBS_CLK] =
+					&cam_cc_sm_obs_clk.clkr;
+		cam_cc_sa8775p_clocks[CAM_CC_TITAN_TOP_ACCU_SHIFT_CLK] =
+				&cam_cc_titan_top_accu_shift_clk.clkr;
+
+		/* Keep some clocks always enabled */
+		regmap_update_bits(regmap, 0x13178, BIT(0), BIT(0)); /* CAM_CC_CAMNOC_XO_CLK */
+		regmap_update_bits(regmap, 0x131d0, BIT(0), BIT(0)); /* CAM_CC_GDSC_CLK */
+		regmap_update_bits(regmap, 0x131ec, BIT(0), BIT(0)); /* CAM_CC_SLEEP_CLK */
+	} else {
+		/* Keep some clocks always enabled */
+		qcom_branch_set_clk_en(regmap, 0x13194); /* CAM_CC_CAMNOC_XO_CLK */
+		qcom_branch_set_clk_en(regmap, 0x131ec); /* CAM_CC_GDSC_CLK */
+		qcom_branch_set_clk_en(regmap, 0x13208); /* CAM_CC_SLEEP_CLK */
+	}
+
+	ret = qcom_cc_really_probe(&pdev->dev, &cam_cc_sa8775p_desc, regmap);
+
+	pm_runtime_put(&pdev->dev);
+
+	return ret;
+}
+
+static struct platform_driver cam_cc_sa8775p_driver = {
+	.probe = cam_cc_sa8775p_probe,
+	.driver = {
+		.name = "camcc-sa8775p",
+		.of_match_table = cam_cc_sa8775p_match_table,
+	},
+};
+
+module_platform_driver(cam_cc_sa8775p_driver);
+
+MODULE_DESCRIPTION("QTI CAMCC SA8775P Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sc7180.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sc7180.c
@@ -1680,7 +1680,7 @@
 	clk_agera_pll_configure(&cam_cc_pll2, regmap, &cam_cc_pll2_config);
 	clk_fabia_pll_configure(&cam_cc_pll3, regmap, &cam_cc_pll3_config);
 
-	ret = qcom_cc_really_probe(pdev, &cam_cc_sc7180_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &cam_cc_sc7180_desc, regmap);
 	pm_runtime_put(&pdev->dev);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "Failed to register CAM CC clocks\n");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sc7280.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sc7280.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/clk-provider.h>
@@ -2247,6 +2248,9 @@
 
 static struct gdsc cam_cc_titan_top_gdsc = {
 	.gdscr = 0xc194,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "cam_cc_titan_top_gdsc",
 	},
@@ -2256,46 +2260,66 @@
 
 static struct gdsc cam_cc_bps_gdsc = {
 	.gdscr = 0x7004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "cam_cc_bps_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &cam_cc_titan_top_gdsc.pd,
 	.flags = HW_CTRL | RETAIN_FF_ENABLE,
 };
 
 static struct gdsc cam_cc_ife_0_gdsc = {
 	.gdscr = 0xa004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "cam_cc_ife_0_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &cam_cc_titan_top_gdsc.pd,
 	.flags = RETAIN_FF_ENABLE,
 };
 
 static struct gdsc cam_cc_ife_1_gdsc = {
 	.gdscr = 0xb004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "cam_cc_ife_1_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &cam_cc_titan_top_gdsc.pd,
 	.flags = RETAIN_FF_ENABLE,
 };
 
 static struct gdsc cam_cc_ife_2_gdsc = {
 	.gdscr = 0xb070,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "cam_cc_ife_2_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &cam_cc_titan_top_gdsc.pd,
 	.flags = RETAIN_FF_ENABLE,
 };
 
 static struct gdsc cam_cc_ipe_0_gdsc = {
 	.gdscr = 0x8004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "cam_cc_ipe_0_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &cam_cc_titan_top_gdsc.pd,
 	.flags = HW_CTRL | RETAIN_FF_ENABLE,
 };
 
@@ -2457,7 +2481,7 @@
 	clk_lucid_pll_configure(&cam_cc_pll5, regmap, &cam_cc_pll5_config);
 	clk_lucid_pll_configure(&cam_cc_pll6, regmap, &cam_cc_pll6_config);
 
-	return qcom_cc_really_probe(pdev, &cam_cc_sc7280_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &cam_cc_sc7280_desc, regmap);
 }
 
 static struct platform_driver cam_cc_sc7280_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sc8280xp.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sc8280xp.c
@@ -630,6 +630,7 @@
 	F(480000000, P_CAMCC_PLL7_OUT_EVEN, 1, 0, 0),
 	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
 	F(760000000, P_CAMCC_PLL3_OUT_EVEN, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_bps_clk_src = {
@@ -654,6 +655,7 @@
 	F(320000000, P_CAMCC_PLL7_OUT_ODD, 1, 0, 0),
 	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
 	F(480000000, P_CAMCC_PLL7_OUT_EVEN, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_camnoc_axi_clk_src = {
@@ -673,6 +675,7 @@
 static const struct freq_tbl ftbl_camcc_cci_0_clk_src[] = {
 	F(19200000, P_BI_TCXO, 1, 0, 0),
 	F(37500000, P_CAMCC_PLL0_OUT_EVEN, 16, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_cci_0_clk_src = {
@@ -735,6 +738,7 @@
 	F(19200000, P_BI_TCXO, 1, 0, 0),
 	F(240000000, P_CAMCC_PLL0_OUT_EVEN, 2.5, 0, 0),
 	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_cphy_rx_clk_src = {
@@ -754,6 +758,7 @@
 static const struct freq_tbl ftbl_camcc_csi0phytimer_clk_src[] = {
 	F(19200000, P_BI_TCXO, 1, 0, 0),
 	F(300000000, P_CAMCC_PLL0_OUT_EVEN, 2, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_csi0phytimer_clk_src = {
@@ -818,6 +823,7 @@
 	F(200000000, P_CAMCC_PLL0_OUT_EVEN, 3, 0, 0),
 	F(300000000, P_CAMCC_PLL0_OUT_MAIN, 4, 0, 0),
 	F(400000000, P_CAMCC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_fast_ahb_clk_src = {
@@ -838,6 +844,7 @@
 	F(19200000, P_BI_TCXO, 1, 0, 0),
 	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
 	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_icp_clk_src = {
@@ -860,6 +867,7 @@
 	F(558000000, P_CAMCC_PLL3_OUT_EVEN, 1, 0, 0),
 	F(637000000, P_CAMCC_PLL3_OUT_EVEN, 1, 0, 0),
 	F(760000000, P_CAMCC_PLL3_OUT_EVEN, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_ife_0_clk_src = {
@@ -883,6 +891,7 @@
 	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
 	F(480000000, P_CAMCC_PLL7_OUT_EVEN, 1, 0, 0),
 	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_ife_0_csid_clk_src = {
@@ -905,6 +914,7 @@
 	F(558000000, P_CAMCC_PLL4_OUT_EVEN, 1, 0, 0),
 	F(637000000, P_CAMCC_PLL4_OUT_EVEN, 1, 0, 0),
 	F(760000000, P_CAMCC_PLL4_OUT_EVEN, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_ife_1_clk_src = {
@@ -941,6 +951,7 @@
 	F(558000000, P_CAMCC_PLL5_OUT_EVEN, 1, 0, 0),
 	F(637000000, P_CAMCC_PLL5_OUT_EVEN, 1, 0, 0),
 	F(760000000, P_CAMCC_PLL5_OUT_EVEN, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_ife_2_clk_src = {
@@ -962,6 +973,7 @@
 	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
 	F(480000000, P_CAMCC_PLL7_OUT_EVEN, 1, 0, 0),
 	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_ife_2_csid_clk_src = {
@@ -984,6 +996,7 @@
 	F(558000000, P_CAMCC_PLL6_OUT_EVEN, 1, 0, 0),
 	F(637000000, P_CAMCC_PLL6_OUT_EVEN, 1, 0, 0),
 	F(760000000, P_CAMCC_PLL6_OUT_EVEN, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_ife_3_clk_src = {
@@ -1020,6 +1033,7 @@
 	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
 	F(480000000, P_CAMCC_PLL7_OUT_EVEN, 1, 0, 0),
 	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_ife_lite_0_clk_src = {
@@ -1140,6 +1154,7 @@
 	F(475000000, P_CAMCC_PLL1_OUT_EVEN, 1, 0, 0),
 	F(520000000, P_CAMCC_PLL1_OUT_EVEN, 1, 0, 0),
 	F(600000000, P_CAMCC_PLL1_OUT_EVEN, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_ipe_0_clk_src = {
@@ -1163,6 +1178,7 @@
 	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
 	F(480000000, P_CAMCC_PLL7_OUT_EVEN, 1, 0, 0),
 	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_jpeg_clk_src = {
@@ -1184,6 +1200,7 @@
 	F(300000000, P_CAMCC_PLL0_OUT_EVEN, 2, 0, 0),
 	F(320000000, P_CAMCC_PLL7_OUT_ODD, 1, 0, 0),
 	F(400000000, P_CAMCC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_lrme_clk_src = {
@@ -1204,6 +1221,7 @@
 	F(19200000, P_BI_TCXO, 1, 0, 0),
 	F(24000000, P_CAMCC_PLL2_OUT_EARLY, 10, 1, 4),
 	F(64000000, P_CAMCC_PLL2_OUT_EARLY, 15, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_mclk0_clk_src = {
@@ -1320,6 +1338,7 @@
 
 static const struct freq_tbl ftbl_camcc_sleep_clk_src[] = {
 	F(32000, P_SLEEP_CLK, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_sleep_clk_src = {
@@ -1339,6 +1358,7 @@
 static const struct freq_tbl ftbl_camcc_slow_ahb_clk_src[] = {
 	F(19200000, P_BI_TCXO, 1, 0, 0),
 	F(80000000, P_CAMCC_PLL7_OUT_EVEN, 6, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_slow_ahb_clk_src = {
@@ -1357,6 +1377,7 @@
 
 static const struct freq_tbl ftbl_camcc_xo_clk_src[] = {
 	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 camcc_xo_clk_src = {
@@ -3015,7 +3036,7 @@
 	 */
 	regmap_update_bits(regmap, 0xc1e4, BIT(0), 1);
 
-	ret = qcom_cc_really_probe(pdev, &camcc_sc8280xp_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &camcc_sc8280xp_desc, regmap);
 	if (ret)
 		goto err_disable;
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sdm845.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sdm845.c
@@ -1735,7 +1735,7 @@
 	cam_cc_pll_config.l = 0x14;
 	clk_fabia_pll_configure(&cam_cc_pll3, regmap, &cam_cc_pll_config);
 
-	return qcom_cc_really_probe(pdev, &cam_cc_sdm845_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &cam_cc_sdm845_desc, regmap);
 }
 
 static struct platform_driver cam_cc_sdm845_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sm6350.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sm6350.c
@@ -1879,7 +1879,7 @@
 	clk_agera_pll_configure(&camcc_pll2, regmap, &camcc_pll2_config);
 	clk_fabia_pll_configure(&camcc_pll3, regmap, &camcc_pll3_config);
 
-	return qcom_cc_really_probe(pdev, &camcc_sm6350_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &camcc_sm6350_desc, regmap);
 }
 
 static struct platform_driver camcc_sm6350_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sm7150.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sm7150.c
@@ -0,0 +1,2061 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Danila Tikhonov <danila@jiaxyga.com>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,sm7150-camcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "common.h"
+#include "gdsc.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+	DT_CHIP_SLEEP_CLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_BI_TCXO_MX,
+	P_CAMCC_PLL0_OUT_EVEN,
+	P_CAMCC_PLL0_OUT_MAIN,
+	P_CAMCC_PLL0_OUT_ODD,
+	P_CAMCC_PLL1_OUT_EVEN,
+	P_CAMCC_PLL2_OUT_AUX,
+	P_CAMCC_PLL2_OUT_EARLY,
+	P_CAMCC_PLL2_OUT_MAIN,
+	P_CAMCC_PLL3_OUT_EVEN,
+	P_CAMCC_PLL4_OUT_EVEN,
+	P_CHIP_SLEEP_CLK,
+};
+
+static const struct pll_vco fabia_vco[] = {
+	{ 249600000, 2000000000, 0 },
+};
+
+/* 1200MHz configuration */
+static const struct alpha_pll_config camcc_pll0_config = {
+	.l = 0x3e,
+	.alpha = 0x8000,
+	.post_div_mask = 0xff << 8,
+	.post_div_val = 0x31 << 8,
+	.test_ctl_val = 0x40000000,
+};
+
+static struct clk_alpha_pll camcc_pll0 = {
+	.offset = 0x0,
+	.vco_table = fabia_vco,
+	.num_vco = ARRAY_SIZE(fabia_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fabia_ops,
+		},
+	},
+};
+
+static struct clk_fixed_factor camcc_pll0_out_even = {
+	.mult = 1,
+	.div = 2,
+	.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_pll0_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&camcc_pll0.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+static struct clk_fixed_factor camcc_pll0_out_odd = {
+	.mult = 1,
+	.div = 3,
+	.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_pll0_out_odd",
+		.parent_hws = (const struct clk_hw*[]) {
+			&camcc_pll0.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+/* 680MHz configuration */
+static const struct alpha_pll_config camcc_pll1_config = {
+	.l = 0x23,
+	.alpha = 0x6aaa,
+	.post_div_mask = 0xf << 8,
+	.post_div_val = 0x1 << 8,
+	.test_ctl_val = 0x40000000,
+};
+
+static struct clk_alpha_pll camcc_pll1 = {
+	.offset = 0x1000,
+	.vco_table = fabia_vco,
+	.num_vco = ARRAY_SIZE(fabia_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_pll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fabia_ops,
+		},
+	},
+};
+
+static struct clk_fixed_factor camcc_pll1_out_even = {
+	.mult = 1,
+	.div = 2,
+	.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_pll1_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&camcc_pll1.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+/* 1920MHz configuration */
+static const struct alpha_pll_config camcc_pll2_config = {
+	.l = 0x64,
+	.post_div_val = 0x3 << 8,
+	.post_div_mask = 0x3 << 8,
+	.early_output_mask = BIT(3),
+	.aux_output_mask = BIT(1),
+	.main_output_mask = BIT(0),
+	.config_ctl_hi_val = 0x400003d6,
+	.config_ctl_val = 0x20000954,
+};
+
+static struct clk_alpha_pll camcc_pll2 = {
+	.offset = 0x2000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_pll2",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_agera_ops,
+		},
+	},
+};
+
+static struct clk_fixed_factor camcc_pll2_out_early = {
+	.mult = 1,
+	.div = 2,
+	.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_pll2_out_early",
+		.parent_hws = (const struct clk_hw*[]) {
+			&camcc_pll2.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+static struct clk_alpha_pll_postdiv camcc_pll2_out_aux = {
+	.offset = 0x2000,
+	.post_div_shift = 8,
+	.width = 2,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_pll2_out_aux",
+		.parent_hws = (const struct clk_hw*[]) {
+			&camcc_pll2.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_ops,
+	},
+};
+
+static struct clk_alpha_pll_postdiv camcc_pll2_out_main = {
+	.offset = 0x2000,
+	.post_div_shift = 8,
+	.width = 2,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_pll2_out_main",
+		.parent_hws = (const struct clk_hw*[]) {
+			&camcc_pll2.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_ops,
+	},
+};
+
+/* 760MHz configuration */
+static const struct alpha_pll_config camcc_pll3_config = {
+	.l = 0x27,
+	.alpha = 0x9555,
+	.post_div_mask = 0xf << 8,
+	.post_div_val = 0x1 << 8,
+	.test_ctl_val = 0x40000000,
+};
+
+static struct clk_alpha_pll camcc_pll3 = {
+	.offset = 0x3000,
+	.vco_table = fabia_vco,
+	.num_vco = ARRAY_SIZE(fabia_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_pll3",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fabia_ops,
+		},
+	},
+};
+
+static struct clk_fixed_factor camcc_pll3_out_even = {
+	.mult = 1,
+	.div = 2,
+	.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_pll3_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&camcc_pll3.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+static struct clk_alpha_pll camcc_pll4 = {
+	.offset = 0x4000,
+	.vco_table = fabia_vco,
+	.num_vco = ARRAY_SIZE(fabia_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_pll4",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fabia_ops,
+		},
+	},
+};
+
+static struct clk_fixed_factor camcc_pll4_out_even = {
+	.mult = 1,
+	.div = 2,
+	.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_pll4_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&camcc_pll4.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+static const struct parent_map camcc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAMCC_PLL0_OUT_MAIN, 1 },
+	{ P_CAMCC_PLL0_OUT_EVEN, 2 },
+	{ P_CAMCC_PLL0_OUT_ODD, 3 },
+	{ P_CAMCC_PLL2_OUT_MAIN, 5 },
+};
+
+static const struct clk_parent_data camcc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &camcc_pll0.clkr.hw },
+	{ .hw = &camcc_pll0_out_even.hw },
+	{ .hw = &camcc_pll0_out_odd.hw },
+	{ .hw = &camcc_pll2_out_main.clkr.hw },
+};
+
+static const struct parent_map camcc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAMCC_PLL0_OUT_MAIN, 1 },
+	{ P_CAMCC_PLL0_OUT_EVEN, 2 },
+	{ P_CAMCC_PLL0_OUT_ODD, 3 },
+	{ P_CAMCC_PLL1_OUT_EVEN, 4 },
+	{ P_CAMCC_PLL2_OUT_EARLY, 5 },
+};
+
+static const struct clk_parent_data camcc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &camcc_pll0.clkr.hw },
+	{ .hw = &camcc_pll0_out_even.hw },
+	{ .hw = &camcc_pll0_out_odd.hw },
+	{ .hw = &camcc_pll1_out_even.hw },
+	{ .hw = &camcc_pll2_out_early.hw },
+};
+
+static const struct parent_map camcc_parent_map_2[] = {
+	{ P_BI_TCXO_MX, 0 },
+	{ P_CAMCC_PLL2_OUT_AUX, 5 },
+};
+
+static const struct clk_parent_data camcc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &camcc_pll2_out_aux.clkr.hw },
+};
+
+static const struct parent_map camcc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAMCC_PLL0_OUT_MAIN, 1 },
+	{ P_CAMCC_PLL0_OUT_EVEN, 2 },
+	{ P_CAMCC_PLL0_OUT_ODD, 3 },
+	{ P_CAMCC_PLL2_OUT_EARLY, 5 },
+	{ P_CAMCC_PLL4_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data camcc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &camcc_pll0.clkr.hw },
+	{ .hw = &camcc_pll0_out_even.hw },
+	{ .hw = &camcc_pll0_out_odd.hw },
+	{ .hw = &camcc_pll2_out_early.hw },
+	{ .hw = &camcc_pll4_out_even.hw },
+};
+
+static const struct parent_map camcc_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAMCC_PLL3_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data camcc_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &camcc_pll3_out_even.hw },
+};
+
+static const struct parent_map camcc_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAMCC_PLL4_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data camcc_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &camcc_pll4_out_even.hw },
+};
+
+static const struct parent_map camcc_parent_map_6[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAMCC_PLL1_OUT_EVEN, 4 },
+};
+
+static const struct clk_parent_data camcc_parent_data_6[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &camcc_pll1_out_even.hw },
+};
+
+static const struct parent_map camcc_parent_map_7[] = {
+	{ P_CHIP_SLEEP_CLK, 0 },
+};
+
+static const struct clk_parent_data camcc_parent_data_7[] = {
+	{ .index = DT_CHIP_SLEEP_CLK },
+};
+
+static const struct parent_map camcc_parent_map_8[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAMCC_PLL0_OUT_ODD, 3 },
+};
+
+static const struct clk_parent_data camcc_parent_data_8[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &camcc_pll0_out_odd.hw },
+};
+
+static const struct parent_map camcc_parent_map_9[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data camcc_parent_data_9[] = {
+	{ .index = DT_BI_TCXO_AO },
+};
+
+static const struct freq_tbl ftbl_camcc_bps_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(100000000, P_CAMCC_PLL0_OUT_EVEN, 6, 0, 0),
+	F(200000000, P_CAMCC_PLL0_OUT_ODD, 2, 0, 0),
+	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
+	F(480000000, P_CAMCC_PLL2_OUT_MAIN, 1, 0, 0),
+	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_bps_clk_src = {
+	.cmd_rcgr = 0x7010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_bps_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_bps_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_camnoc_axi_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(150000000, P_CAMCC_PLL0_OUT_EVEN, 4, 0, 0),
+	F(240000000, P_CAMCC_PLL2_OUT_MAIN, 2, 0, 0),
+	F(320000000, P_CAMCC_PLL2_OUT_MAIN, 1.5, 0, 0),
+	F(400000000, P_CAMCC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(480000000, P_CAMCC_PLL2_OUT_MAIN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_camnoc_axi_clk_src = {
+	.cmd_rcgr = 0xc12c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_camnoc_axi_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_camnoc_axi_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_cci_0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(37500000, P_CAMCC_PLL0_OUT_EVEN, 16, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_cci_0_clk_src = {
+	.cmd_rcgr = 0xc0c4,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_cci_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_cci_0_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_cci_1_clk_src = {
+	.cmd_rcgr = 0xc0e0,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_cci_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_cci_1_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_cphy_rx_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(300000000, P_CAMCC_PLL0_OUT_EVEN, 2, 0, 0),
+	F(384000000, P_CAMCC_PLL2_OUT_EARLY, 2.5, 0, 0),
+	F(400000000, P_CAMCC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_cphy_rx_clk_src = {
+	.cmd_rcgr = 0xa064,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_1,
+	.freq_tbl = ftbl_camcc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_cphy_rx_clk_src",
+		.parent_data = camcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_1),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_csi0phytimer_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(300000000, P_CAMCC_PLL0_OUT_EVEN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_csi0phytimer_clk_src = {
+	.cmd_rcgr = 0x6004,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_csi0phytimer_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_csi1phytimer_clk_src = {
+	.cmd_rcgr = 0x6028,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_csi1phytimer_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_csi2phytimer_clk_src = {
+	.cmd_rcgr = 0x604c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_csi2phytimer_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_csi3phytimer_clk_src = {
+	.cmd_rcgr = 0x6070,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_csi3phytimer_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_fast_ahb_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(50000000, P_CAMCC_PLL0_OUT_EVEN, 12, 0, 0),
+	F(100000000, P_CAMCC_PLL0_OUT_EVEN, 6, 0, 0),
+	F(200000000, P_CAMCC_PLL0_OUT_EVEN, 3, 0, 0),
+	F(300000000, P_CAMCC_PLL0_OUT_MAIN, 4, 0, 0),
+	F(400000000, P_CAMCC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_fast_ahb_clk_src = {
+	.cmd_rcgr = 0x703c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_fast_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_fast_ahb_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_fd_core_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(380000000, P_CAMCC_PLL4_OUT_EVEN, 1, 0, 0),
+	F(384000000, P_CAMCC_PLL2_OUT_EARLY, 2.5, 0, 0),
+	F(400000000, P_CAMCC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(480000000, P_CAMCC_PLL2_OUT_EARLY, 2, 0, 0),
+	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_fd_core_clk_src = {
+	.cmd_rcgr = 0xc09c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_3,
+	.freq_tbl = ftbl_camcc_fd_core_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_fd_core_clk_src",
+		.parent_data = camcc_parent_data_3,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_icp_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
+	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_icp_clk_src = {
+	.cmd_rcgr = 0xc074,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_icp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_icp_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_ife_0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(380000000, P_CAMCC_PLL3_OUT_EVEN, 1, 0, 0),
+	F(510000000, P_CAMCC_PLL3_OUT_EVEN, 1, 0, 0),
+	F(637000000, P_CAMCC_PLL3_OUT_EVEN, 1, 0, 0),
+	F(760000000, P_CAMCC_PLL3_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_ife_0_clk_src = {
+	.cmd_rcgr = 0xa010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_4,
+	.freq_tbl = ftbl_camcc_ife_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_ife_0_clk_src",
+		.parent_data = camcc_parent_data_4,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_ife_0_csid_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(75000000, P_CAMCC_PLL0_OUT_EVEN, 8, 0, 0),
+	F(300000000, P_CAMCC_PLL0_OUT_EVEN, 2, 0, 0),
+	F(384000000, P_CAMCC_PLL2_OUT_EARLY, 2.5, 0, 0),
+	F(400000000, P_CAMCC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_ife_0_csid_clk_src = {
+	.cmd_rcgr = 0xa03c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_1,
+	.freq_tbl = ftbl_camcc_ife_0_csid_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_ife_0_csid_clk_src",
+		.parent_data = camcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_1),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_ife_1_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(380000000, P_CAMCC_PLL4_OUT_EVEN, 1, 0, 0),
+	F(510000000, P_CAMCC_PLL4_OUT_EVEN, 1, 0, 0),
+	F(637000000, P_CAMCC_PLL4_OUT_EVEN, 1, 0, 0),
+	F(760000000, P_CAMCC_PLL4_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_ife_1_clk_src = {
+	.cmd_rcgr = 0xb010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_5,
+	.freq_tbl = ftbl_camcc_ife_1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_ife_1_clk_src",
+		.parent_data = camcc_parent_data_5,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_5),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_ife_1_csid_clk_src = {
+	.cmd_rcgr = 0xb034,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_1,
+	.freq_tbl = ftbl_camcc_ife_0_csid_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_ife_1_csid_clk_src",
+		.parent_data = camcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_1),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_ife_lite_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(320000000, P_CAMCC_PLL2_OUT_MAIN, 1.5, 0, 0),
+	F(400000000, P_CAMCC_PLL0_OUT_ODD, 1, 0, 0),
+	F(480000000, P_CAMCC_PLL2_OUT_MAIN, 1, 0, 0),
+	F(600000000, P_CAMCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_ife_lite_clk_src = {
+	.cmd_rcgr = 0xc004,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_ife_lite_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_ife_lite_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_ife_lite_csid_clk_src = {
+	.cmd_rcgr = 0xc020,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_1,
+	.freq_tbl = ftbl_camcc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_ife_lite_csid_clk_src",
+		.parent_data = camcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_1),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_ipe_0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(340000000, P_CAMCC_PLL1_OUT_EVEN, 1, 0, 0),
+	F(430000000, P_CAMCC_PLL1_OUT_EVEN, 1, 0, 0),
+	F(520000000, P_CAMCC_PLL1_OUT_EVEN, 1, 0, 0),
+	F(600000000, P_CAMCC_PLL1_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_ipe_0_clk_src = {
+	.cmd_rcgr = 0x8010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_6,
+	.freq_tbl = ftbl_camcc_ipe_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_ipe_0_clk_src",
+		.parent_data = camcc_parent_data_6,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_6),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_jpeg_clk_src = {
+	.cmd_rcgr = 0xc048,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_bps_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_jpeg_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_lrme_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(100000000, P_CAMCC_PLL0_OUT_EVEN, 6, 0, 0),
+	F(240000000, P_CAMCC_PLL2_OUT_MAIN, 2, 0, 0),
+	F(300000000, P_CAMCC_PLL0_OUT_EVEN, 2, 0, 0),
+	F(320000000, P_CAMCC_PLL2_OUT_MAIN, 1.5, 0, 0),
+	F(400000000, P_CAMCC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_lrme_clk_src = {
+	.cmd_rcgr = 0xc100,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_0,
+	.freq_tbl = ftbl_camcc_lrme_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_lrme_clk_src",
+		.parent_data = camcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_mclk0_clk_src[] = {
+	F(19200000, P_BI_TCXO_MX, 1, 0, 0),
+	F(24000000, P_CAMCC_PLL2_OUT_AUX, 1, 1, 20),
+	F(34285714, P_CAMCC_PLL2_OUT_AUX, 14, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_mclk0_clk_src = {
+	.cmd_rcgr = 0x5004,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_2,
+	.freq_tbl = ftbl_camcc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_mclk0_clk_src",
+		.parent_data = camcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_mclk1_clk_src = {
+	.cmd_rcgr = 0x5024,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_2,
+	.freq_tbl = ftbl_camcc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_mclk1_clk_src",
+		.parent_data = camcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_mclk2_clk_src = {
+	.cmd_rcgr = 0x5044,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_2,
+	.freq_tbl = ftbl_camcc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_mclk2_clk_src",
+		.parent_data = camcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 camcc_mclk3_clk_src = {
+	.cmd_rcgr = 0x5064,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_2,
+	.freq_tbl = ftbl_camcc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_mclk3_clk_src",
+		.parent_data = camcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_sleep_clk_src[] = {
+	F(32000, P_CHIP_SLEEP_CLK, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_sleep_clk_src = {
+	.cmd_rcgr = 0xc1a4,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_7,
+	.freq_tbl = ftbl_camcc_sleep_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_sleep_clk_src",
+		.parent_data = camcc_parent_data_7,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_7),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_slow_ahb_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(80000000, P_CAMCC_PLL0_OUT_ODD, 5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_slow_ahb_clk_src = {
+	.cmd_rcgr = 0x7058,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_8,
+	.freq_tbl = ftbl_camcc_slow_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_slow_ahb_clk_src",
+		.parent_data = camcc_parent_data_8,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_8),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_camcc_xo_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 camcc_xo_clk_src = {
+	.cmd_rcgr = 0xc188,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = camcc_parent_map_9,
+	.freq_tbl = ftbl_camcc_xo_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "camcc_xo_clk_src",
+		.parent_data = camcc_parent_data_9,
+		.num_parents = ARRAY_SIZE(camcc_parent_data_9),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_branch camcc_bps_ahb_clk = {
+	.halt_reg = 0x7070,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x7070,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_bps_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_bps_areg_clk = {
+	.halt_reg = 0x7054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x7054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_bps_areg_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_bps_axi_clk = {
+	.halt_reg = 0x7038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x7038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_bps_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_camnoc_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_bps_clk = {
+	.halt_reg = 0x7028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x7028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_bps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_bps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_camnoc_axi_clk = {
+	.halt_reg = 0xc148,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc148,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_camnoc_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_camnoc_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_camnoc_dcd_xo_clk = {
+	.halt_reg = 0xc150,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc150,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_camnoc_dcd_xo_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_cci_0_clk = {
+	.halt_reg = 0xc0dc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc0dc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_cci_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_cci_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_cci_1_clk = {
+	.halt_reg = 0xc0f8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc0f8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_cci_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_cci_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_core_ahb_clk = {
+	.halt_reg = 0xc184,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0xc184,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_core_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_cpas_ahb_clk = {
+	.halt_reg = 0xc124,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc124,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_cpas_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_csi0phytimer_clk = {
+	.halt_reg = 0x601c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x601c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_csi0phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_csi0phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_csi1phytimer_clk = {
+	.halt_reg = 0x6040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_csi1phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_csi1phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_csi2phytimer_clk = {
+	.halt_reg = 0x6064,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_csi2phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_csi2phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_csi3phytimer_clk = {
+	.halt_reg = 0x6088,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6088,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_csi3phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_csi3phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_csiphy0_clk = {
+	.halt_reg = 0x6020,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_csiphy0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_csiphy1_clk = {
+	.halt_reg = 0x6044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_csiphy1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_csiphy2_clk = {
+	.halt_reg = 0x6068,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6068,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_csiphy2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_csiphy3_clk = {
+	.halt_reg = 0x608c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x608c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_csiphy3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_fd_core_clk = {
+	.halt_reg = 0xc0b4,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc0b4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_fd_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_fd_core_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_fd_core_uar_clk = {
+	.halt_reg = 0xc0bc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc0bc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_fd_core_uar_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_fd_core_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_icp_ahb_clk = {
+	.halt_reg = 0xc094,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc094,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_icp_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_icp_clk = {
+	.halt_reg = 0xc08c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc08c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_icp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_icp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_0_axi_clk = {
+	.halt_reg = 0xa080,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa080,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_0_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_camnoc_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_0_clk = {
+	.halt_reg = 0xa028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_0_cphy_rx_clk = {
+	.halt_reg = 0xa07c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa07c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_0_cphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_0_csid_clk = {
+	.halt_reg = 0xa054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_0_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ife_0_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_0_dsp_clk = {
+	.halt_reg = 0xa038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_0_dsp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_1_axi_clk = {
+	.halt_reg = 0xb058,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb058,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_1_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_camnoc_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_1_clk = {
+	.halt_reg = 0xb028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_1_cphy_rx_clk = {
+	.halt_reg = 0xb054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_1_cphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_1_csid_clk = {
+	.halt_reg = 0xb04c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb04c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_1_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ife_1_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_1_dsp_clk = {
+	.halt_reg = 0xb030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_1_dsp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_lite_clk = {
+	.halt_reg = 0xc01c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc01c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_lite_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ife_lite_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_lite_cphy_rx_clk = {
+	.halt_reg = 0xc040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_lite_cphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ife_lite_csid_clk = {
+	.halt_reg = 0xc038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ife_lite_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ife_lite_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ipe_0_ahb_clk = {
+	.halt_reg = 0x8040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ipe_0_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ipe_0_areg_clk = {
+	.halt_reg = 0x803c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x803c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ipe_0_areg_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ipe_0_axi_clk = {
+	.halt_reg = 0x8038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ipe_0_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_camnoc_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ipe_0_clk = {
+	.halt_reg = 0x8028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ipe_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ipe_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ipe_1_ahb_clk = {
+	.halt_reg = 0x9028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ipe_1_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ipe_1_areg_clk = {
+	.halt_reg = 0x9024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ipe_1_areg_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ipe_1_axi_clk = {
+	.halt_reg = 0x9020,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ipe_1_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_camnoc_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_ipe_1_clk = {
+	.halt_reg = 0x9010,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_ipe_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_ipe_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_jpeg_clk = {
+	.halt_reg = 0xc060,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc060,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_jpeg_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_jpeg_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_lrme_clk = {
+	.halt_reg = 0xc118,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc118,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_lrme_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_lrme_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_mclk0_clk = {
+	.halt_reg = 0x501c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x501c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_mclk0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_mclk0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_mclk1_clk = {
+	.halt_reg = 0x503c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x503c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_mclk1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_mclk1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_mclk2_clk = {
+	.halt_reg = 0x505c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x505c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_mclk2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_mclk2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_mclk3_clk = {
+	.halt_reg = 0x507c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x507c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_mclk3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_mclk3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch camcc_sleep_clk = {
+	.halt_reg = 0xc1bc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc1bc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "camcc_sleep_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&camcc_sleep_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc camcc_titan_top_gdsc;
+
+static struct gdsc camcc_bps_gdsc = {
+	.gdscr = 0x7004,
+	.pd = {
+		.name = "camcc_bps_gdsc",
+	},
+	.flags = HW_CTRL | POLL_CFG_GDSCR,
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc camcc_ife_0_gdsc = {
+	.gdscr = 0xa004,
+	.pd = {
+		.name = "camcc_ife_0_gdsc",
+	},
+	.flags = POLL_CFG_GDSCR,
+	.parent = &camcc_titan_top_gdsc.pd,
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc camcc_ife_1_gdsc = {
+	.gdscr = 0xb004,
+	.pd = {
+		.name = "camcc_ife_1_gdsc",
+	},
+	.flags = POLL_CFG_GDSCR,
+	.parent = &camcc_titan_top_gdsc.pd,
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc camcc_ipe_0_gdsc = {
+	.gdscr = 0x8004,
+	.pd = {
+		.name = "camcc_ipe_0_gdsc",
+	},
+	.flags = HW_CTRL | POLL_CFG_GDSCR,
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc camcc_ipe_1_gdsc = {
+	.gdscr = 0x9004,
+	.pd = {
+		.name = "camcc_ipe_1_gdsc",
+	},
+	.flags = HW_CTRL | POLL_CFG_GDSCR,
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc camcc_titan_top_gdsc = {
+	.gdscr = 0xc1c4,
+	.pd = {
+		.name = "camcc_titan_top_gdsc",
+	},
+	.flags = POLL_CFG_GDSCR,
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+struct clk_hw *camcc_sm7150_hws[] = {
+	[CAMCC_PLL0_OUT_EVEN] = &camcc_pll0_out_even.hw,
+	[CAMCC_PLL0_OUT_ODD] = &camcc_pll0_out_odd.hw,
+	[CAMCC_PLL1_OUT_EVEN] = &camcc_pll1_out_even.hw,
+	[CAMCC_PLL2_OUT_EARLY] = &camcc_pll2_out_early.hw,
+	[CAMCC_PLL3_OUT_EVEN] = &camcc_pll3_out_even.hw,
+	[CAMCC_PLL4_OUT_EVEN] = &camcc_pll4_out_even.hw,
+};
+
+static struct clk_regmap *camcc_sm7150_clocks[] = {
+	[CAMCC_BPS_AHB_CLK] = &camcc_bps_ahb_clk.clkr,
+	[CAMCC_BPS_AREG_CLK] = &camcc_bps_areg_clk.clkr,
+	[CAMCC_BPS_AXI_CLK] = &camcc_bps_axi_clk.clkr,
+	[CAMCC_BPS_CLK] = &camcc_bps_clk.clkr,
+	[CAMCC_BPS_CLK_SRC] = &camcc_bps_clk_src.clkr,
+	[CAMCC_CAMNOC_AXI_CLK] = &camcc_camnoc_axi_clk.clkr,
+	[CAMCC_CAMNOC_AXI_CLK_SRC] = &camcc_camnoc_axi_clk_src.clkr,
+	[CAMCC_CAMNOC_DCD_XO_CLK] = &camcc_camnoc_dcd_xo_clk.clkr,
+	[CAMCC_CCI_0_CLK] = &camcc_cci_0_clk.clkr,
+	[CAMCC_CCI_0_CLK_SRC] = &camcc_cci_0_clk_src.clkr,
+	[CAMCC_CCI_1_CLK] = &camcc_cci_1_clk.clkr,
+	[CAMCC_CCI_1_CLK_SRC] = &camcc_cci_1_clk_src.clkr,
+	[CAMCC_CORE_AHB_CLK] = &camcc_core_ahb_clk.clkr,
+	[CAMCC_CPAS_AHB_CLK] = &camcc_cpas_ahb_clk.clkr,
+	[CAMCC_CPHY_RX_CLK_SRC] = &camcc_cphy_rx_clk_src.clkr,
+	[CAMCC_CSI0PHYTIMER_CLK] = &camcc_csi0phytimer_clk.clkr,
+	[CAMCC_CSI0PHYTIMER_CLK_SRC] = &camcc_csi0phytimer_clk_src.clkr,
+	[CAMCC_CSI1PHYTIMER_CLK] = &camcc_csi1phytimer_clk.clkr,
+	[CAMCC_CSI1PHYTIMER_CLK_SRC] = &camcc_csi1phytimer_clk_src.clkr,
+	[CAMCC_CSI2PHYTIMER_CLK] = &camcc_csi2phytimer_clk.clkr,
+	[CAMCC_CSI2PHYTIMER_CLK_SRC] = &camcc_csi2phytimer_clk_src.clkr,
+	[CAMCC_CSI3PHYTIMER_CLK] = &camcc_csi3phytimer_clk.clkr,
+	[CAMCC_CSI3PHYTIMER_CLK_SRC] = &camcc_csi3phytimer_clk_src.clkr,
+	[CAMCC_CSIPHY0_CLK] = &camcc_csiphy0_clk.clkr,
+	[CAMCC_CSIPHY1_CLK] = &camcc_csiphy1_clk.clkr,
+	[CAMCC_CSIPHY2_CLK] = &camcc_csiphy2_clk.clkr,
+	[CAMCC_CSIPHY3_CLK] = &camcc_csiphy3_clk.clkr,
+	[CAMCC_FAST_AHB_CLK_SRC] = &camcc_fast_ahb_clk_src.clkr,
+	[CAMCC_FD_CORE_CLK] = &camcc_fd_core_clk.clkr,
+	[CAMCC_FD_CORE_CLK_SRC] = &camcc_fd_core_clk_src.clkr,
+	[CAMCC_FD_CORE_UAR_CLK] = &camcc_fd_core_uar_clk.clkr,
+	[CAMCC_ICP_AHB_CLK] = &camcc_icp_ahb_clk.clkr,
+	[CAMCC_ICP_CLK] = &camcc_icp_clk.clkr,
+	[CAMCC_ICP_CLK_SRC] = &camcc_icp_clk_src.clkr,
+	[CAMCC_IFE_0_AXI_CLK] = &camcc_ife_0_axi_clk.clkr,
+	[CAMCC_IFE_0_CLK] = &camcc_ife_0_clk.clkr,
+	[CAMCC_IFE_0_CLK_SRC] = &camcc_ife_0_clk_src.clkr,
+	[CAMCC_IFE_0_CPHY_RX_CLK] = &camcc_ife_0_cphy_rx_clk.clkr,
+	[CAMCC_IFE_0_CSID_CLK] = &camcc_ife_0_csid_clk.clkr,
+	[CAMCC_IFE_0_CSID_CLK_SRC] = &camcc_ife_0_csid_clk_src.clkr,
+	[CAMCC_IFE_0_DSP_CLK] = &camcc_ife_0_dsp_clk.clkr,
+	[CAMCC_IFE_1_AXI_CLK] = &camcc_ife_1_axi_clk.clkr,
+	[CAMCC_IFE_1_CLK] = &camcc_ife_1_clk.clkr,
+	[CAMCC_IFE_1_CLK_SRC] = &camcc_ife_1_clk_src.clkr,
+	[CAMCC_IFE_1_CPHY_RX_CLK] = &camcc_ife_1_cphy_rx_clk.clkr,
+	[CAMCC_IFE_1_CSID_CLK] = &camcc_ife_1_csid_clk.clkr,
+	[CAMCC_IFE_1_CSID_CLK_SRC] = &camcc_ife_1_csid_clk_src.clkr,
+	[CAMCC_IFE_1_DSP_CLK] = &camcc_ife_1_dsp_clk.clkr,
+	[CAMCC_IFE_LITE_CLK] = &camcc_ife_lite_clk.clkr,
+	[CAMCC_IFE_LITE_CLK_SRC] = &camcc_ife_lite_clk_src.clkr,
+	[CAMCC_IFE_LITE_CPHY_RX_CLK] = &camcc_ife_lite_cphy_rx_clk.clkr,
+	[CAMCC_IFE_LITE_CSID_CLK] = &camcc_ife_lite_csid_clk.clkr,
+	[CAMCC_IFE_LITE_CSID_CLK_SRC] = &camcc_ife_lite_csid_clk_src.clkr,
+	[CAMCC_IPE_0_AHB_CLK] = &camcc_ipe_0_ahb_clk.clkr,
+	[CAMCC_IPE_0_AREG_CLK] = &camcc_ipe_0_areg_clk.clkr,
+	[CAMCC_IPE_0_AXI_CLK] = &camcc_ipe_0_axi_clk.clkr,
+	[CAMCC_IPE_0_CLK] = &camcc_ipe_0_clk.clkr,
+	[CAMCC_IPE_0_CLK_SRC] = &camcc_ipe_0_clk_src.clkr,
+	[CAMCC_IPE_1_AHB_CLK] = &camcc_ipe_1_ahb_clk.clkr,
+	[CAMCC_IPE_1_AREG_CLK] = &camcc_ipe_1_areg_clk.clkr,
+	[CAMCC_IPE_1_AXI_CLK] = &camcc_ipe_1_axi_clk.clkr,
+	[CAMCC_IPE_1_CLK] = &camcc_ipe_1_clk.clkr,
+	[CAMCC_JPEG_CLK] = &camcc_jpeg_clk.clkr,
+	[CAMCC_JPEG_CLK_SRC] = &camcc_jpeg_clk_src.clkr,
+	[CAMCC_LRME_CLK] = &camcc_lrme_clk.clkr,
+	[CAMCC_LRME_CLK_SRC] = &camcc_lrme_clk_src.clkr,
+	[CAMCC_MCLK0_CLK] = &camcc_mclk0_clk.clkr,
+	[CAMCC_MCLK0_CLK_SRC] = &camcc_mclk0_clk_src.clkr,
+	[CAMCC_MCLK1_CLK] = &camcc_mclk1_clk.clkr,
+	[CAMCC_MCLK1_CLK_SRC] = &camcc_mclk1_clk_src.clkr,
+	[CAMCC_MCLK2_CLK] = &camcc_mclk2_clk.clkr,
+	[CAMCC_MCLK2_CLK_SRC] = &camcc_mclk2_clk_src.clkr,
+	[CAMCC_MCLK3_CLK] = &camcc_mclk3_clk.clkr,
+	[CAMCC_MCLK3_CLK_SRC] = &camcc_mclk3_clk_src.clkr,
+	[CAMCC_PLL0] = &camcc_pll0.clkr,
+	[CAMCC_PLL1] = &camcc_pll1.clkr,
+	[CAMCC_PLL2] = &camcc_pll2.clkr,
+	[CAMCC_PLL2_OUT_AUX] = &camcc_pll2_out_aux.clkr,
+	[CAMCC_PLL2_OUT_MAIN] = &camcc_pll2_out_main.clkr,
+	[CAMCC_PLL3] = &camcc_pll3.clkr,
+	[CAMCC_PLL4] = &camcc_pll4.clkr,
+	[CAMCC_SLEEP_CLK] = &camcc_sleep_clk.clkr,
+	[CAMCC_SLEEP_CLK_SRC] = &camcc_sleep_clk_src.clkr,
+	[CAMCC_SLOW_AHB_CLK_SRC] = &camcc_slow_ahb_clk_src.clkr,
+	[CAMCC_XO_CLK_SRC] = &camcc_xo_clk_src.clkr,
+};
+
+static struct gdsc *camcc_sm7150_gdscs[] = {
+	[BPS_GDSC] = &camcc_bps_gdsc,
+	[IFE_0_GDSC] = &camcc_ife_0_gdsc,
+	[IFE_1_GDSC] = &camcc_ife_1_gdsc,
+	[IPE_0_GDSC] = &camcc_ipe_0_gdsc,
+	[IPE_1_GDSC] = &camcc_ipe_1_gdsc,
+	[TITAN_TOP_GDSC] = &camcc_titan_top_gdsc,
+};
+
+static const struct regmap_config camcc_sm7150_regmap_config = {
+	.reg_bits	= 32,
+	.reg_stride	= 4,
+	.val_bits	= 32,
+	.max_register	= 0xd024,
+	.fast_io	= true,
+};
+
+static const struct qcom_cc_desc camcc_sm7150_desc = {
+	.config = &camcc_sm7150_regmap_config,
+	.clk_hws = camcc_sm7150_hws,
+	.num_clk_hws = ARRAY_SIZE(camcc_sm7150_hws),
+	.clks = camcc_sm7150_clocks,
+	.num_clks = ARRAY_SIZE(camcc_sm7150_clocks),
+	.gdscs = camcc_sm7150_gdscs,
+	.num_gdscs = ARRAY_SIZE(camcc_sm7150_gdscs),
+};
+
+static const struct of_device_id camcc_sm7150_match_table[] = {
+	{ .compatible = "qcom,sm7150-camcc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, camcc_sm7150_match_table);
+
+static int camcc_sm7150_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+
+	regmap = qcom_cc_map(pdev, &camcc_sm7150_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	clk_fabia_pll_configure(&camcc_pll0, regmap, &camcc_pll0_config);
+	clk_fabia_pll_configure(&camcc_pll1, regmap, &camcc_pll1_config);
+	clk_agera_pll_configure(&camcc_pll2, regmap, &camcc_pll2_config);
+	clk_fabia_pll_configure(&camcc_pll3, regmap, &camcc_pll3_config);
+	clk_fabia_pll_configure(&camcc_pll4, regmap, &camcc_pll3_config);
+
+	/* Keep some clocks always-on */
+	qcom_branch_set_clk_en(regmap, 0xc1a0); /* CAMCC_GDSC_CLK */
+
+	return qcom_cc_really_probe(&pdev->dev, &camcc_sm7150_desc, regmap);
+}
+
+static struct platform_driver camcc_sm7150_driver = {
+	.probe = camcc_sm7150_probe,
+	.driver = {
+		.name = "camcc-sm7150",
+		.of_match_table = camcc_sm7150_match_table,
+	},
+};
+
+module_platform_driver(camcc_sm7150_driver);
+
+MODULE_DESCRIPTION("Qualcomm SM7150 Camera Clock Controller");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sm8250.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sm8250.c
@@ -2433,7 +2433,7 @@
 	clk_lucid_pll_configure(&cam_cc_pll3, regmap, &cam_cc_pll3_config);
 	clk_lucid_pll_configure(&cam_cc_pll4, regmap, &cam_cc_pll4_config);
 
-	return qcom_cc_really_probe(pdev, &cam_cc_sm8250_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &cam_cc_sm8250_desc, regmap);
 }
 
 static struct platform_driver cam_cc_sm8250_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sm8450.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sm8450.c
@@ -2839,7 +2839,7 @@
 	clk_lucid_evo_pll_configure(&cam_cc_pll7, regmap, &cam_cc_pll7_config);
 	clk_lucid_evo_pll_configure(&cam_cc_pll8, regmap, &cam_cc_pll8_config);
 
-	return qcom_cc_really_probe(pdev, &cam_cc_sm8450_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &cam_cc_sm8450_desc, regmap);
 }
 
 static struct platform_driver cam_cc_sm8450_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-sm8550.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-sm8550.c
@@ -3544,7 +3544,7 @@
 	regmap_update_bits(regmap, 0x1419c, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x142cc, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &cam_cc_sm8550_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &cam_cc_sm8550_desc, regmap);
 
 	pm_runtime_put(&pdev->dev);
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/camcc-x1e80100.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/camcc-x1e80100.c
@@ -0,0 +1,2486 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,x1e80100-camcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+	DT_SLEEP_CLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_BI_TCXO_AO,
+	P_CAM_CC_PLL0_OUT_EVEN,
+	P_CAM_CC_PLL0_OUT_MAIN,
+	P_CAM_CC_PLL0_OUT_ODD,
+	P_CAM_CC_PLL1_OUT_EVEN,
+	P_CAM_CC_PLL2_OUT_EVEN,
+	P_CAM_CC_PLL2_OUT_MAIN,
+	P_CAM_CC_PLL3_OUT_EVEN,
+	P_CAM_CC_PLL4_OUT_EVEN,
+	P_CAM_CC_PLL6_OUT_EVEN,
+	P_CAM_CC_PLL8_OUT_EVEN,
+	P_SLEEP_CLK,
+};
+
+static const struct pll_vco lucid_ole_vco[] = {
+	{ 249600000, 2300000000, 0 },
+};
+
+static const struct pll_vco rivian_ole_vco[] = {
+	{ 777000000, 1285000000, 0 },
+};
+
+static const struct alpha_pll_config cam_cc_pll0_config = {
+	.l = 0x3e,
+	.alpha = 0x8000,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x82aa299c,
+	.test_ctl_val = 0x00000000,
+	.test_ctl_hi_val = 0x00000003,
+	.test_ctl_hi1_val = 0x00009000,
+	.test_ctl_hi2_val = 0x00000034,
+	.user_ctl_val = 0x00008400,
+	.user_ctl_hi_val = 0x00000005,
+};
+
+static struct clk_alpha_pll cam_cc_pll0 = {
+	.offset = 0x0,
+	.vco_table = lucid_ole_vco,
+	.num_vco = ARRAY_SIZE(lucid_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll0_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll0_out_even = {
+	.offset = 0x0,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll0_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll0_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll0_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll0.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_ole_ops,
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll0_out_odd[] = {
+	{ 0x2, 3 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll0_out_odd = {
+	.offset = 0x0,
+	.post_div_shift = 14,
+	.post_div_table = post_div_table_cam_cc_pll0_out_odd,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll0_out_odd),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll0_out_odd",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll0.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_ole_ops,
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll1_config = {
+	.l = 0x1f,
+	.alpha = 0xaaaa,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x82aa299c,
+	.test_ctl_val = 0x00000000,
+	.test_ctl_hi_val = 0x00000003,
+	.test_ctl_hi1_val = 0x00009000,
+	.test_ctl_hi2_val = 0x00000034,
+	.user_ctl_val = 0x00000400,
+	.user_ctl_hi_val = 0x00000005,
+};
+
+static struct clk_alpha_pll cam_cc_pll1 = {
+	.offset = 0x1000,
+	.vco_table = lucid_ole_vco,
+	.num_vco = ARRAY_SIZE(lucid_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll1_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll1_out_even = {
+	.offset = 0x1000,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll1_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll1_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll1_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll1.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_ole_ops,
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll2_config = {
+	.l = 0x32,
+	.alpha = 0x0,
+	.config_ctl_val = 0x10000030,
+	.config_ctl_hi_val = 0x80890263,
+	.config_ctl_hi1_val = 0x00000217,
+	.user_ctl_val = 0x00000001,
+	.user_ctl_hi_val = 0x00000000,
+};
+
+static struct clk_alpha_pll cam_cc_pll2 = {
+	.offset = 0x2000,
+	.vco_table = rivian_ole_vco,
+	.num_vco = ARRAY_SIZE(rivian_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_RIVIAN_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll2",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_rivian_evo_ops,
+		},
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll3_config = {
+	.l = 0x24,
+	.alpha = 0x0,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x82aa299c,
+	.test_ctl_val = 0x00000000,
+	.test_ctl_hi_val = 0x00000003,
+	.test_ctl_hi1_val = 0x00009000,
+	.test_ctl_hi2_val = 0x00000034,
+	.user_ctl_val = 0x00000400,
+	.user_ctl_hi_val = 0x00000005,
+};
+
+static struct clk_alpha_pll cam_cc_pll3 = {
+	.offset = 0x3000,
+	.vco_table = lucid_ole_vco,
+	.num_vco = ARRAY_SIZE(lucid_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll3",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll3_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll3_out_even = {
+	.offset = 0x3000,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll3_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll3_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll3_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll3.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_ole_ops,
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll4_config = {
+	.l = 0x24,
+	.alpha = 0x0,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x82aa299c,
+	.test_ctl_val = 0x00000000,
+	.test_ctl_hi_val = 0x00000003,
+	.test_ctl_hi1_val = 0x00009000,
+	.test_ctl_hi2_val = 0x00000034,
+	.user_ctl_val = 0x00000400,
+	.user_ctl_hi_val = 0x00000005,
+};
+
+static struct clk_alpha_pll cam_cc_pll4 = {
+	.offset = 0x4000,
+	.vco_table = lucid_ole_vco,
+	.num_vco = ARRAY_SIZE(lucid_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll4",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll4_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll4_out_even = {
+	.offset = 0x4000,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll4_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll4_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll4_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll4.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_ole_ops,
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll6_config = {
+	.l = 0x24,
+	.alpha = 0x0,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x82aa299c,
+	.test_ctl_val = 0x00000000,
+	.test_ctl_hi_val = 0x00000003,
+	.test_ctl_hi1_val = 0x00009000,
+	.test_ctl_hi2_val = 0x00000034,
+	.user_ctl_val = 0x00000400,
+	.user_ctl_hi_val = 0x00000005,
+};
+
+static struct clk_alpha_pll cam_cc_pll6 = {
+	.offset = 0x6000,
+	.vco_table = lucid_ole_vco,
+	.num_vco = ARRAY_SIZE(lucid_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll6",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll6_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll6_out_even = {
+	.offset = 0x6000,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll6_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll6_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll6_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll6.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_ole_ops,
+	},
+};
+
+static const struct alpha_pll_config cam_cc_pll8_config = {
+	.l = 0x32,
+	.alpha = 0x0,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x82aa299c,
+	.test_ctl_val = 0x00000000,
+	.test_ctl_hi_val = 0x00000003,
+	.test_ctl_hi1_val = 0x00009000,
+	.test_ctl_hi2_val = 0x00000034,
+	.user_ctl_val = 0x00000400,
+	.user_ctl_hi_val = 0x00000005,
+};
+
+static struct clk_alpha_pll cam_cc_pll8 = {
+	.offset = 0x8000,
+	.vco_table = lucid_ole_vco,
+	.num_vco = ARRAY_SIZE(lucid_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_pll8",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_cam_cc_pll8_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv cam_cc_pll8_out_even = {
+	.offset = 0x8000,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_cam_cc_pll8_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_cam_cc_pll8_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_pll8_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&cam_cc_pll8.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_alpha_pll_postdiv_lucid_ole_ops,
+	},
+};
+
+static const struct parent_map cam_cc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL0_OUT_MAIN, 1 },
+	{ P_CAM_CC_PLL0_OUT_EVEN, 2 },
+	{ P_CAM_CC_PLL0_OUT_ODD, 3 },
+	{ P_CAM_CC_PLL8_OUT_EVEN, 5 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll0.clkr.hw },
+	{ .hw = &cam_cc_pll0_out_even.clkr.hw },
+	{ .hw = &cam_cc_pll0_out_odd.clkr.hw },
+	{ .hw = &cam_cc_pll8_out_even.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL2_OUT_EVEN, 3 },
+	{ P_CAM_CC_PLL2_OUT_MAIN, 5 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll2.clkr.hw },
+	{ .hw = &cam_cc_pll2.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL3_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll3_out_even.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL4_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll4_out_even.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL1_OUT_EVEN, 4 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll1_out_even.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_CAM_CC_PLL6_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &cam_cc_pll6_out_even.clkr.hw },
+};
+
+static const struct parent_map cam_cc_parent_map_6[] = {
+	{ P_SLEEP_CLK, 0 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_6_ao[] = {
+	{ .index = DT_SLEEP_CLK },
+};
+
+static const struct parent_map cam_cc_parent_map_7[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data cam_cc_parent_data_7_ao[] = {
+	{ .index = DT_BI_TCXO_AO },
+};
+
+static const struct freq_tbl ftbl_cam_cc_bps_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(160000000, P_CAM_CC_PLL0_OUT_ODD, 2.5, 0, 0),
+	F(200000000, P_CAM_CC_PLL0_OUT_ODD, 2, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_ODD, 1, 0, 0),
+	F(600000000, P_CAM_CC_PLL0_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_bps_clk_src = {
+	.cmd_rcgr = 0x10278,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_bps_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_bps_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_camnoc_axi_rt_clk_src[] = {
+	F(240000000, P_CAM_CC_PLL0_OUT_EVEN, 2.5, 0, 0),
+	F(300000000, P_CAM_CC_PLL0_OUT_EVEN, 2, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_ODD, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_camnoc_axi_rt_clk_src = {
+	.cmd_rcgr = 0x138f8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_camnoc_axi_rt_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_camnoc_axi_rt_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_cci_0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(30000000, P_CAM_CC_PLL8_OUT_EVEN, 16, 0, 0),
+	F(37500000, P_CAM_CC_PLL0_OUT_EVEN, 16, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_cci_0_clk_src = {
+	.cmd_rcgr = 0x1365c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cci_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cci_0_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_cci_1_clk_src = {
+	.cmd_rcgr = 0x1378c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cci_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cci_1_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_cphy_rx_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(300000000, P_CAM_CC_PLL0_OUT_MAIN, 4, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(480000000, P_CAM_CC_PLL0_OUT_MAIN, 2.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_cphy_rx_clk_src = {
+	.cmd_rcgr = 0x11164,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_cphy_rx_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_cphy_rx_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_csi0phytimer_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(266666667, P_CAM_CC_PLL0_OUT_ODD, 1.5, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_ODD, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_csi0phytimer_clk_src = {
+	.cmd_rcgr = 0x150e0,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi0phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi1phytimer_clk_src = {
+	.cmd_rcgr = 0x15104,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi1phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi2phytimer_clk_src = {
+	.cmd_rcgr = 0x15124,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi2phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi3phytimer_clk_src = {
+	.cmd_rcgr = 0x15258,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi3phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi4phytimer_clk_src = {
+	.cmd_rcgr = 0x1538c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi4phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_csi5phytimer_clk_src = {
+	.cmd_rcgr = 0x154c0,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csi0phytimer_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csi5phytimer_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_csid_clk_src[] = {
+	F(300000000, P_CAM_CC_PLL0_OUT_MAIN, 4, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(480000000, P_CAM_CC_PLL0_OUT_MAIN, 2.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_csid_clk_src = {
+	.cmd_rcgr = 0x138d4,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_csid_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_csid_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_fast_ahb_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(80000000, P_CAM_CC_PLL0_OUT_EVEN, 7.5, 0, 0),
+	F(100000000, P_CAM_CC_PLL0_OUT_EVEN, 6, 0, 0),
+	F(200000000, P_CAM_CC_PLL0_OUT_EVEN, 3, 0, 0),
+	F(300000000, P_CAM_CC_PLL0_OUT_MAIN, 4, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_fast_ahb_clk_src = {
+	.cmd_rcgr = 0x10018,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_fast_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_fast_ahb_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_icp_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(300000000, P_CAM_CC_PLL0_OUT_EVEN, 2, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_ODD, 1, 0, 0),
+	F(480000000, P_CAM_CC_PLL8_OUT_EVEN, 1, 0, 0),
+	F(600000000, P_CAM_CC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_icp_clk_src = {
+	.cmd_rcgr = 0x13520,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_icp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_icp_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ife_0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(345600000, P_CAM_CC_PLL3_OUT_EVEN, 1, 0, 0),
+	F(432000000, P_CAM_CC_PLL3_OUT_EVEN, 1, 0, 0),
+	F(594000000, P_CAM_CC_PLL3_OUT_EVEN, 1, 0, 0),
+	F(675000000, P_CAM_CC_PLL3_OUT_EVEN, 1, 0, 0),
+	F(727000000, P_CAM_CC_PLL3_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ife_0_clk_src = {
+	.cmd_rcgr = 0x11018,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_2,
+	.freq_tbl = ftbl_cam_cc_ife_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_0_clk_src",
+		.parent_data = cam_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ife_1_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(345600000, P_CAM_CC_PLL4_OUT_EVEN, 1, 0, 0),
+	F(432000000, P_CAM_CC_PLL4_OUT_EVEN, 1, 0, 0),
+	F(594000000, P_CAM_CC_PLL4_OUT_EVEN, 1, 0, 0),
+	F(675000000, P_CAM_CC_PLL4_OUT_EVEN, 1, 0, 0),
+	F(727000000, P_CAM_CC_PLL4_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ife_1_clk_src = {
+	.cmd_rcgr = 0x12018,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_3,
+	.freq_tbl = ftbl_cam_cc_ife_1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_1_clk_src",
+		.parent_data = cam_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ife_lite_clk_src[] = {
+	F(266666667, P_CAM_CC_PLL0_OUT_ODD, 1.5, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_ODD, 1, 0, 0),
+	F(480000000, P_CAM_CC_PLL8_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ife_lite_clk_src = {
+	.cmd_rcgr = 0x13000,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_ife_lite_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_lite_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_ife_lite_csid_clk_src = {
+	.cmd_rcgr = 0x1313c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_ife_lite_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ife_lite_csid_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_ipe_nps_clk_src[] = {
+	F(304000000, P_CAM_CC_PLL1_OUT_EVEN, 1, 0, 0),
+	F(364000000, P_CAM_CC_PLL1_OUT_EVEN, 1, 0, 0),
+	F(500000000, P_CAM_CC_PLL1_OUT_EVEN, 1, 0, 0),
+	F(600000000, P_CAM_CC_PLL1_OUT_EVEN, 1, 0, 0),
+	F(700000000, P_CAM_CC_PLL1_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_ipe_nps_clk_src = {
+	.cmd_rcgr = 0x103cc,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_4,
+	.freq_tbl = ftbl_cam_cc_ipe_nps_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_ipe_nps_clk_src",
+		.parent_data = cam_cc_parent_data_4,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_jpeg_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(160000000, P_CAM_CC_PLL0_OUT_ODD, 2.5, 0, 0),
+	F(200000000, P_CAM_CC_PLL0_OUT_ODD, 2, 0, 0),
+	F(400000000, P_CAM_CC_PLL0_OUT_ODD, 1, 0, 0),
+	F(480000000, P_CAM_CC_PLL8_OUT_EVEN, 1, 0, 0),
+	F(600000000, P_CAM_CC_PLL0_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_jpeg_clk_src = {
+	.cmd_rcgr = 0x133dc,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_jpeg_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_jpeg_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_mclk0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(24000000, P_CAM_CC_PLL2_OUT_MAIN, 10, 1, 4),
+	F(68571429, P_CAM_CC_PLL2_OUT_MAIN, 14, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_mclk0_clk_src = {
+	.cmd_rcgr = 0x15000,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk0_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk1_clk_src = {
+	.cmd_rcgr = 0x1501c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk1_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk2_clk_src = {
+	.cmd_rcgr = 0x15038,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk2_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk3_clk_src = {
+	.cmd_rcgr = 0x15054,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk3_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk4_clk_src = {
+	.cmd_rcgr = 0x15070,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk4_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk5_clk_src = {
+	.cmd_rcgr = 0x1508c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk5_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk6_clk_src = {
+	.cmd_rcgr = 0x150a8,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk6_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 cam_cc_mclk7_clk_src = {
+	.cmd_rcgr = 0x150c4,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_1,
+	.freq_tbl = ftbl_cam_cc_mclk0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_mclk7_clk_src",
+		.parent_data = cam_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_sfe_0_clk_src[] = {
+	F(345600000, P_CAM_CC_PLL6_OUT_EVEN, 1, 0, 0),
+	F(432000000, P_CAM_CC_PLL6_OUT_EVEN, 1, 0, 0),
+	F(594000000, P_CAM_CC_PLL6_OUT_EVEN, 1, 0, 0),
+	F(675000000, P_CAM_CC_PLL6_OUT_EVEN, 1, 0, 0),
+	F(727000000, P_CAM_CC_PLL6_OUT_EVEN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_sfe_0_clk_src = {
+	.cmd_rcgr = 0x13294,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_5,
+	.freq_tbl = ftbl_cam_cc_sfe_0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_sfe_0_clk_src",
+		.parent_data = cam_cc_parent_data_5,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_5),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_sleep_clk_src[] = {
+	F(32000, P_SLEEP_CLK, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_sleep_clk_src = {
+	.cmd_rcgr = 0x13aa0,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_6,
+	.freq_tbl = ftbl_cam_cc_sleep_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_sleep_clk_src",
+		.parent_data = cam_cc_parent_data_6_ao,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_6_ao),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_slow_ahb_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(64000000, P_CAM_CC_PLL8_OUT_EVEN, 7.5, 0, 0),
+	F(80000000, P_CAM_CC_PLL0_OUT_EVEN, 7.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_slow_ahb_clk_src = {
+	.cmd_rcgr = 0x10148,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_0,
+	.freq_tbl = ftbl_cam_cc_slow_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_slow_ahb_clk_src",
+		.parent_data = cam_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_cam_cc_xo_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 cam_cc_xo_clk_src = {
+	.cmd_rcgr = 0x13a84,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = cam_cc_parent_map_7,
+	.freq_tbl = ftbl_cam_cc_xo_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "cam_cc_xo_clk_src",
+		.parent_data = cam_cc_parent_data_7_ao,
+		.num_parents = ARRAY_SIZE(cam_cc_parent_data_7_ao),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_branch cam_cc_bps_ahb_clk = {
+	.halt_reg = 0x10274,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x10274,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_bps_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_bps_clk = {
+	.halt_reg = 0x103a4,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x103a4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_bps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_bps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_bps_fast_ahb_clk = {
+	.halt_reg = 0x10144,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x10144,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_bps_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_camnoc_axi_nrt_clk = {
+	.halt_reg = 0x13920,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13920,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_camnoc_axi_nrt_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_camnoc_axi_rt_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_camnoc_axi_rt_clk = {
+	.halt_reg = 0x13910,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13910,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_camnoc_axi_rt_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_camnoc_axi_rt_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_camnoc_dcd_xo_clk = {
+	.halt_reg = 0x1392c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1392c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_camnoc_dcd_xo_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_camnoc_xo_clk = {
+	.halt_reg = 0x13930,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13930,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_camnoc_xo_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cci_0_clk = {
+	.halt_reg = 0x13788,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13788,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cci_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cci_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cci_1_clk = {
+	.halt_reg = 0x138b8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x138b8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cci_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cci_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_core_ahb_clk = {
+	.halt_reg = 0x13a80,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x13a80,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_core_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ahb_clk = {
+	.halt_reg = 0x138bc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x138bc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_bps_clk = {
+	.halt_reg = 0x103b0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x103b0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_bps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_bps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_fast_ahb_clk = {
+	.halt_reg = 0x138c8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x138c8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ife_0_clk = {
+	.halt_reg = 0x11150,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x11150,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ife_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ife_1_clk = {
+	.halt_reg = 0x1203c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1203c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ife_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ife_lite_clk = {
+	.halt_reg = 0x13138,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13138,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ife_lite_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_lite_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_ipe_nps_clk = {
+	.halt_reg = 0x10504,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x10504,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_ipe_nps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ipe_nps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_cpas_sfe_0_clk = {
+	.halt_reg = 0x133cc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x133cc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_cpas_sfe_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_sfe_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi0phytimer_clk = {
+	.halt_reg = 0x150f8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150f8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi0phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi0phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi1phytimer_clk = {
+	.halt_reg = 0x1511c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1511c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi1phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi1phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi2phytimer_clk = {
+	.halt_reg = 0x15250,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15250,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi2phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi2phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi3phytimer_clk = {
+	.halt_reg = 0x15384,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15384,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi3phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi3phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi4phytimer_clk = {
+	.halt_reg = 0x154b8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x154b8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi4phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi4phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csi5phytimer_clk = {
+	.halt_reg = 0x155ec,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x155ec,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csi5phytimer_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csi5phytimer_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csid_clk = {
+	.halt_reg = 0x138ec,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x138ec,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csid_csiphy_rx_clk = {
+	.halt_reg = 0x15100,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15100,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csid_csiphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy0_clk = {
+	.halt_reg = 0x150fc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150fc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy1_clk = {
+	.halt_reg = 0x15120,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15120,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy2_clk = {
+	.halt_reg = 0x15254,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15254,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy3_clk = {
+	.halt_reg = 0x15388,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15388,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy4_clk = {
+	.halt_reg = 0x154bc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x154bc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy4_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_csiphy5_clk = {
+	.halt_reg = 0x155f0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x155f0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_csiphy5_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_icp_ahb_clk = {
+	.halt_reg = 0x13658,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13658,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_icp_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_icp_clk = {
+	.halt_reg = 0x1364c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1364c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_icp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_icp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_clk = {
+	.halt_reg = 0x11144,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x11144,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_dsp_clk = {
+	.halt_reg = 0x11154,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x11154,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_dsp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_0_fast_ahb_clk = {
+	.halt_reg = 0x11160,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x11160,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_0_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_clk = {
+	.halt_reg = 0x12030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x12030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_dsp_clk = {
+	.halt_reg = 0x12040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x12040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_dsp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_1_fast_ahb_clk = {
+	.halt_reg = 0x1204c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1204c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_1_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_ahb_clk = {
+	.halt_reg = 0x13278,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13278,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_clk = {
+	.halt_reg = 0x1312c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1312c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_lite_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_cphy_rx_clk = {
+	.halt_reg = 0x13274,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13274,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_cphy_rx_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_cphy_rx_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ife_lite_csid_clk = {
+	.halt_reg = 0x13268,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13268,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ife_lite_csid_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ife_lite_csid_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_nps_ahb_clk = {
+	.halt_reg = 0x1051c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1051c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_nps_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_slow_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_nps_clk = {
+	.halt_reg = 0x104f8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x104f8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_nps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ipe_nps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_nps_fast_ahb_clk = {
+	.halt_reg = 0x10520,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x10520,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_nps_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_pps_clk = {
+	.halt_reg = 0x10508,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x10508,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_pps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_ipe_nps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_ipe_pps_fast_ahb_clk = {
+	.halt_reg = 0x10524,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x10524,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_ipe_pps_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_jpeg_clk = {
+	.halt_reg = 0x13508,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x13508,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_jpeg_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_jpeg_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk0_clk = {
+	.halt_reg = 0x15018,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk1_clk = {
+	.halt_reg = 0x15034,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15034,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk2_clk = {
+	.halt_reg = 0x15050,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15050,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk3_clk = {
+	.halt_reg = 0x1506c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1506c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk4_clk = {
+	.halt_reg = 0x15088,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x15088,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk4_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk4_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk5_clk = {
+	.halt_reg = 0x150a4,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150a4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk5_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk5_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk6_clk = {
+	.halt_reg = 0x150c0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150c0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk6_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk6_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_mclk7_clk = {
+	.halt_reg = 0x150dc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x150dc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_mclk7_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_mclk7_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_sfe_0_clk = {
+	.halt_reg = 0x133c0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x133c0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_sfe_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_sfe_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch cam_cc_sfe_0_fast_ahb_clk = {
+	.halt_reg = 0x133d8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x133d8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "cam_cc_sfe_0_fast_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&cam_cc_fast_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc cam_cc_bps_gdsc = {
+	.gdscr = 0x10004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "cam_cc_bps_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+};
+
+static struct gdsc cam_cc_ife_0_gdsc = {
+	.gdscr = 0x11004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "cam_cc_ife_0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+};
+
+static struct gdsc cam_cc_ife_1_gdsc = {
+	.gdscr = 0x12004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "cam_cc_ife_1_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+};
+
+static struct gdsc cam_cc_ipe_0_gdsc = {
+	.gdscr = 0x103b8,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "cam_cc_ipe_0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+};
+
+static struct gdsc cam_cc_sfe_0_gdsc = {
+	.gdscr = 0x13280,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "cam_cc_sfe_0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+};
+
+static struct gdsc cam_cc_titan_top_gdsc = {
+	.gdscr = 0x13a6c,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "cam_cc_titan_top_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+};
+
+static struct clk_regmap *cam_cc_x1e80100_clocks[] = {
+	[CAM_CC_BPS_AHB_CLK] = &cam_cc_bps_ahb_clk.clkr,
+	[CAM_CC_BPS_CLK] = &cam_cc_bps_clk.clkr,
+	[CAM_CC_BPS_CLK_SRC] = &cam_cc_bps_clk_src.clkr,
+	[CAM_CC_BPS_FAST_AHB_CLK] = &cam_cc_bps_fast_ahb_clk.clkr,
+	[CAM_CC_CAMNOC_AXI_NRT_CLK] = &cam_cc_camnoc_axi_nrt_clk.clkr,
+	[CAM_CC_CAMNOC_AXI_RT_CLK] = &cam_cc_camnoc_axi_rt_clk.clkr,
+	[CAM_CC_CAMNOC_AXI_RT_CLK_SRC] = &cam_cc_camnoc_axi_rt_clk_src.clkr,
+	[CAM_CC_CAMNOC_DCD_XO_CLK] = &cam_cc_camnoc_dcd_xo_clk.clkr,
+	[CAM_CC_CAMNOC_XO_CLK] = &cam_cc_camnoc_xo_clk.clkr,
+	[CAM_CC_CCI_0_CLK] = &cam_cc_cci_0_clk.clkr,
+	[CAM_CC_CCI_0_CLK_SRC] = &cam_cc_cci_0_clk_src.clkr,
+	[CAM_CC_CCI_1_CLK] = &cam_cc_cci_1_clk.clkr,
+	[CAM_CC_CCI_1_CLK_SRC] = &cam_cc_cci_1_clk_src.clkr,
+	[CAM_CC_CORE_AHB_CLK] = &cam_cc_core_ahb_clk.clkr,
+	[CAM_CC_CPAS_AHB_CLK] = &cam_cc_cpas_ahb_clk.clkr,
+	[CAM_CC_CPAS_BPS_CLK] = &cam_cc_cpas_bps_clk.clkr,
+	[CAM_CC_CPAS_FAST_AHB_CLK] = &cam_cc_cpas_fast_ahb_clk.clkr,
+	[CAM_CC_CPAS_IFE_0_CLK] = &cam_cc_cpas_ife_0_clk.clkr,
+	[CAM_CC_CPAS_IFE_1_CLK] = &cam_cc_cpas_ife_1_clk.clkr,
+	[CAM_CC_CPAS_IFE_LITE_CLK] = &cam_cc_cpas_ife_lite_clk.clkr,
+	[CAM_CC_CPAS_IPE_NPS_CLK] = &cam_cc_cpas_ipe_nps_clk.clkr,
+	[CAM_CC_CPAS_SFE_0_CLK] = &cam_cc_cpas_sfe_0_clk.clkr,
+	[CAM_CC_CPHY_RX_CLK_SRC] = &cam_cc_cphy_rx_clk_src.clkr,
+	[CAM_CC_CSI0PHYTIMER_CLK] = &cam_cc_csi0phytimer_clk.clkr,
+	[CAM_CC_CSI0PHYTIMER_CLK_SRC] = &cam_cc_csi0phytimer_clk_src.clkr,
+	[CAM_CC_CSI1PHYTIMER_CLK] = &cam_cc_csi1phytimer_clk.clkr,
+	[CAM_CC_CSI1PHYTIMER_CLK_SRC] = &cam_cc_csi1phytimer_clk_src.clkr,
+	[CAM_CC_CSI2PHYTIMER_CLK] = &cam_cc_csi2phytimer_clk.clkr,
+	[CAM_CC_CSI2PHYTIMER_CLK_SRC] = &cam_cc_csi2phytimer_clk_src.clkr,
+	[CAM_CC_CSI3PHYTIMER_CLK] = &cam_cc_csi3phytimer_clk.clkr,
+	[CAM_CC_CSI3PHYTIMER_CLK_SRC] = &cam_cc_csi3phytimer_clk_src.clkr,
+	[CAM_CC_CSI4PHYTIMER_CLK] = &cam_cc_csi4phytimer_clk.clkr,
+	[CAM_CC_CSI4PHYTIMER_CLK_SRC] = &cam_cc_csi4phytimer_clk_src.clkr,
+	[CAM_CC_CSI5PHYTIMER_CLK] = &cam_cc_csi5phytimer_clk.clkr,
+	[CAM_CC_CSI5PHYTIMER_CLK_SRC] = &cam_cc_csi5phytimer_clk_src.clkr,
+	[CAM_CC_CSID_CLK] = &cam_cc_csid_clk.clkr,
+	[CAM_CC_CSID_CLK_SRC] = &cam_cc_csid_clk_src.clkr,
+	[CAM_CC_CSID_CSIPHY_RX_CLK] = &cam_cc_csid_csiphy_rx_clk.clkr,
+	[CAM_CC_CSIPHY0_CLK] = &cam_cc_csiphy0_clk.clkr,
+	[CAM_CC_CSIPHY1_CLK] = &cam_cc_csiphy1_clk.clkr,
+	[CAM_CC_CSIPHY2_CLK] = &cam_cc_csiphy2_clk.clkr,
+	[CAM_CC_CSIPHY3_CLK] = &cam_cc_csiphy3_clk.clkr,
+	[CAM_CC_CSIPHY4_CLK] = &cam_cc_csiphy4_clk.clkr,
+	[CAM_CC_CSIPHY5_CLK] = &cam_cc_csiphy5_clk.clkr,
+	[CAM_CC_FAST_AHB_CLK_SRC] = &cam_cc_fast_ahb_clk_src.clkr,
+	[CAM_CC_ICP_AHB_CLK] = &cam_cc_icp_ahb_clk.clkr,
+	[CAM_CC_ICP_CLK] = &cam_cc_icp_clk.clkr,
+	[CAM_CC_ICP_CLK_SRC] = &cam_cc_icp_clk_src.clkr,
+	[CAM_CC_IFE_0_CLK] = &cam_cc_ife_0_clk.clkr,
+	[CAM_CC_IFE_0_CLK_SRC] = &cam_cc_ife_0_clk_src.clkr,
+	[CAM_CC_IFE_0_DSP_CLK] = &cam_cc_ife_0_dsp_clk.clkr,
+	[CAM_CC_IFE_0_FAST_AHB_CLK] = &cam_cc_ife_0_fast_ahb_clk.clkr,
+	[CAM_CC_IFE_1_CLK] = &cam_cc_ife_1_clk.clkr,
+	[CAM_CC_IFE_1_CLK_SRC] = &cam_cc_ife_1_clk_src.clkr,
+	[CAM_CC_IFE_1_DSP_CLK] = &cam_cc_ife_1_dsp_clk.clkr,
+	[CAM_CC_IFE_1_FAST_AHB_CLK] = &cam_cc_ife_1_fast_ahb_clk.clkr,
+	[CAM_CC_IFE_LITE_AHB_CLK] = &cam_cc_ife_lite_ahb_clk.clkr,
+	[CAM_CC_IFE_LITE_CLK] = &cam_cc_ife_lite_clk.clkr,
+	[CAM_CC_IFE_LITE_CLK_SRC] = &cam_cc_ife_lite_clk_src.clkr,
+	[CAM_CC_IFE_LITE_CPHY_RX_CLK] = &cam_cc_ife_lite_cphy_rx_clk.clkr,
+	[CAM_CC_IFE_LITE_CSID_CLK] = &cam_cc_ife_lite_csid_clk.clkr,
+	[CAM_CC_IFE_LITE_CSID_CLK_SRC] = &cam_cc_ife_lite_csid_clk_src.clkr,
+	[CAM_CC_IPE_NPS_AHB_CLK] = &cam_cc_ipe_nps_ahb_clk.clkr,
+	[CAM_CC_IPE_NPS_CLK] = &cam_cc_ipe_nps_clk.clkr,
+	[CAM_CC_IPE_NPS_CLK_SRC] = &cam_cc_ipe_nps_clk_src.clkr,
+	[CAM_CC_IPE_NPS_FAST_AHB_CLK] = &cam_cc_ipe_nps_fast_ahb_clk.clkr,
+	[CAM_CC_IPE_PPS_CLK] = &cam_cc_ipe_pps_clk.clkr,
+	[CAM_CC_IPE_PPS_FAST_AHB_CLK] = &cam_cc_ipe_pps_fast_ahb_clk.clkr,
+	[CAM_CC_JPEG_CLK] = &cam_cc_jpeg_clk.clkr,
+	[CAM_CC_JPEG_CLK_SRC] = &cam_cc_jpeg_clk_src.clkr,
+	[CAM_CC_MCLK0_CLK] = &cam_cc_mclk0_clk.clkr,
+	[CAM_CC_MCLK0_CLK_SRC] = &cam_cc_mclk0_clk_src.clkr,
+	[CAM_CC_MCLK1_CLK] = &cam_cc_mclk1_clk.clkr,
+	[CAM_CC_MCLK1_CLK_SRC] = &cam_cc_mclk1_clk_src.clkr,
+	[CAM_CC_MCLK2_CLK] = &cam_cc_mclk2_clk.clkr,
+	[CAM_CC_MCLK2_CLK_SRC] = &cam_cc_mclk2_clk_src.clkr,
+	[CAM_CC_MCLK3_CLK] = &cam_cc_mclk3_clk.clkr,
+	[CAM_CC_MCLK3_CLK_SRC] = &cam_cc_mclk3_clk_src.clkr,
+	[CAM_CC_MCLK4_CLK] = &cam_cc_mclk4_clk.clkr,
+	[CAM_CC_MCLK4_CLK_SRC] = &cam_cc_mclk4_clk_src.clkr,
+	[CAM_CC_MCLK5_CLK] = &cam_cc_mclk5_clk.clkr,
+	[CAM_CC_MCLK5_CLK_SRC] = &cam_cc_mclk5_clk_src.clkr,
+	[CAM_CC_MCLK6_CLK] = &cam_cc_mclk6_clk.clkr,
+	[CAM_CC_MCLK6_CLK_SRC] = &cam_cc_mclk6_clk_src.clkr,
+	[CAM_CC_MCLK7_CLK] = &cam_cc_mclk7_clk.clkr,
+	[CAM_CC_MCLK7_CLK_SRC] = &cam_cc_mclk7_clk_src.clkr,
+	[CAM_CC_PLL0] = &cam_cc_pll0.clkr,
+	[CAM_CC_PLL0_OUT_EVEN] = &cam_cc_pll0_out_even.clkr,
+	[CAM_CC_PLL0_OUT_ODD] = &cam_cc_pll0_out_odd.clkr,
+	[CAM_CC_PLL1] = &cam_cc_pll1.clkr,
+	[CAM_CC_PLL1_OUT_EVEN] = &cam_cc_pll1_out_even.clkr,
+	[CAM_CC_PLL2] = &cam_cc_pll2.clkr,
+	[CAM_CC_PLL3] = &cam_cc_pll3.clkr,
+	[CAM_CC_PLL3_OUT_EVEN] = &cam_cc_pll3_out_even.clkr,
+	[CAM_CC_PLL4] = &cam_cc_pll4.clkr,
+	[CAM_CC_PLL4_OUT_EVEN] = &cam_cc_pll4_out_even.clkr,
+	[CAM_CC_PLL6] = &cam_cc_pll6.clkr,
+	[CAM_CC_PLL6_OUT_EVEN] = &cam_cc_pll6_out_even.clkr,
+	[CAM_CC_PLL8] = &cam_cc_pll8.clkr,
+	[CAM_CC_PLL8_OUT_EVEN] = &cam_cc_pll8_out_even.clkr,
+	[CAM_CC_SFE_0_CLK] = &cam_cc_sfe_0_clk.clkr,
+	[CAM_CC_SFE_0_CLK_SRC] = &cam_cc_sfe_0_clk_src.clkr,
+	[CAM_CC_SFE_0_FAST_AHB_CLK] = &cam_cc_sfe_0_fast_ahb_clk.clkr,
+	[CAM_CC_SLEEP_CLK_SRC] = &cam_cc_sleep_clk_src.clkr,
+	[CAM_CC_SLOW_AHB_CLK_SRC] = &cam_cc_slow_ahb_clk_src.clkr,
+	[CAM_CC_XO_CLK_SRC] = &cam_cc_xo_clk_src.clkr,
+};
+
+static struct gdsc *cam_cc_x1e80100_gdscs[] = {
+	[CAM_CC_BPS_GDSC] = &cam_cc_bps_gdsc,
+	[CAM_CC_IFE_0_GDSC] = &cam_cc_ife_0_gdsc,
+	[CAM_CC_IFE_1_GDSC] = &cam_cc_ife_1_gdsc,
+	[CAM_CC_IPE_0_GDSC] = &cam_cc_ipe_0_gdsc,
+	[CAM_CC_SFE_0_GDSC] = &cam_cc_sfe_0_gdsc,
+	[CAM_CC_TITAN_TOP_GDSC] = &cam_cc_titan_top_gdsc,
+};
+
+static const struct qcom_reset_map cam_cc_x1e80100_resets[] = {
+	[CAM_CC_BPS_BCR] = { 0x10000 },
+	[CAM_CC_ICP_BCR] = { 0x1351c },
+	[CAM_CC_IFE_0_BCR] = { 0x11000 },
+	[CAM_CC_IFE_1_BCR] = { 0x12000 },
+	[CAM_CC_IPE_0_BCR] = { 0x103b4 },
+	[CAM_CC_SFE_0_BCR] = { 0x1327c },
+};
+
+static const struct regmap_config cam_cc_x1e80100_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0x1603c,
+	.fast_io = true,
+};
+
+static const struct qcom_cc_desc cam_cc_x1e80100_desc = {
+	.config = &cam_cc_x1e80100_regmap_config,
+	.clks = cam_cc_x1e80100_clocks,
+	.num_clks = ARRAY_SIZE(cam_cc_x1e80100_clocks),
+	.resets = cam_cc_x1e80100_resets,
+	.num_resets = ARRAY_SIZE(cam_cc_x1e80100_resets),
+	.gdscs = cam_cc_x1e80100_gdscs,
+	.num_gdscs = ARRAY_SIZE(cam_cc_x1e80100_gdscs),
+};
+
+static const struct of_device_id cam_cc_x1e80100_match_table[] = {
+	{ .compatible = "qcom,x1e80100-camcc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, cam_cc_x1e80100_match_table);
+
+static int cam_cc_x1e80100_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+	int ret;
+
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		return ret;
+
+	ret = pm_runtime_resume_and_get(&pdev->dev);
+	if (ret)
+		return ret;
+
+	regmap = qcom_cc_map(pdev, &cam_cc_x1e80100_desc);
+	if (IS_ERR(regmap)) {
+		pm_runtime_put(&pdev->dev);
+		return PTR_ERR(regmap);
+	}
+
+	clk_lucid_ole_pll_configure(&cam_cc_pll0, regmap, &cam_cc_pll0_config);
+	clk_lucid_ole_pll_configure(&cam_cc_pll1, regmap, &cam_cc_pll1_config);
+	clk_rivian_evo_pll_configure(&cam_cc_pll2, regmap, &cam_cc_pll2_config);
+	clk_lucid_ole_pll_configure(&cam_cc_pll3, regmap, &cam_cc_pll3_config);
+	clk_lucid_ole_pll_configure(&cam_cc_pll4, regmap, &cam_cc_pll4_config);
+	clk_lucid_ole_pll_configure(&cam_cc_pll6, regmap, &cam_cc_pll6_config);
+	clk_lucid_ole_pll_configure(&cam_cc_pll8, regmap, &cam_cc_pll8_config);
+
+	/* Keep clocks always enabled */
+	regmap_update_bits(regmap, 0x13a9c, BIT(0), BIT(0)); /* cam_cc_gdsc_clk */
+	regmap_update_bits(regmap, 0x13ab8, BIT(0), BIT(0)); /* cam_cc_sleep_clk */
+
+	ret = qcom_cc_really_probe(&pdev->dev, &cam_cc_x1e80100_desc, regmap);
+
+	pm_runtime_put(&pdev->dev);
+
+	return ret;
+}
+
+static struct platform_driver cam_cc_x1e80100_driver = {
+	.probe = cam_cc_x1e80100_probe,
+	.driver = {
+		.name = "camcc-x1e80100",
+		.of_match_table = cam_cc_x1e80100_match_table,
+	},
+};
+
+module_platform_driver(cam_cc_x1e80100_driver);
+
+MODULE_DESCRIPTION("QTI Camera Clock Controller X1E80100 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/clk-alpha-pll.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/clk-alpha-pll.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2015, 2018, The Linux Foundation. All rights reserved.
- * Copyright (c) 2021, 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021, 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/kernel.h>
@@ -40,7 +40,7 @@
 
 #define PLL_USER_CTL(p)		((p)->offset + (p)->regs[PLL_OFF_USER_CTL])
 # define PLL_POST_DIV_SHIFT	8
-# define PLL_POST_DIV_MASK(p)	GENMASK((p)->width, 0)
+# define PLL_POST_DIV_MASK(p)	GENMASK((p)->width ? (p)->width - 1 : 3, 0)
 # define PLL_ALPHA_EN		BIT(24)
 # define PLL_ALPHA_MODE		BIT(25)
 # define PLL_VCO_SHIFT		20
@@ -52,6 +52,7 @@
 #define PLL_CONFIG_CTL(p)	((p)->offset + (p)->regs[PLL_OFF_CONFIG_CTL])
 #define PLL_CONFIG_CTL_U(p)	((p)->offset + (p)->regs[PLL_OFF_CONFIG_CTL_U])
 #define PLL_CONFIG_CTL_U1(p)	((p)->offset + (p)->regs[PLL_OFF_CONFIG_CTL_U1])
+#define PLL_CONFIG_CTL_U2(p)	((p)->offset + (p)->regs[PLL_OFF_CONFIG_CTL_U2])
 #define PLL_TEST_CTL(p)		((p)->offset + (p)->regs[PLL_OFF_TEST_CTL])
 #define PLL_TEST_CTL_U(p)	((p)->offset + (p)->regs[PLL_OFF_TEST_CTL_U])
 #define PLL_TEST_CTL_U1(p)     ((p)->offset + (p)->regs[PLL_OFF_TEST_CTL_U1])
@@ -212,7 +213,6 @@
 		[PLL_OFF_USER_CTL] = 0x18,
 		[PLL_OFF_USER_CTL_U] = 0x1c,
 		[PLL_OFF_CONFIG_CTL] = 0x20,
-		[PLL_OFF_CONFIG_CTL_U] = 0xff,
 		[PLL_OFF_TEST_CTL] = 0x30,
 		[PLL_OFF_TEST_CTL_U] = 0x34,
 		[PLL_OFF_STATUS] = 0x28,
@@ -228,6 +228,32 @@
 		[PLL_OFF_ALPHA_VAL] = 0x24,
 		[PLL_OFF_ALPHA_VAL_U] = 0x28,
 	},
+	[CLK_ALPHA_PLL_TYPE_ZONDA_OLE] =  {
+		[PLL_OFF_L_VAL] = 0x04,
+		[PLL_OFF_ALPHA_VAL] = 0x08,
+		[PLL_OFF_USER_CTL] = 0x0c,
+		[PLL_OFF_USER_CTL_U] = 0x10,
+		[PLL_OFF_CONFIG_CTL] = 0x14,
+		[PLL_OFF_CONFIG_CTL_U] = 0x18,
+		[PLL_OFF_CONFIG_CTL_U1] = 0x1c,
+		[PLL_OFF_CONFIG_CTL_U2] = 0x20,
+		[PLL_OFF_TEST_CTL] = 0x24,
+		[PLL_OFF_TEST_CTL_U] = 0x28,
+		[PLL_OFF_TEST_CTL_U1] = 0x2c,
+		[PLL_OFF_OPMODE] = 0x30,
+		[PLL_OFF_STATUS] = 0x3c,
+	},
+	[CLK_ALPHA_PLL_TYPE_NSS_HUAYRA] =  {
+		[PLL_OFF_L_VAL] = 0x04,
+		[PLL_OFF_ALPHA_VAL] = 0x08,
+		[PLL_OFF_TEST_CTL] = 0x0c,
+		[PLL_OFF_TEST_CTL_U] = 0x10,
+		[PLL_OFF_USER_CTL] = 0x14,
+		[PLL_OFF_CONFIG_CTL] = 0x18,
+		[PLL_OFF_CONFIG_CTL_U] = 0x1c,
+		[PLL_OFF_STATUS] = 0x20,
+	},
+
 };
 EXPORT_SYMBOL_GPL(clk_alpha_pll_regs);
 
@@ -382,6 +408,8 @@
 	mask |= config->pre_div_mask;
 	mask |= config->post_div_mask;
 	mask |= config->vco_mask;
+	mask |= config->alpha_en_mask;
+	mask |= config->alpha_mode_mask;
 
 	regmap_update_bits(regmap, PLL_USER_CTL(pll), mask, val);
 
@@ -1480,8 +1508,8 @@
 	}
 
 	return regmap_update_bits(regmap, PLL_USER_CTL(pll),
-				  PLL_POST_DIV_MASK(pll) << PLL_POST_DIV_SHIFT,
-				  val << PLL_POST_DIV_SHIFT);
+				  PLL_POST_DIV_MASK(pll) << pll->post_div_shift,
+				  val << pll->post_div_shift);
 }
 
 const struct clk_ops clk_alpha_pll_postdiv_trion_ops = {
@@ -1640,7 +1668,7 @@
 	if (ret < 0)
 		return ret;
 
-	regmap_write(pll->clkr.regmap, PLL_L_VAL(pll), l);
+	regmap_update_bits(pll->clkr.regmap, PLL_L_VAL(pll), LUCID_EVO_PLL_L_VAL_MASK,  l);
 	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL(pll), a);
 
 	/* Latch the PLL input */
@@ -1759,6 +1787,58 @@
 };
 EXPORT_SYMBOL_GPL(clk_alpha_pll_agera_ops);
 
+/**
+ * clk_lucid_5lpe_pll_configure - configure the lucid 5lpe pll
+ *
+ * @pll: clk alpha pll
+ * @regmap: register map
+ * @config: configuration to apply for pll
+ */
+void clk_lucid_5lpe_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
+				  const struct alpha_pll_config *config)
+{
+	/*
+	 * If the bootloader left the PLL enabled it's likely that there are
+	 * RCGs that will lock up if we disable the PLL below.
+	 */
+	if (trion_pll_is_enabled(pll, regmap)) {
+		pr_debug("Lucid 5LPE PLL is already enabled, skipping configuration\n");
+		return;
+	}
+
+	clk_alpha_pll_write_config(regmap, PLL_L_VAL(pll), config->l);
+	regmap_write(regmap, PLL_CAL_L_VAL(pll), TRION_PLL_CAL_VAL);
+	clk_alpha_pll_write_config(regmap, PLL_ALPHA_VAL(pll), config->alpha);
+	clk_alpha_pll_write_config(regmap, PLL_CONFIG_CTL(pll),
+				     config->config_ctl_val);
+	clk_alpha_pll_write_config(regmap, PLL_CONFIG_CTL_U(pll),
+				     config->config_ctl_hi_val);
+	clk_alpha_pll_write_config(regmap, PLL_CONFIG_CTL_U1(pll),
+				     config->config_ctl_hi1_val);
+	clk_alpha_pll_write_config(regmap, PLL_USER_CTL(pll),
+					config->user_ctl_val);
+	clk_alpha_pll_write_config(regmap, PLL_USER_CTL_U(pll),
+					config->user_ctl_hi_val);
+	clk_alpha_pll_write_config(regmap, PLL_USER_CTL_U1(pll),
+					config->user_ctl_hi1_val);
+	clk_alpha_pll_write_config(regmap, PLL_TEST_CTL(pll),
+					config->test_ctl_val);
+	clk_alpha_pll_write_config(regmap, PLL_TEST_CTL_U(pll),
+					config->test_ctl_hi_val);
+	clk_alpha_pll_write_config(regmap, PLL_TEST_CTL_U1(pll),
+					config->test_ctl_hi1_val);
+
+	/* Disable PLL output */
+	regmap_update_bits(regmap, PLL_MODE(pll),  PLL_OUTCTRL, 0);
+
+	/* Set operation mode to OFF */
+	regmap_write(regmap, PLL_OPMODE(pll), PLL_STANDBY);
+
+	/* Place the PLL in STANDBY mode */
+	regmap_update_bits(regmap, PLL_MODE(pll), PLL_RESET_N, PLL_RESET_N);
+}
+EXPORT_SYMBOL_GPL(clk_lucid_5lpe_pll_configure);
+
 static int alpha_pll_lucid_5lpe_enable(struct clk_hw *hw)
 {
 	struct clk_alpha_pll *pll = to_clk_alpha_pll(hw);
@@ -2474,6 +2554,8 @@
 	rate = alpha_pll_round_rate(rate, prate, &l, &a, ALPHA_REG_BITWIDTH);
 
 	regmap_write(pll->clkr.regmap, PLL_L_VAL(pll), l);
+
+	a <<= ALPHA_REG_BITWIDTH - ALPHA_BITWIDTH;
 	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL(pll), a);
 	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL_U(pll),
 		     a >> ALPHA_BITWIDTH);
@@ -2538,6 +2620,9 @@
 	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL_U(pll),
 					a >> ALPHA_BITWIDTH);
 
+	regmap_update_bits(pll->clkr.regmap, PLL_USER_CTL(pll),
+			   PLL_ALPHA_EN, PLL_ALPHA_EN);
+
 	regmap_write(pll->clkr.regmap, PLL_MODE(pll), PLL_BYPASSNL);
 
 	/* Wait five micro seconds or more */
@@ -2571,3 +2656,173 @@
 	.set_rate = clk_alpha_pll_stromer_plus_set_rate,
 };
 EXPORT_SYMBOL_GPL(clk_alpha_pll_stromer_plus_ops);
+
+static int clk_alpha_pll_slew_update(struct clk_alpha_pll *pll)
+{
+	int ret;
+	u32 val;
+
+	regmap_update_bits(pll->clkr.regmap, PLL_MODE(pll), PLL_UPDATE, PLL_UPDATE);
+	regmap_read(pll->clkr.regmap, PLL_MODE(pll), &val);
+
+	ret = wait_for_pll_update(pll);
+	if (ret)
+		return ret;
+	/*
+	 * Hardware programming mandates a wait of at least 570ns before polling the LOCK
+	 * detect bit. Have a delay of 1us just to be safe.
+	 */
+	mb();
+	udelay(1);
+
+	return wait_for_pll_enable_lock(pll);
+}
+
+static int clk_alpha_pll_slew_set_rate(struct clk_hw *hw, unsigned long rate,
+					unsigned long parent_rate)
+{
+	struct clk_alpha_pll *pll = to_clk_alpha_pll(hw);
+	unsigned long freq_hz;
+	const struct pll_vco *curr_vco, *vco;
+	u32 l, alpha_width = pll_alpha_width(pll);
+	u64 a;
+
+	freq_hz =  alpha_pll_round_rate(rate, parent_rate, &l, &a, alpha_width);
+	if (freq_hz != rate) {
+		pr_err("alpha_pll: Call clk_set_rate with rounded rates!\n");
+		return -EINVAL;
+	}
+
+	curr_vco = alpha_pll_find_vco(pll, clk_hw_get_rate(hw));
+	if (!curr_vco) {
+		pr_err("alpha pll: not in a valid vco range\n");
+		return -EINVAL;
+	}
+
+	vco = alpha_pll_find_vco(pll, freq_hz);
+	if (!vco) {
+		pr_err("alpha pll: not in a valid vco range\n");
+		return -EINVAL;
+	}
+
+	/*
+	 * Dynamic pll update will not support switching frequencies across
+	 * vco ranges. In those cases fall back to normal alpha set rate.
+	 */
+	if (curr_vco->val != vco->val)
+		return clk_alpha_pll_set_rate(hw, rate, parent_rate);
+
+	a = a << (ALPHA_REG_BITWIDTH - ALPHA_BITWIDTH);
+
+	regmap_write(pll->clkr.regmap, PLL_L_VAL(pll), l);
+	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL(pll), a);
+	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL_U(pll), a >> 32);
+
+	/* Ensure that the write above goes through before proceeding. */
+	mb();
+
+	if (clk_hw_is_enabled(hw))
+		return clk_alpha_pll_slew_update(pll);
+
+	return 0;
+}
+
+/*
+ * Slewing plls should be bought up at frequency which is in the middle of the
+ * desired VCO range. So after bringing up the pll at calibration freq, set it
+ * back to desired frequency(that was set by previous clk_set_rate).
+ */
+static int clk_alpha_pll_calibrate(struct clk_hw *hw)
+{
+	unsigned long calibration_freq, freq_hz;
+	struct clk_alpha_pll *pll = to_clk_alpha_pll(hw);
+	struct clk_hw *parent;
+	const struct pll_vco *vco;
+	u32 l, alpha_width = pll_alpha_width(pll);
+	int rc;
+	u64 a;
+
+	parent = clk_hw_get_parent(hw);
+	if (!parent) {
+		pr_err("alpha pll: no valid parent found\n");
+		return -EINVAL;
+	}
+
+	vco = alpha_pll_find_vco(pll, clk_hw_get_rate(hw));
+	if (!vco) {
+		pr_err("alpha pll: not in a valid vco range\n");
+		return -EINVAL;
+	}
+
+	/*
+	 * As during slewing plls vco_sel won't be allowed to change, vco table
+	 * should have only one entry table, i.e. index = 0, find the
+	 * calibration frequency.
+	 */
+	calibration_freq = (pll->vco_table[0].min_freq + pll->vco_table[0].max_freq) / 2;
+
+	freq_hz = alpha_pll_round_rate(calibration_freq, clk_hw_get_rate(parent),
+					&l, &a, alpha_width);
+	if (freq_hz != calibration_freq) {
+		pr_err("alpha_pll: call clk_set_rate with rounded rates!\n");
+		return -EINVAL;
+	}
+
+	/* Setup PLL for calibration frequency */
+	a <<= (ALPHA_REG_BITWIDTH - ALPHA_BITWIDTH);
+
+	regmap_write(pll->clkr.regmap, PLL_L_VAL(pll), l);
+	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL(pll), a);
+	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL_U(pll), a >> 32);
+
+	regmap_update_bits(pll->clkr.regmap, PLL_USER_CTL(pll), PLL_VCO_MASK << PLL_VCO_SHIFT,
+				vco->val << PLL_VCO_SHIFT);
+
+	/* Bringup the pll at calibration frequency */
+	rc = clk_alpha_pll_enable(hw);
+	if (rc) {
+		pr_err("alpha pll calibration failed\n");
+		return rc;
+	}
+
+	/*
+	 * PLL is already running at calibration frequency.
+	 * So slew pll to the previously set frequency.
+	 */
+	freq_hz = alpha_pll_round_rate(clk_hw_get_rate(hw),
+			clk_hw_get_rate(parent), &l, &a, alpha_width);
+
+	pr_debug("pll %s: setting back to required rate %lu, freq_hz %ld\n",
+		clk_hw_get_name(hw), clk_hw_get_rate(hw), freq_hz);
+
+	/* Setup the PLL for the new frequency */
+	a <<= (ALPHA_REG_BITWIDTH - ALPHA_BITWIDTH);
+
+	regmap_write(pll->clkr.regmap, PLL_L_VAL(pll), l);
+	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL(pll), a);
+	regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL_U(pll), a >> 32);
+
+	regmap_update_bits(pll->clkr.regmap, PLL_USER_CTL(pll), PLL_ALPHA_EN, PLL_ALPHA_EN);
+
+	return clk_alpha_pll_slew_update(pll);
+}
+
+static int clk_alpha_pll_slew_enable(struct clk_hw *hw)
+{
+	int rc;
+
+	rc = clk_alpha_pll_calibrate(hw);
+	if (rc)
+		return rc;
+
+	return clk_alpha_pll_enable(hw);
+}
+
+const struct clk_ops clk_alpha_pll_slew_ops = {
+	.enable = clk_alpha_pll_slew_enable,
+	.disable = clk_alpha_pll_disable,
+	.recalc_rate = clk_alpha_pll_recalc_rate,
+	.round_rate = clk_alpha_pll_round_rate,
+	.set_rate = clk_alpha_pll_slew_set_rate,
+};
+EXPORT_SYMBOL_GPL(clk_alpha_pll_slew_ops);
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/clk-alpha-pll.h
+++ linux-qcom-6.8.0/drivers/clk/qcom/clk-alpha-pll.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (c) 2015, 2018, 2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 
@@ -21,6 +21,7 @@
 	CLK_ALPHA_PLL_TYPE_LUCID = CLK_ALPHA_PLL_TYPE_TRION,
 	CLK_ALPHA_PLL_TYPE_AGERA,
 	CLK_ALPHA_PLL_TYPE_ZONDA,
+	CLK_ALPHA_PLL_TYPE_ZONDA_OLE,
 	CLK_ALPHA_PLL_TYPE_LUCID_EVO,
 	CLK_ALPHA_PLL_TYPE_LUCID_OLE,
 	CLK_ALPHA_PLL_TYPE_RIVIAN_EVO,
@@ -28,6 +29,7 @@
 	CLK_ALPHA_PLL_TYPE_BRAMMO_EVO,
 	CLK_ALPHA_PLL_TYPE_STROMER,
 	CLK_ALPHA_PLL_TYPE_STROMER_PLUS,
+	CLK_ALPHA_PLL_TYPE_NSS_HUAYRA,
 	CLK_ALPHA_PLL_TYPE_MAX,
 };
 
@@ -42,6 +44,7 @@
 	PLL_OFF_CONFIG_CTL,
 	PLL_OFF_CONFIG_CTL_U,
 	PLL_OFF_CONFIG_CTL_U1,
+	PLL_OFF_CONFIG_CTL_U2,
 	PLL_OFF_TEST_CTL,
 	PLL_OFF_TEST_CTL_U,
 	PLL_OFF_TEST_CTL_U1,
@@ -119,6 +122,7 @@
 	u32 config_ctl_val;
 	u32 config_ctl_hi_val;
 	u32 config_ctl_hi1_val;
+	u32 config_ctl_hi2_val;
 	u32 user_ctl_val;
 	u32 user_ctl_hi_val;
 	u32 user_ctl_hi1_val;
@@ -173,6 +177,7 @@
 
 extern const struct clk_ops clk_alpha_pll_zonda_ops;
 #define clk_alpha_pll_postdiv_zonda_ops clk_alpha_pll_postdiv_fabia_ops
+#define clk_alpha_pll_zonda_ole_ops clk_alpha_pll_zonda_ops
 
 extern const struct clk_ops clk_alpha_pll_lucid_evo_ops;
 extern const struct clk_ops clk_alpha_pll_reset_lucid_evo_ops;
@@ -185,6 +190,8 @@
 extern const struct clk_ops clk_alpha_pll_rivian_evo_ops;
 #define clk_alpha_pll_postdiv_rivian_evo_ops clk_alpha_pll_postdiv_fabia_ops
 
+extern const struct clk_ops clk_alpha_pll_slew_ops;
+
 void clk_alpha_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
 			     const struct alpha_pll_config *config);
 void clk_fabia_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
@@ -198,6 +205,8 @@
 
 void clk_zonda_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
 			     const struct alpha_pll_config *config);
+void clk_lucid_5lpe_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
+				  const struct alpha_pll_config *config);
 void clk_lucid_evo_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
 				 const struct alpha_pll_config *config);
 void clk_lucid_ole_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/clk-branch.h
+++ linux-qcom-6.8.0/drivers/clk/qcom/clk-branch.h
@@ -64,6 +64,7 @@
 #define CBCR_FORCE_MEM_PERIPH_OFF	BIT(12)
 #define CBCR_WAKEUP			GENMASK(11, 8)
 #define CBCR_SLEEP			GENMASK(7, 4)
+#define CBCR_CLOCK_ENABLE		BIT(0)
 
 static inline void qcom_branch_set_force_mem_core(struct regmap *regmap,
 						  struct clk_branch clk, bool on)
@@ -98,6 +99,11 @@
 			   FIELD_PREP(CBCR_SLEEP, val));
 }
 
+static inline void qcom_branch_set_clk_en(struct regmap *regmap, u32 cbcr)
+{
+	regmap_update_bits(regmap, cbcr, CBCR_CLOCK_ENABLE, CBCR_CLOCK_ENABLE);
+}
+
 extern const struct clk_ops clk_branch_ops;
 extern const struct clk_ops clk_branch2_ops;
 extern const struct clk_ops clk_branch_simple_ops;
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/clk-rcg.h
+++ linux-qcom-6.8.0/drivers/clk/qcom/clk-rcg.h
@@ -176,6 +176,8 @@
 extern const struct clk_ops clk_pixel_ops;
 extern const struct clk_ops clk_gfx3d_ops;
 extern const struct clk_ops clk_rcg2_shared_ops;
+extern const struct clk_ops clk_rcg2_shared_floor_ops;
+extern const struct clk_ops clk_rcg2_shared_no_init_park_ops;
 extern const struct clk_ops clk_dp_ops;
 
 struct clk_rcg_dfs_data {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/clk-rcg2.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/clk-rcg2.c
@@ -1020,15 +1020,23 @@
 	return clk_rcg2_clear_force_enable(hw);
 }
 
-static int clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
-				    unsigned long parent_rate)
+static int __clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
+				      unsigned long parent_rate,
+				      enum freq_policy policy)
 {
 	struct clk_rcg2 *rcg = to_clk_rcg2(hw);
 	const struct freq_tbl *f;
 
-	f = qcom_find_freq(rcg->freq_tbl, rate);
-	if (!f)
+	switch (policy) {
+	case FLOOR:
+		f = qcom_find_freq_floor(rcg->freq_tbl, rate);
+		break;
+	case CEIL:
+		f = qcom_find_freq(rcg->freq_tbl, rate);
+		break;
+	default:
 		return -EINVAL;
+	}
 
 	/*
 	 * In case clock is disabled, update the M, N and D registers, cache
@@ -1041,10 +1049,28 @@
 	return clk_rcg2_shared_force_enable_clear(hw, f);
 }
 
+static int clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
+				    unsigned long parent_rate)
+{
+	return __clk_rcg2_shared_set_rate(hw, rate, parent_rate, CEIL);
+}
+
 static int clk_rcg2_shared_set_rate_and_parent(struct clk_hw *hw,
 		unsigned long rate, unsigned long parent_rate, u8 index)
 {
-	return clk_rcg2_shared_set_rate(hw, rate, parent_rate);
+	return __clk_rcg2_shared_set_rate(hw, rate, parent_rate, CEIL);
+}
+
+static int clk_rcg2_shared_set_floor_rate(struct clk_hw *hw, unsigned long rate,
+					  unsigned long parent_rate)
+{
+	return __clk_rcg2_shared_set_rate(hw, rate, parent_rate, FLOOR);
+}
+
+static int clk_rcg2_shared_set_floor_rate_and_parent(struct clk_hw *hw,
+		unsigned long rate, unsigned long parent_rate, u8 index)
+{
+	return __clk_rcg2_shared_set_rate(hw, rate, parent_rate, FLOOR);
 }
 
 static int clk_rcg2_shared_enable(struct clk_hw *hw)
@@ -1138,7 +1164,39 @@
 	return clk_rcg2_recalc_rate(hw, parent_rate);
 }
 
+static int clk_rcg2_shared_init(struct clk_hw *hw)
+{
+	/*
+	 * This does a few things:
+	 *
+	 *  1. Sets rcg->parked_cfg to reflect the value at probe so that the
+	 *     proper parent is reported from clk_rcg2_shared_get_parent().
+	 *
+	 *  2. Clears the force enable bit of the RCG because we rely on child
+	 *     clks (branches) to turn the RCG on/off with a hardware feedback
+	 *     mechanism and only set the force enable bit in the RCG when we
+	 *     want to make sure the clk stays on for parent switches or
+	 *     parking.
+	 *
+	 *  3. Parks shared RCGs on the safe source at registration because we
+	 *     can't be certain that the parent clk will stay on during boot,
+	 *     especially if the parent is shared. If this RCG is enabled at
+	 *     boot, and the parent is turned off, the RCG will get stuck on. A
+	 *     GDSC can wedge if is turned on and the RCG is stuck on because
+	 *     the GDSC's controller will hang waiting for the clk status to
+	 *     toggle on when it never does.
+	 *
+	 * The safest option here is to "park" the RCG at init so that the clk
+	 * can never get stuck on or off. This ensures the GDSC can't get
+	 * wedged.
+	 */
+	clk_rcg2_shared_disable(hw);
+
+	return 0;
+}
+
 const struct clk_ops clk_rcg2_shared_ops = {
+	.init = clk_rcg2_shared_init,
 	.enable = clk_rcg2_shared_enable,
 	.disable = clk_rcg2_shared_disable,
 	.get_parent = clk_rcg2_shared_get_parent,
@@ -1150,6 +1208,48 @@
 };
 EXPORT_SYMBOL_GPL(clk_rcg2_shared_ops);
 
+const struct clk_ops clk_rcg2_shared_floor_ops = {
+	.enable = clk_rcg2_shared_enable,
+	.disable = clk_rcg2_shared_disable,
+	.get_parent = clk_rcg2_shared_get_parent,
+	.set_parent = clk_rcg2_shared_set_parent,
+	.recalc_rate = clk_rcg2_shared_recalc_rate,
+	.determine_rate = clk_rcg2_determine_floor_rate,
+	.set_rate = clk_rcg2_shared_set_floor_rate,
+	.set_rate_and_parent = clk_rcg2_shared_set_floor_rate_and_parent,
+};
+EXPORT_SYMBOL_GPL(clk_rcg2_shared_floor_ops);
+
+static int clk_rcg2_shared_no_init_park(struct clk_hw *hw)
+{
+	struct clk_rcg2 *rcg = to_clk_rcg2(hw);
+
+	/*
+	 * Read the config register so that the parent is properly mapped at
+	 * registration time.
+	 */
+	regmap_read(rcg->clkr.regmap, rcg->cmd_rcgr + CFG_REG, &rcg->parked_cfg);
+
+	return 0;
+}
+
+/*
+ * Like clk_rcg2_shared_ops but skip the init so that the clk frequency is left
+ * unchanged at registration time.
+ */
+const struct clk_ops clk_rcg2_shared_no_init_park_ops = {
+	.init = clk_rcg2_shared_no_init_park,
+	.enable = clk_rcg2_shared_enable,
+	.disable = clk_rcg2_shared_disable,
+	.get_parent = clk_rcg2_shared_get_parent,
+	.set_parent = clk_rcg2_shared_set_parent,
+	.recalc_rate = clk_rcg2_shared_recalc_rate,
+	.determine_rate = clk_rcg2_determine_rate,
+	.set_rate = clk_rcg2_shared_set_rate,
+	.set_rate_and_parent = clk_rcg2_shared_set_rate_and_parent,
+};
+EXPORT_SYMBOL_GPL(clk_rcg2_shared_no_init_park_ops);
+
 /* Common APIs to be used for DFS based RCGR */
 static void clk_rcg2_dfs_populate_freq(struct clk_hw *hw, unsigned int l,
 				       struct freq_tbl *f)
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/clk-rpmh.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/clk-rpmh.c
@@ -263,6 +263,8 @@
 		cmd_state = 0;
 	}
 
+	cmd_state = min(cmd_state, BCM_TCS_CMD_VOTE_MASK);
+
 	if (c->last_sent_aggr_state != cmd_state) {
 		cmd.addr = c->res_addr;
 		cmd.data = BCM_TCS_CMD(1, enable, 0, cmd_state);
@@ -387,6 +389,18 @@
 DEFINE_CLK_RPMH_BCM(pka, "PKA0");
 DEFINE_CLK_RPMH_BCM(qpic_clk, "QP0");
 
+static struct clk_hw *sar2130p_rpmh_clocks[] = {
+	[RPMH_CXO_CLK]		= &clk_rpmh_bi_tcxo_div1.hw,
+	[RPMH_CXO_CLK_A]	= &clk_rpmh_bi_tcxo_div1_ao.hw,
+	[RPMH_RF_CLK1]		= &clk_rpmh_rf_clk1_a.hw,
+	[RPMH_RF_CLK1_A]	= &clk_rpmh_rf_clk1_a_ao.hw,
+};
+
+static const struct clk_rpmh_desc clk_rpmh_sar2130p = {
+	.clks = sar2130p_rpmh_clocks,
+	.num_clks = ARRAY_SIZE(sar2130p_rpmh_clocks),
+};
+
 static struct clk_hw *sdm845_rpmh_clocks[] = {
 	[RPMH_CXO_CLK]		= &clk_rpmh_bi_tcxo_div2.hw,
 	[RPMH_CXO_CLK_A]	= &clk_rpmh_bi_tcxo_div2_ao.hw,
@@ -793,6 +807,24 @@
 	.num_clks = ARRAY_SIZE(x1e80100_rpmh_clocks),
 };
 
+static struct clk_hw *qcs615_rpmh_clocks[] = {
+	[RPMH_CXO_CLK]		= &clk_rpmh_bi_tcxo_div2.hw,
+	[RPMH_CXO_CLK_A]	= &clk_rpmh_bi_tcxo_div2_ao.hw,
+	[RPMH_LN_BB_CLK2]	= &clk_rpmh_ln_bb_clk2_a2.hw,
+	[RPMH_LN_BB_CLK2_A]	= &clk_rpmh_ln_bb_clk2_a2_ao.hw,
+	[RPMH_LN_BB_CLK3]	= &clk_rpmh_ln_bb_clk3_a2.hw,
+	[RPMH_LN_BB_CLK3_A]	= &clk_rpmh_ln_bb_clk3_a2_ao.hw,
+	[RPMH_RF_CLK1]		= &clk_rpmh_rf_clk1_a.hw,
+	[RPMH_RF_CLK1_A]	= &clk_rpmh_rf_clk1_a_ao.hw,
+	[RPMH_RF_CLK2]		= &clk_rpmh_rf_clk2_a.hw,
+	[RPMH_RF_CLK2_A]	= &clk_rpmh_rf_clk2_a_ao.hw,
+};
+
+static const struct clk_rpmh_desc clk_rpmh_qcs615 = {
+	.clks = qcs615_rpmh_clocks,
+	.num_clks = ARRAY_SIZE(qcs615_rpmh_clocks),
+};
+
 static struct clk_hw *of_clk_rpmh_hw_get(struct of_phandle_args *clkspec,
 					 void *data)
 {
@@ -876,8 +908,10 @@
 }
 
 static const struct of_device_id clk_rpmh_match_table[] = {
+	{ .compatible = "qcom,qcs615-rpmh-clk", .data = &clk_rpmh_qcs615},
 	{ .compatible = "qcom,qdu1000-rpmh-clk", .data = &clk_rpmh_qdu1000},
 	{ .compatible = "qcom,sa8775p-rpmh-clk", .data = &clk_rpmh_sa8775p},
+	{ .compatible = "qcom,sar2130p-rpmh-clk", .data = &clk_rpmh_sar2130p},
 	{ .compatible = "qcom,sc7180-rpmh-clk", .data = &clk_rpmh_sc7180},
 	{ .compatible = "qcom,sc8180x-rpmh-clk", .data = &clk_rpmh_sc8180x},
 	{ .compatible = "qcom,sc8280xp-rpmh-clk", .data = &clk_rpmh_sc8280xp},
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/clk-smd-rpm.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/clk-smd-rpm.c
@@ -768,6 +768,7 @@
 
 static const struct rpm_smd_clk_desc rpm_clk_msm8976 = {
 	.clks = msm8976_clks,
+	.num_clks = ARRAY_SIZE(msm8976_clks),
 	.icc_clks = bimc_pcnoc_snoc_smmnoc_icc_clks,
 	.num_icc_clks = ARRAY_SIZE(bimc_pcnoc_snoc_smmnoc_icc_clks),
 };
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/common.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/common.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/export.h>
@@ -234,11 +235,10 @@
 	return cc->rclks[idx] ? &cc->rclks[idx]->hw : NULL;
 }
 
-int qcom_cc_really_probe(struct platform_device *pdev,
+int qcom_cc_really_probe(struct device *dev,
 			 const struct qcom_cc_desc *desc, struct regmap *regmap)
 {
 	int i, ret;
-	struct device *dev = &pdev->dev;
 	struct qcom_reset_controller *reset;
 	struct qcom_cc *cc;
 	struct gdsc_desc *scd;
@@ -270,6 +270,7 @@
 		scd->dev = dev;
 		scd->scs = desc->gdscs;
 		scd->num = desc->num_gdscs;
+		scd->pmdomains = desc->pmdomains;
 		ret = gdsc_register(scd, &reset->rcdev, regmap);
 		if (ret)
 			return ret;
@@ -315,7 +316,7 @@
 	if (IS_ERR(regmap))
 		return PTR_ERR(regmap);
 
-	return qcom_cc_really_probe(pdev, desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, desc, regmap);
 }
 EXPORT_SYMBOL_GPL(qcom_cc_probe);
 
@@ -333,8 +334,27 @@
 	if (IS_ERR(regmap))
 		return PTR_ERR(regmap);
 
-	return qcom_cc_really_probe(pdev, desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, desc, regmap);
 }
 EXPORT_SYMBOL_GPL(qcom_cc_probe_by_index);
 
+static void qcom_cc_detach_pds(void *data)
+{
+	struct qcom_cc_desc *desc = (struct qcom_cc_desc *)data;
+
+	dev_pm_domain_detach_list(desc->pmdomains);
+}
+
+int qcom_cc_attach_pds(struct device *dev, struct qcom_cc_desc *desc)
+{
+	int ret;
+
+	ret = dev_pm_domain_attach_list(dev, NULL, &desc->pmdomains);
+	if (ret < 0 && ret != -EEXIST)
+		return ret;
+
+	return devm_add_action_or_reset(dev, qcom_cc_detach_pds, desc);
+}
+EXPORT_SYMBOL_GPL(qcom_cc_attach_pds);
+
 MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/common.h
+++ linux-qcom-6.8.0/drivers/clk/qcom/common.h
@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /* Copyright (c) 2014, The Linux Foundation. All rights reserved. */
+/* Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. */
 
 #ifndef __QCOM_CLK_COMMON_H__
 #define __QCOM_CLK_COMMON_H__
@@ -29,6 +30,7 @@
 	size_t num_gdscs;
 	struct clk_hw **clk_hws;
 	size_t num_clk_hws;
+	struct dev_pm_domain_list *pmdomains;
 };
 
 /**
@@ -58,12 +60,13 @@
 
 extern struct regmap *qcom_cc_map(struct platform_device *pdev,
 				  const struct qcom_cc_desc *desc);
-extern int qcom_cc_really_probe(struct platform_device *pdev,
+extern int qcom_cc_really_probe(struct device *dev,
 				const struct qcom_cc_desc *desc,
 				struct regmap *regmap);
 extern int qcom_cc_probe(struct platform_device *pdev,
 			 const struct qcom_cc_desc *desc);
 extern int qcom_cc_probe_by_index(struct platform_device *pdev, int index,
 				  const struct qcom_cc_desc *desc);
+extern int qcom_cc_attach_pds(struct device *dev, struct qcom_cc_desc *desc);
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-qcm2290.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-qcm2290.c
@@ -522,7 +522,7 @@
 	/* Keep DISP_CC_XO_CLK always-ON */
 	regmap_update_bits(regmap, 0x604c, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &disp_cc_qcm2290_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &disp_cc_qcm2290_desc, regmap);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register DISP CC clocks\n");
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-qcs615.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-qcs615.c
@@ -0,0 +1,786 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,qcs615-dispcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_GPLL0,
+	DT_DSI0_PHY_PLL_OUT_BYTECLK,
+	DT_DSI0_PHY_PLL_OUT_DSICLK,
+	DT_DSI1_PHY_PLL_OUT_DSICLK,
+	DT_DP_PHY_PLL_LINK_CLK,
+	DT_DP_PHY_PLL_VCO_DIV_CLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_DISP_CC_PLL0_OUT_MAIN,
+	P_DP_PHY_PLL_LINK_CLK,
+	P_DP_PHY_PLL_VCO_DIV_CLK,
+	P_DSI0_PHY_PLL_OUT_BYTECLK,
+	P_DSI0_PHY_PLL_OUT_DSICLK,
+	P_DSI1_PHY_PLL_OUT_DSICLK,
+	P_GPLL0_OUT_MAIN,
+};
+
+static const struct pll_vco disp_cc_pll_vco[] = {
+	{ 500000000, 1000000000, 2 },
+};
+
+/* 576MHz configuration VCO - 2 */
+static struct alpha_pll_config disp_cc_pll0_config = {
+	.l = 0x1e,
+	.vco_val = BIT(21),
+	.vco_mask = GENMASK(21, 20),
+	.main_output_mask = BIT(0),
+	.config_ctl_val = 0x4001055b,
+	.test_ctl_hi_val = 0x1,
+	.test_ctl_hi_mask = 0x1,
+};
+
+static struct clk_alpha_pll disp_cc_pll0 = {
+	.offset = 0x0,
+	.vco_table = disp_cc_pll_vco,
+	.num_vco = ARRAY_SIZE(disp_cc_pll_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_slew_ops,
+		},
+	},
+};
+
+static const struct parent_map disp_cc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DP_PHY_PLL_LINK_CLK, 1 },
+	{ P_DP_PHY_PLL_VCO_DIV_CLK, 2 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DP_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP_PHY_PLL_VCO_DIV_CLK },
+};
+
+static const struct parent_map disp_cc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct parent_map disp_cc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 1 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_BYTECLK },
+};
+
+static const struct parent_map disp_cc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DISP_CC_PLL0_OUT_MAIN, 1 },
+	{ P_GPLL0_OUT_MAIN, 4 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &disp_cc_pll0.clkr.hw },
+	{ .index = DT_GPLL0 },
+};
+
+static const struct parent_map disp_cc_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 4 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_GPLL0 },
+};
+
+static const struct parent_map disp_cc_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_DSICLK, 1 },
+	{ P_DSI1_PHY_PLL_OUT_DSICLK, 2 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_DSICLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_DSICLK },
+};
+
+static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0),
+	F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 disp_cc_mdss_ahb_clk_src = {
+	.cmd_rcgr = 0x2170,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_4,
+	.freq_tbl = ftbl_disp_cc_mdss_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_ahb_clk_src",
+		.parent_data = disp_cc_parent_data_4,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_4),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_byte0_clk_src = {
+	.cmd_rcgr = 0x20c0,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_2,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_byte0_clk_src",
+		.parent_data = disp_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_disp_cc_mdss_dp_aux1_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 disp_cc_mdss_dp_aux_clk_src = {
+	.cmd_rcgr = 0x2158,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_1,
+	.freq_tbl = ftbl_disp_cc_mdss_dp_aux1_clk_src,
+	.clkr.hw.init = &(struct clk_init_data){
+		.name = "disp_cc_mdss_dp_aux_clk_src",
+		.parent_data = disp_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_1),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dp_crypto_clk_src = {
+	.cmd_rcgr = 0x2110,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dp_crypto_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dp_link_clk_src = {
+	.cmd_rcgr = 0x20f4,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dp_link_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dp_pixel1_clk_src = {
+	.cmd_rcgr = 0x2140,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dp_pixel1_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dp_pixel_clk_src = {
+	.cmd_rcgr = 0x2128,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dp_pixel_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_esc0_clk_src = {
+	.cmd_rcgr = 0x20dc,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_2,
+	.freq_tbl = ftbl_disp_cc_mdss_dp_aux1_clk_src,
+	.clkr.hw.init = &(struct clk_init_data){
+		.name = "disp_cc_mdss_esc0_clk_src",
+		.parent_data = disp_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_disp_cc_mdss_mdp_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(192000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(256000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(307000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 disp_cc_mdss_mdp_clk_src = {
+	.cmd_rcgr = 0x2078,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_3,
+	.freq_tbl = ftbl_disp_cc_mdss_mdp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_mdp_clk_src",
+		.parent_data = disp_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_pclk0_clk_src = {
+	.cmd_rcgr = 0x2060,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_5,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_pclk0_clk_src",
+		.parent_data = disp_cc_parent_data_5,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_5),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_pixel_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_rot_clk_src = {
+	.cmd_rcgr = 0x2090,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_3,
+	.freq_tbl = ftbl_disp_cc_mdss_mdp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_rot_clk_src",
+		.parent_data = disp_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_vsync_clk_src = {
+	.cmd_rcgr = 0x20a8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_1,
+	.freq_tbl = ftbl_disp_cc_mdss_dp_aux1_clk_src,
+	.clkr.hw.init = &(struct clk_init_data){
+		.name = "disp_cc_mdss_vsync_clk_src",
+		.parent_data = disp_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_1),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = {
+	.reg = 0x20d8,
+	.shift = 0,
+	.width = 2,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_byte0_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&disp_cc_mdss_byte0_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div disp_cc_mdss_dp_link_div_clk_src = {
+	.reg = 0x210c,
+	.shift = 0,
+	.width = 2,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dp_link_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&disp_cc_mdss_dp_link_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_branch disp_cc_mdss_ahb_clk = {
+	.halt_reg = 0x2048,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2048,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_byte0_clk = {
+	.halt_reg = 0x2024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_byte0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_byte0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_byte0_intf_clk = {
+	.halt_reg = 0x2028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_byte0_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_byte0_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dp_aux_clk = {
+	.halt_reg = 0x2044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dp_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dp_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dp_crypto_clk = {
+	.halt_reg = 0x2038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dp_crypto_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dp_crypto_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dp_link_clk = {
+	.halt_reg = 0x2030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dp_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dp_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dp_link_intf_clk = {
+	.halt_reg = 0x2034,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2034,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dp_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dp_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dp_pixel1_clk = {
+	.halt_reg = 0x2040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dp_pixel1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dp_pixel1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dp_pixel_clk = {
+	.halt_reg = 0x203c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x203c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dp_pixel_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dp_pixel_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_esc0_clk = {
+	.halt_reg = 0x202c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x202c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_esc0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_esc0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_mdp_clk = {
+	.halt_reg = 0x2008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_mdp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_mdp_lut_clk = {
+	.halt_reg = 0x2018,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_mdp_lut_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_non_gdsc_ahb_clk = {
+	.halt_reg = 0x4004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_non_gdsc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_pclk0_clk = {
+	.halt_reg = 0x2004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_pclk0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_pclk0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_rot_clk = {
+	.halt_reg = 0x2010,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_rot_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_rot_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_rscc_ahb_clk = {
+	.halt_reg = 0x400c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x400c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_rscc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_rscc_vsync_clk = {
+	.halt_reg = 0x4008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x4008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_rscc_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_vsync_clk = {
+	.halt_reg = 0x2020,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc mdss_core_gdsc = {
+	.gdscr = 0x3000,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "mdss_core_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = HW_CTRL | POLL_CFG_GDSCR,
+};
+
+static struct clk_regmap *disp_cc_qcs615_clocks[] = {
+	[DISP_CC_MDSS_AHB_CLK] = &disp_cc_mdss_ahb_clk.clkr,
+	[DISP_CC_MDSS_AHB_CLK_SRC] = &disp_cc_mdss_ahb_clk_src.clkr,
+	[DISP_CC_MDSS_BYTE0_CLK] = &disp_cc_mdss_byte0_clk.clkr,
+	[DISP_CC_MDSS_BYTE0_CLK_SRC] = &disp_cc_mdss_byte0_clk_src.clkr,
+	[DISP_CC_MDSS_BYTE0_DIV_CLK_SRC] = &disp_cc_mdss_byte0_div_clk_src.clkr,
+	[DISP_CC_MDSS_BYTE0_INTF_CLK] = &disp_cc_mdss_byte0_intf_clk.clkr,
+	[DISP_CC_MDSS_DP_AUX_CLK] = &disp_cc_mdss_dp_aux_clk.clkr,
+	[DISP_CC_MDSS_DP_AUX_CLK_SRC] = &disp_cc_mdss_dp_aux_clk_src.clkr,
+	[DISP_CC_MDSS_DP_CRYPTO_CLK] = &disp_cc_mdss_dp_crypto_clk.clkr,
+	[DISP_CC_MDSS_DP_CRYPTO_CLK_SRC] = &disp_cc_mdss_dp_crypto_clk_src.clkr,
+	[DISP_CC_MDSS_DP_LINK_CLK] = &disp_cc_mdss_dp_link_clk.clkr,
+	[DISP_CC_MDSS_DP_LINK_CLK_SRC] = &disp_cc_mdss_dp_link_clk_src.clkr,
+	[DISP_CC_MDSS_DP_LINK_DIV_CLK_SRC] = &disp_cc_mdss_dp_link_div_clk_src.clkr,
+	[DISP_CC_MDSS_DP_LINK_INTF_CLK] = &disp_cc_mdss_dp_link_intf_clk.clkr,
+	[DISP_CC_MDSS_DP_PIXEL1_CLK] = &disp_cc_mdss_dp_pixel1_clk.clkr,
+	[DISP_CC_MDSS_DP_PIXEL1_CLK_SRC] = &disp_cc_mdss_dp_pixel1_clk_src.clkr,
+	[DISP_CC_MDSS_DP_PIXEL_CLK] = &disp_cc_mdss_dp_pixel_clk.clkr,
+	[DISP_CC_MDSS_DP_PIXEL_CLK_SRC] = &disp_cc_mdss_dp_pixel_clk_src.clkr,
+	[DISP_CC_MDSS_ESC0_CLK] = &disp_cc_mdss_esc0_clk.clkr,
+	[DISP_CC_MDSS_ESC0_CLK_SRC] = &disp_cc_mdss_esc0_clk_src.clkr,
+	[DISP_CC_MDSS_MDP_CLK] = &disp_cc_mdss_mdp_clk.clkr,
+	[DISP_CC_MDSS_MDP_CLK_SRC] = &disp_cc_mdss_mdp_clk_src.clkr,
+	[DISP_CC_MDSS_MDP_LUT_CLK] = &disp_cc_mdss_mdp_lut_clk.clkr,
+	[DISP_CC_MDSS_NON_GDSC_AHB_CLK] = &disp_cc_mdss_non_gdsc_ahb_clk.clkr,
+	[DISP_CC_MDSS_PCLK0_CLK] = &disp_cc_mdss_pclk0_clk.clkr,
+	[DISP_CC_MDSS_PCLK0_CLK_SRC] = &disp_cc_mdss_pclk0_clk_src.clkr,
+	[DISP_CC_MDSS_ROT_CLK] = &disp_cc_mdss_rot_clk.clkr,
+	[DISP_CC_MDSS_ROT_CLK_SRC] = &disp_cc_mdss_rot_clk_src.clkr,
+	[DISP_CC_MDSS_RSCC_AHB_CLK] = &disp_cc_mdss_rscc_ahb_clk.clkr,
+	[DISP_CC_MDSS_RSCC_VSYNC_CLK] = &disp_cc_mdss_rscc_vsync_clk.clkr,
+	[DISP_CC_MDSS_VSYNC_CLK] = &disp_cc_mdss_vsync_clk.clkr,
+	[DISP_CC_MDSS_VSYNC_CLK_SRC] = &disp_cc_mdss_vsync_clk_src.clkr,
+	[DISP_CC_PLL0] = &disp_cc_pll0.clkr,
+};
+
+static struct gdsc *disp_cc_qcs615_gdscs[] = {
+	[MDSS_CORE_GDSC] = &mdss_core_gdsc,
+};
+
+static const struct regmap_config disp_cc_qcs615_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0x10000,
+	.fast_io = true,
+};
+
+static const struct qcom_cc_desc disp_cc_qcs615_desc = {
+	.config = &disp_cc_qcs615_regmap_config,
+	.clks = disp_cc_qcs615_clocks,
+	.num_clks = ARRAY_SIZE(disp_cc_qcs615_clocks),
+	.gdscs = disp_cc_qcs615_gdscs,
+	.num_gdscs = ARRAY_SIZE(disp_cc_qcs615_gdscs),
+};
+
+static const struct of_device_id disp_cc_qcs615_match_table[] = {
+	{ .compatible = "qcom,qcs615-dispcc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, disp_cc_qcs615_match_table);
+
+static int disp_cc_qcs615_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+
+	regmap = qcom_cc_map(pdev, &disp_cc_qcs615_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	clk_alpha_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
+
+	/* Keep some clocks always enabled */
+	regmap_update_bits(regmap, 0x6054, BIT(0), BIT(0)); /* DISP_CC_XO_CLK */
+
+	return qcom_cc_really_probe(&pdev->dev, &disp_cc_qcs615_desc, regmap);
+}
+
+static struct platform_driver disp_cc_qcs615_driver = {
+	.probe = disp_cc_qcs615_probe,
+	.driver = {
+		.name = "dispcc-qcs615",
+		.of_match_table = disp_cc_qcs615_match_table,
+	},
+};
+
+module_platform_driver(disp_cc_qcs615_driver);
+
+MODULE_DESCRIPTION("QTI DISPCC QCS615 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sc7180.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sc7180.c
@@ -713,7 +713,7 @@
 
 	clk_fabia_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll_config);
 
-	return qcom_cc_really_probe(pdev, &disp_cc_sc7180_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &disp_cc_sc7180_desc, regmap);
 }
 
 static struct platform_driver disp_cc_sc7180_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sc7280.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sc7280.c
@@ -884,7 +884,7 @@
 	 */
 	regmap_update_bits(regmap, 0x5008, BIT(0), BIT(0));
 
-	return qcom_cc_really_probe(pdev, &disp_cc_sc7280_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &disp_cc_sc7280_desc, regmap);
 }
 
 static struct platform_driver disp_cc_sc7280_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sc8280xp.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sc8280xp.c
@@ -3172,7 +3172,7 @@
 	clk_lucid_pll_configure(clkr_to_alpha_clk_pll(desc->clks[DISP_CC_PLL1]), regmap, &disp_cc_pll1_config);
 	clk_lucid_pll_configure(clkr_to_alpha_clk_pll(desc->clks[DISP_CC_PLL2]), regmap, &disp_cc_pll2_config);
 
-	ret = qcom_cc_really_probe(pdev, desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, desc, regmap);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register display clock controller\n");
 		goto out_pm_runtime_put;
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sdm845.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sdm845.c
@@ -759,6 +759,8 @@
 
 static struct gdsc mdss_gdsc = {
 	.gdscr = 0x3000,
+	.en_few_wait_val = 0x6,
+	.en_rest_wait_val = 0x5,
 	.pd = {
 		.name = "mdss_gdsc",
 	},
@@ -861,7 +863,7 @@
 	/* Enable hardware clock gating for DSI and MDP clocks */
 	regmap_update_bits(regmap, 0x8000, 0x7f0, 0x7f0);
 
-	return qcom_cc_really_probe(pdev, &disp_cc_sdm845_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &disp_cc_sdm845_desc, regmap);
 }
 
 static struct platform_driver disp_cc_sdm845_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sm6115.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sm6115.c
@@ -586,7 +586,7 @@
 	/* Keep DISP_CC_XO_CLK always-ON */
 	regmap_update_bits(regmap, 0x604c, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &disp_cc_sm6115_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &disp_cc_sm6115_desc, regmap);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register DISP CC clocks\n");
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sm6125.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sm6125.c
@@ -682,7 +682,7 @@
 
 	clk_alpha_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
 
-	return qcom_cc_really_probe(pdev, &disp_cc_sm6125_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &disp_cc_sm6125_desc, regmap);
 }
 
 static struct platform_driver disp_cc_sm6125_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sm6350.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sm6350.c
@@ -221,26 +221,17 @@
 	},
 };
 
-static const struct freq_tbl ftbl_disp_cc_mdss_dp_link_clk_src[] = {
-	F(162000, P_DP_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(270000, P_DP_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(540000, P_DP_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(810000, P_DP_PHY_PLL_LINK_CLK, 1, 0, 0),
-	{ }
-};
-
 static struct clk_rcg2 disp_cc_mdss_dp_link_clk_src = {
 	.cmd_rcgr = 0x10f8,
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_0,
-	.freq_tbl = ftbl_disp_cc_mdss_dp_link_clk_src,
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "disp_cc_mdss_dp_link_clk_src",
 		.parent_data = disp_cc_parent_data_0,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT | CLK_GET_RATE_NOCACHE,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -770,7 +761,7 @@
 
 	clk_fabia_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
 
-	return qcom_cc_really_probe(pdev, &disp_cc_sm6350_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &disp_cc_sm6350_desc, regmap);
 }
 
 static struct platform_driver disp_cc_sm6350_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sm6375.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sm6375.c
@@ -583,7 +583,7 @@
 
 	clk_lucid_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
 
-	return qcom_cc_really_probe(pdev, &disp_cc_sm6375_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &disp_cc_sm6375_desc, regmap);
 }
 
 static struct platform_driver disp_cc_sm6375_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sm7150.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sm7150.c
@@ -0,0 +1,1006 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Danila Tikhonov <danila@jiaxyga.com>
+ * Copyright (c) 2024, David Wronek <david@mainlining.org>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,sm7150-dispcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "common.h"
+#include "gdsc.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+	DT_GCC_DISP_GPLL0_CLK,
+	DT_CHIP_SLEEP_CLK,
+	DT_DSI0_PHY_PLL_OUT_BYTECLK,
+	DT_DSI0_PHY_PLL_OUT_DSICLK,
+	DT_DSI1_PHY_PLL_OUT_BYTECLK,
+	DT_DSI1_PHY_PLL_OUT_DSICLK,
+	DT_DP_PHY_PLL_LINK_CLK,
+	DT_DP_PHY_PLL_VCO_DIV_CLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_CHIP_SLEEP_CLK,
+	P_DISPCC_PLL0_OUT_EVEN,
+	P_DISPCC_PLL0_OUT_MAIN,
+	P_DP_PHY_PLL_LINK_CLK,
+	P_DP_PHY_PLL_VCO_DIV_CLK,
+	P_DSI0_PHY_PLL_OUT_BYTECLK,
+	P_DSI0_PHY_PLL_OUT_DSICLK,
+	P_DSI1_PHY_PLL_OUT_BYTECLK,
+	P_DSI1_PHY_PLL_OUT_DSICLK,
+	P_GCC_DISP_GPLL0_CLK,
+};
+
+static const struct pll_vco fabia_vco[] = {
+	{ 249600000, 2000000000, 0 },
+	{ 125000000, 1000000000, 1 },
+};
+
+/* 860MHz configuration */
+static const struct alpha_pll_config dispcc_pll0_config = {
+	.l = 0x2c,
+	.alpha = 0xcaaa,
+	.test_ctl_val = 0x40000000,
+};
+
+static struct clk_alpha_pll dispcc_pll0 = {
+	.offset = 0x0,
+	.vco_table = fabia_vco,
+	.num_vco = ARRAY_SIZE(fabia_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fabia_ops,
+		},
+	},
+};
+
+static const struct parent_map dispcc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 1 },
+	{ P_DSI1_PHY_PLL_OUT_BYTECLK, 2 },
+};
+
+static const struct clk_parent_data dispcc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_BYTECLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_BYTECLK },
+};
+
+static const struct parent_map dispcc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DP_PHY_PLL_LINK_CLK, 1 },
+	{ P_DP_PHY_PLL_VCO_DIV_CLK, 2 },
+};
+
+static const struct clk_parent_data dispcc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DP_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP_PHY_PLL_VCO_DIV_CLK },
+};
+
+static const struct parent_map dispcc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data dispcc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct clk_parent_data dispcc_parent_data_2_ao[] = {
+	{ .index = DT_BI_TCXO_AO },
+};
+
+static const struct parent_map dispcc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DISPCC_PLL0_OUT_MAIN, 1 },
+	{ P_GCC_DISP_GPLL0_CLK, 4 },
+	{ P_DISPCC_PLL0_OUT_EVEN, 5 },
+};
+
+static const struct clk_parent_data dispcc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &dispcc_pll0.clkr.hw },
+	{ .index = DT_GCC_DISP_GPLL0_CLK },
+	{ .hw = &dispcc_pll0.clkr.hw },
+};
+
+static const struct parent_map dispcc_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_DSICLK, 1 },
+	{ P_DSI1_PHY_PLL_OUT_DSICLK, 2 },
+};
+
+static const struct clk_parent_data dispcc_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_DSICLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_DSICLK },
+};
+
+static const struct parent_map dispcc_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_DISP_GPLL0_CLK, 4 },
+};
+
+static const struct clk_parent_data dispcc_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_GCC_DISP_GPLL0_CLK },
+};
+
+static const struct parent_map dispcc_parent_map_6[] = {
+	{ P_CHIP_SLEEP_CLK, 0 },
+};
+
+static const struct clk_parent_data dispcc_parent_data_6[] = {
+	{ .index = DT_CHIP_SLEEP_CLK },
+};
+
+static const struct freq_tbl ftbl_dispcc_mdss_ahb_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(37500000, P_GCC_DISP_GPLL0_CLK, 16, 0, 0),
+	F(75000000, P_GCC_DISP_GPLL0_CLK, 8, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 dispcc_mdss_ahb_clk_src = {
+	.cmd_rcgr = 0x22bc,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_5,
+	.freq_tbl = ftbl_dispcc_mdss_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_ahb_clk_src",
+		.parent_data = dispcc_parent_data_5,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_5),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_dispcc_mdss_byte0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 dispcc_mdss_byte0_clk_src = {
+	.cmd_rcgr = 0x2110,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_0,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_byte0_clk_src",
+		.parent_data = dispcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_byte1_clk_src = {
+	.cmd_rcgr = 0x212c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_0,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_byte1_clk_src",
+		.parent_data = dispcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_dp_aux_clk_src = {
+	.cmd_rcgr = 0x21dc,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_2,
+	.freq_tbl = ftbl_dispcc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_dp_aux_clk_src",
+		.parent_data = dispcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_dispcc_mdss_dp_crypto_clk_src[] = {
+	F(108000, P_DP_PHY_PLL_LINK_CLK, 3, 0, 0),
+	F(180000, P_DP_PHY_PLL_LINK_CLK, 3, 0, 0),
+	F(360000, P_DP_PHY_PLL_LINK_CLK, 1.5, 0, 0),
+	F(540000, P_DP_PHY_PLL_LINK_CLK, 1.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 dispcc_mdss_dp_crypto_clk_src = {
+	.cmd_rcgr = 0x2194,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_1,
+	.freq_tbl = ftbl_dispcc_mdss_dp_crypto_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_dp_crypto_clk_src",
+		.parent_data = dispcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_1),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_dp_link_clk_src = {
+	.cmd_rcgr = 0x2178,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_1,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_dp_link_clk_src",
+		.parent_data = dispcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_dp_pixel1_clk_src = {
+	.cmd_rcgr = 0x21c4,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_1,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_dp_pixel1_clk_src",
+		.parent_data = dispcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_dp_pixel_clk_src = {
+	.cmd_rcgr = 0x21ac,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_1,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_dp_pixel_clk_src",
+		.parent_data = dispcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_esc0_clk_src = {
+	.cmd_rcgr = 0x2148,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_0,
+	.freq_tbl = ftbl_dispcc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_esc0_clk_src",
+		.parent_data = dispcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_esc1_clk_src = {
+	.cmd_rcgr = 0x2160,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_0,
+	.freq_tbl = ftbl_dispcc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_esc1_clk_src",
+		.parent_data = dispcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_dispcc_mdss_mdp_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(85714286, P_GCC_DISP_GPLL0_CLK, 7, 0, 0),
+	F(100000000, P_GCC_DISP_GPLL0_CLK, 6, 0, 0),
+	F(150000000, P_GCC_DISP_GPLL0_CLK, 4, 0, 0),
+	F(172000000, P_DISPCC_PLL0_OUT_MAIN, 5, 0, 0),
+	F(200000000, P_GCC_DISP_GPLL0_CLK, 3, 0, 0),
+	F(286666667, P_DISPCC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(300000000, P_GCC_DISP_GPLL0_CLK, 2, 0, 0),
+	F(344000000, P_DISPCC_PLL0_OUT_MAIN, 2.5, 0, 0),
+	F(430000000, P_DISPCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 dispcc_mdss_mdp_clk_src = {
+	.cmd_rcgr = 0x20c8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_3,
+	.freq_tbl = ftbl_dispcc_mdss_mdp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_mdp_clk_src",
+		.parent_data = dispcc_parent_data_3,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_pclk0_clk_src = {
+	.cmd_rcgr = 0x2098,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_pclk0_clk_src",
+		.parent_data = dispcc_parent_data_4,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_pixel_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_pclk1_clk_src = {
+	.cmd_rcgr = 0x20b0,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_pclk1_clk_src",
+		.parent_data = dispcc_parent_data_4,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_pixel_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_dispcc_mdss_rot_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(171428571, P_GCC_DISP_GPLL0_CLK, 3.5, 0, 0),
+	F(200000000, P_GCC_DISP_GPLL0_CLK, 3, 0, 0),
+	F(300000000, P_GCC_DISP_GPLL0_CLK, 2, 0, 0),
+	F(344000000, P_DISPCC_PLL0_OUT_MAIN, 2.5, 0, 0),
+	F(430000000, P_DISPCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 dispcc_mdss_rot_clk_src = {
+	.cmd_rcgr = 0x20e0,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_3,
+	.freq_tbl = ftbl_dispcc_mdss_rot_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_rot_clk_src",
+		.parent_data = dispcc_parent_data_3,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_3),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_mdss_vsync_clk_src = {
+	.cmd_rcgr = 0x20f8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_2,
+	.freq_tbl = ftbl_dispcc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_mdss_vsync_clk_src",
+		.parent_data = dispcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_dispcc_sleep_clk_src[] = {
+	F(32000, P_CHIP_SLEEP_CLK, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 dispcc_sleep_clk_src = {
+	.cmd_rcgr = 0x6060,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_6,
+	.freq_tbl = ftbl_dispcc_sleep_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_sleep_clk_src",
+		.parent_data = dispcc_parent_data_6,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_6),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 dispcc_xo_clk_src = {
+	.cmd_rcgr = 0x6044,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = dispcc_parent_map_2,
+	.freq_tbl = ftbl_dispcc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "dispcc_xo_clk_src",
+		.parent_data = dispcc_parent_data_2_ao,
+		.num_parents = ARRAY_SIZE(dispcc_parent_data_2_ao),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_branch dispcc_mdss_ahb_clk = {
+	.halt_reg = 0x2080,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2080,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_byte0_clk = {
+	.halt_reg = 0x2028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_byte0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_byte0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_regmap_div dispcc_mdss_byte0_div_clk_src = {
+	.reg = 0x2128,
+	.shift = 0,
+	.width = 2,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_byte0_div_clk_src",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_byte0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.ops = &clk_regmap_div_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_byte0_intf_clk = {
+	.halt_reg = 0x202c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x202c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_byte0_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_byte0_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_byte1_clk = {
+	.halt_reg = 0x2030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_byte1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_byte1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_regmap_div dispcc_mdss_byte1_div_clk_src = {
+	.reg = 0x2144,
+	.shift = 0,
+	.width = 2,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_byte1_div_clk_src",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_byte1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.ops = &clk_regmap_div_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_byte1_intf_clk = {
+	.halt_reg = 0x2034,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2034,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_byte1_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_byte1_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_dp_aux_clk = {
+	.halt_reg = 0x2054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_dp_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_dp_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_dp_crypto_clk = {
+	.halt_reg = 0x2048,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2048,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_dp_crypto_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_dp_crypto_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_dp_link_clk = {
+	.halt_reg = 0x2040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_dp_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_dp_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_dp_link_intf_clk = {
+	.halt_reg = 0x2044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_dp_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_dp_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_dp_pixel1_clk = {
+	.halt_reg = 0x2050,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2050,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_dp_pixel1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_dp_pixel1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_dp_pixel_clk = {
+	.halt_reg = 0x204c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x204c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_dp_pixel_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_dp_pixel_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_esc0_clk = {
+	.halt_reg = 0x2038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_esc0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_esc0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_esc1_clk = {
+	.halt_reg = 0x203c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x203c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_esc1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_esc1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_mdp_clk = {
+	.halt_reg = 0x200c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x200c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_mdp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_mdp_lut_clk = {
+	.halt_reg = 0x201c,
+	.halt_check = BRANCH_VOTED,
+	.clkr = {
+		.enable_reg = 0x201c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_mdp_lut_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_non_gdsc_ahb_clk = {
+	.halt_reg = 0x4004,
+	.halt_check = BRANCH_VOTED,
+	.clkr = {
+		.enable_reg = 0x4004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_non_gdsc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_pclk0_clk = {
+	.halt_reg = 0x2004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_pclk0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_pclk0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_pclk1_clk = {
+	.halt_reg = 0x2008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_pclk1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_pclk1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_rot_clk = {
+	.halt_reg = 0x2014,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_rot_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_rot_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_rscc_ahb_clk = {
+	.halt_reg = 0x400c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x400c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_rscc_ahb_clk",
+			.parent_names = (const char *[]) {
+				"dispcc_mdss_ahb_clk_src",
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_rscc_vsync_clk = {
+	.halt_reg = 0x4008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x4008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_rscc_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_mdss_vsync_clk = {
+	.halt_reg = 0x2024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_mdss_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&dispcc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch dispcc_sleep_clk = {
+	.halt_reg = 0x6078,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6078,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "dispcc_sleep_clk",
+			.parent_names = (const char *[]) {
+				"dispcc_sleep_clk_src",
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc mdss_gdsc = {
+	.gdscr = 0x3000,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "mdss_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = HW_CTRL,
+};
+
+static struct clk_regmap *dispcc_sm7150_clocks[] = {
+	[DISPCC_MDSS_AHB_CLK] = &dispcc_mdss_ahb_clk.clkr,
+	[DISPCC_MDSS_AHB_CLK_SRC] = &dispcc_mdss_ahb_clk_src.clkr,
+	[DISPCC_MDSS_BYTE0_CLK] = &dispcc_mdss_byte0_clk.clkr,
+	[DISPCC_MDSS_BYTE0_CLK_SRC] = &dispcc_mdss_byte0_clk_src.clkr,
+	[DISPCC_MDSS_BYTE0_DIV_CLK_SRC] = &dispcc_mdss_byte0_div_clk_src.clkr,
+	[DISPCC_MDSS_BYTE0_INTF_CLK] = &dispcc_mdss_byte0_intf_clk.clkr,
+	[DISPCC_MDSS_BYTE1_CLK] = &dispcc_mdss_byte1_clk.clkr,
+	[DISPCC_MDSS_BYTE1_CLK_SRC] = &dispcc_mdss_byte1_clk_src.clkr,
+	[DISPCC_MDSS_BYTE1_DIV_CLK_SRC] = &dispcc_mdss_byte1_div_clk_src.clkr,
+	[DISPCC_MDSS_BYTE1_INTF_CLK] = &dispcc_mdss_byte1_intf_clk.clkr,
+	[DISPCC_MDSS_DP_AUX_CLK] = &dispcc_mdss_dp_aux_clk.clkr,
+	[DISPCC_MDSS_DP_AUX_CLK_SRC] = &dispcc_mdss_dp_aux_clk_src.clkr,
+	[DISPCC_MDSS_DP_CRYPTO_CLK] = &dispcc_mdss_dp_crypto_clk.clkr,
+	[DISPCC_MDSS_DP_CRYPTO_CLK_SRC] = &dispcc_mdss_dp_crypto_clk_src.clkr,
+	[DISPCC_MDSS_DP_LINK_CLK] = &dispcc_mdss_dp_link_clk.clkr,
+	[DISPCC_MDSS_DP_LINK_CLK_SRC] = &dispcc_mdss_dp_link_clk_src.clkr,
+	[DISPCC_MDSS_DP_LINK_INTF_CLK] = &dispcc_mdss_dp_link_intf_clk.clkr,
+	[DISPCC_MDSS_DP_PIXEL1_CLK] = &dispcc_mdss_dp_pixel1_clk.clkr,
+	[DISPCC_MDSS_DP_PIXEL1_CLK_SRC] = &dispcc_mdss_dp_pixel1_clk_src.clkr,
+	[DISPCC_MDSS_DP_PIXEL_CLK] = &dispcc_mdss_dp_pixel_clk.clkr,
+	[DISPCC_MDSS_DP_PIXEL_CLK_SRC] = &dispcc_mdss_dp_pixel_clk_src.clkr,
+	[DISPCC_MDSS_ESC0_CLK] = &dispcc_mdss_esc0_clk.clkr,
+	[DISPCC_MDSS_ESC0_CLK_SRC] = &dispcc_mdss_esc0_clk_src.clkr,
+	[DISPCC_MDSS_ESC1_CLK] = &dispcc_mdss_esc1_clk.clkr,
+	[DISPCC_MDSS_ESC1_CLK_SRC] = &dispcc_mdss_esc1_clk_src.clkr,
+	[DISPCC_MDSS_MDP_CLK] = &dispcc_mdss_mdp_clk.clkr,
+	[DISPCC_MDSS_MDP_CLK_SRC] = &dispcc_mdss_mdp_clk_src.clkr,
+	[DISPCC_MDSS_MDP_LUT_CLK] = &dispcc_mdss_mdp_lut_clk.clkr,
+	[DISPCC_MDSS_NON_GDSC_AHB_CLK] = &dispcc_mdss_non_gdsc_ahb_clk.clkr,
+	[DISPCC_MDSS_PCLK0_CLK] = &dispcc_mdss_pclk0_clk.clkr,
+	[DISPCC_MDSS_PCLK0_CLK_SRC] = &dispcc_mdss_pclk0_clk_src.clkr,
+	[DISPCC_MDSS_PCLK1_CLK] = &dispcc_mdss_pclk1_clk.clkr,
+	[DISPCC_MDSS_PCLK1_CLK_SRC] = &dispcc_mdss_pclk1_clk_src.clkr,
+	[DISPCC_MDSS_ROT_CLK] = &dispcc_mdss_rot_clk.clkr,
+	[DISPCC_MDSS_ROT_CLK_SRC] = &dispcc_mdss_rot_clk_src.clkr,
+	[DISPCC_MDSS_RSCC_AHB_CLK] = &dispcc_mdss_rscc_ahb_clk.clkr,
+	[DISPCC_MDSS_RSCC_VSYNC_CLK] = &dispcc_mdss_rscc_vsync_clk.clkr,
+	[DISPCC_MDSS_VSYNC_CLK] = &dispcc_mdss_vsync_clk.clkr,
+	[DISPCC_MDSS_VSYNC_CLK_SRC] = &dispcc_mdss_vsync_clk_src.clkr,
+	[DISPCC_PLL0] = &dispcc_pll0.clkr,
+	[DISPCC_SLEEP_CLK] = &dispcc_sleep_clk.clkr,
+	[DISPCC_SLEEP_CLK_SRC] = &dispcc_sleep_clk_src.clkr,
+	[DISPCC_XO_CLK_SRC] = &dispcc_xo_clk_src.clkr,
+};
+
+static struct gdsc *dispcc_sm7150_gdscs[] = {
+	[MDSS_GDSC] = &mdss_gdsc,
+};
+
+static const struct regmap_config dispcc_sm7150_regmap_config = {
+	.reg_bits	= 32,
+	.reg_stride	= 4,
+	.val_bits	= 32,
+	.max_register	= 0x10000,
+	.fast_io	= true,
+};
+
+static const struct qcom_cc_desc dispcc_sm7150_desc = {
+	.config = &dispcc_sm7150_regmap_config,
+	.clks = dispcc_sm7150_clocks,
+	.num_clks = ARRAY_SIZE(dispcc_sm7150_clocks),
+	.gdscs = dispcc_sm7150_gdscs,
+	.num_gdscs = ARRAY_SIZE(dispcc_sm7150_gdscs),
+};
+
+static const struct of_device_id dispcc_sm7150_match_table[] = {
+	{ .compatible = "qcom,sm7150-dispcc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, dispcc_sm7150_match_table);
+
+static int dispcc_sm7150_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+
+	regmap = qcom_cc_map(pdev, &dispcc_sm7150_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	clk_fabia_pll_configure(&dispcc_pll0, regmap, &dispcc_pll0_config);
+	/* Enable clock gating for DSI and MDP clocks */
+	regmap_update_bits(regmap, 0x8000, 0x7f0, 0x7f0);
+
+	/* Keep some clocks always-on */
+	qcom_branch_set_clk_en(regmap, 0x605c); /* DISPCC_XO_CLK */
+
+	return qcom_cc_really_probe(&pdev->dev, &dispcc_sm7150_desc, regmap);
+}
+
+static struct platform_driver dispcc_sm7150_driver = {
+	.probe = dispcc_sm7150_probe,
+	.driver = {
+		.name = "dispcc-sm7150",
+		.of_match_table = dispcc_sm7150_match_table,
+	},
+};
+
+module_platform_driver(dispcc_sm7150_driver);
+
+MODULE_DESCRIPTION("Qualcomm SM7150 Display Clock Controller");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sm8250.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sm8250.c
@@ -851,6 +851,7 @@
 				&disp_cc_mdss_dp_link1_div_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -886,6 +887,7 @@
 				&disp_cc_mdss_dp_link_div_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -1011,6 +1013,7 @@
 				&disp_cc_mdss_mdp_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -1359,8 +1362,13 @@
 		disp_cc_sm8250_clocks[DISP_CC_MDSS_EDP_GTC_CLK_SRC] = NULL;
 	}
 
-	clk_lucid_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
-	clk_lucid_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
+	if (of_device_is_compatible(pdev->dev.of_node, "qcom,sm8350-dispcc")) {
+		clk_lucid_5lpe_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
+		clk_lucid_5lpe_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
+	} else {
+		clk_lucid_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
+		clk_lucid_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
+	}
 
 	/* Enable clock gating for MDP clocks */
 	regmap_update_bits(regmap, 0x8000, 0x10, 0x10);
@@ -1368,7 +1376,7 @@
 	/* DISP_CC_XO_CLK always-on */
 	regmap_update_bits(regmap, 0x605c, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &disp_cc_sm8250_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &disp_cc_sm8250_desc, regmap);
 
 	pm_runtime_put(&pdev->dev);
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sm8450.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sm8450.c
@@ -309,26 +309,17 @@
 	},
 };
 
-static const struct freq_tbl ftbl_disp_cc_mdss_dptx0_link_clk_src[] = {
-	F(162000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(270000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(540000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(810000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	{ }
-};
-
 static struct clk_rcg2 disp_cc_mdss_dptx0_link_clk_src = {
 	.cmd_rcgr = 0x819c,
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx0_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -382,13 +373,12 @@
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx1_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -442,13 +432,12 @@
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx2_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -502,13 +491,12 @@
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx3_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -1793,7 +1781,7 @@
 	 */
 	regmap_update_bits(regmap, 0xe05c, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &disp_cc_sm8450_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &disp_cc_sm8450_desc, regmap);
 	if (ret)
 		goto err_put_rpm;
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sm8550.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sm8550.c
@@ -196,7 +196,7 @@
 static const struct parent_map disp_cc_parent_map_4[] = {
 	{ P_BI_TCXO, 0 },
 	{ P_DP0_PHY_PLL_LINK_CLK, 1 },
-	{ P_DP1_PHY_PLL_VCO_DIV_CLK, 2 },
+	{ P_DP0_PHY_PLL_VCO_DIV_CLK, 2 },
 	{ P_DP3_PHY_PLL_VCO_DIV_CLK, 3 },
 	{ P_DP1_PHY_PLL_VCO_DIV_CLK, 4 },
 	{ P_DP2_PHY_PLL_VCO_DIV_CLK, 6 },
@@ -213,7 +213,7 @@
 
 static const struct parent_map disp_cc_parent_map_5[] = {
 	{ P_BI_TCXO, 0 },
-	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 4 },
+	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 2 },
 	{ P_DSI1_PHY_PLL_OUT_BYTECLK, 4 },
 };
 
@@ -345,26 +345,17 @@
 	},
 };
 
-static const struct freq_tbl ftbl_disp_cc_mdss_dptx0_link_clk_src[] = {
-	F(162000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(270000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(540000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(810000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	{ }
-};
-
 static struct clk_rcg2 disp_cc_mdss_dptx0_link_clk_src = {
 	.cmd_rcgr = 0x8170,
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_7,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx0_link_clk_src",
 		.parent_data = disp_cc_parent_data_7,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_7),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -409,7 +400,7 @@
 		.parent_data = disp_cc_parent_data_0,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_dp_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -418,13 +409,12 @@
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx1_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -478,13 +468,12 @@
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx2_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -538,13 +527,12 @@
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx3_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -574,7 +562,7 @@
 		.parent_data = disp_cc_parent_data_5,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_5),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_rcg2_shared_ops,
 	},
 };
 
@@ -589,7 +577,7 @@
 		.parent_data = disp_cc_parent_data_5,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_5),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_rcg2_shared_ops,
 	},
 };
 
@@ -1623,7 +1611,7 @@
 		.name = "mdss_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
-	.flags = HW_CTRL | RETAIN_FF_ENABLE,
+	.flags = POLL_CFG_GDSCR | HW_CTRL | RETAIN_FF_ENABLE,
 };
 
 static struct gdsc mdss_int2_gdsc = {
@@ -1632,7 +1620,7 @@
 		.name = "mdss_int2_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
-	.flags = HW_CTRL | RETAIN_FF_ENABLE,
+	.flags = POLL_CFG_GDSCR | HW_CTRL | RETAIN_FF_ENABLE,
 };
 
 static struct clk_regmap *disp_cc_sm8550_clocks[] = {
@@ -1786,7 +1774,7 @@
 	 */
 	regmap_update_bits(regmap, 0xe054, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &disp_cc_sm8550_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &disp_cc_sm8550_desc, regmap);
 	if (ret)
 		goto err_put_rpm;
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-sm8650.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-sm8650.c
@@ -343,26 +343,17 @@
 	},
 };
 
-static const struct freq_tbl ftbl_disp_cc_mdss_dptx0_link_clk_src[] = {
-	F(162000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(270000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(540000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	F(810000, P_DP0_PHY_PLL_LINK_CLK, 1, 0, 0),
-	{ }
-};
-
 static struct clk_rcg2 disp_cc_mdss_dptx0_link_clk_src = {
 	.cmd_rcgr = 0x8170,
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_7,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(const struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx0_link_clk_src",
 		.parent_data = disp_cc_parent_data_7,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_7),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -416,13 +407,12 @@
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(const struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx1_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -476,13 +466,12 @@
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(const struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx2_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -536,13 +525,12 @@
 	.mnd_width = 0,
 	.hid_width = 5,
 	.parent_map = disp_cc_parent_map_3,
-	.freq_tbl = ftbl_disp_cc_mdss_dptx0_link_clk_src,
 	.clkr.hw.init = &(const struct clk_init_data) {
 		.name = "disp_cc_mdss_dptx3_link_clk_src",
 		.parent_data = disp_cc_parent_data_3,
 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_byte2_ops,
 	},
 };
 
@@ -1780,7 +1768,7 @@
 	/* Keep clocks always enabled */
 	regmap_update_bits(regmap, 0xe054, BIT(0), BIT(0)); /* disp_cc_xo_clk */
 
-	ret = qcom_cc_really_probe(pdev, &disp_cc_sm8650_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &disp_cc_sm8650_desc, regmap);
 	if (ret)
 		goto err_put_rpm;
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc-x1e80100.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc-x1e80100.c
@@ -0,0 +1,1718 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/err.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,x1e80100-dispcc.h>
+
+#include "common.h"
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "reset.h"
+#include "gdsc.h"
+
+/* Need to match the order of clocks in DT binding */
+enum {
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+	DT_AHB_CLK,
+	DT_SLEEP_CLK,
+
+	DT_DSI0_PHY_PLL_OUT_BYTECLK,
+	DT_DSI0_PHY_PLL_OUT_DSICLK,
+	DT_DSI1_PHY_PLL_OUT_BYTECLK,
+	DT_DSI1_PHY_PLL_OUT_DSICLK,
+
+	DT_DP0_PHY_PLL_LINK_CLK,
+	DT_DP0_PHY_PLL_VCO_DIV_CLK,
+	DT_DP1_PHY_PLL_LINK_CLK,
+	DT_DP1_PHY_PLL_VCO_DIV_CLK,
+	DT_DP2_PHY_PLL_LINK_CLK,
+	DT_DP2_PHY_PLL_VCO_DIV_CLK,
+	DT_DP3_PHY_PLL_LINK_CLK,
+	DT_DP3_PHY_PLL_VCO_DIV_CLK,
+};
+
+#define DISP_CC_MISC_CMD	0xF000
+
+enum {
+	P_BI_TCXO,
+	P_BI_TCXO_AO,
+	P_DISP_CC_PLL0_OUT_MAIN,
+	P_DISP_CC_PLL1_OUT_EVEN,
+	P_DISP_CC_PLL1_OUT_MAIN,
+	P_DP0_PHY_PLL_LINK_CLK,
+	P_DP0_PHY_PLL_VCO_DIV_CLK,
+	P_DP1_PHY_PLL_LINK_CLK,
+	P_DP1_PHY_PLL_VCO_DIV_CLK,
+	P_DP2_PHY_PLL_LINK_CLK,
+	P_DP2_PHY_PLL_VCO_DIV_CLK,
+	P_DP3_PHY_PLL_LINK_CLK,
+	P_DP3_PHY_PLL_VCO_DIV_CLK,
+	P_DSI0_PHY_PLL_OUT_BYTECLK,
+	P_DSI0_PHY_PLL_OUT_DSICLK,
+	P_DSI1_PHY_PLL_OUT_BYTECLK,
+	P_DSI1_PHY_PLL_OUT_DSICLK,
+	P_SLEEP_CLK,
+};
+
+static const struct pll_vco lucid_ole_vco[] = {
+	{ 249600000, 2300000000, 0 },
+};
+
+static const struct alpha_pll_config disp_cc_pll0_config = {
+	.l = 0xd,
+	.alpha = 0x6492,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x82aa299c,
+	.test_ctl_val = 0x00000000,
+	.test_ctl_hi_val = 0x00000003,
+	.test_ctl_hi1_val = 0x00009000,
+	.test_ctl_hi2_val = 0x00000034,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00000005,
+};
+
+static struct clk_alpha_pll disp_cc_pll0 = {
+	.offset = 0x0,
+	.vco_table = lucid_ole_vco,
+	.num_vco = ARRAY_SIZE(lucid_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_reset_lucid_ole_ops,
+		},
+	},
+};
+
+static const struct alpha_pll_config disp_cc_pll1_config = {
+	.l = 0x1f,
+	.alpha = 0x4000,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x82aa299c,
+	.test_ctl_val = 0x00000000,
+	.test_ctl_hi_val = 0x00000003,
+	.test_ctl_hi1_val = 0x00009000,
+	.test_ctl_hi2_val = 0x00000034,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00000005,
+};
+
+static struct clk_alpha_pll disp_cc_pll1 = {
+	.offset = 0x1000,
+	.vco_table = lucid_ole_vco,
+	.num_vco = ARRAY_SIZE(lucid_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_pll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_reset_lucid_ole_ops,
+		},
+	},
+};
+
+static const struct parent_map disp_cc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DP0_PHY_PLL_LINK_CLK, 1 },
+	{ P_DP0_PHY_PLL_VCO_DIV_CLK, 2 },
+	{ P_DP3_PHY_PLL_VCO_DIV_CLK, 3 },
+	{ P_DP1_PHY_PLL_VCO_DIV_CLK, 4 },
+	{ P_DP2_PHY_PLL_VCO_DIV_CLK, 6 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DP0_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP0_PHY_PLL_VCO_DIV_CLK },
+	{ .index = DT_DP3_PHY_PLL_VCO_DIV_CLK },
+	{ .index = DT_DP1_PHY_PLL_VCO_DIV_CLK },
+	{ .index = DT_DP2_PHY_PLL_VCO_DIV_CLK },
+};
+
+static const struct parent_map disp_cc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_1_ao[] = {
+	{ .index = DT_BI_TCXO_AO },
+};
+
+static const struct parent_map disp_cc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_DSICLK, 1 },
+	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 2 },
+	{ P_DSI1_PHY_PLL_OUT_DSICLK, 3 },
+	{ P_DSI1_PHY_PLL_OUT_BYTECLK, 4 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_DSICLK },
+	{ .index = DT_DSI0_PHY_PLL_OUT_BYTECLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_DSICLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_BYTECLK },
+};
+
+static const struct parent_map disp_cc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DP0_PHY_PLL_LINK_CLK, 1 },
+	{ P_DP1_PHY_PLL_LINK_CLK, 2 },
+	{ P_DP2_PHY_PLL_LINK_CLK, 3 },
+	{ P_DP3_PHY_PLL_LINK_CLK, 4 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DP0_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP1_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP2_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP3_PHY_PLL_LINK_CLK },
+};
+
+static const struct parent_map disp_cc_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 2 },
+	{ P_DSI1_PHY_PLL_OUT_BYTECLK, 4 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_BYTECLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_BYTECLK },
+};
+
+static const struct parent_map disp_cc_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DISP_CC_PLL1_OUT_MAIN, 4 },
+	{ P_DISP_CC_PLL1_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &disp_cc_pll1.clkr.hw },
+	{ .hw = &disp_cc_pll1.clkr.hw },
+};
+
+static const struct parent_map disp_cc_parent_map_6[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DISP_CC_PLL0_OUT_MAIN, 1 },
+	{ P_DISP_CC_PLL1_OUT_MAIN, 4 },
+	{ P_DISP_CC_PLL1_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_6[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &disp_cc_pll0.clkr.hw },
+	{ .hw = &disp_cc_pll1.clkr.hw },
+	{ .hw = &disp_cc_pll1.clkr.hw },
+};
+
+static const struct parent_map disp_cc_parent_map_7[] = {
+	{ P_SLEEP_CLK, 0 },
+};
+
+static const struct clk_parent_data disp_cc_parent_data_7[] = {
+	{ .index = DT_SLEEP_CLK },
+};
+
+static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(37500000, P_DISP_CC_PLL1_OUT_MAIN, 16, 0, 0),
+	F(75000000, P_DISP_CC_PLL1_OUT_MAIN, 8, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 disp_cc_mdss_ahb_clk_src = {
+	.cmd_rcgr = 0x82ec,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_5,
+	.freq_tbl = ftbl_disp_cc_mdss_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_ahb_clk_src",
+		.parent_data = disp_cc_parent_data_5,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_5),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_disp_cc_mdss_byte0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 disp_cc_mdss_byte0_clk_src = {
+	.cmd_rcgr = 0x810c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_2,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_byte0_clk_src",
+		.parent_data = disp_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_byte1_clk_src = {
+	.cmd_rcgr = 0x8128,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_2,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_byte1_clk_src",
+		.parent_data = disp_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx0_aux_clk_src = {
+	.cmd_rcgr = 0x81c0,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_1,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx0_aux_clk_src",
+		.parent_data = disp_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx0_link_clk_src = {
+	.cmd_rcgr = 0x8174,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_3,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx0_link_clk_src",
+		.parent_data = disp_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx0_pixel0_clk_src = {
+	.cmd_rcgr = 0x8190,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx0_pixel0_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx0_pixel1_clk_src = {
+	.cmd_rcgr = 0x81a8,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx0_pixel1_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx1_aux_clk_src = {
+	.cmd_rcgr = 0x8224,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_1,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx1_aux_clk_src",
+		.parent_data = disp_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx1_link_clk_src = {
+	.cmd_rcgr = 0x8208,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_3,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx1_link_clk_src",
+		.parent_data = disp_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx1_pixel0_clk_src = {
+	.cmd_rcgr = 0x81d8,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx1_pixel0_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx1_pixel1_clk_src = {
+	.cmd_rcgr = 0x81f0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx1_pixel1_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx2_aux_clk_src = {
+	.cmd_rcgr = 0x8288,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_1,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx2_aux_clk_src",
+		.parent_data = disp_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx2_link_clk_src = {
+	.cmd_rcgr = 0x823c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_3,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx2_link_clk_src",
+		.parent_data = disp_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx2_pixel0_clk_src = {
+	.cmd_rcgr = 0x8258,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx2_pixel0_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx2_pixel1_clk_src = {
+	.cmd_rcgr = 0x8270,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx2_pixel1_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx3_aux_clk_src = {
+	.cmd_rcgr = 0x82d4,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_1,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx3_aux_clk_src",
+		.parent_data = disp_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx3_link_clk_src = {
+	.cmd_rcgr = 0x82b8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_3,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx3_link_clk_src",
+		.parent_data = disp_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_dptx3_pixel0_clk_src = {
+	.cmd_rcgr = 0x82a0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_0,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx3_pixel0_clk_src",
+		.parent_data = disp_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_esc0_clk_src = {
+	.cmd_rcgr = 0x8144,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_4,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_esc0_clk_src",
+		.parent_data = disp_cc_parent_data_4,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_esc1_clk_src = {
+	.cmd_rcgr = 0x815c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_4,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_esc1_clk_src",
+		.parent_data = disp_cc_parent_data_4,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_disp_cc_mdss_mdp_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(85714286, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(100000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(150000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(172000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(200000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(325000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(375000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(514000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(575000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 disp_cc_mdss_mdp_clk_src = {
+	.cmd_rcgr = 0x80dc,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_6,
+	.freq_tbl = ftbl_disp_cc_mdss_mdp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_mdp_clk_src",
+		.parent_data = disp_cc_parent_data_6,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_6),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_pclk0_clk_src = {
+	.cmd_rcgr = 0x80ac,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_2,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_pclk0_clk_src",
+		.parent_data = disp_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_pixel_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_pclk1_clk_src = {
+	.cmd_rcgr = 0x80c4,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_2,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_pclk1_clk_src",
+		.parent_data = disp_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_pixel_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_mdss_vsync_clk_src = {
+	.cmd_rcgr = 0x80f4,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_1,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_vsync_clk_src",
+		.parent_data = disp_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_disp_cc_sleep_clk_src[] = {
+	F(32000, P_SLEEP_CLK, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 disp_cc_sleep_clk_src = {
+	.cmd_rcgr = 0xe05c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_7,
+	.freq_tbl = ftbl_disp_cc_sleep_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_sleep_clk_src",
+		.parent_data = disp_cc_parent_data_7,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_7),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 disp_cc_xo_clk_src = {
+	.cmd_rcgr = 0xe03c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_parent_map_1,
+	.freq_tbl = ftbl_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_xo_clk_src",
+		.parent_data = disp_cc_parent_data_1_ao,
+		.num_parents = ARRAY_SIZE(disp_cc_parent_data_1_ao),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = {
+	.reg = 0x8124,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_byte0_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&disp_cc_mdss_byte0_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div disp_cc_mdss_byte1_div_clk_src = {
+	.reg = 0x8140,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_byte1_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&disp_cc_mdss_byte1_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div disp_cc_mdss_dptx0_link_div_clk_src = {
+	.reg = 0x818c,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx0_link_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&disp_cc_mdss_dptx0_link_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div disp_cc_mdss_dptx1_link_div_clk_src = {
+	.reg = 0x8220,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx1_link_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&disp_cc_mdss_dptx1_link_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div disp_cc_mdss_dptx2_link_div_clk_src = {
+	.reg = 0x8254,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx2_link_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&disp_cc_mdss_dptx2_link_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div disp_cc_mdss_dptx3_link_div_clk_src = {
+	.reg = 0x82d0,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "disp_cc_mdss_dptx3_link_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&disp_cc_mdss_dptx3_link_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_branch disp_cc_mdss_accu_clk = {
+	.halt_reg = 0xe058,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xe058,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_accu_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_ahb1_clk = {
+	.halt_reg = 0xa020,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_ahb1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_ahb_clk = {
+	.halt_reg = 0x80a8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x80a8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_byte0_clk = {
+	.halt_reg = 0x8028,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_byte0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_byte0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_byte0_intf_clk = {
+	.halt_reg = 0x802c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x802c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_byte0_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_byte0_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_byte1_clk = {
+	.halt_reg = 0x8030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_byte1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_byte1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_byte1_intf_clk = {
+	.halt_reg = 0x8034,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8034,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_byte1_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_byte1_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx0_aux_clk = {
+	.halt_reg = 0x8058,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8058,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx0_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx0_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx0_link_clk = {
+	.halt_reg = 0x8040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx0_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx0_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx0_link_intf_clk = {
+	.halt_reg = 0x8048,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8048,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx0_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx0_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx0_pixel0_clk = {
+	.halt_reg = 0x8050,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8050,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx0_pixel0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx0_pixel0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx0_pixel1_clk = {
+	.halt_reg = 0x8054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx0_pixel1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx0_pixel1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx0_usb_router_link_intf_clk = {
+	.halt_reg = 0x8044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx0_usb_router_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx0_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx1_aux_clk = {
+	.halt_reg = 0x8074,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8074,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx1_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx1_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx1_link_clk = {
+	.halt_reg = 0x8064,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx1_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx1_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx1_link_intf_clk = {
+	.halt_reg = 0x806c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x806c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx1_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx1_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx1_pixel0_clk = {
+	.halt_reg = 0x805c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x805c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx1_pixel0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx1_pixel0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx1_pixel1_clk = {
+	.halt_reg = 0x8060,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8060,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx1_pixel1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx1_pixel1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx1_usb_router_link_intf_clk = {
+	.halt_reg = 0x8068,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8068,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx1_usb_router_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx1_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx2_aux_clk = {
+	.halt_reg = 0x8090,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8090,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx2_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx2_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx2_link_clk = {
+	.halt_reg = 0x8080,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8080,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx2_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx2_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx2_link_intf_clk = {
+	.halt_reg = 0x8084,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8084,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx2_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx2_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx2_pixel0_clk = {
+	.halt_reg = 0x8078,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8078,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx2_pixel0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx2_pixel0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx2_pixel1_clk = {
+	.halt_reg = 0x807c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x807c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx2_pixel1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx2_pixel1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx2_usb_router_link_intf_clk = {
+	.halt_reg = 0x8088,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8088,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx2_usb_router_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx2_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx3_aux_clk = {
+	.halt_reg = 0x80a0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x80a0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx3_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx3_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx3_link_clk = {
+	.halt_reg = 0x8098,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8098,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx3_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx3_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx3_link_intf_clk = {
+	.halt_reg = 0x809c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x809c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx3_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx3_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_dptx3_pixel0_clk = {
+	.halt_reg = 0x8094,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8094,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_dptx3_pixel0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_dptx3_pixel0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_esc0_clk = {
+	.halt_reg = 0x8038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_esc0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_esc0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_esc1_clk = {
+	.halt_reg = 0x803c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x803c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_esc1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_esc1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_mdp1_clk = {
+	.halt_reg = 0xa004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_mdp1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_mdp_clk = {
+	.halt_reg = 0x800c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x800c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_mdp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_mdp_lut1_clk = {
+	.halt_reg = 0xa010,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_mdp_lut1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_mdp_lut_clk = {
+	.halt_reg = 0x8018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x8018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_mdp_lut_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_non_gdsc_ahb_clk = {
+	.halt_reg = 0xc004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xc004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_non_gdsc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_pclk0_clk = {
+	.halt_reg = 0x8004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_pclk0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_pclk0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_pclk1_clk = {
+	.halt_reg = 0x8008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_pclk1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_pclk1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_rscc_ahb_clk = {
+	.halt_reg = 0xc00c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc00c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_rscc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_rscc_vsync_clk = {
+	.halt_reg = 0xc008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xc008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_rscc_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_vsync1_clk = {
+	.halt_reg = 0xa01c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa01c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_vsync1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch disp_cc_mdss_vsync_clk = {
+	.halt_reg = 0x8024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "disp_cc_mdss_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc mdss_gdsc = {
+	.gdscr = 0x9000,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "mdss_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = HW_CTRL | RETAIN_FF_ENABLE,
+};
+
+static struct gdsc mdss_int2_gdsc = {
+	.gdscr = 0xb000,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "mdss_int2_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = HW_CTRL | RETAIN_FF_ENABLE,
+};
+
+static struct clk_regmap *disp_cc_x1e80100_clocks[] = {
+	[DISP_CC_MDSS_ACCU_CLK] = &disp_cc_mdss_accu_clk.clkr,
+	[DISP_CC_MDSS_AHB1_CLK] = &disp_cc_mdss_ahb1_clk.clkr,
+	[DISP_CC_MDSS_AHB_CLK] = &disp_cc_mdss_ahb_clk.clkr,
+	[DISP_CC_MDSS_AHB_CLK_SRC] = &disp_cc_mdss_ahb_clk_src.clkr,
+	[DISP_CC_MDSS_BYTE0_CLK] = &disp_cc_mdss_byte0_clk.clkr,
+	[DISP_CC_MDSS_BYTE0_CLK_SRC] = &disp_cc_mdss_byte0_clk_src.clkr,
+	[DISP_CC_MDSS_BYTE0_DIV_CLK_SRC] = &disp_cc_mdss_byte0_div_clk_src.clkr,
+	[DISP_CC_MDSS_BYTE0_INTF_CLK] = &disp_cc_mdss_byte0_intf_clk.clkr,
+	[DISP_CC_MDSS_BYTE1_CLK] = &disp_cc_mdss_byte1_clk.clkr,
+	[DISP_CC_MDSS_BYTE1_CLK_SRC] = &disp_cc_mdss_byte1_clk_src.clkr,
+	[DISP_CC_MDSS_BYTE1_DIV_CLK_SRC] = &disp_cc_mdss_byte1_div_clk_src.clkr,
+	[DISP_CC_MDSS_BYTE1_INTF_CLK] = &disp_cc_mdss_byte1_intf_clk.clkr,
+	[DISP_CC_MDSS_DPTX0_AUX_CLK] = &disp_cc_mdss_dptx0_aux_clk.clkr,
+	[DISP_CC_MDSS_DPTX0_AUX_CLK_SRC] = &disp_cc_mdss_dptx0_aux_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX0_LINK_CLK] = &disp_cc_mdss_dptx0_link_clk.clkr,
+	[DISP_CC_MDSS_DPTX0_LINK_CLK_SRC] = &disp_cc_mdss_dptx0_link_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX0_LINK_DIV_CLK_SRC] = &disp_cc_mdss_dptx0_link_div_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX0_LINK_INTF_CLK] = &disp_cc_mdss_dptx0_link_intf_clk.clkr,
+	[DISP_CC_MDSS_DPTX0_PIXEL0_CLK] = &disp_cc_mdss_dptx0_pixel0_clk.clkr,
+	[DISP_CC_MDSS_DPTX0_PIXEL0_CLK_SRC] = &disp_cc_mdss_dptx0_pixel0_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX0_PIXEL1_CLK] = &disp_cc_mdss_dptx0_pixel1_clk.clkr,
+	[DISP_CC_MDSS_DPTX0_PIXEL1_CLK_SRC] = &disp_cc_mdss_dptx0_pixel1_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX0_USB_ROUTER_LINK_INTF_CLK] =
+		&disp_cc_mdss_dptx0_usb_router_link_intf_clk.clkr,
+	[DISP_CC_MDSS_DPTX1_AUX_CLK] = &disp_cc_mdss_dptx1_aux_clk.clkr,
+	[DISP_CC_MDSS_DPTX1_AUX_CLK_SRC] = &disp_cc_mdss_dptx1_aux_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX1_LINK_CLK] = &disp_cc_mdss_dptx1_link_clk.clkr,
+	[DISP_CC_MDSS_DPTX1_LINK_CLK_SRC] = &disp_cc_mdss_dptx1_link_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX1_LINK_DIV_CLK_SRC] = &disp_cc_mdss_dptx1_link_div_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX1_LINK_INTF_CLK] = &disp_cc_mdss_dptx1_link_intf_clk.clkr,
+	[DISP_CC_MDSS_DPTX1_PIXEL0_CLK] = &disp_cc_mdss_dptx1_pixel0_clk.clkr,
+	[DISP_CC_MDSS_DPTX1_PIXEL0_CLK_SRC] = &disp_cc_mdss_dptx1_pixel0_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX1_PIXEL1_CLK] = &disp_cc_mdss_dptx1_pixel1_clk.clkr,
+	[DISP_CC_MDSS_DPTX1_PIXEL1_CLK_SRC] = &disp_cc_mdss_dptx1_pixel1_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX1_USB_ROUTER_LINK_INTF_CLK] =
+		&disp_cc_mdss_dptx1_usb_router_link_intf_clk.clkr,
+	[DISP_CC_MDSS_DPTX2_AUX_CLK] = &disp_cc_mdss_dptx2_aux_clk.clkr,
+	[DISP_CC_MDSS_DPTX2_AUX_CLK_SRC] = &disp_cc_mdss_dptx2_aux_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX2_LINK_CLK] = &disp_cc_mdss_dptx2_link_clk.clkr,
+	[DISP_CC_MDSS_DPTX2_LINK_CLK_SRC] = &disp_cc_mdss_dptx2_link_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX2_LINK_DIV_CLK_SRC] = &disp_cc_mdss_dptx2_link_div_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX2_LINK_INTF_CLK] = &disp_cc_mdss_dptx2_link_intf_clk.clkr,
+	[DISP_CC_MDSS_DPTX2_PIXEL0_CLK] = &disp_cc_mdss_dptx2_pixel0_clk.clkr,
+	[DISP_CC_MDSS_DPTX2_PIXEL0_CLK_SRC] = &disp_cc_mdss_dptx2_pixel0_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX2_PIXEL1_CLK] = &disp_cc_mdss_dptx2_pixel1_clk.clkr,
+	[DISP_CC_MDSS_DPTX2_PIXEL1_CLK_SRC] = &disp_cc_mdss_dptx2_pixel1_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX2_USB_ROUTER_LINK_INTF_CLK] =
+		&disp_cc_mdss_dptx2_usb_router_link_intf_clk.clkr,
+	[DISP_CC_MDSS_DPTX3_AUX_CLK] = &disp_cc_mdss_dptx3_aux_clk.clkr,
+	[DISP_CC_MDSS_DPTX3_AUX_CLK_SRC] = &disp_cc_mdss_dptx3_aux_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX3_LINK_CLK] = &disp_cc_mdss_dptx3_link_clk.clkr,
+	[DISP_CC_MDSS_DPTX3_LINK_CLK_SRC] = &disp_cc_mdss_dptx3_link_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX3_LINK_DIV_CLK_SRC] = &disp_cc_mdss_dptx3_link_div_clk_src.clkr,
+	[DISP_CC_MDSS_DPTX3_LINK_INTF_CLK] = &disp_cc_mdss_dptx3_link_intf_clk.clkr,
+	[DISP_CC_MDSS_DPTX3_PIXEL0_CLK] = &disp_cc_mdss_dptx3_pixel0_clk.clkr,
+	[DISP_CC_MDSS_DPTX3_PIXEL0_CLK_SRC] = &disp_cc_mdss_dptx3_pixel0_clk_src.clkr,
+	[DISP_CC_MDSS_ESC0_CLK] = &disp_cc_mdss_esc0_clk.clkr,
+	[DISP_CC_MDSS_ESC0_CLK_SRC] = &disp_cc_mdss_esc0_clk_src.clkr,
+	[DISP_CC_MDSS_ESC1_CLK] = &disp_cc_mdss_esc1_clk.clkr,
+	[DISP_CC_MDSS_ESC1_CLK_SRC] = &disp_cc_mdss_esc1_clk_src.clkr,
+	[DISP_CC_MDSS_MDP1_CLK] = &disp_cc_mdss_mdp1_clk.clkr,
+	[DISP_CC_MDSS_MDP_CLK] = &disp_cc_mdss_mdp_clk.clkr,
+	[DISP_CC_MDSS_MDP_CLK_SRC] = &disp_cc_mdss_mdp_clk_src.clkr,
+	[DISP_CC_MDSS_MDP_LUT1_CLK] = &disp_cc_mdss_mdp_lut1_clk.clkr,
+	[DISP_CC_MDSS_MDP_LUT_CLK] = &disp_cc_mdss_mdp_lut_clk.clkr,
+	[DISP_CC_MDSS_NON_GDSC_AHB_CLK] = &disp_cc_mdss_non_gdsc_ahb_clk.clkr,
+	[DISP_CC_MDSS_PCLK0_CLK] = &disp_cc_mdss_pclk0_clk.clkr,
+	[DISP_CC_MDSS_PCLK0_CLK_SRC] = &disp_cc_mdss_pclk0_clk_src.clkr,
+	[DISP_CC_MDSS_PCLK1_CLK] = &disp_cc_mdss_pclk1_clk.clkr,
+	[DISP_CC_MDSS_PCLK1_CLK_SRC] = &disp_cc_mdss_pclk1_clk_src.clkr,
+	[DISP_CC_MDSS_RSCC_AHB_CLK] = &disp_cc_mdss_rscc_ahb_clk.clkr,
+	[DISP_CC_MDSS_RSCC_VSYNC_CLK] = &disp_cc_mdss_rscc_vsync_clk.clkr,
+	[DISP_CC_MDSS_VSYNC1_CLK] = &disp_cc_mdss_vsync1_clk.clkr,
+	[DISP_CC_MDSS_VSYNC_CLK] = &disp_cc_mdss_vsync_clk.clkr,
+	[DISP_CC_MDSS_VSYNC_CLK_SRC] = &disp_cc_mdss_vsync_clk_src.clkr,
+	[DISP_CC_PLL0] = &disp_cc_pll0.clkr,
+	[DISP_CC_PLL1] = &disp_cc_pll1.clkr,
+	[DISP_CC_SLEEP_CLK_SRC] = &disp_cc_sleep_clk_src.clkr,
+	[DISP_CC_XO_CLK_SRC] = &disp_cc_xo_clk_src.clkr,
+};
+
+static const struct qcom_reset_map disp_cc_x1e80100_resets[] = {
+	[DISP_CC_MDSS_CORE_BCR] = { 0x8000 },
+	[DISP_CC_MDSS_CORE_INT2_BCR] = { 0xa000 },
+	[DISP_CC_MDSS_RSCC_BCR] = { 0xc000 },
+};
+
+static struct gdsc *disp_cc_x1e80100_gdscs[] = {
+	[MDSS_GDSC] = &mdss_gdsc,
+	[MDSS_INT2_GDSC] = &mdss_int2_gdsc,
+};
+
+static const struct regmap_config disp_cc_x1e80100_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0x11008,
+	.fast_io = true,
+};
+
+static const struct qcom_cc_desc disp_cc_x1e80100_desc = {
+	.config = &disp_cc_x1e80100_regmap_config,
+	.clks = disp_cc_x1e80100_clocks,
+	.num_clks = ARRAY_SIZE(disp_cc_x1e80100_clocks),
+	.resets = disp_cc_x1e80100_resets,
+	.num_resets = ARRAY_SIZE(disp_cc_x1e80100_resets),
+	.gdscs = disp_cc_x1e80100_gdscs,
+	.num_gdscs = ARRAY_SIZE(disp_cc_x1e80100_gdscs),
+};
+
+static const struct of_device_id disp_cc_x1e80100_match_table[] = {
+	{ .compatible = "qcom,x1e80100-dispcc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, disp_cc_x1e80100_match_table);
+
+static int disp_cc_x1e80100_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+	int ret;
+
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		return ret;
+
+	ret = pm_runtime_resume_and_get(&pdev->dev);
+	if (ret)
+		return ret;
+
+	regmap = qcom_cc_map(pdev, &disp_cc_x1e80100_desc);
+	if (IS_ERR(regmap)) {
+		ret = PTR_ERR(regmap);
+		goto err_put_rpm;
+	}
+
+	clk_lucid_evo_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
+	clk_lucid_evo_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
+
+	/* Enable clock gating for MDP clocks */
+	regmap_update_bits(regmap, DISP_CC_MISC_CMD, 0x10, 0x10);
+
+	/* Keep clocks always enabled */
+	regmap_update_bits(regmap, 0xe074, BIT(0), BIT(0)); /* disp_cc_sleep_clk */
+	regmap_update_bits(regmap, 0xe054, BIT(0), BIT(0)); /* disp_cc_xo_clk */
+
+	ret = qcom_cc_really_probe(&pdev->dev, &disp_cc_x1e80100_desc, regmap);
+	if (ret)
+		goto err_put_rpm;
+
+	pm_runtime_put(&pdev->dev);
+
+	return 0;
+
+err_put_rpm:
+	pm_runtime_put_sync(&pdev->dev);
+
+	return ret;
+}
+
+static struct platform_driver disp_cc_x1e80100_driver = {
+	.probe = disp_cc_x1e80100_probe,
+	.driver = {
+		.name = "dispcc-x1e80100",
+		.of_match_table = disp_cc_x1e80100_match_table,
+	},
+};
+
+static int __init disp_cc_x1e80100_init(void)
+{
+	return platform_driver_register(&disp_cc_x1e80100_driver);
+}
+subsys_initcall(disp_cc_x1e80100_init);
+
+static void __exit disp_cc_x1e80100_exit(void)
+{
+	platform_driver_unregister(&disp_cc_x1e80100_driver);
+}
+module_exit(disp_cc_x1e80100_exit);
+
+MODULE_DESCRIPTION("QTI Display Clock Controller X1E80100 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc0-sa8775p.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc0-sa8775p.c
@@ -0,0 +1,1486 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,sa8775p-dispcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_IFACE,
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+	DT_SLEEP_CLK,
+	DT_DP0_PHY_PLL_LINK_CLK,
+	DT_DP0_PHY_PLL_VCO_DIV_CLK,
+	DT_DP1_PHY_PLL_LINK_CLK,
+	DT_DP1_PHY_PLL_VCO_DIV_CLK,
+	DT_DSI0_PHY_PLL_OUT_BYTECLK,
+	DT_DSI0_PHY_PLL_OUT_DSICLK,
+	DT_DSI1_PHY_PLL_OUT_BYTECLK,
+	DT_DSI1_PHY_PLL_OUT_DSICLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_DP0_PHY_PLL_LINK_CLK,
+	P_DP0_PHY_PLL_VCO_DIV_CLK,
+	P_DP1_PHY_PLL_LINK_CLK,
+	P_DP1_PHY_PLL_VCO_DIV_CLK,
+	P_DSI0_PHY_PLL_OUT_BYTECLK,
+	P_DSI0_PHY_PLL_OUT_DSICLK,
+	P_DSI1_PHY_PLL_OUT_BYTECLK,
+	P_DSI1_PHY_PLL_OUT_DSICLK,
+	P_MDSS_0_DISP_CC_PLL0_OUT_MAIN,
+	P_MDSS_0_DISP_CC_PLL1_OUT_EVEN,
+	P_MDSS_0_DISP_CC_PLL1_OUT_MAIN,
+	P_SLEEP_CLK,
+};
+
+static const struct pll_vco lucid_evo_vco[] = {
+	{ 249600000, 2020000000, 0 },
+};
+
+static const struct alpha_pll_config mdss_0_disp_cc_pll0_config = {
+	.l = 0x3a,
+	.alpha = 0x9800,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll mdss_0_disp_cc_pll0 = {
+	.offset = 0x0,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct alpha_pll_config mdss_0_disp_cc_pll1_config = {
+	.l = 0x1f,
+	.alpha = 0x4000,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll mdss_0_disp_cc_pll1 = {
+	.offset = 0x1000,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_pll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct parent_map disp_cc_0_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DP0_PHY_PLL_LINK_CLK, 1 },
+	{ P_DP0_PHY_PLL_VCO_DIV_CLK, 2 },
+	{ P_DP1_PHY_PLL_VCO_DIV_CLK, 4 },
+};
+
+static const struct clk_parent_data disp_cc_0_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DP0_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP0_PHY_PLL_VCO_DIV_CLK },
+	{ .index = DT_DP1_PHY_PLL_VCO_DIV_CLK },
+};
+
+static const struct parent_map disp_cc_0_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_DSICLK, 1 },
+	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 2 },
+	{ P_DSI1_PHY_PLL_OUT_DSICLK, 3 },
+	{ P_DSI1_PHY_PLL_OUT_BYTECLK, 4 },
+};
+
+static const struct clk_parent_data disp_cc_0_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_DSICLK },
+	{ .index = DT_DSI0_PHY_PLL_OUT_BYTECLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_DSICLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_BYTECLK },
+};
+
+static const struct parent_map disp_cc_0_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data disp_cc_0_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct clk_parent_data disp_cc_0_parent_data_2_ao[] = {
+	{ .index = DT_BI_TCXO_AO },
+};
+
+static const struct parent_map disp_cc_0_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DP0_PHY_PLL_LINK_CLK, 1 },
+	{ P_DP1_PHY_PLL_LINK_CLK, 2 },
+};
+
+static const struct clk_parent_data disp_cc_0_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DP0_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP1_PHY_PLL_LINK_CLK },
+};
+
+static const struct parent_map disp_cc_0_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 2 },
+	{ P_DSI1_PHY_PLL_OUT_BYTECLK, 4 },
+};
+
+static const struct clk_parent_data disp_cc_0_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_BYTECLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_BYTECLK },
+};
+
+static const struct parent_map disp_cc_0_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_MDSS_0_DISP_CC_PLL1_OUT_MAIN, 4 },
+	{ P_MDSS_0_DISP_CC_PLL1_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data disp_cc_0_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &mdss_0_disp_cc_pll1.clkr.hw },
+	{ .hw = &mdss_0_disp_cc_pll1.clkr.hw },
+};
+
+static const struct parent_map disp_cc_0_parent_map_6[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_MDSS_0_DISP_CC_PLL0_OUT_MAIN, 1 },
+	{ P_MDSS_0_DISP_CC_PLL1_OUT_MAIN, 4 },
+	{ P_MDSS_0_DISP_CC_PLL1_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data disp_cc_0_parent_data_6[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &mdss_0_disp_cc_pll0.clkr.hw },
+	{ .hw = &mdss_0_disp_cc_pll1.clkr.hw },
+	{ .hw = &mdss_0_disp_cc_pll1.clkr.hw },
+};
+
+static const struct parent_map disp_cc_0_parent_map_7[] = {
+	{ P_SLEEP_CLK, 0 },
+};
+
+static const struct clk_parent_data disp_cc_0_parent_data_7[] = {
+	{ .index = DT_SLEEP_CLK },
+};
+
+static const struct freq_tbl ftbl_mdss_0_disp_cc_mdss_ahb_clk_src[] = {
+	F(37500000, P_MDSS_0_DISP_CC_PLL1_OUT_MAIN, 16, 0, 0),
+	F(75000000, P_MDSS_0_DISP_CC_PLL1_OUT_MAIN, 8, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_ahb_clk_src = {
+	.cmd_rcgr = 0x824c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_5,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_ahb_clk_src",
+		.parent_data = disp_cc_0_parent_data_5,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_5),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_mdss_0_disp_cc_mdss_byte0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_byte0_clk_src = {
+	.cmd_rcgr = 0x80ec,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_1,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_byte0_clk_src",
+		.parent_data = disp_cc_0_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_byte1_clk_src = {
+	.cmd_rcgr = 0x8108,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_1,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_byte1_clk_src",
+		.parent_data = disp_cc_0_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx0_aux_clk_src = {
+	.cmd_rcgr = 0x81b8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_2,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx0_aux_clk_src",
+		.parent_data = disp_cc_0_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx0_crypto_clk_src = {
+	.cmd_rcgr = 0x8170,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_3,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx0_crypto_clk_src",
+		.parent_data = disp_cc_0_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx0_link_clk_src = {
+	.cmd_rcgr = 0x8154,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_3,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx0_link_clk_src",
+		.parent_data = disp_cc_0_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx0_pixel0_clk_src = {
+	.cmd_rcgr = 0x8188,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_0,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx0_pixel0_clk_src",
+		.parent_data = disp_cc_0_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx0_pixel1_clk_src = {
+	.cmd_rcgr = 0x81a0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_0,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx0_pixel1_clk_src",
+		.parent_data = disp_cc_0_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx0_pixel2_clk_src = {
+	.cmd_rcgr = 0x826c,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_0,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx0_pixel2_clk_src",
+		.parent_data = disp_cc_0_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx0_pixel3_clk_src = {
+	.cmd_rcgr = 0x8284,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_0,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx0_pixel3_clk_src",
+		.parent_data = disp_cc_0_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx1_aux_clk_src = {
+	.cmd_rcgr = 0x8234,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_2,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx1_aux_clk_src",
+		.parent_data = disp_cc_0_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx1_crypto_clk_src = {
+	.cmd_rcgr = 0x821c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_3,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx1_crypto_clk_src",
+		.parent_data = disp_cc_0_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx1_link_clk_src = {
+	.cmd_rcgr = 0x8200,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_3,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx1_link_clk_src",
+		.parent_data = disp_cc_0_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx1_pixel0_clk_src = {
+	.cmd_rcgr = 0x81d0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_0,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx1_pixel0_clk_src",
+		.parent_data = disp_cc_0_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_dptx1_pixel1_clk_src = {
+	.cmd_rcgr = 0x81e8,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_0,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx1_pixel1_clk_src",
+		.parent_data = disp_cc_0_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_esc0_clk_src = {
+	.cmd_rcgr = 0x8124,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_4,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_esc0_clk_src",
+		.parent_data = disp_cc_0_parent_data_4,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_esc1_clk_src = {
+	.cmd_rcgr = 0x813c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_4,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_esc1_clk_src",
+		.parent_data = disp_cc_0_parent_data_4,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_mdss_0_disp_cc_mdss_mdp_clk_src[] = {
+	F(375000000, P_MDSS_0_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(500000000, P_MDSS_0_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(575000000, P_MDSS_0_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(650000000, P_MDSS_0_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_mdp_clk_src = {
+	.cmd_rcgr = 0x80bc,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_6,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_mdp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_mdp_clk_src",
+		.parent_data = disp_cc_0_parent_data_6,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_6),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_pclk0_clk_src = {
+	.cmd_rcgr = 0x808c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_1,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_pclk0_clk_src",
+		.parent_data = disp_cc_0_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_pixel_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_pclk1_clk_src = {
+	.cmd_rcgr = 0x80a4,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_1,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_pclk1_clk_src",
+		.parent_data = disp_cc_0_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_pixel_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_mdss_vsync_clk_src = {
+	.cmd_rcgr = 0x80d4,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_2,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_vsync_clk_src",
+		.parent_data = disp_cc_0_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_mdss_0_disp_cc_sleep_clk_src[] = {
+	F(32000, P_SLEEP_CLK, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_sleep_clk_src = {
+	.cmd_rcgr = 0xc058,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_7,
+	.freq_tbl = ftbl_mdss_0_disp_cc_sleep_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_sleep_clk_src",
+		.parent_data = disp_cc_0_parent_data_7,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_7),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_0_disp_cc_xo_clk_src = {
+	.cmd_rcgr = 0xc03c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_0_parent_map_2,
+	.freq_tbl = ftbl_mdss_0_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_xo_clk_src",
+		.parent_data = disp_cc_0_parent_data_2_ao,
+		.num_parents = ARRAY_SIZE(disp_cc_0_parent_data_2_ao),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_regmap_div mdss_0_disp_cc_mdss_byte0_div_clk_src = {
+	.reg = 0x8104,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_byte0_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&mdss_0_disp_cc_mdss_byte0_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ops,
+	},
+};
+
+static struct clk_regmap_div mdss_0_disp_cc_mdss_byte1_div_clk_src = {
+	.reg = 0x8120,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_byte1_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&mdss_0_disp_cc_mdss_byte1_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ops,
+	},
+};
+
+static struct clk_regmap_div mdss_0_disp_cc_mdss_dptx0_link_div_clk_src = {
+	.reg = 0x816c,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx0_link_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&mdss_0_disp_cc_mdss_dptx0_link_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div mdss_0_disp_cc_mdss_dptx1_link_div_clk_src = {
+	.reg = 0x8218,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_0_disp_cc_mdss_dptx1_link_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&mdss_0_disp_cc_mdss_dptx1_link_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_ahb1_clk = {
+	.halt_reg = 0x8088,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8088,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_ahb1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_ahb_clk = {
+	.halt_reg = 0x8084,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8084,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_byte0_clk = {
+	.halt_reg = 0x8034,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8034,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_byte0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_byte0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_byte0_intf_clk = {
+	.halt_reg = 0x8038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_byte0_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_byte0_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_byte1_clk = {
+	.halt_reg = 0x803c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x803c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_byte1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_byte1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_byte1_intf_clk = {
+	.halt_reg = 0x8040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_byte1_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_byte1_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx0_aux_clk = {
+	.halt_reg = 0x805c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x805c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx0_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx0_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx0_crypto_clk = {
+	.halt_reg = 0x8058,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8058,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx0_crypto_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx0_crypto_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx0_link_clk = {
+	.halt_reg = 0x804c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x804c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx0_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx0_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx0_link_intf_clk = {
+	.halt_reg = 0x8050,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8050,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx0_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx0_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx0_pixel0_clk = {
+	.halt_reg = 0x8060,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8060,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx0_pixel0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx0_pixel0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx0_pixel1_clk = {
+	.halt_reg = 0x8064,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx0_pixel1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx0_pixel1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx0_pixel2_clk = {
+	.halt_reg = 0x8264,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8264,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx0_pixel2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx0_pixel2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx0_pixel3_clk = {
+	.halt_reg = 0x8268,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8268,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx0_pixel3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx0_pixel3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx0_usb_router_link_intf_clk = {
+	.halt_reg = 0x8054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx0_usb_router_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx0_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx1_aux_clk = {
+	.halt_reg = 0x8080,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8080,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx1_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx1_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx1_crypto_clk = {
+	.halt_reg = 0x807c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x807c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx1_crypto_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx1_crypto_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx1_link_clk = {
+	.halt_reg = 0x8070,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8070,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx1_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx1_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx1_link_intf_clk = {
+	.halt_reg = 0x8074,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8074,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx1_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx1_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx1_pixel0_clk = {
+	.halt_reg = 0x8068,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8068,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx1_pixel0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx1_pixel0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx1_pixel1_clk = {
+	.halt_reg = 0x806c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x806c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx1_pixel1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx1_pixel1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_dptx1_usb_router_link_intf_clk = {
+	.halt_reg = 0x8078,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8078,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_dptx1_usb_router_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_dptx1_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_esc0_clk = {
+	.halt_reg = 0x8044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_esc0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_esc0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_esc1_clk = {
+	.halt_reg = 0x8048,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8048,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_esc1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_esc1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_mdp1_clk = {
+	.halt_reg = 0x8014,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_mdp1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_mdp_clk = {
+	.halt_reg = 0x800c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x800c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_mdp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_mdp_lut1_clk = {
+	.halt_reg = 0x8024,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x8024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_mdp_lut1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_mdp_lut_clk = {
+	.halt_reg = 0x801c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x801c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_mdp_lut_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_non_gdsc_ahb_clk = {
+	.halt_reg = 0xa004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xa004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_non_gdsc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_pclk0_clk = {
+	.halt_reg = 0x8004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_pclk0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_pclk0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_pclk1_clk = {
+	.halt_reg = 0x8008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_pclk1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_pclk1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_pll_lock_monitor_clk = {
+	.halt_reg = 0xe000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xe000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_pll_lock_monitor_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_rscc_ahb_clk = {
+	.halt_reg = 0xa00c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa00c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_rscc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_rscc_vsync_clk = {
+	.halt_reg = 0xa008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_rscc_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_vsync1_clk = {
+	.halt_reg = 0x8030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_vsync1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_mdss_vsync_clk = {
+	.halt_reg = 0x802c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x802c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_mdss_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_0_disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_0_disp_cc_sm_obs_clk = {
+	.halt_reg = 0x11014,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x11014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_0_disp_cc_sm_obs_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc mdss_0_disp_cc_mdss_core_gdsc = {
+	.gdscr = 0x9000,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "mdss_0_disp_cc_mdss_core_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE | HW_CTRL,
+};
+
+static struct gdsc mdss_0_disp_cc_mdss_core_int2_gdsc = {
+	.gdscr = 0xd000,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "mdss_0_disp_cc_mdss_core_int2_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE | HW_CTRL,
+};
+
+static struct clk_regmap *disp_cc_0_sa8775p_clocks[] = {
+	[MDSS_DISP_CC_MDSS_AHB1_CLK] = &mdss_0_disp_cc_mdss_ahb1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_AHB_CLK] = &mdss_0_disp_cc_mdss_ahb_clk.clkr,
+	[MDSS_DISP_CC_MDSS_AHB_CLK_SRC] = &mdss_0_disp_cc_mdss_ahb_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE0_CLK] = &mdss_0_disp_cc_mdss_byte0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE0_CLK_SRC] = &mdss_0_disp_cc_mdss_byte0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE0_DIV_CLK_SRC] = &mdss_0_disp_cc_mdss_byte0_div_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE0_INTF_CLK] = &mdss_0_disp_cc_mdss_byte0_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE1_CLK] = &mdss_0_disp_cc_mdss_byte1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE1_CLK_SRC] = &mdss_0_disp_cc_mdss_byte1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE1_DIV_CLK_SRC] = &mdss_0_disp_cc_mdss_byte1_div_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE1_INTF_CLK] = &mdss_0_disp_cc_mdss_byte1_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_AUX_CLK] = &mdss_0_disp_cc_mdss_dptx0_aux_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_AUX_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx0_aux_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_CRYPTO_CLK] = &mdss_0_disp_cc_mdss_dptx0_crypto_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_CRYPTO_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx0_crypto_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK] = &mdss_0_disp_cc_mdss_dptx0_link_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx0_link_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_LINK_DIV_CLK_SRC] =
+	      &mdss_0_disp_cc_mdss_dptx0_link_div_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_LINK_INTF_CLK] = &mdss_0_disp_cc_mdss_dptx0_link_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK] = &mdss_0_disp_cc_mdss_dptx0_pixel0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx0_pixel0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK] = &mdss_0_disp_cc_mdss_dptx0_pixel1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx0_pixel1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL2_CLK] = &mdss_0_disp_cc_mdss_dptx0_pixel2_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL2_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx0_pixel2_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL3_CLK] = &mdss_0_disp_cc_mdss_dptx0_pixel3_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL3_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx0_pixel3_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_USB_ROUTER_LINK_INTF_CLK] =
+	      &mdss_0_disp_cc_mdss_dptx0_usb_router_link_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_AUX_CLK] = &mdss_0_disp_cc_mdss_dptx1_aux_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_AUX_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx1_aux_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_CRYPTO_CLK] = &mdss_0_disp_cc_mdss_dptx1_crypto_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_CRYPTO_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx1_crypto_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_LINK_CLK] = &mdss_0_disp_cc_mdss_dptx1_link_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_LINK_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx1_link_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_LINK_DIV_CLK_SRC] =
+	      &mdss_0_disp_cc_mdss_dptx1_link_div_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_LINK_INTF_CLK] = &mdss_0_disp_cc_mdss_dptx1_link_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_PIXEL0_CLK] = &mdss_0_disp_cc_mdss_dptx1_pixel0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_PIXEL0_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx1_pixel0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_PIXEL1_CLK] = &mdss_0_disp_cc_mdss_dptx1_pixel1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_PIXEL1_CLK_SRC] = &mdss_0_disp_cc_mdss_dptx1_pixel1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_USB_ROUTER_LINK_INTF_CLK] =
+	      &mdss_0_disp_cc_mdss_dptx1_usb_router_link_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_ESC0_CLK] = &mdss_0_disp_cc_mdss_esc0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_ESC0_CLK_SRC] = &mdss_0_disp_cc_mdss_esc0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_ESC1_CLK] = &mdss_0_disp_cc_mdss_esc1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_ESC1_CLK_SRC] = &mdss_0_disp_cc_mdss_esc1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_MDP1_CLK] = &mdss_0_disp_cc_mdss_mdp1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_MDP_CLK] = &mdss_0_disp_cc_mdss_mdp_clk.clkr,
+	[MDSS_DISP_CC_MDSS_MDP_CLK_SRC] = &mdss_0_disp_cc_mdss_mdp_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_MDP_LUT1_CLK] = &mdss_0_disp_cc_mdss_mdp_lut1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_MDP_LUT_CLK] = &mdss_0_disp_cc_mdss_mdp_lut_clk.clkr,
+	[MDSS_DISP_CC_MDSS_NON_GDSC_AHB_CLK] = &mdss_0_disp_cc_mdss_non_gdsc_ahb_clk.clkr,
+	[MDSS_DISP_CC_MDSS_PCLK0_CLK] = &mdss_0_disp_cc_mdss_pclk0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_PCLK0_CLK_SRC] = &mdss_0_disp_cc_mdss_pclk0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_PCLK1_CLK] = &mdss_0_disp_cc_mdss_pclk1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_PCLK1_CLK_SRC] = &mdss_0_disp_cc_mdss_pclk1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_PLL_LOCK_MONITOR_CLK] = &mdss_0_disp_cc_mdss_pll_lock_monitor_clk.clkr,
+	[MDSS_DISP_CC_MDSS_RSCC_AHB_CLK] = &mdss_0_disp_cc_mdss_rscc_ahb_clk.clkr,
+	[MDSS_DISP_CC_MDSS_RSCC_VSYNC_CLK] = &mdss_0_disp_cc_mdss_rscc_vsync_clk.clkr,
+	[MDSS_DISP_CC_MDSS_VSYNC1_CLK] = &mdss_0_disp_cc_mdss_vsync1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_VSYNC_CLK] = &mdss_0_disp_cc_mdss_vsync_clk.clkr,
+	[MDSS_DISP_CC_MDSS_VSYNC_CLK_SRC] = &mdss_0_disp_cc_mdss_vsync_clk_src.clkr,
+	[MDSS_DISP_CC_PLL0] = &mdss_0_disp_cc_pll0.clkr,
+	[MDSS_DISP_CC_PLL1] = &mdss_0_disp_cc_pll1.clkr,
+	[MDSS_DISP_CC_SLEEP_CLK_SRC] = &mdss_0_disp_cc_sleep_clk_src.clkr,
+	[MDSS_DISP_CC_SM_OBS_CLK] = &mdss_0_disp_cc_sm_obs_clk.clkr,
+	[MDSS_DISP_CC_XO_CLK_SRC] = &mdss_0_disp_cc_xo_clk_src.clkr,
+};
+
+static struct gdsc *disp_cc_0_sa8775p_gdscs[] = {
+	[MDSS_DISP_CC_MDSS_CORE_GDSC] = &mdss_0_disp_cc_mdss_core_gdsc,
+	[MDSS_DISP_CC_MDSS_CORE_INT2_GDSC] = &mdss_0_disp_cc_mdss_core_int2_gdsc,
+};
+
+static const struct qcom_reset_map disp_cc_0_sa8775p_resets[] = {
+	[MDSS_DISP_CC_MDSS_CORE_BCR] = { 0x8000 },
+	[MDSS_DISP_CC_MDSS_RSCC_BCR] = { 0xa000 },
+};
+
+static const struct regmap_config disp_cc_0_sa8775p_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0x12414,
+	.fast_io = true,
+};
+
+static struct qcom_cc_desc disp_cc_0_sa8775p_desc = {
+	.config = &disp_cc_0_sa8775p_regmap_config,
+	.clks = disp_cc_0_sa8775p_clocks,
+	.num_clks = ARRAY_SIZE(disp_cc_0_sa8775p_clocks),
+	.resets = disp_cc_0_sa8775p_resets,
+	.num_resets = ARRAY_SIZE(disp_cc_0_sa8775p_resets),
+	.gdscs = disp_cc_0_sa8775p_gdscs,
+	.num_gdscs = ARRAY_SIZE(disp_cc_0_sa8775p_gdscs),
+};
+
+static const struct of_device_id disp_cc_0_sa8775p_match_table[] = {
+	{ .compatible = "qcom,sa8775p-dispcc0" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, disp_cc_0_sa8775p_match_table);
+
+static int disp_cc_0_sa8775p_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+	int ret;
+
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		return ret;
+
+	ret = pm_runtime_resume_and_get(&pdev->dev);
+	if (ret)
+		return ret;
+
+	regmap = qcom_cc_map(pdev, &disp_cc_0_sa8775p_desc);
+	if (IS_ERR(regmap)) {
+		pm_runtime_put(&pdev->dev);
+		return PTR_ERR(regmap);
+	}
+
+	clk_lucid_evo_pll_configure(&mdss_0_disp_cc_pll0, regmap, &mdss_0_disp_cc_pll0_config);
+	clk_lucid_evo_pll_configure(&mdss_0_disp_cc_pll1, regmap, &mdss_0_disp_cc_pll1_config);
+
+	/*
+	 * Keep clocks always enabled:
+	 *	mdss_0_disp_cc_sleep_clk
+	 *	mdss_0_disp_cc_xo_clk
+	 * Use qcom_clk_set_en()
+	 */
+	regmap_update_bits(regmap, 0xc070, BIT(0), BIT(0));
+	regmap_update_bits(regmap, 0xc054, BIT(0), BIT(0));
+
+	ret = qcom_cc_really_probe(&pdev->dev, &disp_cc_0_sa8775p_desc, regmap);
+
+	pm_runtime_put(&pdev->dev);
+
+	return ret;
+}
+
+static struct platform_driver disp_cc_0_sa8775p_driver = {
+	.probe = disp_cc_0_sa8775p_probe,
+	.driver = {
+		.name = "dispcc0-sa8775p",
+		.of_match_table = disp_cc_0_sa8775p_match_table,
+	},
+};
+
+module_platform_driver(disp_cc_0_sa8775p_driver);
+
+MODULE_DESCRIPTION("QTI DISPCC0 SA8775P Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/dispcc1-sa8775p.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/dispcc1-sa8775p.c
@@ -0,0 +1,1495 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,sa8775p-dispcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_IFACE,
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+	DT_SLEEP_CLK,
+	DT_DP0_PHY_PLL_LINK_CLK,
+	DT_DP0_PHY_PLL_VCO_DIV_CLK,
+	DT_DP1_PHY_PLL_LINK_CLK,
+	DT_DP1_PHY_PLL_VCO_DIV_CLK,
+	DT_DSI0_PHY_PLL_OUT_BYTECLK,
+	DT_DSI0_PHY_PLL_OUT_DSICLK,
+	DT_DSI1_PHY_PLL_OUT_BYTECLK,
+	DT_DSI1_PHY_PLL_OUT_DSICLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_DP0_PHY_PLL_LINK_CLK,
+	P_DP0_PHY_PLL_VCO_DIV_CLK,
+	P_DP1_PHY_PLL_LINK_CLK,
+	P_DP1_PHY_PLL_VCO_DIV_CLK,
+	P_DSI0_PHY_PLL_OUT_BYTECLK,
+	P_DSI0_PHY_PLL_OUT_DSICLK,
+	P_DSI1_PHY_PLL_OUT_BYTECLK,
+	P_DSI1_PHY_PLL_OUT_DSICLK,
+	P_MDSS_1_DISP_CC_PLL0_OUT_MAIN,
+	P_MDSS_1_DISP_CC_PLL1_OUT_EVEN,
+	P_MDSS_1_DISP_CC_PLL1_OUT_MAIN,
+	P_SLEEP_CLK,
+};
+
+static const struct pll_vco lucid_evo_vco[] = {
+	{ 249600000, 2020000000, 0 },
+};
+
+static const struct alpha_pll_config mdss_1_disp_cc_pll0_config = {
+	.l = 0x3a,
+	.alpha = 0x9800,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll mdss_1_disp_cc_pll0 = {
+	.offset = 0x0,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct alpha_pll_config mdss_1_disp_cc_pll1_config = {
+	.l = 0x1f,
+	.alpha = 0x4000,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll mdss_1_disp_cc_pll1 = {
+	.offset = 0x1000,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_pll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct parent_map disp_cc_1_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DP0_PHY_PLL_LINK_CLK, 1 },
+	{ P_DP0_PHY_PLL_VCO_DIV_CLK, 2 },
+	{ P_DP1_PHY_PLL_VCO_DIV_CLK, 4 },
+};
+
+static const struct clk_parent_data disp_cc_1_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DP0_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP0_PHY_PLL_VCO_DIV_CLK },
+	{ .index = DT_DP1_PHY_PLL_VCO_DIV_CLK },
+};
+
+static const struct parent_map disp_cc_1_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_DSICLK, 1 },
+	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 2 },
+	{ P_DSI1_PHY_PLL_OUT_DSICLK, 3 },
+	{ P_DSI1_PHY_PLL_OUT_BYTECLK, 4 },
+};
+
+static const struct clk_parent_data disp_cc_1_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_DSICLK },
+	{ .index = DT_DSI0_PHY_PLL_OUT_BYTECLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_DSICLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_BYTECLK },
+};
+
+static const struct parent_map disp_cc_1_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data disp_cc_1_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct clk_parent_data disp_cc_1_parent_data_2_ao[] = {
+	{ .index = DT_BI_TCXO_AO },
+};
+
+static const struct parent_map disp_cc_1_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DP0_PHY_PLL_LINK_CLK, 1 },
+	{ P_DP1_PHY_PLL_LINK_CLK, 2 },
+};
+
+static const struct clk_parent_data disp_cc_1_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DP0_PHY_PLL_LINK_CLK },
+	{ .index = DT_DP1_PHY_PLL_LINK_CLK },
+};
+
+static const struct parent_map disp_cc_1_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_DSI0_PHY_PLL_OUT_BYTECLK, 2 },
+	{ P_DSI1_PHY_PLL_OUT_BYTECLK, 4 },
+};
+
+static const struct clk_parent_data disp_cc_1_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_DSI0_PHY_PLL_OUT_BYTECLK },
+	{ .index = DT_DSI1_PHY_PLL_OUT_BYTECLK },
+};
+
+static const struct parent_map disp_cc_1_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_MDSS_1_DISP_CC_PLL1_OUT_MAIN, 4 },
+	{ P_MDSS_1_DISP_CC_PLL1_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data disp_cc_1_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &mdss_1_disp_cc_pll1.clkr.hw },
+	{ .hw = &mdss_1_disp_cc_pll1.clkr.hw },
+};
+
+static const struct parent_map disp_cc_1_parent_map_6[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_MDSS_1_DISP_CC_PLL0_OUT_MAIN, 1 },
+	{ P_MDSS_1_DISP_CC_PLL1_OUT_MAIN, 4 },
+	{ P_MDSS_1_DISP_CC_PLL1_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data disp_cc_1_parent_data_6[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &mdss_1_disp_cc_pll0.clkr.hw },
+	{ .hw = &mdss_1_disp_cc_pll1.clkr.hw },
+	{ .hw = &mdss_1_disp_cc_pll1.clkr.hw },
+};
+
+static const struct parent_map disp_cc_1_parent_map_7[] = {
+	{ P_SLEEP_CLK, 0 },
+};
+
+static const struct clk_parent_data disp_cc_1_parent_data_7_ao[] = {
+	{ .index = DT_SLEEP_CLK },
+};
+
+static const struct freq_tbl ftbl_mdss_1_disp_cc_mdss_ahb_clk_src[] = {
+	F(37500000, P_MDSS_1_DISP_CC_PLL1_OUT_MAIN, 16, 0, 0),
+	F(75000000, P_MDSS_1_DISP_CC_PLL1_OUT_MAIN, 8, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_ahb_clk_src = {
+	.cmd_rcgr = 0x824c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_5,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_ahb_clk_src",
+		.parent_data = disp_cc_1_parent_data_5,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_5),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_mdss_1_disp_cc_mdss_byte0_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_byte0_clk_src = {
+	.cmd_rcgr = 0x80ec,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_1,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_byte0_clk_src",
+		.parent_data = disp_cc_1_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_byte1_clk_src = {
+	.cmd_rcgr = 0x8108,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_1,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_byte1_clk_src",
+		.parent_data = disp_cc_1_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx0_aux_clk_src = {
+	.cmd_rcgr = 0x81b8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_2,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx0_aux_clk_src",
+		.parent_data = disp_cc_1_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx0_crypto_clk_src = {
+	.cmd_rcgr = 0x8170,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_3,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx0_crypto_clk_src",
+		.parent_data = disp_cc_1_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx0_link_clk_src = {
+	.cmd_rcgr = 0x8154,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_3,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx0_link_clk_src",
+		.parent_data = disp_cc_1_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx0_pixel0_clk_src = {
+	.cmd_rcgr = 0x8188,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_0,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx0_pixel0_clk_src",
+		.parent_data = disp_cc_1_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx0_pixel1_clk_src = {
+	.cmd_rcgr = 0x81a0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_0,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx0_pixel1_clk_src",
+		.parent_data = disp_cc_1_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx0_pixel2_clk_src = {
+	.cmd_rcgr = 0x826c,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_0,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx0_pixel2_clk_src",
+		.parent_data = disp_cc_1_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx0_pixel3_clk_src = {
+	.cmd_rcgr = 0x8284,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_0,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx0_pixel3_clk_src",
+		.parent_data = disp_cc_1_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx1_aux_clk_src = {
+	.cmd_rcgr = 0x8234,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_2,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx1_aux_clk_src",
+		.parent_data = disp_cc_1_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx1_crypto_clk_src = {
+	.cmd_rcgr = 0x821c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_3,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx1_crypto_clk_src",
+		.parent_data = disp_cc_1_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx1_link_clk_src = {
+	.cmd_rcgr = 0x8200,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_3,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx1_link_clk_src",
+		.parent_data = disp_cc_1_parent_data_3,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_byte2_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx1_pixel0_clk_src = {
+	.cmd_rcgr = 0x81d0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_0,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx1_pixel0_clk_src",
+		.parent_data = disp_cc_1_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_dptx1_pixel1_clk_src = {
+	.cmd_rcgr = 0x81e8,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_0,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx1_pixel1_clk_src",
+		.parent_data = disp_cc_1_parent_data_0,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_dp_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_esc0_clk_src = {
+	.cmd_rcgr = 0x8124,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_4,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_esc0_clk_src",
+		.parent_data = disp_cc_1_parent_data_4,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_esc1_clk_src = {
+	.cmd_rcgr = 0x813c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_4,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_esc1_clk_src",
+		.parent_data = disp_cc_1_parent_data_4,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_4),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_mdss_1_disp_cc_mdss_mdp_clk_src[] = {
+	F(375000000, P_MDSS_1_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(500000000, P_MDSS_1_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(575000000, P_MDSS_1_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	F(650000000, P_MDSS_1_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_mdp_clk_src = {
+	.cmd_rcgr = 0x80bc,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_6,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_mdp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_mdp_clk_src",
+		.parent_data = disp_cc_1_parent_data_6,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_6),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_pclk0_clk_src = {
+	.cmd_rcgr = 0x808c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_1,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_pclk0_clk_src",
+		.parent_data = disp_cc_1_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_pixel_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_pclk1_clk_src = {
+	.cmd_rcgr = 0x80a4,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_1,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_pclk1_clk_src",
+		.parent_data = disp_cc_1_parent_data_1,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_pixel_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_mdss_vsync_clk_src = {
+	.cmd_rcgr = 0x80d4,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_2,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_vsync_clk_src",
+		.parent_data = disp_cc_1_parent_data_2,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_mdss_1_disp_cc_sleep_clk_src[] = {
+	F(32000, P_SLEEP_CLK, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_sleep_clk_src = {
+	.cmd_rcgr = 0xc058,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_7,
+	.freq_tbl = ftbl_mdss_1_disp_cc_sleep_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_sleep_clk_src",
+		.parent_data = disp_cc_1_parent_data_7_ao,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_7_ao),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 mdss_1_disp_cc_xo_clk_src = {
+	.cmd_rcgr = 0xc03c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = disp_cc_1_parent_map_2,
+	.freq_tbl = ftbl_mdss_1_disp_cc_mdss_byte0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_xo_clk_src",
+		.parent_data = disp_cc_1_parent_data_2_ao,
+		.num_parents = ARRAY_SIZE(disp_cc_1_parent_data_2_ao),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_regmap_div mdss_1_disp_cc_mdss_byte0_div_clk_src = {
+	.reg = 0x8104,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_byte0_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&mdss_1_disp_cc_mdss_byte0_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ops,
+	},
+};
+
+static struct clk_regmap_div mdss_1_disp_cc_mdss_byte1_div_clk_src = {
+	.reg = 0x8120,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_byte1_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&mdss_1_disp_cc_mdss_byte1_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ops,
+	},
+};
+
+static struct clk_regmap_div mdss_1_disp_cc_mdss_dptx0_link_div_clk_src = {
+	.reg = 0x816c,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx0_link_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&mdss_1_disp_cc_mdss_dptx0_link_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div mdss_1_disp_cc_mdss_dptx1_link_div_clk_src = {
+	.reg = 0x8218,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "mdss_1_disp_cc_mdss_dptx1_link_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&mdss_1_disp_cc_mdss_dptx1_link_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_ahb1_clk = {
+	.halt_reg = 0x8088,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8088,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_ahb1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_ahb_clk = {
+	.halt_reg = 0x8084,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8084,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_byte0_clk = {
+	.halt_reg = 0x8034,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8034,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_byte0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_byte0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_byte0_intf_clk = {
+	.halt_reg = 0x8038,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_byte0_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_byte0_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_byte1_clk = {
+	.halt_reg = 0x803c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x803c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_byte1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_byte1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_byte1_intf_clk = {
+	.halt_reg = 0x8040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_byte1_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_byte1_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx0_aux_clk = {
+	.halt_reg = 0x805c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x805c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx0_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx0_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx0_crypto_clk = {
+	.halt_reg = 0x8058,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8058,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx0_crypto_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx0_crypto_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx0_link_clk = {
+	.halt_reg = 0x804c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x804c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx0_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx0_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx0_link_intf_clk = {
+	.halt_reg = 0x8050,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8050,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx0_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx0_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx0_pixel0_clk = {
+	.halt_reg = 0x8060,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8060,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx0_pixel0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx0_pixel0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx0_pixel1_clk = {
+	.halt_reg = 0x8064,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx0_pixel1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx0_pixel1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx0_pixel2_clk = {
+	.halt_reg = 0x8264,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8264,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx0_pixel2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx0_pixel2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx0_pixel3_clk = {
+	.halt_reg = 0x8268,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8268,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx0_pixel3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx0_pixel3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx0_usb_router_link_intf_clk = {
+	.halt_reg = 0x8054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx0_usb_router_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx0_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx1_aux_clk = {
+	.halt_reg = 0x8080,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8080,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx1_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx1_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx1_crypto_clk = {
+	.halt_reg = 0x807c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x807c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx1_crypto_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx1_crypto_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx1_link_clk = {
+	.halt_reg = 0x8070,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8070,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx1_link_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx1_link_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx1_link_intf_clk = {
+	.halt_reg = 0x8074,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8074,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx1_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx1_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx1_pixel0_clk = {
+	.halt_reg = 0x8068,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8068,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx1_pixel0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx1_pixel0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx1_pixel1_clk = {
+	.halt_reg = 0x806c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x806c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx1_pixel1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx1_pixel1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_dptx1_usb_router_link_intf_clk = {
+	.halt_reg = 0x8078,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8078,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_dptx1_usb_router_link_intf_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_dptx1_link_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_esc0_clk = {
+	.halt_reg = 0x8044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_esc0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_esc0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_esc1_clk = {
+	.halt_reg = 0x8048,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8048,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_esc1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_esc1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_mdp1_clk = {
+	.halt_reg = 0x8014,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_mdp1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_mdp_clk = {
+	.halt_reg = 0x800c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x800c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_mdp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_mdp_lut1_clk = {
+	.halt_reg = 0x8024,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x8024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_mdp_lut1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_mdp_lut_clk = {
+	.halt_reg = 0x801c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x801c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_mdp_lut_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_mdp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_non_gdsc_ahb_clk = {
+	.halt_reg = 0xa004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xa004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_non_gdsc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_pclk0_clk = {
+	.halt_reg = 0x8004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_pclk0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_pclk0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_pclk1_clk = {
+	.halt_reg = 0x8008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_pclk1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_pclk1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_pll_lock_monitor_clk = {
+	.halt_reg = 0xe000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xe000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_pll_lock_monitor_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_rscc_ahb_clk = {
+	.halt_reg = 0xa00c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa00c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_rscc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_rscc_vsync_clk = {
+	.halt_reg = 0xa008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_rscc_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_vsync1_clk = {
+	.halt_reg = 0x8030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_vsync1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_mdss_vsync_clk = {
+	.halt_reg = 0x802c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x802c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_mdss_vsync_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&mdss_1_disp_cc_mdss_vsync_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch mdss_1_disp_cc_sm_obs_clk = {
+	.halt_reg = 0x11014,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x11014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "mdss_1_disp_cc_sm_obs_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc mdss_1_disp_cc_mdss_core_gdsc = {
+	.gdscr = 0x9000,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "mdss_1_disp_cc_mdss_core_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE | HW_CTRL,
+};
+
+static struct gdsc mdss_1_disp_cc_mdss_core_int2_gdsc = {
+	.gdscr = 0xd000,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "mdss_1_disp_cc_mdss_core_int2_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE | HW_CTRL,
+};
+
+static struct clk_regmap *disp_cc_1_sa8775p_clocks[] = {
+	[MDSS_DISP_CC_MDSS_AHB1_CLK] = &mdss_1_disp_cc_mdss_ahb1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_AHB_CLK] = &mdss_1_disp_cc_mdss_ahb_clk.clkr,
+	[MDSS_DISP_CC_MDSS_AHB_CLK_SRC] = &mdss_1_disp_cc_mdss_ahb_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE0_CLK] = &mdss_1_disp_cc_mdss_byte0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE0_CLK_SRC] = &mdss_1_disp_cc_mdss_byte0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE0_DIV_CLK_SRC] = &mdss_1_disp_cc_mdss_byte0_div_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE0_INTF_CLK] = &mdss_1_disp_cc_mdss_byte0_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE1_CLK] = &mdss_1_disp_cc_mdss_byte1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE1_CLK_SRC] = &mdss_1_disp_cc_mdss_byte1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE1_DIV_CLK_SRC] = &mdss_1_disp_cc_mdss_byte1_div_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_BYTE1_INTF_CLK] = &mdss_1_disp_cc_mdss_byte1_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_AUX_CLK] = &mdss_1_disp_cc_mdss_dptx0_aux_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_AUX_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx0_aux_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_CRYPTO_CLK] = &mdss_1_disp_cc_mdss_dptx0_crypto_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_CRYPTO_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx0_crypto_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK] = &mdss_1_disp_cc_mdss_dptx0_link_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx0_link_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_LINK_DIV_CLK_SRC] =
+	      &mdss_1_disp_cc_mdss_dptx0_link_div_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_LINK_INTF_CLK] = &mdss_1_disp_cc_mdss_dptx0_link_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK] = &mdss_1_disp_cc_mdss_dptx0_pixel0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx0_pixel0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK] = &mdss_1_disp_cc_mdss_dptx0_pixel1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx0_pixel1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL2_CLK] = &mdss_1_disp_cc_mdss_dptx0_pixel2_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL2_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx0_pixel2_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL3_CLK] = &mdss_1_disp_cc_mdss_dptx0_pixel3_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_PIXEL3_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx0_pixel3_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX0_USB_ROUTER_LINK_INTF_CLK] =
+	      &mdss_1_disp_cc_mdss_dptx0_usb_router_link_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_AUX_CLK] = &mdss_1_disp_cc_mdss_dptx1_aux_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_AUX_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx1_aux_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_CRYPTO_CLK] = &mdss_1_disp_cc_mdss_dptx1_crypto_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_CRYPTO_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx1_crypto_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_LINK_CLK] = &mdss_1_disp_cc_mdss_dptx1_link_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_LINK_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx1_link_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_LINK_DIV_CLK_SRC] =
+	      &mdss_1_disp_cc_mdss_dptx1_link_div_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_LINK_INTF_CLK] = &mdss_1_disp_cc_mdss_dptx1_link_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_PIXEL0_CLK] = &mdss_1_disp_cc_mdss_dptx1_pixel0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_PIXEL0_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx1_pixel0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_PIXEL1_CLK] = &mdss_1_disp_cc_mdss_dptx1_pixel1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_PIXEL1_CLK_SRC] = &mdss_1_disp_cc_mdss_dptx1_pixel1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_DPTX1_USB_ROUTER_LINK_INTF_CLK] =
+	      &mdss_1_disp_cc_mdss_dptx1_usb_router_link_intf_clk.clkr,
+	[MDSS_DISP_CC_MDSS_ESC0_CLK] = &mdss_1_disp_cc_mdss_esc0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_ESC0_CLK_SRC] = &mdss_1_disp_cc_mdss_esc0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_ESC1_CLK] = &mdss_1_disp_cc_mdss_esc1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_ESC1_CLK_SRC] = &mdss_1_disp_cc_mdss_esc1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_MDP1_CLK] = &mdss_1_disp_cc_mdss_mdp1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_MDP_CLK] = &mdss_1_disp_cc_mdss_mdp_clk.clkr,
+	[MDSS_DISP_CC_MDSS_MDP_CLK_SRC] = &mdss_1_disp_cc_mdss_mdp_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_MDP_LUT1_CLK] = &mdss_1_disp_cc_mdss_mdp_lut1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_MDP_LUT_CLK] = &mdss_1_disp_cc_mdss_mdp_lut_clk.clkr,
+	[MDSS_DISP_CC_MDSS_NON_GDSC_AHB_CLK] = &mdss_1_disp_cc_mdss_non_gdsc_ahb_clk.clkr,
+	[MDSS_DISP_CC_MDSS_PCLK0_CLK] = &mdss_1_disp_cc_mdss_pclk0_clk.clkr,
+	[MDSS_DISP_CC_MDSS_PCLK0_CLK_SRC] = &mdss_1_disp_cc_mdss_pclk0_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_PCLK1_CLK] = &mdss_1_disp_cc_mdss_pclk1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_PCLK1_CLK_SRC] = &mdss_1_disp_cc_mdss_pclk1_clk_src.clkr,
+	[MDSS_DISP_CC_MDSS_PLL_LOCK_MONITOR_CLK] = &mdss_1_disp_cc_mdss_pll_lock_monitor_clk.clkr,
+	[MDSS_DISP_CC_MDSS_RSCC_AHB_CLK] = &mdss_1_disp_cc_mdss_rscc_ahb_clk.clkr,
+	[MDSS_DISP_CC_MDSS_RSCC_VSYNC_CLK] = &mdss_1_disp_cc_mdss_rscc_vsync_clk.clkr,
+	[MDSS_DISP_CC_MDSS_VSYNC1_CLK] = &mdss_1_disp_cc_mdss_vsync1_clk.clkr,
+	[MDSS_DISP_CC_MDSS_VSYNC_CLK] = &mdss_1_disp_cc_mdss_vsync_clk.clkr,
+	[MDSS_DISP_CC_MDSS_VSYNC_CLK_SRC] = &mdss_1_disp_cc_mdss_vsync_clk_src.clkr,
+	[MDSS_DISP_CC_PLL0] = &mdss_1_disp_cc_pll0.clkr,
+	[MDSS_DISP_CC_PLL1] = &mdss_1_disp_cc_pll1.clkr,
+	[MDSS_DISP_CC_SLEEP_CLK_SRC] = &mdss_1_disp_cc_sleep_clk_src.clkr,
+	[MDSS_DISP_CC_SM_OBS_CLK] = &mdss_1_disp_cc_sm_obs_clk.clkr,
+	[MDSS_DISP_CC_XO_CLK_SRC] = &mdss_1_disp_cc_xo_clk_src.clkr,
+};
+
+static struct gdsc *disp_cc_1_sa8775p_gdscs[] = {
+	[MDSS_DISP_CC_MDSS_CORE_GDSC] = &mdss_1_disp_cc_mdss_core_gdsc,
+	[MDSS_DISP_CC_MDSS_CORE_INT2_GDSC] = &mdss_1_disp_cc_mdss_core_int2_gdsc,
+};
+
+static const struct qcom_reset_map disp_cc_1_sa8775p_resets[] = {
+	[MDSS_DISP_CC_MDSS_CORE_BCR] = { 0x8000 },
+	[MDSS_DISP_CC_MDSS_RSCC_BCR] = { 0xa000 },
+};
+
+static const struct regmap_config disp_cc_1_sa8775p_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0x12414,
+	.fast_io = true,
+};
+
+static struct qcom_cc_desc disp_cc_1_sa8775p_desc = {
+	.config = &disp_cc_1_sa8775p_regmap_config,
+	.clks = disp_cc_1_sa8775p_clocks,
+	.num_clks = ARRAY_SIZE(disp_cc_1_sa8775p_clocks),
+	.resets = disp_cc_1_sa8775p_resets,
+	.num_resets = ARRAY_SIZE(disp_cc_1_sa8775p_resets),
+	.gdscs = disp_cc_1_sa8775p_gdscs,
+	.num_gdscs = ARRAY_SIZE(disp_cc_1_sa8775p_gdscs),
+};
+
+static const struct of_device_id disp_cc_1_sa8775p_match_table[] = {
+	{ .compatible = "qcom,sa8775p-dispcc1" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, disp_cc_1_sa8775p_match_table);
+
+static int disp_cc_1_sa8775p_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+	int ret;
+
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		return ret;
+
+	ret = pm_runtime_resume_and_get(&pdev->dev);
+	if (ret)
+		return ret;
+
+	regmap = qcom_cc_map(pdev, &disp_cc_1_sa8775p_desc);
+	if (IS_ERR(regmap)) {
+		pm_runtime_put(&pdev->dev);
+		return PTR_ERR(regmap);
+	}
+
+	clk_lucid_evo_pll_configure(&mdss_1_disp_cc_pll0, regmap, &mdss_1_disp_cc_pll0_config);
+	clk_lucid_evo_pll_configure(&mdss_1_disp_cc_pll1, regmap, &mdss_1_disp_cc_pll1_config);
+
+	/*
+	 * Keep clocks always enabled:
+	 *	mdss_1_disp_cc_sleep_clk
+	 *	mdss_1_disp_cc_xo_clk
+	 */
+	regmap_update_bits(regmap, 0xc070, BIT(0), BIT(0));
+	regmap_update_bits(regmap, 0xc054, BIT(0), BIT(0));
+
+	/*
+	 * Reparent below clocks to XO
+	 *	mdss_1_disp_cc_mdss_dptx0_crypto_clk_src
+	 *	mdss_1_disp_cc_mdss_dptx1_crypto_clk_src
+	 */
+	regmap_write(regmap, 0x8174, 0x0);
+	regmap_update_bits(regmap, 0x8170, BIT(0), BIT(0));
+	regmap_write(regmap, 0x8220, 0x0);
+	regmap_update_bits(regmap, 0x821c, BIT(0), BIT(0));
+
+	ret = qcom_cc_really_probe(&pdev->dev, &disp_cc_1_sa8775p_desc, regmap);
+
+	pm_runtime_put(&pdev->dev);
+
+	return ret;
+}
+
+static struct platform_driver disp_cc_1_sa8775p_driver = {
+	.probe = disp_cc_1_sa8775p_probe,
+	.driver = {
+		.name = "dispcc1-sa8775p",
+		.of_match_table = disp_cc_1_sa8775p_match_table,
+	},
+};
+
+module_platform_driver(disp_cc_1_sa8775p_driver);
+
+MODULE_DESCRIPTION("QTI DISPCC1 SA8775P Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/ecpricc-qdu1000.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/ecpricc-qdu1000.c
@@ -2439,7 +2439,7 @@
 	clk_lucid_evo_pll_configure(&ecpri_cc_pll0, regmap, &ecpri_cc_pll0_config);
 	clk_lucid_evo_pll_configure(&ecpri_cc_pll1, regmap, &ecpri_cc_pll1_config);
 
-	return qcom_cc_really_probe(pdev, &ecpri_cc_qdu1000_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &ecpri_cc_qdu1000_desc, regmap);
 }
 
 static struct platform_driver ecpri_cc_qdu1000_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-ipq5018.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-ipq5018.c
@@ -857,6 +857,7 @@
 
 static const struct freq_tbl ftbl_pcie0_aux_clk_src[] = {
 	F(2000000, P_XO, 12, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 pcie0_aux_clk_src = {
@@ -1099,6 +1100,7 @@
 	F(100000000, P_GPLL0, 8, 0, 0),
 	F(200000000, P_GPLL0, 4, 0, 0),
 	F(320000000, P_GPLL0, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 qpic_io_macro_clk_src = {
@@ -1194,6 +1196,7 @@
 static const struct freq_tbl ftbl_ubi0_core_clk_src[] = {
 	F(850000000, P_UBI32_PLL, 1, 0, 0),
 	F(1000000000, P_UBI32_PLL, 1, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 ubi0_core_clk_src = {
@@ -1754,7 +1757,7 @@
 	.halt_check = BRANCH_HALT_DELAY,
 	.halt_bit = 31,
 	.clkr = {
-		.enable_reg = 0x683190,
+		.enable_reg = 0x68190,
 		.enable_mask = BIT(0),
 		.hw.init = &(struct clk_init_data) {
 			.name = "gcc_gmac0_sys_clk",
@@ -2180,7 +2183,7 @@
 };
 
 static struct clk_branch gcc_pcie1_pipe_clk = {
-	.halt_reg = 8,
+	.halt_reg = 0x76018,
 	.halt_check = BRANCH_HALT_DELAY,
 	.halt_bit = 31,
 	.clkr = {
@@ -3632,7 +3635,7 @@
 	[GCC_SYSTEM_NOC_BCR] = { 0x26000, 0 },
 	[GCC_TCSR_BCR] = { 0x28000, 0 },
 	[GCC_TLMM_BCR] = { 0x34000, 0 },
-	[GCC_UBI0_AXI_ARES] = { 0x680},
+	[GCC_UBI0_AXI_ARES] = { 0x68010, 0 },
 	[GCC_UBI0_AHB_ARES] = { 0x68010, 1 },
 	[GCC_UBI0_NC_AXI_ARES] = { 0x68010, 2 },
 	[GCC_UBI0_DBG_ARES] = { 0x68010, 3 },
@@ -3695,7 +3698,7 @@
 
 	clk_alpha_pll_configure(&ubi32_pll_main, regmap, &ubi32_pll_config);
 
-	return qcom_cc_really_probe(pdev, &ipq5018_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &ipq5018_desc, regmap);
 }
 
 static struct platform_driver gcc_ipq5018_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-ipq5332.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-ipq5332.c
@@ -3388,6 +3388,7 @@
 	[GCC_QDSS_DAP_DIV_CLK_SRC] = &gcc_qdss_dap_div_clk_src.clkr,
 	[GCC_QDSS_ETR_USB_CLK] = &gcc_qdss_etr_usb_clk.clkr,
 	[GCC_QDSS_EUD_AT_CLK] = &gcc_qdss_eud_at_clk.clkr,
+	[GCC_QDSS_TSCTR_CLK_SRC] = &gcc_qdss_tsctr_clk_src.clkr,
 	[GCC_QPIC_AHB_CLK] = &gcc_qpic_ahb_clk.clkr,
 	[GCC_QPIC_CLK] = &gcc_qpic_clk.clkr,
 	[GCC_QPIC_IO_MACRO_CLK] = &gcc_qpic_io_macro_clk.clkr,
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-ipq6018.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-ipq6018.c
@@ -1554,6 +1554,7 @@
 
 static const struct freq_tbl ftbl_pcie_aux_clk_src[] = {
 	F(24000000, P_XO, 1, 0, 0),
+	{ }
 };
 
 static const struct clk_parent_data gcc_xo_gpll0_core_pi_sleep_clk[] = {
@@ -1734,6 +1735,7 @@
 	F(160000000, P_GPLL0, 5, 0, 0),
 	F(216000000, P_GPLL6, 5, 0, 0),
 	F(308570000, P_GPLL6, 3.5, 0, 0),
+	{ }
 };
 
 static const struct clk_parent_data gcc_xo_gpll0_gpll6_gpll0_div2[] = {
@@ -4623,7 +4625,7 @@
 	clk_alpha_pll_configure(&nss_crypto_pll_main, regmap,
 				&nss_crypto_pll_config);
 
-	return qcom_cc_really_probe(pdev, &gcc_ipq6018_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_ipq6018_desc, regmap);
 }
 
 static struct platform_driver gcc_ipq6018_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-ipq8074.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-ipq8074.c
@@ -644,6 +644,7 @@
 
 static const struct freq_tbl ftbl_pcie_aux_clk_src[] = {
 	F(19200000, P_XO, 1, 0, 0),
+	{ }
 };
 
 static const struct clk_parent_data gcc_xo_gpll0_sleep_clk[] = {
@@ -795,6 +796,7 @@
 	F(19200000, P_XO, 1, 0, 0),
 	F(160000000, P_GPLL0, 5, 0, 0),
 	F(308570000, P_GPLL6, 3.5, 0, 0),
+	{ }
 };
 
 static const struct clk_parent_data gcc_xo_gpll0_gpll6_gpll0_div2[] = {
@@ -4726,7 +4728,7 @@
 	clk_alpha_pll_configure(&nss_crypto_pll_main, regmap,
 				&nss_crypto_pll_config);
 
-	return qcom_cc_really_probe(pdev, &gcc_ipq8074_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_ipq8074_desc, regmap);
 }
 
 static struct platform_driver gcc_ipq8074_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-ipq9574.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-ipq9574.c
@@ -65,7 +65,7 @@
 
 static struct clk_alpha_pll gpll0_main = {
 	.offset = 0x20000,
-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT_EVO],
 	.clkr = {
 		.enable_reg = 0x0b000,
 		.enable_mask = BIT(0),
@@ -93,7 +93,7 @@
 
 static struct clk_alpha_pll_postdiv gpll0 = {
 	.offset = 0x20000,
-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT_EVO],
 	.width = 4,
 	.clkr.hw.init = &(const struct clk_init_data) {
 		.name = "gpll0",
@@ -107,7 +107,7 @@
 
 static struct clk_alpha_pll gpll4_main = {
 	.offset = 0x22000,
-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT_EVO],
 	.clkr = {
 		.enable_reg = 0x0b000,
 		.enable_mask = BIT(2),
@@ -122,7 +122,7 @@
 
 static struct clk_alpha_pll_postdiv gpll4 = {
 	.offset = 0x22000,
-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT_EVO],
 	.width = 4,
 	.clkr.hw.init = &(const struct clk_init_data) {
 		.name = "gpll4",
@@ -136,7 +136,7 @@
 
 static struct clk_alpha_pll gpll2_main = {
 	.offset = 0x21000,
-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT_EVO],
 	.clkr = {
 		.enable_reg = 0x0b000,
 		.enable_mask = BIT(1),
@@ -151,7 +151,7 @@
 
 static struct clk_alpha_pll_postdiv gpll2 = {
 	.offset = 0x21000,
-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT_EVO],
 	.width = 4,
 	.clkr.hw.init = &(const struct clk_init_data) {
 		.name = "gpll2",
@@ -2082,6 +2082,7 @@
 static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = {
 	F(150000000, P_GPLL4, 8, 0, 0),
 	F(300000000, P_GPLL4, 4, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 sdcc1_ice_core_clk_src = {
@@ -2139,9 +2140,10 @@
 
 static struct clk_branch gcc_crypto_axi_clk = {
 	.halt_reg = 0x16010,
+	.halt_check = BRANCH_HALT_VOTED,
 	.clkr = {
-		.enable_reg = 0x16010,
-		.enable_mask = BIT(0),
+		.enable_reg = 0xb004,
+		.enable_mask = BIT(15),
 		.hw.init = &(const struct clk_init_data) {
 			.name = "gcc_crypto_axi_clk",
 			.parent_hws = (const struct clk_hw *[]) {
@@ -2155,9 +2157,10 @@
 
 static struct clk_branch gcc_crypto_ahb_clk = {
 	.halt_reg = 0x16014,
+	.halt_check = BRANCH_HALT_VOTED,
 	.clkr = {
-		.enable_reg = 0x16014,
-		.enable_mask = BIT(0),
+		.enable_reg = 0xb004,
+		.enable_mask = BIT(16),
 		.hw.init = &(const struct clk_init_data) {
 			.name = "gcc_crypto_ahb_clk",
 			.parent_hws = (const struct clk_hw *[]) {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-mdm9607.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-mdm9607.c
@@ -1604,7 +1604,7 @@
 	/* Vote for GPLL0 to turn on. Needed by acpuclock. */
 	regmap_update_bits(regmap, 0x45000, BIT(0), BIT(0));
 
-	return qcom_cc_really_probe(pdev, &gcc_mdm9607_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_mdm9607_desc, regmap);
 }
 
 static struct platform_driver gcc_mdm9607_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-mdm9615.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-mdm9615.c
@@ -1736,7 +1736,7 @@
 	if (IS_ERR(regmap))
 		return PTR_ERR(regmap);
 
-	return qcom_cc_really_probe(pdev, &gcc_mdm9615_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_mdm9615_desc, regmap);
 }
 
 static struct platform_driver gcc_mdm9615_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-msm8917.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-msm8917.c
@@ -3270,7 +3270,7 @@
 
 	clk_alpha_pll_configure(&gpll3_early, regmap, &gpll3_early_config);
 
-	return qcom_cc_really_probe(pdev, gcc_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, gcc_desc, regmap);
 }
 
 static const struct of_device_id gcc_msm8917_match_table[] = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-msm8939.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-msm8939.c
@@ -4108,7 +4108,7 @@
 	clk_pll_configure_sr_hpm_lp(&gpll3, regmap, &gpll3_config, true);
 	clk_pll_configure_sr_hpm_lp(&gpll4, regmap, &gpll4_config, true);
 
-	return qcom_cc_really_probe(pdev, &gcc_msm8939_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_msm8939_desc, regmap);
 }
 
 static struct platform_driver gcc_msm8939_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-msm8953.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-msm8953.c
@@ -4216,7 +4216,7 @@
 
 	clk_alpha_pll_configure(&gpll3_early, regmap, &gpll3_early_config);
 
-	return qcom_cc_really_probe(pdev, &gcc_msm8953_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_msm8953_desc, regmap);
 }
 
 static const struct of_device_id gcc_msm8953_match_table[] = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-msm8976.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-msm8976.c
@@ -4129,7 +4129,7 @@
 	if (ret)
 		return ret;
 
-	return qcom_cc_really_probe(pdev, &gcc_msm8976_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_msm8976_desc, regmap);
 }
 
 static struct platform_driver gcc_msm8976_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-msm8996.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-msm8996.c
@@ -3620,7 +3620,7 @@
 	 */
 	regmap_update_bits(regmap, 0x52008, BIT(21), BIT(21));
 
-	return qcom_cc_really_probe(pdev, &gcc_msm8996_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_msm8996_desc, regmap);
 }
 
 static struct platform_driver gcc_msm8996_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-msm8998.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-msm8998.c
@@ -3292,7 +3292,7 @@
 	regmap_write(regmap, GCC_MMSS_MISC, 0x10003);
 	regmap_write(regmap, GCC_GPU_MISC, 0x10003);
 
-	return qcom_cc_really_probe(pdev, &gcc_msm8998_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_msm8998_desc, regmap);
 }
 
 static const struct of_device_id gcc_msm8998_match_table[] = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-qcm2290.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-qcm2290.c
@@ -2994,7 +2994,7 @@
 	clk_alpha_pll_configure(&gpll8, regmap, &gpll8_config);
 	clk_alpha_pll_configure(&gpll9, regmap, &gpll9_config);
 
-	return qcom_cc_really_probe(pdev, &gcc_qcm2290_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_qcm2290_desc, regmap);
 }
 
 static struct platform_driver gcc_qcm2290_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-qcs404.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-qcs404.c
@@ -131,6 +131,7 @@
 /* 930MHz configuration */
 static const struct alpha_pll_config gpll3_config = {
 	.l = 48,
+	.alpha_hi = 0x70,
 	.alpha = 0x0,
 	.alpha_en_mask = BIT(24),
 	.post_div_mask = 0xf << 8,
@@ -2824,7 +2825,7 @@
 
 	clk_alpha_pll_configure(&gpll3_out_main, regmap, &gpll3_config);
 
-	return qcom_cc_really_probe(pdev, &gcc_qcs404_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_qcs404_desc, regmap);
 }
 
 static struct platform_driver gcc_qcs404_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-qcs615.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-qcs615.c
@@ -0,0 +1,3034 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,qcs615-gcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+	DT_SLEEP_CLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_GPLL0_OUT_AUX2_DIV,
+	P_GPLL0_OUT_MAIN,
+	P_GPLL3_OUT_MAIN,
+	P_GPLL3_OUT_MAIN_DIV,
+	P_GPLL4_OUT_MAIN,
+	P_GPLL6_OUT_MAIN,
+	P_GPLL7_OUT_MAIN,
+	P_GPLL8_OUT_MAIN,
+	P_SLEEP_CLK,
+};
+
+static struct clk_alpha_pll gpll0 = {
+	.offset = 0x0,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.enable_reg = 0x52000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+/* Fixed divider clock of GPLL0 instead of PLL normal postdiv */
+static struct clk_fixed_factor gpll0_out_aux2_div = {
+	.mult = 1,
+	.div = 2,
+	.hw.init = &(struct clk_init_data) {
+		.name = "gpll0_out_aux2_div",
+		.parent_data = &(const struct clk_parent_data) {
+			.hw = &gpll0.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+static struct clk_alpha_pll gpll3 = {
+	.offset = 0x3000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.enable_reg = 0x52000,
+		.enable_mask = BIT(3),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpll3",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+/* Fixed divider clock of GPLL3 instead of PLL normal postdiv */
+static struct clk_fixed_factor gpll3_out_aux2_div = {
+	.mult = 1,
+	.div = 2,
+	.hw.init = &(struct clk_init_data) {
+		.name = "gpll3_out_aux2_div",
+		.parent_data = &(const struct clk_parent_data) {
+			.hw = &gpll3.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+static struct clk_alpha_pll gpll4 = {
+	.offset = 0x76000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.enable_reg = 0x52000,
+		.enable_mask = BIT(4),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpll4",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+static struct clk_alpha_pll gpll6 = {
+	.offset = 0x13000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.enable_reg = 0x52000,
+		.enable_mask = BIT(6),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpll6",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_gpll6_out_main[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv gpll6_out_main = {
+	.offset = 0x13000,
+	.post_div_shift = 8,
+	.post_div_table = post_div_table_gpll6_out_main,
+	.num_post_div = ARRAY_SIZE(post_div_table_gpll6_out_main),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpll6_out_main",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gpll6.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_alpha_pll_postdiv_ops,
+	},
+};
+
+static struct clk_alpha_pll gpll7 = {
+	.offset = 0x1a000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.enable_reg = 0x52000,
+		.enable_mask = BIT(7),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpll7",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+static struct clk_alpha_pll gpll8 = {
+	.offset = 0x1b000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.enable_reg = 0x52000,
+		.enable_mask = BIT(8),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpll8",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_gpll8_out_main[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv gpll8_out_main = {
+	.offset = 0x1b000,
+	.post_div_shift = 8,
+	.post_div_table = post_div_table_gpll8_out_main,
+	.num_post_div = ARRAY_SIZE(post_div_table_gpll8_out_main),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpll8_out_main",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gpll8.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_alpha_pll_postdiv_ops,
+	},
+};
+
+static const struct parent_map gcc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 1 },
+	{ P_GPLL0_OUT_AUX2_DIV, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpll0.clkr.hw },
+	{ .hw = &gpll0_out_aux2_div.hw },
+};
+
+static const struct clk_parent_data gcc_parent_data_0_ao[] = {
+	{ .index = DT_BI_TCXO_AO },
+	{ .hw = &gpll0.clkr.hw },
+	{ .hw = &gpll0.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 1 },
+	{ P_GPLL6_OUT_MAIN, 2 },
+	{ P_GPLL0_OUT_AUX2_DIV, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpll0.clkr.hw },
+	{ .hw = &gpll6_out_main.clkr.hw },
+	{ .hw = &gpll0_out_aux2_div.hw },
+};
+
+static const struct parent_map gcc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 1 },
+	{ P_SLEEP_CLK, 5 },
+	{ P_GPLL0_OUT_AUX2_DIV, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpll0.clkr.hw },
+	{ .index = DT_SLEEP_CLK },
+	{ .hw = &gpll0_out_aux2_div.hw },
+};
+
+static const struct parent_map gcc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_SLEEP_CLK, 5 },
+};
+
+static const struct clk_parent_data gcc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_SLEEP_CLK },
+};
+
+static const struct parent_map gcc_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data gcc_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct parent_map gcc_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 1 },
+	{ P_GPLL7_OUT_MAIN, 3 },
+	{ P_GPLL4_OUT_MAIN, 5 },
+	{ P_GPLL0_OUT_AUX2_DIV, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpll0.clkr.hw },
+	{ .hw = &gpll7.clkr.hw },
+	{ .hw = &gpll4.clkr.hw },
+	{ .hw = &gpll0_out_aux2_div.hw },
+};
+
+static const struct parent_map gcc_parent_map_6[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 1 },
+	{ P_GPLL7_OUT_MAIN, 3 },
+	{ P_GPLL0_OUT_AUX2_DIV, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_6[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpll0.clkr.hw },
+	{ .hw = &gpll7.clkr.hw },
+	{ .hw = &gpll0_out_aux2_div.hw },
+};
+
+static const struct parent_map gcc_parent_map_7[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 1 },
+	{ P_GPLL3_OUT_MAIN_DIV, 4 },
+	{ P_GPLL0_OUT_AUX2_DIV, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_7[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpll0.clkr.hw },
+	{ .hw = &gpll3_out_aux2_div.hw },
+	{ .hw = &gpll0_out_aux2_div.hw },
+};
+
+static const struct parent_map gcc_parent_map_8[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 1 },
+	{ P_GPLL8_OUT_MAIN, 2 },
+	{ P_GPLL4_OUT_MAIN, 5 },
+	{ P_GPLL0_OUT_AUX2_DIV, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_8[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpll0.clkr.hw },
+	{ .hw = &gpll8_out_main.clkr.hw },
+	{ .hw = &gpll4.clkr.hw },
+	{ .hw = &gpll0_out_aux2_div.hw },
+};
+
+static const struct parent_map gcc_parent_map_9[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 1 },
+	{ P_GPLL3_OUT_MAIN, 4 },
+};
+
+static const struct clk_parent_data gcc_parent_data_9[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpll0.clkr.hw },
+	{ .hw = &gpll3.clkr.hw },
+};
+
+static const struct freq_tbl ftbl_gcc_cpuss_ahb_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
+	.cmd_rcgr = 0x48014,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_cpuss_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_cpuss_ahb_clk_src",
+		.parent_data = gcc_parent_data_0_ao,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0_ao),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_emac_ptp_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(50000000, P_GPLL0_OUT_AUX2_DIV, 6, 0, 0),
+	F(75000000, P_GPLL0_OUT_AUX2_DIV, 4, 0, 0),
+	F(125000000, P_GPLL7_OUT_MAIN, 4, 0, 0),
+	F(250000000, P_GPLL7_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_emac_ptp_clk_src = {
+	.cmd_rcgr = 0x6038,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_5,
+	.freq_tbl = ftbl_gcc_emac_ptp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_emac_ptp_clk_src",
+		.parent_data = gcc_parent_data_5,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_5),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_emac_rgmii_clk_src[] = {
+	F(2500000, P_BI_TCXO, 1, 25, 192),
+	F(5000000, P_BI_TCXO, 1, 25, 96),
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(25000000, P_GPLL0_OUT_AUX2_DIV, 12, 0, 0),
+	F(50000000, P_GPLL0_OUT_AUX2_DIV, 6, 0, 0),
+	F(75000000, P_GPLL0_OUT_AUX2_DIV, 4, 0, 0),
+	F(125000000, P_GPLL7_OUT_MAIN, 4, 0, 0),
+	F(250000000, P_GPLL7_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_emac_rgmii_clk_src = {
+	.cmd_rcgr = 0x601c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_6,
+	.freq_tbl = ftbl_gcc_emac_rgmii_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_emac_rgmii_clk_src",
+		.parent_data = gcc_parent_data_6,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_6),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_gp1_clk_src[] = {
+	F(25000000, P_GPLL0_OUT_AUX2_DIV, 12, 0, 0),
+	F(50000000, P_GPLL0_OUT_AUX2_DIV, 6, 0, 0),
+	F(100000000, P_GPLL0_OUT_MAIN, 6, 0, 0),
+	F(200000000, P_GPLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_gp1_clk_src = {
+	.cmd_rcgr = 0x64004,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_2,
+	.freq_tbl = ftbl_gcc_gp1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_gp1_clk_src",
+		.parent_data = gcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_gp2_clk_src = {
+	.cmd_rcgr = 0x65004,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_2,
+	.freq_tbl = ftbl_gcc_gp1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_gp2_clk_src",
+		.parent_data = gcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_gp3_clk_src = {
+	.cmd_rcgr = 0x66004,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_2,
+	.freq_tbl = ftbl_gcc_gp1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_gp3_clk_src",
+		.parent_data = gcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_pcie_0_aux_clk_src[] = {
+	F(9600000, P_BI_TCXO, 2, 0, 0),
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_pcie_0_aux_clk_src = {
+	.cmd_rcgr = 0x6b02c,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_3,
+	.freq_tbl = ftbl_gcc_pcie_0_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pcie_0_aux_clk_src",
+		.parent_data = gcc_parent_data_3,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_3),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_pcie_phy_refgen_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(100000000, P_GPLL0_OUT_MAIN, 6, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_pcie_phy_refgen_clk_src = {
+	.cmd_rcgr = 0x6f014,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_pcie_phy_refgen_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pcie_phy_refgen_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_pdm2_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(60000000, P_GPLL0_OUT_MAIN, 10, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_pdm2_clk_src = {
+	.cmd_rcgr = 0x33010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_pdm2_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pdm2_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_qspi_core_clk_src[] = {
+	F(60000000, P_GPLL0_OUT_AUX2_DIV, 5, 0, 0),
+	F(133250000, P_GPLL3_OUT_MAIN_DIV, 4, 0, 0),
+	F(266500000, P_GPLL3_OUT_MAIN_DIV, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_qspi_core_clk_src = {
+	.cmd_rcgr = 0x4b008,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_7,
+	.freq_tbl = ftbl_gcc_qspi_core_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_qspi_core_clk_src",
+		.parent_data = gcc_parent_data_7,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_7),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_qupv3_wrap0_s0_clk_src[] = {
+	F(7372800, P_GPLL0_OUT_AUX2_DIV, 1, 384, 15625),
+	F(14745600, P_GPLL0_OUT_AUX2_DIV, 1, 768, 15625),
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(29491200, P_GPLL0_OUT_AUX2_DIV, 1, 1536, 15625),
+	F(32000000, P_GPLL0_OUT_AUX2_DIV, 1, 8, 75),
+	F(48000000, P_GPLL0_OUT_AUX2_DIV, 1, 4, 25),
+	F(64000000, P_GPLL0_OUT_AUX2_DIV, 1, 16, 75),
+	F(75000000, P_GPLL0_OUT_AUX2_DIV, 4, 0, 0),
+	F(80000000, P_GPLL0_OUT_AUX2_DIV, 1, 4, 15),
+	F(96000000, P_GPLL0_OUT_AUX2_DIV, 1, 8, 25),
+	F(100000000, P_GPLL0_OUT_MAIN, 6, 0, 0),
+	F(102400000, P_GPLL0_OUT_AUX2_DIV, 1, 128, 375),
+	F(112000000, P_GPLL0_OUT_AUX2_DIV, 1, 28, 75),
+	F(117964800, P_GPLL0_OUT_AUX2_DIV, 1, 6144, 15625),
+	F(120000000, P_GPLL0_OUT_AUX2_DIV, 2.5, 0, 0),
+	F(128000000, P_GPLL6_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s0_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
+	.cmd_rcgr = 0x17148,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s1_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
+	.cmd_rcgr = 0x17278,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s1_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s2_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
+	.cmd_rcgr = 0x173a8,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s3_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
+	.cmd_rcgr = 0x174d8,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s4_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
+	.cmd_rcgr = 0x17608,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s5_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
+	.cmd_rcgr = 0x17738,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s5_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s0_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
+	.cmd_rcgr = 0x18148,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s1_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
+	.cmd_rcgr = 0x18278,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s1_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s2_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
+	.cmd_rcgr = 0x183a8,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s3_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
+	.cmd_rcgr = 0x184d8,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s4_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
+	.cmd_rcgr = 0x18608,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s5_clk_src",
+	.parent_data = gcc_parent_data_1,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+	.ops = &clk_rcg2_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
+	.cmd_rcgr = 0x18738,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s5_clk_src_init,
+};
+
+static const struct freq_tbl ftbl_gcc_sdcc1_apps_clk_src[] = {
+	F(144000, P_BI_TCXO, 16, 3, 25),
+	F(400000, P_BI_TCXO, 12, 1, 4),
+	F(20000000, P_GPLL0_OUT_AUX2_DIV, 5, 1, 3),
+	F(25000000, P_GPLL0_OUT_AUX2_DIV, 6, 1, 2),
+	F(50000000, P_GPLL0_OUT_AUX2_DIV, 6, 0, 0),
+	F(100000000, P_GPLL0_OUT_AUX2_DIV, 3, 0, 0),
+	F(192000000, P_GPLL6_OUT_MAIN, 2, 0, 0),
+	F(384000000, P_GPLL6_OUT_MAIN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_sdcc1_apps_clk_src = {
+	.cmd_rcgr = 0x12028,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_sdcc1_apps_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_sdcc1_apps_clk_src",
+		.parent_data = gcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+		.ops = &clk_rcg2_floor_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_sdcc1_ice_core_clk_src[] = {
+	F(75000000, P_GPLL0_OUT_AUX2_DIV, 4, 0, 0),
+	F(150000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
+	F(200000000, P_GPLL0_OUT_MAIN, 3, 0, 0),
+	F(300000000, P_GPLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
+	.cmd_rcgr = 0x12010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_sdcc1_ice_core_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_sdcc1_ice_core_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_floor_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_sdcc2_apps_clk_src[] = {
+	F(400000, P_BI_TCXO, 12, 1, 4),
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(25000000, P_GPLL0_OUT_AUX2_DIV, 12, 0, 0),
+	F(50000000, P_GPLL0_OUT_AUX2_DIV, 6, 0, 0),
+	F(100000000, P_GPLL0_OUT_AUX2_DIV, 3, 0, 0),
+	F(202000000, P_GPLL8_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
+	.cmd_rcgr = 0x1400c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_8,
+	.freq_tbl = ftbl_gcc_sdcc2_apps_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_sdcc2_apps_clk_src",
+		.parent_data = gcc_parent_data_8,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_8),
+		.ops = &clk_rcg2_floor_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_ufs_phy_axi_clk_src[] = {
+	F(25000000, P_GPLL0_OUT_AUX2_DIV, 12, 0, 0),
+	F(50000000, P_GPLL0_OUT_AUX2_DIV, 6, 0, 0),
+	F(100000000, P_GPLL0_OUT_MAIN, 6, 0, 0),
+	F(200000000, P_GPLL0_OUT_MAIN, 3, 0, 0),
+	F(240000000, P_GPLL0_OUT_MAIN, 2.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = {
+	.cmd_rcgr = 0x77020,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_ufs_phy_axi_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_ufs_phy_axi_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_ufs_phy_ice_core_clk_src[] = {
+	F(37500000, P_GPLL0_OUT_AUX2_DIV, 8, 0, 0),
+	F(75000000, P_GPLL0_OUT_AUX2_DIV, 4, 0, 0),
+	F(150000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
+	F(300000000, P_GPLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = {
+	.cmd_rcgr = 0x77048,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_ufs_phy_ice_core_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_ufs_phy_ice_core_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_ufs_phy_phy_aux_clk_src = {
+	.cmd_rcgr = 0x7707c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_4,
+	.freq_tbl = ftbl_gcc_pcie_0_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_ufs_phy_phy_aux_clk_src",
+		.parent_data = gcc_parent_data_4,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_4),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_ufs_phy_unipro_core_clk_src[] = {
+	F(37500000, P_GPLL0_OUT_AUX2_DIV, 8, 0, 0),
+	F(75000000, P_GPLL0_OUT_MAIN, 8, 0, 0),
+	F(150000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = {
+	.cmd_rcgr = 0x77060,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_ufs_phy_unipro_core_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_ufs_phy_unipro_core_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_usb20_sec_master_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(60000000, P_GPLL0_OUT_MAIN, 10, 0, 0),
+	F(120000000, P_GPLL0_OUT_MAIN, 5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_usb20_sec_master_clk_src = {
+	.cmd_rcgr = 0xa601c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_usb20_sec_master_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb20_sec_master_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_usb20_sec_mock_utmi_clk_src = {
+	.cmd_rcgr = 0xa6034,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_pdm2_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb20_sec_mock_utmi_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_usb2_sec_phy_aux_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_usb2_sec_phy_aux_clk_src = {
+	.cmd_rcgr = 0xa6060,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_3,
+	.freq_tbl = ftbl_gcc_usb2_sec_phy_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb2_sec_phy_aux_clk_src",
+		.parent_data = gcc_parent_data_3,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_3),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_usb30_prim_master_clk_src[] = {
+	F(66666667, P_GPLL0_OUT_AUX2_DIV, 4.5, 0, 0),
+	F(133333333, P_GPLL0_OUT_MAIN, 4.5, 0, 0),
+	F(200000000, P_GPLL0_OUT_MAIN, 3, 0, 0),
+	F(240000000, P_GPLL0_OUT_MAIN, 2.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
+	.cmd_rcgr = 0xf01c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_usb30_prim_master_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb30_prim_master_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_usb30_prim_mock_utmi_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(20000000, P_GPLL0_OUT_AUX2_DIV, 15, 0, 0),
+	F(40000000, P_GPLL0_OUT_AUX2_DIV, 7.5, 0, 0),
+	F(60000000, P_GPLL0_OUT_MAIN, 10, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = {
+	.cmd_rcgr = 0xf034,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_usb30_prim_mock_utmi_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb30_prim_mock_utmi_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = {
+	.cmd_rcgr = 0xf060,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_3,
+	.freq_tbl = ftbl_gcc_usb2_sec_phy_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb3_prim_phy_aux_clk_src",
+		.parent_data = gcc_parent_data_3,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_3),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_vsensor_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(400000000, P_GPLL0_OUT_MAIN, 1.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_vsensor_clk_src = {
+	.cmd_rcgr = 0x7a018,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_9,
+	.freq_tbl = ftbl_gcc_vsensor_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_vsensor_clk_src",
+		.parent_data = gcc_parent_data_9,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_9),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_branch gcc_aggre_ufs_phy_axi_clk = {
+	.halt_reg = 0x770c0,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x770c0,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x770c0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_aggre_ufs_phy_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_aggre_usb2_sec_axi_clk = {
+	.halt_reg = 0xa6084,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xa6084,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_aggre_usb2_sec_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb20_sec_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_aggre_usb3_prim_axi_clk = {
+	.halt_reg = 0xf07c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xf07c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_aggre_usb3_prim_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb30_prim_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ahb2phy_east_clk = {
+	.halt_reg = 0x6a008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x6a008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x6a008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ahb2phy_east_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ahb2phy_west_clk = {
+	.halt_reg = 0x6a004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x6a004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x6a004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ahb2phy_west_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_boot_rom_ahb_clk = {
+	.halt_reg = 0x38004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x38004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(10),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_boot_rom_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_camera_hf_axi_clk = {
+	.halt_reg = 0xb030,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xb030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_camera_hf_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ce1_ahb_clk = {
+	.halt_reg = 0x4100c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x4100c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(3),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ce1_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ce1_axi_clk = {
+	.halt_reg = 0x41008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(4),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ce1_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ce1_clk = {
+	.halt_reg = 0x41004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(5),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ce1_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_cfg_noc_usb2_sec_axi_clk = {
+	.halt_reg = 0xa609c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xa609c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_cfg_noc_usb2_sec_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb20_sec_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_cfg_noc_usb3_prim_axi_clk = {
+	.halt_reg = 0xf078,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xf078,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_cfg_noc_usb3_prim_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb30_prim_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_cpuss_ahb_clk = {
+	.halt_reg = 0x48000,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(21),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_cpuss_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_cpuss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_IS_CRITICAL | CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ddrss_gpu_axi_clk = {
+	.halt_reg = 0x71154,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x71154,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ddrss_gpu_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_disp_gpll0_div_clk_src = {
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(20),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_disp_gpll0_div_clk_src",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpll0_out_aux2_div.hw,
+			},
+			.num_parents = 1,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_disp_hf_axi_clk = {
+	.halt_reg = 0xb038,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xb038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_disp_hf_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_emac_axi_clk = {
+	.halt_reg = 0x6010,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_emac_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_emac_ptp_clk = {
+	.halt_reg = 0x6034,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6034,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_emac_ptp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_emac_ptp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_emac_rgmii_clk = {
+	.halt_reg = 0x6018,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_emac_rgmii_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_emac_rgmii_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_emac_slv_ahb_clk = {
+	.halt_reg = 0x6014,
+	.halt_check = BRANCH_HALT,
+	.hwcg_reg = 0x6014,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x6014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_emac_slv_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gp1_clk = {
+	.halt_reg = 0x64000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x64000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gp1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gp1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gp2_clk = {
+	.halt_reg = 0x65000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x65000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gp2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gp2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gp3_clk = {
+	.halt_reg = 0x66000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x66000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gp3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gp3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_gpll0_clk_src = {
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(15),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_gpll0_clk_src",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpll0.clkr.hw,
+			},
+			.num_parents = 1,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_gpll0_div_clk_src = {
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(16),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_gpll0_div_clk_src",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpll0_out_aux2_div.hw,
+			},
+			.num_parents = 1,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_iref_clk = {
+	.halt_reg = 0x8c010,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8c010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_iref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_memnoc_gfx_clk = {
+	.halt_reg = 0x7100c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x7100c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_memnoc_gfx_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_snoc_dvm_gfx_clk = {
+	.halt_reg = 0x71018,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x71018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_snoc_dvm_gfx_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie0_phy_refgen_clk = {
+	.halt_reg = 0x6f02c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6f02c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie0_phy_refgen_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_phy_refgen_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_aux_clk = {
+	.halt_reg = 0x6b020,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(3),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_0_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_cfg_ahb_clk = {
+	.halt_reg = 0x6b01c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x6b01c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(2),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_cfg_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_clkref_clk = {
+	.halt_reg = 0x8c00c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8c00c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_clkref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_mstr_axi_clk = {
+	.halt_reg = 0x6b018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(1),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_mstr_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_pipe_clk = {
+	.halt_reg = 0x6b024,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(4),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_pipe_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_slv_axi_clk = {
+	.halt_reg = 0x6b014,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x6b014,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_slv_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_slv_q2a_axi_clk = {
+	.halt_reg = 0x6b010,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(5),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_slv_q2a_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_phy_aux_clk = {
+	.halt_reg = 0x6f004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x6f004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_phy_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_0_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pdm2_clk = {
+	.halt_reg = 0x3300c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x3300c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pdm2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pdm2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pdm_ahb_clk = {
+	.halt_reg = 0x33004,
+	.halt_check = BRANCH_HALT,
+	.hwcg_reg = 0x33004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x33004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pdm_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pdm_xo4_clk = {
+	.halt_reg = 0x33008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x33008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pdm_xo4_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_prng_ahb_clk = {
+	.halt_reg = 0x34004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x34004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(13),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_prng_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_camera_nrt_ahb_clk = {
+	.halt_reg = 0xb018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0xb018,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0xb018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_camera_nrt_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_disp_ahb_clk = {
+	.halt_reg = 0xb020,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0xb020,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0xb020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_disp_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_pcie_ahb_clk = {
+	.halt_reg = 0x6b044,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x6b044,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(28),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_pcie_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_video_vcodec_ahb_clk = {
+	.halt_reg = 0xb014,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0xb014,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0xb014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_video_vcodec_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qspi_cnoc_periph_ahb_clk = {
+	.halt_reg = 0x4b000,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qspi_cnoc_periph_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qspi_core_clk = {
+	.halt_reg = 0x4b004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x4b004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qspi_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qspi_core_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_core_2x_clk = {
+	.halt_reg = 0x17014,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(9),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_core_2x_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_core_clk = {
+	.halt_reg = 0x1700c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(8),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_core_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s0_clk = {
+	.halt_reg = 0x17144,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(10),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s1_clk = {
+	.halt_reg = 0x17274,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(11),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s2_clk = {
+	.halt_reg = 0x173a4,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(12),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s3_clk = {
+	.halt_reg = 0x174d4,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(13),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s4_clk = {
+	.halt_reg = 0x17604,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(14),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s4_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s4_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s5_clk = {
+	.halt_reg = 0x17734,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(15),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s5_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s5_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_core_2x_clk = {
+	.halt_reg = 0x18014,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(18),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_core_2x_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_core_clk = {
+	.halt_reg = 0x1800c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(19),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_core_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s0_clk = {
+	.halt_reg = 0x18144,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(22),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s1_clk = {
+	.halt_reg = 0x18274,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(23),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s2_clk = {
+	.halt_reg = 0x183a4,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(24),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s3_clk = {
+	.halt_reg = 0x184d4,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(25),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s4_clk = {
+	.halt_reg = 0x18604,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(26),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s4_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s4_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s5_clk = {
+	.halt_reg = 0x18734,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(27),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s5_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s5_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_0_m_ahb_clk = {
+	.halt_reg = 0x17004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(6),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_0_m_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_0_s_ahb_clk = {
+	.halt_reg = 0x17008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x17008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(7),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_0_s_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_1_m_ahb_clk = {
+	.halt_reg = 0x18004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(20),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_1_m_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_1_s_ahb_clk = {
+	.halt_reg = 0x18008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x18008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x5200c,
+		.enable_mask = BIT(21),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_1_s_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_rx1_usb2_clkref_clk = {
+	.halt_reg = 0x8c030,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8c030,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_rx1_usb2_clkref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_rx3_usb2_clkref_clk = {
+	.halt_reg = 0x8c038,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x8c038,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_rx3_usb2_clkref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sdcc1_ahb_clk = {
+	.halt_reg = 0x12008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x12008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_sdcc1_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sdcc1_apps_clk = {
+	.halt_reg = 0x12004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x12004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_sdcc1_apps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_sdcc1_apps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sdcc1_ice_core_clk = {
+	.halt_reg = 0x1200c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1200c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_sdcc1_ice_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_sdcc1_ice_core_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sdcc2_ahb_clk = {
+	.halt_reg = 0x14008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x14008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_sdcc2_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sdcc2_apps_clk = {
+	.halt_reg = 0x14004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x14004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_sdcc2_apps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_sdcc2_apps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sys_noc_cpuss_ahb_clk = {
+	.halt_reg = 0x4819c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x52004,
+		.enable_mask = BIT(0),
+		.hw.init = &(struct clk_init_data) {
+			.name = "gcc_sys_noc_cpuss_ahb_clk",
+			.parent_data = &(const struct clk_parent_data) {
+				.hw = &gcc_cpuss_ahb_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_IS_CRITICAL | CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_card_clkref_clk = {
+	.halt_reg = 0x8c004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x8c004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_card_clkref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_mem_clkref_clk = {
+	.halt_reg = 0x8c000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8c000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_mem_clkref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_ahb_clk = {
+	.halt_reg = 0x77014,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x77014,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x77014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_axi_clk = {
+	.halt_reg = 0x77010,
+	.halt_check = BRANCH_HALT,
+	.hwcg_reg = 0x77010,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x77010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_ice_core_clk = {
+	.halt_reg = 0x77044,
+	.halt_check = BRANCH_HALT,
+	.hwcg_reg = 0x77044,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x77044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_ice_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_ice_core_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_phy_aux_clk = {
+	.halt_reg = 0x77078,
+	.halt_check = BRANCH_HALT,
+	.hwcg_reg = 0x77078,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x77078,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_phy_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_rx_symbol_0_clk = {
+	.halt_reg = 0x7701c,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x7701c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_rx_symbol_0_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_tx_symbol_0_clk = {
+	.halt_reg = 0x77018,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x77018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_tx_symbol_0_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_unipro_core_clk = {
+	.halt_reg = 0x77040,
+	.halt_check = BRANCH_HALT,
+	.hwcg_reg = 0x77040,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x77040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_unipro_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_unipro_core_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb20_sec_master_clk = {
+	.halt_reg = 0xa6010,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xa6010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb20_sec_master_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb20_sec_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb20_sec_mock_utmi_clk = {
+	.halt_reg = 0xa6018,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa6018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb20_sec_mock_utmi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb20_sec_mock_utmi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb20_sec_sleep_clk = {
+	.halt_reg = 0xa6014,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa6014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb20_sec_sleep_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb2_prim_clkref_clk = {
+	.halt_reg = 0x8c028,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x8c028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb2_prim_clkref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb2_sec_clkref_clk = {
+	.halt_reg = 0x8c018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x8c018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb2_sec_clkref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb2_sec_phy_aux_clk = {
+	.halt_reg = 0xa6050,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa6050,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb2_sec_phy_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb2_sec_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb2_sec_phy_com_aux_clk = {
+	.halt_reg = 0xa6054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa6054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb2_sec_phy_com_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb2_sec_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb2_sec_phy_pipe_clk = {
+	.halt_reg = 0xa6058,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0xa6058,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb2_sec_phy_pipe_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb30_prim_master_clk = {
+	.halt_reg = 0xf010,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xf010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb30_prim_master_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb30_prim_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb30_prim_mock_utmi_clk = {
+	.halt_reg = 0xf018,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xf018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb30_prim_mock_utmi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb30_prim_mock_utmi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb30_prim_sleep_clk = {
+	.halt_reg = 0xf014,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xf014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb30_prim_sleep_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb3_prim_clkref_clk = {
+	.halt_reg = 0x8c014,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x8c014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb3_prim_clkref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb3_prim_phy_aux_clk = {
+	.halt_reg = 0xf050,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xf050,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb3_prim_phy_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb3_prim_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb3_prim_phy_com_aux_clk = {
+	.halt_reg = 0xf054,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xf054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb3_prim_phy_com_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb3_prim_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb3_prim_phy_pipe_clk = {
+	.halt_reg = 0xf058,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0xf058,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb3_prim_phy_pipe_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb3_sec_clkref_clk = {
+	.halt_reg = 0x8c008,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x8c008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb3_sec_clkref_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_video_axi0_clk = {
+	.halt_reg = 0xb024,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0xb024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_video_axi0_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_hw *gcc_qcs615_hws[] = {
+	[GPLL0_OUT_AUX2_DIV] = &gpll0_out_aux2_div.hw,
+	[GPLL3_OUT_AUX2_DIV] = &gpll3_out_aux2_div.hw,
+};
+
+static struct gdsc emac_gdsc = {
+	.gdscr = 0x6004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x2,
+	.pd = {
+		.name = "emac_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc pcie_0_gdsc = {
+	.gdscr = 0x6b004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x2,
+	.pd = {
+		.name = "pcie_0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc ufs_phy_gdsc = {
+	.gdscr = 0x77004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x2,
+	.pd = {
+		.name = "ufs_phy_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc usb20_sec_gdsc = {
+	.gdscr = 0xa6004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x2,
+	.pd = {
+		.name = "usb20_sec_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc usb30_prim_gdsc = {
+	.gdscr = 0xf004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x2,
+	.pd = {
+		.name = "usb30_prim_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc hlos1_vote_aggre_noc_mmu_audio_tbu_gdsc = {
+	.gdscr = 0x7d040,
+	.pd = {
+		.name = "hlos1_vote_aggre_noc_mmu_audio_tbu",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE,
+};
+
+static struct gdsc hlos1_vote_aggre_noc_mmu_tbu1_gdsc = {
+	.gdscr = 0x7d044,
+	.pd = {
+		.name = "hlos1_vote_aggre_noc_mmu_tbu1",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE,
+};
+
+static struct gdsc hlos1_vote_aggre_noc_mmu_tbu2_gdsc = {
+	.gdscr = 0x7d048,
+	.pd = {
+		.name = "hlos1_vote_aggre_noc_mmu_tbu2",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE,
+};
+
+static struct gdsc hlos1_vote_aggre_noc_mmu_pcie_tbu_gdsc = {
+	.gdscr = 0x7d04c,
+	.pd = {
+		.name = "hlos1_vote_aggre_noc_mmu_pcie_tbu",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE,
+};
+
+static struct gdsc hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc = {
+	.gdscr = 0x7d050,
+	.pd = {
+		.name = "hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE,
+};
+
+static struct gdsc hlos1_vote_mmnoc_mmu_tbu_sf_gdsc = {
+	.gdscr = 0x7d054,
+	.pd = {
+		.name = "hlos1_vote_mmnoc_mmu_tbu_sf_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE,
+};
+
+static struct gdsc hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc = {
+	.gdscr = 0x7d058,
+	.pd = {
+		.name = "hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE,
+};
+
+static struct clk_regmap *gcc_qcs615_clocks[] = {
+	[GCC_AGGRE_UFS_PHY_AXI_CLK] = &gcc_aggre_ufs_phy_axi_clk.clkr,
+	[GCC_AGGRE_USB2_SEC_AXI_CLK] = &gcc_aggre_usb2_sec_axi_clk.clkr,
+	[GCC_AGGRE_USB3_PRIM_AXI_CLK] = &gcc_aggre_usb3_prim_axi_clk.clkr,
+	[GCC_AHB2PHY_EAST_CLK] = &gcc_ahb2phy_east_clk.clkr,
+	[GCC_AHB2PHY_WEST_CLK] = &gcc_ahb2phy_west_clk.clkr,
+	[GCC_BOOT_ROM_AHB_CLK] = &gcc_boot_rom_ahb_clk.clkr,
+	[GCC_CAMERA_HF_AXI_CLK] = &gcc_camera_hf_axi_clk.clkr,
+	[GCC_CE1_AHB_CLK] = &gcc_ce1_ahb_clk.clkr,
+	[GCC_CE1_AXI_CLK] = &gcc_ce1_axi_clk.clkr,
+	[GCC_CE1_CLK] = &gcc_ce1_clk.clkr,
+	[GCC_CFG_NOC_USB2_SEC_AXI_CLK] = &gcc_cfg_noc_usb2_sec_axi_clk.clkr,
+	[GCC_CFG_NOC_USB3_PRIM_AXI_CLK] = &gcc_cfg_noc_usb3_prim_axi_clk.clkr,
+	[GCC_CPUSS_AHB_CLK] = &gcc_cpuss_ahb_clk.clkr,
+	[GCC_CPUSS_AHB_CLK_SRC] = &gcc_cpuss_ahb_clk_src.clkr,
+	[GCC_DDRSS_GPU_AXI_CLK] = &gcc_ddrss_gpu_axi_clk.clkr,
+	[GCC_DISP_GPLL0_DIV_CLK_SRC] = &gcc_disp_gpll0_div_clk_src.clkr,
+	[GCC_DISP_HF_AXI_CLK] = &gcc_disp_hf_axi_clk.clkr,
+	[GCC_EMAC_AXI_CLK] = &gcc_emac_axi_clk.clkr,
+	[GCC_EMAC_PTP_CLK] = &gcc_emac_ptp_clk.clkr,
+	[GCC_EMAC_PTP_CLK_SRC] = &gcc_emac_ptp_clk_src.clkr,
+	[GCC_EMAC_RGMII_CLK] = &gcc_emac_rgmii_clk.clkr,
+	[GCC_EMAC_RGMII_CLK_SRC] = &gcc_emac_rgmii_clk_src.clkr,
+	[GCC_EMAC_SLV_AHB_CLK] = &gcc_emac_slv_ahb_clk.clkr,
+	[GCC_GP1_CLK] = &gcc_gp1_clk.clkr,
+	[GCC_GP1_CLK_SRC] = &gcc_gp1_clk_src.clkr,
+	[GCC_GP2_CLK] = &gcc_gp2_clk.clkr,
+	[GCC_GP2_CLK_SRC] = &gcc_gp2_clk_src.clkr,
+	[GCC_GP3_CLK] = &gcc_gp3_clk.clkr,
+	[GCC_GP3_CLK_SRC] = &gcc_gp3_clk_src.clkr,
+	[GCC_GPU_GPLL0_CLK_SRC] = &gcc_gpu_gpll0_clk_src.clkr,
+	[GCC_GPU_GPLL0_DIV_CLK_SRC] = &gcc_gpu_gpll0_div_clk_src.clkr,
+	[GCC_GPU_IREF_CLK] = &gcc_gpu_iref_clk.clkr,
+	[GCC_GPU_MEMNOC_GFX_CLK] = &gcc_gpu_memnoc_gfx_clk.clkr,
+	[GCC_GPU_SNOC_DVM_GFX_CLK] = &gcc_gpu_snoc_dvm_gfx_clk.clkr,
+	[GCC_PCIE0_PHY_REFGEN_CLK] = &gcc_pcie0_phy_refgen_clk.clkr,
+	[GCC_PCIE_0_AUX_CLK] = &gcc_pcie_0_aux_clk.clkr,
+	[GCC_PCIE_0_AUX_CLK_SRC] = &gcc_pcie_0_aux_clk_src.clkr,
+	[GCC_PCIE_0_CFG_AHB_CLK] = &gcc_pcie_0_cfg_ahb_clk.clkr,
+	[GCC_PCIE_0_CLKREF_CLK] = &gcc_pcie_0_clkref_clk.clkr,
+	[GCC_PCIE_0_MSTR_AXI_CLK] = &gcc_pcie_0_mstr_axi_clk.clkr,
+	[GCC_PCIE_0_PIPE_CLK] = &gcc_pcie_0_pipe_clk.clkr,
+	[GCC_PCIE_0_SLV_AXI_CLK] = &gcc_pcie_0_slv_axi_clk.clkr,
+	[GCC_PCIE_0_SLV_Q2A_AXI_CLK] = &gcc_pcie_0_slv_q2a_axi_clk.clkr,
+	[GCC_PCIE_PHY_AUX_CLK] = &gcc_pcie_phy_aux_clk.clkr,
+	[GCC_PCIE_PHY_REFGEN_CLK_SRC] = &gcc_pcie_phy_refgen_clk_src.clkr,
+	[GCC_PDM2_CLK] = &gcc_pdm2_clk.clkr,
+	[GCC_PDM2_CLK_SRC] = &gcc_pdm2_clk_src.clkr,
+	[GCC_PDM_AHB_CLK] = &gcc_pdm_ahb_clk.clkr,
+	[GCC_PDM_XO4_CLK] = &gcc_pdm_xo4_clk.clkr,
+	[GCC_PRNG_AHB_CLK] = &gcc_prng_ahb_clk.clkr,
+	[GCC_QMIP_CAMERA_NRT_AHB_CLK] = &gcc_qmip_camera_nrt_ahb_clk.clkr,
+	[GCC_QMIP_DISP_AHB_CLK] = &gcc_qmip_disp_ahb_clk.clkr,
+	[GCC_QMIP_PCIE_AHB_CLK] = &gcc_qmip_pcie_ahb_clk.clkr,
+	[GCC_QMIP_VIDEO_VCODEC_AHB_CLK] = &gcc_qmip_video_vcodec_ahb_clk.clkr,
+	[GCC_QSPI_CNOC_PERIPH_AHB_CLK] = &gcc_qspi_cnoc_periph_ahb_clk.clkr,
+	[GCC_QSPI_CORE_CLK] = &gcc_qspi_core_clk.clkr,
+	[GCC_QSPI_CORE_CLK_SRC] = &gcc_qspi_core_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_CORE_2X_CLK] = &gcc_qupv3_wrap0_core_2x_clk.clkr,
+	[GCC_QUPV3_WRAP0_CORE_CLK] = &gcc_qupv3_wrap0_core_clk.clkr,
+	[GCC_QUPV3_WRAP0_S0_CLK] = &gcc_qupv3_wrap0_s0_clk.clkr,
+	[GCC_QUPV3_WRAP0_S0_CLK_SRC] = &gcc_qupv3_wrap0_s0_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S1_CLK] = &gcc_qupv3_wrap0_s1_clk.clkr,
+	[GCC_QUPV3_WRAP0_S1_CLK_SRC] = &gcc_qupv3_wrap0_s1_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S2_CLK] = &gcc_qupv3_wrap0_s2_clk.clkr,
+	[GCC_QUPV3_WRAP0_S2_CLK_SRC] = &gcc_qupv3_wrap0_s2_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S3_CLK] = &gcc_qupv3_wrap0_s3_clk.clkr,
+	[GCC_QUPV3_WRAP0_S3_CLK_SRC] = &gcc_qupv3_wrap0_s3_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S4_CLK] = &gcc_qupv3_wrap0_s4_clk.clkr,
+	[GCC_QUPV3_WRAP0_S4_CLK_SRC] = &gcc_qupv3_wrap0_s4_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S5_CLK] = &gcc_qupv3_wrap0_s5_clk.clkr,
+	[GCC_QUPV3_WRAP0_S5_CLK_SRC] = &gcc_qupv3_wrap0_s5_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_CORE_2X_CLK] = &gcc_qupv3_wrap1_core_2x_clk.clkr,
+	[GCC_QUPV3_WRAP1_CORE_CLK] = &gcc_qupv3_wrap1_core_clk.clkr,
+	[GCC_QUPV3_WRAP1_S0_CLK] = &gcc_qupv3_wrap1_s0_clk.clkr,
+	[GCC_QUPV3_WRAP1_S0_CLK_SRC] = &gcc_qupv3_wrap1_s0_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S1_CLK] = &gcc_qupv3_wrap1_s1_clk.clkr,
+	[GCC_QUPV3_WRAP1_S1_CLK_SRC] = &gcc_qupv3_wrap1_s1_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S2_CLK] = &gcc_qupv3_wrap1_s2_clk.clkr,
+	[GCC_QUPV3_WRAP1_S2_CLK_SRC] = &gcc_qupv3_wrap1_s2_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S3_CLK] = &gcc_qupv3_wrap1_s3_clk.clkr,
+	[GCC_QUPV3_WRAP1_S3_CLK_SRC] = &gcc_qupv3_wrap1_s3_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S4_CLK] = &gcc_qupv3_wrap1_s4_clk.clkr,
+	[GCC_QUPV3_WRAP1_S4_CLK_SRC] = &gcc_qupv3_wrap1_s4_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S5_CLK] = &gcc_qupv3_wrap1_s5_clk.clkr,
+	[GCC_QUPV3_WRAP1_S5_CLK_SRC] = &gcc_qupv3_wrap1_s5_clk_src.clkr,
+	[GCC_QUPV3_WRAP_0_M_AHB_CLK] = &gcc_qupv3_wrap_0_m_ahb_clk.clkr,
+	[GCC_QUPV3_WRAP_0_S_AHB_CLK] = &gcc_qupv3_wrap_0_s_ahb_clk.clkr,
+	[GCC_QUPV3_WRAP_1_M_AHB_CLK] = &gcc_qupv3_wrap_1_m_ahb_clk.clkr,
+	[GCC_QUPV3_WRAP_1_S_AHB_CLK] = &gcc_qupv3_wrap_1_s_ahb_clk.clkr,
+	[GCC_RX1_USB2_CLKREF_CLK] = &gcc_rx1_usb2_clkref_clk.clkr,
+	[GCC_RX3_USB2_CLKREF_CLK] = &gcc_rx3_usb2_clkref_clk.clkr,
+	[GCC_SDCC1_AHB_CLK] = &gcc_sdcc1_ahb_clk.clkr,
+	[GCC_SDCC1_APPS_CLK] = &gcc_sdcc1_apps_clk.clkr,
+	[GCC_SDCC1_APPS_CLK_SRC] = &gcc_sdcc1_apps_clk_src.clkr,
+	[GCC_SDCC1_ICE_CORE_CLK] = &gcc_sdcc1_ice_core_clk.clkr,
+	[GCC_SDCC1_ICE_CORE_CLK_SRC] = &gcc_sdcc1_ice_core_clk_src.clkr,
+	[GCC_SDCC2_AHB_CLK] = &gcc_sdcc2_ahb_clk.clkr,
+	[GCC_SDCC2_APPS_CLK] = &gcc_sdcc2_apps_clk.clkr,
+	[GCC_SDCC2_APPS_CLK_SRC] = &gcc_sdcc2_apps_clk_src.clkr,
+	[GCC_SYS_NOC_CPUSS_AHB_CLK] = &gcc_sys_noc_cpuss_ahb_clk.clkr,
+	[GCC_UFS_CARD_CLKREF_CLK] = &gcc_ufs_card_clkref_clk.clkr,
+	[GCC_UFS_MEM_CLKREF_CLK] = &gcc_ufs_mem_clkref_clk.clkr,
+	[GCC_UFS_PHY_AHB_CLK] = &gcc_ufs_phy_ahb_clk.clkr,
+	[GCC_UFS_PHY_AXI_CLK] = &gcc_ufs_phy_axi_clk.clkr,
+	[GCC_UFS_PHY_AXI_CLK_SRC] = &gcc_ufs_phy_axi_clk_src.clkr,
+	[GCC_UFS_PHY_ICE_CORE_CLK] = &gcc_ufs_phy_ice_core_clk.clkr,
+	[GCC_UFS_PHY_ICE_CORE_CLK_SRC] = &gcc_ufs_phy_ice_core_clk_src.clkr,
+	[GCC_UFS_PHY_PHY_AUX_CLK] = &gcc_ufs_phy_phy_aux_clk.clkr,
+	[GCC_UFS_PHY_PHY_AUX_CLK_SRC] = &gcc_ufs_phy_phy_aux_clk_src.clkr,
+	[GCC_UFS_PHY_RX_SYMBOL_0_CLK] = &gcc_ufs_phy_rx_symbol_0_clk.clkr,
+	[GCC_UFS_PHY_TX_SYMBOL_0_CLK] = &gcc_ufs_phy_tx_symbol_0_clk.clkr,
+	[GCC_UFS_PHY_UNIPRO_CORE_CLK] = &gcc_ufs_phy_unipro_core_clk.clkr,
+	[GCC_UFS_PHY_UNIPRO_CORE_CLK_SRC] = &gcc_ufs_phy_unipro_core_clk_src.clkr,
+	[GCC_USB20_SEC_MASTER_CLK] = &gcc_usb20_sec_master_clk.clkr,
+	[GCC_USB20_SEC_MASTER_CLK_SRC] = &gcc_usb20_sec_master_clk_src.clkr,
+	[GCC_USB20_SEC_MOCK_UTMI_CLK] = &gcc_usb20_sec_mock_utmi_clk.clkr,
+	[GCC_USB20_SEC_MOCK_UTMI_CLK_SRC] = &gcc_usb20_sec_mock_utmi_clk_src.clkr,
+	[GCC_USB20_SEC_SLEEP_CLK] = &gcc_usb20_sec_sleep_clk.clkr,
+	[GCC_USB2_PRIM_CLKREF_CLK] = &gcc_usb2_prim_clkref_clk.clkr,
+	[GCC_USB2_SEC_CLKREF_CLK] = &gcc_usb2_sec_clkref_clk.clkr,
+	[GCC_USB2_SEC_PHY_AUX_CLK] = &gcc_usb2_sec_phy_aux_clk.clkr,
+	[GCC_USB2_SEC_PHY_AUX_CLK_SRC] = &gcc_usb2_sec_phy_aux_clk_src.clkr,
+	[GCC_USB2_SEC_PHY_COM_AUX_CLK] = &gcc_usb2_sec_phy_com_aux_clk.clkr,
+	[GCC_USB2_SEC_PHY_PIPE_CLK] = &gcc_usb2_sec_phy_pipe_clk.clkr,
+	[GCC_USB30_PRIM_MASTER_CLK] = &gcc_usb30_prim_master_clk.clkr,
+	[GCC_USB30_PRIM_MASTER_CLK_SRC] = &gcc_usb30_prim_master_clk_src.clkr,
+	[GCC_USB30_PRIM_MOCK_UTMI_CLK] = &gcc_usb30_prim_mock_utmi_clk.clkr,
+	[GCC_USB30_PRIM_MOCK_UTMI_CLK_SRC] = &gcc_usb30_prim_mock_utmi_clk_src.clkr,
+	[GCC_USB30_PRIM_SLEEP_CLK] = &gcc_usb30_prim_sleep_clk.clkr,
+	[GCC_USB3_PRIM_CLKREF_CLK] = &gcc_usb3_prim_clkref_clk.clkr,
+	[GCC_USB3_PRIM_PHY_AUX_CLK] = &gcc_usb3_prim_phy_aux_clk.clkr,
+	[GCC_USB3_PRIM_PHY_AUX_CLK_SRC] = &gcc_usb3_prim_phy_aux_clk_src.clkr,
+	[GCC_USB3_PRIM_PHY_COM_AUX_CLK] = &gcc_usb3_prim_phy_com_aux_clk.clkr,
+	[GCC_USB3_PRIM_PHY_PIPE_CLK] = &gcc_usb3_prim_phy_pipe_clk.clkr,
+	[GCC_USB3_SEC_CLKREF_CLK] = &gcc_usb3_sec_clkref_clk.clkr,
+	[GCC_VIDEO_AXI0_CLK] = &gcc_video_axi0_clk.clkr,
+	[GCC_VSENSOR_CLK_SRC] = &gcc_vsensor_clk_src.clkr,
+	[GPLL0] = &gpll0.clkr,
+	[GPLL3] = &gpll3.clkr,
+	[GPLL4] = &gpll4.clkr,
+	[GPLL6] = &gpll6.clkr,
+	[GPLL6_OUT_MAIN] = &gpll6_out_main.clkr,
+	[GPLL7] = &gpll7.clkr,
+	[GPLL8] = &gpll8.clkr,
+	[GPLL8_OUT_MAIN] = &gpll8_out_main.clkr,
+};
+
+static struct gdsc *gcc_qcs615_gdscs[] = {
+	[EMAC_GDSC] = &emac_gdsc,
+	[PCIE_0_GDSC] = &pcie_0_gdsc,
+	[UFS_PHY_GDSC] = &ufs_phy_gdsc,
+	[USB20_SEC_GDSC] = &usb20_sec_gdsc,
+	[USB30_PRIM_GDSC] = &usb30_prim_gdsc,
+	[HLOS1_VOTE_AGGRE_NOC_MMU_AUDIO_TBU_GDSC] = &hlos1_vote_aggre_noc_mmu_audio_tbu_gdsc,
+	[HLOS1_VOTE_AGGRE_NOC_MMU_TBU1_GDSC] = &hlos1_vote_aggre_noc_mmu_tbu1_gdsc,
+	[HLOS1_VOTE_AGGRE_NOC_MMU_TBU2_GDSC] = &hlos1_vote_aggre_noc_mmu_tbu2_gdsc,
+	[HLOS1_VOTE_AGGRE_NOC_MMU_PCIE_TBU_GDSC] = &hlos1_vote_aggre_noc_mmu_pcie_tbu_gdsc,
+	[HLOS1_VOTE_MMNOC_MMU_TBU_HF0_GDSC] = &hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc,
+	[HLOS1_VOTE_MMNOC_MMU_TBU_SF_GDSC] = &hlos1_vote_mmnoc_mmu_tbu_sf_gdsc,
+	[HLOS1_VOTE_MMNOC_MMU_TBU_HF1_GDSC] = &hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc,
+};
+
+static const struct qcom_reset_map gcc_qcs615_resets[] = {
+	[GCC_EMAC_BCR] = { 0x6000 },
+	[GCC_QUSB2PHY_PRIM_BCR] = { 0xd000 },
+	[GCC_QUSB2PHY_SEC_BCR] = { 0xd004 },
+	[GCC_USB30_PRIM_BCR] = { 0xf000 },
+	[GCC_USB2_PHY_SEC_BCR] = { 0x50018 },
+	[GCC_USB3_DP_PHY_SEC_BCR] = { 0x50020 },
+	[GCC_USB3PHY_PHY_SEC_BCR] = { 0x5001c },
+	[GCC_PCIE_0_BCR] = { 0x6b000 },
+	[GCC_PCIE_0_PHY_BCR] = { 0x6c01c },
+	[GCC_PCIE_PHY_BCR] = { 0x6f000 },
+	[GCC_PCIE_PHY_COM_BCR] = { 0x6f010 },
+	[GCC_UFS_PHY_BCR] = { 0x77000 },
+	[GCC_USB20_SEC_BCR] = { 0xa6000 },
+	[GCC_USB3PHY_PHY_PRIM_SP0_BCR] = { 0x50008 },
+	[GCC_USB3_PHY_PRIM_SP0_BCR] = { 0x50000 },
+	[GCC_SDCC1_BCR] = { 0x12000 },
+	[GCC_SDCC2_BCR] = { 0x14000 },
+};
+
+static const struct clk_rcg_dfs_data gcc_dfs_clocks[] = {
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s5_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s5_clk_src),
+};
+
+static const struct regmap_config gcc_qcs615_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0xa609c,
+	.fast_io = true,
+};
+
+static const struct qcom_cc_desc gcc_qcs615_desc = {
+	.config = &gcc_qcs615_regmap_config,
+	.clk_hws = gcc_qcs615_hws,
+	.num_clk_hws = ARRAY_SIZE(gcc_qcs615_hws),
+	.clks = gcc_qcs615_clocks,
+	.num_clks = ARRAY_SIZE(gcc_qcs615_clocks),
+	.resets = gcc_qcs615_resets,
+	.num_resets = ARRAY_SIZE(gcc_qcs615_resets),
+	.gdscs = gcc_qcs615_gdscs,
+	.num_gdscs = ARRAY_SIZE(gcc_qcs615_gdscs),
+};
+
+static const struct of_device_id gcc_qcs615_match_table[] = {
+	{ .compatible = "qcom,qcs615-gcc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, gcc_qcs615_match_table);
+
+static int gcc_qcs615_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+	int ret;
+
+	regmap = qcom_cc_map(pdev, &gcc_qcs615_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+	/*
+	 * Disable the GPLL0 active input to MM blocks and GPU
+	 * via MISC registers.
+	 */
+	regmap_update_bits(regmap, 0x0b084, BIT(0), BIT(0));
+	regmap_update_bits(regmap, 0x9b000, BIT(0), BIT(0));
+
+	/* Keep some clocks always enabled */
+	qcom_branch_set_clk_en(regmap, 0xb008); /* GCC_CAMERA_AHB_CLK */
+	qcom_branch_set_clk_en(regmap, 0xb044); /* GCC_CAMERA_XO_CLK */
+	qcom_branch_set_clk_en(regmap, 0xb00c); /* GCC_DISP_AHB_CLK */
+	qcom_branch_set_clk_en(regmap, 0xb048); /* GCC_DISP_XO_CLK */
+	qcom_branch_set_clk_en(regmap, 0x71004); /* GCC_GPU_CFG_AHB_CLK */
+	qcom_branch_set_clk_en(regmap, 0xb004); /* GCC_VIDEO_AHB_CLK */
+	qcom_branch_set_clk_en(regmap, 0xb040); /* GCC_VIDEO_XO_CLK */
+	qcom_branch_set_clk_en(regmap, 0x480040); /* GCC_CPUSS_GNOC_CLK */
+
+	ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks,
+				       ARRAY_SIZE(gcc_dfs_clocks));
+	if (ret)
+		return ret;
+
+	return qcom_cc_really_probe(&pdev->dev, &gcc_qcs615_desc, regmap);
+}
+
+static struct platform_driver gcc_qcs615_driver = {
+	.probe = gcc_qcs615_probe,
+	.driver = {
+		.name = "gcc-qcs615",
+		.of_match_table = gcc_qcs615_match_table,
+	},
+};
+
+static int __init gcc_qcs615_init(void)
+{
+	return platform_driver_register(&gcc_qcs615_driver);
+}
+subsys_initcall(gcc_qcs615_init);
+
+static void __exit gcc_qcs615_exit(void)
+{
+	platform_driver_unregister(&gcc_qcs615_driver);
+}
+module_exit(gcc_qcs615_exit);
+
+MODULE_DESCRIPTION("QTI GCC QCS615 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-qcs8300.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-qcs8300.c
@@ -0,0 +1,3640 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,qcs8300-gcc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "clk-regmap-phy-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_SLEEP_CLK,
+	DT_PCIE_0_PIPE_CLK,
+	DT_PCIE_1_PIPE_CLK,
+	DT_PCIE_PHY_AUX_CLK,
+	DT_RXC0_REF_CLK,
+	DT_UFS_PHY_RX_SYMBOL_0_CLK,
+	DT_UFS_PHY_RX_SYMBOL_1_CLK,
+	DT_UFS_PHY_TX_SYMBOL_0_CLK,
+	DT_USB3_PHY_WRAPPER_GCC_USB30_PRIM_PIPE_CLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_GCC_GPLL0_OUT_EVEN,
+	P_GCC_GPLL0_OUT_MAIN,
+	P_GCC_GPLL1_OUT_MAIN,
+	P_GCC_GPLL4_OUT_MAIN,
+	P_GCC_GPLL7_OUT_MAIN,
+	P_GCC_GPLL9_OUT_MAIN,
+	P_PCIE_0_PIPE_CLK,
+	P_PCIE_1_PIPE_CLK,
+	P_PCIE_PHY_AUX_CLK,
+	P_RXC0_REF_CLK,
+	P_SLEEP_CLK,
+	P_UFS_PHY_RX_SYMBOL_0_CLK,
+	P_UFS_PHY_RX_SYMBOL_1_CLK,
+	P_UFS_PHY_TX_SYMBOL_0_CLK,
+	P_USB3_PHY_WRAPPER_GCC_USB30_PRIM_PIPE_CLK,
+};
+
+static struct clk_alpha_pll gcc_gpll0 = {
+	.offset = 0x0,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.enable_reg = 0x4b028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fixed_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct clk_div_table post_div_table_gcc_gpll0_out_even[] = {
+	{ 0x1, 2 },
+	{ }
+};
+
+static struct clk_alpha_pll_postdiv gcc_gpll0_out_even = {
+	.offset = 0x0,
+	.post_div_shift = 10,
+	.post_div_table = post_div_table_gcc_gpll0_out_even,
+	.num_post_div = ARRAY_SIZE(post_div_table_gcc_gpll0_out_even),
+	.width = 4,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_gpll0_out_even",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gcc_gpll0.clkr.hw,
+		},
+		.num_parents = 1,
+		.ops = &clk_alpha_pll_postdiv_lucid_evo_ops,
+	},
+};
+
+static struct clk_alpha_pll gcc_gpll1 = {
+	.offset = 0x1000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.enable_reg = 0x4b028,
+		.enable_mask = BIT(1),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fixed_lucid_evo_ops,
+		},
+	},
+};
+
+static struct clk_alpha_pll gcc_gpll4 = {
+	.offset = 0x4000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.enable_reg = 0x4b028,
+		.enable_mask = BIT(4),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpll4",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fixed_lucid_evo_ops,
+		},
+	},
+};
+
+static struct clk_alpha_pll gcc_gpll7 = {
+	.offset = 0x7000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.enable_reg = 0x4b028,
+		.enable_mask = BIT(7),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpll7",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fixed_lucid_evo_ops,
+		},
+	},
+};
+
+static struct clk_alpha_pll gcc_gpll9 = {
+	.offset = 0x9000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.enable_reg = 0x4b028,
+		.enable_mask = BIT(9),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpll9",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fixed_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct parent_map gcc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_GPLL0_OUT_MAIN, 1 },
+	{ P_GCC_GPLL0_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gcc_gpll0.clkr.hw },
+	{ .hw = &gcc_gpll0_out_even.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_GPLL0_OUT_MAIN, 1 },
+	{ P_SLEEP_CLK, 5 },
+	{ P_GCC_GPLL0_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gcc_gpll0.clkr.hw },
+	{ .index = DT_SLEEP_CLK },
+	{ .hw = &gcc_gpll0_out_even.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_SLEEP_CLK, 5 },
+};
+
+static const struct clk_parent_data gcc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_SLEEP_CLK },
+};
+
+static const struct parent_map gcc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_GPLL0_OUT_MAIN, 1 },
+	{ P_GCC_GPLL1_OUT_MAIN, 4 },
+	{ P_GCC_GPLL4_OUT_MAIN, 5 },
+	{ P_GCC_GPLL0_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gcc_gpll0.clkr.hw },
+	{ .hw = &gcc_gpll1.clkr.hw },
+	{ .hw = &gcc_gpll4.clkr.hw },
+	{ .hw = &gcc_gpll0_out_even.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_4[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_GPLL0_OUT_MAIN, 1 },
+	{ P_GCC_GPLL4_OUT_MAIN, 5 },
+	{ P_GCC_GPLL0_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_4[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gcc_gpll0.clkr.hw },
+	{ .hw = &gcc_gpll4.clkr.hw },
+	{ .hw = &gcc_gpll0_out_even.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_5[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data gcc_parent_data_5[] = {
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct parent_map gcc_parent_map_6[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_GPLL7_OUT_MAIN, 2 },
+	{ P_GCC_GPLL4_OUT_MAIN, 5 },
+	{ P_GCC_GPLL0_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_6[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gcc_gpll7.clkr.hw },
+	{ .hw = &gcc_gpll4.clkr.hw },
+	{ .hw = &gcc_gpll0_out_even.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_7[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_GPLL7_OUT_MAIN, 2 },
+	{ P_RXC0_REF_CLK, 3 },
+	{ P_GCC_GPLL0_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_7[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gcc_gpll7.clkr.hw },
+	{ .index = DT_RXC0_REF_CLK },
+	{ .hw = &gcc_gpll0_out_even.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_8[] = {
+	{ P_PCIE_PHY_AUX_CLK, 1 },
+	{ P_BI_TCXO, 2 },
+};
+
+static const struct clk_parent_data gcc_parent_data_8[] = {
+	{ .index = DT_PCIE_PHY_AUX_CLK },
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct parent_map gcc_parent_map_10[] = {
+	{ P_PCIE_PHY_AUX_CLK, 1 },
+	{ P_BI_TCXO, 2 },
+};
+
+static const struct clk_parent_data gcc_parent_data_10[] = {
+	{ .index = DT_PCIE_PHY_AUX_CLK },
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct parent_map gcc_parent_map_12[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_GPLL0_OUT_MAIN, 1 },
+	{ P_GCC_GPLL9_OUT_MAIN, 2 },
+	{ P_GCC_GPLL4_OUT_MAIN, 5 },
+	{ P_GCC_GPLL0_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_12[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gcc_gpll0.clkr.hw },
+	{ .hw = &gcc_gpll9.clkr.hw },
+	{ .hw = &gcc_gpll4.clkr.hw },
+	{ .hw = &gcc_gpll0_out_even.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_13[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_GPLL0_OUT_MAIN, 1 },
+};
+
+static const struct clk_parent_data gcc_parent_data_13[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gcc_gpll0.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_14[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GCC_GPLL0_OUT_MAIN, 1 },
+	{ P_GCC_GPLL4_OUT_MAIN, 3 },
+	{ P_GCC_GPLL0_OUT_EVEN, 6 },
+};
+
+static const struct clk_parent_data gcc_parent_data_14[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gcc_gpll0.clkr.hw },
+	{ .hw = &gcc_gpll4.clkr.hw },
+	{ .hw = &gcc_gpll0_out_even.clkr.hw },
+};
+
+static const struct parent_map gcc_parent_map_15[] = {
+	{ P_UFS_PHY_RX_SYMBOL_0_CLK, 0 },
+	{ P_BI_TCXO, 2 },
+};
+
+static const struct clk_parent_data gcc_parent_data_15[] = {
+	{ .index = DT_UFS_PHY_RX_SYMBOL_0_CLK },
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct parent_map gcc_parent_map_16[] = {
+	{ P_UFS_PHY_RX_SYMBOL_1_CLK, 0 },
+	{ P_BI_TCXO, 2 },
+};
+
+static const struct clk_parent_data gcc_parent_data_16[] = {
+	{ .index = DT_UFS_PHY_RX_SYMBOL_1_CLK },
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct parent_map gcc_parent_map_17[] = {
+	{ P_UFS_PHY_TX_SYMBOL_0_CLK, 0 },
+	{ P_BI_TCXO, 2 },
+};
+
+static const struct clk_parent_data gcc_parent_data_17[] = {
+	{ .index = DT_UFS_PHY_TX_SYMBOL_0_CLK },
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct parent_map gcc_parent_map_18[] = {
+	{ P_USB3_PHY_WRAPPER_GCC_USB30_PRIM_PIPE_CLK, 0 },
+	{ P_BI_TCXO, 2 },
+};
+
+static const struct clk_parent_data gcc_parent_data_18[] = {
+	{ .index = DT_USB3_PHY_WRAPPER_GCC_USB30_PRIM_PIPE_CLK },
+	{ .index = DT_BI_TCXO },
+};
+
+static struct clk_regmap_mux gcc_pcie_0_phy_aux_clk_src = {
+	.reg = 0xa9074,
+	.shift = 0,
+	.width = 2,
+	.parent_map = gcc_parent_map_8,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_phy_aux_clk_src",
+			.parent_data = gcc_parent_data_8,
+			.num_parents = ARRAY_SIZE(gcc_parent_data_8),
+			.ops = &clk_regmap_mux_closest_ops,
+		},
+	},
+};
+
+static struct clk_regmap_phy_mux gcc_pcie_0_pipe_clk_src = {
+	.reg = 0xa906c,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_pipe_clk_src",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_PCIE_0_PIPE_CLK,
+			},
+			.num_parents = 1,
+			.ops = &clk_regmap_phy_mux_ops,
+		},
+	},
+};
+
+static struct clk_regmap_mux gcc_pcie_1_phy_aux_clk_src = {
+	.reg = 0x77074,
+	.shift = 0,
+	.width = 2,
+	.parent_map = gcc_parent_map_10,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_phy_aux_clk_src",
+			.parent_data = gcc_parent_data_10,
+			.num_parents = ARRAY_SIZE(gcc_parent_data_10),
+			.ops = &clk_regmap_mux_closest_ops,
+		},
+	},
+};
+
+static struct clk_regmap_phy_mux gcc_pcie_1_pipe_clk_src = {
+	.reg = 0x7706c,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_pipe_clk_src",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_PCIE_1_PIPE_CLK,
+			},
+			.num_parents = 1,
+			.ops = &clk_regmap_phy_mux_ops,
+		},
+	},
+};
+
+static struct clk_regmap_mux gcc_ufs_phy_rx_symbol_0_clk_src = {
+	.reg = 0x83060,
+	.shift = 0,
+	.width = 2,
+	.parent_map = gcc_parent_map_15,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_rx_symbol_0_clk_src",
+			.parent_data = gcc_parent_data_15,
+			.num_parents = ARRAY_SIZE(gcc_parent_data_15),
+			.ops = &clk_regmap_mux_closest_ops,
+		},
+	},
+};
+
+static struct clk_regmap_mux gcc_ufs_phy_rx_symbol_1_clk_src = {
+	.reg = 0x830d0,
+	.shift = 0,
+	.width = 2,
+	.parent_map = gcc_parent_map_16,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_rx_symbol_1_clk_src",
+			.parent_data = gcc_parent_data_16,
+			.num_parents = ARRAY_SIZE(gcc_parent_data_16),
+			.ops = &clk_regmap_mux_closest_ops,
+		},
+	},
+};
+
+static struct clk_regmap_mux gcc_ufs_phy_tx_symbol_0_clk_src = {
+	.reg = 0x83050,
+	.shift = 0,
+	.width = 2,
+	.parent_map = gcc_parent_map_17,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_tx_symbol_0_clk_src",
+			.parent_data = gcc_parent_data_17,
+			.num_parents = ARRAY_SIZE(gcc_parent_data_17),
+			.ops = &clk_regmap_mux_closest_ops,
+		},
+	},
+};
+
+static struct clk_regmap_mux gcc_usb3_prim_phy_pipe_clk_src = {
+	.reg = 0x1b068,
+	.shift = 0,
+	.width = 2,
+	.parent_map = gcc_parent_map_18,
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb3_prim_phy_pipe_clk_src",
+			.parent_data = gcc_parent_data_18,
+			.num_parents = ARRAY_SIZE(gcc_parent_data_18),
+			.ops = &clk_regmap_mux_closest_ops,
+		},
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_emac0_phy_aux_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_emac0_phy_aux_clk_src = {
+	.cmd_rcgr = 0xb6028,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_2,
+	.freq_tbl = ftbl_gcc_emac0_phy_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_emac0_phy_aux_clk_src",
+		.parent_data = gcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_emac0_ptp_clk_src[] = {
+	F(125000000, P_GCC_GPLL7_OUT_MAIN, 8, 0, 0),
+	F(230400000, P_GCC_GPLL4_OUT_MAIN, 3.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_emac0_ptp_clk_src = {
+	.cmd_rcgr = 0xb6060,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_6,
+	.freq_tbl = ftbl_gcc_emac0_ptp_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_emac0_ptp_clk_src",
+		.parent_data = gcc_parent_data_6,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_6),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_emac0_rgmii_clk_src[] = {
+	F(5000000, P_GCC_GPLL0_OUT_EVEN, 10, 1, 6),
+	F(50000000, P_GCC_GPLL0_OUT_EVEN, 6, 0, 0),
+	F(125000000, P_GCC_GPLL7_OUT_MAIN, 8, 0, 0),
+	F(250000000, P_GCC_GPLL7_OUT_MAIN, 4, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_emac0_rgmii_clk_src = {
+	.cmd_rcgr = 0xb6048,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_7,
+	.freq_tbl = ftbl_gcc_emac0_rgmii_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_emac0_rgmii_clk_src",
+		.parent_data = gcc_parent_data_7,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_7),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_gp1_clk_src[] = {
+	F(100000000, P_GCC_GPLL0_OUT_MAIN, 6, 0, 0),
+	F(200000000, P_GCC_GPLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_gp1_clk_src = {
+	.cmd_rcgr = 0x70004,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_gp1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_gp1_clk_src",
+		.parent_data = gcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_gp2_clk_src = {
+	.cmd_rcgr = 0x71004,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_gp1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_gp2_clk_src",
+		.parent_data = gcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_gp3_clk_src = {
+	.cmd_rcgr = 0x62004,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_gp1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_gp3_clk_src",
+		.parent_data = gcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_gp4_clk_src = {
+	.cmd_rcgr = 0x1e004,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_gp1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_gp4_clk_src",
+		.parent_data = gcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_gp5_clk_src = {
+	.cmd_rcgr = 0x1f004,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_1,
+	.freq_tbl = ftbl_gcc_gp1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_gp5_clk_src",
+		.parent_data = gcc_parent_data_1,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_pcie_0_aux_clk_src = {
+	.cmd_rcgr = 0xa9078,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_2,
+	.freq_tbl = ftbl_gcc_emac0_phy_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pcie_0_aux_clk_src",
+		.parent_data = gcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_pcie_0_phy_rchng_clk_src[] = {
+	F(100000000, P_GCC_GPLL0_OUT_MAIN, 6, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_pcie_0_phy_rchng_clk_src = {
+	.cmd_rcgr = 0xa9054,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_pcie_0_phy_rchng_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pcie_0_phy_rchng_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_pcie_1_aux_clk_src = {
+	.cmd_rcgr = 0x77078,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_2,
+	.freq_tbl = ftbl_gcc_emac0_phy_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pcie_1_aux_clk_src",
+		.parent_data = gcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_pcie_1_phy_rchng_clk_src = {
+	.cmd_rcgr = 0x77054,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_pcie_0_phy_rchng_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pcie_1_phy_rchng_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_pdm2_clk_src[] = {
+	F(60000000, P_GCC_GPLL0_OUT_MAIN, 10, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_pdm2_clk_src = {
+	.cmd_rcgr = 0x3f010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_pdm2_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pdm2_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_qupv3_wrap0_s0_clk_src[] = {
+	F(7372800, P_GCC_GPLL0_OUT_EVEN, 1, 384, 15625),
+	F(14745600, P_GCC_GPLL0_OUT_EVEN, 1, 768, 15625),
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(29491200, P_GCC_GPLL0_OUT_EVEN, 1, 1536, 15625),
+	F(32000000, P_GCC_GPLL0_OUT_EVEN, 1, 8, 75),
+	F(48000000, P_GCC_GPLL0_OUT_EVEN, 1, 4, 25),
+	F(64000000, P_GCC_GPLL0_OUT_EVEN, 1, 16, 75),
+	F(80000000, P_GCC_GPLL0_OUT_EVEN, 1, 4, 15),
+	F(96000000, P_GCC_GPLL0_OUT_EVEN, 1, 8, 25),
+	F(120000000, P_GCC_GPLL0_OUT_MAIN, 5, 0, 0),
+	{ }
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s0_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
+	.cmd_rcgr = 0x23154,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s1_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
+	.cmd_rcgr = 0x23288,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s1_clk_src_init,
+};
+
+static const struct freq_tbl ftbl_gcc_qupv3_wrap0_s2_clk_src[] = {
+	F(7372800, P_GCC_GPLL0_OUT_EVEN, 1, 384, 15625),
+	F(14745600, P_GCC_GPLL0_OUT_EVEN, 1, 768, 15625),
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(29491200, P_GCC_GPLL0_OUT_EVEN, 1, 1536, 15625),
+	F(32000000, P_GCC_GPLL0_OUT_EVEN, 1, 8, 75),
+	F(48000000, P_GCC_GPLL0_OUT_EVEN, 1, 4, 25),
+	F(64000000, P_GCC_GPLL0_OUT_EVEN, 1, 16, 75),
+	F(80000000, P_GCC_GPLL0_OUT_EVEN, 1, 4, 15),
+	F(96000000, P_GCC_GPLL0_OUT_EVEN, 1, 8, 25),
+	F(100000000, P_GCC_GPLL0_OUT_MAIN, 6, 0, 0),
+	{ }
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s2_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
+	.cmd_rcgr = 0x233bc,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s3_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
+	.cmd_rcgr = 0x234f0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s4_clk_src",
+	.parent_data = gcc_parent_data_4,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_4),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
+	.cmd_rcgr = 0x23624,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_4,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s5_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
+	.cmd_rcgr = 0x23758,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s5_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s6_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s6_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s6_clk_src = {
+	.cmd_rcgr = 0x2388c,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s6_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s7_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s7_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap0_s7_clk_src = {
+	.cmd_rcgr = 0x239c0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap0_s7_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s0_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
+	.cmd_rcgr = 0x24154,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s1_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
+	.cmd_rcgr = 0x24288,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s1_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s2_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
+	.cmd_rcgr = 0x243bc,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s3_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
+	.cmd_rcgr = 0x244f0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s4_clk_src",
+	.parent_data = gcc_parent_data_4,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_4),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
+	.cmd_rcgr = 0x24624,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_4,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s5_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
+	.cmd_rcgr = 0x24758,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s5_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s6_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s6_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s6_clk_src = {
+	.cmd_rcgr = 0x2488c,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s6_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s7_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s7_clk_src",
+	.parent_data = gcc_parent_data_0,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap1_s7_clk_src = {
+	.cmd_rcgr = 0x249c0,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_qupv3_wrap0_s2_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap1_s7_clk_src_init,
+};
+
+static const struct freq_tbl ftbl_gcc_qupv3_wrap3_s0_clk_src[] = {
+	F(7372800, P_GCC_GPLL0_OUT_EVEN, 1, 384, 15625),
+	F(14745600, P_GCC_GPLL0_OUT_EVEN, 1, 768, 15625),
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(29491200, P_GCC_GPLL0_OUT_EVEN, 1, 1536, 15625),
+	F(32000000, P_GCC_GPLL0_OUT_EVEN, 1, 8, 75),
+	F(48000000, P_GCC_GPLL0_OUT_EVEN, 1, 4, 25),
+	F(64000000, P_GCC_GPLL0_OUT_EVEN, 1, 16, 75),
+	F(75000000, P_GCC_GPLL0_OUT_EVEN, 4, 0, 0),
+	F(80000000, P_GCC_GPLL0_OUT_EVEN, 1, 4, 15),
+	F(96000000, P_GCC_GPLL0_OUT_EVEN, 1, 8, 25),
+	F(100000000, P_GCC_GPLL0_OUT_MAIN, 6, 0, 0),
+	F(403200000, P_GCC_GPLL4_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_init_data gcc_qupv3_wrap3_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap3_s0_clk_src",
+	.parent_data = gcc_parent_data_3,
+	.num_parents = ARRAY_SIZE(gcc_parent_data_3),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_shared_ops,
+};
+
+static struct clk_rcg2 gcc_qupv3_wrap3_s0_clk_src = {
+	.cmd_rcgr = 0xc4158,
+	.mnd_width = 16,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_3,
+	.freq_tbl = ftbl_gcc_qupv3_wrap3_s0_clk_src,
+	.clkr.hw.init = &gcc_qupv3_wrap3_s0_clk_src_init,
+};
+
+static const struct freq_tbl ftbl_gcc_sdcc1_apps_clk_src[] = {
+	F(144000, P_BI_TCXO, 16, 3, 25),
+	F(400000, P_BI_TCXO, 12, 1, 4),
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(20000000, P_GCC_GPLL0_OUT_EVEN, 5, 1, 3),
+	F(25000000, P_GCC_GPLL0_OUT_EVEN, 12, 0, 0),
+	F(50000000, P_GCC_GPLL0_OUT_EVEN, 6, 0, 0),
+	F(100000000, P_GCC_GPLL0_OUT_EVEN, 3, 0, 0),
+	F(192000000, P_GCC_GPLL9_OUT_MAIN, 4, 0, 0),
+	F(384000000, P_GCC_GPLL9_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_sdcc1_apps_clk_src = {
+	.cmd_rcgr = 0x20014,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_12,
+	.freq_tbl = ftbl_gcc_sdcc1_apps_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_sdcc1_apps_clk_src",
+		.parent_data = gcc_parent_data_12,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_12),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_floor_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_sdcc1_ice_core_clk_src[] = {
+	F(150000000, P_GCC_GPLL0_OUT_MAIN, 4, 0, 0),
+	F(300000000, P_GCC_GPLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
+	.cmd_rcgr = 0x2002c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_13,
+	.freq_tbl = ftbl_gcc_sdcc1_ice_core_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_sdcc1_ice_core_clk_src",
+		.parent_data = gcc_parent_data_13,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_13),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_floor_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_ufs_phy_axi_clk_src[] = {
+	F(25000000, P_GCC_GPLL0_OUT_EVEN, 12, 0, 0),
+	F(75000000, P_GCC_GPLL0_OUT_EVEN, 4, 0, 0),
+	F(150000000, P_GCC_GPLL0_OUT_MAIN, 4, 0, 0),
+	F(300000000, P_GCC_GPLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = {
+	.cmd_rcgr = 0x8302c,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_ufs_phy_axi_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_ufs_phy_axi_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_ufs_phy_ice_core_clk_src[] = {
+	F(75000000, P_GCC_GPLL0_OUT_EVEN, 4, 0, 0),
+	F(201600000, P_GCC_GPLL4_OUT_MAIN, 4, 0, 0),
+	F(403200000, P_GCC_GPLL4_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = {
+	.cmd_rcgr = 0x83074,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_14,
+	.freq_tbl = ftbl_gcc_ufs_phy_ice_core_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_ufs_phy_ice_core_clk_src",
+		.parent_data = gcc_parent_data_14,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_14),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_ufs_phy_phy_aux_clk_src = {
+	.cmd_rcgr = 0x830a8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_5,
+	.freq_tbl = ftbl_gcc_emac0_phy_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_ufs_phy_phy_aux_clk_src",
+		.parent_data = gcc_parent_data_5,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_5),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_ufs_phy_unipro_core_clk_src[] = {
+	F(75000000, P_GCC_GPLL0_OUT_EVEN, 4, 0, 0),
+	F(150000000, P_GCC_GPLL0_OUT_MAIN, 4, 0, 0),
+	F(300000000, P_GCC_GPLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = {
+	.cmd_rcgr = 0x8308c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_ufs_phy_unipro_core_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_ufs_phy_unipro_core_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_usb20_master_clk_src[] = {
+	F(120000000, P_GCC_GPLL0_OUT_MAIN, 5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_usb20_master_clk_src = {
+	.cmd_rcgr = 0x1c028,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_usb20_master_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb20_master_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_usb20_mock_utmi_clk_src = {
+	.cmd_rcgr = 0x1c040,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_emac0_phy_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb20_mock_utmi_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gcc_usb30_prim_master_clk_src[] = {
+	F(133333333, P_GCC_GPLL0_OUT_MAIN, 4.5, 0, 0),
+	F(200000000, P_GCC_GPLL0_OUT_MAIN, 3, 0, 0),
+	F(240000000, P_GCC_GPLL0_OUT_MAIN, 2.5, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
+	.cmd_rcgr = 0x1b028,
+	.mnd_width = 8,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_usb30_prim_master_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb30_prim_master_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = {
+	.cmd_rcgr = 0x1b040,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_0,
+	.freq_tbl = ftbl_gcc_emac0_phy_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb30_prim_mock_utmi_clk_src",
+		.parent_data = gcc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = {
+	.cmd_rcgr = 0x1b06c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gcc_parent_map_2,
+	.freq_tbl = ftbl_gcc_emac0_phy_aux_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb3_prim_phy_aux_clk_src",
+		.parent_data = gcc_parent_data_2,
+		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_regmap_div gcc_pcie_0_pipe_div_clk_src = {
+	.reg = 0xa9070,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pcie_0_pipe_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gcc_pcie_0_pipe_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div gcc_pcie_1_pipe_div_clk_src = {
+	.reg = 0x77070,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_pcie_1_pipe_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gcc_pcie_1_pipe_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div gcc_qupv3_wrap3_s0_div_clk_src = {
+	.reg = 0xc4288,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_qupv3_wrap3_s0_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gcc_qupv3_wrap3_s0_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div gcc_usb20_mock_utmi_postdiv_clk_src = {
+	.reg = 0x1c058,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb20_mock_utmi_postdiv_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gcc_usb20_mock_utmi_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div gcc_usb30_prim_mock_utmi_postdiv_clk_src = {
+	.reg = 0x1b058,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gcc_usb30_prim_mock_utmi_postdiv_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gcc_usb30_prim_mock_utmi_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_branch gcc_aggre_noc_qupv3_axi_clk = {
+	.halt_reg = 0x8e200,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x8e200,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(28),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_aggre_noc_qupv3_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_aggre_ufs_phy_axi_clk = {
+	.halt_reg = 0x830d4,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x830d4,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x830d4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_aggre_ufs_phy_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_aggre_usb2_prim_axi_clk = {
+	.halt_reg = 0x1c05c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x1c05c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x1c05c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_aggre_usb2_prim_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb20_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_aggre_usb3_prim_axi_clk = {
+	.halt_reg = 0x1b084,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x1b084,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x1b084,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_aggre_usb3_prim_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb30_prim_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ahb2phy0_clk = {
+	.halt_reg = 0x76004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x76004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x76004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ahb2phy0_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ahb2phy2_clk = {
+	.halt_reg = 0x76008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x76008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x76008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ahb2phy2_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ahb2phy3_clk = {
+	.halt_reg = 0x7600c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x7600c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x7600c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ahb2phy3_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_boot_rom_ahb_clk = {
+	.halt_reg = 0x44004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x44004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(10),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_boot_rom_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_camera_hf_axi_clk = {
+	.halt_reg = 0x32010,
+	.halt_check = BRANCH_HALT_SKIP,
+	.hwcg_reg = 0x32010,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x32010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_camera_hf_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_camera_sf_axi_clk = {
+	.halt_reg = 0x32018,
+	.halt_check = BRANCH_HALT_SKIP,
+	.hwcg_reg = 0x32018,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x32018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_camera_sf_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_camera_throttle_xo_clk = {
+	.halt_reg = 0x32024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x32024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_camera_throttle_xo_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_cfg_noc_usb2_prim_axi_clk = {
+	.halt_reg = 0x1c060,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x1c060,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x1c060,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_cfg_noc_usb2_prim_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb20_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_cfg_noc_usb3_prim_axi_clk = {
+	.halt_reg = 0x1b088,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x1b088,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x1b088,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_cfg_noc_usb3_prim_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb30_prim_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ddrss_gpu_axi_clk = {
+	.halt_reg = 0x7d164,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x7d164,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x7d164,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ddrss_gpu_axi_clk",
+			.ops = &clk_branch2_aon_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_disp_hf_axi_clk = {
+	.halt_reg = 0x33010,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x33010,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x33010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_disp_hf_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_edp_ref_clkref_en = {
+	.halt_reg = 0x97448,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x97448,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_edp_ref_clkref_en",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_emac0_axi_clk = {
+	.halt_reg = 0xb6018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0xb6018,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0xb6018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_emac0_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_emac0_phy_aux_clk = {
+	.halt_reg = 0xb6024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb6024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_emac0_phy_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_emac0_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_emac0_ptp_clk = {
+	.halt_reg = 0xb6040,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb6040,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_emac0_ptp_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_emac0_ptp_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_emac0_rgmii_clk = {
+	.halt_reg = 0xb6044,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb6044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_emac0_rgmii_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_emac0_rgmii_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_emac0_slv_ahb_clk = {
+	.halt_reg = 0xb6020,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0xb6020,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0xb6020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_emac0_slv_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gp1_clk = {
+	.halt_reg = 0x70000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x70000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gp1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gp1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gp2_clk = {
+	.halt_reg = 0x71000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x71000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gp2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gp2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gp3_clk = {
+	.halt_reg = 0x62000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x62000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gp3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gp3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gp4_clk = {
+	.halt_reg = 0x1e000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1e000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gp4_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gp4_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gp5_clk = {
+	.halt_reg = 0x1f000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1f000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gp5_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gp5_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_gpll0_clk_src = {
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(15),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_gpll0_clk_src",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gpll0.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_gpll0_div_clk_src = {
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(16),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_gpll0_div_clk_src",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_gpll0_out_even.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_memnoc_gfx_center_pipeline_clk = {
+	.halt_reg = 0x7d160,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x7d160,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x7d160,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_memnoc_gfx_center_pipeline_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_memnoc_gfx_clk = {
+	.halt_reg = 0x7d010,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x7d010,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x7d010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_memnoc_gfx_clk",
+			.ops = &clk_branch2_aon_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_snoc_dvm_gfx_clk = {
+	.halt_reg = 0x7d01c,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x7d01c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_snoc_dvm_gfx_clk",
+			.ops = &clk_branch2_aon_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_tcu_throttle_ahb_clk = {
+	.halt_reg = 0x7d008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x7d008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x7d008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_tcu_throttle_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_gpu_tcu_throttle_clk = {
+	.halt_reg = 0x7d014,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x7d014,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x7d014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_gpu_tcu_throttle_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_aux_clk = {
+	.halt_reg = 0xa9038,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b010,
+		.enable_mask = BIT(16),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_0_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_cfg_ahb_clk = {
+	.halt_reg = 0xa902c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0xa902c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b010,
+		.enable_mask = BIT(12),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_cfg_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_mstr_axi_clk = {
+	.halt_reg = 0xa9024,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b010,
+		.enable_mask = BIT(11),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_mstr_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_phy_aux_clk = {
+	.halt_reg = 0xa9030,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b010,
+		.enable_mask = BIT(13),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_phy_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_0_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_phy_rchng_clk = {
+	.halt_reg = 0xa9050,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b010,
+		.enable_mask = BIT(15),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_phy_rchng_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_0_phy_rchng_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_pipe_clk = {
+	.halt_reg = 0xa9040,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x4b010,
+		.enable_mask = BIT(14),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_pipe_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_0_pipe_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_pipediv2_clk = {
+	.halt_reg = 0xa9048,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x4b018,
+		.enable_mask = BIT(22),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_pipediv2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_0_pipe_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_slv_axi_clk = {
+	.halt_reg = 0xa901c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b010,
+		.enable_mask = BIT(10),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_slv_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_0_slv_q2a_axi_clk = {
+	.halt_reg = 0xa9018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b018,
+		.enable_mask = BIT(12),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_0_slv_q2a_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_1_aux_clk = {
+	.halt_reg = 0x77038,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(31),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_1_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_1_cfg_ahb_clk = {
+	.halt_reg = 0x7702c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x7702c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(2),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_cfg_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_1_mstr_axi_clk = {
+	.halt_reg = 0x77024,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(1),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_mstr_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_1_phy_aux_clk = {
+	.halt_reg = 0x77030,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(3),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_phy_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_1_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_1_phy_rchng_clk = {
+	.halt_reg = 0x77050,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(22),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_phy_rchng_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_1_phy_rchng_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_1_pipe_clk = {
+	.halt_reg = 0x77040,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(4),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_pipe_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_1_pipe_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_1_pipediv2_clk = {
+	.halt_reg = 0x77048,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x4b018,
+		.enable_mask = BIT(16),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_pipediv2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pcie_1_pipe_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_1_slv_axi_clk = {
+	.halt_reg = 0x7701c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_slv_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_1_slv_q2a_axi_clk = {
+	.halt_reg = 0x77018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(5),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_1_slv_q2a_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_clkref_en = {
+	.halt_reg = 0x9746c,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x9746c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_clkref_en",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pcie_throttle_cfg_clk = {
+	.halt_reg = 0xb2034,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b020,
+		.enable_mask = BIT(15),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pcie_throttle_cfg_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pdm2_clk = {
+	.halt_reg = 0x3f00c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x3f00c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pdm2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_pdm2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pdm_ahb_clk = {
+	.halt_reg = 0x3f004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x3f004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x3f004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pdm_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_pdm_xo4_clk = {
+	.halt_reg = 0x3f008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x3f008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_pdm_xo4_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_camera_nrt_ahb_clk = {
+	.halt_reg = 0x32008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x32008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x32008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_camera_nrt_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_camera_rt_ahb_clk = {
+	.halt_reg = 0x3200c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x3200c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x3200c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_camera_rt_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_disp_ahb_clk = {
+	.halt_reg = 0x33008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x33008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x33008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_disp_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_disp_rot_ahb_clk = {
+	.halt_reg = 0x3300c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x3300c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_disp_rot_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_video_cvp_ahb_clk = {
+	.halt_reg = 0x34008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x34008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x34008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_video_cvp_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_video_vcodec_ahb_clk = {
+	.halt_reg = 0x3400c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x3400c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x3400c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_video_vcodec_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qmip_video_vcpu_ahb_clk = {
+	.halt_reg = 0x34010,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x34010,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x34010,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qmip_video_vcpu_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_core_2x_clk = {
+	.halt_reg = 0x23018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(9),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_core_2x_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_core_clk = {
+	.halt_reg = 0x2300c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(8),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_core_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s0_clk = {
+	.halt_reg = 0x2314c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(10),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s1_clk = {
+	.halt_reg = 0x23280,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(11),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s2_clk = {
+	.halt_reg = 0x233b4,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(12),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s3_clk = {
+	.halt_reg = 0x234e8,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(13),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s4_clk = {
+	.halt_reg = 0x2361c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(14),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s4_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s4_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s5_clk = {
+	.halt_reg = 0x23750,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(15),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s5_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s5_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s6_clk = {
+	.halt_reg = 0x23884,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(16),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s6_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s6_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap0_s7_clk = {
+	.halt_reg = 0x239b8,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(17),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap0_s7_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap0_s7_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_core_2x_clk = {
+	.halt_reg = 0x24018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(18),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_core_2x_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_core_clk = {
+	.halt_reg = 0x2400c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(19),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_core_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s0_clk = {
+	.halt_reg = 0x2414c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(22),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s1_clk = {
+	.halt_reg = 0x24280,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(23),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s2_clk = {
+	.halt_reg = 0x243b4,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(24),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s2_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s2_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s3_clk = {
+	.halt_reg = 0x244e8,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(25),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s3_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s3_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s4_clk = {
+	.halt_reg = 0x2461c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(26),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s4_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s4_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s5_clk = {
+	.halt_reg = 0x24750,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(27),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s5_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s5_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s6_clk = {
+	.halt_reg = 0x24884,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b018,
+		.enable_mask = BIT(27),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s6_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s6_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap1_s7_clk = {
+	.halt_reg = 0x249b8,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b018,
+		.enable_mask = BIT(28),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap1_s7_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap1_s7_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap3_core_2x_clk = {
+	.halt_reg = 0xc4018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(24),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap3_core_2x_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap3_core_clk = {
+	.halt_reg = 0xc400c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(23),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap3_core_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap3_qspi_clk = {
+	.halt_reg = 0xc4284,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(26),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap3_qspi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap3_s0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap3_s0_clk = {
+	.halt_reg = 0xc4150,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(25),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap3_s0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_qupv3_wrap3_s0_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_0_m_ahb_clk = {
+	.halt_reg = 0x23004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x23004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(6),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_0_m_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_0_s_ahb_clk = {
+	.halt_reg = 0x23008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x23008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(7),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_0_s_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_1_m_ahb_clk = {
+	.halt_reg = 0x24004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x24004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(20),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_1_m_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_1_s_ahb_clk = {
+	.halt_reg = 0x24008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x24008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b008,
+		.enable_mask = BIT(21),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_1_s_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_3_m_ahb_clk = {
+	.halt_reg = 0xc4004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0xc4004,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(27),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_3_m_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_qupv3_wrap_3_s_ahb_clk = {
+	.halt_reg = 0xc4008,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0xc4008,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x4b000,
+		.enable_mask = BIT(20),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_qupv3_wrap_3_s_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sdcc1_ahb_clk = {
+	.halt_reg = 0x2000c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x2000c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_sdcc1_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sdcc1_apps_clk = {
+	.halt_reg = 0x20004,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x20004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_sdcc1_apps_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_sdcc1_apps_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sdcc1_ice_core_clk = {
+	.halt_reg = 0x20044,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x20044,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x20044,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_sdcc1_ice_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_sdcc1_ice_core_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_sgmi_clkref_en = {
+	.halt_reg = 0x97034,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x97034,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_sgmi_clkref_en",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_ahb_clk = {
+	.halt_reg = 0x83020,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x83020,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x83020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_axi_clk = {
+	.halt_reg = 0x83018,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x83018,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x83018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_axi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_axi_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_ice_core_clk = {
+	.halt_reg = 0x8306c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x8306c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x8306c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_ice_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_ice_core_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_phy_aux_clk = {
+	.halt_reg = 0x830a4,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x830a4,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x830a4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_phy_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_rx_symbol_0_clk = {
+	.halt_reg = 0x83028,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x83028,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_rx_symbol_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_rx_symbol_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_rx_symbol_1_clk = {
+	.halt_reg = 0x830c0,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x830c0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_rx_symbol_1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_rx_symbol_1_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_tx_symbol_0_clk = {
+	.halt_reg = 0x83024,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x83024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_tx_symbol_0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_tx_symbol_0_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_ufs_phy_unipro_core_clk = {
+	.halt_reg = 0x83064,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x83064,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x83064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_ufs_phy_unipro_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_ufs_phy_unipro_core_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb20_master_clk = {
+	.halt_reg = 0x1c018,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1c018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb20_master_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb20_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb20_mock_utmi_clk = {
+	.halt_reg = 0x1c024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1c024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb20_mock_utmi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb20_mock_utmi_postdiv_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb20_sleep_clk = {
+	.halt_reg = 0x1c020,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1c020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb20_sleep_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb30_prim_master_clk = {
+	.halt_reg = 0x1b018,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1b018,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb30_prim_master_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb30_prim_master_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb30_prim_mock_utmi_clk = {
+	.halt_reg = 0x1b024,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1b024,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb30_prim_mock_utmi_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb30_prim_mock_utmi_postdiv_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb30_prim_sleep_clk = {
+	.halt_reg = 0x1b020,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1b020,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb30_prim_sleep_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb3_prim_phy_aux_clk = {
+	.halt_reg = 0x1b05c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1b05c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb3_prim_phy_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb3_prim_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb3_prim_phy_com_aux_clk = {
+	.halt_reg = 0x1b060,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1b060,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb3_prim_phy_com_aux_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb3_prim_phy_aux_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb3_prim_phy_pipe_clk = {
+	.halt_reg = 0x1b064,
+	.halt_check = BRANCH_HALT_DELAY,
+	.hwcg_reg = 0x1b064,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x1b064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb3_prim_phy_pipe_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gcc_usb3_prim_phy_pipe_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_usb_clkref_en = {
+	.halt_reg = 0x97468,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x97468,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_usb_clkref_en",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_video_axi0_clk = {
+	.halt_reg = 0x34014,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x34014,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x34014,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_video_axi0_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gcc_video_axi1_clk = {
+	.halt_reg = 0x3401c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x3401c,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x3401c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gcc_video_axi1_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc gcc_emac0_gdsc = {
+	.gdscr = 0xb6004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "gcc_emac0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+};
+
+static struct gdsc gcc_pcie_0_gdsc = {
+	.gdscr = 0xa9004,
+	.collapse_ctrl = 0x4b104,
+	.collapse_mask = BIT(0),
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "gcc_pcie_0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE | RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
+};
+
+static struct gdsc gcc_pcie_1_gdsc = {
+	.gdscr = 0x77004,
+	.collapse_ctrl = 0x4b104,
+	.collapse_mask = BIT(1),
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "gcc_pcie_1_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE | RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
+};
+
+static struct gdsc gcc_ufs_phy_gdsc = {
+	.gdscr = 0x83004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "gcc_ufs_phy_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
+};
+
+static struct gdsc gcc_usb20_prim_gdsc = {
+	.gdscr = 0x1c004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "gcc_usb20_prim_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
+};
+
+static struct gdsc gcc_usb30_prim_gdsc = {
+	.gdscr = 0x1b004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "gcc_usb30_prim_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
+};
+
+static struct clk_regmap *gcc_qcs8300_clocks[] = {
+	[GCC_AGGRE_NOC_QUPV3_AXI_CLK] = &gcc_aggre_noc_qupv3_axi_clk.clkr,
+	[GCC_AGGRE_UFS_PHY_AXI_CLK] = &gcc_aggre_ufs_phy_axi_clk.clkr,
+	[GCC_AGGRE_USB2_PRIM_AXI_CLK] = &gcc_aggre_usb2_prim_axi_clk.clkr,
+	[GCC_AGGRE_USB3_PRIM_AXI_CLK] = &gcc_aggre_usb3_prim_axi_clk.clkr,
+	[GCC_AHB2PHY0_CLK] = &gcc_ahb2phy0_clk.clkr,
+	[GCC_AHB2PHY2_CLK] = &gcc_ahb2phy2_clk.clkr,
+	[GCC_AHB2PHY3_CLK] = &gcc_ahb2phy3_clk.clkr,
+	[GCC_BOOT_ROM_AHB_CLK] = &gcc_boot_rom_ahb_clk.clkr,
+	[GCC_CAMERA_HF_AXI_CLK] = &gcc_camera_hf_axi_clk.clkr,
+	[GCC_CAMERA_SF_AXI_CLK] = &gcc_camera_sf_axi_clk.clkr,
+	[GCC_CAMERA_THROTTLE_XO_CLK] = &gcc_camera_throttle_xo_clk.clkr,
+	[GCC_CFG_NOC_USB2_PRIM_AXI_CLK] = &gcc_cfg_noc_usb2_prim_axi_clk.clkr,
+	[GCC_CFG_NOC_USB3_PRIM_AXI_CLK] = &gcc_cfg_noc_usb3_prim_axi_clk.clkr,
+	[GCC_DDRSS_GPU_AXI_CLK] = &gcc_ddrss_gpu_axi_clk.clkr,
+	[GCC_DISP_HF_AXI_CLK] = &gcc_disp_hf_axi_clk.clkr,
+	[GCC_EDP_REF_CLKREF_EN] = &gcc_edp_ref_clkref_en.clkr,
+	[GCC_EMAC0_AXI_CLK] = &gcc_emac0_axi_clk.clkr,
+	[GCC_EMAC0_PHY_AUX_CLK] = &gcc_emac0_phy_aux_clk.clkr,
+	[GCC_EMAC0_PHY_AUX_CLK_SRC] = &gcc_emac0_phy_aux_clk_src.clkr,
+	[GCC_EMAC0_PTP_CLK] = &gcc_emac0_ptp_clk.clkr,
+	[GCC_EMAC0_PTP_CLK_SRC] = &gcc_emac0_ptp_clk_src.clkr,
+	[GCC_EMAC0_RGMII_CLK] = &gcc_emac0_rgmii_clk.clkr,
+	[GCC_EMAC0_RGMII_CLK_SRC] = &gcc_emac0_rgmii_clk_src.clkr,
+	[GCC_EMAC0_SLV_AHB_CLK] = &gcc_emac0_slv_ahb_clk.clkr,
+	[GCC_GP1_CLK] = &gcc_gp1_clk.clkr,
+	[GCC_GP1_CLK_SRC] = &gcc_gp1_clk_src.clkr,
+	[GCC_GP2_CLK] = &gcc_gp2_clk.clkr,
+	[GCC_GP2_CLK_SRC] = &gcc_gp2_clk_src.clkr,
+	[GCC_GP3_CLK] = &gcc_gp3_clk.clkr,
+	[GCC_GP3_CLK_SRC] = &gcc_gp3_clk_src.clkr,
+	[GCC_GP4_CLK] = &gcc_gp4_clk.clkr,
+	[GCC_GP4_CLK_SRC] = &gcc_gp4_clk_src.clkr,
+	[GCC_GP5_CLK] = &gcc_gp5_clk.clkr,
+	[GCC_GP5_CLK_SRC] = &gcc_gp5_clk_src.clkr,
+	[GCC_GPLL0] = &gcc_gpll0.clkr,
+	[GCC_GPLL0_OUT_EVEN] = &gcc_gpll0_out_even.clkr,
+	[GCC_GPLL1] = &gcc_gpll1.clkr,
+	[GCC_GPLL4] = &gcc_gpll4.clkr,
+	[GCC_GPLL7] = &gcc_gpll7.clkr,
+	[GCC_GPLL9] = &gcc_gpll9.clkr,
+	[GCC_GPU_GPLL0_CLK_SRC] = &gcc_gpu_gpll0_clk_src.clkr,
+	[GCC_GPU_GPLL0_DIV_CLK_SRC] = &gcc_gpu_gpll0_div_clk_src.clkr,
+	[GCC_GPU_MEMNOC_GFX_CENTER_PIPELINE_CLK] = &gcc_gpu_memnoc_gfx_center_pipeline_clk.clkr,
+	[GCC_GPU_MEMNOC_GFX_CLK] = &gcc_gpu_memnoc_gfx_clk.clkr,
+	[GCC_GPU_SNOC_DVM_GFX_CLK] = &gcc_gpu_snoc_dvm_gfx_clk.clkr,
+	[GCC_GPU_TCU_THROTTLE_AHB_CLK] = &gcc_gpu_tcu_throttle_ahb_clk.clkr,
+	[GCC_GPU_TCU_THROTTLE_CLK] = &gcc_gpu_tcu_throttle_clk.clkr,
+	[GCC_PCIE_0_AUX_CLK] = &gcc_pcie_0_aux_clk.clkr,
+	[GCC_PCIE_0_AUX_CLK_SRC] = &gcc_pcie_0_aux_clk_src.clkr,
+	[GCC_PCIE_0_CFG_AHB_CLK] = &gcc_pcie_0_cfg_ahb_clk.clkr,
+	[GCC_PCIE_0_MSTR_AXI_CLK] = &gcc_pcie_0_mstr_axi_clk.clkr,
+	[GCC_PCIE_0_PHY_AUX_CLK] = &gcc_pcie_0_phy_aux_clk.clkr,
+	[GCC_PCIE_0_PHY_AUX_CLK_SRC] = &gcc_pcie_0_phy_aux_clk_src.clkr,
+	[GCC_PCIE_0_PHY_RCHNG_CLK] = &gcc_pcie_0_phy_rchng_clk.clkr,
+	[GCC_PCIE_0_PHY_RCHNG_CLK_SRC] = &gcc_pcie_0_phy_rchng_clk_src.clkr,
+	[GCC_PCIE_0_PIPE_CLK] = &gcc_pcie_0_pipe_clk.clkr,
+	[GCC_PCIE_0_PIPE_CLK_SRC] = &gcc_pcie_0_pipe_clk_src.clkr,
+	[GCC_PCIE_0_PIPE_DIV_CLK_SRC] = &gcc_pcie_0_pipe_div_clk_src.clkr,
+	[GCC_PCIE_0_PIPEDIV2_CLK] = &gcc_pcie_0_pipediv2_clk.clkr,
+	[GCC_PCIE_0_SLV_AXI_CLK] = &gcc_pcie_0_slv_axi_clk.clkr,
+	[GCC_PCIE_0_SLV_Q2A_AXI_CLK] = &gcc_pcie_0_slv_q2a_axi_clk.clkr,
+	[GCC_PCIE_1_AUX_CLK] = &gcc_pcie_1_aux_clk.clkr,
+	[GCC_PCIE_1_AUX_CLK_SRC] = &gcc_pcie_1_aux_clk_src.clkr,
+	[GCC_PCIE_1_CFG_AHB_CLK] = &gcc_pcie_1_cfg_ahb_clk.clkr,
+	[GCC_PCIE_1_MSTR_AXI_CLK] = &gcc_pcie_1_mstr_axi_clk.clkr,
+	[GCC_PCIE_1_PHY_AUX_CLK] = &gcc_pcie_1_phy_aux_clk.clkr,
+	[GCC_PCIE_1_PHY_AUX_CLK_SRC] = &gcc_pcie_1_phy_aux_clk_src.clkr,
+	[GCC_PCIE_1_PHY_RCHNG_CLK] = &gcc_pcie_1_phy_rchng_clk.clkr,
+	[GCC_PCIE_1_PHY_RCHNG_CLK_SRC] = &gcc_pcie_1_phy_rchng_clk_src.clkr,
+	[GCC_PCIE_1_PIPE_CLK] = &gcc_pcie_1_pipe_clk.clkr,
+	[GCC_PCIE_1_PIPE_CLK_SRC] = &gcc_pcie_1_pipe_clk_src.clkr,
+	[GCC_PCIE_1_PIPE_DIV_CLK_SRC] = &gcc_pcie_1_pipe_div_clk_src.clkr,
+	[GCC_PCIE_1_PIPEDIV2_CLK] = &gcc_pcie_1_pipediv2_clk.clkr,
+	[GCC_PCIE_1_SLV_AXI_CLK] = &gcc_pcie_1_slv_axi_clk.clkr,
+	[GCC_PCIE_1_SLV_Q2A_AXI_CLK] = &gcc_pcie_1_slv_q2a_axi_clk.clkr,
+	[GCC_PCIE_CLKREF_EN] = &gcc_pcie_clkref_en.clkr,
+	[GCC_PCIE_THROTTLE_CFG_CLK] = &gcc_pcie_throttle_cfg_clk.clkr,
+	[GCC_PDM2_CLK] = &gcc_pdm2_clk.clkr,
+	[GCC_PDM2_CLK_SRC] = &gcc_pdm2_clk_src.clkr,
+	[GCC_PDM_AHB_CLK] = &gcc_pdm_ahb_clk.clkr,
+	[GCC_PDM_XO4_CLK] = &gcc_pdm_xo4_clk.clkr,
+	[GCC_QMIP_CAMERA_NRT_AHB_CLK] = &gcc_qmip_camera_nrt_ahb_clk.clkr,
+	[GCC_QMIP_CAMERA_RT_AHB_CLK] = &gcc_qmip_camera_rt_ahb_clk.clkr,
+	[GCC_QMIP_DISP_AHB_CLK] = &gcc_qmip_disp_ahb_clk.clkr,
+	[GCC_QMIP_DISP_ROT_AHB_CLK] = &gcc_qmip_disp_rot_ahb_clk.clkr,
+	[GCC_QMIP_VIDEO_CVP_AHB_CLK] = &gcc_qmip_video_cvp_ahb_clk.clkr,
+	[GCC_QMIP_VIDEO_VCODEC_AHB_CLK] = &gcc_qmip_video_vcodec_ahb_clk.clkr,
+	[GCC_QMIP_VIDEO_VCPU_AHB_CLK] = &gcc_qmip_video_vcpu_ahb_clk.clkr,
+	[GCC_QUPV3_WRAP0_CORE_2X_CLK] = &gcc_qupv3_wrap0_core_2x_clk.clkr,
+	[GCC_QUPV3_WRAP0_CORE_CLK] = &gcc_qupv3_wrap0_core_clk.clkr,
+	[GCC_QUPV3_WRAP0_S0_CLK] = &gcc_qupv3_wrap0_s0_clk.clkr,
+	[GCC_QUPV3_WRAP0_S0_CLK_SRC] = &gcc_qupv3_wrap0_s0_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S1_CLK] = &gcc_qupv3_wrap0_s1_clk.clkr,
+	[GCC_QUPV3_WRAP0_S1_CLK_SRC] = &gcc_qupv3_wrap0_s1_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S2_CLK] = &gcc_qupv3_wrap0_s2_clk.clkr,
+	[GCC_QUPV3_WRAP0_S2_CLK_SRC] = &gcc_qupv3_wrap0_s2_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S3_CLK] = &gcc_qupv3_wrap0_s3_clk.clkr,
+	[GCC_QUPV3_WRAP0_S3_CLK_SRC] = &gcc_qupv3_wrap0_s3_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S4_CLK] = &gcc_qupv3_wrap0_s4_clk.clkr,
+	[GCC_QUPV3_WRAP0_S4_CLK_SRC] = &gcc_qupv3_wrap0_s4_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S5_CLK] = &gcc_qupv3_wrap0_s5_clk.clkr,
+	[GCC_QUPV3_WRAP0_S5_CLK_SRC] = &gcc_qupv3_wrap0_s5_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S6_CLK] = &gcc_qupv3_wrap0_s6_clk.clkr,
+	[GCC_QUPV3_WRAP0_S6_CLK_SRC] = &gcc_qupv3_wrap0_s6_clk_src.clkr,
+	[GCC_QUPV3_WRAP0_S7_CLK] = &gcc_qupv3_wrap0_s7_clk.clkr,
+	[GCC_QUPV3_WRAP0_S7_CLK_SRC] = &gcc_qupv3_wrap0_s7_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_CORE_2X_CLK] = &gcc_qupv3_wrap1_core_2x_clk.clkr,
+	[GCC_QUPV3_WRAP1_CORE_CLK] = &gcc_qupv3_wrap1_core_clk.clkr,
+	[GCC_QUPV3_WRAP1_S0_CLK] = &gcc_qupv3_wrap1_s0_clk.clkr,
+	[GCC_QUPV3_WRAP1_S0_CLK_SRC] = &gcc_qupv3_wrap1_s0_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S1_CLK] = &gcc_qupv3_wrap1_s1_clk.clkr,
+	[GCC_QUPV3_WRAP1_S1_CLK_SRC] = &gcc_qupv3_wrap1_s1_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S2_CLK] = &gcc_qupv3_wrap1_s2_clk.clkr,
+	[GCC_QUPV3_WRAP1_S2_CLK_SRC] = &gcc_qupv3_wrap1_s2_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S3_CLK] = &gcc_qupv3_wrap1_s3_clk.clkr,
+	[GCC_QUPV3_WRAP1_S3_CLK_SRC] = &gcc_qupv3_wrap1_s3_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S4_CLK] = &gcc_qupv3_wrap1_s4_clk.clkr,
+	[GCC_QUPV3_WRAP1_S4_CLK_SRC] = &gcc_qupv3_wrap1_s4_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S5_CLK] = &gcc_qupv3_wrap1_s5_clk.clkr,
+	[GCC_QUPV3_WRAP1_S5_CLK_SRC] = &gcc_qupv3_wrap1_s5_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S6_CLK] = &gcc_qupv3_wrap1_s6_clk.clkr,
+	[GCC_QUPV3_WRAP1_S6_CLK_SRC] = &gcc_qupv3_wrap1_s6_clk_src.clkr,
+	[GCC_QUPV3_WRAP1_S7_CLK] = &gcc_qupv3_wrap1_s7_clk.clkr,
+	[GCC_QUPV3_WRAP1_S7_CLK_SRC] = &gcc_qupv3_wrap1_s7_clk_src.clkr,
+	[GCC_QUPV3_WRAP3_CORE_2X_CLK] = &gcc_qupv3_wrap3_core_2x_clk.clkr,
+	[GCC_QUPV3_WRAP3_CORE_CLK] = &gcc_qupv3_wrap3_core_clk.clkr,
+	[GCC_QUPV3_WRAP3_QSPI_CLK] = &gcc_qupv3_wrap3_qspi_clk.clkr,
+	[GCC_QUPV3_WRAP3_S0_CLK] = &gcc_qupv3_wrap3_s0_clk.clkr,
+	[GCC_QUPV3_WRAP3_S0_CLK_SRC] = &gcc_qupv3_wrap3_s0_clk_src.clkr,
+	[GCC_QUPV3_WRAP3_S0_DIV_CLK_SRC] = &gcc_qupv3_wrap3_s0_div_clk_src.clkr,
+	[GCC_QUPV3_WRAP_0_M_AHB_CLK] = &gcc_qupv3_wrap_0_m_ahb_clk.clkr,
+	[GCC_QUPV3_WRAP_0_S_AHB_CLK] = &gcc_qupv3_wrap_0_s_ahb_clk.clkr,
+	[GCC_QUPV3_WRAP_1_M_AHB_CLK] = &gcc_qupv3_wrap_1_m_ahb_clk.clkr,
+	[GCC_QUPV3_WRAP_1_S_AHB_CLK] = &gcc_qupv3_wrap_1_s_ahb_clk.clkr,
+	[GCC_QUPV3_WRAP_3_M_AHB_CLK] = &gcc_qupv3_wrap_3_m_ahb_clk.clkr,
+	[GCC_QUPV3_WRAP_3_S_AHB_CLK] = &gcc_qupv3_wrap_3_s_ahb_clk.clkr,
+	[GCC_SDCC1_AHB_CLK] = &gcc_sdcc1_ahb_clk.clkr,
+	[GCC_SDCC1_APPS_CLK] = &gcc_sdcc1_apps_clk.clkr,
+	[GCC_SDCC1_APPS_CLK_SRC] = &gcc_sdcc1_apps_clk_src.clkr,
+	[GCC_SDCC1_ICE_CORE_CLK] = &gcc_sdcc1_ice_core_clk.clkr,
+	[GCC_SDCC1_ICE_CORE_CLK_SRC] = &gcc_sdcc1_ice_core_clk_src.clkr,
+	[GCC_SGMI_CLKREF_EN] = &gcc_sgmi_clkref_en.clkr,
+	[GCC_UFS_PHY_AHB_CLK] = &gcc_ufs_phy_ahb_clk.clkr,
+	[GCC_UFS_PHY_AXI_CLK] = &gcc_ufs_phy_axi_clk.clkr,
+	[GCC_UFS_PHY_AXI_CLK_SRC] = &gcc_ufs_phy_axi_clk_src.clkr,
+	[GCC_UFS_PHY_ICE_CORE_CLK] = &gcc_ufs_phy_ice_core_clk.clkr,
+	[GCC_UFS_PHY_ICE_CORE_CLK_SRC] = &gcc_ufs_phy_ice_core_clk_src.clkr,
+	[GCC_UFS_PHY_PHY_AUX_CLK] = &gcc_ufs_phy_phy_aux_clk.clkr,
+	[GCC_UFS_PHY_PHY_AUX_CLK_SRC] = &gcc_ufs_phy_phy_aux_clk_src.clkr,
+	[GCC_UFS_PHY_RX_SYMBOL_0_CLK] = &gcc_ufs_phy_rx_symbol_0_clk.clkr,
+	[GCC_UFS_PHY_RX_SYMBOL_0_CLK_SRC] = &gcc_ufs_phy_rx_symbol_0_clk_src.clkr,
+	[GCC_UFS_PHY_RX_SYMBOL_1_CLK] = &gcc_ufs_phy_rx_symbol_1_clk.clkr,
+	[GCC_UFS_PHY_RX_SYMBOL_1_CLK_SRC] = &gcc_ufs_phy_rx_symbol_1_clk_src.clkr,
+	[GCC_UFS_PHY_TX_SYMBOL_0_CLK] = &gcc_ufs_phy_tx_symbol_0_clk.clkr,
+	[GCC_UFS_PHY_TX_SYMBOL_0_CLK_SRC] = &gcc_ufs_phy_tx_symbol_0_clk_src.clkr,
+	[GCC_UFS_PHY_UNIPRO_CORE_CLK] = &gcc_ufs_phy_unipro_core_clk.clkr,
+	[GCC_UFS_PHY_UNIPRO_CORE_CLK_SRC] = &gcc_ufs_phy_unipro_core_clk_src.clkr,
+	[GCC_USB20_MASTER_CLK] = &gcc_usb20_master_clk.clkr,
+	[GCC_USB20_MASTER_CLK_SRC] = &gcc_usb20_master_clk_src.clkr,
+	[GCC_USB20_MOCK_UTMI_CLK] = &gcc_usb20_mock_utmi_clk.clkr,
+	[GCC_USB20_MOCK_UTMI_CLK_SRC] = &gcc_usb20_mock_utmi_clk_src.clkr,
+	[GCC_USB20_MOCK_UTMI_POSTDIV_CLK_SRC] = &gcc_usb20_mock_utmi_postdiv_clk_src.clkr,
+	[GCC_USB20_SLEEP_CLK] = &gcc_usb20_sleep_clk.clkr,
+	[GCC_USB30_PRIM_MASTER_CLK] = &gcc_usb30_prim_master_clk.clkr,
+	[GCC_USB30_PRIM_MASTER_CLK_SRC] = &gcc_usb30_prim_master_clk_src.clkr,
+	[GCC_USB30_PRIM_MOCK_UTMI_CLK] = &gcc_usb30_prim_mock_utmi_clk.clkr,
+	[GCC_USB30_PRIM_MOCK_UTMI_CLK_SRC] = &gcc_usb30_prim_mock_utmi_clk_src.clkr,
+	[GCC_USB30_PRIM_MOCK_UTMI_POSTDIV_CLK_SRC] = &gcc_usb30_prim_mock_utmi_postdiv_clk_src.clkr,
+	[GCC_USB30_PRIM_SLEEP_CLK] = &gcc_usb30_prim_sleep_clk.clkr,
+	[GCC_USB3_PRIM_PHY_AUX_CLK] = &gcc_usb3_prim_phy_aux_clk.clkr,
+	[GCC_USB3_PRIM_PHY_AUX_CLK_SRC] = &gcc_usb3_prim_phy_aux_clk_src.clkr,
+	[GCC_USB3_PRIM_PHY_COM_AUX_CLK] = &gcc_usb3_prim_phy_com_aux_clk.clkr,
+	[GCC_USB3_PRIM_PHY_PIPE_CLK] = &gcc_usb3_prim_phy_pipe_clk.clkr,
+	[GCC_USB3_PRIM_PHY_PIPE_CLK_SRC] = &gcc_usb3_prim_phy_pipe_clk_src.clkr,
+	[GCC_USB_CLKREF_EN] = &gcc_usb_clkref_en.clkr,
+	[GCC_VIDEO_AXI0_CLK] = &gcc_video_axi0_clk.clkr,
+	[GCC_VIDEO_AXI1_CLK] = &gcc_video_axi1_clk.clkr,
+};
+
+static struct gdsc *gcc_qcs8300_gdscs[] = {
+	[GCC_EMAC0_GDSC] = &gcc_emac0_gdsc,
+	[GCC_PCIE_0_GDSC] = &gcc_pcie_0_gdsc,
+	[GCC_PCIE_1_GDSC] = &gcc_pcie_1_gdsc,
+	[GCC_UFS_PHY_GDSC] = &gcc_ufs_phy_gdsc,
+	[GCC_USB20_PRIM_GDSC] = &gcc_usb20_prim_gdsc,
+	[GCC_USB30_PRIM_GDSC] = &gcc_usb30_prim_gdsc,
+};
+
+static const struct qcom_reset_map gcc_qcs8300_resets[] = {
+	[GCC_EMAC0_BCR] = { 0xb6000 },
+	[GCC_PCIE_0_BCR] = { 0xa9000 },
+	[GCC_PCIE_0_LINK_DOWN_BCR] = { 0xbf000 },
+	[GCC_PCIE_0_NOCSR_COM_PHY_BCR] = { 0xbf008 },
+	[GCC_PCIE_0_PHY_BCR] = { 0xa9144 },
+	[GCC_PCIE_0_PHY_NOCSR_COM_PHY_BCR] = { 0xbf00c },
+	[GCC_PCIE_1_BCR] = { 0x77000 },
+	[GCC_PCIE_1_LINK_DOWN_BCR] = { 0xae084 },
+	[GCC_PCIE_1_NOCSR_COM_PHY_BCR] = { 0xae090 },
+	[GCC_PCIE_1_PHY_BCR] = { 0xae08c },
+	[GCC_PCIE_1_PHY_NOCSR_COM_PHY_BCR] = { 0xae094 },
+	[GCC_SDCC1_BCR] = { 0x20000 },
+	[GCC_UFS_PHY_BCR] = { 0x83000 },
+	[GCC_USB20_PRIM_BCR] = { 0x1c000 },
+	[GCC_USB2_PHY_PRIM_BCR] = { 0x5c01c },
+	[GCC_USB2_PHY_SEC_BCR] = { 0x5c020 },
+	[GCC_USB30_PRIM_BCR] = { 0x1b000 },
+	[GCC_USB3_DP_PHY_PRIM_BCR] = { 0x5c008 },
+	[GCC_USB3_PHY_PRIM_BCR] = { 0x5c000 },
+	[GCC_USB3_PHY_TERT_BCR] = { 0x5c024 },
+	[GCC_USB3_UNIPHY_MP0_BCR] = { 0x5c00c },
+	[GCC_USB3_UNIPHY_MP1_BCR] = { 0x5c010 },
+	[GCC_USB3PHY_PHY_PRIM_BCR] = { 0x5c004 },
+	[GCC_USB3UNIPHY_PHY_MP0_BCR] = { 0x5c014 },
+	[GCC_USB3UNIPHY_PHY_MP1_BCR] = { 0x5c018 },
+	[GCC_USB_PHY_CFG_AHB2PHY_BCR] = { 0x76000 },
+	[GCC_VIDEO_AXI0_CLK_ARES] = { 0x34014, 2 },
+	[GCC_VIDEO_AXI1_CLK_ARES] = { 0x3401c, 2 },
+	[GCC_VIDEO_BCR] = { 0x34000 },
+};
+
+static const struct clk_rcg_dfs_data gcc_dfs_clocks[] = {
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s5_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s6_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s7_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s5_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s6_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s7_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap3_s0_clk_src),
+};
+
+static const struct regmap_config gcc_qcs8300_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0x472cffc,
+	.fast_io = true,
+};
+
+static const struct qcom_cc_desc gcc_qcs8300_desc = {
+	.config = &gcc_qcs8300_regmap_config,
+	.clks = gcc_qcs8300_clocks,
+	.num_clks = ARRAY_SIZE(gcc_qcs8300_clocks),
+	.resets = gcc_qcs8300_resets,
+	.num_resets = ARRAY_SIZE(gcc_qcs8300_resets),
+	.gdscs = gcc_qcs8300_gdscs,
+	.num_gdscs = ARRAY_SIZE(gcc_qcs8300_gdscs),
+};
+
+static const struct of_device_id gcc_qcs8300_match_table[] = {
+	{ .compatible = "qcom,qcs8300-gcc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, gcc_qcs8300_match_table);
+
+static int gcc_qcs8300_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+	int ret;
+
+	regmap = qcom_cc_map(pdev, &gcc_qcs8300_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks,
+				       ARRAY_SIZE(gcc_dfs_clocks));
+	if (ret)
+		return ret;
+
+	/* Keep some clocks always enabled */
+	qcom_branch_set_clk_en(regmap, 0x32004); /* GCC_CAMERA_AHB_CLK */
+	qcom_branch_set_clk_en(regmap, 0x32020); /* GCC_CAMERA_XO_CLK */
+	qcom_branch_set_clk_en(regmap, 0x33004); /* GCC_DISP_AHB_CLK */
+	qcom_branch_set_clk_en(regmap, 0x33018); /* GCC_DISP_XO_CLK */
+	qcom_branch_set_clk_en(regmap, 0x7d004); /* GCC_GPU_CFG_AHB_CLK */
+	qcom_branch_set_clk_en(regmap, 0x34004); /* GCC_VIDEO_AHB_CLK */
+	qcom_branch_set_clk_en(regmap, 0x34024); /* GCC_VIDEO_XO_CLK */
+
+	/* FORCE_MEM_CORE_ON for ufs phy ice core clocks */
+	qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_ice_core_clk, true);
+
+	return qcom_cc_really_probe(&pdev->dev, &gcc_qcs8300_desc, regmap);
+}
+
+static struct platform_driver gcc_qcs8300_driver = {
+	.probe = gcc_qcs8300_probe,
+	.driver = {
+		.name = "gcc-qcs8300",
+		.of_match_table = gcc_qcs8300_match_table,
+	},
+};
+
+static int __init gcc_qcs8300_init(void)
+{
+	return platform_driver_register(&gcc_qcs8300_driver);
+}
+subsys_initcall(gcc_qcs8300_init);
+
+static void __exit gcc_qcs8300_exit(void)
+{
+	platform_driver_unregister(&gcc_qcs8300_driver);
+}
+module_exit(gcc_qcs8300_exit);
+
+MODULE_DESCRIPTION("QTI GCC QCS8300 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-qdu1000.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-qdu1000.c
@@ -2674,7 +2674,7 @@
 	if (ret)
 		return ret;
 
-	ret = qcom_cc_really_probe(pdev, &gcc_qdu1000_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &gcc_qdu1000_desc, regmap);
 	if (ret)
 		return dev_err_probe(&pdev->dev, ret, "Failed to register GCC clocks\n");
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sa8775p.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sa8775p.c
@@ -1,14 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022, 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  * Copyright (c) 2023, Linaro Limited
  */
 
-#include <linux/clk.h>
 #include <linux/clk-provider.h>
-#include <linux/err.h>
-#include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/mod_devicetable.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/regmap.h>
@@ -1737,26 +1735,6 @@
 	},
 };
 
-static struct clk_branch gcc_aggre_ufs_phy_axi_hw_ctl_clk = {
-	.halt_reg = 0x830d4,
-	.halt_check = BRANCH_HALT_VOTED,
-	.hwcg_reg = 0x830d4,
-	.hwcg_bit = 1,
-	.clkr = {
-		.enable_reg = 0x830d4,
-		.enable_mask = BIT(1),
-		.hw.init = &(const struct clk_init_data){
-			.name = "gcc_aggre_ufs_phy_axi_hw_ctl_clk",
-			.parent_hws = (const struct clk_hw*[]){
-				&gcc_ufs_phy_axi_clk_src.clkr.hw,
-			},
-			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT,
-			.ops = &clk_branch2_ops,
-		},
-	},
-};
-
 static struct clk_branch gcc_aggre_usb2_prim_axi_clk = {
 	.halt_reg = 0x1c05c,
 	.halt_check = BRANCH_HALT_VOTED,
@@ -3809,26 +3787,6 @@
 	},
 };
 
-static struct clk_branch gcc_ufs_phy_axi_hw_ctl_clk = {
-	.halt_reg = 0x83018,
-	.halt_check = BRANCH_HALT_VOTED,
-	.hwcg_reg = 0x83018,
-	.hwcg_bit = 1,
-	.clkr = {
-		.enable_reg = 0x83018,
-		.enable_mask = BIT(1),
-		.hw.init = &(const struct clk_init_data){
-			.name = "gcc_ufs_phy_axi_hw_ctl_clk",
-			.parent_hws = (const struct clk_hw*[]){
-				&gcc_ufs_phy_axi_clk_src.clkr.hw,
-			},
-			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT,
-			.ops = &clk_branch2_ops,
-		},
-	},
-};
-
 static struct clk_branch gcc_ufs_phy_ice_core_clk = {
 	.halt_reg = 0x8306c,
 	.halt_check = BRANCH_HALT_VOTED,
@@ -3849,26 +3807,6 @@
 	},
 };
 
-static struct clk_branch gcc_ufs_phy_ice_core_hw_ctl_clk = {
-	.halt_reg = 0x8306c,
-	.halt_check = BRANCH_HALT_VOTED,
-	.hwcg_reg = 0x8306c,
-	.hwcg_bit = 1,
-	.clkr = {
-		.enable_reg = 0x8306c,
-		.enable_mask = BIT(1),
-		.hw.init = &(const struct clk_init_data){
-			.name = "gcc_ufs_phy_ice_core_hw_ctl_clk",
-			.parent_hws = (const struct clk_hw*[]){
-				&gcc_ufs_phy_ice_core_clk_src.clkr.hw,
-			},
-			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT,
-			.ops = &clk_branch2_ops,
-		},
-	},
-};
-
 static struct clk_branch gcc_ufs_phy_phy_aux_clk = {
 	.halt_reg = 0x830a4,
 	.halt_check = BRANCH_HALT_VOTED,
@@ -3889,26 +3827,6 @@
 	},
 };
 
-static struct clk_branch gcc_ufs_phy_phy_aux_hw_ctl_clk = {
-	.halt_reg = 0x830a4,
-	.halt_check = BRANCH_HALT_VOTED,
-	.hwcg_reg = 0x830a4,
-	.hwcg_bit = 1,
-	.clkr = {
-		.enable_reg = 0x830a4,
-		.enable_mask = BIT(1),
-		.hw.init = &(const struct clk_init_data){
-			.name = "gcc_ufs_phy_phy_aux_hw_ctl_clk",
-			.parent_hws = (const struct clk_hw*[]){
-				&gcc_ufs_phy_phy_aux_clk_src.clkr.hw,
-			},
-			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT,
-			.ops = &clk_branch2_ops,
-		},
-	},
-};
-
 static struct clk_branch gcc_ufs_phy_rx_symbol_0_clk = {
 	.halt_reg = 0x83028,
 	.halt_check = BRANCH_HALT_DELAY,
@@ -3983,26 +3901,6 @@
 	},
 };
 
-static struct clk_branch gcc_ufs_phy_unipro_core_hw_ctl_clk = {
-	.halt_reg = 0x83064,
-	.halt_check = BRANCH_HALT_VOTED,
-	.hwcg_reg = 0x83064,
-	.hwcg_bit = 1,
-	.clkr = {
-		.enable_reg = 0x83064,
-		.enable_mask = BIT(1),
-		.hw.init = &(const struct clk_init_data){
-			.name = "gcc_ufs_phy_unipro_core_hw_ctl_clk",
-			.parent_hws = (const struct clk_hw*[]){
-				&gcc_ufs_phy_unipro_core_clk_src.clkr.hw,
-			},
-			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT,
-			.ops = &clk_branch2_ops,
-		},
-	},
-};
-
 static struct clk_branch gcc_usb20_master_clk = {
 	.halt_reg = 0x1c018,
 	.halt_check = BRANCH_HALT,
@@ -4305,81 +4203,120 @@
 
 static struct gdsc pcie_0_gdsc = {
 	.gdscr = 0xa9004,
+	.collapse_ctrl = 0x4b104,
+	.collapse_mask = BIT(0),
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "pcie_0_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE | RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
 };
 
 static struct gdsc pcie_1_gdsc = {
 	.gdscr = 0x77004,
+	.collapse_ctrl = 0x4b104,
+	.collapse_mask = BIT(1),
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "pcie_1_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE | RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
 };
 
 static struct gdsc ufs_card_gdsc = {
 	.gdscr = 0x81004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "ufs_card_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
 };
 
 static struct gdsc ufs_phy_gdsc = {
 	.gdscr = 0x83004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "ufs_phy_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
 };
 
 static struct gdsc usb20_prim_gdsc = {
 	.gdscr = 0x1c004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "usb20_prim_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
 };
 
 static struct gdsc usb30_prim_gdsc = {
 	.gdscr = 0x1b004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "usb30_prim_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
 };
 
 static struct gdsc usb30_sec_gdsc = {
 	.gdscr = 0x2f004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "usb30_sec_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
 };
 
 static struct gdsc emac0_gdsc = {
 	.gdscr = 0xb6004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "emac0_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
 };
 
 static struct gdsc emac1_gdsc = {
 	.gdscr = 0xb4004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "emac1_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
 };
 
 static struct clk_regmap *gcc_sa8775p_clocks[] = {
 	[GCC_AGGRE_NOC_QUPV3_AXI_CLK] = &gcc_aggre_noc_qupv3_axi_clk.clkr,
 	[GCC_AGGRE_UFS_CARD_AXI_CLK] = &gcc_aggre_ufs_card_axi_clk.clkr,
 	[GCC_AGGRE_UFS_PHY_AXI_CLK] = &gcc_aggre_ufs_phy_axi_clk.clkr,
-	[GCC_AGGRE_UFS_PHY_AXI_HW_CTL_CLK] = &gcc_aggre_ufs_phy_axi_hw_ctl_clk.clkr,
 	[GCC_AGGRE_USB2_PRIM_AXI_CLK] = &gcc_aggre_usb2_prim_axi_clk.clkr,
 	[GCC_AGGRE_USB3_PRIM_AXI_CLK] = &gcc_aggre_usb3_prim_axi_clk.clkr,
 	[GCC_AGGRE_USB3_SEC_AXI_CLK] = &gcc_aggre_usb3_sec_axi_clk.clkr,
@@ -4569,13 +4506,10 @@
 	[GCC_UFS_PHY_AHB_CLK] = &gcc_ufs_phy_ahb_clk.clkr,
 	[GCC_UFS_PHY_AXI_CLK] = &gcc_ufs_phy_axi_clk.clkr,
 	[GCC_UFS_PHY_AXI_CLK_SRC] = &gcc_ufs_phy_axi_clk_src.clkr,
-	[GCC_UFS_PHY_AXI_HW_CTL_CLK] = &gcc_ufs_phy_axi_hw_ctl_clk.clkr,
 	[GCC_UFS_PHY_ICE_CORE_CLK] = &gcc_ufs_phy_ice_core_clk.clkr,
 	[GCC_UFS_PHY_ICE_CORE_CLK_SRC] = &gcc_ufs_phy_ice_core_clk_src.clkr,
-	[GCC_UFS_PHY_ICE_CORE_HW_CTL_CLK] = &gcc_ufs_phy_ice_core_hw_ctl_clk.clkr,
 	[GCC_UFS_PHY_PHY_AUX_CLK] = &gcc_ufs_phy_phy_aux_clk.clkr,
 	[GCC_UFS_PHY_PHY_AUX_CLK_SRC] = &gcc_ufs_phy_phy_aux_clk_src.clkr,
-	[GCC_UFS_PHY_PHY_AUX_HW_CTL_CLK] = &gcc_ufs_phy_phy_aux_hw_ctl_clk.clkr,
 	[GCC_UFS_PHY_RX_SYMBOL_0_CLK] = &gcc_ufs_phy_rx_symbol_0_clk.clkr,
 	[GCC_UFS_PHY_RX_SYMBOL_0_CLK_SRC] = &gcc_ufs_phy_rx_symbol_0_clk_src.clkr,
 	[GCC_UFS_PHY_RX_SYMBOL_1_CLK] = &gcc_ufs_phy_rx_symbol_1_clk.clkr,
@@ -4584,7 +4518,6 @@
 	[GCC_UFS_PHY_TX_SYMBOL_0_CLK_SRC] = &gcc_ufs_phy_tx_symbol_0_clk_src.clkr,
 	[GCC_UFS_PHY_UNIPRO_CORE_CLK] = &gcc_ufs_phy_unipro_core_clk.clkr,
 	[GCC_UFS_PHY_UNIPRO_CORE_CLK_SRC] = &gcc_ufs_phy_unipro_core_clk_src.clkr,
-	[GCC_UFS_PHY_UNIPRO_CORE_HW_CTL_CLK] = &gcc_ufs_phy_unipro_core_hw_ctl_clk.clkr,
 	[GCC_USB20_MASTER_CLK] = &gcc_usb20_master_clk.clkr,
 	[GCC_USB20_MASTER_CLK_SRC] = &gcc_usb20_master_clk_src.clkr,
 	[GCC_USB20_MOCK_UTMI_CLK] = &gcc_usb20_mock_utmi_clk.clkr,
@@ -4747,6 +4680,7 @@
 	 * GCC_CAMERA_AHB_CLK, GCC_CAMERA_XO_CLK, GCC_DISP1_AHB_CLK,
 	 * GCC_DISP1_XO_CLK, GCC_DISP_AHB_CLK, GCC_DISP_XO_CLK,
 	 * GCC_GPU_CFG_AHB_CLK, GCC_VIDEO_AHB_CLK, GCC_VIDEO_XO_CLK.
+	 * Use qcom_clk_set_en()
 	 */
 	regmap_update_bits(regmap, 0x32004, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x32020, BIT(0), BIT(0));
@@ -4758,7 +4692,10 @@
 	regmap_update_bits(regmap, 0x34004, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x34024, BIT(0), BIT(0));
 
-	return qcom_cc_really_probe(pdev, &gcc_sa8775p_desc, regmap);
+	/* FORCE_MEM_CORE_ON for ufs phy ice core clocks */
+	qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_ice_core_clk, true);
+
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sa8775p_desc, regmap);
 }
 
 static struct platform_driver gcc_sa8775p_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sc7180.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sc7180.c
@@ -2462,7 +2462,7 @@
 	if (ret)
 		return ret;
 
-	return qcom_cc_really_probe(pdev, &gcc_sc7180_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sc7180_desc, regmap);
 }
 
 static struct platform_driver gcc_sc7180_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sc7280.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sc7280.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/clk-provider.h>
@@ -3094,6 +3095,9 @@
 
 static struct gdsc gcc_pcie_0_gdsc = {
 	.gdscr = 0x6b004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "gcc_pcie_0_gdsc",
 	},
@@ -3112,6 +3116,9 @@
 
 static struct gdsc gcc_ufs_phy_gdsc = {
 	.gdscr = 0x77004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "gcc_ufs_phy_gdsc",
 	},
@@ -3121,6 +3128,9 @@
 
 static struct gdsc gcc_usb30_prim_gdsc = {
 	.gdscr = 0xf004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "gcc_usb30_prim_gdsc",
 	},
@@ -3467,12 +3477,15 @@
 	regmap_update_bits(regmap, 0x71004, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x7100C, BIT(13), BIT(13));
 
+	/* FORCE_MEM_CORE_ON for ufs phy ice core clocks */
+	qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_ice_core_clk, true);
+
 	ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks,
 			ARRAY_SIZE(gcc_dfs_clocks));
 	if (ret)
 		return ret;
 
-	return qcom_cc_really_probe(pdev, &gcc_sc7280_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sc7280_desc, regmap);
 }
 
 static struct platform_driver gcc_sc7280_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sc8180x.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sc8180x.c
@@ -142,6 +142,23 @@
 	},
 };
 
+static struct clk_alpha_pll gpll9 = {
+	.offset = 0x1c000,
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_TRION],
+	.clkr = {
+		.enable_reg = 0x52000,
+		.enable_mask = BIT(9),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpll9",
+			.parent_data = &(const struct clk_parent_data) {
+				.fw_name = "bi_tcxo",
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fixed_trion_ops,
+		},
+	},
+};
+
 static const struct parent_map gcc_parent_map_0[] = {
 	{ P_BI_TCXO, 0 },
 	{ P_GPLL0_OUT_MAIN, 1 },
@@ -241,7 +258,7 @@
 static const struct clk_parent_data gcc_parents_7[] = {
 	{ .fw_name = "bi_tcxo", },
 	{ .hw = &gpll0.clkr.hw },
-	{ .name = "gppl9" },
+	{ .hw = &gpll9.clkr.hw },
 	{ .hw = &gpll4.clkr.hw },
 	{ .hw = &gpll0_out_even.clkr.hw },
 };
@@ -260,28 +277,6 @@
 	{ .hw = &gpll0_out_even.clkr.hw },
 };
 
-static const struct freq_tbl ftbl_gcc_cpuss_ahb_clk_src[] = {
-	F(19200000, P_BI_TCXO, 1, 0, 0),
-	F(50000000, P_GPLL0_OUT_MAIN, 12, 0, 0),
-	F(100000000, P_GPLL0_OUT_MAIN, 6, 0, 0),
-	{ }
-};
-
-static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
-	.cmd_rcgr = 0x48014,
-	.mnd_width = 0,
-	.hid_width = 5,
-	.parent_map = gcc_parent_map_0,
-	.freq_tbl = ftbl_gcc_cpuss_ahb_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_cpuss_ahb_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
-};
-
 static const struct freq_tbl ftbl_gcc_emac_ptp_clk_src[] = {
 	F(19200000, P_BI_TCXO, 1, 0, 0),
 	F(50000000, P_GPLL0_OUT_EVEN, 6, 0, 0),
@@ -609,19 +604,29 @@
 	{ }
 };
 
+static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s0_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
+};
+
 static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
 	.cmd_rcgr = 0x17148,
 	.mnd_width = 16,
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s0_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s1_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
@@ -630,13 +635,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s1_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s1_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s2_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
@@ -645,13 +652,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s2_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s3_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
@@ -660,13 +669,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s3_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s4_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
@@ -675,13 +686,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s4_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s5_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
@@ -690,13 +703,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s5_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s5_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s6_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s6_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s6_clk_src = {
@@ -705,13 +720,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s6_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s6_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s7_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s7_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s7_clk_src = {
@@ -720,13 +737,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s7_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s7_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s0_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
@@ -735,13 +754,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s0_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s1_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
@@ -750,13 +771,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s1_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s1_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s2_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
@@ -765,13 +788,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s2_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s3_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
@@ -780,13 +805,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s3_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s4_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
@@ -795,13 +822,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s4_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s5_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
@@ -810,13 +839,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s5_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s5_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s0_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s0_clk_src = {
@@ -825,13 +856,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s0_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s1_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s1_clk_src = {
@@ -840,28 +873,33 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s1_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s1_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s2_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
+
 static struct clk_rcg2 gcc_qupv3_wrap2_s2_clk_src = {
 	.cmd_rcgr = 0x1e3a8,
 	.mnd_width = 16,
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s2_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s3_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s3_clk_src = {
@@ -870,13 +908,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s3_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s4_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s4_clk_src = {
@@ -885,13 +925,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s4_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s5_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s5_clk_src = {
@@ -900,13 +942,7 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s5_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s5_clk_src_init,
 };
 
 static const struct freq_tbl ftbl_gcc_sdcc2_apps_clk_src[] = {
@@ -916,7 +952,7 @@
 	F(25000000, P_GPLL0_OUT_MAIN, 12, 1, 2),
 	F(50000000, P_GPLL0_OUT_MAIN, 12, 0, 0),
 	F(100000000, P_GPLL0_OUT_MAIN, 6, 0, 0),
-	F(200000000, P_GPLL0_OUT_MAIN, 3, 0, 0),
+	F(202000000, P_GPLL9_OUT_MAIN, 4, 0, 0),
 	{ }
 };
 
@@ -939,9 +975,8 @@
 	F(400000, P_BI_TCXO, 12, 1, 4),
 	F(9600000, P_BI_TCXO, 2, 0, 0),
 	F(19200000, P_BI_TCXO, 1, 0, 0),
-	F(37500000, P_GPLL0_OUT_MAIN, 16, 0, 0),
 	F(50000000, P_GPLL0_OUT_MAIN, 12, 0, 0),
-	F(75000000, P_GPLL0_OUT_MAIN, 8, 0, 0),
+	F(100000000, P_GPLL0_OUT_MAIN, 6, 0, 0),
 	{ }
 };
 
@@ -1599,25 +1634,6 @@
 	},
 };
 
-/* For CPUSS functionality the AHB clock needs to be left enabled */
-static struct clk_branch gcc_cpuss_ahb_clk = {
-	.halt_reg = 0x48000,
-	.halt_check = BRANCH_HALT_VOTED,
-	.clkr = {
-		.enable_reg = 0x52004,
-		.enable_mask = BIT(21),
-		.hw.init = &(struct clk_init_data){
-			.name = "gcc_cpuss_ahb_clk",
-			.parent_hws = (const struct clk_hw *[]){
-				      &gcc_cpuss_ahb_clk_src.clkr.hw
-			},
-			.num_parents = 1,
-			.flags = CLK_IS_CRITICAL | CLK_SET_RATE_PARENT,
-			.ops = &clk_branch2_ops,
-		},
-	},
-};
-
 static struct clk_branch gcc_cpuss_rbcpr_clk = {
 	.halt_reg = 0x48008,
 	.halt_check = BRANCH_HALT,
@@ -3150,25 +3166,6 @@
 	},
 };
 
-/* For CPUSS functionality the SYS NOC clock needs to be left enabled */
-static struct clk_branch gcc_sys_noc_cpuss_ahb_clk = {
-	.halt_reg = 0x4819c,
-	.halt_check = BRANCH_HALT_VOTED,
-	.clkr = {
-		.enable_reg = 0x52004,
-		.enable_mask = BIT(0),
-		.hw.init = &(struct clk_init_data){
-			.name = "gcc_sys_noc_cpuss_ahb_clk",
-			.parent_hws = (const struct clk_hw *[]){
-				      &gcc_cpuss_ahb_clk_src.clkr.hw
-			},
-			.num_parents = 1,
-			.flags = CLK_IS_CRITICAL | CLK_SET_RATE_PARENT,
-			.ops = &clk_branch2_ops,
-		},
-	},
-};
-
 static struct clk_branch gcc_tsif_ahb_clk = {
 	.halt_reg = 0x36004,
 	.halt_check = BRANCH_HALT,
@@ -4258,8 +4255,6 @@
 	[GCC_CFG_NOC_USB3_MP_AXI_CLK] = &gcc_cfg_noc_usb3_mp_axi_clk.clkr,
 	[GCC_CFG_NOC_USB3_PRIM_AXI_CLK] = &gcc_cfg_noc_usb3_prim_axi_clk.clkr,
 	[GCC_CFG_NOC_USB3_SEC_AXI_CLK] = &gcc_cfg_noc_usb3_sec_axi_clk.clkr,
-	[GCC_CPUSS_AHB_CLK] = &gcc_cpuss_ahb_clk.clkr,
-	[GCC_CPUSS_AHB_CLK_SRC] = &gcc_cpuss_ahb_clk_src.clkr,
 	[GCC_CPUSS_RBCPR_CLK] = &gcc_cpuss_rbcpr_clk.clkr,
 	[GCC_DDRSS_GPU_AXI_CLK] = &gcc_ddrss_gpu_axi_clk.clkr,
 	[GCC_DISP_HF_AXI_CLK] = &gcc_disp_hf_axi_clk.clkr,
@@ -4396,7 +4391,6 @@
 	[GCC_SDCC4_AHB_CLK] = &gcc_sdcc4_ahb_clk.clkr,
 	[GCC_SDCC4_APPS_CLK] = &gcc_sdcc4_apps_clk.clkr,
 	[GCC_SDCC4_APPS_CLK_SRC] = &gcc_sdcc4_apps_clk_src.clkr,
-	[GCC_SYS_NOC_CPUSS_AHB_CLK] = &gcc_sys_noc_cpuss_ahb_clk.clkr,
 	[GCC_TSIF_AHB_CLK] = &gcc_tsif_ahb_clk.clkr,
 	[GCC_TSIF_INACTIVITY_TIMERS_CLK] = &gcc_tsif_inactivity_timers_clk.clkr,
 	[GCC_TSIF_REF_CLK] = &gcc_tsif_ref_clk.clkr,
@@ -4483,6 +4477,7 @@
 	[GPLL1] = &gpll1.clkr,
 	[GPLL4] = &gpll4.clkr,
 	[GPLL7] = &gpll7.clkr,
+	[GPLL9] = &gpll9.clkr,
 };
 
 static const struct qcom_reset_map gcc_sc8180x_resets[] = {
@@ -4533,6 +4528,29 @@
 	[GCC_VIDEO_AXI1_CLK_BCR] = { 0xb028, 2 },
 };
 
+static const struct clk_rcg_dfs_data gcc_dfs_clocks[] = {
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s5_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s6_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s7_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s5_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s5_clk_src),
+};
+
 static struct gdsc *gcc_sc8180x_gdscs[] = {
 	[EMAC_GDSC] = &emac_gdsc,
 	[PCIE_0_GDSC] = &pcie_0_gdsc,
@@ -4574,6 +4592,7 @@
 static int gcc_sc8180x_probe(struct platform_device *pdev)
 {
 	struct regmap *regmap;
+	int ret;
 
 	regmap = qcom_cc_map(pdev, &gcc_sc8180x_desc);
 	if (IS_ERR(regmap))
@@ -4601,7 +4620,12 @@
 	regmap_update_bits(regmap, 0x4d110, 0x3, 0x3);
 	regmap_update_bits(regmap, 0x71028, 0x3, 0x3);
 
-	return qcom_cc_really_probe(pdev, &gcc_sc8180x_desc, regmap);
+	ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks,
+					ARRAY_SIZE(gcc_dfs_clocks));
+	if (ret)
+		return ret;
+
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sc8180x_desc, regmap);
 }
 
 static struct platform_driver gcc_sc8180x_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sc8280xp.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sc8280xp.c
@@ -7563,7 +7563,7 @@
 	if (ret)
 		goto err_put_rpm;
 
-	ret = qcom_cc_really_probe(pdev, &gcc_sc8280xp_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &gcc_sc8280xp_desc, regmap);
 	if (ret)
 		goto err_put_rpm;
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sdm660.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sdm660.c
@@ -2474,7 +2474,7 @@
 	if (ret)
 		return ret;
 
-	return qcom_cc_really_probe(pdev, &gcc_sdm660_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sdm660_desc, regmap);
 }
 
 static struct platform_driver gcc_sdm660_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sdm845.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sdm845.c
@@ -4011,7 +4011,7 @@
 		return ret;
 
 	gcc_desc = of_device_get_match_data(&pdev->dev);
-	return qcom_cc_really_probe(pdev, gcc_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, gcc_desc, regmap);
 }
 
 static struct platform_driver gcc_sdm845_driver = {
@@ -4037,3 +4037,4 @@
 MODULE_DESCRIPTION("QTI GCC SDM845 Driver");
 MODULE_LICENSE("GPL v2");
 MODULE_ALIAS("platform:gcc-sdm845");
+MODULE_SOFTDEP("pre: rpmhpd");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sdx55.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sdx55.c
@@ -1620,7 +1620,7 @@
 	regmap_update_bits(regmap, 0x6d008, BIT(21), BIT(21));
 	regmap_update_bits(regmap, 0x6d008, BIT(22), BIT(22));
 
-	return qcom_cc_really_probe(pdev, &gcc_sdx55_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sdx55_desc, regmap);
 }
 
 static struct platform_driver gcc_sdx55_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sdx65.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sdx65.c
@@ -1583,7 +1583,7 @@
 	regmap_update_bits(regmap, 0x6d008, BIT(21), BIT(21));
 	regmap_update_bits(regmap, 0x6d008, BIT(22), BIT(22));
 
-	return qcom_cc_really_probe(pdev, &gcc_sdx65_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sdx65_desc, regmap);
 }
 
 static struct platform_driver gcc_sdx65_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sdx75.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sdx75.c
@@ -2944,7 +2944,7 @@
 	regmap_update_bits(regmap, 0x3e004, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x3e008, BIT(0), BIT(0));
 
-	return qcom_cc_really_probe(pdev, &gcc_sdx75_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sdx75_desc, regmap);
 }
 
 static struct platform_driver gcc_sdx75_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm4450.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm4450.c
@@ -2871,7 +2871,7 @@
 
 	regmap_update_bits(regmap, 0x4201c, BIT(21), BIT(21));
 
-	return qcom_cc_really_probe(pdev, &gcc_sm4450_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm4450_desc, regmap);
 }
 
 static struct platform_driver gcc_sm4450_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm6115.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm6115.c
@@ -3513,7 +3513,7 @@
 	clk_alpha_pll_configure(&gpll10, regmap, &gpll10_config);
 	clk_alpha_pll_configure(&gpll11, regmap, &gpll11_config);
 
-	return qcom_cc_really_probe(pdev, &gcc_sm6115_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm6115_desc, regmap);
 }
 
 static struct platform_driver gcc_sm6115_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm6125.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm6125.c
@@ -4161,7 +4161,7 @@
 	if (ret)
 		return ret;
 
-	return qcom_cc_really_probe(pdev, &gcc_sm6125_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm6125_desc, regmap);
 }
 
 static struct platform_driver gcc_sm6125_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm6350.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm6350.c
@@ -100,8 +100,8 @@
 		.enable_mask = BIT(6),
 		.hw.init = &(struct clk_init_data){
 			.name = "gpll6",
-			.parent_hws = (const struct clk_hw*[]){
-				&gpll0.clkr.hw,
+			.parent_data = &(const struct clk_parent_data){
+				.fw_name = "bi_tcxo",
 			},
 			.num_parents = 1,
 			.ops = &clk_alpha_pll_fixed_fabia_ops,
@@ -124,7 +124,7 @@
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gpll6_out_even",
 		.parent_hws = (const struct clk_hw*[]){
-			&gpll0.clkr.hw,
+			&gpll6.clkr.hw,
 		},
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_fabia_ops,
@@ -139,8 +139,8 @@
 		.enable_mask = BIT(7),
 		.hw.init = &(struct clk_init_data){
 			.name = "gpll7",
-			.parent_hws = (const struct clk_hw*[]){
-				&gpll0.clkr.hw,
+			.parent_data = &(const struct clk_parent_data){
+				.fw_name = "bi_tcxo",
 			},
 			.num_parents = 1,
 			.ops = &clk_alpha_pll_fixed_fabia_ops,
@@ -2559,7 +2559,7 @@
 	if (ret)
 		return ret;
 
-	return qcom_cc_really_probe(pdev, &gcc_sm6350_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm6350_desc, regmap);
 }
 
 static struct platform_driver gcc_sm6350_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm6375.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm6375.c
@@ -3895,7 +3895,7 @@
 	clk_lucid_pll_configure(&gpll8, regmap, &gpll8_config);
 	clk_zonda_pll_configure(&gpll9, regmap, &gpll9_config);
 
-	return qcom_cc_really_probe(pdev, &gcc_sm6375_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm6375_desc, regmap);
 }
 
 static struct platform_driver gcc_sm6375_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm7150.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm7150.c
@@ -3022,7 +3022,7 @@
 	if (ret)
 		return ret;
 
-	return qcom_cc_really_probe(pdev, &gcc_sm7150_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm7150_desc, regmap);
 }
 
 static struct platform_driver gcc_sm7150_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm8150.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm8150.c
@@ -453,19 +453,29 @@
 	{ }
 };
 
+static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s0_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
+};
+
 static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
 	.cmd_rcgr = 0x17148,
 	.mnd_width = 16,
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s0_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s1_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
@@ -474,13 +484,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s1_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s1_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s2_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
@@ -489,13 +501,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s2_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s3_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
@@ -504,13 +518,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s3_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s4_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
@@ -519,13 +535,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s4_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s5_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
@@ -534,13 +552,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s5_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s5_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s6_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s6_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s6_clk_src = {
@@ -549,13 +569,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s6_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s6_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap0_s7_clk_src_init = {
+	.name = "gcc_qupv3_wrap0_s7_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s7_clk_src = {
@@ -564,13 +586,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap0_s7_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap0_s7_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s0_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
@@ -579,13 +603,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s0_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s1_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
@@ -594,13 +620,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s1_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s1_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s2_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
@@ -609,13 +637,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s2_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s3_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
@@ -624,13 +654,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s3_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s4_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
@@ -639,13 +671,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s4_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap1_s5_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
@@ -654,13 +688,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap1_s5_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap1_s5_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s0_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s0_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s0_clk_src = {
@@ -669,13 +705,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s0_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s0_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s1_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s1_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s1_clk_src = {
@@ -684,13 +722,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s1_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s1_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s2_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s2_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s2_clk_src = {
@@ -699,13 +739,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s2_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s2_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s3_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s3_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s3_clk_src = {
@@ -714,13 +756,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s3_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s3_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s4_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s4_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s4_clk_src = {
@@ -729,13 +773,15 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s4_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s4_clk_src_init,
+};
+
+static struct clk_init_data gcc_qupv3_wrap2_s5_clk_src_init = {
+	.name = "gcc_qupv3_wrap2_s5_clk_src",
+	.parent_data = gcc_parents_0,
+	.num_parents = ARRAY_SIZE(gcc_parents_0),
+	.flags = CLK_SET_RATE_PARENT,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s5_clk_src = {
@@ -744,13 +790,7 @@
 	.hid_width = 5,
 	.parent_map = gcc_parent_map_0,
 	.freq_tbl = ftbl_gcc_qupv3_wrap0_s0_clk_src,
-	.clkr.hw.init = &(struct clk_init_data){
-		.name = "gcc_qupv3_wrap2_s5_clk_src",
-		.parent_data = gcc_parents_0,
-		.num_parents = ARRAY_SIZE(gcc_parents_0),
-		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
-	},
+	.clkr.hw.init = &gcc_qupv3_wrap2_s5_clk_src_init,
 };
 
 static const struct freq_tbl ftbl_gcc_sdcc2_apps_clk_src[] = {
@@ -3750,6 +3790,29 @@
 	[USB30_SEC_GDSC] = &usb30_sec_gdsc,
 };
 
+static const struct clk_rcg_dfs_data gcc_dfs_clocks[] = {
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s5_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s6_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap0_s7_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap1_s5_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s0_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s1_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s2_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s3_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s4_clk_src),
+	DEFINE_RCG_DFS(gcc_qupv3_wrap2_s5_clk_src),
+};
+
 static const struct regmap_config gcc_sm8150_regmap_config = {
 	.reg_bits	= 32,
 	.reg_stride	= 4,
@@ -3777,6 +3840,7 @@
 static int gcc_sm8150_probe(struct platform_device *pdev)
 {
 	struct regmap *regmap;
+	int ret;
 
 	regmap = qcom_cc_map(pdev, &gcc_sm8150_desc);
 	if (IS_ERR(regmap))
@@ -3786,7 +3850,12 @@
 	regmap_update_bits(regmap, 0x4d110, 0x3, 0x3);
 	regmap_update_bits(regmap, 0x71028, 0x3, 0x3);
 
-	return qcom_cc_really_probe(pdev, &gcc_sm8150_desc, regmap);
+	ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks,
+				       ARRAY_SIZE(gcc_dfs_clocks));
+	if (ret)
+		dev_err_probe(&pdev->dev, ret, "Failed to register with DFS!\n");
+
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm8150_desc, regmap);
 }
 
 static struct platform_driver gcc_sm8150_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm8250.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm8250.c
@@ -3226,7 +3226,7 @@
 	.pd = {
 		.name = "pcie_0_gdsc",
 	},
-	.pwrsts = PWRSTS_OFF_ON,
+	.pwrsts = PWRSTS_RET_ON,
 };
 
 static struct gdsc pcie_1_gdsc = {
@@ -3234,7 +3234,7 @@
 	.pd = {
 		.name = "pcie_1_gdsc",
 	},
-	.pwrsts = PWRSTS_OFF_ON,
+	.pwrsts = PWRSTS_RET_ON,
 };
 
 static struct gdsc pcie_2_gdsc = {
@@ -3242,7 +3242,7 @@
 	.pd = {
 		.name = "pcie_2_gdsc",
 	},
-	.pwrsts = PWRSTS_OFF_ON,
+	.pwrsts = PWRSTS_RET_ON,
 };
 
 static struct gdsc ufs_card_gdsc = {
@@ -3661,7 +3661,7 @@
 	if (ret)
 		return ret;
 
-	return qcom_cc_really_probe(pdev, &gcc_sm8250_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm8250_desc, regmap);
 }
 
 static struct platform_driver gcc_sm8250_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm8350.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm8350.c
@@ -3826,7 +3826,7 @@
 	/* FORCE_MEM_CORE_ON for ufs phy ice core clocks */
 	regmap_update_bits(regmap, gcc_ufs_phy_ice_core_clk.halt_reg, BIT(14), BIT(14));
 
-	return qcom_cc_really_probe(pdev, &gcc_sm8350_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm8350_desc, regmap);
 }
 
 static struct platform_driver gcc_sm8350_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm8450.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm8450.c
@@ -2974,7 +2974,7 @@
 	.pd = {
 		.name = "pcie_0_gdsc",
 	},
-	.pwrsts = PWRSTS_OFF_ON,
+	.pwrsts = PWRSTS_RET_ON,
 };
 
 static struct gdsc pcie_1_gdsc = {
@@ -2982,7 +2982,7 @@
 	.pd = {
 		.name = "pcie_1_gdsc",
 	},
-	.pwrsts = PWRSTS_OFF_ON,
+	.pwrsts = PWRSTS_RET_ON,
 };
 
 static struct gdsc ufs_phy_gdsc = {
@@ -3294,7 +3294,7 @@
 	regmap_update_bits(regmap, 0x42004, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x42028, BIT(0), BIT(0));
 
-	return qcom_cc_really_probe(pdev, &gcc_sm8450_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm8450_desc, regmap);
 }
 
 static struct platform_driver gcc_sm8450_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm8550.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm8550.c
@@ -536,7 +536,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -551,7 +551,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -566,7 +566,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -581,7 +581,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -596,7 +596,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -611,7 +611,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -626,7 +626,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -641,7 +641,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -656,7 +656,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -671,7 +671,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -700,7 +700,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
@@ -717,7 +717,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
@@ -750,7 +750,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
@@ -767,7 +767,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
@@ -784,7 +784,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
@@ -801,7 +801,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
@@ -818,7 +818,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s6_clk_src = {
@@ -835,7 +835,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s7_clk_src = {
@@ -852,7 +852,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s0_clk_src = {
@@ -869,7 +869,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s1_clk_src = {
@@ -886,7 +886,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s2_clk_src = {
@@ -903,7 +903,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s3_clk_src = {
@@ -920,7 +920,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s4_clk_src = {
@@ -937,7 +937,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s5_clk_src = {
@@ -975,7 +975,7 @@
 	.parent_data = gcc_parent_data_8,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_8),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s6_clk_src = {
@@ -992,7 +992,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s7_clk_src = {
@@ -1159,7 +1159,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_shared_no_init_park_ops,
 	},
 };
 
@@ -3369,7 +3369,7 @@
 	/* Clear GDSC_SLEEP_ENA_VOTE to stop votes being auto-removed in sleep. */
 	regmap_write(regmap, 0x52024, 0x0);
 
-	return qcom_cc_really_probe(pdev, &gcc_sm8550_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm8550_desc, regmap);
 }
 
 static struct platform_driver gcc_sm8550_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-sm8650.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-sm8650.c
@@ -713,7 +713,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -728,7 +728,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -743,7 +743,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -758,7 +758,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -773,7 +773,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -788,7 +788,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -803,7 +803,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -818,7 +818,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -833,7 +833,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -848,7 +848,7 @@
 		.parent_data = gcc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -863,7 +863,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_qspi_ref_clk_src = {
@@ -899,7 +899,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
@@ -916,7 +916,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
@@ -948,7 +948,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
@@ -980,7 +980,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
@@ -997,7 +997,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
@@ -1014,7 +1014,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s6_clk_src = {
@@ -1031,7 +1031,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s7_clk_src = {
@@ -1059,7 +1059,7 @@
 		.parent_data = gcc_parent_data_2,
 		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_shared_ops,
+		.ops = &clk_rcg2_ops,
 	},
 };
 
@@ -1068,7 +1068,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s0_clk_src = {
@@ -1085,7 +1085,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s1_clk_src = {
@@ -1102,7 +1102,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s2_clk_src = {
@@ -1119,7 +1119,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s3_clk_src = {
@@ -1136,7 +1136,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s4_clk_src = {
@@ -1153,7 +1153,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s5_clk_src = {
@@ -1186,7 +1186,7 @@
 	.parent_data = gcc_parent_data_10,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_10),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s6_clk_src = {
@@ -1203,7 +1203,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s7_clk_src = {
@@ -1226,7 +1226,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap3_qspi_ref_clk_src = {
@@ -3822,7 +3822,7 @@
 	/* Clear GDSC_SLEEP_ENA_VOTE to stop votes being auto-removed in sleep. */
 	regmap_write(regmap, 0x52150, 0x0);
 
-	return qcom_cc_really_probe(pdev, &gcc_sm8650_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_sm8650_desc, regmap);
 }
 
 static struct platform_driver gcc_sm8650_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gcc-x1e80100.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gcc-x1e80100.c
@@ -670,7 +670,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
@@ -687,7 +687,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
@@ -719,7 +719,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
@@ -736,7 +736,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
@@ -768,7 +768,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
@@ -785,7 +785,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
@@ -802,7 +802,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s6_clk_src = {
@@ -819,7 +819,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap0_s7_clk_src = {
@@ -836,7 +836,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
@@ -853,7 +853,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
@@ -870,7 +870,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
@@ -887,7 +887,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
@@ -904,7 +904,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
@@ -921,7 +921,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
@@ -938,7 +938,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s6_clk_src = {
@@ -955,7 +955,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap1_s7_clk_src = {
@@ -972,7 +972,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s0_clk_src = {
@@ -989,7 +989,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s1_clk_src = {
@@ -1006,7 +1006,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s2_clk_src = {
@@ -1023,7 +1023,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s3_clk_src = {
@@ -1040,7 +1040,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s4_clk_src = {
@@ -1057,7 +1057,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s5_clk_src = {
@@ -1074,7 +1074,7 @@
 	.parent_data = gcc_parent_data_8,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_8),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s6_clk_src = {
@@ -1091,7 +1091,7 @@
 	.parent_data = gcc_parent_data_0,
 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
 	.flags = CLK_SET_RATE_PARENT,
-	.ops = &clk_rcg2_shared_ops,
+	.ops = &clk_rcg2_ops,
 };
 
 static struct clk_rcg2 gcc_qupv3_wrap2_s7_clk_src = {
@@ -2812,7 +2812,7 @@
 
 static struct clk_branch gcc_pcie_0_pipe_clk = {
 	.halt_reg = 0xa0044,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52010,
 		.enable_mask = BIT(25),
@@ -2901,7 +2901,7 @@
 
 static struct clk_branch gcc_pcie_1_pipe_clk = {
 	.halt_reg = 0x2c044,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52020,
 		.enable_mask = BIT(30),
@@ -2990,7 +2990,7 @@
 
 static struct clk_branch gcc_pcie_2_pipe_clk = {
 	.halt_reg = 0x13044,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52020,
 		.enable_mask = BIT(23),
@@ -3110,7 +3110,7 @@
 
 static struct clk_branch gcc_pcie_3_pipe_clk = {
 	.halt_reg = 0x58050,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52020,
 		.enable_mask = BIT(3),
@@ -3123,7 +3123,7 @@
 
 static struct clk_branch gcc_pcie_3_pipediv2_clk = {
 	.halt_reg = 0x58060,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52020,
 		.enable_mask = BIT(5),
@@ -3235,7 +3235,7 @@
 
 static struct clk_branch gcc_pcie_4_pipe_clk = {
 	.halt_reg = 0x6b044,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52008,
 		.enable_mask = BIT(4),
@@ -3248,7 +3248,7 @@
 
 static struct clk_branch gcc_pcie_4_pipediv2_clk = {
 	.halt_reg = 0x6b054,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52010,
 		.enable_mask = BIT(27),
@@ -3360,7 +3360,7 @@
 
 static struct clk_branch gcc_pcie_5_pipe_clk = {
 	.halt_reg = 0x2f044,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52018,
 		.enable_mask = BIT(17),
@@ -3373,7 +3373,7 @@
 
 static struct clk_branch gcc_pcie_5_pipediv2_clk = {
 	.halt_reg = 0x2f054,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52018,
 		.enable_mask = BIT(19),
@@ -3498,7 +3498,7 @@
 
 static struct clk_branch gcc_pcie_6a_pipe_clk = {
 	.halt_reg = 0x31050,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52018,
 		.enable_mask = BIT(26),
@@ -3511,7 +3511,7 @@
 
 static struct clk_branch gcc_pcie_6a_pipediv2_clk = {
 	.halt_reg = 0x31060,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52018,
 		.enable_mask = BIT(28),
@@ -3636,7 +3636,7 @@
 
 static struct clk_branch gcc_pcie_6b_pipe_clk = {
 	.halt_reg = 0x8d050,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52000,
 		.enable_mask = BIT(30),
@@ -3649,7 +3649,7 @@
 
 static struct clk_branch gcc_pcie_6b_pipediv2_clk = {
 	.halt_reg = 0x8d060,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52010,
 		.enable_mask = BIT(28),
@@ -5109,7 +5109,7 @@
 
 static struct clk_branch gcc_usb3_mp_phy_pipe_0_clk = {
 	.halt_reg = 0x17290,
-	.halt_check = BRANCH_HALT,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x17290,
 		.enable_mask = BIT(0),
@@ -5122,7 +5122,7 @@
 
 static struct clk_branch gcc_usb3_mp_phy_pipe_1_clk = {
 	.halt_reg = 0x17298,
-	.halt_check = BRANCH_HALT,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x17298,
 		.enable_mask = BIT(0),
@@ -5186,7 +5186,7 @@
 
 static struct clk_branch gcc_usb3_prim_phy_pipe_clk = {
 	.halt_reg = 0x39068,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.hwcg_reg = 0x39068,
 	.hwcg_bit = 1,
 	.clkr = {
@@ -5257,7 +5257,7 @@
 
 static struct clk_branch gcc_usb3_sec_phy_pipe_clk = {
 	.halt_reg = 0xa1068,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.hwcg_reg = 0xa1068,
 	.hwcg_bit = 1,
 	.clkr = {
@@ -5269,6 +5269,7 @@
 				&gcc_usb3_sec_phy_pipe_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -5327,7 +5328,7 @@
 
 static struct clk_branch gcc_usb3_tert_phy_pipe_clk = {
 	.halt_reg = 0xa2068,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.hwcg_reg = 0xa2068,
 	.hwcg_bit = 1,
 	.clkr = {
@@ -5339,6 +5340,7 @@
 				&gcc_usb3_tert_phy_pipe_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -5405,7 +5407,7 @@
 
 static struct clk_branch gcc_usb4_0_phy_p2rr2p_pipe_clk = {
 	.halt_reg = 0x9f0d8,
-	.halt_check = BRANCH_HALT,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x9f0d8,
 		.enable_mask = BIT(0),
@@ -5418,7 +5420,7 @@
 
 static struct clk_branch gcc_usb4_0_phy_pcie_pipe_clk = {
 	.halt_reg = 0x9f048,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52010,
 		.enable_mask = BIT(19),
@@ -5457,7 +5459,7 @@
 
 static struct clk_branch gcc_usb4_0_phy_usb_pipe_clk = {
 	.halt_reg = 0x9f0a4,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.hwcg_reg = 0x9f0a4,
 	.hwcg_bit = 1,
 	.clkr = {
@@ -5582,7 +5584,7 @@
 
 static struct clk_branch gcc_usb4_1_phy_p2rr2p_pipe_clk = {
 	.halt_reg = 0x2b0d8,
-	.halt_check = BRANCH_HALT,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x2b0d8,
 		.enable_mask = BIT(0),
@@ -5595,7 +5597,7 @@
 
 static struct clk_branch gcc_usb4_1_phy_pcie_pipe_clk = {
 	.halt_reg = 0x2b048,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52028,
 		.enable_mask = BIT(0),
@@ -5634,7 +5636,7 @@
 
 static struct clk_branch gcc_usb4_1_phy_usb_pipe_clk = {
 	.halt_reg = 0x2b0a4,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.hwcg_reg = 0x2b0a4,
 	.hwcg_bit = 1,
 	.clkr = {
@@ -5759,7 +5761,7 @@
 
 static struct clk_branch gcc_usb4_2_phy_p2rr2p_pipe_clk = {
 	.halt_reg = 0x110d8,
-	.halt_check = BRANCH_HALT,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x110d8,
 		.enable_mask = BIT(0),
@@ -5772,7 +5774,7 @@
 
 static struct clk_branch gcc_usb4_2_phy_pcie_pipe_clk = {
 	.halt_reg = 0x11048,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x52028,
 		.enable_mask = BIT(1),
@@ -5811,7 +5813,7 @@
 
 static struct clk_branch gcc_usb4_2_phy_usb_pipe_clk = {
 	.halt_reg = 0x110a4,
-	.halt_check = BRANCH_HALT_VOTED,
+	.halt_check = BRANCH_HALT_SKIP,
 	.hwcg_reg = 0x110a4,
 	.hwcg_bit = 1,
 	.clkr = {
@@ -6153,7 +6155,7 @@
 	.pd = {
 		.name = "gcc_usb3_mp_ss1_phy_gdsc",
 	},
-	.pwrsts = PWRSTS_OFF_ON,
+	.pwrsts = PWRSTS_RET_ON,
 	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
 };
 
@@ -6201,7 +6203,7 @@
 	.pd = {
 		.name = "gcc_usb_0_phy_gdsc",
 	},
-	.pwrsts = PWRSTS_OFF_ON,
+	.pwrsts = PWRSTS_RET_ON,
 	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
 };
 
@@ -6213,7 +6215,7 @@
 	.pd = {
 		.name = "gcc_usb_1_phy_gdsc",
 	},
-	.pwrsts = PWRSTS_OFF_ON,
+	.pwrsts = PWRSTS_RET_ON,
 	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
 };
 
@@ -6781,7 +6783,7 @@
 	/* Clear GDSC_SLEEP_ENA_VOTE to stop votes being auto-removed in sleep. */
 	regmap_write(regmap, 0x52224, 0x0);
 
-	return qcom_cc_really_probe(pdev, &gcc_x1e80100_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gcc_x1e80100_desc, regmap);
 }
 
 static struct platform_driver gcc_x1e80100_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gdsc.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gdsc.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2015, 2017-2018, 2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/bitops.h>
@@ -46,7 +47,7 @@
 #define RETAIN_MEM		BIT(14)
 #define RETAIN_PERIPH		BIT(13)
 
-#define STATUS_POLL_TIMEOUT_US	1500
+#define STATUS_POLL_TIMEOUT_US	2000
 #define TIMEOUT_US		500
 
 #define domain_to_gdsc(domain) container_of(domain, struct gdsc, pd)
@@ -470,7 +471,7 @@
 {
 	int i, ret;
 	struct genpd_onecell_data *data;
-	struct device *dev = desc->dev;
+	struct device *dev = desc->dev, *pd_dev;
 	struct gdsc **scs = desc->scs;
 	size_t num = desc->num;
 
@@ -512,6 +513,16 @@
 			pm_genpd_add_subdomain(scs[i]->parent, &scs[i]->pd);
 		else if (!IS_ERR_OR_NULL(dev->pm_domain))
 			pm_genpd_add_subdomain(pd_to_genpd(dev->pm_domain), &scs[i]->pd);
+		else if (desc->pmdomains) {
+			for (int j = 0; j < desc->pmdomains->num_pds; j++) {
+				pd_dev = desc->pmdomains->pd_devs[j];
+				if (!IS_ERR_OR_NULL(pd_dev)) {
+					struct generic_pm_domain *genpd =
+						pd_to_genpd(pd_dev->pm_domain);
+					pm_genpd_add_subdomain(genpd, &scs[i]->pd);
+				}
+			}
+		}
 	}
 
 	return of_genpd_add_provider_onecell(dev->of_node, data);
@@ -520,7 +531,7 @@
 void gdsc_unregister(struct gdsc_desc *desc)
 {
 	int i;
-	struct device *dev = desc->dev;
+	struct device *dev = desc->dev, *pd_dev;
 	struct gdsc **scs = desc->scs;
 	size_t num = desc->num;
 
@@ -532,6 +543,16 @@
 			pm_genpd_remove_subdomain(scs[i]->parent, &scs[i]->pd);
 		else if (!IS_ERR_OR_NULL(dev->pm_domain))
 			pm_genpd_remove_subdomain(pd_to_genpd(dev->pm_domain), &scs[i]->pd);
+		else if (desc->pmdomains) {
+			for (int j = 0; j < desc->pmdomains->num_pds; j++) {
+				pd_dev = desc->pmdomains->pd_devs[j];
+				if (!IS_ERR_OR_NULL(pd_dev)) {
+					struct generic_pm_domain *genpd =
+						pd_to_genpd(pd_dev->pm_domain);
+					pm_genpd_remove_subdomain(genpd, &scs[i]->pd);
+				}
+			}
+		}
 	}
 	of_genpd_del_provider(dev->of_node);
 }
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gdsc.h
+++ linux-qcom-6.8.0/drivers/clk/qcom/gdsc.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
  * Copyright (c) 2015, 2017-2018, 2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef __QCOM_GDSC_H__
@@ -78,6 +79,7 @@
 struct gdsc_desc {
 	struct device *dev;
 	struct gdsc **scs;
+	struct dev_pm_domain_list *pmdomains;
 	size_t num;
 };
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-msm8998.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-msm8998.c
@@ -334,7 +334,7 @@
 	/* tweak droop detector (GPUCC_GPU_DD_WRAP_CTRL) to reduce leakage */
 	regmap_write_bits(regmap, gfx3d_clk.clkr.enable_reg, BIT(0), BIT(0));
 
-	return qcom_cc_really_probe(pdev, &gpucc_msm8998_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpucc_msm8998_desc, regmap);
 }
 
 static struct platform_driver gpucc_msm8998_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-qcs615.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-qcs615.c
@@ -0,0 +1,525 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,qcs615-gpucc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_GPLL0_OUT_MAIN,
+	DT_GPLL0_OUT_MAIN_DIV,
+};
+
+enum {
+	P_BI_TCXO,
+	P_GPLL0_OUT_MAIN,
+	P_GPLL0_OUT_MAIN_DIV,
+	P_GPU_CC_PLL0_2X_CLK,
+	P_CRC_DIV_PLL0_OUT_AUX2,
+	P_GPU_CC_PLL0_OUT_MAIN,
+	P_GPU_CC_PLL1_OUT_AUX,
+	P_CRC_DIV_PLL1_OUT_AUX2,
+	P_GPU_CC_PLL1_OUT_MAIN,
+};
+
+static const struct pll_vco gpu_cc_pll0_vco[] = {
+	{ 1000000000, 2100000000, 0 },
+};
+
+static struct pll_vco gpu_cc_pll1_vco[] = {
+	{ 500000000,  1000000000, 2 },
+};
+
+/* 1020MHz configuration VCO - 0 */
+static struct alpha_pll_config gpu_cc_pll0_config = {
+	.l = 0x35,
+	.config_ctl_val = 0x4001055b,
+	.test_ctl_hi_val = 0x1,
+	.test_ctl_hi_mask = 0x1,
+	.alpha_hi = 0x20,
+	.alpha = 0x00,
+	.alpha_en_mask = BIT(24),
+	.vco_val = 0x0,
+	.vco_mask = GENMASK(21, 20),
+	.aux2_output_mask = BIT(2),
+};
+
+static struct clk_alpha_pll gpu_cc_pll0 = {
+	.offset = 0x0,
+	.vco_table = gpu_cc_pll0_vco,
+	.num_vco = ARRAY_SIZE(gpu_cc_pll0_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_slew_ops,
+		},
+	},
+};
+
+/* 930MHz configuration VCO - 2 */
+static struct alpha_pll_config gpu_cc_pll1_config = {
+	.l = 0x30,
+	.config_ctl_val = 0x4001055b,
+	.test_ctl_hi_val = 0x1,
+	.test_ctl_hi_mask = 0x1,
+	.alpha_hi = 0x70,
+	.alpha = 0x00,
+	.alpha_en_mask = BIT(24),
+	.vco_val = BIT(21),
+	.vco_mask = GENMASK(21, 20),
+	.aux2_output_mask = BIT(2),
+};
+
+static struct clk_alpha_pll gpu_cc_pll1 = {
+	.offset = 0x100,
+	.vco_table = gpu_cc_pll1_vco,
+	.num_vco = ARRAY_SIZE(gpu_cc_pll1_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_pll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_slew_ops,
+		},
+	}
+};
+
+/* Clock Ramp Controller */
+static struct clk_fixed_factor crc_div_pll0 = {
+	.mult = 1,
+	.div = 2,
+	.hw.init = &(struct clk_init_data){
+		.name = "crc_div_pll0",
+			.parent_data = &(const struct clk_parent_data){
+				.hw = &gpu_cc_pll0.clkr.hw,
+			},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+/* Clock Ramp Controller */
+static struct clk_fixed_factor crc_div_pll1 = {
+	.mult = 1,
+	.div = 2,
+	.hw.init = &(struct clk_init_data){
+		.name = "crc_div_pll1",
+			.parent_data = &(const struct clk_parent_data){
+				.hw = &gpu_cc_pll1.clkr.hw,
+			},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
+static const struct parent_map gpu_cc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPU_CC_PLL0_OUT_MAIN, 1 },
+	{ P_GPU_CC_PLL1_OUT_MAIN, 3 },
+	{ P_GPLL0_OUT_MAIN, 5 },
+	{ P_GPLL0_OUT_MAIN_DIV, 6 },
+};
+
+static const struct clk_parent_data gpu_cc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpu_cc_pll0.clkr.hw },
+	{ .hw = &gpu_cc_pll1.clkr.hw },
+	{ .index = DT_GPLL0_OUT_MAIN },
+	{ .index = DT_GPLL0_OUT_MAIN_DIV },
+};
+
+static const struct parent_map gpu_cc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPU_CC_PLL0_2X_CLK, 1 },
+	{ P_CRC_DIV_PLL0_OUT_AUX2, 2 },
+	{ P_GPU_CC_PLL1_OUT_AUX, 3 },
+	{ P_CRC_DIV_PLL1_OUT_AUX2, 4 },
+	{ P_GPLL0_OUT_MAIN, 5 },
+};
+
+static const struct clk_parent_data gpu_cc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpu_cc_pll0.clkr.hw },
+	{ .hw = &crc_div_pll0.hw },
+	{ .hw = &gpu_cc_pll1.clkr.hw },
+	{ .hw = &crc_div_pll1.hw },
+	{ .index = DT_GPLL0_OUT_MAIN },
+};
+
+static const struct freq_tbl ftbl_gpu_cc_gmu_clk_src[] = {
+	F(200000000, P_GPLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gpu_cc_gmu_clk_src = {
+	.cmd_rcgr = 0x1120,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gpu_cc_parent_map_0,
+	.freq_tbl = ftbl_gpu_cc_gmu_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpu_cc_gmu_clk_src",
+		.parent_data = gpu_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_0),
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gpu_cc_gx_gfx3d_clk_src[] = {
+	F(290000000, P_CRC_DIV_PLL1_OUT_AUX2, 1, 0, 0),
+	F(350000000, P_CRC_DIV_PLL1_OUT_AUX2, 1, 0, 0),
+	F(435000000, P_CRC_DIV_PLL1_OUT_AUX2, 1, 0, 0),
+	F(500000000, P_CRC_DIV_PLL0_OUT_AUX2, 1, 0, 0),
+	F(550000000, P_CRC_DIV_PLL0_OUT_AUX2, 1, 0, 0),
+	F(650000000, P_CRC_DIV_PLL0_OUT_AUX2, 1, 0, 0),
+	F(700000000, P_CRC_DIV_PLL0_OUT_AUX2, 1, 0, 0),
+	F(745000000, P_CRC_DIV_PLL0_OUT_AUX2, 1, 0, 0),
+	F(845000000, P_CRC_DIV_PLL0_OUT_AUX2, 1, 0, 0),
+	F(895000000, P_CRC_DIV_PLL0_OUT_AUX2, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gpu_cc_gx_gfx3d_clk_src = {
+	.cmd_rcgr = 0x101c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gpu_cc_parent_map_1,
+	.freq_tbl = ftbl_gpu_cc_gx_gfx3d_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpu_cc_gx_gfx3d_clk_src",
+		.parent_data = gpu_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_branch gpu_cc_crc_ahb_clk = {
+	.halt_reg = 0x107c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x107c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_crc_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cx_gfx3d_clk = {
+	.halt_reg = 0x10a4,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x10a4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_cx_gfx3d_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_gx_gfx3d_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cx_gfx3d_slv_clk = {
+	.halt_reg = 0x10a8,
+	.halt_check = BRANCH_HALT_DELAY,
+	.clkr = {
+		.enable_reg = 0x10a8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_cx_gfx3d_slv_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_gx_gfx3d_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cx_gmu_clk = {
+	.halt_reg = 0x1098,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1098,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_cx_gmu_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_gmu_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cx_snoc_dvm_clk = {
+	.halt_reg = 0x108c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x108c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_cx_snoc_dvm_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cxo_aon_clk = {
+	.halt_reg = 0x1004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x1004,
+		.enable_mask = BIT(0),
+		.hw.init = &(struct clk_init_data){
+			.name = "gpu_cc_cxo_aon_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cxo_clk = {
+	.halt_reg = 0x109c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x109c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_cxo_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_gx_gfx3d_clk = {
+	.halt_reg = 0x1054,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x1054,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_gx_gfx3d_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_gx_gfx3d_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_gx_gmu_clk = {
+	.halt_reg = 0x1064,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x1064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_gx_gmu_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_gmu_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_hlos1_vote_gpu_smmu_clk = {
+	.halt_reg = 0x5000,
+	.halt_check = BRANCH_VOTED,
+	.clkr = {
+		.enable_reg = 0x5000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_hlos1_vote_gpu_smmu_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_sleep_clk = {
+	.halt_reg = 0x1090,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x1090,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_sleep_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_hw *gpu_cc_qcs615_hws[] = {
+	[CRC_DIV_PLL0] = &crc_div_pll0.hw,
+	[CRC_DIV_PLL1] = &crc_div_pll1.hw,
+};
+
+static struct gdsc cx_gdsc = {
+	.gdscr = 0x106c,
+	.gds_hw_ctrl = 0x1540,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x8,
+	.pd = {
+		.name = "cx_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR,
+};
+
+static struct gdsc gx_gdsc = {
+	.gdscr = 0x100c,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x2,
+	.pd = {
+		.name = "gx_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR,
+};
+
+static struct clk_regmap *gpu_cc_qcs615_clocks[] = {
+	[GPU_CC_CRC_AHB_CLK] = &gpu_cc_crc_ahb_clk.clkr,
+	[GPU_CC_CX_GFX3D_CLK] = &gpu_cc_cx_gfx3d_clk.clkr,
+	[GPU_CC_CX_GFX3D_SLV_CLK] = &gpu_cc_cx_gfx3d_slv_clk.clkr,
+	[GPU_CC_CX_GMU_CLK] = &gpu_cc_cx_gmu_clk.clkr,
+	[GPU_CC_CX_SNOC_DVM_CLK] = &gpu_cc_cx_snoc_dvm_clk.clkr,
+	[GPU_CC_CXO_AON_CLK] = &gpu_cc_cxo_aon_clk.clkr,
+	[GPU_CC_CXO_CLK] = &gpu_cc_cxo_clk.clkr,
+	[GPU_CC_GMU_CLK_SRC] = &gpu_cc_gmu_clk_src.clkr,
+	[GPU_CC_GX_GFX3D_CLK] = &gpu_cc_gx_gfx3d_clk.clkr,
+	[GPU_CC_GX_GFX3D_CLK_SRC] = &gpu_cc_gx_gfx3d_clk_src.clkr,
+	[GPU_CC_GX_GMU_CLK] = &gpu_cc_gx_gmu_clk.clkr,
+	[GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK] = &gpu_cc_hlos1_vote_gpu_smmu_clk.clkr,
+	[GPU_CC_PLL0] = &gpu_cc_pll0.clkr,
+	[GPU_CC_PLL1] = &gpu_cc_pll1.clkr,
+	[GPU_CC_SLEEP_CLK] = &gpu_cc_sleep_clk.clkr,
+};
+
+static struct gdsc *gpu_cc_qcs615_gdscs[] = {
+	[CX_GDSC] = &cx_gdsc,
+	[GX_GDSC] = &gx_gdsc,
+};
+
+static const struct qcom_reset_map gpu_cc_qcs615_resets[] = {
+	[GPU_CC_CX_BCR] = { 0x1068 },
+	[GPU_CC_GFX3D_AON_BCR] = { 0x10a0 },
+	[GPU_CC_GMU_BCR] = { 0x111c },
+	[GPU_CC_GX_BCR] = { 0x1008 },
+	[GPU_CC_XO_BCR] = { 0x1000 },
+};
+
+static const struct regmap_config gpu_cc_qcs615_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0x7008,
+	.fast_io = true,
+};
+
+static const struct qcom_cc_desc gpu_cc_qcs615_desc = {
+	.config = &gpu_cc_qcs615_regmap_config,
+	.clks = gpu_cc_qcs615_clocks,
+	.num_clks = ARRAY_SIZE(gpu_cc_qcs615_clocks),
+	.clk_hws = gpu_cc_qcs615_hws,
+	.num_clk_hws = ARRAY_SIZE(gpu_cc_qcs615_hws),
+	.resets = gpu_cc_qcs615_resets,
+	.num_resets = ARRAY_SIZE(gpu_cc_qcs615_resets),
+	.gdscs = gpu_cc_qcs615_gdscs,
+	.num_gdscs = ARRAY_SIZE(gpu_cc_qcs615_gdscs),
+};
+
+static const struct of_device_id gpu_cc_qcs615_match_table[] = {
+	{ .compatible = "qcom,qcs615-gpucc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, gpu_cc_qcs615_match_table);
+
+static void configure_crc(struct regmap *regmap)
+{
+	/* Recommended WAKEUP/SLEEP settings for the gpu_cc_cx_gmu_clk */
+	regmap_update_bits(regmap, gpu_cc_cx_gmu_clk.clkr.enable_reg, 0xff0, 0xff0);
+
+	/*
+	 * After POR, Clock Ramp Controller(CRC) will be in bypass mode.
+	 * Software needs to do the following operation to enable the CRC
+	 * for GFX3D clock and divide the input clock by div by 2.
+	 */
+	regmap_update_bits(regmap, 0x1028, 0x00015011, 0x00015011);
+	regmap_update_bits(regmap, 0x1024, 0x00800000, 0x00800000);
+}
+
+static int gpu_cc_qcs615_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+
+	regmap = qcom_cc_map(pdev, &gpu_cc_qcs615_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	clk_alpha_pll_configure(&gpu_cc_pll0, regmap, &gpu_cc_pll0_config);
+	clk_alpha_pll_configure(&gpu_cc_pll1, regmap, &gpu_cc_pll1_config);
+
+	/* Keep some clocks always enabled */
+	regmap_update_bits(regmap, 0x1078, BIT(0), BIT(0)); /* GPU_CC_AHB_CLK */
+
+	configure_crc(regmap);
+
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_qcs615_desc, regmap);
+}
+
+static struct platform_driver gpu_cc_qcs615_driver = {
+	.probe = gpu_cc_qcs615_probe,
+	.driver = {
+		.name = "gpucc-qcs615",
+		.of_match_table = gpu_cc_qcs615_match_table,
+	},
+};
+
+module_platform_driver(gpu_cc_qcs615_driver);
+
+MODULE_DESCRIPTION("QTI GPUCC QCS615 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sa8775p.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sa8775p.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022, 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  * Copyright (c) 2023, Linaro Limited
  */
 
@@ -161,7 +161,7 @@
 		.name = "gpu_cc_ff_clk_src",
 		.parent_data = gpu_cc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_0),
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_rcg2_shared_ops,
 	},
 };
 
@@ -181,7 +181,7 @@
 		.parent_data = gpu_cc_parent_data_1,
 		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_1),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_rcg2_shared_ops,
 	},
 };
 
@@ -200,7 +200,7 @@
 		.name = "gpu_cc_hub_clk_src",
 		.parent_data = gpu_cc_parent_data_2,
 		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_2),
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_rcg2_shared_ops,
 	},
 };
 
@@ -280,7 +280,7 @@
 				&gpu_cc_hub_ahb_div_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -294,8 +294,7 @@
 		.enable_mask = BIT(0),
 		.hw.init = &(const struct clk_init_data){
 			.name = "gpu_cc_cb_clk",
-			.flags = CLK_IS_CRITICAL,
-			.ops = &clk_branch2_ops,
+			.ops = &clk_branch2_aon_ops,
 		},
 	},
 };
@@ -312,7 +311,25 @@
 				&gpu_cc_hub_ahb_div_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cx_accu_shift_clk = {
+	.halt_reg = 0x95e8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x95e8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data){
+			.name = "gpu_cc_cx_accu_shift_clk",
+			.parent_hws = (const struct clk_hw*[]){
+				&gpu_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -330,7 +347,7 @@
 				&gpu_cc_ff_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -348,7 +365,7 @@
 				&gpu_cc_gmu_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
-			.flags =  CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+			.flags =  CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_aon_ops,
 		},
 	},
@@ -362,7 +379,6 @@
 		.enable_mask = BIT(0),
 		.hw.init = &(const struct clk_init_data){
 			.name = "gpu_cc_cx_snoc_dvm_clk",
-			.flags = CLK_IS_CRITICAL,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -380,7 +396,7 @@
 				&gpu_cc_xo_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -398,7 +414,7 @@
 				&gpu_cc_xo_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
-			.flags =  CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+			.flags =  CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -416,12 +432,30 @@
 				&gpu_cc_demet_div_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_aon_ops,
 		},
 	},
 };
 
+static struct clk_branch gpu_cc_gx_accu_shift_clk = {
+	.halt_reg = 0x95e4,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x95e4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data){
+			.name = "gpu_cc_gx_accu_shift_clk",
+			.parent_hws = (const struct clk_hw*[]){
+				&gpu_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
 static struct clk_branch gpu_cc_hlos1_vote_gpu_smmu_clk = {
 	.halt_reg = 0x7000,
 	.halt_check = BRANCH_HALT_VOTED,
@@ -430,7 +464,6 @@
 		.enable_mask = BIT(0),
 		.hw.init = &(const struct clk_init_data){
 			.name = "gpu_cc_hlos1_vote_gpu_smmu_clk",
-			.flags = CLK_IS_CRITICAL,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -448,7 +481,7 @@
 				&gpu_cc_hub_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
-			.flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+			.flags = CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_aon_ops,
 		},
 	},
@@ -466,7 +499,7 @@
 				&gpu_cc_hub_cx_int_div_clk_src.clkr.hw,
 			},
 			.num_parents = 1,
-			.flags =  CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+			.flags =  CLK_SET_RATE_PARENT,
 			.ops = &clk_branch2_aon_ops,
 		},
 	},
@@ -480,7 +513,6 @@
 		.enable_mask = BIT(0),
 		.hw.init = &(const struct clk_init_data){
 			.name = "gpu_cc_memnoc_gfx_clk",
-			.flags = CLK_IS_CRITICAL,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -494,7 +526,6 @@
 		.enable_mask = BIT(0),
 		.hw.init = &(const struct clk_init_data){
 			.name = "gpu_cc_sleep_clk",
-			.flags = CLK_IS_CRITICAL,
 			.ops = &clk_branch2_ops,
 		},
 	},
@@ -504,6 +535,7 @@
 	[GPU_CC_AHB_CLK] = &gpu_cc_ahb_clk.clkr,
 	[GPU_CC_CB_CLK] = &gpu_cc_cb_clk.clkr,
 	[GPU_CC_CRC_AHB_CLK] = &gpu_cc_crc_ahb_clk.clkr,
+	[GPU_CC_CX_ACCU_SHIFT_CLK] = NULL,
 	[GPU_CC_CX_FF_CLK] = &gpu_cc_cx_ff_clk.clkr,
 	[GPU_CC_CX_GMU_CLK] = &gpu_cc_cx_gmu_clk.clkr,
 	[GPU_CC_CX_SNOC_DVM_CLK] = &gpu_cc_cx_snoc_dvm_clk.clkr,
@@ -513,6 +545,7 @@
 	[GPU_CC_DEMET_DIV_CLK_SRC] = &gpu_cc_demet_div_clk_src.clkr,
 	[GPU_CC_FF_CLK_SRC] = &gpu_cc_ff_clk_src.clkr,
 	[GPU_CC_GMU_CLK_SRC] = &gpu_cc_gmu_clk_src.clkr,
+	[GPU_CC_GX_ACCU_SHIFT_CLK] = NULL,
 	[GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK] = &gpu_cc_hlos1_vote_gpu_smmu_clk.clkr,
 	[GPU_CC_HUB_AHB_DIV_CLK_SRC] = &gpu_cc_hub_ahb_div_clk_src.clkr,
 	[GPU_CC_HUB_AON_CLK] = &gpu_cc_hub_aon_clk.clkr,
@@ -528,16 +561,22 @@
 
 static struct gdsc cx_gdsc = {
 	.gdscr = 0x9108,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.gds_hw_ctrl = 0x953c,
 	.pd = {
 		.name = "cx_gdsc",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
-	.flags = VOTABLE | RETAIN_FF_ENABLE | ALWAYS_ON,
+	.flags = VOTABLE | RETAIN_FF_ENABLE,
 };
 
 static struct gdsc gx_gdsc = {
 	.gdscr = 0x905c,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
 	.pd = {
 		.name = "gx_gdsc",
 		.power_on = gdsc_gx_do_nothing_enable,
@@ -582,6 +621,7 @@
 };
 
 static const struct of_device_id gpu_cc_sa8775p_match_table[] = {
+	{ .compatible = "qcom,qcs8300-gpucc" },
 	{ .compatible = "qcom,sa8775p-gpucc" },
 	{ }
 };
@@ -595,10 +635,18 @@
 	if (IS_ERR(regmap))
 		return PTR_ERR(regmap);
 
+	if (of_device_is_compatible(pdev->dev.of_node, "qcom,qcs8300-gpucc")) {
+		gpu_cc_pll0_config.l = 0x31;
+		gpu_cc_pll0_config.alpha = 0xe555;
+
+		gpu_cc_sa8775p_clocks[GPU_CC_CX_ACCU_SHIFT_CLK] = &gpu_cc_cx_accu_shift_clk.clkr;
+		gpu_cc_sa8775p_clocks[GPU_CC_GX_ACCU_SHIFT_CLK] = &gpu_cc_gx_accu_shift_clk.clkr;
+	}
+
 	clk_lucid_evo_pll_configure(&gpu_cc_pll0, regmap, &gpu_cc_pll0_config);
 	clk_lucid_evo_pll_configure(&gpu_cc_pll1, regmap, &gpu_cc_pll1_config);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sa8775p_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sa8775p_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sa8775p_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sc7180.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sc7180.c
@@ -241,7 +241,7 @@
 	value = 0xF << CX_GMU_CBCR_WAKE_SHIFT | 0xF << CX_GMU_CBCR_SLEEP_SHIFT;
 	regmap_update_bits(regmap, 0x1098, mask, value);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sc7180_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sc7180_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sc7180_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sc7280.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sc7280.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/clk-provider.h>
@@ -379,6 +380,9 @@
 
 static struct gdsc cx_gdsc = {
 	.gdscr = 0x106c,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x2,
 	.gds_hw_ctrl = 0x1540,
 	.pd = {
 		.name = "cx_gdsc",
@@ -389,6 +393,9 @@
 
 static struct gdsc gx_gdsc = {
 	.gdscr = 0x100c,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x2,
 	.clamp_io_ctrl = 0x1508,
 	.pd = {
 		.name = "gx_gdsc",
@@ -465,7 +472,7 @@
 	regmap_update_bits(regmap, 0x1098, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x1098, BIT(13), BIT(13));
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sc7280_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sc7280_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sc7280_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sc8280xp.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sc8280xp.c
@@ -451,7 +451,7 @@
 	regmap_update_bits(regmap, 0x1170, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x109c, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &gpu_cc_sc8280xp_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &gpu_cc_sc8280xp_desc, regmap);
 	pm_runtime_put(&pdev->dev);
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sdm660.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sdm660.c
@@ -330,7 +330,7 @@
 	gpu_pll_config.alpha_hi = 0x8a;
 	clk_alpha_pll_configure(&gpu_pll1_pll_out_main, regmap, &gpu_pll_config);
 
-	return qcom_cc_really_probe(pdev, &gpucc_sdm660_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpucc_sdm660_desc, regmap);
 }
 
 static struct platform_driver gpucc_sdm660_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sdm845.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sdm845.c
@@ -192,7 +192,7 @@
 	value = 0xf << CX_GMU_CBCR_WAKE_SHIFT | 0xf << CX_GMU_CBCR_SLEEP_SHIFT;
 	regmap_update_bits(regmap, 0x1098, mask, value);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sdm845_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sdm845_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sdm845_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm6115.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm6115.c
@@ -488,7 +488,7 @@
 	qcom_branch_set_force_mem_core(regmap, gpu_cc_gx_gfx3d_clk, true);
 	qcom_branch_set_force_periph_on(regmap, gpu_cc_gx_gfx3d_clk, true);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sm6115_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sm6115_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sm6115_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm6125.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm6125.c
@@ -409,7 +409,7 @@
 	qcom_branch_set_force_mem_core(regmap, gpu_cc_gx_gfx3d_clk, true);
 	qcom_branch_set_force_periph_on(regmap, gpu_cc_gx_gfx3d_clk, true);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sm6125_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sm6125_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sm6125_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm6350.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm6350.c
@@ -502,7 +502,7 @@
 	value = 0xF << CX_GMU_CBCR_WAKE_SHIFT | 0xF << CX_GMU_CBCR_SLEEP_SHIFT;
 	regmap_update_bits(regmap, 0x1098, mask, value);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sm6350_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sm6350_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sm6350_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm6375.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm6375.c
@@ -455,7 +455,7 @@
 	clk_lucid_pll_configure(&gpucc_pll0, regmap, &gpucc_pll0_config);
 	clk_lucid_pll_configure(&gpucc_pll1, regmap, &gpucc_pll1_config);
 
-	ret = qcom_cc_really_probe(pdev, &gpucc_sm6375_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &gpucc_sm6375_desc, regmap);
 	pm_runtime_put(&pdev->dev);
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm8150.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm8150.c
@@ -304,7 +304,7 @@
 
 	clk_trion_pll_configure(&gpu_cc_pll1, regmap, &gpu_cc_pll1_config);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sm8150_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sm8150_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sm8150_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm8250.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm8250.c
@@ -320,7 +320,7 @@
 	value = 0xf << CX_GMU_CBCR_WAKE_SHIFT | 0xf << CX_GMU_CBCR_SLEEP_SHIFT;
 	regmap_update_bits(regmap, 0x1098, mask, value);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sm8250_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sm8250_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sm8250_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm8350.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm8350.c
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
  * Copyright (c) 2022, Linaro Limited
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/clk.h>
@@ -147,7 +148,7 @@
 		.parent_data = gpu_cc_parent_data_0,
 		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_0),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_rcg2_shared_ops,
 	},
 };
 
@@ -169,7 +170,7 @@
 		.parent_data = gpu_cc_parent_data_1,
 		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_1),
 		.flags = CLK_SET_RATE_PARENT,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_rcg2_shared_ops,
 	},
 };
 
@@ -604,7 +605,7 @@
 	clk_lucid_pll_configure(&gpu_cc_pll0, regmap, &gpu_cc_pll0_config);
 	clk_lucid_pll_configure(&gpu_cc_pll1, regmap, &gpu_cc_pll1_config);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sm8350_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sm8350_desc, regmap);
 }
 
 static const struct of_device_id gpu_cc_sm8350_match_table[] = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm8450.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm8450.c
@@ -751,7 +751,7 @@
 	clk_lucid_evo_pll_configure(&gpu_cc_pll0, regmap, &gpu_cc_pll0_config);
 	clk_lucid_evo_pll_configure(&gpu_cc_pll1, regmap, &gpu_cc_pll1_config);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sm8450_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sm8450_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sm8450_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm8550.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm8550.c
@@ -583,7 +583,7 @@
 	regmap_update_bits(regmap, 0x9004, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x900c, BIT(0), BIT(0));
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sm8550_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sm8550_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sm8550_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-sm8650.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-sm8650.c
@@ -647,7 +647,7 @@
 	clk_lucid_ole_pll_configure(&gpu_cc_pll0, regmap, &gpu_cc_pll0_config);
 	clk_lucid_ole_pll_configure(&gpu_cc_pll1, regmap, &gpu_cc_pll1_config);
 
-	return qcom_cc_really_probe(pdev, &gpu_cc_sm8650_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_sm8650_desc, regmap);
 }
 
 static struct platform_driver gpu_cc_sm8650_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/gpucc-x1e80100.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/gpucc-x1e80100.c
@@ -0,0 +1,656 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,x1e80100-gpucc.h>
+#include <dt-bindings/reset/qcom,x1e80100-gpucc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_GPLL0_OUT_MAIN,
+	DT_GPLL0_OUT_MAIN_DIV,
+};
+
+enum {
+	P_BI_TCXO,
+	P_GPLL0_OUT_MAIN,
+	P_GPLL0_OUT_MAIN_DIV,
+	P_GPU_CC_PLL0_OUT_MAIN,
+	P_GPU_CC_PLL1_OUT_MAIN,
+};
+
+static const struct pll_vco lucid_ole_vco[] = {
+	{ 249600000, 2300000000, 0 },
+};
+
+static const struct pll_vco zonda_ole_vco[] = {
+	{ 700000000, 3600000000, 0 },
+};
+
+static const struct alpha_pll_config gpu_cc_pll0_config = {
+	.l = 0x29,
+	.alpha = 0xa000,
+	.config_ctl_val = 0x08240800,
+	.config_ctl_hi_val = 0x05008001,
+	.config_ctl_hi1_val = 0x00000000,
+	.config_ctl_hi2_val = 0x00000000,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x02000000,
+};
+
+static struct clk_alpha_pll gpu_cc_pll0 = {
+	.offset = 0x0,
+	.vco_table = zonda_ole_vco,
+	.num_vco = ARRAY_SIZE(zonda_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_ZONDA_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_zonda_ole_ops,
+		},
+	},
+};
+
+static const struct alpha_pll_config gpu_cc_pll1_config = {
+	.l = 0x16,
+	.alpha = 0xeaaa,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x82aa299c,
+	.test_ctl_val = 0x00000000,
+	.test_ctl_hi_val = 0x00000003,
+	.test_ctl_hi1_val = 0x00009000,
+	.test_ctl_hi2_val = 0x00000034,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00000005,
+};
+
+static struct clk_alpha_pll gpu_cc_pll1 = {
+	.offset = 0x1000,
+	.vco_table = lucid_ole_vco,
+	.num_vco = ARRAY_SIZE(lucid_ole_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_OLE],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_pll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct parent_map gpu_cc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_MAIN, 5 },
+	{ P_GPLL0_OUT_MAIN_DIV, 6 },
+};
+
+static const struct clk_parent_data gpu_cc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .index = DT_GPLL0_OUT_MAIN },
+	{ .index = DT_GPLL0_OUT_MAIN_DIV },
+};
+
+static const struct parent_map gpu_cc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPU_CC_PLL0_OUT_MAIN, 1 },
+	{ P_GPU_CC_PLL1_OUT_MAIN, 3 },
+	{ P_GPLL0_OUT_MAIN, 5 },
+	{ P_GPLL0_OUT_MAIN_DIV, 6 },
+};
+
+static const struct clk_parent_data gpu_cc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpu_cc_pll0.clkr.hw },
+	{ .hw = &gpu_cc_pll1.clkr.hw },
+	{ .index = DT_GPLL0_OUT_MAIN },
+	{ .index = DT_GPLL0_OUT_MAIN_DIV },
+};
+
+static const struct parent_map gpu_cc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_GPU_CC_PLL1_OUT_MAIN, 3 },
+	{ P_GPLL0_OUT_MAIN, 5 },
+	{ P_GPLL0_OUT_MAIN_DIV, 6 },
+};
+
+static const struct clk_parent_data gpu_cc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &gpu_cc_pll1.clkr.hw },
+	{ .index = DT_GPLL0_OUT_MAIN },
+	{ .index = DT_GPLL0_OUT_MAIN_DIV },
+};
+
+static const struct parent_map gpu_cc_parent_map_3[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data gpu_cc_parent_data_3[] = {
+	{ .index = DT_BI_TCXO },
+};
+
+static const struct freq_tbl ftbl_gpu_cc_ff_clk_src[] = {
+	F(200000000, P_GPLL0_OUT_MAIN, 3, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gpu_cc_ff_clk_src = {
+	.cmd_rcgr = 0x9474,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gpu_cc_parent_map_0,
+	.freq_tbl = ftbl_gpu_cc_ff_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpu_cc_ff_clk_src",
+		.parent_data = gpu_cc_parent_data_0,
+		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_gpu_cc_gmu_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(220000000, P_GPU_CC_PLL1_OUT_MAIN, 2, 0, 0),
+	F(550000000, P_GPU_CC_PLL1_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 gpu_cc_gmu_clk_src = {
+	.cmd_rcgr = 0x9318,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gpu_cc_parent_map_1,
+	.freq_tbl = ftbl_gpu_cc_gmu_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpu_cc_gmu_clk_src",
+		.parent_data = gpu_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 gpu_cc_hub_clk_src = {
+	.cmd_rcgr = 0x93ec,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gpu_cc_parent_map_2,
+	.freq_tbl = ftbl_gpu_cc_ff_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpu_cc_hub_clk_src",
+		.parent_data = gpu_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_rcg2 gpu_cc_xo_clk_src = {
+	.cmd_rcgr = 0x9010,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = gpu_cc_parent_map_3,
+	.freq_tbl = NULL,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpu_cc_xo_clk_src",
+		.parent_data = gpu_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(gpu_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_regmap_div gpu_cc_demet_div_clk_src = {
+	.reg = 0x9054,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpu_cc_demet_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gpu_cc_xo_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div gpu_cc_xo_div_clk_src = {
+	.reg = 0x9050,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "gpu_cc_xo_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&gpu_cc_xo_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_branch gpu_cc_ahb_clk = {
+	.halt_reg = 0x911c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x911c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_hub_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_crc_ahb_clk = {
+	.halt_reg = 0x9120,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x9120,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_crc_ahb_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_hub_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cx_ff_clk = {
+	.halt_reg = 0x914c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x914c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_cx_ff_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_ff_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cx_gmu_clk = {
+	.halt_reg = 0x913c,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x913c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_cx_gmu_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_gmu_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_aon_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cxo_aon_clk = {
+	.halt_reg = 0x9004,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x9004,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_cxo_aon_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_cxo_clk = {
+	.halt_reg = 0x9144,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9144,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_cxo_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_demet_clk = {
+	.halt_reg = 0x900c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x900c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_demet_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_demet_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_aon_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_freq_measure_clk = {
+	.halt_reg = 0x9008,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9008,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_freq_measure_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_xo_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_hlos1_vote_gpu_smmu_clk = {
+	.halt_reg = 0x7000,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x7000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_hlos1_vote_gpu_smmu_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_gx_gmu_clk = {
+	.halt_reg = 0x90bc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x90bc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_gx_gmu_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_gmu_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_gx_vsense_clk = {
+	.halt_reg = 0x90b0,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x90b0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_gx_vsense_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_hub_aon_clk = {
+	.halt_reg = 0x93e8,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x93e8,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_hub_aon_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_hub_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_aon_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_hub_cx_int_clk = {
+	.halt_reg = 0x9148,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x9148,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_hub_cx_int_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&gpu_cc_hub_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_aon_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_memnoc_gfx_clk = {
+	.halt_reg = 0x9150,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x9150,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_memnoc_gfx_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_mnd1x_0_gfx3d_clk = {
+	.halt_reg = 0x9288,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9288,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_mnd1x_0_gfx3d_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_mnd1x_1_gfx3d_clk = {
+	.halt_reg = 0x928c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x928c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_mnd1x_1_gfx3d_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch gpu_cc_sleep_clk = {
+	.halt_reg = 0x9134,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x9134,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "gpu_cc_sleep_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc gpu_cx_gdsc = {
+	.gdscr = 0x9108,
+	.gds_hw_ctrl = 0x953c,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "gpu_cx_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = VOTABLE | RETAIN_FF_ENABLE,
+};
+
+static struct gdsc gpu_gx_gdsc = {
+	.gdscr = 0x905c,
+	.clamp_io_ctrl = 0x9504,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0xf,
+	.pd = {
+		.name = "gpu_gx_gdsc",
+		.power_on = gdsc_gx_do_nothing_enable,
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = CLAMP_IO | AON_RESET | SW_RESET | POLL_CFG_GDSCR,
+};
+
+static struct clk_regmap *gpu_cc_x1e80100_clocks[] = {
+	[GPU_CC_AHB_CLK] = &gpu_cc_ahb_clk.clkr,
+	[GPU_CC_CRC_AHB_CLK] = &gpu_cc_crc_ahb_clk.clkr,
+	[GPU_CC_CX_FF_CLK] = &gpu_cc_cx_ff_clk.clkr,
+	[GPU_CC_CX_GMU_CLK] = &gpu_cc_cx_gmu_clk.clkr,
+	[GPU_CC_CXO_AON_CLK] = &gpu_cc_cxo_aon_clk.clkr,
+	[GPU_CC_CXO_CLK] = &gpu_cc_cxo_clk.clkr,
+	[GPU_CC_DEMET_CLK] = &gpu_cc_demet_clk.clkr,
+	[GPU_CC_DEMET_DIV_CLK_SRC] = &gpu_cc_demet_div_clk_src.clkr,
+	[GPU_CC_FF_CLK_SRC] = &gpu_cc_ff_clk_src.clkr,
+	[GPU_CC_FREQ_MEASURE_CLK] = &gpu_cc_freq_measure_clk.clkr,
+	[GPU_CC_GMU_CLK_SRC] = &gpu_cc_gmu_clk_src.clkr,
+	[GPU_CC_GX_GMU_CLK] = &gpu_cc_gx_gmu_clk.clkr,
+	[GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK] = &gpu_cc_hlos1_vote_gpu_smmu_clk.clkr,
+	[GPU_CC_GX_VSENSE_CLK] = &gpu_cc_gx_vsense_clk.clkr,
+	[GPU_CC_HUB_AON_CLK] = &gpu_cc_hub_aon_clk.clkr,
+	[GPU_CC_HUB_CLK_SRC] = &gpu_cc_hub_clk_src.clkr,
+	[GPU_CC_HUB_CX_INT_CLK] = &gpu_cc_hub_cx_int_clk.clkr,
+	[GPU_CC_MEMNOC_GFX_CLK] = &gpu_cc_memnoc_gfx_clk.clkr,
+	[GPU_CC_MND1X_0_GFX3D_CLK] = &gpu_cc_mnd1x_0_gfx3d_clk.clkr,
+	[GPU_CC_MND1X_1_GFX3D_CLK] = &gpu_cc_mnd1x_1_gfx3d_clk.clkr,
+	[GPU_CC_PLL0] = &gpu_cc_pll0.clkr,
+	[GPU_CC_PLL1] = &gpu_cc_pll1.clkr,
+	[GPU_CC_SLEEP_CLK] = &gpu_cc_sleep_clk.clkr,
+	[GPU_CC_XO_CLK_SRC] = &gpu_cc_xo_clk_src.clkr,
+	[GPU_CC_XO_DIV_CLK_SRC] = &gpu_cc_xo_div_clk_src.clkr,
+};
+
+static const struct qcom_reset_map gpu_cc_x1e80100_resets[] = {
+	[GPUCC_GPU_CC_XO_BCR] = { 0x9000 },
+	[GPUCC_GPU_CC_GX_BCR] = { 0x9058 },
+	[GPUCC_GPU_CC_CX_BCR] = { 0x9104 },
+	[GPUCC_GPU_CC_GFX3D_AON_BCR] = { 0x9198 },
+	[GPUCC_GPU_CC_ACD_BCR] = { 0x9358 },
+	[GPUCC_GPU_CC_FAST_HUB_BCR] = { 0x93e4 },
+	[GPUCC_GPU_CC_FF_BCR] = { 0x9470 },
+	[GPUCC_GPU_CC_GMU_BCR] = { 0x9314 },
+	[GPUCC_GPU_CC_CB_BCR] = { 0x93a0 },
+};
+
+static struct gdsc *gpu_cc_x1e80100_gdscs[] = {
+	[GPU_CX_GDSC] = &gpu_cx_gdsc,
+	[GPU_GX_GDSC] = &gpu_gx_gdsc,
+};
+
+static const struct regmap_config gpu_cc_x1e80100_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0x9988,
+	.fast_io = true,
+};
+
+static const struct qcom_cc_desc gpu_cc_x1e80100_desc = {
+	.config = &gpu_cc_x1e80100_regmap_config,
+	.clks = gpu_cc_x1e80100_clocks,
+	.num_clks = ARRAY_SIZE(gpu_cc_x1e80100_clocks),
+	.resets = gpu_cc_x1e80100_resets,
+	.num_resets = ARRAY_SIZE(gpu_cc_x1e80100_resets),
+	.gdscs = gpu_cc_x1e80100_gdscs,
+	.num_gdscs = ARRAY_SIZE(gpu_cc_x1e80100_gdscs),
+};
+
+static const struct of_device_id gpu_cc_x1e80100_match_table[] = {
+	{ .compatible = "qcom,x1e80100-gpucc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, gpu_cc_x1e80100_match_table);
+
+static int gpu_cc_x1e80100_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+
+	regmap = qcom_cc_map(pdev, &gpu_cc_x1e80100_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	clk_zonda_pll_configure(&gpu_cc_pll0, regmap, &gpu_cc_pll0_config);
+	clk_lucid_evo_pll_configure(&gpu_cc_pll1, regmap, &gpu_cc_pll1_config);
+
+	/* Keep clocks always enabled */
+	regmap_update_bits(regmap, 0x93a4, BIT(0), BIT(0)); /* gpu_cc_cb_clk */
+
+	return qcom_cc_really_probe(&pdev->dev, &gpu_cc_x1e80100_desc, regmap);
+}
+
+static struct platform_driver gpu_cc_x1e80100_driver = {
+	.probe = gpu_cc_x1e80100_probe,
+	.driver = {
+		.name = "gpucc-x1e80100",
+		.of_match_table = gpu_cc_x1e80100_match_table,
+	},
+};
+module_platform_driver(gpu_cc_x1e80100_driver);
+
+MODULE_DESCRIPTION("QTI GPU Clock Controller X1E80100 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/kpss-xcc.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/kpss-xcc.c
@@ -58,9 +58,7 @@
 	if (IS_ERR(hw))
 		return PTR_ERR(hw);
 
-	of_clk_add_hw_provider(dev->of_node, of_clk_hw_simple_get, hw);
-
-	return 0;
+	return of_clk_add_hw_provider(dev->of_node, of_clk_hw_simple_get, hw);
 }
 
 static struct platform_driver kpss_xcc_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/lcc-ipq806x.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/lcc-ipq806x.c
@@ -454,7 +454,7 @@
 	/* Enable PLL4 source on the LPASS Primary PLL Mux */
 	regmap_write(regmap, 0xc4, 0x1);
 
-	return qcom_cc_really_probe(pdev, &lcc_ipq806x_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &lcc_ipq806x_desc, regmap);
 }
 
 static struct platform_driver lcc_ipq806x_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/lcc-msm8960.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/lcc-msm8960.c
@@ -481,7 +481,7 @@
 	/* Enable PLL4 source on the LPASS Primary PLL Mux */
 	regmap_write(regmap, 0xc4, 0x1);
 
-	return qcom_cc_really_probe(pdev, &lcc_msm8960_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &lcc_msm8960_desc, regmap);
 }
 
 static struct platform_driver lcc_msm8960_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/lpassaudiocc-sc7280.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/lpassaudiocc-sc7280.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/clk-provider.h>
@@ -766,18 +767,23 @@
 		goto exit;
 	}
 
-	clk_zonda_pll_configure(&lpass_audio_cc_pll, regmap, &lpass_audio_cc_pll_config);
+	if (!of_property_read_bool(pdev->dev.of_node, "qcom,adsp-skip-pll")) {
+		clk_zonda_pll_configure(&lpass_audio_cc_pll, regmap, &lpass_audio_cc_pll_config);
 
-	/* PLL settings */
-	regmap_write(regmap, 0x4, 0x3b);
-	regmap_write(regmap, 0x8, 0xff05);
+		/* PLL settings */
+		regmap_write(regmap, 0x4, 0x3b);
+		regmap_write(regmap, 0x8, 0xff05);
+	}
 
-	ret = qcom_cc_really_probe(pdev, &lpass_audio_cc_sc7280_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &lpass_audio_cc_sc7280_desc, regmap);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register LPASS AUDIO CC clocks\n");
 		goto exit;
 	}
 
+	lpass_audio_cc_sc7280_regmap_config.name = "lpassaudio_cc_reset";
+	lpass_audio_cc_sc7280_regmap_config.max_register = 0xc8;
+
 	ret = qcom_cc_probe_by_index(pdev, 1, &lpass_audio_cc_reset_sc7280_desc);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register LPASS AUDIO CC Resets\n");
@@ -847,7 +853,7 @@
 
 	clk_lucid_pll_configure(&lpass_aon_cc_pll, regmap, &lpass_aon_cc_pll_config);
 
-	ret = qcom_cc_really_probe(pdev, &lpass_aon_cc_sc7280_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &lpass_aon_cc_sc7280_desc, regmap);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register LPASS AON CC clocks\n");
 		goto exit;
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/lpasscorecc-sc7180.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/lpasscorecc-sc7180.c
@@ -414,7 +414,7 @@
 	clk_fabia_pll_configure(&lpass_lpaaudio_dig_pll, regmap,
 				&lpass_lpaaudio_dig_pll_config);
 
-	ret = qcom_cc_really_probe(pdev, &lpass_core_cc_sc7180_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &lpass_core_cc_sc7180_desc, regmap);
 
 	pm_runtime_mark_last_busy(&pdev->dev);
 exit:
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/lpasscorecc-sc7280.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/lpasscorecc-sc7280.c
@@ -406,7 +406,7 @@
 
 	clk_lucid_pll_configure(&lpass_core_cc_dig_pll, regmap, &lpass_core_cc_dig_pll_config);
 
-	return qcom_cc_really_probe(pdev, &lpass_core_cc_sc7280_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &lpass_core_cc_sc7280_desc, regmap);
 }
 
 static struct platform_driver lpass_core_cc_sc7280_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/mmcc-apq8084.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/mmcc-apq8084.c
@@ -348,6 +348,7 @@
 	F(333430000, P_MMPLL1, 3.5, 0, 0),
 	F(400000000, P_MMPLL0, 2, 0, 0),
 	F(466800000, P_MMPLL1, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 mmss_axi_clk_src = {
@@ -372,6 +373,7 @@
 	F(150000000, P_GPLL0, 4, 0, 0),
 	F(228570000, P_MMPLL0, 3.5, 0, 0),
 	F(320000000, P_MMPLL0, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 ocmemnoc_clk_src = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/mmcc-msm8960.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/mmcc-msm8960.c
@@ -3122,7 +3122,7 @@
 
 	clk_pll_configure_sr(&pll15, regmap, &pll15_config, false);
 
-	return qcom_cc_really_probe(pdev, desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, desc, regmap);
 }
 
 static struct platform_driver mmcc_msm8960_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/mmcc-msm8974.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/mmcc-msm8974.c
@@ -290,6 +290,7 @@
 	F(291750000, P_MMPLL1, 4, 0, 0),
 	F(400000000, P_MMPLL0, 2, 0, 0),
 	F(466800000, P_MMPLL1, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 mmss_axi_clk_src = {
@@ -314,6 +315,7 @@
 	F(150000000, P_GPLL0, 4, 0, 0),
 	F(291750000, P_MMPLL1, 4, 0, 0),
 	F(400000000, P_MMPLL0, 2, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 ocmemnoc_clk_src = {
@@ -2766,7 +2768,7 @@
 		msm8226_clock_override();
 	}
 
-	return qcom_cc_really_probe(pdev, desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, desc, regmap);
 }
 
 static struct platform_driver mmcc_msm8974_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/mmcc-msm8994.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/mmcc-msm8994.c
@@ -2602,7 +2602,7 @@
 	clk_alpha_pll_configure(&mmpll3_early, regmap, &mmpll_p_config);
 	clk_alpha_pll_configure(&mmpll5_early, regmap, &mmpll_p_config);
 
-	return qcom_cc_really_probe(pdev, &mmcc_msm8994_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &mmcc_msm8994_desc, regmap);
 }
 
 static struct platform_driver mmcc_msm8994_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/mmcc-msm8996.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/mmcc-msm8996.c
@@ -3626,7 +3626,7 @@
 	/* Disable the NoC FSM for mmss_mmagic_cfg_ahb_clk */
 	regmap_update_bits(regmap, 0x5054, BIT(15), 0);
 
-	return qcom_cc_really_probe(pdev, &mmcc_msm8996_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &mmcc_msm8996_desc, regmap);
 }
 
 static struct platform_driver mmcc_msm8996_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/mmcc-msm8998.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/mmcc-msm8998.c
@@ -2535,6 +2535,8 @@
 
 static struct gdsc video_top_gdsc = {
 	.gdscr = 0x1024,
+	.cxcs = (unsigned int []){ 0x1028, 0x1034, 0x1038 },
+	.cxc_count = 3,
 	.pd = {
 		.name = "video_top",
 	},
@@ -2543,20 +2545,26 @@
 
 static struct gdsc video_subcore0_gdsc = {
 	.gdscr = 0x1040,
+	.cxcs = (unsigned int []){ 0x1048 },
+	.cxc_count = 1,
 	.pd = {
 		.name = "video_subcore0",
 	},
 	.parent = &video_top_gdsc.pd,
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = HW_CTRL,
 };
 
 static struct gdsc video_subcore1_gdsc = {
 	.gdscr = 0x1044,
+	.cxcs = (unsigned int []){ 0x104c },
+	.cxc_count = 1,
 	.pd = {
 		.name = "video_subcore1",
 	},
 	.parent = &video_top_gdsc.pd,
 	.pwrsts = PWRSTS_OFF_ON,
+	.flags = HW_CTRL,
 };
 
 static struct gdsc mdss_gdsc = {
@@ -2858,7 +2866,7 @@
 	if (IS_ERR(regmap))
 		return PTR_ERR(regmap);
 
-	return qcom_cc_really_probe(pdev, &mmcc_msm8998_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &mmcc_msm8998_desc, regmap);
 }
 
 static struct platform_driver mmcc_msm8998_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/mmcc-sdm660.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/mmcc-sdm660.c
@@ -2847,7 +2847,7 @@
 	clk_alpha_pll_configure(&mmpll8, regmap, &mmpll8_config);
 	clk_alpha_pll_configure(&mmpll10, regmap, &mmpll10_config);
 
-	return qcom_cc_really_probe(pdev, &mmcc_660_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &mmcc_660_desc, regmap);
 }
 
 static struct platform_driver mmcc_660_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/reset.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/reset.c
@@ -22,8 +22,8 @@
 	return 0;
 }
 
-static int
-qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
+static int qcom_reset_set_assert(struct reset_controller_dev *rcdev,
+				 unsigned long id, bool assert)
 {
 	struct qcom_reset_controller *rst;
 	const struct qcom_reset_map *map;
@@ -33,21 +33,22 @@
 	map = &rst->reset_map[id];
 	mask = map->bitmask ? map->bitmask : BIT(map->bit);
 
-	return regmap_update_bits(rst->regmap, map->reg, mask, mask);
+	regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0);
+
+	/* Read back the register to ensure write completion, ignore the value */
+	regmap_read(rst->regmap, map->reg, &mask);
+
+	return 0;
 }
 
-static int
-qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id)
+static int qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
 {
-	struct qcom_reset_controller *rst;
-	const struct qcom_reset_map *map;
-	u32 mask;
-
-	rst = to_qcom_reset_controller(rcdev);
-	map = &rst->reset_map[id];
-	mask = map->bitmask ? map->bitmask : BIT(map->bit);
+	return qcom_reset_set_assert(rcdev, id, true);
+}
 
-	return regmap_update_bits(rst->regmap, map->reg, mask, 0);
+static int qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id)
+{
+	return qcom_reset_set_assert(rcdev, id, false);
 }
 
 const struct reset_control_ops qcom_reset_ops = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/tcsrcc-sm8550.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/tcsrcc-sm8550.c
@@ -129,6 +129,13 @@
 	},
 };
 
+static struct clk_regmap *tcsr_cc_sar2130p_clocks[] = {
+	[TCSR_PCIE_0_CLKREF_EN] = &tcsr_pcie_0_clkref_en.clkr,
+	[TCSR_PCIE_1_CLKREF_EN] = &tcsr_pcie_1_clkref_en.clkr,
+	[TCSR_USB2_CLKREF_EN] = &tcsr_usb2_clkref_en.clkr,
+	[TCSR_USB3_CLKREF_EN] = &tcsr_usb3_clkref_en.clkr,
+};
+
 static struct clk_regmap *tcsr_cc_sm8550_clocks[] = {
 	[TCSR_PCIE_0_CLKREF_EN] = &tcsr_pcie_0_clkref_en.clkr,
 	[TCSR_PCIE_1_CLKREF_EN] = &tcsr_pcie_1_clkref_en.clkr,
@@ -146,6 +153,12 @@
 	.fast_io = true,
 };
 
+static const struct qcom_cc_desc tcsr_cc_sar2130p_desc = {
+	.config = &tcsr_cc_sm8550_regmap_config,
+	.clks = tcsr_cc_sar2130p_clocks,
+	.num_clks = ARRAY_SIZE(tcsr_cc_sar2130p_clocks),
+};
+
 static const struct qcom_cc_desc tcsr_cc_sm8550_desc = {
 	.config = &tcsr_cc_sm8550_regmap_config,
 	.clks = tcsr_cc_sm8550_clocks,
@@ -153,7 +166,8 @@
 };
 
 static const struct of_device_id tcsr_cc_sm8550_match_table[] = {
-	{ .compatible = "qcom,sm8550-tcsr" },
+	{ .compatible = "qcom,sar2130p-tcsr", .data = &tcsr_cc_sar2130p_desc },
+	{ .compatible = "qcom,sm8550-tcsr", .data = &tcsr_cc_sm8550_desc },
 	{ }
 };
 MODULE_DEVICE_TABLE(of, tcsr_cc_sm8550_match_table);
@@ -162,11 +176,11 @@
 {
 	struct regmap *regmap;
 
-	regmap = qcom_cc_map(pdev, &tcsr_cc_sm8550_desc);
+	regmap = qcom_cc_map(pdev, of_device_get_match_data(&pdev->dev));
 	if (IS_ERR(regmap))
 		return PTR_ERR(regmap);
 
-	return qcom_cc_really_probe(pdev, &tcsr_cc_sm8550_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &tcsr_cc_sm8550_desc, regmap);
 }
 
 static struct platform_driver tcsr_cc_sm8550_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-qcs615.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-qcs615.c
@@ -0,0 +1,332 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,qcs615-videocc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_SLEEP_CLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_SLEEP_CLK,
+	P_VIDEO_PLL0_OUT_AUX,
+	P_VIDEO_PLL0_OUT_AUX2,
+	P_VIDEO_PLL0_OUT_MAIN,
+};
+
+static const struct pll_vco video_cc_pll0_vco[] = {
+	{ 500000000, 1000000000, 2 },
+};
+
+/* 600MHz configuration VCO - 2 */
+static struct alpha_pll_config video_pll0_config = {
+	.l = 0x1f,
+	.alpha_hi = 0x40,
+	.alpha = 0x00,
+	.alpha_en_mask = BIT(24),
+	.vco_val = BIT(21),
+	.vco_mask = GENMASK(21, 20),
+	.main_output_mask = BIT(0),
+	.config_ctl_val = 0x4001055b,
+	.test_ctl_hi_val = 0x1,
+	.test_ctl_hi_mask = 0x1,
+};
+
+static struct clk_alpha_pll video_pll0 = {
+	.offset = 0x42c,
+	.vco_table = video_cc_pll0_vco,
+	.num_vco = ARRAY_SIZE(video_cc_pll0_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_slew_ops,
+		},
+	},
+};
+
+static const struct parent_map video_cc_parent_map_0[] = {
+	{ P_SLEEP_CLK, 0 },
+};
+
+static const struct clk_parent_data video_cc_parent_data_0_ao[] = {
+	{ .index = DT_SLEEP_CLK },
+};
+
+static const struct parent_map video_cc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_VIDEO_PLL0_OUT_MAIN, 1 },
+	{ P_VIDEO_PLL0_OUT_AUX, 2 },
+	{ P_VIDEO_PLL0_OUT_AUX2, 3 },
+};
+
+static const struct clk_parent_data video_cc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &video_pll0.clkr.hw },
+	{ .hw = &video_pll0.clkr.hw },
+	{ .hw = &video_pll0.clkr.hw },
+};
+
+static const struct freq_tbl ftbl_video_cc_sleep_clk_src[] = {
+	F(32000, P_SLEEP_CLK, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 video_cc_sleep_clk_src = {
+	.cmd_rcgr = 0xaf8,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = video_cc_parent_map_0,
+	.freq_tbl = ftbl_video_cc_sleep_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_sleep_clk_src",
+		.parent_data = video_cc_parent_data_0_ao,
+		.num_parents = ARRAY_SIZE(video_cc_parent_data_0_ao),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_video_cc_venus_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	F(133333333, P_VIDEO_PLL0_OUT_MAIN, 4.5, 0, 0),
+	F(240000000, P_VIDEO_PLL0_OUT_MAIN, 2.5, 0, 0),
+	F(300000000, P_VIDEO_PLL0_OUT_MAIN, 2, 0, 0),
+	F(380000000, P_VIDEO_PLL0_OUT_MAIN, 2, 0, 0),
+	F(410000000, P_VIDEO_PLL0_OUT_MAIN, 2, 0, 0),
+	F(460000000, P_VIDEO_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 video_cc_venus_clk_src = {
+	.cmd_rcgr = 0x7f0,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = video_cc_parent_map_1,
+	.freq_tbl = ftbl_video_cc_venus_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_venus_clk_src",
+		.parent_data = video_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(video_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_branch video_cc_sleep_clk = {
+	.halt_reg = 0xb18,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xb18,
+		.enable_mask = BIT(0),
+		.hw.init = &(struct clk_init_data){
+			.name = "video_cc_sleep_clk",
+			.parent_data = &(const struct clk_parent_data){
+				.hw = &video_cc_sleep_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_vcodec0_axi_clk = {
+	.halt_reg = 0x8f0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8f0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_vcodec0_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_vcodec0_core_clk = {
+	.halt_reg = 0x890,
+	.halt_check = BRANCH_HALT_VOTED,
+	.clkr = {
+		.enable_reg = 0x890,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_vcodec0_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&video_cc_venus_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_venus_ahb_clk = {
+	.halt_reg = 0x9b0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9b0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_venus_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_venus_ctl_axi_clk = {
+	.halt_reg = 0x8d0,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8d0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_venus_ctl_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_venus_ctl_core_clk = {
+	.halt_reg = 0x850,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x850,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_venus_ctl_core_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&video_cc_venus_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc vcodec0_gdsc = {
+	.gdscr = 0x874,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x6,
+	.pd = {
+		.name = "vcodec0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = HW_CTRL | POLL_CFG_GDSCR,
+};
+
+static struct gdsc venus_gdsc = {
+	.gdscr = 0x814,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x6,
+	.pd = {
+		.name = "venus_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR,
+};
+
+static struct clk_regmap *video_cc_qcs615_clocks[] = {
+	[VIDEO_CC_SLEEP_CLK] = &video_cc_sleep_clk.clkr,
+	[VIDEO_CC_SLEEP_CLK_SRC] = &video_cc_sleep_clk_src.clkr,
+	[VIDEO_CC_VCODEC0_AXI_CLK] = &video_cc_vcodec0_axi_clk.clkr,
+	[VIDEO_CC_VCODEC0_CORE_CLK] = &video_cc_vcodec0_core_clk.clkr,
+	[VIDEO_CC_VENUS_AHB_CLK] = &video_cc_venus_ahb_clk.clkr,
+	[VIDEO_CC_VENUS_CLK_SRC] = &video_cc_venus_clk_src.clkr,
+	[VIDEO_CC_VENUS_CTL_AXI_CLK] = &video_cc_venus_ctl_axi_clk.clkr,
+	[VIDEO_CC_VENUS_CTL_CORE_CLK] = &video_cc_venus_ctl_core_clk.clkr,
+	[VIDEO_PLL0] = &video_pll0.clkr,
+};
+
+static struct gdsc *video_cc_qcs615_gdscs[] = {
+	[VCODEC0_GDSC] = &vcodec0_gdsc,
+	[VENUS_GDSC] = &venus_gdsc,
+};
+
+static const struct qcom_reset_map video_cc_qcs615_resets[] = {
+	[VIDEO_CC_INTERFACE_BCR] = { 0x8b0 },
+	[VIDEO_CC_VCODEC0_BCR] = { 0x870 },
+	[VIDEO_CC_VENUS_BCR] = { 0x810 },
+};
+
+static const struct regmap_config video_cc_qcs615_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0xb94,
+	.fast_io = true,
+};
+
+static const struct qcom_cc_desc video_cc_qcs615_desc = {
+	.config = &video_cc_qcs615_regmap_config,
+	.clks = video_cc_qcs615_clocks,
+	.num_clks = ARRAY_SIZE(video_cc_qcs615_clocks),
+	.resets = video_cc_qcs615_resets,
+	.num_resets = ARRAY_SIZE(video_cc_qcs615_resets),
+	.gdscs = video_cc_qcs615_gdscs,
+	.num_gdscs = ARRAY_SIZE(video_cc_qcs615_gdscs),
+};
+
+static const struct of_device_id video_cc_qcs615_match_table[] = {
+	{ .compatible = "qcom,qcs615-videocc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, video_cc_qcs615_match_table);
+
+static int video_cc_qcs615_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+
+	regmap = qcom_cc_map(pdev, &video_cc_qcs615_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	clk_alpha_pll_configure(&video_pll0, regmap, &video_pll0_config);
+
+	/* Keep some clocks always enabled */
+	regmap_update_bits(regmap, 0x0ab8, BIT(0), BIT(0)); /* VIDEO_CC_XO_CLK */
+
+	return qcom_cc_really_probe(&pdev->dev, &video_cc_qcs615_desc, regmap);
+}
+
+static struct platform_driver video_cc_qcs615_driver = {
+	.probe = video_cc_qcs615_probe,
+	.driver = {
+		.name = "videocc-qcs615",
+		.of_match_table = video_cc_qcs615_match_table,
+	},
+};
+
+module_platform_driver(video_cc_qcs615_driver);
+
+MODULE_DESCRIPTION("QTI VIDEOCC QCS615 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sa8775p.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sa8775p.c
@@ -0,0 +1,581 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,sa8775p-videocc.h>
+
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-pll.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-regmap-divider.h"
+#include "clk-regmap-mux.h"
+#include "common.h"
+#include "gdsc.h"
+#include "reset.h"
+
+enum {
+	DT_IFACE,
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+	DT_SLEEP_CLK,
+};
+
+enum {
+	P_BI_TCXO,
+	P_BI_TCXO_AO,
+	P_SLEEP_CLK,
+	P_VIDEO_PLL0_OUT_MAIN,
+	P_VIDEO_PLL1_OUT_MAIN,
+};
+
+static const struct pll_vco lucid_evo_vco[] = {
+	{ 249600000, 2020000000, 0 },
+};
+
+static const struct alpha_pll_config video_pll0_config = {
+	.l = 0x39,
+	.alpha = 0x3000,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll video_pll0 = {
+	.offset = 0x0,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct alpha_pll_config video_pll1_config = {
+	.l = 0x39,
+	.alpha = 0x3000,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00182261,
+	.config_ctl_hi1_val = 0x32aa299c,
+	.user_ctl_val = 0x00000000,
+	.user_ctl_hi_val = 0x00400805,
+};
+
+static struct clk_alpha_pll video_pll1 = {
+	.offset = 0x1000,
+	.vco_table = lucid_evo_vco,
+	.num_vco = ARRAY_SIZE(lucid_evo_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_LUCID_EVO],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_pll1",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_lucid_evo_ops,
+		},
+	},
+};
+
+static const struct parent_map video_cc_parent_map_0_ao[] = {
+	{ P_BI_TCXO_AO, 0 },
+};
+
+static const struct clk_parent_data video_cc_parent_data_0_ao[] = {
+	{ .index = DT_BI_TCXO_AO },
+};
+
+static const struct parent_map video_cc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_VIDEO_PLL0_OUT_MAIN, 1 },
+};
+
+static const struct clk_parent_data video_cc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &video_pll0.clkr.hw },
+};
+
+static const struct parent_map video_cc_parent_map_2[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_VIDEO_PLL1_OUT_MAIN, 1 },
+};
+
+static const struct clk_parent_data video_cc_parent_data_2[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &video_pll1.clkr.hw },
+};
+
+static const struct parent_map video_cc_parent_map_3[] = {
+	{ P_SLEEP_CLK, 0 },
+};
+
+static const struct clk_parent_data video_cc_parent_data_3[] = {
+	{ .index = DT_SLEEP_CLK },
+};
+
+static const struct freq_tbl ftbl_video_cc_ahb_clk_src[] = {
+	F(19200000, P_BI_TCXO_AO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 video_cc_ahb_clk_src = {
+	.cmd_rcgr = 0x8030,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = video_cc_parent_map_0_ao,
+	.freq_tbl = ftbl_video_cc_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_ahb_clk_src",
+		.parent_data = video_cc_parent_data_0_ao,
+		.num_parents = ARRAY_SIZE(video_cc_parent_data_0_ao),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_video_cc_mvs0_clk_src[] = {
+	F(1098000000, P_VIDEO_PLL0_OUT_MAIN, 1, 0, 0),
+	F(1332000000, P_VIDEO_PLL0_OUT_MAIN, 1, 0, 0),
+	F(1599000000, P_VIDEO_PLL0_OUT_MAIN, 1, 0, 0),
+	F(1680000000, P_VIDEO_PLL0_OUT_MAIN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 video_cc_mvs0_clk_src = {
+	.cmd_rcgr = 0x8000,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = video_cc_parent_map_1,
+	.freq_tbl = ftbl_video_cc_mvs0_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_mvs0_clk_src",
+		.parent_data = video_cc_parent_data_1,
+		.num_parents = ARRAY_SIZE(video_cc_parent_data_1),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_video_cc_mvs1_clk_src[] = {
+	F(1098000000, P_VIDEO_PLL1_OUT_MAIN, 1, 0, 0),
+	F(1332000000, P_VIDEO_PLL1_OUT_MAIN, 1, 0, 0),
+	F(1600000000, P_VIDEO_PLL1_OUT_MAIN, 1, 0, 0),
+	F(1800000000, P_VIDEO_PLL1_OUT_MAIN, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 video_cc_mvs1_clk_src = {
+	.cmd_rcgr = 0x8018,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = video_cc_parent_map_2,
+	.freq_tbl = ftbl_video_cc_mvs1_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_mvs1_clk_src",
+		.parent_data = video_cc_parent_data_2,
+		.num_parents = ARRAY_SIZE(video_cc_parent_data_2),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_video_cc_sleep_clk_src[] = {
+	F(32000, P_SLEEP_CLK, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 video_cc_sleep_clk_src = {
+	.cmd_rcgr = 0x812c,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = video_cc_parent_map_3,
+	.freq_tbl = ftbl_video_cc_sleep_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_sleep_clk_src",
+		.parent_data = video_cc_parent_data_3,
+		.num_parents = ARRAY_SIZE(video_cc_parent_data_3),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_rcg2 video_cc_xo_clk_src = {
+	.cmd_rcgr = 0x8110,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = video_cc_parent_map_0_ao,
+	.freq_tbl = ftbl_video_cc_ahb_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_xo_clk_src",
+		.parent_data = video_cc_parent_data_0_ao,
+		.num_parents = ARRAY_SIZE(video_cc_parent_data_0_ao),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static struct clk_regmap_div video_cc_mvs0_div_clk_src = {
+	.reg = 0x80b8,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_mvs0_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&video_cc_mvs0_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div video_cc_mvs0c_div2_div_clk_src = {
+	.reg = 0x806c,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_mvs0c_div2_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&video_cc_mvs0_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div video_cc_mvs1_div_clk_src = {
+	.reg = 0x80dc,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_mvs1_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&video_cc_mvs1_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div video_cc_mvs1c_div2_div_clk_src = {
+	.reg = 0x8094,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_mvs1c_div2_div_clk_src",
+		.parent_hws = (const struct clk_hw*[]) {
+			&video_cc_mvs1_clk_src.clkr.hw,
+		},
+		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_regmap_div video_cc_sm_div_clk_src = {
+	.reg = 0x8108,
+	.shift = 0,
+	.width = 4,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "video_cc_sm_div_clk_src",
+		.ops = &clk_regmap_div_ro_ops,
+	},
+};
+
+static struct clk_branch video_cc_mvs0_clk = {
+	.halt_reg = 0x80b0,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x80b0,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x80b0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_mvs0_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&video_cc_mvs0_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_mvs0c_clk = {
+	.halt_reg = 0x8064,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x8064,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_mvs0c_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&video_cc_mvs0c_div2_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_mvs1_clk = {
+	.halt_reg = 0x80d4,
+	.halt_check = BRANCH_HALT_VOTED,
+	.hwcg_reg = 0x80d4,
+	.hwcg_bit = 1,
+	.clkr = {
+		.enable_reg = 0x80d4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_mvs1_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&video_cc_mvs1_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_mvs1c_clk = {
+	.halt_reg = 0x808c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x808c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_mvs1c_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&video_cc_mvs1c_div2_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_pll_lock_monitor_clk = {
+	.halt_reg = 0x9000,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9000,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_pll_lock_monitor_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&video_cc_xo_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch video_cc_sm_obs_clk = {
+	.halt_reg = 0x810c,
+	.halt_check = BRANCH_HALT_SKIP,
+	.clkr = {
+		.enable_reg = 0x810c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "video_cc_sm_obs_clk",
+			.parent_hws = (const struct clk_hw*[]) {
+				&video_cc_sm_div_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc video_cc_mvs0c_gdsc = {
+	.gdscr = 0x804c,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x6,
+	.pd = {
+		.name = "video_cc_mvs0c_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
+};
+
+static struct gdsc video_cc_mvs0_gdsc = {
+	.gdscr = 0x809c,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x6,
+	.pd = {
+		.name = "video_cc_mvs0_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &video_cc_mvs0c_gdsc.pd,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
+};
+
+static struct gdsc video_cc_mvs1c_gdsc = {
+	.gdscr = 0x8074,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x6,
+	.pd = {
+		.name = "video_cc_mvs1c_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR,
+};
+
+static struct gdsc video_cc_mvs1_gdsc = {
+	.gdscr = 0x80c0,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x6,
+	.pd = {
+		.name = "video_cc_mvs1_gdsc",
+	},
+	.pwrsts = PWRSTS_OFF_ON,
+	.parent = &video_cc_mvs1c_gdsc.pd,
+	.flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR | HW_CTRL,
+};
+
+static struct clk_regmap *video_cc_sa8775p_clocks[] = {
+	[VIDEO_CC_AHB_CLK_SRC] = &video_cc_ahb_clk_src.clkr,
+	[VIDEO_CC_MVS0_CLK] = &video_cc_mvs0_clk.clkr,
+	[VIDEO_CC_MVS0_CLK_SRC] = &video_cc_mvs0_clk_src.clkr,
+	[VIDEO_CC_MVS0_DIV_CLK_SRC] = &video_cc_mvs0_div_clk_src.clkr,
+	[VIDEO_CC_MVS0C_CLK] = &video_cc_mvs0c_clk.clkr,
+	[VIDEO_CC_MVS0C_DIV2_DIV_CLK_SRC] = &video_cc_mvs0c_div2_div_clk_src.clkr,
+	[VIDEO_CC_MVS1_CLK] = &video_cc_mvs1_clk.clkr,
+	[VIDEO_CC_MVS1_CLK_SRC] = &video_cc_mvs1_clk_src.clkr,
+	[VIDEO_CC_MVS1_DIV_CLK_SRC] = &video_cc_mvs1_div_clk_src.clkr,
+	[VIDEO_CC_MVS1C_CLK] = &video_cc_mvs1c_clk.clkr,
+	[VIDEO_CC_MVS1C_DIV2_DIV_CLK_SRC] = &video_cc_mvs1c_div2_div_clk_src.clkr,
+	[VIDEO_CC_PLL_LOCK_MONITOR_CLK] = &video_cc_pll_lock_monitor_clk.clkr,
+	[VIDEO_CC_SLEEP_CLK_SRC] = &video_cc_sleep_clk_src.clkr,
+	[VIDEO_CC_SM_DIV_CLK_SRC] = &video_cc_sm_div_clk_src.clkr,
+	[VIDEO_CC_SM_OBS_CLK] = &video_cc_sm_obs_clk.clkr,
+	[VIDEO_CC_XO_CLK_SRC] = &video_cc_xo_clk_src.clkr,
+	[VIDEO_PLL0] = &video_pll0.clkr,
+	[VIDEO_PLL1] = &video_pll1.clkr,
+};
+
+static struct gdsc *video_cc_sa8775p_gdscs[] = {
+	[VIDEO_CC_MVS0_GDSC] = &video_cc_mvs0_gdsc,
+	[VIDEO_CC_MVS0C_GDSC] = &video_cc_mvs0c_gdsc,
+	[VIDEO_CC_MVS1_GDSC] = &video_cc_mvs1_gdsc,
+	[VIDEO_CC_MVS1C_GDSC] = &video_cc_mvs1c_gdsc,
+};
+
+static const struct qcom_reset_map video_cc_sa8775p_resets[] = {
+	[VIDEO_CC_INTERFACE_BCR] = { 0x80e8 },
+	[VIDEO_CC_MVS0_BCR] = { 0x8098 },
+	[VIDEO_CC_MVS0C_CLK_ARES] = { 0x8064, 2 },
+	[VIDEO_CC_MVS0C_BCR] = { 0x8048 },
+	[VIDEO_CC_MVS1_BCR] = { 0x80bc },
+	[VIDEO_CC_MVS1C_CLK_ARES] = { 0x808c, 2 },
+	[VIDEO_CC_MVS1C_BCR] = { 0x8070 },
+};
+
+static const struct regmap_config video_cc_sa8775p_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+	.max_register = 0xb000,
+	.fast_io = true,
+};
+
+static struct qcom_cc_desc video_cc_sa8775p_desc = {
+	.config = &video_cc_sa8775p_regmap_config,
+	.clks = video_cc_sa8775p_clocks,
+	.num_clks = ARRAY_SIZE(video_cc_sa8775p_clocks),
+	.resets = video_cc_sa8775p_resets,
+	.num_resets = ARRAY_SIZE(video_cc_sa8775p_resets),
+	.gdscs = video_cc_sa8775p_gdscs,
+	.num_gdscs = ARRAY_SIZE(video_cc_sa8775p_gdscs),
+};
+
+static const struct of_device_id video_cc_sa8775p_match_table[] = {
+	{ .compatible = "qcom,sa8775p-videocc" },
+	{ .compatible = "qcom,qcs8300-videocc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, video_cc_sa8775p_match_table);
+
+static int video_cc_sa8775p_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+	int ret;
+
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		return ret;
+
+	ret = pm_runtime_resume_and_get(&pdev->dev);
+	if (ret)
+		return ret;
+
+	regmap = qcom_cc_map(pdev, &video_cc_sa8775p_desc);
+	if (IS_ERR(regmap)) {
+		pm_runtime_put(&pdev->dev);
+		return PTR_ERR(regmap);
+	}
+
+	clk_lucid_evo_pll_configure(&video_pll0, regmap, &video_pll0_config);
+	clk_lucid_evo_pll_configure(&video_pll1, regmap, &video_pll1_config);
+
+	/* Set mvs0c clock divider to div-3 on qcs8300 to fix infrequent video hangs */
+	if (of_device_is_compatible(pdev->dev.of_node, "qcom,qcs8300-videocc"))
+		regmap_write(regmap, video_cc_mvs0c_div2_div_clk_src.reg, 2);
+
+	/* Keep some clocks always enabled */
+	qcom_branch_set_clk_en(regmap, 0x80ec); /* VIDEO_CC_AHB_CLK */
+	qcom_branch_set_clk_en(regmap, 0x8144); /* VIDEO_CC_SLEEP_CLK */
+	qcom_branch_set_clk_en(regmap, 0x8128); /* VIDEO_CC_XO_CLK */
+
+	ret = qcom_cc_really_probe(&pdev->dev, &video_cc_sa8775p_desc, regmap);
+
+	pm_runtime_put(&pdev->dev);
+
+	return ret;
+}
+
+static struct platform_driver video_cc_sa8775p_driver = {
+	.probe = video_cc_sa8775p_probe,
+	.driver = {
+		.name = "videocc-sa8775p",
+		.of_match_table = video_cc_sa8775p_match_table,
+	},
+};
+
+module_platform_driver(video_cc_sa8775p_driver);
+
+MODULE_DESCRIPTION("QTI VIDEOCC SA8775P Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sc7180.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sc7180.c
@@ -226,7 +226,7 @@
 	/* Keep VIDEO_CC_XO_CLK ALWAYS-ON */
 	regmap_update_bits(regmap, 0x984, 0x1, 0x1);
 
-	return qcom_cc_really_probe(pdev, &video_cc_sc7180_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &video_cc_sc7180_desc, regmap);
 }
 
 static struct platform_driver video_cc_sc7180_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sc7280.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sc7280.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/clk-provider.h>
@@ -232,6 +233,9 @@
 
 static struct gdsc mvs0_gdsc = {
 	.gdscr = 0x3004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x6,
 	.pd = {
 		.name = "mvs0_gdsc",
 	},
@@ -241,6 +245,9 @@
 
 static struct gdsc mvsc_gdsc = {
 	.gdscr = 0x2004,
+	.en_rest_wait_val = 0x2,
+	.en_few_wait_val = 0x2,
+	.clk_dis_wait_val = 0x6,
 	.pd = {
 		.name = "mvsc_gdsc",
 	},
@@ -298,7 +305,7 @@
 
 	clk_lucid_pll_configure(&video_pll0, regmap, &video_pll0_config);
 
-	return qcom_cc_really_probe(pdev, &video_cc_sc7280_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &video_cc_sc7280_desc, regmap);
 }
 
 static struct platform_driver video_cc_sc7280_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sdm845.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sdm845.c
@@ -329,7 +329,7 @@
 
 	clk_fabia_pll_configure(&video_pll0, regmap, &video_pll0_config);
 
-	return qcom_cc_really_probe(pdev, &video_cc_sdm845_desc, regmap);
+	return qcom_cc_really_probe(&pdev->dev, &video_cc_sdm845_desc, regmap);
 }
 
 static struct platform_driver video_cc_sdm845_driver = {
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sm7150.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sm7150.c
@@ -0,0 +1,357 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Danila Tikhonov <danila@jiaxyga.com>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#include <dt-bindings/clock/qcom,sm7150-videocc.h>
+
+#include "common.h"
+#include "clk-alpha-pll.h"
+#include "clk-branch.h"
+#include "clk-rcg.h"
+#include "clk-regmap.h"
+#include "clk-pll.h"
+#include "gdsc.h"
+
+enum {
+	DT_BI_TCXO,
+	DT_BI_TCXO_AO,
+};
+
+enum {
+	P_BI_TCXO,
+	P_VIDEOCC_PLL0_OUT_EVEN,
+	P_VIDEOCC_PLL0_OUT_MAIN,
+	P_VIDEOCC_PLL0_OUT_ODD,
+};
+
+static const struct pll_vco fabia_vco[] = {
+	{ 249600000, 2000000000, 0 },
+	{ 125000000, 1000000000, 1 },
+};
+
+static struct alpha_pll_config videocc_pll0_config = {
+	.l = 0x19,
+	.alpha = 0x0,
+	.config_ctl_val = 0x20485699,
+	.config_ctl_hi_val = 0x00002067,
+	.user_ctl_val = 0x00000001,
+	.user_ctl_hi_val = 0x00004805,
+	.test_ctl_hi_val = 0x40000000,
+};
+
+static struct clk_alpha_pll videocc_pll0 = {
+	.offset = 0x42c,
+	.vco_table = fabia_vco,
+	.num_vco = ARRAY_SIZE(fabia_vco),
+	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+	.clkr = {
+		.hw.init = &(const struct clk_init_data) {
+			.name = "videocc_pll0",
+			.parent_data = &(const struct clk_parent_data) {
+				.index = DT_BI_TCXO,
+			},
+			.num_parents = 1,
+			.ops = &clk_alpha_pll_fabia_ops,
+		},
+	},
+};
+
+static const struct parent_map videocc_parent_map_0[] = {
+	{ P_BI_TCXO, 0 },
+	{ P_VIDEOCC_PLL0_OUT_MAIN, 1 },
+	{ P_VIDEOCC_PLL0_OUT_EVEN, 2 },
+	{ P_VIDEOCC_PLL0_OUT_ODD, 3 },
+};
+
+static const struct clk_parent_data videocc_parent_data_0[] = {
+	{ .index = DT_BI_TCXO },
+	{ .hw = &videocc_pll0.clkr.hw },
+	{ .hw = &videocc_pll0.clkr.hw },
+	{ .hw = &videocc_pll0.clkr.hw },
+};
+
+static const struct parent_map videocc_parent_map_1[] = {
+	{ P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data videocc_parent_data_1[] = {
+	{ .index = DT_BI_TCXO_AO },
+};
+
+static const struct freq_tbl ftbl_videocc_iris_clk_src[] = {
+	F(240000000, P_VIDEOCC_PLL0_OUT_MAIN, 2, 0, 0),
+	F(338000000, P_VIDEOCC_PLL0_OUT_MAIN, 2, 0, 0),
+	F(365000000, P_VIDEOCC_PLL0_OUT_MAIN, 2, 0, 0),
+	F(444000000, P_VIDEOCC_PLL0_OUT_MAIN, 2, 0, 0),
+	F(533000000, P_VIDEOCC_PLL0_OUT_MAIN, 2, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 videocc_iris_clk_src = {
+	.cmd_rcgr = 0x7f0,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = videocc_parent_map_0,
+	.freq_tbl = ftbl_videocc_iris_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "videocc_iris_clk_src",
+		.parent_data = videocc_parent_data_0,
+		.num_parents = ARRAY_SIZE(videocc_parent_data_0),
+		.flags = CLK_SET_RATE_PARENT,
+		.ops = &clk_rcg2_shared_ops,
+	},
+};
+
+static const struct freq_tbl ftbl_videocc_xo_clk_src[] = {
+	F(19200000, P_BI_TCXO, 1, 0, 0),
+	{ }
+};
+
+static struct clk_rcg2 videocc_xo_clk_src = {
+	.cmd_rcgr = 0xa98,
+	.mnd_width = 0,
+	.hid_width = 5,
+	.parent_map = videocc_parent_map_1,
+	.freq_tbl = ftbl_videocc_xo_clk_src,
+	.clkr.hw.init = &(const struct clk_init_data) {
+		.name = "videocc_xo_clk_src",
+		.parent_data = videocc_parent_data_1,
+		.num_parents = ARRAY_SIZE(videocc_parent_data_1),
+		.ops = &clk_rcg2_ops,
+	},
+};
+
+static struct clk_branch videocc_iris_ahb_clk = {
+	.halt_reg = 0x8f4,
+	.halt_check = BRANCH_VOTED,
+	.clkr = {
+		.enable_reg = 0x8f4,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "videocc_iris_ahb_clk",
+			.parent_data = &(const struct clk_parent_data) {
+				.hw = &videocc_iris_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch videocc_mvs0_axi_clk = {
+	.halt_reg = 0x9ec,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9ec,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "videocc_mvs0_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch videocc_mvs0_core_clk = {
+	.halt_reg = 0x890,
+	.halt_check = BRANCH_VOTED,
+	.clkr = {
+		.enable_reg = 0x890,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "videocc_mvs0_core_clk",
+			.parent_data = &(const struct clk_parent_data) {
+				.hw = &videocc_iris_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch videocc_mvs1_axi_clk = {
+	.halt_reg = 0xa0c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa0c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "videocc_mvs1_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch videocc_mvs1_core_clk = {
+	.halt_reg = 0x8d0,
+	.halt_check = BRANCH_VOTED,
+	.clkr = {
+		.enable_reg = 0x8d0,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "videocc_mvs1_core_clk",
+			.parent_data = &(const struct clk_parent_data) {
+				.hw = &videocc_iris_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch videocc_mvsc_core_clk = {
+	.halt_reg = 0x850,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x850,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "videocc_mvsc_core_clk",
+			.parent_data = &(const struct clk_parent_data) {
+				.hw = &videocc_iris_clk_src.clkr.hw,
+			},
+			.num_parents = 1,
+			.flags = CLK_SET_RATE_PARENT,
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch videocc_mvsc_ctl_axi_clk = {
+	.halt_reg = 0x9cc,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0x9cc,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "videocc_mvsc_ctl_axi_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct clk_branch videocc_venus_ahb_clk = {
+	.halt_reg = 0xa6c,
+	.halt_check = BRANCH_HALT,
+	.clkr = {
+		.enable_reg = 0xa6c,
+		.enable_mask = BIT(0),
+		.hw.init = &(const struct clk_init_data) {
+			.name = "videocc_venus_ahb_clk",
+			.ops = &clk_branch2_ops,
+		},
+	},
+};
+
+static struct gdsc venus_gdsc = {
+	.gdscr = 0x814,
+	.pd = {
+		.name = "venus_gdsc",
+	},
+	.cxcs = (unsigned int []){ 0x850, 0x9cc },
+	.cxc_count = 2,
+	.pwrsts = PWRSTS_OFF_ON,
+	.flags = POLL_CFG_GDSCR,
+};
+
+static struct gdsc vcodec0_gdsc = {
+	.gdscr = 0x874,
+	.pd = {
+		.name = "vcodec0_gdsc",
+	},
+	.cxcs = (unsigned int []){ 0x890, 0x9ec },
+	.cxc_count = 2,
+	.flags = HW_CTRL | POLL_CFG_GDSCR,
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct gdsc vcodec1_gdsc = {
+	.gdscr = 0x8b4,
+	.pd = {
+		.name = "vcodec1_gdsc",
+	},
+	.cxcs = (unsigned int []){ 0x8d0, 0xa0c },
+	.cxc_count = 2,
+	.flags = HW_CTRL | POLL_CFG_GDSCR,
+	.pwrsts = PWRSTS_OFF_ON,
+};
+
+static struct clk_regmap *videocc_sm7150_clocks[] = {
+	[VIDEOCC_PLL0] = &videocc_pll0.clkr,
+	[VIDEOCC_IRIS_AHB_CLK] = &videocc_iris_ahb_clk.clkr,
+	[VIDEOCC_IRIS_CLK_SRC] = &videocc_iris_clk_src.clkr,
+	[VIDEOCC_MVS0_AXI_CLK] = &videocc_mvs0_axi_clk.clkr,
+	[VIDEOCC_MVS0_CORE_CLK] = &videocc_mvs0_core_clk.clkr,
+	[VIDEOCC_MVS1_AXI_CLK] = &videocc_mvs1_axi_clk.clkr,
+	[VIDEOCC_MVS1_CORE_CLK] = &videocc_mvs1_core_clk.clkr,
+	[VIDEOCC_MVSC_CORE_CLK] = &videocc_mvsc_core_clk.clkr,
+	[VIDEOCC_MVSC_CTL_AXI_CLK] = &videocc_mvsc_ctl_axi_clk.clkr,
+	[VIDEOCC_VENUS_AHB_CLK] = &videocc_venus_ahb_clk.clkr,
+	[VIDEOCC_XO_CLK_SRC] = &videocc_xo_clk_src.clkr,
+};
+
+static struct gdsc *videocc_sm7150_gdscs[] = {
+	[VENUS_GDSC] = &venus_gdsc,
+	[VCODEC0_GDSC] = &vcodec0_gdsc,
+	[VCODEC1_GDSC] = &vcodec1_gdsc,
+};
+
+static const struct regmap_config videocc_sm7150_regmap_config = {
+	.reg_bits	= 32,
+	.reg_stride	= 4,
+	.val_bits	= 32,
+	.max_register	= 0xb94,
+	.fast_io	= true,
+};
+
+static const struct qcom_cc_desc videocc_sm7150_desc = {
+	.config = &videocc_sm7150_regmap_config,
+	.clks = videocc_sm7150_clocks,
+	.num_clks = ARRAY_SIZE(videocc_sm7150_clocks),
+	.gdscs = videocc_sm7150_gdscs,
+	.num_gdscs = ARRAY_SIZE(videocc_sm7150_gdscs),
+};
+
+static const struct of_device_id videocc_sm7150_match_table[] = {
+	{ .compatible = "qcom,sm7150-videocc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, videocc_sm7150_match_table);
+
+static int videocc_sm7150_probe(struct platform_device *pdev)
+{
+	struct regmap *regmap;
+
+	regmap = qcom_cc_map(pdev, &videocc_sm7150_desc);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	clk_fabia_pll_configure(&videocc_pll0, regmap, &videocc_pll0_config);
+
+	/* Keep some clocks always-on */
+	qcom_branch_set_clk_en(regmap, 0x984); /* VIDEOCC_XO_CLK */
+
+	return qcom_cc_really_probe(&pdev->dev, &videocc_sm7150_desc, regmap);
+}
+
+static struct platform_driver videocc_sm7150_driver = {
+	.probe = videocc_sm7150_probe,
+	.driver = {
+		.name = "videocc-sm7150",
+		.of_match_table = videocc_sm7150_match_table,
+	},
+};
+module_platform_driver(videocc_sm7150_driver);
+
+MODULE_DESCRIPTION("Qualcomm SM7150 Video Clock Controller");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sm8150.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sm8150.c
@@ -262,7 +262,7 @@
 	/* Keep VIDEO_CC_XO_CLK ALWAYS-ON */
 	regmap_update_bits(regmap, 0x984, 0x1, 0x1);
 
-	ret = qcom_cc_really_probe(pdev, &video_cc_sm8150_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &video_cc_sm8150_desc, regmap);
 
 	pm_runtime_put_sync(&pdev->dev);
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sm8250.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sm8250.c
@@ -387,7 +387,7 @@
 	regmap_update_bits(regmap, 0xe58, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0xeec, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &video_cc_sm8250_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &video_cc_sm8250_desc, regmap);
 
 	pm_runtime_put(&pdev->dev);
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sm8350.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sm8350.c
@@ -566,7 +566,7 @@
 	regmap_update_bits(regmap, 0xe58, BIT(0), BIT(0));
 	regmap_update_bits(regmap, video_cc_xo_clk_cbcr, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &video_cc_sm8350_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &video_cc_sm8350_desc, regmap);
 	pm_runtime_put(&pdev->dev);
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sm8450.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sm8450.c
@@ -433,7 +433,7 @@
 	regmap_update_bits(regmap, 0x8130, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x8114, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &video_cc_sm8450_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &video_cc_sm8450_desc, regmap);
 
 	pm_runtime_put(&pdev->dev);
 
--- linux-qcom-6.8.0.orig/drivers/clk/qcom/videocc-sm8550.c
+++ linux-qcom-6.8.0/drivers/clk/qcom/videocc-sm8550.c
@@ -438,7 +438,7 @@
 	regmap_update_bits(regmap, 0x8140, BIT(0), BIT(0));
 	regmap_update_bits(regmap, 0x8124, BIT(0), BIT(0));
 
-	ret = qcom_cc_really_probe(pdev, &video_cc_sm8550_desc, regmap);
+	ret = qcom_cc_really_probe(&pdev->dev, &video_cc_sm8550_desc, regmap);
 
 	pm_runtime_put(&pdev->dev);
 
--- linux-qcom-6.8.0.orig/drivers/clk/ralink/clk-mtmips.c
+++ linux-qcom-6.8.0/drivers/clk/ralink/clk-mtmips.c
@@ -263,8 +263,8 @@
 		.rate = _rate		 \
 	}
 
-static struct mtmips_clk_fixed rt305x_fixed_clocks[] = {
-	CLK_FIXED("xtal", NULL, 40000000)
+static struct mtmips_clk_fixed rt3883_fixed_clocks[] = {
+	CLK_FIXED("periph", "xtal", 40000000)
 };
 
 static struct mtmips_clk_fixed rt3352_fixed_clocks[] = {
@@ -366,6 +366,12 @@
 	return container_of(hw, struct mtmips_clk, hw);
 }
 
+static unsigned long rt2880_xtal_recalc_rate(struct clk_hw *hw,
+					     unsigned long parent_rate)
+{
+	return 40000000;
+}
+
 static unsigned long rt5350_xtal_recalc_rate(struct clk_hw *hw,
 					     unsigned long parent_rate)
 {
@@ -677,10 +683,12 @@
 }
 
 static struct mtmips_clk rt2880_clks_base[] = {
+	{ CLK_BASE("xtal", NULL, rt2880_xtal_recalc_rate) },
 	{ CLK_BASE("cpu", "xtal", rt2880_cpu_recalc_rate) }
 };
 
 static struct mtmips_clk rt305x_clks_base[] = {
+	{ CLK_BASE("xtal", NULL, rt2880_xtal_recalc_rate) },
 	{ CLK_BASE("cpu", "xtal", rt305x_cpu_recalc_rate) }
 };
 
@@ -690,6 +698,7 @@
 };
 
 static struct mtmips_clk rt3883_clks_base[] = {
+	{ CLK_BASE("xtal", NULL, rt2880_xtal_recalc_rate) },
 	{ CLK_BASE("cpu", "xtal", rt3883_cpu_recalc_rate) },
 	{ CLK_BASE("bus", "cpu", rt3883_bus_recalc_rate) }
 };
@@ -746,8 +755,8 @@
 static const struct mtmips_clk_data rt2880_clk_data = {
 	.clk_base = rt2880_clks_base,
 	.num_clk_base = ARRAY_SIZE(rt2880_clks_base),
-	.clk_fixed = rt305x_fixed_clocks,
-	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
+	.clk_fixed = NULL,
+	.num_clk_fixed = 0,
 	.clk_factor = rt2880_factor_clocks,
 	.num_clk_factor = ARRAY_SIZE(rt2880_factor_clocks),
 	.clk_periph = rt2880_pherip_clks,
@@ -757,8 +766,8 @@
 static const struct mtmips_clk_data rt305x_clk_data = {
 	.clk_base = rt305x_clks_base,
 	.num_clk_base = ARRAY_SIZE(rt305x_clks_base),
-	.clk_fixed = rt305x_fixed_clocks,
-	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
+	.clk_fixed = NULL,
+	.num_clk_fixed = 0,
 	.clk_factor = rt305x_factor_clocks,
 	.num_clk_factor = ARRAY_SIZE(rt305x_factor_clocks),
 	.clk_periph = rt305x_pherip_clks,
@@ -779,8 +788,8 @@
 static const struct mtmips_clk_data rt3883_clk_data = {
 	.clk_base = rt3883_clks_base,
 	.num_clk_base = ARRAY_SIZE(rt3883_clks_base),
-	.clk_fixed = rt305x_fixed_clocks,
-	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
+	.clk_fixed = rt3883_fixed_clocks,
+	.num_clk_fixed = ARRAY_SIZE(rt3883_fixed_clocks),
 	.clk_factor = NULL,
 	.num_clk_factor = 0,
 	.clk_periph = rt5350_pherip_clks,
--- linux-qcom-6.8.0.orig/drivers/clk/renesas/r8a779a0-cpg-mssr.c
+++ linux-qcom-6.8.0/drivers/clk/renesas/r8a779a0-cpg-mssr.c
@@ -139,7 +139,7 @@
 	DEF_MOD("avb3",		214,	R8A779A0_CLK_S3D2),
 	DEF_MOD("avb4",		215,	R8A779A0_CLK_S3D2),
 	DEF_MOD("avb5",		216,	R8A779A0_CLK_S3D2),
-	DEF_MOD("canfd0",	328,	R8A779A0_CLK_CANFD),
+	DEF_MOD("canfd0",	328,	R8A779A0_CLK_S3D2),
 	DEF_MOD("csi40",	331,	R8A779A0_CLK_CSI0),
 	DEF_MOD("csi41",	400,	R8A779A0_CLK_CSI0),
 	DEF_MOD("csi42",	401,	R8A779A0_CLK_CSI0),
--- linux-qcom-6.8.0.orig/drivers/clk/renesas/r8a779f0-cpg-mssr.c
+++ linux-qcom-6.8.0/drivers/clk/renesas/r8a779f0-cpg-mssr.c
@@ -161,7 +161,7 @@
 	DEF_MOD("cmt1",		911,	R8A779F0_CLK_R),
 	DEF_MOD("cmt2",		912,	R8A779F0_CLK_R),
 	DEF_MOD("cmt3",		913,	R8A779F0_CLK_R),
-	DEF_MOD("pfc0",		915,	R8A779F0_CLK_CL16M),
+	DEF_MOD("pfc0",		915,	R8A779F0_CLK_CPEX),
 	DEF_MOD("tsc",		919,	R8A779F0_CLK_CL16M),
 	DEF_MOD("rswitch2",	1505,	R8A779F0_CLK_RSW2),
 	DEF_MOD("ether-serdes",	1506,	R8A779F0_CLK_S0D2_HSC),
--- linux-qcom-6.8.0.orig/drivers/clk/renesas/r8a779g0-cpg-mssr.c
+++ linux-qcom-6.8.0/drivers/clk/renesas/r8a779g0-cpg-mssr.c
@@ -22,7 +22,7 @@
 
 enum clk_ids {
 	/* Core Clock Outputs exported to DT */
-	LAST_DT_CORE_CLK = R8A779G0_CLK_R,
+	LAST_DT_CORE_CLK = R8A779G0_CLK_CP,
 
 	/* External Input Clocks */
 	CLK_EXTAL,
@@ -141,6 +141,7 @@
 	DEF_FIXED("svd2_vip",	R8A779G0_CLK_SVD2_VIP,	CLK_SV_VIP,	2, 1),
 	DEF_FIXED("cbfusa",	R8A779G0_CLK_CBFUSA,	CLK_EXTAL,	2, 1),
 	DEF_FIXED("cpex",	R8A779G0_CLK_CPEX,	CLK_EXTAL,	2, 1),
+	DEF_FIXED("cp",		R8A779G0_CLK_CP,	CLK_EXTAL,	2, 1),
 	DEF_FIXED("viobus",	R8A779G0_CLK_VIOBUS,	CLK_VIO,	1, 1),
 	DEF_FIXED("viobusd2",	R8A779G0_CLK_VIOBUSD2,	CLK_VIO,	2, 1),
 	DEF_FIXED("vcbus",	R8A779G0_CLK_VCBUS,	CLK_VC,		1, 1),
@@ -193,7 +194,7 @@
 	DEF_MOD("msi4",		622,	R8A779G0_CLK_MSO),
 	DEF_MOD("msi5",		623,	R8A779G0_CLK_MSO),
 	DEF_MOD("pciec0",	624,	R8A779G0_CLK_S0D2_HSC),
-	DEF_MOD("pscie1",	625,	R8A779G0_CLK_S0D2_HSC),
+	DEF_MOD("pciec1",	625,	R8A779G0_CLK_S0D2_HSC),
 	DEF_MOD("pwm",		628,	R8A779G0_CLK_SASYNCPERD4),
 	DEF_MOD("rpc-if",	629,	R8A779G0_CLK_RPCD2),
 	DEF_MOD("scif0",	702,	R8A779G0_CLK_SASYNCPERD4),
@@ -232,10 +233,10 @@
 	DEF_MOD("cmt1",		911,	R8A779G0_CLK_R),
 	DEF_MOD("cmt2",		912,	R8A779G0_CLK_R),
 	DEF_MOD("cmt3",		913,	R8A779G0_CLK_R),
-	DEF_MOD("pfc0",		915,	R8A779G0_CLK_CL16M),
-	DEF_MOD("pfc1",		916,	R8A779G0_CLK_CL16M),
-	DEF_MOD("pfc2",		917,	R8A779G0_CLK_CL16M),
-	DEF_MOD("pfc3",		918,	R8A779G0_CLK_CL16M),
+	DEF_MOD("pfc0",		915,	R8A779G0_CLK_CP),
+	DEF_MOD("pfc1",		916,	R8A779G0_CLK_CP),
+	DEF_MOD("pfc2",		917,	R8A779G0_CLK_CP),
+	DEF_MOD("pfc3",		918,	R8A779G0_CLK_CP),
 	DEF_MOD("tsc",		919,	R8A779G0_CLK_CL16M),
 	DEF_MOD("tsn",		2723,	R8A779G0_CLK_S0D4_HSC),
 	DEF_MOD("ssiu",		2926,	R8A779G0_CLK_S0D6_PER),
--- linux-qcom-6.8.0.orig/drivers/clk/renesas/r9a07g043-cpg.c
+++ linux-qcom-6.8.0/drivers/clk/renesas/r9a07g043-cpg.c
@@ -138,7 +138,7 @@
 	DEF_FIXED("SPI1", R9A07G043_CLK_SPI1, CLK_DIV_PLL3_C, 1, 4),
 	DEF_SD_MUX("SD0", R9A07G043_CLK_SD0, SEL_SDHI0, SEL_SDHI0_STS, sel_shdi,
 		   mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier),
-	DEF_SD_MUX("SD1", R9A07G043_CLK_SD1, SEL_SDHI1, SEL_SDHI0_STS, sel_shdi,
+	DEF_SD_MUX("SD1", R9A07G043_CLK_SD1, SEL_SDHI1, SEL_SDHI1_STS, sel_shdi,
 		   mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier),
 	DEF_FIXED("SD0_DIV4", CLK_SD0_DIV4, R9A07G043_CLK_SD0, 1, 4),
 	DEF_FIXED("SD1_DIV4", CLK_SD1_DIV4, R9A07G043_CLK_SD1, 1, 4),
@@ -265,6 +265,10 @@
 				0x5a8, 1),
 	DEF_MOD("tsu_pclk",	R9A07G043_TSU_PCLK, R9A07G043_CLK_TSU,
 				0x5ac, 0),
+#ifdef CONFIG_RISCV
+	DEF_MOD("nceplic_aclk",	R9A07G043_NCEPLIC_ACLK, R9A07G043_CLK_P1,
+				0x608, 0),
+#endif
 };
 
 static struct rzg2l_reset r9a07g043_resets[] = {
@@ -318,6 +322,10 @@
 	DEF_RST(R9A07G043_ADC_PRESETN, 0x8a8, 0),
 	DEF_RST(R9A07G043_ADC_ADRST_N, 0x8a8, 1),
 	DEF_RST(R9A07G043_TSU_PRESETN, 0x8ac, 0),
+#ifdef CONFIG_RISCV
+	DEF_RST(R9A07G043_NCEPLIC_ARESETN, 0x908, 0),
+#endif
+
 };
 
 static const unsigned int r9a07g043_crit_mod_clks[] __initconst = {
@@ -327,6 +335,7 @@
 #endif
 #ifdef CONFIG_RISCV
 	MOD_CLK_BASE + R9A07G043_IAX45_CLK,
+	MOD_CLK_BASE + R9A07G043_NCEPLIC_ACLK,
 #endif
 	MOD_CLK_BASE + R9A07G043_DMAC_ACLK,
 };
--- linux-qcom-6.8.0.orig/drivers/clk/renesas/r9a07g044-cpg.c
+++ linux-qcom-6.8.0/drivers/clk/renesas/r9a07g044-cpg.c
@@ -178,7 +178,7 @@
 		DEF_FIXED("SPI1", R9A07G044_CLK_SPI1, CLK_DIV_PLL3_C, 1, 4),
 		DEF_SD_MUX("SD0", R9A07G044_CLK_SD0, SEL_SDHI0, SEL_SDHI0_STS, sel_shdi,
 			   mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier),
-		DEF_SD_MUX("SD1", R9A07G044_CLK_SD1, SEL_SDHI1, SEL_SDHI0_STS, sel_shdi,
+		DEF_SD_MUX("SD1", R9A07G044_CLK_SD1, SEL_SDHI1, SEL_SDHI1_STS, sel_shdi,
 			   mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier),
 		DEF_FIXED("SD0_DIV4", CLK_SD0_DIV4, R9A07G044_CLK_SD0, 1, 4),
 		DEF_FIXED("SD1_DIV4", CLK_SD1_DIV4, R9A07G044_CLK_SD1, 1, 4),
--- linux-qcom-6.8.0.orig/drivers/clk/renesas/rzg2l-cpg.c
+++ linux-qcom-6.8.0/drivers/clk/renesas/rzg2l-cpg.c
@@ -555,7 +555,7 @@
 rzg2l_cpg_get_foutpostdiv_rate(struct rzg2l_pll5_param *params,
 			       unsigned long rate)
 {
-	unsigned long foutpostdiv_rate;
+	unsigned long foutpostdiv_rate, foutvco_rate;
 
 	params->pl5_intin = rate / MEGA;
 	params->pl5_fracin = div_u64(((u64)rate % MEGA) << 24, MEGA);
@@ -564,10 +564,11 @@
 	params->pl5_postdiv2 = 1;
 	params->pl5_spread = 0x16;
 
-	foutpostdiv_rate =
-		EXTAL_FREQ_IN_MEGA_HZ * MEGA / params->pl5_refdiv *
-		((((params->pl5_intin << 24) + params->pl5_fracin)) >> 24) /
-		(params->pl5_postdiv1 * params->pl5_postdiv2);
+	foutvco_rate = div_u64(mul_u32_u32(EXTAL_FREQ_IN_MEGA_HZ * MEGA,
+					   (params->pl5_intin << 24) + params->pl5_fracin),
+			       params->pl5_refdiv) >> 24;
+	foutpostdiv_rate = DIV_ROUND_CLOSEST_ULL(foutvco_rate,
+						 params->pl5_postdiv1 * params->pl5_postdiv2);
 
 	return foutpostdiv_rate;
 }
--- linux-qcom-6.8.0.orig/drivers/clk/rockchip/clk-rk3228.c
+++ linux-qcom-6.8.0/drivers/clk/rockchip/clk-rk3228.c
@@ -409,7 +409,7 @@
 			RK2928_CLKSEL_CON(29), 0, 3, DFLAGS),
 	DIV(0, "sclk_vop_pre", "sclk_vop_src", 0,
 			RK2928_CLKSEL_CON(27), 8, 8, DFLAGS),
-	MUX(DCLK_VOP, "dclk_vop", mux_dclk_vop_p, 0,
+	MUX(DCLK_VOP, "dclk_vop", mux_dclk_vop_p, CLK_SET_RATE_PARENT | CLK_SET_RATE_NO_REPARENT,
 			RK2928_CLKSEL_CON(27), 1, 1, MFLAGS),
 
 	FACTOR(0, "xin12m", "xin24m", 0, 1, 2),
--- linux-qcom-6.8.0.orig/drivers/clk/rockchip/clk-rk3588.c
+++ linux-qcom-6.8.0/drivers/clk/rockchip/clk-rk3588.c
@@ -526,7 +526,7 @@
 PNAME(pmu_300m_24m_p)			= { "clk_300m_src", "xin24m" };
 PNAME(pmu_400m_24m_p)			= { "clk_400m_src", "xin24m" };
 PNAME(pmu_100m_50m_24m_src_p)		= { "clk_pmu1_100m_src", "clk_pmu1_50m_src", "xin24m" };
-PNAME(pmu_24m_32k_100m_src_p)		= { "xin24m", "32k", "clk_pmu1_100m_src" };
+PNAME(pmu_24m_32k_100m_src_p)		= { "xin24m", "xin32k", "clk_pmu1_100m_src" };
 PNAME(hclk_pmu1_root_p)			= { "clk_pmu1_200m_src", "clk_pmu1_100m_src", "clk_pmu1_50m_src", "xin24m" };
 PNAME(hclk_pmu_cm0_root_p)		= { "clk_pmu1_400m_src", "clk_pmu1_200m_src", "clk_pmu1_100m_src", "xin24m" };
 PNAME(mclk_pdm0_p)			= { "clk_pmu1_300m_src", "clk_pmu1_200m_src" };
--- linux-qcom-6.8.0.orig/drivers/clk/rockchip/clk.c
+++ linux-qcom-6.8.0/drivers/clk/rockchip/clk.c
@@ -433,12 +433,13 @@
 				    struct rockchip_clk_branch *list,
 				    unsigned int nr_clk)
 {
-	struct clk *clk = NULL;
+	struct clk *clk;
 	unsigned int idx;
 	unsigned long flags;
 
 	for (idx = 0; idx < nr_clk; idx++, list++) {
 		flags = list->flags;
+		clk = NULL;
 
 		/* catch simple muxes */
 		switch (list->branch_type) {
--- linux-qcom-6.8.0.orig/drivers/clk/samsung/clk-exynos-clkout.c
+++ linux-qcom-6.8.0/drivers/clk/samsung/clk-exynos-clkout.c
@@ -13,9 +13,9 @@
 #include <linux/io.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm.h>
-#include <linux/property.h>
 
 #define EXYNOS_CLKOUT_NR_CLKS		1
 #define EXYNOS_CLKOUT_PARENTS		32
@@ -84,17 +84,24 @@
 static int exynos_clkout_match_parent_dev(struct device *dev, u32 *mux_mask)
 {
 	const struct exynos_clkout_variant *variant;
+	const struct of_device_id *match;
 
 	if (!dev->parent) {
 		dev_err(dev, "not instantiated from MFD\n");
 		return -EINVAL;
 	}
 
-	variant = device_get_match_data(dev->parent);
-	if (!variant) {
+	/*
+	 * 'exynos_clkout_ids' arrays is not the ids array matched by
+	 * the dev->parent driver, so of_device_get_match_data() or
+	 * device_get_match_data() cannot be used here.
+	 */
+	match = of_match_device(exynos_clkout_ids, dev->parent);
+	if (!match) {
 		dev_err(dev, "cannot match parent device\n");
 		return -EINVAL;
 	}
+	variant = match->data;
 
 	*mux_mask = variant->mux_mask;
 
--- linux-qcom-6.8.0.orig/drivers/clk/samsung/clk-exynos4.c
+++ linux-qcom-6.8.0/drivers/clk/samsung/clk-exynos4.c
@@ -1040,19 +1040,20 @@
 static void __init exynos4_clk_register_finpll(struct samsung_clk_provider *ctx)
 {
 	struct samsung_fixed_rate_clock fclk;
-	struct clk *clk;
-	unsigned long finpll_f = 24000000;
+	unsigned long finpll_f;
+	unsigned int parent;
 	char *parent_name;
 	unsigned int xom = exynos4_get_xom();
 
 	parent_name = xom & 1 ? "xusbxti" : "xxti";
-	clk = clk_get(NULL, parent_name);
-	if (IS_ERR(clk)) {
+	parent = xom & 1 ? CLK_XUSBXTI : CLK_XXTI;
+
+	finpll_f = clk_hw_get_rate(ctx->clk_data.hws[parent]);
+	if (!finpll_f) {
 		pr_err("%s: failed to lookup parent clock %s, assuming "
 			"fin_pll clock frequency is 24MHz\n", __func__,
 			parent_name);
-	} else {
-		finpll_f = clk_get_rate(clk);
+		finpll_f = 24000000;
 	}
 
 	fclk.id = CLK_FIN_PLL;
--- linux-qcom-6.8.0.orig/drivers/clk/samsung/clk-exynos7885.c
+++ linux-qcom-6.8.0/drivers/clk/samsung/clk-exynos7885.c
@@ -20,7 +20,7 @@
 #define CLKS_NR_TOP			(CLK_GOUT_FSYS_USB30DRD + 1)
 #define CLKS_NR_CORE			(CLK_GOUT_TREX_P_CORE_PCLK_P_CORE + 1)
 #define CLKS_NR_PERI			(CLK_GOUT_WDT1_PCLK + 1)
-#define CLKS_NR_FSYS			(CLK_GOUT_MMC_SDIO_SDCLKIN + 1)
+#define CLKS_NR_FSYS			(CLK_MOUT_FSYS_USB30DRD_USER + 1)
 
 /* ---- CMU_TOP ------------------------------------------------------------- */
 
--- linux-qcom-6.8.0.orig/drivers/clk/samsung/clk-exynos850.c
+++ linux-qcom-6.8.0/drivers/clk/samsung/clk-exynos850.c
@@ -605,7 +605,7 @@
 
 static const struct samsung_gate_clock apm_gate_clks[] __initconst = {
 	GATE(CLK_GOUT_CLKCMU_CMGP_BUS, "gout_clkcmu_cmgp_bus", "dout_apm_bus",
-	     CLK_CON_GAT_CLKCMU_CMGP_BUS, 21, 0, 0),
+	     CLK_CON_GAT_CLKCMU_CMGP_BUS, 21, CLK_SET_RATE_PARENT, 0),
 	GATE(CLK_GOUT_CLKCMU_CHUB_BUS, "gout_clkcmu_chub_bus",
 	     "mout_clkcmu_chub_bus",
 	     CLK_CON_GAT_GATE_CLKCMU_CHUB_BUS, 21, 0, 0),
@@ -974,19 +974,19 @@
 static const struct samsung_mux_clock cmgp_mux_clks[] __initconst = {
 	MUX(CLK_MOUT_CMGP_ADC, "mout_cmgp_adc", mout_cmgp_adc_p,
 	    CLK_CON_MUX_CLK_CMGP_ADC, 0, 1),
-	MUX(CLK_MOUT_CMGP_USI0, "mout_cmgp_usi0", mout_cmgp_usi0_p,
-	    CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP0, 0, 1),
-	MUX(CLK_MOUT_CMGP_USI1, "mout_cmgp_usi1", mout_cmgp_usi1_p,
-	    CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP1, 0, 1),
+	MUX_F(CLK_MOUT_CMGP_USI0, "mout_cmgp_usi0", mout_cmgp_usi0_p,
+	      CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP0, 0, 1, CLK_SET_RATE_PARENT, 0),
+	MUX_F(CLK_MOUT_CMGP_USI1, "mout_cmgp_usi1", mout_cmgp_usi1_p,
+	      CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP1, 0, 1, CLK_SET_RATE_PARENT, 0),
 };
 
 static const struct samsung_div_clock cmgp_div_clks[] __initconst = {
 	DIV(CLK_DOUT_CMGP_ADC, "dout_cmgp_adc", "gout_clkcmu_cmgp_bus",
 	    CLK_CON_DIV_DIV_CLK_CMGP_ADC, 0, 4),
-	DIV(CLK_DOUT_CMGP_USI0, "dout_cmgp_usi0", "mout_cmgp_usi0",
-	    CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP0, 0, 5),
-	DIV(CLK_DOUT_CMGP_USI1, "dout_cmgp_usi1", "mout_cmgp_usi1",
-	    CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP1, 0, 5),
+	DIV_F(CLK_DOUT_CMGP_USI0, "dout_cmgp_usi0", "mout_cmgp_usi0",
+	      CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP0, 0, 5, CLK_SET_RATE_PARENT, 0),
+	DIV_F(CLK_DOUT_CMGP_USI1, "dout_cmgp_usi1", "mout_cmgp_usi1",
+	      CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP1, 0, 5, CLK_SET_RATE_PARENT, 0),
 };
 
 static const struct samsung_gate_clock cmgp_gate_clks[] __initconst = {
@@ -1001,12 +1001,12 @@
 	     "gout_clkcmu_cmgp_bus",
 	     CLK_CON_GAT_GOUT_CMGP_GPIO_PCLK, 21, CLK_IGNORE_UNUSED, 0),
 	GATE(CLK_GOUT_CMGP_USI0_IPCLK, "gout_cmgp_usi0_ipclk", "dout_cmgp_usi0",
-	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP0_IPCLK, 21, 0, 0),
+	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP0_IPCLK, 21, CLK_SET_RATE_PARENT, 0),
 	GATE(CLK_GOUT_CMGP_USI0_PCLK, "gout_cmgp_usi0_pclk",
 	     "gout_clkcmu_cmgp_bus",
 	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP0_PCLK, 21, 0, 0),
 	GATE(CLK_GOUT_CMGP_USI1_IPCLK, "gout_cmgp_usi1_ipclk", "dout_cmgp_usi1",
-	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP1_IPCLK, 21, 0, 0),
+	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP1_IPCLK, 21, CLK_SET_RATE_PARENT, 0),
 	GATE(CLK_GOUT_CMGP_USI1_PCLK, "gout_cmgp_usi1_pclk",
 	     "gout_clkcmu_cmgp_bus",
 	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP1_PCLK, 21, 0, 0),
@@ -1557,8 +1557,9 @@
 	    mout_peri_uart_user_p, PLL_CON0_MUX_CLKCMU_PERI_UART_USER, 4, 1),
 	MUX(CLK_MOUT_PERI_HSI2C_USER, "mout_peri_hsi2c_user",
 	    mout_peri_hsi2c_user_p, PLL_CON0_MUX_CLKCMU_PERI_HSI2C_USER, 4, 1),
-	MUX(CLK_MOUT_PERI_SPI_USER, "mout_peri_spi_user", mout_peri_spi_user_p,
-	    PLL_CON0_MUX_CLKCMU_PERI_SPI_USER, 4, 1),
+	MUX_F(CLK_MOUT_PERI_SPI_USER, "mout_peri_spi_user",
+	      mout_peri_spi_user_p, PLL_CON0_MUX_CLKCMU_PERI_SPI_USER, 4, 1,
+	      CLK_SET_RATE_PARENT, 0),
 };
 
 static const struct samsung_div_clock peri_div_clks[] __initconst = {
@@ -1568,8 +1569,8 @@
 	    CLK_CON_DIV_DIV_CLK_PERI_HSI2C_1, 0, 5),
 	DIV(CLK_DOUT_PERI_HSI2C2, "dout_peri_hsi2c2", "gout_peri_hsi2c2",
 	    CLK_CON_DIV_DIV_CLK_PERI_HSI2C_2, 0, 5),
-	DIV(CLK_DOUT_PERI_SPI0, "dout_peri_spi0", "mout_peri_spi_user",
-	    CLK_CON_DIV_DIV_CLK_PERI_SPI_0, 0, 5),
+	DIV_F(CLK_DOUT_PERI_SPI0, "dout_peri_spi0", "mout_peri_spi_user",
+	      CLK_CON_DIV_DIV_CLK_PERI_SPI_0, 0, 5, CLK_SET_RATE_PARENT, 0),
 };
 
 static const struct samsung_gate_clock peri_gate_clks[] __initconst = {
@@ -1611,7 +1612,7 @@
 	     "mout_peri_bus_user",
 	     CLK_CON_GAT_GOUT_PERI_PWM_MOTOR_PCLK, 21, 0, 0),
 	GATE(CLK_GOUT_SPI0_IPCLK, "gout_spi0_ipclk", "dout_peri_spi0",
-	     CLK_CON_GAT_GOUT_PERI_SPI_0_IPCLK, 21, 0, 0),
+	     CLK_CON_GAT_GOUT_PERI_SPI_0_IPCLK, 21, CLK_SET_RATE_PARENT, 0),
 	GATE(CLK_GOUT_SPI0_PCLK, "gout_spi0_pclk", "mout_peri_bus_user",
 	     CLK_CON_GAT_GOUT_PERI_SPI_0_PCLK, 21, 0, 0),
 	GATE(CLK_GOUT_SYSREG_PERI_PCLK, "gout_sysreg_peri_pclk",
--- linux-qcom-6.8.0.orig/drivers/clk/samsung/clk-exynosautov9.c
+++ linux-qcom-6.8.0/drivers/clk/samsung/clk-exynosautov9.c
@@ -352,13 +352,13 @@
 	/* CMU_TOP_PURECLKCOMP */
 	PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared0_pll", "oscclk",
 	    PLL_LOCKTIME_PLL_SHARED0, PLL_CON3_PLL_SHARED0, NULL),
-	PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared1_pll", "oscclk",
+	PLL(pll_0822x, FOUT_SHARED1_PLL, "fout_shared1_pll", "oscclk",
 	    PLL_LOCKTIME_PLL_SHARED1, PLL_CON3_PLL_SHARED1, NULL),
-	PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared2_pll", "oscclk",
+	PLL(pll_0822x, FOUT_SHARED2_PLL, "fout_shared2_pll", "oscclk",
 	    PLL_LOCKTIME_PLL_SHARED2, PLL_CON3_PLL_SHARED2, NULL),
-	PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared3_pll", "oscclk",
+	PLL(pll_0822x, FOUT_SHARED3_PLL, "fout_shared3_pll", "oscclk",
 	    PLL_LOCKTIME_PLL_SHARED3, PLL_CON3_PLL_SHARED3, NULL),
-	PLL(pll_0822x, FOUT_SHARED0_PLL, "fout_shared4_pll", "oscclk",
+	PLL(pll_0822x, FOUT_SHARED4_PLL, "fout_shared4_pll", "oscclk",
 	    PLL_LOCKTIME_PLL_SHARED4, PLL_CON3_PLL_SHARED4, NULL),
 };
 
--- linux-qcom-6.8.0.orig/drivers/clk/sifive/sifive-prci.c
+++ linux-qcom-6.8.0/drivers/clk/sifive/sifive-prci.c
@@ -4,7 +4,6 @@
  * Copyright (C) 2020 Zong Li
  */
 
-#include <linux/clkdev.h>
 #include <linux/delay.h>
 #include <linux/io.h>
 #include <linux/module.h>
@@ -536,13 +535,6 @@
 				 init.name, r);
 			return r;
 		}
-
-		r = clk_hw_register_clkdev(&pic->hw, pic->name, dev_name(dev));
-		if (r) {
-			dev_warn(dev, "Failed to register clkdev for %s: %d\n",
-				 init.name, r);
-			return r;
-		}
 
 		pd->hw_clks.hws[i] = &pic->hw;
 	}
--- linux-qcom-6.8.0.orig/drivers/clk/starfive/clk-starfive-jh7110-sys.c
+++ linux-qcom-6.8.0/drivers/clk/starfive/clk-starfive-jh7110-sys.c
@@ -385,6 +385,32 @@
 }
 EXPORT_SYMBOL_GPL(jh7110_reset_controller_register);
 
+/*
+ * This clock notifier is called when the rate of PLL0 clock is to be changed.
+ * The cpu_root clock should save the curent parent clock and switch its parent
+ * clock to osc before PLL0 rate will be changed. Then switch its parent clock
+ * back after the PLL0 rate is completed.
+ */
+static int jh7110_pll0_clk_notifier_cb(struct notifier_block *nb,
+				       unsigned long action, void *data)
+{
+	struct jh71x0_clk_priv *priv = container_of(nb, struct jh71x0_clk_priv, pll_clk_nb);
+	struct clk *cpu_root = priv->reg[JH7110_SYSCLK_CPU_ROOT].hw.clk;
+	int ret = 0;
+
+	if (action == PRE_RATE_CHANGE) {
+		struct clk *osc = clk_get(priv->dev, "osc");
+
+		priv->original_clk = clk_get_parent(cpu_root);
+		ret = clk_set_parent(cpu_root, osc);
+		clk_put(osc);
+	} else if (action == POST_RATE_CHANGE) {
+		ret = clk_set_parent(cpu_root, priv->original_clk);
+	}
+
+	return notifier_from_errno(ret);
+}
+
 static int __init jh7110_syscrg_probe(struct platform_device *pdev)
 {
 	struct jh71x0_clk_priv *priv;
@@ -413,7 +439,10 @@
 		if (IS_ERR(priv->pll[0]))
 			return PTR_ERR(priv->pll[0]);
 	} else {
-		clk_put(pllclk);
+		priv->pll_clk_nb.notifier_call = jh7110_pll0_clk_notifier_cb;
+		ret = clk_notifier_register(pllclk, &priv->pll_clk_nb);
+		if (ret)
+			return ret;
 		priv->pll[0] = NULL;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/clk/starfive/clk-starfive-jh7110-vout.c
+++ linux-qcom-6.8.0/drivers/clk/starfive/clk-starfive-jh7110-vout.c
@@ -145,7 +145,7 @@
 
 	/* enable power domain and clocks */
 	pm_runtime_enable(priv->dev);
-	ret = pm_runtime_get_sync(priv->dev);
+	ret = pm_runtime_resume_and_get(priv->dev);
 	if (ret < 0)
 		return dev_err_probe(priv->dev, ret, "failed to turn on power\n");
 
--- linux-qcom-6.8.0.orig/drivers/clk/starfive/clk-starfive-jh71x0.h
+++ linux-qcom-6.8.0/drivers/clk/starfive/clk-starfive-jh71x0.h
@@ -114,6 +114,8 @@
 	spinlock_t rmw_lock;
 	struct device *dev;
 	void __iomem *base;
+	struct clk *original_clk;
+	struct notifier_block pll_clk_nb;
 	struct clk_hw *pll[3];
 	struct jh71x0_clk reg[];
 };
--- linux-qcom-6.8.0.orig/drivers/clk/sunxi-ng/ccu-sun20i-d1.c
+++ linux-qcom-6.8.0/drivers/clk/sunxi-ng/ccu-sun20i-d1.c
@@ -1371,7 +1371,7 @@
 
 	/* Enforce m1 = 0, m0 = 0 for PLL_AUDIO0 */
 	val = readl(reg + SUN20I_D1_PLL_AUDIO0_REG);
-	val &= ~BIT(1) | BIT(0);
+	val &= ~(BIT(1) | BIT(0));
 	writel(val, reg + SUN20I_D1_PLL_AUDIO0_REG);
 
 	/* Force fanout-27M factor N to 0. */
--- linux-qcom-6.8.0.orig/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+++ linux-qcom-6.8.0/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
@@ -182,6 +182,8 @@
 					      &ccu_nkm_ops,
 					      CLK_SET_RATE_UNGATE | CLK_SET_RATE_PARENT),
 		.features	= CCU_FEATURE_CLOSEST_RATE,
+		.min_rate	= 500000000,
+		.max_rate	= 1400000000,
 	},
 };
 
--- linux-qcom-6.8.0.orig/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+++ linux-qcom-6.8.0/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
@@ -1181,11 +1181,18 @@
 	SUN50I_H6_USB3_CLK_REG,
 };
 
+static struct ccu_mux_nb sun50i_h6_cpu_nb = {
+	.common		= &cpux_clk.common,
+	.cm		= &cpux_clk.mux,
+	.delay_us       = 1,
+	.bypass_index   = 0, /* index of 24 MHz oscillator */
+};
+
 static int sun50i_h6_ccu_probe(struct platform_device *pdev)
 {
 	void __iomem *reg;
+	int i, ret;
 	u32 val;
-	int i;
 
 	reg = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(reg))
@@ -1252,7 +1259,15 @@
 	val |= BIT(24);
 	writel(val, reg + SUN50I_H6_HDMI_CEC_CLK_REG);
 
-	return devm_sunxi_ccu_probe(&pdev->dev, reg, &sun50i_h6_ccu_desc);
+	ret = devm_sunxi_ccu_probe(&pdev->dev, reg, &sun50i_h6_ccu_desc);
+	if (ret)
+		return ret;
+
+	/* Reparent CPU during PLL CPUX rate changes */
+	ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
+				  &sun50i_h6_cpu_nb);
+
+	return 0;
 }
 
 static const struct of_device_id sun50i_h6_ccu_ids[] = {
--- linux-qcom-6.8.0.orig/drivers/clk/sunxi-ng/ccu_common.c
+++ linux-qcom-6.8.0/drivers/clk/sunxi-ng/ccu_common.c
@@ -44,6 +44,16 @@
 			unsigned long current_rate,
 			unsigned long best_rate)
 {
+	unsigned long min_rate, max_rate;
+
+	clk_hw_get_rate_range(&common->hw, &min_rate, &max_rate);
+
+	if (current_rate > max_rate)
+		return false;
+
+	if (current_rate < min_rate)
+		return false;
+
 	if (common->features & CCU_FEATURE_CLOSEST_RATE)
 		return abs(current_rate - target_rate) < abs(best_rate - target_rate);
 
@@ -138,6 +148,21 @@
 		}
 	}
 
+	for (i = 0; i < desc->num_ccu_clks; i++) {
+		struct ccu_common *cclk = desc->ccu_clks[i];
+
+		if (!cclk)
+			continue;
+
+		if (cclk->max_rate)
+			clk_hw_set_rate_range(&cclk->hw, cclk->min_rate,
+					      cclk->max_rate);
+		else
+			WARN(cclk->min_rate,
+			     "No max_rate, ignoring min_rate of clock %d - %s\n",
+			     i, clk_hw_get_name(&cclk->hw));
+	}
+
 	ret = of_clk_add_hw_provider(node, of_clk_hw_onecell_get,
 				     desc->hw_clks);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/clk/sunxi-ng/ccu_common.h
+++ linux-qcom-6.8.0/drivers/clk/sunxi-ng/ccu_common.h
@@ -31,6 +31,9 @@
 	u16		lock_reg;
 	u32		prediv;
 
+	unsigned long	min_rate;
+	unsigned long	max_rate;
+
 	unsigned long	features;
 	spinlock_t	*lock;
 	struct clk_hw	hw;
--- linux-qcom-6.8.0.orig/drivers/clk/ti/clk-dra7-atl.c
+++ linux-qcom-6.8.0/drivers/clk/ti/clk-dra7-atl.c
@@ -240,6 +240,7 @@
 		}
 
 		clk = of_clk_get_from_provider(&clkspec);
+		of_node_put(clkspec.np);
 		if (IS_ERR(clk)) {
 			pr_err("%s: failed to get atl clock %d from provider\n",
 			       __func__, i);
--- linux-qcom-6.8.0.orig/drivers/clk/zynq/clkc.c
+++ linux-qcom-6.8.0/drivers/clk/zynq/clkc.c
@@ -42,6 +42,7 @@
 #define SLCR_SWDT_CLK_SEL		(zynq_clkc_base + 0x204)
 
 #define NUM_MIO_PINS	54
+#define CLK_NAME_LEN	16
 
 #define DBG_CLK_CTRL_CLKACT_TRC		BIT(0)
 #define DBG_CLK_CTRL_CPU_1XCLKACT	BIT(1)
@@ -215,7 +216,7 @@
 	int i;
 	u32 tmp;
 	int ret;
-	char *clk_name;
+	char clk_name[CLK_NAME_LEN];
 	unsigned int fclk_enable = 0;
 	const char *clk_output_name[clk_max];
 	const char *cpu_parents[4];
@@ -426,12 +427,10 @@
 			"gem1_emio_mux", CLK_SET_RATE_PARENT,
 			SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock);
 
-	tmp = strlen("mio_clk_00x");
-	clk_name = kmalloc(tmp, GFP_KERNEL);
 	for (i = 0; i < NUM_MIO_PINS; i++) {
 		int idx;
 
-		snprintf(clk_name, tmp, "mio_clk_%2.2d", i);
+		snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i);
 		idx = of_property_match_string(np, "clock-names", clk_name);
 		if (idx >= 0)
 			can_mio_mux_parents[i] = of_clk_get_parent_name(np,
@@ -439,7 +438,6 @@
 		else
 			can_mio_mux_parents[i] = dummy_nm;
 	}
-	kfree(clk_name);
 	clk_register_mux(NULL, "can_mux", periph_parents, 4,
 			CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0,
 			&canclk_lock);
--- linux-qcom-6.8.0.orig/drivers/clocksource/Kconfig
+++ linux-qcom-6.8.0/drivers/clocksource/Kconfig
@@ -390,7 +390,8 @@
 	  This affects CPU_FREQ max delta from the initial frequency.
 
 config ARM_TIMER_SP804
-	bool "Support for Dual Timer SP804 module" if COMPILE_TEST
+	bool "Support for Dual Timer SP804 module"
+	depends on ARM || ARM64 || COMPILE_TEST
 	depends on GENERIC_SCHED_CLOCK && HAVE_CLK
 	select CLKSRC_MMIO
 	select TIMER_OF if OF
--- linux-qcom-6.8.0.orig/drivers/clocksource/arm_global_timer.c
+++ linux-qcom-6.8.0/drivers/clocksource/arm_global_timer.c
@@ -32,7 +32,7 @@
 #define GT_CONTROL_IRQ_ENABLE		BIT(2)	/* banked */
 #define GT_CONTROL_AUTO_INC		BIT(3)	/* banked */
 #define GT_CONTROL_PRESCALER_SHIFT      8
-#define GT_CONTROL_PRESCALER_MAX        0xF
+#define GT_CONTROL_PRESCALER_MAX        0xFF
 #define GT_CONTROL_PRESCALER_MASK       (GT_CONTROL_PRESCALER_MAX << \
 					 GT_CONTROL_PRESCALER_SHIFT)
 
@@ -290,18 +290,17 @@
 	switch (event) {
 	case PRE_RATE_CHANGE:
 	{
-		int psv;
+		unsigned long psv;
 
-		psv = DIV_ROUND_CLOSEST(ndata->new_rate,
-					gt_target_rate);
-
-		if (abs(gt_target_rate - (ndata->new_rate / psv)) > MAX_F_ERR)
+		psv = DIV_ROUND_CLOSEST(ndata->new_rate, gt_target_rate);
+		if (!psv ||
+		    abs(gt_target_rate - (ndata->new_rate / psv)) > MAX_F_ERR)
 			return NOTIFY_BAD;
 
 		psv--;
 
 		/* prescaler within legal range? */
-		if (psv < 0 || psv > GT_CONTROL_PRESCALER_MAX)
+		if (psv > GT_CONTROL_PRESCALER_MAX)
 			return NOTIFY_BAD;
 
 		/*
--- linux-qcom-6.8.0.orig/drivers/clocksource/hyperv_timer.c
+++ linux-qcom-6.8.0/drivers/clocksource/hyperv_timer.c
@@ -27,7 +27,8 @@
 #include <asm/mshyperv.h>
 
 static struct clock_event_device __percpu *hv_clock_event;
-static u64 hv_sched_clock_offset __ro_after_init;
+/* Note: offset can hold negative values after hibernation. */
+static u64 hv_sched_clock_offset __read_mostly;
 
 /*
  * If false, we're using the old mechanism for stimer0 interrupts
@@ -137,7 +138,21 @@
 	ce->name = "Hyper-V clockevent";
 	ce->features = CLOCK_EVT_FEAT_ONESHOT;
 	ce->cpumask = cpumask_of(cpu);
-	ce->rating = 1000;
+
+	/*
+	 * Lower the rating of the Hyper-V timer in a TDX VM without paravisor,
+	 * so the local APIC timer (lapic_clockevent) is the default timer in
+	 * such a VM. The Hyper-V timer is not preferred in such a VM because
+	 * it depends on the slow VM Reference Counter MSR (the Hyper-V TSC
+	 * page is not enbled in such a VM because the VM uses Invariant TSC
+	 * as a better clocksource and it's challenging to mark the Hyper-V
+	 * TSC page shared in very early boot).
+	 */
+	if (!ms_hyperv.paravisor_present && hv_isolation_type_tdx())
+		ce->rating = 90;
+	else
+		ce->rating = 1000;
+
 	ce->set_state_shutdown = hv_ce_shutdown;
 	ce->set_state_oneshot = hv_ce_set_oneshot;
 	ce->set_next_event = hv_ce_set_next_event;
@@ -456,6 +471,17 @@
 	hv_set_register(HV_REGISTER_REFERENCE_TSC, tsc_msr.as_uint64);
 }
 
+/*
+ * Called during resume from hibernation, from overridden
+ * x86_platform.restore_sched_clock_state routine. This is to adjust offsets
+ * used to calculate time for hv tsc page based sched_clock, to account for
+ * time spent before hibernation.
+ */
+void hv_adj_sched_clock_offset(u64 offset)
+{
+	hv_sched_clock_offset -= offset;
+}
+
 #ifdef HAVE_VDSO_CLOCKMODE_HVCLOCK
 static int hv_cs_enable(struct clocksource *cs)
 {
--- linux-qcom-6.8.0.orig/drivers/clocksource/sh_cmt.c
+++ linux-qcom-6.8.0/drivers/clocksource/sh_cmt.c
@@ -528,6 +528,7 @@
 static irqreturn_t sh_cmt_interrupt(int irq, void *dev_id)
 {
 	struct sh_cmt_channel *ch = dev_id;
+	unsigned long flags;
 
 	/* clear flags */
 	sh_cmt_write_cmcsr(ch, sh_cmt_read_cmcsr(ch) &
@@ -558,6 +559,8 @@
 
 	ch->flags &= ~FLAG_SKIPEVENT;
 
+	raw_spin_lock_irqsave(&ch->lock, flags);
+
 	if (ch->flags & FLAG_REPROGRAM) {
 		ch->flags &= ~FLAG_REPROGRAM;
 		sh_cmt_clock_event_program_verify(ch, 1);
@@ -570,6 +573,8 @@
 
 	ch->flags &= ~FLAG_IRQCONTEXT;
 
+	raw_spin_unlock_irqrestore(&ch->lock, flags);
+
 	return IRQ_HANDLED;
 }
 
@@ -780,12 +785,18 @@
 				   struct clock_event_device *ced)
 {
 	struct sh_cmt_channel *ch = ced_to_sh_cmt(ced);
+	unsigned long flags;
 
 	BUG_ON(!clockevent_state_oneshot(ced));
+
+	raw_spin_lock_irqsave(&ch->lock, flags);
+
 	if (likely(ch->flags & FLAG_IRQCONTEXT))
 		ch->next_match_value = delta - 1;
 	else
-		sh_cmt_set_next(ch, delta - 1);
+		__sh_cmt_set_next(ch, delta - 1);
+
+	raw_spin_unlock_irqrestore(&ch->lock, flags);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/clocksource/timer-imx-tpm.c
+++ linux-qcom-6.8.0/drivers/clocksource/timer-imx-tpm.c
@@ -83,20 +83,28 @@
 static int tpm_set_next_event(unsigned long delta,
 				struct clock_event_device *evt)
 {
-	unsigned long next, now;
+	unsigned long next, prev, now;
 
-	next = tpm_read_counter();
-	next += delta;
+	prev = tpm_read_counter();
+	next = prev + delta;
 	writel(next, timer_base + TPM_C0V);
 	now = tpm_read_counter();
 
 	/*
+	 * Need to wait CNT increase at least 1 cycle to make sure
+	 * the C0V has been updated into HW.
+	 */
+	if ((next & 0xffffffff) != readl(timer_base + TPM_C0V))
+		while (now == tpm_read_counter())
+			;
+
+	/*
 	 * NOTE: We observed in a very small probability, the bus fabric
 	 * contention between GPU and A7 may results a few cycles delay
 	 * of writing CNT registers which may cause the min_delta event got
 	 * missed, so we need add a ETIME check here in case it happened.
 	 */
-	return (int)(next - now) <= 0 ? -ETIME : 0;
+	return (now - prev) >= delta ? -ETIME : 0;
 }
 
 static int tpm_set_state_oneshot(struct clock_event_device *evt)
--- linux-qcom-6.8.0.orig/drivers/clocksource/timer-of.c
+++ linux-qcom-6.8.0/drivers/clocksource/timer-of.c
@@ -25,10 +25,7 @@
 
 	struct clock_event_device *clkevt = &to->clkevt;
 
-	if (of_irq->percpu)
-		free_percpu_irq(of_irq->irq, clkevt);
-	else
-		free_irq(of_irq->irq, clkevt);
+	free_irq(of_irq->irq, clkevt);
 }
 
 /**
@@ -42,9 +39,6 @@
  * - Get interrupt number by name
  * - Get interrupt number by index
  *
- * When the interrupt is per CPU, 'request_percpu_irq()' is called,
- * otherwise 'request_irq()' is used.
- *
  * Returns 0 on success, < 0 otherwise
  */
 static __init int timer_of_irq_init(struct device_node *np,
@@ -69,12 +63,9 @@
 		return -EINVAL;
 	}
 
-	ret = of_irq->percpu ?
-		request_percpu_irq(of_irq->irq, of_irq->handler,
-				   np->full_name, clkevt) :
-		request_irq(of_irq->irq, of_irq->handler,
-			    of_irq->flags ? of_irq->flags : IRQF_TIMER,
-			    np->full_name, clkevt);
+	ret = request_irq(of_irq->irq, of_irq->handler,
+			  of_irq->flags ? of_irq->flags : IRQF_TIMER,
+			  np->full_name, clkevt);
 	if (ret) {
 		pr_err("Failed to request irq %d for %pOF\n", of_irq->irq, np);
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/clocksource/timer-of.h
+++ linux-qcom-6.8.0/drivers/clocksource/timer-of.h
@@ -11,7 +11,6 @@
 struct of_timer_irq {
 	int irq;
 	int index;
-	int percpu;
 	const char *name;
 	unsigned long flags;
 	irq_handler_t handler;
--- linux-qcom-6.8.0.orig/drivers/clocksource/timer-qcom.c
+++ linux-qcom-6.8.0/drivers/clocksource/timer-qcom.c
@@ -233,6 +233,7 @@
 	}
 
 	if (of_property_read_u32(np, "clock-frequency", &freq)) {
+		iounmap(cpu0_base);
 		pr_err("Unknown frequency\n");
 		return -EINVAL;
 	}
@@ -243,7 +244,11 @@
 	freq /= 4;
 	writel_relaxed(DGT_CLK_CTL_DIV_4, source_base + DGT_CLK_CTL);
 
-	return msm_timer_init(freq, 32, irq, !!percpu_offset);
+	ret = msm_timer_init(freq, 32, irq, !!percpu_offset);
+	if (ret)
+		iounmap(cpu0_base);
+
+	return ret;
 }
 TIMER_OF_DECLARE(kpss_timer, "qcom,kpss-timer", msm_dt_timer_init);
 TIMER_OF_DECLARE(scss_timer, "qcom,scss-timer", msm_dt_timer_init);
--- linux-qcom-6.8.0.orig/drivers/clocksource/timer-riscv.c
+++ linux-qcom-6.8.0/drivers/clocksource/timer-riscv.c
@@ -108,6 +108,9 @@
 {
 	struct clock_event_device *ce = per_cpu_ptr(&riscv_clock_event, cpu);
 
+	/* Clear timer interrupt */
+	riscv_clock_event_stop();
+
 	ce->cpumask = cpumask_of(cpu);
 	ce->irq = riscv_clock_event_irq;
 	if (riscv_timer_cannot_wake_cpu)
--- linux-qcom-6.8.0.orig/drivers/clocksource/timer-ti-dm-systimer.c
+++ linux-qcom-6.8.0/drivers/clocksource/timer-ti-dm-systimer.c
@@ -686,9 +686,9 @@
 
 static int __init dmtimer_percpu_quirk_init(struct device_node *np, u32 pa)
 {
-	struct device_node *arm_timer;
+	struct device_node *arm_timer __free(device_node) =
+		of_find_compatible_node(NULL, NULL, "arm,armv7-timer");
 
-	arm_timer = of_find_compatible_node(NULL, NULL, "arm,armv7-timer");
 	if (of_device_is_available(arm_timer)) {
 		pr_warn_once("ARM architected timer wrap issue i940 detected\n");
 		return 0;
--- linux-qcom-6.8.0.orig/drivers/comedi/comedi_fops.c
+++ linux-qcom-6.8.0/drivers/comedi/comedi_fops.c
@@ -2407,6 +2407,18 @@
 
 			start += PAGE_SIZE;
 		}
+
+#ifdef CONFIG_MMU
+		/*
+		 * Leaving behind a partial mapping of a buffer we're about to
+		 * drop is unsafe, see remap_pfn_range_notrack().
+		 * We need to zap the range here ourselves instead of relying
+		 * on the automatic zapping in remap_pfn_range() because we call
+		 * remap_pfn_range() in a loop.
+		 */
+		if (retval)
+			zap_vma_ptes(vma, vma->vm_start, size);
+#endif
 	}
 
 	if (retval == 0) {
--- linux-qcom-6.8.0.orig/drivers/comedi/drivers/ni_routing/tools/convert_c_to_py.c
+++ linux-qcom-6.8.0/drivers/comedi/drivers/ni_routing/tools/convert_c_to_py.c
@@ -140,6 +140,11 @@
 {
 	FILE *fp = fopen("ni_values.py", "w");
 
+	if (fp == NULL) {
+		fprintf(stderr, "Could not open file!");
+		return -1;
+	}
+
 	/* write route register values */
 	fprintf(fp, "ni_route_values = {\n");
 	for (int i = 0; ni_all_route_values[i]; ++i)
--- linux-qcom-6.8.0.orig/drivers/comedi/drivers/vmk80xx.c
+++ linux-qcom-6.8.0/drivers/comedi/drivers/vmk80xx.c
@@ -641,33 +641,22 @@
 	struct vmk80xx_private *devpriv = dev->private;
 	struct usb_interface *intf = comedi_to_usb_interface(dev);
 	struct usb_host_interface *iface_desc = intf->cur_altsetting;
-	struct usb_endpoint_descriptor *ep_desc;
-	int i;
+	struct usb_endpoint_descriptor *ep_rx_desc, *ep_tx_desc;
+	int ret;
 
-	if (iface_desc->desc.bNumEndpoints != 2)
-		return -ENODEV;
-
-	for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
-		ep_desc = &iface_desc->endpoint[i].desc;
-
-		if (usb_endpoint_is_int_in(ep_desc) ||
-		    usb_endpoint_is_bulk_in(ep_desc)) {
-			if (!devpriv->ep_rx)
-				devpriv->ep_rx = ep_desc;
-			continue;
-		}
+	if (devpriv->model == VMK8061_MODEL)
+		ret = usb_find_common_endpoints(iface_desc, &ep_rx_desc,
+						&ep_tx_desc, NULL, NULL);
+	else
+		ret = usb_find_common_endpoints(iface_desc, NULL, NULL,
+						&ep_rx_desc, &ep_tx_desc);
 
-		if (usb_endpoint_is_int_out(ep_desc) ||
-		    usb_endpoint_is_bulk_out(ep_desc)) {
-			if (!devpriv->ep_tx)
-				devpriv->ep_tx = ep_desc;
-			continue;
-		}
-	}
-
-	if (!devpriv->ep_rx || !devpriv->ep_tx)
+	if (ret)
 		return -ENODEV;
 
+	devpriv->ep_rx = ep_rx_desc;
+	devpriv->ep_tx = ep_tx_desc;
+
 	if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx))
 		return -EINVAL;
 
--- linux-qcom-6.8.0.orig/drivers/counter/stm32-timer-cnt.c
+++ linux-qcom-6.8.0/drivers/counter/stm32-timer-cnt.c
@@ -195,11 +195,17 @@
 {
 	struct stm32_timer_cnt *const priv = counter_priv(counter);
 	u32 cr1;
+	int ret;
 
 	if (enable) {
 		regmap_read(priv->regmap, TIM_CR1, &cr1);
-		if (!(cr1 & TIM_CR1_CEN))
-			clk_enable(priv->clk);
+		if (!(cr1 & TIM_CR1_CEN)) {
+			ret = clk_enable(priv->clk);
+			if (ret) {
+				dev_err(counter->parent, "Cannot enable clock %d\n", ret);
+				return ret;
+			}
+		}
 
 		regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN,
 				   TIM_CR1_CEN);
@@ -383,7 +389,11 @@
 		return ret;
 
 	if (priv->enabled) {
-		clk_enable(priv->clk);
+		ret = clk_enable(priv->clk);
+		if (ret) {
+			dev_err(dev, "Cannot enable clock %d\n", ret);
+			return ret;
+		}
 
 		/* Restore registers that may have been lost */
 		regmap_write(priv->regmap, TIM_SMCR, priv->bak.smcr);
--- linux-qcom-6.8.0.orig/drivers/counter/ti-ecap-capture.c
+++ linux-qcom-6.8.0/drivers/counter/ti-ecap-capture.c
@@ -576,8 +576,13 @@
 {
 	struct counter_device *counter_dev = dev_get_drvdata(dev);
 	struct ecap_cnt_dev *ecap_dev = counter_priv(counter_dev);
+	int ret;
 
-	clk_enable(ecap_dev->clk);
+	ret = clk_enable(ecap_dev->clk);
+	if (ret) {
+		dev_err(dev, "Cannot enable clock %d\n", ret);
+		return ret;
+	}
 
 	ecap_cnt_capture_set_evmode(counter_dev, ecap_dev->pm_ctx.ev_mode);
 
--- linux-qcom-6.8.0.orig/drivers/counter/ti-eqep.c
+++ linux-qcom-6.8.0/drivers/counter/ti-eqep.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/bitops.h>
+#include <linux/clk.h>
 #include <linux/counter.h>
 #include <linux/kernel.h>
 #include <linux/mod_devicetable.h>
@@ -376,6 +377,7 @@
 	struct counter_device *counter;
 	struct ti_eqep_cnt *priv;
 	void __iomem *base;
+	struct clk *clk;
 	int err;
 
 	counter = devm_counter_alloc(dev, sizeof(*priv));
@@ -415,6 +417,10 @@
 	pm_runtime_enable(dev);
 	pm_runtime_get_sync(dev);
 
+	clk = devm_clk_get_enabled(dev, NULL);
+	if (IS_ERR(clk))
+		return dev_err_probe(dev, PTR_ERR(clk), "failed to enable clock\n");
+
 	err = counter_add(counter);
 	if (err < 0) {
 		pm_runtime_put_sync(dev);
--- linux-qcom-6.8.0.orig/drivers/cpufreq/Kconfig.arm
+++ linux-qcom-6.8.0/drivers/cpufreq/Kconfig.arm
@@ -173,6 +173,7 @@
 config ARM_QCOM_CPUFREQ_HW
 	tristate "QCOM CPUFreq HW driver"
 	depends on ARCH_QCOM || COMPILE_TEST
+	depends on COMMON_CLK
 	help
 	  Support for the CPUFreq HW driver.
 	  Some QCOM chipsets have a HW engine to offload the steps
--- linux-qcom-6.8.0.orig/drivers/cpufreq/acpi-cpufreq.c
+++ linux-qcom-6.8.0/drivers/cpufreq/acpi-cpufreq.c
@@ -890,8 +890,10 @@
 	if (perf->states[0].core_frequency * 1000 != freq_table[0].frequency)
 		pr_warn(FW_WARN "P-state 0 is not max freq\n");
 
-	if (acpi_cpufreq_driver.set_boost)
+	if (acpi_cpufreq_driver.set_boost) {
 		set_boost(policy, acpi_cpufreq_driver.boost_enabled);
+		policy->boost_enabled = acpi_cpufreq_driver.boost_enabled;
+	}
 
 	return result;
 
--- linux-qcom-6.8.0.orig/drivers/cpufreq/amd-pstate-ut.c
+++ linux-qcom-6.8.0/drivers/cpufreq/amd-pstate-ut.c
@@ -26,10 +26,11 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/fs.h>
-#include <linux/amd-pstate.h>
 
 #include <acpi/cppc_acpi.h>
 
+#include "amd-pstate.h"
+
 /*
  * Abbreviations:
  * amd_pstate_ut: used as a shortform for AMD P-State unit test.
@@ -201,6 +202,7 @@
 	int cpu = 0;
 	struct cpufreq_policy *policy = NULL;
 	struct amd_cpudata *cpudata = NULL;
+	u32 nominal_freq_khz;
 
 	for_each_possible_cpu(cpu) {
 		policy = cpufreq_cpu_get(cpu);
@@ -208,13 +210,14 @@
 			break;
 		cpudata = policy->driver_data;
 
-		if (!((cpudata->max_freq >= cpudata->nominal_freq) &&
-			(cpudata->nominal_freq > cpudata->lowest_nonlinear_freq) &&
+		nominal_freq_khz = cpudata->nominal_freq*1000;
+		if (!((cpudata->max_freq >= nominal_freq_khz) &&
+			(nominal_freq_khz > cpudata->lowest_nonlinear_freq) &&
 			(cpudata->lowest_nonlinear_freq > cpudata->min_freq) &&
 			(cpudata->min_freq > 0))) {
 			amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL;
 			pr_err("%s cpu%d max=%d >= nominal=%d > lowest_nonlinear=%d > min=%d > 0, the formula is incorrect!\n",
-				__func__, cpu, cpudata->max_freq, cpudata->nominal_freq,
+				__func__, cpu, cpudata->max_freq, nominal_freq_khz,
 				cpudata->lowest_nonlinear_freq, cpudata->min_freq);
 			goto skip_test;
 		}
@@ -228,13 +231,13 @@
 
 		if (cpudata->boost_supported) {
 			if ((policy->max == cpudata->max_freq) ||
-					(policy->max == cpudata->nominal_freq))
+					(policy->max == nominal_freq_khz))
 				amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_PASS;
 			else {
 				amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL;
 				pr_err("%s cpu%d policy_max=%d should be equal cpu_max=%d or cpu_nominal=%d !\n",
 					__func__, cpu, policy->max, cpudata->max_freq,
-					cpudata->nominal_freq);
+					nominal_freq_khz);
 				goto skip_test;
 			}
 		} else {
--- linux-qcom-6.8.0.orig/drivers/cpufreq/amd-pstate.c
+++ linux-qcom-6.8.0/drivers/cpufreq/amd-pstate.c
@@ -36,7 +36,7 @@
 #include <linux/delay.h>
 #include <linux/uaccess.h>
 #include <linux/static_call.h>
-#include <linux/amd-pstate.h>
+#include <linux/topology.h>
 
 #include <acpi/processor.h>
 #include <acpi/cppc_acpi.h>
@@ -45,10 +45,45 @@
 #include <asm/processor.h>
 #include <asm/cpufeature.h>
 #include <asm/cpu_device_id.h>
+
+#include "amd-pstate.h"
 #include "amd-pstate-trace.h"
 
 #define AMD_PSTATE_TRANSITION_LATENCY	20000
 #define AMD_PSTATE_TRANSITION_DELAY	1000
+#define CPPC_HIGHEST_PERF_PERFORMANCE	196
+#define CPPC_HIGHEST_PERF_DEFAULT	166
+
+#define AMD_CPPC_EPP_PERFORMANCE		0x00
+#define AMD_CPPC_EPP_BALANCE_PERFORMANCE	0x80
+#define AMD_CPPC_EPP_BALANCE_POWERSAVE		0xBF
+#define AMD_CPPC_EPP_POWERSAVE			0xFF
+
+/*
+ * enum amd_pstate_mode - driver working mode of amd pstate
+ */
+enum amd_pstate_mode {
+	AMD_PSTATE_UNDEFINED = 0,
+	AMD_PSTATE_DISABLE,
+	AMD_PSTATE_PASSIVE,
+	AMD_PSTATE_ACTIVE,
+	AMD_PSTATE_GUIDED,
+	AMD_PSTATE_MAX,
+};
+
+static const char * const amd_pstate_mode_string[] = {
+	[AMD_PSTATE_UNDEFINED]   = "undefined",
+	[AMD_PSTATE_DISABLE]     = "disable",
+	[AMD_PSTATE_PASSIVE]     = "passive",
+	[AMD_PSTATE_ACTIVE]      = "active",
+	[AMD_PSTATE_GUIDED]      = "guided",
+	NULL,
+};
+
+struct quirk_entry {
+	u32 nominal_freq;
+	u32 lowest_freq;
+};
 
 /*
  * TODO: We need more time to fine tune processors with shared memory solution
@@ -64,6 +99,8 @@
 static struct cpufreq_driver amd_pstate_epp_driver;
 static int cppc_state = AMD_PSTATE_UNDEFINED;
 static bool cppc_enabled;
+static struct quirk_entry *quirks;
+static bool amd_pstate_prefcore = true;
 
 /*
  * AMD Energy Preference Performance (EPP)
@@ -108,6 +145,41 @@
 
 typedef int (*cppc_mode_transition_fn)(int);
 
+static struct quirk_entry quirk_amd_7k62 = {
+	.nominal_freq = 2600,
+	.lowest_freq = 550,
+};
+
+static int __init dmi_matched_7k62_bios_bug(const struct dmi_system_id *dmi)
+{
+	/**
+	 * match the broken bios for family 17h processor support CPPC V2
+	 * broken BIOS lack of nominal_freq and lowest_freq capabilities
+	 * definition in ACPI tables
+	 */
+	if (boot_cpu_has(X86_FEATURE_ZEN2)) {
+		quirks = dmi->driver_data;
+		pr_info("Overriding nominal and lowest frequencies for %s\n", dmi->ident);
+		return 1;
+	}
+
+	return 0;
+}
+
+static const struct dmi_system_id amd_pstate_quirks_table[] __initconst = {
+	{
+		.callback = dmi_matched_7k62_bios_bug,
+		.ident = "AMD EPYC 7K62",
+		.matches = {
+			DMI_MATCH(DMI_BIOS_VERSION, "5.14"),
+			DMI_MATCH(DMI_BIOS_RELEASE, "12/12/2019"),
+		},
+		.driver_data = &quirk_amd_7k62,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(dmi, amd_pstate_quirks_table);
+
 static inline int get_mode_idx_from_str(const char *str, size_t size)
 {
 	int i;
@@ -175,6 +247,26 @@
 	return index;
 }
 
+static void pstate_update_perf(struct amd_cpudata *cpudata, u32 min_perf,
+			       u32 des_perf, u32 max_perf, bool fast_switch)
+{
+	if (fast_switch)
+		wrmsrl(MSR_AMD_CPPC_REQ, READ_ONCE(cpudata->cppc_req_cached));
+	else
+		wrmsrl_on_cpu(cpudata->cpu, MSR_AMD_CPPC_REQ,
+			      READ_ONCE(cpudata->cppc_req_cached));
+}
+
+DEFINE_STATIC_CALL(amd_pstate_update_perf, pstate_update_perf);
+
+static inline void amd_pstate_update_perf(struct amd_cpudata *cpudata,
+					  u32 min_perf, u32 des_perf,
+					  u32 max_perf, bool fast_switch)
+{
+	static_call(amd_pstate_update_perf)(cpudata, min_perf, des_perf,
+					    max_perf, fast_switch);
+}
+
 static int amd_pstate_set_epp(struct amd_cpudata *cpudata, u32 epp)
 {
 	int ret;
@@ -191,6 +283,9 @@
 		if (!ret)
 			cpudata->epp_cached = epp;
 	} else {
+		amd_pstate_update_perf(cpudata, cpudata->min_limit_perf, 0U,
+					     cpudata->max_limit_perf, false);
+
 		perf_ctrls.energy_perf = epp;
 		ret = cppc_set_epp_perf(cpudata->cpu, &perf_ctrls, 1);
 		if (ret) {
@@ -209,10 +304,8 @@
 	int epp = -EINVAL;
 	int ret;
 
-	if (!pref_index) {
-		pr_debug("EPP pref_index is invalid\n");
-		return -EINVAL;
-	}
+	if (!pref_index)
+		epp = cpudata->epp_default;
 
 	if (epp == -EINVAL)
 		epp = epp_values[pref_index];
@@ -287,6 +380,21 @@
 	return static_call(amd_pstate_enable)(enable);
 }
 
+static u32 amd_pstate_highest_perf_set(struct amd_cpudata *cpudata)
+{
+	struct cpuinfo_x86 *c = &cpu_data(0);
+
+	/*
+	 * For AMD CPUs with Family ID 19H and Model ID range 0x70 to 0x7f,
+	 * the highest performance level is set to 196.
+	 * https://bugzilla.kernel.org/show_bug.cgi?id=218759
+	 */
+	if (c->x86 == 0x19 && (c->x86_model >= 0x70 && c->x86_model <= 0x7f))
+		return CPPC_HIGHEST_PERF_PERFORMANCE;
+
+	return CPPC_HIGHEST_PERF_DEFAULT;
+}
+
 static int pstate_init_perf(struct amd_cpudata *cpudata)
 {
 	u64 cap1;
@@ -297,13 +405,14 @@
 	if (ret)
 		return ret;
 
-	/*
-	 * TODO: Introduce AMD specific power feature.
-	 *
-	 * CPPC entry doesn't indicate the highest performance in some ASICs.
+	/* For platforms that do not support the preferred core feature, the
+	 * highest_pef may be configured with 166 or 255, to avoid max frequency
+	 * calculated wrongly. we take the AMD_CPPC_HIGHEST_PERF(cap1) value as
+	 * the default max perf.
 	 */
-	highest_perf = amd_get_highest_perf();
-	if (highest_perf > AMD_CPPC_HIGHEST_PERF(cap1))
+	if (cpudata->hw_prefcore)
+		highest_perf = amd_pstate_highest_perf_set(cpudata);
+	else
 		highest_perf = AMD_CPPC_HIGHEST_PERF(cap1);
 
 	WRITE_ONCE(cpudata->highest_perf, highest_perf);
@@ -324,8 +433,9 @@
 	if (ret)
 		return ret;
 
-	highest_perf = amd_get_highest_perf();
-	if (highest_perf > cppc_perf.highest_perf)
+	if (cpudata->hw_prefcore)
+		highest_perf = amd_pstate_highest_perf_set(cpudata);
+	else
 		highest_perf = cppc_perf.highest_perf;
 
 	WRITE_ONCE(cpudata->highest_perf, highest_perf);
@@ -361,16 +471,6 @@
 	return static_call(amd_pstate_init_perf)(cpudata);
 }
 
-static void pstate_update_perf(struct amd_cpudata *cpudata, u32 min_perf,
-			       u32 des_perf, u32 max_perf, bool fast_switch)
-{
-	if (fast_switch)
-		wrmsrl(MSR_AMD_CPPC_REQ, READ_ONCE(cpudata->cppc_req_cached));
-	else
-		wrmsrl_on_cpu(cpudata->cpu, MSR_AMD_CPPC_REQ,
-			      READ_ONCE(cpudata->cppc_req_cached));
-}
-
 static void cppc_update_perf(struct amd_cpudata *cpudata,
 			     u32 min_perf, u32 des_perf,
 			     u32 max_perf, bool fast_switch)
@@ -384,16 +484,6 @@
 	cppc_set_perf(cpudata->cpu, &perf_ctrls);
 }
 
-DEFINE_STATIC_CALL(amd_pstate_update_perf, pstate_update_perf);
-
-static inline void amd_pstate_update_perf(struct amd_cpudata *cpudata,
-					  u32 min_perf, u32 des_perf,
-					  u32 max_perf, bool fast_switch)
-{
-	static_call(amd_pstate_update_perf)(cpudata, min_perf, des_perf,
-					    max_perf, fast_switch);
-}
-
 static inline bool amd_pstate_sample(struct amd_cpudata *cpudata)
 {
 	u64 aperf, mperf, tsc;
@@ -555,9 +645,14 @@
 	unsigned long max_perf, min_perf, des_perf,
 		      cap_perf, lowest_nonlinear_perf, max_freq;
 	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
-	struct amd_cpudata *cpudata = policy->driver_data;
+	struct amd_cpudata *cpudata;
 	unsigned int target_freq;
 
+	if (!policy)
+		return;
+
+	cpudata = policy->driver_data;
+
 	if (policy->min != cpudata->min_limit_freq || policy->max != cpudata->max_limit_freq)
 		amd_pstate_update_min_max_limit(policy);
 
@@ -570,7 +665,7 @@
 	if (target_perf < capacity)
 		des_perf = DIV_ROUND_UP(cap_perf * target_perf, capacity);
 
-	min_perf = READ_ONCE(cpudata->highest_perf);
+	min_perf = READ_ONCE(cpudata->lowest_perf);
 	if (_min_perf < capacity)
 		min_perf = DIV_ROUND_UP(cap_perf * _min_perf, capacity);
 
@@ -592,74 +687,22 @@
 
 static int amd_get_min_freq(struct amd_cpudata *cpudata)
 {
-	struct cppc_perf_caps cppc_perf;
-
-	int ret = cppc_get_perf_caps(cpudata->cpu, &cppc_perf);
-	if (ret)
-		return ret;
-
-	/* Switch to khz */
-	return cppc_perf.lowest_freq * 1000;
+	return READ_ONCE(cpudata->min_freq);
 }
 
 static int amd_get_max_freq(struct amd_cpudata *cpudata)
 {
-	struct cppc_perf_caps cppc_perf;
-	u32 max_perf, max_freq, nominal_freq, nominal_perf;
-	u64 boost_ratio;
-
-	int ret = cppc_get_perf_caps(cpudata->cpu, &cppc_perf);
-	if (ret)
-		return ret;
-
-	nominal_freq = cppc_perf.nominal_freq;
-	nominal_perf = READ_ONCE(cpudata->nominal_perf);
-	max_perf = READ_ONCE(cpudata->highest_perf);
-
-	boost_ratio = div_u64(max_perf << SCHED_CAPACITY_SHIFT,
-			      nominal_perf);
-
-	max_freq = nominal_freq * boost_ratio >> SCHED_CAPACITY_SHIFT;
-
-	/* Switch to khz */
-	return max_freq * 1000;
+	return READ_ONCE(cpudata->max_freq);
 }
 
 static int amd_get_nominal_freq(struct amd_cpudata *cpudata)
 {
-	struct cppc_perf_caps cppc_perf;
-
-	int ret = cppc_get_perf_caps(cpudata->cpu, &cppc_perf);
-	if (ret)
-		return ret;
-
-	/* Switch to khz */
-	return cppc_perf.nominal_freq * 1000;
+	return READ_ONCE(cpudata->nominal_freq);
 }
 
 static int amd_get_lowest_nonlinear_freq(struct amd_cpudata *cpudata)
 {
-	struct cppc_perf_caps cppc_perf;
-	u32 lowest_nonlinear_freq, lowest_nonlinear_perf,
-	    nominal_freq, nominal_perf;
-	u64 lowest_nonlinear_ratio;
-
-	int ret = cppc_get_perf_caps(cpudata->cpu, &cppc_perf);
-	if (ret)
-		return ret;
-
-	nominal_freq = cppc_perf.nominal_freq;
-	nominal_perf = READ_ONCE(cpudata->nominal_perf);
-
-	lowest_nonlinear_perf = cppc_perf.lowest_nonlinear_perf;
-
-	lowest_nonlinear_ratio = div_u64(lowest_nonlinear_perf << SCHED_CAPACITY_SHIFT,
-					 nominal_perf);
-
-	lowest_nonlinear_freq = nominal_freq * lowest_nonlinear_ratio >> SCHED_CAPACITY_SHIFT;
-
-	/* Switch to khz */
-	return lowest_nonlinear_freq * 1000;
+	return READ_ONCE(cpudata->lowest_nonlinear_freq);
 }
 
 static int amd_pstate_set_boost(struct cpufreq_policy *policy, int state)
@@ -706,6 +749,135 @@
 	wrmsrl_on_cpu(cpu, MSR_AMD_PERF_CTL, 0);
 }
 
+/**
+ * amd_pstate_init_freq: Initialize the max_freq, min_freq,
+ *                       nominal_freq and lowest_nonlinear_freq for
+ *                       the @cpudata object.
+ *
+ *  Requires: highest_perf, lowest_perf, nominal_perf and
+ *            lowest_nonlinear_perf members of @cpudata to be
+ *            initialized.
+ *
+ *  Returns 0 on success, non-zero value on failure.
+ */
+static int amd_pstate_init_freq(struct amd_cpudata *cpudata)
+{
+	int ret;
+	u32 min_freq;
+	u32 highest_perf, max_freq;
+	u32 nominal_perf, nominal_freq;
+	u32 lowest_nonlinear_perf, lowest_nonlinear_freq;
+	u32 boost_ratio, lowest_nonlinear_ratio;
+	struct cppc_perf_caps cppc_perf;
+
+
+	ret = cppc_get_perf_caps(cpudata->cpu, &cppc_perf);
+	if (ret)
+		return ret;
+
+	if (quirks && quirks->lowest_freq)
+		min_freq = quirks->lowest_freq * 1000;
+	else
+		min_freq = cppc_perf.lowest_freq * 1000;
+
+	if (quirks && quirks->nominal_freq)
+		nominal_freq = quirks->nominal_freq ;
+	else
+		nominal_freq = cppc_perf.nominal_freq;
+
+	nominal_perf = READ_ONCE(cpudata->nominal_perf);
+
+	highest_perf = READ_ONCE(cpudata->highest_perf);
+	boost_ratio = div_u64(highest_perf << SCHED_CAPACITY_SHIFT, nominal_perf);
+	max_freq = (nominal_freq * boost_ratio >> SCHED_CAPACITY_SHIFT) * 1000;
+
+	lowest_nonlinear_perf = READ_ONCE(cpudata->lowest_nonlinear_perf);
+	lowest_nonlinear_ratio = div_u64(lowest_nonlinear_perf << SCHED_CAPACITY_SHIFT,
+					 nominal_perf);
+	lowest_nonlinear_freq = (nominal_freq * lowest_nonlinear_ratio >> SCHED_CAPACITY_SHIFT) * 1000;
+
+	WRITE_ONCE(cpudata->min_freq, min_freq);
+	WRITE_ONCE(cpudata->lowest_nonlinear_freq, lowest_nonlinear_freq);
+	WRITE_ONCE(cpudata->nominal_freq, nominal_freq);
+	WRITE_ONCE(cpudata->max_freq, max_freq);
+
+	return 0;
+}
+
+/*
+ * Set amd-pstate preferred core enable can't be done directly from cpufreq callbacks
+ * due to locking, so queue the work for later.
+ */
+static void amd_pstste_sched_prefcore_workfn(struct work_struct *work)
+{
+	sched_set_itmt_support();
+}
+static DECLARE_WORK(sched_prefcore_work, amd_pstste_sched_prefcore_workfn);
+
+/*
+ * Get the highest performance register value.
+ * @cpu: CPU from which to get highest performance.
+ * @highest_perf: Return address.
+ *
+ * Return: 0 for success, -EIO otherwise.
+ */
+static int amd_pstate_get_highest_perf(int cpu, u32 *highest_perf)
+{
+	int ret;
+
+	if (boot_cpu_has(X86_FEATURE_CPPC)) {
+		u64 cap1;
+
+		ret = rdmsrl_safe_on_cpu(cpu, MSR_AMD_CPPC_CAP1, &cap1);
+		if (ret)
+			return ret;
+		WRITE_ONCE(*highest_perf, AMD_CPPC_HIGHEST_PERF(cap1));
+	} else {
+		u64 cppc_highest_perf;
+
+		ret = cppc_get_highest_perf(cpu, &cppc_highest_perf);
+		if (ret)
+			return ret;
+		WRITE_ONCE(*highest_perf, cppc_highest_perf);
+	}
+
+	return (ret);
+}
+
+#define CPPC_MAX_PERF	U8_MAX
+
+static void amd_pstate_init_prefcore(struct amd_cpudata *cpudata)
+{
+	int ret, prio;
+	u32 highest_perf;
+
+	ret = amd_pstate_get_highest_perf(cpudata->cpu, &highest_perf);
+	if (ret)
+		return;
+
+	cpudata->hw_prefcore = true;
+	/* check if CPPC preferred core feature is enabled*/
+	if (highest_perf < CPPC_MAX_PERF)
+		prio = (int)highest_perf;
+	else {
+		pr_debug("AMD CPPC preferred core is unsupported!\n");
+		cpudata->hw_prefcore = false;
+		return;
+	}
+
+	if (!amd_pstate_prefcore)
+		return;
+
+	/*
+	 * The priorities can be set regardless of whether or not
+	 * sched_set_itmt_support(true) has been called and it is valid to
+	 * update them at any time after it has been called.
+	 */
+	sched_set_itmt_core_prio(prio, cpudata->cpu);
+
+	schedule_work(&sched_prefcore_work);
+}
+
 static int amd_pstate_cpu_init(struct cpufreq_policy *policy)
 {
 	int min_freq, max_freq, nominal_freq, lowest_nonlinear_freq, ret;
@@ -727,10 +899,16 @@
 
 	cpudata->cpu = policy->cpu;
 
+	amd_pstate_init_prefcore(cpudata);
+
 	ret = amd_pstate_init_perf(cpudata);
 	if (ret)
 		goto free_cpudata1;
 
+	ret = amd_pstate_init_freq(cpudata);
+	if (ret)
+		goto free_cpudata1;
+
 	min_freq = amd_get_min_freq(cpudata);
 	max_freq = amd_get_max_freq(cpudata);
 	nominal_freq = amd_get_nominal_freq(cpudata);
@@ -772,13 +950,8 @@
 		goto free_cpudata2;
 	}
 
-	/* Initial processor data capability frequencies */
-	cpudata->max_freq = max_freq;
-	cpudata->min_freq = min_freq;
 	cpudata->max_limit_freq = max_freq;
 	cpudata->min_limit_freq = min_freq;
-	cpudata->nominal_freq = nominal_freq;
-	cpudata->lowest_nonlinear_freq = lowest_nonlinear_freq;
 
 	policy->driver_data = cpudata;
 
@@ -877,6 +1050,17 @@
 	return sysfs_emit(buf, "%u\n", perf);
 }
 
+static ssize_t show_amd_pstate_hw_prefcore(struct cpufreq_policy *policy,
+					   char *buf)
+{
+	bool hw_prefcore;
+	struct amd_cpudata *cpudata = policy->driver_data;
+
+	hw_prefcore = READ_ONCE(cpudata->hw_prefcore);
+
+	return sysfs_emit(buf, "%s\n", str_enabled_disabled(hw_prefcore));
+}
+
 static ssize_t show_energy_performance_available_preferences(
 				struct cpufreq_policy *policy, char *buf)
 {
@@ -950,11 +1134,21 @@
 		return -EINVAL;
 
 	cppc_state = mode;
+
+	ret = amd_pstate_enable(true);
+	if (ret) {
+		pr_err("failed to enable cppc during amd-pstate driver registration, return %d\n",
+		       ret);
+		amd_pstate_driver_cleanup();
+		return ret;
+	}
+
 	ret = cpufreq_register_driver(current_pstate_driver);
 	if (ret) {
 		amd_pstate_driver_cleanup();
 		return ret;
 	}
+
 	return 0;
 }
 
@@ -1074,18 +1268,27 @@
 	return ret < 0 ? ret : count;
 }
 
+static ssize_t prefcore_show(struct device *dev,
+			     struct device_attribute *attr, char *buf)
+{
+	return sysfs_emit(buf, "%s\n", str_enabled_disabled(amd_pstate_prefcore));
+}
+
 cpufreq_freq_attr_ro(amd_pstate_max_freq);
 cpufreq_freq_attr_ro(amd_pstate_lowest_nonlinear_freq);
 
 cpufreq_freq_attr_ro(amd_pstate_highest_perf);
+cpufreq_freq_attr_ro(amd_pstate_hw_prefcore);
 cpufreq_freq_attr_rw(energy_performance_preference);
 cpufreq_freq_attr_ro(energy_performance_available_preferences);
 static DEVICE_ATTR_RW(status);
+static DEVICE_ATTR_RO(prefcore);
 
 static struct freq_attr *amd_pstate_attr[] = {
 	&amd_pstate_max_freq,
 	&amd_pstate_lowest_nonlinear_freq,
 	&amd_pstate_highest_perf,
+	&amd_pstate_hw_prefcore,
 	NULL,
 };
 
@@ -1093,6 +1296,7 @@
 	&amd_pstate_max_freq,
 	&amd_pstate_lowest_nonlinear_freq,
 	&amd_pstate_highest_perf,
+	&amd_pstate_hw_prefcore,
 	&energy_performance_preference,
 	&energy_performance_available_preferences,
 	NULL,
@@ -1100,6 +1304,7 @@
 
 static struct attribute *pstate_global_attributes[] = {
 	&dev_attr_status.attr,
+	&dev_attr_prefcore.attr,
 	NULL
 };
 
@@ -1151,10 +1356,16 @@
 	cpudata->cpu = policy->cpu;
 	cpudata->epp_policy = 0;
 
+	amd_pstate_init_prefcore(cpudata);
+
 	ret = amd_pstate_init_perf(cpudata);
 	if (ret)
 		goto free_cpudata1;
 
+	ret = amd_pstate_init_freq(cpudata);
+	if (ret)
+		goto free_cpudata1;
+
 	min_freq = amd_get_min_freq(cpudata);
 	max_freq = amd_get_max_freq(cpudata);
 	nominal_freq = amd_get_nominal_freq(cpudata);
@@ -1171,15 +1382,9 @@
 	/* It will be updated by governor */
 	policy->cur = policy->cpuinfo.min_freq;
 
-	/* Initial processor data capability frequencies */
-	cpudata->max_freq = max_freq;
-	cpudata->min_freq = min_freq;
-	cpudata->nominal_freq = nominal_freq;
-	cpudata->lowest_nonlinear_freq = lowest_nonlinear_freq;
-
 	policy->driver_data = cpudata;
 
-	cpudata->epp_cached = amd_pstate_get_epp(cpudata, 0);
+	cpudata->epp_cached = cpudata->epp_default = amd_pstate_get_epp(cpudata, 0);
 
 	policy->min = policy->cpuinfo.min_freq;
 	policy->max = policy->cpuinfo.max_freq;
@@ -1216,6 +1421,13 @@
 
 static int amd_pstate_epp_cpu_exit(struct cpufreq_policy *policy)
 {
+	struct amd_cpudata *cpudata = policy->driver_data;
+
+	if (cpudata) {
+		kfree(cpudata);
+		policy->driver_data = NULL;
+	}
+
 	pr_debug("CPU %d exiting\n", policy->cpu);
 	return 0;
 }
@@ -1242,7 +1454,7 @@
 	value = READ_ONCE(cpudata->cppc_req_cached);
 
 	if (cpudata->policy == CPUFREQ_POLICY_PERFORMANCE)
-		min_perf = max_perf;
+		min_perf = min(cpudata->nominal_perf, max_perf);
 
 	/* Initial min/max values for CPPC Performance Controls Register */
 	value &= ~AMD_CPPC_MIN_PERF(~0L);
@@ -1486,8 +1698,18 @@
 	if (cpufreq_get_current_driver())
 		return -EEXIST;
 
-	switch (cppc_state) {
-	case AMD_PSTATE_UNDEFINED:
+	quirks = NULL;
+
+	/* check if this machine need CPPC quirks */
+	dmi_check_system(amd_pstate_quirks_table);
+
+	/*
+	* determine the driver mode from the command line or kernel config.
+	* If no command line input is provided, cppc_state will be AMD_PSTATE_UNDEFINED.
+	* command line options will override the kernel config settings.
+	*/
+
+	if (cppc_state == AMD_PSTATE_UNDEFINED) {
 		/* Disable on the following configs by default:
 		 * 1. Undefined platforms
 		 * 2. Server platforms
@@ -1499,15 +1721,20 @@
 			pr_info("driver load is disabled, boot with specific mode to enable this\n");
 			return -ENODEV;
 		}
-		ret = amd_pstate_set_driver(CONFIG_X86_AMD_PSTATE_DEFAULT_MODE);
-		if (ret)
-			return ret;
-		break;
+		/* get driver mode from kernel config option [1:4] */
+		cppc_state = CONFIG_X86_AMD_PSTATE_DEFAULT_MODE;
+	}
+
+	switch (cppc_state) {
 	case AMD_PSTATE_DISABLE:
+		pr_info("driver load is disabled, boot with specific mode to enable this\n");
 		return -ENODEV;
 	case AMD_PSTATE_PASSIVE:
 	case AMD_PSTATE_ACTIVE:
 	case AMD_PSTATE_GUIDED:
+		ret = amd_pstate_set_driver(cppc_state);
+		if (ret)
+			return ret;
 		break;
 	default:
 		return -EINVAL;
@@ -1528,7 +1755,7 @@
 	/* enable amd pstate feature */
 	ret = amd_pstate_enable(true);
 	if (ret) {
-		pr_err("failed to enable with return %d\n", ret);
+		pr_err("failed to enable driver mode(%d)\n", cppc_state);
 		return ret;
 	}
 
@@ -1567,7 +1794,17 @@
 
 	return amd_pstate_set_driver(mode_idx);
 }
+
+static int __init amd_prefcore_param(char *str)
+{
+	if (!strcmp(str, "disable"))
+		amd_pstate_prefcore = false;
+
+	return 0;
+}
+
 early_param("amd_pstate", amd_pstate_param);
+early_param("amd_prefcore", amd_prefcore_param);
 
 MODULE_AUTHOR("Huang Rui <ray.huang@amd.com>");
 MODULE_DESCRIPTION("AMD Processor P-state Frequency Driver");
--- linux-qcom-6.8.0.orig/drivers/cpufreq/amd-pstate.h
+++ linux-qcom-6.8.0/drivers/cpufreq/amd-pstate.h
@@ -0,0 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2022 Advanced Micro Devices, Inc.
+ *
+ * Author: Meng Li <li.meng@amd.com>
+ */
+
+#ifndef _LINUX_AMD_PSTATE_H
+#define _LINUX_AMD_PSTATE_H
+
+#include <linux/pm_qos.h>
+
+/*********************************************************************
+ *                        AMD P-state INTERFACE                       *
+ *********************************************************************/
+/**
+ * struct  amd_aperf_mperf
+ * @aperf: actual performance frequency clock count
+ * @mperf: maximum performance frequency clock count
+ * @tsc:   time stamp counter
+ */
+struct amd_aperf_mperf {
+	u64 aperf;
+	u64 mperf;
+	u64 tsc;
+};
+
+/**
+ * struct amd_cpudata - private CPU data for AMD P-State
+ * @cpu: CPU number
+ * @req: constraint request to apply
+ * @cppc_req_cached: cached performance request hints
+ * @highest_perf: the maximum performance an individual processor may reach,
+ *		  assuming ideal conditions
+ * @nominal_perf: the maximum sustained performance level of the processor,
+ *		  assuming ideal operating conditions
+ * @lowest_nonlinear_perf: the lowest performance level at which nonlinear power
+ *			   savings are achieved
+ * @lowest_perf: the absolute lowest performance level of the processor
+ * @max_freq: the frequency that mapped to highest_perf
+ * @min_freq: the frequency that mapped to lowest_perf
+ * @nominal_freq: the frequency that mapped to nominal_perf
+ * @lowest_nonlinear_freq: the frequency that mapped to lowest_nonlinear_perf
+ * @cur: Difference of Aperf/Mperf/tsc count between last and current sample
+ * @prev: Last Aperf/Mperf/tsc count value read from register
+ * @freq: current cpu frequency value
+ * @boost_supported: check whether the Processor or SBIOS supports boost mode
+ * @hw_prefcore: check whether HW supports preferred core featue.
+ * 		  Only when hw_prefcore and early prefcore param are true,
+ * 		  AMD P-State driver supports preferred core featue.
+ * @epp_policy: Last saved policy used to set energy-performance preference
+ * @epp_cached: Cached CPPC energy-performance preference value
+ * @policy: Cpufreq policy value
+ * @cppc_cap1_cached Cached MSR_AMD_CPPC_CAP1 register value
+ *
+ * The amd_cpudata is key private data for each CPU thread in AMD P-State, and
+ * represents all the attributes and goals that AMD P-State requests at runtime.
+ */
+struct amd_cpudata {
+	int	cpu;
+
+	struct	freq_qos_request req[2];
+	u64	cppc_req_cached;
+
+	u32	highest_perf;
+	u32	nominal_perf;
+	u32	lowest_nonlinear_perf;
+	u32	lowest_perf;
+	u32     min_limit_perf;
+	u32     max_limit_perf;
+	u32     min_limit_freq;
+	u32     max_limit_freq;
+
+	u32	max_freq;
+	u32	min_freq;
+	u32	nominal_freq;
+	u32	lowest_nonlinear_freq;
+
+	struct amd_aperf_mperf cur;
+	struct amd_aperf_mperf prev;
+
+	u64	freq;
+	bool	boost_supported;
+	bool	hw_prefcore;
+
+	/* EPP feature related attributes*/
+	s16	epp_policy;
+	s16	epp_cached;
+	u32	policy;
+	u64	cppc_cap1_cached;
+	bool	suspended;
+	s16	epp_default;
+};
+
+#endif /* _LINUX_AMD_PSTATE_H */
--- linux-qcom-6.8.0.orig/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ linux-qcom-6.8.0/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -481,7 +481,12 @@
 static unsigned int brcm_avs_cpufreq_get(unsigned int cpu)
 {
 	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
-	struct private_data *priv = policy->driver_data;
+	struct private_data *priv;
+
+	if (!policy)
+		return 0;
+
+	priv = policy->driver_data;
 
 	cpufreq_cpu_put(policy);
 
--- linux-qcom-6.8.0.orig/drivers/cpufreq/cppc_cpufreq.c
+++ linux-qcom-6.8.0/drivers/cpufreq/cppc_cpufreq.c
@@ -118,6 +118,9 @@
 
 	perf = cppc_perf_from_fbctrs(cpu_data, &cppc_fi->prev_perf_fb_ctrs,
 				     &fb_ctrs);
+	if (!perf)
+		return;
+
 	cppc_fi->prev_perf_fb_ctrs = fb_ctrs;
 
 	perf <<= SCHED_CAPACITY_SHIFT;
@@ -425,6 +428,9 @@
 	struct cppc_cpudata *cpu_data;
 
 	policy = cpufreq_cpu_get_raw(cpu_dev->id);
+	if (!policy)
+		return -EINVAL;
+
 	cpu_data = policy->driver_data;
 	perf_caps = &cpu_data->perf_caps;
 	max_cap = arch_scale_cpu_capacity(cpu_dev->id);
@@ -492,6 +498,9 @@
 	int step;
 
 	policy = cpufreq_cpu_get_raw(cpu_dev->id);
+	if (!policy)
+		return -EINVAL;
+
 	cpu_data = policy->driver_data;
 	perf_caps = &cpu_data->perf_caps;
 	max_cap = arch_scale_cpu_capacity(cpu_dev->id);
@@ -730,35 +739,72 @@
 	delta_delivered = get_delta(fb_ctrs_t1->delivered,
 				    fb_ctrs_t0->delivered);
 
-	/* Check to avoid divide-by zero and invalid delivered_perf */
+	/*
+	 * Avoid divide-by zero and unchanged feedback counters.
+	 * Leave it for callers to handle.
+	 */
 	if (!delta_reference || !delta_delivered)
-		return cpu_data->perf_ctrls.desired_perf;
+		return 0;
 
 	return (reference_perf * delta_delivered) / delta_reference;
 }
 
+static int cppc_get_perf_ctrs_sample(int cpu,
+				     struct cppc_perf_fb_ctrs *fb_ctrs_t0,
+				     struct cppc_perf_fb_ctrs *fb_ctrs_t1)
+{
+	int ret;
+
+	ret = cppc_get_perf_ctrs(cpu, fb_ctrs_t0);
+	if (ret)
+		return ret;
+
+	udelay(2); /* 2usec delay between sampling */
+
+	return cppc_get_perf_ctrs(cpu, fb_ctrs_t1);
+}
+
 static unsigned int cppc_cpufreq_get_rate(unsigned int cpu)
 {
 	struct cppc_perf_fb_ctrs fb_ctrs_t0 = {0}, fb_ctrs_t1 = {0};
 	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
-	struct cppc_cpudata *cpu_data = policy->driver_data;
+	struct cppc_cpudata *cpu_data;
 	u64 delivered_perf;
 	int ret;
 
-	cpufreq_cpu_put(policy);
+	if (!policy)
+		return -ENODEV;
 
-	ret = cppc_get_perf_ctrs(cpu, &fb_ctrs_t0);
-	if (ret)
-		return 0;
+	cpu_data = policy->driver_data;
 
-	udelay(2); /* 2usec delay between sampling */
+	cpufreq_cpu_put(policy);
 
-	ret = cppc_get_perf_ctrs(cpu, &fb_ctrs_t1);
-	if (ret)
-		return 0;
+	ret = cppc_get_perf_ctrs_sample(cpu, &fb_ctrs_t0, &fb_ctrs_t1);
+	if (ret) {
+		if (ret == -EFAULT)
+			/* Any of the associated CPPC regs is 0. */
+			goto out_invalid_counters;
+		else
+			return 0;
+	}
 
 	delivered_perf = cppc_perf_from_fbctrs(cpu_data, &fb_ctrs_t0,
 					       &fb_ctrs_t1);
+	if (!delivered_perf)
+		goto out_invalid_counters;
+
+	return cppc_perf_to_khz(&cpu_data->perf_caps, delivered_perf);
+
+out_invalid_counters:
+	/*
+	 * Feedback counters could be unchanged or 0 when a cpu enters a
+	 * low-power idle state, e.g. clock-gated or power-gated.
+	 * Use desired perf for reflecting frequency.  Get the latest register
+	 * value first as some platforms may update the actual delivered perf
+	 * there; if failed, resort to the cached desired perf.
+	 */
+	if (cppc_get_desired_perf(cpu, &delivered_perf))
+		delivered_perf = cpu_data->perf_ctrls.desired_perf;
 
 	return cppc_perf_to_khz(&cpu_data->perf_caps, delivered_perf);
 }
@@ -822,10 +868,15 @@
 static unsigned int hisi_cppc_cpufreq_get_rate(unsigned int cpu)
 {
 	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
-	struct cppc_cpudata *cpu_data = policy->driver_data;
+	struct cppc_cpudata *cpu_data;
 	u64 desired_perf;
 	int ret;
 
+	if (!policy)
+		return -ENODEV;
+
+	cpu_data = policy->driver_data;
+
 	cpufreq_cpu_put(policy);
 
 	ret = cppc_get_desired_perf(cpu, &desired_perf);
--- linux-qcom-6.8.0.orig/drivers/cpufreq/cpufreq-dt.c
+++ linux-qcom-6.8.0/drivers/cpufreq/cpufreq-dt.c
@@ -208,7 +208,7 @@
 	if (!priv)
 		return -ENOMEM;
 
-	if (!alloc_cpumask_var(&priv->cpus, GFP_KERNEL))
+	if (!zalloc_cpumask_var(&priv->cpus, GFP_KERNEL))
 		return -ENOMEM;
 
 	cpumask_set_cpu(cpu, priv->cpus);
--- linux-qcom-6.8.0.orig/drivers/cpufreq/cpufreq.c
+++ linux-qcom-6.8.0/drivers/cpufreq/cpufreq.c
@@ -644,14 +644,16 @@
 	if (policy->boost_enabled == enable)
 		return count;
 
+	policy->boost_enabled = enable;
+
 	cpus_read_lock();
 	ret = cpufreq_driver->set_boost(policy, enable);
 	cpus_read_unlock();
 
-	if (ret)
+	if (ret) {
+		policy->boost_enabled = !policy->boost_enabled;
 		return ret;
-
-	policy->boost_enabled = enable;
+	}
 
 	return count;
 }
@@ -1419,6 +1421,10 @@
 			goto out_free_policy;
 		}
 
+		/* Let the per-policy boost flag mirror the cpufreq_driver boost during init */
+		if (cpufreq_boost_enabled() && policy_has_boost_freq(policy))
+			policy->boost_enabled = true;
+
 		/*
 		 * The initialization has succeeded and the policy is online.
 		 * If there is a problem with its frequency table, take it
@@ -1571,7 +1577,8 @@
 	if (cpufreq_driver->ready)
 		cpufreq_driver->ready(policy);
 
-	if (cpufreq_thermal_control_enabled(cpufreq_driver))
+	/* Register cpufreq cooling only for a new policy */
+	if (new_policy && cpufreq_thermal_control_enabled(cpufreq_driver))
 		policy->cdev = of_cpufreq_cooling_register(policy);
 
 	pr_debug("initialization complete\n");
@@ -1655,11 +1662,6 @@
 	else
 		policy->last_policy = policy->policy;
 
-	if (cpufreq_thermal_control_enabled(cpufreq_driver)) {
-		cpufreq_cooling_unregister(policy->cdev);
-		policy->cdev = NULL;
-	}
-
 	if (has_target())
 		cpufreq_exit_governor(policy);
 
@@ -1669,10 +1671,13 @@
 	 */
 	if (cpufreq_driver->offline) {
 		cpufreq_driver->offline(policy);
-	} else if (cpufreq_driver->exit) {
-		cpufreq_driver->exit(policy);
-		policy->freq_table = NULL;
+		return;
 	}
+
+	if (cpufreq_driver->exit)
+		cpufreq_driver->exit(policy);
+
+	policy->freq_table = NULL;
 }
 
 static int cpufreq_offline(unsigned int cpu)
@@ -1720,8 +1725,17 @@
 		return;
 	}
 
+	/*
+	 * Unregister cpufreq cooling once all the CPUs of the policy are
+	 * removed.
+	 */
+	if (cpufreq_thermal_control_enabled(cpufreq_driver)) {
+		cpufreq_cooling_unregister(policy->cdev);
+		policy->cdev = NULL;
+	}
+
 	/* We did light-weight exit earlier, do full tear down now */
-	if (cpufreq_driver->offline)
+	if (cpufreq_driver->offline && cpufreq_driver->exit)
 		cpufreq_driver->exit(policy);
 
 	up_write(&policy->rwsem);
@@ -2755,11 +2769,12 @@
 
 	cpus_read_lock();
 	for_each_active_policy(policy) {
+		policy->boost_enabled = state;
 		ret = cpufreq_driver->set_boost(policy, state);
-		if (ret)
+		if (ret) {
+			policy->boost_enabled = !policy->boost_enabled;
 			goto err_reset_state;
-
-		policy->boost_enabled = state;
+		}
 	}
 	cpus_read_unlock();
 
@@ -2841,6 +2856,20 @@
 	return 0;
 }
 
+static char cpufreq_driver_name[CPUFREQ_NAME_LEN];
+
+static int __init cpufreq_driver_setup(char *str)
+{
+	strscpy(cpufreq_driver_name, str, CPUFREQ_NAME_LEN);
+	return 1;
+}
+
+/*
+ * Set this name to only allow one specific cpu freq driver, e.g.,
+ * cpufreq_driver=powernow-k8
+ */
+__setup("cpufreq_driver=", cpufreq_driver_setup);
+
 /**
  * cpufreq_register_driver - register a CPU Frequency driver
  * @driver_data: A struct cpufreq_driver containing the values#
@@ -2876,7 +2905,13 @@
 		 (driver_data->adjust_perf && !driver_data->fast_switch))
 		return -EINVAL;
 
-	pr_debug("trying to register driver %s\n", driver_data->name);
+	pr_debug("trying to register driver %s, cpufreq_driver=%s\n",
+		driver_data->name, cpufreq_driver_name);
+
+	if (cpufreq_driver_name[0])
+		if (!driver_data->name ||
+			strcmp(cpufreq_driver_name, driver_data->name))
+				return -EINVAL;
 
 	/* Protect against concurrent CPU online/offline. */
 	cpus_read_lock();
--- linux-qcom-6.8.0.orig/drivers/cpufreq/freq_table.c
+++ linux-qcom-6.8.0/drivers/cpufreq/freq_table.c
@@ -40,7 +40,7 @@
 	cpufreq_for_each_valid_entry(pos, table) {
 		freq = pos->frequency;
 
-		if (!cpufreq_boost_enabled()
+		if ((!cpufreq_boost_enabled() || !policy->boost_enabled)
 		    && (pos->flags & CPUFREQ_BOOST_FREQ))
 			continue;
 
--- linux-qcom-6.8.0.orig/drivers/cpufreq/intel_pstate.c
+++ linux-qcom-6.8.0/drivers/cpufreq/intel_pstate.c
@@ -25,6 +25,7 @@
 #include <linux/acpi.h>
 #include <linux/vmalloc.h>
 #include <linux/pm_qos.h>
+#include <linux/bitfield.h>
 #include <trace/events/power.h>
 
 #include <asm/cpu.h>
@@ -359,15 +360,14 @@
 	int ret;
 
 	ret = cppc_get_perf_caps(cpu, &cppc_perf);
-	if (ret)
-		return;
-
 	/*
-	 * On some systems with overclocking enabled, CPPC.highest_perf is hardcoded to 0xff.
-	 * In this case we can't use CPPC.highest_perf to enable ITMT.
-	 * In this case we can look at MSR_HWP_CAPABILITIES bits [8:0] to decide.
+	 * If CPPC is not available, fall back to MSR_HWP_CAPABILITIES bits [8:0].
+	 *
+	 * Also, on some systems with overclocking enabled, CPPC.highest_perf is
+	 * hardcoded to 0xff, so CPPC.highest_perf cannot be used to enable ITMT.
+	 * Fall back to MSR_HWP_CAPABILITIES then too.
 	 */
-	if (cppc_perf.highest_perf == CPPC_MAX_PERF)
+	if (ret || cppc_perf.highest_perf == CPPC_MAX_PERF)
 		cppc_perf.highest_perf = HWP_HIGHEST_PERF(READ_ONCE(all_cpu_data[cpu]->hwp_cap_cached));
 
 	/*
@@ -1632,24 +1632,31 @@
 	wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_STATUS, 0);
 }
 
-static DEFINE_SPINLOCK(hwp_notify_lock);
+static DEFINE_RAW_SPINLOCK(hwp_notify_lock);
 static cpumask_t hwp_intr_enable_mask;
 
+#define HWP_GUARANTEED_PERF_CHANGE_STATUS      BIT(0)
+#define HWP_HIGHEST_PERF_CHANGE_STATUS         BIT(3)
+
 void notify_hwp_interrupt(void)
 {
 	unsigned int this_cpu = smp_processor_id();
 	struct cpudata *cpudata;
+	u64 value, status_mask;
 	unsigned long flags;
-	u64 value;
 
 	if (!READ_ONCE(hwp_active) || !boot_cpu_has(X86_FEATURE_HWP_NOTIFY))
 		return;
 
+	status_mask = HWP_GUARANTEED_PERF_CHANGE_STATUS;
+	if (cpu_feature_enabled(X86_FEATURE_HWP_HIGHEST_PERF_CHANGE))
+		status_mask |= HWP_HIGHEST_PERF_CHANGE_STATUS;
+
 	rdmsrl_safe(MSR_HWP_STATUS, &value);
-	if (!(value & 0x01))
+	if (!(value & status_mask))
 		return;
 
-	spin_lock_irqsave(&hwp_notify_lock, flags);
+	raw_spin_lock_irqsave(&hwp_notify_lock, flags);
 
 	if (!cpumask_test_cpu(this_cpu, &hwp_intr_enable_mask))
 		goto ack_intr;
@@ -1673,13 +1680,13 @@
 
 	schedule_delayed_work(&cpudata->hwp_notify_work, msecs_to_jiffies(10));
 
-	spin_unlock_irqrestore(&hwp_notify_lock, flags);
+	raw_spin_unlock_irqrestore(&hwp_notify_lock, flags);
 
 	return;
 
 ack_intr:
 	wrmsrl_safe(MSR_HWP_STATUS, 0);
-	spin_unlock_irqrestore(&hwp_notify_lock, flags);
+	raw_spin_unlock_irqrestore(&hwp_notify_lock, flags);
 }
 
 static void intel_pstate_disable_hwp_interrupt(struct cpudata *cpudata)
@@ -1692,25 +1699,33 @@
 	/* wrmsrl_on_cpu has to be outside spinlock as this can result in IPC */
 	wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_INTERRUPT, 0x00);
 
-	spin_lock_irqsave(&hwp_notify_lock, flags);
+	raw_spin_lock_irqsave(&hwp_notify_lock, flags);
 	if (cpumask_test_and_clear_cpu(cpudata->cpu, &hwp_intr_enable_mask))
 		cancel_delayed_work(&cpudata->hwp_notify_work);
-	spin_unlock_irqrestore(&hwp_notify_lock, flags);
+	raw_spin_unlock_irqrestore(&hwp_notify_lock, flags);
 }
 
+#define HWP_GUARANTEED_PERF_CHANGE_REQ BIT(0)
+#define HWP_HIGHEST_PERF_CHANGE_REQ    BIT(2)
+
 static void intel_pstate_enable_hwp_interrupt(struct cpudata *cpudata)
 {
-	/* Enable HWP notification interrupt for guaranteed performance change */
+	/* Enable HWP notification interrupt for performance change */
 	if (boot_cpu_has(X86_FEATURE_HWP_NOTIFY)) {
+		u64 interrupt_mask = HWP_GUARANTEED_PERF_CHANGE_REQ;
+
 		unsigned long flags;
 
-		spin_lock_irqsave(&hwp_notify_lock, flags);
+		raw_spin_lock_irqsave(&hwp_notify_lock, flags);
 		INIT_DELAYED_WORK(&cpudata->hwp_notify_work, intel_pstate_notify_work);
 		cpumask_set_cpu(cpudata->cpu, &hwp_intr_enable_mask);
-		spin_unlock_irqrestore(&hwp_notify_lock, flags);
+		raw_spin_unlock_irqrestore(&hwp_notify_lock, flags);
+
+		if (cpu_feature_enabled(X86_FEATURE_HWP_HIGHEST_PERF_CHANGE))
+			interrupt_mask |= HWP_HIGHEST_PERF_CHANGE_REQ;
 
 		/* wrmsrl_on_cpu has to be outside spinlock as this can result in IPC */
-		wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_INTERRUPT, 0x01);
+		wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_INTERRUPT, interrupt_mask);
 		wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_STATUS, 0);
 	}
 }
@@ -2404,52 +2419,56 @@
 	.get_val = core_get_val,
 };
 
-#define X86_MATCH(model, policy)					 \
-	X86_MATCH_VENDOR_FAM_MODEL_FEATURE(INTEL, 6, INTEL_FAM6_##model, \
-					   X86_FEATURE_APERFMPERF, &policy)
+#define X86_MATCH(vfm, policy)					 \
+	X86_MATCH_VFM_FEATURE(vfm, X86_FEATURE_APERFMPERF, &policy)
 
 static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
-	X86_MATCH(SANDYBRIDGE,		core_funcs),
-	X86_MATCH(SANDYBRIDGE_X,	core_funcs),
-	X86_MATCH(ATOM_SILVERMONT,	silvermont_funcs),
-	X86_MATCH(IVYBRIDGE,		core_funcs),
-	X86_MATCH(HASWELL,		core_funcs),
-	X86_MATCH(BROADWELL,		core_funcs),
-	X86_MATCH(IVYBRIDGE_X,		core_funcs),
-	X86_MATCH(HASWELL_X,		core_funcs),
-	X86_MATCH(HASWELL_L,		core_funcs),
-	X86_MATCH(HASWELL_G,		core_funcs),
-	X86_MATCH(BROADWELL_G,		core_funcs),
-	X86_MATCH(ATOM_AIRMONT,		airmont_funcs),
-	X86_MATCH(SKYLAKE_L,		core_funcs),
-	X86_MATCH(BROADWELL_X,		core_funcs),
-	X86_MATCH(SKYLAKE,		core_funcs),
-	X86_MATCH(BROADWELL_D,		core_funcs),
-	X86_MATCH(XEON_PHI_KNL,		knl_funcs),
-	X86_MATCH(XEON_PHI_KNM,		knl_funcs),
-	X86_MATCH(ATOM_GOLDMONT,	core_funcs),
-	X86_MATCH(ATOM_GOLDMONT_PLUS,	core_funcs),
-	X86_MATCH(SKYLAKE_X,		core_funcs),
-	X86_MATCH(COMETLAKE,		core_funcs),
-	X86_MATCH(ICELAKE_X,		core_funcs),
-	X86_MATCH(TIGERLAKE,		core_funcs),
-	X86_MATCH(SAPPHIRERAPIDS_X,	core_funcs),
-	X86_MATCH(EMERALDRAPIDS_X,      core_funcs),
+	X86_MATCH(INTEL_SANDYBRIDGE,		core_funcs),
+	X86_MATCH(INTEL_SANDYBRIDGE_X,		core_funcs),
+	X86_MATCH(INTEL_ATOM_SILVERMONT,	silvermont_funcs),
+	X86_MATCH(INTEL_IVYBRIDGE,		core_funcs),
+	X86_MATCH(INTEL_HASWELL,		core_funcs),
+	X86_MATCH(INTEL_BROADWELL,		core_funcs),
+	X86_MATCH(INTEL_IVYBRIDGE_X,		core_funcs),
+	X86_MATCH(INTEL_HASWELL_X,		core_funcs),
+	X86_MATCH(INTEL_HASWELL_L,		core_funcs),
+	X86_MATCH(INTEL_HASWELL_G,		core_funcs),
+	X86_MATCH(INTEL_BROADWELL_G,		core_funcs),
+	X86_MATCH(INTEL_ATOM_AIRMONT,		airmont_funcs),
+	X86_MATCH(INTEL_SKYLAKE_L,		core_funcs),
+	X86_MATCH(INTEL_BROADWELL_X,		core_funcs),
+	X86_MATCH(INTEL_SKYLAKE,		core_funcs),
+	X86_MATCH(INTEL_BROADWELL_D,		core_funcs),
+	X86_MATCH(INTEL_XEON_PHI_KNL,		knl_funcs),
+	X86_MATCH(INTEL_XEON_PHI_KNM,		knl_funcs),
+	X86_MATCH(INTEL_ATOM_GOLDMONT,		core_funcs),
+	X86_MATCH(INTEL_ATOM_GOLDMONT_PLUS,	core_funcs),
+	X86_MATCH(INTEL_SKYLAKE_X,		core_funcs),
+	X86_MATCH(INTEL_COMETLAKE,		core_funcs),
+	X86_MATCH(INTEL_ICELAKE_X,		core_funcs),
+	X86_MATCH(INTEL_TIGERLAKE,		core_funcs),
+	X86_MATCH(INTEL_SAPPHIRERAPIDS_X,	core_funcs),
+	X86_MATCH(INTEL_EMERALDRAPIDS_X,	core_funcs),
 	{}
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_pstate_cpu_ids);
 
 static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = {
-	X86_MATCH(BROADWELL_D,		core_funcs),
-	X86_MATCH(BROADWELL_X,		core_funcs),
-	X86_MATCH(SKYLAKE_X,		core_funcs),
-	X86_MATCH(ICELAKE_X,		core_funcs),
-	X86_MATCH(SAPPHIRERAPIDS_X,	core_funcs),
+	X86_MATCH(INTEL_BROADWELL_D,		core_funcs),
+	X86_MATCH(INTEL_BROADWELL_X,		core_funcs),
+	X86_MATCH(INTEL_SKYLAKE_X,		core_funcs),
+	X86_MATCH(INTEL_ICELAKE_X,		core_funcs),
+	X86_MATCH(INTEL_SAPPHIRERAPIDS_X,	core_funcs),
+	X86_MATCH(INTEL_EMERALDRAPIDS_X,	core_funcs),
+	X86_MATCH(INTEL_GRANITERAPIDS_D,	core_funcs),
+	X86_MATCH(INTEL_GRANITERAPIDS_X,	core_funcs),
+	X86_MATCH(INTEL_ATOM_CRESTMONT,		core_funcs),
+	X86_MATCH(INTEL_ATOM_CRESTMONT_X,	core_funcs),
 	{}
 };
 
 static const struct x86_cpu_id intel_pstate_cpu_ee_disable_ids[] = {
-	X86_MATCH(KABYLAKE,		core_funcs),
+	X86_MATCH(INTEL_KABYLAKE,		core_funcs),
 	{}
 };
 
@@ -3137,10 +3156,10 @@
 			if (intel_pstate_driver == &intel_pstate)
 				intel_pstate_clear_update_util_hook(cpu);
 
-			spin_lock(&hwp_notify_lock);
+			raw_spin_lock(&hwp_notify_lock);
 			kfree(all_cpu_data[cpu]);
 			WRITE_ONCE(all_cpu_data[cpu], NULL);
-			spin_unlock(&hwp_notify_lock);
+			raw_spin_unlock(&hwp_notify_lock);
 		}
 	}
 	cpus_read_unlock();
@@ -3388,14 +3407,13 @@
 
 #define INTEL_PSTATE_HWP_BROADWELL	0x01
 
-#define X86_MATCH_HWP(model, hwp_mode)					\
-	X86_MATCH_VENDOR_FAM_MODEL_FEATURE(INTEL, 6, INTEL_FAM6_##model, \
-					   X86_FEATURE_HWP, hwp_mode)
+#define X86_MATCH_HWP(vfm, hwp_mode)				\
+	X86_MATCH_VFM_FEATURE(vfm, X86_FEATURE_HWP, hwp_mode)
 
 static const struct x86_cpu_id hwp_support_ids[] __initconst = {
-	X86_MATCH_HWP(BROADWELL_X,	INTEL_PSTATE_HWP_BROADWELL),
-	X86_MATCH_HWP(BROADWELL_D,	INTEL_PSTATE_HWP_BROADWELL),
-	X86_MATCH_HWP(ANY,		0),
+	X86_MATCH_HWP(INTEL_BROADWELL_X,	INTEL_PSTATE_HWP_BROADWELL),
+	X86_MATCH_HWP(INTEL_BROADWELL_D,	INTEL_PSTATE_HWP_BROADWELL),
+	X86_MATCH_HWP(INTEL_ANY,		0),
 	{}
 };
 
@@ -3407,19 +3425,41 @@
 	return !!(value & 0x1);
 }
 
-static const struct x86_cpu_id intel_epp_balance_perf[] = {
+#define POWERSAVE_MASK			GENMASK(7, 0)
+#define BALANCE_POWER_MASK		GENMASK(15, 8)
+#define BALANCE_PERFORMANCE_MASK	GENMASK(23, 16)
+#define PERFORMANCE_MASK		GENMASK(31, 24)
+
+#define HWP_SET_EPP_VALUES(powersave, balance_power, balance_perf, performance) \
+	(FIELD_PREP_CONST(POWERSAVE_MASK, powersave) |\
+	 FIELD_PREP_CONST(BALANCE_POWER_MASK, balance_power) |\
+	 FIELD_PREP_CONST(BALANCE_PERFORMANCE_MASK, balance_perf) |\
+	 FIELD_PREP_CONST(PERFORMANCE_MASK, performance))
+
+#define HWP_SET_DEF_BALANCE_PERF_EPP(balance_perf) \
+	(HWP_SET_EPP_VALUES(HWP_EPP_POWERSAVE, HWP_EPP_BALANCE_POWERSAVE,\
+	 balance_perf, HWP_EPP_PERFORMANCE))
+
+static const struct x86_cpu_id intel_epp_default[] = {
 	/*
 	 * Set EPP value as 102, this is the max suggested EPP
 	 * which can result in one core turbo frequency for
 	 * AlderLake Mobile CPUs.
 	 */
-	X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, 102),
-	X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, 32),
+	X86_MATCH_VFM(INTEL_ALDERLAKE_L, HWP_SET_DEF_BALANCE_PERF_EPP(102)),
+	X86_MATCH_VFM(INTEL_SAPPHIRERAPIDS_X, HWP_SET_DEF_BALANCE_PERF_EPP(32)),
+	X86_MATCH_VFM(INTEL_EMERALDRAPIDS_X, HWP_SET_DEF_BALANCE_PERF_EPP(32)),
+	X86_MATCH_VFM(INTEL_GRANITERAPIDS_X, HWP_SET_DEF_BALANCE_PERF_EPP(32)),
+	X86_MATCH_VFM(INTEL_GRANITERAPIDS_D, HWP_SET_DEF_BALANCE_PERF_EPP(32)),
+	X86_MATCH_VFM(INTEL_METEORLAKE_L, HWP_SET_EPP_VALUES(HWP_EPP_POWERSAVE,
+		      179, 64, 16)),
+	X86_MATCH_VFM(INTEL_ARROWLAKE, HWP_SET_EPP_VALUES(HWP_EPP_POWERSAVE,
+		      179, 64, 16)),
 	{}
 };
 
 static const struct x86_cpu_id intel_hybrid_scaling_factor[] = {
-	X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L, HYBRID_SCALING_FACTOR_MTL),
+	X86_MATCH_VFM(INTEL_METEORLAKE_L, HYBRID_SCALING_FACTOR_MTL),
 	{}
 };
 
@@ -3512,11 +3552,24 @@
 	intel_pstate_sysfs_expose_params();
 
 	if (hwp_active) {
-		const struct x86_cpu_id *id = x86_match_cpu(intel_epp_balance_perf);
+		const struct x86_cpu_id *id = x86_match_cpu(intel_epp_default);
 		const struct x86_cpu_id *hybrid_id = x86_match_cpu(intel_hybrid_scaling_factor);
 
-		if (id)
-			epp_values[EPP_INDEX_BALANCE_PERFORMANCE] = id->driver_data;
+		if (id) {
+			epp_values[EPP_INDEX_POWERSAVE] =
+					FIELD_GET(POWERSAVE_MASK, id->driver_data);
+			epp_values[EPP_INDEX_BALANCE_POWERSAVE] =
+					FIELD_GET(BALANCE_POWER_MASK, id->driver_data);
+			epp_values[EPP_INDEX_BALANCE_PERFORMANCE] =
+					FIELD_GET(BALANCE_PERFORMANCE_MASK, id->driver_data);
+			epp_values[EPP_INDEX_PERFORMANCE] =
+					FIELD_GET(PERFORMANCE_MASK, id->driver_data);
+			pr_debug("Updated EPPs powersave:%x balanced power:%x balanced perf:%x performance:%x\n",
+				 epp_values[EPP_INDEX_POWERSAVE],
+				 epp_values[EPP_INDEX_BALANCE_POWERSAVE],
+				 epp_values[EPP_INDEX_BALANCE_PERFORMANCE],
+				 epp_values[EPP_INDEX_PERFORMANCE]);
+		}
 
 		if (hybrid_id) {
 			hybrid_scaling_factor = hybrid_id->driver_data;
--- linux-qcom-6.8.0.orig/drivers/cpufreq/loongson2_cpufreq.c
+++ linux-qcom-6.8.0/drivers/cpufreq/loongson2_cpufreq.c
@@ -154,7 +154,9 @@
 
 	ret = cpufreq_register_driver(&loongson2_cpufreq_driver);
 
-	if (!ret && !nowait) {
+	if (ret) {
+		platform_driver_unregister(&platform_driver);
+	} else if (!nowait) {
 		saved_cpu_wait = cpu_wait;
 		cpu_wait = loongson2_cpu_wait;
 	}
--- linux-qcom-6.8.0.orig/drivers/cpufreq/mediatek-cpufreq-hw.c
+++ linux-qcom-6.8.0/drivers/cpufreq/mediatek-cpufreq-hw.c
@@ -13,6 +13,7 @@
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
 #include <linux/slab.h>
 
 #define LUT_MAX_ENTRIES			32U
@@ -61,7 +62,7 @@
 
 	policy = cpufreq_cpu_get_raw(cpu_dev->id);
 	if (!policy)
-		return 0;
+		return -EINVAL;
 
 	data = policy->driver_data;
 
@@ -300,7 +301,23 @@
 static int mtk_cpufreq_hw_driver_probe(struct platform_device *pdev)
 {
 	const void *data;
-	int ret;
+	int ret, cpu;
+	struct device *cpu_dev;
+	struct regulator *cpu_reg;
+
+	/* Make sure that all CPU supplies are available before proceeding. */
+	for_each_possible_cpu(cpu) {
+		cpu_dev = get_cpu_device(cpu);
+		if (!cpu_dev)
+			return dev_err_probe(&pdev->dev, -EPROBE_DEFER,
+					     "Failed to get cpu%d device\n", cpu);
+
+		cpu_reg = devm_regulator_get(cpu_dev, "cpu");
+		if (IS_ERR(cpu_reg))
+			return dev_err_probe(&pdev->dev, PTR_ERR(cpu_reg),
+					     "CPU%d regulator get failed\n", cpu);
+	}
+
 
 	data = of_device_get_match_data(&pdev->dev);
 	if (!data)
--- linux-qcom-6.8.0.orig/drivers/cpufreq/qcom-cpufreq-nvmem.c
+++ linux-qcom-6.8.0/drivers/cpufreq/qcom-cpufreq-nvmem.c
@@ -480,23 +480,30 @@
 
 	drv = devm_kzalloc(&pdev->dev, struct_size(drv, cpus, num_possible_cpus()),
 		           GFP_KERNEL);
-	if (!drv)
+	if (!drv) {
+		of_node_put(np);
 		return -ENOMEM;
+	}
 
 	match = pdev->dev.platform_data;
 	drv->data = match->data;
-	if (!drv->data)
+	if (!drv->data) {
+		of_node_put(np);
 		return -ENODEV;
+	}
 
 	if (drv->data->get_version) {
 		speedbin_nvmem = of_nvmem_cell_get(np, NULL);
-		if (IS_ERR(speedbin_nvmem))
+		if (IS_ERR(speedbin_nvmem)) {
+			of_node_put(np);
 			return dev_err_probe(cpu_dev, PTR_ERR(speedbin_nvmem),
 					     "Could not get nvmem cell\n");
+		}
 
 		ret = drv->data->get_version(cpu_dev,
 							speedbin_nvmem, &pvs_name, drv);
 		if (ret) {
+			of_node_put(np);
 			nvmem_cell_put(speedbin_nvmem);
 			return ret;
 		}
--- linux-qcom-6.8.0.orig/drivers/cpufreq/scmi-cpufreq.c
+++ linux-qcom-6.8.0/drivers/cpufreq/scmi-cpufreq.c
@@ -62,9 +62,9 @@
 					     unsigned int target_freq)
 {
 	struct scmi_data *priv = policy->driver_data;
+	unsigned long freq = target_freq;
 
-	if (!perf_ops->freq_set(ph, priv->domain_id,
-				target_freq * 1000, true))
+	if (!perf_ops->freq_set(ph, priv->domain_id, freq * 1000, true))
 		return target_freq;
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/cpufreq/ti-cpufreq.c
+++ linux-qcom-6.8.0/drivers/cpufreq/ti-cpufreq.c
@@ -61,6 +61,9 @@
 	unsigned long efuse_shift;
 	unsigned long rev_offset;
 	bool multi_regulator;
+/* Backward compatibility hack: Might have missing syscon */
+#define TI_QUIRK_SYSCON_MAY_BE_MISSING	0x1
+	u8 quirks;
 };
 
 struct ti_cpufreq_data {
@@ -182,6 +185,7 @@
 	.efuse_mask = BIT(3),
 	.rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE,
 	.multi_regulator = false,
+	.quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING,
 };
 
 /*
@@ -209,6 +213,7 @@
 	.efuse_mask = BIT(9),
 	.rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE,
 	.multi_regulator = true,
+	.quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING,
 };
 
 /*
@@ -223,6 +228,7 @@
 	.efuse_mask = 0,
 	.rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE,
 	.multi_regulator = false,
+	.quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING,
 };
 
 static struct ti_cpufreq_soc_data am625_soc_data = {
@@ -250,7 +256,7 @@
 
 	ret = regmap_read(opp_data->syscon, opp_data->soc_data->efuse_offset,
 			  &efuse);
-	if (ret == -EIO) {
+	if (opp_data->soc_data->quirks & TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO) {
 		/* not a syscon register! */
 		void __iomem *regs = ioremap(OMAP3_SYSCON_BASE +
 				opp_data->soc_data->efuse_offset, 4);
@@ -291,7 +297,7 @@
 
 	ret = regmap_read(opp_data->syscon, opp_data->soc_data->rev_offset,
 			  &revision);
-	if (ret == -EIO) {
+	if (opp_data->soc_data->quirks & TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO) {
 		/* not a syscon register! */
 		void __iomem *regs = ioremap(OMAP3_SYSCON_BASE +
 				opp_data->soc_data->rev_offset, 4);
@@ -419,7 +425,7 @@
 
 	ret = dev_pm_opp_set_config(opp_data->cpu_dev, &config);
 	if (ret < 0) {
-		dev_err(opp_data->cpu_dev, "Failed to set OPP config\n");
+		dev_err_probe(opp_data->cpu_dev, ret, "Failed to set OPP config\n");
 		goto fail_put_node;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/cpuidle/cpuidle-riscv-sbi.c
+++ linux-qcom-6.8.0/drivers/cpuidle/cpuidle-riscv-sbi.c
@@ -8,6 +8,7 @@
 
 #define pr_fmt(fmt) "cpuidle-riscv-sbi: " fmt
 
+#include <linux/cleanup.h>
 #include <linux/cpuhotplug.h>
 #include <linux/cpuidle.h>
 #include <linux/cpumask.h>
@@ -267,19 +268,16 @@
 {
 	struct sbi_cpuidle_data *data = per_cpu_ptr(&sbi_cpuidle_data, cpu);
 	struct device_node *state_node;
-	struct device_node *cpu_node;
 	u32 *states;
 	int i, ret;
 
-	cpu_node = of_cpu_device_node_get(cpu);
+	struct device_node *cpu_node __free(device_node) = of_cpu_device_node_get(cpu);
 	if (!cpu_node)
 		return -ENODEV;
 
 	states = devm_kcalloc(dev, state_count, sizeof(*states), GFP_KERNEL);
-	if (!states) {
-		ret = -ENOMEM;
-		goto fail;
-	}
+	if (!states)
+		return -ENOMEM;
 
 	/* Parse SBI specific details from state DT nodes */
 	for (i = 1; i < state_count; i++) {
@@ -295,10 +293,8 @@
 
 		pr_debug("sbi-state %#x index %d\n", states[i], i);
 	}
-	if (i != state_count) {
-		ret = -ENODEV;
-		goto fail;
-	}
+	if (i != state_count)
+		return -ENODEV;
 
 	/* Initialize optional data, used for the hierarchical topology. */
 	ret = sbi_dt_cpu_init_topology(drv, data, state_count, cpu);
@@ -308,10 +304,7 @@
 	/* Store states in the per-cpu struct. */
 	data->states = states;
 
-fail:
-	of_node_put(cpu_node);
-
-	return ret;
+	return 0;
 }
 
 static void sbi_cpuidle_deinit_cpu(int cpu)
@@ -541,12 +534,12 @@
 	int cpu, ret;
 	struct cpuidle_driver *drv;
 	struct cpuidle_device *dev;
-	struct device_node *np, *pds_node;
+	struct device_node *pds_node;
 
 	/* Detect OSI support based on CPU DT nodes */
 	sbi_cpuidle_use_osi = true;
 	for_each_possible_cpu(cpu) {
-		np = of_cpu_device_node_get(cpu);
+		struct device_node *np __free(device_node) = of_cpu_device_node_get(cpu);
 		if (np &&
 		    of_property_present(np, "power-domains") &&
 		    of_property_present(np, "power-domain-names")) {
--- linux-qcom-6.8.0.orig/drivers/cpuidle/driver.c
+++ linux-qcom-6.8.0/drivers/cpuidle/driver.c
@@ -16,6 +16,7 @@
 #include <linux/cpumask.h>
 #include <linux/tick.h>
 #include <linux/cpu.h>
+#include <linux/math64.h>
 
 #include "cpuidle.h"
 
@@ -187,7 +188,7 @@
 			s->target_residency = div_u64(s->target_residency_ns, NSEC_PER_USEC);
 
 		if (s->exit_latency > 0)
-			s->exit_latency_ns = s->exit_latency * NSEC_PER_USEC;
+			s->exit_latency_ns = mul_u32_u32(s->exit_latency, NSEC_PER_USEC);
 		else if (s->exit_latency_ns < 0)
 			s->exit_latency_ns =  0;
 		else
--- linux-qcom-6.8.0.orig/drivers/crypto/bcm/cipher.c
+++ linux-qcom-6.8.0/drivers/crypto/bcm/cipher.c
@@ -2415,6 +2415,7 @@
 
 static int ahash_hmac_init(struct ahash_request *req)
 {
+	int ret;
 	struct iproc_reqctx_s *rctx = ahash_request_ctx(req);
 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
 	struct iproc_ctx_s *ctx = crypto_ahash_ctx(tfm);
@@ -2424,7 +2425,9 @@
 	flow_log("ahash_hmac_init()\n");
 
 	/* init the context as a hash */
-	ahash_init(req);
+	ret = ahash_init(req);
+	if (ret)
+		return ret;
 
 	if (!spu_no_incr_hash(ctx)) {
 		/* SPU-M can do incr hashing but needs sw for outer HMAC */
--- linux-qcom-6.8.0.orig/drivers/crypto/bcm/spu2.c
+++ linux-qcom-6.8.0/drivers/crypto/bcm/spu2.c
@@ -495,7 +495,7 @@
 	if (hash_iv_len) {
 		packet_log("  Hash IV Length %u bytes\n", hash_iv_len);
 		packet_dump("  hash IV: ", ptr, hash_iv_len);
-		ptr += ciph_key_len;
+		ptr += hash_iv_len;
 	}
 
 	if (ciph_iv_len) {
--- linux-qcom-6.8.0.orig/drivers/crypto/caam/caamhash.c
+++ linux-qcom-6.8.0/drivers/crypto/caam/caamhash.c
@@ -708,6 +708,7 @@
 		       GFP_KERNEL : GFP_ATOMIC;
 	struct ahash_edesc *edesc;
 
+	sg_num = pad_sg_nents(sg_num);
 	edesc = kzalloc(struct_size(edesc, sec4_sg, sg_num), flags);
 	if (!edesc)
 		return NULL;
--- linux-qcom-6.8.0.orig/drivers/crypto/caam/caampkc.c
+++ linux-qcom-6.8.0/drivers/crypto/caam/caampkc.c
@@ -984,7 +984,7 @@
 	return -ENOMEM;
 }
 
-static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
+static int caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
 				       struct rsa_key *raw_key)
 {
 	struct caam_rsa_key *rsa_key = &ctx->key;
@@ -994,7 +994,7 @@
 
 	rsa_key->p = caam_read_raw_data(raw_key->p, &p_sz);
 	if (!rsa_key->p)
-		return;
+		return -ENOMEM;
 	rsa_key->p_sz = p_sz;
 
 	rsa_key->q = caam_read_raw_data(raw_key->q, &q_sz);
@@ -1029,7 +1029,7 @@
 
 	rsa_key->priv_form = FORM3;
 
-	return;
+	return 0;
 
 free_dq:
 	kfree_sensitive(rsa_key->dq);
@@ -1043,6 +1043,7 @@
 	kfree_sensitive(rsa_key->q);
 free_p:
 	kfree_sensitive(rsa_key->p);
+	return -ENOMEM;
 }
 
 static int caam_rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key,
@@ -1088,7 +1089,9 @@
 	rsa_key->e_sz = raw_key.e_sz;
 	rsa_key->n_sz = raw_key.n_sz;
 
-	caam_rsa_set_priv_key_form(ctx, &raw_key);
+	ret = caam_rsa_set_priv_key_form(ctx, &raw_key);
+	if (ret)
+		goto err;
 
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/crypto/caam/qi.c
+++ linux-qcom-6.8.0/drivers/crypto/caam/qi.c
@@ -772,7 +772,7 @@
 
 	caam_debugfs_qi_init(ctrlpriv);
 
-	err = devm_add_action_or_reset(qidev, caam_qi_shutdown, ctrlpriv);
+	err = devm_add_action_or_reset(qidev, caam_qi_shutdown, qidev);
 	if (err)
 		return err;
 
--- linux-qcom-6.8.0.orig/drivers/crypto/cavium/cpt/cptpf_main.c
+++ linux-qcom-6.8.0/drivers/crypto/cavium/cpt/cptpf_main.c
@@ -44,7 +44,7 @@
 		dev_err(dev, "Cores still busy %llx", coremask);
 		grp = cpt_read_csr64(cpt->reg_base,
 				     CPTX_PF_EXEC_BUSY(0));
-		if (timeout--)
+		if (!timeout--)
 			break;
 
 		udelay(CSR_DELAY);
@@ -302,6 +302,8 @@
 
 	ret = do_cpt_init(cpt, mcode);
 	if (ret) {
+		dma_free_coherent(&cpt->pdev->dev, mcode->code_size,
+				  mcode->code, mcode->phys_base);
 		dev_err(dev, "do_cpt_init failed with ret: %d\n", ret);
 		goto fw_release;
 	}
@@ -394,7 +396,7 @@
 		dev_err(dev, "Cores still busy");
 		grp = cpt_read_csr64(cpt->reg_base,
 				     CPTX_PF_EXEC_BUSY(0));
-		if (timeout--)
+		if (!timeout--)
 			break;
 
 		udelay(CSR_DELAY);
--- linux-qcom-6.8.0.orig/drivers/crypto/ccp/platform-access.c
+++ linux-qcom-6.8.0/drivers/crypto/ccp/platform-access.c
@@ -118,9 +118,16 @@
 		goto unlock;
 	}
 
-	/* Store the status in request header for caller to investigate */
+	/*
+	 * Read status from PSP. If status is non-zero, it indicates an error
+	 * occurred during "processing" of the command.
+	 * If status is zero, it indicates the command was "processed"
+	 * successfully, but the result of the command is in the payload.
+	 * Return both cases to the caller as -EIO to investigate.
+	 */
 	cmd_reg = ioread32(cmd);
-	req->header.status = FIELD_GET(PSP_CMDRESP_STS, cmd_reg);
+	if (FIELD_GET(PSP_CMDRESP_STS, cmd_reg))
+		req->header.status = FIELD_GET(PSP_CMDRESP_STS, cmd_reg);
 	if (req->header.status) {
 		ret = -EIO;
 		goto unlock;
--- linux-qcom-6.8.0.orig/drivers/crypto/ccp/sev-dev.c
+++ linux-qcom-6.8.0/drivers/crypto/ccp/sev-dev.c
@@ -349,7 +349,18 @@
 
 	sev->int_rcvd = 0;
 
-	reg = FIELD_PREP(SEV_CMDRESP_CMD, cmd) | SEV_CMDRESP_IOC;
+	reg = FIELD_PREP(SEV_CMDRESP_CMD, cmd);
+
+	/*
+	 * If invoked during panic handling, local interrupts are disabled so
+	 * the PSP command completion interrupt can't be used.
+	 * sev_wait_cmd_ioc() already checks for interrupts disabled and
+	 * polls for PSP command completion.  Ensure we do not request an
+	 * interrupt from the PSP if irqs disabled.
+	 */
+	if (!irqs_disabled())
+		reg |= SEV_CMDRESP_IOC;
+
 	iowrite32(reg, sev->io_regs + sev->vdata->cmdresp_reg);
 
 	/* wait for command completion */
@@ -1381,6 +1392,8 @@
 	return;
 
 err:
+	sev_dev_destroy(psp_master);
+
 	psp_master->sev_data = NULL;
 }
 
--- linux-qcom-6.8.0.orig/drivers/crypto/ccp/sp-platform.c
+++ linux-qcom-6.8.0/drivers/crypto/ccp/sp-platform.c
@@ -39,44 +39,38 @@
 	},
 };
 
-#ifdef CONFIG_ACPI
 static const struct acpi_device_id sp_acpi_match[] = {
 	{ "AMDI0C00", (kernel_ulong_t)&dev_vdata[0] },
 	{ },
 };
 MODULE_DEVICE_TABLE(acpi, sp_acpi_match);
-#endif
 
-#ifdef CONFIG_OF
 static const struct of_device_id sp_of_match[] = {
 	{ .compatible = "amd,ccp-seattle-v1a",
 	  .data = (const void *)&dev_vdata[0] },
 	{ },
 };
 MODULE_DEVICE_TABLE(of, sp_of_match);
-#endif
 
 static struct sp_dev_vdata *sp_get_of_version(struct platform_device *pdev)
 {
-#ifdef CONFIG_OF
 	const struct of_device_id *match;
 
 	match = of_match_node(sp_of_match, pdev->dev.of_node);
 	if (match && match->data)
 		return (struct sp_dev_vdata *)match->data;
-#endif
+
 	return NULL;
 }
 
 static struct sp_dev_vdata *sp_get_acpi_version(struct platform_device *pdev)
 {
-#ifdef CONFIG_ACPI
 	const struct acpi_device_id *match;
 
 	match = acpi_match_device(sp_acpi_match, &pdev->dev);
 	if (match && match->driver_data)
 		return (struct sp_dev_vdata *)match->driver_data;
-#endif
+
 	return NULL;
 }
 
@@ -212,12 +206,8 @@
 static struct platform_driver sp_platform_driver = {
 	.driver = {
 		.name = "ccp",
-#ifdef CONFIG_ACPI
 		.acpi_match_table = sp_acpi_match,
-#endif
-#ifdef CONFIG_OF
 		.of_match_table = sp_of_match,
-#endif
 	},
 	.probe = sp_platform_probe,
 	.remove_new = sp_platform_remove,
--- linux-qcom-6.8.0.orig/drivers/crypto/hisilicon/debugfs.c
+++ linux-qcom-6.8.0/drivers/crypto/hisilicon/debugfs.c
@@ -783,8 +783,14 @@
 {
 	int i;
 
+	if (!dregs)
+		return;
+
 	/* Setting the pointer is NULL to prevent double free */
 	for (i = 0; i < reg_len; i++) {
+		if (!dregs[i].regs)
+			continue;
+
 		kfree(dregs[i].regs);
 		dregs[i].regs = NULL;
 	}
@@ -834,14 +840,21 @@
 static int qm_diff_regs_init(struct hisi_qm *qm,
 		struct dfx_diff_registers *dregs, u32 reg_len)
 {
+	int ret;
+
 	qm->debug.qm_diff_regs = dfx_regs_init(qm, qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
-	if (IS_ERR(qm->debug.qm_diff_regs))
-		return PTR_ERR(qm->debug.qm_diff_regs);
+	if (IS_ERR(qm->debug.qm_diff_regs)) {
+		ret = PTR_ERR(qm->debug.qm_diff_regs);
+		qm->debug.qm_diff_regs = NULL;
+		return ret;
+	}
 
 	qm->debug.acc_diff_regs = dfx_regs_init(qm, dregs, reg_len);
 	if (IS_ERR(qm->debug.acc_diff_regs)) {
 		dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
-		return PTR_ERR(qm->debug.acc_diff_regs);
+		ret = PTR_ERR(qm->debug.acc_diff_regs);
+		qm->debug.acc_diff_regs = NULL;
+		return ret;
 	}
 
 	return 0;
@@ -882,7 +895,9 @@
 static void qm_diff_regs_uninit(struct hisi_qm *qm, u32 reg_len)
 {
 	dfx_regs_uninit(qm, qm->debug.acc_diff_regs, reg_len);
+	qm->debug.acc_diff_regs = NULL;
 	dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+	qm->debug.qm_diff_regs = NULL;
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/crypto/hisilicon/hpre/hpre_main.c
+++ linux-qcom-6.8.0/drivers/crypto/hisilicon/hpre/hpre_main.c
@@ -13,9 +13,7 @@
 #include <linux/uacce.h>
 #include "hpre.h"
 
-#define HPRE_QM_ABNML_INT_MASK		0x100004
 #define HPRE_CTRL_CNT_CLR_CE_BIT	BIT(0)
-#define HPRE_COMM_CNT_CLR_CE		0x0
 #define HPRE_CTRL_CNT_CLR_CE		0x301000
 #define HPRE_FSM_MAX_CNT		0x301008
 #define HPRE_VFG_AXQOS			0x30100c
@@ -42,7 +40,6 @@
 #define HPRE_HAC_INT_SET		0x301500
 #define HPRE_RNG_TIMEOUT_NUM		0x301A34
 #define HPRE_CORE_INT_ENABLE		0
-#define HPRE_CORE_INT_DISABLE		GENMASK(21, 0)
 #define HPRE_RDCHN_INI_ST		0x301a00
 #define HPRE_CLSTR_BASE			0x302000
 #define HPRE_CORE_EN_OFFSET		0x04
@@ -66,7 +63,6 @@
 #define HPRE_CLSTR_ADDR_INTRVL		0x1000
 #define HPRE_CLUSTER_INQURY		0x100
 #define HPRE_CLSTR_ADDR_INQRY_RSLT	0x104
-#define HPRE_TIMEOUT_ABNML_BIT		6
 #define HPRE_PASID_EN_BIT		9
 #define HPRE_REG_RD_INTVRL_US		10
 #define HPRE_REG_RD_TMOUT_US		1000
@@ -203,9 +199,9 @@
 	{HPRE_QM_RESET_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0xC37, 0x6C37},
 	{HPRE_QM_OOO_SHUTDOWN_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0x4, 0x6C37},
 	{HPRE_QM_CE_MASK_CAP, 0x312C, 0, GENMASK(31, 0), 0x0, 0x8, 0x8},
-	{HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFFFE},
-	{HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFFFE},
-	{HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFFFE},
+	{HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFC3E},
+	{HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFC3E},
+	{HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFC3E},
 	{HPRE_CE_MASK_CAP, 0x3138, 0, GENMASK(31, 0), 0x0, 0x1, 0x1},
 	{HPRE_CLUSTER_NUM_CAP, 0x313c, 20, GENMASK(3, 0), 0x0,  0x4, 0x1},
 	{HPRE_CORE_TYPE_NUM_CAP, 0x313c, 16, GENMASK(3, 0), 0x0, 0x2, 0x2},
@@ -358,6 +354,8 @@
 	},
 };
 
+static const struct hisi_qm_err_ini hpre_err_ini;
+
 bool hpre_check_alg_support(struct hisi_qm *qm, u32 alg)
 {
 	u32 cap_val;
@@ -654,11 +652,6 @@
 	writel(HPRE_QM_USR_CFG_MASK, qm->io_base + QM_AWUSER_M_CFG_ENABLE);
 	writel_relaxed(HPRE_QM_AXI_CFG_MASK, qm->io_base + QM_AXI_M_CFG);
 
-	/* HPRE need more time, we close this interrupt */
-	val = readl_relaxed(qm->io_base + HPRE_QM_ABNML_INT_MASK);
-	val |= BIT(HPRE_TIMEOUT_ABNML_BIT);
-	writel_relaxed(val, qm->io_base + HPRE_QM_ABNML_INT_MASK);
-
 	if (qm->ver >= QM_HW_V3)
 		writel(HPRE_RSA_ENB | HPRE_ECC_ENB,
 			qm->io_base + HPRE_TYPES_ENB);
@@ -667,9 +660,7 @@
 
 	writel(HPRE_QM_VFG_AX_MASK, qm->io_base + HPRE_VFG_AXCACHE);
 	writel(0x0, qm->io_base + HPRE_BD_ENDIAN);
-	writel(0x0, qm->io_base + HPRE_INT_MASK);
 	writel(0x0, qm->io_base + HPRE_POISON_BYPASS);
-	writel(0x0, qm->io_base + HPRE_COMM_CNT_CLR_CE);
 	writel(0x0, qm->io_base + HPRE_ECC_BYPASS);
 
 	writel(HPRE_BD_USR_MASK, qm->io_base + HPRE_BD_ARUSR_CFG);
@@ -759,7 +750,7 @@
 
 static void hpre_hw_error_enable(struct hisi_qm *qm)
 {
-	u32 ce, nfe;
+	u32 ce, nfe, err_en;
 
 	ce = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CE_MASK_CAP, qm->cap_ver);
 	nfe = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_NFE_MASK_CAP, qm->cap_ver);
@@ -776,7 +767,8 @@
 	hpre_master_ooo_ctrl(qm, true);
 
 	/* enable hpre hw error interrupts */
-	writel(HPRE_CORE_INT_ENABLE, qm->io_base + HPRE_INT_MASK);
+	err_en = ce | nfe | HPRE_HAC_RAS_FE_ENABLE;
+	writel(~err_en, qm->io_base + HPRE_INT_MASK);
 }
 
 static inline struct hisi_qm *hpre_file_to_qm(struct hpre_debugfs_file *file)
@@ -1162,6 +1154,7 @@
 		qm->qp_num = pf_q_num;
 		qm->debug.curr_qm_qp_num = pf_q_num;
 		qm->qm_list = &hpre_devices;
+		qm->err_ini = &hpre_err_ini;
 		if (pf_q_num_flag)
 			set_bit(QM_MODULE_PARAM, &qm->misc_ctl);
 	}
@@ -1288,11 +1281,15 @@
 
 static void hpre_clear_hw_err_status(struct hisi_qm *qm, u32 err_sts)
 {
-	u32 nfe;
-
 	writel(err_sts, qm->io_base + HPRE_HAC_SOURCE_INT);
-	nfe = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_NFE_MASK_CAP, qm->cap_ver);
-	writel(nfe, qm->io_base + HPRE_RAS_NFE_ENB);
+}
+
+static void hpre_disable_error_report(struct hisi_qm *qm, u32 err_type)
+{
+	u32 nfe_mask;
+
+	nfe_mask = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_NFE_MASK_CAP, qm->cap_ver);
+	writel(nfe_mask & (~err_type), qm->io_base + HPRE_RAS_NFE_ENB);
 }
 
 static void hpre_open_axi_master_ooo(struct hisi_qm *qm)
@@ -1306,6 +1303,27 @@
 	       qm->io_base + HPRE_AM_OOO_SHUTDOWN_ENB);
 }
 
+static enum acc_err_result hpre_get_err_result(struct hisi_qm *qm)
+{
+	u32 err_status;
+
+	err_status = hpre_get_hw_err_status(qm);
+	if (err_status) {
+		if (err_status & qm->err_info.ecc_2bits_mask)
+			qm->err_status.is_dev_ecc_mbit = true;
+		hpre_log_hw_error(qm, err_status);
+
+		if (err_status & qm->err_info.dev_reset_mask) {
+			/* Disable the same error reporting until device is recovered. */
+			hpre_disable_error_report(qm, err_status);
+			return ACC_ERR_NEED_RESET;
+		}
+		hpre_clear_hw_err_status(qm, err_status);
+	}
+
+	return ACC_ERR_RECOVERED;
+}
+
 static void hpre_err_info_init(struct hisi_qm *qm)
 {
 	struct hisi_qm_err_info *err_info = &qm->err_info;
@@ -1332,12 +1350,12 @@
 	.hw_err_disable		= hpre_hw_error_disable,
 	.get_dev_hw_err_status	= hpre_get_hw_err_status,
 	.clear_dev_hw_err_status = hpre_clear_hw_err_status,
-	.log_dev_hw_err		= hpre_log_hw_error,
 	.open_axi_master_ooo	= hpre_open_axi_master_ooo,
 	.open_sva_prefetch	= hpre_open_sva_prefetch,
 	.close_sva_prefetch	= hpre_close_sva_prefetch,
 	.show_last_dfx_regs	= hpre_show_last_dfx_regs,
 	.err_info_init		= hpre_err_info_init,
+	.get_err_result		= hpre_get_err_result,
 };
 
 static int hpre_pf_probe_init(struct hpre *hpre)
@@ -1351,8 +1369,6 @@
 
 	hpre_open_sva_prefetch(qm);
 
-	qm->err_ini = &hpre_err_ini;
-	qm->err_ini->err_info_init(qm);
 	hisi_qm_dev_err_init(qm);
 	ret = hpre_show_last_regs_init(qm);
 	if (ret)
@@ -1381,6 +1397,18 @@
 	return 0;
 }
 
+static void hpre_probe_uninit(struct hisi_qm *qm)
+{
+	if (qm->fun_type == QM_HW_VF)
+		return;
+
+	hpre_cnt_regs_clear(qm);
+	qm->debug.curr_qm_qp_num = 0;
+	hpre_show_last_regs_uninit(qm);
+	hpre_close_sva_prefetch(qm);
+	hisi_qm_dev_err_uninit(qm);
+}
+
 static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
 	struct hisi_qm *qm;
@@ -1406,7 +1434,7 @@
 
 	ret = hisi_qm_start(qm);
 	if (ret)
-		goto err_with_err_init;
+		goto err_with_probe_init;
 
 	ret = hpre_debugfs_init(qm);
 	if (ret)
@@ -1445,9 +1473,8 @@
 	hpre_debugfs_exit(qm);
 	hisi_qm_stop(qm, QM_NORMAL);
 
-err_with_err_init:
-	hpre_show_last_regs_uninit(qm);
-	hisi_qm_dev_err_uninit(qm);
+err_with_probe_init:
+	hpre_probe_uninit(qm);
 
 err_with_qm_init:
 	hisi_qm_uninit(qm);
@@ -1469,13 +1496,7 @@
 	hpre_debugfs_exit(qm);
 	hisi_qm_stop(qm, QM_NORMAL);
 
-	if (qm->fun_type == QM_HW_PF) {
-		hpre_cnt_regs_clear(qm);
-		qm->debug.curr_qm_qp_num = 0;
-		hpre_show_last_regs_uninit(qm);
-		hisi_qm_dev_err_uninit(qm);
-	}
-
+	hpre_probe_uninit(qm);
 	hisi_qm_uninit(qm);
 }
 
--- linux-qcom-6.8.0.orig/drivers/crypto/hisilicon/qm.c
+++ linux-qcom-6.8.0/drivers/crypto/hisilicon/qm.c
@@ -265,12 +265,6 @@
 	SHAPER_VFT,
 };
 
-enum acc_err_result {
-	ACC_ERR_NONE,
-	ACC_ERR_NEED_RESET,
-	ACC_ERR_RECOVERED,
-};
-
 enum qm_alg_type {
 	ALG_TYPE_0,
 	ALG_TYPE_1,
@@ -443,6 +437,7 @@
 };
 
 static void qm_irqs_unregister(struct hisi_qm *qm);
+static int qm_reset_device(struct hisi_qm *qm);
 
 static u32 qm_get_hw_error_status(struct hisi_qm *qm)
 {
@@ -1414,22 +1409,25 @@
 
 static enum acc_err_result qm_hw_error_handle_v2(struct hisi_qm *qm)
 {
-	u32 error_status, tmp;
+	u32 error_status;
 
-	/* read err sts */
-	tmp = readl(qm->io_base + QM_ABNORMAL_INT_STATUS);
-	error_status = qm->error_mask & tmp;
-
-	if (error_status) {
+	error_status = qm_get_hw_error_status(qm);
+	if (error_status & qm->error_mask) {
 		if (error_status & QM_ECC_MBIT)
 			qm->err_status.is_qm_ecc_mbit = true;
 
 		qm_log_hw_error(qm, error_status);
-		if (error_status & qm->err_info.qm_reset_mask)
+		if (error_status & qm->err_info.qm_reset_mask) {
+			/* Disable the same error reporting until device is recovered. */
+			writel(qm->err_info.nfe & (~error_status),
+			       qm->io_base + QM_RAS_NFE_ENABLE);
 			return ACC_ERR_NEED_RESET;
+		}
 
+		/* Clear error source if not need reset. */
 		writel(error_status, qm->io_base + QM_ABNORMAL_INT_SOURCE);
 		writel(qm->err_info.nfe, qm->io_base + QM_RAS_NFE_ENABLE);
+		writel(qm->err_info.ce, qm->io_base + QM_RAS_CE_ENABLE);
 	}
 
 	return ACC_ERR_RECOVERED;
@@ -2833,12 +2831,9 @@
 	hisi_qm_set_state(qm, QM_NOT_READY);
 	up_write(&qm->qps_lock);
 
+	qm_remove_uacce(qm);
 	qm_irqs_unregister(qm);
 	hisi_qm_pci_uninit(qm);
-	if (qm->use_sva) {
-		uacce_remove(qm->uacce);
-		qm->uacce = NULL;
-	}
 }
 EXPORT_SYMBOL_GPL(hisi_qm_uninit);
 
@@ -3801,30 +3796,12 @@
 
 static enum acc_err_result qm_dev_err_handle(struct hisi_qm *qm)
 {
-	u32 err_sts;
-
-	if (!qm->err_ini->get_dev_hw_err_status) {
-		dev_err(&qm->pdev->dev, "Device doesn't support get hw error status!\n");
+	if (!qm->err_ini->get_err_result) {
+		dev_err(&qm->pdev->dev, "Device doesn't support reset!\n");
 		return ACC_ERR_NONE;
 	}
 
-	/* get device hardware error status */
-	err_sts = qm->err_ini->get_dev_hw_err_status(qm);
-	if (err_sts) {
-		if (err_sts & qm->err_info.ecc_2bits_mask)
-			qm->err_status.is_dev_ecc_mbit = true;
-
-		if (qm->err_ini->log_dev_hw_err)
-			qm->err_ini->log_dev_hw_err(qm, err_sts);
-
-		if (err_sts & qm->err_info.dev_reset_mask)
-			return ACC_ERR_NEED_RESET;
-
-		if (qm->err_ini->clear_dev_hw_err_status)
-			qm->err_ini->clear_dev_hw_err_status(qm, err_sts);
-	}
-
-	return ACC_ERR_RECOVERED;
+	return qm->err_ini->get_err_result(qm);
 }
 
 static enum acc_err_result qm_process_dev_error(struct hisi_qm *qm)
@@ -3955,6 +3932,28 @@
 	return -ETIMEDOUT;
 }
 
+static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm)
+{
+	u32 nfe_enb = 0;
+
+	/* Kunpeng930 hardware automatically close master ooo when NFE occurs */
+	if (qm->ver >= QM_HW_V3)
+		return;
+
+	if (!qm->err_status.is_dev_ecc_mbit &&
+	    qm->err_status.is_qm_ecc_mbit &&
+	    qm->err_ini->close_axi_master_ooo) {
+		qm->err_ini->close_axi_master_ooo(qm);
+	} else if (qm->err_status.is_dev_ecc_mbit &&
+		   !qm->err_status.is_qm_ecc_mbit &&
+		   !qm->err_ini->close_axi_master_ooo) {
+		nfe_enb = readl(qm->io_base + QM_RAS_NFE_ENABLE);
+		writel(nfe_enb & QM_RAS_NFE_MBIT_DISABLE,
+		       qm->io_base + QM_RAS_NFE_ENABLE);
+		writel(QM_ECC_MBIT, qm->io_base + QM_ABNORMAL_INT_SET);
+	}
+}
+
 static int qm_vf_reset_prepare(struct hisi_qm *qm,
 			       enum qm_stop_reason stop_reason)
 {
@@ -4019,6 +4018,8 @@
 		return ret;
 	}
 
+	qm_dev_ecc_mbit_handle(qm);
+
 	/* PF obtains the information of VF by querying the register. */
 	qm_cmd_uninit(qm);
 
@@ -4049,33 +4050,26 @@
 	return 0;
 }
 
-static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm)
+static int qm_master_ooo_check(struct hisi_qm *qm)
 {
-	u32 nfe_enb = 0;
+	u32 val;
+	int ret;
 
-	/* Kunpeng930 hardware automatically close master ooo when NFE occurs */
-	if (qm->ver >= QM_HW_V3)
-		return;
+	/* Check the ooo register of the device before resetting the device. */
+	writel(ACC_MASTER_GLOBAL_CTRL_SHUTDOWN, qm->io_base + ACC_MASTER_GLOBAL_CTRL);
+	ret = readl_relaxed_poll_timeout(qm->io_base + ACC_MASTER_TRANS_RETURN,
+					 val, (val == ACC_MASTER_TRANS_RETURN_RW),
+					 POLL_PERIOD, POLL_TIMEOUT);
+	if (ret)
+		pci_warn(qm->pdev, "Bus lock! Please reset system.\n");
 
-	if (!qm->err_status.is_dev_ecc_mbit &&
-	    qm->err_status.is_qm_ecc_mbit &&
-	    qm->err_ini->close_axi_master_ooo) {
-		qm->err_ini->close_axi_master_ooo(qm);
-	} else if (qm->err_status.is_dev_ecc_mbit &&
-		   !qm->err_status.is_qm_ecc_mbit &&
-		   !qm->err_ini->close_axi_master_ooo) {
-		nfe_enb = readl(qm->io_base + QM_RAS_NFE_ENABLE);
-		writel(nfe_enb & QM_RAS_NFE_MBIT_DISABLE,
-		       qm->io_base + QM_RAS_NFE_ENABLE);
-		writel(QM_ECC_MBIT, qm->io_base + QM_ABNORMAL_INT_SET);
-	}
+	return ret;
 }
 
-static int qm_soft_reset(struct hisi_qm *qm)
+static int qm_soft_reset_prepare(struct hisi_qm *qm)
 {
 	struct pci_dev *pdev = qm->pdev;
 	int ret;
-	u32 val;
 
 	/* Ensure all doorbells and mailboxes received by QM */
 	ret = qm_check_req_recv(qm);
@@ -4096,30 +4090,23 @@
 		return ret;
 	}
 
-	qm_dev_ecc_mbit_handle(qm);
-
-	/* OOO register set and check */
-	writel(ACC_MASTER_GLOBAL_CTRL_SHUTDOWN,
-	       qm->io_base + ACC_MASTER_GLOBAL_CTRL);
-
-	/* If bus lock, reset chip */
-	ret = readl_relaxed_poll_timeout(qm->io_base + ACC_MASTER_TRANS_RETURN,
-					 val,
-					 (val == ACC_MASTER_TRANS_RETURN_RW),
-					 POLL_PERIOD, POLL_TIMEOUT);
-	if (ret) {
-		pci_emerg(pdev, "Bus lock! Please reset system.\n");
+	ret = qm_master_ooo_check(qm);
+	if (ret)
 		return ret;
-	}
 
 	if (qm->err_ini->close_sva_prefetch)
 		qm->err_ini->close_sva_prefetch(qm);
 
 	ret = qm_set_pf_mse(qm, false);
-	if (ret) {
+	if (ret)
 		pci_err(pdev, "Fails to disable pf MSE bit.\n");
-		return ret;
-	}
+
+	return ret;
+}
+
+static int qm_reset_device(struct hisi_qm *qm)
+{
+	struct pci_dev *pdev = qm->pdev;
 
 	/* The reset related sub-control registers are not in PCI BAR */
 	if (ACPI_HANDLE(&pdev->dev)) {
@@ -4138,12 +4125,23 @@
 			pci_err(pdev, "Reset step %llu failed!\n", value);
 			return -EIO;
 		}
-	} else {
-		pci_err(pdev, "No reset method!\n");
-		return -EINVAL;
+
+		return 0;
 	}
 
-	return 0;
+	pci_err(pdev, "No reset method!\n");
+	return -EINVAL;
+}
+
+static int qm_soft_reset(struct hisi_qm *qm)
+{
+	int ret;
+
+	ret = qm_soft_reset_prepare(qm);
+	if (ret)
+		return ret;
+
+	return qm_reset_device(qm);
 }
 
 static int qm_vf_reset_done(struct hisi_qm *qm)
@@ -5096,6 +5094,35 @@
 	return ret;
 }
 
+static int qm_clear_device(struct hisi_qm *qm)
+{
+	acpi_handle handle = ACPI_HANDLE(&qm->pdev->dev);
+	int ret;
+
+	if (qm->fun_type == QM_HW_VF)
+		return 0;
+
+	/* Device does not support reset, return */
+	if (!qm->err_ini->err_info_init)
+		return 0;
+	qm->err_ini->err_info_init(qm);
+
+	if (!handle)
+		return 0;
+
+	/* No reset method, return */
+	if (!acpi_has_method(handle, qm->err_info.acpi_rst))
+		return 0;
+
+	ret = qm_master_ooo_check(qm);
+	if (ret) {
+		writel(0x0, qm->io_base + ACC_MASTER_GLOBAL_CTRL);
+		return ret;
+	}
+
+	return qm_reset_device(qm);
+}
+
 static int hisi_qm_pci_init(struct hisi_qm *qm)
 {
 	struct pci_dev *pdev = qm->pdev;
@@ -5125,8 +5152,14 @@
 		goto err_get_pci_res;
 	}
 
+	ret = qm_clear_device(qm);
+	if (ret)
+		goto err_free_vectors;
+
 	return 0;
 
+err_free_vectors:
+	pci_free_irq_vectors(pdev);
 err_get_pci_res:
 	qm_put_pci_res(qm);
 err_disable_pcidev:
@@ -5427,7 +5460,6 @@
 {
 	struct pci_dev *pdev = qm->pdev;
 	int ret;
-	u32 val;
 
 	ret = qm->ops->set_msi(qm, false);
 	if (ret) {
@@ -5435,18 +5467,9 @@
 		return ret;
 	}
 
-	/* shutdown OOO register */
-	writel(ACC_MASTER_GLOBAL_CTRL_SHUTDOWN,
-	       qm->io_base + ACC_MASTER_GLOBAL_CTRL);
-
-	ret = readl_relaxed_poll_timeout(qm->io_base + ACC_MASTER_TRANS_RETURN,
-					 val,
-					 (val == ACC_MASTER_TRANS_RETURN_RW),
-					 POLL_PERIOD, POLL_TIMEOUT);
-	if (ret) {
-		pci_emerg(pdev, "Bus lock! Please reset system.\n");
+	ret = qm_master_ooo_check(qm);
+	if (ret)
 		return ret;
-	}
 
 	ret = qm_set_pf_mse(qm, false);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/crypto/hisilicon/sec2/sec_crypto.c
+++ linux-qcom-6.8.0/drivers/crypto/hisilicon/sec2/sec_crypto.c
@@ -481,8 +481,10 @@
 
 	if (ctx->pbuf_supported)
 		sec_free_pbuf_resource(dev, qp_ctx->res);
-	if (ctx->alg_type == SEC_AEAD)
+	if (ctx->alg_type == SEC_AEAD) {
 		sec_free_mac_resource(dev, qp_ctx->res);
+		sec_free_aiv_resource(dev, qp_ctx->res);
+	}
 }
 
 static int sec_alloc_qp_ctx_resource(struct hisi_qm *qm, struct sec_ctx *ctx,
--- linux-qcom-6.8.0.orig/drivers/crypto/hisilicon/sec2/sec_main.c
+++ linux-qcom-6.8.0/drivers/crypto/hisilicon/sec2/sec_main.c
@@ -152,7 +152,7 @@
 	{SEC_CORE_TYPE_NUM_CAP, 0x313c, 16, GENMASK(3, 0), 0x1, 0x1, 0x1},
 	{SEC_CORE_NUM_CAP, 0x313c, 8, GENMASK(7, 0), 0x4, 0x4, 0x4},
 	{SEC_CORES_PER_CLUSTER_NUM_CAP, 0x313c, 0, GENMASK(7, 0), 0x4, 0x4, 0x4},
-	{SEC_CORE_ENABLE_BITMAP, 0x3140, 32, GENMASK(31, 0), 0x17F, 0x17F, 0xF},
+	{SEC_CORE_ENABLE_BITMAP, 0x3140, 0, GENMASK(31, 0), 0x17F, 0x17F, 0xF},
 	{SEC_DRV_ALG_BITMAP_LOW, 0x3144, 0, GENMASK(31, 0), 0x18050CB, 0x18050CB, 0x18670CF},
 	{SEC_DRV_ALG_BITMAP_HIGH, 0x3148, 0, GENMASK(31, 0), 0x395C, 0x395C, 0x395C},
 	{SEC_DEV_ALG_BITMAP_LOW, 0x314c, 0, GENMASK(31, 0), 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF},
@@ -1006,11 +1006,15 @@
 
 static void sec_clear_hw_err_status(struct hisi_qm *qm, u32 err_sts)
 {
-	u32 nfe;
-
 	writel(err_sts, qm->io_base + SEC_CORE_INT_SOURCE);
-	nfe = hisi_qm_get_hw_info(qm, sec_basic_info, SEC_NFE_MASK_CAP, qm->cap_ver);
-	writel(nfe, qm->io_base + SEC_RAS_NFE_REG);
+}
+
+static void sec_disable_error_report(struct hisi_qm *qm, u32 err_type)
+{
+	u32 nfe_mask;
+
+	nfe_mask = hisi_qm_get_hw_info(qm, sec_basic_info, SEC_NFE_MASK_CAP, qm->cap_ver);
+	writel(nfe_mask & (~err_type), qm->io_base + SEC_RAS_NFE_REG);
 }
 
 static void sec_open_axi_master_ooo(struct hisi_qm *qm)
@@ -1022,6 +1026,27 @@
 	writel(val | SEC_AXI_SHUTDOWN_ENABLE, qm->io_base + SEC_CONTROL_REG);
 }
 
+static enum acc_err_result sec_get_err_result(struct hisi_qm *qm)
+{
+	u32 err_status;
+
+	err_status = sec_get_hw_err_status(qm);
+	if (err_status) {
+		if (err_status & qm->err_info.ecc_2bits_mask)
+			qm->err_status.is_dev_ecc_mbit = true;
+		sec_log_hw_error(qm, err_status);
+
+		if (err_status & qm->err_info.dev_reset_mask) {
+			/* Disable the same error reporting until device is recovered. */
+			sec_disable_error_report(qm, err_status);
+			return ACC_ERR_NEED_RESET;
+		}
+		sec_clear_hw_err_status(qm, err_status);
+	}
+
+	return ACC_ERR_RECOVERED;
+}
+
 static void sec_err_info_init(struct hisi_qm *qm)
 {
 	struct hisi_qm_err_info *err_info = &qm->err_info;
@@ -1048,12 +1073,12 @@
 	.hw_err_disable		= sec_hw_error_disable,
 	.get_dev_hw_err_status	= sec_get_hw_err_status,
 	.clear_dev_hw_err_status = sec_clear_hw_err_status,
-	.log_dev_hw_err		= sec_log_hw_error,
 	.open_axi_master_ooo	= sec_open_axi_master_ooo,
 	.open_sva_prefetch	= sec_open_sva_prefetch,
 	.close_sva_prefetch	= sec_close_sva_prefetch,
 	.show_last_dfx_regs	= sec_show_last_dfx_regs,
 	.err_info_init		= sec_err_info_init,
+	.get_err_result		= sec_get_err_result,
 };
 
 static int sec_pf_probe_init(struct sec_dev *sec)
@@ -1061,9 +1086,6 @@
 	struct hisi_qm *qm = &sec->qm;
 	int ret;
 
-	qm->err_ini = &sec_err_ini;
-	qm->err_ini->err_info_init(qm);
-
 	ret = sec_set_user_domain_and_cache(qm);
 	if (ret)
 		return ret;
@@ -1118,6 +1140,7 @@
 		qm->qp_num = pf_q_num;
 		qm->debug.curr_qm_qp_num = pf_q_num;
 		qm->qm_list = &sec_devices;
+		qm->err_ini = &sec_err_ini;
 		if (pf_q_num_flag)
 			set_bit(QM_MODULE_PARAM, &qm->misc_ctl);
 	} else if (qm->fun_type == QM_HW_VF && qm->ver == QM_HW_V1) {
@@ -1182,6 +1205,12 @@
 
 static void sec_probe_uninit(struct hisi_qm *qm)
 {
+	if (qm->fun_type == QM_HW_VF)
+		return;
+
+	sec_debug_regs_clear(qm);
+	sec_show_last_regs_uninit(qm);
+	sec_close_sva_prefetch(qm);
 	hisi_qm_dev_err_uninit(qm);
 }
 
@@ -1270,7 +1299,6 @@
 	sec_debugfs_exit(qm);
 	hisi_qm_stop(qm, QM_NORMAL);
 err_probe_uninit:
-	sec_show_last_regs_uninit(qm);
 	sec_probe_uninit(qm);
 err_qm_uninit:
 	sec_qm_uninit(qm);
@@ -1292,11 +1320,6 @@
 	sec_debugfs_exit(qm);
 
 	(void)hisi_qm_stop(qm, QM_NORMAL);
-
-	if (qm->fun_type == QM_HW_PF)
-		sec_debug_regs_clear(qm);
-	sec_show_last_regs_uninit(qm);
-
 	sec_probe_uninit(qm);
 
 	sec_qm_uninit(qm);
--- linux-qcom-6.8.0.orig/drivers/crypto/hisilicon/sgl.c
+++ linux-qcom-6.8.0/drivers/crypto/hisilicon/sgl.c
@@ -228,7 +228,7 @@
 	dma_addr_t curr_sgl_dma = 0;
 	struct acc_hw_sge *curr_hw_sge;
 	struct scatterlist *sg;
-	int sg_n;
+	int sg_n, ret;
 
 	if (!dev || !sgl || !pool || !hw_sgl_dma)
 		return ERR_PTR(-EINVAL);
@@ -243,14 +243,15 @@
 
 	if (sg_n_mapped > pool->sge_nr) {
 		dev_err(dev, "the number of entries in input scatterlist is bigger than SGL pool setting.\n");
-		return ERR_PTR(-EINVAL);
+		ret = -EINVAL;
+		goto err_unmap;
 	}
 
 	curr_hw_sgl = acc_get_sgl(pool, index, &curr_sgl_dma);
 	if (IS_ERR(curr_hw_sgl)) {
 		dev_err(dev, "Get SGL error!\n");
-		dma_unmap_sg(dev, sgl, sg_n, DMA_BIDIRECTIONAL);
-		return ERR_PTR(-ENOMEM);
+		ret = -ENOMEM;
+		goto err_unmap;
 	}
 	curr_hw_sgl->entry_length_in_sgl = cpu_to_le16(pool->sge_nr);
 	curr_hw_sge = curr_hw_sgl->sge_entries;
@@ -265,6 +266,11 @@
 	*hw_sgl_dma = curr_sgl_dma;
 
 	return curr_hw_sgl;
+
+err_unmap:
+	dma_unmap_sg(dev, sgl, sg_n, DMA_BIDIRECTIONAL);
+
+	return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(hisi_acc_sg_buf_map_to_hw_sgl);
 
--- linux-qcom-6.8.0.orig/drivers/crypto/hisilicon/zip/zip_main.c
+++ linux-qcom-6.8.0/drivers/crypto/hisilicon/zip/zip_main.c
@@ -1069,11 +1069,15 @@
 
 static void hisi_zip_clear_hw_err_status(struct hisi_qm *qm, u32 err_sts)
 {
-	u32 nfe;
-
 	writel(err_sts, qm->io_base + HZIP_CORE_INT_SOURCE);
-	nfe = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_NFE_MASK_CAP, qm->cap_ver);
-	writel(nfe, qm->io_base + HZIP_CORE_INT_RAS_NFE_ENB);
+}
+
+static void hisi_zip_disable_error_report(struct hisi_qm *qm, u32 err_type)
+{
+	u32 nfe_mask;
+
+	nfe_mask = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_NFE_MASK_CAP, qm->cap_ver);
+	writel(nfe_mask & (~err_type), qm->io_base + HZIP_CORE_INT_RAS_NFE_ENB);
 }
 
 static void hisi_zip_open_axi_master_ooo(struct hisi_qm *qm)
@@ -1103,6 +1107,27 @@
 	       qm->io_base + HZIP_CORE_INT_SET);
 }
 
+static enum acc_err_result hisi_zip_get_err_result(struct hisi_qm *qm)
+{
+	u32 err_status;
+
+	err_status = hisi_zip_get_hw_err_status(qm);
+	if (err_status) {
+		if (err_status & qm->err_info.ecc_2bits_mask)
+			qm->err_status.is_dev_ecc_mbit = true;
+		hisi_zip_log_hw_error(qm, err_status);
+
+		if (err_status & qm->err_info.dev_reset_mask) {
+			/* Disable the same error reporting until device is recovered. */
+			hisi_zip_disable_error_report(qm, err_status);
+			return ACC_ERR_NEED_RESET;
+		}
+		hisi_zip_clear_hw_err_status(qm, err_status);
+	}
+
+	return ACC_ERR_RECOVERED;
+}
+
 static void hisi_zip_err_info_init(struct hisi_qm *qm)
 {
 	struct hisi_qm_err_info *err_info = &qm->err_info;
@@ -1130,13 +1155,13 @@
 	.hw_err_disable		= hisi_zip_hw_error_disable,
 	.get_dev_hw_err_status	= hisi_zip_get_hw_err_status,
 	.clear_dev_hw_err_status = hisi_zip_clear_hw_err_status,
-	.log_dev_hw_err		= hisi_zip_log_hw_error,
 	.open_axi_master_ooo	= hisi_zip_open_axi_master_ooo,
 	.close_axi_master_ooo	= hisi_zip_close_axi_master_ooo,
 	.open_sva_prefetch	= hisi_zip_open_sva_prefetch,
 	.close_sva_prefetch	= hisi_zip_close_sva_prefetch,
 	.show_last_dfx_regs	= hisi_zip_show_last_dfx_regs,
 	.err_info_init		= hisi_zip_err_info_init,
+	.get_err_result		= hisi_zip_get_err_result,
 };
 
 static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
@@ -1151,8 +1176,6 @@
 
 	hisi_zip->ctrl = ctrl;
 	ctrl->hisi_zip = hisi_zip;
-	qm->err_ini = &hisi_zip_err_ini;
-	qm->err_ini->err_info_init(qm);
 
 	ret = hisi_zip_set_user_domain_and_cache(qm);
 	if (ret)
@@ -1213,6 +1236,7 @@
 		qm->qp_num = pf_q_num;
 		qm->debug.curr_qm_qp_num = pf_q_num;
 		qm->qm_list = &zip_devices;
+		qm->err_ini = &hisi_zip_err_ini;
 		if (pf_q_num_flag)
 			set_bit(QM_MODULE_PARAM, &qm->misc_ctl);
 	} else if (qm->fun_type == QM_HW_VF && qm->ver == QM_HW_V1) {
@@ -1279,6 +1303,16 @@
 	return 0;
 }
 
+static void hisi_zip_probe_uninit(struct hisi_qm *qm)
+{
+	if (qm->fun_type == QM_HW_VF)
+		return;
+
+	hisi_zip_show_last_regs_uninit(qm);
+	hisi_zip_close_sva_prefetch(qm);
+	hisi_qm_dev_err_uninit(qm);
+}
+
 static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
 	struct hisi_zip *hisi_zip;
@@ -1305,7 +1339,7 @@
 
 	ret = hisi_qm_start(qm);
 	if (ret)
-		goto err_dev_err_uninit;
+		goto err_probe_uninit;
 
 	ret = hisi_zip_debugfs_init(qm);
 	if (ret)
@@ -1344,9 +1378,8 @@
 	hisi_zip_debugfs_exit(qm);
 	hisi_qm_stop(qm, QM_NORMAL);
 
-err_dev_err_uninit:
-	hisi_zip_show_last_regs_uninit(qm);
-	hisi_qm_dev_err_uninit(qm);
+err_probe_uninit:
+	hisi_zip_probe_uninit(qm);
 
 err_qm_uninit:
 	hisi_zip_qm_uninit(qm);
@@ -1368,8 +1401,7 @@
 
 	hisi_zip_debugfs_exit(qm);
 	hisi_qm_stop(qm, QM_NORMAL);
-	hisi_zip_show_last_regs_uninit(qm);
-	hisi_qm_dev_err_uninit(qm);
+	hisi_zip_probe_uninit(qm);
 	hisi_zip_qm_uninit(qm);
 }
 
--- linux-qcom-6.8.0.orig/drivers/crypto/inside-secure/safexcel_hash.c
+++ linux-qcom-6.8.0/drivers/crypto/inside-secure/safexcel_hash.c
@@ -2093,7 +2093,7 @@
 
 	safexcel_ahash_cra_init(tfm);
 	ctx->aes = kmalloc(sizeof(*ctx->aes), GFP_KERNEL);
-	return PTR_ERR_OR_ZERO(ctx->aes);
+	return ctx->aes == NULL ? -ENOMEM : 0;
 }
 
 static void safexcel_xcbcmac_cra_exit(struct crypto_tfm *tfm)
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/iaa/iaa_crypto_main.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/iaa/iaa_crypto_main.c
@@ -599,10 +599,10 @@
 		if (!device_mode)
 			continue;
 
-		free_device_compression_mode(iaa_device, device_mode);
-		iaa_device->compression_modes[i] = NULL;
 		if (iaa_compression_modes[i]->free)
 			iaa_compression_modes[i]->free(device_mode);
+		free_device_compression_mode(iaa_device, device_mode);
+		iaa_device->compression_modes[i] = NULL;
 	}
 }
 
@@ -908,6 +908,8 @@
 		return -EINVAL;
 
 	cpus_per_iaa = (nr_nodes * nr_cpus_per_node) / nr_iaa;
+	if (!cpus_per_iaa)
+		cpus_per_iaa = 1;
 out:
 	return 0;
 }
@@ -923,10 +925,12 @@
 		}
 	}
 
-	if (nr_iaa)
+	if (nr_iaa) {
 		cpus_per_iaa = (nr_nodes * nr_cpus_per_node) / nr_iaa;
-	else
-		cpus_per_iaa = 0;
+		if (!cpus_per_iaa)
+			cpus_per_iaa = 1;
+	} else
+		cpus_per_iaa = 1;
 }
 
 static int wq_table_add_wqs(int iaa, int cpu)
@@ -1324,7 +1328,7 @@
 
 	*compression_crc = idxd_desc->iax_completion->crc;
 
-	if (!ctx->async_mode)
+	if (!ctx->async_mode || disable_async)
 		idxd_free_desc(wq, idxd_desc);
 out:
 	return ret;
@@ -1570,7 +1574,7 @@
 
 	*dlen = req->dlen;
 
-	if (!ctx->async_mode)
+	if (!ctx->async_mode || disable_async)
 		idxd_free_desc(wq, idxd_desc);
 
 	/* Update stats */
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/Kconfig
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/Kconfig
@@ -106,3 +106,17 @@
 
 	  To compile this as a module, choose M here: the module
 	  will be called qat_c62xvf.
+
+config CRYPTO_DEV_QAT_ERROR_INJECTION
+	bool "Support for Intel(R) QAT Devices Heartbeat Error Injection"
+	depends on CRYPTO_DEV_QAT
+	depends on DEBUG_FS
+	help
+	  Enables a mechanism that allows to inject a heartbeat error on
+	  Intel(R) QuickAssist devices for testing purposes.
+
+	  This is intended for developer use only.
+	  If unsure, say N.
+
+	  This functionality is available via debugfs entry of the Intel(R)
+	  QuickAssist device
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c
@@ -296,7 +296,7 @@
 {
 	if (adf_gen4_init_thd2arb_map(accel_dev))
 		dev_warn(&GET_DEV(accel_dev),
-			 "Generate of the thread to arbiter map failed");
+			 "Failed to generate thread to arbiter mapping");
 
 	return GET_HW_DATA(accel_dev)->thd_to_arb_map;
 }
@@ -372,6 +372,13 @@
 	if (!fw_config)
 		return 0;
 
+	/* If dcc, all rings handle compression requests */
+	if (adf_get_service_enabled(accel_dev) == SVC_DCC) {
+		for (i = 0; i < RP_GROUP_COUNT; i++)
+			rps[i] = COMP;
+		goto set_mask;
+	}
+
 	for (i = 0; i < RP_GROUP_COUNT; i++) {
 		switch (fw_config[i].ae_mask) {
 		case ADF_AE_GROUP_0:
@@ -400,6 +407,7 @@
 		}
 	}
 
+set_mask:
 	ring_to_svc_map = rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_0_SHIFT |
 			  rps[RP_GROUP_1] << ADF_CFG_SERV_RING_PAIR_1_SHIFT |
 			  rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_2_SHIFT |
@@ -420,7 +428,7 @@
 	else
 		id = -EINVAL;
 
-	if (id < 0 || id > num_objs)
+	if (id < 0 || id >= num_objs)
 		return NULL;
 
 	return fw_objs[id];
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c
@@ -208,7 +208,7 @@
 {
 	if (adf_gen4_init_thd2arb_map(accel_dev))
 		dev_warn(&GET_DEV(accel_dev),
-			 "Generate of the thread to arbiter map failed");
+			 "Failed to generate thread to arbiter mapping");
 
 	return GET_HW_DATA(accel_dev)->thd_to_arb_map;
 }
@@ -331,6 +331,13 @@
 	if (!fw_config)
 		return 0;
 
+	/* If dcc, all rings handle compression requests */
+	if (adf_get_service_enabled(accel_dev) == SVC_DCC) {
+		for (i = 0; i < RP_GROUP_COUNT; i++)
+			rps[i] = COMP;
+		goto set_mask;
+	}
+
 	for (i = 0; i < RP_GROUP_COUNT; i++) {
 		switch (fw_config[i].ae_mask) {
 		case ADF_AE_GROUP_0:
@@ -359,6 +366,7 @@
 		}
 	}
 
+set_mask:
 	ring_to_svc_map = rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_0_SHIFT |
 			  rps[RP_GROUP_1] << ADF_CFG_SERV_RING_PAIR_1_SHIFT |
 			  rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_2_SHIFT |
@@ -379,7 +387,7 @@
 	else
 		id = -EINVAL;
 
-	if (id < 0 || id > num_objs)
+	if (id < 0 || id >= num_objs)
 		return NULL;
 
 	return fw_objs[id];
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_4xxx/adf_drv.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_4xxx/adf_drv.c
@@ -197,7 +197,9 @@
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Intel");
 MODULE_FIRMWARE(ADF_4XXX_FW);
+MODULE_FIRMWARE(ADF_402XX_FW);
 MODULE_FIRMWARE(ADF_4XXX_MMP);
+MODULE_FIRMWARE(ADF_402XX_MMP);
 MODULE_DESCRIPTION("Intel(R) QuickAssist Technology");
 MODULE_VERSION(ADF_DRV_VERSION);
 MODULE_SOFTDEP("pre: crypto-intel_qat");
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/Makefile
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/Makefile
@@ -53,3 +53,5 @@
 			       adf_pfvf_pf_msg.o adf_pfvf_pf_proto.o \
 			       adf_pfvf_vf_msg.o adf_pfvf_vf_proto.o \
 			       adf_gen2_pfvf.o adf_gen4_pfvf.o
+
+intel_qat-$(CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION) += adf_heartbeat_inject.o
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h
@@ -332,6 +332,7 @@
 	struct ratelimit_state vf2pf_ratelimit;
 	u32 vf_nr;
 	bool init;
+	bool restarting;
 	u8 vf_compat_ver;
 };
 
@@ -401,6 +402,7 @@
 	struct adf_error_counters ras_errors;
 	struct mutex state_lock; /* protect state of the device */
 	bool is_vf;
+	bool autoreset_on_error;
 	u32 accel_id;
 };
 #endif
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_aer.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_aer.c
@@ -7,8 +7,15 @@
 #include <linux/delay.h>
 #include "adf_accel_devices.h"
 #include "adf_common_drv.h"
+#include "adf_pfvf_pf_msg.h"
+
+struct adf_fatal_error_data {
+	struct adf_accel_dev *accel_dev;
+	struct work_struct work;
+};
 
 static struct workqueue_struct *device_reset_wq;
+static struct workqueue_struct *device_sriov_wq;
 
 static pci_ers_result_t adf_error_detected(struct pci_dev *pdev,
 					   pci_channel_state_t state)
@@ -26,6 +33,19 @@
 		return PCI_ERS_RESULT_DISCONNECT;
 	}
 
+	set_bit(ADF_STATUS_RESTARTING, &accel_dev->status);
+	if (accel_dev->hw_device->exit_arb) {
+		dev_dbg(&pdev->dev, "Disabling arbitration\n");
+		accel_dev->hw_device->exit_arb(accel_dev);
+	}
+	adf_error_notifier(accel_dev);
+	adf_pf2vf_notify_fatal_error(accel_dev);
+	adf_dev_restarting_notify(accel_dev);
+	adf_pf2vf_notify_restarting(accel_dev);
+	adf_pf2vf_wait_for_restarting_complete(accel_dev);
+	pci_clear_master(pdev);
+	adf_dev_down(accel_dev, false);
+
 	return PCI_ERS_RESULT_NEED_RESET;
 }
 
@@ -37,6 +57,13 @@
 	struct work_struct reset_work;
 };
 
+/* sriov dev data */
+struct adf_sriov_dev_data {
+	struct adf_accel_dev *accel_dev;
+	struct completion compl;
+	struct work_struct sriov_work;
+};
+
 void adf_reset_sbr(struct adf_accel_dev *accel_dev)
 {
 	struct pci_dev *pdev = accel_to_pci_dev(accel_dev);
@@ -82,11 +109,22 @@
 	}
 }
 
+static void adf_device_sriov_worker(struct work_struct *work)
+{
+	struct adf_sriov_dev_data *sriov_data =
+		container_of(work, struct adf_sriov_dev_data, sriov_work);
+
+	adf_reenable_sriov(sriov_data->accel_dev);
+	complete(&sriov_data->compl);
+}
+
 static void adf_device_reset_worker(struct work_struct *work)
 {
 	struct adf_reset_dev_data *reset_data =
 		  container_of(work, struct adf_reset_dev_data, reset_work);
 	struct adf_accel_dev *accel_dev = reset_data->accel_dev;
+	unsigned long wait_jiffies = msecs_to_jiffies(10000);
+	struct adf_sriov_dev_data sriov_data;
 
 	adf_dev_restarting_notify(accel_dev);
 	if (adf_dev_restart(accel_dev)) {
@@ -97,14 +135,22 @@
 		WARN(1, "QAT: device restart failed. Device is unusable\n");
 		return;
 	}
+
+	sriov_data.accel_dev = accel_dev;
+	init_completion(&sriov_data.compl);
+	INIT_WORK(&sriov_data.sriov_work, adf_device_sriov_worker);
+	queue_work(device_sriov_wq, &sriov_data.sriov_work);
+	if (wait_for_completion_timeout(&sriov_data.compl, wait_jiffies))
+		adf_pf2vf_notify_restarted(accel_dev);
+
 	adf_dev_restarted_notify(accel_dev);
 	clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status);
 
 	/* The dev is back alive. Notify the caller if in sync mode */
-	if (reset_data->mode == ADF_DEV_RESET_SYNC)
-		complete(&reset_data->compl);
-	else
+	if (reset_data->mode == ADF_DEV_RESET_ASYNC)
 		kfree(reset_data);
+	else
+		complete(&reset_data->compl);
 }
 
 static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev,
@@ -136,6 +182,7 @@
 		if (!timeout) {
 			dev_err(&GET_DEV(accel_dev),
 				"Reset device timeout expired\n");
+			cancel_work_sync(&reset_data->reset_work);
 			ret = -EFAULT;
 		}
 		kfree(reset_data);
@@ -147,14 +194,25 @@
 static pci_ers_result_t adf_slot_reset(struct pci_dev *pdev)
 {
 	struct adf_accel_dev *accel_dev = adf_devmgr_pci_to_accel_dev(pdev);
+	int res = 0;
 
 	if (!accel_dev) {
 		pr_err("QAT: Can't find acceleration device\n");
 		return PCI_ERS_RESULT_DISCONNECT;
 	}
-	if (adf_dev_aer_schedule_reset(accel_dev, ADF_DEV_RESET_SYNC))
+
+	if (!pdev->is_busmaster)
+		pci_set_master(pdev);
+	pci_restore_state(pdev);
+	pci_save_state(pdev);
+	res = adf_dev_up(accel_dev, false);
+	if (res && res != -EALREADY)
 		return PCI_ERS_RESULT_DISCONNECT;
 
+	adf_reenable_sriov(accel_dev);
+	adf_pf2vf_notify_restarted(accel_dev);
+	adf_dev_restarted_notify(accel_dev);
+	clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status);
 	return PCI_ERS_RESULT_RECOVERED;
 }
 
@@ -171,11 +229,65 @@
 };
 EXPORT_SYMBOL_GPL(adf_err_handler);
 
+int adf_dev_autoreset(struct adf_accel_dev *accel_dev)
+{
+	if (accel_dev->autoreset_on_error)
+		return adf_dev_aer_schedule_reset(accel_dev, ADF_DEV_RESET_ASYNC);
+
+	return 0;
+}
+
+static void adf_notify_fatal_error_worker(struct work_struct *work)
+{
+	struct adf_fatal_error_data *wq_data =
+			container_of(work, struct adf_fatal_error_data, work);
+	struct adf_accel_dev *accel_dev = wq_data->accel_dev;
+	struct adf_hw_device_data *hw_device = accel_dev->hw_device;
+
+	adf_error_notifier(accel_dev);
+
+	if (!accel_dev->is_vf) {
+		/* Disable arbitration to stop processing of new requests */
+		if (accel_dev->autoreset_on_error && hw_device->exit_arb)
+			hw_device->exit_arb(accel_dev);
+		if (accel_dev->pf.vf_info)
+			adf_pf2vf_notify_fatal_error(accel_dev);
+		adf_dev_autoreset(accel_dev);
+	}
+
+	kfree(wq_data);
+}
+
+int adf_notify_fatal_error(struct adf_accel_dev *accel_dev)
+{
+	struct adf_fatal_error_data *wq_data;
+
+	wq_data = kzalloc(sizeof(*wq_data), GFP_ATOMIC);
+	if (!wq_data)
+		return -ENOMEM;
+
+	wq_data->accel_dev = accel_dev;
+	INIT_WORK(&wq_data->work, adf_notify_fatal_error_worker);
+	adf_misc_wq_queue_work(&wq_data->work);
+
+	return 0;
+}
+
 int adf_init_aer(void)
 {
 	device_reset_wq = alloc_workqueue("qat_device_reset_wq",
 					  WQ_MEM_RECLAIM, 0);
-	return !device_reset_wq ? -EFAULT : 0;
+	if (!device_reset_wq)
+		return -EFAULT;
+
+	device_sriov_wq = alloc_workqueue("qat_device_sriov_wq", 0, 0);
+	if (!device_sriov_wq) {
+		destroy_workqueue(device_reset_wq);
+		device_reset_wq = NULL;
+		return -EFAULT;
+	}
+
+	return 0;
 }
 
 void adf_exit_aer(void)
@@ -183,4 +295,8 @@
 	if (device_reset_wq)
 		destroy_workqueue(device_reset_wq);
 	device_reset_wq = NULL;
+
+	if (device_sriov_wq)
+		destroy_workqueue(device_sriov_wq);
+	device_sriov_wq = NULL;
 }
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_cfg.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_cfg.c
@@ -290,17 +290,19 @@
 	 * 3. if the key exists with the same value, then return without doing
 	 *    anything (the newly created key_val is freed).
 	 */
+	down_write(&cfg->lock);
 	if (!adf_cfg_key_val_get(accel_dev, section_name, key, temp_val)) {
 		if (strncmp(temp_val, key_val->val, sizeof(temp_val))) {
 			adf_cfg_keyval_remove(key, section);
 		} else {
 			kfree(key_val);
-			return 0;
+			goto out;
 		}
 	}
 
-	down_write(&cfg->lock);
 	adf_cfg_keyval_add(key_val, section);
+
+out:
 	up_write(&cfg->lock);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_cfg_strings.h
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_cfg_strings.h
@@ -49,5 +49,6 @@
 	ADF_ETRMGR_BANK "%d" ADF_ETRMGR_CORE_AFFINITY
 #define ADF_ACCEL_STR "Accelerator%d"
 #define ADF_HEARTBEAT_TIMER  "HeartbeatTimer"
+#define ADF_SRIOV_ENABLED "SriovEnabled"
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_clock.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_clock.c
@@ -83,6 +83,9 @@
 	}
 
 	delta_us = timespec_to_us(&ts3) - timespec_to_us(&ts1);
+	if (!delta_us)
+		return -EINVAL;
+
 	temp = (timestamp2 - timestamp1) * ME_CLK_DIVIDER * 10;
 	temp = DIV_ROUND_CLOSEST_ULL(temp, delta_us);
 	/*
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c
@@ -16,7 +16,6 @@
 
 #define CNV_ERR_INFO_MASK		GENMASK(11, 0)
 #define CNV_ERR_TYPE_MASK		GENMASK(15, 12)
-#define CNV_SLICE_ERR_MASK		GENMASK(7, 0)
 #define CNV_SLICE_ERR_SIGN_BIT_INDEX	7
 #define CNV_DELTA_ERR_SIGN_BIT_INDEX	11
 
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_common_drv.h
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_common_drv.h
@@ -40,6 +40,7 @@
 	ADF_EVENT_SHUTDOWN,
 	ADF_EVENT_RESTARTING,
 	ADF_EVENT_RESTARTED,
+	ADF_EVENT_FATAL_ERROR,
 };
 
 struct service_hndl {
@@ -60,6 +61,8 @@
 
 void adf_devmgr_update_class_index(struct adf_hw_device_data *hw_data);
 void adf_clean_vf_map(bool);
+int adf_notify_fatal_error(struct adf_accel_dev *accel_dev);
+void adf_error_notifier(struct adf_accel_dev *accel_dev);
 int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
 		       struct adf_accel_dev *pf);
 void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev,
@@ -84,12 +87,14 @@
 extern const struct pci_error_handlers adf_err_handler;
 void adf_reset_sbr(struct adf_accel_dev *accel_dev);
 void adf_reset_flr(struct adf_accel_dev *accel_dev);
+int adf_dev_autoreset(struct adf_accel_dev *accel_dev);
 void adf_dev_restore(struct adf_accel_dev *accel_dev);
 int adf_init_aer(void);
 void adf_exit_aer(void);
 int adf_init_arb(struct adf_accel_dev *accel_dev);
 void adf_exit_arb(struct adf_accel_dev *accel_dev);
 void adf_update_ring_arb(struct adf_etr_ring_data *ring);
+int adf_disable_arb_thd(struct adf_accel_dev *accel_dev, u32 ae, u32 thr);
 
 int adf_dev_get(struct adf_accel_dev *accel_dev);
 void adf_dev_put(struct adf_accel_dev *accel_dev);
@@ -188,6 +193,7 @@
 #if defined(CONFIG_PCI_IOV)
 int adf_sriov_configure(struct pci_dev *pdev, int numvfs);
 void adf_disable_sriov(struct adf_accel_dev *accel_dev);
+void adf_reenable_sriov(struct adf_accel_dev *accel_dev);
 void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev, u32 vf_mask);
 void adf_disable_all_vf2pf_interrupts(struct adf_accel_dev *accel_dev);
 bool adf_recv_and_handle_pf2vf_msg(struct adf_accel_dev *accel_dev);
@@ -208,6 +214,10 @@
 {
 }
 
+static inline void adf_reenable_sriov(struct adf_accel_dev *accel_dev)
+{
+}
+
 static inline int adf_init_pf_wq(void)
 {
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_dbgfs.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_dbgfs.c
@@ -22,18 +22,13 @@
 void adf_dbgfs_init(struct adf_accel_dev *accel_dev)
 {
 	char name[ADF_DEVICE_NAME_LENGTH];
-	void *ret;
 
 	/* Create dev top level debugfs entry */
 	snprintf(name, sizeof(name), "%s%s_%s", ADF_DEVICE_NAME_PREFIX,
 		 accel_dev->hw_device->dev_class->name,
 		 pci_name(accel_dev->accel_pci_dev.pci_dev));
 
-	ret = debugfs_create_dir(name, NULL);
-	if (IS_ERR_OR_NULL(ret))
-		return;
-
-	accel_dev->debugfs_dir = ret;
+	accel_dev->debugfs_dir = debugfs_create_dir(name, NULL);
 
 	adf_cfg_dev_dbgfs_add(accel_dev);
 }
@@ -59,9 +54,6 @@
  */
 void adf_dbgfs_add(struct adf_accel_dev *accel_dev)
 {
-	if (!accel_dev->debugfs_dir)
-		return;
-
 	if (!accel_dev->is_vf) {
 		adf_fw_counters_dbgfs_add(accel_dev);
 		adf_heartbeat_dbgfs_add(accel_dev);
@@ -77,9 +69,6 @@
  */
 void adf_dbgfs_rm(struct adf_accel_dev *accel_dev)
 {
-	if (!accel_dev->debugfs_dir)
-		return;
-
 	if (!accel_dev->is_vf) {
 		adf_tl_dbgfs_rm(accel_dev);
 		adf_cnv_dbgfs_rm(accel_dev);
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_gen2_pfvf.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_gen2_pfvf.c
@@ -100,7 +100,9 @@
 	errmsk3 |= ADF_GEN2_ERR_MSK_VF2PF(ADF_GEN2_VF_MSK);
 	ADF_CSR_WR(pmisc_addr, ADF_GEN2_ERRMSK3, errmsk3);
 
-	errmsk3 &= ADF_GEN2_ERR_MSK_VF2PF(sources | disabled);
+	/* Update only section of errmsk3 related to VF2PF */
+	errmsk3 &= ~ADF_GEN2_ERR_MSK_VF2PF(ADF_GEN2_VF_MSK);
+	errmsk3 |= ADF_GEN2_ERR_MSK_VF2PF(sources | disabled);
 	ADF_CSR_WR(pmisc_addr, ADF_GEN2_ERRMSK3, errmsk3);
 
 	/* Return the sources of the (new) interrupt(s) */
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c
@@ -398,6 +398,9 @@
 			 ADF_GEN4_ADMIN_ACCELENGINES;
 
 	if (srv_id == SVC_DCC) {
+		if (ae_cnt > ICP_QAT_HW_AE_DELIMITER)
+			return -EINVAL;
+
 		memcpy(thd2arb_map, thrd_to_arb_map_dcc,
 		       array_size(sizeof(*thd2arb_map), ae_cnt));
 		return 0;
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c
@@ -1007,8 +1007,7 @@
 static bool adf_handle_ssmcpppar_err(struct adf_accel_dev *accel_dev,
 				     void __iomem *csr, u32 iastatssm)
 {
-	u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SSMCPPERR);
-	u32 bits_num = BITS_PER_REG(reg);
+	u32 reg, bits_num = BITS_PER_REG(reg);
 	bool reset_required = false;
 	unsigned long errs_bits;
 	u32 bit_iterator;
@@ -1106,8 +1105,7 @@
 static bool adf_handle_ser_err_ssmsh(struct adf_accel_dev *accel_dev,
 				     void __iomem *csr, u32 iastatssm)
 {
-	u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SER_ERR_SSMSH);
-	u32 bits_num = BITS_PER_REG(reg);
+	u32 reg, bits_num = BITS_PER_REG(reg);
 	bool reset_required = false;
 	unsigned long errs_bits;
 	u32 bit_iterator;
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_gen4_tl.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_gen4_tl.c
@@ -149,5 +149,6 @@
 	tl_data->sl_exec_counters = sl_exec_counters;
 	tl_data->rp_counters = rp_counters;
 	tl_data->num_rp_counters = ARRAY_SIZE(rp_counters);
+	tl_data->max_sl_cnt = ADF_GEN4_TL_MAX_SLICES_PER_TYPE;
 }
 EXPORT_SYMBOL_GPL(adf_gen4_init_tl_data);
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_heartbeat.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_heartbeat.c
@@ -23,12 +23,6 @@
 
 #define ADF_HB_EMPTY_SIG 0xA5A5A5A5
 
-/* Heartbeat counter pair */
-struct hb_cnt_pair {
-	__u16 resp_heartbeat_cnt;
-	__u16 req_heartbeat_cnt;
-};
-
 static int adf_hb_check_polling_freq(struct adf_accel_dev *accel_dev)
 {
 	u64 curr_time = adf_clock_get_current_time();
@@ -211,6 +205,19 @@
 	return ret;
 }
 
+static void adf_heartbeat_reset(struct adf_accel_dev *accel_dev)
+{
+	u64 curr_time = adf_clock_get_current_time();
+	u64 time_since_reset = curr_time - accel_dev->heartbeat->last_hb_reset_time;
+
+	if (time_since_reset < ADF_CFG_HB_RESET_MS)
+		return;
+
+	accel_dev->heartbeat->last_hb_reset_time = curr_time;
+	if (adf_notify_fatal_error(accel_dev))
+		dev_err(&GET_DEV(accel_dev), "Failed to notify fatal error\n");
+}
+
 void adf_heartbeat_status(struct adf_accel_dev *accel_dev,
 			  enum adf_device_heartbeat_status *hb_status)
 {
@@ -235,6 +242,7 @@
 			"Heartbeat ERROR: QAT is not responding.\n");
 		*hb_status = HB_DEV_UNRESPONSIVE;
 		hb->hb_failed_counter++;
+		adf_heartbeat_reset(accel_dev);
 		return;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_heartbeat.h
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_heartbeat.h
@@ -13,17 +13,26 @@
 #define ADF_CFG_HB_TIMER_DEFAULT_MS 500
 #define ADF_CFG_HB_COUNT_THRESHOLD 3
 
+#define ADF_CFG_HB_RESET_MS 5000
+
 enum adf_device_heartbeat_status {
 	HB_DEV_UNRESPONSIVE = 0,
 	HB_DEV_ALIVE,
 	HB_DEV_UNSUPPORTED,
 };
 
+/* Heartbeat counter pair */
+struct hb_cnt_pair {
+	__u16 resp_heartbeat_cnt;
+	__u16 req_heartbeat_cnt;
+};
+
 struct adf_heartbeat {
 	unsigned int hb_sent_counter;
 	unsigned int hb_failed_counter;
 	unsigned int hb_timer;
 	u64 last_hb_check_time;
+	u64 last_hb_reset_time;
 	bool ctrs_cnt_checked;
 	struct hb_dma_addr {
 		dma_addr_t phy_addr;
@@ -35,6 +44,9 @@
 		struct dentry *cfg;
 		struct dentry *sent;
 		struct dentry *failed;
+#ifdef CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION
+		struct dentry *inject_error;
+#endif
 	} dbgfs;
 };
 
@@ -51,6 +63,15 @@
 			  enum adf_device_heartbeat_status *hb_status);
 void adf_heartbeat_check_ctrs(struct adf_accel_dev *accel_dev);
 
+#ifdef CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION
+int adf_heartbeat_inject_error(struct adf_accel_dev *accel_dev);
+#else
+static inline int adf_heartbeat_inject_error(struct adf_accel_dev *accel_dev)
+{
+	return -EPERM;
+}
+#endif
+
 #else
 static inline int adf_heartbeat_init(struct adf_accel_dev *accel_dev)
 {
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_heartbeat_dbgfs.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_heartbeat_dbgfs.c
@@ -155,6 +155,43 @@
 	.write = adf_hb_cfg_write,
 };
 
+static ssize_t adf_hb_error_inject_write(struct file *file,
+					 const char __user *user_buf,
+					 size_t count, loff_t *ppos)
+{
+	struct adf_accel_dev *accel_dev = file->private_data;
+	size_t written_chars;
+	char buf[3];
+	int ret;
+
+	/* last byte left as string termination */
+	if (count != 2)
+		return -EINVAL;
+
+	written_chars = simple_write_to_buffer(buf, sizeof(buf) - 1,
+					       ppos, user_buf, count);
+	if (buf[0] != '1')
+		return -EINVAL;
+
+	ret = adf_heartbeat_inject_error(accel_dev);
+	if (ret) {
+		dev_err(&GET_DEV(accel_dev),
+			"Heartbeat error injection failed with status %d\n",
+			ret);
+		return ret;
+	}
+
+	dev_info(&GET_DEV(accel_dev), "Heartbeat error injection enabled\n");
+
+	return written_chars;
+}
+
+static const struct file_operations adf_hb_error_inject_fops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.write = adf_hb_error_inject_write,
+};
+
 void adf_heartbeat_dbgfs_add(struct adf_accel_dev *accel_dev)
 {
 	struct adf_heartbeat *hb = accel_dev->heartbeat;
@@ -171,6 +208,17 @@
 					       &hb->hb_failed_counter, &adf_hb_stats_fops);
 	hb->dbgfs.cfg = debugfs_create_file("config", 0600, hb->dbgfs.base_dir,
 					    accel_dev, &adf_hb_cfg_fops);
+
+	if (IS_ENABLED(CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION)) {
+		struct dentry *inject_error __maybe_unused;
+
+		inject_error = debugfs_create_file("inject_error", 0200,
+						   hb->dbgfs.base_dir, accel_dev,
+						   &adf_hb_error_inject_fops);
+#ifdef CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION
+		hb->dbgfs.inject_error = inject_error;
+#endif
+	}
 }
 EXPORT_SYMBOL_GPL(adf_heartbeat_dbgfs_add);
 
@@ -189,6 +237,10 @@
 	hb->dbgfs.failed = NULL;
 	debugfs_remove(hb->dbgfs.cfg);
 	hb->dbgfs.cfg = NULL;
+#ifdef CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION
+	debugfs_remove(hb->dbgfs.inject_error);
+	hb->dbgfs.inject_error = NULL;
+#endif
 	debugfs_remove(hb->dbgfs.base_dir);
 	hb->dbgfs.base_dir = NULL;
 }
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_heartbeat_inject.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_heartbeat_inject.c
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright(c) 2023 Intel Corporation */
+#include <linux/random.h>
+
+#include "adf_admin.h"
+#include "adf_common_drv.h"
+#include "adf_heartbeat.h"
+
+#define MAX_HB_TICKS 0xFFFFFFFF
+
+static int adf_hb_set_timer_to_max(struct adf_accel_dev *accel_dev)
+{
+	struct adf_hw_device_data *hw_data = accel_dev->hw_device;
+
+	accel_dev->heartbeat->hb_timer = 0;
+
+	if (hw_data->stop_timer)
+		hw_data->stop_timer(accel_dev);
+
+	return adf_send_admin_hb_timer(accel_dev, MAX_HB_TICKS);
+}
+
+static void adf_set_hb_counters_fail(struct adf_accel_dev *accel_dev, u32 ae,
+				     u32 thr)
+{
+	struct hb_cnt_pair *stats = accel_dev->heartbeat->dma.virt_addr;
+	struct adf_hw_device_data *hw_device = accel_dev->hw_device;
+	const size_t max_aes = hw_device->get_num_aes(hw_device);
+	const size_t hb_ctrs = hw_device->num_hb_ctrs;
+	size_t thr_id = ae * hb_ctrs + thr;
+	u16 num_rsp = stats[thr_id].resp_heartbeat_cnt;
+
+	/*
+	 * Inject live.req != live.rsp and live.rsp == last.rsp
+	 * to trigger the heartbeat error detection
+	 */
+	stats[thr_id].req_heartbeat_cnt++;
+	stats += (max_aes * hb_ctrs);
+	stats[thr_id].resp_heartbeat_cnt = num_rsp;
+}
+
+int adf_heartbeat_inject_error(struct adf_accel_dev *accel_dev)
+{
+	struct adf_hw_device_data *hw_device = accel_dev->hw_device;
+	const size_t max_aes = hw_device->get_num_aes(hw_device);
+	const size_t hb_ctrs = hw_device->num_hb_ctrs;
+	u32 rand, rand_ae, rand_thr;
+	unsigned long ae_mask;
+	int ret;
+
+	ae_mask = hw_device->ae_mask;
+
+	do {
+		/* Ensure we have a valid ae */
+		get_random_bytes(&rand, sizeof(rand));
+		rand_ae = rand % max_aes;
+	} while (!test_bit(rand_ae, &ae_mask));
+
+	get_random_bytes(&rand, sizeof(rand));
+	rand_thr = rand % hb_ctrs;
+
+	/* Increase the heartbeat timer to prevent FW updating HB counters */
+	ret = adf_hb_set_timer_to_max(accel_dev);
+	if (ret)
+		return ret;
+
+	/* Configure worker threads to stop processing any packet */
+	ret = adf_disable_arb_thd(accel_dev, rand_ae, rand_thr);
+	if (ret)
+		return ret;
+
+	/* Change HB counters memory to simulate a hang */
+	adf_set_hb_counters_fail(accel_dev, rand_ae, rand_thr);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c
@@ -90,10 +90,6 @@
 
 	hw_data->get_arb_info(&info);
 
-	/* Reset arbiter configuration */
-	for (i = 0; i < ADF_ARB_NUM; i++)
-		WRITE_CSR_ARB_SARCONFIG(csr, arb_off, i, 0);
-
 	/* Unmap worker threads to service arbiters */
 	for (i = 0; i < hw_data->num_engines; i++)
 		WRITE_CSR_ARB_WT2SAM(csr, arb_off, wt_off, i, 0);
@@ -103,3 +99,28 @@
 		csr_ops->write_csr_ring_srv_arb_en(csr, i, 0);
 }
 EXPORT_SYMBOL_GPL(adf_exit_arb);
+
+int adf_disable_arb_thd(struct adf_accel_dev *accel_dev, u32 ae, u32 thr)
+{
+	void __iomem *csr = accel_dev->transport->banks[0].csr_addr;
+	struct adf_hw_device_data *hw_data = accel_dev->hw_device;
+	const u32 *thd_2_arb_cfg;
+	struct arb_info info;
+	u32 ae_thr_map;
+
+	if (ADF_AE_STRAND0_THREAD == thr || ADF_AE_STRAND1_THREAD == thr)
+		thr = ADF_AE_ADMIN_THREAD;
+
+	hw_data->get_arb_info(&info);
+	thd_2_arb_cfg = hw_data->get_arb_mapping(accel_dev);
+	if (!thd_2_arb_cfg)
+		return -EFAULT;
+
+	/* Disable scheduling for this particular AE and thread */
+	ae_thr_map = *(thd_2_arb_cfg + ae);
+	ae_thr_map &= ~(GENMASK(3, 0) << (thr * BIT(2)));
+
+	WRITE_CSR_ARB_WT2SAM(csr, info.arb_offset, info.wt2sam_offset, ae,
+			     ae_thr_map);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_init.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_init.c
@@ -323,6 +323,8 @@
 	if (hw_data->stop_timer)
 		hw_data->stop_timer(accel_dev);
 
+	hw_data->disable_iov(accel_dev);
+
 	if (wait)
 		msleep(100);
 
@@ -386,8 +388,6 @@
 
 	adf_tl_shutdown(accel_dev);
 
-	hw_data->disable_iov(accel_dev);
-
 	if (test_bit(ADF_STATUS_IRQ_ALLOCATED, &accel_dev->status)) {
 		hw_data->free_irq(accel_dev);
 		clear_bit(ADF_STATUS_IRQ_ALLOCATED, &accel_dev->status);
@@ -433,6 +433,18 @@
 	return 0;
 }
 
+void adf_error_notifier(struct adf_accel_dev *accel_dev)
+{
+	struct service_hndl *service;
+
+	list_for_each_entry(service, &service_table, list) {
+		if (service->event_hld(accel_dev, ADF_EVENT_FATAL_ERROR))
+			dev_err(&GET_DEV(accel_dev),
+				"Failed to send error event to %s.\n",
+				service->name);
+	}
+}
+
 static int adf_dev_shutdown_cache_cfg(struct adf_accel_dev *accel_dev)
 {
 	char services[ADF_CFG_MAX_VAL_LEN_IN_BYTES] = {0};
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_isr.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_isr.c
@@ -139,8 +139,13 @@
 
 	if (ras_ops->handle_interrupt &&
 	    ras_ops->handle_interrupt(accel_dev, &reset_required)) {
-		if (reset_required)
+		if (reset_required) {
 			dev_err(&GET_DEV(accel_dev), "Fatal error, reset required\n");
+			if (adf_notify_fatal_error(accel_dev))
+				dev_err(&GET_DEV(accel_dev),
+					"Failed to notify fatal error\n");
+		}
+
 		return true;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_pfvf_msg.h
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_pfvf_msg.h
@@ -99,6 +99,8 @@
 	ADF_PF2VF_MSGTYPE_RESTARTING		= 0x01,
 	ADF_PF2VF_MSGTYPE_VERSION_RESP		= 0x02,
 	ADF_PF2VF_MSGTYPE_BLKMSG_RESP		= 0x03,
+	ADF_PF2VF_MSGTYPE_FATAL_ERROR		= 0x04,
+	ADF_PF2VF_MSGTYPE_RESTARTED		= 0x05,
 /* Values from 0x10 are Gen4 specific, message type is only 4 bits in Gen2 devices. */
 	ADF_PF2VF_MSGTYPE_RP_RESET_RESP		= 0x10,
 };
@@ -112,6 +114,7 @@
 	ADF_VF2PF_MSGTYPE_LARGE_BLOCK_REQ	= 0x07,
 	ADF_VF2PF_MSGTYPE_MEDIUM_BLOCK_REQ	= 0x08,
 	ADF_VF2PF_MSGTYPE_SMALL_BLOCK_REQ	= 0x09,
+	ADF_VF2PF_MSGTYPE_RESTARTING_COMPLETE	= 0x0a,
 /* Values from 0x10 are Gen4 specific, message type is only 4 bits in Gen2 devices. */
 	ADF_VF2PF_MSGTYPE_RP_RESET		= 0x10,
 };
@@ -124,8 +127,10 @@
 	ADF_PFVF_COMPAT_FAST_ACK		= 0x03,
 	/* Ring to service mapping support for non-standard mappings */
 	ADF_PFVF_COMPAT_RING_TO_SVC_MAP		= 0x04,
+	/* Fallback compat */
+	ADF_PFVF_COMPAT_FALLBACK		= 0x05,
 	/* Reference to the latest version */
-	ADF_PFVF_COMPAT_THIS_VERSION		= 0x04,
+	ADF_PFVF_COMPAT_THIS_VERSION		= 0x05,
 };
 
 /* PF->VF Version Response */
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_pfvf_pf_msg.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_pfvf_pf_msg.c
@@ -1,24 +1,89 @@
 // SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only)
 /* Copyright(c) 2015 - 2021 Intel Corporation */
+#include <linux/delay.h>
 #include <linux/pci.h>
 #include "adf_accel_devices.h"
 #include "adf_pfvf_msg.h"
 #include "adf_pfvf_pf_msg.h"
 #include "adf_pfvf_pf_proto.h"
 
+#define ADF_PF_WAIT_RESTARTING_COMPLETE_DELAY	100
+#define ADF_VF_SHUTDOWN_RETRY			100
+
 void adf_pf2vf_notify_restarting(struct adf_accel_dev *accel_dev)
 {
 	struct adf_accel_vf_info *vf;
 	struct pfvf_message msg = { .type = ADF_PF2VF_MSGTYPE_RESTARTING };
 	int i, num_vfs = pci_num_vf(accel_to_pci_dev(accel_dev));
 
+	dev_dbg(&GET_DEV(accel_dev), "pf2vf notify restarting\n");
 	for (i = 0, vf = accel_dev->pf.vf_info; i < num_vfs; i++, vf++) {
-		if (vf->init && adf_send_pf2vf_msg(accel_dev, i, msg))
+		if (vf->init && vf->vf_compat_ver >= ADF_PFVF_COMPAT_FALLBACK)
+			vf->restarting = true;
+		else
+			vf->restarting = false;
+
+		if (!vf->init)
+			continue;
+
+		if (adf_send_pf2vf_msg(accel_dev, i, msg))
 			dev_err(&GET_DEV(accel_dev),
 				"Failed to send restarting msg to VF%d\n", i);
 	}
 }
 
+void adf_pf2vf_wait_for_restarting_complete(struct adf_accel_dev *accel_dev)
+{
+	int num_vfs = pci_num_vf(accel_to_pci_dev(accel_dev));
+	int i, retries = ADF_VF_SHUTDOWN_RETRY;
+	struct adf_accel_vf_info *vf;
+	bool vf_running;
+
+	dev_dbg(&GET_DEV(accel_dev), "pf2vf wait for restarting complete\n");
+	do {
+		vf_running = false;
+		for (i = 0, vf = accel_dev->pf.vf_info; i < num_vfs; i++, vf++)
+			if (vf->restarting)
+				vf_running = true;
+		if (!vf_running)
+			break;
+		msleep(ADF_PF_WAIT_RESTARTING_COMPLETE_DELAY);
+	} while (--retries);
+
+	if (vf_running)
+		dev_warn(&GET_DEV(accel_dev), "Some VFs are still running\n");
+}
+
+void adf_pf2vf_notify_restarted(struct adf_accel_dev *accel_dev)
+{
+	struct pfvf_message msg = { .type = ADF_PF2VF_MSGTYPE_RESTARTED };
+	int i, num_vfs = pci_num_vf(accel_to_pci_dev(accel_dev));
+	struct adf_accel_vf_info *vf;
+
+	dev_dbg(&GET_DEV(accel_dev), "pf2vf notify restarted\n");
+	for (i = 0, vf = accel_dev->pf.vf_info; i < num_vfs; i++, vf++) {
+		if (vf->init && vf->vf_compat_ver >= ADF_PFVF_COMPAT_FALLBACK &&
+		    adf_send_pf2vf_msg(accel_dev, i, msg))
+			dev_err(&GET_DEV(accel_dev),
+				"Failed to send restarted msg to VF%d\n", i);
+	}
+}
+
+void adf_pf2vf_notify_fatal_error(struct adf_accel_dev *accel_dev)
+{
+	struct pfvf_message msg = { .type = ADF_PF2VF_MSGTYPE_FATAL_ERROR };
+	int i, num_vfs = pci_num_vf(accel_to_pci_dev(accel_dev));
+	struct adf_accel_vf_info *vf;
+
+	dev_dbg(&GET_DEV(accel_dev), "pf2vf notify fatal error\n");
+	for (i = 0, vf = accel_dev->pf.vf_info; i < num_vfs; i++, vf++) {
+		if (vf->init && vf->vf_compat_ver >= ADF_PFVF_COMPAT_FALLBACK &&
+		    adf_send_pf2vf_msg(accel_dev, i, msg))
+			dev_err(&GET_DEV(accel_dev),
+				"Failed to send fatal error msg to VF%d\n", i);
+	}
+}
+
 int adf_pf_capabilities_msg_provider(struct adf_accel_dev *accel_dev,
 				     u8 *buffer, u8 compat)
 {
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_pfvf_pf_msg.h
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_pfvf_pf_msg.h
@@ -5,7 +5,28 @@
 
 #include "adf_accel_devices.h"
 
+#if defined(CONFIG_PCI_IOV)
 void adf_pf2vf_notify_restarting(struct adf_accel_dev *accel_dev);
+void adf_pf2vf_wait_for_restarting_complete(struct adf_accel_dev *accel_dev);
+void adf_pf2vf_notify_restarted(struct adf_accel_dev *accel_dev);
+void adf_pf2vf_notify_fatal_error(struct adf_accel_dev *accel_dev);
+#else
+static inline void adf_pf2vf_notify_restarting(struct adf_accel_dev *accel_dev)
+{
+}
+
+static inline void adf_pf2vf_wait_for_restarting_complete(struct adf_accel_dev *accel_dev)
+{
+}
+
+static inline void adf_pf2vf_notify_restarted(struct adf_accel_dev *accel_dev)
+{
+}
+
+static inline void adf_pf2vf_notify_fatal_error(struct adf_accel_dev *accel_dev)
+{
+}
+#endif
 
 typedef int (*adf_pf2vf_blkmsg_provider)(struct adf_accel_dev *accel_dev,
 					 u8 *buffer, u8 compat);
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_pfvf_pf_proto.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_pfvf_pf_proto.c
@@ -291,6 +291,14 @@
 		vf_info->init = false;
 		}
 		break;
+	case ADF_VF2PF_MSGTYPE_RESTARTING_COMPLETE:
+		{
+		dev_dbg(&GET_DEV(accel_dev),
+			"Restarting Complete received from VF%d\n", vf_nr);
+		vf_info->restarting = false;
+		vf_info->init = false;
+		}
+		break;
 	case ADF_VF2PF_MSGTYPE_LARGE_BLOCK_REQ:
 	case ADF_VF2PF_MSGTYPE_MEDIUM_BLOCK_REQ:
 	case ADF_VF2PF_MSGTYPE_SMALL_BLOCK_REQ:
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_pfvf_vf_msg.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_pfvf_vf_msg.c
@@ -48,6 +48,20 @@
 }
 EXPORT_SYMBOL_GPL(adf_vf2pf_notify_shutdown);
 
+void adf_vf2pf_notify_restart_complete(struct adf_accel_dev *accel_dev)
+{
+	struct pfvf_message msg = { .type = ADF_VF2PF_MSGTYPE_RESTARTING_COMPLETE };
+
+	/* Check compatibility version */
+	if (accel_dev->vf.pf_compat_ver < ADF_PFVF_COMPAT_FALLBACK)
+		return;
+
+	if (adf_send_vf2pf_msg(accel_dev, msg))
+		dev_err(&GET_DEV(accel_dev),
+			"Failed to send Restarting complete event to PF\n");
+}
+EXPORT_SYMBOL_GPL(adf_vf2pf_notify_restart_complete);
+
 int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev)
 {
 	u8 pf_version;
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_pfvf_vf_msg.h
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_pfvf_vf_msg.h
@@ -6,6 +6,7 @@
 #if defined(CONFIG_PCI_IOV)
 int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev);
 void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev);
+void adf_vf2pf_notify_restart_complete(struct adf_accel_dev *accel_dev);
 int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev);
 int adf_vf2pf_get_capabilities(struct adf_accel_dev *accel_dev);
 int adf_vf2pf_get_ring_to_svc(struct adf_accel_dev *accel_dev);
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_pfvf_vf_proto.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_pfvf_vf_proto.c
@@ -308,6 +308,12 @@
 
 		adf_pf2vf_handle_pf_restarting(accel_dev);
 		return false;
+	case ADF_PF2VF_MSGTYPE_RESTARTED:
+		dev_dbg(&GET_DEV(accel_dev), "Restarted message received from PF\n");
+		return true;
+	case ADF_PF2VF_MSGTYPE_FATAL_ERROR:
+		dev_err(&GET_DEV(accel_dev), "Fatal error received from PF\n");
+		return true;
 	case ADF_PF2VF_MSGTYPE_VERSION_RESP:
 	case ADF_PF2VF_MSGTYPE_BLKMSG_RESP:
 	case ADF_PF2VF_MSGTYPE_RP_RESET_RESP:
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_rl.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_rl.c
@@ -788,6 +788,24 @@
 	sla_type_arr[node_id] = NULL;
 }
 
+static void free_all_sla(struct adf_accel_dev *accel_dev)
+{
+	struct adf_rl *rl_data = accel_dev->rate_limiting;
+	int sla_id;
+
+	mutex_lock(&rl_data->rl_lock);
+
+	for (sla_id = 0; sla_id < RL_NODES_CNT_MAX; sla_id++) {
+		if (!rl_data->sla[sla_id])
+			continue;
+
+		kfree(rl_data->sla[sla_id]);
+		rl_data->sla[sla_id] = NULL;
+	}
+
+	mutex_unlock(&rl_data->rl_lock);
+}
+
 /**
  * add_update_sla() - handles the creation and the update of an SLA
  * @accel_dev: pointer to acceleration device structure
@@ -1088,6 +1106,7 @@
 	mutex_init(&rl->rl_lock);
 	rl->device_data = &accel_dev->hw_device->rl_data;
 	rl->accel_dev = accel_dev;
+	init_rwsem(&rl->user_input.lock);
 	accel_dev->rate_limiting = rl;
 
 err_ret:
@@ -1107,7 +1126,7 @@
 	}
 
 	if ((fw_caps & RL_CAPABILITY_MASK) != RL_CAPABILITY_VALUE) {
-		dev_info(&GET_DEV(accel_dev), "not supported\n");
+		dev_info(&GET_DEV(accel_dev), "feature not supported by FW\n");
 		ret = -EOPNOTSUPP;
 		goto ret_free;
 	}
@@ -1155,7 +1174,7 @@
 		return;
 
 	adf_sysfs_rl_rm(accel_dev);
-	adf_rl_remove_sla_all(accel_dev, true);
+	free_all_sla(accel_dev);
 }
 
 void adf_rl_exit(struct adf_accel_dev *accel_dev)
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_sriov.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_sriov.c
@@ -60,7 +60,6 @@
 		/* This ptr will be populated when VFs will be created */
 		vf_info->accel_dev = accel_dev;
 		vf_info->vf_nr = i;
-		vf_info->vf_compat_ver = 0;
 
 		mutex_init(&vf_info->pf2vf_lock);
 		ratelimit_state_init(&vf_info->vf2pf_ratelimit,
@@ -84,6 +83,32 @@
 	return pci_enable_sriov(pdev, totalvfs);
 }
 
+void adf_reenable_sriov(struct adf_accel_dev *accel_dev)
+{
+	struct pci_dev *pdev = accel_to_pci_dev(accel_dev);
+	char cfg[ADF_CFG_MAX_VAL_LEN_IN_BYTES] = {0};
+	unsigned long val = 0;
+
+	if (adf_cfg_get_param_value(accel_dev, ADF_GENERAL_SEC,
+				    ADF_SRIOV_ENABLED, cfg))
+		return;
+
+	if (!accel_dev->pf.vf_info)
+		return;
+
+	if (adf_cfg_add_key_value_param(accel_dev, ADF_KERNEL_SEC, ADF_NUM_CY,
+					&val, ADF_DEC))
+		return;
+
+	if (adf_cfg_add_key_value_param(accel_dev, ADF_KERNEL_SEC, ADF_NUM_DC,
+					&val, ADF_DEC))
+		return;
+
+	set_bit(ADF_STATUS_CONFIGURED, &accel_dev->status);
+	dev_dbg(&pdev->dev, "Re-enabling SRIOV\n");
+	adf_enable_sriov(accel_dev);
+}
+
 /**
  * adf_disable_sriov() - Disable SRIOV for the device
  * @accel_dev:  Pointer to accel device.
@@ -103,6 +128,7 @@
 		return;
 
 	adf_pf2vf_notify_restarting(accel_dev);
+	adf_pf2vf_wait_for_restarting_complete(accel_dev);
 	pci_disable_sriov(accel_to_pci_dev(accel_dev));
 
 	/* Disable VF to PF interrupts */
@@ -115,8 +141,10 @@
 	for (i = 0, vf = accel_dev->pf.vf_info; i < totalvfs; i++, vf++)
 		mutex_destroy(&vf->pf2vf_lock);
 
-	kfree(accel_dev->pf.vf_info);
-	accel_dev->pf.vf_info = NULL;
+	if (!test_bit(ADF_STATUS_RESTARTING, &accel_dev->status)) {
+		kfree(accel_dev->pf.vf_info);
+		accel_dev->pf.vf_info = NULL;
+	}
 }
 EXPORT_SYMBOL_GPL(adf_disable_sriov);
 
@@ -194,6 +222,10 @@
 	if (ret)
 		return ret;
 
+	val = 1;
+	adf_cfg_add_key_value_param(accel_dev, ADF_GENERAL_SEC, ADF_SRIOV_ENABLED,
+				    &val, ADF_DEC);
+
 	return numvfs;
 }
 EXPORT_SYMBOL_GPL(adf_sriov_configure);
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_sysfs.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_sysfs.c
@@ -204,6 +204,42 @@
 }
 static DEVICE_ATTR_RW(pm_idle_enabled);
 
+static ssize_t auto_reset_show(struct device *dev, struct device_attribute *attr,
+			       char *buf)
+{
+	char *auto_reset;
+	struct adf_accel_dev *accel_dev;
+
+	accel_dev = adf_devmgr_pci_to_accel_dev(to_pci_dev(dev));
+	if (!accel_dev)
+		return -EINVAL;
+
+	auto_reset = accel_dev->autoreset_on_error ? "on" : "off";
+
+	return sysfs_emit(buf, "%s\n", auto_reset);
+}
+
+static ssize_t auto_reset_store(struct device *dev, struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct adf_accel_dev *accel_dev;
+	bool enabled = false;
+	int ret;
+
+	ret = kstrtobool(buf, &enabled);
+	if (ret)
+		return ret;
+
+	accel_dev = adf_devmgr_pci_to_accel_dev(to_pci_dev(dev));
+	if (!accel_dev)
+		return -EINVAL;
+
+	accel_dev->autoreset_on_error = enabled;
+
+	return count;
+}
+static DEVICE_ATTR_RW(auto_reset);
+
 static DEVICE_ATTR_RW(state);
 static DEVICE_ATTR_RW(cfg_services);
 
@@ -291,6 +327,7 @@
 	&dev_attr_pm_idle_enabled.attr,
 	&dev_attr_rp2srv.attr,
 	&dev_attr_num_rps.attr,
+	&dev_attr_auto_reset.attr,
 	NULL,
 };
 
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_telemetry.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_telemetry.c
@@ -41,6 +41,20 @@
 	return 0;
 }
 
+static int validate_tl_slice_counters(struct icp_qat_fw_init_admin_slice_cnt *slice_count,
+				      u8 max_slices_per_type)
+{
+	u8 *sl_counter = (u8 *)slice_count;
+	int i;
+
+	for (i = 0; i < ADF_TL_SL_CNT_COUNT; i++) {
+		if (sl_counter[i] > max_slices_per_type)
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int adf_tl_alloc_mem(struct adf_accel_dev *accel_dev)
 {
 	struct adf_tl_hw_data *tl_data = &GET_TL_DATA(accel_dev);
@@ -214,6 +228,13 @@
 		return ret;
 	}
 
+	ret = validate_tl_slice_counters(&telemetry->slice_cnt, tl_data->max_sl_cnt);
+	if (ret) {
+		dev_err(dev, "invalid value returned by FW\n");
+		adf_send_admin_tl_stop(accel_dev);
+		return ret;
+	}
+
 	telemetry->hbuffs = state;
 	atomic_set(&telemetry->state, state);
 
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_telemetry.h
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_telemetry.h
@@ -40,6 +40,7 @@
 	u8 num_dev_counters;
 	u8 num_rp_counters;
 	u8 max_rp;
+	u8 max_sl_cnt;
 };
 
 struct adf_telemetry {
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
@@ -13,6 +13,7 @@
 #include "adf_cfg.h"
 #include "adf_cfg_strings.h"
 #include "adf_cfg_common.h"
+#include "adf_pfvf_vf_msg.h"
 #include "adf_transport_access_macros.h"
 #include "adf_transport_internal.h"
 
@@ -75,6 +76,7 @@
 
 	/* Re-enable PF2VF interrupts */
 	adf_enable_pf2vf_interrupts(accel_dev);
+	adf_vf2pf_notify_restart_complete(accel_dev);
 	kfree(stop_data);
 }
 
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c
@@ -13,15 +13,6 @@
 #include "qat_compression.h"
 #include "qat_algs_send.h"
 
-#define QAT_RFC_1950_HDR_SIZE 2
-#define QAT_RFC_1950_FOOTER_SIZE 4
-#define QAT_RFC_1950_CM_DEFLATE 8
-#define QAT_RFC_1950_CM_DEFLATE_CINFO_32K 7
-#define QAT_RFC_1950_CM_MASK 0x0f
-#define QAT_RFC_1950_CM_OFFSET 4
-#define QAT_RFC_1950_DICT_MASK 0x20
-#define QAT_RFC_1950_COMP_HDR 0x785e
-
 static DEFINE_MUTEX(algs_lock);
 static unsigned int active_devs;
 
--- linux-qcom-6.8.0.orig/drivers/crypto/intel/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c
+++ linux-qcom-6.8.0/drivers/crypto/intel/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c
@@ -192,8 +192,12 @@
 	ADF_CSR_WR(pmisc_addr, ADF_GEN2_ERRMSK3, errmsk3);
 	ADF_CSR_WR(pmisc_addr, ADF_GEN2_ERRMSK5, errmsk5);
 
-	errmsk3 &= ADF_DH895XCC_ERR_MSK_VF2PF_L(sources | disabled);
-	errmsk5 &= ADF_DH895XCC_ERR_MSK_VF2PF_U(sources | disabled);
+	/* Update only section of errmsk3 and errmsk5 related to VF2PF */
+	errmsk3 &= ~ADF_DH895XCC_ERR_MSK_VF2PF_L(ADF_DH895XCC_VF_MSK);
+	errmsk5 &= ~ADF_DH895XCC_ERR_MSK_VF2PF_U(ADF_DH895XCC_VF_MSK);
+
+	errmsk3 |= ADF_DH895XCC_ERR_MSK_VF2PF_L(sources | disabled);
+	errmsk5 |= ADF_DH895XCC_ERR_MSK_VF2PF_U(sources | disabled);
 	ADF_CSR_WR(pmisc_addr, ADF_GEN2_ERRMSK3, errmsk3);
 	ADF_CSR_WR(pmisc_addr, ADF_GEN2_ERRMSK5, errmsk5);
 
--- linux-qcom-6.8.0.orig/drivers/crypto/marvell/Kconfig
+++ linux-qcom-6.8.0/drivers/crypto/marvell/Kconfig
@@ -28,6 +28,7 @@
 	select CRYPTO_SKCIPHER
 	select CRYPTO_HASH
 	select CRYPTO_AEAD
+	select CRYPTO_AUTHENC
 	select CRYPTO_DEV_MARVELL
 	help
 		This driver allows you to utilize the Marvell Cryptographic
@@ -47,6 +48,7 @@
 	select CRYPTO_SKCIPHER
 	select CRYPTO_HASH
 	select CRYPTO_AEAD
+	select CRYPTO_AUTHENC
 	select NET_DEVLINK
 	help
 		This driver allows you to utilize the Marvell Cryptographic
--- linux-qcom-6.8.0.orig/drivers/crypto/marvell/cesa/hash.c
+++ linux-qcom-6.8.0/drivers/crypto/marvell/cesa/hash.c
@@ -947,7 +947,7 @@
 		.base = {
 			.cra_name = "md5",
 			.cra_driver_name = "mv-md5",
-			.cra_priority = 300,
+			.cra_priority = 0,
 			.cra_flags = CRYPTO_ALG_ASYNC |
 				     CRYPTO_ALG_ALLOCATES_MEMORY |
 				     CRYPTO_ALG_KERN_DRIVER_ONLY,
@@ -1018,7 +1018,7 @@
 		.base = {
 			.cra_name = "sha1",
 			.cra_driver_name = "mv-sha1",
-			.cra_priority = 300,
+			.cra_priority = 0,
 			.cra_flags = CRYPTO_ALG_ASYNC |
 				     CRYPTO_ALG_ALLOCATES_MEMORY |
 				     CRYPTO_ALG_KERN_DRIVER_ONLY,
@@ -1092,7 +1092,7 @@
 		.base = {
 			.cra_name = "sha256",
 			.cra_driver_name = "mv-sha256",
-			.cra_priority = 300,
+			.cra_priority = 0,
 			.cra_flags = CRYPTO_ALG_ASYNC |
 				     CRYPTO_ALG_ALLOCATES_MEMORY |
 				     CRYPTO_ALG_KERN_DRIVER_ONLY,
@@ -1302,7 +1302,7 @@
 		.base = {
 			.cra_name = "hmac(md5)",
 			.cra_driver_name = "mv-hmac-md5",
-			.cra_priority = 300,
+			.cra_priority = 0,
 			.cra_flags = CRYPTO_ALG_ASYNC |
 				     CRYPTO_ALG_ALLOCATES_MEMORY |
 				     CRYPTO_ALG_KERN_DRIVER_ONLY,
@@ -1373,7 +1373,7 @@
 		.base = {
 			.cra_name = "hmac(sha1)",
 			.cra_driver_name = "mv-hmac-sha1",
-			.cra_priority = 300,
+			.cra_priority = 0,
 			.cra_flags = CRYPTO_ALG_ASYNC |
 				     CRYPTO_ALG_ALLOCATES_MEMORY |
 				     CRYPTO_ALG_KERN_DRIVER_ONLY,
@@ -1444,7 +1444,7 @@
 		.base = {
 			.cra_name = "hmac(sha256)",
 			.cra_driver_name = "mv-hmac-sha256",
-			.cra_priority = 300,
+			.cra_priority = 0,
 			.cra_flags = CRYPTO_ALG_ASYNC |
 				     CRYPTO_ALG_ALLOCATES_MEMORY |
 				     CRYPTO_ALG_KERN_DRIVER_ONLY,
--- linux-qcom-6.8.0.orig/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
+++ linux-qcom-6.8.0/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
@@ -17,7 +17,6 @@
 #include <crypto/sha2.h>
 #include <crypto/xts.h>
 #include <crypto/scatterwalk.h>
-#include <linux/rtnetlink.h>
 #include <linux/sort.h>
 #include <linux/module.h>
 #include "otx_cptvf.h"
@@ -66,6 +65,8 @@
 	.count = ATOMIC_INIT(0)
 };
 
+static struct otx_cpt_sdesc *alloc_sdesc(struct crypto_shash *alg);
+
 static inline int get_se_device(struct pci_dev **pdev, int *cpu_num)
 {
 	int count, ret = 0;
@@ -509,44 +510,61 @@
 	ctx->cipher_type = cipher_type;
 	ctx->mac_type = mac_type;
 
+	switch (ctx->mac_type) {
+	case OTX_CPT_SHA1:
+		ctx->hashalg = crypto_alloc_shash("sha1", 0, 0);
+		break;
+
+	case OTX_CPT_SHA256:
+		ctx->hashalg = crypto_alloc_shash("sha256", 0, 0);
+		break;
+
+	case OTX_CPT_SHA384:
+		ctx->hashalg = crypto_alloc_shash("sha384", 0, 0);
+		break;
+
+	case OTX_CPT_SHA512:
+		ctx->hashalg = crypto_alloc_shash("sha512", 0, 0);
+		break;
+	}
+
+	if (IS_ERR(ctx->hashalg))
+		return PTR_ERR(ctx->hashalg);
+
+	crypto_aead_set_reqsize_dma(tfm, sizeof(struct otx_cpt_req_ctx));
+
+	if (!ctx->hashalg)
+		return 0;
+
 	/*
 	 * When selected cipher is NULL we use HMAC opcode instead of
 	 * FLEXICRYPTO opcode therefore we don't need to use HASH algorithms
 	 * for calculating ipad and opad
 	 */
 	if (ctx->cipher_type != OTX_CPT_CIPHER_NULL) {
-		switch (ctx->mac_type) {
-		case OTX_CPT_SHA1:
-			ctx->hashalg = crypto_alloc_shash("sha1", 0,
-							  CRYPTO_ALG_ASYNC);
-			if (IS_ERR(ctx->hashalg))
-				return PTR_ERR(ctx->hashalg);
-			break;
-
-		case OTX_CPT_SHA256:
-			ctx->hashalg = crypto_alloc_shash("sha256", 0,
-							  CRYPTO_ALG_ASYNC);
-			if (IS_ERR(ctx->hashalg))
-				return PTR_ERR(ctx->hashalg);
-			break;
-
-		case OTX_CPT_SHA384:
-			ctx->hashalg = crypto_alloc_shash("sha384", 0,
-							  CRYPTO_ALG_ASYNC);
-			if (IS_ERR(ctx->hashalg))
-				return PTR_ERR(ctx->hashalg);
-			break;
-
-		case OTX_CPT_SHA512:
-			ctx->hashalg = crypto_alloc_shash("sha512", 0,
-							  CRYPTO_ALG_ASYNC);
-			if (IS_ERR(ctx->hashalg))
-				return PTR_ERR(ctx->hashalg);
-			break;
+		int ss = crypto_shash_statesize(ctx->hashalg);
+
+		ctx->ipad = kzalloc(ss, GFP_KERNEL);
+		if (!ctx->ipad) {
+			crypto_free_shash(ctx->hashalg);
+			return -ENOMEM;
+		}
+
+		ctx->opad = kzalloc(ss, GFP_KERNEL);
+		if (!ctx->opad) {
+			kfree(ctx->ipad);
+			crypto_free_shash(ctx->hashalg);
+			return -ENOMEM;
 		}
 	}
 
-	crypto_aead_set_reqsize_dma(tfm, sizeof(struct otx_cpt_req_ctx));
+	ctx->sdesc = alloc_sdesc(ctx->hashalg);
+	if (!ctx->sdesc) {
+		kfree(ctx->opad);
+		kfree(ctx->ipad);
+		crypto_free_shash(ctx->hashalg);
+		return -ENOMEM;
+	}
 
 	return 0;
 }
@@ -602,8 +620,7 @@
 
 	kfree(ctx->ipad);
 	kfree(ctx->opad);
-	if (ctx->hashalg)
-		crypto_free_shash(ctx->hashalg);
+	crypto_free_shash(ctx->hashalg);
 	kfree(ctx->sdesc);
 }
 
@@ -699,7 +716,7 @@
 		*dst = cpu_to_be64p(src);
 }
 
-static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)
+static int swap_pad(u8 mac_type, u8 *pad)
 {
 	struct sha512_state *sha512;
 	struct sha256_state *sha256;
@@ -707,22 +724,19 @@
 
 	switch (mac_type) {
 	case OTX_CPT_SHA1:
-		sha1 = (struct sha1_state *) in_pad;
+		sha1 = (struct sha1_state *)pad;
 		swap_data32(sha1->state, SHA1_DIGEST_SIZE);
-		memcpy(out_pad, &sha1->state, SHA1_DIGEST_SIZE);
 		break;
 
 	case OTX_CPT_SHA256:
-		sha256 = (struct sha256_state *) in_pad;
+		sha256 = (struct sha256_state *)pad;
 		swap_data32(sha256->state, SHA256_DIGEST_SIZE);
-		memcpy(out_pad, &sha256->state, SHA256_DIGEST_SIZE);
 		break;
 
 	case OTX_CPT_SHA384:
 	case OTX_CPT_SHA512:
-		sha512 = (struct sha512_state *) in_pad;
+		sha512 = (struct sha512_state *)pad;
 		swap_data64(sha512->state, SHA512_DIGEST_SIZE);
-		memcpy(out_pad, &sha512->state, SHA512_DIGEST_SIZE);
 		break;
 
 	default:
@@ -732,55 +746,53 @@
 	return 0;
 }
 
-static int aead_hmac_init(struct crypto_aead *cipher)
+static int aead_hmac_init(struct crypto_aead *cipher,
+			  struct crypto_authenc_keys *keys)
 {
 	struct otx_cpt_aead_ctx *ctx = crypto_aead_ctx_dma(cipher);
-	int state_size = crypto_shash_statesize(ctx->hashalg);
 	int ds = crypto_shash_digestsize(ctx->hashalg);
 	int bs = crypto_shash_blocksize(ctx->hashalg);
-	int authkeylen = ctx->auth_key_len;
+	int authkeylen = keys->authkeylen;
 	u8 *ipad = NULL, *opad = NULL;
-	int ret = 0, icount = 0;
+	int icount = 0;
+	int ret;
 
-	ctx->sdesc = alloc_sdesc(ctx->hashalg);
-	if (!ctx->sdesc)
-		return -ENOMEM;
+	if (authkeylen > bs) {
+		ret = crypto_shash_digest(&ctx->sdesc->shash, keys->authkey,
+					  authkeylen, ctx->key);
+		if (ret)
+			return ret;
+		authkeylen = ds;
+	} else
+		memcpy(ctx->key, keys->authkey, authkeylen);
 
-	ctx->ipad = kzalloc(bs, GFP_KERNEL);
-	if (!ctx->ipad) {
-		ret = -ENOMEM;
-		goto calc_fail;
-	}
+	ctx->enc_key_len = keys->enckeylen;
+	ctx->auth_key_len = authkeylen;
 
-	ctx->opad = kzalloc(bs, GFP_KERNEL);
-	if (!ctx->opad) {
-		ret = -ENOMEM;
-		goto calc_fail;
-	}
+	if (ctx->cipher_type == OTX_CPT_CIPHER_NULL)
+		return keys->enckeylen ? -EINVAL : 0;
 
-	ipad = kzalloc(state_size, GFP_KERNEL);
-	if (!ipad) {
-		ret = -ENOMEM;
-		goto calc_fail;
+	switch (keys->enckeylen) {
+	case AES_KEYSIZE_128:
+		ctx->key_type = OTX_CPT_AES_128_BIT;
+		break;
+	case AES_KEYSIZE_192:
+		ctx->key_type = OTX_CPT_AES_192_BIT;
+		break;
+	case AES_KEYSIZE_256:
+		ctx->key_type = OTX_CPT_AES_256_BIT;
+		break;
+	default:
+		/* Invalid key length */
+		return -EINVAL;
 	}
 
-	opad = kzalloc(state_size, GFP_KERNEL);
-	if (!opad) {
-		ret = -ENOMEM;
-		goto calc_fail;
-	}
+	memcpy(ctx->key + authkeylen, keys->enckey, keys->enckeylen);
 
-	if (authkeylen > bs) {
-		ret = crypto_shash_digest(&ctx->sdesc->shash, ctx->key,
-					  authkeylen, ipad);
-		if (ret)
-			goto calc_fail;
-
-		authkeylen = ds;
-	} else {
-		memcpy(ipad, ctx->key, authkeylen);
-	}
+	ipad = ctx->ipad;
+	opad = ctx->opad;
 
+	memcpy(ipad, ctx->key, authkeylen);
 	memset(ipad + authkeylen, 0, bs - authkeylen);
 	memcpy(opad, ipad, bs);
 
@@ -798,7 +810,7 @@
 	crypto_shash_init(&ctx->sdesc->shash);
 	crypto_shash_update(&ctx->sdesc->shash, ipad, bs);
 	crypto_shash_export(&ctx->sdesc->shash, ipad);
-	ret = copy_pad(ctx->mac_type, ctx->ipad, ipad);
+	ret = swap_pad(ctx->mac_type, ipad);
 	if (ret)
 		goto calc_fail;
 
@@ -806,25 +818,9 @@
 	crypto_shash_init(&ctx->sdesc->shash);
 	crypto_shash_update(&ctx->sdesc->shash, opad, bs);
 	crypto_shash_export(&ctx->sdesc->shash, opad);
-	ret = copy_pad(ctx->mac_type, ctx->opad, opad);
-	if (ret)
-		goto calc_fail;
-
-	kfree(ipad);
-	kfree(opad);
-
-	return 0;
+	ret = swap_pad(ctx->mac_type, opad);
 
 calc_fail:
-	kfree(ctx->ipad);
-	ctx->ipad = NULL;
-	kfree(ctx->opad);
-	ctx->opad = NULL;
-	kfree(ipad);
-	kfree(opad);
-	kfree(ctx->sdesc);
-	ctx->sdesc = NULL;
-
 	return ret;
 }
 
@@ -832,57 +828,15 @@
 					   const unsigned char *key,
 					   unsigned int keylen)
 {
-	struct otx_cpt_aead_ctx *ctx = crypto_aead_ctx_dma(cipher);
-	struct crypto_authenc_key_param *param;
-	int enckeylen = 0, authkeylen = 0;
-	struct rtattr *rta = (void *)key;
-	int status = -EINVAL;
-
-	if (!RTA_OK(rta, keylen))
-		goto badkey;
-
-	if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-		goto badkey;
-
-	if (RTA_PAYLOAD(rta) < sizeof(*param))
-		goto badkey;
-
-	param = RTA_DATA(rta);
-	enckeylen = be32_to_cpu(param->enckeylen);
-	key += RTA_ALIGN(rta->rta_len);
-	keylen -= RTA_ALIGN(rta->rta_len);
-	if (keylen < enckeylen)
-		goto badkey;
-
-	if (keylen > OTX_CPT_MAX_KEY_SIZE)
-		goto badkey;
-
-	authkeylen = keylen - enckeylen;
-	memcpy(ctx->key, key, keylen);
-
-	switch (enckeylen) {
-	case AES_KEYSIZE_128:
-		ctx->key_type = OTX_CPT_AES_128_BIT;
-		break;
-	case AES_KEYSIZE_192:
-		ctx->key_type = OTX_CPT_AES_192_BIT;
-		break;
-	case AES_KEYSIZE_256:
-		ctx->key_type = OTX_CPT_AES_256_BIT;
-		break;
-	default:
-		/* Invalid key length */
-		goto badkey;
-	}
+	struct crypto_authenc_keys authenc_keys;
+	int status;
 
-	ctx->enc_key_len = enckeylen;
-	ctx->auth_key_len = authkeylen;
-
-	status = aead_hmac_init(cipher);
+	status = crypto_authenc_extractkeys(&authenc_keys, key, keylen);
 	if (status)
 		goto badkey;
 
-	return 0;
+	status = aead_hmac_init(cipher, &authenc_keys);
+
 badkey:
 	return status;
 }
@@ -891,36 +845,7 @@
 					    const unsigned char *key,
 					    unsigned int keylen)
 {
-	struct otx_cpt_aead_ctx *ctx = crypto_aead_ctx_dma(cipher);
-	struct crypto_authenc_key_param *param;
-	struct rtattr *rta = (void *)key;
-	int enckeylen = 0;
-
-	if (!RTA_OK(rta, keylen))
-		goto badkey;
-
-	if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-		goto badkey;
-
-	if (RTA_PAYLOAD(rta) < sizeof(*param))
-		goto badkey;
-
-	param = RTA_DATA(rta);
-	enckeylen = be32_to_cpu(param->enckeylen);
-	key += RTA_ALIGN(rta->rta_len);
-	keylen -= RTA_ALIGN(rta->rta_len);
-	if (enckeylen != 0)
-		goto badkey;
-
-	if (keylen > OTX_CPT_MAX_KEY_SIZE)
-		goto badkey;
-
-	memcpy(ctx->key, key, keylen);
-	ctx->enc_key_len = enckeylen;
-	ctx->auth_key_len = keylen;
-	return 0;
-badkey:
-	return -EINVAL;
+	return otx_cpt_aead_cbc_aes_sha_setkey(cipher, key, keylen);
 }
 
 static int otx_cpt_aead_gcm_aes_setkey(struct crypto_aead *cipher,
--- linux-qcom-6.8.0.orig/drivers/crypto/marvell/octeontx2/cn10k_cpt.c
+++ linux-qcom-6.8.0/drivers/crypto/marvell/octeontx2/cn10k_cpt.c
@@ -138,6 +138,10 @@
 		return -ENOMEM;
 	cptr_dma = dma_map_single(&pdev->dev, hctx, CN10K_CPT_HW_CTX_SIZE,
 				  DMA_BIDIRECTIONAL);
+	if (dma_mapping_error(&pdev->dev, cptr_dma)) {
+		kfree(hctx);
+		return -ENOMEM;
+	}
 
 	cn10k_cpt_hw_ctx_set(hctx, 1);
 	er_ctx->hw_ctx = hctx;
--- linux-qcom-6.8.0.orig/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
+++ linux-qcom-6.8.0/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
@@ -11,7 +11,6 @@
 #include <crypto/xts.h>
 #include <crypto/gcm.h>
 #include <crypto/scatterwalk.h>
-#include <linux/rtnetlink.h>
 #include <linux/sort.h>
 #include <linux/module.h>
 #include "otx2_cptvf.h"
@@ -55,6 +54,8 @@
 	.count = ATOMIC_INIT(0)
 };
 
+static struct otx2_cpt_sdesc *alloc_sdesc(struct crypto_shash *alg);
+
 static inline int get_se_device(struct pci_dev **pdev, int *cpu_num)
 {
 	int count;
@@ -598,40 +599,56 @@
 	ctx->cipher_type = cipher_type;
 	ctx->mac_type = mac_type;
 
+	switch (ctx->mac_type) {
+	case OTX2_CPT_SHA1:
+		ctx->hashalg = crypto_alloc_shash("sha1", 0, 0);
+		break;
+
+	case OTX2_CPT_SHA256:
+		ctx->hashalg = crypto_alloc_shash("sha256", 0, 0);
+		break;
+
+	case OTX2_CPT_SHA384:
+		ctx->hashalg = crypto_alloc_shash("sha384", 0, 0);
+		break;
+
+	case OTX2_CPT_SHA512:
+		ctx->hashalg = crypto_alloc_shash("sha512", 0, 0);
+		break;
+	}
+
+	if (IS_ERR(ctx->hashalg))
+		return PTR_ERR(ctx->hashalg);
+
+	if (ctx->hashalg) {
+		ctx->sdesc = alloc_sdesc(ctx->hashalg);
+		if (!ctx->sdesc) {
+			crypto_free_shash(ctx->hashalg);
+			return -ENOMEM;
+		}
+	}
+
 	/*
 	 * When selected cipher is NULL we use HMAC opcode instead of
 	 * FLEXICRYPTO opcode therefore we don't need to use HASH algorithms
 	 * for calculating ipad and opad
 	 */
-	if (ctx->cipher_type != OTX2_CPT_CIPHER_NULL) {
-		switch (ctx->mac_type) {
-		case OTX2_CPT_SHA1:
-			ctx->hashalg = crypto_alloc_shash("sha1", 0,
-							  CRYPTO_ALG_ASYNC);
-			if (IS_ERR(ctx->hashalg))
-				return PTR_ERR(ctx->hashalg);
-			break;
-
-		case OTX2_CPT_SHA256:
-			ctx->hashalg = crypto_alloc_shash("sha256", 0,
-							  CRYPTO_ALG_ASYNC);
-			if (IS_ERR(ctx->hashalg))
-				return PTR_ERR(ctx->hashalg);
-			break;
-
-		case OTX2_CPT_SHA384:
-			ctx->hashalg = crypto_alloc_shash("sha384", 0,
-							  CRYPTO_ALG_ASYNC);
-			if (IS_ERR(ctx->hashalg))
-				return PTR_ERR(ctx->hashalg);
-			break;
-
-		case OTX2_CPT_SHA512:
-			ctx->hashalg = crypto_alloc_shash("sha512", 0,
-							  CRYPTO_ALG_ASYNC);
-			if (IS_ERR(ctx->hashalg))
-				return PTR_ERR(ctx->hashalg);
-			break;
+	if (ctx->cipher_type != OTX2_CPT_CIPHER_NULL && ctx->hashalg) {
+		int ss = crypto_shash_statesize(ctx->hashalg);
+
+		ctx->ipad = kzalloc(ss, GFP_KERNEL);
+		if (!ctx->ipad) {
+			kfree(ctx->sdesc);
+			crypto_free_shash(ctx->hashalg);
+			return -ENOMEM;
+		}
+
+		ctx->opad = kzalloc(ss, GFP_KERNEL);
+		if (!ctx->opad) {
+			kfree(ctx->ipad);
+			kfree(ctx->sdesc);
+			crypto_free_shash(ctx->hashalg);
+			return -ENOMEM;
 		}
 	}
 	switch (ctx->cipher_type) {
@@ -713,8 +730,7 @@
 
 	kfree(ctx->ipad);
 	kfree(ctx->opad);
-	if (ctx->hashalg)
-		crypto_free_shash(ctx->hashalg);
+	crypto_free_shash(ctx->hashalg);
 	kfree(ctx->sdesc);
 
 	if (ctx->fbk_cipher) {
@@ -788,7 +804,7 @@
 		cpu_to_be64s(src);
 }
 
-static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)
+static int swap_pad(u8 mac_type, u8 *pad)
 {
 	struct sha512_state *sha512;
 	struct sha256_state *sha256;
@@ -796,22 +812,19 @@
 
 	switch (mac_type) {
 	case OTX2_CPT_SHA1:
-		sha1 = (struct sha1_state *) in_pad;
+		sha1 = (struct sha1_state *)pad;
 		swap_data32(sha1->state, SHA1_DIGEST_SIZE);
-		memcpy(out_pad, &sha1->state, SHA1_DIGEST_SIZE);
 		break;
 
 	case OTX2_CPT_SHA256:
-		sha256 = (struct sha256_state *) in_pad;
+		sha256 = (struct sha256_state *)pad;
 		swap_data32(sha256->state, SHA256_DIGEST_SIZE);
-		memcpy(out_pad, &sha256->state, SHA256_DIGEST_SIZE);
 		break;
 
 	case OTX2_CPT_SHA384:
 	case OTX2_CPT_SHA512:
-		sha512 = (struct sha512_state *) in_pad;
+		sha512 = (struct sha512_state *)pad;
 		swap_data64(sha512->state, SHA512_DIGEST_SIZE);
-		memcpy(out_pad, &sha512->state, SHA512_DIGEST_SIZE);
 		break;
 
 	default:
@@ -821,55 +834,54 @@
 	return 0;
 }
 
-static int aead_hmac_init(struct crypto_aead *cipher)
+static int aead_hmac_init(struct crypto_aead *cipher,
+			  struct crypto_authenc_keys *keys)
 {
 	struct otx2_cpt_aead_ctx *ctx = crypto_aead_ctx_dma(cipher);
-	int state_size = crypto_shash_statesize(ctx->hashalg);
 	int ds = crypto_shash_digestsize(ctx->hashalg);
 	int bs = crypto_shash_blocksize(ctx->hashalg);
-	int authkeylen = ctx->auth_key_len;
+	int authkeylen = keys->authkeylen;
 	u8 *ipad = NULL, *opad = NULL;
-	int ret = 0, icount = 0;
-
-	ctx->sdesc = alloc_sdesc(ctx->hashalg);
-	if (!ctx->sdesc)
-		return -ENOMEM;
-
-	ctx->ipad = kzalloc(bs, GFP_KERNEL);
-	if (!ctx->ipad) {
-		ret = -ENOMEM;
-		goto calc_fail;
-	}
-
-	ctx->opad = kzalloc(bs, GFP_KERNEL);
-	if (!ctx->opad) {
-		ret = -ENOMEM;
-		goto calc_fail;
-	}
-
-	ipad = kzalloc(state_size, GFP_KERNEL);
-	if (!ipad) {
-		ret = -ENOMEM;
-		goto calc_fail;
-	}
-
-	opad = kzalloc(state_size, GFP_KERNEL);
-	if (!opad) {
-		ret = -ENOMEM;
-		goto calc_fail;
-	}
+	int icount = 0;
+	int ret;
 
 	if (authkeylen > bs) {
-		ret = crypto_shash_digest(&ctx->sdesc->shash, ctx->key,
-					  authkeylen, ipad);
+		ret = crypto_shash_digest(&ctx->sdesc->shash, keys->authkey,
+					  authkeylen, ctx->key);
 		if (ret)
 			goto calc_fail;
 
 		authkeylen = ds;
-	} else {
-		memcpy(ipad, ctx->key, authkeylen);
+	} else
+		memcpy(ctx->key, keys->authkey, authkeylen);
+
+	ctx->enc_key_len = keys->enckeylen;
+	ctx->auth_key_len = authkeylen;
+
+	if (ctx->cipher_type == OTX2_CPT_CIPHER_NULL)
+		return keys->enckeylen ? -EINVAL : 0;
+
+	switch (keys->enckeylen) {
+	case AES_KEYSIZE_128:
+		ctx->key_type = OTX2_CPT_AES_128_BIT;
+		break;
+	case AES_KEYSIZE_192:
+		ctx->key_type = OTX2_CPT_AES_192_BIT;
+		break;
+	case AES_KEYSIZE_256:
+		ctx->key_type = OTX2_CPT_AES_256_BIT;
+		break;
+	default:
+		/* Invalid key length */
+		return -EINVAL;
 	}
 
+	memcpy(ctx->key + authkeylen, keys->enckey, keys->enckeylen);
+
+	ipad = ctx->ipad;
+	opad = ctx->opad;
+
+	memcpy(ipad, ctx->key, authkeylen);
 	memset(ipad + authkeylen, 0, bs - authkeylen);
 	memcpy(opad, ipad, bs);
 
@@ -887,7 +899,7 @@
 	crypto_shash_init(&ctx->sdesc->shash);
 	crypto_shash_update(&ctx->sdesc->shash, ipad, bs);
 	crypto_shash_export(&ctx->sdesc->shash, ipad);
-	ret = copy_pad(ctx->mac_type, ctx->ipad, ipad);
+	ret = swap_pad(ctx->mac_type, ipad);
 	if (ret)
 		goto calc_fail;
 
@@ -895,25 +907,9 @@
 	crypto_shash_init(&ctx->sdesc->shash);
 	crypto_shash_update(&ctx->sdesc->shash, opad, bs);
 	crypto_shash_export(&ctx->sdesc->shash, opad);
-	ret = copy_pad(ctx->mac_type, ctx->opad, opad);
-	if (ret)
-		goto calc_fail;
-
-	kfree(ipad);
-	kfree(opad);
-
-	return 0;
+	ret = swap_pad(ctx->mac_type, opad);
 
 calc_fail:
-	kfree(ctx->ipad);
-	ctx->ipad = NULL;
-	kfree(ctx->opad);
-	ctx->opad = NULL;
-	kfree(ipad);
-	kfree(opad);
-	kfree(ctx->sdesc);
-	ctx->sdesc = NULL;
-
 	return ret;
 }
 
@@ -921,87 +917,17 @@
 					    const unsigned char *key,
 					    unsigned int keylen)
 {
-	struct otx2_cpt_aead_ctx *ctx = crypto_aead_ctx_dma(cipher);
-	struct crypto_authenc_key_param *param;
-	int enckeylen = 0, authkeylen = 0;
-	struct rtattr *rta = (void *)key;
-
-	if (!RTA_OK(rta, keylen))
-		return -EINVAL;
-
-	if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-		return -EINVAL;
-
-	if (RTA_PAYLOAD(rta) < sizeof(*param))
-		return -EINVAL;
-
-	param = RTA_DATA(rta);
-	enckeylen = be32_to_cpu(param->enckeylen);
-	key += RTA_ALIGN(rta->rta_len);
-	keylen -= RTA_ALIGN(rta->rta_len);
-	if (keylen < enckeylen)
-		return -EINVAL;
-
-	if (keylen > OTX2_CPT_MAX_KEY_SIZE)
-		return -EINVAL;
-
-	authkeylen = keylen - enckeylen;
-	memcpy(ctx->key, key, keylen);
-
-	switch (enckeylen) {
-	case AES_KEYSIZE_128:
-		ctx->key_type = OTX2_CPT_AES_128_BIT;
-		break;
-	case AES_KEYSIZE_192:
-		ctx->key_type = OTX2_CPT_AES_192_BIT;
-		break;
-	case AES_KEYSIZE_256:
-		ctx->key_type = OTX2_CPT_AES_256_BIT;
-		break;
-	default:
-		/* Invalid key length */
-		return -EINVAL;
-	}
+	struct crypto_authenc_keys authenc_keys;
 
-	ctx->enc_key_len = enckeylen;
-	ctx->auth_key_len = authkeylen;
-
-	return aead_hmac_init(cipher);
+	return crypto_authenc_extractkeys(&authenc_keys, key, keylen) ?:
+	       aead_hmac_init(cipher, &authenc_keys);
 }
 
 static int otx2_cpt_aead_ecb_null_sha_setkey(struct crypto_aead *cipher,
 					     const unsigned char *key,
 					     unsigned int keylen)
 {
-	struct otx2_cpt_aead_ctx *ctx = crypto_aead_ctx_dma(cipher);
-	struct crypto_authenc_key_param *param;
-	struct rtattr *rta = (void *)key;
-	int enckeylen = 0;
-
-	if (!RTA_OK(rta, keylen))
-		return -EINVAL;
-
-	if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-		return -EINVAL;
-
-	if (RTA_PAYLOAD(rta) < sizeof(*param))
-		return -EINVAL;
-
-	param = RTA_DATA(rta);
-	enckeylen = be32_to_cpu(param->enckeylen);
-	key += RTA_ALIGN(rta->rta_len);
-	keylen -= RTA_ALIGN(rta->rta_len);
-	if (enckeylen != 0)
-		return -EINVAL;
-
-	if (keylen > OTX2_CPT_MAX_KEY_SIZE)
-		return -EINVAL;
-
-	memcpy(ctx->key, key, keylen);
-	ctx->enc_key_len = enckeylen;
-	ctx->auth_key_len = keylen;
-
-	return 0;
+	return otx2_cpt_aead_cbc_aes_sha_setkey(cipher, key, keylen);
 }
 
 static int otx2_cpt_aead_gcm_aes_setkey(struct crypto_aead *cipher,
--- linux-qcom-6.8.0.orig/drivers/crypto/mxs-dcp.c
+++ linux-qcom-6.8.0/drivers/crypto/mxs-dcp.c
@@ -220,7 +220,8 @@
 static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
 			   struct skcipher_request *req, int init)
 {
-	dma_addr_t key_phys, src_phys, dst_phys;
+	dma_addr_t key_phys = 0;
+	dma_addr_t src_phys, dst_phys;
 	struct dcp *sdcp = global_sdcp;
 	struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
 	struct dcp_aes_req_ctx *rctx = skcipher_request_ctx(req);
--- linux-qcom-6.8.0.orig/drivers/crypto/n2_core.c
+++ linux-qcom-6.8.0/drivers/crypto/n2_core.c
@@ -1357,6 +1357,7 @@
 	ahash->setkey = n2_hmac_async_setkey;
 
 	base = &ahash->halg.base;
+	err = -EINVAL;
 	if (snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "hmac(%s)",
 		     p->child_alg) >= CRYPTO_MAX_ALG_NAME)
 		goto out_free_p;
--- linux-qcom-6.8.0.orig/drivers/crypto/qce/aead.c
+++ linux-qcom-6.8.0/drivers/crypto/qce/aead.c
@@ -86,6 +86,9 @@
 		}
 	}
 
+	if (qce->qce_cmd_desc_enable)
+		qce_bam_release_lock(qce);
+
 	qce->async_req_done(qce, error);
 }
 
@@ -433,6 +436,9 @@
 	else
 		rctx->assoclen = req->assoclen;
 
+	if (qce->qce_cmd_desc_enable)
+		qce_bam_acquire_lock(qce);
+
 	diff_dst = (req->src != req->dst) ? true : false;
 	dir_src = diff_dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
 	dir_dst = diff_dst ? DMA_FROM_DEVICE : DMA_BIDIRECTIONAL;
--- linux-qcom-6.8.0.orig/drivers/crypto/qce/common.c
+++ linux-qcom-6.8.0/drivers/crypto/qce/common.c
@@ -25,7 +25,10 @@
 
 static inline void qce_write(struct qce_device *qce, u32 offset, u32 val)
 {
-	writel(val, qce->base + offset);
+	if (qce->qce_cmd_desc_enable)
+		qce_write_reg_dma(qce, offset, val, 1);
+	else
+		writel(val, qce->base + offset);
 }
 
 static inline void qce_write_array(struct qce_device *qce, u32 offset,
@@ -33,8 +36,12 @@
 {
 	int i;
 
-	for (i = 0; i < len; i++)
-		qce_write(qce, offset + i * sizeof(u32), val[i]);
+	for (i = 0; i < len; i++) {
+		if (qce->qce_cmd_desc_enable)
+			qce_write_reg_dma(qce, offset + i * sizeof(u32), val[i], 1);
+		else
+			qce_write(qce, offset + i * sizeof(u32), val[i]);
+	}
 }
 
 static inline void
@@ -42,8 +49,12 @@
 {
 	int i;
 
-	for (i = 0; i < len; i++)
-		qce_write(qce, offset + i * sizeof(u32), 0);
+	for (i = 0; i < len; i++) {
+		if (qce->qce_cmd_desc_enable)
+			qce_write_reg_dma(qce, offset + i * sizeof(u32), 0, 1);
+		else
+			qce_write(qce, offset + i * sizeof(u32), 0);
+	}
 }
 
 static u32 qce_config_reg(struct qce_device *qce, int little)
@@ -157,11 +168,15 @@
 	__be32 mackey[QCE_SHA_HMAC_KEY_SIZE / sizeof(__be32)] = {0};
 	u32 auth_cfg = 0, config;
 	unsigned int iv_words;
+	int ret = 0;
 
 	/* if not the last, the size has to be on the block boundary */
 	if (!rctx->last_blk && req->nbytes % blocksize)
 		return -EINVAL;
 
+	if (qce->qce_cmd_desc_enable)
+		qce_clear_bam_transaction(qce);
+
 	qce_setup_config(qce);
 
 	if (IS_CMAC(rctx->flags)) {
@@ -225,6 +240,13 @@
 
 	qce_crypto_go(qce, true);
 
+	if (qce->qce_cmd_desc_enable) {
+		ret = qce_submit_cmd_desc(qce, 0);
+		if (ret) {
+			dev_err(qce->dev, "Error in sha cmd descriptor ret = %d\n", ret);
+			return ret;
+		}
+	}
 	return 0;
 }
 #endif
@@ -325,6 +347,10 @@
 	u32 encr_cfg = 0, auth_cfg = 0, config;
 	unsigned int ivsize = rctx->ivsize;
 	unsigned long flags = rctx->flags;
+	int ret = 0;
+
+	if (qce->qce_cmd_desc_enable)
+		qce_clear_bam_transaction(qce);
 
 	qce_setup_config(qce);
 
@@ -388,6 +414,14 @@
 
 	qce_crypto_go(qce, true);
 
+	if (qce->qce_cmd_desc_enable) {
+		ret = qce_submit_cmd_desc(qce, 0);
+		if (ret) {
+			dev_err(qce->dev, "Error in skcipher cmd descriptor ret = %d\n", ret);
+			return ret;
+		}
+	}
+
 	return 0;
 }
 #endif
@@ -438,6 +472,10 @@
 	unsigned long flags = rctx->flags;
 	u32 encr_cfg, auth_cfg, config, totallen;
 	u32 iv_last_word;
+	int ret = 0;
+
+	if (qce->qce_cmd_desc_enable)
+		qce_clear_bam_transaction(qce);
 
 	qce_setup_config(qce);
 
@@ -537,6 +575,14 @@
 	/* Start the process */
 	qce_crypto_go(qce, !IS_CCM(flags));
 
+	if (qce->qce_cmd_desc_enable) {
+		ret = qce_submit_cmd_desc(qce, 0);
+		if (ret) {
+			dev_err(qce->dev, "Error in aead cmd descriptor ret = %d\n", ret);
+			return ret;
+		}
+	}
+
 	return 0;
 }
 #endif
@@ -593,3 +639,39 @@
 	*minor = (val & CORE_MINOR_REV_MASK) >> CORE_MINOR_REV_SHIFT;
 	*step = (val & CORE_STEP_REV_MASK) >> CORE_STEP_REV_SHIFT;
 }
+
+int qce_bam_acquire_lock(struct qce_device *qce)
+{
+	int ret = 0;
+
+	qce_clear_bam_transaction(qce);
+
+	/* This is just a dummy write to acquire lock bam pipe */
+	qce_write_reg_dma(qce, REG_AUTH_SEG_CFG, 0, 1);
+
+	ret = qce_submit_cmd_desc(qce, QCE_DMA_DESC_FLAG_LOCK);
+	if (ret) {
+		dev_err(qce->dev, "Error in LOCK cmd descriptor ret = %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+int qce_bam_release_lock(struct qce_device *qce)
+{
+	int ret = 0;
+
+	qce_clear_bam_transaction(qce);
+
+	/* This is just q dummy write to release lock on bam pipe*/
+	qce_write_reg_dma(qce, REG_AUTH_SEG_CFG, 0, 1);
+
+	ret = qce_submit_cmd_desc(qce, QCE_DMA_DESC_FLAG_UNLOCK);
+	if (ret) {
+		dev_err(qce->dev, "Error in LOCK cmd descriptor ret = %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/crypto/qce/core.c
+++ linux-qcom-6.8.0/drivers/crypto/qce/core.c
@@ -9,6 +9,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/mod_devicetable.h>
+#include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
@@ -192,7 +193,8 @@
 {
 	struct device *dev = &pdev->dev;
 	struct qce_device *qce;
-	int ret;
+	struct resource *res = NULL;
+	int ret = 0;
 
 	qce = devm_kzalloc(dev, sizeof(*qce), GFP_KERNEL);
 	if (!qce)
@@ -205,6 +207,18 @@
 	if (IS_ERR(qce->base))
 		return PTR_ERR(qce->base);
 
+	if (device_property_read_bool(dev, "qce,cmd_desc_support")) {
+		qce->qce_cmd_desc_enable = true;
+		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+		if (!res)
+			return -EINVAL;
+		qce->base_dma = dma_map_resource(dev, res->start, resource_size(res),
+						 DMA_BIDIRECTIONAL, 0);
+		ret = dma_mapping_error(dev, qce->base_dma);
+		if (ret)
+			return ret;
+	}
+
 	ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
 	if (ret < 0)
 		return ret;
@@ -225,7 +239,12 @@
 	if (IS_ERR(qce->mem_path))
 		return PTR_ERR(qce->mem_path);
 
-	ret = icc_set_bw(qce->mem_path, QCE_DEFAULT_MEM_BANDWIDTH, QCE_DEFAULT_MEM_BANDWIDTH);
+	if (of_property_read_u32((&pdev->dev)->of_node, "qcom,icc_bw", &qce->icc_bw)) {
+		pr_warn("%s: No icc BW set, using default\n", __func__);
+		qce->icc_bw = QCE_DEFAULT_MEM_BANDWIDTH;
+	}
+
+	ret = icc_set_bw(qce->mem_path, qce->icc_bw, qce->icc_bw);
 	if (ret)
 		return ret;
 
@@ -283,12 +302,64 @@
 
 	tasklet_kill(&qce->done_tasklet);
 	qce_unregister_algs(qce);
+	icc_set_bw(qce->mem_path, qce->icc_bw, qce->icc_bw);
 	qce_dma_release(&qce->dma);
+	icc_set_bw(qce->mem_path, 0, 0);
 	clk_disable_unprepare(qce->bus);
 	clk_disable_unprepare(qce->iface);
 	clk_disable_unprepare(qce->core);
 }
 
+static int  qce_crypto_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	struct qce_device *qce = platform_get_drvdata(pdev);
+
+	clk_disable_unprepare(qce->bus);
+	clk_disable_unprepare(qce->iface);
+	clk_disable_unprepare(qce->core);
+	icc_set_bw(qce->mem_path, 0, 0);
+
+	return 0;
+}
+
+static int  qce_crypto_resume(struct platform_device *pdev)
+{
+	struct qce_device *qce = platform_get_drvdata(pdev);
+	int ret = 0;
+
+	ret = icc_set_bw(qce->mem_path, qce->icc_bw, qce->icc_bw);
+	if (ret)
+		return ret;
+
+	ret = clk_prepare_enable(qce->core);
+	if (ret)
+		goto err_mem_path_disable;
+
+	ret = clk_prepare_enable(qce->iface);
+	if (ret)
+		goto err_clks_core;
+
+	ret = clk_prepare_enable(qce->bus);
+	if (ret)
+		goto err_clks_iface;
+
+	return 0;
+
+err_clks_iface:
+	clk_disable_unprepare(qce->iface);
+err_clks_core:
+	clk_disable_unprepare(qce->core);
+err_mem_path_disable:
+	icc_set_bw(qce->mem_path, 0, 0);
+
+	return ret;
+}
+
+static void qce_crypto_shutdown(struct platform_device *pdev)
+{
+	qce_crypto_remove(pdev);
+}
+
 static const struct of_device_id qce_crypto_of_match[] = {
 	{ .compatible = "qcom,crypto-v5.1", },
 	{ .compatible = "qcom,crypto-v5.4", },
@@ -300,6 +371,9 @@
 static struct platform_driver qce_crypto_driver = {
 	.probe = qce_crypto_probe,
 	.remove_new = qce_crypto_remove,
+	.suspend = qce_crypto_suspend,
+	.resume = qce_crypto_resume,
+	.shutdown = qce_crypto_shutdown,
 	.driver = {
 		.name = KBUILD_MODNAME,
 		.of_match_table = qce_crypto_of_match,
--- linux-qcom-6.8.0.orig/drivers/crypto/qce/core.h
+++ linux-qcom-6.8.0/drivers/crypto/qce/core.h
@@ -42,6 +42,11 @@
 	int (*async_req_enqueue)(struct qce_device *qce,
 				 struct crypto_async_request *req);
 	void (*async_req_done)(struct qce_device *qce, int ret);
+	u32 icc_bw;
+	dma_addr_t base_dma;
+	__le32 *reg_read_buf;
+	dma_addr_t reg_buf_phys;
+	bool qce_cmd_desc_enable;
 };
 
 /**
@@ -58,4 +63,12 @@
 	int (*async_req_handle)(struct crypto_async_request *async_req);
 };
 
+int qce_write_reg_dma(struct qce_device *qce, unsigned int offset, u32 val,
+		      int cnt);
+int qce_read_reg_dma(struct qce_device *qce, unsigned int offset, void *buff,
+		     int cnt);
+void qce_clear_bam_transaction(struct qce_device *qce);
+int qce_submit_cmd_desc(struct qce_device *qce, unsigned long flags);
+int qce_bam_acquire_lock(struct qce_device *qce);
+int qce_bam_release_lock(struct qce_device *qce);
 #endif /* _CORE_H_ */
--- linux-qcom-6.8.0.orig/drivers/crypto/qce/dma.c
+++ linux-qcom-6.8.0/drivers/crypto/qce/dma.c
@@ -1,15 +1,242 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/dmaengine.h>
+#include <linux/dma-mapping.h>
 #include <crypto/scatterwalk.h>
 
 #include "dma.h"
+#include "core.h"
+
+#define QCE_REG_BUF_DMA_ADDR(qce, vaddr) \
+	((qce)->reg_buf_phys + \
+	 ((uint8_t *)(vaddr) - (uint8_t *)(qce)->reg_read_buf))
+
+void qce_clear_bam_transaction(struct qce_device *qce)
+{
+	struct qce_bam_transaction *qce_bam_txn = NULL;
+
+	if (qce != NULL)
+		qce_bam_txn = qce->dma.qce_bam_txn;
+	qce_bam_txn->qce_bam_ce_index = 0;
+	qce_bam_txn->qce_write_sgl_cnt = 0;
+	qce_bam_txn->qce_read_sgl_cnt = 0;
+	qce_bam_txn->qce_bam_ce_index = 0;
+	qce_bam_txn->qce_pre_bam_ce_index = 0;
+}
+
+static int qce_dma_prep_cmd_sg(struct qce_device *qce, struct dma_chan *chan,
+			       struct scatterlist *qce_bam_sgl,
+			       int qce_sgl_cnt, unsigned long flags,
+			       enum dma_transfer_direction dir,
+			       dma_async_tx_callback cb, void *cb_param)
+{
+	struct dma_async_tx_descriptor *dma_desc = NULL;
+	struct qce_desc_info *desc = NULL;
+	dma_cookie_t cookie = 0;
+
+	desc = qce->dma.qce_bam_txn->qce_desc;
+
+	if (!qce_bam_sgl || !qce_sgl_cnt)
+		return -EINVAL;
+
+	if (!dma_map_sg(qce->dev, qce_bam_sgl,
+			qce_sgl_cnt, dir)) {
+		dev_err(qce->dev, "failure in mapping sgl for cmd desc\n");
+		return -ENOMEM;
+	}
+
+	dma_desc = dmaengine_prep_slave_sg(chan, qce_bam_sgl, qce_sgl_cnt,
+					   dir, flags);
+	if (!dma_desc) {
+		pr_err("%s:failure in prep cmd desc\n", __func__);
+		dma_unmap_sg(qce->dev, qce_bam_sgl, qce_sgl_cnt, dir);
+		kfree(desc);
+		return -EINVAL;
+	}
+
+	desc->dma_desc = dma_desc;
+	desc->dma_desc->callback = cb;
+	desc->dma_desc->callback_param = cb_param;
+
+	cookie = dmaengine_submit(desc->dma_desc);
+
+	return dma_submit_error(cookie);
+}
+
+int qce_submit_cmd_desc(struct qce_device *qce, unsigned long flags)
+{
+	struct qce_bam_transaction *qce_bam_txn = NULL;
+	struct dma_chan *chan = NULL;
+	unsigned long desc_flags = 0;
+	int ret = 0;
+
+	if (qce == NULL)
+		return -EINVAL;
+
+	qce_bam_txn = qce->dma.qce_bam_txn;
+	chan = qce->dma.rxchan;
+
+	if (flags & QCE_DMA_DESC_FLAG_LOCK)
+		desc_flags = DMA_PREP_CMD | DMA_PREP_LOCK;
+	else if (flags & QCE_DMA_DESC_FLAG_UNLOCK)
+		desc_flags = DMA_PREP_CMD | DMA_PREP_UNLOCK;
+	else
+		desc_flags = DMA_PREP_CMD;
+
+	/* For command descriptor always use consumer pipe
+	 * it recomended as per HPG
+	 */
+
+	if (qce_bam_txn->qce_read_sgl_cnt) {
+		ret = qce_dma_prep_cmd_sg(qce, chan,
+					qce_bam_txn->qce_reg_read_sgl,
+					qce_bam_txn->qce_read_sgl_cnt,
+					desc_flags, DMA_DEV_TO_MEM,
+					NULL, NULL);
+		if (ret) {
+			pr_err("error while submiting cmd desc for rx ret = %d\n", ret);
+			return ret;
+		}
+	}
+
+	if (qce_bam_txn->qce_write_sgl_cnt) {
+		ret = qce_dma_prep_cmd_sg(qce, chan,
+					qce_bam_txn->qce_reg_write_sgl,
+					qce_bam_txn->qce_write_sgl_cnt,
+					desc_flags, DMA_MEM_TO_DEV,
+					NULL, NULL);
+	}
+
+	if (ret) {
+		pr_err("error while submiting cmd desc for tx ret = %d\n", ret);
+		return ret;
+	}
+
+	qce_dma_issue_pending(&qce->dma);
+	if (qce_bam_txn->qce_read_sgl_cnt)
+		dma_unmap_sg(qce->dev, qce_bam_txn->qce_reg_read_sgl,
+			     qce_bam_txn->qce_read_sgl_cnt, DMA_DEV_TO_MEM);
+	if (qce_bam_txn->qce_write_sgl_cnt)
+		dma_unmap_sg(qce->dev, qce_bam_txn->qce_reg_write_sgl,
+			     qce_bam_txn->qce_write_sgl_cnt, DMA_MEM_TO_DEV);
+	return ret;
+}
+
+static void qce_prep_dma_command_desc(struct qce_device *qce,
+				      struct qce_dma_data *dma, bool read, unsigned int addr,
+				      void *buff, int size)
+{
+	struct qce_bam_transaction *qce_bam_txn = dma->qce_bam_txn;
+	struct bam_cmd_element *qce_bam_ce_buffer = NULL;
+	int qce_bam_ce_size = 0, cnt = 0, index = 0;
+
+
+	index = qce_bam_txn->qce_bam_ce_index;
+	qce_bam_ce_buffer = &qce_bam_txn->qce_bam_ce[index];
+	if (read)
+		bam_prep_ce(qce_bam_ce_buffer, addr, BAM_READ_COMMAND,
+			    QCE_REG_BUF_DMA_ADDR(qce,
+						 (unsigned int *)buff));
+	else
+		bam_prep_ce_le32(qce_bam_ce_buffer, addr, BAM_WRITE_COMMAND,
+				 *((__le32 *)buff));
+
+	qce_bam_ce_buffer = &qce_bam_txn->qce_bam_ce
+		[qce_bam_txn->qce_pre_bam_ce_index];
+	qce_bam_txn->qce_bam_ce_index += size;
+	qce_bam_ce_size = (qce_bam_txn->qce_bam_ce_index -
+		qce_bam_txn->qce_pre_bam_ce_index) *
+		sizeof(struct bam_cmd_element);
+
+	if (read) {
+		cnt = qce_bam_txn->qce_read_sgl_cnt;
+		sg_set_buf(&qce_bam_txn->qce_reg_read_sgl[cnt],
+			  qce_bam_ce_buffer,
+			  qce_bam_ce_size);
+
+		++qce_bam_txn->qce_read_sgl_cnt;
+		qce_bam_txn->qce_pre_bam_ce_index =
+					qce_bam_txn->qce_bam_ce_index;
+	} else {
+		cnt = qce_bam_txn->qce_write_sgl_cnt;
+		sg_set_buf(&qce_bam_txn->qce_reg_write_sgl[cnt],
+			   qce_bam_ce_buffer,
+			   qce_bam_ce_size);
+
+		++qce_bam_txn->qce_write_sgl_cnt;
+		qce_bam_txn->qce_pre_bam_ce_index =
+					qce_bam_txn->qce_bam_ce_index;
+	}
+}
+
+int qce_write_reg_dma(struct qce_device *qce,
+		      unsigned int offset, u32 val, int cnt)
+{
+	void *buff =  NULL;
+	unsigned int reg_addr = 0;
+
+	buff = &val;
+
+	if (qce == NULL)
+		return -EINVAL;
+
+	reg_addr = ((unsigned int)(qce->base_dma) + offset);
+	qce_prep_dma_command_desc(qce, &qce->dma, false, reg_addr, buff, cnt);
+
+	return 0;
+}
+
+int qce_read_reg_dma(struct qce_device *qce,
+		     unsigned int offset, void *buff, int cnt)
+{
+	void *vaddr = NULL;
+	unsigned int reg_addr = 0;
+
+	if (qce == NULL)
+		return -EINVAL;
+
+	reg_addr = ((unsigned int)(qce->base_dma) + offset);
+	vaddr = qce->reg_read_buf;
+
+	qce_prep_dma_command_desc(qce, &qce->dma, true, reg_addr, vaddr, cnt);
+	memcpy(buff, vaddr, 4);
+
+	return 0;
+}
+
+static struct qce_bam_transaction *qce_alloc_bam_txn(struct qce_dma_data *dma)
+{
+	struct qce_bam_transaction *qce_bam_txn = NULL;
+
+	dma->qce_bam_txn = kmalloc(sizeof(*qce_bam_txn), GFP_KERNEL);
+	if (!dma->qce_bam_txn)
+		return NULL;
+
+	dma->qce_bam_txn->qce_desc = kzalloc(sizeof(struct qce_desc_info),
+					     GFP_KERNEL);
+	if (!dma->qce_bam_txn->qce_desc) {
+		kfree(dma->qce_bam_txn);
+		return NULL;
+	}
+
+	sg_init_table(dma->qce_bam_txn->qce_reg_write_sgl,
+		      QCE_BAM_CMD_SGL_SIZE);
+
+	sg_init_table(dma->qce_bam_txn->qce_reg_read_sgl,
+		      QCE_BAM_CMD_SGL_SIZE);
+
+	qce_bam_txn = dma->qce_bam_txn;
+
+	return qce_bam_txn;
+}
 
 int qce_dma_request(struct device *dev, struct qce_dma_data *dma)
 {
+	struct qce_device *qce = container_of(dma, struct qce_device, dma);
 	int ret;
 
 	dma->txchan = dma_request_chan(dev, "tx");
@@ -31,6 +258,24 @@
 
 	dma->ignore_buf = dma->result_buf + QCE_RESULT_BUF_SZ;
 
+	if (qce->qce_cmd_desc_enable) {
+		dma->qce_bam_txn = qce_alloc_bam_txn(dma);
+		if (!dma->qce_bam_txn) {
+			pr_err("Failed to allocate bam transaction\n");
+			ret = -ENOMEM;
+			goto error_nomem;
+		}
+
+		qce->reg_read_buf = dmam_alloc_coherent(qce->dev,
+				    QCE_MAX_REG_READ *
+				    sizeof(*qce->reg_read_buf),
+				    &qce->reg_buf_phys, GFP_KERNEL);
+		if (!qce->reg_read_buf) {
+			pr_err("Failed to allocate reg_read_buf\n");
+			ret = -ENOMEM;
+			goto error_nomem;
+		}
+	}
 	return 0;
 error_nomem:
 	dma_release_channel(dma->rxchan);
@@ -41,9 +286,21 @@
 
 void qce_dma_release(struct qce_dma_data *dma)
 {
+	struct qce_device *qce = container_of(dma,
+			struct qce_device, dma);
+
 	dma_release_channel(dma->txchan);
 	dma_release_channel(dma->rxchan);
 	kfree(dma->result_buf);
+	if (qce->qce_cmd_desc_enable) {
+		if (qce->reg_read_buf)
+			dmam_free_coherent(qce->dev, QCE_MAX_REG_READ *
+					   sizeof(*qce->reg_read_buf),
+					   qce->reg_read_buf,
+					   qce->reg_buf_phys);
+		kfree(dma->qce_bam_txn->qce_desc);
+		kfree(dma->qce_bam_txn);
+	}
 }
 
 struct scatterlist *
--- linux-qcom-6.8.0.orig/drivers/crypto/qce/dma.h
+++ linux-qcom-6.8.0/drivers/crypto/qce/dma.h
@@ -7,6 +7,7 @@
 #define _DMA_H_
 
 #include <linux/dmaengine.h>
+#include <linux/dma/qcom_bam_dma.h>
 
 /* maximum data transfer block size between BAM and CE */
 #define QCE_BAM_BURST_SIZE		64
@@ -14,6 +15,12 @@
 #define QCE_AUTHIV_REGS_CNT		16
 #define QCE_AUTH_BYTECOUNT_REGS_CNT	4
 #define QCE_CNTRIV_REGS_CNT		4
+#define QCE_BAM_CMD_SGL_SIZE           128
+#define QCE_BAM_CMD_ELEMENT_SIZE       128
+#define QCE_DMA_DESC_FLAG_BAM_NWD      (0x0004)
+#define QCE_MAX_REG_READ               8
+#define QCE_DMA_DESC_FLAG_LOCK          (0x0002)
+#define QCE_DMA_DESC_FLAG_UNLOCK        (0x0001)
 
 struct qce_result_dump {
 	u32 auth_iv[QCE_AUTHIV_REGS_CNT];
@@ -27,11 +34,28 @@
 #define QCE_RESULT_BUF_SZ	\
 		ALIGN(sizeof(struct qce_result_dump), QCE_BAM_BURST_SIZE)
 
+struct qce_bam_transaction {
+	struct bam_cmd_element qce_bam_ce[QCE_BAM_CMD_ELEMENT_SIZE];
+	struct scatterlist qce_reg_write_sgl[QCE_BAM_CMD_SGL_SIZE];
+	struct scatterlist qce_reg_read_sgl[QCE_BAM_CMD_SGL_SIZE];
+	struct qce_desc_info *qce_desc;
+	u32 qce_bam_ce_index;
+	u32 qce_pre_bam_ce_index;
+	u32 qce_write_sgl_cnt;
+	u32 qce_read_sgl_cnt;
+};
+
 struct qce_dma_data {
 	struct dma_chan *txchan;
 	struct dma_chan *rxchan;
 	struct qce_result_dump *result_buf;
 	void *ignore_buf;
+	struct qce_bam_transaction *qce_bam_txn;
+};
+
+struct qce_desc_info {
+	struct dma_async_tx_descriptor *dma_desc;
+	enum dma_data_direction dir;
 };
 
 int qce_dma_request(struct device *dev, struct qce_dma_data *dma);
@@ -44,5 +68,5 @@
 struct scatterlist *
 qce_sgtable_add(struct sg_table *sgt, struct scatterlist *sg_add,
 		unsigned int max_len);
-
+void qce_dma_issue_cmd_desc_pending(struct qce_dma_data *dma, bool read);
 #endif /* _DMA_H_ */
--- linux-qcom-6.8.0.orig/drivers/crypto/qce/sha.c
+++ linux-qcom-6.8.0/drivers/crypto/qce/sha.c
@@ -69,6 +69,9 @@
 	rctx->last_blk = false;
 	rctx->first_blk = false;
 
+	if (qce->qce_cmd_desc_enable)
+		qce_bam_release_lock(qce);
+
 	qce->async_req_done(tmpl->qce, error);
 }
 
@@ -90,6 +93,9 @@
 		rctx->authklen = AES_KEYSIZE_128;
 	}
 
+	if (qce->qce_cmd_desc_enable)
+		qce_bam_acquire_lock(qce);
+
 	rctx->src_nents = sg_nents_for_len(req->src, req->nbytes);
 	if (rctx->src_nents < 0) {
 		dev_err(qce->dev, "Invalid numbers of src SG.\n");
--- linux-qcom-6.8.0.orig/drivers/crypto/qce/skcipher.c
+++ linux-qcom-6.8.0/drivers/crypto/qce/skcipher.c
@@ -56,6 +56,9 @@
 	if (error < 0)
 		dev_dbg(qce->dev, "skcipher operation error (%x)\n", status);
 
+	if (qce->qce_cmd_desc_enable)
+		qce_bam_release_lock(qce);
+
 	memcpy(rctx->iv, result_buf->encr_cntr_iv, rctx->ivsize);
 	qce->async_req_done(tmpl->qce, error);
 }
@@ -82,6 +85,9 @@
 	dir_src = diff_dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
 	dir_dst = diff_dst ? DMA_FROM_DEVICE : DMA_BIDIRECTIONAL;
 
+	if (qce->qce_cmd_desc_enable)
+		qce_bam_acquire_lock(qce);
+
 	rctx->src_nents = sg_nents_for_len(req->src, req->cryptlen);
 	if (diff_dst)
 		rctx->dst_nents = sg_nents_for_len(req->dst, req->cryptlen);
--- linux-qcom-6.8.0.orig/drivers/crypto/qcom-rng.c
+++ linux-qcom-6.8.0/drivers/crypto/qcom-rng.c
@@ -196,7 +196,7 @@
 	if (IS_ERR(rng->clk))
 		return PTR_ERR(rng->clk);
 
-	rng->of_data = (struct qcom_rng_of_data *)of_device_get_match_data(&pdev->dev);
+	rng->of_data = (struct qcom_rng_of_data *)device_get_match_data(&pdev->dev);
 
 	qcom_rng_dev = rng;
 	ret = crypto_register_rng(&qcom_rng_alg);
@@ -247,7 +247,7 @@
 };
 
 static const struct acpi_device_id __maybe_unused qcom_rng_acpi_match[] = {
-	{ .id = "QCOM8160", .driver_data = 1 },
+	{ .id = "QCOM8160", .driver_data = (kernel_ulong_t)&qcom_prng_ee_of_data },
 	{}
 };
 MODULE_DEVICE_TABLE(acpi, qcom_rng_acpi_match);
--- linux-qcom-6.8.0.orig/drivers/crypto/starfive/jh7110-cryp.h
+++ linux-qcom-6.8.0/drivers/crypto/starfive/jh7110-cryp.h
@@ -30,6 +30,7 @@
 #define MAX_KEY_SIZE				SHA512_BLOCK_SIZE
 #define STARFIVE_AES_IV_LEN			AES_BLOCK_SIZE
 #define STARFIVE_AES_CTR_LEN			AES_BLOCK_SIZE
+#define STARFIVE_RSA_MAX_KEYSZ			256
 
 union starfive_aes_csr {
 	u32 v;
@@ -218,12 +219,11 @@
 	struct scatterlist			*out_sg;
 	struct ahash_request			ahash_fbk_req;
 	size_t					total;
-	size_t					nents;
 	unsigned int				blksize;
 	unsigned int				digsize;
 	unsigned long				in_sg_len;
 	unsigned char				*adata;
-	u8 rsa_data[] __aligned(sizeof(u32));
+	u8 rsa_data[STARFIVE_RSA_MAX_KEYSZ] __aligned(sizeof(u32));
 };
 
 struct starfive_cryp_dev *starfive_cryp_find_dev(struct starfive_cryp_ctx *ctx);
--- linux-qcom-6.8.0.orig/drivers/crypto/starfive/jh7110-rsa.c
+++ linux-qcom-6.8.0/drivers/crypto/starfive/jh7110-rsa.c
@@ -31,7 +31,6 @@
 /* A * A * R mod N ==> A */
 #define CRYPTO_CMD_AARN			0x7
 
-#define STARFIVE_RSA_MAX_KEYSZ		256
 #define STARFIVE_RSA_RESET		0x2
 
 static inline int starfive_pka_wait_done(struct starfive_cryp_ctx *ctx)
@@ -71,7 +70,7 @@
 {
 	struct starfive_cryp_dev *cryp = ctx->cryp;
 	struct starfive_cryp_request_ctx *rctx = ctx->rctx;
-	int count = rctx->total / sizeof(u32) - 1;
+	int count = (ALIGN(rctx->total, 4) / 4) - 1;
 	int loop;
 	u32 temp;
 	u8 opsize;
@@ -248,12 +247,17 @@
 	struct starfive_cryp_dev *cryp = ctx->cryp;
 	struct starfive_cryp_request_ctx *rctx = ctx->rctx;
 	struct starfive_rsa_key *key = &ctx->rsa_key;
-	int ret = 0;
+	int ret = 0, shift = 0;
 
 	writel(STARFIVE_RSA_RESET, cryp->base + STARFIVE_PKA_CACR_OFFSET);
 
-	rctx->total = sg_copy_to_buffer(rctx->in_sg, rctx->nents,
-					rctx->rsa_data, rctx->total);
+	if (!IS_ALIGNED(rctx->total, sizeof(u32))) {
+		shift = sizeof(u32) - (rctx->total & 0x3);
+		memset(rctx->rsa_data, 0, shift);
+	}
+
+	rctx->total = sg_copy_to_buffer(rctx->in_sg, sg_nents(rctx->in_sg),
+					rctx->rsa_data + shift, rctx->total);
 
 	if (enc) {
 		key->bitlen = key->e_bitlen;
@@ -273,7 +277,6 @@
 
 err_rsa_crypt:
 	writel(STARFIVE_RSA_RESET, cryp->base + STARFIVE_PKA_CACR_OFFSET);
-	kfree(rctx->rsa_data);
 	return ret;
 }
 
@@ -303,7 +306,6 @@
 	rctx->in_sg = req->src;
 	rctx->out_sg = req->dst;
 	rctx->total = req->src_len;
-	rctx->nents = sg_nents(rctx->in_sg);
 	ctx->rctx = rctx;
 
 	return starfive_rsa_enc_core(ctx, 1);
--- linux-qcom-6.8.0.orig/drivers/crypto/stm32/stm32-cryp.c
+++ linux-qcom-6.8.0/drivers/crypto/stm32/stm32-cryp.c
@@ -11,6 +11,7 @@
 #include <crypto/internal/des.h>
 #include <crypto/internal/skcipher.h>
 #include <crypto/scatterwalk.h>
+#include <linux/bottom_half.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/err.h>
@@ -1665,8 +1666,11 @@
 		it_mask &= ~IMSCR_OUT;
 	stm32_cryp_write(cryp, cryp->caps->imsc, it_mask);
 
-	if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out)
+	if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) {
+		local_bh_disable();
 		stm32_cryp_finish_req(cryp, 0);
+		local_bh_enable();
+	}
 
 	return IRQ_HANDLED;
 }
--- linux-qcom-6.8.0.orig/drivers/crypto/xilinx/zynqmp-aes-gcm.c
+++ linux-qcom-6.8.0/drivers/crypto/xilinx/zynqmp-aes-gcm.c
@@ -231,7 +231,10 @@
 		err = zynqmp_aes_aead_cipher(areq);
 	}
 
+	local_bh_disable();
 	crypto_finalize_aead_request(engine, areq, err);
+	local_bh_enable();
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/cxl/Kconfig
+++ linux-qcom-6.8.0/drivers/cxl/Kconfig
@@ -59,6 +59,7 @@
 	default CXL_BUS
 	select ACPI_TABLE_LIB
 	select ACPI_HMAT
+	select CXL_PORT
 	help
 	  Enable support for host managed device memory (HDM) resources
 	  published by a platform's ACPI CXL memory layout description.  See
--- linux-qcom-6.8.0.orig/drivers/cxl/Makefile
+++ linux-qcom-6.8.0/drivers/cxl/Makefile
@@ -1,13 +1,21 @@
 # SPDX-License-Identifier: GPL-2.0
+
+# Order is important here for the built-in case:
+# - 'core' first for fundamental init
+# - 'port' before platform root drivers like 'acpi' so that CXL-root ports
+#   are immediately enabled
+# - 'mem' and 'pmem' before endpoint drivers so that memdevs are
+#   immediately enabled
+# - 'pci' last, also mirrors the hardware enumeration hierarchy
 obj-y += core/
-obj-$(CONFIG_CXL_PCI) += cxl_pci.o
-obj-$(CONFIG_CXL_MEM) += cxl_mem.o
+obj-$(CONFIG_CXL_PORT) += cxl_port.o
 obj-$(CONFIG_CXL_ACPI) += cxl_acpi.o
 obj-$(CONFIG_CXL_PMEM) += cxl_pmem.o
-obj-$(CONFIG_CXL_PORT) += cxl_port.o
+obj-$(CONFIG_CXL_MEM) += cxl_mem.o
+obj-$(CONFIG_CXL_PCI) += cxl_pci.o
 
-cxl_mem-y := mem.o
-cxl_pci-y := pci.o
+cxl_port-y := port.o
 cxl_acpi-y := acpi.o
 cxl_pmem-y := pmem.o security.o
-cxl_port-y := port.o
+cxl_mem-y := mem.o
+cxl_pci-y := pci.o
--- linux-qcom-6.8.0.orig/drivers/cxl/acpi.c
+++ linux-qcom-6.8.0/drivers/cxl/acpi.c
@@ -74,6 +74,43 @@
 	return cxlrd->cxlsd.target[n];
 }
 
+static u64 cxl_xor_hpa_to_spa(struct cxl_root_decoder *cxlrd, u64 hpa)
+{
+	struct cxl_cxims_data *cximsd = cxlrd->platform_data;
+	int hbiw = cxlrd->cxlsd.nr_targets;
+	u64 val;
+	int pos;
+
+	/* No xormaps for host bridge interleave ways of 1 or 3 */
+	if (hbiw == 1 || hbiw == 3)
+		return hpa;
+
+	/*
+	 * For root decoders using xormaps (hbiw: 2,4,6,8,12,16) restore
+	 * the position bit to its value before the xormap was applied at
+	 * HPA->DPA translation.
+	 *
+	 * pos is the lowest set bit in an XORMAP
+	 * val is the XORALLBITS(HPA & XORMAP)
+	 *
+	 * XORALLBITS: The CXL spec (3.1 Table 9-22) defines XORALLBITS
+	 * as an operation that outputs a single bit by XORing all the
+	 * bits in the input (hpa & xormap). Implement XORALLBITS using
+	 * hweight64(). If the hamming weight is even the XOR of those
+	 * bits results in val==0, if odd the XOR result is val==1.
+	 */
+
+	for (int i = 0; i < cximsd->nr_maps; i++) {
+		if (!cximsd->xormaps[i])
+			continue;
+		pos = __ffs(cximsd->xormaps[i]);
+		val = (hweight64(hpa & cximsd->xormaps[i]) & 1);
+		hpa = (hpa & ~(1ULL << pos)) | (val << pos);
+	}
+
+	return hpa;
+}
+
 struct cxl_cxims_context {
 	struct device *dev;
 	struct cxl_root_decoder *cxlrd;
@@ -410,6 +447,9 @@
 
 	cxlrd->qos_class = cfmws->qtg_id;
 
+	if (cfmws->interleave_arithmetic == ACPI_CEDT_CFMWS_ARITHMETIC_XOR)
+		cxlrd->hpa_to_spa = cxl_xor_hpa_to_spa;
+
 	rc = cxl_decoder_add(cxld, target_map);
 err_xormap:
 	if (rc)
@@ -530,13 +570,15 @@
 	if (kstrtou32(acpi_device_uid(hb), 0, &uid))
 		return -EINVAL;
 
-	rc = acpi_get_genport_coordinates(uid, &dport->hb_coord);
+	rc = acpi_get_genport_coordinates(uid, dport->hb_coord);
 	if (rc < 0)
 		return rc;
 
 	/* Adjust back to picoseconds from nanoseconds */
-	dport->hb_coord.read_latency *= 1000;
-	dport->hb_coord.write_latency *= 1000;
+	for (int i = 0; i < ACCESS_COORDINATE_MAX; i++) {
+		dport->hb_coord[i].read_latency *= 1000;
+		dport->hb_coord[i].write_latency *= 1000;
+	}
 
 	return 0;
 }
@@ -920,6 +962,13 @@
 
 /* load before dax_hmem sees 'Soft Reserved' CXL ranges */
 subsys_initcall(cxl_acpi_init);
+
+/*
+ * Arrange for host-bridge ports to be active synchronous with
+ * cxl_acpi_probe() exit.
+ */
+MODULE_SOFTDEP("pre: cxl_port");
+
 module_exit(cxl_acpi_exit);
 MODULE_LICENSE("GPL v2");
 MODULE_IMPORT_NS(CXL);
--- linux-qcom-6.8.0.orig/drivers/cxl/core/cdat.c
+++ linux-qcom-6.8.0/drivers/cxl/core/cdat.c
@@ -162,15 +162,22 @@
 static int cxl_port_perf_data_calculate(struct cxl_port *port,
 					struct xarray *dsmas_xa)
 {
-	struct access_coordinate c;
+	struct access_coordinate ep_c;
+	struct access_coordinate coord[ACCESS_COORDINATE_MAX];
 	struct dsmas_entry *dent;
 	int valid_entries = 0;
 	unsigned long index;
 	int rc;
 
-	rc = cxl_endpoint_get_perf_coordinates(port, &c);
+	rc = cxl_endpoint_get_perf_coordinates(port, &ep_c);
 	if (rc) {
-		dev_dbg(&port->dev, "Failed to retrieve perf coordinates.\n");
+		dev_dbg(&port->dev, "Failed to retrieve ep perf coordinates.\n");
+		return rc;
+	}
+
+	rc = cxl_hb_get_perf_coordinates(port, coord);
+	if (rc)  {
+		dev_dbg(&port->dev, "Failed to retrieve hb perf coordinates.\n");
 		return rc;
 	}
 
@@ -185,18 +192,19 @@
 	xa_for_each(dsmas_xa, index, dent) {
 		int qos_class;
 
-		dent->coord.read_latency = dent->coord.read_latency +
-					   c.read_latency;
-		dent->coord.write_latency = dent->coord.write_latency +
-					    c.write_latency;
-		dent->coord.read_bandwidth = min_t(int, c.read_bandwidth,
-						   dent->coord.read_bandwidth);
-		dent->coord.write_bandwidth = min_t(int, c.write_bandwidth,
-						    dent->coord.write_bandwidth);
-
+		cxl_coordinates_combine(&dent->coord, &dent->coord, &ep_c);
+		/*
+		 * Keeping the host bridge coordinates separate from the dsmas
+		 * coordinates in order to allow calculation of access class
+		 * 0 and 1 for region later.
+		 */
+		cxl_coordinates_combine(&coord[ACCESS_COORDINATE_LOCAL],
+					&coord[ACCESS_COORDINATE_LOCAL],
+					&dent->coord);
 		dent->entries = 1;
-		rc = cxl_root->ops->qos_class(cxl_root, &dent->coord, 1,
-					      &qos_class);
+		rc = cxl_root->ops->qos_class(cxl_root,
+					      &coord[ACCESS_COORDINATE_LOCAL],
+					      1, &qos_class);
 		if (rc != 1)
 			continue;
 
@@ -389,36 +397,38 @@
 static int cdat_sslbis_handler(union acpi_subtable_headers *header, void *arg,
 			       const unsigned long end)
 {
+	struct acpi_cdat_sslbis_table {
+		struct acpi_cdat_header header;
+		struct acpi_cdat_sslbis sslbis_header;
+		struct acpi_cdat_sslbe entries[];
+	} *tbl = (struct acpi_cdat_sslbis_table *)header;
+	int size = sizeof(header->cdat) + sizeof(tbl->sslbis_header);
 	struct acpi_cdat_sslbis *sslbis;
-	int size = sizeof(header->cdat) + sizeof(*sslbis);
 	struct cxl_port *port = arg;
 	struct device *dev = &port->dev;
-	struct acpi_cdat_sslbe *entry;
 	int remain, entries, i;
 	u16 len;
 
 	len = le16_to_cpu((__force __le16)header->cdat.length);
 	remain = len - size;
-	if (!remain || remain % sizeof(*entry) ||
+	if (!remain || remain % sizeof(tbl->entries[0]) ||
 	    (unsigned long)header + len > end) {
 		dev_warn(dev, "Malformed SSLBIS table length: (%u)\n", len);
 		return -EINVAL;
 	}
 
-	/* Skip common header */
-	sslbis = (struct acpi_cdat_sslbis *)((unsigned long)header +
-					     sizeof(header->cdat));
-
+	sslbis = &tbl->sslbis_header;
 	/* Unrecognized data type, we can skip */
 	if (sslbis->data_type > ACPI_HMAT_WRITE_BANDWIDTH)
 		return 0;
 
-	entries = remain / sizeof(*entry);
-	entry = (struct acpi_cdat_sslbe *)((unsigned long)header + sizeof(*sslbis));
+	entries = remain / sizeof(tbl->entries[0]);
+	if (struct_size(tbl, entries, entries) != len)
+		return -EINVAL;
 
 	for (i = 0; i < entries; i++) {
-		u16 x = le16_to_cpu((__force __le16)entry->portx_id);
-		u16 y = le16_to_cpu((__force __le16)entry->porty_id);
+		u16 x = le16_to_cpu((__force __le16)tbl->entries[i].portx_id);
+		u16 y = le16_to_cpu((__force __le16)tbl->entries[i].porty_id);
 		__le64 le_base;
 		__le16 le_val;
 		struct cxl_dport *dport;
@@ -448,8 +458,8 @@
 			break;
 		}
 
-		le_base = (__force __le64)sslbis->entry_base_unit;
-		le_val = (__force __le16)entry->latency_or_bandwidth;
+		le_base = (__force __le64)tbl->sslbis_header.entry_base_unit;
+		le_val = (__force __le16)tbl->entries[i].latency_or_bandwidth;
 
 		if (check_mul_overflow(le64_to_cpu(le_base),
 				       le16_to_cpu(le_val), &val))
@@ -462,8 +472,6 @@
 							  sslbis->data_type,
 							  val);
 		}
-
-		entry++;
 	}
 
 	return 0;
@@ -484,4 +492,26 @@
 }
 EXPORT_SYMBOL_NS_GPL(cxl_switch_parse_cdat, CXL);
 
+/**
+ * cxl_coordinates_combine - Combine the two input coordinates
+ *
+ * @out: Output coordinate of c1 and c2 combined
+ * @c1: input coordinates
+ * @c2: input coordinates
+ */
+void cxl_coordinates_combine(struct access_coordinate *out,
+			     struct access_coordinate *c1,
+			     struct access_coordinate *c2)
+{
+		if (c1->write_bandwidth && c2->write_bandwidth)
+			out->write_bandwidth = min(c1->write_bandwidth,
+						   c2->write_bandwidth);
+		out->write_latency = c1->write_latency + c2->write_latency;
+
+		if (c1->read_bandwidth && c2->read_bandwidth)
+			out->read_bandwidth = min(c1->read_bandwidth,
+						  c2->read_bandwidth);
+		out->read_latency = c1->read_latency + c2->read_latency;
+}
+
 MODULE_IMPORT_NS(CXL);
--- linux-qcom-6.8.0.orig/drivers/cxl/core/core.h
+++ linux-qcom-6.8.0/drivers/cxl/core/core.h
@@ -27,7 +27,14 @@
 int cxl_region_init(void);
 void cxl_region_exit(void);
 int cxl_get_poison_by_endpoint(struct cxl_port *port);
+struct cxl_region *cxl_dpa_to_region(const struct cxl_memdev *cxlmd, u64 dpa);
+
 #else
+static inline
+struct cxl_region *cxl_dpa_to_region(const struct cxl_memdev *cxlmd, u64 dpa)
+{
+	return NULL;
+}
 static inline int cxl_get_poison_by_endpoint(struct cxl_port *port)
 {
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/cxl/core/hdm.c
+++ linux-qcom-6.8.0/drivers/cxl/core/hdm.c
@@ -52,6 +52,14 @@
 	struct cxl_dport *dport = NULL;
 	int single_port_map[1];
 	unsigned long index;
+	struct cxl_hdm *cxlhdm = dev_get_drvdata(&port->dev);
+
+	/*
+	 * Capability checks are moot for passthrough decoders, support
+	 * any and all possibilities.
+	 */
+	cxlhdm->interleave_mask = ~0U;
+	cxlhdm->iw_cap_mask = ~0UL;
 
 	cxlsd = cxl_switch_decoder_alloc(port, 1);
 	if (IS_ERR(cxlsd))
@@ -79,6 +87,11 @@
 		cxlhdm->interleave_mask |= GENMASK(11, 8);
 	if (FIELD_GET(CXL_HDM_DECODER_INTERLEAVE_14_12, hdm_cap))
 		cxlhdm->interleave_mask |= GENMASK(14, 12);
+	cxlhdm->iw_cap_mask = BIT(1) | BIT(2) | BIT(4) | BIT(8);
+	if (FIELD_GET(CXL_HDM_DECODER_INTERLEAVE_3_6_12_WAY, hdm_cap))
+		cxlhdm->iw_cap_mask |= BIT(3) | BIT(6) | BIT(12);
+	if (FIELD_GET(CXL_HDM_DECODER_INTERLEAVE_16_WAY, hdm_cap))
+		cxlhdm->iw_cap_mask |= BIT(16);
 }
 
 static bool should_emulate_decoders(struct cxl_endpoint_dvsec_info *info)
@@ -700,7 +713,44 @@
 	return 0;
 }
 
-static int cxl_decoder_reset(struct cxl_decoder *cxld)
+static int commit_reap(struct device *dev, const void *data)
+{
+	struct cxl_port *port = to_cxl_port(dev->parent);
+	struct cxl_decoder *cxld;
+
+	if (!is_switch_decoder(dev) && !is_endpoint_decoder(dev))
+		return 0;
+
+	cxld = to_cxl_decoder(dev);
+	if (port->commit_end == cxld->id &&
+	    ((cxld->flags & CXL_DECODER_F_ENABLE) == 0)) {
+		port->commit_end--;
+		dev_dbg(&port->dev, "reap: %s commit_end: %d\n",
+			dev_name(&cxld->dev), port->commit_end);
+	}
+
+	return 0;
+}
+
+void cxl_port_commit_reap(struct cxl_decoder *cxld)
+{
+	struct cxl_port *port = to_cxl_port(cxld->dev.parent);
+
+	lockdep_assert_held_write(&cxl_region_rwsem);
+
+	/*
+	 * Once the highest committed decoder is disabled, free any other
+	 * decoders that were pinned allocated by out-of-order release.
+	 */
+	port->commit_end--;
+	dev_dbg(&port->dev, "reap: %s commit_end: %d\n", dev_name(&cxld->dev),
+		port->commit_end);
+	device_for_each_child_reverse_from(&port->dev, &cxld->dev, NULL,
+					   commit_reap);
+}
+EXPORT_SYMBOL_NS_GPL(cxl_port_commit_reap, CXL);
+
+static void cxl_decoder_reset(struct cxl_decoder *cxld)
 {
 	struct cxl_port *port = to_cxl_port(cxld->dev.parent);
 	struct cxl_hdm *cxlhdm = dev_get_drvdata(&port->dev);
@@ -709,14 +759,14 @@
 	u32 ctrl;
 
 	if ((cxld->flags & CXL_DECODER_F_ENABLE) == 0)
-		return 0;
+		return;
 
-	if (port->commit_end != id) {
+	if (port->commit_end == id)
+		cxl_port_commit_reap(cxld);
+	else
 		dev_dbg(&port->dev,
 			"%s: out of order reset, expected decoder%d.%d\n",
 			dev_name(&cxld->dev), port->id, port->commit_end);
-		return -EBUSY;
-	}
 
 	down_read(&cxl_dpa_rwsem);
 	ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
@@ -729,7 +779,6 @@
 	writel(0, hdm + CXL_HDM_DECODER0_BASE_LOW_OFFSET(id));
 	up_read(&cxl_dpa_rwsem);
 
-	port->commit_end--;
 	cxld->flags &= ~CXL_DECODER_F_ENABLE;
 
 	/* Userspace is now responsible for reconfiguring this decoder */
@@ -739,8 +788,6 @@
 		cxled = to_cxl_endpoint_decoder(&cxld->dev);
 		cxled->state = CXL_DECODER_STATE_MANUAL;
 	}
-
-	return 0;
 }
 
 static int cxl_setup_hdm_decoder_from_dvsec(
--- linux-qcom-6.8.0.orig/drivers/cxl/core/mbox.c
+++ linux-qcom-6.8.0/drivers/cxl/core/mbox.c
@@ -915,7 +915,7 @@
 
 		payload->handles[i++] = gen->hdr.handle;
 		dev_dbg(mds->cxlds.dev, "Event log '%d': Clearing %u\n", log,
-			le16_to_cpu(payload->handles[i]));
+			le16_to_cpu(payload->handles[i - 1]));
 
 		if (i == max_handles) {
 			payload->nr_recs = i;
@@ -946,24 +946,22 @@
 	struct cxl_memdev *cxlmd = mds->cxlds.cxlmd;
 	struct device *dev = mds->cxlds.dev;
 	struct cxl_get_event_payload *payload;
-	struct cxl_mbox_cmd mbox_cmd;
 	u8 log_type = type;
 	u16 nr_rec;
 
 	mutex_lock(&mds->event.log_lock);
 	payload = mds->event.buf;
 
-	mbox_cmd = (struct cxl_mbox_cmd) {
-		.opcode = CXL_MBOX_OP_GET_EVENT_RECORD,
-		.payload_in = &log_type,
-		.size_in = sizeof(log_type),
-		.payload_out = payload,
-		.size_out = mds->payload_size,
-		.min_out = struct_size(payload, records, 0),
-	};
-
 	do {
 		int rc, i;
+		struct cxl_mbox_cmd mbox_cmd = (struct cxl_mbox_cmd) {
+			.opcode = CXL_MBOX_OP_GET_EVENT_RECORD,
+			.payload_in = &log_type,
+			.size_in = sizeof(log_type),
+			.payload_out = payload,
+			.size_out = mds->payload_size,
+			.min_out = struct_size(payload, records, 0),
+		};
 
 		rc = cxl_internal_send_cmd(mds, &mbox_cmd);
 		if (rc) {
@@ -1296,7 +1294,6 @@
 	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
 	struct cxl_mbox_poison_out *po;
 	struct cxl_mbox_poison_in pi;
-	struct cxl_mbox_cmd mbox_cmd;
 	int nr_records = 0;
 	int rc;
 
@@ -1308,16 +1305,16 @@
 	pi.offset = cpu_to_le64(offset);
 	pi.length = cpu_to_le64(len / CXL_POISON_LEN_MULT);
 
-	mbox_cmd = (struct cxl_mbox_cmd) {
-		.opcode = CXL_MBOX_OP_GET_POISON,
-		.size_in = sizeof(pi),
-		.payload_in = &pi,
-		.size_out = mds->payload_size,
-		.payload_out = po,
-		.min_out = struct_size(po, record, 0),
-	};
-
 	do {
+		struct cxl_mbox_cmd mbox_cmd = (struct cxl_mbox_cmd){
+			.opcode = CXL_MBOX_OP_GET_POISON,
+			.size_in = sizeof(pi),
+			.payload_in = &pi,
+			.size_out = mds->payload_size,
+			.payload_out = po,
+			.min_out = struct_size(po, record, 0),
+		};
+
 		rc = cxl_internal_send_cmd(mds, &mbox_cmd);
 		if (rc)
 			break;
--- linux-qcom-6.8.0.orig/drivers/cxl/core/memdev.c
+++ linux-qcom-6.8.0/drivers/cxl/core/memdev.c
@@ -251,50 +251,6 @@
 }
 EXPORT_SYMBOL_NS_GPL(cxl_trigger_poison_list, CXL);
 
-struct cxl_dpa_to_region_context {
-	struct cxl_region *cxlr;
-	u64 dpa;
-};
-
-static int __cxl_dpa_to_region(struct device *dev, void *arg)
-{
-	struct cxl_dpa_to_region_context *ctx = arg;
-	struct cxl_endpoint_decoder *cxled;
-	u64 dpa = ctx->dpa;
-
-	if (!is_endpoint_decoder(dev))
-		return 0;
-
-	cxled = to_cxl_endpoint_decoder(dev);
-	if (!cxled->dpa_res || !resource_size(cxled->dpa_res))
-		return 0;
-
-	if (dpa > cxled->dpa_res->end || dpa < cxled->dpa_res->start)
-		return 0;
-
-	dev_dbg(dev, "dpa:0x%llx mapped in region:%s\n", dpa,
-		dev_name(&cxled->cxld.region->dev));
-
-	ctx->cxlr = cxled->cxld.region;
-
-	return 1;
-}
-
-static struct cxl_region *cxl_dpa_to_region(struct cxl_memdev *cxlmd, u64 dpa)
-{
-	struct cxl_dpa_to_region_context ctx;
-	struct cxl_port *port;
-
-	ctx = (struct cxl_dpa_to_region_context) {
-		.dpa = dpa,
-	};
-	port = cxlmd->endpoint;
-	if (port && is_cxl_endpoint(port) && cxl_num_decoders_committed(port))
-		device_for_each_child(&port->dev, &ctx, __cxl_dpa_to_region);
-
-	return ctx.cxlr;
-}
-
 static int cxl_validate_poison_dpa(struct cxl_memdev *cxlmd, u64 dpa)
 {
 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
--- linux-qcom-6.8.0.orig/drivers/cxl/core/pci.c
+++ linux-qcom-6.8.0/drivers/cxl/core/pci.c
@@ -390,10 +390,6 @@
 
 		size |= temp & CXL_DVSEC_MEM_SIZE_LOW_MASK;
 		if (!size) {
-			info->dvsec_range[i] = (struct range) {
-				.start = 0,
-				.end = CXL_RESOURCE_NONE,
-			};
 			continue;
 		}
 
@@ -411,12 +407,10 @@
 
 		base |= temp & CXL_DVSEC_MEM_BASE_LOW_MASK;
 
-		info->dvsec_range[i] = (struct range) {
+		info->dvsec_range[ranges++] = (struct range) {
 			.start = base,
 			.end = base + size - 1
 		};
-
-		ranges++;
 	}
 
 	info->ranges = ranges;
@@ -1034,3 +1028,32 @@
 
 	return cxl_flit_size(pdev) * MEGA / bw;
 }
+
+static int __cxl_endpoint_decoder_reset_detected(struct device *dev, void *data)
+{
+	struct cxl_port *port = data;
+	struct cxl_decoder *cxld;
+	struct cxl_hdm *cxlhdm;
+	void __iomem *hdm;
+	u32 ctrl;
+
+	if (!is_endpoint_decoder(dev))
+		return 0;
+
+	cxld = to_cxl_decoder(dev);
+	if ((cxld->flags & CXL_DECODER_F_ENABLE) == 0)
+		return 0;
+
+	cxlhdm = dev_get_drvdata(&port->dev);
+	hdm = cxlhdm->regs.hdm_decoder;
+	ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(cxld->id));
+
+	return !FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMITTED, ctrl);
+}
+
+bool cxl_endpoint_decoder_reset_detected(struct cxl_port *port)
+{
+	return device_for_each_child(&port->dev, port,
+				     __cxl_endpoint_decoder_reset_detected);
+}
+EXPORT_SYMBOL_NS_GPL(cxl_endpoint_decoder_reset_detected, CXL);
--- linux-qcom-6.8.0.orig/drivers/cxl/core/pmem.c
+++ linux-qcom-6.8.0/drivers/cxl/core/pmem.c
@@ -62,10 +62,14 @@
 	return is_cxl_nvdimm_bridge(dev);
 }
 
-struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_memdev *cxlmd)
+/**
+ * cxl_find_nvdimm_bridge() - find a bridge device relative to a port
+ * @port: any descendant port of an nvdimm-bridge associated
+ *        root-cxl-port
+ */
+struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_port *port)
 {
-	struct cxl_root *cxl_root __free(put_cxl_root) =
-		find_cxl_root(cxlmd->endpoint);
+	struct cxl_root *cxl_root __free(put_cxl_root) = find_cxl_root(port);
 	struct device *dev;
 
 	if (!cxl_root)
@@ -242,18 +246,20 @@
 
 /**
  * devm_cxl_add_nvdimm() - add a bridge between a cxl_memdev and an nvdimm
+ * @parent_port: parent port for the (to be added) @cxlmd endpoint port
  * @cxlmd: cxl_memdev instance that will perform LIBNVDIMM operations
  *
  * Return: 0 on success negative error code on failure.
  */
-int devm_cxl_add_nvdimm(struct cxl_memdev *cxlmd)
+int devm_cxl_add_nvdimm(struct cxl_port *parent_port,
+			struct cxl_memdev *cxlmd)
 {
 	struct cxl_nvdimm_bridge *cxl_nvb;
 	struct cxl_nvdimm *cxl_nvd;
 	struct device *dev;
 	int rc;
 
-	cxl_nvb = cxl_find_nvdimm_bridge(cxlmd);
+	cxl_nvb = cxl_find_nvdimm_bridge(parent_port);
 	if (!cxl_nvb)
 		return -ENODEV;
 
--- linux-qcom-6.8.0.orig/drivers/cxl/core/port.c
+++ linux-qcom-6.8.0/drivers/cxl/core/port.c
@@ -2069,11 +2069,18 @@
 
 static struct workqueue_struct *cxl_bus_wq;
 
-static void cxl_bus_rescan_queue(struct work_struct *w)
+static int cxl_rescan_attach(struct device *dev, void *data)
 {
-	int rc = bus_rescan_devices(&cxl_bus_type);
+	int rc = device_attach(dev);
+
+	dev_vdbg(dev, "rescan: %s\n", rc ? "attach" : "detached");
 
-	pr_debug("CXL bus rescan result: %d\n", rc);
+	return 0;
+}
+
+static void cxl_bus_rescan_queue(struct work_struct *w)
+{
+	bus_for_each_dev(&cxl_bus_type, NULL, NULL, cxl_rescan_attach);
 }
 
 void cxl_bus_rescan(void)
@@ -2096,18 +2103,41 @@
 }
 EXPORT_SYMBOL_NS_GPL(schedule_cxl_memdev_detach, CXL);
 
-static void combine_coordinates(struct access_coordinate *c1,
-				struct access_coordinate *c2)
+/**
+ * cxl_hb_get_perf_coordinates - Retrieve performance numbers between initiator
+ *				 and host bridge
+ *
+ * @port: endpoint cxl_port
+ * @coord: output access coordinates
+ *
+ * Return: errno on failure, 0 on success.
+ */
+int cxl_hb_get_perf_coordinates(struct cxl_port *port,
+				struct access_coordinate *coord)
 {
-		if (c2->write_bandwidth)
-			c1->write_bandwidth = min(c1->write_bandwidth,
-						  c2->write_bandwidth);
-		c1->write_latency += c2->write_latency;
-
-		if (c2->read_bandwidth)
-			c1->read_bandwidth = min(c1->read_bandwidth,
-						 c2->read_bandwidth);
-		c1->read_latency += c2->read_latency;
+	struct cxl_port *iter = port;
+	struct cxl_dport *dport;
+
+	if (!is_cxl_endpoint(port))
+		return -EINVAL;
+
+	dport = iter->parent_dport;
+	while (iter && !is_cxl_root(to_cxl_port(iter->dev.parent))) {
+		iter = to_cxl_port(iter->dev.parent);
+		dport = iter->parent_dport;
+	}
+
+	coord[ACCESS_COORDINATE_LOCAL] =
+		dport->hb_coord[ACCESS_COORDINATE_LOCAL];
+	coord[ACCESS_COORDINATE_CPU] =
+		dport->hb_coord[ACCESS_COORDINATE_CPU];
+
+	return 0;
+}
+
+static bool parent_port_is_cxl_root(struct cxl_port *port)
+{
+	return is_cxl_root(to_cxl_port(port->dev.parent));
 }
 
 /**
@@ -2129,30 +2159,31 @@
 	struct cxl_dport *dport;
 	struct pci_dev *pdev;
 	unsigned int bw;
+	bool is_cxl_root;
 
 	if (!is_cxl_endpoint(port))
 		return -EINVAL;
 
-	dport = iter->parent_dport;
-
 	/*
-	 * Exit the loop when the parent port of the current port is cxl root.
-	 * The iterative loop starts at the endpoint and gathers the
-	 * latency of the CXL link from the current iter to the next downstream
-	 * port each iteration. If the parent is cxl root then there is
-	 * nothing to gather.
+	 * Exit the loop when the parent port of the current iter port is cxl
+	 * root. The iterative loop starts at the endpoint and gathers the
+	 * latency of the CXL link from the current device/port to the connected
+	 * downstream port each iteration.
 	 */
-	while (iter && !is_cxl_root(to_cxl_port(iter->dev.parent))) {
-		combine_coordinates(&c, &dport->sw_coord);
-		c.write_latency += dport->link_latency;
-		c.read_latency += dport->link_latency;
-
-		iter = to_cxl_port(iter->dev.parent);
+	do {
 		dport = iter->parent_dport;
-	}
+		iter = to_cxl_port(iter->dev.parent);
+		is_cxl_root = parent_port_is_cxl_root(iter);
 
-	/* Augment with the generic port (host bridge) perf data */
-	combine_coordinates(&c, &dport->hb_coord);
+		/*
+		 * There's no valid access_coordinate for a root port since RPs do not
+		 * have CDAT and therefore needs to be skipped.
+		 */
+		if (!is_cxl_root)
+			cxl_coordinates_combine(&c, &c, &dport->sw_coord);
+		c.write_latency += dport->link_latency;
+		c.read_latency += dport->link_latency;
+	} while (!is_cxl_root);
 
 	/* Get the calculated PCI paths bandwidth */
 	pdev = to_pci_dev(port->uport_dev->parent);
--- linux-qcom-6.8.0.orig/drivers/cxl/core/region.c
+++ linux-qcom-6.8.0/drivers/cxl/core/region.c
@@ -128,8 +128,8 @@
 				"Bypassing cpu_cache_invalidate_memregion() for testing!\n");
 			return 0;
 		} else {
-			dev_err(&cxlr->dev,
-				"Failed to synchronize CPU cache state\n");
+			dev_WARN(&cxlr->dev,
+				 "Failed to synchronize CPU cache state\n");
 			return -ENXIO;
 		}
 	}
@@ -138,19 +138,17 @@
 	return 0;
 }
 
-static int cxl_region_decode_reset(struct cxl_region *cxlr, int count)
+static void cxl_region_decode_reset(struct cxl_region *cxlr, int count)
 {
 	struct cxl_region_params *p = &cxlr->params;
-	int i, rc = 0;
+	int i;
 
 	/*
-	 * Before region teardown attempt to flush, and if the flush
-	 * fails cancel the region teardown for data consistency
-	 * concerns
+	 * Before region teardown attempt to flush, evict any data cached for
+	 * this region, or scream loudly about missing arch / platform support
+	 * for CXL teardown.
 	 */
-	rc = cxl_region_invalidate_memregion(cxlr);
-	if (rc)
-		return rc;
+	cxl_region_invalidate_memregion(cxlr);
 
 	for (i = count - 1; i >= 0; i--) {
 		struct cxl_endpoint_decoder *cxled = p->targets[i];
@@ -173,23 +171,17 @@
 			cxl_rr = cxl_rr_load(iter, cxlr);
 			cxld = cxl_rr->decoder;
 			if (cxld->reset)
-				rc = cxld->reset(cxld);
-			if (rc)
-				return rc;
+				cxld->reset(cxld);
 			set_bit(CXL_REGION_F_NEEDS_RESET, &cxlr->flags);
 		}
 
 endpoint_reset:
-		rc = cxled->cxld.reset(&cxled->cxld);
-		if (rc)
-			return rc;
+		cxled->cxld.reset(&cxled->cxld);
 		set_bit(CXL_REGION_F_NEEDS_RESET, &cxlr->flags);
 	}
 
 	/* all decoders associated with this region have been torn down */
 	clear_bit(CXL_REGION_F_NEEDS_RESET, &cxlr->flags);
-
-	return 0;
 }
 
 static int commit_decoder(struct cxl_decoder *cxld)
@@ -305,16 +297,8 @@
 		 * still pending.
 		 */
 		if (p->state == CXL_CONFIG_RESET_PENDING) {
-			rc = cxl_region_decode_reset(cxlr, p->interleave_ways);
-			/*
-			 * Revert to committed since there may still be active
-			 * decoders associated with this region, or move forward
-			 * to active to mark the reset successful
-			 */
-			if (rc)
-				p->state = CXL_CONFIG_COMMIT;
-			else
-				p->state = CXL_CONFIG_ACTIVE;
+			cxl_region_decode_reset(cxlr, p->interleave_ways);
+			p->state = CXL_CONFIG_ACTIVE;
 		}
 	}
 
@@ -998,6 +982,26 @@
 	}
 	cxld = cxl_rr->decoder;
 
+	/*
+	 * the number of targets should not exceed the target_count
+	 * of the decoder
+	 */
+	if (is_switch_decoder(&cxld->dev)) {
+		struct cxl_switch_decoder *cxlsd;
+
+		cxlsd = to_cxl_switch_decoder(&cxld->dev);
+		if (cxl_rr->nr_targets > cxlsd->nr_targets) {
+			dev_dbg(&cxlr->dev,
+				"%s:%s %s add: %s:%s @ %d overflows targets: %d\n",
+				dev_name(port->uport_dev), dev_name(&port->dev),
+				dev_name(&cxld->dev), dev_name(&cxlmd->dev),
+				dev_name(&cxled->cxld.dev), pos,
+				cxlsd->nr_targets);
+			rc = -ENXIO;
+			goto out_erase;
+		}
+	}
+
 	rc = cxl_rr_ep_add(cxl_rr, cxled);
 	if (rc) {
 		dev_dbg(&cxlr->dev,
@@ -1107,6 +1111,50 @@
 	return 0;
 }
 
+static int check_interleave_cap(struct cxl_decoder *cxld, int iw, int ig)
+{
+	struct cxl_port *port = to_cxl_port(cxld->dev.parent);
+	struct cxl_hdm *cxlhdm = dev_get_drvdata(&port->dev);
+	unsigned int interleave_mask;
+	u8 eiw;
+	u16 eig;
+	int high_pos, low_pos;
+
+	if (!test_bit(iw, &cxlhdm->iw_cap_mask))
+		return -ENXIO;
+	/*
+	 * Per CXL specification r3.1(8.2.4.20.13 Decoder Protection),
+	 * if eiw < 8:
+	 *   DPAOFFSET[51: eig + 8] = HPAOFFSET[51: eig + 8 + eiw]
+	 *   DPAOFFSET[eig + 7: 0]  = HPAOFFSET[eig + 7: 0]
+	 *
+	 *   when the eiw is 0, all the bits of HPAOFFSET[51: 0] are used, the
+	 *   interleave bits are none.
+	 *
+	 * if eiw >= 8:
+	 *   DPAOFFSET[51: eig + 8] = HPAOFFSET[51: eig + eiw] / 3
+	 *   DPAOFFSET[eig + 7: 0]  = HPAOFFSET[eig + 7: 0]
+	 *
+	 *   when the eiw is 8, all the bits of HPAOFFSET[51: 0] are used, the
+	 *   interleave bits are none.
+	 */
+	ways_to_eiw(iw, &eiw);
+	if (eiw == 0 || eiw == 8)
+		return 0;
+
+	granularity_to_eig(ig, &eig);
+	if (eiw > 8)
+		high_pos = eiw + eig - 1;
+	else
+		high_pos = eiw + eig + 7;
+	low_pos = eig + 8;
+	interleave_mask = GENMASK(high_pos, low_pos);
+	if (interleave_mask & ~cxlhdm->interleave_mask)
+		return -ENXIO;
+
+	return 0;
+}
+
 static int cxl_port_setup_targets(struct cxl_port *port,
 				  struct cxl_region *cxlr,
 				  struct cxl_endpoint_decoder *cxled)
@@ -1120,6 +1168,7 @@
 	struct cxl_region_params *p = &cxlr->params;
 	struct cxl_decoder *cxld = cxl_rr->decoder;
 	struct cxl_switch_decoder *cxlsd;
+	struct cxl_port *iter = port;
 	u16 eig, peig;
 	u8 eiw, peiw;
 
@@ -1136,16 +1185,26 @@
 
 	cxlsd = to_cxl_switch_decoder(&cxld->dev);
 	if (cxl_rr->nr_targets_set) {
-		int i, distance;
+		int i, distance = 1;
+		struct cxl_region_ref *cxl_rr_iter;
 
 		/*
-		 * Passthrough decoders impose no distance requirements between
-		 * peers
+		 * The "distance" between peer downstream ports represents which
+		 * endpoint positions in the region interleave a given port can
+		 * host.
+		 *
+		 * For example, at the root of a hierarchy the distance is
+		 * always 1 as every index targets a different host-bridge. At
+		 * each subsequent switch level those ports map every Nth region
+		 * position where N is the width of the switch == distance.
 		 */
-		if (cxl_rr->nr_targets == 1)
-			distance = 0;
-		else
-			distance = p->nr_targets / cxl_rr->nr_targets;
+		do {
+			cxl_rr_iter = cxl_rr_load(iter, cxlr);
+			distance *= cxl_rr_iter->nr_targets;
+			iter = to_cxl_port(iter->dev.parent);
+		} while (!is_cxl_root(iter));
+		distance *= cxlrd->cxlsd.cxld.interleave_ways;
+
 		for (i = 0; i < cxl_rr->nr_targets_set; i++)
 			if (ep->dport == cxlsd->target[i]) {
 				rc = check_last_peer(cxled, ep, cxl_rr,
@@ -1257,6 +1316,15 @@
 			return -ENXIO;
 		}
 	} else {
+		rc = check_interleave_cap(cxld, iw, ig);
+		if (rc) {
+			dev_dbg(&cxlr->dev,
+				"%s:%s iw: %d ig: %d is not supported\n",
+				dev_name(port->uport_dev),
+				dev_name(&port->dev), iw, ig);
+			return rc;
+		}
+
 		cxld->interleave_ways = iw;
 		cxld->interleave_granularity = ig;
 		cxld->hpa_range = (struct range) {
@@ -1456,10 +1524,13 @@
 				      const struct cxl_dport *dport, int pos)
 {
 	struct cxl_memdev *cxlmd = cxled_to_memdev(cxled);
+	struct cxl_switch_decoder *cxlsd = &cxlrd->cxlsd;
+	struct cxl_decoder *cxld = &cxlsd->cxld;
+	int iw = cxld->interleave_ways;
 	struct cxl_port *iter;
 	int rc;
 
-	if (cxlrd->calc_hb(cxlrd, pos) != dport) {
+	if (dport != cxlrd->cxlsd.target[pos % iw]) {
 		dev_dbg(&cxlr->dev, "%s:%s invalid target position for %s\n",
 			dev_name(&cxlmd->dev), dev_name(&cxled->cxld.dev),
 			dev_name(&cxlrd->cxlsd.cxld.dev));
@@ -1693,6 +1764,15 @@
 	struct cxl_dport *dport;
 	int rc = -ENXIO;
 
+	rc = check_interleave_cap(&cxled->cxld, p->interleave_ways,
+				  p->interleave_granularity);
+	if (rc) {
+		dev_dbg(&cxlr->dev, "%s iw: %d ig: %d is not supported\n",
+			dev_name(&cxled->cxld.dev), p->interleave_ways,
+			p->interleave_granularity);
+		return rc;
+	}
+
 	if (cxled->mode != cxlr->mode) {
 		dev_dbg(&cxlr->dev, "%s region mode: %d mismatch: %d\n",
 			dev_name(&cxled->cxld.dev), cxlr->mode, cxled->mode);
@@ -1861,13 +1941,7 @@
 	get_device(&cxlr->dev);
 
 	if (p->state > CXL_CONFIG_ACTIVE) {
-		/*
-		 * TODO: tear down all impacted regions if a device is
-		 * removed out of order
-		 */
-		rc = cxl_region_decode_reset(cxlr, p->interleave_ways);
-		if (rc)
-			goto out;
+		cxl_region_decode_reset(cxlr, p->interleave_ways);
 		p->state = CXL_CONFIG_ACTIVE;
 	}
 
@@ -2187,15 +2261,6 @@
 	struct device *dev;
 	int rc;
 
-	switch (mode) {
-	case CXL_DECODER_RAM:
-	case CXL_DECODER_PMEM:
-		break;
-	default:
-		dev_err(&cxlrd->cxlsd.cxld.dev, "unsupported mode %d\n", mode);
-		return ERR_PTR(-EINVAL);
-	}
-
 	cxlr = cxl_region_alloc(cxlrd, id);
 	if (IS_ERR(cxlr))
 		return cxlr;
@@ -2246,6 +2311,15 @@
 {
 	int rc;
 
+	switch (mode) {
+	case CXL_DECODER_RAM:
+	case CXL_DECODER_PMEM:
+		break;
+	default:
+		dev_err(&cxlrd->cxlsd.cxld.dev, "unsupported mode %d\n", mode);
+		return ERR_PTR(-EINVAL);
+	}
+
 	rc = memregion_alloc(GFP_KERNEL);
 	if (rc < 0)
 		return ERR_PTR(rc);
@@ -2510,28 +2584,78 @@
 	return rc;
 }
 
+struct cxl_dpa_to_region_context {
+	struct cxl_region *cxlr;
+	u64 dpa;
+};
+
+static int __cxl_dpa_to_region(struct device *dev, void *arg)
+{
+	struct cxl_dpa_to_region_context *ctx = arg;
+	struct cxl_endpoint_decoder *cxled;
+	struct cxl_region *cxlr;
+	u64 dpa = ctx->dpa;
+
+	if (!is_endpoint_decoder(dev))
+		return 0;
+
+	cxled = to_cxl_endpoint_decoder(dev);
+	if (!cxled || !cxled->dpa_res || !resource_size(cxled->dpa_res))
+		return 0;
+
+	if (dpa > cxled->dpa_res->end || dpa < cxled->dpa_res->start)
+		return 0;
+
+	/*
+	 * Stop the region search (return 1) when an endpoint mapping is
+	 * found. The region may not be fully constructed so offering
+	 * the cxlr in the context structure is not guaranteed.
+	 */
+	cxlr = cxled->cxld.region;
+	if (cxlr)
+		dev_dbg(dev, "dpa:0x%llx mapped in region:%s\n", dpa,
+			dev_name(&cxlr->dev));
+	else
+		dev_dbg(dev, "dpa:0x%llx mapped in endpoint:%s\n", dpa,
+			dev_name(dev));
+
+	ctx->cxlr = cxlr;
+
+	return 1;
+}
+
+struct cxl_region *cxl_dpa_to_region(const struct cxl_memdev *cxlmd, u64 dpa)
+{
+	struct cxl_dpa_to_region_context ctx;
+	struct cxl_port *port;
+
+	ctx = (struct cxl_dpa_to_region_context) {
+		.dpa = dpa,
+	};
+	port = cxlmd->endpoint;
+	if (port && is_cxl_endpoint(port) && cxl_num_decoders_committed(port))
+		device_for_each_child(&port->dev, &ctx, __cxl_dpa_to_region);
+
+	return ctx.cxlr;
+}
+
 static struct lock_class_key cxl_pmem_region_key;
 
-static struct cxl_pmem_region *cxl_pmem_region_alloc(struct cxl_region *cxlr)
+static int cxl_pmem_region_alloc(struct cxl_region *cxlr)
 {
 	struct cxl_region_params *p = &cxlr->params;
 	struct cxl_nvdimm_bridge *cxl_nvb;
-	struct cxl_pmem_region *cxlr_pmem;
 	struct device *dev;
 	int i;
 
-	down_read(&cxl_region_rwsem);
-	if (p->state != CXL_CONFIG_COMMIT) {
-		cxlr_pmem = ERR_PTR(-ENXIO);
-		goto out;
-	}
+	guard(rwsem_read)(&cxl_region_rwsem);
+	if (p->state != CXL_CONFIG_COMMIT)
+		return -ENXIO;
 
-	cxlr_pmem = kzalloc(struct_size(cxlr_pmem, mapping, p->nr_targets),
-			    GFP_KERNEL);
-	if (!cxlr_pmem) {
-		cxlr_pmem = ERR_PTR(-ENOMEM);
-		goto out;
-	}
+	struct cxl_pmem_region *cxlr_pmem __free(kfree) =
+		kzalloc(struct_size(cxlr_pmem, mapping, p->nr_targets), GFP_KERNEL);
+	if (!cxlr_pmem)
+		return -ENOMEM;
 
 	cxlr_pmem->hpa_range.start = p->res->start;
 	cxlr_pmem->hpa_range.end = p->res->end;
@@ -2548,11 +2672,9 @@
 		 * bridge for one device is the same for all.
 		 */
 		if (i == 0) {
-			cxl_nvb = cxl_find_nvdimm_bridge(cxlmd);
-			if (!cxl_nvb) {
-				cxlr_pmem = ERR_PTR(-ENODEV);
-				goto out;
-			}
+			cxl_nvb = cxl_find_nvdimm_bridge(cxlmd->endpoint);
+			if (!cxl_nvb)
+				return -ENODEV;
 			cxlr->cxl_nvb = cxl_nvb;
 		}
 		m->cxlmd = cxlmd;
@@ -2563,18 +2685,16 @@
 	}
 
 	dev = &cxlr_pmem->dev;
-	cxlr_pmem->cxlr = cxlr;
-	cxlr->cxlr_pmem = cxlr_pmem;
 	device_initialize(dev);
 	lockdep_set_class(&dev->mutex, &cxl_pmem_region_key);
 	device_set_pm_not_required(dev);
 	dev->parent = &cxlr->dev;
 	dev->bus = &cxl_bus_type;
 	dev->type = &cxl_pmem_region_type;
-out:
-	up_read(&cxl_region_rwsem);
+	cxlr_pmem->cxlr = cxlr;
+	cxlr->cxlr_pmem = no_free_ptr(cxlr_pmem);
 
-	return cxlr_pmem;
+	return 0;
 }
 
 static void cxl_dax_region_release(struct device *dev)
@@ -2691,9 +2811,10 @@
 	struct device *dev;
 	int rc;
 
-	cxlr_pmem = cxl_pmem_region_alloc(cxlr);
-	if (IS_ERR(cxlr_pmem))
-		return PTR_ERR(cxlr_pmem);
+	rc = cxl_pmem_region_alloc(cxlr);
+	if (rc)
+		return rc;
+	cxlr_pmem = cxlr->cxlr_pmem;
 	cxl_nvb = cxlr->cxl_nvb;
 
 	dev = &cxlr_pmem->dev;
--- linux-qcom-6.8.0.orig/drivers/cxl/core/regs.c
+++ linux-qcom-6.8.0/drivers/cxl/core/regs.c
@@ -271,6 +271,7 @@
 static bool cxl_decode_regblock(struct pci_dev *pdev, u32 reg_lo, u32 reg_hi,
 				struct cxl_register_map *map)
 {
+	u8 reg_type = FIELD_GET(CXL_DVSEC_REG_LOCATOR_BLOCK_ID_MASK, reg_lo);
 	int bar = FIELD_GET(CXL_DVSEC_REG_LOCATOR_BIR_MASK, reg_lo);
 	u64 offset = ((u64)reg_hi << 32) |
 		     (reg_lo & CXL_DVSEC_REG_LOCATOR_BLOCK_OFF_LOW_MASK);
@@ -278,11 +279,11 @@
 	if (offset > pci_resource_len(pdev, bar)) {
 		dev_warn(&pdev->dev,
 			 "BAR%d: %pr: too small (offset: %pa, type: %d)\n", bar,
-			 &pdev->resource[bar], &offset, map->reg_type);
+			 &pdev->resource[bar], &offset, reg_type);
 		return false;
 	}
 
-	map->reg_type = FIELD_GET(CXL_DVSEC_REG_LOCATOR_BLOCK_ID_MASK, reg_lo);
+	map->reg_type = reg_type;
 	map->resource = pci_resource_start(pdev, bar) + offset;
 	map->max_size = pci_resource_len(pdev, bar) - offset;
 	return true;
--- linux-qcom-6.8.0.orig/drivers/cxl/core/trace.c
+++ linux-qcom-6.8.0/drivers/cxl/core/trace.c
@@ -7,20 +7,13 @@
 #define CREATE_TRACE_POINTS
 #include "trace.h"
 
-static bool cxl_is_hpa_in_range(u64 hpa, struct cxl_region *cxlr, int pos)
+static bool cxl_is_hpa_in_chunk(u64 hpa, struct cxl_region *cxlr, int pos)
 {
 	struct cxl_region_params *p = &cxlr->params;
 	int gran = p->interleave_granularity;
 	int ways = p->interleave_ways;
 	u64 offset;
 
-	/* Is the hpa within this region at all */
-	if (hpa < p->res->start || hpa > p->res->end) {
-		dev_dbg(&cxlr->dev,
-			"Addr trans fail: hpa 0x%llx not in region\n", hpa);
-		return false;
-	}
-
 	/* Is the hpa in an expected chunk for its pos(-ition) */
 	offset = hpa - p->res->start;
 	offset = do_div(offset, gran * ways);
@@ -36,6 +29,7 @@
 static u64 cxl_dpa_to_hpa(u64 dpa,  struct cxl_region *cxlr,
 			  struct cxl_endpoint_decoder *cxled)
 {
+	struct cxl_root_decoder *cxlrd = to_cxl_root_decoder(cxlr->dev.parent);
 	u64 dpa_offset, hpa_offset, bits_upper, mask_upper, hpa;
 	struct cxl_region_params *p = &cxlr->params;
 	int pos = cxled->pos;
@@ -75,7 +69,18 @@
 	/* Apply the hpa_offset to the region base address */
 	hpa = hpa_offset + p->res->start;
 
-	if (!cxl_is_hpa_in_range(hpa, cxlr, cxled->pos))
+	/* Root decoder translation overrides typical modulo decode */
+	if (cxlrd->hpa_to_spa)
+		hpa = cxlrd->hpa_to_spa(cxlrd, hpa);
+
+	if (hpa < p->res->start || hpa > p->res->end) {
+		dev_dbg(&cxlr->dev,
+			"Addr trans fail: hpa 0x%llx not in region\n", hpa);
+		return ULLONG_MAX;
+	}
+
+	/* Simple chunk check, by pos & gran, only applies to modulo decodes */
+	if (!cxlrd->hpa_to_spa && (!cxl_is_hpa_in_chunk(hpa, cxlr, pos)))
 		return ULLONG_MAX;
 
 	return hpa;
--- linux-qcom-6.8.0.orig/drivers/cxl/core/trace.h
+++ linux-qcom-6.8.0/drivers/cxl/core/trace.h
@@ -253,8 +253,8 @@
  * DRAM Event Record
  * CXL rev 3.0 section 8.2.9.2.1.2; Table 8-44
  */
-#define CXL_DPA_FLAGS_MASK			0x3F
-#define CXL_DPA_MASK				(~CXL_DPA_FLAGS_MASK)
+#define CXL_DPA_FLAGS_MASK			GENMASK(1, 0)
+#define CXL_DPA_MASK				GENMASK_ULL(63, 6)
 
 #define CXL_DPA_VOLATILE			BIT(0)
 #define CXL_DPA_NOT_REPAIRABLE			BIT(1)
@@ -279,7 +279,7 @@
 #define CXL_GMER_MEM_EVT_TYPE_ECC_ERROR			0x00
 #define CXL_GMER_MEM_EVT_TYPE_INV_ADDR			0x01
 #define CXL_GMER_MEM_EVT_TYPE_DATA_PATH_ERROR		0x02
-#define show_mem_event_type(type)	__print_symbolic(type,			\
+#define show_gmer_mem_event_type(type)	__print_symbolic(type,			\
 	{ CXL_GMER_MEM_EVT_TYPE_ECC_ERROR,		"ECC Error" },		\
 	{ CXL_GMER_MEM_EVT_TYPE_INV_ADDR,		"Invalid Address" },	\
 	{ CXL_GMER_MEM_EVT_TYPE_DATA_PATH_ERROR,	"Data Path Error" }	\
@@ -361,7 +361,7 @@
 		"device=%x comp_id=%s validity_flags='%s'",
 		__entry->dpa, show_dpa_flags(__entry->dpa_flags),
 		show_event_desc_flags(__entry->descriptor),
-		show_mem_event_type(__entry->type),
+		show_gmer_mem_event_type(__entry->type),
 		show_trans_type(__entry->transaction_type),
 		__entry->channel, __entry->rank, __entry->device,
 		__print_hex(__entry->comp_id, CXL_EVENT_GEN_MED_COMP_ID_SIZE),
@@ -378,6 +378,17 @@
  * DRAM Event Record defines many fields the same as the General Media Event
  * Record.  Reuse those definitions as appropriate.
  */
+#define CXL_DER_MEM_EVT_TYPE_ECC_ERROR			0x00
+#define CXL_DER_MEM_EVT_TYPE_SCRUB_MEDIA_ECC_ERROR	0x01
+#define CXL_DER_MEM_EVT_TYPE_INV_ADDR			0x02
+#define CXL_DER_MEM_EVT_TYPE_DATA_PATH_ERROR		0x03
+#define show_dram_mem_event_type(type)  __print_symbolic(type,				\
+	{ CXL_DER_MEM_EVT_TYPE_ECC_ERROR,		"ECC Error" },			\
+	{ CXL_DER_MEM_EVT_TYPE_SCRUB_MEDIA_ECC_ERROR,	"Scrub Media ECC Error" },	\
+	{ CXL_DER_MEM_EVT_TYPE_INV_ADDR,		"Invalid Address" },		\
+	{ CXL_DER_MEM_EVT_TYPE_DATA_PATH_ERROR,		"Data Path Error" }		\
+)
+
 #define CXL_DER_VALID_CHANNEL				BIT(0)
 #define CXL_DER_VALID_RANK				BIT(1)
 #define CXL_DER_VALID_NIBBLE				BIT(2)
@@ -452,7 +463,7 @@
 		"validity_flags='%s'",
 		__entry->dpa, show_dpa_flags(__entry->dpa_flags),
 		show_event_desc_flags(__entry->descriptor),
-		show_mem_event_type(__entry->type),
+		show_dram_mem_event_type(__entry->type),
 		show_trans_type(__entry->transaction_type),
 		__entry->channel, __entry->rank, __entry->nibble_mask,
 		__entry->bank_group, __entry->bank,
@@ -646,18 +657,18 @@
 
 TRACE_EVENT(cxl_poison,
 
-	TP_PROTO(struct cxl_memdev *cxlmd, struct cxl_region *region,
+	TP_PROTO(struct cxl_memdev *cxlmd, struct cxl_region *cxlr,
 		 const struct cxl_poison_record *record, u8 flags,
 		 __le64 overflow_ts, enum cxl_poison_trace_type trace_type),
 
-	TP_ARGS(cxlmd, region, record, flags, overflow_ts, trace_type),
+	TP_ARGS(cxlmd, cxlr, record, flags, overflow_ts, trace_type),
 
 	TP_STRUCT__entry(
 		__string(memdev, dev_name(&cxlmd->dev))
 		__string(host, dev_name(cxlmd->dev.parent))
 		__field(u64, serial)
 		__field(u8, trace_type)
-		__string(region, region)
+		__string(region, cxlr ? dev_name(&cxlr->dev) : "")
 		__field(u64, overflow_ts)
 		__field(u64, hpa)
 		__field(u64, dpa)
@@ -677,10 +688,10 @@
 		__entry->source = cxl_poison_record_source(record);
 		__entry->trace_type = trace_type;
 		__entry->flags = flags;
-		if (region) {
-			__assign_str(region, dev_name(&region->dev));
-			memcpy(__entry->uuid, &region->params.uuid, 16);
-			__entry->hpa = cxl_trace_hpa(region, cxlmd,
+		if (cxlr) {
+			__assign_str(region, dev_name(&cxlr->dev));
+			memcpy(__entry->uuid, &cxlr->params.uuid, 16);
+			__entry->hpa = cxl_trace_hpa(cxlr, cxlmd,
 						     __entry->dpa);
 		} else {
 			__assign_str(region, "");
--- linux-qcom-6.8.0.orig/drivers/cxl/cxl.h
+++ linux-qcom-6.8.0/drivers/cxl/cxl.h
@@ -44,6 +44,8 @@
 #define   CXL_HDM_DECODER_TARGET_COUNT_MASK GENMASK(7, 4)
 #define   CXL_HDM_DECODER_INTERLEAVE_11_8 BIT(8)
 #define   CXL_HDM_DECODER_INTERLEAVE_14_12 BIT(9)
+#define   CXL_HDM_DECODER_INTERLEAVE_3_6_12_WAY BIT(11)
+#define   CXL_HDM_DECODER_INTERLEAVE_16_WAY BIT(12)
 #define CXL_HDM_DECODER_CTRL_OFFSET 0x4
 #define   CXL_HDM_DECODER_ENABLE BIT(1)
 #define CXL_HDM_DECODER0_BASE_LOW_OFFSET(i) (0x20 * (i) + 0x10)
@@ -354,7 +356,7 @@
 	struct cxl_region *region;
 	unsigned long flags;
 	int (*commit)(struct cxl_decoder *cxld);
-	int (*reset)(struct cxl_decoder *cxld);
+	void (*reset)(struct cxl_decoder *cxld);
 };
 
 /*
@@ -431,12 +433,14 @@
 struct cxl_root_decoder;
 typedef struct cxl_dport *(*cxl_calc_hb_fn)(struct cxl_root_decoder *cxlrd,
 					    int pos);
+typedef u64 (*cxl_hpa_to_spa_fn)(struct cxl_root_decoder *cxlrd, u64 hpa);
 
 /**
  * struct cxl_root_decoder - Static platform CXL address decoder
  * @res: host / parent resource for region allocations
  * @region_id: region id for next region provisioning event
  * @calc_hb: which host bridge covers the n'th position by granularity
+ * @hpa_to_spa: translate CXL host-physical-address to Platform system-physical-address
  * @platform_data: platform specific configuration data
  * @range_lock: sync region autodiscovery by address range
  * @qos_class: QoS performance class cookie
@@ -446,6 +450,7 @@
 	struct resource *res;
 	atomic_t region_id;
 	cxl_calc_hb_fn calc_hb;
+	cxl_hpa_to_spa_fn hpa_to_spa;
 	void *platform_data;
 	struct mutex range_lock;
 	int qos_class;
@@ -671,7 +676,7 @@
 	struct cxl_port *port;
 	struct cxl_regs regs;
 	struct access_coordinate sw_coord;
-	struct access_coordinate hb_coord;
+	struct access_coordinate hb_coord[ACCESS_COORDINATE_MAX];
 	long link_latency;
 };
 
@@ -722,6 +727,7 @@
 int cxl_num_decoders_committed(struct cxl_port *port);
 bool is_cxl_port(const struct device *dev);
 struct cxl_port *to_cxl_port(const struct device *dev);
+void cxl_port_commit_reap(struct cxl_decoder *cxld);
 struct pci_bus;
 int devm_cxl_register_pci_bus(struct device *host, struct device *uport_dev,
 			      struct pci_bus *bus);
@@ -845,8 +851,8 @@
 struct cxl_nvdimm *to_cxl_nvdimm(struct device *dev);
 bool is_cxl_nvdimm(struct device *dev);
 bool is_cxl_nvdimm_bridge(struct device *dev);
-int devm_cxl_add_nvdimm(struct cxl_memdev *cxlmd);
-struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_memdev *cxlmd);
+int devm_cxl_add_nvdimm(struct cxl_port *parent_port, struct cxl_memdev *cxlmd);
+struct cxl_nvdimm_bridge *cxl_find_nvdimm_bridge(struct cxl_port *port);
 
 #ifdef CONFIG_CXL_REGION
 bool is_cxl_pmem_region(struct device *dev);
@@ -879,9 +885,17 @@
 
 int cxl_endpoint_get_perf_coordinates(struct cxl_port *port,
 				      struct access_coordinate *coord);
+int cxl_hb_get_perf_coordinates(struct cxl_port *port,
+				struct access_coordinate *coord);
 
 void cxl_memdev_update_perf(struct cxl_memdev *cxlmd);
 
+void cxl_coordinates_combine(struct access_coordinate *out,
+			     struct access_coordinate *c1,
+			     struct access_coordinate *c2);
+
+bool cxl_endpoint_decoder_reset_detected(struct cxl_port *port);
+
 /*
  * Unit test builds overrides this to __weak, find the 'strong' version
  * of these symbols in tools/testing/cxl/.
--- linux-qcom-6.8.0.orig/drivers/cxl/cxlmem.h
+++ linux-qcom-6.8.0/drivers/cxl/cxlmem.h
@@ -559,7 +559,7 @@
 		  0x3b, 0x3f, 0x17)
 
 #define DEFINE_CXL_VENDOR_DEBUG_UUID                                           \
-	UUID_INIT(0xe1819d9, 0x11a9, 0x400c, 0x81, 0x1f, 0xd6, 0x07, 0x19,     \
+	UUID_INIT(0x5e1819d9, 0x11a9, 0x400c, 0x81, 0x1f, 0xd6, 0x07, 0x19,     \
 		  0x40, 0x3d, 0x86)
 
 struct cxl_mbox_get_supported_logs {
@@ -848,11 +848,21 @@
 
 int cxl_mem_sanitize(struct cxl_memdev *cxlmd, u16 cmd);
 
+/**
+ * struct cxl_hdm - HDM Decoder registers and cached / decoded capabilities
+ * @regs: mapped registers, see devm_cxl_setup_hdm()
+ * @decoder_count: number of decoders for this port
+ * @target_count: for switch decoders, max downstream port targets
+ * @interleave_mask: interleave granularity capability, see check_interleave_cap()
+ * @iw_cap_mask: bitmask of supported interleave ways, see check_interleave_cap()
+ * @port: mapped cxl_port, see devm_cxl_setup_hdm()
+ */
 struct cxl_hdm {
 	struct cxl_component_regs regs;
 	unsigned int decoder_count;
 	unsigned int target_count;
 	unsigned int interleave_mask;
+	unsigned long iw_cap_mask;
 	struct cxl_port *port;
 };
 
--- linux-qcom-6.8.0.orig/drivers/cxl/mem.c
+++ linux-qcom-6.8.0/drivers/cxl/mem.c
@@ -152,6 +152,15 @@
 		return -ENXIO;
 	}
 
+	if (resource_size(&cxlds->pmem_res) && IS_ENABLED(CONFIG_CXL_PMEM)) {
+		rc = devm_cxl_add_nvdimm(parent_port, cxlmd);
+		if (rc) {
+			if (rc == -ENODEV)
+				dev_info(dev, "PMEM disabled by platform\n");
+			return rc;
+		}
+	}
+
 	if (dport->rch)
 		endpoint_parent = parent_port->uport_dev;
 	else
@@ -174,14 +183,6 @@
 	if (rc)
 		return rc;
 
-	if (resource_size(&cxlds->pmem_res) && IS_ENABLED(CONFIG_CXL_PMEM)) {
-		rc = devm_cxl_add_nvdimm(cxlmd);
-		if (rc == -ENODEV)
-			dev_info(dev, "PMEM disabled by platform\n");
-		else
-			return rc;
-	}
-
 	/*
 	 * The kernel may be operating out of CXL memory on this device,
 	 * there is no spec defined way to determine whether this device
--- linux-qcom-6.8.0.orig/drivers/cxl/pci.c
+++ linux-qcom-6.8.0/drivers/cxl/pci.c
@@ -917,8 +917,7 @@
 	if (rc)
 		return rc;
 
-	rc = cxl_pci_ras_unmask(pdev);
-	if (rc)
+	if (cxl_pci_ras_unmask(pdev))
 		dev_dbg(&pdev->dev, "No RAS reporting unmasked\n");
 
 	pci_save_state(pdev);
@@ -957,11 +956,33 @@
 		 dev->driver ? "successful" : "failed");
 }
 
+static void cxl_reset_done(struct pci_dev *pdev)
+{
+	struct cxl_dev_state *cxlds = pci_get_drvdata(pdev);
+	struct cxl_memdev *cxlmd = cxlds->cxlmd;
+	struct device *dev = &pdev->dev;
+
+	/*
+	 * FLR does not expect to touch the HDM decoders and related
+	 * registers.  SBR, however, will wipe all device configurations.
+	 * Issue a warning if there was an active decoder before the reset
+	 * that no longer exists.
+	 */
+	guard(device)(&cxlmd->dev);
+	if (cxlmd->endpoint &&
+	    cxl_endpoint_decoder_reset_detected(cxlmd->endpoint)) {
+		dev_crit(dev, "SBR happened without memory regions removal.\n");
+		dev_crit(dev, "System may be unstable if regions hosted system memory.\n");
+		add_taint(TAINT_USER, LOCKDEP_STILL_OK);
+	}
+}
+
 static const struct pci_error_handlers cxl_error_handlers = {
 	.error_detected	= cxl_error_detected,
 	.slot_reset	= cxl_slot_reset,
 	.resume		= cxl_error_resume,
 	.cor_error_detected	= cxl_cor_error_detected,
+	.reset_done	= cxl_reset_done,
 };
 
 static struct pci_driver cxl_pci_driver = {
--- linux-qcom-6.8.0.orig/drivers/cxl/port.c
+++ linux-qcom-6.8.0/drivers/cxl/port.c
@@ -208,7 +208,22 @@
 	},
 };
 
-module_cxl_driver(cxl_port_driver);
+static int __init cxl_port_init(void)
+{
+	return cxl_driver_register(&cxl_port_driver);
+}
+/*
+ * Be ready to immediately enable ports emitted by the platform CXL root
+ * (e.g. cxl_acpi) when CONFIG_CXL_PORT=y.
+ */
+subsys_initcall(cxl_port_init);
+
+static void __exit cxl_port_exit(void)
+{
+	cxl_driver_unregister(&cxl_port_driver);
+}
+module_exit(cxl_port_exit);
+
 MODULE_LICENSE("GPL v2");
 MODULE_IMPORT_NS(CXL);
 MODULE_ALIAS_CXL(CXL_DEVICE_PORT);
--- linux-qcom-6.8.0.orig/drivers/dax/device.c
+++ linux-qcom-6.8.0/drivers/dax/device.c
@@ -86,7 +86,7 @@
 		nr_pages = 1;
 
 	pgoff = linear_page_index(vmf->vma,
-			ALIGN(vmf->address, fault_size));
+			ALIGN_DOWN(vmf->address, fault_size));
 
 	for (i = 0; i < nr_pages; i++) {
 		struct page *page = pfn_to_page(pfn_t_to_pfn(pfn) + i);
--- linux-qcom-6.8.0.orig/drivers/dma-buf/dma-buf.c
+++ linux-qcom-6.8.0/drivers/dma-buf/dma-buf.c
@@ -9,6 +9,8 @@
  * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and
  * Daniel Vetter <daniel@ffwll.ch> for their support in creation and
  * refining of this idea.
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/fs.h>
@@ -1412,6 +1414,27 @@
 }
 EXPORT_SYMBOL_NS_GPL(dma_buf_begin_cpu_access, DMA_BUF);
 
+int dma_buf_begin_cpu_access_partial(struct dma_buf *dmabuf,
+		enum dma_data_direction direction,
+		unsigned int offset, unsigned int len)
+{
+	int ret = 0;
+
+	if (WARN_ON(!dmabuf))
+		return -EINVAL;
+	if (dmabuf->ops->begin_cpu_access_partial)
+		ret = dmabuf->ops->begin_cpu_access_partial(dmabuf, direction,
+				offset, len);
+	/* Ensure that all fences are waited upon - but we first allow
+	 * the native handler the chance to do so more efficiently if it
+	 * chooses. A double invocation here will be reasonably cheap no-op.
+	 */
+	if (ret == 0)
+		ret = __dma_buf_begin_cpu_access(dmabuf, direction);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(dma_buf_begin_cpu_access_partial);
+
 /**
  * dma_buf_end_cpu_access - Must be called after accessing a dma_buf from the
  * cpu in the kernel context. Calls end_cpu_access to allow exporter-specific
@@ -1440,6 +1463,19 @@
 }
 EXPORT_SYMBOL_NS_GPL(dma_buf_end_cpu_access, DMA_BUF);
 
+int dma_buf_end_cpu_access_partial(struct dma_buf *dmabuf,
+		enum dma_data_direction direction,
+		unsigned int offset, unsigned int len)
+{
+	int ret = 0;
+
+	WARN_ON(!dmabuf);
+	if (dmabuf->ops->end_cpu_access_partial)
+		ret = dmabuf->ops->end_cpu_access_partial(dmabuf, direction,
+				offset, len);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access_partial);
 
 /**
  * dma_buf_mmap - Setup up a userspace mmap with the given vma
--- linux-qcom-6.8.0.orig/drivers/dma-buf/dma-fence-array.c
+++ linux-qcom-6.8.0/drivers/dma-buf/dma-fence-array.c
@@ -103,10 +103,36 @@
 static bool dma_fence_array_signaled(struct dma_fence *fence)
 {
 	struct dma_fence_array *array = to_dma_fence_array(fence);
+	int num_pending;
+	unsigned int i;
 
-	if (atomic_read(&array->num_pending) > 0)
+	/*
+	 * We need to read num_pending before checking the enable_signal bit
+	 * to avoid racing with the enable_signaling() implementation, which
+	 * might decrement the counter, and cause a partial check.
+	 * atomic_read_acquire() pairs with atomic_dec_and_test() in
+	 * dma_fence_array_enable_signaling()
+	 *
+	 * The !--num_pending check is here to account for the any_signaled case
+	 * if we race with enable_signaling(), that means the !num_pending check
+	 * in the is_signalling_enabled branch might be outdated (num_pending
+	 * might have been decremented), but that's fine. The user will get the
+	 * right value when testing again later.
+	 */
+	num_pending = atomic_read_acquire(&array->num_pending);
+	if (test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, &array->base.flags)) {
+		if (num_pending <= 0)
+			goto signal;
 		return false;
+	}
 
+	for (i = 0; i < array->num_fences; ++i) {
+		if (dma_fence_is_signaled(array->fences[i]) && !--num_pending)
+			goto signal;
+	}
+	return false;
+
+signal:
 	dma_fence_array_clear_pending_error(array);
 	return true;
 }
--- linux-qcom-6.8.0.orig/drivers/dma-buf/dma-fence-unwrap.c
+++ linux-qcom-6.8.0/drivers/dma-buf/dma-fence-unwrap.c
@@ -12,6 +12,7 @@
 #include <linux/dma-fence-chain.h>
 #include <linux/dma-fence-unwrap.h>
 #include <linux/slab.h>
+#include <linux/sort.h>
 
 /* Internal helper to start new array iteration, don't use directly */
 static struct dma_fence *
@@ -59,6 +60,25 @@
 }
 EXPORT_SYMBOL_GPL(dma_fence_unwrap_next);
 
+
+static int fence_cmp(const void *_a, const void *_b)
+{
+	struct dma_fence *a = *(struct dma_fence **)_a;
+	struct dma_fence *b = *(struct dma_fence **)_b;
+
+	if (a->context < b->context)
+		return -1;
+	else if (a->context > b->context)
+		return 1;
+
+	if (dma_fence_is_later(b, a))
+		return 1;
+	else if (dma_fence_is_later(a, b))
+		return -1;
+
+	return 0;
+}
+
 /* Implementation for the dma_fence_merge() marco, don't use directly */
 struct dma_fence *__dma_fence_unwrap_merge(unsigned int num_fences,
 					   struct dma_fence **fences,
@@ -67,8 +87,7 @@
 	struct dma_fence_array *result;
 	struct dma_fence *tmp, **array;
 	ktime_t timestamp;
-	unsigned int i;
-	size_t count;
+	int i, j, count;
 
 	count = 0;
 	timestamp = ns_to_ktime(0);
@@ -96,78 +115,55 @@
 	if (!array)
 		return NULL;
 
-	/*
-	 * This trashes the input fence array and uses it as position for the
-	 * following merge loop. This works because the dma_fence_merge()
-	 * wrapper macro is creating this temporary array on the stack together
-	 * with the iterators.
-	 */
-	for (i = 0; i < num_fences; ++i)
-		fences[i] = dma_fence_unwrap_first(fences[i], &iter[i]);
-
 	count = 0;
-	do {
-		unsigned int sel;
-
-restart:
-		tmp = NULL;
-		for (i = 0; i < num_fences; ++i) {
-			struct dma_fence *next;
-
-			while (fences[i] && dma_fence_is_signaled(fences[i]))
-				fences[i] = dma_fence_unwrap_next(&iter[i]);
-
-			next = fences[i];
-			if (!next)
-				continue;
-
-			/*
-			 * We can't guarantee that inpute fences are ordered by
-			 * context, but it is still quite likely when this
-			 * function is used multiple times. So attempt to order
-			 * the fences by context as we pass over them and merge
-			 * fences with the same context.
-			 */
-			if (!tmp || tmp->context > next->context) {
-				tmp = next;
-				sel = i;
-
-			} else if (tmp->context < next->context) {
-				continue;
-
-			} else if (dma_fence_is_later(tmp, next)) {
-				fences[i] = dma_fence_unwrap_next(&iter[i]);
-				goto restart;
+	for (i = 0; i < num_fences; ++i) {
+		dma_fence_unwrap_for_each(tmp, &iter[i], fences[i]) {
+			if (!dma_fence_is_signaled(tmp)) {
+				array[count++] = dma_fence_get(tmp);
 			} else {
-				fences[sel] = dma_fence_unwrap_next(&iter[sel]);
-				goto restart;
+				ktime_t t = dma_fence_timestamp(tmp);
+
+				if (ktime_after(t, timestamp))
+					timestamp = t;
 			}
 		}
+	}
 
-		if (tmp) {
-			array[count++] = dma_fence_get(tmp);
-			fences[sel] = dma_fence_unwrap_next(&iter[sel]);
-		}
-	} while (tmp);
+	if (count == 0 || count == 1)
+		goto return_fastpath;
 
-	if (count == 0) {
-		tmp = dma_fence_allocate_private_stub(ktime_get());
-		goto return_tmp;
-	}
+	sort(array, count, sizeof(*array), fence_cmp, NULL);
 
-	if (count == 1) {
-		tmp = array[0];
-		goto return_tmp;
+	/*
+	 * Only keep the most recent fence for each context.
+	 */
+	j = 0;
+	for (i = 1; i < count; i++) {
+		if (array[i]->context == array[j]->context)
+			dma_fence_put(array[i]);
+		else
+			array[++j] = array[i];
 	}
+	count = ++j;
 
-	result = dma_fence_array_create(count, array,
-					dma_fence_context_alloc(1),
-					1, false);
-	if (!result) {
-		tmp = NULL;
-		goto return_tmp;
+	if (count > 1) {
+		result = dma_fence_array_create(count, array,
+						dma_fence_context_alloc(1),
+						1, false);
+		if (!result) {
+			for (i = 0; i < count; i++)
+				dma_fence_put(array[i]);
+			tmp = NULL;
+			goto return_tmp;
+		}
+		return &result->base;
 	}
-	return &result->base;
+
+return_fastpath:
+	if (count == 0)
+		tmp = dma_fence_allocate_private_stub(timestamp);
+	else
+		tmp = array[0];
 
 return_tmp:
 	kfree(array);
--- linux-qcom-6.8.0.orig/drivers/dma-buf/dma-heap.c
+++ linux-qcom-6.8.0/drivers/dma-buf/dma-heap.c
@@ -4,6 +4,7 @@
  *
  * Copyright (C) 2011 Google, Inc.
  * Copyright (C) 2019 Linaro Ltd.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/cdev.h>
@@ -12,6 +13,7 @@
 #include <linux/dma-buf.h>
 #include <linux/err.h>
 #include <linux/xarray.h>
+#include <linux/kref.h>
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/nospec.h>
@@ -31,6 +33,9 @@
  * @heap_devt		heap device node
  * @list		list head connecting to list of heaps
  * @heap_cdev		heap char device
+ * @heap_dev		heap device struct
+ * @minor:		heap device node minor number
+ * @refcount:		reference counter for this heap device
  *
  * Represents a heap of memory from which buffers can be made.
  */
@@ -41,6 +46,9 @@
 	dev_t heap_devt;
 	struct list_head list;
 	struct cdev heap_cdev;
+	int minor;
+	struct kref refcount;
+	struct device *heap_dev;
 };
 
 static LIST_HEAD(heap_list);
@@ -49,12 +57,15 @@
 static struct class *dma_heap_class;
 static DEFINE_XARRAY_ALLOC(dma_heap_minors);
 
-static int dma_heap_buffer_alloc(struct dma_heap *heap, size_t len,
-				 unsigned int fd_flags,
-				 unsigned int heap_flags)
+struct dma_buf *dma_heap_buffer_alloc(struct dma_heap *heap, size_t len,
+				      unsigned int fd_flags,
+				      unsigned int heap_flags)
 {
-	struct dma_buf *dmabuf;
-	int fd;
+	if (fd_flags & ~DMA_HEAP_VALID_FD_FLAGS)
+		return ERR_PTR(-EINVAL);
+
+	if (heap_flags & ~DMA_HEAP_VALID_HEAP_FLAGS)
+		return ERR_PTR(-EINVAL);
 
 	/*
 	 * Allocations from all heaps have to begin
@@ -62,9 +73,20 @@
 	 */
 	len = PAGE_ALIGN(len);
 	if (!len)
-		return -EINVAL;
+		return ERR_PTR(-EINVAL);
+
+	return heap->ops->allocate(heap, len, fd_flags, heap_flags);
+}
+EXPORT_SYMBOL_GPL(dma_heap_buffer_alloc);
+
+static int dma_heap_bufferfd_alloc(struct dma_heap *heap, size_t len,
+				   unsigned int fd_flags,
+				   unsigned int heap_flags)
+{
+	struct dma_buf *dmabuf;
+	int fd;
 
-	dmabuf = heap->ops->allocate(heap, len, fd_flags, heap_flags);
+	dmabuf = dma_heap_buffer_alloc(heap, len, fd_flags, heap_flags);
 	if (IS_ERR(dmabuf))
 		return PTR_ERR(dmabuf);
 
@@ -102,15 +124,9 @@
 	if (heap_allocation->fd)
 		return -EINVAL;
 
-	if (heap_allocation->fd_flags & ~DMA_HEAP_VALID_FD_FLAGS)
-		return -EINVAL;
-
-	if (heap_allocation->heap_flags & ~DMA_HEAP_VALID_HEAP_FLAGS)
-		return -EINVAL;
-
-	fd = dma_heap_buffer_alloc(heap, heap_allocation->len,
-				   heap_allocation->fd_flags,
-				   heap_allocation->heap_flags);
+	fd = dma_heap_bufferfd_alloc(heap, heap_allocation->len,
+				     heap_allocation->fd_flags,
+				     heap_allocation->heap_flags);
 	if (fd < 0)
 		return fd;
 
@@ -205,6 +221,18 @@
 }
 
 /**
+ * dma_heap_get_dev() - get device struct for the heap
+ * @heap: DMA-Heap to retrieve device struct from
+ *
+ * Returns:
+ * The device struct for the heap.
+ */
+struct device *dma_heap_get_dev(struct dma_heap *heap)
+{
+		return heap->heap_dev;
+}
+
+/**
  * dma_heap_get_name() - get heap name
  * @heap: DMA-Heap to retrieve private data for
  *
@@ -215,12 +243,11 @@
 {
 	return heap->name;
 }
+EXPORT_SYMBOL_GPL(dma_heap_get_name);
 
 struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info)
 {
 	struct dma_heap *heap, *h, *err_ret;
-	struct device *dev_ret;
-	unsigned int minor;
 	int ret;
 
 	if (!exp_info->name || !strcmp(exp_info->name, "")) {
@@ -237,12 +264,13 @@
 	if (!heap)
 		return ERR_PTR(-ENOMEM);
 
+	kref_init(&heap->refcount);
 	heap->name = exp_info->name;
 	heap->ops = exp_info->ops;
 	heap->priv = exp_info->priv;
 
 	/* Find unused minor number */
-	ret = xa_alloc(&dma_heap_minors, &minor, heap,
+	ret = xa_alloc(&dma_heap_minors, &heap->minor, heap,
 		       XA_LIMIT(0, NUM_HEAP_MINORS - 1), GFP_KERNEL);
 	if (ret < 0) {
 		pr_err("dma_heap: Unable to get minor number for heap\n");
@@ -251,7 +279,7 @@
 	}
 
 	/* Create device */
-	heap->heap_devt = MKDEV(MAJOR(dma_heap_devt), minor);
+	heap->heap_devt = MKDEV(MAJOR(dma_heap_devt), heap->minor);
 
 	cdev_init(&heap->heap_cdev, &dma_heap_fops);
 	ret = cdev_add(&heap->heap_cdev, heap->heap_devt, 1);
@@ -261,17 +289,20 @@
 		goto err1;
 	}
 
-	dev_ret = device_create(dma_heap_class,
-				NULL,
-				heap->heap_devt,
-				NULL,
-				heap->name);
-	if (IS_ERR(dev_ret)) {
+	heap->heap_dev = device_create(dma_heap_class,
+			NULL,
+			heap->heap_devt,
+			NULL,
+			heap->name);
+	if (IS_ERR(heap->heap_dev)) {
 		pr_err("dma_heap: Unable to create device\n");
-		err_ret = ERR_CAST(dev_ret);
+		err_ret = ERR_CAST(heap->heap_dev);
 		goto err2;
 	}
 
+	/* Make sure it doesn't disappear on us */
+	heap->heap_dev = get_device(heap->heap_dev);
+
 	mutex_lock(&heap_list_lock);
 	/* check the name is unique */
 	list_for_each_entry(h, &heap_list, list) {
@@ -295,11 +326,55 @@
 err2:
 	cdev_del(&heap->heap_cdev);
 err1:
-	xa_erase(&dma_heap_minors, minor);
+	xa_erase(&dma_heap_minors, heap->minor);
 err0:
 	kfree(heap);
 	return err_ret;
 }
+EXPORT_SYMBOL_GPL(dma_heap_add);
+
+struct dma_heap *dma_heap_find(const char *name)
+{
+	struct dma_heap *h;
+
+	mutex_lock(&heap_list_lock);
+	list_for_each_entry(h, &heap_list, list) {
+		if (!strcmp(h->name, name)) {
+			kref_get(&h->refcount);
+			mutex_unlock(&heap_list_lock);
+			return h;
+		}
+	}
+	mutex_unlock(&heap_list_lock);
+	return NULL;
+}
+EXPORT_SYMBOL_GPL(dma_heap_find);
+
+static void dma_heap_release(struct kref *ref)
+{
+	struct dma_heap *heap = container_of(ref, struct dma_heap, refcount);
+
+	/* Note, we already holding the heap_list_lock here */
+	list_del(&heap->list);
+
+	device_destroy(dma_heap_class, heap->heap_devt);
+	cdev_del(&heap->heap_cdev);
+	xa_erase(&dma_heap_minors, heap->minor);
+
+	kfree(heap);
+}
+
+void dma_heap_put(struct dma_heap *h)
+{
+	/*
+	 * Take the heap_list_lock now to avoid racing with code
+	 * scanning the list and then taking a kref.
+	 */
+	mutex_lock(&heap_list_lock);
+	kref_put(&h->refcount, dma_heap_release);
+	mutex_unlock(&heap_list_lock);
+}
+EXPORT_SYMBOL_GPL(dma_heap_put);
 
 static char *dma_heap_devnode(const struct device *dev, umode_t *mode)
 {
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/Kconfig
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/Kconfig
@@ -12,3 +12,67 @@
 	  Choose this option to enable dma-buf CMA heap. This heap is backed
 	  by the Contiguous Memory Allocator (CMA). If your system has these
 	  regions, you should say Y here.
+
+config QCOM_DMABUF_HEAPS
+	tristate "QCOM DMA-BUF Heaps"
+	depends on DMABUF_HEAPS
+	help
+	  Choose this option to build the dma-buf heap module. Other
+	  heaps can subsequently be compiled into this module by enabling
+	  the appropriate defconfig option.
+	  If in doubt, say M here.
+
+config QCOM_DMABUF_HEAPS_SYSTEM
+	bool "QCOM DMA-BUF System Heap"
+	depends on QCOM_DMABUF_HEAPS
+	help
+	  Choose this option to build the QCOM DMA-BUF system
+	  heap. This heap combines the built-in system heap
+	  along with other optimizatons. If in doubt, say Y
+	  here.
+
+config QCOM_DMABUF_HEAPS_PAGE_POOL_REFILL
+	bool "QCOM DMA-BUF Page Pool Refill"
+	depends on QCOM_DMABUF_HEAPS_SYSTEM
+	help
+	  Choose this option to enable the page pool auto refill
+	  feature for the system heap's page pools. When enabled,
+	  a thread is created which wakes up to refill the page pools
+	  when they fall below a particular threshold, which in turn
+	  results in smaller allocation latencies. If in doubt, say Y
+	  here.
+
+config QCOM_DMABUF_HEAPS_SYSTEM_SECURE
+	bool "QCOM DMA-BUF System Secure Heap"
+	depends on QCOM_DMABUF_HEAPS
+	depends on QCOM_DMABUF_HEAPS_SYSTEM
+	help
+	  Choose this option to build the QCOM DMA-BUF system
+	  secure heap. This heap, which combines the built-in
+	  system heap along with other optimizations, assigns
+	  memory that is secure by default. If in doubt, say Y
+	  here.
+
+config QCOM_DMABUF_HEAPS_SYSTEM_UNCACHED
+	bool "QCOM DMA-BUF Uncached System Heap"
+	depends on QCOM_DMABUF_HEAPS && QCOM_DMABUF_HEAPS_SYSTEM
+	help
+	  Choose this option to create an uncached QCOM DMA-BUF
+	  system heap. This heap is equivalent to our system heap,
+	  such that the memory is mapped as uncached. If in doubt,
+	  say Y here.
+
+config QCOM_DMABUF_HEAPS_CMA
+	bool "QCOM DMA-BUF CMA Heap"
+	depends on QCOM_DMABUF_HEAPS && DMA_CMA
+	help
+	  Choose this option to build the QCOM DMA-BUF CMA heap.
+	  If in doubt, say Y here.
+
+config QCOM_DMABUF_HEAPS_CARVEOUT
+	bool "QCOM dma-buf Carveout Heap"
+	depends on QCOM_DMABUF_HEAPS
+	depends on ARCH_SPARSEMEM_ENABLE
+	help
+	  Choose this option to build the QCOM DMA-BUF Carveout heap.
+	  If in doubt, say Y here.
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/Makefile
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/Makefile
@@ -1,3 +1,13 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_DMABUF_HEAPS_SYSTEM)	+= system_heap.o
 obj-$(CONFIG_DMABUF_HEAPS_CMA)		+= cma_heap.o
+obj-$(CONFIG_QCOM_DMABUF_HEAPS)		+= qcom_dma_heaps.o
+qcom_dma_heaps-y			:= qcom_dma_heap.o qcom_dt_parser.o qcom_sg_ops.o
+qcom_dma_heaps-$(CONFIG_QCOM_DMABUF_HEAPS_SYSTEM) += qcom_system_heap.o \
+						     qcom_dynamic_page_pool.o
+qcom_dma_heaps-$(CONFIG_QCOM_DMABUF_HEAPS_SYSTEM_SECURE) += qcom_secure_system_heap.o \
+							    qcom_dynamic_page_pool.o \
+							    qcom_dma_heap_secure_utils.o
+qcom_dma_heaps-$(CONFIG_QCOM_DMABUF_HEAPS_CMA)	+= qcom_cma_heap.o
+qcom_dma_heaps-$(CONFIG_QCOM_DMABUF_HEAPS_CARVEOUT) += qcom_carveout_heap.o \
+						       qcom_dma_heap_secure_utils.o
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/cma_heap.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/cma_heap.c
@@ -165,7 +165,7 @@
 	struct vm_area_struct *vma = vmf->vma;
 	struct cma_heap_buffer *buffer = vma->vm_private_data;
 
-	if (vmf->pgoff > buffer->pagecount)
+	if (vmf->pgoff >= buffer->pagecount)
 		return VM_FAULT_SIGBUS;
 
 	return vmf_insert_pfn(vma, vmf->address, page_to_pfn(buffer->pages[vmf->pgoff]));
@@ -274,8 +274,8 @@
 
 static struct dma_buf *cma_heap_allocate(struct dma_heap *heap,
 					 unsigned long len,
-					 unsigned long fd_flags,
-					 unsigned long heap_flags)
+					 u32 fd_flags,
+					 u64 heap_flags)
 {
 	struct cma_heap *cma_heap = dma_heap_get_drvdata(heap);
 	struct cma_heap_buffer *buffer;
@@ -366,7 +366,14 @@
 	.allocate = cma_heap_allocate,
 };
 
-static int __add_cma_heap(struct cma *cma, void *data)
+/**
+ * cma_heap_add - adds a CMA heap to dmabuf heaps
+ * @cma:       pointer to the CMA pool to register the heap for
+ * @data:      unused
+ *
+ * Returns 0 on success. Else, returns errno.
+ */
+int cma_heap_add(struct cma *cma, void *data)
 {
 	struct cma_heap *cma_heap;
 	struct dma_heap_export_info exp_info;
@@ -390,6 +397,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(cma_heap_add);
 
 static int add_default_cma_heap(void)
 {
@@ -397,7 +405,7 @@
 	int ret = 0;
 
 	if (default_cma)
-		ret = __add_cma_heap(default_cma, NULL);
+		ret = cma_heap_add(default_cma, NULL);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_carveout_heap.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_carveout_heap.c
@@ -0,0 +1,423 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * DMA-BUF heap carveout heap allocator. Copied from
+ * drivers/staging/android/ion/heaps/ion_carveout_heap.c as of commit
+ * aeb022cc01ecc ("dma-heap: qcom: Change symbol names to let module be built
+ * in")
+ *
+ * Copyright (C) 2011 Google, Inc.
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/genalloc.h>
+#include <linux/io.h>
+#include <linux/mm.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <soc/qcom/secure_buffer.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/list.h>
+#include <linux/dma-buf.h>
+#include <linux/dma-heap.h>
+#include <linux/qcom_dma_heap.h>
+
+#include "qcom_dma_heap_secure_utils.h"
+#include "qcom_sg_ops.h"
+#include "qcom_carveout_heap.h"
+
+#define CARVEOUT_ALLOCATE_FAIL -1
+
+
+/*
+ * @pool_refcount_priv -
+ *	Cookie set by carveout_heap_add_memory for use with its callbacks.
+ *	Cookie provider will call carveout_heap_remove_memory if refcount
+ *	reaches zero.
+ * @pool_refcount_get -
+ *	Function callback to Increase refcount. Returns 0
+ *	on success and fails if refcount is already zero.
+ * @pool_refcount_put - Function callback to decrease refcount.
+ */
+struct carveout_heap {
+	struct dma_heap *heap;
+	struct rw_semaphore mem_sem;
+	struct gen_pool *pool;
+	struct device *dev;
+	bool is_secure;
+	phys_addr_t base;
+};
+
+struct secure_carveout_heap {
+	u32 token;
+	struct carveout_heap carveout_heap;
+};
+
+static void sc_heap_free(struct qcom_sg_buffer *buffer);
+
+void __maybe_unused pages_sync_for_device(struct device *dev, struct page *page,
+			       size_t size, enum dma_data_direction dir)
+{
+	struct scatterlist sg;
+
+	sg_init_table(&sg, 1);
+	sg_set_page(&sg, page, size, 0);
+	/*
+	 * This is not correct - sg_dma_address needs a dma_addr_t that is valid
+	 * for the targeted device, but this works on the currently targeted
+	 * hardware.
+	 */
+	sg_dma_address(&sg) = page_to_phys(page);
+	dma_sync_sg_for_device(dev, &sg, 1, dir);
+}
+
+static phys_addr_t carveout_allocate(struct carveout_heap *carveout_heap,
+				     unsigned long size)
+{
+	unsigned long offset = CARVEOUT_ALLOCATE_FAIL;
+
+	down_read(&carveout_heap->mem_sem);
+	if (carveout_heap->pool) {
+		offset = gen_pool_alloc(carveout_heap->pool, size);
+		if (!offset) {
+			offset = CARVEOUT_ALLOCATE_FAIL;
+			goto unlock;
+		}
+	}
+
+unlock:
+	up_read(&carveout_heap->mem_sem);
+	return offset;
+}
+
+static void carveout_free(struct carveout_heap *carveout_heap,
+			  phys_addr_t addr, unsigned long size)
+{
+	if (addr == CARVEOUT_ALLOCATE_FAIL)
+		return;
+
+	down_read(&carveout_heap->mem_sem);
+	if (carveout_heap->pool)
+		gen_pool_free(carveout_heap->pool, addr, size);
+	up_read(&carveout_heap->mem_sem);
+}
+
+struct mem_buf_vmperm *
+carveout_setup_vmperm(struct carveout_heap *carveout_heap,
+			struct sg_table *sgt)
+{
+	struct secure_carveout_heap *sc_heap;
+	struct mem_buf_vmperm *vmperm;
+	int *vmids, *perms;
+	u32 nr;
+	int ret;
+
+	if (!carveout_heap->is_secure) {
+		vmperm = mem_buf_vmperm_alloc(sgt);
+		return vmperm;
+	}
+
+	sc_heap = container_of(carveout_heap,
+			struct secure_carveout_heap, carveout_heap);
+
+	ret = get_vmperm_from_ion_flags(sc_heap->token,
+			&vmids, &perms, &nr);
+	if (ret)
+		return ERR_PTR(ret);
+
+	vmperm = mem_buf_vmperm_alloc_staticvm(sgt, vmids, perms, nr);
+	kfree(vmids);
+	kfree(perms);
+
+	return vmperm;
+}
+
+static struct dma_buf *__carveout_heap_allocate(struct carveout_heap *carveout_heap,
+						unsigned long len,
+						u32 fd_flags,
+						u64 heap_flags,
+						void (*buffer_free)(struct qcom_sg_buffer *))
+{
+	struct sg_table *table;
+	struct qcom_sg_buffer *buffer;
+	phys_addr_t paddr;
+	int ret;
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	struct dma_buf *dmabuf;
+
+	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
+	if (!buffer)
+		return ERR_PTR(-ENOMEM);
+
+	/* Initialize the buffer */
+	INIT_LIST_HEAD(&buffer->attachments);
+	mutex_init(&buffer->lock);
+	buffer->heap = carveout_heap->heap;
+	buffer->len = len;
+	buffer->free = buffer_free;
+	buffer->uncached = true;
+
+	table = &buffer->sg_table;
+	ret = sg_alloc_table(table, 1, GFP_KERNEL);
+	if (ret)
+		goto err_free;
+
+	paddr = carveout_allocate(carveout_heap, len);
+	if (paddr == CARVEOUT_ALLOCATE_FAIL) {
+		ret = -ENOMEM;
+		goto err_free_table;
+	}
+
+	sg_set_page(table->sgl, pfn_to_page(PFN_DOWN(paddr)), len, 0);
+
+	buffer->vmperm = carveout_setup_vmperm(carveout_heap, &buffer->sg_table);
+	if (IS_ERR(buffer->vmperm))
+		goto err_free_carveout;
+
+
+	/* Instantiate our dma_buf */
+	exp_info.exp_name = dma_heap_get_name(carveout_heap->heap);
+	exp_info.size = buffer->len;
+	exp_info.flags = fd_flags;
+	exp_info.priv = buffer;
+	dmabuf = qcom_dma_buf_export(&exp_info, &qcom_sg_buf_ops);
+	if (IS_ERR(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
+		goto err_free_vmperm;
+	}
+
+	return dmabuf;
+
+err_free_vmperm:
+	mem_buf_vmperm_release(buffer->vmperm);
+err_free_carveout:
+	carveout_free(carveout_heap, paddr, len);
+err_free_table:
+	sg_free_table(table);
+err_free:
+	kfree(buffer);
+	return ERR_PTR(ret);
+}
+
+static int carveout_pages_zero(struct page *page, size_t size);
+
+static void carveout_heap_free(struct qcom_sg_buffer *buffer)
+{
+	struct carveout_heap *carveout_heap;
+	struct sg_table *table = &buffer->sg_table;
+	struct page *page = sg_page(table->sgl);
+	phys_addr_t paddr = page_to_phys(page);
+	struct device *dev;
+
+	carveout_heap = dma_heap_get_drvdata(buffer->heap);
+
+	dev = carveout_heap->dev;
+
+	carveout_pages_zero(page, buffer->len);
+	carveout_free(carveout_heap, paddr, buffer->len);
+	sg_free_table(table);
+	kfree(buffer);
+}
+
+
+static struct dma_buf *carveout_heap_allocate(struct dma_heap *heap,
+					      unsigned long len,
+					      u32 fd_flags,
+					      u64 heap_flags)
+{
+	struct carveout_heap *carveout_heap = dma_heap_get_drvdata(heap);
+
+	return __carveout_heap_allocate(carveout_heap, len, fd_flags,
+					heap_flags, carveout_heap_free);
+}
+
+static int carveout_pages_zero(struct page *page, size_t size)
+{
+	void __iomem *addr;
+
+	addr = ioremap_wc(page_to_phys(page), size);
+	if (!addr)
+		return -ENOMEM;
+	memset(addr, 0, size);
+	iounmap(addr);
+
+	return 0;
+}
+
+static int carveout_init_heap_memory(struct carveout_heap *co_heap,
+				     phys_addr_t base, ssize_t size)
+{
+	struct page *page = pfn_to_page(PFN_DOWN(base));
+	int ret = 0;
+
+	ret = carveout_pages_zero(page, size);
+	if (ret)
+		return ret;
+
+	co_heap->pool = gen_pool_create(PAGE_SHIFT, -1);
+	if (!co_heap->pool)
+		return -ENOMEM;
+
+	co_heap->base = base;
+	gen_pool_add(co_heap->pool, co_heap->base, size, -1);
+
+	return 0;
+}
+
+static int __carveout_heap_init(struct platform_heap *heap_data,
+				struct carveout_heap *carveout_heap)
+{
+	struct device *dev = heap_data->dev;
+	int ret = 0;
+
+	carveout_heap->dev = dev;
+	ret = carveout_init_heap_memory(carveout_heap,
+					heap_data->base,
+					heap_data->size);
+
+	init_rwsem(&carveout_heap->mem_sem);
+
+	return ret;
+}
+
+static const struct dma_heap_ops carveout_heap_ops = {
+	.allocate = carveout_heap_allocate,
+};
+
+static void carveout_heap_destroy(struct carveout_heap *heap);
+
+int qcom_carveout_heap_create(struct platform_heap *heap_data)
+{
+	struct dma_heap_export_info exp_info;
+	struct carveout_heap *carveout_heap;
+	int ret;
+
+	if (!heap_data->is_nomap) {
+		pr_err("carveout heap memory regions need to be created with no-map\n");
+		return -EINVAL;
+	}
+
+	carveout_heap = kzalloc(sizeof(*carveout_heap), GFP_KERNEL);
+	if (!carveout_heap)
+		return -ENOMEM;
+
+	ret = __carveout_heap_init(heap_data, carveout_heap);
+	if (ret)
+		goto err;
+
+	carveout_heap->is_secure = false;
+
+	exp_info.name = heap_data->name;
+	exp_info.ops = &carveout_heap_ops;
+	exp_info.priv = carveout_heap;
+
+	carveout_heap->heap = dma_heap_add(&exp_info);
+	if (IS_ERR(carveout_heap->heap)) {
+		ret = PTR_ERR(carveout_heap->heap);
+		goto destroy_heap;
+	}
+
+	return 0;
+
+destroy_heap:
+	carveout_heap_destroy(carveout_heap);
+err:
+	kfree(carveout_heap);
+
+	return ret;
+}
+
+static void carveout_heap_destroy(struct carveout_heap *carveout_heap)
+{
+	down_write(&carveout_heap->mem_sem);
+	if (carveout_heap->pool)
+		gen_pool_destroy(carveout_heap->pool);
+	up_write(&carveout_heap->mem_sem);
+	carveout_heap = NULL;
+}
+
+static struct dma_buf *sc_heap_allocate(struct dma_heap *heap,
+					unsigned long len,
+					u32 fd_flags,
+					u64 heap_flags)
+{
+	struct secure_carveout_heap *sc_heap;
+
+	sc_heap = dma_heap_get_drvdata(heap);
+	return  __carveout_heap_allocate(&sc_heap->carveout_heap, len,
+					 fd_flags, heap_flags, sc_heap_free);
+}
+
+static void sc_heap_free(struct qcom_sg_buffer *buffer)
+{
+	struct secure_carveout_heap *sc_heap;
+	struct sg_table *table = &buffer->sg_table;
+	struct page *page = sg_page(table->sgl);
+	phys_addr_t paddr = PFN_PHYS(page_to_pfn(page));
+
+	sc_heap = dma_heap_get_drvdata(buffer->heap);
+
+	if (qcom_is_buffer_hlos_accessible(sc_heap->token))
+		carveout_pages_zero(page, buffer->len);
+	carveout_free(&sc_heap->carveout_heap, paddr, buffer->len);
+	sg_free_table(table);
+	kfree(buffer);
+}
+
+static struct dma_heap_ops sc_heap_ops = {
+	.allocate = sc_heap_allocate,
+};
+
+int qcom_secure_carveout_heap_create(struct platform_heap *heap_data)
+{
+	struct dma_heap_export_info exp_info;
+	struct secure_carveout_heap *sc_heap;
+	int ret;
+
+	if (!heap_data->is_nomap) {
+		pr_err("secure carveout heap memory regions need to be created with no-map\n");
+		return -EINVAL;
+	}
+
+	sc_heap = kzalloc(sizeof(*sc_heap), GFP_KERNEL);
+	if (!sc_heap)
+		return -ENOMEM;
+
+	ret = __carveout_heap_init(heap_data, &sc_heap->carveout_heap);
+	if (ret)
+		goto err;
+
+	ret = hyp_assign_from_flags(heap_data->base, heap_data->size,
+				    heap_data->token);
+	if (ret) {
+		pr_err("secure_carveout_heap: Assign token 0x%x failed\n",
+		       heap_data->token);
+		goto destroy_heap;
+	}
+
+	sc_heap->token = heap_data->token;
+	sc_heap->carveout_heap.is_secure = true;
+
+	exp_info.name = heap_data->name;
+	exp_info.ops = &sc_heap_ops;
+	exp_info.priv = sc_heap;
+
+	sc_heap->carveout_heap.heap = dma_heap_add(&exp_info);
+	if (IS_ERR(sc_heap->carveout_heap.heap)) {
+		ret = PTR_ERR(sc_heap->carveout_heap.heap);
+		goto destroy_heap;
+	}
+
+	return 0;
+
+destroy_heap:
+	carveout_heap_destroy(&sc_heap->carveout_heap);
+err:
+	kfree(sc_heap);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_carveout_heap.h
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_carveout_heap.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QCOM_CARVEOUT_HEAP_H
+#define _QCOM_CARVEOUT_HEAP_H
+
+#include "qcom_dt_parser.h"
+
+#ifdef CONFIG_QCOM_DMABUF_HEAPS_CARVEOUT
+int qcom_secure_carveout_heap_create(struct platform_heap *heap_data);
+int qcom_carveout_heap_create(struct platform_heap *heap_data);
+#else
+static inline int qcom_secure_carveout_heap_create(struct platform_heap *heap_data)
+{
+	return -EINVAL;
+}
+static inline int qcom_carveout_heap_create(struct platform_heap *heap_data)
+{
+	return -EINVAL;
+}
+#endif
+
+#endif /* _QCOM_CARVEOUT_HEAP_H */
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_cma_heap.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_cma_heap.c
@@ -0,0 +1,199 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * DMABUF CMA heap exporter
+ * Copied from drivers/dma-buf/heaps/cma_heap.c as of commit b61614ec318a
+ * ("dma-buf: heaps: Add CMA heap to dmabuf heaps")
+ *
+ * Copyright (C) 2012, 2019 Linaro Ltd.
+ * Author: <benjamin.gaignard@linaro.org> for ST-Ericsson.
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/cma.h>
+#include <linux/device.h>
+#include <linux/dma-buf.h>
+#include <linux/dma-heap.h>
+#include <linux/dma-map-ops.h>
+#include <linux/err.h>
+#include <linux/errno.h>
+#include <linux/highmem.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/scatterlist.h>
+#include <linux/sched/signal.h>
+#include <linux/list.h>
+
+#include "qcom_cma_heap.h"
+#include "qcom_sg_ops.h"
+
+struct cma_heap {
+	struct cma *cma;
+	/* max_align is in units of page_order, similar to CONFIG_CMA_ALIGNMENT */
+	u32 max_align;
+	bool uncached;
+};
+
+static void cma_heap_free(struct qcom_sg_buffer *buffer)
+{
+	struct cma_heap *cma_heap;
+	unsigned long nr_pages = buffer->len >> PAGE_SHIFT;
+	struct page *cma_pages = sg_page(buffer->sg_table.sgl);
+
+	cma_heap = dma_heap_get_drvdata(buffer->heap);
+
+	/* free page list */
+	sg_free_table(&buffer->sg_table);
+	/* release memory */
+	cma_release(cma_heap->cma, cma_pages, nr_pages);
+	kfree(buffer);
+}
+
+/* dmabuf heap CMA operations functions */
+struct dma_buf *cma_heap_allocate(struct dma_heap *heap,
+				  unsigned long len,
+				  u32 fd_flags,
+				  u64 heap_flags)
+{
+	struct cma_heap *cma_heap;
+	struct qcom_sg_buffer *helper_buffer;
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	struct page *cma_pages;
+	size_t size = PAGE_ALIGN(len);
+	unsigned long nr_pages = size >> PAGE_SHIFT;
+	unsigned long align = get_order(size);
+	struct dma_buf *dmabuf;
+	int ret = -ENOMEM;
+
+	cma_heap = dma_heap_get_drvdata(heap);
+
+	if (align > cma_heap->max_align)
+		align = cma_heap->max_align;
+
+	helper_buffer = kzalloc(sizeof(*helper_buffer), GFP_KERNEL);
+	if (!helper_buffer)
+		return ERR_PTR(-ENOMEM);
+
+	helper_buffer->heap = heap;
+	INIT_LIST_HEAD(&helper_buffer->attachments);
+	mutex_init(&helper_buffer->lock);
+	helper_buffer->len = size;
+	helper_buffer->uncached = cma_heap->uncached;
+	helper_buffer->free = cma_heap_free;
+
+	cma_pages = cma_alloc(cma_heap->cma, nr_pages, align, false);
+	if (!cma_pages)
+		goto free_buf;
+
+	if (PageHighMem(cma_pages)) {
+		unsigned long nr_clear_pages = nr_pages;
+		struct page *page = cma_pages;
+
+		while (nr_clear_pages > 0) {
+			void *vaddr = kmap_local_page(page);
+
+			memset(vaddr, 0, PAGE_SIZE);
+			kunmap_local(vaddr);
+			/*
+			 * Avoid wasting time zeroing memory if the process
+			 * has been killed by SIGKILL
+			 */
+			if (fatal_signal_pending(current))
+				goto free_cma;
+
+			page++;
+			nr_clear_pages--;
+		}
+	} else {
+		memset(page_address(cma_pages), 0, size);
+	}
+
+	ret = sg_alloc_table(&helper_buffer->sg_table, 1, GFP_KERNEL);
+	if (ret)
+		goto free_cma;
+
+	sg_set_page(helper_buffer->sg_table.sgl, cma_pages, size, 0);
+
+	helper_buffer->vmperm = mem_buf_vmperm_alloc(&helper_buffer->sg_table);
+	if (IS_ERR(helper_buffer->vmperm))
+		goto free_sgtable;
+
+	if (helper_buffer->uncached) {
+		dma_map_sgtable(dma_heap_get_dev(heap), &helper_buffer->sg_table,
+				DMA_BIDIRECTIONAL, 0);
+		dma_unmap_sgtable(dma_heap_get_dev(heap), &helper_buffer->sg_table,
+				  DMA_BIDIRECTIONAL, 0);
+	}
+
+	/* create the dmabuf */
+	exp_info.exp_name = dma_heap_get_name(heap);
+	exp_info.size = helper_buffer->len;
+	exp_info.flags = fd_flags;
+	exp_info.priv = helper_buffer;
+	dmabuf = qcom_dma_buf_export(&exp_info, &qcom_sg_buf_ops);
+	if (IS_ERR(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
+		goto vmperm_release;
+	}
+
+	return dmabuf;
+
+vmperm_release:
+	mem_buf_vmperm_release(helper_buffer->vmperm);
+free_sgtable:
+	sg_free_table(&helper_buffer->sg_table);
+free_cma:
+	cma_release(cma_heap->cma, cma_pages, nr_pages);
+free_buf:
+	kfree(helper_buffer);
+	return ERR_PTR(ret);
+}
+
+static const struct dma_heap_ops cma_heap_ops = {
+	.allocate = cma_heap_allocate,
+};
+
+static int __add_cma_heap(struct platform_heap *heap_data, void *data)
+{
+	struct cma_heap *cma_heap;
+	struct dma_heap_export_info exp_info;
+	struct dma_heap *heap;
+
+	if (!heap_data->dev->cma_area) {
+		pr_err("%s: CMA area for device uninitialized!\n", __func__);
+		return -EINVAL;
+	}
+
+	cma_heap = kzalloc(sizeof(*cma_heap), GFP_KERNEL);
+	if (!cma_heap)
+		return -ENOMEM;
+
+	cma_heap->cma = heap_data->dev->cma_area;
+	cma_heap->max_align = CONFIG_CMA_ALIGNMENT;
+	if (heap_data->max_align)
+		cma_heap->max_align = heap_data->max_align;
+	cma_heap->uncached = heap_data->is_uncached;
+
+	exp_info.name = heap_data->name;
+	exp_info.ops = &cma_heap_ops;
+	exp_info.priv = cma_heap;
+
+	heap = dma_heap_add(&exp_info);
+	if (IS_ERR(heap)) {
+		int ret = PTR_ERR(heap);
+
+		kfree(cma_heap);
+		return ret;
+	}
+
+	if (cma_heap->uncached)
+		dma_coerce_mask_and_coherent(dma_heap_get_dev(heap),
+					     DMA_BIT_MASK(64));
+
+	return 0;
+}
+
+int qcom_add_cma_heap(struct platform_heap *heap_data)
+{
+	return __add_cma_heap(heap_data, NULL);
+}
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_cma_heap.h
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_cma_heap.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QCOM_CMA_HEAP_H
+#define _QCOM_CMA_HEAP_H
+
+#include "qcom_dt_parser.h"
+
+#ifdef CONFIG_QCOM_DMABUF_HEAPS_CMA
+int qcom_add_cma_heap(struct platform_heap *heap_data);
+#else
+static int qcom_add_cma_heap(struct platform_heap *heap_data)
+{
+	return 1;
+}
+#endif
+
+#endif /* _QCOM_CMA_HEAP_H */
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_dma_heap.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_dma_heap.c
@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/err.h>
+
+#include <linux/qcom_dma_heap.h>
+#include "qcom_cma_heap.h"
+#include "qcom_dt_parser.h"
+#include "qcom_system_heap.h"
+#include "qcom_carveout_heap.h"
+#include "qcom_secure_system_heap.h"
+#include "qcom_dma_heap_priv.h"
+
+/*
+ * We cache the file ops used by DMA-BUFs so that a user with a struct file
+ * pointer can determine if that file is for a DMA-BUF. We can't initialize
+ * the pointer here at compile time as ERR_PTR() evaluates to a function.
+ */
+#define FOPS_INIT_VAL ERR_PTR(-EINVAL)
+static const struct file_operations *dma_buf_cached_fops;
+
+static int qcom_dma_heap_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	int i;
+	struct platform_data *heaps;
+
+	qcom_system_heap_create("qcom,system", NULL, false);
+#ifdef CONFIG_QCOM_DMABUF_HEAPS_SYSTEM_UNCACHED
+	qcom_system_heap_create("qcom,system-uncached", NULL, true);
+#endif
+	qcom_secure_system_heap_create("qcom,secure-pixel", NULL,
+				       QCOM_DMA_HEAP_FLAG_CP_PIXEL);
+	qcom_secure_system_heap_create("qcom,secure-non-pixel", NULL,
+				       QCOM_DMA_HEAP_FLAG_CP_NON_PIXEL);
+	heaps = parse_heap_dt(pdev);
+	if (IS_ERR_OR_NULL(heaps))
+		return PTR_ERR(heaps);
+
+	for (i = 0; i < heaps->nr; i++) {
+		struct platform_heap *heap_data = &heaps->heaps[i];
+
+		switch (heap_data->type) {
+#ifdef CONFIG_QCOM_DMABUF_HEAPS_CARVEOUT
+		case HEAP_TYPE_CARVEOUT:
+			ret = qcom_carveout_heap_create(heap_data);
+			break;
+#endif
+		case HEAP_TYPE_CMA:
+			ret = qcom_add_cma_heap(heap_data);
+			break;
+		default:
+			pr_err("%s: Unknown heap type %u\n", __func__, heap_data->type);
+			break;
+		}
+
+		if (ret)
+			pr_err("%s: DMA-BUF Heap: Failed to create %s, error is %d\n",
+			       __func__, heap_data->name, ret);
+		else
+			pr_info("%s: DMA-BUF Heap: Created %s\n", __func__,
+				heap_data->name);
+	}
+
+	free_pdata(heaps);
+
+	dma_buf_cached_fops = FOPS_INIT_VAL;
+
+	return ret;
+}
+
+void qcom_store_dma_buf_fops(struct file *file)
+{
+	if (dma_buf_cached_fops == FOPS_INIT_VAL)
+		dma_buf_cached_fops = file->f_op;
+}
+EXPORT_SYMBOL_GPL(qcom_store_dma_buf_fops);
+
+bool qcom_is_dma_buf_file(struct file *file)
+{
+	return file->f_op == dma_buf_cached_fops;
+}
+EXPORT_SYMBOL_GPL(qcom_is_dma_buf_file);
+
+static const struct of_device_id qcom_dma_heap_match_table[] = {
+	{.compatible = "qcom,dma-heaps"},
+	{},
+};
+
+static struct platform_driver qcom_dma_heap_driver = {
+	.probe = qcom_dma_heap_probe,
+	.driver = {
+		.name = "qcom-dma-heap",
+		.of_match_table = qcom_dma_heap_match_table,
+	},
+};
+
+static int __init init_heap_driver(void)
+{
+	return platform_driver_register(&qcom_dma_heap_driver);
+}
+module_init(init_heap_driver);
+
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_dma_heap_priv.h
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_dma_heap_priv.h
@@ -0,0 +1,63 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2011 Google, Inc.
+ * Copyright (C) 2019 Linaro Ltd.
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QCOM_DMA_HEAP_PRIV_H
+#define _QCOM_DMA_HEAP_PRIV_H
+
+#include <linux/dma-heap.h>
+#include <linux/list.h>
+#include <linux/fs.h>
+
+#include <linux/mem-buf-exporter.h>
+
+void qcom_store_dma_buf_fops(struct file *file);
+
+static inline struct dma_buf *qcom_dma_buf_export(struct dma_buf_export_info *exp_info,
+						  struct mem_buf_dma_buf_ops *ops)
+{
+	struct dma_buf *dmabuf;
+
+	dmabuf = mem_buf_dma_buf_export(exp_info, ops);
+	if (!IS_ERR(dmabuf))
+		qcom_store_dma_buf_fops(dmabuf->file);
+
+	return dmabuf;
+}
+
+/**
+ * struct heap_helper_buffer - helper buffer metadata
+ * @heap:		back pointer to the heap the buffer came from
+ * @dmabuf:		backing dma-buf for this buffer
+ * @size:		size of the buffer
+ * @priv_virt		pointer to heap specific private value
+ * @lock		mutext to protect the data in this structure
+ * @vmap_cnt		count of vmap references on the buffer
+ * @vaddr		vmap'ed virtual address
+ * @pagecount		number of pages in the buffer
+ * @pages		list of page pointers
+ * @attachments		list of device attachments
+ *
+ * @free		heap callback to free the buffer
+ */
+struct heap_helper_buffer {
+	struct dma_heap *heap;
+	struct dma_buf *dmabuf;
+	size_t size;
+
+	void *priv_virt;
+	struct mutex lock;
+	int vmap_cnt;
+	void *vaddr;
+	pgoff_t pagecount;
+	struct page **pages;
+	struct list_head attachments;
+
+	void (*free)(struct heap_helper_buffer *buffer);
+};
+
+#endif /* _QCOM_DMA_HEAP_PRIV_H */
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_dma_heap_secure_utils.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_dma_heap_secure_utils.c
@@ -0,0 +1,287 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <soc/qcom/secure_buffer.h>
+#include <linux/qcom_dma_heap.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+
+int get_secure_vmid(unsigned long flags)
+{
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_TZ)
+		return VMID_TZ;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_TOUCH)
+		return VMID_CP_TOUCH;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_BITSTREAM)
+		return VMID_CP_BITSTREAM;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_PIXEL)
+		return VMID_CP_PIXEL;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_NON_PIXEL)
+		return VMID_CP_NON_PIXEL;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_CAMERA)
+		return VMID_CP_CAMERA;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_SEC_DISPLAY)
+		return VMID_CP_SEC_DISPLAY;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_APP)
+		return VMID_CP_APP;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_CAMERA_PREVIEW)
+		return VMID_CP_CAMERA_PREVIEW;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_SPSS_SP)
+		return VMID_CP_SPSS_SP;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_SPSS_SP_SHARED)
+		return VMID_CP_SPSS_SP_SHARED;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_SPSS_HLOS_SHARED)
+		return VMID_CP_SPSS_HLOS_SHARED;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_CDSP)
+		return VMID_CP_CDSP;
+	if (flags & QCOM_DMA_HEAP_FLAG_CP_MSS_MSA)
+		return VMID_MSS_MSA;
+
+	return -EINVAL;
+}
+
+static unsigned int count_set_bits(unsigned long val)
+{
+	return ((unsigned int)bitmap_weight(&val, BITS_PER_LONG));
+}
+
+bool qcom_is_buffer_hlos_accessible(unsigned long flags)
+{
+	if (!(flags & QCOM_DMA_HEAP_FLAG_CP_HLOS) &&
+	    !(flags & QCOM_DMA_HEAP_FLAG_CP_SPSS_HLOS_SHARED))
+		return false;
+
+	return true;
+}
+
+static int get_vmid(unsigned long flags)
+{
+	int vmid;
+
+	vmid = get_secure_vmid(flags);
+	if (vmid < 0) {
+		if (flags & QCOM_DMA_HEAP_FLAG_CP_HLOS)
+			vmid = VMID_HLOS;
+	}
+	return vmid;
+}
+
+static int populate_vm_list(unsigned long flags, unsigned int *vm_list,
+			 int nelems)
+{
+	unsigned int itr = 0;
+	int vmid;
+
+	flags = flags & QCOM_DMA_HEAP_FLAGS_CP_MASK;
+	if (!flags)
+		return -EINVAL;
+
+	for_each_set_bit(itr, &flags, BITS_PER_LONG) {
+		vmid = get_vmid(0x1UL << itr);
+		if (vmid < 0 || !nelems)
+			return -EINVAL;
+
+		vm_list[nelems - 1] = vmid;
+		nelems--;
+	}
+	return 0;
+}
+
+static int hyp_unassign_sg(struct sg_table *sgt, int *source_vm_list,
+		int source_nelems, bool clear_page_private)
+{
+	u32 dest_vmid = VMID_HLOS;
+	u32 dest_perms = PERM_READ | PERM_WRITE | PERM_EXEC;
+	struct scatterlist *sg;
+	int ret, i;
+
+	if (source_nelems <= 0) {
+		pr_err("%s: source_nelems invalid\n",
+				__func__);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	ret = hyp_assign_table(sgt, source_vm_list, source_nelems, &dest_vmid,
+			&dest_perms, 1);
+	if (ret)
+		goto out;
+
+	if (clear_page_private)
+		for_each_sg(sgt->sgl, sg, sgt->nents, i)
+			ClearPagePrivate(sg_page(sg));
+out:
+	return ret;
+}
+
+static int hyp_assign_sg(struct sg_table *sgt, int *dest_vm_list,
+		int dest_nelems, bool set_page_private)
+{
+	u32 source_vmid = VMID_HLOS;
+	struct scatterlist *sg;
+	int *dest_perms;
+	int ret, i;
+
+	if (dest_nelems <= 0) {
+		pr_err("%s: dest_nelems invalid\n",
+				__func__);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	dest_perms = kcalloc(dest_nelems, sizeof(*dest_perms), GFP_KERNEL);
+	if (!dest_perms) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	for (i = 0; i < dest_nelems; i++)
+		dest_perms[i] = msm_secure_get_vmid_perms(dest_vm_list[i]);
+
+	ret = hyp_assign_table(sgt, &source_vmid, 1,
+			dest_vm_list, dest_perms, dest_nelems);
+
+	if (ret) {
+		pr_err("%s: Assign call failed\n",
+				__func__);
+		goto out_free_dest;
+	}
+	if (set_page_private)
+		for_each_sg(sgt->sgl, sg, sgt->nents, i)
+			SetPagePrivate(sg_page(sg));
+
+out_free_dest:
+	kfree(dest_perms);
+out:
+	return ret;
+}
+
+int hyp_unassign_sg_from_flags(struct sg_table *sgt, unsigned long flags,
+			       bool set_page_private)
+{
+	int ret;
+	int *source_vm_list;
+	int source_nelems;
+
+	source_nelems = count_set_bits(flags & QCOM_DMA_HEAP_FLAGS_CP_MASK);
+	source_vm_list = kcalloc(source_nelems, sizeof(*source_vm_list),
+				 GFP_KERNEL);
+	if (!source_vm_list)
+		return -ENOMEM;
+	ret = populate_vm_list(flags, source_vm_list, source_nelems);
+	if (ret) {
+		pr_err("%s: Failed to get secure vmids\n", __func__);
+		goto out_free_source;
+	}
+
+	ret = hyp_unassign_sg(sgt, source_vm_list, source_nelems,
+				  set_page_private);
+
+out_free_source:
+	kfree(source_vm_list);
+	return ret;
+}
+
+int hyp_assign_sg_from_flags(struct sg_table *sgt, unsigned long flags,
+			     bool set_page_private)
+{
+	int ret;
+	int *dest_vm_list = NULL;
+	int dest_nelems;
+
+	dest_nelems = count_set_bits(flags & QCOM_DMA_HEAP_FLAGS_CP_MASK);
+	dest_vm_list = kcalloc(dest_nelems, sizeof(*dest_vm_list), GFP_KERNEL);
+	if (!dest_vm_list) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	ret = populate_vm_list(flags, dest_vm_list, dest_nelems);
+	if (ret) {
+		pr_err("%s: Failed to get secure vmid(s)\n", __func__);
+		goto out_free_dest_vm;
+	}
+
+	ret = hyp_assign_sg(sgt, dest_vm_list, dest_nelems,
+				set_page_private);
+
+out_free_dest_vm:
+	kfree(dest_vm_list);
+out:
+	return ret;
+}
+
+int get_vmperm_from_ion_flags(unsigned long flags, int **_vmids,
+			int **_perms, u32 *_nr)
+{
+	int *vmids, *modes;
+	u32 nr, i;
+
+	if (!_vmids || !_perms || !_nr)
+		return -EINVAL;
+
+	nr = count_set_bits(flags);
+	vmids = kcalloc(nr, sizeof(*vmids), GFP_KERNEL);
+	if (!vmids)
+		return -ENOMEM;
+
+	modes = kcalloc(nr, sizeof(*modes), GFP_KERNEL);
+	if (!modes) {
+		kfree(vmids);
+		return -ENOMEM;
+	}
+
+	if ((flags & ~QCOM_DMA_HEAP_FLAGS_CP_MASK) ||
+	    populate_vm_list(flags, vmids, nr)) {
+		pr_err("%s: Failed to parse secure flags 0x%lx\n", __func__,
+		       flags);
+		kfree(modes);
+		kfree(vmids);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < nr; i++)
+		modes[i] = msm_secure_get_vmid_perms(vmids[i]);
+
+	*_vmids = vmids;
+	*_perms = modes;
+	*_nr = nr;
+	return 0;
+}
+
+int hyp_assign_from_flags(u64 base, u64 size, unsigned long flags)
+{
+	int *vmids, *modes;
+	u32 nr;
+	u64 src_vm = BIT(QCOM_SCM_VMID_HLOS);
+	struct qcom_scm_vmperm *newvm;
+	int ret;
+	int i;
+
+	ret = get_vmperm_from_ion_flags(flags, &vmids, &modes, &nr);
+	if (ret)
+		return ret;
+
+	newvm = kcalloc(nr, sizeof(struct qcom_scm_vmperm), GFP_KERNEL);
+	if (!newvm) {
+		ret = -ENOMEM;
+		goto kcalloc_fail;
+	}
+	for (i = 0; i < nr; i++) {
+		newvm[i].vmid = vmids[i];
+		newvm[i].perm = modes[i];
+	}
+	ret = qcom_scm_assign_mem(base, size, &src_vm, newvm, nr);
+	if (ret)
+		pr_err("%s: Assign call failed, flags 0x%lx\n", __func__,
+		       flags);
+
+	kfree(newvm);
+kcalloc_fail:
+	kfree(modes);
+	kfree(vmids);
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_dma_heap_secure_utils.h
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_dma_heap_secure_utils.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QCOM_DMA_HEAP_SECURE_UTILS_H
+#define _QCOM_DMA_HEAP_SECURE_UTILS_H
+
+int hyp_assign_sg_from_flags(struct sg_table *sgt, unsigned long flags,
+			     bool set_page_private);
+
+int hyp_unassign_sg_from_flags(struct sg_table *sgt, unsigned long flags,
+			       bool set_page_private);
+
+/*
+ * This function handles conversion from the legacy ion flag based interface
+ * to a precise list of vmids and permissions.
+ */
+int get_vmperm_from_ion_flags(unsigned long flags, int **vmids, int **perms, u32 *nr);
+int hyp_assign_from_flags(u64 base, u64 size, unsigned long flags);
+bool qcom_is_buffer_hlos_accessible(unsigned long flags);
+int get_secure_vmid(unsigned long flags);
+
+#endif /* _QCOM_DMA_HEAP_SECURE_UTILS_H */
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_dt_parser.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_dt_parser.c
@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/of_platform.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/of_reserved_mem.h>
+
+#include <linux/qcom_dma_heap.h>
+#include "qcom_dt_parser.h"
+
+#ifdef CONFIG_PANIC_ON_QCOM_DMA_HEAPS_FAILURE
+#define QCOM_DMA_HEAP_WARN(fmt...) panic(fmt)
+#else /* CONFIG_PANIC_ON_QCOM_DMA_HEAPS_FAILURE */
+#define QCOM_DMA_HEAP_WARN(fmt...) WARN(1, fmt)
+#endif /* CONFIG_PANIC_ON_QCOM_DMA_HEAPS_FAILURE */
+
+static int populate_heap(struct device_node *node,
+			 struct platform_heap *heap)
+{
+	int ret;
+
+	/* Mandatory properties */
+	ret = of_property_read_string(node, "qcom,dma-heap-name", &heap->name);
+	if (ret)
+		goto err;
+
+	ret = of_property_read_u32(node, "qcom,dma-heap-type", &heap->type);
+	if (ret) {
+		pr_err("Reading %s property in node %s failed with err %d.\n",
+		       "qcom,dma-heap-type", of_node_full_name(node), ret);
+		goto err;
+	}
+
+	/* Optional properties */
+	heap->is_uncached = of_property_read_bool(node, "qcom,uncached-heap");
+
+	ret = of_property_read_u32(node, "qcom,token", &heap->token);
+	if (ret && ret != -EINVAL)
+		goto err;
+
+	ret = of_property_read_u32(node, "qcom,max-align", &heap->max_align);
+	if (ret && ret != -EINVAL)
+		goto err;
+
+	return 0;
+
+err:
+	if (ret)
+		QCOM_DMA_HEAP_WARN("%s: Unable to populate heap %s, err: %d\n",
+				   __func__, of_node_full_name(node), ret);
+	return ret;
+}
+
+void free_pdata(const struct platform_data *pdata)
+{
+	kfree(pdata->heaps);
+	kfree(pdata);
+}
+
+static int heap_dt_init(struct device_node *mem_node,
+			struct platform_heap *heap)
+{
+	const __be32 *basep;
+	u64 base, size;
+	struct device *dev = heap->dev;
+	struct reserved_mem *rmem;
+	int ret = 0;
+
+
+	rmem = of_reserved_mem_lookup(mem_node);
+
+	if (!rmem) {
+		dev_err(dev, "Failed to find reserved memory region\n");
+		return -EINVAL;
+	}
+
+	/*
+	 * We only need to call this when the memory-region is managed by
+	 * a reserved memory region driver (e.g. CMA, coherent, etc). In that
+	 * case, they will have ops for device specific initialization for
+	 * the memory region. Otherwise, we have a pure carveout, which needs
+	 * not be initialized.
+	 */
+	if (rmem->ops) {
+		ret = of_reserved_mem_device_init_by_idx(dev, dev->of_node, 0);
+		if (ret) {
+			dev_err(dev,
+				"Failed to initialize memory region rc: %d\n",
+				ret);
+			return ret;
+		}
+	}
+
+	basep = of_get_address(mem_node, 0, &size, NULL);
+	if (basep) {
+		base = of_translate_address(mem_node, basep);
+		if (base != OF_BAD_ADDR) {
+			heap->base = base;
+			heap->size = size;
+		} else {
+			ret = -EINVAL;
+			dev_err(heap->dev,
+				"Failed to get heap base/size\n");
+			of_reserved_mem_device_release(dev);
+		}
+	}
+	heap->is_nomap =  of_property_read_bool(mem_node, "no-map");
+
+	return ret;
+}
+
+static void release_reserved_memory_regions(struct platform_heap *heaps,
+					    int idx)
+{
+	struct device *dev;
+	struct device_node *node, *mem_node;
+
+	for (idx = idx - 1; idx >= 0; idx--) {
+		dev = heaps[idx].dev;
+		node = dev->of_node;
+		mem_node = of_parse_phandle(node, "memory-region", 0);
+
+		if (mem_node)
+			of_reserved_mem_device_release(dev);
+
+		of_node_put(mem_node);
+	}
+}
+
+struct platform_data *parse_heap_dt(struct platform_device *pdev)
+{
+	struct platform_data *pdata = NULL;
+	struct device_node *node;
+	struct device_node *mem_node;
+	struct platform_device *new_dev = NULL;
+	const struct device_node *dt_node = pdev->dev.of_node;
+	int ret;
+	int idx = 0;
+
+	pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
+	if (!pdata)
+		return ERR_PTR(-ENOMEM);
+
+	for_each_available_child_of_node(dt_node, node)
+		pdata->nr++;
+
+	/*
+	 * No heaps defined in the devicetree. However, there may be other
+	 * heaps (e.g. system heaps) that do not need to be defined in the
+	 * devicetree.
+	 */
+	if (!pdata->nr)
+		goto out;
+
+	pdata->heaps = kcalloc(pdata->nr, sizeof(*pdata->heaps), GFP_KERNEL);
+	if (!pdata->heaps) {
+		kfree(pdata);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	for_each_available_child_of_node(dt_node, node) {
+		new_dev = of_platform_device_create(node, NULL, &pdev->dev);
+		if (!new_dev) {
+			pr_err("Failed to create device %s\n", node->name);
+			ret = -EINVAL;
+			goto free_heaps;
+		}
+		of_dma_configure(&new_dev->dev, node, true);
+
+		pdata->heaps[idx].dev = &new_dev->dev;
+
+		ret = populate_heap(node, &pdata->heaps[idx]);
+		if (ret)
+			goto free_heaps;
+
+		mem_node = of_parse_phandle(node, "memory-region", 0);
+		if (mem_node) {
+			ret = heap_dt_init(mem_node, &pdata->heaps[idx]);
+			if (ret)
+				goto free_heaps;
+
+			of_node_put(mem_node);
+		}
+
+		++idx;
+	}
+
+out:
+	return pdata;
+
+free_heaps:
+	of_node_put(node);
+	release_reserved_memory_regions(pdata->heaps, idx);
+	free_pdata(pdata);
+	return ERR_PTR(ret);
+}
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_dt_parser.h
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_dt_parser.h
@@ -0,0 +1,57 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QCOM_DT_PARSER_H
+#define _QCOM_DT_PARSER_H
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+
+/**
+ * struct platform_heap - defines a heap in the given platform
+ * @type:	type of the heap
+ * @name:	used for debug purposes
+ * @base:	base address of heap in physical memory if applicable
+ * @size:	size of the heap in bytes if applicable
+ * @dev:	the device associated with the heap's DT node
+ * @is_dynamic:	indicates if memory can be added or removed from carveout heaps
+ * is_nomap:	indicates if this heap is assosicated with a memory region which is
+ *		which has no-map property.
+ * is_uncached:	indicates if this heap provides uncached memory or not
+ * @token:	the end points to which memory for secure carveout memory is
+ *		assigned to
+ * @max_align:  page order of the maximum alignment. Used by cma heap.
+ *
+ * Provided by the board file.
+ */
+struct platform_heap {
+	u32 type;
+	const char *name;
+	phys_addr_t base;
+	size_t size;
+	struct device *dev;
+	bool is_uncached;
+	bool is_nomap;
+	u32 token;
+	u32 max_align;
+};
+
+/**
+ * struct platform_data - array of platform heaps passed from board file
+ * @nr:    number of structures in the array
+ * @heaps: array of platform_heap structions
+ *
+ * Provided by the board file in the form of platform data to a platform device.
+ */
+struct platform_data {
+	int nr;
+	struct platform_heap *heaps;
+};
+
+struct platform_data *parse_heap_dt(struct platform_device *pdev);
+void free_pdata(const struct platform_data *pdata);
+
+#endif /* _QCOM_DT_PARSER_H */
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_dynamic_page_pool.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_dynamic_page_pool.c
@@ -0,0 +1,336 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Dynamic page pool system
+ *
+ * Taken from:
+ * mm/dynamic_page_pool.c
+ * Git-repo: https://git.linaro.org/people/john.stultz/android-dev.git
+ * Branch: dma-buf-heap-perf
+ * Git-commit: 458ea8030852755867bdc0384aa40f97aba7a572
+ *
+ * Based on the ION page pool code
+ * Copyright (C) 2011 Google, Inc.
+ *
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/swap.h>
+#include <linux/spinlock.h>
+#include <linux/sched/signal.h>
+#include <uapi/linux/sched/types.h>
+
+#include "qcom_dynamic_page_pool.h"
+
+static LIST_HEAD(pool_list);
+static DEFINE_MUTEX(pool_list_lock);
+
+void dynamic_page_pool_add(struct dynamic_page_pool *pool, struct page *page)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&pool->lock, flags);
+	if (PageHighMem(page)) {
+		list_add_tail(&page->lru, &pool->high_items);
+		pool->high_count++;
+	} else {
+		list_add_tail(&page->lru, &pool->low_items);
+		pool->low_count++;
+	}
+
+	atomic_inc(&pool->count);
+	mod_node_page_state(page_pgdat(page), NR_KERNEL_MISC_RECLAIMABLE,
+			    1 << pool->order);
+	spin_unlock_irqrestore(&pool->lock, flags);
+}
+
+struct page *dynamic_page_pool_remove(struct dynamic_page_pool *pool, bool high)
+{
+	struct page *page;
+
+	if (high) {
+		BUG_ON(!pool->high_count);
+		page = list_first_entry(&pool->high_items, struct page, lru);
+		pool->high_count--;
+	} else {
+		BUG_ON(!pool->low_count);
+		page = list_first_entry(&pool->low_items, struct page, lru);
+		pool->low_count--;
+	}
+
+	atomic_dec(&pool->count);
+	list_del(&page->lru);
+	mod_node_page_state(page_pgdat(page), NR_KERNEL_MISC_RECLAIMABLE,
+			    -(1 << pool->order));
+	return page;
+}
+
+void dynamic_page_pool_free(struct dynamic_page_pool *pool, struct page *page)
+{
+	BUG_ON(pool->order != compound_order(page));
+
+	dynamic_page_pool_add(pool, page);
+}
+
+int dynamic_page_pool_total(struct dynamic_page_pool *pool, bool high)
+{
+	int count = pool->low_count;
+
+	if (high)
+		count += pool->high_count;
+
+	return count << pool->order;
+}
+
+struct dynamic_page_pool *dynamic_page_pool_create(gfp_t gfp_mask, unsigned int order)
+{
+	struct dynamic_page_pool *pool = kmalloc(sizeof(*pool), GFP_KERNEL);
+
+	if (!pool)
+		return NULL;
+	pool->high_count = 0;
+	pool->low_count = 0;
+	INIT_LIST_HEAD(&pool->low_items);
+	INIT_LIST_HEAD(&pool->high_items);
+	pool->gfp_mask = gfp_mask | __GFP_COMP;
+	pool->order = order;
+	spin_lock_init(&pool->lock);
+
+	mutex_lock(&pool_list_lock);
+	list_add(&pool->list, &pool_list);
+	mutex_unlock(&pool_list_lock);
+
+	return pool;
+}
+
+void dynamic_page_pool_destroy(struct dynamic_page_pool *pool)
+{
+	struct page *page, *tmp;
+	LIST_HEAD(pages);
+	int num_pages = 0;
+	int ret = DYNAMIC_POOL_SUCCESS;
+	unsigned long flags;
+
+	/* Remove us from the pool list */
+	mutex_lock(&pool_list_lock);
+	list_del(&pool->list);
+	mutex_unlock(&pool_list_lock);
+
+	/* Free any remaining pages in the pool */
+	spin_lock_irqsave(&pool->lock, flags);
+	while (true) {
+		if (pool->low_count)
+			page = dynamic_page_pool_remove(pool, false);
+		else if (pool->high_count)
+			page = dynamic_page_pool_remove(pool, true);
+		else
+			break;
+
+		list_add(&page->lru, &pages);
+		num_pages++;
+	}
+	spin_unlock_irqrestore(&pool->lock, flags);
+
+	if (num_pages && pool->prerelease_callback)
+		ret = pool->prerelease_callback(pool, &pages, num_pages);
+
+	if (ret != DYNAMIC_POOL_SUCCESS) {
+		pr_err("Failed to reclaim pages when destroying the pool!\n");
+		return;
+	}
+
+	list_for_each_entry_safe(page, tmp, &pages, lru) {
+		list_del(&page->lru);
+		__free_pages(page, pool->order);
+	}
+
+	kfree(pool);
+}
+
+static int dynamic_page_pool_do_shrink(struct dynamic_page_pool *pool, gfp_t gfp_mask,
+				       int nr_to_scan)
+{
+	int freed = 0;
+	bool high;
+	struct page *page, *tmp;
+	LIST_HEAD(pages);
+	int ret = DYNAMIC_POOL_SUCCESS;
+
+	if (current_is_kswapd())
+		high = true;
+	else
+		high = !!(gfp_mask & __GFP_HIGHMEM);
+
+	if (nr_to_scan == 0)
+		return dynamic_page_pool_total(pool, high);
+
+	while (freed < nr_to_scan) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&pool->lock, flags);
+		if (pool->low_count) {
+			page = dynamic_page_pool_remove(pool, false);
+		} else if (high && pool->high_count) {
+			page = dynamic_page_pool_remove(pool, true);
+		} else {
+			spin_unlock_irqrestore(&pool->lock, flags);
+			break;
+		}
+		spin_unlock_irqrestore(&pool->lock, flags);
+		list_add(&page->lru, &pages);
+		freed += (1 << pool->order);
+	}
+
+	if (freed && pool->prerelease_callback)
+		ret = pool->prerelease_callback(pool, &pages, freed >> pool->order);
+
+	if (ret != DYNAMIC_POOL_SUCCESS) {
+		pr_err("Failed to reclaim secure page pool pages!\n");
+		return 0;
+	}
+
+	list_for_each_entry_safe(page, tmp, &pages, lru) {
+		list_del(&page->lru);
+		__free_pages(page, pool->order);
+	}
+
+	return freed;
+}
+
+void dynamic_page_pool_shrink_high_and_low(struct dynamic_page_pool **pools_list,
+					   int num_pools, int nr_to_scan)
+{
+	int i, remaining = nr_to_scan;
+
+	mutex_lock(&pool_list_lock);
+	for (i = 0; i < num_pools; i++) {
+		remaining -= dynamic_page_pool_do_shrink(pools_list[i], __GFP_HIGHMEM,
+							 remaining);
+
+		if (remaining <= 0) {
+			mutex_unlock(&pool_list_lock);
+			return;
+		}
+	}
+	mutex_unlock(&pool_list_lock);
+}
+
+static int dynamic_page_pool_shrink(gfp_t gfp_mask, int nr_to_scan)
+{
+	struct dynamic_page_pool *pool;
+	int nr_total = 0;
+	int nr_freed;
+	int only_scan = 0;
+
+	if (!nr_to_scan)
+		only_scan = 1;
+
+	mutex_lock(&pool_list_lock);
+	list_for_each_entry(pool, &pool_list, list) {
+		if (only_scan) {
+			nr_total += dynamic_page_pool_do_shrink(pool,
+								gfp_mask,
+								nr_to_scan);
+		} else {
+			nr_freed = dynamic_page_pool_do_shrink(pool,
+							       gfp_mask,
+							       nr_to_scan);
+			nr_to_scan -= nr_freed;
+			nr_total += nr_freed;
+			if (nr_to_scan <= 0)
+				break;
+		}
+	}
+	mutex_unlock(&pool_list_lock);
+
+	return nr_total;
+}
+
+static unsigned long dynamic_page_pool_shrink_count(struct shrinker *shrinker,
+						    struct shrink_control *sc)
+{
+	return dynamic_page_pool_shrink(sc->gfp_mask, 0);
+}
+
+static unsigned long dynamic_page_pool_shrink_scan(struct shrinker *shrinker,
+						   struct shrink_control *sc)
+{
+	int to_scan = sc->nr_to_scan;
+
+	if (to_scan == 0)
+		return 0;
+
+	return dynamic_page_pool_shrink(sc->gfp_mask, to_scan);
+}
+
+struct dynamic_page_pool **dynamic_page_pool_create_pools(int vmid,
+							  prerelease_callback callback)
+{
+	struct dynamic_page_pool **pool_list;
+	int i;
+	int ret;
+
+	pool_list = kmalloc_array(NUM_ORDERS, sizeof(*pool_list), GFP_KERNEL);
+	if (!pool_list)
+		return ERR_PTR(-ENOMEM);
+
+	for (i = 0; i < NUM_ORDERS; i++) {
+		pool_list[i] = dynamic_page_pool_create(order_flags[i],
+							orders[i]);
+		pool_list[i]->vmid = vmid;
+		pool_list[i]->prerelease_callback = callback;
+		atomic_set(&pool_list[i]->count, 0);
+		pool_list[i]->last_low_watermark_ktime = 0;
+
+		if (IS_ERR_OR_NULL(pool_list[i])) {
+			int j;
+
+			pr_err("%s: page pool creation failed for the order %u pool!\n",
+			       __func__, orders[i]);
+			for (j = 0; j < i; j++)
+				dynamic_page_pool_destroy(pool_list[j]);
+
+			ret = -ENOMEM;
+			goto free_pool_arr;
+		}
+	}
+
+	return pool_list;
+
+free_pool_arr:
+	kfree(pool_list);
+
+	return ERR_PTR(ret);
+}
+
+void dynamic_page_pool_release_pools(struct dynamic_page_pool **pool_list)
+{
+	int i;
+
+	for (i = 0; i < NUM_ORDERS; i++)
+		dynamic_page_pool_destroy(pool_list[i]);
+
+	kfree(pool_list);
+}
+
+int dynamic_page_pool_init_shrinker(void)
+{
+	static bool registered;
+	static struct shrinker *shrinker;
+
+	if (registered)
+		return 0;
+
+	shrinker = shrinker_alloc(0, "dynamic_page_pool");
+	if (!shrinker)
+		return -ENOMEM;
+
+	shrinker->count_objects = dynamic_page_pool_shrink_count;
+	shrinker->scan_objects = dynamic_page_pool_shrink_scan;
+	shrinker_register(shrinker);
+
+	registered = true;
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_dynamic_page_pool.h
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_dynamic_page_pool.h
@@ -0,0 +1,111 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * ION Memory Allocator kernel interface header
+ *
+ * Taken from:
+ * include/linux/dynamic_page_pool.h
+ * Git-repo: https://git.linaro.org/people/john.stultz/android-dev.git
+ * Branch: dma-buf-heap-perf
+ * Git-commit: 458ea8030852755867bdc0384aa40f97aba7a572
+ *
+ * Copyright (C) 2011 Google, Inc.
+ *
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DYN_PAGE_POOL_H
+#define _DYN_PAGE_POOL_H
+
+#include <linux/device.h>
+#include <linux/kref.h>
+#include <linux/mm_types.h>
+#include <linux/mutex.h>
+#include <linux/shrinker.h>
+#include <linux/types.h>
+
+#define HIGH_ORDER_GFP  (((GFP_HIGHUSER | __GFP_ZERO | __GFP_NOWARN \
+				| __GFP_NORETRY) & ~__GFP_RECLAIM) \
+				| __GFP_COMP)
+#define LOW_ORDER_GFP (GFP_HIGHUSER | __GFP_ZERO | __GFP_COMP)
+
+/*
+ * We add __GFP_NOWARN for order 4 allocations since the core mm/ framework
+ * makes no guarantee of these allocations succeeding.
+ */
+static gfp_t order_flags[] = {HIGH_ORDER_GFP, HIGH_ORDER_GFP,
+			      LOW_ORDER_GFP};
+#if defined(CONFIG_IOMMU_IO_PGTABLE_ARMV7S) && !defined(CONFIG_64BIT) && !defined(CONFIG_ARM_LPAE)
+static const unsigned int orders[] = {8, 4, 0};
+#else
+static const unsigned int orders[] = {9, 4, 0};
+#endif
+#define NUM_ORDERS ARRAY_SIZE(orders)
+
+enum dynamic_pool_callback_ret {
+	DYNAMIC_POOL_SUCCESS,
+	DYNAMIC_POOL_FAILURE,
+};
+
+struct dynamic_page_pool;
+
+typedef enum dynamic_pool_callback_ret (*prerelease_callback)(struct dynamic_page_pool *pool,
+							      struct list_head *pages,
+							      int num_pages);
+
+/**
+ * struct dynamic_page_pool - pagepool struct
+ * @high_count:			number of highmem items in the pool
+ * @low_count:			number of lowmem items in the pool
+ * @count:			total number of pages/items in the pool
+ * @high_items:			list of highmem items
+ * @low_items:			list of lowmem items
+ * @last_low_watermark_ktime:	most recent time at which the zone watermarks were
+ *				low
+ * @refill_worker:		kthread used to refill a pool, if applicable
+ * @lock:			lock protecting this struct and especially the count
+ *				item list
+ * @gfp_mask:			gfp_mask to use from alloc
+ * @order:			order of pages in the pool
+ * @list:			list node for list of pools
+ * @vmid:			the vmid used for this pool
+ * @prerelease_callback:	preprocessing function called before pages are
+ *				released to buddy
+ *
+ * Allows you to keep a pool of pre allocated pages to use
+ * Keeping a pool of pages that is ready for dma, ie any cached mapping have
+ * been invalidated from the cache, provides a significant performance benefit
+ * on many systems
+ */
+struct dynamic_page_pool {
+	int high_count;
+	int low_count;
+	atomic_t count;
+	struct list_head high_items;
+	struct list_head low_items;
+	ktime_t last_low_watermark_ktime;
+	struct task_struct *refill_worker;
+	spinlock_t lock;
+	gfp_t gfp_mask;
+	unsigned int order;
+	struct list_head list;
+	int vmid;
+	prerelease_callback prerelease_callback;
+};
+
+struct dynamic_page_pool **dynamic_page_pool_create_pools(int vmid,
+							  prerelease_callback callback);
+void dynamic_page_pool_release_pools(struct dynamic_page_pool **pool_list);
+
+struct page *dynamic_page_pool_alloc(struct dynamic_page_pool *pool);
+void dynamic_page_pool_free(struct dynamic_page_pool *pool, struct page *page);
+
+int dynamic_page_pool_init_shrinker(void);
+void dynamic_page_pool_shrink_high_and_low(struct dynamic_page_pool **pools_list,
+					   int num_pools, int nr_to_scan);
+int dynamic_page_pool_total(struct dynamic_page_pool *pool, bool high);
+
+struct page *dynamic_page_pool_remove(struct dynamic_page_pool *pool, bool high);
+void dynamic_page_pool_add(struct dynamic_page_pool *pool, struct page *page);
+
+#endif /* _DYN_PAGE_POOL_H */
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_secure_system_heap.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_secure_system_heap.c
@@ -0,0 +1,726 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * DMABUF System heap exporter
+ * Originally copied from: drivers/dma-buf/heaps/system_heap.c as of commit
+ * 263e38f82cbb ("dma-buf: heaps: Remove redundant heap identifier from system
+ * heap name")
+ *
+ * Additions taken from modifications to drivers/dma-buf/heaps/system-heap.c,
+ * from patches submitted, are listed below:
+ *
+ * Addition that modifies dma_buf ops to use SG tables taken from
+ * drivers/dma-buf/heaps/system-heap.c in:
+ * https://lore.kernel.org/lkml/20201017013255.43568-2-john.stultz@linaro.org/
+ *
+ * Addition that skips unneeded syncs in the dma_buf ops taken from
+ * https://lore.kernel.org/lkml/20201017013255.43568-5-john.stultz@linaro.org/
+ *
+ * Addition that tries to allocate higher order pages taken from
+ * https://lore.kernel.org/lkml/20201017013255.43568-6-john.stultz@linaro.org/
+ *
+ * Addition that implements an uncached heap taken from
+ * https://lore.kernel.org/lkml/20201017013255.43568-8-john.stultz@linaro.org/,
+ * with our own modificaitons made to account for core kernel changes that are
+ * a part of the patch series.
+ *
+ * Pooling functionality taken from:
+ * Git-repo: https://git.linaro.org/people/john.stultz/android-dev.git
+ * Branch: dma-buf-heap-perf
+ * Git-commit: 6f080eb67dce63c6efa57ef564ca4cd762ccebb0
+ * Git-commit: 6fb9593b928c4cb485bef4e88c59c6b9fdf11352
+ *
+ * Branched off from qcom_system_heap.c as of commit a4e135a8e482
+ * ("dt-bindings: ipcc: Add WPSS client to IPCC header") to accommodate secure
+ * pooling.
+ *
+ * Copyright (C) 2011 Google, Inc.
+ * Copyright (C) 2019, 2020 Linaro Ltd.
+ *
+ * Portions based off of Andrew Davis' SRAM heap:
+ * Copyright (C) 2019 Texas Instruments Incorporated - http://www.ti.com/
+ *	Andrew F. Davis <afd@ti.com>
+ *
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/dma-buf.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-heap.h>
+#include <linux/err.h>
+#include <linux/highmem.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/qcom_dma_heap.h>
+
+#include "qcom_dma_heap_secure_utils.h"
+#include "qcom_dynamic_page_pool.h"
+#include "qcom_sg_ops.h"
+#include "qcom_secure_system_heap.h"
+#include "qcom_system_heap.h"
+
+#define MAX_NR_PREFETCH_REGIONS 32
+
+/*
+ * The video client may not hold the last reference count on the
+ * ion_buffer(s). Delay for a short time after the video client sends
+ * the IOC_DRAIN event to increase the chance that the reference
+ * count drops to zero. Time in milliseconds.
+ */
+#define SHRINK_DELAY 1000
+
+struct prefetch_info {
+	struct list_head list;
+	struct dma_heap *heap;
+	u64 size;
+	bool shrink;
+};
+
+static LIST_HEAD(prefetch_list);
+static DEFINE_SPINLOCK(work_lock);
+static struct delayed_work prefetch_work;
+static struct workqueue_struct *prefetch_wq;
+
+static LIST_HEAD(secure_heaps);
+
+static inline struct dynamic_page_pool **get_sys_heap_page_pool(void)
+{
+	static struct dynamic_page_pool **qcom_sys_heap_pools;
+	struct dma_heap *dma_heap;
+	struct qcom_system_heap *sys_heap;
+
+	if (qcom_sys_heap_pools)
+		return qcom_sys_heap_pools;
+
+	dma_heap = dma_heap_find("qcom,system");
+	if (!dma_heap) {
+		pr_err("Unable to find the system heap\n");
+		goto out;
+	}
+
+	sys_heap = (struct qcom_system_heap *) dma_heap_get_drvdata(dma_heap);
+	qcom_sys_heap_pools = sys_heap->pool_list;
+
+out:
+	return qcom_sys_heap_pools;
+}
+
+static struct sg_table *get_pages(u64 size, struct dma_heap *heap)
+{
+	LIST_HEAD(pages);
+	struct dynamic_page_pool **qcom_sys_heap_pools;
+	unsigned long size_remaining = size;
+	struct page *page, *tmp_page;
+	int max_order = orders[0];
+	int num_pages = 0;
+	struct sg_table *sgt;
+	struct scatterlist *sg;
+	int ret;
+
+	qcom_sys_heap_pools = get_sys_heap_page_pool();
+	if (!qcom_sys_heap_pools) {
+		pr_err("%s: Couldn't obtain the pools for the system heap!\n", __func__);
+		return ERR_PTR(-EINVAL);
+	}
+
+	while (size_remaining > 0) {
+		page = qcom_sys_heap_alloc_largest_available(qcom_sys_heap_pools,
+							     size_remaining,
+							     max_order,
+							     false);
+
+		if (!page) {
+			pr_err("%s: Failed to get pages from the system heap: %lu, %llu!\n",
+			       __func__, size_remaining, size);
+			ret = -ENOMEM;
+			goto err;
+		}
+
+		list_add_tail(&page->lru, &pages);
+		size_remaining -= page_size(page);
+		max_order = compound_order(page);
+		num_pages++;
+	}
+
+	sgt = kzalloc(sizeof(*sgt), GFP_KERNEL);
+	if (!sgt) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	ret = sg_alloc_table(sgt, num_pages, GFP_KERNEL);
+	if (ret) {
+		pr_err("%s: sg table allocation failed with %d\n", __func__, ret);
+		goto free_table;
+	}
+
+	sg = sgt->sgl;
+	list_for_each_entry(page, &pages, lru) {
+		sg_set_page(sg, page, page_size(page), 0);
+		sg = sg_next(sg);
+	}
+
+	dma_map_sgtable(dma_heap_get_dev(heap), sgt, DMA_BIDIRECTIONAL, 0);
+	dma_unmap_sgtable(dma_heap_get_dev(heap), sgt, DMA_BIDIRECTIONAL, 0);
+
+	return sgt;
+
+free_table:
+	kfree(sgt);
+err:
+	list_for_each_entry_safe(page, tmp_page, &pages, lru)
+		__free_pages(page, compound_order(page));
+
+	return ERR_PTR(ret);
+}
+
+static void process_one_prefetch(struct prefetch_info *info)
+{
+	struct qcom_secure_system_heap *secure_heap = dma_heap_get_drvdata(info->heap);
+
+	struct sg_table *sgt;
+	struct scatterlist *sg;
+	struct page *page;
+	int ret;
+	int i, j;
+
+	sgt = get_pages(info->size, info->heap);
+	if (IS_ERR(sgt))
+		return;
+
+	ret = hyp_assign_sg_from_flags(sgt, secure_heap->vmid, true);
+	if (ret)
+		goto err;
+
+	for_each_sgtable_sg(sgt, sg, i) {
+		page = sg_page(sg);
+
+		for (j = 0; j < NUM_ORDERS; j++) {
+			if (compound_order(page) == orders[j])
+				break;
+		}
+		dynamic_page_pool_free(secure_heap->pool_list[j], page);
+	}
+
+	sg_free_table(sgt);
+
+	return;
+
+err:
+	for_each_sgtable_sg(sgt, sg, i) {
+		page = sg_page(sg);
+		__free_pages(page, compound_order(page));
+	}
+	sg_free_table(sgt);
+}
+
+static void process_one_shrink(struct prefetch_info *info)
+{
+	struct qcom_secure_system_heap *secure_heap = dma_heap_get_drvdata(info->heap);
+
+	dynamic_page_pool_shrink_high_and_low(secure_heap->pool_list,
+					      NUM_ORDERS, info->size / PAGE_SIZE);
+}
+
+static void secure_system_heap_prefetch_work(struct work_struct *work)
+{
+	struct prefetch_info *info, *tmp;
+	unsigned long flags;
+
+	spin_lock_irqsave(&work_lock, flags);
+	list_for_each_entry_safe(info, tmp, &prefetch_list, list) {
+		list_del(&info->list);
+		spin_unlock_irqrestore(&work_lock, flags);
+
+		if (info->shrink)
+			process_one_shrink(info);
+		else
+			process_one_prefetch(info);
+
+		kfree(info);
+		spin_lock_irqsave(&work_lock, flags);
+	}
+	spin_unlock_irqrestore(&work_lock, flags);
+}
+
+static int alloc_prefetch_info(struct dma_buf_heap_prefetch_region *region,
+			       bool shrink, struct list_head *items)
+{
+	struct prefetch_info *info;
+
+	info = kmalloc(sizeof(*info), GFP_KERNEL);
+	if (!info)
+		return -ENOMEM;
+
+	info->size = PAGE_ALIGN(region->size);
+	info->heap = region->heap;
+	info->shrink = shrink;
+	INIT_LIST_HEAD(&info->list);
+	list_add_tail(&info->list, items);
+	return 0;
+}
+
+static int __qcom_secure_system_heap_resize(struct dma_buf_heap_prefetch_region *regions,
+					    size_t nr_regions,
+					    bool shrink)
+{
+	struct qcom_secure_system_heap *list_ptr, *secure_heap = NULL;
+	int i, ret = 0;
+	struct prefetch_info *info, *tmp;
+	unsigned long flags;
+	LIST_HEAD(items);
+
+	if (!regions || nr_regions > MAX_NR_PREFETCH_REGIONS) {
+		pr_err("%s: Invalid input for %s\n", __func__,
+		       (shrink) ? "drain" : "prefetch");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < nr_regions; i++) {
+		list_for_each_entry(list_ptr, &secure_heaps, list) {
+			if (list_ptr == dma_heap_get_drvdata(regions->heap)) {
+				secure_heap = list_ptr;
+				break;
+			}
+		}
+
+		if (!secure_heap) {
+			pr_err("%s: %s is not a secure system heap!\n", __func__,
+			       dma_heap_get_name(regions->heap));
+			ret = -EINVAL;
+			goto out_free;
+		}
+
+		ret = alloc_prefetch_info(&regions[i], shrink, &items);
+		if (ret)
+			goto out_free;
+	}
+
+	spin_lock_irqsave(&work_lock, flags);
+	list_splice_tail_init(&items, &prefetch_list);
+	queue_delayed_work(prefetch_wq, &prefetch_work,
+			   shrink ?  msecs_to_jiffies(SHRINK_DELAY) : 0);
+	spin_unlock_irqrestore(&work_lock, flags);
+
+	return 0;
+
+out_free:
+	list_for_each_entry_safe(info, tmp, &items, list) {
+		list_del(&info->list);
+		kfree(info);
+	}
+	return ret;
+}
+
+int qcom_secure_system_heap_prefetch(struct dma_buf_heap_prefetch_region *regions,
+				     size_t nr_regions)
+{
+	return __qcom_secure_system_heap_resize(regions, nr_regions, false);
+}
+EXPORT_SYMBOL_GPL(qcom_secure_system_heap_prefetch);
+
+int qcom_secure_system_heap_drain(struct dma_buf_heap_prefetch_region *regions,
+				  size_t nr_regions)
+{
+	return __qcom_secure_system_heap_resize(regions, nr_regions, true);
+}
+EXPORT_SYMBOL_GPL(qcom_secure_system_heap_drain);
+
+static enum dynamic_pool_callback_ret free_secure_pages(struct dynamic_page_pool *pool,
+							struct list_head *pages,
+							int num_pages)
+{
+	struct page *page;
+	struct sg_table sgt;
+	struct scatterlist *sg;
+	int ret;
+
+	if (!num_pages)
+		return DYNAMIC_POOL_SUCCESS;
+
+	ret = sg_alloc_table(&sgt, num_pages, GFP_KERNEL);
+	if (ret)
+		return DYNAMIC_POOL_FAILURE;
+
+	sg = sgt.sgl;
+	list_for_each_entry(page, pages, lru) {
+		sg_set_page(sg, page, page_size(page), 0);
+		sg = sg_next(sg);
+	}
+
+	ret = hyp_unassign_sg_from_flags(&sgt, pool->vmid, true);
+	sg_free_table(&sgt);
+
+	if (ret)
+		return DYNAMIC_POOL_FAILURE;
+
+	return DYNAMIC_POOL_SUCCESS;
+}
+
+static void page_list_merge(struct list_head *secure_pages,
+			    struct list_head *non_secure_pages,
+			    struct scatterlist *sg,
+			    struct scatterlist *non_secure_sg)
+{
+	bool is_secure_head, is_non_secure_head;
+	struct page *secure_page = list_first_entry(secure_pages, struct page, lru);
+	struct page *non_secure_page = list_first_entry(non_secure_pages, struct page, lru);
+
+	do {
+		is_secure_head = list_entry_is_head(secure_page, secure_pages, lru);
+		is_non_secure_head = list_entry_is_head(non_secure_page, non_secure_pages, lru);
+
+		if (!is_secure_head && !is_non_secure_head) {
+			if (page_size(non_secure_page) >= page_size(secure_page)) {
+				sg_set_page(sg, non_secure_page,
+					    page_size(non_secure_page), 0);
+				sg_set_page(non_secure_sg, non_secure_page,
+					    page_size(non_secure_page), 0);
+
+				non_secure_page = list_next_entry(non_secure_page, lru);
+				non_secure_sg = sg_next(non_secure_sg);
+			} else {
+				sg_set_page(sg, secure_page,
+					    page_size(secure_page), 0);
+				secure_page = list_next_entry(secure_page, lru);
+			}
+		} else if (!is_non_secure_head) {
+			sg_set_page(sg, non_secure_page,
+					page_size(non_secure_page), 0);
+			sg_set_page(non_secure_sg, non_secure_page,
+					page_size(non_secure_page), 0);
+
+			non_secure_page = list_next_entry(non_secure_page, lru);
+			non_secure_sg = sg_next(non_secure_sg);
+		} else if (!is_secure_head) {
+			sg_set_page(sg, secure_page,
+					page_size(secure_page), 0);
+			secure_page = list_next_entry(secure_page, lru);
+		}
+
+		sg = sg_next(sg);
+	} while (sg);
+}
+
+static int page_to_pool_ind(struct page *page)
+{
+	int i;
+
+	for (i = 0; i < NUM_ORDERS; i++)
+		if (compound_order(page) == orders[i])
+			break;
+	return i;
+}
+
+static void system_heap_free(struct qcom_sg_buffer *buffer)
+{
+	struct qcom_secure_system_heap *sys_heap;
+	struct sg_table *table;
+	struct scatterlist *sg;
+	int i, j;
+
+	sys_heap = dma_heap_get_drvdata(buffer->heap);
+	table = &buffer->sg_table;
+
+	for_each_sg(table->sgl, sg, table->nents, i) {
+		struct page *page = sg_page(sg);
+
+		for (j = 0; j < NUM_ORDERS; j++) {
+			if (compound_order(page) == orders[j])
+				break;
+		}
+		dynamic_page_pool_free(sys_heap->pool_list[j], page);
+	}
+	sg_free_table(table);
+	kfree(buffer);
+}
+
+static struct page *alloc_largest_available(struct dynamic_page_pool **pools,
+					    unsigned long size,
+					    unsigned int max_order,
+					    bool *page_from_secure_pool)
+{
+	struct page *page = NULL;
+	int i;
+	struct dynamic_page_pool **qcom_sys_heap_pools = get_sys_heap_page_pool();
+
+	if (!qcom_sys_heap_pools) {
+		pr_err("%s: Couldn't obtain the pools for the system heap!\n", __func__);
+		return NULL;
+	}
+
+	*page_from_secure_pool = true;
+
+	for (i = 0; i < NUM_ORDERS; i++) {
+		unsigned long flags;
+
+		if (size <  (PAGE_SIZE << orders[i]))
+			continue;
+		if (max_order < orders[i])
+			continue;
+
+		spin_lock_irqsave(&pools[i]->lock, flags);
+		if (pools[i]->high_count)
+			page = dynamic_page_pool_remove(pools[i], true);
+		else if (pools[i]->low_count)
+			page = dynamic_page_pool_remove(pools[i], false);
+		spin_unlock_irqrestore(&pools[i]->lock, flags);
+
+		if (!page)
+			continue;
+		return page;
+	}
+
+	*page_from_secure_pool = false;
+
+	return qcom_sys_heap_alloc_largest_available(qcom_sys_heap_pools,
+						     size,
+						     max_order,
+						     false);
+}
+
+static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
+					       unsigned long len,
+					       u32 fd_flags,
+					       u64 heap_flags)
+{
+	struct qcom_secure_system_heap *sys_heap;
+	struct qcom_sg_buffer *buffer;
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	unsigned long size_remaining = len;
+	unsigned int max_order = orders[0];
+	bool page_from_secure_pool;
+	struct dma_buf *dmabuf;
+	struct sg_table *table, non_secure_table;
+	struct scatterlist *sg, *non_secure_sg = NULL;
+	LIST_HEAD(secure_pages);
+	LIST_HEAD(non_secure_pages);
+	struct page *page, *tmp_page;
+	int total_pages = 0, num_non_secure_pages = 0;
+	int ret = -ENOMEM, hyp_ret = 0;
+	int perms;
+	int vmid;
+
+	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
+	if (!buffer)
+		return ERR_PTR(-ENOMEM);
+
+	sys_heap = dma_heap_get_drvdata(heap);
+
+	INIT_LIST_HEAD(&buffer->attachments);
+	mutex_init(&buffer->lock);
+	buffer->heap = heap;
+	buffer->len = len;
+	buffer->uncached = true;
+	buffer->free = system_heap_free;
+
+	while (size_remaining > 0) {
+		/*
+		 * Avoid trying to allocate memory if the process
+		 * has been killed by SIGKILL
+		 */
+		if (fatal_signal_pending(current))
+			goto free_buffer;
+
+		page = alloc_largest_available(sys_heap->pool_list,
+					       size_remaining,
+					       max_order,
+					       &page_from_secure_pool);
+		if (!page)
+			goto free_buffer;
+
+		if (page_from_secure_pool) {
+			list_add_tail(&page->lru, &secure_pages);
+		} else {
+			num_non_secure_pages++;
+			list_add_tail(&page->lru, &non_secure_pages);
+		}
+
+		size_remaining -= page_size(page);
+		max_order = compound_order(page);
+		total_pages++;
+	}
+
+	table = &buffer->sg_table;
+	if (sg_alloc_table(table, total_pages, GFP_KERNEL))
+		goto free_buffer;
+	sg = table->sgl;
+
+	if (num_non_secure_pages) {
+		if (sg_alloc_table(&non_secure_table, num_non_secure_pages, GFP_KERNEL))
+			goto free_sg;
+		non_secure_sg = non_secure_table.sgl;
+	}
+
+	page_list_merge(&secure_pages, &non_secure_pages, sg, non_secure_sg);
+
+	if (num_non_secure_pages) {
+		dma_map_sgtable(dma_heap_get_dev(heap), &non_secure_table, DMA_BIDIRECTIONAL, 0);
+		dma_unmap_sgtable(dma_heap_get_dev(heap), &non_secure_table, DMA_BIDIRECTIONAL, 0);
+
+		hyp_ret = hyp_assign_sg_from_flags(&non_secure_table, sys_heap->vmid, true);
+		if (hyp_ret) {
+			if (hyp_ret != -EADDRNOTAVAIL)
+				/* Set hyp_ret = 0 so that we free the non-secure pages */
+				hyp_ret = 0;
+
+			goto free_non_secure_sg;
+		}
+	}
+
+	perms = msm_secure_get_vmid_perms(sys_heap->vmid);
+	vmid = get_secure_vmid(sys_heap->vmid);
+	buffer->vmperm = mem_buf_vmperm_alloc_staticvm(table,
+				&vmid, &perms, 1);
+
+	if (IS_ERR(buffer->vmperm)) {
+		ret = PTR_ERR(buffer->vmperm);
+		goto hyp_unassign;
+	}
+
+	/* create the dmabuf */
+	exp_info.exp_name = dma_heap_get_name(heap);
+	exp_info.ops = &qcom_sg_buf_ops.dma_ops;
+	exp_info.size = buffer->len;
+	exp_info.flags = fd_flags;
+	exp_info.priv = buffer;
+	dmabuf = qcom_dma_buf_export(&exp_info, &qcom_sg_buf_ops);
+	if (IS_ERR(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
+		goto vmperm_release;
+	}
+
+	if (num_non_secure_pages)
+		sg_free_table(&non_secure_table);
+
+	return dmabuf;
+
+vmperm_release:
+	mem_buf_vmperm_release(buffer->vmperm);
+
+hyp_unassign:
+	/* We check PagePrivate() below to see if we've reclaimed a particular page */
+	hyp_ret = hyp_unassign_sg_from_flags(&non_secure_table, sys_heap->vmid, true);
+
+free_non_secure_sg:
+	if (num_non_secure_pages)
+		sg_free_table(&non_secure_table);
+free_sg:
+	sg_free_table(table);
+free_buffer:
+	list_for_each_entry_safe(page, tmp_page, &secure_pages, lru)
+		dynamic_page_pool_free(sys_heap->pool_list[page_to_pool_ind(page)], page);
+	if (!hyp_ret)
+		list_for_each_entry_safe(page, tmp_page, &non_secure_pages, lru)
+			__free_pages(page, compound_order(page));
+
+	kfree(buffer);
+
+	return ERR_PTR(ret);
+}
+
+
+static const struct dma_heap_ops system_heap_ops = {
+	.allocate = system_heap_allocate,
+};
+
+static int create_prefetch_workqueue(void)
+{
+	static bool registered;
+
+	if (registered)
+		return 0;
+
+	INIT_DELAYED_WORK(&prefetch_work,
+			  secure_system_heap_prefetch_work);
+
+	prefetch_wq = alloc_workqueue("system_secure_prefetch_wq",
+				      WQ_UNBOUND | WQ_FREEZABLE, 0);
+	if (!prefetch_wq) {
+		pr_err("Failed to create system secure prefetch workqueue\n");
+		return -ENOMEM;
+	}
+
+	registered = true;
+	return 0;
+}
+
+void qcom_secure_system_heap_create(const char *name, const char *secure_system_alias, int vmid)
+{
+	struct dma_heap_export_info exp_info;
+	struct dma_heap *heap;
+	struct qcom_secure_system_heap *sys_heap;
+	int ret;
+
+	if (get_secure_vmid(vmid) == -EINVAL || hweight_long(vmid) != 1) {
+		pr_err("Invalid VMID or supplied more than one VMID\n");
+		ret = -EINVAL;
+		goto out;
+	}
+
+	ret = dynamic_page_pool_init_shrinker();
+	if (ret)
+		goto out;
+
+	ret = create_prefetch_workqueue();
+	if (ret)
+		goto out;
+
+	sys_heap = kzalloc(sizeof(*sys_heap), GFP_KERNEL);
+	if (!sys_heap) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	sys_heap->vmid = vmid;
+	sys_heap->pool_list = dynamic_page_pool_create_pools(vmid, free_secure_pages);
+	if (IS_ERR(sys_heap->pool_list)) {
+		ret = PTR_ERR(sys_heap->pool_list);
+		goto free_heap;
+	}
+
+	exp_info.name = name;
+	exp_info.ops = &system_heap_ops;
+	exp_info.priv = sys_heap;
+
+	heap = dma_heap_add(&exp_info);
+	if (IS_ERR(heap)) {
+		ret = PTR_ERR(heap);
+		goto free_pools;
+	}
+
+	dma_coerce_mask_and_coherent(dma_heap_get_dev(heap), DMA_BIT_MASK(64));
+
+	list_add(&sys_heap->list, &secure_heaps);
+
+	pr_info("%s: DMA-BUF Heap: Created '%s'\n", __func__, name);
+
+	if (secure_system_alias != NULL) {
+		exp_info.name = secure_system_alias;
+
+		heap = dma_heap_add(&exp_info);
+		if (IS_ERR(heap)) {
+			pr_err("%s: Failed to create '%s', error is %ld\n", __func__,
+			       secure_system_alias, PTR_ERR(heap));
+			return;
+		}
+
+		dma_coerce_mask_and_coherent(dma_heap_get_dev(heap), DMA_BIT_MASK(64));
+
+		pr_info("%s: DMA-BUF Heap: Created '%s'\n", __func__, secure_system_alias);
+	}
+
+	return;
+
+free_pools:
+	dynamic_page_pool_release_pools(sys_heap->pool_list);
+
+free_heap:
+	kfree(sys_heap);
+
+out:
+	pr_err("%s: Failed to create '%s', error is %d\n", __func__, name, ret);
+}
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_secure_system_heap.h
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_secure_system_heap.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QCOM_SECURE_SYSTEM_HEAP_H
+#define _QCOM_SECURE_SYSTEM_HEAP_H
+
+#include <linux/dma-heap.h>
+#include <linux/err.h>
+#include "qcom_dynamic_page_pool.h"
+
+struct qcom_secure_system_heap {
+	struct dynamic_page_pool **pool_list;
+	int vmid;
+	struct list_head list;
+};
+
+#ifdef CONFIG_QCOM_DMABUF_HEAPS_SYSTEM_SECURE
+void qcom_secure_system_heap_create(const char *name, const char *secure_system_alias,
+				    int vmid);
+#else
+static void qcom_secure_system_heap_create(const char *name, const char *secure_system_alias,
+					   int vmid)
+{
+
+}
+#endif
+
+#endif /* _QCOM_SECURE_SYSTEM_HEAP_H */
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_sg_ops.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_sg_ops.c
@@ -0,0 +1,599 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * mmap() algorithm taken from drivers/staging/android/ion/ion_heap.c as
+ * of commit a3ec289e74b4 ("arm-smmu: Fix missing qsmmuv500 callback")
+ *
+ * Copyright (C) 2011 Google, Inc.
+ * Copyright (C) 2019, 2020 Linaro Ltd.
+ *
+ * Portions based off of Andrew Davis' SRAM heap:
+ * Copyright (C) 2019 Texas Instruments Incorporated - http://www.ti.com/
+ *	Andrew F. Davis <afd@ti.com>
+ *
+ * These ops were base of the ops in drivers/dma-buf/heaps/system-heap.c from
+ * https://lore.kernel.org/lkml/20201017013255.43568-2-john.stultz@linaro.org/
+ *
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/dma-buf.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-heap.h>
+#include <linux/err.h>
+#include <linux/highmem.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/of.h>
+#include <linux/dma-map-ops.h>
+#include <linux/qcom_dma_heap.h>
+#include <linux/msm_dma_iommu_mapping.h>
+#include <linux/qti-smmu-proxy-callbacks.h>
+
+#include "qcom_sg_ops.h"
+
+int proxy_invalid_map(struct device *dev, struct sg_table *table,
+		      struct dma_buf *dmabuf)
+{
+	WARN(1, "Trying to map with SMMU proxy driver when it has not fully probed!\n");
+	return -EINVAL;
+}
+
+void proxy_invalid_unmap(struct device *dev, struct sg_table *table,
+			 struct dma_buf *dmabuf)
+{
+	WARN(1, "Trying to unmap with SMMU proxy driver when it has not fully probed!\n");
+}
+
+static struct smmu_proxy_callbacks smmu_proxy_callback_ops = {
+	.map_sgtable = proxy_invalid_map,
+	.unmap_sgtable = proxy_invalid_unmap,
+};
+
+static struct sg_table *dup_sg_table(struct sg_table *table)
+{
+	struct sg_table *new_table;
+	int ret, i;
+	struct scatterlist *sg, *new_sg;
+
+	new_table = kzalloc(sizeof(*new_table), GFP_KERNEL);
+	if (!new_table)
+		return ERR_PTR(-ENOMEM);
+
+	ret = sg_alloc_table(new_table, table->orig_nents, GFP_KERNEL);
+	if (ret) {
+		kfree(new_table);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	new_sg = new_table->sgl;
+	for_each_sgtable_sg(table, sg, i) {
+		sg_set_page(new_sg, sg_page(sg), sg->length, sg->offset);
+		new_sg = sg_next(new_sg);
+	}
+
+	return new_table;
+}
+
+int qcom_sg_attach(struct dma_buf *dmabuf,
+		   struct dma_buf_attachment *attachment)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+	struct dma_heap_attachment *a;
+	struct sg_table *table;
+
+	a = kzalloc(sizeof(*a), GFP_KERNEL);
+	if (!a)
+		return -ENOMEM;
+
+	table = dup_sg_table(&buffer->sg_table);
+	if (IS_ERR(table)) {
+		kfree(a);
+		return -ENOMEM;
+	}
+
+	a->table = table;
+	a->dev = attachment->dev;
+	INIT_LIST_HEAD(&a->list);
+	a->mapped = false;
+
+	attachment->priv = a;
+
+	mutex_lock(&buffer->lock);
+	list_add(&a->list, &buffer->attachments);
+	mutex_unlock(&buffer->lock);
+
+	return 0;
+}
+
+void qcom_sg_detach(struct dma_buf *dmabuf,
+		    struct dma_buf_attachment *attachment)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+	struct dma_heap_attachment *a = attachment->priv;
+
+	mutex_lock(&buffer->lock);
+	list_del(&a->list);
+	mutex_unlock(&buffer->lock);
+
+	sg_free_table(a->table);
+	kfree(a->table);
+	kfree(a);
+}
+
+struct sg_table *qcom_sg_map_dma_buf(struct dma_buf_attachment *attachment,
+				     enum dma_data_direction direction)
+{
+	struct dma_heap_attachment *a = attachment->priv;
+	struct sg_table *table = a->table;
+	struct qcom_sg_buffer *buffer;
+	struct mem_buf_vmperm *vmperm;
+	unsigned long attrs = attachment->dma_map_attrs;
+	int ret;
+
+	buffer = attachment->dmabuf->priv;
+	vmperm = buffer->vmperm;
+
+	if (smmu_proxy_callback_ops.map_sgtable &&
+	    (attrs & DMA_ATTR_QTI_SMMU_PROXY_MAP)) {
+		ret = smmu_proxy_callback_ops.map_sgtable(attachment->dev, table,
+							  attachment->dmabuf);
+		return ret ? ERR_PTR(ret) : table;
+	}
+
+	/* Prevent map/unmap during begin/end_cpu_access */
+	mutex_lock(&buffer->lock);
+
+	/* Ensure VM permissions are constant while the buffer is mapped */
+	mem_buf_vmperm_pin(vmperm);
+	if (buffer->uncached || !mem_buf_vmperm_can_cmo(vmperm))
+		attrs |= DMA_ATTR_SKIP_CPU_SYNC;
+
+	if (attrs & DMA_ATTR_DELAYED_UNMAP) {
+		ret = msm_dma_map_sgtable(attachment->dev, table, direction,
+					  attachment->dmabuf, attrs);
+	} else if (!a->mapped) {
+		ret = dma_map_sgtable(attachment->dev, table, direction, attrs);
+	} else {
+		dev_err(attachment->dev, "Error: Dma-buf is already mapped!\n");
+		ret = -EBUSY;
+	}
+
+	if (ret) {
+		table = ERR_PTR(ret);
+		goto err_map_sgtable;
+	}
+
+	a->mapped = true;
+	mutex_unlock(&buffer->lock);
+	return table;
+
+err_map_sgtable:
+	mem_buf_vmperm_unpin(vmperm);
+	mutex_unlock(&buffer->lock);
+	return table;
+}
+
+void qcom_sg_unmap_dma_buf(struct dma_buf_attachment *attachment,
+			   struct sg_table *table,
+			   enum dma_data_direction direction)
+{
+	struct dma_heap_attachment *a = attachment->priv;
+	struct qcom_sg_buffer *buffer;
+	struct mem_buf_vmperm *vmperm;
+	unsigned long attrs = attachment->dma_map_attrs;
+
+	buffer = attachment->dmabuf->priv;
+	vmperm = buffer->vmperm;
+
+	if (smmu_proxy_callback_ops.unmap_sgtable &&
+	    (attrs & DMA_ATTR_QTI_SMMU_PROXY_MAP)) {
+		smmu_proxy_callback_ops.unmap_sgtable(attachment->dev, table,
+						      attachment->dmabuf);
+		return;
+	}
+
+	/* Prevent map/unmap during begin/end_cpu_access */
+	mutex_lock(&buffer->lock);
+
+	if (buffer->uncached || !mem_buf_vmperm_can_cmo(vmperm))
+		attrs |= DMA_ATTR_SKIP_CPU_SYNC;
+
+	a->mapped = false;
+
+	if (attrs & DMA_ATTR_DELAYED_UNMAP) {
+		msm_dma_unmap_sgtable(attachment->dev, table, direction,
+				      attachment->dmabuf, attrs);
+	} else {
+		dma_unmap_sgtable(attachment->dev, table, direction, attrs);
+	}
+	mem_buf_vmperm_unpin(vmperm);
+	mutex_unlock(&buffer->lock);
+}
+
+int qcom_sg_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
+				     enum dma_data_direction direction)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+	struct dma_heap_attachment *a;
+
+	if (buffer->uncached)
+		return 0;
+
+	mutex_lock(&buffer->lock);
+
+	/* Keep the same behavior as ion by returning 0 instead of -EPERM */
+	if (!mem_buf_vmperm_can_cmo(buffer->vmperm)) {
+		mutex_unlock(&buffer->lock);
+		return 0;
+	}
+
+	if (buffer->vmap_cnt)
+		invalidate_kernel_vmap_range(buffer->vaddr, buffer->len);
+
+	list_for_each_entry(a, &buffer->attachments, list) {
+		if (!a->mapped)
+			continue;
+		dma_sync_sgtable_for_cpu(a->dev, a->table, direction);
+	}
+
+	mutex_unlock(&buffer->lock);
+
+	return 0;
+}
+
+int qcom_sg_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
+				   enum dma_data_direction direction)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+	struct dma_heap_attachment *a;
+
+	if (buffer->uncached)
+		return 0;
+
+	mutex_lock(&buffer->lock);
+
+	/* Keep the same behavior as ion by returning 0 instead of -EPERM */
+	if (!mem_buf_vmperm_can_cmo(buffer->vmperm)) {
+		mutex_unlock(&buffer->lock);
+		return 0;
+	}
+
+	if (buffer->vmap_cnt)
+		flush_kernel_vmap_range(buffer->vaddr, buffer->len);
+
+	list_for_each_entry(a, &buffer->attachments, list) {
+		if (!a->mapped)
+			continue;
+		dma_sync_sgtable_for_device(a->dev, a->table, direction);
+	}
+	mutex_unlock(&buffer->lock);
+
+	return 0;
+}
+
+static int sgl_sync_range(struct device *dev, struct scatterlist *sgl,
+			  unsigned int nents, unsigned long offset,
+			  unsigned long length,
+			  enum dma_data_direction dir, bool for_cpu)
+{
+	int i;
+	struct scatterlist *sg;
+	unsigned int len = 0;
+	dma_addr_t sg_dma_addr;
+
+	for_each_sg(sgl, sg, nents, i) {
+		if (sg_dma_len(sg) == 0)
+			break;
+
+		if (i > 0) {
+			if (!get_dma_ops(dev))
+				return 0;
+
+			pr_warn_ratelimited("Partial cmo only supported with 1 segment\n"
+				"is dma_set_max_seg_size being set on dev:%s\n",
+				dev_name(dev));
+			return -EINVAL;
+		}
+	}
+
+	for_each_sg(sgl, sg, nents, i) {
+		unsigned int sg_offset, sg_left, size = 0;
+
+		if (i == 0)
+			sg_dma_addr = sg_dma_address(sg);
+
+		len += sg->length;
+		if (len <= offset) {
+			sg_dma_addr += sg->length;
+			continue;
+		}
+
+		sg_left = len - offset;
+		sg_offset = sg->length - sg_left;
+
+		size = (length < sg_left) ? length : sg_left;
+		if (for_cpu)
+			dma_sync_single_range_for_cpu(dev, sg_dma_addr,
+						      sg_offset, size, dir);
+		else
+			dma_sync_single_range_for_device(dev, sg_dma_addr,
+							 sg_offset, size, dir);
+
+		offset += size;
+		length -= size;
+		sg_dma_addr += sg->length;
+
+		if (length == 0)
+			break;
+	}
+
+	return 0;
+}
+
+int qcom_sg_dma_buf_begin_cpu_access_partial(struct dma_buf *dmabuf,
+					     enum dma_data_direction dir,
+					     unsigned int offset,
+					     unsigned int len)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+	struct dma_heap_attachment *a;
+	int ret = 0;
+
+	if (buffer->uncached)
+		return 0;
+
+	mutex_lock(&buffer->lock);
+
+	/* Keep the same behavior as ion by returning 0 instead of -EPERM */
+	if (!mem_buf_vmperm_can_cmo(buffer->vmperm)) {
+		mutex_unlock(&buffer->lock);
+		return 0;
+	}
+
+	if (buffer->vmap_cnt)
+		invalidate_kernel_vmap_range(buffer->vaddr + offset, len);
+
+	list_for_each_entry(a, &buffer->attachments, list) {
+		if (!a->mapped)
+			continue;
+
+		ret = sgl_sync_range(a->dev, a->table->sgl, a->table->orig_nents,
+				     offset, len, dir, true);
+	}
+	mutex_unlock(&buffer->lock);
+
+	return ret;
+}
+
+int qcom_sg_dma_buf_end_cpu_access_partial(struct dma_buf *dmabuf,
+					   enum dma_data_direction direction,
+					   unsigned int offset,
+					   unsigned int len)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+	struct dma_heap_attachment *a;
+	int ret = 0;
+
+	if (buffer->uncached)
+		return 0;
+
+	mutex_lock(&buffer->lock);
+
+	/* Keep the same behavior as ion by returning 0 instead of -EPERM */
+	if (!mem_buf_vmperm_can_cmo(buffer->vmperm)) {
+		mutex_unlock(&buffer->lock);
+		return 0;
+	}
+
+	if (buffer->vmap_cnt)
+		flush_kernel_vmap_range(buffer->vaddr + offset, len);
+
+	list_for_each_entry(a, &buffer->attachments, list) {
+		if (!a->mapped)
+			continue;
+
+		ret = sgl_sync_range(a->dev, a->table->sgl, a->table->orig_nents,
+				     offset, len, direction, false);
+	}
+	mutex_unlock(&buffer->lock);
+
+	return ret;
+}
+
+static void qcom_sg_vm_ops_open(struct vm_area_struct *vma)
+{
+	struct mem_buf_vmperm *vmperm = vma->vm_private_data;
+
+	mem_buf_vmperm_pin(vmperm);
+}
+
+static void qcom_sg_vm_ops_close(struct vm_area_struct *vma)
+{
+	struct mem_buf_vmperm *vmperm = vma->vm_private_data;
+
+	mem_buf_vmperm_unpin(vmperm);
+}
+
+static const struct vm_operations_struct qcom_sg_vm_ops = {
+	.open = qcom_sg_vm_ops_open,
+	.close = qcom_sg_vm_ops_close,
+};
+
+int qcom_sg_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+	struct sg_table *table = &buffer->sg_table;
+	struct scatterlist *sg;
+	unsigned long addr = vma->vm_start;
+	unsigned long offset = vma->vm_pgoff * PAGE_SIZE;
+	int ret;
+	int i;
+
+	mem_buf_vmperm_pin(buffer->vmperm);
+	if (!mem_buf_vmperm_can_mmap(buffer->vmperm, vma)) {
+		mem_buf_vmperm_unpin(buffer->vmperm);
+		return -EPERM;
+	}
+
+	vma->vm_ops = &qcom_sg_vm_ops;
+	vma->vm_private_data = buffer->vmperm;
+	if (buffer->uncached)
+		vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+
+	for_each_sg(table->sgl, sg, table->nents, i) {
+		struct page *page = sg_page(sg);
+		unsigned long remainder = vma->vm_end - addr;
+		unsigned long len = sg->length;
+
+		if (offset >= sg->length) {
+			offset -= sg->length;
+			continue;
+		} else if (offset) {
+			page += offset / PAGE_SIZE;
+			len = sg->length - offset;
+			offset = 0;
+		}
+		len = min(len, remainder);
+		ret = remap_pfn_range(vma, addr, page_to_pfn(page), len,
+				      vma->vm_page_prot);
+		if (ret) {
+			mem_buf_vmperm_unpin(buffer->vmperm);
+			return ret;
+		}
+		addr += len;
+		if (addr >= vma->vm_end)
+			return 0;
+	}
+	return 0;
+}
+
+void *qcom_sg_do_vmap(struct qcom_sg_buffer *buffer)
+{
+	struct sg_table *table = &buffer->sg_table;
+	int npages = PAGE_ALIGN(buffer->len) / PAGE_SIZE;
+	struct page **pages = vmalloc(sizeof(struct page *) * npages);
+	struct page **tmp = pages;
+	struct sg_page_iter piter;
+	pgprot_t pgprot = PAGE_KERNEL;
+	void *vaddr;
+
+	if (!pages)
+		return ERR_PTR(-ENOMEM);
+
+	if (buffer->uncached)
+		pgprot = pgprot_writecombine(PAGE_KERNEL);
+
+	for_each_sgtable_page(table, &piter, 0) {
+		WARN_ON(tmp - pages >= npages);
+		*tmp++ = sg_page_iter_page(&piter);
+	}
+
+	vaddr = vmap(pages, npages, VM_MAP, pgprot);
+	vfree(pages);
+
+	if (!vaddr)
+		return ERR_PTR(-ENOMEM);
+
+	return vaddr;
+}
+
+int qcom_sg_vmap(struct dma_buf *dmabuf, struct iosys_map *map)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+	void *vaddr;
+	int ret = 0;
+
+	mem_buf_vmperm_pin(buffer->vmperm);
+	if (!mem_buf_vmperm_can_vmap(buffer->vmperm)) {
+		mem_buf_vmperm_unpin(buffer->vmperm);
+		return -EPERM;
+	}
+
+	mutex_lock(&buffer->lock);
+	if (buffer->vmap_cnt) {
+		buffer->vmap_cnt++;
+		iosys_map_set_vaddr(map, buffer->vaddr);
+		goto out;
+	}
+
+	vaddr = qcom_sg_do_vmap(buffer);
+	if (IS_ERR(vaddr)) {
+		ret = PTR_ERR(vaddr);
+		mem_buf_vmperm_unpin(buffer->vmperm);
+		goto out;
+	}
+
+	buffer->vaddr = vaddr;
+	buffer->vmap_cnt++;
+	iosys_map_set_vaddr(map, buffer->vaddr);
+out:
+	mutex_unlock(&buffer->lock);
+
+	return ret;
+}
+
+void qcom_sg_vunmap(struct dma_buf *dmabuf, struct iosys_map *map)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+
+	mutex_lock(&buffer->lock);
+	if (!--buffer->vmap_cnt) {
+		vunmap(buffer->vaddr);
+		buffer->vaddr = NULL;
+	}
+	mem_buf_vmperm_unpin(buffer->vmperm);
+	mutex_unlock(&buffer->lock);
+	iosys_map_clear(map);
+}
+
+void qcom_sg_release(struct dma_buf *dmabuf)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+
+	if (mem_buf_vmperm_release(buffer->vmperm))
+		return;
+
+	msm_dma_buf_freed(buffer);
+	buffer->free(buffer);
+}
+
+struct mem_buf_vmperm *qcom_sg_lookup_vmperm(struct dma_buf *dmabuf)
+{
+	struct qcom_sg_buffer *buffer = dmabuf->priv;
+
+	return buffer->vmperm;
+}
+
+struct mem_buf_dma_buf_ops qcom_sg_buf_ops = {
+	.attach = qcom_sg_attach,
+	.lookup = qcom_sg_lookup_vmperm,
+	.dma_ops = {
+		.attach = NULL, /* Will be set by mem_buf_dma_buf_export */
+		.detach = qcom_sg_detach,
+		.map_dma_buf = qcom_sg_map_dma_buf,
+		.unmap_dma_buf = qcom_sg_unmap_dma_buf,
+		.begin_cpu_access = qcom_sg_dma_buf_begin_cpu_access,
+		.end_cpu_access = qcom_sg_dma_buf_end_cpu_access,
+		.begin_cpu_access_partial = qcom_sg_dma_buf_begin_cpu_access_partial,
+		.end_cpu_access_partial = qcom_sg_dma_buf_end_cpu_access_partial,
+		.mmap = qcom_sg_mmap,
+		.vmap = qcom_sg_vmap,
+		.vunmap = qcom_sg_vunmap,
+		.release = qcom_sg_release,
+	}
+};
+EXPORT_SYMBOL_GPL(qcom_sg_buf_ops);
+
+int qti_smmu_proxy_register_callbacks(smmu_proxy_map_sgtable map_sgtable_fn_ptr,
+				      smmu_proxy_unmap_sgtable unmap_sgtable_fn_ptr)
+{
+	smmu_proxy_callback_ops.map_sgtable = map_sgtable_fn_ptr;
+	smmu_proxy_callback_ops.unmap_sgtable = unmap_sgtable_fn_ptr;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(qti_smmu_proxy_register_callbacks);
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_sg_ops.h
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_sg_ops.h
@@ -0,0 +1,85 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2011 Google, Inc.
+ * Copyright (C) 2019, 2020 Linaro Ltd.
+ *
+ * Portions based off of Andrew Davis' SRAM heap:
+ * Copyright (C) 2019 Texas Instruments Incorporated - http://www.ti.com/
+ *	Andrew F. Davis <afd@ti.com>
+ *
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QCOM_SG_OPS_H
+#define _QCOM_SG_OPS_H
+
+#include <linux/scatterlist.h>
+#include <linux/dma-heap.h>
+#include <linux/device.h>
+#include "qcom_dma_heap_priv.h"
+
+struct qcom_sg_buffer {
+	struct dma_heap *heap;
+	struct list_head attachments;
+	struct mutex lock;
+	unsigned long len;
+	struct sg_table sg_table;
+	int vmap_cnt;
+	void *vaddr;
+	bool uncached;
+	struct mem_buf_vmperm *vmperm;
+	void (*free)(struct qcom_sg_buffer *buffer);
+};
+
+struct dma_heap_attachment {
+	struct device *dev;
+	struct sg_table *table;
+	struct list_head list;
+	bool mapped;
+};
+
+int qcom_sg_attach(struct dma_buf *dmabuf,
+		   struct dma_buf_attachment *attachment);
+
+void qcom_sg_detach(struct dma_buf *dmabuf,
+		    struct dma_buf_attachment *attachment);
+
+struct sg_table *qcom_sg_map_dma_buf(struct dma_buf_attachment *attachment,
+				     enum dma_data_direction direction);
+
+void qcom_sg_unmap_dma_buf(struct dma_buf_attachment *attachment,
+			   struct sg_table *table,
+			   enum dma_data_direction direction);
+
+int qcom_sg_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
+				     enum dma_data_direction direction);
+
+int qcom_sg_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
+				   enum dma_data_direction direction);
+
+int qcom_sg_dma_buf_begin_cpu_access_partial(struct dma_buf *dmabuf,
+					     enum dma_data_direction dir,
+					     unsigned int offset,
+					     unsigned int len);
+
+int qcom_sg_dma_buf_end_cpu_access_partial(struct dma_buf *dmabuf,
+					   enum dma_data_direction direction,
+					   unsigned int offset,
+					   unsigned int len);
+
+int qcom_sg_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma);
+
+void *qcom_sg_do_vmap(struct qcom_sg_buffer *buffer);
+
+int qcom_sg_vmap(struct dma_buf *dmabuf, struct iosys_map *map);
+
+void qcom_sg_vunmap(struct dma_buf *dmabuf, struct iosys_map *map);
+
+void qcom_sg_release(struct dma_buf *dmabuf);
+
+struct mem_buf_vmperm *qcom_sg_lookup_vmperm(struct dma_buf *dmabuf);
+
+extern struct mem_buf_dma_buf_ops qcom_sg_buf_ops;
+
+#endif /* _QCOM_SG_OPS_H */
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_system_heap.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_system_heap.c
@@ -0,0 +1,620 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * DMABUF System heap exporter
+ * Originally copied from: drivers/dma-buf/heaps/system_heap.c as of commit
+ * 263e38f82cbb ("dma-buf: heaps: Remove redundant heap identifier from system
+ * heap name")
+ *
+ * Additions taken from modifications to drivers/dma-buf/heaps/system-heap.c,
+ * from patches submitted, are listed below:
+ *
+ * Addition that modifies dma_buf ops to use SG tables taken from
+ * drivers/dma-buf/heaps/system-heap.c in:
+ * https://lore.kernel.org/lkml/20201017013255.43568-2-john.stultz@linaro.org/
+ *
+ * Addition that skips unneeded syncs in the dma_buf ops taken from
+ * https://lore.kernel.org/lkml/20201017013255.43568-5-john.stultz@linaro.org/
+ *
+ * Addition that tries to allocate higher order pages taken from
+ * https://lore.kernel.org/lkml/20201017013255.43568-6-john.stultz@linaro.org/
+ *
+ * Addition that implements an uncached heap taken from
+ * https://lore.kernel.org/lkml/20201017013255.43568-8-john.stultz@linaro.org/,
+ * with our own modificaitons made to account for core kernel changes that are
+ * a part of the patch series.
+ *
+ * Pooling functionality taken from:
+ * Git-repo: https://git.linaro.org/people/john.stultz/android-dev.git
+ * Branch: dma-buf-heap-perf
+ * Git-commit: 6f080eb67dce63c6efa57ef564ca4cd762ccebb0
+ * Git-commit: 6fb9593b928c4cb485bef4e88c59c6b9fdf11352
+ *
+ * Copyright (C) 2011 Google, Inc.
+ * Copyright (C) 2019, 2020 Linaro Ltd.
+ *
+ * Portions based off of Andrew Davis' SRAM heap:
+ * Copyright (C) 2019 Texas Instruments Incorporated - http://www.ti.com/
+ *	Andrew F. Davis <afd@ti.com>
+ *
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/dma-buf.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-heap.h>
+#include <linux/err.h>
+#include <linux/highmem.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/kthread.h>
+#include <linux/qcom_dma_heap.h>
+#include <uapi/linux/sched/types.h>
+
+#include "qcom_dma_heap_secure_utils.h"
+#include "qcom_dynamic_page_pool.h"
+#include "qcom_sg_ops.h"
+#include "qcom_system_heap.h"
+#include "../../../mm/internal.h"
+
+#if IS_ENABLED(CONFIG_QCOM_DMABUF_HEAPS_PAGE_POOL_REFILL)
+#define DYNAMIC_POOL_FILL_MARK (100 * SZ_1M)
+#define DYNAMIC_POOL_LOW_MARK_PERCENT 40UL
+#define DYNAMIC_POOL_LOW_MARK ((DYNAMIC_POOL_FILL_MARK * DYNAMIC_POOL_LOW_MARK_PERCENT) / 100)
+
+#define DYNAMIC_POOL_REFILL_DEFER_WINDOW_MS 10
+#define DYNAMIC_POOL_KTHREAD_NICE_VAL 10
+
+static int get_dynamic_pool_fillmark(struct dynamic_page_pool *pool)
+{
+	return DYNAMIC_POOL_FILL_MARK / (PAGE_SIZE << pool->order);
+}
+
+static bool dynamic_pool_fillmark_reached(struct dynamic_page_pool *pool)
+{
+	return atomic_read(&pool->count) >= get_dynamic_pool_fillmark(pool);
+}
+
+static int get_dynamic_pool_lowmark(struct dynamic_page_pool *pool)
+{
+	return DYNAMIC_POOL_LOW_MARK / (PAGE_SIZE << pool->order);
+}
+
+static bool dynamic_pool_count_below_lowmark(struct dynamic_page_pool *pool)
+{
+	return atomic_read(&pool->count) < get_dynamic_pool_lowmark(pool);
+}
+
+/* Based on gfp_zone() in mm/mmzone.c since it is not exported. */
+enum zone_type dynamic_pool_gfp_zone(gfp_t flags)
+{
+	enum zone_type z;
+	gfp_t local_flags = flags;
+	int bit;
+
+	bit = (__force int) ((local_flags) & GFP_ZONEMASK);
+
+	z = (GFP_ZONE_TABLE >> (bit * GFP_ZONES_SHIFT)) &
+					 ((1 << GFP_ZONES_SHIFT) - 1);
+	VM_BUG_ON((GFP_ZONE_BAD >> bit) & 1);
+	return z;
+}
+
+/*
+ * Based on __zone_watermark_ok() in mm/page_alloc.c since it is not exported.
+ *
+ * Return true if free base pages are above 'mark'. For high-order checks it
+ * will return true of the order-0 watermark is reached and there is at least
+ * one free page of a suitable size. Checking now avoids taking the zone lock
+ * to check in the allocation paths if no pages are free.
+ */
+static bool __dynamic_pool_zone_watermark_ok(struct zone *z, unsigned int order, unsigned long mark,
+					     int highest_zoneidx, long free_pages)
+{
+	long min = mark;
+	long unusable_free;
+	int o;
+
+	/*
+	 * Access to high atomic reserves is not required, and CMA should not be
+	 * used, since these allocations are non-movable.
+	 */
+	unusable_free = ((1 << order) - 1) + z->nr_reserved_highatomic;
+#ifdef CONFIG_CMA
+	unusable_free += zone_page_state(z, NR_FREE_CMA_PAGES);
+#endif
+
+	/* free_pages may go negative - that's OK */
+	free_pages -= unusable_free;
+
+	/*
+	 * Check watermarks for an order-0 allocation request. If these
+	 * are not met, then a high-order request also cannot go ahead
+	 * even if a suitable page happened to be free.
+	 *
+	 * 'min' can be taken as 'mark' since we do not expect these allocations
+	 * to require disruptive actions (such as running the OOM killer) or
+	 * a lot of effort.
+	 */
+	if (free_pages <= min + z->lowmem_reserve[highest_zoneidx])
+		return false;
+
+	/* If this is an order-0 request then the watermark is fine */
+	if (!order)
+		return true;
+
+	/* For a high-order request, check at least one suitable page is free */
+	for (o = order; o < MAX_ORDER; o++) {
+		struct free_area *area = &z->free_area[o];
+		int mt;
+
+		if (!area->nr_free)
+			continue;
+
+		for (mt = 0; mt < MIGRATE_PCPTYPES; mt++) {
+			if (!free_area_empty(area, mt))
+				return true;
+		}
+	}
+
+	return false;
+}
+
+/* Based on zone_watermark_ok_safe from mm/page_alloc.c since it is not exported. */
+bool dynamic_pool_zone_watermark_ok_safe(struct zone *z, unsigned int order,
+						unsigned long mark, int highest_zoneidx)
+{
+	long free_pages = zone_page_state(z, NR_FREE_PAGES);
+
+	if (z->percpu_drift_mark && free_pages < z->percpu_drift_mark)
+		free_pages = zone_page_state_snapshot(z, NR_FREE_PAGES);
+
+	return __dynamic_pool_zone_watermark_ok(z, order, mark, highest_zoneidx, free_pages);
+}
+
+/* do a simple check to see if we are in any low memory situation */
+static bool dynamic_pool_refill_ok(struct dynamic_page_pool *pool)
+{
+	struct zone *zone;
+	int i, mark;
+	enum zone_type classzone_idx = dynamic_pool_gfp_zone(pool->gfp_mask);
+	s64 delta;
+
+	/* check if we are within the refill defer window */
+	delta = ktime_ms_delta(ktime_get(), pool->last_low_watermark_ktime);
+	if (delta < DYNAMIC_POOL_REFILL_DEFER_WINDOW_MS)
+		return false;
+
+	/*
+	 * make sure that if we allocate a pool->order page from buddy,
+	 * we don't put the zone watermarks below the high threshold.
+	 * This makes sure there's no unwanted repetitive refilling and
+	 * reclaiming of buddy pages on the pool.
+	 */
+	for (i = classzone_idx; i >= 0; i--) {
+		zone = &NODE_DATA(numa_node_id())->node_zones[i];
+
+		if (!strcmp(zone->name, "DMA32"))
+			continue;
+
+		mark = high_wmark_pages(zone);
+		mark += 1 << pool->order;
+		if (!dynamic_pool_zone_watermark_ok_safe(zone, pool->order, mark, classzone_idx)) {
+			pool->last_low_watermark_ktime = ktime_get();
+			return false;
+		}
+	}
+
+	return true;
+}
+
+static void dynamic_page_pool_refill(struct dynamic_page_pool *pool)
+{
+	struct page *page;
+	gfp_t gfp_refill = (pool->gfp_mask | __GFP_RECLAIM) & ~__GFP_NORETRY;
+
+	/* skip refilling order 0 pools */
+	if (!pool->order)
+		return;
+
+	while (!dynamic_pool_fillmark_reached(pool) && dynamic_pool_refill_ok(pool)) {
+		page = alloc_pages(gfp_refill, pool->order);
+		if (!page)
+			break;
+
+		dynamic_page_pool_add(pool, page);
+	}
+}
+
+static bool dynamic_pool_needs_refill(struct dynamic_page_pool *pool)
+{
+	return pool->order && dynamic_pool_count_below_lowmark(pool);
+}
+
+static int system_heap_refill_worker(void *data)
+{
+	struct dynamic_page_pool **pool_list = data;
+	int i;
+
+	for (;;) {
+		for (i = 0; i < NUM_ORDERS; i++) {
+			if (dynamic_pool_count_below_lowmark(pool_list[i]))
+				dynamic_page_pool_refill(pool_list[i]);
+		}
+
+		set_current_state(TASK_INTERRUPTIBLE);
+		if (unlikely(kthread_should_stop())) {
+			set_current_state(TASK_RUNNING);
+			break;
+		}
+		schedule();
+
+		set_current_state(TASK_RUNNING);
+	}
+
+	return 0;
+}
+
+static int system_heap_create_refill_worker(struct qcom_system_heap *sys_heap, const char *name)
+{
+	struct task_struct *refill_worker;
+	struct sched_attr attr = { .sched_nice = DYNAMIC_POOL_KTHREAD_NICE_VAL };
+	int ret;
+	int i;
+
+	refill_worker = kthread_run(system_heap_refill_worker, sys_heap->pool_list,
+				    "%s-pool-refill-thread", name);
+	if (IS_ERR(refill_worker)) {
+		pr_err("%s: failed to create %s-pool-refill-thread: %ld\n",
+			__func__, name, PTR_ERR(refill_worker));
+		return PTR_ERR(refill_worker);
+	}
+
+	ret = sched_setattr(refill_worker, &attr);
+	if (ret) {
+		pr_warn("%s: failed to set task priority for %s-pool-refill-thread: ret = %d\n",
+			__func__, name, ret);
+		kthread_stop(refill_worker);
+		return ret;
+	}
+
+	for (i = 0; i < NUM_ORDERS; i++)
+		sys_heap->pool_list[i]->refill_worker = refill_worker;
+
+	return ret;
+}
+
+static void system_heap_destroy_refill_worker(struct qcom_system_heap *sys_heap)
+{
+	kthread_stop(sys_heap->pool_list[0]->refill_worker);
+}
+#else
+static bool dynamic_pool_needs_refill(struct dynamic_page_pool *pool)
+{
+	return false;
+}
+
+static int system_heap_create_refill_worker(struct qcom_system_heap *sys_heap, const char *name)
+{
+	return 0;
+}
+
+static void system_heap_destroy_refill_worker(struct qcom_system_heap *sys_heap)
+{
+}
+#endif
+
+static int system_heap_clear_pages(struct page **pages, int num, pgprot_t pgprot)
+{
+	void *addr = vmap(pages, num, VM_MAP, pgprot);
+
+	if (!addr)
+		return -ENOMEM;
+	memset(addr, 0, PAGE_SIZE * num);
+	vunmap(addr);
+	return 0;
+}
+
+static int system_heap_zero_buffer(struct qcom_sg_buffer *buffer)
+{
+	struct sg_table *sgt = &buffer->sg_table;
+	struct sg_page_iter piter;
+	struct page *pages[32];
+	int p = 0;
+	int ret = 0;
+
+	for_each_sgtable_page(sgt, &piter, 0) {
+		pages[p++] = sg_page_iter_page(&piter);
+		if (p == ARRAY_SIZE(pages)) {
+			ret = system_heap_clear_pages(pages, p, PAGE_KERNEL);
+			if (ret)
+				return ret;
+			p = 0;
+		}
+	}
+	if (p)
+		ret = system_heap_clear_pages(pages, p, PAGE_KERNEL);
+
+	return ret;
+}
+
+void qcom_system_heap_free(struct qcom_sg_buffer *buffer)
+{
+	struct qcom_system_heap *sys_heap;
+	struct sg_table *table;
+	struct scatterlist *sg;
+	int i, j;
+
+	sys_heap = dma_heap_get_drvdata(buffer->heap);
+	table = &buffer->sg_table;
+
+	/* Zero the buffer pages before adding back to the pool */
+	system_heap_zero_buffer(buffer);
+
+	for_each_sg(table->sgl, sg, table->nents, i) {
+		struct page *page = sg_page(sg);
+
+		for (j = 0; j < NUM_ORDERS; j++) {
+			if (compound_order(page) == orders[j])
+				break;
+		}
+
+		/* Do not keep page in the pool if it is a zone movable page */
+		if (is_zone_movable_page(page)) {
+			/* Unpin the page before freeing page back to buddy */
+			put_page(page);
+			__free_pages(page, compound_order(page));
+		} else {
+			dynamic_page_pool_free(sys_heap->pool_list[j], page);
+		}
+	}
+	sg_free_table(table);
+	kfree(buffer);
+}
+
+struct page *qcom_sys_heap_alloc_largest_available(struct dynamic_page_pool **pools,
+						   unsigned long size,
+						   unsigned int max_order,
+						   bool movable)
+{
+	struct page *page = NULL;
+	int i;
+
+	for (i = 0; i < NUM_ORDERS; i++) {
+		unsigned long flags;
+
+		if (size <  (PAGE_SIZE << orders[i]))
+			continue;
+		if (max_order < orders[i])
+			continue;
+
+		spin_lock_irqsave(&pools[i]->lock, flags);
+		if (pools[i]->high_count)
+			page = dynamic_page_pool_remove(pools[i], true);
+		else if (pools[i]->low_count)
+			page = dynamic_page_pool_remove(pools[i], false);
+		spin_unlock_irqrestore(&pools[i]->lock, flags);
+
+		if (!page)
+			page = alloc_pages(pools[i]->gfp_mask, pools[i]->order);
+		if (!page)
+			continue;
+
+		if (dynamic_pool_needs_refill(pools[i]))
+			wake_up_process(pools[i]->refill_worker);
+
+		return page;
+	}
+	return NULL;
+}
+
+int system_qcom_sg_buffer_alloc(struct dma_heap *heap,
+				struct qcom_sg_buffer *buffer,
+				unsigned long len,
+				bool movable)
+{
+	struct qcom_system_heap *sys_heap;
+	unsigned long size_remaining = len;
+	unsigned int max_order = orders[0];
+	struct sg_table *table;
+	struct scatterlist *sg;
+	struct list_head pages;
+	struct page *page, *tmp_page;
+	int i, ret = -ENOMEM;
+
+	sys_heap = dma_heap_get_drvdata(heap);
+
+	INIT_LIST_HEAD(&buffer->attachments);
+	mutex_init(&buffer->lock);
+	buffer->heap = heap;
+	buffer->len = len;
+	buffer->uncached = sys_heap->uncached;
+	buffer->free = qcom_system_heap_free;
+
+	INIT_LIST_HEAD(&pages);
+	i = 0;
+	while (size_remaining > 0) {
+		/*
+		 * Avoid trying to allocate memory if the process
+		 * has been killed by SIGKILL
+		 */
+		if (fatal_signal_pending(current))
+			goto free_mem;
+
+		page = qcom_sys_heap_alloc_largest_available(sys_heap->pool_list,
+							     size_remaining,
+							     max_order,
+							     movable);
+		if (!page)
+			goto free_mem;
+
+		list_add_tail(&page->lru, &pages);
+		size_remaining -= page_size(page);
+		max_order = compound_order(page);
+		i++;
+	}
+
+	table = &buffer->sg_table;
+	if (sg_alloc_table(table, i, GFP_KERNEL))
+		goto free_mem;
+
+	sg = table->sgl;
+	list_for_each_entry_safe(page, tmp_page, &pages, lru) {
+		sg_set_page(sg, page, page_size(page), 0);
+		sg = sg_next(sg);
+		list_del(&page->lru);
+	}
+
+	/*
+	 * For uncached buffers, we need to initially flush cpu cache, since
+	 * the __GFP_ZERO on the allocation means the zeroing was done by the
+	 * cpu and thus it is likely cached. Map (and implicitly flush) and
+	 * unmap it now so we don't get corruption later on.
+	 */
+	if (buffer->uncached) {
+		dma_map_sgtable(dma_heap_get_dev(heap), table, DMA_BIDIRECTIONAL, 0);
+		dma_unmap_sgtable(dma_heap_get_dev(heap), table, DMA_BIDIRECTIONAL, 0);
+	}
+
+	return 0;
+
+free_mem:
+	list_for_each_entry_safe(page, tmp_page, &pages, lru) {
+		/* Unpin the memory first if it was borrowed from movable zone */
+		if (is_zone_movable_page(page))
+			put_page(page);
+		__free_pages(page, compound_order(page));
+	}
+
+	return ret;
+}
+
+static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
+					    unsigned long len,
+					    u32 fd_flags,
+					    u64 heap_flags)
+{
+	struct qcom_sg_buffer *buffer;
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	struct dma_buf *dmabuf;
+	int ret;
+
+	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
+	if (!buffer)
+		return ERR_PTR(-ENOMEM);
+
+	ret = system_qcom_sg_buffer_alloc(heap, buffer, len, false);
+	if (ret)
+		goto free_buf_struct;
+
+	buffer->vmperm = mem_buf_vmperm_alloc(&buffer->sg_table);
+	if (IS_ERR(buffer->vmperm)) {
+		ret = PTR_ERR(buffer->vmperm);
+		goto free_sys_heap_mem;
+	}
+
+	/* create the dmabuf */
+	exp_info.exp_name = dma_heap_get_name(heap);
+	exp_info.size = buffer->len;
+	exp_info.flags = fd_flags;
+	exp_info.priv = buffer;
+	dmabuf = qcom_dma_buf_export(&exp_info, &qcom_sg_buf_ops);
+	if (IS_ERR(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
+		goto free_vmperm;
+	}
+
+	return dmabuf;
+
+free_vmperm:
+	mem_buf_vmperm_release(buffer->vmperm);
+free_sys_heap_mem:
+	qcom_system_heap_free(buffer);
+	return ERR_PTR(ret);
+free_buf_struct:
+	kfree(buffer);
+
+	return ERR_PTR(ret);
+}
+
+static const struct dma_heap_ops system_heap_ops = {
+	.allocate = system_heap_allocate,
+};
+
+void qcom_system_heap_create(const char *name, const char *system_alias, bool uncached)
+{
+	struct dma_heap_export_info exp_info;
+	struct dma_heap *heap;
+	struct qcom_system_heap *sys_heap;
+	int ret;
+
+	ret = dynamic_page_pool_init_shrinker();
+	if (ret)
+		goto out;
+
+	sys_heap = kzalloc(sizeof(*sys_heap), GFP_KERNEL);
+	if (!sys_heap) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	exp_info.name = name;
+	exp_info.ops = &system_heap_ops;
+	exp_info.priv = sys_heap;
+
+	sys_heap->uncached = uncached;
+
+	sys_heap->pool_list = dynamic_page_pool_create_pools(0, NULL);
+	if (IS_ERR(sys_heap->pool_list)) {
+		ret = PTR_ERR(sys_heap->pool_list);
+		goto free_heap;
+	}
+
+	ret = system_heap_create_refill_worker(sys_heap, name);
+	if (ret)
+		goto free_pools;
+
+	heap = dma_heap_add(&exp_info);
+	if (IS_ERR(heap)) {
+		ret = PTR_ERR(heap);
+		goto stop_worker;
+	}
+
+	if (uncached)
+		dma_coerce_mask_and_coherent(dma_heap_get_dev(heap),
+					     DMA_BIT_MASK(64));
+
+	pr_info("%s: DMA-BUF Heap: Created '%s'\n", __func__, name);
+
+	if (system_alias != NULL) {
+		exp_info.name = system_alias;
+
+		heap = dma_heap_add(&exp_info);
+		if (IS_ERR(heap)) {
+			pr_err("%s: Failed to create '%s', error is %ld\n", __func__,
+			       system_alias, PTR_ERR(heap));
+			return;
+		}
+
+		dma_coerce_mask_and_coherent(dma_heap_get_dev(heap), DMA_BIT_MASK(64));
+
+		pr_info("%s: DMA-BUF Heap: Created '%s'\n", __func__, system_alias);
+	}
+
+	return;
+
+stop_worker:
+	system_heap_destroy_refill_worker(sys_heap);
+
+free_pools:
+	dynamic_page_pool_release_pools(sys_heap->pool_list);
+
+free_heap:
+	kfree(sys_heap);
+
+out:
+	pr_err("%s: Failed to create '%s', error is %d\n", __func__, name, ret);
+}
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/qcom_system_heap.h
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/qcom_system_heap.h
@@ -0,0 +1,72 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QCOM_SYSTEM_HEAP_H
+#define _QCOM_SYSTEM_HEAP_H
+
+#include <linux/dma-heap.h>
+#include <linux/err.h>
+#include "qcom_sg_ops.h"
+#include "qcom_dynamic_page_pool.h"
+#include "qcom_sg_ops.h"
+
+struct qcom_system_heap {
+	int uncached;
+	struct dynamic_page_pool **pool_list;
+};
+
+#ifdef CONFIG_QCOM_DMABUF_HEAPS_SYSTEM
+void qcom_system_heap_create(const char *name, const char *system_alias, bool uncached);
+void qcom_system_heap_free(struct qcom_sg_buffer *buffer);
+struct page *qcom_sys_heap_alloc_largest_available(struct dynamic_page_pool **pools,
+						   unsigned long size,
+						   unsigned int max_order,
+						   bool movable);
+int system_qcom_sg_buffer_alloc(struct dma_heap *heap,
+				struct qcom_sg_buffer *buffer,
+				unsigned long len,
+				bool movable);
+enum zone_type dynamic_pool_gfp_zone(gfp_t flags);
+
+bool dynamic_pool_zone_watermark_ok_safe(struct zone *z, unsigned int order,
+					unsigned long mark, int highest_zoneidx);
+#else
+static inline void qcom_system_heap_create(const char *name, const char *system_alias,
+					   bool uncached)
+{
+
+}
+static inline void qcom_system_heap_free(struct qcom_sg_buffer *buffer)
+{
+
+}
+static inline struct page *qcom_sys_heap_alloc_largest_available(struct dynamic_page_pool **pools,
+								 unsigned long size,
+								 unsigned int max_order,
+								 bool movable)
+{
+	return ERR_PTR(-EOPNOTSUPP);
+}
+static inline int system_qcom_sg_buffer_alloc(struct dma_heap *heap,
+					      struct qcom_sg_buffer *buffer,
+					      unsigned long len,
+					      bool movable)
+{
+	return -EOPNOTSUPP;
+}
+enum zone_type dynamic_pool_gfp_zone(gfp_t flags)
+{
+	return -EOPNOTSUPP;
+}
+
+bool dynamic_pool_zone_watermark_ok_safe(struct zone *z, unsigned int order,
+					unsigned long mark, int highest_zoneidx)
+{
+	return -EOPNOTSUPP;
+}
+#endif
+
+#endif /* _QCOM_SYSTEM_HEAP_H */
--- linux-qcom-6.8.0.orig/drivers/dma-buf/heaps/system_heap.c
+++ linux-qcom-6.8.0/drivers/dma-buf/heaps/system_heap.c
@@ -333,8 +333,8 @@
 
 static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
 					    unsigned long len,
-					    unsigned long fd_flags,
-					    unsigned long heap_flags)
+					    u32 fd_flags,
+					    u64 heap_flags)
 {
 	struct system_heap_buffer *buffer;
 	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
--- linux-qcom-6.8.0.orig/drivers/dma-buf/st-dma-fence-chain.c
+++ linux-qcom-6.8.0/drivers/dma-buf/st-dma-fence-chain.c
@@ -84,11 +84,11 @@
 		return -ENOMEM;
 
 	chain = mock_chain(NULL, f, 1);
-	if (!chain)
+	if (chain)
+		dma_fence_enable_sw_signaling(chain);
+	else
 		err = -ENOMEM;
 
-	dma_fence_enable_sw_signaling(chain);
-
 	dma_fence_signal(f);
 	dma_fence_put(f);
 
--- linux-qcom-6.8.0.orig/drivers/dma-buf/st-dma-fence.c
+++ linux-qcom-6.8.0/drivers/dma-buf/st-dma-fence.c
@@ -540,6 +540,12 @@
 			t[i].before = pass;
 			t[i].task = kthread_run(thread_signal_callback, &t[i],
 						"dma-fence:%d", i);
+			if (IS_ERR(t[i].task)) {
+				ret = PTR_ERR(t[i].task);
+				while (--i >= 0)
+					kthread_stop_put(t[i].task);
+				return ret;
+			}
 			get_task_struct(t[i].task);
 		}
 
--- linux-qcom-6.8.0.orig/drivers/dma-buf/sync_debug.c
+++ linux-qcom-6.8.0/drivers/dma-buf/sync_debug.c
@@ -110,12 +110,12 @@
 
 	seq_printf(s, "%s: %d\n", obj->name, obj->value);
 
-	spin_lock_irq(&obj->lock);
+	spin_lock(&obj->lock); /* Caller already disabled IRQ. */
 	list_for_each(pos, &obj->pt_list) {
 		struct sync_pt *pt = container_of(pos, struct sync_pt, link);
 		sync_print_fence(s, &pt->base, false);
 	}
-	spin_unlock_irq(&obj->lock);
+	spin_unlock(&obj->lock);
 }
 
 static void sync_print_sync_file(struct seq_file *s,
--- linux-qcom-6.8.0.orig/drivers/dma-buf/udmabuf.c
+++ linux-qcom-6.8.0/drivers/dma-buf/udmabuf.c
@@ -35,12 +35,13 @@
 	struct vm_area_struct *vma = vmf->vma;
 	struct udmabuf *ubuf = vma->vm_private_data;
 	pgoff_t pgoff = vmf->pgoff;
+	unsigned long pfn;
 
 	if (pgoff >= ubuf->pagecount)
 		return VM_FAULT_SIGBUS;
-	vmf->page = ubuf->pages[pgoff];
-	get_page(vmf->page);
-	return 0;
+
+	pfn = page_to_pfn(ubuf->pages[pgoff]);
+	return vmf_insert_pfn(vma, vmf->address, pfn);
 }
 
 static const struct vm_operations_struct udmabuf_vm_ops = {
@@ -56,6 +57,7 @@
 
 	vma->vm_ops = &udmabuf_vm_ops;
 	vma->vm_private_data = ubuf;
+	vm_flags_set(vma, VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);
 	return 0;
 }
 
@@ -192,7 +194,7 @@
 };
 
 #define SEALS_WANTED (F_SEAL_SHRINK)
-#define SEALS_DENIED (F_SEAL_WRITE)
+#define SEALS_DENIED (F_SEAL_WRITE|F_SEAL_FUTURE_WRITE)
 
 static long udmabuf_create(struct miscdevice *device,
 			   struct udmabuf_create_list *head,
--- linux-qcom-6.8.0.orig/drivers/dma/Kconfig
+++ linux-qcom-6.8.0/drivers/dma/Kconfig
@@ -394,7 +394,7 @@
 
 config MCF_EDMA
 	tristate "Freescale eDMA engine support, ColdFire mcf5441x SoCs"
-	depends on M5441x || COMPILE_TEST
+	depends on M5441x || (COMPILE_TEST && FSL_EDMA=n)
 	select DMA_ENGINE
 	select DMA_VIRTUAL_CHANNELS
 	help
@@ -643,16 +643,16 @@
 
 config TEGRA210_ADMA
 	tristate "NVIDIA Tegra210 ADMA support"
-	depends on (ARCH_TEGRA_210_SOC || COMPILE_TEST)
+	depends on (ARCH_TEGRA || COMPILE_TEST)
 	select DMA_ENGINE
 	select DMA_VIRTUAL_CHANNELS
 	help
-	  Support for the NVIDIA Tegra210 ADMA controller driver. The
-	  DMA controller has multiple DMA channels and is used to service
-	  various audio clients in the Tegra210 audio processing engine
-	  (APE). This DMA controller transfers data from memory to
-	  peripheral and vice versa. It does not support memory to
-	  memory data transfer.
+	  Support for the NVIDIA Tegra210/Tegra186/Tegra194/Tegra234 ADMA
+	  controller driver. The DMA controller has multiple DMA channels
+	  and is used to service various audio clients in the Tegra210
+	  audio processing engine (APE). This DMA controller transfers
+	  data from memory to peripheral and vice versa. It does not
+	  support memory to memory data transfer.
 
 config TIMB_DMA
 	tristate "Timberdale FPGA DMA support"
--- linux-qcom-6.8.0.orig/drivers/dma/altera-msgdma.c
+++ linux-qcom-6.8.0/drivers/dma/altera-msgdma.c
@@ -233,7 +233,7 @@
 	struct msgdma_sw_desc *child, *next;
 
 	mdev->desc_free_cnt++;
-	list_add_tail(&desc->node, &mdev->free_list);
+	list_move_tail(&desc->node, &mdev->free_list);
 	list_for_each_entry_safe(child, next, &desc->tx_list, node) {
 		mdev->desc_free_cnt++;
 		list_move_tail(&child->node, &mdev->free_list);
@@ -583,17 +583,16 @@
 static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev)
 {
 	struct msgdma_sw_desc *desc, *next;
+	unsigned long irqflags;
 
 	list_for_each_entry_safe(desc, next, &mdev->done_list, node) {
 		struct dmaengine_desc_callback cb;
 
-		list_del(&desc->node);
-
 		dmaengine_desc_get_callback(&desc->async_tx, &cb);
 		if (dmaengine_desc_callback_valid(&cb)) {
-			spin_unlock(&mdev->lock);
+			spin_unlock_irqrestore(&mdev->lock, irqflags);
 			dmaengine_desc_callback_invoke(&cb, NULL);
-			spin_lock(&mdev->lock);
+			spin_lock_irqsave(&mdev->lock, irqflags);
 		}
 
 		/* Run any dependencies, then free the descriptor */
--- linux-qcom-6.8.0.orig/drivers/dma/apple-admac.c
+++ linux-qcom-6.8.0/drivers/dma/apple-admac.c
@@ -153,6 +153,8 @@
 {
 	struct admac_sram *sram;
 	int i, ret = 0, nblocks;
+	ad->txcache.size = readl_relaxed(ad->base + REG_TX_SRAM_SIZE);
+	ad->rxcache.size = readl_relaxed(ad->base + REG_RX_SRAM_SIZE);
 
 	if (dir == DMA_MEM_TO_DEV)
 		sram = &ad->txcache;
@@ -912,12 +914,7 @@
 		goto free_irq;
 	}
 
-	ad->txcache.size = readl_relaxed(ad->base + REG_TX_SRAM_SIZE);
-	ad->rxcache.size = readl_relaxed(ad->base + REG_RX_SRAM_SIZE);
-
 	dev_info(&pdev->dev, "Audio DMA Controller\n");
-	dev_info(&pdev->dev, "imprint %x TX cache %u RX cache %u\n",
-		 readl_relaxed(ad->base + REG_IMPRINT), ad->txcache.size, ad->rxcache.size);
 
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/dma/at_xdmac.c
+++ linux-qcom-6.8.0/drivers/dma/at_xdmac.c
@@ -1363,6 +1363,8 @@
 		return NULL;
 
 	desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value);
+	if (!desc)
+		return NULL;
 	list_add_tail(&desc->desc_node, &desc->descs_list);
 
 	desc->tx_dma_desc.cookie = -EBUSY;
--- linux-qcom-6.8.0.orig/drivers/dma/dma-axi-dmac.c
+++ linux-qcom-6.8.0/drivers/dma/dma-axi-dmac.c
@@ -1134,8 +1134,8 @@
 {
 	struct axi_dmac *dmac = platform_get_drvdata(pdev);
 
-	of_dma_controller_free(pdev->dev.of_node);
 	free_irq(dmac->irq, dmac);
+	of_dma_controller_free(pdev->dev.of_node);
 	tasklet_kill(&dmac->chan.vchan.task);
 	dma_async_device_unregister(&dmac->dma_dev);
 	clk_disable_unprepare(dmac->clk);
--- linux-qcom-6.8.0.orig/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ linux-qcom-6.8.0/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -302,6 +302,7 @@
 		kfree(desc);
 		return NULL;
 	}
+	desc->nr_hw_descs = num;
 
 	return desc;
 }
@@ -328,7 +329,7 @@
 static void axi_desc_put(struct axi_dma_desc *desc)
 {
 	struct axi_dma_chan *chan = desc->chan;
-	int count = atomic_read(&chan->descs_allocated);
+	int count = desc->nr_hw_descs;
 	struct axi_dma_hw_desc *hw_desc;
 	int descs_put;
 
@@ -1139,9 +1140,6 @@
 		/* Remove the completed descriptor from issued list before completing */
 		list_del(&vd->node);
 		vchan_cookie_complete(vd);
-
-		/* Submit queued descriptors after processing the completed ones */
-		axi_chan_start_first_queued(chan);
 	}
 
 out:
--- linux-qcom-6.8.0.orig/drivers/dma/dw-axi-dmac/dw-axi-dmac.h
+++ linux-qcom-6.8.0/drivers/dma/dw-axi-dmac/dw-axi-dmac.h
@@ -104,6 +104,7 @@
 	u32				completed_blocks;
 	u32				length;
 	u32				period_len;
+	u32				nr_hw_descs;
 };
 
 struct axi_dma_chan_config {
--- linux-qcom-6.8.0.orig/drivers/dma/dw-edma/dw-hdma-v0-core.c
+++ linux-qcom-6.8.0/drivers/dma/dw-edma/dw-hdma-v0-core.c
@@ -17,8 +17,8 @@
 	DW_HDMA_V0_CB					= BIT(0),
 	DW_HDMA_V0_TCB					= BIT(1),
 	DW_HDMA_V0_LLP					= BIT(2),
-	DW_HDMA_V0_LIE					= BIT(3),
-	DW_HDMA_V0_RIE					= BIT(4),
+	DW_HDMA_V0_LWIE					= BIT(3),
+	DW_HDMA_V0_RWIE					= BIT(4),
 	DW_HDMA_V0_CCS					= BIT(8),
 	DW_HDMA_V0_LLE					= BIT(9),
 };
@@ -195,25 +195,14 @@
 static void dw_hdma_v0_core_write_chunk(struct dw_edma_chunk *chunk)
 {
 	struct dw_edma_burst *child;
-	struct dw_edma_chan *chan = chunk->chan;
 	u32 control = 0, i = 0;
-	int j;
 
 	if (chunk->cb)
 		control = DW_HDMA_V0_CB;
 
-	j = chunk->bursts_alloc;
-	list_for_each_entry(child, &chunk->burst->list, list) {
-		j--;
-		if (!j) {
-			control |= DW_HDMA_V0_LIE;
-			if (!(chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL))
-				control |= DW_HDMA_V0_RIE;
-		}
-
+	list_for_each_entry(child, &chunk->burst->list, list)
 		dw_hdma_v0_write_ll_data(chunk, i++, control, child->sz,
 					 child->sar, child->dar);
-	}
 
 	control = DW_HDMA_V0_LLP | DW_HDMA_V0_TCB;
 	if (!chunk->cb)
@@ -247,10 +236,11 @@
 	if (first) {
 		/* Enable engine */
 		SET_CH_32(dw, chan->dir, chan->id, ch_en, BIT(0));
-		/* Interrupt enable&unmask - done, abort */
-		tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup) |
-		      HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK |
-		      HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN;
+		/* Interrupt unmask - stop, abort */
+		tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup);
+		tmp &= ~(HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK);
+		/* Interrupt enable - stop, abort */
+		tmp |= HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN;
 		if (!(dw->chip->flags & DW_EDMA_CHIP_LOCAL))
 			tmp |= HDMA_V0_REMOTE_STOP_INT_EN | HDMA_V0_REMOTE_ABORT_INT_EN;
 		SET_CH_32(dw, chan->dir, chan->id, int_setup, tmp);
--- linux-qcom-6.8.0.orig/drivers/dma/dw/acpi.c
+++ linux-qcom-6.8.0/drivers/dma/dw/acpi.c
@@ -8,13 +8,15 @@
 
 static bool dw_dma_acpi_filter(struct dma_chan *chan, void *param)
 {
+	struct dw_dma *dw = to_dw_dma(chan->device);
+	struct dw_dma_chip_pdata *data = dev_get_drvdata(dw->dma.dev);
 	struct acpi_dma_spec *dma_spec = param;
 	struct dw_dma_slave slave = {
 		.dma_dev = dma_spec->dev,
 		.src_id = dma_spec->slave_id,
 		.dst_id = dma_spec->slave_id,
-		.m_master = 0,
-		.p_master = 1,
+		.m_master = data->m_master,
+		.p_master = data->p_master,
 	};
 
 	return dw_dma_filter(chan, &slave);
--- linux-qcom-6.8.0.orig/drivers/dma/dw/core.c
+++ linux-qcom-6.8.0/drivers/dma/dw/core.c
@@ -16,6 +16,7 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
+#include <linux/log2.h>
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -621,12 +622,10 @@
 	struct dw_desc		*prev;
 	struct dw_desc		*first;
 	u32			ctllo, ctlhi;
-	u8			m_master = dwc->dws.m_master;
-	u8			lms = DWC_LLP_LMS(m_master);
+	u8			lms = DWC_LLP_LMS(dwc->dws.m_master);
 	dma_addr_t		reg;
 	unsigned int		reg_width;
 	unsigned int		mem_width;
-	unsigned int		data_width = dw->pdata->data_width[m_master];
 	unsigned int		i;
 	struct scatterlist	*sg;
 	size_t			total_len = 0;
@@ -660,7 +659,7 @@
 			mem = sg_dma_address(sg);
 			len = sg_dma_len(sg);
 
-			mem_width = __ffs(data_width | mem | len);
+			mem_width = __ffs(sconfig->src_addr_width | mem | len);
 
 slave_sg_todev_fill_desc:
 			desc = dwc_desc_get(dwc);
@@ -720,7 +719,7 @@
 			lli_write(desc, sar, reg);
 			lli_write(desc, dar, mem);
 			lli_write(desc, ctlhi, ctlhi);
-			mem_width = __ffs(data_width | mem);
+			mem_width = __ffs(sconfig->dst_addr_width | mem);
 			lli_write(desc, ctllo, ctllo | DWC_CTLL_DST_WIDTH(mem_width));
 			desc->len = dlen;
 
@@ -780,17 +779,93 @@
 }
 EXPORT_SYMBOL_GPL(dw_dma_filter);
 
+static int dwc_verify_p_buswidth(struct dma_chan *chan)
+{
+	struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
+	struct dw_dma *dw = to_dw_dma(chan->device);
+	u32 reg_width, max_width;
+
+	if (dwc->dma_sconfig.direction == DMA_MEM_TO_DEV)
+		reg_width = dwc->dma_sconfig.dst_addr_width;
+	else if (dwc->dma_sconfig.direction == DMA_DEV_TO_MEM)
+		reg_width = dwc->dma_sconfig.src_addr_width;
+	else /* DMA_MEM_TO_MEM */
+		return 0;
+
+	max_width = dw->pdata->data_width[dwc->dws.p_master];
+
+	/* Fall-back to 1-byte transfer width if undefined */
+	if (reg_width == DMA_SLAVE_BUSWIDTH_UNDEFINED)
+		reg_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+	else if (!is_power_of_2(reg_width) || reg_width > max_width)
+		return -EINVAL;
+	else /* bus width is valid */
+		return 0;
+
+	/* Update undefined addr width value */
+	if (dwc->dma_sconfig.direction == DMA_MEM_TO_DEV)
+		dwc->dma_sconfig.dst_addr_width = reg_width;
+	else /* DMA_DEV_TO_MEM */
+		dwc->dma_sconfig.src_addr_width = reg_width;
+
+	return 0;
+}
+
+static int dwc_verify_m_buswidth(struct dma_chan *chan)
+{
+	struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
+	struct dw_dma *dw = to_dw_dma(chan->device);
+	u32 reg_width, reg_burst, mem_width;
+
+	mem_width = dw->pdata->data_width[dwc->dws.m_master];
+
+	/*
+	 * It's possible to have a data portion locked in the DMA FIFO in case
+	 * of the channel suspension. Subsequent channel disabling will cause
+	 * that data silent loss. In order to prevent that maintain the src and
+	 * dst transfer widths coherency by means of the relation:
+	 * (CTLx.SRC_TR_WIDTH * CTLx.SRC_MSIZE >= CTLx.DST_TR_WIDTH)
+	 * Look for the details in the commit message that brings this change.
+	 *
+	 * Note the DMA configs utilized in the calculations below must have
+	 * been verified to have correct values by this method call.
+	 */
+	if (dwc->dma_sconfig.direction == DMA_MEM_TO_DEV) {
+		reg_width = dwc->dma_sconfig.dst_addr_width;
+		if (mem_width < reg_width)
+			return -EINVAL;
+
+		dwc->dma_sconfig.src_addr_width = mem_width;
+	} else if (dwc->dma_sconfig.direction == DMA_DEV_TO_MEM) {
+		reg_width = dwc->dma_sconfig.src_addr_width;
+		reg_burst = rounddown_pow_of_two(dwc->dma_sconfig.src_maxburst);
+
+		dwc->dma_sconfig.dst_addr_width = min(mem_width, reg_width * reg_burst);
+	}
+
+	return 0;
+}
+
 static int dwc_config(struct dma_chan *chan, struct dma_slave_config *sconfig)
 {
 	struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
 	struct dw_dma *dw = to_dw_dma(chan->device);
+	int ret;
 
 	memcpy(&dwc->dma_sconfig, sconfig, sizeof(*sconfig));
 
 	dwc->dma_sconfig.src_maxburst =
-		clamp(dwc->dma_sconfig.src_maxburst, 0U, dwc->max_burst);
+		clamp(dwc->dma_sconfig.src_maxburst, 1U, dwc->max_burst);
 	dwc->dma_sconfig.dst_maxburst =
-		clamp(dwc->dma_sconfig.dst_maxburst, 0U, dwc->max_burst);
+		clamp(dwc->dma_sconfig.dst_maxburst, 1U, dwc->max_burst);
+
+	ret = dwc_verify_p_buswidth(chan);
+	if (ret)
+		return ret;
+
+	ret = dwc_verify_m_buswidth(chan);
+	if (ret)
+		return ret;
 
 	dw->encode_maxburst(dwc, &dwc->dma_sconfig.src_maxburst);
 	dw->encode_maxburst(dwc, &dwc->dma_sconfig.dst_maxburst);
--- linux-qcom-6.8.0.orig/drivers/dma/dw/internal.h
+++ linux-qcom-6.8.0/drivers/dma/dw/internal.h
@@ -51,11 +51,15 @@
 	int (*probe)(struct dw_dma_chip *chip);
 	int (*remove)(struct dw_dma_chip *chip);
 	struct dw_dma_chip *chip;
+	u8 m_master;
+	u8 p_master;
 };
 
 static __maybe_unused const struct dw_dma_chip_pdata dw_dma_chip_pdata = {
 	.probe = dw_dma_probe,
 	.remove = dw_dma_remove,
+	.m_master = 0,
+	.p_master = 1,
 };
 
 static const struct dw_dma_platform_data idma32_pdata = {
@@ -72,6 +76,8 @@
 	.pdata = &idma32_pdata,
 	.probe = idma32_dma_probe,
 	.remove = idma32_dma_remove,
+	.m_master = 0,
+	.p_master = 0,
 };
 
 static const struct dw_dma_platform_data xbar_pdata = {
@@ -88,6 +94,8 @@
 	.pdata = &xbar_pdata,
 	.probe = idma32_dma_probe,
 	.remove = idma32_dma_remove,
+	.m_master = 0,
+	.p_master = 0,
 };
 
 #endif /* _DMA_DW_INTERNAL_H */
--- linux-qcom-6.8.0.orig/drivers/dma/dw/pci.c
+++ linux-qcom-6.8.0/drivers/dma/dw/pci.c
@@ -56,10 +56,10 @@
 	if (ret)
 		return ret;
 
-	dw_dma_acpi_controller_register(chip->dw);
-
 	pci_set_drvdata(pdev, data);
 
+	dw_dma_acpi_controller_register(chip->dw);
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/dma/fsl-edma-common.c
+++ linux-qcom-6.8.0/drivers/dma/fsl-edma-common.c
@@ -3,6 +3,7 @@
 // Copyright (c) 2013-2014 Freescale Semiconductor, Inc
 // Copyright (c) 2017 Sysam, Angelo Dureghello  <angelo@sysam.it>
 
+#include <linux/clk.h>
 #include <linux/dmapool.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -74,18 +75,10 @@
 
 	flags = fsl_edma_drvflags(fsl_chan);
 	val = edma_readl_chreg(fsl_chan, ch_sbr);
-	/* Remote/local swapped wrongly on iMX8 QM Audio edma */
-	if (flags & FSL_EDMA_DRV_QUIRK_SWAPPED) {
-		if (!fsl_chan->is_rxchan)
-			val |= EDMA_V3_CH_SBR_RD;
-		else
-			val |= EDMA_V3_CH_SBR_WR;
-	} else {
-		if (fsl_chan->is_rxchan)
-			val |= EDMA_V3_CH_SBR_RD;
-		else
-			val |= EDMA_V3_CH_SBR_WR;
-	}
+	if (fsl_chan->is_rxchan)
+		val |= EDMA_V3_CH_SBR_RD;
+	else
+		val |= EDMA_V3_CH_SBR_WR;
 
 	if (fsl_chan->is_remote)
 		val &= ~(EDMA_V3_CH_SBR_RD | EDMA_V3_CH_SBR_WR);
@@ -97,8 +90,8 @@
 		 * ch_mux: With the exception of 0, attempts to write a value
 		 * already in use will be forced to 0.
 		 */
-		if (!edma_readl_chreg(fsl_chan, ch_mux))
-			edma_writel_chreg(fsl_chan, fsl_chan->srcid, ch_mux);
+		if (!edma_readl(fsl_chan->edma, fsl_chan->mux_addr))
+			edma_writel(fsl_chan->edma, fsl_chan->srcid, fsl_chan->mux_addr);
 	}
 
 	val = edma_readl_chreg(fsl_chan, ch_csr);
@@ -134,7 +127,7 @@
 	flags = fsl_edma_drvflags(fsl_chan);
 
 	if (flags & FSL_EDMA_DRV_HAS_CHMUX)
-		edma_writel_chreg(fsl_chan, 0, ch_mux);
+		edma_writel(fsl_chan->edma, 0, fsl_chan->mux_addr);
 
 	val &= ~EDMA_V3_CH_CSR_ERQ;
 	edma_writel_chreg(fsl_chan, val, ch_csr);
@@ -754,6 +747,8 @@
 	fsl_desc->iscyclic = false;
 
 	fsl_chan->is_sw = true;
+	if (fsl_edma_drvflags(fsl_chan) & FSL_EDMA_DRV_MEM_REMOTE)
+		fsl_chan->is_remote = true;
 
 	/* To match with copy_align and max_seg_size so 1 tcd is enough */
 	fsl_edma_fill_tcd(fsl_chan, fsl_desc->tcd[0].vtcd, dma_src, dma_dst,
@@ -802,6 +797,9 @@
 {
 	struct fsl_edma_chan *fsl_chan = to_fsl_edma_chan(chan);
 
+	if (fsl_edma_drvflags(fsl_chan) & FSL_EDMA_DRV_HAS_CHCLK)
+		clk_prepare_enable(fsl_chan->clk);
+
 	fsl_chan->tcd_pool = dma_pool_create("tcd_pool", chan->device->dev,
 				sizeof(struct fsl_edma_hw_tcd),
 				32, 0);
@@ -829,6 +827,9 @@
 	fsl_chan->tcd_pool = NULL;
 	fsl_chan->is_sw = false;
 	fsl_chan->srcid = 0;
+	fsl_chan->is_remote = false;
+	if (fsl_edma_drvflags(fsl_chan) & FSL_EDMA_DRV_HAS_CHCLK)
+		clk_disable_unprepare(fsl_chan->clk);
 }
 
 void fsl_edma_cleanup_vchan(struct dma_device *dmadev)
--- linux-qcom-6.8.0.orig/drivers/dma/fsl-edma-common.h
+++ linux-qcom-6.8.0/drivers/dma/fsl-edma-common.h
@@ -146,10 +146,12 @@
 	enum dma_data_direction		dma_dir;
 	char				chan_name[32];
 	struct fsl_edma_hw_tcd __iomem *tcd;
+	void __iomem			*mux_addr;
 	u32				real_count;
 	struct work_struct		issue_worker;
 	struct platform_device		*pdev;
 	struct device			*pd_dev;
+	struct device_link		*pd_dev_link;
 	u32				srcid;
 	struct clk			*clk;
 	int                             priority;
@@ -177,8 +179,7 @@
 #define FSL_EDMA_DRV_HAS_PD		BIT(5)
 #define FSL_EDMA_DRV_HAS_CHCLK		BIT(6)
 #define FSL_EDMA_DRV_HAS_CHMUX		BIT(7)
-/* imx8 QM audio edma remote local swapped */
-#define FSL_EDMA_DRV_QUIRK_SWAPPED	BIT(8)
+#define FSL_EDMA_DRV_MEM_REMOTE		BIT(8)
 /* control and status register is in tcd address space, edma3 reg layout */
 #define FSL_EDMA_DRV_SPLIT_REG		BIT(9)
 #define FSL_EDMA_DRV_BUS_8BYTE		BIT(10)
@@ -207,6 +208,8 @@
 	u32			chreg_off;
 	u32			chreg_space_sz;
 	u32			flags;
+	u32			mux_off;	/* channel mux register offset */
+	u32			mux_skip;	/* how much skip for each channel */
 	int			(*setup_irq)(struct platform_device *pdev,
 					     struct fsl_edma_engine *fsl_edma);
 };
--- linux-qcom-6.8.0.orig/drivers/dma/fsl-edma-main.c
+++ linux-qcom-6.8.0/drivers/dma/fsl-edma-main.c
@@ -336,16 +336,19 @@
 };
 
 static struct fsl_edma_drvdata imx8qm_data = {
-	.flags = FSL_EDMA_DRV_HAS_PD | FSL_EDMA_DRV_EDMA3,
+	.flags = FSL_EDMA_DRV_HAS_PD | FSL_EDMA_DRV_EDMA3 | FSL_EDMA_DRV_MEM_REMOTE,
 	.chreg_space_sz = 0x10000,
 	.chreg_off = 0x10000,
 	.setup_irq = fsl_edma3_irq_init,
 };
 
-static struct fsl_edma_drvdata imx8qm_audio_data = {
-	.flags = FSL_EDMA_DRV_QUIRK_SWAPPED | FSL_EDMA_DRV_HAS_PD | FSL_EDMA_DRV_EDMA3,
+static struct fsl_edma_drvdata imx8ulp_data = {
+	.flags = FSL_EDMA_DRV_HAS_CHMUX | FSL_EDMA_DRV_HAS_CHCLK | FSL_EDMA_DRV_HAS_DMACLK |
+		 FSL_EDMA_DRV_EDMA3,
 	.chreg_space_sz = 0x10000,
 	.chreg_off = 0x10000,
+	.mux_off = 0x10000 + offsetof(struct fsl_edma3_ch_reg, ch_mux),
+	.mux_skip = 0x10000,
 	.setup_irq = fsl_edma3_irq_init,
 };
 
@@ -360,6 +363,8 @@
 	.flags = FSL_EDMA_DRV_HAS_CHMUX | FSL_EDMA_DRV_HAS_DMACLK | FSL_EDMA_DRV_EDMA4,
 	.chreg_space_sz = 0x8000,
 	.chreg_off = 0x10000,
+	.mux_off = 0x10000 + offsetof(struct fsl_edma3_ch_reg, ch_mux),
+	.mux_skip = 0x8000,
 	.setup_irq = fsl_edma3_irq_init,
 };
 
@@ -368,17 +373,40 @@
 	{ .compatible = "fsl,ls1028a-edma", .data = &ls1028a_data},
 	{ .compatible = "fsl,imx7ulp-edma", .data = &imx7ulp_data},
 	{ .compatible = "fsl,imx8qm-edma", .data = &imx8qm_data},
-	{ .compatible = "fsl,imx8qm-adma", .data = &imx8qm_audio_data},
+	{ .compatible = "fsl,imx8ulp-edma", .data = &imx8ulp_data},
 	{ .compatible = "fsl,imx93-edma3", .data = &imx93_data3},
 	{ .compatible = "fsl,imx93-edma4", .data = &imx93_data4},
 	{ /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, fsl_edma_dt_ids);
 
+static void fsl_edma3_detach_pd(struct fsl_edma_engine *fsl_edma)
+{
+	struct fsl_edma_chan *fsl_chan;
+	int i;
+
+	for (i = 0; i < fsl_edma->n_chans; i++) {
+		if (fsl_edma->chan_masked & BIT(i))
+			continue;
+		fsl_chan = &fsl_edma->chans[i];
+		if (fsl_chan->pd_dev_link)
+			device_link_del(fsl_chan->pd_dev_link);
+		if (fsl_chan->pd_dev) {
+			dev_pm_domain_detach(fsl_chan->pd_dev, false);
+			pm_runtime_dont_use_autosuspend(fsl_chan->pd_dev);
+			pm_runtime_set_suspended(fsl_chan->pd_dev);
+		}
+	}
+}
+
+static void devm_fsl_edma3_detach_pd(void *data)
+{
+	fsl_edma3_detach_pd(data);
+}
+
 static int fsl_edma3_attach_pd(struct platform_device *pdev, struct fsl_edma_engine *fsl_edma)
 {
 	struct fsl_edma_chan *fsl_chan;
-	struct device_link *link;
 	struct device *pd_chan;
 	struct device *dev;
 	int i;
@@ -394,15 +422,16 @@
 		pd_chan = dev_pm_domain_attach_by_id(dev, i);
 		if (IS_ERR_OR_NULL(pd_chan)) {
 			dev_err(dev, "Failed attach pd %d\n", i);
-			return -EINVAL;
+			goto detach;
 		}
 
-		link = device_link_add(dev, pd_chan, DL_FLAG_STATELESS |
+		fsl_chan->pd_dev_link = device_link_add(dev, pd_chan, DL_FLAG_STATELESS |
 					     DL_FLAG_PM_RUNTIME |
 					     DL_FLAG_RPM_ACTIVE);
-		if (!link) {
+		if (!fsl_chan->pd_dev_link) {
 			dev_err(dev, "Failed to add device_link to %d\n", i);
-			return -EINVAL;
+			dev_pm_domain_detach(pd_chan, false);
+			goto detach;
 		}
 
 		fsl_chan->pd_dev = pd_chan;
@@ -413,6 +442,10 @@
 	}
 
 	return 0;
+
+detach:
+	fsl_edma3_detach_pd(fsl_edma);
+	return -EINVAL;
 }
 
 static int fsl_edma_probe(struct platform_device *pdev)
@@ -421,6 +454,7 @@
 	struct fsl_edma_engine *fsl_edma;
 	const struct fsl_edma_drvdata *drvdata = NULL;
 	u32 chan_mask[2] = {0, 0};
+	char clk_name[36];
 	struct edma_regs *regs;
 	int chans;
 	int ret, i;
@@ -509,6 +543,9 @@
 		ret = fsl_edma3_attach_pd(pdev, fsl_edma);
 		if (ret)
 			return ret;
+		ret = devm_add_action_or_reset(&pdev->dev, devm_fsl_edma3_detach_pd, fsl_edma);
+		if (ret)
+			return ret;
 	}
 
 	INIT_LIST_HEAD(&fsl_edma->dma_dev.channels);
@@ -533,12 +570,23 @@
 				offsetof(struct fsl_edma3_ch_reg, tcd) : 0;
 		fsl_chan->tcd = fsl_edma->membase
 				+ i * drvdata->chreg_space_sz + drvdata->chreg_off + len;
+		fsl_chan->mux_addr = fsl_edma->membase + drvdata->mux_off + i * drvdata->mux_skip;
 
+		if (drvdata->flags & FSL_EDMA_DRV_HAS_CHCLK) {
+			snprintf(clk_name, sizeof(clk_name), "ch%02d", i);
+			fsl_chan->clk = devm_clk_get_enabled(&pdev->dev,
+							     (const char *)clk_name);
+
+			if (IS_ERR(fsl_chan->clk))
+				return PTR_ERR(fsl_chan->clk);
+		}
 		fsl_chan->pdev = pdev;
 		vchan_init(&fsl_chan->vchan, &fsl_edma->dma_dev);
 
 		edma_write_tcdreg(fsl_chan, 0, csr);
 		fsl_edma_chan_mux(fsl_chan, 0, false);
+		if (fsl_chan->edma->drvdata->flags & FSL_EDMA_DRV_HAS_CHCLK)
+			clk_disable_unprepare(fsl_chan->clk);
 	}
 
 	ret = fsl_edma->drvdata->setup_irq(pdev, fsl_edma);
--- linux-qcom-6.8.0.orig/drivers/dma/idma64.c
+++ linux-qcom-6.8.0/drivers/dma/idma64.c
@@ -171,6 +171,10 @@
 	u32 status_err;
 	unsigned short i;
 
+	/* Since IRQ may be shared, check if DMA controller is powered on */
+	if (status == GENMASK(31, 0))
+		return IRQ_NONE;
+
 	dev_vdbg(idma64->dma.dev, "%s: status=%#x\n", __func__, status);
 
 	/* Check if we have any interrupt from the DMA controller */
@@ -594,7 +598,9 @@
 
 	idma64->dma.dev = chip->sysdev;
 
-	dma_set_max_seg_size(idma64->dma.dev, IDMA64C_CTLH_BLOCK_TS_MASK);
+	ret = dma_set_max_seg_size(idma64->dma.dev, IDMA64C_CTLH_BLOCK_TS_MASK);
+	if (ret)
+		return ret;
 
 	ret = dma_async_device_register(&idma64->dma);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/dma/idxd/cdev.c
+++ linux-qcom-6.8.0/drivers/dma/idxd/cdev.c
@@ -342,7 +342,7 @@
 	if (!evl)
 		return;
 
-	spin_lock(&evl->lock);
+	mutex_lock(&evl->lock);
 	status.bits = ioread64(idxd->reg_base + IDXD_EVLSTATUS_OFFSET);
 	t = status.tail;
 	h = status.head;
@@ -354,9 +354,8 @@
 			set_bit(h, evl->bmap);
 		h = (h + 1) % size;
 	}
-	spin_unlock(&evl->lock);
-
 	drain_workqueue(wq->wq);
+	mutex_unlock(&evl->lock);
 }
 
 static int idxd_cdev_release(struct inode *node, struct file *filep)
@@ -401,6 +400,18 @@
 	int rc;
 
 	dev_dbg(&pdev->dev, "%s called\n", __func__);
+
+	/*
+	 * Due to an erratum in some of the devices supported by the driver,
+	 * direct user submission to the device can be unsafe.
+	 * (See document INTEL-SA-01084)
+	 *
+	 * For the devices that exhibit this behavior, require that the user
+	 * has CAP_SYS_RAWIO capabilities.
+	 */
+	if (!idxd->user_submission_safe && !capable(CAP_SYS_RAWIO))
+		return -EPERM;
+
 	rc = check_vma(wq, vma, __func__);
 	if (rc < 0)
 		return rc;
@@ -415,6 +426,70 @@
 			vma->vm_page_prot);
 }
 
+static int idxd_submit_user_descriptor(struct idxd_user_context *ctx,
+				       struct dsa_hw_desc __user *udesc)
+{
+	struct idxd_wq *wq = ctx->wq;
+	struct idxd_dev *idxd_dev = &wq->idxd->idxd_dev;
+	const uint64_t comp_addr_align = is_dsa_dev(idxd_dev) ? 0x20 : 0x40;
+	void __iomem *portal = idxd_wq_portal_addr(wq);
+	struct dsa_hw_desc descriptor __aligned(64);
+	int rc;
+
+	rc = copy_from_user(&descriptor, udesc, sizeof(descriptor));
+	if (rc)
+		return -EFAULT;
+
+	/*
+	 * DSA devices are capable of indirect ("batch") command submission.
+	 * On devices where direct user submissions are not safe, we cannot
+	 * allow this since there is no good way for us to verify these
+	 * indirect commands.
+	 */
+	if (is_dsa_dev(idxd_dev) && descriptor.opcode == DSA_OPCODE_BATCH &&
+		!wq->idxd->user_submission_safe)
+		return -EINVAL;
+	/*
+	 * As per the programming specification, the completion address must be
+	 * aligned to 32 or 64 bytes. If this is violated the hardware
+	 * engine can get very confused (security issue).
+	 */
+	if (!IS_ALIGNED(descriptor.completion_addr, comp_addr_align))
+		return -EINVAL;
+
+	if (wq_dedicated(wq))
+		iosubmit_cmds512(portal, &descriptor, 1);
+	else {
+		descriptor.priv = 0;
+		descriptor.pasid = ctx->pasid;
+		rc = idxd_enqcmds(wq, portal, &descriptor);
+		if (rc < 0)
+			return rc;
+	}
+
+	return 0;
+}
+
+static ssize_t idxd_cdev_write(struct file *filp, const char __user *buf, size_t len,
+			       loff_t *unused)
+{
+	struct dsa_hw_desc __user *udesc = (struct dsa_hw_desc __user *)buf;
+	struct idxd_user_context *ctx = filp->private_data;
+	ssize_t written = 0;
+	int i;
+
+	for (i = 0; i < len/sizeof(struct dsa_hw_desc); i++) {
+		int rc = idxd_submit_user_descriptor(ctx, udesc + i);
+
+		if (rc)
+			return written ? written : rc;
+
+		written += sizeof(struct dsa_hw_desc);
+	}
+
+	return written;
+}
+
 static __poll_t idxd_cdev_poll(struct file *filp,
 			       struct poll_table_struct *wait)
 {
@@ -437,6 +512,7 @@
 	.open = idxd_cdev_open,
 	.release = idxd_cdev_release,
 	.mmap = idxd_cdev_mmap,
+	.write = idxd_cdev_write,
 	.poll = idxd_cdev_poll,
 };
 
@@ -501,7 +577,6 @@
 	struct idxd_cdev *idxd_cdev;
 
 	idxd_cdev = wq->idxd_cdev;
-	ida_destroy(&file_ida);
 	wq->idxd_cdev = NULL;
 	cdev_device_del(&idxd_cdev->cdev, cdev_dev(idxd_cdev));
 	put_device(cdev_dev(idxd_cdev));
--- linux-qcom-6.8.0.orig/drivers/dma/idxd/debugfs.c
+++ linux-qcom-6.8.0/drivers/dma/idxd/debugfs.c
@@ -66,7 +66,7 @@
 	if (!evl || !evl->log)
 		return 0;
 
-	spin_lock(&evl->lock);
+	mutex_lock(&evl->lock);
 
 	evl_status.bits = ioread64(idxd->reg_base + IDXD_EVLSTATUS_OFFSET);
 	t = evl_status.tail;
@@ -87,7 +87,7 @@
 		dump_event_entry(idxd, s, i, &count, processed);
 	}
 
-	spin_unlock(&evl->lock);
+	mutex_unlock(&evl->lock);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/dma/idxd/device.c
+++ linux-qcom-6.8.0/drivers/dma/idxd/device.c
@@ -775,7 +775,7 @@
 		goto err_alloc;
 	}
 
-	spin_lock(&evl->lock);
+	mutex_lock(&evl->lock);
 	evl->log = addr;
 	evl->dma = dma_addr;
 	evl->log_size = size;
@@ -796,7 +796,7 @@
 	gencfg.evl_en = 1;
 	iowrite32(gencfg.bits, idxd->reg_base + IDXD_GENCFG_OFFSET);
 
-	spin_unlock(&evl->lock);
+	mutex_unlock(&evl->lock);
 	return 0;
 
 err_alloc:
@@ -819,7 +819,7 @@
 	if (!gencfg.evl_en)
 		return;
 
-	spin_lock(&evl->lock);
+	mutex_lock(&evl->lock);
 	gencfg.evl_en = 0;
 	iowrite32(gencfg.bits, idxd->reg_base + IDXD_GENCFG_OFFSET);
 
@@ -836,7 +836,7 @@
 	evl_dma = evl->dma;
 	evl->log = NULL;
 	evl->size = IDXD_EVL_SIZE_MIN;
-	spin_unlock(&evl->lock);
+	mutex_unlock(&evl->lock);
 
 	dma_free_coherent(dev, evl_log_size, evl_log, evl_dma);
 }
--- linux-qcom-6.8.0.orig/drivers/dma/idxd/idxd.h
+++ linux-qcom-6.8.0/drivers/dma/idxd/idxd.h
@@ -288,12 +288,13 @@
 	int evl_cr_off;
 	int cr_status_off;
 	int cr_result_off;
+	bool user_submission_safe;
 	load_device_defaults_fn_t load_device_defaults;
 };
 
 struct idxd_evl {
 	/* Lock to protect event log access. */
-	spinlock_t lock;
+	struct mutex lock;
 	void *log;
 	dma_addr_t dma;
 	/* Total size of event log = number of entries * entry size. */
@@ -374,6 +375,8 @@
 
 	struct dentry *dbgfs_dir;
 	struct dentry *dbgfs_evl_file;
+
+	bool user_submission_safe;
 };
 
 static inline unsigned int evl_ent_size(struct idxd_device *idxd)
--- linux-qcom-6.8.0.orig/drivers/dma/idxd/init.c
+++ linux-qcom-6.8.0/drivers/dma/idxd/init.c
@@ -47,6 +47,7 @@
 		.align = 32,
 		.dev_type = &dsa_device_type,
 		.evl_cr_off = offsetof(struct dsa_evl_entry, cr),
+		.user_submission_safe = false, /* See INTEL-SA-01084 erratum */
 		.cr_status_off = offsetof(struct dsa_completion_record, status),
 		.cr_result_off = offsetof(struct dsa_completion_record, result),
 	},
@@ -57,6 +58,7 @@
 		.align = 64,
 		.dev_type = &iax_device_type,
 		.evl_cr_off = offsetof(struct iax_evl_entry, cr),
+		.user_submission_safe = false, /* See INTEL-SA-01084 erratum */
 		.cr_status_off = offsetof(struct iax_completion_record, status),
 		.cr_result_off = offsetof(struct iax_completion_record, error_code),
 		.load_device_defaults = idxd_load_iaa_device_defaults,
@@ -354,7 +356,7 @@
 	if (!evl)
 		return -ENOMEM;
 
-	spin_lock_init(&evl->lock);
+	mutex_init(&evl->lock);
 	evl->size = IDXD_EVL_SIZE_MIN;
 
 	idxd_name = dev_name(idxd_confdev(idxd));
@@ -774,6 +776,8 @@
 	dev_info(&pdev->dev, "Intel(R) Accelerator Device (v%x)\n",
 		 idxd->hw.version);
 
+	idxd->user_submission_safe = data->user_submission_safe;
+
 	return 0;
 
  err_dev_register:
--- linux-qcom-6.8.0.orig/drivers/dma/idxd/irq.c
+++ linux-qcom-6.8.0/drivers/dma/idxd/irq.c
@@ -363,7 +363,7 @@
 	evl_status.bits = 0;
 	evl_status.int_pending = 1;
 
-	spin_lock(&evl->lock);
+	mutex_lock(&evl->lock);
 	/* Clear interrupt pending bit */
 	iowrite32(evl_status.bits_upper32,
 		  idxd->reg_base + IDXD_EVLSTATUS_OFFSET + sizeof(u32));
@@ -380,7 +380,7 @@
 
 	evl_status.head = h;
 	iowrite32(evl_status.bits_lower32, idxd->reg_base + IDXD_EVLSTATUS_OFFSET);
-	spin_unlock(&evl->lock);
+	mutex_unlock(&evl->lock);
 }
 
 irqreturn_t idxd_misc_thread(int vec, void *data)
@@ -611,11 +611,13 @@
 
 	spin_unlock(&irq_entry->list_lock);
 
-	list_for_each_entry(desc, &flist, list) {
+	list_for_each_entry_safe(desc, n, &flist, list) {
 		/*
 		 * Check against the original status as ABORT is software defined
 		 * and 0xff, which DSA_COMP_STATUS_MASK can mask out.
 		 */
+		list_del(&desc->list);
+
 		if (unlikely(desc->completion->status == IDXD_COMP_DESC_ABORT)) {
 			idxd_desc_complete(desc, IDXD_COMPLETE_ABORT, true);
 			continue;
--- linux-qcom-6.8.0.orig/drivers/dma/idxd/perfmon.c
+++ linux-qcom-6.8.0/drivers/dma/idxd/perfmon.c
@@ -528,14 +528,11 @@
 		return 0;
 
 	target = cpumask_any_but(cpu_online_mask, cpu);
-
 	/* migrate events if there is a valid target */
-	if (target < nr_cpu_ids)
+	if (target < nr_cpu_ids) {
 		cpumask_set_cpu(target, &perfmon_dsa_cpu_mask);
-	else
-		target = -1;
-
-	perf_pmu_migrate_context(&idxd_pmu->pmu, cpu, target);
+		perf_pmu_migrate_context(&idxd_pmu->pmu, cpu, target);
+	}
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/dma/idxd/registers.h
+++ linux-qcom-6.8.0/drivers/dma/idxd/registers.h
@@ -6,9 +6,6 @@
 #include <uapi/linux/idxd.h>
 
 /* PCI Config */
-#define PCI_DEVICE_ID_INTEL_DSA_SPR0	0x0b25
-#define PCI_DEVICE_ID_INTEL_IAX_SPR0	0x0cfe
-
 #define DEVICE_VERSION_1		0x100
 #define DEVICE_VERSION_2		0x200
 
--- linux-qcom-6.8.0.orig/drivers/dma/idxd/sysfs.c
+++ linux-qcom-6.8.0/drivers/dma/idxd/sysfs.c
@@ -1197,12 +1197,35 @@
 static struct device_attribute dev_attr_wq_enqcmds_retries =
 		__ATTR(enqcmds_retries, 0644, wq_enqcmds_retries_show, wq_enqcmds_retries_store);
 
+static ssize_t op_cap_show_common(struct device *dev, char *buf, unsigned long *opcap_bmap)
+{
+	ssize_t pos;
+	int i;
+
+	pos = 0;
+	for (i = IDXD_MAX_OPCAP_BITS/64 - 1; i >= 0; i--) {
+		unsigned long val = opcap_bmap[i];
+
+		/* On systems where direct user submissions are not safe, we need to clear out
+		 * the BATCH capability from the capability mask in sysfs since we cannot support
+		 * that command on such systems.
+		 */
+		if (i == DSA_OPCODE_BATCH/64 && !confdev_to_idxd(dev)->user_submission_safe)
+			clear_bit(DSA_OPCODE_BATCH % 64, &val);
+
+		pos += sysfs_emit_at(buf, pos, "%*pb", 64, &val);
+		pos += sysfs_emit_at(buf, pos, "%c", i == 0 ? '\n' : ',');
+	}
+
+	return pos;
+}
+
 static ssize_t wq_op_config_show(struct device *dev,
 				 struct device_attribute *attr, char *buf)
 {
 	struct idxd_wq *wq = confdev_to_wq(dev);
 
-	return sysfs_emit(buf, "%*pb\n", IDXD_MAX_OPCAP_BITS, wq->opcap_bmap);
+	return op_cap_show_common(dev, buf, wq->opcap_bmap);
 }
 
 static int idxd_verify_supported_opcap(struct idxd_device *idxd, unsigned long *opmask)
@@ -1455,7 +1478,7 @@
 {
 	struct idxd_device *idxd = confdev_to_idxd(dev);
 
-	return sysfs_emit(buf, "%*pb\n", IDXD_MAX_OPCAP_BITS, idxd->opcap_bmap);
+	return op_cap_show_common(dev, buf, idxd->opcap_bmap);
 }
 static DEVICE_ATTR_RO(op_cap);
 
--- linux-qcom-6.8.0.orig/drivers/dma/ioat/init.c
+++ linux-qcom-6.8.0/drivers/dma/ioat/init.c
@@ -534,18 +534,6 @@
 	return err;
 }
 
-static int ioat_register(struct ioatdma_device *ioat_dma)
-{
-	int err = dma_async_device_register(&ioat_dma->dma_dev);
-
-	if (err) {
-		ioat_disable_interrupts(ioat_dma);
-		dma_pool_destroy(ioat_dma->completion_pool);
-	}
-
-	return err;
-}
-
 static void ioat_dma_remove(struct ioatdma_device *ioat_dma)
 {
 	struct dma_device *dma = &ioat_dma->dma_dev;
@@ -1181,9 +1169,9 @@
 		       ioat_chan->reg_base + IOAT_DCACTRL_OFFSET);
 	}
 
-	err = ioat_register(ioat_dma);
+	err = dma_async_device_register(&ioat_dma->dma_dev);
 	if (err)
-		return err;
+		goto err_disable_interrupts;
 
 	ioat_kobject_add(ioat_dma, &ioat_ktype);
 
@@ -1192,20 +1180,29 @@
 
 	/* disable relaxed ordering */
 	err = pcie_capability_read_word(pdev, PCI_EXP_DEVCTL, &val16);
-	if (err)
-		return pcibios_err_to_errno(err);
+	if (err) {
+		err = pcibios_err_to_errno(err);
+		goto err_disable_interrupts;
+	}
 
 	/* clear relaxed ordering enable */
 	val16 &= ~PCI_EXP_DEVCTL_RELAX_EN;
 	err = pcie_capability_write_word(pdev, PCI_EXP_DEVCTL, val16);
-	if (err)
-		return pcibios_err_to_errno(err);
+	if (err) {
+		err = pcibios_err_to_errno(err);
+		goto err_disable_interrupts;
+	}
 
 	if (ioat_dma->cap & IOAT_CAP_DPS)
 		writeb(ioat_pending_level + 1,
 		       ioat_dma->reg_base + IOAT_PREFETCH_LIMIT_OFFSET);
 
 	return 0;
+
+err_disable_interrupts:
+	ioat_disable_interrupts(ioat_dma);
+	dma_pool_destroy(ioat_dma->completion_pool);
+	return err;
 }
 
 static void ioat_shutdown(struct pci_dev *pdev)
@@ -1350,6 +1347,8 @@
 	void __iomem * const *iomap;
 	struct device *dev = &pdev->dev;
 	struct ioatdma_device *device;
+	unsigned int i;
+	u8 version;
 	int err;
 
 	err = pcim_enable_device(pdev);
@@ -1363,6 +1362,10 @@
 	if (!iomap)
 		return -ENOMEM;
 
+	version = readb(iomap[IOAT_MMIO_BAR] + IOAT_VER_OFFSET);
+	if (version < IOAT_VER_3_0)
+		return -ENODEV;
+
 	err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
 	if (err)
 		return err;
@@ -1373,17 +1376,18 @@
 	pci_set_master(pdev);
 	pci_set_drvdata(pdev, device);
 
-	device->version = readb(device->reg_base + IOAT_VER_OFFSET);
+	device->version = version;
 	if (device->version >= IOAT_VER_3_4)
 		ioat_dca_enabled = 0;
-	if (device->version >= IOAT_VER_3_0) {
-		if (is_skx_ioat(pdev))
-			device->version = IOAT_VER_3_2;
-		err = ioat3_dma_probe(device, ioat_dca_enabled);
-	} else
-		return -ENODEV;
 
+	if (is_skx_ioat(pdev))
+		device->version = IOAT_VER_3_2;
+
+	err = ioat3_dma_probe(device, ioat_dca_enabled);
 	if (err) {
+		for (i = 0; i < IOAT_MAX_CHANS; i++)
+			kfree(device->idx[i]);
+		kfree(device);
 		dev_err(dev, "Intel(R) I/OAT DMA Engine init failed\n");
 		return -ENODEV;
 	}
@@ -1445,6 +1449,7 @@
 static void __exit ioat_exit_module(void)
 {
 	pci_unregister_driver(&ioat_pci_driver);
+	kmem_cache_destroy(ioat_sed_cache);
 	kmem_cache_destroy(ioat_cache);
 }
 module_exit(ioat_exit_module);
--- linux-qcom-6.8.0.orig/drivers/dma/ls2x-apb-dma.c
+++ linux-qcom-6.8.0/drivers/dma/ls2x-apb-dma.c
@@ -31,7 +31,7 @@
 #define LDMA_ASK_VALID		BIT(2)
 #define LDMA_START		BIT(3) /* DMA start operation */
 #define LDMA_STOP		BIT(4) /* DMA stop operation */
-#define LDMA_CONFIG_MASK	GENMASK(4, 0) /* DMA controller config bits mask */
+#define LDMA_CONFIG_MASK	GENMASK_ULL(4, 0) /* DMA controller config bits mask */
 
 /* Bitfields in ndesc_addr field of HW decriptor */
 #define LDMA_DESC_EN		BIT(0) /*1: The next descriptor is valid */
--- linux-qcom-6.8.0.orig/drivers/dma/mv_xor.c
+++ linux-qcom-6.8.0/drivers/dma/mv_xor.c
@@ -1388,6 +1388,7 @@
 			irq = irq_of_parse_and_map(np, 0);
 			if (!irq) {
 				ret = -ENODEV;
+				of_node_put(np);
 				goto err_channel_add;
 			}
 
@@ -1396,6 +1397,7 @@
 			if (IS_ERR(chan)) {
 				ret = PTR_ERR(chan);
 				irq_dispose_mapping(irq);
+				of_node_put(np);
 				goto err_channel_add;
 			}
 
--- linux-qcom-6.8.0.orig/drivers/dma/owl-dma.c
+++ linux-qcom-6.8.0/drivers/dma/owl-dma.c
@@ -250,7 +250,7 @@
 	else
 		regval &= ~val;
 
-	writel(val, pchan->base + reg);
+	writel(regval, pchan->base + reg);
 }
 
 static void pchan_writel(struct owl_dma_pchan *pchan, u32 reg, u32 data)
@@ -274,7 +274,7 @@
 	else
 		regval &= ~val;
 
-	writel(val, od->base + reg);
+	writel(regval, od->base + reg);
 }
 
 static void dma_writel(struct owl_dma *od, u32 reg, u32 data)
--- linux-qcom-6.8.0.orig/drivers/dma/pl330.c
+++ linux-qcom-6.8.0/drivers/dma/pl330.c
@@ -1053,9 +1053,6 @@
 
 	thrd->req_running = idx;
 
-	if (desc->rqtype == DMA_MEM_TO_DEV || desc->rqtype == DMA_DEV_TO_MEM)
-		UNTIL(thrd, PL330_STATE_WFP);
-
 	return true;
 }
 
--- linux-qcom-6.8.0.orig/drivers/dma/qcom/bam_dma.c
+++ linux-qcom-6.8.0/drivers/dma/qcom/bam_dma.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2021 The Linux Foundation. All rights reserved.
  */
 /*
  * QCOM BAM DMA engine driver
@@ -39,6 +39,7 @@
 #include <linux/of_dma.h>
 #include <linux/circ_buf.h>
 #include <linux/clk.h>
+#include <linux/dma/qcom_bam_dma.h>
 #include <linux/dmaengine.h>
 #include <linux/pm_runtime.h>
 
@@ -58,6 +59,8 @@
 #define DESC_FLAG_EOB BIT(13)
 #define DESC_FLAG_NWD BIT(12)
 #define DESC_FLAG_CMD BIT(11)
+#define DESC_FLAG_LOCK BIT(10)
+#define DESC_FLAG_UNLOCK BIT(9)
 
 struct bam_async_desc {
 	struct virt_dma_desc vd;
@@ -338,7 +341,10 @@
 /* BAM_P_SW_OFSTS */
 #define P_SW_OFSTS_MASK		0xffff
 
-#define BAM_DESC_FIFO_SIZE	SZ_32K
+#define MSM_SLIM_DESC_NUM	32
+#define MSM_SLIM_DESC_FIFO_SIZE	(MSM_SLIM_DESC_NUM * 8)
+#define BAM_DESC_FIFO_SIZE	(bdev->r_mem.is_r_mem ? (MSM_SLIM_DESC_FIFO_SIZE) : SZ_32K)
+
 #define MAX_DESCRIPTORS (BAM_DESC_FIFO_SIZE / sizeof(struct bam_desc_hw) - 1)
 #define BAM_FIFO_SIZE	(SZ_32K - 8)
 #define IS_BUSY(chan)	(CIRC_SPACE(bchan->tail, bchan->head,\
@@ -377,6 +383,26 @@
 	return container_of(common, struct bam_chan, vc.chan);
 }
 
+/**
+ * struct remote_mem - Stores remote memory information
+ * @r_res:	Memory resource structure parsed from devicetree
+ * @r_vbase:	Virtual base address of remote memory region
+ * @r_vsbase:	Saved virtual base address of remote memory region
+ * @r_pbase:	Physical base address of remote memory region
+ * @is_r_mem:	Indicates if remote memory is used or not
+ *
+ * Some BAM clients require the use of a specific memory region for the
+ * pipe descriptor fifo. This structure is used to hold the remote
+ * memory region information.
+ */
+struct remote_mem {
+	struct resource *r_res;
+	void __iomem *r_vbase;
+	void __iomem *r_vsbase;
+	u32 r_pbase;
+	bool is_r_mem;
+};
+
 struct bam_device {
 	void __iomem *regs;
 	struct device *dev;
@@ -398,6 +424,7 @@
 
 	/* dma start transaction tasklet */
 	struct tasklet_struct task;
+	struct remote_mem r_mem;
 };
 
 /**
@@ -501,7 +528,7 @@
 	writel_relaxed(ALIGN(bchan->fifo_phys, sizeof(struct bam_desc_hw)),
 			bam_addr(bdev, bchan->id, BAM_P_DESC_FIFO_ADDR));
 	writel_relaxed(BAM_FIFO_SIZE,
-			bam_addr(bdev, bchan->id, BAM_P_FIFO_SIZES));
+		       bam_addr(bdev, bchan->id, BAM_P_FIFO_SIZES));
 
 	/* enable the per pipe interrupts, enable EOT, ERR, and INT irqs */
 	writel_relaxed(P_DEFAULT_IRQS_EN,
@@ -543,9 +570,20 @@
 	if (bchan->fifo_virt)
 		return 0;
 
-	/* allocate FIFO descriptor space, but only if necessary */
-	bchan->fifo_virt = dma_alloc_wc(bdev->dev, BAM_DESC_FIFO_SIZE,
-					&bchan->fifo_phys, GFP_KERNEL);
+	if (bdev->r_mem.is_r_mem) {
+		bchan->fifo_virt = bdev->r_mem.r_vbase;
+		bchan->fifo_phys = bdev->r_mem.r_res->start;
+	} else {
+		/* allocate FIFO descriptor space, but only if necessary */
+		bchan->fifo_virt = dma_alloc_wc(bdev->dev, BAM_DESC_FIFO_SIZE,
+						&bchan->fifo_phys, GFP_KERNEL);
+	}
+
+	if (bdev->r_mem.is_r_mem) {
+		memset_io(bchan->fifo_virt, 0x0, MSM_SLIM_DESC_NUM * 8);
+		bdev->r_mem.r_vbase = bdev->r_mem.r_vbase + (MSM_SLIM_DESC_NUM * 8);
+		bdev->r_mem.r_res->start = bdev->r_mem.r_res->start + (MSM_SLIM_DESC_NUM * 8);
+	}
 
 	if (!bchan->fifo_virt) {
 		dev_err(bdev->dev, "Failed to allocate desc fifo\n");
@@ -588,9 +626,16 @@
 	bam_reset_channel(bchan);
 	spin_unlock_irqrestore(&bchan->vc.lock, flags);
 
-	dma_free_wc(bdev->dev, BAM_DESC_FIFO_SIZE, bchan->fifo_virt,
-		    bchan->fifo_phys);
+	if (!bdev->r_mem.is_r_mem) {
+		dma_free_wc(bdev->dev, BAM_DESC_FIFO_SIZE, bchan->fifo_virt,
+			    bchan->fifo_phys);
+	} else {
+		bdev->r_mem.r_vbase = bdev->r_mem.r_vsbase;
+		bdev->r_mem.r_res->start = bdev->r_mem.r_pbase;
+	}
+
 	bchan->fifo_virt = NULL;
+	bchan->fifo_phys = 0;
 
 	/* mask irq for pipe/channel */
 	val = readl_relaxed(bam_addr(bdev, 0, BAM_IRQ_SRCS_MSK_EE));
@@ -657,7 +702,6 @@
 	struct bam_desc_hw *desc;
 	unsigned int num_alloc = 0;
 
-
 	if (!is_slave_direction(direction)) {
 		dev_err(bdev->dev, "invalid dma direction\n");
 		return NULL;
@@ -686,6 +730,13 @@
 
 	/* fill in temporary descriptors */
 	desc = async_desc->desc;
+	if (flags & DMA_PREP_CMD) {
+		if (flags & DMA_PREP_LOCK)
+			desc->flags |= cpu_to_le16(DESC_FLAG_LOCK);
+		if (flags & DMA_PREP_UNLOCK)
+			desc->flags |= cpu_to_le16(DESC_FLAG_UNLOCK);
+	}
+
 	for_each_sg(sgl, sg, sg_len, i) {
 		unsigned int remainder = sg_dma_len(sg);
 		unsigned int curr_offset = 0;
@@ -1140,6 +1191,7 @@
 static void bam_issue_pending(struct dma_chan *chan)
 {
 	struct bam_chan *bchan = to_bam_chan(chan);
+	struct bam_device *bdev = bchan->bdev;
 	unsigned long flags;
 
 	spin_lock_irqsave(&bchan->vc.lock, flags);
@@ -1237,6 +1289,7 @@
 {
 	struct bam_device *bdev;
 	const struct of_device_id *match;
+	struct resource *remote_res;
 	int ret, i;
 
 	bdev = devm_kzalloc(&pdev->dev, sizeof(*bdev), GFP_KERNEL);
@@ -1257,6 +1310,31 @@
 	if (IS_ERR(bdev->regs))
 		return PTR_ERR(bdev->regs);
 
+	bdev->r_mem.is_r_mem = false;
+	remote_res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+						  "bam_remote_mem");
+	if (remote_res) {
+		bdev->r_mem.is_r_mem = true;
+		bdev->r_mem.r_pbase = (unsigned long long)remote_res->start;
+		bdev->r_mem.r_vbase = devm_ioremap(&pdev->dev,
+						   remote_res->start,
+						   resource_size(remote_res));
+
+		if (!bdev->r_mem.r_vbase) {
+			dev_err(&pdev->dev, "Remote mem ioremap failed\n");
+			return -ENOMEM;
+		}
+
+		bdev->r_mem.r_vsbase = bdev->r_mem.r_vbase;
+		bdev->r_mem.r_res = remote_res;
+	}
+
+	ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+	if (ret) {
+		dev_err(&pdev->dev, "Could not set 32 bit mask\n");
+		return -ENODEV;
+	}
+
 	bdev->irq = platform_get_irq(pdev, 0);
 	if (bdev->irq < 0)
 		return bdev->irq;
@@ -1336,6 +1414,7 @@
 	/* set capabilities */
 	dma_cap_zero(bdev->common.cap_mask);
 	dma_cap_set(DMA_SLAVE, bdev->common.cap_mask);
+	dma_cap_set(DMA_PRIVATE, bdev->common.cap_mask);
 
 	/* initialize dmaengine apis */
 	bdev->common.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
--- linux-qcom-6.8.0.orig/drivers/dma/qcom/gpi.c
+++ linux-qcom-6.8.0/drivers/dma/qcom/gpi.c
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
  * Copyright (c) 2020, Linaro Limited
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <dt-bindings/dma/qcom-gpi.h>
@@ -27,6 +28,7 @@
 #define TRE_FLAGS_IEOT		BIT(9)
 #define TRE_FLAGS_BEI		BIT(10)
 #define TRE_FLAGS_LINK		BIT(11)
+#define TRE_FLAGS_IMMEDIATE_DMA	BIT(16)
 #define TRE_FLAGS_TYPE		GENMASK(23, 16)
 
 /* SPI CONFIG0 WD0 */
@@ -64,6 +66,15 @@
 
 /* DMA TRE */
 #define TRE_DMA_LEN		GENMASK(23, 0)
+#define TRE_DMA_IMMEDIATE_LEN	GENMASK(3, 0)
+
+/* Lock TRE */
+#define TRE_I2C_LOCK		BIT(0)
+#define TRE_MINOR_TYPE		GENMASK(19, 16)
+#define TRE_MAJOR_TYPE		GENMASK(23, 20)
+
+/* Lock Unlock TRE */
+#define TRE_I2C_UNLOCK		BIT(8)
 
 /* Register offsets from gpi-top */
 #define GPII_n_CH_k_CNTXT_0_OFFS(n, k)	(0x20000 + (0x4000 * (n)) + (0x80 * (k)))
@@ -522,7 +533,7 @@
 	bool ieob_set;
 };
 
-#define MAX_TRE 3
+#define MAX_TRE 5
 
 struct gpi_desc {
 	struct virt_dma_desc vd;
@@ -1076,8 +1087,17 @@
 	dev_dbg(gpii->gpi_dev->dev, "Residue %d\n", result.residue);
 
 	dma_cookie_complete(&vd->tx);
-	dmaengine_desc_get_callback_invoke(&vd->tx, &result);
-
+	if (gchan->protocol == QCOM_GPI_I2C) {
+		struct dmaengine_desc_callback cb;
+		struct gpi_i2c_config *i2c;
+
+		dmaengine_desc_get_callback(&vd->tx, &cb);
+		i2c = cb.callback_param;
+		i2c->status = compl_event->status;
+		dmaengine_desc_callback_invoke(&cb, &result);
+	} else {
+		dmaengine_desc_get_callback_invoke(&vd->tx, &result);
+	}
 gpi_free_desc:
 	spin_lock_irqsave(&gchan->vc.lock, flags);
 	list_del(&vd->node);
@@ -1644,6 +1664,20 @@
 	struct gpi_tre *tre;
 	unsigned int i;
 
+	/* create lock tre for first tranfser */
+	if (i2c->shared_se && i2c->first_msg) {
+		tre = &desc->tre[tre_idx];
+		tre_idx++;
+
+		/* lock: chain bit set */
+		tre->dword[0] = 0;
+		tre->dword[1] = 0;
+		tre->dword[2] = 0;
+		tre->dword[3] = u32_encode_bits(1, TRE_I2C_LOCK);
+		tre->dword[3] |= u32_encode_bits(0, TRE_MINOR_TYPE);
+		tre->dword[3] |= u32_encode_bits(3, TRE_MAJOR_TYPE);
+	}
+
 	/* first create config tre if applicable */
 	if (i2c->set_config) {
 		tre = &desc->tre[tre_idx];
@@ -1702,6 +1736,20 @@
 		tre->dword[3] |= u32_encode_bits(1, TRE_FLAGS_IEOT);
 	}
 
+	/* Unlock tre for last transfer */
+	if (i2c->shared_se && i2c->last_msg && i2c->op != I2C_READ) {
+		tre = &desc->tre[tre_idx];
+		tre_idx++;
+
+		/* unlock tre: ieob set */
+		tre->dword[0] = 0;
+		tre->dword[1] = 0;
+		tre->dword[2] = 0;
+		tre->dword[3] = u32_encode_bits(1, TRE_I2C_UNLOCK);
+		tre->dword[3] |= u32_encode_bits(1, TRE_MINOR_TYPE);
+		tre->dword[3] |= u32_encode_bits(3, TRE_MAJOR_TYPE);
+	}
+
 	for (i = 0; i < tre_idx; i++)
 		dev_dbg(dev, "TRE:%d %x:%x:%x:%x\n", i, desc->tre[i].dword[0],
 			desc->tre[i].dword[1], desc->tre[i].dword[2], desc->tre[i].dword[3]);
@@ -1718,6 +1766,8 @@
 	dma_addr_t address;
 	struct gpi_tre *tre;
 	unsigned int i;
+	u8 *buf;
+	int len = 0;
 
 	/* first create config tre if applicable */
 	if (direction == DMA_MEM_TO_DEV && spi->set_config) {
@@ -1770,14 +1820,32 @@
 	tre_idx++;
 
 	address = sg_dma_address(sgl);
-	tre->dword[0] = lower_32_bits(address);
-	tre->dword[1] = upper_32_bits(address);
+	len = sg_dma_len(sgl);
 
-	tre->dword[2] = u32_encode_bits(sg_dma_len(sgl), TRE_DMA_LEN);
+	/* Support Immediate dma for write transfers for data length up to 8 bytes */
+	if ((spi->flags & QCOM_GPI_IMMEDIATE_DMA) && direction == DMA_MEM_TO_DEV) {
+		buf = (u8 *)sg_virt(sgl);
 
-	tre->dword[3] = u32_encode_bits(TRE_TYPE_DMA, TRE_FLAGS_TYPE);
-	if (direction == DMA_MEM_TO_DEV)
+		/* memcpy may not always be length of 8, hence pre-fill both dword's with 0 */
+		tre->dword[0] = 0;
+		tre->dword[1] = 0;
+		memcpy((u8 *)&tre->dword[0], buf, len);
+
+		tre->dword[2] = u32_encode_bits(len, TRE_DMA_IMMEDIATE_LEN);
+
+		tre->dword[3] = u32_encode_bits(TRE_TYPE_DMA, TRE_FLAGS_TYPE);
 		tre->dword[3] |= u32_encode_bits(1, TRE_FLAGS_IEOT);
+		tre->dword[3] |= u32_encode_bits(1, TRE_FLAGS_IMMEDIATE_DMA);
+	} else {
+		tre->dword[0] = lower_32_bits(address);
+		tre->dword[1] = upper_32_bits(address);
+
+		tre->dword[2] = u32_encode_bits(len, TRE_DMA_LEN);
+
+		tre->dword[3] = u32_encode_bits(TRE_TYPE_DMA, TRE_FLAGS_TYPE);
+		if (direction == DMA_MEM_TO_DEV)
+			tre->dword[3] |= u32_encode_bits(1, TRE_FLAGS_IEOT);
+	}
 
 	for (i = 0; i < tre_idx; i++)
 		dev_dbg(dev, "TRE:%d %x:%x:%x:%x\n", i, desc->tre[i].dword[0],
@@ -2254,6 +2322,7 @@
 	/* configure dmaengine apis */
 	gpi_dev->dma_device.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
 	gpi_dev->dma_device.residue_granularity = DMA_RESIDUE_GRANULARITY_DESCRIPTOR;
+	dma_cap_set(DMA_PRIVATE, gpi_dev->dma_device.cap_mask);
 	gpi_dev->dma_device.src_addr_widths = DMA_SLAVE_BUSWIDTH_8_BYTES;
 	gpi_dev->dma_device.dst_addr_widths = DMA_SLAVE_BUSWIDTH_8_BYTES;
 	gpi_dev->dma_device.device_alloc_chan_resources = gpi_alloc_chan_resources;
--- linux-qcom-6.8.0.orig/drivers/dma/tegra186-gpc-dma.c
+++ linux-qcom-6.8.0/drivers/dma/tegra186-gpc-dma.c
@@ -231,6 +231,7 @@
 	bool config_init;
 	char name[30];
 	enum dma_transfer_direction sid_dir;
+	enum dma_status status;
 	int id;
 	int irq;
 	int slave_id;
@@ -393,6 +394,8 @@
 		tegra_dma_dump_chan_regs(tdc);
 	}
 
+	tdc->status = DMA_PAUSED;
+
 	return ret;
 }
 
@@ -419,6 +422,8 @@
 	val = tdc_read(tdc, TEGRA_GPCDMA_CHAN_CSRE);
 	val &= ~TEGRA_GPCDMA_CHAN_CSRE_PAUSE;
 	tdc_write(tdc, TEGRA_GPCDMA_CHAN_CSRE, val);
+
+	tdc->status = DMA_IN_PROGRESS;
 }
 
 static int tegra_dma_device_resume(struct dma_chan *dc)
@@ -544,6 +549,7 @@
 
 	tegra_dma_sid_free(tdc);
 	tdc->dma_desc = NULL;
+	tdc->status = DMA_COMPLETE;
 }
 
 static void tegra_dma_chan_decode_error(struct tegra_dma_channel *tdc,
@@ -716,6 +722,7 @@
 		tdc->dma_desc = NULL;
 	}
 
+	tdc->status = DMA_COMPLETE;
 	tegra_dma_sid_free(tdc);
 	vchan_get_all_descriptors(&tdc->vc, &head);
 	spin_unlock_irqrestore(&tdc->vc.lock, flags);
@@ -746,6 +753,9 @@
 	bytes_xfer = dma_desc->bytes_xfer +
 		     sg_req[dma_desc->sg_idx].len - (wcount * 4);
 
+	if (dma_desc->bytes_req == bytes_xfer)
+		return 0;
+
 	residual = dma_desc->bytes_req - (bytes_xfer % dma_desc->bytes_req);
 
 	return residual;
@@ -766,6 +776,9 @@
 	if (ret == DMA_COMPLETE)
 		return ret;
 
+	if (tdc->status == DMA_PAUSED)
+		ret = DMA_PAUSED;
+
 	spin_lock_irqsave(&tdc->vc.lock, flags);
 	vd = vchan_find_desc(&tdc->vc, cookie);
 	if (vd) {
--- linux-qcom-6.8.0.orig/drivers/dma/ti/k3-udma.c
+++ linux-qcom-6.8.0/drivers/dma/ti/k3-udma.c
@@ -4472,7 +4472,9 @@
 		ud->rchan_cnt = UDMA_CAP2_RCHAN_CNT(cap2);
 		break;
 	case DMA_TYPE_BCDMA:
-		ud->bchan_cnt = BCDMA_CAP2_BCHAN_CNT(cap2);
+		ud->bchan_cnt = BCDMA_CAP2_BCHAN_CNT(cap2) +
+				BCDMA_CAP3_HBCHAN_CNT(cap3) +
+				BCDMA_CAP3_UBCHAN_CNT(cap3);
 		ud->tchan_cnt = BCDMA_CAP2_TCHAN_CNT(cap2);
 		ud->rchan_cnt = BCDMA_CAP2_RCHAN_CNT(cap2);
 		ud->rflow_cnt = ud->rchan_cnt;
--- linux-qcom-6.8.0.orig/drivers/dma/ti/omap-dma.c
+++ linux-qcom-6.8.0/drivers/dma/ti/omap-dma.c
@@ -1186,10 +1186,10 @@
 	d->dev_addr = dev_addr;
 	d->fi = burst;
 	d->es = es;
+	d->sglen = 1;
 	d->sg[0].addr = buf_addr;
 	d->sg[0].en = period_len / es_bytes[es];
 	d->sg[0].fn = buf_len / period_len;
-	d->sglen = 1;
 
 	d->ccr = c->ccr;
 	if (dir == DMA_DEV_TO_MEM)
@@ -1258,10 +1258,10 @@
 	d->dev_addr = src;
 	d->fi = 0;
 	d->es = data_type;
+	d->sglen = 1;
 	d->sg[0].en = len / BIT(data_type);
 	d->sg[0].fn = 1;
 	d->sg[0].addr = dest;
-	d->sglen = 1;
 	d->ccr = c->ccr;
 	d->ccr |= CCR_DST_AMODE_POSTINC | CCR_SRC_AMODE_POSTINC;
 
@@ -1309,6 +1309,7 @@
 	if (data_type > CSDP_DATA_TYPE_32)
 		data_type = CSDP_DATA_TYPE_32;
 
+	d->sglen = 1;
 	sg = &d->sg[0];
 	d->dir = DMA_MEM_TO_MEM;
 	d->dev_addr = xt->src_start;
@@ -1316,7 +1317,6 @@
 	sg->en = xt->sgl[0].size / BIT(data_type);
 	sg->fn = xt->numf;
 	sg->addr = xt->dst_start;
-	d->sglen = 1;
 	d->ccr = c->ccr;
 
 	src_icg = dmaengine_get_src_icg(xt, &xt->sgl[0]);
--- linux-qcom-6.8.0.orig/drivers/dma/xilinx/xdma-regs.h
+++ linux-qcom-6.8.0/drivers/dma/xilinx/xdma-regs.h
@@ -117,6 +117,9 @@
 			 CHAN_CTRL_IE_WRITE_ERROR |			\
 			 CHAN_CTRL_IE_DESC_ERROR)
 
+/* bits of the channel status register */
+#define XDMA_CHAN_STATUS_BUSY			BIT(0)
+
 #define XDMA_CHAN_STATUS_MASK CHAN_CTRL_START
 
 #define XDMA_CHAN_ERROR_MASK (CHAN_CTRL_IE_DESC_ALIGN_MISMATCH |	\
--- linux-qcom-6.8.0.orig/drivers/dma/xilinx/xdma.c
+++ linux-qcom-6.8.0/drivers/dma/xilinx/xdma.c
@@ -71,6 +71,8 @@
 	enum dma_transfer_direction	dir;
 	struct dma_slave_config		cfg;
 	u32				irq;
+	struct completion		last_interrupt;
+	bool				stop_requested;
 };
 
 /**
@@ -376,6 +378,8 @@
 		return ret;
 
 	xchan->busy = true;
+	xchan->stop_requested = false;
+	reinit_completion(&xchan->last_interrupt);
 
 	return 0;
 }
@@ -387,7 +391,6 @@
 static int xdma_xfer_stop(struct xdma_chan *xchan)
 {
 	int ret;
-	u32 val;
 	struct xdma_device *xdev = xchan->xdev_hdl;
 
 	/* clear run stop bit to prevent any further auto-triggering */
@@ -395,13 +398,7 @@
 			   CHAN_CTRL_RUN_STOP);
 	if (ret)
 		return ret;
-
-	/* Clear the channel status register */
-	ret = regmap_read(xdev->rmap, xchan->base + XDMA_CHAN_STATUS_RC, &val);
-	if (ret)
-		return ret;
-
-	return 0;
+	return ret;
 }
 
 /**
@@ -474,6 +471,8 @@
 		xchan->xdev_hdl = xdev;
 		xchan->base = base + i * XDMA_CHAN_STRIDE;
 		xchan->dir = dir;
+		xchan->stop_requested = false;
+		init_completion(&xchan->last_interrupt);
 
 		ret = xdma_channel_init(xchan);
 		if (ret)
@@ -521,6 +520,7 @@
 	spin_lock_irqsave(&xdma_chan->vchan.lock, flags);
 
 	xdma_chan->busy = false;
+	xdma_chan->stop_requested = true;
 	vd = vchan_next_desc(&xdma_chan->vchan);
 	if (vd) {
 		list_del(&vd->node);
@@ -542,17 +542,26 @@
 static void xdma_synchronize(struct dma_chan *chan)
 {
 	struct xdma_chan *xdma_chan = to_xdma_chan(chan);
+	struct xdma_device *xdev = xdma_chan->xdev_hdl;
+	int st = 0;
+
+	/* If the engine continues running, wait for the last interrupt */
+	regmap_read(xdev->rmap, xdma_chan->base + XDMA_CHAN_STATUS, &st);
+	if (st & XDMA_CHAN_STATUS_BUSY)
+		wait_for_completion_timeout(&xdma_chan->last_interrupt, msecs_to_jiffies(1000));
 
 	vchan_synchronize(&xdma_chan->vchan);
 }
 
 /**
- * xdma_fill_descs - Fill hardware descriptors with contiguous memory block addresses
- * @sw_desc: tx descriptor state container
- * @src_addr: Value for a ->src_addr field of a first descriptor
- * @dst_addr: Value for a ->dst_addr field of a first descriptor
- * @size: Total size of a contiguous memory block
- * @filled_descs_num: Number of filled hardware descriptors for corresponding sw_desc
+ * xdma_fill_descs() - Fill hardware descriptors for one contiguous memory chunk.
+ *		       More than one descriptor will be used if the size is bigger
+ *		       than XDMA_DESC_BLEN_MAX.
+ * @sw_desc: Descriptor container
+ * @src_addr: First value for the ->src_addr field
+ * @dst_addr: First value for the ->dst_addr field
+ * @size: Size of the contiguous memory block
+ * @filled_descs_num: Index of the first descriptor to take care of in @sw_desc
  */
 static inline u32 xdma_fill_descs(struct xdma_desc *sw_desc, u64 src_addr,
 				  u64 dst_addr, u32 size, u32 filled_descs_num)
@@ -704,7 +713,7 @@
 	desc_num = 0;
 	for (i = 0; i < periods; i++) {
 		desc_num += xdma_fill_descs(sw_desc, *src, *dst, period_size, desc_num);
-		addr += i * period_size;
+		addr += period_size;
 	}
 
 	tx_desc = vchan_tx_prep(&xdma_chan->vchan, &sw_desc->vdesc, flags);
@@ -878,6 +887,9 @@
 
 	spin_lock(&xchan->vchan.lock);
 
+	if (xchan->stop_requested)
+		complete(&xchan->last_interrupt);
+
 	/* get submitted request */
 	vd = vchan_next_desc(&xchan->vchan);
 	if (!vd)
--- linux-qcom-6.8.0.orig/drivers/dma/xilinx/xilinx_dpdma.c
+++ linux-qcom-6.8.0/drivers/dma/xilinx/xilinx_dpdma.c
@@ -214,7 +214,8 @@
  * @running: true if the channel is running
  * @first_frame: flag for the first frame of stream
  * @video_group: flag if multi-channel operation is needed for video channels
- * @lock: lock to access struct xilinx_dpdma_chan
+ * @lock: lock to access struct xilinx_dpdma_chan. Must be taken before
+ *        @vchan.lock, if both are to be held.
  * @desc_pool: descriptor allocation pool
  * @err_task: error IRQ bottom half handler
  * @desc: References to descriptors being processed
@@ -1097,12 +1098,14 @@
 	 * Complete the active descriptor, if any, promote the pending
 	 * descriptor to active, and queue the next transfer, if any.
 	 */
+	spin_lock(&chan->vchan.lock);
 	if (chan->desc.active)
 		vchan_cookie_complete(&chan->desc.active->vdesc);
 	chan->desc.active = pending;
 	chan->desc.pending = NULL;
 
 	xilinx_dpdma_chan_queue_transfer(chan);
+	spin_unlock(&chan->vchan.lock);
 
 out:
 	spin_unlock_irqrestore(&chan->lock, flags);
@@ -1264,10 +1267,12 @@
 	struct xilinx_dpdma_chan *chan = to_xilinx_chan(dchan);
 	unsigned long flags;
 
-	spin_lock_irqsave(&chan->vchan.lock, flags);
+	spin_lock_irqsave(&chan->lock, flags);
+	spin_lock(&chan->vchan.lock);
 	if (vchan_issue_pending(&chan->vchan))
 		xilinx_dpdma_chan_queue_transfer(chan);
-	spin_unlock_irqrestore(&chan->vchan.lock, flags);
+	spin_unlock(&chan->vchan.lock);
+	spin_unlock_irqrestore(&chan->lock, flags);
 }
 
 static int xilinx_dpdma_config(struct dma_chan *dchan,
@@ -1495,7 +1500,9 @@
 		    XILINX_DPDMA_EINTR_CHAN_ERR_MASK << chan->id);
 
 	spin_lock_irqsave(&chan->lock, flags);
+	spin_lock(&chan->vchan.lock);
 	xilinx_dpdma_chan_queue_transfer(chan);
+	spin_unlock(&chan->vchan.lock);
 	spin_unlock_irqrestore(&chan->lock, flags);
 }
 
--- linux-qcom-6.8.0.orig/drivers/dpll/Kconfig
+++ linux-qcom-6.8.0/drivers/dpll/Kconfig
@@ -4,4 +4,4 @@
 #
 
 config DPLL
-  bool
+	bool
--- linux-qcom-6.8.0.orig/drivers/dpll/dpll_core.c
+++ linux-qcom-6.8.0/drivers/dpll/dpll_core.c
@@ -29,6 +29,8 @@
 	WARN_ON_ONCE(!xa_get_mark(&dpll_device_xa, (d)->id, DPLL_REGISTERED))
 #define ASSERT_DPLL_NOT_REGISTERED(d)	\
 	WARN_ON_ONCE(xa_get_mark(&dpll_device_xa, (d)->id, DPLL_REGISTERED))
+#define ASSERT_DPLL_PIN_REGISTERED(p) \
+	WARN_ON_ONCE(!xa_get_mark(&dpll_pin_xa, (p)->id, DPLL_REGISTERED))
 
 struct dpll_device_registration {
 	struct list_head list;
@@ -40,6 +42,7 @@
 	struct list_head list;
 	const struct dpll_pin_ops *ops;
 	void *priv;
+	void *cookie;
 };
 
 struct dpll_device *dpll_device_get_by_id(int id)
@@ -52,12 +55,14 @@
 
 static struct dpll_pin_registration *
 dpll_pin_registration_find(struct dpll_pin_ref *ref,
-			   const struct dpll_pin_ops *ops, void *priv)
+			   const struct dpll_pin_ops *ops, void *priv,
+			   void *cookie)
 {
 	struct dpll_pin_registration *reg;
 
 	list_for_each_entry(reg, &ref->registration_list, list) {
-		if (reg->ops == ops && reg->priv == priv)
+		if (reg->ops == ops && reg->priv == priv &&
+		    reg->cookie == cookie)
 			return reg;
 	}
 	return NULL;
@@ -65,7 +70,8 @@
 
 static int
 dpll_xa_ref_pin_add(struct xarray *xa_pins, struct dpll_pin *pin,
-		    const struct dpll_pin_ops *ops, void *priv)
+		    const struct dpll_pin_ops *ops, void *priv,
+		    void *cookie)
 {
 	struct dpll_pin_registration *reg;
 	struct dpll_pin_ref *ref;
@@ -76,7 +82,7 @@
 	xa_for_each(xa_pins, i, ref) {
 		if (ref->pin != pin)
 			continue;
-		reg = dpll_pin_registration_find(ref, ops, priv);
+		reg = dpll_pin_registration_find(ref, ops, priv, cookie);
 		if (reg) {
 			refcount_inc(&ref->refcount);
 			return 0;
@@ -109,6 +115,7 @@
 	}
 	reg->ops = ops;
 	reg->priv = priv;
+	reg->cookie = cookie;
 	if (ref_exists)
 		refcount_inc(&ref->refcount);
 	list_add_tail(&reg->list, &ref->registration_list);
@@ -117,7 +124,8 @@
 }
 
 static int dpll_xa_ref_pin_del(struct xarray *xa_pins, struct dpll_pin *pin,
-			       const struct dpll_pin_ops *ops, void *priv)
+			       const struct dpll_pin_ops *ops, void *priv,
+			       void *cookie)
 {
 	struct dpll_pin_registration *reg;
 	struct dpll_pin_ref *ref;
@@ -126,12 +134,12 @@
 	xa_for_each(xa_pins, i, ref) {
 		if (ref->pin != pin)
 			continue;
-		reg = dpll_pin_registration_find(ref, ops, priv);
+		reg = dpll_pin_registration_find(ref, ops, priv, cookie);
 		if (WARN_ON(!reg))
 			return -EINVAL;
+		list_del(&reg->list);
+		kfree(reg);
 		if (refcount_dec_and_test(&ref->refcount)) {
-			list_del(&reg->list);
-			kfree(reg);
 			xa_erase(xa_pins, i);
 			WARN_ON(!list_empty(&ref->registration_list));
 			kfree(ref);
@@ -144,7 +152,7 @@
 
 static int
 dpll_xa_ref_dpll_add(struct xarray *xa_dplls, struct dpll_device *dpll,
-		     const struct dpll_pin_ops *ops, void *priv)
+		     const struct dpll_pin_ops *ops, void *priv, void *cookie)
 {
 	struct dpll_pin_registration *reg;
 	struct dpll_pin_ref *ref;
@@ -155,7 +163,7 @@
 	xa_for_each(xa_dplls, i, ref) {
 		if (ref->dpll != dpll)
 			continue;
-		reg = dpll_pin_registration_find(ref, ops, priv);
+		reg = dpll_pin_registration_find(ref, ops, priv, cookie);
 		if (reg) {
 			refcount_inc(&ref->refcount);
 			return 0;
@@ -188,6 +196,7 @@
 	}
 	reg->ops = ops;
 	reg->priv = priv;
+	reg->cookie = cookie;
 	if (ref_exists)
 		refcount_inc(&ref->refcount);
 	list_add_tail(&reg->list, &ref->registration_list);
@@ -197,7 +206,7 @@
 
 static void
 dpll_xa_ref_dpll_del(struct xarray *xa_dplls, struct dpll_device *dpll,
-		     const struct dpll_pin_ops *ops, void *priv)
+		     const struct dpll_pin_ops *ops, void *priv, void *cookie)
 {
 	struct dpll_pin_registration *reg;
 	struct dpll_pin_ref *ref;
@@ -206,12 +215,12 @@
 	xa_for_each(xa_dplls, i, ref) {
 		if (ref->dpll != dpll)
 			continue;
-		reg = dpll_pin_registration_find(ref, ops, priv);
+		reg = dpll_pin_registration_find(ref, ops, priv, cookie);
 		if (WARN_ON(!reg))
 			return;
+		list_del(&reg->list);
+		kfree(reg);
 		if (refcount_dec_and_test(&ref->refcount)) {
-			list_del(&reg->list);
-			kfree(reg);
 			xa_erase(xa_dplls, i);
 			WARN_ON(!list_empty(&ref->registration_list));
 			kfree(ref);
@@ -440,7 +449,7 @@
 				   sizeof(*src->freq_supported);
 		dst->freq_supported = kmemdup(src->freq_supported,
 					      freq_size, GFP_KERNEL);
-		if (!src->freq_supported)
+		if (!dst->freq_supported)
 			return -ENOMEM;
 	}
 	if (src->board_label) {
@@ -592,14 +601,14 @@
 
 static int
 __dpll_pin_register(struct dpll_device *dpll, struct dpll_pin *pin,
-		    const struct dpll_pin_ops *ops, void *priv)
+		    const struct dpll_pin_ops *ops, void *priv, void *cookie)
 {
 	int ret;
 
-	ret = dpll_xa_ref_pin_add(&dpll->pin_refs, pin, ops, priv);
+	ret = dpll_xa_ref_pin_add(&dpll->pin_refs, pin, ops, priv, cookie);
 	if (ret)
 		return ret;
-	ret = dpll_xa_ref_dpll_add(&pin->dpll_refs, dpll, ops, priv);
+	ret = dpll_xa_ref_dpll_add(&pin->dpll_refs, dpll, ops, priv, cookie);
 	if (ret)
 		goto ref_pin_del;
 	xa_set_mark(&dpll_pin_xa, pin->id, DPLL_REGISTERED);
@@ -608,7 +617,7 @@
 	return ret;
 
 ref_pin_del:
-	dpll_xa_ref_pin_del(&dpll->pin_refs, pin, ops, priv);
+	dpll_xa_ref_pin_del(&dpll->pin_refs, pin, ops, priv, cookie);
 	return ret;
 }
 
@@ -640,7 +649,7 @@
 		      dpll->clock_id == pin->clock_id)))
 		ret = -EINVAL;
 	else
-		ret = __dpll_pin_register(dpll, pin, ops, priv);
+		ret = __dpll_pin_register(dpll, pin, ops, priv, NULL);
 	mutex_unlock(&dpll_lock);
 
 	return ret;
@@ -649,10 +658,11 @@
 
 static void
 __dpll_pin_unregister(struct dpll_device *dpll, struct dpll_pin *pin,
-		      const struct dpll_pin_ops *ops, void *priv)
+		      const struct dpll_pin_ops *ops, void *priv, void *cookie)
 {
-	dpll_xa_ref_pin_del(&dpll->pin_refs, pin, ops, priv);
-	dpll_xa_ref_dpll_del(&pin->dpll_refs, dpll, ops, priv);
+	ASSERT_DPLL_PIN_REGISTERED(pin);
+	dpll_xa_ref_pin_del(&dpll->pin_refs, pin, ops, priv, cookie);
+	dpll_xa_ref_dpll_del(&pin->dpll_refs, dpll, ops, priv, cookie);
 	if (xa_empty(&pin->dpll_refs))
 		xa_clear_mark(&dpll_pin_xa, pin->id, DPLL_REGISTERED);
 }
@@ -677,7 +687,7 @@
 
 	mutex_lock(&dpll_lock);
 	dpll_pin_delete_ntf(pin);
-	__dpll_pin_unregister(dpll, pin, ops, priv);
+	__dpll_pin_unregister(dpll, pin, ops, priv, NULL);
 	mutex_unlock(&dpll_lock);
 }
 EXPORT_SYMBOL_GPL(dpll_pin_unregister);
@@ -713,12 +723,12 @@
 		return -EINVAL;
 
 	mutex_lock(&dpll_lock);
-	ret = dpll_xa_ref_pin_add(&pin->parent_refs, parent, ops, priv);
+	ret = dpll_xa_ref_pin_add(&pin->parent_refs, parent, ops, priv, pin);
 	if (ret)
 		goto unlock;
 	refcount_inc(&pin->refcount);
 	xa_for_each(&parent->dpll_refs, i, ref) {
-		ret = __dpll_pin_register(ref->dpll, pin, ops, priv);
+		ret = __dpll_pin_register(ref->dpll, pin, ops, priv, parent);
 		if (ret) {
 			stop = i;
 			goto dpll_unregister;
@@ -732,11 +742,12 @@
 dpll_unregister:
 	xa_for_each(&parent->dpll_refs, i, ref)
 		if (i < stop) {
-			__dpll_pin_unregister(ref->dpll, pin, ops, priv);
+			__dpll_pin_unregister(ref->dpll, pin, ops, priv,
+					      parent);
 			dpll_pin_delete_ntf(pin);
 		}
 	refcount_dec(&pin->refcount);
-	dpll_xa_ref_pin_del(&pin->parent_refs, parent, ops, priv);
+	dpll_xa_ref_pin_del(&pin->parent_refs, parent, ops, priv, pin);
 unlock:
 	mutex_unlock(&dpll_lock);
 	return ret;
@@ -761,10 +772,10 @@
 
 	mutex_lock(&dpll_lock);
 	dpll_pin_delete_ntf(pin);
-	dpll_xa_ref_pin_del(&pin->parent_refs, parent, ops, priv);
+	dpll_xa_ref_pin_del(&pin->parent_refs, parent, ops, priv, pin);
 	refcount_dec(&pin->refcount);
 	xa_for_each(&pin->dpll_refs, i, ref)
-		__dpll_pin_unregister(ref->dpll, pin, ops, priv);
+		__dpll_pin_unregister(ref->dpll, pin, ops, priv, parent);
 	mutex_unlock(&dpll_lock);
 }
 EXPORT_SYMBOL_GPL(dpll_pin_on_pin_unregister);
--- linux-qcom-6.8.0.orig/drivers/dpll/dpll_netlink.c
+++ linux-qcom-6.8.0/drivers/dpll/dpll_netlink.c
@@ -335,6 +335,51 @@
 	return 0;
 }
 
+static int
+dpll_msg_add_pin_esync(struct sk_buff *msg, struct dpll_pin *pin,
+		       struct dpll_pin_ref *ref, struct netlink_ext_ack *extack)
+{
+	const struct dpll_pin_ops *ops = dpll_pin_ops(ref);
+	struct dpll_device *dpll = ref->dpll;
+	struct dpll_pin_esync esync;
+	struct nlattr *nest;
+	int ret, i;
+
+	if (!ops->esync_get)
+		return 0;
+	ret = ops->esync_get(pin, dpll_pin_on_dpll_priv(dpll, pin), dpll,
+			     dpll_priv(dpll), &esync, extack);
+	if (ret == -EOPNOTSUPP)
+		return 0;
+	else if (ret)
+		return ret;
+	if (nla_put_64bit(msg, DPLL_A_PIN_ESYNC_FREQUENCY, sizeof(esync.freq),
+			  &esync.freq, DPLL_A_PIN_PAD))
+		return -EMSGSIZE;
+	if (nla_put_u32(msg, DPLL_A_PIN_ESYNC_PULSE, esync.pulse))
+		return -EMSGSIZE;
+	for (i = 0; i < esync.range_num; i++) {
+		nest = nla_nest_start(msg,
+				      DPLL_A_PIN_ESYNC_FREQUENCY_SUPPORTED);
+		if (!nest)
+			return -EMSGSIZE;
+		if (nla_put_64bit(msg, DPLL_A_PIN_FREQUENCY_MIN,
+				  sizeof(esync.range[i].min),
+				  &esync.range[i].min, DPLL_A_PIN_PAD))
+			goto nest_cancel;
+		if (nla_put_64bit(msg, DPLL_A_PIN_FREQUENCY_MAX,
+				  sizeof(esync.range[i].max),
+				  &esync.range[i].max, DPLL_A_PIN_PAD))
+			goto nest_cancel;
+		nla_nest_end(msg, nest);
+	}
+	return 0;
+
+nest_cancel:
+	nla_nest_cancel(msg, nest);
+	return -EMSGSIZE;
+}
+
 static bool dpll_pin_is_freq_supported(struct dpll_pin *pin, u32 freq)
 {
 	int fs;
@@ -476,6 +521,9 @@
 	ret = dpll_msg_add_ffo(msg, pin, ref, extack);
 	if (ret)
 		return ret;
+	ret = dpll_msg_add_pin_esync(msg, pin, ref, extack);
+	if (ret)
+		return ret;
 	if (xa_empty(&pin->parent_refs))
 		ret = dpll_msg_add_pin_dplls(msg, pin, extack);
 	else
@@ -732,6 +780,83 @@
 }
 
 static int
+dpll_pin_esync_set(struct dpll_pin *pin, struct nlattr *a,
+		   struct netlink_ext_ack *extack)
+{
+	struct dpll_pin_ref *ref, *failed;
+	const struct dpll_pin_ops *ops;
+	struct dpll_pin_esync esync;
+	u64 freq = nla_get_u64(a);
+	struct dpll_device *dpll;
+	bool supported = false;
+	unsigned long i;
+	int ret;
+
+	xa_for_each(&pin->dpll_refs, i, ref) {
+		ops = dpll_pin_ops(ref);
+		if (!ops->esync_set || !ops->esync_get) {
+			NL_SET_ERR_MSG(extack,
+				       "embedded sync feature is not supported by this device");
+			return -EOPNOTSUPP;
+		}
+	}
+	ref = dpll_xa_ref_dpll_first(&pin->dpll_refs);
+	ops = dpll_pin_ops(ref);
+	dpll = ref->dpll;
+	ret = ops->esync_get(pin, dpll_pin_on_dpll_priv(dpll, pin), dpll,
+			     dpll_priv(dpll), &esync, extack);
+	if (ret) {
+		NL_SET_ERR_MSG(extack, "unable to get current embedded sync frequency value");
+		return ret;
+	}
+	if (freq == esync.freq)
+		return 0;
+	for (i = 0; i < esync.range_num; i++)
+		if (freq <= esync.range[i].max && freq >= esync.range[i].min)
+			supported = true;
+	if (!supported) {
+		NL_SET_ERR_MSG_ATTR(extack, a,
+				    "requested embedded sync frequency value is not supported by this device");
+		return -EINVAL;
+	}
+
+	xa_for_each(&pin->dpll_refs, i, ref) {
+		void *pin_dpll_priv;
+
+		ops = dpll_pin_ops(ref);
+		dpll = ref->dpll;
+		pin_dpll_priv = dpll_pin_on_dpll_priv(dpll, pin);
+		ret = ops->esync_set(pin, pin_dpll_priv, dpll, dpll_priv(dpll),
+				      freq, extack);
+		if (ret) {
+			failed = ref;
+			NL_SET_ERR_MSG_FMT(extack,
+					   "embedded sync frequency set failed for dpll_id: %u",
+					   dpll->id);
+			goto rollback;
+		}
+	}
+	__dpll_pin_change_ntf(pin);
+
+	return 0;
+
+rollback:
+	xa_for_each(&pin->dpll_refs, i, ref) {
+		void *pin_dpll_priv;
+
+		if (ref == failed)
+			break;
+		ops = dpll_pin_ops(ref);
+		dpll = ref->dpll;
+		pin_dpll_priv = dpll_pin_on_dpll_priv(dpll, pin);
+		if (ops->esync_set(pin, pin_dpll_priv, dpll, dpll_priv(dpll),
+				   esync.freq, extack))
+			NL_SET_ERR_MSG(extack, "set embedded sync frequency rollback failed");
+	}
+	return ret;
+}
+
+static int
 dpll_pin_on_pin_state_set(struct dpll_pin *pin, u32 parent_idx,
 			  enum dpll_pin_state state,
 			  struct netlink_ext_ack *extack)
@@ -1032,6 +1157,11 @@
 			if (ret)
 				return ret;
 			break;
+		case DPLL_A_PIN_ESYNC_FREQUENCY:
+			ret = dpll_pin_esync_set(pin, a, info->extack);
+			if (ret)
+				return ret;
+			break;
 		}
 	}
 
--- linux-qcom-6.8.0.orig/drivers/dpll/dpll_nl.c
+++ linux-qcom-6.8.0/drivers/dpll/dpll_nl.c
@@ -62,7 +62,7 @@
 };
 
 /* DPLL_CMD_PIN_SET - do */
-static const struct nla_policy dpll_pin_set_nl_policy[DPLL_A_PIN_PHASE_ADJUST + 1] = {
+static const struct nla_policy dpll_pin_set_nl_policy[DPLL_A_PIN_ESYNC_FREQUENCY + 1] = {
 	[DPLL_A_PIN_ID] = { .type = NLA_U32, },
 	[DPLL_A_PIN_FREQUENCY] = { .type = NLA_U64, },
 	[DPLL_A_PIN_DIRECTION] = NLA_POLICY_RANGE(NLA_U32, 1, 2),
@@ -71,6 +71,7 @@
 	[DPLL_A_PIN_PARENT_DEVICE] = NLA_POLICY_NESTED(dpll_pin_parent_device_nl_policy),
 	[DPLL_A_PIN_PARENT_PIN] = NLA_POLICY_NESTED(dpll_pin_parent_pin_nl_policy),
 	[DPLL_A_PIN_PHASE_ADJUST] = { .type = NLA_S32, },
+	[DPLL_A_PIN_ESYNC_FREQUENCY] = { .type = NLA_U64, },
 };
 
 /* Ops table for dpll */
@@ -138,7 +139,7 @@
 		.doit		= dpll_nl_pin_set_doit,
 		.post_doit	= dpll_pin_post_doit,
 		.policy		= dpll_pin_set_nl_policy,
-		.maxattr	= DPLL_A_PIN_PHASE_ADJUST,
+		.maxattr	= DPLL_A_PIN_ESYNC_FREQUENCY,
 		.flags		= GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
 	},
 };
--- linux-qcom-6.8.0.orig/drivers/edac/Makefile
+++ linux-qcom-6.8.0/drivers/edac/Makefile
@@ -54,11 +54,13 @@
 layerscape_edac_mod-y			:= fsl_ddr_edac.o layerscape_edac.o
 obj-$(CONFIG_EDAC_LAYERSCAPE)		+= layerscape_edac_mod.o
 
-skx_edac-y				:= skx_common.o skx_base.o
-obj-$(CONFIG_EDAC_SKX)			+= skx_edac.o
+skx_edac_common-y			:= skx_common.o
 
-i10nm_edac-y				:= skx_common.o i10nm_base.o
-obj-$(CONFIG_EDAC_I10NM)		+= i10nm_edac.o
+skx_edac-y				:= skx_base.o
+obj-$(CONFIG_EDAC_SKX)			+= skx_edac.o skx_edac_common.o
+
+i10nm_edac-y				:= i10nm_base.o
+obj-$(CONFIG_EDAC_I10NM)		+= i10nm_edac.o skx_edac_common.o
 
 obj-$(CONFIG_EDAC_CELL)			+= cell_edac.o
 obj-$(CONFIG_EDAC_PPC4XX)		+= ppc4xx_edac.o
--- linux-qcom-6.8.0.orig/drivers/edac/amd64_edac.c
+++ linux-qcom-6.8.0/drivers/edac/amd64_edac.c
@@ -80,7 +80,7 @@
 		amd64_warn("%s: error reading F%dx%03x.\n",
 			   func, PCI_FUNC(pdev->devfn), offset);
 
-	return err;
+	return pcibios_err_to_errno(err);
 }
 
 int __amd64_write_pci_cfg_dword(struct pci_dev *pdev, int offset,
@@ -93,7 +93,7 @@
 		amd64_warn("%s: error writing to F%dx%03x.\n",
 			   func, PCI_FUNC(pdev->devfn), offset);
 
-	return err;
+	return pcibios_err_to_errno(err);
 }
 
 /*
@@ -1024,8 +1024,10 @@
 	}
 
 	ret = pci_read_config_dword(pdev, REG_LOCAL_NODE_TYPE_MAP, &tmp);
-	if (ret)
+	if (ret) {
+		ret = pcibios_err_to_errno(ret);
 		goto out;
+	}
 
 	gpu_node_map.node_count = FIELD_GET(LNTM_NODE_COUNT, tmp);
 	gpu_node_map.base_node_id = FIELD_GET(LNTM_BASE_NODE_ID, tmp);
@@ -3626,36 +3628,24 @@
 
 static bool umc_ecc_enabled(struct amd64_pvt *pvt)
 {
-	u8 umc_en_mask = 0, ecc_en_mask = 0;
-	u16 nid = pvt->mc_node_id;
 	struct amd64_umc *umc;
-	u8 ecc_en = 0, i;
+	bool ecc_en = false;
+	int i;
 
+	/* Check whether at least one UMC is enabled: */
 	for_each_umc(i) {
 		umc = &pvt->umc[i];
 
-		/* Only check enabled UMCs. */
-		if (!(umc->sdp_ctrl & UMC_SDP_INIT))
-			continue;
-
-		umc_en_mask |= BIT(i);
-
-		if (umc->umc_cap_hi & UMC_ECC_ENABLED)
-			ecc_en_mask |= BIT(i);
+		if (umc->sdp_ctrl & UMC_SDP_INIT &&
+		    umc->umc_cap_hi & UMC_ECC_ENABLED) {
+			ecc_en = true;
+			break;
+		}
 	}
 
-	/* Check whether at least one UMC is enabled: */
-	if (umc_en_mask)
-		ecc_en = umc_en_mask == ecc_en_mask;
-	else
-		edac_dbg(0, "Node %d: No enabled UMCs.\n", nid);
+	edac_dbg(3, "Node %d: DRAM ECC %s.\n", pvt->mc_node_id, (ecc_en ? "enabled" : "disabled"));
 
-	edac_dbg(3, "Node %d: DRAM ECC %s.\n", nid, (ecc_en ? "enabled" : "disabled"));
-
-	if (!ecc_en)
-		return false;
-	else
-		return true;
+	return ecc_en;
 }
 
 static inline void
--- linux-qcom-6.8.0.orig/drivers/edac/bluefield_edac.c
+++ linux-qcom-6.8.0/drivers/edac/bluefield_edac.c
@@ -180,7 +180,7 @@
 static void bluefield_edac_init_dimms(struct mem_ctl_info *mci)
 {
 	struct bluefield_edac_priv *priv = mci->pvt_info;
-	int mem_ctrl_idx = mci->mc_idx;
+	u64 mem_ctrl_idx = mci->mc_idx;
 	struct dimm_info *dimm;
 	u64 smc_info, smc_arg;
 	int is_empty = 1, i;
--- linux-qcom-6.8.0.orig/drivers/edac/fsl_ddr_edac.c
+++ linux-qcom-6.8.0/drivers/edac/fsl_ddr_edac.c
@@ -328,21 +328,25 @@
 	 * TODO: Add support for 32-bit wide buses
 	 */
 	if ((err_detect & DDR_EDE_SBE) && (bus_width == 64)) {
+		u64 cap = (u64)cap_high << 32 | cap_low;
+		u32 s = syndrome;
+
 		sbe_ecc_decode(cap_high, cap_low, syndrome,
 				&bad_data_bit, &bad_ecc_bit);
 
-		if (bad_data_bit != -1)
-			fsl_mc_printk(mci, KERN_ERR,
-				"Faulty Data bit: %d\n", bad_data_bit);
-		if (bad_ecc_bit != -1)
-			fsl_mc_printk(mci, KERN_ERR,
-				"Faulty ECC bit: %d\n", bad_ecc_bit);
+		if (bad_data_bit >= 0) {
+			fsl_mc_printk(mci, KERN_ERR, "Faulty Data bit: %d\n", bad_data_bit);
+			cap ^= 1ULL << bad_data_bit;
+		}
+
+		if (bad_ecc_bit >= 0) {
+			fsl_mc_printk(mci, KERN_ERR, "Faulty ECC bit: %d\n", bad_ecc_bit);
+			s ^= 1 << bad_ecc_bit;
+		}
 
 		fsl_mc_printk(mci, KERN_ERR,
 			"Expected Data / ECC:\t%#8.8x_%08x / %#2.2x\n",
-			cap_high ^ (1 << (bad_data_bit - 32)),
-			cap_low ^ (1 << bad_data_bit),
-			syndrome ^ (1 << bad_ecc_bit));
+			upper_32_bits(cap), lower_32_bits(cap), s);
 	}
 
 	fsl_mc_printk(mci, KERN_ERR,
--- linux-qcom-6.8.0.orig/drivers/edac/i10nm_base.c
+++ linux-qcom-6.8.0/drivers/edac/i10nm_base.c
@@ -1088,6 +1088,7 @@
 		return -ENODEV;
 
 	cfg = (struct res_config *)id->driver_data;
+	skx_set_res_cfg(cfg);
 	res_cfg = cfg;
 
 	rc = skx_get_hi_lo(0x09a2, off, &tolm, &tohm);
--- linux-qcom-6.8.0.orig/drivers/edac/igen6_edac.c
+++ linux-qcom-6.8.0/drivers/edac/igen6_edac.c
@@ -257,6 +257,11 @@
 #define DID_MTL_P_SKU2	0x7d02
 #define DID_MTL_P_SKU3	0x7d14
 
+/* Compute die IDs for Arrow Lake-UH with IBECC */
+#define DID_ARL_UH_SKU1	0x7d06
+#define DID_ARL_UH_SKU2	0x7d20
+#define DID_ARL_UH_SKU3	0x7d30
+
 static int get_mchbar(struct pci_dev *pdev, u64 *mchbar)
 {
 	union  {
@@ -310,7 +315,7 @@
 	if (igen6_tom <= _4GB)
 		return eaddr + igen6_tolud - _4GB;
 
-	if (eaddr < _4GB)
+	if (eaddr >= igen6_tom)
 		return eaddr + igen6_tolud - igen6_tom;
 
 	return eaddr;
@@ -595,6 +600,9 @@
 	{ PCI_VDEVICE(INTEL, DID_MTL_P_SKU1), (kernel_ulong_t)&mtl_p_cfg },
 	{ PCI_VDEVICE(INTEL, DID_MTL_P_SKU2), (kernel_ulong_t)&mtl_p_cfg },
 	{ PCI_VDEVICE(INTEL, DID_MTL_P_SKU3), (kernel_ulong_t)&mtl_p_cfg },
+	{ PCI_VDEVICE(INTEL, DID_ARL_UH_SKU1), (kernel_ulong_t)&mtl_p_cfg },
+	{ PCI_VDEVICE(INTEL, DID_ARL_UH_SKU2), (kernel_ulong_t)&mtl_p_cfg },
+	{ PCI_VDEVICE(INTEL, DID_ARL_UH_SKU3), (kernel_ulong_t)&mtl_p_cfg },
 	{ },
 };
 MODULE_DEVICE_TABLE(pci, igen6_pci_tbl);
@@ -798,7 +806,7 @@
 
 	rc = pci_read_config_word(imc->pdev, ERRCMD_OFFSET, &errcmd);
 	if (rc)
-		return rc;
+		return pcibios_err_to_errno(rc);
 
 	if (enable)
 		errcmd |= ERRCMD_CE | ERRSTS_UE;
@@ -807,7 +815,7 @@
 
 	rc = pci_write_config_word(imc->pdev, ERRCMD_OFFSET, errcmd);
 	if (rc)
-		return rc;
+		return pcibios_err_to_errno(rc);
 
 	return 0;
 }
@@ -1235,6 +1243,7 @@
 	imc->mci = mci;
 	return 0;
 fail3:
+	mci->pvt_info = NULL;
 	kfree(mci->ctl_name);
 fail2:
 	edac_mc_free(mci);
@@ -1259,6 +1268,7 @@
 
 		edac_mc_del_mc(mci->pdev);
 		kfree(mci->ctl_name);
+		mci->pvt_info = NULL;
 		edac_mc_free(mci);
 		iounmap(imc->window);
 	}
--- linux-qcom-6.8.0.orig/drivers/edac/qcom_edac.c
+++ linux-qcom-6.8.0/drivers/edac/qcom_edac.c
@@ -95,7 +95,7 @@
 	 * Configure interrupt enable registers such that Tag, Data RAM related
 	 * interrupts are propagated to interrupt controller for servicing
 	 */
-	ret = regmap_update_bits(llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_2_enable,
+	ret = regmap_update_bits(llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_0_enable,
 				 TRP0_INTERRUPT_ENABLE,
 				 TRP0_INTERRUPT_ENABLE);
 	if (ret)
@@ -113,7 +113,7 @@
 	if (ret)
 		return ret;
 
-	ret = regmap_update_bits(llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_2_enable,
+	ret = regmap_update_bits(llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_0_enable,
 				 DRP0_INTERRUPT_ENABLE,
 				 DRP0_INTERRUPT_ENABLE);
 	if (ret)
@@ -342,9 +342,11 @@
 	int ecc_irq;
 	int rc;
 
-	rc = qcom_llcc_core_setup(llcc_driv_data, llcc_driv_data->bcast_regmap);
-	if (rc)
-		return rc;
+	if (!llcc_driv_data->ecc_irq_configured) {
+		rc = qcom_llcc_core_setup(llcc_driv_data, llcc_driv_data->bcast_regmap);
+		if (rc)
+			return rc;
+	}
 
 	/* Allocate edac control info */
 	edev_ctl = edac_device_alloc_ctl_info(0, "qcom-llcc", 1, "bank",
--- linux-qcom-6.8.0.orig/drivers/edac/skx_common.c
+++ linux-qcom-6.8.0/drivers/edac/skx_common.c
@@ -47,8 +47,9 @@
 static u64 skx_tolm, skx_tohm;
 static LIST_HEAD(dev_edac_list);
 static bool skx_mem_cfg_2lm;
+static struct res_config *skx_res_cfg;
 
-int __init skx_adxl_get(void)
+int skx_adxl_get(void)
 {
 	const char * const *names;
 	int i, j;
@@ -110,14 +111,16 @@
 
 	return -ENODEV;
 }
+EXPORT_SYMBOL_GPL(skx_adxl_get);
 
-void __exit skx_adxl_put(void)
+void skx_adxl_put(void)
 {
 	kfree(adxl_values);
 	kfree(adxl_msg);
 }
+EXPORT_SYMBOL_GPL(skx_adxl_put);
 
-static bool skx_adxl_decode(struct decoded_addr *res, bool error_in_1st_level_mem)
+static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src)
 {
 	struct skx_dev *d;
 	int i, len = 0;
@@ -133,8 +136,24 @@
 		return false;
 	}
 
+	/*
+	 * GNR with a Flat2LM memory configuration may mistakenly classify
+	 * a near-memory error(DDR5) as a far-memory error(CXL), resulting
+	 * in the incorrect selection of decoded ADXL components.
+	 * To address this, prefetch the decoded far-memory controller ID
+	 * and adjust the error source to near-memory if the far-memory
+	 * controller ID is invalid.
+	 */
+	if (skx_res_cfg && skx_res_cfg->type == GNR && err_src == ERR_SRC_2LM_FM) {
+		res->imc = (int)adxl_values[component_indices[INDEX_MEMCTRL]];
+		if (res->imc == -1) {
+			err_src = ERR_SRC_2LM_NM;
+			edac_dbg(0, "Adjust the error source to near-memory.\n");
+		}
+	}
+
 	res->socket  = (int)adxl_values[component_indices[INDEX_SOCKET]];
-	if (error_in_1st_level_mem) {
+	if (err_src == ERR_SRC_2LM_NM) {
 		res->imc     = (adxl_nm_bitmap & BIT_NM_MEMCTRL) ?
 			       (int)adxl_values[component_indices[INDEX_NM_MEMCTRL]] : -1;
 		res->channel = (adxl_nm_bitmap & BIT_NM_CHANNEL) ?
@@ -187,12 +206,20 @@
 {
 	skx_mem_cfg_2lm = mem_cfg_2lm;
 }
+EXPORT_SYMBOL_GPL(skx_set_mem_cfg);
+
+void skx_set_res_cfg(struct res_config *cfg)
+{
+	skx_res_cfg = cfg;
+}
+EXPORT_SYMBOL_GPL(skx_set_res_cfg);
 
 void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log)
 {
 	driver_decode = decode;
 	skx_show_retry_rd_err_log = show_retry_log;
 }
+EXPORT_SYMBOL_GPL(skx_set_decode);
 
 int skx_get_src_id(struct skx_dev *d, int off, u8 *id)
 {
@@ -206,6 +233,7 @@
 	*id = GET_BITFIELD(reg, 12, 14);
 	return 0;
 }
+EXPORT_SYMBOL_GPL(skx_get_src_id);
 
 int skx_get_node_id(struct skx_dev *d, u8 *id)
 {
@@ -219,6 +247,7 @@
 	*id = GET_BITFIELD(reg, 0, 2);
 	return 0;
 }
+EXPORT_SYMBOL_GPL(skx_get_node_id);
 
 static int get_width(u32 mtr)
 {
@@ -284,6 +313,7 @@
 		*list = &dev_edac_list;
 	return ndev;
 }
+EXPORT_SYMBOL_GPL(skx_get_all_bus_mappings);
 
 int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm)
 {
@@ -323,6 +353,7 @@
 	pci_dev_put(pdev);
 	return -ENODEV;
 }
+EXPORT_SYMBOL_GPL(skx_get_hi_lo);
 
 static int skx_get_dimm_attr(u32 reg, int lobit, int hibit, int add,
 			     int minval, int maxval, const char *name)
@@ -394,6 +425,7 @@
 
 	return 1;
 }
+EXPORT_SYMBOL_GPL(skx_get_dimm_info);
 
 int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc,
 			int chan, int dimmno, const char *mod_str)
@@ -442,6 +474,7 @@
 
 	return (size == 0 || size == ~0ull) ? 0 : 1;
 }
+EXPORT_SYMBOL_GPL(skx_get_nvdimm_info);
 
 int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev,
 		     const char *ctl_name, const char *mod_str,
@@ -512,6 +545,7 @@
 	imc->mci = NULL;
 	return rc;
 }
+EXPORT_SYMBOL_GPL(skx_register_mci);
 
 static void skx_unregister_mci(struct skx_imc *imc)
 {
@@ -609,31 +643,27 @@
 			     optype, skx_msg);
 }
 
-static bool skx_error_in_1st_level_mem(const struct mce *m)
+static enum error_source skx_error_source(const struct mce *m)
 {
-	u32 errcode;
+	u32 errcode = GET_BITFIELD(m->status, 0, 15) & MCACOD_MEM_ERR_MASK;
 
-	if (!skx_mem_cfg_2lm)
-		return false;
-
-	errcode = GET_BITFIELD(m->status, 0, 15) & MCACOD_MEM_ERR_MASK;
-
-	return errcode == MCACOD_EXT_MEM_ERR;
-}
+	if (errcode != MCACOD_MEM_CTL_ERR && errcode != MCACOD_EXT_MEM_ERR)
+		return ERR_SRC_NOT_MEMORY;
 
-static bool skx_error_in_mem(const struct mce *m)
-{
-	u32 errcode;
+	if (!skx_mem_cfg_2lm)
+		return ERR_SRC_1LM;
 
-	errcode = GET_BITFIELD(m->status, 0, 15) & MCACOD_MEM_ERR_MASK;
+	if (errcode == MCACOD_EXT_MEM_ERR)
+		return ERR_SRC_2LM_NM;
 
-	return (errcode == MCACOD_MEM_CTL_ERR || errcode == MCACOD_EXT_MEM_ERR);
+	return ERR_SRC_2LM_FM;
 }
 
 int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
 			void *data)
 {
 	struct mce *mce = (struct mce *)data;
+	enum error_source err_src;
 	struct decoded_addr res;
 	struct mem_ctl_info *mci;
 	char *type;
@@ -641,14 +671,16 @@
 	if (mce->kflags & MCE_HANDLED_CEC)
 		return NOTIFY_DONE;
 
+	err_src = skx_error_source(mce);
+
 	/* Ignore unless this is memory related with an address */
-	if (!skx_error_in_mem(mce) || !(mce->status & MCI_STATUS_ADDRV))
+	if (err_src == ERR_SRC_NOT_MEMORY || !(mce->status & MCI_STATUS_ADDRV))
 		return NOTIFY_DONE;
 
 	memset(&res, 0, sizeof(res));
 	res.mce  = mce;
 	res.addr = mce->addr & MCI_ADDR_PHYSADDR;
-	if (!pfn_to_online_page(res.addr >> PAGE_SHIFT)) {
+	if (!pfn_to_online_page(res.addr >> PAGE_SHIFT) && !arch_is_platform_page(res.addr)) {
 		pr_err("Invalid address 0x%llx in IA32_MC%d_ADDR\n", mce->addr, mce->bank);
 		return NOTIFY_DONE;
 	}
@@ -656,7 +688,7 @@
 	/* Try driver decoder first */
 	if (!(driver_decode && driver_decode(&res))) {
 		/* Then try firmware decoder (ACPI DSM methods) */
-		if (!(adxl_component_count && skx_adxl_decode(&res, skx_error_in_1st_level_mem(mce))))
+		if (!(adxl_component_count && skx_adxl_decode(&res, err_src)))
 			return NOTIFY_DONE;
 	}
 
@@ -688,6 +720,7 @@
 	mce->kflags |= MCE_HANDLED_EDAC;
 	return NOTIFY_DONE;
 }
+EXPORT_SYMBOL_GPL(skx_mce_check_error);
 
 void skx_remove(void)
 {
@@ -725,3 +758,8 @@
 		kfree(d);
 	}
 }
+EXPORT_SYMBOL_GPL(skx_remove);
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Tony Luck");
+MODULE_DESCRIPTION("MC Driver for Intel server processors");
--- linux-qcom-6.8.0.orig/drivers/edac/skx_common.h
+++ linux-qcom-6.8.0/drivers/edac/skx_common.h
@@ -147,6 +147,13 @@
 	INDEX_MAX
 };
 
+enum error_source {
+	ERR_SRC_1LM,
+	ERR_SRC_2LM_NM,
+	ERR_SRC_2LM_FM,
+	ERR_SRC_NOT_MEMORY,
+};
+
 #define BIT_NM_MEMCTRL	BIT_ULL(INDEX_NM_MEMCTRL)
 #define BIT_NM_CHANNEL	BIT_ULL(INDEX_NM_CHANNEL)
 #define BIT_NM_DIMM	BIT_ULL(INDEX_NM_DIMM)
@@ -231,10 +238,11 @@
 typedef bool (*skx_decode_f)(struct decoded_addr *res);
 typedef void (*skx_show_retry_log_f)(struct decoded_addr *res, char *msg, int len, bool scrub_err);
 
-int __init skx_adxl_get(void);
-void __exit skx_adxl_put(void);
+int skx_adxl_get(void);
+void skx_adxl_put(void);
 void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log);
 void skx_set_mem_cfg(bool mem_cfg_2lm);
+void skx_set_res_cfg(struct res_config *cfg);
 
 int skx_get_src_id(struct skx_dev *d, int off, u8 *id);
 int skx_get_node_id(struct skx_dev *d, u8 *id);
--- linux-qcom-6.8.0.orig/drivers/edac/synopsys_edac.c
+++ linux-qcom-6.8.0/drivers/edac/synopsys_edac.c
@@ -9,6 +9,8 @@
 #include <linux/edac.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/sizes.h>
 #include <linux/interrupt.h>
 #include <linux/of.h>
 
@@ -299,6 +301,7 @@
 /**
  * struct synps_edac_priv - DDR memory controller private instance data.
  * @baseaddr:		Base address of the DDR controller.
+ * @reglock:		Concurrent CSRs access lock.
  * @message:		Buffer for framing the event specific info.
  * @stat:		ECC status information.
  * @p_data:		Platform data.
@@ -313,6 +316,7 @@
  */
 struct synps_edac_priv {
 	void __iomem *baseaddr;
+	spinlock_t reglock;
 	char message[SYNPS_EDAC_MSG_SIZE];
 	struct synps_ecc_status stat;
 	const struct synps_platform_data *p_data;
@@ -334,6 +338,7 @@
  * @get_mtype:		Get mtype.
  * @get_dtype:		Get dtype.
  * @get_ecc_state:	Get ECC state.
+ * @get_mem_info:	Get EDAC memory info
  * @quirks:		To differentiate IPs.
  */
 struct synps_platform_data {
@@ -341,6 +346,9 @@
 	enum mem_type (*get_mtype)(const void __iomem *base);
 	enum dev_type (*get_dtype)(const void __iomem *base);
 	bool (*get_ecc_state)(void __iomem *base);
+#ifdef CONFIG_EDAC_DEBUG
+	u64 (*get_mem_info)(struct synps_edac_priv *priv);
+#endif
 	int quirks;
 };
 
@@ -399,6 +407,25 @@
 	return 0;
 }
 
+#ifdef CONFIG_EDAC_DEBUG
+/**
+ * zynqmp_get_mem_info - Get the current memory info.
+ * @priv:	DDR memory controller private instance data.
+ *
+ * Return: host interface address.
+ */
+static u64 zynqmp_get_mem_info(struct synps_edac_priv *priv)
+{
+	u64 hif_addr = 0, linear_addr;
+
+	linear_addr = priv->poison_addr;
+	if (linear_addr >= SZ_32G)
+		linear_addr = linear_addr - SZ_32G + SZ_2G;
+	hif_addr = linear_addr >> 3;
+	return hif_addr;
+}
+#endif
+
 /**
  * zynqmp_get_error_info - Get the current ECC error info.
  * @priv:	DDR memory controller private instance data.
@@ -408,7 +435,8 @@
 static int zynqmp_get_error_info(struct synps_edac_priv *priv)
 {
 	struct synps_ecc_status *p;
-	u32 regval, clearval = 0;
+	u32 regval, clearval;
+	unsigned long flags;
 	void __iomem *base;
 
 	base = priv->baseaddr;
@@ -452,10 +480,14 @@
 	p->ueinfo.blknr = (regval & ECC_CEADDR1_BLKNR_MASK);
 	p->ueinfo.data = readl(base + ECC_UESYND0_OFST);
 out:
-	clearval = ECC_CTRL_CLR_CE_ERR | ECC_CTRL_CLR_CE_ERRCNT;
-	clearval |= ECC_CTRL_CLR_UE_ERR | ECC_CTRL_CLR_UE_ERRCNT;
+	spin_lock_irqsave(&priv->reglock, flags);
+
+	clearval = readl(base + ECC_CLR_OFST) |
+		   ECC_CTRL_CLR_CE_ERR | ECC_CTRL_CLR_CE_ERRCNT |
+		   ECC_CTRL_CLR_UE_ERR | ECC_CTRL_CLR_UE_ERRCNT;
 	writel(clearval, base + ECC_CLR_OFST);
-	writel(0x0, base + ECC_CLR_OFST);
+
+	spin_unlock_irqrestore(&priv->reglock, flags);
 
 	return 0;
 }
@@ -515,24 +547,41 @@
 
 static void enable_intr(struct synps_edac_priv *priv)
 {
+	unsigned long flags;
+
 	/* Enable UE/CE Interrupts */
-	if (priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR)
-		writel(DDR_UE_MASK | DDR_CE_MASK,
-		       priv->baseaddr + ECC_CLR_OFST);
-	else
+	if (!(priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR)) {
 		writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK,
 		       priv->baseaddr + DDR_QOS_IRQ_EN_OFST);
 
+		return;
+	}
+
+	spin_lock_irqsave(&priv->reglock, flags);
+
+	writel(DDR_UE_MASK | DDR_CE_MASK,
+	       priv->baseaddr + ECC_CLR_OFST);
+
+	spin_unlock_irqrestore(&priv->reglock, flags);
 }
 
 static void disable_intr(struct synps_edac_priv *priv)
 {
+	unsigned long flags;
+
 	/* Disable UE/CE Interrupts */
-	if (priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR)
-		writel(0x0, priv->baseaddr + ECC_CLR_OFST);
-	else
+	if (!(priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR)) {
 		writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK,
 		       priv->baseaddr + DDR_QOS_IRQ_DB_OFST);
+
+		return;
+	}
+
+	spin_lock_irqsave(&priv->reglock, flags);
+
+	writel(0, priv->baseaddr + ECC_CLR_OFST);
+
+	spin_unlock_irqrestore(&priv->reglock, flags);
 }
 
 /**
@@ -576,8 +625,6 @@
 	/* v3.0 of the controller does not have this register */
 	if (!(priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR))
 		writel(regval, priv->baseaddr + DDR_QOS_IRQ_STAT_OFST);
-	else
-		enable_intr(priv);
 
 	return IRQ_HANDLED;
 }
@@ -899,6 +946,9 @@
 	.get_mtype	= zynqmp_get_mtype,
 	.get_dtype	= zynqmp_get_dtype,
 	.get_ecc_state	= zynqmp_get_ecc_state,
+#ifdef CONFIG_EDAC_DEBUG
+	.get_mem_info	= zynqmp_get_mem_info,
+#endif
 	.quirks         = (DDR_ECC_INTR_SUPPORT
 #ifdef CONFIG_EDAC_DEBUG
 			  | DDR_ECC_DATA_POISON_SUPPORT
@@ -952,10 +1002,16 @@
 static void ddr_poison_setup(struct synps_edac_priv *priv)
 {
 	int col = 0, row = 0, bank = 0, bankgrp = 0, rank = 0, regval;
+	const struct synps_platform_data *p_data;
 	int index;
 	ulong hif_addr = 0;
 
-	hif_addr = priv->poison_addr >> 3;
+	p_data = priv->p_data;
+
+	if (p_data->get_mem_info)
+		hif_addr = p_data->get_mem_info(priv);
+	else
+		hif_addr = priv->poison_addr >> 3;
 
 	for (index = 0; index < DDR_MAX_ROW_SHIFT; index++) {
 		if (priv->row_shift[index])
@@ -1359,6 +1415,7 @@
 	priv = mci->pvt_info;
 	priv->baseaddr = baseaddr;
 	priv->p_data = p_data;
+	spin_lock_init(&priv->reglock);
 
 	mc_init(mci, pdev);
 
--- linux-qcom-6.8.0.orig/drivers/edac/versal_edac.c
+++ linux-qcom-6.8.0/drivers/edac/versal_edac.c
@@ -423,7 +423,7 @@
 			 convert_to_physical(priv, pinf), pinf.burstpos);
 
 		edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci,
-				     priv->ce_cnt, 0, 0, 0, 0, 0, -1,
+				     1, 0, 0, 0, 0, 0, -1,
 				     priv->message, "");
 	}
 
@@ -436,7 +436,7 @@
 			 convert_to_physical(priv, pinf), pinf.burstpos);
 
 		edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci,
-				     priv->ue_cnt, 0, 0, 0, 0, 0, -1,
+				     1, 0, 0, 0, 0, 0, -1,
 				     priv->message, "");
 	}
 
@@ -1006,8 +1006,7 @@
 	}
 
 	rc = xlnx_register_event(PM_NOTIFY_CB, VERSAL_EVENT_ERROR_PMC_ERR1,
-				 XPM_EVENT_ERROR_MASK_DDRMC_CR | XPM_EVENT_ERROR_MASK_DDRMC_NCR |
-				 XPM_EVENT_ERROR_MASK_NOC_CR | XPM_EVENT_ERROR_MASK_NOC_NCR,
+				 XPM_EVENT_ERROR_MASK_DDRMC_CR | XPM_EVENT_ERROR_MASK_DDRMC_NCR,
 				 false, err_callback, mci);
 	if (rc) {
 		if (rc == -EACCES)
@@ -1044,8 +1043,6 @@
 
 	xlnx_unregister_event(PM_NOTIFY_CB, VERSAL_EVENT_ERROR_PMC_ERR1,
 			      XPM_EVENT_ERROR_MASK_DDRMC_CR |
-			      XPM_EVENT_ERROR_MASK_NOC_CR |
-			      XPM_EVENT_ERROR_MASK_NOC_NCR |
 			      XPM_EVENT_ERROR_MASK_DDRMC_NCR, err_callback, mci);
 	edac_mc_del_mc(&pdev->dev);
 	edac_mc_free(mci);
--- linux-qcom-6.8.0.orig/drivers/extcon/Kconfig
+++ linux-qcom-6.8.0/drivers/extcon/Kconfig
@@ -116,7 +116,8 @@
 
 config EXTCON_MAX8997
 	tristate "Maxim MAX8997 EXTCON Support"
-	depends on MFD_MAX8997 && IRQ_DOMAIN
+	depends on MFD_MAX8997
+	select IRQ_DOMAIN
 	help
 	  If you say yes here you get support for the MUIC device of
 	  Maxim MAX8997 PMIC. The MAX8997 MUIC is a USB port accessory
--- linux-qcom-6.8.0.orig/drivers/firewire/core-cdev.c
+++ linux-qcom-6.8.0/drivers/firewire/core-cdev.c
@@ -598,11 +598,11 @@
 		queue_event(client, &e->event, rsp, sizeof(*rsp) + rsp->length, NULL, 0);
 
 		break;
+	}
 	default:
 		WARN_ON(1);
 		break;
 	}
-	}
 
 	/* Drop the idr's reference */
 	client_put(client);
--- linux-qcom-6.8.0.orig/drivers/firewire/nosy.c
+++ linux-qcom-6.8.0/drivers/firewire/nosy.c
@@ -148,10 +148,12 @@
 	if (atomic_read(&buffer->size) == 0)
 		return -ENODEV;
 
-	/* FIXME: Check length <= user_length. */
+	length = buffer->head->length;
+
+	if (length > user_length)
+		return 0;
 
 	end = buffer->data + buffer->capacity;
-	length = buffer->head->length;
 
 	if (&buffer->head->data[length] < end) {
 		if (copy_to_user(data, buffer->head->data, length))
--- linux-qcom-6.8.0.orig/drivers/firewire/ohci.c
+++ linux-qcom-6.8.0/drivers/firewire/ohci.c
@@ -1556,6 +1556,8 @@
 #define HEADER_GET_DATA_LENGTH(q)	(((q) >> 16) & 0xffff)
 #define HEADER_GET_EXTENDED_TCODE(q)	(((q) >> 0) & 0xffff)
 
+static u32 get_cycle_time(struct fw_ohci *ohci);
+
 static void handle_local_rom(struct fw_ohci *ohci,
 			     struct fw_packet *packet, u32 csr)
 {
@@ -1580,6 +1582,8 @@
 				 (void *) ohci->config_rom + i, length);
 	}
 
+	// Timestamping on behalf of the hardware.
+	response.timestamp = cycle_time_to_ohci_tstamp(get_cycle_time(ohci));
 	fw_core_handle_response(&ohci->card, &response);
 }
 
@@ -1628,6 +1632,8 @@
 	fw_fill_response(&response, packet->header, RCODE_BUSY, NULL, 0);
 
  out:
+	// Timestamping on behalf of the hardware.
+	response.timestamp = cycle_time_to_ohci_tstamp(get_cycle_time(ohci));
 	fw_core_handle_response(&ohci->card, &response);
 }
 
@@ -1670,8 +1676,6 @@
 	}
 }
 
-static u32 get_cycle_time(struct fw_ohci *ohci);
-
 static void at_context_transmit(struct context *ctx, struct fw_packet *packet)
 {
 	unsigned long flags;
@@ -2060,6 +2064,8 @@
 
 	ohci->generation = generation;
 	reg_write(ohci, OHCI1394_IntEventClear, OHCI1394_busReset);
+	if (param_debug & OHCI_PARAM_DEBUG_BUSRESETS)
+		reg_write(ohci, OHCI1394_IntMaskSet, OHCI1394_busReset);
 
 	if (ohci->quirks & QUIRK_RESET_PACKET)
 		ohci->request_generation = generation;
@@ -2125,12 +2131,14 @@
 		return IRQ_NONE;
 
 	/*
-	 * busReset and postedWriteErr must not be cleared yet
+	 * busReset and postedWriteErr events must not be cleared yet
 	 * (OHCI 1.1 clauses 7.2.3.2 and 13.2.8.1)
 	 */
 	reg_write(ohci, OHCI1394_IntEventClear,
 		  event & ~(OHCI1394_busReset | OHCI1394_postedWriteErr));
 	log_irqs(ohci, event);
+	if (event & OHCI1394_busReset)
+		reg_write(ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);
 
 	if (event & OHCI1394_selfIDComplete)
 		queue_work(selfid_workqueue, &ohci->bus_reset_work);
--- linux-qcom-6.8.0.orig/drivers/firmware/Kconfig
+++ linux-qcom-6.8.0/drivers/firmware/Kconfig
@@ -182,6 +182,7 @@
 config SYSFB
 	bool
 	select BOOT_VESA_SUPPORT
+	select SCREEN_INFO
 
 config SYSFB_SIMPLEFB
 	bool "Mark VGA/VBE/EFI FB as generic system framebuffer"
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_ffa/driver.c
+++ linux-qcom-6.8.0/drivers/firmware/arm_ffa/driver.c
@@ -790,7 +790,7 @@
 
 			part_id = packed_id_list[ids_processed++];
 
-			if (!ids_count[list]) { /* Global Notification */
+			if (ids_count[list] == 1) { /* Global Notification */
 				__do_sched_recv_cb(part_id, 0, false);
 				continue;
 			}
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_scmi/bus.c
+++ linux-qcom-6.8.0/drivers/firmware/arm_scmi/bus.c
@@ -305,7 +305,10 @@
 
 static void scmi_device_release(struct device *dev)
 {
-	kfree(to_scmi_dev(dev));
+	struct scmi_device *scmi_dev = to_scmi_dev(dev);
+
+	kfree_const(scmi_dev->name);
+	kfree(scmi_dev);
 }
 
 static void __scmi_device_destroy(struct scmi_device *scmi_dev)
@@ -318,7 +321,6 @@
 	if (scmi_dev->protocol_id == SCMI_PROTOCOL_SYSTEM)
 		atomic_set(&scmi_syspower_registered, 0);
 
-	kfree_const(scmi_dev->name);
 	ida_free(&scmi_bus_id, scmi_dev->id);
 	device_unregister(&scmi_dev->dev);
 }
@@ -390,7 +392,6 @@
 
 	return scmi_dev;
 put_dev:
-	kfree_const(scmi_dev->name);
 	put_device(&scmi_dev->dev);
 	ida_free(&scmi_bus_id, id);
 	return NULL;
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_scmi/common.h
+++ linux-qcom-6.8.0/drivers/firmware/arm_scmi/common.h
@@ -163,6 +163,7 @@
  *      used to initialize this channel
  * @dev: Reference to device in the SCMI hierarchy corresponding to this
  *	 channel
+ * @is_p2a: A flag to identify a channel as P2A (RX)
  * @rx_timeout_ms: The configured RX timeout in milliseconds.
  * @handle: Pointer to SCMI entity handle
  * @no_completion_irq: Flag to indicate that this channel has no completion
@@ -174,6 +175,7 @@
 struct scmi_chan_info {
 	int id;
 	struct device *dev;
+	bool is_p2a;
 	unsigned int rx_timeout_ms;
 	struct scmi_handle *handle;
 	bool no_completion_irq;
@@ -291,6 +293,7 @@
 #endif
 #ifdef CONFIG_ARM_SCMI_TRANSPORT_SMC
 extern const struct scmi_desc scmi_smc_desc;
+extern const struct scmi_desc scmi_qcom_smc_desc;
 #endif
 #ifdef CONFIG_ARM_SCMI_TRANSPORT_VIRTIO
 extern const struct scmi_desc scmi_virtio_desc;
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_scmi/driver.c
+++ linux-qcom-6.8.0/drivers/firmware/arm_scmi/driver.c
@@ -857,6 +857,11 @@
 static inline void scmi_clear_channel(struct scmi_info *info,
 				      struct scmi_chan_info *cinfo)
 {
+	if (!cinfo->is_p2a) {
+		dev_warn(cinfo->dev, "Invalid clear on A2P channel !\n");
+		return;
+	}
+
 	if (info->desc->ops->clear_channel)
 		info->desc->ops->clear_channel(cinfo);
 }
@@ -2333,6 +2338,7 @@
 	if (!cinfo)
 		return -ENOMEM;
 
+	cinfo->is_p2a = !tx;
 	cinfo->rx_timeout_ms = info->desc->max_rx_timeout_ms;
 
 	/* Create a unique name for this transport device */
@@ -2617,10 +2623,8 @@
 	dbg->top_dentry = top_dentry;
 
 	if (devm_add_action_or_reset(info->dev,
-				     scmi_debugfs_common_cleanup, dbg)) {
-		scmi_debugfs_common_cleanup(dbg);
+				     scmi_debugfs_common_cleanup, dbg))
 		return NULL;
-	}
 
 	return dbg;
 }
@@ -2927,7 +2931,7 @@
 #ifdef CONFIG_ARM_SCMI_TRANSPORT_SMC
 	{ .compatible = "arm,scmi-smc", .data = &scmi_smc_desc},
 	{ .compatible = "arm,scmi-smc-param", .data = &scmi_smc_desc},
-	{ .compatible = "qcom,scmi-smc", .data = &scmi_smc_desc},
+	{ .compatible = "qcom,scmi-smc", .data = &scmi_qcom_smc_desc},
 #endif
 #ifdef CONFIG_ARM_SCMI_TRANSPORT_VIRTIO
 	{ .compatible = "arm,scmi-virtio", .data = &scmi_virtio_desc},
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_scmi/mailbox.c
+++ linux-qcom-6.8.0/drivers/firmware/arm_scmi/mailbox.c
@@ -23,6 +23,7 @@
  * @chan_receiver: Optional Receiver mailbox unidirectional channel
  * @cinfo: SCMI channel info
  * @shmem: Transmit/Receive shared memory area
+ * @chan_lock: Lock that prevents multiple xfers from being queued
  */
 struct scmi_mailbox {
 	struct mbox_client cl;
@@ -30,6 +31,7 @@
 	struct mbox_chan *chan_receiver;
 	struct scmi_chan_info *cinfo;
 	struct scmi_shared_mem __iomem *shmem;
+	struct mutex chan_lock;
 };
 
 #define client_to_scmi_mailbox(c) container_of(c, struct scmi_mailbox, cl)
@@ -228,6 +230,7 @@
 
 	cinfo->transport_info = smbox;
 	smbox->cinfo = cinfo;
+	mutex_init(&smbox->chan_lock);
 
 	return 0;
 }
@@ -255,13 +258,23 @@
 	struct scmi_mailbox *smbox = cinfo->transport_info;
 	int ret;
 
-	ret = mbox_send_message(smbox->chan, xfer);
+	/*
+	 * The mailbox layer has its own queue. However the mailbox queue
+	 * confuses the per message SCMI timeouts since the clock starts when
+	 * the message is submitted into the mailbox queue. So when multiple
+	 * messages are queued up the clock starts on all messages instead of
+	 * only the one inflight.
+	 */
+	mutex_lock(&smbox->chan_lock);
 
-	/* mbox_send_message returns non-negative value on success, so reset */
-	if (ret > 0)
-		ret = 0;
+	ret = mbox_send_message(smbox->chan, xfer);
+	/* mbox_send_message returns non-negative value on success */
+	if (ret < 0) {
+		mutex_unlock(&smbox->chan_lock);
+		return ret;
+	}
 
-	return ret;
+	return 0;
 }
 
 static void mailbox_mark_txdone(struct scmi_chan_info *cinfo, int ret,
@@ -269,13 +282,10 @@
 {
 	struct scmi_mailbox *smbox = cinfo->transport_info;
 
-	/*
-	 * NOTE: we might prefer not to need the mailbox ticker to manage the
-	 * transfer queueing since the protocol layer queues things by itself.
-	 * Unfortunately, we have to kick the mailbox framework after we have
-	 * received our message.
-	 */
 	mbox_client_txdone(smbox->chan, ret);
+
+	/* Release channel */
+	mutex_unlock(&smbox->chan_lock);
 }
 
 static void mailbox_fetch_response(struct scmi_chan_info *cinfo,
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_scmi/optee.c
+++ linux-qcom-6.8.0/drivers/firmware/arm_scmi/optee.c
@@ -471,6 +471,13 @@
 	struct scmi_chan_info *cinfo = p;
 	struct scmi_optee_channel *channel = cinfo->transport_info;
 
+	/*
+	 * Different protocols might share the same chan info, so a previous
+	 * call might have already freed the structure.
+	 */
+	if (!channel)
+		return 0;
+
 	mutex_lock(&scmi_optee_private->mu);
 	list_del(&channel->link);
 	mutex_unlock(&scmi_optee_private->mu);
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_scmi/raw_mode.c
+++ linux-qcom-6.8.0/drivers/firmware/arm_scmi/raw_mode.c
@@ -921,7 +921,7 @@
 	rd->raw = raw;
 	filp->private_data = rd;
 
-	return 0;
+	return nonseekable_open(inode, filp);
 }
 
 static int scmi_dbg_raw_mode_release(struct inode *inode, struct file *filp)
@@ -950,6 +950,7 @@
 	.open = scmi_dbg_raw_mode_open,
 	.release = scmi_dbg_raw_mode_release,
 	.write = scmi_dbg_raw_mode_reset_write,
+	.llseek = no_llseek,
 	.owner = THIS_MODULE,
 };
 
@@ -959,6 +960,7 @@
 	.read = scmi_dbg_raw_mode_message_read,
 	.write = scmi_dbg_raw_mode_message_write,
 	.poll = scmi_dbg_raw_mode_message_poll,
+	.llseek = no_llseek,
 	.owner = THIS_MODULE,
 };
 
@@ -975,6 +977,7 @@
 	.read = scmi_dbg_raw_mode_message_read,
 	.write = scmi_dbg_raw_mode_message_async_write,
 	.poll = scmi_dbg_raw_mode_message_poll,
+	.llseek = no_llseek,
 	.owner = THIS_MODULE,
 };
 
@@ -998,6 +1001,7 @@
 	.release = scmi_dbg_raw_mode_release,
 	.read = scmi_test_dbg_raw_mode_notif_read,
 	.poll = scmi_test_dbg_raw_mode_notif_poll,
+	.llseek = no_llseek,
 	.owner = THIS_MODULE,
 };
 
@@ -1021,6 +1025,7 @@
 	.release = scmi_dbg_raw_mode_release,
 	.read = scmi_test_dbg_raw_mode_errors_read,
 	.poll = scmi_test_dbg_raw_mode_errors_poll,
+	.llseek = no_llseek,
 	.owner = THIS_MODULE,
 };
 
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_scmi/smc.c
+++ linux-qcom-6.8.0/drivers/firmware/arm_scmi/smc.c
@@ -214,6 +214,13 @@
 	struct scmi_chan_info *cinfo = p;
 	struct scmi_smc *scmi_info = cinfo->transport_info;
 
+	/*
+	 * Different protocols might share the same chan info, so a previous
+	 * smc_chan_free call might have already freed the structure.
+	 */
+	if (!scmi_info)
+		return 0;
+
 	/* Ignore any possible further reception on the IRQ path */
 	if (scmi_info->irq > 0)
 		free_irq(scmi_info->irq, scmi_info);
@@ -296,3 +303,12 @@
 	.sync_cmds_completed_on_ret = true,
 	.atomic_enabled = IS_ENABLED(CONFIG_ARM_SCMI_TRANSPORT_SMC_ATOMIC_ENABLE),
 };
+
+const struct scmi_desc scmi_qcom_smc_desc = {
+	.ops = &scmi_smc_ops,
+	.max_rx_timeout_ms = 3000,
+	.max_msg = 10,
+	.max_msg_size = 256,
+	.sync_cmds_completed_on_ret = true,
+	.atomic_enabled = IS_ENABLED(CONFIG_ARM_SCMI_TRANSPORT_SMC_ATOMIC_ENABLE),
+};
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_scpi.c
+++ linux-qcom-6.8.0/drivers/firmware/arm_scpi.c
@@ -630,6 +630,9 @@
 	if (ret)
 		return ERR_PTR(ret);
 
+	if (!buf.opp_count)
+		return ERR_PTR(-ENOENT);
+
 	info = kmalloc(sizeof(*info), GFP_KERNEL);
 	if (!info)
 		return ERR_PTR(-ENOMEM);
--- linux-qcom-6.8.0.orig/drivers/firmware/arm_sdei.c
+++ linux-qcom-6.8.0/drivers/firmware/arm_sdei.c
@@ -763,7 +763,7 @@
 	int err;
 
 	/* unregister private events */
-	cpuhp_remove_state(sdei_entry_point);
+	cpuhp_remove_state(sdei_hp_state);
 
 	err = sdei_unregister_shared();
 	if (err)
--- linux-qcom-6.8.0.orig/drivers/firmware/cirrus/cs_dsp.c
+++ linux-qcom-6.8.0/drivers/firmware/cirrus/cs_dsp.c
@@ -522,7 +522,7 @@
 {
 	cs_dsp_debugfs_clear(dsp);
 	debugfs_remove_recursive(dsp->debugfs_root);
-	dsp->debugfs_root = NULL;
+	dsp->debugfs_root = ERR_PTR(-ENODEV);
 }
 EXPORT_SYMBOL_NS_GPL(cs_dsp_cleanup_debugfs, FW_CS_DSP);
 #else
@@ -796,6 +796,9 @@
 
 	lockdep_assert_held(&ctl->dsp->pwr_lock);
 
+	if (ctl->flags && !(ctl->flags & WMFW_CTL_FLAG_WRITEABLE))
+		return -EPERM;
+
 	if (len + off * sizeof(u32) > ctl->len)
 		return -EINVAL;
 
@@ -1053,9 +1056,16 @@
 	int len;
 };
 
-static int cs_dsp_coeff_parse_string(int bytes, const u8 **pos, const u8 **str)
+static int cs_dsp_coeff_parse_string(int bytes, const u8 **pos, unsigned int avail,
+				     const u8 **str)
 {
-	int length;
+	int length, total_field_len;
+
+	/* String fields are at least one __le32 */
+	if (sizeof(__le32) > avail) {
+		*pos = NULL;
+		return 0;
+	}
 
 	switch (bytes) {
 	case 1:
@@ -1068,10 +1078,16 @@
 		return 0;
 	}
 
+	total_field_len = ((length + bytes) + 3) & ~0x03;
+	if ((unsigned int)total_field_len > avail) {
+		*pos = NULL;
+		return 0;
+	}
+
 	if (str)
 		*str = *pos + bytes;
 
-	*pos += ((length + bytes) + 3) & ~0x03;
+	*pos += total_field_len;
 
 	return length;
 }
@@ -1096,71 +1112,134 @@
 	return val;
 }
 
-static inline void cs_dsp_coeff_parse_alg(struct cs_dsp *dsp, const u8 **data,
-					  struct cs_dsp_coeff_parsed_alg *blk)
+static int cs_dsp_coeff_parse_alg(struct cs_dsp *dsp,
+				  const struct wmfw_region *region,
+				  struct cs_dsp_coeff_parsed_alg *blk)
 {
 	const struct wmfw_adsp_alg_data *raw;
+	unsigned int data_len = le32_to_cpu(region->len);
+	unsigned int pos;
+	const u8 *tmp;
+
+	raw = (const struct wmfw_adsp_alg_data *)region->data;
 
 	switch (dsp->fw_ver) {
 	case 0:
 	case 1:
-		raw = (const struct wmfw_adsp_alg_data *)*data;
-		*data = raw->data;
+		if (sizeof(*raw) > data_len)
+			return -EOVERFLOW;
 
 		blk->id = le32_to_cpu(raw->id);
 		blk->name = raw->name;
-		blk->name_len = strlen(raw->name);
+		blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name));
 		blk->ncoeff = le32_to_cpu(raw->ncoeff);
+
+		pos = sizeof(*raw);
 		break;
 	default:
-		blk->id = cs_dsp_coeff_parse_int(sizeof(raw->id), data);
-		blk->name_len = cs_dsp_coeff_parse_string(sizeof(u8), data,
+		if (sizeof(raw->id) > data_len)
+			return -EOVERFLOW;
+
+		tmp = region->data;
+		blk->id = cs_dsp_coeff_parse_int(sizeof(raw->id), &tmp);
+		pos = tmp - region->data;
+
+		tmp = &region->data[pos];
+		blk->name_len = cs_dsp_coeff_parse_string(sizeof(u8), &tmp, data_len - pos,
 							  &blk->name);
-		cs_dsp_coeff_parse_string(sizeof(u16), data, NULL);
-		blk->ncoeff = cs_dsp_coeff_parse_int(sizeof(raw->ncoeff), data);
+		if (!tmp)
+			return -EOVERFLOW;
+
+		pos = tmp - region->data;
+		cs_dsp_coeff_parse_string(sizeof(u16), &tmp, data_len - pos, NULL);
+		if (!tmp)
+			return -EOVERFLOW;
+
+		pos = tmp - region->data;
+		if (sizeof(raw->ncoeff) > (data_len - pos))
+			return -EOVERFLOW;
+
+		blk->ncoeff = cs_dsp_coeff_parse_int(sizeof(raw->ncoeff), &tmp);
+		pos += sizeof(raw->ncoeff);
 		break;
 	}
 
+	if ((int)blk->ncoeff < 0)
+		return -EOVERFLOW;
+
 	cs_dsp_dbg(dsp, "Algorithm ID: %#x\n", blk->id);
 	cs_dsp_dbg(dsp, "Algorithm name: %.*s\n", blk->name_len, blk->name);
 	cs_dsp_dbg(dsp, "# of coefficient descriptors: %#x\n", blk->ncoeff);
+
+	return pos;
 }
 
-static inline void cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp, const u8 **data,
-					    struct cs_dsp_coeff_parsed_coeff *blk)
+static int cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp,
+				    const struct wmfw_region *region,
+				    unsigned int pos,
+				    struct cs_dsp_coeff_parsed_coeff *blk)
 {
 	const struct wmfw_adsp_coeff_data *raw;
+	unsigned int data_len = le32_to_cpu(region->len);
+	unsigned int blk_len, blk_end_pos;
 	const u8 *tmp;
-	int length;
+
+	raw = (const struct wmfw_adsp_coeff_data *)&region->data[pos];
+	if (sizeof(raw->hdr) > (data_len - pos))
+		return -EOVERFLOW;
+
+	blk_len = le32_to_cpu(raw->hdr.size);
+	if (blk_len > S32_MAX)
+		return -EOVERFLOW;
+
+	if (blk_len > (data_len - pos - sizeof(raw->hdr)))
+		return -EOVERFLOW;
+
+	blk_end_pos = pos + sizeof(raw->hdr) + blk_len;
+
+	blk->offset = le16_to_cpu(raw->hdr.offset);
+	blk->mem_type = le16_to_cpu(raw->hdr.type);
 
 	switch (dsp->fw_ver) {
 	case 0:
 	case 1:
-		raw = (const struct wmfw_adsp_coeff_data *)*data;
-		*data = *data + sizeof(raw->hdr) + le32_to_cpu(raw->hdr.size);
+		if (sizeof(*raw) > (data_len - pos))
+			return -EOVERFLOW;
 
-		blk->offset = le16_to_cpu(raw->hdr.offset);
-		blk->mem_type = le16_to_cpu(raw->hdr.type);
 		blk->name = raw->name;
-		blk->name_len = strlen(raw->name);
+		blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name));
 		blk->ctl_type = le16_to_cpu(raw->ctl_type);
 		blk->flags = le16_to_cpu(raw->flags);
 		blk->len = le32_to_cpu(raw->len);
 		break;
 	default:
-		tmp = *data;
-		blk->offset = cs_dsp_coeff_parse_int(sizeof(raw->hdr.offset), &tmp);
-		blk->mem_type = cs_dsp_coeff_parse_int(sizeof(raw->hdr.type), &tmp);
-		length = cs_dsp_coeff_parse_int(sizeof(raw->hdr.size), &tmp);
-		blk->name_len = cs_dsp_coeff_parse_string(sizeof(u8), &tmp,
+		pos += sizeof(raw->hdr);
+		tmp = &region->data[pos];
+		blk->name_len = cs_dsp_coeff_parse_string(sizeof(u8), &tmp, data_len - pos,
 							  &blk->name);
-		cs_dsp_coeff_parse_string(sizeof(u8), &tmp, NULL);
-		cs_dsp_coeff_parse_string(sizeof(u16), &tmp, NULL);
+		if (!tmp)
+			return -EOVERFLOW;
+
+		pos = tmp - region->data;
+		cs_dsp_coeff_parse_string(sizeof(u8), &tmp, data_len - pos, NULL);
+		if (!tmp)
+			return -EOVERFLOW;
+
+		pos = tmp - region->data;
+		cs_dsp_coeff_parse_string(sizeof(u16), &tmp, data_len - pos, NULL);
+		if (!tmp)
+			return -EOVERFLOW;
+
+		pos = tmp - region->data;
+		if (sizeof(raw->ctl_type) + sizeof(raw->flags) + sizeof(raw->len) >
+		    (data_len - pos))
+			return -EOVERFLOW;
+
 		blk->ctl_type = cs_dsp_coeff_parse_int(sizeof(raw->ctl_type), &tmp);
+		pos += sizeof(raw->ctl_type);
 		blk->flags = cs_dsp_coeff_parse_int(sizeof(raw->flags), &tmp);
+		pos += sizeof(raw->flags);
 		blk->len = cs_dsp_coeff_parse_int(sizeof(raw->len), &tmp);
-
-		*data = *data + sizeof(raw->hdr) + length;
 		break;
 	}
 
@@ -1170,6 +1249,8 @@
 	cs_dsp_dbg(dsp, "\tCoefficient flags: %#x\n", blk->flags);
 	cs_dsp_dbg(dsp, "\tALSA control type: %#x\n", blk->ctl_type);
 	cs_dsp_dbg(dsp, "\tALSA control len: %#x\n", blk->len);
+
+	return blk_end_pos;
 }
 
 static int cs_dsp_check_coeff_flags(struct cs_dsp *dsp,
@@ -1193,12 +1274,16 @@
 	struct cs_dsp_alg_region alg_region = {};
 	struct cs_dsp_coeff_parsed_alg alg_blk;
 	struct cs_dsp_coeff_parsed_coeff coeff_blk;
-	const u8 *data = region->data;
-	int i, ret;
+	int i, pos, ret;
+
+	pos = cs_dsp_coeff_parse_alg(dsp, region, &alg_blk);
+	if (pos < 0)
+		return pos;
 
-	cs_dsp_coeff_parse_alg(dsp, &data, &alg_blk);
 	for (i = 0; i < alg_blk.ncoeff; i++) {
-		cs_dsp_coeff_parse_coeff(dsp, &data, &coeff_blk);
+		pos = cs_dsp_coeff_parse_coeff(dsp, region, pos, &coeff_blk);
+		if (pos < 0)
+			return pos;
 
 		switch (coeff_blk.ctl_type) {
 		case WMFW_CTL_TYPE_BYTES:
@@ -1267,6 +1352,10 @@
 	const struct wmfw_adsp1_sizes *adsp1_sizes;
 
 	adsp1_sizes = (void *)&firmware->data[pos];
+	if (sizeof(*adsp1_sizes) > firmware->size - pos) {
+		cs_dsp_err(dsp, "%s: file truncated\n", file);
+		return 0;
+	}
 
 	cs_dsp_dbg(dsp, "%s: %d DM, %d PM, %d ZM\n", file,
 		   le32_to_cpu(adsp1_sizes->dm), le32_to_cpu(adsp1_sizes->pm),
@@ -1283,6 +1372,10 @@
 	const struct wmfw_adsp2_sizes *adsp2_sizes;
 
 	adsp2_sizes = (void *)&firmware->data[pos];
+	if (sizeof(*adsp2_sizes) > firmware->size - pos) {
+		cs_dsp_err(dsp, "%s: file truncated\n", file);
+		return 0;
+	}
 
 	cs_dsp_dbg(dsp, "%s: %d XM, %d YM %d PM, %d ZM\n", file,
 		   le32_to_cpu(adsp2_sizes->xm), le32_to_cpu(adsp2_sizes->ym),
@@ -1322,7 +1415,6 @@
 	struct regmap *regmap = dsp->regmap;
 	unsigned int pos = 0;
 	const struct wmfw_header *header;
-	const struct wmfw_adsp1_sizes *adsp1_sizes;
 	const struct wmfw_footer *footer;
 	const struct wmfw_region *region;
 	const struct cs_dsp_region *mem;
@@ -1338,10 +1430,8 @@
 
 	ret = -EINVAL;
 
-	pos = sizeof(*header) + sizeof(*adsp1_sizes) + sizeof(*footer);
-	if (pos >= firmware->size) {
-		cs_dsp_err(dsp, "%s: file too short, %zu bytes\n",
-			   file, firmware->size);
+	if (sizeof(*header) >= firmware->size) {
+		ret = -EOVERFLOW;
 		goto out_fw;
 	}
 
@@ -1369,22 +1459,36 @@
 
 	pos = sizeof(*header);
 	pos = dsp->ops->parse_sizes(dsp, file, pos, firmware);
+	if ((pos == 0) || (sizeof(*footer) > firmware->size - pos)) {
+		ret = -EOVERFLOW;
+		goto out_fw;
+	}
 
 	footer = (void *)&firmware->data[pos];
 	pos += sizeof(*footer);
 
 	if (le32_to_cpu(header->len) != pos) {
-		cs_dsp_err(dsp, "%s: unexpected header length %d\n",
-			   file, le32_to_cpu(header->len));
+		ret = -EOVERFLOW;
 		goto out_fw;
 	}
 
 	cs_dsp_dbg(dsp, "%s: timestamp %llu\n", file,
 		   le64_to_cpu(footer->timestamp));
 
-	while (pos < firmware->size &&
-	       sizeof(*region) < firmware->size - pos) {
+	while (pos < firmware->size) {
+		/* Is there enough data for a complete block header? */
+		if (sizeof(*region) > firmware->size - pos) {
+			ret = -EOVERFLOW;
+			goto out_fw;
+		}
+
 		region = (void *)&(firmware->data[pos]);
+
+		if (le32_to_cpu(region->len) > firmware->size - pos - sizeof(*region)) {
+			ret = -EOVERFLOW;
+			goto out_fw;
+		}
+
 		region_name = "Unknown";
 		reg = 0;
 		text = NULL;
@@ -1441,16 +1545,6 @@
 			   regions, le32_to_cpu(region->len), offset,
 			   region_name);
 
-		if (le32_to_cpu(region->len) >
-		    firmware->size - pos - sizeof(*region)) {
-			cs_dsp_err(dsp,
-				   "%s.%d: %s region len %d bytes exceeds file length %zu\n",
-				   file, regions, region_name,
-				   le32_to_cpu(region->len), firmware->size);
-			ret = -EINVAL;
-			goto out_fw;
-		}
-
 		if (text) {
 			memcpy(text, region->data, le32_to_cpu(region->len));
 			cs_dsp_info(dsp, "%s: %s\n", file, text);
@@ -1501,6 +1595,9 @@
 	cs_dsp_buf_free(&buf_list);
 	kfree(text);
 
+	if (ret == -EOVERFLOW)
+		cs_dsp_err(dsp, "%s: file content overflows file data\n", file);
+
 	return ret;
 }
 
@@ -2068,10 +2165,20 @@
 	pos = le32_to_cpu(hdr->len);
 
 	blocks = 0;
-	while (pos < firmware->size &&
-	       sizeof(*blk) < firmware->size - pos) {
+	while (pos < firmware->size) {
+		/* Is there enough data for a complete block header? */
+		if (sizeof(*blk) > firmware->size - pos) {
+			ret = -EOVERFLOW;
+			goto out_fw;
+		}
+
 		blk = (void *)(&firmware->data[pos]);
 
+		if (le32_to_cpu(blk->len) > firmware->size - pos - sizeof(*blk)) {
+			ret = -EOVERFLOW;
+			goto out_fw;
+		}
+
 		type = le16_to_cpu(blk->type);
 		offset = le16_to_cpu(blk->offset);
 		version = le32_to_cpu(blk->ver) >> 8;
@@ -2168,17 +2275,6 @@
 		}
 
 		if (reg) {
-			if (le32_to_cpu(blk->len) >
-			    firmware->size - pos - sizeof(*blk)) {
-				cs_dsp_err(dsp,
-					   "%s.%d: %s region len %d bytes exceeds file length %zu\n",
-					   file, blocks, region_name,
-					   le32_to_cpu(blk->len),
-					   firmware->size);
-				ret = -EINVAL;
-				goto out_fw;
-			}
-
 			buf = cs_dsp_buf_alloc(blk->data,
 					       le32_to_cpu(blk->len),
 					       &buf_list);
@@ -2218,6 +2314,10 @@
 	regmap_async_complete(regmap);
 	cs_dsp_buf_free(&buf_list);
 	kfree(text);
+
+	if (ret == -EOVERFLOW)
+		cs_dsp_err(dsp, "%s: file content overflows file data\n", file);
+
 	return ret;
 }
 
@@ -2246,6 +2346,11 @@
 
 	mutex_init(&dsp->pwr_lock);
 
+#ifdef CONFIG_DEBUG_FS
+	/* Ensure this is invalid if client never provides a debugfs root */
+	dsp->debugfs_root = ERR_PTR(-ENODEV);
+#endif
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/firmware/dmi-id.c
+++ linux-qcom-6.8.0/drivers/firmware/dmi-id.c
@@ -169,9 +169,14 @@
 	return 0;
 }
 
+static void dmi_dev_release(struct device *dev)
+{
+	kfree(dev);
+}
+
 static struct class dmi_class = {
 	.name = "dmi",
-	.dev_release = (void(*)(struct device *)) kfree,
+	.dev_release = dmi_dev_release,
 	.dev_uevent = dmi_dev_uevent,
 };
 
--- linux-qcom-6.8.0.orig/drivers/firmware/dmi_scan.c
+++ linux-qcom-6.8.0/drivers/firmware/dmi_scan.c
@@ -102,6 +102,17 @@
 		const struct dmi_header *dm = (const struct dmi_header *)data;
 
 		/*
+		 * If a short entry is found (less than 4 bytes), not only it
+		 * is invalid, but we cannot reliably locate the next entry.
+		 */
+		if (dm->length < sizeof(struct dmi_header)) {
+			pr_warn(FW_BUG
+				"Corrupted DMI table, offset %zd (only %d entries processed)\n",
+				data - buf, i);
+			break;
+		}
+
+		/*
 		 *  We want to know the total length (formatted area and
 		 *  strings) before decoding to make sure we won't run off the
 		 *  table in dmi_decode or dmi_string
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/Kconfig
+++ linux-qcom-6.8.0/drivers/firmware/efi/Kconfig
@@ -76,10 +76,6 @@
 	bool "Enable the generic EFI decompressor"
 	depends on EFI_GENERIC_STUB && !ARM
 	select HAVE_KERNEL_GZIP
-	select HAVE_KERNEL_LZ4
-	select HAVE_KERNEL_LZMA
-	select HAVE_KERNEL_LZO
-	select HAVE_KERNEL_XZ
 	select HAVE_KERNEL_ZSTD
 	help
 	  Create the bootable image as an EFI application that carries the
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/Makefile
+++ linux-qcom-6.8.0/drivers/firmware/efi/Makefile
@@ -25,6 +25,7 @@
 obj-$(CONFIG_EFI_BOOTLOADER_CONTROL)	+= efibc.o
 obj-$(CONFIG_EFI_TEST)			+= test/
 obj-$(CONFIG_EFI_DEV_PATH_PARSER)	+= dev-path-parser.o
+obj-$(CONFIG_EFI)			+= secureboot.o
 obj-$(CONFIG_APPLE_PROPERTIES)		+= apple-properties.o
 obj-$(CONFIG_EFI_RCI2_TABLE)		+= rci2-table.o
 obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE)	+= embedded-firmware.o
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/efi-init.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/efi-init.c
@@ -19,6 +19,7 @@
 #include <linux/of_fdt.h>
 #include <linux/platform_device.h>
 #include <linux/screen_info.h>
+#include <linux/security.h>
 
 #include <asm/efi.h>
 
@@ -237,6 +238,13 @@
 		return;
 	}
 
+	efi_set_secure_boot(efi_get__secure_boot());
+
+#ifdef CONFIG_LOCK_DOWN_IN_SECURE_BOOT
+	if (efi_enabled(EFI_SECURE_BOOT))
+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);
+#endif
+
 	reserve_regions();
 	/*
 	 * For memblock manipulation, the cap should come after the memblock_add().
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/efi.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/efi.c
@@ -33,6 +33,7 @@
 #include <linux/memblock.h>
 #include <linux/security.h>
 #include <linux/notifier.h>
+#include <linux/bsearch.h>
 
 #include <asm/early_ioremap.h>
 
@@ -203,6 +204,8 @@
 
 	name_size = sizeof(name);
 
+	if (!efi.get_next_variable)
+		return false;
 	status = efi.get_next_variable(&name_size, &name, &guid);
 	if (status == EFI_UNSUPPORTED)
 		return false;
@@ -597,7 +600,8 @@
 	{EFI_MEMORY_ATTRIBUTES_TABLE_GUID,	&efi_mem_attr_table,	"MEMATTR"	},
 	{LINUX_EFI_RANDOM_SEED_TABLE_GUID,	&efi_rng_seed,		"RNG"		},
 	{LINUX_EFI_TPM_EVENT_LOG_GUID,		&efi.tpm_log,		"TPMEventLog"	},
-	{LINUX_EFI_TPM_FINAL_LOG_GUID,		&efi.tpm_final_log,	"TPMFinalLog"	},
+	{EFI_TCG2_FINAL_EVENTS_TABLE_GUID,	&efi.tpm_final_log,	"TPMFinalLog"	},
+	{EFI_CC_FINAL_EVENTS_TABLE_GUID,	&efi.tpm_final_log,	"CCFinalLog"	},
 	{LINUX_EFI_MEMRESERVE_TABLE_GUID,	&mem_reserve,		"MEMRESERVE"	},
 	{LINUX_EFI_INITRD_MEDIA_GUID,		&initrd,		"INITRD"	},
 	{EFI_RT_PROPERTIES_TABLE_GUID,		&rt_prop,		"RTPROP"	},
@@ -990,40 +994,101 @@
 	return -EINVAL;
 }
 
+struct efi_error_code {
+	efi_status_t status;
+	int errno;
+	const char *description;
+};
+
+static const struct efi_error_code efi_error_codes[] = {
+	{ EFI_SUCCESS, 0, "Success"},
+#if 0
+	{ EFI_LOAD_ERROR, -EPICK_AN_ERRNO, "Load Error"},
+#endif
+	{ EFI_INVALID_PARAMETER, -EINVAL, "Invalid Parameter"},
+	{ EFI_UNSUPPORTED, -ENOSYS, "Unsupported"},
+	{ EFI_BAD_BUFFER_SIZE, -ENOSPC, "Bad Buffer Size"},
+	{ EFI_BUFFER_TOO_SMALL, -ENOSPC, "Buffer Too Small"},
+	{ EFI_NOT_READY, -EAGAIN, "Not Ready"},
+	{ EFI_DEVICE_ERROR, -EIO, "Device Error"},
+	{ EFI_WRITE_PROTECTED, -EROFS, "Write Protected"},
+	{ EFI_OUT_OF_RESOURCES, -ENOMEM, "Out of Resources"},
+#if 0
+	{ EFI_VOLUME_CORRUPTED, -EPICK_AN_ERRNO, "Volume Corrupt"},
+	{ EFI_VOLUME_FULL, -EPICK_AN_ERRNO, "Volume Full"},
+	{ EFI_NO_MEDIA, -EPICK_AN_ERRNO, "No Media"},
+	{ EFI_MEDIA_CHANGED, -EPICK_AN_ERRNO, "Media changed"},
+#endif
+	{ EFI_NOT_FOUND, -ENOENT, "Not Found"},
+#if 0
+	{ EFI_ACCESS_DENIED, -EPICK_AN_ERRNO, "Access Denied"},
+	{ EFI_NO_RESPONSE, -EPICK_AN_ERRNO, "No Response"},
+	{ EFI_NO_MAPPING, -EPICK_AN_ERRNO, "No mapping"},
+	{ EFI_TIMEOUT, -EPICK_AN_ERRNO, "Time out"},
+	{ EFI_NOT_STARTED, -EPICK_AN_ERRNO, "Not started"},
+	{ EFI_ALREADY_STARTED, -EPICK_AN_ERRNO, "Already started"},
+#endif
+	{ EFI_ABORTED, -EINTR, "Aborted"},
+#if 0
+	{ EFI_ICMP_ERROR, -EPICK_AN_ERRNO, "ICMP Error"},
+	{ EFI_TFTP_ERROR, -EPICK_AN_ERRNO, "TFTP Error"},
+	{ EFI_PROTOCOL_ERROR, -EPICK_AN_ERRNO, "Protocol Error"},
+	{ EFI_INCOMPATIBLE_VERSION, -EPICK_AN_ERRNO, "Incompatible Version"},
+#endif
+	{ EFI_SECURITY_VIOLATION, -EACCES, "Security Policy Violation"},
+#if 0
+	{ EFI_CRC_ERROR, -EPICK_AN_ERRNO, "CRC Error"},
+	{ EFI_END_OF_MEDIA, -EPICK_AN_ERRNO, "End of Media"},
+	{ EFI_END_OF_FILE, -EPICK_AN_ERRNO, "End of File"},
+	{ EFI_INVALID_LANGUAGE, -EPICK_AN_ERRNO, "Invalid Languages"},
+	{ EFI_COMPROMISED_DATA, -EPICK_AN_ERRNO, "Compromised Data"},
+
+	// warnings
+	{ EFI_WARN_UNKOWN_GLYPH, -EPICK_AN_ERRNO, "Warning Unknown Glyph"},
+	{ EFI_WARN_DELETE_FAILURE, -EPICK_AN_ERRNO, "Warning Delete Failure"},
+	{ EFI_WARN_WRITE_FAILURE, -EPICK_AN_ERRNO, "Warning Write Failure"},
+	{ EFI_WARN_BUFFER_TOO_SMALL, -EPICK_AN_ERRNO, "Warning Buffer Too Small"},
+#endif
+};
+
+static int
+efi_status_cmp_bsearch(const void *key, const void *item)
+{
+	u64 status = (u64)(uintptr_t)key;
+	struct efi_error_code *code = (struct efi_error_code *)item;
+
+	if (status < code->status)
+		return -1;
+	if (status > code->status)
+		return 1;
+	return 0;
+}
+
 int efi_status_to_err(efi_status_t status)
 {
-	int err;
+	struct efi_error_code *found;
+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);
 
-	switch (status) {
-	case EFI_SUCCESS:
-		err = 0;
-		break;
-	case EFI_INVALID_PARAMETER:
-		err = -EINVAL;
-		break;
-	case EFI_OUT_OF_RESOURCES:
-		err = -ENOSPC;
-		break;
-	case EFI_DEVICE_ERROR:
-		err = -EIO;
-		break;
-	case EFI_WRITE_PROTECTED:
-		err = -EROFS;
-		break;
-	case EFI_SECURITY_VIOLATION:
-		err = -EACCES;
-		break;
-	case EFI_NOT_FOUND:
-		err = -ENOENT;
-		break;
-	case EFI_ABORTED:
-		err = -EINTR;
-		break;
-	default:
-		err = -EINVAL;
-	}
+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,
+			sizeof(struct efi_error_code), num,
+			efi_status_cmp_bsearch);
+	if (!found)
+		return -EINVAL;
+	return found->errno;
+}
+
+const char *
+efi_status_to_str(efi_status_t status)
+{
+	struct efi_error_code *found;
+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);
 
-	return err;
+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,
+			sizeof(struct efi_error_code), num,
+			efi_status_cmp_bsearch);
+	if (!found)
+		return "Unknown error code";
+	return found->description;
 }
 EXPORT_SYMBOL_GPL(efi_status_to_err);
 
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/fdtparams.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/fdtparams.c
@@ -16,16 +16,24 @@
 	MMSIZE,
 	DCSIZE,
 	DCVERS,
+	SCBOOT,
 
 	PARAMCOUNT
 };
 
+static u32 __secure_boot __initdata = efi_secureboot_mode_unset;
+u32 __init efi_get__secure_boot(void)
+{
+	return __secure_boot;
+}
+
 static __initconst const char name[][22] = {
 	[SYSTAB] = "System Table         ",
 	[MMBASE] = "MemMap Address       ",
 	[MMSIZE] = "MemMap Size          ",
 	[DCSIZE] = "MemMap Desc. Size    ",
 	[DCVERS] = "MemMap Desc. Version ",
+	[SCBOOT] = "Secure Boot Enabled  ",
 };
 
 static __initconst const struct {
@@ -53,6 +61,7 @@
 			[MMSIZE] = "linux,uefi-mmap-size",
 			[DCSIZE] = "linux,uefi-mmap-desc-size",
 			[DCVERS] = "linux,uefi-mmap-desc-ver",
+			[SCBOOT] = "linux,uefi-secure-boot",
 		}
 	}
 };
@@ -95,6 +104,7 @@
 		[MMSIZE] = { &mm->size,		sizeof(mm->size) },
 		[DCSIZE] = { &mm->desc_size,	sizeof(mm->desc_size) },
 		[DCVERS] = { &mm->desc_version,	sizeof(mm->desc_version) },
+		[SCBOOT] = { &__secure_boot,	sizeof(__secure_boot) },
 	};
 
 	BUILD_BUG_ON(ARRAY_SIZE(target) != ARRAY_SIZE(name));
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/Makefile.zboot
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/Makefile.zboot
@@ -12,22 +12,16 @@
 $(obj)/vmlinux.bin: $(obj)/$(EFI_ZBOOT_PAYLOAD) FORCE
 	$(call if_changed,copy_and_pad)
 
-comp-type-$(CONFIG_KERNEL_GZIP)		:= gzip
-comp-type-$(CONFIG_KERNEL_LZ4)		:= lz4
-comp-type-$(CONFIG_KERNEL_LZMA)		:= lzma
-comp-type-$(CONFIG_KERNEL_LZO)		:= lzo
-comp-type-$(CONFIG_KERNEL_XZ)		:= xzkern
-comp-type-$(CONFIG_KERNEL_ZSTD)		:= zstd22
-
 # in GZIP, the appended le32 carrying the uncompressed size is part of the
 # format, but in other cases, we just append it at the end for convenience,
 # causing the original tools to complain when checking image integrity.
-# So disregard it when calculating the payload size in the zimage header.
-zboot-method-y                         := $(comp-type-y)_with_size
-zboot-size-len-y                       := 4
+comp-type-y				:= gzip
+zboot-method-y				:= gzip
+zboot-size-len-y			:= 0
 
-zboot-method-$(CONFIG_KERNEL_GZIP)     := gzip
-zboot-size-len-$(CONFIG_KERNEL_GZIP)   := 0
+comp-type-$(CONFIG_KERNEL_ZSTD)		:= zstd
+zboot-method-$(CONFIG_KERNEL_ZSTD)	:= zstd22_with_size
+zboot-size-len-$(CONFIG_KERNEL_ZSTD)	:= 4
 
 $(obj)/vmlinuz: $(obj)/vmlinux.bin FORCE
 	$(call if_changed,$(zboot-method-y))
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -11,6 +11,7 @@
 
 #include <linux/efi.h>
 #include <linux/kernel.h>
+#include <linux/overflow.h>
 #include <asm/efi.h>
 #include <asm/setup.h>
 
@@ -24,6 +25,8 @@
 static bool efi_nosoftreserve;
 static bool efi_disable_pci_dma = IS_ENABLED(CONFIG_EFI_DISABLE_PCI_DMA);
 
+int efi_mem_encrypt;
+
 bool __pure __efi_soft_reserve_enabled(void)
 {
 	return !efi_nosoftreserve;
@@ -75,6 +78,12 @@
 			efi_noinitrd = true;
 		} else if (IS_ENABLED(CONFIG_X86_64) && !strcmp(param, "no5lvl")) {
 			efi_no5lvl = true;
+		} else if (IS_ENABLED(CONFIG_ARCH_HAS_MEM_ENCRYPT) &&
+			   !strcmp(param, "mem_encrypt") && val) {
+			if (parse_option_str(val, "on"))
+				efi_mem_encrypt = 1;
+			else if (parse_option_str(val, "off"))
+				efi_mem_encrypt = -1;
 		} else if (!strcmp(param, "efi") && val) {
 			efi_nochunk = parse_option_str(val, "nochunk");
 			efi_novamap |= parse_option_str(val, "novamap");
@@ -193,7 +202,7 @@
 	*load_options_size = load_option_unpacked.optional_data_size;
 }
 
-enum efistub_event {
+enum efistub_event_type {
 	EFISTUB_EVT_INITRD,
 	EFISTUB_EVT_LOAD_OPTIONS,
 	EFISTUB_EVT_COUNT,
@@ -219,54 +228,95 @@
 	},
 };
 
+static_assert(sizeof(efi_tcg2_event_t) == sizeof(efi_cc_event_t));
+
+union efistub_event {
+	efi_tcg2_event_t	tcg2_data;
+	efi_cc_event_t		cc_data;
+};
+
+struct efistub_measured_event {
+	union efistub_event	event_data;
+	TCG_PCClientTaggedEvent tagged_event __packed;
+};
+
 static efi_status_t efi_measure_tagged_event(unsigned long load_addr,
 					     unsigned long load_size,
-					     enum efistub_event event)
+					     enum efistub_event_type event)
 {
+	union {
+		efi_status_t
+		(__efiapi *hash_log_extend_event)(void *, u64, efi_physical_addr_t,
+						  u64, const union efistub_event *);
+		struct { u32 hash_log_extend_event; } mixed_mode;
+	} method;
+	struct efistub_measured_event *evt;
+	int size = struct_size(evt, tagged_event.tagged_event_data,
+			       events[event].event_data_len);
 	efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID;
 	efi_tcg2_protocol_t *tcg2 = NULL;
+	union efistub_event ev;
 	efi_status_t status;
+	void *protocol;
 
 	efi_bs_call(locate_protocol, &tcg2_guid, NULL, (void **)&tcg2);
 	if (tcg2) {
-		struct efi_measured_event {
-			efi_tcg2_event_t	event_data;
-			efi_tcg2_tagged_event_t tagged_event;
-			u8			tagged_event_data[];
-		} *evt;
-		int size = sizeof(*evt) + events[event].event_data_len;
-
-		status = efi_bs_call(allocate_pool, EFI_LOADER_DATA, size,
-				     (void **)&evt);
-		if (status != EFI_SUCCESS)
-			goto fail;
-
-		evt->event_data = (struct efi_tcg2_event){
+		ev.tcg2_data = (struct efi_tcg2_event){
 			.event_size			= size,
-			.event_header.header_size	= sizeof(evt->event_data.event_header),
+			.event_header.header_size	= sizeof(ev.tcg2_data.event_header),
 			.event_header.header_version	= EFI_TCG2_EVENT_HEADER_VERSION,
 			.event_header.pcr_index		= events[event].pcr_index,
 			.event_header.event_type	= EV_EVENT_TAG,
 		};
+		protocol = tcg2;
+		method.hash_log_extend_event =
+			(void *)efi_table_attr(tcg2, hash_log_extend_event);
+	} else {
+		efi_guid_t cc_guid = EFI_CC_MEASUREMENT_PROTOCOL_GUID;
+		efi_cc_protocol_t *cc = NULL;
+
+		efi_bs_call(locate_protocol, &cc_guid, NULL, (void **)&cc);
+		if (!cc)
+			return EFI_UNSUPPORTED;
 
-		evt->tagged_event = (struct efi_tcg2_tagged_event){
-			.tagged_event_id		= events[event].event_id,
-			.tagged_event_data_size		= events[event].event_data_len,
+		ev.cc_data = (struct efi_cc_event){
+			.event_size			= size,
+			.event_header.header_size	= sizeof(ev.cc_data.event_header),
+			.event_header.header_version	= EFI_CC_EVENT_HEADER_VERSION,
+			.event_header.event_type	= EV_EVENT_TAG,
 		};
 
-		memcpy(evt->tagged_event_data, events[event].event_data,
-		       events[event].event_data_len);
-
-		status = efi_call_proto(tcg2, hash_log_extend_event, 0,
-					load_addr, load_size, &evt->event_data);
-		efi_bs_call(free_pool, evt);
-
+		status = efi_call_proto(cc, map_pcr_to_mr_index,
+					events[event].pcr_index,
+					&ev.cc_data.event_header.mr_index);
 		if (status != EFI_SUCCESS)
 			goto fail;
-		return EFI_SUCCESS;
+
+		protocol = cc;
+		method.hash_log_extend_event =
+			(void *)efi_table_attr(cc, hash_log_extend_event);
 	}
 
-	return EFI_UNSUPPORTED;
+	status = efi_bs_call(allocate_pool, EFI_LOADER_DATA, size, (void **)&evt);
+	if (status != EFI_SUCCESS)
+		goto fail;
+
+	*evt = (struct efistub_measured_event) {
+		.event_data			     = ev,
+		.tagged_event.tagged_event_id	     = events[event].event_id,
+		.tagged_event.tagged_event_data_size = events[event].event_data_len,
+	};
+
+	memcpy(evt->tagged_event.tagged_event_data, events[event].event_data,
+	       events[event].event_data_len);
+
+	status = efi_fn_call(&method, hash_log_extend_event, protocol, 0,
+			     load_addr, load_size, &evt->event_data);
+	efi_bs_call(free_pool, evt);
+
+	if (status == EFI_SUCCESS)
+		return EFI_SUCCESS;
+
 fail:
 	efi_warn("Failed to measure data for event %d: 0x%lx\n", event, status);
 	return status;
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/efi-stub.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/efi-stub.c
@@ -129,7 +129,7 @@
 
 	if (IS_ENABLED(CONFIG_CMDLINE_EXTEND) ||
 	    IS_ENABLED(CONFIG_CMDLINE_FORCE) ||
-	    cmdline_size == 0) {
+	    cmdline[0] == 0) {
 		status = efi_parse_options(CONFIG_CMDLINE);
 		if (status != EFI_SUCCESS) {
 			efi_err("Failed to parse options\n");
@@ -149,7 +149,7 @@
 	return EFI_SUCCESS;
 
 fail_free_cmdline:
-	efi_bs_call(free_pool, cmdline_ptr);
+	efi_bs_call(free_pool, cmdline);
 	return status;
 }
 
@@ -167,7 +167,7 @@
 
 	si = setup_graphics();
 
-	efi_retrieve_tpm2_eventlog();
+	efi_retrieve_eventlog();
 
 	/* Ask the firmware to clear memory on unclean shutdown */
 	efi_enable_reset_attack_mitigation();
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/efistub.h
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/efistub.h
@@ -37,8 +37,8 @@
 extern bool efi_nochunk;
 extern bool efi_nokaslr;
 extern int efi_loglevel;
+extern int efi_mem_encrypt;
 extern bool efi_novamap;
-
 extern const efi_system_table_t *efi_system_table;
 
 typedef union efi_dxe_services_table efi_dxe_services_table_t;
@@ -171,7 +171,7 @@
  * the EFI memory map. Other related structures, e.g. x86 e820ext, need
  * to factor in this headroom requirement as well.
  */
-#define EFI_MMAP_NR_SLACK_SLOTS	8
+#define EFI_MMAP_NR_SLACK_SLOTS	16
 
 typedef struct efi_generic_dev_path efi_device_path_protocol_t;
 
@@ -843,14 +843,14 @@
 	/* u8[] event follows here */
 } __packed;
 
-struct efi_tcg2_tagged_event {
-	u32 tagged_event_id;
-	u32 tagged_event_data_size;
-	/* u8  tagged event data follows here */
-} __packed;
+/* from TCG PC Client Platform Firmware Profile Specification */
+typedef struct tdTCG_PCClientTaggedEvent {
+	u32	tagged_event_id;
+	u32	tagged_event_data_size;
+	u8	tagged_event_data[];
+} TCG_PCClientTaggedEvent;
 
 typedef struct efi_tcg2_event efi_tcg2_event_t;
-typedef struct efi_tcg2_tagged_event efi_tcg2_tagged_event_t;
 typedef union efi_tcg2_protocol efi_tcg2_protocol_t;
 
 union efi_tcg2_protocol {
@@ -882,6 +882,87 @@
 	} mixed_mode;
 };
 
+typedef struct {
+	u8 major;
+	u8 minor;
+} efi_cc_version_t;
+
+typedef struct {
+	u8 type;
+	u8 sub_type;
+} efi_cc_type_t;
+
+/* EFI CC type/subtype defines */
+#define EFI_CC_TYPE_NONE		0
+#define EFI_CC_TYPE_AMD_SEV		1
+#define EFI_CC_TYPE_INTEL_TDX		2
+
+typedef u32 efi_cc_mr_index_t;
+
+struct efi_cc_event {
+	u32 event_size;
+	struct {
+		u32 header_size;
+		u16 header_version;
+		u32 mr_index;
+		u32 event_type;
+	} __packed event_header;
+	/* u8[] event follows here */
+} __packed;
+
+typedef struct efi_cc_event efi_cc_event_t;
+
+typedef u32 efi_cc_event_log_bitmap_t;
+typedef u32 efi_cc_event_log_format_t;
+typedef u32 efi_cc_event_algorithm_bitmap_t;
+
+typedef struct {
+	u8				size;
+	efi_cc_version_t		structure_version;
+	efi_cc_version_t		protocol_version;
+	efi_cc_event_algorithm_bitmap_t	hash_algorithm_bitmap;
+	efi_cc_event_log_bitmap_t	supported_event_logs;
+	efi_cc_type_t			cc_type;
+} efi_cc_boot_service_cap_t;
+
+#define EFI_CC_EVENT_HEADER_VERSION	1
+
+#define EFI_CC_BOOT_HASH_ALG_SHA384	0x00000004
+
+#define EFI_CC_EVENT_LOG_FORMAT_TCG_2	0x00000002
+
+typedef union efi_cc_protocol efi_cc_protocol_t;
+
+union efi_cc_protocol {
+	struct {
+		efi_status_t
+		(__efiapi *get_capability)(efi_cc_protocol_t *,
+					   efi_cc_boot_service_cap_t *);
+
+		efi_status_t
+		(__efiapi *get_event_log)(efi_cc_protocol_t *,
+					  efi_cc_event_log_format_t,
+					  efi_physical_addr_t *,
+					  efi_physical_addr_t *,
+					  efi_bool_t *);
+
+		efi_status_t
+		(__efiapi *hash_log_extend_event)(efi_cc_protocol_t *, u64,
+						  efi_physical_addr_t, u64,
+						  const efi_cc_event_t *);
+
+		efi_status_t
+		(__efiapi *map_pcr_to_mr_index)(efi_cc_protocol_t *, u32,
+						efi_cc_mr_index_t *);
+	};
+	struct {
+		u32 get_capability;
+		u32 get_event_log;
+		u32 hash_log_extend_event;
+		u32 map_pcr_to_mr_index;
+	} mixed_mode;
+};
+
 struct riscv_efi_boot_protocol {
 	u64 revision;
 
@@ -1061,7 +1142,7 @@
 efi_enable_reset_attack_mitigation(void) { }
 #endif
 
-void efi_retrieve_tpm2_eventlog(void);
+void efi_retrieve_eventlog(void);
 
 struct screen_info *alloc_screen_info(void);
 struct screen_info *__alloc_screen_info(void);
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/fdt.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/fdt.c
@@ -132,6 +132,12 @@
 		}
 	}
 
+	fdt_val32 = cpu_to_fdt32(efi_get_secureboot());
+	status = fdt_setprop(fdt, node, "linux,uefi-secure-boot",
+			     &fdt_val32, sizeof(fdt_val32));
+	if (status)
+		goto fdt_set_fail;
+
 	/* Shrink the FDT back to its minimum size: */
 	fdt_pack(fdt);
 
@@ -335,8 +341,8 @@
 
 fail:
 	efi_free(fdt_size, fdt_addr);
-
-	efi_bs_call(free_pool, priv.runtime_map);
+	if (!efi_novamap)
+		efi_bs_call(free_pool, priv.runtime_map);
 
 	return EFI_LOAD_ERROR;
 }
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/loongarch.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/loongarch.c
@@ -41,7 +41,7 @@
 unsigned long __weak kernel_entry_address(unsigned long kernel_addr,
 		efi_loaded_image_t *image)
 {
-	return *(unsigned long *)(kernel_addr + 8) - VMLINUX_LOAD_ADDRESS + kernel_addr;
+	return *(unsigned long *)(kernel_addr + 8) - PHYSADDR(VMLINUX_LOAD_ADDRESS) + kernel_addr;
 }
 
 efi_status_t efi_boot_kernel(void *handle, efi_loaded_image_t *image,
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/randomalloc.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/randomalloc.c
@@ -120,7 +120,7 @@
 			continue;
 		}
 
-		target = round_up(md->phys_addr, align) + target_slot * align;
+		target = round_up(max_t(u64, md->phys_addr, alloc_min), align) + target_slot * align;
 		pages = size / EFI_PAGE_SIZE;
 
 		status = efi_bs_call(allocate_pages, EFI_ALLOCATE_ADDRESS,
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/screen_info.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/screen_info.c
@@ -32,6 +32,8 @@
 	if (status != EFI_SUCCESS)
 		return NULL;
 
+	memset(si, 0, sizeof(*si));
+
 	status = efi_bs_call(install_configuration_table,
 			     &screen_info_guid, si);
 	if (status == EFI_SUCCESS)
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/tpm.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/tpm.c
@@ -47,39 +47,18 @@
 
 #endif
 
-void efi_retrieve_tpm2_eventlog(void)
+static void efi_retrieve_tcg2_eventlog(int version, efi_physical_addr_t log_location,
+				       efi_physical_addr_t log_last_entry,
+				       efi_bool_t truncated,
+				       struct efi_tcg2_final_events_table *final_events_table)
 {
-	efi_guid_t tcg2_guid = EFI_TCG2_PROTOCOL_GUID;
 	efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
 	efi_status_t status;
-	efi_physical_addr_t log_location = 0, log_last_entry = 0;
 	struct linux_efi_tpm_eventlog *log_tbl = NULL;
-	struct efi_tcg2_final_events_table *final_events_table = NULL;
 	unsigned long first_entry_addr, last_entry_addr;
 	size_t log_size, last_entry_size;
-	efi_bool_t truncated;
-	int version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2;
-	efi_tcg2_protocol_t *tcg2_protocol = NULL;
 	int final_events_size = 0;
 
-	status = efi_bs_call(locate_protocol, &tcg2_guid, NULL,
-			     (void **)&tcg2_protocol);
-	if (status != EFI_SUCCESS)
-		return;
-
-	status = efi_call_proto(tcg2_protocol, get_event_log, version,
-				&log_location, &log_last_entry, &truncated);
-
-	if (status != EFI_SUCCESS || !log_location) {
-		version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
-		status = efi_call_proto(tcg2_protocol, get_event_log, version,
-					&log_location, &log_last_entry,
-					&truncated);
-		if (status != EFI_SUCCESS || !log_location)
-			return;
-
-	}
-
 	first_entry_addr = (unsigned long) log_location;
 
 	/*
@@ -93,8 +72,10 @@
 		 * get_event_log only returns the address of the last entry.
 		 * We need to calculate its size to deduce the full size of
 		 * the logs.
+		 *
+		 * CC Event log also uses TCG2 format, handle it same as TPM2.
 		 */
-		if (version == EFI_TCG2_EVENT_LOG_FORMAT_TCG_2) {
+		if (version > EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2) {
 			/*
 			 * The TCG2 log format has variable length entries,
 			 * and the information to decode the hash algorithms
@@ -115,7 +96,7 @@
 	}
 
 	/* Allocate space for the logs and copy them. */
-	status = efi_bs_call(allocate_pool, EFI_LOADER_DATA,
+	status = efi_bs_call(allocate_pool, EFI_ACPI_RECLAIM_MEMORY,
 			     sizeof(*log_tbl) + log_size, (void **)&log_tbl);
 
 	if (status != EFI_SUCCESS) {
@@ -127,8 +108,6 @@
 	 * Figure out whether any events have already been logged to the
 	 * final events structure, and if so how much space they take up
 	 */
-	if (version == EFI_TCG2_EVENT_LOG_FORMAT_TCG_2)
-		final_events_table = get_efi_config_table(LINUX_EFI_TPM_FINAL_LOG_GUID);
 	if (final_events_table && final_events_table->nr_events) {
 		struct tcg_pcr_event2_head *header;
 		int offset;
@@ -165,3 +144,50 @@
 err_free:
 	efi_bs_call(free_pool, log_tbl);
 }
+
+void efi_retrieve_eventlog(void)
+{
+	struct efi_tcg2_final_events_table *final_events_table = NULL;
+	efi_physical_addr_t log_location = 0, log_last_entry = 0;
+	efi_guid_t tpm2_guid = EFI_TCG2_PROTOCOL_GUID;
+	int version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2;
+	efi_tcg2_protocol_t *tpm2 = NULL;
+	efi_bool_t truncated;
+	efi_status_t status;
+
+	status = efi_bs_call(locate_protocol, &tpm2_guid, NULL, (void **)&tpm2);
+	if (status == EFI_SUCCESS) {
+		status = efi_call_proto(tpm2, get_event_log, version, &log_location,
+					&log_last_entry, &truncated);
+
+		if (status != EFI_SUCCESS || !log_location) {
+			version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
+			status = efi_call_proto(tpm2, get_event_log, version,
+						&log_location, &log_last_entry,
+						&truncated);
+		} else {
+			final_events_table =
+				get_efi_config_table(EFI_TCG2_FINAL_EVENTS_TABLE_GUID);
+		}
+	} else {
+		efi_guid_t cc_guid = EFI_CC_MEASUREMENT_PROTOCOL_GUID;
+		efi_cc_protocol_t *cc = NULL;
+
+		status = efi_bs_call(locate_protocol, &cc_guid, NULL, (void **)&cc);
+		if (status != EFI_SUCCESS)
+			return;
+
+		version = EFI_CC_EVENT_LOG_FORMAT_TCG_2;
+		status = efi_call_proto(cc, get_event_log, version, &log_location,
+					&log_last_entry, &truncated);
+
+		final_events_table =
+			get_efi_config_table(EFI_CC_FINAL_EVENTS_TABLE_GUID);
+	}
+
+	if (status != EFI_SUCCESS || !log_location)
+		return;
+
+	efi_retrieve_tcg2_eventlog(version, log_location, log_last_entry,
+				   truncated, final_events_table);
+}
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/x86-stub.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/x86-stub.c
@@ -21,6 +21,8 @@
 #include "efistub.h"
 #include "x86-stub.h"
 
+extern char _bss[], _ebss[];
+
 const efi_system_table_t *efi_system_table;
 const efi_dxe_services_table_t *efi_dxe_table;
 static efi_loaded_image_t *image = NULL;
@@ -236,6 +238,15 @@
 	rounded_end = roundup(start + size, EFI_PAGE_SIZE);
 
 	if (memattr != NULL) {
+		status = efi_call_proto(memattr, set_memory_attributes,
+					rounded_start,
+					rounded_end - rounded_start,
+					EFI_MEMORY_RO);
+		if (status != EFI_SUCCESS) {
+			efi_warn("Failed to set EFI_MEMORY_RO attribute\n");
+			return status;
+		}
+
 		status = efi_call_proto(memattr, clear_memory_attributes,
 					rounded_start,
 					rounded_end - rounded_start,
@@ -458,13 +469,17 @@
 efi_status_t __efiapi efi_pe_entry(efi_handle_t handle,
 				   efi_system_table_t *sys_table_arg)
 {
-	static struct boot_params boot_params __page_aligned_bss;
-	struct setup_header *hdr = &boot_params.hdr;
 	efi_guid_t proto = LOADED_IMAGE_PROTOCOL_GUID;
+	struct boot_params *boot_params;
+	struct setup_header *hdr;
 	int options_size = 0;
 	efi_status_t status;
+	unsigned long alloc;
 	char *cmdline_ptr;
 
+	if (efi_is_native())
+		memset(_bss, 0, _ebss - _bss);
+
 	efi_system_table = sys_table_arg;
 
 	/* Check if we were booted by the EFI firmware */
@@ -477,25 +492,32 @@
 		efi_exit(handle, status);
 	}
 
+	status = efi_allocate_pages(PARAM_SIZE, &alloc, ULONG_MAX);
+	if (status != EFI_SUCCESS)
+		efi_exit(handle, status);
+
+	boot_params = memset((void *)alloc, 0x0, PARAM_SIZE);
+	hdr	    = &boot_params->hdr;
+
 	/* Assign the setup_header fields that the kernel actually cares about */
 	hdr->root_flags	= 1;
 	hdr->vid_mode	= 0xffff;
 
 	hdr->type_of_loader = 0x21;
+	hdr->initrd_addr_max = INT_MAX;
 
 	/* Convert unicode cmdline to ascii */
 	cmdline_ptr = efi_convert_cmdline(image, &options_size);
-	if (!cmdline_ptr)
-		goto fail;
+	if (!cmdline_ptr) {
+		efi_free(PARAM_SIZE, alloc);
+		efi_exit(handle, EFI_OUT_OF_RESOURCES);
+	}
 
 	efi_set_u64_split((unsigned long)cmdline_ptr, &hdr->cmd_line_ptr,
-			  &boot_params.ext_cmd_line_ptr);
+			  &boot_params->ext_cmd_line_ptr);
 
-	efi_stub_entry(handle, sys_table_arg, &boot_params);
+	efi_stub_entry(handle, sys_table_arg, boot_params);
 	/* not reached */
-
-fail:
-	efi_exit(handle, status);
 }
 
 static void add_e820ext(struct boot_params *params,
@@ -761,6 +783,26 @@
 	efi_warn("Decompression failed: %s\n", str);
 }
 
+static const char *cmdline_memmap_override;
+
+static efi_status_t parse_options(const char *cmdline)
+{
+	static const char opts[][14] = {
+		"mem=", "memmap=", "efi_fake_mem=", "hugepages="
+	};
+
+	for (int i = 0; i < ARRAY_SIZE(opts); i++) {
+		const char *p = strstr(cmdline, opts[i]);
+
+		if (p == cmdline || (p > cmdline && isspace(p[-1]))) {
+			cmdline_memmap_override = opts[i];
+			break;
+		}
+	}
+
+	return efi_parse_options(cmdline);
+}
+
 static efi_status_t efi_decompress_kernel(unsigned long *kernel_entry)
 {
 	unsigned long virt_addr = LOAD_PHYSICAL_ADDR;
@@ -792,6 +834,10 @@
 		    !memcmp(efistub_fw_vendor(), ami, sizeof(ami))) {
 			efi_debug("AMI firmware v2.0 or older detected - disabling physical KASLR\n");
 			seed[0] = 0;
+		} else if (cmdline_memmap_override) {
+			efi_info("%s detected on the kernel command line - disabling physical KASLR\n",
+				 cmdline_memmap_override);
+			seed[0] = 0;
 		}
 
 		boot_params_ptr->hdr.loadflags |= KASLR_FLAG;
@@ -812,7 +858,7 @@
 
 	*kernel_entry = addr + entry;
 
-	return efi_adjust_memory_range_protection(addr, kernel_total_size);
+	return efi_adjust_memory_range_protection(addr, kernel_text_size);
 }
 
 static void __noreturn enter_kernel(unsigned long kernel_addr,
@@ -868,7 +914,7 @@
 	}
 
 #ifdef CONFIG_CMDLINE_BOOL
-	status = efi_parse_options(CONFIG_CMDLINE);
+	status = parse_options(CONFIG_CMDLINE);
 	if (status != EFI_SUCCESS) {
 		efi_err("Failed to parse options\n");
 		goto fail;
@@ -877,13 +923,16 @@
 	if (!IS_ENABLED(CONFIG_CMDLINE_OVERRIDE)) {
 		unsigned long cmdline_paddr = ((u64)hdr->cmd_line_ptr |
 					       ((u64)boot_params->ext_cmd_line_ptr << 32));
-		status = efi_parse_options((char *)cmdline_paddr);
+		status = parse_options((char *)cmdline_paddr);
 		if (status != EFI_SUCCESS) {
 			efi_err("Failed to parse options\n");
 			goto fail;
 		}
 	}
 
+	if (efi_mem_encrypt > 0)
+		hdr->xloadflags |= XLF_MEM_ENCRYPTION;
+
 	status = efi_decompress_kernel(&kernel_entry);
 	if (status != EFI_SUCCESS) {
 		efi_err("Failed to decompress kernel\n");
@@ -923,7 +972,7 @@
 
 	efi_random_get_seed();
 
-	efi_retrieve_tpm2_eventlog();
+	efi_retrieve_eventlog();
 
 	setup_graphics(boot_params);
 
@@ -958,8 +1007,6 @@
 void efi_handover_entry(efi_handle_t handle, efi_system_table_t *sys_table_arg,
 			struct boot_params *boot_params)
 {
-	extern char _bss[], _ebss[];
-
 	memset(_bss, 0, _ebss - _bss);
 	efi_stub_entry(handle, sys_table_arg, boot_params);
 }
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/libstub/zboot.lds
+++ linux-qcom-6.8.0/drivers/firmware/efi/libstub/zboot.lds
@@ -41,6 +41,7 @@
 	}
 
 	/DISCARD/ : {
+		*(.discard .discard.*)
 		*(.modinfo .init.modinfo)
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/memmap.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/memmap.c
@@ -15,10 +15,6 @@
 #include <asm/early_ioremap.h>
 #include <asm/efi.h>
 
-#ifndef __efi_memmap_free
-#define __efi_memmap_free(phys, size, flags) do { } while (0)
-#endif
-
 /**
  * __efi_memmap_init - Common code for mapping the EFI memory map
  * @data: EFI memory map data
@@ -51,11 +47,6 @@
 		return -ENOMEM;
 	}
 
-	if (efi.memmap.flags & (EFI_MEMMAP_MEMBLOCK | EFI_MEMMAP_SLAB))
-		__efi_memmap_free(efi.memmap.phys_map,
-				  efi.memmap.desc_size * efi.memmap.nr_map,
-				  efi.memmap.flags);
-
 	map.phys_map = data->phys_map;
 	map.nr_map = data->size / data->desc_size;
 	map.map_end = map.map + data->size;
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/secureboot.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/secureboot.c
@@ -0,0 +1,38 @@
+/* Core kernel secure boot support.
+ *
+ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/efi.h>
+#include <linux/kernel.h>
+#include <linux/printk.h>
+
+/*
+ * Decide what to do when UEFI secure boot mode is enabled.
+ */
+void __init efi_set_secure_boot(enum efi_secureboot_mode mode)
+{
+	if (efi_enabled(EFI_BOOT)) {
+		switch (mode) {
+		case efi_secureboot_mode_disabled:
+			pr_info("Secure boot disabled\n");
+			break;
+		case efi_secureboot_mode_enabled:
+			set_bit(EFI_SECURE_BOOT, &efi.flags);
+			pr_info("Secure boot enabled\n");
+			break;
+		default:
+			pr_warn("Secure boot could not be determined (mode %u)\n",
+				   mode);
+			break;
+		}
+	}
+}
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/tpm.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/tpm.c
@@ -40,7 +40,8 @@
 {
 	struct linux_efi_tpm_eventlog *log_tbl;
 	struct efi_tcg2_final_events_table *final_tbl;
-	int tbl_size;
+	unsigned int tbl_size;
+	int final_tbl_size;
 	int ret = 0;
 
 	if (efi.tpm_log == EFI_INVALID_TABLE_ADDR) {
@@ -80,26 +81,26 @@
 		goto out;
 	}
 
-	tbl_size = 0;
+	final_tbl_size = 0;
 	if (final_tbl->nr_events != 0) {
 		void *events = (void *)efi.tpm_final_log
 				+ sizeof(final_tbl->version)
 				+ sizeof(final_tbl->nr_events);
 
-		tbl_size = tpm2_calc_event_log_size(events,
-						    final_tbl->nr_events,
-						    log_tbl->log);
+		final_tbl_size = tpm2_calc_event_log_size(events,
+							  final_tbl->nr_events,
+							  log_tbl->log);
 	}
 
-	if (tbl_size < 0) {
+	if (final_tbl_size < 0) {
 		pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n");
 		ret = -EINVAL;
 		goto out_calc;
 	}
 
 	memblock_reserve(efi.tpm_final_log,
-			 tbl_size + sizeof(*final_tbl));
-	efi_tpm_final_log_size = tbl_size;
+			 final_tbl_size + sizeof(*final_tbl));
+	efi_tpm_final_log_size = final_tbl_size;
 
 out_calc:
 	early_memunmap(final_tbl, sizeof(*final_tbl));
--- linux-qcom-6.8.0.orig/drivers/firmware/efi/unaccepted_memory.c
+++ linux-qcom-6.8.0/drivers/firmware/efi/unaccepted_memory.c
@@ -4,6 +4,7 @@
 #include <linux/memblock.h>
 #include <linux/spinlock.h>
 #include <linux/crash_dump.h>
+#include <linux/nmi.h>
 #include <asm/unaccepted_memory.h>
 
 /* Protects unaccepted memory bitmap and accepting_list */
@@ -149,6 +150,9 @@
 	}
 
 	list_del(&range.list);
+
+	touch_softlockup_watchdog();
+
 	spin_unlock_irqrestore(&unaccepted_memory_lock, flags);
 }
 
--- linux-qcom-6.8.0.orig/drivers/firmware/google/gsmi.c
+++ linux-qcom-6.8.0/drivers/firmware/google/gsmi.c
@@ -918,7 +918,8 @@
 	gsmi_dev.pdev = platform_device_register_full(&gsmi_dev_info);
 	if (IS_ERR(gsmi_dev.pdev)) {
 		printk(KERN_ERR "gsmi: unable to register platform device\n");
-		return PTR_ERR(gsmi_dev.pdev);
+		ret = PTR_ERR(gsmi_dev.pdev);
+		goto out_unregister;
 	}
 
 	/* SMI access needs to be serialized */
@@ -1056,10 +1057,11 @@
 	gsmi_buf_free(gsmi_dev.name_buf);
 	kmem_cache_destroy(gsmi_dev.mem_pool);
 	platform_device_unregister(gsmi_dev.pdev);
-	pr_info("gsmi: failed to load: %d\n", ret);
+out_unregister:
 #ifdef CONFIG_PM
 	platform_driver_unregister(&gsmi_driver_info);
 #endif
+	pr_info("gsmi: failed to load: %d\n", ret);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/firmware/iscsi_ibft.c
+++ linux-qcom-6.8.0/drivers/firmware/iscsi_ibft.c
@@ -310,7 +310,10 @@
 		str += sprintf_ipaddr(str, nic->ip_addr);
 		break;
 	case ISCSI_BOOT_ETH_SUBNET_MASK:
-		val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1));
+		if (nic->subnet_mask_prefix > 32)
+			val = cpu_to_be32(~0);
+		else
+			val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1));
 		str += sprintf(str, "%pI4", &val);
 		break;
 	case ISCSI_BOOT_ETH_PREFIX_LEN:
--- linux-qcom-6.8.0.orig/drivers/firmware/microchip/mpfs-auto-update.c
+++ linux-qcom-6.8.0/drivers/firmware/microchip/mpfs-auto-update.c
@@ -74,14 +74,11 @@
 #define AUTO_UPDATE_RESERVED_SIZE	SZ_1M
 #define AUTO_UPDATE_BITSTREAM_BASE	(AUTO_UPDATE_DIRECTORY_SIZE + AUTO_UPDATE_RESERVED_SIZE)
 
-#define AUTO_UPDATE_TIMEOUT_MS		60000
-
 struct mpfs_auto_update_priv {
 	struct mpfs_sys_controller *sys_controller;
 	struct device *dev;
 	struct mtd_info *flash;
 	struct fw_upload *fw_uploader;
-	struct completion programming_complete;
 	size_t size_per_bitstream;
 	bool cancel_request;
 };
@@ -143,19 +140,6 @@
 
 static enum fw_upload_err mpfs_auto_update_poll_complete(struct fw_upload *fw_uploader)
 {
-	struct mpfs_auto_update_priv *priv = fw_uploader->dd_handle;
-	int ret;
-
-	/*
-	 * There is no meaningful way to get the status of the programming while
-	 * it is in progress, so attempting anything other than waiting for it
-	 * to complete would be misplaced.
-	 */
-	ret = wait_for_completion_timeout(&priv->programming_complete,
-					  msecs_to_jiffies(AUTO_UPDATE_TIMEOUT_MS));
-	if (ret)
-		return FW_UPLOAD_ERR_TIMEOUT;
-
 	return FW_UPLOAD_ERR_NONE;
 }
 
@@ -206,10 +190,12 @@
 	if (ret | response->resp_status) {
 		dev_warn(priv->dev, "Verification of Upgrade Image failed!\n");
 		ret = ret ? ret : -EBADMSG;
+		goto free_message;
 	}
 
 	dev_info(priv->dev, "Verification of Upgrade Image passed!\n");
 
+free_message:
 	devm_kfree(priv->dev, message);
 free_response:
 	devm_kfree(priv->dev, response);
@@ -344,30 +330,20 @@
 						 u32 offset, u32 size, u32 *written)
 {
 	struct mpfs_auto_update_priv *priv = fw_uploader->dd_handle;
-	enum fw_upload_err err = FW_UPLOAD_ERR_NONE;
 	int ret;
 
-	reinit_completion(&priv->programming_complete);
-
 	ret = mpfs_auto_update_write_bitstream(fw_uploader, data, offset, size, written);
-	if (ret) {
-		err = FW_UPLOAD_ERR_RW_ERROR;
-		goto out;
-	}
+	if (ret)
+		return FW_UPLOAD_ERR_RW_ERROR;
 
-	if (priv->cancel_request) {
-		err = FW_UPLOAD_ERR_CANCELED;
-		goto out;
-	}
+	if (priv->cancel_request)
+		return FW_UPLOAD_ERR_CANCELED;
 
 	ret = mpfs_auto_update_verify_image(fw_uploader);
 	if (ret)
-		err = FW_UPLOAD_ERR_FW_INVALID;
+		return FW_UPLOAD_ERR_FW_INVALID;
 
-out:
-	complete(&priv->programming_complete);
-
-	return err;
+	return FW_UPLOAD_ERR_NONE;
 }
 
 static const struct fw_upload_ops mpfs_auto_update_ops = {
@@ -461,8 +437,6 @@
 		return dev_err_probe(dev, ret,
 				     "The current bitstream does not support auto-update\n");
 
-	init_completion(&priv->programming_complete);
-
 	fw_uploader = firmware_upload_register(THIS_MODULE, dev, "mpfs-auto-update",
 					       &mpfs_auto_update_ops, priv);
 	if (IS_ERR(fw_uploader))
--- linux-qcom-6.8.0.orig/drivers/firmware/psci/psci.c
+++ linux-qcom-6.8.0/drivers/firmware/psci/psci.c
@@ -29,6 +29,8 @@
 #include <asm/smp_plat.h>
 #include <asm/suspend.h>
 
+#define REBOOT_PREFIX "mode-"
+
 /*
  * While a 64-bit OS can make calls with SMC32 calling conventions, for some
  * calls it is necessary to use SMC64 to pass or return 64-bit values.
@@ -79,6 +81,14 @@
 static u32 psci_cpu_suspend_feature;
 static bool psci_system_reset2_supported;
 
+struct psci_reset_param {
+	const char *mode;
+	u32 reset_type;
+	u32 cookie;
+};
+static struct psci_reset_param *psci_reset_params;
+static size_t num_psci_reset_params;
+
 static inline bool psci_has_ext_power_state(void)
 {
 	return psci_cpu_suspend_feature &
@@ -305,11 +315,29 @@
 	return 0;
 }
 
+static void psci_vendor_sys_reset2(unsigned long action, void *data)
+{
+	const char *cmd = data;
+	size_t i;
+
+	for (i = 0; i < num_psci_reset_params; i++) {
+		if (!strcmp(psci_reset_params[i].mode, cmd)) {
+			invoke_psci_fn(PSCI_FN_NATIVE(1_1, SYSTEM_RESET2),
+				       psci_reset_params[i].reset_type,
+				       psci_reset_params[i].cookie, 0);
+			break;
+		}
+	}
+}
+
 static int psci_sys_reset(struct notifier_block *nb, unsigned long action,
 			  void *data)
 {
+	if (data && psci_system_reset2_supported && num_psci_reset_params)
+		psci_vendor_sys_reset2(action, data);
+
 	if ((reboot_mode == REBOOT_WARM || reboot_mode == REBOOT_SOFT) &&
-	    psci_system_reset2_supported) {
+		 psci_system_reset2_supported) {
 		/*
 		 * reset_type[31] = 0 (architectural)
 		 * reset_type[30:0] = 0 (SYSTEM_WARM_RESET)
@@ -497,10 +525,12 @@
 
 static int psci_system_suspend(unsigned long unused)
 {
+	int err;
 	phys_addr_t pa_cpu_resume = __pa_symbol(cpu_resume);
 
-	return invoke_psci_fn(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND),
+	err = invoke_psci_fn(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND),
 			      pa_cpu_resume, 0, 0);
+	return psci_to_linux_errno(err);
 }
 
 static int psci_system_suspend_enter(suspend_state_t state)
@@ -523,18 +553,26 @@
 		psci_system_reset2_supported = true;
 }
 
-static void __init psci_init_system_suspend(void)
+static int __init psci_init_system_suspend(void)
 {
 	int ret;
+	u32 ver;
 
 	if (!IS_ENABLED(CONFIG_SUSPEND))
-		return;
+		return 0;
+
+	ver = psci_0_2_get_version();
+	if (PSCI_VERSION_MAJOR(ver) < 1)
+		return 0;
 
 	ret = psci_features(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND));
 
 	if (ret != PSCI_RET_NOT_SUPPORTED)
 		suspend_set_ops(&psci_suspend_ops);
+
+	return ret;
 }
+late_initcall(psci_init_system_suspend)
 
 static void __init psci_init_cpu_suspend(void)
 {
@@ -651,7 +689,6 @@
 	if (PSCI_VERSION_MAJOR(ver) >= 1) {
 		psci_init_smccc();
 		psci_init_cpu_suspend();
-		psci_init_system_suspend();
 		psci_init_system_reset2();
 		kvm_init_hyp_services();
 	}
@@ -748,6 +785,63 @@
 	{},
 };
 
+static int __init psci_init_system_reset2_modes(void)
+{
+	const size_t len = strlen(REBOOT_PREFIX);
+	struct psci_reset_param *param;
+	struct device_node *np;
+	struct property *prop;
+	size_t count = 0;
+	u32 magic[2];
+	int ret;
+
+	if (!psci_system_reset2_supported)
+		return 0;
+
+	np = of_find_matching_node(NULL, psci_of_match);
+	if (!np)
+		return 0;
+
+	for_each_property_of_node(np, prop) {
+		if (strncmp(prop->name, REBOOT_PREFIX, len))
+			continue;
+		ret = of_property_count_elems_of_size(np, prop->name, sizeof(magic[0]));
+		if (ret != 1 && ret != 2)
+			continue;
+
+		count++;
+	}
+
+	param = psci_reset_params = kcalloc(count, sizeof(*psci_reset_params), GFP_KERNEL);
+	if (!psci_reset_params)
+		return -ENOMEM;
+
+	for_each_property_of_node(np, prop) {
+		if (strncmp(prop->name, REBOOT_PREFIX, len))
+			continue;
+
+		param->mode = kstrdup_const(prop->name + len, GFP_KERNEL);
+		if (!param->mode)
+			continue;
+
+		ret = of_property_read_variable_u32_array(np, prop->name, magic, 1, 2);
+		if (ret < 0) {
+			pr_warn("Failed to parse vendor reboot mode %s\n", param->mode);
+			kfree(param->mode);
+			continue;
+		}
+
+		/* Force reset type to be in vendor space */
+		param->reset_type = PSCI_1_1_RESET_TYPE_VENDOR_START | magic[0];
+		param->cookie = ret == 2 ? magic[1] : 0;
+		param++;
+		num_psci_reset_params++;
+	}
+
+	return 0;
+}
+arch_initcall(psci_init_system_reset2_modes);
+
 int __init psci_dt_init(void)
 {
 	struct device_node *np;
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/Kconfig
+++ linux-qcom-6.8.0/drivers/firmware/qcom/Kconfig
@@ -7,8 +7,40 @@
 menu "Qualcomm firmware drivers"
 
 config QCOM_SCM
+	select QCOM_TZMEM
 	tristate
 
+config QCOM_TZMEM
+	tristate
+	select GENERIC_ALLOCATOR
+
+choice
+	prompt "TrustZone interface memory allocator mode"
+	depends on QCOM_TZMEM
+	default QCOM_TZMEM_MODE_GENERIC
+	help
+	  Selects the mode of the memory allocator providing memory buffers of
+	  suitable format for sharing with the TrustZone. If in doubt, select
+	  'Generic'.
+
+config QCOM_TZMEM_MODE_GENERIC
+	bool "Generic"
+	help
+	  Use the generic allocator mode. The memory is page-aligned, non-cachable
+	  and physically contiguous.
+
+config QCOM_TZMEM_MODE_SHMBRIDGE
+	bool "SHM Bridge"
+	help
+	  Use Qualcomm Shared Memory Bridge. The memory has the same alignment as
+	  in the 'Generic' allocator but is also explicitly marked as an SHM Bridge
+	  buffer.
+
+	  With this selected, all buffers passed to the TrustZone must be allocated
+	  using the TZMem allocator or else the TrustZone will refuse to use them.
+
+endchoice
+
 config QCOM_SCM_DOWNLOAD_MODE_DEFAULT
 	bool "Qualcomm download mode enabled by default"
 	depends on QCOM_SCM
@@ -20,6 +52,23 @@
 
 	  Say Y here to enable "download mode" by default.
 
+config QCOM_SCM_ADDON
+	bool "Qualcomm SCM Addon Support"
+	depends on QCOM_SCM
+	help
+	  QCOM SCM addon provision APIs for client like kgsl, SHMBridge, etc,
+	  once enable it provides extra API via QCOM_SCM.
+
+config QTEE_SHM_BRIDGE
+	bool "QTI TEE shared memory bridge"
+	depends on QCOM_SCM && QCOM_SCM_ADDON
+	help
+	  QTEE shared memory bridge driver provides kernel APIs to share
+	  memory between trustzone & other VMs through shared memory bridge.
+	  It allows kernel clients to create bridge, delete bridge, and do
+	  memory sub-allocation and free from the default kernel bridge
+	  created by bridge driver.
+
 config QCOM_QSEECOM
 	bool "Qualcomm QSEECOM interface driver"
 	depends on QCOM_SCM=y
@@ -53,4 +102,12 @@
 	  Select Y here to provide access to EFI variables on the aforementioned
 	  platforms.
 
+config QTI_TZ_LOG
+	tristate "QTI Trust Zone (TZ) Log Driver"
+	depends on QCOM_TZMEM && PROC_FS && QCOM_SCM
+	help
+	  Provide debugging capability with a procfs interface for messages produced
+	  by the Secure code (Trust zone). These messages provide diagnostic information
+	  about TZ operations.
+
 endmenu
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/Makefile
+++ linux-qcom-6.8.0/drivers/firmware/qcom/Makefile
@@ -5,5 +5,8 @@
 
 obj-$(CONFIG_QCOM_SCM)		+= qcom-scm.o
 qcom-scm-objs += qcom_scm.o qcom_scm-smc.o qcom_scm-legacy.o
+obj-$(CONFIG_QCOM_TZMEM)	+= qcom_tzmem.o
+obj-$(CONFIG_QTEE_SHM_BRIDGE)	+= qtee_shmbridge.o
 obj-$(CONFIG_QCOM_QSEECOM)	+= qcom_qseecom.o
 obj-$(CONFIG_QCOM_QSEECOM_UEFISECAPP) += qcom_qseecom_uefisecapp.o
+obj-$(CONFIG_QTI_TZ_LOG)	+= tz_log.o
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
+++ linux-qcom-6.8.0/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
@@ -221,6 +221,19 @@
  * alignment of 8 bytes (64 bits) for GUIDs. Our definition of efi_guid_t,
  * however, has an alignment of 4 byte (32 bits). So far, this seems to work
  * fine here. See also the comment on the typedef of efi_guid_t.
+ *
+ * Note: It looks like uefisecapp is quite picky about how the memory passed to
+ * it is structured and aligned. In particular the request/response setup used
+ * for QSEE_CMD_UEFI_GET_VARIABLE. While qcom_qseecom_app_send(), in theory,
+ * accepts separate buffers/addresses for the request and response parts, in
+ * practice, however, it seems to expect them to be both part of a larger
+ * contiguous block. We initially allocated separate buffers for the request
+ * and response but this caused the QSEE_CMD_UEFI_GET_VARIABLE command to
+ * either not write any response to the response buffer or outright crash the
+ * device. Therefore, we now allocate a single contiguous block of DMA memory
+ * for both and properly align the data using the macros below. In particular,
+ * request and response structs are aligned at 8 byte (via __reqdata_offs()),
+ * following the driver that this has been reverse-engineered from.
  */
 #define qcuefi_buf_align_fields(fields...)					\
 	({									\
@@ -244,6 +257,12 @@
 #define __array_offs(type, count, offset)					\
 	__field_impl(sizeof(type) * (count), __alignof__(type), offset)
 
+#define __array_offs_aligned(type, count, align, offset)			\
+	__field_impl(sizeof(type) * (count), align, offset)
+
+#define __reqdata_offs(size, offset)						\
+	__array_offs_aligned(u8, size, 8, offset)
+
 #define __array(type, count)		__array_offs(type, count, NULL)
 #define __field_offs(type, offset)	__array_offs(type, 1, offset)
 #define __field(type)			__array_offs(type, 1, NULL)
@@ -277,10 +296,15 @@
 	unsigned long buffer_size = *data_size;
 	efi_status_t efi_status = EFI_SUCCESS;
 	unsigned long name_length;
+	dma_addr_t cmd_buf_dma;
+	size_t cmd_buf_size;
+	void *cmd_buf;
 	size_t guid_offs;
 	size_t name_offs;
 	size_t req_size;
 	size_t rsp_size;
+	size_t req_offs;
+	size_t rsp_offs;
 	ssize_t status;
 
 	if (!name || !guid)
@@ -304,17 +328,19 @@
 		__array(u8, buffer_size)
 	);
 
-	req_data = kzalloc(req_size, GFP_KERNEL);
-	if (!req_data) {
+	cmd_buf_size = qcuefi_buf_align_fields(
+		__reqdata_offs(req_size, &req_offs)
+		__reqdata_offs(rsp_size, &rsp_offs)
+	);
+
+	cmd_buf = qseecom_dma_alloc(qcuefi->client, cmd_buf_size, &cmd_buf_dma, GFP_KERNEL);
+	if (!cmd_buf) {
 		efi_status = EFI_OUT_OF_RESOURCES;
 		goto out;
 	}
 
-	rsp_data = kzalloc(rsp_size, GFP_KERNEL);
-	if (!rsp_data) {
-		efi_status = EFI_OUT_OF_RESOURCES;
-		goto out_free_req;
-	}
+	req_data = cmd_buf + req_offs;
+	rsp_data = cmd_buf + rsp_offs;
 
 	req_data->command_id = QSEE_CMD_UEFI_GET_VARIABLE;
 	req_data->data_size = buffer_size;
@@ -332,7 +358,9 @@
 
 	memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size);
 
-	status = qcom_qseecom_app_send(qcuefi->client, req_data, req_size, rsp_data, rsp_size);
+	status = qcom_qseecom_app_send(qcuefi->client,
+				       cmd_buf_dma + req_offs, req_size,
+				       cmd_buf_dma + rsp_offs, rsp_size);
 	if (status) {
 		efi_status = EFI_DEVICE_ERROR;
 		goto out_free;
@@ -407,9 +435,7 @@
 	memcpy(data, ((void *)rsp_data) + rsp_data->data_offset, rsp_data->data_size);
 
 out_free:
-	kfree(rsp_data);
-out_free_req:
-	kfree(req_data);
+	qseecom_dma_free(qcuefi->client, cmd_buf_size, cmd_buf, cmd_buf_dma);
 out:
 	return efi_status;
 }
@@ -422,10 +448,15 @@
 	struct qsee_rsp_uefi_set_variable *rsp_data;
 	efi_status_t efi_status = EFI_SUCCESS;
 	unsigned long name_length;
+	dma_addr_t cmd_buf_dma;
+	size_t cmd_buf_size;
+	void *cmd_buf;
 	size_t name_offs;
 	size_t guid_offs;
 	size_t data_offs;
 	size_t req_size;
+	size_t req_offs;
+	size_t rsp_offs;
 	ssize_t status;
 
 	if (!name || !guid)
@@ -450,17 +481,19 @@
 		__array_offs(u8, data_size, &data_offs)
 	);
 
-	req_data = kzalloc(req_size, GFP_KERNEL);
-	if (!req_data) {
+	cmd_buf_size = qcuefi_buf_align_fields(
+		__reqdata_offs(req_size, &req_offs)
+		__reqdata_offs(sizeof(*rsp_data), &rsp_offs)
+	);
+
+	cmd_buf = qseecom_dma_alloc(qcuefi->client, cmd_buf_size, &cmd_buf_dma, GFP_KERNEL);
+	if (!cmd_buf) {
 		efi_status = EFI_OUT_OF_RESOURCES;
 		goto out;
 	}
 
-	rsp_data = kzalloc(sizeof(*rsp_data), GFP_KERNEL);
-	if (!rsp_data) {
-		efi_status = EFI_OUT_OF_RESOURCES;
-		goto out_free_req;
-	}
+	req_data = cmd_buf + req_offs;
+	rsp_data = cmd_buf + rsp_offs;
 
 	req_data->command_id = QSEE_CMD_UEFI_SET_VARIABLE;
 	req_data->attributes = attributes;
@@ -483,8 +516,9 @@
 	if (data_size)
 		memcpy(((void *)req_data) + req_data->data_offset, data, req_data->data_size);
 
-	status = qcom_qseecom_app_send(qcuefi->client, req_data, req_size, rsp_data,
-				       sizeof(*rsp_data));
+	status = qcom_qseecom_app_send(qcuefi->client,
+				       cmd_buf_dma + req_offs, req_size,
+				       cmd_buf_dma + rsp_offs, sizeof(*rsp_data));
 	if (status) {
 		efi_status = EFI_DEVICE_ERROR;
 		goto out_free;
@@ -507,9 +541,7 @@
 	}
 
 out_free:
-	kfree(rsp_data);
-out_free_req:
-	kfree(req_data);
+	qseecom_dma_free(qcuefi->client, cmd_buf_size, cmd_buf, cmd_buf_dma);
 out:
 	return efi_status;
 }
@@ -521,10 +553,15 @@
 	struct qsee_req_uefi_get_next_variable *req_data;
 	struct qsee_rsp_uefi_get_next_variable *rsp_data;
 	efi_status_t efi_status = EFI_SUCCESS;
+	dma_addr_t cmd_buf_dma;
+	size_t cmd_buf_size;
+	void *cmd_buf;
 	size_t guid_offs;
 	size_t name_offs;
 	size_t req_size;
 	size_t rsp_size;
+	size_t req_offs;
+	size_t rsp_offs;
 	ssize_t status;
 
 	if (!name_size || !name || !guid)
@@ -545,17 +582,19 @@
 		__array(*name, *name_size / sizeof(*name))
 	);
 
-	req_data = kzalloc(req_size, GFP_KERNEL);
-	if (!req_data) {
+	cmd_buf_size = qcuefi_buf_align_fields(
+		__reqdata_offs(req_size, &req_offs)
+		__reqdata_offs(rsp_size, &rsp_offs)
+	);
+
+	cmd_buf = qseecom_dma_alloc(qcuefi->client, cmd_buf_size, &cmd_buf_dma, GFP_KERNEL);
+	if (!cmd_buf) {
 		efi_status = EFI_OUT_OF_RESOURCES;
 		goto out;
 	}
 
-	rsp_data = kzalloc(rsp_size, GFP_KERNEL);
-	if (!rsp_data) {
-		efi_status = EFI_OUT_OF_RESOURCES;
-		goto out_free_req;
-	}
+	req_data = cmd_buf + req_offs;
+	rsp_data = cmd_buf + rsp_offs;
 
 	req_data->command_id = QSEE_CMD_UEFI_GET_NEXT_VARIABLE;
 	req_data->guid_offset = guid_offs;
@@ -572,7 +611,9 @@
 		goto out_free;
 	}
 
-	status = qcom_qseecom_app_send(qcuefi->client, req_data, req_size, rsp_data, rsp_size);
+	status = qcom_qseecom_app_send(qcuefi->client,
+				       cmd_buf_dma + req_offs, req_size,
+				       cmd_buf_dma + rsp_offs, rsp_size);
 	if (status) {
 		efi_status = EFI_DEVICE_ERROR;
 		goto out_free;
@@ -645,9 +686,7 @@
 	}
 
 out_free:
-	kfree(rsp_data);
-out_free_req:
-	kfree(req_data);
+	qseecom_dma_free(qcuefi->client, cmd_buf_size, cmd_buf, cmd_buf_dma);
 out:
 	return efi_status;
 }
@@ -659,26 +698,34 @@
 	struct qsee_req_uefi_query_variable_info *req_data;
 	struct qsee_rsp_uefi_query_variable_info *rsp_data;
 	efi_status_t efi_status = EFI_SUCCESS;
+	dma_addr_t cmd_buf_dma;
+	size_t cmd_buf_size;
+	void *cmd_buf;
+	size_t req_offs;
+	size_t rsp_offs;
 	int status;
 
-	req_data = kzalloc(sizeof(*req_data), GFP_KERNEL);
-	if (!req_data) {
+	cmd_buf_size = qcuefi_buf_align_fields(
+		__reqdata_offs(sizeof(*req_data), &req_offs)
+		__reqdata_offs(sizeof(*rsp_data), &rsp_offs)
+	);
+
+	cmd_buf = qseecom_dma_alloc(qcuefi->client, cmd_buf_size, &cmd_buf_dma, GFP_KERNEL);
+	if (!cmd_buf) {
 		efi_status = EFI_OUT_OF_RESOURCES;
 		goto out;
 	}
 
-	rsp_data = kzalloc(sizeof(*rsp_data), GFP_KERNEL);
-	if (!rsp_data) {
-		efi_status = EFI_OUT_OF_RESOURCES;
-		goto out_free_req;
-	}
+	req_data = cmd_buf + req_offs;
+	rsp_data = cmd_buf + rsp_offs;
 
 	req_data->command_id = QSEE_CMD_UEFI_QUERY_VARIABLE_INFO;
 	req_data->attributes = attr;
 	req_data->length = sizeof(*req_data);
 
-	status = qcom_qseecom_app_send(qcuefi->client, req_data, sizeof(*req_data), rsp_data,
-				       sizeof(*rsp_data));
+	status = qcom_qseecom_app_send(qcuefi->client,
+				       cmd_buf_dma + req_offs, sizeof(*req_data),
+				       cmd_buf_dma + rsp_offs, sizeof(*rsp_data));
 	if (status) {
 		efi_status = EFI_DEVICE_ERROR;
 		goto out_free;
@@ -711,9 +758,7 @@
 		*max_variable_size = rsp_data->max_variable_size;
 
 out_free:
-	kfree(rsp_data);
-out_free_req:
-	kfree(req_data);
+	qseecom_dma_free(qcuefi->client, cmd_buf_size, cmd_buf, cmd_buf_dma);
 out:
 	return efi_status;
 }
@@ -741,6 +786,10 @@
 static struct qcuefi_client *qcuefi_acquire(void)
 {
 	mutex_lock(&__qcuefi_lock);
+	if (!__qcuefi) {
+		mutex_unlock(&__qcuefi_lock);
+		return NULL;
+	}
 	return __qcuefi;
 }
 
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/qcom_scm-smc.c
+++ linux-qcom-6.8.0/drivers/firmware/qcom/qcom_scm-smc.c
@@ -2,6 +2,7 @@
 /* Copyright (c) 2015,2019 The Linux Foundation. All rights reserved.
  */
 
+#include <linux/cleanup.h>
 #include <linux/io.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
@@ -9,6 +10,7 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/firmware/qcom/qcom_tzmem.h>
 #include <linux/arm-smccc.h>
 #include <linux/dma-mapping.h>
 
@@ -71,7 +73,7 @@
 	struct arm_smccc_res get_wq_res;
 	struct arm_smccc_args get_wq_ctx = {0};
 
-	get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_STD_CALL,
+	get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL,
 				ARM_SMCCC_SMC_64, ARM_SMCCC_OWNER_SIP,
 				SCM_SMC_FNID(QCOM_SCM_SVC_WAITQ, QCOM_SCM_WAITQ_GET_WQ_CTX));
 
@@ -150,11 +152,10 @@
 		   enum qcom_scm_convention qcom_convention,
 		   struct qcom_scm_res *res, bool atomic)
 {
+	struct qcom_tzmem_pool *mempool = qcom_scm_get_tzmem_pool();
 	int arglen = desc->arginfo & 0xf;
 	int i, ret;
-	dma_addr_t args_phys = 0;
-	void *args_virt = NULL;
-	size_t alloc_len;
+	void *args_virt __free(qcom_tzmem) = NULL;
 	gfp_t flag = atomic ? GFP_ATOMIC : GFP_KERNEL;
 	u32 smccc_call_type = atomic ? ARM_SMCCC_FAST_CALL : ARM_SMCCC_STD_CALL;
 	u32 qcom_smccc_convention = (qcom_convention == SMC_CONVENTION_ARM_32) ?
@@ -172,9 +173,9 @@
 		smc.args[i + SCM_SMC_FIRST_REG_IDX] = desc->args[i];
 
 	if (unlikely(arglen > SCM_SMC_N_REG_ARGS)) {
-		alloc_len = SCM_SMC_N_EXT_ARGS * sizeof(u64);
-		args_virt = kzalloc(PAGE_ALIGN(alloc_len), flag);
-
+		args_virt = qcom_tzmem_alloc(mempool,
+					     SCM_SMC_N_EXT_ARGS * sizeof(u64),
+					     flag);
 		if (!args_virt)
 			return -ENOMEM;
 
@@ -192,25 +193,10 @@
 						      SCM_SMC_FIRST_EXT_IDX]);
 		}
 
-		args_phys = dma_map_single(dev, args_virt, alloc_len,
-					   DMA_TO_DEVICE);
-
-		if (dma_mapping_error(dev, args_phys)) {
-			kfree(args_virt);
-			return -ENOMEM;
-		}
-
-		smc.args[SCM_SMC_LAST_REG_IDX] = args_phys;
+		smc.args[SCM_SMC_LAST_REG_IDX] = qcom_tzmem_to_phys(args_virt);
 	}
 
-	/* ret error check follows after args_virt cleanup*/
 	ret = __scm_smc_do(dev, &smc, &smc_res, atomic);
-
-	if (args_virt) {
-		dma_unmap_single(dev, args_phys, alloc_len, DMA_TO_DEVICE);
-		kfree(args_virt);
-	}
-
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/qcom_scm.c
+++ linux-qcom-6.8.0/drivers/firmware/qcom/qcom_scm.c
@@ -1,15 +1,21 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2010,2015,2019 The Linux Foundation. All rights reserved.
  * Copyright (C) 2015 Linaro Ltd.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/arm-smccc.h>
+#include <linux/bitfield.h>
+#include <linux/bits.h>
+#include <linux/cleanup.h>
 #include <linux/clk.h>
 #include <linux/completion.h>
 #include <linux/cpumask.h>
 #include <linux/dma-mapping.h>
+#include <linux/err.h>
 #include <linux/export.h>
 #include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/firmware/qcom/qcom_tzmem.h>
 #include <linux/init.h>
 #include <linux/interconnect.h>
 #include <linux/interrupt.h>
@@ -18,11 +24,14 @@
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
+#include <linux/of_reserved_mem.h>
 #include <linux/platform_device.h>
 #include <linux/reset-controller.h>
+#include <linux/sizes.h>
 #include <linux/types.h>
 
 #include "qcom_scm.h"
+#include "qcom_tzmem.h"
 
 static bool download_mode = IS_ENABLED(CONFIG_QCOM_SCM_DOWNLOAD_MODE_DEFAULT);
 module_param(download_mode, bool, 0);
@@ -41,8 +50,11 @@
 	int scm_vote_count;
 
 	u64 dload_mode_addr;
-};
 
+	struct qcom_tzmem_pool *mempool;
+};
+#if 0
+/* moved to include/linux/firmware/qcom/qcom_scm.h */
 struct qcom_scm_current_perm_info {
 	__le32 vmid;
 	__le32 perm;
@@ -55,7 +67,7 @@
 	__le64 mem_addr;
 	__le64 mem_size;
 };
-
+#endif
 /**
  * struct qcom_scm_qseecom_resp - QSEECOM SCM call response.
  * @result:    Result or status of the SCM call. See &enum qcom_scm_qseecom_result.
@@ -102,6 +114,7 @@
 };
 
 #define QSEECOM_MAX_APP_NAME_SIZE		64
+#define SHMBRIDGE_RESULT_NOTSUPP		4
 
 /* Each bit configures cold/warm boot address for one of the 4 CPUs */
 static const u8 qcom_scm_cpu_cold_bits[QCOM_SCM_BOOT_MAX_CPUS] = {
@@ -114,6 +127,10 @@
 #define QCOM_SMC_WAITQ_FLAG_WAKE_ONE	BIT(0)
 #define QCOM_SMC_WAITQ_FLAG_WAKE_ALL	BIT(1)
 
+#define QCOM_DLOAD_MASK		GENMASK(5, 4)
+#define QCOM_DLOAD_NODUMP	0
+#define QCOM_DLOAD_FULLDUMP	1
+
 static const char * const qcom_scm_convention_names[] = {
 	[SMC_CONVENTION_UNKNOWN] = "unknown",
 	[SMC_CONVENTION_ARM_32] = "smc arm 32",
@@ -195,6 +212,11 @@
 enum qcom_scm_convention qcom_scm_convention = SMC_CONVENTION_UNKNOWN;
 static DEFINE_SPINLOCK(scm_query_lock);
 
+struct qcom_tzmem_pool *qcom_scm_get_tzmem_pool(void)
+{
+	return __scm->mempool;
+}
+
 static enum qcom_scm_convention __get_convention(void)
 {
 	unsigned long flags;
@@ -458,7 +480,7 @@
 }
 EXPORT_SYMBOL_GPL(qcom_scm_set_remote_state);
 
-static int qcom_scm_disable_sdi(void)
+int qcom_scm_disable_sdi(void)
 {
 	int ret;
 	struct qcom_scm_desc desc = {
@@ -480,6 +502,7 @@
 
 	return ret ? : res.result[0];
 }
+EXPORT_SYMBOL_GPL(qcom_scm_disable_sdi);
 
 static int __qcom_scm_set_dload_mode(struct device *dev, bool enable)
 {
@@ -496,19 +519,32 @@
 	return qcom_scm_call_atomic(__scm->dev, &desc, NULL);
 }
 
+static int qcom_scm_io_rmw(phys_addr_t addr, unsigned int mask, unsigned int val)
+{
+	unsigned int old;
+	unsigned int new;
+	int ret;
+
+	ret = qcom_scm_io_readl(addr, &old);
+	if (ret)
+		return ret;
+
+	new = (old & ~mask) | (val & mask);
+
+	return qcom_scm_io_writel(addr, new);
+}
+
 static void qcom_scm_set_download_mode(bool enable)
 {
-	bool avail;
+	u32 val = enable ? QCOM_DLOAD_FULLDUMP : QCOM_DLOAD_NODUMP;
 	int ret = 0;
 
-	avail = __qcom_scm_is_call_available(__scm->dev,
-					     QCOM_SCM_SVC_BOOT,
-					     QCOM_SCM_BOOT_SET_DLOAD_MODE);
-	if (avail) {
+	if (__scm->dload_mode_addr) {
+		ret = qcom_scm_io_rmw(__scm->dload_mode_addr, QCOM_DLOAD_MASK,
+				      FIELD_PREP(QCOM_DLOAD_MASK, val));
+	} else if (__qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_BOOT,
+						QCOM_SCM_BOOT_SET_DLOAD_MODE)) {
 		ret = __qcom_scm_set_dload_mode(__scm->dev, enable);
-	} else if (__scm->dload_mode_addr) {
-		ret = qcom_scm_io_writel(__scm->dload_mode_addr,
-				enable ? QCOM_SCM_BOOT_SET_DLOAD_MODE : 0);
 	} else {
 		dev_err(__scm->dev,
 			"No available mechanism for setting download mode\n");
@@ -554,13 +590,23 @@
 	 * During the scm call memory protection will be enabled for the meta
 	 * data blob, so make sure it's physically contiguous, 4K aligned and
 	 * non-cachable to avoid XPU violations.
+	 *
+	 * For PIL calls the hypervisor like Gunyah or older QHEE creates SHM
+	 * Bridges for the blob buffers on behalf of Linux so we must not do it
+	 * ourselves hence use TZMem allocator only when these hypervisors are
+	 * not present.
+	 *
+	 * If we pass a buffer that is already part of an SHM Bridge to this
+	 * call, it will fail.
 	 */
-	mdata_buf = dma_alloc_coherent(__scm->dev, size, &mdata_phys,
-				       GFP_KERNEL);
-	if (!mdata_buf) {
-		dev_err(__scm->dev, "Allocation of metadata buffer failed.\n");
+	if (ctx && ctx->shm_bridge_needed)
+		mdata_buf = qcom_tzmem_alloc(__scm->mempool, size, GFP_KERNEL);
+	else
+		mdata_buf = dma_alloc_coherent(__scm->dev, size, &mdata_phys, GFP_KERNEL);
+
+	if (!mdata_buf)
 		return -ENOMEM;
-	}
+
 	memcpy(mdata_buf, metadata, size);
 
 	ret = qcom_scm_clk_enable();
@@ -569,22 +615,36 @@
 
 	ret = qcom_scm_bw_enable();
 	if (ret)
-		return ret;
+		goto disable_clk;
 
-	desc.args[1] = mdata_phys;
+	if (ctx && ctx->shm_bridge_needed)
+		desc.args[1] = qcom_tzmem_to_phys(mdata_buf);
+	else
+		desc.args[1] = mdata_phys;
 
 	ret = qcom_scm_call(__scm->dev, &desc, &res);
-
 	qcom_scm_bw_disable();
+
+disable_clk:
 	qcom_scm_clk_disable();
 
 out:
-	if (ret < 0 || !ctx) {
-		dma_free_coherent(__scm->dev, size, mdata_buf, mdata_phys);
-	} else if (ctx) {
-		ctx->ptr = mdata_buf;
-		ctx->phys = mdata_phys;
-		ctx->size = size;
+	if (ret < 0) {
+		if (ctx && ctx->shm_bridge_needed)
+			qcom_tzmem_free(mdata_buf);
+		else
+			dma_free_coherent(__scm->dev, size, mdata_buf, mdata_phys);
+	} else {
+		if (ctx) {
+			if (ctx->shm_bridge_needed)
+				ctx->phys = qcom_tzmem_to_phys(mdata_buf);
+			else
+				ctx->phys = mdata_phys;
+			ctx->ptr = mdata_buf;
+			ctx->size = size;
+		} else {
+			dma_free_coherent(__scm->dev, size, mdata_buf, mdata_phys);
+		}
 	}
 
 	return ret ? : res.result[0];
@@ -600,7 +660,10 @@
 	if (!ctx->ptr)
 		return;
 
-	dma_free_coherent(__scm->dev, ctx->size, ctx->ptr, ctx->phys);
+	if (ctx->shm_bridge_needed)
+		qcom_tzmem_free(ctx->ptr);
+	else
+		dma_free_coherent(__scm->dev, ctx->size, ctx->ptr, ctx->phys);
 
 	ctx->ptr = NULL;
 	ctx->phys = 0;
@@ -637,10 +700,12 @@
 
 	ret = qcom_scm_bw_enable();
 	if (ret)
-		return ret;
+		goto disable_clk;
 
 	ret = qcom_scm_call(__scm->dev, &desc, &res);
 	qcom_scm_bw_disable();
+
+disable_clk:
 	qcom_scm_clk_disable();
 
 	return ret ? : res.result[0];
@@ -672,10 +737,12 @@
 
 	ret = qcom_scm_bw_enable();
 	if (ret)
-		return ret;
+		goto disable_clk;
 
 	ret = qcom_scm_call(__scm->dev, &desc, &res);
 	qcom_scm_bw_disable();
+
+disable_clk:
 	qcom_scm_clk_disable();
 
 	return ret ? : res.result[0];
@@ -706,11 +773,12 @@
 
 	ret = qcom_scm_bw_enable();
 	if (ret)
-		return ret;
+		goto disable_clk;
 
 	ret = qcom_scm_call(__scm->dev, &desc, &res);
-
 	qcom_scm_bw_disable();
+
+disable_clk:
 	qcom_scm_clk_disable();
 
 	return ret ? : res.result[0];
@@ -855,6 +923,32 @@
 }
 EXPORT_SYMBOL_GPL(qcom_scm_restore_sec_cfg);
 
+#define QCOM_SCM_CP_APERTURE_CONTEXT_MASK	GENMASK(7, 0)
+
+bool qcom_scm_set_gpu_smmu_aperture_is_available(void)
+{
+	return __qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_MP,
+					    QCOM_SCM_MP_CP_SMMU_APERTURE_ID);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_set_gpu_smmu_aperture_is_available);
+
+int qcom_scm_set_gpu_smmu_aperture(unsigned int context_bank)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_MP,
+		.cmd = QCOM_SCM_MP_CP_SMMU_APERTURE_ID,
+		.arginfo = QCOM_SCM_ARGS(4),
+		.args[0] = 0xffff0000 | FIELD_PREP(QCOM_SCM_CP_APERTURE_CONTEXT_MASK, context_bank),
+		.args[1] = 0xffffffff,
+		.args[2] = 0xffffffff,
+		.args[3] = 0xffffffff,
+		.owner = ARM_SMCCC_OWNER_SIP
+	};
+
+	return qcom_scm_call(__scm->dev, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_set_gpu_smmu_aperture);
+
 int qcom_scm_iommu_secure_ptbl_size(u32 spare, size_t *size)
 {
 	struct qcom_scm_desc desc = {
@@ -987,14 +1081,13 @@
 	struct qcom_scm_mem_map_info *mem_to_map;
 	phys_addr_t mem_to_map_phys;
 	phys_addr_t dest_phys;
-	dma_addr_t ptr_phys;
+	phys_addr_t ptr_phys;
 	size_t mem_to_map_sz;
 	size_t dest_sz;
 	size_t src_sz;
 	size_t ptr_sz;
 	int next_vm;
 	__le32 *src;
-	void *ptr;
 	int ret, i, b;
 	u64 srcvm_bits = *srcvm;
 
@@ -1004,10 +1097,13 @@
 	ptr_sz = ALIGN(src_sz, SZ_64) + ALIGN(mem_to_map_sz, SZ_64) +
 			ALIGN(dest_sz, SZ_64);
 
-	ptr = dma_alloc_coherent(__scm->dev, ptr_sz, &ptr_phys, GFP_KERNEL);
+	void *ptr __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+							ptr_sz, GFP_KERNEL);
 	if (!ptr)
 		return -ENOMEM;
 
+	ptr_phys = qcom_tzmem_to_phys(ptr);
+
 	/* Fill source vmid detail */
 	src = ptr;
 	i = 0;
@@ -1036,7 +1132,6 @@
 
 	ret = __qcom_scm_assign_mem(__scm->dev, mem_to_map_phys, mem_to_map_sz,
 				    ptr_phys, src_sz, dest_phys, dest_sz);
-	dma_free_coherent(__scm->dev, ptr_sz, ptr, ptr_phys);
 	if (ret) {
 		dev_err(__scm->dev,
 			"Assign memory protection call failed %d\n", ret);
@@ -1049,6 +1144,39 @@
 EXPORT_SYMBOL_GPL(qcom_scm_assign_mem);
 
 /**
+ *  qcom_scm_assign_mem_regions() - Make a secure call to reassign memory
+ *                                   ownership of several memory regions
+ *  @mem_regions:    A buffer describing the set of memory regions that need to
+ *                   be reassigned
+ *  @mem_regions_sz: The size of the buffer describing the set of memory
+ *                   regions that need to be reassigned (in bytes)
+ *  @srcvms:         A buffer populated with he vmid(s) for the current set of
+ *                   owners
+ *  @src_sz:         The size of the src_vms buffer (in bytes)
+ *  @newvms:         A buffer populated with the new owners and corresponding
+ *                  permission flags.
+ *  @newvms_sz:      The size of the new_vms buffer (in bytes)
+ *
+ *  NOTE: It is up to the caller to ensure that the buffers that will be accessed
+ *  by the secure world are cache aligned, and have been flushed prior to
+ *  invoking this call.
+ *
+ *  Return negative errno on failure, 0 on success.
+ */
+int qcom_scm_assign_mem_regions(struct qcom_scm_mem_map_info *mem_regions,
+		size_t mem_regions_sz, u32 *srcvms,
+		size_t src_sz,
+		struct qcom_scm_current_perm_info *newvms,
+		size_t newvms_sz)
+{
+	return __qcom_scm_assign_mem(__scm ? __scm->dev : NULL,
+			virt_to_phys(mem_regions), mem_regions_sz,
+			virt_to_phys(srcvms), src_sz,
+			virt_to_phys(newvms), newvms_sz);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_assign_mem_regions);
+
+/**
  * qcom_scm_ocmem_lock_available() - is OCMEM lock/unlock interface available
  */
 bool qcom_scm_ocmem_lock_available(void)
@@ -1184,37 +1312,253 @@
 		.args[4] = data_unit_size,
 		.owner = ARM_SMCCC_OWNER_SIP,
 	};
-	void *keybuf;
-	dma_addr_t key_phys;
-	int ret;
 
-	/*
-	 * 'key' may point to vmalloc()'ed memory, but we need to pass a
-	 * physical address that's been properly flushed.  The sanctioned way to
-	 * do this is by using the DMA API.  But as is best practice for crypto
-	 * keys, we also must wipe the key after use.  This makes kmemdup() +
-	 * dma_map_single() not clearly correct, since the DMA API can use
-	 * bounce buffers.  Instead, just use dma_alloc_coherent().  Programming
-	 * keys is normally rare and thus not performance-critical.
-	 */
+	int ret;
 
-	keybuf = dma_alloc_coherent(__scm->dev, key_size, &key_phys,
-				    GFP_KERNEL);
+	void *keybuf __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+							   key_size,
+							   GFP_KERNEL);
 	if (!keybuf)
 		return -ENOMEM;
 	memcpy(keybuf, key, key_size);
-	desc.args[1] = key_phys;
+	desc.args[1] = qcom_tzmem_to_phys(keybuf);
 
 	ret = qcom_scm_call(__scm->dev, &desc, NULL);
 
 	memzero_explicit(keybuf, key_size);
 
-	dma_free_coherent(__scm->dev, key_size, keybuf, key_phys);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(qcom_scm_ice_set_key);
 
 /**
+ * qcom_scm_derive_sw_secret() - Derive software secret from wrapped key
+ * @wkey: the hardware wrapped key inaccessible to software
+ * @wkey_size: size of the wrapped key
+ * @sw_secret: the secret to be derived which is exactly the secret size
+ * @sw_secret_size: size of the sw_secret
+ *
+ * Derive a software secret from a hardware wrapped key for software crypto
+ * operations.
+ * For wrapped keys, the key needs to be unwrapped, in order to derive a
+ * software secret, which can be done in the hardware from a secure execution
+ * environment.
+ *
+ * For more information on sw secret, please refer to "Hardware-wrapped keys"
+ * section of Documentation/block/inline-encryption.rst.
+ *
+ * Return: 0 on success; -errno on failure.
+ */
+int qcom_scm_derive_sw_secret(const u8 *wkey, size_t wkey_size,
+			     u8 *sw_secret, size_t sw_secret_size)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_ES,
+		.cmd =  QCOM_SCM_ES_DERIVE_SW_SECRET,
+		.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RW,
+					 QCOM_SCM_VAL, QCOM_SCM_RW,
+					 QCOM_SCM_VAL),
+		.args[1] = wkey_size,
+		.args[3] = sw_secret_size,
+		.owner = ARM_SMCCC_OWNER_SIP,
+	};
+
+	int ret;
+
+	void *wkey_buf __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+							     wkey_size,
+							     GFP_KERNEL);
+	if (!wkey_buf)
+		return -ENOMEM;
+
+	void *secret_buf __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+							       sw_secret_size,
+							       GFP_KERNEL);
+	if (!secret_buf) {
+		ret = -ENOMEM;
+		goto out_free_wrapped;
+	}
+
+	memcpy(wkey_buf, wkey, wkey_size);
+	desc.args[0] = qcom_tzmem_to_phys(wkey_buf);
+	desc.args[2] = qcom_tzmem_to_phys(secret_buf);
+
+	ret = qcom_scm_call(__scm->dev, &desc, NULL);
+	if (!ret)
+		memcpy(sw_secret, secret_buf, sw_secret_size);
+
+	memzero_explicit(secret_buf, sw_secret_size);
+
+out_free_wrapped:
+	memzero_explicit(wkey_buf, wkey_size);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_derive_sw_secret);
+
+/**
+ * qcom_scm_generate_ice_key() - Generate a wrapped key for encryption.
+ * @lt_key: the wrapped key returned after key generation
+ * @lt_key_size: size of the wrapped key to be returned.
+ *
+ * Generate a key using the built-in HW module in the SoC. Wrap the key using
+ * the platform-specific Key Encryption Key and return to the caller.
+ *
+ * Return: 0 on success; -errno on failure.
+ */
+int qcom_scm_generate_ice_key(u8 *lt_key, size_t lt_key_size)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_ES,
+		.cmd =  QCOM_SCM_ES_GENERATE_ICE_KEY,
+		.arginfo = QCOM_SCM_ARGS(2, QCOM_SCM_RW, QCOM_SCM_VAL),
+		.args[1] = lt_key_size,
+		.owner = ARM_SMCCC_OWNER_SIP,
+	};
+
+	int ret;
+
+	void *lt_key_buf __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+							       lt_key_size,
+							       GFP_KERNEL);
+	if (!lt_key_buf)
+		return -ENOMEM;
+
+	desc.args[0] = qcom_tzmem_to_phys(lt_key_buf);
+
+	ret = qcom_scm_call(__scm->dev, &desc, NULL);
+	if (!ret)
+		memcpy(lt_key, lt_key_buf, lt_key_size);
+
+	memzero_explicit(lt_key_buf, lt_key_size);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_generate_ice_key);
+
+/**
+ * qcom_scm_prepare_ice_key() - Get the per-boot ephemeral wrapped key
+ * @lt_key: the longterm wrapped key
+ * @lt_key_size: size of the wrapped key
+ * @eph_key: ephemeral wrapped key to be returned
+ * @eph_key_size: size of the ephemeral wrapped key
+ *
+ * Qualcomm wrapped keys (longterm keys) are rewrapped with a per-boot
+ * ephemeral key for added protection. These are ephemeral in nature as
+ * they are valid only for that boot.
+ *
+ * Retrieve the key wrapped with the per-boot ephemeral key and return it to
+ * the caller.
+ *
+ * Return: 0 on success; -errno on failure.
+ */
+int qcom_scm_prepare_ice_key(const u8 *lt_key, size_t lt_key_size,
+			    u8 *eph_key, size_t eph_key_size)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_ES,
+		.cmd =  QCOM_SCM_ES_PREPARE_ICE_KEY,
+		.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RO,
+					 QCOM_SCM_VAL, QCOM_SCM_RW,
+					 QCOM_SCM_VAL),
+		.args[1] = lt_key_size,
+		.args[3] = eph_key_size,
+		.owner = ARM_SMCCC_OWNER_SIP,
+	};
+
+	int ret;
+
+	void *lt_key_buf __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+							       lt_key_size,
+							       GFP_KERNEL);
+	if (!lt_key_buf)
+		return -ENOMEM;
+
+	void *eph_key_buf __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+								eph_key_size,
+								GFP_KERNEL);
+	if (!eph_key_buf) {
+		ret = -ENOMEM;
+		goto out_free_longterm;
+	}
+
+	memcpy(lt_key_buf, lt_key, lt_key_size);
+	desc.args[0] = qcom_tzmem_to_phys(lt_key_buf);
+	desc.args[2] = qcom_tzmem_to_phys(eph_key_buf);
+
+	ret = qcom_scm_call(__scm->dev, &desc, NULL);
+	if (!ret)
+		memcpy(eph_key, eph_key_buf, eph_key_size);
+
+	memzero_explicit(eph_key_buf, eph_key_size);
+
+out_free_longterm:
+	memzero_explicit(lt_key_buf, lt_key_size);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_prepare_ice_key);
+
+/**
+ * qcom_scm_import_ice_key() - Import a wrapped key for encryption
+ * @imp_key: the raw key that is imported
+ * @imp_key_size: size of the key to be imported
+ * @lt_key: the wrapped key to be returned
+ * @lt_key_size: size of the wrapped key
+ *
+ * Import a raw key and return a long-term wrapped key to the caller.
+ *
+ * Return: 0 on success; -errno on failure.
+ */
+int qcom_scm_import_ice_key(const u8 *imp_key, size_t imp_key_size,
+			   u8 *lt_key, size_t lt_key_size)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_ES,
+		.cmd =  QCOM_SCM_ES_IMPORT_ICE_KEY,
+		.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RO,
+					 QCOM_SCM_VAL, QCOM_SCM_RW,
+					 QCOM_SCM_VAL),
+		.args[1] = imp_key_size,
+		.args[3] = lt_key_size,
+		.owner = ARM_SMCCC_OWNER_SIP,
+	};
+
+	int ret;
+
+	void *imp_key_buf __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+								imp_key_size,
+								GFP_KERNEL);
+	if (!imp_key_buf)
+		return -ENOMEM;
+
+	void *lt_key_buf __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+							       lt_key_size,
+							       GFP_KERNEL);
+	if (!lt_key_buf) {
+		ret = -ENOMEM;
+		goto out_free_longterm;
+	}
+
+	memcpy(imp_key_buf, imp_key, imp_key_size);
+	desc.args[0] = qcom_tzmem_to_phys(imp_key_buf);
+	desc.args[2] = qcom_tzmem_to_phys(lt_key_buf);
+
+	ret = qcom_scm_call(__scm->dev, &desc, NULL);
+	if (!ret)
+		memcpy(lt_key, lt_key_buf, lt_key_size);
+
+	memzero_explicit(lt_key_buf, lt_key_size);
+
+out_free_longterm:
+	memzero_explicit(imp_key_buf, imp_key_size);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_import_ice_key);
+
+
+/**
  * qcom_scm_hdcp_available() - Check if secure environment supports HDCP.
  *
  * Return true if HDCP is supported, false if not.
@@ -1321,6 +1665,76 @@
 }
 EXPORT_SYMBOL_GPL(qcom_scm_lmh_dcvsh_available);
 
+int qcom_scm_shm_bridge_enable(void)
+{
+	int ret;
+
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_MP,
+		.cmd = QCOM_SCM_MP_SHM_BRIDGE_ENABLE,
+		.owner = ARM_SMCCC_OWNER_SIP
+	};
+
+	struct qcom_scm_res res;
+
+	if (!__qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_MP,
+					  QCOM_SCM_MP_SHM_BRIDGE_ENABLE))
+		return -EOPNOTSUPP;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	if (ret)
+		return ret;
+
+	if (res.result[0] == SHMBRIDGE_RESULT_NOTSUPP)
+		return -EOPNOTSUPP;
+
+	return res.result[0];
+}
+EXPORT_SYMBOL_GPL(qcom_scm_shm_bridge_enable);
+
+int qcom_scm_shm_bridge_create(struct device *dev, u64 pfn_and_ns_perm_flags,
+			       u64 ipfn_and_s_perm_flags, u64 size_and_flags,
+			       u64 ns_vmids, u64 *handle)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_MP,
+		.cmd = QCOM_SCM_MP_SHM_BRIDGE_CREATE,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = pfn_and_ns_perm_flags,
+		.args[1] = ipfn_and_s_perm_flags,
+		.args[2] = size_and_flags,
+		.args[3] = ns_vmids,
+		.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_VAL, QCOM_SCM_VAL,
+					 QCOM_SCM_VAL, QCOM_SCM_VAL),
+	};
+
+	struct qcom_scm_res res;
+	int ret;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	if (handle && !ret)
+		*handle = res.result[1];
+
+	return ret ?: res.result[0];
+}
+EXPORT_SYMBOL_GPL(qcom_scm_shm_bridge_create);
+
+int qcom_scm_shm_bridge_delete(struct device *dev, u64 handle)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_MP,
+		.cmd = QCOM_SCM_MP_SHM_BRIDGE_DELETE,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = handle,
+		.arginfo = QCOM_SCM_ARGS(1, QCOM_SCM_VAL),
+	};
+
+	return qcom_scm_call(__scm->dev, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_shm_bridge_delete);
+
 int qcom_scm_lmh_profile_change(u32 profile_id)
 {
 	struct qcom_scm_desc desc = {
@@ -1338,8 +1752,6 @@
 int qcom_scm_lmh_dcvsh(u32 payload_fn, u32 payload_reg, u32 payload_val,
 		       u64 limit_node, u32 node_id, u64 version)
 {
-	dma_addr_t payload_phys;
-	u32 *payload_buf;
 	int ret, payload_size = 5 * sizeof(u32);
 
 	struct qcom_scm_desc desc = {
@@ -1354,7 +1766,9 @@
 		.owner = ARM_SMCCC_OWNER_SIP,
 	};
 
-	payload_buf = dma_alloc_coherent(__scm->dev, payload_size, &payload_phys, GFP_KERNEL);
+	u32 *payload_buf __free(qcom_tzmem) = qcom_tzmem_alloc(__scm->mempool,
+							       payload_size,
+							       GFP_KERNEL);
 	if (!payload_buf)
 		return -ENOMEM;
 
@@ -1364,15 +1778,28 @@
 	payload_buf[3] = 1;
 	payload_buf[4] = payload_val;
 
-	desc.args[0] = payload_phys;
+	desc.args[0] = qcom_tzmem_to_phys(payload_buf);
 
 	ret = qcom_scm_call(__scm->dev, &desc, NULL);
 
-	dma_free_coherent(__scm->dev, payload_size, payload_buf, payload_phys);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(qcom_scm_lmh_dcvsh);
 
+int qcom_scm_gpu_init_regs(u32 gpu_req)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_GPU,
+		.cmd = QCOM_SCM_SVC_GPU_INIT_REGS,
+		.arginfo = QCOM_SCM_ARGS(1),
+		.args[0] = gpu_req,
+		.owner = ARM_SMCCC_OWNER_SIP,
+	};
+
+	return qcom_scm_call(__scm->dev, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_gpu_init_regs);
+
 static int qcom_scm_find_dload_address(struct device *dev, u64 *addr)
 {
 	struct device_node *tcsr;
@@ -1576,9 +2003,9 @@
 /**
  * qcom_scm_qseecom_app_send() - Send to and receive data from a given QSEE app.
  * @app_id:   The ID of the target app.
- * @req:      Request buffer sent to the app (must be DMA-mappable).
+ * @req:      DMA address of the request buffer sent to the app.
  * @req_size: Size of the request buffer.
- * @rsp:      Response buffer, written to by the app (must be DMA-mappable).
+ * @rsp:      DMA address of the response buffer, written to by the app.
  * @rsp_size: Size of the response buffer.
  *
  * Sends a request to the QSEE app associated with the given ID and read back
@@ -1589,33 +2016,13 @@
  *
  * Return: Zero on success, nonzero on failure.
  */
-int qcom_scm_qseecom_app_send(u32 app_id, void *req, size_t req_size, void *rsp,
-			      size_t rsp_size)
+int qcom_scm_qseecom_app_send(u32 app_id, dma_addr_t req, size_t req_size,
+			      dma_addr_t rsp, size_t rsp_size)
 {
 	struct qcom_scm_qseecom_resp res = {};
 	struct qcom_scm_desc desc = {};
-	dma_addr_t req_phys;
-	dma_addr_t rsp_phys;
 	int status;
 
-	/* Map request buffer */
-	req_phys = dma_map_single(__scm->dev, req, req_size, DMA_TO_DEVICE);
-	status = dma_mapping_error(__scm->dev, req_phys);
-	if (status) {
-		dev_err(__scm->dev, "qseecom: failed to map request buffer\n");
-		return status;
-	}
-
-	/* Map response buffer */
-	rsp_phys = dma_map_single(__scm->dev, rsp, rsp_size, DMA_FROM_DEVICE);
-	status = dma_mapping_error(__scm->dev, rsp_phys);
-	if (status) {
-		dma_unmap_single(__scm->dev, req_phys, req_size, DMA_TO_DEVICE);
-		dev_err(__scm->dev, "qseecom: failed to map response buffer\n");
-		return status;
-	}
-
-	/* Set up SCM call data */
 	desc.owner = QSEECOM_TZ_OWNER_TZ_APPS;
 	desc.svc = QSEECOM_TZ_SVC_APP_ID_PLACEHOLDER;
 	desc.cmd = QSEECOM_TZ_CMD_APP_SEND;
@@ -1623,18 +2030,13 @@
 				     QCOM_SCM_RW, QCOM_SCM_VAL,
 				     QCOM_SCM_RW, QCOM_SCM_VAL);
 	desc.args[0] = app_id;
-	desc.args[1] = req_phys;
+	desc.args[1] = req;
 	desc.args[2] = req_size;
-	desc.args[3] = rsp_phys;
+	desc.args[3] = rsp;
 	desc.args[4] = rsp_size;
 
-	/* Perform call */
 	status = qcom_scm_qseecom_call(&desc, &res);
 
-	/* Unmap buffers */
-	dma_unmap_single(__scm->dev, rsp_phys, rsp_size, DMA_FROM_DEVICE);
-	dma_unmap_single(__scm->dev, req_phys, req_size, DMA_TO_DEVICE);
-
 	if (status)
 		return status;
 
@@ -1649,7 +2051,7 @@
  * We do not yet support re-entrant calls via the qseecom interface. To prevent
  + any potential issues with this, only allow validated machines for now.
  */
-static const struct of_device_id qcom_scm_qseecom_allowlist[] = {
+static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = {
 	{ .compatible = "lenovo,thinkpad-x13s", },
 	{ }
 };
@@ -1738,7 +2140,7 @@
  */
 bool qcom_scm_is_available(void)
 {
-	return !!__scm;
+	return !!READ_ONCE(__scm);
 }
 EXPORT_SYMBOL_GPL(qcom_scm_is_available);
 
@@ -1769,7 +2171,7 @@
 	return 0;
 }
 
-static int qcom_scm_waitq_wakeup(struct qcom_scm *scm, unsigned int wq_ctx)
+static int qcom_scm_waitq_wakeup(unsigned int wq_ctx)
 {
 	int ret;
 
@@ -1801,7 +2203,7 @@
 			goto out;
 		}
 
-		ret = qcom_scm_waitq_wakeup(scm, wq_ctx);
+		ret = qcom_scm_waitq_wakeup(wq_ctx);
 		if (ret)
 			goto out;
 	} while (more_pending);
@@ -1810,8 +2212,13 @@
 	return IRQ_HANDLED;
 }
 
+#ifdef CONFIG_QCOM_SCM_ADDON
+#include "qcom_scm_addon.c"
+#endif
+
 static int qcom_scm_probe(struct platform_device *pdev)
 {
+	struct qcom_tzmem_pool_config pool_config;
 	struct qcom_scm *scm;
 	int irq, ret;
 
@@ -1819,10 +2226,12 @@
 	if (!scm)
 		return -ENOMEM;
 
+	scm->dev = &pdev->dev;
 	ret = qcom_scm_find_dload_address(&pdev->dev, &scm->dload_mode_addr);
 	if (ret < 0)
 		return ret;
 
+	init_completion(&scm->waitq_comp);
 	mutex_init(&scm->scm_bw_lock);
 
 	scm->path = devm_of_icc_get(&pdev->dev, NULL);
@@ -1854,10 +2263,8 @@
 	if (ret)
 		return ret;
 
-	__scm = scm;
-	__scm->dev = &pdev->dev;
-
-	init_completion(&__scm->waitq_comp);
+	/* Let all above stores be available after this */
+	smp_store_release(&__scm, scm);
 
 	irq = platform_get_irq_optional(pdev, 0);
 	if (irq < 0) {
@@ -1877,16 +2284,34 @@
 	 * will cause the boot stages to enter download mode, unless
 	 * disabled below by a clean shutdown/reboot.
 	 */
-	if (download_mode)
-		qcom_scm_set_download_mode(true);
-
+	qcom_scm_set_download_mode(download_mode);
 
 	/*
 	 * Disable SDI if indicated by DT that it is enabled by default.
 	 */
-	if (of_property_read_bool(pdev->dev.of_node, "qcom,sdi-enabled"))
+	if (of_property_read_bool(pdev->dev.of_node, "qcom,sdi-enabled") || !download_mode)
 		qcom_scm_disable_sdi();
 
+	ret = of_reserved_mem_device_init(__scm->dev);
+	if (ret && ret != -ENODEV)
+		return dev_err_probe(__scm->dev, ret,
+				     "Failed to setup the reserved memory region for TZ mem\n");
+
+	ret = qcom_tzmem_enable(__scm->dev);
+	if (ret)
+		return dev_err_probe(__scm->dev, ret,
+				     "Failed to enable the TrustZone memory allocator\n");
+
+	memset(&pool_config, 0, sizeof(pool_config));
+	pool_config.initial_size = 0;
+	pool_config.policy = QCOM_TZMEM_POLICY_ON_DEMAND;
+	pool_config.max_size = SZ_256K;
+
+	__scm->mempool = devm_qcom_tzmem_pool_new(__scm->dev, &pool_config);
+	if (IS_ERR(__scm->mempool))
+		return dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool),
+				     "Failed to create the SCM memory pool\n");
+
 	/*
 	 * Initialize the QSEECOM interface.
 	 *
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/qcom_scm.h
+++ linux-qcom-6.8.0/drivers/firmware/qcom/qcom_scm.h
@@ -1,10 +1,12 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /* Copyright (c) 2010-2015,2019 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #ifndef __QCOM_SCM_INT_H
 #define __QCOM_SCM_INT_H
 
 struct device;
+struct qcom_tzmem_pool;
 
 enum qcom_scm_convention {
 	SMC_CONVENTION_UNKNOWN,
@@ -78,6 +80,8 @@
 int scm_legacy_call(struct device *dev, const struct qcom_scm_desc *desc,
 		    struct qcom_scm_res *res);
 
+struct qcom_tzmem_pool *qcom_scm_get_tzmem_pool(void);
+
 #define QCOM_SCM_SVC_BOOT		0x01
 #define QCOM_SCM_BOOT_SET_ADDR		0x01
 #define QCOM_SCM_BOOT_TERMINATE_PC	0x02
@@ -113,6 +117,10 @@
 #define QCOM_SCM_MP_IOMMU_SET_CP_POOL_SIZE	0x05
 #define QCOM_SCM_MP_VIDEO_VAR			0x08
 #define QCOM_SCM_MP_ASSIGN			0x16
+#define QCOM_SCM_MP_CP_SMMU_APERTURE_ID		0x1b
+#define QCOM_SCM_MP_SHM_BRIDGE_ENABLE		0x1c
+#define QCOM_SCM_MP_SHM_BRIDGE_DELETE		0x1d
+#define QCOM_SCM_MP_SHM_BRIDGE_CREATE		0x1e
 
 #define QCOM_SCM_SVC_OCMEM		0x0f
 #define QCOM_SCM_OCMEM_LOCK_CMD		0x01
@@ -121,6 +129,10 @@
 #define QCOM_SCM_SVC_ES			0x10	/* Enterprise Security */
 #define QCOM_SCM_ES_INVALIDATE_ICE_KEY	0x03
 #define QCOM_SCM_ES_CONFIG_SET_ICE_KEY	0x04
+#define QCOM_SCM_ES_DERIVE_SW_SECRET	0x07
+#define QCOM_SCM_ES_GENERATE_ICE_KEY   0x08
+#define QCOM_SCM_ES_PREPARE_ICE_KEY    0x09
+#define QCOM_SCM_ES_IMPORT_ICE_KEY     0xA
 
 #define QCOM_SCM_SVC_HDCP		0x11
 #define QCOM_SCM_HDCP_INVOKE		0x01
@@ -138,6 +150,9 @@
 #define QCOM_SCM_WAITQ_RESUME			0x02
 #define QCOM_SCM_WAITQ_GET_WQ_CTX		0x03
 
+#define QCOM_SCM_SVC_GPU			0x28
+#define QCOM_SCM_SVC_GPU_INIT_REGS		0x01
+
 /* common error codes */
 #define QCOM_SCM_V2_EBUSY	-12
 #define QCOM_SCM_ENOMEM		-5
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/qcom_scm_addon.c
+++ linux-qcom-6.8.0/drivers/firmware/qcom/qcom_scm_addon.c
@@ -0,0 +1,673 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define QCOM_SCM_MP_CP_SMMU_APERTURE_ID         0x1b
+#define QCOM_SCM_CP_APERTURE_REG    0x0
+#define QCOM_SCM_SVC_GPU            0x28
+#define QCOM_SCM_SVC_GPU_INIT_REGS          0x1
+
+#define QCOM_SCM_SVC_SMCINVOKE          0x06
+#define QCOM_SCM_SMCINVOKE_INVOKE_LEGACY    0x00
+#define QCOM_SCM_SMCINVOKE_INVOKE       0x02
+#define QCOM_SCM_SMCINVOKE_CB_RSP       0x01
+
+#define QCOM_SCM_SVC_INFO       0x06
+#define QCOM_SCM_INFO_IS_CALL_AVAIL 0x01
+#define QCOM_SCM_INFO_GET_FEAT_VERSION_CMD  0x03
+
+/* TOS Services and Function IDs */
+#define QCOM_SCM_SVC_QSEELOG            0x01
+#define QCOM_SCM_QSEELOG_REGISTER       0x06
+#define QCOM_SCM_QUERY_ENCR_LOG_FEAT_ID     0x0b
+#define QCOM_SCM_REQUEST_ENCR_LOG_ID        0x0c
+
+/* Feature IDs for QCOM_SCM_INFO_GET_FEAT_VERSION */
+#define QCOM_SCM_TZ_DBG_ETM_FEAT_ID     0x08
+#define QCOM_SCM_FEAT_LOG_ID            0x0a
+#define QCOM_SCM_MP_CP_FEAT_ID          0x0c
+
+#define QCOM_SCM_SVC_DCVS           0x0D
+#define QCOM_SCM_DCVS_RESET         0x07
+#define QCOM_SCM_DCVS_UPDATE            0x08
+#define QCOM_SCM_DCVS_INIT          0x09
+#define QCOM_SCM_DCVS_UPDATE_V2         0x0a
+#define QCOM_SCM_DCVS_INIT_V2           0x0b
+#define QCOM_SCM_DCVS_INIT_CA_V2        0x0c
+#define QCOM_SCM_DCVS_UPDATE_CA_V2      0x0d
+
+#define QCOM_SCM_IO_RESET           0x03
+
+/* IDs for SHM bridge */
+#define QCOM_SCM_MEMP_SHM_BRIDGE_ENABLE         0x1c
+#define QCOM_SCM_MEMP_SHM_BRIDGE_DELETE         0x1d
+#define QCOM_SCM_MEMP_SHM_BRDIGE_CREATE         0x1e
+
+/* IDs for sdi and sec wdog control */
+#define QCOM_SCM_BOOT_SEC_WDOG_DIS	0x07
+#define QCOM_SCM_BOOT_SEC_WDOG_TRIGGER	0x08
+#define QCOM_SCM_BOOT_WDOG_DEBUG_PART	0x09
+#define QCOM_SCM_BOOT_SPIN_CPU		0x0d
+
+/* IDs for SHE */
+#define QCOM_SCM_SVC_SHE                        0x21
+#define QCOM_SCM_SHE_ID                         0x1
+
+/* IDs for QCOM_SCM_INFO_BW_PROF_ID */
+#define QCOM_SCM_INFO_BW_PROF_ID	0x07
+
+/* IDs for CAMERA */
+#define QCOM_SCM_SVC_CAMERA			0x18
+#define QCOM_SCM_CAMERA_UPDATE_CAMNOC_QOS	0xA
+
+static int __qcom_scm_get_feat_version(struct device *dev, u64 feat_id, u64 *version)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_INFO,
+		.cmd = QCOM_SCM_INFO_GET_FEAT_VERSION_CMD,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = feat_id,
+		.arginfo = QCOM_SCM_ARGS(1),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	if (version)
+		*version = res.result[0];
+
+	return ret;
+}
+
+/**
+ * qcom_scm_dcvs_ca_available() - check if context aware DCVS operations are
+ * available
+ */
+bool qcom_scm_dcvs_ca_available(void)
+{
+	struct device *dev = __scm ? __scm->dev : NULL;
+
+	return __qcom_scm_is_call_available(dev, QCOM_SCM_SVC_DCVS,
+					QCOM_SCM_DCVS_INIT_CA_V2) &&
+			__qcom_scm_is_call_available(dev, QCOM_SCM_SVC_DCVS,
+					QCOM_SCM_DCVS_UPDATE_CA_V2);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_dcvs_ca_available);
+
+/**
+ * qcom_scm_dcvs_core_available() - check if core DCVS operations are available
+ */
+bool qcom_scm_dcvs_core_available(void)
+{
+	struct device *dev = __scm ? __scm->dev : NULL;
+
+	return __qcom_scm_is_call_available(dev, QCOM_SCM_SVC_DCVS,
+					QCOM_SCM_DCVS_INIT) &&
+			 __qcom_scm_is_call_available(dev, QCOM_SCM_SVC_DCVS,
+					QCOM_SCM_DCVS_UPDATE) &&
+			 __qcom_scm_is_call_available(dev, QCOM_SCM_SVC_DCVS,
+					QCOM_SCM_DCVS_RESET);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_dcvs_core_available);
+
+int qcom_scm_dcvs_reset(void)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_DCVS,
+		.cmd = QCOM_SCM_DCVS_RESET,
+		.owner = ARM_SMCCC_OWNER_SIP
+	};
+
+	return qcom_scm_call(__scm ? __scm->dev : NULL, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_dcvs_reset);
+
+int qcom_scm_dcvs_init_v2(phys_addr_t addr, size_t size, int *version)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_DCVS,
+		.cmd = QCOM_SCM_DCVS_INIT_V2,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = addr,
+		.args[1] = size,
+		.arginfo = QCOM_SCM_ARGS(2, QCOM_SCM_RW, QCOM_SCM_VAL),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	if (ret >= 0)
+		*version = res.result[0];
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_dcvs_init_v2);
+
+int qcom_scm_dcvs_update(int level, s64 total_time, s64 busy_time)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_DCVS,
+		.cmd = QCOM_SCM_DCVS_UPDATE,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = level,
+		.args[1] = total_time,
+		.args[2] = busy_time,
+		.arginfo = QCOM_SCM_ARGS(3),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call_atomic(__scm->dev, &desc, &res);
+
+	return ret ? : res.result[0];
+}
+EXPORT_SYMBOL_GPL(qcom_scm_dcvs_update);
+
+int qcom_scm_dcvs_update_v2(int level, s64 total_time, s64 busy_time)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_DCVS,
+		.cmd = QCOM_SCM_DCVS_UPDATE_V2,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = level,
+		.args[1] = total_time,
+		.args[2] = busy_time,
+		.arginfo = QCOM_SCM_ARGS(3),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	return ret ? : res.result[0];
+}
+EXPORT_SYMBOL_GPL(qcom_scm_dcvs_update_v2);
+
+int qcom_scm_dcvs_update_ca_v2(int level, s64 total_time, s64 busy_time,
+		int context_count)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_DCVS,
+		.cmd = QCOM_SCM_DCVS_UPDATE_CA_V2,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = level,
+		.args[1] = total_time,
+		.args[2] = busy_time,
+		.args[3] = context_count,
+		.arginfo = QCOM_SCM_ARGS(4),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	return ret ? : res.result[0];
+
+}
+EXPORT_SYMBOL_GPL(qcom_scm_dcvs_update_ca_v2);
+
+int qcom_scm_dcvs_init_ca_v2(phys_addr_t addr, size_t size)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_DCVS,
+		.cmd = QCOM_SCM_DCVS_INIT_CA_V2,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = addr,
+		.args[1] = size,
+		.arginfo = QCOM_SCM_ARGS(2, QCOM_SCM_RW, QCOM_SCM_VAL),
+	};
+
+	return qcom_scm_call(__scm->dev, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_dcvs_init_ca_v2);
+
+int qcom_scm_io_reset(void)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_IO,
+		.cmd = QCOM_SCM_IO_RESET,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.arginfo = QCOM_SCM_ARGS(2),
+	};
+
+	return qcom_scm_call_atomic(__scm ? __scm->dev : NULL, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_io_reset);
+
+int qcom_scm_get_tz_log_feat_id(u64 *version)
+{
+	return __qcom_scm_get_feat_version(__scm->dev, QCOM_SCM_FEAT_LOG_ID, version);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_get_tz_log_feat_id);
+
+int qcom_scm_get_tz_feat_id_version(u64 feat_id, u64 *version)
+{
+	return __qcom_scm_get_feat_version(__scm->dev, feat_id, version);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_get_tz_feat_id_version);
+
+int qcom_scm_register_qsee_log_buf(phys_addr_t buf, size_t len)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_QSEELOG,
+		.cmd = QCOM_SCM_QSEELOG_REGISTER,
+		.owner = ARM_SMCCC_OWNER_TRUSTED_OS,
+		.args[0] = buf,
+		.args[1] = len,
+		.arginfo = QCOM_SCM_ARGS(2, QCOM_SCM_RW),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	return ret ? : res.result[0];
+}
+EXPORT_SYMBOL_GPL(qcom_scm_register_qsee_log_buf);
+
+int qcom_scm_query_encrypted_log_feature(u64 *enabled)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_QSEELOG,
+		.cmd = QCOM_SCM_QUERY_ENCR_LOG_FEAT_ID,
+		.owner = ARM_SMCCC_OWNER_TRUSTED_OS
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+	if (enabled)
+		*enabled = res.result[0];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_query_encrypted_log_feature);
+
+int qcom_scm_request_encrypted_log(phys_addr_t buf,
+					size_t len,
+					uint32_t log_id,
+					bool is_full_tz_logs_supported,
+					bool is_full_tz_logs_enabled)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_QSEELOG,
+		.cmd = QCOM_SCM_REQUEST_ENCR_LOG_ID,
+		.owner = ARM_SMCCC_OWNER_TRUSTED_OS,
+		.args[0] = buf,
+		.args[1] = len,
+		.args[2] = log_id
+	};
+	struct qcom_scm_res res;
+
+	if (is_full_tz_logs_supported) {
+		if (is_full_tz_logs_enabled) {
+			/* requesting full logs */
+			desc.args[3] = 1;
+		} else {
+			/* requesting incremental logs */
+			desc.args[3] = 0;
+		}
+		desc.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RW);
+	} else {
+		desc.arginfo = QCOM_SCM_ARGS(3, QCOM_SCM_RW);
+	}
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	return ret ? : res.result[0];
+}
+EXPORT_SYMBOL_GPL(qcom_scm_request_encrypted_log);
+
+bool qcom_scm_kgsl_set_smmu_aperture_available(void)
+{
+	int ret;
+
+	ret = __qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_MP,
+				QCOM_SCM_MP_CP_SMMU_APERTURE_ID);
+
+	return ret > 0;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_kgsl_set_smmu_aperture_available);
+
+int qcom_scm_kgsl_set_smmu_aperture(unsigned int num_context_bank)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_MP,
+		.cmd = QCOM_SCM_MP_CP_SMMU_APERTURE_ID,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = 0xffff0000
+				| ((QCOM_SCM_CP_APERTURE_REG & 0xff) << 8)
+				| (num_context_bank & 0xff),
+		.args[1] = 0xffffffff,
+		.args[2] = 0xffffffff,
+		.args[3] = 0xffffffff,
+		.arginfo = QCOM_SCM_ARGS(4),
+	};
+
+	return qcom_scm_call(__scm->dev, &desc, NULL);
+
+}
+EXPORT_SYMBOL_GPL(qcom_scm_kgsl_set_smmu_aperture);
+
+int qcom_scm_kgsl_init_regs(u32 gpu_req)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_GPU,
+		.cmd = QCOM_SCM_SVC_GPU_INIT_REGS,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = gpu_req,
+		.arginfo = QCOM_SCM_ARGS(1),
+	};
+
+	return qcom_scm_call(__scm->dev, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_kgsl_init_regs);
+
+int qcom_scm_invoke_smc(phys_addr_t in_buf, size_t in_buf_size,
+		phys_addr_t out_buf, size_t out_buf_size, int32_t *result,
+		u64 *response_type, unsigned int *data)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_SMCINVOKE,
+		.cmd = QCOM_SCM_SMCINVOKE_INVOKE,
+		.owner = ARM_SMCCC_OWNER_TRUSTED_OS,
+		.args[0] = in_buf,
+		.args[1] = in_buf_size,
+		.args[2] = out_buf,
+		.args[3] = out_buf_size,
+		.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RW, QCOM_SCM_VAL,
+					QCOM_SCM_RW, QCOM_SCM_VAL),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	if (result)
+		*result = res.result[1];
+
+	if (response_type)
+		*response_type = res.result[0];
+
+	if (data)
+		*data = res.result[2];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_invoke_smc);
+
+int qcom_scm_invoke_smc_legacy(phys_addr_t in_buf, size_t in_buf_size,
+		phys_addr_t out_buf, size_t out_buf_size, int32_t *result,
+		u64 *response_type, unsigned int *data)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_SMCINVOKE,
+		.cmd = QCOM_SCM_SMCINVOKE_INVOKE_LEGACY,
+		.owner = ARM_SMCCC_OWNER_TRUSTED_OS,
+		.args[0] = in_buf,
+		.args[1] = in_buf_size,
+		.args[2] = out_buf,
+		.args[3] = out_buf_size,
+		.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RW, QCOM_SCM_VAL,
+					QCOM_SCM_RW, QCOM_SCM_VAL),
+	};
+
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	if (result)
+		*result = res.result[1];
+
+	if (response_type)
+		*response_type = res.result[0];
+
+	if (data)
+		*data = res.result[2];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_invoke_smc_legacy);
+
+int qcom_scm_invoke_callback_response(phys_addr_t out_buf,
+	size_t out_buf_size, int32_t *result, u64 *response_type,
+	unsigned int *data)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_SMCINVOKE,
+		.cmd = QCOM_SCM_SMCINVOKE_CB_RSP,
+		.owner = ARM_SMCCC_OWNER_TRUSTED_OS,
+		.args[0] = out_buf,
+		.args[1] = out_buf_size,
+		.arginfo = QCOM_SCM_ARGS(2, QCOM_SCM_RW, QCOM_SCM_VAL),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	if (result)
+		*result = res.result[1];
+
+	if (response_type)
+		*response_type = res.result[0];
+
+	if (data)
+		*data = res.result[2];
+
+	return ret;
+
+}
+EXPORT_SYMBOL_GPL(qcom_scm_invoke_callback_response);
+
+int qcom_scm_enable_shm_bridge(void)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_MP,
+		.cmd = QCOM_SCM_MEMP_SHM_BRIDGE_ENABLE,
+		.owner = ARM_SMCCC_OWNER_SIP
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	return ret ? : res.result[0];
+}
+EXPORT_SYMBOL_GPL(qcom_scm_enable_shm_bridge);
+
+int qcom_scm_delete_shm_bridge(u64 handle)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_MP,
+		.cmd = QCOM_SCM_MEMP_SHM_BRIDGE_DELETE,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = handle,
+		.arginfo = QCOM_SCM_ARGS(1, QCOM_SCM_VAL),
+	};
+
+	return qcom_scm_call(__scm ? __scm->dev : NULL, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_delete_shm_bridge);
+
+int qcom_scm_create_shm_bridge(u64 pfn_and_ns_perm_flags,
+	u64 ipfn_and_s_perm_flags, u64 size_and_flags, u64 ns_vmids,
+	u64 *handle)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+	.svc = QCOM_SCM_SVC_MP,
+	.cmd = QCOM_SCM_MEMP_SHM_BRDIGE_CREATE,
+	.owner = ARM_SMCCC_OWNER_SIP,
+	.args[0] = pfn_and_ns_perm_flags,
+	.args[1] = ipfn_and_s_perm_flags,
+	.args[2] = size_and_flags,
+	.args[3] = ns_vmids,
+	.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_VAL, QCOM_SCM_VAL,
+				QCOM_SCM_VAL, QCOM_SCM_VAL),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	if (handle)
+		*handle = res.result[1];
+
+	return ret ? : res.result[0];
+}
+EXPORT_SYMBOL_GPL(qcom_scm_create_shm_bridge);
+
+/**
+ * qcm_scm_sec_wdog_deactivate() - Deactivate secure watchdog
+ */
+int qcom_scm_sec_wdog_deactivate(void)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_BOOT,
+		.cmd = QCOM_SCM_BOOT_SEC_WDOG_DIS,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = 1,
+		.arginfo = QCOM_SCM_ARGS(1),
+	};
+
+	return qcom_scm_call(__scm->dev, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_sec_wdog_deactivate);
+
+/**
+ * qcom_scm_sec_wdog_trigger() - Trigger secure watchdog
+ */
+int qcom_scm_sec_wdog_trigger(void)
+{
+	int ret;
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_BOOT,
+		.cmd = QCOM_SCM_BOOT_SEC_WDOG_TRIGGER,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = 0,
+		.arginfo = QCOM_SCM_ARGS(1),
+	};
+	struct qcom_scm_res res;
+
+	ret = qcom_scm_call(__scm->dev, &desc, &res);
+
+	return ret ? : res.result[0];
+}
+EXPORT_SYMBOL_GPL(qcom_scm_sec_wdog_trigger);
+
+/**
+ * qcom_scm_spin_cpu(void) - spin on cpu
+ */
+int qcom_scm_spin_cpu(void)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_BOOT,
+		.cmd = QCOM_SCM_BOOT_SPIN_CPU,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = 0,
+		.arginfo = QCOM_SCM_ARGS(1),
+	};
+
+	return qcom_scm_call(__scm->dev, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_spin_cpu);
+
+int qcom_scm_ddrbw_profiler(phys_addr_t in_buf, size_t in_buf_size,
+			    phys_addr_t out_buf, size_t out_buf_size)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_INFO,
+		.cmd = QCOM_SCM_INFO_BW_PROF_ID,
+		.owner = ARM_SMCCC_OWNER_SIP,
+	};
+
+	desc.args[0] = in_buf;
+	desc.args[1] = in_buf_size;
+	desc.args[2] = out_buf;
+	desc.args[3] = out_buf_size;
+	desc.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RW, QCOM_SCM_VAL,
+				     QCOM_SCM_RW, QCOM_SCM_VAL);
+
+	return qcom_scm_call(__scm ? __scm->dev : NULL, &desc, NULL);
+}
+EXPORT_SYMBOL_GPL(qcom_scm_ddrbw_profiler);
+
+/**
+ * qcom_scm_she_op() - request TZ SHE (Secure Hardware Extension) service
+ *		       to perform crypto operations based on SHE tables.
+ */
+int qcom_scm_she_op(u64 _arg1, u64 _arg2, u64 _arg3, u64 _arg4, u64 *res1)
+{
+	int ret;
+
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_SHE,
+		.cmd = QCOM_SCM_SHE_ID,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_VAL, QCOM_SCM_VAL,
+				     QCOM_SCM_RW, QCOM_SCM_VAL),
+	};
+	struct qcom_scm_res res;
+
+	desc.args[0] = _arg1;
+	desc.args[1] = _arg2;
+	desc.args[2] = _arg3;
+	desc.args[3] = _arg4;
+
+	ret = qcom_scm_call_atomic(__scm ? __scm->dev : NULL, &desc, &res);
+
+	/* The result from SHE service must be handled by the SHE client */
+	if (res1)
+		*res1 = res.result[0];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_she_op);
+
+int qcom_scm_camera_update_camnoc_qos(uint32_t use_case_id,
+	uint32_t cam_qos_cnt, struct qcom_scm_camera_qos *cam_qos)
+{
+	int ret;
+	dma_addr_t payload_phys;
+	u32 *payload_buf = NULL;
+	u32 payload_size = 0;
+
+	if ((cam_qos_cnt > QCOM_SCM_CAMERA_MAX_QOS_CNT) || (cam_qos_cnt && !cam_qos)) {
+		pr_err("Invalid input SmartQoS count: %d\n", cam_qos_cnt);
+		return -EINVAL;
+	}
+
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_CAMERA,
+		.cmd = QCOM_SCM_CAMERA_UPDATE_CAMNOC_QOS,
+		.owner = ARM_SMCCC_OWNER_SIP,
+		.args[0] = use_case_id,
+		.args[2] = payload_size,
+		.arginfo = QCOM_SCM_ARGS(3, QCOM_SCM_VAL, QCOM_SCM_RW, QCOM_SCM_VAL),
+	};
+
+	payload_size = cam_qos_cnt * sizeof(struct qcom_scm_camera_qos);
+
+	/* fill all required qos settings */
+	if (use_case_id && payload_size && cam_qos) {
+		payload_buf = dma_alloc_coherent(__scm->dev,
+						 payload_size, &payload_phys, GFP_KERNEL);
+		if (!payload_buf)
+			return -ENOMEM;
+
+		memcpy(payload_buf, cam_qos, payload_size);
+		desc.args[1] = payload_phys;
+		desc.args[2] = payload_size;
+
+	}
+	ret = qcom_scm_call(__scm->dev, &desc, NULL);
+
+	if (payload_buf)
+		dma_free_coherent(__scm->dev, payload_size, payload_buf, payload_phys);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_scm_camera_update_camnoc_qos);
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/qcom_tzmem.c
+++ linux-qcom-6.8.0/drivers/firmware/qcom/qcom_tzmem.c
@@ -0,0 +1,758 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Memory allocator for buffers shared with the TrustZone.
+ *
+ * Copyright (C) 2023-2024 Linaro Ltd.
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "qcom_tzmem: [%d][%s]: " fmt, __LINE__,  __func__
+
+#include <linux/bug.h>
+#include <linux/cleanup.h>
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/firmware/qcom/qcom_tzmem.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <dt-bindings/firmware/qcom,scm.h>
+#include <linux/genalloc.h>
+#include <linux/gfp.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/radix-tree.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/types.h>
+#include <linux/of_platform.h>
+#include <linux/of_reserved_mem.h>
+#include <linux/platform_device.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/device.h>
+
+#include "qcom_tzmem.h"
+
+struct qcom_tzmem_pool {
+	struct gen_pool *genpool;
+	struct list_head areas;
+	enum qcom_tzmem_policy policy;
+	size_t increment;
+	size_t max_size;
+	spinlock_t lock;
+};
+
+struct qcom_tzmem_chunk {
+	phys_addr_t paddr;
+	size_t size;
+	struct qcom_tzmem_pool *owner;
+};
+#define MAXSHMVMS 4
+#define PERM_BITS 3
+#define VM_BITS 16
+#define VMID_NUM_HYP 0
+#define VMID_NUM_HLOS 1
+#define SELF_OWNER_BIT 1
+#define SHM_NUM_VM_SHIFT 9
+#define SHM_VM_MASK 0xFFFF
+#define SHM_PERM_MASK 0x7
+
+#define SHMBRIDGE_E_NOT_SUPPORTED 4	/* SHMbridge is not implemented */
+
+#define AC_ERR_SHARED_MEMORY_SINGLE_SOURCE 15
+
+/* ns_vmids */
+#define UPDATE_NS_VMIDS(ns_vmids, id)	\
+				(((uint64_t)(ns_vmids) << VM_BITS) \
+				| ((uint64_t)(id) & SHM_VM_MASK))
+
+/* ns_perms */
+#define UPDATE_NS_PERMS(ns_perms, perm)	\
+				(((uint64_t)(ns_perms) << PERM_BITS) \
+				| ((uint64_t)(perm) & SHM_PERM_MASK))
+
+/* pfn_and_ns_perm_flags = paddr | ns_perms */
+#define UPDATE_PFN_AND_NS_PERM_FLAGS(paddr, ns_perms)	\
+				((uint64_t)(paddr) | (ns_perms))
+
+
+/* ipfn_and_s_perm_flags = ipaddr | tz_perm */
+#define UPDATE_IPFN_AND_S_PERM_FLAGS(ipaddr, tz_perm)	\
+				((uint64_t)(ipaddr) | (uint64_t)(tz_perm))
+
+/* size_and_flags when dest_vm is not HYP */
+#define UPDATE_SIZE_AND_FLAGS(size, destnum)	\
+				((size) | (destnum) << SHM_NUM_VM_SHIFT)
+
+struct bridge_list {
+	struct list_head head;
+	struct mutex lock;
+};
+
+struct bridge_list_entry {
+	struct list_head list;
+	phys_addr_t paddr;
+	uint64_t handle;
+	int32_t ref_count;
+};
+
+static struct device *qcom_tzmem_dev;
+static RADIX_TREE(qcom_tzmem_chunks, GFP_ATOMIC);
+static DEFINE_SPINLOCK(qcom_tzmem_chunks_lock);
+
+#if IS_ENABLED(CONFIG_QCOM_TZMEM_MODE_GENERIC)
+
+static int qcom_tzmem_init(void)
+{
+	return 0;
+}
+
+static int32_t __qcom_tzmem_register(phys_addr_t paddr, size_t size, uint32_t *ns_vmid_list,
+		uint32_t *ns_vm_perm_list, uint32_t ns_vmid_num, uint32_t tz_perm, uint64_t *handle)
+{
+	return 0;
+}
+
+static int32_t __qcom_tzmem_deregister(uint64_t handle)
+{
+	return 0;
+}
+
+#elif IS_ENABLED(CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE)
+
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/of.h>
+
+#define QCOM_SHM_BRIDGE_NUM_VM_SHIFT 9
+
+static bool qcom_tzmem_using_shm_bridge;
+static struct bridge_list bridge_list_head;
+
+/* List of machines that are known to not support SHM bridge correctly. */
+static const char *const qcom_tzmem_blacklist[] = {
+	"qcom,sc8180x",
+	NULL
+};
+
+static int qcom_tzmem_init(void)
+{
+	const char *const *platform;
+	int ret;
+
+	for (platform = qcom_tzmem_blacklist; *platform; platform++) {
+		if (of_machine_is_compatible(*platform))
+			goto notsupp;
+	}
+
+	ret = qcom_scm_shm_bridge_enable();
+	if (ret == -EOPNOTSUPP)
+		goto notsupp;
+
+	if (!ret)
+		qcom_tzmem_using_shm_bridge = true;
+
+	mutex_init(&bridge_list_head.lock);
+	INIT_LIST_HEAD(&bridge_list_head.head);
+
+	return ret;
+
+notsupp:
+	dev_info(qcom_tzmem_dev, "SHM Bridge not supported\n");
+	return 0;
+}
+
+int qcom_tzmem_init_area(struct qcom_tzmem_area *area)
+{
+	u64 pfn_and_ns_perm, ipfn_and_s_perm, size_and_flags;
+	int ret;
+
+	if (!qcom_tzmem_using_shm_bridge)
+		return 0;
+
+	pfn_and_ns_perm = (u64)area->paddr | QCOM_SCM_PERM_RW;
+	ipfn_and_s_perm = (u64)area->paddr | QCOM_SCM_PERM_RW;
+	size_and_flags = area->size | (1 << QCOM_SHM_BRIDGE_NUM_VM_SHIFT);
+
+	u64 *handle __free(kfree) = kzalloc(sizeof(*handle), GFP_KERNEL);
+	if (!handle)
+		return -ENOMEM;
+
+	ret = qcom_scm_shm_bridge_create(qcom_tzmem_dev, pfn_and_ns_perm,
+					 ipfn_and_s_perm, size_and_flags,
+					 QCOM_SCM_VMID_HLOS, handle);
+	if (ret)
+		return ret;
+
+	area->priv = no_free_ptr(handle);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_init_area);
+
+void qcom_tzmem_cleanup_area(struct qcom_tzmem_area *area)
+{
+	u64 *handle = area->priv;
+
+	if (!qcom_tzmem_using_shm_bridge)
+		return;
+
+	qcom_scm_shm_bridge_delete(qcom_tzmem_dev, *handle);
+	kfree(handle);
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_cleanup_area);
+
+static int32_t qcom_tzmem_list_add_locked(phys_addr_t paddr,
+						uint64_t handle)
+{
+	struct bridge_list_entry *entry;
+
+	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+	if (!entry)
+		return -ENOMEM;
+	entry->handle = handle;
+	entry->paddr = paddr;
+	entry->ref_count = 0;
+
+	list_add_tail(&entry->list, &bridge_list_head.head);
+	return 0;
+}
+
+static void qcom_tzmem_list_del_locked(uint64_t handle)
+{
+	struct bridge_list_entry *entry;
+
+	list_for_each_entry(entry, &bridge_list_head.head, list) {
+		if (entry->handle == handle) {
+			list_del(&entry->list);
+			kfree(entry);
+			break;
+		}
+	}
+}
+
+/**
+ * qcom_tzmem_list_dec_refcount_locked: Decrement the reference count of
+ *					registered shmbridge and if refcount reached to zero delete
+ *					the shmbridge (i.e send a scm call to tz and remove that
+ *					from out local list too.
+ *					API suppose to be called in a locked enviorment.
+ *
+ * Return 0 in case of success else error code in case of failure
+ */
+static int32_t qcom_tzmem_list_dec_refcount_locked(uint64_t handle)
+{
+	struct bridge_list_entry *entry;
+	int32_t ret = -EINVAL;
+
+	list_for_each_entry(entry, &bridge_list_head.head, list)
+		if (entry->handle == handle) {
+
+			if (entry->ref_count > 0) {
+				/* decrement reference count */
+				entry->ref_count--;
+				pr_debug("bridge on %lld exists decrease refcount :%d\n",
+						handle, entry->ref_count);
+
+				if (entry->ref_count == 0) {
+				/* All valid reference are freed, it's time to delete the bridge */
+					//ret = qcom_scm_delete_shm_bridge(handle);
+					ret = qcom_scm_shm_bridge_delete(qcom_tzmem_dev, handle);
+					if (ret) {
+						pr_err("Failed to del bridge %lld, ret = %d\n",
+								handle, ret);
+						/* restore reference count in case of failure */
+						entry->ref_count++;
+						goto exit;
+					}
+					qcom_tzmem_list_del_locked(handle);
+				}
+				ret = 0;
+			} else
+				pr_err("ref_count should not be negative handle %lld , refcount: %d\n",
+					 handle, entry->ref_count);
+			break;
+		}
+exit:
+	if (ret == -EINVAL)
+		pr_err("Not able to find bridge handle %lld in map\n", handle);
+
+	return ret;
+}
+
+/**
+ * qcom_tzmem_list_inc_refcount_locked: Increment the ref count in case if
+ *					we try to register a pre-registered phyaddr with shmbridge
+ *					and provide a valid handle to the caller API which was
+ *					passed by caller as a pointer.
+ *					API suppose to be called in a locked enviorment.
+ *
+ * Return 0 in case of success else error code in case of failure.
+ */
+static int32_t qcom_tzmem_list_inc_refcount_locked(phys_addr_t paddr, uint64_t *handle)
+{
+	struct bridge_list_entry *entry;
+	int32_t ret = -EINVAL;
+
+	list_for_each_entry(entry, &bridge_list_head.head, list)
+		if (entry->paddr == paddr) {
+
+			entry->ref_count++;
+			pr_debug("%s: bridge on %llx exists increase refcount :%d\n",
+				__func__, (uint64_t)paddr, entry->ref_count);
+
+			/* update handle in case we found paddr already exist */
+			*handle = entry->handle;
+			ret = 0;
+			break;
+		}
+	if (ret)
+		pr_err("Not able to find bridge paddr %llx in map\n", (uint64_t)paddr);
+	return ret;
+}
+
+static int32_t qcom_tzmem_query_locked(phys_addr_t paddr)
+{
+	struct bridge_list_entry *entry;
+
+	list_for_each_entry(entry, &bridge_list_head.head, list)
+		if (entry->paddr == paddr) {
+			pr_debug("A bridge on %llx exists\n", (uint64_t)paddr);
+			return -EEXIST;
+		}
+	return 0;
+}
+
+/* Register paddr & size as a bridge, return bridge handle */
+static int32_t __qcom_tzmem_register(
+		phys_addr_t paddr,
+		size_t size,
+		uint32_t *ns_vmid_list,
+		uint32_t *ns_vm_perm_list,
+		uint32_t ns_vmid_num,
+		uint32_t tz_perm,
+		uint64_t *handle)
+
+{
+	int32_t ret = 0;
+	uint64_t pfn_and_ns_perm_flags = 0;
+	uint64_t ipfn_and_s_perm_flags = 0;
+	uint64_t size_and_flags = 0;
+	uint64_t ns_perms = 0;
+	uint64_t ns_vmids = 0;
+	int i = 0;
+
+	if (!qcom_tzmem_using_shm_bridge)
+		return 0;
+
+	if (!handle || !ns_vmid_list || !ns_vm_perm_list ||
+				ns_vmid_num > MAXSHMVMS) {
+		pr_err("invalid input parameters\n");
+		return -EINVAL;
+	}
+
+	mutex_lock(&bridge_list_head.lock);
+	ret = qcom_tzmem_query_locked(paddr);
+	if (ret) {
+		pr_debug("found 0%llu already exist with shmbridge\n", paddr);
+		goto bridge_exist;
+	}
+
+	for (i = 0; i < ns_vmid_num; i++) {
+		ns_perms = UPDATE_NS_PERMS(ns_perms, ns_vm_perm_list[i]);
+		ns_vmids = UPDATE_NS_VMIDS(ns_vmids, ns_vmid_list[i]);
+	}
+
+	pfn_and_ns_perm_flags = UPDATE_PFN_AND_NS_PERM_FLAGS(paddr, ns_perms);
+	ipfn_and_s_perm_flags = UPDATE_IPFN_AND_S_PERM_FLAGS(paddr, tz_perm);
+	size_and_flags = UPDATE_SIZE_AND_FLAGS(size, ns_vmid_num);
+
+	if (ns_vmid_num == 0) {
+		size_and_flags |= SELF_OWNER_BIT << 1;
+		size_and_flags |= QCOM_SCM_PERM_RW << 2;
+	}
+
+	pr_debug("%s: desc.args[0] %llx, args[1] %llx, args[2] %llx, args[3] %llx\n",
+		__func__, pfn_and_ns_perm_flags, ipfn_and_s_perm_flags,
+		size_and_flags, ns_vmids);
+
+	ret = qcom_scm_shm_bridge_create(qcom_tzmem_dev, pfn_and_ns_perm_flags,
+			ipfn_and_s_perm_flags, size_and_flags, ns_vmids,
+			handle);
+
+	if (ret) {
+		pr_err("Shm creation failed, ret: %d, NS PA|Perm: 0x%llx, size|flags: 0x%llx, ns_vmids: 0x%llx\n",
+			ret, pfn_and_ns_perm_flags, size_and_flags, ns_vmids);
+
+		/*
+		 * If bridge is already existing and we are not real owner also paddr
+		 * not exist in our map we will add an entry in our map and go for
+		 * deregister for this since QTEE also maintain ref_count. So for this
+		 * we should deregister to decrease ref_count in QTEE.
+		 */
+		if (ret == AC_ERR_SHARED_MEMORY_SINGLE_SOURCE)
+			pr_err("bridge %llu exist but not registered in our map\n", paddr);
+		else {
+			ret = -EINVAL;
+			goto exit;
+		}
+	}
+
+	ret = qcom_tzmem_list_add_locked(paddr, *handle);
+bridge_exist:
+	ret = qcom_tzmem_list_inc_refcount_locked(paddr, handle);
+exit:
+	mutex_unlock(&bridge_list_head.lock);
+	return ret;
+}
+
+/* Deregister bridge */
+static int32_t __qcom_tzmem_deregister(uint64_t handle)
+{
+	int32_t ret = 0;
+
+	if (!qcom_tzmem_using_shm_bridge)
+		return 0;
+
+	mutex_lock(&bridge_list_head.lock);
+	ret = qcom_tzmem_list_dec_refcount_locked(handle);
+	mutex_unlock(&bridge_list_head.lock);
+
+	return ret;
+}
+
+#endif /* CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE */
+
+int32_t qcom_tzmem_register(phys_addr_t paddr, size_t size, uint32_t *ns_vmid_list,
+		uint32_t *ns_vm_perm_list, uint32_t ns_vmid_num, uint32_t tz_perm, uint64_t *handle)
+{
+	return __qcom_tzmem_register(paddr, size, ns_vmid_list, ns_vm_perm_list,
+			ns_vmid_num, tz_perm, handle);
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_register);
+
+int32_t qcom_tzmem_deregister(uint64_t handle)
+{
+	return __qcom_tzmem_deregister(handle);
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_deregister);
+
+static int qcom_tzmem_pool_add_memory(struct qcom_tzmem_pool *pool,
+				      size_t size, gfp_t gfp)
+{
+	int ret;
+
+	struct qcom_tzmem_area *area __free(kfree) = kzalloc(sizeof(*area),
+							     gfp);
+	if (!area)
+		return -ENOMEM;
+
+	area->size = PAGE_ALIGN(size);
+
+	area->vaddr = dma_alloc_coherent(qcom_tzmem_dev, area->size,
+					 &area->paddr, gfp);
+	if (!area->vaddr)
+		return -ENOMEM;
+
+	ret = qcom_tzmem_init_area(area);
+	if (ret) {
+		dma_free_coherent(qcom_tzmem_dev, area->size,
+				  area->vaddr, area->paddr);
+		return ret;
+	}
+
+	ret = gen_pool_add_virt(pool->genpool, (unsigned long)area->vaddr,
+				(phys_addr_t)area->paddr, size, -1);
+	if (ret) {
+		dma_free_coherent(qcom_tzmem_dev, area->size,
+				  area->vaddr, area->paddr);
+		return ret;
+	}
+
+	scoped_guard(spinlock_irqsave, &pool->lock)
+		list_add_tail(&area->list, &pool->areas);
+
+	area = NULL;
+	return 0;
+}
+
+/**
+ * qcom_tzmem_pool_new() - Create a new TZ memory pool.
+ * @config: Pool configuration.
+ *
+ * Create a new pool of memory suitable for sharing with the TrustZone.
+ *
+ * Must not be used in atomic context.
+ *
+ * Return: New memory pool address or ERR_PTR() on error.
+ */
+struct qcom_tzmem_pool *
+qcom_tzmem_pool_new(const struct qcom_tzmem_pool_config *config)
+{
+	int ret = -ENOMEM;
+
+	might_sleep();
+
+	switch (config->policy) {
+	case QCOM_TZMEM_POLICY_STATIC:
+		if (!config->initial_size)
+			return ERR_PTR(-EINVAL);
+		break;
+	case QCOM_TZMEM_POLICY_MULTIPLIER:
+		if (!config->increment)
+			return ERR_PTR(-EINVAL);
+		break;
+	case QCOM_TZMEM_POLICY_ON_DEMAND:
+		break;
+	default:
+		return ERR_PTR(-EINVAL);
+	}
+
+	struct qcom_tzmem_pool *pool __free(kfree) = kzalloc(sizeof(*pool),
+							     GFP_KERNEL);
+	if (!pool)
+		return ERR_PTR(-ENOMEM);
+
+	pool->genpool = gen_pool_create(PAGE_SHIFT, -1);
+	if (!pool->genpool)
+		return ERR_PTR(-ENOMEM);
+
+	gen_pool_set_algo(pool->genpool, gen_pool_best_fit, NULL);
+
+	pool->policy = config->policy;
+	pool->increment = config->increment;
+	pool->max_size = config->max_size;
+	INIT_LIST_HEAD(&pool->areas);
+	spin_lock_init(&pool->lock);
+
+	if (config->initial_size) {
+		ret = qcom_tzmem_pool_add_memory(pool, config->initial_size,
+						 GFP_KERNEL);
+		if (ret) {
+			gen_pool_destroy(pool->genpool);
+			return ERR_PTR(ret);
+		}
+	}
+
+	return_ptr(pool);
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_pool_new);
+
+/**
+ * qcom_tzmem_pool_free() - Destroy a TZ memory pool and free all resources.
+ * @pool: Memory pool to free.
+ *
+ * Must not be called if any of the allocated chunks has not been freed.
+ * Must not be used in atomic context.
+ */
+void qcom_tzmem_pool_free(struct qcom_tzmem_pool *pool)
+{
+	struct qcom_tzmem_area *area, *next;
+	struct qcom_tzmem_chunk *chunk;
+	struct radix_tree_iter iter;
+	bool non_empty = false;
+	void __rcu **slot;
+
+	might_sleep();
+
+	if (!pool)
+		return;
+
+	scoped_guard(spinlock_irqsave, &qcom_tzmem_chunks_lock) {
+		radix_tree_for_each_slot(slot, &qcom_tzmem_chunks, &iter, 0) {
+			chunk = radix_tree_deref_slot_protected(slot,
+						&qcom_tzmem_chunks_lock);
+
+			if (chunk->owner == pool)
+				non_empty = true;
+		}
+	}
+
+	WARN(non_empty, "Freeing TZ memory pool with memory still allocated");
+
+	list_for_each_entry_safe(area, next, &pool->areas, list) {
+		list_del(&area->list);
+		qcom_tzmem_cleanup_area(area);
+		dma_free_coherent(qcom_tzmem_dev, area->size,
+				  area->vaddr, area->paddr);
+		kfree(area);
+	}
+
+	gen_pool_destroy(pool->genpool);
+	kfree(pool);
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_pool_free);
+
+static void devm_qcom_tzmem_pool_free(void *data)
+{
+	struct qcom_tzmem_pool *pool = data;
+
+	qcom_tzmem_pool_free(pool);
+}
+
+/**
+ * devm_qcom_tzmem_pool_new() - Managed variant of qcom_tzmem_pool_new().
+ * @dev: Device managing this resource.
+ * @config: Pool configuration.
+ *
+ * Must not be used in atomic context.
+ *
+ * Return: Address of the managed pool or ERR_PTR() on failure.
+ */
+struct qcom_tzmem_pool *
+devm_qcom_tzmem_pool_new(struct device *dev,
+			 const struct qcom_tzmem_pool_config *config)
+{
+	struct qcom_tzmem_pool *pool;
+	int ret;
+
+	pool = qcom_tzmem_pool_new(config);
+	if (IS_ERR(pool))
+		return pool;
+
+	ret = devm_add_action_or_reset(dev, devm_qcom_tzmem_pool_free, pool);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return pool;
+}
+EXPORT_SYMBOL_GPL(devm_qcom_tzmem_pool_new);
+
+static bool qcom_tzmem_try_grow_pool(struct qcom_tzmem_pool *pool,
+				     size_t requested, gfp_t gfp)
+{
+	size_t current_size = gen_pool_size(pool->genpool);
+
+	if (pool->max_size && (current_size + requested) > pool->max_size)
+		return false;
+
+	switch (pool->policy) {
+	case QCOM_TZMEM_POLICY_STATIC:
+		return false;
+	case QCOM_TZMEM_POLICY_MULTIPLIER:
+		requested = current_size * pool->increment;
+		break;
+	case QCOM_TZMEM_POLICY_ON_DEMAND:
+		break;
+	}
+
+	return !qcom_tzmem_pool_add_memory(pool, requested, gfp);
+}
+
+/**
+ * qcom_tzmem_alloc() - Allocate a memory chunk suitable for sharing with TZ.
+ * @pool: TZ memory pool from which to allocate memory.
+ * @size: Number of bytes to allocate.
+ * @gfp: GFP flags.
+ *
+ * Can be used in any context.
+ *
+ * Return:
+ * Address of the allocated buffer or NULL if no more memory can be allocated.
+ * The buffer must be released using qcom_tzmem_free().
+ */
+void *qcom_tzmem_alloc(struct qcom_tzmem_pool *pool, size_t size, gfp_t gfp)
+{
+	unsigned long vaddr;
+	int ret;
+
+	if (!size)
+		return NULL;
+
+	size = PAGE_ALIGN(size);
+
+	struct qcom_tzmem_chunk *chunk __free(kfree) = kzalloc(sizeof(*chunk),
+							       gfp);
+	if (!chunk)
+		return NULL;
+
+again:
+	vaddr = gen_pool_alloc(pool->genpool, size);
+	if (!vaddr) {
+		if (qcom_tzmem_try_grow_pool(pool, size, gfp))
+			goto again;
+
+		return NULL;
+	}
+
+	chunk->paddr = gen_pool_virt_to_phys(pool->genpool, vaddr);
+	chunk->size = size;
+	chunk->owner = pool;
+
+	scoped_guard(spinlock_irqsave, &qcom_tzmem_chunks_lock) {
+		ret = radix_tree_insert(&qcom_tzmem_chunks, vaddr, chunk);
+		if (ret) {
+			gen_pool_free(pool->genpool, vaddr, size);
+			return NULL;
+		}
+
+		chunk = NULL;
+	}
+
+	return (void *)vaddr;
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_alloc);
+
+/**
+ * qcom_tzmem_free() - Release a buffer allocated from a TZ memory pool.
+ * @vaddr: Virtual address of the buffer.
+ *
+ * Can be used in any context.
+ */
+void qcom_tzmem_free(void *vaddr)
+{
+	struct qcom_tzmem_chunk *chunk;
+
+	scoped_guard(spinlock_irqsave, &qcom_tzmem_chunks_lock)
+		chunk = radix_tree_delete_item(&qcom_tzmem_chunks,
+					       (unsigned long)vaddr, NULL);
+
+	if (!chunk) {
+		WARN(1, "Virtual address %p not owned by TZ memory allocator",
+		     vaddr);
+		return;
+	}
+
+	scoped_guard(spinlock_irqsave, &chunk->owner->lock)
+		gen_pool_free(chunk->owner->genpool, (unsigned long)vaddr,
+			      chunk->size);
+	kfree(chunk);
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_free);
+
+/**
+ * qcom_tzmem_to_phys() - Map the virtual address of a TZ buffer to physical.
+ * @vaddr: Virtual address of the buffer allocated from a TZ memory pool.
+ *
+ * Can be used in any context. The address must have been returned by a call
+ * to qcom_tzmem_alloc().
+ *
+ * Returns: Physical address of the buffer.
+ */
+phys_addr_t qcom_tzmem_to_phys(void *vaddr)
+{
+	struct qcom_tzmem_chunk *chunk;
+
+	guard(spinlock_irqsave)(&qcom_tzmem_chunks_lock);
+
+	chunk = radix_tree_lookup(&qcom_tzmem_chunks, (unsigned long)vaddr);
+	if (!chunk)
+		return 0;
+
+	return chunk->paddr;
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_to_phys);
+
+int qcom_tzmem_enable(struct device *dev)
+{
+	if (qcom_tzmem_dev)
+		return -EBUSY;
+
+	qcom_tzmem_dev = dev;
+
+	return qcom_tzmem_init();
+}
+EXPORT_SYMBOL_GPL(qcom_tzmem_enable);
+
+MODULE_DESCRIPTION("TrustZone memory allocator for Qualcomm firmware drivers");
+MODULE_AUTHOR("Bartosz Golaszewski <bartosz.golaszewski@linaro.org>");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/qcom_tzmem.h
+++ linux-qcom-6.8.0/drivers/firmware/qcom/qcom_tzmem.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2023-2024 Linaro Ltd.
+ */
+
+#ifndef __QCOM_TZMEM_PRIV_H
+#define __QCOM_TZMEM_PRIV_H
+
+struct device;
+
+int qcom_tzmem_enable(struct device *dev);
+
+#endif /* __QCOM_TZMEM_PRIV_H */
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/qtee_shmbridge.c
+++ linux-qcom-6.8.0/drivers/firmware/qcom/qtee_shmbridge.c
@@ -0,0 +1,669 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * QTI TEE shared memory bridge driver
+ *
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "shmbridge: [%d][%s]: " fmt, __LINE__,  __func__
+
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/genalloc.h>
+#include <linux/platform_device.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_platform.h>
+#include <linux/of_reserved_mem.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/dma-mapping.h>
+#include <linux/qtee_shmbridge.h>
+#include <linux/of_platform.h>
+
+#define DEFAULT_BRIDGE_SIZE	SZ_4M	/*4M*/
+#define MIN_BRIDGE_SIZE		SZ_4K   /*4K*/
+
+#define MAXSHMVMS 4
+#define PERM_BITS 3
+#define VM_BITS 16
+#define VMID_NUM_HYP 0
+#define VMID_NUM_HLOS 1
+#define SELF_OWNER_BIT 1
+#define SHM_NUM_VM_SHIFT 9
+#define SHM_VM_MASK 0xFFFF
+#define SHM_PERM_MASK 0x7
+
+#define SHMBRIDGE_E_NOT_SUPPORTED 4	/* SHMbridge is not implemented */
+
+#define AC_ERR_SHARED_MEMORY_SINGLE_SOURCE 15
+
+/* ns_vmids */
+#define UPDATE_NS_VMIDS(ns_vmids, id)	\
+				(((uint64_t)(ns_vmids) << VM_BITS) \
+				| ((uint64_t)(id) & SHM_VM_MASK))
+
+/* ns_perms */
+#define UPDATE_NS_PERMS(ns_perms, perm)	\
+				(((uint64_t)(ns_perms) << PERM_BITS) \
+				| ((uint64_t)(perm) & SHM_PERM_MASK))
+
+/* pfn_and_ns_perm_flags = paddr | ns_perms */
+#define UPDATE_PFN_AND_NS_PERM_FLAGS(paddr, ns_perms)	\
+				((uint64_t)(paddr) | (ns_perms))
+
+
+/* ipfn_and_s_perm_flags = ipaddr | tz_perm */
+#define UPDATE_IPFN_AND_S_PERM_FLAGS(ipaddr, tz_perm)	\
+				((uint64_t)(ipaddr) | (uint64_t)(tz_perm))
+
+/* size_and_flags when dest_vm is not HYP */
+#define UPDATE_SIZE_AND_FLAGS(size, destnum)	\
+				((size) | (destnum) << SHM_NUM_VM_SHIFT)
+
+struct bridge_info {
+	phys_addr_t paddr;
+	void *vaddr;
+	size_t size;
+	uint64_t handle;
+	int min_alloc_order;
+	struct gen_pool *genpool;
+	struct device *dev;
+};
+
+struct bridge_list {
+	struct list_head head;
+	struct mutex lock;
+};
+
+struct bridge_list_entry {
+	struct list_head list;
+	phys_addr_t paddr;
+	uint64_t handle;
+	int32_t ref_count;
+};
+
+struct cma_heap_bridge_info {
+	uint32_t heapid;
+	uint64_t handle;
+};
+
+enum CMA_HEAP_TYPE {
+	QSEECOM_HEAP = 0,
+	QSEECOM_TA_HEAP,
+	USER_CONTI_HEAP,
+	HEAP_TYPE_MAX
+};
+
+static struct bridge_info default_bridge;
+static struct bridge_info dma_bridge;
+static struct bridge_list bridge_list_head;
+static bool qtee_shmbridge_enabled;
+static bool support_hyp;
+static bool qtee_shmbridge_free_pages_alloc;
+
+/* enable shared memory bridge mechanism in HYP */
+static int32_t qtee_shmbridge_enable(bool enable)
+{
+	int32_t ret = 0;
+
+	qtee_shmbridge_enabled = false;
+
+	/*
+	 * Check property to disable shmbridge mechanism and fallback to default
+	 * hyp based mechanism.
+	 */
+	if (of_property_read_bool(default_bridge.dev->of_node,
+	    "qcom,disable-shmbridge-support")) {
+		return ret;
+	}
+
+	if (!enable) {
+		pr_warn("shmbridge isn't enabled\n");
+		return ret;
+	}
+
+	qtee_shmbridge_enabled = true;
+	pr_info("shmbridge is enabled\n");
+	return ret;
+}
+
+/* Check whether shmbridge mechanism is enabled in HYP or not */
+bool qtee_shmbridge_is_enabled(void)
+{
+	return qtee_shmbridge_enabled;
+}
+EXPORT_SYMBOL_GPL(qtee_shmbridge_is_enabled);
+
+static int32_t qtee_shmbridge_list_add_locked(phys_addr_t paddr,
+						uint64_t handle)
+{
+	struct bridge_list_entry *entry;
+
+	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+	if (!entry)
+		return -ENOMEM;
+	entry->handle = handle;
+	entry->paddr = paddr;
+	entry->ref_count = 0;
+
+	list_add_tail(&entry->list, &bridge_list_head.head);
+	return 0;
+}
+
+static void qtee_shmbridge_list_del_locked(uint64_t handle)
+{
+	struct bridge_list_entry *entry;
+
+	list_for_each_entry(entry, &bridge_list_head.head, list) {
+		if (entry->handle == handle) {
+			list_del(&entry->list);
+			kfree(entry);
+			break;
+		}
+	}
+}
+
+/**
+ * qtee_shmbridge_list_dec_refcount_locked: Decrement the reference count of
+ *					registered shmbridge and if refcount reached to zero delete
+ *					the shmbridge (i.e send a scm call to tz and remove that
+ *					from out local list too.
+ *					API suppose to be called in a locked enviorment.
+ *
+ * Return 0 in case of success else error code in case of failure
+ */
+static int32_t qtee_shmbridge_list_dec_refcount_locked(uint64_t handle)
+{
+	struct bridge_list_entry *entry;
+	int32_t ret = -EINVAL;
+
+	list_for_each_entry(entry, &bridge_list_head.head, list)
+		if (entry->handle == handle) {
+
+			if (entry->ref_count > 0) {
+				/* decrement reference count */
+				entry->ref_count--;
+				pr_debug("bridge on %lld exists decrease refcount :%d\n",
+						handle, entry->ref_count);
+
+				if (entry->ref_count == 0) {
+				/* All valid reference are freed, it's time to delete the bridge */
+					ret = qcom_scm_delete_shm_bridge(handle);
+					if (ret) {
+						pr_err("Failed to del bridge %lld, ret = %d\n",
+								handle, ret);
+						/* restore reference count in case of failure */
+						entry->ref_count++;
+						goto exit;
+					}
+					qtee_shmbridge_list_del_locked(handle);
+				}
+				ret = 0;
+			} else
+				pr_err("ref_count should not be negative handle %lld , refcount: %d\n",
+					 handle, entry->ref_count);
+			break;
+		}
+exit:
+	if (ret == -EINVAL)
+		pr_err("Not able to find bridge handle %lld in map\n", handle);
+
+	return ret;
+}
+
+/**
+ * qtee_shmbridge_list_inc_refcount_locked: Increment the ref count in case if
+ *					we try to register a pre-registered phyaddr with shmbridge
+ *					and provide a valid handle to the caller API which was
+ *					passed by caller as a pointer.
+ *					API suppose to be called in a locked enviorment.
+ *
+ * Return 0 in case of success else error code in case of failure.
+ */
+static int32_t qtee_shmbridge_list_inc_refcount_locked(phys_addr_t paddr, uint64_t *handle)
+{
+	struct bridge_list_entry *entry;
+	int32_t ret = -EINVAL;
+
+	list_for_each_entry(entry, &bridge_list_head.head, list)
+		if (entry->paddr == paddr) {
+
+			entry->ref_count++;
+			pr_debug("%s: bridge on %llx exists increase refcount :%d\n",
+				__func__, (uint64_t)paddr, entry->ref_count);
+
+			/* update handle in case we found paddr already exist */
+			*handle = entry->handle;
+			ret = 0;
+			break;
+		}
+	if (ret)
+		pr_err("Not able to find bridge paddr %llx in map\n", (uint64_t)paddr);
+	return ret;
+}
+
+static int32_t qtee_shmbridge_query_locked(phys_addr_t paddr)
+{
+	struct bridge_list_entry *entry;
+
+	list_for_each_entry(entry, &bridge_list_head.head, list)
+		if (entry->paddr == paddr) {
+			pr_debug("A bridge on %llx exists\n", (uint64_t)paddr);
+			return -EEXIST;
+		}
+	return 0;
+}
+
+/* Check whether a bridge starting from paddr exists */
+int32_t qtee_shmbridge_query(phys_addr_t paddr)
+{
+	int32_t ret = 0;
+
+	mutex_lock(&bridge_list_head.lock);
+	ret = qtee_shmbridge_query_locked(paddr);
+	mutex_unlock(&bridge_list_head.lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qtee_shmbridge_query);
+
+/* Register paddr & size as a bridge, return bridge handle */
+int32_t qtee_shmbridge_register(
+		phys_addr_t paddr,
+		size_t size,
+		uint32_t *ns_vmid_list,
+		uint32_t *ns_vm_perm_list,
+		uint32_t ns_vmid_num,
+		uint32_t tz_perm,
+		uint64_t *handle)
+
+{
+	int32_t ret = 0;
+	uint64_t pfn_and_ns_perm_flags = 0;
+	uint64_t ipfn_and_s_perm_flags = 0;
+	uint64_t size_and_flags = 0;
+	uint64_t ns_perms = 0;
+	uint64_t ns_vmids = 0;
+	int i = 0;
+
+	if (!qtee_shmbridge_enabled)
+		return 0;
+
+	if (!handle || !ns_vmid_list || !ns_vm_perm_list ||
+				ns_vmid_num > MAXSHMVMS) {
+		pr_err("invalid input parameters\n");
+		return -EINVAL;
+	}
+
+	mutex_lock(&bridge_list_head.lock);
+	ret = qtee_shmbridge_query_locked(paddr);
+	if (ret) {
+		pr_debug("found 0%llu already exist with shmbridge\n", paddr);
+		goto bridge_exist;
+	}
+
+	for (i = 0; i < ns_vmid_num; i++) {
+		ns_perms = UPDATE_NS_PERMS(ns_perms, ns_vm_perm_list[i]);
+		ns_vmids = UPDATE_NS_VMIDS(ns_vmids, ns_vmid_list[i]);
+	}
+
+	pfn_and_ns_perm_flags = UPDATE_PFN_AND_NS_PERM_FLAGS(paddr, ns_perms);
+	ipfn_and_s_perm_flags = UPDATE_IPFN_AND_S_PERM_FLAGS(paddr, tz_perm);
+	size_and_flags = UPDATE_SIZE_AND_FLAGS(size, ns_vmid_num);
+
+	if (support_hyp) {
+		size_and_flags |= SELF_OWNER_BIT << 1;
+		size_and_flags |= QCOM_SCM_PERM_RW << 2;
+	}
+
+	pr_debug("%s: desc.args[0] %llx, args[1] %llx, args[2] %llx, args[3] %llx\n",
+		__func__, pfn_and_ns_perm_flags, ipfn_and_s_perm_flags,
+		size_and_flags, ns_vmids);
+
+	ret = qcom_scm_create_shm_bridge(pfn_and_ns_perm_flags,
+			ipfn_and_s_perm_flags, size_and_flags, ns_vmids,
+			handle);
+
+	if (ret) {
+		pr_err("Shm creation failed, ret: %d, NS PA|Perm: 0x%llx, size|flags: 0x%llx, ns_vmids: 0x%llx\n",
+			ret, pfn_and_ns_perm_flags, size_and_flags, ns_vmids);
+
+		/*
+		 * If bridge is already existing and we are not real owner also paddr
+		 * not exist in our map we will add an entry in our map and go for
+		 * deregister for this since QTEE also maintain ref_count. So for this
+		 * we should deregister to decrease ref_count in QTEE.
+		 */
+		if (ret == AC_ERR_SHARED_MEMORY_SINGLE_SOURCE)
+			pr_err("bridge %llu exist but not registered in our map\n", paddr);
+		else {
+			ret = -EINVAL;
+			goto exit;
+		}
+	}
+
+	ret = qtee_shmbridge_list_add_locked(paddr, *handle);
+bridge_exist:
+	ret = qtee_shmbridge_list_inc_refcount_locked(paddr, handle);
+exit:
+	mutex_unlock(&bridge_list_head.lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qtee_shmbridge_register);
+
+/* Deregister bridge */
+int32_t qtee_shmbridge_deregister(uint64_t handle)
+{
+	int32_t ret = 0;
+
+	if (!qtee_shmbridge_enabled)
+		return 0;
+
+	mutex_lock(&bridge_list_head.lock);
+	ret = qtee_shmbridge_list_dec_refcount_locked(handle);
+	mutex_unlock(&bridge_list_head.lock);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qtee_shmbridge_deregister);
+
+
+/* Sub-allocate from default kernel bridge created by shmb driver */
+int32_t qtee_shmbridge_allocate_shm(size_t size, struct qtee_shm *shm)
+{
+	int32_t ret = 0;
+	unsigned long va;
+
+	if (IS_ERR_OR_NULL(shm)) {
+		pr_err("qtee_shm is NULL\n");
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	if (size > default_bridge.size) {
+		pr_err("requestd size %zu is larger than bridge size %zu\n",
+			size, default_bridge.size);
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	if (!default_bridge.genpool) {
+		pr_err("Shmbridge pool not available!\n");
+		ret = -ENOMEM;
+		goto exit;
+	}
+
+	size = roundup(size, 1 << default_bridge.min_alloc_order);
+
+	va = gen_pool_alloc(default_bridge.genpool, size);
+	if (!va) {
+		pr_err("failed to sub-allocate %zu bytes from bridge\n", size);
+		ret = -ENOMEM;
+		goto exit;
+	}
+
+	memset((void *)va, 0, size);
+	shm->vaddr = (void *)va;
+	shm->paddr = gen_pool_virt_to_phys(default_bridge.genpool, va);
+	shm->size = size;
+
+	pr_debug("%s: shm->paddr %llx, size %zu\n",
+			__func__, (uint64_t)shm->paddr, shm->size);
+
+exit:
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qtee_shmbridge_allocate_shm);
+
+
+/* Free buffer that is sub-allocated from default kernel bridge */
+void qtee_shmbridge_free_shm(struct qtee_shm *shm)
+{
+	if (IS_ERR_OR_NULL(shm) || !shm->vaddr)
+		return;
+	gen_pool_free(default_bridge.genpool, (unsigned long)shm->vaddr,
+		      shm->size);
+}
+EXPORT_SYMBOL_GPL(qtee_shmbridge_free_shm);
+
+/* cache clean operation for buffer sub-allocated from default bridge */
+void qtee_shmbridge_flush_shm_buf(struct qtee_shm *shm)
+{
+	if (shm)
+		return dma_sync_single_for_device(default_bridge.dev,
+				shm->paddr, shm->size, DMA_TO_DEVICE);
+}
+EXPORT_SYMBOL_GPL(qtee_shmbridge_flush_shm_buf);
+
+/* cache invalidation operation for buffer sub-allocated from default bridge */
+void qtee_shmbridge_inv_shm_buf(struct qtee_shm *shm)
+{
+	if (shm)
+		return dma_sync_single_for_cpu(default_bridge.dev,
+				shm->paddr, shm->size, DMA_FROM_DEVICE);
+}
+EXPORT_SYMBOL_GPL(qtee_shmbridge_inv_shm_buf);
+
+/*
+ * shared memory bridge initialization
+ *
+ */
+static int qtee_shmbridge_init(struct platform_device *pdev)
+{
+	int ret = 0;
+	uint32_t custom_bridge_size, ns_vm_nums;
+	uint32_t *ns_vm_ids;
+	uint32_t ns_vm_ids_hlos[] = {QCOM_SCM_VMID_HLOS};
+	uint32_t ns_vm_ids_hyp[] = {};
+	uint32_t ns_vm_perms[] = {QCOM_SCM_PERM_RW};
+	struct device_node *mem_node;
+	struct reserved_mem *rmem;
+
+	support_hyp = of_property_read_bool((&pdev->dev)->of_node,
+			"qcom,support-hypervisor");
+	if (support_hyp) {
+		ns_vm_ids = ns_vm_ids_hyp;
+		ns_vm_nums = VMID_NUM_HYP;
+	} else {
+		ns_vm_ids = ns_vm_ids_hlos;
+		ns_vm_nums = VMID_NUM_HLOS;
+	}
+
+	if (default_bridge.vaddr) {
+		pr_err("qtee shmbridge is already initialized\n");
+		return 0;
+	}
+
+	ret = of_property_read_u32((&pdev->dev)->of_node,
+		"qcom,custom-bridge-size", &custom_bridge_size);
+	if (ret)
+		default_bridge.size = DEFAULT_BRIDGE_SIZE;
+	else
+		default_bridge.size = custom_bridge_size * MIN_BRIDGE_SIZE;
+
+	pr_info("qtee shmbridge registered default bridge with size %zu bytes\n",
+		default_bridge.size);
+
+	/*
+	 * First try to allocate memory via free_pages speciying DMA capabilities
+	 * as 32bit(GFP_DMA32) by default as _scm->dev is also based on 32bit.
+	 *
+	 * In case of failures, try to allocate with dma_alloc_coherent.
+	 */
+	default_bridge.vaddr = (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|GFP_DMA32,
+				get_order(default_bridge.size));
+
+	if (default_bridge.vaddr) {
+		default_bridge.paddr = dma_map_single(&pdev->dev,
+				default_bridge.vaddr, default_bridge.size,
+				DMA_TO_DEVICE);
+		if (dma_mapping_error(&pdev->dev, default_bridge.paddr)) {
+			pr_err("dma_map_single() failed\n");
+			ret = -ENOMEM;
+			goto exit_freebuf;
+		}
+		qtee_shmbridge_free_pages_alloc = true;
+	} else {
+		pr_info("Allocation via free_pages failed, trying with dma_alloc now..\n");
+		default_bridge.vaddr = dma_alloc_coherent(&pdev->dev, default_bridge.size,
+								&default_bridge.paddr, GFP_KERNEL);
+		if (!default_bridge.vaddr)
+			return -ENOMEM;
+	}
+	default_bridge.dev = &pdev->dev;
+
+	/* create a general mem pool */
+	default_bridge.min_alloc_order = PAGE_SHIFT; /* 4K page size aligned */
+	default_bridge.genpool = gen_pool_create(
+					default_bridge.min_alloc_order, -1);
+	if (!default_bridge.genpool) {
+		pr_err("gen_pool_add_virt() failed\n");
+		ret = -ENOMEM;
+		goto exit_unmap;
+	}
+
+	gen_pool_set_algo(default_bridge.genpool, gen_pool_best_fit, NULL);
+	ret = gen_pool_add_virt(default_bridge.genpool,
+			(uintptr_t)default_bridge.vaddr,
+				default_bridge.paddr, default_bridge.size, -1);
+	if (ret) {
+		pr_err("gen_pool_add_virt() failed, ret = %d\n", ret);
+		goto exit_destroy_pool;
+	}
+
+	mutex_init(&bridge_list_head.lock);
+	INIT_LIST_HEAD(&bridge_list_head.head);
+
+	/* temporarily disable shm bridge mechanism */
+	ret = qtee_shmbridge_enable(true);
+	if (ret) {
+		/* keep the mem pool and return if failed to enable bridge */
+		ret = 0;
+		goto exit;
+	}
+
+	/*register default bridge*/
+	ret = qtee_shmbridge_register(default_bridge.paddr,
+			default_bridge.size, ns_vm_ids,
+			ns_vm_perms, ns_vm_nums, QCOM_SCM_PERM_RW,
+			&default_bridge.handle);
+
+	if (ret) {
+		pr_err("Failed to register default bridge, size %zu\n",
+			default_bridge.size);
+		goto exit_deregister_default_bridge;
+	}
+
+	pr_debug("qtee shmbridge registered default bridge with size %zu bytes\n",
+			default_bridge.size);
+
+	mem_node = of_parse_phandle((&pdev->dev)->of_node, "memory-region", 0);
+	if (!mem_node) {
+		pr_info("%s: Could not parse memory region for DMA bridge, skipping\n", __func__);
+		goto exit_success;
+	}
+
+	rmem = of_reserved_mem_lookup(mem_node);
+	of_node_put(mem_node);
+	if (!rmem) {
+		pr_info("%s: Failed to get memory-region node, skipping\n", __func__);
+		goto exit_success;
+	}
+
+	dma_bridge.paddr = rmem->base;
+	dma_bridge.size = rmem->size;
+
+	/* register dma_bridge */
+	ret = qtee_shmbridge_register(dma_bridge.paddr,
+			dma_bridge.size, ns_vm_ids,
+			ns_vm_perms, ns_vm_nums, QCOM_SCM_PERM_RW,
+			&dma_bridge.handle);
+
+	if (ret) {
+		pr_err("Failed to register dma bridge, size %zu\n",
+			dma_bridge.size);
+		goto exit_deregister_dma_bridge;
+	}
+
+exit_success:
+	return 0;
+
+exit_deregister_dma_bridge:
+	qtee_shmbridge_deregister(dma_bridge.handle);
+exit_deregister_default_bridge:
+	qtee_shmbridge_deregister(default_bridge.handle);
+	qtee_shmbridge_enable(false);
+exit_destroy_pool:
+	gen_pool_destroy(default_bridge.genpool);
+exit_unmap:
+	if (qtee_shmbridge_free_pages_alloc)
+		dma_unmap_single(&pdev->dev, default_bridge.paddr, default_bridge.size,
+			DMA_TO_DEVICE);
+exit_freebuf:
+	if (qtee_shmbridge_free_pages_alloc)
+		free_pages((long)default_bridge.vaddr, get_order(default_bridge.size));
+	else
+		dma_free_coherent(&pdev->dev, default_bridge.size,
+			default_bridge.vaddr, default_bridge.paddr);
+
+	default_bridge.vaddr = NULL;
+exit:
+	return ret;
+}
+
+static int qtee_shmbridge_probe(struct platform_device *pdev)
+{
+	/* Defer if qcom_scm is not available */
+	if (!qcom_scm_is_available())
+		return dev_err_probe(&pdev->dev, -EPROBE_DEFER, "qcom_scm is not up!\n");
+
+	return qtee_shmbridge_init(pdev);
+}
+
+static int qtee_shmbridge_remove(struct platform_device *pdev)
+{
+	qtee_shmbridge_deregister(default_bridge.handle);
+	gen_pool_destroy(default_bridge.genpool);
+	if (qtee_shmbridge_free_pages_alloc) {
+		dma_unmap_single(&pdev->dev, default_bridge.paddr, default_bridge.size,
+			DMA_TO_DEVICE);
+		free_pages((long)default_bridge.vaddr, get_order(default_bridge.size));
+	} else {
+		dma_free_coherent(&pdev->dev, default_bridge.size,
+			default_bridge.vaddr, default_bridge.paddr);
+	}
+	return 0;
+}
+
+static const struct of_device_id qtee_shmbridge_of_match[] = {
+	{ .compatible = "qcom,tee-shared-memory-bridge"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, qtee_shmbridge_of_match);
+
+static struct platform_driver qtee_shmbridge_driver = {
+	.probe = qtee_shmbridge_probe,
+	.remove = qtee_shmbridge_remove,
+	.driver = {
+		.name = "shared_memory_bridge",
+		.of_match_table = qtee_shmbridge_of_match,
+	},
+};
+
+static int __init qtee_shmbridge_driver_init(void)
+{
+	return platform_driver_register(&qtee_shmbridge_driver);
+}
+/*
+ * Keep shmbridge init level same as qcom_scm so that it's available after
+ * qcom_scm and well before loading other dependent modules.
+ */
+subsys_initcall(qtee_shmbridge_driver_init);
+
+static void __exit qtee_shmbridge_driver_exit(void)
+{
+	platform_driver_unregister(&qtee_shmbridge_driver);
+}
+module_exit(qtee_shmbridge_driver_exit);
+
+MODULE_DESCRIPTION("Qualcomm Technologies, Inc. SHM Bridge driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/firmware/qcom/tz_log.c
+++ linux-qcom-6.8.0/drivers/firmware/qcom/tz_log.c
@@ -0,0 +1,2004 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "tz_log:[%s][%d]: " fmt, __func__, __LINE__
+
+#include <linux/debugfs.h>
+#include <linux/errno.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/uaccess.h>
+#include <linux/of.h>
+#include <linux/dma-buf.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/firmware/qcom/qcom_tzmem.h>
+#include <linux/proc_fs.h>
+#include <linux/version.h>
+#if IS_ENABLED(CONFIG_MSM_TMECOM_QMP)
+#include <linux/tmelog.h>
+#endif
+
+
+/* QSEE_LOG_BUF_SIZE = 32K */
+#define QSEE_LOG_BUF_SIZE 0x8000
+
+/* enlarged qsee log buf size is 128K by default */
+#define QSEE_LOG_BUF_SIZE_V2 0x20000
+
+/* Tme log buffer size 20K */
+#define TME_LOG_BUF_SIZE 0x5000
+
+/* TZ Diagnostic Area legacy version number */
+#define TZBSP_DIAG_MAJOR_VERSION_LEGACY	2
+
+/* TZ Diagnostic Area version number */
+#define TZBSP_FVER_MAJOR_MINOR_MASK     0x3FF  /* 10 bits */
+#define TZBSP_FVER_MAJOR_SHIFT          22
+#define TZBSP_FVER_MINOR_SHIFT          12
+#define TZBSP_DIAG_MAJOR_VERSION_V9     9
+#define TZBSP_DIAG_MINOR_VERSION_V2     2
+#define TZBSP_DIAG_MINOR_VERSION_V21    3
+#define TZBSP_DIAG_MINOR_VERSION_V22    4
+
+/* TZ Diag Feature Version Id */
+#define QCOM_SCM_FEAT_DIAG_ID           0x06
+
+/*
+ * Preprocessor Definitions and Constants
+ */
+#define TZBSP_MAX_CPU_COUNT 0x08
+/*
+ * Number of VMID Tables
+ */
+#define TZBSP_DIAG_NUM_OF_VMID 16
+/*
+ * VMID Description length
+ */
+#define TZBSP_DIAG_VMID_DESC_LEN 7
+/*
+ * Number of Interrupts
+ */
+#define TZBSP_DIAG_INT_NUM  32
+/*
+ * Length of descriptive name associated with Interrupt
+ */
+#define TZBSP_MAX_INT_DESC 16
+/*
+ * TZ 3.X version info
+ */
+#define QSEE_VERSION_TZ_3_X 0x800000
+/*
+ * TZ 4.X version info
+ */
+#define QSEE_VERSION_TZ_4_X 0x1000000
+
+#define TZBSP_AES_256_ENCRYPTED_KEY_SIZE 256
+#define TZBSP_NONCE_LEN 12
+#define TZBSP_TAG_LEN 16
+
+#define ENCRYPTED_TZ_LOG_ID 0
+#define ENCRYPTED_QSEE_LOG_ID 1
+
+#define PERM_BITS 3
+#define VM_BITS 16
+
+/*
+ * Directory for TZ DBG logs
+ */
+#define TZDBG_DIR_NAME "tzdbg"
+
+/*
+ * VMID Table
+ */
+struct tzdbg_vmid_t {
+	uint8_t vmid; /* Virtual Machine Identifier */
+	uint8_t desc[TZBSP_DIAG_VMID_DESC_LEN];	/* ASCII Text */
+};
+/*
+ * Boot Info Table
+ */
+struct tzdbg_boot_info_t {
+	uint32_t wb_entry_cnt;	/* Warmboot entry CPU Counter */
+	uint32_t wb_exit_cnt;	/* Warmboot exit CPU Counter */
+	uint32_t pc_entry_cnt;	/* Power Collapse entry CPU Counter */
+	uint32_t pc_exit_cnt;	/* Power Collapse exit CPU counter */
+	uint32_t warm_jmp_addr;	/* Last Warmboot Jump Address */
+	uint32_t spare;	/* Reserved for future use. */
+};
+/*
+ * Boot Info Table for 64-bit
+ */
+struct tzdbg_boot_info64_t {
+	uint32_t wb_entry_cnt;  /* Warmboot entry CPU Counter */
+	uint32_t wb_exit_cnt;   /* Warmboot exit CPU Counter */
+	uint32_t pc_entry_cnt;  /* Power Collapse entry CPU Counter */
+	uint32_t pc_exit_cnt;   /* Power Collapse exit CPU counter */
+	uint32_t psci_entry_cnt;/* PSCI syscall entry CPU Counter */
+	uint32_t psci_exit_cnt;   /* PSCI syscall exit CPU Counter */
+	uint64_t warm_jmp_addr; /* Last Warmboot Jump Address */
+	uint32_t warm_jmp_instr; /* Last Warmboot Jump Address Instruction */
+};
+/*
+ * Reset Info Table
+ */
+struct tzdbg_reset_info_t {
+	uint32_t reset_type;	/* Reset Reason */
+	uint32_t reset_cnt;	/* Number of resets occurred/CPU */
+};
+/*
+ * Interrupt Info Table
+ */
+struct tzdbg_int_t {
+	/*
+	 * Type of Interrupt/exception
+	 */
+	uint16_t int_info;
+	/*
+	 * Availability of the slot
+	 */
+	uint8_t avail;
+	/*
+	 * Reserved for future use
+	 */
+	uint8_t spare;
+	/*
+	 * Interrupt # for IRQ and FIQ
+	 */
+	uint32_t int_num;
+	/*
+	 * ASCII text describing type of interrupt e.g:
+	 * Secure Timer, EBI XPU. This string is always null terminated,
+	 * supporting at most TZBSP_MAX_INT_DESC characters.
+	 * Any additional characters are truncated.
+	 */
+	uint8_t int_desc[TZBSP_MAX_INT_DESC];
+	uint64_t int_count[TZBSP_MAX_CPU_COUNT]; /* # of times seen per CPU */
+};
+
+/*
+ * Interrupt Info Table used in tz version >=4.X
+ */
+struct tzdbg_int_t_tz40 {
+	uint16_t int_info;
+	uint8_t avail;
+	uint8_t spare;
+	uint32_t int_num;
+	uint8_t int_desc[TZBSP_MAX_INT_DESC];
+	uint32_t int_count[TZBSP_MAX_CPU_COUNT]; /* uint32_t in TZ ver >= 4.x*/
+};
+
+/* warm boot reason for cores */
+struct tzbsp_diag_wakeup_info_t {
+	/* Wake source info : APCS_GICC_HPPIR */
+	uint32_t HPPIR;
+	/* Wake source info : APCS_GICC_AHPPIR */
+	uint32_t AHPPIR;
+};
+
+/*
+ * Log ring buffer position
+ */
+struct tzdbg_log_pos_t {
+	uint16_t wrap;
+	uint16_t offset;
+};
+
+struct tzdbg_log_pos_v2_t {
+	uint32_t wrap;
+	uint32_t offset;
+};
+
+ /*
+  * Log ring buffer
+  */
+struct tzdbg_log_t {
+	struct tzdbg_log_pos_t	log_pos;
+	/* open ended array to the end of the 4K IMEM buffer */
+	uint8_t					log_buf[];
+};
+
+struct tzdbg_log_v2_t {
+	struct tzdbg_log_pos_v2_t	log_pos;
+	/* open ended array to the end of the 4K IMEM buffer */
+	uint8_t					log_buf[];
+};
+
+struct tzbsp_encr_info_for_log_chunk_t {
+	uint32_t size_to_encr;
+	uint8_t nonce[TZBSP_NONCE_LEN];
+	uint8_t tag[TZBSP_TAG_LEN];
+};
+
+/*
+ * Only `ENTIRE_LOG` will be used unless the
+ * "OEM_tz_num_of_diag_log_chunks_to_encr" devcfg field >= 2.
+ * If this is true, the diag log will be encrypted in two
+ * separate chunks: a smaller chunk containing only error
+ * fatal logs and a bigger "rest of the log" chunk. In this
+ * case, `ERR_FATAL_LOG_CHUNK` and `BIG_LOG_CHUNK` will be
+ * used instead of `ENTIRE_LOG`.
+ */
+enum tzbsp_encr_info_for_log_chunks_idx_t {
+	BIG_LOG_CHUNK = 0,
+	ENTIRE_LOG = 1,
+	ERR_FATAL_LOG_CHUNK = 1,
+	MAX_NUM_OF_CHUNKS,
+};
+
+struct tzbsp_encr_info_t {
+	uint32_t num_of_chunks;
+	struct tzbsp_encr_info_for_log_chunk_t chunks[MAX_NUM_OF_CHUNKS];
+	uint8_t key[TZBSP_AES_256_ENCRYPTED_KEY_SIZE];
+};
+
+/*
+ * Diagnostic Table
+ * Note: This is the reference data structure for tz diagnostic table
+ * supporting TZBSP_MAX_CPU_COUNT, the real diagnostic data is directly
+ * copied into buffer from i/o memory.
+ */
+struct tzdbg_t {
+	uint32_t magic_num;
+	uint32_t version;
+	/*
+	 * Number of CPU's
+	 */
+	uint32_t cpu_count;
+	/*
+	 * Offset of VMID Table
+	 */
+	uint32_t vmid_info_off;
+	/*
+	 * Offset of Boot Table
+	 */
+	uint32_t boot_info_off;
+	/*
+	 * Offset of Reset info Table
+	 */
+	uint32_t reset_info_off;
+	/*
+	 * Offset of Interrupt info Table
+	 */
+	uint32_t int_info_off;
+	/*
+	 * Ring Buffer Offset
+	 */
+	uint32_t ring_off;
+	/*
+	 * Ring Buffer Length
+	 */
+	uint32_t ring_len;
+
+	/* Offset for Wakeup info */
+	uint32_t wakeup_info_off;
+
+	union {
+		/* The elements in below structure have to be used for TZ where
+		 * diag version = TZBSP_DIAG_MINOR_VERSION_V2
+		 */
+		struct {
+
+			/*
+			 * VMID to EE Mapping
+			 */
+			struct tzdbg_vmid_t vmid_info[TZBSP_DIAG_NUM_OF_VMID];
+			/*
+			 * Boot Info
+			 */
+			struct tzdbg_boot_info_t  boot_info[TZBSP_MAX_CPU_COUNT];
+			/*
+			 * Reset Info
+			 */
+			struct tzdbg_reset_info_t reset_info[TZBSP_MAX_CPU_COUNT];
+			uint32_t num_interrupts;
+			struct tzdbg_int_t  int_info[TZBSP_DIAG_INT_NUM];
+			/* Wake up info */
+			struct tzbsp_diag_wakeup_info_t  wakeup_info[TZBSP_MAX_CPU_COUNT];
+
+			uint8_t key[TZBSP_AES_256_ENCRYPTED_KEY_SIZE];
+
+			uint8_t nonce[TZBSP_NONCE_LEN];
+
+			uint8_t tag[TZBSP_TAG_LEN];
+		};
+		/* The elements in below structure have to be used for TZ where
+		 * diag version = TZBSP_DIAG_MINOR_VERSION_V21
+		 */
+		struct {
+
+			uint32_t encr_info_for_log_off;
+
+			/*
+			 * VMID to EE Mapping
+			 */
+			struct tzdbg_vmid_t vmid_info_v2[TZBSP_DIAG_NUM_OF_VMID];
+			/*
+			 * Boot Info
+			 */
+			struct tzdbg_boot_info_t  boot_info_v2[TZBSP_MAX_CPU_COUNT];
+			/*
+			 * Reset Info
+			 */
+			struct tzdbg_reset_info_t reset_info_v2[TZBSP_MAX_CPU_COUNT];
+			uint32_t num_interrupts_v2;
+			struct tzdbg_int_t  int_info_v2[TZBSP_DIAG_INT_NUM];
+
+			/* Wake up info */
+			struct tzbsp_diag_wakeup_info_t  wakeup_info_v2[TZBSP_MAX_CPU_COUNT];
+
+			struct tzbsp_encr_info_t encr_info_for_log;
+		};
+	};
+
+	/*
+	 * We need at least 2K for the ring buffer
+	 */
+	struct tzdbg_log_t ring_buffer;	/* TZ Ring Buffer */
+};
+
+struct hypdbg_log_pos_t {
+	uint16_t wrap;
+	uint16_t offset;
+};
+
+struct rmdbg_log_hdr_t {
+	uint32_t write_idx;
+	uint32_t size;
+};
+struct rmdbg_log_pos_t {
+	uint32_t read_idx;
+	uint32_t size;
+};
+struct hypdbg_boot_info_t {
+	uint32_t warm_entry_cnt;
+	uint32_t warm_exit_cnt;
+};
+
+struct hypdbg_t {
+	/* Magic Number */
+	uint32_t magic_num;
+
+	/* Number of CPU's */
+	uint32_t cpu_count;
+
+	/* Ring Buffer Offset */
+	uint32_t ring_off;
+
+	/* Ring buffer position mgmt */
+	struct hypdbg_log_pos_t log_pos;
+	uint32_t log_len;
+
+	/* S2 fault numbers */
+	uint32_t s2_fault_counter;
+
+	/* Boot Info */
+	struct hypdbg_boot_info_t boot_info[TZBSP_MAX_CPU_COUNT];
+
+	/* Ring buffer pointer */
+	uint8_t log_buf_p[];
+};
+
+struct tme_log_pos {
+	uint32_t offset;
+	size_t size;
+};
+
+/*
+ * Enumeration order for VMID's
+ */
+enum tzdbg_stats_type {
+	TZDBG_BOOT = 0,
+	TZDBG_RESET,
+	TZDBG_INTERRUPT,
+	TZDBG_VMID,
+	TZDBG_GENERAL,
+	TZDBG_LOG,
+	TZDBG_QSEE_LOG,
+	TZDBG_HYP_GENERAL,
+	TZDBG_HYP_LOG,
+	TZDBG_RM_LOG,
+	TZDBG_TME_LOG,
+	TZDBG_STATS_MAX
+};
+
+struct tzdbg_stat {
+	size_t display_len;
+	size_t display_offset;
+	char *name;
+	char *data;
+	bool avail;
+};
+
+struct tzdbg {
+	void __iomem *virt_iobase;
+	void __iomem *hyp_virt_iobase;
+	void __iomem *rmlog_virt_iobase;
+	void __iomem *tmelog_virt_iobase;
+	struct tzdbg_t *diag_buf;
+	struct hypdbg_t *hyp_diag_buf;
+	uint8_t *rm_diag_buf;
+	uint8_t *tme_buf;
+	char *disp_buf;
+	int debug_tz[TZDBG_STATS_MAX];
+	struct tzdbg_stat stat[TZDBG_STATS_MAX];
+	uint32_t hyp_debug_rw_buf_size;
+	uint32_t rmlog_rw_buf_size;
+	bool is_hyplog_enabled;
+	uint32_t tz_version;
+	bool is_encrypted_log_enabled;
+	bool is_enlarged_buf;
+	bool is_full_encrypted_tz_logs_supported;
+	bool is_full_encrypted_tz_logs_enabled;
+	int tz_diag_minor_version;
+	int tz_diag_major_version;
+};
+
+struct tzbsp_encr_log_t {
+	/* Magic Number */
+	uint32_t magic_num;
+	/* version NUMBER */
+	uint32_t version;
+	/* encrypted log size */
+	uint32_t encr_log_buff_size;
+	/* Wrap value*/
+	uint16_t wrap_count;
+	/* AES encryption key wrapped up with oem public key*/
+	uint8_t key[TZBSP_AES_256_ENCRYPTED_KEY_SIZE];
+	/* Nonce used for encryption*/
+	uint8_t nonce[TZBSP_NONCE_LEN];
+	/* Tag to be used for Validation */
+	uint8_t tag[TZBSP_TAG_LEN];
+	/* Encrypted log buffer */
+	uint8_t log_buf[];
+};
+
+struct encrypted_log_info {
+	phys_addr_t paddr;
+	void *vaddr;
+	size_t size;
+	uint64_t shmb_handle;
+};
+
+static struct tzdbg tzdbg = {
+	.stat[TZDBG_BOOT].name = "boot",
+	.stat[TZDBG_RESET].name = "reset",
+	.stat[TZDBG_INTERRUPT].name = "interrupt",
+	.stat[TZDBG_VMID].name = "vmid",
+	.stat[TZDBG_GENERAL].name = "general",
+	.stat[TZDBG_LOG].name = "log",
+	.stat[TZDBG_QSEE_LOG].name = "qsee_log",
+	.stat[TZDBG_HYP_GENERAL].name = "hyp_general",
+	.stat[TZDBG_HYP_LOG].name = "hyp_log",
+	.stat[TZDBG_RM_LOG].name = "rm_log",
+	.stat[TZDBG_TME_LOG].name = "tme_log",
+};
+
+struct ns_register_shmbridge_t {
+	uint32_t ns_vmids[VM_BITS];
+	uint32_t ns_vm_perms[PERM_BITS];
+	uint32_t ns_vm_nums;
+};
+
+static struct tzdbg_log_t *g_qsee_log;
+static struct tzdbg_log_v2_t *g_qsee_log_v2;
+static dma_addr_t coh_pmem;
+static uint32_t debug_rw_buf_size;
+static uint32_t display_buf_size;
+static uint32_t qseelog_buf_size;
+static phys_addr_t disp_buf_paddr;
+static uint32_t tmecrashdump_address_offset;
+
+static uint64_t qseelog_shmbridge_handle;
+static struct encrypted_log_info enc_qseelog_info;
+static struct encrypted_log_info enc_tzlog_info;
+
+static bool support_hyp;
+
+/*
+ * Debugfs data structure and functions
+ */
+
+static int _disp_tz_general_stats(void)
+{
+	int len = 0;
+
+	len += scnprintf(tzdbg.disp_buf + len, debug_rw_buf_size - 1,
+			"   Version        : 0x%x\n"
+			"   Magic Number   : 0x%x\n"
+			"   Number of CPU  : %d\n",
+			tzdbg.diag_buf->version,
+			tzdbg.diag_buf->magic_num,
+			tzdbg.diag_buf->cpu_count);
+	tzdbg.stat[TZDBG_GENERAL].data = tzdbg.disp_buf;
+	return len;
+}
+
+static int _disp_tz_vmid_stats(void)
+{
+	int i, num_vmid;
+	int len = 0;
+	struct tzdbg_vmid_t *ptr;
+
+	ptr = (struct tzdbg_vmid_t *)((unsigned char *)tzdbg.diag_buf +
+					tzdbg.diag_buf->vmid_info_off);
+	num_vmid = ((tzdbg.diag_buf->boot_info_off -
+				tzdbg.diag_buf->vmid_info_off)/
+					(sizeof(struct tzdbg_vmid_t)));
+
+	for (i = 0; i < num_vmid; i++) {
+		if (ptr->vmid < 0xFF) {
+			len += scnprintf(tzdbg.disp_buf + len,
+				(debug_rw_buf_size - 1) - len,
+				"   0x%x        %s\n",
+				(uint32_t)ptr->vmid, (uint8_t *)ptr->desc);
+		}
+		if (len > (debug_rw_buf_size - 1)) {
+			pr_warn("%s: Cannot fit all info into the buffer\n",
+								__func__);
+			break;
+		}
+		ptr++;
+	}
+
+	tzdbg.stat[TZDBG_VMID].data = tzdbg.disp_buf;
+	return len;
+}
+
+static int _disp_tz_boot_stats(void)
+{
+	int i;
+	int len = 0;
+	struct tzdbg_boot_info_t *ptr = NULL;
+	struct tzdbg_boot_info64_t *ptr_64 = NULL;
+
+	pr_info("qsee_version = 0x%x\n", tzdbg.tz_version);
+	if (tzdbg.tz_version >= QSEE_VERSION_TZ_3_X) {
+		ptr_64 = (struct tzdbg_boot_info64_t *)((unsigned char *)
+			tzdbg.diag_buf + tzdbg.diag_buf->boot_info_off);
+	} else {
+		ptr = (struct tzdbg_boot_info_t *)((unsigned char *)
+			tzdbg.diag_buf + tzdbg.diag_buf->boot_info_off);
+	}
+
+	for (i = 0; i < tzdbg.diag_buf->cpu_count; i++) {
+		if (tzdbg.tz_version >= QSEE_VERSION_TZ_3_X) {
+			len += scnprintf(tzdbg.disp_buf + len,
+					(debug_rw_buf_size - 1) - len,
+					"  CPU #: %d\n"
+					"     Warmboot jump address : 0x%llx\n"
+					"     Warmboot entry CPU counter : 0x%x\n"
+					"     Warmboot exit CPU counter : 0x%x\n"
+					"     Power Collapse entry CPU counter : 0x%x\n"
+					"     Power Collapse exit CPU counter : 0x%x\n"
+					"     Psci entry CPU counter : 0x%x\n"
+					"     Psci exit CPU counter : 0x%x\n"
+					"     Warmboot Jump Address Instruction : 0x%x\n",
+					i, (uint64_t)ptr_64->warm_jmp_addr,
+					ptr_64->wb_entry_cnt,
+					ptr_64->wb_exit_cnt,
+					ptr_64->pc_entry_cnt,
+					ptr_64->pc_exit_cnt,
+					ptr_64->psci_entry_cnt,
+					ptr_64->psci_exit_cnt,
+					ptr_64->warm_jmp_instr);
+
+			if (len > (debug_rw_buf_size - 1)) {
+				pr_warn("%s: Cannot fit all info into the buffer\n",
+						__func__);
+				break;
+			}
+			ptr_64++;
+		} else {
+			len += scnprintf(tzdbg.disp_buf + len,
+					(debug_rw_buf_size - 1) - len,
+					"  CPU #: %d\n"
+					"     Warmboot jump address     : 0x%x\n"
+					"     Warmboot entry CPU counter: 0x%x\n"
+					"     Warmboot exit CPU counter : 0x%x\n"
+					"     Power Collapse entry CPU counter: 0x%x\n"
+					"     Power Collapse exit CPU counter : 0x%x\n",
+					i, ptr->warm_jmp_addr,
+					ptr->wb_entry_cnt,
+					ptr->wb_exit_cnt,
+					ptr->pc_entry_cnt,
+					ptr->pc_exit_cnt);
+
+			if (len > (debug_rw_buf_size - 1)) {
+				pr_warn("%s: Cannot fit all info into the buffer\n",
+						__func__);
+				break;
+			}
+			ptr++;
+		}
+	}
+	tzdbg.stat[TZDBG_BOOT].data = tzdbg.disp_buf;
+	return len;
+}
+
+static int _disp_tz_reset_stats(void)
+{
+	int i;
+	int len = 0;
+	struct tzdbg_reset_info_t *ptr;
+
+	ptr = (struct tzdbg_reset_info_t *)((unsigned char *)tzdbg.diag_buf +
+					tzdbg.diag_buf->reset_info_off);
+
+	for (i = 0; i < tzdbg.diag_buf->cpu_count; i++) {
+		len += scnprintf(tzdbg.disp_buf + len,
+				(debug_rw_buf_size - 1) - len,
+				"  CPU #: %d\n"
+				"     Reset Type (reason)       : 0x%x\n"
+				"     Reset counter             : 0x%x\n",
+				i, ptr->reset_type, ptr->reset_cnt);
+
+		if (len > (debug_rw_buf_size - 1)) {
+			pr_warn("%s: Cannot fit all info into the buffer\n",
+								__func__);
+			break;
+		}
+
+		ptr++;
+	}
+	tzdbg.stat[TZDBG_RESET].data = tzdbg.disp_buf;
+	return len;
+}
+
+static int _disp_tz_interrupt_stats(void)
+{
+	int i, j;
+	int len = 0;
+	int *num_int;
+	void *ptr;
+	struct tzdbg_int_t *tzdbg_ptr;
+	struct tzdbg_int_t_tz40 *tzdbg_ptr_tz40;
+
+	num_int = (uint32_t *)((unsigned char *)tzdbg.diag_buf +
+			(tzdbg.diag_buf->int_info_off - sizeof(uint32_t)));
+	ptr = ((unsigned char *)tzdbg.diag_buf +
+					tzdbg.diag_buf->int_info_off);
+
+	pr_info("qsee_version = 0x%x\n", tzdbg.tz_version);
+
+	if (tzdbg.tz_version < QSEE_VERSION_TZ_4_X) {
+		tzdbg_ptr = ptr;
+		for (i = 0; i < (*num_int); i++) {
+			len += scnprintf(tzdbg.disp_buf + len,
+				(debug_rw_buf_size - 1) - len,
+				"     Interrupt Number          : 0x%x\n"
+				"     Type of Interrupt         : 0x%x\n"
+				"     Description of interrupt  : %s\n",
+				tzdbg_ptr->int_num,
+				(uint32_t)tzdbg_ptr->int_info,
+				(uint8_t *)tzdbg_ptr->int_desc);
+			for (j = 0; j < tzdbg.diag_buf->cpu_count; j++) {
+				len += scnprintf(tzdbg.disp_buf + len,
+				(debug_rw_buf_size - 1) - len,
+				"     int_count on CPU # %d      : %u\n",
+				(uint32_t)j,
+				(uint32_t)tzdbg_ptr->int_count[j]);
+			}
+			len += scnprintf(tzdbg.disp_buf + len,
+					debug_rw_buf_size - 1, "\n");
+
+			if (len > (debug_rw_buf_size - 1)) {
+				pr_warn("%s: Cannot fit all info into buf\n",
+								__func__);
+				break;
+			}
+			tzdbg_ptr++;
+		}
+	} else {
+		tzdbg_ptr_tz40 = ptr;
+		for (i = 0; i < (*num_int); i++) {
+			len += scnprintf(tzdbg.disp_buf + len,
+				(debug_rw_buf_size - 1) - len,
+				"     Interrupt Number          : 0x%x\n"
+				"     Type of Interrupt         : 0x%x\n"
+				"     Description of interrupt  : %s\n",
+				tzdbg_ptr_tz40->int_num,
+				(uint32_t)tzdbg_ptr_tz40->int_info,
+				(uint8_t *)tzdbg_ptr_tz40->int_desc);
+			for (j = 0; j < tzdbg.diag_buf->cpu_count; j++) {
+				len += scnprintf(tzdbg.disp_buf + len,
+				(debug_rw_buf_size - 1) - len,
+				"     int_count on CPU # %d      : %u\n",
+				(uint32_t)j,
+				(uint32_t)tzdbg_ptr_tz40->int_count[j]);
+			}
+			len += scnprintf(tzdbg.disp_buf + len,
+					debug_rw_buf_size - 1, "\n");
+
+			if (len > (debug_rw_buf_size - 1)) {
+				pr_warn("%s: Cannot fit all info into buf\n",
+								__func__);
+				break;
+			}
+			tzdbg_ptr_tz40++;
+		}
+	}
+
+	tzdbg.stat[TZDBG_INTERRUPT].data = tzdbg.disp_buf;
+	return len;
+}
+
+static int _disp_tz_log_stats_legacy(void)
+{
+	int len = 0;
+	unsigned char *ptr;
+
+	ptr = (unsigned char *)tzdbg.diag_buf +
+					tzdbg.diag_buf->ring_off;
+	len += scnprintf(tzdbg.disp_buf, (debug_rw_buf_size - 1) - len,
+							"%s\n", ptr);
+
+	tzdbg.stat[TZDBG_LOG].data = tzdbg.disp_buf;
+	return len;
+}
+
+static int _disp_log_stats(struct tzdbg_log_t *log,
+			struct tzdbg_log_pos_t *log_start, uint32_t log_len,
+			size_t count, uint32_t buf_idx)
+{
+	uint32_t wrap_start;
+	uint32_t wrap_end;
+	uint32_t wrap_cnt;
+	int max_len;
+	int len = 0;
+	int i = 0;
+
+	wrap_start = log_start->wrap;
+	wrap_end = log->log_pos.wrap;
+
+	/* Calculate difference in # of buffer wrap-arounds */
+	if (wrap_end >= wrap_start)
+		wrap_cnt = wrap_end - wrap_start;
+	else {
+		/* wrap counter has wrapped around, invalidate start position */
+		wrap_cnt = 2;
+	}
+
+	if (wrap_cnt > 1) {
+		/* end position has wrapped around more than once, */
+		/* current start no longer valid                   */
+		log_start->wrap = log->log_pos.wrap - 1;
+		log_start->offset = (log->log_pos.offset + 1) % log_len;
+	} else if ((wrap_cnt == 1) &&
+		(log->log_pos.offset > log_start->offset)) {
+		/* end position has overwritten start */
+		log_start->offset = (log->log_pos.offset + 1) % log_len;
+	}
+
+	pr_debug("diag_buf wrap = %u, offset = %u\n",
+		log->log_pos.wrap, log->log_pos.offset);
+	while (log_start->offset == log->log_pos.offset) {
+		/*
+		 * No data in ring buffer,
+		 * so we'll hang around until something happens
+		 */
+		unsigned long t = msleep_interruptible(50);
+
+		if (t != 0) {
+			/* Some event woke us up, so let's quit */
+			return 0;
+}
+
+		if (buf_idx == TZDBG_LOG)
+			memcpy_fromio((void *)tzdbg.diag_buf, tzdbg.virt_iobase,
+						debug_rw_buf_size);
+
+	}
+
+	max_len = (count > debug_rw_buf_size) ? debug_rw_buf_size : count;
+
+	pr_debug("diag_buf wrap = %u, offset = %u\n",
+		log->log_pos.wrap, log->log_pos.offset);
+	/*
+	 *  Read from ring buff while there is data and space in return buff
+	 */
+	while ((log_start->offset != log->log_pos.offset) && (len < max_len)) {
+		tzdbg.disp_buf[i++] = log->log_buf[log_start->offset];
+		log_start->offset = (log_start->offset + 1) % log_len;
+		if (log_start->offset == 0)
+			++log_start->wrap;
+		++len;
+	}
+
+	/*
+	 * return buffer to caller
+	 */
+	tzdbg.stat[buf_idx].data = tzdbg.disp_buf;
+	return len;
+}
+
+static int _disp_log_stats_v2(struct tzdbg_log_v2_t *log,
+			struct tzdbg_log_pos_v2_t *log_start, uint32_t log_len,
+			size_t count, uint32_t buf_idx)
+{
+	uint32_t wrap_start;
+	uint32_t wrap_end;
+	uint32_t wrap_cnt;
+	int max_len;
+	int len = 0;
+	int i = 0;
+
+	wrap_start = log_start->wrap;
+	wrap_end = log->log_pos.wrap;
+
+	/* Calculate difference in # of buffer wrap-arounds */
+	if (wrap_end >= wrap_start)
+		wrap_cnt = wrap_end - wrap_start;
+	else {
+		/* wrap counter has wrapped around, invalidate start position */
+		wrap_cnt = 2;
+}
+
+	if (wrap_cnt > 1) {
+		/* end position has wrapped around more than once, */
+		/* current start no longer valid                   */
+		log_start->wrap = log->log_pos.wrap - 1;
+		log_start->offset = (log->log_pos.offset + 1) % log_len;
+	} else if ((wrap_cnt == 1) &&
+		(log->log_pos.offset > log_start->offset)) {
+		/* end position has overwritten start */
+		log_start->offset = (log->log_pos.offset + 1) % log_len;
+	}
+	pr_debug("diag_buf wrap = %u, offset = %u\n",
+		log->log_pos.wrap, log->log_pos.offset);
+
+	while (log_start->offset == log->log_pos.offset) {
+		/*
+		 * No data in ring buffer,
+		 * so we'll hang around until something happens
+		 */
+		unsigned long t = msleep_interruptible(50);
+
+		if (t != 0) {
+			/* Some event woke us up, so let's quit */
+			return 0;
+		}
+
+		if (buf_idx == TZDBG_LOG)
+			memcpy_fromio((void *)tzdbg.diag_buf, tzdbg.virt_iobase,
+						debug_rw_buf_size);
+
+	}
+
+	max_len = (count > debug_rw_buf_size) ? debug_rw_buf_size : count;
+
+	pr_debug("diag_buf wrap = %u, offset = %u\n",
+		log->log_pos.wrap, log->log_pos.offset);
+
+	/*
+	 *  Read from ring buff while there is data and space in return buff
+	 */
+	while ((log_start->offset != log->log_pos.offset) && (len < max_len)) {
+		tzdbg.disp_buf[i++] = log->log_buf[log_start->offset];
+		log_start->offset = (log_start->offset + 1) % log_len;
+		if (log_start->offset == 0)
+			++log_start->wrap;
+		++len;
+	}
+
+	/*
+	 * return buffer to caller
+	 */
+	tzdbg.stat[buf_idx].data = tzdbg.disp_buf;
+	return len;
+}
+
+static int __disp_hyp_log_stats(uint8_t *log,
+			struct hypdbg_log_pos_t *log_start, uint32_t log_len,
+			size_t count, uint32_t buf_idx)
+{
+	struct hypdbg_t *hyp = tzdbg.hyp_diag_buf;
+	unsigned long t = 0;
+	uint32_t wrap_start;
+	uint32_t wrap_end;
+	uint32_t wrap_cnt;
+	int max_len;
+	int len = 0;
+	int i = 0;
+
+	wrap_start = log_start->wrap;
+	wrap_end = hyp->log_pos.wrap;
+
+	/* Calculate difference in # of buffer wrap-arounds */
+	if (wrap_end >= wrap_start)
+		wrap_cnt = wrap_end - wrap_start;
+	else {
+		/* wrap counter has wrapped around, invalidate start position */
+		wrap_cnt = 2;
+	}
+
+	if (wrap_cnt > 1) {
+		/* end position has wrapped around more than once, */
+		/* current start no longer valid                   */
+		log_start->wrap = hyp->log_pos.wrap - 1;
+		log_start->offset = (hyp->log_pos.offset + 1) % log_len;
+	} else if ((wrap_cnt == 1) &&
+		(hyp->log_pos.offset > log_start->offset)) {
+		/* end position has overwritten start */
+		log_start->offset = (hyp->log_pos.offset + 1) % log_len;
+	}
+
+	while (log_start->offset == hyp->log_pos.offset) {
+		/*
+		 * No data in ring buffer,
+		 * so we'll hang around until something happens
+		 */
+		t = msleep_interruptible(50);
+		if (t != 0) {
+			/* Some event woke us up, so let's quit */
+			return 0;
+		}
+
+		/* TZDBG_HYP_LOG */
+		memcpy_fromio((void *)tzdbg.hyp_diag_buf, tzdbg.hyp_virt_iobase,
+						tzdbg.hyp_debug_rw_buf_size);
+	}
+
+	max_len = (count > tzdbg.hyp_debug_rw_buf_size) ?
+				tzdbg.hyp_debug_rw_buf_size : count;
+
+	/*
+	 *  Read from ring buff while there is data and space in return buff
+	 */
+	while ((log_start->offset != hyp->log_pos.offset) && (len < max_len)) {
+		tzdbg.disp_buf[i++] = log[log_start->offset];
+		log_start->offset = (log_start->offset + 1) % log_len;
+		if (log_start->offset == 0)
+			++log_start->wrap;
+		++len;
+	}
+
+	/*
+	 * return buffer to caller
+	 */
+	tzdbg.stat[buf_idx].data = tzdbg.disp_buf;
+	return len;
+}
+static int __disp_rm_log_stats(uint8_t *log_ptr, uint32_t max_len)
+{
+	uint32_t i = 0;
+	/*
+	 *  Transfer data from rm dialog buff to display buffer in user space
+	 */
+	while ((i < max_len) && (i < display_buf_size)) {
+		tzdbg.disp_buf[i] = log_ptr[i];
+		i++;
+	}
+	if (i != max_len)
+		pr_err("Dropping RM log message, max_len:%d display_buf_size:%d\n",
+			i, display_buf_size);
+	tzdbg.stat[TZDBG_RM_LOG].data = tzdbg.disp_buf;
+	return i;
+}
+
+static int print_text(char *intro_message,
+			unsigned char *text_addr,
+			unsigned int size,
+			char *buf, uint32_t buf_len)
+{
+	unsigned int   i;
+	int len = 0;
+
+	pr_debug("begin address %p, size %d\n", text_addr, size);
+	len += scnprintf(buf + len, buf_len - len, "%s\n", intro_message);
+	for (i = 0;  i < size;  i++) {
+		if (buf_len <= len + 6) {
+			pr_err("buffer not enough, buf_len %d, len %d\n",
+				buf_len, len);
+			return buf_len;
+		}
+		len += scnprintf(buf + len, buf_len - len, "%02hhx ",
+					text_addr[i]);
+		if ((i & 0x1f) == 0x1f)
+			len += scnprintf(buf + len, buf_len - len, "%c", '\n');
+	}
+	len += scnprintf(buf + len, buf_len - len, "%c", '\n');
+	return len;
+}
+
+static int _disp_encrpted_log_stats(struct encrypted_log_info *enc_log_info,
+				enum tzdbg_stats_type type, uint32_t log_id)
+{
+	int ret = 0, len = 0;
+	struct tzbsp_encr_log_t *encr_log_head;
+	uint32_t size = 0;
+
+	if ((!tzdbg.is_full_encrypted_tz_logs_supported) &&
+		(tzdbg.is_full_encrypted_tz_logs_enabled))
+		pr_info("TZ not supporting full encrypted log functionality\n");
+	ret = qcom_scm_request_encrypted_log(enc_log_info->paddr,
+		enc_log_info->size, log_id, tzdbg.is_full_encrypted_tz_logs_supported,
+		tzdbg.is_full_encrypted_tz_logs_enabled);
+	if (ret)
+		return 0;
+	encr_log_head = (struct tzbsp_encr_log_t *)(enc_log_info->vaddr);
+	pr_debug("display_buf_size = %d, encr_log_buff_size = %d\n",
+		display_buf_size, encr_log_head->encr_log_buff_size);
+	size = encr_log_head->encr_log_buff_size;
+
+	len += scnprintf(tzdbg.disp_buf + len,
+			(display_buf_size - 1) - len,
+			"\n-------- New Encrypted %s --------\n",
+			((log_id == ENCRYPTED_QSEE_LOG_ID) ?
+				"QSEE Log" : "TZ Dialog"));
+
+	len += scnprintf(tzdbg.disp_buf + len,
+			(display_buf_size - 1) - len,
+			"\nMagic_Num :\n0x%x\n"
+			"\nVerion :\n%d\n"
+			"\nEncr_Log_Buff_Size :\n%d\n"
+			"\nWrap_Count :\n%d\n",
+			encr_log_head->magic_num,
+			encr_log_head->version,
+			encr_log_head->encr_log_buff_size,
+			encr_log_head->wrap_count);
+
+	len += print_text("\nKey : ", encr_log_head->key,
+			TZBSP_AES_256_ENCRYPTED_KEY_SIZE,
+			tzdbg.disp_buf + len, display_buf_size);
+	len += print_text("\nNonce : ", encr_log_head->nonce,
+			TZBSP_NONCE_LEN,
+			tzdbg.disp_buf + len, display_buf_size - len);
+	len += print_text("\nTag : ", encr_log_head->tag,
+			TZBSP_TAG_LEN,
+			tzdbg.disp_buf + len, display_buf_size - len);
+
+	if (len > display_buf_size - size)
+		pr_warn("Cannot fit all info into the buffer\n");
+
+	pr_debug("encrypted log size %d, disply buffer size %d, used len %d\n",
+			size, display_buf_size, len);
+
+	len += print_text("\nLog : ", encr_log_head->log_buf, size,
+				tzdbg.disp_buf + len, display_buf_size - len);
+	memset(enc_log_info->vaddr, 0, enc_log_info->size);
+	tzdbg.stat[type].data = tzdbg.disp_buf;
+	return len;
+}
+
+static int _disp_tz_log_stats(size_t count)
+{
+	static struct tzdbg_log_pos_v2_t log_start_v2 = {0};
+	static struct tzdbg_log_pos_t log_start = {0};
+	struct tzdbg_log_v2_t *log_v2_ptr;
+	struct tzdbg_log_t *log_ptr;
+
+	log_ptr = (struct tzdbg_log_t *)((unsigned char *)tzdbg.diag_buf +
+			tzdbg.diag_buf->ring_off -
+			offsetof(struct tzdbg_log_t, log_buf));
+
+	log_v2_ptr = (struct tzdbg_log_v2_t *)((unsigned char *)tzdbg.diag_buf +
+			tzdbg.diag_buf->ring_off -
+			offsetof(struct tzdbg_log_v2_t, log_buf));
+
+	if (!tzdbg.is_enlarged_buf)
+		return _disp_log_stats(log_ptr, &log_start,
+				tzdbg.diag_buf->ring_len, count, TZDBG_LOG);
+
+	return _disp_log_stats_v2(log_v2_ptr, &log_start_v2,
+			tzdbg.diag_buf->ring_len, count, TZDBG_LOG);
+}
+
+static int _disp_hyp_log_stats(size_t count)
+{
+	static struct hypdbg_log_pos_t log_start = {0};
+	uint8_t *log_ptr;
+	uint32_t log_len;
+
+	log_ptr = (uint8_t *)((unsigned char *)tzdbg.hyp_diag_buf +
+				tzdbg.hyp_diag_buf->ring_off);
+	log_len = tzdbg.hyp_debug_rw_buf_size - tzdbg.hyp_diag_buf->ring_off;
+
+	return __disp_hyp_log_stats(log_ptr, &log_start,
+			log_len, count, TZDBG_HYP_LOG);
+}
+
+static int _disp_rm_log_stats(size_t count)
+{
+	static struct rmdbg_log_pos_t log_start = { 0 };
+	struct rmdbg_log_hdr_t *p_log_hdr = NULL;
+	uint8_t *log_ptr = NULL;
+	uint32_t log_len = 0;
+	static bool wrap_around = { false };
+
+	/* Return 0 to close the display file,if there is nothing else to do */
+	if ((log_start.size == 0x0) && wrap_around) {
+		wrap_around = false;
+		return 0;
+	}
+	/* Copy RM log data to tzdbg diag buffer for the first time */
+	/* Initialize the tracking data structure */
+	if (tzdbg.rmlog_rw_buf_size != 0) {
+		if (!wrap_around) {
+			memcpy_fromio((void *)tzdbg.rm_diag_buf,
+					tzdbg.rmlog_virt_iobase,
+					tzdbg.rmlog_rw_buf_size);
+			/* get RM header info first */
+			p_log_hdr = (struct rmdbg_log_hdr_t *)tzdbg.rm_diag_buf;
+			/* Update RM log buffer index tracker and its size */
+			log_start.read_idx = 0x0;
+			log_start.size = p_log_hdr->size;
+		}
+		/* Update RM log buffer starting ptr */
+		log_ptr =
+			(uint8_t *) ((unsigned char *)tzdbg.rm_diag_buf +
+				 sizeof(struct rmdbg_log_hdr_t));
+	} else {
+	/* Return 0 to close the display file,if there is nothing else to do */
+		pr_err("There is no RM log to read, size is %d!\n",
+			tzdbg.rmlog_rw_buf_size);
+		return 0;
+	}
+	log_len = log_start.size;
+	log_ptr += log_start.read_idx;
+	/* Check if we exceed the max length provided by user space */
+	log_len = (count > log_len) ? log_len : count;
+	/* Update tracking data structure */
+	log_start.size -= log_len;
+	log_start.read_idx += log_len;
+
+	if (log_start.size)
+		wrap_around =  true;
+	return __disp_rm_log_stats(log_ptr, log_len);
+}
+
+static int _disp_qsee_log_stats(size_t count)
+{
+	static struct tzdbg_log_pos_t log_start = {0};
+	static struct tzdbg_log_pos_v2_t log_start_v2 = {0};
+
+	if (!tzdbg.is_enlarged_buf)
+		return _disp_log_stats(g_qsee_log, &log_start,
+			QSEE_LOG_BUF_SIZE - sizeof(struct tzdbg_log_pos_t),
+			count, TZDBG_QSEE_LOG);
+
+	return _disp_log_stats_v2(g_qsee_log_v2, &log_start_v2,
+		QSEE_LOG_BUF_SIZE_V2 - sizeof(struct tzdbg_log_pos_v2_t),
+		count, TZDBG_QSEE_LOG);
+}
+
+static int _disp_hyp_general_stats(size_t count)
+{
+	int len = 0;
+	int i;
+	struct hypdbg_boot_info_t *ptr = NULL;
+
+	len += scnprintf((unsigned char *)tzdbg.disp_buf + len,
+			tzdbg.hyp_debug_rw_buf_size - 1,
+			"   Magic Number    : 0x%x\n"
+			"   CPU Count       : 0x%x\n"
+			"   S2 Fault Counter: 0x%x\n",
+			tzdbg.hyp_diag_buf->magic_num,
+			tzdbg.hyp_diag_buf->cpu_count,
+			tzdbg.hyp_diag_buf->s2_fault_counter);
+
+	ptr = tzdbg.hyp_diag_buf->boot_info;
+	for (i = 0; i < tzdbg.hyp_diag_buf->cpu_count; i++) {
+		len += scnprintf((unsigned char *)tzdbg.disp_buf + len,
+				(tzdbg.hyp_debug_rw_buf_size - 1) - len,
+				"  CPU #: %d\n"
+				"     Warmboot entry CPU counter: 0x%x\n"
+				"     Warmboot exit CPU counter : 0x%x\n",
+				i, ptr->warm_entry_cnt, ptr->warm_exit_cnt);
+
+		if (len > (tzdbg.hyp_debug_rw_buf_size - 1)) {
+			pr_warn("%s: Cannot fit all info into the buffer\n",
+								__func__);
+			break;
+		}
+		ptr++;
+	}
+
+	tzdbg.stat[TZDBG_HYP_GENERAL].data = (char *)tzdbg.disp_buf;
+	return len;
+}
+
+#if IS_ENABLED(CONFIG_MSM_TMECOM_QMP)
+static int _disp_tme_log_stats(size_t count)
+{
+	static struct tme_log_pos log_start = { 0 };
+	static bool wrap_around = { false };
+	uint32_t buf_size;
+	uint8_t *log_ptr = NULL;
+	uint32_t log_len = 0;
+	int ret = 0;
+
+	/* Return 0 to close the display file */
+	if ((log_start.size == 0x0) && wrap_around) {
+		wrap_around = false;
+		return 0;
+	}
+
+	/* Copy TME log data to tzdbg diag buffer for the first time */
+	if (!wrap_around) {
+		if (tmelog_process_request(tmecrashdump_address_offset,
+								   TME_LOG_BUF_SIZE, &buf_size)) {
+			pr_err("Read tme log failed, ret=%d, buf_size: %#x\n", ret, buf_size);
+			return 0;
+		}
+		log_start.offset = 0x0;
+		log_start.size = buf_size;
+	}
+
+	log_ptr = tzdbg.tmelog_virt_iobase;
+	log_len = log_start.size;
+	log_ptr += log_start.offset;
+
+	/* Check if we exceed the max length provided by user space */
+	log_len = min(min((uint32_t)count, log_len), display_buf_size);
+
+	log_start.size -= log_len;
+	log_start.offset += log_len;
+	pr_debug("log_len: %d, log_start.offset: %#x, log_start.size: %#x\n",
+			log_len, log_start.offset, log_start.size);
+
+	if (log_start.size)
+		wrap_around =  true;
+
+	/* Copy TME log data to display buffer */
+	memcpy_fromio(tzdbg.disp_buf, log_ptr, log_len);
+
+	tzdbg.stat[TZDBG_TME_LOG].data = tzdbg.disp_buf;
+	return log_len;
+}
+#else
+static int _disp_tme_log_stats(size_t count)
+{
+	return 0;
+}
+#endif
+
+static ssize_t tzdbg_fs_read_unencrypted(int tz_id, char __user *buf,
+	size_t count, loff_t *offp)
+{
+	int len = 0;
+
+	if (tz_id == TZDBG_BOOT || tz_id == TZDBG_RESET ||
+		tz_id == TZDBG_INTERRUPT || tz_id == TZDBG_GENERAL ||
+		tz_id == TZDBG_VMID || tz_id == TZDBG_LOG)
+		memcpy_fromio((void *)tzdbg.diag_buf, tzdbg.virt_iobase,
+						debug_rw_buf_size);
+
+	if (tz_id == TZDBG_HYP_GENERAL || tz_id == TZDBG_HYP_LOG)
+		memcpy_fromio((void *)tzdbg.hyp_diag_buf,
+				tzdbg.hyp_virt_iobase,
+				tzdbg.hyp_debug_rw_buf_size);
+
+	switch (tz_id) {
+	case TZDBG_BOOT:
+		len = _disp_tz_boot_stats();
+		break;
+	case TZDBG_RESET:
+		len = _disp_tz_reset_stats();
+		break;
+	case TZDBG_INTERRUPT:
+		len = _disp_tz_interrupt_stats();
+		break;
+	case TZDBG_GENERAL:
+		len = _disp_tz_general_stats();
+		break;
+	case TZDBG_VMID:
+		len = _disp_tz_vmid_stats();
+		break;
+	case TZDBG_LOG:
+		if (TZBSP_DIAG_MAJOR_VERSION_LEGACY <
+				(tzdbg.diag_buf->version >> 16)) {
+			len = _disp_tz_log_stats(count);
+			*offp = 0;
+		} else {
+			len = _disp_tz_log_stats_legacy();
+		}
+		break;
+	case TZDBG_QSEE_LOG:
+		len = _disp_qsee_log_stats(count);
+		*offp = 0;
+		break;
+	case TZDBG_HYP_GENERAL:
+		len = _disp_hyp_general_stats(count);
+		break;
+	case TZDBG_HYP_LOG:
+		len = _disp_hyp_log_stats(count);
+		*offp = 0;
+		break;
+	case TZDBG_RM_LOG:
+		len = _disp_rm_log_stats(count);
+		*offp = 0;
+		break;
+	case TZDBG_TME_LOG:
+		len = _disp_tme_log_stats(count);
+		*offp = 0;
+		break;
+	default:
+		break;
+	}
+
+	if (len > count)
+		len = count;
+
+	return simple_read_from_buffer(buf, len, offp,
+				tzdbg.stat[tz_id].data, len);
+}
+
+static ssize_t tzdbg_fs_read_encrypted(int tz_id, char __user *buf,
+	size_t count, loff_t *offp)
+{
+	int len = 0, ret = 0;
+	struct tzdbg_stat *stat = &(tzdbg.stat[tz_id]);
+
+	pr_debug("%s: tz_id = %d\n", __func__, tz_id);
+
+	if (tz_id >= TZDBG_STATS_MAX) {
+		pr_err("invalid encrypted log id %d\n", tz_id);
+		return ret;
+	}
+
+	if (!stat->display_len) {
+		if (tz_id == TZDBG_QSEE_LOG)
+			stat->display_len = _disp_encrpted_log_stats(
+					&enc_qseelog_info,
+					tz_id, ENCRYPTED_QSEE_LOG_ID);
+		else
+			stat->display_len = _disp_encrpted_log_stats(
+					&enc_tzlog_info,
+					tz_id, ENCRYPTED_TZ_LOG_ID);
+		stat->display_offset = 0;
+	}
+	len = stat->display_len;
+	if (len > count)
+		len = count;
+
+	*offp = 0;
+	ret = simple_read_from_buffer(buf, len, offp,
+				tzdbg.stat[tz_id].data + stat->display_offset,
+				count);
+	stat->display_offset += ret;
+	stat->display_len -= ret;
+	pr_debug("ret = %d, offset = %d\n", ret, (int)(*offp));
+	pr_debug("display_len = %lu, offset = %lu\n",
+			stat->display_len, stat->display_offset);
+	return ret;
+}
+
+static ssize_t tzdbg_fs_read(struct file *file, char __user *buf,
+	size_t count, loff_t *offp)
+{
+	struct seq_file *seq = file->private_data;
+	int tz_id = TZDBG_STATS_MAX;
+
+	if (seq)
+		tz_id = *(int *)(seq->private);
+	else {
+		pr_err("%s: Seq data null unable to proceed\n", __func__);
+		return 0;
+	}
+
+	if (!tzdbg.is_encrypted_log_enabled ||
+	    (tz_id == TZDBG_HYP_GENERAL || tz_id == TZDBG_HYP_LOG)
+	    || tz_id == TZDBG_RM_LOG || tz_id == TZDBG_TME_LOG)
+		return tzdbg_fs_read_unencrypted(tz_id, buf, count, offp);
+	else
+		return tzdbg_fs_read_encrypted(tz_id, buf, count, offp);
+}
+
+static int tzdbg_procfs_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, NULL, pde_data(inode));
+}
+
+static int tzdbg_procfs_release(struct inode *inode, struct file *file)
+{
+	return single_release(inode, file);
+}
+
+const struct proc_ops tzdbg_fops = {
+	.proc_flags   = PROC_ENTRY_PERMANENT,
+	.proc_read    = tzdbg_fs_read,
+	.proc_open    = tzdbg_procfs_open,
+	.proc_release = tzdbg_procfs_release,
+};
+
+static int tzdbg_init_tme_log(struct platform_device *pdev, void __iomem *virt_iobase)
+{
+	/*
+	 * Tme logs are dumped in tme log ddr region but that region is not
+	 * accessible to hlos. Instead, collect logs at tme crashdump ddr
+	 * region with tmecom interface and then display logs reading from
+	 * crashdump region.
+	 */
+	if (of_property_read_u32((&pdev->dev)->of_node, "tmecrashdump-address-offset",
+				&tmecrashdump_address_offset)) {
+		pr_err("Tme Crashdump address offset need to be defined!\n");
+		return -EINVAL;
+	}
+
+	tzdbg.tmelog_virt_iobase =
+		devm_ioremap(&pdev->dev, tmecrashdump_address_offset, TME_LOG_BUF_SIZE);
+	if (!tzdbg.tmelog_virt_iobase) {
+		pr_err("ERROR: Could not ioremap: start=%#x, len=%u\n",
+				tmecrashdump_address_offset, TME_LOG_BUF_SIZE);
+		return -ENXIO;
+	}
+
+	return 0;
+}
+
+/*
+ * Allocates log buffer from ION, registers the buffer at TZ
+ */
+static int tzdbg_register_qsee_log_buf(struct platform_device *pdev)
+{
+	int ret = 0;
+	void *buf = NULL;
+
+	struct ns_register_shmbridge_t ns_vm_shm = {
+		.ns_vm_perms[0] = QCOM_SCM_PERM_RW,
+	};
+
+	if (support_hyp) {
+		ns_vm_shm.ns_vm_nums = 0;
+	} else {
+		ns_vm_shm.ns_vmids[0] = QCOM_SCM_VMID_HLOS;
+		ns_vm_shm.ns_vm_nums = 1;
+	}
+
+	if (tzdbg.is_enlarged_buf) {
+		if (of_property_read_u32((&pdev->dev)->of_node,
+			"qseelog-buf-size-v2", &qseelog_buf_size)) {
+			pr_debug("Enlarged qseelog buf size isn't defined\n");
+			qseelog_buf_size = QSEE_LOG_BUF_SIZE_V2;
+		}
+	}  else {
+		qseelog_buf_size = QSEE_LOG_BUF_SIZE;
+	}
+	pr_debug("qseelog buf size is 0x%x\n", qseelog_buf_size);
+
+	buf = dma_alloc_coherent(&pdev->dev,
+			qseelog_buf_size, &coh_pmem, GFP_KERNEL);
+	if (buf == NULL)
+		return -ENOMEM;
+
+	if (!tzdbg.is_encrypted_log_enabled) {
+		ret = qcom_tzmem_register(coh_pmem,
+			qseelog_buf_size,
+			ns_vm_shm.ns_vmids,
+			ns_vm_shm.ns_vm_perms,
+			ns_vm_shm.ns_vm_nums,
+			QCOM_SCM_PERM_RW,
+			&qseelog_shmbridge_handle);
+		if (ret) {
+			pr_err("failed to create bridge for qsee_log buf\n");
+			goto exit_free_mem;
+		}
+	}
+
+	g_qsee_log = (struct tzdbg_log_t *)buf;
+	g_qsee_log->log_pos.wrap = g_qsee_log->log_pos.offset = 0;
+
+	g_qsee_log_v2 = (struct tzdbg_log_v2_t *)buf;
+	g_qsee_log_v2->log_pos.wrap = g_qsee_log_v2->log_pos.offset = 0;
+
+	ret = qcom_scm_register_qsee_log_buf(coh_pmem, qseelog_buf_size);
+	if (ret) {
+		pr_err(
+		"%s: scm_call to register log buf failed, resp result =%d\n",
+		__func__, ret);
+		goto exit_dereg_bridge;
+	}
+
+	return ret;
+
+exit_dereg_bridge:
+	if (!tzdbg.is_encrypted_log_enabled)
+		qcom_tzmem_deregister(qseelog_shmbridge_handle);
+exit_free_mem:
+	dma_free_coherent(&pdev->dev, qseelog_buf_size,
+			(void *)g_qsee_log, coh_pmem);
+	return ret;
+}
+
+static void tzdbg_free_qsee_log_buf(struct platform_device *pdev)
+{
+	if (!tzdbg.is_encrypted_log_enabled)
+		qcom_tzmem_deregister(qseelog_shmbridge_handle);
+	dma_free_coherent(&pdev->dev, qseelog_buf_size,
+				(void *)g_qsee_log, coh_pmem);
+}
+
+static int tzdbg_allocate_encrypted_log_buf(struct platform_device *pdev)
+{
+	int ret = 0;
+	struct ns_register_shmbridge_t ns_vm_shm = {
+		.ns_vm_perms[0] = QCOM_SCM_PERM_RW,
+	};
+
+	if (support_hyp) {
+		ns_vm_shm.ns_vm_nums = 0;
+	} else {
+		ns_vm_shm.ns_vmids[0] = QCOM_SCM_VMID_HLOS;
+		ns_vm_shm.ns_vm_nums = 1;
+	}
+
+	if (!tzdbg.is_encrypted_log_enabled)
+		return 0;
+
+	/* max encrypted qsee log buf zize (include header, and page align) */
+	enc_qseelog_info.size = qseelog_buf_size + PAGE_SIZE;
+
+	enc_qseelog_info.vaddr = dma_alloc_coherent(&pdev->dev,
+					enc_qseelog_info.size,
+					&enc_qseelog_info.paddr, GFP_KERNEL);
+	if (enc_qseelog_info.vaddr == NULL)
+		return -ENOMEM;
+
+	ret = qcom_tzmem_register(enc_qseelog_info.paddr,
+			enc_qseelog_info.size,
+			ns_vm_shm.ns_vmids,
+			ns_vm_shm.ns_vm_perms,
+			ns_vm_shm.ns_vm_nums,
+			QCOM_SCM_PERM_RW,
+			&enc_qseelog_info.shmb_handle);
+	if (ret) {
+		pr_err("failed to create encr_qsee_log bridge, ret %d\n", ret);
+		goto exit_free_qseelog;
+	}
+	pr_debug("Alloc memory for encr_qsee_log, size = %zu\n",
+			enc_qseelog_info.size);
+
+	enc_tzlog_info.size = debug_rw_buf_size;
+	enc_tzlog_info.vaddr = dma_alloc_coherent(&pdev->dev,
+					enc_tzlog_info.size,
+					&enc_tzlog_info.paddr, GFP_KERNEL);
+	if (enc_tzlog_info.vaddr == NULL)
+		goto exit_unreg_qseelog;
+
+	ret = qcom_tzmem_register(enc_tzlog_info.paddr,
+			enc_tzlog_info.size,
+			ns_vm_shm.ns_vmids,
+			ns_vm_shm.ns_vm_perms,
+			ns_vm_shm.ns_vm_nums,
+			QCOM_SCM_PERM_RW,
+			&enc_tzlog_info.shmb_handle);
+	if (ret) {
+		pr_err("failed to create encr_tz_log bridge, ret = %d\n", ret);
+		goto exit_free_tzlog;
+	}
+	pr_debug("Alloc memory for encr_tz_log, size %zu\n",
+		enc_qseelog_info.size);
+
+	return 0;
+
+exit_free_tzlog:
+	dma_free_coherent(&pdev->dev, enc_tzlog_info.size,
+			enc_tzlog_info.vaddr, enc_tzlog_info.paddr);
+exit_unreg_qseelog:
+	qcom_tzmem_deregister(enc_qseelog_info.shmb_handle);
+exit_free_qseelog:
+	dma_free_coherent(&pdev->dev, enc_qseelog_info.size,
+			enc_qseelog_info.vaddr, enc_qseelog_info.paddr);
+	return -ENOMEM;
+}
+
+static void tzdbg_free_encrypted_log_buf(struct platform_device *pdev)
+{
+	qcom_tzmem_deregister(enc_tzlog_info.shmb_handle);
+	dma_free_coherent(&pdev->dev, enc_tzlog_info.size,
+			enc_tzlog_info.vaddr, enc_tzlog_info.paddr);
+	qcom_tzmem_deregister(enc_qseelog_info.shmb_handle);
+	dma_free_coherent(&pdev->dev, enc_qseelog_info.size,
+			enc_qseelog_info.vaddr, enc_qseelog_info.paddr);
+}
+
+static int  tzdbg_fs_init(struct platform_device *pdev)
+{
+	int rc = 0;
+	int i;
+	struct proc_dir_entry *dent_dir;
+	struct proc_dir_entry *dent;
+
+	dent_dir = proc_mkdir(TZDBG_DIR_NAME, NULL);
+	if (dent_dir == NULL) {
+		dev_err(&pdev->dev, "tzdbg proc_mkdir failed\n");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < TZDBG_STATS_MAX; i++) {
+		tzdbg.debug_tz[i] = i;
+		if (!tzdbg.stat[i].avail)
+			continue;
+
+		dent = proc_create_data(tzdbg.stat[i].name,
+				0444, dent_dir,
+				&tzdbg_fops, &tzdbg.debug_tz[i]);
+		if (dent == NULL) {
+			dev_err(&pdev->dev, "TZ proc_create_data failed\n");
+			rc = -ENOMEM;
+			goto err;
+		}
+	}
+	platform_set_drvdata(pdev, dent_dir);
+	return 0;
+err:
+	remove_proc_subtree(TZDBG_DIR_NAME, NULL);
+
+	return rc;
+}
+
+static void tzdbg_fs_exit(struct platform_device *pdev)
+{
+	struct proc_dir_entry *dent_dir;
+
+	dent_dir = platform_get_drvdata(pdev);
+	if (dent_dir)
+		remove_proc_subtree(TZDBG_DIR_NAME, NULL);
+}
+
+static int __update_hypdbg_base(struct platform_device *pdev,
+			void __iomem *virt_iobase)
+{
+	phys_addr_t hypdiag_phy_iobase;
+	uint32_t hyp_address_offset;
+	uint32_t hyp_size_offset;
+	struct hypdbg_t *hyp;
+	uint32_t *ptr = NULL;
+
+	if (of_property_read_u32((&pdev->dev)->of_node, "hyplog-address-offset",
+							&hyp_address_offset)) {
+		dev_err(&pdev->dev, "hyplog address offset is not defined\n");
+		return -EINVAL;
+	}
+	if (of_property_read_u32((&pdev->dev)->of_node, "hyplog-size-offset",
+							&hyp_size_offset)) {
+		dev_err(&pdev->dev, "hyplog size offset is not defined\n");
+		return -EINVAL;
+	}
+
+	hypdiag_phy_iobase = readl_relaxed(virt_iobase + hyp_address_offset);
+	tzdbg.hyp_debug_rw_buf_size = readl_relaxed(virt_iobase +
+					hyp_size_offset);
+
+	tzdbg.hyp_virt_iobase = devm_ioremap(&pdev->dev,
+					hypdiag_phy_iobase,
+					tzdbg.hyp_debug_rw_buf_size);
+	if (!tzdbg.hyp_virt_iobase) {
+		dev_err(&pdev->dev, "ERROR could not ioremap: start=%pr, len=%u\n",
+			&hypdiag_phy_iobase, tzdbg.hyp_debug_rw_buf_size);
+		return -ENXIO;
+	}
+
+	ptr = kzalloc(tzdbg.hyp_debug_rw_buf_size, GFP_KERNEL);
+	if (!ptr)
+		return -ENOMEM;
+
+	tzdbg.hyp_diag_buf = (struct hypdbg_t *)ptr;
+	hyp = tzdbg.hyp_diag_buf;
+	hyp->log_pos.wrap = hyp->log_pos.offset = 0;
+	return 0;
+}
+
+static int __update_rmlog_base(struct platform_device *pdev,
+			       void __iomem *virt_iobase)
+{
+	uint32_t rmlog_address;
+	uint32_t rmlog_size;
+	uint32_t *ptr = NULL;
+
+	/* if we don't get the node just ignore it */
+	if (of_property_read_u32((&pdev->dev)->of_node, "rmlog-address",
+							&rmlog_address)) {
+		dev_err(&pdev->dev, "RM log address is not defined\n");
+		tzdbg.rmlog_rw_buf_size = 0;
+		return 0;
+	}
+	/* if we don't get the node just ignore it */
+	if (of_property_read_u32((&pdev->dev)->of_node, "rmlog-size",
+							&rmlog_size)) {
+		dev_err(&pdev->dev, "RM log size is not defined\n");
+		tzdbg.rmlog_rw_buf_size = 0;
+		return 0;
+	}
+
+	tzdbg.rmlog_rw_buf_size = rmlog_size;
+
+	/* Check if there is RM log to read */
+	if (!tzdbg.rmlog_rw_buf_size) {
+		tzdbg.rmlog_virt_iobase = NULL;
+		tzdbg.rm_diag_buf = NULL;
+		dev_err(&pdev->dev, "RM log size is %d\n",
+			tzdbg.rmlog_rw_buf_size);
+		return 0;
+	}
+
+	tzdbg.rmlog_virt_iobase = devm_ioremap(&pdev->dev,
+					rmlog_address,
+					rmlog_size);
+	if (!tzdbg.rmlog_virt_iobase) {
+		dev_err(&pdev->dev, "ERROR could not ioremap: start=%u, len=%u\n",
+			rmlog_address, tzdbg.rmlog_rw_buf_size);
+		return -ENXIO;
+	}
+
+	ptr = kzalloc(tzdbg.rmlog_rw_buf_size, GFP_KERNEL);
+	if (!ptr)
+		return -ENOMEM;
+
+	tzdbg.rm_diag_buf = (uint8_t *)ptr;
+	return 0;
+}
+static int tzdbg_get_tz_version(void)
+{
+	u64 version;
+	int ret = 0;
+
+	ret = qcom_scm_get_tz_log_feat_id(&version);
+
+	if (ret) {
+		pr_err("%s: scm_call to get tz version failed\n",
+				__func__);
+		return ret;
+	}
+	tzdbg.tz_version = version;
+
+	ret = qcom_scm_get_tz_feat_id_version(QCOM_SCM_FEAT_DIAG_ID, &version);
+	if (ret) {
+		pr_err("%s: scm_call to get tz diag version failed, ret = %d\n",
+				__func__, ret);
+		return ret;
+	}
+	pr_warn("tz diag version is %llu\n", version);
+	tzdbg.tz_diag_major_version =
+		((version >> TZBSP_FVER_MAJOR_SHIFT) & TZBSP_FVER_MAJOR_MINOR_MASK);
+	tzdbg.tz_diag_minor_version =
+		((version >> TZBSP_FVER_MINOR_SHIFT) & TZBSP_FVER_MAJOR_MINOR_MASK);
+	if (tzdbg.tz_diag_major_version == TZBSP_DIAG_MAJOR_VERSION_V9) {
+		switch (tzdbg.tz_diag_minor_version) {
+		case TZBSP_DIAG_MINOR_VERSION_V2:
+		case TZBSP_DIAG_MINOR_VERSION_V21:
+		case TZBSP_DIAG_MINOR_VERSION_V22:
+			tzdbg.is_enlarged_buf = true;
+			break;
+		default:
+			tzdbg.is_enlarged_buf = false;
+		}
+	} else {
+		tzdbg.is_enlarged_buf = false;
+	}
+	return ret;
+}
+
+static void tzdbg_query_encrypted_log(void)
+{
+	int ret = 0;
+	uint64_t enabled;
+
+	ret = qcom_scm_query_encrypted_log_feature(&enabled);
+	if (ret) {
+		if (ret == -EIO)
+			pr_info("SCM_CALL : SYS CALL NOT SUPPORTED IN TZ\n");
+		else
+			pr_err("scm_call QUERY_ENCR_LOG_FEATURE failed ret %d\n", ret);
+		tzdbg.is_encrypted_log_enabled = false;
+	} else {
+		pr_warn("encrypted qseelog enabled is %llu\n", enabled);
+		tzdbg.is_encrypted_log_enabled = enabled;
+	}
+}
+
+/*
+ * Driver functions
+ */
+static int tz_log_probe(struct platform_device *pdev)
+{
+	struct resource *resource;
+	void __iomem *virt_iobase;
+	phys_addr_t tzdiag_phy_iobase;
+	uint32_t *ptr = NULL;
+	int ret = 0, i;
+
+	/* Defer if qcom_scm is not available */
+	if (!qcom_scm_is_available())
+		return dev_err_probe(&pdev->dev, -EPROBE_DEFER, "qcom_scm is not up!\n");
+
+	/*
+	 * By default all nodes will be created.
+	 * Mark avail as false later selectively if there's need to skip proc node creation.
+	 */
+	for (i = 0; i < TZDBG_STATS_MAX; i++)
+		tzdbg.stat[i].avail = true;
+
+	ret = tzdbg_get_tz_version();
+	if (ret)
+		return ret;
+
+	/*
+	 * This attribute indicates tz_log driver can create share memory through hypervisor,
+	 * which is associated with the share memory that registered by qtee_shmbridge dirver
+	 * with enabling hypervisor support.
+	 */
+	support_hyp = of_property_read_bool((&pdev->dev)->of_node,
+		"qcom,support-hypervisor");
+
+	/*
+	 * Get address that stores the physical location diagnostic data
+	 */
+	resource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!resource) {
+		dev_err(&pdev->dev,
+				"%s: ERROR Missing MEM resource\n", __func__);
+		return -ENXIO;
+	}
+
+	/*
+	 * Get the debug buffer size
+	 */
+	debug_rw_buf_size = resource_size(resource);
+
+	/*
+	 * Map address that stores the physical location diagnostic data
+	 */
+	virt_iobase = devm_ioremap(&pdev->dev, resource->start,
+				debug_rw_buf_size);
+	if (!virt_iobase) {
+		dev_err(&pdev->dev,
+			"%s: ERROR could not ioremap: start=%pr, len=%u\n",
+			__func__, &resource->start,
+			(unsigned int)(debug_rw_buf_size));
+		return -ENXIO;
+	}
+
+	if (pdev->dev.of_node) {
+		tzdbg.is_hyplog_enabled = of_property_read_bool(
+			(&pdev->dev)->of_node, "qcom,hyplog-enabled");
+		if (tzdbg.is_hyplog_enabled) {
+			ret = __update_hypdbg_base(pdev, virt_iobase);
+			if (ret) {
+				dev_err(&pdev->dev,
+					"%s: fail to get hypdbg_base ret %d\n",
+					__func__, ret);
+				return -EINVAL;
+			}
+			ret = __update_rmlog_base(pdev, virt_iobase);
+			if (ret) {
+				dev_err(&pdev->dev,
+					"%s: fail to get rmlog_base ret %d\n",
+					__func__, ret);
+				return -EINVAL;
+			}
+		} else {
+			tzdbg.stat[TZDBG_HYP_LOG].avail = false;
+			tzdbg.stat[TZDBG_HYP_GENERAL].avail = false;
+			tzdbg.stat[TZDBG_RM_LOG].avail = false;
+			dev_info(&pdev->dev, "Hyp log service not support\n");
+		}
+	} else {
+		dev_dbg(&pdev->dev, "Device tree data is not found\n");
+	}
+
+	/*
+	 * Retrieve the address of diagnostic data
+	 */
+	tzdiag_phy_iobase = readl_relaxed(virt_iobase);
+
+	tzdbg_query_encrypted_log();
+	/*
+	 * Map the diagnostic information area if encryption is disabled
+	 */
+	if (!tzdbg.is_encrypted_log_enabled) {
+		tzdbg.virt_iobase = devm_ioremap(&pdev->dev,
+				tzdiag_phy_iobase, debug_rw_buf_size);
+
+		if (!tzdbg.virt_iobase) {
+			dev_err(&pdev->dev,
+				"%s: could not ioremap: start=%pr, len=%u\n",
+				__func__, &tzdiag_phy_iobase,
+				debug_rw_buf_size);
+			return -ENXIO;
+		}
+		/* allocate diag_buf */
+		ptr = kzalloc(debug_rw_buf_size, GFP_KERNEL);
+		if (ptr == NULL)
+			return -ENOMEM;
+		tzdbg.diag_buf = (struct tzdbg_t *)ptr;
+	} else {
+		if ((tzdbg.tz_diag_major_version == TZBSP_DIAG_MAJOR_VERSION_V9) &&
+			(tzdbg.tz_diag_minor_version >= TZBSP_DIAG_MINOR_VERSION_V22))
+			tzdbg.is_full_encrypted_tz_logs_supported = true;
+		if (pdev->dev.of_node) {
+			tzdbg.is_full_encrypted_tz_logs_enabled = of_property_read_bool(
+				(&pdev->dev)->of_node, "qcom,full-encrypted-tz-logs-enabled");
+		}
+	}
+
+	/* Init for tme log */
+	ret = tzdbg_init_tme_log(pdev, virt_iobase);
+	if (ret < 0) {
+		tzdbg.stat[TZDBG_TME_LOG].avail = false;
+		pr_warn("Tme log initialization failed!\n");
+	}
+
+	/* register unencrypted qsee log buffer */
+	ret = tzdbg_register_qsee_log_buf(pdev);
+	if (ret)
+		goto exit_free_diag_buf;
+
+	/* allocate encrypted qsee and tz log buffer */
+	ret = tzdbg_allocate_encrypted_log_buf(pdev);
+	if (ret) {
+		dev_err(&pdev->dev,
+			" %s: Failed to allocate encrypted log buffer\n",
+			__func__);
+		goto exit_free_qsee_log_buf;
+	}
+
+	/* allocate display_buf */
+	if (UINT_MAX/4 < qseelog_buf_size) {
+		pr_err("display_buf_size integer overflow\n");
+		goto exit_free_qsee_log_buf;
+	}
+	display_buf_size = qseelog_buf_size * 4;
+	tzdbg.disp_buf = dma_alloc_coherent(&pdev->dev, display_buf_size,
+		&disp_buf_paddr, GFP_KERNEL);
+	if (tzdbg.disp_buf == NULL) {
+		ret = -ENOMEM;
+		goto exit_free_encr_log_buf;
+	}
+
+	if (tzdbg_fs_init(pdev))
+		goto exit_free_disp_buf;
+	return 0;
+
+exit_free_disp_buf:
+	dma_free_coherent(&pdev->dev, display_buf_size,
+			(void *)tzdbg.disp_buf, disp_buf_paddr);
+exit_free_encr_log_buf:
+	tzdbg_free_encrypted_log_buf(pdev);
+exit_free_qsee_log_buf:
+	tzdbg_free_qsee_log_buf(pdev);
+exit_free_diag_buf:
+	if (!tzdbg.is_encrypted_log_enabled)
+		kfree(tzdbg.diag_buf);
+	return -ENXIO;
+}
+
+static int tz_log_remove(struct platform_device *pdev)
+{
+	tzdbg_fs_exit(pdev);
+	dma_free_coherent(&pdev->dev, display_buf_size,
+			(void *)tzdbg.disp_buf, disp_buf_paddr);
+	tzdbg_free_encrypted_log_buf(pdev);
+	tzdbg_free_qsee_log_buf(pdev);
+	if (!tzdbg.is_encrypted_log_enabled)
+		kfree(tzdbg.diag_buf);
+	return 0;
+}
+
+static const struct of_device_id tzlog_match[] = {
+	{.compatible = "qcom,tz-log"},
+	{}
+};
+
+static struct platform_driver tz_log_driver = {
+	.probe		= tz_log_probe,
+	.remove		= tz_log_remove,
+	.driver		= {
+		.name = "tz_log",
+		.of_match_table = tzlog_match,
+		.probe_type = PROBE_PREFER_ASYNCHRONOUS,
+	},
+};
+
+module_platform_driver(tz_log_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("TZ Log driver");
--- linux-qcom-6.8.0.orig/drivers/firmware/raspberrypi.c
+++ linux-qcom-6.8.0/drivers/firmware/raspberrypi.c
@@ -9,6 +9,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/kref.h>
 #include <linux/mailbox_client.h>
+#include <linux/mailbox_controller.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
@@ -97,8 +98,8 @@
 	if (size & 3)
 		return -EINVAL;
 
-	buf = dma_alloc_coherent(fw->cl.dev, PAGE_ALIGN(size), &bus_addr,
-				 GFP_ATOMIC);
+	buf = dma_alloc_coherent(fw->chan->mbox->dev, PAGE_ALIGN(size),
+				 &bus_addr, GFP_ATOMIC);
 	if (!buf)
 		return -ENOMEM;
 
@@ -126,7 +127,7 @@
 		ret = -EINVAL;
 	}
 
-	dma_free_coherent(fw->cl.dev, PAGE_ALIGN(size), buf, bus_addr);
+	dma_free_coherent(fw->chan->mbox->dev, PAGE_ALIGN(size), buf, bus_addr);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/firmware/smccc/smccc.c
+++ linux-qcom-6.8.0/drivers/firmware/smccc/smccc.c
@@ -16,7 +16,6 @@
 static enum arm_smccc_conduit smccc_conduit = SMCCC_CONDUIT_NONE;
 
 bool __ro_after_init smccc_trng_available = false;
-u64 __ro_after_init smccc_has_sve_hint = false;
 s32 __ro_after_init smccc_soc_id_version = SMCCC_RET_NOT_SUPPORTED;
 s32 __ro_after_init smccc_soc_id_revision = SMCCC_RET_NOT_SUPPORTED;
 
@@ -28,9 +27,6 @@
 	smccc_conduit = conduit;
 
 	smccc_trng_available = smccc_probe_trng();
-	if (IS_ENABLED(CONFIG_ARM64_SVE) &&
-	    smccc_version >= ARM_SMCCC_VERSION_1_3)
-		smccc_has_sve_hint = true;
 
 	if ((smccc_version >= ARM_SMCCC_VERSION_1_2) &&
 	    (smccc_conduit != SMCCC_CONDUIT_NONE)) {
--- linux-qcom-6.8.0.orig/drivers/firmware/sysfb.c
+++ linux-qcom-6.8.0/drivers/firmware/sysfb.c
@@ -29,6 +29,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/pci.h>
 #include <linux/platform_data/simplefb.h>
 #include <linux/platform_device.h>
 #include <linux/screen_info.h>
@@ -38,6 +39,8 @@
 static DEFINE_MUTEX(disable_lock);
 static bool disabled;
 
+static struct device *sysfb_parent_dev(const struct screen_info *si);
+
 static bool sysfb_unregister(void)
 {
 	if (IS_ERR_OR_NULL(pd))
@@ -51,6 +54,7 @@
 
 /**
  * sysfb_disable() - disable the Generic System Framebuffers support
+ * @dev:	the device to check if non-NULL
  *
  * This disables the registration of system framebuffer devices that match the
  * generic drivers that make use of the system framebuffer set up by firmware.
@@ -60,33 +64,85 @@
  * Context: The function can sleep. A @disable_lock mutex is acquired to serialize
  *          against sysfb_init(), that registers a system framebuffer device.
  */
-void sysfb_disable(void)
+void sysfb_disable(struct device *dev)
 {
+	struct screen_info *si = &screen_info;
+	struct device *parent;
+
 	mutex_lock(&disable_lock);
-	sysfb_unregister();
-	disabled = true;
+	parent = sysfb_parent_dev(si);
+	if (!dev || !parent || dev == parent) {
+		sysfb_unregister();
+		disabled = true;
+	}
 	mutex_unlock(&disable_lock);
 }
 EXPORT_SYMBOL_GPL(sysfb_disable);
 
+#if defined(CONFIG_PCI)
+static bool sysfb_pci_dev_is_enabled(struct pci_dev *pdev)
+{
+	/*
+	 * TODO: Try to integrate this code into the PCI subsystem
+	 */
+	int ret;
+	u16 command;
+
+	ret = pci_read_config_word(pdev, PCI_COMMAND, &command);
+	if (ret != PCIBIOS_SUCCESSFUL)
+		return false;
+	if (!(command & PCI_COMMAND_MEMORY))
+		return false;
+	return true;
+}
+#else
+static bool sysfb_pci_dev_is_enabled(struct pci_dev *pdev)
+{
+	return false;
+}
+#endif
+
+static struct device *sysfb_parent_dev(const struct screen_info *si)
+{
+	struct pci_dev *pdev;
+
+	pdev = screen_info_pci_dev(si);
+	if (IS_ERR(pdev)) {
+		return ERR_CAST(pdev);
+	} else if (pdev) {
+		if (!sysfb_pci_dev_is_enabled(pdev))
+			return ERR_PTR(-ENODEV);
+		return &pdev->dev;
+	}
+
+	return NULL;
+}
+
 static __init int sysfb_init(void)
 {
 	struct screen_info *si = &screen_info;
+	struct device *parent;
 	struct simplefb_platform_data mode;
 	const char *name;
 	bool compatible;
 	int ret = 0;
 
+	screen_info_apply_fixups();
+
 	mutex_lock(&disable_lock);
 	if (disabled)
 		goto unlock_mutex;
 
 	sysfb_apply_efi_quirks();
 
+	parent = sysfb_parent_dev(si);
+	if (IS_ERR(parent))
+		goto unlock_mutex;
+
 	/* try to create a simple-framebuffer device */
 	compatible = sysfb_parse_mode(si, &mode);
 	if (compatible) {
-		pd = sysfb_create_simplefb(si, &mode);
+		pd = sysfb_create_simplefb(si, &mode, parent);
 		if (!IS_ERR(pd))
 			goto unlock_mutex;
 	}
@@ -109,6 +165,8 @@
 		goto unlock_mutex;
 	}
 
+	pd->dev.parent = parent;
+
 	sysfb_set_efifb_fwnode(pd);
 
 	ret = platform_device_add_data(pd, si, sizeof(*si));
--- linux-qcom-6.8.0.orig/drivers/firmware/sysfb_simplefb.c
+++ linux-qcom-6.8.0/drivers/firmware/sysfb_simplefb.c
@@ -91,7 +91,8 @@
 }
 
 __init struct platform_device *sysfb_create_simplefb(const struct screen_info *si,
-						     const struct simplefb_platform_data *mode)
+						     const struct simplefb_platform_data *mode,
+						     struct device *parent)
 {
 	struct platform_device *pd;
 	struct resource res;
@@ -143,6 +144,8 @@
 	if (!pd)
 		return ERR_PTR(-ENOMEM);
 
+	pd->dev.parent = parent;
+
 	sysfb_set_efifb_fwnode(pd);
 
 	ret = platform_device_add_resources(pd, &res, 1);
--- linux-qcom-6.8.0.orig/drivers/firmware/tegra/bpmp-debugfs.c
+++ linux-qcom-6.8.0/drivers/firmware/tegra/bpmp-debugfs.c
@@ -77,7 +77,7 @@
 
 	root_path_buf = kzalloc(root_path_buf_len, GFP_KERNEL);
 	if (!root_path_buf)
-		goto out;
+		return NULL;
 
 	root_path = dentry_path(bpmp->debugfs_mirror, root_path_buf,
 				root_path_buf_len);
--- linux-qcom-6.8.0.orig/drivers/firmware/tegra/bpmp.c
+++ linux-qcom-6.8.0/drivers/firmware/tegra/bpmp.c
@@ -24,12 +24,6 @@
 #define MSG_RING	BIT(1)
 #define TAG_SZ		32
 
-static inline struct tegra_bpmp *
-mbox_client_to_bpmp(struct mbox_client *client)
-{
-	return container_of(client, struct tegra_bpmp, mbox.client);
-}
-
 static inline const struct tegra_bpmp_ops *
 channel_to_ops(struct tegra_bpmp_channel *channel)
 {
--- linux-qcom-6.8.0.orig/drivers/firmware/turris-mox-rwtm.c
+++ linux-qcom-6.8.0/drivers/firmware/turris-mox-rwtm.c
@@ -2,7 +2,7 @@
 /*
  * Turris Mox rWTM firmware driver
  *
- * Copyright (C) 2019 Marek Behún <kabel@kernel.org>
+ * Copyright (C) 2019, 2024 Marek Behún <kabel@kernel.org>
  */
 
 #include <linux/armada-37xx-rwtm-mailbox.h>
@@ -174,6 +174,9 @@
 	struct mox_rwtm *rwtm = dev_get_drvdata(cl->dev);
 	struct armada_37xx_rwtm_rx_msg *msg = data;
 
+	if (completion_done(&rwtm->cmd_done))
+		return;
+
 	rwtm->reply = *msg;
 	complete(&rwtm->cmd_done);
 }
@@ -199,9 +202,8 @@
 	if (ret < 0)
 		return ret;
 
-	ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2);
-	if (ret < 0)
-		return ret;
+	if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2))
+		return -ETIMEDOUT;
 
 	ret = mox_get_status(MBOX_CMD_BOARD_INFO, reply->retval);
 	if (ret == -ENODATA) {
@@ -235,9 +237,8 @@
 	if (ret < 0)
 		return ret;
 
-	ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2);
-	if (ret < 0)
-		return ret;
+	if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2))
+		return -ETIMEDOUT;
 
 	ret = mox_get_status(MBOX_CMD_ECDSA_PUB_KEY, reply->retval);
 	if (ret == -ENODATA) {
@@ -274,9 +275,8 @@
 	if (ret < 0)
 		return ret;
 
-	ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2);
-	if (ret < 0)
-		return ret;
+	if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2))
+		return -ETIMEDOUT;
 
 	return mox_get_status(MBOX_CMD_GET_RANDOM, rwtm->reply.retval);
 }
@@ -499,6 +499,7 @@
 	platform_set_drvdata(pdev, rwtm);
 
 	mutex_init(&rwtm->busy);
+	init_completion(&rwtm->cmd_done);
 
 	rwtm->mbox_client.dev = dev;
 	rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback;
@@ -512,8 +513,6 @@
 		goto remove_files;
 	}
 
-	init_completion(&rwtm->cmd_done);
-
 	ret = mox_get_board_info(rwtm);
 	if (ret < 0)
 		dev_warn(dev, "Cannot read board information: %i\n", ret);
--- linux-qcom-6.8.0.orig/drivers/fpga/dfl-pci.c
+++ linux-qcom-6.8.0/drivers/fpga/dfl-pci.c
@@ -78,6 +78,7 @@
 #define PCIE_DEVICE_ID_SILICOM_PAC_N5011	0x1001
 #define PCIE_DEVICE_ID_INTEL_DFL		0xbcce
 /* PCI Subdevice ID for PCIE_DEVICE_ID_INTEL_DFL */
+#define PCIE_SUBDEVICE_ID_INTEL_D5005		0x138d
 #define PCIE_SUBDEVICE_ID_INTEL_N6000		0x1770
 #define PCIE_SUBDEVICE_ID_INTEL_N6001		0x1771
 #define PCIE_SUBDEVICE_ID_INTEL_C6100		0x17d4
@@ -102,6 +103,8 @@
 	{PCI_DEVICE(PCI_VENDOR_ID_SILICOM_DENMARK, PCIE_DEVICE_ID_SILICOM_PAC_N5010),},
 	{PCI_DEVICE(PCI_VENDOR_ID_SILICOM_DENMARK, PCIE_DEVICE_ID_SILICOM_PAC_N5011),},
 	{PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_DFL,
+			PCI_VENDOR_ID_INTEL, PCIE_SUBDEVICE_ID_INTEL_D5005),},
+	{PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_DFL,
 			PCI_VENDOR_ID_INTEL, PCIE_SUBDEVICE_ID_INTEL_N6000),},
 	{PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_DFL_VF,
 			PCI_VENDOR_ID_INTEL, PCIE_SUBDEVICE_ID_INTEL_N6000),},
--- linux-qcom-6.8.0.orig/drivers/fpga/fpga-bridge.c
+++ linux-qcom-6.8.0/drivers/fpga/fpga-bridge.c
@@ -55,33 +55,26 @@
 }
 EXPORT_SYMBOL_GPL(fpga_bridge_disable);
 
-static struct fpga_bridge *__fpga_bridge_get(struct device *dev,
+static struct fpga_bridge *__fpga_bridge_get(struct device *bridge_dev,
 					     struct fpga_image_info *info)
 {
 	struct fpga_bridge *bridge;
-	int ret = -ENODEV;
 
-	bridge = to_fpga_bridge(dev);
+	bridge = to_fpga_bridge(bridge_dev);
 
 	bridge->info = info;
 
-	if (!mutex_trylock(&bridge->mutex)) {
-		ret = -EBUSY;
-		goto err_dev;
-	}
+	if (!mutex_trylock(&bridge->mutex))
+		return ERR_PTR(-EBUSY);
 
-	if (!try_module_get(dev->parent->driver->owner))
-		goto err_ll_mod;
+	if (!try_module_get(bridge->br_ops_owner)) {
+		mutex_unlock(&bridge->mutex);
+		return ERR_PTR(-ENODEV);
+	}
 
 	dev_dbg(&bridge->dev, "get\n");
 
 	return bridge;
-
-err_ll_mod:
-	mutex_unlock(&bridge->mutex);
-err_dev:
-	put_device(dev);
-	return ERR_PTR(ret);
 }
 
 /**
@@ -98,13 +91,18 @@
 struct fpga_bridge *of_fpga_bridge_get(struct device_node *np,
 				       struct fpga_image_info *info)
 {
-	struct device *dev;
+	struct fpga_bridge *bridge;
+	struct device *bridge_dev;
 
-	dev = class_find_device_by_of_node(&fpga_bridge_class, np);
-	if (!dev)
+	bridge_dev = class_find_device_by_of_node(&fpga_bridge_class, np);
+	if (!bridge_dev)
 		return ERR_PTR(-ENODEV);
 
-	return __fpga_bridge_get(dev, info);
+	bridge = __fpga_bridge_get(bridge_dev, info);
+	if (IS_ERR(bridge))
+		put_device(bridge_dev);
+
+	return bridge;
 }
 EXPORT_SYMBOL_GPL(of_fpga_bridge_get);
 
@@ -125,6 +123,7 @@
 struct fpga_bridge *fpga_bridge_get(struct device *dev,
 				    struct fpga_image_info *info)
 {
+	struct fpga_bridge *bridge;
 	struct device *bridge_dev;
 
 	bridge_dev = class_find_device(&fpga_bridge_class, NULL, dev,
@@ -132,7 +131,11 @@
 	if (!bridge_dev)
 		return ERR_PTR(-ENODEV);
 
-	return __fpga_bridge_get(bridge_dev, info);
+	bridge = __fpga_bridge_get(bridge_dev, info);
+	if (IS_ERR(bridge))
+		put_device(bridge_dev);
+
+	return bridge;
 }
 EXPORT_SYMBOL_GPL(fpga_bridge_get);
 
@@ -146,7 +149,7 @@
 	dev_dbg(&bridge->dev, "put\n");
 
 	bridge->info = NULL;
-	module_put(bridge->dev.parent->driver->owner);
+	module_put(bridge->br_ops_owner);
 	mutex_unlock(&bridge->mutex);
 	put_device(&bridge->dev);
 }
@@ -316,18 +319,19 @@
 ATTRIBUTE_GROUPS(fpga_bridge);
 
 /**
- * fpga_bridge_register - create and register an FPGA Bridge device
+ * __fpga_bridge_register - create and register an FPGA Bridge device
  * @parent:	FPGA bridge device from pdev
  * @name:	FPGA bridge name
  * @br_ops:	pointer to structure of fpga bridge ops
  * @priv:	FPGA bridge private data
+ * @owner:	owner module containing the br_ops
  *
  * Return: struct fpga_bridge pointer or ERR_PTR()
  */
 struct fpga_bridge *
-fpga_bridge_register(struct device *parent, const char *name,
-		     const struct fpga_bridge_ops *br_ops,
-		     void *priv)
+__fpga_bridge_register(struct device *parent, const char *name,
+		       const struct fpga_bridge_ops *br_ops,
+		       void *priv, struct module *owner)
 {
 	struct fpga_bridge *bridge;
 	int id, ret;
@@ -357,6 +361,7 @@
 
 	bridge->name = name;
 	bridge->br_ops = br_ops;
+	bridge->br_ops_owner = owner;
 	bridge->priv = priv;
 
 	bridge->dev.groups = br_ops->groups;
@@ -386,7 +391,7 @@
 
 	return ERR_PTR(ret);
 }
-EXPORT_SYMBOL_GPL(fpga_bridge_register);
+EXPORT_SYMBOL_GPL(__fpga_bridge_register);
 
 /**
  * fpga_bridge_unregister - unregister an FPGA bridge
--- linux-qcom-6.8.0.orig/drivers/fpga/fpga-mgr.c
+++ linux-qcom-6.8.0/drivers/fpga/fpga-mgr.c
@@ -664,20 +664,16 @@
 };
 ATTRIBUTE_GROUPS(fpga_mgr);
 
-static struct fpga_manager *__fpga_mgr_get(struct device *dev)
+static struct fpga_manager *__fpga_mgr_get(struct device *mgr_dev)
 {
 	struct fpga_manager *mgr;
 
-	mgr = to_fpga_manager(dev);
+	mgr = to_fpga_manager(mgr_dev);
 
-	if (!try_module_get(dev->parent->driver->owner))
-		goto err_dev;
+	if (!try_module_get(mgr->mops_owner))
+		mgr = ERR_PTR(-ENODEV);
 
 	return mgr;
-
-err_dev:
-	put_device(dev);
-	return ERR_PTR(-ENODEV);
 }
 
 static int fpga_mgr_dev_match(struct device *dev, const void *data)
@@ -693,12 +689,18 @@
  */
 struct fpga_manager *fpga_mgr_get(struct device *dev)
 {
-	struct device *mgr_dev = class_find_device(&fpga_mgr_class, NULL, dev,
-						   fpga_mgr_dev_match);
+	struct fpga_manager *mgr;
+	struct device *mgr_dev;
+
+	mgr_dev = class_find_device(&fpga_mgr_class, NULL, dev, fpga_mgr_dev_match);
 	if (!mgr_dev)
 		return ERR_PTR(-ENODEV);
 
-	return __fpga_mgr_get(mgr_dev);
+	mgr = __fpga_mgr_get(mgr_dev);
+	if (IS_ERR(mgr))
+		put_device(mgr_dev);
+
+	return mgr;
 }
 EXPORT_SYMBOL_GPL(fpga_mgr_get);
 
@@ -711,13 +713,18 @@
  */
 struct fpga_manager *of_fpga_mgr_get(struct device_node *node)
 {
-	struct device *dev;
+	struct fpga_manager *mgr;
+	struct device *mgr_dev;
 
-	dev = class_find_device_by_of_node(&fpga_mgr_class, node);
-	if (!dev)
+	mgr_dev = class_find_device_by_of_node(&fpga_mgr_class, node);
+	if (!mgr_dev)
 		return ERR_PTR(-ENODEV);
 
-	return __fpga_mgr_get(dev);
+	mgr = __fpga_mgr_get(mgr_dev);
+	if (IS_ERR(mgr))
+		put_device(mgr_dev);
+
+	return mgr;
 }
 EXPORT_SYMBOL_GPL(of_fpga_mgr_get);
 
@@ -727,7 +734,7 @@
  */
 void fpga_mgr_put(struct fpga_manager *mgr)
 {
-	module_put(mgr->dev.parent->driver->owner);
+	module_put(mgr->mops_owner);
 	put_device(&mgr->dev);
 }
 EXPORT_SYMBOL_GPL(fpga_mgr_put);
@@ -766,9 +773,10 @@
 EXPORT_SYMBOL_GPL(fpga_mgr_unlock);
 
 /**
- * fpga_mgr_register_full - create and register an FPGA Manager device
+ * __fpga_mgr_register_full - create and register an FPGA Manager device
  * @parent:	fpga manager device from pdev
  * @info:	parameters for fpga manager
+ * @owner:	owner module containing the ops
  *
  * The caller of this function is responsible for calling fpga_mgr_unregister().
  * Using devm_fpga_mgr_register_full() instead is recommended.
@@ -776,7 +784,8 @@
  * Return: pointer to struct fpga_manager pointer or ERR_PTR()
  */
 struct fpga_manager *
-fpga_mgr_register_full(struct device *parent, const struct fpga_manager_info *info)
+__fpga_mgr_register_full(struct device *parent, const struct fpga_manager_info *info,
+			 struct module *owner)
 {
 	const struct fpga_manager_ops *mops = info->mops;
 	struct fpga_manager *mgr;
@@ -804,6 +813,8 @@
 
 	mutex_init(&mgr->ref_mutex);
 
+	mgr->mops_owner = owner;
+
 	mgr->name = info->name;
 	mgr->mops = info->mops;
 	mgr->priv = info->priv;
@@ -841,14 +852,15 @@
 
 	return ERR_PTR(ret);
 }
-EXPORT_SYMBOL_GPL(fpga_mgr_register_full);
+EXPORT_SYMBOL_GPL(__fpga_mgr_register_full);
 
 /**
- * fpga_mgr_register - create and register an FPGA Manager device
+ * __fpga_mgr_register - create and register an FPGA Manager device
  * @parent:	fpga manager device from pdev
  * @name:	fpga manager name
  * @mops:	pointer to structure of fpga manager ops
  * @priv:	fpga manager private data
+ * @owner:	owner module containing the ops
  *
  * The caller of this function is responsible for calling fpga_mgr_unregister().
  * Using devm_fpga_mgr_register() instead is recommended. This simple
@@ -859,8 +871,8 @@
  * Return: pointer to struct fpga_manager pointer or ERR_PTR()
  */
 struct fpga_manager *
-fpga_mgr_register(struct device *parent, const char *name,
-		  const struct fpga_manager_ops *mops, void *priv)
+__fpga_mgr_register(struct device *parent, const char *name,
+		    const struct fpga_manager_ops *mops, void *priv, struct module *owner)
 {
 	struct fpga_manager_info info = { 0 };
 
@@ -868,9 +880,9 @@
 	info.mops = mops;
 	info.priv = priv;
 
-	return fpga_mgr_register_full(parent, &info);
+	return __fpga_mgr_register_full(parent, &info, owner);
 }
-EXPORT_SYMBOL_GPL(fpga_mgr_register);
+EXPORT_SYMBOL_GPL(__fpga_mgr_register);
 
 /**
  * fpga_mgr_unregister - unregister an FPGA manager
@@ -900,9 +912,10 @@
 }
 
 /**
- * devm_fpga_mgr_register_full - resource managed variant of fpga_mgr_register()
+ * __devm_fpga_mgr_register_full - resource managed variant of fpga_mgr_register()
  * @parent:	fpga manager device from pdev
  * @info:	parameters for fpga manager
+ * @owner:	owner module containing the ops
  *
  * Return:  fpga manager pointer on success, negative error code otherwise.
  *
@@ -910,7 +923,8 @@
  * function will be called automatically when the managing device is detached.
  */
 struct fpga_manager *
-devm_fpga_mgr_register_full(struct device *parent, const struct fpga_manager_info *info)
+__devm_fpga_mgr_register_full(struct device *parent, const struct fpga_manager_info *info,
+			      struct module *owner)
 {
 	struct fpga_mgr_devres *dr;
 	struct fpga_manager *mgr;
@@ -919,7 +933,7 @@
 	if (!dr)
 		return ERR_PTR(-ENOMEM);
 
-	mgr = fpga_mgr_register_full(parent, info);
+	mgr = __fpga_mgr_register_full(parent, info, owner);
 	if (IS_ERR(mgr)) {
 		devres_free(dr);
 		return mgr;
@@ -930,14 +944,15 @@
 
 	return mgr;
 }
-EXPORT_SYMBOL_GPL(devm_fpga_mgr_register_full);
+EXPORT_SYMBOL_GPL(__devm_fpga_mgr_register_full);
 
 /**
- * devm_fpga_mgr_register - resource managed variant of fpga_mgr_register()
+ * __devm_fpga_mgr_register - resource managed variant of fpga_mgr_register()
  * @parent:	fpga manager device from pdev
  * @name:	fpga manager name
  * @mops:	pointer to structure of fpga manager ops
  * @priv:	fpga manager private data
+ * @owner:	owner module containing the ops
  *
  * Return:  fpga manager pointer on success, negative error code otherwise.
  *
@@ -946,8 +961,9 @@
  * device is detached.
  */
 struct fpga_manager *
-devm_fpga_mgr_register(struct device *parent, const char *name,
-		       const struct fpga_manager_ops *mops, void *priv)
+__devm_fpga_mgr_register(struct device *parent, const char *name,
+			 const struct fpga_manager_ops *mops, void *priv,
+			 struct module *owner)
 {
 	struct fpga_manager_info info = { 0 };
 
@@ -955,9 +971,9 @@
 	info.mops = mops;
 	info.priv = priv;
 
-	return devm_fpga_mgr_register_full(parent, &info);
+	return __devm_fpga_mgr_register_full(parent, &info, owner);
 }
-EXPORT_SYMBOL_GPL(devm_fpga_mgr_register);
+EXPORT_SYMBOL_GPL(__devm_fpga_mgr_register);
 
 static void fpga_mgr_dev_release(struct device *dev)
 {
--- linux-qcom-6.8.0.orig/drivers/fpga/fpga-region.c
+++ linux-qcom-6.8.0/drivers/fpga/fpga-region.c
@@ -53,7 +53,7 @@
 	}
 
 	get_device(dev);
-	if (!try_module_get(dev->parent->driver->owner)) {
+	if (!try_module_get(region->ops_owner)) {
 		put_device(dev);
 		mutex_unlock(&region->mutex);
 		return ERR_PTR(-ENODEV);
@@ -75,7 +75,7 @@
 
 	dev_dbg(dev, "put\n");
 
-	module_put(dev->parent->driver->owner);
+	module_put(region->ops_owner);
 	put_device(dev);
 	mutex_unlock(&region->mutex);
 }
@@ -181,14 +181,16 @@
 ATTRIBUTE_GROUPS(fpga_region);
 
 /**
- * fpga_region_register_full - create and register an FPGA Region device
+ * __fpga_region_register_full - create and register an FPGA Region device
  * @parent: device parent
  * @info: parameters for FPGA Region
+ * @owner: module containing the get_bridges function
  *
  * Return: struct fpga_region or ERR_PTR()
  */
 struct fpga_region *
-fpga_region_register_full(struct device *parent, const struct fpga_region_info *info)
+__fpga_region_register_full(struct device *parent, const struct fpga_region_info *info,
+			    struct module *owner)
 {
 	struct fpga_region *region;
 	int id, ret = 0;
@@ -213,6 +215,7 @@
 	region->compat_id = info->compat_id;
 	region->priv = info->priv;
 	region->get_bridges = info->get_bridges;
+	region->ops_owner = owner;
 
 	mutex_init(&region->mutex);
 	INIT_LIST_HEAD(&region->bridge_list);
@@ -241,13 +244,14 @@
 
 	return ERR_PTR(ret);
 }
-EXPORT_SYMBOL_GPL(fpga_region_register_full);
+EXPORT_SYMBOL_GPL(__fpga_region_register_full);
 
 /**
- * fpga_region_register - create and register an FPGA Region device
+ * __fpga_region_register - create and register an FPGA Region device
  * @parent: device parent
  * @mgr: manager that programs this region
  * @get_bridges: optional function to get bridges to a list
+ * @owner: module containing the get_bridges function
  *
  * This simple version of the register function should be sufficient for most users.
  * The fpga_region_register_full() function is available for users that need to
@@ -256,17 +260,17 @@
  * Return: struct fpga_region or ERR_PTR()
  */
 struct fpga_region *
-fpga_region_register(struct device *parent, struct fpga_manager *mgr,
-		     int (*get_bridges)(struct fpga_region *))
+__fpga_region_register(struct device *parent, struct fpga_manager *mgr,
+		       int (*get_bridges)(struct fpga_region *), struct module *owner)
 {
 	struct fpga_region_info info = { 0 };
 
 	info.mgr = mgr;
 	info.get_bridges = get_bridges;
 
-	return fpga_region_register_full(parent, &info);
+	return __fpga_region_register_full(parent, &info, owner);
 }
-EXPORT_SYMBOL_GPL(fpga_region_register);
+EXPORT_SYMBOL_GPL(__fpga_region_register);
 
 /**
  * fpga_region_unregister - unregister an FPGA region
--- linux-qcom-6.8.0.orig/drivers/gpio/Kconfig
+++ linux-qcom-6.8.0/drivers/gpio/Kconfig
@@ -711,7 +711,8 @@
 	  Say yes here to support UniPhier GPIOs.
 
 config GPIO_VF610
-	def_bool y
+	bool "VF610 GPIO support"
+	default y if SOC_VF610
 	depends on ARCH_MXC
 	select GPIOLIB_IRQCHIP
 	help
@@ -1526,7 +1527,7 @@
 	  are "output only" GPIOs.
 
 config GPIO_TQMX86
-	tristate "TQ-Systems QTMX86 GPIO"
+	tristate "TQ-Systems TQMx86 GPIO"
 	depends on MFD_TQMX86 || COMPILE_TEST
 	depends on HAS_IOPORT_MAP
 	select GPIOLIB_IRQCHIP
@@ -1586,6 +1587,18 @@
 menu "PCI GPIO expanders"
 	depends on PCI
 
+config GPIO_AAEON
+	tristate "AAEON GPIO support"
+	depends on ASUS_WMI
+	depends on UBUNTU_ODM_DRIVERS
+	select MFD_AAEON
+	help
+	  Say yes here to support GPIO pins on Single Board Computers produced
+	  by AAEON.
+
+	  This driver leverages the ASUS WMI interface to access device
+	  resources.
+
 config GPIO_AMD8111
 	tristate "AMD 8111 GPIO driver"
 	depends on X86 || COMPILE_TEST
@@ -1793,6 +1806,8 @@
 
 config GPIO_AGGREGATOR
 	tristate "GPIO Aggregator"
+	select CONFIGFS_FS
+	select DEV_SYNC_PROBE
 	help
 	  Say yes here to enable the GPIO Aggregator, which provides a way to
 	  aggregate existing GPIO lines into a new virtual GPIO chip.
@@ -1842,3 +1857,6 @@
 endmenu
 
 endif
+
+config DEV_SYNC_PROBE
+	tristate
--- linux-qcom-6.8.0.orig/drivers/gpio/Makefile
+++ linux-qcom-6.8.0/drivers/gpio/Makefile
@@ -19,11 +19,15 @@
 # directly supported by gpio-generic
 gpio-generic-$(CONFIG_GPIO_GENERIC)	+= gpio-mmio.o
 
+# Utilities for drivers that need synchronous fake device creation
+obj-$(CONFIG_DEV_SYNC_PROBE)		+= dev-sync-probe.o
+
 obj-$(CONFIG_GPIO_104_DIO_48E)		+= gpio-104-dio-48e.o
 obj-$(CONFIG_GPIO_104_IDI_48)		+= gpio-104-idi-48.o
 obj-$(CONFIG_GPIO_104_IDIO_16)		+= gpio-104-idio-16.o
 obj-$(CONFIG_GPIO_74X164)		+= gpio-74x164.o
 obj-$(CONFIG_GPIO_74XX_MMIO)		+= gpio-74xx-mmio.o
+obj-$(CONFIG_GPIO_AAEON)                += gpio-aaeon.o
 obj-$(CONFIG_GPIO_ADNP)			+= gpio-adnp.o
 obj-$(CONFIG_GPIO_ADP5520)		+= gpio-adp5520.o
 obj-$(CONFIG_GPIO_AGGREGATOR)		+= gpio-aggregator.o
--- linux-qcom-6.8.0.orig/drivers/gpio/dev-sync-probe.c
+++ linux-qcom-6.8.0/drivers/gpio/dev-sync-probe.c
@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Common code for drivers creating fake platform devices.
+ *
+ * Provides synchronous device creation: waits for probe completion and
+ * returns the probe success or error status to the device creator.
+ *
+ * Copyright (C) 2021 Bartosz Golaszewski<brgl@bgdev.pl>
+ * Copyright (C) 2025 Koichiro Den<koichiro.den@canonical.com>
+ */
+
+#include <linux/device.h>
+#include <linux/slab.h>
+
+#include "dev-sync-probe.h"
+
+static int dev_sync_probe_notifier_call(struct notifier_block *nb,
+					unsigned long action, void *data)
+{
+	struct dev_sync_probe_data *pdata;
+	struct device *dev = data;
+
+	pdata = container_of(nb, struct dev_sync_probe_data, bus_notifier);
+	if (!device_match_name(dev, pdata->name))
+		return NOTIFY_DONE;
+
+	switch (action) {
+	case BUS_NOTIFY_BOUND_DRIVER:
+		pdata->driver_bound = true;
+		break;
+	case BUS_NOTIFY_DRIVER_NOT_BOUND:
+		pdata->driver_bound = false;
+		break;
+	default:
+		return NOTIFY_DONE;
+	}
+
+	complete(&pdata->probe_completion);
+	return NOTIFY_OK;
+}
+
+void dev_sync_probe_init(struct dev_sync_probe_data *data)
+{
+	memset(data, 0, sizeof(*data));
+	init_completion(&data->probe_completion);
+	data->bus_notifier.notifier_call = dev_sync_probe_notifier_call;
+}
+EXPORT_SYMBOL_GPL(dev_sync_probe_init);
+
+int dev_sync_probe_register(struct dev_sync_probe_data *data,
+			    struct platform_device_info *pdevinfo)
+{
+	struct platform_device *pdev;
+	char *name;
+
+	name = kasprintf(GFP_KERNEL, "%s.%d", pdevinfo->name, pdevinfo->id);
+	if (!name)
+		return -ENOMEM;
+
+	data->driver_bound = false;
+	data->name = name;
+	reinit_completion(&data->probe_completion);
+	bus_register_notifier(&platform_bus_type, &data->bus_notifier);
+
+	pdev = platform_device_register_full(pdevinfo);
+	if (IS_ERR(pdev)) {
+		bus_unregister_notifier(&platform_bus_type, &data->bus_notifier);
+		kfree(data->name);
+		return PTR_ERR(pdev);
+	}
+
+	wait_for_completion(&data->probe_completion);
+	bus_unregister_notifier(&platform_bus_type, &data->bus_notifier);
+
+	if (!data->driver_bound) {
+		platform_device_unregister(pdev);
+		kfree(data->name);
+		return -ENXIO;
+	}
+
+	data->pdev = pdev;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(dev_sync_probe_register);
+
+void dev_sync_probe_unregister(struct dev_sync_probe_data *data)
+{
+	platform_device_unregister(data->pdev);
+	kfree(data->name);
+	data->pdev = NULL;
+}
+EXPORT_SYMBOL_GPL(dev_sync_probe_unregister);
+
+MODULE_AUTHOR("Bartosz Golaszewski<brgl@bgdev.pl>");
+MODULE_AUTHOR("Koichiro Den<koichiro.den@canonical.com>");
+MODULE_DESCRIPTION("Utilities for synchronous fake device creation");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/gpio/dev-sync-probe.h
+++ linux-qcom-6.8.0/drivers/gpio/dev-sync-probe.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef DEV_SYNC_PROBE_H
+#define DEV_SYNC_PROBE_H
+
+#include <linux/completion.h>
+#include <linux/notifier.h>
+#include <linux/platform_device.h>
+
+struct dev_sync_probe_data {
+	struct platform_device *pdev;
+	const char *name;
+
+	/* Synchronize with probe */
+	struct notifier_block bus_notifier;
+	struct completion probe_completion;
+	bool driver_bound;
+};
+
+void dev_sync_probe_init(struct dev_sync_probe_data *data);
+int dev_sync_probe_register(struct dev_sync_probe_data *data,
+			    struct platform_device_info *pdevinfo);
+void dev_sync_probe_unregister(struct dev_sync_probe_data *data);
+
+#endif /* DEV_SYNC_PROBE_H */
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-aaeon.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-aaeon.c
@@ -0,0 +1,205 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * AAEON GPIO driver
+ * Copyright (c) 2021, AAEON Ltd.
+ *
+ * Author: Edward Lin <edward1_lin@aaeon.com.tw>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/acpi.h>
+#include <linux/bitops.h>
+#include <linux/gpio/driver.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/platform_data/x86/asus-wmi.h>
+#include <linux/platform_device.h>
+
+#define DRVNAME "gpio_aaeon"
+#define ASUS_NB_WMI_EVENT_GUID   "0B3CBB35-E3C2-45ED-91C2-4C5A6D195D1C"
+#define AAEON_WMI_MGMT_GUID      "97845ED0-4E6D-11DE-8A39-0800200C9A66"
+
+#define GET_GPIO_NUMBER_ID       0x00010000
+#define GET_LEVEL_METHOD_ID      0x00010001
+#define SET_LEVEL_METHOD_ID      0x00010002
+#define GET_DIRECTION_METHOD_ID  0x00010003
+#define SET_DIRECTION_METHOD_ID  0x00010004
+#define GET_SIO_NUMBER_METHOD_ID 0xF0010
+
+struct aaeon_gpio_bank {
+	struct gpio_chip chip;
+	unsigned int regbase;
+	struct aaeon_gpio_data *data;
+};
+
+struct aaeon_gpio_data {
+	int nr_bank;
+	struct aaeon_gpio_bank *bank;
+};
+
+static int aaeon_gpio_get_number(void);
+static int aaeon_gpio_get_direction(struct gpio_chip *chip,
+				 unsigned int offset);
+static int aaeon_gpio_output_set_direction(struct gpio_chip *chip,
+				 unsigned int offset, int value);
+static int aaeon_gpio_input_set_direction(struct gpio_chip *chip,
+				 unsigned int offset);
+static int aaeon_gpio_get(struct gpio_chip *chip,
+				 unsigned int offset);
+static void aaeon_gpio_set(struct gpio_chip *chip, unsigned int offset,
+				 int value);
+
+#define AAEON_GPIO_BANK(_base, _ngpio, _regbase)			\
+{									\
+	.chip = {							\
+		.label            = DRVNAME,				\
+		.owner            = THIS_MODULE,			\
+		.get_direction    = aaeon_gpio_get_direction,		\
+		.direction_input  = aaeon_gpio_input_set_direction,     \
+		.direction_output = aaeon_gpio_output_set_direction,    \
+		.get              = aaeon_gpio_get,			\
+		.set              = aaeon_gpio_set,			\
+		.base             = _base,				\
+		.ngpio            = _ngpio,				\
+		.can_sleep        = true,				\
+	},								\
+	.regbase = _regbase,						\
+}
+
+static struct aaeon_gpio_bank aaeon_gpio_bank[] = {
+	AAEON_GPIO_BANK(0, 0, 0xF0),
+};
+
+static int aaeon_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+{
+	int err, retval;
+	u32 dev_id = 0x0;
+
+	dev_id |= offset;
+	err = asus_wmi_evaluate_method(GET_DIRECTION_METHOD_ID, dev_id,
+				       0, &retval);
+	if (err)
+		return err;
+
+	return retval;
+}
+
+static int aaeon_gpio_input_set_direction(struct gpio_chip *chip,
+					  unsigned int offset)
+{
+	int err, retval;
+	u32 dev_id;
+
+	dev_id = BIT(16) | offset;
+	err = asus_wmi_evaluate_method(SET_DIRECTION_METHOD_ID, dev_id,
+				       0, &retval);
+	if (err)
+		return err;
+
+	return retval;
+}
+
+static int aaeon_gpio_output_set_direction(struct gpio_chip *chip,
+					   unsigned int offset, int value)
+{
+	int err, retval;
+	u32 dev_id = 0x0;
+
+	dev_id |= offset;
+	err = asus_wmi_evaluate_method(SET_DIRECTION_METHOD_ID, dev_id,
+				       0, &retval);
+	if (err)
+		return err;
+
+	return retval;
+}
+
+static int aaeon_gpio_get(struct gpio_chip *chip, unsigned int offset)
+{
+	int err, retval;
+	u32 dev_id = 0x0;
+
+	dev_id |= offset;
+	err = asus_wmi_evaluate_method(GET_LEVEL_METHOD_ID, dev_id, 0, &retval);
+	if (err)
+		return err;
+
+	return retval;
+}
+
+static void aaeon_gpio_set(struct gpio_chip *chip, unsigned int offset,
+			   int value)
+{
+	int retval;
+	u32 dev_id = offset;
+
+	if (value)
+		dev_id = BIT(16) | dev_id;
+
+	asus_wmi_evaluate_method(SET_LEVEL_METHOD_ID, dev_id, 0, &retval);
+}
+
+static int aaeon_gpio_get_number(void)
+{
+	int err, retval;
+
+	err = asus_wmi_evaluate_method(GET_GPIO_NUMBER_ID,
+				       GET_SIO_NUMBER_METHOD_ID,
+				       0, &retval);
+	if (err)
+		return err;
+
+	return retval;
+}
+
+static int __init aaeon_gpio_probe(struct platform_device *pdev)
+{
+	int err, i;
+	int dio_number = 0;
+	struct aaeon_gpio_data *data;
+	struct aaeon_gpio_bank *bank;
+
+	/* Prevent other drivers adding this platfom device */
+	if (!wmi_has_guid(AAEON_WMI_MGMT_GUID)) {
+		pr_debug("AAEON Management GUID not found\n");
+		return -ENODEV;
+	}
+
+	dio_number = aaeon_gpio_get_number();
+	if (dio_number < 0)
+		return -ENODEV;
+
+	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	data->nr_bank = ARRAY_SIZE(aaeon_gpio_bank);
+	data->bank = aaeon_gpio_bank;
+	platform_set_drvdata(pdev, data);
+	bank = &data->bank[0];
+	bank->chip.parent = &pdev->dev;
+	bank->chip.ngpio = dio_number;
+	bank->data = data;
+	err = devm_gpiochip_add_data(&pdev->dev, &bank->chip, bank);
+	if (err)
+		pr_debug("Failed to register gpiochip %d: %d\n", i, err);
+
+	return err;
+}
+
+static struct platform_driver aaeon_gpio_driver = {
+	.driver = {
+		.name = "gpio-aaeon",
+	},
+};
+
+module_platform_driver_probe(aaeon_gpio_driver, aaeon_gpio_probe);
+
+MODULE_ALIAS("platform:gpio-aaeon");
+MODULE_DESCRIPTION("AAEON GPIO Driver");
+MODULE_AUTHOR("Edward Lin <edward1_lin@aaeon.com.tw>");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-aggregator.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-aggregator.c
@@ -9,10 +9,13 @@
 
 #include <linux/bitmap.h>
 #include <linux/bitops.h>
+#include <linux/configfs.h>
 #include <linux/ctype.h>
 #include <linux/delay.h>
 #include <linux/idr.h>
 #include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/lockdep.h>
 #include <linux/mod_devicetable.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
@@ -27,23 +30,88 @@
 #include <linux/gpio/driver.h>
 #include <linux/gpio/machine.h>
 
+#include "dev-sync-probe.h"
+
 #define AGGREGATOR_MAX_GPIOS 512
+#define AGGREGATOR_LEGACY_PREFIX "_sysfs"
 
 /*
  * GPIO Aggregator sysfs interface
  */
 
 struct gpio_aggregator {
+	struct dev_sync_probe_data probe_data;
+	struct config_group group;
 	struct gpiod_lookup_table *lookups;
-	struct platform_device *pdev;
+	struct mutex lock;
+	int id;
+
+	/* List of gpio_aggregator_line. Always added in order */
+	struct list_head list_head;
+
+	/* used by legacy sysfs interface only */
+	bool init_via_sysfs;
 	char args[];
 };
 
+struct gpio_aggregator_line {
+	struct config_group group;
+	struct gpio_aggregator *parent;
+	struct list_head entry;
+
+	/* Line index within the aggregator device */
+	unsigned int idx;
+
+	/* Custom name for the virtual line */
+	const char *name;
+	/* GPIO chip label or line name */
+	const char *key;
+	/* Can be negative to indicate lookup by line name */
+	int offset;
+
+	enum gpio_lookup_flags flags;
+};
+
+struct gpio_aggregator_pdev_meta {
+	bool init_via_sysfs;
+};
+
 static DEFINE_MUTEX(gpio_aggregator_lock);	/* protects idr */
 static DEFINE_IDR(gpio_aggregator_idr);
 
-static int aggr_add_gpio(struct gpio_aggregator *aggr, const char *key,
-			 int hwnum, unsigned int *n)
+static int gpio_aggregator_alloc(struct gpio_aggregator **aggr, size_t arg_size)
+{
+	int ret;
+
+	struct gpio_aggregator *new __free(kfree) = kzalloc(
+					sizeof(*new) + arg_size, GFP_KERNEL);
+	if (!new)
+		return -ENOMEM;
+
+	scoped_guard(mutex, &gpio_aggregator_lock)
+		ret = idr_alloc(&gpio_aggregator_idr, new, 0, 0, GFP_KERNEL);
+
+	if (ret < 0)
+		return ret;
+
+	new->id = ret;
+	INIT_LIST_HEAD(&new->list_head);
+	mutex_init(&new->lock);
+	*aggr = no_free_ptr(new);
+	return 0;
+}
+
+static void gpio_aggregator_free(struct gpio_aggregator *aggr)
+{
+	scoped_guard(mutex, &gpio_aggregator_lock)
+		idr_remove(&gpio_aggregator_idr, aggr->id);
+
+	mutex_destroy(&aggr->lock);
+	kfree(aggr);
+}
+
+static int gpio_aggregator_add_gpio(struct gpio_aggregator *aggr,
+				    const char *key, int hwnum, unsigned int *n)
 {
 	struct gpiod_lookup_table *lookups;
 
@@ -61,180 +129,101 @@
 	return 0;
 }
 
-static int aggr_parse(struct gpio_aggregator *aggr)
+static bool gpio_aggregator_is_active(struct gpio_aggregator *aggr)
 {
-	char *args = skip_spaces(aggr->args);
-	char *name, *offsets, *p;
-	unsigned long *bitmap;
-	unsigned int i, n = 0;
-	int error = 0;
-
-	bitmap = bitmap_alloc(AGGREGATOR_MAX_GPIOS, GFP_KERNEL);
-	if (!bitmap)
-		return -ENOMEM;
+	lockdep_assert_held(&aggr->lock);
 
-	args = next_arg(args, &name, &p);
-	while (*args) {
-		args = next_arg(args, &offsets, &p);
-
-		p = get_options(offsets, 0, &error);
-		if (error == 0 || *p) {
-			/* Named GPIO line */
-			error = aggr_add_gpio(aggr, name, U16_MAX, &n);
-			if (error)
-				goto free_bitmap;
-
-			name = offsets;
-			continue;
-		}
-
-		/* GPIO chip + offset(s) */
-		error = bitmap_parselist(offsets, bitmap, AGGREGATOR_MAX_GPIOS);
-		if (error) {
-			pr_err("Cannot parse %s: %d\n", offsets, error);
-			goto free_bitmap;
-		}
-
-		for_each_set_bit(i, bitmap, AGGREGATOR_MAX_GPIOS) {
-			error = aggr_add_gpio(aggr, name, i, &n);
-			if (error)
-				goto free_bitmap;
-		}
-
-		args = next_arg(args, &name, &p);
-	}
-
-	if (!n) {
-		pr_err("No GPIOs specified\n");
-		error = -EINVAL;
-	}
-
-free_bitmap:
-	bitmap_free(bitmap);
-	return error;
+	return aggr->probe_data.pdev && platform_get_drvdata(aggr->probe_data.pdev);
 }
 
-static ssize_t new_device_store(struct device_driver *driver, const char *buf,
-				size_t count)
+/* Only aggregators created via legacy sysfs can be "activating". */
+static bool gpio_aggregator_is_activating(struct gpio_aggregator *aggr)
 {
-	struct gpio_aggregator *aggr;
-	struct platform_device *pdev;
-	int res, id;
-
-	/* kernfs guarantees string termination, so count + 1 is safe */
-	aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL);
-	if (!aggr)
-		return -ENOMEM;
-
-	memcpy(aggr->args, buf, count + 1);
-
-	aggr->lookups = kzalloc(struct_size(aggr->lookups, table, 1),
-				GFP_KERNEL);
-	if (!aggr->lookups) {
-		res = -ENOMEM;
-		goto free_ga;
-	}
+	lockdep_assert_held(&aggr->lock);
 
-	mutex_lock(&gpio_aggregator_lock);
-	id = idr_alloc(&gpio_aggregator_idr, aggr, 0, 0, GFP_KERNEL);
-	mutex_unlock(&gpio_aggregator_lock);
+	return aggr->probe_data.pdev && !platform_get_drvdata(aggr->probe_data.pdev);
+}
 
-	if (id < 0) {
-		res = id;
-		goto free_table;
-	}
+static size_t gpio_aggregator_count_lines(struct gpio_aggregator *aggr)
+{
+	lockdep_assert_held(&aggr->lock);
 
-	aggr->lookups->dev_id = kasprintf(GFP_KERNEL, "%s.%d", DRV_NAME, id);
-	if (!aggr->lookups->dev_id) {
-		res = -ENOMEM;
-		goto remove_idr;
-	}
+	return list_count_nodes(&aggr->list_head);
+}
 
-	res = aggr_parse(aggr);
-	if (res)
-		goto free_dev_id;
+static struct gpio_aggregator_line *
+gpio_aggregator_line_alloc(struct gpio_aggregator *parent, unsigned int idx,
+			   char *key, int offset)
+{
+	struct gpio_aggregator_line *line;
 
-	gpiod_add_lookup_table(aggr->lookups);
+	line = kzalloc(sizeof(*line), GFP_KERNEL);
+	if (!line)
+		return ERR_PTR(-ENOMEM);
 
-	pdev = platform_device_register_simple(DRV_NAME, id, NULL, 0);
-	if (IS_ERR(pdev)) {
-		res = PTR_ERR(pdev);
-		goto remove_table;
+	if (key) {
+		line->key = kstrdup(key, GFP_KERNEL);
+		if (!line->key) {
+			kfree(line);
+			return ERR_PTR(-ENOMEM);
+		}
 	}
 
-	aggr->pdev = pdev;
-	return count;
+	line->flags = GPIO_LOOKUP_FLAGS_DEFAULT;
+	line->parent = parent;
+	line->idx = idx;
+	line->offset = offset;
+	INIT_LIST_HEAD(&line->entry);
 
-remove_table:
-	gpiod_remove_lookup_table(aggr->lookups);
-free_dev_id:
-	kfree(aggr->lookups->dev_id);
-remove_idr:
-	mutex_lock(&gpio_aggregator_lock);
-	idr_remove(&gpio_aggregator_idr, id);
-	mutex_unlock(&gpio_aggregator_lock);
-free_table:
-	kfree(aggr->lookups);
-free_ga:
-	kfree(aggr);
-	return res;
-}
-
-static DRIVER_ATTR_WO(new_device);
-
-static void gpio_aggregator_free(struct gpio_aggregator *aggr)
-{
-	platform_device_unregister(aggr->pdev);
-	gpiod_remove_lookup_table(aggr->lookups);
-	kfree(aggr->lookups->dev_id);
-	kfree(aggr->lookups);
-	kfree(aggr);
+	return line;
 }
 
-static ssize_t delete_device_store(struct device_driver *driver,
-				   const char *buf, size_t count)
+static void gpio_aggregator_line_add(struct gpio_aggregator *aggr,
+				     struct gpio_aggregator_line *line)
 {
-	struct gpio_aggregator *aggr;
-	unsigned int id;
-	int error;
+	struct gpio_aggregator_line *tmp;
 
-	if (!str_has_prefix(buf, DRV_NAME "."))
-		return -EINVAL;
+	lockdep_assert_held(&aggr->lock);
 
-	error = kstrtouint(buf + strlen(DRV_NAME "."), 10, &id);
-	if (error)
-		return error;
-
-	mutex_lock(&gpio_aggregator_lock);
-	aggr = idr_remove(&gpio_aggregator_idr, id);
-	mutex_unlock(&gpio_aggregator_lock);
-	if (!aggr)
-		return -ENOENT;
-
-	gpio_aggregator_free(aggr);
-	return count;
+	list_for_each_entry(tmp, &aggr->list_head, entry) {
+		if (tmp->idx > line->idx) {
+			list_add_tail(&line->entry, &tmp->entry);
+			return;
+		}
+	}
+	list_add_tail(&line->entry, &aggr->list_head);
 }
-static DRIVER_ATTR_WO(delete_device);
-
-static struct attribute *gpio_aggregator_attrs[] = {
-	&driver_attr_new_device.attr,
-	&driver_attr_delete_device.attr,
-	NULL
-};
-ATTRIBUTE_GROUPS(gpio_aggregator);
 
-static int __exit gpio_aggregator_idr_remove(int id, void *p, void *data)
+static void gpio_aggregator_line_del(struct gpio_aggregator *aggr,
+				     struct gpio_aggregator_line *line)
 {
-	gpio_aggregator_free(p);
-	return 0;
-}
+	lockdep_assert_held(&aggr->lock);
 
-static void __exit gpio_aggregator_remove_all(void)
-{
-	mutex_lock(&gpio_aggregator_lock);
-	idr_for_each(&gpio_aggregator_idr, gpio_aggregator_idr_remove, NULL);
-	idr_destroy(&gpio_aggregator_idr);
-	mutex_unlock(&gpio_aggregator_lock);
+	list_del(&line->entry);
+}
+
+static void gpio_aggregator_free_lines(struct gpio_aggregator *aggr)
+{
+	struct gpio_aggregator_line *line, *tmp;
+
+	list_for_each_entry_safe(line, tmp, &aggr->list_head, entry) {
+		configfs_unregister_group(&line->group);
+		/*
+		 * Normally, we acquire aggr->lock within the configfs
+		 * callback. However, in the legacy sysfs interface case,
+		 * calling configfs_(un)register_group while holding
+		 * aggr->lock could cause a deadlock. Fortunately, this is
+		 * unnecessary because the new_device/delete_device path
+		 * and the module unload path are mutually exclusive,
+		 * thanks to an explicit try_module_get. That's why this
+		 * minimal scoped_guard suffices.
+		 */
+		scoped_guard(mutex, &aggr->lock)
+			gpio_aggregator_line_del(aggr, line);
+		kfree(line->key);
+		kfree(line->name);
+		kfree(line);
+	}
 }
 
 
@@ -560,6 +549,728 @@
 	return fwd;
 }
 
+/*
+ * Configfs interface
+ */
+
+static struct gpio_aggregator *
+to_gpio_aggregator(struct config_item *item)
+{
+	struct config_group *group = to_config_group(item);
+
+	return container_of(group, struct gpio_aggregator, group);
+}
+
+static struct gpio_aggregator_line *
+to_gpio_aggregator_line(struct config_item *item)
+{
+	struct config_group *group = to_config_group(item);
+
+	return container_of(group, struct gpio_aggregator_line, group);
+}
+
+static struct fwnode_handle *
+gpio_aggregator_make_device_sw_node(struct gpio_aggregator *aggr)
+{
+	struct property_entry properties[2];
+	struct gpio_aggregator_line *line;
+	size_t num_lines;
+	int n = 0;
+
+	memset(properties, 0, sizeof(properties));
+
+	num_lines = gpio_aggregator_count_lines(aggr);
+	if (num_lines == 0)
+		return NULL;
+
+	const char **line_names __free(kfree) = kcalloc(
+				num_lines, sizeof(*line_names), GFP_KERNEL);
+	if (!line_names)
+		return ERR_PTR(-ENOMEM);
+
+	/* The list is always sorted as new elements are inserted in order. */
+	list_for_each_entry(line, &aggr->list_head, entry)
+		line_names[n++] = line->name ?: "";
+
+	properties[0] = PROPERTY_ENTRY_STRING_ARRAY_LEN(
+					"gpio-line-names",
+					line_names, num_lines);
+
+	return fwnode_create_software_node(properties, NULL);
+}
+
+static int gpio_aggregator_activate(struct gpio_aggregator *aggr)
+{
+	struct platform_device_info pdevinfo;
+	struct gpio_aggregator_line *line;
+	struct fwnode_handle *swnode;
+	unsigned int n = 0;
+	int ret = 0;
+
+	if (gpio_aggregator_count_lines(aggr) == 0)
+		return -EINVAL;
+
+	aggr->lookups = kzalloc(struct_size(aggr->lookups, table, 1),
+				GFP_KERNEL);
+	if (!aggr->lookups)
+		return -ENOMEM;
+
+	swnode = gpio_aggregator_make_device_sw_node(aggr);
+	if (IS_ERR(swnode)) {
+		ret = PTR_ERR(swnode);
+		goto err_remove_lookups;
+	}
+
+	memset(&pdevinfo, 0, sizeof(pdevinfo));
+	pdevinfo.name = DRV_NAME;
+	pdevinfo.id = aggr->id;
+	pdevinfo.fwnode = swnode;
+
+	/* The list is always sorted as new elements are inserted in order. */
+	list_for_each_entry(line, &aggr->list_head, entry) {
+		/*
+		 * - Either GPIO chip label or line name must be configured
+		 *   (i.e. line->key must be non-NULL)
+		 * - Line directories must be named with sequential numeric
+		 *   suffixes starting from 0. (i.e. ./line0, ./line1, ...)
+		 */
+		if (!line->key || line->idx != n) {
+			ret = -EINVAL;
+			goto err_remove_swnode;
+		}
+
+		if (line->offset < 0)
+			ret = gpio_aggregator_add_gpio(aggr, line->key,
+						       U16_MAX, &n);
+		else
+			ret = gpio_aggregator_add_gpio(aggr, line->key,
+						       line->offset, &n);
+		if (ret)
+			goto err_remove_swnode;
+	}
+
+	aggr->lookups->dev_id = kasprintf(GFP_KERNEL, "%s.%d", DRV_NAME, aggr->id);
+	if (!aggr->lookups->dev_id) {
+		ret = -ENOMEM;
+		goto err_remove_swnode;
+	}
+
+	gpiod_add_lookup_table(aggr->lookups);
+
+	ret = dev_sync_probe_register(&aggr->probe_data, &pdevinfo);
+	if (ret)
+		goto err_remove_lookup_table;
+
+	return 0;
+
+err_remove_lookup_table:
+	kfree(aggr->lookups->dev_id);
+	gpiod_remove_lookup_table(aggr->lookups);
+err_remove_swnode:
+	fwnode_remove_software_node(swnode);
+err_remove_lookups:
+	kfree(aggr->lookups);
+
+	return ret;
+}
+
+static void gpio_aggregator_deactivate(struct gpio_aggregator *aggr)
+{
+	dev_sync_probe_unregister(&aggr->probe_data);
+	gpiod_remove_lookup_table(aggr->lookups);
+	kfree(aggr->lookups->dev_id);
+	kfree(aggr->lookups);
+}
+
+static void gpio_aggregator_lockup_configfs(struct gpio_aggregator *aggr,
+					    bool lock)
+{
+	struct configfs_subsystem *subsys = aggr->group.cg_subsys;
+	struct gpio_aggregator_line *line;
+
+	/*
+	 * The device only needs to depend on leaf lines. This is
+	 * sufficient to lock up all the configfs entries that the
+	 * instantiated, alive device depends on.
+	 */
+	list_for_each_entry(line, &aggr->list_head, entry) {
+		if (lock)
+			configfs_depend_item_unlocked(
+					subsys, &line->group.cg_item);
+		else
+			configfs_undepend_item_unlocked(
+					&line->group.cg_item);
+	}
+}
+
+static ssize_t
+gpio_aggregator_line_key_show(struct config_item *item, char *page)
+{
+	struct gpio_aggregator_line *line = to_gpio_aggregator_line(item);
+	struct gpio_aggregator *aggr = line->parent;
+
+	guard(mutex)(&aggr->lock);
+
+	return sysfs_emit(page, "%s\n", line->key ?: "");
+}
+
+static ssize_t
+gpio_aggregator_line_key_store(struct config_item *item, const char *page,
+			       size_t count)
+{
+	struct gpio_aggregator_line *line = to_gpio_aggregator_line(item);
+	struct gpio_aggregator *aggr = line->parent;
+
+	char *key __free(kfree) = kstrndup(skip_spaces(page), count,
+					   GFP_KERNEL);
+	if (!key)
+		return -ENOMEM;
+
+	strim(key);
+
+	guard(mutex)(&aggr->lock);
+
+	if (gpio_aggregator_is_activating(aggr) ||
+	    gpio_aggregator_is_active(aggr))
+		return -EBUSY;
+
+	kfree(line->key);
+	line->key = no_free_ptr(key);
+
+	return count;
+}
+CONFIGFS_ATTR(gpio_aggregator_line_, key);
+
+static ssize_t
+gpio_aggregator_line_name_show(struct config_item *item, char *page)
+{
+	struct gpio_aggregator_line *line = to_gpio_aggregator_line(item);
+	struct gpio_aggregator *aggr = line->parent;
+
+	guard(mutex)(&aggr->lock);
+
+	return sysfs_emit(page, "%s\n", line->name ?: "");
+}
+
+static ssize_t
+gpio_aggregator_line_name_store(struct config_item *item, const char *page,
+				size_t count)
+{
+	struct gpio_aggregator_line *line = to_gpio_aggregator_line(item);
+	struct gpio_aggregator *aggr = line->parent;
+
+	char *name __free(kfree) = kstrndup(skip_spaces(page), count,
+					    GFP_KERNEL);
+	if (!name)
+		return -ENOMEM;
+
+	strim(name);
+
+	guard(mutex)(&aggr->lock);
+
+	if (gpio_aggregator_is_activating(aggr) ||
+	    gpio_aggregator_is_active(aggr))
+		return -EBUSY;
+
+	kfree(line->name);
+	line->name = no_free_ptr(name);
+
+	return count;
+}
+CONFIGFS_ATTR(gpio_aggregator_line_, name);
+
+static ssize_t
+gpio_aggregator_line_offset_show(struct config_item *item, char *page)
+{
+	struct gpio_aggregator_line *line = to_gpio_aggregator_line(item);
+	struct gpio_aggregator *aggr = line->parent;
+
+	guard(mutex)(&aggr->lock);
+
+	return sysfs_emit(page, "%d\n", line->offset);
+}
+
+static ssize_t
+gpio_aggregator_line_offset_store(struct config_item *item, const char *page,
+				  size_t count)
+{
+	struct gpio_aggregator_line *line = to_gpio_aggregator_line(item);
+	struct gpio_aggregator *aggr = line->parent;
+	int offset, ret;
+
+	ret = kstrtoint(page, 0, &offset);
+	if (ret)
+		return ret;
+
+	/*
+	 * When offset == -1, 'key' represents a line name to lookup.
+	 * When 0 <= offset < 65535, 'key' represents the label of the chip with
+	 * the 'offset' value representing the line within that chip.
+	 *
+	 * GPIOLIB uses the U16_MAX value to indicate lookup by line name so
+	 * the greatest offset we can accept is (U16_MAX - 1).
+	 */
+	if (offset > (U16_MAX - 1) || offset < -1)
+		return -EINVAL;
+
+	guard(mutex)(&aggr->lock);
+
+	if (gpio_aggregator_is_activating(aggr) ||
+	    gpio_aggregator_is_active(aggr))
+		return -EBUSY;
+
+	line->offset = offset;
+
+	return count;
+}
+CONFIGFS_ATTR(gpio_aggregator_line_, offset);
+
+static struct configfs_attribute *gpio_aggregator_line_attrs[] = {
+	&gpio_aggregator_line_attr_key,
+	&gpio_aggregator_line_attr_name,
+	&gpio_aggregator_line_attr_offset,
+	NULL
+};
+
+static ssize_t
+gpio_aggregator_device_dev_name_show(struct config_item *item, char *page)
+{
+	struct gpio_aggregator *aggr = to_gpio_aggregator(item);
+	struct platform_device *pdev;
+
+	guard(mutex)(&aggr->lock);
+
+	pdev = aggr->probe_data.pdev;
+	if (pdev)
+		return sysfs_emit(page, "%s\n", dev_name(&pdev->dev));
+
+	return sysfs_emit(page, "%s.%d\n", DRV_NAME, aggr->id);
+}
+CONFIGFS_ATTR_RO(gpio_aggregator_device_, dev_name);
+
+static ssize_t
+gpio_aggregator_device_live_show(struct config_item *item, char *page)
+{
+	struct gpio_aggregator *aggr = to_gpio_aggregator(item);
+
+	guard(mutex)(&aggr->lock);
+
+	return sysfs_emit(page, "%c\n",
+			  gpio_aggregator_is_active(aggr) ? '1' : '0');
+}
+
+static ssize_t
+gpio_aggregator_device_live_store(struct config_item *item, const char *page,
+				  size_t count)
+{
+	struct gpio_aggregator *aggr = to_gpio_aggregator(item);
+	int ret = 0;
+	bool live;
+
+	ret = kstrtobool(page, &live);
+	if (ret)
+		return ret;
+
+	if (!try_module_get(THIS_MODULE))
+		return -ENOENT;
+
+	if (live && !aggr->init_via_sysfs)
+		gpio_aggregator_lockup_configfs(aggr, true);
+
+	scoped_guard(mutex, &aggr->lock) {
+		if (gpio_aggregator_is_activating(aggr) ||
+		    (live == gpio_aggregator_is_active(aggr)))
+			ret = -EPERM;
+		else if (live)
+			ret = gpio_aggregator_activate(aggr);
+		else
+			gpio_aggregator_deactivate(aggr);
+	}
+
+	/*
+	 * Undepend is required only if device disablement (live == 0)
+	 * succeeds or if device enablement (live == 1) fails.
+	 */
+	if (live == !!ret && !aggr->init_via_sysfs)
+		gpio_aggregator_lockup_configfs(aggr, false);
+
+	module_put(THIS_MODULE);
+
+	return ret ?: count;
+}
+CONFIGFS_ATTR(gpio_aggregator_device_, live);
+
+static struct configfs_attribute *gpio_aggregator_device_attrs[] = {
+	&gpio_aggregator_device_attr_dev_name,
+	&gpio_aggregator_device_attr_live,
+	NULL
+};
+
+static void
+gpio_aggregator_line_release(struct config_item *item)
+{
+	struct gpio_aggregator_line *line = to_gpio_aggregator_line(item);
+	struct gpio_aggregator *aggr = line->parent;
+
+	guard(mutex)(&aggr->lock);
+
+	gpio_aggregator_line_del(aggr, line);
+	kfree(line->key);
+	kfree(line->name);
+	kfree(line);
+}
+
+static struct configfs_item_operations gpio_aggregator_line_item_ops = {
+	.release	= gpio_aggregator_line_release,
+};
+
+static const struct config_item_type gpio_aggregator_line_type = {
+	.ct_item_ops	= &gpio_aggregator_line_item_ops,
+	.ct_attrs	= gpio_aggregator_line_attrs,
+	.ct_owner	= THIS_MODULE,
+};
+
+static void gpio_aggregator_device_release(struct config_item *item)
+{
+	struct gpio_aggregator *aggr = to_gpio_aggregator(item);
+
+	/*
+	 * At this point, aggr is neither active nor activating,
+	 * so calling gpio_aggregator_deactivate() is always unnecessary.
+	 */
+	gpio_aggregator_free(aggr);
+}
+
+static struct configfs_item_operations gpio_aggregator_device_item_ops = {
+	.release	= gpio_aggregator_device_release,
+};
+
+static struct config_group *
+gpio_aggregator_device_make_group(struct config_group *group, const char *name)
+{
+	struct gpio_aggregator *aggr = to_gpio_aggregator(&group->cg_item);
+	struct gpio_aggregator_line *line;
+	unsigned int idx;
+	int ret, nchar;
+
+	ret = sscanf(name, "line%u%n", &idx, &nchar);
+	if (ret != 1 || nchar != strlen(name))
+		return ERR_PTR(-EINVAL);
+
+	if (aggr->init_via_sysfs)
+		/*
+		 * Aggregators created via legacy sysfs interface are exposed as
+		 * default groups, which means rmdir(2) is prohibited for them.
+		 * For simplicity, and to avoid confusion, we also prohibit
+		 * mkdir(2).
+		 */
+		return ERR_PTR(-EPERM);
+
+	guard(mutex)(&aggr->lock);
+
+	if (gpio_aggregator_is_active(aggr))
+		return ERR_PTR(-EBUSY);
+
+	list_for_each_entry(line, &aggr->list_head, entry)
+		if (line->idx == idx)
+			return ERR_PTR(-EINVAL);
+
+	line = gpio_aggregator_line_alloc(aggr, idx, NULL, -1);
+	if (IS_ERR(line))
+		return ERR_CAST(line);
+
+	config_group_init_type_name(&line->group, name, &gpio_aggregator_line_type);
+
+	gpio_aggregator_line_add(aggr, line);
+
+	return &line->group;
+}
+
+static struct configfs_group_operations gpio_aggregator_device_group_ops = {
+	.make_group	= gpio_aggregator_device_make_group,
+};
+
+static const struct config_item_type gpio_aggregator_device_type = {
+	.ct_group_ops	= &gpio_aggregator_device_group_ops,
+	.ct_item_ops	= &gpio_aggregator_device_item_ops,
+	.ct_attrs	= gpio_aggregator_device_attrs,
+	.ct_owner	= THIS_MODULE,
+};
+
+static struct config_group *
+gpio_aggregator_make_group(struct config_group *group, const char *name)
+{
+	struct gpio_aggregator *aggr;
+	int ret;
+
+	/*
+	 * "_sysfs" prefix is reserved for auto-generated config group
+	 * for devices create via legacy sysfs interface.
+	 */
+	if (strncmp(name, AGGREGATOR_LEGACY_PREFIX,
+		    sizeof(AGGREGATOR_LEGACY_PREFIX) - 1) == 0)
+		return ERR_PTR(-EINVAL);
+
+	/* arg space is unneeded */
+	ret = gpio_aggregator_alloc(&aggr, 0);
+	if (ret)
+		return ERR_PTR(ret);
+
+	config_group_init_type_name(&aggr->group, name, &gpio_aggregator_device_type);
+	dev_sync_probe_init(&aggr->probe_data);
+
+	return &aggr->group;
+}
+
+static struct configfs_group_operations gpio_aggregator_group_ops = {
+	.make_group	= gpio_aggregator_make_group,
+};
+
+static const struct config_item_type gpio_aggregator_type = {
+	.ct_group_ops	= &gpio_aggregator_group_ops,
+	.ct_owner	= THIS_MODULE,
+};
+
+static struct configfs_subsystem gpio_aggregator_subsys = {
+	.su_group = {
+		.cg_item = {
+			.ci_namebuf	= DRV_NAME,
+			.ci_type	= &gpio_aggregator_type,
+		},
+	},
+};
+
+/*
+ * Sysfs interface
+ */
+static int gpio_aggregator_parse(struct gpio_aggregator *aggr)
+{
+	char *args = skip_spaces(aggr->args);
+	struct gpio_aggregator_line *line;
+	char name[CONFIGFS_ITEM_NAME_LEN];
+	char *key, *offsets, *p;
+	unsigned int i, n = 0;
+	int error = 0;
+
+	unsigned long *bitmap __free(bitmap) =
+			bitmap_alloc(AGGREGATOR_MAX_GPIOS, GFP_KERNEL);
+	if (!bitmap)
+		return -ENOMEM;
+
+	args = next_arg(args, &key, &p);
+	while (*args) {
+		args = next_arg(args, &offsets, &p);
+
+		p = get_options(offsets, 0, &error);
+		if (error == 0 || *p) {
+			/* Named GPIO line */
+			scnprintf(name, sizeof(name), "line%u", n);
+			line = gpio_aggregator_line_alloc(aggr, n, key, -1);
+			if (IS_ERR(line)) {
+				error = PTR_ERR(line);
+				goto err;
+			}
+			config_group_init_type_name(&line->group, name,
+						    &gpio_aggregator_line_type);
+			error = configfs_register_group(&aggr->group,
+							&line->group);
+			if (error)
+				goto err;
+			scoped_guard(mutex, &aggr->lock)
+				gpio_aggregator_line_add(aggr, line);
+
+			error = gpio_aggregator_add_gpio(aggr, key, U16_MAX, &n);
+			if (error)
+				goto err;
+
+			key = offsets;
+			continue;
+		}
+
+		/* GPIO chip + offset(s) */
+		error = bitmap_parselist(offsets, bitmap, AGGREGATOR_MAX_GPIOS);
+		if (error) {
+			pr_err("Cannot parse %s: %d\n", offsets, error);
+			goto err;
+		}
+
+		for_each_set_bit(i, bitmap, AGGREGATOR_MAX_GPIOS) {
+			scnprintf(name, sizeof(name), "line%u", n);
+			line = gpio_aggregator_line_alloc(aggr, n, key, i);
+			if (IS_ERR(line)) {
+				error = PTR_ERR(line);
+				goto err;
+			}
+			config_group_init_type_name(&line->group, name,
+						    &gpio_aggregator_line_type);
+			error = configfs_register_group(&aggr->group,
+							&line->group);
+			if (error)
+				goto err;
+			scoped_guard(mutex, &aggr->lock)
+				gpio_aggregator_line_add(aggr, line);
+
+			error = gpio_aggregator_add_gpio(aggr, key, i, &n);
+			if (error)
+				goto err;
+		}
+
+		args = next_arg(args, &key, &p);
+	}
+
+	if (!n) {
+		pr_err("No GPIOs specified\n");
+		error = -EINVAL;
+		goto err;
+	}
+
+	return 0;
+
+err:
+	gpio_aggregator_free_lines(aggr);
+	return error;
+}
+
+static ssize_t gpio_aggregator_new_device_store(struct device_driver *driver,
+						const char *buf, size_t count)
+{
+	struct gpio_aggregator_pdev_meta meta = { .init_via_sysfs = true };
+	char name[CONFIGFS_ITEM_NAME_LEN];
+	struct gpio_aggregator *aggr;
+	struct platform_device *pdev;
+	int res;
+
+	if (!try_module_get(THIS_MODULE))
+		return -ENOENT;
+
+	/* kernfs guarantees string termination, so count + 1 is safe */
+	res = gpio_aggregator_alloc(&aggr, count + 1);
+	if (res)
+		goto put_module;
+
+	memcpy(aggr->args, buf, count + 1);
+
+	aggr->init_via_sysfs = true;
+	aggr->lookups = kzalloc(struct_size(aggr->lookups, table, 1),
+				GFP_KERNEL);
+	if (!aggr->lookups) {
+		res = -ENOMEM;
+		goto free_ga;
+	}
+
+	aggr->lookups->dev_id = kasprintf(GFP_KERNEL, "%s.%d", DRV_NAME, aggr->id);
+	if (!aggr->lookups->dev_id) {
+		res = -ENOMEM;
+		goto free_table;
+	}
+
+	scnprintf(name, sizeof(name), "%s.%d", AGGREGATOR_LEGACY_PREFIX, aggr->id);
+	config_group_init_type_name(&aggr->group, name, &gpio_aggregator_device_type);
+
+	/*
+	 * Since the device created by sysfs might be toggled via configfs
+	 * 'live' attribute later, this initialization is needed.
+	 */
+	dev_sync_probe_init(&aggr->probe_data);
+
+	/* Expose to configfs */
+	res = configfs_register_group(&gpio_aggregator_subsys.su_group,
+				      &aggr->group);
+	if (res)
+		goto free_dev_id;
+
+	res = gpio_aggregator_parse(aggr);
+	if (res)
+		goto unregister_group;
+
+	gpiod_add_lookup_table(aggr->lookups);
+
+	pdev = platform_device_register_data(NULL, DRV_NAME, aggr->id, &meta, sizeof(meta));
+	if (IS_ERR(pdev)) {
+		res = PTR_ERR(pdev);
+		goto remove_table;
+	}
+
+	aggr->probe_data.pdev = pdev;
+	module_put(THIS_MODULE);
+	return count;
+
+remove_table:
+	gpiod_remove_lookup_table(aggr->lookups);
+unregister_group:
+	configfs_unregister_group(&aggr->group);
+free_dev_id:
+	kfree(aggr->lookups->dev_id);
+free_table:
+	kfree(aggr->lookups);
+free_ga:
+	gpio_aggregator_free(aggr);
+put_module:
+	module_put(THIS_MODULE);
+	return res;
+}
+
+static struct driver_attribute driver_attr_gpio_aggregator_new_device =
+	__ATTR(new_device, 0200, NULL, gpio_aggregator_new_device_store);
+
+static void gpio_aggregator_destroy(struct gpio_aggregator *aggr)
+{
+	scoped_guard(mutex, &aggr->lock) {
+		if (gpio_aggregator_is_activating(aggr) ||
+		    gpio_aggregator_is_active(aggr))
+			gpio_aggregator_deactivate(aggr);
+	}
+	gpio_aggregator_free_lines(aggr);
+	configfs_unregister_group(&aggr->group);
+	kfree(aggr);
+}
+
+static ssize_t gpio_aggregator_delete_device_store(struct device_driver *driver,
+						   const char *buf, size_t count)
+{
+	struct gpio_aggregator *aggr;
+	unsigned int id;
+	int error;
+
+	if (!str_has_prefix(buf, DRV_NAME "."))
+		return -EINVAL;
+
+	error = kstrtouint(buf + strlen(DRV_NAME "."), 10, &id);
+	if (error)
+		return error;
+
+	if (!try_module_get(THIS_MODULE))
+		return -ENOENT;
+
+	mutex_lock(&gpio_aggregator_lock);
+	aggr = idr_find(&gpio_aggregator_idr, id);
+	/*
+	 * For simplicity, devices created via configfs cannot be deleted
+	 * via sysfs.
+	 */
+	if (aggr && aggr->init_via_sysfs)
+		idr_remove(&gpio_aggregator_idr, id);
+	else {
+		mutex_unlock(&gpio_aggregator_lock);
+		module_put(THIS_MODULE);
+		return -ENOENT;
+	}
+	mutex_unlock(&gpio_aggregator_lock);
+
+	gpio_aggregator_destroy(aggr);
+	module_put(THIS_MODULE);
+	return count;
+}
+
+static struct driver_attribute driver_attr_gpio_aggregator_delete_device =
+	__ATTR(delete_device, 0200, NULL, gpio_aggregator_delete_device_store);
+
+static struct attribute *gpio_aggregator_attrs[] = {
+	&driver_attr_gpio_aggregator_new_device.attr,
+	&driver_attr_gpio_aggregator_delete_device.attr,
+	NULL
+};
+ATTRIBUTE_GROUPS(gpio_aggregator);
 
 /*
  *  GPIO Aggregator platform device
@@ -567,7 +1278,9 @@
 
 static int gpio_aggregator_probe(struct platform_device *pdev)
 {
+	struct gpio_aggregator_pdev_meta *meta;
 	struct device *dev = &pdev->dev;
+	bool init_via_sysfs = false;
 	struct gpio_desc **descs;
 	struct gpiochip_fwd *fwd;
 	unsigned long features;
@@ -581,10 +1294,28 @@
 	if (!descs)
 		return -ENOMEM;
 
+	meta = dev_get_platdata(&pdev->dev);
+	if (meta && meta->init_via_sysfs)
+		init_via_sysfs = true;
+
 	for (i = 0; i < n; i++) {
 		descs[i] = devm_gpiod_get_index(dev, NULL, i, GPIOD_ASIS);
-		if (IS_ERR(descs[i]))
+		if (IS_ERR(descs[i])) {
+			/*
+			 * Deferred probing is not suitable when the aggregator
+			 * is created via configfs. They should just retry later
+			 * whenever they like. For device creation via sysfs,
+			 * error is propagated without overriding for backward
+			 * compatibility. .prevent_deferred_probe is kept unset
+			 * for other cases.
+			 */
+			if (!init_via_sysfs && !dev_of_node(dev) &&
+			    descs[i] == ERR_PTR(-EPROBE_DEFER)) {
+				pr_warn("Deferred probe canceled for creation via configfs.\n");
+				return -ENODEV;
+			}
 			return PTR_ERR(descs[i]);
+		}
 	}
 
 	features = (uintptr_t)device_get_match_data(dev);
@@ -618,9 +1349,63 @@
 	},
 };
 
+static int __exit gpio_aggregator_idr_remove(int id, void *p, void *data)
+{
+	/*
+	 * There should be no aggregator created via configfs, as their
+	 * presence would prevent module unloading.
+	 */
+	gpio_aggregator_destroy(p);
+	return 0;
+}
+
+static void __exit gpio_aggregator_remove_all(void)
+{
+	/*
+	 * Configfs callbacks acquire gpio_aggregator_lock when accessing
+	 * gpio_aggregator_idr, so to prevent lock inversion deadlock, we
+	 * cannot protect idr_for_each invocation here with
+	 * gpio_aggregator_lock, as gpio_aggregator_idr_remove() accesses
+	 * configfs groups. Fortunately, the new_device/delete_device path
+	 * and the module unload path are mutually exclusive, thanks to an
+	 * explicit try_module_get inside of those driver attr handlers.
+	 * Also, when we reach here, no configfs entries present or being
+	 * created. Therefore, no need to protect with gpio_aggregator_lock
+	 * below.
+	 */
+	idr_for_each(&gpio_aggregator_idr, gpio_aggregator_idr_remove, NULL);
+	idr_destroy(&gpio_aggregator_idr);
+}
+
 static int __init gpio_aggregator_init(void)
 {
-	return platform_driver_register(&gpio_aggregator_driver);
+	int ret = 0;
+
+	config_group_init(&gpio_aggregator_subsys.su_group);
+	mutex_init(&gpio_aggregator_subsys.su_mutex);
+	ret = configfs_register_subsystem(&gpio_aggregator_subsys);
+	if (ret) {
+		pr_err("Failed to register the '%s' configfs subsystem: %d\n",
+		       gpio_aggregator_subsys.su_group.cg_item.ci_namebuf, ret);
+		mutex_destroy(&gpio_aggregator_subsys.su_mutex);
+		return ret;
+	}
+
+	/*
+	 * CAVEAT: This must occur after configfs registration. Otherwise,
+	 * a race condition could arise: driver attribute groups might be
+	 * exposed and accessed by users before configfs registration
+	 * completes. new_device_store() does not expect a partially
+	 * initialized configfs state.
+	 */
+	ret = platform_driver_register(&gpio_aggregator_driver);
+	if (ret) {
+		pr_err("Failed to register the platform driver: %d\n", ret);
+		mutex_destroy(&gpio_aggregator_subsys.su_mutex);
+		configfs_unregister_subsystem(&gpio_aggregator_subsys);
+	}
+
+	return ret;
 }
 module_init(gpio_aggregator_init);
 
@@ -628,6 +1413,7 @@
 {
 	gpio_aggregator_remove_all();
 	platform_driver_unregister(&gpio_aggregator_driver);
+	configfs_unregister_subsystem(&gpio_aggregator_subsys);
 }
 module_exit(gpio_aggregator_exit);
 
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-aspeed.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-aspeed.c
@@ -406,6 +406,8 @@
 	gpio->dcache[GPIO_BANK(offset)] = reg;
 
 	iowrite32(reg, addr);
+	/* Flush write */
+	ioread32(addr);
 }
 
 static void aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset,
@@ -1191,7 +1193,7 @@
 	if (!gpio_id)
 		return -EINVAL;
 
-	gpio->clk = of_clk_get(pdev->dev.of_node, 0);
+	gpio->clk = devm_clk_get_enabled(&pdev->dev, NULL);
 	if (IS_ERR(gpio->clk)) {
 		dev_warn(&pdev->dev,
 				"Failed to get clock from devicetree, debouncing disabled\n");
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-crystalcove.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-crystalcove.c
@@ -92,7 +92,7 @@
 		case 0x5e:
 			return GPIOPANELCTL;
 		default:
-			return -EOPNOTSUPP;
+			return -ENOTSUPP;
 		}
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-davinci.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-davinci.c
@@ -225,6 +225,11 @@
 	else
 		nirq = DIV_ROUND_UP(ngpio, 16);
 
+	if (nirq > MAX_INT_PER_BANK) {
+		dev_err(dev, "Too many IRQs!\n");
+		return -EINVAL;
+	}
+
 	chips = devm_kzalloc(dev, sizeof(*chips), GFP_KERNEL);
 	if (!chips)
 		return -ENOMEM;
@@ -284,7 +289,7 @@
  * serve as EDMA event triggers.
  */
 
-static void gpio_irq_disable(struct irq_data *d)
+static void gpio_irq_mask(struct irq_data *d)
 {
 	struct davinci_gpio_regs __iomem *g = irq2regs(d);
 	uintptr_t mask = (uintptr_t)irq_data_get_irq_handler_data(d);
@@ -293,7 +298,7 @@
 	writel_relaxed(mask, &g->clr_rising);
 }
 
-static void gpio_irq_enable(struct irq_data *d)
+static void gpio_irq_unmask(struct irq_data *d)
 {
 	struct davinci_gpio_regs __iomem *g = irq2regs(d);
 	uintptr_t mask = (uintptr_t)irq_data_get_irq_handler_data(d);
@@ -319,8 +324,8 @@
 
 static struct irq_chip gpio_irqchip = {
 	.name		= "GPIO",
-	.irq_enable	= gpio_irq_enable,
-	.irq_disable	= gpio_irq_disable,
+	.irq_unmask	= gpio_irq_unmask,
+	.irq_mask	= gpio_irq_mask,
 	.irq_set_type	= gpio_irq_type,
 	.flags		= IRQCHIP_SET_TYPE_MASKED | IRQCHIP_SKIP_SET_WAKE,
 };
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-exar.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-exar.c
@@ -99,11 +99,13 @@
 	struct exar_gpio_chip *exar_gpio = gpiochip_get_data(chip);
 	unsigned int addr = exar_offset_to_lvl_addr(exar_gpio, offset);
 	unsigned int bit = exar_offset_to_bit(exar_gpio, offset);
+	unsigned int bit_value = value ? BIT(bit) : 0;
 
-	if (value)
-		regmap_set_bits(exar_gpio->regmap, addr, BIT(bit));
-	else
-		regmap_clear_bits(exar_gpio->regmap, addr, BIT(bit));
+	/*
+	 * regmap_write_bits() forces value to be written when an external
+	 * pull up/down might otherwise indicate value was already set.
+	 */
+	regmap_write_bits(exar_gpio->regmap, addr, BIT(bit), bit_value);
 }
 
 static int exar_direction_output(struct gpio_chip *chip, unsigned int offset,
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-grgpio.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-grgpio.c
@@ -328,6 +328,7 @@
 static int grgpio_probe(struct platform_device *ofdev)
 {
 	struct device_node *np = ofdev->dev.of_node;
+	struct device *dev = &ofdev->dev;
 	void  __iomem *regs;
 	struct gpio_chip *gc;
 	struct grgpio_priv *priv;
@@ -337,7 +338,7 @@
 	int size;
 	int i;
 
-	priv = devm_kzalloc(&ofdev->dev, sizeof(*priv), GFP_KERNEL);
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;
 
@@ -346,28 +347,31 @@
 		return PTR_ERR(regs);
 
 	gc = &priv->gc;
-	err = bgpio_init(gc, &ofdev->dev, 4, regs + GRGPIO_DATA,
+	err = bgpio_init(gc, dev, 4, regs + GRGPIO_DATA,
 			 regs + GRGPIO_OUTPUT, NULL, regs + GRGPIO_DIR, NULL,
 			 BGPIOF_BIG_ENDIAN_BYTE_ORDER);
 	if (err) {
-		dev_err(&ofdev->dev, "bgpio_init() failed\n");
+		dev_err(dev, "bgpio_init() failed\n");
 		return err;
 	}
 
 	priv->regs = regs;
 	priv->imask = gc->read_reg(regs + GRGPIO_IMASK);
-	priv->dev = &ofdev->dev;
+	priv->dev = dev;
 
 	gc->owner = THIS_MODULE;
 	gc->to_irq = grgpio_to_irq;
-	gc->label = devm_kasprintf(&ofdev->dev, GFP_KERNEL, "%pOF", np);
+	gc->label = devm_kasprintf(dev, GFP_KERNEL, "%pOF", np);
+	if (!gc->label)
+		return -ENOMEM;
+
 	gc->base = -1;
 
 	err = of_property_read_u32(np, "nbits", &prop);
 	if (err || prop <= 0 || prop > GRGPIO_MAX_NGPIO) {
 		gc->ngpio = GRGPIO_MAX_NGPIO;
-		dev_dbg(&ofdev->dev,
-			"No or invalid nbits property: assume %d\n", gc->ngpio);
+		dev_dbg(dev, "No or invalid nbits property: assume %d\n",
+			gc->ngpio);
 	} else {
 		gc->ngpio = prop;
 	}
@@ -379,7 +383,7 @@
 	irqmap = (s32 *)of_get_property(np, "irqmap", &size);
 	if (irqmap) {
 		if (size < gc->ngpio) {
-			dev_err(&ofdev->dev,
+			dev_err(dev,
 				"irqmap shorter than ngpio (%d < %d)\n",
 				size, gc->ngpio);
 			return -EINVAL;
@@ -389,7 +393,7 @@
 						     &grgpio_irq_domain_ops,
 						     priv);
 		if (!priv->domain) {
-			dev_err(&ofdev->dev, "Could not add irq domain\n");
+			dev_err(dev, "Could not add irq domain\n");
 			return -EINVAL;
 		}
 
@@ -419,13 +423,13 @@
 
 	err = gpiochip_add_data(gc, priv);
 	if (err) {
-		dev_err(&ofdev->dev, "Could not add gpiochip\n");
+		dev_err(dev, "Could not add gpiochip\n");
 		if (priv->domain)
 			irq_domain_remove(priv->domain);
 		return err;
 	}
 
-	dev_info(&ofdev->dev, "regs=0x%p, base=%d, ngpio=%d, irqs=%s\n",
+	dev_info(dev, "regs=0x%p, base=%d, ngpio=%d, irqs=%s\n",
 		 priv->regs, gc->base, gc->ngpio, priv->domain ? "on" : "off");
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-ljca.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-ljca.c
@@ -82,9 +82,9 @@
 	int ret;
 
 	mutex_lock(&ljca_gpio->trans_lock);
+	packet->num = 1;
 	packet->item[0].index = gpio_id;
 	packet->item[0].value = config | ljca_gpio->connect_mode[gpio_id];
-	packet->num = 1;
 
 	ret = ljca_transfer(ljca_gpio->ljca, LJCA_GPIO_CONFIG, (u8 *)packet,
 			    struct_size(packet, item, packet->num), NULL, 0);
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-loongson-64bit.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-loongson-64bit.c
@@ -237,9 +237,9 @@
 static const struct loongson_gpio_chip_data loongson_gpio_ls2k2000_data2 = {
 	.label = "ls2k2000_gpio",
 	.mode = BIT_CTRL_MODE,
-	.conf_offset = 0x84,
-	.in_offset = 0x88,
-	.out_offset = 0x80,
+	.conf_offset = 0x4,
+	.in_offset = 0x8,
+	.out_offset = 0x0,
 };
 
 static const struct loongson_gpio_chip_data loongson_gpio_ls3a5000_data = {
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-lpc32xx.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-lpc32xx.c
@@ -529,6 +529,7 @@
 	{ .compatible = "nxp,lpc3220-gpio", },
 	{ },
 };
+MODULE_DEVICE_TABLE(of, lpc32xx_gpio_of_match);
 
 static struct platform_driver lpc32xx_gpio_driver = {
 	.driver		= {
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-mlxbf3.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-mlxbf3.c
@@ -39,6 +39,8 @@
 #define MLXBF_GPIO_CAUSE_OR_EVTEN0        0x14
 #define MLXBF_GPIO_CAUSE_OR_CLRCAUSE      0x18
 
+#define MLXBF_GPIO_CLR_ALL_INTS           GENMASK(31, 0)
+
 struct mlxbf3_gpio_context {
 	struct gpio_chip gc;
 
@@ -82,6 +84,8 @@
 	val = readl(gs->gpio_cause_io + MLXBF_GPIO_CAUSE_OR_EVTEN0);
 	val &= ~BIT(offset);
 	writel(val, gs->gpio_cause_io + MLXBF_GPIO_CAUSE_OR_EVTEN0);
+
+	writel(BIT(offset), gs->gpio_cause_io + MLXBF_GPIO_CAUSE_OR_CLRCAUSE);
 	raw_spin_unlock_irqrestore(&gs->gc.bgpio_lock, flags);
 
 	gpiochip_disable_irq(gc, offset);
@@ -253,6 +257,15 @@
 	return 0;
 }
 
+static void mlxbf3_gpio_shutdown(struct platform_device *pdev)
+{
+	struct mlxbf3_gpio_context *gs = platform_get_drvdata(pdev);
+
+	/* Disable and clear all interrupts */
+	writel(0, gs->gpio_cause_io + MLXBF_GPIO_CAUSE_OR_EVTEN0);
+	writel(MLXBF_GPIO_CLR_ALL_INTS, gs->gpio_cause_io + MLXBF_GPIO_CAUSE_OR_CLRCAUSE);
+}
+
 static const struct acpi_device_id mlxbf3_gpio_acpi_match[] = {
 	{ "MLNXBF33", 0 },
 	{}
@@ -265,6 +278,7 @@
 		.acpi_match_table = mlxbf3_gpio_acpi_match,
 	},
 	.probe    = mlxbf3_gpio_probe,
+	.shutdown = mlxbf3_gpio_shutdown,
 };
 module_platform_driver(mlxbf3_gpio_driver);
 
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-mmio.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-mmio.c
@@ -619,8 +619,6 @@
 	ret = gpiochip_get_ngpios(gc, dev);
 	if (ret)
 		gc->ngpio = gc->bgpio_bits;
-	else
-		gc->bgpio_bits = roundup_pow_of_two(round_up(gc->ngpio, 8));
 
 	ret = bgpio_setup_io(gc, dat, set, clr, flags);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-npcm-sgpio.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-npcm-sgpio.c
@@ -434,7 +434,7 @@
 	struct gpio_chip *gc = irq_desc_get_handler_data(desc);
 	struct irq_chip *ic = irq_desc_get_chip(desc);
 	struct npcm_sgpio *gpio = gpiochip_get_data(gc);
-	unsigned int i, j, girq;
+	unsigned int i, j;
 	unsigned long reg;
 
 	chained_irq_enter(ic, desc);
@@ -443,11 +443,9 @@
 		const struct npcm_sgpio_bank *bank = &npcm_sgpio_banks[i];
 
 		reg = ioread8(bank_reg(gpio, bank, EVENT_STS));
-		for_each_set_bit(j, &reg, 8) {
-			girq = irq_find_mapping(gc->irq.domain,
-						i * 8 + gpio->nout_sgpio + j);
-			generic_handle_domain_irq(gc->irq.domain, girq);
-		}
+		for_each_set_bit(j, &reg, 8)
+			generic_handle_domain_irq(gc->irq.domain,
+						  i * 8 + gpio->nout_sgpio + j);
 	}
 
 	chained_irq_exit(ic, desc);
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-pca953x.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-pca953x.c
@@ -758,6 +758,8 @@
 	int level;
 
 	if (chip->driver_data & PCA_PCAL) {
+		guard(mutex)(&chip->i2c_lock);
+
 		/* Enable latch on interrupt-enabled inputs */
 		pca953x_write_regs(chip, PCAL953X_IN_LATCH, chip->irq_mask);
 
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-rockchip.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-rockchip.c
@@ -713,6 +713,7 @@
 		return -ENODEV;
 
 	pctldev = of_pinctrl_get(pctlnp);
+	of_node_put(pctlnp);
 	if (!pctldev)
 		return -EPROBE_DEFER;
 
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-sim.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-sim.c
@@ -1009,6 +1009,33 @@
 	dev->pdev = NULL;
 }
 
+static void
+gpio_sim_device_lockup_configfs(struct gpio_sim_device *dev, bool lock)
+{
+	struct configfs_subsystem *subsys = dev->group.cg_subsys;
+	struct gpio_sim_bank *bank;
+	struct gpio_sim_line *line;
+	struct config_item *item;
+
+	/*
+	 * The device only needs to depend on leaf entries. This is
+	 * sufficient to lock up all the configfs entries that the
+	 * instantiated, alive device depends on.
+	 */
+	list_for_each_entry(bank, &dev->bank_list, siblings) {
+		list_for_each_entry(line, &bank->line_list, siblings) {
+			item = line->hog ? &line->hog->item
+					 : &line->group.cg_item;
+
+			if (lock)
+				WARN_ON(configfs_depend_item_unlocked(subsys,
+								      item));
+			else
+				configfs_undepend_item_unlocked(item);
+		}
+	}
+}
+
 static ssize_t
 gpio_sim_device_config_live_store(struct config_item *item,
 				  const char *page, size_t count)
@@ -1021,14 +1048,24 @@
 	if (ret)
 		return ret;
 
-	guard(mutex)(&dev->lock);
+	if (live)
+		gpio_sim_device_lockup_configfs(dev, true);
+
+	scoped_guard(mutex, &dev->lock) {
+		if (live == gpio_sim_device_is_live_unlocked(dev))
+			ret = -EPERM;
+		else if (live)
+			ret = gpio_sim_device_activate_unlocked(dev);
+		else
+			gpio_sim_device_deactivate_unlocked(dev);
+	}
 
-	if (live == gpio_sim_device_is_live_unlocked(dev))
-		ret = -EPERM;
-	else if (live)
-		ret = gpio_sim_device_activate_unlocked(dev);
-	else
-		gpio_sim_device_deactivate_unlocked(dev);
+	/*
+	 * Undepend is required only if device disablement (live == 0)
+	 * succeeds or if device enablement (live == 1) fails.
+	 */
+	if (live == !!ret)
+		gpio_sim_device_lockup_configfs(dev, false);
 
 	return ret ?: count;
 }
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-tangier.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-tangier.c
@@ -195,7 +195,8 @@
 
 static void tng_irq_ack(struct irq_data *d)
 {
-	struct tng_gpio *priv = irq_data_get_irq_chip_data(d);
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+	struct tng_gpio *priv = gpiochip_get_data(gc);
 	irq_hw_number_t gpio = irqd_to_hwirq(d);
 	void __iomem *gisr;
 	u8 shift;
@@ -227,7 +228,8 @@
 
 static void tng_irq_mask(struct irq_data *d)
 {
-	struct tng_gpio *priv = irq_data_get_irq_chip_data(d);
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+	struct tng_gpio *priv = gpiochip_get_data(gc);
 	irq_hw_number_t gpio = irqd_to_hwirq(d);
 
 	tng_irq_unmask_mask(priv, gpio, false);
@@ -236,7 +238,8 @@
 
 static void tng_irq_unmask(struct irq_data *d)
 {
-	struct tng_gpio *priv = irq_data_get_irq_chip_data(d);
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+	struct tng_gpio *priv = gpiochip_get_data(gc);
 	irq_hw_number_t gpio = irqd_to_hwirq(d);
 
 	gpiochip_enable_irq(&priv->chip, gpio);
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-tegra186.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-tegra186.c
@@ -36,12 +36,6 @@
 #define  TEGRA186_GPIO_SCR_SEC_REN		BIT(27)
 #define  TEGRA186_GPIO_SCR_SEC_G1W		BIT(9)
 #define  TEGRA186_GPIO_SCR_SEC_G1R		BIT(1)
-#define  TEGRA186_GPIO_FULL_ACCESS		(TEGRA186_GPIO_SCR_SEC_WEN | \
-						 TEGRA186_GPIO_SCR_SEC_REN | \
-						 TEGRA186_GPIO_SCR_SEC_G1R | \
-						 TEGRA186_GPIO_SCR_SEC_G1W)
-#define  TEGRA186_GPIO_SCR_SEC_ENABLE		(TEGRA186_GPIO_SCR_SEC_WEN | \
-						 TEGRA186_GPIO_SCR_SEC_REN)
 
 /* control registers */
 #define TEGRA186_GPIO_ENABLE_CONFIG 0x00
@@ -177,10 +171,18 @@
 
 	value = __raw_readl(secure + TEGRA186_GPIO_SCR);
 
-	if ((value & TEGRA186_GPIO_SCR_SEC_ENABLE) == 0)
-		return true;
-
-	if ((value & TEGRA186_GPIO_FULL_ACCESS) == TEGRA186_GPIO_FULL_ACCESS)
+	/*
+	 * When SCR_SEC_[R|W]EN is unset, then we have full read/write access to all the
+	 * registers for given GPIO pin.
+	 * When SCR_SEC[R|W]EN is set, then there is need to further check the accompanying
+	 * SCR_SEC_G1[R|W] bit to determine read/write access to all the registers for given
+	 * GPIO pin.
+	 */
+
+	if (((value & TEGRA186_GPIO_SCR_SEC_REN) == 0 ||
+	     ((value & TEGRA186_GPIO_SCR_SEC_REN) && (value & TEGRA186_GPIO_SCR_SEC_G1R))) &&
+	     ((value & TEGRA186_GPIO_SCR_SEC_WEN) == 0 ||
+	     ((value & TEGRA186_GPIO_SCR_SEC_WEN) && (value & TEGRA186_GPIO_SCR_SEC_G1W))))
 		return true;
 
 	return false;
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-tqmx86.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-tqmx86.c
@@ -6,6 +6,7 @@
  *   Vadim V.Vlasov <vvlasov@dev.rtsoft.ru>
  */
 
+#include <linux/bitmap.h>
 #include <linux/bitops.h>
 #include <linux/errno.h>
 #include <linux/gpio/driver.h>
@@ -28,16 +29,25 @@
 #define TQMX86_GPIIC	3	/* GPI Interrupt Configuration Register */
 #define TQMX86_GPIIS	4	/* GPI Interrupt Status Register */
 
+#define TQMX86_GPII_NONE	0
 #define TQMX86_GPII_FALLING	BIT(0)
 #define TQMX86_GPII_RISING	BIT(1)
+/* Stored in irq_type as a trigger type, but not actually valid as a register
+ * value, so the name doesn't use "GPII"
+ */
+#define TQMX86_INT_BOTH		(BIT(0) | BIT(1))
 #define TQMX86_GPII_MASK	(BIT(0) | BIT(1))
 #define TQMX86_GPII_BITS	2
+/* Stored in irq_type with GPII bits */
+#define TQMX86_INT_UNMASKED	BIT(2)
 
 struct tqmx86_gpio_data {
 	struct gpio_chip	chip;
 	void __iomem		*io_base;
 	int			irq;
+	/* Lock must be held for accessing output and irq_type fields */
 	raw_spinlock_t		spinlock;
+	DECLARE_BITMAP(output, TQMX86_NGPIO);
 	u8			irq_type[TQMX86_NGPI];
 };
 
@@ -64,15 +74,10 @@
 {
 	struct tqmx86_gpio_data *gpio = gpiochip_get_data(chip);
 	unsigned long flags;
-	u8 val;
 
 	raw_spin_lock_irqsave(&gpio->spinlock, flags);
-	val = tqmx86_gpio_read(gpio, TQMX86_GPIOD);
-	if (value)
-		val |= BIT(offset);
-	else
-		val &= ~BIT(offset);
-	tqmx86_gpio_write(gpio, val, TQMX86_GPIOD);
+	__assign_bit(offset, gpio->output, value);
+	tqmx86_gpio_write(gpio, bitmap_get_value8(gpio->output, 0), TQMX86_GPIOD);
 	raw_spin_unlock_irqrestore(&gpio->spinlock, flags);
 }
 
@@ -107,21 +112,38 @@
 	return GPIO_LINE_DIRECTION_OUT;
 }
 
+static void tqmx86_gpio_irq_config(struct tqmx86_gpio_data *gpio, int offset)
+	__must_hold(&gpio->spinlock)
+{
+	u8 type = TQMX86_GPII_NONE, gpiic;
+
+	if (gpio->irq_type[offset] & TQMX86_INT_UNMASKED) {
+		type = gpio->irq_type[offset] & TQMX86_GPII_MASK;
+
+		if (type == TQMX86_INT_BOTH)
+			type = tqmx86_gpio_get(&gpio->chip, offset + TQMX86_NGPO)
+				? TQMX86_GPII_FALLING
+				: TQMX86_GPII_RISING;
+	}
+
+	gpiic = tqmx86_gpio_read(gpio, TQMX86_GPIIC);
+	gpiic &= ~(TQMX86_GPII_MASK << (offset * TQMX86_GPII_BITS));
+	gpiic |= type << (offset * TQMX86_GPII_BITS);
+	tqmx86_gpio_write(gpio, gpiic, TQMX86_GPIIC);
+}
+
 static void tqmx86_gpio_irq_mask(struct irq_data *data)
 {
 	unsigned int offset = (data->hwirq - TQMX86_NGPO);
 	struct tqmx86_gpio_data *gpio = gpiochip_get_data(
 		irq_data_get_irq_chip_data(data));
 	unsigned long flags;
-	u8 gpiic, mask;
-
-	mask = TQMX86_GPII_MASK << (offset * TQMX86_GPII_BITS);
 
 	raw_spin_lock_irqsave(&gpio->spinlock, flags);
-	gpiic = tqmx86_gpio_read(gpio, TQMX86_GPIIC);
-	gpiic &= ~mask;
-	tqmx86_gpio_write(gpio, gpiic, TQMX86_GPIIC);
+	gpio->irq_type[offset] &= ~TQMX86_INT_UNMASKED;
+	tqmx86_gpio_irq_config(gpio, offset);
 	raw_spin_unlock_irqrestore(&gpio->spinlock, flags);
+
 	gpiochip_disable_irq(&gpio->chip, irqd_to_hwirq(data));
 }
 
@@ -131,16 +153,12 @@
 	struct tqmx86_gpio_data *gpio = gpiochip_get_data(
 		irq_data_get_irq_chip_data(data));
 	unsigned long flags;
-	u8 gpiic, mask;
-
-	mask = TQMX86_GPII_MASK << (offset * TQMX86_GPII_BITS);
 
 	gpiochip_enable_irq(&gpio->chip, irqd_to_hwirq(data));
+
 	raw_spin_lock_irqsave(&gpio->spinlock, flags);
-	gpiic = tqmx86_gpio_read(gpio, TQMX86_GPIIC);
-	gpiic &= ~mask;
-	gpiic |= gpio->irq_type[offset] << (offset * TQMX86_GPII_BITS);
-	tqmx86_gpio_write(gpio, gpiic, TQMX86_GPIIC);
+	gpio->irq_type[offset] |= TQMX86_INT_UNMASKED;
+	tqmx86_gpio_irq_config(gpio, offset);
 	raw_spin_unlock_irqrestore(&gpio->spinlock, flags);
 }
 
@@ -151,7 +169,7 @@
 	unsigned int offset = (data->hwirq - TQMX86_NGPO);
 	unsigned int edge_type = type & IRQF_TRIGGER_MASK;
 	unsigned long flags;
-	u8 new_type, gpiic;
+	u8 new_type;
 
 	switch (edge_type) {
 	case IRQ_TYPE_EDGE_RISING:
@@ -161,19 +179,16 @@
 		new_type = TQMX86_GPII_FALLING;
 		break;
 	case IRQ_TYPE_EDGE_BOTH:
-		new_type = TQMX86_GPII_FALLING | TQMX86_GPII_RISING;
+		new_type = TQMX86_INT_BOTH;
 		break;
 	default:
 		return -EINVAL; /* not supported */
 	}
 
-	gpio->irq_type[offset] = new_type;
-
 	raw_spin_lock_irqsave(&gpio->spinlock, flags);
-	gpiic = tqmx86_gpio_read(gpio, TQMX86_GPIIC);
-	gpiic &= ~((TQMX86_GPII_MASK) << (offset * TQMX86_GPII_BITS));
-	gpiic |= new_type << (offset * TQMX86_GPII_BITS);
-	tqmx86_gpio_write(gpio, gpiic, TQMX86_GPIIC);
+	gpio->irq_type[offset] &= ~TQMX86_GPII_MASK;
+	gpio->irq_type[offset] |= new_type;
+	tqmx86_gpio_irq_config(gpio, offset);
 	raw_spin_unlock_irqrestore(&gpio->spinlock, flags);
 
 	return 0;
@@ -184,8 +199,8 @@
 	struct gpio_chip *chip = irq_desc_get_handler_data(desc);
 	struct tqmx86_gpio_data *gpio = gpiochip_get_data(chip);
 	struct irq_chip *irq_chip = irq_desc_get_chip(desc);
-	unsigned long irq_bits;
-	int i = 0;
+	unsigned long irq_bits, flags;
+	int i;
 	u8 irq_status;
 
 	chained_irq_enter(irq_chip, desc);
@@ -194,6 +209,34 @@
 	tqmx86_gpio_write(gpio, irq_status, TQMX86_GPIIS);
 
 	irq_bits = irq_status;
+
+	raw_spin_lock_irqsave(&gpio->spinlock, flags);
+	for_each_set_bit(i, &irq_bits, TQMX86_NGPI) {
+		/*
+		 * Edge-both triggers are implemented by flipping the edge
+		 * trigger after each interrupt, as the controller only supports
+		 * either rising or falling edge triggers, but not both.
+		 *
+		 * Internally, the TQMx86 GPIO controller has separate status
+		 * registers for rising and falling edge interrupts. GPIIC
+		 * configures which bits from which register are visible in the
+		 * interrupt status register GPIIS and defines what triggers the
+		 * parent IRQ line. Writing to GPIIS always clears both rising
+		 * and falling interrupt flags internally, regardless of the
+		 * currently configured trigger.
+		 *
+		 * In consequence, we can cleanly implement the edge-both
+		 * trigger in software by first clearing the interrupt and then
+		 * setting the new trigger based on the current GPIO input in
+		 * tqmx86_gpio_irq_config() - even if an edge arrives between
+		 * reading the input and setting the trigger, we will have a new
+		 * interrupt pending.
+		 */
+		if ((gpio->irq_type[i] & TQMX86_GPII_MASK) == TQMX86_INT_BOTH)
+			tqmx86_gpio_irq_config(gpio, i);
+	}
+	raw_spin_unlock_irqrestore(&gpio->spinlock, flags);
+
 	for_each_set_bit(i, &irq_bits, TQMX86_NGPI)
 		generic_handle_domain_irq(gpio->chip.irq.domain,
 					  i + TQMX86_NGPO);
@@ -277,6 +320,13 @@
 
 	tqmx86_gpio_write(gpio, (u8)~TQMX86_DIR_INPUT_MASK, TQMX86_GPIODD);
 
+	/*
+	 * Reading the previous output state is not possible with TQMx86 hardware.
+	 * Initialize all outputs to 0 to have a defined state that matches the
+	 * shadow register.
+	 */
+	tqmx86_gpio_write(gpio, 0, TQMX86_GPIOD);
+
 	chip = &gpio->chip;
 	chip->label = "gpio-tqmx86";
 	chip->owner = THIS_MODULE;
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-wcove.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-wcove.c
@@ -104,7 +104,7 @@
 	unsigned int reg = type == CTRL_IN ? GPIO_IN_CTRL_BASE : GPIO_OUT_CTRL_BASE;
 
 	if (gpio >= WCOVE_GPIO_NUM)
-		return -EOPNOTSUPP;
+		return -ENOTSUPP;
 
 	return reg + gpio;
 }
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-xilinx.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-xilinx.c
@@ -65,7 +65,7 @@
 	DECLARE_BITMAP(state, 64);
 	DECLARE_BITMAP(last_irq_read, 64);
 	DECLARE_BITMAP(dir, 64);
-	spinlock_t gpio_lock;	/* For serializing operations */
+	raw_spinlock_t gpio_lock;	/* For serializing operations */
 	int irq;
 	DECLARE_BITMAP(enable, 64);
 	DECLARE_BITMAP(rising_edge, 64);
@@ -179,14 +179,14 @@
 	struct xgpio_instance *chip = gpiochip_get_data(gc);
 	int bit = xgpio_to_bit(chip, gpio);
 
-	spin_lock_irqsave(&chip->gpio_lock, flags);
+	raw_spin_lock_irqsave(&chip->gpio_lock, flags);
 
 	/* Write to GPIO signal and set its direction to output */
 	__assign_bit(bit, chip->state, val);
 
 	xgpio_write_ch(chip, XGPIO_DATA_OFFSET, bit, chip->state);
 
-	spin_unlock_irqrestore(&chip->gpio_lock, flags);
+	raw_spin_unlock_irqrestore(&chip->gpio_lock, flags);
 }
 
 /**
@@ -210,7 +210,7 @@
 	bitmap_remap(hw_mask, mask, chip->sw_map, chip->hw_map, 64);
 	bitmap_remap(hw_bits, bits, chip->sw_map, chip->hw_map, 64);
 
-	spin_lock_irqsave(&chip->gpio_lock, flags);
+	raw_spin_lock_irqsave(&chip->gpio_lock, flags);
 
 	bitmap_replace(state, chip->state, hw_bits, hw_mask, 64);
 
@@ -218,7 +218,7 @@
 
 	bitmap_copy(chip->state, state, 64);
 
-	spin_unlock_irqrestore(&chip->gpio_lock, flags);
+	raw_spin_unlock_irqrestore(&chip->gpio_lock, flags);
 }
 
 /**
@@ -236,13 +236,13 @@
 	struct xgpio_instance *chip = gpiochip_get_data(gc);
 	int bit = xgpio_to_bit(chip, gpio);
 
-	spin_lock_irqsave(&chip->gpio_lock, flags);
+	raw_spin_lock_irqsave(&chip->gpio_lock, flags);
 
 	/* Set the GPIO bit in shadow register and set direction as input */
 	__set_bit(bit, chip->dir);
 	xgpio_write_ch(chip, XGPIO_TRI_OFFSET, bit, chip->dir);
 
-	spin_unlock_irqrestore(&chip->gpio_lock, flags);
+	raw_spin_unlock_irqrestore(&chip->gpio_lock, flags);
 
 	return 0;
 }
@@ -265,7 +265,7 @@
 	struct xgpio_instance *chip = gpiochip_get_data(gc);
 	int bit = xgpio_to_bit(chip, gpio);
 
-	spin_lock_irqsave(&chip->gpio_lock, flags);
+	raw_spin_lock_irqsave(&chip->gpio_lock, flags);
 
 	/* Write state of GPIO signal */
 	__assign_bit(bit, chip->state, val);
@@ -275,7 +275,7 @@
 	__clear_bit(bit, chip->dir);
 	xgpio_write_ch(chip, XGPIO_TRI_OFFSET, bit, chip->dir);
 
-	spin_unlock_irqrestore(&chip->gpio_lock, flags);
+	raw_spin_unlock_irqrestore(&chip->gpio_lock, flags);
 
 	return 0;
 }
@@ -401,7 +401,7 @@
 	int bit = xgpio_to_bit(chip, irq_offset);
 	u32 mask = BIT(bit / 32), temp;
 
-	spin_lock_irqsave(&chip->gpio_lock, flags);
+	raw_spin_lock_irqsave(&chip->gpio_lock, flags);
 
 	__clear_bit(bit, chip->enable);
 
@@ -411,7 +411,7 @@
 		temp &= ~mask;
 		xgpio_writereg(chip->regs + XGPIO_IPIER_OFFSET, temp);
 	}
-	spin_unlock_irqrestore(&chip->gpio_lock, flags);
+	raw_spin_unlock_irqrestore(&chip->gpio_lock, flags);
 
 	gpiochip_disable_irq(&chip->gc, irq_offset);
 }
@@ -431,7 +431,7 @@
 
 	gpiochip_enable_irq(&chip->gc, irq_offset);
 
-	spin_lock_irqsave(&chip->gpio_lock, flags);
+	raw_spin_lock_irqsave(&chip->gpio_lock, flags);
 
 	__set_bit(bit, chip->enable);
 
@@ -450,7 +450,7 @@
 		xgpio_writereg(chip->regs + XGPIO_IPIER_OFFSET, val);
 	}
 
-	spin_unlock_irqrestore(&chip->gpio_lock, flags);
+	raw_spin_unlock_irqrestore(&chip->gpio_lock, flags);
 }
 
 /**
@@ -515,7 +515,7 @@
 
 	chained_irq_enter(irqchip, desc);
 
-	spin_lock(&chip->gpio_lock);
+	raw_spin_lock(&chip->gpio_lock);
 
 	xgpio_read_ch_all(chip, XGPIO_DATA_OFFSET, all);
 
@@ -532,7 +532,7 @@
 	bitmap_copy(chip->last_irq_read, all, 64);
 	bitmap_or(all, rising, falling, 64);
 
-	spin_unlock(&chip->gpio_lock);
+	raw_spin_unlock(&chip->gpio_lock);
 
 	dev_dbg(gc->parent, "IRQ rising %*pb falling %*pb\n", 64, rising, 64, falling);
 
@@ -623,7 +623,7 @@
 	bitmap_set(chip->hw_map,  0, width[0]);
 	bitmap_set(chip->hw_map, 32, width[1]);
 
-	spin_lock_init(&chip->gpio_lock);
+	raw_spin_lock_init(&chip->gpio_lock);
 
 	chip->gc.base = -1;
 	chip->gc.ngpio = bitmap_weight(chip->hw_map, 64);
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-zevio.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-zevio.c
@@ -11,6 +11,7 @@
 #include <linux/io.h>
 #include <linux/mod_devicetable.h>
 #include <linux/platform_device.h>
+#include <linux/property.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 
@@ -169,6 +170,7 @@
 /* Initialization */
 static int zevio_gpio_probe(struct platform_device *pdev)
 {
+	struct device *dev = &pdev->dev;
 	struct zevio_gpio *controller;
 	int status, i;
 
@@ -180,6 +182,10 @@
 	controller->chip = zevio_gpio_chip;
 	controller->chip.parent = &pdev->dev;
 
+	controller->chip.label = devm_kasprintf(dev, GFP_KERNEL, "%pfw", dev_fwnode(dev));
+	if (!controller->chip.label)
+		return -ENOMEM;
+
 	controller->regs = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(controller->regs))
 		return dev_err_probe(&pdev->dev, PTR_ERR(controller->regs),
--- linux-qcom-6.8.0.orig/drivers/gpio/gpio-zynqmp-modepin.c
+++ linux-qcom-6.8.0/drivers/gpio/gpio-zynqmp-modepin.c
@@ -146,6 +146,7 @@
 	{ .compatible = "xlnx,zynqmp-gpio-modepin", },
 	{ }
 };
+MODULE_DEVICE_TABLE(of, modepin_platform_id);
 
 static struct platform_driver modepin_platform_driver = {
 	.driver = {
--- linux-qcom-6.8.0.orig/drivers/gpio/gpiolib-acpi.c
+++ linux-qcom-6.8.0/drivers/gpio/gpiolib-acpi.c
@@ -128,7 +128,24 @@
 
 static int acpi_gpiochip_find(struct gpio_chip *gc, void *data)
 {
-	return device_match_acpi_handle(&gc->gpiodev->dev, data);
+	/* First check the actual GPIO device */
+	if (device_match_acpi_handle(&gc->gpiodev->dev, data))
+		return true;
+
+	/*
+	 * When the ACPI device is artificially split to the banks of GPIOs,
+	 * where each of them is represented by a separate GPIO device,
+	 * the firmware node of the physical device may not be shared among
+	 * the banks as they may require different values for the same property,
+	 * e.g., number of GPIOs in a certain bank. In such case the ACPI handle
+	 * of a GPIO device is NULL and can not be used. Hence we have to check
+	 * the parent device to be sure that there is no match before bailing
+	 * out.
+	 */
+	if (gc->parent)
+		return device_match_acpi_handle(gc->parent, data);
+
+	return false;
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpio/gpiolib-cdev.c
+++ linux-qcom-6.8.0/drivers/gpio/gpiolib-cdev.c
@@ -95,6 +95,10 @@
 	GPIOHANDLE_REQUEST_OPEN_DRAIN | \
 	GPIOHANDLE_REQUEST_OPEN_SOURCE)
 
+#define GPIOHANDLE_REQUEST_DIRECTION_FLAGS \
+	(GPIOHANDLE_REQUEST_INPUT | \
+	 GPIOHANDLE_REQUEST_OUTPUT)
+
 static int linehandle_validate_flags(u32 flags)
 {
 	/* Return an error if an unknown flag is set */
@@ -175,21 +179,21 @@
 	if (ret)
 		return ret;
 
+	/* Lines must be reconfigured explicitly as input or output. */
+	if (!(lflags & GPIOHANDLE_REQUEST_DIRECTION_FLAGS))
+		return -EINVAL;
+
 	for (i = 0; i < lh->num_descs; i++) {
 		desc = lh->descs[i];
-		linehandle_flags_to_desc_flags(gcnf.flags, &desc->flags);
+		linehandle_flags_to_desc_flags(lflags, &desc->flags);
 
-		/*
-		 * Lines have to be requested explicitly for input
-		 * or output, else the line will be treated "as is".
-		 */
 		if (lflags & GPIOHANDLE_REQUEST_OUTPUT) {
 			int val = !!gcnf.default_values[i];
 
 			ret = gpiod_direction_output(desc, val);
 			if (ret)
 				return ret;
-		} else if (lflags & GPIOHANDLE_REQUEST_INPUT) {
+		} else {
 			ret = gpiod_direction_input(desc);
 			if (ret)
 				return ret;
@@ -734,6 +738,25 @@
 		       GPIO_V2_LINE_EVENT_FALLING_EDGE;
 }
 
+static inline char *make_irq_label(const char *orig)
+{
+	char *new;
+
+	if (!orig)
+		return NULL;
+
+	new = kstrdup_and_replace(orig, '/', ':', GFP_KERNEL);
+	if (!new)
+		return ERR_PTR(-ENOMEM);
+
+	return new;
+}
+
+static inline void free_irq_label(const char *label)
+{
+	kfree(label);
+}
+
 #ifdef CONFIG_HTE
 
 static enum hte_return process_hw_ts_thread(void *p)
@@ -1021,6 +1044,7 @@
 {
 	unsigned long irqflags;
 	int ret, level, irq;
+	char *label;
 
 	/* try hardware */
 	ret = gpiod_set_debounce(line->desc, debounce_period_us);
@@ -1043,11 +1067,17 @@
 			if (irq < 0)
 				return -ENXIO;
 
+			label = make_irq_label(line->req->label);
+			if (IS_ERR(label))
+				return -ENOMEM;
+
 			irqflags = IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING;
 			ret = request_irq(irq, debounce_irq_handler, irqflags,
-					  line->req->label, line);
-			if (ret)
+					  label, line);
+			if (ret) {
+				free_irq_label(label);
 				return ret;
+			}
 			line->irq = irq;
 		} else {
 			ret = hte_edge_setup(line, GPIO_V2_LINE_FLAG_EDGE_BOTH);
@@ -1092,7 +1122,7 @@
 static void edge_detector_stop(struct line *line)
 {
 	if (line->irq) {
-		free_irq(line->irq, line);
+		free_irq_label(free_irq(line->irq, line));
 		line->irq = 0;
 	}
 
@@ -1116,6 +1146,7 @@
 	unsigned long irqflags = 0;
 	u64 eflags;
 	int irq, ret;
+	char *label;
 
 	eflags = edflags & GPIO_V2_LINE_EDGE_FLAGS;
 	if (eflags && !kfifo_initialized(&line->req->events)) {
@@ -1152,11 +1183,17 @@
 			IRQF_TRIGGER_RISING : IRQF_TRIGGER_FALLING;
 	irqflags |= IRQF_ONESHOT;
 
+	label = make_irq_label(line->req->label);
+	if (IS_ERR(label))
+		return PTR_ERR(label);
+
 	/* Request a thread to read the events */
 	ret = request_threaded_irq(irq, edge_irq_handler, edge_irq_thread,
-				   irqflags, line->req->label, line);
-	if (ret)
+				   irqflags, label, line);
+	if (ret) {
+		free_irq_label(label);
 		return ret;
+	}
 
 	line->irq = irq;
 	return 0;
@@ -1166,6 +1203,8 @@
 				struct gpio_v2_line_config *lc,
 				unsigned int line_idx, u64 edflags)
 {
+	u64 eflags;
+	int ret;
 	u64 active_edflags = READ_ONCE(line->edflags);
 	unsigned int debounce_period_us =
 			gpio_v2_line_config_debounce_period(lc, line_idx);
@@ -1177,6 +1216,18 @@
 	/* sw debounced and still will be...*/
 	if (debounce_period_us && READ_ONCE(line->sw_debounced)) {
 		line_set_debounce_period(line, debounce_period_us);
+		/*
+		 * ensure event fifo is initialised if edge detection
+		 * is now enabled.
+		 */
+		eflags = edflags & GPIO_V2_LINE_EDGE_FLAGS;
+		if (eflags && !kfifo_initialized(&line->req->events)) {
+			ret = kfifo_alloc(&line->req->events,
+					  line->req->event_buffer_size,
+					  GFP_KERNEL);
+			if (ret)
+				return ret;
+		}
 		return 0;
 	}
 
@@ -1489,12 +1540,14 @@
 		line = &lr->lines[i];
 		desc = lr->lines[i].desc;
 		flags = gpio_v2_line_config_flags(&lc, i);
-		gpio_v2_line_config_flags_to_desc_flags(flags, &desc->flags);
-		edflags = flags & GPIO_V2_LINE_EDGE_DETECTOR_FLAGS;
 		/*
-		 * Lines have to be requested explicitly for input
-		 * or output, else the line will be treated "as is".
+		 * Lines not explicitly reconfigured as input or output
+		 * are left unchanged.
 		 */
+		if (!(flags & GPIO_V2_LINE_DIRECTION_FLAGS))
+			continue;
+		gpio_v2_line_config_flags_to_desc_flags(flags, &desc->flags);
+		edflags = flags & GPIO_V2_LINE_EDGE_DETECTOR_FLAGS;
 		if (flags & GPIO_V2_LINE_FLAG_OUTPUT) {
 			int val = gpio_v2_line_config_output_value(&lc, i);
 
@@ -1502,7 +1555,7 @@
 			ret = gpiod_direction_output(desc, val);
 			if (ret)
 				return ret;
-		} else if (flags & GPIO_V2_LINE_FLAG_INPUT) {
+		} else {
 			ret = gpiod_direction_input(desc);
 			if (ret)
 				return ret;
@@ -1979,7 +2032,7 @@
 		blocking_notifier_chain_unregister(&le->gdev->device_notifier,
 						   &le->device_unregistered_nb);
 	if (le->irq)
-		free_irq(le->irq, le);
+		free_irq_label(free_irq(le->irq, le));
 	if (le->desc)
 		gpiod_free(le->desc);
 	kfree(le->label);
@@ -2120,6 +2173,7 @@
 	int fd;
 	int ret;
 	int irq, irqflags = 0;
+	char *label;
 
 	if (copy_from_user(&eventreq, ip, sizeof(eventreq)))
 		return -EFAULT;
@@ -2204,15 +2258,23 @@
 	if (ret)
 		goto out_free_le;
 
+	label = make_irq_label(le->label);
+	if (IS_ERR(label)) {
+		ret = PTR_ERR(label);
+		goto out_free_le;
+	}
+
 	/* Request a thread to read the events */
 	ret = request_threaded_irq(irq,
 				   lineevent_irq_handler,
 				   lineevent_irq_thread,
 				   irqflags,
-				   le->label,
+				   label,
 				   le);
-	if (ret)
+	if (ret) {
+		free_irq_label(label);
 		goto out_free_le;
+	}
 
 	le->irq = irq;
 
@@ -2758,11 +2820,11 @@
 	struct gpio_chardev_data *cdev = file->private_data;
 	struct gpio_device *gdev = cdev->gdev;
 
-	bitmap_free(cdev->watched_lines);
 	blocking_notifier_chain_unregister(&gdev->device_notifier,
 					   &cdev->device_unregistered_nb);
 	blocking_notifier_chain_unregister(&gdev->line_state_notifier,
 					   &cdev->lineinfo_changed_nb);
+	bitmap_free(cdev->watched_lines);
 	gpio_device_put(gdev);
 	kfree(cdev);
 
--- linux-qcom-6.8.0.orig/drivers/gpio/gpiolib-devres.c
+++ linux-qcom-6.8.0/drivers/gpio/gpiolib-devres.c
@@ -158,7 +158,7 @@
 	if (!dr)
 		return ERR_PTR(-ENOMEM);
 
-	desc = fwnode_gpiod_get_index(fwnode, con_id, index, flags, label);
+	desc = gpiod_find_and_request(dev, fwnode, con_id, index, flags, label, false);
 	if (IS_ERR(desc)) {
 		devres_free(dr);
 		return desc;
--- linux-qcom-6.8.0.orig/drivers/gpio/gpiolib-of.c
+++ linux-qcom-6.8.0/drivers/gpio/gpiolib-of.c
@@ -202,6 +202,24 @@
 		 */
 		{ "qi,lb60",		"rb-gpios",	true },
 #endif
+#if IS_ENABLED(CONFIG_PCI_LANTIQ)
+		/*
+		 * According to the PCI specification, the RST# pin is an
+		 * active-low signal. However, most of the device trees that
+		 * have been widely used for a long time incorrectly describe
+		 * reset GPIO as active-high, and were also using wrong name
+		 * for the property.
+		 */
+		{ "lantiq,pci-xway",	"gpio-reset",	false },
+#endif
+#if IS_ENABLED(CONFIG_TOUCHSCREEN_TSC2005)
+		/*
+		 * DTS for Nokia N900 incorrectly specified "active high"
+		 * polarity for the reset line, while the chip actually
+		 * treats it as "active low".
+		 */
+		{ "ti,tsc2005",		"reset-gpios",	false },
+#endif
 	};
 	unsigned int i;
 
@@ -501,9 +519,9 @@
 		{ "reset",	"reset-n-io",	"marvell,nfc-uart" },
 		{ "reset",	"reset-n-io",	"mrvl,nfc-uart" },
 #endif
-#if !IS_ENABLED(CONFIG_PCI_LANTIQ)
+#if IS_ENABLED(CONFIG_PCI_LANTIQ)
 		/* MIPS Lantiq PCI */
-		{ "reset",	"gpios-reset",	"lantiq,pci-xway" },
+		{ "reset",	"gpio-reset",	"lantiq,pci-xway" },
 #endif
 
 		/*
--- linux-qcom-6.8.0.orig/drivers/gpio/gpiolib-sysfs.c
+++ linux-qcom-6.8.0/drivers/gpio/gpiolib-sysfs.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 
 #include <linux/bitops.h>
+#include <linux/cleanup.h>
 #include <linux/device.h>
 #include <linux/idr.h>
 #include <linux/init.h>
@@ -773,15 +774,15 @@
 	struct gpio_desc *desc;
 	struct gpio_chip *chip = gdev->chip;
 
-	if (!gdev->mockdev)
-		return;
+	scoped_guard(mutex, &sysfs_lock) {
+		if (!gdev->mockdev)
+			return;
 
-	device_unregister(gdev->mockdev);
+		device_unregister(gdev->mockdev);
 
-	/* prevent further gpiod exports */
-	mutex_lock(&sysfs_lock);
-	gdev->mockdev = NULL;
-	mutex_unlock(&sysfs_lock);
+		/* prevent further gpiod exports */
+		gdev->mockdev = NULL;
+	}
 
 	/* unregister gpiod class devices owned by sysfs */
 	for_each_gpio_desc_with_flag(chip, desc, FLAG_SYSFS) {
--- linux-qcom-6.8.0.orig/drivers/gpio/gpiolib.c
+++ linux-qcom-6.8.0/drivers/gpio/gpiolib.c
@@ -12,9 +12,11 @@
 #include <linux/idr.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
+#include <linux/irqdesc.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/nospec.h>
 #include <linux/of.h>
 #include <linux/pinctrl/consumer.h>
 #include <linux/seq_file.h>
@@ -174,7 +176,7 @@
 	if (hwnum >= gdev->ngpio)
 		return ERR_PTR(-EINVAL);
 
-	return &gdev->descs[hwnum];
+	return &gdev->descs[array_index_nospec(hwnum, gdev->ngpio)];
 }
 EXPORT_SYMBOL_GPL(gpio_device_get_desc);
 
@@ -653,6 +655,45 @@
 }
 EXPORT_SYMBOL_GPL(gpiochip_line_is_valid);
 
+static void gpiod_free_irqs(struct gpio_desc *desc)
+{
+	int irq = gpiod_to_irq(desc);
+	struct irq_desc *irqd = irq_to_desc(irq);
+	void *cookie;
+
+	for (;;) {
+		/*
+		 * Make sure the action doesn't go away while we're
+		 * dereferencing it. Retrieve and store the cookie value.
+		 * If the irq is freed after we release the lock, that's
+		 * alright - the underlying maple tree lookup will return NULL
+		 * and nothing will happen in free_irq().
+		 */
+		scoped_guard(mutex, &irqd->request_mutex) {
+			if (!irq_desc_has_action(irqd))
+				return;
+
+			cookie = irqd->action->dev_id;
+		}
+
+		free_irq(irq, cookie);
+	}
+}
+
+/*
+ * The chip is going away but there may be users who had requested interrupts
+ * on its GPIO lines who have no idea about its removal and have no way of
+ * being notified about it. We need to free any interrupts still in use here or
+ * we'll leak memory and resources (like procfs files).
+ */
+static void gpiochip_free_remaining_irqs(struct gpio_chip *gc)
+{
+	struct gpio_desc *desc;
+
+	for_each_gpio_desc_with_flag(gc, desc, FLAG_USED_AS_IRQ)
+		gpiod_free_irqs(desc);
+}
+
 static void gpiodev_release(struct device *dev)
 {
 	struct gpio_device *gdev = to_gpio_device(dev);
@@ -1052,6 +1093,8 @@
 	/* FIXME: should the legacy sysfs handling be moved to gpio_device? */
 	gpiochip_sysfs_unregister(gdev);
 	gpiochip_free_hogs(gc);
+	gpiochip_free_remaining_irqs(gc);
+
 	/* Numb the device, cancelling all outstanding operations */
 	gdev->chip = NULL;
 	gpiochip_irqchip_remove(gc);
@@ -2402,6 +2445,11 @@
 }
 EXPORT_SYMBOL_GPL(gpiochip_dup_line_label);
 
+static inline const char *function_name_or_default(const char *con_id)
+{
+	return con_id ?: "(default)";
+}
+
 /**
  * gpiochip_request_own_desc - Allow GPIO chip to request its own descriptor
  * @gc: GPIO chip
@@ -2430,10 +2478,11 @@
 					    enum gpiod_flags dflags)
 {
 	struct gpio_desc *desc = gpiochip_get_desc(gc, hwnum);
+	const char *name = function_name_or_default(label);
 	int ret;
 
 	if (IS_ERR(desc)) {
-		chip_err(gc, "failed to get GPIO descriptor\n");
+		chip_err(gc, "failed to get GPIO %s descriptor\n", name);
 		return desc;
 	}
 
@@ -2443,8 +2492,8 @@
 
 	ret = gpiod_configure_flags(desc, label, lflags, dflags);
 	if (ret) {
-		chip_err(gc, "setup of own GPIO %s failed\n", label);
 		gpiod_free_commit(desc);
+		chip_err(gc, "setup of own GPIO %s failed\n", name);
 		return ERR_PTR(ret);
 	}
 
@@ -4119,34 +4168,33 @@
 					      enum gpiod_flags *flags,
 					      unsigned long *lookupflags)
 {
+	const char *name = function_name_or_default(con_id);
 	struct gpio_desc *desc = ERR_PTR(-ENOENT);
 
 	if (is_of_node(fwnode)) {
-		dev_dbg(consumer, "using DT '%pfw' for '%s' GPIO lookup\n",
-			fwnode, con_id);
+		dev_dbg(consumer, "using DT '%pfw' for '%s' GPIO lookup\n", fwnode, name);
 		desc = of_find_gpio(to_of_node(fwnode), con_id, idx, lookupflags);
 	} else if (is_acpi_node(fwnode)) {
-		dev_dbg(consumer, "using ACPI '%pfw' for '%s' GPIO lookup\n",
-			fwnode, con_id);
+		dev_dbg(consumer, "using ACPI '%pfw' for '%s' GPIO lookup\n", fwnode, name);
 		desc = acpi_find_gpio(fwnode, con_id, idx, flags, lookupflags);
 	} else if (is_software_node(fwnode)) {
-		dev_dbg(consumer, "using swnode '%pfw' for '%s' GPIO lookup\n",
-			fwnode, con_id);
+		dev_dbg(consumer, "using swnode '%pfw' for '%s' GPIO lookup\n", fwnode, name);
 		desc = swnode_find_gpio(fwnode, con_id, idx, lookupflags);
 	}
 
 	return desc;
 }
 
-static struct gpio_desc *gpiod_find_and_request(struct device *consumer,
-						struct fwnode_handle *fwnode,
-						const char *con_id,
-						unsigned int idx,
-						enum gpiod_flags flags,
-						const char *label,
-						bool platform_lookup_allowed)
+struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+					 struct fwnode_handle *fwnode,
+					 const char *con_id,
+					 unsigned int idx,
+					 enum gpiod_flags flags,
+					 const char *label,
+					 bool platform_lookup_allowed)
 {
 	unsigned long lookupflags = GPIO_LOOKUP_FLAGS_DEFAULT;
+	const char *name = function_name_or_default(con_id);
 	struct gpio_desc *desc;
 	int ret;
 
@@ -4162,7 +4210,7 @@
 	}
 
 	if (IS_ERR(desc)) {
-		dev_dbg(consumer, "No GPIO consumer %s found\n", con_id);
+		dev_dbg(consumer, "No GPIO consumer %s found\n", name);
 		return desc;
 	}
 
@@ -4183,15 +4231,14 @@
 		 *
 		 * FIXME: Make this more sane and safe.
 		 */
-		dev_info(consumer,
-			 "nonexclusive access to GPIO for %s\n", con_id);
+		dev_info(consumer, "nonexclusive access to GPIO for %s\n", name);
 		return desc;
 	}
 
 	ret = gpiod_configure_flags(desc, con_id, lookupflags, flags);
 	if (ret < 0) {
-		dev_dbg(consumer, "setup of GPIO %s failed\n", con_id);
 		gpiod_put(desc);
+		dev_dbg(consumer, "setup of GPIO %s failed\n", name);
 		return ERR_PTR(ret);
 	}
 
@@ -4307,6 +4354,7 @@
 int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id,
 		unsigned long lflags, enum gpiod_flags dflags)
 {
+	const char *name = function_name_or_default(con_id);
 	int ret;
 
 	if (lflags & GPIO_ACTIVE_LOW)
@@ -4350,7 +4398,7 @@
 
 	/* No particular flag request, return here... */
 	if (!(dflags & GPIOD_FLAGS_BIT_DIR_SET)) {
-		gpiod_dbg(desc, "no flags found for %s\n", con_id);
+		gpiod_dbg(desc, "no flags found for GPIO %s\n", name);
 		return 0;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpio/gpiolib.h
+++ linux-qcom-6.8.0/drivers/gpio/gpiolib.h
@@ -202,6 +202,14 @@
 	return ret;
 }
 
+struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+					 struct fwnode_handle *fwnode,
+					 const char *con_id,
+					 unsigned int idx,
+					 enum gpiod_flags flags,
+					 const char *label,
+					 bool platform_lookup_allowed);
+
 int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id,
 		unsigned long lflags, enum gpiod_flags dflags);
 int gpio_set_debounce_timeout(struct gpio_desc *desc, unsigned int debounce);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/Kconfig
+++ linux-qcom-6.8.0/drivers/gpu/drm/Kconfig
@@ -221,6 +221,7 @@
 config DRM_GPUVM
 	tristate
 	depends on DRM
+	select DRM_EXEC
 	help
 	  GPU-VM representation providing helpers to manage a GPUs virtual
 	  address space
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/Makefile
@@ -157,6 +157,7 @@
 obj-$(CONFIG_DRM_QXL) += qxl/
 obj-$(CONFIG_DRM_VIRTIO_GPU) += virtio/
 obj-$(CONFIG_DRM_MSM) += msm/
+obj-$(CONFIG_DRM_MSM) += msm_default/
 obj-$(CONFIG_DRM_TEGRA) += tegra/
 obj-$(CONFIG_DRM_STM) += stm/
 obj-$(CONFIG_DRM_STI) += sti/
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/aldebaran.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/aldebaran.c
@@ -97,7 +97,7 @@
 		adev->ip_blocks[i].status.hw = false;
 	}
 
-	return r;
+	return 0;
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -198,7 +198,7 @@
 extern uint amdgpu_dc_feature_mask;
 extern uint amdgpu_dc_debug_mask;
 extern uint amdgpu_dc_visual_confirm;
-extern uint amdgpu_dm_abm_level;
+extern int amdgpu_dm_abm_level;
 extern int amdgpu_backlight;
 extern int amdgpu_damage_clips;
 extern struct amdgpu_mgpu_info mgpu_info;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -147,6 +147,7 @@
 					   struct acpi_buffer *params)
 {
 	acpi_status status;
+	union acpi_object *obj;
 	union acpi_object atif_arg_elements[2];
 	struct acpi_object_list atif_arg;
 	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
@@ -169,16 +170,24 @@
 
 	status = acpi_evaluate_object(atif->handle, NULL, &atif_arg,
 				      &buffer);
+	obj = (union acpi_object *)buffer.pointer;
 
-	/* Fail only if calling the method fails and ATIF is supported */
-	if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
+	/* Fail if calling the method fails */
+	if (ACPI_FAILURE(status)) {
 		DRM_DEBUG_DRIVER("failed to evaluate ATIF got %s\n",
 				 acpi_format_exception(status));
-		kfree(buffer.pointer);
+		kfree(obj);
 		return NULL;
 	}
 
-	return buffer.pointer;
+	if (obj->type != ACPI_TYPE_BUFFER) {
+		DRM_DEBUG_DRIVER("bad object returned from ATIF: %d\n",
+				 obj->type);
+		kfree(obj);
+		return NULL;
+	}
+
+	return obj;
 }
 
 /**
@@ -789,6 +798,7 @@
 		return -EIO;
 	}
 
+	kfree(info);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c
@@ -100,6 +100,7 @@
 	amdgpu_afmt_calc_cts(clock, &res.cts_32khz, &res.n_32khz, 32000);
 	amdgpu_afmt_calc_cts(clock, &res.cts_44_1khz, &res.n_44_1khz, 44100);
 	amdgpu_afmt_calc_cts(clock, &res.cts_48khz, &res.n_48khz, 48000);
+	res.clock = clock;
 
 	return res;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -146,7 +146,7 @@
 {
 	int ret;
 
-	if (!adev->kfd.init_complete)
+	if (!adev->kfd.init_complete || adev->kfd.client.dev)
 		return 0;
 
 	ret = drm_client_init(&adev->ddev, &adev->kfd.client, "kfd",
@@ -360,15 +360,15 @@
 	return r;
 }
 
-void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void *mem_obj)
+void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj)
 {
-	struct amdgpu_bo *bo = (struct amdgpu_bo *) mem_obj;
+	struct amdgpu_bo **bo = (struct amdgpu_bo **) mem_obj;
 
-	amdgpu_bo_reserve(bo, true);
-	amdgpu_bo_kunmap(bo);
-	amdgpu_bo_unpin(bo);
-	amdgpu_bo_unreserve(bo);
-	amdgpu_bo_unref(&(bo));
+	amdgpu_bo_reserve(*bo, true);
+	amdgpu_bo_kunmap(*bo);
+	amdgpu_bo_unpin(*bo);
+	amdgpu_bo_unreserve(*bo);
+	amdgpu_bo_unref(bo);
 }
 
 int amdgpu_amdkfd_alloc_gws(struct amdgpu_device *adev, size_t size,
@@ -455,6 +455,9 @@
 		else
 			mem_info->local_mem_size_private =
 					KFD_XCP_MEMORY_SIZE(adev, xcp->id);
+	} else if (adev->flags & AMD_IS_APU) {
+		mem_info->local_mem_size_public = (ttm_tt_pages_limit() << PAGE_SHIFT);
+		mem_info->local_mem_size_private = 0;
 	} else {
 		mem_info->local_mem_size_public = adev->gmc.visible_vram_size;
 		mem_info->local_mem_size_private = adev->gmc.real_vram_size -
@@ -708,8 +711,9 @@
 void amdgpu_amdkfd_set_compute_idle(struct amdgpu_device *adev, bool idle)
 {
 	enum amd_powergating_state state = idle ? AMD_PG_STATE_GATE : AMD_PG_STATE_UNGATE;
-	if (IP_VERSION_MAJ(amdgpu_ip_version(adev, GC_HWIP, 0)) == 11 &&
-	    ((adev->mes.kiq_version & AMDGPU_MES_VERSION_MASK) <= 64)) {
+	if ((IP_VERSION_MAJ(amdgpu_ip_version(adev, GC_HWIP, 0)) == 11 &&
+	    ((adev->mes.kiq_version & AMDGPU_MES_VERSION_MASK) <= 64)) ||
+		(IP_VERSION_MAJ(amdgpu_ip_version(adev, GC_HWIP, 0)) == 12)) {
 		pr_debug("GFXOFF is %s\n", idle ? "enabled" : "disabled");
 		amdgpu_gfx_off_ctrl(adev, idle);
 	} else if ((IP_VERSION_MAJ(amdgpu_ip_version(adev, GC_HWIP, 0)) == 9) &&
@@ -803,6 +807,8 @@
 		}
 		do_div(tmp, adev->xcp_mgr->num_xcp_per_mem_partition);
 		return ALIGN_DOWN(tmp, PAGE_SIZE);
+	} else if (adev->flags & AMD_IS_APU) {
+		return (ttm_tt_pages_limit() << PAGE_SHIFT);
 	} else {
 		return adev->gmc.real_vram_size;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -223,7 +223,7 @@
 int amdgpu_amdkfd_alloc_gtt_mem(struct amdgpu_device *adev, size_t size,
 				void **mem_obj, uint64_t *gpu_addr,
 				void **cpu_ptr, bool mqd_gfx9);
-void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void *mem_obj);
+void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj);
 int amdgpu_amdkfd_alloc_gws(struct amdgpu_device *adev, size_t size,
 				void **mem_obj);
 void amdgpu_amdkfd_free_gws(struct amdgpu_device *adev, void *mem_obj);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -196,7 +196,7 @@
 			return -EINVAL;
 
 		vram_size = KFD_XCP_MEMORY_SIZE(adev, xcp_id);
-		if (adev->gmc.is_app_apu) {
+		if (adev->gmc.is_app_apu || adev->flags & AMD_IS_APU) {
 			system_mem_needed = size;
 			ttm_mem_needed = size;
 		}
@@ -220,7 +220,7 @@
 	    (kfd_mem_limit.ttm_mem_used + ttm_mem_needed >
 	     kfd_mem_limit.max_ttm_mem_limit) ||
 	    (adev && xcp_id >= 0 && adev->kfd.vram_used[xcp_id] + vram_needed >
-	     vram_size - reserved_for_pt)) {
+	     vram_size - reserved_for_pt - atomic64_read(&adev->vram_pin_size))) {
 		ret = -ENOMEM;
 		goto release;
 	}
@@ -232,7 +232,8 @@
 		  "adev reference can't be null when vram is used");
 	if (adev && xcp_id >= 0) {
 		adev->kfd.vram_used[xcp_id] += vram_needed;
-		adev->kfd.vram_used_aligned[xcp_id] += adev->gmc.is_app_apu ?
+		adev->kfd.vram_used_aligned[xcp_id] +=
+				(adev->gmc.is_app_apu || adev->flags & AMD_IS_APU) ?
 				vram_needed :
 				ALIGN(vram_needed, VRAM_AVAILABLITY_ALIGN);
 	}
@@ -260,7 +261,7 @@
 
 		if (adev) {
 			adev->kfd.vram_used[xcp_id] -= size;
-			if (adev->gmc.is_app_apu) {
+			if (adev->gmc.is_app_apu || adev->flags & AMD_IS_APU) {
 				adev->kfd.vram_used_aligned[xcp_id] -= size;
 				kfd_mem_limit.system_mem_used -= size;
 				kfd_mem_limit.ttm_mem_used -= size;
@@ -414,6 +415,10 @@
 		 "Called with userptr BO"))
 		return -EINVAL;
 
+	/* bo has been pinned, not need validate it */
+	if (bo->tbo.pin_count)
+		return 0;
+
 	amdgpu_bo_placement_from_domain(bo, domain);
 
 	ret = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
@@ -887,7 +892,7 @@
 	 * if peer device has large BAR. In contrast, access over xGMI is
 	 * allowed for both small and large BAR configurations of peer device
 	 */
-	if ((adev != bo_adev && !adev->gmc.is_app_apu) &&
+	if ((adev != bo_adev && !(adev->gmc.is_app_apu || adev->flags & AMD_IS_APU)) &&
 	    ((mem->domain == AMDGPU_GEM_DOMAIN_VRAM) ||
 	     (mem->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_DOORBELL) ||
 	     (mem->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_MMIO_REMAP))) {
@@ -1186,7 +1191,8 @@
 	int ret;
 
 	ctx->sync = &mem->sync;
-	drm_exec_init(&ctx->exec, DRM_EXEC_INTERRUPTIBLE_WAIT, 0);
+	drm_exec_init(&ctx->exec, DRM_EXEC_INTERRUPTIBLE_WAIT |
+		      DRM_EXEC_IGNORE_DUPLICATES, 0);
 	drm_exec_until_all_locked(&ctx->exec) {
 		ctx->n_vms = 0;
 		list_for_each_entry(entry, &mem->attachments, list) {
@@ -1424,8 +1430,8 @@
 	list_add_tail(&vm->vm_list_node,
 			&(vm->process_info->vm_list_head));
 	vm->process_info->n_vms++;
-
-	*ef = dma_fence_get(&vm->process_info->eviction_fence->base);
+	if (ef)
+		*ef = dma_fence_get(&vm->process_info->eviction_fence->base);
 	mutex_unlock(&vm->process_info->lock);
 
 	return 0;
@@ -1653,7 +1659,7 @@
 		- atomic64_read(&adev->vram_pin_size)
 		- reserved_for_pt;
 
-	if (adev->gmc.is_app_apu) {
+	if (adev->gmc.is_app_apu || adev->flags & AMD_IS_APU) {
 		system_mem_available = no_system_mem_limit ?
 					kfd_mem_limit.max_system_mem_limit :
 					kfd_mem_limit.max_system_mem_limit -
@@ -1701,7 +1707,7 @@
 	if (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) {
 		domain = alloc_domain = AMDGPU_GEM_DOMAIN_VRAM;
 
-		if (adev->gmc.is_app_apu) {
+		if (adev->gmc.is_app_apu || adev->flags & AMD_IS_APU) {
 			domain = AMDGPU_GEM_DOMAIN_GTT;
 			alloc_domain = AMDGPU_GEM_DOMAIN_GTT;
 			alloc_flags = 0;
@@ -1851,6 +1857,7 @@
 err_bo_create:
 	amdgpu_amdkfd_unreserve_mem_limit(adev, aligned_size, flags, xcp_id);
 err_reserve_limit:
+	amdgpu_sync_free(&(*mem)->sync);
 	mutex_destroy(&(*mem)->lock);
 	if (gobj)
 		drm_gem_object_put(gobj);
@@ -1947,7 +1954,7 @@
 	if (size) {
 		if (!is_imported &&
 		   (mem->bo->preferred_domains == AMDGPU_GEM_DOMAIN_VRAM ||
-		   (adev->gmc.is_app_apu &&
+		   ((adev->gmc.is_app_apu || adev->flags & AMD_IS_APU) &&
 		    mem->bo->preferred_domains == AMDGPU_GEM_DOMAIN_GTT)))
 			*size = bo_size;
 		else
@@ -2370,8 +2377,9 @@
 	(*mem)->dmabuf = dma_buf;
 	(*mem)->bo = bo;
 	(*mem)->va = va;
-	(*mem)->domain = (bo->preferred_domains & AMDGPU_GEM_DOMAIN_VRAM) && !adev->gmc.is_app_apu ?
-		AMDGPU_GEM_DOMAIN_VRAM : AMDGPU_GEM_DOMAIN_GTT;
+	(*mem)->domain = (bo->preferred_domains & AMDGPU_GEM_DOMAIN_VRAM) &&
+			 !(adev->gmc.is_app_apu || adev->flags & AMD_IS_APU) ?
+			 AMDGPU_GEM_DOMAIN_VRAM : AMDGPU_GEM_DOMAIN_GTT;
 
 	(*mem)->mapped_to_gpu_memory = 0;
 	(*mem)->process_info = avm->process_info;
@@ -2706,7 +2714,7 @@
 
 		/* keep mem without hmm range at userptr_inval_list */
 		if (!mem->range)
-			 continue;
+			continue;
 
 		/* Only check mem with hmm range associated */
 		valid = amdgpu_ttm_tt_get_user_pages_done(
@@ -2934,9 +2942,6 @@
 			if (!attachment->is_mapped)
 				continue;
 
-			if (attachment->bo_va->base.bo->tbo.pin_count)
-				continue;
-
 			kfd_mem_dmaunmap_attachment(mem, attachment);
 			ret = update_gpuvm_pte(mem, attachment, &sync_obj);
 			if (ret) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
@@ -1018,7 +1018,9 @@
 		if (clock_type == COMPUTE_ENGINE_PLL_PARAM) {
 			args.v3.ulClockParams = cpu_to_le32((clock_type << 24) | clock);
 
-			amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+			if (amdgpu_atom_execute_table(adev->mode_info.atom_context,
+			    index, (uint32_t *)&args, sizeof(args)))
+				return -EINVAL;
 
 			dividers->post_div = args.v3.ucPostDiv;
 			dividers->enable_post_div = (args.v3.ucCntlFlag &
@@ -1038,7 +1040,9 @@
 			if (strobe_mode)
 				args.v5.ucInputFlag = ATOM_PLL_INPUT_FLAG_PLL_STROBE_MODE_EN;
 
-			amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+			if (amdgpu_atom_execute_table(adev->mode_info.atom_context,
+			    index, (uint32_t *)&args, sizeof(args)))
+				return -EINVAL;
 
 			dividers->post_div = args.v5.ucPostDiv;
 			dividers->enable_post_div = (args.v5.ucCntlFlag &
@@ -1056,7 +1060,9 @@
 		/* fusion */
 		args.v4.ulClock = cpu_to_le32(clock);	/* 10 khz */
 
-		amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+		if (amdgpu_atom_execute_table(adev->mode_info.atom_context,
+		    index, (uint32_t *)&args, sizeof(args)))
+			return -EINVAL;
 
 		dividers->post_divider = dividers->post_div = args.v4.ucPostDiv;
 		dividers->real_clock = le32_to_cpu(args.v4.ulClock);
@@ -1067,7 +1073,9 @@
 		args.v6_in.ulClock.ulComputeClockFlag = clock_type;
 		args.v6_in.ulClock.ulClockFreq = cpu_to_le32(clock);	/* 10 khz */
 
-		amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+		if (amdgpu_atom_execute_table(adev->mode_info.atom_context,
+		    index, (uint32_t *)&args, sizeof(args)))
+			return -EINVAL;
 
 		dividers->whole_fb_div = le16_to_cpu(args.v6_out.ulFbDiv.usFbDiv);
 		dividers->frac_fb_div = le16_to_cpu(args.v6_out.ulFbDiv.usFbDivFrac);
@@ -1109,7 +1117,9 @@
 			if (strobe_mode)
 				args.ucInputFlag |= MPLL_INPUT_FLAG_STROBE_MODE_EN;
 
-			amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+			if (amdgpu_atom_execute_table(adev->mode_info.atom_context,
+			    index, (uint32_t *)&args, sizeof(args)))
+				return -EINVAL;
 
 			mpll_param->clkfrac = le16_to_cpu(args.ulFbDiv.usFbDivFrac);
 			mpll_param->clkf = le16_to_cpu(args.ulFbDiv.usFbDiv);
@@ -1151,7 +1161,8 @@
 	if (mem_clock)
 		args.sReserved.ulClock = cpu_to_le32(mem_clock & SET_CLOCK_FREQ_MASK);
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args,
+		sizeof(args));
 }
 
 void amdgpu_atombios_get_default_voltages(struct amdgpu_device *adev,
@@ -1205,7 +1216,9 @@
 		args.v2.ucVoltageMode = 0;
 		args.v2.usVoltageLevel = 0;
 
-		amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+		if (amdgpu_atom_execute_table(adev->mode_info.atom_context,
+		    index, (uint32_t *)&args, sizeof(args)))
+			return -EINVAL;
 
 		*voltage = le16_to_cpu(args.v2.usVoltageLevel);
 		break;
@@ -1214,7 +1227,9 @@
 		args.v3.ucVoltageMode = ATOM_GET_VOLTAGE_LEVEL;
 		args.v3.usVoltageLevel = cpu_to_le16(voltage_id);
 
-		amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+		if (amdgpu_atom_execute_table(adev->mode_info.atom_context,
+		    index, (uint32_t *)&args, sizeof(args)))
+			return -EINVAL;
 
 		*voltage = le16_to_cpu(args.v3.usVoltageLevel);
 		break;
@@ -1476,6 +1491,8 @@
 										(u32)le32_to_cpu(*((u32 *)reg_data + j));
 									j++;
 								} else if ((reg_table->mc_reg_address[i].pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) {
+									if (i == 0)
+										continue;
 									reg_table->mc_reg_table_entry[num_ranges].mc_data[i] =
 										reg_table->mc_reg_table_entry[num_ranges].mc_data[i - 1];
 								}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c
@@ -211,6 +211,7 @@
 	struct atom_integrated_system_info_v1_11 v11;
 	struct atom_integrated_system_info_v1_12 v12;
 	struct atom_integrated_system_info_v2_1 v21;
+	struct atom_integrated_system_info_v2_3 v23;
 };
 
 union umc_info {
@@ -359,6 +360,20 @@
 					if (vram_type)
 						*vram_type = convert_atom_mem_type_to_vram_type(adev, mem_type);
 					break;
+				case 3:
+					mem_channel_number = igp_info->v23.umachannelnumber;
+					if (!mem_channel_number)
+						mem_channel_number = 1;
+					mem_type = igp_info->v23.memorytype;
+					if (mem_type == LpDdr5MemType)
+						mem_channel_width = 32;
+					else
+						mem_channel_width = 64;
+					if (vram_width)
+						*vram_width = mem_channel_number * mem_channel_width;
+					if (vram_type)
+						*vram_type = convert_atom_mem_type_to_vram_type(adev, mem_type);
+					break;
 				default:
 					return -EINVAL;
 				}
@@ -384,7 +399,7 @@
 					mem_channel_number = vram_info->v30.channel_num;
 					mem_channel_width = vram_info->v30.channel_width;
 					if (vram_width)
-						*vram_width = mem_channel_number * (1 << mem_channel_width);
+						*vram_width = mem_channel_number * 16;
 					break;
 				default:
 					return -EINVAL;
@@ -941,5 +956,6 @@
 		return -EINVAL;
 	}
 
-	return amdgpu_atom_execute_table(ctx, ATOM_CMD_INIT, (uint32_t *)&asic_init_ps_v2_1);
+	return amdgpu_atom_execute_table(ctx, ATOM_CMD_INIT, (uint32_t *)&asic_init_ps_v2_1,
+		sizeof(asic_init_ps_v2_1));
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -213,6 +213,9 @@
 		struct amdgpu_firmware_info *ucode;
 
 		id = fw_type_convert(cgs_device, type);
+		if (id >= AMDGPU_UCODE_ID_MAXIMUM)
+			return -EINVAL;
+
 		ucode = &adev->firmware.ucode[id];
 		if (ucode->fw == NULL)
 			return -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -263,6 +263,10 @@
 			if (size < sizeof(struct drm_amdgpu_bo_list_in))
 				goto free_partial_kdata;
 
+			/* Only a single BO list is allowed to simplify handling. */
+			if (p->bo_list)
+				goto free_partial_kdata;
+
 			ret = amdgpu_cs_p1_bo_handles(p, p->chunks[i].kdata);
 			if (ret)
 				goto free_partial_kdata;
@@ -819,7 +823,7 @@
 
 	p->bytes_moved += ctx.bytes_moved;
 	if (!amdgpu_gmc_vram_full_visible(&adev->gmc) &&
-	    amdgpu_bo_in_cpu_visible_vram(bo))
+	    amdgpu_res_cpu_visible(adev, bo->tbo.resource))
 		p->bytes_moved_vis += ctx.bytes_moved;
 
 	if (unlikely(r == -ENOMEM) && domain != bo->allowed_domains) {
@@ -1057,6 +1061,9 @@
 			r = amdgpu_ring_parse_cs(ring, p, job, ib);
 			if (r)
 				return r;
+
+			if (ib->sa_bo)
+				ib->gpu_addr =  amdgpu_sa_bo_gpu_addr(ib->sa_bo);
 		} else {
 			ib->ptr = (uint32_t *)kptr;
 			r = amdgpu_ring_patch_cs_in_place(ring, p, job, ib);
@@ -1093,6 +1100,21 @@
 	unsigned int i;
 	int r;
 
+	/*
+	 * We can't use gang submit on with reserved VMIDs when the VM changes
+	 * can't be invalidated by more than one engine at the same time.
+	 */
+	if (p->gang_size > 1 && !p->adev->vm_manager.concurrent_flush) {
+		for (i = 0; i < p->gang_size; ++i) {
+			struct drm_sched_entity *entity = p->entities[i];
+			struct drm_gpu_scheduler *sched = entity->rq->sched;
+			struct amdgpu_ring *ring = to_amdgpu_ring(sched);
+
+			if (amdgpu_vmid_uses_reserved(vm, ring->vm_hub))
+				return -EINVAL;
+		}
+	}
+
 	r = amdgpu_vm_clear_freed(adev, vm, NULL);
 	if (r)
 		return r;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -685,16 +685,24 @@
 
 	switch (args->in.op) {
 	case AMDGPU_CTX_OP_ALLOC_CTX:
+		if (args->in.flags)
+			return -EINVAL;
 		r = amdgpu_ctx_alloc(adev, fpriv, filp, priority, &id);
 		args->out.alloc.ctx_id = id;
 		break;
 	case AMDGPU_CTX_OP_FREE_CTX:
+		if (args->in.flags)
+			return -EINVAL;
 		r = amdgpu_ctx_free(fpriv, id);
 		break;
 	case AMDGPU_CTX_OP_QUERY_STATE:
+		if (args->in.flags)
+			return -EINVAL;
 		r = amdgpu_ctx_query(adev, fpriv, id, &args->out);
 		break;
 	case AMDGPU_CTX_OP_QUERY_STATE2:
+		if (args->in.flags)
+			return -EINVAL;
 		r = amdgpu_ctx_query2(adev, fpriv, id, &args->out);
 		break;
 	case AMDGPU_CTX_OP_GET_STABLE_PSTATE:
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -402,7 +402,7 @@
 	int r;
 	uint32_t *data, x;
 
-	if (size & 0x3 || *pos & 0x3)
+	if (size > 4096 || size & 0x3 || *pos & 0x3)
 		return -EINVAL;
 
 	r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
@@ -1648,7 +1648,7 @@
 
 	for (i = 0; i < ARRAY_SIZE(debugfs_regs); i++) {
 		ent = debugfs_create_file(debugfs_regs_names[i],
-					  S_IFREG | 0444, root,
+					  S_IFREG | 0400, root,
 					  adev, debugfs_regs[i]);
 		if (!i && !IS_ERR_OR_NULL(ent))
 			i_size_write(ent->d_inode, adev->rmmio_size);
@@ -2060,12 +2060,13 @@
 	struct amdgpu_device *adev = (struct amdgpu_device *)file_inode(f)->i_private;
 	char reg_offset[11];
 	uint32_t *new = NULL, *tmp = NULL;
-	int ret, i = 0, len = 0;
+	unsigned int len = 0;
+	int ret, i = 0;
 
 	do {
 		memset(reg_offset, 0, 11);
 		if (copy_from_user(reg_offset, buf + len,
-					min(10, ((int)size-len)))) {
+					min(10, (size-len)))) {
 			ret = -EFAULT;
 			goto error_free;
 		}
@@ -2185,11 +2186,11 @@
 	amdgpu_securedisplay_debugfs_init(adev);
 	amdgpu_fw_attestation_debugfs_init(adev);
 
-	debugfs_create_file("amdgpu_evict_vram", 0444, root, adev,
+	debugfs_create_file("amdgpu_evict_vram", 0400, root, adev,
 			    &amdgpu_evict_vram_fops);
-	debugfs_create_file("amdgpu_evict_gtt", 0444, root, adev,
+	debugfs_create_file("amdgpu_evict_gtt", 0400, root, adev,
 			    &amdgpu_evict_gtt_fops);
-	debugfs_create_file("amdgpu_test_ib", 0444, root, adev,
+	debugfs_create_file("amdgpu_test_ib", 0400, root, adev,
 			    &amdgpu_debugfs_test_ib_fops);
 	debugfs_create_file("amdgpu_vm_info", 0444, root, adev,
 			    &amdgpu_debugfs_vm_info_fops);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3945,6 +3945,7 @@
 	mutex_init(&adev->grbm_idx_mutex);
 	mutex_init(&adev->mn_lock);
 	mutex_init(&adev->virt.vf_errors.lock);
+	mutex_init(&adev->virt.rlcg_reg_lock);
 	hash_init(adev->mn_hash);
 	mutex_init(&adev->psp.mutex);
 	mutex_init(&adev->notifier_lock);
@@ -4120,18 +4121,22 @@
 					adev->ip_blocks[i].status.hw = true;
 				}
 			}
+		} else if (amdgpu_ip_version(adev, MP1_HWIP, 0) == IP_VERSION(13, 0, 10) &&
+				   !amdgpu_device_has_display_hardware(adev)) {
+					r = psp_gpu_reset(adev);
 		} else {
-			tmp = amdgpu_reset_method;
-			/* It should do a default reset when loading or reloading the driver,
-			 * regardless of the module parameter reset_method.
-			 */
-			amdgpu_reset_method = AMD_RESET_METHOD_NONE;
-			r = amdgpu_asic_reset(adev);
-			amdgpu_reset_method = tmp;
-			if (r) {
-				dev_err(adev->dev, "asic reset on init failed\n");
-				goto failed;
-			}
+				tmp = amdgpu_reset_method;
+				/* It should do a default reset when loading or reloading the driver,
+				 * regardless of the module parameter reset_method.
+				 */
+				amdgpu_reset_method = AMD_RESET_METHOD_NONE;
+				r = amdgpu_asic_reset(adev);
+				amdgpu_reset_method = tmp;
+		}
+
+		if (r) {
+		  dev_err(adev->dev, "asic reset on init failed\n");
+		  goto failed;
 		}
 	}
 
@@ -4421,8 +4426,8 @@
 	int idx;
 	bool px;
 
-	amdgpu_fence_driver_sw_fini(adev);
 	amdgpu_device_ip_fini(adev);
+	amdgpu_fence_driver_sw_fini(adev);
 	amdgpu_ucode_release(&adev->firmware.gpu_info_fw);
 	adev->accel_working = false;
 	dma_fence_put(rcu_dereference_protected(adev->gang_submit, true));
@@ -4524,6 +4529,8 @@
 	if (r)
 		goto unprepare;
 
+	flush_delayed_work(&adev->gfx.gfx_off_delay_work);
+
 	for (i = 0; i < adev->num_ip_blocks; i++) {
 		if (!adev->ip_blocks[i].status.valid)
 			continue;
@@ -4894,7 +4901,8 @@
 		shadow = vmbo->shadow;
 
 		/* No need to recover an evicted BO */
-		if (shadow->tbo.resource->mem_type != TTM_PL_TT ||
+		if (!shadow->tbo.resource ||
+		    shadow->tbo.resource->mem_type != TTM_PL_TT ||
 		    shadow->tbo.resource->start == AMDGPU_BO_INVALID_OFFSET ||
 		    shadow->parent->tbo.resource->mem_type != TTM_PL_VRAM)
 			continue;
@@ -4938,27 +4946,26 @@
  * amdgpu_device_reset_sriov - reset ASIC for SR-IOV vf
  *
  * @adev: amdgpu_device pointer
- * @from_hypervisor: request from hypervisor
+ * @reset_context: amdgpu reset context pointer
  *
  * do VF FLR and reinitialize Asic
  * return 0 means succeeded otherwise failed
  */
 static int amdgpu_device_reset_sriov(struct amdgpu_device *adev,
-				     bool from_hypervisor)
+				     struct amdgpu_reset_context *reset_context)
 {
 	int r;
 	struct amdgpu_hive_info *hive = NULL;
-	int retry_limit = 0;
 
-retry:
-	amdgpu_amdkfd_pre_reset(adev);
-
-	if (from_hypervisor)
+	if (test_bit(AMDGPU_HOST_FLR, &reset_context->flags)) {
+		clear_bit(AMDGPU_HOST_FLR, &reset_context->flags);
 		r = amdgpu_virt_request_full_gpu(adev, true);
-	else
+	} else {
 		r = amdgpu_virt_reset_gpu(adev);
+	}
 	if (r)
 		return r;
+
 	amdgpu_irq_gpu_reset_resume_helper(adev);
 
 	/* some sw clean up VF needs to do before recover */
@@ -4967,7 +4974,7 @@
 	/* Resume IP prior to SMC */
 	r = amdgpu_device_ip_reinit_early_sriov(adev);
 	if (r)
-		goto error;
+		return r;
 
 	amdgpu_virt_init_data_exchange(adev);
 
@@ -4978,38 +4985,35 @@
 	/* now we are okay to resume SMC/CP/SDMA */
 	r = amdgpu_device_ip_reinit_late_sriov(adev);
 	if (r)
-		goto error;
+		return r;
 
 	hive = amdgpu_get_xgmi_hive(adev);
 	/* Update PSP FW topology after reset */
 	if (hive && adev->gmc.xgmi.num_physical_nodes > 1)
 		r = amdgpu_xgmi_update_topology(hive, adev);
-
 	if (hive)
 		amdgpu_put_xgmi_hive(hive);
+	if (r)
+		return r;
 
-	if (!r) {
-		r = amdgpu_ib_ring_tests(adev);
-
-		amdgpu_amdkfd_post_reset(adev);
-	}
+	r = amdgpu_ib_ring_tests(adev);
+	if (r)
+		return r;
 
-error:
-	if (!r && adev->virt.gim_feature & AMDGIM_FEATURE_GIM_FLR_VRAMLOST) {
+	if (adev->virt.gim_feature & AMDGIM_FEATURE_GIM_FLR_VRAMLOST) {
 		amdgpu_inc_vram_lost(adev);
 		r = amdgpu_device_recover_vram(adev);
 	}
-	amdgpu_virt_release_full_gpu(adev, true);
+	if (r)
+		return r;
 
-	if (AMDGPU_RETRY_SRIOV_RESET(r)) {
-		if (retry_limit < AMDGPU_MAX_RETRY_LIMIT) {
-			retry_limit++;
-			goto retry;
-		} else
-			DRM_ERROR("GPU reset retry is beyond the retry limit\n");
-	}
+	/* need to be called during full access so we can't do it later like
+	 * bare-metal does.
+	 */
+	amdgpu_amdkfd_post_reset(adev);
+	amdgpu_virt_release_full_gpu(adev, true);
 
-	return r;
+	return 0;
 }
 
 /**
@@ -5100,11 +5104,14 @@
 
 	dev_info(adev->dev, "GPU mode1 reset\n");
 
+	/* Cache the state before bus master disable. The saved config space
+	 * values are used in other cases like restore after mode-2 reset.
+	 */
+	amdgpu_device_cache_pci_state(adev->pdev);
+
 	/* disable BM */
 	pci_clear_master(adev->pdev);
 
-	amdgpu_device_cache_pci_state(adev->pdev);
-
 	if (amdgpu_dpm_is_mode1_reset_supported(adev)) {
 		dev_info(adev->dev, "GPU smu mode1 reset\n");
 		ret = amdgpu_dpm_mode1_reset(adev);
@@ -5539,6 +5546,7 @@
 	int i, r = 0;
 	bool need_emergency_restart = false;
 	bool audio_suspended = false;
+	int retry_limit = AMDGPU_MAX_RETRY_LIMIT;
 
 	/*
 	 * Special case: RAS triggered and full reset isn't supported
@@ -5573,7 +5581,7 @@
 	 * to put adev in the 1st position.
 	 */
 	INIT_LIST_HEAD(&device_list);
-	if (!amdgpu_sriov_vf(adev) && (adev->gmc.xgmi.num_physical_nodes > 1)) {
+	if (!amdgpu_sriov_vf(adev) && (adev->gmc.xgmi.num_physical_nodes > 1) && hive) {
 		list_for_each_entry(tmp_adev, &hive->device_list, gmc.xgmi.head) {
 			list_add_tail(&tmp_adev->reset_list, &device_list);
 			if (adev->shutdown)
@@ -5614,8 +5622,7 @@
 
 		cancel_delayed_work_sync(&tmp_adev->delayed_init_work);
 
-		if (!amdgpu_sriov_vf(tmp_adev))
-			amdgpu_amdkfd_pre_reset(tmp_adev);
+		amdgpu_amdkfd_pre_reset(tmp_adev);
 
 		/*
 		 * Mark these ASICs to be reseted as untracked first
@@ -5668,18 +5675,16 @@
 				  r, adev_to_drm(tmp_adev)->unique);
 			tmp_adev->asic_reset_res = r;
 		}
-
-		/*
-		 * Drop all pending non scheduler resets. Scheduler resets
-		 * were already dropped during drm_sched_stop
-		 */
-		amdgpu_device_stop_pending_resets(tmp_adev);
 	}
 
 	/* Actual ASIC resets if needed.*/
 	/* Host driver will handle XGMI hive reset for SRIOV */
 	if (amdgpu_sriov_vf(adev)) {
-		r = amdgpu_device_reset_sriov(adev, job ? false : true);
+		r = amdgpu_device_reset_sriov(adev, reset_context);
+		if (AMDGPU_RETRY_SRIOV_RESET(r) && (retry_limit--) > 0) {
+			amdgpu_virt_release_full_gpu(adev, true);
+			goto retry;
+		}
 		if (r)
 			adev->asic_reset_res = r;
 
@@ -5694,6 +5699,16 @@
 			goto retry;
 	}
 
+	list_for_each_entry(tmp_adev, device_list_handle, reset_list) {
+		/*
+		 * Drop any pending non scheduler resets queued before reset is done.
+		 * Any reset scheduled after this point would be valid. Scheduler resets
+		 * were already dropped during drm_sched_stop and no new ones can come
+		 * in before drm_sched_start.
+		 */
+		amdgpu_device_stop_pending_resets(tmp_adev);
+	}
+
 skip_hw_reset:
 
 	/* Post ASIC reset for all devs .*/
@@ -5786,13 +5801,18 @@
 	*speed = PCI_SPEED_UNKNOWN;
 	*width = PCIE_LNK_WIDTH_UNKNOWN;
 
-	while ((parent = pci_upstream_bridge(parent))) {
-		/* skip upstream/downstream switches internal to dGPU*/
-		if (parent->vendor == PCI_VENDOR_ID_ATI)
-			continue;
-		*speed = pcie_get_speed_cap(parent);
-		*width = pcie_get_width_cap(parent);
-		break;
+	if (amdgpu_device_pcie_dynamic_switching_supported(adev)) {
+		while ((parent = pci_upstream_bridge(parent))) {
+			/* skip upstream/downstream switches internal to dGPU*/
+			if (parent->vendor == PCI_VENDOR_ID_ATI)
+				continue;
+			*speed = pcie_get_speed_cap(parent);
+			*width = pcie_get_width_cap(parent);
+			break;
+		}
+	} else {
+		/* use the current speeds rather than max if switching is not supported */
+		pcie_bandwidth_available(adev->pdev, NULL, speed, width);
 	}
 }
 
@@ -6007,7 +6027,7 @@
 	    adev->nbio.funcs->enable_doorbell_interrupt)
 		adev->nbio.funcs->enable_doorbell_interrupt(adev, true);
 
-	if (amdgpu_passthrough(adev) &&
+	if (amdgpu_passthrough(adev) && adev->nbio.funcs &&
 	    adev->nbio.funcs->clear_doorbell_interrupt)
 		adev->nbio.funcs->clear_doorbell_interrupt(adev);
 
@@ -6107,6 +6127,20 @@
 	struct amdgpu_reset_context reset_context;
 	u32 memsize;
 	struct list_head device_list;
+	struct amdgpu_hive_info *hive;
+	int hive_ras_recovery = 0;
+	struct amdgpu_ras *ras;
+
+	/* PCI error slot reset should be skipped During RAS recovery */
+	hive = amdgpu_get_xgmi_hive(adev);
+	if (hive) {
+		hive_ras_recovery = atomic_read(&hive->ras_recovery);
+		amdgpu_put_xgmi_hive(hive);
+	}
+	ras = amdgpu_ras_get_context(adev);
+	if ((amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 3)) &&
+		 ras && (atomic_read(&ras->in_recovery) || hive_ras_recovery))
+		return PCI_ERS_RESULT_RECOVERED;
 
 	DRM_INFO("PCI error: slot reset callback!!\n");
 
@@ -6201,6 +6235,9 @@
 	struct amdgpu_device *adev = drm_to_adev(dev);
 	int r;
 
+	if (amdgpu_sriov_vf(adev))
+		return false;
+
 	r = pci_save_state(pdev);
 	if (!r) {
 		kfree(adev->pci_state);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1278,11 +1278,10 @@
 				 *     0b10 : encode is disabled
 				 *     0b01 : decode is disabled
 				 */
-				adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
-					ip->revision & 0xc0;
-				ip->revision &= ~0xc0;
 				if (adev->vcn.num_vcn_inst <
 				    AMDGPU_MAX_VCN_INSTANCES) {
+					adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
+						ip->revision & 0xc0;
 					adev->vcn.num_vcn_inst++;
 					adev->vcn.inst_mask |=
 						(1U << ip->instance_number);
@@ -1293,6 +1292,7 @@
 						adev->vcn.num_vcn_inst + 1,
 						AMDGPU_MAX_VCN_INSTANCES);
 				}
+				ip->revision &= ~0xc0;
 			}
 			if (le16_to_cpu(ip->hw_id) == SDMA0_HWID ||
 			    le16_to_cpu(ip->hw_id) == SDMA1_HWID ||
@@ -1572,7 +1572,7 @@
 		break;
 	case 2:
 		mall_size_per_umc = le32_to_cpu(mall_info->v2.mall_size_per_umc);
-		adev->gmc.mall_size = mall_size_per_umc * adev->gmc.num_umc;
+		adev->gmc.mall_size = (uint64_t)mall_size_per_umc * adev->gmc.num_umc;
 		break;
 	default:
 		dev_err(adev->dev,
@@ -1867,6 +1867,7 @@
 		amdgpu_device_ip_block_add(adev, &smu_v13_0_ip_block);
 		break;
 	case IP_VERSION(14, 0, 0):
+	case IP_VERSION(14, 0, 1):
 		amdgpu_device_ip_block_add(adev, &smu_v14_0_ip_block);
 		break;
 	default:
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -917,8 +917,7 @@
 {
 	u64 micro_tile_mode;
 
-	/* Zero swizzle mode means linear */
-	if (AMDGPU_TILING_GET(afb->tiling_flags, SWIZZLE_MODE) == 0)
+	if (AMDGPU_TILING_GET(afb->tiling_flags, ARRAY_MODE) == 1) /* LINEAR_ALIGNED */
 		return 0;
 
 	micro_tile_mode = AMDGPU_TILING_GET(afb->tiling_flags, MICRO_TILE_MODE);
@@ -1042,6 +1041,30 @@
 			block_width = 256 / format_info->cpp[i];
 			block_height = 1;
 			block_size_log2 = 8;
+		} else if (AMD_FMT_MOD_GET(TILE_VERSION, modifier) >= AMD_FMT_MOD_TILE_VER_GFX12) {
+			int swizzle = AMD_FMT_MOD_GET(TILE, modifier);
+
+			switch (swizzle) {
+			case AMD_FMT_MOD_TILE_GFX12_256B_2D:
+				block_size_log2 = 8;
+				break;
+			case AMD_FMT_MOD_TILE_GFX12_4K_2D:
+				block_size_log2 = 12;
+				break;
+			case AMD_FMT_MOD_TILE_GFX12_64K_2D:
+				block_size_log2 = 16;
+				break;
+			case AMD_FMT_MOD_TILE_GFX12_256K_2D:
+				block_size_log2 = 18;
+				break;
+			default:
+				drm_dbg_kms(rfb->base.dev,
+					    "Gfx12 swizzle mode with unknown block size: %d\n", swizzle);
+				return -EINVAL;
+			}
+
+			get_block_dimensions(block_size_log2, format_info->cpp[i],
+					     &block_width, &block_height);
 		} else {
 			int swizzle = AMD_FMT_MOD_GET(TILE, modifier);
 
@@ -1077,7 +1100,8 @@
 			return ret;
 	}
 
-	if (AMD_FMT_MOD_GET(DCC, modifier)) {
+	if (AMD_FMT_MOD_GET(TILE_VERSION, modifier) <= AMD_FMT_MOD_TILE_VER_GFX11 &&
+	    AMD_FMT_MOD_GET(DCC, modifier)) {
 		if (AMD_FMT_MOD_GET(DCC_RETILE, modifier)) {
 			block_size_log2 = get_dcc_block_size(modifier, false, false);
 			get_block_dimensions(block_size_log2 + 8, format_info->cpp[0],
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -849,12 +849,13 @@
  * the ABM algorithm, with 1 being the least reduction and 4 being the most
  * reduction.
  *
- * Defaults to 0, or disabled. Userspace can still override this level later
- * after boot.
+ * Defaults to -1, or disabled. Userspace can only override this level after
+ * boot if it's set to auto.
  */
-uint amdgpu_dm_abm_level;
-MODULE_PARM_DESC(abmlevel, "ABM level (0 = off (default), 1-4 = backlight reduction level) ");
-module_param_named(abmlevel, amdgpu_dm_abm_level, uint, 0444);
+int amdgpu_dm_abm_level = -1;
+MODULE_PARM_DESC(abmlevel,
+		 "ABM level (0 = off, 1-4 = backlight reduction level, -1 auto (default))");
+module_param_named(abmlevel, amdgpu_dm_abm_level, int, 0444);
 
 int amdgpu_backlight = -1;
 MODULE_PARM_DESC(backlight, "Backlight control (0 = pwm, 1 = aux, -1 auto (default))");
@@ -2451,8 +2452,11 @@
 	}
 	for (i = 0; i < mgpu_info.num_dgpu; i++) {
 		adev = mgpu_info.gpu_ins[i].adev;
-		if (!adev->kfd.init_complete)
+		if (!adev->kfd.init_complete) {
+			kgd2kfd_init_zone_device(adev);
 			amdgpu_amdkfd_device_init(adev);
+			amdgpu_amdkfd_drm_client_create(adev);
+		}
 		amdgpu_ttm_set_buffer_funcs_status(adev, true);
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c
@@ -179,7 +179,7 @@
  * Returns the number of bytes read/written; -errno on error.
  */
 static int amdgpu_eeprom_xfer(struct i2c_adapter *i2c_adap, u32 eeprom_addr,
-			      u8 *eeprom_buf, u16 buf_size, bool read)
+			      u8 *eeprom_buf, u32 buf_size, bool read)
 {
 	const struct i2c_adapter_quirks *quirks = i2c_adap->quirks;
 	u16 limit;
@@ -225,7 +225,7 @@
 
 int amdgpu_eeprom_read(struct i2c_adapter *i2c_adap,
 		       u32 eeprom_addr, u8 *eeprom_buf,
-		       u16 bytes)
+		       u32 bytes)
 {
 	return amdgpu_eeprom_xfer(i2c_adap, eeprom_addr, eeprom_buf, bytes,
 				  true);
@@ -233,7 +233,7 @@
 
 int amdgpu_eeprom_write(struct i2c_adapter *i2c_adap,
 			u32 eeprom_addr, u8 *eeprom_buf,
-			u16 bytes)
+			u32 bytes)
 {
 	return amdgpu_eeprom_xfer(i2c_adap, eeprom_addr, eeprom_buf, bytes,
 				  false);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h
@@ -28,10 +28,10 @@
 
 int amdgpu_eeprom_read(struct i2c_adapter *i2c_adap,
 		       u32 eeprom_addr, u8 *eeprom_buf,
-		       u16 bytes);
+		       u32 bytes);
 
 int amdgpu_eeprom_write(struct i2c_adapter *i2c_adap,
 			u32 eeprom_addr, u8 *eeprom_buf,
-			u16 bytes);
+			u32 bytes);
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_fdinfo.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_fdinfo.c
@@ -97,6 +97,10 @@
 		   stats.requested_visible_vram/1024UL);
 	drm_printf(p, "amd-requested-gtt:\t%llu KiB\n",
 		   stats.requested_gtt/1024UL);
+	drm_printf(p, "drm-shared-vram:\t%llu KiB\n", stats.vram_shared/1024UL);
+	drm_printf(p, "drm-shared-gtt:\t%llu KiB\n", stats.gtt_shared/1024UL);
+	drm_printf(p, "drm-shared-cpu:\t%llu KiB\n", stats.cpu_shared/1024UL);
+
 	for (hw_ip = 0; hw_ip < AMDGPU_HW_IP_NUM; ++hw_ip) {
 		if (!usage[hw_ip])
 			continue;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_fw_attestation.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_fw_attestation.c
@@ -122,6 +122,10 @@
 	if (adev->flags & AMD_IS_APU)
 		return 0;
 
+	if (amdgpu_ip_version(adev, MP0_HWIP, 0) == IP_VERSION(14, 0, 2) ||
+	    amdgpu_ip_version(adev, MP0_HWIP, 0) == IP_VERSION(14, 0, 3))
+		return 0;
+
 	if (adev->asic_type >= CHIP_SIENNA_CICHLID)
 		return 1;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
@@ -34,6 +34,7 @@
 #include <asm/set_memory.h>
 #endif
 #include "amdgpu.h"
+#include "amdgpu_reset.h"
 #include <drm/drm_drv.h>
 #include <drm/ttm/ttm_tt.h>
 
@@ -408,7 +409,10 @@
 		return;
 
 	mb();
-	amdgpu_device_flush_hdp(adev, NULL);
+	if (down_read_trylock(&adev->reset_domain->sem)) {
+		amdgpu_device_flush_hdp(adev, NULL);
+		up_read(&adev->reset_domain->sem);
+	}
 	for_each_set_bit(i, adev->vmhubs_mask, AMDGPU_MAX_VMHUBS)
 		amdgpu_gmc_flush_gpu_tlb(adev, 0, i, 0);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -313,6 +313,9 @@
 		return -EINVAL;
 	}
 
+	/* always clear VRAM */
+	flags |= AMDGPU_GEM_CREATE_VRAM_CLEARED;
+
 	/* create a gem object to contain this object in */
 	if (args->in.domains & (AMDGPU_GEM_DOMAIN_GDS |
 	    AMDGPU_GEM_DOMAIN_GWS | AMDGPU_GEM_DOMAIN_OA)) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -814,8 +814,11 @@
 	int r;
 
 	if (amdgpu_ras_is_supported(adev, ras_block->block)) {
-		if (!amdgpu_persistent_edc_harvesting_supported(adev))
-			amdgpu_ras_reset_error_status(adev, AMDGPU_RAS_BLOCK__GFX);
+		if (!amdgpu_persistent_edc_harvesting_supported(adev)) {
+			r = amdgpu_ras_reset_error_status(adev, AMDGPU_RAS_BLOCK__GFX);
+			if (r)
+				return r;
+		}
 
 		r = amdgpu_ras_block_late_init(adev, ras_block);
 		if (r)
@@ -959,7 +962,10 @@
 		pr_err("critical bug! too many kiq readers\n");
 		goto failed_unlock;
 	}
-	amdgpu_ring_alloc(ring, 32);
+	r = amdgpu_ring_alloc(ring, 32);
+	if (r)
+		goto failed_unlock;
+
 	amdgpu_ring_emit_rreg(ring, reg, reg_val_offs);
 	r = amdgpu_fence_emit_polling(ring, &seq, MAX_KIQ_REG_WAIT);
 	if (r)
@@ -1025,7 +1031,10 @@
 	}
 
 	spin_lock_irqsave(&kiq->ring_lock, flags);
-	amdgpu_ring_alloc(ring, 32);
+	r = amdgpu_ring_alloc(ring, 32);
+	if (r)
+		goto failed_unlock;
+
 	amdgpu_ring_emit_wreg(ring, reg, v);
 	r = amdgpu_fence_emit_polling(ring, &seq, MAX_KIQ_REG_WAIT);
 	if (r)
@@ -1061,6 +1070,7 @@
 
 failed_undo:
 	amdgpu_ring_undo(ring);
+failed_unlock:
 	spin_unlock_irqrestore(&kiq->ring_lock, flags);
 failed_kiq_write:
 	dev_err(adev->dev, "failed to write reg:%x\n", reg);
@@ -1205,7 +1215,8 @@
 		fw_size = le32_to_cpu(cp_hdr_v2_0->data_size_bytes);
 		break;
 	default:
-		break;
+		dev_err(adev->dev, "Invalid ucode id %u\n", ucode_id);
+		return;
 	}
 
 	if (adev->firmware.load_type == AMDGPU_FW_LOAD_PSP) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -684,12 +684,17 @@
 	struct amdgpu_ring *ring = &adev->gfx.kiq[inst].ring;
 	struct amdgpu_kiq *kiq = &adev->gfx.kiq[inst];
 	unsigned int ndw;
-	signed long r;
+	int r;
 	uint32_t seq;
 
-	if (!adev->gmc.flush_pasid_uses_kiq || !ring->sched.ready ||
-	    !down_read_trylock(&adev->reset_domain->sem)) {
+	/*
+	 * A GPU reset should flush all TLBs anyway, so no need to do
+	 * this while one is ongoing.
+	 */
+	if (!down_read_trylock(&adev->reset_domain->sem))
+		return 0;
 
+	if (!adev->gmc.flush_pasid_uses_kiq || !ring->sched.ready) {
 		if (adev->gmc.flush_tlb_needs_extra_type_2)
 			adev->gmc.gmc_funcs->flush_gpu_tlb_pasid(adev, pasid,
 								 2, all_hub,
@@ -703,43 +708,44 @@
 		adev->gmc.gmc_funcs->flush_gpu_tlb_pasid(adev, pasid,
 							 flush_type, all_hub,
 							 inst);
-		return 0;
-	}
+		r = 0;
+	} else {
+		/* 2 dwords flush + 8 dwords fence */
+		ndw = kiq->pmf->invalidate_tlbs_size + 8;
+
+		if (adev->gmc.flush_tlb_needs_extra_type_2)
+			ndw += kiq->pmf->invalidate_tlbs_size;
+
+		if (adev->gmc.flush_tlb_needs_extra_type_0)
+			ndw += kiq->pmf->invalidate_tlbs_size;
 
-	/* 2 dwords flush + 8 dwords fence */
-	ndw = kiq->pmf->invalidate_tlbs_size + 8;
+		spin_lock(&adev->gfx.kiq[inst].ring_lock);
+		r = amdgpu_ring_alloc(ring, ndw);
+		if (r) {
+			spin_unlock(&adev->gfx.kiq[inst].ring_lock);
+			goto error_unlock_reset;
+		}
+		if (adev->gmc.flush_tlb_needs_extra_type_2)
+			kiq->pmf->kiq_invalidate_tlbs(ring, pasid, 2, all_hub);
 
-	if (adev->gmc.flush_tlb_needs_extra_type_2)
-		ndw += kiq->pmf->invalidate_tlbs_size;
+		if (flush_type == 2 && adev->gmc.flush_tlb_needs_extra_type_0)
+			kiq->pmf->kiq_invalidate_tlbs(ring, pasid, 0, all_hub);
 
-	if (adev->gmc.flush_tlb_needs_extra_type_0)
-		ndw += kiq->pmf->invalidate_tlbs_size;
+		kiq->pmf->kiq_invalidate_tlbs(ring, pasid, flush_type, all_hub);
+		r = amdgpu_fence_emit_polling(ring, &seq, MAX_KIQ_REG_WAIT);
+		if (r) {
+			amdgpu_ring_undo(ring);
+			spin_unlock(&adev->gfx.kiq[inst].ring_lock);
+			goto error_unlock_reset;
+		}
 
-	spin_lock(&adev->gfx.kiq[inst].ring_lock);
-	amdgpu_ring_alloc(ring, ndw);
-	if (adev->gmc.flush_tlb_needs_extra_type_2)
-		kiq->pmf->kiq_invalidate_tlbs(ring, pasid, 2, all_hub);
-
-	if (flush_type == 2 && adev->gmc.flush_tlb_needs_extra_type_0)
-		kiq->pmf->kiq_invalidate_tlbs(ring, pasid, 0, all_hub);
-
-	kiq->pmf->kiq_invalidate_tlbs(ring, pasid, flush_type, all_hub);
-	r = amdgpu_fence_emit_polling(ring, &seq, MAX_KIQ_REG_WAIT);
-	if (r) {
-		amdgpu_ring_undo(ring);
+		amdgpu_ring_commit(ring);
 		spin_unlock(&adev->gfx.kiq[inst].ring_lock);
-		goto error_unlock_reset;
-	}
-
-	amdgpu_ring_commit(ring);
-	spin_unlock(&adev->gfx.kiq[inst].ring_lock);
-	r = amdgpu_fence_wait_polling(ring, seq, usec_timeout);
-	if (r < 1) {
-		dev_err(adev->dev, "wait for kiq fence error: %ld.\n", r);
-		r = -ETIME;
-		goto error_unlock_reset;
+		if (amdgpu_fence_wait_polling(ring, seq, usec_timeout) < 1) {
+			dev_err(adev->dev, "timeout waiting for kiq fence\n");
+			r = -ETIME;
+		}
 	}
-	r = 0;
 
 error_unlock_reset:
 	up_read(&adev->reset_domain->sem);
@@ -822,7 +828,6 @@
 	struct amdgpu_gmc *gmc = &adev->gmc;
 	uint32_t gc_ver = amdgpu_ip_version(adev, GC_HWIP, 0);
 	bool noretry_default = (gc_ver == IP_VERSION(9, 0, 1) ||
-				gc_ver == IP_VERSION(9, 3, 0) ||
 				gc_ver == IP_VERSION(9, 4, 0) ||
 				gc_ver == IP_VERSION(9, 4, 1) ||
 				gc_ver == IP_VERSION(9, 4, 2) ||
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
@@ -129,13 +129,25 @@
  */
 int amdgpu_hmm_register(struct amdgpu_bo *bo, unsigned long addr)
 {
+	int r;
+
 	if (bo->kfd_bo)
-		return mmu_interval_notifier_insert(&bo->notifier, current->mm,
+		r = mmu_interval_notifier_insert(&bo->notifier, current->mm,
 						    addr, amdgpu_bo_size(bo),
 						    &amdgpu_hmm_hsa_ops);
-	return mmu_interval_notifier_insert(&bo->notifier, current->mm, addr,
-					    amdgpu_bo_size(bo),
-					    &amdgpu_hmm_gfx_ops);
+	else
+		r = mmu_interval_notifier_insert(&bo->notifier, current->mm, addr,
+							amdgpu_bo_size(bo),
+							&amdgpu_hmm_gfx_ops);
+	if (r)
+		/*
+		 * Make sure amdgpu_hmm_unregister() doesn't call
+		 * mmu_interval_notifier_remove() when the notifier isn't properly
+		 * initialized.
+		 */
+		bo->notifier.mm = NULL;
+
+	return r;
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -193,8 +193,8 @@
 	need_ctx_switch = ring->current_ctx != fence_ctx;
 	if (ring->funcs->emit_pipeline_sync && job &&
 	    ((tmp = amdgpu_sync_get_fence(&job->explicit_sync)) ||
-	     (amdgpu_sriov_vf(adev) && need_ctx_switch) ||
-	     amdgpu_vm_need_pipeline_sync(ring, job))) {
+	     need_ctx_switch || amdgpu_vm_need_pipeline_sync(ring, job))) {
+
 		need_pipe_sync = true;
 
 		if (tmp)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
@@ -407,7 +407,7 @@
 	if (r || !idle)
 		goto error;
 
-	if (vm->reserved_vmid[vmhub] || (enforce_isolation && (vmhub == AMDGPU_GFXHUB(0)))) {
+	if (amdgpu_vmid_uses_reserved(vm, vmhub)) {
 		r = amdgpu_vmid_grab_reserved(vm, ring, job, &id, fence);
 		if (r || !id)
 			goto error;
@@ -457,6 +457,19 @@
 	return r;
 }
 
+/*
+ * amdgpu_vmid_uses_reserved - check if a VM will use a reserved VMID
+ * @vm: the VM to check
+ * @vmhub: the VMHUB which will be used
+ *
+ * Returns: True if the VM will use a reserved VMID.
+ */
+bool amdgpu_vmid_uses_reserved(struct amdgpu_vm *vm, unsigned int vmhub)
+{
+	return vm->reserved_vmid[vmhub] ||
+		(enforce_isolation && (vmhub == AMDGPU_GFXHUB(0)));
+}
+
 int amdgpu_vmid_alloc_reserved(struct amdgpu_device *adev,
 			       unsigned vmhub)
 {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h
@@ -78,6 +78,7 @@
 
 bool amdgpu_vmid_had_gpu_reset(struct amdgpu_device *adev,
 			       struct amdgpu_vmid *id);
+bool amdgpu_vmid_uses_reserved(struct amdgpu_vm *vm, unsigned int vmhub);
 int amdgpu_vmid_alloc_reserved(struct amdgpu_device *adev,
 				unsigned vmhub);
 void amdgpu_vmid_free_reserved(struct amdgpu_device *adev,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
@@ -445,6 +445,14 @@
 
 	entry.ih = ih;
 	entry.iv_entry = (const uint32_t *)&ih->ring[ring_index];
+
+	/*
+	 * timestamp is not supported on some legacy SOCs (cik, cz, iceland,
+	 * si and tonga), so initialize timestamp and timestamp_src to 0
+	 */
+	entry.timestamp = 0;
+	entry.timestamp_src = 0;
+
 	amdgpu_ih_decode_iv(adev, &entry);
 
 	trace_amdgpu_iv(ih - &adev->irq.ih, &entry);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
@@ -159,7 +159,6 @@
 
 void amdgpu_job_free_resources(struct amdgpu_job *job)
 {
-	struct amdgpu_ring *ring = to_amdgpu_ring(job->base.sched);
 	struct dma_fence *f;
 	unsigned i;
 
@@ -172,7 +171,7 @@
 		f = NULL;
 
 	for (i = 0; i < job->num_ibs; ++i)
-		amdgpu_ib_free(ring->adev, &job->ibs[i], f);
+		amdgpu_ib_free(NULL, &job->ibs[i], f);
 }
 
 static void amdgpu_job_free_cb(struct drm_sched_job *s_job)
@@ -258,9 +257,8 @@
 	struct dma_fence *fence = NULL;
 	int r;
 
-	/* Ignore soft recovered fences here */
 	r = drm_sched_entity_error(s_entity);
-	if (r && r != -ENODATA)
+	if (r)
 		goto error;
 
 	if (!fence && job->gang_submit)
@@ -300,12 +298,15 @@
 		dma_fence_set_error(finished, -ECANCELED);
 
 	if (finished->error < 0) {
-		DRM_INFO("Skip scheduling IBs!\n");
+		dev_dbg(adev->dev, "Skip scheduling IBs in ring(%s)",
+			ring->name);
 	} else {
 		r = amdgpu_ib_schedule(ring, job->num_ibs, job->ibs, job,
 				       &fence);
 		if (r)
-			DRM_ERROR("Error scheduling IBs (%d)\n", r);
+			dev_err(adev->dev,
+				"Error scheduling IBs (%d) in ring(%s)", r,
+				ring->name);
 	}
 
 	job->job_run_counter++;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -43,6 +43,7 @@
 #include "amdgpu_gem.h"
 #include "amdgpu_display.h"
 #include "amdgpu_ras.h"
+#include "amdgpu_reset.h"
 #include "amd_pcie.h"
 
 void amdgpu_unregister_gpu_instance(struct amdgpu_device *adev)
@@ -654,25 +655,32 @@
 			switch (type) {
 			case AMD_IP_BLOCK_TYPE_GFX:
 				ret = amdgpu_xcp_get_inst_details(xcp, AMDGPU_XCP_GFX, &inst_mask);
+				if (ret)
+					return ret;
 				count = hweight32(inst_mask);
 				break;
 			case AMD_IP_BLOCK_TYPE_SDMA:
 				ret = amdgpu_xcp_get_inst_details(xcp, AMDGPU_XCP_SDMA, &inst_mask);
+				if (ret)
+					return ret;
 				count = hweight32(inst_mask);
 				break;
 			case AMD_IP_BLOCK_TYPE_JPEG:
 				ret = amdgpu_xcp_get_inst_details(xcp, AMDGPU_XCP_VCN, &inst_mask);
+				if (ret)
+					return ret;
 				count = hweight32(inst_mask) * adev->jpeg.num_jpeg_rings;
 				break;
 			case AMD_IP_BLOCK_TYPE_VCN:
 				ret = amdgpu_xcp_get_inst_details(xcp, AMDGPU_XCP_VCN, &inst_mask);
+				if (ret)
+					return ret;
 				count = hweight32(inst_mask);
 				break;
 			default:
 				return -EINVAL;
 			}
-			if (ret)
-				return ret;
+
 			return copy_to_user(out, &count, min(size, 4u)) ? -EFAULT : 0;
 		}
 
@@ -802,6 +810,7 @@
 				    ? -EFAULT : 0;
 	}
 	case AMDGPU_INFO_READ_MMR_REG: {
+		int ret = 0;
 		unsigned int n, alloc_size;
 		uint32_t *regs;
 		unsigned int se_num = (info->read_mmr_reg.instance >>
@@ -811,24 +820,37 @@
 				   AMDGPU_INFO_MMR_SH_INDEX_SHIFT) &
 				  AMDGPU_INFO_MMR_SH_INDEX_MASK;
 
+		if (!down_read_trylock(&adev->reset_domain->sem))
+			return -ENOENT;
+
 		/* set full masks if the userspace set all bits
 		 * in the bitfields
 		 */
-		if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK)
+		if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK) {
 			se_num = 0xffffffff;
-		else if (se_num >= AMDGPU_GFX_MAX_SE)
-			return -EINVAL;
-		if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)
+		} else if (se_num >= AMDGPU_GFX_MAX_SE) {
+			ret = -EINVAL;
+			goto out;
+		}
+
+		if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) {
 			sh_num = 0xffffffff;
-		else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE)
-			return -EINVAL;
+		} else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE) {
+			ret = -EINVAL;
+			goto out;
+		}
 
-		if (info->read_mmr_reg.count > 128)
-			return -EINVAL;
+		if (info->read_mmr_reg.count > 128) {
+			ret = -EINVAL;
+			goto out;
+		}
 
 		regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL);
-		if (!regs)
-			return -ENOMEM;
+		if (!regs) {
+			ret = -ENOMEM;
+			goto out;
+		}
+
 		alloc_size = info->read_mmr_reg.count * sizeof(*regs);
 
 		amdgpu_gfx_off_ctrl(adev, false);
@@ -840,13 +862,17 @@
 					      info->read_mmr_reg.dword_offset + i);
 				kfree(regs);
 				amdgpu_gfx_off_ctrl(adev, true);
-				return -EFAULT;
+				ret = -EFAULT;
+				goto out;
 			}
 		}
 		amdgpu_gfx_off_ctrl(adev, true);
 		n = copy_to_user(out, regs, min(size, alloc_size));
 		kfree(regs);
-		return n ? -EFAULT : 0;
+		ret = (n ? -EFAULT : 0);
+out:
+		up_read(&adev->reset_domain->sem);
+		return ret;
 	}
 	case AMDGPU_INFO_DEV_INFO: {
 		struct drm_amdgpu_info_device *dev_info;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
@@ -1084,8 +1084,10 @@
 
 	r = amdgpu_ring_init(adev, ring, 1024, NULL, 0,
 			     AMDGPU_RING_PRIO_DEFAULT, NULL);
-	if (r)
+	if (r) {
+		amdgpu_mes_unlock(&adev->mes);
 		goto clean_up_memory;
+	}
 
 	amdgpu_mes_ring_to_queue_props(adev, ring, &qprops);
 
@@ -1118,7 +1120,6 @@
 	amdgpu_ring_fini(ring);
 clean_up_memory:
 	kfree(ring);
-	amdgpu_mes_unlock(&adev->mes);
 	return r;
 }
 
@@ -1129,6 +1130,7 @@
 		return;
 
 	amdgpu_mes_remove_hw_queue(adev, ring->hw_queue_id);
+	del_timer_sync(&ring->fence_drv.fallback_timer);
 	amdgpu_ring_fini(ring);
 	kfree(ring);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -608,6 +608,8 @@
 	else
 		amdgpu_bo_placement_from_domain(bo, bp->domain);
 	if (bp->type == ttm_bo_type_kernel)
+		bo->tbo.priority = 2;
+	else if (!(bp->flags & AMDGPU_GEM_CREATE_DISCARDABLE))
 		bo->tbo.priority = 1;
 
 	if (!bp->destroy)
@@ -620,8 +622,7 @@
 		return r;
 
 	if (!amdgpu_gmc_vram_full_visible(&adev->gmc) &&
-	    bo->tbo.resource->mem_type == TTM_PL_VRAM &&
-	    amdgpu_bo_in_cpu_visible_vram(bo))
+	    amdgpu_res_cpu_visible(adev, bo->tbo.resource))
 		amdgpu_cs_report_moved_bytes(adev, ctx.bytes_moved,
 					     ctx.bytes_moved);
 	else
@@ -1245,14 +1246,18 @@
  * amdgpu_bo_move_notify - notification about a memory move
  * @bo: pointer to a buffer object
  * @evict: if this move is evicting the buffer from the graphics address space
+ * @new_mem: new resource for backing the BO
  *
  * Marks the corresponding &amdgpu_bo buffer object as invalid, also performs
  * bookkeeping.
  * TTM driver callback which is called when ttm moves a buffer.
  */
-void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, bool evict)
+void amdgpu_bo_move_notify(struct ttm_buffer_object *bo,
+			   bool evict,
+			   struct ttm_resource *new_mem)
 {
 	struct amdgpu_device *adev = amdgpu_ttm_adev(bo->bdev);
+	struct ttm_resource *old_mem = bo->resource;
 	struct amdgpu_bo *abo;
 
 	if (!amdgpu_bo_is_amdgpu_bo(bo))
@@ -1264,37 +1269,50 @@
 	amdgpu_bo_kunmap(abo);
 
 	if (abo->tbo.base.dma_buf && !abo->tbo.base.import_attach &&
-	    bo->resource->mem_type != TTM_PL_SYSTEM)
+	    old_mem && old_mem->mem_type != TTM_PL_SYSTEM)
 		dma_buf_move_notify(abo->tbo.base.dma_buf);
 
-	/* remember the eviction */
-	if (evict)
-		atomic64_inc(&adev->num_evictions);
+	/* move_notify is called before move happens */
+	trace_amdgpu_bo_move(abo, new_mem ? new_mem->mem_type : -1,
+			     old_mem ? old_mem->mem_type : -1);
 }
 
 void amdgpu_bo_get_memory(struct amdgpu_bo *bo,
 			  struct amdgpu_mem_stats *stats)
 {
+	struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
+	struct ttm_resource *res = bo->tbo.resource;
 	uint64_t size = amdgpu_bo_size(bo);
+	struct drm_gem_object *obj;
 	unsigned int domain;
+	bool shared;
 
 	/* Abort if the BO doesn't currently have a backing store */
-	if (!bo->tbo.resource)
+	if (!res)
 		return;
 
-	domain = amdgpu_mem_type_to_domain(bo->tbo.resource->mem_type);
+	obj = &bo->tbo.base;
+	shared = drm_gem_object_is_shared_for_memory_stats(obj);
+
+	domain = amdgpu_mem_type_to_domain(res->mem_type);
 	switch (domain) {
 	case AMDGPU_GEM_DOMAIN_VRAM:
 		stats->vram += size;
-		if (amdgpu_bo_in_cpu_visible_vram(bo))
+		if (amdgpu_res_cpu_visible(adev, bo->tbo.resource))
 			stats->visible_vram += size;
+		if (shared)
+			stats->vram_shared += size;
 		break;
 	case AMDGPU_GEM_DOMAIN_GTT:
 		stats->gtt += size;
+		if (shared)
+			stats->gtt_shared += size;
 		break;
 	case AMDGPU_GEM_DOMAIN_CPU:
 	default:
 		stats->cpu += size;
+		if (shared)
+			stats->cpu_shared += size;
 		break;
 	}
 
@@ -1381,10 +1399,7 @@
 	/* Remember that this BO was accessed by the CPU */
 	abo->flags |= AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
 
-	if (bo->resource->mem_type != TTM_PL_VRAM)
-		return 0;
-
-	if (amdgpu_bo_in_cpu_visible_vram(abo))
+	if (amdgpu_res_cpu_visible(adev, bo->resource))
 		return 0;
 
 	/* Can't move a pinned BO to visible VRAM */
@@ -1408,7 +1423,7 @@
 
 	/* this should never happen */
 	if (bo->resource->mem_type == TTM_PL_VRAM &&
-	    !amdgpu_bo_in_cpu_visible_vram(abo))
+	    !amdgpu_res_cpu_visible(adev, bo->resource))
 		return VM_FAULT_SIGBUS;
 
 	ttm_bo_move_to_lru_tail_unlocked(bo);
@@ -1572,6 +1587,7 @@
  */
 u64 amdgpu_bo_print_info(int id, struct amdgpu_bo *bo, struct seq_file *m)
 {
+	struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
 	struct dma_buf_attachment *attachment;
 	struct dma_buf *dma_buf;
 	const char *placement;
@@ -1580,10 +1596,11 @@
 
 	if (dma_resv_trylock(bo->tbo.base.resv)) {
 		unsigned int domain;
+
 		domain = amdgpu_mem_type_to_domain(bo->tbo.resource->mem_type);
 		switch (domain) {
 		case AMDGPU_GEM_DOMAIN_VRAM:
-			if (amdgpu_bo_in_cpu_visible_vram(bo))
+			if (amdgpu_res_cpu_visible(adev, bo->tbo.resource))
 				placement = "VRAM VISIBLE";
 			else
 				placement = "VRAM";
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
@@ -138,12 +138,18 @@
 struct amdgpu_mem_stats {
 	/* current VRAM usage, includes visible VRAM */
 	uint64_t vram;
+	/* current shared VRAM usage, includes visible VRAM */
+	uint64_t vram_shared;
 	/* current visible VRAM usage */
 	uint64_t visible_vram;
 	/* current GTT usage */
 	uint64_t gtt;
+	/* current shared GTT usage */
+	uint64_t gtt_shared;
 	/* current system memory usage */
 	uint64_t cpu;
+	/* current shared system memory usage */
+	uint64_t cpu_shared;
 	/* sum of evicted buffers, includes visible VRAM */
 	uint64_t evicted_vram;
 	/* sum of evicted buffers due to CPU access */
@@ -245,28 +251,6 @@
 }
 
 /**
- * amdgpu_bo_in_cpu_visible_vram - check if BO is (partly) in visible VRAM
- */
-static inline bool amdgpu_bo_in_cpu_visible_vram(struct amdgpu_bo *bo)
-{
-	struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
-	struct amdgpu_res_cursor cursor;
-
-	if (!bo->tbo.resource || bo->tbo.resource->mem_type != TTM_PL_VRAM)
-		return false;
-
-	amdgpu_res_first(bo->tbo.resource, 0, amdgpu_bo_size(bo), &cursor);
-	while (cursor.remaining) {
-		if (cursor.start < adev->gmc.visible_vram_size)
-			return true;
-
-		amdgpu_res_next(&cursor, cursor.size);
-	}
-
-	return false;
-}
-
-/**
  * amdgpu_bo_explicit_sync - return whether the bo is explicitly synced
  */
 static inline bool amdgpu_bo_explicit_sync(struct amdgpu_bo *bo)
@@ -344,7 +328,9 @@
 int amdgpu_bo_get_metadata(struct amdgpu_bo *bo, void *buffer,
 			   size_t buffer_size, uint32_t *metadata_size,
 			   uint64_t *flags);
-void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, bool evict);
+void amdgpu_bo_move_notify(struct ttm_buffer_object *bo,
+			   bool evict,
+			   struct ttm_resource *new_mem);
 void amdgpu_bo_release_notify(struct ttm_buffer_object *bo);
 vm_fault_t amdgpu_bo_fault_reserve_notify(struct ttm_buffer_object *bo);
 void amdgpu_bo_fence(struct amdgpu_bo *bo, struct dma_fence *fence,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -1340,6 +1340,9 @@
 	uint8_t dst_num_links = node_info.num_links;
 
 	hive = amdgpu_get_xgmi_hive(psp->adev);
+	if (WARN_ON(!hive))
+		return;
+
 	list_for_each_entry(mirror_adev, &hive->device_list, gmc.xgmi.head) {
 		struct psp_xgmi_topology_info *mirror_top_info;
 		int j;
@@ -1546,6 +1549,68 @@
 	}
 }
 
+static int psp_ras_send_cmd(struct psp_context *psp,
+		enum ras_command cmd_id, void *in, void *out)
+{
+	struct ta_ras_shared_memory *ras_cmd;
+	uint32_t cmd = cmd_id;
+	int ret = 0;
+
+	if (!in)
+		return -EINVAL;
+
+	mutex_lock(&psp->ras_context.mutex);
+	ras_cmd = (struct ta_ras_shared_memory *)psp->ras_context.context.mem_context.shared_buf;
+	memset(ras_cmd, 0, sizeof(struct ta_ras_shared_memory));
+
+	switch (cmd) {
+	case TA_RAS_COMMAND__ENABLE_FEATURES:
+	case TA_RAS_COMMAND__DISABLE_FEATURES:
+		memcpy(&ras_cmd->ras_in_message,
+			in, sizeof(ras_cmd->ras_in_message));
+		break;
+	case TA_RAS_COMMAND__TRIGGER_ERROR:
+		memcpy(&ras_cmd->ras_in_message.trigger_error,
+			in, sizeof(ras_cmd->ras_in_message.trigger_error));
+		break;
+	case TA_RAS_COMMAND__QUERY_ADDRESS:
+		memcpy(&ras_cmd->ras_in_message.address,
+			in, sizeof(ras_cmd->ras_in_message.address));
+		break;
+	default:
+		dev_err(psp->adev->dev, "Invalid ras cmd id: %u\n", cmd);
+		ret = -EINVAL;
+		goto err_out;
+	}
+
+	ras_cmd->cmd_id = cmd;
+	ret = psp_ras_invoke(psp, ras_cmd->cmd_id);
+
+	switch (cmd) {
+	case TA_RAS_COMMAND__TRIGGER_ERROR:
+		if (ret || psp->cmd_buf_mem->resp.status)
+			ret = -EINVAL;
+		else if (out)
+			memcpy(out, &ras_cmd->ras_status, sizeof(ras_cmd->ras_status));
+		break;
+	case TA_RAS_COMMAND__QUERY_ADDRESS:
+		if (ret || ras_cmd->ras_status || psp->cmd_buf_mem->resp.status)
+			ret = -EINVAL;
+		else if (out)
+			memcpy(out,
+				&ras_cmd->ras_out_message.address,
+				sizeof(ras_cmd->ras_out_message.address));
+		break;
+	default:
+		break;
+	}
+
+err_out:
+	mutex_unlock(&psp->ras_context.mutex);
+
+	return ret;
+}
+
 int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id)
 {
 	struct ta_ras_shared_memory *ras_cmd;
@@ -1587,23 +1652,15 @@
 int psp_ras_enable_features(struct psp_context *psp,
 		union ta_ras_cmd_input *info, bool enable)
 {
-	struct ta_ras_shared_memory *ras_cmd;
+	enum ras_command cmd_id;
 	int ret;
 
-	if (!psp->ras_context.context.initialized)
+	if (!psp->ras_context.context.initialized || !info)
 		return -EINVAL;
 
-	ras_cmd = (struct ta_ras_shared_memory *)psp->ras_context.context.mem_context.shared_buf;
-	memset(ras_cmd, 0, sizeof(struct ta_ras_shared_memory));
-
-	if (enable)
-		ras_cmd->cmd_id = TA_RAS_COMMAND__ENABLE_FEATURES;
-	else
-		ras_cmd->cmd_id = TA_RAS_COMMAND__DISABLE_FEATURES;
-
-	ras_cmd->ras_in_message = *info;
-
-	ret = psp_ras_invoke(psp, ras_cmd->cmd_id);
+	cmd_id = enable ?
+		TA_RAS_COMMAND__ENABLE_FEATURES : TA_RAS_COMMAND__DISABLE_FEATURES;
+	ret = psp_ras_send_cmd(psp, cmd_id, info, NULL);
 	if (ret)
 		return -EINVAL;
 
@@ -1627,6 +1684,8 @@
 
 	psp->ras_context.context.initialized = false;
 
+	mutex_destroy(&psp->ras_context.mutex);
+
 	return ret;
 }
 
@@ -1711,9 +1770,10 @@
 
 	ret = psp_ta_load(psp, &psp->ras_context.context);
 
-	if (!ret && !ras_cmd->ras_status)
+	if (!ret && !ras_cmd->ras_status) {
 		psp->ras_context.context.initialized = true;
-	else {
+		mutex_init(&psp->ras_context.mutex);
+	} else {
 		if (ras_cmd->ras_status)
 			dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status);
 
@@ -1727,12 +1787,12 @@
 int psp_ras_trigger_error(struct psp_context *psp,
 			  struct ta_ras_trigger_error_input *info, uint32_t instance_mask)
 {
-	struct ta_ras_shared_memory *ras_cmd;
 	struct amdgpu_device *adev = psp->adev;
 	int ret;
 	uint32_t dev_mask;
+	uint32_t ras_status = 0;
 
-	if (!psp->ras_context.context.initialized)
+	if (!psp->ras_context.context.initialized || !info)
 		return -EINVAL;
 
 	switch (info->block_id) {
@@ -1756,13 +1816,8 @@
 	dev_mask &= AMDGPU_RAS_INST_MASK;
 	info->sub_block_index |= dev_mask;
 
-	ras_cmd = (struct ta_ras_shared_memory *)psp->ras_context.context.mem_context.shared_buf;
-	memset(ras_cmd, 0, sizeof(struct ta_ras_shared_memory));
-
-	ras_cmd->cmd_id = TA_RAS_COMMAND__TRIGGER_ERROR;
-	ras_cmd->ras_in_message.trigger_error = *info;
-
-	ret = psp_ras_invoke(psp, ras_cmd->cmd_id);
+	ret = psp_ras_send_cmd(psp,
+			TA_RAS_COMMAND__TRIGGER_ERROR, info, &ras_status);
 	if (ret)
 		return -EINVAL;
 
@@ -1772,11 +1827,36 @@
 	if (amdgpu_ras_intr_triggered())
 		return 0;
 
-	if (ras_cmd->ras_status == TA_RAS_STATUS__TEE_ERROR_ACCESS_DENIED)
+	if (ras_status == TA_RAS_STATUS__TEE_ERROR_ACCESS_DENIED)
 		return -EACCES;
-	else if (ras_cmd->ras_status)
+	else if (ras_status)
+		return -EINVAL;
+
+	return 0;
+}
+
+int psp_ras_query_address(struct psp_context *psp,
+			  struct ta_ras_query_address_input *addr_in,
+			  struct ta_ras_query_address_output *addr_out)
+{
+	struct ta_ras_shared_memory *ras_cmd;
+	int ret;
+
+	if (!psp->ras_context.context.initialized)
 		return -EINVAL;
 
+	ras_cmd = (struct ta_ras_shared_memory *)psp->ras_context.context.mem_context.shared_buf;
+	memset(ras_cmd, 0, sizeof(struct ta_ras_shared_memory));
+
+	ras_cmd->cmd_id = TA_RAS_COMMAND__QUERY_ADDRESS;
+	ras_cmd->ras_in_message.address = *addr_in;
+
+	ret = psp_ras_invoke(psp, ras_cmd->cmd_id);
+	if (ret || ras_cmd->ras_status || psp->cmd_buf_mem->resp.status)
+		return -EINVAL;
+
+	*addr_out = ras_cmd->ras_out_message.address;
+
 	return 0;
 }
 // ras end
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
@@ -197,6 +197,7 @@
 struct psp_ras_context {
 	struct ta_context		context;
 	struct amdgpu_ras		*ras;
+	struct mutex			mutex;
 };
 
 #define MEM_TRAIN_SYSTEM_SIGNATURE		0x54534942
@@ -502,6 +503,9 @@
 int psp_ras_trigger_error(struct psp_context *psp,
 			  struct ta_ras_trigger_error_input *info, uint32_t instance_mask);
 int psp_ras_terminate(struct psp_context *psp);
+int psp_ras_query_address(struct psp_context *psp,
+			  struct ta_ras_query_address_input *addr_in,
+			  struct ta_ras_query_address_output *addr_out);
 
 int psp_hdcp_invoke(struct psp_context *psp, uint32_t ta_cmd_id);
 int psp_dtm_invoke(struct psp_context *psp, uint32_t ta_cmd_id);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
@@ -166,6 +166,9 @@
 	if (ret)
 		return -EFAULT;
 
+	if (ta_bin_len > PSP_1_MEG)
+		return -EINVAL;
+
 	copy_pos += sizeof(uint32_t);
 
 	ta_bin = kzalloc(ta_bin_len, GFP_KERNEL);
@@ -334,7 +337,7 @@
 
 	set_ta_context_funcs(psp, ta_type, &context);
 
-	if (!context->initialized) {
+	if (!context || !context->initialized) {
 		dev_err(adev->dev, "TA is not initialized\n");
 		ret = -EINVAL;
 		goto err_free_shared_buf;
@@ -348,6 +351,7 @@
 
 	context->session_id = ta_id;
 
+	mutex_lock(&psp->ras_context.mutex);
 	ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
 	if (ret)
 		goto err_free_shared_buf;
@@ -366,6 +370,7 @@
 		ret = -EFAULT;
 
 err_free_shared_buf:
+	mutex_unlock(&psp->ras_context.mutex);
 	kfree(shared_buf);
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -1998,12 +1998,15 @@
 int amdgpu_ras_interrupt_dispatch(struct amdgpu_device *adev,
 		struct ras_dispatch_if *info)
 {
-	struct ras_manager *obj = amdgpu_ras_find_obj(adev, &info->head);
-	struct ras_ih_data *data = &obj->ih_data;
+	struct ras_manager *obj;
+	struct ras_ih_data *data;
 
+	obj = amdgpu_ras_find_obj(adev, &info->head);
 	if (!obj)
 		return -EINVAL;
 
+	data = &obj->ih_data;
+
 	if (data->inuse == 0)
 		return 0;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
@@ -38,6 +38,7 @@
  */
 #define AMDGPU_RAS_INST_MASK 0xfffff000
 #define AMDGPU_RAS_INST_SHIFT 0xc
+#define AMDGPU_RAS_GPU_ERR_HBM_ID(x)			AMDGPU_GET_REG_FIELD(x, 14, 13)
 
 enum amdgpu_ras_block {
 	AMDGPU_RAS_BLOCK__UMC = 0,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h
@@ -32,6 +32,7 @@
 
 	AMDGPU_NEED_FULL_RESET = 0,
 	AMDGPU_SKIP_HW_RESET = 1,
+	AMDGPU_HOST_FLR = 2,
 };
 
 struct amdgpu_reset_context {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -352,7 +352,7 @@
 	ring->max_dw = max_dw;
 	ring->hw_prio = hw_prio;
 
-	if (!ring->no_scheduler) {
+	if (!ring->no_scheduler && ring->funcs->type < AMDGPU_HW_IP_NUM) {
 		hw_ip = ring->funcs->type;
 		num_sched = &adev->gpu_sched[hw_ip][hw_prio].num_scheds;
 		adev->gpu_sched[hw_ip][hw_prio].sched[(*num_sched)++] =
@@ -473,8 +473,9 @@
 					size_t size, loff_t *pos)
 {
 	struct amdgpu_ring *ring = file_inode(f)->i_private;
-	int r, i;
 	uint32_t value, result, early[3];
+	loff_t i;
+	int r;
 
 	if (*pos & 3 || size & 3)
 		return -EINVAL;
@@ -524,46 +525,58 @@
 {
 	struct amdgpu_ring *ring = file_inode(f)->i_private;
 	volatile u32 *mqd;
-	int r;
+	u32 *kbuf;
+	int r, i;
 	uint32_t value, result;
 
 	if (*pos & 3 || size & 3)
 		return -EINVAL;
 
-	result = 0;
+	kbuf = kmalloc(ring->mqd_size, GFP_KERNEL);
+	if (!kbuf)
+		return -ENOMEM;
 
 	r = amdgpu_bo_reserve(ring->mqd_obj, false);
 	if (unlikely(r != 0))
-		return r;
+		goto err_free;
 
 	r = amdgpu_bo_kmap(ring->mqd_obj, (void **)&mqd);
-	if (r) {
-		amdgpu_bo_unreserve(ring->mqd_obj);
-		return r;
-	}
+	if (r)
+		goto err_unreserve;
+
+	/*
+	 * Copy to local buffer to avoid put_user(), which might fault
+	 * and acquire mmap_sem, under reservation_ww_class_mutex.
+	 */
+	for (i = 0; i < ring->mqd_size/sizeof(u32); i++)
+		kbuf[i] = mqd[i];
+
+	amdgpu_bo_kunmap(ring->mqd_obj);
+	amdgpu_bo_unreserve(ring->mqd_obj);
 
+	result = 0;
 	while (size) {
 		if (*pos >= ring->mqd_size)
-			goto done;
+			break;
 
-		value = mqd[*pos/4];
+		value = kbuf[*pos/4];
 		r = put_user(value, (uint32_t *)buf);
 		if (r)
-			goto done;
+			goto err_free;
 		buf += 4;
 		result += 4;
 		size -= 4;
 		*pos += 4;
 	}
 
-done:
-	amdgpu_bo_kunmap(ring->mqd_obj);
-	mqd = NULL;
-	amdgpu_bo_unreserve(ring->mqd_obj);
-	if (r)
-		return r;
-
+	kfree(kbuf);
 	return result;
+
+err_unreserve:
+	amdgpu_bo_unreserve(ring->mqd_obj);
+err_free:
+	kfree(kbuf);
+	return r;
 }
 
 static const struct file_operations amdgpu_debugfs_mqd_fops = {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c
@@ -135,6 +135,10 @@
 		mutex_unlock(&psp->securedisplay_context.mutex);
 		break;
 	case 2:
+		if (size < 3 || phy_id >= TA_SECUREDISPLAY_MAX_PHY) {
+			dev_err(adev->dev, "Invalid input: %s\n", str);
+			return -EINVAL;
+		}
 		mutex_lock(&psp->securedisplay_context.mutex);
 		psp_prep_securedisplay_cmd_buf(psp, &securedisplay_cmd,
 			TA_SECUREDISPLAY_COMMAND__SEND_ROI_CRC);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -137,7 +137,7 @@
 			amdgpu_bo_placement_from_domain(abo, AMDGPU_GEM_DOMAIN_CPU);
 		} else if (!amdgpu_gmc_vram_full_visible(&adev->gmc) &&
 			   !(abo->flags & AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED) &&
-			   amdgpu_bo_in_cpu_visible_vram(abo)) {
+			   amdgpu_res_cpu_visible(adev, bo->resource)) {
 
 			/* Try evicting to the CPU inaccessible part of VRAM
 			 * first, but only set GTT as busy placement, so this
@@ -408,40 +408,55 @@
 	return r;
 }
 
-/*
- * amdgpu_mem_visible - Check that memory can be accessed by ttm_bo_move_memcpy
+/**
+ * amdgpu_res_cpu_visible - Check that resource can be accessed by CPU
+ * @adev: amdgpu device
+ * @res: the resource to check
  *
- * Called by amdgpu_bo_move()
+ * Returns: true if the full resource is CPU visible, false otherwise.
  */
-static bool amdgpu_mem_visible(struct amdgpu_device *adev,
-			       struct ttm_resource *mem)
+bool amdgpu_res_cpu_visible(struct amdgpu_device *adev,
+			    struct ttm_resource *res)
 {
-	u64 mem_size = (u64)mem->size;
 	struct amdgpu_res_cursor cursor;
-	u64 end;
 
-	if (mem->mem_type == TTM_PL_SYSTEM ||
-	    mem->mem_type == TTM_PL_TT)
+	if (!res)
+		return false;
+
+	if (res->mem_type == TTM_PL_SYSTEM || res->mem_type == TTM_PL_TT ||
+	    res->mem_type == AMDGPU_PL_PREEMPT || res->mem_type == AMDGPU_PL_DOORBELL)
 		return true;
-	if (mem->mem_type != TTM_PL_VRAM)
+
+	if (res->mem_type != TTM_PL_VRAM)
 		return false;
 
-	amdgpu_res_first(mem, 0, mem_size, &cursor);
-	end = cursor.start + cursor.size;
+	amdgpu_res_first(res, 0, res->size, &cursor);
 	while (cursor.remaining) {
+		if ((cursor.start + cursor.size) > adev->gmc.visible_vram_size)
+			return false;
 		amdgpu_res_next(&cursor, cursor.size);
+	}
 
-		if (!cursor.remaining)
-			break;
+	return true;
+}
 
-		/* ttm_resource_ioremap only supports contiguous memory */
-		if (end != cursor.start)
-			return false;
+/*
+ * amdgpu_res_copyable - Check that memory can be accessed by ttm_bo_move_memcpy
+ *
+ * Called by amdgpu_bo_move()
+ */
+static bool amdgpu_res_copyable(struct amdgpu_device *adev,
+				struct ttm_resource *mem)
+{
+	if (!amdgpu_res_cpu_visible(adev, mem))
+		return false;
 
-		end = cursor.start + cursor.size;
-	}
+	/* ttm_resource_ioremap only supports contiguous memory */
+	if (mem->mem_type == TTM_PL_VRAM &&
+	    !(mem->placement & TTM_PL_FLAG_CONTIGUOUS))
+		return false;
 
-	return end <= adev->gmc.visible_vram_size;
+	return true;
 }
 
 /*
@@ -471,14 +486,16 @@
 
 	if (!old_mem || (old_mem->mem_type == TTM_PL_SYSTEM &&
 			 bo->ttm == NULL)) {
+		amdgpu_bo_move_notify(bo, evict, new_mem);
 		ttm_bo_move_null(bo, new_mem);
-		goto out;
+		return 0;
 	}
 	if (old_mem->mem_type == TTM_PL_SYSTEM &&
 	    (new_mem->mem_type == TTM_PL_TT ||
 	     new_mem->mem_type == AMDGPU_PL_PREEMPT)) {
+		amdgpu_bo_move_notify(bo, evict, new_mem);
 		ttm_bo_move_null(bo, new_mem);
-		goto out;
+		return 0;
 	}
 	if ((old_mem->mem_type == TTM_PL_TT ||
 	     old_mem->mem_type == AMDGPU_PL_PREEMPT) &&
@@ -488,9 +505,10 @@
 			return r;
 
 		amdgpu_ttm_backend_unbind(bo->bdev, bo->ttm);
+		amdgpu_bo_move_notify(bo, evict, new_mem);
 		ttm_resource_free(bo, &bo->resource);
 		ttm_bo_assign_mem(bo, new_mem);
-		goto out;
+		return 0;
 	}
 
 	if (old_mem->mem_type == AMDGPU_PL_GDS ||
@@ -502,8 +520,9 @@
 	    new_mem->mem_type == AMDGPU_PL_OA ||
 	    new_mem->mem_type == AMDGPU_PL_DOORBELL) {
 		/* Nothing to save here */
+		amdgpu_bo_move_notify(bo, evict, new_mem);
 		ttm_bo_move_null(bo, new_mem);
-		goto out;
+		return 0;
 	}
 
 	if (bo->type == ttm_bo_type_device &&
@@ -515,27 +534,28 @@
 		abo->flags &= ~AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
 	}
 
-	if (adev->mman.buffer_funcs_enabled) {
-		if (((old_mem->mem_type == TTM_PL_SYSTEM &&
-		      new_mem->mem_type == TTM_PL_VRAM) ||
-		     (old_mem->mem_type == TTM_PL_VRAM &&
-		      new_mem->mem_type == TTM_PL_SYSTEM))) {
-			hop->fpfn = 0;
-			hop->lpfn = 0;
-			hop->mem_type = TTM_PL_TT;
-			hop->flags = TTM_PL_FLAG_TEMPORARY;
-			return -EMULTIHOP;
-		}
+	if (adev->mman.buffer_funcs_enabled &&
+	    ((old_mem->mem_type == TTM_PL_SYSTEM &&
+	      new_mem->mem_type == TTM_PL_VRAM) ||
+	     (old_mem->mem_type == TTM_PL_VRAM &&
+	      new_mem->mem_type == TTM_PL_SYSTEM))) {
+		hop->fpfn = 0;
+		hop->lpfn = 0;
+		hop->mem_type = TTM_PL_TT;
+		hop->flags = TTM_PL_FLAG_TEMPORARY;
+		return -EMULTIHOP;
+	}
 
+	amdgpu_bo_move_notify(bo, evict, new_mem);
+	if (adev->mman.buffer_funcs_enabled)
 		r = amdgpu_move_blit(bo, evict, new_mem, old_mem);
-	} else {
+	else
 		r = -ENODEV;
-	}
 
 	if (r) {
 		/* Check that all memory is CPU accessible */
-		if (!amdgpu_mem_visible(adev, old_mem) ||
-		    !amdgpu_mem_visible(adev, new_mem)) {
+		if (!amdgpu_res_copyable(adev, old_mem) ||
+		    !amdgpu_res_copyable(adev, new_mem)) {
 			pr_err("Move buffer fallback to memcpy unavailable\n");
 			return r;
 		}
@@ -545,11 +565,10 @@
 			return r;
 	}
 
-	trace_amdgpu_bo_move(abo, new_mem->mem_type, old_mem->mem_type);
-out:
-	/* update statistics */
+	/* update statistics after the move */
+	if (evict)
+		atomic64_inc(&adev->num_evictions);
 	atomic64_add(bo->base.size, &adev->num_bytes_moved);
-	amdgpu_bo_move_notify(bo, evict);
 	return 0;
 }
 
@@ -562,7 +581,6 @@
 				     struct ttm_resource *mem)
 {
 	struct amdgpu_device *adev = amdgpu_ttm_adev(bdev);
-	size_t bus_size = (size_t)mem->size;
 
 	switch (mem->mem_type) {
 	case TTM_PL_SYSTEM:
@@ -573,9 +591,6 @@
 		break;
 	case TTM_PL_VRAM:
 		mem->bus.offset = mem->start << PAGE_SHIFT;
-		/* check if it's visible */
-		if ((mem->bus.offset + bus_size) > adev->gmc.visible_vram_size)
-			return -EINVAL;
 
 		if (adev->mman.aper_base_kaddr &&
 		    mem->placement & TTM_PL_FLAG_CONTIGUOUS)
@@ -779,7 +794,7 @@
 	/* Map SG to device */
 	r = dma_map_sgtable(adev->dev, ttm->sg, direction, 0);
 	if (r)
-		goto release_sg;
+		goto release_sg_table;
 
 	/* convert SG to linear array of pages and dma addresses */
 	drm_prime_sg_to_dma_addr_array(ttm->sg, gtt->ttm.dma_address,
@@ -787,6 +802,8 @@
 
 	return 0;
 
+release_sg_table:
+	sg_free_table(ttm->sg);
 release_sg:
 	kfree(ttm->sg);
 	ttm->sg = NULL;
@@ -869,6 +886,7 @@
 		amdgpu_gart_bind(adev, gtt->offset, ttm->num_pages,
 				 gtt->ttm.dma_address, flags);
 	}
+	gtt->bound = true;
 }
 
 /*
@@ -1554,7 +1572,7 @@
 static void
 amdgpu_bo_delete_mem_notify(struct ttm_buffer_object *bo)
 {
-	amdgpu_bo_move_notify(bo, false);
+	amdgpu_bo_move_notify(bo, false, NULL);
 }
 
 static struct ttm_device_funcs amdgpu_bo_driver = {
@@ -1816,6 +1834,7 @@
 
 	mutex_init(&adev->mman.gtt_window_lock);
 
+	dma_set_max_seg_size(adev->dev, UINT_MAX);
 	/* No others user of address space so set it to 0 */
 	r = ttm_device_init(&adev->mman.bdev, &amdgpu_bo_driver, adev->dev,
 			       adev_to_drm(adev)->anon_inode->i_mapping,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
@@ -139,6 +139,9 @@
 int amdgpu_vram_mgr_query_page_status(struct amdgpu_vram_mgr *mgr,
 				      uint64_t start);
 
+bool amdgpu_res_cpu_visible(struct amdgpu_device *adev,
+			    struct ttm_resource *res);
+
 int amdgpu_ttm_init(struct amdgpu_device *adev);
 void amdgpu_ttm_fini(struct amdgpu_device *adev);
 void amdgpu_ttm_set_buffer_funcs_status(struct amdgpu_device *adev,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
@@ -175,6 +175,7 @@
 	}
 
 	kfree(err_data->err_addr);
+	err_data->err_addr = NULL;
 	return AMDGPU_RAS_SUCCESS;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c
@@ -766,6 +766,9 @@
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+	if (amdgpu_in_reset(adev) || adev->in_s0ix || adev->in_suspend)
+		return 0;
+
 	return umsch_mm_test(adev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
@@ -214,15 +214,15 @@
 
 	drm_sched_entity_destroy(&adev->vce.entity);
 
-	amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr,
-		(void **)&adev->vce.cpu_addr);
-
 	for (i = 0; i < adev->vce.num_rings; i++)
 		amdgpu_ring_fini(&adev->vce.ring[i]);
 
 	amdgpu_ucode_release(&adev->vce.fw);
 	mutex_destroy(&adev->vce.idle_mutex);
 
+	amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr,
+		(void **)&adev->vce.cpu_addr);
+
 	return 0;
 }
 
@@ -743,7 +743,8 @@
 	uint32_t created = 0;
 	uint32_t allocated = 0;
 	uint32_t tmp, handle = 0;
-	uint32_t *size = &tmp;
+	uint32_t dummy = 0xffffffff;
+	uint32_t *size = &dummy;
 	unsigned int idx;
 	int i, r = 0;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -137,6 +137,10 @@
 		}
 	}
 
+	/* from vcn4 and above, only unified queue is used */
+	adev->vcn.using_unified_queue =
+		amdgpu_ip_version(adev, UVD_HWIP, 0) >= IP_VERSION(4, 0, 0);
+
 	hdr = (const struct common_firmware_header *)adev->vcn.fw->data;
 	adev->vcn.fw_version = le32_to_cpu(hdr->ucode_version);
 
@@ -261,18 +265,6 @@
 	return 0;
 }
 
-/* from vcn4 and above, only unified queue is used */
-static bool amdgpu_vcn_using_unified_queue(struct amdgpu_ring *ring)
-{
-	struct amdgpu_device *adev = ring->adev;
-	bool ret = false;
-
-	if (amdgpu_ip_version(adev, UVD_HWIP, 0) >= IP_VERSION(4, 0, 0))
-		ret = true;
-
-	return ret;
-}
-
 bool amdgpu_vcn_is_disabled_vcn(struct amdgpu_device *adev, enum vcn_ring_type type, uint32_t vcn_instance)
 {
 	bool ret = false;
@@ -382,7 +374,9 @@
 		for (i = 0; i < adev->vcn.num_enc_rings; ++i)
 			fence[j] += amdgpu_fence_count_emitted(&adev->vcn.inst[j].ring_enc[i]);
 
-		if (adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG)	{
+		/* Only set DPG pause for VCN3 or below, VCN4 and above will be handled by FW */
+		if (adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG &&
+		    !adev->vcn.using_unified_queue) {
 			struct dpg_pause_state new_state;
 
 			if (fence[j] ||
@@ -428,7 +422,9 @@
 	amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCN,
 	       AMD_PG_STATE_UNGATE);
 
-	if (adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG)	{
+	/* Only set DPG pause for VCN3 or below, VCN4 and above will be handled by FW */
+	if (adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG &&
+	    !adev->vcn.using_unified_queue) {
 		struct dpg_pause_state new_state;
 
 		if (ring->funcs->type == AMDGPU_RING_TYPE_VCN_ENC) {
@@ -454,8 +450,12 @@
 
 void amdgpu_vcn_ring_end_use(struct amdgpu_ring *ring)
 {
+	struct amdgpu_device *adev = ring->adev;
+
+	/* Only set DPG pause for VCN3 or below, VCN4 and above will be handled by FW */
 	if (ring->adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG &&
-		ring->funcs->type == AMDGPU_RING_TYPE_VCN_ENC)
+	    ring->funcs->type == AMDGPU_RING_TYPE_VCN_ENC &&
+	    !adev->vcn.using_unified_queue)
 		atomic_dec(&ring->adev->vcn.inst[ring->me].dpg_enc_submission_cnt);
 
 	atomic_dec(&ring->adev->vcn.total_submission_cnt);
@@ -709,12 +709,11 @@
 	struct amdgpu_job *job;
 	struct amdgpu_ib *ib;
 	uint64_t addr = AMDGPU_GPU_PAGE_ALIGN(ib_msg->gpu_addr);
-	bool sq = amdgpu_vcn_using_unified_queue(ring);
 	uint32_t *ib_checksum;
 	uint32_t ib_pack_in_dw;
 	int i, r;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_size_dw += 8;
 
 	r = amdgpu_job_alloc_with_ib(ring->adev, NULL, NULL,
@@ -727,7 +726,7 @@
 	ib->length_dw = 0;
 
 	/* single queue headers */
-	if (sq) {
+	if (adev->vcn.using_unified_queue) {
 		ib_pack_in_dw = sizeof(struct amdgpu_vcn_decode_buffer) / sizeof(uint32_t)
 						+ 4 + 2; /* engine info + decoding ib in dw */
 		ib_checksum = amdgpu_vcn_unified_ring_ib_header(ib, ib_pack_in_dw, false);
@@ -746,7 +745,7 @@
 	for (i = ib->length_dw; i < ib_size_dw; ++i)
 		ib->ptr[i] = 0x0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		amdgpu_vcn_unified_ring_ib_checksum(&ib_checksum, ib_pack_in_dw);
 
 	r = amdgpu_job_submit_direct(job, ring, &f);
@@ -836,15 +835,15 @@
 					 struct dma_fence **fence)
 {
 	unsigned int ib_size_dw = 16;
+	struct amdgpu_device *adev = ring->adev;
 	struct amdgpu_job *job;
 	struct amdgpu_ib *ib;
 	struct dma_fence *f = NULL;
 	uint32_t *ib_checksum = NULL;
 	uint64_t addr;
-	bool sq = amdgpu_vcn_using_unified_queue(ring);
 	int i, r;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_size_dw += 8;
 
 	r = amdgpu_job_alloc_with_ib(ring->adev, NULL, NULL,
@@ -858,7 +857,7 @@
 
 	ib->length_dw = 0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_checksum = amdgpu_vcn_unified_ring_ib_header(ib, 0x11, true);
 
 	ib->ptr[ib->length_dw++] = 0x00000018;
@@ -880,7 +879,7 @@
 	for (i = ib->length_dw; i < ib_size_dw; ++i)
 		ib->ptr[i] = 0x0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		amdgpu_vcn_unified_ring_ib_checksum(&ib_checksum, 0x11);
 
 	r = amdgpu_job_submit_direct(job, ring, &f);
@@ -903,15 +902,15 @@
 					  struct dma_fence **fence)
 {
 	unsigned int ib_size_dw = 16;
+	struct amdgpu_device *adev = ring->adev;
 	struct amdgpu_job *job;
 	struct amdgpu_ib *ib;
 	struct dma_fence *f = NULL;
 	uint32_t *ib_checksum = NULL;
 	uint64_t addr;
-	bool sq = amdgpu_vcn_using_unified_queue(ring);
 	int i, r;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_size_dw += 8;
 
 	r = amdgpu_job_alloc_with_ib(ring->adev, NULL, NULL,
@@ -925,7 +924,7 @@
 
 	ib->length_dw = 0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_checksum = amdgpu_vcn_unified_ring_ib_header(ib, 0x11, true);
 
 	ib->ptr[ib->length_dw++] = 0x00000018;
@@ -947,7 +946,7 @@
 	for (i = ib->length_dw; i < ib_size_dw; ++i)
 		ib->ptr[i] = 0x0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		amdgpu_vcn_unified_ring_ib_checksum(&ib_checksum, 0x11);
 
 	r = amdgpu_job_submit_direct(job, ring, &f);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
@@ -287,6 +287,7 @@
 
 	uint16_t inst_mask;
 	uint8_t	num_inst_per_aid;
+	bool using_unified_queue;
 };
 
 struct amdgpu_fw_shared_rb_ptrs_struct {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
@@ -138,8 +138,10 @@
 
 	if (virt->ops && virt->ops->req_full_gpu) {
 		r = virt->ops->req_full_gpu(adev, init);
-		if (r)
+		if (r) {
+			adev->no_hw_access = true;
 			return r;
+		}
 
 		adev->virt.caps &= ~AMDGPU_SRIOV_CAPS_RUNTIME;
 	}
@@ -437,6 +439,8 @@
 	else
 		vram_usage_va = adev->mman.drv_vram_usage_va;
 
+	memset(&bp, 0, sizeof(bp));
+
 	if (bp_block_size) {
 		bp_cnt = bp_block_size / sizeof(uint64_t);
 		for (bp_idx = 0; bp_idx < bp_cnt; bp_idx++) {
@@ -616,7 +620,7 @@
 	vf2pf_info->dummy_page_addr = (uint64_t)adev->dummy_page_addr;
 	vf2pf_info->checksum =
 		amd_sriov_msg_checksum(
-		vf2pf_info, vf2pf_info->header.size, 0, 0);
+		vf2pf_info, sizeof(*vf2pf_info), 0, 0);
 
 	return 0;
 }
@@ -999,11 +1003,17 @@
 		return 0;
 	}
 
+	if (amdgpu_device_skip_hw_access(adev))
+		return 0;
+
 	reg_access_ctrl = &adev->gfx.rlc.reg_access_ctrl[xcc_id];
 	scratch_reg0 = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->scratch_reg0;
 	scratch_reg1 = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->scratch_reg1;
 	scratch_reg2 = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->scratch_reg2;
 	scratch_reg3 = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->scratch_reg3;
+
+	mutex_lock(&adev->virt.rlcg_reg_lock);
+
 	if (reg_access_ctrl->spare_int)
 		spare_int = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->spare_int;
 
@@ -1059,6 +1069,9 @@
 	}
 
 	ret = readl(scratch_reg0);
+
+	mutex_unlock(&adev->virt.rlcg_reg_lock);
+
 	return ret;
 }
 
@@ -1068,6 +1081,9 @@
 {
 	u32 rlcg_flag;
 
+	if (amdgpu_device_skip_hw_access(adev))
+		return;
+
 	if (!amdgpu_sriov_runtime(adev) &&
 		amdgpu_virt_get_rlcg_reg_access_flag(adev, acc_flags, hwip, true, &rlcg_flag)) {
 		amdgpu_virt_rlcg_reg_rw(adev, offset, value, rlcg_flag, xcc_id);
@@ -1085,6 +1101,9 @@
 {
 	u32 rlcg_flag;
 
+	if (amdgpu_device_skip_hw_access(adev))
+		return 0;
+
 	if (!amdgpu_sriov_runtime(adev) &&
 		amdgpu_virt_get_rlcg_reg_access_flag(adev, acc_flags, hwip, false, &rlcg_flag))
 		return amdgpu_virt_rlcg_reg_rw(adev, offset, 0, rlcg_flag, xcc_id);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
@@ -265,6 +265,8 @@
 
 	/* the ucode id to signal the autoload */
 	uint32_t autoload_ucode_id;
+
+	struct mutex rlcg_reg_lock;
 };
 
 struct amdgpu_video_codec_info;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
@@ -3,6 +3,7 @@
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_edid.h>
 #include <drm/drm_simple_kms_helper.h>
+#include <drm/drm_gem_framebuffer_helper.h>
 #include <drm/drm_vblank.h>
 
 #include "amdgpu.h"
@@ -314,7 +315,13 @@
 		return 0;
 	}
 	afb = to_amdgpu_framebuffer(new_state->fb);
-	obj = new_state->fb->obj[0];
+
+	obj = drm_gem_fb_get_obj(new_state->fb, 0);
+	if (!obj) {
+		DRM_ERROR("Failed to get obj from framebuffer\n");
+		return -EINVAL;
+	}
+
 	rbo = gem_to_amdgpu_bo(obj);
 	adev = amdgpu_ttm_adev(rbo->tbo.bdev);
 
@@ -368,12 +375,19 @@
 				   struct drm_plane_state *old_state)
 {
 	struct amdgpu_bo *rbo;
+	struct drm_gem_object *obj;
 	int r;
 
 	if (!old_state->fb)
 		return;
 
-	rbo = gem_to_amdgpu_bo(old_state->fb->obj[0]);
+	obj = drm_gem_fb_get_obj(old_state->fb, 0);
+	if (!obj) {
+		DRM_ERROR("Failed to get obj from framebuffer\n");
+		return;
+	}
+
+	rbo = gem_to_amdgpu_bo(obj);
 	r = amdgpu_bo_reserve(rbo, false);
 	if (unlikely(r)) {
 		DRM_ERROR("failed to reserve rbo before unpin\n");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -418,7 +418,7 @@
 	if (!vm)
 		return result;
 
-	result += vm->generation;
+	result += lower_32_bits(vm->generation);
 	/* Add one if the page tables will be re-generated on next CS */
 	if (drm_sched_entity_error(&vm->delayed))
 		++result;
@@ -443,13 +443,14 @@
 			      int (*validate)(void *p, struct amdgpu_bo *bo),
 			      void *param)
 {
+	uint64_t new_vm_generation = amdgpu_vm_generation(adev, vm);
 	struct amdgpu_vm_bo_base *bo_base;
 	struct amdgpu_bo *shadow;
 	struct amdgpu_bo *bo;
 	int r;
 
-	if (drm_sched_entity_error(&vm->delayed)) {
-		++vm->generation;
+	if (vm->generation != new_vm_generation) {
+		vm->generation = new_vm_generation;
 		amdgpu_vm_bo_reset_state_machine(vm);
 		amdgpu_vm_fini_entities(vm);
 		r = amdgpu_vm_init_entities(adev, vm);
@@ -1165,10 +1166,9 @@
 	 * next command submission.
 	 */
 	if (bo && bo->tbo.base.resv == vm->root.bo->tbo.base.resv) {
-		uint32_t mem_type = bo->tbo.resource->mem_type;
-
-		if (!(bo->preferred_domains &
-		      amdgpu_mem_type_to_domain(mem_type)))
+		if (bo->tbo.resource &&
+		    !(bo->preferred_domains &
+		      amdgpu_mem_type_to_domain(bo->tbo.resource->mem_type)))
 			amdgpu_vm_bo_evicted(&bo_va->base);
 		else
 			amdgpu_vm_bo_idle(&bo_va->base);
@@ -1559,6 +1559,37 @@
 	trace_amdgpu_vm_bo_map(bo_va, mapping);
 }
 
+/* Validate operation parameters to prevent potential abuse */
+static int amdgpu_vm_verify_parameters(struct amdgpu_device *adev,
+					  struct amdgpu_bo *bo,
+					  uint64_t saddr,
+					  uint64_t offset,
+					  uint64_t size)
+{
+	uint64_t tmp, lpfn;
+
+	if (saddr & AMDGPU_GPU_PAGE_MASK
+	    || offset & AMDGPU_GPU_PAGE_MASK
+	    || size & AMDGPU_GPU_PAGE_MASK)
+		return -EINVAL;
+
+	if (check_add_overflow(saddr, size, &tmp)
+	    || check_add_overflow(offset, size, &tmp)
+	    || size == 0 /* which also leads to end < begin */)
+		return -EINVAL;
+
+	/* make sure object fit at this offset */
+	if (bo && offset + size > amdgpu_bo_size(bo))
+		return -EINVAL;
+
+	/* Ensure last pfn not exceed max_pfn */
+	lpfn = (saddr + size - 1) >> AMDGPU_GPU_PAGE_SHIFT;
+	if (lpfn >= adev->vm_manager.max_pfn)
+		return -EINVAL;
+
+	return 0;
+}
+
 /**
  * amdgpu_vm_bo_map - map bo inside a vm
  *
@@ -1585,21 +1616,14 @@
 	struct amdgpu_bo *bo = bo_va->base.bo;
 	struct amdgpu_vm *vm = bo_va->base.vm;
 	uint64_t eaddr;
+	int r;
 
-	/* validate the parameters */
-	if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK)
-		return -EINVAL;
-	if (saddr + size <= saddr || offset + size <= offset)
-		return -EINVAL;
-
-	/* make sure object fit at this offset */
-	eaddr = saddr + size - 1;
-	if ((bo && offset + size > amdgpu_bo_size(bo)) ||
-	    (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT))
-		return -EINVAL;
+	r = amdgpu_vm_verify_parameters(adev, bo, saddr, offset, size);
+	if (r)
+		return r;
 
 	saddr /= AMDGPU_GPU_PAGE_SIZE;
-	eaddr /= AMDGPU_GPU_PAGE_SIZE;
+	eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE;
 
 	tmp = amdgpu_vm_it_iter_first(&vm->va, saddr, eaddr);
 	if (tmp) {
@@ -1652,17 +1676,9 @@
 	uint64_t eaddr;
 	int r;
 
-	/* validate the parameters */
-	if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK)
-		return -EINVAL;
-	if (saddr + size <= saddr || offset + size <= offset)
-		return -EINVAL;
-
-	/* make sure object fit at this offset */
-	eaddr = saddr + size - 1;
-	if ((bo && offset + size > amdgpu_bo_size(bo)) ||
-	    (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT))
-		return -EINVAL;
+	r = amdgpu_vm_verify_parameters(adev, bo, saddr, offset, size);
+	if (r)
+		return r;
 
 	/* Allocate all the needed memory */
 	mapping = kmalloc(sizeof(*mapping), GFP_KERNEL);
@@ -1676,7 +1692,7 @@
 	}
 
 	saddr /= AMDGPU_GPU_PAGE_SIZE;
-	eaddr /= AMDGPU_GPU_PAGE_SIZE;
+	eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE;
 
 	mapping->start = saddr;
 	mapping->last = eaddr;
@@ -1763,10 +1779,14 @@
 	struct amdgpu_bo_va_mapping *before, *after, *tmp, *next;
 	LIST_HEAD(removed);
 	uint64_t eaddr;
+	int r;
+
+	r = amdgpu_vm_verify_parameters(adev, NULL, saddr, 0, size);
+	if (r)
+		return r;
 
-	eaddr = saddr + size - 1;
 	saddr /= AMDGPU_GPU_PAGE_SIZE;
-	eaddr /= AMDGPU_GPU_PAGE_SIZE;
+	eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE;
 
 	/* Allocate all the needed memory */
 	before = kzalloc(sizeof(*before), GFP_KERNEL);
@@ -2231,7 +2251,7 @@
 	vm->last_update = dma_fence_get_stub();
 	vm->last_unlocked = dma_fence_get_stub();
 	vm->last_tlb_flush = dma_fence_get_stub();
-	vm->generation = 0;
+	vm->generation = amdgpu_vm_generation(adev, NULL);
 
 	mutex_init(&vm->eviction_lock);
 	vm->evicting = false;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
@@ -766,11 +766,15 @@
 			 struct amdgpu_vm_bo_base *entry)
 {
 	struct amdgpu_vm_bo_base *parent = amdgpu_vm_pt_parent(entry);
-	struct amdgpu_bo *bo = parent->bo, *pbo;
+	struct amdgpu_bo *bo, *pbo;
 	struct amdgpu_vm *vm = params->vm;
 	uint64_t pde, pt, flags;
 	unsigned int level;
 
+	if (WARN_ON(!parent))
+		return -EINVAL;
+
+	bo = parent->bo;
 	for (level = 0, pbo = bo->parent; pbo; ++level)
 		pbo = pbo->parent;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
@@ -102,6 +102,11 @@
 	if (!r)
 		r = amdgpu_sync_push_to_job(&sync, p->job);
 	amdgpu_sync_free(&sync);
+
+	if (r) {
+		p->num_dw_left = 0;
+		amdgpu_job_free(p->job);
+	}
 	return r;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c
@@ -390,6 +390,12 @@
 	struct amdgpu_vpe *vpe = &adev->vpe;
 	int ret;
 
+	/* Power on VPE */
+	ret = amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VPE,
+						     AMD_PG_STATE_UNGATE);
+	if (ret)
+		return ret;
+
 	ret = vpe_load_microcode(vpe);
 	if (ret)
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
@@ -31,6 +31,8 @@
 #include "amdgpu_atomfirmware.h"
 #include "atom.h"
 
+#define AMDGPU_MAX_SG_SEGMENT_SIZE	(2UL << 30)
+
 struct amdgpu_vram_reservation {
 	u64 start;
 	u64 size;
@@ -516,9 +518,7 @@
 
 		BUG_ON(min_block_size < mm->chunk_size);
 
-		/* Limit maximum size to 2GiB due to SG table limitations */
-		size = min(remaining_size, 2ULL << 30);
-
+		size = remaining_size;
 		if ((size >= (u64)pages_per_block << PAGE_SHIFT) &&
 				!(size & (((u64)pages_per_block << PAGE_SHIFT) - 1)))
 			min_block_size = (u64)pages_per_block << PAGE_SHIFT;
@@ -646,7 +646,7 @@
 	amdgpu_res_first(res, offset, length, &cursor);
 	while (cursor.remaining) {
 		num_entries++;
-		amdgpu_res_next(&cursor, cursor.size);
+		amdgpu_res_next(&cursor, min(cursor.size, AMDGPU_MAX_SG_SEGMENT_SIZE));
 	}
 
 	r = sg_alloc_table(*sgt, num_entries, GFP_KERNEL);
@@ -666,7 +666,7 @@
 	amdgpu_res_first(res, offset, length, &cursor);
 	for_each_sgtable_sg((*sgt), sg, i) {
 		phys_addr_t phys = cursor.start + adev->gmc.aper_base;
-		size_t size = cursor.size;
+		unsigned long size = min(cursor.size, AMDGPU_MAX_SG_SEGMENT_SIZE);
 		dma_addr_t addr;
 
 		addr = dma_map_resource(dev, phys, size, dir,
@@ -679,7 +679,7 @@
 		sg_dma_address(sg) = addr;
 		sg_dma_len(sg) = size;
 
-		amdgpu_res_next(&cursor, cursor.size);
+		amdgpu_res_next(&cursor, size);
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.h
@@ -180,6 +180,6 @@
 
 #define for_each_xcp(xcp_mgr, xcp, i)                            \
 	for (i = 0, xcp = amdgpu_get_next_xcp(xcp_mgr, &i); xcp; \
-	     xcp = amdgpu_get_next_xcp(xcp_mgr, &i))
+	     ++i, xcp = amdgpu_get_next_xcp(xcp_mgr, &i))
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c
@@ -434,6 +434,9 @@
 		}
 	}
 
+	if (i == top->num_nodes)
+		return -EINVAL;
+
 	for (i = 0; i < top->num_nodes; i++) {
 		for (j = 0; j < top->nodes[i].num_links; j++)
 			/* node id in sysfs starts from 1 rather than 0 so +1 here */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h
@@ -210,7 +210,7 @@
 	uint32_t pcie_atomic_ops_support_flags;
 	/* reserved */
 	uint32_t reserved[256 - AMD_SRIOV_MSG_PF2VF_INFO_FILLED_SIZE];
-};
+} __packed;
 
 struct amd_sriov_msg_vf2pf_info_header {
 	/* the total structure size in byte */
@@ -268,7 +268,7 @@
 
 	/* reserved */
 	uint32_t reserved[256 - AMD_SRIOV_MSG_VF2PF_INFO_FILLED_SIZE];
-};
+} __packed;
 
 /* mailbox message send from guest to host  */
 enum amd_sriov_mailbox_request_message {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
@@ -62,6 +62,11 @@
 	adev->doorbell_index.max_assignment = AMDGPU_DOORBELL_LAYOUT1_MAX_ASSIGNMENT << 1;
 }
 
+static bool aqua_vanjaram_xcp_vcn_shared(struct amdgpu_device *adev)
+{
+	return (adev->xcp_mgr->num_xcps > adev->vcn.num_vcn_inst);
+}
+
 static void aqua_vanjaram_set_xcp_id(struct amdgpu_device *adev,
 			     uint32_t inst_idx, struct amdgpu_ring *ring)
 {
@@ -87,7 +92,7 @@
 	case AMDGPU_RING_TYPE_VCN_ENC:
 	case AMDGPU_RING_TYPE_VCN_JPEG:
 		ip_blk = AMDGPU_XCP_VCN;
-		if (adev->xcp_mgr->mode == AMDGPU_CPX_PARTITION_MODE)
+		if (aqua_vanjaram_xcp_vcn_shared(adev))
 			inst_mask = 1 << (inst_idx * 2);
 		break;
 	default:
@@ -140,10 +145,12 @@
 
 		aqua_vanjaram_xcp_gpu_sched_update(adev, ring, ring->xcp_id);
 
-		/* VCN is shared by two partitions under CPX MODE */
+		/* VCN may be shared by two partitions under CPX MODE in certain
+		 * configs.
+		 */
 		if ((ring->funcs->type == AMDGPU_RING_TYPE_VCN_ENC ||
-			ring->funcs->type == AMDGPU_RING_TYPE_VCN_JPEG) &&
-			adev->xcp_mgr->mode == AMDGPU_CPX_PARTITION_MODE)
+		     ring->funcs->type == AMDGPU_RING_TYPE_VCN_JPEG) &&
+		    aqua_vanjaram_xcp_vcn_shared(adev))
 			aqua_vanjaram_xcp_gpu_sched_update(adev, ring, ring->xcp_id + 1);
 	}
 
@@ -434,7 +441,7 @@
 	case AMDGPU_SPX_PARTITION_MODE:
 		return adev->gmc.num_mem_partitions == 1 && num_xcc > 0;
 	case AMDGPU_DPX_PARTITION_MODE:
-		return adev->gmc.num_mem_partitions != 8 && (num_xcc % 4) == 0;
+		return adev->gmc.num_mem_partitions <= 2 && (num_xcc % 4) == 0;
 	case AMDGPU_TPX_PARTITION_MODE:
 		return (adev->gmc.num_mem_partitions == 1 ||
 			adev->gmc.num_mem_partitions == 3) &&
@@ -494,6 +501,12 @@
 
 	if (mode == AMDGPU_AUTO_COMPUTE_PARTITION_MODE) {
 		mode = __aqua_vanjaram_get_auto_mode(xcp_mgr);
+		if (mode == AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE) {
+			dev_err(adev->dev,
+				"Invalid config, no compatible compute partition mode found, available memory partitions: %d",
+				adev->gmc.num_mem_partitions);
+			return -EINVAL;
+		}
 	} else if (!__aqua_vanjaram_is_valid_mode(xcp_mgr, mode)) {
 		dev_err(adev->dev,
 			"Invalid compute partition mode requested, requested: %s, available memory partitions: %d",
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/atom.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -62,6 +62,7 @@
 typedef struct {
 	struct atom_context *ctx;
 	uint32_t *ps, *ws;
+	int ps_size, ws_size;
 	int ps_shift;
 	uint16_t start;
 	unsigned last_jump;
@@ -70,8 +71,8 @@
 } atom_exec_context;
 
 int amdgpu_atom_debug;
-static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params);
-int amdgpu_atom_execute_table(struct atom_context *ctx, int index, uint32_t *params);
+static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params, int params_size);
+int amdgpu_atom_execute_table(struct atom_context *ctx, int index, uint32_t *params, int params_size);
 
 static uint32_t atom_arg_mask[8] =
 	{ 0xFFFFFFFF, 0xFFFF, 0xFFFF00, 0xFFFF0000, 0xFF, 0xFF00, 0xFF0000,
@@ -223,7 +224,10 @@
 		(*ptr)++;
 		/* get_unaligned_le32 avoids unaligned accesses from atombios
 		 * tables, noticed on a DEC Alpha. */
-		val = get_unaligned_le32((u32 *)&ctx->ps[idx]);
+		if (idx < ctx->ps_size)
+			val = get_unaligned_le32((u32 *)&ctx->ps[idx]);
+		else
+			pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size);
 		if (print)
 			DEBUG("PS[0x%02X,0x%04X]", idx, val);
 		break;
@@ -261,7 +265,10 @@
 			val = gctx->reg_block;
 			break;
 		default:
-			val = ctx->ws[idx];
+			if (idx < ctx->ws_size)
+				val = ctx->ws[idx];
+			else
+				pr_info("WS index out of range: %i > %i\n", idx, ctx->ws_size);
 		}
 		break;
 	case ATOM_ARG_ID:
@@ -313,7 +320,7 @@
 				DEBUG("IMM 0x%02X\n", val);
 			return val;
 		}
-		return 0;
+		break;
 	case ATOM_ARG_PLL:
 		idx = U8(*ptr);
 		(*ptr)++;
@@ -495,6 +502,10 @@
 		idx = U8(*ptr);
 		(*ptr)++;
 		DEBUG("PS[0x%02X]", idx);
+		if (idx >= ctx->ps_size) {
+			pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size);
+			return;
+		}
 		ctx->ps[idx] = cpu_to_le32(val);
 		break;
 	case ATOM_ARG_WS:
@@ -527,6 +538,10 @@
 			gctx->reg_block = val;
 			break;
 		default:
+			if (idx >= ctx->ws_size) {
+				pr_info("WS index out of range: %i > %i\n", idx, ctx->ws_size);
+				return;
+			}
 			ctx->ws[idx] = val;
 		}
 		break;
@@ -624,7 +639,7 @@
 	else
 		SDEBUG("   table: %d\n", idx);
 	if (U16(ctx->ctx->cmd_table + 4 + 2 * idx))
-		r = amdgpu_atom_execute_table_locked(ctx->ctx, idx, ctx->ps + ctx->ps_shift);
+		r = amdgpu_atom_execute_table_locked(ctx->ctx, idx, ctx->ps + ctx->ps_shift, ctx->ps_size - ctx->ps_shift);
 	if (r) {
 		ctx->abort = true;
 	}
@@ -1203,7 +1218,7 @@
 	atom_op_div32, ATOM_ARG_WS},
 };
 
-static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params)
+static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params, int params_size)
 {
 	int base = CU16(ctx->cmd_table + 4 + 2 * index);
 	int len, ws, ps, ptr;
@@ -1225,12 +1240,16 @@
 	ectx.ps_shift = ps / 4;
 	ectx.start = base;
 	ectx.ps = params;
+	ectx.ps_size = params_size;
 	ectx.abort = false;
 	ectx.last_jump = 0;
-	if (ws)
+	if (ws) {
 		ectx.ws = kcalloc(4, ws, GFP_KERNEL);
-	else
+		ectx.ws_size = ws;
+	} else {
 		ectx.ws = NULL;
+		ectx.ws_size = 0;
+	}
 
 	debug_depth++;
 	while (1) {
@@ -1264,7 +1283,7 @@
 	return ret;
 }
 
-int amdgpu_atom_execute_table(struct atom_context *ctx, int index, uint32_t *params)
+int amdgpu_atom_execute_table(struct atom_context *ctx, int index, uint32_t *params, int params_size)
 {
 	int r;
 
@@ -1280,7 +1299,7 @@
 	/* reset divmul */
 	ctx->divmul[0] = 0;
 	ctx->divmul[1] = 0;
-	r = amdgpu_atom_execute_table_locked(ctx, index, params);
+	r = amdgpu_atom_execute_table_locked(ctx, index, params, params_size);
 	mutex_unlock(&ctx->mutex);
 	return r;
 }
@@ -1552,7 +1571,7 @@
 
 	if (!CU16(ctx->cmd_table + 4 + 2 * ATOM_CMD_INIT))
 		return 1;
-	ret = amdgpu_atom_execute_table(ctx, ATOM_CMD_INIT, ps);
+	ret = amdgpu_atom_execute_table(ctx, ATOM_CMD_INIT, ps, 16);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/atom.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/atom.h
@@ -156,7 +156,7 @@
 extern int amdgpu_atom_debug;
 
 struct atom_context *amdgpu_atom_parse(struct card_info *card, void *bios);
-int amdgpu_atom_execute_table(struct atom_context *ctx, int index, uint32_t *params);
+int amdgpu_atom_execute_table(struct atom_context *ctx, int index, uint32_t *params, int params_size);
 int amdgpu_atom_asic_init(struct atom_context *ctx);
 void amdgpu_atom_destroy(struct atom_context *ctx);
 bool amdgpu_atom_parse_data_header(struct atom_context *ctx, int index, uint16_t *size,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
@@ -77,7 +77,7 @@
 		args.usOverscanTop = cpu_to_le16(amdgpu_crtc->v_border);
 		break;
 	}
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void amdgpu_atombios_crtc_scaler_setup(struct drm_crtc *crtc)
@@ -106,7 +106,7 @@
 		args.ucEnable = ATOM_SCALER_DISABLE;
 		break;
 	}
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void amdgpu_atombios_crtc_lock(struct drm_crtc *crtc, int lock)
@@ -123,7 +123,7 @@
 	args.ucCRTC = amdgpu_crtc->crtc_id;
 	args.ucEnable = lock;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void amdgpu_atombios_crtc_enable(struct drm_crtc *crtc, int state)
@@ -139,7 +139,7 @@
 	args.ucCRTC = amdgpu_crtc->crtc_id;
 	args.ucEnable = state;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void amdgpu_atombios_crtc_blank(struct drm_crtc *crtc, int state)
@@ -155,7 +155,7 @@
 	args.ucCRTC = amdgpu_crtc->crtc_id;
 	args.ucBlanking = state;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state)
@@ -171,7 +171,7 @@
 	args.ucDispPipeId = amdgpu_crtc->crtc_id;
 	args.ucEnable = state;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void amdgpu_atombios_crtc_powergate_init(struct amdgpu_device *adev)
@@ -183,7 +183,7 @@
 
 	args.ucEnable = ATOM_INIT;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void amdgpu_atombios_crtc_set_dtd_timing(struct drm_crtc *crtc,
@@ -228,7 +228,7 @@
 	args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
 	args.ucCRTC = amdgpu_crtc->crtc_id;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 union atom_enable_ss {
@@ -293,7 +293,7 @@
 	args.v3.usSpreadSpectrumStep = cpu_to_le16(ss->step);
 	args.v3.ucEnable = enable;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 union adjust_pixel_clock {
@@ -395,7 +395,7 @@
 					ADJUST_DISPLAY_CONFIG_SS_ENABLE;
 
 			amdgpu_atom_execute_table(adev->mode_info.atom_context,
-					   index, (uint32_t *)&args);
+					   index, (uint32_t *)&args, sizeof(args));
 			adjusted_clock = le16_to_cpu(args.v1.usPixelClock) * 10;
 			break;
 		case 3:
@@ -428,7 +428,7 @@
 				args.v3.sInput.ucExtTransmitterID = 0;
 
 			amdgpu_atom_execute_table(adev->mode_info.atom_context,
-					   index, (uint32_t *)&args);
+					   index, (uint32_t *)&args, sizeof(args));
 			adjusted_clock = le32_to_cpu(args.v3.sOutput.ulDispPllFreq) * 10;
 			if (args.v3.sOutput.ucRefDiv) {
 				amdgpu_crtc->pll_flags |= AMDGPU_PLL_USE_FRAC_FB_DIV;
@@ -514,7 +514,7 @@
 		DRM_ERROR("Unknown table version %d %d\n", frev, crev);
 		return;
 	}
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 union set_dce_clock {
@@ -544,7 +544,7 @@
 			args.v2_1.asParam.ulDCEClkFreq = cpu_to_le32(freq); /* 10kHz units */
 			args.v2_1.asParam.ucDCEClkType = clk_type;
 			args.v2_1.asParam.ucDCEClkSrc = clk_src;
-			amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+			amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 			ret_freq = le32_to_cpu(args.v2_1.asParam.ulDCEClkFreq) * 10;
 			break;
 		default:
@@ -740,7 +740,7 @@
 		return;
 	}
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 int amdgpu_atombios_crtc_prepare_pll(struct drm_crtc *crtc,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/atombios_dp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/atombios_dp.c
@@ -83,7 +83,7 @@
 	args.v2.ucDelay = delay / 10;
 	args.v2.ucHPD_ID = chan->rec.hpd;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
 	*ack = args.v2.ucReplyStatus;
 
@@ -301,7 +301,7 @@
 	args.ucLaneNum = lane_num;
 	args.ucStatus = 0;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 	return args.ucStatus;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
@@ -335,7 +335,7 @@
 	args.ucDacStandard = ATOM_DAC1_PS2;
 	args.usPixelClock = cpu_to_le16(amdgpu_encoder->pixel_clock / 10);
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
 }
 
@@ -432,7 +432,7 @@
 		break;
 	}
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 int amdgpu_atombios_encoder_get_encoder_mode(struct drm_encoder *encoder)
@@ -732,7 +732,7 @@
 		break;
 	}
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
 }
 
@@ -1136,7 +1136,7 @@
 		break;
 	}
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 bool
@@ -1164,7 +1164,7 @@
 
 	args.v1.ucAction = action;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
 	/* wait for the panel to power up */
 	if (action == ATOM_TRANSMITTER_ACTION_POWER_ON) {
@@ -1288,7 +1288,7 @@
 		DRM_ERROR("Unknown table version: %d, %d\n", frev, crev);
 		return;
 	}
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static void
@@ -1633,7 +1633,7 @@
 		return;
 	}
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 /* This only needs to be called once at startup */
@@ -1706,7 +1706,7 @@
 				args.sDacload.ucMisc = DAC_LOAD_MISC_YPrPb;
 		}
 
-		amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+		amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
 		return true;
 	} else
@@ -2065,26 +2065,29 @@
 					fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;
 					if (fake_edid_record->ucFakeEDIDLength) {
 						struct edid *edid;
-						int edid_size =
-							max((int)EDID_LENGTH, (int)fake_edid_record->ucFakeEDIDLength);
-						edid = kmalloc(edid_size, GFP_KERNEL);
-						if (edid) {
-							memcpy((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0],
-							       fake_edid_record->ucFakeEDIDLength);
+						int edid_size;
 
+						if (fake_edid_record->ucFakeEDIDLength == 128)
+							edid_size = fake_edid_record->ucFakeEDIDLength;
+						else
+							edid_size = fake_edid_record->ucFakeEDIDLength * 128;
+						edid = kmemdup(&fake_edid_record->ucFakeEDIDString[0],
+							       edid_size, GFP_KERNEL);
+						if (edid) {
 							if (drm_edid_is_valid(edid)) {
 								adev->mode_info.bios_hardcoded_edid = edid;
 								adev->mode_info.bios_hardcoded_edid_size = edid_size;
-							} else
+							} else {
 								kfree(edid);
+							}
 						}
+						record += struct_size(fake_edid_record,
+								      ucFakeEDIDString,
+								      edid_size);
+					} else {
+						/* empty fake edid record must be 3 bytes long */
+						record += sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
 					}
-					record += fake_edid_record->ucFakeEDIDLength ?
-						  struct_size(fake_edid_record,
-							      ucFakeEDIDString,
-							      fake_edid_record->ucFakeEDIDLength) :
-						  /* empty fake edid record must be 3 bytes long */
-						  sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
 					break;
 				case LCD_PANEL_RESOLUTION_RECORD_TYPE:
 					panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/atombios_i2c.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/atombios_i2c.c
@@ -86,7 +86,7 @@
 	args.ucSlaveAddr = slave_addr << 1;
 	args.ucLineNumber = chan->rec.i2c_id;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
 	/* error */
 	if (args.ucStatus != HW_ASSISTED_I2C_STATUS_SUCCESS) {
@@ -172,5 +172,5 @@
 	args.ucSlaveAddr = slave_addr;
 	args.ucLineNumber = line_number;
 
-	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+	amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/df_v1_7.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/df_v1_7.c
@@ -70,6 +70,8 @@
 	int fb_channel_number;
 
 	fb_channel_number = adev->df.funcs->get_fb_channel_number(adev);
+	if (fb_channel_number >= ARRAY_SIZE(df_v1_7_channel_number))
+		fb_channel_number = 0;
 
 	return df_v1_7_channel_number[fb_channel_number];
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -8792,7 +8792,9 @@
 	value = REG_SET_FIELD(value, SQ_CMD, MODE, 0x01);
 	value = REG_SET_FIELD(value, SQ_CMD, CHECK_VMID, 1);
 	value = REG_SET_FIELD(value, SQ_CMD, VM_ID, vmid);
+	amdgpu_gfx_rlc_enter_safe_mode(adev, 0);
 	WREG32_SOC15(GC, 0, mmSQ_CMD, value);
+	amdgpu_gfx_rlc_exit_safe_mode(adev, 0);
 }
 
 static void
@@ -9194,7 +9196,7 @@
 		7 + /* PIPELINE_SYNC */
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 +
-		2 + /* VM_FLUSH */
+		4 + /* VM_FLUSH */
 		8 + /* FENCE for VM_FLUSH */
 		20 + /* GDS switch */
 		4 + /* double SWITCH_BUFFER,
@@ -9285,7 +9287,6 @@
 		7 + /* gfx_v10_0_ring_emit_pipeline_sync */
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 +
-		2 + /* gfx_v10_0_ring_emit_vm_flush */
 		8 + 8 + 8, /* gfx_v10_0_ring_emit_fence_kiq x3 for user fence, vm fence */
 	.emit_ib_size =	7, /* gfx_v10_0_ring_emit_ib_compute */
 	.emit_ib = gfx_v10_0_ring_emit_ib_compute,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -1630,7 +1630,7 @@
 			active_rb_bitmap |= (0x3 << (i * rb_bitmap_width_per_sa));
 	}
 
-	active_rb_bitmap |= global_active_rb_bitmap;
+	active_rb_bitmap &= global_active_rb_bitmap;
 	adev->gfx.config.backend_enable_mask = active_rb_bitmap;
 	adev->gfx.config.num_rbs = hweight32(active_rb_bitmap);
 }
@@ -4287,11 +4287,11 @@
 			/* RLC autoload sequence 1: Program rlc ram */
 			if (adev->gfx.imu.funcs->program_rlc_ram)
 				adev->gfx.imu.funcs->program_rlc_ram(adev);
+			/* rlc autoload firmware */
+			r = gfx_v11_0_rlc_backdoor_autoload_enable(adev);
+			if (r)
+				return r;
 		}
-		/* rlc autoload firmware */
-		r = gfx_v11_0_rlc_backdoor_autoload_enable(adev);
-		if (r)
-			return r;
 	} else {
 		if (adev->firmware.load_type == AMDGPU_FW_LOAD_DIRECT) {
 			if (adev->gfx.imu.funcs && (amdgpu_dpm > 0)) {
@@ -4491,6 +4491,8 @@
 	int r, i, j, k;
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+	gfx_v11_0_set_safe_mode(adev, 0);
+
 	tmp = RREG32_SOC15(GC, 0, regCP_INT_CNTL);
 	tmp = REG_SET_FIELD(tmp, CP_INT_CNTL, CMP_BUSY_INT_ENABLE, 0);
 	tmp = REG_SET_FIELD(tmp, CP_INT_CNTL, CNTX_BUSY_INT_ENABLE, 0);
@@ -4498,8 +4500,6 @@
 	tmp = REG_SET_FIELD(tmp, CP_INT_CNTL, GFX_IDLE_INT_ENABLE, 0);
 	WREG32_SOC15(GC, 0, regCP_INT_CNTL, tmp);
 
-	gfx_v11_0_set_safe_mode(adev, 0);
-
 	for (i = 0; i < adev->gfx.mec.num_mec; ++i) {
 		for (j = 0; j < adev->gfx.mec.num_queue_per_pipe; j++) {
 			for (k = 0; k < adev->gfx.mec.num_pipe_per_mec; k++) {
@@ -5716,7 +5716,9 @@
 	value = REG_SET_FIELD(value, SQ_CMD, MODE, 0x01);
 	value = REG_SET_FIELD(value, SQ_CMD, CHECK_VMID, 1);
 	value = REG_SET_FIELD(value, SQ_CMD, VM_ID, vmid);
+	amdgpu_gfx_rlc_enter_safe_mode(adev, 0);
 	WREG32_SOC15(GC, 0, regSQ_CMD, value);
+	amdgpu_gfx_rlc_exit_safe_mode(adev, 0);
 }
 
 static void
@@ -6110,7 +6112,7 @@
 		7 + /* PIPELINE_SYNC */
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 +
-		2 + /* VM_FLUSH */
+		4 + /* VM_FLUSH */
 		8 + /* FENCE for VM_FLUSH */
 		20 + /* GDS switch */
 		5 + /* COND_EXEC */
@@ -6195,7 +6197,6 @@
 		7 + /* gfx_v11_0_ring_emit_pipeline_sync */
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 +
-		2 + /* gfx_v11_0_ring_emit_vm_flush */
 		8 + 8 + 8, /* gfx_v11_0_ring_emit_fence_kiq x3 for user fence, vm fence */
 	.emit_ib_size =	7, /* gfx_v11_0_ring_emit_ib_compute */
 	.emit_ib = gfx_v11_0_ring_emit_ib_compute,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -1172,6 +1172,10 @@
 	{ 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc6 },
 	/* Apple MacBook Pro (15-inch, 2019) Radeon Pro Vega 20 4 GB */
 	{ 0x1002, 0x69af, 0x106b, 0x019a, 0xc0 },
+	/* https://bbs.openkylin.top/t/topic/171497 */
+	{ 0x1002, 0x15d8, 0x19e5, 0x3e14, 0xc2 },
+	/* HP 705G4 DM with R5 2400G */
+	{ 0x1002, 0x15dd, 0x103c, 0x8464, 0xd6 },
 	{ 0, 0, 0, 0, 0 },
 };
 
@@ -2474,7 +2478,7 @@
 	tmp = REG_SET_FIELD(tmp, CP_INT_CNTL_RING0, CNTX_BUSY_INT_ENABLE, enable ? 1 : 0);
 	tmp = REG_SET_FIELD(tmp, CP_INT_CNTL_RING0, CNTX_EMPTY_INT_ENABLE, enable ? 1 : 0);
 	tmp = REG_SET_FIELD(tmp, CP_INT_CNTL_RING0, CMP_BUSY_INT_ENABLE, enable ? 1 : 0);
-	if(adev->gfx.num_gfx_rings)
+	if (adev->gfx.num_gfx_rings)
 		tmp = REG_SET_FIELD(tmp, CP_INT_CNTL_RING0, GFX_IDLE_INT_ENABLE, enable ? 1 : 0);
 
 	WREG32_SOC15(GC, 0, mmCP_INT_CNTL_RING0, tmp);
@@ -5708,7 +5712,9 @@
 	value = REG_SET_FIELD(value, SQ_CMD, MODE, 0x01);
 	value = REG_SET_FIELD(value, SQ_CMD, CHECK_VMID, 1);
 	value = REG_SET_FIELD(value, SQ_CMD, VM_ID, vmid);
+	amdgpu_gfx_rlc_enter_safe_mode(adev, 0);
 	WREG32_SOC15(GC, 0, mmSQ_CMD, value);
+	amdgpu_gfx_rlc_exit_safe_mode(adev, 0);
 }
 
 static void gfx_v9_0_set_gfx_eop_interrupt_state(struct amdgpu_device *adev,
@@ -5779,17 +5785,59 @@
 	}
 }
 
+static u32 gfx_v9_0_get_cpc_int_cntl(struct amdgpu_device *adev,
+				     int me, int pipe)
+{
+	/*
+	 * amdgpu controls only the first MEC. That's why this function only
+	 * handles the setting of interrupts for this specific MEC. All other
+	 * pipes' interrupts are set by amdkfd.
+	 */
+	if (me != 1)
+		return 0;
+
+	switch (pipe) {
+	case 0:
+		return SOC15_REG_OFFSET(GC, 0, mmCP_ME1_PIPE0_INT_CNTL);
+	case 1:
+		return SOC15_REG_OFFSET(GC, 0, mmCP_ME1_PIPE1_INT_CNTL);
+	case 2:
+		return SOC15_REG_OFFSET(GC, 0, mmCP_ME1_PIPE2_INT_CNTL);
+	case 3:
+		return SOC15_REG_OFFSET(GC, 0, mmCP_ME1_PIPE3_INT_CNTL);
+	default:
+		return 0;
+	}
+}
+
 static int gfx_v9_0_set_priv_reg_fault_state(struct amdgpu_device *adev,
 					     struct amdgpu_irq_src *source,
 					     unsigned type,
 					     enum amdgpu_interrupt_state state)
 {
+	u32 cp_int_cntl_reg, cp_int_cntl;
+	int i, j;
+
 	switch (state) {
 	case AMDGPU_IRQ_STATE_DISABLE:
 	case AMDGPU_IRQ_STATE_ENABLE:
 		WREG32_FIELD15(GC, 0, CP_INT_CNTL_RING0,
 			       PRIV_REG_INT_ENABLE,
 			       state == AMDGPU_IRQ_STATE_ENABLE ? 1 : 0);
+		for (i = 0; i < adev->gfx.mec.num_mec; i++) {
+			for (j = 0; j < adev->gfx.mec.num_pipe_per_mec; j++) {
+				/* MECs start at 1 */
+				cp_int_cntl_reg = gfx_v9_0_get_cpc_int_cntl(adev, i + 1, j);
+
+				if (cp_int_cntl_reg) {
+					cp_int_cntl = RREG32_SOC15_IP(GC, cp_int_cntl_reg);
+					cp_int_cntl = REG_SET_FIELD(cp_int_cntl, CP_ME1_PIPE0_INT_CNTL,
+								    PRIV_REG_INT_ENABLE,
+								    state == AMDGPU_IRQ_STATE_ENABLE ? 1 : 0);
+					WREG32_SOC15_IP(GC, cp_int_cntl_reg, cp_int_cntl);
+				}
+			}
+		}
 		break;
 	default:
 		break;
@@ -6991,7 +7039,6 @@
 		7 + /* gfx_v9_0_ring_emit_pipeline_sync */
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 +
-		2 + /* gfx_v9_0_ring_emit_vm_flush */
 		8 + 8 + 8 + /* gfx_v9_0_ring_emit_fence x3 for user fence, vm fence */
 		7 + /* gfx_v9_0_emit_mem_sync */
 		5 + /* gfx_v9_0_emit_wave_limit for updating mmSPI_WCL_PIPE_PERCENT_GFX register */
@@ -7029,7 +7076,6 @@
 		7 + /* gfx_v9_0_ring_emit_pipeline_sync */
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 5 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 7 +
-		2 + /* gfx_v9_0_ring_emit_vm_flush */
 		8 + 8 + 8, /* gfx_v9_0_ring_emit_fence_kiq x3 for user fence, vm fence */
 	.emit_ib_size =	7, /* gfx_v9_0_ring_emit_ib_compute */
 	.emit_fence = gfx_v9_0_ring_emit_fence_kiq,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
@@ -426,16 +426,16 @@
 
 static int gfx_v9_4_3_init_microcode(struct amdgpu_device *adev)
 {
-	const char *chip_name;
+	char ucode_prefix[15];
 	int r;
 
-	chip_name = "gc_9_4_3";
+	amdgpu_ucode_ip_version_decode(adev, GC_HWIP, ucode_prefix, sizeof(ucode_prefix));
 
-	r = gfx_v9_4_3_init_rlc_microcode(adev, chip_name);
+	r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
 	if (r)
 		return r;
 
-	r = gfx_v9_4_3_init_cp_compute_microcode(adev, chip_name);
+	r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
 	if (r)
 		return r;
 
@@ -2755,21 +2755,63 @@
 	}
 }
 
+static u32 gfx_v9_4_3_get_cpc_int_cntl(struct amdgpu_device *adev,
+				     int xcc_id, int me, int pipe)
+{
+	/*
+	 * amdgpu controls only the first MEC. That's why this function only
+	 * handles the setting of interrupts for this specific MEC. All other
+	 * pipes' interrupts are set by amdkfd.
+	 */
+	if (me != 1)
+		return 0;
+
+	switch (pipe) {
+	case 0:
+		return SOC15_REG_OFFSET(GC, GET_INST(GC, xcc_id), regCP_ME1_PIPE0_INT_CNTL);
+	case 1:
+		return SOC15_REG_OFFSET(GC, GET_INST(GC, xcc_id), regCP_ME1_PIPE1_INT_CNTL);
+	case 2:
+		return SOC15_REG_OFFSET(GC, GET_INST(GC, xcc_id), regCP_ME1_PIPE2_INT_CNTL);
+	case 3:
+		return SOC15_REG_OFFSET(GC, GET_INST(GC, xcc_id), regCP_ME1_PIPE3_INT_CNTL);
+	default:
+		return 0;
+	}
+}
+
 static int gfx_v9_4_3_set_priv_reg_fault_state(struct amdgpu_device *adev,
 					     struct amdgpu_irq_src *source,
 					     unsigned type,
 					     enum amdgpu_interrupt_state state)
 {
-	int i, num_xcc;
+	u32 mec_int_cntl_reg, mec_int_cntl;
+	int i, j, k, num_xcc;
 
 	num_xcc = NUM_XCC(adev->gfx.xcc_mask);
 	switch (state) {
 	case AMDGPU_IRQ_STATE_DISABLE:
 	case AMDGPU_IRQ_STATE_ENABLE:
-		for (i = 0; i < num_xcc; i++)
+		for (i = 0; i < num_xcc; i++) {
 			WREG32_FIELD15_PREREG(GC, GET_INST(GC, i), CP_INT_CNTL_RING0,
-				PRIV_REG_INT_ENABLE,
-				state == AMDGPU_IRQ_STATE_ENABLE ? 1 : 0);
+					      PRIV_REG_INT_ENABLE,
+					      state == AMDGPU_IRQ_STATE_ENABLE ? 1 : 0);
+			for (j = 0; j < adev->gfx.mec.num_mec; j++) {
+				for (k = 0; k < adev->gfx.mec.num_pipe_per_mec; k++) {
+					/* MECs start at 1 */
+					mec_int_cntl_reg = gfx_v9_4_3_get_cpc_int_cntl(adev, i, j + 1, k);
+
+					if (mec_int_cntl_reg) {
+						mec_int_cntl = RREG32_XCC(mec_int_cntl_reg, i);
+						mec_int_cntl = REG_SET_FIELD(mec_int_cntl, CP_ME1_PIPE0_INT_CNTL,
+									     PRIV_REG_INT_ENABLE,
+									     state == AMDGPU_IRQ_STATE_ENABLE ?
+									     1 : 0);
+						WREG32_XCC(mec_int_cntl_reg, mec_int_cntl, i);
+					}
+				}
+			}
+		}
 		break;
 	default:
 		break;
@@ -4121,9 +4163,10 @@
 static int gfx_v9_4_3_get_cu_info(struct amdgpu_device *adev,
 				 struct amdgpu_cu_info *cu_info)
 {
-	int i, j, k, counter, xcc_id, active_cu_number = 0;
-	u32 mask, bitmap, ao_bitmap, ao_cu_mask = 0;
+	int i, j, k, prev_counter, counter, xcc_id, active_cu_number = 0;
+	u32 mask, bitmap, ao_bitmap, ao_cu_mask = 0, tmp;
 	unsigned disable_masks[4 * 4];
+	bool is_symmetric_cus;
 
 	if (!adev || !cu_info)
 		return -EINVAL;
@@ -4141,6 +4184,7 @@
 
 	mutex_lock(&adev->grbm_idx_mutex);
 	for (xcc_id = 0; xcc_id < NUM_XCC(adev->gfx.xcc_mask); xcc_id++) {
+		is_symmetric_cus = true;
 		for (i = 0; i < adev->gfx.config.max_shader_engines; i++) {
 			for (j = 0; j < adev->gfx.config.max_sh_per_se; j++) {
 				mask = 1;
@@ -4168,6 +4212,15 @@
 					ao_cu_mask |= (ao_bitmap << (i * 16 + j * 8));
 				cu_info->ao_cu_bitmap[i][j] = ao_bitmap;
 			}
+			if (i && is_symmetric_cus && prev_counter != counter)
+				is_symmetric_cus = false;
+			prev_counter = counter;
+		}
+		if (is_symmetric_cus) {
+			tmp = RREG32_SOC15(GC, GET_INST(GC, xcc_id), regCP_CPC_DEBUG);
+			tmp = REG_SET_FIELD(tmp, CP_CPC_DEBUG, CPC_HARVESTING_RELAUNCH_DISABLE, 1);
+			tmp = REG_SET_FIELD(tmp, CP_CPC_DEBUG, CPC_HARVESTING_DISPATCH_DISABLE, 1);
+			WREG32_SOC15(GC, GET_INST(GC, xcc_id), regCP_CPC_DEBUG, tmp);
 		}
 		gfx_v9_4_3_xcc_select_se_sh(adev, 0xffffffff, 0xffffffff, 0xffffffff,
 					    xcc_id);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c
@@ -570,6 +570,7 @@
 		adev->mmhub.funcs = &mmhub_v3_0_2_funcs;
 		break;
 	case IP_VERSION(3, 3, 0):
+	case IP_VERSION(3, 3, 1):
 		adev->mmhub.funcs = &mmhub_v3_3_funcs;
 		break;
 	default:
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -1107,8 +1107,10 @@
 					 uint64_t *flags)
 {
 	struct amdgpu_device *bo_adev = amdgpu_ttm_adev(bo->tbo.bdev);
-	bool is_vram = bo->tbo.resource->mem_type == TTM_PL_VRAM;
-	bool coherent = bo->flags & (AMDGPU_GEM_CREATE_COHERENT | AMDGPU_GEM_CREATE_EXT_COHERENT);
+	bool is_vram = bo->tbo.resource &&
+		bo->tbo.resource->mem_type == TTM_PL_VRAM;
+	bool coherent = bo->flags & (AMDGPU_GEM_CREATE_COHERENT |
+				     AMDGPU_GEM_CREATE_EXT_COHERENT);
 	bool ext_coherent = bo->flags & AMDGPU_GEM_CREATE_EXT_COHERENT;
 	bool uncached = bo->flags & AMDGPU_GEM_CREATE_UNCACHED;
 	struct amdgpu_vm *vm = mapping->bo_va->base.vm;
@@ -1116,6 +1118,8 @@
 	bool snoop = false;
 	bool is_local;
 
+	dma_resv_assert_held(bo->tbo.base.resv);
+
 	switch (amdgpu_ip_version(adev, GC_HWIP, 0)) {
 	case IP_VERSION(9, 4, 1):
 	case IP_VERSION(9, 4, 2):
@@ -1233,9 +1237,8 @@
 		*flags &= ~AMDGPU_PTE_VALID;
 	}
 
-	if (bo && bo->tbo.resource)
-		gmc_v9_0_get_coherence_flags(adev, mapping->bo_va->base.bo,
-					     mapping, flags);
+	if ((*flags & AMDGPU_PTE_VALID) && bo)
+		gmc_v9_0_get_coherence_flags(adev, bo, mapping, flags);
 }
 
 static void gmc_v9_0_override_vm_pte_flags(struct amdgpu_device *adev,
@@ -1897,7 +1900,7 @@
 		break;
 	}
 
-	size = adev->gmc.real_vram_size >> AMDGPU_GPU_PAGE_SHIFT;
+	size = (adev->gmc.real_vram_size + SZ_16M) >> AMDGPU_GPU_PAGE_SHIFT;
 	size /= adev->gmc.num_mem_partitions;
 
 	for (i = 0; i < adev->gmc.num_mem_partitions; ++i) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c
@@ -40,10 +40,12 @@
 static void hdp_v4_0_flush_hdp(struct amdgpu_device *adev,
 				struct amdgpu_ring *ring)
 {
-	if (!ring || !ring->funcs->emit_wreg)
-		WREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0);
-	else
+	if (!ring || !ring->funcs->emit_wreg) {
+		WREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0);
+		RREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2);
+	} else {
 		amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0);
+	}
 }
 
 static void hdp_v4_0_invalidate_hdp(struct amdgpu_device *adev,
@@ -53,11 +55,13 @@
 	    amdgpu_ip_version(adev, HDP_HWIP, 0) == IP_VERSION(4, 4, 2))
 		return;
 
-	if (!ring || !ring->funcs->emit_wreg)
+	if (!ring || !ring->funcs->emit_wreg) {
 		WREG32_SOC15_NO_KIQ(HDP, 0, mmHDP_READ_CACHE_INVALIDATE, 1);
-	else
+		RREG32_SOC15_NO_KIQ(HDP, 0, mmHDP_READ_CACHE_INVALIDATE);
+	} else {
 		amdgpu_ring_emit_wreg(ring, SOC15_REG_OFFSET(
 			HDP, 0, mmHDP_READ_CACHE_INVALIDATE), 1);
+	}
 }
 
 static void hdp_v4_0_query_ras_error_count(struct amdgpu_device *adev,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/hdp_v5_0.c
@@ -31,10 +31,12 @@
 static void hdp_v5_0_flush_hdp(struct amdgpu_device *adev,
 				struct amdgpu_ring *ring)
 {
-	if (!ring || !ring->funcs->emit_wreg)
-		WREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0);
-	else
+	if (!ring || !ring->funcs->emit_wreg) {
+		WREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0);
+		RREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2);
+	} else {
 		amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0);
+	}
 }
 
 static void hdp_v5_0_invalidate_hdp(struct amdgpu_device *adev,
@@ -42,6 +44,7 @@
 {
 	if (!ring || !ring->funcs->emit_wreg) {
 		WREG32_SOC15_NO_KIQ(HDP, 0, mmHDP_READ_CACHE_INVALIDATE, 1);
+		RREG32_SOC15_NO_KIQ(HDP, 0, mmHDP_READ_CACHE_INVALIDATE);
 	} else {
 		amdgpu_ring_emit_wreg(ring, SOC15_REG_OFFSET(
 					HDP, 0, mmHDP_READ_CACHE_INVALIDATE), 1);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c
@@ -31,13 +31,15 @@
 static void hdp_v5_2_flush_hdp(struct amdgpu_device *adev,
 				struct amdgpu_ring *ring)
 {
-	if (!ring || !ring->funcs->emit_wreg)
+	if (!ring || !ring->funcs->emit_wreg) {
 		WREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2,
 			0);
-	else
+		RREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2);
+	} else {
 		amdgpu_ring_emit_wreg(ring,
 			(adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2,
 			0);
+	}
 }
 
 static void hdp_v5_2_update_mem_power_gating(struct amdgpu_device *adev,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/hdp_v6_0.c
@@ -34,10 +34,12 @@
 static void hdp_v6_0_flush_hdp(struct amdgpu_device *adev,
 				struct amdgpu_ring *ring)
 {
-	if (!ring || !ring->funcs->emit_wreg)
-		WREG32_NO_KIQ((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0);
-	else
+	if (!ring || !ring->funcs->emit_wreg) {
+		WREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0);
+		RREG32((adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2);
+	} else {
 		amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2, 0);
+	}
 }
 
 static void hdp_v6_0_update_clock_gating(struct amdgpu_device *adev,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/ih_v6_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/ih_v6_0.c
@@ -135,6 +135,34 @@
 
 	tmp = RREG32(ih_regs->ih_rb_cntl);
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, RB_ENABLE, (enable ? 1 : 0));
+
+	if (enable) {
+		/* Unset the CLEAR_OVERFLOW bit to make sure the next step
+		 * is switching the bit from 0 to 1
+		 */
+		tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+		if (amdgpu_sriov_vf(adev) && amdgpu_sriov_reg_indirect_ih(adev)) {
+			if (psp_reg_program(&adev->psp, ih_regs->psp_reg_id, tmp))
+				return -ETIMEDOUT;
+		} else {
+			WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+		}
+
+		/* Clear RB_OVERFLOW bit */
+		tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
+		if (amdgpu_sriov_vf(adev) && amdgpu_sriov_reg_indirect_ih(adev)) {
+			if (psp_reg_program(&adev->psp, ih_regs->psp_reg_id, tmp))
+				return -ETIMEDOUT;
+		} else {
+			WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+		}
+
+		/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+		 * can be detected.
+		 */
+		tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	}
+
 	/* enable_intr field is only valid in ring0 */
 	if (ih == &adev->irq.ih)
 		tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, ENABLE_INTR, (enable ? 1 : 0));
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
@@ -23,6 +23,7 @@
 
 #include "amdgpu.h"
 #include "amdgpu_jpeg.h"
+#include "amdgpu_cs.h"
 #include "soc15.h"
 #include "soc15d.h"
 #include "vcn_v1_0.h"
@@ -34,6 +35,9 @@
 static void jpeg_v1_0_set_dec_ring_funcs(struct amdgpu_device *adev);
 static void jpeg_v1_0_set_irq_funcs(struct amdgpu_device *adev);
 static void jpeg_v1_0_ring_begin_use(struct amdgpu_ring *ring);
+static int jpeg_v1_dec_ring_parse_cs(struct amdgpu_cs_parser *parser,
+				     struct amdgpu_job *job,
+				     struct amdgpu_ib *ib);
 
 static void jpeg_v1_0_decode_ring_patch_wreg(struct amdgpu_ring *ring, uint32_t *ptr, uint32_t reg_offset, uint32_t val)
 {
@@ -300,7 +304,10 @@
 
 	amdgpu_ring_write(ring,
 		PACKETJ(SOC15_REG_OFFSET(JPEG, 0, mmUVD_LMI_JRBC_IB_VMID), 0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, (vmid | (vmid << 4)));
+	if (ring->funcs->parse_cs)
+		amdgpu_ring_write(ring, 0);
+	else
+		amdgpu_ring_write(ring, (vmid | (vmid << 4)));
 
 	amdgpu_ring_write(ring,
 		PACKETJ(SOC15_REG_OFFSET(JPEG, 0, mmUVD_LMI_JPEG_VMID), 0, 0, PACKETJ_TYPE0));
@@ -554,6 +561,7 @@
 	.get_rptr = jpeg_v1_0_decode_ring_get_rptr,
 	.get_wptr = jpeg_v1_0_decode_ring_get_wptr,
 	.set_wptr = jpeg_v1_0_decode_ring_set_wptr,
+	.parse_cs = jpeg_v1_dec_ring_parse_cs,
 	.emit_frame_size =
 		6 + 6 + /* hdp invalidate / flush */
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
@@ -612,3 +620,69 @@
 
 	vcn_v1_0_set_pg_for_begin_use(ring, set_clocks);
 }
+
+/**
+ * jpeg_v1_dec_ring_parse_cs - command submission parser
+ *
+ * @parser: Command submission parser context
+ * @job: the job to parse
+ * @ib: the IB to parse
+ *
+ * Parse the command stream, return -EINVAL for invalid packet,
+ * 0 otherwise
+ */
+static int jpeg_v1_dec_ring_parse_cs(struct amdgpu_cs_parser *parser,
+				     struct amdgpu_job *job,
+				     struct amdgpu_ib *ib)
+{
+	u32 i, reg, res, cond, type;
+	int ret = 0;
+	struct amdgpu_device *adev = parser->adev;
+
+	for (i = 0; i < ib->length_dw ; i += 2) {
+		reg  = CP_PACKETJ_GET_REG(ib->ptr[i]);
+		res  = CP_PACKETJ_GET_RES(ib->ptr[i]);
+		cond = CP_PACKETJ_GET_COND(ib->ptr[i]);
+		type = CP_PACKETJ_GET_TYPE(ib->ptr[i]);
+
+		if (res || cond != PACKETJ_CONDITION_CHECK0) /* only allow 0 for now */
+			return -EINVAL;
+
+		if (reg >= JPEG_V1_REG_RANGE_START && reg <= JPEG_V1_REG_RANGE_END)
+			continue;
+
+		switch (type) {
+		case PACKETJ_TYPE0:
+			if (reg != JPEG_V1_LMI_JPEG_WRITE_64BIT_BAR_HIGH &&
+			    reg != JPEG_V1_LMI_JPEG_WRITE_64BIT_BAR_LOW &&
+			    reg != JPEG_V1_LMI_JPEG_READ_64BIT_BAR_HIGH &&
+			    reg != JPEG_V1_LMI_JPEG_READ_64BIT_BAR_LOW &&
+			    reg != JPEG_V1_REG_CTX_INDEX &&
+			    reg != JPEG_V1_REG_CTX_DATA) {
+				ret = -EINVAL;
+			}
+			break;
+		case PACKETJ_TYPE1:
+			if (reg != JPEG_V1_REG_CTX_DATA)
+				ret = -EINVAL;
+			break;
+		case PACKETJ_TYPE3:
+			if (reg != JPEG_V1_REG_SOFT_RESET)
+				ret = -EINVAL;
+			break;
+		case PACKETJ_TYPE6:
+			if (ib->ptr[i] != CP_PACKETJ_NOP)
+				ret = -EINVAL;
+			break;
+		default:
+			ret = -EINVAL;
+		}
+
+		if (ret) {
+			dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
+			break;
+		}
+	}
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.h
@@ -29,4 +29,15 @@
 void jpeg_v1_0_sw_fini(void *handle);
 void jpeg_v1_0_start(struct amdgpu_device *adev, int mode);
 
+#define JPEG_V1_REG_RANGE_START	0x8000
+#define JPEG_V1_REG_RANGE_END	0x803f
+
+#define JPEG_V1_LMI_JPEG_WRITE_64BIT_BAR_HIGH	0x8238
+#define JPEG_V1_LMI_JPEG_WRITE_64BIT_BAR_LOW	0x8239
+#define JPEG_V1_LMI_JPEG_READ_64BIT_BAR_HIGH	0x825a
+#define JPEG_V1_LMI_JPEG_READ_64BIT_BAR_LOW	0x825b
+#define JPEG_V1_REG_CTX_INDEX			0x8328
+#define JPEG_V1_REG_CTX_DATA			0x8329
+#define JPEG_V1_REG_SOFT_RESET			0x83a0
+
 #endif /*__JPEG_V1_0_H__*/
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c
@@ -23,6 +23,7 @@
 
 #include "amdgpu.h"
 #include "amdgpu_jpeg.h"
+#include "amdgpu_cs.h"
 #include "amdgpu_pm.h"
 #include "soc15.h"
 #include "soc15d.h"
@@ -543,11 +544,15 @@
 
 	amdgpu_ring_write(ring, PACKETJ(mmUVD_LMI_JRBC_IB_VMID_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, (vmid | (vmid << 4)));
+
+	if (ring->funcs->parse_cs)
+		amdgpu_ring_write(ring, 0);
+	else
+		amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
 
 	amdgpu_ring_write(ring, PACKETJ(mmUVD_LMI_JPEG_VMID_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, (vmid | (vmid << 4)));
+	amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
 
 	amdgpu_ring_write(ring,	PACKETJ(mmUVD_LMI_JRBC_IB_64BIT_BAR_LOW_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
@@ -767,6 +772,7 @@
 	.get_rptr = jpeg_v2_0_dec_ring_get_rptr,
 	.get_wptr = jpeg_v2_0_dec_ring_get_wptr,
 	.set_wptr = jpeg_v2_0_dec_ring_set_wptr,
+	.parse_cs = jpeg_v2_dec_ring_parse_cs,
 	.emit_frame_size =
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
@@ -814,3 +820,58 @@
 		.rev = 0,
 		.funcs = &jpeg_v2_0_ip_funcs,
 };
+
+/**
+ * jpeg_v2_dec_ring_parse_cs - command submission parser
+ *
+ * @parser: Command submission parser context
+ * @job: the job to parse
+ * @ib: the IB to parse
+ *
+ * Parse the command stream, return -EINVAL for invalid packet,
+ * 0 otherwise
+ */
+int jpeg_v2_dec_ring_parse_cs(struct amdgpu_cs_parser *parser,
+			      struct amdgpu_job *job,
+			      struct amdgpu_ib *ib)
+{
+	u32 i, reg, res, cond, type;
+	struct amdgpu_device *adev = parser->adev;
+
+	for (i = 0; i < ib->length_dw ; i += 2) {
+		reg  = CP_PACKETJ_GET_REG(ib->ptr[i]);
+		res  = CP_PACKETJ_GET_RES(ib->ptr[i]);
+		cond = CP_PACKETJ_GET_COND(ib->ptr[i]);
+		type = CP_PACKETJ_GET_TYPE(ib->ptr[i]);
+
+		if (res) /* only support 0 at the moment */
+			return -EINVAL;
+
+		switch (type) {
+		case PACKETJ_TYPE0:
+			if (cond != PACKETJ_CONDITION_CHECK0 || reg < JPEG_REG_RANGE_START ||
+			    reg > JPEG_REG_RANGE_END) {
+				dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
+				return -EINVAL;
+			}
+			break;
+		case PACKETJ_TYPE3:
+			if (cond != PACKETJ_CONDITION_CHECK3 || reg < JPEG_REG_RANGE_START ||
+			    reg > JPEG_REG_RANGE_END) {
+				dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
+				return -EINVAL;
+			}
+			break;
+		case PACKETJ_TYPE6:
+			if (ib->ptr[i] == CP_PACKETJ_NOP)
+				continue;
+			dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
+			return -EINVAL;
+		default:
+			dev_err(adev->dev, "Unknown packet type %d !\n", type);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.h
@@ -45,6 +45,9 @@
 
 #define JRBC_DEC_EXTERNAL_REG_WRITE_ADDR				0x18000
 
+#define JPEG_REG_RANGE_START						0x4000
+#define JPEG_REG_RANGE_END						0x41c2
+
 void jpeg_v2_0_dec_ring_insert_start(struct amdgpu_ring *ring);
 void jpeg_v2_0_dec_ring_insert_end(struct amdgpu_ring *ring);
 void jpeg_v2_0_dec_ring_emit_fence(struct amdgpu_ring *ring, u64 addr, u64 seq,
@@ -57,6 +60,9 @@
 				unsigned vmid, uint64_t pd_addr);
 void jpeg_v2_0_dec_ring_emit_wreg(struct amdgpu_ring *ring, uint32_t reg, uint32_t val);
 void jpeg_v2_0_dec_ring_nop(struct amdgpu_ring *ring, uint32_t count);
+int jpeg_v2_dec_ring_parse_cs(struct amdgpu_cs_parser *parser,
+			      struct amdgpu_job *job,
+			      struct amdgpu_ib *ib);
 
 extern const struct amdgpu_ip_block_version jpeg_v2_0_ip_block;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
@@ -660,6 +660,7 @@
 	.get_rptr = jpeg_v2_5_dec_ring_get_rptr,
 	.get_wptr = jpeg_v2_5_dec_ring_get_wptr,
 	.set_wptr = jpeg_v2_5_dec_ring_set_wptr,
+	.parse_cs = jpeg_v2_dec_ring_parse_cs,
 	.emit_frame_size =
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
@@ -689,6 +690,7 @@
 	.get_rptr = jpeg_v2_5_dec_ring_get_rptr,
 	.get_wptr = jpeg_v2_5_dec_ring_get_wptr,
 	.set_wptr = jpeg_v2_5_dec_ring_set_wptr,
+	.parse_cs = jpeg_v2_dec_ring_parse_cs,
 	.emit_frame_size =
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c
@@ -565,6 +565,7 @@
 	.get_rptr = jpeg_v3_0_dec_ring_get_rptr,
 	.get_wptr = jpeg_v3_0_dec_ring_get_wptr,
 	.set_wptr = jpeg_v3_0_dec_ring_set_wptr,
+	.parse_cs = jpeg_v2_dec_ring_parse_cs,
 	.emit_frame_size =
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0.c
@@ -727,6 +727,7 @@
 	.get_rptr = jpeg_v4_0_dec_ring_get_rptr,
 	.get_wptr = jpeg_v4_0_dec_ring_get_wptr,
 	.set_wptr = jpeg_v4_0_dec_ring_set_wptr,
+	.parse_cs = jpeg_v2_dec_ring_parse_cs,
 	.emit_frame_size =
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0.h
@@ -32,5 +32,4 @@
 };
 
 extern const struct amdgpu_ip_block_version jpeg_v4_0_ip_block;
-
 #endif /* __JPEG_V4_0_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
@@ -25,6 +25,7 @@
 #include "amdgpu_jpeg.h"
 #include "soc15.h"
 #include "soc15d.h"
+#include "jpeg_v2_0.h"
 #include "jpeg_v4_0_3.h"
 #include "mmsch_v4_0_3.h"
 
@@ -658,11 +659,12 @@
 		amdgpu_ring_write(ring, PACKETJ(regUVD_JRBC_EXTERNAL_REG_INTERNAL_OFFSET,
 			0, 0, PACKETJ_TYPE0));
 		amdgpu_ring_write(ring, 0x62a04); /* PCTL0_MMHUB_DEEPSLEEP_IB */
-	}
 
-	amdgpu_ring_write(ring, PACKETJ(JRBC_DEC_EXTERNAL_REG_WRITE_ADDR,
-		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, 0x80004000);
+		amdgpu_ring_write(ring,
+				  PACKETJ(JRBC_DEC_EXTERNAL_REG_WRITE_ADDR, 0,
+					  0, PACKETJ_TYPE0));
+		amdgpu_ring_write(ring, 0x80004000);
+	}
 }
 
 /**
@@ -678,11 +680,12 @@
 		amdgpu_ring_write(ring, PACKETJ(regUVD_JRBC_EXTERNAL_REG_INTERNAL_OFFSET,
 			0, 0, PACKETJ_TYPE0));
 		amdgpu_ring_write(ring, 0x62a04);
-	}
 
-	amdgpu_ring_write(ring, PACKETJ(JRBC_DEC_EXTERNAL_REG_WRITE_ADDR,
-		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, 0x00004000);
+		amdgpu_ring_write(ring,
+				  PACKETJ(JRBC_DEC_EXTERNAL_REG_WRITE_ADDR, 0,
+					  0, PACKETJ_TYPE0));
+		amdgpu_ring_write(ring, 0x00004000);
+	}
 }
 
 /**
@@ -773,11 +776,15 @@
 
 	amdgpu_ring_write(ring, PACKETJ(regUVD_LMI_JRBC_IB_VMID_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, (vmid | (vmid << 4)));
+
+	if (ring->funcs->parse_cs)
+		amdgpu_ring_write(ring, 0);
+	else
+		amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
 
 	amdgpu_ring_write(ring, PACKETJ(regUVD_LMI_JPEG_VMID_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, (vmid | (vmid << 4)));
+	amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
 
 	amdgpu_ring_write(ring,	PACKETJ(regUVD_LMI_JRBC_IB_64BIT_BAR_LOW_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
@@ -1061,6 +1068,7 @@
 	.get_rptr = jpeg_v4_0_3_dec_ring_get_rptr,
 	.get_wptr = jpeg_v4_0_3_dec_ring_get_wptr,
 	.set_wptr = jpeg_v4_0_3_dec_ring_set_wptr,
+	.parse_cs = jpeg_v2_dec_ring_parse_cs,
 	.emit_frame_size =
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c
@@ -153,7 +153,7 @@
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 	struct amdgpu_ring *ring = adev->jpeg.inst->ring_dec;
-	int r;
+	int r = 0;
 
 	r = amdgpu_ring_test_helper(ring);
 	if (r)
@@ -564,6 +564,7 @@
 	.get_rptr = jpeg_v4_0_5_dec_ring_get_rptr,
 	.get_wptr = jpeg_v4_0_5_dec_ring_get_wptr,
 	.set_wptr = jpeg_v4_0_5_dec_ring_set_wptr,
+	.parse_cs = jpeg_v2_dec_ring_parse_cs,
 	.emit_frame_size =
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c
@@ -544,7 +544,7 @@
 
 static void mmhub_v1_7_get_clockgating(struct amdgpu_device *adev, u64 *flags)
 {
-	int data, data1;
+	u32 data, data1;
 
 	if (amdgpu_sriov_vf(adev))
 		*flags = 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
@@ -671,7 +671,7 @@
 
 static void mmhub_v2_0_get_clockgating(struct amdgpu_device *adev, u64 *flags)
 {
-	int data, data1;
+	u32 data, data1;
 
 	if (amdgpu_sriov_vf(adev))
 		*flags = 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c
@@ -98,16 +98,16 @@
 
 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(3, 3, 0):
-		mmhub_cid = mmhub_client_ids_v3_3[cid][rw];
+	case IP_VERSION(3, 3, 1):
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_3) ?
+			    mmhub_client_ids_v3_3[cid][rw] :
+			    cid == 0x140 ? "UMSCH" : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;
 		break;
 	}
 
-	if (!mmhub_cid && cid == 0x140)
-		mmhub_cid = "UMSCH";
-
 	dev_err(adev->dev, "\t Faulty UTCL2 client ID: %s (0x%x)\n",
 		mmhub_cid ? mmhub_cid : "unknown", cid);
 	dev_err(adev->dev, "\t MORE_FAULTS: 0x%lx\n",
@@ -560,7 +560,7 @@
 
 static void mmhub_v3_3_get_clockgating(struct amdgpu_device *adev, u64 *flags)
 {
-	int data;
+	u32 data;
 
 	if (amdgpu_sriov_vf(adev))
 		*flags = 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c
@@ -657,7 +657,7 @@
 
 static void mmhub_v9_4_get_clockgating(struct amdgpu_device *adev, u64 *flags)
 {
-	int data, data1;
+	u32 data, data1;
 
 	if (amdgpu_sriov_vf(adev))
 		*flags = 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
@@ -290,6 +290,7 @@
 		reset_context.method = AMD_RESET_METHOD_NONE;
 		reset_context.reset_req_dev = adev;
 		clear_bit(AMDGPU_NEED_FULL_RESET, &reset_context.flags);
+		set_bit(AMDGPU_HOST_FLR, &reset_context.flags);
 
 		amdgpu_device_gpu_recover(adev, NULL, &reset_context);
 	}
@@ -317,7 +318,7 @@
 
 	switch (event) {
 		case IDH_FLR_NOTIFICATION:
-		if (amdgpu_sriov_runtime(adev) && !amdgpu_in_reset(adev))
+		if (amdgpu_sriov_runtime(adev))
 			WARN_ONCE(!amdgpu_reset_domain_schedule(adev->reset_domain,
 								&adev->virt.flr_work),
 				  "Failed to queue work! at %s",
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
@@ -315,6 +315,7 @@
 		reset_context.method = AMD_RESET_METHOD_NONE;
 		reset_context.reset_req_dev = adev;
 		clear_bit(AMDGPU_NEED_FULL_RESET, &reset_context.flags);
+		set_bit(AMDGPU_HOST_FLR, &reset_context.flags);
 
 		amdgpu_device_gpu_recover(adev, NULL, &reset_context);
 	}
@@ -345,7 +346,7 @@
 
 	switch (event) {
 	case IDH_FLR_NOTIFICATION:
-		if (amdgpu_sriov_runtime(adev) && !amdgpu_in_reset(adev))
+		if (amdgpu_sriov_runtime(adev))
 			WARN_ONCE(!amdgpu_reset_domain_schedule(adev->reset_domain,
 				   &adev->virt.flr_work),
 				  "Failed to queue work! at %s",
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/mxgpu_vi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/mxgpu_vi.c
@@ -529,6 +529,7 @@
 		reset_context.method = AMD_RESET_METHOD_NONE;
 		reset_context.reset_req_dev = adev;
 		clear_bit(AMDGPU_NEED_FULL_RESET, &reset_context.flags);
+		set_bit(AMDGPU_HOST_FLR, &reset_context.flags);
 
 		amdgpu_device_gpu_recover(adev, NULL, &reset_context);
 	}
@@ -560,7 +561,7 @@
 		r = xgpu_vi_mailbox_rcv_msg(adev, IDH_FLR_NOTIFICATION);
 
 		/* only handle FLR_NOTIFY now */
-		if (!r && !amdgpu_in_reset(adev))
+		if (!r)
 			WARN_ONCE(!amdgpu_reset_domain_schedule(adev->reset_domain,
 								&adev->virt.flr_work),
 				  "Failed to queue work! at %s",
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c
@@ -270,6 +270,15 @@
 	if (def != data)
 		WREG32_SOC15(NBIO, 0, regBIF_BIF256_CI256_RC3X4_USB4_PCIE_MST_CTRL_3, data);
 
+	switch (amdgpu_ip_version(adev, NBIO_HWIP, 0)) {
+	case IP_VERSION(7, 11, 0):
+	case IP_VERSION(7, 11, 1):
+	case IP_VERSION(7, 11, 2):
+	case IP_VERSION(7, 11, 3):
+		data = RREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF5_STRAP4) & ~BIT(23);
+		WREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF5_STRAP4, data);
+		break;
+	}
 }
 
 static void nbio_v7_11_update_medium_grain_clock_gating(struct amdgpu_device *adev,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
@@ -387,7 +387,7 @@
 		else
 			WREG32_SOC15(NBIO, 0, mmBIF_DOORBELL_INT_CNTL, bif_doorbell_intr_cntl);
 
-		if (!ras->disable_ras_err_cnt_harvest) {
+		if (ras && !ras->disable_ras_err_cnt_harvest && obj) {
 			/*
 			 * clear error status after ras_controller_intr
 			 * according to hw team and count ue number
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/nbio_v7_7.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/nbio_v7_7.c
@@ -247,6 +247,12 @@
 	if (def != data)
 		WREG32_SOC15(NBIO, 0, regBIF0_PCIE_MST_CTRL_3, data);
 
+	switch (amdgpu_ip_version(adev, NBIO_HWIP, 0)) {
+	case IP_VERSION(7, 7, 0):
+		data = RREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF5_STRAP4) & ~BIT(23);
+		WREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF5_STRAP4, data);
+		break;
+	}
 }
 
 static void nbio_v7_7_update_medium_grain_clock_gating(struct amdgpu_device *adev,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/nv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/nv.c
@@ -68,8 +68,8 @@
 
 /* Navi */
 static const struct amdgpu_video_codec_info nv_video_codecs_encode_array[] = {
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 0)},
 };
 
 static const struct amdgpu_video_codecs nv_video_codecs_encode = {
@@ -95,8 +95,8 @@
 
 /* Sienna Cichlid */
 static const struct amdgpu_video_codec_info sc_video_codecs_encode_array[] = {
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2160, 0)},
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 7680, 4352, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 0)},
 };
 
 static const struct amdgpu_video_codecs sc_video_codecs_encode = {
@@ -137,8 +137,8 @@
 
 /* SRIOV Sienna Cichlid, not const since data is controlled by host */
 static struct amdgpu_video_codec_info sriov_sc_video_codecs_encode_array[] = {
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2160, 0)},
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 7680, 4352, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 0)},
 };
 
 static struct amdgpu_video_codec_info sriov_sc_video_codecs_decode_array_vcn0[] = {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
@@ -2017,10 +2017,13 @@
 				      struct amdgpu_irq_src *source,
 				      struct amdgpu_iv_entry *entry)
 {
-	uint32_t instance;
+	int instance;
 
 	DRM_DEBUG("IH: SDMA trap\n");
 	instance = sdma_v4_0_irq_id_to_seq(entry->client_id);
+	if (instance < 0)
+		return instance;
+
 	switch (entry->ring_id) {
 	case 0:
 		amdgpu_fence_process(&adev->sdma.instance[instance].ring);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c
@@ -366,7 +366,8 @@
 	u32 ref_and_mask = 0;
 	const struct nbio_hdp_flush_reg *nbio_hf_reg = adev->nbio.hdp_flush_reg;
 
-	ref_and_mask = nbio_hf_reg->ref_and_mask_sdma0 << ring->me;
+	ref_and_mask = nbio_hf_reg->ref_and_mask_sdma0
+		       << (ring->me % adev->sdma.num_inst_per_aid);
 
 	sdma_v4_4_2_wait_reg_mem(ring, 0, 1,
 			       adev->nbio.funcs->get_hdp_flush_done_offset(adev),
@@ -429,16 +430,11 @@
 	struct amdgpu_ring *sdma[AMDGPU_MAX_SDMA_INSTANCES];
 	u32 doorbell_offset, doorbell;
 	u32 rb_cntl, ib_cntl;
-	int i, unset = 0;
+	int i;
 
 	for_each_inst(i, inst_mask) {
 		sdma[i] = &adev->sdma.instance[i].ring;
 
-		if ((adev->mman.buffer_funcs_ring == sdma[i]) && unset != 1) {
-			amdgpu_ttm_set_buffer_funcs_status(adev, false);
-			unset = 1;
-		}
-
 		rb_cntl = RREG32_SDMA(i, regSDMA_GFX_RB_CNTL);
 		rb_cntl = REG_SET_FIELD(rb_cntl, SDMA_GFX_RB_CNTL, RB_ENABLE, 0);
 		WREG32_SDMA(i, regSDMA_GFX_RB_CNTL, rb_cntl);
@@ -485,20 +481,10 @@
 static void sdma_v4_4_2_inst_page_stop(struct amdgpu_device *adev,
 				       uint32_t inst_mask)
 {
-	struct amdgpu_ring *sdma[AMDGPU_MAX_SDMA_INSTANCES];
 	u32 rb_cntl, ib_cntl;
 	int i;
-	bool unset = false;
 
 	for_each_inst(i, inst_mask) {
-		sdma[i] = &adev->sdma.instance[i].page;
-
-		if ((adev->mman.buffer_funcs_ring == sdma[i]) &&
-			(!unset)) {
-			amdgpu_ttm_set_buffer_funcs_status(adev, false);
-			unset = true;
-		}
-
 		rb_cntl = RREG32_SDMA(i, regSDMA_PAGE_RB_CNTL);
 		rb_cntl = REG_SET_FIELD(rb_cntl, SDMA_PAGE_RB_CNTL,
 					RB_ENABLE, 0);
@@ -948,13 +934,7 @@
 			r = amdgpu_ring_test_helper(page);
 			if (r)
 				return r;
-
-			if (adev->mman.buffer_funcs_ring == page)
-				amdgpu_ttm_set_buffer_funcs_status(adev, true);
 		}
-
-		if (adev->mman.buffer_funcs_ring == ring)
-			amdgpu_ttm_set_buffer_funcs_status(adev, true);
 	}
 
 	return r;
@@ -1621,19 +1601,9 @@
 	u32 sdma_cntl;
 
 	sdma_cntl = RREG32_SDMA(type, regSDMA_CNTL);
-	switch (state) {
-	case AMDGPU_IRQ_STATE_DISABLE:
-		sdma_cntl = REG_SET_FIELD(sdma_cntl, SDMA_CNTL,
-					  DRAM_ECC_INT_ENABLE, 0);
-		WREG32_SDMA(type, regSDMA_CNTL, sdma_cntl);
-		break;
-	/* sdma ecc interrupt is enabled by default
-	 * driver doesn't need to do anything to
-	 * enable the interrupt */
-	case AMDGPU_IRQ_STATE_ENABLE:
-	default:
-		break;
-	}
+	sdma_cntl = REG_SET_FIELD(sdma_cntl, SDMA_CNTL, DRAM_ECC_INT_ENABLE,
+					state == AMDGPU_IRQ_STATE_ENABLE ? 1 : 0);
+	WREG32_SDMA(type, regSDMA_CNTL, sdma_cntl);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
@@ -188,6 +188,16 @@
 		DRM_DEBUG("calling WDOORBELL64(0x%08x, 0x%016llx)\n",
 				ring->doorbell_index, ring->wptr << 2);
 		WDOORBELL64(ring->doorbell_index, ring->wptr << 2);
+		if (amdgpu_ip_version(adev, SDMA0_HWIP, 0) == IP_VERSION(5, 2, 1)) {
+			/* SDMA seems to miss doorbells sometimes when powergating kicks in.
+			 * Updating the wptr directly will wake it. This is only safe because
+			 * we disallow gfxoff in begin_use() and then allow it again in end_use().
+			 */
+			WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR),
+			       lower_32_bits(ring->wptr << 2));
+			WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR_HI),
+			       upper_32_bits(ring->wptr << 2));
+		}
 	} else {
 		DRM_DEBUG("Not using doorbell -- "
 				"mmSDMA%i_GFX_RB_WPTR == 0x%08x "
@@ -292,17 +302,21 @@
 	u32 ref_and_mask = 0;
 	const struct nbio_hdp_flush_reg *nbio_hf_reg = adev->nbio.hdp_flush_reg;
 
-	ref_and_mask = nbio_hf_reg->ref_and_mask_sdma0 << ring->me;
+	if (ring->me > 1) {
+		amdgpu_asic_flush_hdp(adev, ring);
+	} else {
+		ref_and_mask = nbio_hf_reg->ref_and_mask_sdma0 << ring->me;
 
-	amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_POLL_REGMEM) |
-			  SDMA_PKT_POLL_REGMEM_HEADER_HDP_FLUSH(1) |
-			  SDMA_PKT_POLL_REGMEM_HEADER_FUNC(3)); /* == */
-	amdgpu_ring_write(ring, (adev->nbio.funcs->get_hdp_flush_done_offset(adev)) << 2);
-	amdgpu_ring_write(ring, (adev->nbio.funcs->get_hdp_flush_req_offset(adev)) << 2);
-	amdgpu_ring_write(ring, ref_and_mask); /* reference */
-	amdgpu_ring_write(ring, ref_and_mask); /* mask */
-	amdgpu_ring_write(ring, SDMA_PKT_POLL_REGMEM_DW5_RETRY_COUNT(0xfff) |
-			  SDMA_PKT_POLL_REGMEM_DW5_INTERVAL(10)); /* retry count, poll interval */
+		amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_POLL_REGMEM) |
+				  SDMA_PKT_POLL_REGMEM_HEADER_HDP_FLUSH(1) |
+				  SDMA_PKT_POLL_REGMEM_HEADER_FUNC(3)); /* == */
+		amdgpu_ring_write(ring, (adev->nbio.funcs->get_hdp_flush_done_offset(adev)) << 2);
+		amdgpu_ring_write(ring, (adev->nbio.funcs->get_hdp_flush_req_offset(adev)) << 2);
+		amdgpu_ring_write(ring, ref_and_mask); /* reference */
+		amdgpu_ring_write(ring, ref_and_mask); /* mask */
+		amdgpu_ring_write(ring, SDMA_PKT_POLL_REGMEM_DW5_RETRY_COUNT(0xfff) |
+				  SDMA_PKT_POLL_REGMEM_DW5_INTERVAL(10)); /* retry count, poll interval */
+	}
 }
 
 /**
@@ -1654,6 +1668,10 @@
 	 * but it shouldn't hurt for other parts since
 	 * this GFXOFF will be disallowed anyway when SDMA is
 	 * active, this just makes it explicit.
+	 * sdma_v5_2_ring_set_wptr() takes advantage of this
+	 * to update the wptr because sometimes SDMA seems to miss
+	 * doorbells when entering PG.  If you remove this, update
+	 * sdma_v5_2_ring_set_wptr() as well!
 	 */
 	amdgpu_gfx_off_ctrl(adev, false);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/sienna_cichlid.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/sienna_cichlid.c
@@ -92,7 +92,7 @@
 		adev->ip_blocks[i].status.hw = false;
 	}
 
-	return r;
+	return 0;
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/smu_v13_0_10.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/smu_v13_0_10.c
@@ -91,7 +91,7 @@
 		adev->ip_blocks[i].status.hw = false;
 	}
 
-	return r;
+	return 0;
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -90,8 +90,8 @@
 /* Vega, Raven, Arcturus */
 static const struct amdgpu_video_codec_info vega_video_codecs_encode_array[] =
 {
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 0)},
 };
 
 static const struct amdgpu_video_codecs vega_video_codecs_encode =
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/soc15d.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/soc15d.h
@@ -76,6 +76,12 @@
 			 ((cond & 0xF) << 24) |				\
 			 ((type & 0xF) << 28))
 
+#define CP_PACKETJ_NOP		0x60000000
+#define CP_PACKETJ_GET_REG(x)  ((x) & 0x3FFFF)
+#define CP_PACKETJ_GET_RES(x)  (((x) >> 18) & 0x3F)
+#define CP_PACKETJ_GET_COND(x) (((x) >> 24) & 0xF)
+#define CP_PACKETJ_GET_TYPE(x) (((x) >> 28) & 0xF)
+
 /* Packet 3 types */
 #define	PACKET3_NOP					0x10
 #define	PACKET3_SET_BASE				0x11
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/soc21.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/soc21.c
@@ -49,13 +49,13 @@
 
 /* SOC21 */
 static const struct amdgpu_video_codec_info vcn_4_0_0_video_codecs_encode_array_vcn0[] = {
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 0)},
 	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 0)},
 	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)},
 };
 
 static const struct amdgpu_video_codec_info vcn_4_0_0_video_codecs_encode_array_vcn1[] = {
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 0)},
 	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 0)},
 };
 
@@ -96,14 +96,14 @@
 
 /* SRIOV SOC21, not const since data is controlled by host */
 static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_encode_array_vcn0[] = {
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 0)},
 	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)},
 };
 
 static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_encode_array_vcn1[] = {
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 0)},
 };
 
 static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_encode_vcn0 = {
@@ -450,10 +450,8 @@
 {
 	switch (amdgpu_ip_version(adev, GC_HWIP, 0)) {
 	case IP_VERSION(11, 0, 0):
-		return amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__UMC);
 	case IP_VERSION(11, 0, 2):
 	case IP_VERSION(11, 0, 3):
-		return false;
 	default:
 		return true;
 	}
@@ -714,7 +712,10 @@
 			AMD_PG_SUPPORT_VCN |
 			AMD_PG_SUPPORT_JPEG |
 			AMD_PG_SUPPORT_GFX_PG;
-		adev->external_rev_id = adev->rev_id + 0x1;
+		if (adev->rev_id == 0)
+			adev->external_rev_id = 0x1;
+		else
+			adev->external_rev_id = adev->rev_id + 0x10;
 		break;
 	default:
 		/* FIXME: not supported yet */
@@ -832,10 +833,35 @@
 	return soc21_common_hw_fini(adev);
 }
 
+static bool soc21_need_reset_on_resume(struct amdgpu_device *adev)
+{
+	u32 sol_reg1, sol_reg2;
+
+	/* Will reset for the following suspend abort cases.
+	 * 1) Only reset dGPU side.
+	 * 2) S3 suspend got aborted and TOS is active.
+	 */
+	if (!(adev->flags & AMD_IS_APU) && adev->in_s3 &&
+	    !adev->suspend_complete) {
+		sol_reg1 = RREG32_SOC15(MP0, 0, regMP0_SMN_C2PMSG_81);
+		msleep(100);
+		sol_reg2 = RREG32_SOC15(MP0, 0, regMP0_SMN_C2PMSG_81);
+
+		return (sol_reg1 != sol_reg2);
+	}
+
+	return false;
+}
+
 static int soc21_common_resume(void *handle)
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+	if (soc21_need_reset_on_resume(adev)) {
+		dev_info(adev->dev, "S3 suspend aborted, resetting...");
+		soc21_asic_reset(adev);
+	}
+
 	return soc21_common_hw_init(adev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/ta_ras_if.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/ta_ras_if.h
@@ -36,6 +36,9 @@
 	TA_RAS_COMMAND__ENABLE_FEATURES = 0,
 	TA_RAS_COMMAND__DISABLE_FEATURES,
 	TA_RAS_COMMAND__TRIGGER_ERROR,
+	TA_RAS_COMMAND__QUERY_BLOCK_INFO,
+	TA_RAS_COMMAND__QUERY_SUB_BLOCK_INFO,
+	TA_RAS_COMMAND__QUERY_ADDRESS,
 };
 
 enum ta_ras_status {
@@ -105,6 +108,11 @@
 	TA_RAS_ERROR__POISON			= 8,
 };
 
+enum ta_ras_address_type {
+	TA_RAS_MCA_TO_PA,
+	TA_RAS_PA_TO_MCA,
+};
+
 /* Input/output structures for RAS commands */
 /**********************************************************/
 
@@ -133,12 +141,38 @@
 	uint8_t channel_dis_num;
 };
 
+struct ta_ras_mca_addr {
+	uint64_t err_addr;
+	uint32_t ch_inst;
+	uint32_t umc_inst;
+	uint32_t node_inst;
+};
+
+struct ta_ras_phy_addr {
+	uint64_t pa;
+	uint32_t bank;
+	uint32_t channel_idx;
+};
+
+struct ta_ras_query_address_input {
+	enum ta_ras_address_type addr_type;
+	struct ta_ras_mca_addr ma;
+	struct ta_ras_phy_addr pa;
+};
+
 struct ta_ras_output_flags {
 	uint8_t ras_init_success_flag;
 	uint8_t err_inject_switch_disable_flag;
 	uint8_t reg_access_failure_flag;
 };
 
+struct ta_ras_query_address_output {
+	/* don't use the flags here */
+	struct ta_ras_output_flags flags;
+	struct ta_ras_mca_addr ma;
+	struct ta_ras_phy_addr pa;
+};
+
 /* Common input structure for RAS callbacks */
 /**********************************************************/
 union ta_ras_cmd_input {
@@ -146,12 +180,14 @@
 	struct ta_ras_enable_features_input	enable_features;
 	struct ta_ras_disable_features_input	disable_features;
 	struct ta_ras_trigger_error_input	trigger_error;
+	struct ta_ras_query_address_input	address;
 
 	uint32_t reserve_pad[256];
 };
 
 union ta_ras_cmd_output {
 	struct ta_ras_output_flags flags;
+	struct ta_ras_query_address_output address;
 
 	uint32_t reserve_pad[256];
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/umsch_mm_v4_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/umsch_mm_v4_0.c
@@ -225,6 +225,8 @@
 
 	WREG32_SOC15(VCN, 0, regVCN_UMSCH_RB_SIZE, ring->ring_size);
 
+	ring->wptr = 0;
+
 	data = RREG32_SOC15(VCN, 0, regVCN_RB_ENABLE);
 	data &= ~(VCN_RB_ENABLE__AUDIO_RB_EN_MASK);
 	WREG32_SOC15(VCN, 0, regVCN_RB_ENABLE, data);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
@@ -1289,7 +1289,7 @@
 					   struct amdgpu_job *job,
 					   struct amdgpu_ib *ib)
 {
-	struct amdgpu_ring *ring = to_amdgpu_ring(job->base.sched);
+	struct amdgpu_ring *ring = amdgpu_job_ring(job);
 	unsigned i;
 
 	/* No patching necessary for the first instance */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
@@ -77,6 +77,20 @@
 	return amdgpu_vcn_early_init(adev);
 }
 
+static int vcn_v4_0_3_fw_shared_init(struct amdgpu_device *adev, int inst_idx)
+{
+	struct amdgpu_vcn4_fw_shared *fw_shared;
+
+	fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+	fw_shared->present_flag_0 = cpu_to_le32(AMDGPU_FW_SHARED_FLAG_0_UNIFIED_QUEUE);
+	fw_shared->sq.is_enabled = 1;
+
+	if (amdgpu_vcnfw_log)
+		amdgpu_vcn_fwlog_init(&adev->vcn.inst[inst_idx]);
+
+	return 0;
+}
+
 /**
  * vcn_v4_0_3_sw_init - sw init for VCN block
  *
@@ -107,8 +121,6 @@
 		return r;
 
 	for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
-		volatile struct amdgpu_vcn4_fw_shared *fw_shared;
-
 		vcn_inst = GET_INST(VCN, i);
 
 		ring = &adev->vcn.inst[i].ring_enc[0];
@@ -131,12 +143,7 @@
 		if (r)
 			return r;
 
-		fw_shared = adev->vcn.inst[i].fw_shared.cpu_addr;
-		fw_shared->present_flag_0 = cpu_to_le32(AMDGPU_FW_SHARED_FLAG_0_UNIFIED_QUEUE);
-		fw_shared->sq.is_enabled = true;
-
-		if (amdgpu_vcnfw_log)
-			amdgpu_vcn_fwlog_init(&adev->vcn.inst[i]);
+		vcn_v4_0_3_fw_shared_init(adev, i);
 	}
 
 	if (amdgpu_sriov_vf(adev)) {
@@ -221,6 +228,8 @@
 		}
 	} else {
 		for (i = 0; i < adev->vcn.num_vcn_inst; ++i) {
+			struct amdgpu_vcn4_fw_shared *fw_shared;
+
 			vcn_inst = GET_INST(VCN, i);
 			ring = &adev->vcn.inst[i].ring_enc[0];
 
@@ -244,6 +253,11 @@
 					regVCN_RB1_DB_CTRL);
 			}
 
+			/* Re-init fw_shared when RAS fatal error occurred */
+			fw_shared = adev->vcn.inst[i].fw_shared.cpu_addr;
+			if (!fw_shared->sq.is_enabled)
+				vcn_v4_0_3_fw_shared_init(adev, i);
+
 			r = amdgpu_ring_test_helper(ring);
 			if (r)
 				goto done;
@@ -882,6 +896,8 @@
 	for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
 		vcn_inst = GET_INST(VCN, i);
 
+		vcn_v4_0_3_fw_shared_init(adev, vcn_inst);
+
 		memset(&header, 0, sizeof(struct mmsch_v4_0_3_init_header));
 		header.version = MMSCH_VERSION;
 		header.total_size = sizeof(struct mmsch_v4_0_3_init_header) >> 2;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
@@ -1346,170 +1346,6 @@
 	}
 }
 
-static int vcn_v4_0_5_limit_sched(struct amdgpu_cs_parser *p,
-				struct amdgpu_job *job)
-{
-	struct drm_gpu_scheduler **scheds;
-
-	/* The create msg must be in the first IB submitted */
-	if (atomic_read(&job->base.entity->fence_seq))
-		return -EINVAL;
-
-	/* if VCN0 is harvested, we can't support AV1 */
-	if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)
-		return -EINVAL;
-
-	scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_ENC]
-		[AMDGPU_RING_PRIO_0].sched;
-	drm_sched_entity_modify_sched(job->base.entity, scheds, 1);
-	return 0;
-}
-
-static int vcn_v4_0_5_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job,
-			    uint64_t addr)
-{
-	struct ttm_operation_ctx ctx = { false, false };
-	struct amdgpu_bo_va_mapping *map;
-	uint32_t *msg, num_buffers;
-	struct amdgpu_bo *bo;
-	uint64_t start, end;
-	unsigned int i;
-	void *ptr;
-	int r;
-
-	addr &= AMDGPU_GMC_HOLE_MASK;
-	r = amdgpu_cs_find_mapping(p, addr, &bo, &map);
-	if (r) {
-		DRM_ERROR("Can't find BO for addr 0x%08llx\n", addr);
-		return r;
-	}
-
-	start = map->start * AMDGPU_GPU_PAGE_SIZE;
-	end = (map->last + 1) * AMDGPU_GPU_PAGE_SIZE;
-	if (addr & 0x7) {
-		DRM_ERROR("VCN messages must be 8 byte aligned!\n");
-		return -EINVAL;
-	}
-
-	bo->flags |= AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
-	amdgpu_bo_placement_from_domain(bo, bo->allowed_domains);
-	r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
-	if (r) {
-		DRM_ERROR("Failed validating the VCN message BO (%d)!\n", r);
-		return r;
-	}
-
-	r = amdgpu_bo_kmap(bo, &ptr);
-	if (r) {
-		DRM_ERROR("Failed mapping the VCN message (%d)!\n", r);
-		return r;
-	}
-
-	msg = ptr + addr - start;
-
-	/* Check length */
-	if (msg[1] > end - addr) {
-		r = -EINVAL;
-		goto out;
-	}
-
-	if (msg[3] != RDECODE_MSG_CREATE)
-		goto out;
-
-	num_buffers = msg[2];
-	for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {
-		uint32_t offset, size, *create;
-
-		if (msg[0] != RDECODE_MESSAGE_CREATE)
-			continue;
-
-		offset = msg[1];
-		size = msg[2];
-
-		if (offset + size > end) {
-			r = -EINVAL;
-			goto out;
-		}
-
-		create = ptr + addr + offset - start;
-
-		/* H264, HEVC and VP9 can run on any instance */
-		if (create[0] == 0x7 || create[0] == 0x10 || create[0] == 0x11)
-			continue;
-
-		r = vcn_v4_0_5_limit_sched(p, job);
-		if (r)
-			goto out;
-	}
-
-out:
-	amdgpu_bo_kunmap(bo);
-	return r;
-}
-
-#define RADEON_VCN_ENGINE_TYPE_ENCODE			(0x00000002)
-#define RADEON_VCN_ENGINE_TYPE_DECODE			(0x00000003)
-
-#define RADEON_VCN_ENGINE_INFO				(0x30000001)
-#define RADEON_VCN_ENGINE_INFO_MAX_OFFSET		16
-
-#define RENCODE_ENCODE_STANDARD_AV1			2
-#define RENCODE_IB_PARAM_SESSION_INIT			0x00000003
-#define RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET	64
-
-/* return the offset in ib if id is found, -1 otherwise
- * to speed up the searching we only search upto max_offset
- */
-static int vcn_v4_0_5_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int max_offset)
-{
-	int i;
-
-	for (i = 0; i < ib->length_dw && i < max_offset && ib->ptr[i] >= 8; i += ib->ptr[i]/4) {
-		if (ib->ptr[i + 1] == id)
-			return i;
-	}
-	return -1;
-}
-
-static int vcn_v4_0_5_ring_patch_cs_in_place(struct amdgpu_cs_parser *p,
-					   struct amdgpu_job *job,
-					   struct amdgpu_ib *ib)
-{
-	struct amdgpu_ring *ring = amdgpu_job_ring(job);
-	struct amdgpu_vcn_decode_buffer *decode_buffer;
-	uint64_t addr;
-	uint32_t val;
-	int idx;
-
-	/* The first instance can decode anything */
-	if (!ring->me)
-		return 0;
-
-	/* RADEON_VCN_ENGINE_INFO is at the top of ib block */
-	idx = vcn_v4_0_5_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO,
-			RADEON_VCN_ENGINE_INFO_MAX_OFFSET);
-	if (idx < 0) /* engine info is missing */
-		return 0;
-
-	val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */
-	if (val == RADEON_VCN_ENGINE_TYPE_DECODE) {
-		decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6];
-
-		if (!(decode_buffer->valid_buf_flag  & 0x1))
-			return 0;
-
-		addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 |
-			decode_buffer->msg_buffer_address_lo;
-		return vcn_v4_0_5_dec_msg(p, job, addr);
-	} else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) {
-		idx = vcn_v4_0_5_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT,
-			RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET);
-		if (idx >= 0 && ib->ptr[idx + 2] == RENCODE_ENCODE_STANDARD_AV1)
-			return vcn_v4_0_5_limit_sched(p, job);
-	}
-	return 0;
-}
-
 static const struct amdgpu_ring_funcs vcn_v4_0_5_unified_ring_vm_funcs = {
 	.type = AMDGPU_RING_TYPE_VCN_ENC,
 	.align_mask = 0x3f,
@@ -1517,7 +1353,6 @@
 	.get_rptr = vcn_v4_0_5_unified_ring_get_rptr,
 	.get_wptr = vcn_v4_0_5_unified_ring_get_wptr,
 	.set_wptr = vcn_v4_0_5_unified_ring_set_wptr,
-	.patch_cs_in_place = vcn_v4_0_5_ring_patch_cs_in_place,
 	.emit_frame_size =
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 3 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 4 +
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/vega20_ih.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/vega20_ih.c
@@ -114,6 +114,33 @@
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, RB_ENABLE, (enable ? 1 : 0));
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, RB_GPU_TS_ENABLE, 1);
 
+	if (enable) {
+		/* Unset the CLEAR_OVERFLOW bit to make sure the next step
+		 * is switching the bit from 0 to 1
+		 */
+		tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+		if (amdgpu_sriov_vf(adev) && amdgpu_sriov_reg_indirect_ih(adev)) {
+			if (psp_reg_program(&adev->psp, ih_regs->psp_reg_id, tmp))
+				return -ETIMEDOUT;
+		} else {
+			WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+		}
+
+		/* Clear RB_OVERFLOW bit */
+		tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
+		if (amdgpu_sriov_vf(adev) && amdgpu_sriov_reg_indirect_ih(adev)) {
+			if (psp_reg_program(&adev->psp, ih_regs->psp_reg_id, tmp))
+				return -ETIMEDOUT;
+		} else {
+			WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+		}
+
+		/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+		 * can be detected.
+		 */
+		tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	}
+
 	/* enable_intr field is only valid in ring0 */
 	if (ih == &adev->irq.ih)
 		tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, ENABLE_INTR, (enable ? 1 : 0));
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdgpu/vi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -136,15 +136,15 @@
 	{
 		.codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC,
 		.max_width = 4096,
-		.max_height = 2304,
-		.max_pixels_per_frame = 4096 * 2304,
+		.max_height = 4096,
+		.max_pixels_per_frame = 4096 * 4096,
 		.max_level = 0,
 	},
 	{
 		.codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC,
 		.max_width = 4096,
-		.max_height = 2304,
-		.max_pixels_per_frame = 4096 * 2304,
+		.max_height = 4096,
+		.max_pixels_per_frame = 4096 * 4096,
 		.max_level = 0,
 	},
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -417,7 +417,7 @@
 
 err_create_queue:
 	if (wptr_bo)
-		amdgpu_amdkfd_free_gtt_mem(dev->adev, wptr_bo);
+		amdgpu_amdkfd_free_gtt_mem(dev->adev, (void **)&wptr_bo);
 err_wptr_map_gart:
 err_bind_process:
 err_pdd:
@@ -778,8 +778,8 @@
 	 * nodes, but not more than args->num_of_nodes as that is
 	 * the amount of memory allocated by user
 	 */
-	pa = kzalloc((sizeof(struct kfd_process_device_apertures) *
-				args->num_of_nodes), GFP_KERNEL);
+	pa = kcalloc(args->num_of_nodes, sizeof(struct kfd_process_device_apertures),
+		     GFP_KERNEL);
 	if (!pa)
 		return -ENOMEM;
 
@@ -1138,7 +1138,7 @@
 			goto err_unlock;
 		}
 		offset = dev->adev->rmmio_remap.bus_addr;
-		if (!offset) {
+		if (!offset || (PAGE_SIZE > 4096)) {
 			err = -ENOMEM;
 			goto err_unlock;
 		}
@@ -1164,7 +1164,7 @@
 
 		if (flags & KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM)
 			size >>= 1;
-		WRITE_ONCE(pdd->vram_usage, pdd->vram_usage + PAGE_ALIGN(size));
+		atomic64_add(PAGE_ALIGN(size), &pdd->vram_usage);
 	}
 
 	mutex_unlock(&p->mutex);
@@ -1235,7 +1235,7 @@
 		kfd_process_device_remove_obj_handle(
 			pdd, GET_IDR_HANDLE(args->handle));
 
-	WRITE_ONCE(pdd->vram_usage, pdd->vram_usage - size);
+	atomic64_sub(size, &pdd->vram_usage);
 
 err_unlock:
 err_pdd:
@@ -1522,7 +1522,7 @@
 
 	/* Find a KFD GPU device that supports the get_dmabuf_info query */
 	for (i = 0; kfd_topology_enum_kfd_devices(i, &dev) == 0; i++)
-		if (dev)
+		if (dev && !kfd_devcgroup_check_permission(dev))
 			break;
 	if (!dev)
 		return -EINVAL;
@@ -1544,7 +1544,7 @@
 	if (xcp_id >= 0)
 		args->gpu_id = dmabuf_adev->kfd.dev->nodes[xcp_id]->id;
 	else
-		args->gpu_id = dmabuf_adev->kfd.dev->nodes[0]->id;
+		args->gpu_id = dev->id;
 	args->flags = flags;
 
 	/* Copy metadata buffer to user mode */
@@ -2306,7 +2306,7 @@
 			return -EINVAL;
 		}
 		offset = pdd->dev->adev->rmmio_remap.bus_addr;
-		if (!offset) {
+		if (!offset || (PAGE_SIZE > 4096)) {
 			pr_err("amdgpu_amdkfd_get_mmio_remap_phys_addr failed\n");
 			return -ENOMEM;
 		}
@@ -2345,7 +2345,7 @@
 	} else if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) {
 		bo_bucket->restored_offset = offset;
 		/* Update the VRAM usage count */
-		WRITE_ONCE(pdd->vram_usage, pdd->vram_usage + bo_bucket->size);
+		atomic64_add(bo_bucket->size, &pdd->vram_usage);
 	}
 	return 0;
 }
@@ -3347,6 +3347,9 @@
 	if (vma->vm_end - vma->vm_start != PAGE_SIZE)
 		return -EINVAL;
 
+	if (PAGE_SIZE > 4096)
+		return -EINVAL;
+
 	address = dev->adev->rmmio_remap.bus_addr;
 
 	vm_flags_set(vma, VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_NORESERVE |
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_crat.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_crat.h
@@ -42,8 +42,6 @@
 #define CRAT_OEMTABLEID_LENGTH	8
 #define CRAT_RESERVED_LENGTH	6
 
-#define CRAT_OEMID_64BIT_MASK ((1ULL << (CRAT_OEMID_LENGTH * 8)) - 1)
-
 /* Compute Unit flags */
 #define COMPUTE_UNIT_CPU	(1 << 0)  /* Create Virtual CRAT for CPU */
 #define COMPUTE_UNIT_GPU	(1 << 1)  /* Create Virtual CRAT for GPU */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_debug.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_debug.c
@@ -103,7 +103,8 @@
 			struct kfd_process,
 			debug_event_workarea);
 
-	kernel_write(process->dbg_ev_file, &write_data, 1, &pos);
+	if (process->debug_trap_enabled && process->dbg_ev_file)
+		kernel_write(process->dbg_ev_file, &write_data, 1, &pos);
 }
 
 /* update process/device/queue exception status, write to descriptor
@@ -348,10 +349,27 @@
 {
 	uint32_t spi_dbg_cntl = pdd->spi_dbg_override | pdd->spi_dbg_launch_mode;
 	uint32_t flags = pdd->process->dbg_flags;
+	struct amdgpu_device *adev = pdd->dev->adev;
+	int r;
 
 	if (!kfd_dbg_is_per_vmid_supported(pdd->dev))
 		return 0;
 
+	if (!pdd->proc_ctx_cpu_ptr) {
+			r = amdgpu_amdkfd_alloc_gtt_mem(adev,
+				AMDGPU_MES_PROC_CTX_SIZE,
+				&pdd->proc_ctx_bo,
+				&pdd->proc_ctx_gpu_addr,
+				&pdd->proc_ctx_cpu_ptr,
+				false);
+		if (r) {
+			dev_err(adev->dev,
+			"failed to allocate process context bo\n");
+			return r;
+		}
+		memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE);
+	}
+
 	return amdgpu_mes_set_shader_debugger(pdd->dev->adev, pdd->proc_ctx_gpu_addr, spi_dbg_cntl,
 						pdd->watch_points, flags, sq_trap_en);
 }
@@ -645,6 +663,7 @@
 	else if (target->runtime_info.runtime_state != DEBUG_RUNTIME_STATE_DISABLED)
 		target->runtime_info.runtime_state = DEBUG_RUNTIME_STATE_ENABLED;
 
+	cancel_work_sync(&target->debug_event_workarea);
 	fput(target->dbg_ev_file);
 	target->dbg_ev_file = NULL;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -405,15 +405,8 @@
 			f2g = &gfx_v11_kfd2kgd;
 			break;
 		case IP_VERSION(11, 0, 3):
-			if ((adev->pdev->device == 0x7460 &&
-			     adev->pdev->revision == 0x00) ||
-			    (adev->pdev->device == 0x7461 &&
-			     adev->pdev->revision == 0x00))
-				/* Note: Compiler version is 11.0.5 while HW version is 11.0.3 */
-				gfx_target_version = 110005;
-			else
-				/* Note: Compiler version is 11.0.1 while HW version is 11.0.3 */
-				gfx_target_version = 110001;
+			/* Note: Compiler version is 11.0.1 while HW version is 11.0.3 */
+			gfx_target_version = 110001;
 			f2g = &gfx_v11_kfd2kgd;
 			break;
 		case IP_VERSION(11, 5, 0):
@@ -854,7 +847,7 @@
 kfd_doorbell_error:
 	kfd_gtt_sa_fini(kfd);
 kfd_gtt_sa_init_error:
-	amdgpu_amdkfd_free_gtt_mem(kfd->adev, kfd->gtt_mem);
+	amdgpu_amdkfd_free_gtt_mem(kfd->adev, &kfd->gtt_mem);
 alloc_gtt_mem_failure:
 	dev_err(kfd_device,
 		"device %x:%x NOT added due to errors\n",
@@ -872,7 +865,7 @@
 		kfd_doorbell_fini(kfd);
 		ida_destroy(&kfd->doorbell_ida);
 		kfd_gtt_sa_fini(kfd);
-		amdgpu_amdkfd_free_gtt_mem(kfd->adev, kfd->gtt_mem);
+		amdgpu_amdkfd_free_gtt_mem(kfd->adev, &kfd->gtt_mem);
 	}
 
 	kfree(kfd);
@@ -944,7 +937,6 @@
 {
 	struct kfd_node *node;
 	int i;
-	int count;
 
 	if (!kfd->init_complete)
 		return;
@@ -952,12 +944,10 @@
 	/* for runtime suspend, skip locking kfd */
 	if (!run_pm) {
 		mutex_lock(&kfd_processes_mutex);
-		count = ++kfd_locked;
-		mutex_unlock(&kfd_processes_mutex);
-
 		/* For first KFD device suspend all the KFD processes */
-		if (count == 1)
+		if (++kfd_locked == 1)
 			kfd_suspend_all_processes();
+		mutex_unlock(&kfd_processes_mutex);
 	}
 
 	for (i = 0; i < kfd->num_nodes; i++) {
@@ -968,7 +958,7 @@
 
 int kgd2kfd_resume(struct kfd_dev *kfd, bool run_pm)
 {
-	int ret, count, i;
+	int ret, i;
 
 	if (!kfd->init_complete)
 		return 0;
@@ -982,12 +972,10 @@
 	/* for runtime resume, skip unlocking kfd */
 	if (!run_pm) {
 		mutex_lock(&kfd_processes_mutex);
-		count = --kfd_locked;
-		mutex_unlock(&kfd_processes_mutex);
-
-		WARN_ONCE(count < 0, "KFD suspend / resume ref. error");
-		if (count == 0)
+		if (--kfd_locked == 0)
 			ret = kfd_resume_all_processes();
+		WARN_ONCE(kfd_locked < 0, "KFD suspend / resume ref. error");
+		mutex_unlock(&kfd_processes_mutex);
 	}
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -197,6 +197,21 @@
 	if (dqm->is_hws_hang)
 		return -EIO;
 
+	if (!pdd->proc_ctx_cpu_ptr) {
+		r = amdgpu_amdkfd_alloc_gtt_mem(adev,
+				AMDGPU_MES_PROC_CTX_SIZE,
+				&pdd->proc_ctx_bo,
+				&pdd->proc_ctx_gpu_addr,
+				&pdd->proc_ctx_cpu_ptr,
+				false);
+		if (r) {
+			dev_err(adev->dev,
+				"failed to allocate process context bo\n");
+			return r;
+		}
+		memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE);
+	}
+
 	memset(&queue_input, 0x0, sizeof(struct mes_add_queue_input));
 	queue_input.process_id = qpd->pqm->process->pasid;
 	queue_input.page_table_base_addr =  qpd->page_table_base;
@@ -1997,6 +2012,7 @@
 		dev_err(dev, "HIQ MQD's queue_doorbell_id0 is not 0, Queue preemption time out\n");
 		while (halt_if_hws_hang)
 			schedule();
+		kfd_hws_hang(dqm);
 		return -ETIME;
 	}
 
@@ -2629,7 +2645,7 @@
 {
 	WARN(!mqd, "No hiq sdma mqd trunk to free");
 
-	amdgpu_amdkfd_free_gtt_mem(dev->adev, mqd->gtt_mem);
+	amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);
 }
 
 void device_queue_manager_uninit(struct device_queue_manager *dqm)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c
@@ -373,7 +373,8 @@
 
 		pdd = kfd_create_process_device_data(dev, process);
 		if (!pdd) {
-			pr_err("Failed to create process device data\n");
+			dev_err(dev->adev->dev,
+				"Failed to create process device data\n");
 			return -ENOMEM;
 		}
 		/*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c
@@ -336,7 +336,8 @@
 				break;
 			}
 			kfd_signal_event_interrupt(pasid, context_id0 & 0x7fffff, 23);
-		} else if (source_id == SOC15_INTSRC_CP_BAD_OPCODE) {
+		} else if (source_id == SOC15_INTSRC_CP_BAD_OPCODE &&
+			   KFD_DBG_EC_TYPE_IS_PACKET(KFD_DEBUG_CP_BAD_OP_ECODE(context_id0))) {
 			kfd_set_dbg_ev_from_interrupt(dev, pasid,
 				KFD_DEBUG_DOORBELL_ID(context_id0),
 				KFD_EC_MASK(KFD_DEBUG_CP_BAD_OP_ECODE(context_id0)),
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c
@@ -325,7 +325,8 @@
 		/* CP */
 		if (source_id == SOC15_INTSRC_CP_END_OF_PIPE)
 			kfd_signal_event_interrupt(pasid, context_id0, 32);
-		else if (source_id == SOC15_INTSRC_CP_BAD_OPCODE)
+		else if (source_id == SOC15_INTSRC_CP_BAD_OPCODE &&
+			 KFD_DBG_EC_TYPE_IS_PACKET(KFD_CTXID0_CP_BAD_OP_ECODE(context_id0)))
 			kfd_set_dbg_ev_from_interrupt(dev, pasid,
 				KFD_CTXID0_DOORBELL_ID(context_id0),
 				KFD_EC_MASK(KFD_CTXID0_CP_BAD_OP_ECODE(context_id0)),
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c
@@ -385,7 +385,8 @@
 				break;
 			}
 			kfd_signal_event_interrupt(pasid, sq_int_data, 24);
-		} else if (source_id == SOC15_INTSRC_CP_BAD_OPCODE) {
+		} else if (source_id == SOC15_INTSRC_CP_BAD_OPCODE &&
+			   KFD_DBG_EC_TYPE_IS_PACKET(KFD_DEBUG_CP_BAD_OP_ECODE(context_id0))) {
 			kfd_set_dbg_ev_from_interrupt(dev, pasid,
 				KFD_DEBUG_DOORBELL_ID(context_id0),
 				KFD_EC_MASK(KFD_DEBUG_CP_BAD_OP_ECODE(context_id0)),
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -68,7 +68,7 @@
 		kq->mqd_mgr = dev->dqm->mqd_mgrs[KFD_MQD_TYPE_HIQ];
 		break;
 	default:
-		pr_err("Invalid queue type %d\n", type);
+		dev_err(dev->adev->dev, "Invalid queue type %d\n", type);
 		return false;
 	}
 
@@ -78,13 +78,14 @@
 	prop.doorbell_ptr = kfd_get_kernel_doorbell(dev->kfd, &prop.doorbell_off);
 
 	if (!prop.doorbell_ptr) {
-		pr_err("Failed to initialize doorbell");
+		dev_err(dev->adev->dev, "Failed to initialize doorbell");
 		goto err_get_kernel_doorbell;
 	}
 
 	retval = kfd_gtt_sa_allocate(dev, queue_size, &kq->pq);
 	if (retval != 0) {
-		pr_err("Failed to init pq queues size %d\n", queue_size);
+		dev_err(dev->adev->dev, "Failed to init pq queues size %d\n",
+			queue_size);
 		goto err_pq_allocate_vidmem;
 	}
 
@@ -123,7 +124,7 @@
 
 	memset(kq->pq_kernel_addr, 0, queue_size);
 	memset(kq->rptr_kernel, 0, sizeof(*kq->rptr_kernel));
-	memset(kq->wptr_kernel, 0, sizeof(*kq->wptr_kernel));
+	memset(kq->wptr_kernel, 0, dev->kfd->device_info.doorbell_size);
 
 	prop.queue_size = queue_size;
 	prop.is_interop = false;
@@ -332,7 +333,7 @@
 	if (kq_initialize(kq, dev, type, KFD_KERNEL_QUEUE_SIZE))
 		return kq;
 
-	pr_err("Failed to init kernel queue\n");
+	dev_err(dev->adev->dev, "Failed to init kernel queue\n");
 
 	kfree(kq);
 	return NULL;
@@ -351,26 +352,26 @@
 	uint32_t *buffer, i;
 	int retval;
 
-	pr_err("Starting kernel queue test\n");
+	dev_err(dev->adev->dev, "Starting kernel queue test\n");
 
 	kq = kernel_queue_init(dev, KFD_QUEUE_TYPE_HIQ);
 	if (unlikely(!kq)) {
-		pr_err("  Failed to initialize HIQ\n");
-		pr_err("Kernel queue test failed\n");
+		dev_err(dev->adev->dev, "  Failed to initialize HIQ\n");
+		dev_err(dev->adev->dev, "Kernel queue test failed\n");
 		return;
 	}
 
 	retval = kq_acquire_packet_buffer(kq, 5, &buffer);
 	if (unlikely(retval != 0)) {
-		pr_err("  Failed to acquire packet buffer\n");
-		pr_err("Kernel queue test failed\n");
+		dev_err(dev->adev->dev, "  Failed to acquire packet buffer\n");
+		dev_err(dev->adev->dev, "Kernel queue test failed\n");
 		return;
 	}
 	for (i = 0; i < 5; i++)
 		buffer[i] = kq->nop_packet;
 	kq_submit_packet(kq);
 
-	pr_err("Ending kernel queue test\n");
+	dev_err(dev->adev->dev, "Ending kernel queue test\n");
 }
 
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
@@ -306,7 +306,7 @@
 		spage = migrate_pfn_to_page(migrate->src[i]);
 		if (spage && !is_zone_device_page(spage)) {
 			src[i] = dma_map_page(dev, spage, 0, PAGE_SIZE,
-					      DMA_TO_DEVICE);
+					      DMA_BIDIRECTIONAL);
 			r = dma_mapping_error(dev, src[i]);
 			if (r) {
 				dev_err(dev, "%s: fail %d dma_map_page\n",
@@ -509,10 +509,19 @@
 	start = start_mgr << PAGE_SHIFT;
 	end = (last_mgr + 1) << PAGE_SHIFT;
 
+	r = amdgpu_amdkfd_reserve_mem_limit(node->adev,
+					prange->npages * PAGE_SIZE,
+					KFD_IOC_ALLOC_MEM_FLAGS_VRAM,
+					node->xcp ? node->xcp->id : 0);
+	if (r) {
+		dev_dbg(node->adev->dev, "failed to reserve VRAM, r: %ld\n", r);
+		return -ENOSPC;
+	}
+
 	r = svm_range_vram_node_new(node, prange, true);
 	if (r) {
 		dev_dbg(node->adev->dev, "fail %ld to alloc vram\n", r);
-		return r;
+		goto out;
 	}
 	ttm_res_offset = (start_mgr - prange->start + prange->offset) << PAGE_SHIFT;
 
@@ -545,6 +554,11 @@
 		svm_range_vram_node_free(prange);
 	}
 
+out:
+	amdgpu_amdkfd_unreserve_mem_limit(node->adev,
+					prange->npages * PAGE_SIZE,
+					KFD_IOC_ALLOC_MEM_FLAGS_VRAM,
+					node->xcp ? node->xcp->id : 0);
 	return r < 0 ? r : 0;
 }
 
@@ -616,7 +630,7 @@
 			goto out_oom;
 		}
 
-		dst[i] = dma_map_page(dev, dpage, 0, PAGE_SIZE, DMA_FROM_DEVICE);
+		dst[i] = dma_map_page(dev, dpage, 0, PAGE_SIZE, DMA_BIDIRECTIONAL);
 		r = dma_mapping_error(dev, dst[i]);
 		if (r) {
 			dev_err(adev->dev, "%s: fail %d dma_map_page\n", __func__, r);
@@ -1009,7 +1023,7 @@
 	if (amdgpu_ip_version(adev, GC_HWIP, 0) < IP_VERSION(9, 0, 1))
 		return -EINVAL;
 
-	if (adev->gmc.is_app_apu)
+	if (adev->gmc.is_app_apu || adev->flags & AMD_IS_APU)
 		return 0;
 
 	pgmap = &kfddev->pgmap;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
@@ -118,12 +118,14 @@
 	 * attention grabbing.
 	 */
 	if (gfx_info->max_shader_engines > KFD_MAX_NUM_SE) {
-		pr_err("Exceeded KFD_MAX_NUM_SE, chip reports %d\n",
-		       gfx_info->max_shader_engines);
+		dev_err(mm->dev->adev->dev,
+			"Exceeded KFD_MAX_NUM_SE, chip reports %d\n",
+			gfx_info->max_shader_engines);
 		return;
 	}
 	if (gfx_info->max_sh_per_se > KFD_MAX_NUM_SH_PER_SE) {
-		pr_err("Exceeded KFD_MAX_NUM_SH, chip reports %d\n",
+		dev_err(mm->dev->adev->dev,
+			"Exceeded KFD_MAX_NUM_SH, chip reports %d\n",
 			gfx_info->max_sh_per_se * gfx_info->max_shader_engines);
 		return;
 	}
@@ -223,7 +225,7 @@
 	      struct kfd_mem_obj *mqd_mem_obj)
 {
 	if (mqd_mem_obj->gtt_mem) {
-		amdgpu_amdkfd_free_gtt_mem(mm->dev->adev, mqd_mem_obj->gtt_mem);
+		amdgpu_amdkfd_free_gtt_mem(mm->dev->adev, &mqd_mem_obj->gtt_mem);
 		kfree(mqd_mem_obj);
 	} else {
 		kfd_gtt_sa_free(mm->dev, mqd_mem_obj);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
@@ -695,7 +695,7 @@
 		m = get_mqd(mqd + size * xcc);
 		update_mqd(mm, m, q, minfo);
 
-		update_cu_mask(mm, mqd, minfo, xcc);
+		update_cu_mask(mm, m, minfo, xcc);
 
 		if (q->format == KFD_QUEUE_FORMAT_AQL) {
 			switch (xcc) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c
@@ -45,7 +45,8 @@
 	unsigned int process_count, queue_count, compute_queue_count, gws_queue_count;
 	unsigned int map_queue_size;
 	unsigned int max_proc_per_quantum = 1;
-	struct kfd_node *dev = pm->dqm->dev;
+	struct kfd_node *node = pm->dqm->dev;
+	struct device *dev = node->adev->dev;
 
 	process_count = pm->dqm->processes_count;
 	queue_count = pm->dqm->active_queue_count;
@@ -59,14 +60,14 @@
 	 */
 	*over_subscription = false;
 
-	if (dev->max_proc_per_quantum > 1)
-		max_proc_per_quantum = dev->max_proc_per_quantum;
+	if (node->max_proc_per_quantum > 1)
+		max_proc_per_quantum = node->max_proc_per_quantum;
 
 	if ((process_count > max_proc_per_quantum) ||
 	    compute_queue_count > get_cp_queues_num(pm->dqm) ||
 	    gws_queue_count > 1) {
 		*over_subscription = true;
-		pr_debug("Over subscribed runlist\n");
+		dev_dbg(dev, "Over subscribed runlist\n");
 	}
 
 	map_queue_size = pm->pmf->map_queues_size;
@@ -81,7 +82,7 @@
 	if (*over_subscription)
 		*rlib_size += pm->pmf->runlist_size;
 
-	pr_debug("runlist ib size %d\n", *rlib_size);
+	dev_dbg(dev, "runlist ib size %d\n", *rlib_size);
 }
 
 static int pm_allocate_runlist_ib(struct packet_manager *pm,
@@ -90,6 +91,8 @@
 				unsigned int *rl_buffer_size,
 				bool *is_over_subscription)
 {
+	struct kfd_node *node = pm->dqm->dev;
+	struct device *dev = node->adev->dev;
 	int retval;
 
 	if (WARN_ON(pm->allocated))
@@ -99,11 +102,10 @@
 
 	mutex_lock(&pm->lock);
 
-	retval = kfd_gtt_sa_allocate(pm->dqm->dev, *rl_buffer_size,
-					&pm->ib_buffer_obj);
+	retval = kfd_gtt_sa_allocate(node, *rl_buffer_size, &pm->ib_buffer_obj);
 
 	if (retval) {
-		pr_err("Failed to allocate runlist IB\n");
+		dev_err(dev, "Failed to allocate runlist IB\n");
 		goto out;
 	}
 
@@ -125,6 +127,8 @@
 {
 	unsigned int alloc_size_bytes;
 	unsigned int *rl_buffer, rl_wptr, i;
+	struct kfd_node *node = pm->dqm->dev;
+	struct device *dev = node->adev->dev;
 	int retval, processes_mapped;
 	struct device_process_node *cur;
 	struct qcm_process_device *qpd;
@@ -142,7 +146,7 @@
 	*rl_size_bytes = alloc_size_bytes;
 	pm->ib_size_bytes = alloc_size_bytes;
 
-	pr_debug("Building runlist ib process count: %d queues count %d\n",
+	dev_dbg(dev, "Building runlist ib process count: %d queues count %d\n",
 		pm->dqm->processes_count, pm->dqm->active_queue_count);
 
 	/* build the run list ib packet */
@@ -150,7 +154,7 @@
 		qpd = cur->qpd;
 		/* build map process packet */
 		if (processes_mapped >= pm->dqm->processes_count) {
-			pr_debug("Not enough space left in runlist IB\n");
+			dev_dbg(dev, "Not enough space left in runlist IB\n");
 			pm_release_ib(pm);
 			return -ENOMEM;
 		}
@@ -167,7 +171,8 @@
 			if (!kq->queue->properties.is_active)
 				continue;
 
-			pr_debug("static_queue, mapping kernel q %d, is debug status %d\n",
+			dev_dbg(dev,
+				"static_queue, mapping kernel q %d, is debug status %d\n",
 				kq->queue->queue, qpd->is_debug);
 
 			retval = pm->pmf->map_queues(pm,
@@ -186,7 +191,8 @@
 			if (!q->properties.is_active)
 				continue;
 
-			pr_debug("static_queue, mapping user queue %d, is debug status %d\n",
+			dev_dbg(dev,
+				"static_queue, mapping user queue %d, is debug status %d\n",
 				q->queue, qpd->is_debug);
 
 			retval = pm->pmf->map_queues(pm,
@@ -203,11 +209,13 @@
 		}
 	}
 
-	pr_debug("Finished map process and queues to runlist\n");
+	dev_dbg(dev, "Finished map process and queues to runlist\n");
 
 	if (is_over_subscription) {
 		if (!pm->is_over_subscription)
-			pr_warn("Runlist is getting oversubscribed. Expect reduced ROCm performance.\n");
+			dev_warn(
+				dev,
+				"Runlist is getting oversubscribed. Expect reduced ROCm performance.\n");
 		retval = pm->pmf->runlist(pm, &rl_buffer[rl_wptr],
 					*rl_gpu_addr,
 					alloc_size_bytes / sizeof(uint32_t),
@@ -272,6 +280,8 @@
 int pm_send_set_resources(struct packet_manager *pm,
 				struct scheduling_resources *res)
 {
+	struct kfd_node *node = pm->dqm->dev;
+	struct device *dev = node->adev->dev;
 	uint32_t *buffer, size;
 	int retval = 0;
 
@@ -281,7 +291,7 @@
 					size / sizeof(uint32_t),
 					(unsigned int **)&buffer);
 	if (!buffer) {
-		pr_err("Failed to allocate buffer on kernel queue\n");
+		dev_err(dev, "Failed to allocate buffer on kernel queue\n");
 		retval = -ENOMEM;
 		goto out;
 	}
@@ -343,6 +353,8 @@
 int pm_send_query_status(struct packet_manager *pm, uint64_t fence_address,
 			uint64_t fence_value)
 {
+	struct kfd_node *node = pm->dqm->dev;
+	struct device *dev = node->adev->dev;
 	uint32_t *buffer, size;
 	int retval = 0;
 
@@ -354,7 +366,7 @@
 	kq_acquire_packet_buffer(pm->priv_queue,
 			size / sizeof(uint32_t), (unsigned int **)&buffer);
 	if (!buffer) {
-		pr_err("Failed to allocate buffer on kernel queue\n");
+		dev_err(dev, "Failed to allocate buffer on kernel queue\n");
 		retval = -ENOMEM;
 		goto out;
 	}
@@ -372,6 +384,8 @@
 
 int pm_update_grace_period(struct packet_manager *pm, uint32_t grace_period)
 {
+	struct kfd_node *node = pm->dqm->dev;
+	struct device *dev = node->adev->dev;
 	int retval = 0;
 	uint32_t *buffer, size;
 
@@ -385,7 +399,8 @@
 			(unsigned int **)&buffer);
 
 		if (!buffer) {
-			pr_err("Failed to allocate buffer on kernel queue\n");
+			dev_err(dev,
+				"Failed to allocate buffer on kernel queue\n");
 			retval = -ENOMEM;
 			goto out;
 		}
@@ -406,6 +421,8 @@
 			enum kfd_unmap_queues_filter filter,
 			uint32_t filter_param, bool reset)
 {
+	struct kfd_node *node = pm->dqm->dev;
+	struct device *dev = node->adev->dev;
 	uint32_t *buffer, size;
 	int retval = 0;
 
@@ -414,7 +431,7 @@
 	kq_acquire_packet_buffer(pm->priv_queue,
 			size / sizeof(uint32_t), (unsigned int **)&buffer);
 	if (!buffer) {
-		pr_err("Failed to allocate buffer on kernel queue\n");
+		dev_err(dev, "Failed to allocate buffer on kernel queue\n");
 		retval = -ENOMEM;
 		goto out;
 	}
@@ -463,6 +480,8 @@
 
 int pm_debugfs_hang_hws(struct packet_manager *pm)
 {
+	struct kfd_node *node = pm->dqm->dev;
+	struct device *dev = node->adev->dev;
 	uint32_t *buffer, size;
 	int r = 0;
 
@@ -474,16 +493,16 @@
 	kq_acquire_packet_buffer(pm->priv_queue,
 			size / sizeof(uint32_t), (unsigned int **)&buffer);
 	if (!buffer) {
-		pr_err("Failed to allocate buffer on kernel queue\n");
+		dev_err(dev, "Failed to allocate buffer on kernel queue\n");
 		r = -ENOMEM;
 		goto out;
 	}
 	memset(buffer, 0x55, size);
 	kq_submit_packet(pm->priv_queue);
 
-	pr_info("Submitting %x %x %x %x %x %x %x to HIQ to hang the HWS.",
-		buffer[0], buffer[1], buffer[2], buffer[3],
-		buffer[4], buffer[5], buffer[6]);
+	dev_info(dev, "Submitting %x %x %x %x %x %x %x to HIQ to hang the HWS.",
+		 buffer[0], buffer[1], buffer[2], buffer[3], buffer[4],
+		 buffer[5], buffer[6]);
 out:
 	mutex_unlock(&pm->lock);
 	return r;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -765,7 +765,7 @@
 	enum kfd_pdd_bound bound;
 
 	/* VRAM usage */
-	uint64_t vram_usage;
+	atomic64_t vram_usage;
 	struct attribute attr_vram;
 	char vram_filename[MAX_SYSFS_FILENAME_LEN];
 
@@ -1473,7 +1473,7 @@
 
 static inline bool kfd_flush_tlb_after_unmap(struct kfd_dev *dev)
 {
-	return KFD_GC_VERSION(dev) > IP_VERSION(9, 4, 2) ||
+	return KFD_GC_VERSION(dev) >= IP_VERSION(9, 4, 2) ||
 	       (KFD_GC_VERSION(dev) == IP_VERSION(9, 4, 1) && dev->sdma_fw_version >= 18) ||
 	       KFD_GC_VERSION(dev) == IP_VERSION(9, 4, 0);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -306,14 +306,14 @@
 	} else if (strncmp(attr->name, "vram_", 5) == 0) {
 		struct kfd_process_device *pdd = container_of(attr, struct kfd_process_device,
 							      attr_vram);
-		return snprintf(buffer, PAGE_SIZE, "%llu\n", READ_ONCE(pdd->vram_usage));
+		return snprintf(buffer, PAGE_SIZE, "%llu\n", atomic64_read(&pdd->vram_usage));
 	} else if (strncmp(attr->name, "sdma_", 5) == 0) {
 		struct kfd_process_device *pdd = container_of(attr, struct kfd_process_device,
 							      attr_sdma);
 		struct kfd_sdma_activity_handler_workarea sdma_activity_work_handler;
 
-		INIT_WORK(&sdma_activity_work_handler.sdma_activity_work,
-					kfd_sdma_activity_worker);
+		INIT_WORK_ONSTACK(&sdma_activity_work_handler.sdma_activity_work,
+				  kfd_sdma_activity_worker);
 
 		sdma_activity_work_handler.pdd = pdd;
 		sdma_activity_work_handler.sdma_activity_counter = 0;
@@ -321,6 +321,7 @@
 		schedule_work(&sdma_activity_work_handler.sdma_activity_work);
 
 		flush_work(&sdma_activity_work_handler.sdma_activity_work);
+		destroy_work_on_stack(&sdma_activity_work_handler.sdma_activity_work);
 
 		return snprintf(buffer, PAGE_SIZE, "%llu\n",
 				(sdma_activity_work_handler.sdma_activity_counter)/
@@ -819,9 +820,9 @@
 	mutex_lock(&kfd_processes_mutex);
 
 	if (kfd_is_locked()) {
-		mutex_unlock(&kfd_processes_mutex);
 		pr_debug("KFD is locked! Cannot create process");
-		return ERR_PTR(-EINVAL);
+		process = ERR_PTR(-EINVAL);
+		goto out;
 	}
 
 	/* A prior open of /dev/kfd could have already created the process. */
@@ -829,6 +830,14 @@
 	if (process) {
 		pr_debug("Process already found\n");
 	} else {
+		/* If the process just called exec(3), it is possible that the
+		 * cleanup of the kfd_process (following the release of the mm
+		 * of the old process image) is still in the cleanup work queue.
+		 * Make sure to drain any job before trying to recreate any
+		 * resource for this process.
+		 */
+		flush_workqueue(kfd_process_wq);
+
 		process = create_process(thread);
 		if (IS_ERR(process))
 			goto out;
@@ -1038,9 +1047,10 @@
 
 		kfd_free_process_doorbells(pdd->dev->kfd, pdd);
 
-		if (pdd->dev->kfd->shared_resources.enable_mes)
+		if (pdd->dev->kfd->shared_resources.enable_mes &&
+			pdd->proc_ctx_cpu_ptr)
 			amdgpu_amdkfd_free_gtt_mem(pdd->dev->adev,
-						   pdd->proc_ctx_bo);
+						   &pdd->proc_ctx_bo);
 		/*
 		 * before destroying pdd, make sure to report availability
 		 * for auto suspend
@@ -1121,7 +1131,8 @@
 	 */
 	synchronize_rcu();
 	ef = rcu_access_pointer(p->ef);
-	dma_fence_signal(ef);
+	if (ef)
+		dma_fence_signal(ef);
 
 	kfd_process_remove_sysfs(p);
 
@@ -1303,7 +1314,8 @@
 		if (IS_ERR_VALUE(qpd->tba_addr)) {
 			int err = qpd->tba_addr;
 
-			pr_err("Failure to set tba address. error %d.\n", err);
+			dev_err(dev->adev->dev,
+				"Failure to set tba address. error %d.\n", err);
 			qpd->tba_addr = 0;
 			qpd->cwsr_kaddr = NULL;
 			return err;
@@ -1571,7 +1583,6 @@
 							struct kfd_process *p)
 {
 	struct kfd_process_device *pdd = NULL;
-	int retval = 0;
 
 	if (WARN_ON_ONCE(p->n_pdds >= MAX_GPU_INSTANCE))
 		return NULL;
@@ -1590,25 +1601,11 @@
 	pdd->bound = PDD_UNBOUND;
 	pdd->already_dequeued = false;
 	pdd->runtime_inuse = false;
-	pdd->vram_usage = 0;
+	atomic64_set(&pdd->vram_usage, 0);
 	pdd->sdma_past_activity_counter = 0;
 	pdd->user_gpu_id = dev->id;
 	atomic64_set(&pdd->evict_duration_counter, 0);
 
-	if (dev->kfd->shared_resources.enable_mes) {
-		retval = amdgpu_amdkfd_alloc_gtt_mem(dev->adev,
-						AMDGPU_MES_PROC_CTX_SIZE,
-						&pdd->proc_ctx_bo,
-						&pdd->proc_ctx_gpu_addr,
-						&pdd->proc_ctx_cpu_ptr,
-						false);
-		if (retval) {
-			pr_err("failed to allocate process context bo\n");
-			goto err_free_pdd;
-		}
-		memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE);
-	}
-
 	p->pdds[p->n_pdds++] = pdd;
 	if (kfd_dbg_is_per_vmid_supported(pdd->dev))
 		pdd->spi_dbg_override = pdd->dev->kfd2kgd->disable_debug_trap(
@@ -1620,10 +1617,6 @@
 	idr_init(&pdd->alloc_idr);
 
 	return pdd;
-
-err_free_pdd:
-	kfree(pdd);
-	return NULL;
 }
 
 /**
@@ -1666,12 +1659,15 @@
 
 	ret = amdgpu_amdkfd_gpuvm_acquire_process_vm(dev->adev, avm,
 						     &p->kgd_process_info,
-						     &ef);
+						     p->ef ? NULL : &ef);
 	if (ret) {
-		pr_err("Failed to create process VM object\n");
+		dev_err(dev->adev->dev, "Failed to create process VM object\n");
 		return ret;
 	}
-	RCU_INIT_POINTER(p->ef, ef);
+
+	if (!p->ef)
+		RCU_INIT_POINTER(p->ef, ef);
+
 	pdd->drm_priv = drm_file->private_data;
 
 	ret = kfd_process_device_reserve_ib_mem(pdd);
@@ -1715,7 +1711,7 @@
 
 	pdd = kfd_get_process_device_data(dev, p);
 	if (!pdd) {
-		pr_err("Process device data doesn't exist\n");
+		dev_err(dev->adev->dev, "Process device data doesn't exist\n");
 		return ERR_PTR(-ENOMEM);
 	}
 
@@ -1825,6 +1821,7 @@
 
 	for (i = 0; i < p->n_pdds; i++) {
 		struct kfd_process_device *pdd = p->pdds[i];
+		struct device *dev = pdd->dev->adev->dev;
 
 		kfd_smi_event_queue_eviction(pdd->dev, p->lead_thread->pid,
 					     trigger);
@@ -1836,7 +1833,7 @@
 		 * them been add back since they actually not be saved right now.
 		 */
 		if (r && r != -EIO) {
-			pr_err("Failed to evict process queues\n");
+			dev_err(dev, "Failed to evict process queues\n");
 			goto fail;
 		}
 		n_evicted++;
@@ -1858,7 +1855,8 @@
 
 		if (pdd->dev->dqm->ops.restore_process_queues(pdd->dev->dqm,
 							      &pdd->qpd))
-			pr_err("Failed to restore queues\n");
+			dev_err(pdd->dev->adev->dev,
+				"Failed to restore queues\n");
 
 		n_evicted--;
 	}
@@ -1874,13 +1872,14 @@
 
 	for (i = 0; i < p->n_pdds; i++) {
 		struct kfd_process_device *pdd = p->pdds[i];
+		struct device *dev = pdd->dev->adev->dev;
 
 		kfd_smi_event_queue_restore(pdd->dev, p->lead_thread->pid);
 
 		r = pdd->dev->dqm->ops.restore_process_queues(pdd->dev->dqm,
 							      &pdd->qpd);
 		if (r) {
-			pr_err("Failed to restore process queues\n");
+			dev_err(dev, "Failed to restore process queues\n");
 			if (!ret)
 				ret = r;
 		}
@@ -1922,6 +1921,8 @@
 	rcu_read_lock();
 	ef = dma_fence_get_rcu_safe(&p->ef);
 	rcu_read_unlock();
+	if (!ef)
+		return -EINVAL;
 
 	ret = dma_fence_signal(ef);
 	dma_fence_put(ef);
@@ -1949,10 +1950,9 @@
 		 * they are responsible stopping the queues and scheduling
 		 * the restore work.
 		 */
-		if (!signal_eviction_fence(p))
-			queue_delayed_work(kfd_restore_wq, &p->restore_work,
-				msecs_to_jiffies(PROCESS_RESTORE_TIME_MS));
-		else
+		if (signal_eviction_fence(p) ||
+		    mod_delayed_work(kfd_restore_wq, &p->restore_work,
+				     msecs_to_jiffies(PROCESS_RESTORE_TIME_MS)))
 			kfd_process_restore_queues(p);
 
 		pr_debug("Finished evicting pasid 0x%x\n", p->pasid);
@@ -2011,9 +2011,9 @@
 	if (ret) {
 		pr_debug("Failed to restore BOs of pasid 0x%x, retry after %d ms\n",
 			 p->pasid, PROCESS_BACK_OFF_TIME_MS);
-		ret = queue_delayed_work(kfd_restore_wq, &p->restore_work,
-				msecs_to_jiffies(PROCESS_BACK_OFF_TIME_MS));
-		WARN(!ret, "reschedule restore work failed\n");
+		if (mod_delayed_work(kfd_restore_wq, &p->restore_work,
+				     msecs_to_jiffies(PROCESS_RESTORE_TIME_MS)))
+			kfd_process_restore_queues(p);
 	}
 }
 
@@ -2056,7 +2056,7 @@
 	struct qcm_process_device *qpd;
 
 	if ((vma->vm_end - vma->vm_start) != KFD_CWSR_TBA_TMA_SIZE) {
-		pr_err("Incorrect CWSR mapping size.\n");
+		dev_err(dev->adev->dev, "Incorrect CWSR mapping size.\n");
 		return -EINVAL;
 	}
 
@@ -2068,7 +2068,8 @@
 	qpd->cwsr_kaddr = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
 					get_order(KFD_CWSR_TBA_TMA_SIZE));
 	if (!qpd->cwsr_kaddr) {
-		pr_err("Error allocating per process CWSR buffer.\n");
+		dev_err(dev->adev->dev,
+			"Error allocating per process CWSR buffer.\n");
 		return -ENOMEM;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -28,6 +28,7 @@
 #include "kfd_priv.h"
 #include "kfd_kernel_queue.h"
 #include "amdgpu_amdkfd.h"
+#include "amdgpu_reset.h"
 
 static inline struct process_queue_node *get_queue_by_qid(
 			struct process_queue_manager *pqm, unsigned int qid)
@@ -87,8 +88,12 @@
 		return;
 
 	dev->dqm->ops.process_termination(dev->dqm, &pdd->qpd);
-	if (dev->kfd->shared_resources.enable_mes)
-		amdgpu_mes_flush_shader_debugger(dev->adev, pdd->proc_ctx_gpu_addr);
+	if (dev->kfd->shared_resources.enable_mes &&
+	    down_read_trylock(&dev->adev->reset_domain->sem)) {
+		amdgpu_mes_flush_shader_debugger(dev->adev,
+						 pdd->proc_ctx_gpu_addr);
+		up_read(&dev->adev->reset_domain->sem);
+	}
 	pdd->already_dequeued = true;
 }
 
@@ -196,9 +201,9 @@
 	}
 
 	if (dev->kfd->shared_resources.enable_mes) {
-		amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->gang_ctx_bo);
+		amdgpu_amdkfd_free_gtt_mem(dev->adev, &pqn->q->gang_ctx_bo);
 		if (pqn->q->wptr_bo)
-			amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->wptr_bo);
+			amdgpu_amdkfd_free_gtt_mem(dev->adev, (void **)&pqn->q->wptr_bo);
 	}
 }
 
@@ -979,6 +984,7 @@
 		pr_debug("Queue id %d was restored successfully\n", queue_id);
 
 	kfree(q_data);
+	kfree(q_extra_data);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -404,6 +404,27 @@
 		spin_lock(&svm_bo->list_lock);
 	}
 	spin_unlock(&svm_bo->list_lock);
+
+	if (mmget_not_zero(svm_bo->eviction_fence->mm)) {
+		struct kfd_process_device *pdd;
+		struct kfd_process *p;
+		struct mm_struct *mm;
+
+		mm = svm_bo->eviction_fence->mm;
+		/*
+		 * The forked child process takes svm_bo device pages ref, svm_bo could be
+		 * released after parent process is gone.
+		 */
+		p = kfd_lookup_process_by_mm(mm);
+		if (p) {
+			pdd = kfd_get_process_device_data(svm_bo->node, p);
+			if (pdd)
+				atomic64_sub(amdgpu_bo_size(svm_bo->bo), &pdd->vram_usage);
+			kfd_unref_process(p);
+		}
+		mmput(mm);
+	}
+
 	if (!dma_fence_is_signaled(&svm_bo->eviction_fence->base))
 		/* We're not in the eviction worker. Signal the fence. */
 		dma_fence_signal(&svm_bo->eviction_fence->base);
@@ -531,6 +552,7 @@
 svm_range_vram_node_new(struct kfd_node *node, struct svm_range *prange,
 			bool clear)
 {
+	struct kfd_process_device *pdd;
 	struct amdgpu_bo_param bp;
 	struct svm_range_bo *svm_bo;
 	struct amdgpu_bo_user *ubo;
@@ -622,6 +644,10 @@
 	list_add(&prange->svm_bo_list, &svm_bo->range_list);
 	spin_unlock(&svm_bo->list_lock);
 
+	pdd = svm_range_get_pdd_by_node(prange, node);
+	if (pdd)
+		atomic64_add(amdgpu_bo_size(bo), &pdd->vram_usage);
+
 	return 0;
 
 reserve_bo_failed:
@@ -1656,7 +1682,7 @@
 	start = map_start << PAGE_SHIFT;
 	end = (map_last + 1) << PAGE_SHIFT;
 	for (addr = start; !r && addr < end; ) {
-		struct hmm_range *hmm_range;
+		struct hmm_range *hmm_range = NULL;
 		unsigned long map_start_vma;
 		unsigned long map_last_vma;
 		struct vm_area_struct *vma;
@@ -1694,7 +1720,12 @@
 		}
 
 		svm_range_lock(prange);
-		if (!r && amdgpu_hmm_range_get_pages_done(hmm_range)) {
+
+		/* Free backing memory of hmm_range if it was initialized
+		 * Overrride return value to TRY AGAIN only if prior returns
+		 * were successful
+		 */
+		if (hmm_range && amdgpu_hmm_range_get_pages_done(hmm_range) && !r) {
 			pr_debug("hmm update the range, need validate again\n");
 			r = -EAGAIN;
 		}
@@ -2617,7 +2648,8 @@
 		return -1;
 	}
 
-	if (node->adev->gmc.is_app_apu)
+	if (node->adev->gmc.is_app_apu ||
+	    node->adev->flags & AMD_IS_APU)
 		return 0;
 
 	if (prange->preferred_loc == gpuid ||
@@ -3335,7 +3367,8 @@
 		goto out;
 	}
 
-	if (bo_node->adev->gmc.is_app_apu) {
+	if (bo_node->adev->gmc.is_app_apu ||
+	    bo_node->adev->flags & AMD_IS_APU) {
 		best_loc = 0;
 		goto out;
 	}
@@ -3424,7 +3457,7 @@
 				mm, KFD_MIGRATE_TRIGGER_PREFETCH);
 	*migrated = !r;
 
-	return r;
+	return 0;
 }
 
 int svm_range_schedule_evict_svm_bo(struct amdgpu_amdkfd_fence *fence)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_svm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_svm.h
@@ -201,7 +201,8 @@
  * is initialized to not 0 when page migration register device memory.
  */
 #define KFD_IS_SVM_API_SUPPORTED(adev) ((adev)->kfd.pgmap.type != 0 ||\
-					(adev)->gmc.is_app_apu)
+					(adev)->gmc.is_app_apu ||\
+					((adev)->flags & AMD_IS_APU))
 
 void svm_range_bo_unref_async(struct svm_range_bo *svm_bo);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -958,8 +958,7 @@
 	dev = list_last_entry(&topology_device_list,
 			struct kfd_topology_device, list);
 	if (dev) {
-		sys_props.platform_id =
-			(*((uint64_t *)dev->oem_id)) & CRAT_OEMID_64BIT_MASK;
+		sys_props.platform_id = dev->oem_id64;
 		sys_props.platform_oem = *((uint64_t *)dev->oem_table_id);
 		sys_props.platform_rev = dev->oem_revision;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_topology.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/amdkfd/kfd_topology.h
@@ -154,7 +154,10 @@
 	struct attribute		attr_gpuid;
 	struct attribute		attr_name;
 	struct attribute		attr_props;
-	uint8_t				oem_id[CRAT_OEMID_LENGTH];
+	union {
+		uint8_t				oem_id[CRAT_OEMID_LENGTH];
+		uint64_t			oem_id64;
+	};
 	uint8_t				oem_table_id[CRAT_OEMTABLEID_LENGTH];
 	uint32_t			oem_revision;
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -147,6 +147,9 @@
 #define FIRMWARE_DCN_35_DMUB "amdgpu/dcn_3_5_dmcub.bin"
 MODULE_FIRMWARE(FIRMWARE_DCN_35_DMUB);
 
+#define FIRMWARE_DCN_351_DMUB "amdgpu/dcn_3_5_1_dmcub.bin"
+MODULE_FIRMWARE(FIRMWARE_DCN_351_DMUB);
+
 /* Number of bytes in PSP header for firmware. */
 #define PSP_HEADER_BYTES 0x100
 
@@ -270,7 +273,7 @@
 static int dm_crtc_get_scanoutpos(struct amdgpu_device *adev, int crtc,
 				  u32 *vbl, u32 *position)
 {
-	u32 v_blank_start, v_blank_end, h_position, v_position;
+	u32 v_blank_start = 0, v_blank_end = 0, h_position = 0, v_position = 0;
 	struct amdgpu_crtc *acrtc = NULL;
 	struct dc *dc = adev->dm.dc;
 
@@ -590,12 +593,14 @@
 	if (!acrtc)
 		return;
 
-	if (acrtc->wb_pending) {
-		if (acrtc->wb_conn) {
-			spin_lock_irqsave(&acrtc->wb_conn->job_lock, flags);
+	if (acrtc->wb_conn) {
+		spin_lock_irqsave(&acrtc->wb_conn->job_lock, flags);
+
+		if (acrtc->wb_pending) {
 			job = list_first_entry_or_null(&acrtc->wb_conn->job_queue,
 						       struct drm_writeback_job,
 						       list_entry);
+			acrtc->wb_pending = false;
 			spin_unlock_irqrestore(&acrtc->wb_conn->job_lock, flags);
 
 			if (job) {
@@ -613,8 +618,7 @@
 							       acrtc->dm_irq_params.stream, 0);
 			}
 		} else
-			DRM_ERROR("%s: no amdgpu_crtc wb_conn\n", __func__);
-		acrtc->wb_pending = false;
+			spin_unlock_irqrestore(&acrtc->wb_conn->job_lock, flags);
 	}
 
 	vrr_active = amdgpu_dm_crtc_vrr_active_irq(acrtc);
@@ -753,6 +757,12 @@
 		return;
 	}
 
+	/* Skip DMUB HPD IRQ in suspend/resume. We will probe them later. */
+	if (notify->type == DMUB_NOTIFICATION_HPD && adev->in_suspend) {
+		DRM_INFO("Skip DMUB HPD IRQ callback in suspend/resume\n");
+		return;
+	}
+
 	link_index = notify->link_index;
 	link = adev->dm.dc->links[link_index];
 	dev = adev->dm.ddev;
@@ -844,7 +854,7 @@
  */
 static void dm_dmub_outbox1_low_irq(void *interrupt_params)
 {
-	struct dmub_notification notify;
+	struct dmub_notification notify = {0};
 	struct common_irq_params *irq_params = interrupt_params;
 	struct amdgpu_device *adev = irq_params->adev;
 	struct amdgpu_display_manager *dm = &adev->dm;
@@ -1683,7 +1693,11 @@
 		else
 			init_data.flags.gpu_vm_support = (amdgpu_sg_display != 0);
 	} else {
-		init_data.flags.gpu_vm_support = (amdgpu_sg_display != 0) && (adev->flags & AMD_IS_APU);
+		if (amdgpu_ip_version(adev, DCE_HWIP, 0) == IP_VERSION(2, 0, 3))
+			init_data.flags.gpu_vm_support = (amdgpu_sg_display == 1);
+		else
+			init_data.flags.gpu_vm_support =
+				(amdgpu_sg_display != 0) && (adev->flags & AMD_IS_APU);
 	}
 
 	adev->mode_info.gpu_vm_support = init_data.flags.gpu_vm_support;
@@ -1929,17 +1943,15 @@
 		adev->dm.hdcp_workqueue = NULL;
 	}
 
-	if (adev->dm.dc)
+	if (adev->dm.dc) {
 		dc_deinit_callbacks(adev->dm.dc);
-
-	if (adev->dm.dc)
 		dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
-
-	if (dc_enable_dmub_notifications(adev->dm.dc)) {
-		kfree(adev->dm.dmub_notify);
-		adev->dm.dmub_notify = NULL;
-		destroy_workqueue(adev->dm.delayed_hpd_wq);
-		adev->dm.delayed_hpd_wq = NULL;
+		if (dc_enable_dmub_notifications(adev->dm.dc)) {
+			kfree(adev->dm.dmub_notify);
+			adev->dm.dmub_notify = NULL;
+			destroy_workqueue(adev->dm.delayed_hpd_wq);
+			adev->dm.delayed_hpd_wq = NULL;
+		}
 	}
 
 	if (adev->dm.dmub_bo)
@@ -2667,7 +2679,8 @@
 
 		dm->cached_dc_state = dc_state_create_copy(dm->dc->current_state);
 
-		dm_gpureset_toggle_interrupts(adev, dm->cached_dc_state, false);
+		if (dm->cached_dc_state)
+			dm_gpureset_toggle_interrupts(adev, dm->cached_dc_state, false);
 
 		amdgpu_dm_commit_zero_streams(dm->dc);
 
@@ -2690,6 +2703,10 @@
 	hpd_rx_irq_work_suspend(dm);
 
 	dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D3);
+
+	if (dm->dc->caps.ips_support && adev->in_s0ix)
+		dc_allow_idle_optimizations(dm->dc, true);
+
 	dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D3);
 
 	return 0;
@@ -2906,6 +2923,7 @@
 			dc_enable_dmub_outbox(adev->dm.dc);
 		}
 
+		dc_exit_ips_for_hw_access(dm->dc);
 		WARN_ON(!dc_commit_streams(dm->dc, dc_state->streams, dc_state->stream_count));
 
 		dm_gpureset_commit_state(dm->cached_dc_state, dm);
@@ -2978,7 +2996,8 @@
 			emulated_link_detect(aconnector->dc_link);
 		} else {
 			mutex_lock(&dm->dc_lock);
-			dc_link_detect(aconnector->dc_link, DETECT_REASON_HPD);
+			dc_exit_ips_for_hw_access(dm->dc);
+			dc_link_detect(aconnector->dc_link, DETECT_REASON_RESUMEFROMS3S4);
 			mutex_unlock(&dm->dc_lock);
 		}
 
@@ -3009,6 +3028,7 @@
 			dc_stream_release(dm_new_crtc_state->stream);
 			dm_new_crtc_state->stream = NULL;
 		}
+		dm_new_crtc_state->base.color_mgmt_changed = true;
 	}
 
 	for_each_new_plane_in_state(dm->cached_state, plane, new_plane_state, i) {
@@ -3027,6 +3047,10 @@
 	/* Do mst topology probing after resuming cached state*/
 	drm_connector_list_iter_begin(ddev, &iter);
 	drm_for_each_connector_iter(connector, &iter) {
+
+		if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
+			continue;
+
 		aconnector = to_amdgpu_dm_connector(connector);
 		if (aconnector->dc_link->type != dc_connection_mst_branch ||
 		    aconnector->mst_root)
@@ -3307,6 +3331,7 @@
 	enum dc_connection_type new_connection_type = dc_connection_none;
 	struct amdgpu_device *adev = drm_to_adev(dev);
 	struct dm_connector_state *dm_con_state = to_dm_connector_state(connector->state);
+	struct dc *dc = aconnector->dc_link->ctx->dc;
 	bool ret = false;
 
 	if (adev->dm.disable_hpd_irq)
@@ -3341,6 +3366,7 @@
 			drm_kms_helper_connector_hotplug_event(connector);
 	} else {
 		mutex_lock(&adev->dm.dc_lock);
+		dc_exit_ips_for_hw_access(dc);
 		ret = dc_link_detect(aconnector->dc_link, DETECT_REASON_HPD);
 		mutex_unlock(&adev->dm.dc_lock);
 		if (ret) {
@@ -3400,6 +3426,7 @@
 	bool has_left_work = false;
 	int idx = dc_link->link_index;
 	struct hpd_rx_irq_offload_work_queue *offload_wq = &adev->dm.hpd_rx_offload_wq[idx];
+	struct dc *dc = aconnector->dc_link->ctx->dc;
 
 	memset(&hpd_irq_data, 0, sizeof(hpd_irq_data));
 
@@ -3489,6 +3516,7 @@
 			bool ret = false;
 
 			mutex_lock(&adev->dm.dc_lock);
+			dc_exit_ips_for_hw_access(dc);
 			ret = dc_link_detect(dc_link, DETECT_REASON_HPDRX);
 			mutex_unlock(&adev->dm.dc_lock);
 
@@ -4075,8 +4103,11 @@
 	}
 
 #ifdef AMD_PRIVATE_COLOR
-	if (amdgpu_dm_create_color_properties(adev))
+	if (amdgpu_dm_create_color_properties(adev)) {
+		dc_state_release(state->context);
+		kfree(state);
 		return -ENOMEM;
+	}
 #endif
 
 	r = amdgpu_dm_audio_init(adev);
@@ -4091,6 +4122,7 @@
 
 #define AMDGPU_DM_DEFAULT_MIN_BACKLIGHT 12
 #define AMDGPU_DM_DEFAULT_MAX_BACKLIGHT 255
+#define AMDGPU_DM_MIN_SPREAD ((AMDGPU_DM_DEFAULT_MAX_BACKLIGHT - AMDGPU_DM_DEFAULT_MIN_BACKLIGHT) / 2)
 #define AUX_BL_DEFAULT_TRANSITION_TIME_MS 50
 
 static void amdgpu_dm_update_backlight_caps(struct amdgpu_display_manager *dm,
@@ -4105,6 +4137,21 @@
 		return;
 
 	amdgpu_acpi_get_backlight_caps(&caps);
+
+	/* validate the firmware value is sane */
+	if (caps.caps_valid) {
+		int spread = caps.max_input_signal - caps.min_input_signal;
+
+		if (caps.max_input_signal > AMDGPU_DM_DEFAULT_MAX_BACKLIGHT ||
+		    caps.min_input_signal < 0 ||
+		    spread > AMDGPU_DM_DEFAULT_MAX_BACKLIGHT ||
+		    spread < AMDGPU_DM_MIN_SPREAD) {
+			DRM_DEBUG_KMS("DM: Invalid backlight caps: min=%d, max=%d\n",
+				      caps.min_input_signal, caps.max_input_signal);
+			caps.caps_valid = false;
+		}
+	}
+
 	if (caps.caps_valid) {
 		dm->backlight_caps[bl_idx].caps_valid = true;
 		if (caps.aux_support)
@@ -4179,7 +4226,7 @@
 	struct amdgpu_dm_backlight_caps caps;
 	struct dc_link *link;
 	u32 brightness;
-	bool rc;
+	bool rc, reallow_idle = false;
 
 	amdgpu_dm_update_backlight_caps(dm, bl_idx);
 	caps = dm->backlight_caps[bl_idx];
@@ -4192,6 +4239,12 @@
 	link = (struct dc_link *)dm->backlight_link[bl_idx];
 
 	/* Change brightness based on AUX property */
+	mutex_lock(&dm->dc_lock);
+	if (dm->dc->caps.ips_support && dm->dc->ctx->dmub_srv->idle_allowed) {
+		dc_allow_idle_optimizations(dm->dc, false);
+		reallow_idle = true;
+	}
+
 	if (caps.aux_support) {
 		rc = dc_link_set_backlight_level_nits(link, true, brightness,
 						      AUX_BL_DEFAULT_TRANSITION_TIME_MS);
@@ -4203,6 +4256,11 @@
 			DRM_DEBUG("DM: Failed to update backlight on eDP[%d]\n", bl_idx);
 	}
 
+	if (dm->dc->caps.ips_support && reallow_idle)
+		dc_allow_idle_optimizations(dm->dc, true);
+
+	mutex_unlock(&dm->dc_lock);
+
 	if (rc)
 		dm->actual_brightness[bl_idx] = user_brightness;
 }
@@ -4411,7 +4469,10 @@
 
 	/* There is one primary plane per CRTC */
 	primary_planes = dm->dc->caps.max_streams;
-	ASSERT(primary_planes <= AMDGPU_MAX_PLANES);
+	if (primary_planes > AMDGPU_MAX_PLANES) {
+		DRM_ERROR("DM: Plane nums out of 6 planes\n");
+		return -EINVAL;
+	}
 
 	/*
 	 * Initialize primary planes, implicit planes for legacy IOCTLS.
@@ -4506,17 +4567,17 @@
 		}
 	}
 
+	if (link_cnt > MAX_LINKS) {
+		DRM_ERROR(
+			"KMS: Cannot support more than %d display indexes\n",
+				MAX_LINKS);
+		goto fail;
+	}
+
 	/* loops over all connectors on the board */
 	for (i = 0; i < link_cnt; i++) {
 		struct dc_link *link = NULL;
 
-		if (i > AMDGPU_DM_MAX_DISPLAY_INDEX) {
-			DRM_ERROR(
-				"KMS: Cannot support more than %d display indexes\n",
-					AMDGPU_DM_MAX_DISPLAY_INDEX);
-			continue;
-		}
-
 		link = dc_get_link_at_index(dm->dc, i);
 
 		if (link->connector_signal == SIGNAL_TYPE_VIRTUAL) {
@@ -4571,6 +4632,7 @@
 			bool ret = false;
 
 			mutex_lock(&dm->dc_lock);
+			dc_exit_ips_for_hw_access(dm->dc);
 			ret = dc_link_detect(link, DETECT_REASON_BOOT);
 			mutex_unlock(&dm->dc_lock);
 
@@ -4778,6 +4840,9 @@
 	case IP_VERSION(3, 5, 0):
 		fw_name_dmub = FIRMWARE_DCN_35_DMUB;
 		break;
+	case IP_VERSION(3, 5, 1):
+		fw_name_dmub = FIRMWARE_DCN_351_DMUB;
+		break;
 	default:
 		/* ASIC doesn't support DMUB. */
 		return 0;
@@ -5201,6 +5266,10 @@
  * @new_plane_state: New state of @plane
  * @crtc_state: New state of CRTC connected to the @plane
  * @flip_addrs: DC flip tracking struct, which also tracts dirty rects
+ * @is_psr_su: Flag indicating whether Panel Self Refresh Selective Update (PSR SU) is enabled.
+ *             If PSR SU is enabled and damage clips are available, only the regions of the screen
+ *             that have changed will be updated. If PSR SU is not enabled,
+ *             or if damage clips are not available, the entire screen will be updated.
  * @dirty_regions_changed: dirty regions changed
  *
  * For PSR SU, DC informs the DMUB uController of dirty rectangle regions
@@ -5871,6 +5940,9 @@
 		&aconnector->base.probed_modes :
 		&aconnector->base.modes;
 
+	if (aconnector->base.connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
+		return NULL;
+
 	if (aconnector->freesync_vid_base.clock != 0)
 		return &aconnector->freesync_vid_base;
 
@@ -6254,27 +6326,31 @@
 
 	if (stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
 		mod_build_hf_vsif_infopacket(stream, &stream->vsp_infopacket);
-	else if (stream->signal == SIGNAL_TYPE_DISPLAY_PORT ||
-			 stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST ||
-			 stream->signal == SIGNAL_TYPE_EDP) {
+
+	if (stream->signal == SIGNAL_TYPE_DISPLAY_PORT ||
+	    stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST ||
+	    stream->signal == SIGNAL_TYPE_EDP) {
+		const struct dc_edid_caps *edid_caps;
+		unsigned int disable_colorimetry = 0;
+
+		if (aconnector->dc_sink) {
+			edid_caps = &aconnector->dc_sink->edid_caps;
+			disable_colorimetry = edid_caps->panel_patch.disable_colorimetry;
+		}
+
 		//
 		// should decide stream support vsc sdp colorimetry capability
 		// before building vsc info packet
 		//
-		stream->use_vsc_sdp_for_colorimetry = false;
-		if (aconnector->dc_sink->sink_signal == SIGNAL_TYPE_DISPLAY_PORT_MST) {
-			stream->use_vsc_sdp_for_colorimetry =
-				aconnector->dc_sink->is_vsc_sdp_colorimetry_supported;
-		} else {
-			if (stream->link->dpcd_caps.dprx_feature.bits.VSC_SDP_COLORIMETRY_SUPPORTED)
-				stream->use_vsc_sdp_for_colorimetry = true;
-		}
+		stream->use_vsc_sdp_for_colorimetry = stream->link->dpcd_caps.dpcd_rev.raw >= 0x14 &&
+						      stream->link->dpcd_caps.dprx_feature.bits.VSC_SDP_COLORIMETRY_SUPPORTED &&
+						      !disable_colorimetry;
+
 		if (stream->out_transfer_func->tf == TRANSFER_FUNCTION_GAMMA22)
 			tf = TRANSFER_FUNC_GAMMA_22;
 		mod_build_vsc_infopacket(stream, &stream->vsc_infopacket, stream->output_color_space, tf);
+		aconnector->sr_skip_count = AMDGPU_DM_PSR_ENTRY_DELAY;
 
-		if (stream->link->psr_settings.psr_feature_enabled)
-			aconnector->psr_skip_count = AMDGPU_DM_PSR_ENTRY_DELAY;
 	}
 finish:
 	dc_sink_release(sink);
@@ -6409,10 +6485,104 @@
 	return ret;
 }
 
+/**
+ * DOC: panel power savings
+ *
+ * The display manager allows you to set your desired **panel power savings**
+ * level (between 0-4, with 0 representing off), e.g. using the following::
+ *
+ *   # echo 3 > /sys/class/drm/card0-eDP-1/amdgpu/panel_power_savings
+ *
+ * Modifying this value can have implications on color accuracy, so tread
+ * carefully.
+ */
+
+static ssize_t panel_power_savings_show(struct device *device,
+					struct device_attribute *attr,
+					char *buf)
+{
+	struct drm_connector *connector = dev_get_drvdata(device);
+	struct drm_device *dev = connector->dev;
+	u8 val;
+
+	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
+	val = to_dm_connector_state(connector->state)->abm_level ==
+		ABM_LEVEL_IMMEDIATE_DISABLE ? 0 :
+		to_dm_connector_state(connector->state)->abm_level;
+	drm_modeset_unlock(&dev->mode_config.connection_mutex);
+
+	return sysfs_emit(buf, "%u\n", val);
+}
+
+static ssize_t panel_power_savings_store(struct device *device,
+					 struct device_attribute *attr,
+					 const char *buf, size_t count)
+{
+	struct drm_connector *connector = dev_get_drvdata(device);
+	struct drm_device *dev = connector->dev;
+	long val;
+	int ret;
+
+	ret = kstrtol(buf, 0, &val);
+
+	if (ret)
+		return ret;
+
+	if (val < 0 || val > 4)
+		return -EINVAL;
+
+	drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
+	to_dm_connector_state(connector->state)->abm_level = val ?:
+		ABM_LEVEL_IMMEDIATE_DISABLE;
+	drm_modeset_unlock(&dev->mode_config.connection_mutex);
+
+	drm_kms_helper_hotplug_event(dev);
+
+	return count;
+}
+
+static DEVICE_ATTR_RW(panel_power_savings);
+
+static struct attribute *amdgpu_attrs[] = {
+	&dev_attr_panel_power_savings.attr,
+	NULL
+};
+
+static const struct attribute_group amdgpu_group = {
+	.name = "amdgpu",
+	.attrs = amdgpu_attrs
+};
+
+static bool
+amdgpu_dm_should_create_sysfs(struct amdgpu_dm_connector *amdgpu_dm_connector)
+{
+	if (amdgpu_dm_abm_level >= 0)
+		return false;
+
+	if (amdgpu_dm_connector->base.connector_type != DRM_MODE_CONNECTOR_eDP)
+		return false;
+
+	/* check for OLED panels */
+	if (amdgpu_dm_connector->bl_idx >= 0) {
+		struct drm_device *drm = amdgpu_dm_connector->base.dev;
+		struct amdgpu_display_manager *dm = &drm_to_adev(drm)->dm;
+		struct amdgpu_dm_backlight_caps *caps;
+
+		caps = &dm->backlight_caps[amdgpu_dm_connector->bl_idx];
+		if (caps->aux_support)
+			return false;
+	}
+
+	return true;
+}
+
 static void amdgpu_dm_connector_unregister(struct drm_connector *connector)
 {
 	struct amdgpu_dm_connector *amdgpu_dm_connector = to_amdgpu_dm_connector(connector);
 
+	if (amdgpu_dm_should_create_sysfs(amdgpu_dm_connector))
+		sysfs_remove_group(&connector->kdev->kobj, &amdgpu_group);
+
 	drm_dp_aux_unregister(&amdgpu_dm_connector->dm_dp_aux.aux);
 }
 
@@ -6474,9 +6644,12 @@
 		state->vcpi_slots = 0;
 		state->pbn = 0;
 
-		if (connector->connector_type == DRM_MODE_CONNECTOR_eDP)
-			state->abm_level = amdgpu_dm_abm_level ?:
-				ABM_LEVEL_IMMEDIATE_DISABLE;
+		if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+			if (amdgpu_dm_abm_level <= 0)
+				state->abm_level = ABM_LEVEL_IMMEDIATE_DISABLE;
+			else
+				state->abm_level = amdgpu_dm_abm_level;
+		}
 
 		__drm_atomic_helper_connector_reset(connector, &state->base);
 	}
@@ -6514,6 +6687,13 @@
 		to_amdgpu_dm_connector(connector);
 	int r;
 
+	if (amdgpu_dm_should_create_sysfs(amdgpu_dm_connector)) {
+		r = sysfs_create_group(&connector->kdev->kobj,
+				       &amdgpu_group);
+		if (r)
+			return r;
+	}
+
 	amdgpu_dm_register_backlight_device(amdgpu_dm_connector);
 
 	if ((connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) ||
@@ -6631,7 +6811,8 @@
 		aconnector->dc_sink = aconnector->dc_link->local_sink ?
 		aconnector->dc_link->local_sink :
 		aconnector->dc_em_sink;
-		dc_sink_retain(aconnector->dc_sink);
+		if (aconnector->dc_sink)
+			dc_sink_retain(aconnector->dc_sink);
 	}
 }
 
@@ -6726,6 +6907,14 @@
 	const struct drm_connector_state *drm_state = dm_state ? &dm_state->base : NULL;
 	int requested_bpc = drm_state ? drm_state->max_requested_bpc : 8;
 	enum dc_status dc_result = DC_OK;
+	uint8_t bpc_limit = 6;
+
+	if (!dm_state)
+		return NULL;
+
+	if (aconnector->dc_link->connector_signal == SIGNAL_TYPE_HDMI_TYPE_A ||
+	    aconnector->dc_link->dpcd_caps.dongle_type == DISPLAY_DONGLE_DP_HDMI_CONVERTER)
+		bpc_limit = 8;
 
 	do {
 		stream = create_stream_for_sink(connector, drm_mode,
@@ -6747,11 +6936,12 @@
 			dc_result = dm_validate_stream_and_context(adev->dm.dc, stream);
 
 		if (dc_result != DC_OK) {
-			DRM_DEBUG_KMS("Mode %dx%d (clk %d) failed DC validation with error %d (%s)\n",
+			DRM_DEBUG_KMS("Mode %dx%d (clk %d) pixel_encoding:%s color_depth:%s failed validation -- %s\n",
 				      drm_mode->hdisplay,
 				      drm_mode->vdisplay,
 				      drm_mode->clock,
-				      dc_result,
+				      dc_pixel_encoding_to_str(stream->timing.pixel_encoding),
+				      dc_color_depth_to_str(stream->timing.display_color_depth),
 				      dc_status_to_str(dc_result));
 
 			dc_stream_release(stream);
@@ -6759,10 +6949,13 @@
 			requested_bpc -= 2; /* lower bpc to retry validation */
 		}
 
-	} while (stream == NULL && requested_bpc >= 6);
+	} while (stream == NULL && requested_bpc >= bpc_limit);
 
-	if (dc_result == DC_FAIL_ENC_VALIDATE && !aconnector->force_yuv420_output) {
-		DRM_DEBUG_KMS("Retry forcing YCbCr420 encoding\n");
+	if ((dc_result == DC_FAIL_ENC_VALIDATE ||
+	     dc_result == DC_EXCEED_DONGLE_CAP) &&
+	     !aconnector->force_yuv420_output) {
+		DRM_DEBUG_KMS("%s:%d Retry forcing yuv420 encoding\n",
+				     __func__, __LINE__);
 
 		aconnector->force_yuv420_output = true;
 		stream = create_validate_stream_for_sink(aconnector, drm_mode,
@@ -7054,7 +7247,7 @@
 	struct amdgpu_dm_connector *aconnector;
 	struct dm_connector_state *dm_conn_state;
 	int i, j, ret;
-	int vcpi, pbn_div, pbn, slot_num = 0;
+	int vcpi, pbn_div, pbn = 0, slot_num = 0;
 
 	for_each_new_connector_in_state(state, connector, new_con_state, i) {
 
@@ -7094,7 +7287,7 @@
 			}
 		}
 
-		if (j == dc_state->stream_count)
+		if (j == dc_state->stream_count || pbn_div == 0)
 			continue;
 
 		slot_num = DIV_ROUND_UP(pbn, pbn_div);
@@ -7458,7 +7651,8 @@
 				drm_add_modes_noedid(connector, 1920, 1080);
 	} else {
 		amdgpu_dm_connector_ddc_get_modes(connector, edid);
-		amdgpu_dm_connector_add_common_modes(encoder, connector);
+		if (encoder)
+			amdgpu_dm_connector_add_common_modes(encoder, connector);
 		amdgpu_dm_connector_add_freesync_modes(connector, edid);
 	}
 	amdgpu_dm_fbc_init(connector);
@@ -7548,7 +7742,8 @@
 	aconnector->base.state->max_requested_bpc = aconnector->base.state->max_bpc;
 
 	if (connector_type == DRM_MODE_CONNECTOR_eDP &&
-	    (dc_is_dmcu_initialized(adev->dm.dc) || adev->dm.dc->ctx->dmub_srv)) {
+	    (dc_is_dmcu_initialized(adev->dm.dc) ||
+	     adev->dm.dc->ctx->dmub_srv) && amdgpu_dm_abm_level < 0) {
 		drm_object_attach_property(&aconnector->base.base,
 				adev->mode_info.abm_level_property, 0);
 	}
@@ -8327,7 +8522,7 @@
 			 * during the PSR-SU was disabled.
 			 */
 			if (acrtc_state->stream->link->psr_settings.psr_version >= DC_PSR_VERSION_SU_1 &&
-			    acrtc_attach->dm_irq_params.allow_psr_entry &&
+			    acrtc_attach->dm_irq_params.allow_sr_entry &&
 #ifdef CONFIG_DRM_AMD_SECURE_DISPLAY
 			    !amdgpu_dm_crc_window_is_activated(acrtc_state->base.crtc) &&
 #endif
@@ -8454,15 +8649,13 @@
 				bundle->stream_update.vrr_infopacket =
 					&acrtc_state->stream->vrr_infopacket;
 		}
-	} else if (cursor_update && acrtc_state->active_planes > 0 &&
-		   acrtc_attach->base.state->event) {
-		drm_crtc_vblank_get(pcrtc);
-
+	} else if (cursor_update && acrtc_state->active_planes > 0) {
 		spin_lock_irqsave(&pcrtc->dev->event_lock, flags);
-
-		acrtc_attach->event = acrtc_attach->base.state->event;
-		acrtc_attach->base.state->event = NULL;
-
+		if (acrtc_attach->base.state->event) {
+			drm_crtc_vblank_get(pcrtc);
+			acrtc_attach->event = acrtc_attach->base.state->event;
+			acrtc_attach->base.state->event = NULL;
+		}
 		spin_unlock_irqrestore(&pcrtc->dev->event_lock, flags);
 	}
 
@@ -8551,27 +8744,27 @@
 				!acrtc_state->stream->link->psr_settings.psr_feature_enabled)
 			amdgpu_dm_link_setup_psr(acrtc_state->stream);
 
-		/* Decrement skip count when PSR is enabled and we're doing fast updates. */
+		/* Decrement skip count when SR is enabled and we're doing fast updates. */
 		if (acrtc_state->update_type == UPDATE_TYPE_FAST &&
 		    acrtc_state->stream->link->psr_settings.psr_feature_enabled) {
 			struct amdgpu_dm_connector *aconn =
 				(struct amdgpu_dm_connector *)acrtc_state->stream->dm_stream_context;
 
-			if (aconn->psr_skip_count > 0)
-				aconn->psr_skip_count--;
+			if (aconn->sr_skip_count > 0)
+				aconn->sr_skip_count--;
 
-			/* Allow PSR when skip count is 0. */
-			acrtc_attach->dm_irq_params.allow_psr_entry = !aconn->psr_skip_count;
+			/* Allow SR when skip count is 0. */
+			acrtc_attach->dm_irq_params.allow_sr_entry = !aconn->sr_skip_count;
 
 			/*
-			 * If sink supports PSR SU, there is no need to rely on
-			 * a vblank event disable request to enable PSR. PSR SU
+			 * If sink supports PSR SU/Panel Replay, there is no need to rely on
+			 * a vblank event disable request to enable PSR/RP. PSR SU/RP
 			 * can be enabled immediately once OS demonstrates an
 			 * adequate number of fast atomic commits to notify KMD
 			 * of update events. See `vblank_control_worker()`.
 			 */
-			if (acrtc_state->stream->link->psr_settings.psr_version >= DC_PSR_VERSION_SU_1 &&
-			    acrtc_attach->dm_irq_params.allow_psr_entry &&
+			if (acrtc_state->stream->link->psr_settings.psr_version == DC_PSR_VERSION_SU_1 &&
+			    acrtc_attach->dm_irq_params.allow_sr_entry &&
 #ifdef CONFIG_DRM_AMD_SECURE_DISPLAY
 			    !amdgpu_dm_crc_window_is_activated(acrtc_state->base.crtc) &&
 #endif
@@ -8581,7 +8774,7 @@
 			    500000000)
 				amdgpu_dm_psr_enable(acrtc_state->stream);
 		} else {
-			acrtc_attach->dm_irq_params.allow_psr_entry = false;
+			acrtc_attach->dm_irq_params.allow_sr_entry = false;
 		}
 
 		mutex_unlock(&dm->dc_lock);
@@ -8630,10 +8823,10 @@
 		if (!drm_atomic_crtc_needs_modeset(new_crtc_state))
 			continue;
 
+notify:
 		if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
 			continue;
 
-notify:
 		aconnector = to_amdgpu_dm_connector(connector);
 
 		mutex_lock(&adev->dm.audio_lock);
@@ -8713,6 +8906,7 @@
 	struct drm_connector *connector;
 	bool mode_set_reset_required = false;
 	u32 i;
+	bool set_backlight_level = false;
 
 	/* Disable writeback */
 	for_each_old_connector_in_state(state, connector, old_con_state, i) {
@@ -8732,7 +8926,7 @@
 		if (acrtc)
 			old_crtc_state = drm_atomic_get_old_crtc_state(state, &acrtc->base);
 
-		if (!acrtc->wb_enabled)
+		if (!acrtc || !acrtc->wb_enabled)
 			continue;
 
 		dm_old_crtc_state = to_dm_crtc_state(old_crtc_state);
@@ -8780,7 +8974,8 @@
 
 			memset(&position, 0, sizeof(position));
 			mutex_lock(&dm->dc_lock);
-			dc_stream_set_cursor_position(dm_old_crtc_state->stream, &position);
+			dc_exit_ips_for_hw_access(dm->dc);
+			dc_stream_program_cursor_position(dm_old_crtc_state->stream, &position);
 			mutex_unlock(&dm->dc_lock);
 		}
 
@@ -8828,6 +9023,7 @@
 			acrtc->hw_mode = new_crtc_state->mode;
 			crtc->hwmode = new_crtc_state->mode;
 			mode_set_reset_required = true;
+			set_backlight_level = true;
 		} else if (modereset_required(new_crtc_state)) {
 			DRM_DEBUG_ATOMIC("Atomic commit: RESET. crtc id %d:[%p]\n", acrtc->crtc_id, acrtc);
 			/* i.e. reset mode */
@@ -8848,6 +9044,7 @@
 
 	dm_enable_per_frame_crtc_master_sync(dc_state);
 	mutex_lock(&dm->dc_lock);
+	dc_exit_ips_for_hw_access(dm->dc);
 	WARN_ON(!dc_commit_streams(dm->dc, dc_state->streams, dc_state->stream_count));
 
 	/* Allow idle optimization when vblank count is 0 for display off */
@@ -8875,6 +9072,19 @@
 				acrtc->otg_inst = status->primary_otg_inst;
 		}
 	}
+
+	/* During boot up and resume the DC layer will reset the panel brightness
+	 * to fix a flicker issue.
+	 * It will cause the dm->actual_brightness is not the current panel brightness
+	 * level. (the dm->brightness is the correct panel level)
+	 * So we set the backlight level with dm->brightness value after set mode
+	 */
+	if (set_backlight_level) {
+		for (i = 0; i < dm->num_of_edps; i++) {
+			if (dm->backlight_dev[i])
+				amdgpu_dm_backlight_set_level(dm, i, dm->brightness[i]);
+		}
+	}
 }
 
 static void dm_set_writeback(struct amdgpu_display_manager *dm,
@@ -9003,9 +9213,6 @@
 
 	trace_amdgpu_dm_atomic_commit_tail_begin(state);
 
-	if (dm->dc->caps.ips_support && dm->dc->idle_optimizations_allowed)
-		dc_allow_idle_optimizations(dm->dc, false);
-
 	drm_atomic_helper_update_legacy_modeset_state(dev, state);
 	drm_dp_mst_atomic_wait_for_dependencies(state);
 
@@ -9131,9 +9338,10 @@
 
 			DRM_INFO("[HDCP_DM] hdcp_update_display enable_encryption = %x\n", enable_encryption);
 
-			hdcp_update_display(
-				adev->dm.hdcp_workqueue, aconnector->dc_link->link_index, aconnector,
-				new_con_state->hdcp_content_type, enable_encryption);
+			if (aconnector->dc_link)
+				hdcp_update_display(
+					adev->dm.hdcp_workqueue, aconnector->dc_link->link_index, aconnector,
+					new_con_state->hdcp_content_type, enable_encryption);
 		}
 	}
 
@@ -9216,6 +9424,7 @@
 
 
 		mutex_lock(&dm->dc_lock);
+		dc_exit_ips_for_hw_access(dm->dc);
 		dc_update_planes_and_stream(dm->dc,
 					    dummy_updates,
 					    status->plane_count,
@@ -10280,8 +10489,8 @@
 	int plane_src_w, plane_src_h;
 
 	dm_get_oriented_plane_size(plane_state, &plane_src_w, &plane_src_h);
-	*out_plane_scale_w = plane_state->crtc_w * 1000 / plane_src_w;
-	*out_plane_scale_h = plane_state->crtc_h * 1000 / plane_src_h;
+	*out_plane_scale_w = plane_src_w ? plane_state->crtc_w * 1000 / plane_src_w : 0;
+	*out_plane_scale_h = plane_src_h ? plane_state->crtc_h * 1000 / plane_src_h : 0;
 }
 
 static int dm_check_crtc_cursor(struct drm_atomic_state *state,
@@ -10407,6 +10616,25 @@
 	return drm_dp_mst_add_affected_dsc_crtcs(state, &aconnector->mst_root->mst_mgr);
 }
 
+static bool amdgpu_dm_crtc_mem_type_changed(struct drm_device *dev,
+					    struct drm_atomic_state *state,
+					    struct drm_crtc_state *crtc_state)
+{
+	struct drm_plane *plane;
+	struct drm_plane_state *new_plane_state, *old_plane_state;
+
+	drm_for_each_plane_mask(plane, dev, crtc_state->plane_mask) {
+		new_plane_state = drm_atomic_get_plane_state(state, plane);
+		old_plane_state = drm_atomic_get_plane_state(state, plane);
+
+		if (old_plane_state->fb && new_plane_state->fb &&
+		    get_mem_type(old_plane_state->fb) != get_mem_type(new_plane_state->fb))
+			return true;
+	}
+
+	return false;
+}
+
 /**
  * amdgpu_dm_atomic_check() - Atomic check implementation for AMDgpu DM.
  *
@@ -10451,7 +10679,7 @@
 	struct dm_crtc_state *dm_old_crtc_state, *dm_new_crtc_state;
 	struct drm_dp_mst_topology_mgr *mgr;
 	struct drm_dp_mst_topology_state *mst_state;
-	struct dsc_mst_fairness_vars vars[MAX_PIPES];
+	struct dsc_mst_fairness_vars vars[MAX_PIPES] = {0};
 
 	trace_amdgpu_dm_atomic_check_begin(state);
 
@@ -10578,10 +10806,6 @@
 
 	/* Remove exiting planes if they are modified */
 	for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) {
-		if (old_plane_state->fb && new_plane_state->fb &&
-		    get_mem_type(old_plane_state->fb) !=
-		    get_mem_type(new_plane_state->fb))
-			lock_and_validation_needed = true;
 
 		ret = dm_update_plane_state(dc, state, plane,
 					    old_plane_state,
@@ -10834,9 +11058,11 @@
 
 		/*
 		 * Only allow async flips for fast updates that don't change
-		 * the FB pitch, the DCC state, rotation, etc.
+		 * the FB pitch, the DCC state, rotation, mem_type, etc.
 		 */
-		if (new_crtc_state->async_flip && lock_and_validation_needed) {
+		if (new_crtc_state->async_flip &&
+		    (lock_and_validation_needed ||
+		     amdgpu_dm_crtc_mem_type_changed(dev, state, new_crtc_state))) {
 			drm_dbg_atomic(crtc->dev,
 				       "[CRTC:%d:%s] async flips are only supported for fast updates\n",
 				       crtc->base.id, crtc->name);
@@ -10868,25 +11094,6 @@
 	return ret;
 }
 
-static bool is_dp_capable_without_timing_msa(struct dc *dc,
-					     struct amdgpu_dm_connector *amdgpu_dm_connector)
-{
-	u8 dpcd_data;
-	bool capable = false;
-
-	if (amdgpu_dm_connector->dc_link &&
-		dm_helpers_dp_read_dpcd(
-				NULL,
-				amdgpu_dm_connector->dc_link,
-				DP_DOWN_STREAM_PORT_COUNT,
-				&dpcd_data,
-				sizeof(dpcd_data))) {
-		capable = (dpcd_data & DP_MSA_TIMING_PAR_IGNORED) ? true:false;
-	}
-
-	return capable;
-}
-
 static bool dm_edid_parser_send_cea(struct amdgpu_display_manager *dm,
 		unsigned int offset,
 		unsigned int total_length,
@@ -11017,6 +11224,49 @@
 	return ret;
 }
 
+static void parse_edid_displayid_vrr(struct drm_connector *connector,
+		struct edid *edid)
+{
+	u8 *edid_ext = NULL;
+	int i;
+	int j = 0;
+	u16 min_vfreq;
+	u16 max_vfreq;
+
+	if (edid == NULL || edid->extensions == 0)
+		return;
+
+	/* Find DisplayID extension */
+	for (i = 0; i < edid->extensions; i++) {
+		edid_ext = (void *)(edid + (i + 1));
+		if (edid_ext[0] == DISPLAYID_EXT)
+			break;
+	}
+
+	if (edid_ext == NULL)
+		return;
+
+	while (j < EDID_LENGTH) {
+		/* Get dynamic video timing range from DisplayID if available */
+		if (EDID_LENGTH - j > 13 && edid_ext[j] == 0x25	&&
+		    (edid_ext[j+1] & 0xFE) == 0 && (edid_ext[j+2] == 9)) {
+			min_vfreq = edid_ext[j+9];
+			if (edid_ext[j+1] & 7)
+				max_vfreq = edid_ext[j+10] + ((edid_ext[j+11] & 3) << 8);
+			else
+				max_vfreq = edid_ext[j+10];
+
+			if (max_vfreq && min_vfreq) {
+				connector->display_info.monitor_range.max_vfreq = max_vfreq;
+				connector->display_info.monitor_range.min_vfreq = min_vfreq;
+
+				return;
+			}
+		}
+		j++;
+	}
+}
+
 static int parse_amd_vsdb(struct amdgpu_dm_connector *aconnector,
 			  struct edid *edid, struct amdgpu_hdmi_vsdb_info *vsdb_info)
 {
@@ -11034,7 +11284,7 @@
 			break;
 	}
 
-	while (j < EDID_LENGTH) {
+	while (j < EDID_LENGTH - sizeof(struct amd_vsdb_block)) {
 		struct amd_vsdb_block *amd_vsdb = (struct amd_vsdb_block *)&edid_ext[j];
 		unsigned int ieeeId = (amd_vsdb->ieee_id[2] << 16) | (amd_vsdb->ieee_id[1] << 8) | (amd_vsdb->ieee_id[0]);
 
@@ -11138,18 +11388,31 @@
 	if (!adev->dm.freesync_module)
 		goto update;
 
-	if (sink->sink_signal == SIGNAL_TYPE_DISPLAY_PORT
-		|| sink->sink_signal == SIGNAL_TYPE_EDP) {
+	/* Some eDP panels only have the refresh rate range info in DisplayID */
+	if ((connector->display_info.monitor_range.min_vfreq == 0 ||
+	     connector->display_info.monitor_range.max_vfreq == 0))
+		parse_edid_displayid_vrr(connector, edid);
+
+	if (edid && (sink->sink_signal == SIGNAL_TYPE_DISPLAY_PORT ||
+		     sink->sink_signal == SIGNAL_TYPE_EDP)) {
 		bool edid_check_required = false;
 
-		if (edid) {
-			edid_check_required = is_dp_capable_without_timing_msa(
-						adev->dm.dc,
-						amdgpu_dm_connector);
+		if (amdgpu_dm_connector->dc_link &&
+		    amdgpu_dm_connector->dc_link->dpcd_caps.allow_invalid_MSA_timing_param) {
+			if (edid->features & DRM_EDID_FEATURE_CONTINUOUS_FREQ) {
+				amdgpu_dm_connector->min_vfreq = connector->display_info.monitor_range.min_vfreq;
+				amdgpu_dm_connector->max_vfreq = connector->display_info.monitor_range.max_vfreq;
+				if (amdgpu_dm_connector->max_vfreq -
+				    amdgpu_dm_connector->min_vfreq > 10)
+					freesync_capable = true;
+			} else {
+				edid_check_required = edid->version > 1 ||
+						      (edid->version == 1 &&
+						       edid->revision > 1);
+			}
 		}
 
-		if (edid_check_required == true && (edid->version > 1 ||
-		   (edid->version == 1 && edid->revision > 1))) {
+		if (edid_check_required) {
 			for (i = 0; i < 4; i++) {
 
 				timing	= &edid->detailed_timings[i];
@@ -11243,6 +11506,12 @@
 	if (dm_con_state)
 		dm_con_state->freesync_capable = freesync_capable;
 
+	if (connector->state && amdgpu_dm_connector->dc_link && !freesync_capable &&
+	    amdgpu_dm_connector->dc_link->replay_settings.config.replay_supported) {
+		amdgpu_dm_connector->dc_link->replay_settings.config.replay_supported = false;
+		amdgpu_dm_connector->dc_link->replay_settings.replay_feature_enabled = false;
+	}
+
 	if (connector->vrr_capable_property)
 		drm_connector_set_vrr_capable_property(connector,
 						       freesync_capable);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -50,7 +50,7 @@
 
 #define AMDGPU_DM_MAX_NUM_EDP 2
 
-#define AMDGPU_DMUB_NOTIFICATION_MAX 5
+#define AMDGPU_DMUB_NOTIFICATION_MAX 6
 
 #define HDMI_AMD_VENDOR_SPECIFIC_DATA_BLOCK_IEEE_REGISTRATION_ID 0x00001A
 #define AMD_VSDB_VERSION_3_FEATURECAP_REPLAYMODE 0x40
@@ -692,7 +692,7 @@
 	/* Cached display modes */
 	struct drm_display_mode freesync_vid_base;
 
-	int psr_skip_count;
+	int sr_skip_count;
 
 	/* Record progress status of mst*/
 	uint8_t mst_status;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
@@ -108,9 +108,10 @@
 	else if (dm->active_vblank_irq_count)
 		dm->active_vblank_irq_count--;
 
-	dc_allow_idle_optimizations(dm->dc, dm->active_vblank_irq_count == 0);
-
-	DRM_DEBUG_KMS("Allow idle optimizations (MALL): %d\n", dm->active_vblank_irq_count == 0);
+	if (dm->active_vblank_irq_count > 0) {
+		DRM_DEBUG_KMS("Allow idle optimizations (MALL): false\n");
+		dc_allow_idle_optimizations(dm->dc, false);
+	}
 
 	/*
 	 * Control PSR based on vblank requirements from OS
@@ -132,11 +133,16 @@
 #ifdef CONFIG_DRM_AMD_SECURE_DISPLAY
 			   !amdgpu_dm_crc_window_is_activated(&vblank_work->acrtc->base) &&
 #endif
-			   vblank_work->acrtc->dm_irq_params.allow_psr_entry) {
+			   vblank_work->acrtc->dm_irq_params.allow_sr_entry) {
 			amdgpu_dm_psr_enable(vblank_work->stream);
 		}
 	}
 
+	if (dm->active_vblank_irq_count == 0) {
+		DRM_DEBUG_KMS("Allow idle optimizations (MALL): true\n");
+		dc_allow_idle_optimizations(dm->dc, true);
+	}
+
 	mutex_unlock(&dm->dc_lock);
 
 	dc_stream_release(vblank_work->stream);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -1249,7 +1249,7 @@
 				 size_t size, loff_t *pos)
 {
 	int r;
-	uint8_t data[36];
+	uint8_t data[36] = {0};
 	struct amdgpu_dm_connector *connector = file_inode(f)->i_private;
 	struct dm_crtc_state *acrtc_state;
 	uint32_t write_size = 36;
@@ -1483,7 +1483,7 @@
 	const uint32_t rd_buf_size = 10;
 	struct pipe_ctx *pipe_ctx;
 	ssize_t result = 0;
-	int i, r, str_len = 30;
+	int i, r, str_len = 10;
 
 	rd_buf = kcalloc(rd_buf_size, sizeof(char), GFP_KERNEL);
 
@@ -1495,7 +1495,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -1596,7 +1598,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -1681,7 +1685,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -1780,7 +1786,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -1865,7 +1873,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -1964,7 +1974,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -2045,7 +2057,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -2141,7 +2155,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -2220,7 +2236,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -2276,7 +2294,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -2347,7 +2367,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -2418,7 +2440,9 @@
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe_ctx = &aconnector->dc_link->dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe_ctx->stream &&
-		    pipe_ctx->stream->link == aconnector->dc_link)
+		    pipe_ctx->stream->link == aconnector->dc_link &&
+		    pipe_ctx->stream->sink &&
+		    pipe_ctx->stream->sink == aconnector->dc_sink)
 			break;
 	}
 
@@ -2936,7 +2960,7 @@
 {
 	struct amdgpu_dm_connector *connector = data;
 	struct dc_link *link = connector->dc_link;
-	u32 residency;
+	u32 residency = 0;
 
 	link->dc->link_srv->edp_get_psr_residency(link, &residency);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -72,6 +72,10 @@
 		DRM_DEBUG_DRIVER("Clearing DPCD 0x317 on monitor with panel id %X\n", panel_id);
 		edid_caps->panel_patch.remove_sink_ext_caps = true;
 		break;
+	case drm_edid_encode_panel_id('S', 'D', 'C', 0x4154):
+		DRM_DEBUG_DRIVER("Disabling VSC on monitor with panel id %X\n", panel_id);
+		edid_caps->panel_patch.disable_colorimetry = true;
+		break;
 	default:
 		return;
 	}
@@ -363,7 +367,7 @@
 	mst_state = to_drm_dp_mst_topology_state(mst_mgr->base.state);
 	new_payload = drm_atomic_get_mst_payload_state(mst_state, aconnector->mst_output_port);
 
-	ret = drm_dp_add_payload_part2(mst_mgr, mst_state->base.state, new_payload);
+	ret = drm_dp_add_payload_part2(mst_mgr, new_payload);
 
 	if (ret) {
 		amdgpu_dm_set_mst_status(&aconnector->mst_status,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq_params.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq_params.h
@@ -33,7 +33,7 @@
 	struct mod_vrr_params vrr_params;
 	struct dc_stream_state *stream;
 	int active_planes;
-	bool allow_psr_entry;
+	bool allow_sr_entry;
 	struct mod_freesync_config freesync_config;
 
 #ifdef CONFIG_DEBUG_FS
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -182,6 +182,8 @@
 		dc_sink_release(dc_sink);
 		aconnector->dc_sink = NULL;
 		aconnector->edid = NULL;
+		aconnector->dsc_aux = NULL;
+		port->passthrough_aux = NULL;
 	}
 
 	aconnector->mst_status = MST_STATUS_DEFAULT;
@@ -249,7 +251,7 @@
 		aconnector->dsc_aux = &aconnector->mst_root->dm_dp_aux.aux;
 
 	/* synaptics cascaded MST hub case */
-	if (!aconnector->dsc_aux && is_synaptics_cascaded_panamera(aconnector->dc_link, port))
+	if (is_synaptics_cascaded_panamera(aconnector->dc_link, port))
 		aconnector->dsc_aux = port->mgr->aux;
 
 	if (!aconnector->dsc_aux)
@@ -494,6 +496,8 @@
 		dc_sink_release(aconnector->dc_sink);
 		aconnector->dc_sink = NULL;
 		aconnector->edid = NULL;
+		aconnector->dsc_aux = NULL;
+		port->passthrough_aux = NULL;
 
 		amdgpu_dm_set_mst_status(&aconnector->mst_status,
 			MST_REMOTE_EDID | MST_ALLOCATE_NEW_PAYLOAD | MST_CLEAR_ALLOCATED_PAYLOAD,
@@ -613,6 +617,9 @@
 		&connector->base,
 		dev->mode_config.tile_property,
 		0);
+	connector->colorspace_property = master->base.colorspace_property;
+	if (connector->colorspace_property)
+		drm_connector_attach_colorspace_property(connector);
 
 	drm_connector_set_path_property(connector, pathprop);
 
@@ -1012,6 +1019,7 @@
 	int remaining_to_try = 0;
 	int ret;
 	uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link);
+	int var_pbn;
 
 	for (i = 0; i < count; i++) {
 		if (vars[i + k].dsc_enabled
@@ -1041,26 +1049,34 @@
 		if (next_index == -1)
 			break;
 
+		var_pbn = vars[next_index].pbn;
 		vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.stream_kbps, fec_overhead_multiplier_x1000);
 		ret = drm_dp_atomic_find_time_slots(state,
 						    params[next_index].port->mgr,
 						    params[next_index].port,
 						    vars[next_index].pbn);
-		if (ret < 0)
+		if (ret < 0) {
+			DRM_DEBUG_DRIVER("%s:%d MST_DSC index #%d, failed to set pbn to the state, %d\n",
+						__func__, __LINE__, next_index, ret);
+			vars[next_index].pbn = var_pbn;
 			return ret;
+		}
 
 		ret = drm_dp_mst_atomic_check(state);
 		if (ret == 0) {
 			vars[next_index].dsc_enabled = false;
 			vars[next_index].bpp_x16 = 0;
 		} else {
-			vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.max_kbps, fec_overhead_multiplier_x1000);
+			vars[next_index].pbn = var_pbn;
 			ret = drm_dp_atomic_find_time_slots(state,
 							    params[next_index].port->mgr,
 							    params[next_index].port,
 							    vars[next_index].pbn);
-			if (ret < 0)
+			if (ret < 0) {
+				DRM_DEBUG_DRIVER("%s:%d MST_DSC index #%d, failed to set pbn to the state, %d\n",
+							__func__, __LINE__, next_index, ret);
 				return ret;
+			}
 		}
 
 		tried[next_index] = true;
@@ -1084,6 +1100,7 @@
 	int i, k, ret;
 	bool debugfs_overwrite = false;
 	uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link);
+	struct drm_connector_state *new_conn_state;
 
 	memset(params, 0, sizeof(params));
 
@@ -1106,6 +1123,14 @@
 		if (!aconnector->mst_output_port)
 			continue;
 
+		new_conn_state = drm_atomic_get_new_connector_state(state, &aconnector->base);
+
+		if (!new_conn_state) {
+			DRM_DEBUG_DRIVER("%s:%d MST_DSC Skip the stream 0x%p with invalid new_conn_state\n",
+					__func__, __LINE__, stream);
+			continue;
+		}
+
 		stream->timing.flags.DSC = 0;
 
 		params[count].timing = &stream->timing;
@@ -1119,7 +1144,7 @@
 		params[count].num_slices_v = aconnector->dsc_settings.dsc_num_slices_v;
 		params[count].bpp_overwrite = aconnector->dsc_settings.dsc_bits_per_pixel;
 		params[count].compression_possible = stream->sink->dsc_caps.dsc_dec_caps.is_dsc_supported;
-		dc_dsc_get_policy_for_timing(params[count].timing, 0, &dsc_policy);
+		dc_dsc_get_policy_for_timing(params[count].timing, 0, &dsc_policy, dc_link_get_highest_encoding_format(stream->link));
 		if (!dc_dsc_compute_bandwidth_range(
 				stream->sink->ctx->dc->res_pool->dscs[0],
 				stream->sink->ctx->dc->debug.dsc_min_slice_height_override,
@@ -1135,6 +1160,8 @@
 		count++;
 	}
 
+	DRM_DEBUG_DRIVER("%s: MST_DSC Params set up for %d streams\n", __func__, count);
+
 	if (count == 0) {
 		ASSERT(0);
 		return 0;
@@ -1219,10 +1246,6 @@
 	if (dc_link->type != dc_connection_mst_branch)
 		return false;
 
-	if (!(dc_link->dpcd_caps.dsc_caps.dsc_basic_caps.fields.dsc_support.DSC_SUPPORT ||
-		dc_link->dpcd_caps.dsc_caps.dsc_basic_caps.fields.dsc_support.DSC_PASSTHROUGH_SUPPORT))
-		return false;
-
 	for (i = 0; i < MAX_PIPES; i++)
 		stream_on_link[i] = NULL;
 
@@ -1243,6 +1266,18 @@
 		if (!aconnector)
 			continue;
 
+		/*
+		 *	Check if cached virtual MST DSC caps are available and DSC is supported
+		 *	this change takes care of newer MST DSC capable devices that report their
+		 *	DPCD caps as per specifications in their Virtual DPCD registers.
+
+		 *	TODO: implement the check for older MST DSC devices that do not conform to
+		 *	specifications.
+		*/
+		if (!(aconnector->dc_sink->dsc_caps.dsc_dec_caps.is_dsc_supported ||
+			aconnector->dc_link->dpcd_caps.dsc_caps.dsc_basic_caps.fields.dsc_support.DSC_PASSTHROUGH_SUPPORT))
+			continue;
+
 		stream_on_link[new_stream_on_link_num] = aconnector;
 		new_stream_on_link_num++;
 
@@ -1586,7 +1621,7 @@
 {
 	struct dc_dsc_policy dsc_policy = {0};
 
-	dc_dsc_get_policy_for_timing(&stream->timing, 0, &dsc_policy);
+	dc_dsc_get_policy_for_timing(&stream->timing, 0, &dsc_policy, dc_link_get_highest_encoding_format(stream->link));
 	dc_dsc_compute_bandwidth_range(stream->sink->ctx->dc->res_pool->dscs[0],
 				       stream->sink->ctx->dc->debug.dsc_min_slice_height_override,
 				       dsc_policy.min_target_bpp * 16,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
@@ -28,6 +28,7 @@
 #include <drm/drm_blend.h>
 #include <drm/drm_gem_atomic_helper.h>
 #include <drm/drm_plane_helper.h>
+#include <drm/drm_gem_framebuffer_helper.h>
 #include <drm/drm_fourcc.h>
 
 #include "amdgpu.h"
@@ -854,10 +855,14 @@
 	}
 
 	afb = to_amdgpu_framebuffer(new_state->fb);
-	obj = new_state->fb->obj[0];
+	obj = drm_gem_fb_get_obj(new_state->fb, 0);
+	if (!obj) {
+		DRM_ERROR("Failed to get obj from framebuffer\n");
+		return -EINVAL;
+	}
+
 	rbo = gem_to_amdgpu_bo(obj);
 	adev = amdgpu_ttm_adev(rbo->tbo.bdev);
-
 	r = amdgpu_bo_reserve(rbo, true);
 	if (r) {
 		dev_err(adev->dev, "fail to reserve bo (%d)\n", r);
@@ -1254,7 +1259,7 @@
 		/* turn off cursor */
 		if (crtc_state && crtc_state->stream) {
 			mutex_lock(&adev->dm.dc_lock);
-			dc_stream_set_cursor_position(crtc_state->stream,
+			dc_stream_program_cursor_position(crtc_state->stream,
 						      &position);
 			mutex_unlock(&adev->dm.dc_lock);
 		}
@@ -1280,15 +1285,16 @@
 	    adev->dm.dc->caps.color.dpp.gamma_corr)
 		attributes.attribute_flags.bits.ENABLE_CURSOR_DEGAMMA = 1;
 
-	attributes.pitch = afb->base.pitches[0] / afb->base.format->cpp[0];
+	if (afb)
+		attributes.pitch = afb->base.pitches[0] / afb->base.format->cpp[0];
 
 	if (crtc_state->stream) {
 		mutex_lock(&adev->dm.dc_lock);
-		if (!dc_stream_set_cursor_attributes(crtc_state->stream,
+		if (!dc_stream_program_cursor_attributes(crtc_state->stream,
 							 &attributes))
 			DRM_ERROR("DC failed to set cursor attributes\n");
 
-		if (!dc_stream_set_cursor_position(crtc_state->stream,
+		if (!dc_stream_program_cursor_position(crtc_state->stream,
 						   &position))
 			DRM_ERROR("DC failed to set cursor position\n");
 		mutex_unlock(&adev->dm.dc_lock);
@@ -1395,8 +1401,6 @@
 	const struct drm_format_info *info = drm_format_info(format);
 	int i;
 
-	enum dm_micro_swizzle microtile = amdgpu_dm_plane_modifier_gfx9_swizzle_mode(modifier) & 3;
-
 	if (!info)
 		return false;
 
@@ -1418,29 +1422,34 @@
 	if (i == plane->modifier_count)
 		return false;
 
-	/*
-	 * For D swizzle the canonical modifier depends on the bpp, so check
-	 * it here.
-	 */
-	if (AMD_FMT_MOD_GET(TILE_VERSION, modifier) == AMD_FMT_MOD_TILE_VER_GFX9 &&
-	    adev->family >= AMDGPU_FAMILY_NV) {
-		if (microtile == MICRO_SWIZZLE_D && info->cpp[0] == 4)
-			return false;
-	}
+	/* GFX12 doesn't have these limitations. */
+	if (AMD_FMT_MOD_GET(TILE_VERSION, modifier) <= AMD_FMT_MOD_TILE_VER_GFX11) {
+		enum dm_micro_swizzle microtile = amdgpu_dm_plane_modifier_gfx9_swizzle_mode(modifier) & 3;
 
-	if (adev->family >= AMDGPU_FAMILY_RV && microtile == MICRO_SWIZZLE_D &&
-	    info->cpp[0] < 8)
-		return false;
-
-	if (amdgpu_dm_plane_modifier_has_dcc(modifier)) {
-		/* Per radeonsi comments 16/64 bpp are more complicated. */
-		if (info->cpp[0] != 4)
-			return false;
-		/* We support multi-planar formats, but not when combined with
-		 * additional DCC metadata planes.
+		/*
+		 * For D swizzle the canonical modifier depends on the bpp, so check
+		 * it here.
 		 */
-		if (info->num_planes > 1)
+		if (AMD_FMT_MOD_GET(TILE_VERSION, modifier) == AMD_FMT_MOD_TILE_VER_GFX9 &&
+		    adev->family >= AMDGPU_FAMILY_NV) {
+			if (microtile == MICRO_SWIZZLE_D && info->cpp[0] == 4)
+				return false;
+		}
+
+		if (adev->family >= AMDGPU_FAMILY_RV && microtile == MICRO_SWIZZLE_D &&
+		    info->cpp[0] < 8)
 			return false;
+
+		if (amdgpu_dm_plane_modifier_has_dcc(modifier)) {
+			/* Per radeonsi comments 16/64 bpp are more complicated. */
+			if (info->cpp[0] != 4)
+				return false;
+			/* We support multi-planar formats, but not when combined with
+			 * additional DCC metadata planes.
+			 */
+			if (info->num_planes > 1)
+				return false;
+		}
 	}
 
 	return true;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c
@@ -141,9 +141,8 @@
  * amdgpu_dm_psr_enable() - enable psr f/w
  * @stream: stream state
  *
- * Return: true if success
  */
-bool amdgpu_dm_psr_enable(struct dc_stream_state *stream)
+void amdgpu_dm_psr_enable(struct dc_stream_state *stream)
 {
 	struct dc_link *link = stream->link;
 	unsigned int vsync_rate_hz = 0;
@@ -190,7 +189,10 @@
 	if (link->psr_settings.psr_version < DC_PSR_VERSION_SU_1)
 		power_opt |= psr_power_opt_z10_static_screen;
 
-	return dc_link_set_psr_allow_active(link, &psr_enable, false, false, &power_opt);
+	dc_link_set_psr_allow_active(link, &psr_enable, false, false, &power_opt);
+
+	if (link->ctx->dc->caps.ips_support)
+		dc_allow_idle_optimizations(link->ctx->dc, true);
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.h
@@ -32,7 +32,7 @@
 #define AMDGPU_DM_PSR_ENTRY_DELAY 5
 
 void amdgpu_dm_set_psr_caps(struct dc_link *link);
-bool amdgpu_dm_psr_enable(struct dc_stream_state *stream);
+void amdgpu_dm_psr_enable(struct dc_stream_state *stream);
 bool amdgpu_dm_link_setup_psr(struct dc_stream_state *stream);
 bool amdgpu_dm_psr_disable(struct dc_stream_state *stream);
 bool amdgpu_dm_psr_disable_all(struct amdgpu_display_manager *dm);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c
@@ -76,10 +76,8 @@
 
 static int amdgpu_dm_wb_connector_get_modes(struct drm_connector *connector)
 {
-	struct drm_device *dev = connector->dev;
-
-	return drm_add_modes_noedid(connector, dev->mode_config.max_width,
-				    dev->mode_config.max_height);
+	/* Maximum resolution supported by DWB */
+	return drm_add_modes_noedid(connector, 3840, 2160);
 }
 
 static int amdgpu_dm_wb_prepare_job(struct drm_writeback_connector *wb_connector,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
@@ -667,6 +667,9 @@
 	ss_table_header_include = ((ATOM_ASIC_INTERNAL_SS_INFO_V3 *) bios_get_image(&bp->base,
 				DATA_TABLES(ASIC_InternalSS_Info),
 				struct_size(ss_table_header_include, asSpreadSpectrum, 1)));
+	if (!ss_table_header_include)
+		return BP_RESULT_UNSUPPORTED;
+
 	table_size =
 		(le16_to_cpu(ss_table_header_include->sHeader.usStructureSize)
 				- sizeof(ATOM_COMMON_TABLE_HEADER))
@@ -1036,6 +1039,8 @@
 				&bp->base,
 				DATA_TABLES(ASIC_InternalSS_Info),
 				struct_size(header, asSpreadSpectrum, 1)));
+	if (!header)
+		return result;
 
 	memset(info, 0, sizeof(struct spread_spectrum_info));
 
@@ -1109,6 +1114,8 @@
 	get_atom_data_table_revision(header, &revision);
 
 	tbl = GET_IMAGE(ATOM_SPREAD_SPECTRUM_INFO, DATA_TABLES(SS_Info));
+	if (!tbl)
+		return result;
 
 	if (1 != revision.major || 2 > revision.minor)
 		return result;
@@ -1636,6 +1643,8 @@
 
 	tbl = GET_IMAGE(ATOM_SPREAD_SPECTRUM_INFO,
 			DATA_TABLES(SS_Info));
+	if (!tbl)
+		return number;
 
 	if (1 != revision.major || 2 > revision.minor)
 		return number;
@@ -1718,6 +1727,8 @@
 				&bp->base,
 				DATA_TABLES(ASIC_InternalSS_Info),
 				struct_size(header_include, asSpreadSpectrum, 1)));
+	if (!header_include)
+		return 0;
 
 	size = (le16_to_cpu(header_include->sHeader.usStructureSize)
 			- sizeof(ATOM_COMMON_TABLE_HEADER))
@@ -1756,6 +1767,9 @@
 	header_include = ((ATOM_ASIC_INTERNAL_SS_INFO_V3 *) bios_get_image(&bp->base,
 				DATA_TABLES(ASIC_InternalSS_Info),
 				struct_size(header_include, asSpreadSpectrum, 1)));
+	if (!header_include)
+		return number;
+
 	size = (le16_to_cpu(header_include->sHeader.usStructureSize) -
 			sizeof(ATOM_COMMON_TABLE_HEADER)) /
 					sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3);
@@ -2552,8 +2566,8 @@
 
 	/* Sort voltage table from low to high*/
 	if (result == BP_RESULT_OK) {
-		uint32_t i;
-		uint32_t j;
+		int32_t i;
+		int32_t j;
 
 		for (i = 1; i < NUMBER_OF_DISP_CLK_VOLTAGE; ++i) {
 			for (j = i; j > 0; --j) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
@@ -2922,8 +2922,11 @@
 	struct atom_common_table_header *header;
 	struct atom_data_revision revision;
 
-	uint32_t i;
-	uint32_t j;
+	int32_t i;
+	int32_t j;
+
+	if (!info)
+		return result;
 
 	if (info && DATA_TABLES(integratedsysteminfo)) {
 		header = GET_IMAGE(struct atom_common_table_header,
@@ -2948,6 +2951,7 @@
 				result = get_integrated_info_v2_1(bp, info);
 				break;
 			case 2:
+			case 3:
 				result = get_integrated_info_v2_2(bp, info);
 				break;
 			default:
@@ -3037,7 +3041,7 @@
 		struct dc_vram_info *info)
 {
 	struct bios_parser *bp = BP_FROM_DCB(dcb);
-	static enum bp_result result = BP_RESULT_BADBIOSTABLE;
+	enum bp_result result = BP_RESULT_BADBIOSTABLE;
 	struct atom_common_table_header *header;
 	struct atom_data_revision revision;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/bios/command_table.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/bios/command_table.c
@@ -37,7 +37,7 @@
 #define EXEC_BIOS_CMD_TABLE(command, params)\
 	(amdgpu_atom_execute_table(((struct amdgpu_device *)bp->base.ctx->driver_context)->mode_info.atom_context, \
 		GetIndexIntoMasterTable(COMMAND, command), \
-		(uint32_t *)&params) == 0)
+		(uint32_t *)&params, sizeof(params)) == 0)
 
 #define BIOS_CMD_TABLE_REVISION(command, frev, crev)\
 	amdgpu_atom_parse_cmd_header(((struct amdgpu_device *)bp->base.ctx->driver_context)->mode_info.atom_context, \
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/bios/command_table2.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/bios/command_table2.c
@@ -49,7 +49,7 @@
 #define EXEC_BIOS_CMD_TABLE(fname, params)\
 	(amdgpu_atom_execute_table(((struct amdgpu_device *)bp->base.ctx->driver_context)->mode_info.atom_context, \
 		GET_INDEX_INTO_MASTER_TABLE(command, fname), \
-		(uint32_t *)&params) == 0)
+		(uint32_t *)&params, sizeof(params)) == 0)
 
 #define BIOS_CMD_TABLE_REVISION(fname, frev, crev)\
 	amdgpu_atom_parse_cmd_header(((struct amdgpu_device *)bp->base.ctx->driver_context)->mode_info.atom_context, \
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
@@ -195,7 +195,7 @@
 	 * , then change minimum memory clock based on real-time bandwidth
 	 * limitation.
 	 */
-	if ((dc->ctx->asic_id.chip_family == FAMILY_AI) &&
+	if (dc->bw_vbios && (dc->ctx->asic_id.chip_family == FAMILY_AI) &&
 	     ASICREV_IS_VEGA20_P(dc->ctx->asic_id.hw_internal_rev) && (context->stream_count >= 2)) {
 		pp_display_cfg->min_memory_clock_khz = max(pp_display_cfg->min_memory_clock_khz,
 							   (uint32_t) div64_s64(
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
@@ -503,7 +503,7 @@
 
 	clk_mgr->cur_phyclk_req_table[link->link_index] = link->cur_link_settings.link_rate * LINK_RATE_REF_FREQ_IN_KHZ;
 
-	for (i = 0; i < MAX_PIPES * 2; i++) {
+	for (i = 0; i < MAX_LINKS; i++) {
 		if (clk_mgr->cur_phyclk_req_table[i] > max_phyclk_req)
 			max_phyclk_req = clk_mgr->cur_phyclk_req_table[i];
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
@@ -484,7 +484,8 @@
 			ranges->reader_wm_sets[num_valid_sets].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX;
 
 			/* Modify previous watermark range to cover up to max */
-			ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX;
+			if (num_valid_sets > 0)
+				ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX;
 		}
 		num_valid_sets++;
 	}
@@ -548,7 +549,7 @@
 
 	clk_mgr->cur_phyclk_req_table[link->link_index] = link->cur_link_settings.link_rate * LINK_RATE_REF_FREQ_IN_KHZ;
 
-	for (i = 0; i < MAX_PIPES * 2; i++) {
+	for (i = 0; i < MAX_LINKS; i++) {
 		if (clk_mgr->cur_phyclk_req_table[i] > max_phyclk_req)
 			max_phyclk_req = clk_mgr->cur_phyclk_req_table[i];
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
@@ -474,7 +474,7 @@
 
 	clk_mgr->cur_phyclk_req_table[link->link_index] = link->cur_link_settings.link_rate * LINK_RATE_REF_FREQ_IN_KHZ;
 
-	for (i = 0; i < MAX_PIPES * 2; i++) {
+	for (i = 0; i < MAX_LINKS; i++) {
 		if (clk_mgr->cur_phyclk_req_table[i] > max_phyclk_req)
 			max_phyclk_req = clk_mgr->cur_phyclk_req_table[i];
 	}
@@ -560,11 +560,19 @@
 	dce_clock_read_ss_info(clk_mgr);
 
 	clk_mgr->base.bw_params = kzalloc(sizeof(*clk_mgr->base.bw_params), GFP_KERNEL);
+	if (!clk_mgr->base.bw_params) {
+		BREAK_TO_DEBUGGER();
+		return;
+	}
 
 	/* need physical address of table to give to PMFW */
 	clk_mgr->wm_range_table = dm_helpers_allocate_gpu_mem(clk_mgr->base.ctx,
 			DC_MEM_ALLOC_TYPE_GART, sizeof(WatermarksExternal_t),
 			&clk_mgr->wm_range_table_addr);
+	if (!clk_mgr->wm_range_table) {
+		BREAK_TO_DEBUGGER();
+		return;
+	}
 }
 
 void dcn3_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
@@ -145,6 +145,10 @@
 	 */
 	clk_mgr_base->clks.zstate_support = new_clocks->zstate_support;
 	if (safe_to_lower) {
+		if (clk_mgr_base->clks.dtbclk_en && !new_clocks->dtbclk_en) {
+			dcn315_smu_set_dtbclk(clk_mgr, false);
+			clk_mgr_base->clks.dtbclk_en = new_clocks->dtbclk_en;
+		}
 		/* check that we're not already in lower */
 		if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_LOW_POWER) {
 			display_count = dcn315_get_active_display_cnt_wa(dc, context);
@@ -160,6 +164,10 @@
 			}
 		}
 	} else {
+		if (!clk_mgr_base->clks.dtbclk_en && new_clocks->dtbclk_en) {
+			dcn315_smu_set_dtbclk(clk_mgr, true);
+			clk_mgr_base->clks.dtbclk_en = new_clocks->dtbclk_en;
+		}
 		/* check that we're not already in D0 */
 		if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_MISSION_MODE) {
 			union display_idle_optimization_u idle_info = { 0 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c
@@ -99,20 +99,25 @@
 	return display_count;
 }
 
-static void dcn316_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state *context, bool disable)
+static void dcn316_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state *context,
+		bool safe_to_lower, bool disable)
 {
 	struct dc *dc = clk_mgr_base->ctx->dc;
 	int i;
 
 	for (i = 0; i < dc->res_pool->pipe_count; ++i) {
-		struct pipe_ctx *pipe = &dc->current_state->res_ctx.pipe_ctx[i];
+		struct pipe_ctx *pipe = safe_to_lower
+			? &context->res_ctx.pipe_ctx[i]
+			: &dc->current_state->res_ctx.pipe_ctx[i];
 
 		if (pipe->top_pipe || pipe->prev_odm_pipe)
 			continue;
-		if (pipe->stream && (pipe->stream->dpms_off || pipe->plane_state == NULL ||
-				     dc_is_virtual_signal(pipe->stream->signal))) {
+		if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal) ||
+				     !pipe->stream->link_enc)) {
 			if (disable) {
-				pipe->stream_res.tg->funcs->immediate_disable_crtc(pipe->stream_res.tg);
+				if (pipe->stream_res.tg && pipe->stream_res.tg->funcs->immediate_disable_crtc)
+					pipe->stream_res.tg->funcs->immediate_disable_crtc(pipe->stream_res.tg);
+
 				reset_sync_context_for_pipe(dc, context, i);
 			} else
 				pipe->stream_res.tg->funcs->enable_crtc(pipe->stream_res.tg);
@@ -207,11 +212,11 @@
 	}
 
 	if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz)) {
-		dcn316_disable_otg_wa(clk_mgr_base, context, true);
+		dcn316_disable_otg_wa(clk_mgr_base, context, safe_to_lower, true);
 
 		clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz;
 		dcn316_smu_set_dispclk(clk_mgr, clk_mgr_base->clks.dispclk_khz);
-		dcn316_disable_otg_wa(clk_mgr_base, context, false);
+		dcn316_disable_otg_wa(clk_mgr_base, context, safe_to_lower, false);
 
 		update_dispclk = true;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
@@ -216,6 +216,16 @@
 	if (clk_mgr_base->bw_params->dc_mode_limit.dispclk_mhz > 1950)
 		clk_mgr_base->bw_params->dc_mode_limit.dispclk_mhz = 1950;
 
+	/* DPPCLK */
+	dcn32_init_single_clock(clk_mgr, PPCLK_DPPCLK,
+			&clk_mgr_base->bw_params->clk_table.entries[0].dppclk_mhz,
+			&num_entries_per_clk->num_dppclk_levels);
+	num_levels = num_entries_per_clk->num_dppclk_levels;
+	clk_mgr_base->bw_params->dc_mode_limit.dppclk_mhz = dcn30_smu_get_dc_mode_max_dpm_freq(clk_mgr, PPCLK_DPPCLK);
+	//HW recommends limit of 1950 MHz in display clock for all DCN3.2.x
+	if (clk_mgr_base->bw_params->dc_mode_limit.dppclk_mhz > 1950)
+		clk_mgr_base->bw_params->dc_mode_limit.dppclk_mhz = 1950;
+
 	if (num_entries_per_clk->num_dcfclk_levels &&
 			num_entries_per_clk->num_dtbclk_levels &&
 			num_entries_per_clk->num_dispclk_levels)
@@ -240,6 +250,10 @@
 					= khz_to_mhz_ceil(clk_mgr_base->ctx->dc->debug.min_dpp_clk_khz);
 	}
 
+	for (i = 0; i < num_levels; i++)
+		if (clk_mgr_base->bw_params->clk_table.entries[i].dppclk_mhz > 1950)
+			clk_mgr_base->bw_params->clk_table.entries[i].dppclk_mhz = 1950;
+
 	/* Get UCLK, update bounding box */
 	clk_mgr_base->funcs->get_memclk_states_from_smu(clk_mgr_base);
 
@@ -682,8 +696,12 @@
 					 * since we calculate mode support based on softmax being the max UCLK
 					 * frequency.
 					 */
-					dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK,
-							dc->clk_mgr->bw_params->dc_mode_softmax_memclk);
+					if (dc->debug.disable_dc_mode_overwrite) {
+						dcn30_smu_set_hard_max_by_freq(clk_mgr, PPCLK_UCLK, dc->clk_mgr->bw_params->max_memclk_mhz);
+						dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK, dc->clk_mgr->bw_params->max_memclk_mhz);
+					} else
+						dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK,
+								dc->clk_mgr->bw_params->dc_mode_softmax_memclk);
 				} else {
 					dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK, dc->clk_mgr->bw_params->max_memclk_mhz);
 				}
@@ -716,8 +734,13 @@
 		/* set UCLK to requested value if P-State switching is supported, or to re-enable P-State switching */
 		if (clk_mgr_base->clks.p_state_change_support &&
 				(update_uclk || !clk_mgr_base->clks.prev_p_state_change_support) &&
-				!dc->work_arounds.clock_update_disable_mask.uclk)
+				!dc->work_arounds.clock_update_disable_mask.uclk) {
+			if (dc->clk_mgr->dc_mode_softmax_enabled && dc->debug.disable_dc_mode_overwrite)
+				dcn30_smu_set_hard_max_by_freq(clk_mgr, PPCLK_UCLK,
+						max((int)dc->clk_mgr->bw_params->dc_mode_softmax_memclk, khz_to_mhz_ceil(clk_mgr_base->clks.dramclk_khz)));
+
 			dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK, khz_to_mhz_ceil(clk_mgr_base->clks.dramclk_khz));
+		}
 
 		if (clk_mgr_base->clks.num_ways != new_clocks->num_ways &&
 				clk_mgr_base->clks.num_ways > new_clocks->num_ways) {
@@ -1153,11 +1176,19 @@
 	clk_mgr->smu_present = false;
 
 	clk_mgr->base.bw_params = kzalloc(sizeof(*clk_mgr->base.bw_params), GFP_KERNEL);
+	if (!clk_mgr->base.bw_params) {
+		BREAK_TO_DEBUGGER();
+		return;
+	}
 
 	/* need physical address of table to give to PMFW */
 	clk_mgr->wm_range_table = dm_helpers_allocate_gpu_mem(clk_mgr->base.ctx,
 			DC_MEM_ALLOC_TYPE_GART, sizeof(WatermarksExternal_t),
 			&clk_mgr->wm_range_table_addr);
+	if (!clk_mgr->wm_range_table) {
+		BREAK_TO_DEBUGGER();
+		return;
+	}
 }
 
 void dcn32_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
@@ -384,19 +384,6 @@
 	dcn35_smu_enable_pme_wa(clk_mgr);
 }
 
-void dcn35_init_clocks(struct clk_mgr *clk_mgr)
-{
-	uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
-
-	memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
-
-	// Assumption is that boot state always supports pstate
-	clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk;	// restore ref_dtbclk
-	clk_mgr->clks.p_state_change_support = true;
-	clk_mgr->clks.prev_p_state_change_support = true;
-	clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN;
-	clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN;
-}
 
 bool dcn35_are_clock_states_equal(struct dc_clocks *a,
 		struct dc_clocks *b)
@@ -421,7 +408,19 @@
 		struct clk_mgr_dcn35 *clk_mgr)
 {
 }
+void dcn35_init_clocks(struct clk_mgr *clk_mgr)
+{
+	uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
 
+	memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
+
+	// Assumption is that boot state always supports pstate
+	clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk;	// restore ref_dtbclk
+	clk_mgr->clks.p_state_change_support = true;
+	clk_mgr->clks.prev_p_state_change_support = true;
+	clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN;
+	clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN;
+}
 static struct clk_bw_params dcn35_bw_params = {
 	.vram_type = Ddr4MemType,
 	.num_channels = 1,
@@ -706,7 +705,7 @@
 		clock_table->NumFclkLevelsEnabled;
 	max_fclk = find_max_clk_value(clock_table->FclkClocks_Freq, num_fclk);
 
-	num_dcfclk = (clock_table->NumFclkLevelsEnabled > NUM_DCFCLK_DPM_LEVELS) ? NUM_DCFCLK_DPM_LEVELS :
+	num_dcfclk = (clock_table->NumDcfClkLevelsEnabled > NUM_DCFCLK_DPM_LEVELS) ? NUM_DCFCLK_DPM_LEVELS :
 		clock_table->NumDcfClkLevelsEnabled;
 	for (i = 0; i < num_dcfclk; i++) {
 		int j;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -212,7 +212,8 @@
 		connectors_num,
 		num_virtual_links);
 
-	for (i = 0; i < connectors_num; i++) {
+	// condition loop on link_count to allow skipping invalid indices
+	for (i = 0; dc->link_count < connectors_num && i < MAX_LINKS; i++) {
 		struct link_init_data link_init_params = {0};
 		struct dc_link *link;
 
@@ -411,9 +412,14 @@
 	 * avoid conflicting with firmware updates.
 	 */
 	if (dc->ctx->dce_version > DCE_VERSION_MAX)
-		if (dc->optimized_required || dc->wm_optimized_required)
+		if (dc->optimized_required)
 			return false;
 
+	if (!memcmp(&stream->adjust, adjust, sizeof(*adjust)))
+		return true;
+
+	dc_exit_ips_for_hw_access(dc);
+
 	stream->adjust.v_total_max = adjust->v_total_max;
 	stream->adjust.v_total_mid = adjust->v_total_mid;
 	stream->adjust.v_total_mid_frame_num = adjust->v_total_mid_frame_num;
@@ -454,6 +460,8 @@
 
 	int i = 0;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		struct pipe_ctx *pipe = &dc->current_state->res_ctx.pipe_ctx[i];
 
@@ -484,6 +492,8 @@
 	bool ret = false;
 	struct crtc_position position;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		struct pipe_ctx *pipe =
 				&dc->current_state->res_ctx.pipe_ctx[i];
@@ -603,6 +613,8 @@
 	if (pipe == NULL)
 		return false;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	/* By default, capture the full frame */
 	param.windowa_x_start = 0;
 	param.windowa_y_start = 0;
@@ -662,6 +674,8 @@
 	struct pipe_ctx *pipe;
 	struct timing_generator *tg;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		pipe = &dc->current_state->res_ctx.pipe_ctx[i];
 		if (pipe->stream == stream)
@@ -686,6 +700,8 @@
 	int i;
 	struct pipe_ctx *pipe_ctx;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		if (dc->current_state->res_ctx.pipe_ctx[i].stream
 				== stream) {
@@ -721,6 +737,8 @@
 	if (option > DITHER_OPTION_MAX)
 		return;
 
+	dc_exit_ips_for_hw_access(stream->ctx->dc);
+
 	stream->dither_option = option;
 
 	memset(&params, 0, sizeof(params));
@@ -745,6 +763,8 @@
 	bool ret = false;
 	struct pipe_ctx *pipes;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		if (dc->current_state->res_ctx.pipe_ctx[i].stream == stream) {
 			pipes = &dc->current_state->res_ctx.pipe_ctx[i];
@@ -762,6 +782,8 @@
 	bool ret = false;
 	struct pipe_ctx *pipes;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		if (dc->current_state->res_ctx.pipe_ctx[i].stream
 				== stream) {
@@ -788,6 +810,8 @@
 	struct pipe_ctx *pipes_affected[MAX_PIPES];
 	int num_pipes_affected = 0;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < num_streams; i++) {
 		struct dc_stream_state *stream = streams[i];
 
@@ -1282,6 +1306,54 @@
 	}
 }
 
+/**
+ * wait_for_blank_complete - wait for all active OPPs to finish pending blank
+ * pattern updates
+ *
+ * @dc: [in] dc reference
+ * @context: [in] hardware context in use
+ */
+static void wait_for_blank_complete(struct dc *dc,
+		struct dc_state *context)
+{
+	struct pipe_ctx *opp_head;
+	struct dce_hwseq *hws = dc->hwseq;
+	int i;
+
+	if (!hws->funcs.wait_for_blank_complete)
+		return;
+
+	for (i = 0; i < MAX_PIPES; i++) {
+		opp_head = &context->res_ctx.pipe_ctx[i];
+
+		if (!resource_is_pipe_type(opp_head, OPP_HEAD) ||
+				dc_state_get_pipe_subvp_type(context, opp_head) == SUBVP_PHANTOM)
+			continue;
+
+		hws->funcs.wait_for_blank_complete(opp_head->stream_res.opp);
+	}
+}
+
+static void wait_for_odm_update_pending_complete(struct dc *dc, struct dc_state *context)
+{
+	struct pipe_ctx *otg_master;
+	struct timing_generator *tg;
+	int i;
+
+	for (i = 0; i < MAX_PIPES; i++) {
+		otg_master = &context->res_ctx.pipe_ctx[i];
+		if (!resource_is_pipe_type(otg_master, OTG_MASTER) ||
+				dc_state_get_pipe_subvp_type(context, otg_master) == SUBVP_PHANTOM)
+			continue;
+		tg = otg_master->stream_res.tg;
+		if (tg->funcs->wait_odm_doublebuffer_pending_clear)
+			tg->funcs->wait_odm_doublebuffer_pending_clear(tg);
+	}
+
+	/* ODM update may require to reprogram blank pattern for each OPP */
+	wait_for_blank_complete(dc, context);
+}
+
 static void wait_for_no_pipes_pending(struct dc *dc, struct dc_state *context)
 {
 	int i;
@@ -1319,6 +1391,7 @@
 		return NULL;
 
 	if (init_params->dce_environment == DCE_ENV_VIRTUAL_HW) {
+		dc->caps.linear_pitch_alignment = 64;
 		if (!dc_construct_ctx(dc, init_params))
 			goto destruct_dc;
 	} else {
@@ -1713,7 +1786,7 @@
 		if (crtc_timing->pix_clk_100hz != pix_clk_100hz)
 			return false;
 
-		if (!se->funcs->dp_get_pixel_format)
+		if (!se || !se->funcs->dp_get_pixel_format)
 			return false;
 
 		if (!se->funcs->dp_get_pixel_format(
@@ -1733,6 +1806,9 @@
 		return false;
 	}
 
+	if (link->dpcd_caps.channel_coding_cap.bits.DP_128b_132b_SUPPORTED)
+		return false;
+
 	if (dc->link_srv->edp_is_ilr_optimization_required(link, crtc_timing)) {
 		DC_LOG_EVENT_LINK_TRAINING("Seamless boot disabled to optimize eDP link rate\n");
 		return false;
@@ -1766,6 +1842,8 @@
 	int i, j;
 	struct pipe_ctx *pipe;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		if (context != NULL) {
 			pipe = &context->res_ctx.pipe_ctx[i];
@@ -1785,6 +1863,8 @@
 void dc_trigger_sync(struct dc *dc, struct dc_state *context)
 {
 	if (context->stream_count > 1 && !dc->debug.disable_timing_sync) {
+		dc_exit_ips_for_hw_access(dc);
+
 		enable_timing_multisync(dc, context);
 		program_timing_sync(dc, context);
 	}
@@ -1969,6 +2049,11 @@
 		context->stream_count == 0) {
 		/* Must wait for no flips to be pending before doing optimize bw */
 		wait_for_no_pipes_pending(dc, context);
+		/*
+		 * optimized dispclk depends on ODM setup. Need to wait for ODM
+		 * update pending complete before optimizing bandwidth.
+		 */
+		wait_for_odm_update_pending_complete(dc, context);
 		/* pplib is notified if disp_num changed */
 		dc->hwss.optimize_bandwidth(dc, context);
 		/* Need to do otg sync again as otg could be out of sync due to otg
@@ -2041,6 +2126,8 @@
 	if (!streams_changed(dc, streams, stream_count))
 		return res;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	DC_LOG_DC("%s: %d streams\n", __func__, stream_count);
 
 	for (i = 0; i < stream_count; i++) {
@@ -2227,7 +2314,6 @@
 	}
 
 	dc->optimized_required = false;
-	dc->wm_optimized_required = false;
 }
 
 bool dc_set_generic_gpio_for_stereo(bool enable,
@@ -2650,8 +2736,6 @@
 		} else if (memcmp(&dc->current_state->bw_ctx.bw.dcn.clk, &dc->clk_mgr->clks, offsetof(struct dc_clocks, prev_p_state_change_support)) != 0) {
 			dc->optimized_required = true;
 		}
-
-		dc->optimized_required |= dc->wm_optimized_required;
 	}
 
 	return type;
@@ -2859,9 +2943,6 @@
 	if (update->vrr_active_fixed)
 		stream->vrr_active_fixed = *update->vrr_active_fixed;
 
-	if (update->crtc_timing_adjust)
-		stream->adjust = *update->crtc_timing_adjust;
-
 	if (update->dpms_off)
 		stream->dpms_off = *update->dpms_off;
 
@@ -2922,7 +3003,7 @@
 }
 
 static void backup_plane_states_for_stream(
-		struct dc_plane_state plane_states[MAX_SURFACE_NUM],
+		struct dc_plane_state plane_states[MAX_SURFACES],
 		struct dc_stream_state *stream)
 {
 	int i;
@@ -2936,7 +3017,7 @@
 }
 
 static void restore_plane_states_for_stream(
-		struct dc_plane_state plane_states[MAX_SURFACE_NUM],
+		struct dc_plane_state plane_states[MAX_SURFACES],
 		struct dc_stream_state *stream)
 {
 	int i;
@@ -2945,8 +3026,12 @@
 	if (!status)
 		return;
 
-	for (i = 0; i < status->plane_count; i++)
+	for (i = 0; i < status->plane_count; i++) {
+		/* refcount will always be valid, restore everything else */
+		struct kref refcount = status->plane_states[i]->refcount;
 		*status->plane_states[i] = plane_states[i];
+		status->plane_states[i]->refcount = refcount;
+	}
 }
 
 static bool update_planes_and_stream_state(struct dc *dc,
@@ -3223,6 +3308,9 @@
 	if (stream->link->replay_settings.config.replay_supported)
 		return true;
 
+	if (stream->ctx->dce_version >= DCN_VERSION_3_5 && stream->abm_level)
+		return true;
+
 	return false;
 }
 
@@ -3376,6 +3464,8 @@
 	int i, j;
 	struct pipe_ctx *top_pipe_to_program = NULL;
 	struct dc_stream_status *stream_status = NULL;
+	dc_exit_ips_for_hw_access(dc);
+
 	dc_z10_restore(dc);
 
 	top_pipe_to_program = resource_get_otg_master_for_stream(
@@ -3418,23 +3508,26 @@
 
 	stream_status = dc_state_get_stream_status(context, stream);
 
-	build_dmub_cmd_list(dc,
-			srf_updates,
-			surface_count,
-			stream,
-			context,
-			context->dc_dmub_cmd,
-			&(context->dmub_cmd_count));
-	hwss_build_fast_sequence(dc,
-			context->dc_dmub_cmd,
-			context->dmub_cmd_count,
-			context->block_sequence,
-			&(context->block_sequence_steps),
-			top_pipe_to_program,
-			stream_status);
-	hwss_execute_sequence(dc,
-			context->block_sequence,
-			context->block_sequence_steps);
+	if (stream_status) {
+		build_dmub_cmd_list(dc,
+				srf_updates,
+				surface_count,
+				stream,
+				context,
+				context->dc_dmub_cmd,
+				&(context->dmub_cmd_count));
+		hwss_build_fast_sequence(dc,
+				context->dc_dmub_cmd,
+				context->dmub_cmd_count,
+				context->block_sequence,
+				&(context->block_sequence_steps),
+				top_pipe_to_program,
+				stream_status);
+		hwss_execute_sequence(dc,
+				context->block_sequence,
+				context->block_sequence_steps);
+	}
+
 	/* Clear update flags so next flip doesn't have redundant programming
 	 * (if there's no stream update, the update flags are not cleared).
 	 * Surface updates are cleared unconditionally at the beginning of each flip,
@@ -3444,7 +3537,7 @@
 		top_pipe_to_program->stream->update_flags.raw = 0;
 }
 
-static void wait_for_outstanding_hw_updates(struct dc *dc, const struct dc_state *dc_context)
+static void wait_for_outstanding_hw_updates(struct dc *dc, struct dc_state *dc_context)
 {
 /*
  * This function calls HWSS to wait for any potentially double buffered
@@ -3482,6 +3575,7 @@
 			}
 		}
 	}
+	wait_for_odm_update_pending_complete(dc, dc_context);
 }
 
 static void commit_planes_for_stream(struct dc *dc,
@@ -3503,6 +3597,8 @@
 	// dc->current_state anymore, so we have to cache it before we apply
 	// the new SubVP context
 	subvp_prev_use = false;
+	dc_exit_ips_for_hw_access(dc);
+
 	dc_z10_restore(dc);
 	if (update_type == UPDATE_TYPE_FULL)
 		wait_for_outstanding_hw_updates(dc, context);
@@ -3772,7 +3868,8 @@
 	}
 
 	if ((update_type != UPDATE_TYPE_FAST) && stream->update_flags.bits.dsc_changed)
-		if (top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) {
+		if (top_pipe_to_program &&
+		    top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) {
 			top_pipe_to_program->stream_res.tg->funcs->wait_for_state(
 				top_pipe_to_program->stream_res.tg,
 				CRTC_STATE_VACTIVE);
@@ -4293,8 +4390,7 @@
 			stream_update->mst_bw_update ||
 			stream_update->func_shaper ||
 			stream_update->lut3d_func ||
-			stream_update->pending_test_pattern ||
-			stream_update->crtc_timing_adjust))
+			stream_update->pending_test_pattern))
 		return true;
 
 	if (stream) {
@@ -4384,6 +4480,8 @@
 	bool is_plane_addition = 0;
 	bool is_fast_update_only;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	populate_fast_updates(fast_update, srf_updates, surface_count, stream_update);
 	is_fast_update_only = fast_update_only(dc, fast_update, srf_updates,
 			surface_count, stream_update, stream);
@@ -4504,6 +4602,8 @@
 	int i, j;
 	struct dc_fast_update fast_update[MAX_SURFACES] = {0};
 
+	dc_exit_ips_for_hw_access(dc);
+
 	populate_fast_updates(fast_update, srf_updates, surface_count, stream_update);
 	stream_status = dc_stream_get_status(stream);
 	context = dc->current_state;
@@ -4688,6 +4788,8 @@
 	case DC_ACPI_CM_POWER_STATE_D0:
 		dc_state_construct(dc, dc->current_state);
 
+		dc_exit_ips_for_hw_access(dc);
+
 		dc_z10_restore(dc);
 
 		dc->hwss.init_hw(dc);
@@ -4825,28 +4927,29 @@
 	if (allow == dc->idle_optimizations_allowed)
 		return;
 
-	if (dc->hwss.apply_idle_power_optimizations && dc->hwss.apply_idle_power_optimizations(dc, allow))
+	if (dc->hwss.apply_idle_power_optimizations && dc->clk_mgr != NULL &&
+	    dc->hwss.apply_idle_power_optimizations(dc, allow))
 		dc->idle_optimizations_allowed = allow;
 }
 
-bool dc_dmub_is_ips_idle_state(struct dc *dc)
+void dc_exit_ips_for_hw_access(struct dc *dc)
 {
-	uint32_t idle_state = 0;
+	if (dc->caps.ips_support)
+		dc_allow_idle_optimizations(dc, false);
+}
 
+bool dc_dmub_is_ips_idle_state(struct dc *dc)
+{
 	if (dc->debug.disable_idle_power_optimizations)
 		return false;
 
 	if (!dc->caps.ips_support || (dc->config.disable_ips == DMUB_IPS_DISABLE_ALL))
 		return false;
 
-	if (dc->hwss.get_idle_state)
-		idle_state = dc->hwss.get_idle_state(dc);
-
-	if (!(idle_state & DMUB_IPS1_ALLOW_MASK) ||
-		!(idle_state & DMUB_IPS2_ALLOW_MASK))
-		return true;
+	if (!dc->ctx->dmub_srv)
+		return false;
 
-	return false;
+	return dc->ctx->dmub_srv->idle_allowed;
 }
 
 /* set min and max memory clock to lowest and highest DPM level, respectively */
@@ -5445,3 +5548,20 @@
 	return profile;
 }
 
+/*
+ **********************************************************************************
+ * dc_get_det_buffer_size_from_state() - extracts detile buffer size from dc state
+ *
+ * Called when DM wants to log detile buffer size from dc_state
+ *
+ **********************************************************************************
+ */
+unsigned int dc_get_det_buffer_size_from_state(const struct dc_state *context)
+{
+	struct dc *dc = context->clk_mgr->ctx->dc;
+
+	if (dc->res_pool->funcs->get_det_buffer_size)
+		return dc->res_pool->funcs->get_det_buffer_size(context);
+	else
+		return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/core/dc_debug.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/core/dc_debug.c
@@ -434,3 +434,43 @@
 
 	return "Unexpected status error";
 }
+
+char *dc_pixel_encoding_to_str(enum dc_pixel_encoding pixel_encoding)
+{
+	switch (pixel_encoding) {
+	case PIXEL_ENCODING_RGB:
+		return "RGB";
+	case PIXEL_ENCODING_YCBCR422:
+		return "YUV422";
+	case PIXEL_ENCODING_YCBCR444:
+		return "YUV444";
+	case PIXEL_ENCODING_YCBCR420:
+		return "YUV420";
+	default:
+		return "Unknown";
+	}
+}
+
+char *dc_color_depth_to_str(enum dc_color_depth color_depth)
+{
+	switch (color_depth) {
+	case COLOR_DEPTH_666:
+		return "6-bpc";
+	case COLOR_DEPTH_888:
+		return "8-bpc";
+	case COLOR_DEPTH_101010:
+		return "10-bpc";
+	case COLOR_DEPTH_121212:
+		return "12-bpc";
+	case COLOR_DEPTH_141414:
+		return "14-bpc";
+	case COLOR_DEPTH_161616:
+		return "16-bpc";
+	case COLOR_DEPTH_999:
+		return "9-bpc";
+	case COLOR_DEPTH_111111:
+		return "11-bpc";
+	default:
+		return "Unknown";
+	}
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
@@ -602,57 +602,59 @@
 	while (current_pipe) {
 		current_mpc_pipe = current_pipe;
 		while (current_mpc_pipe) {
-			if (dc->hwss.set_flip_control_gsl && current_mpc_pipe->plane_state && current_mpc_pipe->plane_state->update_flags.raw) {
-				block_sequence[*num_steps].params.set_flip_control_gsl_params.pipe_ctx = current_mpc_pipe;
-				block_sequence[*num_steps].params.set_flip_control_gsl_params.flip_immediate = current_mpc_pipe->plane_state->flip_immediate;
-				block_sequence[*num_steps].func = HUBP_SET_FLIP_CONTROL_GSL;
-				(*num_steps)++;
-			}
-			if (dc->hwss.program_triplebuffer && dc->debug.enable_tri_buf && current_mpc_pipe->plane_state->update_flags.raw) {
-				block_sequence[*num_steps].params.program_triplebuffer_params.dc = dc;
-				block_sequence[*num_steps].params.program_triplebuffer_params.pipe_ctx = current_mpc_pipe;
-				block_sequence[*num_steps].params.program_triplebuffer_params.enableTripleBuffer = current_mpc_pipe->plane_state->triplebuffer_flips;
-				block_sequence[*num_steps].func = HUBP_PROGRAM_TRIPLEBUFFER;
-				(*num_steps)++;
-			}
-			if (dc->hwss.update_plane_addr && current_mpc_pipe->plane_state->update_flags.bits.addr_update) {
-				if (resource_is_pipe_type(current_mpc_pipe, OTG_MASTER) &&
-						stream_status->mall_stream_config.type == SUBVP_MAIN) {
-					block_sequence[*num_steps].params.subvp_save_surf_addr.dc_dmub_srv = dc->ctx->dmub_srv;
-					block_sequence[*num_steps].params.subvp_save_surf_addr.addr = &current_mpc_pipe->plane_state->address;
-					block_sequence[*num_steps].params.subvp_save_surf_addr.subvp_index = current_mpc_pipe->subvp_index;
-					block_sequence[*num_steps].func = DMUB_SUBVP_SAVE_SURF_ADDR;
+			if (current_mpc_pipe->plane_state) {
+				if (dc->hwss.set_flip_control_gsl && current_mpc_pipe->plane_state->update_flags.raw) {
+					block_sequence[*num_steps].params.set_flip_control_gsl_params.pipe_ctx = current_mpc_pipe;
+					block_sequence[*num_steps].params.set_flip_control_gsl_params.flip_immediate = current_mpc_pipe->plane_state->flip_immediate;
+					block_sequence[*num_steps].func = HUBP_SET_FLIP_CONTROL_GSL;
+					(*num_steps)++;
+				}
+				if (dc->hwss.program_triplebuffer && dc->debug.enable_tri_buf && current_mpc_pipe->plane_state->update_flags.raw) {
+					block_sequence[*num_steps].params.program_triplebuffer_params.dc = dc;
+					block_sequence[*num_steps].params.program_triplebuffer_params.pipe_ctx = current_mpc_pipe;
+					block_sequence[*num_steps].params.program_triplebuffer_params.enableTripleBuffer = current_mpc_pipe->plane_state->triplebuffer_flips;
+					block_sequence[*num_steps].func = HUBP_PROGRAM_TRIPLEBUFFER;
+					(*num_steps)++;
+				}
+				if (dc->hwss.update_plane_addr && current_mpc_pipe->plane_state->update_flags.bits.addr_update) {
+					if (resource_is_pipe_type(current_mpc_pipe, OTG_MASTER) &&
+							stream_status->mall_stream_config.type == SUBVP_MAIN) {
+						block_sequence[*num_steps].params.subvp_save_surf_addr.dc_dmub_srv = dc->ctx->dmub_srv;
+						block_sequence[*num_steps].params.subvp_save_surf_addr.addr = &current_mpc_pipe->plane_state->address;
+						block_sequence[*num_steps].params.subvp_save_surf_addr.subvp_index = current_mpc_pipe->subvp_index;
+						block_sequence[*num_steps].func = DMUB_SUBVP_SAVE_SURF_ADDR;
+						(*num_steps)++;
+					}
+
+					block_sequence[*num_steps].params.update_plane_addr_params.dc = dc;
+					block_sequence[*num_steps].params.update_plane_addr_params.pipe_ctx = current_mpc_pipe;
+					block_sequence[*num_steps].func = HUBP_UPDATE_PLANE_ADDR;
 					(*num_steps)++;
 				}
 
-				block_sequence[*num_steps].params.update_plane_addr_params.dc = dc;
-				block_sequence[*num_steps].params.update_plane_addr_params.pipe_ctx = current_mpc_pipe;
-				block_sequence[*num_steps].func = HUBP_UPDATE_PLANE_ADDR;
-				(*num_steps)++;
-			}
-
-			if (hws->funcs.set_input_transfer_func && current_mpc_pipe->plane_state->update_flags.bits.gamma_change) {
-				block_sequence[*num_steps].params.set_input_transfer_func_params.dc = dc;
-				block_sequence[*num_steps].params.set_input_transfer_func_params.pipe_ctx = current_mpc_pipe;
-				block_sequence[*num_steps].params.set_input_transfer_func_params.plane_state = current_mpc_pipe->plane_state;
-				block_sequence[*num_steps].func = DPP_SET_INPUT_TRANSFER_FUNC;
-				(*num_steps)++;
-			}
+				if (hws->funcs.set_input_transfer_func && current_mpc_pipe->plane_state->update_flags.bits.gamma_change) {
+					block_sequence[*num_steps].params.set_input_transfer_func_params.dc = dc;
+					block_sequence[*num_steps].params.set_input_transfer_func_params.pipe_ctx = current_mpc_pipe;
+					block_sequence[*num_steps].params.set_input_transfer_func_params.plane_state = current_mpc_pipe->plane_state;
+					block_sequence[*num_steps].func = DPP_SET_INPUT_TRANSFER_FUNC;
+					(*num_steps)++;
+				}
 
-			if (dc->hwss.program_gamut_remap && current_mpc_pipe->plane_state->update_flags.bits.gamut_remap_change) {
-				block_sequence[*num_steps].params.program_gamut_remap_params.pipe_ctx = current_mpc_pipe;
-				block_sequence[*num_steps].func = DPP_PROGRAM_GAMUT_REMAP;
-				(*num_steps)++;
-			}
-			if (current_mpc_pipe->plane_state->update_flags.bits.input_csc_change) {
-				block_sequence[*num_steps].params.setup_dpp_params.pipe_ctx = current_mpc_pipe;
-				block_sequence[*num_steps].func = DPP_SETUP_DPP;
-				(*num_steps)++;
-			}
-			if (current_mpc_pipe->plane_state->update_flags.bits.coeff_reduction_change) {
-				block_sequence[*num_steps].params.program_bias_and_scale_params.pipe_ctx = current_mpc_pipe;
-				block_sequence[*num_steps].func = DPP_PROGRAM_BIAS_AND_SCALE;
-				(*num_steps)++;
+				if (dc->hwss.program_gamut_remap && current_mpc_pipe->plane_state->update_flags.bits.gamut_remap_change) {
+					block_sequence[*num_steps].params.program_gamut_remap_params.pipe_ctx = current_mpc_pipe;
+					block_sequence[*num_steps].func = DPP_PROGRAM_GAMUT_REMAP;
+					(*num_steps)++;
+				}
+				if (current_mpc_pipe->plane_state->update_flags.bits.input_csc_change) {
+					block_sequence[*num_steps].params.setup_dpp_params.pipe_ctx = current_mpc_pipe;
+					block_sequence[*num_steps].func = DPP_SETUP_DPP;
+					(*num_steps)++;
+				}
+				if (current_mpc_pipe->plane_state->update_flags.bits.coeff_reduction_change) {
+					block_sequence[*num_steps].params.program_bias_and_scale_params.pipe_ctx = current_mpc_pipe;
+					block_sequence[*num_steps].func = DPP_PROGRAM_BIAS_AND_SCALE;
+					(*num_steps)++;
+				}
 			}
 			if (hws->funcs.set_output_transfer_func && current_mpc_pipe->stream->update_flags.bits.out_tf) {
 				block_sequence[*num_steps].params.set_output_transfer_func_params.dc = dc;
@@ -830,6 +832,9 @@
 	struct dpp *dpp = pipe_ctx->plane_res.dpp;
 	struct dc_plane_state *plane_state = pipe_ctx->plane_state;
 
+	if (!plane_state)
+		return;
+
 	if (dpp && dpp->funcs->dpp_setup) {
 		// program the input csc
 		dpp->funcs->dpp_setup(dpp,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c
@@ -37,6 +37,9 @@
 #include "dce/dce_i2c.h"
 struct dc_link *dc_get_link_at_index(struct dc *dc, uint32_t link_index)
 {
+	if (link_index >= MAX_LINKS)
+		return NULL;
+
 	return dc->links[link_index];
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -750,25 +750,6 @@
 		*flip_horz_scan_dir = !*flip_horz_scan_dir;
 }
 
-/*
- * This is a preliminary vp size calculation to allow us to check taps support.
- * The result is completely overridden afterwards.
- */
-static void calculate_viewport_size(struct pipe_ctx *pipe_ctx)
-{
-	struct scaler_data *data = &pipe_ctx->plane_res.scl_data;
-
-	data->viewport.width = dc_fixpt_ceil(dc_fixpt_mul_int(data->ratios.horz, data->recout.width));
-	data->viewport.height = dc_fixpt_ceil(dc_fixpt_mul_int(data->ratios.vert, data->recout.height));
-	data->viewport_c.width = dc_fixpt_ceil(dc_fixpt_mul_int(data->ratios.horz_c, data->recout.width));
-	data->viewport_c.height = dc_fixpt_ceil(dc_fixpt_mul_int(data->ratios.vert_c, data->recout.height));
-	if (pipe_ctx->plane_state->rotation == ROTATION_ANGLE_90 ||
-			pipe_ctx->plane_state->rotation == ROTATION_ANGLE_270) {
-		swap(data->viewport.width, data->viewport.height);
-		swap(data->viewport_c.width, data->viewport_c.height);
-	}
-}
-
 static struct rect intersect_rec(const struct rect *r0, const struct rect *r1)
 {
 	struct rect rec;
@@ -1478,6 +1459,7 @@
 	const struct dc_plane_state *plane_state = pipe_ctx->plane_state;
 	struct dc_crtc_timing *timing = &pipe_ctx->stream->timing;
 	const struct rect odm_slice_rec = calculate_odm_slice_in_timing_active(pipe_ctx);
+	struct scaling_taps temp = {0};
 	bool res = false;
 	DC_LOGGER_INIT(pipe_ctx->stream->ctx->logger);
 
@@ -1509,8 +1491,6 @@
 	calculate_recout(pipe_ctx);
 	/* depends on pixel format */
 	calculate_scaling_ratios(pipe_ctx);
-	/* depends on scaling ratios and recout, does not calculate offset yet */
-	calculate_viewport_size(pipe_ctx);
 
 	/*
 	 * LB calculations depend on vp size, h/v_active and scaling ratios
@@ -1531,6 +1511,24 @@
 
 	pipe_ctx->plane_res.scl_data.lb_params.alpha_en = plane_state->per_pixel_alpha;
 
+	// get TAP value with 100x100 dummy data for max scaling qualify, override
+	// if a new scaling quality required
+	pipe_ctx->plane_res.scl_data.viewport.width = 100;
+	pipe_ctx->plane_res.scl_data.viewport.height = 100;
+	pipe_ctx->plane_res.scl_data.viewport_c.width = 100;
+	pipe_ctx->plane_res.scl_data.viewport_c.height = 100;
+	if (pipe_ctx->plane_res.xfm != NULL)
+		res = pipe_ctx->plane_res.xfm->funcs->transform_get_optimal_number_of_taps(
+				pipe_ctx->plane_res.xfm, &pipe_ctx->plane_res.scl_data, &plane_state->scaling_quality);
+
+	if (pipe_ctx->plane_res.dpp != NULL)
+		res = pipe_ctx->plane_res.dpp->funcs->dpp_get_optimal_number_of_taps(
+				pipe_ctx->plane_res.dpp, &pipe_ctx->plane_res.scl_data, &plane_state->scaling_quality);
+
+	temp = pipe_ctx->plane_res.scl_data.taps;
+
+	calculate_inits_and_viewports(pipe_ctx);
+
 	if (pipe_ctx->plane_res.xfm != NULL)
 		res = pipe_ctx->plane_res.xfm->funcs->transform_get_optimal_number_of_taps(
 				pipe_ctx->plane_res.xfm, &pipe_ctx->plane_res.scl_data, &plane_state->scaling_quality);
@@ -1557,11 +1555,14 @@
 					&plane_state->scaling_quality);
 	}
 
-	/*
-	 * Depends on recout, scaling ratios, h_active and taps
-	 * May need to re-check lb size after this in some obscure scenario
-	 */
-	if (res)
+	/* Ignore scaler failure if pipe context plane is phantom plane */
+	if (!res && plane_state->is_phantom)
+		res = true;
+
+	if (res && (pipe_ctx->plane_res.scl_data.taps.v_taps != temp.v_taps ||
+		pipe_ctx->plane_res.scl_data.taps.h_taps != temp.h_taps ||
+		pipe_ctx->plane_res.scl_data.taps.v_taps_c != temp.v_taps_c ||
+		pipe_ctx->plane_res.scl_data.taps.h_taps_c != temp.h_taps_c))
 		calculate_inits_and_viewports(pipe_ctx);
 
 	/*
@@ -2179,50 +2180,98 @@
 	}
 }
 
-void resource_log_pipe_topology_update(struct dc *dc, struct dc_state *state)
+static void resource_log_pipe_for_stream(struct dc *dc, struct dc_state *state,
+		struct pipe_ctx *otg_master, int stream_idx)
 {
-	struct pipe_ctx *otg_master;
 	struct pipe_ctx *opp_heads[MAX_PIPES];
 	struct pipe_ctx *dpp_pipes[MAX_PIPES];
 
-	int stream_idx, slice_idx, dpp_idx, plane_idx, slice_count, dpp_count;
+	int slice_idx, dpp_idx, plane_idx, slice_count, dpp_count;
 	bool is_primary;
 	DC_LOGGER_INIT(dc->ctx->logger);
 
+	slice_count = resource_get_opp_heads_for_otg_master(otg_master,
+			&state->res_ctx, opp_heads);
+	for (slice_idx = 0; slice_idx < slice_count; slice_idx++) {
+		plane_idx = -1;
+		if (opp_heads[slice_idx]->plane_state) {
+			dpp_count = resource_get_dpp_pipes_for_opp_head(
+					opp_heads[slice_idx],
+					&state->res_ctx,
+					dpp_pipes);
+			for (dpp_idx = 0; dpp_idx < dpp_count; dpp_idx++) {
+				is_primary = !dpp_pipes[dpp_idx]->top_pipe ||
+						dpp_pipes[dpp_idx]->top_pipe->plane_state != dpp_pipes[dpp_idx]->plane_state;
+				if (is_primary)
+					plane_idx++;
+				resource_log_pipe(dc, dpp_pipes[dpp_idx],
+						stream_idx, slice_idx,
+						plane_idx, slice_count,
+						is_primary);
+			}
+		} else {
+			resource_log_pipe(dc, opp_heads[slice_idx],
+					stream_idx, slice_idx, plane_idx,
+					slice_count, true);
+		}
+
+	}
+}
+
+static int resource_stream_to_stream_idx(struct dc_state *state,
+		struct dc_stream_state *stream)
+{
+	int i, stream_idx = -1;
+
+	for (i = 0; i < state->stream_count; i++)
+		if (state->streams[i] == stream) {
+			stream_idx = i;
+			break;
+		}
+
+	/* never return negative array index */
+	if (stream_idx == -1) {
+		ASSERT(0);
+		return 0;
+	}
+
+	return stream_idx;
+}
+
+void resource_log_pipe_topology_update(struct dc *dc, struct dc_state *state)
+{
+	struct pipe_ctx *otg_master;
+	int stream_idx, phantom_stream_idx;
+	DC_LOGGER_INIT(dc->ctx->logger);
+
 	DC_LOG_DC("    pipe topology update");
 	DC_LOG_DC("  ________________________");
 	for (stream_idx = 0; stream_idx < state->stream_count; stream_idx++) {
+		if (state->streams[stream_idx]->is_phantom)
+			continue;
+
 		otg_master = resource_get_otg_master_for_stream(
 				&state->res_ctx, state->streams[stream_idx]);
-		if (!otg_master	|| otg_master->stream_res.tg == NULL) {
-			DC_LOG_DC("topology update: otg_master NULL stream_idx %d!\n", stream_idx);
-			return;
-		}
-		slice_count = resource_get_opp_heads_for_otg_master(otg_master,
-				&state->res_ctx, opp_heads);
-		for (slice_idx = 0; slice_idx < slice_count; slice_idx++) {
-			plane_idx = -1;
-			if (opp_heads[slice_idx]->plane_state) {
-				dpp_count = resource_get_dpp_pipes_for_opp_head(
-						opp_heads[slice_idx],
-						&state->res_ctx,
-						dpp_pipes);
-				for (dpp_idx = 0; dpp_idx < dpp_count; dpp_idx++) {
-					is_primary = !dpp_pipes[dpp_idx]->top_pipe ||
-							dpp_pipes[dpp_idx]->top_pipe->plane_state != dpp_pipes[dpp_idx]->plane_state;
-					if (is_primary)
-						plane_idx++;
-					resource_log_pipe(dc, dpp_pipes[dpp_idx],
-							stream_idx, slice_idx,
-							plane_idx, slice_count,
-							is_primary);
-				}
-			} else {
-				resource_log_pipe(dc, opp_heads[slice_idx],
-						stream_idx, slice_idx, plane_idx,
-						slice_count, true);
-			}
 
+		if (!otg_master)
+			continue;
+
+		resource_log_pipe_for_stream(dc, state, otg_master, stream_idx);
+	}
+	if (state->phantom_stream_count > 0) {
+		DC_LOG_DC(" |    (phantom pipes)     |");
+		for (stream_idx = 0; stream_idx < state->stream_count; stream_idx++) {
+			if (state->stream_status[stream_idx].mall_stream_config.type != SUBVP_MAIN)
+				continue;
+
+			phantom_stream_idx = resource_stream_to_stream_idx(state,
+					state->stream_status[stream_idx].mall_stream_config.paired_stream);
+			otg_master = resource_get_otg_master_for_stream(
+					&state->res_ctx, state->streams[phantom_stream_idx]);
+			if (!otg_master)
+				continue;
+
+			resource_log_pipe_for_stream(dc, state, otg_master, stream_idx);
 		}
 	}
 	DC_LOG_DC(" |________________________|\n");
@@ -2448,6 +2497,17 @@
 	}
 }
 
+static int get_num_of_free_pipes(const struct resource_pool *pool, const struct dc_state *context)
+{
+	int i;
+	int count = 0;
+
+	for (i = 0; i < pool->pipe_count; i++)
+		if (resource_is_pipe_type(&context->res_ctx.pipe_ctx[i], FREE_PIPE))
+			count++;
+	return count;
+}
+
 enum dc_status resource_add_otg_master_for_stream_output(struct dc_state *new_ctx,
 		const struct resource_pool *pool,
 		struct dc_stream_state *stream)
@@ -2581,37 +2641,33 @@
 		struct dc_state *cur_ctx,
 		struct resource_pool *pool)
 {
-	struct pipe_ctx *opp_head_pipe, *sec_pipe, *tail_pipe;
+	struct pipe_ctx *sec_pipe, *tail_pipe;
+	struct pipe_ctx *opp_heads[MAX_PIPES];
+	int opp_head_count;
+	int i;
 
 	if (!pool->funcs->acquire_free_pipe_as_secondary_dpp_pipe) {
 		ASSERT(0);
 		return false;
 	}
 
-	opp_head_pipe = otg_master_pipe;
-	while (opp_head_pipe) {
+	opp_head_count = resource_get_opp_heads_for_otg_master(otg_master_pipe,
+			&new_ctx->res_ctx, opp_heads);
+	if (get_num_of_free_pipes(pool, new_ctx) < opp_head_count)
+		/* not enough free pipes */
+		return false;
+
+	for (i = 0; i < opp_head_count; i++) {
 		sec_pipe = pool->funcs->acquire_free_pipe_as_secondary_dpp_pipe(
 				cur_ctx,
 				new_ctx,
 				pool,
-				opp_head_pipe);
-		if (!sec_pipe) {
-			/* try tearing down MPCC combine */
-			int pipe_idx = acquire_first_split_pipe(
-					&new_ctx->res_ctx, pool,
-					otg_master_pipe->stream);
-
-			if (pipe_idx >= 0)
-				sec_pipe = &new_ctx->res_ctx.pipe_ctx[pipe_idx];
-		}
-
-		if (!sec_pipe)
-			return false;
-
+				opp_heads[i]);
+		ASSERT(sec_pipe);
 		sec_pipe->plane_state = plane_state;
 
 		/* establish pipe relationship */
-		tail_pipe = get_tail_pipe(opp_head_pipe);
+		tail_pipe = get_tail_pipe(opp_heads[i]);
 		tail_pipe->bottom_pipe = sec_pipe;
 		sec_pipe->top_pipe = tail_pipe;
 		sec_pipe->bottom_pipe = NULL;
@@ -2622,8 +2678,6 @@
 		} else {
 			sec_pipe->prev_odm_pipe = NULL;
 		}
-
-		opp_head_pipe = opp_head_pipe->next_odm_pipe;
 	}
 	return true;
 }
@@ -3049,6 +3103,8 @@
 bool dc_is_stream_unchanged(
 	struct dc_stream_state *old_stream, struct dc_stream_state *stream)
 {
+	if (!old_stream || !stream)
+		return false;
 
 	if (!are_stream_backends_same(old_stream, stream))
 		return false;
@@ -3128,6 +3184,9 @@
 {
 	int i, available_audio_count;
 
+	if (id == ENGINE_ID_UNKNOWN)
+		return NULL;
+
 	available_audio_count = pool->audio_count;
 
 	for (i = 0; i < available_audio_count; i++) {
@@ -3403,7 +3462,7 @@
 		if (pool->dpps[pipe_idx])
 			pipe_ctx->plane_res.mpcc_inst = pool->dpps[pipe_idx]->inst;
 
-		if (pipe_idx >= pool->timing_generator_count) {
+		if (pipe_idx >= pool->timing_generator_count && pool->timing_generator_count != 0) {
 			int tg_inst = pool->timing_generator_count - 1;
 
 			pipe_ctx->stream_res.tg = pool->timing_generators[tg_inst];
@@ -3554,8 +3613,10 @@
 		}
 	}
 
-	if (!stream_status)
+	if (!stream_status) {
 		ASSERT(0);
+		return false;
+	}
 
 	for (i = 0; i < set_count; i++)
 		if (set[i].stream == stream)
@@ -4564,6 +4625,9 @@
 
 enum dc_status dc_validate_stream(struct dc *dc, struct dc_stream_state *stream)
 {
+	if (dc == NULL || stream == NULL)
+		return DC_ERROR_UNEXPECTED;
+
 	struct dc_link *link = stream->link;
 	struct timing_generator *tg = dc->res_pool->timing_generators[0];
 	enum dc_status res = DC_OK;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/core/dc_state.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/core/dc_state.c
@@ -200,8 +200,12 @@
 	dc_state_construct(dc, state);
 
 #ifdef CONFIG_DRM_AMD_DC_FP
-	if (dc->debug.using_dml2)
-		dml2_create(dc, &dc->dml2_options, &state->bw_ctx.dml2);
+	if (dc->debug.using_dml2) {
+		if (!dml2_create(dc, &dc->dml2_options, &state->bw_ctx.dml2)) {
+			dc_state_release(state);
+			return NULL;
+		}
+	}
 #endif
 
 	kref_init(&state->refcount);
@@ -240,6 +244,8 @@
 	dc_state_copy_internal(new_state, src_state);
 
 #ifdef CONFIG_DRM_AMD_DC_FP
+	new_state->bw_ctx.dml2 = NULL;
+
 	if (src_state->bw_ctx.dml2 &&
 			!dml2_create_copy(&new_state->bw_ctx.dml2, src_state->bw_ctx.dml2)) {
 		dc_state_release(new_state);
@@ -334,7 +340,8 @@
 
 void dc_state_release(struct dc_state *state)
 {
-	kref_put(&state->refcount, dc_state_free);
+	if (state != NULL)
+		kref_put(&state->refcount, dc_state_free);
 }
 /*
  * dc_state_add_stream() - Add a new dc_stream_state to a dc_state.
@@ -414,6 +421,19 @@
 	return DC_OK;
 }
 
+static void remove_mpc_combine_for_stream(const struct dc *dc,
+		struct dc_state *new_ctx,
+		const struct dc_state *cur_ctx,
+		struct dc_stream_status *status)
+{
+	int i;
+
+	for (i = 0; i < status->plane_count; i++)
+		resource_update_pipes_for_plane_with_slice_count(
+				new_ctx, cur_ctx, dc->res_pool,
+				status->plane_states[i], 1);
+}
+
 bool dc_state_add_plane(
 		const struct dc *dc,
 		struct dc_stream_state *stream,
@@ -424,22 +444,52 @@
 	struct pipe_ctx *otg_master_pipe;
 	struct dc_stream_status *stream_status = NULL;
 	bool added = false;
+	int odm_slice_count;
+	int i;
 
 	stream_status = dc_state_get_stream_status(state, stream);
+	otg_master_pipe = resource_get_otg_master_for_stream(
+			&state->res_ctx, stream);
 	if (stream_status == NULL) {
 		dm_error("Existing stream not found; failed to attach surface!\n");
 		goto out;
-	} else if (stream_status->plane_count == MAX_SURFACE_NUM) {
+	} else if (stream_status->plane_count == MAX_SURFACES) {
 		dm_error("Surface: can not attach plane_state %p! Maximum is: %d\n",
-				plane_state, MAX_SURFACE_NUM);
+				plane_state, MAX_SURFACES);
+		goto out;
+	} else if (!otg_master_pipe) {
 		goto out;
 	}
 
-	otg_master_pipe = resource_get_otg_master_for_stream(
-			&state->res_ctx, stream);
-	if (otg_master_pipe)
+	added = resource_append_dpp_pipes_for_plane_composition(state,
+			dc->current_state, pool, otg_master_pipe, plane_state);
+
+	if (!added) {
+		/* try to remove MPC combine to free up pipes */
+		for (i = 0; i < state->stream_count; i++)
+			remove_mpc_combine_for_stream(dc, state,
+					dc->current_state,
+					&state->stream_status[i]);
 		added = resource_append_dpp_pipes_for_plane_composition(state,
-				dc->current_state, pool, otg_master_pipe, plane_state);
+					dc->current_state, pool,
+					otg_master_pipe, plane_state);
+	}
+
+	if (!added) {
+		/* try to decrease ODM slice count gradually to free up pipes */
+		odm_slice_count = resource_get_odm_slice_count(otg_master_pipe);
+		for (i = odm_slice_count - 1; i > 0; i--) {
+			resource_update_pipes_for_stream_with_slice_count(state,
+					dc->current_state, dc->res_pool, stream,
+					i);
+			added = resource_append_dpp_pipes_for_plane_composition(
+					state,
+					dc->current_state, pool,
+					otg_master_pipe, plane_state);
+			if (added)
+				break;
+		}
+	}
 
 	if (added) {
 		stream_status->plane_states[stream_status->plane_count] =
@@ -499,15 +549,6 @@
 
 	stream_status->plane_states[stream_status->plane_count] = NULL;
 
-	if (stream_status->plane_count == 0 && dc->config.enable_windowed_mpo_odm)
-		/* ODM combine could prevent us from supporting more planes
-		 * we will reset ODM slice count back to 1 when all planes have
-		 * been removed to maximize the amount of planes supported when
-		 * new planes are added.
-		 */
-		resource_update_pipes_for_stream_with_slice_count(
-				state, dc->current_state, dc->res_pool, stream, 1);
-
 	return true;
 }
 
@@ -529,7 +570,7 @@
 {
 	int i, old_plane_count;
 	struct dc_stream_status *stream_status = NULL;
-	struct dc_plane_state *del_planes[MAX_SURFACE_NUM] = { 0 };
+	struct dc_plane_state *del_planes[MAX_SURFACES] = { 0 };
 
 	for (i = 0; i < state->stream_count; i++)
 		if (state->streams[i] == stream) {
@@ -796,7 +837,7 @@
 {
 	int i, old_plane_count;
 	struct dc_stream_status *stream_status = NULL;
-	struct dc_plane_state *del_planes[MAX_SURFACE_NUM] = { 0 };
+	struct dc_plane_state *del_planes[MAX_SURFACES] = { 0 };
 
 	for (i = 0; i < state->stream_count; i++)
 		if (state->streams[i] == phantom_stream) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -278,7 +278,6 @@
 	const struct dc_cursor_attributes *attributes)
 {
 	struct dc  *dc;
-	bool reset_idle_optimizations = false;
 
 	if (NULL == stream) {
 		dm_error("DC: dc_stream is NULL!\n");
@@ -309,20 +308,36 @@
 
 	stream->cursor_attributes = *attributes;
 
-	dc_z10_restore(dc);
-	/* disable idle optimizations while updating cursor */
-	if (dc->idle_optimizations_allowed) {
-		dc_allow_idle_optimizations(dc, false);
-		reset_idle_optimizations = true;
-	}
+	return true;
+}
 
-	program_cursor_attributes(dc, stream, attributes);
-
-	/* re-enable idle optimizations if necessary */
-	if (reset_idle_optimizations)
-		dc_allow_idle_optimizations(dc, true);
+bool dc_stream_program_cursor_attributes(
+	struct dc_stream_state *stream,
+	const struct dc_cursor_attributes *attributes)
+{
+	struct dc  *dc;
+	bool reset_idle_optimizations = false;
 
-	return true;
+	dc = stream ? stream->ctx->dc : NULL;
+
+	if (dc_stream_set_cursor_attributes(stream, attributes)) {
+		dc_z10_restore(dc);
+		/* disable idle optimizations while updating cursor */
+		if (dc->idle_optimizations_allowed) {
+			dc_allow_idle_optimizations(dc, false);
+			reset_idle_optimizations = true;
+		}
+
+		program_cursor_attributes(dc, stream, attributes);
+
+		/* re-enable idle optimizations if necessary */
+		if (reset_idle_optimizations && !dc->debug.disable_dmub_reallow_idle)
+			dc_allow_idle_optimizations(dc, true);
+
+		return true;
+	}
+
+	return false;
 }
 
 static void program_cursor_position(
@@ -367,9 +382,6 @@
 	struct dc_stream_state *stream,
 	const struct dc_cursor_position *position)
 {
-	struct dc *dc;
-	bool reset_idle_optimizations = false;
-
 	if (NULL == stream) {
 		dm_error("DC: dc_stream is NULL!\n");
 		return false;
@@ -380,24 +392,46 @@
 		return false;
 	}
 
+	stream->cursor_position = *position;
+
+
+	return true;
+}
+
+bool dc_stream_program_cursor_position(
+	struct dc_stream_state *stream,
+	const struct dc_cursor_position *position)
+{
+	struct dc *dc;
+	bool reset_idle_optimizations = false;
+	const struct dc_cursor_position *old_position;
+
+	if (!stream)
+		return false;
+
+	old_position = &stream->cursor_position;
 	dc = stream->ctx->dc;
-	dc_z10_restore(dc);
 
-	/* disable idle optimizations if enabling cursor */
-	if (dc->idle_optimizations_allowed && (!stream->cursor_position.enable || dc->debug.exit_idle_opt_for_cursor_updates)
-			&& position->enable) {
-		dc_allow_idle_optimizations(dc, false);
-		reset_idle_optimizations = true;
-	}
+	if (dc_stream_set_cursor_position(stream, position)) {
+		dc_z10_restore(dc);
 
-	stream->cursor_position = *position;
+		/* disable idle optimizations if enabling cursor */
+		if (dc->idle_optimizations_allowed &&
+		    (!old_position->enable || dc->debug.exit_idle_opt_for_cursor_updates) &&
+		    position->enable) {
+			dc_allow_idle_optimizations(dc, false);
+			reset_idle_optimizations = true;
+		}
 
-	program_cursor_position(dc, stream, position);
-	/* re-enable idle optimizations if necessary */
-	if (reset_idle_optimizations)
-		dc_allow_idle_optimizations(dc, true);
+		program_cursor_position(dc, stream, position);
+		/* re-enable idle optimizations if necessary */
+		if (reset_idle_optimizations && !dc->debug.disable_dmub_reallow_idle)
+			dc_allow_idle_optimizations(dc, true);
 
-	return true;
+		return true;
+	}
+
+	return false;
 }
 
 bool dc_stream_add_writeback(struct dc *dc,
@@ -423,6 +457,8 @@
 		return false;
 	}
 
+	dc_exit_ips_for_hw_access(dc);
+
 	wb_info->dwb_params.out_transfer_func = stream->out_transfer_func;
 
 	dwb = dc->res_pool->dwbc[wb_info->dwb_pipe_inst];
@@ -493,6 +529,8 @@
 		return false;
 	}
 
+	dc_exit_ips_for_hw_access(dc);
+
 	if (dwb->funcs->set_fc_enable)
 		dwb->funcs->set_fc_enable(dwb, DWB_FRAME_CAPTURE_DISABLE);
 
@@ -542,6 +580,8 @@
 		return false;
 	}
 
+	dc_exit_ips_for_hw_access(dc);
+
 	/* disable writeback */
 	if (dc->hwss.disable_writeback) {
 		struct dwbc *dwb = dc->res_pool->dwbc[dwb_pipe_inst];
@@ -557,6 +597,8 @@
 		int num_dwb,
 		struct dc_writeback_info *wb_info)
 {
+	dc_exit_ips_for_hw_access(dc);
+
 	if (dc->hwss.mmhubbub_warmup)
 		return dc->hwss.mmhubbub_warmup(dc, num_dwb, wb_info);
 	else
@@ -569,6 +611,8 @@
 	struct resource_context *res_ctx =
 		&dc->current_state->res_ctx;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
 
@@ -597,6 +641,8 @@
 	dc = stream->ctx->dc;
 	res_ctx = &dc->current_state->res_ctx;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		struct pipe_ctx *pipe_ctx = &res_ctx->pipe_ctx[i];
 
@@ -628,6 +674,8 @@
 	struct resource_context *res_ctx =
 		&dc->current_state->res_ctx;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < MAX_PIPES; i++) {
 		struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
 
@@ -664,6 +712,8 @@
 	if (i == MAX_PIPES)
 		return true;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	return dc->hwss.dmdata_status_done(pipe);
 }
 
@@ -698,6 +748,8 @@
 
 	pipe_ctx->stream->dmdata_address = attr->address;
 
+	dc_exit_ips_for_hw_access(dc);
+
 	dc->hwss.program_dmdata_engine(pipe_ctx);
 
 	if (hubp->funcs->dmdata_set_attributes != NULL &&
@@ -748,12 +800,12 @@
 			stream->dst.height,
 			stream->output_color_space);
 	DC_LOG_DC(
-			"\tpix_clk_khz: %d, h_total: %d, v_total: %d, pixelencoder:%d, displaycolorDepth:%d\n",
+			"\tpix_clk_khz: %d, h_total: %d, v_total: %d, pixel_encoding:%s, color_depth:%s\n",
 			stream->timing.pix_clk_100hz / 10,
 			stream->timing.h_total,
 			stream->timing.v_total,
-			stream->timing.pixel_encoding,
-			stream->timing.display_color_depth);
+			dc_pixel_encoding_to_str(stream->timing.pixel_encoding),
+			dc_color_depth_to_str(stream->timing.display_color_depth));
 	DC_LOG_DC(
 			"\tlink: %d\n",
 			stream->link->link_index);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/core/dc_surface.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/core/dc_surface.c
@@ -156,11 +156,14 @@
 		if (pipe_ctx->plane_state != plane_state)
 			continue;
 
-		pipe_ctx->plane_state->status.is_flip_pending = false;
+		if (pipe_ctx->plane_state)
+			pipe_ctx->plane_state->status.is_flip_pending = false;
 
 		break;
 	}
 
+	dc_exit_ips_for_hw_access(dc);
+
 	for (i = 0; i < dc->res_pool->pipe_count; i++) {
 		struct pipe_ctx *pipe_ctx =
 				&dc->current_state->res_ctx.pipe_ctx[i];
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dc.h
@@ -53,7 +53,7 @@
 
 #define DC_VER "3.2.266"
 
-#define MAX_SURFACES 3
+#define MAX_SURFACES 4
 #define MAX_PLANES 6
 #define MAX_STREAMS 6
 #define MIN_VIEWPORT_SIZE 12
@@ -987,6 +987,7 @@
 	bool psp_disabled_wa;
 	unsigned int ips2_eval_delay_us;
 	unsigned int ips2_entry_delay_us;
+	bool disable_dmub_reallow_idle;
 	bool disable_timeout;
 	bool disable_extblankadj;
 	unsigned int static_screen_wait_frames;
@@ -1013,7 +1014,7 @@
 	struct dc_phy_addr_space_config vm_pa_config;
 
 	uint8_t link_count;
-	struct dc_link *links[MAX_PIPES * 2];
+	struct dc_link *links[MAX_LINKS];
 	struct link_service *link_srv;
 
 	struct dc_state *current_state;
@@ -1037,7 +1038,6 @@
 
 	/* Require to optimize clocks and bandwidth for added/removed planes */
 	bool optimized_required;
-	bool wm_optimized_required;
 	bool idle_optimizations_allowed;
 	bool enable_c20_dtm_b0;
 
@@ -2325,6 +2325,7 @@
 				struct dc_cursor_attributes *cursor_attr);
 
 void dc_allow_idle_optimizations(struct dc *dc, bool allow);
+void dc_exit_ips_for_hw_access(struct dc *dc);
 bool dc_dmub_is_ips_idle_state(struct dc *dc);
 
 /* set min and max memory clock to lowest and highest DPM level, respectively */
@@ -2390,6 +2391,8 @@
 
 struct dc_power_profile dc_get_power_profile_for_dc_state(const struct dc_state *context);
 
+unsigned int dc_get_det_buffer_size_from_state(const struct dc_state *context);
+
 /* DSC Interfaces */
 #include "dc_dsc.h"
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -231,7 +231,9 @@
 			if (status == DMUB_STATUS_POWER_STATE_D3)
 				return false;
 
-			dmub_srv_wait_for_idle(dmub, 100000);
+			status = dmub_srv_wait_for_idle(dmub, 100000);
+			if (status != DMUB_STATUS_OK)
+				return false;
 
 			/* Requeue the command. */
 			status = dmub_srv_cmd_queue(dmub, &cmd_list[i]);
@@ -497,7 +499,8 @@
 	union dmub_rb_cmd cmd = { 0 };
 	unsigned int panel_inst = 0;
 
-	dc_get_edp_link_panel_inst(dc, pipe_ctx->stream->link, &panel_inst);
+	if (!dc_get_edp_link_panel_inst(dc, pipe_ctx->stream->link, &panel_inst))
+		return;
 
 	memset(&cmd, 0, sizeof(cmd));
 
@@ -1320,16 +1323,27 @@
 	 * Powering up the hardware requires notifying PMFW and DMCUB.
 	 * Clearing the driver idle allow requires a DMCUB command.
 	 * DMCUB commands requires the DMCUB to be powered up and restored.
-	 *
-	 * Exit out early to prevent an infinite loop of DMCUB commands
-	 * triggering exit low power - use software state to track this.
 	 */
-	dc_dmub_srv->idle_allowed = allow_idle;
 
-	if (!allow_idle)
+	if (!allow_idle) {
 		dc_dmub_srv_exit_low_power_state(dc);
-	else
+		/*
+		 * Idle is considered fully exited only after the sequence above
+		 * fully completes. If we have a race of two threads exiting
+		 * at the same time then it's safe to perform the sequence
+		 * twice as long as we're not re-entering.
+		 *
+		 * Infinite command submission is avoided by using the
+		 * dm_execute_dmub_cmd submission instead of the "wake" helpers.
+		 */
+		dc_dmub_srv->idle_allowed = false;
+	} else {
+		/* Consider idle as notified prior to the actual submission to
+		 * prevent multiple entries. */
+		dc_dmub_srv->idle_allowed = true;
+
 		dc_dmub_srv_notify_idle(dc, allow_idle);
+	}
 }
 
 bool dc_wake_and_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd,
@@ -1364,7 +1378,7 @@
 	else
 		result = dm_execute_dmub_cmd(ctx, cmd, wait_type);
 
-	if (result && reallow_idle)
+	if (result && reallow_idle && !ctx->dc->debug.disable_dmub_reallow_idle)
 		dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, true);
 
 	return result;
@@ -1413,7 +1427,7 @@
 
 	result = dc_dmub_execute_gpint(ctx, command_code, param, response, wait_type);
 
-	if (result && reallow_idle)
+	if (result && reallow_idle && !ctx->dc->debug.disable_dmub_reallow_idle)
 		dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, true);
 
 	return result;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dc_dsc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dc_dsc.h
@@ -100,7 +100,8 @@
  */
 void dc_dsc_get_policy_for_timing(const struct dc_crtc_timing *timing,
 		uint32_t max_target_bpp_limit_override_x16,
-		struct dc_dsc_policy *policy);
+		struct dc_dsc_policy *policy,
+		const enum dc_link_encoding_format link_encoding);
 
 void dc_dsc_policy_set_max_target_bpp_limit(uint32_t limit);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dc_stream.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dc_stream.h
@@ -56,7 +56,7 @@
 	int plane_count;
 	int audio_inst;
 	struct timing_sync_info timing_sync_info;
-	struct dc_plane_state *plane_states[MAX_SURFACE_NUM];
+	struct dc_plane_state *plane_states[MAX_SURFACES];
 	bool is_abm_supported;
 	struct mall_stream_config mall_stream_config;
 };
@@ -139,7 +139,6 @@
 		uint32_t wb_update:1;
 		uint32_t dsc_changed : 1;
 		uint32_t mst_bw : 1;
-		uint32_t crtc_timing_adjust : 1;
 		uint32_t fams_changed : 1;
 	} bits;
 
@@ -326,7 +325,6 @@
 	struct dc_3dlut *lut3d_func;
 
 	struct test_pattern *pending_test_pattern;
-	struct dc_crtc_timing_adjust *crtc_timing_adjust;
 };
 
 bool dc_is_stream_unchanged(
@@ -478,10 +476,18 @@
 	struct dc_stream_state *stream,
 	const struct dc_cursor_attributes *attributes);
 
+bool dc_stream_program_cursor_attributes(
+	struct dc_stream_state *stream,
+	const struct dc_cursor_attributes *attributes);
+
 bool dc_stream_set_cursor_position(
 	struct dc_stream_state *stream,
 	const struct dc_cursor_position *position);
 
+bool dc_stream_program_cursor_position(
+	struct dc_stream_state *stream,
+	const struct dc_cursor_position *position);
+
 
 bool dc_stream_adjust_vmin_vmax(struct dc *dc,
 				struct dc_stream_state *stream,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dc_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dc_types.h
@@ -76,7 +76,6 @@
 	unsigned long last_entry_write;
 };
 
-#define MAX_SURFACE_NUM 6
 #define NUM_PIXEL_FORMATS 10
 
 enum tiling_mode {
@@ -178,6 +177,7 @@
 	unsigned int skip_avmute;
 	unsigned int mst_start_top_delay;
 	unsigned int remove_sink_ext_caps;
+	unsigned int disable_colorimetry;
 };
 
 struct dc_edid_caps {
@@ -1085,9 +1085,9 @@
 	/* SMU optimization is enabled */
 	bool replay_smu_opt_enable;
 	/* Current Coasting vtotal */
-	uint16_t coasting_vtotal;
+	uint32_t coasting_vtotal;
 	/* Coasting vtotal table */
-	uint16_t coasting_vtotal_table[PR_COASTING_TYPE_NUM];
+	uint32_t coasting_vtotal_table[PR_COASTING_TYPE_NUM];
 	/* Maximum link off frame count */
 	enum replay_link_off_frame_count_level link_off_frame_count_level;
 	/* Replay pseudo vtotal for abm + ips on full screen video which can improve ips residency */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c
@@ -262,7 +262,7 @@
 {
 	union dmub_rb_cmd cmd;
 	struct dc_context *dc = abm->ctx;
-	uint32_t ramping_boundary = 0xFFFF;
+	uint8_t ramping_boundary = 0xFF;
 
 	memset(&cmd, 0, sizeof(cmd));
 	cmd.abm_set_pipe.header.type = DMUB_CMD__ABM;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c
@@ -84,7 +84,7 @@
 
 	cmd.replay_enable.header.payload_bytes = sizeof(struct dmub_rb_cmd_replay_enable_data);
 
-	dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
+	dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
 
 	/* Below loops 1000 x 500us = 500 ms.
 	 *  Exit REPLAY may need to wait 1-2 frames to power up. Timeout after at
@@ -102,7 +102,8 @@
 					break;
 			}
 
-			fsleep(500);
+			/* must *not* be fsleep - this can be called from high irq levels */
+			udelay(500);
 		}
 
 		/* assert if max retry hit */
@@ -127,7 +128,7 @@
 	cmd.replay_set_power_opt.replay_set_power_opt_data.power_opt = power_opt;
 	cmd.replay_set_power_opt.replay_set_power_opt_data.panel_inst = panel_inst;
 
-	dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
+	dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
 }
 
 /*
@@ -209,8 +210,7 @@
 	else
 		copy_settings_data->flags.bitfields.force_wakeup_by_tps3 = 0;
 
-
-	dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
+	dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
 
 	return true;
 }
@@ -231,7 +231,7 @@
 	cmd.replay_set_coasting_vtotal.header.payload_bytes = sizeof(struct dmub_cmd_replay_set_coasting_vtotal_data);
 	cmd.replay_set_coasting_vtotal.replay_set_coasting_vtotal_data.coasting_vtotal = coasting_vtotal;
 
-	dm_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
+	dc_wake_and_execute_dmub_cmd(dc, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dce110/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dce110/Makefile
@@ -23,7 +23,7 @@
 # Makefile for the 'controller' sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
-CFLAGS_$(AMDDALPATH)/dc/dce110/dce110_resource.o = $(call cc-disable-warning, override-init)
+CFLAGS_$(AMDDALPATH)/dc/dce110/dce110_resource.o = -Wno-override-init
 
 DCE110 = dce110_timing_generator.o \
 dce110_compressor.o dce110_opp_regamma_v.o \
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dce112/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dce112/Makefile
@@ -23,7 +23,7 @@
 # Makefile for the 'controller' sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
-CFLAGS_$(AMDDALPATH)/dc/dce112/dce112_resource.o = $(call cc-disable-warning, override-init)
+CFLAGS_$(AMDDALPATH)/dc/dce112/dce112_resource.o = -Wno-override-init
 
 DCE112 = dce112_compressor.o
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dce120/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dce120/Makefile
@@ -24,7 +24,7 @@
 # It provides the control and status of HW CRTC block.
 
 
-CFLAGS_$(AMDDALPATH)/dc/dce120/dce120_resource.o = $(call cc-disable-warning, override-init)
+CFLAGS_$(AMDDALPATH)/dc/dce120/dce120_resource.o = -Wno-override-init
 
 DCE120 = dce120_timing_generator.o
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dce60/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dce60/Makefile
@@ -23,7 +23,7 @@
 # Makefile for the 'controller' sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
-CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init)
+CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = -Wno-override-init
 
 DCE60 = dce60_timing_generator.o dce60_hw_sequencer.o \
 	dce60_resource.o
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dce80/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dce80/Makefile
@@ -23,7 +23,7 @@
 # Makefile for the 'controller' sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
-CFLAGS_$(AMDDALPATH)/dc/dce80/dce80_resource.o = $(call cc-disable-warning, override-init)
+CFLAGS_$(AMDDALPATH)/dc/dce80/dce80_resource.o = -Wno-override-init
 
 DCE80 = dce80_timing_generator.o
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
@@ -382,6 +382,11 @@
 				i += increment) {
 			if (j == hw_points - 1)
 				break;
+			if (i >= TRANSFER_FUNC_POINTS) {
+				DC_LOG_ERROR("Index out of bounds: i=%d, TRANSFER_FUNC_POINTS=%d\n",
+					     i, TRANSFER_FUNC_POINTS);
+				return false;
+			}
 			rgb_resulted[j].red = output_tf->tf_pts.red[i];
 			rgb_resulted[j].green = output_tf->tf_pts.green[i];
 			rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
@@ -566,6 +571,8 @@
 				i += increment) {
 			if (j == hw_points - 1)
 				break;
+			if (i >= TRANSFER_FUNC_POINTS)
+				return false;
 			rgb_resulted[j].red = output_tf->tf_pts.red[i];
 			rgb_resulted[j].green = output_tf->tf_pts.green[i];
 			rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
@@ -749,7 +749,8 @@
 	if (flip_pending)
 		return true;
 
-	if (earliest_inuse_address.grph.addr.quad_part != hubp->request_address.grph.addr.quad_part)
+	if (hubp &&
+	    earliest_inuse_address.grph.addr.quad_part != hubp->request_address.grph.addr.quad_part)
 		return true;
 
 	return false;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_opp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_opp.c
@@ -377,6 +377,7 @@
 		.opp_set_disp_pattern_generator = NULL,
 		.opp_program_dpg_dimensions = NULL,
 		.dpg_is_blanked = NULL,
+		.dpg_is_pending = NULL,
 		.opp_destroy = opp1_destroy
 };
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c
@@ -690,6 +690,9 @@
 	int pair;
 	uint16_t odd_coef, even_coef;
 
+	if (!filter)
+		return;
+
 	for (phase = 0; phase < (NUM_PHASES / 2 + 1); phase++) {
 		for (pair = 0; pair < tap_pairs; pair++) {
 			even_coef = filter[phase * taps + 2 * pair];
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c
@@ -595,7 +595,8 @@
 		hubbub1->base.ctx->dc->clk_mgr->clks.p_state_change_support == false)
 		safe_to_lower = true;
 
-	hubbub1_program_pstate_watermarks(hubbub, watermarks, refclk_mhz, safe_to_lower);
+	if (hubbub1_program_pstate_watermarks(hubbub, watermarks, refclk_mhz, safe_to_lower))
+		wm_pending = true;
 
 	REG_SET(DCHUBBUB_ARB_SAT_LEVEL, 0,
 			DCHUBBUB_ARB_SAT_LEVEL, 60 * refclk_mhz);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c
@@ -927,7 +927,8 @@
 	if (flip_pending)
 		return true;
 
-	if (earliest_inuse_address.grph.addr.quad_part != hubp->request_address.grph.addr.quad_part)
+	if (hubp &&
+	    earliest_inuse_address.grph.addr.quad_part != hubp->request_address.grph.addr.quad_part)
 		return true;
 
 	return false;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_opp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_opp.c
@@ -337,6 +337,19 @@
 		(double_buffer_pending == 0);
 }
 
+bool opp2_dpg_is_pending(struct output_pixel_processor *opp)
+{
+	struct dcn20_opp *oppn20 = TO_DCN20_OPP(opp);
+	uint32_t double_buffer_pending;
+	uint32_t dpg_en;
+
+	REG_GET(DPG_CONTROL, DPG_EN, &dpg_en);
+
+	REG_GET(DPG_STATUS, DPG_DOUBLE_BUFFER_PENDING, &double_buffer_pending);
+
+	return (dpg_en == 1 && double_buffer_pending == 1);
+}
+
 void opp2_program_left_edge_extra_pixel (
 		struct output_pixel_processor *opp,
 		bool count)
@@ -363,6 +376,7 @@
 		.opp_set_disp_pattern_generator = opp2_set_disp_pattern_generator,
 		.opp_program_dpg_dimensions = opp2_program_dpg_dimensions,
 		.dpg_is_blanked = opp2_dpg_is_blanked,
+		.dpg_is_pending = opp2_dpg_is_pending,
 		.opp_dpg_set_blank_color = opp2_dpg_set_blank_color,
 		.opp_destroy = opp1_destroy,
 		.opp_program_left_edge_extra_pixel = opp2_program_left_edge_extra_pixel,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_opp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_opp.h
@@ -159,6 +159,8 @@
 
 bool opp2_dpg_is_blanked(struct output_pixel_processor *opp);
 
+bool opp2_dpg_is_pending(struct output_pixel_processor *opp);
+
 void opp2_dpg_set_blank_color(
 		struct output_pixel_processor *opp,
 		const struct tg_color *color);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn201/dcn201_opp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn201/dcn201_opp.c
@@ -50,6 +50,7 @@
 		.opp_set_disp_pattern_generator = opp2_set_disp_pattern_generator,
 		.opp_program_dpg_dimensions = opp2_program_dpg_dimensions,
 		.dpg_is_blanked = opp2_dpg_is_blanked,
+		.dpg_is_pending = opp2_dpg_is_pending,
 		.opp_dpg_set_blank_color = opp2_dpg_set_blank_color,
 		.opp_destroy = opp1_destroy,
 		.opp_program_left_edge_extra_pixel = opp2_program_left_edge_extra_pixel,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
@@ -177,6 +177,8 @@
 				i += increment) {
 			if (j == hw_points)
 				break;
+			if (i >= TRANSFER_FUNC_POINTS)
+				return false;
 			rgb_resulted[j].red = output_tf->tf_pts.red[i];
 			rgb_resulted[j].green = output_tf->tf_pts.green[i];
 			rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
@@ -335,6 +337,8 @@
 				i += increment) {
 			if (j == hw_points - 1)
 				break;
+			if (i >= TRANSFER_FUNC_POINTS)
+				return false;
 			rgb_resulted[j].red = output_tf->tf_pts.red[i];
 			rgb_resulted[j].green = output_tf->tf_pts.green[i];
 			rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.c
@@ -44,6 +44,36 @@
 #define NUM_ELEMENTS(a) (sizeof(a) / sizeof((a)[0]))
 
 
+void mpc3_mpc_init(struct mpc *mpc)
+{
+	struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc);
+	int opp_id;
+
+	mpc1_mpc_init(mpc);
+
+	for (opp_id = 0; opp_id < MAX_OPP; opp_id++) {
+		if (REG(MUX[opp_id]))
+			/* disable mpc out rate and flow control */
+			REG_UPDATE_2(MUX[opp_id], MPC_OUT_RATE_CONTROL_DISABLE,
+					1, MPC_OUT_FLOW_CONTROL_COUNT, 0);
+	}
+}
+
+void mpc3_mpc_init_single_inst(struct mpc *mpc, unsigned int mpcc_id)
+{
+	struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc);
+
+	mpc1_mpc_init_single_inst(mpc, mpcc_id);
+
+	/* assuming mpc out mux is connected to opp with the same index at this
+	 * point in time (e.g. transitioning from vbios to driver)
+	 */
+	if (mpcc_id < MAX_OPP && REG(MUX[mpcc_id]))
+		/* disable mpc out rate and flow control */
+		REG_UPDATE_2(MUX[mpcc_id], MPC_OUT_RATE_CONTROL_DISABLE,
+				1, MPC_OUT_FLOW_CONTROL_COUNT, 0);
+}
+
 bool mpc3_is_dwb_idle(
 	struct mpc *mpc,
 	int dwb_id)
@@ -80,25 +110,6 @@
 		MPC_DWB0_MUX, 0xf);
 }
 
-void mpc3_set_out_rate_control(
-	struct mpc *mpc,
-	int opp_id,
-	bool enable,
-	bool rate_2x_mode,
-	struct mpc_dwb_flow_control *flow_control)
-{
-	struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc);
-
-	REG_UPDATE_2(MUX[opp_id],
-			MPC_OUT_RATE_CONTROL_DISABLE, !enable,
-			MPC_OUT_RATE_CONTROL, rate_2x_mode);
-
-	if (flow_control)
-		REG_UPDATE_2(MUX[opp_id],
-			MPC_OUT_FLOW_CONTROL_MODE, flow_control->flow_ctrl_mode,
-			MPC_OUT_FLOW_CONTROL_COUNT, flow_control->flow_ctrl_cnt1);
-}
-
 enum dc_lut_mode mpc3_get_ogam_current(struct mpc *mpc, int mpcc_id)
 {
 	/*Contrary to DCN2 and DCN1 wherein a single status register field holds this info;
@@ -1386,8 +1397,8 @@
 	.read_mpcc_state = mpc1_read_mpcc_state,
 	.insert_plane = mpc1_insert_plane,
 	.remove_mpcc = mpc1_remove_mpcc,
-	.mpc_init = mpc1_mpc_init,
-	.mpc_init_single_inst = mpc1_mpc_init_single_inst,
+	.mpc_init = mpc3_mpc_init,
+	.mpc_init_single_inst = mpc3_mpc_init_single_inst,
 	.update_blending = mpc2_update_blending,
 	.cursor_lock = mpc1_cursor_lock,
 	.get_mpcc_for_dpp = mpc1_get_mpcc_for_dpp,
@@ -1404,7 +1415,6 @@
 	.set_dwb_mux = mpc3_set_dwb_mux,
 	.disable_dwb_mux = mpc3_disable_dwb_mux,
 	.is_dwb_idle = mpc3_is_dwb_idle,
-	.set_out_rate_control = mpc3_set_out_rate_control,
 	.set_gamut_remap = mpc3_set_gamut_remap,
 	.program_shaper = mpc3_program_shaper,
 	.acquire_rmu = mpcc3_acquire_rmu,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.h
@@ -1007,6 +1007,13 @@
 	int num_mpcc,
 	int num_rmu);
 
+void mpc3_mpc_init(
+	struct mpc *mpc);
+
+void mpc3_mpc_init_single_inst(
+	struct mpc *mpc,
+	unsigned int mpcc_id);
+
 bool mpc3_program_shaper(
 		struct mpc *mpc,
 		const struct pwl_params *params,
@@ -1074,13 +1081,6 @@
 	struct mpc *mpc,
 	int dwb_id);
 
-void mpc3_set_out_rate_control(
-	struct mpc *mpc,
-	int opp_id,
-	bool enable,
-	bool rate_2x_mode,
-	struct mpc_dwb_flow_control *flow_control);
-
 void mpc3_power_on_ogam_lut(
 	struct mpc *mpc, int mpcc_id,
 	bool power_on);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_link_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_link_encoder.c
@@ -395,6 +395,12 @@
 				x),
 			25));
 
+	// If y rounds up to integer, carry it over to x.
+	if (y >> 25) {
+		x += 1;
+		y = 0;
+	}
+
 	switch (stream_encoder_inst) {
 	case 0:
 		REG_SET_2(DP_DPHY_SYM32_VC_RATE_CNTL0, 0,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dio_link_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dio_link_encoder.c
@@ -34,6 +34,7 @@
 #include "dc_bios_types.h"
 #include "link_enc_cfg.h"
 
+#include "dc_dmub_srv.h"
 #include "gpio_service_interface.h"
 
 #ifndef MIN
@@ -61,6 +62,38 @@
 #define AUX_REG_WRITE(reg_name, val) \
 			dm_write_reg(CTX, AUX_REG(reg_name), val)
 
+static uint8_t phy_id_from_transmitter(enum transmitter t)
+{
+	uint8_t phy_id;
+
+	switch (t) {
+	case TRANSMITTER_UNIPHY_A:
+		phy_id = 0;
+		break;
+	case TRANSMITTER_UNIPHY_B:
+		phy_id = 1;
+		break;
+	case TRANSMITTER_UNIPHY_C:
+		phy_id = 2;
+		break;
+	case TRANSMITTER_UNIPHY_D:
+		phy_id = 3;
+		break;
+	case TRANSMITTER_UNIPHY_E:
+		phy_id = 4;
+		break;
+	case TRANSMITTER_UNIPHY_F:
+		phy_id = 5;
+		break;
+	case TRANSMITTER_UNIPHY_G:
+		phy_id = 6;
+		break;
+	default:
+		phy_id = 0;
+		break;
+	}
+	return phy_id;
+}
 
 void enc32_hw_init(struct link_encoder *enc)
 {
@@ -117,38 +150,50 @@
 	}
 }
 
-static bool dcn32_link_encoder_is_in_alt_mode(struct link_encoder *enc)
+static bool query_dp_alt_from_dmub(struct link_encoder *enc,
+	union dmub_rb_cmd *cmd)
 {
 	struct dcn10_link_encoder *enc10 = TO_DCN10_LINK_ENC(enc);
-	uint32_t dp_alt_mode_disable = 0;
-	bool is_usb_c_alt_mode = false;
 
-	if (enc->features.flags.bits.DP_IS_USB_C) {
-		/* if value == 1 alt mode is disabled, otherwise it is enabled */
-		REG_GET(RDPCSPIPE_PHY_CNTL6, RDPCS_PHY_DPALT_DISABLE, &dp_alt_mode_disable);
-		is_usb_c_alt_mode = (dp_alt_mode_disable == 0);
-	}
+	memset(cmd, 0, sizeof(*cmd));
+	cmd->query_dp_alt.header.type = DMUB_CMD__VBIOS;
+	cmd->query_dp_alt.header.sub_type =
+		DMUB_CMD__VBIOS_TRANSMITTER_QUERY_DP_ALT;
+	cmd->query_dp_alt.header.payload_bytes = sizeof(cmd->query_dp_alt.data);
+	cmd->query_dp_alt.data.phy_id = phy_id_from_transmitter(enc10->base.transmitter);
 
-	return is_usb_c_alt_mode;
+	if (!dc_wake_and_execute_dmub_cmd(enc->ctx, cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY))
+		return false;
+
+	return true;
 }
 
-static void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc,
+bool dcn32_link_encoder_is_in_alt_mode(struct link_encoder *enc)
+{
+	union dmub_rb_cmd cmd;
+
+	if (!query_dp_alt_from_dmub(enc, &cmd))
+		return false;
+
+	return (cmd.query_dp_alt.data.is_dp_alt_disable == 0);
+}
+
+void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc,
 	struct dc_link_settings *link_settings)
 {
-	struct dcn10_link_encoder *enc10 = TO_DCN10_LINK_ENC(enc);
-	uint32_t is_in_usb_c_dp4_mode = 0;
+	union dmub_rb_cmd cmd;
 
 	dcn10_link_encoder_get_max_link_cap(enc, link_settings);
 
-	/* in usb c dp2 mode, max lane count is 2 */
-	if (enc->funcs->is_in_alt_mode && enc->funcs->is_in_alt_mode(enc)) {
-		REG_GET(RDPCSPIPE_PHY_CNTL6, RDPCS_PHY_DPALT_DP4, &is_in_usb_c_dp4_mode);
-		if (!is_in_usb_c_dp4_mode)
-			link_settings->lane_count = MIN(LANE_COUNT_TWO, link_settings->lane_count);
-	}
+	if (!query_dp_alt_from_dmub(enc, &cmd))
+		return;
 
+	if (cmd.query_dp_alt.data.is_usb &&
+			cmd.query_dp_alt.data.is_dp4 == 0)
+		link_settings->lane_count = MIN(LANE_COUNT_TWO, link_settings->lane_count);
 }
 
+
 static const struct link_encoder_funcs dcn32_link_enc_funcs = {
 	.read_state = link_enc2_read_state,
 	.validate_output_with_stream =
@@ -203,12 +248,12 @@
 	enc10->base.hpd_source = init_data->hpd_source;
 	enc10->base.connector = init_data->connector;
 
+	if (enc10->base.connector.id == CONNECTOR_ID_USBC)
+		enc10->base.features.flags.bits.DP_IS_USB_C = 1;
 
 	enc10->base.preferred_engine = ENGINE_ID_UNKNOWN;
 
 	enc10->base.features = *enc_features;
-	if (enc10->base.connector.id == CONNECTOR_ID_USBC)
-		enc10->base.features.flags.bits.DP_IS_USB_C = 1;
 
 	enc10->base.transmitter = init_data->transmitter;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dio_link_encoder.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dio_link_encoder.h
@@ -53,4 +53,9 @@
 	const struct dc_link_settings *link_settings,
 	enum clock_source_id clock_source);
 
+bool dcn32_link_encoder_is_in_alt_mode(struct link_encoder *enc);
+
+void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc,
+	struct dc_link_settings *link_settings);
+
 #endif /* __DC_LINK_ENCODER__DCN32_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
@@ -47,7 +47,7 @@
 	struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc);
 	int mpcc_id;
 
-	mpc1_mpc_init(mpc);
+	mpc3_mpc_init(mpc);
 
 	if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc) {
 		if (mpc30->mpc_mask->MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE && mpc30->mpc_mask->MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE) {
@@ -991,7 +991,7 @@
 	.insert_plane = mpc1_insert_plane,
 	.remove_mpcc = mpc1_remove_mpcc,
 	.mpc_init = mpc32_mpc_init,
-	.mpc_init_single_inst = mpc1_mpc_init_single_inst,
+	.mpc_init_single_inst = mpc3_mpc_init_single_inst,
 	.update_blending = mpc2_update_blending,
 	.cursor_lock = mpc1_cursor_lock,
 	.get_mpcc_for_dpp = mpc1_get_mpcc_for_dpp,
@@ -1008,7 +1008,6 @@
 	.set_dwb_mux = mpc3_set_dwb_mux,
 	.disable_dwb_mux = mpc3_disable_dwb_mux,
 	.is_dwb_idle = mpc3_is_dwb_idle,
-	.set_out_rate_control = mpc3_set_out_rate_control,
 	.set_gamut_remap = mpc3_set_gamut_remap,
 	.program_shaper = mpc32_program_shaper,
 	.program_3dlut = mpc32_program_3dlut,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c
@@ -234,12 +234,12 @@
 				pipe->stream->timing.v_addressable != pipe->stream->src.height) {
 			is_center_timing = true;
 		}
-	}
 
-	if (pipe->plane_state) {
-		if (pipe->stream->timing.v_addressable != pipe->plane_state->dst_rect.height &&
-				pipe->stream->timing.v_addressable != pipe->plane_state->src_rect.height) {
-			is_center_timing = true;
+		if (pipe->plane_state) {
+			if (pipe->stream->timing.v_addressable != pipe->plane_state->dst_rect.height &&
+					pipe->stream->timing.v_addressable != pipe->plane_state->src_rect.height) {
+				is_center_timing = true;
+			}
 		}
 	}
 
@@ -673,7 +673,7 @@
 
 				subvp_disallow |= disallow_subvp_in_active_plus_blank(pipe);
 				refresh_rate = (pipe->stream->timing.pix_clk_100hz * (uint64_t)100 +
-					pipe->stream->timing.v_total * pipe->stream->timing.h_total - (uint64_t)1);
+					pipe->stream->timing.v_total * (unsigned long long)pipe->stream->timing.h_total - (uint64_t)1);
 				refresh_rate = div_u64(refresh_rate, pipe->stream->timing.v_total);
 				refresh_rate = div_u64(refresh_rate, pipe->stream->timing.h_total);
 			}
@@ -734,7 +734,7 @@
 
 				subvp_disallow |= disallow_subvp_in_active_plus_blank(pipe);
 				refresh_rate = (pipe->stream->timing.pix_clk_100hz * (uint64_t)100 +
-					pipe->stream->timing.v_total * pipe->stream->timing.h_total - (uint64_t)1);
+					pipe->stream->timing.v_total * (unsigned long long)pipe->stream->timing.h_total - (uint64_t)1);
 				refresh_rate = div_u64(refresh_rate, pipe->stream->timing.v_total);
 				refresh_rate = div_u64(refresh_rate, pipe->stream->timing.h_total);
 			}
@@ -782,3 +782,9 @@
 		pipe_cnt++;
 	}
 }
+
+void dcn32_override_min_req_dcfclk(struct dc *dc, struct dc_state *context)
+{
+	if (dcn32_subvp_in_use(dc, context) && context->bw_ctx.bw.dcn.clk.dcfclk_khz <= MIN_SUBVP_DCFCLK_KHZ)
+		context->bw_ctx.bw.dcn.clk.dcfclk_khz = MIN_SUBVP_DCFCLK_KHZ;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c
@@ -290,10 +290,10 @@
 
 		/* The recommended programming sequence to enable DTBCLK DTO to generate
 		 * valid pixel HPO DPSTREAM ENCODER, specifies that DTO source select should
-		 * be set only after DTO is enabled
+		 * be set only after DTO is enabled.
+		 * PIPEx_DTO_SRC_SEL should not be programmed during DTBCLK update since OTG may still be on, and the
+		 * programming is handled in program_pix_clk() regardless, so it can be removed from here.
 		 */
-		REG_UPDATE(OTG_PIXEL_RATE_CNTL[params->otg_inst],
-				PIPE_DTO_SRC_SEL[params->otg_inst], 2);
 	} else {
 		switch (params->otg_inst) {
 		case 0:
@@ -310,9 +310,12 @@
 			break;
 		}
 
-		REG_UPDATE_2(OTG_PIXEL_RATE_CNTL[params->otg_inst],
-				DTBCLK_DTO_ENABLE[params->otg_inst], 0,
-				PIPE_DTO_SRC_SEL[params->otg_inst], params->is_hdmi ? 0 : 1);
+		/**
+		 * PIPEx_DTO_SRC_SEL should not be programmed during DTBCLK update since OTG may still be on, and the
+		 * programming is handled in program_pix_clk() regardless, so it can be removed from here.
+		 */
+		REG_UPDATE(OTG_PIXEL_RATE_CNTL[params->otg_inst],
+				DTBCLK_DTO_ENABLE[params->otg_inst], 0);
 
 		REG_WRITE(DTBCLK_DTO_MODULO[params->otg_inst], 0);
 		REG_WRITE(DTBCLK_DTO_PHASE[params->otg_inst], 0);
@@ -768,7 +771,7 @@
 	/* for DPMST, this backend could be used by multiple front end.
 	only disable the backend if this stream_enc_ins is the last active stream enc connected to this back_end*/
 		uint8_t i;
-		for (i = 0; i != link_enc_inst && i < sizeof(fe_clk_en); i++) {
+		for (i = 0; i != link_enc_inst && i < ARRAY_SIZE(fe_clk_en); i++) {
 			if (fe_clk_en[i] && be_clk_sel[i] == link_enc_inst)
 				num_enabled_symclk_fe++;
 		}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dio_link_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dio_link_encoder.c
@@ -184,6 +184,8 @@
 	enc10->base.hpd_source = init_data->hpd_source;
 	enc10->base.connector = init_data->connector;
 
+	if (enc10->base.connector.id == CONNECTOR_ID_USBC)
+		enc10->base.features.flags.bits.DP_IS_USB_C = 1;
 
 	enc10->base.preferred_engine = ENGINE_ID_UNKNOWN;
 
@@ -238,8 +240,6 @@
 	}
 
 	enc10->base.features.flags.bits.HDMI_6GB_EN = 1;
-	if (enc10->base.connector.id == CONNECTOR_ID_USBC)
-		enc10->base.features.flags.bits.DP_IS_USB_C = 1;
 
 	if (bp_funcs->get_connector_speed_cap_info)
 		result = bp_funcs->get_connector_speed_cap_info(enc10->base.ctx->dc_bios,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c
@@ -1453,10 +1453,9 @@
 	ASSERT(fclks->num_levels);
 
 	vmin0p65_idx = 0;
-	vmid0p72_idx = fclks->num_levels -
-		(fclks->num_levels > 2 ? 3 : (fclks->num_levels > 1 ? 2 : 1));
-	vnom0p8_idx = fclks->num_levels - (fclks->num_levels > 1 ? 2 : 1);
-	vmax0p9_idx = fclks->num_levels - 1;
+	vmid0p72_idx = fclks->num_levels > 2 ? fclks->num_levels - 3 : 0;
+	vnom0p8_idx = fclks->num_levels > 1 ? fclks->num_levels - 2 : 0;
+	vmax0p9_idx = fclks->num_levels > 0 ? fclks->num_levels - 1 : 0;
 
 	dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 =
 		32 * (fclks->data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
@@ -78,7 +78,7 @@
 
 static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma)
 {
-	unsigned int ret_val = 0;
+	unsigned int ret_val = 1;
 
 	if (source_format == dm_444_16) {
 		if (!is_chroma)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
@@ -78,7 +78,7 @@
 
 static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma)
 {
-	unsigned int ret_val = 0;
+	unsigned int ret_val = 1;
 
 	if (source_format == dm_444_16) {
 		if (!is_chroma)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
@@ -53,7 +53,7 @@
 
 static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma)
 {
-	unsigned int ret_val = 0;
+	unsigned int ret_val = 1;
 
 	if (source_format == dm_444_16) {
 		if (!is_chroma)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
@@ -4273,7 +4273,7 @@
 
 	//Calculate Swath, DET Configuration, DCFCLKDeepSleep
 	//
-	for (i = 0; i < mode_lib->soc.num_states; ++i) {
+	for (i = start_state; i < mode_lib->soc.num_states; ++i) {
 		for (j = 0; j <= 1; ++j) {
 			for (k = 0; k < v->NumberOfActivePlanes; ++k) {
 				v->RequiredDPPCLKThisState[k] = v->RequiredDPPCLK[i][j][k];
@@ -4576,7 +4576,7 @@
 
 	//Calculate Return BW
 
-	for (i = 0; i < mode_lib->soc.num_states; ++i) {
+	for (i = start_state; i < mode_lib->soc.num_states; ++i) {
 		for (j = 0; j <= 1; ++j) {
 			for (k = 0; k <= v->NumberOfActivePlanes - 1; k++) {
 				if (v->BlendingAndTiming[k] == k) {
@@ -4635,7 +4635,7 @@
 					v->UrgentOutOfOrderReturnPerChannelVMDataOnly);
 	v->FinalDRAMClockChangeLatency = (v->DRAMClockChangeLatencyOverride > 0 ? v->DRAMClockChangeLatencyOverride : v->DRAMClockChangeLatency);
 
-	for (i = 0; i < mode_lib->soc.num_states; ++i) {
+	for (i = start_state; i < mode_lib->soc.num_states; ++i) {
 		for (j = 0; j <= 1; ++j) {
 			v->DCFCLKState[i][j] = v->DCFCLKPerState[i];
 		}
@@ -4646,7 +4646,7 @@
 
 		if (v->ClampMinDCFCLK) {
 			/* Clamp calculated values to actual minimum */
-			for (i = 0; i < mode_lib->soc.num_states; ++i) {
+			for (i = start_state; i < mode_lib->soc.num_states; ++i) {
 				for (j = 0; j <= 1; ++j) {
 					if (v->DCFCLKState[i][j] < mode_lib->soc.min_dcfclk) {
 						v->DCFCLKState[i][j] = mode_lib->soc.min_dcfclk;
@@ -4656,7 +4656,7 @@
 		}
 	}
 
-	for (i = 0; i < mode_lib->soc.num_states; ++i) {
+	for (i = start_state; i < mode_lib->soc.num_states; ++i) {
 		for (j = 0; j <= 1; ++j) {
 			v->IdealSDPPortBandwidthPerState[i][j] = dml_min3(
 					v->ReturnBusWidth * v->DCFCLKState[i][j],
@@ -4674,7 +4674,7 @@
 
 	//Re-ordering Buffer Support Check
 
-	for (i = 0; i < mode_lib->soc.num_states; ++i) {
+	for (i = start_state; i < mode_lib->soc.num_states; ++i) {
 		for (j = 0; j <= 1; ++j) {
 			if ((v->ROBBufferSizeInKByte - v->PixelChunkSizeInKByte) * 1024 / v->ReturnBWPerState[i][j]
 					> (v->RoundTripPingLatencyCycles + 32) / v->DCFCLKState[i][j] + ReorderingBytes / v->ReturnBWPerState[i][j]) {
@@ -4692,7 +4692,7 @@
 		MaxTotalVActiveRDBandwidth = MaxTotalVActiveRDBandwidth + v->ReadBandwidthLuma[k] + v->ReadBandwidthChroma[k];
 	}
 
-	for (i = 0; i < mode_lib->soc.num_states; ++i) {
+	for (i = start_state; i < mode_lib->soc.num_states; ++i) {
 		for (j = 0; j <= 1; ++j) {
 			v->MaxTotalVerticalActiveAvailableBandwidth[i][j] = dml_min(
 					v->IdealSDPPortBandwidthPerState[i][j] * v->MaxAveragePercentOfIdealSDPPortBWDisplayCanUseInNormalSystemOperation / 100,
@@ -4708,7 +4708,7 @@
 
 	//Prefetch Check
 
-	for (i = 0; i < mode_lib->soc.num_states; ++i) {
+	for (i = start_state; i < mode_lib->soc.num_states; ++i) {
 		for (j = 0; j <= 1; ++j) {
 			int NextPrefetchModeState = MinPrefetchMode;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c
@@ -304,6 +304,16 @@
 			dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 		}
 
+		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+		 * MAX_NUM_DPM_LVL is 8.
+		 * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+		 * DC__VOLTAGE_STATES is 40.
+		 */
+		if (num_states > MAX_NUM_DPM_LVL) {
+			ASSERT(0);
+			return;
+		}
+
 		dcn3_02_soc.num_states = num_states;
 		for (i = 0; i < dcn3_02_soc.num_states; i++) {
 			dcn3_02_soc.clock_limits[i].state = i;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c
@@ -266,6 +266,17 @@
 					optimal_uclk_for_dcfclk_sta_targets[i] =
 							bw_params->clk_table.entries[j].memclk_mhz * 16;
 					break;
+				} else {
+					/* condition where (dcfclk_sta_targets[i] >= optimal_dcfclk_for_uclk[j]):
+					 * This is required for dcn303 because it just so happens that the memory
+					 * bandwidth is low enough such that all the optimal DCFCLK for each UCLK
+					 * is lower than the smallest DCFCLK STA target. In this case we need to
+					 * populate the optimal UCLK for each DCFCLK STA target to be the max UCLK.
+					 */
+					if (j == num_uclk_states - 1) {
+						optimal_uclk_for_dcfclk_sta_targets[i] =
+								bw_params->clk_table.entries[j].memclk_mhz * 16;
+					}
 				}
 			}
 		}
@@ -299,6 +310,16 @@
 			dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 		}
 
+		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+		 * MAX_NUM_DPM_LVL is 8.
+		 * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+		 * DC__VOLTAGE_STATES is 40.
+		 */
+		if (num_states > MAX_NUM_DPM_LVL) {
+			ASSERT(0);
+			return;
+		}
+
 		dcn3_03_soc.num_states = num_states;
 		for (i = 0; i < dcn3_03_soc.num_states; i++) {
 			dcn3_03_soc.clock_limits[i].state = i;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c
@@ -291,6 +291,7 @@
 	.do_urgent_latency_adjustment = false,
 	.urgent_latency_adjustment_fabric_clock_component_us = 0,
 	.urgent_latency_adjustment_fabric_clock_reference_mhz = 0,
+	.dispclk_dppclk_vco_speed_mhz = 2400.0,
 	.num_chans = 4,
 	.dummy_pstate_latency_us = 10.0
 };
@@ -438,6 +439,7 @@
 	.do_urgent_latency_adjustment = false,
 	.urgent_latency_adjustment_fabric_clock_component_us = 0,
 	.urgent_latency_adjustment_fabric_clock_reference_mhz = 0,
+	.dispclk_dppclk_vco_speed_mhz = 2500.0,
 };
 
 void dcn31_zero_pipe_dcc_fraction(display_e2e_pipe_params_st *pipes,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
@@ -868,8 +868,9 @@
 	 * for VBLANK: (VACTIVE region of the SubVP pipe can fit the MALL prefetch, VBLANK frame time,
 	 * and the max of (VBLANK blanking time, MALL region)).
 	 */
-	if (stretched_drr_us < (1 / (double)drr_timing->min_refresh_in_uhz) * 1000000 * 1000000 &&
-			subvp_active_us - prefetch_us - stretched_drr_us - max_vblank_mallregion > 0)
+	if (drr_timing &&
+	    stretched_drr_us < (1 / (double)drr_timing->min_refresh_in_uhz) * 1000000 * 1000000 &&
+	    subvp_active_us - prefetch_us - stretched_drr_us - max_vblank_mallregion > 0)
 		schedulable = true;
 
 	return schedulable;
@@ -934,7 +935,7 @@
 		if (!subvp_pipe && pipe_mall_type == SUBVP_MAIN)
 			subvp_pipe = pipe;
 	}
-	if (found) {
+	if (found && subvp_pipe) {
 		phantom_stream = dc_state_get_paired_subvp_stream(context, subvp_pipe->stream);
 		main_timing = &subvp_pipe->stream->timing;
 		phantom_timing = &phantom_stream->timing;
@@ -2760,7 +2761,7 @@
 	struct _vcs_dpi_voltage_scaling_st entry = {0};
 	struct clk_limit_table_entry max_clk_data = {0};
 
-	unsigned int min_dcfclk_mhz = 199, min_fclk_mhz = 299;
+	unsigned int min_dcfclk_mhz = 399, min_fclk_mhz = 599;
 
 	static const unsigned int num_dcfclk_stas = 5;
 	unsigned int dcfclk_sta_targets[DC__VOLTAGE_STATES] = {199, 615, 906, 1324, 1564};
@@ -3207,6 +3208,16 @@
 				dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 			}
 
+			/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+			 * MAX_NUM_DPM_LVL is 8.
+			 * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+			 * DC__VOLTAGE_STATES is 40.
+			 */
+			if (num_states > MAX_NUM_DPM_LVL) {
+				ASSERT(0);
+				return;
+			}
+
 			dcn3_2_soc.num_states = num_states;
 			for (i = 0; i < dcn3_2_soc.num_states; i++) {
 				dcn3_2_soc.clock_limits[i].state = i;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
@@ -3364,6 +3364,9 @@
 							&mode_lib->vba.UrgentBurstFactorLumaPre[k],
 							&mode_lib->vba.UrgentBurstFactorChromaPre[k],
 							&mode_lib->vba.NotUrgentLatencyHidingPre[k]);
+
+					v->cursor_bw_pre[k] = mode_lib->vba.NumberOfCursors[k] * mode_lib->vba.CursorWidth[k][0] * mode_lib->vba.CursorBPP[k][0] /
+							8.0 / (mode_lib->vba.HTotal[k] / mode_lib->vba.PixelClock[k]) * v->VRatioPreY[i][j][k];
 				}
 
 				{
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
@@ -803,6 +803,16 @@
 			dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 		}
 
+		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+		 * MAX_NUM_DPM_LVL is 8.
+		 * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+		 * DC__VOLTAGE_STATES is 40.
+		 */
+		if (num_states > MAX_NUM_DPM_LVL) {
+			ASSERT(0);
+			return;
+		}
+
 		dcn3_21_soc.num_states = num_states;
 		for (i = 0; i < dcn3_21_soc.num_states; i++) {
 			dcn3_21_soc.clock_limits[i].state = i;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c
@@ -177,7 +177,7 @@
 	.urgent_latency_pixel_data_only_us = 4.0,
 	.urgent_latency_pixel_mixed_with_vm_data_us = 4.0,
 	.urgent_latency_vm_data_only_us = 4.0,
-	.dram_clock_change_latency_us = 11.72,
+	.dram_clock_change_latency_us = 34.0,
 	.urgent_out_of_order_return_per_channel_pixel_only_bytes = 4096,
 	.urgent_out_of_order_return_per_channel_pixel_and_vm_bytes = 4096,
 	.urgent_out_of_order_return_per_channel_vm_only_bytes = 4096,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
@@ -1099,8 +1099,13 @@
 
 	// Total Available Pipes Support Check
 	for (k = 0; k < mode_lib->vba.NumberOfActivePlanes; ++k) {
-		total_pipes += mode_lib->vba.DPPPerPlane[k];
 		pipe_idx = get_pipe_idx(mode_lib, k);
+		if (pipe_idx == -1) {
+			ASSERT(0);
+			continue; // skip inactive planes
+		}
+		total_pipes += mode_lib->vba.DPPPerPlane[k];
+
 		if (mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz > 0.0)
 			mode_lib->vba.DPPCLK[k] = mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz;
 		else
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c
@@ -39,7 +39,7 @@
 
 static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma)
 {
-	unsigned int ret_val = 0;
+	unsigned int ret_val = 1;
 
 	if (source_format == dm_444_16) {
 		if (!is_chroma)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
@@ -66,11 +66,15 @@
 
 static inline double dml_ceil(double a, double granularity)
 {
+	if (granularity == 0)
+		return 0;
 	return (double) dcn_bw_ceil2(a, granularity);
 }
 
 static inline double dml_floor(double a, double granularity)
 {
+	if (granularity == 0)
+		return 0;
 	return (double) dcn_bw_floor2(a, granularity);
 }
 
@@ -114,11 +118,15 @@
 
 static inline double dml_ceil_ex(double x, double granularity)
 {
+	if (granularity == 0)
+		return 0;
 	return (double) dcn_bw_ceil2(x, granularity);
 }
 
 static inline double dml_floor_ex(double x, double granularity)
 {
+	if (granularity == 0)
+		return 0;
 	return (double) dcn_bw_floor2(x, granularity);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
@@ -1219,6 +1219,7 @@
 	s->dst_y_prefetch_oto = s->Tvm_oto_lines + 2 * s->Tr0_oto_lines + s->Lsw_oto;
 
 	s->dst_y_prefetch_equ = p->VStartup - (*p->TSetup + dml_max(p->TWait + p->TCalc, *p->Tdmdl)) / s->LineTime - (*p->DSTYAfterScaler + (dml_float_t) *p->DSTXAfterScaler / (dml_float_t)p->myPipe->HTotal);
+	s->dst_y_prefetch_equ = dml_min(s->dst_y_prefetch_equ, 63.75); // limit to the reg limit of U6.2 for DST_Y_PREFETCH
 
 #ifdef __DML_VBA_DEBUG__
 	dml_print("DML::%s: HTotal = %u\n", __func__, p->myPipe->HTotal);
@@ -4282,7 +4283,7 @@
 	}
 
 	*p->compbuf_reserved_space_64b = 2 * p->PixelChunkSizeInKByte * 1024 / 64;
-	if (p->UnboundedRequestEnabled) {
+	if (*p->UnboundedRequestEnabled) {
 		*p->compbuf_reserved_space_64b = dml_max(*p->compbuf_reserved_space_64b,
 				(dml_float_t)(p->ROBBufferSizeInKByte * 1024/64)
 				- (dml_float_t)(RoundedUpSwathSizeBytesY[SurfaceDoingUnboundedRequest] * TTUFIFODEPTH / MAXIMUMCOMPRESSION/64));
@@ -9460,8 +9461,10 @@
 
 		/* Copy the calculated watermarks to mp.Watermark as the getter functions are
 		 * implemented by the DML team to copy the calculated values from the mp.Watermark interface.
+		 * &mode_lib->mp.Watermark and &locals->Watermark are the same address, memcpy may lead to
+		 * unexpected behavior. memmove should be used.
 		 */
-		memcpy(&mode_lib->mp.Watermark, CalculateWatermarks_params->Watermark, sizeof(struct Watermarks));
+		memmove(&mode_lib->mp.Watermark, CalculateWatermarks_params->Watermark, sizeof(struct Watermarks));
 
 		for (k = 0; k < mode_lib->ms.num_active_planes; ++k) {
 			if (mode_lib->ms.cache_display_cfg.writeback.WritebackEnable[k] == true) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c
@@ -88,7 +88,8 @@
 			return  i;
 	}
 
-	return -1;
+	ASSERT(false);
+	return __DML2_WRAPPER_MAX_STREAMS_PLANES__;
 }
 
 static int find_disp_cfg_idx_by_stream_id(struct dml2_dml_to_dc_pipe_mapping *mapping, unsigned int stream_id)
@@ -100,7 +101,8 @@
 			return  i;
 	}
 
-	return -1;
+	ASSERT(false);
+	return __DML2_WRAPPER_MAX_STREAMS_PLANES__;
 }
 
 // The master pipe of a stream is defined as the top pipe in odm slice 0
@@ -237,12 +239,25 @@
 	 * However this condition comes with a caveat. We need to ignore pipes that will
 	 * require a change in OPP but still have the same stream id. For example during
 	 * an MPC to ODM transiton.
+	 *
+	 * Adding check to avoid pipe select on the head pipe by utilizing dc resource
+	 * helper function resource_get_primary_dpp_pipe and comparing the pipe index.
 	 */
 	if (existing_state) {
 		for (i = 0; i < pipe_count; i++) {
 			if (existing_state->res_ctx.pipe_ctx[i].stream && existing_state->res_ctx.pipe_ctx[i].stream->stream_id == stream_id) {
+				struct pipe_ctx *head_pipe =
+					resource_is_pipe_type(&existing_state->res_ctx.pipe_ctx[i], DPP_PIPE) ?
+						resource_get_primary_dpp_pipe(&existing_state->res_ctx.pipe_ctx[i]) :
+							NULL;
+
+				// we should always respect the head pipe from selection
+				if (head_pipe && head_pipe->pipe_idx == i)
+					continue;
 				if (existing_state->res_ctx.pipe_ctx[i].plane_res.hubp &&
-					existing_state->res_ctx.pipe_ctx[i].plane_res.hubp->opp_id != i)
+					existing_state->res_ctx.pipe_ctx[i].plane_res.hubp->opp_id != i &&
+						(existing_state->res_ctx.pipe_ctx[i].prev_odm_pipe ||
+						existing_state->res_ctx.pipe_ctx[i].next_odm_pipe))
 					continue;
 
 				preferred_pipe_candidates[num_preferred_candidates++] = i;
@@ -271,6 +286,14 @@
 	 */
 	if (existing_state) {
 		for (i  = 0; i < pipe_count; i++) {
+			struct pipe_ctx *head_pipe =
+				resource_is_pipe_type(&existing_state->res_ctx.pipe_ctx[i], DPP_PIPE) ?
+					resource_get_primary_dpp_pipe(&existing_state->res_ctx.pipe_ctx[i]) :
+						NULL;
+
+			// we should always respect the head pipe from selection
+			if (head_pipe && head_pipe->pipe_idx == i)
+				continue;
 			if ((existing_state->res_ctx.pipe_ctx[i].plane_res.hubp &&
 				existing_state->res_ctx.pipe_ctx[i].plane_res.hubp->opp_id != i) ||
 				existing_state->res_ctx.pipe_ctx[i].stream_res.tg)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c
@@ -750,6 +750,8 @@
 					ctx->config.svp_pstate.callbacks.dc,
 					state,
 					curr_pipe->plane_state);
+			if (!phantom_plane)
+				return;
 		}
 
 		memcpy(&phantom_plane->address, &curr_pipe->plane_state->address, sizeof(phantom_plane->address));
@@ -811,7 +813,7 @@
 {
 	int i, old_plane_count;
 	struct dc_stream_status *stream_status = NULL;
-	struct dc_plane_state *del_planes[MAX_SURFACE_NUM] = { 0 };
+	struct dc_plane_state *del_planes[MAX_SURFACES] = { 0 };
 
 	for (i = 0; i < context->stream_count; i++)
 			if (context->streams[i] == stream) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c
@@ -228,17 +228,14 @@
 		break;
 
 	case dml_project_dcn35:
+	case dml_project_dcn351:
 		out->num_chans = 4;
 		out->round_trip_ping_latency_dcfclk_cycles = 106;
 		out->smn_latency_us = 2;
 		out->dispclk_dppclk_vco_speed_mhz = 3600;
+		out->pct_ideal_dram_bw_after_urgent_pixel_only = 65.0;
 		break;
 
-	case dml_project_dcn351:
-		out->num_chans = 16;
-		out->round_trip_ping_latency_dcfclk_cycles = 1100;
-		out->smn_latency_us = 2;
-		break;
 	}
 	/* ---Overrides if available--- */
 	if (dml2->config.bbox_overrides.dram_num_chan)
@@ -798,7 +795,7 @@
 	}
 }
 
-static struct scaler_data get_scaler_data_for_plane(const struct dc_plane_state *in, struct dc_state *context)
+static void get_scaler_data_for_plane(const struct dc_plane_state *in, struct dc_state *context, struct scaler_data *out)
 {
 	int i;
 	struct pipe_ctx *temp_pipe = &context->res_ctx.temp_pipe;
@@ -819,18 +816,32 @@
 	}
 
 	ASSERT(i < MAX_PIPES);
-	return temp_pipe->plane_res.scl_data;
+	memcpy(out, &temp_pipe->plane_res.scl_data, sizeof(*out));
 }
 
-static void populate_dummy_dml_plane_cfg(struct dml_plane_cfg_st *out, unsigned int location, const struct dc_stream_state *in)
+static void populate_dummy_dml_plane_cfg(struct dml_plane_cfg_st *out, unsigned int location,
+					 const struct dc_stream_state *in,
+					 const struct soc_bounding_box_st *soc)
 {
+	dml_uint_t width, height;
+
+	if (in->timing.h_addressable > 3840)
+		width = 3840;
+	else
+		width = in->timing.h_addressable;	// 4K max
+
+	if (in->timing.v_addressable > 2160)
+		height = 2160;
+	else
+		height = in->timing.v_addressable;	// 4K max
+
 	out->CursorBPP[location] = dml_cur_32bit;
 	out->CursorWidth[location] = 256;
 
-	out->GPUVMMinPageSizeKBytes[location] = 256;
+	out->GPUVMMinPageSizeKBytes[location] = soc->gpuvm_min_page_size_kbytes;
 
-	out->ViewportWidth[location] = in->timing.h_addressable;
-	out->ViewportHeight[location] = in->timing.v_addressable;
+	out->ViewportWidth[location] = width;
+	out->ViewportHeight[location] = height;
 	out->ViewportStationary[location] = false;
 	out->ViewportWidthChroma[location] = 0;
 	out->ViewportHeightChroma[location] = 0;
@@ -849,7 +860,7 @@
 	out->HTapsChroma[location] = 0;
 	out->VTapsChroma[location] = 0;
 	out->SourceScan[location] = dml_rotation_0;
-	out->ScalerRecoutWidth[location] = in->timing.h_addressable;
+	out->ScalerRecoutWidth[location] = width;
 
 	out->LBBitPerPixel[location] = 57;
 
@@ -864,29 +875,35 @@
 	out->ScalerEnabled[location] = false;
 }
 
-static void populate_dml_plane_cfg_from_plane_state(struct dml_plane_cfg_st *out, unsigned int location, const struct dc_plane_state *in, struct dc_state *context)
-{
-	const struct scaler_data scaler_data = get_scaler_data_for_plane(in, context);
+static void populate_dml_plane_cfg_from_plane_state(struct dml_plane_cfg_st *out, unsigned int location,
+						    const struct dc_plane_state *in, struct dc_state *context,
+						    const struct soc_bounding_box_st *soc)
+{
+	struct scaler_data *scaler_data = kzalloc(sizeof(*scaler_data), GFP_KERNEL);
+	if (!scaler_data)
+		return;
+
+	get_scaler_data_for_plane(in, context, scaler_data);
 
 	out->CursorBPP[location] = dml_cur_32bit;
 	out->CursorWidth[location] = 256;
 
-	out->GPUVMMinPageSizeKBytes[location] = 256;
+	out->GPUVMMinPageSizeKBytes[location] = soc->gpuvm_min_page_size_kbytes;
 
-	out->ViewportWidth[location] = scaler_data.viewport.width;
-	out->ViewportHeight[location] = scaler_data.viewport.height;
-	out->ViewportWidthChroma[location] = scaler_data.viewport_c.width;
-	out->ViewportHeightChroma[location] = scaler_data.viewport_c.height;
-	out->ViewportXStart[location] = scaler_data.viewport.x;
-	out->ViewportYStart[location] = scaler_data.viewport.y;
-	out->ViewportXStartC[location] = scaler_data.viewport_c.x;
-	out->ViewportYStartC[location] = scaler_data.viewport_c.y;
+	out->ViewportWidth[location] = scaler_data->viewport.width;
+	out->ViewportHeight[location] = scaler_data->viewport.height;
+	out->ViewportWidthChroma[location] = scaler_data->viewport_c.width;
+	out->ViewportHeightChroma[location] = scaler_data->viewport_c.height;
+	out->ViewportXStart[location] = scaler_data->viewport.x;
+	out->ViewportYStart[location] = scaler_data->viewport.y;
+	out->ViewportXStartC[location] = scaler_data->viewport_c.x;
+	out->ViewportYStartC[location] = scaler_data->viewport_c.y;
 	out->ViewportStationary[location] = false;
 
-	out->ScalerEnabled[location] = scaler_data.ratios.horz.value != dc_fixpt_one.value ||
-				scaler_data.ratios.horz_c.value != dc_fixpt_one.value ||
-				scaler_data.ratios.vert.value != dc_fixpt_one.value ||
-				scaler_data.ratios.vert_c.value != dc_fixpt_one.value;
+	out->ScalerEnabled[location] = scaler_data->ratios.horz.value != dc_fixpt_one.value ||
+				scaler_data->ratios.horz_c.value != dc_fixpt_one.value ||
+				scaler_data->ratios.vert.value != dc_fixpt_one.value ||
+				scaler_data->ratios.vert_c.value != dc_fixpt_one.value;
 
 	/* Current driver code base uses LBBitPerPixel as 57. There is a discrepancy
 	 * from the HW/DML teams about this value. Initialize LBBitPerPixel with the
@@ -902,25 +919,25 @@
 		out->VRatioChroma[location] = 1;
 	} else {
 		/* Follow the original dml_wrapper.c code direction to fix scaling issues */
-		out->HRatio[location] = (dml_float_t)scaler_data.ratios.horz.value / (1ULL << 32);
-		out->HRatioChroma[location] = (dml_float_t)scaler_data.ratios.horz_c.value / (1ULL << 32);
-		out->VRatio[location] = (dml_float_t)scaler_data.ratios.vert.value / (1ULL << 32);
-		out->VRatioChroma[location] = (dml_float_t)scaler_data.ratios.vert_c.value / (1ULL << 32);
+		out->HRatio[location] = (dml_float_t)scaler_data->ratios.horz.value / (1ULL << 32);
+		out->HRatioChroma[location] = (dml_float_t)scaler_data->ratios.horz_c.value / (1ULL << 32);
+		out->VRatio[location] = (dml_float_t)scaler_data->ratios.vert.value / (1ULL << 32);
+		out->VRatioChroma[location] = (dml_float_t)scaler_data->ratios.vert_c.value / (1ULL << 32);
 	}
 
-	if (!scaler_data.taps.h_taps) {
+	if (!scaler_data->taps.h_taps) {
 		out->HTaps[location] = 1;
 		out->HTapsChroma[location] = 1;
 	} else {
-		out->HTaps[location] = scaler_data.taps.h_taps;
-		out->HTapsChroma[location] = scaler_data.taps.h_taps_c;
+		out->HTaps[location] = scaler_data->taps.h_taps;
+		out->HTapsChroma[location] = scaler_data->taps.h_taps_c;
 	}
-	if (!scaler_data.taps.v_taps) {
+	if (!scaler_data->taps.v_taps) {
 		out->VTaps[location] = 1;
 		out->VTapsChroma[location] = 1;
 	} else {
-		out->VTaps[location] = scaler_data.taps.v_taps;
-		out->VTapsChroma[location] = scaler_data.taps.v_taps_c;
+		out->VTaps[location] = scaler_data->taps.v_taps;
+		out->VTapsChroma[location] = scaler_data->taps.v_taps_c;
 	}
 
 	out->SourceScan[location] = (enum dml_rotation_angle)in->rotation;
@@ -931,6 +948,8 @@
 	out->DynamicMetadataTransmittedBytes[location] = 0;
 
 	out->NumberOfCursors[location] = 1;
+
+	kfree(scaler_data);
 }
 
 static unsigned int map_stream_to_dml_display_cfg(const struct dml2_context *dml2,
@@ -1107,7 +1126,8 @@
 			disp_cfg_plane_location = dml_dispcfg->num_surfaces++;
 
 			populate_dummy_dml_surface_cfg(&dml_dispcfg->surface, disp_cfg_plane_location, context->streams[i]);
-			populate_dummy_dml_plane_cfg(&dml_dispcfg->plane, disp_cfg_plane_location, context->streams[i]);
+			populate_dummy_dml_plane_cfg(&dml_dispcfg->plane, disp_cfg_plane_location,
+						     context->streams[i], &dml2->v20.dml_core_ctx.soc);
 
 			dml_dispcfg->plane.BlendingAndTiming[disp_cfg_plane_location] = disp_cfg_stream_location;
 
@@ -1123,7 +1143,10 @@
 				ASSERT(disp_cfg_plane_location >= 0 && disp_cfg_plane_location <= __DML2_WRAPPER_MAX_STREAMS_PLANES__);
 
 				populate_dml_surface_cfg_from_plane_state(dml2->v20.dml_core_ctx.project, &dml_dispcfg->surface, disp_cfg_plane_location, context->stream_status[i].plane_states[j]);
-				populate_dml_plane_cfg_from_plane_state(&dml_dispcfg->plane, disp_cfg_plane_location, context->stream_status[i].plane_states[j], context);
+				populate_dml_plane_cfg_from_plane_state(
+					&dml_dispcfg->plane, disp_cfg_plane_location,
+					context->stream_status[i].plane_states[j], context,
+					&dml2->v20.dml_core_ctx.soc);
 
 				if (stream_mall_type == SUBVP_MAIN) {
 					dml_dispcfg->plane.UseMALLForPStateChange[disp_cfg_plane_location] = dml_use_mall_pstate_change_sub_viewport;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c
@@ -294,7 +294,7 @@
 	context->bw_ctx.bw.dcn.clk.dcfclk_deep_sleep_khz = (unsigned int)in_ctx->v20.dml_core_ctx.mp.DCFCLKDeepSleep * 1000;
 	context->bw_ctx.bw.dcn.clk.dppclk_khz = 0;
 
-	if (in_ctx->v20.dml_core_ctx.ms.support.FCLKChangeSupport[in_ctx->v20.scratch.mode_support_params.out_lowest_state_idx] == dml_fclock_change_unsupported)
+	if (in_ctx->v20.dml_core_ctx.ms.support.FCLKChangeSupport[0] == dml_fclock_change_unsupported)
 		context->bw_ctx.bw.dcn.clk.fclk_p_state_change_support = false;
 	else
 		context->bw_ctx.bw.dcn.clk.fclk_p_state_change_support = true;
@@ -327,6 +327,8 @@
 			dml_pipe_idx = dml2_helper_find_dml_pipe_idx_by_stream_id(in_ctx, context->res_ctx.pipe_ctx[dc_pipe_ctx_index].stream->stream_id);
 		}
 
+		if (dml_pipe_idx == 0xFFFFFFFF)
+			continue;
 		ASSERT(in_ctx->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[dml_pipe_idx]);
 		ASSERT(in_ctx->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[dml_pipe_idx] == context->res_ctx.pipe_ctx[dc_pipe_ctx_index].stream->stream_id);
 
@@ -468,6 +470,9 @@
 			dml_pipe_idx = find_dml_pipe_idx_by_plane_id(in_ctx, plane_id);
 		else
 			dml_pipe_idx = dml2_helper_find_dml_pipe_idx_by_stream_id(in_ctx, display_state->res_ctx.pipe_ctx[i].stream->stream_id);
+
+		if (dml_pipe_idx == 0xFFFFFFFF)
+			continue;
 		total_det_allocated += dml_get_det_buffer_size_kbytes(&in_ctx->v20.dml_core_ctx, dml_pipe_idx);
 		if (total_det_allocated > max_det_size) {
 			need_recalculation = true;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
@@ -703,13 +703,8 @@
 	return (struct dml2_context *) kzalloc(sizeof(struct dml2_context), GFP_KERNEL);
 }
 
-bool dml2_create(const struct dc *in_dc, const struct dml2_configuration_options *config, struct dml2_context **dml2)
+static void dml2_init(const struct dc *in_dc, const struct dml2_configuration_options *config, struct dml2_context **dml2)
 {
-	// Allocate Mode Lib Ctx
-	*dml2 = dml2_allocate_memory();
-
-	if (!(*dml2))
-		return false;
 
 	// Store config options
 	(*dml2)->config = *config;
@@ -737,9 +732,18 @@
 	initialize_dml2_soc_bbox(*dml2, in_dc, &(*dml2)->v20.dml_core_ctx.soc);
 
 	initialize_dml2_soc_states(*dml2, in_dc, &(*dml2)->v20.dml_core_ctx.soc, &(*dml2)->v20.dml_core_ctx.states);
+}
+
+bool dml2_create(const struct dc *in_dc, const struct dml2_configuration_options *config, struct dml2_context **dml2)
+{
+	// Allocate Mode Lib Ctx
+	*dml2 = dml2_allocate_memory();
+
+	if (!(*dml2))
+		return false;
+
+	dml2_init(in_dc, config, dml2);
 
-	/*Initialize DML20 instance which calls dml2_core_create, and core_dcn3_populate_informative*/
-	//dml2_initialize_instance(&(*dml_ctx)->v20.dml_init);
 	return true;
 }
 
@@ -779,3 +783,11 @@
 
 	return true;
 }
+
+void dml2_reinit(const struct dc *in_dc,
+				 const struct dml2_configuration_options *config,
+				 struct dml2_context **dml2)
+{
+
+	dml2_init(in_dc, config, dml2);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h
@@ -214,6 +214,9 @@
 	struct dml2_context *src_dml2);
 bool dml2_create_copy(struct dml2_context **dst_dml2,
 	struct dml2_context *src_dml2);
+void dml2_reinit(const struct dc *in_dc,
+				 const struct dml2_configuration_options *config,
+				 struct dml2_context **dml2);
 
 /*
  * dml2_validate - Determines if a display configuration is supported or not.
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c
@@ -878,7 +878,7 @@
 
 	memset(dsc_cfg, 0, sizeof(struct dc_dsc_config));
 
-	dc_dsc_get_policy_for_timing(timing, options->max_target_bpp_limit_override_x16, &policy);
+	dc_dsc_get_policy_for_timing(timing, options->max_target_bpp_limit_override_x16, &policy, link_encoding);
 	pic_width = timing->h_addressable + timing->h_border_left + timing->h_border_right;
 	pic_height = timing->v_addressable + timing->v_border_top + timing->v_border_bottom;
 
@@ -1050,7 +1050,12 @@
 	if (!is_dsc_possible)
 		goto done;
 
-	dsc_cfg->num_slices_v = pic_height/slice_height;
+	if (slice_height > 0) {
+		dsc_cfg->num_slices_v = pic_height / slice_height;
+	} else {
+		is_dsc_possible = false;
+		goto done;
+	}
 
 	if (target_bandwidth_kbps > 0) {
 		is_dsc_possible = decide_dsc_target_bpp_x16(
@@ -1146,7 +1151,8 @@
 
 void dc_dsc_get_policy_for_timing(const struct dc_crtc_timing *timing,
 		uint32_t max_target_bpp_limit_override_x16,
-		struct dc_dsc_policy *policy)
+		struct dc_dsc_policy *policy,
+		const enum dc_link_encoding_format link_encoding)
 {
 	uint32_t bpc = 0;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c
@@ -56,7 +56,7 @@
 	struct dc_context *ctx)
 {
 	struct gpio_service *service;
-	uint32_t index_of_id;
+	int32_t index_of_id;
 
 	service = kzalloc(sizeof(struct gpio_service), GFP_KERNEL);
 
@@ -112,7 +112,7 @@
 	return service;
 
 failure_2:
-	while (index_of_id) {
+	while (index_of_id > 0) {
 		--index_of_id;
 		kfree(service->busyness[index_of_id]);
 	}
@@ -239,6 +239,9 @@
 	enum gpio_id id,
 	uint32_t en)
 {
+	if (id == GPIO_ID_UNKNOWN)
+		return false;
+
 	return service->busyness[id][en];
 }
 
@@ -247,6 +250,9 @@
 	enum gpio_id id,
 	uint32_t en)
 {
+	if (id == GPIO_ID_UNKNOWN)
+		return;
+
 	service->busyness[id][en] = true;
 }
 
@@ -255,6 +261,9 @@
 	enum gpio_id id,
 	uint32_t en)
 {
+	if (id == GPIO_ID_UNKNOWN)
+		return;
+
 	service->busyness[id][en] = false;
 }
 
@@ -263,7 +272,7 @@
 	enum gpio_id id,
 	uint32_t en)
 {
-	if (!service->busyness[id]) {
+	if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) {
 		ASSERT_CRITICAL(false);
 		return GPIO_RESULT_OPEN_FAILED;
 	}
@@ -277,7 +286,7 @@
 	enum gpio_id id,
 	uint32_t en)
 {
-	if (!service->busyness[id]) {
+	if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) {
 		ASSERT_CRITICAL(false);
 		return GPIO_RESULT_OPEN_FAILED;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c
@@ -130,13 +130,21 @@
 	const uint8_t hdcp_i2c_addr_link_primary = 0x3a; /* 0x74 >> 1*/
 	const uint8_t hdcp_i2c_addr_link_secondary = 0x3b; /* 0x76 >> 1*/
 	struct i2c_command i2c_command;
-	uint8_t offset = hdcp_i2c_offsets[message_info->msg_id];
+	uint8_t offset;
 	struct i2c_payload i2c_payloads[] = {
-		{ true, 0, 1, &offset },
+		{ true, 0, 1, 0 },
 		/* actual hdcp payload, will be filled later, zeroed for now*/
 		{ 0 }
 	};
 
+	if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {
+		DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id);
+		return false;
+	}
+
+	offset = hdcp_i2c_offsets[message_info->msg_id];
+	i2c_payloads[0].data = &offset;
+
 	switch (message_info->link) {
 	case HDCP_LINK_SECONDARY:
 		i2c_payloads[0].address = hdcp_i2c_addr_link_secondary;
@@ -310,6 +318,11 @@
 	struct dc_link *link,
 	struct hdcp_protection_message *message_info)
 {
+	if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {
+		DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id);
+		return false;
+	}
+
 	return dpcd_access_helper(
 		link,
 		message_info->length,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
@@ -57,6 +57,7 @@
 #include "panel_cntl.h"
 #include "dc_state_priv.h"
 #include "dpcd_defs.h"
+#include "dsc.h"
 /* include DCE11 register header files */
 #include "dce/dce_11_0_d.h"
 #include "dce/dce_11_0_sh_mask.h"
@@ -957,7 +958,7 @@
 {
 	struct dc_context *ctx = link->ctx;
 	struct bp_transmitter_control cntl = { 0 };
-	uint8_t pwrseq_instance;
+	uint8_t pwrseq_instance = 0;
 	unsigned int pre_T11_delay = OLED_PRE_T11_DELAY;
 	unsigned int post_T7_delay = OLED_POST_T7_DELAY;
 
@@ -1010,7 +1011,8 @@
 	 */
 	/* dc_service_sleep_in_milliseconds(50); */
 		/*edp 1.2*/
-	pwrseq_instance = link->panel_cntl->pwrseq_inst;
+	if (link->panel_cntl)
+		pwrseq_instance = link->panel_cntl->pwrseq_inst;
 
 	if (cntl.action == TRANSMITTER_CONTROL_BACKLIGHT_ON) {
 		if (!link->dc->config.edp_no_power_sequencing)
@@ -1185,7 +1187,8 @@
 		if (dccg) {
 			dccg->funcs->disable_symclk32_se(dccg, dp_hpo_inst);
 			dccg->funcs->set_dpstreamclk(dccg, REFCLK, tg->inst, dp_hpo_inst);
-			dccg->funcs->set_dtbclk_dto(dccg, &dto_params);
+			if (dccg && dccg->funcs->set_dtbclk_dto)
+				dccg->funcs->set_dtbclk_dto(dccg, &dto_params);
 		}
 	} else if (dccg && dccg->funcs->disable_symclk_se) {
 		dccg->funcs->disable_symclk_se(dccg, stream_enc->stream_enc_inst,
@@ -1726,6 +1729,48 @@
 	}
 }
 
+static void clean_up_dsc_blocks(struct dc *dc)
+{
+	struct display_stream_compressor *dsc = NULL;
+	struct timing_generator *tg = NULL;
+	struct stream_encoder *se = NULL;
+	struct dccg *dccg = dc->res_pool->dccg;
+	struct pg_cntl *pg_cntl = dc->res_pool->pg_cntl;
+	int i;
+
+	if (dc->ctx->dce_version != DCN_VERSION_3_5 &&
+		dc->ctx->dce_version != DCN_VERSION_3_51)
+		return;
+
+	for (i = 0; i < dc->res_pool->res_cap->num_dsc; i++) {
+		struct dcn_dsc_state s  = {0};
+
+		dsc = dc->res_pool->dscs[i];
+		dsc->funcs->dsc_read_state(dsc, &s);
+		if (s.dsc_fw_en) {
+			/* disable DSC in OPTC */
+			if (i < dc->res_pool->timing_generator_count) {
+				tg = dc->res_pool->timing_generators[i];
+				tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0);
+			}
+			/* disable DSC in stream encoder */
+			if (i < dc->res_pool->stream_enc_count) {
+				se = dc->res_pool->stream_enc[i];
+				se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0);
+				se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true);
+			}
+			/* disable DSC block */
+			if (dccg->funcs->set_ref_dscclk)
+				dccg->funcs->set_ref_dscclk(dccg, dsc->inst);
+			dsc->funcs->dsc_disable(dsc);
+
+			/* power down DSC */
+			if (pg_cntl != NULL)
+				pg_cntl->funcs->dsc_pg_control(pg_cntl, dsc->inst, false);
+		}
+	}
+}
+
 /*
  * When ASIC goes from VBIOS/VGA mode to driver/accelerated mode we need:
  *  1. Power down all DC HW blocks
@@ -1810,6 +1855,13 @@
 		clk_mgr_exit_optimized_pwr_state(dc, dc->clk_mgr);
 
 		power_down_all_hw_blocks(dc);
+
+		/* DSC could be enabled on eDP during VBIOS post.
+		 * To clean up dsc blocks if eDP is in link but not active.
+		 */
+		if (edp_link_with_sink && (edp_stream_num == 0))
+			clean_up_dsc_blocks(dc);
+
 		disable_vga_and_power_gate_all_controllers(dc);
 		if (edp_link_with_sink && !keep_edp_vdd_on)
 			dc->hwss.edp_power_control(edp_link_with_sink, false);
@@ -1928,13 +1980,20 @@
 	 * as well.
 	 */
 	for (i = 0; i < num_pipes; i++) {
-		pipe_ctx[i]->stream_res.tg->funcs->set_drr(
-			pipe_ctx[i]->stream_res.tg, &params);
+		/* dc_state_destruct() might null the stream resources, so fetch tg
+		 * here first to avoid a race condition. The lifetime of the pointee
+		 * itself (the timing_generator object) is not a problem here.
+		 */
+		struct timing_generator *tg = pipe_ctx[i]->stream_res.tg;
 
-		if (adjust.v_total_max != 0 && adjust.v_total_min != 0)
-			pipe_ctx[i]->stream_res.tg->funcs->set_static_screen_control(
-					pipe_ctx[i]->stream_res.tg,
-					event_triggers, num_frames);
+		if ((tg != NULL) && tg->funcs) {
+			if (tg->funcs->set_drr)
+				tg->funcs->set_drr(tg, &params);
+			if (adjust.v_total_max != 0 && adjust.v_total_min != 0)
+				if (tg->funcs->set_static_screen_control)
+					tg->funcs->set_static_screen_control(
+						tg, event_triggers, num_frames);
+		}
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
@@ -1497,7 +1497,7 @@
 		dc->clk_mgr->funcs->init_clocks(dc->clk_mgr);
 
 	/* Align bw context with hw config when system resume. */
-	if (dc->clk_mgr->clks.dispclk_khz != 0 && dc->clk_mgr->clks.dppclk_khz != 0) {
+	if (dc->clk_mgr && dc->clk_mgr->clks.dispclk_khz != 0 && dc->clk_mgr->clks.dppclk_khz != 0) {
 		dc->current_state->bw_ctx.bw.dcn.clk.dispclk_khz = dc->clk_mgr->clks.dispclk_khz;
 		dc->current_state->bw_ctx.bw.dcn.clk.dppclk_khz = dc->clk_mgr->clks.dppclk_khz;
 	}
@@ -1617,7 +1617,7 @@
 		REG_UPDATE(DCFCLK_CNTL, DCFCLK_GATE_DIS, 0);
 	}
 
-	if (dc->clk_mgr->funcs->notify_wm_ranges)
+	if (dc->clk_mgr && dc->clk_mgr->funcs->notify_wm_ranges)
 		dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr);
 }
 
@@ -1840,6 +1840,9 @@
 {
 	struct dpp *dpp = pipe_ctx->plane_res.dpp;
 
+	if (!stream)
+		return false;
+
 	if (dpp == NULL)
 		return false;
 
@@ -1862,8 +1865,8 @@
 	} else
 		dpp->funcs->dpp_program_regamma_pwl(dpp, NULL, OPP_REGAMMA_BYPASS);
 
-	if (stream != NULL && stream->ctx != NULL &&
-			stream->out_transfer_func != NULL) {
+	if (stream->ctx &&
+	    stream->out_transfer_func) {
 		log_tf(stream->ctx,
 				stream->out_transfer_func,
 				dpp->regamma_params.hw_points_num);
@@ -3076,7 +3079,7 @@
 			context,
 			false);
 
-	dc->wm_optimized_required = hubbub->funcs->program_watermarks(hubbub,
+	dc->optimized_required |= hubbub->funcs->program_watermarks(hubbub,
 			&context->bw_ctx.bw.dcn.watermarks,
 			dc->res_pool->ref_clocks.dchub_ref_clock_inKhz / 1000,
 			true);
@@ -3153,15 +3156,19 @@
 	 * as well.
 	 */
 	for (i = 0; i < num_pipes; i++) {
-		if ((pipe_ctx[i]->stream_res.tg != NULL) && pipe_ctx[i]->stream_res.tg->funcs) {
-			if (pipe_ctx[i]->stream_res.tg->funcs->set_drr)
-				pipe_ctx[i]->stream_res.tg->funcs->set_drr(
-					pipe_ctx[i]->stream_res.tg, &params);
+		/* dc_state_destruct() might null the stream resources, so fetch tg
+		 * here first to avoid a race condition. The lifetime of the pointee
+		 * itself (the timing_generator object) is not a problem here.
+		 */
+		struct timing_generator *tg = pipe_ctx[i]->stream_res.tg;
+
+		if ((tg != NULL) && tg->funcs) {
+			if (tg->funcs->set_drr)
+				tg->funcs->set_drr(tg, &params);
 			if (adjust.v_total_max != 0 && adjust.v_total_min != 0)
-				if (pipe_ctx[i]->stream_res.tg->funcs->set_static_screen_control)
-					pipe_ctx[i]->stream_res.tg->funcs->set_static_screen_control(
-						pipe_ctx[i]->stream_res.tg,
-						event_triggers, num_frames);
+				if (tg->funcs->set_static_screen_control)
+					tg->funcs->set_static_screen_control(
+						tg, event_triggers, num_frames);
 		}
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
@@ -934,7 +934,8 @@
 	/*
 	 * if above if is not executed then 'params' equal to 0 and set in bypass
 	 */
-	mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+	if (mpc->funcs->set_output_gamma)
+		mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
 
 	return true;
 }
@@ -1392,6 +1393,11 @@
 		return;
 	}
 
+	if (resource_is_pipe_type(new_pipe, OTG_MASTER) &&
+			resource_is_odm_topology_changed(new_pipe, old_pipe))
+		/* Detect odm changes */
+		new_pipe->update_flags.bits.odm = 1;
+
 	/* Exit on unchanged, unused pipe */
 	if (!old_pipe->plane_state && !new_pipe->plane_state)
 		return;
@@ -1445,10 +1451,6 @@
 
 	/* Detect top pipe only changes */
 	if (resource_is_pipe_type(new_pipe, OTG_MASTER)) {
-		/* Detect odm changes */
-		if (resource_is_odm_topology_changed(new_pipe, old_pipe))
-			new_pipe->update_flags.bits.odm = 1;
-
 		/* Detect global sync changes */
 		if (old_pipe->pipe_dlg_param.vready_offset != new_pipe->pipe_dlg_param.vready_offset
 				|| old_pipe->pipe_dlg_param.vstartup_start != new_pipe->pipe_dlg_param.vstartup_start
@@ -1812,17 +1814,26 @@
 		dc->res_pool->hubbub->funcs->program_det_size(
 			dc->res_pool->hubbub, pipe_ctx->plane_res.hubp->inst, pipe_ctx->det_buffer_size_kb);
 
-	if (pipe_ctx->update_flags.raw || pipe_ctx->plane_state->update_flags.raw || pipe_ctx->stream->update_flags.raw)
+	if (pipe_ctx->plane_state && (pipe_ctx->update_flags.raw ||
+	    pipe_ctx->plane_state->update_flags.raw ||
+	    pipe_ctx->stream->update_flags.raw))
 		dcn20_update_dchubp_dpp(dc, pipe_ctx, context);
 
-	if (pipe_ctx->update_flags.bits.enable
-			|| pipe_ctx->plane_state->update_flags.bits.hdr_mult)
+	if (pipe_ctx->update_flags.bits.enable ||
+	    (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.hdr_mult))
 		hws->funcs.set_hdr_multiplier(pipe_ctx);
 
-	if (pipe_ctx->update_flags.bits.enable ||
-	    pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change ||
-	    pipe_ctx->plane_state->update_flags.bits.gamma_change ||
-	    pipe_ctx->plane_state->update_flags.bits.lut_3d)
+	if ((pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.hdr_mult) ||
+	    pipe_ctx->update_flags.bits.enable)
+		hws->funcs.set_hdr_multiplier(pipe_ctx);
+
+	if ((pipe_ctx->plane_state &&
+	     pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change) ||
+	    (pipe_ctx->plane_state &&
+	     pipe_ctx->plane_state->update_flags.bits.gamma_change) ||
+	    (pipe_ctx->plane_state &&
+	     pipe_ctx->plane_state->update_flags.bits.lut_3d) ||
+	     pipe_ctx->update_flags.bits.enable)
 		hws->funcs.set_input_transfer_func(dc, pipe_ctx, pipe_ctx->plane_state);
 
 	/* dcn10_translate_regamma_to_hw_format takes 750us to finish
@@ -1832,7 +1843,8 @@
 	if (pipe_ctx->update_flags.bits.enable ||
 			pipe_ctx->update_flags.bits.plane_changed ||
 			pipe_ctx->stream->update_flags.bits.out_tf ||
-			pipe_ctx->plane_state->update_flags.bits.output_tf_change)
+			(pipe_ctx->plane_state &&
+			 pipe_ctx->plane_state->update_flags.bits.output_tf_change))
 		hws->funcs.set_output_transfer_func(dc, pipe_ctx, pipe_ctx->stream);
 
 	/* If the pipe has been enabled or has a different opp, we
@@ -1856,7 +1868,7 @@
 	}
 
 	/* Set ABM pipe after other pipe configurations done */
-	if (pipe_ctx->plane_state->visible) {
+	if ((pipe_ctx->plane_state && pipe_ctx->plane_state->visible)) {
 		if (pipe_ctx->stream_res.abm) {
 			dc->hwss.set_pipe(pipe_ctx);
 			pipe_ctx->stream_res.abm->funcs->set_abm_level(pipe_ctx->stream_res.abm,
@@ -1891,19 +1903,20 @@
 	DC_LOGGER_INIT(dc->ctx->logger);
 	unsigned int prev_hubp_count = 0;
 	unsigned int hubp_count = 0;
+	struct pipe_ctx *pipe;
 
 	if (resource_is_pipe_topology_changed(dc->current_state, context))
 		resource_log_pipe_topology_update(dc, context);
 
 	if (dc->hwss.program_triplebuffer != NULL && dc->debug.enable_tri_buf) {
 		for (i = 0; i < dc->res_pool->pipe_count; i++) {
-			struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+			pipe = &context->res_ctx.pipe_ctx[i];
 
-			if (!pipe_ctx->top_pipe && !pipe_ctx->prev_odm_pipe && pipe_ctx->plane_state) {
-				ASSERT(!pipe_ctx->plane_state->triplebuffer_flips);
+			if (!pipe->top_pipe && !pipe->prev_odm_pipe && pipe->plane_state) {
+				ASSERT(!pipe->plane_state->triplebuffer_flips);
 				/*turn off triple buffer for full update*/
 				dc->hwss.program_triplebuffer(
-						dc, pipe_ctx, pipe_ctx->plane_state->triplebuffer_flips);
+						dc, pipe, pipe->plane_state->triplebuffer_flips);
 			}
 		}
 	}
@@ -1978,12 +1991,22 @@
 			DC_LOG_DC("Reset mpcc for pipe %d\n", dc->current_state->res_ctx.pipe_ctx[i].pipe_idx);
 		}
 
+	/* update ODM for blanked OTG master pipes */
+	for (i = 0; i < dc->res_pool->pipe_count; i++) {
+		pipe = &context->res_ctx.pipe_ctx[i];
+		if (resource_is_pipe_type(pipe, OTG_MASTER) &&
+				!resource_is_pipe_type(pipe, DPP_PIPE) &&
+				pipe->update_flags.bits.odm &&
+				hws->funcs.update_odm)
+			hws->funcs.update_odm(dc, context, pipe);
+	}
+
 	/*
 	 * Program all updated pipes, order matters for mpcc setup. Start with
 	 * top pipe and program all pipes that follow in order
 	 */
 	for (i = 0; i < dc->res_pool->pipe_count; i++) {
-		struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i];
+		pipe = &context->res_ctx.pipe_ctx[i];
 
 		if (pipe->plane_state && !pipe->top_pipe) {
 			while (pipe) {
@@ -2022,17 +2045,6 @@
 			context->stream_status[0].plane_count > 1) {
 			pipe->plane_res.hubp->funcs->hubp_wait_pipe_read_start(pipe->plane_res.hubp);
 		}
-
-		/* when dynamic ODM is active, pipes must be reconfigured when all planes are
-		 * disabled, as some transitions will leave software and hardware state
-		 * mismatched.
-		 */
-		if (dc->debug.enable_single_display_2to1_odm_policy &&
-			pipe->stream &&
-			pipe->update_flags.bits.disable &&
-			!pipe->prev_odm_pipe &&
-			hws->funcs.update_odm)
-			hws->funcs.update_odm(dc, context, pipe);
 	}
 }
 
@@ -2097,6 +2109,9 @@
 		}
 	}
 
+	if (!hwseq)
+		return;
+
 	/* P-State support transitions:
 	 * Natural -> FPO: 		P-State disabled in prepare, force disallow anytime is safe
 	 * FPO -> Natural: 		Unforce anytime after FW disable is safe (P-State will assert naturally)
@@ -2104,7 +2119,7 @@
 	 * FPO -> Unsupported:	P-State disabled in prepare, unforce disallow anytime is safe
 	 * FPO <-> SubVP:		Force disallow is maintained on the FPO / SubVP pipes
 	 */
-	if (hwseq && hwseq->funcs.update_force_pstate)
+	if (hwseq->funcs.update_force_pstate)
 		dc->hwseq->funcs.update_force_pstate(dc, context);
 
 	/* Only program the MALL registers after all the main and phantom pipes
@@ -2159,10 +2174,10 @@
 	}
 
 	/* program dchubbub watermarks:
-	 * For assigning wm_optimized_required, use |= operator since we don't want
+	 * For assigning optimized_required, use |= operator since we don't want
 	 * to clear the value if the optimize has not happened yet
 	 */
-	dc->wm_optimized_required |= hubbub->funcs->program_watermarks(hubbub,
+	dc->optimized_required |= hubbub->funcs->program_watermarks(hubbub,
 					&context->bw_ctx.bw.dcn.watermarks,
 					dc->res_pool->ref_clocks.dchub_ref_clock_inKhz / 1000,
 					false);
@@ -2175,10 +2190,10 @@
 	if (hubbub->funcs->program_compbuf_size) {
 		if (context->bw_ctx.dml.ip.min_comp_buffer_size_kbytes) {
 			compbuf_size_kb = context->bw_ctx.dml.ip.min_comp_buffer_size_kbytes;
-			dc->wm_optimized_required |= (compbuf_size_kb != dc->current_state->bw_ctx.dml.ip.min_comp_buffer_size_kbytes);
+			dc->optimized_required |= (compbuf_size_kb != dc->current_state->bw_ctx.dml.ip.min_comp_buffer_size_kbytes);
 		} else {
 			compbuf_size_kb = context->bw_ctx.bw.dcn.compbuf_size_kb;
-			dc->wm_optimized_required |= (compbuf_size_kb != dc->current_state->bw_ctx.bw.dcn.compbuf_size_kb);
+			dc->optimized_required |= (compbuf_size_kb != dc->current_state->bw_ctx.bw.dcn.compbuf_size_kb);
 		}
 
 		hubbub->funcs->program_compbuf_size(hubbub, compbuf_size_kb, false);
@@ -2343,8 +2358,11 @@
 {
 	int counter;
 
+	if (!opp)
+		return false;
+
 	for (counter = 0; counter < 1000; counter++) {
-		if (opp->funcs->dpg_is_blanked(opp))
+		if (!opp->funcs->dpg_is_pending(opp))
 			break;
 
 		udelay(100);
@@ -2355,7 +2373,7 @@
 		return false;
 	}
 
-	return true;
+	return opp->funcs->dpg_is_blanked(opp);
 }
 
 bool dcn20_dmdata_status_done(struct pipe_ctx *pipe_ctx)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c
@@ -95,8 +95,11 @@
 	} else if (hwseq->fb_offset.quad_part <= addr->quad_part &&
 			addr->quad_part <= hwseq->uma_top.quad_part) {
 		is_in_uma = true;
+	} else if (addr->quad_part == 0) {
+		is_in_uma = false;
 	} else {
 		is_in_uma = false;
+		BREAK_TO_DEBUGGER();
 	}
 	return is_in_uma;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -142,7 +142,7 @@
 {
 	union dmub_rb_cmd cmd;
 	struct dc_context *dc = abm->ctx;
-	uint32_t ramping_boundary = 0xFFFF;
+	uint8_t ramping_boundary = 0xFF;
 
 	memset(&cmd, 0, sizeof(cmd));
 	cmd.abm_set_pipe.header.type = DMUB_CMD__ABM;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
@@ -251,7 +251,11 @@
 		}
 	}
 
-	mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+	if (mpc->funcs->set_output_gamma)
+		mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+	else
+		DC_LOG_ERROR("%s: set_output_gamma function pointer is NULL.\n", __func__);
+
 	return ret;
 }
 
@@ -478,7 +482,7 @@
 	uint32_t backlight = MAX_BACKLIGHT_LEVEL;
 	uint32_t user_level = MAX_BACKLIGHT_LEVEL;
 
-	if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks)
+	if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks)
 		dc->clk_mgr->funcs->init_clocks(dc->clk_mgr);
 
 	// Initialize the dccg
@@ -639,11 +643,12 @@
 	if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks)
 		dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub);
 
-	if (dc->clk_mgr->funcs->notify_wm_ranges)
+	if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->notify_wm_ranges)
 		dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr);
 
 	//if softmax is enabled then hardmax will be set by a different call
-	if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled)
+	if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->set_hard_max_memclk &&
+	    !dc->clk_mgr->dc_mode_softmax_enabled)
 		dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr);
 
 	if (dc->res_pool->hubbub->funcs->force_pstate_change_control)
@@ -663,10 +668,20 @@
 	if (pipe_ctx == NULL)
 		return;
 
-	if (dc_is_hdmi_signal(pipe_ctx->stream->signal) && pipe_ctx->stream_res.stream_enc != NULL)
+	if (dc_is_hdmi_signal(pipe_ctx->stream->signal) && pipe_ctx->stream_res.stream_enc != NULL) {
 		pipe_ctx->stream_res.stream_enc->funcs->set_avmute(
 				pipe_ctx->stream_res.stream_enc,
 				enable);
+
+		/* Wait for two frame to make sure AV mute is sent out */
+		if (enable) {
+			pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+			pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
+			pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+			pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
+			pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+		}
+	}
 }
 
 void dcn30_update_info_frame(struct pipe_ctx *pipe_ctx)
@@ -765,6 +780,9 @@
 			stream = dc->current_state->streams[0];
 			plane = (stream ? dc->current_state->stream_status[0].plane_states[0] : NULL);
 
+			if (!stream || !plane)
+				return false;
+
 			if (stream && plane) {
 				cursor_cache_enable = stream->cursor_position.enable &&
 						plane->address.grph.cursor_cache_addr.quad_part;
@@ -883,7 +901,7 @@
 
 					/* Use copied cursor, and it's okay to not switch back */
 					cursor_attr.address.quad_part = cmd.mall.cursor_copy_dst.quad_part;
-					dc_stream_set_cursor_attributes(stream, &cursor_attr);
+					dc_stream_program_cursor_attributes(stream, &cursor_attr);
 				}
 
 				/* Enable MALL */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
@@ -258,10 +258,10 @@
 	if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks)
 		dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub);
 
-	if (dc->clk_mgr->funcs->notify_wm_ranges)
+	if (dc->clk_mgr && dc->clk_mgr->funcs->notify_wm_ranges)
 		dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr);
 
-	if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled)
+	if (dc->clk_mgr && dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled)
 		dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr);
 
 	if (dc->res_pool->hubbub->funcs->force_pstate_change_control)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
@@ -69,29 +69,6 @@
 #define FN(reg_name, field_name) \
 	hws->shifts->field_name, hws->masks->field_name
 
-static int calc_mpc_flow_ctrl_cnt(const struct dc_stream_state *stream,
-		int opp_cnt)
-{
-	bool hblank_halved = optc2_is_two_pixels_per_containter(&stream->timing);
-	int flow_ctrl_cnt;
-
-	if (opp_cnt >= 2)
-		hblank_halved = true;
-
-	flow_ctrl_cnt = stream->timing.h_total - stream->timing.h_addressable -
-			stream->timing.h_border_left -
-			stream->timing.h_border_right;
-
-	if (hblank_halved)
-		flow_ctrl_cnt /= 2;
-
-	/* ODM combine 4:1 case */
-	if (opp_cnt == 4)
-		flow_ctrl_cnt /= 2;
-
-	return flow_ctrl_cnt;
-}
-
 static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
 {
 	struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc;
@@ -183,10 +160,6 @@
 	struct pipe_ctx *odm_pipe;
 	int opp_cnt = 0;
 	int opp_inst[MAX_PIPES] = {0};
-	bool rate_control_2x_pclk = (pipe_ctx->stream->timing.flags.INTERLACE || optc2_is_two_pixels_per_containter(&pipe_ctx->stream->timing));
-	struct mpc_dwb_flow_control flow_control;
-	struct mpc *mpc = dc->res_pool->mpc;
-	int i;
 
 	opp_cnt = get_odm_config(pipe_ctx, opp_inst);
 
@@ -199,20 +172,6 @@
 		pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
 				pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
 
-	rate_control_2x_pclk = rate_control_2x_pclk || opp_cnt > 1;
-	flow_control.flow_ctrl_mode = 0;
-	flow_control.flow_ctrl_cnt0 = 0x80;
-	flow_control.flow_ctrl_cnt1 = calc_mpc_flow_ctrl_cnt(pipe_ctx->stream, opp_cnt);
-	if (mpc->funcs->set_out_rate_control) {
-		for (i = 0; i < opp_cnt; ++i) {
-			mpc->funcs->set_out_rate_control(
-					mpc, opp_inst[i],
-					true,
-					rate_control_2x_pclk,
-					&flow_control);
-		}
-	}
-
 	for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) {
 		odm_pipe->stream_res.opp->funcs->opp_pipe_clock_control(
 				odm_pipe->stream_res.opp,
@@ -402,7 +361,9 @@
 		if (pipe->top_pipe || pipe->prev_odm_pipe)
 			continue;
 
-		if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal))) {
+		if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal)) &&
+			!pipe->stream->apply_seamless_boot_optimization &&
+			!pipe->stream->apply_edp_fast_boot_optimization) {
 			pipe->stream_res.tg->funcs->disable_crtc(pipe->stream_res.tg);
 			reset_sync_context_for_pipe(dc, context, i);
 			otg_disabled[i] = true;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
@@ -584,7 +584,9 @@
 		}
 	}
 
-	mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+	if (mpc->funcs->set_output_gamma)
+		mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+
 	return ret;
 }
 
@@ -755,7 +757,7 @@
 	uint32_t backlight = MAX_BACKLIGHT_LEVEL;
 	uint32_t user_level = MAX_BACKLIGHT_LEVEL;
 
-	if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks)
+	if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks)
 		dc->clk_mgr->funcs->init_clocks(dc->clk_mgr);
 
 	// Initialize the dccg
@@ -934,10 +936,11 @@
 	if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks)
 		dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub);
 
-	if (dc->clk_mgr->funcs->notify_wm_ranges)
+	if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->notify_wm_ranges)
 		dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr);
 
-	if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled)
+	if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->set_hard_max_memclk &&
+	    !dc->clk_mgr->dc_mode_softmax_enabled)
 		dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr);
 
 	if (dc->res_pool->hubbub->funcs->force_pstate_change_control)
@@ -966,29 +969,6 @@
 	}
 }
 
-static int calc_mpc_flow_ctrl_cnt(const struct dc_stream_state *stream,
-		int opp_cnt)
-{
-	bool hblank_halved = optc2_is_two_pixels_per_containter(&stream->timing);
-	int flow_ctrl_cnt;
-
-	if (opp_cnt >= 2)
-		hblank_halved = true;
-
-	flow_ctrl_cnt = stream->timing.h_total - stream->timing.h_addressable -
-			stream->timing.h_border_left -
-			stream->timing.h_border_right;
-
-	if (hblank_halved)
-		flow_ctrl_cnt /= 2;
-
-	/* ODM combine 4:1 case */
-	if (opp_cnt == 4)
-		flow_ctrl_cnt /= 2;
-
-	return flow_ctrl_cnt;
-}
-
 static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
 {
 	struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc;
@@ -1017,6 +997,20 @@
 		struct dsc_config dsc_cfg;
 		struct dsc_optc_config dsc_optc_cfg;
 		enum optc_dsc_mode optc_dsc_mode;
+		struct dcn_dsc_state dsc_state = {0};
+
+		if (!dsc) {
+			DC_LOG_DSC("DSC is NULL for tg instance %d:", pipe_ctx->stream_res.tg->inst);
+			return;
+		}
+
+		if (dsc->funcs->dsc_read_state) {
+			dsc->funcs->dsc_read_state(dsc, &dsc_state);
+			if (!dsc_state.dsc_fw_en) {
+				DC_LOG_DSC("DSC has been disabled for tg instance %d:", pipe_ctx->stream_res.tg->inst);
+				return;
+			}
+		}
 
 		/* Enable DSC hw block */
 		dsc_cfg.pic_width = (stream->timing.h_addressable + stream->timing.h_border_left + stream->timing.h_border_right) / opp_cnt;
@@ -1103,10 +1097,6 @@
 	struct pipe_ctx *odm_pipe;
 	int opp_cnt = 0;
 	int opp_inst[MAX_PIPES] = {0};
-	bool rate_control_2x_pclk = (pipe_ctx->stream->timing.flags.INTERLACE || optc2_is_two_pixels_per_containter(&pipe_ctx->stream->timing));
-	struct mpc_dwb_flow_control flow_control;
-	struct mpc *mpc = dc->res_pool->mpc;
-	int i;
 
 	opp_cnt = get_odm_config(pipe_ctx, opp_inst);
 
@@ -1119,20 +1109,6 @@
 		pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
 				pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
 
-	rate_control_2x_pclk = rate_control_2x_pclk || opp_cnt > 1;
-	flow_control.flow_ctrl_mode = 0;
-	flow_control.flow_ctrl_cnt0 = 0x80;
-	flow_control.flow_ctrl_cnt1 = calc_mpc_flow_ctrl_cnt(pipe_ctx->stream, opp_cnt);
-	if (mpc->funcs->set_out_rate_control) {
-		for (i = 0; i < opp_cnt; ++i) {
-			mpc->funcs->set_out_rate_control(
-					mpc, opp_inst[i],
-					true,
-					rate_control_2x_pclk,
-					&flow_control);
-		}
-	}
-
 	for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) {
 		odm_pipe->stream_res.opp->funcs->opp_pipe_clock_control(
 				odm_pipe->stream_res.opp,
@@ -1156,6 +1132,13 @@
 			dsc->funcs->dsc_disconnect(dsc);
 		}
 	}
+
+	if (!resource_is_pipe_type(pipe_ctx, DPP_PIPE))
+		/*
+		 * blank pattern is generated by OPP, reprogram blank pattern
+		 * due to OPP count change
+		 */
+		dc->hwseq->funcs.blank_pixel_data(dc, pipe_ctx, true);
 }
 
 unsigned int dcn32_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsigned int *k1_div, unsigned int *k2_div)
@@ -1778,3 +1761,26 @@
 		context->bw_ctx.bw.dcn.clk.p_state_change_support = p_state_change_support;
 	}
 }
+
+void dcn32_interdependent_update_lock(struct dc *dc,
+		struct dc_state *context, bool lock)
+{
+	unsigned int i;
+	struct pipe_ctx *pipe;
+	struct timing_generator *tg;
+
+	for (i = 0; i < dc->res_pool->pipe_count; i++) {
+		pipe = &context->res_ctx.pipe_ctx[i];
+		tg = pipe->stream_res.tg;
+
+		if (!resource_is_pipe_type(pipe, OTG_MASTER) ||
+				!tg->funcs->is_tg_enabled(tg) ||
+				dc_state_get_pipe_subvp_type(context, pipe) == SUBVP_PHANTOM)
+			continue;
+
+		if (lock)
+			dc->hwss.pipe_control_lock(dc, pipe, true);
+		else
+			dc->hwss.pipe_control_lock(dc, pipe, false);
+	}
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.h
@@ -129,4 +129,6 @@
 void dcn32_prepare_bandwidth(struct dc *dc,
 	struct dc_state *context);
 
+void dcn32_interdependent_update_lock(struct dc *dc,
+		struct dc_state *context, bool lock);
 #endif /* __DC_HWSS_DCN32_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_init.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_init.c
@@ -58,7 +58,7 @@
 	.disable_plane = dcn20_disable_plane,
 	.disable_pixel_data = dcn20_disable_pixel_data,
 	.pipe_control_lock = dcn20_pipe_control_lock,
-	.interdependent_update_lock = dcn10_lock_all_pipes,
+	.interdependent_update_lock = dcn32_interdependent_update_lock,
 	.cursor_lock = dcn10_cursor_lock,
 	.prepare_bandwidth = dcn32_prepare_bandwidth,
 	.optimize_bandwidth = dcn20_optimize_bandwidth,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
@@ -235,7 +235,7 @@
 	if (hws->funcs.enable_power_gating_plane)
 		hws->funcs.enable_power_gating_plane(dc->hwseq, true);
 */
-	if (res_pool->hubbub->funcs->dchubbub_init)
+	if (res_pool->hubbub && res_pool->hubbub->funcs->dchubbub_init)
 		res_pool->hubbub->funcs->dchubbub_init(dc->res_pool->hubbub);
 	/* If taking control over from VBIOS, we may want to optimize our first
 	 * mode set, so we need to skip powering down pipes until we know which
@@ -328,10 +328,10 @@
 	if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks)
 		dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub);
 
-	if (dc->clk_mgr->funcs->notify_wm_ranges)
+	if (dc->clk_mgr && dc->clk_mgr->funcs->notify_wm_ranges)
 		dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr);
 
-	if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled)
+	if (dc->clk_mgr && dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled)
 		dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr);
 
 
@@ -358,29 +358,6 @@
 	}
 }
 
-static int calc_mpc_flow_ctrl_cnt(const struct dc_stream_state *stream,
-		int opp_cnt)
-{
-	bool hblank_halved = optc2_is_two_pixels_per_containter(&stream->timing);
-	int flow_ctrl_cnt;
-
-	if (opp_cnt >= 2)
-		hblank_halved = true;
-
-	flow_ctrl_cnt = stream->timing.h_total - stream->timing.h_addressable -
-			stream->timing.h_border_left -
-			stream->timing.h_border_right;
-
-	if (hblank_halved)
-		flow_ctrl_cnt /= 2;
-
-	/* ODM combine 4:1 case */
-	if (opp_cnt == 4)
-		flow_ctrl_cnt /= 2;
-
-	return flow_ctrl_cnt;
-}
-
 static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
 {
 	struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc;
@@ -398,7 +375,20 @@
 		struct dsc_config dsc_cfg;
 		struct dsc_optc_config dsc_optc_cfg;
 		enum optc_dsc_mode optc_dsc_mode;
+		struct dcn_dsc_state dsc_state = {0};
+
+		if (!dsc) {
+			DC_LOG_DSC("DSC is NULL for tg instance %d:", pipe_ctx->stream_res.tg->inst);
+			return;
+		}
 
+		if (dsc->funcs->dsc_read_state) {
+			dsc->funcs->dsc_read_state(dsc, &dsc_state);
+			if (!dsc_state.dsc_fw_en) {
+				DC_LOG_DSC("DSC has been disabled for tg instance %d:", pipe_ctx->stream_res.tg->inst);
+				return;
+			}
+		}
 		/* Enable DSC hw block */
 		dsc_cfg.pic_width = (stream->timing.h_addressable + stream->timing.h_border_left + stream->timing.h_border_right) / opp_cnt;
 		dsc_cfg.pic_height = stream->timing.v_addressable + stream->timing.v_border_top + stream->timing.v_border_bottom;
@@ -474,10 +464,6 @@
 	struct pipe_ctx *odm_pipe;
 	int opp_cnt = 0;
 	int opp_inst[MAX_PIPES] = {0};
-	bool rate_control_2x_pclk = (pipe_ctx->stream->timing.flags.INTERLACE || optc2_is_two_pixels_per_containter(&pipe_ctx->stream->timing));
-	struct mpc_dwb_flow_control flow_control;
-	struct mpc *mpc = dc->res_pool->mpc;
-	int i;
 
 	opp_cnt = get_odm_config(pipe_ctx, opp_inst);
 
@@ -490,20 +476,6 @@
 		pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
 				pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
 
-	rate_control_2x_pclk = rate_control_2x_pclk || opp_cnt > 1;
-	flow_control.flow_ctrl_mode = 0;
-	flow_control.flow_ctrl_cnt0 = 0x80;
-	flow_control.flow_ctrl_cnt1 = calc_mpc_flow_ctrl_cnt(pipe_ctx->stream, opp_cnt);
-	if (mpc->funcs->set_out_rate_control) {
-		for (i = 0; i < opp_cnt; ++i) {
-			mpc->funcs->set_out_rate_control(
-					mpc, opp_inst[i],
-					true,
-					rate_control_2x_pclk,
-					&flow_control);
-		}
-	}
-
 	for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) {
 		odm_pipe->stream_res.opp->funcs->opp_pipe_clock_control(
 				odm_pipe->stream_res.opp,
@@ -679,22 +651,43 @@
 
 bool dcn35_apply_idle_power_optimizations(struct dc *dc, bool enable)
 {
-	struct dc_link *edp_links[MAX_NUM_EDP];
-	int i, edp_num;
 	if (dc->debug.dmcub_emulation)
 		return true;
 
 	if (enable) {
-		dc_get_edp_links(dc, edp_links, &edp_num);
-		if (edp_num == 0 || edp_num > 1)
-			return false;
+		uint32_t num_active_edp = 0;
+		int i;
 
 		for (i = 0; i < dc->current_state->stream_count; ++i) {
 			struct dc_stream_state *stream = dc->current_state->streams[i];
+			struct dc_link *link = stream->link;
+			bool is_psr = link && !link->panel_config.psr.disable_psr &&
+				      (link->psr_settings.psr_version == DC_PSR_VERSION_1 ||
+				       link->psr_settings.psr_version == DC_PSR_VERSION_SU_1);
+			bool is_replay = link && link->replay_settings.replay_feature_enabled;
+
+			/* Ignore streams that disabled. */
+			if (stream->dpms_off)
+				continue;
 
-			if (!stream->dpms_off && !dc_is_embedded_signal(stream->signal))
+			/* Active external displays block idle optimizations. */
+			if (!dc_is_embedded_signal(stream->signal))
 				return false;
+
+			/* If not PWRSEQ0 can't enter idle optimizations */
+			if (link && link->link_index != 0)
+				return false;
+
+			/* Check for panel power features required for idle optimizations. */
+			if (!is_psr && !is_replay)
+				return false;
+
+			num_active_edp += 1;
 		}
+
+		/* If more than one active eDP then disallow. */
+		if (num_active_edp > 1)
+			return false;
 	}
 
 	// TODO: review other cases when idle optimization is allowed
@@ -1016,11 +1009,10 @@
 		if (pipe_ctx->plane_res.hubp)
 			update_state->pg_pipe_res_update[PG_HUBP][pipe_ctx->plane_res.hubp->inst] = false;
 
-		if (pipe_ctx->plane_res.dpp)
+		if (pipe_ctx->plane_res.dpp && pipe_ctx->plane_res.hubp)
 			update_state->pg_pipe_res_update[PG_DPP][pipe_ctx->plane_res.hubp->inst] = false;
 
-		if ((pipe_ctx->plane_res.dpp || pipe_ctx->stream_res.opp) &&
-			pipe_ctx->plane_res.mpcc_inst >= 0)
+		if (pipe_ctx->plane_res.dpp || pipe_ctx->stream_res.opp)
 			update_state->pg_pipe_res_update[PG_MPCC][pipe_ctx->plane_res.mpcc_inst] = false;
 
 		if (pipe_ctx->stream_res.dsc)
@@ -1065,7 +1057,8 @@
 			continue;
 
 		if ((!cur_pipe->plane_state && new_pipe->plane_state) ||
-			(!cur_pipe->stream && new_pipe->stream)) {
+			(!cur_pipe->stream && new_pipe->stream) ||
+			(cur_pipe->stream != new_pipe->stream && new_pipe->stream)) {
 			// New pipe addition
 			for (j = 0; j < PG_HW_PIPE_RESOURCES_NUM_ELEMENT; j++) {
 				if (j == PG_HUBP && new_pipe->plane_res.hubp)
@@ -1353,7 +1346,13 @@
 	params.vertical_total_mid_frame_num = adjust.v_total_mid_frame_num;
 
 	for (i = 0; i < num_pipes; i++) {
-		if ((pipe_ctx[i]->stream_res.tg != NULL) && pipe_ctx[i]->stream_res.tg->funcs) {
+		/* dc_state_destruct() might null the stream resources, so fetch tg
+		 * here first to avoid a race condition. The lifetime of the pointee
+		 * itself (the timing_generator object) is not a problem here.
+		 */
+		struct timing_generator *tg = pipe_ctx[i]->stream_res.tg;
+
+		if ((tg != NULL) && tg->funcs) {
 			struct dc_crtc_timing *timing = &pipe_ctx[i]->stream->timing;
 			struct dc *dc = pipe_ctx[i]->stream->ctx->dc;
 
@@ -1366,14 +1365,84 @@
 					num_frames = 2 * (frame_rate % 60);
 				}
 			}
-			if (pipe_ctx[i]->stream_res.tg->funcs->set_drr)
-				pipe_ctx[i]->stream_res.tg->funcs->set_drr(
-					pipe_ctx[i]->stream_res.tg, &params);
+			if (tg->funcs->set_drr)
+				tg->funcs->set_drr(tg, &params);
 			if (adjust.v_total_max != 0 && adjust.v_total_min != 0)
-				if (pipe_ctx[i]->stream_res.tg->funcs->set_static_screen_control)
-					pipe_ctx[i]->stream_res.tg->funcs->set_static_screen_control(
-						pipe_ctx[i]->stream_res.tg,
-						event_triggers, num_frames);
+				if (tg->funcs->set_static_screen_control)
+					tg->funcs->set_static_screen_control(
+						tg, event_triggers, num_frames);
 		}
 	}
 }
+
+static bool should_avoid_empty_tu(struct pipe_ctx *pipe_ctx)
+{
+	/* Calculate average pixel count per TU, return false if under ~2.00 to
+	 * avoid empty TUs. This is only required for DPIA tunneling as empty TUs
+	 * are legal to generate for native DP links. Assume TU size 64 as there
+	 * is currently no scenario where it's reprogrammed from HW default.
+	 * MTPs have no such limitation, so this does not affect MST use cases.
+	 */
+	unsigned int pix_clk_mhz;
+	unsigned int symclk_mhz;
+	unsigned int avg_pix_per_tu_x1000;
+	unsigned int tu_size_bytes = 64;
+	struct dc_crtc_timing *timing = &pipe_ctx->stream->timing;
+	struct dc_link_settings *link_settings = &pipe_ctx->link_config.dp_link_settings;
+	const struct dc *dc = pipe_ctx->stream->link->dc;
+
+	if (pipe_ctx->stream->link->ep_type != DISPLAY_ENDPOINT_USB4_DPIA)
+		return false;
+
+	// Not necessary for MST configurations
+	if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
+		return false;
+
+	pix_clk_mhz = timing->pix_clk_100hz / 10000;
+
+	// If this is true, can't block due to dynamic ODM
+	if (pix_clk_mhz > dc->clk_mgr->bw_params->clk_table.entries[0].dispclk_mhz)
+		return false;
+
+	switch (link_settings->link_rate) {
+	case LINK_RATE_LOW:
+		symclk_mhz = 162;
+		break;
+	case LINK_RATE_HIGH:
+		symclk_mhz = 270;
+		break;
+	case LINK_RATE_HIGH2:
+		symclk_mhz = 540;
+		break;
+	case LINK_RATE_HIGH3:
+		symclk_mhz = 810;
+		break;
+	default:
+		// We shouldn't be tunneling any other rates, something is wrong
+		ASSERT(0);
+		return false;
+	}
+
+	avg_pix_per_tu_x1000 = (1000 * pix_clk_mhz * tu_size_bytes)
+		/ (symclk_mhz * link_settings->lane_count);
+
+	// Add small empirically-decided margin to account for potential jitter
+	return (avg_pix_per_tu_x1000 < 2020);
+}
+
+bool dcn35_is_dp_dig_pixel_rate_div_policy(struct pipe_ctx *pipe_ctx)
+{
+	struct dc *dc = pipe_ctx->stream->ctx->dc;
+
+	if (!is_h_timing_divisible_by_2(pipe_ctx->stream))
+		return false;
+
+	if (should_avoid_empty_tu(pipe_ctx))
+		return false;
+
+	if (dc_is_dp_signal(pipe_ctx->stream->signal) && !dc->link_srv->dp_is_128b_132b_signal(pipe_ctx) &&
+		dc->debug.enable_dp_dig_pixel_rate_div_policy)
+		return true;
+
+	return false;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h
@@ -90,4 +90,6 @@
 void dcn35_set_drr(struct pipe_ctx **pipe_ctx,
 		int num_pipes, struct dc_crtc_timing_adjust adjust);
 
+bool dcn35_is_dp_dig_pixel_rate_div_policy(struct pipe_ctx *pipe_ctx);
+
 #endif /* __DC_HWSS_DCN35_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c
@@ -158,7 +158,7 @@
 	.setup_hpo_hw_control = dcn35_setup_hpo_hw_control,
 	.calculate_dccg_k1_k2_values = dcn32_calculate_dccg_k1_k2_values,
 	.set_pixels_per_cycle = dcn32_set_pixels_per_cycle,
-	.is_dp_dig_pixel_rate_div_policy = dcn32_is_dp_dig_pixel_rate_div_policy,
+	.is_dp_dig_pixel_rate_div_policy = dcn35_is_dp_dig_pixel_rate_div_policy,
 	.dsc_pg_control = dcn35_dsc_pg_control,
 	.dsc_pg_status = dcn32_dsc_pg_status,
 	.enable_plane = dcn35_enable_plane,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/inc/core_status.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/inc/core_status.h
@@ -60,5 +60,7 @@
 };
 
 char *dc_status_to_str(enum dc_status status);
+char *dc_pixel_encoding_to_str(enum dc_pixel_encoding pixel_encoding);
+char *dc_color_depth_to_str(enum dc_color_depth color_depth);
 
 #endif /* _CORE_STATUS_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/inc/core_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/inc/core_types.h
@@ -202,6 +202,7 @@
 
 	void (*get_panel_config_defaults)(struct dc_panel_config *panel_config);
 	void (*build_pipe_pix_clk_params)(struct pipe_ctx *pipe_ctx);
+	unsigned int (*get_det_buffer_size)(const struct dc_state *context);
 };
 
 struct audio_support{
@@ -612,7 +613,7 @@
 		 * store current value in plane states so we can still recover
 		 * a valid current state during dc update.
 		 */
-		struct dc_plane_state plane_states[MAX_SURFACE_NUM];
+		struct dc_plane_state plane_states[MAX_SURFACES];
 	} scratch;
 };
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h
@@ -349,7 +349,7 @@
 	enum dm_pp_clocks_state cur_min_clks_state;
 	bool periodic_retraining_disabled;
 
-	unsigned int cur_phyclk_req_table[MAX_PIPES * 2];
+	unsigned int cur_phyclk_req_table[MAX_LINKS];
 
 	bool smu_present;
 	void *wm_range_table;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
@@ -44,6 +44,7 @@
  */
 #define MAX_PIPES 6
 #define MAX_PHANTOM_PIPES (MAX_PIPES / 2)
+#define MAX_LINKS (MAX_PIPES * 2 +2)
 #define MAX_DIG_LINK_ENCODERS 7
 #define MAX_DWB_PIPES	1
 #define MAX_HPO_DP2_ENCODERS	4
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/inc/hw/opp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/inc/hw/opp.h
@@ -321,6 +321,9 @@
 	bool (*dpg_is_blanked)(
 			struct output_pixel_processor *opp);
 
+	bool (*dpg_is_pending)(struct output_pixel_processor *opp);
+
+
 	void (*opp_dpg_set_blank_color)(
 			struct output_pixel_processor *opp,
 			const struct tg_color *color);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
@@ -333,6 +333,7 @@
 
 	void (*init_odm)(struct timing_generator *tg);
 	void (*wait_drr_doublebuffer_pending_clear)(struct timing_generator *tg);
+	void (*wait_odm_doublebuffer_pending_clear)(struct timing_generator *tg);
 };
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/inc/link.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/inc/link.h
@@ -285,12 +285,12 @@
 			enum replay_FW_Message_type msg,
 			union dmub_replay_cmd_set *cmd_data);
 	bool (*edp_set_coasting_vtotal)(
-			struct dc_link *link, uint16_t coasting_vtotal);
+			struct dc_link *link, uint32_t coasting_vtotal);
 	bool (*edp_replay_residency)(const struct dc_link *link,
 			unsigned int *residency, const bool is_start,
 			const bool is_alpm);
 	bool (*edp_set_replay_power_opt_and_coasting_vtotal)(struct dc_link *link,
-			const unsigned int *power_opts, uint16_t coasting_vtotal);
+			const unsigned int *power_opts, uint32_t coasting_vtotal);
 
 	bool (*edp_wait_for_t12)(struct dc_link *link);
 	bool (*edp_is_ilr_optimization_required)(struct dc_link *link,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c
@@ -211,8 +211,12 @@
 						   info->ext_id);
 	uint8_t pipe_offset = dal_irq_src - IRQ_TYPE_VBLANK;
 
-	struct timing_generator *tg =
-			dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg;
+	struct timing_generator *tg;
+
+	if (pipe_offset >= MAX_PIPES)
+		return false;
+
+	tg = dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg;
 
 	if (enable) {
 		if (!tg || !tg->funcs->arm_vert_intr(tg, 2)) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
@@ -816,8 +816,11 @@
 			break;
 		}
 
+		if (!pipe_ctx->stream)
+			return false;
+
 		if (pipe_ctx->stream_res.tg->funcs->lock_doublebuffer_enable) {
-			if (pipe_ctx->stream && should_use_dmub_lock(pipe_ctx->stream->link)) {
+			if (should_use_dmub_lock(pipe_ctx->stream->link)) {
 				union dmub_hw_lock_flags hw_locks = { 0 };
 				struct dmub_hw_lock_inst_flags inst_flags = { 0 };
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.c
@@ -58,7 +58,10 @@
 	struct link_encoder *link_enc = link_enc_cfg_get_link_enc(pipe_ctx->stream->link);
 	struct stream_encoder *stream_enc = pipe_ctx->stream_res.stream_enc;
 
-	if (stream_enc && stream_enc->funcs->disable_fifo)
+	if (!stream_enc)
+		return;
+
+	if (stream_enc->funcs->disable_fifo)
 		stream_enc->funcs->disable_fifo(stream_enc);
 
 	link_enc->funcs->connect_dig_be_to_fe(
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c
@@ -28,6 +28,8 @@
 #include "dccg.h"
 #include "clk_mgr.h"
 
+#define DC_LOGGER link->ctx->logger
+
 void set_hpo_dp_throttled_vcp_size(struct pipe_ctx *pipe_ctx,
 		struct fixed31_32 throttled_vcp_size)
 {
@@ -108,6 +110,11 @@
 		enum clock_source_id clock_source,
 		const struct dc_link_settings *link_settings)
 {
+	if (!link_res->hpo_dp_link_enc) {
+		DC_LOG_ERROR("%s: invalid hpo_dp_link_enc\n", __func__);
+		return;
+	}
+
 	if (link->dc->res_pool->dccg->funcs->set_symclk32_le_root_clock_gating)
 		link->dc->res_pool->dccg->funcs->set_symclk32_le_root_clock_gating(
 				link->dc->res_pool->dccg,
@@ -124,6 +131,11 @@
 		const struct link_resource *link_res,
 		enum signal_type signal)
 {
+	if (!link_res->hpo_dp_link_enc) {
+		DC_LOG_ERROR("%s: invalid hpo_dp_link_enc\n", __func__);
+		return;
+	}
+
 		link_res->hpo_dp_link_enc->funcs->link_disable(link_res->hpo_dp_link_enc);
 		link_res->hpo_dp_link_enc->funcs->disable_link_phy(
 				link_res->hpo_dp_link_enc, signal);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_fixed_vs_pe_retimer_dp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_fixed_vs_pe_retimer_dp.c
@@ -162,7 +162,12 @@
 		link_res->hpo_dp_link_enc->funcs->set_link_test_pattern(
 				link_res->hpo_dp_link_enc, tp_params);
 	}
+
 	link->dc->link_srv->dp_trace_source_sequence(link, DPCD_SOURCE_SEQ_AFTER_SET_SOURCE_PATTERN);
+
+	// Give retimer extra time to lock before updating DP_TRAINING_PATTERN_SET to TPS1
+	if (tp_params->dp_phy_pattern == DP_TEST_PATTERN_128b_132b_TPS1_TRAINING_MODE)
+		msleep(30);
 }
 
 static void set_hpo_fixed_vs_pe_retimer_dp_lane_settings(struct dc_link *link,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/link_factory.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/link_factory.c
@@ -385,7 +385,7 @@
 	if (link->panel_cntl)
 		link->panel_cntl->funcs->destroy(&link->panel_cntl);
 
-	if (link->link_enc) {
+	if (link->link_enc && !link->is_dig_mapping_flexible) {
 		/* Update link encoder resource tracking variables. These are used for
 		 * the dynamic assignment of link encoders to streams. Virtual links
 		 * are not assigned encoder resources on creation.
@@ -611,14 +611,14 @@
 	link->link_enc =
 		link->dc->res_pool->funcs->link_enc_create(dc_ctx, &enc_init_data);
 
-	DC_LOG_DC("BIOS object table - DP_IS_USB_C: %d", link->link_enc->features.flags.bits.DP_IS_USB_C);
-	DC_LOG_DC("BIOS object table - IS_DP2_CAPABLE: %d", link->link_enc->features.flags.bits.IS_DP2_CAPABLE);
-
 	if (!link->link_enc) {
 		DC_ERROR("Failed to create link encoder!\n");
 		goto link_enc_create_fail;
 	}
 
+	DC_LOG_DC("BIOS object table - DP_IS_USB_C: %d", link->link_enc->features.flags.bits.DP_IS_USB_C);
+	DC_LOG_DC("BIOS object table - IS_DP2_CAPABLE: %d", link->link_enc->features.flags.bits.IS_DP2_CAPABLE);
+
 	/* Update link encoder tracking variables. These are used for the dynamic
 	 * assignment of link encoders to streams.
 	 */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c
@@ -534,7 +534,7 @@
 		struct dc_link_settings *cur,
 		enum link_training_result training_result)
 {
-	uint8_t cur_idx = 0, next_idx;
+	uint32_t cur_idx = 0, next_idx;
 	bool found = false;
 
 	if (training_result == LINK_TRAINING_ABORT)
@@ -914,21 +914,17 @@
 
 	memset(link_setting, 0, sizeof(*link_setting));
 
-	/* if preferred is specified through AMDDP, use it, if it's enough
-	 * to drive the mode
-	 */
-	if (link->preferred_link_setting.lane_count !=
-			LANE_COUNT_UNKNOWN &&
-			link->preferred_link_setting.link_rate !=
-					LINK_RATE_UNKNOWN) {
+	if (dc_is_dp_signal(stream->signal)  &&
+			link->preferred_link_setting.lane_count != LANE_COUNT_UNKNOWN &&
+			link->preferred_link_setting.link_rate != LINK_RATE_UNKNOWN) {
+		/* if preferred is specified through AMDDP, use it, if it's enough
+		 * to drive the mode
+		 */
 		*link_setting = link->preferred_link_setting;
-		return true;
-	}
-
-	/* MST doesn't perform link training for now
-	 * TODO: add MST specific link training routine
-	 */
-	if (stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) {
+	} else if (stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) {
+		/* MST doesn't perform link training for now
+		 * TODO: add MST specific link training routine
+		 */
 		decide_mst_link_settings(link, link_setting);
 	} else if (link->connector_signal == SIGNAL_TYPE_EDP) {
 		/* enable edp link optimization for DSC eDP case */
@@ -1590,9 +1586,17 @@
 			return false;
 	}
 
-	if (dp_is_lttpr_present(link))
+	if (dp_is_lttpr_present(link)) {
 		configure_lttpr_mode_transparent(link);
 
+		// Echo TOTAL_LTTPR_CNT back downstream
+		core_link_write_dpcd(
+				link,
+				DP_TOTAL_LTTPR_CNT,
+				&link->dpcd_caps.lttpr_caps.phy_repeater_cnt,
+				sizeof(link->dpcd_caps.lttpr_caps.phy_repeater_cnt));
+	}
+
 	/* Read DP tunneling information. */
 	status = dpcd_get_tunneling_device_data(link);
 
@@ -2215,7 +2219,7 @@
 
 		memset(&link->verified_link_cap, 0,
 				sizeof(struct dc_link_settings));
-		if (!link_detect_connection_type(link, &type) || type == dc_connection_none) {
+		if (link->link_enc && (!link_detect_connection_type(link, &type) || type == dc_connection_none)) {
 			link->verified_link_cap = fail_safe_link_settings;
 			break;
 		} else if (dp_verify_link_cap(link, known_limit_link_setting, &fail_count)) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
@@ -166,7 +166,7 @@
 	uint8_t idx = 0xFF;
 	int i;
 
-	for (i = 0; i < MAX_PIPES * 2; ++i) {
+	for (i = 0; i < MAX_LINKS; ++i) {
 
 		if (!dc_struct->links[i] ||
 				dc_struct->links[i]->ep_type != DISPLAY_ENDPOINT_USB4_DPIA)
@@ -196,7 +196,7 @@
 	struct dc_link *link_dpia_primary, *link_dpia_secondary;
 	int total_bw = 0;
 
-	for (uint8_t i = 0; i < (MAX_PIPES * 2) - 1; ++i) {
+	for (uint8_t i = 0; i < MAX_LINKS - 1; ++i) {
 
 		if (!dc->links[i] || dc->links[i]->ep_type != DISPLAY_ENDPOINT_USB4_DPIA)
 			continue;
@@ -270,7 +270,7 @@
 
 	/* Error check whether requested and allocated are equal */
 	req_bw = requested_bw * (Kbps_TO_Gbps / link->dpia_bw_alloc_config.bw_granularity);
-	if (req_bw == link->dpia_bw_alloc_config.allocated_bw) {
+	if (req_bw && (req_bw == link->dpia_bw_alloc_config.allocated_bw)) {
 		DC_LOG_ERROR("%s: Request bw equals to allocated bw for link(%d)\n",
 			__func__, link->link_index);
 	}
@@ -341,6 +341,14 @@
 			ret = true;
 			init_usb4_bw_struct(link);
 			link->dpia_bw_alloc_config.bw_alloc_enabled = true;
+
+			/*
+			 * During DP tunnel creation, CM preallocates BW and reduces estimated BW of other
+			 * DPIA. CM release preallocation only when allocation is complete. Do zero alloc
+			 * to make the CM to release preallocation and update estimated BW correctly for
+			 * all DPIAs per host router
+			 */
+			link_dp_dpia_allocate_usb4_bandwidth_for_stream(link, 0);
 		}
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_irq_handler.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_irq_handler.c
@@ -454,7 +454,8 @@
 	 * If we got sink count changed it means
 	 * Downstream port status changed,
 	 * then DM should call DC to do the detection.
-	 * NOTE: Do not handle link loss on eDP since it is internal link*/
+	 * NOTE: Do not handle link loss on eDP since it is internal link
+	 */
 	if ((link->connector_signal != SIGNAL_TYPE_EDP) &&
 			dp_parse_link_loss_status(
 					link,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c
@@ -143,32 +143,25 @@
 
 	link_enc = link_enc_cfg_get_link_enc(link);
 	ASSERT(link_enc);
+	if (link_enc->funcs->fec_set_ready == NULL)
+		return DC_NOT_SUPPORTED;
 
-	if (!dp_should_enable_fec(link))
-		return status;
+	if (ready && dp_should_enable_fec(link)) {
+		fec_config = 1;
 
-	if (link_enc->funcs->fec_set_ready &&
-			link->dpcd_caps.fec_cap.bits.FEC_CAPABLE) {
-		if (ready) {
-			fec_config = 1;
-			status = core_link_write_dpcd(link,
-					DP_FEC_CONFIGURATION,
-					&fec_config,
-					sizeof(fec_config));
-			if (status == DC_OK) {
-				link_enc->funcs->fec_set_ready(link_enc, true);
-				link->fec_state = dc_link_fec_ready;
-			} else {
-				link_enc->funcs->fec_set_ready(link_enc, false);
-				link->fec_state = dc_link_fec_not_ready;
-				dm_error("dpcd write failed to set fec_ready");
-			}
-		} else if (link->fec_state == dc_link_fec_ready) {
+		status = core_link_write_dpcd(link, DP_FEC_CONFIGURATION,
+				&fec_config, sizeof(fec_config));
+
+		if (status == DC_OK) {
+			link_enc->funcs->fec_set_ready(link_enc, true);
+			link->fec_state = dc_link_fec_ready;
+		}
+	} else {
+		if (link->fec_state == dc_link_fec_ready) {
 			fec_config = 0;
-			status = core_link_write_dpcd(link,
-					DP_FEC_CONFIGURATION,
-					&fec_config,
-					sizeof(fec_config));
+			core_link_write_dpcd(link, DP_FEC_CONFIGURATION,
+				&fec_config, sizeof(fec_config));
+
 			link_enc->funcs->fec_set_ready(link_enc, false);
 			link->fec_state = dc_link_fec_not_ready;
 		}
@@ -183,14 +176,12 @@
 
 	link_enc = link_enc_cfg_get_link_enc(link);
 	ASSERT(link_enc);
-
-	if (!dp_should_enable_fec(link))
+	if (link_enc->funcs->fec_set_enable == NULL)
 		return;
 
-	if (link_enc->funcs->fec_set_enable &&
-			link->dpcd_caps.fec_cap.bits.FEC_CAPABLE) {
-		if (link->fec_state == dc_link_fec_ready && enable) {
-			/* Accord to DP spec, FEC enable sequence can first
+	if (enable && dp_should_enable_fec(link)) {
+		if (link->fec_state == dc_link_fec_ready) {
+			/* According to DP spec, FEC enable sequence can first
 			 * be transmitted anytime after 1000 LL codes have
 			 * been transmitted on the link after link training
 			 * completion. Using 1 lane RBR should have the maximum
@@ -200,7 +191,9 @@
 			udelay(7);
 			link_enc->funcs->fec_set_enable(link_enc, true);
 			link->fec_state = dc_link_fec_enabled;
-		} else if (link->fec_state == dc_link_fec_enabled && !enable) {
+		}
+	} else {
+		if (link->fec_state == dc_link_fec_enabled) {
 			link_enc->funcs->fec_set_enable(link_enc, false);
 			link->fec_state = dc_link_fec_ready;
 		}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
@@ -914,10 +914,10 @@
 			/* Driver does not need to train the first hop. Skip DPCD read and clear
 			 * AUX_RD_INTERVAL for DPTX-to-DPIA hop.
 			 */
-			if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA)
+			if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA && repeater_cnt > 0 && repeater_cnt < MAX_REPEATER_CNT)
 				link->dpcd_caps.lttpr_caps.aux_rd_interval[--repeater_cnt] = 0;
 
-			for (repeater_id = repeater_cnt; repeater_id > 0; repeater_id--) {
+			for (repeater_id = repeater_cnt; repeater_id > 0 && repeater_id < MAX_REPEATER_CNT; repeater_id--) {
 				aux_interval_address = DP_TRAINING_AUX_RD_INTERVAL_PHY_REPEATER1 +
 						((DP_REPEATER_CONFIGURATION_AND_STATUS_SIZE) * (repeater_id - 1));
 				core_link_read_dpcd(
@@ -1676,8 +1676,7 @@
 		if (status == LINK_TRAINING_ABORT) {
 			enum dc_connection_type type = dc_connection_none;
 
-			link_detect_connection_type(link, &type);
-			if (type == dc_connection_none) {
+			if (link_detect_connection_type(link, &type) && type == dc_connection_none) {
 				DC_LOG_HW_LINK_TRAINING("%s: Aborting training because sink unplugged\n", __func__);
 				break;
 			}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c
@@ -164,7 +164,8 @@
 	if (new_addr_range.start != in_address || new_addr_range.end != end_address) {
 		*out_address = new_addr_range.start;
 		*out_size = ADDRESS_RANGE_SIZE(new_addr_range.start, new_addr_range.end);
-		*out_data = kzalloc(*out_size * sizeof(**out_data), GFP_KERNEL);
+		*out_data = kcalloc(*out_size, sizeof(**out_data), GFP_KERNEL);
+		ASSERT(*out_data);
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
@@ -892,7 +892,8 @@
 
 	/* Set power optimization flag */
 	if (power_opts && link->replay_settings.replay_power_opt_active != *power_opts) {
-		if (link->replay_settings.replay_feature_enabled && replay->funcs->replay_set_power_opt) {
+		if (replay != NULL && link->replay_settings.replay_feature_enabled &&
+		    replay->funcs->replay_set_power_opt) {
 			replay->funcs->replay_set_power_opt(replay, *power_opts, panel_inst);
 			link->replay_settings.replay_power_opt_active = *power_opts;
 		}
@@ -1033,7 +1034,7 @@
 	return true;
 }
 
-bool edp_set_coasting_vtotal(struct dc_link *link, uint16_t coasting_vtotal)
+bool edp_set_coasting_vtotal(struct dc_link *link, uint32_t coasting_vtotal)
 {
 	struct dc *dc = link->ctx->dc;
 	struct dmub_replay *replay = dc->res_pool->replay;
@@ -1072,7 +1073,7 @@
 }
 
 bool edp_set_replay_power_opt_and_coasting_vtotal(struct dc_link *link,
-	const unsigned int *power_opts, uint16_t coasting_vtotal)
+	const unsigned int *power_opts, uint32_t coasting_vtotal)
 {
 	struct dc  *dc = link->ctx->dc;
 	struct dmub_replay *replay = dc->res_pool->replay;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.h
@@ -59,12 +59,12 @@
 bool edp_send_replay_cmd(struct dc_link *link,
 			enum replay_FW_Message_type msg,
 			union dmub_replay_cmd_set *cmd_data);
-bool edp_set_coasting_vtotal(struct dc_link *link, uint16_t coasting_vtotal);
+bool edp_set_coasting_vtotal(struct dc_link *link, uint32_t coasting_vtotal);
 bool edp_replay_residency(const struct dc_link *link,
 	unsigned int *residency, const bool is_start, const bool is_alpm);
 bool edp_get_replay_state(const struct dc_link *link, uint64_t *state);
 bool edp_set_replay_power_opt_and_coasting_vtotal(struct dc_link *link,
-	const unsigned int *power_opts, uint16_t coasting_vtotal);
+	const unsigned int *power_opts, uint32_t coasting_vtotal);
 bool edp_wait_for_t12(struct dc_link *link);
 bool edp_is_ilr_optimization_required(struct dc_link *link,
        struct dc_crtc_timing *crtc_timing);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/optc/dcn10/dcn10_optc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/optc/dcn10/dcn10_optc.h
@@ -557,7 +557,8 @@
 	type OTG_CRC_DATA_STREAM_SPLIT_MODE;\
 	type OTG_CRC_DATA_FORMAT;\
 	type OTG_V_TOTAL_LAST_USED_BY_DRR;\
-	type OTG_DRR_TIMING_DBUF_UPDATE_PENDING;
+	type OTG_DRR_TIMING_DBUF_UPDATE_PENDING;\
+	type OTG_H_TIMING_DIV_MODE_DB_UPDATE_PENDING;
 
 #define TG_REG_FIELD_LIST_DCN3_2(type) \
 	type OTG_H_TIMING_DIV_MODE_MANUAL;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.c
@@ -122,6 +122,13 @@
 	}
 }
 
+void optc32_wait_odm_doublebuffer_pending_clear(struct timing_generator *tg)
+{
+	struct optc *optc1 = DCN10TG_FROM_TG(tg);
+
+	REG_WAIT(OTG_DOUBLE_BUFFER_CONTROL, OTG_H_TIMING_DIV_MODE_DB_UPDATE_PENDING, 0, 2, 50000);
+}
+
 void optc32_set_h_timing_div_manual_mode(struct timing_generator *optc, bool manual_mode)
 {
 	struct optc *optc1 = DCN10TG_FROM_TG(optc);
@@ -260,9 +267,6 @@
 				OTG_V_TOTAL_MAX_SEL, 1,
 				OTG_FORCE_LOCK_ON_EVENT, 0,
 				OTG_SET_V_TOTAL_MIN_MASK, (1 << 1)); /* TRIGA */
-
-		// Setup manual flow control for EOF via TRIG_A
-		optc->funcs->setup_manual_trigger(optc);
 	}
 }
 
@@ -345,6 +349,7 @@
 		.set_odm_bypass = optc32_set_odm_bypass,
 		.set_odm_combine = optc32_set_odm_combine,
 		.get_odm_combine_segments = optc32_get_odm_combine_segments,
+		.wait_odm_doublebuffer_pending_clear = optc32_wait_odm_doublebuffer_pending_clear,
 		.set_h_timing_div_manual_mode = optc32_set_h_timing_div_manual_mode,
 		.get_optc_source = optc2_get_optc_source,
 		.set_out_mux = optc3_set_out_mux,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.h
@@ -183,5 +183,6 @@
 void optc32_get_odm_combine_segments(struct timing_generator *tg, int *odm_combine_segments);
 void optc32_set_odm_bypass(struct timing_generator *optc,
 		const struct dc_crtc_timing *dc_crtc_timing);
+void optc32_wait_odm_doublebuffer_pending_clear(struct timing_generator *tg);
 
 #endif /* __DC_OPTC_DCN32_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dce112/dce112_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dce112/dce112_resource.c
@@ -1069,7 +1069,10 @@
 	struct dm_pp_clock_levels clks = {0};
 	int memory_type_multiplier = MEMORY_TYPE_MULTIPLIER_CZ;
 
-	if (dc->bw_vbios && dc->bw_vbios->memory_type == bw_def_hbm)
+	if (!dc->bw_vbios)
+		return;
+
+	if (dc->bw_vbios->memory_type == bw_def_hbm)
 		memory_type_multiplier = MEMORY_TYPE_HBM;
 
 	/*do system clock  TODO PPLIB: after PPLIB implement,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c
@@ -1539,6 +1539,7 @@
 	if (dce83_construct(num_virtual_links, dc, pool))
 		return &pool->base;
 
+	kfree(pool);
 	BREAK_TO_DEBUGGER();
 	return NULL;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
@@ -2031,6 +2031,7 @@
 {
 	bool out = false;
 	int split[MAX_PIPES] = { 0 };
+	bool merge[MAX_PIPES] = { false };
 	int pipe_cnt, i, pipe_idx, vlevel;
 
 	ASSERT(pipes);
@@ -2055,7 +2056,7 @@
 	if (vlevel > context->bw_ctx.dml.soc.num_states)
 		goto validate_fail;
 
-	vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, NULL);
+	vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, merge);
 
 	/*initialize pipe_just_split_from to invalid idx*/
 	for (i = 0; i < MAX_PIPES; i++)
@@ -2191,10 +2192,11 @@
 		const struct dc_dcc_surface_param *input,
 		struct dc_surface_dcc_cap *output)
 {
-	return dc->res_pool->hubbub->funcs->get_dcc_compression_cap(
-			dc->res_pool->hubbub,
-			input,
-			output);
+	if (dc->res_pool->hubbub->funcs->get_dcc_compression_cap)
+		return dc->res_pool->hubbub->funcs->get_dcc_compression_cap(
+			dc->res_pool->hubbub, input, output);
+
+	return false;
 }
 
 static void dcn20_destroy_resource_pool(struct resource_pool **pool)
@@ -2451,6 +2453,7 @@
 	dc->caps.post_blend_color_processing = true;
 	dc->caps.force_dp_tps4_for_cp2520 = true;
 	dc->caps.extended_aux_timeout_support = true;
+	dc->caps.dmcub_support = true;
 
 	/* Color pipeline capabilities */
 	dc->caps.color.dpp.dcn_arch = 1;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
@@ -1003,8 +1003,10 @@
 	struct pipe_ctx *head_pipe = resource_get_otg_master_for_stream(res_ctx, opp_head_pipe->stream);
 	struct pipe_ctx *idle_pipe = resource_find_free_secondary_pipe_legacy(res_ctx, pool, head_pipe);
 
-	if (!head_pipe)
+	if (!head_pipe) {
 		ASSERT(0);
+		return NULL;
+	}
 
 	if (!idle_pipe)
 		return NULL;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c
@@ -800,6 +800,7 @@
 {
 	bool out = false;
 	int split[MAX_PIPES] = { 0 };
+	bool merge[MAX_PIPES] = { false };
 	int pipe_cnt, i, pipe_idx, vlevel;
 
 	ASSERT(pipes);
@@ -842,7 +843,7 @@
 			goto validate_fail;
 	}
 
-	vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, NULL);
+	vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, merge);
 
 	for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) {
 		struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i];
@@ -1323,7 +1324,7 @@
 		kzalloc(sizeof(struct dcn21_link_encoder), GFP_KERNEL);
 	int link_regs_id;
 
-	if (!enc21)
+	if (!enc21 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
 		return NULL;
 
 	link_regs_id =
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
@@ -2050,6 +2050,9 @@
 
 	BW_VAL_TRACE_COUNT();
 
+	if (!pipes)
+		goto validate_fail;
+
 	DC_FP_START();
 	out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate, true);
 	DC_FP_END();
@@ -2169,6 +2172,17 @@
 					optimal_uclk_for_dcfclk_sta_targets[i] =
 							bw_params->clk_table.entries[j].memclk_mhz * 16;
 					break;
+				} else {
+					/* condition where (dcfclk_sta_targets[i] >= optimal_dcfclk_for_uclk[j]):
+					 * If it just so happens that the memory bandwidth is low enough such that
+					 * all the optimal DCFCLK for each UCLK is lower than the smallest DCFCLK STA
+					 * target, we need to populate the optimal UCLK for each DCFCLK STA target to
+					 * be the max UCLK.
+					 */
+					if (j == num_uclk_states - 1) {
+						optimal_uclk_for_dcfclk_sta_targets[i] =
+								bw_params->clk_table.entries[j].memclk_mhz * 16;
+					}
 				}
 			}
 		}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
@@ -892,7 +892,7 @@
 	.disable_z10 = true,
 	.enable_legacy_fast_update = true,
 	.enable_z9_disable_interface = true, /* Allow support for the PMFW interface for disable Z9*/
-	.dml_hostvm_override = DML_HOSTVM_OVERRIDE_FALSE,
+	.dml_hostvm_override = DML_HOSTVM_NO_OVERRIDE,
 	.using_dml2 = false,
 };
 
@@ -1311,6 +1311,8 @@
 
 	/* allocate HPO link encoder */
 	hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
+	if (!hpo_dp_enc31)
+		return NULL; /* out of memory */
 
 	hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst,
 					&hpo_dp_link_enc_regs[inst],
@@ -1720,6 +1722,12 @@
 	return pipe_cnt;
 }
 
+unsigned int dcn31_get_det_buffer_size(
+	const struct dc_state *context)
+{
+	return context->bw_ctx.dml.ip.det_buffer_size_kbytes;
+}
+
 void dcn31_calculate_wm_and_dlg(
 		struct dc *dc, struct dc_state *context,
 		display_e2e_pipe_params_st *pipes,
@@ -1767,6 +1775,9 @@
 
 	BW_VAL_TRACE_COUNT();
 
+	if (!pipes)
+		goto validate_fail;
+
 	DC_FP_START();
 	out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate, true);
 	DC_FP_END();
@@ -1839,6 +1850,7 @@
 	.update_bw_bounding_box = dcn31_update_bw_bounding_box,
 	.patch_unknown_plane_state = dcn20_patch_unknown_plane_state,
 	.get_panel_config_defaults = dcn31_get_panel_config_defaults,
+	.get_det_buffer_size = dcn31_get_det_buffer_size,
 };
 
 static struct clock_source *dcn30_clock_source_create(
@@ -1860,6 +1872,7 @@
 		return &clk_src->base;
 	}
 
+	kfree(clk_src);
 	BREAK_TO_DEBUGGER();
 	return NULL;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
@@ -63,6 +63,9 @@
 		const struct dc_init_data *init_data,
 		struct dc *dc);
 
+unsigned int dcn31_get_det_buffer_size(
+	const struct dc_state *context);
+
 /*temp: B0 specific before switch to dcn313 headers*/
 #ifndef regPHYPLLF_PIXCLK_RESYNC_CNTL
 #define regPHYPLLF_PIXCLK_RESYNC_CNTL 0x007e
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
@@ -1384,6 +1384,8 @@
 
 	/* allocate HPO link encoder */
 	hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
+	if (!hpo_dp_enc31)
+		return NULL; /* out of memory */
 
 	hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst,
 					&hpo_dp_link_enc_regs[inst],
@@ -1675,8 +1677,8 @@
 		return &clk_src->base;
 	}
 
-	BREAK_TO_DEBUGGER();
 	kfree(clk_src);
+	BREAK_TO_DEBUGGER();
 	return NULL;
 }
 
@@ -1744,6 +1746,9 @@
 
 	BW_VAL_TRACE_COUNT();
 
+	if (!pipes)
+		goto validate_fail;
+
 	if (filter_modes_for_single_channel_workaround(dc, context))
 		goto validate_fail;
 
@@ -1812,6 +1817,7 @@
 	.patch_unknown_plane_state = dcn20_patch_unknown_plane_state,
 	.get_panel_config_defaults = dcn314_get_panel_config_defaults,
 	.get_preferred_eng_id_dpia = dcn314_get_preferred_eng_id_dpia,
+	.get_det_buffer_size = dcn31_get_det_buffer_size,
 };
 
 static struct clock_source *dcn30_clock_source_create(
@@ -1833,8 +1839,8 @@
 		return &clk_src->base;
 	}
 
-	BREAK_TO_DEBUGGER();
 	kfree(clk_src);
+	BREAK_TO_DEBUGGER();
 	return NULL;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
@@ -1309,6 +1309,8 @@
 
 	/* allocate HPO link encoder */
 	hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
+	if (!hpo_dp_enc31)
+		return NULL; /* out of memory */
 
 	hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst,
 					&hpo_dp_link_enc_regs[inst],
@@ -1754,7 +1756,7 @@
 				bool split_required = pipe->stream->timing.pix_clk_100hz >= dcn_get_max_non_odm_pix_rate_100hz(&dc->dml.soc)
 						|| (pipe->plane_state && pipe->plane_state->src_rect.width > 5120);
 
-				if (remaining_det_segs > MIN_RESERVED_DET_SEGS)
+				if (remaining_det_segs > MIN_RESERVED_DET_SEGS && crb_pipes != 0)
 					pipes[pipe_cnt].pipe.src.det_size_override += (remaining_det_segs - MIN_RESERVED_DET_SEGS) / crb_pipes +
 							(crb_idx < (remaining_det_segs - MIN_RESERVED_DET_SEGS) % crb_pipes ? 1 : 0);
 				if (pipes[pipe_cnt].pipe.src.det_size_override > 2 * DCN3_15_MAX_DET_SEGS) {
@@ -1834,6 +1836,7 @@
 	.update_bw_bounding_box = dcn315_update_bw_bounding_box,
 	.patch_unknown_plane_state = dcn20_patch_unknown_plane_state,
 	.get_panel_config_defaults = dcn315_get_panel_config_defaults,
+	.get_det_buffer_size = dcn31_get_det_buffer_size,
 };
 
 static bool dcn315_resource_construct(
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
@@ -1306,6 +1306,8 @@
 
 	/* allocate HPO link encoder */
 	hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
+	if (!hpo_dp_enc31)
+		return NULL; /* out of memory */
 
 	hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst,
 					&hpo_dp_link_enc_regs[inst],
@@ -1719,6 +1721,7 @@
 	.update_bw_bounding_box = dcn316_update_bw_bounding_box,
 	.patch_unknown_plane_state = dcn20_patch_unknown_plane_state,
 	.get_panel_config_defaults = dcn316_get_panel_config_defaults,
+	.get_det_buffer_size = dcn31_get_det_buffer_size,
 };
 
 static bool dcn316_resource_construct(
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
@@ -1304,6 +1304,8 @@
 
 	/* allocate HPO link encoder */
 	hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
+	if (!hpo_dp_enc31)
+		return NULL; /* out of memory */
 
 #undef REG_STRUCT
 #define REG_STRUCT hpo_dp_link_enc_regs
@@ -1648,6 +1650,9 @@
 		else
 			phantom_plane = dc_state_create_phantom_plane(dc, context, curr_pipe->plane_state);
 
+		if (!phantom_plane)
+			continue;
+
 		memcpy(&phantom_plane->address, &curr_pipe->plane_state->address, sizeof(phantom_plane->address));
 		memcpy(&phantom_plane->scaling_quality, &curr_pipe->plane_state->scaling_quality,
 				sizeof(phantom_plane->scaling_quality));
@@ -1712,6 +1717,9 @@
 	// be a valid candidate for SubVP (i.e. has a plane, stream, doesn't
 	// already have phantom pipe assigned, etc.) by previous checks.
 	phantom_stream = dcn32_enable_phantom_stream(dc, context, pipes, pipe_cnt, index);
+	if (!phantom_stream)
+		return;
+
 	dcn32_enable_phantom_plane(dc, context, phantom_stream, index);
 
 	for (i = 0; i < dc->res_pool->pipe_count; i++) {
@@ -1751,6 +1759,9 @@
 
 	BW_VAL_TRACE_COUNT();
 
+	if (!pipes)
+		goto validate_fail;
+
 	DC_FP_START();
 	out = dcn32_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate);
 	DC_FP_END();
@@ -1771,6 +1782,7 @@
 	dc->res_pool->funcs->calculate_wm_and_dlg(dc, context, pipes, pipe_cnt, vlevel);
 
 	dcn32_override_min_req_memclk(dc, context);
+	dcn32_override_min_req_dcfclk(dc, context);
 
 	BW_VAL_TRACE_END_WATERMARKS();
 
@@ -1930,6 +1942,8 @@
 {
 	DC_FP_START();
 	dcn32_update_bw_bounding_box_fpu(dc, bw_params);
+	if (dc->debug.using_dml2 && dc->current_state && dc->current_state->bw_ctx.dml2)
+		dml2_reinit(dc, &dc->dml2_options, &dc->current_state->bw_ctx.dml2);
 	DC_FP_END();
 }
 
@@ -2589,8 +2603,10 @@
 	struct resource_context *old_ctx = &stream->ctx->dc->current_state->res_ctx;
 	int head_index;
 
-	if (!head_pipe)
+	if (!head_pipe) {
 		ASSERT(0);
+		return NULL;
+	}
 
 	/*
 	 * Modified from dcn20_acquire_idle_pipe_for_layer
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.h
@@ -42,6 +42,7 @@
 #define SUBVP_ACTIVE_MARGIN_LIST_LEN 2
 #define DCN3_2_MAX_SUBVP_PIXEL_RATE_MHZ 1800
 #define DCN3_2_VMIN_DISPCLK_HZ 717000000
+#define MIN_SUBVP_DCFCLK_KHZ 400000
 
 #define TO_DCN32_RES_POOL(pool)\
 	container_of(pool, struct dcn32_resource_pool, base)
@@ -181,6 +182,8 @@
 
 void dcn32_update_dml_pipes_odm_policy_based_on_context(struct dc *dc, struct dc_state *context, display_e2e_pipe_params_st *pipes);
 
+void dcn32_override_min_req_dcfclk(struct dc *dc, struct dc_state *context);
+
 /* definitions for run time init of reg offsets */
 
 /* CLK SRC */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
@@ -1288,6 +1288,8 @@
 
 	/* allocate HPO link encoder */
 	hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
+	if (!hpo_dp_enc31)
+		return NULL; /* out of memory */
 
 #undef REG_STRUCT
 #define REG_STRUCT hpo_dp_link_enc_regs
@@ -1581,6 +1583,8 @@
 {
 	DC_FP_START();
 	dcn321_update_bw_bounding_box_fpu(dc, bw_params);
+	if (dc->debug.using_dml2 && dc->current_state && dc->current_state->bw_ctx.dml2)
+		dml2_reinit(dc, &dc->dml2_options, &dc->current_state->bw_ctx.dml2);
 	DC_FP_END();
 }
 
@@ -1759,6 +1763,9 @@
 	dc->caps.color.mpc.ogam_rom_caps.hlg = 0;
 	dc->caps.color.mpc.ocsc = 1;
 
+	/* Use pipe context based otg sync logic */
+	dc->config.use_pipe_ctx_sync_logic = true;
+
 	dc->config.dc_mode_clk_limit_support = true;
 	/* read VBIOS LTTPR caps */
 	{
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
@@ -701,7 +701,7 @@
 
 	// 6:1 downscaling ratio: 1000/6 = 166.666
 	.max_downscale_factor = {
-			.argb8888 = 167,
+			.argb8888 = 250,
 			.nv12 = 167,
 			.fp16 = 167
 	},
@@ -782,7 +782,9 @@
 	.psp_disabled_wa = true,
 	.ips2_eval_delay_us = 2000,
 	.ips2_entry_delay_us = 800,
+	.disable_dmub_reallow_idle = true,
 	.static_screen_wait_frames = 2,
+	.disable_timeout = true,
 };
 
 static const struct dc_panel_config panel_config_defaults = {
@@ -1366,6 +1368,8 @@
 
 	/* allocate HPO link encoder */
 	hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
+	if (!hpo_dp_enc31)
+		return NULL; /* out of memory */
 
 #undef REG_STRUCT
 #define REG_STRUCT hpo_dp_link_enc_regs
@@ -1712,6 +1716,7 @@
 		return &clk_src->base;
 	}
 
+	kfree(clk_src);
 	BREAK_TO_DEBUGGER();
 	return NULL;
 }
@@ -1770,6 +1775,7 @@
 	.patch_unknown_plane_state = dcn20_patch_unknown_plane_state,
 	.get_panel_config_defaults = dcn35_get_panel_config_defaults,
 	.get_preferred_eng_id_dpia = dcn35_get_preferred_eng_id_dpia,
+	.get_det_buffer_size = dcn31_get_det_buffer_size,
 };
 
 static bool dcn35_resource_construct(
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
@@ -3133,6 +3133,14 @@
 	 * Currently the support is only for 0 or 1
 	 */
 	uint8_t panel_inst;
+	/**
+	 * 16-bit value dicated by driver that indicates the coasting vtotal high byte part.
+	 */
+	uint16_t coasting_vtotal_high;
+	/**
+	 * Explicit padding to 4 byte boundary.
+	 */
+	uint8_t pad[2];
 };
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c
@@ -448,7 +448,7 @@
 void dmub_dcn35_get_diagnostic_data(struct dmub_srv *dmub, struct dmub_diagnostic_data *diag_data)
 {
 	uint32_t is_dmub_enabled, is_soft_reset, is_sec_reset;
-	uint32_t is_traceport_enabled, is_cw0_enabled, is_cw6_enabled;
+	uint32_t is_traceport_enabled, is_cw6_enabled;
 
 	if (!dmub || !diag_data)
 		return;
@@ -499,9 +499,6 @@
 	REG_GET(DMCUB_CNTL, DMCUB_TRACEPORT_EN, &is_traceport_enabled);
 	diag_data->is_traceport_en  = is_traceport_enabled;
 
-	REG_GET(DMCUB_REGION3_CW0_TOP_ADDRESS, DMCUB_REGION3_CW0_ENABLE, &is_cw0_enabled);
-	diag_data->is_cw0_enabled = is_cw0_enabled;
-
 	REG_GET(DMCUB_REGION3_CW6_TOP_ADDRESS, DMCUB_REGION3_CW6_ENABLE, &is_cw6_enabled);
 	diag_data->is_cw6_enabled = is_cw6_enabled;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/include/dpcd_defs.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/include/dpcd_defs.h
@@ -177,4 +177,9 @@
 #define DP_SINK_PR_PIXEL_DEVIATION_PER_LINE     0x379
 #define DP_SINK_PR_MAX_NUMBER_OF_DEVIATION_LINE 0x37A
 
+/* Remove once drm_dp_helper.h is updated upstream */
+#ifndef DP_TOTAL_LTTPR_CNT
+#define DP_TOTAL_LTTPR_CNT                                  0xF000A /* 2.1 */
+#endif
+
 #endif /* __DAL_DPCD_DEFS_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
@@ -134,7 +134,7 @@
 
 	v_total = div64_u64(div64_u64(((unsigned long long)(
 			frame_duration_in_ns) * (stream->timing.pix_clk_100hz / 10)),
-			stream->timing.h_total), 1000000);
+			stream->timing.h_total) + 500000, 1000000);
 
 	/* v_total cannot be less than nominal */
 	if (v_total < stream->timing.v_total) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
@@ -432,18 +432,18 @@
 		goto out;
 	}
 
-	if (status == MOD_HDCP_STATUS_SUCCESS)
-		mod_hdcp_execute_and_set(mod_hdcp_read_bstatus,
-				&input->bstatus_read, &status,
-				hdcp, "bstatus_read");
-	if (status == MOD_HDCP_STATUS_SUCCESS)
-		mod_hdcp_execute_and_set(check_link_integrity_dp,
-				&input->link_integrity_check, &status,
-				hdcp, "link_integrity_check");
-	if (status == MOD_HDCP_STATUS_SUCCESS)
-		mod_hdcp_execute_and_set(check_no_reauthentication_request_dp,
-				&input->reauth_request_check, &status,
-				hdcp, "reauth_request_check");
+	mod_hdcp_execute_and_set(mod_hdcp_read_bstatus,
+			&input->bstatus_read, &status,
+			hdcp, "bstatus_read");
+
+	mod_hdcp_execute_and_set(check_link_integrity_dp,
+			&input->link_integrity_check, &status,
+			hdcp, "link_integrity_check");
+
+	mod_hdcp_execute_and_set(check_no_reauthentication_request_dp,
+			&input->reauth_request_check, &status,
+			hdcp, "reauth_request_check");
+
 out:
 	return status;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c
@@ -156,7 +156,16 @@
 	uint32_t cur_size = 0;
 	uint32_t data_offset = 0;
 
+	if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID ||
+		msg_id >= MOD_HDCP_MESSAGE_ID_MAX)
+		return MOD_HDCP_STATUS_DDC_FAILURE;
+
 	if (is_dp_hdcp(hdcp)) {
+		int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) /
+			sizeof(hdcp_dpcd_addrs[0]);
+		if (msg_id >= num_dpcd_addrs)
+			return MOD_HDCP_STATUS_DDC_FAILURE;
+
 		while (buf_len > 0) {
 			cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);
 			success = hdcp->config.ddc.funcs.read_dpcd(hdcp->config.ddc.handle,
@@ -171,6 +180,11 @@
 			data_offset += cur_size;
 		}
 	} else {
+		int num_i2c_offsets = sizeof(hdcp_i2c_offsets) /
+			sizeof(hdcp_i2c_offsets[0]);
+		if (msg_id >= num_i2c_offsets)
+			return MOD_HDCP_STATUS_DDC_FAILURE;
+
 		success = hdcp->config.ddc.funcs.read_i2c(
 				hdcp->config.ddc.handle,
 				HDCP_I2C_ADDR,
@@ -215,7 +229,16 @@
 	uint32_t cur_size = 0;
 	uint32_t data_offset = 0;
 
+	if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID ||
+		msg_id >= MOD_HDCP_MESSAGE_ID_MAX)
+		return MOD_HDCP_STATUS_DDC_FAILURE;
+
 	if (is_dp_hdcp(hdcp)) {
+		int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) /
+			sizeof(hdcp_dpcd_addrs[0]);
+		if (msg_id >= num_dpcd_addrs)
+			return MOD_HDCP_STATUS_DDC_FAILURE;
+
 		while (buf_len > 0) {
 			cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);
 			success = hdcp->config.ddc.funcs.write_dpcd(
@@ -231,6 +254,11 @@
 			data_offset += cur_size;
 		}
 	} else {
+		int num_i2c_offsets = sizeof(hdcp_i2c_offsets) /
+			sizeof(hdcp_i2c_offsets[0]);
+		if (msg_id >= num_i2c_offsets)
+			return MOD_HDCP_STATUS_DDC_FAILURE;
+
 		hdcp->buf[0] = hdcp_i2c_offsets[msg_id];
 		memmove(&hdcp->buf[1], buf, buf_len);
 		success = hdcp->config.ddc.funcs.write_i2c(
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c
@@ -513,6 +513,9 @@
 	hdcp_cmd = (struct ta_hdcp_shared_memory *)psp->hdcp_context.context.mem_context.shared_buf;
 	memset(hdcp_cmd, 0, sizeof(struct ta_hdcp_shared_memory));
 
+	if (!display)
+		return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND;
+
 	hdcp_cmd->in_msg.hdcp2_create_session_v2.display_handle = display->index;
 
 	if (hdcp->connection.link.adjust.hdcp2.force_type == MOD_HDCP_FORCE_TYPE_0)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/modules/inc/mod_stats.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/modules/inc/mod_stats.h
@@ -57,10 +57,10 @@
 		unsigned int length);
 
 void mod_stats_update_flip(struct mod_stats *mod_stats,
-		unsigned long timestamp_in_ns);
+		unsigned long long timestamp_in_ns);
 
 void mod_stats_update_vupdate(struct mod_stats *mod_stats,
-		unsigned long timestamp_in_ns);
+		unsigned long long timestamp_in_ns);
 
 void mod_stats_update_freesync(struct mod_stats *mod_stats,
 		unsigned int v_total_min,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c
@@ -147,15 +147,12 @@
 	}
 
 	/* VSC packet set to 4 for PSR-SU, or 2 for PSR1 */
-	if (stream->link->psr_settings.psr_feature_enabled) {
-		if (stream->link->psr_settings.psr_version == DC_PSR_VERSION_SU_1)
-			vsc_packet_revision = vsc_packet_rev4;
-		else if (stream->link->psr_settings.psr_version == DC_PSR_VERSION_1)
-			vsc_packet_revision = vsc_packet_rev2;
-	}
-
-	if (stream->link->replay_settings.config.replay_supported)
+	if (stream->link->psr_settings.psr_version == DC_PSR_VERSION_SU_1)
+		vsc_packet_revision = vsc_packet_rev4;
+	else if (stream->link->replay_settings.config.replay_supported)
 		vsc_packet_revision = vsc_packet_rev4;
+	else if (stream->link->psr_settings.psr_version == DC_PSR_VERSION_1)
+		vsc_packet_revision = vsc_packet_rev2;
 
 	/* Update to revision 5 for extended colorimetry support */
 	if (stream->use_vsc_sdp_for_colorimetry)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
@@ -841,6 +841,8 @@
 				isPSRSUSupported = false;
 			else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x03)
 				isPSRSUSupported = false;
+			else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x01)
+				isPSRSUSupported = false;
 			else if (dpcd_caps->psr_info.force_psrsu_cap == 0x1)
 				isPSRSUSupported = true;
 		}
@@ -975,7 +977,7 @@
 
 void set_replay_coasting_vtotal(struct dc_link *link,
 	enum replay_coasting_vtotal_type type,
-	uint16_t vtotal)
+	uint32_t vtotal)
 {
 	link->replay_settings.coasting_vtotal_table[type] = vtotal;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/display/modules/power/power_helpers.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/display/modules/power/power_helpers.h
@@ -56,7 +56,7 @@
 void init_replay_config(struct dc_link *link, struct replay_config *pr_config);
 void set_replay_coasting_vtotal(struct dc_link *link,
 	enum replay_coasting_vtotal_type type,
-	uint16_t vtotal);
+	uint32_t vtotal);
 void set_replay_ips_full_screen_video_src_vtotal(struct dc_link *link, uint16_t vtotal);
 void calculate_replay_link_off_frame_count(struct dc_link *link,
 	uint16_t vtotal, uint16_t htotal);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_offset.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_offset.h
@@ -7571,6 +7571,8 @@
 // base address: 0x10100000
 #define regRCC_STRAP0_RCC_DEV0_EPF0_STRAP0                                                              0xd000
 #define regRCC_STRAP0_RCC_DEV0_EPF0_STRAP0_BASE_IDX                                                     5
+#define regRCC_DEV0_EPF5_STRAP4                                                                         0xd284
+#define regRCC_DEV0_EPF5_STRAP4_BASE_IDX                                                                5
 
 
 // addressBlock: nbio_nbif0_bif_rst_bif_rst_regblk
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_sh_mask.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_sh_mask.h
@@ -50665,6 +50665,19 @@
 #define RCC_STRAP0_RCC_DEV0_EPF0_STRAP0__STRAP_D1_SUPPORT_DEV0_F0_MASK                                        0x40000000L
 #define RCC_STRAP0_RCC_DEV0_EPF0_STRAP0__STRAP_D2_SUPPORT_DEV0_F0_MASK                                        0x80000000L
 
+//RCC_DEV0_EPF5_STRAP4
+#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_64BIT_EN_DEV0_F5__SHIFT                                            0x14
+#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_EN_DEV0_F5__SHIFT                                                  0x15
+#define RCC_DEV0_EPF5_STRAP4__STRAP_FLR_EN_DEV0_F5__SHIFT                                                     0x16
+#define RCC_DEV0_EPF5_STRAP4__STRAP_PME_SUPPORT_DEV0_F5__SHIFT                                                0x17
+#define RCC_DEV0_EPF5_STRAP4__STRAP_INTERRUPT_PIN_DEV0_F5__SHIFT                                              0x1c
+#define RCC_DEV0_EPF5_STRAP4__STRAP_AUXPWR_SUPPORT_DEV0_F5__SHIFT                                             0x1f
+#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_64BIT_EN_DEV0_F5_MASK                                              0x00100000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_EN_DEV0_F5_MASK                                                    0x00200000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_FLR_EN_DEV0_F5_MASK                                                       0x00400000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_PME_SUPPORT_DEV0_F5_MASK                                                  0x0F800000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_INTERRUPT_PIN_DEV0_F5_MASK                                                0x70000000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_AUXPWR_SUPPORT_DEV0_F5_MASK                                               0x80000000L
 
 // addressBlock: nbio_nbif0_bif_rst_bif_rst_regblk
 //HARD_RST_CTRL
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/include/atomfirmware.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/include/atomfirmware.h
@@ -702,7 +702,7 @@
 {
   struct  atom_common_table_header  table_header;
   /*the real number of this included in the structure is calcualted by using the (whole structure size - the header size)/size of atom_gpio_pin_lut  */
-  struct  atom_gpio_pin_assignment  gpio_pin[8];
+  struct  atom_gpio_pin_assignment  gpio_pin[];
 };
 
 
@@ -1006,7 +1006,7 @@
   uint16_t  supporteddevices;
   uint8_t   number_of_path;
   uint8_t   reserved;
-  struct    atom_display_object_path_v2 display_path[8];   //the real number of this included in the structure is calculated by using the (whole structure size - the header size- number_of_path)/size of atom_display_object_path
+  struct    atom_display_object_path_v2 display_path[];   //the real number of this included in the structure is calculated by using the (whole structure size - the header size- number_of_path)/size of atom_display_object_path
 };
 
 struct display_object_info_table_v1_5 {
@@ -1016,7 +1016,7 @@
 	uint8_t reserved;
 	// the real number of this included in the structure is calculated by using the
 	// (whole structure size - the header size- number_of_path)/size of atom_display_object_path
-	struct atom_display_object_path_v3 display_path[8];
+	struct atom_display_object_path_v3 display_path[];
 };
 
 /* 
@@ -1625,6 +1625,49 @@
 	uint32_t  reserved4[189];
 };
 
+struct uma_carveout_option {
+  char       optionName[29];        //max length of string is 28chars + '\0'. Current design is for "minimum", "Medium", "High". This makes entire struct size 64bits
+  uint8_t    memoryCarvedGb;        //memory carved out with setting
+  uint8_t    memoryRemainingGb;     //memory remaining on system
+  union {
+    struct _flags {
+      uint8_t Auto     : 1;
+      uint8_t Custom   : 1;
+      uint8_t Reserved : 6;
+    } flags;
+    uint8_t all8;
+  } uma_carveout_option_flags;
+};
+
+struct atom_integrated_system_info_v2_3 {
+  struct  atom_common_table_header table_header;
+  uint32_t  vbios_misc; // enum of atom_system_vbiosmisc_def
+  uint32_t  gpucapinfo; // enum of atom_system_gpucapinf_def
+  uint32_t  system_config;
+  uint32_t  cpucapinfo;
+  uint16_t  gpuclk_ss_percentage; // unit of 0.001%,   1000 mean 1%
+  uint16_t  gpuclk_ss_type;
+  uint16_t  dpphy_override;  // bit vector, enum of atom_sysinfo_dpphy_override_def
+  uint8_t memorytype;       // enum of atom_dmi_t17_mem_type_def, APU memory type indication.
+  uint8_t umachannelnumber; // number of memory channels
+  uint8_t htc_hyst_limit;
+  uint8_t htc_tmp_limit;
+  uint8_t reserved1; // dp_ss_control
+  uint8_t gpu_package_id;
+  struct  edp_info_table  edp1_info;
+  struct  edp_info_table  edp2_info;
+  uint32_t  reserved2[8];
+  struct  atom_external_display_connection_info extdispconninfo;
+  uint8_t UMACarveoutVersion;
+  uint8_t UMACarveoutIndexMax;
+  uint8_t UMACarveoutTypeDefault;
+  uint8_t UMACarveoutIndexDefault;
+  uint8_t UMACarveoutType;           //Auto or Custom
+  uint8_t UMACarveoutIndex;
+  struct  uma_carveout_option UMASizeControlOption[20];
+  uint8_t reserved3[110];
+};
+
 // system_config
 enum atom_system_vbiosmisc_def{
   INTEGRATED_SYSTEM_INFO__GET_EDID_CALLBACK_FUNC_SUPPORT = 0x01,
@@ -3508,7 +3551,7 @@
    uint8_t  phase_delay_us;                      // phase delay in unit of micro second
    uint8_t  reserved;   
    uint32_t gpio_mask_val;                         // GPIO Mask value
-   struct atom_voltage_gpio_map_lut voltage_gpio_lut[1];
+   struct atom_voltage_gpio_map_lut voltage_gpio_lut[] __counted_by(gpio_entry_num);
 };
 
 struct  atom_svid2_voltage_object_v4
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/include/pptable.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/include/pptable.h
@@ -477,31 +477,30 @@
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
-    //how many states we have 
-    UCHAR ucNumEntries;
-    
-    ATOM_PPLIB_STATE_V2 states[1];
+	//how many states we have
+	UCHAR ucNumEntries;
+
+	ATOM_PPLIB_STATE_V2 states[] /* __counted_by(ucNumEntries) */;
 }StateArray;
 
 
 typedef struct _ClockInfoArray{
-    //how many clock levels we have
-    UCHAR ucNumEntries;
-    
-    //sizeof(ATOM_PPLIB_CLOCK_INFO)
-    UCHAR ucEntrySize;
-    
-    UCHAR clockInfo[1];
+	//how many clock levels we have
+	UCHAR ucNumEntries;
+
+	//sizeof(ATOM_PPLIB_CLOCK_INFO)
+	UCHAR ucEntrySize;
+
+	UCHAR clockInfo[];
 }ClockInfoArray;
 
 typedef struct _NonClockInfoArray{
+	//how many non-clock levels we have. normally should be same as number of states
+	UCHAR ucNumEntries;
+	//sizeof(ATOM_PPLIB_NONCLOCK_INFO)
+	UCHAR ucEntrySize;
 
-    //how many non-clock levels we have. normally should be same as number of states
-    UCHAR ucNumEntries;
-    //sizeof(ATOM_PPLIB_NONCLOCK_INFO)
-    UCHAR ucEntrySize;
-    
-    ATOM_PPLIB_NONCLOCK_INFO nonClockInfo[1];
+	ATOM_PPLIB_NONCLOCK_INFO nonClockInfo[] __counted_by(ucNumEntries);
 }NonClockInfoArray;
 
 typedef struct _ATOM_PPLIB_Clock_Voltage_Dependency_Record
@@ -513,8 +512,10 @@
 
 typedef struct _ATOM_PPLIB_Clock_Voltage_Dependency_Table
 {
-    UCHAR ucNumEntries;                                                // Number of entries.
-    ATOM_PPLIB_Clock_Voltage_Dependency_Record entries[1];             // Dynamically allocate entries.
+	// Number of entries.
+	UCHAR ucNumEntries;
+	// Dynamically allocate entries.
+	ATOM_PPLIB_Clock_Voltage_Dependency_Record entries[] __counted_by(ucNumEntries);
 }ATOM_PPLIB_Clock_Voltage_Dependency_Table;
 
 typedef struct _ATOM_PPLIB_Clock_Voltage_Limit_Record
@@ -529,8 +530,10 @@
 
 typedef struct _ATOM_PPLIB_Clock_Voltage_Limit_Table
 {
-    UCHAR ucNumEntries;                                                // Number of entries.
-    ATOM_PPLIB_Clock_Voltage_Limit_Record entries[1];                  // Dynamically allocate entries.
+	// Number of entries.
+	UCHAR ucNumEntries;
+	// Dynamically allocate entries.
+	ATOM_PPLIB_Clock_Voltage_Limit_Record entries[] __counted_by(ucNumEntries);
 }ATOM_PPLIB_Clock_Voltage_Limit_Table;
 
 union _ATOM_PPLIB_CAC_Leakage_Record
@@ -553,8 +556,10 @@
 
 typedef struct _ATOM_PPLIB_CAC_Leakage_Table
 {
-    UCHAR ucNumEntries;                                                 // Number of entries.
-    ATOM_PPLIB_CAC_Leakage_Record entries[1];                           // Dynamically allocate entries.
+	// Number of entries.
+	UCHAR ucNumEntries;
+	// Dynamically allocate entries.
+	ATOM_PPLIB_CAC_Leakage_Record entries[] __counted_by(ucNumEntries);
 }ATOM_PPLIB_CAC_Leakage_Table;
 
 typedef struct _ATOM_PPLIB_PhaseSheddingLimits_Record
@@ -568,8 +573,10 @@
 
 typedef struct _ATOM_PPLIB_PhaseSheddingLimits_Table
 {
-    UCHAR ucNumEntries;                                                 // Number of entries.
-    ATOM_PPLIB_PhaseSheddingLimits_Record entries[1];                   // Dynamically allocate entries.
+	// Number of entries.
+	UCHAR ucNumEntries;
+	// Dynamically allocate entries.
+	ATOM_PPLIB_PhaseSheddingLimits_Record entries[] __counted_by(ucNumEntries);
 }ATOM_PPLIB_PhaseSheddingLimits_Table;
 
 typedef struct _VCEClockInfo{
@@ -580,8 +587,8 @@
 }VCEClockInfo;
 
 typedef struct _VCEClockInfoArray{
-    UCHAR ucNumEntries;
-    VCEClockInfo entries[1];
+	UCHAR ucNumEntries;
+	VCEClockInfo entries[] __counted_by(ucNumEntries);
 }VCEClockInfoArray;
 
 typedef struct _ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record
@@ -592,8 +599,8 @@
 
 typedef struct _ATOM_PPLIB_VCE_Clock_Voltage_Limit_Table
 {
-    UCHAR numEntries;
-    ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record entries[1];
+	UCHAR numEntries;
+	ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record entries[] __counted_by(numEntries);
 }ATOM_PPLIB_VCE_Clock_Voltage_Limit_Table;
 
 typedef struct _ATOM_PPLIB_VCE_State_Record
@@ -604,8 +611,8 @@
 
 typedef struct _ATOM_PPLIB_VCE_State_Table
 {
-    UCHAR numEntries;
-    ATOM_PPLIB_VCE_State_Record entries[1];
+	UCHAR numEntries;
+	ATOM_PPLIB_VCE_State_Record entries[] __counted_by(numEntries);
 }ATOM_PPLIB_VCE_State_Table;
 
 
@@ -626,8 +633,8 @@
 }UVDClockInfo;
 
 typedef struct _UVDClockInfoArray{
-    UCHAR ucNumEntries;
-    UVDClockInfo entries[1];
+	UCHAR ucNumEntries;
+	UVDClockInfo entries[] __counted_by(ucNumEntries);
 }UVDClockInfoArray;
 
 typedef struct _ATOM_PPLIB_UVD_Clock_Voltage_Limit_Record
@@ -638,8 +645,8 @@
 
 typedef struct _ATOM_PPLIB_UVD_Clock_Voltage_Limit_Table
 {
-    UCHAR numEntries;
-    ATOM_PPLIB_UVD_Clock_Voltage_Limit_Record entries[1];
+	UCHAR numEntries;
+	ATOM_PPLIB_UVD_Clock_Voltage_Limit_Record entries[] __counted_by(numEntries);
 }ATOM_PPLIB_UVD_Clock_Voltage_Limit_Table;
 
 typedef struct _ATOM_PPLIB_UVD_Table
@@ -657,8 +664,8 @@
 }ATOM_PPLIB_SAMClk_Voltage_Limit_Record;
 
 typedef struct _ATOM_PPLIB_SAMClk_Voltage_Limit_Table{
-    UCHAR numEntries;
-    ATOM_PPLIB_SAMClk_Voltage_Limit_Record entries[1];
+	UCHAR numEntries;
+	ATOM_PPLIB_SAMClk_Voltage_Limit_Record entries[] __counted_by(numEntries);
 }ATOM_PPLIB_SAMClk_Voltage_Limit_Table;
 
 typedef struct _ATOM_PPLIB_SAMU_Table
@@ -675,8 +682,8 @@
 }ATOM_PPLIB_ACPClk_Voltage_Limit_Record;
 
 typedef struct _ATOM_PPLIB_ACPClk_Voltage_Limit_Table{
-    UCHAR numEntries;
-    ATOM_PPLIB_ACPClk_Voltage_Limit_Record entries[1];
+	UCHAR numEntries;
+	ATOM_PPLIB_ACPClk_Voltage_Limit_Record entries[] __counted_by(numEntries);
 }ATOM_PPLIB_ACPClk_Voltage_Limit_Table;
 
 typedef struct _ATOM_PPLIB_ACP_Table
@@ -743,9 +750,9 @@
 } ATOM_PPLIB_VQ_Budgeting_Record;
 
 typedef struct ATOM_PPLIB_VQ_Budgeting_Table {
-    UCHAR revid;
-    UCHAR numEntries;
-    ATOM_PPLIB_VQ_Budgeting_Record         entries[1];
+	UCHAR revid;
+	UCHAR numEntries;
+	ATOM_PPLIB_VQ_Budgeting_Record entries[] __counted_by(numEntries);
 } ATOM_PPLIB_VQ_Budgeting_Table;
 
 #pragma pack()
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/amdgpu_pm.c
@@ -4217,6 +4217,13 @@
 		}
 	}
 
+	/*
+	 * If gpu_od is the only member in the list, that means gpu_od is an
+	 * empty directory, so remove it.
+	 */
+	if (list_is_singular(&adev->pm.od_kobj_list))
+		goto err_out;
+
 	return 0;
 
 err_out:
@@ -4244,8 +4251,8 @@
 	/* under multi-vf mode, the hwmon attributes are all not supported */
 	if (mode != SRIOV_VF_MODE_MULTI_VF) {
 		adev->pm.int_hwmon_dev = hwmon_device_register_with_groups(adev->dev,
-														DRIVER_NAME, adev,
-														hwmon_groups);
+									DRIVER_NAME, adev,
+									hwmon_groups);
 		if (IS_ERR(adev->pm.int_hwmon_dev)) {
 			ret = PTR_ERR(adev->pm.int_hwmon_dev);
 			dev_err(adev->dev, "Unable to register hwmon device: %d\n", ret);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
@@ -164,6 +164,8 @@
 
 	for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) {
 		if (table[i].ulSupportedSCLK != 0) {
+			if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES)
+				continue;
 			vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit =
 				table[i].usVoltageID;
 			vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit =
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
@@ -99,7 +99,7 @@
 	struct amdgpu_device *adev = hwmgr->adev;
 	struct amdgpu_dpm_thermal *range =
 				&adev->pm.dpm.thermal;
-	uint32_t gpu_temperature, size;
+	uint32_t gpu_temperature, size = sizeof(gpu_temperature);
 	int ret;
 
 	/*
@@ -927,7 +927,7 @@
 		enum PP_SMC_POWER_PROFILE type, bool en)
 {
 	struct pp_hwmgr *hwmgr = handle;
-	long workload;
+	long workload[1];
 	uint32_t index;
 
 	if (!hwmgr || !hwmgr->pm_en)
@@ -945,12 +945,12 @@
 		hwmgr->workload_mask &= ~(1 << hwmgr->workload_prority[type]);
 		index = fls(hwmgr->workload_mask);
 		index = index > 0 && index <= Workload_Policy_Max ? index - 1 : 0;
-		workload = hwmgr->workload_setting[index];
+		workload[0] = hwmgr->workload_setting[index];
 	} else {
 		hwmgr->workload_mask |= (1 << hwmgr->workload_prority[type]);
 		index = fls(hwmgr->workload_mask);
 		index = index <= Workload_Policy_Max ? index - 1 : 0;
-		workload = hwmgr->workload_setting[index];
+		workload[0] = hwmgr->workload_setting[index];
 	}
 
 	if (type == PP_SMC_POWER_PROFILE_COMPUTE &&
@@ -960,7 +960,7 @@
 	}
 
 	if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL)
-		hwmgr->hwmgr_func->set_power_profile_mode(hwmgr, &workload, 0);
+		hwmgr->hwmgr_func->set_power_profile_mode(hwmgr, workload, 0);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c
@@ -30,9 +30,8 @@
 {
 	int result;
 	unsigned int i;
-	unsigned int table_entries;
 	struct pp_power_state *state;
-	int size;
+	int size, table_entries;
 
 	if (hwmgr->hwmgr_func->get_num_of_pp_table_entries == NULL)
 		return 0;
@@ -40,15 +39,19 @@
 	if (hwmgr->hwmgr_func->get_power_state_size == NULL)
 		return 0;
 
-	hwmgr->num_ps = table_entries = hwmgr->hwmgr_func->get_num_of_pp_table_entries(hwmgr);
+	table_entries = hwmgr->hwmgr_func->get_num_of_pp_table_entries(hwmgr);
 
-	hwmgr->ps_size = size = hwmgr->hwmgr_func->get_power_state_size(hwmgr) +
+	size = hwmgr->hwmgr_func->get_power_state_size(hwmgr) +
 					  sizeof(struct pp_power_state);
 
-	if (table_entries == 0 || size == 0) {
+	if (table_entries <= 0 || size == 0) {
 		pr_warn("Please check whether power state management is supported on this asic\n");
+		hwmgr->num_ps = 0;
+		hwmgr->ps_size = 0;
 		return 0;
 	}
+	hwmgr->num_ps = table_entries;
+	hwmgr->ps_size = size;
 
 	hwmgr->ps = kcalloc(table_entries, size, GFP_KERNEL);
 	if (hwmgr->ps == NULL)
@@ -269,7 +272,7 @@
 						struct pp_power_state *new_ps)
 {
 	uint32_t index;
-	long workload;
+	long workload[1];
 
 	if (hwmgr->not_vf) {
 		if (!skip_display_settings)
@@ -294,10 +297,10 @@
 	if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL) {
 		index = fls(hwmgr->workload_mask);
 		index = index > 0 && index <= Workload_Policy_Max ? index - 1 : 0;
-		workload = hwmgr->workload_setting[index];
+		workload[0] = hwmgr->workload_setting[index];
 
-		if (hwmgr->power_profile_mode != workload && hwmgr->hwmgr_func->set_power_profile_mode)
-			hwmgr->hwmgr_func->set_power_profile_mode(hwmgr, &workload, 0);
+		if (hwmgr->power_profile_mode != workload[0] && hwmgr->hwmgr_func->set_power_profile_mode)
+			hwmgr->hwmgr_func->set_power_profile_mode(hwmgr, workload, 0);
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c
@@ -73,8 +73,9 @@
 					j++;
 				} else if ((table->mc_reg_address[i].uc_pre_reg_data &
 							LOW_NIBBLE_MASK) == DATA_EQU_PREV) {
-					table->mc_reg_table_entry[num_ranges].mc_data[i] =
-						table->mc_reg_table_entry[num_ranges].mc_data[i-1];
+					if (i)
+						table->mc_reg_table_entry[num_ranges].mc_data[i] =
+							table->mc_reg_table_entry[num_ranges].mc_data[i-1];
 				}
 			}
 			num_ranges++;
@@ -226,7 +227,7 @@
 
 	return amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, DynamicMemorySettings),
-			(uint32_t *)&engine_clock_parameters);
+			(uint32_t *)&engine_clock_parameters, sizeof(engine_clock_parameters));
 }
 
 /*
@@ -297,7 +298,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 		 GetIndexIntoMasterTable(COMMAND, ComputeMemoryClockParam),
-		(uint32_t *)&mpll_parameters);
+		(uint32_t *)&mpll_parameters, sizeof(mpll_parameters));
 
 	if (0 == result) {
 		mpll_param->mpll_fb_divider.clk_frac =
@@ -345,7 +346,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ComputeMemoryClockParam),
-			(uint32_t *)&mpll_parameters);
+			(uint32_t *)&mpll_parameters, sizeof(mpll_parameters));
 
 	if (!result)
 		mpll_param->mpll_post_divider =
@@ -366,7 +367,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ComputeMemoryClockParam),
-			(uint32_t *)&mpll_parameters);
+			(uint32_t *)&mpll_parameters, sizeof(mpll_parameters));
 
 	/* VEGAM's mpll takes sometime to finish computing */
 	udelay(10);
@@ -396,7 +397,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 		 GetIndexIntoMasterTable(COMMAND, ComputeMemoryEnginePLL),
-		(uint32_t *)&pll_parameters);
+		(uint32_t *)&pll_parameters, sizeof(pll_parameters));
 
 	if (0 == result) {
 		dividers->pll_post_divider = pll_parameters.ucPostDiv;
@@ -420,7 +421,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 		 GetIndexIntoMasterTable(COMMAND, ComputeMemoryEnginePLL),
-		(uint32_t *)&pll_patameters);
+		(uint32_t *)&pll_patameters, sizeof(pll_patameters));
 
 	if (0 == result) {
 		dividers->pll_post_divider =
@@ -457,7 +458,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 		 GetIndexIntoMasterTable(COMMAND, ComputeMemoryEnginePLL),
-		(uint32_t *)&pll_patameters);
+		(uint32_t *)&pll_patameters, sizeof(pll_patameters));
 
 	if (0 == result) {
 		dividers->usSclk_fcw_frac     = le16_to_cpu(pll_patameters.usSclk_fcw_frac);
@@ -490,7 +491,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 		 GetIndexIntoMasterTable(COMMAND, ComputeMemoryEnginePLL),
-		(uint32_t *)&pll_patameters);
+		(uint32_t *)&pll_patameters, sizeof(pll_patameters));
 
 	if (0 == result) {
 		dividers->pll_post_divider =
@@ -773,7 +774,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ReadEfuseValue),
-			(uint32_t *)&sOutput_FuseValues);
+			(uint32_t *)&sOutput_FuseValues, sizeof(sOutput_FuseValues));
 
 	if (result)
 		return result;
@@ -794,7 +795,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ReadEfuseValue),
-			(uint32_t *)&sOutput_FuseValues);
+			(uint32_t *)&sOutput_FuseValues, sizeof(sOutput_FuseValues));
 
 	if (result)
 		return result;
@@ -814,7 +815,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ReadEfuseValue),
-			(uint32_t *)&sOutput_FuseValues);
+			(uint32_t *)&sOutput_FuseValues, sizeof(sOutput_FuseValues));
 
 	if (result)
 		return result;
@@ -835,7 +836,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ReadEfuseValue),
-			(uint32_t *)&sOutput_FuseValues);
+			(uint32_t *)&sOutput_FuseValues, sizeof(sOutput_FuseValues));
 
 	if (result)
 		return result;
@@ -857,7 +858,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ReadEfuseValue),
-			(uint32_t *)&sOutput_FuseValues);
+			(uint32_t *)&sOutput_FuseValues, sizeof(sOutput_FuseValues));
 	if (result)
 		return result;
 
@@ -878,7 +879,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ReadEfuseValue),
-			(uint32_t *)&sOutput_FuseValues);
+			(uint32_t *)&sOutput_FuseValues, sizeof(sOutput_FuseValues));
 
 	if (result)
 		return result;
@@ -909,7 +910,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ReadEfuseValue),
-			(uint32_t *)&sOutput_FuseValues);
+			(uint32_t *)&sOutput_FuseValues, sizeof(sOutput_FuseValues));
 
 	if (result)
 		return result;
@@ -1134,7 +1135,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, GetVoltageInfo),
-			(uint32_t *)&get_voltage_info_param_space);
+			(uint32_t *)&get_voltage_info_param_space, sizeof(get_voltage_info_param_space));
 
 	*voltage = result ? 0 :
 			le16_to_cpu(((GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_2 *)
@@ -1179,7 +1180,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, GetVoltageInfo),
-			(uint32_t *)&get_voltage_info_param_space);
+			(uint32_t *)&get_voltage_info_param_space, sizeof(get_voltage_info_param_space));
 
 	if (0 != result)
 		return result;
@@ -1359,7 +1360,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, ReadEfuseValue),
-			(uint32_t *)&efuse_param);
+			(uint32_t *)&efuse_param, sizeof(efuse_param));
 	*efuse = result ? 0 : le32_to_cpu(efuse_param.ulEfuseValue) & mask;
 
 	return result;
@@ -1380,7 +1381,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 		 GetIndexIntoMasterTable(COMMAND, DynamicMemorySettings),
-		(uint32_t *)&memory_clock_parameters);
+		(uint32_t *)&memory_clock_parameters, sizeof(memory_clock_parameters));
 
 	return result;
 }
@@ -1399,7 +1400,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, GetVoltageInfo),
-			(uint32_t *)&get_voltage_info_param_space);
+			(uint32_t *)&get_voltage_info_param_space, sizeof(get_voltage_info_param_space));
 
 	*voltage = result ? 0 :
 		le32_to_cpu(((GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_3 *)(&get_voltage_info_param_space))->ulVoltageLevel);
@@ -1526,7 +1527,7 @@
 
 	result = amdgpu_atom_execute_table(adev->mode_info.atom_context,
 			GetIndexIntoMasterTable(COMMAND, SetVoltage),
-			(uint32_t *)voltage_parameters);
+			(uint32_t *)voltage_parameters, sizeof(*voltage_parameters));
 
 	*virtual_voltage_id = voltage_parameters->usVoltageLevel;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomfwctrl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomfwctrl.c
@@ -258,7 +258,7 @@
 	idx = GetIndexIntoMasterCmdTable(computegpuclockparam);
 
 	if (amdgpu_atom_execute_table(
-		adev->mode_info.atom_context, idx, (uint32_t *)&pll_parameters))
+		adev->mode_info.atom_context, idx, (uint32_t *)&pll_parameters, sizeof(pll_parameters)))
 		return -EINVAL;
 
 	pll_output = (struct compute_gpu_clock_output_parameter_v1_8 *)
@@ -505,7 +505,7 @@
 	ix = GetIndexIntoMasterCmdTable(getsmuclockinfo);
 
 	if (amdgpu_atom_execute_table(
-		adev->mode_info.atom_context, ix, (uint32_t *)&parameters))
+		adev->mode_info.atom_context, ix, (uint32_t *)&parameters, sizeof(parameters)))
 		return -EINVAL;
 
 	output = (struct atom_get_smu_clock_info_output_parameters_v3_1 *)&parameters;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c
@@ -1185,6 +1185,8 @@
 	fw_info = smu_atom_get_data_table(hwmgr->adev,
 			 GetIndexIntoMasterTable(DATA, FirmwareInfo),
 			 &size, &frev, &crev);
+	PP_ASSERT_WITH_CODE(fw_info != NULL,
+			    "Missing firmware info!", return -EINVAL);
 
 	if ((fw_info->ucTableFormatRevision == 1)
 	    && (le16_to_cpu(fw_info->usStructureSize) >= sizeof(ATOM_FIRMWARE_INFO_V1_4)))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c
@@ -1036,7 +1036,9 @@
 
 	switch (type) {
 	case PP_SCLK:
-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetGfxclkFrequency, &now);
+		ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetGfxclkFrequency, &now);
+		if (ret)
+			return ret;
 
 	/* driver only know min/max gfx_clk, Add level 1 for all other gfx clks */
 		if (now == data->gfx_max_freq_limit/100)
@@ -1057,7 +1059,9 @@
 					i == 2 ? "*" : "");
 		break;
 	case PP_MCLK:
-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetFclkFrequency, &now);
+		ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetFclkFrequency, &now);
+		if (ret)
+			return ret;
 
 		for (i = 0; i < mclk_table->count; i++)
 			size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -1550,7 +1554,10 @@
 		}
 
 		if (input[0] == 0) {
-			smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq);
+			ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq);
+			if (ret)
+				return ret;
+
 			if (input[1] < min_freq) {
 				pr_err("Fine grain setting minimum sclk (%ld) MHz is less than the minimum allowed (%d) MHz\n",
 					input[1], min_freq);
@@ -1558,7 +1565,10 @@
 			}
 			smu10_data->gfx_actual_soft_min_freq = input[1];
 		} else if (input[0] == 1) {
-			smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq);
+			ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq);
+			if (ret)
+				return ret;
+
 			if (input[1] > max_freq) {
 				pr_err("Fine grain setting maximum sclk (%ld) MHz is greater than the maximum allowed (%d) MHz\n",
 					input[1], max_freq);
@@ -1573,10 +1583,15 @@
 			pr_err("Input parameter number not correct\n");
 			return -EINVAL;
 		}
-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq);
-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq);
-
+		ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq);
+		if (ret)
+			return ret;
 		smu10_data->gfx_actual_soft_min_freq = min_freq;
+
+		ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq);
+		if (ret)
+			return ret;
+
 		smu10_data->gfx_actual_soft_max_freq = max_freq;
 	} else if (type == PP_OD_COMMIT_DPM_TABLE) {
 		if (size != 0) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
@@ -2957,6 +2957,7 @@
 
 static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
 {
+	struct amdgpu_device *adev = hwmgr->adev;
 	struct smu7_hwmgr *data;
 	int result = 0;
 
@@ -2993,40 +2994,37 @@
 	/* Initalize Dynamic State Adjustment Rule Settings */
 	result = phm_initializa_dynamic_state_adjustment_rule_settings(hwmgr);
 
-	if (0 == result) {
-		struct amdgpu_device *adev = hwmgr->adev;
+	if (result)
+		goto fail;
 
-		data->is_tlu_enabled = false;
+	data->is_tlu_enabled = false;
 
-		hwmgr->platform_descriptor.hardwareActivityPerformanceLevels =
+	hwmgr->platform_descriptor.hardwareActivityPerformanceLevels =
 							SMU7_MAX_HARDWARE_POWERLEVELS;
-		hwmgr->platform_descriptor.hardwarePerformanceLevels = 2;
-		hwmgr->platform_descriptor.minimumClocksReductionPercentage = 50;
+	hwmgr->platform_descriptor.hardwarePerformanceLevels = 2;
+	hwmgr->platform_descriptor.minimumClocksReductionPercentage = 50;
 
-		data->pcie_gen_cap = adev->pm.pcie_gen_mask;
-		if (data->pcie_gen_cap & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
-			data->pcie_spc_cap = 20;
-		else
-			data->pcie_spc_cap = 16;
-		data->pcie_lane_cap = adev->pm.pcie_mlw_mask;
+	data->pcie_gen_cap = adev->pm.pcie_gen_mask;
+	if (data->pcie_gen_cap & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
+		data->pcie_spc_cap = 20;
+	else
+		data->pcie_spc_cap = 16;
+	data->pcie_lane_cap = adev->pm.pcie_mlw_mask;
 
-		hwmgr->platform_descriptor.vbiosInterruptId = 0x20000400; /* IRQ_SOURCE1_SW_INT */
-/* The true clock step depends on the frequency, typically 4.5 or 9 MHz. Here we use 5. */
-		hwmgr->platform_descriptor.clockStep.engineClock = 500;
-		hwmgr->platform_descriptor.clockStep.memoryClock = 500;
-		smu7_thermal_parameter_init(hwmgr);
-	} else {
-		/* Ignore return value in here, we are cleaning up a mess. */
-		smu7_hwmgr_backend_fini(hwmgr);
-	}
+	hwmgr->platform_descriptor.vbiosInterruptId = 0x20000400; /* IRQ_SOURCE1_SW_INT */
+	/* The true clock step depends on the frequency, typically 4.5 or 9 MHz. Here we use 5. */
+	hwmgr->platform_descriptor.clockStep.engineClock = 500;
+	hwmgr->platform_descriptor.clockStep.memoryClock = 500;
+	smu7_thermal_parameter_init(hwmgr);
 
 	result = smu7_update_edc_leakage_table(hwmgr);
-	if (result) {
-		smu7_hwmgr_backend_fini(hwmgr);
-		return result;
-	}
+	if (result)
+		goto fail;
 
 	return 0;
+fail:
+	smu7_hwmgr_backend_fini(hwmgr);
+	return result;
 }
 
 static int smu7_force_dpm_highest(struct pp_hwmgr *hwmgr)
@@ -3316,8 +3314,7 @@
 			const struct pp_power_state *current_ps)
 {
 	struct amdgpu_device *adev = hwmgr->adev;
-	struct smu7_power_state *smu7_ps =
-				cast_phw_smu7_power_state(&request_ps->hardware);
+	struct smu7_power_state *smu7_ps;
 	uint32_t sclk;
 	uint32_t mclk;
 	struct PP_Clocks minimum_clocks = {0};
@@ -3334,6 +3331,10 @@
 	uint32_t latency;
 	bool latency_allowed = false;
 
+	smu7_ps = cast_phw_smu7_power_state(&request_ps->hardware);
+	if (!smu7_ps)
+		return -EINVAL;
+
 	data->battery_state = (PP_StateUILabel_Battery ==
 			request_ps->classification.ui_label);
 	data->mclk_ignore_signal = false;
@@ -5640,7 +5641,7 @@
 	mode = input[size];
 	switch (mode) {
 	case PP_SMC_POWER_PROFILE_CUSTOM:
-		if (size < 8 && size != 0)
+		if (size != 8 && size != 0)
 			return -EINVAL;
 		/* If only CUSTOM is passed in, use the saved values. Check
 		 * that we actually have a CUSTOM profile by ensuring that
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c
@@ -584,6 +584,7 @@
 				hwmgr->dyn_state.uvd_clock_voltage_dependency_table;
 	unsigned long clock = 0;
 	uint32_t level;
+	int ret;
 
 	if (NULL == table || table->count <= 0)
 		return -EINVAL;
@@ -591,7 +592,9 @@
 	data->uvd_dpm.soft_min_clk = 0;
 	data->uvd_dpm.hard_min_clk = 0;
 
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxUvdLevel, &level);
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxUvdLevel, &level);
+	if (ret)
+		return ret;
 
 	if (level < table->count)
 		clock = table->entries[level].vclk;
@@ -611,6 +614,7 @@
 				hwmgr->dyn_state.vce_clock_voltage_dependency_table;
 	unsigned long clock = 0;
 	uint32_t level;
+	int ret;
 
 	if (NULL == table || table->count <= 0)
 		return -EINVAL;
@@ -618,7 +622,9 @@
 	data->vce_dpm.soft_min_clk = 0;
 	data->vce_dpm.hard_min_clk = 0;
 
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxEclkLevel, &level);
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxEclkLevel, &level);
+	if (ret)
+		return ret;
 
 	if (level < table->count)
 		clock = table->entries[level].ecclk;
@@ -638,6 +644,7 @@
 				hwmgr->dyn_state.acp_clock_voltage_dependency_table;
 	unsigned long clock = 0;
 	uint32_t level;
+	int ret;
 
 	if (NULL == table || table->count <= 0)
 		return -EINVAL;
@@ -645,7 +652,9 @@
 	data->acp_dpm.soft_min_clk = 0;
 	data->acp_dpm.hard_min_clk = 0;
 
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxAclkLevel, &level);
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetMaxAclkLevel, &level);
+	if (ret)
+		return ret;
 
 	if (level < table->count)
 		clock = table->entries[level].acpclk;
@@ -1065,16 +1074,18 @@
 				struct pp_power_state  *prequest_ps,
 			const struct pp_power_state *pcurrent_ps)
 {
-	struct smu8_power_state *smu8_ps =
-				cast_smu8_power_state(&prequest_ps->hardware);
-
-	const struct smu8_power_state *smu8_current_ps =
-				cast_const_smu8_power_state(&pcurrent_ps->hardware);
-
+	struct smu8_power_state *smu8_ps;
+	const struct smu8_power_state *smu8_current_ps;
 	struct smu8_hwmgr *data = hwmgr->backend;
 	struct PP_Clocks clocks = {0, 0, 0, 0};
 	bool force_high;
 
+	smu8_ps = cast_smu8_power_state(&prequest_ps->hardware);
+	smu8_current_ps = cast_const_smu8_power_state(&pcurrent_ps->hardware);
+
+	if (!smu8_ps || !smu8_current_ps)
+		return -EINVAL;
+
 	smu8_ps->need_dfs_bypass = true;
 
 	data->battery_state = (PP_StateUILabel_Battery == prequest_ps->classification.ui_label);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
@@ -354,13 +354,13 @@
 	return 0;
 }
 
-static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr)
+static int vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr)
 {
 	struct vega10_hwmgr *data = hwmgr->backend;
-	int i;
 	uint32_t sub_vendor_id, hw_revision;
 	uint32_t top32, bottom32;
 	struct amdgpu_device *adev = hwmgr->adev;
+	int ret, i;
 
 	vega10_initialize_power_tune_defaults(hwmgr);
 
@@ -485,9 +485,12 @@
 	if (data->registry_data.vr0hot_enabled)
 		data->smu_features[GNLD_VR0HOT].supported = true;
 
-	smum_send_msg_to_smc(hwmgr,
+	ret = smum_send_msg_to_smc(hwmgr,
 			PPSMC_MSG_GetSmuVersion,
 			&hwmgr->smu_version);
+	if (ret)
+		return ret;
+
 		/* ACG firmware has major version 5 */
 	if ((hwmgr->smu_version & 0xff000000) == 0x5000000)
 		data->smu_features[GNLD_ACG].supported = true;
@@ -505,10 +508,16 @@
 		data->smu_features[GNLD_PCC_LIMIT].supported = true;
 
 	/* Get the SN to turn into a Unique ID */
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32);
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32);
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32);
+	if (ret)
+		return ret;
+
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32);
+	if (ret)
+		return ret;
 
 	adev->unique_id = ((uint64_t)bottom32 << 32) | top32;
+	return 0;
 }
 
 #ifdef PPLIB_VEGA10_EVV_SUPPORT
@@ -882,7 +891,9 @@
 
 	vega10_set_features_platform_caps(hwmgr);
 
-	vega10_init_dpm_defaults(hwmgr);
+	result = vega10_init_dpm_defaults(hwmgr);
+	if (result)
+		return result;
 
 #ifdef PPLIB_VEGA10_EVV_SUPPORT
 	/* Get leakage voltage based on leakage ID. */
@@ -2350,15 +2361,20 @@
 {
 	struct vega10_hwmgr *data = hwmgr->backend;
 	uint32_t agc_btc_response;
+	int ret;
 
 	if (data->smu_features[GNLD_ACG].supported) {
 		if (0 == vega10_enable_smc_features(hwmgr, true,
 					data->smu_features[GNLD_DPM_PREFETCHER].smu_feature_bitmap))
 			data->smu_features[GNLD_DPM_PREFETCHER].enabled = true;
 
-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_InitializeAcg, NULL);
+		ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_InitializeAcg, NULL);
+		if (ret)
+			return ret;
 
-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_RunAcgBtc, &agc_btc_response);
+		ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_RunAcgBtc, &agc_btc_response);
+		if (ret)
+			agc_btc_response = 0;
 
 		if (1 == agc_btc_response) {
 			if (1 == data->acg_loop_state)
@@ -2571,8 +2587,11 @@
 		}
 	}
 
-	pp_atomfwctrl_get_voltage_table_v4(hwmgr, VOLTAGE_TYPE_VDDC,
+	result = pp_atomfwctrl_get_voltage_table_v4(hwmgr, VOLTAGE_TYPE_VDDC,
 			VOLTAGE_OBJ_SVID2,  &voltage_table);
+	PP_ASSERT_WITH_CODE(!result,
+			"Failed to get voltage table!",
+			return result);
 	pp_table->MaxVidStep = voltage_table.max_vid_step;
 
 	pp_table->GfxDpmVoltageMode =
@@ -3259,8 +3278,7 @@
 			const struct pp_power_state *current_ps)
 {
 	struct amdgpu_device *adev = hwmgr->adev;
-	struct vega10_power_state *vega10_ps =
-				cast_phw_vega10_power_state(&request_ps->hardware);
+	struct vega10_power_state *vega10_ps;
 	uint32_t sclk;
 	uint32_t mclk;
 	struct PP_Clocks minimum_clocks = {0};
@@ -3278,6 +3296,10 @@
 	uint32_t stable_pstate_sclk = 0, stable_pstate_mclk = 0;
 	uint32_t latency;
 
+	vega10_ps = cast_phw_vega10_power_state(&request_ps->hardware);
+	if (!vega10_ps)
+		return -EINVAL;
+
 	data->battery_state = (PP_StateUILabel_Battery ==
 			request_ps->classification.ui_label);
 
@@ -3415,13 +3437,17 @@
 	const struct vega10_power_state *vega10_ps =
 			cast_const_phw_vega10_power_state(states->pnew_state);
 	struct vega10_single_dpm_table *sclk_table = &(data->dpm_table.gfx_table);
-	uint32_t sclk = vega10_ps->performance_levels
-			[vega10_ps->performance_level_count - 1].gfx_clock;
 	struct vega10_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
-	uint32_t mclk = vega10_ps->performance_levels
-			[vega10_ps->performance_level_count - 1].mem_clock;
+	uint32_t sclk, mclk;
 	uint32_t i;
 
+	if (vega10_ps == NULL)
+		return -EINVAL;
+	sclk = vega10_ps->performance_levels
+			[vega10_ps->performance_level_count - 1].gfx_clock;
+	mclk = vega10_ps->performance_levels
+			[vega10_ps->performance_level_count - 1].mem_clock;
+
 	for (i = 0; i < sclk_table->count; i++) {
 		if (sclk == sclk_table->dpm_levels[i].value)
 			break;
@@ -3728,6 +3754,9 @@
 			cast_const_phw_vega10_power_state(states->pnew_state);
 	int i;
 
+	if (vega10_ps == NULL)
+		return -EINVAL;
+
 	PP_ASSERT_WITH_CODE(!vega10_trim_dpm_states(hwmgr, vega10_ps),
 			"Attempt to Trim DPM States Failed!",
 			return -1);
@@ -3900,11 +3929,14 @@
 		uint32_t *query)
 {
 	uint32_t value;
+	int ret;
 
 	if (!query)
 		return -EINVAL;
 
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrPkgPwr, &value);
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrPkgPwr, &value);
+	if (ret)
+		return ret;
 
 	/* SMC returning actual watts, keep consistent with legacy asics, low 8 bit as 8 fractional bits */
 	*query = value << 8;
@@ -4800,14 +4832,16 @@
 	uint32_t gen_speed, lane_width, current_gen_speed, current_lane_width;
 	PPTable_t *pptable = &(data->smc_state_table.pp_table);
 
-	int i, now, size = 0, count = 0;
+	int i, ret, now,  size = 0, count = 0;
 
 	switch (type) {
 	case PP_SCLK:
 		if (data->registry_data.sclk_dpm_key_disabled)
 			break;
 
-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentGfxclkIndex, &now);
+		ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentGfxclkIndex, &now);
+		if (ret)
+			break;
 
 		if (hwmgr->pp_one_vf &&
 		    (hwmgr->dpm_level == AMD_DPM_FORCED_LEVEL_PROFILE_PEAK))
@@ -4823,7 +4857,9 @@
 		if (data->registry_data.mclk_dpm_key_disabled)
 			break;
 
-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentUclkIndex, &now);
+		ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentUclkIndex, &now);
+		if (ret)
+			break;
 
 		for (i = 0; i < mclk_table->count; i++)
 			size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -4834,7 +4870,9 @@
 		if (data->registry_data.socclk_dpm_key_disabled)
 			break;
 
-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentSocclkIndex, &now);
+		ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentSocclkIndex, &now);
+		if (ret)
+			break;
 
 		for (i = 0; i < soc_table->count; i++)
 			size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -4845,8 +4883,10 @@
 		if (data->registry_data.dcefclk_dpm_key_disabled)
 			break;
 
-		smum_send_msg_to_smc_with_parameter(hwmgr,
+		ret = smum_send_msg_to_smc_with_parameter(hwmgr,
 				PPSMC_MSG_GetClockFreqMHz, CLK_DCEFCLK, &now);
+		if (ret)
+			break;
 
 		for (i = 0; i < dcef_table->count; i++)
 			size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -4995,6 +5035,8 @@
 
 	vega10_psa = cast_const_phw_vega10_power_state(pstate1);
 	vega10_psb = cast_const_phw_vega10_power_state(pstate2);
+	if (vega10_psa == NULL || vega10_psb == NULL)
+		return -EINVAL;
 
 	/* If the two states don't even have the same number of performance levels
 	 * they cannot be the same state.
@@ -5128,6 +5170,8 @@
 		return -EINVAL;
 
 	vega10_ps = cast_phw_vega10_power_state(&ps->hardware);
+	if (vega10_ps == NULL)
+		return -EINVAL;
 
 	vega10_ps->performance_levels
 	[vega10_ps->performance_level_count - 1].gfx_clock =
@@ -5179,6 +5223,8 @@
 		return -EINVAL;
 
 	vega10_ps = cast_phw_vega10_power_state(&ps->hardware);
+	if (vega10_ps == NULL)
+		return -EINVAL;
 
 	vega10_ps->performance_levels
 	[vega10_ps->performance_level_count - 1].mem_clock =
@@ -5420,6 +5466,9 @@
 		return;
 
 	vega10_ps = cast_phw_vega10_power_state(&ps->hardware);
+	if (vega10_ps == NULL)
+		return;
+
 	max_level = vega10_ps->performance_level_count - 1;
 
 	if (vega10_ps->performance_levels[max_level].gfx_clock !=
@@ -5442,6 +5491,9 @@
 
 	ps = (struct pp_power_state *)((unsigned long)(hwmgr->ps) + hwmgr->ps_size * (hwmgr->num_ps - 1));
 	vega10_ps = cast_phw_vega10_power_state(&ps->hardware);
+	if (vega10_ps == NULL)
+		return;
+
 	max_level = vega10_ps->performance_level_count - 1;
 
 	if (vega10_ps->performance_levels[max_level].gfx_clock !=
@@ -5632,6 +5684,8 @@
 		return -EINVAL;
 
 	vega10_ps = cast_const_phw_vega10_power_state(state);
+	if (vega10_ps == NULL)
+		return -EINVAL;
 
 	i = index > vega10_ps->performance_level_count - 1 ?
 			vega10_ps->performance_level_count - 1 : index;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c
@@ -293,12 +293,12 @@
 	return 0;
 }
 
-static void vega12_init_dpm_defaults(struct pp_hwmgr *hwmgr)
+static int vega12_init_dpm_defaults(struct pp_hwmgr *hwmgr)
 {
 	struct vega12_hwmgr *data = (struct vega12_hwmgr *)(hwmgr->backend);
 	struct amdgpu_device *adev = hwmgr->adev;
 	uint32_t top32, bottom32;
-	int i;
+	int i, ret;
 
 	data->smu_features[GNLD_DPM_PREFETCHER].smu_feature_id =
 			FEATURE_DPM_PREFETCHER_BIT;
@@ -364,10 +364,16 @@
 	}
 
 	/* Get the SN to turn into a Unique ID */
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32);
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32);
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32);
+	if (ret)
+		return ret;
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32);
+	if (ret)
+		return ret;
 
 	adev->unique_id = ((uint64_t)bottom32 << 32) | top32;
+
+	return 0;
 }
 
 static int vega12_set_private_data_based_on_pptable(struct pp_hwmgr *hwmgr)
@@ -410,7 +416,11 @@
 
 	vega12_set_features_platform_caps(hwmgr);
 
-	vega12_init_dpm_defaults(hwmgr);
+	result = vega12_init_dpm_defaults(hwmgr);
+	if (result) {
+		pr_err("%s failed\n", __func__);
+		return result;
+	}
 
 	/* Parse pptable data read from VBIOS */
 	vega12_set_private_data_based_on_pptable(hwmgr);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
@@ -328,12 +328,12 @@
 	return 0;
 }
 
-static void vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr)
+static int vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr)
 {
 	struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend);
 	struct amdgpu_device *adev = hwmgr->adev;
 	uint32_t top32, bottom32;
-	int i;
+	int i, ret;
 
 	data->smu_features[GNLD_DPM_PREFETCHER].smu_feature_id =
 			FEATURE_DPM_PREFETCHER_BIT;
@@ -404,10 +404,17 @@
 	}
 
 	/* Get the SN to turn into a Unique ID */
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32);
-	smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32);
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32);
+	if (ret)
+		return ret;
+
+	ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32);
+	if (ret)
+		return ret;
 
 	adev->unique_id = ((uint64_t)bottom32 << 32) | top32;
+
+	return 0;
 }
 
 static int vega20_set_private_data_based_on_pptable(struct pp_hwmgr *hwmgr)
@@ -427,6 +434,7 @@
 {
 	struct vega20_hwmgr *data;
 	struct amdgpu_device *adev = hwmgr->adev;
+	int result;
 
 	data = kzalloc(sizeof(struct vega20_hwmgr), GFP_KERNEL);
 	if (data == NULL)
@@ -452,8 +460,11 @@
 
 	vega20_set_features_platform_caps(hwmgr);
 
-	vega20_init_dpm_defaults(hwmgr);
-
+	result = vega20_init_dpm_defaults(hwmgr);
+	if (result) {
+		pr_err("%s failed\n", __func__);
+		return result;
+	}
 	/* Parse pptable data read from VBIOS */
 	vega20_set_private_data_based_on_pptable(hwmgr);
 
@@ -4091,9 +4102,11 @@
 	if (power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) {
 		struct vega20_hwmgr *data =
 			(struct vega20_hwmgr *)(hwmgr->backend);
-		if (size == 0 && !data->is_custom_profile_set)
+
+		if (size != 10 && size != 0)
 			return -EINVAL;
-		if (size < 10 && size != 0)
+
+		if (size == 0 && !data->is_custom_profile_set)
 			return -EINVAL;
 
 		result = vega20_get_activity_monitor_coeff(hwmgr,
@@ -4155,6 +4168,8 @@
 			activity_monitor.Fclk_PD_Data_error_coeff = input[8];
 			activity_monitor.Fclk_PD_Data_error_rate_coeff = input[9];
 			break;
+		default:
+			return -EINVAL;
 		}
 
 		result = vega20_set_activity_monitor_coeff(hwmgr,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/powerplay/smumgr/vega10_smumgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/powerplay/smumgr/vega10_smumgr.c
@@ -130,13 +130,17 @@
 			    uint64_t *features_enabled)
 {
 	uint32_t enabled_features;
+	int ret;
 
 	if (features_enabled == NULL)
 		return -EINVAL;
 
-	smum_send_msg_to_smc(hwmgr,
+	ret = smum_send_msg_to_smc(hwmgr,
 			PPSMC_MSG_GetEnabledSmuFeatures,
 			&enabled_features);
+	if (ret)
+		return ret;
+
 	*features_enabled = enabled_features;
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -734,7 +734,7 @@
 	smu->adev = adev;
 	smu->pm_enabled = !!amdgpu_dpm;
 	smu->is_apu = false;
-	smu->smu_baco.state = SMU_BACO_STATE_EXIT;
+	smu->smu_baco.state = SMU_BACO_STATE_NONE;
 	smu->smu_baco.platform_support = false;
 	smu->user_dpm_profile.fan_mode = -1;
 
@@ -1192,6 +1192,14 @@
 		smu->plpd_mode = XGMI_PLPD_NONE;
 }
 
+static bool smu_is_workload_profile_available(struct smu_context *smu,
+					      u32 profile)
+{
+	if (profile >= PP_SMC_POWER_PROFILE_COUNT)
+		return false;
+	return smu->workload_map && smu->workload_map[profile].valid_mapping;
+}
+
 static int smu_sw_init(void *handle)
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
@@ -1215,7 +1223,6 @@
 	atomic_set(&smu->smu_power.power_gate.vpe_gated, 1);
 	atomic_set(&smu->smu_power.power_gate.umsch_mm_gated, 1);
 
-	smu->workload_mask = 1 << smu->workload_prority[PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT];
 	smu->workload_prority[PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT] = 0;
 	smu->workload_prority[PP_SMC_POWER_PROFILE_FULLSCREEN3D] = 1;
 	smu->workload_prority[PP_SMC_POWER_PROFILE_POWERSAVING] = 2;
@@ -1224,6 +1231,12 @@
 	smu->workload_prority[PP_SMC_POWER_PROFILE_COMPUTE] = 5;
 	smu->workload_prority[PP_SMC_POWER_PROFILE_CUSTOM] = 6;
 
+	if (smu->is_apu ||
+	    !smu_is_workload_profile_available(smu, PP_SMC_POWER_PROFILE_FULLSCREEN3D))
+		smu->workload_mask = 1 << smu->workload_prority[PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT];
+	else
+		smu->workload_mask = 1 << smu->workload_prority[PP_SMC_POWER_PROFILE_FULLSCREEN3D];
+
 	smu->workload_setting[0] = PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT;
 	smu->workload_setting[1] = PP_SMC_POWER_PROFILE_FULLSCREEN3D;
 	smu->workload_setting[2] = PP_SMC_POWER_PROFILE_POWERSAVING;
@@ -1954,10 +1967,25 @@
 	return 0;
 }
 
+static int smu_reset_mp1_state(struct smu_context *smu)
+{
+	struct amdgpu_device *adev = smu->adev;
+	int ret = 0;
+
+	if ((!adev->in_runpm) && (!adev->in_suspend) &&
+		(!amdgpu_in_reset(adev)) && amdgpu_ip_version(adev, MP1_HWIP, 0) ==
+									IP_VERSION(13, 0, 10) &&
+		!amdgpu_device_has_display_hardware(adev))
+		ret = smu_set_mp1_state(smu, PP_MP1_STATE_UNLOAD);
+
+	return ret;
+}
+
 static int smu_hw_fini(void *handle)
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 	struct smu_context *smu = adev->powerplay.pp_handle;
+	int ret;
 
 	if (amdgpu_sriov_vf(adev) && !amdgpu_sriov_is_pp_one_vf(adev))
 		return 0;
@@ -1975,7 +2003,15 @@
 
 	adev->pm.dpm_enabled = false;
 
-	return smu_smc_hw_cleanup(smu);
+	ret = smu_smc_hw_cleanup(smu);
+	if (ret)
+		return ret;
+
+	ret = smu_reset_mp1_state(smu);
+	if (ret)
+		return ret;
+
+	return 0;
 }
 
 static void smu_late_fini(void *handle)
@@ -2161,12 +2197,13 @@
 }
 
 static int smu_adjust_power_state_dynamic(struct smu_context *smu,
-				   enum amd_dpm_forced_level level,
-				   bool skip_display_settings)
+					  enum amd_dpm_forced_level level,
+					  bool skip_display_settings,
+					  bool init)
 {
 	int ret = 0;
 	int index = 0;
-	long workload;
+	long workload[1];
 	struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
 
 	if (!skip_display_settings) {
@@ -2206,10 +2243,10 @@
 		smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) {
 		index = fls(smu->workload_mask);
 		index = index > 0 && index <= WORKLOAD_POLICY_MAX ? index - 1 : 0;
-		workload = smu->workload_setting[index];
+		workload[0] = smu->workload_setting[index];
 
-		if (smu->power_profile_mode != workload)
-			smu_bump_power_profile_mode(smu, &workload, 0);
+		if (init || smu->power_profile_mode != workload[0])
+			smu_bump_power_profile_mode(smu, workload, 0);
 	}
 
 	return ret;
@@ -2229,11 +2266,13 @@
 		ret = smu_pre_display_config_changed(smu);
 		if (ret)
 			return ret;
-		ret = smu_adjust_power_state_dynamic(smu, level, false);
+		ret = smu_adjust_power_state_dynamic(smu, level, false, false);
 		break;
 	case AMD_PP_TASK_COMPLETE_INIT:
+		ret = smu_adjust_power_state_dynamic(smu, level, true, true);
+		break;
 	case AMD_PP_TASK_READJUST_POWER_STATE:
-		ret = smu_adjust_power_state_dynamic(smu, level, true);
+		ret = smu_adjust_power_state_dynamic(smu, level, true, false);
 		break;
 	default:
 		break;
@@ -2259,7 +2298,7 @@
 {
 	struct smu_context *smu = handle;
 	struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
-	long workload;
+	long workload[1];
 	uint32_t index;
 
 	if (!smu->pm_enabled || !smu->adev->pm.dpm_enabled)
@@ -2272,17 +2311,17 @@
 		smu->workload_mask &= ~(1 << smu->workload_prority[type]);
 		index = fls(smu->workload_mask);
 		index = index > 0 && index <= WORKLOAD_POLICY_MAX ? index - 1 : 0;
-		workload = smu->workload_setting[index];
+		workload[0] = smu->workload_setting[index];
 	} else {
 		smu->workload_mask |= (1 << smu->workload_prority[type]);
 		index = fls(smu->workload_mask);
 		index = index <= WORKLOAD_POLICY_MAX ? index - 1 : 0;
-		workload = smu->workload_setting[index];
+		workload[0] = smu->workload_setting[index];
 	}
 
 	if (smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL &&
 		smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM)
-		smu_bump_power_profile_mode(smu, &workload, 0);
+		smu_bump_power_profile_mode(smu, workload, 0);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
@@ -424,6 +424,7 @@
 enum smu_baco_state {
 	SMU_BACO_STATE_ENTER = 0,
 	SMU_BACO_STATE_EXIT,
+	SMU_BACO_STATE_NONE,
 };
 
 struct smu_baco_context {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
@@ -298,5 +298,11 @@
 
 int smu_v13_0_set_wbrf_exclusion_ranges(struct smu_context *smu,
 						 struct freq_band_range *exclusion_ranges);
+
+int smu_v13_0_get_boot_freq_by_index(struct smu_context *smu,
+				     enum smu_clk_type clk_type,
+				     uint32_t *value);
+
+void smu_v13_0_interrupt_work(struct smu_context *smu);
 #endif
 #endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
@@ -1283,10 +1283,8 @@
 					uint32_t *max_power_limit,
 					uint32_t *min_power_limit)
 {
-	struct smu_11_0_powerplay_table *powerplay_table =
-		(struct smu_11_0_powerplay_table *)smu->smu_table.power_play_table;
 	PPTable_t *pptable = smu->smu_table.driver_pptable;
-	uint32_t power_limit, od_percent_upper, od_percent_lower;
+	uint32_t power_limit;
 
 	if (smu_v11_0_get_current_power_limit(smu, &power_limit)) {
 		/* the last hope to figure out the ppt limit */
@@ -1302,26 +1300,14 @@
 		*current_power_limit = power_limit;
 	if (default_power_limit)
 		*default_power_limit = power_limit;
-
-	if (smu->od_enabled)
-		od_percent_upper = le32_to_cpu(powerplay_table->overdrive_table.max[SMU_11_0_ODSETTING_POWERPERCENTAGE]);
-	else
-		od_percent_upper = 0;
-
-	od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_11_0_ODSETTING_POWERPERCENTAGE]);
-
-	dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
-							od_percent_upper, od_percent_lower, power_limit);
-
-	if (max_power_limit) {
-		*max_power_limit = power_limit * (100 + od_percent_upper);
-		*max_power_limit /= 100;
-	}
-
-	if (min_power_limit) {
-		*min_power_limit = power_limit * (100 - od_percent_lower);
-		*min_power_limit /= 100;
-	}
+	if (max_power_limit)
+		*max_power_limit = power_limit;
+	/**
+	 * No lower bound is imposed on the limit. Any unreasonable limit set
+	 * will result in frequent throttling.
+	 */
+	if (min_power_limit)
+		*min_power_limit = 0;
 
 	return 0;
 }
@@ -1434,6 +1420,9 @@
 
 	if ((profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) &&
 	     (smu->smc_fw_version >= 0x360d00)) {
+		if (size != 10)
+			return -EINVAL;
+
 		ret = smu_cmn_update_table(smu,
 				       SMU_TABLE_ACTIVITY_MONITOR_COEFF,
 				       WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -1467,6 +1456,8 @@
 			activity_monitor.Mem_PD_Data_error_coeff = input[8];
 			activity_monitor.Mem_PD_Data_error_rate_coeff = input[9];
 			break;
+		default:
+			return -EINVAL;
 		}
 
 		ret = smu_cmn_update_table(smu,
@@ -2272,8 +2263,8 @@
 
 	/* TODO: confirm this on real target */
 	esm_ctrl = RREG32_PCIE(smnPCIE_ESM_CTRL);
-	if ((esm_ctrl >> 15) & 0x1FFFF)
-		return (uint16_t)(((esm_ctrl >> 8) & 0x3F) + 128);
+	if ((esm_ctrl >> 15) & 0x1)
+		return (uint16_t)(((esm_ctrl >> 8) & 0x7F) + 128);
 
 	return smu_v11_0_get_current_pcie_link_speed(smu);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
@@ -1219,19 +1219,22 @@
 					   value);
 }
 
-static bool navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type)
+static int navi10_is_support_fine_grained_dpm(struct smu_context *smu, enum smu_clk_type clk_type)
 {
 	PPTable_t *pptable = smu->smu_table.driver_pptable;
 	DpmDescriptor_t *dpm_desc = NULL;
-	uint32_t clk_index = 0;
+	int clk_index = 0;
 
 	clk_index = smu_cmn_to_asic_specific_index(smu,
 						   CMN2ASIC_MAPPING_CLK,
 						   clk_type);
+	if (clk_index < 0)
+		return clk_index;
+
 	dpm_desc = &pptable->DpmDescriptor[clk_index];
 
 	/* 0 - Fine grained DPM, 1 - Discrete DPM */
-	return dpm_desc->SnapToDiscrete == 0;
+	return dpm_desc->SnapToDiscrete == 0 ? 1 : 0;
 }
 
 static inline bool navi10_od_feature_is_supported(struct smu_11_0_overdrive_table *od_table, enum SMU_11_0_ODFEATURE_CAP cap)
@@ -1287,7 +1290,11 @@
 		if (ret)
 			return ret;
 
-		if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) {
+		ret = navi10_is_support_fine_grained_dpm(smu, clk_type);
+		if (ret < 0)
+			return ret;
+
+		if (!ret) {
 			for (i = 0; i < count; i++) {
 				ret = smu_v11_0_get_dpm_freq_by_index(smu,
 								      clk_type, i, &value);
@@ -1496,7 +1503,11 @@
 		if (ret)
 			return size;
 
-		if (!navi10_is_support_fine_grained_dpm(smu, clk_type)) {
+		ret = navi10_is_support_fine_grained_dpm(smu, clk_type);
+		if (ret < 0)
+			return ret;
+
+		if (!ret) {
 			for (i = 0; i < count; i++) {
 				ret = smu_v11_0_get_dpm_freq_by_index(smu, clk_type, i, &value);
 				if (ret)
@@ -1665,7 +1676,11 @@
 	case SMU_UCLK:
 	case SMU_FCLK:
 		/* There is only 2 levels for fine grained DPM */
-		if (navi10_is_support_fine_grained_dpm(smu, clk_type)) {
+		ret = navi10_is_support_fine_grained_dpm(smu, clk_type);
+		if (ret < 0)
+			return ret;
+
+		if (ret) {
 			soft_max_level = (soft_max_level >= 1 ? 1 : 0);
 			soft_min_level = (soft_min_level >= 1 ? 1 : 0);
 		}
@@ -2006,6 +2021,8 @@
 	}
 
 	if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) {
+		if (size != 10)
+			return -EINVAL;
 
 		ret = smu_cmn_update_table(smu,
 				       SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -2049,6 +2066,8 @@
 			activity_monitor.Mem_PD_Data_error_coeff = input[8];
 			activity_monitor.Mem_PD_Data_error_rate_coeff = input[9];
 			break;
+		default:
+			return -EINVAL;
 		}
 
 		ret = smu_cmn_update_table(smu,
@@ -2339,7 +2358,7 @@
 		(struct smu_11_0_powerplay_table *)smu->smu_table.power_play_table;
 	struct smu_11_0_overdrive_table *od_settings = smu->od_settings;
 	PPTable_t *pptable = smu->smu_table.driver_pptable;
-	uint32_t power_limit, od_percent_upper, od_percent_lower;
+	uint32_t power_limit, od_percent_upper = 0, od_percent_lower = 0;
 
 	if (smu_v11_0_get_current_power_limit(smu, &power_limit)) {
 		/* the last hope to figure out the ppt limit */
@@ -2356,13 +2375,16 @@
 	if (default_power_limit)
 		*default_power_limit = power_limit;
 
-	if (smu->od_enabled &&
-		    navi10_od_feature_is_supported(od_settings, SMU_11_0_ODCAP_POWER_LIMIT))
-		od_percent_upper = le32_to_cpu(powerplay_table->overdrive_table.max[SMU_11_0_ODSETTING_POWERPERCENTAGE]);
-	else
-		od_percent_upper = 0;
-
-	od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_11_0_ODSETTING_POWERPERCENTAGE]);
+	if (powerplay_table) {
+		if (smu->od_enabled &&
+			    navi10_od_feature_is_supported(od_settings, SMU_11_0_ODCAP_POWER_LIMIT)) {
+			od_percent_upper = le32_to_cpu(powerplay_table->overdrive_table.max[SMU_11_0_ODSETTING_POWERPERCENTAGE]);
+			od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_11_0_ODSETTING_POWERPERCENTAGE]);
+		} else if (navi10_od_feature_is_supported(od_settings, SMU_11_0_ODCAP_POWER_LIMIT)) {
+			od_percent_upper = 0;
+			od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_11_0_ODSETTING_POWERPERCENTAGE]);
+		}
+	}
 
 	dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
 					od_percent_upper, od_percent_lower, power_limit);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -617,6 +617,12 @@
 	return throttler_status;
 }
 
+static bool sienna_cichlid_is_od_feature_supported(struct smu_11_0_7_overdrive_table *od_table,
+						   enum SMU_11_0_7_ODFEATURE_CAP cap)
+{
+	return od_table->cap[cap];
+}
+
 static int sienna_cichlid_get_power_limit(struct smu_context *smu,
 					  uint32_t *current_power_limit,
 					  uint32_t *default_power_limit,
@@ -625,7 +631,8 @@
 {
 	struct smu_11_0_7_powerplay_table *powerplay_table =
 		(struct smu_11_0_7_powerplay_table *)smu->smu_table.power_play_table;
-	uint32_t power_limit, od_percent_upper, od_percent_lower;
+	struct smu_11_0_7_overdrive_table *od_settings = smu->od_settings;
+	uint32_t power_limit, od_percent_upper = 0, od_percent_lower = 0;
 	uint16_t *table_member;
 
 	GET_PPTABLE_MEMBER(SocketPowerLimitAc, &table_member);
@@ -640,12 +647,16 @@
 	if (default_power_limit)
 		*default_power_limit = power_limit;
 
-	if (smu->od_enabled)
-		od_percent_upper = le32_to_cpu(powerplay_table->overdrive_table.max[SMU_11_0_7_ODSETTING_POWERPERCENTAGE]);
-	else
-		od_percent_upper = 0;
-
-	od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_11_0_7_ODSETTING_POWERPERCENTAGE]);
+	if (powerplay_table) {
+		if (smu->od_enabled &&
+				sienna_cichlid_is_od_feature_supported(od_settings, SMU_11_0_7_ODCAP_POWER_LIMIT)) {
+			od_percent_upper = le32_to_cpu(powerplay_table->overdrive_table.max[SMU_11_0_7_ODSETTING_POWERPERCENTAGE]);
+			od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_11_0_7_ODSETTING_POWERPERCENTAGE]);
+		} else if ((sienna_cichlid_is_od_feature_supported(od_settings, SMU_11_0_7_ODCAP_POWER_LIMIT))) {
+			od_percent_upper = 0;
+			od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_11_0_7_ODSETTING_POWERPERCENTAGE]);
+		}
+	}
 
 	dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
 					od_percent_upper, od_percent_lower, power_limit);
@@ -1250,12 +1261,6 @@
 	return dpm_desc->SnapToDiscrete == 0;
 }
 
-static bool sienna_cichlid_is_od_feature_supported(struct smu_11_0_7_overdrive_table *od_table,
-						   enum SMU_11_0_7_ODFEATURE_CAP cap)
-{
-	return od_table->cap[cap];
-}
-
 static void sienna_cichlid_get_od_setting_range(struct smu_11_0_7_overdrive_table *od_table,
 						enum SMU_11_0_7_ODSETTING_ID setting,
 						uint32_t *min, uint32_t *max)
@@ -1717,6 +1722,8 @@
 	}
 
 	if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) {
+		if (size != 10)
+			return -EINVAL;
 
 		ret = smu_cmn_update_table(smu,
 				       SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -1760,6 +1767,8 @@
 			activity_monitor->Mem_PD_Data_error_coeff = input[8];
 			activity_monitor->Mem_PD_Data_error_rate_coeff = input[9];
 			break;
+		default:
+			return -EINVAL;
 		}
 
 		ret = smu_cmn_update_table(smu,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
@@ -514,7 +514,7 @@
 					    getsmuclockinfo);
 
 	ret = amdgpu_atom_execute_table(adev->mode_info.atom_context, index,
-					(uint32_t *)&input);
+					(uint32_t *)&input, sizeof(input));
 	if (ret)
 		return -EINVAL;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
@@ -242,7 +242,9 @@
 		goto err0_out;
 	smu_table->metrics_time = 0;
 
-	smu_table->gpu_metrics_table_size = max(sizeof(struct gpu_metrics_v2_3), sizeof(struct gpu_metrics_v2_2));
+	smu_table->gpu_metrics_table_size = sizeof(struct gpu_metrics_v2_2);
+	smu_table->gpu_metrics_table_size = max(smu_table->gpu_metrics_table_size, sizeof(struct gpu_metrics_v2_3));
+	smu_table->gpu_metrics_table_size = max(smu_table->gpu_metrics_table_size, sizeof(struct gpu_metrics_v2_4));
 	smu_table->gpu_metrics_table = kzalloc(smu_table->gpu_metrics_table_size, GFP_KERNEL);
 	if (!smu_table->gpu_metrics_table)
 		goto err1_out;
@@ -976,6 +978,18 @@
 		}
 	}
 	if (min) {
+		ret = vangogh_get_profiling_clk_mask(smu,
+						     AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK,
+						     NULL,
+						     NULL,
+						     &mclk_mask,
+						     &fclk_mask,
+						     &soc_mask);
+		if (ret)
+			goto failed;
+
+		vclk_mask = dclk_mask = 0;
+
 		switch (clk_type) {
 		case SMU_UCLK:
 		case SMU_MCLK:
@@ -2444,6 +2458,8 @@
 
 	ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_LogGfxOffResidency,
 					      start, &residency);
+	if (ret)
+		return ret;
 
 	if (!start)
 		adev->gfx.gfx_off_residency = residency;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c
@@ -301,7 +301,7 @@
 					    getsmuclockinfo);
 
 	ret = amdgpu_atom_execute_table(adev->mode_info.atom_context, index,
-					(uint32_t *)&input);
+					(uint32_t *)&input, sizeof(input));
 	if (ret)
 		return -EINVAL;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
@@ -1682,8 +1682,8 @@
 
 	/* TODO: confirm this on real target */
 	esm_ctrl = RREG32_PCIE(smnPCIE_ESM_CTRL);
-	if ((esm_ctrl >> 15) & 0x1FFFF)
-		return (((esm_ctrl >> 8) & 0x3F) + 128);
+	if ((esm_ctrl >> 15) & 0x1)
+		return (((esm_ctrl >> 8) & 0x7F) + 128);
 
 	return smu_v13_0_get_current_pcie_link_speed(smu);
 }
@@ -1880,7 +1880,8 @@
 
 	index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_MSG,
 						SMU_MSG_GfxDeviceDriverReset);
-
+	if (index < 0 )
+		return -EINVAL;
 	mutex_lock(&smu->message_lock);
 	if (smu->smc_fw_version >= 0x00441400) {
 		ret = smu_cmn_send_msg_without_waiting(smu, (uint16_t)index, SMU_RESET_MODE_2);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -79,8 +79,8 @@
 #define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK 0x00000070L
 #define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT 0x4
 #define smnPCIE_LC_SPEED_CNTL			0x11140290
-#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xC000
-#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0xE
+#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xE0
+#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0x5
 
 #define ENABLE_IMU_ARG_GFXOFF_ENABLE		1
 
@@ -1321,11 +1321,11 @@
 	return 0;
 }
 
-static int smu_v13_0_ack_ac_dc_interrupt(struct smu_context *smu)
+void smu_v13_0_interrupt_work(struct smu_context *smu)
 {
-	return smu_cmn_send_smc_msg(smu,
-				    SMU_MSG_ReenableAcDcInterrupt,
-				    NULL);
+	smu_cmn_send_smc_msg(smu,
+			     SMU_MSG_ReenableAcDcInterrupt,
+			     NULL);
 }
 
 #define THM_11_0__SRCID__THM_DIG_THERM_L2H		0		/* ASIC_TEMP > CG_THERMAL_INT.DIG_THERM_INTH  */
@@ -1378,12 +1378,12 @@
 			switch (ctxid) {
 			case 0x3:
 				dev_dbg(adev->dev, "Switched to AC mode!\n");
-				smu_v13_0_ack_ac_dc_interrupt(smu);
+				schedule_work(&smu->interrupt_work);
 				adev->pm.ac_power = true;
 				break;
 			case 0x4:
 				dev_dbg(adev->dev, "Switched to DC mode!\n");
-				smu_v13_0_ack_ac_dc_interrupt(smu);
+				schedule_work(&smu->interrupt_work);
 				adev->pm.ac_power = false;
 				break;
 			case 0x7:
@@ -1555,22 +1555,9 @@
 	uint32_t clock_limit;
 
 	if (!smu_cmn_clk_dpm_is_enabled(smu, clk_type)) {
-		switch (clk_type) {
-		case SMU_MCLK:
-		case SMU_UCLK:
-			clock_limit = smu->smu_table.boot_values.uclk;
-			break;
-		case SMU_GFXCLK:
-		case SMU_SCLK:
-			clock_limit = smu->smu_table.boot_values.gfxclk;
-			break;
-		case SMU_SOCCLK:
-			clock_limit = smu->smu_table.boot_values.socclk;
-			break;
-		default:
-			clock_limit = 0;
-			break;
-		}
+		ret = smu_v13_0_get_boot_freq_by_index(smu, clk_type, &clock_limit);
+		if (ret)
+			return ret;
 
 		/* clock in Mhz unit */
 		if (min)
@@ -1890,6 +1877,40 @@
 					       NULL);
 }
 
+int smu_v13_0_get_boot_freq_by_index(struct smu_context *smu,
+				     enum smu_clk_type clk_type,
+				     uint32_t *value)
+{
+	int ret = 0;
+
+	switch (clk_type) {
+	case SMU_MCLK:
+	case SMU_UCLK:
+		*value = smu->smu_table.boot_values.uclk;
+		break;
+	case SMU_FCLK:
+		*value = smu->smu_table.boot_values.fclk;
+		break;
+	case SMU_GFXCLK:
+	case SMU_SCLK:
+		*value = smu->smu_table.boot_values.gfxclk;
+		break;
+	case SMU_SOCCLK:
+		*value = smu->smu_table.boot_values.socclk;
+		break;
+	case SMU_VCLK:
+		*value = smu->smu_table.boot_values.vclk;
+		break;
+	case SMU_DCLK:
+		*value = smu->smu_table.boot_values.dclk;
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+	return ret;
+}
+
 int smu_v13_0_get_dpm_freq_by_index(struct smu_context *smu,
 				    enum smu_clk_type clk_type, uint16_t level,
 				    uint32_t *value)
@@ -1901,7 +1922,7 @@
 		return -EINVAL;
 
 	if (!smu_cmn_clk_dpm_is_enabled(smu, clk_type))
-		return 0;
+		return smu_v13_0_get_boot_freq_by_index(smu, clk_type, value);
 
 	clk_id = smu_cmn_to_asic_specific_index(smu,
 						CMN2ASIC_MAPPING_CLK,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
@@ -2356,7 +2356,7 @@
 		(struct smu_13_0_0_powerplay_table *)table_context->power_play_table;
 	PPTable_t *pptable = table_context->driver_pptable;
 	SkuTable_t *skutable = &pptable->SkuTable;
-	uint32_t power_limit, od_percent_upper, od_percent_lower;
+	uint32_t power_limit, od_percent_upper = 0, od_percent_lower = 0;
 	uint32_t msg_limit = skutable->MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC];
 
 	if (smu_v13_0_get_current_power_limit(smu, &power_limit))
@@ -2369,12 +2369,16 @@
 	if (default_power_limit)
 		*default_power_limit = power_limit;
 
-	if (smu->od_enabled)
-		od_percent_upper = le32_to_cpu(powerplay_table->overdrive_table.max[SMU_13_0_0_ODSETTING_POWERPERCENTAGE]);
-	else
-		od_percent_upper = 0;
-
-	od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_13_0_0_ODSETTING_POWERPERCENTAGE]);
+	if (powerplay_table) {
+		if (smu->od_enabled &&
+				smu_v13_0_0_is_od_feature_supported(smu, PP_OD_FEATURE_PPT_BIT)) {
+			od_percent_upper = le32_to_cpu(powerplay_table->overdrive_table.max[SMU_13_0_0_ODSETTING_POWERPERCENTAGE]);
+			od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_13_0_0_ODSETTING_POWERPERCENTAGE]);
+		} else if (smu_v13_0_0_is_od_feature_supported(smu, PP_OD_FEATURE_PPT_BIT)) {
+			od_percent_upper = 0;
+			od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_13_0_0_ODSETTING_POWERPERCENTAGE]);
+		}
+	}
 
 	dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
 					od_percent_upper, od_percent_lower, power_limit);
@@ -2491,6 +2495,9 @@
 	}
 
 	if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) {
+		if (size != 9)
+			return -EINVAL;
+
 		ret = smu_cmn_update_table(smu,
 					   SMU_TABLE_ACTIVITY_MONITOR_COEFF,
 					   WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -2522,6 +2529,8 @@
 			activity_monitor->Fclk_PD_Data_error_coeff = input[7];
 			activity_monitor->Fclk_PD_Data_error_rate_coeff = input[8];
 			break;
+		default:
+			return -EINVAL;
 		}
 
 		ret = smu_cmn_update_table(smu,
@@ -2546,18 +2555,17 @@
 	workload_mask = 1 << workload_type;
 
 	/* Add optimizations for SMU13.0.0/10.  Reuse the power saving profile */
-	if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_COMPUTE) {
-		if ((amdgpu_ip_version(smu->adev, MP1_HWIP, 0) == IP_VERSION(13, 0, 0) &&
-			((smu->adev->pm.fw_version == 0x004e6601) ||
-			(smu->adev->pm.fw_version >= 0x004e7300))) ||
-			(amdgpu_ip_version(smu->adev, MP1_HWIP, 0) == IP_VERSION(13, 0, 10) &&
-			 smu->adev->pm.fw_version >= 0x00504500)) {
-			workload_type = smu_cmn_to_asic_specific_index(smu,
-														   CMN2ASIC_MAPPING_WORKLOAD,
-														   PP_SMC_POWER_PROFILE_POWERSAVING);
-			if (workload_type >= 0)
-				workload_mask |= 1 << workload_type;
-		}
+	if ((workload_mask & (1 << PP_SMC_POWER_PROFILE_COMPUTE)) &&
+	    ((amdgpu_ip_version(smu->adev, MP1_HWIP, 0) == IP_VERSION(13, 0, 0) &&
+	      ((smu->adev->pm.fw_version == 0x004e6601) ||
+	       (smu->adev->pm.fw_version >= 0x004e7300))) ||
+	     (amdgpu_ip_version(smu->adev, MP1_HWIP, 0) == IP_VERSION(13, 0, 10) &&
+	      smu->adev->pm.fw_version >= 0x00504500))) {
+		workload_type = smu_cmn_to_asic_specific_index(smu,
+							       CMN2ASIC_MAPPING_WORKLOAD,
+							       PP_SMC_POWER_PROFILE_POWERSAVING);
+		if (workload_type >= 0)
+			workload_mask |= 1 << workload_type;
 	}
 
 	return smu_cmn_send_smc_msg_with_param(smu,
@@ -2747,7 +2755,13 @@
 
 	switch (mp1_state) {
 	case PP_MP1_STATE_UNLOAD:
-		ret = smu_cmn_set_mp1_state(smu, mp1_state);
+		ret = smu_cmn_send_smc_msg_with_param(smu,
+											  SMU_MSG_PrepareMp1ForUnload,
+											  0x55, NULL);
+
+		if (!ret && smu->smu_baco.state == SMU_BACO_STATE_EXIT)
+			ret = smu_v13_0_disable_pmfw_state(smu);
+
 		break;
 	default:
 		/* Ignore others */
@@ -3083,6 +3097,7 @@
 	.is_asic_wbrf_supported = smu_v13_0_0_wbrf_support_check,
 	.enable_uclk_shadow = smu_v13_0_enable_uclk_shadow,
 	.set_wbrf_exclusion_ranges = smu_v13_0_set_wbrf_exclusion_ranges,
+	.interrupt_work = smu_v13_0_interrupt_work,
 };
 
 void smu_v13_0_0_set_ppt_funcs(struct smu_context *smu)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
@@ -226,8 +226,20 @@
 	struct amdgpu_device *adev = smu->adev;
 	int ret = 0;
 
-	if (!en && !adev->in_s0ix)
+	if (!en && !adev->in_s0ix) {
+		if (adev->in_s4) {
+			/* Adds a GFX reset as workaround just before sending the
+			 * MP1_UNLOAD message to prevent GC/RLC/PMFW from entering
+			 * an invalid state.
+			 */
+			ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_GfxDeviceDriverReset,
+							      SMU_RESET_MODE_2, NULL);
+			if (ret)
+				return ret;
+		}
+
 		ret = smu_cmn_send_smc_msg(smu, SMU_MSG_PrepareMp1ForUnload, NULL);
+	}
 
 	return ret;
 }
@@ -740,31 +752,9 @@
 	int ret = 0;
 
 	if (!smu_v13_0_4_clk_dpm_is_enabled(smu, clk_type)) {
-		switch (clk_type) {
-		case SMU_MCLK:
-		case SMU_UCLK:
-			clock_limit = smu->smu_table.boot_values.uclk;
-			break;
-		case SMU_FCLK:
-			clock_limit = smu->smu_table.boot_values.fclk;
-			break;
-		case SMU_GFXCLK:
-		case SMU_SCLK:
-			clock_limit = smu->smu_table.boot_values.gfxclk;
-			break;
-		case SMU_SOCCLK:
-			clock_limit = smu->smu_table.boot_values.socclk;
-			break;
-		case SMU_VCLK:
-			clock_limit = smu->smu_table.boot_values.vclk;
-			break;
-		case SMU_DCLK:
-			clock_limit = smu->smu_table.boot_values.dclk;
-			break;
-		default:
-			clock_limit = 0;
-			break;
-		}
+		ret = smu_v13_0_get_boot_freq_by_index(smu, clk_type, &clock_limit);
+		if (ret)
+			return ret;
 
 		/* clock in Mhz unit */
 		if (min)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c
@@ -727,31 +727,9 @@
 	int ret = 0;
 
 	if (!smu_v13_0_5_clk_dpm_is_enabled(smu, clk_type)) {
-		switch (clk_type) {
-		case SMU_MCLK:
-		case SMU_UCLK:
-			clock_limit = smu->smu_table.boot_values.uclk;
-			break;
-		case SMU_FCLK:
-			clock_limit = smu->smu_table.boot_values.fclk;
-			break;
-		case SMU_GFXCLK:
-		case SMU_SCLK:
-			clock_limit = smu->smu_table.boot_values.gfxclk;
-			break;
-		case SMU_SOCCLK:
-			clock_limit = smu->smu_table.boot_values.socclk;
-			break;
-		case SMU_VCLK:
-			clock_limit = smu->smu_table.boot_values.vclk;
-			break;
-		case SMU_DCLK:
-			clock_limit = smu->smu_table.boot_values.dclk;
-			break;
-		default:
-			clock_limit = 0;
-			break;
-		}
+		ret = smu_v13_0_get_boot_freq_by_index(smu, clk_type, &clock_limit);
+		if (ret)
+			return ret;
 
 		/* clock in Mhz unit */
 		if (min)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c
@@ -2060,8 +2060,8 @@
 
 	/* TODO: confirm this on real target */
 	esm_ctrl = RREG32_PCIE(smnPCIE_ESM_CTRL);
-	if ((esm_ctrl >> 15) & 0x1FFFF)
-		return (((esm_ctrl >> 8) & 0x3F) + 128);
+	if ((esm_ctrl >> 15) & 0x1)
+		return (((esm_ctrl >> 8) & 0x7F) + 128);
 
 	speed_level = (RREG32_PCIE(smnPCIE_LC_SPEED_CNTL) &
 		PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK)
@@ -2205,6 +2205,17 @@
 	return sizeof(*gpu_metrics);
 }
 
+static void smu_v13_0_6_restore_pci_config(struct smu_context *smu)
+{
+	struct amdgpu_device *adev = smu->adev;
+	int i;
+
+	for (i = 0; i < 16; i++)
+		pci_write_config_dword(adev->pdev, i * 4,
+				       adev->pdev->saved_config_space[i]);
+	pci_restore_msi_state(adev->pdev);
+}
+
 static int smu_v13_0_6_mode2_reset(struct smu_context *smu)
 {
 	int ret = 0, index;
@@ -2213,6 +2224,8 @@
 
 	index = smu_cmn_to_asic_specific_index(smu, CMN2ASIC_MAPPING_MSG,
 					       SMU_MSG_GfxDeviceDriverReset);
+	if (index < 0)
+		return index;
 
 	mutex_lock(&smu->message_lock);
 
@@ -2226,6 +2239,20 @@
 	/* Restore the config space saved during init */
 	amdgpu_device_load_pci_state(adev->pdev);
 
+	/* Certain platforms have switches which assign virtual BAR values to
+	 * devices. OS uses the virtual BAR values and device behind the switch
+	 * is assgined another BAR value. When device's config space registers
+	 * are queried, switch returns the virtual BAR values. When mode-2 reset
+	 * is performed, switch is unaware of it, and will continue to return
+	 * the same virtual values to the OS.This affects
+	 * pci_restore_config_space() API as it doesn't write the value saved if
+	 * the current value read from config space is the same as what is
+	 * saved. As a workaround, make sure the config space is restored
+	 * always.
+	 */
+	if (!(adev->flags & AMD_IS_APU))
+		smu_v13_0_6_restore_pci_config(smu);
+
 	dev_dbg(smu->adev->dev, "wait for reset ack\n");
 	do {
 		ret = smu_cmn_wait_for_response(smu);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
@@ -2061,6 +2061,8 @@
 	gpu_metrics->average_dclk1_frequency = metrics->AverageDclk1Frequency;
 
 	gpu_metrics->current_gfxclk = metrics->CurrClock[PPCLK_GFXCLK];
+	gpu_metrics->current_socclk = metrics->CurrClock[PPCLK_SOCCLK];
+	gpu_metrics->current_uclk = metrics->CurrClock[PPCLK_UCLK];
 	gpu_metrics->current_vclk0 = metrics->CurrClock[PPCLK_VCLK_0];
 	gpu_metrics->current_dclk0 = metrics->CurrClock[PPCLK_DCLK_0];
 	gpu_metrics->current_vclk1 = metrics->CurrClock[PPCLK_VCLK_1];
@@ -2320,7 +2322,7 @@
 		(struct smu_13_0_7_powerplay_table *)table_context->power_play_table;
 	PPTable_t *pptable = table_context->driver_pptable;
 	SkuTable_t *skutable = &pptable->SkuTable;
-	uint32_t power_limit, od_percent_upper, od_percent_lower;
+	uint32_t power_limit, od_percent_upper = 0, od_percent_lower = 0;
 	uint32_t msg_limit = skutable->MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC];
 
 	if (smu_v13_0_get_current_power_limit(smu, &power_limit))
@@ -2333,12 +2335,16 @@
 	if (default_power_limit)
 		*default_power_limit = power_limit;
 
-	if (smu->od_enabled)
-		od_percent_upper = le32_to_cpu(powerplay_table->overdrive_table.max[SMU_13_0_7_ODSETTING_POWERPERCENTAGE]);
-	else
-		od_percent_upper = 0;
-
-	od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_13_0_7_ODSETTING_POWERPERCENTAGE]);
+	if (powerplay_table) {
+		if (smu->od_enabled &&
+				(smu_v13_0_7_is_od_feature_supported(smu, PP_OD_FEATURE_PPT_BIT))) {
+			od_percent_upper = le32_to_cpu(powerplay_table->overdrive_table.max[SMU_13_0_7_ODSETTING_POWERPERCENTAGE]);
+			od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_13_0_7_ODSETTING_POWERPERCENTAGE]);
+		} else if (smu_v13_0_7_is_od_feature_supported(smu, PP_OD_FEATURE_PPT_BIT)) {
+			od_percent_upper = 0;
+			od_percent_lower = le32_to_cpu(powerplay_table->overdrive_table.min[SMU_13_0_7_ODSETTING_POWERPERCENTAGE]);
+		}
+	}
 
 	dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
 					od_percent_upper, od_percent_lower, power_limit);
@@ -2446,6 +2452,8 @@
 	}
 
 	if (smu->power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) {
+		if (size != 8)
+			return -EINVAL;
 
 		ret = smu_cmn_update_table(smu,
 				       SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -2474,6 +2482,8 @@
 			activity_monitor->Fclk_MinActiveFreq = input[6];
 			activity_monitor->Fclk_BoosterFreq = input[7];
 			break;
+		default:
+			return -EINVAL;
 		}
 
 		ret = smu_cmn_update_table(smu,
@@ -2657,6 +2667,7 @@
 	.is_asic_wbrf_supported = smu_v13_0_7_wbrf_support_check,
 	.enable_uclk_shadow = smu_v13_0_enable_uclk_shadow,
 	.set_wbrf_exclusion_ranges = smu_v13_0_set_wbrf_exclusion_ranges,
+	.interrupt_work = smu_v13_0_interrupt_work,
 };
 
 void smu_v13_0_7_set_ppt_funcs(struct smu_context *smu)
@@ -2670,4 +2681,5 @@
 	smu->workload_map = smu_v13_0_7_workload_map;
 	smu->smc_driver_if_version = SMU13_0_7_DRIVER_IF_VERSION;
 	smu_v13_0_set_smu_mailbox_registers(smu);
+	smu->power_profile_mode = PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
@@ -861,31 +861,9 @@
 	int ret = 0;
 
 	if (!yellow_carp_clk_dpm_is_enabled(smu, clk_type)) {
-		switch (clk_type) {
-		case SMU_MCLK:
-		case SMU_UCLK:
-			clock_limit = smu->smu_table.boot_values.uclk;
-			break;
-		case SMU_FCLK:
-			clock_limit = smu->smu_table.boot_values.fclk;
-			break;
-		case SMU_GFXCLK:
-		case SMU_SCLK:
-			clock_limit = smu->smu_table.boot_values.gfxclk;
-			break;
-		case SMU_SOCCLK:
-			clock_limit = smu->smu_table.boot_values.socclk;
-			break;
-		case SMU_VCLK:
-			clock_limit = smu->smu_table.boot_values.vclk;
-			break;
-		case SMU_DCLK:
-			clock_limit = smu->smu_table.boot_values.dclk;
-			break;
-		default:
-			clock_limit = 0;
-			break;
-		}
+		ret = smu_v13_0_get_boot_freq_by_index(smu, clk_type, &clock_limit);
+		if (ret)
+			return ret;
 
 		/* clock in Mhz unit */
 		if (min)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c
@@ -836,7 +836,7 @@
 static int smu_v14_0_0_print_clk_levels(struct smu_context *smu,
 					enum smu_clk_type clk_type, char *buf)
 {
-	int i, size = 0, ret = 0;
+	int i, idx, ret = 0, size = 0;
 	uint32_t cur_value = 0, value = 0, count = 0;
 	uint32_t min, max;
 
@@ -870,7 +870,8 @@
 			break;
 
 		for (i = 0; i < count; i++) {
-			ret = smu_v14_0_0_get_dpm_freq_by_index(smu, clk_type, i, &value);
+			idx = (clk_type == SMU_MCLK) ? (count - i - 1) : i;
+			ret = smu_v14_0_0_get_dpm_freq_by_index(smu, clk_type, idx, &value);
 			if (ret)
 				break;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c
@@ -5,6 +5,7 @@
  *
  */
 #include <linux/clk.h>
+#include <linux/of.h>
 #include <linux/pm_runtime.h>
 #include <linux/spinlock.h>
 
@@ -610,12 +611,34 @@
 	return NULL;
 }
 
+static int komeda_attach_bridge(struct device *dev,
+				struct komeda_pipeline *pipe,
+				struct drm_encoder *encoder)
+{
+	struct drm_bridge *bridge;
+	int err;
+
+	bridge = devm_drm_of_get_bridge(dev, pipe->of_node,
+					KOMEDA_OF_PORT_OUTPUT, 0);
+	if (IS_ERR(bridge))
+		return dev_err_probe(dev, PTR_ERR(bridge), "remote bridge not found for pipe: %s\n",
+				     of_node_full_name(pipe->of_node));
+
+	err = drm_bridge_attach(encoder, bridge, NULL, 0);
+	if (err)
+		dev_err(dev, "bridge_attach() failed for pipe: %s\n",
+			of_node_full_name(pipe->of_node));
+
+	return err;
+}
+
 static int komeda_crtc_add(struct komeda_kms_dev *kms,
 			   struct komeda_crtc *kcrtc)
 {
 	struct drm_crtc *crtc = &kcrtc->base;
 	struct drm_device *base = &kms->base;
-	struct drm_bridge *bridge;
+	struct komeda_pipeline *pipe = kcrtc->master;
+	struct drm_encoder *encoder = &kcrtc->encoder;
 	int err;
 
 	err = drm_crtc_init_with_planes(base, crtc,
@@ -626,27 +649,25 @@
 
 	drm_crtc_helper_add(crtc, &komeda_crtc_helper_funcs);
 
-	crtc->port = kcrtc->master->of_output_port;
+	crtc->port = pipe->of_output_port;
 
 	/* Construct an encoder for each pipeline and attach it to the remote
 	 * bridge
 	 */
 	kcrtc->encoder.possible_crtcs = drm_crtc_mask(crtc);
-	err = drm_simple_encoder_init(base, &kcrtc->encoder,
-				      DRM_MODE_ENCODER_TMDS);
+	err = drm_simple_encoder_init(base, encoder, DRM_MODE_ENCODER_TMDS);
 	if (err)
 		return err;
 
-	bridge = devm_drm_of_get_bridge(base->dev, kcrtc->master->of_node,
-					KOMEDA_OF_PORT_OUTPUT, 0);
-	if (IS_ERR(bridge))
-		return PTR_ERR(bridge);
-
-	err = drm_bridge_attach(&kcrtc->encoder, bridge, NULL, 0);
+	if (pipe->of_output_links[0]) {
+		err = komeda_attach_bridge(base->dev, pipe, encoder);
+		if (err)
+			return err;
+	}
 
 	drm_crtc_enable_color_mgmt(crtc, 0, true, KOMEDA_COLOR_LUT_SIZE);
 
-	return err;
+	return 0;
 }
 
 int komeda_kms_add_crtcs(struct komeda_kms_dev *kms, struct komeda_dev *mdev)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/arm/display/komeda/komeda_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/arm/display/komeda/komeda_kms.c
@@ -160,6 +160,7 @@
 	struct drm_plane *plane;
 	struct list_head zorder_list;
 	int order = 0, err;
+	u32 slave_zpos = 0;
 
 	DRM_DEBUG_ATOMIC("[CRTC:%d:%s] calculating normalized zpos values\n",
 			 crtc->base.id, crtc->name);
@@ -199,10 +200,13 @@
 				 plane_st->zpos, plane_st->normalized_zpos);
 
 		/* calculate max slave zorder */
-		if (has_bit(drm_plane_index(plane), kcrtc->slave_planes))
+		if (has_bit(drm_plane_index(plane), kcrtc->slave_planes)) {
+			slave_zpos = plane_st->normalized_zpos;
+			if (to_kplane_st(plane_st)->layer_split)
+				slave_zpos++;
 			kcrtc_st->max_slave_zorder =
-				max(plane_st->normalized_zpos,
-				    kcrtc_st->max_slave_zorder);
+				max(slave_zpos, kcrtc_st->max_slave_zorder);
+		}
 	}
 
 	crtc_st->zpos_changed = true;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c
@@ -259,7 +259,7 @@
 	u32 avail_scalers;
 
 	pipe_st = komeda_pipeline_get_state(c->pipeline, state);
-	if (!pipe_st)
+	if (IS_ERR_OR_NULL(pipe_st))
 		return NULL;
 
 	avail_scalers = (pipe_st->active_comps & KOMEDA_PIPELINE_SCALERS) ^
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/arm/malidp_mw.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/arm/malidp_mw.c
@@ -72,7 +72,10 @@
 		__drm_atomic_helper_connector_destroy_state(connector->state);
 
 	kfree(connector->state);
-	__drm_atomic_helper_connector_reset(connector, &mw_state->base);
+	connector->state = NULL;
+
+	if (mw_state)
+		__drm_atomic_helper_connector_reset(connector, &mw_state->base);
 }
 
 static enum drm_connector_status
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ast/ast_dp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/ast/ast_dp.c
@@ -158,7 +158,14 @@
 			       ASTDP_HOST_EDID_READ_DONE);
 }
 
+bool ast_dp_power_is_on(struct ast_device *ast)
+{
+	u8 vgacre3;
+
+	vgacre3 = ast_get_index_reg(ast, AST_IO_VGACRI, 0xe3);
 
+	return !(vgacre3 & AST_DP_PHY_SLEEP);
+}
 
 void ast_dp_power_on_off(struct drm_device *dev, bool on)
 {
@@ -180,6 +187,7 @@
 {
 	struct ast_device *ast = to_ast_device(dev);
 	u8 video_on_off = on;
+	u32 i = 0;
 
 	// Video On/Off
 	ast_set_index_reg_mask(ast, AST_IO_VGACRI, 0xE3, (u8) ~AST_DP_VIDEO_ENABLE, on);
@@ -192,6 +200,8 @@
 						ASTDP_MIRROR_VIDEO_ENABLE) != video_on_off) {
 			// wait 1 ms
 			mdelay(1);
+			if (++i > 200)
+				break;
 		}
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ast/ast_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/ast/ast_drv.c
@@ -390,6 +390,11 @@
 
 static int ast_drm_thaw(struct drm_device *dev)
 {
+	struct ast_device *ast = to_ast_device(dev);
+
+	ast_enable_vga(ast->ioregs);
+	ast_open_key(ast->ioregs);
+	ast_enable_mmio(dev->dev, ast->ioregs);
 	ast_post_gpu(dev);
 
 	return drm_mode_config_helper_resume(dev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ast/ast_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/ast/ast_drv.h
@@ -505,6 +505,7 @@
 bool ast_astdp_is_connected(struct ast_device *ast);
 int ast_astdp_read_edid(struct drm_device *dev, u8 *ediddata);
 void ast_dp_launch(struct drm_device *dev);
+bool ast_dp_power_is_on(struct ast_device *ast);
 void ast_dp_power_on_off(struct drm_device *dev, bool no);
 void ast_dp_set_on_off(struct drm_device *dev, bool no);
 void ast_dp_set_mode(struct drm_crtc *crtc, struct ast_vbios_mode_info *vbios_mode);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ast/ast_mode.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/ast/ast_mode.c
@@ -28,6 +28,7 @@
  * Authors: Dave Airlie <airlied@redhat.com>
  */
 
+#include <linux/delay.h>
 #include <linux/export.h>
 #include <linux/pci.h>
 
@@ -44,7 +45,6 @@
 #include <drm/drm_gem_shmem_helper.h>
 #include <drm/drm_managed.h>
 #include <drm/drm_probe_helper.h>
-#include <drm/drm_simple_kms_helper.h>
 
 #include "ast_drv.h"
 #include "ast_tables.h"
@@ -302,7 +302,7 @@
 
 	/* Set SEQ; except Screen Disable field */
 	ast_set_index_reg(ast, AST_IO_VGASRI, 0x00, 0x03);
-	ast_set_index_reg_mask(ast, AST_IO_VGASRI, 0x01, 0xdf, stdtable->seq[0]);
+	ast_set_index_reg_mask(ast, AST_IO_VGASRI, 0x01, 0x20, stdtable->seq[0]);
 	for (i = 1; i < 4; i++) {
 		jreg = stdtable->seq[i];
 		ast_set_index_reg(ast, AST_IO_VGASRI, (i + 1), jreg);
@@ -648,12 +648,12 @@
 	struct drm_plane_state *old_plane_state = drm_atomic_get_old_plane_state(state, plane);
 	struct drm_framebuffer *old_fb = old_plane_state->fb;
 	struct ast_plane *ast_plane = to_ast_plane(plane);
+	struct drm_crtc *crtc = plane_state->crtc;
+	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
 	struct drm_rect damage;
 	struct drm_atomic_helper_damage_iter iter;
 
-	if (!old_fb || (fb->format != old_fb->format)) {
-		struct drm_crtc *crtc = plane_state->crtc;
-		struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+	if (!old_fb || (fb->format != old_fb->format) || crtc_state->mode_changed) {
 		struct ast_crtc_state *ast_crtc_state = to_ast_crtc_state(crtc_state);
 		struct ast_vbios_mode_info *vbios_mode_info = &ast_crtc_state->vbios_mode_info;
 
@@ -689,15 +689,15 @@
 	 * Therefore only reprogram the address after enabling the plane.
 	 */
 	ast_set_start_address_crt1(ast, (u32)ast_plane->offset);
-	ast_set_index_reg_mask(ast, AST_IO_VGASRI, 0x1, 0xdf, 0x00);
 }
 
 static void ast_primary_plane_helper_atomic_disable(struct drm_plane *plane,
 						    struct drm_atomic_state *state)
 {
-	struct ast_device *ast = to_ast_device(plane->dev);
-
-	ast_set_index_reg_mask(ast, AST_IO_VGASRI, 0x1, 0xdf, 0x20);
+	/*
+	 * Keep this empty function to avoid calling
+	 * atomic_update when disabling the plane.
+	 */
 }
 
 static const struct drm_plane_helper_funcs ast_primary_plane_helper_funcs = {
@@ -1001,62 +1001,6 @@
  * CRTC
  */
 
-static void ast_crtc_dpms(struct drm_crtc *crtc, int mode)
-{
-	struct ast_device *ast = to_ast_device(crtc->dev);
-	u8 ch = AST_DPMS_VSYNC_OFF | AST_DPMS_HSYNC_OFF;
-	struct ast_crtc_state *ast_state;
-	const struct drm_format_info *format;
-	struct ast_vbios_mode_info *vbios_mode_info;
-
-	/* TODO: Maybe control display signal generation with
-	 *       Sync Enable (bit CR17.7).
-	 */
-	switch (mode) {
-	case DRM_MODE_DPMS_ON:
-		ast_set_index_reg_mask(ast, AST_IO_VGASRI,  0x01, 0xdf, 0);
-		ast_set_index_reg_mask(ast, AST_IO_VGACRI, 0xb6, 0xfc, 0);
-		if (ast->tx_chip_types & AST_TX_DP501_BIT)
-			ast_set_dp501_video_output(crtc->dev, 1);
-
-		if (ast->tx_chip_types & AST_TX_ASTDP_BIT) {
-			ast_dp_power_on_off(crtc->dev, AST_DP_POWER_ON);
-			ast_wait_for_vretrace(ast);
-			ast_dp_set_on_off(crtc->dev, 1);
-		}
-
-		ast_state = to_ast_crtc_state(crtc->state);
-		format = ast_state->format;
-
-		if (format) {
-			vbios_mode_info = &ast_state->vbios_mode_info;
-
-			ast_set_color_reg(ast, format);
-			ast_set_vbios_color_reg(ast, format, vbios_mode_info);
-			if (crtc->state->gamma_lut)
-				ast_crtc_set_gamma(ast, format, crtc->state->gamma_lut->data);
-			else
-				ast_crtc_set_gamma_linear(ast, format);
-		}
-		break;
-	case DRM_MODE_DPMS_STANDBY:
-	case DRM_MODE_DPMS_SUSPEND:
-	case DRM_MODE_DPMS_OFF:
-		ch = mode;
-		if (ast->tx_chip_types & AST_TX_DP501_BIT)
-			ast_set_dp501_video_output(crtc->dev, 0);
-
-		if (ast->tx_chip_types & AST_TX_ASTDP_BIT) {
-			ast_dp_set_on_off(crtc->dev, 0);
-			ast_dp_power_on_off(crtc->dev, AST_DP_POWER_OFF);
-		}
-
-		ast_set_index_reg_mask(ast, AST_IO_VGASRI,  0x01, 0xdf, 0x20);
-		ast_set_index_reg_mask(ast, AST_IO_VGACRI, 0xb6, 0xfc, ch);
-		break;
-	}
-}
-
 static enum drm_mode_status
 ast_crtc_helper_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
 {
@@ -1129,6 +1073,33 @@
 	return status;
 }
 
+static void ast_crtc_helper_mode_set_nofb(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct ast_device *ast = to_ast_device(dev);
+	struct drm_crtc_state *crtc_state = crtc->state;
+	struct ast_crtc_state *ast_crtc_state = to_ast_crtc_state(crtc_state);
+	struct ast_vbios_mode_info *vbios_mode_info =
+		&ast_crtc_state->vbios_mode_info;
+	struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode;
+
+	/*
+	 * Ensure that no scanout takes place before reprogramming mode
+	 * and format registers.
+	 *
+	 * TODO: Get vblank interrupts working and remove this line.
+	 */
+	ast_wait_for_vretrace(ast);
+
+	ast_set_vbios_mode_reg(ast, adjusted_mode, vbios_mode_info);
+	ast_set_index_reg(ast, AST_IO_VGACRI, 0xa1, 0x06);
+	ast_set_std_reg(ast, adjusted_mode, vbios_mode_info);
+	ast_set_crtc_reg(ast, adjusted_mode, vbios_mode_info);
+	ast_set_dclk_reg(ast, adjusted_mode, vbios_mode_info);
+	ast_set_crtthd_reg(ast);
+	ast_set_sync_reg(ast, adjusted_mode, vbios_mode_info);
+}
+
 static int ast_crtc_helper_atomic_check(struct drm_crtc *crtc,
 					struct drm_atomic_state *state)
 {
@@ -1188,7 +1159,6 @@
 	struct drm_device *dev = crtc->dev;
 	struct ast_device *ast = to_ast_device(dev);
 	struct ast_crtc_state *ast_crtc_state = to_ast_crtc_state(crtc_state);
-	struct ast_vbios_mode_info *vbios_mode_info = &ast_crtc_state->vbios_mode_info;
 
 	/*
 	 * The gamma LUT has to be reloaded after changing the primary
@@ -1202,40 +1172,27 @@
 		else
 			ast_crtc_set_gamma_linear(ast, ast_crtc_state->format);
 	}
-
-	//Set Aspeed Display-Port
-	if (ast->tx_chip_types & AST_TX_ASTDP_BIT)
-		ast_dp_set_mode(crtc, vbios_mode_info);
 }
 
 static void ast_crtc_helper_atomic_enable(struct drm_crtc *crtc, struct drm_atomic_state *state)
 {
-	struct drm_device *dev = crtc->dev;
-	struct ast_device *ast = to_ast_device(dev);
-	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
-	struct ast_crtc_state *ast_crtc_state = to_ast_crtc_state(crtc_state);
-	struct ast_vbios_mode_info *vbios_mode_info =
-		&ast_crtc_state->vbios_mode_info;
-	struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode;
-
-	ast_set_vbios_mode_reg(ast, adjusted_mode, vbios_mode_info);
-	ast_set_index_reg(ast, AST_IO_VGACRI, 0xa1, 0x06);
-	ast_set_std_reg(ast, adjusted_mode, vbios_mode_info);
-	ast_set_crtc_reg(ast, adjusted_mode, vbios_mode_info);
-	ast_set_dclk_reg(ast, adjusted_mode, vbios_mode_info);
-	ast_set_crtthd_reg(ast);
-	ast_set_sync_reg(ast, adjusted_mode, vbios_mode_info);
+	struct ast_device *ast = to_ast_device(crtc->dev);
 
-	ast_crtc_dpms(crtc, DRM_MODE_DPMS_ON);
+	ast_set_index_reg_mask(ast, AST_IO_VGACRI, 0xb6, 0xfc, 0x00);
+	ast_set_index_reg_mask(ast, AST_IO_VGASRI, 0x01, 0xdf, 0x00);
 }
 
 static void ast_crtc_helper_atomic_disable(struct drm_crtc *crtc, struct drm_atomic_state *state)
 {
 	struct drm_crtc_state *old_crtc_state = drm_atomic_get_old_crtc_state(state, crtc);
-	struct drm_device *dev = crtc->dev;
-	struct ast_device *ast = to_ast_device(dev);
+	struct ast_device *ast = to_ast_device(crtc->dev);
+	u8 vgacrb6;
 
-	ast_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
+	ast_set_index_reg_mask(ast, AST_IO_VGASRI, 0x01, 0xdf, AST_IO_VGASR1_SD);
+
+	vgacrb6 = AST_IO_VGACRB6_VSYNC_OFF |
+		  AST_IO_VGACRB6_HSYNC_OFF;
+	ast_set_index_reg_mask(ast, AST_IO_VGACRI, 0xb6, 0xfc, vgacrb6);
 
 	/*
 	 * HW cursors require the underlying primary plane and CRTC to
@@ -1248,16 +1205,11 @@
 	 * simple pageflips on the planes.
 	 */
 	drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, false);
-
-	/*
-	 * Ensure that no scanout takes place before reprogramming mode
-	 * and format registers.
-	 */
-	ast_wait_for_vretrace(ast);
 }
 
 static const struct drm_crtc_helper_funcs ast_crtc_helper_funcs = {
 	.mode_valid = ast_crtc_helper_mode_valid,
+	.mode_set_nofb = ast_crtc_helper_mode_set_nofb,
 	.atomic_check = ast_crtc_helper_atomic_check,
 	.atomic_flush = ast_crtc_helper_atomic_flush,
 	.atomic_enable = ast_crtc_helper_atomic_enable,
@@ -1340,6 +1292,14 @@
 }
 
 /*
+ * VGA Encoder
+ */
+
+static const struct drm_encoder_funcs ast_vga_encoder_funcs = {
+	.destroy = drm_encoder_cleanup,
+};
+
+/*
  * VGA Connector
  */
 
@@ -1429,7 +1389,8 @@
 	struct drm_connector *connector = &ast_vga_connector->base;
 	int ret;
 
-	ret = drm_simple_encoder_init(dev, encoder, DRM_MODE_ENCODER_DAC);
+	ret = drm_encoder_init(dev, encoder, &ast_vga_encoder_funcs,
+			       DRM_MODE_ENCODER_DAC, NULL);
 	if (ret)
 		return ret;
 	encoder->possible_crtcs = drm_crtc_mask(crtc);
@@ -1446,6 +1407,14 @@
 }
 
 /*
+ * SIL164 Encoder
+ */
+
+static const struct drm_encoder_funcs ast_sil164_encoder_funcs = {
+	.destroy = drm_encoder_cleanup,
+};
+
+/*
  * SIL164 Connector
  */
 
@@ -1535,7 +1504,8 @@
 	struct drm_connector *connector = &ast_sil164_connector->base;
 	int ret;
 
-	ret = drm_simple_encoder_init(dev, encoder, DRM_MODE_ENCODER_TMDS);
+	ret = drm_encoder_init(dev, encoder, &ast_sil164_encoder_funcs,
+			       DRM_MODE_ENCODER_TMDS, NULL);
 	if (ret)
 		return ret;
 	encoder->possible_crtcs = drm_crtc_mask(crtc);
@@ -1552,6 +1522,35 @@
 }
 
 /*
+ * DP501 Encoder
+ */
+
+static const struct drm_encoder_funcs ast_dp501_encoder_funcs = {
+	.destroy = drm_encoder_cleanup,
+};
+
+static void ast_dp501_encoder_helper_atomic_enable(struct drm_encoder *encoder,
+						   struct drm_atomic_state *state)
+{
+	struct drm_device *dev = encoder->dev;
+
+	ast_set_dp501_video_output(dev, 1);
+}
+
+static void ast_dp501_encoder_helper_atomic_disable(struct drm_encoder *encoder,
+						    struct drm_atomic_state *state)
+{
+	struct drm_device *dev = encoder->dev;
+
+	ast_set_dp501_video_output(dev, 0);
+}
+
+static const struct drm_encoder_helper_funcs ast_dp501_encoder_helper_funcs = {
+	.atomic_enable = ast_dp501_encoder_helper_atomic_enable,
+	.atomic_disable = ast_dp501_encoder_helper_atomic_disable,
+};
+
+/*
  * DP501 Connector
  */
 
@@ -1633,9 +1632,12 @@
 	struct drm_connector *connector = &ast->output.dp501.connector;
 	int ret;
 
-	ret = drm_simple_encoder_init(dev, encoder, DRM_MODE_ENCODER_TMDS);
+	ret = drm_encoder_init(dev, encoder, &ast_dp501_encoder_funcs,
+			       DRM_MODE_ENCODER_TMDS, NULL);
 	if (ret)
 		return ret;
+	drm_encoder_helper_add(encoder, &ast_dp501_encoder_helper_funcs);
+
 	encoder->possible_crtcs = drm_crtc_mask(crtc);
 
 	ret = ast_dp501_connector_init(dev, connector);
@@ -1650,6 +1652,51 @@
 }
 
 /*
+ * ASPEED Display-Port Encoder
+ */
+
+static const struct drm_encoder_funcs ast_astdp_encoder_funcs = {
+	.destroy = drm_encoder_cleanup,
+};
+
+static void ast_astdp_encoder_helper_atomic_mode_set(struct drm_encoder *encoder,
+						     struct drm_crtc_state *crtc_state,
+						     struct drm_connector_state *conn_state)
+{
+	struct drm_crtc *crtc = crtc_state->crtc;
+	struct ast_crtc_state *ast_crtc_state = to_ast_crtc_state(crtc_state);
+	struct ast_vbios_mode_info *vbios_mode_info = &ast_crtc_state->vbios_mode_info;
+
+	ast_dp_set_mode(crtc, vbios_mode_info);
+}
+
+static void ast_astdp_encoder_helper_atomic_enable(struct drm_encoder *encoder,
+						   struct drm_atomic_state *state)
+{
+	struct drm_device *dev = encoder->dev;
+	struct ast_device *ast = to_ast_device(dev);
+
+	ast_dp_power_on_off(dev, AST_DP_POWER_ON);
+	ast_wait_for_vretrace(ast);
+	ast_dp_set_on_off(dev, 1);
+}
+
+static void ast_astdp_encoder_helper_atomic_disable(struct drm_encoder *encoder,
+						    struct drm_atomic_state *state)
+{
+	struct drm_device *dev = encoder->dev;
+
+	ast_dp_set_on_off(dev, 0);
+	ast_dp_power_on_off(dev, AST_DP_POWER_OFF);
+}
+
+static const struct drm_encoder_helper_funcs ast_astdp_encoder_helper_funcs = {
+	.atomic_mode_set = ast_astdp_encoder_helper_atomic_mode_set,
+	.atomic_enable = ast_astdp_encoder_helper_atomic_enable,
+	.atomic_disable = ast_astdp_encoder_helper_atomic_disable,
+};
+
+/*
  * ASPEED Display-Port Connector
  */
 
@@ -1696,11 +1743,35 @@
 						 struct drm_modeset_acquire_ctx *ctx,
 						 bool force)
 {
+	struct drm_device *dev = connector->dev;
 	struct ast_device *ast = to_ast_device(connector->dev);
+	enum drm_connector_status status = connector_status_disconnected;
+	struct drm_connector_state *connector_state = connector->state;
+	bool is_active = false;
+
+	mutex_lock(&ast->modeset_lock);
+
+	if (connector_state && connector_state->crtc) {
+		struct drm_crtc_state *crtc_state = connector_state->crtc->state;
+
+		if (crtc_state && crtc_state->active)
+			is_active = true;
+	}
+
+	if (!is_active && !ast_dp_power_is_on(ast)) {
+		ast_dp_power_on_off(dev, true);
+		msleep(50);
+	}
 
 	if (ast_astdp_is_connected(ast))
-		return connector_status_connected;
-	return connector_status_disconnected;
+		status = connector_status_connected;
+
+	if (!is_active && status == connector_status_disconnected)
+		ast_dp_power_on_off(dev, false);
+
+	mutex_unlock(&ast->modeset_lock);
+
+	return status;
 }
 
 static const struct drm_connector_helper_funcs ast_astdp_connector_helper_funcs = {
@@ -1743,9 +1814,12 @@
 	struct drm_connector *connector = &ast->output.astdp.connector;
 	int ret;
 
-	ret = drm_simple_encoder_init(dev, encoder, DRM_MODE_ENCODER_TMDS);
+	ret = drm_encoder_init(dev, encoder, &ast_astdp_encoder_funcs,
+			       DRM_MODE_ENCODER_TMDS, NULL);
 	if (ret)
 		return ret;
+	drm_encoder_helper_add(encoder, &ast_astdp_encoder_helper_funcs);
+
 	encoder->possible_crtcs = drm_crtc_mask(crtc);
 
 	ret = ast_astdp_connector_init(dev, connector);
@@ -1871,7 +1945,7 @@
 	 * the I/O-register lock. Released in atomic_flush().
 	 */
 	mutex_lock(&ast->modeset_lock);
-	drm_atomic_helper_commit_tail_rpm(state);
+	drm_atomic_helper_commit_tail(state);
 	mutex_unlock(&ast->modeset_lock);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ast/ast_reg.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/ast/ast_reg.h
@@ -22,6 +22,7 @@
 #define AST_IO_VGAER_VGA_ENABLE		BIT(0)
 
 #define AST_IO_VGASRI			(0x44)
+#define AST_IO_VGASR1_SD		BIT(5)
 #define AST_IO_VGADRR			(0x47)
 #define AST_IO_VGADWR			(0x48)
 #define AST_IO_VGAPDR		        (0x49)
@@ -31,6 +32,8 @@
 #define AST_IO_VGACR80_PASSWORD		(0xa8)
 #define AST_IO_VGACRA1_VGAIO_DISABLED	BIT(1)
 #define AST_IO_VGACRA1_MMIO_ENABLED	BIT(2)
+#define AST_IO_VGACRB6_HSYNC_OFF	BIT(0)
+#define AST_IO_VGACRB6_VSYNC_OFF	BIT(1)
 #define AST_IO_VGACRCB_HWC_16BPP	BIT(0) /* set: ARGB4444, cleared: 2bpp palette */
 #define AST_IO_VGACRCB_HWC_ENABLED	BIT(1)
 
@@ -76,13 +79,6 @@
 #define ASTDP_HOST_EDID_READ_DONE_MASK	GENMASK(0, 0)
 
 /*
- * CRB8[b1]: Enable VSYNC off
- * CRB8[b0]: Enable HSYNC off
- */
-#define AST_DPMS_VSYNC_OFF		BIT(1)
-#define AST_DPMS_HSYNC_OFF		BIT(0)
-
-/*
  * CRDF[b4]: Mirror of AST_DP_VIDEO_ENABLE
  * Precondition:	A. ~AST_DP_PHY_SLEEP  &&
  *			B. DP_HPD &&
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
@@ -153,7 +153,16 @@
 			   ADV7511_AUDIO_CFG3_LEN_MASK, len);
 	regmap_update_bits(adv7511->regmap, ADV7511_REG_I2C_FREQ_ID_CFG,
 			   ADV7511_I2C_FREQ_ID_CFG_RATE_MASK, rate << 4);
-	regmap_write(adv7511->regmap, 0x73, 0x1);
+
+	/* send current Audio infoframe values while updating */
+	regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
+			   BIT(5), BIT(5));
+
+	regmap_write(adv7511->regmap, ADV7511_REG_AUDIO_INFOFRAME(0), 0x1);
+
+	/* use Audio infoframe updated info */
+	regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
+			   BIT(5), 0);
 
 	return 0;
 }
@@ -184,8 +193,9 @@
 	regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(0),
 				BIT(7) | BIT(6), BIT(7));
 	/* use Audio infoframe updated info */
-	regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(1),
+	regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
 				BIT(5), 0);
+
 	/* enable SPDIF receiver */
 	if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF)
 		regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -1211,8 +1211,10 @@
 		return ret;
 
 	ret = adv7511_init_regulators(adv7511);
-	if (ret)
-		return dev_err_probe(dev, ret, "failed to init regulators\n");
+	if (ret) {
+		dev_err_probe(dev, ret, "failed to init regulators\n");
+		goto err_of_node_put;
+	}
 
 	/*
 	 * The power down GPIO is optional. If present, toggle it from active to
@@ -1277,17 +1279,6 @@
 
 	INIT_WORK(&adv7511->hpd_work, adv7511_hpd_work);
 
-	if (i2c->irq) {
-		init_waitqueue_head(&adv7511->wq);
-
-		ret = devm_request_threaded_irq(dev, i2c->irq, NULL,
-						adv7511_irq_handler,
-						IRQF_ONESHOT, dev_name(dev),
-						adv7511);
-		if (ret)
-			goto err_unregister_cec;
-	}
-
 	adv7511_power_off(adv7511);
 
 	i2c_set_clientdata(i2c, adv7511);
@@ -1311,6 +1302,17 @@
 
 	adv7511_audio_init(dev, adv7511);
 
+	if (i2c->irq) {
+		init_waitqueue_head(&adv7511->wq);
+
+		ret = devm_request_threaded_irq(dev, i2c->irq, NULL,
+						adv7511_irq_handler,
+						IRQF_ONESHOT, dev_name(dev),
+						adv7511);
+		if (ret)
+			goto err_unregister_audio;
+	}
+
 	if (adv7511->info->has_dsi) {
 		ret = adv7533_attach_dsi(adv7511);
 		if (ret)
@@ -1332,6 +1334,8 @@
 	i2c_unregister_device(adv7511->i2c_edid);
 uninit_regulators:
 	adv7511_uninit_regulators(adv7511);
+err_of_node_put:
+	of_node_put(adv7511->host_node);
 
 	return ret;
 }
@@ -1340,6 +1344,8 @@
 {
 	struct adv7511 *adv7511 = i2c_get_clientdata(i2c);
 
+	of_node_put(adv7511->host_node);
+
 	adv7511_uninit_regulators(adv7511);
 
 	drm_bridge_remove(&adv7511->bridge);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/adv7511/adv7533.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/adv7511/adv7533.c
@@ -172,7 +172,7 @@
 
 	of_property_read_u32(np, "adi,dsi-lanes", &num_lanes);
 
-	if (num_lanes < 1 || num_lanes > 4)
+	if (num_lanes < 2 || num_lanes > 4)
 		return -EINVAL;
 
 	adv->num_dsi_lanes = num_lanes;
@@ -181,8 +181,6 @@
 	if (!adv->host_node)
 		return -ENODEV;
 
-	of_node_put(adv->host_node);
-
 	adv->use_timing_gen = !of_property_read_bool(np,
 						"adi,disable-timing-generator");
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c
@@ -1027,7 +1027,6 @@
 	u32 status_reg;
 	u8 *buffer = msg->buffer;
 	unsigned int i;
-	int num_transferred = 0;
 	int ret;
 
 	/* Buffer size of AUX CH is 16 bytes */
@@ -1079,7 +1078,6 @@
 			reg = buffer[i];
 			writel(reg, dp->reg_base + ANALOGIX_DP_BUF_DATA_0 +
 			       4 * i);
-			num_transferred++;
 		}
 	}
 
@@ -1127,7 +1125,6 @@
 			reg = readl(dp->reg_base + ANALOGIX_DP_BUF_DATA_0 +
 				    4 * i);
 			buffer[i] = (unsigned char)reg;
-			num_transferred++;
 		}
 	}
 
@@ -1144,7 +1141,7 @@
 		 (msg->request & ~DP_AUX_I2C_MOT) == DP_AUX_NATIVE_READ)
 		msg->reply = DP_AUX_NATIVE_REPLY_ACK;
 
-	return num_transferred > 0 ? num_transferred : -EBUSY;
+	return msg->size;
 
 aux_error:
 	/* if aux err happen, reset aux */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/analogix/anx7625.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/analogix/anx7625.c
@@ -1255,10 +1255,10 @@
 	usleep_range(11000, 12000);
 
 	/* Power on pin enable */
-	gpiod_set_value(ctx->pdata.gpio_p_on, 1);
+	gpiod_set_value_cansleep(ctx->pdata.gpio_p_on, 1);
 	usleep_range(10000, 11000);
 	/* Power reset pin enable */
-	gpiod_set_value(ctx->pdata.gpio_reset, 1);
+	gpiod_set_value_cansleep(ctx->pdata.gpio_reset, 1);
 	usleep_range(10000, 11000);
 
 	DRM_DEV_DEBUG_DRIVER(dev, "power on !\n");
@@ -1278,9 +1278,9 @@
 		return;
 	}
 
-	gpiod_set_value(ctx->pdata.gpio_reset, 0);
+	gpiod_set_value_cansleep(ctx->pdata.gpio_reset, 0);
 	usleep_range(1000, 1100);
-	gpiod_set_value(ctx->pdata.gpio_p_on, 0);
+	gpiod_set_value_cansleep(ctx->pdata.gpio_p_on, 0);
 	usleep_range(1000, 1100);
 
 	ret = regulator_bulk_disable(ARRAY_SIZE(ctx->pdata.supplies),
@@ -1826,9 +1826,6 @@
 
 	DRM_DEV_DEBUG_DRIVER(dev, "sink detect\n");
 
-	if (ctx->pdata.panel_bridge)
-		return connector_status_connected;
-
 	return ctx->hpd_status ? connector_status_connected :
 				     connector_status_disconnected;
 }
@@ -2076,10 +2073,8 @@
 	};
 
 	host = of_find_mipi_dsi_host_by_node(ctx->pdata.mipi_host_node);
-	if (!host) {
-		DRM_DEV_ERROR(dev, "fail to find dsi host.\n");
-		return -EPROBE_DEFER;
-	}
+	if (!host)
+		return dev_err_probe(dev, -EPROBE_DEFER, "fail to find dsi host.\n");
 
 	dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
 	if (IS_ERR(dsi)) {
@@ -2227,6 +2222,9 @@
 
 	ctx->bridge_attached = 1;
 
+	if (ctx->pdata.panel_bridge->type == DRM_MODE_CONNECTOR_DisplayPort)
+		pm_runtime_get_sync(dev);
+
 	return 0;
 }
 
@@ -2235,6 +2233,9 @@
 	struct anx7625_data *ctx = bridge_to_anx7625(bridge);
 
 	drm_dp_aux_unregister(&ctx->aux);
+
+	if (ctx->pdata.panel_bridge->type == DRM_MODE_CONNECTOR_DisplayPort)
+		pm_runtime_put_sync(ctx->dev);
 }
 
 static enum drm_mode_status
@@ -2481,15 +2482,22 @@
 	mutex_unlock(&ctx->aux_lock);
 }
 
+static void
+anx7625_audio_update_connector_status(struct anx7625_data *ctx,
+				      enum drm_connector_status status);
+
 static enum drm_connector_status
 anx7625_bridge_detect(struct drm_bridge *bridge)
 {
 	struct anx7625_data *ctx = bridge_to_anx7625(bridge);
 	struct device *dev = ctx->dev;
+	enum drm_connector_status status;
 
 	DRM_DEV_DEBUG_DRIVER(dev, "drm bridge detect\n");
 
-	return anx7625_sink_detect(ctx);
+	status = anx7625_sink_detect(ctx);
+	anx7625_audio_update_connector_status(ctx, status);
+	return status;
 }
 
 static struct edid *anx7625_bridge_get_edid(struct drm_bridge *bridge,
@@ -2568,6 +2576,8 @@
 	mutex_lock(&ctx->lock);
 
 	anx7625_stop_dp_work(ctx);
+	if (!ctx->pdata.panel_bridge)
+		anx7625_remove_edid(ctx);
 	anx7625_power_standby(ctx);
 
 	mutex_unlock(&ctx->lock);
@@ -2617,7 +2627,7 @@
 	platform->bridge.of_node = dev->of_node;
 	if (!anx7625_of_panel_on_aux_bus(dev))
 		platform->bridge.ops |= DRM_BRIDGE_OP_EDID;
-	if (!platform->pdata.panel_bridge)
+	if (platform->pdata.panel_bridge->type == DRM_MODE_CONNECTOR_DisplayPort)
 		platform->bridge.ops |= DRM_BRIDGE_OP_HPD |
 					DRM_BRIDGE_OP_DETECT;
 	platform->bridge.type = platform->pdata.panel_bridge ?
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/aux-bridge.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/aux-bridge.c
@@ -58,9 +58,10 @@
 	adev->id = ret;
 	adev->name = "aux_bridge";
 	adev->dev.parent = parent;
-	adev->dev.of_node = of_node_get(parent->of_node);
 	adev->dev.release = drm_aux_bridge_release;
 
+	device_set_of_node_from_dev(&adev->dev, parent);
+
 	ret = auxiliary_device_init(adev);
 	if (ret) {
 		ida_free(&drm_aux_bridge_ida, adev->id);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
@@ -2057,6 +2057,9 @@
 	mhdp_state = to_cdns_mhdp_bridge_state(new_state);
 
 	mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode);
+	if (!mhdp_state->current_mode)
+		return;
+
 	drm_mode_set_name(mhdp_state->current_mode);
 
 	dev_dbg(mhdp->dev, "%s: Enabling mode %s\n", __func__, mode->name);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/chipone-icn6211.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/chipone-icn6211.c
@@ -563,10 +563,8 @@
 
 	host = of_find_mipi_dsi_host_by_node(host_node);
 	of_node_put(host_node);
-	if (!host) {
-		dev_err(dev, "failed to find dsi host\n");
-		return -EPROBE_DEFER;
-	}
+	if (!host)
+		return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n");
 
 	dsi = mipi_dsi_device_register_full(host, &info);
 	if (IS_ERR(dsi)) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/ite-it6505.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/ite-it6505.c
@@ -1306,9 +1306,15 @@
 	it6505_link_reset_step_train(it6505);
 	it6505_set_bits(it6505, REG_DATA_MUTE_CTRL, EN_VID_MUTE, EN_VID_MUTE);
 	it6505_set_bits(it6505, REG_INFOFRAME_CTRL, EN_VID_CTRL_PKT, 0x00);
-	it6505_set_bits(it6505, REG_RESET_CTRL, VIDEO_RESET, VIDEO_RESET);
+
+	it6505_set_bits(it6505, REG_VID_BUS_CTRL1, TX_FIFO_RESET, TX_FIFO_RESET);
+	it6505_set_bits(it6505, REG_VID_BUS_CTRL1, TX_FIFO_RESET, 0x00);
+
 	it6505_set_bits(it6505, REG_501_FIFO_CTRL, RST_501_FIFO, RST_501_FIFO);
 	it6505_set_bits(it6505, REG_501_FIFO_CTRL, RST_501_FIFO, 0x00);
+
+	it6505_set_bits(it6505, REG_RESET_CTRL, VIDEO_RESET, VIDEO_RESET);
+	usleep_range(1000, 2000);
 	it6505_set_bits(it6505, REG_RESET_CTRL, VIDEO_RESET, 0x00);
 }
 
@@ -2240,14 +2246,15 @@
 	ret = it6505_link_start_auto_train(it6505);
 	DRM_DEV_DEBUG_DRIVER(dev, "auto train %s, auto_train_retry: %d",
 			     ret ? "pass" : "failed", it6505->auto_train_retry);
-	it6505->auto_train_retry--;
 
 	if (ret) {
+		it6505->auto_train_retry = AUTO_TRAIN_RETRY;
 		it6505_link_train_ok(it6505);
-		return;
+	} else {
+		it6505->auto_train_retry--;
+		it6505_dump(it6505);
 	}
 
-	it6505_dump(it6505);
 }
 
 static void it6505_plugged_status_to_codec(struct it6505 *it6505)
@@ -2468,31 +2475,53 @@
 	schedule_work(&it6505->link_works);
 }
 
-static void it6505_irq_video_fifo_error(struct it6505 *it6505)
+static bool it6505_test_bit(unsigned int bit, const unsigned int *addr)
 {
-	struct device *dev = it6505->dev;
-
-	DRM_DEV_DEBUG_DRIVER(dev, "video fifo overflow interrupt");
-	it6505->auto_train_retry = AUTO_TRAIN_RETRY;
-	flush_work(&it6505->link_works);
-	it6505_stop_hdcp(it6505);
-	it6505_video_reset(it6505);
+	return 1 & (addr[bit / BITS_PER_BYTE] >> (bit % BITS_PER_BYTE));
 }
 
-static void it6505_irq_io_latch_fifo_overflow(struct it6505 *it6505)
+static void it6505_irq_video_handler(struct it6505 *it6505, const int *int_status)
 {
 	struct device *dev = it6505->dev;
+	int reg_0d, reg_int03;
 
-	DRM_DEV_DEBUG_DRIVER(dev, "IO latch fifo overflow interrupt");
-	it6505->auto_train_retry = AUTO_TRAIN_RETRY;
-	flush_work(&it6505->link_works);
-	it6505_stop_hdcp(it6505);
-	it6505_video_reset(it6505);
-}
+	/*
+	 * When video SCDT change with video not stable,
+	 * Or video FIFO error, need video reset
+	 */
+
+	if ((!it6505_get_video_status(it6505) &&
+	     (it6505_test_bit(INT_SCDT_CHANGE, (unsigned int *)int_status))) ||
+	    (it6505_test_bit(BIT_INT_IO_FIFO_OVERFLOW,
+			     (unsigned int *)int_status)) ||
+	    (it6505_test_bit(BIT_INT_VID_FIFO_ERROR,
+			     (unsigned int *)int_status))) {
+		it6505->auto_train_retry = AUTO_TRAIN_RETRY;
+		flush_work(&it6505->link_works);
+		it6505_stop_hdcp(it6505);
+		it6505_video_reset(it6505);
 
-static bool it6505_test_bit(unsigned int bit, const unsigned int *addr)
-{
-	return 1 & (addr[bit / BITS_PER_BYTE] >> (bit % BITS_PER_BYTE));
+		usleep_range(10000, 11000);
+
+		/*
+		 * Clear FIFO error IRQ to prevent fifo error -> reset loop
+		 * HW will trigger SCDT change IRQ again when video stable
+		 */
+
+		reg_int03 = it6505_read(it6505, INT_STATUS_03);
+		reg_0d = it6505_read(it6505, REG_SYSTEM_STS);
+
+		reg_int03 &= (BIT(INT_VID_FIFO_ERROR) | BIT(INT_IO_LATCH_FIFO_OVERFLOW));
+		it6505_write(it6505, INT_STATUS_03, reg_int03);
+
+		DRM_DEV_DEBUG_DRIVER(dev, "reg08 = 0x%02x", reg_int03);
+		DRM_DEV_DEBUG_DRIVER(dev, "reg0D = 0x%02x", reg_0d);
+
+		return;
+	}
+
+	if (it6505_test_bit(INT_SCDT_CHANGE, (unsigned int *)int_status))
+		it6505_irq_scdt(it6505);
 }
 
 static irqreturn_t it6505_int_threaded_handler(int unused, void *data)
@@ -2505,15 +2534,12 @@
 	} irq_vec[] = {
 		{ BIT_INT_HPD, it6505_irq_hpd },
 		{ BIT_INT_HPD_IRQ, it6505_irq_hpd_irq },
-		{ BIT_INT_SCDT, it6505_irq_scdt },
 		{ BIT_INT_HDCP_FAIL, it6505_irq_hdcp_fail },
 		{ BIT_INT_HDCP_DONE, it6505_irq_hdcp_done },
 		{ BIT_INT_AUX_CMD_FAIL, it6505_irq_aux_cmd_fail },
 		{ BIT_INT_HDCP_KSV_CHECK, it6505_irq_hdcp_ksv_check },
 		{ BIT_INT_AUDIO_FIFO_ERROR, it6505_irq_audio_fifo_error },
 		{ BIT_INT_LINK_TRAIN_FAIL, it6505_irq_link_train_fail },
-		{ BIT_INT_VID_FIFO_ERROR, it6505_irq_video_fifo_error },
-		{ BIT_INT_IO_FIFO_OVERFLOW, it6505_irq_io_latch_fifo_overflow },
 	};
 	int int_status[3], i;
 
@@ -2543,6 +2569,7 @@
 			if (it6505_test_bit(irq_vec[i].bit, (unsigned int *)int_status))
 				irq_vec[i].handler(it6505);
 		}
+		it6505_irq_video_handler(it6505, (unsigned int *)int_status);
 	}
 
 	pm_runtime_put_sync(dev);
@@ -2584,10 +2611,10 @@
 	/* time interval between OVDD and SYSRSTN at least be 10ms */
 	if (pdata->gpiod_reset) {
 		usleep_range(10000, 20000);
-		gpiod_set_value_cansleep(pdata->gpiod_reset, 0);
-		usleep_range(1000, 2000);
 		gpiod_set_value_cansleep(pdata->gpiod_reset, 1);
-		usleep_range(10000, 20000);
+		usleep_range(1000, 2000);
+		gpiod_set_value_cansleep(pdata->gpiod_reset, 0);
+		usleep_range(25000, 35000);
 	}
 
 	it6505->powered = true;
@@ -2613,7 +2640,7 @@
 	}
 
 	if (pdata->gpiod_reset)
-		gpiod_set_value_cansleep(pdata->gpiod_reset, 0);
+		gpiod_set_value_cansleep(pdata->gpiod_reset, 1);
 
 	if (pdata->pwr18) {
 		err = regulator_disable(pdata->pwr18);
@@ -3077,6 +3104,8 @@
 {
 	struct it6505 *it6505 = dev_get_drvdata(dev);
 
+	it6505_remove_edid(it6505);
+
 	return it6505_poweroff(it6505);
 }
 
@@ -3103,7 +3132,7 @@
 		return PTR_ERR(pdata->ovdd);
 	}
 
-	pdata->gpiod_reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);
+	pdata->gpiod_reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
 	if (IS_ERR(pdata->gpiod_reset)) {
 		dev_err(dev, "gpiod_reset gpio not found");
 		return PTR_ERR(pdata->gpiod_reset);
@@ -3474,6 +3503,7 @@
 	{ .compatible = "ite,it6505" },
 	{ }
 };
+MODULE_DEVICE_TABLE(of, it6505_of_match);
 
 static struct i2c_driver it6505_i2c_driver = {
 	.driver = {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/lontium-lt8912b.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/lontium-lt8912b.c
@@ -422,50 +422,31 @@
 	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
 };
 
-static enum drm_mode_status
-lt8912_connector_mode_valid(struct drm_connector *connector,
-			    struct drm_display_mode *mode)
-{
-	if (mode->clock > 150000)
-		return MODE_CLOCK_HIGH;
-
-	if (mode->hdisplay > 1920)
-		return MODE_BAD_HVALUE;
-
-	if (mode->vdisplay > 1080)
-		return MODE_BAD_VVALUE;
-
-	return MODE_OK;
-}
-
 static int lt8912_connector_get_modes(struct drm_connector *connector)
 {
-	struct edid *edid;
-	int ret = -1;
-	int num = 0;
+	const struct drm_edid *drm_edid;
 	struct lt8912 *lt = connector_to_lt8912(connector);
 	u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24;
+	int ret, num;
 
-	edid = drm_bridge_get_edid(lt->hdmi_port, connector);
-	if (edid) {
-		drm_connector_update_edid_property(connector, edid);
-		num = drm_add_edid_modes(connector, edid);
-	} else {
-		return ret;
-	}
+	drm_edid = drm_bridge_edid_read(lt->hdmi_port, connector);
+	drm_edid_connector_update(connector, drm_edid);
+	if (!drm_edid)
+		return 0;
+
+	num = drm_edid_connector_add_modes(connector);
 
 	ret = drm_display_info_set_bus_formats(&connector->display_info,
 					       &bus_format, 1);
-	if (ret)
-		num = ret;
+	if (ret < 0)
+		num = 0;
 
-	kfree(edid);
+	drm_edid_free(drm_edid);
 	return num;
 }
 
 static const struct drm_connector_helper_funcs lt8912_connector_helper_funcs = {
 	.get_modes = lt8912_connector_get_modes,
-	.mode_valid = lt8912_connector_mode_valid,
 };
 
 static void lt8912_bridge_mode_set(struct drm_bridge *bridge,
@@ -496,10 +477,8 @@
 						 };
 
 	host = of_find_mipi_dsi_host_by_node(lt->host_node);
-	if (!host) {
-		dev_err(dev, "failed to find dsi host\n");
-		return -EPROBE_DEFER;
-	}
+	if (!host)
+		return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n");
 
 	dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
 	if (IS_ERR(dsi)) {
@@ -609,6 +588,23 @@
 		drm_bridge_hpd_disable(lt->hdmi_port);
 }
 
+static enum drm_mode_status
+lt8912_bridge_mode_valid(struct drm_bridge *bridge,
+			 const struct drm_display_info *info,
+			 const struct drm_display_mode *mode)
+{
+	if (mode->clock > 150000)
+		return MODE_CLOCK_HIGH;
+
+	if (mode->hdisplay > 1920)
+		return MODE_BAD_HVALUE;
+
+	if (mode->vdisplay > 1080)
+		return MODE_BAD_VVALUE;
+
+	return MODE_OK;
+}
+
 static enum drm_connector_status
 lt8912_bridge_detect(struct drm_bridge *bridge)
 {
@@ -639,6 +635,7 @@
 static const struct drm_bridge_funcs lt8912_bridge_funcs = {
 	.attach = lt8912_bridge_attach,
 	.detach = lt8912_bridge_detach,
+	.mode_valid = lt8912_bridge_mode_valid,
 	.mode_set = lt8912_bridge_mode_set,
 	.enable = lt8912_bridge_enable,
 	.detect = lt8912_bridge_detect,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -760,10 +760,8 @@
 	int ret;
 
 	host = of_find_mipi_dsi_host_by_node(dsi_node);
-	if (!host) {
-		dev_err(lt9611->dev, "failed to find dsi host\n");
-		return ERR_PTR(-EPROBE_DEFER);
-	}
+	if (!host)
+		return ERR_PTR(dev_err_probe(lt9611->dev, -EPROBE_DEFER, "failed to find dsi host\n"));
 
 	dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
 	if (IS_ERR(dsi)) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/lontium-lt9611uxc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/lontium-lt9611uxc.c
@@ -265,10 +265,8 @@
 	int ret;
 
 	host = of_find_mipi_dsi_host_by_node(dsi_node);
-	if (!host) {
-		dev_err(dev, "failed to find dsi host\n");
-		return ERR_PTR(-EPROBE_DEFER);
-	}
+	if (!host)
+		return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n"));
 
 	dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
 	if (IS_ERR(dsi)) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/panel.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/panel.c
@@ -358,9 +358,12 @@
 
 static void devm_drm_panel_bridge_release(struct device *dev, void *res)
 {
-	struct drm_bridge **bridge = res;
+	struct drm_bridge *bridge = *(struct drm_bridge **)res;
 
-	drm_panel_bridge_remove(*bridge);
+	if (!bridge)
+		return;
+
+	drm_bridge_remove(bridge);
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/samsung-dsim.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/samsung-dsim.c
@@ -573,8 +573,8 @@
 	u16 _m, best_m;
 	u8 _s, best_s;
 
-	p_min = DIV_ROUND_UP(fin, (12 * MHZ));
-	p_max = fin / (6 * MHZ);
+	p_min = DIV_ROUND_UP(fin, (driver_data->pll_fin_max * MHZ));
+	p_max = fin / (driver_data->pll_fin_min * MHZ);
 
 	for (_p = p_min; _p <= p_max; ++_p) {
 		for (_s = 0; _s <= 5; ++_s) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/tc358767.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/tc358767.c
@@ -1579,6 +1579,13 @@
 				struct drm_connector *connector)
 {
 	struct tc_data *tc = bridge_to_tc(bridge);
+	int ret;
+
+	ret = tc_get_display_props(tc);
+	if (ret < 0) {
+		dev_err(tc->dev, "failed to read display props: %d\n", ret);
+		return 0;
+	}
 
 	return drm_get_edid(connector, &tc->aux.ddc);
 }
@@ -2034,7 +2041,7 @@
 		dev_err(tc->dev, "syserr %x\n", stat);
 	}
 
-	if (tc->hpd_pin >= 0 && tc->bridge.dev) {
+	if (tc->hpd_pin >= 0 && tc->bridge.dev && tc->aux.drm_dev) {
 		/*
 		 * H is triggered when the GPIO goes high.
 		 *
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/tc358768.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/tc358768.c
@@ -125,6 +125,9 @@
 #define TC358768_DSI_CONFW_MODE_CLR	(6 << 29)
 #define TC358768_DSI_CONFW_ADDR_DSI_CONTROL	(0x3 << 24)
 
+/* TC358768_DSICMD_TX (0x0600) register */
+#define TC358768_DSI_CMDTX_DC_START	BIT(0)
+
 static const char * const tc358768_supplies[] = {
 	"vddc", "vddmipi", "vddio"
 };
@@ -229,6 +232,21 @@
 		tc358768_write(priv, reg, tmp);
 }
 
+static void tc358768_dsicmd_tx(struct tc358768_priv *priv)
+{
+	u32 val;
+
+	/* start transfer */
+	tc358768_write(priv, TC358768_DSICMD_TX, TC358768_DSI_CMDTX_DC_START);
+	if (priv->error)
+		return;
+
+	/* wait transfer completion */
+	priv->error = regmap_read_poll_timeout(priv->regmap, TC358768_DSICMD_TX, val,
+					       (val & TC358768_DSI_CMDTX_DC_START) == 0,
+					       100, 100000);
+}
+
 static int tc358768_sw_reset(struct tc358768_priv *priv)
 {
 	/* Assert Reset */
@@ -516,8 +534,7 @@
 		}
 	}
 
-	/* start transfer */
-	tc358768_write(priv, TC358768_DSICMD_TX, 1);
+	tc358768_dsicmd_tx(priv);
 
 	ret = tc358768_clear_error(priv);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/tc358775.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/tc358775.c
@@ -454,10 +454,6 @@
 	dev_dbg(tc->dev, "bus_formats %04x bpc %d\n",
 		connector->display_info.bus_formats[0],
 		tc->bpc);
-	/*
-	 * Default hardware register settings of tc358775 configured
-	 * with MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA jeida-24 format
-	 */
 	if (connector->display_info.bus_formats[0] ==
 		MEDIA_BUS_FMT_RGB888_1X7X4_SPWG) {
 		/* VESA-24 */
@@ -468,14 +464,15 @@
 		d2l_write(tc->i2c, LV_MX1619, LV_MX(LVI_B6, LVI_B7, LVI_B1, LVI_B2));
 		d2l_write(tc->i2c, LV_MX2023, LV_MX(LVI_B3, LVI_B4, LVI_B5, LVI_L0));
 		d2l_write(tc->i2c, LV_MX2427, LV_MX(LVI_HS, LVI_VS, LVI_DE, LVI_R6));
-	} else { /*  MEDIA_BUS_FMT_RGB666_1X7X3_SPWG - JEIDA-18 */
-		d2l_write(tc->i2c, LV_MX0003, LV_MX(LVI_R0, LVI_R1, LVI_R2, LVI_R3));
-		d2l_write(tc->i2c, LV_MX0407, LV_MX(LVI_R4, LVI_L0, LVI_R5, LVI_G0));
-		d2l_write(tc->i2c, LV_MX0811, LV_MX(LVI_G1, LVI_G2, LVI_L0, LVI_L0));
-		d2l_write(tc->i2c, LV_MX1215, LV_MX(LVI_G3, LVI_G4, LVI_G5, LVI_B0));
-		d2l_write(tc->i2c, LV_MX1619, LV_MX(LVI_L0, LVI_L0, LVI_B1, LVI_B2));
-		d2l_write(tc->i2c, LV_MX2023, LV_MX(LVI_B3, LVI_B4, LVI_B5, LVI_L0));
-		d2l_write(tc->i2c, LV_MX2427, LV_MX(LVI_HS, LVI_VS, LVI_DE, LVI_L0));
+	} else {
+		/* JEIDA-18 and JEIDA-24 */
+		d2l_write(tc->i2c, LV_MX0003, LV_MX(LVI_R2, LVI_R3, LVI_R4, LVI_R5));
+		d2l_write(tc->i2c, LV_MX0407, LV_MX(LVI_R6, LVI_R1, LVI_R7, LVI_G2));
+		d2l_write(tc->i2c, LV_MX0811, LV_MX(LVI_G3, LVI_G4, LVI_G0, LVI_G1));
+		d2l_write(tc->i2c, LV_MX1215, LV_MX(LVI_G5, LVI_G6, LVI_G7, LVI_B2));
+		d2l_write(tc->i2c, LV_MX1619, LV_MX(LVI_B0, LVI_B1, LVI_B3, LVI_B4));
+		d2l_write(tc->i2c, LV_MX2023, LV_MX(LVI_B5, LVI_B6, LVI_B7, LVI_L0));
+		d2l_write(tc->i2c, LV_MX2427, LV_MX(LVI_HS, LVI_VS, LVI_DE, LVI_R0));
 	}
 
 	d2l_write(tc->i2c, VFUEN, VFUEN_EN);
@@ -610,10 +607,8 @@
 						};
 
 	host = of_find_mipi_dsi_host_by_node(tc->host_node);
-	if (!host) {
-		dev_err(dev, "failed to find dsi host\n");
-		return -EPROBE_DEFER;
-	}
+	if (!host)
+		return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n");
 
 	dsi = devm_mipi_dsi_device_register_full(dev, host, &info);
 	if (IS_ERR(dsi)) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/ti-dlpc3433.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/ti-dlpc3433.c
@@ -319,12 +319,11 @@
 		.channel = 0,
 		.node = NULL,
 	};
+	int ret;
 
 	host = of_find_mipi_dsi_host_by_node(dlpc->host_node);
-	if (!host) {
-		DRM_DEV_ERROR(dev, "failed to find dsi host\n");
-		return -EPROBE_DEFER;
-	}
+	if (!host)
+		return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n");
 
 	dlpc->dsi = mipi_dsi_device_register_full(host, &info);
 	if (IS_ERR(dlpc->dsi)) {
@@ -336,7 +335,11 @@
 	dlpc->dsi->format = MIPI_DSI_FMT_RGB565;
 	dlpc->dsi->lanes = dlpc->dsi_lanes;
 
-	return devm_mipi_dsi_attach(dev, dlpc->dsi);
+	ret = devm_mipi_dsi_attach(dev, dlpc->dsi);
+	if (ret)
+		DRM_DEV_ERROR(dev, "failed to attach dsi host\n");
+
+	return ret;
 }
 
 static int dlpc3433_probe(struct i2c_client *client)
@@ -367,10 +370,8 @@
 	drm_bridge_add(&dlpc->bridge);
 
 	ret = dlpc_host_attach(dlpc);
-	if (ret) {
-		DRM_DEV_ERROR(dev, "failed to attach dsi host\n");
+	if (ret)
 		goto err_remove_bridge;
-	}
 
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/ti-sn65dsi83.c
@@ -478,7 +478,6 @@
 		dev_err(ctx->dev, "failed to lock PLL, ret=%i\n", ret);
 		/* On failure, disable PLL again and exit. */
 		regmap_write(ctx->regmap, REG_RC_PLL_EN, 0x00);
-		regulator_disable(ctx->vcc);
 		return;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -1591,7 +1591,6 @@
 	pdata->pchip.ops = &ti_sn_pwm_ops;
 	pdata->pchip.npwm = 1;
 	pdata->pchip.of_xlate = of_pwm_single_xlate;
-	pdata->pchip.of_pwm_n_cells = 1;
 
 	devm_pm_runtime_enable(&adev->dev);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ci/gitlab-ci.yml
+++ linux-qcom-6.8.0/drivers/gpu/drm/ci/gitlab-ci.yml
@@ -1,6 +1,6 @@
 variables:
   DRM_CI_PROJECT_PATH: &drm-ci-project-path mesa/mesa
-  DRM_CI_COMMIT_SHA: &drm-ci-commit-sha edfbf74df1d4d6ce54ffe24566108be0e1a98c3d
+  DRM_CI_COMMIT_SHA: &drm-ci-commit-sha 9d162de9a05155e1c4041857a5848842749164cf
 
   UPSTREAM_REPO: git://anongit.freedesktop.org/drm/drm
   TARGET_BRANCH: drm-next
@@ -25,7 +25,9 @@
   # per-job artifact storage on MinIO
   JOB_ARTIFACTS_BASE: ${PIPELINE_ARTIFACTS_BASE}/${CI_JOB_ID}
   # default kernel for rootfs before injecting the current kernel tree
-  KERNEL_IMAGE_BASE: https://${S3_HOST}/mesa-lava/gfx-ci/linux/v6.4.12-for-mesa-ci-f6b4ad45f48d
+  KERNEL_REPO: "gfx-ci/linux"
+  KERNEL_TAG: "v6.6.4-for-mesa-ci-e4f4c500f7fb"
+  KERNEL_IMAGE_BASE: https://${S3_HOST}/mesa-lava/${KERNEL_REPO}/${KERNEL_TAG}
   LAVA_TAGS: subset-1-gfx
   LAVA_JOB_PRIORITY: 30
 
@@ -133,6 +135,11 @@
     - if: &is-pre-merge-for-marge '$GITLAB_USER_LOGIN == "marge-bot" && $CI_PIPELINE_SOURCE == "merge_request_event"'
       when: on_success
 
+.never-post-merge-rules:
+  rules:
+    - if: *is-post-merge
+      when: never
+
 # Rule to filter for only scheduled pipelines.
 .scheduled_pipeline-rules:
   rules:
@@ -150,6 +157,7 @@
 .build-rules:
   rules:
     - !reference [.no_scheduled_pipelines-rules, rules]
+    - !reference [.never-post-merge-rules, rules]
     # Run automatically once all dependency jobs have passed
     - when: on_success
 
@@ -157,6 +165,7 @@
 .container+build-rules:
   rules:
     - !reference [.no_scheduled_pipelines-rules, rules]
+    - !reference [.never-post-merge-rules, rules]
     - when: manual
 
 .ci-deqp-artifacts:
@@ -175,6 +184,7 @@
 .container-rules:
   rules:
     - !reference [.no_scheduled_pipelines-rules, rules]
+    - !reference [.never-post-merge-rules, rules]
     # Run pipeline by default in the main project if any CI pipeline
     # configuration files were changed, to ensure docker images are up to date
     - if: *is-post-merge
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ci/test.yml
+++ linux-qcom-6.8.0/drivers/gpu/drm/ci/test.yml
@@ -104,7 +104,10 @@
     DRIVER_NAME: msm
     BM_DTB: https://${PIPELINE_ARTIFACTS_BASE}/arm64/apq8016-sbc-usb-host.dtb
     GPU_VERSION: apq8016
-    BM_CMDLINE: "ip=dhcp console=ttyMSM0,115200n8 $BM_KERNEL_EXTRA_ARGS root=/dev/nfs rw nfsrootdebug nfsroot=,tcp,nfsvers=4.2 init=/init $BM_KERNELARGS"
+    # disabling unused clocks congests with the MDSS runtime PM trying to
+    # disable those clocks and causes boot to fail.
+    # Reproducer: DRM_MSM=y, DRM_I2C_ADV7511=m
+    BM_KERNEL_EXTRA_ARGS: clk_ignore_unused
     RUNNER_TAG: google-freedreno-db410c
   script:
     - ./install/bare-metal/fastboot.sh
@@ -234,11 +237,11 @@
 i915:tgl:
   extends:
     - .i915
-  parallel: 8
+  parallel: 5
   variables:
-    DEVICE_TYPE: asus-cx9400-volteer
+    DEVICE_TYPE: acer-cp514-2h-1130g7-volteer
     GPU_VERSION: tgl
-    RUNNER_TAG: mesa-ci-x86-64-lava-asus-cx9400-volteer
+    RUNNER_TAG: mesa-ci-x86-64-lava-acer-cp514-2h-1130g7-volteer
 
 .amdgpu:
   extends:
@@ -324,6 +327,7 @@
     GPU_VERSION: none
   extends:
     - .test-gl
+    - .test-rules
   tags:
     - kvm
   script:
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c
@@ -160,11 +160,11 @@
 
 static bool is_hdmi_adaptor(const char hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN])
 {
-	static const char dp_dual_mode_hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN] =
+	static const char dp_dual_mode_hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN + 1] =
 		"DP-HDMI ADAPTOR\x04";
 
 	return memcmp(hdmi_id, dp_dual_mode_hdmi_id,
-		      sizeof(dp_dual_mode_hdmi_id)) == 0;
+		      DP_DUAL_MODE_HDMI_ID_LEN) == 0;
 }
 
 static bool is_type1_adaptor(uint8_t adaptor_id)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/display/drm_dp_helper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/display/drm_dp_helper.c
@@ -533,6 +533,15 @@
 	mutex_lock(&aux->hw_mutex);
 
 	/*
+	 * If the device attached to the aux bus is powered down then there's
+	 * no reason to attempt a transfer. Error out immediately.
+	 */
+	if (aux->powered_down) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	/*
 	 * The specification doesn't give any recommendation on how often to
 	 * retry native transactions. We used to retry 7 times like for
 	 * aux i2c transactions but real world devices this wasn't
@@ -600,6 +609,29 @@
 EXPORT_SYMBOL(drm_dp_dpcd_probe);
 
 /**
+ * drm_dp_dpcd_set_powered() - Set whether the DP device is powered
+ * @aux: DisplayPort AUX channel; for convenience it's OK to pass NULL here
+ *       and the function will be a no-op.
+ * @powered: true if powered; false if not
+ *
+ * If the endpoint device on the DP AUX bus is known to be powered down
+ * then this function can be called to make future transfers fail immediately
+ * instead of needing to time out.
+ *
+ * If this function is never called then a device defaults to being powered.
+ */
+void drm_dp_dpcd_set_powered(struct drm_dp_aux *aux, bool powered)
+{
+	if (!aux)
+		return;
+
+	mutex_lock(&aux->hw_mutex);
+	aux->powered_down = !powered;
+	mutex_unlock(&aux->hw_mutex);
+}
+EXPORT_SYMBOL(drm_dp_dpcd_set_powered);
+
+/**
  * drm_dp_dpcd_read() - read a series of bytes from the DPCD
  * @aux: DisplayPort AUX channel (SST or MST)
  * @offset: address of the (first) register to read
@@ -1858,6 +1890,9 @@
 	struct drm_dp_aux_msg msg;
 	int err = 0;
 
+	if (aux->powered_down)
+		return -EBUSY;
+
 	dp_aux_i2c_transfer_size = clamp(dp_aux_i2c_transfer_size, 1, DP_AUX_MAX_PAYLOAD_BYTES);
 
 	memset(&msg, 0, sizeof(msg));
@@ -2917,6 +2952,103 @@
 EXPORT_SYMBOL(drm_dp_vsc_sdp_log);
 
 /**
+ * drm_dp_vsc_sdp_supported() - check if vsc sdp is supported
+ * @aux: DisplayPort AUX channel
+ * @dpcd: DisplayPort configuration data
+ *
+ * Returns true if vsc sdp is supported, else returns false
+ */
+bool drm_dp_vsc_sdp_supported(struct drm_dp_aux *aux, const u8 dpcd[DP_RECEIVER_CAP_SIZE])
+{
+	u8 rx_feature;
+
+	if (dpcd[DP_DPCD_REV] < DP_DPCD_REV_13)
+		return false;
+
+	if (drm_dp_dpcd_readb(aux, DP_DPRX_FEATURE_ENUMERATION_LIST, &rx_feature) != 1) {
+		drm_dbg_dp(aux->drm_dev, "failed to read DP_DPRX_FEATURE_ENUMERATION_LIST\n");
+		return false;
+	}
+
+	return (rx_feature & DP_VSC_SDP_EXT_FOR_COLORIMETRY_SUPPORTED);
+}
+EXPORT_SYMBOL(drm_dp_vsc_sdp_supported);
+
+/**
+ * drm_dp_vsc_sdp_pack() - pack a given vsc sdp into generic dp_sdp
+ * @vsc: vsc sdp initialized according to its purpose as defined in
+ *       table 2-118 - table 2-120 in DP 1.4a specification
+ * @sdp: valid handle to the generic dp_sdp which will be packed
+ *
+ * Returns length of sdp on success and error code on failure
+ */
+ssize_t drm_dp_vsc_sdp_pack(const struct drm_dp_vsc_sdp *vsc,
+			    struct dp_sdp *sdp)
+{
+	size_t length = sizeof(struct dp_sdp);
+
+	memset(sdp, 0, sizeof(struct dp_sdp));
+
+	/*
+	 * Prepare VSC Header for SU as per DP 1.4a spec, Table 2-119
+	 * VSC SDP Header Bytes
+	 */
+	sdp->sdp_header.HB0 = 0; /* Secondary-Data Packet ID = 0 */
+	sdp->sdp_header.HB1 = vsc->sdp_type; /* Secondary-data Packet Type */
+	sdp->sdp_header.HB2 = vsc->revision; /* Revision Number */
+	sdp->sdp_header.HB3 = vsc->length; /* Number of Valid Data Bytes */
+
+	if (vsc->revision == 0x6) {
+		sdp->db[0] = 1;
+		sdp->db[3] = 1;
+	}
+
+	/*
+	 * Revision 0x5 and revision 0x7 supports Pixel Encoding/Colorimetry
+	 * Format as per DP 1.4a spec and DP 2.0 respectively.
+	 */
+	if (!(vsc->revision == 0x5 || vsc->revision == 0x7))
+		goto out;
+
+	/* VSC SDP Payload for DB16 through DB18 */
+	/* Pixel Encoding and Colorimetry Formats  */
+	sdp->db[16] = (vsc->pixelformat & 0xf) << 4; /* DB16[7:4] */
+	sdp->db[16] |= vsc->colorimetry & 0xf; /* DB16[3:0] */
+
+	switch (vsc->bpc) {
+	case 6:
+		/* 6bpc: 0x0 */
+		break;
+	case 8:
+		sdp->db[17] = 0x1; /* DB17[3:0] */
+		break;
+	case 10:
+		sdp->db[17] = 0x2;
+		break;
+	case 12:
+		sdp->db[17] = 0x3;
+		break;
+	case 16:
+		sdp->db[17] = 0x4;
+		break;
+	default:
+		WARN(1, "Missing case %d\n", vsc->bpc);
+		return -EINVAL;
+	}
+
+	/* Dynamic Range and Component Bit Depth */
+	if (vsc->dynamic_range == DP_DYNAMIC_RANGE_CTA)
+		sdp->db[17] |= 0x80;  /* DB17[7] */
+
+	/* Content Type */
+	sdp->db[18] = vsc->content_type & 0x7;
+
+out:
+	return length;
+}
+EXPORT_SYMBOL(drm_dp_vsc_sdp_pack);
+
+/**
  * drm_dp_get_pcon_max_frl_bw() - maximum frl supported by PCON
  * @dpcd: DisplayPort configuration data
  * @port_cap: port capabilities
@@ -3982,6 +4114,13 @@
 	u32 overhead = 1000000;
 	int symbol_cycles;
 
+	if (lane_count == 0 || hactive == 0 || bpp_x16 == 0) {
+		DRM_DEBUG_KMS("Invalid BW overhead params: lane_count %d, hactive %d, bpp_x16 %d.%04d\n",
+			      lane_count, hactive,
+			      bpp_x16 >> 4, (bpp_x16 & 0xf) * 625);
+		return 0;
+	}
+
 	/*
 	 * DP Standard v2.1 2.6.4.1
 	 * SSC downspread and ref clock variation margin:
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/display/drm_dp_mst_topology.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/display/drm_dp_mst_topology.c
@@ -320,6 +320,9 @@
 	hdr->broadcast = (buf[idx] >> 7) & 0x1;
 	hdr->path_msg = (buf[idx] >> 6) & 0x1;
 	hdr->msg_len = buf[idx] & 0x3f;
+	if (hdr->msg_len < 1)		/* min space for body CRC */
+		return false;
+
 	idx++;
 	hdr->somt = (buf[idx] >> 7) & 0x1;
 	hdr->eomt = (buf[idx] >> 6) & 0x1;
@@ -2924,7 +2927,7 @@
 
 	/* FIXME: Actually do some real error handling here */
 	ret = drm_dp_mst_wait_tx_reply(mstb, txmsg);
-	if (ret <= 0) {
+	if (ret < 0) {
 		drm_err(mgr->dev, "Sending link address failed with %d\n", ret);
 		goto out;
 	}
@@ -2976,7 +2979,7 @@
 	mutex_unlock(&mgr->lock);
 
 out:
-	if (ret <= 0)
+	if (ret < 0)
 		mstb->link_address_sent = false;
 	kfree(txmsg);
 	return ret < 0 ? ret : changed;
@@ -3416,7 +3419,6 @@
 /**
  * drm_dp_add_payload_part2() - Execute payload update part 2
  * @mgr: Manager to use.
- * @state: The global atomic state
  * @payload: The payload to update
  *
  * If @payload was successfully assigned a starting time slot by drm_dp_add_payload_part1(), this
@@ -3425,14 +3427,13 @@
  * Returns: 0 on success, negative error code on failure.
  */
 int drm_dp_add_payload_part2(struct drm_dp_mst_topology_mgr *mgr,
-			     struct drm_atomic_state *state,
 			     struct drm_dp_mst_atomic_payload *payload)
 {
 	int ret = 0;
 
 	/* Skip failed payloads */
 	if (payload->payload_allocation_status != DRM_DP_MST_PAYLOAD_ALLOCATION_DFP) {
-		drm_dbg_kms(state->dev, "Part 1 of payload creation for %s failed, skipping part 2\n",
+		drm_dbg_kms(mgr->dev, "Part 1 of payload creation for %s failed, skipping part 2\n",
 			    payload->port->connector->name);
 		return -EIO;
 	}
@@ -3688,8 +3689,7 @@
 		ret = 0;
 		mgr->payload_id_table_cleared = false;
 
-		memset(&mgr->down_rep_recv, 0, sizeof(mgr->down_rep_recv));
-		memset(&mgr->up_req_recv, 0, sizeof(mgr->up_req_recv));
+		mgr->reset_rx_state = true;
 	}
 
 out_unlock:
@@ -3817,6 +3817,11 @@
 }
 EXPORT_SYMBOL(drm_dp_mst_topology_mgr_resume);
 
+static void reset_msg_rx_state(struct drm_dp_sideband_msg_rx *msg)
+{
+	memset(msg, 0, sizeof(*msg));
+}
+
 static bool
 drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up,
 		      struct drm_dp_mst_branch **mstb)
@@ -3895,6 +3900,34 @@
 	return true;
 }
 
+static int get_msg_request_type(u8 data)
+{
+	return data & 0x7f;
+}
+
+static bool verify_rx_request_type(struct drm_dp_mst_topology_mgr *mgr,
+				   const struct drm_dp_sideband_msg_tx *txmsg,
+				   const struct drm_dp_sideband_msg_rx *rxmsg)
+{
+	const struct drm_dp_sideband_msg_hdr *hdr = &rxmsg->initial_hdr;
+	const struct drm_dp_mst_branch *mstb = txmsg->dst;
+	int tx_req_type = get_msg_request_type(txmsg->msg[0]);
+	int rx_req_type = get_msg_request_type(rxmsg->msg[0]);
+	char rad_str[64];
+
+	if (tx_req_type == rx_req_type)
+		return true;
+
+	drm_dp_mst_rad_to_str(mstb->rad, mstb->lct, rad_str, sizeof(rad_str));
+	drm_dbg_kms(mgr->dev,
+		    "Got unexpected MST reply, mstb: %p seqno: %d lct: %d rad: %s rx_req_type: %s (%02x) != tx_req_type: %s (%02x)\n",
+		    mstb, hdr->seqno, mstb->lct, rad_str,
+		    drm_dp_mst_req_type_str(rx_req_type), rx_req_type,
+		    drm_dp_mst_req_type_str(tx_req_type), tx_req_type);
+
+	return false;
+}
+
 static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr)
 {
 	struct drm_dp_sideband_msg_tx *txmsg;
@@ -3924,6 +3957,9 @@
 		goto out_clear_reply;
 	}
 
+	if (!verify_rx_request_type(mgr, txmsg, msg))
+		goto out_clear_reply;
+
 	drm_dp_sideband_parse_reply(mgr, msg, &txmsg->reply);
 
 	if (txmsg->reply.reply_type == DP_SIDEBAND_REPLY_NAK) {
@@ -4031,9 +4067,10 @@
 static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
 {
 	struct drm_dp_pending_up_req *up_req;
+	struct drm_dp_mst_branch *mst_primary;
 
 	if (!drm_dp_get_one_sb_msg(mgr, true, NULL))
-		goto out;
+		goto out_clear_reply;
 
 	if (!mgr->up_req_recv.have_eomt)
 		return 0;
@@ -4051,15 +4088,25 @@
 		drm_dbg_kms(mgr->dev, "Received unknown up req type, ignoring: %x\n",
 			    up_req->msg.req_type);
 		kfree(up_req);
-		goto out;
+		goto out_clear_reply;
 	}
 
-	drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, up_req->msg.req_type,
+	mutex_lock(&mgr->lock);
+	mst_primary = mgr->mst_primary;
+	if (!mst_primary || !drm_dp_mst_topology_try_get_mstb(mst_primary)) {
+		mutex_unlock(&mgr->lock);
+		kfree(up_req);
+		goto out_clear_reply;
+	}
+	mutex_unlock(&mgr->lock);
+
+	drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type,
 				 false);
 
 	if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) {
 		const struct drm_dp_connection_status_notify *conn_stat =
 			&up_req->msg.u.conn_stat;
+		bool handle_csn;
 
 		drm_dbg_kms(mgr->dev, "Got CSN: pn: %d ldps:%d ddps: %d mcs: %d ip: %d pdt: %d\n",
 			    conn_stat->port_number,
@@ -4068,6 +4115,16 @@
 			    conn_stat->message_capability_status,
 			    conn_stat->input_port,
 			    conn_stat->peer_device_type);
+
+		mutex_lock(&mgr->probe_lock);
+		handle_csn = mst_primary->link_address_sent;
+		mutex_unlock(&mgr->probe_lock);
+
+		if (!handle_csn) {
+			drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it.");
+			kfree(up_req);
+			goto out_put_primary;
+		}
 	} else if (up_req->msg.req_type == DP_RESOURCE_STATUS_NOTIFY) {
 		const struct drm_dp_resource_status_notify *res_stat =
 			&up_req->msg.u.resource_stat;
@@ -4083,11 +4140,24 @@
 	mutex_unlock(&mgr->up_req_lock);
 	queue_work(system_long_wq, &mgr->up_req_work);
 
-out:
+out_put_primary:
+	drm_dp_mst_topology_put_mstb(mst_primary);
+out_clear_reply:
 	memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
 	return 0;
 }
 
+static void update_msg_rx_state(struct drm_dp_mst_topology_mgr *mgr)
+{
+	mutex_lock(&mgr->lock);
+	if (mgr->reset_rx_state) {
+		mgr->reset_rx_state = false;
+		reset_msg_rx_state(&mgr->down_rep_recv);
+		reset_msg_rx_state(&mgr->up_req_recv);
+	}
+	mutex_unlock(&mgr->lock);
+}
+
 /**
  * drm_dp_mst_hpd_irq_handle_event() - MST hotplug IRQ handle MST event
  * @mgr: manager to notify irq for.
@@ -4122,6 +4192,8 @@
 		*handled = true;
 	}
 
+	update_msg_rx_state(mgr);
+
 	if (esi[1] & DP_DOWN_REP_MSG_RDY) {
 		ret = drm_dp_mst_handle_down_rep(mgr);
 		*handled = true;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_atomic_helper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_atomic_helper.c
@@ -1375,7 +1375,7 @@
 		mode = &new_crtc_state->mode;
 		adjusted_mode = &new_crtc_state->adjusted_mode;
 
-		if (!new_crtc_state->mode_changed)
+		if (!new_crtc_state->mode_changed && !new_crtc_state->connectors_changed)
 			continue;
 
 		drm_dbg_atomic(dev, "modeset on [ENCODER:%d:%s]\n",
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_atomic_uapi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_atomic_uapi.c
@@ -543,7 +543,7 @@
 					&state->fb_damage_clips,
 					val,
 					-1,
-					sizeof(struct drm_rect),
+					sizeof(struct drm_mode_rect),
 					&replaced);
 		return ret;
 	} else if (property == plane->scaling_filter_property) {
@@ -1066,21 +1066,17 @@
 			break;
 		}
 
-		if (async_flip && prop != config->prop_fb_id) {
+		if (async_flip &&
+		    (plane_state->plane->type != DRM_PLANE_TYPE_PRIMARY ||
+		     (prop != config->prop_fb_id &&
+		      prop != config->prop_in_fence_fd &&
+		      prop != config->prop_fb_damage_clips))) {
 			ret = drm_atomic_plane_get_property(plane, plane_state,
 							    prop, &old_val);
 			ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop);
 			break;
 		}
 
-		if (async_flip && plane_state->plane->type != DRM_PLANE_TYPE_PRIMARY) {
-			drm_dbg_atomic(prop->dev,
-				       "[OBJECT:%d] Only primary planes can be changed during async flip\n",
-				       obj->id);
-			ret = -EINVAL;
-			break;
-		}
-
 		ret = drm_atomic_plane_set_property(plane,
 				plane_state, file_priv,
 				prop, prop_value);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_bridge.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_bridge.c
@@ -27,8 +27,9 @@
 #include <linux/mutex.h>
 
 #include <drm/drm_atomic_state_helper.h>
-#include <drm/drm_debugfs.h>
 #include <drm/drm_bridge.h>
+#include <drm/drm_debugfs.h>
+#include <drm/drm_edid.h>
 #include <drm/drm_encoder.h>
 #include <drm/drm_file.h>
 #include <drm/drm_of.h>
@@ -352,13 +353,8 @@
 	bridge->encoder = NULL;
 	list_del(&bridge->chain_node);
 
-#ifdef CONFIG_OF
 	DRM_ERROR("failed to attach bridge %pOF to encoder %s: %d\n",
 		  bridge->of_node, encoder->name, ret);
-#else
-	DRM_ERROR("failed to attach bridge to encoder %s: %d\n",
-		  encoder->name, ret);
-#endif
 
 	return ret;
 }
@@ -686,11 +682,17 @@
 				 */
 				list_for_each_entry_from(next, &encoder->bridge_chain,
 							 chain_node) {
-					if (next->pre_enable_prev_first) {
+					if (!next->pre_enable_prev_first) {
 						next = list_prev_entry(next, chain_node);
 						limit = next;
 						break;
 					}
+
+					if (list_is_last(&next->chain_node,
+							 &encoder->bridge_chain)) {
+						limit = next;
+						break;
+					}
 				}
 
 				/* Call these bridges in reverse order */
@@ -773,7 +775,7 @@
 					/* Found first bridge that does NOT
 					 * request prev to be enabled first
 					 */
-					limit = list_prev_entry(next, chain_node);
+					limit = next;
 					break;
 				}
 			}
@@ -1207,6 +1209,47 @@
 EXPORT_SYMBOL_GPL(drm_bridge_get_modes);
 
 /**
+ * drm_bridge_edid_read - read the EDID data of the connected display
+ * @bridge: bridge control structure
+ * @connector: the connector to read EDID for
+ *
+ * If the bridge supports output EDID retrieval, as reported by the
+ * DRM_BRIDGE_OP_EDID bridge ops flag, call &drm_bridge_funcs.edid_read to get
+ * the EDID and return it. Otherwise return NULL.
+ *
+ * If &drm_bridge_funcs.edid_read is not set, fall back to using
+ * drm_bridge_get_edid() and wrapping it in struct drm_edid.
+ *
+ * RETURNS:
+ * The retrieved EDID on success, or NULL otherwise.
+ */
+const struct drm_edid *drm_bridge_edid_read(struct drm_bridge *bridge,
+					    struct drm_connector *connector)
+{
+	if (!(bridge->ops & DRM_BRIDGE_OP_EDID))
+		return NULL;
+
+	/* Transitional: Fall back to ->get_edid. */
+	if (!bridge->funcs->edid_read) {
+		const struct drm_edid *drm_edid;
+		struct edid *edid;
+
+		edid = drm_bridge_get_edid(bridge, connector);
+		if (!edid)
+			return NULL;
+
+		drm_edid = drm_edid_alloc(edid, (edid->extensions + 1) * EDID_LENGTH);
+
+		kfree(edid);
+
+		return drm_edid;
+	}
+
+	return bridge->funcs->edid_read(bridge, connector);
+}
+EXPORT_SYMBOL_GPL(drm_bridge_edid_read);
+
+/**
  * drm_bridge_get_edid - get the EDID data of the connected display
  * @bridge: bridge control structure
  * @connector: the connector to read EDID for
@@ -1215,6 +1258,8 @@
  * DRM_BRIDGE_OP_EDID bridge ops flag, call &drm_bridge_funcs.get_edid to
  * get the EDID and return it. Otherwise return NULL.
  *
+ * Deprecated. Prefer using drm_bridge_edid_read().
+ *
  * RETURNS:
  * The retrieved EDID on success, or NULL otherwise.
  */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_bridge_connector.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_bridge_connector.c
@@ -335,11 +335,11 @@
 	bridge_connector->encoder = encoder;
 
 	/*
-	 * TODO: Handle doublescan_allowed, stereo_allowed and
-	 * ycbcr_420_allowed.
+	 * TODO: Handle doublescan_allowed and stereo_allowed.
 	 */
 	connector = &bridge_connector->base;
 	connector->interlace_allowed = true;
+	connector->ycbcr_420_allowed = true;
 
 	/*
 	 * Initialise connector status handling. First locate the furthest
@@ -352,6 +352,8 @@
 	drm_for_each_bridge_in_chain(encoder, bridge) {
 		if (!bridge->interlace_allowed)
 			connector->interlace_allowed = false;
+		if (!bridge->ycbcr_420_allowed)
+			connector->ycbcr_420_allowed = false;
 
 		if (bridge->ops & DRM_BRIDGE_OP_EDID)
 			bridge_connector->bridge_edid = bridge;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_client_modeset.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_client_modeset.c
@@ -777,6 +777,7 @@
 	unsigned int total_modes_count = 0;
 	struct drm_client_offset *offsets;
 	unsigned int connector_count = 0;
+	/* points to modes protected by mode_config.mutex */
 	struct drm_display_mode **modes;
 	struct drm_crtc **crtcs;
 	int i, ret = 0;
@@ -845,7 +846,6 @@
 		drm_client_pick_crtcs(client, connectors, connector_count,
 				      crtcs, modes, 0, width, height);
 	}
-	mutex_unlock(&dev->mode_config.mutex);
 
 	drm_client_modeset_release(client);
 
@@ -869,12 +869,18 @@
 
 			kfree(modeset->mode);
 			modeset->mode = drm_mode_duplicate(dev, mode);
+			if (!modeset->mode) {
+				ret = -ENOMEM;
+				break;
+			}
+
 			drm_connector_get(connector);
 			modeset->connectors[modeset->num_connectors++] = connector;
 			modeset->x = offset->x;
 			modeset->y = offset->y;
 		}
 	}
+	mutex_unlock(&dev->mode_config.mutex);
 
 	mutex_unlock(&client->modeset_mutex);
 out:
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_connector.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_connector.c
@@ -2940,7 +2940,7 @@
 						     dev->mode_config.max_width,
 						     dev->mode_config.max_height);
 		else
-			drm_dbg_kms(dev, "User-space requested a forced probe on [CONNECTOR:%d:%s] but is not the DRM master, demoting to read-only probe",
+			drm_dbg_kms(dev, "User-space requested a forced probe on [CONNECTOR:%d:%s] but is not the DRM master, demoting to read-only probe\n",
 				    connector->base.id, connector->name);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_drv.c
@@ -34,6 +34,7 @@
 #include <linux/pseudo_fs.h>
 #include <linux/slab.h>
 #include <linux/srcu.h>
+#include <linux/xarray.h>
 
 #include <drm/drm_accel.h>
 #include <drm/drm_cache.h>
@@ -53,8 +54,7 @@
 MODULE_DESCRIPTION("DRM shared core routines");
 MODULE_LICENSE("GPL and additional rights");
 
-static DEFINE_SPINLOCK(drm_minor_lock);
-static struct idr drm_minors_idr;
+DEFINE_XARRAY_ALLOC(drm_minors_xa);
 
 /*
  * If the drm core fails to init for whatever reason,
@@ -82,6 +82,18 @@
  * registered and unregistered dynamically according to device-state.
  */
 
+static struct xarray *drm_minor_get_xa(enum drm_minor_type type)
+{
+	if (type == DRM_MINOR_PRIMARY || type == DRM_MINOR_RENDER)
+		return &drm_minors_xa;
+#if IS_ENABLED(CONFIG_DRM_ACCEL)
+	else if (type == DRM_MINOR_ACCEL)
+		return &accel_minors_xa;
+#endif
+	else
+		return ERR_PTR(-EOPNOTSUPP);
+}
+
 static struct drm_minor **drm_minor_get_slot(struct drm_device *dev,
 					     enum drm_minor_type type)
 {
@@ -100,25 +112,31 @@
 static void drm_minor_alloc_release(struct drm_device *dev, void *data)
 {
 	struct drm_minor *minor = data;
-	unsigned long flags;
 
 	WARN_ON(dev != minor->dev);
 
 	put_device(minor->kdev);
 
-	if (minor->type == DRM_MINOR_ACCEL) {
-		accel_minor_remove(minor->index);
-	} else {
-		spin_lock_irqsave(&drm_minor_lock, flags);
-		idr_remove(&drm_minors_idr, minor->index);
-		spin_unlock_irqrestore(&drm_minor_lock, flags);
-	}
+	xa_erase(drm_minor_get_xa(minor->type), minor->index);
 }
 
+/*
+ * DRM used to support 64 devices, for backwards compatibility we need to maintain the
+ * minor allocation scheme where minors 0-63 are primary nodes, 64-127 are control nodes,
+ * and 128-191 are render nodes.
+ * After reaching the limit, we're allocating minors dynamically - first-come, first-serve.
+ * Accel nodes are using a distinct major, so the minors are allocated in continuous 0-MAX
+ * range.
+ */
+#define DRM_MINOR_LIMIT(t) ({ \
+	typeof(t) _t = (t); \
+	_t == DRM_MINOR_ACCEL ? XA_LIMIT(0, ACCEL_MAX_MINORS) : XA_LIMIT(64 * _t, 64 * _t + 63); \
+})
+#define DRM_EXTENDED_MINOR_LIMIT XA_LIMIT(192, (1 << MINORBITS) - 1)
+
 static int drm_minor_alloc(struct drm_device *dev, enum drm_minor_type type)
 {
 	struct drm_minor *minor;
-	unsigned long flags;
 	int r;
 
 	minor = drmm_kzalloc(dev, sizeof(*minor), GFP_KERNEL);
@@ -128,25 +146,14 @@
 	minor->type = type;
 	minor->dev = dev;
 
-	idr_preload(GFP_KERNEL);
-	if (type == DRM_MINOR_ACCEL) {
-		r = accel_minor_alloc();
-	} else {
-		spin_lock_irqsave(&drm_minor_lock, flags);
-		r = idr_alloc(&drm_minors_idr,
-			NULL,
-			64 * type,
-			64 * (type + 1),
-			GFP_NOWAIT);
-		spin_unlock_irqrestore(&drm_minor_lock, flags);
-	}
-	idr_preload_end();
-
+	r = xa_alloc(drm_minor_get_xa(type), &minor->index,
+		     NULL, DRM_MINOR_LIMIT(type), GFP_KERNEL);
+	if (r == -EBUSY && (type == DRM_MINOR_PRIMARY || type == DRM_MINOR_RENDER))
+		r = xa_alloc(&drm_minors_xa, &minor->index,
+			     NULL, DRM_EXTENDED_MINOR_LIMIT, GFP_KERNEL);
 	if (r < 0)
 		return r;
 
-	minor->index = r;
-
 	r = drmm_add_action_or_reset(dev, drm_minor_alloc_release, minor);
 	if (r)
 		return r;
@@ -162,7 +169,7 @@
 static int drm_minor_register(struct drm_device *dev, enum drm_minor_type type)
 {
 	struct drm_minor *minor;
-	unsigned long flags;
+	void *entry;
 	int ret;
 
 	DRM_DEBUG("\n");
@@ -185,13 +192,12 @@
 		goto err_debugfs;
 
 	/* replace NULL with @minor so lookups will succeed from now on */
-	if (minor->type == DRM_MINOR_ACCEL) {
-		accel_minor_replace(minor, minor->index);
-	} else {
-		spin_lock_irqsave(&drm_minor_lock, flags);
-		idr_replace(&drm_minors_idr, minor, minor->index);
-		spin_unlock_irqrestore(&drm_minor_lock, flags);
+	entry = xa_store(drm_minor_get_xa(type), minor->index, minor, GFP_KERNEL);
+	if (xa_is_err(entry)) {
+		ret = xa_err(entry);
+		goto err_debugfs;
 	}
+	WARN_ON(entry);
 
 	DRM_DEBUG("new minor registered %d\n", minor->index);
 	return 0;
@@ -204,20 +210,13 @@
 static void drm_minor_unregister(struct drm_device *dev, enum drm_minor_type type)
 {
 	struct drm_minor *minor;
-	unsigned long flags;
 
 	minor = *drm_minor_get_slot(dev, type);
 	if (!minor || !device_is_registered(minor->kdev))
 		return;
 
 	/* replace @minor with NULL so lookups will fail from now on */
-	if (minor->type == DRM_MINOR_ACCEL) {
-		accel_minor_replace(NULL, minor->index);
-	} else {
-		spin_lock_irqsave(&drm_minor_lock, flags);
-		idr_replace(&drm_minors_idr, NULL, minor->index);
-		spin_unlock_irqrestore(&drm_minor_lock, flags);
-	}
+	xa_store(drm_minor_get_xa(type), minor->index, NULL, GFP_KERNEL);
 
 	device_del(minor->kdev);
 	dev_set_drvdata(minor->kdev, NULL); /* safety belt */
@@ -233,16 +232,15 @@
  * minor->dev pointer will stay valid! However, the device may get unplugged and
  * unregistered while you hold the minor.
  */
-struct drm_minor *drm_minor_acquire(unsigned int minor_id)
+struct drm_minor *drm_minor_acquire(struct xarray *minor_xa, unsigned int minor_id)
 {
 	struct drm_minor *minor;
-	unsigned long flags;
 
-	spin_lock_irqsave(&drm_minor_lock, flags);
-	minor = idr_find(&drm_minors_idr, minor_id);
+	xa_lock(minor_xa);
+	minor = xa_load(minor_xa, minor_id);
 	if (minor)
 		drm_dev_get(minor->dev);
-	spin_unlock_irqrestore(&drm_minor_lock, flags);
+	xa_unlock(minor_xa);
 
 	if (!minor) {
 		return ERR_PTR(-ENODEV);
@@ -1031,7 +1029,7 @@
 
 	DRM_DEBUG("\n");
 
-	minor = drm_minor_acquire(iminor(inode));
+	minor = drm_minor_acquire(&drm_minors_xa, iminor(inode));
 	if (IS_ERR(minor))
 		return PTR_ERR(minor);
 
@@ -1066,7 +1064,7 @@
 	unregister_chrdev(DRM_MAJOR, "drm");
 	debugfs_remove(drm_debugfs_root);
 	drm_sysfs_destroy();
-	idr_destroy(&drm_minors_idr);
+	WARN_ON(!xa_empty(&drm_minors_xa));
 	drm_connector_ida_destroy();
 }
 
@@ -1075,7 +1073,6 @@
 	int ret;
 
 	drm_connector_ida_init();
-	idr_init(&drm_minors_idr);
 	drm_memcpy_init_early();
 
 	ret = drm_sysfs_init();
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_edid.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_edid.c
@@ -7345,7 +7345,7 @@
 static bool displayid_is_tiled_block(const struct displayid_iter *iter,
 				     const struct displayid_block *block)
 {
-	return (displayid_version(iter) == DISPLAY_ID_STRUCTURE_VER_12 &&
+	return (displayid_version(iter) < DISPLAY_ID_STRUCTURE_VER_20 &&
 		block->tag == DATA_BLOCK_TILED_DISPLAY) ||
 		(displayid_version(iter) == DISPLAY_ID_STRUCTURE_VER_20 &&
 		 block->tag == DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_fb_helper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_fb_helper.c
@@ -524,6 +524,9 @@
 	if (!info)
 		return ERR_PTR(-ENOMEM);
 
+	if (!drm_leak_fbdev_smem)
+		info->flags |= FBINFO_HIDE_SMEM_START;
+
 	ret = fb_alloc_cmap(&info->cmap, 256, 0);
 	if (ret)
 		goto err_release;
@@ -628,6 +631,17 @@
 static void drm_fb_helper_damage(struct drm_fb_helper *helper, u32 x, u32 y,
 				 u32 width, u32 height)
 {
+	/*
+	 * This function may be invoked by panic() to flush the frame
+	 * buffer, where all CPUs except the panic CPU are stopped.
+	 * During the following schedule_work(), the panic CPU needs
+	 * the worker_pool lock, which might be held by a stopped CPU,
+	 * causing schedule_work() and panic() to block. Return early on
+	 * oops_in_progress to prevent this blocking.
+	 */
+	if (oops_in_progress)
+		return;
+
 	drm_fb_helper_add_damage_clip(helper, x, y, width, height);
 
 	schedule_work(&helper->damage_work);
@@ -1860,9 +1874,6 @@
 	info = fb_helper->info;
 	info->var.pixclock = 0;
 
-	if (!drm_leak_fbdev_smem)
-		info->flags |= FBINFO_HIDE_SMEM_START;
-
 	/* Need to drop locks to avoid recursive deadlock in
 	 * register_framebuffer. This is ok because the only thing left to do is
 	 * register the fbdev emulation instance in kernel_fb_helper_list. */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_fbdev_dma.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_fbdev_dma.c
@@ -90,7 +90,8 @@
 		    sizes->surface_width, sizes->surface_height,
 		    sizes->surface_bpp);
 
-	format = drm_mode_legacy_fb_format(sizes->surface_bpp, sizes->surface_depth);
+	format = drm_driver_legacy_fb_format(dev, sizes->surface_bpp,
+					     sizes->surface_depth);
 	buffer = drm_client_framebuffer_create(client, sizes->surface_width,
 					       sizes->surface_height, format);
 	if (IS_ERR(buffer))
@@ -130,7 +131,10 @@
 		info->flags |= FBINFO_READS_FAST; /* signal caching */
 	info->screen_size = sizes->surface_height * fb->pitches[0];
 	info->screen_buffer = map.vaddr;
-	info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer));
+	if (!(info->flags & FBINFO_HIDE_SMEM_START)) {
+		if (!drm_WARN_ON(dev, is_vmalloc_addr(info->screen_buffer)))
+			info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer));
+	}
 	info->fix.smem_len = info->screen_size;
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_fbdev_generic.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_fbdev_generic.c
@@ -84,7 +84,8 @@
 		    sizes->surface_width, sizes->surface_height,
 		    sizes->surface_bpp);
 
-	format = drm_mode_legacy_fb_format(sizes->surface_bpp, sizes->surface_depth);
+	format = drm_driver_legacy_fb_format(dev, sizes->surface_bpp,
+					     sizes->surface_depth);
 	buffer = drm_client_framebuffer_create(client, sizes->surface_width,
 					       sizes->surface_height, format);
 	if (IS_ERR(buffer))
@@ -113,7 +114,6 @@
 	/* screen */
 	info->flags |= FBINFO_VIRTFB | FBINFO_READS_FAST;
 	info->screen_buffer = screen_buffer;
-	info->fix.smem_start = page_to_phys(vmalloc_to_page(info->screen_buffer));
 	info->fix.smem_len = screen_size;
 
 	/* deferred I/O */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_file.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_file.c
@@ -138,7 +138,7 @@
  */
 struct drm_file *drm_file_alloc(struct drm_minor *minor)
 {
-	static atomic64_t ident = ATOMIC_INIT(0);
+	static atomic64_t ident = ATOMIC64_INIT(0);
 	struct drm_device *dev = minor->dev;
 	struct drm_file *file;
 	int ret;
@@ -364,7 +364,7 @@
 	struct drm_minor *minor;
 	int retcode;
 
-	minor = drm_minor_acquire(iminor(inode));
+	minor = drm_minor_acquire(&drm_minors_xa, iminor(inode));
 	if (IS_ERR(minor))
 		return PTR_ERR(minor);
 
@@ -469,14 +469,12 @@
 
 	dev = filp->minor->dev;
 	mutex_lock(&dev->filelist_mutex);
+	get_pid(pid);
 	old = rcu_replace_pointer(filp->pid, pid, 1);
 	mutex_unlock(&dev->filelist_mutex);
 
-	if (pid != old) {
-		get_pid(pid);
-		synchronize_rcu();
-		put_pid(old);
-	}
+	synchronize_rcu();
+	put_pid(old);
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_gem_atomic_helper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_gem_atomic_helper.c
@@ -224,8 +224,8 @@
 
 	__drm_atomic_helper_plane_duplicate_state(plane, &new_shadow_plane_state->base);
 
-	drm_format_conv_state_copy(&shadow_plane_state->fmtcnv_state,
-				   &new_shadow_plane_state->fmtcnv_state);
+	drm_format_conv_state_copy(&new_shadow_plane_state->fmtcnv_state,
+				   &shadow_plane_state->fmtcnv_state);
 }
 EXPORT_SYMBOL(__drm_gem_duplicate_shadow_plane_state);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -610,6 +610,9 @@
 		return ret;
 	}
 
+	if (is_cow_mapping(vma->vm_flags))
+		return -EINVAL;
+
 	dma_resv_lock(shmem->base.resv, NULL);
 	ret = drm_gem_shmem_get_pages(shmem);
 	dma_resv_unlock(shmem->base.resv);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_internal.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_internal.h
@@ -79,10 +79,6 @@
 void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv,
 				 uint32_t handle);
 
-/* drm_drv.c */
-struct drm_minor *drm_minor_acquire(unsigned int minor_id);
-void drm_minor_release(struct drm_minor *minor);
-
 /* drm_managed.c */
 void drm_managed_release(struct drm_device *dev);
 void drmm_add_final_kfree(struct drm_device *dev, void *container);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_mipi_dsi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_mipi_dsi.c
@@ -654,7 +654,7 @@
  *
  * Return: 0 on success or a negative error code on failure.
  */
-ssize_t mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable)
+int mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable)
 {
 	/* Note: Needs updating for non-default PPS or algorithm */
 	u8 tx[2] = { enable << 0, 0 };
@@ -679,8 +679,8 @@
  *
  * Return: 0 on success or a negative error code on failure.
  */
-ssize_t mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi,
-				       const struct drm_dsc_picture_parameter_set *pps)
+int mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi,
+				   const struct drm_dsc_picture_parameter_set *pps)
 {
 	struct mipi_dsi_msg msg = {
 		.channel = dsi->channel,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_mm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_mm.c
@@ -151,7 +151,7 @@
 
 INTERVAL_TREE_DEFINE(struct drm_mm_node, rb,
 		     u64, __subtree_last,
-		     START, LAST, static inline, drm_mm_interval_tree)
+		     START, LAST, static inline __maybe_unused, drm_mm_interval_tree)
 
 struct drm_mm_node *
 __drm_mm_interval_first(const struct drm_mm *mm, u64 start, u64 last)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_modes.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_modes.c
@@ -1285,14 +1285,11 @@
  */
 int drm_mode_vrefresh(const struct drm_display_mode *mode)
 {
-	unsigned int num, den;
+	unsigned int num = 1, den = 1;
 
 	if (mode->htotal == 0 || mode->vtotal == 0)
 		return 0;
 
-	num = mode->clock;
-	den = mode->htotal * mode->vtotal;
-
 	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
 		num *= 2;
 	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
@@ -1300,6 +1297,12 @@
 	if (mode->vscan > 1)
 		den *= mode->vscan;
 
+	if (check_mul_overflow(mode->clock, num, &num))
+		return 0;
+
+	if (check_mul_overflow(mode->htotal * mode->vtotal, den, &den))
+		return 0;
+
 	return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(num, 1000), den);
 }
 EXPORT_SYMBOL(drm_mode_vrefresh);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_modeset_helper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_modeset_helper.c
@@ -193,13 +193,22 @@
 
 	if (!dev)
 		return 0;
+	/*
+	 * Don't disable polling if it was never initialized
+	 */
+	if (dev->mode_config.poll_enabled)
+		drm_kms_helper_poll_disable(dev);
 
-	drm_kms_helper_poll_disable(dev);
 	drm_fb_helper_set_suspend_unlocked(dev->fb_helper, 1);
 	state = drm_atomic_helper_suspend(dev);
 	if (IS_ERR(state)) {
 		drm_fb_helper_set_suspend_unlocked(dev->fb_helper, 0);
-		drm_kms_helper_poll_enable(dev);
+		/*
+		 * Don't enable polling if it was never initialized
+		 */
+		if (dev->mode_config.poll_enabled)
+			drm_kms_helper_poll_enable(dev);
+
 		return PTR_ERR(state);
 	}
 
@@ -239,7 +248,11 @@
 	dev->mode_config.suspend_state = NULL;
 
 	drm_fb_helper_set_suspend_unlocked(dev->fb_helper, 0);
-	drm_kms_helper_poll_enable(dev);
+	/*
+	 * Don't enable polling if it is not initialized
+	 */
+	if (dev->mode_config.poll_enabled)
+		drm_kms_helper_poll_enable(dev);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_panel.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_panel.c
@@ -274,19 +274,24 @@
  * The modes probed from the panel are automatically added to the connector
  * that the panel is attached to.
  *
- * Return: The number of modes available from the panel on success or a
- * negative error code on failure.
+ * Return: The number of modes available from the panel on success, or 0 on
+ * failure (no modes).
  */
 int drm_panel_get_modes(struct drm_panel *panel,
 			struct drm_connector *connector)
 {
 	if (!panel)
-		return -EINVAL;
+		return 0;
 
-	if (panel->funcs && panel->funcs->get_modes)
-		return panel->funcs->get_modes(panel, connector);
+	if (panel->funcs && panel->funcs->get_modes) {
+		int num;
 
-	return -EOPNOTSUPP;
+		num = panel->funcs->get_modes(panel, connector);
+		if (num > 0)
+			return num;
+	}
+
+	return 0;
 }
 EXPORT_SYMBOL(drm_panel_get_modes);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -117,6 +117,12 @@
 	.orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP,
 };
 
+static const struct drm_dmi_panel_orientation_data lcd1080x1920_rightside_up = {
+	.width = 1080,
+	.height = 1920,
+	.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+};
+
 static const struct drm_dmi_panel_orientation_data lcd1200x1920_rightside_up = {
 	.width = 1200,
 	.height = 1920,
@@ -178,6 +184,12 @@
 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
 		},
 		.driver_data = (void *)&lcd800x1280_rightside_up,
+	}, {	/* AYA NEO AYANEO 2 */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYANEO 2"),
+		},
+		.driver_data = (void *)&lcd1200x1920_rightside_up,
 	}, {	/* AYA NEO 2021 */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"),
@@ -190,12 +202,42 @@
 		  DMI_MATCH(DMI_PRODUCT_NAME, "AIR"),
 		},
 		.driver_data = (void *)&lcd1080x1920_leftside_up,
+	}, {	/* AYA NEO Founder */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYA NEO"),
+		  DMI_MATCH(DMI_PRODUCT_NAME, "AYA NEO Founder"),
+		},
+		.driver_data = (void *)&lcd800x1280_rightside_up,
+	}, {	/* AYA NEO GEEK */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"),
+		  DMI_MATCH(DMI_PRODUCT_NAME, "GEEK"),
+		},
+		.driver_data = (void *)&lcd800x1280_rightside_up,
 	}, {	/* AYA NEO NEXT */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"),
 		  DMI_MATCH(DMI_BOARD_NAME, "NEXT"),
 		},
 		.driver_data = (void *)&lcd800x1280_rightside_up,
+	}, {	/* AYA NEO KUN */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"),
+		  DMI_MATCH(DMI_BOARD_NAME, "KUN"),
+		},
+		.driver_data = (void *)&lcd1600x2560_rightside_up,
+	}, {    /* AYN Loki Max */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Loki Max"),
+		},
+		.driver_data = (void *)&lcd1080x1920_leftside_up,
+	}, {	/* AYN Loki Zero */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Loki Zero"),
+		},
+		.driver_data = (void *)&lcd1080x1920_leftside_up,
 	}, {	/* Chuwi HiBook (CWI514) */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"),
@@ -279,6 +321,12 @@
 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1618-03")
 		},
 		.driver_data = (void *)&lcd720x1280_rightside_up,
+	}, {	/* GPD Win Mini */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1617-01")
+		},
+		.driver_data = (void *)&lcd1080x1920_rightside_up,
 	}, {	/* I.T.Works TW891 */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."),
@@ -373,7 +421,6 @@
 	}, {	/* Lenovo Yoga Tab 3 X90F */
 		.matches = {
 		 DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
-		 DMI_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
 		 DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"),
 		},
 		.driver_data = (void *)&lcd1600x2560_rightside_up,
@@ -396,6 +443,12 @@
 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ONE XPLAYER"),
 		},
 		.driver_data = (void *)&lcd1600x2560_leftside_up,
+	}, {	/* OrangePi Neo */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "OrangePi"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "NEO-01"),
+		},
+		.driver_data = (void *)&lcd1200x1920_rightside_up,
 	}, {	/* Samsung GalaxyBook 10.6 */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
@@ -409,6 +462,13 @@
 		  DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "1"),
 		},
 		.driver_data = (void *)&lcd800x1280_rightside_up,
+	}, {	/* Valve Steam Deck */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Valve"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Galileo"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "1"),
+		},
+		.driver_data = (void *)&lcd800x1280_rightside_up,
 	}, {	/* VIOS LTH17 */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VIOS"),
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_prime.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_prime.c
@@ -582,7 +582,12 @@
 {
 	struct drm_gem_object *obj = dma_buf->priv;
 
-	if (!obj->funcs->get_sg_table)
+	/*
+	 * drm_gem_map_dma_buf() requires obj->get_sg_table(), but drivers
+	 * that implement their own ->map_dma_buf() do not.
+	 */
+	if (dma_buf->ops->map_dma_buf == drm_gem_map_dma_buf &&
+	    !obj->funcs->get_sg_table)
 		return -ENOSYS;
 
 	return drm_gem_pin(obj);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_print.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_print.c
@@ -100,8 +100,9 @@
 			copy = iterator->remain;
 
 		/* Copy out the bit of the string that we need */
-		memcpy(iterator->data,
-			str + (iterator->start - iterator->offset), copy);
+		if (iterator->data)
+			memcpy(iterator->data,
+			       str + (iterator->start - iterator->offset), copy);
 
 		iterator->offset = iterator->start + copy;
 		iterator->remain -= copy;
@@ -110,7 +111,8 @@
 
 		len = min_t(ssize_t, strlen(str), iterator->remain);
 
-		memcpy(iterator->data + pos, str, len);
+		if (iterator->data)
+			memcpy(iterator->data + pos, str, len);
 
 		iterator->offset += len;
 		iterator->remain -= len;
@@ -140,8 +142,9 @@
 	if ((iterator->offset >= iterator->start) && (len < iterator->remain)) {
 		ssize_t pos = iterator->offset - iterator->start;
 
-		snprintf(((char *) iterator->data) + pos,
-			iterator->remain, "%pV", vaf);
+		if (iterator->data)
+			snprintf(((char *) iterator->data) + pos,
+				 iterator->remain, "%pV", vaf);
 
 		iterator->offset += len;
 		iterator->remain -= len;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_probe_helper.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_probe_helper.c
@@ -293,14 +293,17 @@
  * Drivers can call this helper from their device resume implementation. It is
  * not an error to call this even when output polling isn't enabled.
  *
+ * If device polling was never initialized before, this call will trigger a
+ * warning and return.
+ *
  * Note that calls to enable and disable polling must be strictly ordered, which
  * is automatically the case when they're only call from suspend/resume
  * callbacks.
  */
 void drm_kms_helper_poll_enable(struct drm_device *dev)
 {
-	if (!dev->mode_config.poll_enabled || !drm_kms_helper_poll ||
-	    dev->mode_config.poll_running)
+	if (drm_WARN_ON_ONCE(dev, !dev->mode_config.poll_enabled) ||
+	    !drm_kms_helper_poll || dev->mode_config.poll_running)
 		return;
 
 	if (drm_kms_helper_enable_hpd(dev) ||
@@ -419,6 +422,13 @@
 
 	count = connector_funcs->get_modes(connector);
 
+	/* The .get_modes() callback should not return negative values. */
+	if (count < 0) {
+		drm_err(connector->dev, ".get_modes() returned %pe\n",
+			ERR_PTR(count));
+		count = 0;
+	}
+
 	/*
 	 * Fallback for when DDC probe failed in drm_get_edid() and thus skipped
 	 * override/firmware EDID.
@@ -619,8 +629,12 @@
 					 0);
 	}
 
-	/* Re-enable polling in case the global poll config changed. */
-	drm_kms_helper_poll_enable(dev);
+	/*
+	 * Re-enable polling in case the global poll config changed but polling
+	 * is still initialized.
+	 */
+	if (dev->mode_config.poll_enabled)
+		drm_kms_helper_poll_enable(dev);
 
 	if (connector->status == connector_status_disconnected) {
 		DRM_DEBUG_KMS("[CONNECTOR:%d:%s] disconnected\n",
@@ -873,12 +887,18 @@
  * not an error to call this even when output polling isn't enabled or already
  * disabled. Polling is re-enabled by calling drm_kms_helper_poll_enable().
  *
+ * If however, the polling was never initialized, this call will trigger a
+ * warning and return
+ *
  * Note that calls to enable and disable polling must be strictly ordered, which
  * is automatically the case when they're only call from suspend/resume
  * callbacks.
  */
 void drm_kms_helper_poll_disable(struct drm_device *dev)
 {
+	if (drm_WARN_ON(dev, !dev->mode_config.poll_enabled))
+		return;
+
 	if (dev->mode_config.poll_running)
 		drm_kms_helper_disable_hpd(dev);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/drm_syncobj.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/drm_syncobj.c
@@ -1459,6 +1459,7 @@
 	struct drm_syncobj *syncobj;
 	struct eventfd_ctx *ev_fd_ctx;
 	struct syncobj_eventfd_entry *entry;
+	int ret;
 
 	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
 		return -EOPNOTSUPP;
@@ -1474,13 +1475,15 @@
 		return -ENOENT;
 
 	ev_fd_ctx = eventfd_ctx_fdget(args->fd);
-	if (IS_ERR(ev_fd_ctx))
-		return PTR_ERR(ev_fd_ctx);
+	if (IS_ERR(ev_fd_ctx)) {
+		ret = PTR_ERR(ev_fd_ctx);
+		goto err_fdget;
+	}
 
 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
 	if (!entry) {
-		eventfd_ctx_put(ev_fd_ctx);
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto err_kzalloc;
 	}
 	entry->syncobj = syncobj;
 	entry->ev_fd_ctx = ev_fd_ctx;
@@ -1491,6 +1494,12 @@
 	drm_syncobj_put(syncobj);
 
 	return 0;
+
+err_kzalloc:
+	eventfd_ctx_put(ev_fd_ctx);
+err_fdget:
+	drm_syncobj_put(syncobj);
+	return ret;
 }
 
 int
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
@@ -482,7 +482,8 @@
 	} else {
 		CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_CACHE,
 				       VIVS_GL_FLUSH_CACHE_DEPTH |
-				       VIVS_GL_FLUSH_CACHE_COLOR);
+				       VIVS_GL_FLUSH_CACHE_COLOR |
+				       VIVS_GL_FLUSH_CACHE_SHADER_L1);
 		if (has_blt) {
 			CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1);
 			CMD_LOAD_STATE(buffer, VIVS_BLT_SET_COMMAND, 0x1);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/etnaviv/etnaviv_drv.c
@@ -494,7 +494,7 @@
 	.desc               = "etnaviv DRM",
 	.date               = "20151214",
 	.major              = 1,
-	.minor              = 3,
+	.minor              = 4,
 };
 
 /*
@@ -527,6 +527,16 @@
 	priv->num_gpus = 0;
 	priv->shm_gfp_mask = GFP_HIGHUSER | __GFP_RETRY_MAYFAIL | __GFP_NOWARN;
 
+	/*
+	 * If the GPU is part of a system with DMA addressing limitations,
+	 * request pages for our SHM backend buffers from the DMA32 zone to
+	 * hopefully avoid performance killing SWIOTLB bounce buffering.
+	 */
+	if (dma_addressing_limited(dev)) {
+		priv->shm_gfp_mask |= GFP_DMA32;
+		priv->shm_gfp_mask &= ~__GFP_HIGHMEM;
+	}
+
 	priv->cmdbuf_suballoc = etnaviv_cmdbuf_suballoc_new(drm->dev);
 	if (IS_ERR(priv->cmdbuf_suballoc)) {
 		dev_err(drm->dev, "Failed to create cmdbuf suballocator\n");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -356,9 +356,11 @@
 
 static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op)
 {
-	if (op & ETNA_PREP_READ)
+	op &= ETNA_PREP_READ | ETNA_PREP_WRITE;
+
+	if (op == ETNA_PREP_READ)
 		return DMA_FROM_DEVICE;
-	else if (op & ETNA_PREP_WRITE)
+	else if (op == ETNA_PREP_WRITE)
 		return DMA_TO_DEVICE;
 	else
 		return DMA_BIDIRECTIONAL;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -632,8 +632,8 @@
 	/* Disable TX clock gating on affected core revisions. */
 	if (etnaviv_is_model_rev(gpu, GC4000, 0x5222) ||
 	    etnaviv_is_model_rev(gpu, GC2000, 0x5108) ||
-	    etnaviv_is_model_rev(gpu, GC2000, 0x6202) ||
-	    etnaviv_is_model_rev(gpu, GC2000, 0x6203))
+	    etnaviv_is_model_rev(gpu, GC7000, 0x6202) ||
+	    etnaviv_is_model_rev(gpu, GC7000, 0x6203))
 		pmc |= VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_TX;
 
 	/* Disable SE and RA clock gating on affected core revisions. */
@@ -820,14 +820,6 @@
 	if (ret)
 		goto fail;
 
-	/*
-	 * If the GPU is part of a system with DMA addressing limitations,
-	 * request pages for our SHM backend buffers from the DMA32 zone to
-	 * hopefully avoid performance killing SWIOTLB bounce buffering.
-	 */
-	if (dma_addressing_limited(gpu->dev))
-		priv->shm_gfp_mask |= GFP_DMA32;
-
 	/* Create buffer: */
 	ret = etnaviv_cmdbuf_init(priv->cmdbuf_suballoc, &gpu->buffer,
 				  PAGE_SIZE);
@@ -1308,6 +1300,8 @@
 {
 	u32 val;
 
+	mutex_lock(&gpu->lock);
+
 	/* disable clock gating */
 	val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS);
 	val &= ~VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING;
@@ -1319,6 +1313,8 @@
 	gpu_write(gpu, VIVS_HI_CLOCK_CONTROL, val);
 
 	sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_PRE);
+
+	mutex_unlock(&gpu->lock);
 }
 
 static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,
@@ -1328,13 +1324,9 @@
 	unsigned int i;
 	u32 val;
 
-	sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_POST);
-
-	for (i = 0; i < submit->nr_pmrs; i++) {
-		const struct etnaviv_perfmon_request *pmr = submit->pmrs + i;
+	mutex_lock(&gpu->lock);
 
-		*pmr->bo_vma = pmr->sequence;
-	}
+	sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_POST);
 
 	/* disable debug register */
 	val = gpu_read(gpu, VIVS_HI_CLOCK_CONTROL);
@@ -1345,6 +1337,14 @@
 	val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS);
 	val |= VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING;
 	gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, val);
+
+	mutex_unlock(&gpu->lock);
+
+	for (i = 0; i < submit->nr_pmrs; i++) {
+		const struct etnaviv_perfmon_request *pmr = submit->pmrs + i;
+
+		*pmr->bo_vma = pmr->sequence;
+	}
 }
 
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c
@@ -265,6 +265,9 @@
 bool etnaviv_fill_identity_from_hwdb(struct etnaviv_gpu *gpu)
 {
 	struct etnaviv_chip_identity *ident = &gpu->identity;
+	const u32 product_id = ident->product_id;
+	const u32 customer_id = ident->customer_id;
+	const u32 eco_id = ident->eco_id;
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(etnaviv_chip_identities); i++) {
@@ -278,6 +281,12 @@
 			 etnaviv_chip_identities[i].eco_id == ~0U)) {
 			memcpy(ident, &etnaviv_chip_identities[i],
 			       sizeof(*ident));
+
+			/* Restore some id values as ~0U aka 'don't care' might been used. */
+			ident->product_id = product_id;
+			ident->customer_id = customer_id;
+			ident->eco_id = eco_id;
+
 			return true;
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/etnaviv/etnaviv_sched.c
@@ -38,9 +38,6 @@
 	u32 dma_addr;
 	int change;
 
-	/* block scheduler */
-	drm_sched_stop(&gpu->sched, sched_job);
-
 	/*
 	 * If the GPU managed to complete this jobs fence, the timout is
 	 * spurious. Bail out.
@@ -63,6 +60,9 @@
 		goto out_no_timeout;
 	}
 
+	/* block scheduler */
+	drm_sched_stop(&gpu->sched, sched_job);
+
 	if(sched_job)
 		drm_sched_increase_karma(sched_job);
 
@@ -76,8 +76,7 @@
 	return DRM_GPU_SCHED_STAT_NOMINAL;
 
 out_no_timeout:
-	/* restart scheduler after GPU is usable again */
-	drm_sched_start(&gpu->sched, true);
+	list_add(&sched_job->list, &sched_job->sched->pending_list);
 	return DRM_GPU_SCHED_STAT_NOMINAL;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/exynos/exynos_dp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/exynos/exynos_dp.c
@@ -286,7 +286,6 @@
 	.remove_new	= exynos_dp_remove,
 	.driver		= {
 		.name	= "exynos-dp",
-		.owner	= THIS_MODULE,
 		.pm	= pm_ptr(&exynos_dp_pm_ops),
 		.of_match_table = exynos_dp_match,
 	},
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1174,7 +1174,7 @@
 	struct exynos_drm_ipp *ipp = &ctx->ipp;
 
 	ctx->drm_dev = drm_dev;
-	ctx->drm_dev = drm_dev;
+	ipp->drm_dev = drm_dev;
 	exynos_drm_register_dma(drm_dev, dev, &ctx->dma_priv);
 
 	exynos_drm_ipp_register(dev, ipp, &ipp_funcs,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -309,6 +309,7 @@
 	struct vidi_context *ctx = ctx_from_connector(connector);
 	struct edid *edid;
 	int edid_len;
+	int count;
 
 	/*
 	 * the edid data comes from user side and it would be set
@@ -316,19 +317,23 @@
 	 */
 	if (!ctx->raw_edid) {
 		DRM_DEV_DEBUG_KMS(ctx->dev, "raw_edid is null.\n");
-		return -EFAULT;
+		return 0;
 	}
 
 	edid_len = (1 + ctx->raw_edid->extensions) * EDID_LENGTH;
 	edid = kmemdup(ctx->raw_edid, edid_len, GFP_KERNEL);
 	if (!edid) {
 		DRM_DEV_DEBUG_KMS(ctx->dev, "failed to allocate edid\n");
-		return -ENOMEM;
+		return 0;
 	}
 
 	drm_connector_update_edid_property(connector, edid);
 
-	return drm_add_edid_modes(connector, edid);
+	count = drm_add_edid_modes(connector, edid);
+
+	kfree(edid);
+
+	return count;
 }
 
 static const struct drm_connector_helper_funcs vidi_connector_helper_funcs = {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -887,11 +887,11 @@
 	int ret;
 
 	if (!hdata->ddc_adpt)
-		return -ENODEV;
+		goto no_edid;
 
 	edid = drm_get_edid(connector, hdata->ddc_adpt);
 	if (!edid)
-		return -ENODEV;
+		goto no_edid;
 
 	hdata->dvi_mode = !connector->display_info.is_hdmi;
 	DRM_DEV_DEBUG_KMS(hdata->dev, "%s : width[%d] x height[%d]\n",
@@ -906,6 +906,9 @@
 	kfree(edid);
 
 	return ret;
+
+no_edid:
+	return drm_add_modes_noedid(connector, 640, 480);
 }
 
 static int hdmi_find_phy_conf(struct hdmi_context *hdata, u32 pixel_clock)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/fsl-dcu/Kconfig
+++ linux-qcom-6.8.0/drivers/gpu/drm/fsl-dcu/Kconfig
@@ -8,6 +8,7 @@
 	select DRM_PANEL
 	select REGMAP_MMIO
 	select VIDEOMODE_HELPERS
+	select MFD_SYSCON if SOC_LS1021A
 	help
 	  Choose this option if you have an Freescale DCU chipset.
 	  If M is selected the module will be called fsl-dcu-drm.
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
@@ -100,6 +100,7 @@
 static int fsl_dcu_load(struct drm_device *dev, unsigned long flags)
 {
 	struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+	struct regmap *scfg;
 	int ret;
 
 	ret = fsl_dcu_drm_modeset_init(fsl_dev);
@@ -108,6 +109,20 @@
 		return ret;
 	}
 
+	scfg = syscon_regmap_lookup_by_compatible("fsl,ls1021a-scfg");
+	if (PTR_ERR(scfg) != -ENODEV) {
+		/*
+		 * For simplicity, enable the PIXCLK unconditionally,
+		 * resulting in increased power consumption. Disabling
+		 * the clock in PM or on unload could be implemented as
+		 * a future improvement.
+		 */
+		ret = regmap_update_bits(scfg, SCFG_PIXCLKCR, SCFG_PIXCLKCR_PXCEN,
+					 SCFG_PIXCLKCR_PXCEN);
+		if (ret < 0)
+			return dev_err_probe(dev->dev, ret, "failed to enable pixclk\n");
+	}
+
 	ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
 	if (ret < 0) {
 		dev_err(dev->dev, "failed to initialize vblank\n");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h
@@ -160,6 +160,9 @@
 #define FSL_DCU_ARGB4444		12
 #define FSL_DCU_YUV422			14
 
+#define SCFG_PIXCLKCR			0x28
+#define SCFG_PIXCLKCR_PXCEN		BIT(31)
+
 #define VF610_LAYER_REG_NUM		9
 #define LS1021A_LAYER_REG_NUM		10
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/gma500/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/gma500/Makefile
@@ -34,7 +34,6 @@
 	  psb_intel_lvds.o \
 	  psb_intel_modes.o \
 	  psb_intel_sdvo.o \
-	  psb_lid.o \
 	  psb_irq.o
 
 gma500_gfx-$(CONFIG_ACPI) +=  opregion.o
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/gma500/cdv_intel_lvds.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/gma500/cdv_intel_lvds.c
@@ -311,6 +311,9 @@
 	if (mode_dev->panel_fixed_mode != NULL) {
 		struct drm_display_mode *mode =
 		    drm_mode_duplicate(dev, mode_dev->panel_fixed_mode);
+		if (!mode)
+			return 0;
+
 		drm_mode_probed_add(connector, mode);
 		return 1;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/gma500/psb_device.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/gma500/psb_device.c
@@ -73,8 +73,7 @@
 	}
 
 	psb_intel_lvds_set_brightness(dev, PSB_MAX_BRIGHTNESS);
-	/* This must occur after the backlight is properly initialised */
-	psb_lid_timer_init(dev_priv);
+
 	return 0;
 }
 
@@ -259,8 +258,6 @@
 
 static void psb_chip_teardown(struct drm_device *dev)
 {
-	struct drm_psb_private *dev_priv = to_drm_psb_private(dev);
-	psb_lid_timer_takedown(dev_priv);
 	gma_intel_teardown_gmbus(dev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/gma500/psb_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/gma500/psb_drv.h
@@ -162,7 +162,6 @@
 #define PSB_NUM_VBLANKS 2
 
 #define PSB_WATCHDOG_DELAY (HZ * 2)
-#define PSB_LID_DELAY (HZ / 10)
 
 #define PSB_MAX_BRIGHTNESS		100
 
@@ -491,11 +490,7 @@
 	/* Hotplug handling */
 	struct work_struct hotplug_work;
 
-	/* LID-Switch */
-	spinlock_t lid_lock;
-	struct timer_list lid_timer;
 	struct psb_intel_opregion opregion;
-	u32 lid_last_state;
 
 	/* Watchdog */
 	uint32_t apm_reg;
@@ -591,10 +586,6 @@
 	int i2c_bus;		/* I2C bus identifier for Moorestown */
 };
 
-/* psb_lid.c */
-extern void psb_lid_timer_init(struct drm_psb_private *dev_priv);
-extern void psb_lid_timer_takedown(struct drm_psb_private *dev_priv);
-
 /* modesetting */
 extern void psb_modeset_init(struct drm_device *dev);
 extern void psb_modeset_cleanup(struct drm_device *dev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/gma500/psb_intel_lvds.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/gma500/psb_intel_lvds.c
@@ -504,6 +504,9 @@
 	if (mode_dev->panel_fixed_mode != NULL) {
 		struct drm_display_mode *mode =
 		    drm_mode_duplicate(dev, mode_dev->panel_fixed_mode);
+		if (!mode)
+			return 0;
+
 		drm_mode_probed_add(connector, mode);
 		return 1;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/Makefile
@@ -33,9 +33,9 @@
 subdir-ccflags-$(CONFIG_DRM_I915_WERROR) += -Werror
 
 # Fine grained warnings disable
-CFLAGS_i915_pci.o = $(call cc-disable-warning, override-init)
-CFLAGS_display/intel_display_device.o = $(call cc-disable-warning, override-init)
-CFLAGS_display/intel_fbdev.o = $(call cc-disable-warning, override-init)
+CFLAGS_i915_pci.o = -Wno-override-init
+CFLAGS_display/intel_display_device.o = -Wno-override-init
+CFLAGS_display/intel_fbdev.o = -Wno-override-init
 
 # Support compiling the display code separately for both i915 and xe
 # drivers. Define I915 when building i915.
@@ -118,6 +118,7 @@
 	gt/intel_ggtt_fencing.o \
 	gt/intel_gt.o \
 	gt/intel_gt_buffer_pool.o \
+	gt/intel_gt_ccs_mode.o \
 	gt/intel_gt_clock_utils.o \
 	gt/intel_gt_debugfs.o \
 	gt/intel_gt_engines_debugfs.o \
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/g4x_dp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/g4x_dp.c
@@ -717,7 +717,6 @@
 {
 	intel_enable_dp(state, encoder, pipe_config, conn_state);
 	intel_edp_backlight_on(pipe_config, conn_state);
-	encoder->audio_enable(encoder, pipe_config, conn_state);
 }
 
 static void vlv_enable_dp(struct intel_atomic_state *state,
@@ -726,7 +725,6 @@
 			  const struct drm_connector_state *conn_state)
 {
 	intel_edp_backlight_on(pipe_config, conn_state);
-	encoder->audio_enable(encoder, pipe_config, conn_state);
 }
 
 static void g4x_pre_enable_dp(struct intel_atomic_state *state,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/icl_dsi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/icl_dsi.c
@@ -1155,7 +1155,6 @@
 	}
 
 	intel_dsi_vbt_exec_sequence(intel_dsi, MIPI_SEQ_INIT_OTP);
-	intel_dsi_vbt_exec_sequence(intel_dsi, MIPI_SEQ_DISPLAY_ON);
 
 	/* ensure all panel commands dispatched before enabling transcoder */
 	wait_for_cmds_dispatched_to_panel(encoder);
@@ -1256,6 +1255,8 @@
 	/* step6d: enable dsi transcoder */
 	gen11_dsi_enable_transcoder(encoder);
 
+	intel_dsi_vbt_exec_sequence(intel_dsi, MIPI_SEQ_DISPLAY_ON);
+
 	/* step7: enable backlight */
 	intel_backlight_enable(crtc_state, conn_state);
 	intel_dsi_vbt_exec_sequence(intel_dsi, MIPI_SEQ_BACKLIGHT_ON);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_audio.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_audio.c
@@ -76,19 +76,6 @@
 				       struct intel_crtc_state *crtc_state);
 };
 
-/* DP N/M table */
-#define LC_810M	810000
-#define LC_540M	540000
-#define LC_270M	270000
-#define LC_162M	162000
-
-struct dp_aud_n_m {
-	int sample_rate;
-	int clock;
-	u16 m;
-	u16 n;
-};
-
 struct hdmi_aud_ncts {
 	int sample_rate;
 	int clock;
@@ -96,60 +83,6 @@
 	int cts;
 };
 
-/* Values according to DP 1.4 Table 2-104 */
-static const struct dp_aud_n_m dp_aud_n_m[] = {
-	{ 32000, LC_162M, 1024, 10125 },
-	{ 44100, LC_162M, 784, 5625 },
-	{ 48000, LC_162M, 512, 3375 },
-	{ 64000, LC_162M, 2048, 10125 },
-	{ 88200, LC_162M, 1568, 5625 },
-	{ 96000, LC_162M, 1024, 3375 },
-	{ 128000, LC_162M, 4096, 10125 },
-	{ 176400, LC_162M, 3136, 5625 },
-	{ 192000, LC_162M, 2048, 3375 },
-	{ 32000, LC_270M, 1024, 16875 },
-	{ 44100, LC_270M, 784, 9375 },
-	{ 48000, LC_270M, 512, 5625 },
-	{ 64000, LC_270M, 2048, 16875 },
-	{ 88200, LC_270M, 1568, 9375 },
-	{ 96000, LC_270M, 1024, 5625 },
-	{ 128000, LC_270M, 4096, 16875 },
-	{ 176400, LC_270M, 3136, 9375 },
-	{ 192000, LC_270M, 2048, 5625 },
-	{ 32000, LC_540M, 1024, 33750 },
-	{ 44100, LC_540M, 784, 18750 },
-	{ 48000, LC_540M, 512, 11250 },
-	{ 64000, LC_540M, 2048, 33750 },
-	{ 88200, LC_540M, 1568, 18750 },
-	{ 96000, LC_540M, 1024, 11250 },
-	{ 128000, LC_540M, 4096, 33750 },
-	{ 176400, LC_540M, 3136, 18750 },
-	{ 192000, LC_540M, 2048, 11250 },
-	{ 32000, LC_810M, 1024, 50625 },
-	{ 44100, LC_810M, 784, 28125 },
-	{ 48000, LC_810M, 512, 16875 },
-	{ 64000, LC_810M, 2048, 50625 },
-	{ 88200, LC_810M, 1568, 28125 },
-	{ 96000, LC_810M, 1024, 16875 },
-	{ 128000, LC_810M, 4096, 50625 },
-	{ 176400, LC_810M, 3136, 28125 },
-	{ 192000, LC_810M, 2048, 16875 },
-};
-
-static const struct dp_aud_n_m *
-audio_config_dp_get_n_m(const struct intel_crtc_state *crtc_state, int rate)
-{
-	int i;
-
-	for (i = 0; i < ARRAY_SIZE(dp_aud_n_m); i++) {
-		if (rate == dp_aud_n_m[i].sample_rate &&
-		    crtc_state->port_clock == dp_aud_n_m[i].clock)
-			return &dp_aud_n_m[i];
-	}
-
-	return NULL;
-}
-
 static const struct {
 	int clock;
 	u32 config;
@@ -387,47 +320,17 @@
 			   const struct intel_crtc_state *crtc_state)
 {
 	struct drm_i915_private *i915 = to_i915(encoder->base.dev);
-	struct i915_audio_component *acomp = i915->display.audio.component;
 	enum transcoder cpu_transcoder = crtc_state->cpu_transcoder;
-	enum port port = encoder->port;
-	const struct dp_aud_n_m *nm;
-	int rate;
-	u32 tmp;
-
-	rate = acomp ? acomp->aud_sample_rate[port] : 0;
-	nm = audio_config_dp_get_n_m(crtc_state, rate);
-	if (nm)
-		drm_dbg_kms(&i915->drm, "using Maud %u, Naud %u\n", nm->m,
-			    nm->n);
-	else
-		drm_dbg_kms(&i915->drm, "using automatic Maud, Naud\n");
-
-	tmp = intel_de_read(i915, HSW_AUD_CFG(cpu_transcoder));
-	tmp &= ~AUD_CONFIG_N_VALUE_INDEX;
-	tmp &= ~AUD_CONFIG_PIXEL_CLOCK_HDMI_MASK;
-	tmp &= ~AUD_CONFIG_N_PROG_ENABLE;
-	tmp |= AUD_CONFIG_N_VALUE_INDEX;
-
-	if (nm) {
-		tmp &= ~AUD_CONFIG_N_MASK;
-		tmp |= AUD_CONFIG_N(nm->n);
-		tmp |= AUD_CONFIG_N_PROG_ENABLE;
-	}
-
-	intel_de_write(i915, HSW_AUD_CFG(cpu_transcoder), tmp);
-
-	tmp = intel_de_read(i915, HSW_AUD_M_CTS_ENABLE(cpu_transcoder));
-	tmp &= ~AUD_CONFIG_M_MASK;
-	tmp &= ~AUD_M_CTS_M_VALUE_INDEX;
-	tmp &= ~AUD_M_CTS_M_PROG_ENABLE;
 
-	if (nm) {
-		tmp |= nm->m;
-		tmp |= AUD_M_CTS_M_VALUE_INDEX;
-		tmp |= AUD_M_CTS_M_PROG_ENABLE;
-	}
+	/* Enable time stamps. Let HW calculate Maud/Naud values */
+	intel_de_rmw(i915, HSW_AUD_CFG(cpu_transcoder),
+		     AUD_CONFIG_N_VALUE_INDEX |
+		     AUD_CONFIG_PIXEL_CLOCK_HDMI_MASK |
+		     AUD_CONFIG_UPPER_N_MASK |
+		     AUD_CONFIG_LOWER_N_MASK |
+		     AUD_CONFIG_N_PROG_ENABLE,
+		     AUD_CONFIG_N_VALUE_INDEX);
 
-	intel_de_write(i915, HSW_AUD_M_CTS_ENABLE(cpu_transcoder), tmp);
 }
 
 static void
@@ -1349,17 +1252,6 @@
 static void i915_audio_component_init(struct drm_i915_private *i915)
 {
 	u32 aud_freq, aud_freq_init;
-	int ret;
-
-	ret = component_add_typed(i915->drm.dev,
-				  &i915_audio_component_bind_ops,
-				  I915_COMPONENT_AUDIO);
-	if (ret < 0) {
-		drm_err(&i915->drm,
-			"failed to add audio component (%d)\n", ret);
-		/* continue with reduced functionality */
-		return;
-	}
 
 	if (DISPLAY_VER(i915) >= 9) {
 		aud_freq_init = intel_de_read(i915, AUD_FREQ_CNTRL);
@@ -1382,6 +1274,21 @@
 
 	/* init with current cdclk */
 	intel_audio_cdclk_change_post(i915);
+}
+
+static void i915_audio_component_register(struct drm_i915_private *i915)
+{
+	int ret;
+
+	ret = component_add_typed(i915->drm.dev,
+				  &i915_audio_component_bind_ops,
+				  I915_COMPONENT_AUDIO);
+	if (ret < 0) {
+		drm_err(&i915->drm,
+			"failed to add audio component (%d)\n", ret);
+		/* continue with reduced functionality */
+		return;
+	}
 
 	i915->display.audio.component_registered = true;
 }
@@ -1414,6 +1321,12 @@
 		i915_audio_component_init(i915);
 }
 
+void intel_audio_register(struct drm_i915_private *i915)
+{
+	if (!i915->display.audio.lpe.platdev)
+		i915_audio_component_register(i915);
+}
+
 /**
  * intel_audio_deinit() - deinitialize the audio driver
  * @i915: the i915 drm device private data
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_audio.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_audio.h
@@ -28,6 +28,7 @@
 void intel_audio_cdclk_change_pre(struct drm_i915_private *dev_priv);
 void intel_audio_cdclk_change_post(struct drm_i915_private *dev_priv);
 void intel_audio_init(struct drm_i915_private *dev_priv);
+void intel_audio_register(struct drm_i915_private *i915);
 void intel_audio_deinit(struct drm_i915_private *dev_priv);
 void intel_audio_sdp_split_update(const struct intel_crtc_state *crtc_state);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_backlight.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_backlight.c
@@ -1011,7 +1011,7 @@
 {
 	struct drm_i915_private *i915 = to_i915(connector->base.dev);
 
-	return DIV_ROUND_CLOSEST(KHz(RUNTIME_INFO(i915)->rawclk_freq),
+	return DIV_ROUND_CLOSEST(KHz(DISPLAY_RUNTIME_INFO(i915)->rawclk_freq),
 				 pwm_freq_hz);
 }
 
@@ -1073,7 +1073,7 @@
 {
 	struct drm_i915_private *i915 = to_i915(connector->base.dev);
 
-	return DIV_ROUND_CLOSEST(KHz(RUNTIME_INFO(i915)->rawclk_freq),
+	return DIV_ROUND_CLOSEST(KHz(DISPLAY_RUNTIME_INFO(i915)->rawclk_freq),
 				 pwm_freq_hz * 128);
 }
 
@@ -1091,7 +1091,7 @@
 	int clock;
 
 	if (IS_PINEVIEW(i915))
-		clock = KHz(RUNTIME_INFO(i915)->rawclk_freq);
+		clock = KHz(DISPLAY_RUNTIME_INFO(i915)->rawclk_freq);
 	else
 		clock = KHz(i915->display.cdclk.hw.cdclk);
 
@@ -1109,7 +1109,7 @@
 	int clock;
 
 	if (IS_G4X(i915))
-		clock = KHz(RUNTIME_INFO(i915)->rawclk_freq);
+		clock = KHz(DISPLAY_RUNTIME_INFO(i915)->rawclk_freq);
 	else
 		clock = KHz(i915->display.cdclk.hw.cdclk);
 
@@ -1133,7 +1133,7 @@
 			clock = MHz(25);
 		mul = 16;
 	} else {
-		clock = KHz(RUNTIME_INFO(i915)->rawclk_freq);
+		clock = KHz(DISPLAY_RUNTIME_INFO(i915)->rawclk_freq);
 		mul = 128;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_bios.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_bios.c
@@ -1042,22 +1042,11 @@
 	panel->vbt.backlight.type = INTEL_BACKLIGHT_DISPLAY_DDI;
 	panel->vbt.backlight.controller = 0;
 	if (i915->display.vbt.version >= 191) {
-		size_t exp_size;
+		const struct lfp_backlight_control_method *method;
 
-		if (i915->display.vbt.version >= 236)
-			exp_size = sizeof(struct bdb_lfp_backlight_data);
-		else if (i915->display.vbt.version >= 234)
-			exp_size = EXP_BDB_LFP_BL_DATA_SIZE_REV_234;
-		else
-			exp_size = EXP_BDB_LFP_BL_DATA_SIZE_REV_191;
-
-		if (get_blocksize(backlight_data) >= exp_size) {
-			const struct lfp_backlight_control_method *method;
-
-			method = &backlight_data->backlight_control[panel_type];
-			panel->vbt.backlight.type = method->type;
-			panel->vbt.backlight.controller = method->controller;
-		}
+		method = &backlight_data->backlight_control[panel_type];
+		panel->vbt.backlight.type = method->type;
+		panel->vbt.backlight.controller = method->controller;
 	}
 
 	panel->vbt.backlight.pwm_freq_hz = entry->pwm_freq_hz;
@@ -1952,16 +1941,12 @@
  * these devices we split the init OTP sequence into a deassert sequence and
  * the actual init OTP part.
  */
-static void fixup_mipi_sequences(struct drm_i915_private *i915,
-				 struct intel_panel *panel)
+static void vlv_fixup_mipi_sequences(struct drm_i915_private *i915,
+				     struct intel_panel *panel)
 {
 	u8 *init_otp;
 	int len;
 
-	/* Limit this to VLV for now. */
-	if (!IS_VALLEYVIEW(i915))
-		return;
-
 	/* Limit this to v1 vid-mode sequences */
 	if (panel->vbt.dsi.config->is_cmd_mode ||
 	    panel->vbt.dsi.seq_version != 1)
@@ -1997,6 +1982,41 @@
 	panel->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP] = init_otp + len - 1;
 }
 
+/*
+ * Some machines (eg. Lenovo 82TQ) appear to have broken
+ * VBT sequences:
+ * - INIT_OTP is not present at all
+ * - what should be in INIT_OTP is in DISPLAY_ON
+ * - what should be in DISPLAY_ON is in BACKLIGHT_ON
+ *   (along with the actual backlight stuff)
+ *
+ * To make those work we simply swap DISPLAY_ON and INIT_OTP.
+ *
+ * TODO: Do we need to limit this to specific machines,
+ *       or examine the contents of the sequences to
+ *       avoid false positives?
+ */
+static void icl_fixup_mipi_sequences(struct drm_i915_private *i915,
+				     struct intel_panel *panel)
+{
+	if (!panel->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP] &&
+	    panel->vbt.dsi.sequence[MIPI_SEQ_DISPLAY_ON]) {
+		drm_dbg_kms(&i915->drm, "Broken VBT: Swapping INIT_OTP and DISPLAY_ON sequences\n");
+
+		swap(panel->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP],
+		     panel->vbt.dsi.sequence[MIPI_SEQ_DISPLAY_ON]);
+	}
+}
+
+static void fixup_mipi_sequences(struct drm_i915_private *i915,
+				 struct intel_panel *panel)
+{
+	if (DISPLAY_VER(i915) >= 11)
+		icl_fixup_mipi_sequences(i915, panel);
+	else if (IS_VALLEYVIEW(i915))
+		vlv_fixup_mipi_sequences(i915, panel);
+}
+
 static void
 parse_mipi_sequence(struct drm_i915_private *i915,
 		    struct intel_panel *panel)
@@ -3344,6 +3364,9 @@
 {
 	const struct child_device_config *child = &devdata->child;
 
+	if (!devdata)
+		return false;
+
 	if (!intel_bios_encoder_supports_dp(devdata) ||
 	    !intel_bios_encoder_supports_hdmi(devdata))
 		return false;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_bw.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_bw.c
@@ -162,7 +162,9 @@
 				1);
 
 	if (ret < 0) {
-		drm_err(&dev_priv->drm, "Failed to disable qgv points (%d) points: 0x%x\n", ret, points_mask);
+		drm_err(&dev_priv->drm,
+			"Failed to disable qgv points (0x%x) points: 0x%x\n",
+			ret, points_mask);
 		return ret;
 	}
 
@@ -290,8 +292,10 @@
 		struct intel_qgv_point *sp = &qi->points[i];
 
 		ret = intel_read_qgv_point_info(dev_priv, sp, i);
-		if (ret)
+		if (ret) {
+			drm_dbg_kms(&dev_priv->drm, "Could not read QGV %d info\n", i);
 			return ret;
+		}
 
 		drm_dbg_kms(&dev_priv->drm,
 			    "QGV %d: DCLK=%d tRP=%d tRDPRE=%d tRAS=%d tRCD=%d tRC=%d\n",
@@ -659,6 +663,22 @@
 	return bi->psf_bw[psf_gv_point];
 }
 
+static unsigned int icl_qgv_bw(struct drm_i915_private *i915,
+			       int num_active_planes, int qgv_point)
+{
+	unsigned int idx;
+
+	if (DISPLAY_VER(i915) >= 12)
+		idx = tgl_max_bw_index(i915, num_active_planes, qgv_point);
+	else
+		idx = icl_max_bw_index(i915, num_active_planes, qgv_point);
+
+	if (idx >= ARRAY_SIZE(i915->display.bw.max))
+		return 0;
+
+	return i915->display.bw.max[idx].deratedbw[qgv_point];
+}
+
 void intel_bw_init_hw(struct drm_i915_private *dev_priv)
 {
 	if (!HAS_DISPLAY(dev_priv))
@@ -735,6 +755,7 @@
 		intel_bw_crtc_data_rate(crtc_state);
 	bw_state->num_active_planes[crtc->pipe] =
 		intel_bw_crtc_num_active_planes(crtc_state);
+	bw_state->force_check_qgv = true;
 
 	drm_dbg_kms(&i915->drm, "pipe %c data rate %u num active planes %u\n",
 		    pipe_name(crtc->pipe),
@@ -804,6 +825,80 @@
 	return to_intel_bw_state(bw_state);
 }
 
+static unsigned int icl_max_bw_qgv_point_mask(struct drm_i915_private *i915,
+					      int num_active_planes)
+{
+	unsigned int num_qgv_points = i915->display.bw.max[0].num_qgv_points;
+	unsigned int max_bw_point = 0;
+	unsigned int max_bw = 0;
+	int i;
+
+	for (i = 0; i < num_qgv_points; i++) {
+		unsigned int max_data_rate =
+			icl_qgv_bw(i915, num_active_planes, i);
+
+		/*
+		 * We need to know which qgv point gives us
+		 * maximum bandwidth in order to disable SAGV
+		 * if we find that we exceed SAGV block time
+		 * with watermarks. By that moment we already
+		 * have those, as it is calculated earlier in
+		 * intel_atomic_check,
+		 */
+		if (max_data_rate > max_bw) {
+			max_bw_point = BIT(i);
+			max_bw = max_data_rate;
+		}
+	}
+
+	return max_bw_point;
+}
+
+static u16 icl_prepare_qgv_points_mask(struct drm_i915_private *i915,
+				       unsigned int qgv_points,
+				       unsigned int psf_points)
+{
+	return ~(ICL_PCODE_REQ_QGV_PT(qgv_points) |
+		 ADLS_PCODE_REQ_PSF_PT(psf_points)) & icl_qgv_points_mask(i915);
+}
+
+static unsigned int icl_max_bw_psf_gv_point_mask(struct drm_i915_private *i915)
+{
+	unsigned int num_psf_gv_points = i915->display.bw.max[0].num_psf_gv_points;
+	unsigned int max_bw_point_mask = 0;
+	unsigned int max_bw = 0;
+	int i;
+
+	for (i = 0; i < num_psf_gv_points; i++) {
+		unsigned int max_data_rate = adl_psf_bw(i915, i);
+
+		if (max_data_rate > max_bw) {
+			max_bw_point_mask = BIT(i);
+			max_bw = max_data_rate;
+		} else if (max_data_rate == max_bw) {
+			max_bw_point_mask |= BIT(i);
+		}
+	}
+
+	return max_bw_point_mask;
+}
+
+static void icl_force_disable_sagv(struct drm_i915_private *i915,
+				   struct intel_bw_state *bw_state)
+{
+	unsigned int qgv_points = icl_max_bw_qgv_point_mask(i915, 0);
+	unsigned int psf_points = icl_max_bw_psf_gv_point_mask(i915);
+
+	bw_state->qgv_points_mask = icl_prepare_qgv_points_mask(i915,
+								qgv_points,
+								psf_points);
+
+	drm_dbg_kms(&i915->drm, "Forcing SAGV disable: mask 0x%x\n",
+		    bw_state->qgv_points_mask);
+
+	icl_pcode_restrict_qgv_points(i915, bw_state->qgv_points_mask);
+}
+
 static int mtl_find_qgv_points(struct drm_i915_private *i915,
 			       unsigned int data_rate,
 			       unsigned int num_active_planes,
@@ -881,8 +976,6 @@
 			       const struct intel_bw_state *old_bw_state,
 			       struct intel_bw_state *new_bw_state)
 {
-	unsigned int max_bw_point = 0;
-	unsigned int max_bw = 0;
 	unsigned int num_psf_gv_points = i915->display.bw.max[0].num_psf_gv_points;
 	unsigned int num_qgv_points = i915->display.bw.max[0].num_qgv_points;
 	u16 psf_points = 0;
@@ -895,31 +988,8 @@
 		return ret;
 
 	for (i = 0; i < num_qgv_points; i++) {
-		unsigned int idx;
-		unsigned int max_data_rate;
-
-		if (DISPLAY_VER(i915) >= 12)
-			idx = tgl_max_bw_index(i915, num_active_planes, i);
-		else
-			idx = icl_max_bw_index(i915, num_active_planes, i);
-
-		if (idx >= ARRAY_SIZE(i915->display.bw.max))
-			continue;
-
-		max_data_rate = i915->display.bw.max[idx].deratedbw[i];
-
-		/*
-		 * We need to know which qgv point gives us
-		 * maximum bandwidth in order to disable SAGV
-		 * if we find that we exceed SAGV block time
-		 * with watermarks. By that moment we already
-		 * have those, as it is calculated earlier in
-		 * intel_atomic_check,
-		 */
-		if (max_data_rate > max_bw) {
-			max_bw_point = i;
-			max_bw = max_data_rate;
-		}
+		unsigned int max_data_rate = icl_qgv_bw(i915,
+							num_active_planes, i);
 		if (max_data_rate >= data_rate)
 			qgv_points |= BIT(i);
 
@@ -963,20 +1033,18 @@
 	 * cause.
 	 */
 	if (!intel_can_enable_sagv(i915, new_bw_state)) {
-		qgv_points = BIT(max_bw_point);
-		drm_dbg_kms(&i915->drm, "No SAGV, using single QGV point %d\n",
-			    max_bw_point);
+		qgv_points = icl_max_bw_qgv_point_mask(i915, num_active_planes);
+		drm_dbg_kms(&i915->drm, "No SAGV, using single QGV point mask 0x%x\n",
+			    qgv_points);
 	}
 
 	/*
 	 * We store the ones which need to be masked as that is what PCode
 	 * actually accepts as a parameter.
 	 */
-	new_bw_state->qgv_points_mask =
-		~(ICL_PCODE_REQ_QGV_PT(qgv_points) |
-		  ADLS_PCODE_REQ_PSF_PT(psf_points)) &
-		icl_qgv_points_mask(i915);
-
+	new_bw_state->qgv_points_mask = icl_prepare_qgv_points_mask(i915,
+								    qgv_points,
+								    psf_points);
 	/*
 	 * If the actual mask had changed we need to make sure that
 	 * the commits are serialized(in case this is a nomodeset, nonblocking)
@@ -1272,8 +1340,9 @@
 	new_bw_state = intel_atomic_get_new_bw_state(state);
 
 	if (new_bw_state &&
-	    intel_can_enable_sagv(i915, old_bw_state) !=
-	    intel_can_enable_sagv(i915, new_bw_state))
+	    (intel_can_enable_sagv(i915, old_bw_state) !=
+	     intel_can_enable_sagv(i915, new_bw_state) ||
+	     new_bw_state->force_check_qgv))
 		changed = true;
 
 	/*
@@ -1287,6 +1356,8 @@
 	if (ret)
 		return ret;
 
+	new_bw_state->force_check_qgv = false;
+
 	return 0;
 }
 
@@ -1313,7 +1384,7 @@
 	.atomic_destroy_state = intel_bw_destroy_state,
 };
 
-int intel_bw_init(struct drm_i915_private *dev_priv)
+int intel_bw_init(struct drm_i915_private *i915)
 {
 	struct intel_bw_state *state;
 
@@ -1321,8 +1392,15 @@
 	if (!state)
 		return -ENOMEM;
 
-	intel_atomic_global_obj_init(dev_priv, &dev_priv->display.bw.obj,
+	intel_atomic_global_obj_init(i915, &i915->display.bw.obj,
 				     &state->base, &intel_bw_funcs);
 
+	/*
+	 * Limit this only if we have SAGV. And for Display version 14 onwards
+	 * sagv is handled though pmdemand requests
+	 */
+	if (intel_has_sagv(i915) && IS_DISPLAY_VER(i915, 11, 13))
+		icl_force_disable_sagv(i915, state);
+
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_bw.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_bw.h
@@ -47,6 +47,12 @@
 	 */
 	u16 qgv_points_mask;
 
+	/*
+	 * Flag to force the QGV comparison in atomic check right after the
+	 * hw state readout
+	 */
+	bool force_check_qgv;
+
 	int min_cdclk[I915_MAX_PIPES];
 	unsigned int data_rate[I915_MAX_PIPES];
 	u8 num_active_planes[I915_MAX_PIPES];
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_cdclk.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_cdclk.c
@@ -2512,7 +2512,8 @@
 		intel_atomic_get_old_cdclk_state(state);
 	const struct intel_cdclk_state *new_cdclk_state =
 		intel_atomic_get_new_cdclk_state(state);
-	enum pipe pipe = new_cdclk_state->pipe;
+	struct intel_cdclk_config cdclk_config;
+	enum pipe pipe;
 
 	if (!intel_cdclk_changed(&old_cdclk_state->actual,
 				 &new_cdclk_state->actual))
@@ -2521,12 +2522,25 @@
 	if (IS_DG2(i915))
 		intel_cdclk_pcode_pre_notify(state);
 
-	if (pipe == INVALID_PIPE ||
-	    old_cdclk_state->actual.cdclk <= new_cdclk_state->actual.cdclk) {
-		drm_WARN_ON(&i915->drm, !new_cdclk_state->base.changed);
+	if (new_cdclk_state->disable_pipes) {
+		cdclk_config = new_cdclk_state->actual;
+		pipe = INVALID_PIPE;
+	} else {
+		if (new_cdclk_state->actual.cdclk >= old_cdclk_state->actual.cdclk) {
+			cdclk_config = new_cdclk_state->actual;
+			pipe = new_cdclk_state->pipe;
+		} else {
+			cdclk_config = old_cdclk_state->actual;
+			pipe = INVALID_PIPE;
+		}
 
-		intel_set_cdclk(i915, &new_cdclk_state->actual, pipe);
+		cdclk_config.voltage_level = max(new_cdclk_state->actual.voltage_level,
+						 old_cdclk_state->actual.voltage_level);
 	}
+
+	drm_WARN_ON(&i915->drm, !new_cdclk_state->base.changed);
+
+	intel_set_cdclk(i915, &cdclk_config, pipe);
 }
 
 /**
@@ -2544,7 +2558,7 @@
 		intel_atomic_get_old_cdclk_state(state);
 	const struct intel_cdclk_state *new_cdclk_state =
 		intel_atomic_get_new_cdclk_state(state);
-	enum pipe pipe = new_cdclk_state->pipe;
+	enum pipe pipe;
 
 	if (!intel_cdclk_changed(&old_cdclk_state->actual,
 				 &new_cdclk_state->actual))
@@ -2553,12 +2567,15 @@
 	if (IS_DG2(i915))
 		intel_cdclk_pcode_post_notify(state);
 
-	if (pipe != INVALID_PIPE &&
-	    old_cdclk_state->actual.cdclk > new_cdclk_state->actual.cdclk) {
-		drm_WARN_ON(&i915->drm, !new_cdclk_state->base.changed);
+	if (!new_cdclk_state->disable_pipes &&
+	    new_cdclk_state->actual.cdclk < old_cdclk_state->actual.cdclk)
+		pipe = new_cdclk_state->pipe;
+	else
+		pipe = INVALID_PIPE;
 
-		intel_set_cdclk(i915, &new_cdclk_state->actual, pipe);
-	}
+	drm_WARN_ON(&i915->drm, !new_cdclk_state->base.changed);
+
+	intel_set_cdclk(i915, &new_cdclk_state->actual, pipe);
 }
 
 static int intel_pixel_rate_to_cdclk(const struct intel_crtc_state *crtc_state)
@@ -3036,6 +3053,7 @@
 		return NULL;
 
 	cdclk_state->pipe = INVALID_PIPE;
+	cdclk_state->disable_pipes = false;
 
 	return &cdclk_state->base;
 }
@@ -3214,6 +3232,8 @@
 		if (ret)
 			return ret;
 
+		new_cdclk_state->disable_pipes = true;
+
 		drm_dbg_kms(&dev_priv->drm,
 			    "Modeset required for cdclk change\n");
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_cdclk.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_cdclk.h
@@ -51,6 +51,9 @@
 
 	/* bitmask of active pipes */
 	u8 active_pipes;
+
+	/* update cdclk with pipes disabled */
+	bool disable_pipes;
 };
 
 int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_color.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_color.c
@@ -1328,19 +1328,29 @@
 	lut = blob->data;
 
 	/*
-	 * DSB fails to correctly load the legacy LUT
-	 * unless we either write each entry twice,
-	 * or use non-posted writes
+	 * DSB fails to correctly load the legacy LUT unless
+	 * we either write each entry twice when using posted
+	 * writes, or we use non-posted writes.
+	 *
+	 * If palette anti-collision is active during LUT
+	 * register writes:
+	 * - posted writes simply get dropped and thus the LUT
+	 *   contents may not be correctly updated
+	 * - non-posted writes are blocked and thus the LUT
+	 *   contents are always correct, but simultaneous CPU
+	 *   MMIO access will start to fail
+	 *
+	 * Choose the lesser of two evils and use posted writes.
+	 * Using posted writes is also faster, even when having
+	 * to write each register twice.
 	 */
-	if (crtc_state->dsb)
-		intel_dsb_nonpost_start(crtc_state->dsb);
-
-	for (i = 0; i < 256; i++)
+	for (i = 0; i < 256; i++) {
 		ilk_lut_write(crtc_state, LGC_PALETTE(pipe, i),
 			      i9xx_lut_8(&lut[i]));
-
-	if (crtc_state->dsb)
-		intel_dsb_nonpost_end(crtc_state->dsb);
+		if (crtc_state->dsb)
+			ilk_lut_write(crtc_state, LGC_PALETTE(pipe, i),
+				      i9xx_lut_8(&lut[i]));
+	}
 }
 
 static void ilk_load_lut_10(const struct intel_crtc_state *crtc_state,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_cursor.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_cursor.c
@@ -35,12 +35,10 @@
 {
 	struct drm_i915_private *dev_priv =
 		to_i915(plane_state->uapi.plane->dev);
-	const struct drm_framebuffer *fb = plane_state->hw.fb;
-	struct drm_i915_gem_object *obj = intel_fb_obj(fb);
 	u32 base;
 
 	if (DISPLAY_INFO(dev_priv)->cursor_needs_physical)
-		base = i915_gem_object_get_dma_address(obj, 0);
+		base = plane_state->phys_dma_addr;
 	else
 		base = intel_plane_ggtt_offset(plane_state);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_cx0_phy.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_cx0_phy.c
@@ -1892,14 +1892,6 @@
 		      0, C10_VDR_CTRL_MSGBUS_ACCESS,
 		      MB_WRITE_COMMITTED);
 
-	/* Custom width needs to be programmed to 0 for both the phy lanes */
-	intel_cx0_rmw(i915, encoder->port, INTEL_CX0_BOTH_LANES, PHY_C10_VDR_CUSTOM_WIDTH,
-		      C10_VDR_CUSTOM_WIDTH_MASK, C10_VDR_CUSTOM_WIDTH_8_10,
-		      MB_WRITE_COMMITTED);
-	intel_cx0_rmw(i915, encoder->port, INTEL_CX0_BOTH_LANES, PHY_C10_VDR_CONTROL(1),
-		      0, C10_VDR_CTRL_UPDATE_CFG,
-		      MB_WRITE_COMMITTED);
-
 	/* Program the pll values only for the master lane */
 	for (i = 0; i < ARRAY_SIZE(pll_state->pll); i++)
 		intel_cx0_write(i915, encoder->port, INTEL_CX0_LANE0, PHY_C10_VDR_PLL(i),
@@ -1909,6 +1901,10 @@
 	intel_cx0_write(i915, encoder->port, INTEL_CX0_LANE0, PHY_C10_VDR_CMN(0), pll_state->cmn, MB_WRITE_COMMITTED);
 	intel_cx0_write(i915, encoder->port, INTEL_CX0_LANE0, PHY_C10_VDR_TX(0), pll_state->tx, MB_WRITE_COMMITTED);
 
+	/* Custom width needs to be programmed to 0 for both the phy lanes */
+	intel_cx0_rmw(i915, encoder->port, INTEL_CX0_BOTH_LANES, PHY_C10_VDR_CUSTOM_WIDTH,
+		      C10_VDR_CUSTOM_WIDTH_MASK, C10_VDR_CUSTOM_WIDTH_8_10,
+		      MB_WRITE_COMMITTED);
 	intel_cx0_rmw(i915, encoder->port, INTEL_CX0_LANE0, PHY_C10_VDR_CONTROL(1),
 		      0, C10_VDR_CTRL_MASTER_LANE | C10_VDR_CTRL_UPDATE_CFG,
 		      MB_WRITE_COMMITTED);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_ddi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -907,7 +907,7 @@
 	 * instead of a specific AUX_IO_<port> reference without powering up any
 	 * extra wells.
 	 */
-	if (intel_encoder_can_psr(&dig_port->base))
+	if (intel_psr_needs_aux_io_power(&dig_port->base, crtc_state))
 		return intel_display_power_aux_io_domain(i915, dig_port->aux_ch);
 	else if (DISPLAY_VER(i915) < 14 &&
 		 (intel_crtc_has_dp_encoder(crtc_state) ||
@@ -4229,7 +4229,12 @@
 static bool crtcs_port_sync_compatible(const struct intel_crtc_state *crtc_state1,
 				       const struct intel_crtc_state *crtc_state2)
 {
+	/*
+	 * FIXME the modeset sequence is currently wrong and
+	 * can't deal with bigjoiner + port sync at the same time.
+	 */
 	return crtc_state1->hw.active && crtc_state2->hw.active &&
+		!crtc_state1->bigjoiner_pipes && !crtc_state2->bigjoiner_pipes &&
 		crtc_state1->output_types == crtc_state2->output_types &&
 		crtc_state1->output_format == crtc_state2->output_format &&
 		crtc_state1->lane_count == crtc_state2->lane_count &&
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_display_core.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_display_core.h
@@ -271,6 +271,9 @@
 };
 
 struct intel_display {
+	/* drm device backpointer */
+	struct drm_device *drm;
+
 	/* Display functions */
 	struct {
 		/* Top level crtc-ish functions */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_display_device.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_display_device.c
@@ -922,6 +922,9 @@
 	const struct intel_display_device_info *info;
 	u16 ver, rel, step;
 
+	/* Add drm device backpointer as early as possible. */
+	i915->display.drm = &i915->drm;
+
 	if (HAS_GMD_ID(i915))
 		info = probe_gmdid_display(i915, &ver, &rel, &step);
 	else
@@ -1095,6 +1098,9 @@
 		}
 	}
 
+	display_runtime->rawclk_freq = intel_read_rawclk(i915);
+	drm_dbg_kms(&i915->drm, "rawclk rate: %d kHz\n", display_runtime->rawclk_freq);
+
 	return;
 
 display_fused_off:
@@ -1137,6 +1143,8 @@
 	drm_printf(p, "has_hdcp: %s\n", str_yes_no(runtime->has_hdcp));
 	drm_printf(p, "has_dmc: %s\n", str_yes_no(runtime->has_dmc));
 	drm_printf(p, "has_dsc: %s\n", str_yes_no(runtime->has_dsc));
+
+	drm_printf(p, "rawclk rate: %u kHz\n", runtime->rawclk_freq);
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_display_device.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_display_device.h
@@ -47,6 +47,7 @@
 #define HAS_DPT(i915)			(DISPLAY_VER(i915) >= 13)
 #define HAS_DSB(i915)			(DISPLAY_INFO(i915)->has_dsb)
 #define HAS_DSC(__i915)			(DISPLAY_RUNTIME_INFO(__i915)->has_dsc)
+#define HAS_DSC_MST(__i915)		(DISPLAY_VER(__i915) >= 12 && HAS_DSC(__i915))
 #define HAS_FBC(i915)			(DISPLAY_RUNTIME_INFO(i915)->fbc_mask != 0)
 #define HAS_FPGA_DBG_UNCLAIMED(i915)	(DISPLAY_INFO(i915)->has_fpga_dbg)
 #define HAS_FW_BLC(i915)		(DISPLAY_VER(i915) >= 3)
@@ -114,6 +115,8 @@
 		u16 step;
 	} ip;
 
+	u32 rawclk_freq;
+
 	u8 pipe_mask;
 	u8 cpu_transcoder_mask;
 	u16 port_mask;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_display_driver.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_display_driver.c
@@ -394,6 +394,8 @@
 
 	intel_audio_init(i915);
 
+	intel_audio_register(i915);
+
 	intel_display_debugfs_register(i915);
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_display_power.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_display_power.c
@@ -1706,6 +1706,14 @@
 	/* Wa_14011503030:xelpd */
 	if (DISPLAY_VER(dev_priv) == 13)
 		intel_de_write(dev_priv, XELPD_DISPLAY_ERR_FATAL_MASK, ~0);
+
+	/* Wa_15013987218 */
+	if (DISPLAY_VER(dev_priv) == 20) {
+		intel_de_rmw(dev_priv, SOUTH_DSPCLK_GATE_D,
+			     0, PCH_GMBUSUNIT_CLOCK_GATE_DISABLE);
+		intel_de_rmw(dev_priv, SOUTH_DSPCLK_GATE_D,
+			     PCH_GMBUSUNIT_CLOCK_GATE_DISABLE, 0);
+	}
 }
 
 static void icl_display_core_uninit(struct drm_i915_private *dev_priv)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_display_power_well.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_display_power_well.c
@@ -1174,9 +1174,9 @@
 		       MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE);
 	intel_de_write(dev_priv, CBR1_VLV, 0);
 
-	drm_WARN_ON(&dev_priv->drm, RUNTIME_INFO(dev_priv)->rawclk_freq == 0);
+	drm_WARN_ON(&dev_priv->drm, DISPLAY_RUNTIME_INFO(dev_priv)->rawclk_freq == 0);
 	intel_de_write(dev_priv, RAWCLK_FREQ_VLV,
-		       DIV_ROUND_CLOSEST(RUNTIME_INFO(dev_priv)->rawclk_freq,
+		       DIV_ROUND_CLOSEST(DISPLAY_RUNTIME_INFO(dev_priv)->rawclk_freq,
 					 1000));
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_display_trace.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_display_trace.h
@@ -411,7 +411,7 @@
 			   struct intel_crtc *crtc = intel_crtc_for_pipe(to_i915(plane->base.dev),
 									 plane->pipe);
 			   __assign_str(dev, __dev_name_kms(plane));
-			   __assign_str(name, plane->base.name)
+			   __assign_str(name, plane->base.name);
 			   __entry->pipe = crtc->pipe;
 			   __entry->frame = intel_crtc_get_vblank_counter(crtc);
 			   __entry->scanline = intel_get_crtc_scanline(crtc);
@@ -438,7 +438,7 @@
 			   struct intel_crtc *crtc = intel_crtc_for_pipe(to_i915(plane->base.dev),
 									 plane->pipe);
 			   __assign_str(dev, __dev_name_kms(plane));
-			   __assign_str(name, plane->base.name)
+			   __assign_str(name, plane->base.name);
 			   __entry->pipe = crtc->pipe;
 			   __entry->frame = intel_crtc_get_vblank_counter(crtc);
 			   __entry->scanline = intel_get_crtc_scanline(crtc);
@@ -465,7 +465,7 @@
 			   struct intel_crtc *crtc = intel_crtc_for_pipe(to_i915(plane->base.dev),
 									 plane->pipe);
 			   __assign_str(dev, __dev_name_kms(plane));
-			   __assign_str(name, plane->base.name)
+			   __assign_str(name, plane->base.name);
 			   __entry->pipe = crtc->pipe;
 			   __entry->frame = intel_crtc_get_vblank_counter(crtc);
 			   __entry->scanline = intel_get_crtc_scanline(crtc);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_display_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_display_types.h
@@ -719,6 +719,7 @@
 #define PLANE_HAS_FENCE BIT(0)
 
 	struct intel_fb_view view;
+	u32 phys_dma_addr; /* for cursor_needs_physical */
 
 	/* Plane pxp decryption state */
 	bool decrypt;
@@ -1715,8 +1716,15 @@
 	bool psr2_sel_fetch_cff_enabled;
 	bool req_psr2_sdp_prior_scanline;
 	u8 sink_sync_latency;
-	u8 io_wake_lines;
-	u8 fast_wake_lines;
+
+	struct {
+		u8 io_wake_lines;
+		u8 fast_wake_lines;
+
+		/* LNL and beyond */
+		u8 check_entry_lines;
+	} alpm_parameters;
+
 	ktime_t last_entry_attempt;
 	ktime_t last_exit;
 	bool sink_not_reliable;
@@ -1840,6 +1848,10 @@
 
 	/* When we last wrote the OUI for eDP */
 	unsigned long last_oui_write;
+
+	struct {
+		unsigned long mask;
+	} quirks;
 };
 
 enum lspcon_vendor {
@@ -2153,4 +2165,41 @@
 	return bpp << 4;
 }
 
+/*
+ * Conversion functions/macros from various pointer types to struct
+ * intel_display pointer.
+ */
+#define __drm_device_to_intel_display(p) \
+	(&to_i915(p)->display)
+#define __intel_connector_to_intel_display(p)		\
+	__drm_device_to_intel_display((p)->base.dev)
+#define __intel_crtc_to_intel_display(p)		\
+	__drm_device_to_intel_display((p)->base.dev)
+#define __intel_crtc_state_to_intel_display(p)			\
+	__drm_device_to_intel_display((p)->uapi.crtc->dev)
+#define __intel_digital_port_to_intel_display(p)		\
+	__drm_device_to_intel_display((p)->base.base.dev)
+#define __intel_dp_to_intel_display(p)	\
+	__drm_device_to_intel_display(dp_to_dig_port(p)->base.base.dev)
+#define __intel_encoder_to_intel_display(p)		\
+	__drm_device_to_intel_display((p)->base.dev)
+#define __intel_hdmi_to_intel_display(p)	\
+	__drm_device_to_intel_display(hdmi_to_dig_port(p)->base.base.dev)
+
+/* Helper for generic association. Map types to conversion functions/macros. */
+#define __assoc(type, p) \
+	struct type: __##type##_to_intel_display((struct type *)(p))
+
+/* Convert various pointer types to struct intel_display pointer. */
+#define to_intel_display(p)				\
+	_Generic(*p,					\
+		 __assoc(drm_device, p),		\
+		 __assoc(intel_connector, p),		\
+		 __assoc(intel_crtc, p),		\
+		 __assoc(intel_crtc_state, p),		\
+		 __assoc(intel_digital_port, p),	\
+		 __assoc(intel_dp, p),			\
+		 __assoc(intel_encoder, p),		\
+		 __assoc(intel_hdmi, p))
+
 #endif /*  __INTEL_DISPLAY_TYPES_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dp.c
@@ -75,6 +75,7 @@
 #include "intel_pch_display.h"
 #include "intel_pps.h"
 #include "intel_psr.h"
+#include "intel_quirks.h"
 #include "intel_tc.h"
 #include "intel_vdsc.h"
 #include "intel_vrr.h"
@@ -434,6 +435,10 @@
 	struct intel_encoder *encoder = &intel_dig_port->base;
 	struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
 
+	/* eDP MSO is not compatible with joiner */
+	if (intel_dp->mso_link_count)
+		return false;
+
 	return DISPLAY_VER(dev_priv) >= 12 ||
 		(DISPLAY_VER(dev_priv) == 11 &&
 		 encoder->port != PORT_A);
@@ -1422,7 +1427,8 @@
 	if (DISPLAY_VER(dev_priv) >= 12)
 		return true;
 
-	if (DISPLAY_VER(dev_priv) == 11 && encoder->port != PORT_A)
+	if (DISPLAY_VER(dev_priv) == 11 && encoder->port != PORT_A &&
+	    !intel_crtc_has_type(pipe_config, INTEL_OUTPUT_DP_MST))
 		return true;
 
 	return false;
@@ -1915,8 +1921,9 @@
 	dsc_max_bpp = min(dsc_max_bpp, pipe_bpp - 1);
 
 	for (i = 0; i < ARRAY_SIZE(valid_dsc_bpp); i++) {
-		if (valid_dsc_bpp[i] < dsc_min_bpp ||
-		    valid_dsc_bpp[i] > dsc_max_bpp)
+		if (valid_dsc_bpp[i] < dsc_min_bpp)
+			continue;
+		if (valid_dsc_bpp[i] > dsc_max_bpp)
 			break;
 
 		ret = dsc_compute_link_config(intel_dp,
@@ -2754,7 +2761,11 @@
 		intel_panel_downclock_mode(connector, &pipe_config->hw.adjusted_mode);
 	int pixel_clock;
 
-	if (has_seamless_m_n(connector))
+	/*
+	 * FIXME all joined pipes share the same transcoder.
+	 * Need to account for that when updating M/N live.
+	 */
+	if (has_seamless_m_n(connector) && !pipe_config->bigjoiner_pipes)
 		pipe_config->update_m_n = true;
 
 	if (!can_enable_drrs(connector, pipe_config, downclock_mode)) {
@@ -3896,6 +3907,7 @@
 
 	drm_dp_read_desc(&intel_dp->aux, &intel_dp->desc,
 			 drm_dp_is_branch(intel_dp->dpcd));
+	intel_init_dpcd_quirks(intel_dp, &intel_dp->desc.ident);
 
 	/*
 	 * Read the eDP display control registers.
@@ -4001,6 +4013,8 @@
 		drm_dp_read_desc(&intel_dp->aux, &intel_dp->desc,
 				 drm_dp_is_branch(intel_dp->dpcd));
 
+		intel_init_dpcd_quirks(intel_dp, &intel_dp->desc.ident);
+
 		intel_dp_set_sink_rates(intel_dp);
 		intel_dp_set_max_sink_lane_count(intel_dp);
 		intel_dp_set_common_rates(intel_dp);
@@ -4113,73 +4127,6 @@
 	return false;
 }
 
-static ssize_t intel_dp_vsc_sdp_pack(const struct drm_dp_vsc_sdp *vsc,
-				     struct dp_sdp *sdp, size_t size)
-{
-	size_t length = sizeof(struct dp_sdp);
-
-	if (size < length)
-		return -ENOSPC;
-
-	memset(sdp, 0, size);
-
-	/*
-	 * Prepare VSC Header for SU as per DP 1.4a spec, Table 2-119
-	 * VSC SDP Header Bytes
-	 */
-	sdp->sdp_header.HB0 = 0; /* Secondary-Data Packet ID = 0 */
-	sdp->sdp_header.HB1 = vsc->sdp_type; /* Secondary-data Packet Type */
-	sdp->sdp_header.HB2 = vsc->revision; /* Revision Number */
-	sdp->sdp_header.HB3 = vsc->length; /* Number of Valid Data Bytes */
-
-	if (vsc->revision == 0x6) {
-		sdp->db[0] = 1;
-		sdp->db[3] = 1;
-	}
-
-	/*
-	 * Revision 0x5 and revision 0x7 supports Pixel Encoding/Colorimetry
-	 * Format as per DP 1.4a spec and DP 2.0 respectively.
-	 */
-	if (!(vsc->revision == 0x5 || vsc->revision == 0x7))
-		goto out;
-
-	/* VSC SDP Payload for DB16 through DB18 */
-	/* Pixel Encoding and Colorimetry Formats  */
-	sdp->db[16] = (vsc->pixelformat & 0xf) << 4; /* DB16[7:4] */
-	sdp->db[16] |= vsc->colorimetry & 0xf; /* DB16[3:0] */
-
-	switch (vsc->bpc) {
-	case 6:
-		/* 6bpc: 0x0 */
-		break;
-	case 8:
-		sdp->db[17] = 0x1; /* DB17[3:0] */
-		break;
-	case 10:
-		sdp->db[17] = 0x2;
-		break;
-	case 12:
-		sdp->db[17] = 0x3;
-		break;
-	case 16:
-		sdp->db[17] = 0x4;
-		break;
-	default:
-		MISSING_CASE(vsc->bpc);
-		break;
-	}
-	/* Dynamic Range and Component Bit Depth */
-	if (vsc->dynamic_range == DP_DYNAMIC_RANGE_CTA)
-		sdp->db[17] |= 0x80;  /* DB17[7] */
-
-	/* Content Type */
-	sdp->db[18] = vsc->content_type & 0x7;
-
-out:
-	return length;
-}
-
 static ssize_t
 intel_dp_hdr_metadata_infoframe_sdp_pack(struct drm_i915_private *i915,
 					 const struct hdmi_drm_infoframe *drm_infoframe,
@@ -4272,8 +4219,7 @@
 
 	switch (type) {
 	case DP_SDP_VSC:
-		len = intel_dp_vsc_sdp_pack(&crtc_state->infoframes.vsc, &sdp,
-					    sizeof(sdp));
+		len = drm_dp_vsc_sdp_pack(&crtc_state->infoframes.vsc, &sdp);
 		break;
 	case HDMI_PACKET_TYPE_GAMUT_METADATA:
 		len = intel_dp_hdr_metadata_infoframe_sdp_pack(dev_priv,
@@ -4300,7 +4246,7 @@
 	struct dp_sdp sdp = {};
 	ssize_t len;
 
-	len = intel_dp_vsc_sdp_pack(vsc, &sdp, sizeof(sdp));
+	len = drm_dp_vsc_sdp_pack(vsc, &sdp);
 
 	if (drm_WARN_ON(&dev_priv->drm, len < 0))
 		return;
@@ -4325,8 +4271,11 @@
 	if (!enable && HAS_DSC(dev_priv))
 		val &= ~VDIP_ENABLE_PPS;
 
-	/* When PSR is enabled, this routine doesn't disable VSC DIP */
-	if (!crtc_state->has_psr)
+	/*
+	 * This routine disables VSC DIP if the function is called
+	 * to disable SDP or if it does not have PSR
+	 */
+	if (!enable || !crtc_state->has_psr)
 		val &= ~VIDEO_DIP_ENABLE_VSC_HSW;
 
 	intel_de_write(dev_priv, reg, val);
@@ -5145,6 +5094,8 @@
 		    !intel_dp_mst_is_master_trans(crtc_state))
 			continue;
 
+		intel_dp->link_trained = false;
+
 		intel_dp_check_frl_training(intel_dp);
 		intel_dp_pcon_dsc_configure(intel_dp, crtc_state);
 		intel_dp_start_link_train(intel_dp, crtc_state);
@@ -5498,6 +5449,17 @@
 	return drm_edid_read_ddc(&connector->base, &intel_dp->aux.ddc);
 }
 
+const struct edid *
+intel_dp_fetch_edid(struct intel_dp *intel_dp)
+{
+	const struct drm_edid * d_edid;
+	d_edid = intel_dp_get_edid(intel_dp);
+	if (d_edid)
+		return drm_edid_raw(d_edid);
+
+	return NULL;
+}
+
 static void
 intel_dp_update_dfp(struct intel_dp *intel_dp,
 		    const struct drm_edid *drm_edid)
@@ -5681,6 +5643,18 @@
 	else
 		status = connector_status_disconnected;
 
+	if (status != connector_status_disconnected &&
+	    !intel_dp_mst_verify_dpcd_state(intel_dp))
+		/*
+		 * This requires retrying detection for instance to re-enable
+		 * the MST mode that got reset via a long HPD pulse. The retry
+		 * will happen either via the hotplug handler's retry logic,
+		 * ensured by setting the connector here to SST/disconnected,
+		 * or via a userspace connector probing in response to the
+		 * hotplug uevent sent when removing the MST connectors.
+		 */
+		status = connector_status_disconnected;
+
 	if (status == connector_status_disconnected) {
 		memset(&intel_dp->compliance, 0, sizeof(intel_dp->compliance));
 		memset(intel_connector->dp.dsc_dpcd, 0, sizeof(intel_connector->dp.dsc_dpcd));
@@ -6523,6 +6497,7 @@
 		intel_connector->get_hw_state = intel_ddi_connector_get_hw_state;
 	else
 		intel_connector->get_hw_state = intel_connector_get_hw_state;
+	intel_connector->sync_state = intel_dp_connector_sync_state;
 
 	if (!intel_edp_init_connector(intel_dp, intel_connector)) {
 		intel_dp_aux_fini(intel_dp);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dp.h
@@ -187,4 +187,6 @@
 
 void intel_dp_get_dsc_sink_cap(u8 dpcd_rev, struct intel_connector *connector);
 
+const struct edid *intel_dp_fetch_edid(struct intel_dp *intel_dp);
+
 #endif /* __INTEL_DP_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dp_aux.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dp_aux.c
@@ -12,6 +12,7 @@
 #include "intel_dp_aux.h"
 #include "intel_dp_aux_regs.h"
 #include "intel_pps.h"
+#include "intel_quirks.h"
 #include "intel_tc.h"
 
 #define AUX_CH_NAME_BUFSIZE	6
@@ -83,7 +84,7 @@
 	 * The clock divider is based off the hrawclk, and would like to run at
 	 * 2MHz.  So, take the hrawclk value and divide by 2000 and use that
 	 */
-	return DIV_ROUND_CLOSEST(RUNTIME_INFO(i915)->rawclk_freq, 2000);
+	return DIV_ROUND_CLOSEST(DISPLAY_RUNTIME_INFO(i915)->rawclk_freq, 2000);
 }
 
 static u32 ilk_get_aux_clock_divider(struct intel_dp *intel_dp, int index)
@@ -103,7 +104,7 @@
 	if (dig_port->aux_ch == AUX_CH_A)
 		freq = i915->display.cdclk.hw.cdclk;
 	else
-		freq = RUNTIME_INFO(i915)->rawclk_freq;
+		freq = DISPLAY_RUNTIME_INFO(i915)->rawclk_freq;
 	return DIV_ROUND_CLOSEST(freq, 2000);
 }
 
@@ -142,11 +143,22 @@
 	return precharge + preamble;
 }
 
-static int intel_dp_aux_fw_sync_len(void)
+int intel_dp_aux_fw_sync_len(struct intel_dp *intel_dp)
 {
 	int precharge = 10; /* 10-16 */
 	int preamble = 8;
 
+	/*
+	 * We faced some glitches on Dell Precision 5490 MTL laptop with panel:
+	 * "Manufacturer: AUO, Model: 63898" when using HW default 18. Using 20
+	 * is fixing these problems with the panel. It is still within range
+	 * mentioned in eDP specification. Increasing Fast Wake sync length is
+	 * causing problems with other panels: increase length as a quirk for
+	 * this specific laptop.
+	 */
+	if (intel_has_dpcd_quirk(intel_dp, QUIRK_FW_SYNC_LEN))
+		precharge += 2;
+
 	return precharge + preamble;
 }
 
@@ -205,7 +217,7 @@
 		DP_AUX_CH_CTL_TIME_OUT_MAX |
 		DP_AUX_CH_CTL_RECEIVE_ERROR |
 		DP_AUX_CH_CTL_MESSAGE_SIZE(send_bytes) |
-		DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL(intel_dp_aux_fw_sync_len()) |
+		DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL(intel_dp_aux_fw_sync_len(intel_dp)) |
 		DP_AUX_CH_CTL_SYNC_PULSE_SKL(intel_dp_aux_sync_len());
 
 	if (intel_tc_port_in_tbt_alt_mode(dig_port))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dp_aux.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dp_aux.h
@@ -20,5 +20,6 @@
 
 void intel_dp_aux_irq_handler(struct drm_i915_private *i915);
 u32 intel_dp_aux_pack(const u8 *src, int src_bytes);
+int intel_dp_aux_fw_sync_len(struct intel_dp *intel_dp);
 
 #endif /* __INTEL_DP_AUX_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dp_hdcp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dp_hdcp.c
@@ -637,12 +637,18 @@
 int intel_dp_hdcp2_capable(struct intel_connector *connector,
 			   bool *capable)
 {
-	struct intel_digital_port *dig_port = intel_attached_dig_port(connector);
-	struct drm_dp_aux *aux = &dig_port->dp.aux;
+	struct intel_digital_port *dig_port;
+	struct drm_dp_aux *aux;
 	u8 rx_caps[3];
 	int ret;
 
 	*capable = false;
+	if (!intel_attached_encoder(connector))
+		return -EINVAL;
+
+	dig_port = intel_attached_dig_port(connector);
+	aux = &dig_port->dp.aux;
+
 	ret = drm_dp_dpcd_read(aux,
 			       DP_HDCP_2_2_REG_RX_CAPS_OFFSET,
 			       rx_caps, HDCP_2_2_RXCAPS_LEN);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dp_link_training.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dp_link_training.c
@@ -114,10 +114,24 @@
 	return drm_dp_dpcd_write(&intel_dp->aux, DP_PHY_REPEATER_MODE, &val, 1) == 1;
 }
 
-static int intel_dp_init_lttpr(struct intel_dp *intel_dp, const u8 dpcd[DP_RECEIVER_CAP_SIZE])
+static bool intel_dp_lttpr_transparent_mode_enabled(struct intel_dp *intel_dp)
+{
+	return intel_dp->lttpr_common_caps[DP_PHY_REPEATER_MODE -
+					   DP_LT_TUNABLE_PHY_REPEATER_FIELD_DATA_STRUCTURE_REV] ==
+		DP_PHY_REPEATER_MODE_TRANSPARENT;
+}
+
+/*
+ * Read the LTTPR common capabilities and switch the LTTPR PHYs to
+ * non-transparent mode if this is supported. Preserve the
+ * transparent/non-transparent mode on an active link.
+ *
+ * Return the number of detected LTTPRs in non-transparent mode or 0 if the
+ * LTTPRs are in transparent mode or the detection failed.
+ */
+static int intel_dp_init_lttpr_phys(struct intel_dp *intel_dp, const u8 dpcd[DP_RECEIVER_CAP_SIZE])
 {
 	int lttpr_count;
-	int i;
 
 	if (!intel_dp_read_lttpr_common_caps(intel_dp, dpcd))
 		return 0;
@@ -132,6 +146,19 @@
 		return 0;
 
 	/*
+	 * Don't change the mode on an active link, to prevent a loss of link
+	 * synchronization. See DP Standard v2.0 3.6.7. about the LTTPR
+	 * resetting its internal state when the mode is changed from
+	 * non-transparent to transparent.
+	 */
+	if (intel_dp->link_trained) {
+		if (lttpr_count < 0 || intel_dp_lttpr_transparent_mode_enabled(intel_dp))
+			goto out_reset_lttpr_count;
+
+		return lttpr_count;
+	}
+
+	/*
 	 * See DP Standard v2.0 3.6.6.1. about the explicit disabling of
 	 * non-transparent mode and the disable->enable non-transparent mode
 	 * sequence.
@@ -151,11 +178,25 @@
 		       "Switching to LTTPR non-transparent LT mode failed, fall-back to transparent mode\n");
 
 		intel_dp_set_lttpr_transparent_mode(intel_dp, true);
-		intel_dp_reset_lttpr_count(intel_dp);
 
-		return 0;
+		goto out_reset_lttpr_count;
 	}
 
+	return lttpr_count;
+
+out_reset_lttpr_count:
+	intel_dp_reset_lttpr_count(intel_dp);
+
+	return 0;
+}
+
+static int intel_dp_init_lttpr(struct intel_dp *intel_dp, const u8 dpcd[DP_RECEIVER_CAP_SIZE])
+{
+	int lttpr_count;
+	int i;
+
+	lttpr_count = intel_dp_init_lttpr_phys(intel_dp, dpcd);
+
 	for (i = 0; i < lttpr_count; i++)
 		intel_dp_read_lttpr_phy_caps(intel_dp, dpcd, DP_PHY_LTTPR(i));
 
@@ -1353,10 +1394,10 @@
 {
 	struct drm_i915_private *i915 = dp_to_i915(intel_dp);
 	bool passed;
-
 	/*
-	 * TODO: Reiniting LTTPRs here won't be needed once proper connector
-	 * HW state readout is added.
+	 * Reinit the LTTPRs here to ensure that they are switched to
+	 * non-transparent mode. During an earlier LTTPR detection this
+	 * could've been prevented by an active link.
 	 */
 	int lttpr_count = intel_dp_init_lttpr_and_dprx_caps(intel_dp);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dp_mst.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dp_mst.c
@@ -72,26 +72,19 @@
 
 static int intel_dp_mst_bw_overhead(const struct intel_crtc_state *crtc_state,
 				    const struct intel_connector *connector,
-				    bool ssc, bool dsc, int bpp_x16)
+				    bool ssc, int dsc_slice_count, int bpp_x16)
 {
 	const struct drm_display_mode *adjusted_mode =
 		&crtc_state->hw.adjusted_mode;
 	unsigned long flags = DRM_DP_BW_OVERHEAD_MST;
-	int dsc_slice_count = 0;
 	int overhead;
 
 	flags |= intel_dp_is_uhbr(crtc_state) ? DRM_DP_BW_OVERHEAD_UHBR : 0;
 	flags |= ssc ? DRM_DP_BW_OVERHEAD_SSC_REF_CLK : 0;
 	flags |= crtc_state->fec_enable ? DRM_DP_BW_OVERHEAD_FEC : 0;
 
-	if (dsc) {
+	if (dsc_slice_count)
 		flags |= DRM_DP_BW_OVERHEAD_DSC;
-		/* TODO: add support for bigjoiner */
-		dsc_slice_count = intel_dp_dsc_get_slice_count(connector,
-							       adjusted_mode->clock,
-							       adjusted_mode->hdisplay,
-							       false);
-	}
 
 	overhead = drm_dp_bw_overhead(crtc_state->lane_count,
 				      adjusted_mode->hdisplay,
@@ -137,6 +130,19 @@
 	return DIV_ROUND_UP(effective_data_rate * 64, 54 * 1000);
 }
 
+static int intel_dp_mst_dsc_get_slice_count(const struct intel_connector *connector,
+					    const struct intel_crtc_state *crtc_state)
+{
+	const struct drm_display_mode *adjusted_mode =
+		&crtc_state->hw.adjusted_mode;
+
+	/* TODO: add support for bigjoiner */
+	return intel_dp_dsc_get_slice_count(connector,
+					    adjusted_mode->clock,
+					    adjusted_mode->hdisplay,
+					    false);
+}
+
 static int intel_dp_mst_find_vcpi_slots_for_bpp(struct intel_encoder *encoder,
 						struct intel_crtc_state *crtc_state,
 						int max_bpp,
@@ -156,6 +162,7 @@
 	const struct drm_display_mode *adjusted_mode =
 		&crtc_state->hw.adjusted_mode;
 	int bpp, slots = -EINVAL;
+	int dsc_slice_count = 0;
 	int ret = 0;
 
 	mst_state = drm_atomic_get_mst_topology_state(state, &intel_dp->mst_mgr);
@@ -179,6 +186,15 @@
 	drm_dbg_kms(&i915->drm, "Looking for slots in range min bpp %d max bpp %d\n",
 		    min_bpp, max_bpp);
 
+	if (dsc) {
+		dsc_slice_count = intel_dp_mst_dsc_get_slice_count(connector, crtc_state);
+		if (!dsc_slice_count) {
+			drm_dbg_kms(&i915->drm, "Can't get valid DSC slice count\n");
+
+			return -ENOSPC;
+		}
+	}
+
 	for (bpp = max_bpp; bpp >= min_bpp; bpp -= step) {
 		int local_bw_overhead;
 		int remote_bw_overhead;
@@ -195,9 +211,9 @@
 					  intel_dp_output_bpp(crtc_state->output_format, bpp));
 
 		local_bw_overhead = intel_dp_mst_bw_overhead(crtc_state, connector,
-							     false, dsc, link_bpp_x16);
+							     false, dsc_slice_count, link_bpp_x16);
 		remote_bw_overhead = intel_dp_mst_bw_overhead(crtc_state, connector,
-							      true, dsc, link_bpp_x16);
+							      true, dsc_slice_count, link_bpp_x16);
 
 		intel_dp_mst_compute_m_n(crtc_state, connector,
 					 local_bw_overhead,
@@ -413,6 +429,9 @@
 	if (mode_hblank_period_ns(adjusted_mode) > 300)
 		return false;
 
+	if (!intel_dp_mst_dsc_get_slice_count(connector, crtc_state))
+		return false;
+
 	return true;
 }
 
@@ -1148,7 +1167,7 @@
 	if (first_mst_stream)
 		intel_ddi_wait_for_fec_status(encoder, pipe_config, true);
 
-	drm_dp_add_payload_part2(&intel_dp->mst_mgr, &state->base,
+	drm_dp_add_payload_part2(&intel_dp->mst_mgr,
 				 drm_atomic_get_mst_payload_state(mst_state, connector->port));
 
 	if (DISPLAY_VER(dev_priv) >= 12)
@@ -1338,7 +1357,7 @@
 		return 0;
 	}
 
-	if (DISPLAY_VER(dev_priv) >= 10 &&
+	if (HAS_DSC_MST(dev_priv) &&
 	    drm_dp_sink_supports_dsc(intel_connector->dp.dsc_dpcd)) {
 		/*
 		 * TBD pass the connector BPC,
@@ -1872,3 +1891,43 @@
 
 	return false;
 }
+
+/*
+ * intel_dp_mst_verify_dpcd_state - verify the MST SW enabled state wrt. the DPCD
+ * @intel_dp: DP port object
+ *
+ * Verify if @intel_dp's MST enabled SW state matches the corresponding DPCD
+ * state. A long HPD pulse - not long enough to be detected as a disconnected
+ * state - could've reset the DPCD state, which requires tearing
+ * down/recreating the MST topology.
+ *
+ * Returns %true if the SW MST enabled and DPCD states match, %false
+ * otherwise.
+ */
+bool intel_dp_mst_verify_dpcd_state(struct intel_dp *intel_dp)
+{
+	struct intel_display *display = to_intel_display(intel_dp);
+	struct intel_connector *connector = intel_dp->attached_connector;
+	struct intel_digital_port *dig_port = dp_to_dig_port(intel_dp);
+	struct intel_encoder *encoder = &dig_port->base;
+	int ret;
+	u8 val;
+
+	if (!intel_dp->is_mst)
+		return true;
+
+	ret = drm_dp_dpcd_readb(intel_dp->mst_mgr.aux, DP_MSTM_CTRL, &val);
+
+	/* Adjust the expected register value for SST + SideBand. */
+	if (ret < 0 || val != (DP_MST_EN | DP_UP_REQ_EN | DP_UPSTREAM_IS_SRC)) {
+		drm_dbg_kms(display->drm,
+			    "[CONNECTOR:%d:%s][ENCODER:%d:%s] MST mode got reset, removing topology (ret=%d, ctrl=0x%02x)\n",
+			    connector->base.base.id, connector->base.name,
+			    encoder->base.base.id, encoder->base.name,
+			    ret, val);
+
+		return false;
+	}
+
+	return true;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dp_mst.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dp_mst.h
@@ -27,5 +27,6 @@
 				   struct intel_link_bw_limits *limits);
 bool intel_dp_mst_crtc_needs_modeset(struct intel_atomic_state *state,
 				     struct intel_crtc *crtc);
+bool intel_dp_mst_verify_dpcd_state(struct intel_dp *intel_dp);
 
 #endif /* __INTEL_DP_MST_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
@@ -1602,7 +1602,7 @@
 }
 
 static int
-skl_ddi_calculate_wrpll(int clock /* in Hz */,
+skl_ddi_calculate_wrpll(int clock,
 			int ref_clock,
 			struct skl_wrpll_params *wrpll_params)
 {
@@ -1627,7 +1627,7 @@
 	};
 	unsigned int dco, d, i;
 	unsigned int p0, p1, p2;
-	u64 afe_clock = clock * 5; /* AFE Clock is 5x Pixel clock */
+	u64 afe_clock = (u64)clock * 1000 * 5; /* AFE Clock is 5x Pixel clock, in Hz */
 
 	for (d = 0; d < ARRAY_SIZE(dividers); d++) {
 		for (dco = 0; dco < ARRAY_SIZE(dco_central_freq); dco++) {
@@ -1759,7 +1759,7 @@
 
 	ctrl1 |= DPLL_CTRL1_HDMI_MODE(0);
 
-	ret = skl_ddi_calculate_wrpll(crtc_state->port_clock * 1000,
+	ret = skl_ddi_calculate_wrpll(crtc_state->port_clock,
 				      i915->display.dpll.ref_clks.nssc, &wrpll_params);
 	if (ret)
 		return ret;
@@ -2509,7 +2509,7 @@
 static bool
 ehl_combo_pll_div_frac_wa_needed(struct drm_i915_private *i915)
 {
-	return (((IS_ELKHARTLAKE(i915) || IS_JASPERLAKE(i915)) &&
+	return ((IS_ELKHARTLAKE(i915) &&
 		 IS_DISPLAY_STEP(i915, STEP_B0, STEP_FOREVER)) ||
 		 IS_TIGERLAKE(i915) || IS_ALDERLAKE_S(i915) || IS_ALDERLAKE_P(i915)) &&
 		 i915->display.dpll.ref_clks.nssc == 38400;
@@ -3308,6 +3308,8 @@
 	struct drm_i915_private *i915 = to_i915(state->base.dev);
 	struct intel_crtc_state *crtc_state =
 		intel_atomic_get_new_crtc_state(state, crtc);
+	const struct intel_crtc_state *old_crtc_state =
+		intel_atomic_get_old_crtc_state(state, crtc);
 	struct icl_port_dpll *port_dpll =
 		&crtc_state->icl_port_dplls[ICL_PORT_DPLL_DEFAULT];
 	struct skl_wrpll_params pll_params = {};
@@ -3326,7 +3328,11 @@
 		return ret;
 
 	/* this is mainly for the fastset check */
-	icl_set_active_port_dpll(crtc_state, ICL_PORT_DPLL_MG_PHY);
+	if (old_crtc_state->shared_dpll &&
+	    old_crtc_state->shared_dpll->info->id == DPLL_ID_ICL_TBTPLL)
+		icl_set_active_port_dpll(crtc_state, ICL_PORT_DPLL_DEFAULT);
+	else
+		icl_set_active_port_dpll(crtc_state, ICL_PORT_DPLL_MG_PHY);
 
 	crtc_state->port_clock = icl_ddi_mg_pll_get_freq(i915, NULL,
 							 &port_dpll->hw_state);
@@ -4023,7 +4029,8 @@
 static const struct dpll_info icl_plls[] = {
 	{ .name = "DPLL 0", .funcs = &combo_pll_funcs, .id = DPLL_ID_ICL_DPLL0, },
 	{ .name = "DPLL 1", .funcs = &combo_pll_funcs, .id = DPLL_ID_ICL_DPLL1, },
-	{ .name = "TBT PLL", .funcs = &tbt_pll_funcs, .id = DPLL_ID_ICL_TBTPLL, },
+	{ .name = "TBT PLL", .funcs = &tbt_pll_funcs, .id = DPLL_ID_ICL_TBTPLL,
+	  .flags = INTEL_DPLL_IS_ALT_PORT_DPLL, },
 	{ .name = "MG PLL 1", .funcs = &mg_pll_funcs, .id = DPLL_ID_ICL_MGPLL1, },
 	{ .name = "MG PLL 2", .funcs = &mg_pll_funcs, .id = DPLL_ID_ICL_MGPLL2, },
 	{ .name = "MG PLL 3", .funcs = &mg_pll_funcs, .id = DPLL_ID_ICL_MGPLL3, },
@@ -4068,7 +4075,8 @@
 static const struct dpll_info tgl_plls[] = {
 	{ .name = "DPLL 0", .funcs = &combo_pll_funcs, .id = DPLL_ID_ICL_DPLL0, },
 	{ .name = "DPLL 1", .funcs = &combo_pll_funcs, .id = DPLL_ID_ICL_DPLL1, },
-	{ .name = "TBT PLL", .funcs = &tbt_pll_funcs, .id = DPLL_ID_ICL_TBTPLL, },
+	{ .name = "TBT PLL", .funcs = &tbt_pll_funcs, .id = DPLL_ID_ICL_TBTPLL,
+	  .flags = INTEL_DPLL_IS_ALT_PORT_DPLL, },
 	{ .name = "TC PLL 1", .funcs = &dkl_pll_funcs, .id = DPLL_ID_ICL_MGPLL1, },
 	{ .name = "TC PLL 2", .funcs = &dkl_pll_funcs, .id = DPLL_ID_ICL_MGPLL2, },
 	{ .name = "TC PLL 3", .funcs = &dkl_pll_funcs, .id = DPLL_ID_ICL_MGPLL3, },
@@ -4141,7 +4149,8 @@
 static const struct dpll_info adlp_plls[] = {
 	{ .name = "DPLL 0", .funcs = &combo_pll_funcs, .id = DPLL_ID_ICL_DPLL0, },
 	{ .name = "DPLL 1", .funcs = &combo_pll_funcs, .id = DPLL_ID_ICL_DPLL1, },
-	{ .name = "TBT PLL", .funcs = &tbt_pll_funcs, .id = DPLL_ID_ICL_TBTPLL, },
+	{ .name = "TBT PLL", .funcs = &tbt_pll_funcs, .id = DPLL_ID_ICL_TBTPLL,
+	  .flags = INTEL_DPLL_IS_ALT_PORT_DPLL, },
 	{ .name = "TC PLL 1", .funcs = &dkl_pll_funcs, .id = DPLL_ID_ICL_MGPLL1, },
 	{ .name = "TC PLL 2", .funcs = &dkl_pll_funcs, .id = DPLL_ID_ICL_MGPLL2, },
 	{ .name = "TC PLL 3", .funcs = &dkl_pll_funcs, .id = DPLL_ID_ICL_MGPLL3, },
@@ -4465,31 +4474,29 @@
 			 struct intel_crtc *crtc,
 			 const struct intel_crtc_state *new_crtc_state)
 {
-	struct intel_dpll_hw_state dpll_hw_state;
+	struct intel_dpll_hw_state dpll_hw_state = {};
 	u8 pipe_mask;
 	bool active;
 
-	memset(&dpll_hw_state, 0, sizeof(dpll_hw_state));
-
-	drm_dbg_kms(&i915->drm, "%s\n", pll->info->name);
-
 	active = intel_dpll_get_hw_state(i915, pll, &dpll_hw_state);
 
 	if (!(pll->info->flags & INTEL_DPLL_ALWAYS_ON)) {
 		I915_STATE_WARN(i915, !pll->on && pll->active_mask,
-				"pll in active use but not on in sw tracking\n");
+				"%s: pll in active use but not on in sw tracking\n",
+				pll->info->name);
 		I915_STATE_WARN(i915, pll->on && !pll->active_mask,
-				"pll is on but not used by any active pipe\n");
+				"%s: pll is on but not used by any active pipe\n",
+				pll->info->name);
 		I915_STATE_WARN(i915, pll->on != active,
-				"pll on state mismatch (expected %i, found %i)\n",
-				pll->on, active);
+				"%s: pll on state mismatch (expected %i, found %i)\n",
+				pll->info->name, pll->on, active);
 	}
 
 	if (!crtc) {
 		I915_STATE_WARN(i915,
 				pll->active_mask & ~pll->state.pipe_mask,
-				"more active pll users than references: 0x%x vs 0x%x\n",
-				pll->active_mask, pll->state.pipe_mask);
+				"%s: more active pll users than references: 0x%x vs 0x%x\n",
+				pll->info->name, pll->active_mask, pll->state.pipe_mask);
 
 		return;
 	}
@@ -4498,21 +4505,30 @@
 
 	if (new_crtc_state->hw.active)
 		I915_STATE_WARN(i915, !(pll->active_mask & pipe_mask),
-				"pll active mismatch (expected pipe %c in active mask 0x%x)\n",
-				pipe_name(crtc->pipe), pll->active_mask);
+				"%s: pll active mismatch (expected pipe %c in active mask 0x%x)\n",
+				pll->info->name, pipe_name(crtc->pipe), pll->active_mask);
 	else
 		I915_STATE_WARN(i915, pll->active_mask & pipe_mask,
-				"pll active mismatch (didn't expect pipe %c in active mask 0x%x)\n",
-				pipe_name(crtc->pipe), pll->active_mask);
+				"%s: pll active mismatch (didn't expect pipe %c in active mask 0x%x)\n",
+				pll->info->name, pipe_name(crtc->pipe), pll->active_mask);
 
 	I915_STATE_WARN(i915, !(pll->state.pipe_mask & pipe_mask),
-			"pll enabled crtcs mismatch (expected 0x%x in 0x%x)\n",
-			pipe_mask, pll->state.pipe_mask);
+			"%s: pll enabled crtcs mismatch (expected 0x%x in 0x%x)\n",
+			pll->info->name, pipe_mask, pll->state.pipe_mask);
 
 	I915_STATE_WARN(i915,
 			pll->on && memcmp(&pll->state.hw_state, &dpll_hw_state,
 					  sizeof(dpll_hw_state)),
-			"pll hw state mismatch\n");
+			"%s: pll hw state mismatch\n",
+			pll->info->name);
+}
+
+static bool has_alt_port_dpll(const struct intel_shared_dpll *old_pll,
+			      const struct intel_shared_dpll *new_pll)
+{
+	return old_pll && new_pll && old_pll != new_pll &&
+		(old_pll->info->flags & INTEL_DPLL_IS_ALT_PORT_DPLL ||
+		 new_pll->info->flags & INTEL_DPLL_IS_ALT_PORT_DPLL);
 }
 
 void intel_shared_dpll_state_verify(struct intel_atomic_state *state,
@@ -4534,11 +4550,15 @@
 		struct intel_shared_dpll *pll = old_crtc_state->shared_dpll;
 
 		I915_STATE_WARN(i915, pll->active_mask & pipe_mask,
-				"pll active mismatch (didn't expect pipe %c in active mask (0x%x))\n",
-				pipe_name(crtc->pipe), pll->active_mask);
-		I915_STATE_WARN(i915, pll->state.pipe_mask & pipe_mask,
-				"pll enabled crtcs mismatch (found pipe %c in enabled mask (0x%x))\n",
-				pipe_name(crtc->pipe), pll->state.pipe_mask);
+				"%s: pll active mismatch (didn't expect pipe %c in active mask (0x%x))\n",
+				pll->info->name, pipe_name(crtc->pipe), pll->active_mask);
+
+		/* TC ports have both MG/TC and TBT PLL referenced simultaneously */
+		I915_STATE_WARN(i915, !has_alt_port_dpll(old_crtc_state->shared_dpll,
+							 new_crtc_state->shared_dpll) &&
+				pll->state.pipe_mask & pipe_mask,
+				"%s: pll enabled crtcs mismatch (found pipe %c in enabled mask (0x%x))\n",
+				pll->info->name, pipe_name(crtc->pipe), pll->state.pipe_mask);
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dpll_mgr.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dpll_mgr.h
@@ -277,12 +277,16 @@
 	enum intel_display_power_domain power_domain;
 
 #define INTEL_DPLL_ALWAYS_ON	(1 << 0)
+#define INTEL_DPLL_IS_ALT_PORT_DPLL	(1 << 1)
 	/**
 	 * @flags:
 	 *
 	 * INTEL_DPLL_ALWAYS_ON
 	 *     Inform the state checker that the DPLL is kept enabled even if
 	 *     not in use by any CRTC.
+	 * INTEL_DPLL_IS_ALT_PORT_DPLL
+	 *     Inform the state checker that the DPLL can be used as a fallback
+	 *     (for TC->TBT fallback).
 	 */
 	u32 flags;
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_dsb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_dsb.c
@@ -340,6 +340,17 @@
 	return max(0, vblank_start - intel_usecs_to_scanlines(adjusted_mode, latency));
 }
 
+static u32 dsb_chicken(struct intel_crtc *crtc)
+{
+	if (crtc->mode_flags & I915_MODE_FLAG_VRR)
+		return DSB_CTRL_WAIT_SAFE_WINDOW |
+			DSB_CTRL_NO_WAIT_VBLANK |
+			DSB_INST_WAIT_SAFE_WINDOW |
+			DSB_INST_NO_WAIT_VBLANK;
+	else
+		return 0;
+}
+
 static void _intel_dsb_commit(struct intel_dsb *dsb, u32 ctrl,
 			      int dewake_scanline)
 {
@@ -361,6 +372,9 @@
 	intel_de_write_fw(dev_priv, DSB_CTRL(pipe, dsb->id),
 			  ctrl | DSB_ENABLE);
 
+	intel_de_write_fw(dev_priv, DSB_CHICKEN(pipe, dsb->id),
+			  dsb_chicken(crtc));
+
 	intel_de_write_fw(dev_priv, DSB_HEAD(pipe, dsb->id),
 			  intel_dsb_buffer_ggtt_offset(&dsb->dsb_buf));
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_fb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_fb.c
@@ -1636,7 +1636,7 @@
 		 * arithmetic related to alignment and offset calculation.
 		 */
 		if (is_gen12_ccs_cc_plane(&fb->base, i)) {
-			if (IS_ALIGNED(fb->base.offsets[i], PAGE_SIZE))
+			if (IS_ALIGNED(fb->base.offsets[i], 64))
 				continue;
 			else
 				return -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_fb_pin.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_fb_pin.c
@@ -255,6 +255,16 @@
 			return PTR_ERR(vma);
 
 		plane_state->ggtt_vma = vma;
+
+		/*
+		 * Pre-populate the dma address before we enter the vblank
+		 * evade critical section as i915_gem_object_get_dma_address()
+		 * will trigger might_sleep() even if it won't actually sleep,
+		 * which is the case when the fb has already been pinned.
+		 */
+		if (phys_cursor)
+			plane_state->phys_dma_addr =
+				i915_gem_object_get_dma_address(intel_fb_obj(fb), 0);
 	} else {
 		struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_hdcp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_hdcp.c
@@ -142,11 +142,16 @@
 /* Is HDCP1.4 capable on Platform and Sink */
 bool intel_hdcp_capable(struct intel_connector *connector)
 {
-	struct intel_digital_port *dig_port = intel_attached_dig_port(connector);
+	struct intel_digital_port *dig_port;
 	const struct intel_hdcp_shim *shim = connector->hdcp.shim;
 	bool capable = false;
 	u8 bksv[5];
 
+	if (!intel_attached_encoder(connector))
+		return capable;
+
+	dig_port = intel_attached_dig_port(connector);
+
 	if (!shim)
 		return capable;
 
@@ -998,7 +1003,8 @@
 	hdcp->value = value;
 	if (update_property) {
 		drm_connector_get(&connector->base);
-		queue_work(i915->unordered_wq, &hdcp->prop_work);
+		if (!queue_work(i915->unordered_wq, &hdcp->prop_work))
+			drm_connector_put(&connector->base);
 	}
 }
 
@@ -2490,7 +2496,8 @@
 		mutex_lock(&hdcp->mutex);
 		hdcp->value = DRM_MODE_CONTENT_PROTECTION_DESIRED;
 		drm_connector_get(&connector->base);
-		queue_work(i915->unordered_wq, &hdcp->prop_work);
+		if (!queue_work(i915->unordered_wq, &hdcp->prop_work))
+			drm_connector_put(&connector->base);
 		mutex_unlock(&hdcp->mutex);
 	}
 
@@ -2507,7 +2514,9 @@
 		 */
 		if (!desired_and_not_enabled && !content_protection_type_changed) {
 			drm_connector_get(&connector->base);
-			queue_work(i915->unordered_wq, &hdcp->prop_work);
+			if (!queue_work(i915->unordered_wq, &hdcp->prop_work))
+				drm_connector_put(&connector->base);
+
 		}
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_hdcp_regs.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_hdcp_regs.h
@@ -249,7 +249,7 @@
 #define HDCP2_STREAM_STATUS(dev_priv, trans, port) \
 					(GRAPHICS_VER(dev_priv) >= 12 ? \
 					 TRANS_HDCP2_STREAM_STATUS(trans) : \
-					 PIPE_HDCP2_STREAM_STATUS(pipe))
+					 PIPE_HDCP2_STREAM_STATUS(port))
 
 #define _PORTA_HDCP2_AUTH_STREAM		0x66F00
 #define _PORTB_HDCP2_AUTH_STREAM		0x66F04
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_lpe_audio.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_lpe_audio.c
@@ -177,6 +177,14 @@
 				handle_simple_irq,
 				"hdmi_lpe_audio_irq_handler");
 
+	static const struct pci_device_id irq_quirk_ids[] = {
+		/* Dell Wyse 3040 */
+		{PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, 0x22b0, 0x1028, 0x07c1)},
+		{}
+	};
+
+	if (pci_dev_present(irq_quirk_ids))
+		return 0;
 	return irq_set_chip_data(irq, dev_priv);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_pps.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_pps.c
@@ -949,6 +949,14 @@
 		intel_de_posting_read(dev_priv, pp_ctrl_reg);
 	}
 
+	/*
+	 * WA: 22019252566
+	 * Disable DPLS gating around power sequence.
+	 */
+	if (IS_DISPLAY_VER(dev_priv, 13, 14))
+		intel_de_rmw(dev_priv, SOUTH_DSPCLK_GATE_D,
+			     0, PCH_DPLSUNIT_CLOCK_GATE_DISABLE);
+
 	pp |= PANEL_POWER_ON;
 	if (!IS_IRONLAKE(dev_priv))
 		pp |= PANEL_POWER_RESET;
@@ -959,6 +967,10 @@
 	wait_panel_on(intel_dp);
 	intel_dp->pps.last_power_on = jiffies;
 
+	if (IS_DISPLAY_VER(dev_priv, 13, 14))
+		intel_de_rmw(dev_priv, SOUTH_DSPCLK_GATE_D,
+			     PCH_DPLSUNIT_CLOCK_GATE_DISABLE, 0);
+
 	if (IS_IRONLAKE(dev_priv)) {
 		pp |= PANEL_POWER_RESET; /* restore panel reset bit */
 		intel_de_write(dev_priv, pp_ctrl_reg, pp);
@@ -1469,7 +1481,7 @@
 {
 	struct drm_i915_private *dev_priv = dp_to_i915(intel_dp);
 	u32 pp_on, pp_off, port_sel = 0;
-	int div = RUNTIME_INFO(dev_priv)->rawclk_freq / 1000;
+	int div = DISPLAY_RUNTIME_INFO(dev_priv)->rawclk_freq / 1000;
 	struct pps_registers regs;
 	enum port port = dp_to_dig_port(intel_dp)->base.port;
 	const struct edp_power_seq *seq = &intel_dp->pps.pps_delays;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_psr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_psr.c
@@ -24,6 +24,7 @@
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_damage_helper.h>
 #include <drm/drm_debugfs.h>
+#include <drm/drm_edid.h>
 
 #include "i915_drv.h"
 #include "i915_reg.h"
@@ -182,6 +183,25 @@
 		return false;
 }
 
+bool intel_psr_needs_aux_io_power(struct intel_encoder *encoder,
+				  const struct intel_crtc_state *crtc_state)
+{
+	/*
+	 * For PSR/PR modes only eDP requires the AUX IO power to be enabled whenever
+	 * the output is enabled. For non-eDP outputs the main link is always
+	 * on, hence it doesn't require the HW initiated AUX wake-up signaling used
+	 * for eDP.
+	 *
+	 * TODO:
+	 * - Consider leaving AUX IO disabled for eDP / PR as well, in case
+	 *   the ALPM with main-link off mode is not enabled.
+	 * - Leave AUX IO enabled for DP / PR, once support for ALPM with
+	 *   main-link off mode is added for it and this mode gets enabled.
+	 */
+	return intel_crtc_has_type(crtc_state, INTEL_OUTPUT_EDP) &&
+	       intel_encoder_can_psr(encoder);
+}
+
 static bool psr_global_enabled(struct intel_dp *intel_dp)
 {
 	struct intel_connector *connector = intel_dp->attached_connector;
@@ -762,8 +782,8 @@
 
 static int psr2_block_count_lines(struct intel_dp *intel_dp)
 {
-	return intel_dp->psr.io_wake_lines < 9 &&
-		intel_dp->psr.fast_wake_lines < 9 ? 8 : 12;
+	return intel_dp->psr.alpm_parameters.io_wake_lines < 9 &&
+		intel_dp->psr.alpm_parameters.fast_wake_lines < 9 ? 8 : 12;
 }
 
 static int psr2_block_count(struct intel_dp *intel_dp)
@@ -800,6 +820,7 @@
 static void hsw_activate_psr2(struct intel_dp *intel_dp)
 {
 	struct drm_i915_private *dev_priv = dp_to_i915(intel_dp);
+	struct intel_psr *psr = &intel_dp->psr;
 	enum transcoder cpu_transcoder = intel_dp->psr.transcoder;
 	u32 val = EDP_PSR2_ENABLE;
 	u32 psr_val = 0;
@@ -841,17 +862,18 @@
 		 */
 		int tmp;
 
-		tmp = map[intel_dp->psr.io_wake_lines - TGL_EDP_PSR2_IO_BUFFER_WAKE_MIN_LINES];
+		tmp = map[psr->alpm_parameters.io_wake_lines -
+			  TGL_EDP_PSR2_IO_BUFFER_WAKE_MIN_LINES];
 		val |= TGL_EDP_PSR2_IO_BUFFER_WAKE(tmp + TGL_EDP_PSR2_IO_BUFFER_WAKE_MIN_LINES);
 
-		tmp = map[intel_dp->psr.fast_wake_lines - TGL_EDP_PSR2_FAST_WAKE_MIN_LINES];
+		tmp = map[psr->alpm_parameters.fast_wake_lines - TGL_EDP_PSR2_FAST_WAKE_MIN_LINES];
 		val |= TGL_EDP_PSR2_FAST_WAKE(tmp + TGL_EDP_PSR2_FAST_WAKE_MIN_LINES);
 	} else if (DISPLAY_VER(dev_priv) >= 12) {
-		val |= TGL_EDP_PSR2_IO_BUFFER_WAKE(intel_dp->psr.io_wake_lines);
-		val |= TGL_EDP_PSR2_FAST_WAKE(intel_dp->psr.fast_wake_lines);
+		val |= TGL_EDP_PSR2_IO_BUFFER_WAKE(psr->alpm_parameters.io_wake_lines);
+		val |= TGL_EDP_PSR2_FAST_WAKE(psr->alpm_parameters.fast_wake_lines);
 	} else if (DISPLAY_VER(dev_priv) >= 9) {
-		val |= EDP_PSR2_IO_BUFFER_WAKE(intel_dp->psr.io_wake_lines);
-		val |= EDP_PSR2_FAST_WAKE(intel_dp->psr.fast_wake_lines);
+		val |= EDP_PSR2_IO_BUFFER_WAKE(psr->alpm_parameters.io_wake_lines);
+		val |= EDP_PSR2_FAST_WAKE(psr->alpm_parameters.fast_wake_lines);
 	}
 
 	if (intel_dp->psr.req_psr2_sdp_prior_scanline)
@@ -1013,11 +1035,57 @@
 	crtc_state->dc3co_exitline = crtc_vdisplay - exit_scanlines;
 }
 
+struct edid_mfgid_prodcode {
+	u8 mfg_id0;
+	u8 mfg_id1;
+	u8 prod_code0;
+	u8 prod_code1;
+};
+
+#define PSR2_DISABLE_QUIRK_ENTRY(id0, id1, code0, code1) \
+	{ .mfg_id0 = (id0), .mfg_id1 = (id1), .prod_code0 = (code0), .prod_code1 = (code1) }
+
+static struct edid_mfgid_prodcode psr2_disable_quirk_tbl[] = {
+	PSR2_DISABLE_QUIRK_ENTRY(0x4d, 0x10, 0x8f, 0x15), /* A sharp QHD panel */
+	PSR2_DISABLE_QUIRK_ENTRY(0x4d, 0x10, 0x93, 0x15), /* A sharp FHD panel */
+	PSR2_DISABLE_QUIRK_ENTRY(0x30, 0xe4, 0x8b, 0x07), /* A LG FHD panel */
+	PSR2_DISABLE_QUIRK_ENTRY(0x30, 0xe4, 0x78, 0x07), /* A LG OLED panel */
+	PSR2_DISABLE_QUIRK_ENTRY(0x30, 0xe4, 0x8c, 0x07), /* A LG QHD panel */
+	PSR2_DISABLE_QUIRK_ENTRY(0x06, 0xaf, 0x9a, 0xf9), /* An AUO panel */
+	PSR2_DISABLE_QUIRK_ENTRY(0x06, 0xaf, 0xa3, 0xc3), /* An AUO panel */
+	{ }
+};
+
+static bool is_edid_in_psr2_disable_quirk_tbl(struct intel_dp *intel_dp)
+{
+	const struct edid *p_edid;
+	int i;
+
+	p_edid = intel_dp_fetch_edid(intel_dp);
+	if (p_edid) {
+		for (i = 0; i < ARRAY_SIZE(psr2_disable_quirk_tbl); i ++) {
+			if (p_edid->mfg_id[0] == psr2_disable_quirk_tbl[i].mfg_id0 &&
+			    p_edid->mfg_id[1] == psr2_disable_quirk_tbl[i].mfg_id1 &&
+			    p_edid->prod_code[0] == psr2_disable_quirk_tbl[i].prod_code0 &&
+			    p_edid->prod_code[1] == psr2_disable_quirk_tbl[i].prod_code1)
+				return true;
+		}
+	}
+
+	return false;
+}
+
 static bool intel_psr2_sel_fetch_config_valid(struct intel_dp *intel_dp,
 					      struct intel_crtc_state *crtc_state)
 {
 	struct drm_i915_private *dev_priv = dp_to_i915(intel_dp);
 
+	if (is_edid_in_psr2_disable_quirk_tbl(intel_dp)) {
+		drm_info_once(&dev_priv->drm,
+			      "PSR2 sel fetch disabled by the edid quirk table\n");
+		return false;
+	}
+
 	if (!dev_priv->display.params.enable_psr2_sel_fetch &&
 	    intel_dp->psr.debug != I915_PSR_DEBUG_ENABLE_SEL_FETCH) {
 		drm_dbg_kms(&dev_priv->drm,
@@ -1101,26 +1169,76 @@
 	return true;
 }
 
-static bool _compute_psr2_wake_times(struct intel_dp *intel_dp,
+static bool _lnl_compute_alpm_params(struct intel_dp *intel_dp,
 				     struct intel_crtc_state *crtc_state)
 {
 	struct drm_i915_private *i915 = dp_to_i915(intel_dp);
+	int check_entry_lines;
+
+	if (DISPLAY_VER(i915) < 20)
+		return true;
+
+	/* ALPM Entry Check = 2 + CEILING( 5us /tline ) */
+	check_entry_lines = 2 +
+		intel_usecs_to_scanlines(&crtc_state->hw.adjusted_mode, 5);
+
+	if (check_entry_lines > 15)
+		return false;
+
+	if (i915->display.params.psr_safest_params)
+		check_entry_lines = 15;
+
+	intel_dp->psr.alpm_parameters.check_entry_lines = check_entry_lines;
+
+	return true;
+}
+
+/*
+ * IO wake time for DISPLAY_VER < 12 is not directly mentioned in Bspec. There
+ * are 50 us io wake time and 32 us fast wake time. Clearly preharge pulses are
+ * not (improperly) included in 32 us fast wake time. 50 us - 32 us = 18 us.
+ */
+static int skl_io_buffer_wake_time(void)
+{
+	return 18;
+}
+
+static int tgl_io_buffer_wake_time(void)
+{
+	return 10;
+}
+
+static int io_buffer_wake_time(const struct intel_crtc_state *crtc_state)
+{
+	struct drm_i915_private *i915 = to_i915(crtc_state->uapi.crtc->dev);
+
+	if (DISPLAY_VER(i915) >= 12)
+		return tgl_io_buffer_wake_time();
+	else
+		return skl_io_buffer_wake_time();
+}
+
+static bool _compute_alpm_params(struct intel_dp *intel_dp,
+				 struct intel_crtc_state *crtc_state)
+{
+	struct drm_i915_private *i915 = dp_to_i915(intel_dp);
 	int io_wake_lines, io_wake_time, fast_wake_lines, fast_wake_time;
+	int tfw_exit_latency = 20; /* eDP spec */
+	int phy_wake = 4;	   /* eDP spec */
+	int preamble = 8;	   /* eDP spec */
+	int precharge = intel_dp_aux_fw_sync_len(intel_dp) - preamble;
 	u8 max_wake_lines;
 
-	if (DISPLAY_VER(i915) >= 12) {
-		io_wake_time = 42;
-		/*
-		 * According to Bspec it's 42us, but based on testing
-		 * it is not enough -> use 45 us.
-		 */
-		fast_wake_time = 45;
+	io_wake_time = max(precharge, io_buffer_wake_time(crtc_state)) +
+		preamble + phy_wake + tfw_exit_latency;
+	fast_wake_time = precharge + preamble + phy_wake +
+		tfw_exit_latency;
+
+	if (DISPLAY_VER(i915) >= 12)
+		/* TODO: Check how we can use ALPM_CTL fast wake extended field */
 		max_wake_lines = 12;
-	} else {
-		io_wake_time = 50;
-		fast_wake_time = 32;
+	else
 		max_wake_lines = 8;
-	}
 
 	io_wake_lines = intel_usecs_to_scanlines(
 		&crtc_state->hw.adjusted_mode, io_wake_time);
@@ -1131,12 +1249,15 @@
 	    fast_wake_lines > max_wake_lines)
 		return false;
 
+	if (!_lnl_compute_alpm_params(intel_dp, crtc_state))
+		return false;
+
 	if (i915->display.params.psr_safest_params)
 		io_wake_lines = fast_wake_lines = max_wake_lines;
 
 	/* According to Bspec lower limit should be set as 7 lines. */
-	intel_dp->psr.io_wake_lines = max(io_wake_lines, 7);
-	intel_dp->psr.fast_wake_lines = max(fast_wake_lines, 7);
+	intel_dp->psr.alpm_parameters.io_wake_lines = max(io_wake_lines, 7);
+	intel_dp->psr.alpm_parameters.fast_wake_lines = max(fast_wake_lines, 7);
 
 	return true;
 }
@@ -1268,7 +1389,7 @@
 		return false;
 	}
 
-	if (!_compute_psr2_wake_times(intel_dp, crtc_state)) {
+	if (!_compute_alpm_params(intel_dp, crtc_state)) {
 		drm_dbg_kms(&dev_priv->drm,
 			    "PSR2 not enabled, Unable to use long enough wake times\n");
 		return false;
@@ -1368,6 +1489,17 @@
 		return;
 	}
 
+	/*
+	 * FIXME figure out what is wrong with PSR+bigjoiner and
+	 * fix it. Presumably something related to the fact that
+	 * PSR is a transcoder level feature.
+	 */
+	if (crtc_state->bigjoiner_pipes) {
+		drm_dbg_kms(&dev_priv->drm,
+			    "PSR disabled due to bigjoiner\n");
+		return;
+	}
+
 	if (CAN_PANEL_REPLAY(intel_dp))
 		crtc_state->has_panel_replay = true;
 	else
@@ -1504,6 +1636,21 @@
 			     wa_16013835468_bit_get(intel_dp), 0);
 }
 
+static void lnl_alpm_configure(struct intel_dp *intel_dp)
+{
+	struct drm_i915_private *dev_priv = dp_to_i915(intel_dp);
+	enum transcoder cpu_transcoder = intel_dp->psr.transcoder;
+	struct intel_psr *psr = &intel_dp->psr;
+
+	if (DISPLAY_VER(dev_priv) < 20)
+		return;
+
+	intel_de_write(dev_priv, ALPM_CTL(cpu_transcoder),
+		       ALPM_CTL_EXTENDED_FAST_WAKE_ENABLE |
+		       ALPM_CTL_ALPM_ENTRY_CHECK(psr->alpm_parameters.check_entry_lines) |
+		       ALPM_CTL_EXTENDED_FAST_WAKE_TIME(psr->alpm_parameters.fast_wake_lines));
+}
+
 static void intel_psr_enable_source(struct intel_dp *intel_dp,
 				    const struct intel_crtc_state *crtc_state)
 {
@@ -1569,6 +1716,8 @@
 			     intel_dp->psr.psr2_sel_fetch_enabled ?
 			     IGNORE_PSR2_HW_TRACKING : 0);
 
+	lnl_alpm_configure(intel_dp);
+
 	/*
 	 * Wa_16013835468
 	 * Wa_14015648006
@@ -3257,16 +3406,9 @@
 		"reserved",
 		"sink internal error",
 	};
-	static const char * const panel_replay_status[] = {
-		"Sink device frame is locked to the Source device",
-		"Sink device is coasting, using the VTotal target",
-		"Sink device is governing the frame rate (frame rate unlock is granted)",
-		"Sink device in the process of re-locking with the Source device",
-	};
 	const char *str;
 	int ret;
 	u8 status, error_status;
-	u32 idx;
 
 	if (!(CAN_PSR(intel_dp) || CAN_PANEL_REPLAY(intel_dp))) {
 		seq_puts(m, "PSR/Panel-Replay Unsupported\n");
@@ -3280,16 +3422,11 @@
 	if (ret)
 		return ret;
 
-	str = "unknown";
-	if (intel_dp->psr.panel_replay_enabled) {
-		idx = (status & DP_SINK_FRAME_LOCKED_MASK) >> DP_SINK_FRAME_LOCKED_SHIFT;
-		if (idx < ARRAY_SIZE(panel_replay_status))
-			str = panel_replay_status[idx];
-	} else if (intel_dp->psr.enabled) {
-		idx = status & DP_PSR_SINK_STATE_MASK;
-		if (idx < ARRAY_SIZE(sink_status))
-			str = sink_status[idx];
-	}
+	status &= DP_PSR_SINK_STATE_MASK;
+	if (status < ARRAY_SIZE(sink_status))
+		str = sink_status[status];
+	else
+		str = "unknown";
 
 	seq_printf(m, "Sink %s status: 0x%x [%s]\n", psr_mode_str(intel_dp), status, str);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_psr.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_psr.h
@@ -28,6 +28,8 @@
 				    (intel_dp)->psr.source_panel_replay_support)
 
 bool intel_encoder_can_psr(struct intel_encoder *encoder);
+bool intel_psr_needs_aux_io_power(struct intel_encoder *encoder,
+				  const struct intel_crtc_state *crtc_state);
 void intel_psr_init_dpcd(struct intel_dp *intel_dp);
 void intel_psr_pre_plane_update(struct intel_atomic_state *state,
 				struct intel_crtc *crtc);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_psr_regs.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_psr_regs.h
@@ -290,4 +290,61 @@
 						  _SEL_FETCH_PLANE_OFFSET_1_A - \
 						  _SEL_FETCH_PLANE_BASE_1_A)
 
+#define _ALPM_CTL_A	0x60950
+#define ALPM_CTL(tran)	_MMIO_TRANS2(tran, _ALPM_CTL_A)
+#define  ALPM_CTL_ALPM_ENABLE				REG_BIT(31)
+#define  ALPM_CTL_ALPM_AUX_LESS_ENABLE			REG_BIT(30)
+#define  ALPM_CTL_LOBF_ENABLE				REG_BIT(29)
+#define  ALPM_CTL_EXTENDED_FAST_WAKE_ENABLE		REG_BIT(28)
+#define  ALPM_CTL_KEEP_FEC_ENABLE_FOR_AUX_WAKE_SLEEP	REG_BIT(27)
+#define  ALPM_CTL_RESTORE_OCCURED			REG_BIT(26)
+#define  ALPM_CTL_RESTORE_TO_SLEEP			REG_BIT(25)
+#define  ALPM_CTL_RESTORE_TO_DEEP_SLEEP			REG_BIT(24)
+#define  ALPM_CTL_AUX_LESS_SLEEP_HOLD_TIME_MASK		REG_GENMASK(23, 21)
+#define  ALPM_CTL_AUX_LESS_SLEEP_HOLD_TIME_50_SYMBOLS	REG_FIELD_PREP(ALPM_CTL_AUX_LESS_SLEEP_HOLD_TIME_MASK, 0)
+#define  ALPM_CTL_AUX_LESS_SLEEP_HOLD_TIME_128_SYMBOLS	REG_FIELD_PREP(ALPM_CTL_AUX_LESS_SLEEP_HOLD_TIME_MASK, 1)
+#define  ALPM_CTL_AUX_LESS_SLEEP_HOLD_TIME_256_SYMBOLS	REG_FIELD_PREP(ALPM_CTL_AUX_LESS_SLEEP_HOLD_TIME_MASK, 2)
+#define  ALPM_CTL_AUX_LESS_SLEEP_HOLD_TIME_512_SYMBOLS	REG_FIELD_PREP(ALPM_CTL_AUX_LESS_SLEEP_HOLD_TIME_MASK, 3)
+#define  ALPM_CTL_AUX_WAKE_SLEEP_HOLD_ENABLE		REG_BIT(20)
+#define  ALPM_CTL_ALPM_ENTRY_CHECK_MASK			REG_GENMASK(19, 16)
+#define  ALPM_CTL_ALPM_ENTRY_CHECK(val)			REG_FIELD_PREP(ALPM_CTL_ALPM_ENTRY_CHECK_MASK, val)
+#define  ALPM_CTL_EXTENDED_FAST_WAKE_TIME_MASK		REG_GENMASK(13, 8)
+#define  ALPM_CTL_EXTENDED_FAST_WAKE_MIN_LINES		5
+#define  ALPM_CTL_EXTENDED_FAST_WAKE_TIME(lines)	REG_FIELD_PREP(ALPM_CTL_EXTENDED_FAST_WAKE_TIME_MASK, (lines) - ALPM_CTL_EXTENDED_FAST_WAKE_MIN_LINES)
+#define  ALPM_CTL_AUX_LESS_WAKE_TIME_MASK		REG_GENMASK(5, 0)
+#define  ALPM_CTL_AUX_LESS_WAKE_TIME(val)		REG_FIELD_PREP(ALPM_CTL_AUX_LESS_WAKE_TIME_MASK, val)
+
+#define _ALPM_CTL2_A	0x60954
+#define ALPM_CTL2(tran)	_MMIO_TRANS2(tran, _ALPM_CTL2_A)
+#define  ALPM_CTL2_SWITCH_TO_ACTIVE_LATENCY_MASK		REG_GENMASK(28, 24)
+#define  ALPM_CTL2_SWITCH_TO_ACTIVE_LATENCY(val)		REG_FIELD_PREP(ALPM_CTL2_SWITCH_TO_ACTIVE_LATENCY_MASK, val)
+#define  ALPM_CTL2_AUX_LESS_WAKE_TIME_EXTENSION_MASK		REG_GENMASK(19, 16)
+#define  ALPM_CTL2_AUX_LESS_WAKE_TIME_EXTENSION(val)		REG_FIELD_PREP(ALPM_CTL2_AUX_LESS_WAKE_TIME_EXTENSION_MASK, val)
+#define  ALPM_CTL2_NUMBER_OF_LTTPR_MASK				REG_GENMASK(15, 12)
+#define  ALPM_CTL2_NUMBER_OF_LTTPR(val)				REG_FIELD_PREP(ALPM_CTL2_NUMBER_OF_LTTPR_MASK, val)
+#define  ALPM_CTL2_LTTPR_AUX_LESS_SLEEP_HOLD_TIME_MASK		REG_GENMASK(10, 8)
+#define  ALPM_CTL2_LTTPR_AUX_LESS_SLEEP_HOLD_TIME(val)		REG_FIELD_PREP(ALPM_CTL2_LTTPR_AUX_LESS_SLEEP_HOLD_TIME_MASK, val)
+#define  ALPM_CTL2_FEC_DECODE_EN_POSITION_AFTER_WAKE_SR		REG_BIT(4)
+#define  ALPM_CTL2_NUMBER_AUX_LESS_ML_PHY_SLEEP_SEQUENCES_MASK	REG_GENMASK(2, 0)
+#define  ALPM_CTL2_NUMBER_AUX_LESS_ML_PHY_SLEEP_SEQUENCES(val)	REG_FIELD_PREP(ALPM_CTL2_NUMBER_AUX_LESS_ML_PHY_SLEEP_SEQUENCES_MASK, val)
+
+#define _PORT_ALPM_CTL_A			0x16fa2c
+#define PORT_ALPM_CTL(tran)			_MMIO_TRANS2(tran, _PORT_ALPM_CTL_A)
+#define  PORT_ALPM_CTL_ALPM_AUX_LESS_ENABLE	REG_BIT(31)
+#define  PORT_ALPM_CTL_MAX_PHY_SWING_SETUP_MASK	REG_GENMASK(23, 20)
+#define  PORT_ALPM_CTL_MAX_PHY_SWING_SETUP(val)	REG_FIELD_PREP(PORT_ALPM_CTL_MAX_PHY_SWING_SETUP_MASK, val)
+#define  PORT_ALPM_CTL_MAX_PHY_SWING_HOLD_MASK	REG_GENMASK(19, 16)
+#define  PORT_ALPM_CTL_MAX_PHY_SWING_HOLD(val)	REG_FIELD_PREP(PORT_ALPM_CTL_MAX_PHY_SWING_HOLD_MASK, val)
+#define  PORT_ALPM_CTL_SILENCE_PERIOD_MASK	REG_GENMASK(7, 0)
+#define  PORT_ALPM_CTL_SILENCE_PERIOD(val)	REG_FIELD_PREP(PORT_ALPM_CTL_SILENCE_PERIOD_MASK, val)
+
+#define _PORT_ALPM_LFPS_CTL_A					0x16fa30
+#define PORT_ALPM_LFPS_CTL(tran)				_MMIO_TRANS2(tran, _PORT_ALPM_LFPS_CTL_A)
+#define  PORT_ALPM_LFPS_CTL_LFPS_START_POLARITY			REG_BIT(31)
+#define  PORT_ALPM_LFPS_CTL_LFPS_CYCLE_COUNT_MASK		REG_GENMASK(27, 24)
+#define  ALPM_CTL_EXTENDED_FAST_WAKE_MIN_LINES		5
+#define  ALPM_CTL_EXTENDED_FAST_WAKE_TIME(lines)	REG_FIELD_PREP(ALPM_CTL_EXTENDED_FAST_WAKE_TIME_MASK, (lines) - ALPM_CTL_EXTENDED_FAST_WAKE_MIN_LINES)
+#define  ALPM_CTL_AUX_LESS_WAKE_TIME_MASK		REG_GENMASK(5, 0)
+#define  ALPM_CTL_AUX_LESS_WAKE_TIME(val)		REG_FIELD_PREP(ALPM_CTL_AUX_LESS_WAKE_TIME_MASK, val)
+
 #endif /* __INTEL_PSR_REGS_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_quirks.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_quirks.c
@@ -14,6 +14,11 @@
 	i915->display.quirks.mask |= BIT(quirk);
 }
 
+static void intel_set_dpcd_quirk(struct intel_dp *intel_dp, enum intel_quirk_id quirk)
+{
+	intel_dp->quirks.mask |= BIT(quirk);
+}
+
 /*
  * Some machines (Lenovo U160) do not work with SSC on LVDS for some reason
  */
@@ -65,6 +70,14 @@
 	drm_info(&i915->drm, "Applying no pps backlight power quirk\n");
 }
 
+static void quirk_fw_sync_len(struct intel_dp *intel_dp)
+{
+	struct intel_display *display = to_intel_display(intel_dp);
+
+	intel_set_dpcd_quirk(intel_dp, QUIRK_FW_SYNC_LEN);
+	drm_info(display->drm, "Applying Fast Wake sync pulse count quirk\n");
+}
+
 struct intel_quirk {
 	int device;
 	int subsystem_vendor;
@@ -72,6 +85,21 @@
 	void (*hook)(struct drm_i915_private *i915);
 };
 
+struct intel_dpcd_quirk {
+	int device;
+	int subsystem_vendor;
+	int subsystem_device;
+	u8 sink_oui[3];
+	u8 sink_device_id[6];
+	void (*hook)(struct intel_dp *intel_dp);
+};
+
+#define SINK_OUI(first, second, third) { (first), (second), (third) }
+#define SINK_DEVICE_ID(first, second, third, fourth, fifth, sixth) \
+	{ (first), (second), (third), (fourth), (fifth), (sixth) }
+
+#define SINK_DEVICE_ID_ANY	SINK_DEVICE_ID(0, 0, 0, 0, 0, 0)
+
 /* For systems that don't have a meaningful PCI subdevice/subvendor ID */
 struct intel_dmi_quirk {
 	void (*hook)(struct drm_i915_private *i915);
@@ -203,6 +231,18 @@
 	{ 0x0f31, 0x103c, 0x220f, quirk_invert_brightness },
 };
 
+static struct intel_dpcd_quirk intel_dpcd_quirks[] = {
+	/* Dell Precision 5490 */
+	{
+		.device = 0x7d55,
+		.subsystem_vendor = 0x1028,
+		.subsystem_device = 0x0cc7,
+		.sink_oui = SINK_OUI(0x38, 0xec, 0x11),
+		.hook = quirk_fw_sync_len,
+	},
+
+};
+
 void intel_init_quirks(struct drm_i915_private *i915)
 {
 	struct pci_dev *d = to_pci_dev(i915->drm.dev);
@@ -224,7 +264,35 @@
 	}
 }
 
+void intel_init_dpcd_quirks(struct intel_dp *intel_dp,
+			    const struct drm_dp_dpcd_ident *ident)
+{
+	struct intel_display *display = to_intel_display(intel_dp);
+	struct pci_dev *d = to_pci_dev(display->drm->dev);
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(intel_dpcd_quirks); i++) {
+		struct intel_dpcd_quirk *q = &intel_dpcd_quirks[i];
+
+		if (d->device == q->device &&
+		    (d->subsystem_vendor == q->subsystem_vendor ||
+		     q->subsystem_vendor == PCI_ANY_ID) &&
+		    (d->subsystem_device == q->subsystem_device ||
+		     q->subsystem_device == PCI_ANY_ID) &&
+		    !memcmp(q->sink_oui, ident->oui, sizeof(ident->oui)) &&
+		    (!memcmp(q->sink_device_id, ident->device_id,
+			    sizeof(ident->device_id)) ||
+		     !memchr_inv(q->sink_device_id, 0, sizeof(q->sink_device_id))))
+			q->hook(intel_dp);
+	}
+}
+
 bool intel_has_quirk(struct drm_i915_private *i915, enum intel_quirk_id quirk)
 {
 	return i915->display.quirks.mask & BIT(quirk);
 }
+
+bool intel_has_dpcd_quirk(struct intel_dp *intel_dp, enum intel_quirk_id quirk)
+{
+	return intel_dp->quirks.mask & BIT(quirk);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_quirks.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_quirks.h
@@ -9,6 +9,8 @@
 #include <linux/types.h>
 
 struct drm_i915_private;
+struct intel_dp;
+struct drm_dp_dpcd_ident;
 
 enum intel_quirk_id {
 	QUIRK_BACKLIGHT_PRESENT,
@@ -17,9 +19,13 @@
 	QUIRK_INVERT_BRIGHTNESS,
 	QUIRK_LVDS_SSC_DISABLE,
 	QUIRK_NO_PPS_BACKLIGHT_POWER_HOOK,
+	QUIRK_FW_SYNC_LEN,
 };
 
 void intel_init_quirks(struct drm_i915_private *i915);
+void intel_init_dpcd_quirks(struct intel_dp *intel_dp,
+			    const struct drm_dp_dpcd_ident *ident);
 bool intel_has_quirk(struct drm_i915_private *i915, enum intel_quirk_id quirk);
+bool intel_has_dpcd_quirk(struct intel_dp *intel_dp, enum intel_quirk_id quirk);
 
 #endif /* __INTEL_QUIRKS_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_sdvo.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_sdvo.c
@@ -1830,8 +1830,6 @@
 	struct intel_crtc *crtc = to_intel_crtc(old_crtc_state->uapi.crtc);
 	u32 temp;
 
-	encoder->audio_disable(encoder, old_crtc_state, conn_state);
-
 	intel_sdvo_set_active_outputs(intel_sdvo, 0);
 	if (0)
 		intel_sdvo_set_encoder_power_state(intel_sdvo,
@@ -1923,8 +1921,6 @@
 		intel_sdvo_set_encoder_power_state(intel_sdvo,
 						   DRM_MODE_DPMS_ON);
 	intel_sdvo_set_active_outputs(intel_sdvo, intel_sdvo_connector->output_flag);
-
-	encoder->audio_enable(encoder, pipe_config, conn_state);
 }
 
 static enum drm_mode_status
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_tc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_tc.c
@@ -390,6 +390,9 @@
 	bool lane_reversal = dig_port->saved_port_bits & DDI_BUF_PORT_REVERSAL;
 	u32 val;
 
+	if (DISPLAY_VER(i915) >= 14)
+		return;
+
 	drm_WARN_ON(&i915->drm,
 		    lane_reversal && tc->mode != TC_PORT_LEGACY);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_vbt_defs.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_vbt_defs.h
@@ -897,11 +897,6 @@
 	u16 reserved;
 } __packed;
 
-#define EXP_BDB_LFP_BL_DATA_SIZE_REV_191 \
-	offsetof(struct bdb_lfp_backlight_data, brightness_level)
-#define EXP_BDB_LFP_BL_DATA_SIZE_REV_234 \
-	offsetof(struct bdb_lfp_backlight_data, brightness_precision_bits)
-
 struct bdb_lfp_backlight_data {
 	u8 entry_size;
 	struct lfp_backlight_data_entry data[16];
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/intel_vrr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/intel_vrr.c
@@ -117,6 +117,13 @@
 	const struct drm_display_info *info = &connector->base.display_info;
 	int vmin, vmax;
 
+	/*
+	 * FIXME all joined pipes share the same transcoder.
+	 * Need to account for that during VRR toggle/push/etc.
+	 */
+	if (crtc_state->bigjoiner_pipes)
+		return;
+
 	if (adjusted_mode->flags & DRM_MODE_FLAG_INTERLACE)
 		return;
 
@@ -187,10 +194,11 @@
 	enum transcoder cpu_transcoder = crtc_state->cpu_transcoder;
 
 	/*
-	 * TRANS_SET_CONTEXT_LATENCY with VRR enabled
-	 * requires this chicken bit on ADL/DG2.
+	 * This bit seems to have two meanings depending on the platform:
+	 * TGL: generate VRR "safe window" for DSB vblank waits
+	 * ADL/DG2: make TRANS_SET_CONTEXT_LATENCY effective with VRR
 	 */
-	if (DISPLAY_VER(dev_priv) == 13)
+	if (IS_DISPLAY_VER(dev_priv, 12, 13))
 		intel_de_rmw(dev_priv, CHICKEN_TRANS(cpu_transcoder),
 			     0, PIPE_VBLANK_WITH_DELAY);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/skl_universal_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/skl_universal_plane.c
@@ -2290,6 +2290,9 @@
 	if (HAS_4TILE(i915))
 		caps |= INTEL_PLANE_CAP_TILING_4;
 
+	if (!IS_ENABLED(I915) && !HAS_FLAT_CCS(i915))
+		return caps;
+
 	if (skl_plane_has_rc_ccs(i915, pipe, plane_id)) {
 		caps |= INTEL_PLANE_CAP_CCS_RC;
 		if (DISPLAY_VER(i915) >= 12)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/skl_watermark.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/skl_watermark.c
@@ -63,7 +63,7 @@
 	return DISPLAY_VER(i915) == 9;
 }
 
-static bool
+bool
 intel_has_sagv(struct drm_i915_private *i915)
 {
 	return HAS_SAGV(i915) &&
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/skl_watermark.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/skl_watermark.h
@@ -25,6 +25,7 @@
 void intel_sagv_post_plane_update(struct intel_atomic_state *state);
 bool intel_can_enable_sagv(struct drm_i915_private *i915,
 			   const struct intel_bw_state *bw_state);
+bool intel_has_sagv(struct drm_i915_private *i915);
 
 u32 skl_ddb_dbuf_slice_mask(struct drm_i915_private *i915,
 			    const struct skl_ddb_entry *entry);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/display/vlv_dsi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/display/vlv_dsi.c
@@ -1868,7 +1868,6 @@
 		/* Lenovo Yoga Tab 3 Pro YT3-X90F */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
 			DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"),
 		},
 		.driver_data = (void *)vlv_dsi_lenovo_yoga_tab3_backlight_fixup,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gem/i915_gem_mman.c
@@ -290,6 +290,41 @@
 	return i915_error_to_vmf_fault(err);
 }
 
+static void set_address_limits(struct vm_area_struct *area,
+			       struct i915_vma *vma,
+			       unsigned long obj_offset,
+			       unsigned long *start_vaddr,
+			       unsigned long *end_vaddr)
+{
+	unsigned long vm_start, vm_end, vma_size; /* user's memory parameters */
+	long start, end; /* memory boundaries */
+
+	/*
+	 * Let's move into the ">> PAGE_SHIFT"
+	 * domain to be sure not to lose bits
+	 */
+	vm_start = area->vm_start >> PAGE_SHIFT;
+	vm_end = area->vm_end >> PAGE_SHIFT;
+	vma_size = vma->size >> PAGE_SHIFT;
+
+	/*
+	 * Calculate the memory boundaries by considering the offset
+	 * provided by the user during memory mapping and the offset
+	 * provided for the partial mapping.
+	 */
+	start = vm_start;
+	start -= obj_offset;
+	start += vma->gtt_view.partial.offset;
+	end = start + vma_size;
+
+	start = max_t(long, start, vm_start);
+	end = min_t(long, end, vm_end);
+
+	/* Let's move back into the "<< PAGE_SHIFT" domain */
+	*start_vaddr = (unsigned long)start << PAGE_SHIFT;
+	*end_vaddr = (unsigned long)end << PAGE_SHIFT;
+}
+
 static vm_fault_t vm_fault_gtt(struct vm_fault *vmf)
 {
 #define MIN_CHUNK_PAGES (SZ_1M >> PAGE_SHIFT)
@@ -302,14 +337,18 @@
 	struct i915_ggtt *ggtt = to_gt(i915)->ggtt;
 	bool write = area->vm_flags & VM_WRITE;
 	struct i915_gem_ww_ctx ww;
+	unsigned long obj_offset;
+	unsigned long start, end; /* memory boundaries */
 	intel_wakeref_t wakeref;
 	struct i915_vma *vma;
 	pgoff_t page_offset;
+	unsigned long pfn;
 	int srcu;
 	int ret;
 
-	/* We don't use vmf->pgoff since that has the fake offset */
+	obj_offset = area->vm_pgoff - drm_vma_node_start(&mmo->vma_node);
 	page_offset = (vmf->address - area->vm_start) >> PAGE_SHIFT;
+	page_offset += obj_offset;
 
 	trace_i915_gem_object_fault(obj, page_offset, true, write);
 
@@ -402,12 +441,14 @@
 	if (ret)
 		goto err_unpin;
 
+	set_address_limits(area, vma, obj_offset, &start, &end);
+
+	pfn = (ggtt->gmadr.start + i915_ggtt_offset(vma)) >> PAGE_SHIFT;
+	pfn += (start - area->vm_start) >> PAGE_SHIFT;
+	pfn += obj_offset - vma->gtt_view.partial.offset;
+
 	/* Finally, remap it using the new GTT offset */
-	ret = remap_io_mapping(area,
-			       area->vm_start + (vma->gtt_view.partial.offset << PAGE_SHIFT),
-			       (ggtt->gmadr.start + i915_ggtt_offset(vma)) >> PAGE_SHIFT,
-			       min_t(u64, vma->size, area->vm_end - area->vm_start),
-			       &ggtt->iomap);
+	ret = remap_io_mapping(area, start, pfn, end - start, &ggtt->iomap);
 	if (ret)
 		goto err_fence;
 
@@ -1084,6 +1125,8 @@
 		mmo = mmap_offset_attach(obj, mmap_type, NULL);
 		if (IS_ERR(mmo))
 			return PTR_ERR(mmo);
+
+		vma->vm_pgoff += drm_vma_node_start(&mmo->vma_node);
 	}
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gem/i915_gem_object.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gem/i915_gem_object.h
@@ -284,7 +284,9 @@
 static inline bool
 i915_gem_object_is_shrinkable(const struct drm_i915_gem_object *obj)
 {
-	return i915_gem_object_type_has(obj, I915_GEM_OBJECT_IS_SHRINKABLE);
+	/* TODO: make DPT shrinkable when it has no bound vmas */
+	return i915_gem_object_type_has(obj, I915_GEM_OBJECT_IS_SHRINKABLE) &&
+		!obj->is_dpt;
 }
 
 static inline bool
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gem/i915_gem_stolen.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gem/i915_gem_stolen.c
@@ -944,7 +944,11 @@
 		dsm_size = ALIGN_DOWN(lmem_size - dsm_base, SZ_1M);
 	}
 
-	if (pci_resource_len(pdev, GEN12_LMEM_BAR) < lmem_size) {
+	if (i915_direct_stolen_access(i915)) {
+		drm_dbg(&i915->drm, "Using direct DSM access\n");
+		io_start = intel_uncore_read64(uncore, GEN12_DSMBASE) & GEN12_BDSM_MASK;
+		io_size = dsm_size;
+	} else if (pci_resource_len(pdev, GEN12_LMEM_BAR) < lmem_size) {
 		io_start = 0;
 		io_size = 0;
 	} else {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
@@ -1136,7 +1136,7 @@
 		GEM_WARN_ON(!i915_ttm_cpu_maps_iomem(bo->resource));
 	}
 
-	if (wakeref & CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND)
+	if (wakeref && CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND != 0)
 		intel_wakeref_auto(&to_i915(obj->base.dev)->runtime_pm.userfault_wakeref,
 				   msecs_to_jiffies_timeout(CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND));
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/gen8_engine_cs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/gen8_engine_cs.c
@@ -226,7 +226,7 @@
 static int mtl_dummy_pipe_control(struct i915_request *rq)
 {
 	/* Wa_14016712196 */
-	if (IS_GFX_GT_IP_RANGE(rq->engine->gt, IP_VER(12, 70), IP_VER(12, 71)) ||
+	if (IS_GFX_GT_IP_RANGE(rq->engine->gt, IP_VER(12, 70), IP_VER(12, 74)) ||
 	    IS_DG2(rq->i915)) {
 		u32 *cs;
 
@@ -743,21 +743,25 @@
 }
 
 /* Wa_14014475959:dg2 */
-#define CCS_SEMAPHORE_PPHWSP_OFFSET	0x540
-static u32 ccs_semaphore_offset(struct i915_request *rq)
+/* Wa_16019325821 */
+/* Wa_14019159160 */
+#define HOLD_SWITCHOUT_SEMAPHORE_PPHWSP_OFFSET	0x540
+static u32 hold_switchout_semaphore_offset(struct i915_request *rq)
 {
 	return i915_ggtt_offset(rq->context->state) +
-		(LRC_PPHWSP_PN * PAGE_SIZE) + CCS_SEMAPHORE_PPHWSP_OFFSET;
+		(LRC_PPHWSP_PN * PAGE_SIZE) + HOLD_SWITCHOUT_SEMAPHORE_PPHWSP_OFFSET;
 }
 
 /* Wa_14014475959:dg2 */
-static u32 *ccs_emit_wa_busywait(struct i915_request *rq, u32 *cs)
+/* Wa_16019325821 */
+/* Wa_14019159160 */
+static u32 *hold_switchout_emit_wa_busywait(struct i915_request *rq, u32 *cs)
 {
 	int i;
 
 	*cs++ = MI_ATOMIC_INLINE | MI_ATOMIC_GLOBAL_GTT | MI_ATOMIC_CS_STALL |
 		MI_ATOMIC_MOVE;
-	*cs++ = ccs_semaphore_offset(rq);
+	*cs++ = hold_switchout_semaphore_offset(rq);
 	*cs++ = 0;
 	*cs++ = 1;
 
@@ -773,7 +777,7 @@
 		MI_SEMAPHORE_POLL |
 		MI_SEMAPHORE_SAD_EQ_SDD;
 	*cs++ = 0;
-	*cs++ = ccs_semaphore_offset(rq);
+	*cs++ = hold_switchout_semaphore_offset(rq);
 	*cs++ = 0;
 
 	return cs;
@@ -790,8 +794,10 @@
 		cs = gen12_emit_preempt_busywait(rq, cs);
 
 	/* Wa_14014475959:dg2 */
-	if (intel_engine_uses_wa_hold_ccs_switchout(rq->engine))
-		cs = ccs_emit_wa_busywait(rq, cs);
+	/* Wa_16019325821 */
+	/* Wa_14019159160 */
+	if (intel_engine_uses_wa_hold_switchout(rq->engine))
+		cs = hold_switchout_emit_wa_busywait(rq, cs);
 
 	rq->tail = intel_ring_offset(rq, cs);
 	assert_ring_tail_valid(rq->ring, rq->tail);
@@ -822,7 +828,7 @@
 		flags |= PIPE_CONTROL_FLUSH_L3;
 
 	/* Wa_14016712196 */
-	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71)) || IS_DG2(i915))
+	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74)) || IS_DG2(i915))
 		/* dummy PIPE_CONTROL + depth flush */
 		cs = gen12_emit_pipe_control(cs, 0,
 					     PIPE_CONTROL_DEPTH_CACHE_FLUSH, 0);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/gen8_ppgtt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/gen8_ppgtt.c
@@ -961,6 +961,9 @@
 	struct i915_vma *vma;
 	int ret;
 
+	if (!intel_gt_needs_wa_16018031267(vm->gt))
+		return 0;
+
 	/* The memory will be used only by GPU. */
 	obj = i915_gem_object_create_lmem(i915, PAGE_SIZE,
 					  I915_BO_ALLOC_VOLATILE |
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
@@ -263,8 +263,13 @@
 		i915_request_put(rq);
 	}
 
+	/* Lazy irq enabling after HW submission */
 	if (!READ_ONCE(b->irq_armed) && !list_empty(&b->signalers))
 		intel_breadcrumbs_arm_irq(b);
+
+	/* And confirm that we still want irqs enabled before we yield */
+	if (READ_ONCE(b->irq_armed) && !atomic_read(&b->active))
+		intel_breadcrumbs_disarm_irq(b);
 }
 
 struct intel_breadcrumbs *
@@ -315,13 +320,7 @@
 		return;
 
 	/* Kick the work once more to drain the signalers, and disarm the irq */
-	irq_work_sync(&b->irq_work);
-	while (READ_ONCE(b->irq_armed) && !atomic_read(&b->active)) {
-		local_irq_disable();
-		signal_irq_work(&b->irq_work);
-		local_irq_enable();
-		cond_resched();
-	}
+	irq_work_queue(&b->irq_work);
 }
 
 void intel_breadcrumbs_free(struct kref *kref)
@@ -404,7 +403,7 @@
 	 * the request as it may have completed and raised the interrupt as
 	 * we were attaching it into the lists.
 	 */
-	if (!b->irq_armed || __i915_request_is_complete(rq))
+	if (!READ_ONCE(b->irq_armed) || __i915_request_is_complete(rq))
 		irq_work_queue(&b->irq_work);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -908,6 +908,29 @@
 		info->engine_mask &= ~BIT(GSC0);
 	}
 
+	/*
+	 * Do not create the command streamer for CCS slices beyond the first.
+	 * All the workload submitted to the first engine will be shared among
+	 * all the slices.
+	 *
+	 * Once the user will be allowed to customize the CCS mode, then this
+	 * check needs to be removed.
+	 */
+	if (IS_DG2(gt->i915)) {
+		u8 first_ccs = __ffs(CCS_MASK(gt));
+
+		/*
+		 * Store the number of active cslices before
+		 * changing the CCS engine configuration
+		 */
+		gt->ccs.cslices = CCS_MASK(gt);
+
+		/* Mask off all the CCS engine */
+		info->engine_mask &= ~GENMASK(CCS3, CCS0);
+		/* Put back in the first CCS engine */
+		info->engine_mask |= BIT(_CCS(first_ccs));
+	}
+
 	return info->engine_mask;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_engine_pm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_engine_pm.c
@@ -279,9 +279,6 @@
 	intel_engine_park_heartbeat(engine);
 	intel_breadcrumbs_park(engine->breadcrumbs);
 
-	/* Must be reset upon idling, or we may miss the busy wakeup. */
-	GEM_BUG_ON(engine->sched_engine->queue_priority_hint != INT_MIN);
-
 	if (engine->park)
 		engine->park(engine);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_engine_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_engine_types.h
@@ -343,6 +343,11 @@
 	 * @start_gt_clk: GT clock time of last idle to active transition.
 	 */
 	u64 start_gt_clk;
+
+	/**
+	 * @total: The last value of total returned
+	 */
+	u64 total;
 };
 
 union intel_engine_tlb_inv_reg {
@@ -586,7 +591,7 @@
 #define I915_ENGINE_HAS_RCS_REG_STATE  BIT(9)
 #define I915_ENGINE_HAS_EU_PRIORITY    BIT(10)
 #define I915_ENGINE_FIRST_RENDER_COMPUTE BIT(11)
-#define I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT BIT(12)
+#define I915_ENGINE_USES_WA_HOLD_SWITCHOUT BIT(12)
 	unsigned int flags;
 
 	/*
@@ -696,10 +701,12 @@
 }
 
 /* Wa_14014475959:dg2 */
+/* Wa_16019325821 */
+/* Wa_14019159160 */
 static inline bool
-intel_engine_uses_wa_hold_ccs_switchout(struct intel_engine_cs *engine)
+intel_engine_uses_wa_hold_switchout(struct intel_engine_cs *engine)
 {
-	return engine->flags & I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT;
+	return engine->flags & I915_ENGINE_USES_WA_HOLD_SWITCHOUT;
 }
 
 #endif /* __INTEL_ENGINE_TYPES_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
@@ -3272,6 +3272,9 @@
 {
 	cancel_timer(&engine->execlists.timer);
 	cancel_timer(&engine->execlists.preempt);
+
+	/* Reset upon idling, or we may delay the busy wakeup. */
+	WRITE_ONCE(engine->sched_engine->queue_priority_hint, INT_MIN);
 }
 
 static void add_to_engine(struct i915_request *rq)
@@ -3312,11 +3315,7 @@
 
 static bool can_preempt(struct intel_engine_cs *engine)
 {
-	if (GRAPHICS_VER(engine->i915) > 8)
-		return true;
-
-	/* GPGPU on bdw requires extra w/a; not implemented */
-	return engine->class != RENDER_CLASS;
+	return GRAPHICS_VER(engine->i915) > 8;
 }
 
 static void kick_execlists(const struct i915_request *rq, int prio)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_ggtt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_ggtt.c
@@ -24,6 +24,7 @@
 #include "intel_ring.h"
 #include "i915_drv.h"
 #include "i915_pci.h"
+#include "i915_reg.h"
 #include "i915_request.h"
 #include "i915_scatterlist.h"
 #include "i915_utils.h"
@@ -1152,13 +1153,20 @@
 static int ggtt_probe_common(struct i915_ggtt *ggtt, u64 size)
 {
 	struct drm_i915_private *i915 = ggtt->vm.i915;
+	struct intel_uncore *uncore = ggtt->vm.gt->uncore;
 	struct pci_dev *pdev = to_pci_dev(i915->drm.dev);
 	phys_addr_t phys_addr;
 	u32 pte_flags;
 	int ret;
 
 	GEM_WARN_ON(pci_resource_len(pdev, GEN4_GTTMMADR_BAR) != gen6_gttmmadr_size(i915));
-	phys_addr = pci_resource_start(pdev, GEN4_GTTMMADR_BAR) + gen6_gttadr_offset(i915);
+
+	if (i915_direct_stolen_access(i915)) {
+		drm_dbg(&i915->drm, "Using direct GSM access\n");
+		phys_addr = intel_uncore_read64(uncore, GEN12_GSMBASE) & GEN12_BDSM_MASK;
+	} else {
+		phys_addr = pci_resource_start(pdev, GEN4_GTTMMADR_BAR) + gen6_gttadr_offset(i915);
+	}
 
 	if (needs_wc_ggtt_mapping(i915))
 		ggtt->gsm = ioremap_wc(phys_addr, size);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c
@@ -298,6 +298,7 @@
 		return;
 
 	GEM_BUG_ON(fence->vma != vma);
+	i915_active_wait(&fence->active);
 	GEM_BUG_ON(!i915_active_is_idle(&fence->active));
 	GEM_BUG_ON(atomic_read(&fence->pin_count));
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_gt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_gt.c
@@ -1024,6 +1024,12 @@
 		return I915_MAP_WC;
 }
 
+bool intel_gt_needs_wa_16018031267(struct intel_gt *gt)
+{
+	/* Wa_16018031267, Wa_16018063123 */
+	return IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 55), IP_VER(12, 71));
+}
+
 bool intel_gt_needs_wa_22016122933(struct intel_gt *gt)
 {
 	return MEDIA_VER_FULL(gt->i915) == IP_VER(13, 0) && gt->type == GT_MEDIA;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_gt.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_gt.h
@@ -82,17 +82,18 @@
 		  ##__VA_ARGS__);					\
 } while (0)
 
-#define NEEDS_FASTCOLOR_BLT_WABB(engine) ( \
-	IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 55), IP_VER(12, 71)) && \
-	engine->class == COPY_ENGINE_CLASS && engine->instance == 0)
-
 static inline bool gt_is_root(struct intel_gt *gt)
 {
 	return !gt->info.id;
 }
 
+bool intel_gt_needs_wa_16018031267(struct intel_gt *gt);
 bool intel_gt_needs_wa_22016122933(struct intel_gt *gt);
 
+#define NEEDS_FASTCOLOR_BLT_WABB(engine) ( \
+	intel_gt_needs_wa_16018031267(engine->gt) && \
+	engine->class == COPY_ENGINE_CLASS && engine->instance == 0)
+
 static inline struct intel_gt *uc_to_gt(struct intel_uc *uc)
 {
 	return container_of(uc, struct intel_gt, uc);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: MIT
+/*
+ * Copyright © 2024 Intel Corporation
+ */
+
+#include "i915_drv.h"
+#include "intel_gt.h"
+#include "intel_gt_ccs_mode.h"
+#include "intel_gt_regs.h"
+
+unsigned int intel_gt_apply_ccs_mode(struct intel_gt *gt)
+{
+	int cslice;
+	u32 mode = 0;
+	int first_ccs = __ffs(CCS_MASK(gt));
+
+	if (!IS_DG2(gt->i915))
+		return 0;
+
+	/* Build the value for the fixed CCS load balancing */
+	for (cslice = 0; cslice < I915_MAX_CCS; cslice++) {
+		if (gt->ccs.cslices & BIT(cslice))
+			/*
+			 * If available, assign the cslice
+			 * to the first available engine...
+			 */
+			mode |= XEHP_CCS_MODE_CSLICE(cslice, first_ccs);
+
+		else
+			/*
+			 * ... otherwise, mark the cslice as
+			 * unavailable if no CCS dispatches here
+			 */
+			mode |= XEHP_CCS_MODE_CSLICE(cslice,
+						     XEHP_CCS_MODE_CSLICE_MASK);
+	}
+
+	return mode;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * Copyright © 2024 Intel Corporation
+ */
+
+#ifndef __INTEL_GT_CCS_MODE_H__
+#define __INTEL_GT_CCS_MODE_H__
+
+struct intel_gt;
+
+unsigned int intel_gt_apply_ccs_mode(struct intel_gt *gt);
+
+#endif /* __INTEL_GT_CCS_MODE_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
@@ -151,7 +151,7 @@
 	 *
 	 * Testing on actual hardware has shown there is no /16.
 	 */
-	return RUNTIME_INFO(uncore->i915)->rawclk_freq * 1000;
+	return DISPLAY_RUNTIME_INFO(uncore->i915)->rawclk_freq * 1000;
 }
 
 static u32 read_clock_frequency(struct intel_uncore *uncore)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_gt_regs.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_gt_regs.h
@@ -1477,8 +1477,14 @@
 #define   ECOBITS_PPGTT_CACHE4B			(0 << 8)
 
 #define GEN12_RCU_MODE				_MMIO(0x14800)
+#define   XEHP_RCU_MODE_FIXED_SLICE_CCS_MODE	REG_BIT(1)
 #define   GEN12_RCU_MODE_CCS_ENABLE		REG_BIT(0)
 
+#define XEHP_CCS_MODE				_MMIO(0x14804)
+#define   XEHP_CCS_MODE_CSLICE_MASK		REG_GENMASK(2, 0) /* CCS0-3 + rsvd */
+#define   XEHP_CCS_MODE_CSLICE_WIDTH		ilog2(XEHP_CCS_MODE_CSLICE_MASK + 1)
+#define   XEHP_CCS_MODE_CSLICE(cslice, ccs)	(ccs << (cslice * XEHP_CCS_MODE_CSLICE_WIDTH))
+
 #define CHV_FUSE_GT				_MMIO(VLV_GUNIT_BASE + 0x2168)
 #define   CHV_FGT_DISABLE_SS0			(1 << 10)
 #define   CHV_FGT_DISABLE_SS1			(1 << 11)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_gt_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_gt_types.h
@@ -207,6 +207,14 @@
 					    [MAX_ENGINE_INSTANCE + 1];
 	enum intel_submission_method submission_method;
 
+	struct {
+		/*
+		 * Mask of the non fused CCS slices
+		 * to be used for the load balancing
+		 */
+		intel_engine_mask_t cslices;
+	} ccs;
+
 	/*
 	 * Default address space (either GGTT or ppGTT depending on arch).
 	 *
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_rc6.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_rc6.c
@@ -133,7 +133,7 @@
 			GEN9_MEDIA_PG_ENABLE |
 			GEN11_MEDIA_SAMPLER_PG_ENABLE;
 
-	if (GRAPHICS_VER(gt->i915) >= 12) {
+	if (GRAPHICS_VER(gt->i915) >= 12 && !IS_DG1(gt->i915)) {
 		for (i = 0; i < I915_MAX_VCS; i++)
 			if (HAS_ENGINE(gt, _VCS(i)))
 				pg_enable |= (VDN_HCP_POWERGATE_ENABLE(i) |
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/intel_workarounds.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/intel_workarounds.c
@@ -10,6 +10,7 @@
 #include "intel_engine_regs.h"
 #include "intel_gpu_commands.h"
 #include "intel_gt.h"
+#include "intel_gt_ccs_mode.h"
 #include "intel_gt_mcr.h"
 #include "intel_gt_print.h"
 #include "intel_gt_regs.h"
@@ -51,7 +52,8 @@
  *   registers belonging to BCS, VCS or VECS should be implemented in
  *   xcs_engine_wa_init(). Workarounds for registers not belonging to a specific
  *   engine's MMIO range but that are part of of the common RCS/CCS reset domain
- *   should be implemented in general_render_compute_wa_init().
+ *   should be implemented in general_render_compute_wa_init(). The settings
+ *   about the CCS load balancing should be added in ccs_engine_wa_mode().
  *
  * - GT workarounds: the list of these WAs is applied whenever these registers
  *   revert to their default values: on GPU reset, suspend/resume [1]_, etc.
@@ -789,8 +791,13 @@
 
 	dg2_ctx_gt_tuning_init(engine, wal);
 
-	if (IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_B0, STEP_FOREVER) ||
-	    IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B0, STEP_FOREVER))
+	/*
+	 * Due to Wa_16014892111, the DRAW_WATERMARK tuning must be done in
+	 * gen12_emit_indirect_ctx_rcs() rather than here on some early
+	 * steppings.
+	 */
+	if (!(IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_A0, STEP_B0) ||
+	      IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_A0, STEP_B0)))
 		wa_add(wal, DRAW_WATERMARK, VERT_WM_VAL, 0x3FF, 0, false);
 }
 
@@ -908,7 +915,7 @@
 	if (engine->class != RENDER_CLASS)
 		goto done;
 
-	if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 71)))
+	if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 74)))
 		xelpg_ctx_workarounds_init(engine, wal);
 	else if (IS_PONTEVECCHIO(i915))
 		; /* noop; none at this time */
@@ -1643,7 +1650,8 @@
 static void
 xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
 {
-	/* Wa_14018778641 / Wa_18018781329 */
+	/* Wa_14018575942 / Wa_18018781329 */
+	wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
 	wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
 
 	/* Wa_22016670082 */
@@ -1710,7 +1718,7 @@
  */
 static void gt_tuning_settings(struct intel_gt *gt, struct i915_wa_list *wal)
 {
-	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) {
+	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74))) {
 		wa_mcr_write_or(wal, XEHP_L3SCQREG7, BLEND_FILL_CACHING_OPT_DIS);
 		wa_mcr_write_or(wal, XEHP_SQCM, EN_32B_ACCESS);
 	}
@@ -1743,7 +1751,7 @@
 		return;
 	}
 
-	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71)))
+	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74)))
 		xelpg_gt_workarounds_init(gt, wal);
 	else if (IS_PONTEVECCHIO(i915))
 		pvc_gt_workarounds_init(gt, wal);
@@ -2216,7 +2224,7 @@
 
 	if (engine->gt->type == GT_MEDIA)
 		; /* none yet */
-	else if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 71)))
+	else if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 74)))
 		xelpg_whitelist_build(engine);
 	else if (IS_PONTEVECCHIO(i915))
 		pvc_whitelist_build(engine);
@@ -2828,7 +2836,7 @@
 {
 	struct drm_i915_private *i915 = gt->i915;
 
-	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71)) || IS_DG2(i915))
+	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74)) || IS_DG2(i915))
 		wa_mcr_write_clr_set(wal, RT_CTRL, STACKID_CTRL, STACKID_CTRL_512);
 
 	/*
@@ -2844,6 +2852,30 @@
 		wa_write_clr(wal, GEN8_GARBCNTL, GEN12_BUS_HASH_CTL_BIT_EXC);
 }
 
+static void ccs_engine_wa_mode(struct intel_engine_cs *engine, struct i915_wa_list *wal)
+{
+	struct intel_gt *gt = engine->gt;
+	u32 mode;
+
+	if (!IS_DG2(gt->i915))
+		return;
+
+	/*
+	 * Wa_14019159160: This workaround, along with others, leads to
+	 * significant challenges in utilizing load balancing among the
+	 * CCS slices. Consequently, an architectural decision has been
+	 * made to completely disable automatic CCS load balancing.
+	 */
+	wa_masked_en(wal, GEN12_RCU_MODE, XEHP_RCU_MODE_FIXED_SLICE_CCS_MODE);
+
+	/*
+	 * After having disabled automatic load balancing we need to
+	 * assign all slices to a single CCS. We will call it CCS mode 1
+	 */
+	mode = intel_gt_apply_ccs_mode(gt);
+	wa_masked_en(wal, XEHP_CCS_MODE, mode);
+}
+
 /*
  * The workarounds in this function apply to shared registers in
  * the general render reset domain that aren't tied to a
@@ -2881,7 +2913,8 @@
 	}
 
 	if (IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_B0, STEP_FOREVER) ||
-	    IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B0, STEP_FOREVER))
+	    IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B0, STEP_FOREVER) ||
+	    IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 74), IP_VER(12, 74)))
 		/* Wa_14017856879 */
 		wa_mcr_masked_en(wal, GEN9_ROW_CHICKEN3, MTL_DISABLE_FIX_FOR_EOT_FLUSH);
 
@@ -2993,8 +3026,10 @@
 	 * to a single RCS/CCS engine's workaround list since
 	 * they're reset as part of the general render domain reset.
 	 */
-	if (engine->flags & I915_ENGINE_FIRST_RENDER_COMPUTE)
+	if (engine->flags & I915_ENGINE_FIRST_RENDER_COMPUTE) {
 		general_render_compute_wa_init(engine, wal);
+		ccs_engine_wa_mode(engine, wal);
+	}
 
 	if (engine->class == COMPUTE_CLASS)
 		ccs_engine_wa_init(engine, wal);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/abi/guc_errors_abi.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/abi/guc_errors_abi.h
@@ -36,6 +36,7 @@
 	INTEL_GUC_LOAD_STATUS_INVALID_INIT_DATA_RANGE_START,
 	INTEL_GUC_LOAD_STATUS_MPU_DATA_INVALID                 = 0x73,
 	INTEL_GUC_LOAD_STATUS_INIT_MMIO_SAVE_RESTORE_INVALID   = 0x74,
+	INTEL_GUC_LOAD_STATUS_KLV_WORKAROUND_INIT_ERROR        = 0x75,
 	INTEL_GUC_LOAD_STATUS_INVALID_INIT_DATA_RANGE_END,
 
 	INTEL_GUC_LOAD_STATUS_READY                            = 0xF0,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/abi/guc_klvs_abi.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/abi/guc_klvs_abi.h
@@ -29,9 +29,9 @@
  */
 
 #define GUC_KLV_LEN_MIN				1u
-#define GUC_KLV_0_KEY				(0xffff << 16)
-#define GUC_KLV_0_LEN				(0xffff << 0)
-#define GUC_KLV_n_VALUE				(0xffffffff << 0)
+#define GUC_KLV_0_KEY				(0xffffu << 16)
+#define GUC_KLV_0_LEN				(0xffffu << 0)
+#define GUC_KLV_n_VALUE				(0xffffffffu << 0)
 
 /**
  * DOC: GuC Self Config KLVs
@@ -101,4 +101,11 @@
 	GUC_CONTEXT_POLICIES_KLV_NUM_IDS = 5,
 };
 
+/*
+ * Workaround keys:
+ */
+enum {
+	GUC_WORKAROUND_KLV_SERIALIZED_RA_MODE				= 0x9001,
+};
+
 #endif /* _ABI_GUC_KLVS_ABI_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/intel_gsc_uc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/intel_gsc_uc.c
@@ -302,7 +302,7 @@
 {
 	struct intel_gt *gt = gsc_uc_to_gt(gsc);
 
-	if (!intel_uc_fw_is_loadable(&gsc->fw))
+	if (!intel_uc_fw_is_loadable(&gsc->fw) || intel_uc_fw_is_in_error(&gsc->fw))
 		return;
 
 	if (intel_gsc_uc_fw_init_done(gsc))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/intel_guc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/intel_guc.c
@@ -294,6 +294,11 @@
 	    IS_DG2(gt->i915))
 		flags |= GUC_WA_HOLD_CCS_SWITCHOUT;
 
+	/* Wa_16019325821 */
+	/* Wa_14019159160 */
+	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71)))
+		flags |= GUC_WA_RCS_CCS_SWITCHOUT;
+
 	/*
 	 * Wa_14012197797
 	 * Wa_22011391025
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/intel_guc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/intel_guc.h
@@ -204,6 +204,8 @@
 	struct guc_mmio_reg *ads_regset;
 	/** @ads_golden_ctxt_size: size of the golden contexts in the ADS */
 	u32 ads_golden_ctxt_size;
+	/** @ads_waklv_size: size of workaround KLVs */
+	u32 ads_waklv_size;
 	/** @ads_capture_size: size of register lists in the ADS used for error capture */
 	u32 ads_capture_size;
 	/** @ads_engine_usage_size: size of engine usage in the ADS */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/intel_guc_ads.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/intel_guc_ads.c
@@ -46,6 +46,10 @@
  *      +---------------------------------------+
  *      | padding                               |
  *      +---------------------------------------+ <== 4K aligned
+ *      | w/a KLVs                              |
+ *      +---------------------------------------+
+ *      | padding                               |
+ *      +---------------------------------------+ <== 4K aligned
  *      | capture lists                         |
  *      +---------------------------------------+
  *      | padding                               |
@@ -88,6 +92,11 @@
 	return PAGE_ALIGN(guc->ads_golden_ctxt_size);
 }
 
+static u32 guc_ads_waklv_size(struct intel_guc *guc)
+{
+	return PAGE_ALIGN(guc->ads_waklv_size);
+}
+
 static u32 guc_ads_capture_size(struct intel_guc *guc)
 {
 	return PAGE_ALIGN(guc->ads_capture_size);
@@ -113,7 +122,7 @@
 	return PAGE_ALIGN(offset);
 }
 
-static u32 guc_ads_capture_offset(struct intel_guc *guc)
+static u32 guc_ads_waklv_offset(struct intel_guc *guc)
 {
 	u32 offset;
 
@@ -123,6 +132,16 @@
 	return PAGE_ALIGN(offset);
 }
 
+static u32 guc_ads_capture_offset(struct intel_guc *guc)
+{
+	u32 offset;
+
+	offset = guc_ads_waklv_offset(guc) +
+		 guc_ads_waklv_size(guc);
+
+	return PAGE_ALIGN(offset);
+}
+
 static u32 guc_ads_private_data_offset(struct intel_guc *guc)
 {
 	u32 offset;
@@ -791,6 +810,65 @@
 	return PAGE_ALIGN(total_size);
 }
 
+/* Wa_14019159160 */
+static u32 guc_waklv_ra_mode(struct intel_guc *guc, u32 offset, u32 remain)
+{
+	u32 size;
+	u32 klv_entry[] = {
+		/* 16:16 key/length */
+		FIELD_PREP(GUC_KLV_0_KEY, GUC_WORKAROUND_KLV_SERIALIZED_RA_MODE) |
+		FIELD_PREP(GUC_KLV_0_LEN, 0),
+		/* 0 dwords data */
+	};
+
+	size = sizeof(klv_entry);
+	GEM_BUG_ON(remain < size);
+
+	iosys_map_memcpy_to(&guc->ads_map, offset, klv_entry, size);
+
+	return size;
+}
+
+static void guc_waklv_init(struct intel_guc *guc)
+{
+	struct intel_gt *gt = guc_to_gt(guc);
+	u32 offset, addr_ggtt, remain, size;
+
+	if (!intel_uc_uses_guc_submission(&gt->uc))
+		return;
+
+	if (GUC_FIRMWARE_VER(guc) < MAKE_GUC_VER(70, 10, 0))
+		return;
+
+	GEM_BUG_ON(iosys_map_is_null(&guc->ads_map));
+	offset = guc_ads_waklv_offset(guc);
+	remain = guc_ads_waklv_size(guc);
+
+	/* Wa_14019159160 */
+	if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) {
+		size = guc_waklv_ra_mode(guc, offset, remain);
+		offset += size;
+		remain -= size;
+	}
+
+	size = guc_ads_waklv_size(guc) - remain;
+	if (!size)
+		return;
+
+	offset = guc_ads_waklv_offset(guc);
+	addr_ggtt = intel_guc_ggtt_offset(guc, guc->ads_vma) + offset;
+
+	ads_blob_write(guc, ads.wa_klv_addr_lo, addr_ggtt);
+	ads_blob_write(guc, ads.wa_klv_addr_hi, 0);
+	ads_blob_write(guc, ads.wa_klv_size, size);
+}
+
+static int guc_prep_waklv(struct intel_guc *guc)
+{
+	/* Fudge something chunky for now: */
+	return PAGE_SIZE;
+}
+
 static void __guc_ads_init(struct intel_guc *guc)
 {
 	struct intel_gt *gt = guc_to_gt(guc);
@@ -838,6 +916,9 @@
 	/* MMIO save/restore list */
 	guc_mmio_reg_state_init(guc);
 
+	/* Workaround KLV list */
+	guc_waklv_init(guc);
+
 	/* Private Data */
 	ads_blob_write(guc, ads.private_data, base +
 		       guc_ads_private_data_offset(guc));
@@ -881,6 +962,12 @@
 		return ret;
 	guc->ads_capture_size = ret;
 
+	/* And don't forget the workaround KLVs: */
+	ret = guc_prep_waklv(guc);
+	if (ret < 0)
+		return ret;
+	guc->ads_waklv_size = ret;
+
 	/* Now the total size can be determined: */
 	size = guc_ads_blob_size(guc);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c
@@ -115,6 +115,7 @@
 	case INTEL_GUC_LOAD_STATUS_INIT_DATA_INVALID:
 	case INTEL_GUC_LOAD_STATUS_MPU_DATA_INVALID:
 	case INTEL_GUC_LOAD_STATUS_INIT_MMIO_SAVE_RESTORE_INVALID:
+	case INTEL_GUC_LOAD_STATUS_KLV_WORKAROUND_INIT_ERROR:
 		*success = false;
 		return true;
 	}
@@ -184,7 +185,7 @@
 	 * in the seconds range. However, there is a limit on how long an
 	 * individual wait_for() can wait. So wrap it in a loop.
 	 */
-	before_freq = intel_rps_read_actual_frequency(&uncore->gt->rps);
+	before_freq = intel_rps_read_actual_frequency(&gt->rps);
 	before = ktime_get();
 	for (count = 0; count < GUC_LOAD_RETRY_LIMIT; count++) {
 		ret = wait_for(guc_load_done(uncore, &status, &success), 1000);
@@ -192,7 +193,7 @@
 			break;
 
 		guc_dbg(guc, "load still in progress, count = %d, freq = %dMHz, status = 0x%08X [0x%02X/%02X]\n",
-			count, intel_rps_read_actual_frequency(&uncore->gt->rps), status,
+			count, intel_rps_read_actual_frequency(&gt->rps), status,
 			REG_FIELD_GET(GS_BOOTROM_MASK, status),
 			REG_FIELD_GET(GS_UKERNEL_MASK, status));
 	}
@@ -204,7 +205,7 @@
 		u32 bootrom = REG_FIELD_GET(GS_BOOTROM_MASK, status);
 
 		guc_info(guc, "load failed: status = 0x%08X, time = %lldms, freq = %dMHz, ret = %d\n",
-			 status, delta_ms, intel_rps_read_actual_frequency(&uncore->gt->rps), ret);
+			 status, delta_ms, intel_rps_read_actual_frequency(&gt->rps), ret);
 		guc_info(guc, "load failed: status: Reset = %d, BootROM = 0x%02X, UKernel = 0x%02X, MIA = 0x%02X, Auth = 0x%02X\n",
 			 REG_FIELD_GET(GS_MIA_IN_RESET, status),
 			 bootrom, ukernel,
@@ -241,6 +242,11 @@
 			ret = -EPERM;
 			break;
 
+		case INTEL_GUC_LOAD_STATUS_KLV_WORKAROUND_INIT_ERROR:
+			guc_info(guc, "invalid w/a KLV entry\n");
+			ret = -EINVAL;
+			break;
+
 		case INTEL_GUC_LOAD_STATUS_HWCONFIG_START:
 			guc_info(guc, "still extracting hwconfig table.\n");
 			ret = -ETIMEDOUT;
@@ -254,11 +260,11 @@
 		guc_warn(guc, "excessive init time: %lldms! [status = 0x%08X, count = %d, ret = %d]\n",
 			 delta_ms, status, count, ret);
 		guc_warn(guc, "excessive init time: [freq = %dMHz, before = %dMHz, perf_limit_reasons = 0x%08X]\n",
-			 intel_rps_read_actual_frequency(&uncore->gt->rps), before_freq,
+			 intel_rps_read_actual_frequency(&gt->rps), before_freq,
 			 intel_uncore_read(uncore, intel_gt_perf_limit_reasons_reg(gt)));
 	} else {
 		guc_dbg(guc, "init took %lldms, freq = %dMHz, before = %dMHz, status = 0x%08X, count = %d, ret = %d\n",
-			delta_ms, intel_rps_read_actual_frequency(&uncore->gt->rps),
+			delta_ms, intel_rps_read_actual_frequency(&gt->rps),
 			before_freq, status, count, ret);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/intel_guc_fwif.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/intel_guc_fwif.h
@@ -96,8 +96,9 @@
 #define   GUC_WA_GAM_CREDITS		BIT(10)
 #define   GUC_WA_DUAL_QUEUE		BIT(11)
 #define   GUC_WA_RCS_RESET_BEFORE_RC6	BIT(13)
-#define   GUC_WA_CONTEXT_ISOLATION	BIT(15)
 #define   GUC_WA_PRE_PARSER		BIT(14)
+#define   GUC_WA_CONTEXT_ISOLATION	BIT(15)
+#define   GUC_WA_RCS_CCS_SWITCHOUT	BIT(16)
 #define   GUC_WA_HOLD_CCS_SWITCHOUT	BIT(17)
 #define   GUC_WA_POLLCS			BIT(18)
 #define   GUC_WA_RCS_REGS_IN_CCS_REGS_LIST	BIT(21)
@@ -430,7 +431,10 @@
 	u32 capture_instance[GUC_CAPTURE_LIST_INDEX_MAX][GUC_MAX_ENGINE_CLASSES];
 	u32 capture_class[GUC_CAPTURE_LIST_INDEX_MAX][GUC_MAX_ENGINE_CLASSES];
 	u32 capture_global[GUC_CAPTURE_LIST_INDEX_MAX];
-	u32 reserved[14];
+	u32 wa_klv_addr_lo;
+	u32 wa_klv_addr_hi;
+	u32 wa_klv_size;
+	u32 reserved[11];
 } __packed;
 
 /* Engine usage stats */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
@@ -1230,6 +1230,21 @@
 	} while (++i < 6);
 }
 
+static void __set_engine_usage_record(struct intel_engine_cs *engine,
+				      u32 last_in, u32 id, u32 total)
+{
+	struct iosys_map rec_map = intel_guc_engine_usage_record_map(engine);
+
+#define record_write(map_, field_, val_) \
+	iosys_map_wr_field(map_, 0, struct guc_engine_usage_record, field_, val_)
+
+	record_write(&rec_map, last_switch_in_stamp, last_in);
+	record_write(&rec_map, current_context_index, id);
+	record_write(&rec_map, total_runtime, total);
+
+#undef record_write
+}
+
 static void guc_update_engine_gt_clks(struct intel_engine_cs *engine)
 {
 	struct intel_engine_guc_stats *stats = &engine->stats.guc;
@@ -1350,9 +1365,12 @@
 		total += intel_gt_clock_interval_to_ns(gt, clk);
 	}
 
+	if (total > stats->total)
+		stats->total = total;
+
 	spin_unlock_irqrestore(&guc->timestamp.lock, flags);
 
-	return ns_to_ktime(total);
+	return ns_to_ktime(stats->total);
 }
 
 static void guc_enable_busyness_worker(struct intel_guc *guc)
@@ -1379,8 +1397,21 @@
 
 	guc_update_pm_timestamp(guc, &unused);
 	for_each_engine(engine, gt, id) {
+		struct intel_engine_guc_stats *stats = &engine->stats.guc;
+
 		guc_update_engine_gt_clks(engine);
-		engine->stats.guc.prev_total = 0;
+
+		/*
+		 * If resetting a running context, accumulate the active
+		 * time as well since there will be no context switch.
+		 */
+		if (stats->running) {
+			u64 clk = guc->timestamp.gt_stamp - stats->start_gt_clk;
+
+			stats->total_gt_clks += clk;
+		}
+		stats->prev_total = 0;
+		stats->running = 0;
 	}
 
 	spin_unlock_irqrestore(&guc->timestamp.lock, flags);
@@ -1491,6 +1522,9 @@
 
 static int guc_action_enable_usage_stats(struct intel_guc *guc)
 {
+	struct intel_gt *gt = guc_to_gt(guc);
+	struct intel_engine_cs *engine;
+	enum intel_engine_id id;
 	u32 offset = intel_guc_engine_usage_offset(guc);
 	u32 action[] = {
 		INTEL_GUC_ACTION_SET_ENG_UTIL_BUFF,
@@ -1498,6 +1532,9 @@
 		0,
 	};
 
+	for_each_engine(engine, gt, id)
+		__set_engine_usage_record(engine, 0, 0xffffffff, 0);
+
 	return intel_guc_send(guc, action, ARRAY_SIZE(action));
 }
 
@@ -2778,9 +2815,9 @@
 		ce->parallel.guc.wqi_tail = 0;
 		ce->parallel.guc.wqi_head = 0;
 
-		wq_desc_offset = i915_ggtt_offset(ce->state) +
+		wq_desc_offset = (u64)i915_ggtt_offset(ce->state) +
 				 __get_parent_scratch_offset(ce);
-		wq_base_offset = i915_ggtt_offset(ce->state) +
+		wq_base_offset = (u64)i915_ggtt_offset(ce->state) +
 				 __get_wq_offset(ce);
 		info->wq_desc_lo = lower_32_bits(wq_desc_offset);
 		info->wq_desc_hi = upper_32_bits(wq_desc_offset);
@@ -4382,7 +4419,13 @@
 	if (engine->class == COMPUTE_CLASS)
 		if (IS_GFX_GT_IP_STEP(engine->gt, IP_VER(12, 70), STEP_A0, STEP_B0) ||
 		    IS_DG2(engine->i915))
-			engine->flags |= I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT;
+			engine->flags |= I915_ENGINE_USES_WA_HOLD_SWITCHOUT;
+
+	/* Wa_16019325821 */
+	/* Wa_14019159160 */
+	if ((engine->class == COMPUTE_CLASS || engine->class == RENDER_CLASS) &&
+	    IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 71)))
+		engine->flags |= I915_ENGINE_USES_WA_HOLD_SWITCHOUT;
 
 	/*
 	 * TODO: GuC supports timeslicing and semaphores as well, but they're
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/intel_huc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/intel_huc.c
@@ -6,6 +6,7 @@
 #include <linux/types.h>
 
 #include "gt/intel_gt.h"
+#include "gt/intel_rps.h"
 #include "intel_guc_reg.h"
 #include "intel_huc.h"
 #include "intel_huc_print.h"
@@ -447,17 +448,68 @@
 	return partial ? "clear media" : "all workloads";
 }
 
+/*
+ * Use a longer timeout for debug builds so that problems can be detected
+ * and analysed. But a shorter timeout for releases so that user's don't
+ * wait forever to find out there is a problem. Note that the only reason
+ * an end user should hit the timeout is in case of extreme thermal throttling.
+ * And a system that is that hot during boot is probably dead anyway!
+ */
+#if defined(CONFIG_DRM_I915_DEBUG_GEM)
+#define HUC_LOAD_RETRY_LIMIT   20
+#else
+#define HUC_LOAD_RETRY_LIMIT   3
+#endif
+
 int intel_huc_wait_for_auth_complete(struct intel_huc *huc,
 				     enum intel_huc_authentication_type type)
 {
 	struct intel_gt *gt = huc_to_gt(huc);
-	int ret;
-
-	ret = __intel_wait_for_register(gt->uncore,
-					huc->status[type].reg,
-					huc->status[type].mask,
-					huc->status[type].value,
-					2, 50, NULL);
+	struct intel_uncore *uncore = gt->uncore;
+	ktime_t before, after, delta;
+	int ret, count;
+	u64 delta_ms;
+	u32 before_freq;
+
+	/*
+	 * The KMD requests maximum frequency during driver load, however thermal
+	 * throttling can force the frequency down to minimum (although the board
+	 * really should never get that hot in real life!). IFWI  issues have been
+	 * seen to cause sporadic failures to grant the higher frequency. And at
+	 * minimum frequency, the authentication time can be in the seconds range.
+	 * Note that there is a limit on how long an individual wait_for() can wait.
+	 * So wrap it in a loop.
+	 */
+	before_freq = intel_rps_read_actual_frequency(&gt->rps);
+	before = ktime_get();
+	for (count = 0; count < HUC_LOAD_RETRY_LIMIT; count++) {
+		ret = __intel_wait_for_register(gt->uncore,
+						huc->status[type].reg,
+						huc->status[type].mask,
+						huc->status[type].value,
+						2, 1000, NULL);
+		if (!ret)
+			break;
+
+		huc_dbg(huc, "auth still in progress, count = %d, freq = %dMHz, status = 0x%08X\n",
+			count, intel_rps_read_actual_frequency(&gt->rps),
+			huc->status[type].reg.reg);
+	}
+	after = ktime_get();
+	delta = ktime_sub(after, before);
+	delta_ms = ktime_to_ms(delta);
+
+	if (delta_ms > 50) {
+		huc_warn(huc, "excessive auth time: %lldms! [status = 0x%08X, count = %d, ret = %d]\n",
+			 delta_ms, huc->status[type].reg.reg, count, ret);
+		huc_warn(huc, "excessive auth time: [freq = %dMHz, before = %dMHz, perf_limit_reasons = 0x%08X]\n",
+			 intel_rps_read_actual_frequency(&gt->rps), before_freq,
+			 intel_uncore_read(uncore, intel_gt_perf_limit_reasons_reg(gt)));
+	} else {
+		huc_dbg(huc, "auth took %lldms, freq = %dMHz, before = %dMHz, status = 0x%08X, count = %d, ret = %d\n",
+			delta_ms, intel_rps_read_actual_frequency(&gt->rps),
+			before_freq, huc->status[type].reg.reg, count, ret);
+	}
 
 	/* mark the load process as complete even if the wait failed */
 	delayed_huc_load_complete(huc);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h
@@ -258,6 +258,11 @@
 	return __intel_uc_fw_status(uc_fw) == INTEL_UC_FIRMWARE_RUNNING;
 }
 
+static inline bool intel_uc_fw_is_in_error(struct intel_uc_fw *uc_fw)
+{
+	return intel_uc_fw_status_to_error(__intel_uc_fw_status(uc_fw)) != 0;
+}
+
 static inline bool intel_uc_fw_is_overridden(const struct intel_uc_fw *uc_fw)
 {
 	return uc_fw->user_overridden;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_driver.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_driver.c
@@ -799,7 +799,7 @@
 		goto out_cleanup_modeset2;
 
 	ret = intel_pxp_init(i915);
-	if (ret != -ENODEV)
+	if (ret && ret != -ENODEV)
 		drm_dbg(&i915->drm, "pxp init failed with %d\n", ret);
 
 	ret = intel_display_driver_probe(i915);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_gpu_error.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -1650,9 +1650,21 @@
 		return NULL;
 
 	intel_engine_get_hung_entity(engine, &ce, &rq);
-	if (rq && !i915_request_started(rq))
-		drm_info(&engine->gt->i915->drm, "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n",
-			 engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id);
+	if (rq && !i915_request_started(rq)) {
+		/*
+		 * We want to know also what is the guc_id of the context,
+		 * but if we don't have the context reference, then skip
+		 * printing it.
+		 */
+		if (ce)
+			drm_info(&engine->gt->i915->drm,
+				 "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n",
+				 engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id);
+		else
+			drm_info(&engine->gt->i915->drm,
+				 "Got hung context on %s with active request %lld:%lld not yet started\n",
+				 engine->name, rq->fence.context, rq->fence.seqno);
+	}
 
 	if (rq) {
 		capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_hwmon.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_hwmon.c
@@ -72,12 +72,13 @@
 	struct intel_uncore *uncore = ddat->uncore;
 	intel_wakeref_t wakeref;
 
-	mutex_lock(&hwmon->hwmon_lock);
+	with_intel_runtime_pm(uncore->rpm, wakeref) {
+		mutex_lock(&hwmon->hwmon_lock);
 
-	with_intel_runtime_pm(uncore->rpm, wakeref)
 		intel_uncore_rmw(uncore, reg, clear, set);
 
-	mutex_unlock(&hwmon->hwmon_lock);
+		mutex_unlock(&hwmon->hwmon_lock);
+	}
 }
 
 /*
@@ -136,20 +137,21 @@
 	else
 		rgaddr = hwmon->rg.energy_status_all;
 
-	mutex_lock(&hwmon->hwmon_lock);
+	with_intel_runtime_pm(uncore->rpm, wakeref) {
+		mutex_lock(&hwmon->hwmon_lock);
 
-	with_intel_runtime_pm(uncore->rpm, wakeref)
 		reg_val = intel_uncore_read(uncore, rgaddr);
 
-	if (reg_val >= ei->reg_val_prev)
-		ei->accum_energy += reg_val - ei->reg_val_prev;
-	else
-		ei->accum_energy += UINT_MAX - ei->reg_val_prev + reg_val;
-	ei->reg_val_prev = reg_val;
+		if (reg_val >= ei->reg_val_prev)
+			ei->accum_energy += reg_val - ei->reg_val_prev;
+		else
+			ei->accum_energy += UINT_MAX - ei->reg_val_prev + reg_val;
+		ei->reg_val_prev = reg_val;
 
-	*energy = mul_u64_u32_shr(ei->accum_energy, SF_ENERGY,
-				  hwmon->scl_shift_energy);
-	mutex_unlock(&hwmon->hwmon_lock);
+		*energy = mul_u64_u32_shr(ei->accum_energy, SF_ENERGY,
+					  hwmon->scl_shift_energy);
+		mutex_unlock(&hwmon->hwmon_lock);
+	}
 }
 
 static ssize_t
@@ -404,6 +406,7 @@
 
 	/* Block waiting for GuC reset to complete when needed */
 	for (;;) {
+		wakeref = intel_runtime_pm_get(ddat->uncore->rpm);
 		mutex_lock(&hwmon->hwmon_lock);
 
 		prepare_to_wait(&ddat->waitq, &wait, TASK_INTERRUPTIBLE);
@@ -417,14 +420,13 @@
 		}
 
 		mutex_unlock(&hwmon->hwmon_lock);
+		intel_runtime_pm_put(ddat->uncore->rpm, wakeref);
 
 		schedule();
 	}
 	finish_wait(&ddat->waitq, &wait);
 	if (ret)
-		goto unlock;
-
-	wakeref = intel_runtime_pm_get(ddat->uncore->rpm);
+		goto exit;
 
 	/* Disable PL1 limit and verify, because the limit cannot be disabled on all platforms */
 	if (val == PL1_DISABLE) {
@@ -444,9 +446,8 @@
 	intel_uncore_rmw(ddat->uncore, hwmon->rg.pkg_rapl_limit,
 			 PKG_PWR_LIM_1_EN | PKG_PWR_LIM_1, nval);
 exit:
-	intel_runtime_pm_put(ddat->uncore->rpm, wakeref);
-unlock:
 	mutex_unlock(&hwmon->hwmon_lock);
+	intel_runtime_pm_put(ddat->uncore->rpm, wakeref);
 	return ret;
 }
 
@@ -792,7 +793,7 @@
 	if (!IS_DGFX(i915))
 		return;
 
-	hwmon = devm_kzalloc(dev, sizeof(*hwmon), GFP_KERNEL);
+	hwmon = kzalloc(sizeof(*hwmon), GFP_KERNEL);
 	if (!hwmon)
 		return;
 
@@ -818,14 +819,12 @@
 	hwm_get_preregistration_info(i915);
 
 	/*  hwmon_dev points to device hwmon<i> */
-	hwmon_dev = devm_hwmon_device_register_with_info(dev, ddat->name,
-							 ddat,
-							 &hwm_chip_info,
-							 hwm_groups);
-	if (IS_ERR(hwmon_dev)) {
-		i915->hwmon = NULL;
-		return;
-	}
+	hwmon_dev = hwmon_device_register_with_info(dev, ddat->name,
+						    ddat,
+						    &hwm_chip_info,
+						    hwm_groups);
+	if (IS_ERR(hwmon_dev))
+		goto err;
 
 	ddat->hwmon_dev = hwmon_dev;
 
@@ -838,16 +837,36 @@
 		if (!hwm_gt_is_visible(ddat_gt, hwmon_energy, hwmon_energy_input, 0))
 			continue;
 
-		hwmon_dev = devm_hwmon_device_register_with_info(dev, ddat_gt->name,
-								 ddat_gt,
-								 &hwm_gt_chip_info,
-								 NULL);
+		hwmon_dev = hwmon_device_register_with_info(dev, ddat_gt->name,
+							    ddat_gt,
+							    &hwm_gt_chip_info,
+							    NULL);
 		if (!IS_ERR(hwmon_dev))
 			ddat_gt->hwmon_dev = hwmon_dev;
 	}
+	return;
+err:
+	i915_hwmon_unregister(i915);
 }
 
 void i915_hwmon_unregister(struct drm_i915_private *i915)
 {
-	fetch_and_zero(&i915->hwmon);
+	struct i915_hwmon *hwmon = i915->hwmon;
+	struct intel_gt *gt;
+	int i;
+
+	if (!hwmon)
+		return;
+
+	for_each_gt(gt, i915, i)
+		if (hwmon->ddat_gt[i].hwmon_dev)
+			hwmon_device_unregister(hwmon->ddat_gt[i].hwmon_dev);
+
+	if (hwmon->ddat.hwmon_dev)
+		hwmon_device_unregister(hwmon->ddat.hwmon_dev);
+
+	mutex_destroy(&hwmon->hwmon_lock);
+
+	kfree(i915->hwmon);
+	i915->hwmon = NULL;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_perf.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_perf.c
@@ -2749,26 +2749,6 @@
 }
 
 static int
-gen12_configure_all_contexts(struct i915_perf_stream *stream,
-			     const struct i915_oa_config *oa_config,
-			     struct i915_active *active)
-{
-	struct flex regs[] = {
-		{
-			GEN8_R_PWR_CLK_STATE(RENDER_RING_BASE),
-			CTX_R_PWR_CLK_STATE,
-		},
-	};
-
-	if (stream->engine->class != RENDER_CLASS)
-		return 0;
-
-	return oa_configure_all_contexts(stream,
-					 regs, ARRAY_SIZE(regs),
-					 active);
-}
-
-static int
 lrc_configure_all_contexts(struct i915_perf_stream *stream,
 			   const struct i915_oa_config *oa_config,
 			   struct i915_active *active)
@@ -2874,7 +2854,6 @@
 {
 	struct drm_i915_private *i915 = stream->perf->i915;
 	struct intel_uncore *uncore = stream->uncore;
-	struct i915_oa_config *oa_config = stream->oa_config;
 	bool periodic = stream->periodic;
 	u32 period_exponent = stream->period_exponent;
 	u32 sqcnt1;
@@ -2919,15 +2898,6 @@
 	intel_uncore_rmw(uncore, GEN12_SQCNT1, 0, sqcnt1);
 
 	/*
-	 * Update all contexts prior writing the mux configurations as we need
-	 * to make sure all slices/subslices are ON before writing to NOA
-	 * registers.
-	 */
-	ret = gen12_configure_all_contexts(stream, oa_config, active);
-	if (ret)
-		return ret;
-
-	/*
 	 * For Gen12, performance counters are context
 	 * saved/restored. Only enable it for the context that
 	 * requested this.
@@ -2981,9 +2951,6 @@
 				   _MASKED_BIT_DISABLE(GEN12_DISABLE_DOP_GATING));
 	}
 
-	/* Reset all contexts' slices/subslices configurations. */
-	gen12_configure_all_contexts(stream, NULL, NULL);
-
 	/* disable the context save/restore or OAR counters */
 	if (stream->ctx)
 		gen12_configure_oar_context(stream, NULL);
@@ -3225,7 +3192,7 @@
 	struct intel_gt *gt = to_gt(i915);
 
 	/* Wa_18013179988 */
-	if (IS_DG2(i915) || IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) {
+	if (IS_DG2(i915) || IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74))) {
 		intel_wakeref_t wakeref;
 		u32 reg, shift;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_reg.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_reg.h
@@ -4597,7 +4597,7 @@
 #define MTL_CHICKEN_TRANS(trans)	_MMIO_TRANS((trans), \
 						    _MTL_CHICKEN_TRANS_A, \
 						    _MTL_CHICKEN_TRANS_B)
-#define   PIPE_VBLANK_WITH_DELAY	REG_BIT(31) /* ADL/DG2 */
+#define   PIPE_VBLANK_WITH_DELAY	REG_BIT(31) /* tgl+ */
 #define   SKL_UNMASK_VBL_TO_PIPE_IN_SRD	REG_BIT(30) /* skl+ */
 #define   HSW_FRAME_START_DELAY_MASK	REG_GENMASK(28, 27)
 #define   HSW_FRAME_START_DELAY(x)	REG_FIELD_PREP(HSW_FRAME_START_DELAY_MASK, x)
@@ -5412,6 +5412,9 @@
 #define   GEN6_PCODE_FREQ_RING_RATIO_SHIFT	16
 #define GEN6_PCODE_DATA1			_MMIO(0x13812C)
 
+#define MTL_PCODE_STOLEN_ACCESS			_MMIO(0x138914)
+#define   STOLEN_ACCESS_ALLOWED			0x1
+
 /* IVYBRIDGE DPF */
 #define GEN7_L3CDERRST1(slice)		_MMIO(0xB008 + (slice) * 0x200) /* L3CD Error Status 1 */
 #define   GEN7_L3CDERRST1_ROW_MASK	(0x7ff << 14)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_scheduler.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_scheduler.c
@@ -506,6 +506,6 @@
 	return 0;
 
 err_priorities:
-	kmem_cache_destroy(slab_priorities);
+	kmem_cache_destroy(slab_dependencies);
 	return -ENOMEM;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_sw_fence.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_sw_fence.c
@@ -51,7 +51,7 @@
 	debug_object_init(fence, &i915_sw_fence_debug_descr);
 }
 
-static inline void debug_fence_init_onstack(struct i915_sw_fence *fence)
+static inline __maybe_unused void debug_fence_init_onstack(struct i915_sw_fence *fence)
 {
 	debug_object_init_on_stack(fence, &i915_sw_fence_debug_descr);
 }
@@ -77,7 +77,7 @@
 	debug_object_destroy(fence, &i915_sw_fence_debug_descr);
 }
 
-static inline void debug_fence_free(struct i915_sw_fence *fence)
+static inline __maybe_unused void debug_fence_free(struct i915_sw_fence *fence)
 {
 	debug_object_free(fence, &i915_sw_fence_debug_descr);
 	smp_wmb(); /* flush the change in state before reallocation */
@@ -94,7 +94,7 @@
 {
 }
 
-static inline void debug_fence_init_onstack(struct i915_sw_fence *fence)
+static inline __maybe_unused void debug_fence_init_onstack(struct i915_sw_fence *fence)
 {
 }
 
@@ -115,7 +115,7 @@
 {
 }
 
-static inline void debug_fence_free(struct i915_sw_fence *fence)
+static inline __maybe_unused void debug_fence_free(struct i915_sw_fence *fence)
 {
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_utils.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_utils.c
@@ -8,6 +8,7 @@
 #include <drm/drm_drv.h>
 
 #include "i915_drv.h"
+#include "i915_reg.h"
 #include "i915_utils.h"
 
 #define FDO_BUG_MSG "Please file a bug on drm/i915; see " FDO_BUG_URL " for details."
@@ -125,3 +126,19 @@
 	/* Running as a guest, we assume the host is enforcing VT'd */
 	return i915_run_as_guest();
 }
+
+bool i915_direct_stolen_access(struct drm_i915_private *i915)
+{
+	/*
+	 * Wa_22018444074
+	 *
+	 * Access via BAR can hang MTL, go directly to GSM/DSM,
+	 * except for VM guests which won't have access to it.
+	 *
+	 * Normally this would not work but on MTL the system firmware
+	 * should have relaxed the access permissions sufficiently.
+	 * 0x138914==0x1 indicates that the firmware has done its job.
+	 */
+	return IS_METEORLAKE(i915) && !i915_run_as_guest() &&
+		intel_uncore_read(&i915->uncore, MTL_PCODE_STOLEN_ACCESS) == STOLEN_ACCESS_ALLOWED;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_utils.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_utils.h
@@ -391,4 +391,6 @@
 
 bool i915_vtd_active(struct drm_i915_private *i915);
 
+bool i915_direct_stolen_access(struct drm_i915_private *i915);
+
 #endif /* !__I915_UTILS_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/i915_vma.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/i915_vma.c
@@ -34,6 +34,7 @@
 #include "gt/intel_engine.h"
 #include "gt/intel_engine_heartbeat.h"
 #include "gt/intel_gt.h"
+#include "gt/intel_gt_pm.h"
 #include "gt/intel_gt_requests.h"
 #include "gt/intel_tlb.h"
 
@@ -103,12 +104,42 @@
 
 static int __i915_vma_active(struct i915_active *ref)
 {
-	return i915_vma_tryget(active_to_vma(ref)) ? 0 : -ENOENT;
+	struct i915_vma *vma = active_to_vma(ref);
+
+	if (!i915_vma_tryget(vma))
+		return -ENOENT;
+
+	/*
+	 * Exclude global GTT VMA from holding a GT wakeref
+	 * while active, otherwise GPU never goes idle.
+	 */
+	if (!i915_vma_is_ggtt(vma)) {
+		/*
+		 * Since we and our _retire() counterpart can be
+		 * called asynchronously, storing a wakeref tracking
+		 * handle inside struct i915_vma is not safe, and
+		 * there is no other good place for that.  Hence,
+		 * use untracked variants of intel_gt_pm_get/put().
+		 */
+		intel_gt_pm_get_untracked(vma->vm->gt);
+	}
+
+	return 0;
 }
 
 static void __i915_vma_retire(struct i915_active *ref)
 {
-	i915_vma_put(active_to_vma(ref));
+	struct i915_vma *vma = active_to_vma(ref);
+
+	if (!i915_vma_is_ggtt(vma)) {
+		/*
+		 * Since we can be called from atomic contexts,
+		 * use an async variant of intel_gt_pm_put().
+		 */
+		intel_gt_pm_put_async_untracked(vma->vm->gt);
+	}
+
+	i915_vma_put(vma);
 }
 
 static struct i915_vma *
@@ -1404,7 +1435,7 @@
 	struct i915_vma_work *work = NULL;
 	struct dma_fence *moving = NULL;
 	struct i915_vma_resource *vma_res = NULL;
-	intel_wakeref_t wakeref = 0;
+	intel_wakeref_t wakeref;
 	unsigned int bound;
 	int err;
 
@@ -1424,8 +1455,14 @@
 	if (err)
 		return err;
 
-	if (flags & PIN_GLOBAL)
-		wakeref = intel_runtime_pm_get(&vma->vm->i915->runtime_pm);
+	/*
+	 * In case of a global GTT, we must hold a runtime-pm wakeref
+	 * while global PTEs are updated.  In other cases, we hold
+	 * the rpm reference while the VMA is active.  Since runtime
+	 * resume may require allocations, which are forbidden inside
+	 * vm->mutex, get the first rpm wakeref outside of the mutex.
+	 */
+	wakeref = intel_runtime_pm_get(&vma->vm->i915->runtime_pm);
 
 	if (flags & vma->vm->bind_async_flags) {
 		/* lock VM */
@@ -1561,8 +1598,7 @@
 	if (work)
 		dma_fence_work_commit_imm(&work->base);
 err_rpm:
-	if (wakeref)
-		intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref);
+	intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref);
 
 	if (moving)
 		dma_fence_put(moving);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/intel_device_info.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/intel_device_info.c
@@ -126,7 +126,6 @@
 #undef PRINT_FLAG
 
 	drm_printf(p, "has_pooled_eu: %s\n", str_yes_no(runtime->has_pooled_eu));
-	drm_printf(p, "rawclk rate: %u kHz\n", runtime->rawclk_freq);
 }
 
 #undef INTEL_VGA_DEVICE
@@ -372,10 +371,6 @@
 			 "Disabling ppGTT for VT-d support\n");
 		runtime->ppgtt_type = INTEL_PPGTT_NONE;
 	}
-
-	runtime->rawclk_freq = intel_read_rawclk(dev_priv);
-	drm_dbg(&dev_priv->drm, "rawclk rate: %d kHz\n", runtime->rawclk_freq);
-
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/intel_device_info.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/intel_device_info.h
@@ -206,8 +206,6 @@
 
 	u16 device_id;
 
-	u32 rawclk_freq;
-
 	struct intel_step_info step;
 
 	unsigned int page_sizes; /* page sizes supported by the HW */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -246,7 +246,10 @@
 		 * function, since the power state is undefined. This applies
 		 * atm to the late/early system suspend/resume handlers.
 		 */
-		if (pm_runtime_get_if_active(rpm->kdev, ignore_usecount) <= 0)
+		if ((ignore_usecount &&
+		     pm_runtime_get_if_active(rpm->kdev) <= 0) ||
+		    (!ignore_usecount &&
+		     pm_runtime_get_if_in_use(rpm->kdev) <= 0))
 			return 0;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/i915/soc/intel_dram.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/i915/soc/intel_dram.c
@@ -681,6 +681,8 @@
 	if (ret)
 		return;
 
+	drm_dbg_kms(&i915->drm, "Num qgv points %u\n", dram_info->num_qgv_points);
+
 	drm_dbg_kms(&i915->drm, "DRAM channels: %u\n", dram_info->num_channels);
 
 	drm_dbg_kms(&i915->drm, "Watermark level 0 adjustment needed: %s\n",
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imagination/pvr_ccb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/imagination/pvr_ccb.c
@@ -321,7 +321,7 @@
 	bool reserved = false;
 	u32 retries = 0;
 
-	while ((jiffies - start_timestamp) < (u32)RESERVE_SLOT_TIMEOUT ||
+	while (time_before(jiffies, start_timestamp + RESERVE_SLOT_TIMEOUT) ||
 	       retries < RESERVE_SLOT_MIN_RETRIES) {
 		reserved = pvr_kccb_try_reserve_slot(pvr_dev);
 		if (reserved)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imagination/pvr_context.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/imagination/pvr_context.c
@@ -17,10 +17,14 @@
 
 #include <drm/drm_auth.h>
 #include <drm/drm_managed.h>
+
+#include <linux/bug.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
+#include <linux/list.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
+#include <linux/spinlock.h>
 #include <linux/string.h>
 #include <linux/types.h>
 #include <linux/xarray.h>
@@ -354,6 +358,10 @@
 		return err;
 	}
 
+	spin_lock(&pvr_dev->ctx_list_lock);
+	list_add_tail(&ctx->file_link, &pvr_file->contexts);
+	spin_unlock(&pvr_dev->ctx_list_lock);
+
 	return 0;
 
 err_destroy_fw_obj:
@@ -380,6 +388,11 @@
 		container_of(ref_count, struct pvr_context, ref_count);
 	struct pvr_device *pvr_dev = ctx->pvr_dev;
 
+	WARN_ON(in_interrupt());
+	spin_lock(&pvr_dev->ctx_list_lock);
+	list_del(&ctx->file_link);
+	spin_unlock(&pvr_dev->ctx_list_lock);
+
 	xa_erase(&pvr_dev->ctx_ids, ctx->ctx_id);
 	pvr_context_destroy_queues(ctx);
 	pvr_fw_object_destroy(ctx->fw_obj);
@@ -437,11 +450,30 @@
  */
 void pvr_destroy_contexts_for_file(struct pvr_file *pvr_file)
 {
+	struct pvr_device *pvr_dev = pvr_file->pvr_dev;
 	struct pvr_context *ctx;
 	unsigned long handle;
 
 	xa_for_each(&pvr_file->ctx_handles, handle, ctx)
 		pvr_context_destroy(pvr_file, handle);
+
+	spin_lock(&pvr_dev->ctx_list_lock);
+	ctx = list_first_entry(&pvr_file->contexts, struct pvr_context, file_link);
+
+	while (!list_entry_is_head(ctx, &pvr_file->contexts, file_link)) {
+		list_del_init(&ctx->file_link);
+
+		if (pvr_context_get_if_referenced(ctx)) {
+			spin_unlock(&pvr_dev->ctx_list_lock);
+
+			pvr_vm_unmap_all(ctx->vm_ctx);
+
+			pvr_context_put(ctx);
+			spin_lock(&pvr_dev->ctx_list_lock);
+		}
+		ctx = list_first_entry(&pvr_file->contexts, struct pvr_context, file_link);
+	}
+	spin_unlock(&pvr_dev->ctx_list_lock);
 }
 
 /**
@@ -451,6 +483,7 @@
 void pvr_context_device_init(struct pvr_device *pvr_dev)
 {
 	xa_init_flags(&pvr_dev->ctx_ids, XA_FLAGS_ALLOC1);
+	spin_lock_init(&pvr_dev->ctx_list_lock);
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imagination/pvr_context.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/imagination/pvr_context.h
@@ -85,6 +85,9 @@
 		/** @compute: Transfer queue. */
 		struct pvr_queue *transfer;
 	} queues;
+
+	/** @file_link: pvr_file PVR context list link. */
+	struct list_head file_link;
 };
 
 static __always_inline struct pvr_queue *
@@ -124,6 +127,24 @@
 }
 
 /**
+ * pvr_context_get_if_referenced() - Take an additional reference on a still
+ * referenced context.
+ * @ctx: Context pointer.
+ *
+ * Call pvr_context_put() to release.
+ *
+ * Returns:
+ *  * True on success, or
+ *  * false if no context pointer passed, or the context wasn't still
+ *  * referenced.
+ */
+static __always_inline bool
+pvr_context_get_if_referenced(struct pvr_context *ctx)
+{
+	return ctx != NULL && kref_get_unless_zero(&ctx->ref_count) != 0;
+}
+
+/**
  * pvr_context_lookup() - Lookup context pointer from handle and file.
  * @pvr_file: Pointer to pvr_file structure.
  * @handle: Context handle.
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imagination/pvr_device.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/imagination/pvr_device.h
@@ -23,6 +23,7 @@
 #include <linux/kernel.h>
 #include <linux/math.h>
 #include <linux/mutex.h>
+#include <linux/spinlock_types.h>
 #include <linux/timer.h>
 #include <linux/types.h>
 #include <linux/wait.h>
@@ -293,6 +294,12 @@
 
 	/** @sched_wq: Workqueue for schedulers. */
 	struct workqueue_struct *sched_wq;
+
+	/**
+	 * @ctx_list_lock: Lock to be held when accessing the context list in
+	 *  struct pvr_file.
+	 */
+	spinlock_t ctx_list_lock;
 };
 
 /**
@@ -344,6 +351,9 @@
 	 * This array is used to allocate handles returned to userspace.
 	 */
 	struct xarray vm_ctx_handles;
+
+	/** @contexts: PVR context list. */
+	struct list_head contexts;
 };
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imagination/pvr_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/imagination/pvr_drv.c
@@ -28,6 +28,7 @@
 #include <linux/export.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
+#include <linux/list.h>
 #include <linux/mod_devicetable.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
@@ -1326,6 +1327,8 @@
 	 */
 	pvr_file->pvr_dev = pvr_dev;
 
+	INIT_LIST_HEAD(&pvr_file->contexts);
+
 	xa_init_flags(&pvr_file->ctx_handles, XA_FLAGS_ALLOC1);
 	xa_init_flags(&pvr_file->free_list_handles, XA_FLAGS_ALLOC1);
 	xa_init_flags(&pvr_file->hwrt_handles, XA_FLAGS_ALLOC1);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imagination/pvr_fw_mips.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/imagination/pvr_fw_mips.h
@@ -7,13 +7,14 @@
 #include "pvr_rogue_mips.h"
 
 #include <asm/page.h>
+#include <linux/math.h>
 #include <linux/types.h>
 
 /* Forward declaration from pvr_gem.h. */
 struct pvr_gem_object;
 
-#define PVR_MIPS_PT_PAGE_COUNT ((ROGUE_MIPSFW_MAX_NUM_PAGETABLE_PAGES * ROGUE_MIPSFW_PAGE_SIZE_4K) \
-				>> PAGE_SHIFT)
+#define PVR_MIPS_PT_PAGE_COUNT DIV_ROUND_UP(ROGUE_MIPSFW_MAX_NUM_PAGETABLE_PAGES * ROGUE_MIPSFW_PAGE_SIZE_4K, PAGE_SIZE)
+
 /**
  * struct pvr_fw_mips_data - MIPS-specific data
  */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imagination/pvr_vm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/imagination/pvr_vm.c
@@ -14,6 +14,7 @@
 #include <drm/drm_gem.h>
 #include <drm/drm_gpuvm.h>
 
+#include <linux/bug.h>
 #include <linux/container_of.h>
 #include <linux/err.h>
 #include <linux/errno.h>
@@ -114,6 +115,8 @@
 	struct drm_gpuva base;
 };
 
+#define to_pvr_vm_gpuva(va) container_of_const(va, struct pvr_vm_gpuva, base)
+
 enum pvr_vm_bind_type {
 	PVR_VM_BIND_TYPE_MAP,
 	PVR_VM_BIND_TYPE_UNMAP,
@@ -386,6 +389,7 @@
 
 	drm_gpuva_unmap(&op->unmap);
 	drm_gpuva_unlink(op->unmap.va);
+	kfree(to_pvr_vm_gpuva(op->unmap.va));
 
 	return 0;
 }
@@ -433,6 +437,7 @@
 	}
 
 	drm_gpuva_unlink(op->remap.unmap->va);
+	kfree(to_pvr_vm_gpuva(op->remap.unmap->va));
 
 	return 0;
 }
@@ -593,12 +598,26 @@
 }
 
 /**
- * pvr_vm_context_release() - Teardown a VM context.
- * @ref_count: Pointer to reference counter of the VM context.
+ * pvr_vm_unmap_all() - Unmap all mappings associated with a VM context.
+ * @vm_ctx: Target VM context.
  *
  * This function ensures that no mappings are left dangling by unmapping them
  * all in order of ascending device-virtual address.
  */
+void
+pvr_vm_unmap_all(struct pvr_vm_context *vm_ctx)
+{
+	WARN_ON(pvr_vm_unmap(vm_ctx, vm_ctx->gpuvm_mgr.mm_start,
+			     vm_ctx->gpuvm_mgr.mm_range));
+}
+
+/**
+ * pvr_vm_context_release() - Teardown a VM context.
+ * @ref_count: Pointer to reference counter of the VM context.
+ *
+ * This function also ensures that no mappings are left dangling by calling
+ * pvr_vm_unmap_all.
+ */
 static void
 pvr_vm_context_release(struct kref *ref_count)
 {
@@ -608,8 +627,7 @@
 	if (vm_ctx->fw_mem_ctx_obj)
 		pvr_fw_object_destroy(vm_ctx->fw_mem_ctx_obj);
 
-	WARN_ON(pvr_vm_unmap(vm_ctx, vm_ctx->gpuvm_mgr.mm_start,
-			     vm_ctx->gpuvm_mgr.mm_range));
+	pvr_vm_unmap_all(vm_ctx);
 
 	pvr_mmu_context_destroy(vm_ctx->mmu_ctx);
 	drm_gem_private_object_fini(&vm_ctx->dummy_gem);
@@ -636,9 +654,7 @@
 
 	xa_lock(&pvr_file->vm_ctx_handles);
 	vm_ctx = xa_load(&pvr_file->vm_ctx_handles, handle);
-	if (vm_ctx)
-		kref_get(&vm_ctx->ref_count);
-
+	pvr_vm_context_get(vm_ctx);
 	xa_unlock(&pvr_file->vm_ctx_handles);
 
 	return vm_ctx;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imagination/pvr_vm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/imagination/pvr_vm.h
@@ -39,6 +39,7 @@
 	       struct pvr_gem_object *pvr_obj, u64 pvr_obj_offset,
 	       u64 device_addr, u64 size);
 int pvr_vm_unmap(struct pvr_vm_context *vm_ctx, u64 device_addr, u64 size);
+void pvr_vm_unmap_all(struct pvr_vm_context *vm_ctx);
 
 dma_addr_t pvr_vm_get_page_table_root_addr(struct pvr_vm_context *vm_ctx);
 struct dma_resv *pvr_vm_get_dma_resv(struct pvr_vm_context *vm_ctx);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imagination/pvr_vm_mips.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/imagination/pvr_vm_mips.c
@@ -46,7 +46,7 @@
 	if (!mips_data)
 		return -ENOMEM;
 
-	for (page_nr = 0; page_nr < ARRAY_SIZE(mips_data->pt_pages); page_nr++) {
+	for (page_nr = 0; page_nr < PVR_MIPS_PT_PAGE_COUNT; page_nr++) {
 		mips_data->pt_pages[page_nr] = alloc_page(GFP_KERNEL | __GFP_ZERO);
 		if (!mips_data->pt_pages[page_nr]) {
 			err = -ENOMEM;
@@ -102,7 +102,7 @@
 	int page_nr;
 
 	vunmap(mips_data->pt);
-	for (page_nr = ARRAY_SIZE(mips_data->pt_pages) - 1; page_nr >= 0; page_nr--) {
+	for (page_nr = PVR_MIPS_PT_PAGE_COUNT - 1; page_nr >= 0; page_nr--) {
 		dma_unmap_page(from_pvr_device(pvr_dev)->dev,
 			       mips_data->pt_dma_addr[page_nr], PAGE_SIZE, DMA_TO_DEVICE);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imx/dcss/dcss-crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/imx/dcss/dcss-crtc.c
@@ -206,15 +206,13 @@
 	if (crtc->irq < 0)
 		return crtc->irq;
 
-	ret = request_irq(crtc->irq, dcss_crtc_irq_handler,
-			  0, "dcss_drm", crtc);
+	ret = request_irq(crtc->irq, dcss_crtc_irq_handler, IRQF_NO_AUTOEN,
+			  "dcss_drm", crtc);
 	if (ret) {
 		dev_err(dcss->dev, "irq request failed with %d.\n", ret);
 		return ret;
 	}
 
-	disable_irq(crtc->irq);
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
@@ -410,14 +410,12 @@
 	}
 
 	ipu_crtc->irq = ipu_plane_irq(ipu_crtc->plane[0]);
-	ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler, 0,
-			"imx_drm", ipu_crtc);
+	ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler,
+			       IRQF_NO_AUTOEN, "imx_drm", ipu_crtc);
 	if (ret < 0) {
 		dev_err(ipu_crtc->dev, "irq request failed with %d.\n", ret);
 		return ret;
 	}
-	/* Only enable IRQ when we actually need it to trigger work. */
-	disable_irq(ipu_crtc->irq);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/imx/ipuv3/parallel-display.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/imx/ipuv3/parallel-display.c
@@ -72,14 +72,14 @@
 		int ret;
 
 		if (!mode)
-			return -EINVAL;
+			return 0;
 
 		ret = of_get_drm_display_mode(np, &imxpd->mode,
 					      &imxpd->bus_flags,
 					      OF_USE_NATIVE_MODE);
 		if (ret) {
 			drm_mode_destroy(connector->dev, mode);
-			return ret;
+			return 0;
 		}
 
 		drm_mode_copy(mode, &imxpd->mode);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/lima/lima_bcast.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/lima/lima_bcast.c
@@ -43,6 +43,18 @@
 
 }
 
+int lima_bcast_mask_irq(struct lima_ip *ip)
+{
+	bcast_write(LIMA_BCAST_BROADCAST_MASK, 0);
+	bcast_write(LIMA_BCAST_INTERRUPT_MASK, 0);
+	return 0;
+}
+
+int lima_bcast_reset(struct lima_ip *ip)
+{
+	return lima_bcast_hw_init(ip);
+}
+
 int lima_bcast_init(struct lima_ip *ip)
 {
 	int i;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/lima/lima_bcast.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/lima/lima_bcast.h
@@ -13,4 +13,7 @@
 
 void lima_bcast_enable(struct lima_device *dev, int num_pp);
 
+int lima_bcast_mask_irq(struct lima_ip *ip);
+int lima_bcast_reset(struct lima_ip *ip);
+
 #endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/lima/lima_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/lima/lima_drv.c
@@ -486,3 +486,4 @@
 MODULE_AUTHOR("Lima Project Developers");
 MODULE_DESCRIPTION("Lima DRM Driver");
 MODULE_LICENSE("GPL v2");
+MODULE_SOFTDEP("pre: governor_simpleondemand");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/lima/lima_gem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/lima/lima_gem.c
@@ -75,29 +75,34 @@
 	} else {
 		bo->base.sgt = kmalloc(sizeof(*bo->base.sgt), GFP_KERNEL);
 		if (!bo->base.sgt) {
-			sg_free_table(&sgt);
-			return -ENOMEM;
+			ret = -ENOMEM;
+			goto err_out0;
 		}
 	}
 
 	ret = dma_map_sgtable(dev, &sgt, DMA_BIDIRECTIONAL, 0);
-	if (ret) {
-		sg_free_table(&sgt);
-		kfree(bo->base.sgt);
-		bo->base.sgt = NULL;
-		return ret;
-	}
+	if (ret)
+		goto err_out1;
 
 	*bo->base.sgt = sgt;
 
 	if (vm) {
 		ret = lima_vm_map_bo(vm, bo, old_size >> PAGE_SHIFT);
 		if (ret)
-			return ret;
+			goto err_out2;
 	}
 
 	bo->heap_size = new_size;
 	return 0;
+
+err_out2:
+	dma_unmap_sgtable(dev, &sgt, DMA_BIDIRECTIONAL, 0);
+err_out1:
+	kfree(bo->base.sgt);
+	bo->base.sgt = NULL;
+err_out0:
+	sg_free_table(&sgt);
+	return ret;
 }
 
 int lima_gem_create_handle(struct drm_device *dev, struct drm_file *file,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/lima/lima_gp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/lima/lima_gp.c
@@ -166,6 +166,11 @@
 	gp_write(LIMA_GP_CMD, cmd);
 }
 
+static int lima_gp_bus_stop_poll(struct lima_ip *ip)
+{
+	return !!(gp_read(LIMA_GP_STATUS) & LIMA_GP_STATUS_BUS_STOPPED);
+}
+
 static int lima_gp_hard_reset_poll(struct lima_ip *ip)
 {
 	gp_write(LIMA_GP_PERF_CNT_0_LIMIT, 0xC01A0000);
@@ -179,6 +184,13 @@
 
 	gp_write(LIMA_GP_PERF_CNT_0_LIMIT, 0xC0FFE000);
 	gp_write(LIMA_GP_INT_MASK, 0);
+
+	gp_write(LIMA_GP_CMD, LIMA_GP_CMD_STOP_BUS);
+	ret = lima_poll_timeout(ip, lima_gp_bus_stop_poll, 10, 100);
+	if (ret) {
+		dev_err(dev->dev, "%s bus stop timeout\n", lima_ip_name(ip));
+		return ret;
+	}
 	gp_write(LIMA_GP_CMD, LIMA_GP_CMD_RESET);
 	ret = lima_poll_timeout(ip, lima_gp_hard_reset_poll, 10, 100);
 	if (ret) {
@@ -212,6 +224,13 @@
 	lima_sched_pipe_task_done(pipe);
 }
 
+static void lima_gp_task_mask_irq(struct lima_sched_pipe *pipe)
+{
+	struct lima_ip *ip = pipe->processor[0];
+
+	gp_write(LIMA_GP_INT_MASK, 0);
+}
+
 static int lima_gp_task_recover(struct lima_sched_pipe *pipe)
 {
 	struct lima_ip *ip = pipe->processor[0];
@@ -317,7 +336,9 @@
 
 void lima_gp_fini(struct lima_ip *ip)
 {
+	struct lima_device *dev = ip->dev;
 
+	devm_free_irq(dev->dev, ip->irq, ip);
 }
 
 int lima_gp_pipe_init(struct lima_device *dev)
@@ -344,6 +365,7 @@
 	pipe->task_error = lima_gp_task_error;
 	pipe->task_mmu_error = lima_gp_task_mmu_error;
 	pipe->task_recover = lima_gp_task_recover;
+	pipe->task_mask_irq = lima_gp_task_mask_irq;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/lima/lima_mmu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/lima/lima_mmu.c
@@ -118,7 +118,12 @@
 
 void lima_mmu_fini(struct lima_ip *ip)
 {
+	struct lima_device *dev = ip->dev;
 
+	if (ip->id == lima_ip_ppmmu_bcast)
+		return;
+
+	devm_free_irq(dev->dev, ip->irq, ip);
 }
 
 void lima_mmu_flush_tlb(struct lima_ip *ip)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/lima/lima_pp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/lima/lima_pp.c
@@ -266,7 +266,9 @@
 
 void lima_pp_fini(struct lima_ip *ip)
 {
+	struct lima_device *dev = ip->dev;
 
+	devm_free_irq(dev->dev, ip->irq, ip);
 }
 
 int lima_pp_bcast_resume(struct lima_ip *ip)
@@ -299,7 +301,9 @@
 
 void lima_pp_bcast_fini(struct lima_ip *ip)
 {
+	struct lima_device *dev = ip->dev;
 
+	devm_free_irq(dev->dev, ip->irq, ip);
 }
 
 static int lima_pp_task_validate(struct lima_sched_pipe *pipe,
@@ -408,6 +412,9 @@
 
 		lima_pp_hard_reset(ip);
 	}
+
+	if (pipe->bcast_processor)
+		lima_bcast_reset(pipe->bcast_processor);
 }
 
 static void lima_pp_task_mmu_error(struct lima_sched_pipe *pipe)
@@ -416,6 +423,20 @@
 		lima_sched_pipe_task_done(pipe);
 }
 
+static void lima_pp_task_mask_irq(struct lima_sched_pipe *pipe)
+{
+	int i;
+
+	for (i = 0; i < pipe->num_processor; i++) {
+		struct lima_ip *ip = pipe->processor[i];
+
+		pp_write(LIMA_PP_INT_MASK, 0);
+	}
+
+	if (pipe->bcast_processor)
+		lima_bcast_mask_irq(pipe->bcast_processor);
+}
+
 static struct kmem_cache *lima_pp_task_slab;
 static int lima_pp_task_slab_refcnt;
 
@@ -447,6 +468,7 @@
 	pipe->task_fini = lima_pp_task_fini;
 	pipe->task_error = lima_pp_task_error;
 	pipe->task_mmu_error = lima_pp_task_mmu_error;
+	pipe->task_mask_irq = lima_pp_task_mask_irq;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/lima/lima_sched.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/lima/lima_sched.c
@@ -402,6 +402,13 @@
 	struct lima_sched_task *task = to_lima_task(job);
 	struct lima_device *ldev = pipe->ldev;
 
+	/*
+	 * The task might still finish while this timeout handler runs.
+	 * To prevent a race condition on its completion, mask all irqs
+	 * on the running core until the next hard reset completes.
+	 */
+	pipe->task_mask_irq(pipe);
+
 	if (!pipe->error)
 		DRM_ERROR("lima job timeout\n");
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/lima/lima_sched.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/lima/lima_sched.h
@@ -80,6 +80,7 @@
 	void (*task_error)(struct lima_sched_pipe *pipe);
 	void (*task_mmu_error)(struct lima_sched_pipe *pipe);
 	int (*task_recover)(struct lima_sched_pipe *pipe);
+	void (*task_mask_irq)(struct lima_sched_pipe *pipe);
 
 	struct work_struct recover_work;
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mcde/mcde_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mcde/mcde_drv.c
@@ -473,6 +473,7 @@
 	},
 	{},
 };
+MODULE_DEVICE_TABLE(of, mcde_of_match);
 
 static struct platform_driver mcde_driver = {
 	.driver = {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/Kconfig
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/Kconfig
@@ -10,9 +10,6 @@
 	select DRM_KMS_HELPER
 	select DRM_MIPI_DSI
 	select DRM_PANEL
-	select MEMORY
-	select MTK_SMI
-	select PHY_MTK_MIPI_DSI
 	select VIDEOMODE_HELPERS
 	help
 	  Choose this option if you have a Mediatek SoCs.
@@ -23,7 +20,6 @@
 config DRM_MEDIATEK_DP
 	tristate "DRM DPTX Support for MediaTek SoCs"
 	depends on DRM_MEDIATEK
-	select PHY_MTK_DP
 	select DRM_DISPLAY_HELPER
 	select DRM_DISPLAY_DP_HELPER
 	select DRM_DP_AUX_BUS
@@ -34,6 +30,5 @@
 	tristate "DRM HDMI Support for Mediatek SoCs"
 	depends on DRM_MEDIATEK
 	select SND_SOC_HDMI_CODEC if SND_SOC
-	select PHY_MTK_HDMI
 	help
 	  DRM/KMS HDMI driver for Mediatek SoCs
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
@@ -38,6 +38,7 @@
 #define DISP_REG_OVL_PITCH_MSB(n)		(0x0040 + 0x20 * (n))
 #define OVL_PITCH_MSB_2ND_SUBBUF			BIT(16)
 #define DISP_REG_OVL_PITCH(n)			(0x0044 + 0x20 * (n))
+#define OVL_CONST_BLEND					BIT(28)
 #define DISP_REG_OVL_RDMA_CTRL(n)		(0x00c0 + 0x20 * (n))
 #define DISP_REG_OVL_RDMA_GMC(n)		(0x00c8 + 0x20 * (n))
 #define DISP_REG_OVL_ADDR_MT2701		0x0040
@@ -71,6 +72,8 @@
 #define	OVL_CON_VIRT_FLIP	BIT(9)
 #define	OVL_CON_HORZ_FLIP	BIT(10)
 
+#define OVL_COLOR_ALPHA		GENMASK(31, 24)
+
 static const u32 mt8173_formats[] = {
 	DRM_FORMAT_XRGB8888,
 	DRM_FORMAT_ARGB8888,
@@ -273,7 +276,13 @@
 	if (w != 0 && h != 0)
 		mtk_ddp_write_relaxed(cmdq_pkt, h << 16 | w, &ovl->cmdq_reg, ovl->regs,
 				      DISP_REG_OVL_ROI_SIZE);
-	mtk_ddp_write_relaxed(cmdq_pkt, 0x0, &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_ROI_BGCLR);
+
+	/*
+	 * The background color must be opaque black (ARGB),
+	 * otherwise the alpha blending will have no effect
+	 */
+	mtk_ddp_write_relaxed(cmdq_pkt, OVL_COLOR_ALPHA, &ovl->cmdq_reg,
+			      ovl->regs, DISP_REG_OVL_ROI_BGCLR);
 
 	mtk_ddp_write(cmdq_pkt, 0x1, &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_RST);
 	mtk_ddp_write(cmdq_pkt, 0x0, &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_RST);
@@ -358,11 +367,6 @@
 
 static unsigned int ovl_fmt_convert(struct mtk_disp_ovl *ovl, unsigned int fmt)
 {
-	/* The return value in switch "MEM_MODE_INPUT_FORMAT_XXX"
-	 * is defined in mediatek HW data sheet.
-	 * The alphabet order in XXX is no relation to data
-	 * arrangement in memory.
-	 */
 	switch (fmt) {
 	default:
 	case DRM_FORMAT_RGB565:
@@ -394,6 +398,29 @@
 	}
 }
 
+static void mtk_ovl_afbc_layer_config(struct mtk_disp_ovl *ovl,
+				      unsigned int idx,
+				      struct mtk_plane_pending_state *pending,
+				      struct cmdq_pkt *cmdq_pkt)
+{
+	unsigned int pitch_msb = pending->pitch >> 16;
+	unsigned int hdr_pitch = pending->hdr_pitch;
+	unsigned int hdr_addr = pending->hdr_addr;
+
+	if (pending->modifier != DRM_FORMAT_MOD_LINEAR) {
+		mtk_ddp_write_relaxed(cmdq_pkt, hdr_addr, &ovl->cmdq_reg, ovl->regs,
+				      DISP_REG_OVL_HDR_ADDR(ovl, idx));
+		mtk_ddp_write_relaxed(cmdq_pkt,
+				      OVL_PITCH_MSB_2ND_SUBBUF | pitch_msb,
+				      &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx));
+		mtk_ddp_write_relaxed(cmdq_pkt, hdr_pitch, &ovl->cmdq_reg, ovl->regs,
+				      DISP_REG_OVL_HDR_PITCH(ovl, idx));
+	} else {
+		mtk_ddp_write_relaxed(cmdq_pkt, pitch_msb,
+				      &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx));
+	}
+}
+
 void mtk_ovl_layer_config(struct device *dev, unsigned int idx,
 			  struct mtk_plane_state *state,
 			  struct cmdq_pkt *cmdq_pkt)
@@ -401,23 +428,13 @@
 	struct mtk_disp_ovl *ovl = dev_get_drvdata(dev);
 	struct mtk_plane_pending_state *pending = &state->pending;
 	unsigned int addr = pending->addr;
-	unsigned int hdr_addr = pending->hdr_addr;
-	unsigned int pitch = pending->pitch;
-	unsigned int hdr_pitch = pending->hdr_pitch;
+	unsigned int pitch_lsb = pending->pitch & GENMASK(15, 0);
 	unsigned int fmt = pending->format;
+	unsigned int rotation = pending->rotation;
 	unsigned int offset = (pending->y << 16) | pending->x;
 	unsigned int src_size = (pending->height << 16) | pending->width;
+	unsigned int ignore_pixel_alpha = 0;
 	unsigned int con;
-	bool is_afbc = pending->modifier != DRM_FORMAT_MOD_LINEAR;
-	union overlay_pitch {
-		struct split_pitch {
-			u16 lsb;
-			u16 msb;
-		} split_pitch;
-		u32 pitch;
-	} overlay_pitch;
-
-	overlay_pitch.pitch = pitch;
 
 	if (!pending->enable) {
 		mtk_ovl_layer_off(dev, idx, cmdq_pkt);
@@ -428,23 +445,39 @@
 	if (state->base.fb && state->base.fb->format->has_alpha)
 		con |= OVL_CON_AEN | OVL_CON_ALPHA;
 
-	if (pending->rotation & DRM_MODE_REFLECT_Y) {
+	/* CONST_BLD must be enabled for XRGB formats although the alpha channel
+	 * can be ignored, or OVL will still read the value from memory.
+	 * For RGB888 related formats, whether CONST_BLD is enabled or not won't
+	 * affect the result. Therefore we use !has_alpha as the condition.
+	 */
+	if (state->base.fb && !state->base.fb->format->has_alpha)
+		ignore_pixel_alpha = OVL_CONST_BLEND;
+
+	/*
+	 * Treat rotate 180 as flip x + flip y, and XOR the original rotation value
+	 * to flip x + flip y to support both in the same time.
+	 */
+	if (rotation & DRM_MODE_ROTATE_180)
+		rotation ^= DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y;
+
+	if (rotation & DRM_MODE_REFLECT_Y) {
 		con |= OVL_CON_VIRT_FLIP;
 		addr += (pending->height - 1) * pending->pitch;
 	}
 
-	if (pending->rotation & DRM_MODE_REFLECT_X) {
+	if (rotation & DRM_MODE_REFLECT_X) {
 		con |= OVL_CON_HORZ_FLIP;
 		addr += pending->pitch - 1;
 	}
 
 	if (ovl->data->supports_afbc)
-		mtk_ovl_set_afbc(ovl, cmdq_pkt, idx, is_afbc);
+		mtk_ovl_set_afbc(ovl, cmdq_pkt, idx,
+				 pending->modifier != DRM_FORMAT_MOD_LINEAR);
 
 	mtk_ddp_write_relaxed(cmdq_pkt, con, &ovl->cmdq_reg, ovl->regs,
 			      DISP_REG_OVL_CON(idx));
-	mtk_ddp_write_relaxed(cmdq_pkt, overlay_pitch.split_pitch.lsb, &ovl->cmdq_reg, ovl->regs,
-			      DISP_REG_OVL_PITCH(idx));
+	mtk_ddp_write_relaxed(cmdq_pkt, pitch_lsb | ignore_pixel_alpha,
+			      &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH(idx));
 	mtk_ddp_write_relaxed(cmdq_pkt, src_size, &ovl->cmdq_reg, ovl->regs,
 			      DISP_REG_OVL_SRC_SIZE(idx));
 	mtk_ddp_write_relaxed(cmdq_pkt, offset, &ovl->cmdq_reg, ovl->regs,
@@ -452,19 +485,8 @@
 	mtk_ddp_write_relaxed(cmdq_pkt, addr, &ovl->cmdq_reg, ovl->regs,
 			      DISP_REG_OVL_ADDR(ovl, idx));
 
-	if (is_afbc) {
-		mtk_ddp_write_relaxed(cmdq_pkt, hdr_addr, &ovl->cmdq_reg, ovl->regs,
-				      DISP_REG_OVL_HDR_ADDR(ovl, idx));
-		mtk_ddp_write_relaxed(cmdq_pkt,
-				      OVL_PITCH_MSB_2ND_SUBBUF | overlay_pitch.split_pitch.msb,
-				      &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx));
-		mtk_ddp_write_relaxed(cmdq_pkt, hdr_pitch, &ovl->cmdq_reg, ovl->regs,
-				      DISP_REG_OVL_HDR_PITCH(ovl, idx));
-	} else {
-		mtk_ddp_write_relaxed(cmdq_pkt,
-				      overlay_pitch.split_pitch.msb,
-				      &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx));
-	}
+	if (ovl->data->supports_afbc)
+		mtk_ovl_afbc_layer_config(ovl, idx, pending, cmdq_pkt);
 
 	mtk_ovl_set_bit_depth(dev, idx, fmt, cmdq_pkt);
 	mtk_ovl_layer_on(dev, idx, cmdq_pkt);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c
@@ -132,7 +132,7 @@
 	merge = ovl_adaptor->ovl_adaptor_comp[OVL_ADAPTOR_MERGE0 + idx];
 	ethdr = ovl_adaptor->ovl_adaptor_comp[OVL_ADAPTOR_ETHDR0];
 
-	if (!pending->enable) {
+	if (!pending->enable || !pending->width || !pending->height) {
 		mtk_merge_stop_cmdq(merge, cmdq_pkt);
 		mtk_mdp_rdma_stop(rdma_l, cmdq_pkt);
 		mtk_mdp_rdma_stop(rdma_r, cmdq_pkt);
@@ -480,8 +480,10 @@
 		}
 
 		comp_pdev = of_find_device_by_node(node);
-		if (!comp_pdev)
+		if (!comp_pdev) {
+			of_node_put(node);
 			return -EPROBE_DEFER;
+		}
 
 		priv->ovl_adaptor_comp[id] = &comp_pdev->dev;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_dp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_dp.c
@@ -145,6 +145,89 @@
 	u16 audio_m_div2_bit;
 };
 
+static const struct mtk_dp_efuse_fmt mt8188_dp_efuse_fmt[MTK_DP_CAL_MAX] = {
+	[MTK_DP_CAL_GLB_BIAS_TRIM] = {
+		.idx = 0,
+		.shift = 10,
+		.mask = 0x1f,
+		.min_val = 1,
+		.max_val = 0x1e,
+		.default_val = 0xf,
+	},
+	[MTK_DP_CAL_CLKTX_IMPSE] = {
+		.idx = 0,
+		.shift = 15,
+		.mask = 0xf,
+		.min_val = 1,
+		.max_val = 0xe,
+		.default_val = 0x8,
+	},
+	[MTK_DP_CAL_LN_TX_IMPSEL_PMOS_0] = {
+		.idx = 1,
+		.shift = 0,
+		.mask = 0xf,
+		.min_val = 1,
+		.max_val = 0xe,
+		.default_val = 0x8,
+	},
+	[MTK_DP_CAL_LN_TX_IMPSEL_PMOS_1] = {
+		.idx = 1,
+		.shift = 8,
+		.mask = 0xf,
+		.min_val = 1,
+		.max_val = 0xe,
+		.default_val = 0x8,
+	},
+	[MTK_DP_CAL_LN_TX_IMPSEL_PMOS_2] = {
+		.idx = 1,
+		.shift = 16,
+		.mask = 0xf,
+		.min_val = 1,
+		.max_val = 0xe,
+		.default_val = 0x8,
+	},
+	[MTK_DP_CAL_LN_TX_IMPSEL_PMOS_3] = {
+		.idx = 1,
+		.shift = 24,
+		.mask = 0xf,
+		.min_val = 1,
+		.max_val = 0xe,
+		.default_val = 0x8,
+	},
+	[MTK_DP_CAL_LN_TX_IMPSEL_NMOS_0] = {
+		.idx = 1,
+		.shift = 4,
+		.mask = 0xf,
+		.min_val = 1,
+		.max_val = 0xe,
+		.default_val = 0x8,
+	},
+	[MTK_DP_CAL_LN_TX_IMPSEL_NMOS_1] = {
+		.idx = 1,
+		.shift = 12,
+		.mask = 0xf,
+		.min_val = 1,
+		.max_val = 0xe,
+		.default_val = 0x8,
+	},
+	[MTK_DP_CAL_LN_TX_IMPSEL_NMOS_2] = {
+		.idx = 1,
+		.shift = 20,
+		.mask = 0xf,
+		.min_val = 1,
+		.max_val = 0xe,
+		.default_val = 0x8,
+	},
+	[MTK_DP_CAL_LN_TX_IMPSEL_NMOS_3] = {
+		.idx = 1,
+		.shift = 28,
+		.mask = 0xf,
+		.min_val = 1,
+		.max_val = 0xe,
+		.default_val = 0x8,
+	},
+};
+
 static const struct mtk_dp_efuse_fmt mt8195_edp_efuse_fmt[MTK_DP_CAL_MAX] = {
 	[MTK_DP_CAL_GLB_BIAS_TRIM] = {
 		.idx = 3,
@@ -460,18 +543,16 @@
 				   enum dp_pixelformat color_format)
 {
 	u32 val;
-
-	/* update MISC0 */
-	mtk_dp_update_bits(mtk_dp, MTK_DP_ENC0_P0_3034,
-			   color_format << DP_TEST_COLOR_FORMAT_SHIFT,
-			   DP_TEST_COLOR_FORMAT_MASK);
+	u32 misc0_color;
 
 	switch (color_format) {
 	case DP_PIXELFORMAT_YUV422:
 		val = PIXEL_ENCODE_FORMAT_DP_ENC0_P0_YCBCR422;
+		misc0_color = DP_COLOR_FORMAT_YCbCr422;
 		break;
 	case DP_PIXELFORMAT_RGB:
 		val = PIXEL_ENCODE_FORMAT_DP_ENC0_P0_RGB;
+		misc0_color = DP_COLOR_FORMAT_RGB;
 		break;
 	default:
 		drm_warn(mtk_dp->drm_dev, "Unsupported color format: %d\n",
@@ -479,6 +560,11 @@
 		return -EINVAL;
 	}
 
+	/* update MISC0 */
+	mtk_dp_update_bits(mtk_dp, MTK_DP_ENC0_P0_3034,
+			   misc0_color,
+			   DP_TEST_COLOR_FORMAT_MASK);
+
 	mtk_dp_update_bits(mtk_dp, MTK_DP_ENC0_P0_303C,
 			   val, PIXEL_ENCODE_FORMAT_DP_ENC0_P0_MASK);
 	return 0;
@@ -2017,7 +2103,6 @@
 	struct mtk_dp *mtk_dp = mtk_dp_from_bridge(bridge);
 	enum drm_connector_status ret = connector_status_disconnected;
 	bool enabled = mtk_dp->enabled;
-	u8 sink_count = 0;
 
 	if (!mtk_dp->train_info.cable_plugged_in)
 		return ret;
@@ -2032,8 +2117,8 @@
 	 * function, we just need to check the HPD connection to check
 	 * whether we connect to a sink device.
 	 */
-	drm_dp_dpcd_readb(&mtk_dp->aux, DP_SINK_COUNT, &sink_count);
-	if (DP_GET_SINK_COUNT(sink_count))
+
+	if (drm_dp_read_sink_count(&mtk_dp->aux) > 0)
 		ret = connector_status_connected;
 
 	if (!enabled)
@@ -2042,12 +2127,12 @@
 	return ret;
 }
 
-static struct edid *mtk_dp_get_edid(struct drm_bridge *bridge,
-				    struct drm_connector *connector)
+static const struct drm_edid *mtk_dp_edid_read(struct drm_bridge *bridge,
+					       struct drm_connector *connector)
 {
 	struct mtk_dp *mtk_dp = mtk_dp_from_bridge(bridge);
 	bool enabled = mtk_dp->enabled;
-	struct edid *new_edid = NULL;
+	const struct drm_edid *drm_edid;
 	struct mtk_dp_audio_cfg *audio_caps = &mtk_dp->info.audio_cur_cfg;
 
 	if (!enabled) {
@@ -2055,7 +2140,7 @@
 		mtk_dp_aux_panel_poweron(mtk_dp, true);
 	}
 
-	new_edid = drm_get_edid(connector, &mtk_dp->aux.ddc);
+	drm_edid = drm_edid_read_ddc(connector, &mtk_dp->aux.ddc);
 
 	/*
 	 * Parse capability here to let atomic_get_input_bus_fmts and
@@ -2063,17 +2148,32 @@
 	 */
 	if (mtk_dp_parse_capabilities(mtk_dp)) {
 		drm_err(mtk_dp->drm_dev, "Can't parse capabilities\n");
-		kfree(new_edid);
-		new_edid = NULL;
+		drm_edid_free(drm_edid);
+		drm_edid = NULL;
 	}
 
-	if (new_edid) {
+	if (drm_edid) {
+		/*
+		 * FIXME: get rid of drm_edid_raw()
+		 */
+		const struct edid *edid = drm_edid_raw(drm_edid);
 		struct cea_sad *sads;
+		int ret;
 
-		audio_caps->sad_count = drm_edid_to_sad(new_edid, &sads);
-		kfree(sads);
+		ret = drm_edid_to_sad(edid, &sads);
+		/* Ignore any errors */
+		if (ret < 0)
+			ret = 0;
+		if (ret)
+			kfree(sads);
+		audio_caps->sad_count = ret;
 
-		audio_caps->detect_monitor = drm_detect_monitor_audio(new_edid);
+		/*
+		 * FIXME: This should use connector->display_info.has_audio from
+		 * a path that has read the EDID and called
+		 * drm_edid_connector_update().
+		 */
+		audio_caps->detect_monitor = drm_detect_monitor_audio(edid);
 	}
 
 	if (!enabled) {
@@ -2081,7 +2181,7 @@
 		drm_atomic_bridge_chain_post_disable(bridge, connector->state->state);
 	}
 
-	return new_edid;
+	return drm_edid;
 }
 
 static ssize_t mtk_dp_aux_transfer(struct drm_dp_aux *mtk_aux,
@@ -2095,7 +2195,7 @@
 
 	if (mtk_dp->bridge.type != DRM_MODE_CONNECTOR_eDP &&
 	    !mtk_dp->train_info.cable_plugged_in) {
-		ret = -EAGAIN;
+		ret = -EIO;
 		goto err;
 	}
 
@@ -2310,12 +2410,19 @@
 {
 	struct mtk_dp *mtk_dp = mtk_dp_from_bridge(bridge);
 	u32 bpp = info->color_formats & DRM_COLOR_FORMAT_YCBCR422 ? 16 : 24;
-	u32 rate = min_t(u32, drm_dp_max_link_rate(mtk_dp->rx_cap) *
-			      drm_dp_max_lane_count(mtk_dp->rx_cap),
-			 drm_dp_bw_code_to_link_rate(mtk_dp->max_linkrate) *
-			 mtk_dp->max_lanes);
+	u32 lane_count_min = mtk_dp->train_info.lane_count;
+	u32 rate = drm_dp_bw_code_to_link_rate(mtk_dp->train_info.link_rate) *
+		   lane_count_min;
 
-	if (rate < mode->clock * bpp / 8)
+	/*
+	 *FEC overhead is approximately 2.4% from DP 1.4a spec 2.2.1.4.2.
+	 *The down-spread amplitude shall either be disabled (0.0%) or up
+	 *to 0.5% from 1.4a 3.5.2.6. Add up to approximately 3% total overhead.
+	 *
+	 *Because rate is already divided by 10,
+	 *mode->clock does not need to be multiplied by 10
+	 */
+	if ((rate * 97 / 100) < (mode->clock * bpp / 8))
 		return MODE_CLOCK_HIGH;
 
 	return MODE_OK;
@@ -2356,10 +2463,9 @@
 	struct drm_display_mode *mode = &crtc_state->adjusted_mode;
 	struct drm_display_info *display_info =
 		&conn_state->connector->display_info;
-	u32 rate = min_t(u32, drm_dp_max_link_rate(mtk_dp->rx_cap) *
-			      drm_dp_max_lane_count(mtk_dp->rx_cap),
-			 drm_dp_bw_code_to_link_rate(mtk_dp->max_linkrate) *
-			 mtk_dp->max_lanes);
+	u32 lane_count_min = mtk_dp->train_info.lane_count;
+	u32 rate = drm_dp_bw_code_to_link_rate(mtk_dp->train_info.link_rate) *
+		   lane_count_min;
 
 	*num_input_fmts = 0;
 
@@ -2368,8 +2474,8 @@
 	 * datarate of YUV422 and sink device supports YUV422, we output YUV422
 	 * format. Use this condition, we can support more resolution.
 	 */
-	if ((rate < (mode->clock * 24 / 8)) &&
-	    (rate > (mode->clock * 16 / 8)) &&
+	if (((rate * 97 / 100) < (mode->clock * 24 / 8)) &&
+	    ((rate * 97 / 100) > (mode->clock * 16 / 8)) &&
 	    (display_info->color_formats & DRM_COLOR_FORMAT_YCBCR422)) {
 		input_fmts = kcalloc(1, sizeof(*input_fmts), GFP_KERNEL);
 		if (!input_fmts)
@@ -2433,7 +2539,7 @@
 	.atomic_enable = mtk_dp_bridge_atomic_enable,
 	.atomic_disable = mtk_dp_bridge_atomic_disable,
 	.mode_valid = mtk_dp_bridge_mode_valid,
-	.get_edid = mtk_dp_get_edid,
+	.edid_read = mtk_dp_edid_read,
 	.detect = mtk_dp_bdg_detect,
 };
 
@@ -2758,7 +2864,7 @@
 static const struct mtk_dp_data mt8188_dp_data = {
 	.bridge_type = DRM_MODE_CONNECTOR_DisplayPort,
 	.smc_cmd = MTK_DP_SIP_ATF_VIDEO_UNMUTE,
-	.efuse_fmt = mt8195_dp_efuse_fmt,
+	.efuse_fmt = mt8188_dp_efuse_fmt,
 	.audio_supported = true,
 	.audio_pkt_in_hblank_area = true,
 	.audio_m_div2_bit = MT8188_AUDIO_M_CODE_MULT_DIV_SEL_DP_ENC0_P0_DIV_2,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -69,6 +69,8 @@
 	/* lock for display hardware access */
 	struct mutex			hw_lock;
 	bool				config_updating;
+	/* lock for config_updating to cmd buffer */
+	spinlock_t			config_lock;
 };
 
 struct mtk_crtc_state {
@@ -95,20 +97,32 @@
 	struct drm_crtc *crtc = &mtk_crtc->base;
 	unsigned long flags;
 
-	spin_lock_irqsave(&crtc->dev->event_lock, flags);
-	drm_crtc_send_vblank_event(crtc, mtk_crtc->event);
-	drm_crtc_vblank_put(crtc);
-	mtk_crtc->event = NULL;
-	spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+	if (mtk_crtc->event) {
+		spin_lock_irqsave(&crtc->dev->event_lock, flags);
+		drm_crtc_send_vblank_event(crtc, mtk_crtc->event);
+		drm_crtc_vblank_put(crtc);
+		mtk_crtc->event = NULL;
+		spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+	}
 }
 
 static void mtk_drm_finish_page_flip(struct mtk_drm_crtc *mtk_crtc)
 {
+	unsigned long flags;
+
 	drm_crtc_handle_vblank(&mtk_crtc->base);
+
+#if IS_REACHABLE(CONFIG_MTK_CMDQ)
+	if (mtk_crtc->cmdq_client.chan)
+		return;
+#endif
+
+	spin_lock_irqsave(&mtk_crtc->config_lock, flags);
 	if (!mtk_crtc->config_updating && mtk_crtc->pending_needs_vblank) {
 		mtk_drm_crtc_finish_page_flip(mtk_crtc);
 		mtk_crtc->pending_needs_vblank = false;
 	}
+	spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
 }
 
 #if IS_REACHABLE(CONFIG_MTK_CMDQ)
@@ -291,12 +305,17 @@
 	struct mtk_drm_crtc *mtk_crtc = container_of(cmdq_cl, struct mtk_drm_crtc, cmdq_client);
 	struct mtk_crtc_state *state;
 	unsigned int i;
+	unsigned long flags;
 
 	if (data->sta < 0)
 		return;
 
 	state = to_mtk_crtc_state(mtk_crtc->base.state);
 
+	spin_lock_irqsave(&mtk_crtc->config_lock, flags);
+	if (mtk_crtc->config_updating)
+		goto ddp_cmdq_cb_out;
+
 	state->pending_config = false;
 
 	if (mtk_crtc->pending_planes) {
@@ -323,6 +342,15 @@
 		mtk_crtc->pending_async_planes = false;
 	}
 
+ddp_cmdq_cb_out:
+
+	if (mtk_crtc->pending_needs_vblank) {
+		mtk_drm_crtc_finish_page_flip(mtk_crtc);
+		mtk_crtc->pending_needs_vblank = false;
+	}
+
+	spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
+
 	mtk_crtc->cmdq_vblank_cnt = 0;
 	wake_up(&mtk_crtc->cb_blocking_queue);
 }
@@ -432,6 +460,7 @@
 {
 	struct drm_device *drm = mtk_crtc->base.dev;
 	struct drm_crtc *crtc = &mtk_crtc->base;
+	unsigned long flags;
 	int i;
 
 	for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) {
@@ -463,10 +492,10 @@
 	pm_runtime_put(drm->dev);
 
 	if (crtc->state->event && !crtc->state->active) {
-		spin_lock_irq(&crtc->dev->event_lock);
+		spin_lock_irqsave(&crtc->dev->event_lock, flags);
 		drm_crtc_send_vblank_event(crtc, crtc->state->event);
 		crtc->state->event = NULL;
-		spin_unlock_irq(&crtc->dev->event_lock);
+		spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
 	}
 }
 
@@ -555,9 +584,14 @@
 	struct mtk_drm_private *priv = crtc->dev->dev_private;
 	unsigned int pending_planes = 0, pending_async_planes = 0;
 	int i;
+	unsigned long flags;
 
 	mutex_lock(&mtk_crtc->hw_lock);
+
+	spin_lock_irqsave(&mtk_crtc->config_lock, flags);
 	mtk_crtc->config_updating = true;
+	spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
+
 	if (needs_vblank)
 		mtk_crtc->pending_needs_vblank = true;
 
@@ -607,11 +641,19 @@
 		 */
 		mtk_crtc->cmdq_vblank_cnt = 3;
 
+		spin_lock_irqsave(&mtk_crtc->config_lock, flags);
+		mtk_crtc->config_updating = false;
+		spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
+
 		mbox_send_message(mtk_crtc->cmdq_client.chan, cmdq_handle);
 		mbox_client_txdone(mtk_crtc->cmdq_client.chan, 0);
 	}
-#endif
+#else
+	spin_lock_irqsave(&mtk_crtc->config_lock, flags);
 	mtk_crtc->config_updating = false;
+	spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
+#endif
+
 	mutex_unlock(&mtk_crtc->hw_lock);
 }
 
@@ -990,10 +1032,10 @@
 
 	mtk_crtc->mmsys_dev = priv->mmsys_dev;
 	mtk_crtc->ddp_comp_nr = path_len;
-	mtk_crtc->ddp_comp = devm_kmalloc_array(dev,
-						mtk_crtc->ddp_comp_nr + (conn_routes ? 1 : 0),
-						sizeof(*mtk_crtc->ddp_comp),
-						GFP_KERNEL);
+	mtk_crtc->ddp_comp = devm_kcalloc(dev,
+					  mtk_crtc->ddp_comp_nr + (conn_routes ? 1 : 0),
+					  sizeof(*mtk_crtc->ddp_comp),
+					  GFP_KERNEL);
 	if (!mtk_crtc->ddp_comp)
 		return -ENOMEM;
 
@@ -1057,6 +1099,7 @@
 		drm_mode_crtc_set_gamma_size(&mtk_crtc->base, gamma_lut_size);
 	drm_crtc_enable_color_mgmt(&mtk_crtc->base, 0, has_ctm, gamma_lut_size);
 	mutex_init(&mtk_crtc->hw_lock);
+	spin_lock_init(&mtk_crtc->config_lock);
 
 #if IS_REACHABLE(CONFIG_MTK_CMDQ)
 	i = priv->mbox_index++;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
@@ -587,7 +587,7 @@
 	int ret;
 #endif
 
-	if (comp_id < 0 || comp_id >= DDP_COMPONENT_DRM_ID_MAX)
+	if (comp_id >= DDP_COMPONENT_DRM_ID_MAX)
 		return -EINVAL;
 
 	type = mtk_ddp_matches[comp_id].type;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -294,6 +294,9 @@
 	.conn_routes = mt8188_mtk_ddp_main_routes,
 	.num_conn_routes = ARRAY_SIZE(mt8188_mtk_ddp_main_routes),
 	.mmsys_dev_num = 1,
+	.max_width = 8191,
+	.min_width = 1,
+	.min_height = 1,
 };
 
 static const struct mtk_mmsys_driver_data mt8192_mmsys_driver_data = {
@@ -308,6 +311,9 @@
 	.main_path = mt8195_mtk_ddp_main,
 	.main_len = ARRAY_SIZE(mt8195_mtk_ddp_main),
 	.mmsys_dev_num = 2,
+	.max_width = 8191,
+	.min_width = 1,
+	.min_height = 1,
 };
 
 static const struct mtk_mmsys_driver_data mt8195_vdosys1_driver_data = {
@@ -315,6 +321,9 @@
 	.ext_len = ARRAY_SIZE(mt8195_mtk_ddp_ext),
 	.mmsys_id = 1,
 	.mmsys_dev_num = 2,
+	.max_width = 8191,
+	.min_width = 2, /* 2-pixel align when ethdr is bypassed */
+	.min_height = 1,
 };
 
 static const struct of_device_id mtk_drm_of_ids[] = {
@@ -394,8 +403,10 @@
 		if (temp_drm_priv->mtk_drm_bound)
 			cnt++;
 
-		if (cnt == MAX_CRTC)
+		if (cnt == MAX_CRTC) {
+			of_node_put(node);
 			break;
+		}
 	}
 
 	if (drm_priv->data->mmsys_dev_num == cnt) {
@@ -491,6 +502,15 @@
 		for (j = 0; j < private->data->mmsys_dev_num; j++) {
 			priv_n = private->all_drm_private[j];
 
+			if (priv_n->data->max_width)
+				drm->mode_config.max_width = priv_n->data->max_width;
+
+			if (priv_n->data->min_width)
+				drm->mode_config.min_width = priv_n->data->min_width;
+
+			if (priv_n->data->min_height)
+				drm->mode_config.min_height = priv_n->data->min_height;
+
 			if (i == CRTC_MAIN && priv_n->data->main_len) {
 				ret = mtk_drm_crtc_create(drm, priv_n->data->main_path,
 							  priv_n->data->main_len, j,
@@ -518,6 +538,10 @@
 		}
 	}
 
+	/* IGT will check if the cursor size is configured */
+	drm->mode_config.cursor_width = 512;
+	drm->mode_config.cursor_height = 512;
+
 	/* Use OVL device for all DMA memory allocations */
 	crtc = drm_crtc_from_index(drm, 0);
 	if (crtc)
@@ -651,6 +675,8 @@
 err_free:
 	private->drm = NULL;
 	drm_dev_put(drm);
+	for (i = 0; i < private->data->mmsys_dev_num; i++)
+		private->all_drm_private[i]->drm = NULL;
 	return ret;
 }
 
@@ -739,6 +765,8 @@
 	  .data = (void *)MTK_DISP_OVL },
 	{ .compatible = "mediatek,mt8192-disp-ovl",
 	  .data = (void *)MTK_DISP_OVL },
+	{ .compatible = "mediatek,mt8195-disp-ovl",
+	  .data = (void *)MTK_DISP_OVL },
 	{ .compatible = "mediatek,mt8183-disp-ovl-2l",
 	  .data = (void *)MTK_DISP_OVL_2L },
 	{ .compatible = "mediatek,mt8192-disp-ovl-2l",
@@ -948,6 +976,13 @@
 		of_node_put(private->comp_node[i]);
 }
 
+static void mtk_drm_shutdown(struct platform_device *pdev)
+{
+	struct mtk_drm_private *private = platform_get_drvdata(pdev);
+
+	drm_atomic_helper_shutdown(private->drm);
+}
+
 static int mtk_drm_sys_prepare(struct device *dev)
 {
 	struct mtk_drm_private *private = dev_get_drvdata(dev);
@@ -979,6 +1014,7 @@
 static struct platform_driver mtk_drm_platform_driver = {
 	.probe	= mtk_drm_probe,
 	.remove_new = mtk_drm_remove,
+	.shutdown = mtk_drm_shutdown,
 	.driver	= {
 		.name	= "mediatek-drm",
 		.pm     = &mtk_drm_pm_ops,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_drm_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_drm_drv.h
@@ -46,6 +46,10 @@
 	bool shadow_register;
 	unsigned int mmsys_id;
 	unsigned int mmsys_dev_num;
+
+	u16 max_width;
+	u16 min_width;
+	u16 min_height;
 };
 
 struct mtk_drm_private {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_drm_gem.c
@@ -38,6 +38,9 @@
 
 	size = round_up(size, PAGE_SIZE);
 
+	if (size == 0)
+		return ERR_PTR(-EINVAL);
+
 	mtk_gem_obj = kzalloc(sizeof(*mtk_gem_obj), GFP_KERNEL);
 	if (!mtk_gem_obj)
 		return ERR_PTR(-ENOMEM);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_drm_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_drm_plane.c
@@ -227,6 +227,8 @@
 	plane->state->src_y = new_state->src_y;
 	plane->state->src_h = new_state->src_h;
 	plane->state->src_w = new_state->src_w;
+	plane->state->dst.x1 = new_state->dst.x1;
+	plane->state->dst.y1 = new_state->dst.y1;
 
 	mtk_plane_update_new_state(new_state, new_plane_state);
 	swap(plane->state->fb, new_state->fb);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -71,8 +71,8 @@
 #define DSI_PS_WC			0x3fff
 #define DSI_PS_SEL			(3 << 16)
 #define PACKED_PS_16BIT_RGB565		(0 << 16)
-#define LOOSELY_PS_18BIT_RGB666		(1 << 16)
-#define PACKED_PS_18BIT_RGB666		(2 << 16)
+#define PACKED_PS_18BIT_RGB666		(1 << 16)
+#define LOOSELY_PS_24BIT_RGB666		(2 << 16)
 #define PACKED_PS_24BIT_RGB888		(3 << 16)
 
 #define DSI_VSA_NL		0x20
@@ -130,11 +130,11 @@
 #define CLK_HS_POST			(0xff << 8)
 #define CLK_HS_EXIT			(0xff << 16)
 
-#define DSI_VM_CMD_CON		0x130
+/* DSI_VM_CMD_CON */
 #define VM_CMD_EN			BIT(0)
 #define TS_VFP_EN			BIT(5)
 
-#define DSI_SHADOW_DEBUG	0x190U
+/* DSI_SHADOW_DEBUG */
 #define FORCE_COMMIT			BIT(0)
 #define BYPASS_SHADOW			BIT(1)
 
@@ -177,6 +177,8 @@
 
 struct mtk_dsi_driver_data {
 	const u32 reg_cmdq_off;
+	const u32 reg_vm_cmd_off;
+	const u32 reg_shadow_dbg_off;
 	bool has_shadow_ctl;
 	bool has_size_ctl;
 	bool cmdq_long_packet_ctl;
@@ -346,8 +348,8 @@
 
 static void mtk_dsi_set_vm_cmd(struct mtk_dsi *dsi)
 {
-	mtk_dsi_mask(dsi, DSI_VM_CMD_CON, VM_CMD_EN, VM_CMD_EN);
-	mtk_dsi_mask(dsi, DSI_VM_CMD_CON, TS_VFP_EN, TS_VFP_EN);
+	mtk_dsi_mask(dsi, dsi->driver_data->reg_vm_cmd_off, VM_CMD_EN, VM_CMD_EN);
+	mtk_dsi_mask(dsi, dsi->driver_data->reg_vm_cmd_off, TS_VFP_EN, TS_VFP_EN);
 }
 
 static void mtk_dsi_ps_control_vact(struct mtk_dsi *dsi)
@@ -369,10 +371,10 @@
 		ps_bpp_mode |= PACKED_PS_24BIT_RGB888;
 		break;
 	case MIPI_DSI_FMT_RGB666:
-		ps_bpp_mode |= PACKED_PS_18BIT_RGB666;
+		ps_bpp_mode |= LOOSELY_PS_24BIT_RGB666;
 		break;
 	case MIPI_DSI_FMT_RGB666_PACKED:
-		ps_bpp_mode |= LOOSELY_PS_18BIT_RGB666;
+		ps_bpp_mode |= PACKED_PS_18BIT_RGB666;
 		break;
 	case MIPI_DSI_FMT_RGB565:
 		ps_bpp_mode |= PACKED_PS_16BIT_RGB565;
@@ -426,7 +428,7 @@
 		dsi_tmp_buf_bpp = 3;
 		break;
 	case MIPI_DSI_FMT_RGB666:
-		tmp_reg = LOOSELY_PS_18BIT_RGB666;
+		tmp_reg = LOOSELY_PS_24BIT_RGB666;
 		dsi_tmp_buf_bpp = 3;
 		break;
 	case MIPI_DSI_FMT_RGB666_PACKED:
@@ -660,7 +662,7 @@
 
 	if (dsi->driver_data->has_shadow_ctl)
 		writel(FORCE_COMMIT | BYPASS_SHADOW,
-		       dsi->regs + DSI_SHADOW_DEBUG);
+		       dsi->regs + dsi->driver_data->reg_shadow_dbg_off);
 
 	mtk_dsi_reset_engine(dsi);
 	mtk_dsi_phy_timconfig(dsi);
@@ -1223,26 +1225,36 @@
 
 static const struct mtk_dsi_driver_data mt8173_dsi_driver_data = {
 	.reg_cmdq_off = 0x200,
+	.reg_vm_cmd_off = 0x130,
+	.reg_shadow_dbg_off = 0x190
 };
 
 static const struct mtk_dsi_driver_data mt2701_dsi_driver_data = {
 	.reg_cmdq_off = 0x180,
+	.reg_vm_cmd_off = 0x130,
+	.reg_shadow_dbg_off = 0x190
 };
 
 static const struct mtk_dsi_driver_data mt8183_dsi_driver_data = {
 	.reg_cmdq_off = 0x200,
+	.reg_vm_cmd_off = 0x130,
+	.reg_shadow_dbg_off = 0x190,
 	.has_shadow_ctl = true,
 	.has_size_ctl = true,
 };
 
 static const struct mtk_dsi_driver_data mt8186_dsi_driver_data = {
 	.reg_cmdq_off = 0xd00,
+	.reg_vm_cmd_off = 0x200,
+	.reg_shadow_dbg_off = 0xc00,
 	.has_shadow_ctl = true,
 	.has_size_ctl = true,
 };
 
 static const struct mtk_dsi_driver_data mt8188_dsi_driver_data = {
 	.reg_cmdq_off = 0xd00,
+	.reg_vm_cmd_off = 0x200,
+	.reg_shadow_dbg_off = 0xc00,
 	.has_shadow_ctl = true,
 	.has_size_ctl = true,
 	.cmdq_long_packet_ctl = true,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mediatek/mtk_ethdr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mediatek/mtk_ethdr.c
@@ -50,7 +50,6 @@
 
 #define MIXER_INX_MODE_BYPASS			0
 #define MIXER_INX_MODE_EVEN_EXTEND		1
-#define DEFAULT_9BIT_ALPHA			0x100
 #define	MIXER_ALPHA_AEN				BIT(8)
 #define	MIXER_ALPHA				0xff
 #define ETHDR_CLK_NUM				13
@@ -154,13 +153,19 @@
 	unsigned int offset = (pending->x & 1) << 31 | pending->y << 16 | pending->x;
 	unsigned int align_width = ALIGN_DOWN(pending->width, 2);
 	unsigned int alpha_con = 0;
+	bool replace_src_a = false;
 
 	dev_dbg(dev, "%s+ idx:%d", __func__, idx);
 
 	if (idx >= 4)
 		return;
 
-	if (!pending->enable) {
+	if (!pending->enable || !pending->width || !pending->height) {
+		/*
+		 * instead of disabling layer with MIX_SRC_CON directly
+		 * set the size to 0 to avoid screen shift due to mixer
+		 * mode switch (hardware behavior)
+		 */
 		mtk_ddp_write(cmdq_pkt, 0, &mixer->cmdq_base, mixer->regs, MIX_L_SRC_SIZE(idx));
 		return;
 	}
@@ -168,8 +173,16 @@
 	if (state->base.fb && state->base.fb->format->has_alpha)
 		alpha_con = MIXER_ALPHA_AEN | MIXER_ALPHA;
 
-	mtk_mmsys_mixer_in_config(priv->mmsys_dev, idx + 1, alpha_con ? false : true,
-				  DEFAULT_9BIT_ALPHA,
+	if (state->base.fb && !state->base.fb->format->has_alpha) {
+		/*
+		 * Mixer doesn't support CONST_BLD mode,
+		 * use a trick to make the output equivalent
+		 */
+		replace_src_a = true;
+	}
+
+	mtk_mmsys_mixer_in_config(priv->mmsys_dev, idx + 1, replace_src_a,
+				  MIXER_ALPHA,
 				  pending->x & 1 ? MIXER_INX_MODE_EVEN_EXTEND :
 				  MIXER_INX_MODE_BYPASS, align_width / 2 - 1, cmdq_pkt);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/meson/meson_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/meson/meson_drv.c
@@ -250,29 +250,20 @@
 	if (ret)
 		goto free_drm;
 	ret = meson_canvas_alloc(priv->canvas, &priv->canvas_id_vd1_0);
-	if (ret) {
-		meson_canvas_free(priv->canvas, priv->canvas_id_osd1);
-		goto free_drm;
-	}
+	if (ret)
+		goto free_canvas_osd1;
 	ret = meson_canvas_alloc(priv->canvas, &priv->canvas_id_vd1_1);
-	if (ret) {
-		meson_canvas_free(priv->canvas, priv->canvas_id_osd1);
-		meson_canvas_free(priv->canvas, priv->canvas_id_vd1_0);
-		goto free_drm;
-	}
+	if (ret)
+		goto free_canvas_vd1_0;
 	ret = meson_canvas_alloc(priv->canvas, &priv->canvas_id_vd1_2);
-	if (ret) {
-		meson_canvas_free(priv->canvas, priv->canvas_id_osd1);
-		meson_canvas_free(priv->canvas, priv->canvas_id_vd1_0);
-		meson_canvas_free(priv->canvas, priv->canvas_id_vd1_1);
-		goto free_drm;
-	}
+	if (ret)
+		goto free_canvas_vd1_1;
 
 	priv->vsync_irq = platform_get_irq(pdev, 0);
 
 	ret = drm_vblank_init(drm, 1);
 	if (ret)
-		goto free_drm;
+		goto free_canvas_vd1_2;
 
 	/* Assign limits per soc revision/package */
 	for (i = 0 ; i < ARRAY_SIZE(meson_drm_soc_attrs) ; ++i) {
@@ -288,11 +279,11 @@
 	 */
 	ret = drm_aperture_remove_framebuffers(&meson_driver);
 	if (ret)
-		goto free_drm;
+		goto free_canvas_vd1_2;
 
 	ret = drmm_mode_config_init(drm);
 	if (ret)
-		goto free_drm;
+		goto free_canvas_vd1_2;
 	drm->mode_config.max_width = 3840;
 	drm->mode_config.max_height = 2160;
 	drm->mode_config.funcs = &meson_mode_config_funcs;
@@ -307,7 +298,7 @@
 	if (priv->afbcd.ops) {
 		ret = priv->afbcd.ops->init(priv);
 		if (ret)
-			goto free_drm;
+			goto free_canvas_vd1_2;
 	}
 
 	/* Encoder Initialization */
@@ -371,6 +362,14 @@
 exit_afbcd:
 	if (priv->afbcd.ops)
 		priv->afbcd.ops->exit(priv);
+free_canvas_vd1_2:
+	meson_canvas_free(priv->canvas, priv->canvas_id_vd1_2);
+free_canvas_vd1_1:
+	meson_canvas_free(priv->canvas, priv->canvas_id_vd1_1);
+free_canvas_vd1_0:
+	meson_canvas_free(priv->canvas, priv->canvas_id_vd1_0);
+free_canvas_osd1:
+	meson_canvas_free(priv->canvas, priv->canvas_id_osd1);
 free_drm:
 	drm_dev_put(drm);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/meson/meson_dw_hdmi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/meson/meson_dw_hdmi.c
@@ -106,6 +106,8 @@
 #define HHI_HDMI_CLK_CNTL	0x1cc /* 0x73 */
 #define HHI_HDMI_PHY_CNTL0	0x3a0 /* 0xe8 */
 #define HHI_HDMI_PHY_CNTL1	0x3a4 /* 0xe9 */
+#define  PHY_CNTL1_INIT		0x03900000
+#define  PHY_INVERT		BIT(17)
 #define HHI_HDMI_PHY_CNTL2	0x3a8 /* 0xea */
 #define HHI_HDMI_PHY_CNTL3	0x3ac /* 0xeb */
 #define HHI_HDMI_PHY_CNTL4	0x3b0 /* 0xec */
@@ -130,6 +132,8 @@
 				    unsigned int addr);
 	void		(*dwc_write)(struct meson_dw_hdmi *dw_hdmi,
 				     unsigned int addr, unsigned int data);
+	u32 cntl0_init;
+	u32 cntl1_init;
 };
 
 struct meson_dw_hdmi {
@@ -384,26 +388,6 @@
 	    dw_hdmi_bus_fmt_is_420(hdmi))
 		mode_is_420 = true;
 
-	/* Enable clocks */
-	regmap_update_bits(priv->hhi, HHI_HDMI_CLK_CNTL, 0xffff, 0x100);
-
-	/* Bring HDMITX MEM output of power down */
-	regmap_update_bits(priv->hhi, HHI_MEM_PD_REG0, 0xff << 8, 0);
-
-	/* Bring out of reset */
-	dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_SW_RESET,  0);
-
-	/* Enable internal pixclk, tmds_clk, spdif_clk, i2s_clk, cecclk */
-	dw_hdmi_top_write_bits(dw_hdmi, HDMITX_TOP_CLK_CNTL,
-			       0x3, 0x3);
-
-	/* Enable cec_clk and hdcp22_tmdsclk_en */
-	dw_hdmi_top_write_bits(dw_hdmi, HDMITX_TOP_CLK_CNTL,
-			       0x3 << 4, 0x3 << 4);
-
-	/* Enable normal output to PHY */
-	dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_BIST_CNTL, BIT(12));
-
 	/* TMDS pattern setup */
 	if (mode->clock > 340000 && !mode_is_420) {
 		dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_TMDS_CLK_PTTN_01,
@@ -425,20 +409,6 @@
 	/* Setup PHY parameters */
 	meson_hdmi_phy_setup_mode(dw_hdmi, mode, mode_is_420);
 
-	/* Setup PHY */
-	regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
-			   0xffff << 16, 0x0390 << 16);
-
-	/* BIT_INVERT */
-	if (dw_hdmi_is_compatible(dw_hdmi, "amlogic,meson-gxl-dw-hdmi") ||
-	    dw_hdmi_is_compatible(dw_hdmi, "amlogic,meson-gxm-dw-hdmi") ||
-	    dw_hdmi_is_compatible(dw_hdmi, "amlogic,meson-g12a-dw-hdmi"))
-		regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
-				   BIT(17), 0);
-	else
-		regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
-				   BIT(17), BIT(17));
-
 	/* Disable clock, fifo, fifo_wr */
 	regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1, 0xf, 0);
 
@@ -492,7 +462,9 @@
 
 	DRM_DEBUG_DRIVER("\n");
 
-	regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL0, 0);
+	/* Fallback to init mode */
+	regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL1, dw_hdmi->data->cntl1_init);
+	regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL0, dw_hdmi->data->cntl0_init);
 }
 
 static enum drm_connector_status dw_hdmi_read_hpd(struct dw_hdmi *hdmi,
@@ -610,11 +582,22 @@
 	.fast_io = true,
 };
 
-static const struct meson_dw_hdmi_data meson_dw_hdmi_gx_data = {
+static const struct meson_dw_hdmi_data meson_dw_hdmi_gxbb_data = {
 	.top_read = dw_hdmi_top_read,
 	.top_write = dw_hdmi_top_write,
 	.dwc_read = dw_hdmi_dwc_read,
 	.dwc_write = dw_hdmi_dwc_write,
+	.cntl0_init = 0x0,
+	.cntl1_init = PHY_CNTL1_INIT | PHY_INVERT,
+};
+
+static const struct meson_dw_hdmi_data meson_dw_hdmi_gxl_data = {
+	.top_read = dw_hdmi_top_read,
+	.top_write = dw_hdmi_top_write,
+	.dwc_read = dw_hdmi_dwc_read,
+	.dwc_write = dw_hdmi_dwc_write,
+	.cntl0_init = 0x0,
+	.cntl1_init = PHY_CNTL1_INIT,
 };
 
 static const struct meson_dw_hdmi_data meson_dw_hdmi_g12a_data = {
@@ -622,6 +605,8 @@
 	.top_write = dw_hdmi_g12a_top_write,
 	.dwc_read = dw_hdmi_g12a_dwc_read,
 	.dwc_write = dw_hdmi_g12a_dwc_write,
+	.cntl0_init = 0x000b4242, /* Bandgap */
+	.cntl1_init = PHY_CNTL1_INIT,
 };
 
 static void meson_dw_hdmi_init(struct meson_dw_hdmi *meson_dw_hdmi)
@@ -656,6 +641,13 @@
 	meson_dw_hdmi->data->top_write(meson_dw_hdmi,
 				       HDMITX_TOP_CLK_CNTL, 0xff);
 
+	/* Enable normal output to PHY */
+	meson_dw_hdmi->data->top_write(meson_dw_hdmi, HDMITX_TOP_BIST_CNTL, BIT(12));
+
+	/* Setup PHY */
+	regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL1, meson_dw_hdmi->data->cntl1_init);
+	regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL0, meson_dw_hdmi->data->cntl0_init);
+
 	/* Enable HDMI-TX Interrupt */
 	meson_dw_hdmi->data->top_write(meson_dw_hdmi, HDMITX_TOP_INTR_STAT_CLR,
 				       HDMITX_TOP_INTR_CORE);
@@ -865,11 +857,11 @@
 
 static const struct of_device_id meson_dw_hdmi_of_table[] = {
 	{ .compatible = "amlogic,meson-gxbb-dw-hdmi",
-	  .data = &meson_dw_hdmi_gx_data },
+	  .data = &meson_dw_hdmi_gxbb_data },
 	{ .compatible = "amlogic,meson-gxl-dw-hdmi",
-	  .data = &meson_dw_hdmi_gx_data },
+	  .data = &meson_dw_hdmi_gxl_data },
 	{ .compatible = "amlogic,meson-gxm-dw-hdmi",
-	  .data = &meson_dw_hdmi_gx_data },
+	  .data = &meson_dw_hdmi_gxl_data },
 	{ .compatible = "amlogic,meson-g12a-dw-hdmi",
 	  .data = &meson_dw_hdmi_g12a_data },
 	{ }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c
@@ -95,6 +95,7 @@
 		return ret;
 	}
 
+	clk_disable_unprepare(mipi_dsi->px_clk);
 	ret = clk_set_rate(mipi_dsi->px_clk, mipi_dsi->mode->clock * 1000);
 
 	if (ret) {
@@ -103,6 +104,12 @@
 		return ret;
 	}
 
+	ret = clk_prepare_enable(mipi_dsi->px_clk);
+	if (ret) {
+		dev_err(mipi_dsi->dev, "Failed to enable DSI Pixel clock (ret %d)\n", ret);
+		return ret;
+	}
+
 	switch (mipi_dsi->dsi_device->format) {
 	case MIPI_DSI_FMT_RGB888:
 		dpi_data_format = DPI_COLOR_24BIT;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/meson/meson_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/meson/meson_plane.c
@@ -534,6 +534,7 @@
 	struct meson_plane *meson_plane;
 	struct drm_plane *plane;
 	const uint64_t *format_modifiers = format_modifiers_default;
+	int ret;
 
 	meson_plane = devm_kzalloc(priv->drm->dev, sizeof(*meson_plane),
 				   GFP_KERNEL);
@@ -548,12 +549,16 @@
 	else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A))
 		format_modifiers = format_modifiers_afbc_g12a;
 
-	drm_universal_plane_init(priv->drm, plane, 0xFF,
-				 &meson_plane_funcs,
-				 supported_drm_formats,
-				 ARRAY_SIZE(supported_drm_formats),
-				 format_modifiers,
-				 DRM_PLANE_TYPE_PRIMARY, "meson_primary_plane");
+	ret = drm_universal_plane_init(priv->drm, plane, 0xFF,
+					&meson_plane_funcs,
+					supported_drm_formats,
+					ARRAY_SIZE(supported_drm_formats),
+					format_modifiers,
+					DRM_PLANE_TYPE_PRIMARY, "meson_primary_plane");
+	if (ret) {
+		devm_kfree(priv->drm->dev, meson_plane);
+		return ret;
+	}
 
 	drm_plane_helper_add(plane, &meson_plane_helper_funcs);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/meson/meson_vclk.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/meson/meson_vclk.c
@@ -790,13 +790,13 @@
 				 FREQ_1000_1001(params[i].pixel_freq));
 		DRM_DEBUG_DRIVER("i = %d phy_freq = %d alt = %d\n",
 				 i, params[i].phy_freq,
-				 FREQ_1000_1001(params[i].phy_freq/10)*10);
+				 FREQ_1000_1001(params[i].phy_freq/1000)*1000);
 		/* Match strict frequency */
 		if (phy_freq == params[i].phy_freq &&
 		    vclk_freq == params[i].vclk_freq)
 			return MODE_OK;
 		/* Match 1000/1001 variant */
-		if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/10)*10) &&
+		if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/1000)*1000) &&
 		    vclk_freq == FREQ_1000_1001(params[i].vclk_freq))
 			return MODE_OK;
 	}
@@ -1070,7 +1070,7 @@
 
 	for (freq = 0 ; params[freq].pixel_freq ; ++freq) {
 		if ((phy_freq == params[freq].phy_freq ||
-		     phy_freq == FREQ_1000_1001(params[freq].phy_freq/10)*10) &&
+		     phy_freq == FREQ_1000_1001(params[freq].phy_freq/1000)*1000) &&
 		    (vclk_freq == params[freq].vclk_freq ||
 		     vclk_freq == FREQ_1000_1001(params[freq].vclk_freq))) {
 			if (vclk_freq != params[freq].vclk_freq)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mgag200/mgag200_i2c.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mgag200/mgag200_i2c.c
@@ -31,6 +31,8 @@
 #include <linux/i2c.h>
 #include <linux/pci.h>
 
+#include <drm/drm_managed.h>
+
 #include "mgag200_drv.h"
 
 static int mga_i2c_read_gpio(struct mga_device *mdev)
@@ -86,7 +88,7 @@
 	return (mga_i2c_read_gpio(mdev) & i2c->clock) ? 1 : 0;
 }
 
-static void mgag200_i2c_release(void *res)
+static void mgag200_i2c_release(struct drm_device *dev, void *res)
 {
 	struct mga_i2c_chan *i2c = res;
 
@@ -114,7 +116,7 @@
 	i2c->adapter.algo_data = &i2c->bit;
 
 	i2c->bit.udelay = 10;
-	i2c->bit.timeout = 2;
+	i2c->bit.timeout = usecs_to_jiffies(2200);
 	i2c->bit.data = i2c;
 	i2c->bit.setsda		= mga_gpio_setsda;
 	i2c->bit.setscl		= mga_gpio_setscl;
@@ -125,5 +127,5 @@
 	if (ret)
 		return ret;
 
-	return devm_add_action_or_reset(dev->dev, mgag200_i2c_release, i2c);
+	return drmm_add_action_or_reset(dev, mgag200_i2c_release, i2c);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/Kconfig
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/Kconfig
@@ -54,6 +54,14 @@
 	  Only use this if you are a driver developer.  This should *not*
 	  be enabled for production kernels.  If unsure, say N.
 
+config DRM_MSM_VALIDATE_XML
+	bool "Validate XML register files against schema"
+	depends on DRM_MSM && EXPERT && n
+	depends on $(success,$(PYTHON3) -c "import lxml")
+	help
+	  Validate XML files with register definitions against rules-fd schema.
+	  This option is mostly targeting DRM MSM developers. If unsure, say N.
+
 config DRM_MSM_MDSS
 	bool
 	depends on DRM_MSM
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/Makefile
@@ -1,23 +1,34 @@
 # SPDX-License-Identifier: GPL-2.0
 ccflags-y := -I $(srctree)/$(src)
+ccflags-y += -I $(obj)/generated
 ccflags-y += -I $(srctree)/$(src)/disp/dpu1
 ccflags-$(CONFIG_DRM_MSM_DSI) += -I $(srctree)/$(src)/dsi
 ccflags-$(CONFIG_DRM_MSM_DP) += -I $(srctree)/$(src)/dp
 
-msm-y := \
+adreno-y := \
 	adreno/adreno_device.o \
 	adreno/adreno_gpu.o \
+	adreno/a2xx_catalog.o \
 	adreno/a2xx_gpu.o \
+	adreno/a2xx_gpummu.o \
+	adreno/a3xx_catalog.o \
 	adreno/a3xx_gpu.o \
+	adreno/a4xx_catalog.o \
 	adreno/a4xx_gpu.o \
+	adreno/a5xx_catalog.o \
 	adreno/a5xx_gpu.o \
 	adreno/a5xx_power.o \
 	adreno/a5xx_preempt.o \
+	adreno/a6xx_catalog.o \
 	adreno/a6xx_gpu.o \
 	adreno/a6xx_gmu.o \
 	adreno/a6xx_hfi.o \
 
-msm-$(CONFIG_DRM_MSM_HDMI) += \
+adreno-$(CONFIG_DEBUG_FS) += adreno/a5xx_debugfs.o \
+
+adreno-$(CONFIG_DRM_MSM_GPU_STATE)	+= adreno/a6xx_gpu_state.o
+
+msm-display-$(CONFIG_DRM_MSM_HDMI) += \
 	hdmi/hdmi.o \
 	hdmi/hdmi_audio.o \
 	hdmi/hdmi_bridge.o \
@@ -26,11 +37,12 @@
 	hdmi/hdmi_phy.o \
 	hdmi/hdmi_phy_8960.o \
 	hdmi/hdmi_phy_8996.o \
+	hdmi/hdmi_phy_8998.o \
 	hdmi/hdmi_phy_8x60.o \
 	hdmi/hdmi_phy_8x74.o \
 	hdmi/hdmi_pll_8960.o \
 
-msm-$(CONFIG_DRM_MSM_MDP4) += \
+msm-display-$(CONFIG_DRM_MSM_MDP4) += \
 	disp/mdp4/mdp4_crtc.o \
 	disp/mdp4/mdp4_dsi_encoder.o \
 	disp/mdp4/mdp4_dtv_encoder.o \
@@ -41,7 +53,7 @@
 	disp/mdp4/mdp4_kms.o \
 	disp/mdp4/mdp4_plane.o \
 
-msm-$(CONFIG_DRM_MSM_MDP5) += \
+msm-display-$(CONFIG_DRM_MSM_MDP5) += \
 	disp/mdp5/mdp5_cfg.o \
 	disp/mdp5/mdp5_cmd_encoder.o \
 	disp/mdp5/mdp5_ctl.o \
@@ -54,7 +66,7 @@
 	disp/mdp5/mdp5_plane.o \
 	disp/mdp5/mdp5_smp.o \
 
-msm-$(CONFIG_DRM_MSM_DPU) += \
+msm-display-$(CONFIG_DRM_MSM_DPU) += \
 	disp/dpu1/dpu_core_perf.o \
 	disp/dpu1/dpu_crtc.o \
 	disp/dpu1/dpu_encoder.o \
@@ -84,14 +96,16 @@
 	disp/dpu1/dpu_vbif.o \
 	disp/dpu1/dpu_writeback.o
 
-msm-$(CONFIG_DRM_MSM_MDSS) += \
+msm-display-$(CONFIG_DRM_MSM_MDSS) += \
 	msm_mdss.o \
 
-msm-y += \
+msm-display-y += \
 	disp/mdp_format.o \
 	disp/mdp_kms.o \
 	disp/msm_disp_snapshot.o \
 	disp/msm_disp_snapshot_util.o \
+
+msm-y += \
 	msm_atomic.o \
 	msm_atomic_tracepoints.o \
 	msm_debugfs.o \
@@ -113,39 +127,95 @@
 	msm_ringbuffer.o \
 	msm_submitqueue.o \
 	msm_gpu_tracepoints.o \
-	msm_gpummu.o
 
-msm-$(CONFIG_DEBUG_FS) += adreno/a5xx_debugfs.o \
-	dp/dp_debug.o
+msm-$(CONFIG_DRM_FBDEV_EMULATION) += msm_fbdev.o
 
-msm-$(CONFIG_DRM_MSM_GPU_STATE)	+= adreno/a6xx_gpu_state.o
+msm-display-$(CONFIG_DEBUG_FS) += \
+	dp/dp_debug.o
 
-msm-$(CONFIG_DRM_MSM_DP)+= dp/dp_aux.o \
+msm-display-$(CONFIG_DRM_MSM_DP)+= dp/dp_aux.o \
 	dp/dp_catalog.o \
 	dp/dp_ctrl.o \
 	dp/dp_display.o \
 	dp/dp_drm.o \
 	dp/dp_link.o \
 	dp/dp_panel.o \
-	dp/dp_parser.o \
-	dp/dp_power.o \
-	dp/dp_audio.o
+	dp/dp_audio.o \
+	dp/dp_utils.o \
+	dp/dp_mst_drm.o
 
-msm-$(CONFIG_DRM_FBDEV_EMULATION) += msm_fbdev.o
+msm-display-$(CONFIG_DRM_MSM_HDMI_HDCP) += hdmi/hdmi_hdcp.o
 
-msm-$(CONFIG_DRM_MSM_HDMI_HDCP) += hdmi/hdmi_hdcp.o
-
-msm-$(CONFIG_DRM_MSM_DSI) += dsi/dsi.o \
+msm-display-$(CONFIG_DRM_MSM_DSI) += dsi/dsi.o \
 			dsi/dsi_cfg.o \
 			dsi/dsi_host.o \
 			dsi/dsi_manager.o \
 			dsi/phy/dsi_phy.o
 
-msm-$(CONFIG_DRM_MSM_DSI_28NM_PHY) += dsi/phy/dsi_phy_28nm.o
-msm-$(CONFIG_DRM_MSM_DSI_20NM_PHY) += dsi/phy/dsi_phy_20nm.o
-msm-$(CONFIG_DRM_MSM_DSI_28NM_8960_PHY) += dsi/phy/dsi_phy_28nm_8960.o
-msm-$(CONFIG_DRM_MSM_DSI_14NM_PHY) += dsi/phy/dsi_phy_14nm.o
-msm-$(CONFIG_DRM_MSM_DSI_10NM_PHY) += dsi/phy/dsi_phy_10nm.o
-msm-$(CONFIG_DRM_MSM_DSI_7NM_PHY) += dsi/phy/dsi_phy_7nm.o
+msm-display-$(CONFIG_DRM_MSM_DSI_28NM_PHY) += dsi/phy/dsi_phy_28nm.o
+msm-display-$(CONFIG_DRM_MSM_DSI_20NM_PHY) += dsi/phy/dsi_phy_20nm.o
+msm-display-$(CONFIG_DRM_MSM_DSI_28NM_8960_PHY) += dsi/phy/dsi_phy_28nm_8960.o
+msm-display-$(CONFIG_DRM_MSM_DSI_14NM_PHY) += dsi/phy/dsi_phy_14nm.o
+msm-display-$(CONFIG_DRM_MSM_DSI_10NM_PHY) += dsi/phy/dsi_phy_10nm.o
+msm-display-$(CONFIG_DRM_MSM_DSI_7NM_PHY) += dsi/phy/dsi_phy_7nm.o
+
+msm-y += $(adreno-y) $(msm-display-y)
+
+obj-$(CONFIG_DRM_MSM)	+= msm_display.o
+msm_display-y := $(msm-y)
+
+ifeq (y,$(CONFIG_DRM_MSM_VALIDATE_XML))
+	headergen-opts += --validate
+else
+	headergen-opts += --no-validate
+endif
+
+quiet_cmd_headergen = GENHDR  $@
+      cmd_headergen = mkdir -p $(obj)/generated && $(PYTHON3) $(srctree)/$(src)/registers/gen_header.py \
+		      $(headergen-opts) --rnn $(srctree)/$(src)/registers --xml $< c-defines > $@
+
+$(obj)/generated/%.xml.h: $(src)/registers/adreno/%.xml \
+		$(src)/registers/adreno/adreno_common.xml \
+		$(src)/registers/adreno/adreno_pm4.xml \
+		$(src)/registers/freedreno_copyright.xml \
+		$(src)/registers/gen_header.py \
+		$(src)/registers/rules-fd.xsd \
+		FORCE
+	$(call if_changed,headergen)
+
+$(obj)/generated/%.xml.h: $(src)/registers/display/%.xml \
+		$(src)/registers/freedreno_copyright.xml \
+		$(src)/registers/gen_header.py \
+		$(src)/registers/rules-fd.xsd \
+		FORCE
+	$(call if_changed,headergen)
+
+ADRENO_HEADERS = \
+	generated/a2xx.xml.h \
+	generated/a3xx.xml.h \
+	generated/a4xx.xml.h \
+	generated/a5xx.xml.h \
+	generated/a6xx.xml.h \
+	generated/a6xx_gmu.xml.h \
+	generated/adreno_common.xml.h \
+	generated/adreno_pm4.xml.h \
+
+DISPLAY_HEADERS = \
+	generated/dsi_phy_7nm.xml.h \
+	generated/dsi_phy_10nm.xml.h \
+	generated/dsi_phy_14nm.xml.h \
+	generated/dsi_phy_20nm.xml.h \
+	generated/dsi_phy_28nm_8960.xml.h \
+	generated/dsi_phy_28nm.xml.h \
+	generated/dsi.xml.h \
+	generated/hdmi.xml.h \
+	generated/mdp4.xml.h \
+	generated/mdp5.xml.h \
+	generated/mdp_common.xml.h \
+	generated/mdss.xml.h \
+	generated/sfpb.xml.h
+
+$(addprefix $(obj)/,$(adreno-y)): $(addprefix $(obj)/,$(ADRENO_HEADERS))
+$(addprefix $(obj)/,$(msm-display-y)): $(addprefix $(obj)/,$(DISPLAY_HEADERS))
 
-obj-$(CONFIG_DRM_MSM)	+= msm.o
+targets += $(ADRENO_HEADERS) $(DISPLAY_HEADERS)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a2xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a2xx_catalog.c
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+
+static const struct adreno_info a2xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x02000000),
+		.family = ADRENO_2XX_GEN1,
+		.revn  = 200,
+		.fw = {
+			[ADRENO_FW_PM4] = "yamato_pm4.fw",
+			[ADRENO_FW_PFP] = "yamato_pfp.fw",
+		},
+		.gmem  = SZ_256K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a2xx_gpu_init,
+	}, { /* a200 on i.mx51 has only 128kib gmem */
+		.chip_ids = ADRENO_CHIP_IDS(0x02000001),
+		.family = ADRENO_2XX_GEN1,
+		.revn  = 201,
+		.fw = {
+			[ADRENO_FW_PM4] = "yamato_pm4.fw",
+			[ADRENO_FW_PFP] = "yamato_pfp.fw",
+		},
+		.gmem  = SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a2xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x02020000),
+		.family = ADRENO_2XX_GEN2,
+		.revn  = 220,
+		.fw = {
+			[ADRENO_FW_PM4] = "leia_pm4_470.fw",
+			[ADRENO_FW_PFP] = "leia_pfp_470.fw",
+		},
+		.gmem  = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a2xx_gpu_init,
+	}
+};
+DECLARE_ADRENO_GPULIST(a2xx);
+
+MODULE_FIRMWARE("qcom/leia_pfp_470.fw");
+MODULE_FIRMWARE("qcom/leia_pm4_470.fw");
+MODULE_FIRMWARE("qcom/yamato_pfp.fw");
+MODULE_FIRMWARE("qcom/yamato_pm4.fw");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
@@ -113,7 +113,7 @@
 	uint32_t *ptr, len;
 	int i, ret;
 
-	msm_gpummu_params(gpu->aspace->mmu, &pt_base, &tran_error);
+	a2xx_gpummu_params(gpu->aspace->mmu, &pt_base, &tran_error);
 
 	DBG("%s", gpu->name);
 
@@ -469,7 +469,7 @@
 static struct msm_gem_address_space *
 a2xx_create_address_space(struct msm_gpu *gpu, struct platform_device *pdev)
 {
-	struct msm_mmu *mmu = msm_gpummu_new(&pdev->dev, gpu);
+	struct msm_mmu *mmu = a2xx_gpummu_new(&pdev->dev, gpu);
 	struct msm_gem_address_space *aspace;
 
 	aspace = msm_gem_address_space_create(mmu, "gpu", SZ_16M,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a2xx_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a2xx_gpu.h
@@ -19,4 +19,8 @@
 };
 #define to_a2xx_gpu(x) container_of(x, struct a2xx_gpu, base)
 
+struct msm_mmu *a2xx_gpummu_new(struct device *dev, struct msm_gpu *gpu);
+void a2xx_gpummu_params(struct msm_mmu *mmu, dma_addr_t *pt_base,
+		dma_addr_t *tran_error);
+
 #endif /* __A2XX_GPU_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a2xx_gpummu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a2xx_gpummu.c
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2018 The Linux Foundation. All rights reserved. */
+
+#include <linux/dma-mapping.h>
+
+#include "msm_drv.h"
+#include "msm_mmu.h"
+
+#include "adreno_gpu.h"
+#include "a2xx_gpu.h"
+
+#include "a2xx.xml.h"
+
+struct a2xx_gpummu {
+	struct msm_mmu base;
+	struct msm_gpu *gpu;
+	dma_addr_t pt_base;
+	uint32_t *table;
+};
+#define to_a2xx_gpummu(x) container_of(x, struct a2xx_gpummu, base)
+
+#define GPUMMU_VA_START SZ_16M
+#define GPUMMU_VA_RANGE (0xfff * SZ_64K)
+#define GPUMMU_PAGE_SIZE SZ_4K
+#define TABLE_SIZE (sizeof(uint32_t) * GPUMMU_VA_RANGE / GPUMMU_PAGE_SIZE)
+
+static void a2xx_gpummu_detach(struct msm_mmu *mmu)
+{
+}
+
+static int a2xx_gpummu_map(struct msm_mmu *mmu, uint64_t iova,
+		struct sg_table *sgt, size_t len, int prot)
+{
+	struct a2xx_gpummu *gpummu = to_a2xx_gpummu(mmu);
+	unsigned idx = (iova - GPUMMU_VA_START) / GPUMMU_PAGE_SIZE;
+	struct sg_dma_page_iter dma_iter;
+	unsigned prot_bits = 0;
+
+	if (prot & IOMMU_WRITE)
+		prot_bits |= 1;
+	if (prot & IOMMU_READ)
+		prot_bits |= 2;
+
+	for_each_sgtable_dma_page(sgt, &dma_iter, 0) {
+		dma_addr_t addr = sg_page_iter_dma_address(&dma_iter);
+		int i;
+
+		for (i = 0; i < PAGE_SIZE; i += GPUMMU_PAGE_SIZE)
+			gpummu->table[idx++] = (addr + i) | prot_bits;
+	}
+
+	/* we can improve by deferring flush for multiple map() */
+	gpu_write(gpummu->gpu, REG_A2XX_MH_MMU_INVALIDATE,
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_ALL |
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_TC);
+	return 0;
+}
+
+static int a2xx_gpummu_unmap(struct msm_mmu *mmu, uint64_t iova, size_t len)
+{
+	struct a2xx_gpummu *gpummu = to_a2xx_gpummu(mmu);
+	unsigned idx = (iova - GPUMMU_VA_START) / GPUMMU_PAGE_SIZE;
+	unsigned i;
+
+	for (i = 0; i < len / GPUMMU_PAGE_SIZE; i++, idx++)
+                gpummu->table[idx] = 0;
+
+	gpu_write(gpummu->gpu, REG_A2XX_MH_MMU_INVALIDATE,
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_ALL |
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_TC);
+	return 0;
+}
+
+static void a2xx_gpummu_resume_translation(struct msm_mmu *mmu)
+{
+}
+
+static void a2xx_gpummu_destroy(struct msm_mmu *mmu)
+{
+	struct a2xx_gpummu *gpummu = to_a2xx_gpummu(mmu);
+
+	dma_free_attrs(mmu->dev, TABLE_SIZE, gpummu->table, gpummu->pt_base,
+		DMA_ATTR_FORCE_CONTIGUOUS);
+
+	kfree(gpummu);
+}
+
+static const struct msm_mmu_funcs funcs = {
+		.detach = a2xx_gpummu_detach,
+		.map = a2xx_gpummu_map,
+		.unmap = a2xx_gpummu_unmap,
+		.destroy = a2xx_gpummu_destroy,
+		.resume_translation = a2xx_gpummu_resume_translation,
+};
+
+struct msm_mmu *a2xx_gpummu_new(struct device *dev, struct msm_gpu *gpu)
+{
+	struct a2xx_gpummu *gpummu;
+
+	gpummu = kzalloc(sizeof(*gpummu), GFP_KERNEL);
+	if (!gpummu)
+		return ERR_PTR(-ENOMEM);
+
+	gpummu->table = dma_alloc_attrs(dev, TABLE_SIZE + 32, &gpummu->pt_base,
+		GFP_KERNEL | __GFP_ZERO, DMA_ATTR_FORCE_CONTIGUOUS);
+	if (!gpummu->table) {
+		kfree(gpummu);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	gpummu->gpu = gpu;
+	msm_mmu_init(&gpummu->base, dev, &funcs, MSM_MMU_GPUMMU);
+
+	return &gpummu->base;
+}
+
+void a2xx_gpummu_params(struct msm_mmu *mmu, dma_addr_t *pt_base,
+		dma_addr_t *tran_error)
+{
+	dma_addr_t base = to_a2xx_gpummu(mmu)->pt_base;
+
+	*pt_base = base;
+	*tran_error = base + TABLE_SIZE; /* 32-byte aligned */
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a3xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a3xx_catalog.c
@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+
+static const struct adreno_info a3xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x03000512),
+		.family = ADRENO_3XX,
+		.fw = {
+			[ADRENO_FW_PM4] = "a330_pm4.fw",
+			[ADRENO_FW_PFP] = "a330_pfp.fw",
+		},
+		.gmem  = SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x03000520),
+		.family = ADRENO_3XX,
+		.revn  = 305,
+		.fw = {
+			[ADRENO_FW_PM4] = "a300_pm4.fw",
+			[ADRENO_FW_PFP] = "a300_pfp.fw",
+		},
+		.gmem  = SZ_256K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x03000600),
+		.family = ADRENO_3XX,
+		.revn  = 307,        /* because a305c is revn==306 */
+		.fw = {
+			[ADRENO_FW_PM4] = "a300_pm4.fw",
+			[ADRENO_FW_PFP] = "a300_pfp.fw",
+		},
+		.gmem  = SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(
+			0x03020000,
+			0x03020001,
+			0x03020002
+		),
+		.family = ADRENO_3XX,
+		.revn  = 320,
+		.fw = {
+			[ADRENO_FW_PM4] = "a300_pm4.fw",
+			[ADRENO_FW_PFP] = "a300_pfp.fw",
+		},
+		.gmem  = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(
+			0x03030000,
+			0x03030001,
+			0x03030002
+		),
+		.family = ADRENO_3XX,
+		.revn  = 330,
+		.fw = {
+			[ADRENO_FW_PM4] = "a330_pm4.fw",
+			[ADRENO_FW_PFP] = "a330_pfp.fw",
+		},
+		.gmem  = SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}
+};
+DECLARE_ADRENO_GPULIST(a3xx);
+
+MODULE_FIRMWARE("qcom/a300_pm4.fw");
+MODULE_FIRMWARE("qcom/a300_pfp.fw");
+MODULE_FIRMWARE("qcom/a330_pm4.fw");
+MODULE_FIRMWARE("qcom/a330_pfp.fw");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
@@ -134,6 +134,13 @@
 		/* Set up AOOO: */
 		gpu_write(gpu, REG_A3XX_VBIF_OUT_AXI_AOOO_EN, 0x0000003c);
 		gpu_write(gpu, REG_A3XX_VBIF_OUT_AXI_AOOO, 0x003c003c);
+	} else if (adreno_is_a305b(adreno_gpu)) {
+		gpu_write(gpu, REG_A3XX_VBIF_IN_RD_LIM_CONF0, 0x00181818);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_WR_LIM_CONF0, 0x00181818);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_RD_LIM_CONF0, 0x00000018);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_WR_LIM_CONF0, 0x00000018);
+		gpu_write(gpu, REG_A3XX_VBIF_DDR_OUT_MAX_BURST, 0x00000303);
+		gpu_write(gpu, REG_A3XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x0003);
 	} else if (adreno_is_a306(adreno_gpu)) {
 		gpu_write(gpu, REG_A3XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x0003);
 		gpu_write(gpu, REG_A3XX_VBIF_OUT_RD_LIM_CONF0, 0x0000000a);
@@ -230,7 +237,7 @@
 	gpu_write(gpu, REG_A3XX_UCHE_CACHE_MODE_CONTROL_REG, 0x00000001);
 
 	/* Enable Clock gating: */
-	if (adreno_is_a306(adreno_gpu))
+	if (adreno_is_a305b(adreno_gpu) || adreno_is_a306(adreno_gpu))
 		gpu_write(gpu, REG_A3XX_RBBM_CLOCK_CTL, 0xaaaaaaaa);
 	else if (adreno_is_a320(adreno_gpu))
 		gpu_write(gpu, REG_A3XX_RBBM_CLOCK_CTL, 0xbfffffff);
@@ -333,7 +340,7 @@
 				AXXX_CP_QUEUE_THRESHOLDS_CSQ_IB1_START(2) |
 				AXXX_CP_QUEUE_THRESHOLDS_CSQ_IB2_START(6) |
 				AXXX_CP_QUEUE_THRESHOLDS_CSQ_ST_START(14));
-	} else if (adreno_is_a330(adreno_gpu)) {
+	} else if (adreno_is_a330(adreno_gpu) || adreno_is_a305b(adreno_gpu)) {
 		/* NOTE: this (value take from downstream android driver)
 		 * includes some bits outside of the known bitfields.  But
 		 * A330 has this "MERCIU queue" thing too, which might
@@ -559,7 +566,7 @@
 		goto fail;
 
 	/* if needed, allocate gmem: */
-	if (adreno_is_a330(adreno_gpu)) {
+	if (adreno_is_a330(adreno_gpu) || adreno_is_a305b(adreno_gpu)) {
 		ret = adreno_gpu_ocmem_init(&adreno_gpu->base.pdev->dev,
 					    adreno_gpu, &a3xx_gpu->ocmem);
 		if (ret)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a4xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a4xx_catalog.c
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+
+static const struct adreno_info a4xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x04000500),
+		.family = ADRENO_4XX,
+		.revn  = 405,
+		.fw = {
+			[ADRENO_FW_PM4] = "a420_pm4.fw",
+			[ADRENO_FW_PFP] = "a420_pfp.fw",
+		},
+		.gmem  = SZ_256K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a4xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x04020000),
+		.family = ADRENO_4XX,
+		.revn  = 420,
+		.fw = {
+			[ADRENO_FW_PM4] = "a420_pm4.fw",
+			[ADRENO_FW_PFP] = "a420_pfp.fw",
+		},
+		.gmem  = (SZ_1M + SZ_512K),
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a4xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x04030002),
+		.family = ADRENO_4XX,
+		.revn  = 430,
+		.fw = {
+			[ADRENO_FW_PM4] = "a420_pm4.fw",
+			[ADRENO_FW_PFP] = "a420_pfp.fw",
+		},
+		.gmem  = (SZ_1M + SZ_512K),
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a4xx_gpu_init,
+	}
+};
+DECLARE_ADRENO_GPULIST(a4xx);
+
+MODULE_FIRMWARE("qcom/a420_pm4.fw");
+MODULE_FIRMWARE("qcom/a420_pfp.fw");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a5xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a5xx_catalog.c
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+
+static const struct adreno_info a5xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x05000600),
+		.family = ADRENO_5XX,
+		.revn = 506,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = (SZ_128K + SZ_8K),
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_TWO_PASS_USE_WFI |
+			  ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		.zapfw = "a506_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05000800),
+		.family = ADRENO_5XX,
+		.revn = 508,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = (SZ_128K + SZ_8K),
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		.zapfw = "a508_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05000900),
+		.family = ADRENO_5XX,
+		.revn = 509,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = (SZ_256K + SZ_16K),
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		/* Adreno 509 uses the same ZAP as 512 */
+		.zapfw = "a512_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05010000),
+		.family = ADRENO_5XX,
+		.revn = 510,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = SZ_256K,
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.init = a5xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05010200),
+		.family = ADRENO_5XX,
+		.revn = 512,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = (SZ_256K + SZ_16K),
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		.zapfw = "a512_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(
+			0x05030002,
+			0x05030004
+		),
+		.family = ADRENO_5XX,
+		.revn = 530,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+			[ADRENO_FW_GPMU] = "a530v3_gpmu.fw2",
+		},
+		.gmem = SZ_1M,
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_TWO_PASS_USE_WFI |
+			ADRENO_QUIRK_FAULT_DETECT_MASK,
+		.init = a5xx_gpu_init,
+		.zapfw = "a530_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05040001),
+		.family = ADRENO_5XX,
+		.revn = 540,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+			[ADRENO_FW_GPMU] = "a540_gpmu.fw2",
+		},
+		.gmem = SZ_1M,
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		.zapfw = "a540_zap.mdt",
+	}
+};
+DECLARE_ADRENO_GPULIST(a5xx);
+
+MODULE_FIRMWARE("qcom/a530_pm4.fw");
+MODULE_FIRMWARE("qcom/a530_pfp.fw");
+MODULE_FIRMWARE("qcom/a530v3_gpmu.fw2");
+MODULE_FIRMWARE("qcom/a530_zap.mdt");
+MODULE_FIRMWARE("qcom/a530_zap.b00");
+MODULE_FIRMWARE("qcom/a530_zap.b01");
+MODULE_FIRMWARE("qcom/a530_zap.b02");
+MODULE_FIRMWARE("qcom/a540_gpmu.fw2");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -65,6 +65,8 @@
 
 static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit)
 {
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
 	struct msm_ringbuffer *ring = submit->ring;
 	struct drm_gem_object *obj;
 	uint32_t *ptr, dwords;
@@ -109,6 +111,7 @@
 		}
 	}
 
+	a5xx_gpu->last_seqno[ring->id] = submit->seqno;
 	a5xx_flush(gpu, ring, true);
 	a5xx_preempt_trigger(gpu);
 
@@ -150,9 +153,13 @@
 	OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
 	OUT_RING(ring, 1);
 
-	/* Enable local preemption for finegrain preemption */
+	/*
+	 * Disable local preemption by default because it requires
+	 * user-space to be aware of it and provide additional handling
+	 * to restore rendering state or do various flushes on switch.
+	 */
 	OUT_PKT7(ring, CP_PREEMPT_ENABLE_LOCAL, 1);
-	OUT_RING(ring, 0x1);
+	OUT_RING(ring, 0x0);
 
 	/* Allow CP_CONTEXT_SWITCH_YIELD packets in the IB2 */
 	OUT_PKT7(ring, CP_YIELD_ENABLE, 1);
@@ -206,6 +213,7 @@
 	/* Write the fence to the scratch register */
 	OUT_PKT4(ring, REG_A5XX_CP_SCRATCH_REG(2), 1);
 	OUT_RING(ring, submit->seqno);
+	a5xx_gpu->last_seqno[ring->id] = submit->seqno;
 
 	/*
 	 * Execute a CACHE_FLUSH_TS event. This will ensure that the
@@ -1788,5 +1796,9 @@
 	else
 		adreno_gpu->ubwc_config.highest_bank_bit = 14;
 
+	/* a5xx only supports UBWC 1.0, these are not configurable */
+	adreno_gpu->ubwc_config.macrotile_mode = 0;
+	adreno_gpu->ubwc_config.ubwc_swizzle = 0x7;
+
 	return gpu;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
@@ -34,8 +34,10 @@
 	struct drm_gem_object *preempt_counters_bo[MSM_GPU_MAX_RINGS];
 	struct a5xx_preempt_record *preempt[MSM_GPU_MAX_RINGS];
 	uint64_t preempt_iova[MSM_GPU_MAX_RINGS];
+	uint32_t last_seqno[MSM_GPU_MAX_RINGS];
 
 	atomic_t preempt_state;
+	spinlock_t preempt_start_lock;
 	struct timer_list preempt_timer;
 
 	struct drm_gem_object *shadow_bo;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
@@ -55,6 +55,8 @@
 /* Return the highest priority ringbuffer with something in it */
 static struct msm_ringbuffer *get_next_ring(struct msm_gpu *gpu)
 {
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
 	unsigned long flags;
 	int i;
 
@@ -64,6 +66,8 @@
 
 		spin_lock_irqsave(&ring->preempt_lock, flags);
 		empty = (get_wptr(ring) == gpu->funcs->get_rptr(gpu, ring));
+		if (!empty && ring == a5xx_gpu->cur_ring)
+			empty = ring->memptrs->fence == a5xx_gpu->last_seqno[i];
 		spin_unlock_irqrestore(&ring->preempt_lock, flags);
 
 		if (!empty)
@@ -98,11 +102,18 @@
 		return;
 
 	/*
+	 * Serialize preemption start to ensure that we always make
+	 * decision on latest state. Otherwise we can get stuck in
+	 * lower priority or empty ring.
+	 */
+	spin_lock_irqsave(&a5xx_gpu->preempt_start_lock, flags);
+
+	/*
 	 * Try to start preemption by moving from NONE to START. If
 	 * unsuccessful, a preemption is already in flight
 	 */
 	if (!try_preempt_state(a5xx_gpu, PREEMPT_NONE, PREEMPT_START))
-		return;
+		goto out;
 
 	/* Get the next ring to preempt to */
 	ring = get_next_ring(gpu);
@@ -127,9 +138,11 @@
 		set_preempt_state(a5xx_gpu, PREEMPT_ABORT);
 		update_wptr(gpu, a5xx_gpu->cur_ring);
 		set_preempt_state(a5xx_gpu, PREEMPT_NONE);
-		return;
+		goto out;
 	}
 
+	spin_unlock_irqrestore(&a5xx_gpu->preempt_start_lock, flags);
+
 	/* Make sure the wptr doesn't update while we're in motion */
 	spin_lock_irqsave(&ring->preempt_lock, flags);
 	a5xx_gpu->preempt[ring->id]->wptr = get_wptr(ring);
@@ -152,6 +165,10 @@
 
 	/* And actually start the preemption */
 	gpu_write(gpu, REG_A5XX_CP_CONTEXT_SWITCH_CNTL, 1);
+	return;
+
+out:
+	spin_unlock_irqrestore(&a5xx_gpu->preempt_start_lock, flags);
 }
 
 void a5xx_preempt_irq(struct msm_gpu *gpu)
@@ -188,6 +205,12 @@
 	update_wptr(gpu, a5xx_gpu->cur_ring);
 
 	set_preempt_state(a5xx_gpu, PREEMPT_NONE);
+
+	/*
+	 * Try to trigger preemption again in case there was a submit or
+	 * retire during ring switch
+	 */
+	a5xx_preempt_trigger(gpu);
 }
 
 void a5xx_preempt_hw_init(struct msm_gpu *gpu)
@@ -204,6 +227,8 @@
 		return;
 
 	for (i = 0; i < gpu->nr_rings; i++) {
+		a5xx_gpu->preempt[i]->data = 0;
+		a5xx_gpu->preempt[i]->info = 0;
 		a5xx_gpu->preempt[i]->wptr = 0;
 		a5xx_gpu->preempt[i]->rptr = 0;
 		a5xx_gpu->preempt[i]->rbase = gpu->rb[i]->iova;
@@ -298,5 +323,6 @@
 		}
 	}
 
+	spin_lock_init(&a5xx_gpu->preempt_start_lock);
 	timer_setup(&a5xx_gpu->preempt_timer, a5xx_preempt_timer, 0);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
@@ -0,0 +1,1339 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+#include "a6xx_gpu.h"
+#include "a6xx.xml.h"
+#include "a6xx_gmu.xml.h"
+
+static const struct adreno_reglist a612_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000081},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01202222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05522022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+/* For a615 family (a615, a616, a618 and a619) */
+static const struct adreno_reglist a615_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0,  0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0,  0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0,  0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP1,  0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP1, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0,  0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP1,  0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP1, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP1, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE,  0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE,  0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002020},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU1, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU2, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU3, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU1, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU2, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU3, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05022022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a630_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP2, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP3, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02022220},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP1, 0x02022220},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP2, 0x02022220},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP3, 0x02022220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP2, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP3, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP1, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP2, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP3, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP1, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP2, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP3, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP2, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP3, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP2, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP3, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP1, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP2, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP3, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP2, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP3, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP2, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP3, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP2, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP3, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP1, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP2, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP3, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP2, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP3, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP2, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP3, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP2, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP3, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP1, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP2, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP3, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB2, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB3, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB1, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB2, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB3, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU1, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU2, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU3, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU1, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU2, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU3, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05022022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a640_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05222022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a650_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a660_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a690_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_CNTL, 0x8AA8AA82},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{REG_A6XX_GPU_GMU_AO_GMU_CGC_MODE_CNTL, 0x20200},
+	{REG_A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x10111},
+	{REG_A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x5555},
+	{}
+};
+
+/* For a615, a616, a618, a619, a630, a640 and a680 */
+static const u32 a630_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
+	A6XX_PROTECT_RDONLY(0x00501, 0x0005),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00800, 0x0082),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
+	A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
+	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
+	A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
+	A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
+	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
+	A6XX_PROTECT_NORDWR(0x09e70, 0x0001),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x032f),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
+	A6XX_PROTECT_NORDWR(0x0be20, 0x17df),
+	A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x11c00, 0x0000), /* note: infinite range */
+};
+DECLARE_ADRENO_PROTECT(a630_protect, 32);
+
+/* These are for a620 and a650 */
+static const u32 a650_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
+	A6XX_PROTECT_RDONLY(0x00501, 0x0005),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00800, 0x0082),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
+	A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
+	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
+	A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
+	A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
+	A6XX_PROTECT_NORDWR(0x08e80, 0x027f),
+	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
+	A6XX_PROTECT_NORDWR(0x09e60, 0x0011),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x032f),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0b608, 0x0007),
+	A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
+	A6XX_PROTECT_NORDWR(0x0be20, 0x17df),
+	A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x18400, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1a800, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
+	A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
+	A6XX_PROTECT_NORDWR(0x1f887, 0x001b),
+	A6XX_PROTECT_NORDWR(0x1f8c0, 0x0000), /* note: infinite range */
+};
+DECLARE_ADRENO_PROTECT(a650_protect, 48);
+
+/* These are for a635 and a660 */
+static const u32 a660_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
+	A6XX_PROTECT_RDONLY(0x00501, 0x0005),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00800, 0x0082),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
+	A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
+	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
+	A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
+	A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
+	A6XX_PROTECT_NORDWR(0x08e80, 0x027f),
+	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
+	A6XX_PROTECT_NORDWR(0x09e60, 0x0011),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x012f),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0b608, 0x0006),
+	A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
+	A6XX_PROTECT_NORDWR(0x0be20, 0x015f),
+	A6XX_PROTECT_NORDWR(0x0d000, 0x05ff),
+	A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x18400, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1a400, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
+	A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
+	A6XX_PROTECT_NORDWR(0x1f860, 0x0000),
+	A6XX_PROTECT_NORDWR(0x1f887, 0x001b),
+	A6XX_PROTECT_NORDWR(0x1f8c0, 0x0000), /* note: infinite range */
+};
+DECLARE_ADRENO_PROTECT(a660_protect, 48);
+
+/* These are for a690 */
+static const u32 a690_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x004ff),
+	A6XX_PROTECT_RDONLY(0x00501, 0x00001),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x002f4),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x00000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x00000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x00000),
+	A6XX_PROTECT_NORDWR(0x00800, 0x00082),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x00008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x00024),
+	A6XX_PROTECT_RDONLY(0x008de, 0x000ae),
+	A6XX_PROTECT_NORDWR(0x00900, 0x0004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x00272),
+	A6XX_PROTECT_NORDWR(0x00e00, 0x00001),
+	A6XX_PROTECT_NORDWR(0x00e03, 0x0000c),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x000c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x01fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x001cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x00000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x00007),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x0001f),
+	A6XX_PROTECT_NORDWR(0x08e80, 0x0027f),
+	A6XX_PROTECT_NORDWR(0x09624, 0x001db),
+	A6XX_PROTECT_NORDWR(0x09e60, 0x00011),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x00187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x001cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x00000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x0012f),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x00000),
+	A6XX_PROTECT_NORDWR(0x0b608, 0x00006),
+	A6XX_PROTECT_NORDWR(0x0be02, 0x00001),
+	A6XX_PROTECT_NORDWR(0x0be20, 0x0015f),
+	A6XX_PROTECT_NORDWR(0x0d000, 0x005ff),
+	A6XX_PROTECT_NORDWR(0x0f000, 0x00bff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x01fff),
+	A6XX_PROTECT_NORDWR(0x11c00, 0x00000), /*note: infiite range */
+};
+DECLARE_ADRENO_PROTECT(a690_protect, 48);
+
+static const struct adreno_info a6xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x06010000),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 610,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+		},
+		.gmem = (SZ_128K + SZ_4K),
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init = a6xx_gpu_init,
+		.zapfw = "a610_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a612_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00080000,
+		},
+		/*
+		 * There are (at least) three SoCs implementing A610: SM6125
+		 * (trinket), SM6115 (bengal) and SM6225 (khaje). Trinket does
+		 * not have speedbinning, as only a single SKU exists and we
+		 * don't support khaje upstream yet.  Hence, this matching
+		 * table is only valid for bengal.
+		 */
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 206, 1 },
+			{ 200, 2 },
+			{ 157, 3 },
+			{ 127, 4 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06010500),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 615,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a630_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x0018000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			/*
+			 * The default speed bin (0) has the same values as
+			 * speed bin 90 which goes up to 432 MHz.
+			 */
+			{ 0,   0 },
+			{ 90,  0 },
+			{ 105, 1 },
+			{ 146, 2 },
+			{ 163, 3 },
+		),
+	}, {
+		.machine = "qcom,sm7150",
+		.chip_ids = ADRENO_CHIP_IDS(0x06010800),
+		.family = ADRENO_6XX_GEN1,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a630_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mbn",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00180000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 128, 1 },
+			{ 146, 2 },
+			{ 167, 3 },
+			{ 172, 4 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06010800),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 618,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a630_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.a6xx = &(const struct a6xx_info) {
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00180000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 169, 1 },
+			{ 174, 2 },
+		),
+	}, {
+		.machine = "qcom,sm4350",
+		.chip_ids = ADRENO_CHIP_IDS(0x06010900),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 619,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a619_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00018000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 138, 1 },
+			{ 92,  2 },
+		),
+	}, {
+		.machine = "qcom,sm6375",
+		.chip_ids = ADRENO_CHIP_IDS(0x06010901),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 619,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a619_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00018000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 190, 1 },
+			{ 177, 2 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06010900),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 619,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a619_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00018000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 120, 4 },
+			{ 138, 3 },
+			{ 169, 2 },
+			{ 180, 1 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(
+			0x06030001,
+			0x06030002
+		),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 630,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a630_gmu.bin",
+		},
+		.gmem = SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a630_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a630_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00180000,
+		},
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06040001),
+		.family = ADRENO_6XX_GEN2,
+		.revn = 640,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a640_gmu.bin",
+		},
+		.gmem = SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a640_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a640_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00180000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0, 0 },
+			{ 1, 1 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06050002),
+		.family = ADRENO_6XX_GEN3,
+		.revn = 650,
+		.fw = {
+			[ADRENO_FW_SQE] = "a650_sqe.fw",
+			[ADRENO_FW_GMU] = "a650_gmu.bin",
+		},
+		.gmem = SZ_1M + SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a650_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a650_hwcg,
+			.protect = &a650_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00300200,
+		},
+		.address_space_size = SZ_16G,
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0, 0 },
+			{ 1, 1 },
+			{ 2, 3 }, /* Yep, 2 and 3 are swapped! :/ */
+			{ 3, 2 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06060001),
+		.family = ADRENO_6XX_GEN4,
+		.revn = 660,
+		.fw = {
+			[ADRENO_FW_SQE] = "a660_sqe.fw",
+			[ADRENO_FW_GMU] = "a660_gmu.bin",
+		},
+		.gmem = SZ_1M + SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a660_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a660_hwcg,
+			.protect = &a660_protect,
+			.gmu_cgc_mode = 0x00020000,
+			.prim_fifo_threshold = 0x00300200,
+		},
+		.address_space_size = SZ_16G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06060300),
+		.family = ADRENO_6XX_GEN4,
+		.fw = {
+			[ADRENO_FW_SQE] = "a660_sqe.fw",
+			[ADRENO_FW_GMU] = "a663_gmu.bin",
+		},
+		.gmem = SZ_1M + SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a690_hwcg,
+			.protect = &a660_protect,
+			.gmu_cgc_mode = 0x00020200,
+			.prim_fifo_threshold = 0x00300200,
+		},
+		.address_space_size = SZ_16G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06030500),
+		.family = ADRENO_6XX_GEN4,
+		.fw = {
+			[ADRENO_FW_SQE] = "a660_sqe.fw",
+			[ADRENO_FW_GMU] = "a660_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a660_zap.mbn",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a660_hwcg,
+			.protect = &a660_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00200200,
+		},
+		.address_space_size = SZ_16G,
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 117, 0 },
+			{ 172, 2 }, /* Called speedbin 1 downstream, but let's not break things! */
+			{ 190, 1 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06080001),
+		.family = ADRENO_6XX_GEN2,
+		.revn = 680,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a640_gmu.bin",
+		},
+		.gmem = SZ_2M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a640_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a640_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00200200,
+		},
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06090000),
+		.family = ADRENO_6XX_GEN4,
+		.fw = {
+			[ADRENO_FW_SQE] = "a660_sqe.fw",
+			[ADRENO_FW_GMU] = "a660_gmu.bin",
+		},
+		.gmem = SZ_4M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a690_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a690_hwcg,
+			.protect = &a690_protect,
+			.gmu_cgc_mode = 0x00020200,
+			.prim_fifo_threshold = 0x00800200,
+		},
+		.address_space_size = SZ_16G,
+	}
+};
+DECLARE_ADRENO_GPULIST(a6xx);
+
+MODULE_FIRMWARE("qcom/a615_zap.mbn");
+MODULE_FIRMWARE("qcom/a619_gmu.bin");
+MODULE_FIRMWARE("qcom/a630_sqe.fw");
+MODULE_FIRMWARE("qcom/a630_gmu.bin");
+MODULE_FIRMWARE("qcom/a630_zap.mbn");
+MODULE_FIRMWARE("qcom/a640_gmu.bin");
+MODULE_FIRMWARE("qcom/a650_gmu.bin");
+MODULE_FIRMWARE("qcom/a650_sqe.fw");
+MODULE_FIRMWARE("qcom/a660_gmu.bin");
+MODULE_FIRMWARE("qcom/a660_sqe.fw");
+
+static const struct adreno_reglist a702_hwcg[] = {
+	{ REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000081 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01202222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040f00 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05522022 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002 },
+	{ REG_A6XX_RBBM_ISDB_CNT, 0x00000182 },
+	{ REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_FCHE, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_FCHE, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_FCHE, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_GLC, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GLC, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GLC, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_MHUB, 0x00000002 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_MHUB, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_MHUB, 0x00000000 },
+	{}
+};
+
+static const struct adreno_reglist a730_hwcg[] = {
+	{ REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02022222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222220 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x44000f00 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00555555 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00440044 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE2_GRAS, 0x00000222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GRAS, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222223 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GPC, 0x00222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_LRZ, 0x55555552 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_CP, 0x00000223 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL, 0x8aa8aa82 },
+	{ REG_A6XX_RBBM_ISDB_CNT, 0x00000182 },
+	{ REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
+	{},
+};
+
+static const struct adreno_reglist a740_hwcg[] = {
+	{ REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x22022222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x003cf3cf },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222220 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000444 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x44000f00 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00555555 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00440044 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE2_GRAS, 0x00000222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GRAS, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222223 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GPC, 0x00222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_LRZ, 0x55555552 },
+	{ REG_A7XX_RBBM_CLOCK_HYST2_VFD, 0x00000000 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_CP, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL, 0x8aa8aa82 },
+	{ REG_A6XX_RBBM_ISDB_CNT, 0x00000182 },
+	{ REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
+	{},
+};
+
+static const u32 a730_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x0058),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
+	A6XX_PROTECT_RDONLY(0x005fb, 0x009d),
+	A6XX_PROTECT_NORDWR(0x00699, 0x01e9),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
+	/* 0x008d0-0x008dd and 0x008e0-0x008e6 are unprotected on purpose for tools like perfetto */
+	A6XX_PROTECT_NORDWR(0x008de, 0x0001),
+	A6XX_PROTECT_RDONLY(0x008e7, 0x014b),
+	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x00b2),
+	A6XX_PROTECT_NORDWR(0x00a41, 0x01be),
+	A6XX_PROTECT_NORDWR(0x00df0, 0x0001),
+	A6XX_PROTECT_NORDWR(0x00e01, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00e07, 0x0008),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
+	A6XX_PROTECT_NORDWR(0x08e80, 0x0280),
+	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
+	A6XX_PROTECT_NORDWR(0x09e40, 0x0000),
+	A6XX_PROTECT_NORDWR(0x09e64, 0x000d),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x000f),
+	A6XX_PROTECT_NORDWR(0x0ae66, 0x0003),
+	A6XX_PROTECT_NORDWR(0x0ae6f, 0x0003),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x0003),
+	A6XX_PROTECT_NORDWR(0x0ec00, 0x0fff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x18400, 0x0053),
+	A6XX_PROTECT_RDONLY(0x18454, 0x0004),
+	A6XX_PROTECT_NORDWR(0x18459, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1a459, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1c459, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
+	A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
+	A6XX_PROTECT_NORDWR(0x1f860, 0x0000),
+	A6XX_PROTECT_NORDWR(0x1f878, 0x002a),
+	/* CP_PROTECT_REG[45, 46] are left untouched! */
+	0,
+	0,
+	A6XX_PROTECT_NORDWR(0x1f8c0, 0x00000),
+};
+DECLARE_ADRENO_PROTECT(a730_protect, 48);
+
+static const struct adreno_info a7xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x07000200),
+		.family = ADRENO_6XX_GEN1, /* NOT a mistake! */
+		.fw = {
+			[ADRENO_FW_SQE] = "a702_sqe.fw",
+		},
+		.gmem = SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a702_zap.mbn",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a702_hwcg,
+			.protect = &a650_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x0000c000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 236, 1 },
+			{ 178, 2 },
+			{ 142, 3 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x07030001),
+		.family = ADRENO_7XX_GEN1,
+		.fw = {
+			[ADRENO_FW_SQE] = "a730_sqe.fw",
+			[ADRENO_FW_GMU] = "gmu_gen70000.bin",
+		},
+		.gmem = SZ_2M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			  ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a730_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a730_hwcg,
+			.protect = &a730_protect,
+			.gmu_cgc_mode = 0x00020000,
+		},
+		.address_space_size = SZ_16G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x43050a01), /* "C510v2" */
+		.family = ADRENO_7XX_GEN2,
+		.fw = {
+			[ADRENO_FW_SQE] = "a740_sqe.fw",
+			[ADRENO_FW_GMU] = "gmu_gen70200.bin",
+		},
+		.gmem = 3 * SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			  ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a740_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a740_hwcg,
+			.protect = &a730_protect,
+			.gmu_chipid = 0x7020100,
+			.gmu_cgc_mode = 0x00020202,
+		},
+		.address_space_size = SZ_16G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x43050c01), /* "C512v2" */
+		.family = ADRENO_7XX_GEN2,
+		.fw = {
+			[ADRENO_FW_SQE] = "gen70500_sqe.fw",
+			[ADRENO_FW_GMU] = "gen70500_gmu.bin",
+		},
+		.gmem = 3 * SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			  ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a740_hwcg,
+			.protect = &a730_protect,
+			.gmu_chipid = 0x7050001,
+			.gmu_cgc_mode = 0x00020202,
+		},
+		.address_space_size = SZ_256G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x43051401), /* "C520v2" */
+		.family = ADRENO_7XX_GEN3,
+		.fw = {
+			[ADRENO_FW_SQE] = "gen70900_sqe.fw",
+			[ADRENO_FW_GMU] = "gmu_gen70900.bin",
+		},
+		.gmem = 3 * SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			  ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "gen70900_zap.mbn",
+		.a6xx = &(const struct a6xx_info) {
+			.protect = &a730_protect,
+			.gmu_chipid = 0x7090100,
+			.gmu_cgc_mode = 0x00020202,
+		},
+		.address_space_size = SZ_16G,
+	}
+};
+DECLARE_ADRENO_GPULIST(a7xx);
+
+static inline void __build_asserts(void)
+{
+	BUILD_BUG_ON(a630_protect.count > a630_protect.count_max);
+	BUILD_BUG_ON(a650_protect.count > a650_protect.count_max);
+	BUILD_BUG_ON(a660_protect.count > a660_protect.count_max);
+	BUILD_BUG_ON(a690_protect.count > a690_protect.count_max);
+	BUILD_BUG_ON(a730_protect.count > a730_protect.count_max);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -223,7 +223,7 @@
 	 * note: downstream saves the value in poweroff and restores it here
 	 */
 	if (adreno_is_a7xx(adreno_gpu))
-		gmu_write(gmu, REG_A6XX_GMU_GENERAL_9, 0);
+		gmu_write(gmu, REG_A7XX_GMU_GENERAL_9, 0);
 	else
 		gmu_write(gmu, REG_A6XX_GPU_GMU_CX_GMU_PWR_COL_CP_RESP, 0);
 
@@ -769,8 +769,9 @@
 {
 	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
 	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	const struct a6xx_info *a6xx_info = adreno_gpu->info->a6xx;
 	u32 fence_range_lower, fence_range_upper;
-	u32 chipid, chipid_min = 0;
+	u32 chipid = 0;
 	int ret;
 
 	/* Vote veto for FAL10 */
@@ -830,25 +831,8 @@
 	 */
 	gmu_write(gmu, REG_A6XX_GMU_CM3_CFG, 0x4052);
 
-	/* NOTE: A730 may also fall in this if-condition with a future GMU fw update. */
-	if (adreno_is_a7xx(adreno_gpu) && !adreno_is_a730(adreno_gpu)) {
-		/* A7xx GPUs have obfuscated chip IDs. Use constant maj = 7 */
-		chipid = FIELD_PREP(GENMASK(31, 24), 0x7);
-
-		/*
-		 * The min part has a 1-1 mapping for each GPU SKU.
-		 * This chipid that the GMU expects corresponds to the "GENX_Y_Z" naming,
-		 * where X = major, Y = minor, Z = patchlevel, e.g. GEN7_2_1 for prod A740.
-		 */
-		if (adreno_is_a740(adreno_gpu))
-			chipid_min = 2;
-		else
-			return -EINVAL;
-
-		chipid |= FIELD_PREP(GENMASK(23, 16), chipid_min);
-
-		/* Get the patchid (which may vary) from the device tree */
-		chipid |= FIELD_PREP(GENMASK(15, 8), adreno_patchid(adreno_gpu));
+	if (a6xx_info->gmu_chipid) {
+		chipid = a6xx_info->gmu_chipid;
 	} else {
 		/*
 		 * Note that the GMU has a slightly different layout for
@@ -863,8 +847,8 @@
 	}
 
 	if (adreno_is_a7xx(adreno_gpu)) {
-		gmu_write(gmu, REG_A6XX_GMU_GENERAL_10, chipid);
-		gmu_write(gmu, REG_A6XX_GMU_GENERAL_8,
+		gmu_write(gmu, REG_A7XX_GMU_GENERAL_10, chipid);
+		gmu_write(gmu, REG_A7XX_GMU_GENERAL_8,
 			  (gmu->log.iova & GENMASK(31, 12)) |
 			  ((gmu->log.size / SZ_4K - 1) & GENMASK(7, 0)));
 	} else {
@@ -1327,7 +1311,13 @@
 	if (!pri_count)
 		return -EINVAL;
 
-	sec = cmd_db_read_aux_data("mx.lvl", &sec_count);
+	/*
+	 * Some targets have a separate gfx mxc rail. So try to read that first and then fall back
+	 * to regular mx rail if it is missing
+	 */
+	sec = cmd_db_read_aux_data("gmxc.lvl", &sec_count);
+	if (IS_ERR(sec) && sec != ERR_PTR(-EPROBE_DEFER))
+		sec = cmd_db_read_aux_data("mx.lvl", &sec_count);
 	if (IS_ERR(sec))
 		return PTR_ERR(sec);
 
@@ -1517,15 +1507,13 @@
 
 	irq = platform_get_irq_byname(pdev, name);
 
-	ret = request_irq(irq, handler, IRQF_TRIGGER_HIGH, name, gmu);
+	ret = request_irq(irq, handler, IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN, name, gmu);
 	if (ret) {
 		DRM_DEV_ERROR(&pdev->dev, "Unable to get interrupt %s %d\n",
 			      name, ret);
 		return ret;
 	}
 
-	disable_irq(irq);
-
 	return irq;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -100,9 +100,10 @@
 }
 
 static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,
-		struct msm_ringbuffer *ring, struct msm_file_private *ctx)
+		struct msm_ringbuffer *ring, struct msm_gem_submit *submit)
 {
 	bool sysprof = refcount_read(&a6xx_gpu->base.base.sysprof_active) > 1;
+	struct msm_file_private *ctx = submit->queue->ctx;
 	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
 	phys_addr_t ttbr;
 	u32 asid;
@@ -114,6 +115,15 @@
 	if (msm_iommu_pagetable_params(ctx->aspace->mmu, &ttbr, &asid))
 		return;
 
+	if (adreno_gpu->info->family >= ADRENO_7XX_GEN1) {
+		/* Wait for previous submit to complete before continuing: */
+		OUT_PKT7(ring, CP_WAIT_TIMESTAMP, 4);
+		OUT_RING(ring, 0);
+		OUT_RING(ring, lower_32_bits(rbmemptr(ring, fence)));
+		OUT_RING(ring, upper_32_bits(rbmemptr(ring, fence)));
+		OUT_RING(ring, submit->seqno - 1);
+	}
+
 	if (!sysprof) {
 		if (!adreno_is_a7xx(adreno_gpu)) {
 			/* Turn off protected mode to write to special registers */
@@ -192,7 +202,7 @@
 	struct msm_ringbuffer *ring = submit->ring;
 	unsigned int i, ibs = 0;
 
-	a6xx_set_pagetable(a6xx_gpu, ring, submit->queue->ctx);
+	a6xx_set_pagetable(a6xx_gpu, ring, submit);
 
 	get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP(0),
 		rbmemptr_stats(ring, index, cpcycles_start));
@@ -282,9 +292,9 @@
 	OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
 	OUT_RING(ring, CP_THREAD_CONTROL_0_SYNC_THREADS | CP_SET_THREAD_BR);
 
-	a6xx_set_pagetable(a6xx_gpu, ring, submit->queue->ctx);
+	a6xx_set_pagetable(a6xx_gpu, ring, submit);
 
-	get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP(0),
+	get_stats_counter(ring, REG_A7XX_RBBM_PERFCTR_CP(0),
 		rbmemptr_stats(ring, index, cpcycles_start));
 	get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER,
 		rbmemptr_stats(ring, index, alwayson_start));
@@ -330,7 +340,7 @@
 	OUT_PKT7(ring, CP_SET_MARKER, 1);
 	OUT_RING(ring, 0x00e); /* IB1LIST end */
 
-	get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP(0),
+	get_stats_counter(ring, REG_A7XX_RBBM_PERFCTR_CP(0),
 		rbmemptr_stats(ring, index, cpcycles_end));
 	get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER,
 		rbmemptr_stats(ring, index, alwayson_end));
@@ -394,564 +404,6 @@
 	a6xx_flush(gpu, ring);
 }
 
-const struct adreno_reglist a612_hwcg[] = {
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000081},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01202222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040f00},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05522022},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
-	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
-	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
-	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
-	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
-	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
-	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
-	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
-	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
-	{},
-};
-
-/* For a615 family (a615, a616, a618 and a619) */
-const struct adreno_reglist a615_hwcg[] = {
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP0,  0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP0,  0x0000F3CF},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP0,  0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP1,  0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP1, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP1, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP0,  0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP1,  0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP1, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP1, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP1, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP1, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE,  0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
-	{REG_A6XX_RBBM_CLOCK_HYST_UCHE,  0x00000004},
-	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002020},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU1, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU2, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU3, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU1, 0x00040F00},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU2, 0x00040F00},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU3, 0x00040F00},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05022022},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
-	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
-	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
-	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
-	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
-	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
-	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
-	{},
-};
-
-const struct adreno_reglist a630_hwcg[] = {
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP1, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP2, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP3, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02022220},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP1, 0x02022220},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP2, 0x02022220},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP3, 0x02022220},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP2, 0x00000080},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP3, 0x00000080},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP1, 0x0000f3cf},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP2, 0x0000f3cf},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP3, 0x0000f3cf},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP1, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP2, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP3, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP2, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP3, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP1, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP2, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP3, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP1, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP2, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP3, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP2, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP3, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP2, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP3, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP1, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP2, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP3, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP1, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP2, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP3, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP2, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP3, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP2, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP3, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP1, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP2, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP3, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP1, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP2, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP3, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
-	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
-	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB2, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB3, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB1, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB2, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB3, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU1, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU2, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU3, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040f00},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU1, 0x00040f00},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU2, 0x00040f00},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU3, 0x00040f00},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05022022},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
-	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
-	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
-	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
-	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
-	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
-	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
-	{},
-};
-
-const struct adreno_reglist a640_hwcg[] = {
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05222022},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
-	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
-	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
-	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
-	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
-	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
-	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
-	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
-	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
-	{},
-};
-
-const struct adreno_reglist a650_hwcg[] = {
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
-	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
-	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
-	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
-	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000777},
-	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
-	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
-	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
-	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
-	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
-	{},
-};
-
-const struct adreno_reglist a660_hwcg[] = {
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
-	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
-	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
-	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
-	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
-	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
-	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
-	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
-	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
-	{},
-};
-
-const struct adreno_reglist a690_hwcg[] = {
-	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
-	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
-	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
-	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
-	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
-	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
-	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
-	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
-	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
-	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
-	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
-	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
-	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
-	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
-	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
-	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
-	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
-	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
-	{REG_A6XX_RBBM_CLOCK_CNTL, 0x8AA8AA82},
-	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
-	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
-	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
-	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
-	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
-	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
-	{REG_A6XX_GPU_GMU_AO_GMU_CGC_MODE_CNTL, 0x20200},
-	{REG_A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x10111},
-	{REG_A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x5555},
-	{}
-};
-
-const struct adreno_reglist a730_hwcg[] = {
-	{ REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02022222 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222220 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00222222 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777 },
-	{ REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
-	{ REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
-	{ REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x44000f00 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00555555 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00440044 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
-	{ REG_A7XX_RBBM_CLOCK_MODE2_GRAS, 0x00000222 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GRAS, 0x00222222 },
-	{ REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222223 },
-	{ REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GPC, 0x00222222 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_BV_VFD, 0x00002222 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222 },
-	{ REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_BV_LRZ, 0x55555552 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_CP, 0x00000223 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL, 0x8aa8aa82 },
-	{ REG_A6XX_RBBM_ISDB_CNT, 0x00000182 },
-	{ REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
-	{ REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
-	{},
-};
-
-const struct adreno_reglist a740_hwcg[] = {
-	{ REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x22022222 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x003cf3cf },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222220 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00222222 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777 },
-	{ REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
-	{ REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
-	{ REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x00222222 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000444 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x44000f00 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00555555 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00440044 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
-	{ REG_A7XX_RBBM_CLOCK_MODE2_GRAS, 0x00000222 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GRAS, 0x00222222 },
-	{ REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222223 },
-	{ REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00222222 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GPC, 0x00222222 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_BV_VFD, 0x00002222 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_BV_LRZ, 0x55555552 },
-	{ REG_A7XX_RBBM_CLOCK_HYST2_VFD, 0x00000000 },
-	{ REG_A7XX_RBBM_CLOCK_MODE_CP, 0x00000222 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL, 0x8aa8aa82 },
-	{ REG_A6XX_RBBM_ISDB_CNT, 0x00000182 },
-	{ REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
-	{ REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000 },
-	{ REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
-	{ REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
-	{ REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
-	{},
-};
-
 static void a6xx_set_hwcg(struct msm_gpu *gpu, bool state)
 {
 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
@@ -961,13 +413,15 @@
 	unsigned int i;
 	u32 val, clock_cntl_on, cgc_mode;
 
-	if (!adreno_gpu->info->hwcg)
+	if (!(adreno_gpu->info->a6xx->hwcg || adreno_is_a7xx(adreno_gpu)))
 		return;
 
 	if (adreno_is_a630(adreno_gpu))
 		clock_cntl_on = 0x8aa8aa02;
 	else if (adreno_is_a610(adreno_gpu))
 		clock_cntl_on = 0xaaa8aa82;
+	else if (adreno_is_a702(adreno_gpu))
+		clock_cntl_on = 0xaaaaaa82;
 	else
 		clock_cntl_on = 0x8aa8aa82;
 
@@ -982,6 +436,25 @@
 			  state ? 0x5555 : 0);
 	}
 
+	if (!adreno_gpu->info->a6xx->hwcg) {
+		gpu_write(gpu, REG_A7XX_RBBM_CLOCK_CNTL_GLOBAL, 1);
+		gpu_write(gpu, REG_A7XX_RBBM_CGC_GLOBAL_LOAD_CMD, state ? 1 : 0);
+
+		if (state) {
+			gpu_write(gpu, REG_A7XX_RBBM_CGC_P2S_TRIG_CMD, 1);
+
+			if (gpu_poll_timeout(gpu, REG_A7XX_RBBM_CGC_P2S_STATUS, val,
+					     val & A7XX_RBBM_CGC_P2S_STATUS_TXDONE, 1, 10)) {
+				dev_err(&gpu->pdev->dev, "RBBM_CGC_P2S_STATUS TXDONE Poll failed\n");
+				return;
+			}
+
+			gpu_write(gpu, REG_A7XX_RBBM_CLOCK_CNTL_GLOBAL, 0);
+		}
+
+		return;
+	}
+
 	val = gpu_read(gpu, REG_A6XX_RBBM_CLOCK_CNTL);
 
 	/* Don't re-program the registers if they are already correct */
@@ -989,267 +462,24 @@
 		return;
 
 	/* Disable SP clock before programming HWCG registers */
-	if (!adreno_is_a610(adreno_gpu) && !adreno_is_a7xx(adreno_gpu))
+	if (!adreno_is_a610_family(adreno_gpu) && !adreno_is_a7xx(adreno_gpu))
 		gmu_rmw(gmu, REG_A6XX_GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL, 1, 0);
 
-	for (i = 0; (reg = &adreno_gpu->info->hwcg[i], reg->offset); i++)
+	for (i = 0; (reg = &adreno_gpu->info->a6xx->hwcg[i], reg->offset); i++)
 		gpu_write(gpu, reg->offset, state ? reg->value : 0);
 
 	/* Enable SP clock */
-	if (!adreno_is_a610(adreno_gpu) && !adreno_is_a7xx(adreno_gpu))
+	if (!adreno_is_a610_family(adreno_gpu) && !adreno_is_a7xx(adreno_gpu))
 		gmu_rmw(gmu, REG_A6XX_GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL, 0, 1);
 
 	gpu_write(gpu, REG_A6XX_RBBM_CLOCK_CNTL, state ? clock_cntl_on : 0);
 }
 
-/* For a615, a616, a618, a619, a630, a640 and a680 */
-static const u32 a6xx_protect[] = {
-	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
-	A6XX_PROTECT_RDONLY(0x00501, 0x0005),
-	A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
-	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00800, 0x0082),
-	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
-	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
-	A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
-	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
-	A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
-	A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
-	A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
-	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
-	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
-	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
-	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
-	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
-	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
-	A6XX_PROTECT_NORDWR(0x09e70, 0x0001),
-	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
-	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
-	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
-	A6XX_PROTECT_NORDWR(0x0ae50, 0x032f),
-	A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
-	A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
-	A6XX_PROTECT_NORDWR(0x0be20, 0x17df),
-	A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
-	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x11c00, 0x0000), /* note: infinite range */
-};
-
-/* These are for a620 and a650 */
-static const u32 a650_protect[] = {
-	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
-	A6XX_PROTECT_RDONLY(0x00501, 0x0005),
-	A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
-	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00800, 0x0082),
-	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
-	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
-	A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
-	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
-	A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
-	A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
-	A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
-	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
-	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
-	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
-	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
-	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
-	A6XX_PROTECT_NORDWR(0x08e80, 0x027f),
-	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
-	A6XX_PROTECT_NORDWR(0x09e60, 0x0011),
-	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
-	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
-	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
-	A6XX_PROTECT_NORDWR(0x0ae50, 0x032f),
-	A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
-	A6XX_PROTECT_NORDWR(0x0b608, 0x0007),
-	A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
-	A6XX_PROTECT_NORDWR(0x0be20, 0x17df),
-	A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
-	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x18400, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x1a800, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
-	A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
-	A6XX_PROTECT_NORDWR(0x1f887, 0x001b),
-	A6XX_PROTECT_NORDWR(0x1f8c0, 0x0000), /* note: infinite range */
-};
-
-/* These are for a635 and a660 */
-static const u32 a660_protect[] = {
-	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
-	A6XX_PROTECT_RDONLY(0x00501, 0x0005),
-	A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
-	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00800, 0x0082),
-	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
-	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
-	A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
-	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
-	A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
-	A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
-	A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
-	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
-	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
-	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
-	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
-	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
-	A6XX_PROTECT_NORDWR(0x08e80, 0x027f),
-	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
-	A6XX_PROTECT_NORDWR(0x09e60, 0x0011),
-	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
-	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
-	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
-	A6XX_PROTECT_NORDWR(0x0ae50, 0x012f),
-	A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
-	A6XX_PROTECT_NORDWR(0x0b608, 0x0006),
-	A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
-	A6XX_PROTECT_NORDWR(0x0be20, 0x015f),
-	A6XX_PROTECT_NORDWR(0x0d000, 0x05ff),
-	A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
-	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x18400, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x1a400, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
-	A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
-	A6XX_PROTECT_NORDWR(0x1f860, 0x0000),
-	A6XX_PROTECT_NORDWR(0x1f887, 0x001b),
-	A6XX_PROTECT_NORDWR(0x1f8c0, 0x0000), /* note: infinite range */
-};
-
-/* These are for a690 */
-static const u32 a690_protect[] = {
-	A6XX_PROTECT_RDONLY(0x00000, 0x004ff),
-	A6XX_PROTECT_RDONLY(0x00501, 0x00001),
-	A6XX_PROTECT_RDONLY(0x0050b, 0x002f4),
-	A6XX_PROTECT_NORDWR(0x0050e, 0x00000),
-	A6XX_PROTECT_NORDWR(0x00510, 0x00000),
-	A6XX_PROTECT_NORDWR(0x00534, 0x00000),
-	A6XX_PROTECT_NORDWR(0x00800, 0x00082),
-	A6XX_PROTECT_NORDWR(0x008a0, 0x00008),
-	A6XX_PROTECT_NORDWR(0x008ab, 0x00024),
-	A6XX_PROTECT_RDONLY(0x008de, 0x000ae),
-	A6XX_PROTECT_NORDWR(0x00900, 0x0004d),
-	A6XX_PROTECT_NORDWR(0x0098d, 0x00272),
-	A6XX_PROTECT_NORDWR(0x00e00, 0x00001),
-	A6XX_PROTECT_NORDWR(0x00e03, 0x0000c),
-	A6XX_PROTECT_NORDWR(0x03c00, 0x000c3),
-	A6XX_PROTECT_RDONLY(0x03cc4, 0x01fff),
-	A6XX_PROTECT_NORDWR(0x08630, 0x001cf),
-	A6XX_PROTECT_NORDWR(0x08e00, 0x00000),
-	A6XX_PROTECT_NORDWR(0x08e08, 0x00007),
-	A6XX_PROTECT_NORDWR(0x08e50, 0x0001f),
-	A6XX_PROTECT_NORDWR(0x08e80, 0x0027f),
-	A6XX_PROTECT_NORDWR(0x09624, 0x001db),
-	A6XX_PROTECT_NORDWR(0x09e60, 0x00011),
-	A6XX_PROTECT_NORDWR(0x09e78, 0x00187),
-	A6XX_PROTECT_NORDWR(0x0a630, 0x001cf),
-	A6XX_PROTECT_NORDWR(0x0ae02, 0x00000),
-	A6XX_PROTECT_NORDWR(0x0ae50, 0x0012f),
-	A6XX_PROTECT_NORDWR(0x0b604, 0x00000),
-	A6XX_PROTECT_NORDWR(0x0b608, 0x00006),
-	A6XX_PROTECT_NORDWR(0x0be02, 0x00001),
-	A6XX_PROTECT_NORDWR(0x0be20, 0x0015f),
-	A6XX_PROTECT_NORDWR(0x0d000, 0x005ff),
-	A6XX_PROTECT_NORDWR(0x0f000, 0x00bff),
-	A6XX_PROTECT_RDONLY(0x0fc00, 0x01fff),
-	A6XX_PROTECT_NORDWR(0x11c00, 0x00000), /*note: infiite range */
-};
-
-static const u32 a730_protect[] = {
-	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
-	A6XX_PROTECT_RDONLY(0x0050b, 0x0058),
-	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
-	A6XX_PROTECT_RDONLY(0x005fb, 0x009d),
-	A6XX_PROTECT_NORDWR(0x00699, 0x01e9),
-	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
-	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
-	/* 0x008d0-0x008dd are unprotected on purpose for tools like perfetto */
-	A6XX_PROTECT_RDONLY(0x008de, 0x0154),
-	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
-	A6XX_PROTECT_NORDWR(0x0098d, 0x00b2),
-	A6XX_PROTECT_NORDWR(0x00a41, 0x01be),
-	A6XX_PROTECT_NORDWR(0x00df0, 0x0001),
-	A6XX_PROTECT_NORDWR(0x00e01, 0x0000),
-	A6XX_PROTECT_NORDWR(0x00e07, 0x0008),
-	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
-	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
-	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
-	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
-	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
-	A6XX_PROTECT_NORDWR(0x08e80, 0x0280),
-	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
-	A6XX_PROTECT_NORDWR(0x09e40, 0x0000),
-	A6XX_PROTECT_NORDWR(0x09e64, 0x000d),
-	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
-	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
-	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
-	A6XX_PROTECT_NORDWR(0x0ae50, 0x000f),
-	A6XX_PROTECT_NORDWR(0x0ae66, 0x0003),
-	A6XX_PROTECT_NORDWR(0x0ae6f, 0x0003),
-	A6XX_PROTECT_NORDWR(0x0b604, 0x0003),
-	A6XX_PROTECT_NORDWR(0x0ec00, 0x0fff),
-	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x18400, 0x0053),
-	A6XX_PROTECT_RDONLY(0x18454, 0x0004),
-	A6XX_PROTECT_NORDWR(0x18459, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x1a459, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x1c459, 0x1fff),
-	A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
-	A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
-	A6XX_PROTECT_NORDWR(0x1f860, 0x0000),
-	A6XX_PROTECT_NORDWR(0x1f878, 0x002a),
-	/* CP_PROTECT_REG[44, 46] are left untouched! */
-	0,
-	0,
-	0,
-	A6XX_PROTECT_NORDWR(0x1f8c0, 0x00000),
-};
-
 static void a6xx_set_cp_protect(struct msm_gpu *gpu)
 {
 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
-	const u32 *regs = a6xx_protect;
-	unsigned i, count, count_max;
-
-	if (adreno_is_a650(adreno_gpu)) {
-		regs = a650_protect;
-		count = ARRAY_SIZE(a650_protect);
-		count_max = 48;
-		BUILD_BUG_ON(ARRAY_SIZE(a650_protect) > 48);
-	} else if (adreno_is_a690(adreno_gpu)) {
-		regs = a690_protect;
-		count = ARRAY_SIZE(a690_protect);
-		count_max = 48;
-		BUILD_BUG_ON(ARRAY_SIZE(a690_protect) > 48);
-	} else if (adreno_is_a660_family(adreno_gpu)) {
-		regs = a660_protect;
-		count = ARRAY_SIZE(a660_protect);
-		count_max = 48;
-		BUILD_BUG_ON(ARRAY_SIZE(a660_protect) > 48);
-	} else if (adreno_is_a730(adreno_gpu) || adreno_is_a740(adreno_gpu)) {
-		regs = a730_protect;
-		count = ARRAY_SIZE(a730_protect);
-		count_max = 48;
-		BUILD_BUG_ON(ARRAY_SIZE(a730_protect) > 48);
-	} else {
-		regs = a6xx_protect;
-		count = ARRAY_SIZE(a6xx_protect);
-		count_max = 32;
-		BUILD_BUG_ON(ARRAY_SIZE(a6xx_protect) > 32);
-	}
+	const struct adreno_protect *protect = adreno_gpu->info->a6xx->protect;
+	unsigned i;
 
 	/*
 	 * Enable access protection to privileged registers, fault on an access
@@ -1261,40 +491,36 @@
 		  A6XX_CP_PROTECT_CNTL_ACCESS_FAULT_ON_VIOL_EN |
 		  A6XX_CP_PROTECT_CNTL_LAST_SPAN_INF_RANGE);
 
-	for (i = 0; i < count - 1; i++) {
+	for (i = 0; i < protect->count - 1; i++) {
 		/* Intentionally skip writing to some registers */
-		if (regs[i])
-			gpu_write(gpu, REG_A6XX_CP_PROTECT(i), regs[i]);
+		if (protect->regs[i])
+			gpu_write(gpu, REG_A6XX_CP_PROTECT(i), protect->regs[i]);
 	}
 	/* last CP_PROTECT to have "infinite" length on the last entry */
-	gpu_write(gpu, REG_A6XX_CP_PROTECT(count_max - 1), regs[i]);
+	gpu_write(gpu, REG_A6XX_CP_PROTECT(protect->count_max - 1), protect->regs[i]);
 }
 
 static void a6xx_calc_ubwc_config(struct adreno_gpu *gpu)
 {
-	/* Unknown, introduced with A650 family, related to UBWC mode/ver 4 */
 	gpu->ubwc_config.rgb565_predicator = 0;
-	/* Unknown, introduced with A650 family */
 	gpu->ubwc_config.uavflagprd_inv = 0;
-	/* Whether the minimum access length is 64 bits */
 	gpu->ubwc_config.min_acc_len = 0;
-	/* Entirely magic, per-GPU-gen value */
-	gpu->ubwc_config.ubwc_mode = 0;
-	/*
-	 * The Highest Bank Bit value represents the bit of the highest DDR bank.
-	 * This should ideally use DRAM type detection.
-	 */
+	gpu->ubwc_config.ubwc_swizzle = 0x6;
+	gpu->ubwc_config.macrotile_mode = 0;
 	gpu->ubwc_config.highest_bank_bit = 15;
 
 	if (adreno_is_a610(gpu)) {
 		gpu->ubwc_config.highest_bank_bit = 13;
 		gpu->ubwc_config.min_acc_len = 1;
-		gpu->ubwc_config.ubwc_mode = 1;
+		gpu->ubwc_config.ubwc_swizzle = 0x7;
 	}
 
-	/* a618 is using the hw default values */
 	if (adreno_is_a618(gpu))
-		return;
+		gpu->ubwc_config.highest_bank_bit = 14;
+
+	if (adreno_is_a619(gpu))
+		/* TODO: Should be 14 but causes corruption at e.g. 1920x1200 on DP */
+		gpu->ubwc_config.highest_bank_bit = 13;
 
 	if (adreno_is_a619_holi(gpu))
 		gpu->ubwc_config.highest_bank_bit = 13;
@@ -1312,6 +538,16 @@
 		gpu->ubwc_config.amsbc = 1;
 		gpu->ubwc_config.rgb565_predicator = 1;
 		gpu->ubwc_config.uavflagprd_inv = 2;
+		gpu->ubwc_config.macrotile_mode = 1;
+	}
+
+	if (adreno_is_a663(gpu)) {
+		gpu->ubwc_config.highest_bank_bit = 13;
+		gpu->ubwc_config.amsbc = 1;
+		gpu->ubwc_config.rgb565_predicator = 1;
+		gpu->ubwc_config.uavflagprd_inv = 2;
+		gpu->ubwc_config.macrotile_mode = 1;
+		gpu->ubwc_config.ubwc_swizzle = 0x4;
 	}
 
 	if (adreno_is_7c3(gpu)) {
@@ -1319,6 +555,12 @@
 		gpu->ubwc_config.amsbc = 1;
 		gpu->ubwc_config.rgb565_predicator = 1;
 		gpu->ubwc_config.uavflagprd_inv = 2;
+		gpu->ubwc_config.macrotile_mode = 1;
+	}
+
+	if (adreno_is_a702(gpu)) {
+		gpu->ubwc_config.highest_bank_bit = 14;
+		gpu->ubwc_config.min_acc_len = 1;
 	}
 }
 
@@ -1334,21 +576,26 @@
 	u32 hbb = adreno_gpu->ubwc_config.highest_bank_bit - 13;
 	u32 hbb_hi = hbb >> 2;
 	u32 hbb_lo = hbb & 3;
+	u32 ubwc_mode = adreno_gpu->ubwc_config.ubwc_swizzle & 1;
+	u32 level2_swizzling_dis = !(adreno_gpu->ubwc_config.ubwc_swizzle & 2);
 
 	gpu_write(gpu, REG_A6XX_RB_NC_MODE_CNTL,
+		  level2_swizzling_dis << 12 |
 		  adreno_gpu->ubwc_config.rgb565_predicator << 11 |
 		  hbb_hi << 10 | adreno_gpu->ubwc_config.amsbc << 4 |
 		  adreno_gpu->ubwc_config.min_acc_len << 3 |
-		  hbb_lo << 1 | adreno_gpu->ubwc_config.ubwc_mode);
+		  hbb_lo << 1 | ubwc_mode);
 
-	gpu_write(gpu, REG_A6XX_TPL1_NC_MODE_CNTL, hbb_hi << 4 |
+	gpu_write(gpu, REG_A6XX_TPL1_NC_MODE_CNTL,
+		  level2_swizzling_dis << 6 | hbb_hi << 4 |
 		  adreno_gpu->ubwc_config.min_acc_len << 3 |
-		  hbb_lo << 1 | adreno_gpu->ubwc_config.ubwc_mode);
+		  hbb_lo << 1 | ubwc_mode);
 
-	gpu_write(gpu, REG_A6XX_SP_NC_MODE_CNTL, hbb_hi << 10 |
+	gpu_write(gpu, REG_A6XX_SP_NC_MODE_CNTL,
+		  level2_swizzling_dis << 12 | hbb_hi << 10 |
 		  adreno_gpu->ubwc_config.uavflagprd_inv << 4 |
 		  adreno_gpu->ubwc_config.min_acc_len << 3 |
-		  hbb_lo << 1 | adreno_gpu->ubwc_config.ubwc_mode);
+		  hbb_lo << 1 | ubwc_mode);
 
 	if (adreno_is_a7xx(adreno_gpu))
 		gpu_write(gpu, REG_A7XX_GRAS_NC_MODE_CNTL,
@@ -1356,6 +603,9 @@
 
 	gpu_write(gpu, REG_A6XX_UCHE_MODE_CNTL,
 		  adreno_gpu->ubwc_config.min_acc_len << 23 | hbb_lo << 21);
+
+	gpu_write(gpu, REG_A6XX_RBBM_NC_MODE_CNTL,
+		  adreno_gpu->ubwc_config.macrotile_mode);
 }
 
 static int a6xx_cp_init(struct msm_gpu *gpu)
@@ -1453,7 +703,7 @@
 		return false;
 
 	/* A7xx is safe! */
-	if (adreno_is_a7xx(adreno_gpu))
+	if (adreno_is_a7xx(adreno_gpu) || adreno_is_a702(adreno_gpu))
 		return true;
 
 	/*
@@ -1671,7 +921,7 @@
 	a6xx_set_hwcg(gpu, true);
 
 	/* VBIF/GBIF start*/
-	if (adreno_is_a610(adreno_gpu) ||
+	if (adreno_is_a610_family(adreno_gpu) ||
 	    adreno_is_a640_family(adreno_gpu) ||
 	    adreno_is_a650_family(adreno_gpu) ||
 	    adreno_is_a7xx(adreno_gpu)) {
@@ -1705,6 +955,7 @@
 	}
 
 	if (!(adreno_is_a650_family(adreno_gpu) ||
+	      adreno_is_a702(adreno_gpu) ||
 	      adreno_is_a730(adreno_gpu))) {
 		gmem_range_min = adreno_is_a740_family(adreno_gpu) ? SZ_16M : SZ_1M;
 
@@ -1725,7 +976,7 @@
 	if (adreno_is_a640_family(adreno_gpu) || adreno_is_a650_family(adreno_gpu)) {
 		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_2, 0x02000140);
 		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_1, 0x8040362c);
-	} else if (adreno_is_a610(adreno_gpu)) {
+	} else if (adreno_is_a610_family(adreno_gpu)) {
 		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_2, 0x00800060);
 		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_1, 0x40201b16);
 	} else if (!adreno_is_a7xx(adreno_gpu)) {
@@ -1740,26 +991,17 @@
 	if (adreno_is_a610(adreno_gpu)) {
 		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_SIZE, 48);
 		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_DBG_ADDR, 47);
+	} else if (adreno_is_a702(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_SIZE, 64);
+		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_DBG_ADDR, 63);
 	} else if (!adreno_is_a7xx(adreno_gpu))
 		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_SIZE, 128);
 
-	/* Setting the primFifo thresholds default values,
-	 * and vccCacheSkipDis=1 bit (0x200) for A640 and newer
-	*/
-	if (adreno_is_a690(adreno_gpu))
-		gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00800200);
-	else if (adreno_is_a650(adreno_gpu) || adreno_is_a660(adreno_gpu))
-		gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00300200);
-	else if (adreno_is_a640_family(adreno_gpu) || adreno_is_7c3(adreno_gpu))
-		gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00200200);
-	else if (adreno_is_a650(adreno_gpu) || adreno_is_a660(adreno_gpu))
-		gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00300200);
-	else if (adreno_is_a619(adreno_gpu))
-		gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00018000);
-	else if (adreno_is_a610(adreno_gpu))
-		gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00080000);
-	else if (!adreno_is_a7xx(adreno_gpu))
-		gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL, 0x00180000);
+
+	/* Set the default primFifo threshold values */
+	if (adreno_gpu->info->a6xx->prim_fifo_threshold)
+		gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL,
+			  adreno_gpu->info->a6xx->prim_fifo_threshold);
 
 	/* Set the AHB default slave response to "ERROR" */
 	gpu_write(gpu, REG_A6XX_CP_AHB_CNTL, 0x1);
@@ -1786,7 +1028,7 @@
 		gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x4fffff);
 	else if (adreno_is_a619(adreno_gpu))
 		gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x3fffff);
-	else if (adreno_is_a610(adreno_gpu))
+	else if (adreno_is_a610(adreno_gpu) || adreno_is_a702(adreno_gpu))
 		gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x3ffff);
 	else
 		gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x1fffff);
@@ -1794,7 +1036,7 @@
 	gpu_write(gpu, REG_A6XX_UCHE_CLIENT_PF, BIT(7) | 0x1);
 
 	/* Set weights for bicubic filtering */
-	if (adreno_is_a650_family(adreno_gpu)) {
+	if (adreno_is_a650_family(adreno_gpu) || adreno_is_x185(adreno_gpu)) {
 		gpu_write(gpu, REG_A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_0, 0);
 		gpu_write(gpu, REG_A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_1,
 			0x3fe05ff4);
@@ -1822,12 +1064,15 @@
 		else
 			gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, 0x1);
 		gpu_write(gpu, REG_A6XX_RBBM_GBIF_CLIENT_QOS_CNTL, 0x0);
+	} else if (adreno_is_a702(adreno_gpu)) {
+		/* Something to do with the HLSQ cluster */
+		gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, BIT(24));
 	}
 
 	if (adreno_is_a690(adreno_gpu))
 		gpu_write(gpu, REG_A6XX_UCHE_CMDQ_CONFIG, 0x90);
 	/* Set dualQ + disable afull for A660 GPU */
-	else if (adreno_is_a660(adreno_gpu))
+	else if (adreno_is_a660(adreno_gpu) || adreno_is_a663(adreno_gpu))
 		gpu_write(gpu, REG_A6XX_UCHE_CMDQ_CONFIG, 0x66906);
 	else if (adreno_is_a7xx(adreno_gpu))
 		gpu_write(gpu, REG_A6XX_UCHE_CMDQ_CONFIG,
@@ -2427,7 +1672,7 @@
 
 	msm_devfreq_resume(gpu);
 
-	adreno_is_a7xx(adreno_gpu) ? a7xx_llc_activate : a6xx_llc_activate(a6xx_gpu);
+	adreno_is_a7xx(adreno_gpu) ? a7xx_llc_activate(a6xx_gpu) : a6xx_llc_activate(a6xx_gpu);
 
 	return ret;
 }
@@ -2880,13 +2125,15 @@
 
 	/* gpu->info only gets assigned in adreno_gpu_init() */
 	is_a7xx = config->info->family == ADRENO_7XX_GEN1 ||
-		  config->info->family == ADRENO_7XX_GEN2;
+		  config->info->family == ADRENO_7XX_GEN2 ||
+		  config->info->family == ADRENO_7XX_GEN3;
 
 	a6xx_llc_slices_init(pdev, a6xx_gpu, is_a7xx);
 
 	ret = a6xx_set_supported_hw(&pdev->dev, config->info);
 	if (ret) {
-		a6xx_destroy(&(a6xx_gpu->base.base));
+		a6xx_llc_slices_destroy(a6xx_gpu);
+		kfree(a6xx_gpu);
 		return ERR_PTR(ret);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
@@ -12,6 +12,20 @@
 
 extern bool hang_debug;
 
+/**
+ * struct a6xx_info - a6xx specific information from device table
+ *
+ * @hwcg: hw clock gating register sequence
+ * @protect: CP_PROTECT settings
+ */
+struct a6xx_info {
+	const struct adreno_reglist *hwcg;
+	const struct adreno_protect *protect;
+	u32 gmu_chipid;
+	u32 gmu_cgc_mode;
+	u32 prim_fifo_threshold;
+};
+
 struct a6xx_gpu {
 	struct adreno_gpu base;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/a6xx_hfi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/a6xx_hfi.c
@@ -478,6 +478,37 @@
 	msg->cnoc_cmds_data[1][0] =  0x60000001;
 }
 
+static void a663_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	/*
+	 * Send a single "off" entry just to get things running
+	 * TODO: bus scaling
+	 */
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x07;
+
+	msg->ddr_cmds_addrs[0] = 0x50004;
+	msg->ddr_cmds_addrs[1] = 0x50000;
+	msg->ddr_cmds_addrs[2] = 0x500b4;
+
+	msg->ddr_cmds_data[0][0] =  0x40000000;
+	msg->ddr_cmds_data[0][1] =  0x40000000;
+	msg->ddr_cmds_data[0][2] =  0x40000000;
+
+	/*
+	 * These are the CX (CNOC) votes - these are used by the GMU but the
+	 * votes are known and fixed for the target
+	 */
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x01;
+
+	msg->cnoc_cmds_addrs[0] = 0x50058;
+	msg->cnoc_cmds_data[0][0] =  0x40000000;
+	msg->cnoc_cmds_data[1][0] =  0x60000001;
+}
+
 static void adreno_7c3_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
 {
 	/*
@@ -646,6 +677,8 @@
 		adreno_7c3_build_bw_table(&msg);
 	else if (adreno_is_a660(adreno_gpu))
 		a660_build_bw_table(&msg);
+	else if (adreno_is_a663(adreno_gpu))
+		a663_build_bw_table(&msg);
 	else if (adreno_is_a690(adreno_gpu))
 		a690_build_bw_table(&msg);
 	else if (adreno_is_a730(adreno_gpu))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/adreno_device.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/adreno_device.c
@@ -20,549 +20,36 @@
 MODULE_PARM_DESC(allow_vram_carveout, "Allow using VRAM Carveout, in place of IOMMU");
 module_param_named(allow_vram_carveout, allow_vram_carveout, bool, 0600);
 
-static const struct adreno_info gpulist[] = {
-	{
-		.chip_ids = ADRENO_CHIP_IDS(0x02000000),
-		.family = ADRENO_2XX_GEN1,
-		.revn  = 200,
-		.fw = {
-			[ADRENO_FW_PM4] = "yamato_pm4.fw",
-			[ADRENO_FW_PFP] = "yamato_pfp.fw",
-		},
-		.gmem  = SZ_256K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a2xx_gpu_init,
-	}, { /* a200 on i.mx51 has only 128kib gmem */
-		.chip_ids = ADRENO_CHIP_IDS(0x02000001),
-		.family = ADRENO_2XX_GEN1,
-		.revn  = 201,
-		.fw = {
-			[ADRENO_FW_PM4] = "yamato_pm4.fw",
-			[ADRENO_FW_PFP] = "yamato_pfp.fw",
-		},
-		.gmem  = SZ_128K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a2xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x02020000),
-		.family = ADRENO_2XX_GEN2,
-		.revn  = 220,
-		.fw = {
-			[ADRENO_FW_PM4] = "leia_pm4_470.fw",
-			[ADRENO_FW_PFP] = "leia_pfp_470.fw",
-		},
-		.gmem  = SZ_512K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a2xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(
-			0x03000512,
-			0x03000520
-		),
-		.family = ADRENO_3XX,
-		.revn  = 305,
-		.fw = {
-			[ADRENO_FW_PM4] = "a300_pm4.fw",
-			[ADRENO_FW_PFP] = "a300_pfp.fw",
-		},
-		.gmem  = SZ_256K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a3xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x03000600),
-		.family = ADRENO_3XX,
-		.revn  = 307,        /* because a305c is revn==306 */
-		.fw = {
-			[ADRENO_FW_PM4] = "a300_pm4.fw",
-			[ADRENO_FW_PFP] = "a300_pfp.fw",
-		},
-		.gmem  = SZ_128K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a3xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(
-			0x03020000,
-			0x03020001,
-			0x03020002
-		),
-		.family = ADRENO_3XX,
-		.revn  = 320,
-		.fw = {
-			[ADRENO_FW_PM4] = "a300_pm4.fw",
-			[ADRENO_FW_PFP] = "a300_pfp.fw",
-		},
-		.gmem  = SZ_512K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a3xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(
-			0x03030000,
-			0x03030001,
-			0x03030002
-		),
-		.family = ADRENO_3XX,
-		.revn  = 330,
-		.fw = {
-			[ADRENO_FW_PM4] = "a330_pm4.fw",
-			[ADRENO_FW_PFP] = "a330_pfp.fw",
-		},
-		.gmem  = SZ_1M,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a3xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x04000500),
-		.family = ADRENO_4XX,
-		.revn  = 405,
-		.fw = {
-			[ADRENO_FW_PM4] = "a420_pm4.fw",
-			[ADRENO_FW_PFP] = "a420_pfp.fw",
-		},
-		.gmem  = SZ_256K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a4xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x04020000),
-		.family = ADRENO_4XX,
-		.revn  = 420,
-		.fw = {
-			[ADRENO_FW_PM4] = "a420_pm4.fw",
-			[ADRENO_FW_PFP] = "a420_pfp.fw",
-		},
-		.gmem  = (SZ_1M + SZ_512K),
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a4xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x04030002),
-		.family = ADRENO_4XX,
-		.revn  = 430,
-		.fw = {
-			[ADRENO_FW_PM4] = "a420_pm4.fw",
-			[ADRENO_FW_PFP] = "a420_pfp.fw",
-		},
-		.gmem  = (SZ_1M + SZ_512K),
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init  = a4xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x05000600),
-		.family = ADRENO_5XX,
-		.revn = 506,
-		.fw = {
-			[ADRENO_FW_PM4] = "a530_pm4.fw",
-			[ADRENO_FW_PFP] = "a530_pfp.fw",
-		},
-		.gmem = (SZ_128K + SZ_8K),
-		/*
-		 * Increase inactive period to 250 to avoid bouncing
-		 * the GDSC which appears to make it grumpy
-		 */
-		.inactive_period = 250,
-		.quirks = ADRENO_QUIRK_TWO_PASS_USE_WFI |
-			  ADRENO_QUIRK_LMLOADKILL_DISABLE,
-		.init = a5xx_gpu_init,
-		.zapfw = "a506_zap.mdt",
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x05000800),
-		.family = ADRENO_5XX,
-		.revn = 508,
-		.fw = {
-			[ADRENO_FW_PM4] = "a530_pm4.fw",
-			[ADRENO_FW_PFP] = "a530_pfp.fw",
-		},
-		.gmem = (SZ_128K + SZ_8K),
-		/*
-		 * Increase inactive period to 250 to avoid bouncing
-		 * the GDSC which appears to make it grumpy
-		 */
-		.inactive_period = 250,
-		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
-		.init = a5xx_gpu_init,
-		.zapfw = "a508_zap.mdt",
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x05000900),
-		.family = ADRENO_5XX,
-		.revn = 509,
-		.fw = {
-			[ADRENO_FW_PM4] = "a530_pm4.fw",
-			[ADRENO_FW_PFP] = "a530_pfp.fw",
-		},
-		.gmem = (SZ_256K + SZ_16K),
-		/*
-		 * Increase inactive period to 250 to avoid bouncing
-		 * the GDSC which appears to make it grumpy
-		 */
-		.inactive_period = 250,
-		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
-		.init = a5xx_gpu_init,
-		/* Adreno 509 uses the same ZAP as 512 */
-		.zapfw = "a512_zap.mdt",
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x05010000),
-		.family = ADRENO_5XX,
-		.revn = 510,
-		.fw = {
-			[ADRENO_FW_PM4] = "a530_pm4.fw",
-			[ADRENO_FW_PFP] = "a530_pfp.fw",
-		},
-		.gmem = SZ_256K,
-		/*
-		 * Increase inactive period to 250 to avoid bouncing
-		 * the GDSC which appears to make it grumpy
-		 */
-		.inactive_period = 250,
-		.init = a5xx_gpu_init,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x05010200),
-		.family = ADRENO_5XX,
-		.revn = 512,
-		.fw = {
-			[ADRENO_FW_PM4] = "a530_pm4.fw",
-			[ADRENO_FW_PFP] = "a530_pfp.fw",
-		},
-		.gmem = (SZ_256K + SZ_16K),
-		/*
-		 * Increase inactive period to 250 to avoid bouncing
-		 * the GDSC which appears to make it grumpy
-		 */
-		.inactive_period = 250,
-		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
-		.init = a5xx_gpu_init,
-		.zapfw = "a512_zap.mdt",
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(
-			0x05030002,
-			0x05030004
-		),
-		.family = ADRENO_5XX,
-		.revn = 530,
-		.fw = {
-			[ADRENO_FW_PM4] = "a530_pm4.fw",
-			[ADRENO_FW_PFP] = "a530_pfp.fw",
-			[ADRENO_FW_GPMU] = "a530v3_gpmu.fw2",
-		},
-		.gmem = SZ_1M,
-		/*
-		 * Increase inactive period to 250 to avoid bouncing
-		 * the GDSC which appears to make it grumpy
-		 */
-		.inactive_period = 250,
-		.quirks = ADRENO_QUIRK_TWO_PASS_USE_WFI |
-			ADRENO_QUIRK_FAULT_DETECT_MASK,
-		.init = a5xx_gpu_init,
-		.zapfw = "a530_zap.mdt",
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x05040001),
-		.family = ADRENO_5XX,
-		.revn = 540,
-		.fw = {
-			[ADRENO_FW_PM4] = "a530_pm4.fw",
-			[ADRENO_FW_PFP] = "a530_pfp.fw",
-			[ADRENO_FW_GPMU] = "a540_gpmu.fw2",
-		},
-		.gmem = SZ_1M,
-		/*
-		 * Increase inactive period to 250 to avoid bouncing
-		 * the GDSC which appears to make it grumpy
-		 */
-		.inactive_period = 250,
-		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
-		.init = a5xx_gpu_init,
-		.zapfw = "a540_zap.mdt",
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x06010000),
-		.family = ADRENO_6XX_GEN1,
-		.revn = 610,
-		.fw = {
-			[ADRENO_FW_SQE] = "a630_sqe.fw",
-		},
-		.gmem = (SZ_128K + SZ_4K),
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init = a6xx_gpu_init,
-		.zapfw = "a610_zap.mdt",
-		.hwcg = a612_hwcg,
-		/*
-		 * There are (at least) three SoCs implementing A610: SM6125
-		 * (trinket), SM6115 (bengal) and SM6225 (khaje). Trinket does
-		 * not have speedbinning, as only a single SKU exists and we
-		 * don't support khaje upstream yet.  Hence, this matching
-		 * table is only valid for bengal.
-		 */
-		.speedbins = ADRENO_SPEEDBINS(
-			{ 0,   0 },
-			{ 206, 1 },
-			{ 200, 2 },
-			{ 157, 3 },
-			{ 127, 4 },
-		),
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x06010800),
-		.family = ADRENO_6XX_GEN1,
-		.revn = 618,
-		.fw = {
-			[ADRENO_FW_SQE] = "a630_sqe.fw",
-			[ADRENO_FW_GMU] = "a630_gmu.bin",
-		},
-		.gmem = SZ_512K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
-		.init = a6xx_gpu_init,
-		.speedbins = ADRENO_SPEEDBINS(
-			{ 0,   0 },
-			{ 169, 1 },
-			{ 174, 2 },
-		),
-	}, {
-		.machine = "qcom,sm4350",
-		.chip_ids = ADRENO_CHIP_IDS(0x06010900),
-		.family = ADRENO_6XX_GEN1,
-		.revn = 619,
-		.fw = {
-			[ADRENO_FW_SQE] = "a630_sqe.fw",
-			[ADRENO_FW_GMU] = "a619_gmu.bin",
-		},
-		.gmem = SZ_512K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init = a6xx_gpu_init,
-		.zapfw = "a615_zap.mdt",
-		.hwcg = a615_hwcg,
-		.speedbins = ADRENO_SPEEDBINS(
-			{ 0,   0 },
-			{ 138, 1 },
-			{ 92,  2 },
-		),
-	}, {
-		.machine = "qcom,sm6375",
-		.chip_ids = ADRENO_CHIP_IDS(0x06010901),
-		.family = ADRENO_6XX_GEN1,
-		.revn = 619,
-		.fw = {
-			[ADRENO_FW_SQE] = "a630_sqe.fw",
-			[ADRENO_FW_GMU] = "a619_gmu.bin",
-		},
-		.gmem = SZ_512K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.init = a6xx_gpu_init,
-		.zapfw = "a615_zap.mdt",
-		.hwcg = a615_hwcg,
-		.speedbins = ADRENO_SPEEDBINS(
-			{ 0,   0 },
-			{ 190, 1 },
-			{ 177, 2 },
-		),
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x06010900),
-		.family = ADRENO_6XX_GEN1,
-		.revn = 619,
-		.fw = {
-			[ADRENO_FW_SQE] = "a630_sqe.fw",
-			[ADRENO_FW_GMU] = "a619_gmu.bin",
-		},
-		.gmem = SZ_512K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
-		.init = a6xx_gpu_init,
-		.zapfw = "a615_zap.mdt",
-		.hwcg = a615_hwcg,
-		.speedbins = ADRENO_SPEEDBINS(
-			{ 0,   0 },
-			{ 120, 4 },
-			{ 138, 3 },
-			{ 169, 2 },
-			{ 180, 1 },
-		),
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(
-			0x06030001,
-			0x06030002
-		),
-		.family = ADRENO_6XX_GEN1,
-		.revn = 630,
-		.fw = {
-			[ADRENO_FW_SQE] = "a630_sqe.fw",
-			[ADRENO_FW_GMU] = "a630_gmu.bin",
-		},
-		.gmem = SZ_1M,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
-		.init = a6xx_gpu_init,
-		.zapfw = "a630_zap.mdt",
-		.hwcg = a630_hwcg,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x06040001),
-		.family = ADRENO_6XX_GEN2,
-		.revn = 640,
-		.fw = {
-			[ADRENO_FW_SQE] = "a630_sqe.fw",
-			[ADRENO_FW_GMU] = "a640_gmu.bin",
-		},
-		.gmem = SZ_1M,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
-		.init = a6xx_gpu_init,
-		.zapfw = "a640_zap.mdt",
-		.hwcg = a640_hwcg,
-		.speedbins = ADRENO_SPEEDBINS(
-			{ 0, 0 },
-			{ 1, 1 },
-		),
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x06050002),
-		.family = ADRENO_6XX_GEN3,
-		.revn = 650,
-		.fw = {
-			[ADRENO_FW_SQE] = "a650_sqe.fw",
-			[ADRENO_FW_GMU] = "a650_gmu.bin",
-		},
-		.gmem = SZ_1M + SZ_128K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
-			ADRENO_QUIRK_HAS_HW_APRIV,
-		.init = a6xx_gpu_init,
-		.zapfw = "a650_zap.mdt",
-		.hwcg = a650_hwcg,
-		.address_space_size = SZ_16G,
-		.speedbins = ADRENO_SPEEDBINS(
-			{ 0, 0 },
-			{ 1, 1 },
-			{ 2, 3 }, /* Yep, 2 and 3 are swapped! :/ */
-			{ 3, 2 },
-		),
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x06060001),
-		.family = ADRENO_6XX_GEN4,
-		.revn = 660,
-		.fw = {
-			[ADRENO_FW_SQE] = "a660_sqe.fw",
-			[ADRENO_FW_GMU] = "a660_gmu.bin",
-		},
-		.gmem = SZ_1M + SZ_512K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
-			ADRENO_QUIRK_HAS_HW_APRIV,
-		.init = a6xx_gpu_init,
-		.zapfw = "a660_zap.mdt",
-		.hwcg = a660_hwcg,
-		.address_space_size = SZ_16G,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x06030500),
-		.family = ADRENO_6XX_GEN4,
-		.fw = {
-			[ADRENO_FW_SQE] = "a660_sqe.fw",
-			[ADRENO_FW_GMU] = "a660_gmu.bin",
-		},
-		.gmem = SZ_512K,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
-			ADRENO_QUIRK_HAS_HW_APRIV,
-		.init = a6xx_gpu_init,
-		.zapfw = "a660_zap.mbn",
-		.hwcg = a660_hwcg,
-		.address_space_size = SZ_16G,
-		.speedbins = ADRENO_SPEEDBINS(
-			{ 0,   0 },
-			{ 117, 0 },
-			{ 172, 2 }, /* Called speedbin 1 downstream, but let's not break things! */
-			{ 190, 1 },
-		),
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x06080001),
-		.family = ADRENO_6XX_GEN2,
-		.revn = 680,
-		.fw = {
-			[ADRENO_FW_SQE] = "a630_sqe.fw",
-			[ADRENO_FW_GMU] = "a640_gmu.bin",
-		},
-		.gmem = SZ_2M,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
-		.init = a6xx_gpu_init,
-		.zapfw = "a640_zap.mdt",
-		.hwcg = a640_hwcg,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x06090000),
-		.family = ADRENO_6XX_GEN4,
-		.fw = {
-			[ADRENO_FW_SQE] = "a660_sqe.fw",
-			[ADRENO_FW_GMU] = "a660_gmu.bin",
-		},
-		.gmem = SZ_4M,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
-			ADRENO_QUIRK_HAS_HW_APRIV,
-		.init = a6xx_gpu_init,
-		.zapfw = "a690_zap.mdt",
-		.hwcg = a690_hwcg,
-		.address_space_size = SZ_16G,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x07030001),
-		.family = ADRENO_7XX_GEN1,
-		.fw = {
-			[ADRENO_FW_SQE] = "a730_sqe.fw",
-			[ADRENO_FW_GMU] = "gmu_gen70000.bin",
-		},
-		.gmem = SZ_2M,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
-			  ADRENO_QUIRK_HAS_HW_APRIV,
-		.init = a6xx_gpu_init,
-		.zapfw = "a730_zap.mdt",
-		.hwcg = a730_hwcg,
-		.address_space_size = SZ_16G,
-	}, {
-		.chip_ids = ADRENO_CHIP_IDS(0x43050a01), /* "C510v2" */
-		.family = ADRENO_7XX_GEN2,
-		.fw = {
-			[ADRENO_FW_SQE] = "a740_sqe.fw",
-			[ADRENO_FW_GMU] = "gmu_gen70200.bin",
-		},
-		.gmem = 3 * SZ_1M,
-		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
-		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
-			  ADRENO_QUIRK_HAS_HW_APRIV,
-		.init = a6xx_gpu_init,
-		.zapfw = "a740_zap.mdt",
-		.hwcg = a740_hwcg,
-		.address_space_size = SZ_16G,
-	},
-};
+extern const struct adreno_gpulist a2xx_gpulist;
+extern const struct adreno_gpulist a3xx_gpulist;
+extern const struct adreno_gpulist a4xx_gpulist;
+extern const struct adreno_gpulist a5xx_gpulist;
+extern const struct adreno_gpulist a6xx_gpulist;
+extern const struct adreno_gpulist a7xx_gpulist;
 
-MODULE_FIRMWARE("qcom/a300_pm4.fw");
-MODULE_FIRMWARE("qcom/a300_pfp.fw");
-MODULE_FIRMWARE("qcom/a330_pm4.fw");
-MODULE_FIRMWARE("qcom/a330_pfp.fw");
-MODULE_FIRMWARE("qcom/a420_pm4.fw");
-MODULE_FIRMWARE("qcom/a420_pfp.fw");
-MODULE_FIRMWARE("qcom/a530_pm4.fw");
-MODULE_FIRMWARE("qcom/a530_pfp.fw");
-MODULE_FIRMWARE("qcom/a530v3_gpmu.fw2");
-MODULE_FIRMWARE("qcom/a530_zap.mdt");
-MODULE_FIRMWARE("qcom/a530_zap.b00");
-MODULE_FIRMWARE("qcom/a530_zap.b01");
-MODULE_FIRMWARE("qcom/a530_zap.b02");
-MODULE_FIRMWARE("qcom/a540_gpmu.fw2");
-MODULE_FIRMWARE("qcom/a619_gmu.bin");
-MODULE_FIRMWARE("qcom/a630_sqe.fw");
-MODULE_FIRMWARE("qcom/a630_gmu.bin");
-MODULE_FIRMWARE("qcom/a630_zap.mbn");
-MODULE_FIRMWARE("qcom/a640_gmu.bin");
-MODULE_FIRMWARE("qcom/a650_gmu.bin");
-MODULE_FIRMWARE("qcom/a650_sqe.fw");
-MODULE_FIRMWARE("qcom/a660_gmu.bin");
-MODULE_FIRMWARE("qcom/a660_sqe.fw");
-MODULE_FIRMWARE("qcom/leia_pfp_470.fw");
-MODULE_FIRMWARE("qcom/leia_pm4_470.fw");
-MODULE_FIRMWARE("qcom/yamato_pfp.fw");
-MODULE_FIRMWARE("qcom/yamato_pm4.fw");
+static const struct adreno_gpulist *gpulists[] = {
+	&a2xx_gpulist,
+	&a3xx_gpulist,
+	&a4xx_gpulist,
+	&a5xx_gpulist,
+	&a6xx_gpulist,
+	&a6xx_gpulist,
+};
 
 static const struct adreno_info *adreno_info(uint32_t chip_id)
 {
 	/* identify gpu: */
-	for (int i = 0; i < ARRAY_SIZE(gpulist); i++) {
-		const struct adreno_info *info = &gpulist[i];
-		if (info->machine && !of_machine_is_compatible(info->machine))
-			continue;
-		for (int j = 0; info->chip_ids[j]; j++)
-			if (info->chip_ids[j] == chip_id)
-				return info;
+	for (int i = 0; i < ARRAY_SIZE(gpulists); i++) {
+		for (int j = 0; j < gpulists[i]->gpus_count; j++) {
+			const struct adreno_info *info = &gpulists[i]->gpus[j];
+
+			if (info->machine && !of_machine_is_compatible(info->machine))
+				continue;
+
+			for (int k = 0; info->chip_ids[k]; k++)
+				if (info->chip_ids[k] == chip_id)
+					return info;
+		}
 	}
 
 	return NULL;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -99,7 +99,7 @@
 		 * was a bad idea, and is only provided for backwards
 		 * compatibility for older targets.
 		 */
-		return -ENODEV;
+		return -ENOENT;
 	}
 
 	if (IS_ERR(fw)) {
@@ -475,7 +475,7 @@
 		ret = request_firmware_direct(&fw, fwname, drm->dev);
 		if (!ret) {
 			DRM_DEV_INFO(drm->dev, "loaded %s from legacy location\n",
-				newname);
+				fwname);
 			adreno_gpu->fwloc = FW_LOCATION_LEGACY;
 			goto out;
 		} else if (adreno_gpu->fwloc != FW_LOCATION_UNKNOWN) {
@@ -563,8 +563,19 @@
 
 int adreno_hw_init(struct msm_gpu *gpu)
 {
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int ret;
+
 	VERB("%s", gpu->name);
 
+	if (adreno_gpu->info->family >= ADRENO_6XX_GEN1 &&
+	    qcom_scm_set_gpu_smmu_aperture_is_available()) {
+		/* We currently always use context bank 0, so hard code this */
+		ret = qcom_scm_set_gpu_smmu_aperture(0);
+		if (ret)
+			DRM_DEV_ERROR(gpu->dev->dev, "unable to set SMMU aperture: %d\n", ret);
+	}
+
 	for (int i = 0; i < gpu->nr_rings; i++) {
 		struct msm_ringbuffer *ring = gpu->rb[i];
 
@@ -1079,6 +1090,7 @@
 	adreno_gpu->chip_id = config->chip_id;
 
 	gpu->allow_relocs = config->info->family < ADRENO_6XX_GEN1;
+	gpu->pdev = pdev;
 
 	/* Only handle the core clock when GMU is not in use (or is absent). */
 	if (adreno_has_gmu_wrapper(adreno_gpu) ||
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/adreno/adreno_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/adreno/adreno_gpu.h
@@ -48,6 +48,7 @@
 	ADRENO_6XX_GEN4,  /* a660 family */
 	ADRENO_7XX_GEN1,  /* a730 family */
 	ADRENO_7XX_GEN2,  /* a740 family */
+	ADRENO_7XX_GEN3,  /* a750 family */
 };
 
 #define ADRENO_QUIRK_TWO_PASS_USE_WFI		BIT(0)
@@ -76,14 +77,13 @@
 	u32 value;
 };
 
-extern const struct adreno_reglist a612_hwcg[], a615_hwcg[], a630_hwcg[], a640_hwcg[], a650_hwcg[];
-extern const struct adreno_reglist a660_hwcg[], a690_hwcg[], a730_hwcg[], a740_hwcg[];
-
 struct adreno_speedbin {
 	uint16_t fuse;
 	uint16_t speedbin;
 };
 
+struct a6xx_info;
+
 struct adreno_info {
 	const char *machine;
 	/**
@@ -100,7 +100,9 @@
 	struct msm_gpu *(*init)(struct drm_device *dev);
 	const char *zapfw;
 	u32 inactive_period;
-	const struct adreno_reglist *hwcg;
+	union {
+		const struct a6xx_info *a6xx;
+	};
 	u64 address_space_size;
 	/**
 	 * @speedbins: Optional table of fuse to speedbin mappings
@@ -113,6 +115,16 @@
 
 #define ADRENO_CHIP_IDS(tbl...) (uint32_t[]) { tbl, 0 }
 
+struct adreno_gpulist {
+	const struct adreno_info *gpus;
+	unsigned gpus_count;
+};
+
+#define DECLARE_ADRENO_GPULIST(name)                  \
+const struct adreno_gpulist name ## _gpulist = {      \
+	name ## _gpus, ARRAY_SIZE(name ## _gpus)      \
+}
+
 /*
  * Helper to build a speedbin table, ie. the table:
  *      fuse | speedbin
@@ -131,6 +143,19 @@
  */
 #define ADRENO_SPEEDBINS(tbl...) (struct adreno_speedbin[]) { tbl {SHRT_MAX, 0} }
 
+struct adreno_protect {
+	const uint32_t *regs;
+	uint32_t count;
+	uint32_t count_max;
+};
+
+#define DECLARE_ADRENO_PROTECT(name, __count_max)	\
+static const struct adreno_protect name = {		\
+	.regs = name ## _regs,				\
+	.count = ARRAY_SIZE(name ## _regs),		\
+	.count_max = __count_max,			\
+};
+
 struct adreno_gpu {
 	struct msm_gpu base;
 	const struct adreno_info *info;
@@ -166,12 +191,42 @@
 	const struct firmware *fw[ADRENO_FW_MAX];
 
 	struct {
+		/**
+		 * @rgb565_predicator: Unknown, introduced with A650 family,
+		 * related to UBWC mode/ver 4
+		 */
 		u32 rgb565_predicator;
+		/** @uavflagprd_inv: Unknown, introduced with A650 family */
 		u32 uavflagprd_inv;
+		/** @min_acc_len: Whether the minimum access length is 64 bits */
 		u32 min_acc_len;
-		u32 ubwc_mode;
+		/**
+		 * @ubwc_swizzle: Whether to enable level 1, 2 & 3 bank swizzling.
+		 *
+		 * UBWC 1.0 always enables all three levels.
+		 * UBWC 2.0 removes level 1 bank swizzling, leaving levels 2 & 3.
+		 * UBWC 4.0 adds the optional ability to disable levels 2 & 3.
+		 *
+		 * This is a bitmask where BIT(0) enables level 1, BIT(1)
+		 * controls level 2, and BIT(2) enables level 3.
+		 */
+		u32 ubwc_swizzle;
+		/**
+		 * @highest_bank_bit: Highest Bank Bit
+		 *
+		 * The Highest Bank Bit value represents the bit of the highest
+		 * DDR bank.  This should ideally use DRAM type detection.
+		 */
 		u32 highest_bank_bit;
 		u32 amsbc;
+		/**
+		 * @macrotile_mode: Macrotile Mode
+		 *
+		 * Whether to use 4-channel macrotiling mode or the newer
+		 * 8-channel macrotiling mode introduced in UBWC 3.1. 0 is
+		 * 4-channel and 1 is 8-channel.
+		 */
+		u32 macrotile_mode;
 	} ubwc_config;
 
 	/*
@@ -256,6 +311,11 @@
 	return adreno_is_revn(gpu, 305);
 }
 
+static inline bool adreno_is_a305b(const struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x03000512;
+}
+
 static inline bool adreno_is_a306(const struct adreno_gpu *gpu)
 {
 	/* yes, 307, because a305c is 306 */
@@ -377,11 +437,30 @@
 	return adreno_is_revn(gpu, 680);
 }
 
+static inline int adreno_is_a663(const struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x06060300;
+}
+
 static inline int adreno_is_a690(const struct adreno_gpu *gpu)
 {
 	return gpu->info->chip_ids[0] == 0x06090000;
 }
 
+static inline int adreno_is_a702(const struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x07000200;
+}
+
+static inline int adreno_is_a610_family(const struct adreno_gpu *gpu)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+
+	/* TODO: A612 */
+	return adreno_is_a610(gpu) || adreno_is_a702(gpu);
+}
+
 /* check for a615, a616, a618, a619 or any a630 derivatives */
 static inline int adreno_is_a630_family(const struct adreno_gpu *gpu)
 {
@@ -423,12 +502,22 @@
 	return gpu->info->chip_ids[0] == 0x43050a01;
 }
 
-/* Placeholder to make future diffs smaller */
+static inline int adreno_is_a750(struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x43051401;
+}
+
+static inline int adreno_is_x185(struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x43050c01;
+}
+
 static inline int adreno_is_a740_family(struct adreno_gpu *gpu)
 {
 	if (WARN_ON_ONCE(!gpu->info))
 		return false;
-	return gpu->info->family == ADRENO_7XX_GEN2;
+	return gpu->info->family == ADRENO_7XX_GEN2 ||
+	       gpu->info->family == ADRENO_7XX_GEN3;
 }
 
 static inline int adreno_is_a7xx(struct adreno_gpu *gpu)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h
@@ -157,18 +157,6 @@
 		.lm_pair = LM_5,
 		.pingpong = PINGPONG_2,
 	}, {
-		.name = "lm_3", .id = LM_3,
-		.base = 0x47000, .len = 0x320,
-		.features = MIXER_MSM8998_MASK,
-		.sblk = &msm8998_lm_sblk,
-		.pingpong = PINGPONG_NONE,
-	}, {
-		.name = "lm_4", .id = LM_4,
-		.base = 0x48000, .len = 0x320,
-		.features = MIXER_MSM8998_MASK,
-		.sblk = &msm8998_lm_sblk,
-		.pingpong = PINGPONG_NONE,
-	}, {
 		.name = "lm_5", .id = LM_5,
 		.base = 0x49000, .len = 0x320,
 		.features = MIXER_MSM8998_MASK,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h
@@ -156,25 +156,13 @@
 		.pingpong = PINGPONG_2,
 		.dspp = DSPP_2,
 	}, {
-		.name = "lm_3", .id = LM_3,
-		.base = 0x0, .len = 0x320,
-		.features = MIXER_SDM845_MASK,
-		.sblk = &sdm845_lm_sblk,
-		.pingpong = PINGPONG_NONE,
-		.dspp = DSPP_3,
-	}, {
-		.name = "lm_4", .id = LM_4,
-		.base = 0x0, .len = 0x320,
-		.features = MIXER_SDM845_MASK,
-		.sblk = &sdm845_lm_sblk,
-		.pingpong = PINGPONG_NONE,
-	}, {
 		.name = "lm_5", .id = LM_5,
 		.base = 0x49000, .len = 0x320,
 		.features = MIXER_SDM845_MASK,
 		.sblk = &sdm845_lm_sblk,
 		.lm_pair = LM_2,
 		.pingpong = PINGPONG_3,
+		.dspp = DSPP_3,
 	},
 };
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_4_qcs8300.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_4_qcs8300.h
@@ -0,0 +1,485 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_8_4_QCS8300_H
+#define _DPU_8_4_QCS8300_H
+
+static const struct dpu_caps qcs8300_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 5120,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg qcs8300_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.features = BIT(DPU_MDP_PERIPH_0_REMOVED),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg qcs8300_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x19000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg qcs8300_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg qcs8300_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+		.dspp = DSPP_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+		.dspp = DSPP_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg qcs8300_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg qcs8300_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x6d000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x6e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	}, {
+		.name = "pingpong_6", .id = PINGPONG_6,
+		.base = 0x65800, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	}, {
+		.name = "pingpong_7", .id = PINGPONG_7,
+		.base = 0x65c00, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	},
+};
+
+static const struct dpu_merge_3d_cfg qcs8300_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x4e000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x4f000, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x50000, .len = 0x8,
+	}, {
+		.name = "merge_3d_3", .id = MERGE_3D_3,
+		.base = 0x65f00, .len = 0x8,
+	},
+};
+
+/*
+ * NOTE: Each display compression engine (DCE) contains dual hard
+ * slice DSC encoders so both share same base address but with
+ * its own different sub block address.
+ */
+static const struct dpu_dsc_cfg qcs8300_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_0_1", .id = DSC_1,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_1_0", .id = DSC_2,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_1_1", .id = DSC_3,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_2_0", .id = DSC_4,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_2_1", .id = DSC_5,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	},
+};
+
+static const struct dpu_wb_cfg qcs8300_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb_yuv,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb_yuv),
+		.clk_ctrl = DPU_CLK_CTRL_WB2,
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+/* TODO: INTF 3, 6, 7 and 8 are used for MST, marked as INTF_NONE for now */
+static const struct dpu_intf_cfg qcs8300_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x36000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x37000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	}, {
+		.name = "intf_4", .id = INTF_4,
+		.base = 0x38000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 20),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 21),
+	}, {
+		.name = "intf_6", .id = INTF_6,
+		.base = 0x3A000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 17),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 16),
+	}, {
+		.name = "intf_7", .id = INTF_7,
+		.base = 0x3b000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 18),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 19),
+	}, {
+		.name = "intf_8", .id = INTF_8,
+		.base = 0x3c000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,	/* pair with intf_4 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 12),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 13),
+	},
+};
+
+static const struct dpu_perf_cfg qcs8300_perf_data = {
+	.max_bw_low = 13600000,
+	.max_bw_high = 18200000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 35,
+	/* FIXME: lut tables */
+	.danger_lut_tbl = {0x3ffff, 0x3ffff, 0x0},
+	.safe_lut_tbl = {0xfff0, 0xfff0, 0x1},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version qcs8300_mdss_ver = {
+	.core_major_ver = 8,
+	.core_minor_ver = 4,
+};
+
+const struct dpu_mdss_cfg dpu_qcs8300_cfg = {
+	.mdss_ver = &qcs8300_mdss_ver,
+	.caps = &qcs8300_dpu_caps,
+	.mdp = &qcs8300_mdp,
+	.cdm = &sc7280_cdm,
+	.ctl_count = ARRAY_SIZE(qcs8300_ctl),
+	.ctl = qcs8300_ctl,
+	.sspp_count = ARRAY_SIZE(qcs8300_sspp),
+	.sspp = qcs8300_sspp,
+	.mixer_count = ARRAY_SIZE(qcs8300_lm),
+	.mixer = qcs8300_lm,
+	.dspp_count = ARRAY_SIZE(qcs8300_dspp),
+	.dspp = qcs8300_dspp,
+	.pingpong_count = ARRAY_SIZE(qcs8300_pp),
+	.pingpong = qcs8300_pp,
+	.dsc_count = ARRAY_SIZE(qcs8300_dsc),
+	.dsc = qcs8300_dsc,
+	.merge_3d_count = ARRAY_SIZE(qcs8300_merge_3d),
+	.merge_3d = qcs8300_merge_3d,
+	.wb_count = ARRAY_SIZE(qcs8300_wb),
+	.wb = qcs8300_wb,
+	.intf_count = ARRAY_SIZE(qcs8300_intf),
+	.intf = qcs8300_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &qcs8300_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_4_sa8775p.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_4_sa8775p.h
@@ -0,0 +1,485 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_8_4_SA8775P_H
+#define _DPU_8_4_SA8775P_H
+
+static const struct dpu_caps sa8775p_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 5120,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sa8775p_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.features = BIT(DPU_MDP_PERIPH_0_REMOVED),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg sa8775p_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x19000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sa8775p_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg sa8775p_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+		.dspp = DSPP_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+		.dspp = DSPP_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sa8775p_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sa8775p_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x6d000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x6e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	}, {
+		.name = "pingpong_6", .id = PINGPONG_6,
+		.base = 0x65800, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	}, {
+		.name = "pingpong_7", .id = PINGPONG_7,
+		.base = 0x65c00, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	},
+};
+
+static const struct dpu_merge_3d_cfg sa8775p_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x4e000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x4f000, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x50000, .len = 0x8,
+	}, {
+		.name = "merge_3d_3", .id = MERGE_3D_3,
+		.base = 0x65f00, .len = 0x8,
+	},
+};
+
+/*
+ * NOTE: Each display compression engine (DCE) contains dual hard
+ * slice DSC encoders so both share same base address but with
+ * its own different sub block address.
+ */
+static const struct dpu_dsc_cfg sa8775p_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_0_1", .id = DSC_1,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_1_0", .id = DSC_2,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_1_1", .id = DSC_3,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_2_0", .id = DSC_4,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_2_1", .id = DSC_5,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	},
+};
+
+static const struct dpu_wb_cfg sa8775p_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb_yuv,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb_yuv),
+		.clk_ctrl = DPU_CLK_CTRL_WB2,
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+/* TODO: INTF 3, 6, 7 and 8 are used for MST, marked as INTF_NONE for now */
+static const struct dpu_intf_cfg sa8775p_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x36000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x37000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	}, {
+		.name = "intf_4", .id = INTF_4,
+		.base = 0x38000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 20),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 21),
+	}, {
+		.name = "intf_6", .id = INTF_6,
+		.base = 0x3A000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 17),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 16),
+	}, {
+		.name = "intf_7", .id = INTF_7,
+		.base = 0x3b000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 18),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 19),
+	}, {
+		.name = "intf_8", .id = INTF_8,
+		.base = 0x3c000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,	/* pair with intf_4 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 12),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 13),
+	},
+};
+
+static const struct dpu_perf_cfg sa8775p_perf_data = {
+	.max_bw_low = 13600000,
+	.max_bw_high = 18200000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 35,
+	/* FIXME: lut tables */
+	.danger_lut_tbl = {0x3ffff, 0x3ffff, 0x0},
+	.safe_lut_tbl = {0xfff0, 0xfff0, 0x1},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sa8775p_mdss_ver = {
+	.core_major_ver = 8,
+	.core_minor_ver = 4,
+};
+
+const struct dpu_mdss_cfg dpu_sa8775p_cfg = {
+	.mdss_ver = &sa8775p_mdss_ver,
+	.caps = &sa8775p_dpu_caps,
+	.mdp = &sa8775p_mdp,
+	.cdm = &sc7280_cdm,
+	.ctl_count = ARRAY_SIZE(sa8775p_ctl),
+	.ctl = sa8775p_ctl,
+	.sspp_count = ARRAY_SIZE(sa8775p_sspp),
+	.sspp = sa8775p_sspp,
+	.mixer_count = ARRAY_SIZE(sa8775p_lm),
+	.mixer = sa8775p_lm,
+	.dspp_count = ARRAY_SIZE(sa8775p_dspp),
+	.dspp = sa8775p_dspp,
+	.pingpong_count = ARRAY_SIZE(sa8775p_pp),
+	.pingpong = sa8775p_pp,
+	.dsc_count = ARRAY_SIZE(sa8775p_dsc),
+	.dsc = sa8775p_dsc,
+	.merge_3d_count = ARRAY_SIZE(sa8775p_merge_3d),
+	.merge_3d = sa8775p_merge_3d,
+	.wb_count = ARRAY_SIZE(sa8775p_wb),
+	.wb = sa8775p_wb,
+	.intf_count = ARRAY_SIZE(sa8775p_intf),
+	.intf = sa8775p_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sa8775p_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
@@ -80,7 +80,7 @@
 
 	mode = &state->adjusted_mode;
 
-	crtc_clk = mode->vtotal * mode->hdisplay * drm_mode_vrefresh(mode);
+	crtc_clk = (u64)mode->vtotal * mode->hdisplay * drm_mode_vrefresh(mode);
 
 	drm_atomic_crtc_for_each_plane(plane, crtc) {
 		pstate = to_dpu_plane_state(plane->state);
@@ -459,15 +459,15 @@
 			&perf->core_clk_rate);
 	debugfs_create_u32("enable_bw_release", 0600, entry,
 			(u32 *)&perf->enable_bw_release);
-	debugfs_create_u32("threshold_low", 0600, entry,
+	debugfs_create_u32("threshold_low", 0400, entry,
 			(u32 *)&perf->perf_cfg->max_bw_low);
-	debugfs_create_u32("threshold_high", 0600, entry,
+	debugfs_create_u32("threshold_high", 0400, entry,
 			(u32 *)&perf->perf_cfg->max_bw_high);
-	debugfs_create_u32("min_core_ib", 0600, entry,
+	debugfs_create_u32("min_core_ib", 0400, entry,
 			(u32 *)&perf->perf_cfg->min_core_ib);
-	debugfs_create_u32("min_llcc_ib", 0600, entry,
+	debugfs_create_u32("min_llcc_ib", 0400, entry,
 			(u32 *)&perf->perf_cfg->min_llcc_ib);
-	debugfs_create_u32("min_dram_ib", 0600, entry,
+	debugfs_create_u32("min_dram_ib", 0400, entry,
 			(u32 *)&perf->perf_cfg->min_dram_ib);
 	debugfs_create_file("perf_mode", 0600, entry,
 			(u32 *)perf, &dpu_core_perf_mode_fops);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
@@ -658,18 +658,18 @@
 	DPU_ATRACE_END("crtc_frame_event");
 }
 
-/*
- * dpu_crtc_frame_event_cb - crtc frame event callback API. CRTC module
- * registers this API to encoder for all frame event callbacks like
- * frame_error, frame_done, idle_timeout, etc. Encoder may call different events
- * from different context - IRQ, user thread, commit_thread, etc. Each event
- * should be carefully reviewed and should be processed in proper task context
- * to avoid schedulin delay or properly manage the irq context's bottom half
- * processing.
+/**
+ * dpu_crtc_frame_event_cb - crtc frame event callback API
+ * @crtc: Pointer to crtc
+ * @event: Event to process
+ *
+ * Encoder may call this for different events from different context - IRQ,
+ * user thread, commit_thread, etc. Each event should be carefully reviewed and
+ * should be processed in proper task context to avoid schedulin delay or
+ * properly manage the irq context's bottom half processing.
  */
-static void dpu_crtc_frame_event_cb(void *data, u32 event)
+void dpu_crtc_frame_event_cb(struct drm_crtc *crtc, u32 event)
 {
-	struct drm_crtc *crtc = (struct drm_crtc *)data;
 	struct dpu_crtc *dpu_crtc;
 	struct msm_drm_private *priv;
 	struct dpu_crtc_frame_event *fevent;
@@ -711,12 +711,13 @@
 	_dpu_crtc_complete_flip(crtc);
 }
 
-static void _dpu_crtc_setup_lm_bounds(struct drm_crtc *crtc,
+static int _dpu_crtc_check_and_setup_lm_bounds(struct drm_crtc *crtc,
 		struct drm_crtc_state *state)
 {
 	struct dpu_crtc_state *cstate = to_dpu_crtc_state(state);
 	struct drm_display_mode *adj_mode = &state->adjusted_mode;
 	u32 crtc_split_width = adj_mode->hdisplay / cstate->num_mixers;
+	struct dpu_kms *dpu_kms = _dpu_crtc_get_kms(crtc);
 	int i;
 
 	for (i = 0; i < cstate->num_mixers; i++) {
@@ -727,7 +728,12 @@
 		r->y2 = adj_mode->vdisplay;
 
 		trace_dpu_crtc_setup_lm_bounds(DRMID(crtc), i, r);
+
+		if (drm_rect_width(r) > dpu_kms->catalog->caps->max_mixer_width)
+			return -E2BIG;
 	}
+
+	return 0;
 }
 
 static void _dpu_crtc_get_pcc_coeff(struct drm_crtc_state *state,
@@ -803,7 +809,7 @@
 
 	DRM_DEBUG_ATOMIC("crtc%d\n", crtc->base.id);
 
-	_dpu_crtc_setup_lm_bounds(crtc, crtc->state);
+	_dpu_crtc_check_and_setup_lm_bounds(crtc, crtc->state);
 
 	/* encoder will trigger pending mask now */
 	drm_for_each_encoder_mask(encoder, crtc->dev, crtc->state->encoder_mask)
@@ -1091,12 +1097,6 @@
 
 	dpu_core_perf_crtc_update(crtc, 0);
 
-	drm_for_each_encoder_mask(encoder, crtc->dev, crtc->state->encoder_mask)
-		dpu_encoder_register_frame_event_callback(encoder, NULL, NULL);
-
-	memset(cstate->mixers, 0, sizeof(cstate->mixers));
-	cstate->num_mixers = 0;
-
 	/* disable clk & bw control until clk & bw properties are set */
 	cstate->bw_control = false;
 	cstate->bw_split_vote = false;
@@ -1132,8 +1132,6 @@
 		 */
 		if (dpu_encoder_get_intf_mode(encoder) == INTF_MODE_VIDEO)
 			request_bandwidth = true;
-		dpu_encoder_register_frame_event_callback(encoder,
-				dpu_crtc_frame_event_cb, (void *)crtc);
 	}
 
 	if (request_bandwidth)
@@ -1197,8 +1195,11 @@
 	if (crtc_state->active_changed)
 		crtc_state->mode_changed = true;
 
-	if (cstate->num_mixers)
-		_dpu_crtc_setup_lm_bounds(crtc, crtc_state);
+	if (cstate->num_mixers) {
+		rc = _dpu_crtc_check_and_setup_lm_bounds(crtc, crtc_state);
+		if (rc)
+			return rc;
+	}
 
 	/* FIXME: move this to dpu_plane_atomic_check? */
 	drm_atomic_crtc_state_for_each_plane_state(plane, pstate, crtc_state) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.h
@@ -300,4 +300,6 @@
 	return crtc && crtc->state ? RT_CLIENT : NRT_CLIENT;
 }
 
+void dpu_crtc_frame_event_cb(struct drm_crtc *crtc, u32 event);
+
 #endif /* _DPU_CRTC_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
@@ -126,6 +126,8 @@
  * @base:		drm_encoder base class for registration with DRM
  * @enc_spinlock:	Virtual-Encoder-Wide Spin Lock for IRQ purposes
  * @enabled:		True if the encoder is active, protected by enc_lock
+ * @commit_done_timedout: True if there has been a timeout on commit after
+ *			enabling the encoder.
  * @num_phys_encs:	Actual number of physical encoders contained.
  * @phys_encs:		Container of physical encoders managed.
  * @cur_master:		Pointer to the current master in this mode. Optimization
@@ -149,8 +151,6 @@
  * @frame_busy_mask:		Bitmask tracking which phys_enc we are still
  *				busy processing current command.
  *				Bit0 = phys_encs[0] etc.
- * @crtc_frame_event_cb:	callback handler for frame event
- * @crtc_frame_event_cb_data:	callback handler private data
  * @frame_done_timeout_ms:	frame done timeout in ms
  * @frame_done_timeout_cnt:	atomic counter tracking the number of frame
  * 				done timeouts
@@ -172,6 +172,7 @@
 	spinlock_t enc_spinlock;
 
 	bool enabled;
+	bool commit_done_timedout;
 
 	unsigned int num_phys_encs;
 	struct dpu_encoder_phys *phys_encs[MAX_PHYS_ENCODERS_PER_VIRTUAL];
@@ -189,8 +190,6 @@
 
 	struct mutex enc_lock;
 	DECLARE_BITMAP(frame_busy_mask, MAX_PHYS_ENCODERS_PER_VIRTUAL);
-	void (*crtc_frame_event_cb)(void *, u32 event);
-	void *crtc_frame_event_cb_data;
 
 	atomic_t frame_done_timeout_ms;
 	atomic_t frame_done_timeout_cnt;
@@ -218,12 +217,66 @@
 	15, 7, 13, 5, 3, 11, 1, 9, 12, 4, 14, 6, 0, 8, 2, 10
 };
 
+u32 dpu_encoder_get_drm_fmt(struct dpu_encoder_phys *phys_enc)
+{
+	struct drm_encoder *drm_enc;
+	struct dpu_encoder_virt *dpu_enc;
+	struct drm_display_info *info;
+	struct drm_display_mode *mode;
+
+	drm_enc = phys_enc->parent;
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	info = &dpu_enc->connector->display_info;
+	mode = &phys_enc->cached_mode;
+
+	if (drm_mode_is_420_only(info, mode))
+		return DRM_FORMAT_YUV420;
+
+	return DRM_FORMAT_RGB888;
+}
+
+bool dpu_encoder_needs_periph_flush(struct dpu_encoder_phys *phys_enc)
+{
+	struct drm_encoder *drm_enc;
+	struct dpu_encoder_virt *dpu_enc;
+	struct msm_display_info *disp_info;
+	struct msm_drm_private *priv;
+	struct drm_display_mode *mode;
+
+	drm_enc = phys_enc->parent;
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	disp_info = &dpu_enc->disp_info;
+	priv = drm_enc->dev->dev_private;
+	mode = &phys_enc->cached_mode;
+
+	return phys_enc->hw_intf->cap->type == INTF_DP &&
+	       msm_dp_needs_periph_flush(priv->dp[disp_info->h_tile_instance[0]], mode);
+}
 
 bool dpu_encoder_is_widebus_enabled(const struct drm_encoder *drm_enc)
 {
+	const struct dpu_encoder_virt *dpu_enc;
+	struct msm_drm_private *priv = drm_enc->dev->dev_private;
+	const struct msm_display_info *disp_info;
+	int index;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	disp_info = &dpu_enc->disp_info;
+	index = disp_info->h_tile_instance[0];
+
+	if (disp_info->intf_type == INTF_DP)
+		return msm_dp_wide_bus_available(priv->dp[index]);
+	else if (disp_info->intf_type == INTF_DSI)
+		return msm_dsi_wide_bus_enabled(priv->dsi[index]);
+
+	return false;
+}
+
+bool dpu_encoder_is_dsc_enabled(const struct drm_encoder *drm_enc)
+{
 	const struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
 
-	return dpu_enc->wide_bus_en;
+	return dpu_enc->dsc ? true : false;
 }
 
 int dpu_encoder_get_crc_values_cnt(const struct drm_encoder *drm_enc)
@@ -371,7 +424,7 @@
 		return -EWOULDBLOCK;
 	}
 
-	if (irq_idx < 0) {
+	if (irq_idx == 0) {
 		DRM_DEBUG_KMS("skip irq wait id=%u, callback=%ps\n",
 			      DRMID(phys_enc->parent), func);
 		return 0;
@@ -549,7 +602,8 @@
 	else if (!dpu_kms->catalog->caps->has_3d_merge)
 		topology.num_lm = 1;
 	else
-		topology.num_lm = (mode->hdisplay > MAX_HDISPLAY_SPLIT) ? 2 : 1;
+		topology.num_lm = (mode->hdisplay > dpu_kms->catalog->caps->max_mixer_width) ?
+				   2 : 1;
 
 	if (crtc_state->ctm)
 		topology.num_dspp = topology.num_lm;
@@ -571,6 +625,40 @@
 	return topology;
 }
 
+static void dpu_encoder_assign_crtc_resources(struct dpu_kms *dpu_kms,
+					      struct drm_encoder *drm_enc,
+					      struct dpu_global_state *global_state,
+					      struct drm_crtc_state *crtc_state)
+{
+	struct dpu_crtc_state *cstate;
+	struct dpu_hw_blk *hw_ctl[MAX_CHANNELS_PER_ENC];
+	struct dpu_hw_blk *hw_lm[MAX_CHANNELS_PER_ENC];
+	struct dpu_hw_blk *hw_dspp[MAX_CHANNELS_PER_ENC];
+	int num_lm, num_ctl, num_dspp, i;
+
+	cstate = to_dpu_crtc_state(crtc_state);
+
+	memset(cstate->mixers, 0, sizeof(cstate->mixers));
+
+	num_ctl = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+		drm_enc->base.id, DPU_HW_BLK_CTL, hw_ctl, ARRAY_SIZE(hw_ctl));
+	num_lm = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+		drm_enc->base.id, DPU_HW_BLK_LM, hw_lm, ARRAY_SIZE(hw_lm));
+	num_dspp = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+		drm_enc->base.id, DPU_HW_BLK_DSPP, hw_dspp,
+		ARRAY_SIZE(hw_dspp));
+
+	for (i = 0; i < num_lm; i++) {
+		int ctl_idx = (i < num_ctl) ? i : (num_ctl-1);
+
+		cstate->mixers[i].hw_lm = to_dpu_hw_mixer(hw_lm[i]);
+		cstate->mixers[i].lm_ctl = to_dpu_hw_ctl(hw_ctl[ctl_idx]);
+		cstate->mixers[i].hw_dspp = i < num_dspp ? to_dpu_hw_dspp(hw_dspp[i]) : NULL;
+	}
+
+	cstate->num_mixers = num_lm;
+}
+
 static int dpu_encoder_virt_atomic_check(
 		struct drm_encoder *drm_enc,
 		struct drm_crtc_state *crtc_state,
@@ -581,6 +669,7 @@
 	struct dpu_kms *dpu_kms;
 	struct drm_display_mode *adj_mode;
 	struct msm_display_topology topology;
+	struct msm_display_info *disp_info;
 	struct dpu_global_state *global_state;
 	struct drm_framebuffer *fb;
 	struct drm_dsc_config *dsc;
@@ -597,6 +686,7 @@
 	DPU_DEBUG_ENC(dpu_enc, "\n");
 
 	priv = drm_enc->dev->dev_private;
+	disp_info = &dpu_enc->disp_info;
 	dpu_kms = to_dpu_kms(priv->kms);
 	adj_mode = &crtc_state->adjusted_mode;
 	global_state = dpu_kms_get_global_state(crtc_state->state);
@@ -624,21 +714,24 @@
 	topology = dpu_encoder_get_topology(dpu_enc, dpu_kms, adj_mode, crtc_state, dsc);
 
 	/*
-	 * Use CDM only for writeback at the moment as other interfaces cannot handle it.
-	 * if writeback itself cannot handle cdm for some reason it will fail in its atomic_check()
+	 * Use CDM only for writeback or DP at the moment as other interfaces cannot handle it.
+	 * If writeback itself cannot handle cdm for some reason it will fail in its atomic_check()
 	 * earlier.
 	 */
-	if (dpu_enc->disp_info.intf_type == INTF_WB && conn_state->writeback_job) {
+	if (disp_info->intf_type == INTF_WB && conn_state->writeback_job) {
 		fb = conn_state->writeback_job->fb;
 
 		if (fb && DPU_FORMAT_IS_YUV(to_dpu_format(msm_framebuffer_format(fb))))
 			topology.needs_cdm = true;
-		if (topology.needs_cdm && !dpu_enc->cur_master->hw_cdm)
-			crtc_state->mode_changed = true;
-		else if (!topology.needs_cdm && dpu_enc->cur_master->hw_cdm)
-			crtc_state->mode_changed = true;
+	} else if (disp_info->intf_type == INTF_DP) {
+		if (msm_dp_is_yuv_420_enabled(priv->dp[disp_info->h_tile_instance[0]], adj_mode))
+			topology.needs_cdm = true;
 	}
 
+	if (topology.needs_cdm && !dpu_enc->cur_master->hw_cdm)
+		crtc_state->mode_changed = true;
+	else if (!topology.needs_cdm && dpu_enc->cur_master->hw_cdm)
+		crtc_state->mode_changed = true;
 	/*
 	 * Release and Allocate resources on every modeset
 	 * Dont allocate when active is false.
@@ -649,6 +742,9 @@
 		if (!crtc_state->active_changed || crtc_state->enable)
 			ret = dpu_rm_reserve(&dpu_kms->rm, global_state,
 					drm_enc, crtc_state, topology);
+		if (!ret)
+			dpu_encoder_assign_crtc_resources(dpu_kms, drm_enc,
+							  global_state, crtc_state);
 	}
 
 	trace_dpu_enc_atomic_check_flags(DRMID(drm_enc), adj_mode->flags);
@@ -1023,14 +1119,11 @@
 	struct dpu_encoder_virt *dpu_enc;
 	struct msm_drm_private *priv;
 	struct dpu_kms *dpu_kms;
-	struct dpu_crtc_state *cstate;
 	struct dpu_global_state *global_state;
 	struct dpu_hw_blk *hw_pp[MAX_CHANNELS_PER_ENC];
 	struct dpu_hw_blk *hw_ctl[MAX_CHANNELS_PER_ENC];
-	struct dpu_hw_blk *hw_lm[MAX_CHANNELS_PER_ENC];
-	struct dpu_hw_blk *hw_dspp[MAX_CHANNELS_PER_ENC] = { NULL };
 	struct dpu_hw_blk *hw_dsc[MAX_CHANNELS_PER_ENC];
-	int num_lm, num_ctl, num_pp, num_dsc;
+	int num_ctl, num_pp, num_dsc;
 	unsigned int dsc_mask = 0;
 	int i;
 
@@ -1059,11 +1152,6 @@
 		ARRAY_SIZE(hw_pp));
 	num_ctl = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
 		drm_enc->base.id, DPU_HW_BLK_CTL, hw_ctl, ARRAY_SIZE(hw_ctl));
-	num_lm = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
-		drm_enc->base.id, DPU_HW_BLK_LM, hw_lm, ARRAY_SIZE(hw_lm));
-	dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
-		drm_enc->base.id, DPU_HW_BLK_DSPP, hw_dspp,
-		ARRAY_SIZE(hw_dspp));
 
 	for (i = 0; i < MAX_CHANNELS_PER_ENC; i++)
 		dpu_enc->hw_pp[i] = i < num_pp ? to_dpu_hw_pingpong(hw_pp[i])
@@ -1079,7 +1167,8 @@
 
 	dpu_enc->dsc_mask = dsc_mask;
 
-	if (dpu_enc->disp_info.intf_type == INTF_WB && conn_state->writeback_job) {
+	if ((dpu_enc->disp_info.intf_type == INTF_WB && conn_state->writeback_job) ||
+	    dpu_enc->disp_info.intf_type == INTF_DP) {
 		struct dpu_hw_blk *hw_cdm = NULL;
 
 		dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
@@ -1088,38 +1177,23 @@
 		dpu_enc->cur_master->hw_cdm = hw_cdm ? to_dpu_hw_cdm(hw_cdm) : NULL;
 	}
 
-	cstate = to_dpu_crtc_state(crtc_state);
-
-	for (i = 0; i < num_lm; i++) {
-		int ctl_idx = (i < num_ctl) ? i : (num_ctl-1);
-
-		cstate->mixers[i].hw_lm = to_dpu_hw_mixer(hw_lm[i]);
-		cstate->mixers[i].lm_ctl = to_dpu_hw_ctl(hw_ctl[ctl_idx]);
-		cstate->mixers[i].hw_dspp = to_dpu_hw_dspp(hw_dspp[i]);
-	}
-
-	cstate->num_mixers = num_lm;
-
-	dpu_enc->connector = conn_state->connector;
-
 	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
 		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
 
-		if (!dpu_enc->hw_pp[i]) {
+		phys->hw_pp = dpu_enc->hw_pp[i];
+		if (!phys->hw_pp) {
 			DPU_ERROR_ENC(dpu_enc,
 				"no pp block assigned at idx: %d\n", i);
 			return;
 		}
 
-		if (!hw_ctl[i]) {
+		phys->hw_ctl = i < num_ctl ? to_dpu_hw_ctl(hw_ctl[i]) : NULL;
+		if (!phys->hw_ctl) {
 			DPU_ERROR_ENC(dpu_enc,
 				"no ctl block assigned at idx: %d\n", i);
 			return;
 		}
 
-		phys->hw_pp = dpu_enc->hw_pp[i];
-		phys->hw_ctl = to_dpu_hw_ctl(hw_ctl[i]);
-
 		phys->cached_mode = crtc_state->adjusted_mode;
 		if (phys->ops.atomic_mode_set)
 			phys->ops.atomic_mode_set(phys, crtc_state, conn_state);
@@ -1188,26 +1262,22 @@
 	struct dpu_encoder_virt *dpu_enc = NULL;
 	int ret = 0;
 	struct drm_display_mode *cur_mode = NULL;
-	struct msm_drm_private *priv = drm_enc->dev->dev_private;
-	struct msm_display_info *disp_info;
-	int index;
 
 	dpu_enc = to_dpu_encoder_virt(drm_enc);
-	disp_info = &dpu_enc->disp_info;
-	index = disp_info->h_tile_instance[0];
-
 	dpu_enc->dsc = dpu_encoder_get_dsc_config(drm_enc);
 
 	atomic_set(&dpu_enc->frame_done_timeout_cnt, 0);
 
-	if (disp_info->intf_type == INTF_DP)
-		dpu_enc->wide_bus_en = msm_dp_wide_bus_available(priv->dp[index]);
-	else if (disp_info->intf_type == INTF_DSI)
-		dpu_enc->wide_bus_en = msm_dsi_wide_bus_enabled(priv->dsi[index]);
-
 	mutex_lock(&dpu_enc->enc_lock);
+
+	dpu_enc->commit_done_timedout = false;
+
+	dpu_enc->connector = drm_atomic_get_new_connector_for_encoder(state, drm_enc);
+
 	cur_mode = &dpu_enc->base.crtc->state->adjusted_mode;
 
+	dpu_enc->wide_bus_en = dpu_encoder_is_widebus_enabled(drm_enc);
+
 	trace_dpu_enc_enable(DRMID(drm_enc), cur_mode->hdisplay,
 			     cur_mode->vdisplay);
 
@@ -1261,7 +1331,7 @@
 	trace_dpu_enc_disable(DRMID(drm_enc));
 
 	/* wait for idle */
-	dpu_encoder_wait_for_event(drm_enc, MSM_ENC_TX_COMPLETE);
+	dpu_encoder_wait_for_tx_complete(drm_enc);
 
 	dpu_encoder_resource_control(drm_enc, DPU_ENC_RC_EVENT_PRE_STOP);
 
@@ -1383,28 +1453,6 @@
 	}
 }
 
-void dpu_encoder_register_frame_event_callback(struct drm_encoder *drm_enc,
-		void (*frame_event_cb)(void *, u32 event),
-		void *frame_event_cb_data)
-{
-	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
-	unsigned long lock_flags;
-	bool enable;
-
-	enable = frame_event_cb ? true : false;
-
-	if (!drm_enc) {
-		DPU_ERROR("invalid encoder\n");
-		return;
-	}
-	trace_dpu_enc_frame_event_cb(DRMID(drm_enc), enable);
-
-	spin_lock_irqsave(&dpu_enc->enc_spinlock, lock_flags);
-	dpu_enc->crtc_frame_event_cb = frame_event_cb;
-	dpu_enc->crtc_frame_event_cb_data = frame_event_cb_data;
-	spin_unlock_irqrestore(&dpu_enc->enc_spinlock, lock_flags);
-}
-
 void dpu_encoder_frame_done_callback(
 		struct drm_encoder *drm_enc,
 		struct dpu_encoder_phys *ready_phys, u32 event)
@@ -1444,15 +1492,12 @@
 			dpu_encoder_resource_control(drm_enc,
 					DPU_ENC_RC_EVENT_FRAME_DONE);
 
-			if (dpu_enc->crtc_frame_event_cb)
-				dpu_enc->crtc_frame_event_cb(
-					dpu_enc->crtc_frame_event_cb_data,
-					event);
+			if (dpu_enc->crtc)
+				dpu_crtc_frame_event_cb(dpu_enc->crtc, event);
 		}
 	} else {
-		if (dpu_enc->crtc_frame_event_cb)
-			dpu_enc->crtc_frame_event_cb(
-				dpu_enc->crtc_frame_event_cb_data, event);
+		if (dpu_enc->crtc)
+			dpu_crtc_frame_event_cb(dpu_enc->crtc, event);
 	}
 }
 
@@ -1670,8 +1715,7 @@
 		phys = dpu_enc->phys_encs[i];
 
 		ctl = phys->hw_ctl;
-		if (ctl->ops.clear_pending_flush)
-			ctl->ops.clear_pending_flush(ctl);
+		ctl->ops.clear_pending_flush(ctl);
 
 		/* update only for command mode primary ctl */
 		if ((phys == dpu_enc->cur_master) &&
@@ -1853,7 +1897,9 @@
 	dsc_common_mode = 0;
 	pic_width = dsc->pic_width;
 
-	dsc_common_mode = DSC_MODE_MULTIPLEX | DSC_MODE_SPLIT_PANEL;
+	dsc_common_mode = DSC_MODE_SPLIT_PANEL;
+	if (dpu_encoder_use_dsc_merge(enc_master->parent))
+		dsc_common_mode |= DSC_MODE_MULTIPLEX;
 	if (enc_master->intf_mode == INTF_MODE_VIDEO)
 		dsc_common_mode |= DSC_MODE_VIDEO;
 
@@ -2110,6 +2156,84 @@
 	ctl->ops.clear_pending_flush(ctl);
 }
 
+void dpu_encoder_helper_phys_setup_cdm(struct dpu_encoder_phys *phys_enc,
+				       const struct dpu_format *dpu_fmt,
+				       u32 output_type)
+{
+	struct dpu_hw_cdm *hw_cdm;
+	struct dpu_hw_cdm_cfg *cdm_cfg;
+	struct dpu_hw_pingpong *hw_pp;
+	int ret;
+
+	if (!phys_enc)
+		return;
+
+	cdm_cfg = &phys_enc->cdm_cfg;
+	hw_pp = phys_enc->hw_pp;
+	hw_cdm = phys_enc->hw_cdm;
+
+	if (!hw_cdm)
+		return;
+
+	if (!DPU_FORMAT_IS_YUV(dpu_fmt)) {
+		DPU_DEBUG("[enc:%d] cdm_disable fmt:%x\n", DRMID(phys_enc->parent),
+			  dpu_fmt->base.pixel_format);
+		if (hw_cdm->ops.bind_pingpong_blk)
+			hw_cdm->ops.bind_pingpong_blk(hw_cdm, PINGPONG_NONE);
+
+		return;
+	}
+
+	memset(cdm_cfg, 0, sizeof(struct dpu_hw_cdm_cfg));
+
+	cdm_cfg->output_width = phys_enc->cached_mode.hdisplay;
+	cdm_cfg->output_height = phys_enc->cached_mode.vdisplay;
+	cdm_cfg->output_fmt = dpu_fmt;
+	cdm_cfg->output_type = output_type;
+	cdm_cfg->output_bit_depth = DPU_FORMAT_IS_DX(dpu_fmt) ?
+			CDM_CDWN_OUTPUT_10BIT : CDM_CDWN_OUTPUT_8BIT;
+	cdm_cfg->csc_cfg = &dpu_csc10_rgb2yuv_601l;
+
+	/* enable 10 bit logic */
+	switch (cdm_cfg->output_fmt->chroma_sample) {
+	case DPU_CHROMA_RGB:
+		cdm_cfg->h_cdwn_type = CDM_CDWN_DISABLE;
+		cdm_cfg->v_cdwn_type = CDM_CDWN_DISABLE;
+		break;
+	case DPU_CHROMA_H2V1:
+		cdm_cfg->h_cdwn_type = CDM_CDWN_COSITE;
+		cdm_cfg->v_cdwn_type = CDM_CDWN_DISABLE;
+		break;
+	case DPU_CHROMA_420:
+		cdm_cfg->h_cdwn_type = CDM_CDWN_COSITE;
+		cdm_cfg->v_cdwn_type = CDM_CDWN_OFFSITE;
+		break;
+	case DPU_CHROMA_H1V2:
+	default:
+		DPU_ERROR("[enc:%d] unsupported chroma sampling type\n",
+			  DRMID(phys_enc->parent));
+		cdm_cfg->h_cdwn_type = CDM_CDWN_DISABLE;
+		cdm_cfg->v_cdwn_type = CDM_CDWN_DISABLE;
+		break;
+	}
+
+	DPU_DEBUG("[enc:%d] cdm_enable:%d,%d,%X,%d,%d,%d,%d]\n",
+		  DRMID(phys_enc->parent), cdm_cfg->output_width,
+		  cdm_cfg->output_height, cdm_cfg->output_fmt->base.pixel_format,
+		  cdm_cfg->output_type, cdm_cfg->output_bit_depth,
+		  cdm_cfg->h_cdwn_type, cdm_cfg->v_cdwn_type);
+
+	if (hw_cdm->ops.enable) {
+		cdm_cfg->pp_id = hw_pp->idx;
+		ret = hw_cdm->ops.enable(hw_cdm, cdm_cfg);
+		if (ret < 0) {
+			DPU_ERROR("[enc:%d] failed to enable CDM; ret:%d\n",
+				  DRMID(phys_enc->parent), ret);
+			return;
+		}
+	}
+}
+
 #ifdef CONFIG_DEBUG_FS
 static int _dpu_encoder_status_show(struct seq_file *s, void *data)
 {
@@ -2214,17 +2338,23 @@
 
 static int dpu_encoder_setup_display(struct dpu_encoder_virt *dpu_enc,
 				 struct dpu_kms *dpu_kms,
-				 struct msm_display_info *disp_info)
+				 struct msm_display_info *disp_info,
+				 int drm_enc_mode)
 {
 	int ret = 0;
 	int i = 0;
 	struct dpu_enc_phys_init_params phys_params;
+	unsigned int intf_id;
+	struct msm_drm_private *priv;
+	struct drm_encoder *drm_enc;
 
 	if (!dpu_enc) {
 		DPU_ERROR("invalid arg(s), enc %d\n", dpu_enc != NULL);
 		return -EINVAL;
 	}
 
+	drm_enc = &dpu_enc->base;
+	priv = drm_enc->dev->dev_private;
 	dpu_enc->cur_master = NULL;
 
 	memset(&phys_params, 0, sizeof(phys_params));
@@ -2261,9 +2391,18 @@
 		DPU_DEBUG("h_tile_instance %d = %d, split_role %d\n",
 				i, controller_id, phys_params.split_role);
 
-		phys_params.hw_intf = dpu_encoder_get_intf(dpu_kms->catalog, &dpu_kms->rm,
-							   disp_info->intf_type,
-							   controller_id);
+		if (drm_enc_mode == DRM_MODE_ENCODER_DPMST) {
+			intf_id = msm_dp_get_mst_intf_id(priv->dp[controller_id],
+							 disp_info->stream_id);
+			DPU_DEBUG("intf_id %d for disp_info->stream_id = %d\n", intf_id,
+				  disp_info->stream_id);
+			phys_params.hw_intf = dpu_rm_get_intf(&dpu_kms->rm, intf_id);
+
+		} else {
+			phys_params.hw_intf = dpu_encoder_get_intf(dpu_kms->catalog, &dpu_kms->rm,
+								   disp_info->intf_type,
+								   controller_id);
+		}
 
 		if (disp_info->intf_type == INTF_WB && controller_id < WB_MAX)
 			phys_params.hw_wb = dpu_rm_get_wb(&dpu_kms->rm, controller_id);
@@ -2306,7 +2445,7 @@
 		return;
 	}
 
-	if (!dpu_enc->frame_busy_mask[0] || !dpu_enc->crtc_frame_event_cb) {
+	if (!dpu_enc->frame_busy_mask[0] || !dpu_enc->crtc) {
 		DRM_DEBUG_KMS("id:%u invalid timeout frame_busy_mask=%lu\n",
 			      DRMID(drm_enc), dpu_enc->frame_busy_mask[0]);
 		return;
@@ -2322,7 +2461,7 @@
 
 	event = DPU_ENCODER_FRAME_EVENT_ERROR;
 	trace_dpu_enc_frame_done_timeout(DRMID(drm_enc), event);
-	dpu_enc->crtc_frame_event_cb(dpu_enc->crtc_frame_event_cb_data, event);
+	dpu_crtc_frame_event_cb(dpu_enc->crtc, event);
 }
 
 static const struct drm_encoder_helper_funcs dpu_encoder_helper_funcs = {
@@ -2357,7 +2496,7 @@
 	mutex_init(&dpu_enc->enc_lock);
 	mutex_init(&dpu_enc->rc_lock);
 
-	ret = dpu_encoder_setup_display(dpu_enc, dpu_kms, disp_info);
+	ret = dpu_encoder_setup_display(dpu_enc, dpu_kms, disp_info, drm_enc_mode);
 	if (ret) {
 		DPU_ERROR("failed to setup encoder\n");
 		return ERR_PTR(-ENOMEM);
@@ -2379,10 +2518,18 @@
 	return &dpu_enc->base;
 }
 
-int dpu_encoder_wait_for_event(struct drm_encoder *drm_enc,
-	enum msm_event_wait event)
+/**
+ * dpu_encoder_wait_for_commit_done() - Wait for encoder to flush pending state
+ * @drm_enc:	encoder pointer
+ *
+ * Wait for hardware to have flushed the current pending changes to hardware at
+ * a vblank or CTL_START. Physical encoders will map this differently depending
+ * on the type: vid mode -> vsync_irq, cmd mode -> CTL_START.
+ *
+ * Return: 0 on success, -EWOULDBLOCK if already signaled, error otherwise
+ */
+int dpu_encoder_wait_for_commit_done(struct drm_encoder *drm_enc)
 {
-	int (*fn_wait)(struct dpu_encoder_phys *phys_enc) = NULL;
 	struct dpu_encoder_virt *dpu_enc = NULL;
 	int i, ret = 0;
 
@@ -2396,23 +2543,51 @@
 	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
 		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
 
-		switch (event) {
-		case MSM_ENC_COMMIT_DONE:
-			fn_wait = phys->ops.wait_for_commit_done;
-			break;
-		case MSM_ENC_TX_COMPLETE:
-			fn_wait = phys->ops.wait_for_tx_complete;
-			break;
-		default:
-			DPU_ERROR_ENC(dpu_enc, "unknown wait event %d\n",
-					event);
-			return -EINVAL;
+		if (phys->ops.wait_for_commit_done) {
+			DPU_ATRACE_BEGIN("wait_for_commit_done");
+			ret = phys->ops.wait_for_commit_done(phys);
+			DPU_ATRACE_END("wait_for_commit_done");
+			if (ret == -ETIMEDOUT && !dpu_enc->commit_done_timedout) {
+				dpu_enc->commit_done_timedout = true;
+				msm_disp_snapshot_state(drm_enc->dev);
+			}
+			if (ret)
+				return ret;
 		}
+	}
+
+	return ret;
+}
+
+/**
+ * dpu_encoder_wait_for_tx_complete() - Wait for encoder to transfer pixels to panel
+ * @drm_enc:	encoder pointer
+ *
+ * Wait for the hardware to transfer all the pixels to the panel. Physical
+ * encoders will map this differently depending on the type: vid mode -> vsync_irq,
+ * cmd mode -> pp_done.
+ *
+ * Return: 0 on success, -EWOULDBLOCK if already signaled, error otherwise
+ */
+int dpu_encoder_wait_for_tx_complete(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc = NULL;
+	int i, ret = 0;
+
+	if (!drm_enc) {
+		DPU_ERROR("invalid encoder\n");
+		return -EINVAL;
+	}
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	DPU_DEBUG_ENC(dpu_enc, "\n");
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
 
-		if (fn_wait) {
-			DPU_ATRACE_BEGIN("wait_for_completion_event");
-			ret = fn_wait(phys);
-			DPU_ATRACE_END("wait_for_completion_event");
+		if (phys->ops.wait_for_tx_complete) {
+			DPU_ATRACE_BEGIN("wait_for_tx_complete");
+			ret = phys->ops.wait_for_tx_complete(phys);
+			DPU_ATRACE_END("wait_for_tx_complete");
 			if (ret)
 				return ret;
 		}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h
@@ -26,6 +26,7 @@
  * @h_tile_instance:    Controller instance used per tile. Number of elements is
  *                      based on num_of_h_tiles
  * @is_cmd_mode		Boolean to indicate if the CMD mode is requested
+ * @stream_id		stream id for which the interface needs to be acquired
  * @is_te_using_watchdog_timer:  Boolean to indicate watchdog TE is
  *				 used instead of panel TE in cmd mode panels
  */
@@ -34,6 +35,7 @@
 	uint32_t num_of_h_tiles;
 	uint32_t h_tile_instance[MAX_H_TILES_PER_DISPLAY];
 	bool is_cmd_mode;
+	int stream_id;
 	bool is_te_using_watchdog_timer;
 };
 
@@ -56,16 +58,6 @@
 					struct drm_crtc *crtc, bool enable);
 
 /**
- * dpu_encoder_register_frame_event_callback - provide callback to encoder that
- *	will be called after the request is complete, or other events.
- * @encoder:	encoder pointer
- * @cb:		callback pointer, provide NULL to deregister
- * @data:	user data provided to callback
- */
-void dpu_encoder_register_frame_event_callback(struct drm_encoder *encoder,
-		void (*cb)(void *, u32), void *data);
-
-/**
  * dpu_encoder_prepare_for_kickoff - schedule double buffer flip of the ctl
  *	path (i.e. ctl flush and start) at next appropriate time.
  *	Immediately: if no previous commit is outstanding.
@@ -93,25 +85,9 @@
  */
 int dpu_encoder_vsync_time(struct drm_encoder *drm_enc, ktime_t *wakeup_time);
 
-/**
- * dpu_encoder_wait_for_event - Waits for encoder events
- * @encoder:	encoder pointer
- * @event:      event to wait for
- * MSM_ENC_COMMIT_DONE -  Wait for hardware to have flushed the current pending
- *                        frames to hardware at a vblank or ctl_start
- *                        Encoders will map this differently depending on the
- *                        panel type.
- *	                  vid mode -> vsync_irq
- *                        cmd mode -> ctl_start
- * MSM_ENC_TX_COMPLETE -  Wait for the hardware to transfer all the pixels to
- *                        the panel. Encoders will map this differently
- *                        depending on the panel type.
- *                        vid mode -> vsync_irq
- *                        cmd mode -> pp_done
- * Returns: 0 on success, -EWOULDBLOCK if already signaled, error otherwise
- */
-int dpu_encoder_wait_for_event(struct drm_encoder *drm_encoder,
-						enum msm_event_wait event);
+int dpu_encoder_wait_for_commit_done(struct drm_encoder *drm_encoder);
+
+int dpu_encoder_wait_for_tx_complete(struct drm_encoder *drm_encoder);
 
 /*
  * dpu_encoder_get_intf_mode - get interface mode of the given encoder
@@ -156,9 +132,20 @@
  */
 int dpu_encoder_get_vsync_count(struct drm_encoder *drm_enc);
 
+/**
+ * dpu_encoder_is_widebus_enabled - return bool value if widebus is enabled
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ */
 bool dpu_encoder_is_widebus_enabled(const struct drm_encoder *drm_enc);
 
 /**
+ * dpu_encoder_is_dsc_enabled - indicate whether dsc is enabled
+ *				for the encoder.
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ */
+bool dpu_encoder_is_dsc_enabled(const struct drm_encoder *drm_enc);
+
+/**
  * dpu_encoder_get_crc_values_cnt - get number of physical encoders contained
  *	in virtual encoder that can collect CRC values
  * @drm_enc:    Pointer to previously created drm encoder structure
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h
@@ -154,6 +154,7 @@
  * @hw_wb:		Hardware interface to the wb registers
  * @hw_cdm:		Hardware interface to the CDM registers
  * @dpu_kms:		Pointer to the dpu_kms top level
+ * @cdm_cfg:		CDM block config needed to store WB/DP block's CDM configuration
  * @cached_mode:	DRM mode cached at mode_set time, acted on in enable
  * @vblank_ctl_lock:	Vblank ctl mutex lock to protect vblank_refcount
  * @enabled:		Whether the encoder has enabled and running a mode
@@ -184,6 +185,7 @@
 	struct dpu_hw_wb *hw_wb;
 	struct dpu_hw_cdm *hw_cdm;
 	struct dpu_kms *dpu_kms;
+	struct dpu_hw_cdm_cfg cdm_cfg;
 	struct drm_display_mode cached_mode;
 	struct mutex vblank_ctl_lock;
 	enum dpu_enc_split_role split_role;
@@ -213,7 +215,6 @@
  * @wbirq_refcount:     Reference count of writeback interrupt
  * @wb_done_timeout_cnt: number of wb done irq timeout errors
  * @wb_cfg:  writeback block config to store fb related details
- * @cdm_cfg: cdm block config needed to store writeback block's CDM configuration
  * @wb_conn: backpointer to writeback connector
  * @wb_job: backpointer to current writeback job
  * @dest:   dpu buffer layout for current writeback output buffer
@@ -223,7 +224,6 @@
 	atomic_t wbirq_refcount;
 	int wb_done_timeout_cnt;
 	struct dpu_hw_wb_cfg wb_cfg;
-	struct dpu_hw_cdm_cfg cdm_cfg;
 	struct drm_writeback_connector *wb_conn;
 	struct drm_writeback_job *wb_job;
 	struct dpu_hw_fmt_layout dest;
@@ -342,6 +342,19 @@
 unsigned int dpu_encoder_helper_get_dsc(struct dpu_encoder_phys *phys_enc);
 
 /**
+ * dpu_encoder_get_drm_fmt - return DRM fourcc format
+ * @phys_enc: Pointer to physical encoder structure
+ */
+u32 dpu_encoder_get_drm_fmt(struct dpu_encoder_phys *phys_enc);
+
+/**
+ * dpu_encoder_needs_periph_flush - return true if physical encoder requires
+ *	peripheral flush
+ * @phys_enc: Pointer to physical encoder structure
+ */
+bool dpu_encoder_needs_periph_flush(struct dpu_encoder_phys *phys_enc);
+
+/**
  * dpu_encoder_helper_split_config - split display configuration helper function
  *	This helper function may be used by physical encoders to configure
  *	the split display related registers.
@@ -382,6 +395,15 @@
 void dpu_encoder_helper_phys_cleanup(struct dpu_encoder_phys *phys_enc);
 
 /**
+ * dpu_encoder_helper_phys_setup_cdm - setup chroma down sampling block
+ * @phys_enc: Pointer to physical encoder
+ * @output_type: HDMI/WB
+ */
+void dpu_encoder_helper_phys_setup_cdm(struct dpu_encoder_phys *phys_enc,
+				       const struct dpu_format *dpu_fmt,
+				       u32 output_type);
+
+/**
  * dpu_encoder_vblank_callback - Notify virtual encoder of vblank IRQ reception
  * @drm_enc:    Pointer to drm encoder structure
  * @phys_enc:	Pointer to physical encoder
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c
@@ -451,9 +451,6 @@
 
 	_dpu_encoder_phys_cmd_pingpong_config(phys_enc);
 
-	if (!dpu_encoder_phys_cmd_is_master(phys_enc))
-		return;
-
 	ctl = phys_enc->hw_ctl;
 	ctl->ops.update_pending_flush_intf(ctl, phys_enc->hw_intf->idx);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
@@ -102,6 +102,7 @@
 	}
 
 	timing->wide_bus_en = dpu_encoder_is_widebus_enabled(phys_enc->parent);
+	timing->compression_en = dpu_encoder_is_dsc_enabled(phys_enc->parent);
 
 	/*
 	 * for DP, divide the horizonal parameters by 2 when
@@ -235,7 +236,7 @@
 	struct drm_display_mode mode;
 	struct dpu_hw_intf_timing_params timing_params = { 0 };
 	const struct dpu_format *fmt = NULL;
-	u32 fmt_fourcc = DRM_FORMAT_RGB888;
+	u32 fmt_fourcc;
 	unsigned long lock_flags;
 	struct dpu_hw_intf_cfg intf_cfg = { 0 };
 
@@ -254,17 +255,21 @@
 	DPU_DEBUG_VIDENC(phys_enc, "enabling mode:\n");
 	drm_mode_debug_printmodeline(&mode);
 
-	if (phys_enc->split_role != ENC_ROLE_SOLO) {
+	fmt_fourcc = dpu_encoder_get_drm_fmt(phys_enc);
+
+	if (phys_enc->split_role != ENC_ROLE_SOLO || fmt_fourcc == DRM_FORMAT_YUV420) {
 		mode.hdisplay >>= 1;
 		mode.htotal >>= 1;
 		mode.hsync_start >>= 1;
 		mode.hsync_end >>= 1;
+		mode.hskew >>= 1;
 
 		DPU_DEBUG_VIDENC(phys_enc,
-			"split_role %d, halve horizontal %d %d %d %d\n",
+			"split_role %d, halve horizontal %d %d %d %d %d\n",
 			phys_enc->split_role,
 			mode.hdisplay, mode.htotal,
-			mode.hsync_start, mode.hsync_end);
+			mode.hsync_start, mode.hsync_end,
+			mode.hskew);
 	}
 
 	drm_mode_to_intf_timing_params(phys_enc, &mode, &timing_params);
@@ -272,12 +277,14 @@
 	fmt = dpu_get_dpu_format(fmt_fourcc);
 	DPU_DEBUG_VIDENC(phys_enc, "fmt_fourcc 0x%X\n", fmt_fourcc);
 
+	if (phys_enc->hw_cdm)
+		intf_cfg.cdm = phys_enc->hw_cdm->idx;
 	intf_cfg.intf = phys_enc->hw_intf->idx;
 	intf_cfg.intf_mode_sel = DPU_CTL_MODE_SEL_VID;
 	intf_cfg.stream_sel = 0; /* Don't care value for video mode */
 	intf_cfg.mode_3d = dpu_encoder_helper_get_3d_blend_mode(phys_enc);
 	intf_cfg.dsc = dpu_encoder_helper_get_dsc(phys_enc);
-	if (phys_enc->hw_pp->merge_3d)
+	if (intf_cfg.mode_3d && phys_enc->hw_pp->merge_3d)
 		intf_cfg.merge_3d = phys_enc->hw_pp->merge_3d->idx;
 
 	spin_lock_irqsave(phys_enc->enc_spinlock, lock_flags);
@@ -412,8 +419,14 @@
 static void dpu_encoder_phys_vid_enable(struct dpu_encoder_phys *phys_enc)
 {
 	struct dpu_hw_ctl *ctl;
+	const struct dpu_format *fmt;
+	u32 fmt_fourcc;
+	u32 mode_3d;
 
 	ctl = phys_enc->hw_ctl;
+	fmt_fourcc = dpu_encoder_get_drm_fmt(phys_enc);
+	fmt = dpu_get_dpu_format(fmt_fourcc);
+	mode_3d = dpu_encoder_helper_get_3d_blend_mode(phys_enc);
 
 	DPU_DEBUG_VIDENC(phys_enc, "\n");
 
@@ -422,6 +435,8 @@
 
 	dpu_encoder_helper_split_config(phys_enc, phys_enc->hw_intf->idx);
 
+	dpu_encoder_helper_phys_setup_cdm(phys_enc, fmt, CDM_CDWN_OUTPUT_HDMI);
+
 	dpu_encoder_phys_vid_setup_timing_engine(phys_enc);
 
 	/*
@@ -434,9 +449,20 @@
 		goto skip_flush;
 
 	ctl->ops.update_pending_flush_intf(ctl, phys_enc->hw_intf->idx);
-	if (ctl->ops.update_pending_flush_merge_3d && phys_enc->hw_pp->merge_3d)
+	if (mode_3d && ctl->ops.update_pending_flush_merge_3d &&
+	    phys_enc->hw_pp->merge_3d)
 		ctl->ops.update_pending_flush_merge_3d(ctl, phys_enc->hw_pp->merge_3d->idx);
 
+	if (ctl->ops.update_pending_flush_cdm && phys_enc->hw_cdm)
+		ctl->ops.update_pending_flush_cdm(ctl, phys_enc->hw_cdm->idx);
+
+	/*
+	 * Peripheral flush must be updated whenever flushing SDP packets is needed.
+	 * SDP packets are required for any YUV format (YUV420, YUV422, YUV444).
+	 */
+	if (ctl->ops.update_pending_flush_periph && dpu_encoder_needs_periph_flush(phys_enc))
+		ctl->ops.update_pending_flush_periph(ctl, phys_enc->hw_intf->idx);
+
 skip_flush:
 	DPU_DEBUG_VIDENC(phys_enc,
 		"update pending flush ctl %d intf %d\n",
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
@@ -265,149 +265,6 @@
 }
 
 /**
- * dpu_encoder_helper_phys_setup_cdm - setup chroma down sampling block
- *                                     This API does not handle DPU_CHROMA_H1V2.
- * @phys_enc:Pointer to physical encoder
- */
-static void dpu_encoder_helper_phys_setup_cdm(struct dpu_encoder_phys *phys_enc)
-{
-	struct dpu_hw_cdm *hw_cdm;
-	struct dpu_hw_cdm_cfg *cdm_cfg;
-	struct dpu_hw_pingpong *hw_pp;
-	struct dpu_encoder_phys_wb *wb_enc;
-	const struct msm_format *format;
-	const struct dpu_format *dpu_fmt;
-	struct drm_writeback_job *wb_job;
-	int ret;
-
-	if (!phys_enc)
-		return;
-
-	wb_enc = to_dpu_encoder_phys_wb(phys_enc);
-	cdm_cfg = &wb_enc->cdm_cfg;
-	hw_pp = phys_enc->hw_pp;
-	hw_cdm = phys_enc->hw_cdm;
-	wb_job = wb_enc->wb_job;
-
-	format = msm_framebuffer_format(wb_enc->wb_job->fb);
-	dpu_fmt = dpu_get_dpu_format_ext(format->pixel_format, wb_job->fb->modifier);
-
-	if (!hw_cdm)
-		return;
-
-	if (!DPU_FORMAT_IS_YUV(dpu_fmt)) {
-		DPU_DEBUG("[enc:%d] cdm_disable fmt:%x\n", DRMID(phys_enc->parent),
-			  dpu_fmt->base.pixel_format);
-		if (hw_cdm->ops.bind_pingpong_blk)
-			hw_cdm->ops.bind_pingpong_blk(hw_cdm, PINGPONG_NONE);
-
-		return;
-	}
-
-	memset(cdm_cfg, 0, sizeof(struct dpu_hw_cdm_cfg));
-
-	cdm_cfg->output_width = wb_job->fb->width;
-	cdm_cfg->output_height = wb_job->fb->height;
-	cdm_cfg->output_fmt = dpu_fmt;
-	cdm_cfg->output_type = CDM_CDWN_OUTPUT_WB;
-	cdm_cfg->output_bit_depth = DPU_FORMAT_IS_DX(dpu_fmt) ?
-			CDM_CDWN_OUTPUT_10BIT : CDM_CDWN_OUTPUT_8BIT;
-	cdm_cfg->csc_cfg = &dpu_csc10_rgb2yuv_601l;
-
-	/* enable 10 bit logic */
-	switch (cdm_cfg->output_fmt->chroma_sample) {
-	case DPU_CHROMA_RGB:
-		cdm_cfg->h_cdwn_type = CDM_CDWN_DISABLE;
-		cdm_cfg->v_cdwn_type = CDM_CDWN_DISABLE;
-		break;
-	case DPU_CHROMA_H2V1:
-		cdm_cfg->h_cdwn_type = CDM_CDWN_COSITE;
-		cdm_cfg->v_cdwn_type = CDM_CDWN_DISABLE;
-		break;
-	case DPU_CHROMA_420:
-		cdm_cfg->h_cdwn_type = CDM_CDWN_COSITE;
-		cdm_cfg->v_cdwn_type = CDM_CDWN_OFFSITE;
-		break;
-	case DPU_CHROMA_H1V2:
-	default:
-		DPU_ERROR("[enc:%d] unsupported chroma sampling type\n",
-			  DRMID(phys_enc->parent));
-		cdm_cfg->h_cdwn_type = CDM_CDWN_DISABLE;
-		cdm_cfg->v_cdwn_type = CDM_CDWN_DISABLE;
-		break;
-	}
-
-	DPU_DEBUG("[enc:%d] cdm_enable:%d,%d,%X,%d,%d,%d,%d]\n",
-		  DRMID(phys_enc->parent), cdm_cfg->output_width,
-		  cdm_cfg->output_height, cdm_cfg->output_fmt->base.pixel_format,
-		  cdm_cfg->output_type, cdm_cfg->output_bit_depth,
-		  cdm_cfg->h_cdwn_type, cdm_cfg->v_cdwn_type);
-
-	if (hw_cdm->ops.enable) {
-		cdm_cfg->pp_id = hw_pp->idx;
-		ret = hw_cdm->ops.enable(hw_cdm, cdm_cfg);
-		if (ret < 0) {
-			DPU_ERROR("[enc:%d] failed to enable CDM; ret:%d\n",
-				  DRMID(phys_enc->parent), ret);
-			return;
-		}
-	}
-}
-
-/**
- * dpu_encoder_phys_wb_atomic_check - verify and fixup given atomic states
- * @phys_enc:	Pointer to physical encoder
- * @crtc_state:	Pointer to CRTC atomic state
- * @conn_state:	Pointer to connector atomic state
- */
-static int dpu_encoder_phys_wb_atomic_check(
-		struct dpu_encoder_phys *phys_enc,
-		struct drm_crtc_state *crtc_state,
-		struct drm_connector_state *conn_state)
-{
-	struct drm_framebuffer *fb;
-	const struct drm_display_mode *mode = &crtc_state->mode;
-
-	DPU_DEBUG("[atomic_check:%d, \"%s\",%d,%d]\n",
-			phys_enc->hw_wb->idx, mode->name, mode->hdisplay, mode->vdisplay);
-
-	if (!conn_state || !conn_state->connector) {
-		DPU_ERROR("invalid connector state\n");
-		return -EINVAL;
-	} else if (conn_state->connector->status !=
-			connector_status_connected) {
-		DPU_ERROR("connector not connected %d\n",
-				conn_state->connector->status);
-		return -EINVAL;
-	}
-
-	if (!conn_state->writeback_job || !conn_state->writeback_job->fb)
-		return 0;
-
-	fb = conn_state->writeback_job->fb;
-
-	DPU_DEBUG("[fb_id:%u][fb:%u,%u]\n", fb->base.id,
-			fb->width, fb->height);
-
-	if (fb->width != mode->hdisplay) {
-		DPU_ERROR("invalid fb w=%d, mode w=%d\n", fb->width,
-				mode->hdisplay);
-		return -EINVAL;
-	} else if (fb->height != mode->vdisplay) {
-		DPU_ERROR("invalid fb h=%d, mode h=%d\n", fb->height,
-				  mode->vdisplay);
-		return -EINVAL;
-	} else if (fb->width > phys_enc->hw_wb->caps->maxlinewidth) {
-		DPU_ERROR("invalid fb w=%d, maxlinewidth=%u\n",
-				  fb->width, phys_enc->hw_wb->caps->maxlinewidth);
-		return -EINVAL;
-	}
-
-	return drm_atomic_helper_check_wb_connector_state(conn_state->connector, conn_state->state);
-}
-
-
-/**
  * _dpu_encoder_phys_wb_update_flush - flush hardware update
  * @phys_enc:	Pointer to physical encoder
  */
@@ -418,6 +275,7 @@
 	struct dpu_hw_pingpong *hw_pp;
 	struct dpu_hw_cdm *hw_cdm;
 	u32 pending_flush = 0;
+	u32 mode_3d;
 
 	if (!phys_enc)
 		return;
@@ -426,6 +284,7 @@
 	hw_pp = phys_enc->hw_pp;
 	hw_ctl = phys_enc->hw_ctl;
 	hw_cdm = phys_enc->hw_cdm;
+	mode_3d = dpu_encoder_helper_get_3d_blend_mode(phys_enc);
 
 	DPU_DEBUG("[wb:%d]\n", hw_wb->idx - WB_0);
 
@@ -437,7 +296,8 @@
 	if (hw_ctl->ops.update_pending_flush_wb)
 		hw_ctl->ops.update_pending_flush_wb(hw_ctl, hw_wb->idx);
 
-	if (hw_ctl->ops.update_pending_flush_merge_3d && hw_pp && hw_pp->merge_3d)
+	if (mode_3d && hw_ctl->ops.update_pending_flush_merge_3d &&
+	    hw_pp && hw_pp->merge_3d)
 		hw_ctl->ops.update_pending_flush_merge_3d(hw_ctl,
 				hw_pp->merge_3d->idx);
 
@@ -462,6 +322,14 @@
 	struct dpu_hw_wb *hw_wb = phys_enc->hw_wb;
 	struct drm_display_mode mode = phys_enc->cached_mode;
 	struct drm_framebuffer *fb = NULL;
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+	struct drm_writeback_job *wb_job;
+	const struct msm_format *format;
+	const struct dpu_format *dpu_fmt;
+
+	wb_job = wb_enc->wb_job;
+	format = msm_framebuffer_format(wb_enc->wb_job->fb);
+	dpu_fmt = dpu_get_dpu_format_ext(format->pixel_format, wb_job->fb->modifier);
 
 	DPU_DEBUG("[mode_set:%d, \"%s\",%d,%d]\n",
 			hw_wb->idx - WB_0, mode.name,
@@ -475,7 +343,7 @@
 
 	dpu_encoder_phys_wb_setup_fb(phys_enc, fb);
 
-	dpu_encoder_helper_phys_setup_cdm(phys_enc);
+	dpu_encoder_helper_phys_setup_cdm(phys_enc, dpu_fmt, CDM_CDWN_OUTPUT_WB);
 
 	dpu_encoder_phys_wb_setup_ctl(phys_enc);
 }
@@ -663,8 +531,7 @@
 	}
 
 	/* reset h/w before final flush */
-	if (phys_enc->hw_ctl->ops.clear_pending_flush)
-		phys_enc->hw_ctl->ops.clear_pending_flush(phys_enc->hw_ctl);
+	phys_enc->hw_ctl->ops.clear_pending_flush(phys_enc->hw_ctl);
 
 	/*
 	 * New CTL reset sequence from 5.0 MDP onwards.
@@ -777,7 +644,6 @@
 	ops->atomic_mode_set = dpu_encoder_phys_wb_atomic_mode_set;
 	ops->enable = dpu_encoder_phys_wb_enable;
 	ops->disable = dpu_encoder_phys_wb_disable;
-	ops->atomic_check = dpu_encoder_phys_wb_atomic_check;
 	ops->wait_for_commit_done = dpu_encoder_phys_wb_wait_for_commit_done;
 	ops->prepare_for_kickoff = dpu_encoder_phys_wb_prepare_for_kickoff;
 	ops->handle_post_kickoff = dpu_encoder_phys_wb_handle_post_kickoff;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
@@ -220,12 +220,9 @@
 	DRM_FORMAT_RGBA4444,
 	DRM_FORMAT_RGBX4444,
 	DRM_FORMAT_XRGB4444,
-	DRM_FORMAT_BGR565,
 	DRM_FORMAT_BGR888,
-	DRM_FORMAT_ABGR8888,
 	DRM_FORMAT_BGRA8888,
 	DRM_FORMAT_BGRX8888,
-	DRM_FORMAT_XBGR8888,
 	DRM_FORMAT_ABGR1555,
 	DRM_FORMAT_BGRA5551,
 	DRM_FORMAT_XBGR1555,
@@ -254,12 +251,9 @@
 	DRM_FORMAT_RGBA4444,
 	DRM_FORMAT_RGBX4444,
 	DRM_FORMAT_XRGB4444,
-	DRM_FORMAT_BGR565,
 	DRM_FORMAT_BGR888,
-	DRM_FORMAT_ABGR8888,
 	DRM_FORMAT_BGRA8888,
 	DRM_FORMAT_BGRX8888,
-	DRM_FORMAT_XBGR8888,
 	DRM_FORMAT_ABGR1555,
 	DRM_FORMAT_BGRA5551,
 	DRM_FORMAT_XBGR1555,
@@ -314,8 +308,8 @@
 	{ \
 	.maxdwnscale = SSPP_UNITY_SCALE, \
 	.maxupscale = SSPP_UNITY_SCALE, \
-	.format_list = plane_formats_yuv, \
-	.num_formats = ARRAY_SIZE(plane_formats_yuv), \
+	.format_list = plane_formats, \
+	.num_formats = ARRAY_SIZE(plane_formats), \
 	.virt_format_list = plane_formats, \
 	.virt_num_formats = ARRAY_SIZE(plane_formats), \
 	}
@@ -700,6 +694,8 @@
 
 #include "catalog/dpu_8_0_sc8280xp.h"
 #include "catalog/dpu_8_1_sm8450.h"
+#include "catalog/dpu_8_4_qcs8300.h"
+#include "catalog/dpu_8_4_sa8775p.h"
 
 #include "catalog/dpu_9_0_sm8550.h"
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
  * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
  */
 
@@ -847,6 +847,8 @@
 extern const struct dpu_mdss_cfg dpu_sc7280_cfg;
 extern const struct dpu_mdss_cfg dpu_sc8280xp_cfg;
 extern const struct dpu_mdss_cfg dpu_sm8450_cfg;
+extern const struct dpu_mdss_cfg dpu_qcs8300_cfg;
+extern const struct dpu_mdss_cfg dpu_sa8775p_cfg;
 extern const struct dpu_mdss_cfg dpu_sm8550_cfg;
 extern const struct dpu_mdss_cfg dpu_sm8650_cfg;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cdm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cdm.c
@@ -186,7 +186,7 @@
 	dpu_hw_cdm_setup_cdwn(ctx, cdm);
 
 	if (cdm->output_type == CDM_CDWN_OUTPUT_HDMI) {
-		if (fmt->chroma_sample != DPU_CHROMA_H1V2)
+		if (fmt->chroma_sample == DPU_CHROMA_H1V2)
 			return -EINVAL; /*unsupported format */
 		opmode = CDM_HDMI_PACK_OP_MODE_EN;
 		opmode |= (fmt->chroma_sample << 1);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
@@ -39,6 +39,7 @@
 #define   CTL_WB_FLUSH                  0x108
 #define   CTL_INTF_FLUSH                0x110
 #define   CTL_CDM_FLUSH                0x114
+#define   CTL_PERIPH_FLUSH              0x128
 #define   CTL_INTF_MASTER               0x134
 #define   CTL_DSPP_n_FLUSH(n)           ((0x13C) + ((n) * 4))
 
@@ -49,6 +50,7 @@
 #define  MERGE_3D_IDX   23
 #define  DSC_IDX        22
 #define CDM_IDX         26
+#define  PERIPH_IDX     30
 #define  INTF_IDX       31
 #define WB_IDX          16
 #define  DSPP_IDX       29  /* From DPU hw rev 7.x.x */
@@ -151,6 +153,10 @@
 				ctx->pending_dspp_flush_mask[dspp - DSPP_0]);
 		}
 
+	if (ctx->pending_flush_mask & BIT(PERIPH_IDX))
+		DPU_REG_WRITE(&ctx->hw, CTL_PERIPH_FLUSH,
+			      ctx->pending_periph_flush_mask);
+
 	if (ctx->pending_flush_mask & BIT(DSC_IDX))
 		DPU_REG_WRITE(&ctx->hw, CTL_DSC_FLUSH,
 			      ctx->pending_dsc_flush_mask);
@@ -311,6 +317,13 @@
 	ctx->pending_flush_mask |= BIT(INTF_IDX);
 }
 
+static void dpu_hw_ctl_update_pending_flush_periph_v1(struct dpu_hw_ctl *ctx,
+						      enum dpu_intf intf)
+{
+	ctx->pending_periph_flush_mask |= BIT(intf - INTF_0);
+	ctx->pending_flush_mask |= BIT(PERIPH_IDX);
+}
+
 static void dpu_hw_ctl_update_pending_flush_merge_3d_v1(struct dpu_hw_ctl *ctx,
 		enum dpu_merge_3d merge_3d)
 {
@@ -532,6 +545,7 @@
 {
 	struct dpu_hw_blk_reg_map *c = &ctx->hw;
 	u32 intf_active = 0;
+	u32 dsc_active = 0;
 	u32 wb_active = 0;
 	u32 mode_sel = 0;
 
@@ -547,6 +561,7 @@
 
 	intf_active = DPU_REG_READ(c, CTL_INTF_ACTIVE);
 	wb_active = DPU_REG_READ(c, CTL_WB_ACTIVE);
+	dsc_active = DPU_REG_READ(c, CTL_DSC_ACTIVE);
 
 	if (cfg->intf)
 		intf_active |= BIT(cfg->intf - INTF_0);
@@ -554,17 +569,18 @@
 	if (cfg->wb)
 		wb_active |= BIT(cfg->wb - WB_0);
 
+	if (cfg->dsc)
+		dsc_active |= cfg->dsc;
+
 	DPU_REG_WRITE(c, CTL_TOP, mode_sel);
 	DPU_REG_WRITE(c, CTL_INTF_ACTIVE, intf_active);
 	DPU_REG_WRITE(c, CTL_WB_ACTIVE, wb_active);
+	DPU_REG_WRITE(c, CTL_DSC_ACTIVE, dsc_active);
 
 	if (cfg->merge_3d)
 		DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE,
 			      BIT(cfg->merge_3d - MERGE_3D_0));
 
-	if (cfg->dsc)
-		DPU_REG_WRITE(c, CTL_DSC_ACTIVE, cfg->dsc);
-
 	if (cfg->cdm)
 		DPU_REG_WRITE(c, CTL_CDM_ACTIVE, cfg->cdm);
 }
@@ -680,6 +696,10 @@
 		ops->reset_intf_cfg = dpu_hw_ctl_reset_intf_cfg_v1;
 		ops->update_pending_flush_intf =
 			dpu_hw_ctl_update_pending_flush_intf_v1;
+
+		ops->update_pending_flush_periph =
+			dpu_hw_ctl_update_pending_flush_periph_v1;
+
 		ops->update_pending_flush_merge_3d =
 			dpu_hw_ctl_update_pending_flush_merge_3d_v1;
 		ops->update_pending_flush_wb = dpu_hw_ctl_update_pending_flush_wb_v1;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h
@@ -83,7 +83,8 @@
 
 	/**
 	 * Clear the value of the cached pending_flush_mask
-	 * No effect on hardware
+	 * No effect on hardware.
+	 * Required to be implemented.
 	 * @ctx       : ctl path ctx pointer
 	 */
 	void (*clear_pending_flush)(struct dpu_hw_ctl *ctx);
@@ -123,6 +124,15 @@
 		enum dpu_intf blk);
 
 	/**
+	 * OR in the given flushbits to the cached pending_(periph_)flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 * @blk       : interface block index
+	 */
+	void (*update_pending_flush_periph)(struct dpu_hw_ctl *ctx,
+					    enum dpu_intf blk);
+
+	/**
 	 * OR in the given flushbits to the cached pending_(merge_3d_)flush_mask
 	 * No effect on hardware
 	 * @ctx       : ctl path ctx pointer
@@ -264,6 +274,7 @@
 	u32 pending_flush_mask;
 	u32 pending_intf_flush_mask;
 	u32 pending_wb_flush_mask;
+	u32 pending_periph_flush_mask;
 	u32 pending_merge_3d_flush_mask;
 	u32 pending_dspp_flush_mask[DSPP_MAX - DSPP_0];
 	u32 pending_dsc_flush_mask;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c
@@ -223,9 +223,11 @@
 
 	VERB("IRQ=[%d, %d]\n", DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
 
-	if (!irq_entry->cb)
+	if (!irq_entry->cb) {
 		DRM_ERROR("no registered cb, IRQ=[%d, %d]\n",
 			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+		return;
+	}
 
 	atomic_inc(&irq_entry->count);
 
@@ -525,14 +527,14 @@
 	int ret;
 
 	if (!irq_cb) {
-		DPU_ERROR("invalid IRQ=[%d, %d] irq_cb:%ps\n",
-			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx), irq_cb);
+		DPU_ERROR("IRQ=[%d, %d] NULL callback\n",
+			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
 		return -EINVAL;
 	}
 
 	if (!dpu_core_irq_is_valid(irq_idx)) {
-		DPU_ERROR("invalid IRQ=[%d, %d]\n",
-			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+		DPU_ERROR("invalid IRQ=[%d, %d] irq_cb:%ps\n",
+			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx), irq_cb);
 		return -EINVAL;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
@@ -163,13 +163,8 @@
 	hsync_ctl = (hsync_period << 16) | p->hsync_pulse_width;
 	display_hctl = (hsync_end_x << 16) | hsync_start_x;
 
-	/*
-	 * DATA_HCTL_EN controls data timing which can be different from
-	 * video timing. It is recommended to enable it for all cases, except
-	 * if compression is enabled in 1 pixel per clock mode
-	 */
 	if (p->wide_bus_en)
-		intf_cfg2 |= INTF_CFG2_DATABUS_WIDEN | INTF_CFG2_DATA_HCTL_EN;
+		intf_cfg2 |= INTF_CFG2_DATABUS_WIDEN;
 
 	data_width = p->width;
 
@@ -229,6 +224,14 @@
 	DPU_REG_WRITE(c, INTF_CONFIG, intf_cfg);
 	DPU_REG_WRITE(c, INTF_PANEL_FORMAT, panel_format);
 	if (ctx->cap->features & BIT(DPU_DATA_HCTL_EN)) {
+		/*
+		 * DATA_HCTL_EN controls data timing which can be different from
+		 * video timing. It is recommended to enable it for all cases, except
+		 * if compression is enabled in 1 pixel per clock mode
+		 */
+		if (!(p->compression_en && !p->wide_bus_en))
+			intf_cfg2 |= INTF_CFG2_DATA_HCTL_EN;
+
 		DPU_REG_WRITE(c, INTF_CONFIG2, intf_cfg2);
 		DPU_REG_WRITE(c, INTF_DISPLAY_DATA_HCTL, display_data_hctl);
 		DPU_REG_WRITE(c, INTF_ACTIVE_DATA_HCTL, active_data_hctl);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
@@ -33,6 +33,7 @@
 	u32 hsync_skew;
 
 	bool wide_bus_en;
+	bool compression_en;
 };
 
 struct dpu_hw_intf_prog_fetch {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
@@ -2,7 +2,7 @@
 /*
  * Copyright (C) 2013 Red Hat
  * Copyright (c) 2014-2018, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Author: Rob Clark <robdclark@gmail.com>
  */
@@ -374,6 +374,12 @@
 	return 0;
 }
 
+static void dpu_kms_global_obj_fini(struct dpu_kms *dpu_kms)
+{
+	drm_atomic_private_obj_fini(&dpu_kms->global_state);
+	drm_modeset_lock_fini(&dpu_kms->global_state_lock);
+}
+
 static int dpu_kms_parse_data_bus_icc_path(struct dpu_kms *dpu_kms)
 {
 	struct icc_path *path0;
@@ -478,7 +484,7 @@
 		 * mode panels. This may be a no-op for command mode panels.
 		 */
 		trace_dpu_kms_wait_for_commit_done(DRMID(crtc));
-		ret = dpu_encoder_wait_for_event(encoder, MSM_ENC_COMMIT_DONE);
+		ret = dpu_encoder_wait_for_commit_done(encoder);
 		if (ret && ret != -EWOULDBLOCK) {
 			DPU_ERROR("wait for commit done returned %d\n", ret);
 			break;
@@ -565,8 +571,10 @@
 {
 	struct drm_encoder *encoder = NULL;
 	struct msm_display_info info;
+	bool yuv_supported;
 	int rc;
-	int i;
+	int i, stream_id;
+	int stream_cnt;
 
 	for (i = 0; i < ARRAY_SIZE(priv->dp); i++) {
 		if (!priv->dp[i])
@@ -583,11 +591,38 @@
 			return PTR_ERR(encoder);
 		}
 
-		rc = msm_dp_modeset_init(priv->dp[i], dev, encoder);
+		yuv_supported = !!dpu_kms->catalog->cdm;
+		rc = msm_dp_modeset_init(priv->dp[i], dev, encoder, yuv_supported);
 		if (rc) {
 			DPU_ERROR("modeset_init failed for DP, rc = %d\n", rc);
 			return rc;
 		}
+
+		stream_cnt = msm_dp_get_mst_max_stream(priv->dp[i]);
+
+		if (stream_cnt > 1) {
+			rc = msm_dp_mst_register(priv->dp[i]);
+			if (rc) {
+				DPU_ERROR("dp_mst_init failed for DP, rc = %d\n", rc);
+				return rc;
+			}
+
+			for (stream_id = 0; stream_id < stream_cnt; stream_id++) {
+				info.stream_id = stream_id;
+				encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_DPMST, &info);
+				if (IS_ERR(encoder)) {
+					DPU_ERROR("encoder init failed for dp mst display\n");
+					return PTR_ERR(encoder);
+				}
+
+				rc = msm_dp_mst_bridge_init(priv->dp[i], encoder);
+				if (rc) {
+					DPU_ERROR("dp mst bridge %d init failed, %d\n",
+						  stream_id, rc);
+					continue;
+				}
+			}
+		}
 	}
 
 	return 0;
@@ -630,23 +665,26 @@
 {
 	struct drm_encoder *encoder = NULL;
 	struct msm_display_info info;
+	const enum dpu_wb wb_idx = WB_2;
+	u32 maxlinewidth;
 	int rc;
 
 	memset(&info, 0, sizeof(info));
 
 	info.num_of_h_tiles = 1;
 	/* use only WB idx 2 instance for DPU */
-	info.h_tile_instance[0] = WB_2;
+	info.h_tile_instance[0] = wb_idx;
 	info.intf_type = INTF_WB;
 
+	maxlinewidth = dpu_rm_get_wb(&dpu_kms->rm, info.h_tile_instance[0])->caps->maxlinewidth;
+
 	encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_VIRTUAL, &info);
 	if (IS_ERR(encoder)) {
 		DPU_ERROR("encoder init failed for dsi display\n");
 		return PTR_ERR(encoder);
 	}
 
-	rc = dpu_writeback_init(dev, encoder, wb_formats,
-			n_formats);
+	rc = dpu_writeback_init(dev, encoder, wb_formats, n_formats, maxlinewidth);
 	if (rc) {
 		DPU_ERROR("dpu_writeback_init, rc = %d\n", rc);
 		return rc;
@@ -801,6 +839,8 @@
 		dpu_kms->hw_vbif[i] = NULL;
 	}
 
+	dpu_kms_global_obj_fini(dpu_kms);
+
 	dpu_kms->catalog = NULL;
 
 	dpu_kms->hw_mdp = NULL;
@@ -1332,6 +1372,8 @@
 	{ .compatible = "qcom,sm8250-dpu", .data = &dpu_sm8250_cfg, },
 	{ .compatible = "qcom,sm8350-dpu", .data = &dpu_sm8350_cfg, },
 	{ .compatible = "qcom,sm8450-dpu", .data = &dpu_sm8450_cfg, },
+	{ .compatible = "qcom,qcs8300-dpu", .data = &dpu_qcs8300_cfg, },
+	{ .compatible = "qcom,sa8775p-dpu", .data = &dpu_sa8775p_cfg, },
 	{ .compatible = "qcom,sm8550-dpu", .data = &dpu_sm8550_cfg, },
 	{ .compatible = "qcom,sm8650-dpu", .data = &dpu_sm8650_cfg, },
 	{}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h
@@ -31,24 +31,14 @@
  * @fmt: Pointer to format string
  */
 #define DPU_DEBUG(fmt, ...)                                                \
-	do {                                                               \
-		if (drm_debug_enabled(DRM_UT_KMS))                         \
-			DRM_DEBUG(fmt, ##__VA_ARGS__); \
-		else                                                       \
-			pr_debug(fmt, ##__VA_ARGS__);                      \
-	} while (0)
+	DRM_DEBUG_DRIVER(fmt, ##__VA_ARGS__)
 
 /**
  * DPU_DEBUG_DRIVER - macro for hardware driver logging
  * @fmt: Pointer to format string
  */
 #define DPU_DEBUG_DRIVER(fmt, ...)                                         \
-	do {                                                               \
-		if (drm_debug_enabled(DRM_UT_DRIVER))                      \
-			DRM_ERROR(fmt, ##__VA_ARGS__); \
-		else                                                       \
-			pr_debug(fmt, ##__VA_ARGS__);                      \
-	} while (0)
+	DRM_DEBUG_DRIVER(fmt, ##__VA_ARGS__)
 
 #define DPU_ERROR(fmt, ...) pr_err("[dpu error]" fmt, ##__VA_ARGS__)
 #define DPU_ERROR_RATELIMITED(fmt, ...) pr_err_ratelimited("[dpu error]" fmt, ##__VA_ARGS__)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
@@ -679,6 +679,9 @@
 			new_state->fb, &layout);
 	if (ret) {
 		DPU_ERROR_PLANE(pdpu, "failed to get format layout, %d\n", ret);
+		if (pstate->aspace)
+			msm_framebuffer_cleanup(new_state->fb, pstate->aspace,
+						pstate->needs_dirtyfb);
 		return ret;
 	}
 
@@ -742,10 +745,9 @@
 	min_src_size = DPU_FORMAT_IS_YUV(fmt) ? 2 : 1;
 
 	if (DPU_FORMAT_IS_YUV(fmt) &&
-	    (!pipe->sspp->cap->sblk->scaler_blk.len ||
-	     !pipe->sspp->cap->sblk->csc_blk.len)) {
+	    !pipe->sspp->cap->sblk->csc_blk.len) {
 		DPU_DEBUG_PLANE(pdpu,
-				"plane doesn't have scaler/csc for yuv\n");
+				"plane doesn't have csc for yuv\n");
 		return -EINVAL;
 	}
 
@@ -862,6 +864,10 @@
 
 	max_linewidth = pdpu->catalog->caps->max_linewidth;
 
+	drm_rect_rotate(&pipe_cfg->src_rect,
+			new_plane_state->fb->width, new_plane_state->fb->height,
+			new_plane_state->rotation);
+
 	if ((drm_rect_width(&pipe_cfg->src_rect) > max_linewidth) ||
 	     _dpu_plane_calc_clk(&crtc_state->adjusted_mode, pipe_cfg) > max_mdp_clk_rate) {
 		/*
@@ -911,6 +917,14 @@
 		r_pipe_cfg->dst_rect.x1 = pipe_cfg->dst_rect.x2;
 	}
 
+	drm_rect_rotate_inv(&pipe_cfg->src_rect,
+			    new_plane_state->fb->width, new_plane_state->fb->height,
+			    new_plane_state->rotation);
+	if (r_pipe->sspp)
+		drm_rect_rotate_inv(&r_pipe_cfg->src_rect,
+				    new_plane_state->fb->width, new_plane_state->fb->height,
+				    new_plane_state->rotation);
+
 	ret = dpu_plane_atomic_check_pipe(pdpu, pipe, pipe_cfg, fmt, &crtc_state->adjusted_mode);
 	if (ret)
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_trace.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_trace.h
@@ -350,10 +350,6 @@
 	TP_PROTO(uint32_t drm_id, bool enable),
 	TP_ARGS(drm_id, enable)
 );
-DEFINE_EVENT(dpu_enc_id_enable_template, dpu_enc_frame_event_cb,
-	TP_PROTO(uint32_t drm_id, bool enable),
-	TP_ARGS(drm_id, enable)
-);
 DEFINE_EVENT(dpu_enc_id_enable_template, dpu_enc_phys_cmd_connect_te,
 	TP_PROTO(uint32_t drm_id, bool enable),
 	TP_ARGS(drm_id, enable)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c
@@ -4,6 +4,7 @@
  */
 
 #include <drm/drm_edid.h>
+#include <drm/drm_framebuffer.h>
 
 #include "dpu_writeback.h"
 
@@ -24,6 +25,61 @@
 			dev->mode_config.max_height);
 }
 
+static int dpu_wb_conn_atomic_check(struct drm_connector *connector,
+				    struct drm_atomic_state *state)
+{
+	struct drm_writeback_connector *wb_conn = drm_connector_to_writeback(connector);
+	struct dpu_wb_connector *dpu_wb_conn = to_dpu_wb_conn(wb_conn);
+	struct drm_connector_state *conn_state =
+		drm_atomic_get_new_connector_state(state, connector);
+	struct drm_crtc *crtc;
+	struct drm_crtc_state *crtc_state;
+	const struct drm_display_mode *mode;
+	struct drm_framebuffer *fb;
+
+	DPU_DEBUG("[atomic_check:%d]\n", connector->base.id);
+
+	if (!conn_state || !conn_state->connector) {
+		DPU_ERROR("invalid connector state\n");
+		return -EINVAL;
+	} else if (conn_state->connector->status != connector_status_connected) {
+		DPU_ERROR("connector not connected %d\n", conn_state->connector->status);
+		return -EINVAL;
+	}
+
+	crtc = conn_state->crtc;
+	if (!crtc)
+		return 0;
+
+	if (!conn_state->writeback_job || !conn_state->writeback_job->fb)
+		return 0;
+
+	crtc_state = drm_atomic_get_crtc_state(state, crtc);
+	if (IS_ERR(crtc_state))
+		return PTR_ERR(crtc_state);
+
+	mode = &crtc_state->mode;
+
+	fb = conn_state->writeback_job->fb;
+
+	DPU_DEBUG("[fb_id:%u][fb:%u,%u][mode:\"%s\":%ux%u]\n", fb->base.id, fb->width, fb->height,
+		  mode->name, mode->hdisplay, mode->vdisplay);
+
+	if (fb->width != mode->hdisplay) {
+		DPU_ERROR("invalid fb w=%d, mode w=%d\n", fb->width, mode->hdisplay);
+		return -EINVAL;
+	} else if (fb->height != mode->vdisplay) {
+		DPU_ERROR("invalid fb h=%d, mode h=%d\n", fb->height, mode->vdisplay);
+		return -EINVAL;
+	} else if (fb->width > dpu_wb_conn->maxlinewidth) {
+		DPU_ERROR("invalid fb w=%d, maxlinewidth=%u\n",
+			  fb->width, dpu_wb_conn->maxlinewidth);
+		return -EINVAL;
+	}
+
+	return drm_atomic_helper_check_wb_connector_state(conn_state->connector, conn_state->state);
+}
+
 static const struct drm_connector_funcs dpu_wb_conn_funcs = {
 	.reset = drm_atomic_helper_connector_reset,
 	.fill_modes = drm_helper_probe_single_connector_modes,
@@ -59,12 +115,13 @@
 
 static const struct drm_connector_helper_funcs dpu_wb_conn_helper_funcs = {
 	.get_modes = dpu_wb_conn_get_modes,
+	.atomic_check = dpu_wb_conn_atomic_check,
 	.prepare_writeback_job = dpu_wb_conn_prepare_job,
 	.cleanup_writeback_job = dpu_wb_conn_cleanup_job,
 };
 
 int dpu_writeback_init(struct drm_device *dev, struct drm_encoder *enc,
-		const u32 *format_list, u32 num_formats)
+		const u32 *format_list, u32 num_formats, u32 maxlinewidth)
 {
 	struct dpu_wb_connector *dpu_wb_conn;
 	int rc = 0;
@@ -73,6 +130,8 @@
 	if (!dpu_wb_conn)
 		return -ENOMEM;
 
+	dpu_wb_conn->maxlinewidth = maxlinewidth;
+
 	drm_connector_helper_add(&dpu_wb_conn->base.base, &dpu_wb_conn_helper_funcs);
 
 	/* DPU initializes the encoder and sets it up completely for writeback
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.h
@@ -18,6 +18,7 @@
 struct dpu_wb_connector {
 	struct drm_writeback_connector base;
 	struct drm_encoder *wb_enc;
+	u32 maxlinewidth;
 };
 
 static inline struct dpu_wb_connector *to_dpu_wb_conn(struct drm_writeback_connector *conn)
@@ -26,6 +27,6 @@
 }
 
 int dpu_writeback_init(struct drm_device *dev, struct drm_encoder *enc,
-		const u32 *format_list, u32 num_formats);
+		const u32 *format_list, u32 num_formats, u32 maxlinewidth);
 
 #endif /*_DPU_WRITEBACK_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.h
@@ -69,6 +69,16 @@
 	uint32_t caps;			/* MDP capabilities: MDP_CAP_xxx bits */
 };
 
+struct mdp5_wb_instance {
+	int id;
+	int lm;
+};
+
+struct mdp5_wb_block {
+	MDP5_SUB_BLOCK_DEFINITION;
+	struct mdp5_wb_instance instances[MAX_BASES];
+};
+
 #define MDP5_INTF_NUM_MAX	5
 
 struct mdp5_intf_block {
@@ -98,6 +108,7 @@
 	struct mdp5_sub_block pp;
 	struct mdp5_sub_block dsc;
 	struct mdp5_sub_block cdm;
+	struct mdp5_wb_block wb;
 	struct mdp5_intf_block intf;
 	struct mdp5_perf_block perf;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c
@@ -356,7 +356,7 @@
 
 			drm_printf(p, "%s:%d\t%d\t%s\n",
 				pipe2name(pipe), j, inuse,
-				plane ? plane->name : NULL);
+				plane ? plane->name : "(null)");
 
 			total += inuse;
 		}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
@@ -26,7 +26,7 @@
 	end_addr = base_addr + aligned_len;
 
 	if (!(*reg))
-		*reg = kzalloc(len_padded, GFP_KERNEL);
+		*reg = kvzalloc(len_padded, GFP_KERNEL);
 
 	if (*reg)
 		dump_addr = *reg;
@@ -48,20 +48,21 @@
 	}
 }
 
-static void msm_disp_state_print_regs(u32 **reg, u32 len, void __iomem *base_addr,
-		struct drm_printer *p)
+static void msm_disp_state_print_regs(const u32 *dump_addr, u32 len,
+		void __iomem *base_addr, struct drm_printer *p)
 {
 	int i;
-	u32 *dump_addr = NULL;
 	void __iomem *addr;
 	u32 num_rows;
 
+	if (!dump_addr) {
+		drm_printf(p, "Registers not stored\n");
+		return;
+	}
+
 	addr = base_addr;
 	num_rows = len / REG_DUMP_ALIGN;
 
-	if (*reg)
-		dump_addr = *reg;
-
 	for (i = 0; i < num_rows; i++) {
 		drm_printf(p, "0x%lx : %08x %08x %08x %08x\n",
 				(unsigned long)(addr - base_addr),
@@ -89,7 +90,7 @@
 
 	list_for_each_entry_safe(block, tmp, &state->blocks, node) {
 		drm_printf(p, "====================%s================\n", block->name);
-		msm_disp_state_print_regs(&block->state, block->size, block->base_addr, p);
+		msm_disp_state_print_regs(block->state, block->size, block->base_addr, p);
 	}
 
 	drm_printf(p, "===================dpu drm state================\n");
@@ -161,7 +162,7 @@
 
 	list_for_each_entry_safe(block, tmp, &disp_state->blocks, node) {
 		list_del(&block->node);
-		kfree(block->state);
+		kvfree(block->state);
 		kfree(block);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_audio.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_audio.c
@@ -15,363 +15,283 @@
 #include "dp_audio.h"
 #include "dp_panel.h"
 #include "dp_display.h"
+#include "dp_utils.h"
 
-#define HEADER_BYTE_2_BIT	 0
-#define PARITY_BYTE_2_BIT	 8
-#define HEADER_BYTE_1_BIT	16
-#define PARITY_BYTE_1_BIT	24
-#define HEADER_BYTE_3_BIT	16
-#define PARITY_BYTE_3_BIT	24
-
-struct dp_audio_private {
+struct msm_dp_audio_private {
 	struct platform_device *audio_pdev;
 	struct platform_device *pdev;
 	struct drm_device *drm_dev;
-	struct dp_catalog *catalog;
-	struct dp_panel *panel;
+	struct msm_dp_catalog *catalog;
 
-	bool engine_on;
 	u32 channels;
 
-	struct dp_audio dp_audio;
+	struct msm_dp_audio msm_dp_audio;
 };
 
-static u8 dp_audio_get_g0_value(u8 data)
-{
-	u8 c[4];
-	u8 g[4];
-	u8 ret_data = 0;
-	u8 i;
-
-	for (i = 0; i < 4; i++)
-		c[i] = (data >> i) & 0x01;
-
-	g[0] = c[3];
-	g[1] = c[0] ^ c[3];
-	g[2] = c[1];
-	g[3] = c[2];
-
-	for (i = 0; i < 4; i++)
-		ret_data = ((g[i] & 0x01) << i) | ret_data;
-
-	return ret_data;
-}
-
-static u8 dp_audio_get_g1_value(u8 data)
-{
-	u8 c[4];
-	u8 g[4];
-	u8 ret_data = 0;
-	u8 i;
-
-	for (i = 0; i < 4; i++)
-		c[i] = (data >> i) & 0x01;
-
-	g[0] = c[0] ^ c[3];
-	g[1] = c[0] ^ c[1] ^ c[3];
-	g[2] = c[1] ^ c[2];
-	g[3] = c[2] ^ c[3];
-
-	for (i = 0; i < 4; i++)
-		ret_data = ((g[i] & 0x01) << i) | ret_data;
-
-	return ret_data;
-}
-
-static u8 dp_audio_calculate_parity(u32 data)
+static u32 msm_dp_audio_get_header(struct msm_dp_catalog *catalog,
+		enum msm_dp_catalog_audio_sdp_type sdp,
+		enum msm_dp_catalog_audio_header_type header)
 {
-	u8 x0 = 0;
-	u8 x1 = 0;
-	u8 ci = 0;
-	u8 iData = 0;
-	u8 i = 0;
-	u8 parity_byte;
-	u8 num_byte = (data & 0xFF00) > 0 ? 8 : 2;
-
-	for (i = 0; i < num_byte; i++) {
-		iData = (data >> i*4) & 0xF;
-
-		ci = iData ^ x1;
-		x1 = x0 ^ dp_audio_get_g1_value(ci);
-		x0 = dp_audio_get_g0_value(ci);
-	}
-
-	parity_byte = x1 | (x0 << 4);
-
-	return parity_byte;
-}
-
-static u32 dp_audio_get_header(struct dp_catalog *catalog,
-		enum dp_catalog_audio_sdp_type sdp,
-		enum dp_catalog_audio_header_type header)
-{
-	catalog->sdp_type = sdp;
-	catalog->sdp_header = header;
-	dp_catalog_audio_get_header(catalog);
-
-	return catalog->audio_data;
+	return msm_dp_catalog_audio_get_header(catalog, sdp, header);
 }
 
-static void dp_audio_set_header(struct dp_catalog *catalog,
+static void msm_dp_audio_set_header(struct msm_dp_catalog *catalog,
 		u32 data,
-		enum dp_catalog_audio_sdp_type sdp,
-		enum dp_catalog_audio_header_type header)
+		enum msm_dp_catalog_audio_sdp_type sdp,
+		enum msm_dp_catalog_audio_header_type header)
 {
-	catalog->sdp_type = sdp;
-	catalog->sdp_header = header;
-	catalog->audio_data = data;
-	dp_catalog_audio_set_header(catalog);
+	msm_dp_catalog_audio_set_header(catalog, sdp, header, data);
 }
 
-static void dp_audio_stream_sdp(struct dp_audio_private *audio)
+static void msm_dp_audio_stream_sdp(struct msm_dp_audio_private *audio)
 {
-	struct dp_catalog *catalog = audio->catalog;
+	struct msm_dp_catalog *catalog = audio->catalog;
 	u32 value, new_value;
 	u8 parity_byte;
 
 	/* Config header and parity byte 1 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_1);
 
 	new_value = 0x02;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_1_BIT)
 			| (parity_byte << PARITY_BYTE_1_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_1);
 
 	/* Config header and parity byte 2 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_2);
 	new_value = value;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_2_BIT)
 			| (parity_byte << PARITY_BYTE_2_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
 
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_2);
 
 	/* Config header and parity byte 3 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_3);
 
 	new_value = audio->channels - 1;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_3_BIT)
 			| (parity_byte << PARITY_BYTE_3_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 3: value = 0x%x, parity_byte = 0x%x\n",
 		value, parity_byte);
 
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_3);
 }
 
-static void dp_audio_timestamp_sdp(struct dp_audio_private *audio)
+static void msm_dp_audio_timestamp_sdp(struct msm_dp_audio_private *audio)
 {
-	struct dp_catalog *catalog = audio->catalog;
+	struct msm_dp_catalog *catalog = audio->catalog;
 	u32 value, new_value;
 	u8 parity_byte;
 
 	/* Config header and parity byte 1 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_1);
 
 	new_value = 0x1;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_1_BIT)
 			| (parity_byte << PARITY_BYTE_1_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_1);
 
 	/* Config header and parity byte 2 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_2);
 
 	new_value = 0x17;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_2_BIT)
 			| (parity_byte << PARITY_BYTE_2_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_2);
 
 	/* Config header and parity byte 3 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_3);
 
 	new_value = (0x0 | (0x11 << 2));
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_3_BIT)
 			| (parity_byte << PARITY_BYTE_3_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 3: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_3);
 }
 
-static void dp_audio_infoframe_sdp(struct dp_audio_private *audio)
+static void msm_dp_audio_infoframe_sdp(struct msm_dp_audio_private *audio)
 {
-	struct dp_catalog *catalog = audio->catalog;
+	struct msm_dp_catalog *catalog = audio->catalog;
 	u32 value, new_value;
 	u8 parity_byte;
 
 	/* Config header and parity byte 1 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_1);
 
 	new_value = 0x84;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_1_BIT)
 			| (parity_byte << PARITY_BYTE_1_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_1);
 
 	/* Config header and parity byte 2 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_2);
 
 	new_value = 0x1b;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_2_BIT)
 			| (parity_byte << PARITY_BYTE_2_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_2);
 
 	/* Config header and parity byte 3 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_3);
 
 	new_value = (0x0 | (0x11 << 2));
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_3_BIT)
 			| (parity_byte << PARITY_BYTE_3_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 3: value = 0x%x, parity_byte = 0x%x\n",
 			new_value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_3);
 }
 
-static void dp_audio_copy_management_sdp(struct dp_audio_private *audio)
+static void msm_dp_audio_copy_management_sdp(struct msm_dp_audio_private *audio)
 {
-	struct dp_catalog *catalog = audio->catalog;
+	struct msm_dp_catalog *catalog = audio->catalog;
 	u32 value, new_value;
 	u8 parity_byte;
 
 	/* Config header and parity byte 1 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_1);
 
 	new_value = 0x05;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_1_BIT)
 			| (parity_byte << PARITY_BYTE_1_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_1);
 
 	/* Config header and parity byte 2 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_2);
 
 	new_value = 0x0F;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_2_BIT)
 			| (parity_byte << PARITY_BYTE_2_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_2);
 
 	/* Config header and parity byte 3 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_3);
 
 	new_value = 0x0;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_3_BIT)
 			| (parity_byte << PARITY_BYTE_3_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 3: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_3);
 }
 
-static void dp_audio_isrc_sdp(struct dp_audio_private *audio)
+static void msm_dp_audio_isrc_sdp(struct msm_dp_audio_private *audio)
 {
-	struct dp_catalog *catalog = audio->catalog;
+	struct msm_dp_catalog *catalog = audio->catalog;
 	u32 value, new_value;
 	u8 parity_byte;
 
 	/* Config header and parity byte 1 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_ISRC, DP_AUDIO_SDP_HEADER_1);
 
 	new_value = 0x06;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_1_BIT)
 			| (parity_byte << PARITY_BYTE_1_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_ISRC, DP_AUDIO_SDP_HEADER_1);
 
 	/* Config header and parity byte 2 */
-	value = dp_audio_get_header(catalog,
+	value = msm_dp_audio_get_header(catalog,
 			DP_AUDIO_SDP_ISRC, DP_AUDIO_SDP_HEADER_2);
 
 	new_value = 0x0F;
-	parity_byte = dp_audio_calculate_parity(new_value);
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
 	value |= ((new_value << HEADER_BYTE_2_BIT)
 			| (parity_byte << PARITY_BYTE_2_BIT));
 	drm_dbg_dp(audio->drm_dev,
 			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
 			value, parity_byte);
-	dp_audio_set_header(catalog, value,
+	msm_dp_audio_set_header(catalog, value,
 		DP_AUDIO_SDP_ISRC, DP_AUDIO_SDP_HEADER_2);
 }
 
-static void dp_audio_setup_sdp(struct dp_audio_private *audio)
+static void msm_dp_audio_setup_sdp(struct msm_dp_audio_private *audio)
 {
-	dp_catalog_audio_config_sdp(audio->catalog);
+	msm_dp_catalog_audio_config_sdp(audio->catalog);
 
-	dp_audio_stream_sdp(audio);
-	dp_audio_timestamp_sdp(audio);
-	dp_audio_infoframe_sdp(audio);
-	dp_audio_copy_management_sdp(audio);
-	dp_audio_isrc_sdp(audio);
+	msm_dp_audio_stream_sdp(audio);
+	msm_dp_audio_timestamp_sdp(audio);
+	msm_dp_audio_infoframe_sdp(audio);
+	msm_dp_audio_copy_management_sdp(audio);
+	msm_dp_audio_isrc_sdp(audio);
 }
 
-static void dp_audio_setup_acr(struct dp_audio_private *audio)
+static void msm_dp_audio_setup_acr(struct msm_dp_audio_private *audio)
 {
 	u32 select = 0;
-	struct dp_catalog *catalog = audio->catalog;
+	struct msm_dp_catalog *catalog = audio->catalog;
 
-	switch (audio->dp_audio.bw_code) {
+	switch (audio->msm_dp_audio.bw_code) {
 	case DP_LINK_BW_1_62:
 		select = 0;
 		break;
@@ -390,16 +310,15 @@
 		break;
 	}
 
-	catalog->audio_data = select;
-	dp_catalog_audio_config_acr(catalog);
+	msm_dp_catalog_audio_config_acr(catalog, select);
 }
 
-static void dp_audio_safe_to_exit_level(struct dp_audio_private *audio)
+static void msm_dp_audio_safe_to_exit_level(struct msm_dp_audio_private *audio)
 {
-	struct dp_catalog *catalog = audio->catalog;
+	struct msm_dp_catalog *catalog = audio->catalog;
 	u32 safe_to_exit_level = 0;
 
-	switch (audio->dp_audio.lane_count) {
+	switch (audio->msm_dp_audio.lane_count) {
 	case 1:
 		safe_to_exit_level = 14;
 		break;
@@ -417,53 +336,49 @@
 		break;
 	}
 
-	catalog->audio_data = safe_to_exit_level;
-	dp_catalog_audio_sfe_level(catalog);
+	msm_dp_catalog_audio_sfe_level(catalog, safe_to_exit_level);
 }
 
-static void dp_audio_enable(struct dp_audio_private *audio, bool enable)
+static void msm_dp_audio_enable(struct msm_dp_audio_private *audio, bool enable)
 {
-	struct dp_catalog *catalog = audio->catalog;
-
-	catalog->audio_data = enable;
-	dp_catalog_audio_enable(catalog);
+	struct msm_dp_catalog *catalog = audio->catalog;
 
-	audio->engine_on = enable;
+	msm_dp_catalog_audio_enable(catalog, enable);
 }
 
-static struct dp_audio_private *dp_audio_get_data(struct platform_device *pdev)
+static struct msm_dp_audio_private *msm_dp_audio_get_data(struct platform_device *pdev)
 {
-	struct dp_audio *dp_audio;
-	struct msm_dp *dp_display;
+	struct msm_dp_audio *msm_dp_audio;
+	struct msm_dp *msm_dp_display;
 
 	if (!pdev) {
 		DRM_ERROR("invalid input\n");
 		return ERR_PTR(-ENODEV);
 	}
 
-	dp_display = platform_get_drvdata(pdev);
-	if (!dp_display) {
+	msm_dp_display = platform_get_drvdata(pdev);
+	if (!msm_dp_display) {
 		DRM_ERROR("invalid input\n");
 		return ERR_PTR(-ENODEV);
 	}
 
-	dp_audio = dp_display->dp_audio;
+	msm_dp_audio = msm_dp_display->msm_dp_audio;
 
-	if (!dp_audio) {
-		DRM_ERROR("invalid dp_audio data\n");
+	if (!msm_dp_audio) {
+		DRM_ERROR("invalid msm_dp_audio data\n");
 		return ERR_PTR(-EINVAL);
 	}
 
-	return container_of(dp_audio, struct dp_audio_private, dp_audio);
+	return container_of(msm_dp_audio, struct msm_dp_audio_private, msm_dp_audio);
 }
 
-static int dp_audio_hook_plugged_cb(struct device *dev, void *data,
+static int msm_dp_audio_hook_plugged_cb(struct device *dev, void *data,
 		hdmi_codec_plugged_cb fn,
 		struct device *codec_dev)
 {
 
 	struct platform_device *pdev;
-	struct msm_dp *dp_display;
+	struct msm_dp *msm_dp_display;
 
 	pdev = to_platform_device(dev);
 	if (!pdev) {
@@ -471,20 +386,20 @@
 		return -ENODEV;
 	}
 
-	dp_display = platform_get_drvdata(pdev);
-	if (!dp_display) {
+	msm_dp_display = platform_get_drvdata(pdev);
+	if (!msm_dp_display) {
 		pr_err("invalid input\n");
 		return -ENODEV;
 	}
 
-	return dp_display_set_plugged_cb(dp_display, fn, codec_dev);
+	return msm_dp_display_set_plugged_cb(msm_dp_display, fn, codec_dev);
 }
 
-static int dp_audio_get_eld(struct device *dev,
+static int msm_dp_audio_get_eld(struct device *dev,
 	void *data, uint8_t *buf, size_t len)
 {
 	struct platform_device *pdev;
-	struct msm_dp *dp_display;
+	struct msm_dp *msm_dp_display;
 
 	pdev = to_platform_device(dev);
 
@@ -493,30 +408,30 @@
 		return -ENODEV;
 	}
 
-	dp_display = platform_get_drvdata(pdev);
-	if (!dp_display) {
+	msm_dp_display = platform_get_drvdata(pdev);
+	if (!msm_dp_display) {
 		DRM_ERROR("invalid input\n");
 		return -ENODEV;
 	}
 
-	memcpy(buf, dp_display->connector->eld,
-		min(sizeof(dp_display->connector->eld), len));
+	memcpy(buf, msm_dp_display->connector->eld,
+		min(sizeof(msm_dp_display->connector->eld), len));
 
 	return 0;
 }
 
-int dp_audio_hw_params(struct device *dev,
+int msm_dp_audio_hw_params(struct device *dev,
 	void *data,
 	struct hdmi_codec_daifmt *daifmt,
 	struct hdmi_codec_params *params)
 {
 	int rc = 0;
-	struct dp_audio_private *audio;
+	struct msm_dp_audio_private *audio;
 	struct platform_device *pdev;
-	struct msm_dp *dp_display;
+	struct msm_dp *msm_dp_display;
 
 	pdev = to_platform_device(dev);
-	dp_display = platform_get_drvdata(pdev);
+	msm_dp_display = platform_get_drvdata(pdev);
 
 	/*
 	 * there could be cases where sound card can be opened even
@@ -526,12 +441,12 @@
 	 * such cases check for connection status and bail out if not
 	 * connected.
 	 */
-	if (!dp_display->power_on) {
+	if (!msm_dp_display_get_active_stream_cnt(msm_dp_display)) {
 		rc = -EINVAL;
 		goto end;
 	}
 
-	audio = dp_audio_get_data(pdev);
+	audio = msm_dp_audio_get_data(pdev);
 	if (IS_ERR(audio)) {
 		rc = PTR_ERR(audio);
 		goto end;
@@ -539,26 +454,26 @@
 
 	audio->channels = params->channels;
 
-	dp_audio_setup_sdp(audio);
-	dp_audio_setup_acr(audio);
-	dp_audio_safe_to_exit_level(audio);
-	dp_audio_enable(audio, true);
-	dp_display_signal_audio_start(dp_display);
-	dp_display->audio_enabled = true;
+	msm_dp_audio_setup_sdp(audio);
+	msm_dp_audio_setup_acr(audio);
+	msm_dp_audio_safe_to_exit_level(audio);
+	msm_dp_audio_enable(audio, true);
+	msm_dp_display_signal_audio_start(msm_dp_display);
+	msm_dp_display->audio_enabled = true;
 
 end:
 	return rc;
 }
 
-static void dp_audio_shutdown(struct device *dev, void *data)
+static void msm_dp_audio_shutdown(struct device *dev, void *data)
 {
-	struct dp_audio_private *audio;
+	struct msm_dp_audio_private *audio;
 	struct platform_device *pdev;
-	struct msm_dp *dp_display;
+	struct msm_dp *msm_dp_display;
 
 	pdev = to_platform_device(dev);
-	dp_display = platform_get_drvdata(pdev);
-	audio = dp_audio_get_data(pdev);
+	msm_dp_display = platform_get_drvdata(pdev);
+	audio = msm_dp_audio_get_data(pdev);
 	if (IS_ERR(audio)) {
 		DRM_ERROR("failed to get audio data\n");
 		return;
@@ -572,32 +487,32 @@
 	 * connected. is_connected cannot be used here as its set
 	 * to false earlier than this call
 	 */
-	if (!dp_display->audio_enabled)
+	if (!msm_dp_display->audio_enabled)
 		return;
 
-	dp_audio_enable(audio, false);
+	msm_dp_audio_enable(audio, false);
 	/* signal the dp display to safely shutdown clocks */
-	dp_display_signal_audio_complete(dp_display);
+	msm_dp_display_signal_audio_complete(msm_dp_display);
 }
 
-static const struct hdmi_codec_ops dp_audio_codec_ops = {
-	.hw_params = dp_audio_hw_params,
-	.audio_shutdown = dp_audio_shutdown,
-	.get_eld = dp_audio_get_eld,
-	.hook_plugged_cb = dp_audio_hook_plugged_cb,
+static const struct hdmi_codec_ops msm_dp_audio_codec_ops = {
+	.hw_params = msm_dp_audio_hw_params,
+	.audio_shutdown = msm_dp_audio_shutdown,
+	.get_eld = msm_dp_audio_get_eld,
+	.hook_plugged_cb = msm_dp_audio_hook_plugged_cb,
 };
 
 static struct hdmi_codec_pdata codec_data = {
-	.ops = &dp_audio_codec_ops,
+	.ops = &msm_dp_audio_codec_ops,
 	.max_i2s_channels = 8,
 	.i2s = 1,
 };
 
-void dp_unregister_audio_driver(struct device *dev, struct dp_audio *dp_audio)
+void msm_dp_unregister_audio_driver(struct device *dev, struct msm_dp_audio *msm_dp_audio)
 {
-	struct dp_audio_private *audio_priv;
+	struct msm_dp_audio_private *audio_priv;
 
-	audio_priv = container_of(dp_audio, struct dp_audio_private, dp_audio);
+	audio_priv = container_of(msm_dp_audio, struct msm_dp_audio_private, msm_dp_audio);
 
 	if (audio_priv->audio_pdev) {
 		platform_device_unregister(audio_priv->audio_pdev);
@@ -605,13 +520,13 @@
 	}
 }
 
-int dp_register_audio_driver(struct device *dev,
-		struct dp_audio *dp_audio)
+int msm_dp_register_audio_driver(struct device *dev,
+		struct msm_dp_audio *msm_dp_audio)
 {
-	struct dp_audio_private *audio_priv;
+	struct msm_dp_audio_private *audio_priv;
 
-	audio_priv = container_of(dp_audio,
-			struct dp_audio_private, dp_audio);
+	audio_priv = container_of(msm_dp_audio,
+			struct msm_dp_audio_private, msm_dp_audio);
 
 	audio_priv->audio_pdev = platform_device_register_data(dev,
 						HDMI_CODEC_DRV_NAME,
@@ -621,13 +536,13 @@
 	return PTR_ERR_OR_ZERO(audio_priv->audio_pdev);
 }
 
-struct dp_audio *dp_audio_get(struct platform_device *pdev,
-			struct dp_panel *panel,
-			struct dp_catalog *catalog)
+struct msm_dp_audio *msm_dp_audio_get(struct platform_device *pdev,
+			struct msm_dp_panel *panel,
+			struct msm_dp_catalog *catalog)
 {
 	int rc = 0;
-	struct dp_audio_private *audio;
-	struct dp_audio *dp_audio;
+	struct msm_dp_audio_private *audio;
+	struct msm_dp_audio *msm_dp_audio;
 
 	if (!pdev || !panel || !catalog) {
 		DRM_ERROR("invalid input\n");
@@ -642,26 +557,25 @@
 	}
 
 	audio->pdev = pdev;
-	audio->panel = panel;
 	audio->catalog = catalog;
 
-	dp_audio = &audio->dp_audio;
+	msm_dp_audio = &audio->msm_dp_audio;
 
-	dp_catalog_audio_init(catalog);
+	msm_dp_catalog_audio_init(catalog);
 
-	return dp_audio;
+	return msm_dp_audio;
 error:
 	return ERR_PTR(rc);
 }
 
-void dp_audio_put(struct dp_audio *dp_audio)
+void msm_dp_audio_put(struct msm_dp_audio *msm_dp_audio)
 {
-	struct dp_audio_private *audio;
+	struct msm_dp_audio_private *audio;
 
-	if (!dp_audio)
+	if (!msm_dp_audio)
 		return;
 
-	audio = container_of(dp_audio, struct dp_audio_private, dp_audio);
+	audio = container_of(msm_dp_audio, struct msm_dp_audio_private, msm_dp_audio);
 
 	devm_kfree(&audio->pdev->dev, audio);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_audio.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_audio.h
@@ -13,58 +13,58 @@
 #include <sound/hdmi-codec.h>
 
 /**
- * struct dp_audio
+ * struct msm_dp_audio
  * @lane_count: number of lanes configured in current session
  * @bw_code: link rate's bandwidth code for current session
  */
-struct dp_audio {
+struct msm_dp_audio {
 	u32 lane_count;
 	u32 bw_code;
 };
 
 /**
- * dp_audio_get()
+ * msm_dp_audio_get()
  *
  * Creates and instance of dp audio.
  *
  * @pdev: caller's platform device instance.
- * @panel: an instance of dp_panel module.
- * @catalog: an instance of dp_catalog module.
+ * @panel: an instance of msm_dp_panel module.
+ * @catalog: an instance of msm_dp_catalog module.
  *
  * Returns the error code in case of failure, otherwize
- * an instance of newly created dp_module.
+ * an instance of newly created msm_dp_module.
  */
-struct dp_audio *dp_audio_get(struct platform_device *pdev,
-			struct dp_panel *panel,
-			struct dp_catalog *catalog);
+struct msm_dp_audio *msm_dp_audio_get(struct platform_device *pdev,
+			struct msm_dp_panel *panel,
+			struct msm_dp_catalog *catalog);
 
 /**
- * dp_register_audio_driver()
+ * msm_dp_register_audio_driver()
  *
  * Registers DP device with hdmi_codec interface.
  *
  * @dev: DP device instance.
- * @dp_audio: an instance of dp_audio module.
+ * @msm_dp_audio: an instance of msm_dp_audio module.
  *
  *
  * Returns the error code in case of failure, otherwise
  * zero on success.
  */
-int dp_register_audio_driver(struct device *dev,
-		struct dp_audio *dp_audio);
+int msm_dp_register_audio_driver(struct device *dev,
+		struct msm_dp_audio *msm_dp_audio);
 
-void dp_unregister_audio_driver(struct device *dev, struct dp_audio *dp_audio);
+void msm_dp_unregister_audio_driver(struct device *dev, struct msm_dp_audio *msm_dp_audio);
 
 /**
- * dp_audio_put()
+ * msm_dp_audio_put()
  *
- * Cleans the dp_audio instance.
+ * Cleans the msm_dp_audio instance.
  *
- * @dp_audio: an instance of dp_audio.
+ * @msm_dp_audio: an instance of msm_dp_audio.
  */
-void dp_audio_put(struct dp_audio *dp_audio);
+void msm_dp_audio_put(struct msm_dp_audio *msm_dp_audio);
 
-int dp_audio_hw_params(struct device *dev,
+int msm_dp_audio_hw_params(struct device *dev,
 	void *data,
 	struct hdmi_codec_daifmt *daifmt,
 	struct hdmi_codec_params *params);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_aux.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_aux.c
@@ -4,6 +4,7 @@
  */
 
 #include <linux/delay.h>
+#include <linux/phy/phy.h>
 #include <drm/drm_print.h>
 
 #include "dp_reg.h"
@@ -19,9 +20,11 @@
 	DP_AUX_ERR_PHY,
 };
 
-struct dp_aux_private {
+struct msm_dp_aux_private {
 	struct device *dev;
-	struct dp_catalog *catalog;
+	struct msm_dp_catalog *catalog;
+
+	struct phy *phy;
 
 	struct mutex mutex;
 	struct completion comp;
@@ -35,15 +38,16 @@
 	bool no_send_stop;
 	bool initted;
 	bool is_edp;
+	bool enable_xfers;
 	u32 offset;
 	u32 segment;
 
-	struct drm_dp_aux dp_aux;
+	struct drm_dp_aux msm_dp_aux;
 };
 
 #define MAX_AUX_RETRIES			5
 
-static ssize_t dp_aux_write(struct dp_aux_private *aux,
+static ssize_t msm_dp_aux_write(struct msm_dp_aux_private *aux,
 			struct drm_dp_aux_msg *msg)
 {
 	u8 data[4];
@@ -84,12 +88,11 @@
 		/* index = 0, write */
 		if (i == 0)
 			reg |= DP_AUX_DATA_INDEX_WRITE;
-		aux->catalog->aux_data = reg;
-		dp_catalog_aux_write_data(aux->catalog);
+		msm_dp_catalog_aux_write_data(aux->catalog, reg);
 	}
 
-	dp_catalog_aux_clear_trans(aux->catalog, false);
-	dp_catalog_aux_clear_hw_interrupts(aux->catalog);
+	msm_dp_catalog_aux_clear_trans(aux->catalog, false);
+	msm_dp_catalog_aux_clear_hw_interrupts(aux->catalog);
 
 	reg = 0; /* Transaction number == 1 */
 	if (!aux->native) { /* i2c */
@@ -103,13 +106,12 @@
 	}
 
 	reg |= DP_AUX_TRANS_CTRL_GO;
-	aux->catalog->aux_data = reg;
-	dp_catalog_aux_write_trans(aux->catalog);
+	msm_dp_catalog_aux_write_trans(aux->catalog, reg);
 
 	return len;
 }
 
-static ssize_t dp_aux_cmd_fifo_tx(struct dp_aux_private *aux,
+static ssize_t msm_dp_aux_cmd_fifo_tx(struct msm_dp_aux_private *aux,
 			      struct drm_dp_aux_msg *msg)
 {
 	ssize_t ret;
@@ -117,7 +119,7 @@
 
 	reinit_completion(&aux->comp);
 
-	ret = dp_aux_write(aux, msg);
+	ret = msm_dp_aux_write(aux, msg);
 	if (ret < 0)
 		return ret;
 
@@ -129,7 +131,7 @@
 	return ret;
 }
 
-static ssize_t dp_aux_cmd_fifo_rx(struct dp_aux_private *aux,
+static ssize_t msm_dp_aux_cmd_fifo_rx(struct msm_dp_aux_private *aux,
 		struct drm_dp_aux_msg *msg)
 {
 	u32 data;
@@ -137,21 +139,20 @@
 	u32 i, actual_i;
 	u32 len = msg->size;
 
-	dp_catalog_aux_clear_trans(aux->catalog, true);
+	msm_dp_catalog_aux_clear_trans(aux->catalog, true);
 
 	data = DP_AUX_DATA_INDEX_WRITE; /* INDEX_WRITE */
 	data |= DP_AUX_DATA_READ;  /* read */
 
-	aux->catalog->aux_data = data;
-	dp_catalog_aux_write_data(aux->catalog);
+	msm_dp_catalog_aux_write_data(aux->catalog, data);
 
 	dp = msg->buffer;
 
 	/* discard first byte */
-	data = dp_catalog_aux_read_data(aux->catalog);
+	data = msm_dp_catalog_aux_read_data(aux->catalog);
 
 	for (i = 0; i < len; i++) {
-		data = dp_catalog_aux_read_data(aux->catalog);
+		data = msm_dp_catalog_aux_read_data(aux->catalog);
 		*dp++ = (u8)((data >> DP_AUX_DATA_OFFSET) & 0xff);
 
 		actual_i = (data >> DP_AUX_DATA_INDEX_OFFSET) & 0xFF;
@@ -162,7 +163,7 @@
 	return i;
 }
 
-static void dp_aux_update_offset_and_segment(struct dp_aux_private *aux,
+static void msm_dp_aux_update_offset_and_segment(struct msm_dp_aux_private *aux,
 					     struct drm_dp_aux_msg *input_msg)
 {
 	u32 edid_address = 0x50;
@@ -184,7 +185,7 @@
 }
 
 /**
- * dp_aux_transfer_helper() - helper function for EDID read transactions
+ * msm_dp_aux_transfer_helper() - helper function for EDID read transactions
  *
  * @aux: DP AUX private structure
  * @input_msg: input message from DRM upstream APIs
@@ -195,7 +196,7 @@
  * This helper function is used to fix EDID reads for non-compliant
  * sinks that do not handle the i2c middle-of-transaction flag correctly.
  */
-static void dp_aux_transfer_helper(struct dp_aux_private *aux,
+static void msm_dp_aux_transfer_helper(struct msm_dp_aux_private *aux,
 				   struct drm_dp_aux_msg *input_msg,
 				   bool send_seg)
 {
@@ -237,7 +238,7 @@
 		helper_msg.address = segment_address;
 		helper_msg.buffer = &aux->segment;
 		helper_msg.size = 1;
-		dp_aux_cmd_fifo_tx(aux, &helper_msg);
+		msm_dp_aux_cmd_fifo_tx(aux, &helper_msg);
 	}
 
 	/*
@@ -251,7 +252,7 @@
 	helper_msg.address = input_msg->address;
 	helper_msg.buffer = &aux->offset;
 	helper_msg.size = 1;
-	dp_aux_cmd_fifo_tx(aux, &helper_msg);
+	msm_dp_aux_cmd_fifo_tx(aux, &helper_msg);
 
 end:
 	aux->offset += message_size;
@@ -264,15 +265,15 @@
  * It will call aux_reset() function to reset the AUX channel,
  * if the waiting is timeout.
  */
-static ssize_t dp_aux_transfer(struct drm_dp_aux *dp_aux,
+static ssize_t msm_dp_aux_transfer(struct drm_dp_aux *msm_dp_aux,
 			       struct drm_dp_aux_msg *msg)
 {
 	ssize_t ret;
 	int const aux_cmd_native_max = 16;
 	int const aux_cmd_i2c_max = 128;
-	struct dp_aux_private *aux;
+	struct msm_dp_aux_private *aux;
 
-	aux = container_of(dp_aux, struct dp_aux_private, dp_aux);
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
 
 	aux->native = msg->request & (DP_AUX_NATIVE_WRITE & DP_AUX_NATIVE_READ);
 
@@ -291,7 +292,7 @@
 		return -EINVAL;
 	}
 
-	ret = pm_runtime_resume_and_get(dp_aux->dev);
+	ret = pm_runtime_resume_and_get(msm_dp_aux->dev);
 	if (ret)
 		return  ret;
 
@@ -302,23 +303,18 @@
 	}
 
 	/*
-	 * For eDP it's important to give a reasonably long wait here for HPD
-	 * to be asserted. This is because the panel driver may have _just_
-	 * turned on the panel and then tried to do an AUX transfer. The panel
-	 * driver has no way of knowing when the panel is ready, so it's up
-	 * to us to wait. For DP we never get into this situation so let's
-	 * avoid ever doing the extra long wait for DP.
+	 * If we're using DP and an external display isn't connected then the
+	 * transfer won't succeed. Return right away. If we don't do this we
+	 * can end up with long timeouts if someone tries to access the DP AUX
+	 * character device when no DP device is connected.
 	 */
-	if (aux->is_edp) {
-		ret = dp_catalog_aux_wait_for_hpd_connect_state(aux->catalog);
-		if (ret) {
-			DRM_DEBUG_DP("Panel not ready for aux transactions\n");
-			goto exit;
-		}
+	if (!aux->is_edp && !aux->enable_xfers) {
+		ret = -ENXIO;
+		goto exit;
 	}
 
-	dp_aux_update_offset_and_segment(aux, msg);
-	dp_aux_transfer_helper(aux, msg, true);
+	msm_dp_aux_update_offset_and_segment(aux, msg);
+	msm_dp_aux_transfer_helper(aux, msg, true);
 
 	aux->read = msg->request & (DP_AUX_I2C_READ & DP_AUX_NATIVE_READ);
 	aux->cmd_busy = true;
@@ -331,22 +327,22 @@
 		aux->no_send_stop = true;
 	}
 
-	ret = dp_aux_cmd_fifo_tx(aux, msg);
+	ret = msm_dp_aux_cmd_fifo_tx(aux, msg);
 	if (ret < 0) {
 		if (aux->native) {
 			aux->retry_cnt++;
 			if (!(aux->retry_cnt % MAX_AUX_RETRIES))
-				dp_catalog_aux_update_cfg(aux->catalog);
+				phy_calibrate(aux->phy);
 		}
 		/* reset aux if link is in connected state */
-		if (dp_catalog_link_is_connected(aux->catalog))
-			dp_catalog_aux_reset(aux->catalog);
+		if (msm_dp_catalog_link_is_connected(aux->catalog))
+			msm_dp_catalog_aux_reset(aux->catalog);
 	} else {
 		aux->retry_cnt = 0;
 		switch (aux->aux_error_num) {
 		case DP_AUX_ERR_NONE:
 			if (aux->read)
-				ret = dp_aux_cmd_fifo_rx(aux, msg);
+				ret = msm_dp_aux_cmd_fifo_rx(aux, msg);
 			msg->reply = aux->native ? DP_AUX_NATIVE_REPLY_ACK : DP_AUX_I2C_REPLY_ACK;
 			break;
 		case DP_AUX_ERR_DEFER:
@@ -368,24 +364,24 @@
 
 exit:
 	mutex_unlock(&aux->mutex);
-	pm_runtime_put_sync(dp_aux->dev);
+	pm_runtime_put_sync(msm_dp_aux->dev);
 
 	return ret;
 }
 
-irqreturn_t dp_aux_isr(struct drm_dp_aux *dp_aux)
+irqreturn_t msm_dp_aux_isr(struct drm_dp_aux *msm_dp_aux)
 {
 	u32 isr;
-	struct dp_aux_private *aux;
+	struct msm_dp_aux_private *aux;
 
-	if (!dp_aux) {
+	if (!msm_dp_aux) {
 		DRM_ERROR("invalid input\n");
 		return IRQ_NONE;
 	}
 
-	aux = container_of(dp_aux, struct dp_aux_private, dp_aux);
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
 
-	isr = dp_catalog_aux_get_irq(aux->catalog);
+	isr = msm_dp_catalog_aux_get_irq(aux->catalog);
 
 	/* no interrupts pending, return immediately */
 	if (!isr)
@@ -407,7 +403,7 @@
 
 	if (isr & DP_INTR_AUX_ERROR) {
 		aux->aux_error_num = DP_AUX_ERR_PHY;
-		dp_catalog_aux_clear_hw_interrupts(aux->catalog);
+		msm_dp_catalog_aux_clear_hw_interrupts(aux->catalog);
 	} else if (isr & DP_INTR_NACK_DEFER) {
 		aux->aux_error_num = DP_AUX_ERR_NACK_DEFER;
 	} else if (isr & DP_INTR_WRONG_ADDR) {
@@ -433,60 +429,68 @@
 	return IRQ_HANDLED;
 }
 
-void dp_aux_reconfig(struct drm_dp_aux *dp_aux)
+void msm_dp_aux_enable_xfers(struct drm_dp_aux *msm_dp_aux, bool enabled)
+{
+	struct msm_dp_aux_private *aux;
+
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
+	aux->enable_xfers = enabled;
+}
+
+void msm_dp_aux_reconfig(struct drm_dp_aux *msm_dp_aux)
 {
-	struct dp_aux_private *aux;
+	struct msm_dp_aux_private *aux;
 
-	aux = container_of(dp_aux, struct dp_aux_private, dp_aux);
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
 
-	dp_catalog_aux_update_cfg(aux->catalog);
-	dp_catalog_aux_reset(aux->catalog);
+	phy_calibrate(aux->phy);
+	msm_dp_catalog_aux_reset(aux->catalog);
 }
 
-void dp_aux_init(struct drm_dp_aux *dp_aux)
+void msm_dp_aux_init(struct drm_dp_aux *msm_dp_aux)
 {
-	struct dp_aux_private *aux;
+	struct msm_dp_aux_private *aux;
 
-	if (!dp_aux) {
+	if (!msm_dp_aux) {
 		DRM_ERROR("invalid input\n");
 		return;
 	}
 
-	aux = container_of(dp_aux, struct dp_aux_private, dp_aux);
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
 
 	mutex_lock(&aux->mutex);
 
-	dp_catalog_aux_enable(aux->catalog, true);
+	msm_dp_catalog_aux_enable(aux->catalog, true);
 	aux->retry_cnt = 0;
 	aux->initted = true;
 
 	mutex_unlock(&aux->mutex);
 }
 
-void dp_aux_deinit(struct drm_dp_aux *dp_aux)
+void msm_dp_aux_deinit(struct drm_dp_aux *msm_dp_aux)
 {
-	struct dp_aux_private *aux;
+	struct msm_dp_aux_private *aux;
 
-	aux = container_of(dp_aux, struct dp_aux_private, dp_aux);
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
 
 	mutex_lock(&aux->mutex);
 
 	aux->initted = false;
-	dp_catalog_aux_enable(aux->catalog, false);
+	msm_dp_catalog_aux_enable(aux->catalog, false);
 
 	mutex_unlock(&aux->mutex);
 }
 
-int dp_aux_register(struct drm_dp_aux *dp_aux)
+int msm_dp_aux_register(struct drm_dp_aux *msm_dp_aux)
 {
 	int ret;
 
-	if (!dp_aux) {
+	if (!msm_dp_aux) {
 		DRM_ERROR("invalid input\n");
 		return -EINVAL;
 	}
 
-	ret = drm_dp_aux_register(dp_aux);
+	ret = drm_dp_aux_register(msm_dp_aux);
 	if (ret) {
 		DRM_ERROR("%s: failed to register drm aux: %d\n", __func__,
 				ret);
@@ -496,30 +500,35 @@
 	return 0;
 }
 
-void dp_aux_unregister(struct drm_dp_aux *dp_aux)
+void msm_dp_aux_unregister(struct drm_dp_aux *msm_dp_aux)
 {
-	drm_dp_aux_unregister(dp_aux);
+	drm_dp_aux_unregister(msm_dp_aux);
 }
 
-static int dp_wait_hpd_asserted(struct drm_dp_aux *dp_aux,
+static int msm_dp_wait_hpd_asserted(struct drm_dp_aux *msm_dp_aux,
 				 unsigned long wait_us)
 {
 	int ret;
-	struct dp_aux_private *aux;
+	struct msm_dp_aux_private *aux;
 
-	aux = container_of(dp_aux, struct dp_aux_private, dp_aux);
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
 
 	pm_runtime_get_sync(aux->dev);
-	ret = dp_catalog_aux_wait_for_hpd_connect_state(aux->catalog);
+	ret = pm_runtime_resume_and_get(aux->dev);
+	if (ret)
+		return ret;
+
+	ret = msm_dp_catalog_aux_wait_for_hpd_connect_state(aux->catalog, wait_us);
 	pm_runtime_put_sync(aux->dev);
 
 	return ret;
 }
 
-struct drm_dp_aux *dp_aux_get(struct device *dev, struct dp_catalog *catalog,
+struct drm_dp_aux *msm_dp_aux_get(struct device *dev, struct msm_dp_catalog *catalog,
+			      struct phy *phy,
 			      bool is_edp)
 {
-	struct dp_aux_private *aux;
+	struct msm_dp_aux_private *aux;
 
 	if (!catalog) {
 		DRM_ERROR("invalid input\n");
@@ -537,6 +546,7 @@
 
 	aux->dev = dev;
 	aux->catalog = catalog;
+	aux->phy = phy;
 	aux->retry_cnt = 0;
 
 	/*
@@ -544,23 +554,23 @@
 	 * before registering AUX with the DRM device so that
 	 * msm eDP panel can be detected by generic_dep_panel_probe().
 	 */
-	aux->dp_aux.name = "dpu_dp_aux";
-	aux->dp_aux.dev = dev;
-	aux->dp_aux.transfer = dp_aux_transfer;
-	aux->dp_aux.wait_hpd_asserted = dp_wait_hpd_asserted;
-	drm_dp_aux_init(&aux->dp_aux);
+	aux->msm_dp_aux.name = "dpu_dp_aux";
+	aux->msm_dp_aux.dev = dev;
+	aux->msm_dp_aux.transfer = msm_dp_aux_transfer;
+	aux->msm_dp_aux.wait_hpd_asserted = msm_dp_wait_hpd_asserted;
+	drm_dp_aux_init(&aux->msm_dp_aux);
 
-	return &aux->dp_aux;
+	return &aux->msm_dp_aux;
 }
 
-void dp_aux_put(struct drm_dp_aux *dp_aux)
+void msm_dp_aux_put(struct drm_dp_aux *msm_dp_aux)
 {
-	struct dp_aux_private *aux;
+	struct msm_dp_aux_private *aux;
 
-	if (!dp_aux)
+	if (!msm_dp_aux)
 		return;
 
-	aux = container_of(dp_aux, struct dp_aux_private, dp_aux);
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
 
 	mutex_destroy(&aux->mutex);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_aux.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_aux.h
@@ -8,16 +8,20 @@
 
 #include "dp_catalog.h"
 #include <drm/display/drm_dp_helper.h>
+#include <drm/display/drm_dp_mst_helper.h>
 
-int dp_aux_register(struct drm_dp_aux *dp_aux);
-void dp_aux_unregister(struct drm_dp_aux *dp_aux);
-irqreturn_t dp_aux_isr(struct drm_dp_aux *dp_aux);
-void dp_aux_init(struct drm_dp_aux *dp_aux);
-void dp_aux_deinit(struct drm_dp_aux *dp_aux);
-void dp_aux_reconfig(struct drm_dp_aux *dp_aux);
+int msm_dp_aux_register(struct drm_dp_aux *msm_dp_aux);
+void msm_dp_aux_unregister(struct drm_dp_aux *msm_dp_aux);
+irqreturn_t msm_dp_aux_isr(struct drm_dp_aux *msm_dp_aux);
+void msm_dp_aux_enable_xfers(struct drm_dp_aux *msm_dp_aux, bool enabled);
+void msm_dp_aux_init(struct drm_dp_aux *msm_dp_aux);
+void msm_dp_aux_deinit(struct drm_dp_aux *msm_dp_aux);
+void msm_dp_aux_reconfig(struct drm_dp_aux *msm_dp_aux);
 
-struct drm_dp_aux *dp_aux_get(struct device *dev, struct dp_catalog *catalog,
+struct phy;
+struct drm_dp_aux *msm_dp_aux_get(struct device *dev, struct msm_dp_catalog *catalog,
+			      struct phy *phy,
 			      bool is_edp);
-void dp_aux_put(struct drm_dp_aux *aux);
+void msm_dp_aux_put(struct drm_dp_aux *aux);
 
 #endif /*__DP_AUX_H_*/
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_catalog.c
@@ -7,8 +7,7 @@
 
 #include <linux/delay.h>
 #include <linux/iopoll.h>
-#include <linux/phy/phy.h>
-#include <linux/phy/phy-dp.h>
+#include <linux/platform_device.h>
 #include <linux/rational.h>
 #include <drm/display/drm_dp_helper.h>
 #include <drm/drm_print.h>
@@ -51,155 +50,202 @@
 	(PSR_UPDATE_INT | PSR_CAPTURE_INT | PSR_EXIT_INT | \
 	PSR_UPDATE_ERROR_INT | PSR_WAKE_ERROR_INT)
 
+#define DP_INTERRUPT_STATUS5 \
+	(DP_INTR_DP0_VCPF_SENT | DP_INTR_DP1_VCPF_SENT)
+#define DP_INTERRUPT_STATUS5_MASK \
+	(DP_INTERRUPT_STATUS5 << DP_INTERRUPT_STATUS_MASK_SHIFT)
+
 #define DP_INTERRUPT_MASK4 \
 	(PSR_UPDATE_MASK | PSR_CAPTURE_MASK | PSR_EXIT_MASK | \
 	PSR_UPDATE_ERROR_MASK | PSR_WAKE_ERROR_MASK)
 
-struct dp_catalog_private {
+#define DP_DEFAULT_AHB_OFFSET	0x0000
+#define DP_DEFAULT_AHB_SIZE	0x0200
+#define DP_DEFAULT_AUX_OFFSET	0x0200
+#define DP_DEFAULT_AUX_SIZE	0x0200
+#define DP_DEFAULT_LINK_OFFSET	0x0400
+#define DP_DEFAULT_LINK_SIZE	0x0C00
+#define DP_DEFAULT_P0_OFFSET	0x1000
+#define DP_DEFAULT_P0_SIZE	0x0400
+
+struct dss_io_region {
+	size_t len;
+	void __iomem *base;
+};
+
+struct dss_io_data {
+	struct dss_io_region ahb;
+	struct dss_io_region aux;
+	struct dss_io_region link;
+	struct dss_io_region p0;
+	struct dss_io_region p1;
+};
+
+struct msm_dp_catalog_private {
 	struct device *dev;
 	struct drm_device *drm_dev;
-	struct dp_io *io;
+	struct dss_io_data io;
 	u32 (*audio_map)[DP_AUDIO_SDP_HEADER_MAX];
-	struct dp_catalog dp_catalog;
-	u8 aux_lut_cfg_index[PHY_AUX_CFG_MAX];
+	struct msm_dp_catalog msm_dp_catalog;
 };
 
-void dp_catalog_snapshot(struct dp_catalog *dp_catalog, struct msm_disp_state *disp_state)
+void msm_dp_catalog_snapshot(struct msm_dp_catalog *msm_dp_catalog, struct msm_disp_state *disp_state)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-			struct dp_catalog_private, dp_catalog);
-	struct dss_io_data *dss = &catalog->io->dp_controller;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+			struct msm_dp_catalog_private, msm_dp_catalog);
+	struct dss_io_data *dss = &catalog->io;
 
 	msm_disp_snapshot_add_block(disp_state, dss->ahb.len, dss->ahb.base, "dp_ahb");
 	msm_disp_snapshot_add_block(disp_state, dss->aux.len, dss->aux.base, "dp_aux");
 	msm_disp_snapshot_add_block(disp_state, dss->link.len, dss->link.base, "dp_link");
 	msm_disp_snapshot_add_block(disp_state, dss->p0.len, dss->p0.base, "dp_p0");
+	msm_disp_snapshot_add_block(disp_state, dss->p1.len, dss->p0.base, "dp_p1");
 }
 
-static inline u32 dp_read_aux(struct dp_catalog_private *catalog, u32 offset)
+static inline u32 msm_dp_read_aux(struct msm_dp_catalog_private *catalog, u32 offset)
 {
-	return readl_relaxed(catalog->io->dp_controller.aux.base + offset);
+	return readl_relaxed(catalog->io.aux.base + offset);
 }
 
-static inline void dp_write_aux(struct dp_catalog_private *catalog,
+static inline void msm_dp_write_aux(struct msm_dp_catalog_private *catalog,
 			       u32 offset, u32 data)
 {
 	/*
 	 * To make sure aux reg writes happens before any other operation,
 	 * this function uses writel() instread of writel_relaxed()
 	 */
-	writel(data, catalog->io->dp_controller.aux.base + offset);
+	writel(data, catalog->io.aux.base + offset);
 }
 
-static inline u32 dp_read_ahb(const struct dp_catalog_private *catalog, u32 offset)
+static inline u32 msm_dp_read_ahb(const struct msm_dp_catalog_private *catalog, u32 offset)
 {
-	return readl_relaxed(catalog->io->dp_controller.ahb.base + offset);
+	return readl_relaxed(catalog->io.ahb.base + offset);
 }
 
-static inline void dp_write_ahb(struct dp_catalog_private *catalog,
+static inline void msm_dp_write_ahb(struct msm_dp_catalog_private *catalog,
 			       u32 offset, u32 data)
 {
 	/*
 	 * To make sure phy reg writes happens before any other operation,
 	 * this function uses writel() instread of writel_relaxed()
 	 */
-	writel(data, catalog->io->dp_controller.ahb.base + offset);
+	writel(data, catalog->io.ahb.base + offset);
 }
 
-static inline void dp_write_p0(struct dp_catalog_private *catalog,
+static inline void msm_dp_write_p0(struct msm_dp_catalog_private *catalog,
 			       u32 offset, u32 data)
 {
 	/*
 	 * To make sure interface reg writes happens before any other operation,
 	 * this function uses writel() instread of writel_relaxed()
 	 */
-	writel(data, catalog->io->dp_controller.p0.base + offset);
+	writel(data, catalog->io.p0.base + offset);
 }
 
-static inline u32 dp_read_p0(struct dp_catalog_private *catalog,
+static inline u32 msm_dp_read_p0(struct msm_dp_catalog_private *catalog,
 			       u32 offset)
 {
 	/*
 	 * To make sure interface reg writes happens before any other operation,
 	 * this function uses writel() instread of writel_relaxed()
 	 */
-	return readl_relaxed(catalog->io->dp_controller.p0.base + offset);
+	return readl_relaxed(catalog->io.p0.base + offset);
 }
 
-static inline u32 dp_read_link(struct dp_catalog_private *catalog, u32 offset)
+static inline void msm_dp_write_p1(struct msm_dp_catalog_private *catalog,
+				   u32 offset, u32 data)
 {
-	return readl_relaxed(catalog->io->dp_controller.link.base + offset);
+	/*
+	 * To make sure interface reg writes happens before any other operation,
+	 * this function uses writel() instread of writel_relaxed()
+	 */
+	writel(data, catalog->io.p1.base + offset);
 }
 
-static inline void dp_write_link(struct dp_catalog_private *catalog,
+static inline u32 msm_dp_read_p1(struct msm_dp_catalog_private *catalog,
+				 u32 offset)
+{
+	/*
+	 * To make sure interface reg writes happens before any other operation,
+	 * this function uses writel() instread of writel_relaxed()
+	 */
+	return readl_relaxed(catalog->io.p1.base + offset);
+}
+
+static inline u32 msm_dp_read_link(struct msm_dp_catalog_private *catalog, u32 offset)
+{
+	return readl_relaxed(catalog->io.link.base + offset);
+}
+
+static inline void msm_dp_write_link(struct msm_dp_catalog_private *catalog,
 			       u32 offset, u32 data)
 {
 	/*
 	 * To make sure link reg writes happens before any other operation,
 	 * this function uses writel() instread of writel_relaxed()
 	 */
-	writel(data, catalog->io->dp_controller.link.base + offset);
+	writel(data, catalog->io.link.base + offset);
 }
 
 /* aux related catalog functions */
-u32 dp_catalog_aux_read_data(struct dp_catalog *dp_catalog)
+u32 msm_dp_catalog_aux_read_data(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	return dp_read_aux(catalog, REG_DP_AUX_DATA);
+	return msm_dp_read_aux(catalog, REG_DP_AUX_DATA);
 }
 
-int dp_catalog_aux_write_data(struct dp_catalog *dp_catalog)
+int msm_dp_catalog_aux_write_data(struct msm_dp_catalog *msm_dp_catalog, u32 data)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	dp_write_aux(catalog, REG_DP_AUX_DATA, dp_catalog->aux_data);
+	msm_dp_write_aux(catalog, REG_DP_AUX_DATA, data);
 	return 0;
 }
 
-int dp_catalog_aux_write_trans(struct dp_catalog *dp_catalog)
+int msm_dp_catalog_aux_write_trans(struct msm_dp_catalog *msm_dp_catalog, u32 data)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	dp_write_aux(catalog, REG_DP_AUX_TRANS_CTRL, dp_catalog->aux_data);
+	msm_dp_write_aux(catalog, REG_DP_AUX_TRANS_CTRL, data);
 	return 0;
 }
 
-int dp_catalog_aux_clear_trans(struct dp_catalog *dp_catalog, bool read)
+int msm_dp_catalog_aux_clear_trans(struct msm_dp_catalog *msm_dp_catalog, bool read)
 {
 	u32 data;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
 	if (read) {
-		data = dp_read_aux(catalog, REG_DP_AUX_TRANS_CTRL);
+		data = msm_dp_read_aux(catalog, REG_DP_AUX_TRANS_CTRL);
 		data &= ~DP_AUX_TRANS_CTRL_GO;
-		dp_write_aux(catalog, REG_DP_AUX_TRANS_CTRL, data);
+		msm_dp_write_aux(catalog, REG_DP_AUX_TRANS_CTRL, data);
 	} else {
-		dp_write_aux(catalog, REG_DP_AUX_TRANS_CTRL, 0);
+		msm_dp_write_aux(catalog, REG_DP_AUX_TRANS_CTRL, 0);
 	}
 	return 0;
 }
 
-int dp_catalog_aux_clear_hw_interrupts(struct dp_catalog *dp_catalog)
+int msm_dp_catalog_aux_clear_hw_interrupts(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	dp_read_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_STATUS);
-	dp_write_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_CLEAR, 0x1f);
-	dp_write_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_CLEAR, 0x9f);
-	dp_write_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_CLEAR, 0);
+	msm_dp_read_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_STATUS);
+	msm_dp_write_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_CLEAR, 0x1f);
+	msm_dp_write_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_CLEAR, 0x9f);
+	msm_dp_write_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_CLEAR, 0);
 	return 0;
 }
 
 /**
- * dp_catalog_aux_reset() - reset AUX controller
+ * msm_dp_catalog_aux_reset() - reset AUX controller
  *
- * @dp_catalog: DP catalog structure
+ * @msm_dp_catalog: DP catalog structure
  *
  * return: void
  *
@@ -208,62 +254,53 @@
  * NOTE: reset AUX controller will also clear any pending HPD related interrupts
  * 
  */
-void dp_catalog_aux_reset(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_aux_reset(struct msm_dp_catalog *msm_dp_catalog)
 {
 	u32 aux_ctrl;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	aux_ctrl = dp_read_aux(catalog, REG_DP_AUX_CTRL);
+	aux_ctrl = msm_dp_read_aux(catalog, REG_DP_AUX_CTRL);
 
 	aux_ctrl |= DP_AUX_CTRL_RESET;
-	dp_write_aux(catalog, REG_DP_AUX_CTRL, aux_ctrl);
+	msm_dp_write_aux(catalog, REG_DP_AUX_CTRL, aux_ctrl);
 	usleep_range(1000, 1100); /* h/w recommended delay */
 
 	aux_ctrl &= ~DP_AUX_CTRL_RESET;
-	dp_write_aux(catalog, REG_DP_AUX_CTRL, aux_ctrl);
+	msm_dp_write_aux(catalog, REG_DP_AUX_CTRL, aux_ctrl);
 }
 
-void dp_catalog_aux_enable(struct dp_catalog *dp_catalog, bool enable)
+void msm_dp_catalog_aux_enable(struct msm_dp_catalog *msm_dp_catalog, bool enable)
 {
 	u32 aux_ctrl;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	aux_ctrl = dp_read_aux(catalog, REG_DP_AUX_CTRL);
+	aux_ctrl = msm_dp_read_aux(catalog, REG_DP_AUX_CTRL);
 
 	if (enable) {
-		dp_write_aux(catalog, REG_DP_TIMEOUT_COUNT, 0xffff);
-		dp_write_aux(catalog, REG_DP_AUX_LIMITS, 0xffff);
+		msm_dp_write_aux(catalog, REG_DP_TIMEOUT_COUNT, 0xffff);
+		msm_dp_write_aux(catalog, REG_DP_AUX_LIMITS, 0xffff);
 		aux_ctrl |= DP_AUX_CTRL_ENABLE;
 	} else {
 		aux_ctrl &= ~DP_AUX_CTRL_ENABLE;
 	}
 
-	dp_write_aux(catalog, REG_DP_AUX_CTRL, aux_ctrl);
-}
-
-void dp_catalog_aux_update_cfg(struct dp_catalog *dp_catalog)
-{
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
-	struct dp_io *dp_io = catalog->io;
-	struct phy *phy = dp_io->phy;
-
-	phy_calibrate(phy);
+	msm_dp_write_aux(catalog, REG_DP_AUX_CTRL, aux_ctrl);
 }
 
-int dp_catalog_aux_wait_for_hpd_connect_state(struct dp_catalog *dp_catalog)
+int msm_dp_catalog_aux_wait_for_hpd_connect_state(struct msm_dp_catalog *msm_dp_catalog,
+					      unsigned long wait_us)
 {
 	u32 state;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	/* poll for hpd connected status every 2ms and timeout after 500ms */
-	return readl_poll_timeout(catalog->io->dp_controller.aux.base +
+	/* poll for hpd connected status every 2ms and timeout after wait_us */
+	return readl_poll_timeout(catalog->io.aux.base +
 				REG_DP_DP_HPD_INT_STATUS,
 				state, state & DP_DP_HPD_STATE_STATUS_CONNECTED,
-				2000, 500000);
+				min(wait_us, 2000), wait_us);
 }
 
 static void dump_regs(void __iomem *base, int len)
@@ -284,11 +321,11 @@
 	}
 }
 
-void dp_catalog_dump_regs(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_dump_regs(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-		struct dp_catalog_private, dp_catalog);
-	struct dss_io_data *io = &catalog->io->dp_controller;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
+	struct dss_io_data *io = &catalog->io;
 
 	pr_info("AHB regs\n");
 	dump_regs(io->ahb.base, io->ahb.len);
@@ -303,17 +340,17 @@
 	dump_regs(io->p0.base, io->p0.len);
 }
 
-u32 dp_catalog_aux_get_irq(struct dp_catalog *dp_catalog)
+u32 msm_dp_catalog_aux_get_irq(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 intr, intr_ack;
 
-	intr = dp_read_ahb(catalog, REG_DP_INTR_STATUS);
+	intr = msm_dp_read_ahb(catalog, REG_DP_INTR_STATUS);
 	intr &= ~DP_INTERRUPT_STATUS1_MASK;
 	intr_ack = (intr & DP_INTERRUPT_STATUS1)
 			<< DP_INTERRUPT_STATUS_ACK_SHIFT;
-	dp_write_ahb(catalog, REG_DP_INTR_STATUS, intr_ack |
+	msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS, intr_ack |
 			DP_INTERRUPT_STATUS1_MASK);
 
 	return intr;
@@ -321,40 +358,40 @@
 }
 
 /* controller related catalog functions */
-void dp_catalog_ctrl_update_transfer_unit(struct dp_catalog *dp_catalog,
-				u32 dp_tu, u32 valid_boundary,
+void msm_dp_catalog_ctrl_update_transfer_unit(struct msm_dp_catalog *msm_dp_catalog,
+				u32 msm_dp_tu, u32 valid_boundary,
 				u32 valid_boundary2)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	dp_write_link(catalog, REG_DP_VALID_BOUNDARY, valid_boundary);
-	dp_write_link(catalog, REG_DP_TU, dp_tu);
-	dp_write_link(catalog, REG_DP_VALID_BOUNDARY_2, valid_boundary2);
+	msm_dp_write_link(catalog, REG_DP_VALID_BOUNDARY, valid_boundary);
+	msm_dp_write_link(catalog, REG_DP_TU, msm_dp_tu);
+	msm_dp_write_link(catalog, REG_DP_VALID_BOUNDARY_2, valid_boundary2);
 }
 
-void dp_catalog_ctrl_state_ctrl(struct dp_catalog *dp_catalog, u32 state)
+void msm_dp_catalog_ctrl_state_ctrl(struct msm_dp_catalog *msm_dp_catalog, u32 state)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	dp_write_link(catalog, REG_DP_STATE_CTRL, state);
+	msm_dp_write_link(catalog, REG_DP_STATE_CTRL, state);
 }
 
-void dp_catalog_ctrl_config_ctrl(struct dp_catalog *dp_catalog, u32 cfg)
+void msm_dp_catalog_ctrl_config_ctrl(struct msm_dp_catalog *msm_dp_catalog, u32 cfg)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
 	drm_dbg_dp(catalog->drm_dev, "DP_CONFIGURATION_CTRL=0x%x\n", cfg);
 
-	dp_write_link(catalog, REG_DP_CONFIGURATION_CTRL, cfg);
+	msm_dp_write_link(catalog, REG_DP_CONFIGURATION_CTRL, cfg);
 }
 
-void dp_catalog_ctrl_lane_mapping(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_ctrl_lane_mapping(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 ln_0 = 0, ln_1 = 1, ln_2 = 2, ln_3 = 3; /* One-to-One mapping */
 	u32 ln_mapping;
 
@@ -363,71 +400,98 @@
 	ln_mapping |= ln_2 << LANE2_MAPPING_SHIFT;
 	ln_mapping |= ln_3 << LANE3_MAPPING_SHIFT;
 
-	dp_write_link(catalog, REG_DP_LOGICAL2PHYSICAL_LANE_MAPPING,
+	msm_dp_write_link(catalog, REG_DP_LOGICAL2PHYSICAL_LANE_MAPPING,
 			ln_mapping);
 }
 
-void dp_catalog_ctrl_psr_mainlink_enable(struct dp_catalog *dp_catalog,
+void msm_dp_catalog_ctrl_psr_mainlink_enable(struct msm_dp_catalog *msm_dp_catalog,
 						bool enable)
 {
 	u32 val;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	val = dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+	val = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
 
 	if (enable)
 		val |= DP_MAINLINK_CTRL_ENABLE;
 	else
 		val &= ~DP_MAINLINK_CTRL_ENABLE;
 
-	dp_write_link(catalog, REG_DP_MAINLINK_CTRL, val);
+	msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, val);
 }
 
-void dp_catalog_ctrl_mainlink_ctrl(struct dp_catalog *dp_catalog,
-						bool enable)
+void msm_dp_catalog_mst_config(struct msm_dp_catalog *msm_dp_catalog, bool enable)
 {
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+							      struct msm_dp_catalog_private,
+							      msm_dp_catalog);
+
 	u32 mainlink_ctrl;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+
+	mainlink_ctrl = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+	if (enable)
+		mainlink_ctrl |= (0x04000100);
+	else
+		mainlink_ctrl &= ~(0x04000100);
+
+	msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+}
+
+void msm_dp_catalog_ctrl_mainlink_ctrl(struct msm_dp_catalog *msm_dp_catalog,
+				       bool enable)
+{
+	u32 mainlink_ctrl;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
 	drm_dbg_dp(catalog->drm_dev, "enable=%d\n", enable);
 	if (enable) {
 		/*
 		 * To make sure link reg writes happens before other operation,
-		 * dp_write_link() function uses writel()
+		 * msm_dp_write_link() function uses writel()
 		 */
-		mainlink_ctrl = dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+		mainlink_ctrl = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
 
 		mainlink_ctrl &= ~(DP_MAINLINK_CTRL_RESET |
 						DP_MAINLINK_CTRL_ENABLE);
-		dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
 
 		mainlink_ctrl |= DP_MAINLINK_CTRL_RESET;
-		dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
 
 		mainlink_ctrl &= ~DP_MAINLINK_CTRL_RESET;
-		dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
 
 		mainlink_ctrl |= (DP_MAINLINK_CTRL_ENABLE |
 					DP_MAINLINK_FB_BOUNDARY_SEL);
-		dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
 	} else {
-		mainlink_ctrl = dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+		mainlink_ctrl = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
 		mainlink_ctrl &= ~DP_MAINLINK_CTRL_ENABLE;
-		dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
 	}
 }
 
-void dp_catalog_ctrl_config_misc(struct dp_catalog *dp_catalog,
+void msm_dp_catalog_ctrl_config_misc(struct msm_dp_catalog *msm_dp_catalog,
 					u32 colorimetry_cfg,
 					u32 test_bits_depth)
 {
 	u32 misc_val;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	u32 reg_offset = 0;
+
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	misc_val = dp_read_link(catalog, REG_DP_MISC1_MISC0);
+	if (msm_dp_catalog->stream_id >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid stream_id:%d\n", msm_dp_catalog->stream_id);
+		return;
+	}
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1)
+		reg_offset = REG_DP1_MISC1_MISC0 - REG_DP_MISC1_MISC0;
+
+	misc_val = msm_dp_read_link(catalog, REG_DP_MISC1_MISC0 + reg_offset);
 
 	/* clear bpp bits */
 	misc_val &= ~(0x07 << DP_MISC0_TEST_BITS_DEPTH_SHIFT);
@@ -437,12 +501,29 @@
 	misc_val |= DP_MISC0_SYNCHRONOUS_CLK;
 
 	drm_dbg_dp(catalog->drm_dev, "misc settings = 0x%x\n", misc_val);
-	dp_write_link(catalog, REG_DP_MISC1_MISC0, misc_val);
+	msm_dp_write_link(catalog, REG_DP_MISC1_MISC0 + reg_offset, misc_val);
+}
+
+void msm_dp_catalog_setup_peripheral_flush(struct msm_dp_catalog *msm_dp_catalog)
+{
+	u32 mainlink_ctrl, hw_revision;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	mainlink_ctrl = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+
+	hw_revision = msm_dp_catalog_hw_revision(msm_dp_catalog);
+	if (hw_revision >= DP_HW_VERSION_1_2)
+		mainlink_ctrl |= DP_MAINLINK_FLUSH_MODE_SDE_PERIPH_UPDATE;
+	else
+		mainlink_ctrl |= DP_MAINLINK_FLUSH_MODE_UPDATE_SDP;
+
+	msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
 }
 
-void dp_catalog_ctrl_config_msa(struct dp_catalog *dp_catalog,
+void msm_dp_catalog_ctrl_config_msa(struct msm_dp_catalog *msm_dp_catalog,
 					u32 rate, u32 stream_rate_khz,
-					bool fixed_nvid)
+					bool is_ycbcr_420)
 {
 	u32 pixel_m, pixel_n;
 	u32 mvid, nvid, pixel_div = 0, dispcc_input_rate;
@@ -450,9 +531,20 @@
 	u32 const link_rate_hbr2 = 540000;
 	u32 const link_rate_hbr3 = 810000;
 	unsigned long den, num;
+	u32 mvid_reg_off = 0, nvid_reg_off = 0;
 
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (msm_dp_catalog->stream_id >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid stream_id:%d\n", msm_dp_catalog->stream_id);
+		return;
+	}
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1) {
+		mvid_reg_off = REG_DP1_SOFTWARE_MVID - REG_DP_SOFTWARE_MVID;
+		nvid_reg_off = REG_DP1_SOFTWARE_NVID - REG_DP_SOFTWARE_NVID;
+	}
 
 	if (rate == link_rate_hbr3)
 		pixel_div = 6;
@@ -485,6 +577,9 @@
 		nvid = temp;
 	}
 
+	if (is_ycbcr_420)
+		mvid /= 2;
+
 	if (link_rate_hbr2 == rate)
 		nvid *= 2;
 
@@ -492,27 +587,32 @@
 		nvid *= 3;
 
 	drm_dbg_dp(catalog->drm_dev, "mvid=0x%x, nvid=0x%x\n", mvid, nvid);
-	dp_write_link(catalog, REG_DP_SOFTWARE_MVID, mvid);
-	dp_write_link(catalog, REG_DP_SOFTWARE_NVID, nvid);
-	dp_write_p0(catalog, MMSS_DP_DSC_DTO, 0x0);
+
+	msm_dp_write_link(catalog, REG_DP_SOFTWARE_MVID + mvid_reg_off, mvid);
+	msm_dp_write_link(catalog, REG_DP_SOFTWARE_NVID + nvid_reg_off, nvid);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		msm_dp_write_p0(catalog, MMSS_DP_DSC_DTO, 0x0);
+	else
+		msm_dp_write_p1(catalog, MMSS_DP_DSC_DTO, 0x0);
 }
 
-int dp_catalog_ctrl_set_pattern_state_bit(struct dp_catalog *dp_catalog,
+int msm_dp_catalog_ctrl_set_pattern_state_bit(struct msm_dp_catalog *msm_dp_catalog,
 					u32 state_bit)
 {
 	int bit, ret;
 	u32 data;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
 	bit = BIT(state_bit - 1);
 	drm_dbg_dp(catalog->drm_dev, "hw: bit=%d train=%d\n", bit, state_bit);
-	dp_catalog_ctrl_state_ctrl(dp_catalog, bit);
+	msm_dp_catalog_ctrl_state_ctrl(msm_dp_catalog, bit);
 
 	bit = BIT(state_bit - 1) << DP_MAINLINK_READY_LINK_TRAINING_SHIFT;
 
 	/* Poll for mainlink ready status */
-	ret = readx_poll_timeout(readl, catalog->io->dp_controller.link.base +
+	ret = readx_poll_timeout(readl, catalog->io.link.base +
 					REG_DP_MAINLINK_READY,
 					data, data & bit,
 					POLLING_SLEEP_US, POLLING_TIMEOUT_US);
@@ -524,25 +624,25 @@
 }
 
 /**
- * dp_catalog_hw_revision() - retrieve DP hw revision
+ * msm_dp_catalog_hw_revision() - retrieve DP hw revision
  *
- * @dp_catalog: DP catalog structure
+ * @msm_dp_catalog: DP catalog structure
  *
  * Return: DP controller hw revision
  *
  */
-u32 dp_catalog_hw_revision(const struct dp_catalog *dp_catalog)
+u32 msm_dp_catalog_hw_revision(const struct msm_dp_catalog *msm_dp_catalog)
 {
-	const struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	const struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	return dp_read_ahb(catalog, REG_DP_HW_VERSION);
+	return msm_dp_read_ahb(catalog, REG_DP_HW_VERSION);
 }
 
 /**
- * dp_catalog_ctrl_reset() - reset DP controller
+ * msm_dp_catalog_ctrl_reset() - reset DP controller
  *
- * @dp_catalog: DP catalog structure
+ * @msm_dp_catalog: DP catalog structure
  *
  * return: void
  *
@@ -551,31 +651,31 @@
  * NOTE: reset DP controller will also clear any pending HPD related interrupts
  * 
  */
-void dp_catalog_ctrl_reset(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_ctrl_reset(struct msm_dp_catalog *msm_dp_catalog)
 {
 	u32 sw_reset;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	sw_reset = dp_read_ahb(catalog, REG_DP_SW_RESET);
+	sw_reset = msm_dp_read_ahb(catalog, REG_DP_SW_RESET);
 
 	sw_reset |= DP_SW_RESET;
-	dp_write_ahb(catalog, REG_DP_SW_RESET, sw_reset);
+	msm_dp_write_ahb(catalog, REG_DP_SW_RESET, sw_reset);
 	usleep_range(1000, 1100); /* h/w recommended delay */
 
 	sw_reset &= ~DP_SW_RESET;
-	dp_write_ahb(catalog, REG_DP_SW_RESET, sw_reset);
+	msm_dp_write_ahb(catalog, REG_DP_SW_RESET, sw_reset);
 }
 
-bool dp_catalog_ctrl_mainlink_ready(struct dp_catalog *dp_catalog)
+bool msm_dp_catalog_ctrl_mainlink_ready(struct msm_dp_catalog *msm_dp_catalog)
 {
 	u32 data;
 	int ret;
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
 	/* Poll for mainlink ready status */
-	ret = readl_poll_timeout(catalog->io->dp_controller.link.base +
+	ret = readl_poll_timeout(catalog->io.link.base +
 				REG_DP_MAINLINK_READY,
 				data, data & DP_MAINLINK_READY_FOR_VIDEO,
 				POLLING_SLEEP_US, POLLING_TIMEOUT_US);
@@ -587,96 +687,99 @@
 	return true;
 }
 
-void dp_catalog_ctrl_enable_irq(struct dp_catalog *dp_catalog,
+void msm_dp_catalog_ctrl_enable_irq(struct msm_dp_catalog *msm_dp_catalog,
 						bool enable)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
 	if (enable) {
-		dp_write_ahb(catalog, REG_DP_INTR_STATUS,
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS,
 				DP_INTERRUPT_STATUS1_MASK);
-		dp_write_ahb(catalog, REG_DP_INTR_STATUS2,
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS2,
 				DP_INTERRUPT_STATUS2_MASK);
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS5,
+				 DP_INTERRUPT_STATUS5_MASK);
 	} else {
-		dp_write_ahb(catalog, REG_DP_INTR_STATUS, 0x00);
-		dp_write_ahb(catalog, REG_DP_INTR_STATUS2, 0x00);
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS, 0x00);
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS2, 0x00);
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS5, 0x00);
 	}
 }
 
-void dp_catalog_hpd_config_intr(struct dp_catalog *dp_catalog,
+void msm_dp_catalog_hpd_config_intr(struct msm_dp_catalog *msm_dp_catalog,
 			u32 intr_mask, bool en)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	u32 config = dp_read_aux(catalog, REG_DP_DP_HPD_INT_MASK);
+	u32 config = msm_dp_read_aux(catalog, REG_DP_DP_HPD_INT_MASK);
 
 	config = (en ? config | intr_mask : config & ~intr_mask);
 
 	drm_dbg_dp(catalog->drm_dev, "intr_mask=%#x config=%#x\n",
 					intr_mask, config);
-	dp_write_aux(catalog, REG_DP_DP_HPD_INT_MASK,
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_INT_MASK,
 				config & DP_DP_HPD_INT_MASK);
 }
 
-void dp_catalog_ctrl_hpd_enable(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_ctrl_hpd_enable(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	u32 reftimer = dp_read_aux(catalog, REG_DP_DP_HPD_REFTIMER);
+	u32 reftimer = msm_dp_read_aux(catalog, REG_DP_DP_HPD_REFTIMER);
 
 	/* Configure REFTIMER and enable it */
 	reftimer |= DP_DP_HPD_REFTIMER_ENABLE;
-	dp_write_aux(catalog, REG_DP_DP_HPD_REFTIMER, reftimer);
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_REFTIMER, reftimer);
 
 	/* Enable HPD */
-	dp_write_aux(catalog, REG_DP_DP_HPD_CTRL, DP_DP_HPD_CTRL_HPD_EN);
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_CTRL, DP_DP_HPD_CTRL_HPD_EN);
 }
 
-void dp_catalog_ctrl_hpd_disable(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_ctrl_hpd_disable(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	u32 reftimer = dp_read_aux(catalog, REG_DP_DP_HPD_REFTIMER);
+	u32 reftimer = msm_dp_read_aux(catalog, REG_DP_DP_HPD_REFTIMER);
 
 	reftimer &= ~DP_DP_HPD_REFTIMER_ENABLE;
-	dp_write_aux(catalog, REG_DP_DP_HPD_REFTIMER, reftimer);
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_REFTIMER, reftimer);
 
-	dp_write_aux(catalog, REG_DP_DP_HPD_CTRL, 0);
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_CTRL, 0);
 }
 
-static void dp_catalog_enable_sdp(struct dp_catalog_private *catalog)
+static void msm_dp_catalog_enable_sdp(struct msm_dp_catalog_private *catalog)
 {
 	/* trigger sdp */
-	dp_write_link(catalog, MMSS_DP_SDP_CFG3, UPDATE_SDP);
-	dp_write_link(catalog, MMSS_DP_SDP_CFG3, 0x0);
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG3, UPDATE_SDP);
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG3, 0x0);
 }
 
-void dp_catalog_ctrl_config_psr(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_ctrl_config_psr(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 config;
 
 	/* enable PSR1 function */
-	config = dp_read_link(catalog, REG_PSR_CONFIG);
+	config = msm_dp_read_link(catalog, REG_PSR_CONFIG);
 	config |= PSR1_SUPPORTED;
-	dp_write_link(catalog, REG_PSR_CONFIG, config);
+	msm_dp_write_link(catalog, REG_PSR_CONFIG, config);
 
-	dp_write_ahb(catalog, REG_DP_INTR_MASK4, DP_INTERRUPT_MASK4);
-	dp_catalog_enable_sdp(catalog);
+	msm_dp_write_ahb(catalog, REG_DP_INTR_MASK4, DP_INTERRUPT_MASK4);
+	msm_dp_catalog_enable_sdp(catalog);
 }
 
-void dp_catalog_ctrl_set_psr(struct dp_catalog *dp_catalog, bool enter)
+void msm_dp_catalog_ctrl_set_psr(struct msm_dp_catalog *msm_dp_catalog, bool enter)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-			struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+			struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 cmd;
 
-	cmd = dp_read_link(catalog, REG_PSR_CMD);
+	cmd = msm_dp_read_link(catalog, REG_PSR_CMD);
 
 	cmd &= ~(PSR_ENTER | PSR_EXIT);
 
@@ -685,17 +788,17 @@
 	else
 		cmd |= PSR_EXIT;
 
-	dp_catalog_enable_sdp(catalog);
-	dp_write_link(catalog, REG_PSR_CMD, cmd);
+	msm_dp_catalog_enable_sdp(catalog);
+	msm_dp_write_link(catalog, REG_PSR_CMD, cmd);
 }
 
-u32 dp_catalog_link_is_connected(struct dp_catalog *dp_catalog)
+u32 msm_dp_catalog_link_is_connected(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 status;
 
-	status = dp_read_aux(catalog, REG_DP_DP_HPD_INT_STATUS);
+	status = msm_dp_read_aux(catalog, REG_DP_DP_HPD_INT_STATUS);
 	drm_dbg_dp(catalog->drm_dev, "aux status: %#x\n", status);
 	status >>= DP_DP_HPD_STATE_STATUS_BITS_SHIFT;
 	status &= DP_DP_HPD_STATE_STATUS_BITS_MASK;
@@ -703,16 +806,16 @@
 	return status;
 }
 
-u32 dp_catalog_hpd_get_intr_status(struct dp_catalog *dp_catalog)
+u32 msm_dp_catalog_hpd_get_intr_status(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	int isr, mask;
 
-	isr = dp_read_aux(catalog, REG_DP_DP_HPD_INT_STATUS);
-	dp_write_aux(catalog, REG_DP_DP_HPD_INT_ACK,
+	isr = msm_dp_read_aux(catalog, REG_DP_DP_HPD_INT_STATUS);
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_INT_ACK,
 				 (isr & DP_DP_HPD_INT_MASK));
-	mask = dp_read_aux(catalog, REG_DP_DP_HPD_INT_MASK);
+	mask = msm_dp_read_aux(catalog, REG_DP_DP_HPD_INT_MASK);
 
 	/*
 	 * We only want to return interrupts that are unmasked to the caller.
@@ -724,134 +827,132 @@
 	return isr & (mask | ~DP_DP_HPD_INT_MASK);
 }
 
-u32 dp_catalog_ctrl_read_psr_interrupt_status(struct dp_catalog *dp_catalog)
+u32 msm_dp_catalog_ctrl_read_psr_interrupt_status(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 intr, intr_ack;
 
-	intr = dp_read_ahb(catalog, REG_DP_INTR_STATUS4);
+	intr = msm_dp_read_ahb(catalog, REG_DP_INTR_STATUS4);
 	intr_ack = (intr & DP_INTERRUPT_STATUS4)
 			<< DP_INTERRUPT_STATUS_ACK_SHIFT;
-	dp_write_ahb(catalog, REG_DP_INTR_STATUS4, intr_ack);
+	msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS4, intr_ack);
 
 	return intr;
 }
 
-int dp_catalog_ctrl_get_interrupt(struct dp_catalog *dp_catalog)
+int msm_dp_catalog_ctrl_get_interrupt(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 intr, intr_ack;
 
-	intr = dp_read_ahb(catalog, REG_DP_INTR_STATUS2);
+	intr = msm_dp_read_ahb(catalog, REG_DP_INTR_STATUS2);
 	intr &= ~DP_INTERRUPT_STATUS2_MASK;
 	intr_ack = (intr & DP_INTERRUPT_STATUS2)
 			<< DP_INTERRUPT_STATUS_ACK_SHIFT;
-	dp_write_ahb(catalog, REG_DP_INTR_STATUS2,
+	msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS2,
 			intr_ack | DP_INTERRUPT_STATUS2_MASK);
 
 	return intr;
 }
 
-void dp_catalog_ctrl_phy_reset(struct dp_catalog *dp_catalog)
+int msm_dp_catalog_ctrl_get_interrupt_5(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+							      struct msm_dp_catalog_private,
+							      msm_dp_catalog);
+	u32 intr, intr_ack;
 
-	dp_write_ahb(catalog, REG_DP_PHY_CTRL,
-			DP_PHY_CTRL_SW_RESET | DP_PHY_CTRL_SW_RESET_PLL);
-	usleep_range(1000, 1100); /* h/w recommended delay */
-	dp_write_ahb(catalog, REG_DP_PHY_CTRL, 0x0);
+	intr = msm_dp_read_ahb(catalog, REG_DP_INTR_STATUS5);
+	intr &= ~DP_INTERRUPT_STATUS5_MASK;
+	intr_ack = (intr & DP_INTERRUPT_STATUS5)
+			<< DP_INTERRUPT_STATUS_ACK_SHIFT;
+	msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS5,
+			 intr_ack | DP_INTERRUPT_STATUS5_MASK);
+
+	return intr;
 }
 
-int dp_catalog_ctrl_update_vx_px(struct dp_catalog *dp_catalog,
-		u8 v_level, u8 p_level)
+void msm_dp_catalog_ctrl_phy_reset(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
-	struct dp_io *dp_io = catalog->io;
-	struct phy *phy = dp_io->phy;
-	struct phy_configure_opts_dp *opts_dp = &dp_io->phy_opts.dp;
-
-	/* TODO: Update for all lanes instead of just first one */
-	opts_dp->voltage[0] = v_level;
-	opts_dp->pre[0] = p_level;
-	opts_dp->set_voltages = 1;
-	phy_configure(phy, &dp_io->phy_opts);
-	opts_dp->set_voltages = 0;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	return 0;
+	msm_dp_write_ahb(catalog, REG_DP_PHY_CTRL,
+			DP_PHY_CTRL_SW_RESET | DP_PHY_CTRL_SW_RESET_PLL);
+	usleep_range(1000, 1100); /* h/w recommended delay */
+	msm_dp_write_ahb(catalog, REG_DP_PHY_CTRL, 0x0);
 }
 
-void dp_catalog_ctrl_send_phy_pattern(struct dp_catalog *dp_catalog,
+void msm_dp_catalog_ctrl_send_phy_pattern(struct msm_dp_catalog *msm_dp_catalog,
 			u32 pattern)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 value = 0x0;
 
 	/* Make sure to clear the current pattern before starting a new one */
-	dp_write_link(catalog, REG_DP_STATE_CTRL, 0x0);
+	msm_dp_write_link(catalog, REG_DP_STATE_CTRL, 0x0);
 
 	drm_dbg_dp(catalog->drm_dev, "pattern: %#x\n", pattern);
 	switch (pattern) {
 	case DP_PHY_TEST_PATTERN_D10_2:
-		dp_write_link(catalog, REG_DP_STATE_CTRL,
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
 				DP_STATE_CTRL_LINK_TRAINING_PATTERN1);
 		break;
 	case DP_PHY_TEST_PATTERN_ERROR_COUNT:
 		value &= ~(1 << 16);
-		dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
+		msm_dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
 					value);
 		value |= SCRAMBLER_RESET_COUNT_VALUE;
-		dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
+		msm_dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
 					value);
-		dp_write_link(catalog, REG_DP_MAINLINK_LEVELS,
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_LEVELS,
 					DP_MAINLINK_SAFE_TO_EXIT_LEVEL_2);
-		dp_write_link(catalog, REG_DP_STATE_CTRL,
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
 					DP_STATE_CTRL_LINK_SYMBOL_ERR_MEASURE);
 		break;
 	case DP_PHY_TEST_PATTERN_PRBS7:
-		dp_write_link(catalog, REG_DP_STATE_CTRL,
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
 				DP_STATE_CTRL_LINK_PRBS7);
 		break;
 	case DP_PHY_TEST_PATTERN_80BIT_CUSTOM:
-		dp_write_link(catalog, REG_DP_STATE_CTRL,
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
 				DP_STATE_CTRL_LINK_TEST_CUSTOM_PATTERN);
 		/* 00111110000011111000001111100000 */
-		dp_write_link(catalog, REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG0,
+		msm_dp_write_link(catalog, REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG0,
 				0x3E0F83E0);
 		/* 00001111100000111110000011111000 */
-		dp_write_link(catalog, REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG1,
+		msm_dp_write_link(catalog, REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG1,
 				0x0F83E0F8);
 		/* 1111100000111110 */
-		dp_write_link(catalog, REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG2,
+		msm_dp_write_link(catalog, REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG2,
 				0x0000F83E);
 		break;
 	case DP_PHY_TEST_PATTERN_CP2520:
-		value = dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+		value = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
 		value &= ~DP_MAINLINK_CTRL_SW_BYPASS_SCRAMBLER;
-		dp_write_link(catalog, REG_DP_MAINLINK_CTRL, value);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, value);
 
 		value = DP_HBR2_ERM_PATTERN;
-		dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
+		msm_dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
 				value);
 		value |= SCRAMBLER_RESET_COUNT_VALUE;
-		dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
+		msm_dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
 					value);
-		dp_write_link(catalog, REG_DP_MAINLINK_LEVELS,
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_LEVELS,
 					DP_MAINLINK_SAFE_TO_EXIT_LEVEL_2);
-		dp_write_link(catalog, REG_DP_STATE_CTRL,
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
 					DP_STATE_CTRL_LINK_SYMBOL_ERR_MEASURE);
-		value = dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+		value = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
 		value |= DP_MAINLINK_CTRL_ENABLE;
-		dp_write_link(catalog, REG_DP_MAINLINK_CTRL, value);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, value);
 		break;
 	case DP_PHY_TEST_PATTERN_SEL_MASK:
-		dp_write_link(catalog, REG_DP_MAINLINK_CTRL,
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL,
 				DP_MAINLINK_CTRL_ENABLE);
-		dp_write_link(catalog, REG_DP_STATE_CTRL,
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
 				DP_STATE_CTRL_LINK_TRAINING_PATTERN4);
 		break;
 	default:
@@ -861,48 +962,290 @@
 	}
 }
 
-u32 dp_catalog_ctrl_read_phy_pattern(struct dp_catalog *dp_catalog)
+u32 msm_dp_catalog_ctrl_read_phy_pattern(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	return dp_read_link(catalog, REG_DP_MAINLINK_READY);
+	return msm_dp_read_link(catalog, REG_DP_MAINLINK_READY);
 }
 
 /* panel related catalog functions */
-int dp_catalog_panel_timing_cfg(struct dp_catalog *dp_catalog)
+int msm_dp_catalog_panel_timing_cfg(struct msm_dp_catalog *msm_dp_catalog, u32 total,
+				u32 sync_start, u32 width_blanking, u32 msm_dp_active)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 reg;
+	u32 offset = 0;
 
-	dp_write_link(catalog, REG_DP_TOTAL_HOR_VER,
-				dp_catalog->total);
-	dp_write_link(catalog, REG_DP_START_HOR_VER_FROM_SYNC,
-				dp_catalog->sync_start);
-	dp_write_link(catalog, REG_DP_HSYNC_VSYNC_WIDTH_POLARITY,
-				dp_catalog->width_blanking);
-	dp_write_link(catalog, REG_DP_ACTIVE_HOR_VER, dp_catalog->dp_active);
+	if (msm_dp_catalog->stream_id == DP_STREAM_1)
+		offset = REG_DP1_TOTAL_HOR_VER - REG_DP_TOTAL_HOR_VER;
 
-	reg = dp_read_p0(catalog, MMSS_DP_INTF_CONFIG);
+	msm_dp_write_link(catalog, REG_DP_TOTAL_HOR_VER + offset, total);
+	msm_dp_write_link(catalog, REG_DP_START_HOR_VER_FROM_SYNC + offset, sync_start);
+	msm_dp_write_link(catalog, REG_DP_HSYNC_VSYNC_WIDTH_POLARITY + offset, width_blanking);
+	msm_dp_write_link(catalog, REG_DP_ACTIVE_HOR_VER + offset, msm_dp_active);
 
-	if (dp_catalog->wide_bus_en)
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		reg = msm_dp_read_p0(catalog, MMSS_DP_INTF_CONFIG);
+	else
+		reg = msm_dp_read_p1(catalog, MMSS_DP_INTF_CONFIG);
+
+	if (msm_dp_catalog->wide_bus_en)
 		reg |= DP_INTF_CONFIG_DATABUS_WIDEN;
 	else
 		reg &= ~DP_INTF_CONFIG_DATABUS_WIDEN;
 
 
-	DRM_DEBUG_DP("wide_bus_en=%d reg=%#x\n", dp_catalog->wide_bus_en, reg);
+	DRM_DEBUG_DP("wide_bus_en=%d reg=%#x\n", msm_dp_catalog->wide_bus_en, reg);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		msm_dp_write_p0(catalog, MMSS_DP_INTF_CONFIG, reg);
+	else
+		msm_dp_write_p1(catalog, MMSS_DP_INTF_CONFIG, reg);
 
-	dp_write_p0(catalog, MMSS_DP_INTF_CONFIG, reg);
 	return 0;
 }
 
-void dp_catalog_panel_tpg_enable(struct dp_catalog *dp_catalog,
+int msm_dp_catalog_mst_async_fifo(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+							      struct msm_dp_catalog_private,
+							      msm_dp_catalog);
+
+	u32 reg;
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		reg = msm_dp_read_p0(catalog, MMSS_DP_ASYNC_FIFO_CONFIG);
+	else
+		reg = msm_dp_read_p1(catalog, MMSS_DP_ASYNC_FIFO_CONFIG);
+
+	/* enable MST_FIFO_CONSTANT_FILL */
+	reg |= BIT(0);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		msm_dp_write_p0(catalog, MMSS_DP_ASYNC_FIFO_CONFIG, reg);
+	else
+		msm_dp_write_p1(catalog, MMSS_DP_ASYNC_FIFO_CONFIG, reg);
+
+	return 0;
+}
+
+static void msm_dp_catalog_panel_send_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog, struct dp_sdp *vsc_sdp)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 header[2];
+	u32 val;
+	int i;
+	u32 msm_dp_generic_offset = 0;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1)
+		msm_dp_generic_offset = MMSS_DP1_GENERIC0_0 - MMSS_DP_GENERIC0_0;
+
+	msm_dp_utils_pack_sdp_header(&vsc_sdp->sdp_header, header);
+
+	msm_dp_write_link(catalog, MMSS_DP_GENERIC0_0 + msm_dp_generic_offset, header[0]);
+	msm_dp_write_link(catalog, MMSS_DP_GENERIC0_1 + msm_dp_generic_offset, header[1]);
+
+	for (i = 0; i < sizeof(vsc_sdp->db); i += 4) {
+		val = ((vsc_sdp->db[i]) | (vsc_sdp->db[i + 1] << 8) | (vsc_sdp->db[i + 2] << 16) |
+		       (vsc_sdp->db[i + 3] << 24));
+		msm_dp_write_link(catalog, MMSS_DP_GENERIC0_2 + i + msm_dp_generic_offset, val);
+	}
+}
+
+static void msm_dp_catalog_panel_update_sdp(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 hw_revision;
+	u32 sdp_cfg3_offset = 0;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1)
+		sdp_cfg3_offset = MMSS_DP1_SDP_CFG3 - MMSS_DP_SDP_CFG3;
+
+	hw_revision = msm_dp_catalog_hw_revision(msm_dp_catalog);
+	if (hw_revision < DP_HW_VERSION_1_2 && hw_revision >= DP_HW_VERSION_1_0) {
+		msm_dp_write_link(catalog, MMSS_DP_SDP_CFG3 + sdp_cfg3_offset, 0x01);
+		msm_dp_write_link(catalog, MMSS_DP_SDP_CFG3 + sdp_cfg3_offset, 0x00);
+	}
+}
+
+void msm_dp_catalog_panel_enable_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog, struct dp_sdp *vsc_sdp)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 cfg, cfg2, misc;
+	u32 misc_reg_offset = 0;
+	u32 sdp_cfg_offset = 0;
+	u32 sdp_cfg2_offset = 0;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1) {
+		misc_reg_offset = REG_DP1_MISC1_MISC0 - REG_DP_MISC1_MISC0;
+		sdp_cfg_offset = MMSS_DP1_SDP_CFG - MMSS_DP_SDP_CFG;
+		sdp_cfg2_offset = MMSS_DP1_SDP_CFG2 - MMSS_DP_SDP_CFG2;
+	}
+
+	cfg = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG + sdp_cfg_offset);
+	cfg2 = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG2 + sdp_cfg2_offset);
+	misc = msm_dp_read_link(catalog, REG_DP_MISC1_MISC0 + misc_reg_offset);
+
+	cfg |= GEN0_SDP_EN;
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG + sdp_cfg_offset, cfg);
+
+	cfg2 |= GENERIC0_SDPSIZE_VALID;
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG2 + sdp_cfg2_offset, cfg2);
+
+	msm_dp_catalog_panel_send_vsc_sdp(msm_dp_catalog, vsc_sdp);
+
+	/* indicates presence of VSC (BIT(6) of MISC1) */
+	misc |= DP_MISC1_VSC_SDP;
+
+	drm_dbg_dp(catalog->drm_dev, "vsc sdp enable=1\n");
+
+	pr_debug("misc settings = 0x%x\n", misc);
+
+	msm_dp_write_link(catalog, REG_DP_MISC1_MISC0 + misc_reg_offset, misc);
+
+	msm_dp_catalog_panel_update_sdp(msm_dp_catalog);
+}
+
+void msm_dp_catalog_panel_disable_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 cfg, cfg2, misc;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	cfg = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG);
+	cfg2 = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG2);
+	misc = msm_dp_read_link(catalog, REG_DP_MISC1_MISC0);
+
+	cfg &= ~GEN0_SDP_EN;
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG, cfg);
+
+	cfg2 &= ~GENERIC0_SDPSIZE_VALID;
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG2, cfg2);
+
+	/* switch back to MSA */
+	misc &= ~DP_MISC1_VSC_SDP;
+
+	drm_dbg_dp(catalog->drm_dev, "vsc sdp enable=0\n");
+
+	pr_debug("misc settings = 0x%x\n", misc);
+	msm_dp_write_link(catalog, REG_DP_MISC1_MISC0, misc);
+
+	msm_dp_catalog_panel_update_sdp(msm_dp_catalog);
+}
+
+void msm_dp_catalog_trigger_act(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	msm_dp_write_link(catalog, REG_DP_MST_ACT, 0x1);
+
+	/* make sure ACT signal is performed */
+	wmb();
+}
+
+bool msm_dp_catalog_read_act_complete_sts(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	return msm_dp_read_link(catalog, REG_DP_MST_ACT);
+}
+
+void msm_dp_catalog_mst_channel_alloc(struct msm_dp_catalog *msm_dp_catalog,
+				      u32 ch, u32 ch_start_slot, u32 tot_slot_cnt)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 i, slot_reg_1, slot_reg_2, slot;
+	u32 reg_off = 0;
+	int const num_slots_per_reg = 32;
+
+	if (!msm_dp_catalog || ch >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid input. ch %d\n", ch);
+		return;
+	}
+
+	if (ch_start_slot > DP_MAX_TIME_SLOTS ||
+	    (ch_start_slot + tot_slot_cnt > DP_MAX_TIME_SLOTS)) {
+		DRM_ERROR("invalid slots start %d, tot %d\n",
+			  ch_start_slot, tot_slot_cnt);
+		return;
+	}
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	drm_dbg_dp(catalog->drm_dev, "ch %d, start_slot %d, tot_slot %d\n",
+		   ch, ch_start_slot, tot_slot_cnt);
+
+	if (ch == DP_STREAM_1)
+		reg_off = REG_DP_DP1_TIMESLOT_1_32 - REG_DP_DP0_TIMESLOT_1_32;
+
+	slot_reg_1 = 0;
+	slot_reg_2 = 0;
+
+	if (ch_start_slot && tot_slot_cnt) {
+		ch_start_slot--;
+		for (i = 0; i < tot_slot_cnt; i++) {
+			if (ch_start_slot < num_slots_per_reg) {
+				slot_reg_1 |= BIT(ch_start_slot);
+			} else {
+				slot = ch_start_slot - num_slots_per_reg;
+				slot_reg_2 |= BIT(slot);
+			}
+			ch_start_slot++;
+		}
+	}
+
+	drm_dbg_dp(catalog->drm_dev, "ch:%d slot_reg_1:%d, slot_reg_2:%d\n", ch,
+		   slot_reg_1, slot_reg_2);
+
+	msm_dp_write_link(catalog, REG_DP_DP0_TIMESLOT_1_32 + reg_off, slot_reg_1);
+	msm_dp_write_link(catalog, REG_DP_DP0_TIMESLOT_33_63 + reg_off, slot_reg_2);
+}
+
+void msm_dp_catalog_ctrl_update_rg(struct msm_dp_catalog *msm_dp_catalog, u32 stream,
+				   u32 x_int, u32 y_frac_enum)
+{
+	struct msm_dp_catalog_private *catalog;
+
+	u32 rg, reg_off = 0;
+
+	if (!msm_dp_catalog || stream >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid input. stream %d\n", stream);
+		return;
+	}
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	rg = y_frac_enum;
+	rg |= (x_int << 16);
+
+	drm_dbg_dp(catalog->drm_dev, "stream: %d x_int:%d y_frac_enum:%d rg:%d\n",
+		   stream, x_int, y_frac_enum, rg);
+
+	if (stream == DP_STREAM_1)
+		reg_off = REG_DP_DP1_RG - REG_DP_DP0_RG;
+
+	msm_dp_write_link(catalog, REG_DP_DP0_RG + reg_off, rg);
+}
+
+void msm_dp_catalog_panel_tpg_enable(struct msm_dp_catalog *msm_dp_catalog,
 				struct drm_display_mode *drm_mode)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 	u32 hsync_period, vsync_period;
 	u32 display_v_start, display_v_end;
 	u32 hsync_start_x, hsync_end_x;
@@ -934,144 +1277,201 @@
 	display_hctl = (hsync_end_x << 16) | hsync_start_x;
 
 
-	dp_write_p0(catalog, MMSS_DP_INTF_CONFIG, 0x0);
-	dp_write_p0(catalog, MMSS_DP_INTF_HSYNC_CTL, hsync_ctl);
-	dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PERIOD_F0, vsync_period *
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_CONFIG, 0x0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_HSYNC_CTL, hsync_ctl);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PERIOD_F0, vsync_period *
 			hsync_period);
-	dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F0, v_sync_width *
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F0, v_sync_width *
 			hsync_period);
-	dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PERIOD_F1, 0);
-	dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F1, 0);
-	dp_write_p0(catalog, MMSS_DP_INTF_DISPLAY_HCTL, display_hctl);
-	dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_HCTL, 0);
-	dp_write_p0(catalog, MMSS_INTF_DISPLAY_V_START_F0, display_v_start);
-	dp_write_p0(catalog, MMSS_DP_INTF_DISPLAY_V_END_F0, display_v_end);
-	dp_write_p0(catalog, MMSS_INTF_DISPLAY_V_START_F1, 0);
-	dp_write_p0(catalog, MMSS_DP_INTF_DISPLAY_V_END_F1, 0);
-	dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_START_F0, 0);
-	dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_END_F0, 0);
-	dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_START_F1, 0);
-	dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_END_F1, 0);
-	dp_write_p0(catalog, MMSS_DP_INTF_POLARITY_CTL, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PERIOD_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_DISPLAY_HCTL, display_hctl);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_HCTL, 0);
+	msm_dp_write_p0(catalog, MMSS_INTF_DISPLAY_V_START_F0, display_v_start);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_DISPLAY_V_END_F0, display_v_end);
+	msm_dp_write_p0(catalog, MMSS_INTF_DISPLAY_V_START_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_DISPLAY_V_END_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_START_F0, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_END_F0, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_START_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_END_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_POLARITY_CTL, 0);
 
-	dp_write_p0(catalog, MMSS_DP_TPG_MAIN_CONTROL,
+	msm_dp_write_p0(catalog, MMSS_DP_TPG_MAIN_CONTROL,
 				DP_TPG_CHECKERED_RECT_PATTERN);
-	dp_write_p0(catalog, MMSS_DP_TPG_VIDEO_CONFIG,
+	msm_dp_write_p0(catalog, MMSS_DP_TPG_VIDEO_CONFIG,
 				DP_TPG_VIDEO_CONFIG_BPP_8BIT |
 				DP_TPG_VIDEO_CONFIG_RGB);
-	dp_write_p0(catalog, MMSS_DP_BIST_ENABLE,
+	msm_dp_write_p0(catalog, MMSS_DP_BIST_ENABLE,
 				DP_BIST_ENABLE_DPBIST_EN);
-	dp_write_p0(catalog, MMSS_DP_TIMING_ENGINE_EN,
+	msm_dp_write_p0(catalog, MMSS_DP_TIMING_ENGINE_EN,
 				DP_TIMING_ENGINE_EN_EN);
 	drm_dbg_dp(catalog->drm_dev, "%s: enabled tpg\n", __func__);
 }
 
-void dp_catalog_panel_tpg_disable(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_panel_tpg_disable(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog = container_of(dp_catalog,
-				struct dp_catalog_private, dp_catalog);
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
 
-	dp_write_p0(catalog, MMSS_DP_TPG_MAIN_CONTROL, 0x0);
-	dp_write_p0(catalog, MMSS_DP_BIST_ENABLE, 0x0);
-	dp_write_p0(catalog, MMSS_DP_TIMING_ENGINE_EN, 0x0);
+	msm_dp_write_p0(catalog, MMSS_DP_TPG_MAIN_CONTROL, 0x0);
+	msm_dp_write_p0(catalog, MMSS_DP_BIST_ENABLE, 0x0);
+	msm_dp_write_p0(catalog, MMSS_DP_TIMING_ENGINE_EN, 0x0);
 }
 
-struct dp_catalog *dp_catalog_get(struct device *dev, struct dp_io *io)
+static void __iomem *msm_dp_ioremap(struct platform_device *pdev, int idx, size_t *len)
 {
-	struct dp_catalog_private *catalog;
+	struct resource *res;
+	void __iomem *base;
+
+	base = devm_platform_get_and_ioremap_resource(pdev, idx, &res);
+	if (!IS_ERR(base))
+		*len = resource_size(res);
+
+	return base;
+}
 
-	if (!io) {
-		DRM_ERROR("invalid input\n");
-		return ERR_PTR(-EINVAL);
+static int msm_dp_catalog_get_io(struct msm_dp_catalog_private *catalog)
+{
+	struct platform_device *pdev = to_platform_device(catalog->dev);
+	struct dss_io_data *dss = &catalog->io;
+
+	dss->ahb.base = msm_dp_ioremap(pdev, 0, &dss->ahb.len);
+	if (IS_ERR(dss->ahb.base))
+		return PTR_ERR(dss->ahb.base);
+
+	dss->aux.base = msm_dp_ioremap(pdev, 1, &dss->aux.len);
+	if (IS_ERR(dss->aux.base)) {
+		/*
+		 * The initial binding had a single reg, but in order to
+		 * support variation in the sub-region sizes this was split.
+		 * msm_dp_ioremap() will fail with -EINVAL here if only a single
+		 * reg is specified, so fill in the sub-region offsets and
+		 * lengths based on this single region.
+		 */
+		if (PTR_ERR(dss->aux.base) == -EINVAL) {
+			if (dss->ahb.len < DP_DEFAULT_P0_OFFSET + DP_DEFAULT_P0_SIZE) {
+				DRM_ERROR("legacy memory region not large enough\n");
+				return -EINVAL;
+			}
+
+			dss->ahb.len = DP_DEFAULT_AHB_SIZE;
+			dss->aux.base = dss->ahb.base + DP_DEFAULT_AUX_OFFSET;
+			dss->aux.len = DP_DEFAULT_AUX_SIZE;
+			dss->link.base = dss->ahb.base + DP_DEFAULT_LINK_OFFSET;
+			dss->link.len = DP_DEFAULT_LINK_SIZE;
+			dss->p0.base = dss->ahb.base + DP_DEFAULT_P0_OFFSET;
+			dss->p0.len = DP_DEFAULT_P0_SIZE;
+		} else {
+			DRM_ERROR("unable to remap aux region: %pe\n", dss->aux.base);
+			return PTR_ERR(dss->aux.base);
+		}
+	} else {
+		dss->link.base = msm_dp_ioremap(pdev, 2, &dss->link.len);
+		if (IS_ERR(dss->link.base)) {
+			DRM_ERROR("unable to remap link region: %pe\n", dss->link.base);
+			return PTR_ERR(dss->link.base);
+		}
+
+		dss->p0.base = msm_dp_ioremap(pdev, 3, &dss->p0.len);
+		if (IS_ERR(dss->p0.base)) {
+			DRM_ERROR("unable to remap p0 region: %pe\n", dss->p0.base);
+			return PTR_ERR(dss->p0.base);
+		}
+
+		dss->p1.base = msm_dp_ioremap(pdev, 4, &dss->p1.len);
+		if (IS_ERR(dss->p1.base)) {
+			DRM_ERROR("unable to remap p1 region: %pe\n", dss->p1.base);
+			return PTR_ERR(dss->p1.base);
+		}
 	}
 
+	return 0;
+}
+
+struct msm_dp_catalog *msm_dp_catalog_get(struct device *dev)
+{
+	struct msm_dp_catalog_private *catalog;
+	int ret;
+
 	catalog  = devm_kzalloc(dev, sizeof(*catalog), GFP_KERNEL);
 	if (!catalog)
 		return ERR_PTR(-ENOMEM);
 
 	catalog->dev = dev;
-	catalog->io = io;
 
-	return &catalog->dp_catalog;
+	ret = msm_dp_catalog_get_io(catalog);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return &catalog->msm_dp_catalog;
 }
 
-void dp_catalog_audio_get_header(struct dp_catalog *dp_catalog)
+u32 msm_dp_catalog_audio_get_header(struct msm_dp_catalog *msm_dp_catalog,
+				enum msm_dp_catalog_audio_sdp_type sdp,
+				enum msm_dp_catalog_audio_header_type header)
 {
-	struct dp_catalog_private *catalog;
+	struct msm_dp_catalog_private *catalog;
 	u32 (*sdp_map)[DP_AUDIO_SDP_HEADER_MAX];
-	enum dp_catalog_audio_sdp_type sdp;
-	enum dp_catalog_audio_header_type header;
 
-	if (!dp_catalog)
-		return;
-
-	catalog = container_of(dp_catalog,
-		struct dp_catalog_private, dp_catalog);
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
 
 	sdp_map = catalog->audio_map;
-	sdp     = dp_catalog->sdp_type;
-	header  = dp_catalog->sdp_header;
 
-	dp_catalog->audio_data = dp_read_link(catalog,
-			sdp_map[sdp][header]);
+	return msm_dp_read_link(catalog, sdp_map[sdp][header]);
 }
 
-void dp_catalog_audio_set_header(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_audio_set_header(struct msm_dp_catalog *msm_dp_catalog,
+				 enum msm_dp_catalog_audio_sdp_type sdp,
+				 enum msm_dp_catalog_audio_header_type header,
+				 u32 data)
 {
-	struct dp_catalog_private *catalog;
+	struct msm_dp_catalog_private *catalog;
 	u32 (*sdp_map)[DP_AUDIO_SDP_HEADER_MAX];
-	enum dp_catalog_audio_sdp_type sdp;
-	enum dp_catalog_audio_header_type header;
-	u32 data;
 
-	if (!dp_catalog)
+	if (!msm_dp_catalog)
 		return;
 
-	catalog = container_of(dp_catalog,
-		struct dp_catalog_private, dp_catalog);
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
 
 	sdp_map = catalog->audio_map;
-	sdp     = dp_catalog->sdp_type;
-	header  = dp_catalog->sdp_header;
-	data    = dp_catalog->audio_data;
 
-	dp_write_link(catalog, sdp_map[sdp][header], data);
+	msm_dp_write_link(catalog, sdp_map[sdp][header], data);
 }
 
-void dp_catalog_audio_config_acr(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_audio_config_acr(struct msm_dp_catalog *msm_dp_catalog, u32 select)
 {
-	struct dp_catalog_private *catalog;
-	u32 acr_ctrl, select;
+	struct msm_dp_catalog_private *catalog;
+	u32 acr_ctrl;
 
-	if (!dp_catalog)
+	if (!msm_dp_catalog)
 		return;
 
-	catalog = container_of(dp_catalog,
-		struct dp_catalog_private, dp_catalog);
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
 
-	select = dp_catalog->audio_data;
 	acr_ctrl = select << 4 | BIT(31) | BIT(8) | BIT(14);
 
 	drm_dbg_dp(catalog->drm_dev, "select: %#x, acr_ctrl: %#x\n",
 					select, acr_ctrl);
 
-	dp_write_link(catalog, MMSS_DP_AUDIO_ACR_CTRL, acr_ctrl);
+	msm_dp_write_link(catalog, MMSS_DP_AUDIO_ACR_CTRL, acr_ctrl);
 }
 
-void dp_catalog_audio_enable(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_audio_enable(struct msm_dp_catalog *msm_dp_catalog, bool enable)
 {
-	struct dp_catalog_private *catalog;
-	bool enable;
+	struct msm_dp_catalog_private *catalog;
 	u32 audio_ctrl;
 
-	if (!dp_catalog)
+	if (!msm_dp_catalog)
 		return;
 
-	catalog = container_of(dp_catalog,
-		struct dp_catalog_private, dp_catalog);
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
 
-	enable = !!dp_catalog->audio_data;
-	audio_ctrl = dp_read_link(catalog, MMSS_DP_AUDIO_CFG);
+	audio_ctrl = msm_dp_read_link(catalog, MMSS_DP_AUDIO_CFG);
 
 	if (enable)
 		audio_ctrl |= BIT(0);
@@ -1080,24 +1480,24 @@
 
 	drm_dbg_dp(catalog->drm_dev, "dp_audio_cfg = 0x%x\n", audio_ctrl);
 
-	dp_write_link(catalog, MMSS_DP_AUDIO_CFG, audio_ctrl);
+	msm_dp_write_link(catalog, MMSS_DP_AUDIO_CFG, audio_ctrl);
 	/* make sure audio engine is disabled */
 	wmb();
 }
 
-void dp_catalog_audio_config_sdp(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_audio_config_sdp(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog;
+	struct msm_dp_catalog_private *catalog;
 	u32 sdp_cfg = 0;
 	u32 sdp_cfg2 = 0;
 
-	if (!dp_catalog)
+	if (!msm_dp_catalog)
 		return;
 
-	catalog = container_of(dp_catalog,
-		struct dp_catalog_private, dp_catalog);
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
 
-	sdp_cfg = dp_read_link(catalog, MMSS_DP_SDP_CFG);
+	sdp_cfg = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG);
 	/* AUDIO_TIMESTAMP_SDP_EN */
 	sdp_cfg |= BIT(1);
 	/* AUDIO_STREAM_SDP_EN */
@@ -1111,9 +1511,9 @@
 
 	drm_dbg_dp(catalog->drm_dev, "sdp_cfg = 0x%x\n", sdp_cfg);
 
-	dp_write_link(catalog, MMSS_DP_SDP_CFG, sdp_cfg);
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG, sdp_cfg);
 
-	sdp_cfg2 = dp_read_link(catalog, MMSS_DP_SDP_CFG2);
+	sdp_cfg2 = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG2);
 	/* IFRM_REGSRC -> Do not use reg values */
 	sdp_cfg2 &= ~BIT(0);
 	/* AUDIO_STREAM_HB3_REGSRC-> Do not use reg values */
@@ -1121,12 +1521,12 @@
 
 	drm_dbg_dp(catalog->drm_dev, "sdp_cfg2 = 0x%x\n", sdp_cfg2);
 
-	dp_write_link(catalog, MMSS_DP_SDP_CFG2, sdp_cfg2);
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG2, sdp_cfg2);
 }
 
-void dp_catalog_audio_init(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_audio_init(struct msm_dp_catalog *msm_dp_catalog)
 {
-	struct dp_catalog_private *catalog;
+	struct msm_dp_catalog_private *catalog;
 
 	static u32 sdp_map[][DP_AUDIO_SDP_HEADER_MAX] = {
 		{
@@ -1156,28 +1556,27 @@
 		},
 	};
 
-	if (!dp_catalog)
+	if (!msm_dp_catalog)
 		return;
 
-	catalog = container_of(dp_catalog,
-		struct dp_catalog_private, dp_catalog);
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
 
 	catalog->audio_map = sdp_map;
 }
 
-void dp_catalog_audio_sfe_level(struct dp_catalog *dp_catalog)
+void msm_dp_catalog_audio_sfe_level(struct msm_dp_catalog *msm_dp_catalog, u32 safe_to_exit_level)
 {
-	struct dp_catalog_private *catalog;
-	u32 mainlink_levels, safe_to_exit_level;
+	struct msm_dp_catalog_private *catalog;
+	u32 mainlink_levels;
 
-	if (!dp_catalog)
+	if (!msm_dp_catalog)
 		return;
 
-	catalog = container_of(dp_catalog,
-		struct dp_catalog_private, dp_catalog);
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
 
-	safe_to_exit_level = dp_catalog->audio_data;
-	mainlink_levels = dp_read_link(catalog, REG_DP_MAINLINK_LEVELS);
+	mainlink_levels = msm_dp_read_link(catalog, REG_DP_MAINLINK_LEVELS);
 	mainlink_levels &= 0xFE0;
 	mainlink_levels |= safe_to_exit_level;
 
@@ -1185,5 +1584,5 @@
 			"mainlink_level = 0x%x, safe_to_exit_level = 0x%x\n",
 			 mainlink_levels, safe_to_exit_level);
 
-	dp_write_link(catalog, REG_DP_MAINLINK_LEVELS, mainlink_levels);
+	msm_dp_write_link(catalog, REG_DP_MAINLINK_LEVELS, mainlink_levels);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_catalog.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_catalog.h
@@ -8,7 +8,7 @@
 
 #include <drm/drm_modes.h>
 
-#include "dp_parser.h"
+#include "dp_utils.h"
 #include "disp/msm_disp_snapshot.h"
 
 /* interrupts */
@@ -28,24 +28,15 @@
 #define DP_INTR_FRAME_END		BIT(6)
 #define DP_INTR_CRC_UPDATED		BIT(9)
 
-#define DP_AUX_CFG_MAX_VALUE_CNT 3
+#define DP_INTR_DP0_VCPF_SENT		BIT(0)
+#define DP_INTR_DP1_VCPF_SENT		BIT(3)
 
-/* PHY AUX config registers */
-enum dp_phy_aux_config_type {
-	PHY_AUX_CFG0,
-	PHY_AUX_CFG1,
-	PHY_AUX_CFG2,
-	PHY_AUX_CFG3,
-	PHY_AUX_CFG4,
-	PHY_AUX_CFG5,
-	PHY_AUX_CFG6,
-	PHY_AUX_CFG7,
-	PHY_AUX_CFG8,
-	PHY_AUX_CFG9,
-	PHY_AUX_CFG_MAX,
-};
+#define DP_HW_VERSION_1_0	0x10000000
+#define DP_HW_VERSION_1_2	0x10020000
+
+#define DP_MAX_TIME_SLOTS 64
 
-enum dp_catalog_audio_sdp_type {
+enum msm_dp_catalog_audio_sdp_type {
 	DP_AUDIO_SDP_STREAM,
 	DP_AUDIO_SDP_TIMESTAMP,
 	DP_AUDIO_SDP_INFOFRAME,
@@ -54,90 +45,110 @@
 	DP_AUDIO_SDP_MAX,
 };
 
-enum dp_catalog_audio_header_type {
+enum msm_dp_catalog_audio_header_type {
 	DP_AUDIO_SDP_HEADER_1,
 	DP_AUDIO_SDP_HEADER_2,
 	DP_AUDIO_SDP_HEADER_3,
 	DP_AUDIO_SDP_HEADER_MAX,
 };
 
-struct dp_catalog {
-	u32 aux_data;
-	u32 total;
-	u32 sync_start;
-	u32 width_blanking;
-	u32 dp_active;
-	enum dp_catalog_audio_sdp_type sdp_type;
-	enum dp_catalog_audio_header_type sdp_header;
-	u32 audio_data;
+/* stream id */
+enum msm_dp_stream_id {
+	DP_STREAM_0,
+	DP_STREAM_1,
+	DP_STREAM_2,
+	DP_STREAM_3,
+	DP_STREAM_MAX,
+};
+
+struct msm_dp_catalog {
 	bool wide_bus_en;
+	enum msm_dp_stream_id stream_id;
 };
 
 /* Debug module */
-void dp_catalog_snapshot(struct dp_catalog *dp_catalog, struct msm_disp_state *disp_state);
+void msm_dp_catalog_snapshot(struct msm_dp_catalog *msm_dp_catalog, struct msm_disp_state *disp_state);
 
 /* AUX APIs */
-u32 dp_catalog_aux_read_data(struct dp_catalog *dp_catalog);
-int dp_catalog_aux_write_data(struct dp_catalog *dp_catalog);
-int dp_catalog_aux_write_trans(struct dp_catalog *dp_catalog);
-int dp_catalog_aux_clear_trans(struct dp_catalog *dp_catalog, bool read);
-int dp_catalog_aux_clear_hw_interrupts(struct dp_catalog *dp_catalog);
-void dp_catalog_aux_reset(struct dp_catalog *dp_catalog);
-void dp_catalog_aux_enable(struct dp_catalog *dp_catalog, bool enable);
-void dp_catalog_aux_update_cfg(struct dp_catalog *dp_catalog);
-int dp_catalog_aux_wait_for_hpd_connect_state(struct dp_catalog *dp_catalog);
-u32 dp_catalog_aux_get_irq(struct dp_catalog *dp_catalog);
+u32 msm_dp_catalog_aux_read_data(struct msm_dp_catalog *msm_dp_catalog);
+int msm_dp_catalog_aux_write_data(struct msm_dp_catalog *msm_dp_catalog, u32 data);
+int msm_dp_catalog_aux_write_trans(struct msm_dp_catalog *msm_dp_catalog, u32 data);
+int msm_dp_catalog_aux_clear_trans(struct msm_dp_catalog *msm_dp_catalog, bool read);
+int msm_dp_catalog_aux_clear_hw_interrupts(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_aux_reset(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_aux_enable(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+int msm_dp_catalog_aux_wait_for_hpd_connect_state(struct msm_dp_catalog *msm_dp_catalog,
+					      unsigned long wait_us);
+u32 msm_dp_catalog_aux_get_irq(struct msm_dp_catalog *msm_dp_catalog);
 
 /* DP Controller APIs */
-void dp_catalog_ctrl_state_ctrl(struct dp_catalog *dp_catalog, u32 state);
-void dp_catalog_ctrl_config_ctrl(struct dp_catalog *dp_catalog, u32 config);
-void dp_catalog_ctrl_lane_mapping(struct dp_catalog *dp_catalog);
-void dp_catalog_ctrl_mainlink_ctrl(struct dp_catalog *dp_catalog, bool enable);
-void dp_catalog_ctrl_psr_mainlink_enable(struct dp_catalog *dp_catalog, bool enable);
-void dp_catalog_ctrl_config_misc(struct dp_catalog *dp_catalog, u32 cc, u32 tb);
-void dp_catalog_ctrl_config_msa(struct dp_catalog *dp_catalog, u32 rate,
-				u32 stream_rate_khz, bool fixed_nvid);
-int dp_catalog_ctrl_set_pattern_state_bit(struct dp_catalog *dp_catalog, u32 pattern);
-u32 dp_catalog_hw_revision(const struct dp_catalog *dp_catalog);
-void dp_catalog_ctrl_reset(struct dp_catalog *dp_catalog);
-bool dp_catalog_ctrl_mainlink_ready(struct dp_catalog *dp_catalog);
-void dp_catalog_ctrl_enable_irq(struct dp_catalog *dp_catalog, bool enable);
-void dp_catalog_hpd_config_intr(struct dp_catalog *dp_catalog,
+void msm_dp_catalog_ctrl_state_ctrl(struct msm_dp_catalog *msm_dp_catalog, u32 state);
+void msm_dp_catalog_ctrl_config_ctrl(struct msm_dp_catalog *msm_dp_catalog, u32 config);
+void msm_dp_catalog_ctrl_lane_mapping(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_mainlink_ctrl(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+void msm_dp_catalog_ctrl_psr_mainlink_enable(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+void msm_dp_catalog_setup_peripheral_flush(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_config_misc(struct msm_dp_catalog *msm_dp_catalog, u32 cc, u32 tb);
+void msm_dp_catalog_ctrl_config_msa(struct msm_dp_catalog *msm_dp_catalog, u32 rate,
+				u32 stream_rate_khz, bool is_ycbcr_420);
+int msm_dp_catalog_ctrl_set_pattern_state_bit(struct msm_dp_catalog *msm_dp_catalog, u32 pattern);
+u32 msm_dp_catalog_hw_revision(const struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_reset(struct msm_dp_catalog *msm_dp_catalog);
+bool msm_dp_catalog_ctrl_mainlink_ready(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_enable_irq(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+void msm_dp_catalog_hpd_config_intr(struct msm_dp_catalog *msm_dp_catalog,
 			u32 intr_mask, bool en);
-void dp_catalog_ctrl_hpd_enable(struct dp_catalog *dp_catalog);
-void dp_catalog_ctrl_hpd_disable(struct dp_catalog *dp_catalog);
-void dp_catalog_ctrl_config_psr(struct dp_catalog *dp_catalog);
-void dp_catalog_ctrl_set_psr(struct dp_catalog *dp_catalog, bool enter);
-u32 dp_catalog_link_is_connected(struct dp_catalog *dp_catalog);
-u32 dp_catalog_hpd_get_intr_status(struct dp_catalog *dp_catalog);
-void dp_catalog_ctrl_phy_reset(struct dp_catalog *dp_catalog);
-int dp_catalog_ctrl_update_vx_px(struct dp_catalog *dp_catalog, u8 v_level,
-				u8 p_level);
-int dp_catalog_ctrl_get_interrupt(struct dp_catalog *dp_catalog);
-u32 dp_catalog_ctrl_read_psr_interrupt_status(struct dp_catalog *dp_catalog);
-void dp_catalog_ctrl_update_transfer_unit(struct dp_catalog *dp_catalog,
-				u32 dp_tu, u32 valid_boundary,
+void msm_dp_catalog_ctrl_hpd_enable(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_hpd_disable(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_config_psr(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_set_psr(struct msm_dp_catalog *msm_dp_catalog, bool enter);
+u32 msm_dp_catalog_link_is_connected(struct msm_dp_catalog *msm_dp_catalog);
+u32 msm_dp_catalog_hpd_get_intr_status(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_phy_reset(struct msm_dp_catalog *msm_dp_catalog);
+int msm_dp_catalog_ctrl_get_interrupt(struct msm_dp_catalog *msm_dp_catalog);
+int msm_dp_catalog_ctrl_get_interrupt_5(struct msm_dp_catalog *msm_dp_catalog);
+u32 msm_dp_catalog_ctrl_read_psr_interrupt_status(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_update_transfer_unit(struct msm_dp_catalog *msm_dp_catalog,
+				u32 msm_dp_tu, u32 valid_boundary,
 				u32 valid_boundary2);
-void dp_catalog_ctrl_send_phy_pattern(struct dp_catalog *dp_catalog,
+void msm_dp_catalog_ctrl_send_phy_pattern(struct msm_dp_catalog *msm_dp_catalog,
 				u32 pattern);
-u32 dp_catalog_ctrl_read_phy_pattern(struct dp_catalog *dp_catalog);
+u32 msm_dp_catalog_ctrl_read_phy_pattern(struct msm_dp_catalog *msm_dp_catalog);
 
 /* DP Panel APIs */
-int dp_catalog_panel_timing_cfg(struct dp_catalog *dp_catalog);
-void dp_catalog_dump_regs(struct dp_catalog *dp_catalog);
-void dp_catalog_panel_tpg_enable(struct dp_catalog *dp_catalog,
+int msm_dp_catalog_panel_timing_cfg(struct msm_dp_catalog *msm_dp_catalog, u32 total,
+				u32 sync_start, u32 width_blanking, u32 msm_dp_active);
+void msm_dp_catalog_panel_enable_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog, struct dp_sdp *vsc_sdp);
+void msm_dp_catalog_panel_disable_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_dump_regs(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_panel_tpg_enable(struct msm_dp_catalog *msm_dp_catalog,
 				struct drm_display_mode *drm_mode);
-void dp_catalog_panel_tpg_disable(struct dp_catalog *dp_catalog);
+void msm_dp_catalog_panel_tpg_disable(struct msm_dp_catalog *msm_dp_catalog);
 
-struct dp_catalog *dp_catalog_get(struct device *dev, struct dp_io *io);
+struct msm_dp_catalog *msm_dp_catalog_get(struct device *dev);
 
 /* DP Audio APIs */
-void dp_catalog_audio_get_header(struct dp_catalog *catalog);
-void dp_catalog_audio_set_header(struct dp_catalog *catalog);
-void dp_catalog_audio_config_acr(struct dp_catalog *catalog);
-void dp_catalog_audio_enable(struct dp_catalog *catalog);
-void dp_catalog_audio_config_sdp(struct dp_catalog *catalog);
-void dp_catalog_audio_init(struct dp_catalog *catalog);
-void dp_catalog_audio_sfe_level(struct dp_catalog *catalog);
+u32 msm_dp_catalog_audio_get_header(struct msm_dp_catalog *msm_dp_catalog,
+				enum msm_dp_catalog_audio_sdp_type sdp,
+				enum msm_dp_catalog_audio_header_type header);
+void msm_dp_catalog_audio_set_header(struct msm_dp_catalog *msm_dp_catalog,
+				 enum msm_dp_catalog_audio_sdp_type sdp,
+				 enum msm_dp_catalog_audio_header_type header,
+				 u32 data);
+void msm_dp_catalog_audio_config_acr(struct msm_dp_catalog *catalog, u32 select);
+void msm_dp_catalog_audio_enable(struct msm_dp_catalog *catalog, bool enable);
+void msm_dp_catalog_audio_config_sdp(struct msm_dp_catalog *catalog);
+void msm_dp_catalog_audio_init(struct msm_dp_catalog *catalog);
+void msm_dp_catalog_audio_sfe_level(struct msm_dp_catalog *catalog, u32 safe_to_exit_level);
+
+/* DP MST APIs */
+void msm_dp_catalog_trigger_act(struct msm_dp_catalog *msm_dp_catalog);
+bool msm_dp_catalog_read_act_complete_sts(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_mst_config(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+void msm_dp_catalog_mst_channel_alloc(struct msm_dp_catalog *msm_dp_catalog,
+				      u32 ch, u32 ch_start_slot, u32 tot_slot_cnt);
+void msm_dp_catalog_ctrl_update_rg(struct msm_dp_catalog *msm_dp_catalog, u32 stream,
+				   u32 x_int, u32 y_frac_enum);
+int msm_dp_catalog_mst_async_fifo(struct msm_dp_catalog *msm_dp_catalog);
 
 #endif /* _DP_CATALOG_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -27,6 +27,11 @@
 
 #define DP_CTRL_INTR_READY_FOR_VIDEO     BIT(0)
 #define DP_CTRL_INTR_IDLE_PATTERN_SENT  BIT(3)
+#define DP_CTRL_INTR_DP0_VCPF_SENT       BIT(0)
+#define DP_CTRL_INTR_DP1_VCPF_SENT       BIT(3)
+
+#define MST_DP0_PUSH_VCPF		BIT(12)
+#define MST_DP1_PUSH_VCPF		BIT(14)
 
 #define MR_LINK_TRAINING1  0x8
 #define MR_LINK_SYMBOL_ERM 0x80
@@ -40,7 +45,7 @@
 	DP_TRAINING_2,
 };
 
-struct dp_tu_calc_input {
+struct msm_dp_tu_calc_input {
 	u64 lclk;        /* 162, 270, 540 and 810 */
 	u64 pclk_khz;    /* in KHz */
 	u64 hactive;     /* active h-width */
@@ -55,7 +60,7 @@
 	int num_of_dsc_slices; /* number of slices per line */
 };
 
-struct dp_vc_tu_mapping_table {
+struct msm_dp_vc_tu_mapping_table {
 	u32 vic;
 	u8 lanes;
 	u8 lrate; /* DP_LINK_RATE -> 162(6), 270(10), 540(20), 810 (30) */
@@ -69,24 +74,46 @@
 	u8 tu_size_minus1;
 };
 
-struct dp_ctrl_private {
-	struct dp_ctrl dp_ctrl;
+struct msm_dp_mst_ch_slot_info {
+	u32 start_slot;
+	u32 tot_slots;
+};
+
+struct msm_dp_ctrl_private {
+	struct msm_dp_ctrl msm_dp_ctrl;
 	struct drm_device *drm_dev;
 	struct device *dev;
 	struct drm_dp_aux *aux;
-	struct dp_panel *panel;
-	struct dp_link *link;
-	struct dp_power *power;
-	struct dp_parser *parser;
-	struct dp_catalog *catalog;
+	struct msm_dp_panel *panel;
+	struct msm_dp_link *link;
+	struct msm_dp_catalog *catalog;
+
+	struct phy *phy;
+
+	unsigned int num_core_clks;
+	struct clk_bulk_data *core_clks;
+
+	unsigned int num_link_clks;
+	struct clk_bulk_data *link_clks;
+
+	struct clk *pixel_clk[DP_STREAM_MAX];
+
+	union phy_configure_opts phy_opts;
 
 	struct completion idle_comp;
 	struct completion psr_op_comp;
 	struct completion video_comp;
+
+	bool core_clks_on;
+	bool link_clks_on;
+	bool mst_active;
+	bool stream_clks_on[DP_STREAM_MAX];
+
+	struct msm_dp_mst_ch_slot_info mst_ch_info[DP_STREAM_MAX];
 };
 
-static int dp_aux_link_configure(struct drm_dp_aux *aux,
-					struct dp_link_info *link)
+static int msm_dp_aux_link_configure(struct drm_dp_aux *aux,
+					struct msm_dp_link_info *link)
 {
 	u8 values[2];
 	int err;
@@ -104,14 +131,14 @@
 	return 0;
 }
 
-void dp_ctrl_push_idle(struct dp_ctrl *dp_ctrl)
+void msm_dp_ctrl_push_idle(struct msm_dp_ctrl *msm_dp_ctrl)
 {
-	struct dp_ctrl_private *ctrl;
+	struct msm_dp_ctrl_private *ctrl;
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 
 	reinit_completion(&ctrl->idle_comp);
-	dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_PUSH_IDLE);
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_PUSH_IDLE);
 
 	if (!wait_for_completion_timeout(&ctrl->idle_comp,
 			IDLE_PATTERN_COMPLETION_TIMEOUT_JIFFIES))
@@ -120,7 +147,36 @@
 	drm_dbg_dp(ctrl->drm_dev, "mainlink off\n");
 }
 
-static void dp_ctrl_config_ctrl(struct dp_ctrl_private *ctrl)
+void msm_dp_ctrl_push_vcpf(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel)
+{
+	u32 state = 0x0;
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (msm_dp_panel->stream_id >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
+
+	if (msm_dp_panel->stream_id == DP_STREAM_0)
+		state |= MST_DP0_PUSH_VCPF;
+	else
+		state |= MST_DP1_PUSH_VCPF;
+
+	reinit_completion(&ctrl->idle_comp);
+
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, state);
+
+	if (!wait_for_completion_timeout(&ctrl->idle_comp,
+					 IDLE_PATTERN_COMPLETION_TIMEOUT_JIFFIES))
+		pr_warn("PUSH_VCPF pattern timedout\n");
+
+	drm_dbg_dp(ctrl->drm_dev, "mainlink off\n");
+}
+
+static void msm_dp_ctrl_config_ctrl(struct msm_dp_ctrl_private *ctrl,
+		struct msm_dp_panel *msm_dp_panel)
 {
 	u32 config = 0, tbd;
 	const u8 *dpcd = ctrl->panel->dpcd;
@@ -128,12 +184,15 @@
 	/* Default-> LSCLK DIV: 1/4 LCLK  */
 	config |= (2 << DP_CONFIGURATION_CTRL_LSCLK_DIV_SHIFT);
 
+	if (msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420)
+		config |= DP_CONFIGURATION_CTRL_RGB_YUV; /* YUV420 */
+
 	/* Scrambler reset enable */
 	if (drm_dp_alternate_scrambler_reset_cap(dpcd))
 		config |= DP_CONFIGURATION_CTRL_ASSR;
 
-	tbd = dp_link_get_test_bits_depth(ctrl->link,
-			ctrl->panel->dp_mode.bpp);
+	tbd = msm_dp_link_get_test_bits_depth(ctrl->link,
+		msm_dp_panel->msm_dp_mode.bpp);
 
 	config |= tbd << DP_CONFIGURATION_CTRL_BPC_SHIFT;
 
@@ -153,23 +212,31 @@
 	if (ctrl->panel->psr_cap.version)
 		config |= DP_CONFIGURATION_CTRL_SEND_VSC;
 
-	dp_catalog_ctrl_config_ctrl(ctrl->catalog, config);
+	msm_dp_catalog_ctrl_config_ctrl(ctrl->catalog, config);
 }
 
-static void dp_ctrl_configure_source_params(struct dp_ctrl_private *ctrl)
+static void msm_dp_ctrl_configure_source_params(struct msm_dp_ctrl_private *ctrl,
+		struct msm_dp_panel *msm_dp_panel)
 {
 	u32 cc, tb;
+	ctrl->catalog->stream_id = msm_dp_panel->stream_id;
+
+	msm_dp_catalog_ctrl_lane_mapping(ctrl->catalog);
+	msm_dp_catalog_setup_peripheral_flush(ctrl->catalog);
 
-	dp_catalog_ctrl_lane_mapping(ctrl->catalog);
-	dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, true);
+	if (ctrl->mst_active)
+		msm_dp_catalog_mst_config(ctrl->catalog, true);
 
-	dp_ctrl_config_ctrl(ctrl);
+	msm_dp_ctrl_config_ctrl(ctrl, msm_dp_panel);
 
-	tb = dp_link_get_test_bits_depth(ctrl->link,
-		ctrl->panel->dp_mode.bpp);
-	cc = dp_link_get_colorimetry_config(ctrl->link);
-	dp_catalog_ctrl_config_misc(ctrl->catalog, cc, tb);
-	dp_panel_timing_cfg(ctrl->panel);
+	tb = msm_dp_link_get_test_bits_depth(ctrl->link,
+		msm_dp_panel->msm_dp_mode.bpp);
+	cc = msm_dp_link_get_colorimetry_config(ctrl->link);
+	msm_dp_catalog_ctrl_config_misc(ctrl->catalog, cc, tb);
+	msm_dp_panel_timing_cfg(msm_dp_panel);
+
+	if (ctrl->mst_active)
+		msm_dp_catalog_mst_async_fifo(ctrl->catalog);
 }
 
 /*
@@ -292,7 +359,7 @@
 	}
 }
 
-static void dp_panel_update_tu_timings(struct dp_tu_calc_input *in,
+static void msm_dp_panel_update_tu_timings(struct msm_dp_tu_calc_input *in,
 					struct tu_algo_data *tu)
 {
 	int nlanes = in->nlanes;
@@ -604,9 +671,9 @@
 	}
 }
 
-static void _dp_ctrl_calc_tu(struct dp_ctrl_private *ctrl,
-				struct dp_tu_calc_input *in,
-				struct dp_vc_tu_mapping_table *tu_table)
+static void _dp_ctrl_calc_tu(struct msm_dp_ctrl_private *ctrl,
+				struct msm_dp_tu_calc_input *in,
+				struct msm_dp_vc_tu_mapping_table *tu_table)
 {
 	struct tu_algo_data *tu;
 	int compare_result_1, compare_result_2;
@@ -627,7 +694,7 @@
 	if (!tu)
 		return;
 
-	dp_panel_update_tu_timings(in, tu);
+	msm_dp_panel_update_tu_timings(in, tu);
 
 	tu->err_fp = drm_fixp_from_fraction(1000, 1); /* 1000 */
 
@@ -938,21 +1005,21 @@
 	kfree(tu);
 }
 
-static void dp_ctrl_calc_tu_parameters(struct dp_ctrl_private *ctrl,
-		struct dp_vc_tu_mapping_table *tu_table)
+static void msm_dp_ctrl_calc_tu_parameters(struct msm_dp_ctrl_private *ctrl,
+		struct msm_dp_vc_tu_mapping_table *tu_table)
 {
-	struct dp_tu_calc_input in;
+	struct msm_dp_tu_calc_input in;
 	struct drm_display_mode *drm_mode;
 
-	drm_mode = &ctrl->panel->dp_mode.drm_mode;
+	drm_mode = &ctrl->panel->msm_dp_mode.drm_mode;
 
 	in.lclk = ctrl->link->link_params.rate / 1000;
 	in.pclk_khz = drm_mode->clock;
 	in.hactive = drm_mode->hdisplay;
 	in.hporch = drm_mode->htotal - drm_mode->hdisplay;
 	in.nlanes = ctrl->link->link_params.num_lanes;
-	in.bpp = ctrl->panel->dp_mode.bpp;
-	in.pixel_enc = 444;
+	in.bpp = ctrl->panel->msm_dp_mode.bpp;
+	in.pixel_enc = ctrl->panel->msm_dp_mode.out_fmt_is_yuv_420 ? 420 : 444;
 	in.dsc_en = 0;
 	in.async_en = 0;
 	in.fec_en = 0;
@@ -962,16 +1029,16 @@
 	_dp_ctrl_calc_tu(ctrl, &in, tu_table);
 }
 
-static void dp_ctrl_setup_tr_unit(struct dp_ctrl_private *ctrl)
+static void msm_dp_ctrl_setup_tr_unit(struct msm_dp_ctrl_private *ctrl)
 {
-	u32 dp_tu = 0x0;
+	u32 msm_dp_tu = 0x0;
 	u32 valid_boundary = 0x0;
 	u32 valid_boundary2 = 0x0;
-	struct dp_vc_tu_mapping_table tu_calc_table;
+	struct msm_dp_vc_tu_mapping_table tu_calc_table;
 
-	dp_ctrl_calc_tu_parameters(ctrl, &tu_calc_table);
+	msm_dp_ctrl_calc_tu_parameters(ctrl, &tu_calc_table);
 
-	dp_tu |= tu_calc_table.tu_size_minus1;
+	msm_dp_tu |= tu_calc_table.tu_size_minus1;
 	valid_boundary |= tu_calc_table.valid_boundary_link;
 	valid_boundary |= (tu_calc_table.delay_start_link << 16);
 
@@ -983,13 +1050,13 @@
 		valid_boundary2 |= BIT(0);
 
 	pr_debug("dp_tu=0x%x, valid_boundary=0x%x, valid_boundary2=0x%x\n",
-			dp_tu, valid_boundary, valid_boundary2);
+			msm_dp_tu, valid_boundary, valid_boundary2);
 
-	dp_catalog_ctrl_update_transfer_unit(ctrl->catalog,
-				dp_tu, valid_boundary, valid_boundary2);
+	msm_dp_catalog_ctrl_update_transfer_unit(ctrl->catalog,
+				msm_dp_tu, valid_boundary, valid_boundary2);
 }
 
-static int dp_ctrl_wait4video_ready(struct dp_ctrl_private *ctrl)
+static int msm_dp_ctrl_wait4video_ready(struct msm_dp_ctrl_private *ctrl)
 {
 	int ret = 0;
 
@@ -1001,9 +1068,24 @@
 	return ret;
 }
 
-static int dp_ctrl_update_vx_px(struct dp_ctrl_private *ctrl)
+static int msm_dp_ctrl_set_vx_px(struct msm_dp_ctrl_private *ctrl,
+			     u8 v_level, u8 p_level)
 {
-	struct dp_link *link = ctrl->link;
+	union phy_configure_opts *phy_opts = &ctrl->phy_opts;
+
+	/* TODO: Update for all lanes instead of just first one */
+	phy_opts->dp.voltage[0] = v_level;
+	phy_opts->dp.pre[0] = p_level;
+	phy_opts->dp.set_voltages = 1;
+	phy_configure(ctrl->phy, phy_opts);
+	phy_opts->dp.set_voltages = 0;
+
+	return 0;
+}
+
+static int msm_dp_ctrl_update_vx_px(struct msm_dp_ctrl_private *ctrl)
+{
+	struct msm_dp_link *link = ctrl->link;
 	int ret = 0, lane, lane_cnt;
 	u8 buf[4];
 	u32 max_level_reached = 0;
@@ -1013,20 +1095,20 @@
 	drm_dbg_dp(ctrl->drm_dev,
 		"voltage level: %d emphasis level: %d\n",
 			voltage_swing_level, pre_emphasis_level);
-	ret = dp_catalog_ctrl_update_vx_px(ctrl->catalog,
+	ret = msm_dp_ctrl_set_vx_px(ctrl,
 		voltage_swing_level, pre_emphasis_level);
 
 	if (ret)
 		return ret;
 
-	if (voltage_swing_level >= DP_TRAIN_VOLTAGE_SWING_MAX) {
+	if (voltage_swing_level >= DP_TRAIN_LEVEL_MAX) {
 		drm_dbg_dp(ctrl->drm_dev,
 				"max. voltage swing level reached %d\n",
 				voltage_swing_level);
 		max_level_reached |= DP_TRAIN_MAX_SWING_REACHED;
 	}
 
-	if (pre_emphasis_level >= DP_TRAIN_PRE_EMPHASIS_MAX) {
+	if (pre_emphasis_level >= DP_TRAIN_LEVEL_MAX) {
 		drm_dbg_dp(ctrl->drm_dev,
 				"max. pre-emphasis level reached %d\n",
 				pre_emphasis_level);
@@ -1050,7 +1132,7 @@
 	return ret;
 }
 
-static bool dp_ctrl_train_pattern_set(struct dp_ctrl_private *ctrl,
+static bool msm_dp_ctrl_train_pattern_set(struct msm_dp_ctrl_private *ctrl,
 		u8 pattern)
 {
 	u8 buf;
@@ -1067,7 +1149,7 @@
 	return ret == 1;
 }
 
-static int dp_ctrl_read_link_status(struct dp_ctrl_private *ctrl,
+static int msm_dp_ctrl_read_link_status(struct msm_dp_ctrl_private *ctrl,
 				    u8 *link_status)
 {
 	int ret = 0, len;
@@ -1081,24 +1163,24 @@
 	return ret;
 }
 
-static int dp_ctrl_link_train_1(struct dp_ctrl_private *ctrl,
+static int msm_dp_ctrl_link_train_1(struct msm_dp_ctrl_private *ctrl,
 			int *training_step)
 {
 	int tries, old_v_level, ret = 0;
 	u8 link_status[DP_LINK_STATUS_SIZE];
 	int const maximum_retries = 4;
 
-	dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
 
 	*training_step = DP_TRAINING_1;
 
-	ret = dp_catalog_ctrl_set_pattern_state_bit(ctrl->catalog, 1);
+	ret = msm_dp_catalog_ctrl_set_pattern_state_bit(ctrl->catalog, 1);
 	if (ret)
 		return ret;
-	dp_ctrl_train_pattern_set(ctrl, DP_TRAINING_PATTERN_1 |
+	msm_dp_ctrl_train_pattern_set(ctrl, DP_TRAINING_PATTERN_1 |
 		DP_LINK_SCRAMBLING_DISABLE);
 
-	ret = dp_ctrl_update_vx_px(ctrl);
+	ret = msm_dp_ctrl_update_vx_px(ctrl);
 	if (ret)
 		return ret;
 
@@ -1107,7 +1189,7 @@
 	for (tries = 0; tries < maximum_retries; tries++) {
 		drm_dp_link_train_clock_recovery_delay(ctrl->aux, ctrl->panel->dpcd);
 
-		ret = dp_ctrl_read_link_status(ctrl, link_status);
+		ret = msm_dp_ctrl_read_link_status(ctrl, link_status);
 		if (ret)
 			return ret;
 
@@ -1117,7 +1199,7 @@
 		}
 
 		if (ctrl->link->phy_params.v_level >=
-			DP_TRAIN_VOLTAGE_SWING_MAX) {
+			DP_TRAIN_LEVEL_MAX) {
 			DRM_ERROR_RATELIMITED("max v_level reached\n");
 			return -EAGAIN;
 		}
@@ -1127,8 +1209,8 @@
 			old_v_level = ctrl->link->phy_params.v_level;
 		}
 
-		dp_link_adjust_levels(ctrl->link, link_status);
-		ret = dp_ctrl_update_vx_px(ctrl);
+		msm_dp_link_adjust_levels(ctrl->link, link_status);
+		ret = msm_dp_ctrl_update_vx_px(ctrl);
 		if (ret)
 			return ret;
 	}
@@ -1137,7 +1219,7 @@
 	return -ETIMEDOUT;
 }
 
-static int dp_ctrl_link_rate_down_shift(struct dp_ctrl_private *ctrl)
+static int msm_dp_ctrl_link_rate_down_shift(struct msm_dp_ctrl_private *ctrl)
 {
 	int ret = 0;
 
@@ -1165,7 +1247,7 @@
 	return ret;
 }
 
-static int dp_ctrl_link_lane_down_shift(struct dp_ctrl_private *ctrl)
+static int msm_dp_ctrl_link_lane_down_shift(struct msm_dp_ctrl_private *ctrl)
 {
 
 	if (ctrl->link->link_params.num_lanes == 1)
@@ -1180,13 +1262,13 @@
 	return 0;
 }
 
-static void dp_ctrl_clear_training_pattern(struct dp_ctrl_private *ctrl)
+static void msm_dp_ctrl_clear_training_pattern(struct msm_dp_ctrl_private *ctrl)
 {
-	dp_ctrl_train_pattern_set(ctrl, DP_TRAINING_PATTERN_DISABLE);
+	msm_dp_ctrl_train_pattern_set(ctrl, DP_TRAINING_PATTERN_DISABLE);
 	drm_dp_link_train_channel_eq_delay(ctrl->aux, ctrl->panel->dpcd);
 }
 
-static int dp_ctrl_link_train_2(struct dp_ctrl_private *ctrl,
+static int msm_dp_ctrl_link_train_2(struct msm_dp_ctrl_private *ctrl,
 			int *training_step)
 {
 	int tries = 0, ret = 0;
@@ -1195,7 +1277,7 @@
 	int const maximum_retries = 5;
 	u8 link_status[DP_LINK_STATUS_SIZE];
 
-	dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
 
 	*training_step = DP_TRAINING_2;
 
@@ -1210,16 +1292,16 @@
 		state_ctrl_bit = 2;
 	}
 
-	ret = dp_catalog_ctrl_set_pattern_state_bit(ctrl->catalog, state_ctrl_bit);
+	ret = msm_dp_catalog_ctrl_set_pattern_state_bit(ctrl->catalog, state_ctrl_bit);
 	if (ret)
 		return ret;
 
-	dp_ctrl_train_pattern_set(ctrl, pattern);
+	msm_dp_ctrl_train_pattern_set(ctrl, pattern);
 
 	for (tries = 0; tries <= maximum_retries; tries++) {
 		drm_dp_link_train_channel_eq_delay(ctrl->aux, ctrl->panel->dpcd);
 
-		ret = dp_ctrl_read_link_status(ctrl, link_status);
+		ret = msm_dp_ctrl_read_link_status(ctrl, link_status);
 		if (ret)
 			return ret;
 
@@ -1228,8 +1310,8 @@
 			return 0;
 		}
 
-		dp_link_adjust_levels(ctrl->link, link_status);
-		ret = dp_ctrl_update_vx_px(ctrl);
+		msm_dp_link_adjust_levels(ctrl->link, link_status);
+		ret = msm_dp_ctrl_update_vx_px(ctrl);
 		if (ret)
 			return ret;
 
@@ -1238,22 +1320,24 @@
 	return -ETIMEDOUT;
 }
 
-static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl,
+static int msm_dp_ctrl_link_train(struct msm_dp_ctrl_private *ctrl,
 			int *training_step)
 {
 	int ret = 0;
 	const u8 *dpcd = ctrl->panel->dpcd;
 	u8 encoding[] = { 0, DP_SET_ANSI_8B10B };
 	u8 assr;
-	struct dp_link_info link_info = {0};
+	struct msm_dp_link_info link_info = {0};
 
-	dp_ctrl_config_ctrl(ctrl);
+	msm_dp_ctrl_config_ctrl(ctrl, ctrl->panel);
 
 	link_info.num_lanes = ctrl->link->link_params.num_lanes;
 	link_info.rate = ctrl->link->link_params.rate;
 	link_info.capabilities = DP_LINK_CAP_ENHANCED_FRAMING;
 
-	dp_aux_link_configure(ctrl->aux, &link_info);
+	msm_dp_link_reset_phy_params_vx_px(ctrl->link);
+
+	msm_dp_aux_link_configure(ctrl->aux, &link_info);
 
 	if (drm_dp_max_downspread(dpcd))
 		encoding[0] |= DP_SPREAD_AMP_0_5;
@@ -1267,7 +1351,7 @@
 				&assr, 1);
 	}
 
-	ret = dp_ctrl_link_train_1(ctrl, training_step);
+	ret = msm_dp_ctrl_link_train_1(ctrl, training_step);
 	if (ret) {
 		DRM_ERROR("link training #1 failed. ret=%d\n", ret);
 		goto end;
@@ -1276,7 +1360,7 @@
 	/* print success info as this is a result of user initiated action */
 	drm_dbg_dp(ctrl->drm_dev, "link training #1 successful\n");
 
-	ret = dp_ctrl_link_train_2(ctrl, training_step);
+	ret = msm_dp_ctrl_link_train_2(ctrl, training_step);
 	if (ret) {
 		DRM_ERROR("link training #2 failed. ret=%d\n", ret);
 		goto end;
@@ -1286,17 +1370,17 @@
 	drm_dbg_dp(ctrl->drm_dev, "link training #2 successful\n");
 
 end:
-	dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
 
 	return ret;
 }
 
-static int dp_ctrl_setup_main_link(struct dp_ctrl_private *ctrl,
+static int msm_dp_ctrl_setup_main_link(struct msm_dp_ctrl_private *ctrl,
 			int *training_step)
 {
 	int ret = 0;
 
-	dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, true);
+	msm_dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, true);
 
 	if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN)
 		return ret;
@@ -1307,49 +1391,120 @@
 	 * a link training pattern, we have to first do soft reset.
 	 */
 
-	ret = dp_ctrl_link_train(ctrl, training_step);
+	ret = msm_dp_ctrl_link_train(ctrl, training_step);
 
 	return ret;
 }
 
-static void dp_ctrl_set_clock_rate(struct dp_ctrl_private *ctrl,
-			enum dp_pm_type module, char *name, unsigned long rate)
+int msm_dp_ctrl_core_clk_enable(struct msm_dp_ctrl *msm_dp_ctrl)
 {
-	u32 num = ctrl->parser->mp[module].num_clk;
-	struct clk_bulk_data *cfg = ctrl->parser->mp[module].clocks;
+	struct msm_dp_ctrl_private *ctrl;
+	int ret = 0;
 
-	while (num && strcmp(cfg->id, name)) {
-		num--;
-		cfg++;
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (ctrl->core_clks_on) {
+		drm_dbg_dp(ctrl->drm_dev, "core clks already enabled\n");
+		return 0;
 	}
 
-	drm_dbg_dp(ctrl->drm_dev, "setting rate=%lu on clk=%s\n",
-						rate, name);
+	ret = clk_bulk_prepare_enable(ctrl->num_core_clks, ctrl->core_clks);
+	if (ret)
+		return ret;
 
-	if (num)
-		clk_set_rate(cfg->clk, rate);
-	else
-		DRM_ERROR("%s clock doesn't exit to set rate %lu\n",
-				name, rate);
+	ctrl->core_clks_on = true;
+
+	drm_dbg_dp(ctrl->drm_dev, "enable core clocks \n");
+	drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
+		   ctrl->stream_clks_on ? "on" : "off",
+		   ctrl->link_clks_on ? "on" : "off",
+		   ctrl->core_clks_on ? "on" : "off");
+
+	return 0;
+}
+
+void msm_dp_ctrl_core_clk_disable(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	clk_bulk_disable_unprepare(ctrl->num_core_clks, ctrl->core_clks);
+
+	ctrl->core_clks_on = false;
+
+	drm_dbg_dp(ctrl->drm_dev, "disable core clocks \n");
+	drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
+		   ctrl->stream_clks_on ? "on" : "off",
+		   ctrl->link_clks_on ? "on" : "off",
+		   ctrl->core_clks_on ? "on" : "off");
+}
+
+static int msm_dp_ctrl_link_clk_enable(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	int ret = 0;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (ctrl->link_clks_on) {
+		drm_dbg_dp(ctrl->drm_dev, "links clks already enabled\n");
+		return 0;
+	}
+
+	if (!ctrl->core_clks_on) {
+		drm_dbg_dp(ctrl->drm_dev, "Enable core clks before link clks\n");
+
+		msm_dp_ctrl_core_clk_enable(msm_dp_ctrl);
+	}
+
+	ret = clk_bulk_prepare_enable(ctrl->num_link_clks, ctrl->link_clks);
+	if (ret)
+		return ret;
+
+	ctrl->link_clks_on = true;
+
+	drm_dbg_dp(ctrl->drm_dev, "enable link clocks\n");
+	drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
+		   ctrl->stream_clks_on ? "on" : "off",
+		   ctrl->link_clks_on ? "on" : "off",
+		   ctrl->core_clks_on ? "on" : "off");
+
+	return 0;
 }
 
-static int dp_ctrl_enable_mainlink_clocks(struct dp_ctrl_private *ctrl)
+static void msm_dp_ctrl_link_clk_disable(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	clk_bulk_disable_unprepare(ctrl->num_link_clks, ctrl->link_clks);
+
+	ctrl->link_clks_on = false;
+
+	drm_dbg_dp(ctrl->drm_dev, "disabled link clocks\n");
+	drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
+		   ctrl->stream_clks_on ? "on" : "off",
+		   ctrl->link_clks_on ? "on" : "off",
+		   ctrl->core_clks_on ? "on" : "off");
+}
+
+static int msm_dp_ctrl_enable_mainlink_clocks(struct msm_dp_ctrl_private *ctrl)
 {
 	int ret = 0;
-	struct dp_io *dp_io = &ctrl->parser->io;
-	struct phy *phy = dp_io->phy;
-	struct phy_configure_opts_dp *opts_dp = &dp_io->phy_opts.dp;
+	struct phy *phy = ctrl->phy;
 	const u8 *dpcd = ctrl->panel->dpcd;
 
-	opts_dp->lanes = ctrl->link->link_params.num_lanes;
-	opts_dp->link_rate = ctrl->link->link_params.rate / 100;
-	opts_dp->ssc = drm_dp_max_downspread(dpcd);
+	ctrl->phy_opts.dp.lanes = ctrl->link->link_params.num_lanes;
+	ctrl->phy_opts.dp.link_rate = ctrl->link->link_params.rate / 100;
+	ctrl->phy_opts.dp.ssc = drm_dp_max_downspread(dpcd);
 
-	phy_configure(phy, &dp_io->phy_opts);
+	phy_configure(phy, &ctrl->phy_opts);
 	phy_power_on(phy);
 
 	dev_pm_opp_set_rate(ctrl->dev, ctrl->link->link_params.rate * 1000);
-	ret = dp_power_clk_enable(ctrl->power, DP_CTRL_PM, true);
+	ret = msm_dp_ctrl_link_clk_enable(&ctrl->msm_dp_ctrl);
 	if (ret)
 		DRM_ERROR("Unable to start link clocks. ret=%d\n", ret);
 
@@ -1358,13 +1513,13 @@
 	return ret;
 }
 
-void dp_ctrl_reset_irq_ctrl(struct dp_ctrl *dp_ctrl, bool enable)
+void msm_dp_ctrl_reset_irq_ctrl(struct msm_dp_ctrl *msm_dp_ctrl, bool enable)
 {
-	struct dp_ctrl_private *ctrl;
+	struct msm_dp_ctrl_private *ctrl;
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 
-	dp_catalog_ctrl_reset(ctrl->catalog);
+	msm_dp_catalog_ctrl_reset(ctrl->catalog);
 
 	/*
 	 * all dp controller programmable registers will not
@@ -1372,28 +1527,28 @@
 	 * therefore interrupt mask bits have to be updated
 	 * to enable/disable interrupts
 	 */
-	dp_catalog_ctrl_enable_irq(ctrl->catalog, enable);
+	msm_dp_catalog_ctrl_enable_irq(ctrl->catalog, enable);
 }
 
-void dp_ctrl_config_psr(struct dp_ctrl *dp_ctrl)
+void msm_dp_ctrl_config_psr(struct msm_dp_ctrl *msm_dp_ctrl)
 {
 	u8 cfg;
-	struct dp_ctrl_private *ctrl = container_of(dp_ctrl,
-			struct dp_ctrl_private, dp_ctrl);
+	struct msm_dp_ctrl_private *ctrl = container_of(msm_dp_ctrl,
+			struct msm_dp_ctrl_private, msm_dp_ctrl);
 
 	if (!ctrl->panel->psr_cap.version)
 		return;
 
-	dp_catalog_ctrl_config_psr(ctrl->catalog);
+	msm_dp_catalog_ctrl_config_psr(ctrl->catalog);
 
 	cfg = DP_PSR_ENABLE;
 	drm_dp_dpcd_write(ctrl->aux, DP_PSR_EN_CFG, &cfg, 1);
 }
 
-void dp_ctrl_set_psr(struct dp_ctrl *dp_ctrl, bool enter)
+void msm_dp_ctrl_set_psr(struct msm_dp_ctrl *msm_dp_ctrl, bool enter)
 {
-	struct dp_ctrl_private *ctrl = container_of(dp_ctrl,
-			struct dp_ctrl_private, dp_ctrl);
+	struct msm_dp_ctrl_private *ctrl = container_of(msm_dp_ctrl,
+			struct msm_dp_ctrl_private, msm_dp_ctrl);
 
 	if (!ctrl->panel->psr_cap.version)
 		return;
@@ -1410,103 +1565,80 @@
 	 */
 	if (enter) {
 		reinit_completion(&ctrl->psr_op_comp);
-		dp_catalog_ctrl_set_psr(ctrl->catalog, true);
+		msm_dp_catalog_ctrl_set_psr(ctrl->catalog, true);
 
 		if (!wait_for_completion_timeout(&ctrl->psr_op_comp,
 			PSR_OPERATION_COMPLETION_TIMEOUT_JIFFIES)) {
 			DRM_ERROR("PSR_ENTRY timedout\n");
-			dp_catalog_ctrl_set_psr(ctrl->catalog, false);
+			msm_dp_catalog_ctrl_set_psr(ctrl->catalog, false);
 			return;
 		}
 
-		dp_ctrl_push_idle(dp_ctrl);
-		dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+		msm_dp_ctrl_push_idle(msm_dp_ctrl);
+		msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
 
-		dp_catalog_ctrl_psr_mainlink_enable(ctrl->catalog, false);
+		msm_dp_catalog_ctrl_psr_mainlink_enable(ctrl->catalog, false);
 	} else {
-		dp_catalog_ctrl_psr_mainlink_enable(ctrl->catalog, true);
+		msm_dp_catalog_ctrl_psr_mainlink_enable(ctrl->catalog, true);
 
-		dp_catalog_ctrl_set_psr(ctrl->catalog, false);
-		dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_SEND_VIDEO);
-		dp_ctrl_wait4video_ready(ctrl);
-		dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+		msm_dp_catalog_ctrl_set_psr(ctrl->catalog, false);
+		msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_SEND_VIDEO);
+		msm_dp_ctrl_wait4video_ready(ctrl);
+		msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
 	}
 }
 
-void dp_ctrl_phy_init(struct dp_ctrl *dp_ctrl)
+void msm_dp_ctrl_phy_init(struct msm_dp_ctrl *msm_dp_ctrl)
 {
-	struct dp_ctrl_private *ctrl;
-	struct dp_io *dp_io;
+	struct msm_dp_ctrl_private *ctrl;
 	struct phy *phy;
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
-	dp_io = &ctrl->parser->io;
-	phy = dp_io->phy;
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	phy = ctrl->phy;
 
-	dp_catalog_ctrl_phy_reset(ctrl->catalog);
+	msm_dp_catalog_ctrl_phy_reset(ctrl->catalog);
 	phy_init(phy);
 
 	drm_dbg_dp(ctrl->drm_dev, "phy=%p init=%d power_on=%d\n",
 			phy, phy->init_count, phy->power_count);
 }
 
-void dp_ctrl_phy_exit(struct dp_ctrl *dp_ctrl)
+void msm_dp_ctrl_phy_exit(struct msm_dp_ctrl *msm_dp_ctrl)
 {
-	struct dp_ctrl_private *ctrl;
-	struct dp_io *dp_io;
+	struct msm_dp_ctrl_private *ctrl;
 	struct phy *phy;
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
-	dp_io = &ctrl->parser->io;
-	phy = dp_io->phy;
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	phy = ctrl->phy;
 
-	dp_catalog_ctrl_phy_reset(ctrl->catalog);
+	msm_dp_catalog_ctrl_phy_reset(ctrl->catalog);
 	phy_exit(phy);
 	drm_dbg_dp(ctrl->drm_dev, "phy=%p init=%d power_on=%d\n",
 			phy, phy->init_count, phy->power_count);
 }
 
-static bool dp_ctrl_use_fixed_nvid(struct dp_ctrl_private *ctrl)
-{
-	const u8 *dpcd = ctrl->panel->dpcd;
-
-	/*
-	 * For better interop experience, used a fixed NVID=0x8000
-	 * whenever connected to a VGA dongle downstream.
-	 */
-	if (drm_dp_is_branch(dpcd))
-		return (drm_dp_has_quirk(&ctrl->panel->desc,
-					 DP_DPCD_QUIRK_CONSTANT_N));
-
-	return false;
-}
-
-static int dp_ctrl_reinitialize_mainlink(struct dp_ctrl_private *ctrl)
+static int msm_dp_ctrl_reinitialize_mainlink(struct msm_dp_ctrl_private *ctrl)
 {
+	struct phy *phy = ctrl->phy;
 	int ret = 0;
-	struct dp_io *dp_io = &ctrl->parser->io;
-	struct phy *phy = dp_io->phy;
-	struct phy_configure_opts_dp *opts_dp = &dp_io->phy_opts.dp;
-
-	dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
-	opts_dp->lanes = ctrl->link->link_params.num_lanes;
-	phy_configure(phy, &dp_io->phy_opts);
+
+	msm_dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
+	ctrl->phy_opts.dp.lanes = ctrl->link->link_params.num_lanes;
+	phy_configure(phy, &ctrl->phy_opts);
 	/*
 	 * Disable and re-enable the mainlink clock since the
 	 * link clock might have been adjusted as part of the
 	 * link maintenance.
 	 */
 	dev_pm_opp_set_rate(ctrl->dev, 0);
-	ret = dp_power_clk_enable(ctrl->power, DP_CTRL_PM, false);
-	if (ret) {
-		DRM_ERROR("Failed to disable clocks. ret=%d\n", ret);
-		return ret;
-	}
+
+	msm_dp_ctrl_link_clk_disable(&ctrl->msm_dp_ctrl);
+
 	phy_power_off(phy);
 	/* hw recommended delay before re-enabling clocks */
 	msleep(20);
 
-	ret = dp_ctrl_enable_mainlink_clocks(ctrl);
+	ret = msm_dp_ctrl_enable_mainlink_clocks(ctrl);
 	if (ret) {
 		DRM_ERROR("Failed to enable mainlink clks. ret=%d\n", ret);
 		return ret;
@@ -1515,24 +1647,18 @@
 	return ret;
 }
 
-static int dp_ctrl_deinitialize_mainlink(struct dp_ctrl_private *ctrl)
+static int msm_dp_ctrl_deinitialize_mainlink(struct msm_dp_ctrl_private *ctrl)
 {
-	struct dp_io *dp_io;
 	struct phy *phy;
-	int ret;
 
-	dp_io = &ctrl->parser->io;
-	phy = dp_io->phy;
+	phy = ctrl->phy;
 
-	dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
+	msm_dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
 
-	dp_catalog_ctrl_reset(ctrl->catalog);
+	msm_dp_catalog_ctrl_reset(ctrl->catalog);
 
 	dev_pm_opp_set_rate(ctrl->dev, 0);
-	ret = dp_power_clk_enable(ctrl->power, DP_CTRL_PM, false);
-	if (ret) {
-		DRM_ERROR("Failed to disable link clocks. ret=%d\n", ret);
-	}
+	msm_dp_ctrl_link_clk_disable(&ctrl->msm_dp_ctrl);
 
 	phy_power_off(phy);
 
@@ -1545,30 +1671,53 @@
 	return 0;
 }
 
-static int dp_ctrl_link_maintenance(struct dp_ctrl_private *ctrl)
+int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	bool act_complete;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	msm_dp_catalog_trigger_act(ctrl->catalog);
+	msleep(20); /* needs 1 frame time */
+
+	act_complete = msm_dp_catalog_read_act_complete_sts(ctrl->catalog);
+
+	if (!act_complete)
+		drm_dbg_dp(ctrl->drm_dev, "mst ACT trigger complete SUCCESS\n");
+	else
+		DRM_ERROR("mst ACT trigger complete failed\n");
+
+	return 0;
+}
+
+static int msm_dp_ctrl_link_maintenance(struct msm_dp_ctrl_private *ctrl)
 {
 	int ret = 0;
 	int training_step = DP_TRAINING_NONE;
 
-	dp_ctrl_push_idle(&ctrl->dp_ctrl);
+	msm_dp_ctrl_push_idle(&ctrl->msm_dp_ctrl);
 
 	ctrl->link->phy_params.p_level = 0;
 	ctrl->link->phy_params.v_level = 0;
 
-	ret = dp_ctrl_setup_main_link(ctrl, &training_step);
+	ret = msm_dp_ctrl_setup_main_link(ctrl, &training_step);
 	if (ret)
 		goto end;
 
-	dp_ctrl_clear_training_pattern(ctrl);
+	msm_dp_ctrl_clear_training_pattern(ctrl);
 
-	dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_SEND_VIDEO);
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_SEND_VIDEO);
 
-	ret = dp_ctrl_wait4video_ready(ctrl);
+	if (ctrl->mst_active)
+		msm_dp_ctrl_mst_send_act(&ctrl->msm_dp_ctrl);
+
+	ret = msm_dp_ctrl_wait4video_ready(ctrl);
 end:
 	return ret;
 }
 
-static bool dp_ctrl_send_phy_test_pattern(struct dp_ctrl_private *ctrl)
+static bool msm_dp_ctrl_send_phy_test_pattern(struct msm_dp_ctrl_private *ctrl)
 {
 	bool success = false;
 	u32 pattern_sent = 0x0;
@@ -1576,17 +1725,17 @@
 
 	drm_dbg_dp(ctrl->drm_dev, "request: 0x%x\n", pattern_requested);
 
-	if (dp_catalog_ctrl_update_vx_px(ctrl->catalog,
+	if (msm_dp_ctrl_set_vx_px(ctrl,
 			ctrl->link->phy_params.v_level,
 			ctrl->link->phy_params.p_level)) {
 		DRM_ERROR("Failed to set v/p levels\n");
 		return false;
 	}
-	dp_catalog_ctrl_send_phy_pattern(ctrl->catalog, pattern_requested);
-	dp_ctrl_update_vx_px(ctrl);
-	dp_link_send_test_response(ctrl->link);
+	msm_dp_catalog_ctrl_send_phy_pattern(ctrl->catalog, pattern_requested);
+	msm_dp_ctrl_update_vx_px(ctrl);
+	msm_dp_link_send_test_response(ctrl->link);
 
-	pattern_sent = dp_catalog_ctrl_read_phy_pattern(ctrl->catalog);
+	pattern_sent = msm_dp_catalog_ctrl_read_phy_pattern(ctrl->catalog);
 
 	switch (pattern_sent) {
 	case MR_LINK_TRAINING1:
@@ -1620,7 +1769,33 @@
 	return success;
 }
 
-static int dp_ctrl_process_phy_test_request(struct dp_ctrl_private *ctrl)
+static int msm_dp_ctrl_stream_clk_on(struct msm_dp_ctrl_private *ctrl, unsigned long pixel_rate,
+				     enum msm_dp_stream_id stream_id)
+{
+	int ret;
+
+	ret = clk_set_rate(ctrl->pixel_clk[stream_id], pixel_rate * 1000);
+	if (ret) {
+		DRM_ERROR("Failed to set stream clk rate. ret=%d\n", ret);
+		return ret;
+	}
+
+	if (ctrl->stream_clks_on[stream_id]) {
+		drm_dbg_dp(ctrl->drm_dev, "stream clks already enabled\n");
+	} else {
+		ret = clk_prepare_enable(ctrl->pixel_clk[stream_id]);
+		if (ret) {
+			DRM_ERROR("Failed to start stream clks. ret=%d\n", ret);
+			return ret;
+		}
+		ctrl->stream_clks_on[stream_id] = true;
+	}
+
+	return ret;
+}
+
+static int msm_dp_ctrl_process_phy_test_request(struct msm_dp_ctrl_private *ctrl,
+		struct msm_dp_panel *msm_dp_panel)
 {
 	int ret;
 	unsigned long pixel_rate;
@@ -1636,70 +1811,61 @@
 	 * running. Add the global reset just before disabling the
 	 * link clocks and core clocks.
 	 */
-	ret = dp_ctrl_off(&ctrl->dp_ctrl);
-	if (ret) {
-		DRM_ERROR("failed to disable DP controller\n");
-		return ret;
-	}
+	msm_dp_ctrl_stream_clk_off(&ctrl->msm_dp_ctrl, msm_dp_panel);
+	msm_dp_ctrl_off_link(&ctrl->msm_dp_ctrl);
 
-	ret = dp_ctrl_on_link(&ctrl->dp_ctrl);
+	ret = msm_dp_ctrl_on_link(&ctrl->msm_dp_ctrl, ctrl->mst_active);
 	if (ret) {
 		DRM_ERROR("failed to enable DP link controller\n");
 		return ret;
 	}
 
-	pixel_rate = ctrl->panel->dp_mode.drm_mode.clock;
-	dp_ctrl_set_clock_rate(ctrl, DP_STREAM_PM, "stream_pixel", pixel_rate * 1000);
+	pixel_rate = msm_dp_panel->msm_dp_mode.drm_mode.clock;
+	ret = msm_dp_ctrl_stream_clk_on(ctrl, pixel_rate, msm_dp_panel->stream_id);
 
-	ret = dp_power_clk_enable(ctrl->power, DP_STREAM_PM, true);
-	if (ret) {
-		DRM_ERROR("Failed to start pixel clocks. ret=%d\n", ret);
-		return ret;
-	}
-
-	dp_ctrl_send_phy_test_pattern(ctrl);
+	msm_dp_ctrl_send_phy_test_pattern(ctrl);
 
 	return 0;
 }
 
-void dp_ctrl_handle_sink_request(struct dp_ctrl *dp_ctrl)
+void msm_dp_ctrl_handle_sink_request(struct msm_dp_ctrl *msm_dp_ctrl)
 {
-	struct dp_ctrl_private *ctrl;
+	struct msm_dp_ctrl_private *ctrl;
 	u32 sink_request = 0x0;
 
-	if (!dp_ctrl) {
+	if (!msm_dp_ctrl) {
 		DRM_ERROR("invalid input\n");
 		return;
 	}
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 	sink_request = ctrl->link->sink_request;
 
 	if (sink_request & DP_TEST_LINK_PHY_TEST_PATTERN) {
 		drm_dbg_dp(ctrl->drm_dev, "PHY_TEST_PATTERN request\n");
-		if (dp_ctrl_process_phy_test_request(ctrl)) {
+		if (msm_dp_ctrl_process_phy_test_request(ctrl, ctrl->panel)) {
 			DRM_ERROR("process phy_test_req failed\n");
 			return;
 		}
 	}
 
 	if (sink_request & DP_LINK_STATUS_UPDATED) {
-		if (dp_ctrl_link_maintenance(ctrl)) {
+		if (msm_dp_ctrl_link_maintenance(ctrl)) {
 			DRM_ERROR("LM failed: TEST_LINK_TRAINING\n");
 			return;
 		}
 	}
 
 	if (sink_request & DP_TEST_LINK_TRAINING) {
-		dp_link_send_test_response(ctrl->link);
-		if (dp_ctrl_link_maintenance(ctrl)) {
+		msm_dp_link_send_test_response(ctrl->link);
+		if (msm_dp_ctrl_link_maintenance(ctrl)) {
 			DRM_ERROR("LM failed: TEST_LINK_TRAINING\n");
 			return;
 		}
 	}
 }
 
-static bool dp_ctrl_clock_recovery_any_ok(
+static bool msm_dp_ctrl_clock_recovery_any_ok(
 			const u8 link_status[DP_LINK_STATUS_SIZE],
 			int lane_count)
 {
@@ -1718,20 +1884,20 @@
 	return drm_dp_clock_recovery_ok(link_status, reduced_cnt);
 }
 
-static bool dp_ctrl_channel_eq_ok(struct dp_ctrl_private *ctrl)
+static bool msm_dp_ctrl_channel_eq_ok(struct msm_dp_ctrl_private *ctrl)
 {
 	u8 link_status[DP_LINK_STATUS_SIZE];
 	int num_lanes = ctrl->link->link_params.num_lanes;
 
-	dp_ctrl_read_link_status(ctrl, link_status);
+	msm_dp_ctrl_read_link_status(ctrl, link_status);
 
 	return drm_dp_channel_eq_ok(link_status, num_lanes);
 }
 
-int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+int msm_dp_ctrl_on_link(struct msm_dp_ctrl *msm_dp_ctrl, bool mst_active)
 {
 	int rc = 0;
-	struct dp_ctrl_private *ctrl;
+	struct msm_dp_ctrl_private *ctrl;
 	u32 rate;
 	int link_train_max_retries = 5;
 	u32 const phy_cts_pixel_clk_khz = 148500;
@@ -1739,15 +1905,16 @@
 	unsigned int training_step;
 	unsigned long pixel_rate;
 
-	if (!dp_ctrl)
+	if (!msm_dp_ctrl)
 		return -EINVAL;
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 
 	rate = ctrl->panel->link_info.rate;
-	pixel_rate = ctrl->panel->dp_mode.drm_mode.clock;
+	pixel_rate = ctrl->panel->msm_dp_mode.drm_mode.clock;
 
-	dp_power_clk_enable(ctrl->power, DP_CORE_PM, true);
+	ctrl->mst_active = mst_active;
+	msm_dp_ctrl_core_clk_enable(&ctrl->msm_dp_ctrl);
 
 	if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN) {
 		drm_dbg_dp(ctrl->drm_dev,
@@ -1758,38 +1925,40 @@
 		ctrl->link->link_params.rate = rate;
 		ctrl->link->link_params.num_lanes =
 			ctrl->panel->link_info.num_lanes;
+		if (ctrl->panel->msm_dp_mode.out_fmt_is_yuv_420)
+			pixel_rate >>= 1;
 	}
 
 	drm_dbg_dp(ctrl->drm_dev, "rate=%d, num_lanes=%d, pixel_rate=%lu\n",
 		ctrl->link->link_params.rate, ctrl->link->link_params.num_lanes,
 		pixel_rate);
 
-	rc = dp_ctrl_enable_mainlink_clocks(ctrl);
+	rc = msm_dp_ctrl_enable_mainlink_clocks(ctrl);
 	if (rc)
 		return rc;
 
 	while (--link_train_max_retries) {
 		training_step = DP_TRAINING_NONE;
-		rc = dp_ctrl_setup_main_link(ctrl, &training_step);
+		rc = msm_dp_ctrl_setup_main_link(ctrl, &training_step);
 		if (rc == 0) {
 			/* training completed successfully */
 			break;
 		} else if (training_step == DP_TRAINING_1) {
 			/* link train_1 failed */
-			if (!dp_catalog_link_is_connected(ctrl->catalog))
+			if (!msm_dp_catalog_link_is_connected(ctrl->catalog))
 				break;
 
-			dp_ctrl_read_link_status(ctrl, link_status);
+			msm_dp_ctrl_read_link_status(ctrl, link_status);
 
-			rc = dp_ctrl_link_rate_down_shift(ctrl);
+			rc = msm_dp_ctrl_link_rate_down_shift(ctrl);
 			if (rc < 0) { /* already in RBR = 1.6G */
-				if (dp_ctrl_clock_recovery_any_ok(link_status,
+				if (msm_dp_ctrl_clock_recovery_any_ok(link_status,
 					ctrl->link->link_params.num_lanes)) {
 					/*
 					 * some lanes are ready,
 					 * reduce lane number
 					 */
-					rc = dp_ctrl_link_lane_down_shift(ctrl);
+					rc = msm_dp_ctrl_link_lane_down_shift(ctrl);
 					if (rc < 0) { /* lane == 1 already */
 						/* end with failure */
 						break;
@@ -1801,16 +1970,16 @@
 			}
 		} else if (training_step == DP_TRAINING_2) {
 			/* link train_2 failed */
-			if (!dp_catalog_link_is_connected(ctrl->catalog))
+			if (!msm_dp_catalog_link_is_connected(ctrl->catalog))
 				break;
 
-			dp_ctrl_read_link_status(ctrl, link_status);
+			msm_dp_ctrl_read_link_status(ctrl, link_status);
 
 			if (!drm_dp_clock_recovery_ok(link_status,
 					ctrl->link->link_params.num_lanes))
-				rc = dp_ctrl_link_rate_down_shift(ctrl);
+				rc = msm_dp_ctrl_link_rate_down_shift(ctrl);
 			else
-				rc = dp_ctrl_link_lane_down_shift(ctrl);
+				rc = msm_dp_ctrl_link_lane_down_shift(ctrl);
 
 			if (rc < 0) {
 				/* end with failure */
@@ -1818,10 +1987,10 @@
 			}
 
 			/* stop link training before start re training  */
-			dp_ctrl_clear_training_pattern(ctrl);
+			msm_dp_ctrl_clear_training_pattern(ctrl);
 		}
 
-		rc = dp_ctrl_reinitialize_mainlink(ctrl);
+		rc = msm_dp_ctrl_reinitialize_mainlink(ctrl);
 		if (rc) {
 			DRM_ERROR("Failed to reinitialize mainlink. rc=%d\n", rc);
 			break;
@@ -1842,65 +2011,178 @@
 		 * link training failed
 		 * end txing train pattern here
 		 */
-		dp_ctrl_clear_training_pattern(ctrl);
+		msm_dp_ctrl_clear_training_pattern(ctrl);
 
-		dp_ctrl_deinitialize_mainlink(ctrl);
+		msm_dp_ctrl_deinitialize_mainlink(ctrl);
 		rc = -ECONNRESET;
 	}
 
 	return rc;
 }
 
-static int dp_ctrl_link_retrain(struct dp_ctrl_private *ctrl)
+static int msm_dp_ctrl_link_retrain(struct msm_dp_ctrl_private *ctrl)
 {
 	int training_step = DP_TRAINING_NONE;
 
-	return dp_ctrl_setup_main_link(ctrl, &training_step);
+	return msm_dp_ctrl_setup_main_link(ctrl, &training_step);
 }
 
-int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl, bool force_link_train)
+int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl, bool force_link_train)
 {
 	int ret = 0;
-	bool mainlink_ready = false;
-	struct dp_ctrl_private *ctrl;
-	unsigned long pixel_rate;
-	unsigned long pixel_rate_orig;
+	struct msm_dp_ctrl_private *ctrl;
 
-	if (!dp_ctrl)
+	if (!msm_dp_ctrl)
 		return -EINVAL;
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
-
-	pixel_rate = pixel_rate_orig = ctrl->panel->dp_mode.drm_mode.clock;
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 
-	if (dp_ctrl->wide_bus_en)
-		pixel_rate >>= 1;
-
-	drm_dbg_dp(ctrl->drm_dev, "rate=%d, num_lanes=%d, pixel_rate=%lu\n",
+	drm_dbg_dp(ctrl->drm_dev, "rate=%d, num_lanes=%d\n",
 		ctrl->link->link_params.rate,
-		ctrl->link->link_params.num_lanes, pixel_rate);
+		ctrl->link->link_params.num_lanes);
+
+	drm_dbg_dp(ctrl->drm_dev,
+		"core_clk_on=%d link_clk_on=%d\n",
+		ctrl->core_clks_on, ctrl->link_clks_on);
 
-	if (!dp_power_clk_status(ctrl->power, DP_CTRL_PM)) { /* link clk is off */
-		ret = dp_ctrl_enable_mainlink_clocks(ctrl);
+	if (!ctrl->link_clks_on) { /* link clk is off */
+		ret = msm_dp_ctrl_enable_mainlink_clocks(ctrl);
 		if (ret) {
 			DRM_ERROR("Failed to start link clocks. ret=%d\n", ret);
-			goto end;
+			return ret;
 		}
 	}
 
-	dp_ctrl_set_clock_rate(ctrl, DP_STREAM_PM, "stream_pixel", pixel_rate * 1000);
+	if (force_link_train || !msm_dp_ctrl_channel_eq_ok(ctrl))
+		msm_dp_ctrl_link_retrain(ctrl);
 
-	ret = dp_power_clk_enable(ctrl->power, DP_STREAM_PM, true);
-	if (ret) {
-		DRM_ERROR("Unable to start pixel clocks. ret=%d\n", ret);
-		goto end;
+	/* stop txing train pattern to end link training */
+	msm_dp_ctrl_clear_training_pattern(ctrl);
+
+	return ret;
+}
+
+static void msm_dp_ctrl_mst_calculate_rg(struct msm_dp_ctrl_private *ctrl,
+					 struct msm_dp_panel *panel,
+					 u32 *p_x_int, u32 *p_y_frac_enum)
+{
+	u64 min_slot_cnt, max_slot_cnt;
+	u64 raw_target_sc, target_sc_fixp;
+	u64 ts_denom, ts_enum, ts_int;
+	u64 pclk = panel->msm_dp_mode.drm_mode.clock;
+	u64 lclk = 0;
+	u64 lanes = ctrl->link->link_params.num_lanes;
+	u64 bpp = panel->msm_dp_mode.bpp;
+	u64 pbn = panel->mst_caps.pbn;
+	u64 numerator, denominator, temp, temp1, temp2;
+	u32 x_int = 0, y_frac_enum = 0;
+	u64 target_strm_sym, ts_int_fixp, ts_frac_fixp, y_frac_enum_fixp;
+
+	lclk = ctrl->link->link_params.rate;
+
+	/* min_slot_cnt */
+	numerator = pclk * bpp * 64 * 1000;
+	denominator = lclk * lanes * 8 * 1000;
+	min_slot_cnt = drm_fixp_from_fraction(numerator, denominator);
+
+	/* max_slot_cnt */
+	numerator = pbn * 54 * 1000;
+	denominator = lclk * lanes;
+	max_slot_cnt = drm_fixp_from_fraction(numerator, denominator);
+
+	/* raw_target_sc */
+	numerator = max_slot_cnt + min_slot_cnt;
+	denominator = drm_fixp_from_fraction(2, 1);
+	raw_target_sc = drm_fixp_div(numerator, denominator);
+
+	/* target_sc */
+	temp = drm_fixp_from_fraction(256 * lanes, 1);
+	numerator = drm_fixp_mul(raw_target_sc, temp);
+	denominator = drm_fixp_from_fraction(256 * lanes, 1);
+	target_sc_fixp = drm_fixp_div(numerator, denominator);
+
+	ts_enum = 256 * lanes;
+	ts_denom = drm_fixp_from_fraction(256 * lanes, 1);
+	ts_int = drm_fixp2int(target_sc_fixp);
+
+	temp = drm_fixp2int_ceil(raw_target_sc);
+	if (temp != ts_int) {
+		temp = drm_fixp_from_fraction(ts_int, 1);
+		temp1 = raw_target_sc - temp;
+		temp2 = drm_fixp_mul(temp1, ts_denom);
+		ts_enum = drm_fixp2int(temp2);
 	}
 
-	if (force_link_train || !dp_ctrl_channel_eq_ok(ctrl))
-		dp_ctrl_link_retrain(ctrl);
+	/* target_strm_sym */
+	ts_int_fixp = drm_fixp_from_fraction(ts_int, 1);
+	ts_frac_fixp = drm_fixp_from_fraction(ts_enum, drm_fixp2int(ts_denom));
+	temp = ts_int_fixp + ts_frac_fixp;
+	temp1 = drm_fixp_from_fraction(lanes, 1);
+	target_strm_sym = drm_fixp_mul(temp, temp1);
 
-	/* stop txing train pattern to end link training */
-	dp_ctrl_clear_training_pattern(ctrl);
+	/* x_int */
+	x_int = drm_fixp2int(target_strm_sym);
+
+	/* y_enum_frac */
+	temp = drm_fixp_from_fraction(x_int, 1);
+	temp1 = target_strm_sym - temp;
+	temp2 = drm_fixp_from_fraction(256, 1);
+	y_frac_enum_fixp = drm_fixp_mul(temp1, temp2);
+
+	temp1 = drm_fixp2int(y_frac_enum_fixp);
+	temp2 = drm_fixp2int_ceil(y_frac_enum_fixp);
+
+	y_frac_enum = (u32)((temp1 == temp2) ? temp1 : temp1 + 1);
+
+	*p_x_int = x_int;
+	*p_y_frac_enum = y_frac_enum;
+
+	drm_dbg_dp(ctrl->drm_dev, "mst lane_cnt:%llu, rate:%llu x_int:%d, y_frac:%d\n",
+		   lanes, lclk, x_int, y_frac_enum);
+}
+
+static void msm_dp_ctrl_mst_stream_setup(struct msm_dp_ctrl_private *ctrl,
+					 struct msm_dp_panel *panel,
+					 u32 max_streams)
+{
+	u32 x_int, y_frac_enum;
+
+	drm_dbg_dp(ctrl->drm_dev, "mst stream channel allocation\n");
+
+	msm_dp_ctrl_mst_stream_channel_slot_setup(&ctrl->msm_dp_ctrl, max_streams);
+
+	msm_dp_ctrl_mst_calculate_rg(ctrl, panel, &x_int, &y_frac_enum);
+
+	msm_dp_catalog_ctrl_update_rg(ctrl->catalog, panel->stream_id,
+				      x_int, y_frac_enum);
+}
+
+int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl,
+			  struct msm_dp_panel *msm_dp_panel, u32 max_streams)
+{
+	int ret = 0;
+	bool mainlink_ready = false;
+	struct msm_dp_ctrl_private *ctrl;
+	unsigned long pixel_rate;
+	unsigned long pixel_rate_orig;
+
+	if (!msm_dp_ctrl)
+		return -EINVAL;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	pixel_rate = pixel_rate_orig = msm_dp_panel->msm_dp_mode.drm_mode.clock;
+
+	if (msm_dp_ctrl->wide_bus_en || msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420)
+		pixel_rate >>= 1;
+
+	drm_dbg_dp(ctrl->drm_dev, "pixel_rate=%lu\n", pixel_rate);
+
+	ret = msm_dp_ctrl_stream_clk_on(ctrl, pixel_rate, msm_dp_panel->stream_id);
+	if (ret) {
+		DRM_ERROR("failed to enable stream pixel clk\n");
+		return ret;
+	}
 
 	/*
 	 * Set up transfer unit values and set controller state to send
@@ -1908,60 +2190,73 @@
 	 */
 	reinit_completion(&ctrl->video_comp);
 
-	dp_ctrl_configure_source_params(ctrl);
+	msm_dp_ctrl_configure_source_params(ctrl, msm_dp_panel);
 
-	dp_catalog_ctrl_config_msa(ctrl->catalog,
+	msm_dp_catalog_ctrl_config_msa(ctrl->catalog,
 		ctrl->link->link_params.rate,
-		pixel_rate_orig, dp_ctrl_use_fixed_nvid(ctrl));
+		pixel_rate_orig,
+		msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420);
+
+	if (!ctrl->mst_active)
+		msm_dp_ctrl_setup_tr_unit(ctrl);
 
-	dp_ctrl_setup_tr_unit(ctrl);
+	if (ctrl->mst_active)
+		msm_dp_ctrl_mst_stream_setup(ctrl, msm_dp_panel, max_streams);
 
-	dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_SEND_VIDEO);
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_SEND_VIDEO);
 
-	ret = dp_ctrl_wait4video_ready(ctrl);
+	if (ctrl->mst_active)
+		msm_dp_ctrl_mst_send_act(msm_dp_ctrl);
+
+	ret = msm_dp_ctrl_wait4video_ready(ctrl);
 	if (ret)
 		return ret;
 
-	mainlink_ready = dp_catalog_ctrl_mainlink_ready(ctrl->catalog);
+	mainlink_ready = msm_dp_catalog_ctrl_mainlink_ready(ctrl->catalog);
 	drm_dbg_dp(ctrl->drm_dev,
 		"mainlink %s\n", mainlink_ready ? "READY" : "NOT READY");
 
-end:
 	return ret;
 }
 
-int dp_ctrl_off_link_stream(struct dp_ctrl *dp_ctrl)
+void msm_dp_ctrl_stream_clk_off(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel)
 {
-	struct dp_ctrl_private *ctrl;
-	struct dp_io *dp_io;
-	struct phy *phy;
-	int ret;
+	struct msm_dp_ctrl_private *ctrl;
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
-	dp_io = &ctrl->parser->io;
-	phy = dp_io->phy;
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 
-	/* set dongle to D3 (power off) mode */
-	dp_link_psm_config(ctrl->link, &ctrl->panel->link_info, true);
+	if (ctrl->stream_clks_on[msm_dp_panel->stream_id]) {
+		clk_disable_unprepare(ctrl->pixel_clk[msm_dp_panel->stream_id]);
+		ctrl->stream_clks_on[msm_dp_panel->stream_id] = false;
+	}
+}
 
-	dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
+void msm_dp_ctrl_clear_vsc_sdp_pkt(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *dp_panel)
+{
+	struct msm_dp_ctrl_private *ctrl;
 
-	if (dp_power_clk_status(ctrl->power, DP_STREAM_PM)) {
-		ret = dp_power_clk_enable(ctrl->power, DP_STREAM_PM, false);
-		if (ret) {
-			DRM_ERROR("Failed to disable pclk. ret=%d\n", ret);
-			return ret;
-		}
-	}
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	ctrl->catalog->stream_id = dp_panel->stream_id;
+	msm_dp_catalog_panel_disable_vsc_sdp(ctrl->catalog);
+}
 
-	dev_pm_opp_set_rate(ctrl->dev, 0);
-	ret = dp_power_clk_enable(ctrl->power, DP_CTRL_PM, false);
-	if (ret) {
-		DRM_ERROR("Failed to disable link clocks. ret=%d\n", ret);
-		return ret;
-	}
+void msm_dp_ctrl_psm_config(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
 
-	phy_power_off(phy);
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	/* set dongle to D3 (power off) mode */
+	msm_dp_link_psm_config(ctrl->link, &ctrl->panel->link_info, true);
+}
+
+void msm_dp_ctrl_reinit_phy(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	struct phy *phy;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	phy = ctrl->phy;
 
 	/* aux channel down, reinit phy */
 	phy_exit(phy);
@@ -1969,86 +2264,78 @@
 
 	drm_dbg_dp(ctrl->drm_dev, "phy=%p init=%d power_on=%d\n",
 			phy, phy->init_count, phy->power_count);
-	return ret;
 }
 
-int dp_ctrl_off_link(struct dp_ctrl *dp_ctrl)
+void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl)
 {
-	struct dp_ctrl_private *ctrl;
-	struct dp_io *dp_io;
+	struct msm_dp_ctrl_private *ctrl;
 	struct phy *phy;
-	int ret;
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
-	dp_io = &ctrl->parser->io;
-	phy = dp_io->phy;
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	phy = ctrl->phy;
 
-	dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
+	msm_dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
+	msm_dp_catalog_mst_config(ctrl->catalog, false);
 
-	ret = dp_power_clk_enable(ctrl->power, DP_CTRL_PM, false);
-	if (ret) {
-		DRM_ERROR("Failed to disable link clocks. ret=%d\n", ret);
-	}
+	ctrl->mst_active = false;
 
-	DRM_DEBUG_DP("Before, phy=%p init_count=%d power_on=%d\n",
-		phy, phy->init_count, phy->power_count);
+	dev_pm_opp_set_rate(ctrl->dev, 0);
+	msm_dp_ctrl_link_clk_disable(&ctrl->msm_dp_ctrl);
 
-	phy_power_off(phy);
+	drm_dbg_dp(ctrl->drm_dev, "Before, phy=%p init_count=%d power_on=%d\n",
+		   phy, phy->init_count, phy->power_count);
 
-	DRM_DEBUG_DP("After, phy=%p init_count=%d power_on=%d\n",
-		phy, phy->init_count, phy->power_count);
+	phy_power_off(phy);
 
-	return ret;
+	drm_dbg_dp(ctrl->drm_dev, "After, phy=%p init_count=%d power_on=%d\n",
+		   phy, phy->init_count, phy->power_count);
 }
 
-int dp_ctrl_off(struct dp_ctrl *dp_ctrl)
+void msm_dp_ctrl_set_mst_channel_info(struct msm_dp_ctrl *msm_dp_ctrl,
+				      enum msm_dp_stream_id strm,
+				      u32 start_slot, u32 tot_slots)
 {
-	struct dp_ctrl_private *ctrl;
-	struct dp_io *dp_io;
-	struct phy *phy;
-	int ret = 0;
+	struct msm_dp_ctrl_private *ctrl;
 
-	if (!dp_ctrl)
-		return -EINVAL;
+	if (!msm_dp_ctrl || strm >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
-	dp_io = &ctrl->parser->io;
-	phy = dp_io->phy;
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 
-	dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
+	ctrl->mst_ch_info[strm].start_slot = start_slot;
+	ctrl->mst_ch_info[strm].tot_slots = tot_slots;
+}
 
-	dp_catalog_ctrl_reset(ctrl->catalog);
+// TO-DO : Check if we can do a dealloc instead of this one during teardown
+void msm_dp_ctrl_mst_stream_channel_slot_setup(struct msm_dp_ctrl *msm_dp_ctrl, u32 max_streams)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	int i;
 
-	ret = dp_power_clk_enable(ctrl->power, DP_STREAM_PM, false);
-	if (ret)
-		DRM_ERROR("Failed to disable pixel clocks. ret=%d\n", ret);
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 
-	dev_pm_opp_set_rate(ctrl->dev, 0);
-	ret = dp_power_clk_enable(ctrl->power, DP_CTRL_PM, false);
-	if (ret) {
-		DRM_ERROR("Failed to disable link clocks. ret=%d\n", ret);
+	for (i = DP_STREAM_0; i < max_streams; i++) {
+		msm_dp_catalog_mst_channel_alloc(ctrl->catalog,
+						 i, ctrl->mst_ch_info[i].start_slot,
+						 ctrl->mst_ch_info[i].tot_slots);
 	}
-
-	phy_power_off(phy);
-	drm_dbg_dp(ctrl->drm_dev, "phy=%p init=%d power_on=%d\n",
-			phy, phy->init_count, phy->power_count);
-
-	return ret;
 }
 
-irqreturn_t dp_ctrl_isr(struct dp_ctrl *dp_ctrl)
+irqreturn_t msm_dp_ctrl_isr(struct msm_dp_ctrl *msm_dp_ctrl)
 {
-	struct dp_ctrl_private *ctrl;
+	struct msm_dp_ctrl_private *ctrl;
 	u32 isr;
 	irqreturn_t ret = IRQ_NONE;
 
-	if (!dp_ctrl)
+	if (!msm_dp_ctrl)
 		return IRQ_NONE;
 
-	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 
 	if (ctrl->panel->psr_cap.version) {
-		isr = dp_catalog_ctrl_read_psr_interrupt_status(ctrl->catalog);
+		isr = msm_dp_catalog_ctrl_read_psr_interrupt_status(ctrl->catalog);
 
 		if (isr)
 			complete(&ctrl->psr_op_comp);
@@ -2063,7 +2350,7 @@
 			drm_dbg_dp(ctrl->drm_dev, "PSR frame capture done\n");
 	}
 
-	isr = dp_catalog_ctrl_get_interrupt(ctrl->catalog);
+	isr = msm_dp_catalog_ctrl_get_interrupt(ctrl->catalog);
 
 
 	if (isr & DP_CTRL_INTR_READY_FOR_VIDEO) {
@@ -2078,15 +2365,76 @@
 		ret = IRQ_HANDLED;
 	}
 
+	isr = msm_dp_catalog_ctrl_get_interrupt_5(ctrl->catalog);
+	if (isr & (DP_INTR_DP0_VCPF_SENT | DP_INTR_DP1_VCPF_SENT)) {
+		drm_dbg_dp(ctrl->drm_dev, "vcpf sent\n");
+		complete(&ctrl->idle_comp);
+		ret = IRQ_HANDLED;
+	}
+
 	return ret;
 }
 
-struct dp_ctrl *dp_ctrl_get(struct device *dev, struct dp_link *link,
-			struct dp_panel *panel,	struct drm_dp_aux *aux,
-			struct dp_power *power, struct dp_catalog *catalog,
-			struct dp_parser *parser)
+static const char *core_clks[] = {
+	"core_iface",
+	"core_aux",
+};
+
+static const char *ctrl_clks[] = {
+	"ctrl_link",
+	"ctrl_link_iface",
+};
+
+static int msm_dp_ctrl_clk_init(struct msm_dp_ctrl *msm_dp_ctrl)
 {
-	struct dp_ctrl_private *ctrl;
+	struct msm_dp_ctrl_private *ctrl;
+	struct device *dev;
+	int i, rc;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	dev = ctrl->dev;
+
+	ctrl->num_core_clks = ARRAY_SIZE(core_clks);
+	ctrl->core_clks = devm_kcalloc(dev, ctrl->num_core_clks, sizeof(*ctrl->core_clks), GFP_KERNEL);
+	if (!ctrl->core_clks)
+		return -ENOMEM;
+
+	for (i = 0; i < ctrl->num_core_clks; i++)
+		ctrl->core_clks[i].id = core_clks[i];
+
+	rc = devm_clk_bulk_get(dev, ctrl->num_core_clks, ctrl->core_clks);
+	if (rc)
+		return rc;
+
+	ctrl->num_link_clks = ARRAY_SIZE(ctrl_clks);
+	ctrl->link_clks = devm_kcalloc(dev, ctrl->num_link_clks, sizeof(*ctrl->link_clks), GFP_KERNEL);
+	if (!ctrl->link_clks)
+		return -ENOMEM;
+
+	for (i = 0; i < ctrl->num_link_clks; i++)
+		ctrl->link_clks[i].id = ctrl_clks[i];
+
+	rc = devm_clk_bulk_get(dev, ctrl->num_link_clks, ctrl->link_clks);
+	if (rc)
+		return rc;
+
+	ctrl->pixel_clk[DP_STREAM_0] = devm_clk_get(dev, "stream_pixel");
+	if (IS_ERR(ctrl->pixel_clk[DP_STREAM_0]))
+		return PTR_ERR(ctrl->pixel_clk[DP_STREAM_0]);
+
+	ctrl->pixel_clk[DP_STREAM_1] = devm_clk_get(dev, "stream_1_pixel");
+	if (IS_ERR(ctrl->pixel_clk[DP_STREAM_1]))
+		DRM_ERROR("failed to get stream_pixel_2");
+
+	return 0;
+}
+
+struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link,
+			struct msm_dp_panel *panel,	struct drm_dp_aux *aux,
+			struct msm_dp_catalog *catalog,
+			struct phy *phy)
+{
+	struct msm_dp_ctrl_private *ctrl;
 	int ret;
 
 	if (!dev || !panel || !aux ||
@@ -2105,7 +2453,7 @@
 	if (ret) {
 		dev_err(dev, "invalid DP OPP table in device tree\n");
 		/* caller do PTR_ERR(opp_table) */
-		return (struct dp_ctrl *)ERR_PTR(ret);
+		return (struct msm_dp_ctrl *)ERR_PTR(ret);
 	}
 
 	/* OPP table is optional */
@@ -2118,13 +2466,19 @@
 	init_completion(&ctrl->video_comp);
 
 	/* in parameters */
-	ctrl->parser   = parser;
 	ctrl->panel    = panel;
-	ctrl->power    = power;
 	ctrl->aux      = aux;
 	ctrl->link     = link;
 	ctrl->catalog  = catalog;
 	ctrl->dev      = dev;
+	ctrl->phy      = phy;
+	ctrl->mst_active = false;
+
+	ret = msm_dp_ctrl_clk_init(&ctrl->msm_dp_ctrl);
+	if (ret) {
+		dev_err(dev, "failed to init clocks\n");
+		return ERR_PTR(ret);
+	}
 
-	return &ctrl->dp_ctrl;
+	return &ctrl->msm_dp_ctrl;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_ctrl.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_ctrl.h
@@ -9,34 +9,48 @@
 #include "dp_aux.h"
 #include "dp_panel.h"
 #include "dp_link.h"
-#include "dp_parser.h"
-#include "dp_power.h"
 #include "dp_catalog.h"
 
-struct dp_ctrl {
-	atomic_t aborted;
+struct msm_dp_ctrl {
 	bool wide_bus_en;
 };
 
-int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl);
-int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl, bool force_link_train);
-int dp_ctrl_off_link_stream(struct dp_ctrl *dp_ctrl);
-int dp_ctrl_off_link(struct dp_ctrl *dp_ctrl);
-int dp_ctrl_off(struct dp_ctrl *dp_ctrl);
-void dp_ctrl_push_idle(struct dp_ctrl *dp_ctrl);
-irqreturn_t dp_ctrl_isr(struct dp_ctrl *dp_ctrl);
-void dp_ctrl_handle_sink_request(struct dp_ctrl *dp_ctrl);
-struct dp_ctrl *dp_ctrl_get(struct device *dev, struct dp_link *link,
-			struct dp_panel *panel,	struct drm_dp_aux *aux,
-			struct dp_power *power, struct dp_catalog *catalog,
-			struct dp_parser *parser);
-
-void dp_ctrl_reset_irq_ctrl(struct dp_ctrl *dp_ctrl, bool enable);
-void dp_ctrl_phy_init(struct dp_ctrl *dp_ctrl);
-void dp_ctrl_phy_exit(struct dp_ctrl *dp_ctrl);
-void dp_ctrl_irq_phy_exit(struct dp_ctrl *dp_ctrl);
+struct phy;
 
-void dp_ctrl_set_psr(struct dp_ctrl *dp_ctrl, bool enable);
-void dp_ctrl_config_psr(struct dp_ctrl *dp_ctrl);
+int msm_dp_ctrl_on_link(struct msm_dp_ctrl *msm_dp_ctrl, bool mst_active);
+int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl,
+			  struct msm_dp_panel *msm_dp_panel, u32 max_streams);
+int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl, bool force_link_train);
+void msm_dp_ctrl_off_link_stream(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_stream_clk_off(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel);
+void msm_dp_ctrl_push_idle(struct msm_dp_ctrl *msm_dp_ctrl);
+irqreturn_t msm_dp_ctrl_isr(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_handle_sink_request(struct msm_dp_ctrl *msm_dp_ctrl);
+struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link,
+			struct msm_dp_panel *panel,	struct drm_dp_aux *aux,
+			struct msm_dp_catalog *catalog,
+			struct phy *phy);
 
+void msm_dp_ctrl_reset_irq_ctrl(struct msm_dp_ctrl *msm_dp_ctrl, bool enable);
+void msm_dp_ctrl_phy_init(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_phy_exit(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_irq_phy_exit(struct msm_dp_ctrl *msm_dp_ctrl);
+
+void msm_dp_ctrl_set_psr(struct msm_dp_ctrl *msm_dp_ctrl, bool enable);
+void msm_dp_ctrl_config_psr(struct msm_dp_ctrl *msm_dp_ctrl);
+
+int msm_dp_ctrl_core_clk_enable(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_core_clk_disable(struct msm_dp_ctrl *msm_dp_ctrl);
+
+void msm_dp_ctrl_clear_vsc_sdp_pkt(struct msm_dp_ctrl *msm_dp_ctrl,
+		struct msm_dp_panel *msm_dp_panel);
+void msm_dp_ctrl_psm_config(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_reinit_phy(struct msm_dp_ctrl *msm_dp_ctrl);
+int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_mst_stream_channel_slot_setup(struct msm_dp_ctrl *msm_dp_ctrl, u32 max_streams);
+void msm_dp_ctrl_set_mst_channel_info(struct msm_dp_ctrl *msm_dp_ctrl,
+				      enum msm_dp_stream_id strm,
+				      u32 start_slot, u32 tot_slots);
+void msm_dp_ctrl_push_vcpf(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel);
 #endif /* _DP_CTRL_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_debug.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_debug.c
@@ -9,7 +9,6 @@
 #include <drm/drm_connector.h>
 #include <drm/drm_file.h>
 
-#include "dp_parser.h"
 #include "dp_catalog.h"
 #include "dp_aux.h"
 #include "dp_ctrl.h"
@@ -18,17 +17,15 @@
 
 #define DEBUG_NAME "msm_dp"
 
-struct dp_debug_private {
-	struct dp_link *link;
-	struct dp_panel *panel;
+struct msm_dp_debug_private {
+	struct msm_dp_link *link;
+	struct msm_dp_panel *panel;
 	struct drm_connector *connector;
-
-	struct dp_debug dp_debug;
 };
 
-static int dp_debug_show(struct seq_file *seq, void *p)
+static int msm_dp_debug_show(struct seq_file *seq, void *p)
 {
-	struct dp_debug_private *debug = seq->private;
+	struct msm_dp_debug_private *debug = seq->private;
 	u64 lclk = 0;
 	u32 link_params_rate;
 	const struct drm_display_mode *drm_mode;
@@ -36,7 +33,7 @@
 	if (!debug)
 		return -ENODEV;
 
-	drm_mode = &debug->panel->dp_mode.drm_mode;
+	drm_mode = &debug->panel->msm_dp_mode.drm_mode;
 
 	seq_printf(seq, "\tname = %s\n", DEBUG_NAME);
 	seq_printf(seq, "\tdrm_dp_link\n\t\trate = %u\n",
@@ -58,8 +55,8 @@
 			drm_mode->hsync_end - drm_mode->hsync_start,
 			drm_mode->vsync_end - drm_mode->vsync_start);
 	seq_printf(seq, "\t\tactive_low = %dx%d\n",
-			debug->panel->dp_mode.h_active_low,
-			debug->panel->dp_mode.v_active_low);
+			debug->panel->msm_dp_mode.h_active_low,
+			debug->panel->msm_dp_mode.v_active_low);
 	seq_printf(seq, "\t\th_skew = %d\n",
 			drm_mode->hskew);
 	seq_printf(seq, "\t\trefresh rate = %d\n",
@@ -67,7 +64,7 @@
 	seq_printf(seq, "\t\tpixel clock khz = %d\n",
 			drm_mode->clock);
 	seq_printf(seq, "\t\tbpp = %d\n",
-			debug->panel->dp_mode.bpp);
+			debug->panel->msm_dp_mode.bpp);
 
 	/* Link Information */
 	seq_printf(seq, "\tdp_link:\n\t\ttest_requested = %d\n",
@@ -86,11 +83,11 @@
 
 	return 0;
 }
-DEFINE_SHOW_ATTRIBUTE(dp_debug);
+DEFINE_SHOW_ATTRIBUTE(msm_dp_debug);
 
-static int dp_test_data_show(struct seq_file *m, void *data)
+static int msm_dp_test_data_show(struct seq_file *m, void *data)
 {
-	const struct dp_debug_private *debug = m->private;
+	const struct msm_dp_debug_private *debug = m->private;
 	const struct drm_connector *connector = debug->connector;
 	u32 bpc;
 
@@ -101,18 +98,18 @@
 		seq_printf(m, "vdisplay: %d\n",
 				debug->link->test_video.test_v_height);
 		seq_printf(m, "bpc: %u\n",
-				dp_link_bit_depth_to_bpc(bpc));
+				msm_dp_link_bit_depth_to_bpp(bpc) / 3);
 	} else {
 		seq_puts(m, "0");
 	}
 
 	return 0;
 }
-DEFINE_SHOW_ATTRIBUTE(dp_test_data);
+DEFINE_SHOW_ATTRIBUTE(msm_dp_test_data);
 
-static int dp_test_type_show(struct seq_file *m, void *data)
+static int msm_dp_test_type_show(struct seq_file *m, void *data)
 {
-	const struct dp_debug_private *debug = m->private;
+	const struct msm_dp_debug_private *debug = m->private;
 	const struct drm_connector *connector = debug->connector;
 
 	if (connector->status == connector_status_connected)
@@ -122,15 +119,15 @@
 
 	return 0;
 }
-DEFINE_SHOW_ATTRIBUTE(dp_test_type);
+DEFINE_SHOW_ATTRIBUTE(msm_dp_test_type);
 
-static ssize_t dp_test_active_write(struct file *file,
+static ssize_t msm_dp_test_active_write(struct file *file,
 		const char __user *ubuf,
 		size_t len, loff_t *offp)
 {
 	char *input_buffer;
 	int status = 0;
-	const struct dp_debug_private *debug;
+	const struct msm_dp_debug_private *debug;
 	const struct drm_connector *connector;
 	int val = 0;
 
@@ -167,9 +164,9 @@
 	return len;
 }
 
-static int dp_test_active_show(struct seq_file *m, void *data)
+static int msm_dp_test_active_show(struct seq_file *m, void *data)
 {
-	struct dp_debug_private *debug = m->private;
+	struct msm_dp_debug_private *debug = m->private;
 	struct drm_connector *connector = debug->connector;
 
 	if (connector->status == connector_status_connected) {
@@ -184,78 +181,57 @@
 	return 0;
 }
 
-static int dp_test_active_open(struct inode *inode,
+static int msm_dp_test_active_open(struct inode *inode,
 		struct file *file)
 {
-	return single_open(file, dp_test_active_show,
+	return single_open(file, msm_dp_test_active_show,
 			inode->i_private);
 }
 
 static const struct file_operations test_active_fops = {
 	.owner = THIS_MODULE,
-	.open = dp_test_active_open,
+	.open = msm_dp_test_active_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = single_release,
-	.write = dp_test_active_write
+	.write = msm_dp_test_active_write
 };
 
-static void dp_debug_init(struct dp_debug *dp_debug, struct dentry *root, bool is_edp)
+int msm_dp_debug_init(struct device *dev, struct msm_dp_panel *panel,
+		  struct msm_dp_link *link,
+		  struct drm_connector *connector,
+		  struct dentry *root, bool is_edp)
 {
-	struct dp_debug_private *debug = container_of(dp_debug,
-			struct dp_debug_private, dp_debug);
+	struct msm_dp_debug_private *debug;
+
+	if (!dev || !panel || !link) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	debug = devm_kzalloc(dev, sizeof(*debug), GFP_KERNEL);
+	if (!debug)
+		return -ENOMEM;
+
+	debug->link = link;
+	debug->panel = panel;
 
 	debugfs_create_file("dp_debug", 0444, root,
-			debug, &dp_debug_fops);
+			debug, &msm_dp_debug_fops);
 
 	if (!is_edp) {
-		debugfs_create_file("msm_dp_test_active", 0444,
+		debugfs_create_file("dp_test_active", 0444,
 				    root,
 				    debug, &test_active_fops);
 
-		debugfs_create_file("msm_dp_test_data", 0444,
+		debugfs_create_file("dp_test_data", 0444,
 				    root,
-				    debug, &dp_test_data_fops);
+				    debug, &msm_dp_test_data_fops);
 
-		debugfs_create_file("msm_dp_test_type", 0444,
+		debugfs_create_file("dp_test_type", 0444,
 				    root,
-				    debug, &dp_test_type_fops);
-	}
-}
-
-struct dp_debug *dp_debug_get(struct device *dev, struct dp_panel *panel,
-		struct dp_link *link,
-		struct drm_connector *connector,
-		struct dentry *root, bool is_edp)
-{
-	struct dp_debug_private *debug;
-	struct dp_debug *dp_debug;
-	int rc;
-
-	if (!dev || !panel || !link) {
-		DRM_ERROR("invalid input\n");
-		rc = -EINVAL;
-		goto error;
-	}
-
-	debug = devm_kzalloc(dev, sizeof(*debug), GFP_KERNEL);
-	if (!debug) {
-		rc = -ENOMEM;
-		goto error;
+				    debug, &msm_dp_test_type_fops);
 	}
 
-	debug->dp_debug.debug_en = false;
-	debug->link = link;
-	debug->panel = panel;
-
-	dp_debug = &debug->dp_debug;
-	dp_debug->vdisplay = 0;
-	dp_debug->hdisplay = 0;
-	dp_debug->vrefresh = 0;
-
-	dp_debug_init(dp_debug, root, is_edp);
-
-	return dp_debug;
- error:
-	return ERR_PTR(rc);
+	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_debug.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_debug.h
@@ -9,26 +9,10 @@
 #include "dp_panel.h"
 #include "dp_link.h"
 
-/**
- * struct dp_debug
- * @debug_en: specifies whether debug mode enabled
- * @vdisplay: used to filter out vdisplay value
- * @hdisplay: used to filter out hdisplay value
- * @vrefresh: used to filter out vrefresh value
- * @tpg_state: specifies whether tpg feature is enabled
- */
-struct dp_debug {
-	bool debug_en;
-	int aspect_ratio;
-	int vdisplay;
-	int hdisplay;
-	int vrefresh;
-};
-
 #if defined(CONFIG_DEBUG_FS)
 
 /**
- * dp_debug_get() - configure and get the DisplayPlot debug module data
+ * msm_dp_debug_get() - configure and get the DisplayPlot debug module data
  *
  * @dev: device instance of the caller
  * @panel: instance of panel module
@@ -41,22 +25,22 @@
  * This function sets up the debug module and provides a way
  * for debugfs input to be communicated with existing modules
  */
-struct dp_debug *dp_debug_get(struct device *dev, struct dp_panel *panel,
-		struct dp_link *link,
-		struct drm_connector *connector,
-		struct dentry *root,
-		bool is_edp);
+int msm_dp_debug_init(struct device *dev, struct msm_dp_panel *panel,
+		  struct msm_dp_link *link,
+		  struct drm_connector *connector,
+		  struct dentry *root,
+		  bool is_edp);
 
 #else
 
 static inline
-struct dp_debug *dp_debug_get(struct device *dev, struct dp_panel *panel,
-		struct dp_link *link,
-		struct drm_connector *connector,
-		struct dentry *root,
-		bool is_edp)
+int msm_dp_debug_init(struct device *dev, struct msm_dp_panel *panel,
+		  struct msm_dp_link *link,
+		  struct drm_connector *connector,
+		  struct dentry *root,
+		  bool is_edp)
 {
-	return ERR_PTR(-EINVAL);
+	return -EINVAL;
 }
 
 #endif /* defined(CONFIG_DEBUG_FS) */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_display.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_display.c
@@ -9,23 +9,23 @@
 #include <linux/debugfs.h>
 #include <linux/component.h>
 #include <linux/of_irq.h>
+#include <linux/phy/phy.h>
 #include <linux/delay.h>
 #include <drm/display/drm_dp_aux_bus.h>
 
 #include "msm_drv.h"
 #include "msm_kms.h"
-#include "dp_parser.h"
-#include "dp_power.h"
+#include "dp_ctrl.h"
 #include "dp_catalog.h"
 #include "dp_aux.h"
 #include "dp_reg.h"
 #include "dp_link.h"
 #include "dp_panel.h"
-#include "dp_ctrl.h"
 #include "dp_display.h"
 #include "dp_drm.h"
 #include "dp_audio.h"
 #include "dp_debug.h"
+#include "dp_mst_drm.h"
 
 static bool psr_enabled = false;
 module_param(psr_enabled, bool, 0);
@@ -33,6 +33,8 @@
 
 #define HPD_STRING_SIZE 30
 
+#define DEFAULT_STREAM_COUNT 1
+
 enum {
 	ISR_DISCONNECTED,
 	ISR_CONNECT_PENDING,
@@ -67,14 +69,15 @@
 
 #define WAIT_FOR_RESUME_TIMEOUT_JIFFIES (HZ / 2)
 
-struct dp_event {
+#define MAX_DPCD_TRANSACTION_BYTES 16
+
+struct msm_dp_event {
 	u32 event_id;
 	u32 data;
 	u32 delay;
 };
 
-struct dp_display_private {
-	char *name;
+struct msm_dp_display_private {
 	int irq;
 
 	unsigned int id;
@@ -82,27 +85,23 @@
 	/* state variables */
 	bool core_initialized;
 	bool phy_initialized;
-	bool hpd_irq_on;
 	bool audio_supported;
 
 	struct drm_device *drm_dev;
-	struct dentry *root;
 
-	struct dp_parser  *parser;
-	struct dp_power   *power;
-	struct dp_catalog *catalog;
+	struct msm_dp_catalog *catalog;
 	struct drm_dp_aux *aux;
-	struct dp_link    *link;
-	struct dp_panel   *panel;
-	struct dp_ctrl    *ctrl;
-	struct dp_debug   *debug;
+	struct msm_dp_link    *link;
+	struct msm_dp_panel   *panel;
+	struct msm_dp_ctrl    *ctrl;
 
-	struct dp_display_mode dp_mode;
-	struct msm_dp dp_display;
+	struct msm_dp msm_dp_display;
 
 	/* wait for audio signaling */
 	struct completion audio_comp;
 
+	unsigned int max_stream;
+
 	/* event related only access by event thread */
 	struct mutex event_mutex;
 	wait_queue_head_t event_q;
@@ -110,132 +109,183 @@
 	u32 event_pndx;
 	u32 event_gndx;
 	struct task_struct *ev_tsk;
-	struct dp_event event_list[DP_EVENT_Q_MAX];
+	struct msm_dp_event event_list[DP_EVENT_Q_MAX];
 	spinlock_t event_lock;
 
-	bool wide_bus_en;
+	bool wide_bus_supported;
 
-	struct dp_audio *audio;
+	u32 active_stream_cnt;
+
+	const unsigned int *intf_map;
+
+	struct msm_dp_audio *audio;
 };
 
 struct msm_dp_desc {
 	phys_addr_t io_start;
 	unsigned int id;
-	unsigned int connector_type;
-	bool wide_bus_en;
+	bool wide_bus_supported;
+	const unsigned int *intf_map;
+	unsigned int max_streams;
+};
+
+/* to be kept in sync with enum dpu_intf of dpu_hw_mdss.h */
+enum dp_mst_intf {
+	INTF_0 = 1,
+	INTF_1,
+	INTF_2,
+	INTF_3,
+	INTF_4,
+	INTF_5,
+	INTF_6,
+	INTF_7,
+	INTF_8,
+	INTF_MAX
 };
 
-static const struct msm_dp_desc sc7180_dp_descs[] = {
-	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .connector_type = DRM_MODE_CONNECTOR_DisplayPort },
+static const unsigned int stream_intf_map_sa_8775p[][DP_STREAM_MAX] = {
+	{INTF_0, INTF_3},
+	{INTF_4, INTF_8},
 	{}
 };
 
-static const struct msm_dp_desc sc7280_dp_descs[] = {
-	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .connector_type = DRM_MODE_CONNECTOR_DisplayPort, .wide_bus_en = true },
-	{ .io_start = 0x0aea0000, .id = MSM_DP_CONTROLLER_1, .connector_type = DRM_MODE_CONNECTOR_eDP, .wide_bus_en = true },
+static const struct msm_dp_desc msm_dp_desc_qcs8300[] = {
+	{ .io_start = 0x0af54000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true,
+	  .max_streams = 2, .intf_map = stream_intf_map_sa_8775p[MSM_DP_CONTROLLER_0],
+	},
+	{}
+};
+
+static const struct msm_dp_desc msm_dp_desc_sa8775p[] = {
+	{ .io_start = 0x0af54000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true,
+	  .max_streams = 2, .intf_map = stream_intf_map_sa_8775p[MSM_DP_CONTROLLER_0],
+	},
+	{ .io_start = 0x0af5c000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true,
+	  .max_streams = 2, .intf_map = stream_intf_map_sa_8775p[MSM_DP_CONTROLLER_1],
+	},
+	{ .io_start = 0x22154000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
+	{ .io_start = 0x2215c000, .id = MSM_DP_CONTROLLER_3, .wide_bus_supported = true },
 	{}
 };
 
-static const struct msm_dp_desc sc8180x_dp_descs[] = {
-	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .connector_type = DRM_MODE_CONNECTOR_DisplayPort },
-	{ .io_start = 0x0ae98000, .id = MSM_DP_CONTROLLER_1, .connector_type = DRM_MODE_CONNECTOR_DisplayPort },
-	{ .io_start = 0x0ae9a000, .id = MSM_DP_CONTROLLER_2, .connector_type = DRM_MODE_CONNECTOR_eDP },
+static const struct msm_dp_desc msm_dp_desc_sc7180[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
 	{}
 };
 
-static const struct msm_dp_desc sc8280xp_dp_descs[] = {
-	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .connector_type = DRM_MODE_CONNECTOR_DisplayPort, .wide_bus_en = true },
-	{ .io_start = 0x0ae98000, .id = MSM_DP_CONTROLLER_1, .connector_type = DRM_MODE_CONNECTOR_DisplayPort, .wide_bus_en = true },
-	{ .io_start = 0x0ae9a000, .id = MSM_DP_CONTROLLER_2, .connector_type = DRM_MODE_CONNECTOR_DisplayPort, .wide_bus_en = true },
-	{ .io_start = 0x0aea0000, .id = MSM_DP_CONTROLLER_3, .connector_type = DRM_MODE_CONNECTOR_DisplayPort, .wide_bus_en = true },
-	{ .io_start = 0x22090000, .id = MSM_DP_CONTROLLER_0, .connector_type = DRM_MODE_CONNECTOR_DisplayPort, .wide_bus_en = true },
-	{ .io_start = 0x22098000, .id = MSM_DP_CONTROLLER_1, .connector_type = DRM_MODE_CONNECTOR_DisplayPort, .wide_bus_en = true },
-	{ .io_start = 0x2209a000, .id = MSM_DP_CONTROLLER_2, .connector_type = DRM_MODE_CONNECTOR_DisplayPort, .wide_bus_en = true },
-	{ .io_start = 0x220a0000, .id = MSM_DP_CONTROLLER_3, .connector_type = DRM_MODE_CONNECTOR_DisplayPort, .wide_bus_en = true },
+static const struct msm_dp_desc msm_dp_desc_sc7280[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x0aea0000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
 	{}
 };
 
-static const struct msm_dp_desc sc8280xp_edp_descs[] = {
-	{ .io_start = 0x0ae9a000, .id = MSM_DP_CONTROLLER_2, .connector_type = DRM_MODE_CONNECTOR_eDP, .wide_bus_en = true },
-	{ .io_start = 0x0aea0000, .id = MSM_DP_CONTROLLER_3, .connector_type = DRM_MODE_CONNECTOR_eDP, .wide_bus_en = true },
-	{ .io_start = 0x2209a000, .id = MSM_DP_CONTROLLER_2, .connector_type = DRM_MODE_CONNECTOR_eDP, .wide_bus_en = true },
-	{ .io_start = 0x220a0000, .id = MSM_DP_CONTROLLER_3, .connector_type = DRM_MODE_CONNECTOR_eDP, .wide_bus_en = true },
+static const struct msm_dp_desc msm_dp_desc_sc8180x[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x0ae98000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
+	{ .io_start = 0x0ae9a000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
 	{}
 };
 
-static const struct msm_dp_desc sm8350_dp_descs[] = {
-	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .connector_type = DRM_MODE_CONNECTOR_DisplayPort },
+static const struct msm_dp_desc msm_dp_desc_sc8280xp[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x0ae98000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
+	{ .io_start = 0x0ae9a000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
+	{ .io_start = 0x0aea0000, .id = MSM_DP_CONTROLLER_3, .wide_bus_supported = true },
+	{ .io_start = 0x22090000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x22098000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
+	{ .io_start = 0x2209a000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
+	{ .io_start = 0x220a0000, .id = MSM_DP_CONTROLLER_3, .wide_bus_supported = true },
 	{}
 };
 
-static const struct msm_dp_desc sm8650_dp_descs[] = {
-	{ .io_start = 0x0af54000, .id = MSM_DP_CONTROLLER_0, .connector_type = DRM_MODE_CONNECTOR_DisplayPort },
+static const struct msm_dp_desc msm_dp_desc_sm8650[] = {
+	{ .io_start = 0x0af54000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
 	{}
 };
 
-static const struct of_device_id dp_dt_match[] = {
-	{ .compatible = "qcom,sc7180-dp", .data = &sc7180_dp_descs },
-	{ .compatible = "qcom,sc7280-dp", .data = &sc7280_dp_descs },
-	{ .compatible = "qcom,sc7280-edp", .data = &sc7280_dp_descs },
-	{ .compatible = "qcom,sc8180x-dp", .data = &sc8180x_dp_descs },
-	{ .compatible = "qcom,sc8180x-edp", .data = &sc8180x_dp_descs },
-	{ .compatible = "qcom,sc8280xp-dp", .data = &sc8280xp_dp_descs },
-	{ .compatible = "qcom,sc8280xp-edp", .data = &sc8280xp_edp_descs },
-	{ .compatible = "qcom,sdm845-dp", .data = &sc7180_dp_descs },
-	{ .compatible = "qcom,sm8350-dp", .data = &sm8350_dp_descs },
-	{ .compatible = "qcom,sm8650-dp", .data = &sm8650_dp_descs },
+static const struct msm_dp_desc msm_dp_desc_x1e80100[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x0ae98000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
+	{ .io_start = 0x0ae9a000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
+	{ .io_start = 0x0aea0000, .id = MSM_DP_CONTROLLER_3, .wide_bus_supported = true },
 	{}
 };
 
-static struct dp_display_private *dev_get_dp_display_private(struct device *dev)
+static const struct of_device_id msm_dp_dt_match[] = {
+	{ .compatible = "qcom,qcs8300-dp", .data = &msm_dp_desc_qcs8300 },
+	{ .compatible = "qcom,sa8775p-dp", .data = &msm_dp_desc_sa8775p },
+	{ .compatible = "qcom,sc7180-dp", .data = &msm_dp_desc_sc7180 },
+	{ .compatible = "qcom,sc7280-dp", .data = &msm_dp_desc_sc7280 },
+	{ .compatible = "qcom,sc7280-edp", .data = &msm_dp_desc_sc7280 },
+	{ .compatible = "qcom,sc8180x-dp", .data = &msm_dp_desc_sc8180x },
+	{ .compatible = "qcom,sc8180x-edp", .data = &msm_dp_desc_sc8180x },
+	{ .compatible = "qcom,sc8280xp-dp", .data = &msm_dp_desc_sc8280xp },
+	{ .compatible = "qcom,sc8280xp-edp", .data = &msm_dp_desc_sc8280xp },
+	{ .compatible = "qcom,sdm845-dp", .data = &msm_dp_desc_sc7180 },
+	{ .compatible = "qcom,sm8350-dp", .data = &msm_dp_desc_sc7180 },
+	{ .compatible = "qcom,sm8650-dp", .data = &msm_dp_desc_sm8650 },
+	{ .compatible = "qcom,x1e80100-dp", .data = &msm_dp_desc_x1e80100 },
+	{}
+};
+
+int msm_dp_display_get_active_stream_cnt(struct msm_dp *msm_dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+
+	return msm_dp_display->active_stream_cnt;
+}
+
+static struct msm_dp_display_private *dev_get_dp_display_private(struct device *dev)
 {
 	struct msm_dp *dp = dev_get_drvdata(dev);
 
-	return container_of(dp, struct dp_display_private, dp_display);
+	return container_of(dp, struct msm_dp_display_private, msm_dp_display);
 }
 
-static int dp_add_event(struct dp_display_private *dp_priv, u32 event,
+static int msm_dp_add_event(struct msm_dp_display_private *msm_dp_priv, u32 event,
 						u32 data, u32 delay)
 {
 	unsigned long flag;
-	struct dp_event *todo;
+	struct msm_dp_event *todo;
 	int pndx;
 
-	spin_lock_irqsave(&dp_priv->event_lock, flag);
-	pndx = dp_priv->event_pndx + 1;
+	spin_lock_irqsave(&msm_dp_priv->event_lock, flag);
+	pndx = msm_dp_priv->event_pndx + 1;
 	pndx %= DP_EVENT_Q_MAX;
-	if (pndx == dp_priv->event_gndx) {
+	if (pndx == msm_dp_priv->event_gndx) {
 		pr_err("event_q is full: pndx=%d gndx=%d\n",
-			dp_priv->event_pndx, dp_priv->event_gndx);
-		spin_unlock_irqrestore(&dp_priv->event_lock, flag);
+			msm_dp_priv->event_pndx, msm_dp_priv->event_gndx);
+		spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
 		return -EPERM;
 	}
-	todo = &dp_priv->event_list[dp_priv->event_pndx++];
-	dp_priv->event_pndx %= DP_EVENT_Q_MAX;
+	todo = &msm_dp_priv->event_list[msm_dp_priv->event_pndx++];
+	msm_dp_priv->event_pndx %= DP_EVENT_Q_MAX;
 	todo->event_id = event;
 	todo->data = data;
 	todo->delay = delay;
-	wake_up(&dp_priv->event_q);
-	spin_unlock_irqrestore(&dp_priv->event_lock, flag);
+	wake_up(&msm_dp_priv->event_q);
+	spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
 
 	return 0;
 }
 
-static int dp_del_event(struct dp_display_private *dp_priv, u32 event)
+static int msm_dp_del_event(struct msm_dp_display_private *msm_dp_priv, u32 event)
 {
 	unsigned long flag;
-	struct dp_event *todo;
+	struct msm_dp_event *todo;
 	u32	gndx;
 
-	spin_lock_irqsave(&dp_priv->event_lock, flag);
-	if (dp_priv->event_pndx == dp_priv->event_gndx) {
-		spin_unlock_irqrestore(&dp_priv->event_lock, flag);
+	spin_lock_irqsave(&msm_dp_priv->event_lock, flag);
+	if (msm_dp_priv->event_pndx == msm_dp_priv->event_gndx) {
+		spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
 		return -ENOENT;
 	}
 
-	gndx = dp_priv->event_gndx;
-	while (dp_priv->event_pndx != gndx) {
-		todo = &dp_priv->event_list[gndx];
+	gndx = msm_dp_priv->event_gndx;
+	while (msm_dp_priv->event_pndx != gndx) {
+		todo = &msm_dp_priv->event_list[gndx];
 		if (todo->event_id == event) {
 			todo->event_id = EV_NO_EVENT;	/* deleted */
 			todo->delay = 0;
@@ -243,60 +293,60 @@
 		gndx++;
 		gndx %= DP_EVENT_Q_MAX;
 	}
-	spin_unlock_irqrestore(&dp_priv->event_lock, flag);
+	spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
 
 	return 0;
 }
 
-void dp_display_signal_audio_start(struct msm_dp *dp_display)
+void msm_dp_display_signal_audio_start(struct msm_dp *msm_dp_display)
 {
-	struct dp_display_private *dp;
+	struct msm_dp_display_private *dp;
 
-	dp = container_of(dp_display, struct dp_display_private, dp_display);
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
 
 	reinit_completion(&dp->audio_comp);
 }
 
-void dp_display_signal_audio_complete(struct msm_dp *dp_display)
+void msm_dp_display_signal_audio_complete(struct msm_dp *msm_dp_display)
 {
-	struct dp_display_private *dp;
+	struct msm_dp_display_private *dp;
 
-	dp = container_of(dp_display, struct dp_display_private, dp_display);
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
 
 	complete_all(&dp->audio_comp);
 }
 
-static int dp_hpd_event_thread_start(struct dp_display_private *dp_priv);
+static int msm_dp_hpd_event_thread_start(struct msm_dp_display_private *msm_dp_priv);
 
-static int dp_display_bind(struct device *dev, struct device *master,
+static int msm_dp_display_bind(struct device *dev, struct device *master,
 			   void *data)
 {
 	int rc = 0;
-	struct dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
 	struct msm_drm_private *priv = dev_get_drvdata(master);
 	struct drm_device *drm = priv->dev;
 
-	dp->dp_display.drm_dev = drm;
-	priv->dp[dp->id] = &dp->dp_display;
+	dp->msm_dp_display.drm_dev = drm;
+	priv->dp[dp->id] = &dp->msm_dp_display;
 
 
 
 	dp->drm_dev = drm;
 	dp->aux->drm_dev = drm;
-	rc = dp_aux_register(dp->aux);
+	rc = msm_dp_aux_register(dp->aux);
 	if (rc) {
 		DRM_ERROR("DRM DP AUX register failed\n");
 		goto end;
 	}
 
 
-	rc = dp_register_audio_driver(dev, dp->audio);
+	rc = msm_dp_register_audio_driver(dev, dp->audio);
 	if (rc) {
 		DRM_ERROR("Audio registration Dp failed\n");
 		goto end;
 	}
 
-	rc = dp_hpd_event_thread_start(dp);
+	rc = msm_dp_hpd_event_thread_start(dp);
 	if (rc) {
 		DRM_ERROR("Event thread create failed\n");
 		goto end;
@@ -307,44 +357,44 @@
 	return rc;
 }
 
-static void dp_display_unbind(struct device *dev, struct device *master,
+static void msm_dp_display_unbind(struct device *dev, struct device *master,
 			      void *data)
 {
-	struct dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
 	struct msm_drm_private *priv = dev_get_drvdata(master);
 
 	kthread_stop(dp->ev_tsk);
 
 	of_dp_aux_depopulate_bus(dp->aux);
 
-	dp_unregister_audio_driver(dev, dp->audio);
-	dp_aux_unregister(dp->aux);
+	msm_dp_unregister_audio_driver(dev, dp->audio);
+	msm_dp_aux_unregister(dp->aux);
 	dp->drm_dev = NULL;
 	dp->aux->drm_dev = NULL;
 	priv->dp[dp->id] = NULL;
 }
 
-static const struct component_ops dp_display_comp_ops = {
-	.bind = dp_display_bind,
-	.unbind = dp_display_unbind,
+static const struct component_ops msm_dp_display_comp_ops = {
+	.bind = msm_dp_display_bind,
+	.unbind = msm_dp_display_unbind,
 };
 
-static void dp_display_send_hpd_event(struct msm_dp *dp_display)
+static void msm_dp_display_send_hpd_event(struct msm_dp *msm_dp_display)
 {
-	struct dp_display_private *dp;
+	struct msm_dp_display_private *dp;
 	struct drm_connector *connector;
 
-	dp = container_of(dp_display, struct dp_display_private, dp_display);
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
 
-	connector = dp->dp_display.connector;
+	connector = dp->msm_dp_display.connector;
 	drm_helper_hpd_irq_event(connector->dev);
 }
 
-static int dp_display_send_hpd_notification(struct dp_display_private *dp,
+static int msm_dp_display_send_hpd_notification(struct msm_dp_display_private *dp,
 					    bool hpd)
 {
-	if ((hpd && dp->dp_display.link_ready) ||
-			(!hpd && !dp->dp_display.link_ready)) {
+	if ((hpd && dp->msm_dp_display.link_ready) ||
+			(!hpd && !dp->msm_dp_display.link_ready)) {
 		drm_dbg_dp(dp->drm_dev, "HPD already %s\n",
 				(hpd ? "on" : "off"));
 		return 0;
@@ -353,148 +403,197 @@
 	/* reset video pattern flag on disconnect */
 	if (!hpd) {
 		dp->panel->video_test = false;
-		if (!dp->dp_display.is_edp)
-			drm_dp_set_subconnector_property(dp->dp_display.connector,
+		if (!dp->msm_dp_display.is_edp)
+			drm_dp_set_subconnector_property(dp->msm_dp_display.connector,
 							 connector_status_disconnected,
 							 dp->panel->dpcd,
 							 dp->panel->downstream_ports);
 	}
 
-	dp->dp_display.link_ready = hpd;
+	dp->msm_dp_display.link_ready = hpd;
 
 	drm_dbg_dp(dp->drm_dev, "type=%d hpd=%d\n",
-			dp->dp_display.connector_type, hpd);
-	dp_display_send_hpd_event(&dp->dp_display);
+			dp->msm_dp_display.connector_type, hpd);
+	msm_dp_display_send_hpd_event(&dp->msm_dp_display);
 
 	return 0;
 }
 
-static int dp_display_process_hpd_high(struct dp_display_private *dp)
+static void msm_dp_display_mst_init(struct msm_dp_display_private *dp)
 {
-	int rc = 0;
-	struct edid *edid;
+	const unsigned long clear_mstm_ctrl_timeout_us = 100000;
+	u8 old_mstm_ctrl;
+	struct msm_dp *msm_dp = &dp->msm_dp_display;
+	int ret;
+
+	/* clear sink mst state */
+	drm_dp_dpcd_readb(dp->aux, DP_MSTM_CTRL, &old_mstm_ctrl);
+	drm_dp_dpcd_writeb(dp->aux, DP_MSTM_CTRL, 0);
+
+	/* add extra delay if MST state is not cleared */
+	if (old_mstm_ctrl) {
+		drm_dbg_dp(dp->drm_dev, "MSTM_CTRL is not cleared, wait %luus\n",
+			   clear_mstm_ctrl_timeout_us);
+		usleep_range(clear_mstm_ctrl_timeout_us,
+			     clear_mstm_ctrl_timeout_us + 1000);
+	}
+
+	ret = drm_dp_dpcd_writeb(dp->aux, DP_MSTM_CTRL,
+				 DP_MST_EN | DP_UP_REQ_EN | DP_UPSTREAM_IS_SRC);
+	if (ret < 0) {
+		DRM_ERROR("sink mst enablement failed\n");
+		return;
+	}
+
+	msm_dp->mst_active = true;
+}
+
+static void msm_dp_display_set_mst_mgr_state(struct msm_dp_display_private *dp,
+					     bool state)
+{
+	if (!dp->msm_dp_display.mst_active)
+		return;
 
-	dp->panel->max_dp_lanes = dp->parser->max_dp_lanes;
-	dp->panel->max_dp_link_rate = dp->parser->max_dp_link_rate;
+	msm_dp_mst_display_set_mgr_state(&dp->msm_dp_display, state);
 
-	drm_dbg_dp(dp->drm_dev, "max_lanes=%d max_link_rate=%d\n",
-		dp->panel->max_dp_lanes, dp->panel->max_dp_link_rate);
+	drm_dbg_dp(dp->drm_dev, "mst_mgr_state: %d\n", state);
+}
 
-	rc = dp_panel_read_sink_caps(dp->panel, dp->dp_display.connector);
+static int msm_dp_display_process_hpd_high(struct msm_dp_display_private *dp)
+{
+	struct drm_connector *connector = dp->msm_dp_display.connector;
+	const struct drm_display_info *info = &connector->display_info;
+	int rc = 0;
+	struct msm_dp *dp_display = &dp->msm_dp_display;
+
+	rc = msm_dp_panel_read_link_caps(dp->panel, connector);
 	if (rc)
 		goto end;
 
-	dp_link_process_request(dp->link);
+	if (dp->max_stream <= DEFAULT_STREAM_COUNT || !msm_dp_panel_read_mst_cap(dp->panel)) {
+		rc = msm_dp_panel_read_edid(dp->panel, connector);
+		if (rc)
+			goto end;
+	}
+
+	msm_dp_link_process_request(dp->link);
 
-	if (!dp->dp_display.is_edp)
-		drm_dp_set_subconnector_property(dp->dp_display.connector,
+	if (!dp->msm_dp_display.is_edp)
+		drm_dp_set_subconnector_property(connector,
 						 connector_status_connected,
 						 dp->panel->dpcd,
 						 dp->panel->downstream_ports);
 
-	edid = dp->panel->edid;
-
-	dp->dp_display.psr_supported = dp->panel->psr_cap.version && psr_enabled;
-
-	dp->audio_supported = drm_detect_monitor_audio(edid);
-	dp_panel_handle_sink_request(dp->panel);
+	dp->msm_dp_display.psr_supported = dp->panel->psr_cap.version && psr_enabled;
 
-	dp->dp_display.max_dp_lanes = dp->parser->max_dp_lanes;
+	dp->audio_supported = info->has_audio;
+	msm_dp_panel_handle_sink_request(dp->panel);
 
 	/*
 	 * set sink to normal operation mode -- D0
 	 * before dpcd read
 	 */
-	dp_link_psm_config(dp->link, &dp->panel->link_info, false);
+	msm_dp_link_psm_config(dp->link, &dp->panel->link_info, false);
 
-	dp_link_reset_phy_params_vx_px(dp->link);
-	rc = dp_ctrl_on_link(dp->ctrl);
+	if (dp->max_stream > DEFAULT_STREAM_COUNT && msm_dp_panel_read_mst_cap(dp->panel))
+		msm_dp_display_mst_init(dp);
+
+	msm_dp_link_reset_phy_params_vx_px(dp->link);
+	rc = msm_dp_ctrl_on_link(dp->ctrl, dp_display->mst_active);
 	if (rc) {
 		DRM_ERROR("failed to complete DP link training\n");
 		goto end;
 	}
 
-	dp_add_event(dp, EV_USER_NOTIFICATION, true, 0);
+	msm_dp_display_set_mst_mgr_state(dp, true);
+
+	msm_dp_add_event(dp, EV_USER_NOTIFICATION, true, 0);
 
 end:
 	return rc;
 }
 
-static void dp_display_host_phy_init(struct dp_display_private *dp)
+static void msm_dp_display_host_phy_init(struct msm_dp_display_private *dp)
 {
 	drm_dbg_dp(dp->drm_dev, "type=%d core_init=%d phy_init=%d\n",
-		dp->dp_display.connector_type, dp->core_initialized,
+		dp->msm_dp_display.connector_type, dp->core_initialized,
 		dp->phy_initialized);
 
 	if (!dp->phy_initialized) {
-		dp_ctrl_phy_init(dp->ctrl);
+		msm_dp_ctrl_phy_init(dp->ctrl);
 		dp->phy_initialized = true;
 	}
 }
 
-static void dp_display_host_phy_exit(struct dp_display_private *dp)
+static void msm_dp_display_host_phy_exit(struct msm_dp_display_private *dp)
 {
 	drm_dbg_dp(dp->drm_dev, "type=%d core_init=%d phy_init=%d\n",
-		dp->dp_display.connector_type, dp->core_initialized,
+		dp->msm_dp_display.connector_type, dp->core_initialized,
 		dp->phy_initialized);
 
 	if (dp->phy_initialized) {
-		dp_ctrl_phy_exit(dp->ctrl);
+		msm_dp_ctrl_phy_exit(dp->ctrl);
 		dp->phy_initialized = false;
 	}
 }
 
-static void dp_display_host_init(struct dp_display_private *dp)
+static void msm_dp_display_host_init(struct msm_dp_display_private *dp)
 {
 	drm_dbg_dp(dp->drm_dev, "type=%d core_init=%d phy_init=%d\n",
-		dp->dp_display.connector_type, dp->core_initialized,
+		dp->msm_dp_display.connector_type, dp->core_initialized,
 		dp->phy_initialized);
 
-	dp_power_init(dp->power);
-	dp_ctrl_reset_irq_ctrl(dp->ctrl, true);
-	dp_aux_init(dp->aux);
+	msm_dp_ctrl_core_clk_enable(dp->ctrl);
+	msm_dp_ctrl_reset_irq_ctrl(dp->ctrl, true);
+	msm_dp_aux_init(dp->aux);
 	dp->core_initialized = true;
 }
 
-static void dp_display_host_deinit(struct dp_display_private *dp)
+static void msm_dp_display_host_deinit(struct msm_dp_display_private *dp)
 {
 	drm_dbg_dp(dp->drm_dev, "type=%d core_init=%d phy_init=%d\n",
-		dp->dp_display.connector_type, dp->core_initialized,
+		dp->msm_dp_display.connector_type, dp->core_initialized,
 		dp->phy_initialized);
 
-	dp_ctrl_reset_irq_ctrl(dp->ctrl, false);
-	dp_aux_deinit(dp->aux);
-	dp_power_deinit(dp->power);
+	msm_dp_ctrl_reset_irq_ctrl(dp->ctrl, false);
+	msm_dp_aux_deinit(dp->aux);
+	msm_dp_ctrl_core_clk_disable(dp->ctrl);
 	dp->core_initialized = false;
 }
 
-static int dp_display_usbpd_configure_cb(struct device *dev)
+static int msm_dp_display_usbpd_configure_cb(struct device *dev)
 {
-	struct dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
 
-	dp_display_host_phy_init(dp);
+	msm_dp_display_host_phy_init(dp);
 
-	return dp_display_process_hpd_high(dp);
+	return msm_dp_display_process_hpd_high(dp);
 }
 
-static int dp_display_notify_disconnect(struct device *dev)
+static int msm_dp_display_notify_disconnect(struct device *dev)
 {
-	struct dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp *dp_display = &dp->msm_dp_display;
+
+	if (dp_display->mst_active) {
+		msm_dp_mst_display_set_mgr_state(&dp->msm_dp_display, false);
+		dp_display->mst_active = false;
+	}
 
-	dp_add_event(dp, EV_USER_NOTIFICATION, false, 0);
+	msm_dp_add_event(dp, EV_USER_NOTIFICATION, false, 0);
 
 	return 0;
 }
 
-static void dp_display_handle_video_request(struct dp_display_private *dp)
+static void msm_dp_display_handle_video_request(struct msm_dp_display_private *dp)
 {
 	if (dp->link->sink_request & DP_TEST_LINK_VIDEO_PATTERN) {
 		dp->panel->video_test = true;
-		dp_link_send_test_response(dp->link);
+		msm_dp_link_send_test_response(dp->link);
 	}
 }
 
-static int dp_display_handle_port_ststus_changed(struct dp_display_private *dp)
+static int msm_dp_display_handle_port_status_changed(struct msm_dp_display_private *dp)
 {
 	int rc = 0;
 
@@ -502,12 +601,12 @@
 		drm_dbg_dp(dp->drm_dev, "sink count is zero, nothing to do\n");
 		if (dp->hpd_state != ST_DISCONNECTED) {
 			dp->hpd_state = ST_DISCONNECT_PENDING;
-			dp_add_event(dp, EV_USER_NOTIFICATION, false, 0);
+			msm_dp_add_event(dp, EV_USER_NOTIFICATION, false, 0);
 		}
 	} else {
 		if (dp->hpd_state == ST_DISCONNECTED) {
 			dp->hpd_state = ST_MAINLINK_READY;
-			rc = dp_display_process_hpd_high(dp);
+			rc = msm_dp_display_process_hpd_high(dp);
 			if (rc)
 				dp->hpd_state = ST_DISCONNECTED;
 		}
@@ -516,7 +615,7 @@
 	return rc;
 }
 
-static int dp_display_handle_irq_hpd(struct dp_display_private *dp)
+static int msm_dp_display_handle_irq_hpd(struct msm_dp_display_private *dp)
 {
 	u32 sink_request = dp->link->sink_request;
 
@@ -530,46 +629,52 @@
 		}
 	}
 
-	dp_ctrl_handle_sink_request(dp->ctrl);
+	msm_dp_ctrl_handle_sink_request(dp->ctrl);
 
 	if (sink_request & DP_TEST_LINK_VIDEO_PATTERN)
-		dp_display_handle_video_request(dp);
+		msm_dp_display_handle_video_request(dp);
 
 	return 0;
 }
 
-static int dp_display_usbpd_attention_cb(struct device *dev)
+static int msm_dp_display_usbpd_attention_cb(struct device *dev)
 {
 	int rc = 0;
 	u32 sink_request;
-	struct dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp *msm_dp_display = &dp->msm_dp_display;
 
 	/* check for any test request issued by sink */
-	rc = dp_link_process_request(dp->link);
+	rc = msm_dp_link_process_request(dp->link);
 	if (!rc) {
 		sink_request = dp->link->sink_request;
 		drm_dbg_dp(dp->drm_dev, "hpd_state=%d sink_request=%d\n",
 					dp->hpd_state, sink_request);
-		if (sink_request & DS_PORT_STATUS_CHANGED)
-			rc = dp_display_handle_port_ststus_changed(dp);
-		else
-			rc = dp_display_handle_irq_hpd(dp);
+		if (sink_request & DS_PORT_STATUS_CHANGED) {
+			if (!msm_dp_display->mst_active)
+				rc = msm_dp_display_handle_port_status_changed(dp);
+		} else {
+			rc = msm_dp_display_handle_irq_hpd(dp);
+		}
 	}
 
+	msm_dp_mst_display_hpd_irq(&dp->msm_dp_display);
 	return rc;
 }
 
-static int dp_hpd_plug_handle(struct dp_display_private *dp, u32 data)
+static int msm_dp_hpd_plug_handle(struct msm_dp_display_private *dp, u32 data)
 {
 	u32 state;
 	int ret;
-	struct platform_device *pdev = dp->dp_display.pdev;
+	struct platform_device *pdev = dp->msm_dp_display.pdev;
+
+	msm_dp_aux_enable_xfers(dp->aux, true);
 
 	mutex_lock(&dp->event_mutex);
 
 	state =  dp->hpd_state;
 	drm_dbg_dp(dp->drm_dev, "Before, type=%d hpd_state=%d\n",
-			dp->dp_display.connector_type, state);
+			dp->msm_dp_display.connector_type, state);
 
 	if (state == ST_DISPLAY_OFF) {
 		mutex_unlock(&dp->event_mutex);
@@ -583,7 +688,7 @@
 
 	if (state == ST_DISCONNECT_PENDING) {
 		/* wait until ST_DISCONNECTED */
-		dp_add_event(dp, EV_HPD_PLUG_INT, 0, 1); /* delay = 1 */
+		msm_dp_add_event(dp, EV_HPD_PLUG_INT, 0, 1); /* delay = 1 */
 		mutex_unlock(&dp->event_mutex);
 		return 0;
 	}
@@ -595,66 +700,70 @@
 		return ret;
 	}
 
-	ret = dp_display_usbpd_configure_cb(&pdev->dev);
+	ret = msm_dp_display_usbpd_configure_cb(&pdev->dev);
 	if (ret) {	/* link train failed */
 		dp->hpd_state = ST_DISCONNECTED;
+		pm_runtime_put_sync(&pdev->dev);
 	} else {
 		dp->hpd_state = ST_MAINLINK_READY;
 	}
 
 	drm_dbg_dp(dp->drm_dev, "After, type=%d hpd_state=%d\n",
-			dp->dp_display.connector_type, state);
+			dp->msm_dp_display.connector_type, state);
 	mutex_unlock(&dp->event_mutex);
 
 	/* uevent will complete connection part */
 	return 0;
 };
 
-static void dp_display_handle_plugged_change(struct msm_dp *dp_display,
+static void msm_dp_display_handle_plugged_change(struct msm_dp *msm_dp_display,
 		bool plugged)
 {
-	struct dp_display_private *dp;
+	struct msm_dp_display_private *dp;
 
-	dp = container_of(dp_display,
-			struct dp_display_private, dp_display);
+	dp = container_of(msm_dp_display,
+			struct msm_dp_display_private, msm_dp_display);
 
 	/* notify audio subsystem only if sink supports audio */
-	if (dp_display->plugged_cb && dp_display->codec_dev &&
+	if (msm_dp_display->plugged_cb && msm_dp_display->codec_dev &&
 			dp->audio_supported)
-		dp_display->plugged_cb(dp_display->codec_dev, plugged);
+		msm_dp_display->plugged_cb(msm_dp_display->codec_dev, plugged);
 }
 
-static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data)
+static int msm_dp_hpd_unplug_handle(struct msm_dp_display_private *dp, u32 data)
 {
 	u32 state;
-	struct platform_device *pdev = dp->dp_display.pdev;
+	struct platform_device *pdev = dp->msm_dp_display.pdev;
+
+	msm_dp_aux_enable_xfers(dp->aux, false);
 
 	mutex_lock(&dp->event_mutex);
 
 	state = dp->hpd_state;
 
 	drm_dbg_dp(dp->drm_dev, "Before, type=%d hpd_state=%d\n",
-			dp->dp_display.connector_type, state);
+			dp->msm_dp_display.connector_type, state);
 
 	/* unplugged, no more irq_hpd handle */
-	dp_del_event(dp, EV_IRQ_HPD_INT);
+	msm_dp_del_event(dp, EV_IRQ_HPD_INT);
 
 	if (state == ST_DISCONNECTED) {
 		/* triggered by irq_hdp with sink_count = 0 */
 		if (dp->link->sink_count == 0) {
-			dp_display_host_phy_exit(dp);
+			msm_dp_display_host_phy_exit(dp);
 		}
-		dp_display_notify_disconnect(&dp->dp_display.pdev->dev);
+		msm_dp_display_notify_disconnect(&dp->msm_dp_display.pdev->dev);
 		mutex_unlock(&dp->event_mutex);
 		return 0;
 	} else if (state == ST_DISCONNECT_PENDING) {
 		mutex_unlock(&dp->event_mutex);
 		return 0;
 	} else if (state == ST_MAINLINK_READY) {
-		dp_ctrl_off_link(dp->ctrl);
-		dp_display_host_phy_exit(dp);
+		msm_dp_ctrl_off_link(dp->ctrl);
+		msm_dp_display_host_phy_exit(dp);
 		dp->hpd_state = ST_DISCONNECTED;
-		dp_display_notify_disconnect(&dp->dp_display.pdev->dev);
+		msm_dp_display_notify_disconnect(&dp->msm_dp_display.pdev->dev);
+		pm_runtime_put_sync(&pdev->dev);
 		mutex_unlock(&dp->event_mutex);
 		return 0;
 	}
@@ -663,7 +772,7 @@
 	 * We don't need separate work for disconnect as
 	 * connect/attention interrupts are disabled
 	 */
-	dp_display_notify_disconnect(&dp->dp_display.pdev->dev);
+	msm_dp_display_notify_disconnect(&dp->msm_dp_display.pdev->dev);
 
 	if (state == ST_DISPLAY_OFF) {
 		dp->hpd_state = ST_DISCONNECTED;
@@ -672,10 +781,10 @@
 	}
 
 	/* signal the disconnect event early to ensure proper teardown */
-	dp_display_handle_plugged_change(&dp->dp_display, false);
+	msm_dp_display_handle_plugged_change(&dp->msm_dp_display, false);
 
 	drm_dbg_dp(dp->drm_dev, "After, type=%d hpd_state=%d\n",
-			dp->dp_display.connector_type, state);
+			dp->msm_dp_display.connector_type, state);
 
 	/* uevent will complete disconnection part */
 	pm_runtime_put_sync(&pdev->dev);
@@ -683,7 +792,7 @@
 	return 0;
 }
 
-static int dp_irq_hpd_handle(struct dp_display_private *dp, u32 data)
+static int msm_dp_irq_hpd_handle(struct msm_dp_display_private *dp, u32 data)
 {
 	u32 state;
 
@@ -692,54 +801,91 @@
 	/* irq_hpd can happen at either connected or disconnected state */
 	state =  dp->hpd_state;
 	drm_dbg_dp(dp->drm_dev, "Before, type=%d hpd_state=%d\n",
-			dp->dp_display.connector_type, state);
+			dp->msm_dp_display.connector_type, state);
 
-	if (state == ST_DISPLAY_OFF) {
+	/* irq hpd to indicate monitor disconnect/connect can happen even
+	 * after stream is disabled not necessarily due to hotplug disconnect
+	 */
+	if (state == ST_DISPLAY_OFF && !dp->msm_dp_display.mst_active) {
 		mutex_unlock(&dp->event_mutex);
 		return 0;
 	}
 
-	if (state == ST_MAINLINK_READY || state == ST_DISCONNECT_PENDING) {
+	if ((state == ST_MAINLINK_READY || state == ST_DISCONNECT_PENDING) &&
+			!dp->msm_dp_display.mst_active) {
 		/* wait until ST_CONNECTED */
-		dp_add_event(dp, EV_IRQ_HPD_INT, 0, 1); /* delay = 1 */
+		msm_dp_add_event(dp, EV_IRQ_HPD_INT, 0, 1); /* delay = 1 */
 		mutex_unlock(&dp->event_mutex);
 		return 0;
 	}
 
-	dp_display_usbpd_attention_cb(&dp->dp_display.pdev->dev);
+	msm_dp_display_usbpd_attention_cb(&dp->msm_dp_display.pdev->dev);
 
 	drm_dbg_dp(dp->drm_dev, "After, type=%d hpd_state=%d\n",
-			dp->dp_display.connector_type, state);
+			dp->msm_dp_display.connector_type, state);
 
 	mutex_unlock(&dp->event_mutex);
 
 	return 0;
 }
 
-static void dp_display_deinit_sub_modules(struct dp_display_private *dp)
+struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *dp_display)
+{
+	struct msm_dp_display_private *dp;
+	struct msm_dp_panel *dp_panel;
+
+	struct msm_dp_panel_in panel_in;
+
+	dp = container_of(dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	panel_in.dev = &dp_display->pdev->dev;
+	panel_in.aux = dp->aux;
+	panel_in.catalog = dp->catalog;
+	panel_in.link = dp->link;
+
+	dp_panel = msm_dp_panel_get(&panel_in);
+
+	if (IS_ERR(dp->panel)) {
+		DRM_ERROR("failed to initialize panel\n");
+		return NULL;
+	}
+
+	memcpy(dp_panel->dpcd, dp->panel->dpcd, DP_RECEIVER_CAP_SIZE + 1);
+	memcpy(&dp_panel->link_info, &dp->panel->link_info,
+	       sizeof(dp->panel->link_info));
+
+	return dp_panel;
+}
+
+static void msm_dp_display_deinit_sub_modules(struct msm_dp_display_private *dp)
 {
-	dp_audio_put(dp->audio);
-	dp_panel_put(dp->panel);
-	dp_aux_put(dp->aux);
+	msm_dp_audio_put(dp->audio);
+	msm_dp_panel_put(dp->panel);
+	msm_dp_aux_put(dp->aux);
 }
 
-static int dp_init_sub_modules(struct dp_display_private *dp)
+static int msm_dp_init_sub_modules(struct msm_dp_display_private *dp)
 {
 	int rc = 0;
-	struct device *dev = &dp->dp_display.pdev->dev;
-	struct dp_panel_in panel_in = {
+	struct device *dev = &dp->msm_dp_display.pdev->dev;
+	struct msm_dp_panel_in panel_in = {
 		.dev = dev,
 	};
+	struct phy *phy;
+
+	phy = devm_phy_get(dev, "dp");
+	if (IS_ERR(phy))
+		return PTR_ERR(phy);
 
-	dp->parser = dp_parser_get(dp->dp_display.pdev);
-	if (IS_ERR(dp->parser)) {
-		rc = PTR_ERR(dp->parser);
-		DRM_ERROR("failed to initialize parser, rc = %d\n", rc);
-		dp->parser = NULL;
+	rc = phy_set_mode_ext(phy, PHY_MODE_DP,
+			      dp->msm_dp_display.is_edp ? PHY_SUBMODE_EDP : PHY_SUBMODE_DP);
+	if (rc) {
+		DRM_ERROR("failed to set phy submode, rc = %d\n", rc);
+		dp->catalog = NULL;
 		goto error;
 	}
 
-	dp->catalog = dp_catalog_get(dev, &dp->parser->io);
+	dp->catalog = msm_dp_catalog_get(dev);
 	if (IS_ERR(dp->catalog)) {
 		rc = PTR_ERR(dp->catalog);
 		DRM_ERROR("failed to initialize catalog, rc = %d\n", rc);
@@ -747,15 +893,9 @@
 		goto error;
 	}
 
-	dp->power = dp_power_get(dev, dp->parser);
-	if (IS_ERR(dp->power)) {
-		rc = PTR_ERR(dp->power);
-		DRM_ERROR("failed to initialize power, rc = %d\n", rc);
-		dp->power = NULL;
-		goto error;
-	}
-
-	dp->aux = dp_aux_get(dev, dp->catalog, dp->dp_display.is_edp);
+	dp->aux = msm_dp_aux_get(dev, dp->catalog,
+			     phy,
+			     dp->msm_dp_display.is_edp);
 	if (IS_ERR(dp->aux)) {
 		rc = PTR_ERR(dp->aux);
 		DRM_ERROR("failed to initialize aux, rc = %d\n", rc);
@@ -763,7 +903,7 @@
 		goto error;
 	}
 
-	dp->link = dp_link_get(dev, dp->aux);
+	dp->link = msm_dp_link_get(dev, dp->aux);
 	if (IS_ERR(dp->link)) {
 		rc = PTR_ERR(dp->link);
 		DRM_ERROR("failed to initialize link, rc = %d\n", rc);
@@ -775,7 +915,7 @@
 	panel_in.catalog = dp->catalog;
 	panel_in.link = dp->link;
 
-	dp->panel = dp_panel_get(&panel_in);
+	dp->panel = msm_dp_panel_get(&panel_in);
 	if (IS_ERR(dp->panel)) {
 		rc = PTR_ERR(dp->panel);
 		DRM_ERROR("failed to initialize panel, rc = %d\n", rc);
@@ -783,8 +923,9 @@
 		goto error_link;
 	}
 
-	dp->ctrl = dp_ctrl_get(dev, dp->link, dp->panel, dp->aux,
-			       dp->power, dp->catalog, dp->parser);
+	dp->ctrl = msm_dp_ctrl_get(dev, dp->link, dp->panel, dp->aux,
+			       dp->catalog,
+			       phy);
 	if (IS_ERR(dp->ctrl)) {
 		rc = PTR_ERR(dp->ctrl);
 		DRM_ERROR("failed to initialize ctrl, rc = %d\n", rc);
@@ -792,7 +933,7 @@
 		goto error_ctrl;
 	}
 
-	dp->audio = dp_audio_get(dp->dp_display.pdev, dp->panel, dp->catalog);
+	dp->audio = msm_dp_audio_get(dp->msm_dp_display.pdev, dp->panel, dp->catalog);
 	if (IS_ERR(dp->audio)) {
 		rc = PTR_ERR(dp->audio);
 		pr_err("failed to initialize audio, rc = %d\n", rc);
@@ -800,58 +941,107 @@
 		goto error_ctrl;
 	}
 
-	/* populate wide_bus_en to differernt layers */
-	dp->ctrl->wide_bus_en = dp->wide_bus_en;
-	dp->catalog->wide_bus_en = dp->wide_bus_en;
-
 	return rc;
 
 error_ctrl:
-	dp_panel_put(dp->panel);
+	msm_dp_panel_put(dp->panel);
 error_link:
-	dp_aux_put(dp->aux);
+	msm_dp_aux_put(dp->aux);
 error:
 	return rc;
 }
 
-static int dp_display_set_mode(struct msm_dp *dp_display,
-			       struct dp_display_mode *mode)
+static int msm_dp_display_set_mode(struct msm_dp *msm_dp_display,
+				   const struct drm_display_mode *adjusted_mode,
+				   struct msm_dp_panel *msm_dp_panel)
 {
-	struct dp_display_private *dp;
+	struct msm_dp_display_mode msm_dp_mode;
 
-	dp = container_of(dp_display, struct dp_display_private, dp_display);
+	memset(&msm_dp_mode, 0x0, sizeof(struct msm_dp_display_mode));
+
+	if (msm_dp_display_check_video_test(msm_dp_display))
+		msm_dp_mode.bpp = msm_dp_display_get_test_bpp(msm_dp_display);
+	else /* Default num_components per px = 3 */
+		msm_dp_mode.bpp = msm_dp_panel->connector->display_info.bpc * 3;
+
+	if (!msm_dp_mode.bpp)
+		msm_dp_mode.bpp = 24; /* Default bpp */
+
+	drm_mode_copy(&msm_dp_mode.drm_mode, adjusted_mode);
+
+	msm_dp_mode.v_active_low =
+		!!(msm_dp_mode.drm_mode.flags & DRM_MODE_FLAG_NVSYNC);
+
+	msm_dp_mode.h_active_low =
+		!!(msm_dp_mode.drm_mode.flags & DRM_MODE_FLAG_NHSYNC);
+
+	msm_dp_mode.out_fmt_is_yuv_420 =
+		drm_mode_is_420_only(&msm_dp_display->connector->display_info, adjusted_mode) &&
+		msm_dp_panel->vsc_sdp_supported;
+
+	drm_mode_copy(&msm_dp_panel->msm_dp_mode.drm_mode, &msm_dp_mode.drm_mode);
+	msm_dp_panel->msm_dp_mode.bpp = msm_dp_mode.bpp;
+	msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420 = msm_dp_mode.out_fmt_is_yuv_420;
+	msm_dp_panel->msm_dp_mode.v_active_low = msm_dp_mode.v_active_low;
+	msm_dp_panel->msm_dp_mode.h_active_low = msm_dp_mode.h_active_low;
+	msm_dp_panel_init_panel_info(msm_dp_panel);
 
-	drm_mode_copy(&dp->panel->dp_mode.drm_mode, &mode->drm_mode);
-	dp->panel->dp_mode.bpp = mode->bpp;
-	dp->panel->dp_mode.capabilities = mode->capabilities;
-	dp_panel_init_panel_info(dp->panel);
 	return 0;
 }
 
-static int dp_display_enable(struct dp_display_private *dp, bool force_link_train)
+static int msm_dp_display_prepare(struct msm_dp_display_private *dp)
 {
 	int rc = 0;
-	struct msm_dp *dp_display = &dp->dp_display;
+	struct msm_dp *msm_dp_display = &dp->msm_dp_display;
+	bool force_link_train = false;
+	u32 state;
 
 	drm_dbg_dp(dp->drm_dev, "sink_count=%d\n", dp->link->sink_count);
-	if (dp_display->power_on) {
+	if (msm_dp_display->prepared) {
 		drm_dbg_dp(dp->drm_dev, "Link already setup, return\n");
 		return 0;
 	}
 
-	rc = dp_ctrl_on_stream(dp->ctrl, force_link_train);
+	state = dp->hpd_state;
+	if (state != ST_DISPLAY_OFF && state != ST_MAINLINK_READY)
+		return -EINVAL;
+
+	rc = pm_runtime_resume_and_get(&msm_dp_display->pdev->dev);
+	if (rc) {
+		DRM_ERROR("failed to pm_runtime_resume\n");
+		return rc;
+	}
+
+	if (dp->hpd_state == ST_DISPLAY_OFF) {
+		msm_dp_display_host_phy_init(dp);
+		force_link_train = true;
+	}
+
+	rc = msm_dp_ctrl_prepare_stream_on(dp->ctrl, force_link_train);
 	if (!rc)
-		dp_display->power_on = true;
+		msm_dp_display->prepared = true;
+
+	return rc;
+}
+
+static int msm_dp_display_enable(struct msm_dp_display_private *dp,
+				 struct msm_dp_panel *msm_dp_panel)
+{
+	int rc = 0;
+
+	drm_dbg_dp(dp->drm_dev, "sink_count=%d\n", dp->link->sink_count);
+
+	rc = msm_dp_ctrl_on_stream(dp->ctrl, msm_dp_panel, dp->max_stream);
 
 	return rc;
 }
 
-static int dp_display_post_enable(struct msm_dp *dp_display)
+static int msm_dp_display_post_enable(struct msm_dp *msm_dp_display)
 {
-	struct dp_display_private *dp;
+	struct msm_dp_display_private *dp;
 	u32 rate;
 
-	dp = container_of(dp_display, struct dp_display_private, dp_display);
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
 
 	rate = dp->link->link_params.rate;
 
@@ -861,86 +1051,112 @@
 	}
 
 	/* signal the connect event late to synchronize video and display */
-	dp_display_handle_plugged_change(dp_display, true);
+	msm_dp_display_handle_plugged_change(msm_dp_display, true);
 
-	if (dp_display->psr_supported)
-		dp_ctrl_config_psr(dp->ctrl);
+	if (msm_dp_display->psr_supported)
+		msm_dp_ctrl_config_psr(dp->ctrl);
 
 	return 0;
 }
 
-static int dp_display_disable(struct dp_display_private *dp)
+static void msm_dp_display_audio_notify_disable(struct msm_dp_display_private *dp)
 {
-	struct msm_dp *dp_display = &dp->dp_display;
-
-	if (!dp_display->power_on)
-		return 0;
+	struct msm_dp *msm_dp_display = &dp->msm_dp_display;
 
 	/* wait only if audio was enabled */
-	if (dp_display->audio_enabled) {
+	if (msm_dp_display->audio_enabled) {
 		/* signal the disconnect event */
-		dp_display_handle_plugged_change(dp_display, false);
+		msm_dp_display_handle_plugged_change(msm_dp_display, false);
 		if (!wait_for_completion_timeout(&dp->audio_comp,
 				HZ * 5))
 			DRM_ERROR("audio comp timeout\n");
 	}
 
-	dp_display->audio_enabled = false;
+	msm_dp_display->audio_enabled = false;
+}
 
-	if (dp->link->sink_count == 0) {
-		/*
-		 * irq_hpd with sink_count = 0
-		 * hdmi unplugged out of dongle
-		 */
-		dp_ctrl_off_link_stream(dp->ctrl);
-	} else {
-		/*
-		 * unplugged interrupt
-		 * dongle unplugged out of DUT
-		 */
-		dp_ctrl_off(dp->ctrl);
-		dp_display_host_phy_exit(dp);
-	}
+static int msm_dp_display_disable(struct msm_dp_display_private *dp,
+				  struct msm_dp_panel *msm_dp_panel)
+{
+	if (!dp->active_stream_cnt)
+		return 0;
+
+	msm_dp_ctrl_clear_vsc_sdp_pkt(dp->ctrl, msm_dp_panel);
 
-	dp_display->power_on = false;
+	msm_dp_ctrl_stream_clk_off(dp->ctrl, msm_dp_panel);
+
+	dp->active_stream_cnt--;
 
 	drm_dbg_dp(dp->drm_dev, "sink count: %d\n", dp->link->sink_count);
 	return 0;
 }
 
-int dp_display_set_plugged_cb(struct msm_dp *dp_display,
+int msm_dp_display_set_plugged_cb(struct msm_dp *msm_dp_display,
 		hdmi_codec_plugged_cb fn, struct device *codec_dev)
 {
 	bool plugged;
 
-	dp_display->plugged_cb = fn;
-	dp_display->codec_dev = codec_dev;
-	plugged = dp_display->link_ready;
-	dp_display_handle_plugged_change(dp_display, plugged);
+	msm_dp_display->plugged_cb = fn;
+	msm_dp_display->codec_dev = codec_dev;
+	plugged = msm_dp_display->link_ready;
+	msm_dp_display_handle_plugged_change(msm_dp_display, plugged);
+
+	return 0;
+}
+
+int msm_dp_display_set_stream_info(struct msm_dp *dp,
+				   struct msm_dp_panel *panel, u32 strm_id, u32 start_slot,
+				   u32 num_slots, u32 pbn, int vcpi)
+{
+	struct msm_dp_display_private *msm_dp_display;
+	const int max_slots = 64;
+
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	if (!msm_dp_display) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	if (strm_id >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid stream id:%d\n", strm_id);
+		return -EINVAL;
+	}
+
+	if (start_slot + num_slots > max_slots) {
+		DRM_ERROR("invalid channel info received. start:%d, slots:%d\n",
+			  start_slot, num_slots);
+		return -EINVAL;
+	}
+
+	msm_dp_ctrl_set_mst_channel_info(msm_dp_display->ctrl, strm_id, start_slot, num_slots);
+
+	if (panel) {
+		panel->stream_id = strm_id;
+		panel->mst_caps.pbn = pbn;
+	}
 
 	return 0;
 }
 
 /**
- * dp_bridge_mode_valid - callback to determine if specified mode is valid
- * @bridge: Pointer to drm bridge structure
+ * msm_dp_bridge_mode_valid - callback to determine if specified mode is valid
+ * @dp: Pointer to dp display structure
  * @info: display info
  * @mode: Pointer to drm mode structure
  * Returns: Validity status for specified mode
  */
-enum drm_mode_status dp_bridge_mode_valid(struct drm_bridge *bridge,
-					  const struct drm_display_info *info,
-					  const struct drm_display_mode *mode)
+enum drm_mode_status msm_dp_display_mode_valid(struct msm_dp *dp,
+					       const struct drm_display_info *info,
+					       const struct drm_display_mode *mode)
 {
 	const u32 num_components = 3, default_bpp = 24;
-	struct dp_display_private *dp_display;
-	struct dp_link_info *link_info;
+	struct msm_dp_display_private *msm_dp_display;
+	struct msm_dp_link_info *link_info;
 	u32 mode_rate_khz = 0, supported_rate_khz = 0, mode_bpp = 0;
-	struct msm_dp *dp;
 	int mode_pclk_khz = mode->clock;
 
-	dp = to_dp_bridge(bridge)->dp_display;
-
 	if (!dp || !mode_pclk_khz || !dp->connector) {
 		DRM_ERROR("invalid params\n");
 		return -EINVAL;
@@ -949,14 +1165,18 @@
 	if (mode->clock > DP_MAX_PIXEL_CLK_KHZ)
 		return MODE_CLOCK_HIGH;
 
-	dp_display = container_of(dp, struct dp_display_private, dp_display);
-	link_info = &dp_display->panel->link_info;
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+	link_info = &msm_dp_display->panel->link_info;
+
+	if (drm_mode_is_420_only(&dp->connector->display_info, mode) &&
+	    msm_dp_display->panel->vsc_sdp_supported)
+		mode_pclk_khz /= 2;
 
 	mode_bpp = dp->connector->display_info.bpc * num_components;
 	if (!mode_bpp)
 		mode_bpp = default_bpp;
 
-	mode_bpp = dp_panel_get_mode_bpp(dp_display->panel,
+	mode_bpp = msm_dp_panel_get_mode_bpp(msm_dp_display->panel,
 			mode_bpp, mode_pclk_khz);
 
 	mode_rate_khz = mode_pclk_khz * mode_bpp;
@@ -968,50 +1188,50 @@
 	return MODE_OK;
 }
 
-int dp_display_get_modes(struct msm_dp *dp)
+int msm_dp_display_get_modes(struct msm_dp *dp)
 {
-	struct dp_display_private *dp_display;
+	struct msm_dp_display_private *msm_dp_display;
 
 	if (!dp) {
 		DRM_ERROR("invalid params\n");
 		return 0;
 	}
 
-	dp_display = container_of(dp, struct dp_display_private, dp_display);
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
 
-	return dp_panel_get_modes(dp_display->panel,
+	return msm_dp_panel_get_modes(msm_dp_display->panel,
 		dp->connector);
 }
 
-bool dp_display_check_video_test(struct msm_dp *dp)
+bool msm_dp_display_check_video_test(struct msm_dp *dp)
 {
-	struct dp_display_private *dp_display;
+	struct msm_dp_display_private *msm_dp_display;
 
-	dp_display = container_of(dp, struct dp_display_private, dp_display);
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
 
-	return dp_display->panel->video_test;
+	return msm_dp_display->panel->video_test;
 }
 
-int dp_display_get_test_bpp(struct msm_dp *dp)
+int msm_dp_display_get_test_bpp(struct msm_dp *dp)
 {
-	struct dp_display_private *dp_display;
+	struct msm_dp_display_private *msm_dp_display;
 
 	if (!dp) {
 		DRM_ERROR("invalid params\n");
 		return 0;
 	}
 
-	dp_display = container_of(dp, struct dp_display_private, dp_display);
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
 
-	return dp_link_bit_depth_to_bpp(
-		dp_display->link->test_video.test_bit_depth);
+	return msm_dp_link_bit_depth_to_bpp(
+		msm_dp_display->link->test_video.test_bit_depth);
 }
 
 void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp)
 {
-	struct dp_display_private *dp_display;
+	struct msm_dp_display_private *msm_dp_display;
 
-	dp_display = container_of(dp, struct dp_display_private, dp_display);
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
 
 	/*
 	 * if we are reading registers we need the link clocks to be on
@@ -1020,65 +1240,65 @@
 	 * power_on status before dumping DP registers to avoid crash due
 	 * to unclocked access
 	 */
-	mutex_lock(&dp_display->event_mutex);
+	mutex_lock(&msm_dp_display->event_mutex);
 
-	if (!dp->power_on) {
-		mutex_unlock(&dp_display->event_mutex);
+	if (!msm_dp_display->active_stream_cnt) {
+		mutex_unlock(&msm_dp_display->event_mutex);
 		return;
 	}
 
-	dp_catalog_snapshot(dp_display->catalog, disp_state);
+	msm_dp_catalog_snapshot(msm_dp_display->catalog, disp_state);
 
-	mutex_unlock(&dp_display->event_mutex);
+	mutex_unlock(&msm_dp_display->event_mutex);
 }
 
-void dp_display_set_psr(struct msm_dp *dp_display, bool enter)
+void msm_dp_display_set_psr(struct msm_dp *msm_dp_display, bool enter)
 {
-	struct dp_display_private *dp;
+	struct msm_dp_display_private *dp;
 
-	if (!dp_display) {
+	if (!msm_dp_display) {
 		DRM_ERROR("invalid params\n");
 		return;
 	}
 
-	dp = container_of(dp_display, struct dp_display_private, dp_display);
-	dp_ctrl_set_psr(dp->ctrl, enter);
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+	msm_dp_ctrl_set_psr(dp->ctrl, enter);
 }
 
 static int hpd_event_thread(void *data)
 {
-	struct dp_display_private *dp_priv;
+	struct msm_dp_display_private *msm_dp_priv;
 	unsigned long flag;
-	struct dp_event *todo;
+	struct msm_dp_event *todo;
 	int timeout_mode = 0;
 
-	dp_priv = (struct dp_display_private *)data;
+	msm_dp_priv = (struct msm_dp_display_private *)data;
 
 	while (1) {
 		if (timeout_mode) {
-			wait_event_timeout(dp_priv->event_q,
-				(dp_priv->event_pndx == dp_priv->event_gndx) ||
+			wait_event_timeout(msm_dp_priv->event_q,
+				(msm_dp_priv->event_pndx == msm_dp_priv->event_gndx) ||
 					kthread_should_stop(), EVENT_TIMEOUT);
 		} else {
-			wait_event_interruptible(dp_priv->event_q,
-				(dp_priv->event_pndx != dp_priv->event_gndx) ||
+			wait_event_interruptible(msm_dp_priv->event_q,
+				(msm_dp_priv->event_pndx != msm_dp_priv->event_gndx) ||
 					kthread_should_stop());
 		}
 
 		if (kthread_should_stop())
 			break;
 
-		spin_lock_irqsave(&dp_priv->event_lock, flag);
-		todo = &dp_priv->event_list[dp_priv->event_gndx];
+		spin_lock_irqsave(&msm_dp_priv->event_lock, flag);
+		todo = &msm_dp_priv->event_list[msm_dp_priv->event_gndx];
 		if (todo->delay) {
-			struct dp_event *todo_next;
+			struct msm_dp_event *todo_next;
 
-			dp_priv->event_gndx++;
-			dp_priv->event_gndx %= DP_EVENT_Q_MAX;
+			msm_dp_priv->event_gndx++;
+			msm_dp_priv->event_gndx %= DP_EVENT_Q_MAX;
 
 			/* re enter delay event into q */
-			todo_next = &dp_priv->event_list[dp_priv->event_pndx++];
-			dp_priv->event_pndx %= DP_EVENT_Q_MAX;
+			todo_next = &msm_dp_priv->event_list[msm_dp_priv->event_pndx++];
+			msm_dp_priv->event_pndx %= DP_EVENT_Q_MAX;
 			todo_next->event_id = todo->event_id;
 			todo_next->data = todo->data;
 			todo_next->delay = todo->delay - 1;
@@ -1089,33 +1309,33 @@
 
 			/* switch to timeout mode */
 			timeout_mode = 1;
-			spin_unlock_irqrestore(&dp_priv->event_lock, flag);
+			spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
 			continue;
 		}
 
 		/* timeout with no events in q */
-		if (dp_priv->event_pndx == dp_priv->event_gndx) {
-			spin_unlock_irqrestore(&dp_priv->event_lock, flag);
+		if (msm_dp_priv->event_pndx == msm_dp_priv->event_gndx) {
+			spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
 			continue;
 		}
 
-		dp_priv->event_gndx++;
-		dp_priv->event_gndx %= DP_EVENT_Q_MAX;
+		msm_dp_priv->event_gndx++;
+		msm_dp_priv->event_gndx %= DP_EVENT_Q_MAX;
 		timeout_mode = 0;
-		spin_unlock_irqrestore(&dp_priv->event_lock, flag);
+		spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
 
 		switch (todo->event_id) {
 		case EV_HPD_PLUG_INT:
-			dp_hpd_plug_handle(dp_priv, todo->data);
+			msm_dp_hpd_plug_handle(msm_dp_priv, todo->data);
 			break;
 		case EV_HPD_UNPLUG_INT:
-			dp_hpd_unplug_handle(dp_priv, todo->data);
+			msm_dp_hpd_unplug_handle(msm_dp_priv, todo->data);
 			break;
 		case EV_IRQ_HPD_INT:
-			dp_irq_hpd_handle(dp_priv, todo->data);
+			msm_dp_irq_hpd_handle(msm_dp_priv, todo->data);
 			break;
 		case EV_USER_NOTIFICATION:
-			dp_display_send_hpd_notification(dp_priv,
+			msm_dp_display_send_hpd_notification(msm_dp_priv,
 						todo->data);
 			break;
 		default:
@@ -1126,22 +1346,22 @@
 	return 0;
 }
 
-static int dp_hpd_event_thread_start(struct dp_display_private *dp_priv)
+static int msm_dp_hpd_event_thread_start(struct msm_dp_display_private *msm_dp_priv)
 {
 	/* set event q to empty */
-	dp_priv->event_gndx = 0;
-	dp_priv->event_pndx = 0;
+	msm_dp_priv->event_gndx = 0;
+	msm_dp_priv->event_pndx = 0;
 
-	dp_priv->ev_tsk = kthread_run(hpd_event_thread, dp_priv, "dp_hpd_handler");
-	if (IS_ERR(dp_priv->ev_tsk))
-		return PTR_ERR(dp_priv->ev_tsk);
+	msm_dp_priv->ev_tsk = kthread_run(hpd_event_thread, msm_dp_priv, "dp_hpd_handler");
+	if (IS_ERR(msm_dp_priv->ev_tsk))
+		return PTR_ERR(msm_dp_priv->ev_tsk);
 
 	return 0;
 }
 
-static irqreturn_t dp_display_irq_handler(int irq, void *dev_id)
+static irqreturn_t msm_dp_display_irq_handler(int irq, void *dev_id)
 {
-	struct dp_display_private *dp = dev_id;
+	struct msm_dp_display_private *dp = dev_id;
 	irqreturn_t ret = IRQ_NONE;
 	u32 hpd_isr_status;
 
@@ -1150,43 +1370,43 @@
 		return IRQ_NONE;
 	}
 
-	hpd_isr_status = dp_catalog_hpd_get_intr_status(dp->catalog);
+	hpd_isr_status = msm_dp_catalog_hpd_get_intr_status(dp->catalog);
 
 	if (hpd_isr_status & 0x0F) {
 		drm_dbg_dp(dp->drm_dev, "type=%d isr=0x%x\n",
-			dp->dp_display.connector_type, hpd_isr_status);
+			dp->msm_dp_display.connector_type, hpd_isr_status);
 		/* hpd related interrupts */
 		if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK)
-			dp_add_event(dp, EV_HPD_PLUG_INT, 0, 0);
+			msm_dp_add_event(dp, EV_HPD_PLUG_INT, 0, 0);
 
 		if (hpd_isr_status & DP_DP_IRQ_HPD_INT_MASK) {
-			dp_add_event(dp, EV_IRQ_HPD_INT, 0, 0);
+			msm_dp_add_event(dp, EV_IRQ_HPD_INT, 0, 0);
 		}
 
 		if (hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK) {
-			dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
-			dp_add_event(dp, EV_HPD_PLUG_INT, 0, 3);
+			msm_dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
+			msm_dp_add_event(dp, EV_HPD_PLUG_INT, 0, 3);
 		}
 
 		if (hpd_isr_status & DP_DP_HPD_UNPLUG_INT_MASK)
-			dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
+			msm_dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
 
 		ret = IRQ_HANDLED;
 	}
 
 	/* DP controller isr */
-	ret |= dp_ctrl_isr(dp->ctrl);
+	ret |= msm_dp_ctrl_isr(dp->ctrl);
 
 	/* DP aux isr */
-	ret |= dp_aux_isr(dp->aux);
+	ret |= msm_dp_aux_isr(dp->aux);
 
 	return ret;
 }
 
-static int dp_display_request_irq(struct dp_display_private *dp)
+static int msm_dp_display_request_irq(struct msm_dp_display_private *dp)
 {
 	int rc = 0;
-	struct platform_device *pdev = dp->dp_display.pdev;
+	struct platform_device *pdev = dp->msm_dp_display.pdev;
 
 	dp->irq = platform_get_irq(pdev, 0);
 	if (dp->irq < 0) {
@@ -1194,7 +1414,7 @@
 		return dp->irq;
 	}
 
-	rc = devm_request_irq(&pdev->dev, dp->irq, dp_display_irq_handler,
+	rc = devm_request_irq(&pdev->dev, dp->irq, msm_dp_display_irq_handler,
 			      IRQF_TRIGGER_HIGH|IRQF_NO_AUTOEN,
 			      "dp_display_isr", dp);
 
@@ -1207,7 +1427,7 @@
 	return 0;
 }
 
-static const struct msm_dp_desc *dp_display_get_desc(struct platform_device *pdev)
+static const struct msm_dp_desc *msm_dp_display_get_desc(struct platform_device *pdev)
 {
 	const struct msm_dp_desc *descs = of_device_get_match_data(&pdev->dev);
 	struct resource *res;
@@ -1226,33 +1446,75 @@
 	return NULL;
 }
 
-static int dp_display_get_next_bridge(struct msm_dp *dp);
-
-static int dp_display_probe_tail(struct device *dev)
+static int msm_dp_display_probe_tail(struct device *dev)
 {
 	struct msm_dp *dp = dev_get_drvdata(dev);
 	int ret;
 
-	ret = dp_display_get_next_bridge(dp);
-	if (ret)
-		return ret;
+	/*
+	 * External bridges are mandatory for eDP interfaces: one has to
+	 * provide at least an eDP panel (which gets wrapped into panel-bridge).
+	 *
+	 * For DisplayPort interfaces external bridges are optional, so
+	 * silently ignore an error if one is not present (-ENODEV).
+	 */
+	dp->next_bridge = devm_drm_of_get_bridge(&dp->pdev->dev, dp->pdev->dev.of_node, 1, 0);
+	if (IS_ERR(dp->next_bridge)) {
+		ret = PTR_ERR(dp->next_bridge);
+		dp->next_bridge = NULL;
+		if (dp->is_edp || ret != -ENODEV)
+			return ret;
+	}
 
-	ret = component_add(dev, &dp_display_comp_ops);
+	ret = component_add(dev, &msm_dp_display_comp_ops);
 	if (ret)
 		DRM_ERROR("component add failed, rc=%d\n", ret);
 
 	return ret;
 }
 
-static int dp_auxbus_done_probe(struct drm_dp_aux *aux)
+static int msm_dp_auxbus_done_probe(struct drm_dp_aux *aux)
 {
-	return dp_display_probe_tail(aux->dev);
+	return msm_dp_display_probe_tail(aux->dev);
 }
 
-static int dp_display_probe(struct platform_device *pdev)
+static int msm_dp_display_get_connector_type(struct platform_device *pdev,
+					 const struct msm_dp_desc *desc)
+{
+	struct device_node *node = pdev->dev.of_node;
+	struct device_node *aux_bus = of_get_child_by_name(node, "aux-bus");
+	struct device_node *panel = of_get_child_by_name(aux_bus, "panel");
+	int connector_type;
+
+	if (panel)
+		connector_type = DRM_MODE_CONNECTOR_eDP;
+	else
+		connector_type = DRM_MODE_SUBCONNECTOR_DisplayPort;
+
+	of_node_put(panel);
+	of_node_put(aux_bus);
+
+	return connector_type;
+}
+
+int msm_dp_get_mst_max_stream(const struct msm_dp *dp_display)
+{
+	struct msm_dp_display_private *dp_priv;
+
+	dp_priv = container_of(dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	return dp_priv->max_stream;
+}
+
+int msm_dp_mst_bridge_init(struct msm_dp *dp_display, struct drm_encoder *encoder)
+{
+	return msm_dp_mst_drm_bridge_init(dp_display, encoder);
+}
+
+static int msm_dp_display_probe(struct platform_device *pdev)
 {
 	int rc = 0;
-	struct dp_display_private *dp;
+	struct msm_dp_display_private *dp;
 	const struct msm_dp_desc *desc;
 
 	if (!pdev || !pdev->dev.of_node) {
@@ -1264,34 +1526,26 @@
 	if (!dp)
 		return -ENOMEM;
 
-	desc = dp_display_get_desc(pdev);
+	desc = msm_dp_display_get_desc(pdev);
 	if (!desc)
 		return -EINVAL;
 
-	dp->dp_display.pdev = pdev;
-	dp->name = "drm_dp";
+	dp->msm_dp_display.pdev = pdev;
 	dp->id = desc->id;
-	dp->dp_display.connector_type = desc->connector_type;
-	dp->wide_bus_en = desc->wide_bus_en;
-	dp->dp_display.is_edp =
-		(dp->dp_display.connector_type == DRM_MODE_CONNECTOR_eDP);
+	dp->msm_dp_display.connector_type = msm_dp_display_get_connector_type(pdev, desc);
+	dp->wide_bus_supported = desc->wide_bus_supported;
+	dp->msm_dp_display.is_edp =
+		(dp->msm_dp_display.connector_type == DRM_MODE_CONNECTOR_eDP);
 
-	rc = dp_init_sub_modules(dp);
-	if (rc) {
-		DRM_ERROR("init sub module failed\n");
-		return -EPROBE_DEFER;
-	}
+	dp->max_stream = (desc->max_streams > DEFAULT_STREAM_COUNT) ?
+			  desc->max_streams : DEFAULT_STREAM_COUNT;
 
-	rc = dp->parser->parse(dp->parser);
-	if (rc) {
-		DRM_ERROR("device tree parsing failed\n");
-		goto err;
-	}
+	dp->intf_map = desc->intf_map;
 
-	rc = dp_power_client_init(dp->power);
+	rc = msm_dp_init_sub_modules(dp);
 	if (rc) {
-		DRM_ERROR("Power client create failed\n");
-		goto err;
+		DRM_ERROR("init sub module failed\n");
+		return -EPROBE_DEFER;
 	}
 
 	/* setup event q */
@@ -1300,28 +1554,28 @@
 	spin_lock_init(&dp->event_lock);
 
 	/* Store DP audio handle inside DP display */
-	dp->dp_display.dp_audio = dp->audio;
+	dp->msm_dp_display.msm_dp_audio = dp->audio;
 
 	init_completion(&dp->audio_comp);
 
-	platform_set_drvdata(pdev, &dp->dp_display);
+	platform_set_drvdata(pdev, &dp->msm_dp_display);
 
 	rc = devm_pm_runtime_enable(&pdev->dev);
 	if (rc)
 		goto err;
 
-	rc = dp_display_request_irq(dp);
+	rc = msm_dp_display_request_irq(dp);
 	if (rc)
 		goto err;
 
-	if (dp->dp_display.is_edp) {
-		rc = devm_of_dp_aux_populate_bus(dp->aux, dp_auxbus_done_probe);
+	if (dp->msm_dp_display.is_edp) {
+		rc = devm_of_dp_aux_populate_bus(dp->aux, msm_dp_auxbus_done_probe);
 		if (rc) {
 			DRM_ERROR("eDP auxbus population failed, rc=%d\n", rc);
 			goto err;
 		}
 	} else {
-		rc = dp_display_probe_tail(&pdev->dev);
+		rc = msm_dp_display_probe_tail(&pdev->dev);
 		if (rc)
 			goto err;
 	}
@@ -1329,70 +1583,70 @@
 	return rc;
 
 err:
-	dp_display_deinit_sub_modules(dp);
+	msm_dp_display_deinit_sub_modules(dp);
 	return rc;
 }
 
-static void dp_display_remove(struct platform_device *pdev)
+static void msm_dp_display_remove(struct platform_device *pdev)
 {
-	struct dp_display_private *dp = dev_get_dp_display_private(&pdev->dev);
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(&pdev->dev);
 
-	component_del(&pdev->dev, &dp_display_comp_ops);
-	dp_display_deinit_sub_modules(dp);
+	component_del(&pdev->dev, &msm_dp_display_comp_ops);
+	msm_dp_display_deinit_sub_modules(dp);
 	platform_set_drvdata(pdev, NULL);
 }
 
-static int dp_pm_runtime_suspend(struct device *dev)
+static int msm_dp_pm_runtime_suspend(struct device *dev)
 {
-	struct dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
 
 	disable_irq(dp->irq);
 
-	if (dp->dp_display.is_edp) {
-		dp_display_host_phy_exit(dp);
-		dp_catalog_ctrl_hpd_disable(dp->catalog);
+	if (dp->msm_dp_display.is_edp) {
+		msm_dp_display_host_phy_exit(dp);
+		msm_dp_catalog_ctrl_hpd_disable(dp->catalog);
 	}
-	dp_display_host_deinit(dp);
+	msm_dp_display_host_deinit(dp);
 
 	return 0;
 }
 
-static int dp_pm_runtime_resume(struct device *dev)
+static int msm_dp_pm_runtime_resume(struct device *dev)
 {
-	struct dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
 
 	/*
 	 * for eDP, host cotroller, HPD block and PHY are enabled here
 	 * but with HPD irq disabled
 	 *
 	 * for DP, only host controller is enabled here.
-	 * HPD block is enabled at dp_bridge_hpd_enable()
+	 * HPD block is enabled at msm_dp_bridge_hpd_enable()
 	 * PHY will be enabled at plugin handler later
 	 */
-	dp_display_host_init(dp);
-	if (dp->dp_display.is_edp) {
-		dp_catalog_ctrl_hpd_enable(dp->catalog);
-		dp_display_host_phy_init(dp);
+	msm_dp_display_host_init(dp);
+	if (dp->msm_dp_display.is_edp) {
+		msm_dp_catalog_ctrl_hpd_enable(dp->catalog);
+		msm_dp_display_host_phy_init(dp);
 	}
 
 	enable_irq(dp->irq);
 	return 0;
 }
 
-static const struct dev_pm_ops dp_pm_ops = {
-	SET_RUNTIME_PM_OPS(dp_pm_runtime_suspend, dp_pm_runtime_resume, NULL)
+static const struct dev_pm_ops msm_dp_pm_ops = {
+	SET_RUNTIME_PM_OPS(msm_dp_pm_runtime_suspend, msm_dp_pm_runtime_resume, NULL)
 	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
 				pm_runtime_force_resume)
 };
 
-static struct platform_driver dp_display_driver = {
-	.probe  = dp_display_probe,
-	.remove_new = dp_display_remove,
+static struct platform_driver msm_dp_display_driver = {
+	.probe  = msm_dp_display_probe,
+	.remove_new = msm_dp_display_remove,
 	.driver = {
 		.name = "msm-dp-display",
-		.of_match_table = dp_dt_match,
+		.of_match_table = msm_dp_dt_match,
 		.suppress_bind_attrs = true,
-		.pm = &dp_pm_ops,
+		.pm = &msm_dp_pm_ops,
 	},
 };
 
@@ -1400,7 +1654,7 @@
 {
 	int ret;
 
-	ret = platform_driver_register(&dp_display_driver);
+	ret = platform_driver_register(&msm_dp_display_driver);
 	if (ret)
 		DRM_ERROR("Dp display driver register failed");
 
@@ -1409,290 +1663,360 @@
 
 void __exit msm_dp_unregister(void)
 {
-	platform_driver_unregister(&dp_display_driver);
+	platform_driver_unregister(&msm_dp_display_driver);
 }
 
-bool msm_dp_wide_bus_available(const struct msm_dp *dp_display)
+bool msm_dp_is_yuv_420_enabled(const struct msm_dp *msm_dp_display,
+			       const struct drm_display_mode *mode)
 {
-	struct dp_display_private *dp;
+	struct msm_dp_display_private *dp;
+	const struct drm_display_info *info;
 
-	dp = container_of(dp_display, struct dp_display_private, dp_display);
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+	info = &msm_dp_display->connector->display_info;
 
-	return dp->wide_bus_en;
+	return dp->panel->vsc_sdp_supported && drm_mode_is_420_only(info, mode);
 }
 
-void dp_display_debugfs_init(struct msm_dp *dp_display, struct dentry *root, bool is_edp)
+bool msm_dp_needs_periph_flush(const struct msm_dp *msm_dp_display,
+			       const struct drm_display_mode *mode)
 {
-	struct dp_display_private *dp;
-	struct device *dev;
-	int rc;
+	return msm_dp_is_yuv_420_enabled(msm_dp_display, mode);
+}
 
-	dp = container_of(dp_display, struct dp_display_private, dp_display);
-	dev = &dp->dp_display.pdev->dev;
+bool msm_dp_wide_bus_available(const struct msm_dp *msm_dp_display)
+{
+	struct msm_dp_display_private *dp;
 
-	dp->debug = dp_debug_get(dev, dp->panel,
-					dp->link, dp->dp_display.connector,
-					root, is_edp);
-	if (IS_ERR(dp->debug)) {
-		rc = PTR_ERR(dp->debug);
-		DRM_ERROR("failed to initialize debug, rc = %d\n", rc);
-		dp->debug = NULL;
-	}
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	if (dp->panel->msm_dp_mode.out_fmt_is_yuv_420)
+		return false;
+
+	return dp->wide_bus_supported;
 }
 
-static int dp_display_get_next_bridge(struct msm_dp *dp)
+int msm_dp_get_mst_intf_id(struct msm_dp *dp_display, int stream_id)
 {
-	int rc;
-	struct dp_display_private *dp_priv;
+	struct msm_dp_display_private *dp;
 
-	dp_priv = container_of(dp, struct dp_display_private, dp_display);
+	dp = container_of(dp_display, struct msm_dp_display_private, msm_dp_display);
 
-	/*
-	 * External bridges are mandatory for eDP interfaces: one has to
-	 * provide at least an eDP panel (which gets wrapped into panel-bridge).
-	 *
-	 * For DisplayPort interfaces external bridges are optional, so
-	 * silently ignore an error if one is not present (-ENODEV).
-	 */
-	rc = devm_dp_parser_find_next_bridge(&dp->pdev->dev, dp_priv->parser);
-	if (!dp->is_edp && rc == -ENODEV)
-		return 0;
+	if (dp->intf_map)
+		return dp->intf_map[stream_id];
 
-	if (!rc)
-		dp->next_bridge = dp_priv->parser->next_bridge;
+	return 0;
+}
 
-	return rc;
+void msm_dp_display_debugfs_init(struct msm_dp *msm_dp_display, struct dentry *root, bool is_edp)
+{
+	struct msm_dp_display_private *dp;
+	struct device *dev;
+	int rc;
+
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+	dev = &dp->msm_dp_display.pdev->dev;
+
+	rc = msm_dp_debug_init(dev, dp->panel, dp->link, dp->msm_dp_display.connector, root, is_edp);
+	if (rc)
+		DRM_ERROR("failed to initialize debug, rc = %d\n", rc);
 }
 
-int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev,
-			struct drm_encoder *encoder)
+int msm_dp_modeset_init(struct msm_dp *msm_dp_display, struct drm_device *dev,
+			struct drm_encoder *encoder, bool yuv_supported)
 {
-	struct dp_display_private *dp_priv;
+	struct msm_dp_display_private *msm_dp_priv;
 	int ret;
 
-	dp_display->drm_dev = dev;
+	msm_dp_display->drm_dev = dev;
 
-	dp_priv = container_of(dp_display, struct dp_display_private, dp_display);
+	msm_dp_priv = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
 
-	ret = dp_bridge_init(dp_display, dev, encoder);
+	ret = msm_dp_bridge_init(msm_dp_display, dev, encoder, yuv_supported);
 	if (ret) {
 		DRM_DEV_ERROR(dev->dev,
 			"failed to create dp bridge: %d\n", ret);
 		return ret;
 	}
 
-	dp_display->connector = dp_drm_connector_init(dp_display, encoder);
-	if (IS_ERR(dp_display->connector)) {
-		ret = PTR_ERR(dp_display->connector);
+	msm_dp_display->connector = msm_dp_drm_connector_init(msm_dp_display, encoder);
+	if (IS_ERR(msm_dp_display->connector)) {
+		ret = PTR_ERR(msm_dp_display->connector);
 		DRM_DEV_ERROR(dev->dev,
 			"failed to create dp connector: %d\n", ret);
-		dp_display->connector = NULL;
+		msm_dp_display->connector = NULL;
 		return ret;
 	}
 
-	dp_priv->panel->connector = dp_display->connector;
+	msm_dp_priv->panel->connector = msm_dp_display->connector;
 
 	return 0;
 }
 
-void dp_bridge_atomic_enable(struct drm_bridge *drm_bridge,
-			     struct drm_bridge_state *old_bridge_state)
+int msm_dp_mst_register(struct msm_dp *dp)
 {
-	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
-	struct msm_dp *dp = dp_bridge->dp_display;
-	int rc = 0;
-	struct dp_display_private *dp_display;
-	u32 state;
-	bool force_link_train = false;
+	struct msm_dp_display_private *dp_display;
 
-	dp_display = container_of(dp, struct dp_display_private, dp_display);
-	if (!dp_display->dp_mode.drm_mode.clock) {
-		DRM_ERROR("invalid params\n");
-		return;
-	}
+	dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
 
-	if (dp->is_edp)
-		dp_hpd_plug_handle(dp_display, 0);
+	return msm_dp_mst_init(dp, dp_display->max_stream,
+			   MAX_DPCD_TRANSACTION_BYTES, dp_display->aux);
+}
 
-	mutex_lock(&dp_display->event_mutex);
-	if (pm_runtime_resume_and_get(&dp->pdev->dev)) {
-		DRM_ERROR("failed to pm_runtime_resume\n");
-		mutex_unlock(&dp_display->event_mutex);
-		return;
-	}
+void msm_dp_display_atomic_prepare(struct msm_dp *dp)
+{
+	int rc = 0;
+	struct msm_dp_display_private *msm_dp_display;
 
-	state = dp_display->hpd_state;
-	if (state != ST_DISPLAY_OFF && state != ST_MAINLINK_READY) {
-		mutex_unlock(&dp_display->event_mutex);
-		return;
-	}
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	mutex_lock(&msm_dp_display->event_mutex);
 
-	rc = dp_display_set_mode(dp, &dp_display->dp_mode);
+	rc = msm_dp_display_prepare(msm_dp_display);
 	if (rc) {
-		DRM_ERROR("Failed to perform a mode set, rc=%d\n", rc);
-		mutex_unlock(&dp_display->event_mutex);
-		return;
+		DRM_ERROR("DP display prepare failed, rc=%d\n", rc);
 	}
 
-	state =  dp_display->hpd_state;
+	mutex_unlock(&msm_dp_display->event_mutex);
+}
 
-	if (state == ST_DISPLAY_OFF) {
-		dp_display_host_phy_init(dp_display);
-		force_link_train = true;
-	}
+void msm_dp_display_enable_helper(struct msm_dp *dp, struct msm_dp_panel *msm_dp_panel)
+{
+	int rc = 0;
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	if (dp->is_edp)
+		msm_dp_hpd_plug_handle(msm_dp_display, 0);
 
-	dp_display_enable(dp_display, force_link_train);
+	mutex_lock(&msm_dp_display->event_mutex);
 
-	rc = dp_display_post_enable(dp);
+	rc = msm_dp_display_enable(msm_dp_display, msm_dp_panel);
+	if (rc)
+		DRM_ERROR("DP display enable failed, rc=%d\n", rc);
+
+	rc = msm_dp_display_post_enable(dp);
 	if (rc) {
 		DRM_ERROR("DP display post enable failed, rc=%d\n", rc);
-		dp_display_disable(dp_display);
+		msm_dp_display_disable(msm_dp_display, msm_dp_panel);
 	}
 
+	msm_dp_display->active_stream_cnt++;
+
 	/* completed connection */
-	dp_display->hpd_state = ST_CONNECTED;
+	msm_dp_display->hpd_state = ST_CONNECTED;
 
 	drm_dbg_dp(dp->drm_dev, "type=%d Done\n", dp->connector_type);
-	mutex_unlock(&dp_display->event_mutex);
+	mutex_unlock(&msm_dp_display->event_mutex);
+}
+
+void msm_dp_display_atomic_enable(struct msm_dp *msm_dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+
+	// move this to a different commit
+	msm_dp_display_set_stream_info(msm_dp, msm_dp_display->panel, 0, 0, 0, 0, 0);
+
+	msm_dp_display_enable_helper(msm_dp, msm_dp_display->panel);
+}
+
+void msm_dp_display_disable_helper(struct msm_dp *dp, struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	if (!msm_dp_display->active_stream_cnt) {
+		drm_dbg_dp(dp->drm_dev, "no active streams\n");
+		return;
+	}
+
+	msm_dp_ctrl_push_vcpf(msm_dp_display->ctrl, msm_dp_panel);
+	msm_dp_ctrl_mst_stream_channel_slot_setup(msm_dp_display->ctrl, msm_dp_display->max_stream);
+	msm_dp_ctrl_mst_send_act(msm_dp_display->ctrl);
 }
 
-void dp_bridge_atomic_disable(struct drm_bridge *drm_bridge,
-			      struct drm_bridge_state *old_bridge_state)
+void msm_dp_display_atomic_disable(struct msm_dp *msm_dp)
 {
-	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
-	struct msm_dp *dp = dp_bridge->dp_display;
-	struct dp_display_private *dp_display;
+	struct msm_dp_display_private *msm_dp_display;
 
-	dp_display = container_of(dp, struct dp_display_private, dp_display);
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
 
-	dp_ctrl_push_idle(dp_display->ctrl);
+	msm_dp_ctrl_push_idle(msm_dp_display->ctrl);
 }
 
-void dp_bridge_atomic_post_disable(struct drm_bridge *drm_bridge,
-				   struct drm_bridge_state *old_bridge_state)
+void msm_dp_display_unprepare(struct msm_dp *msm_dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+	if (!msm_dp->prepared) {
+		drm_dbg_dp(msm_dp->drm_dev, "Link already unprepare, return\n");
+		return;
+	}
+
+	if (msm_dp_display->active_stream_cnt) {
+		drm_dbg_dp(msm_dp->drm_dev, "stream still active, return\n");
+		return;
+	}
+
+	/* dongle is still connected but sinks are disconnected */
+	if (msm_dp_display->link->sink_count == 0)
+		msm_dp_ctrl_psm_config(msm_dp_display->ctrl);
+
+	msm_dp_ctrl_off_link(msm_dp_display->ctrl);
+
+	/* re-init the PHY so that we can listen to Dongle disconnect */
+	if (msm_dp_display->link->sink_count == 0)
+		msm_dp_ctrl_reinit_phy(msm_dp_display->ctrl);
+	else
+		msm_dp_display_host_phy_exit(msm_dp_display);
+
+	pm_runtime_put_sync(&msm_dp->pdev->dev);
+
+	msm_dp->prepared = false;
+}
+
+void msm_dp_display_atomic_post_disable_helper(struct msm_dp *dp, struct msm_dp_panel *msm_dp_panel)
 {
-	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
-	struct msm_dp *dp = dp_bridge->dp_display;
 	u32 state;
-	struct dp_display_private *dp_display;
+	struct msm_dp_display_private *msm_dp_display;
 
-	dp_display = container_of(dp, struct dp_display_private, dp_display);
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
 
 	if (dp->is_edp)
-		dp_hpd_unplug_handle(dp_display, 0);
+		msm_dp_hpd_unplug_handle(msm_dp_display, 0);
 
-	mutex_lock(&dp_display->event_mutex);
+	mutex_lock(&msm_dp_display->event_mutex);
 
-	state = dp_display->hpd_state;
+	state = msm_dp_display->hpd_state;
 	if (state != ST_DISCONNECT_PENDING && state != ST_CONNECTED)
 		drm_dbg_dp(dp->drm_dev, "type=%d wrong hpd_state=%d\n",
 			   dp->connector_type, state);
 
-	dp_display_disable(dp_display);
+	msm_dp_display_audio_notify_disable(msm_dp_display);
 
-	state =  dp_display->hpd_state;
-	if (state == ST_DISCONNECT_PENDING) {
+	msm_dp_display_disable(msm_dp_display, msm_dp_panel);
+
+	state =  msm_dp_display->hpd_state;
+	if (state == ST_DISCONNECT_PENDING && !msm_dp_display->active_stream_cnt) {
 		/* completed disconnection */
-		dp_display->hpd_state = ST_DISCONNECTED;
-	} else {
-		dp_display->hpd_state = ST_DISPLAY_OFF;
+		msm_dp_display->hpd_state = ST_DISCONNECTED;
+	} else if (state != ST_DISCONNECT_PENDING && state != ST_DISCONNECTED) {
+		/* stay at pending till both streams are disabled, otherwise OFF */
+		msm_dp_display->hpd_state = ST_DISPLAY_OFF;
 	}
 
 	drm_dbg_dp(dp->drm_dev, "type=%d Done\n", dp->connector_type);
 
-	pm_runtime_put_sync(&dp->pdev->dev);
-	mutex_unlock(&dp_display->event_mutex);
+	mutex_unlock(&msm_dp_display->event_mutex);
 }
 
-void dp_bridge_mode_set(struct drm_bridge *drm_bridge,
-			const struct drm_display_mode *mode,
-			const struct drm_display_mode *adjusted_mode)
+void msm_dp_display_atomic_post_disable(struct msm_dp *msm_dp)
 {
-	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
-	struct msm_dp *dp = dp_bridge->dp_display;
-	struct dp_display_private *dp_display;
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+
+	msm_dp_display_atomic_post_disable_helper(msm_dp, msm_dp_display->panel);
+
+	msm_dp_display_unprepare(msm_dp);
+}
 
-	dp_display = container_of(dp, struct dp_display_private, dp_display);
+void msm_dp_display_mode_set_helper(struct msm_dp *msm_dp,
+				    const struct drm_display_mode *mode,
+				    const struct drm_display_mode *adjusted_mode,
+				    struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_display_private *msm_dp_display;
 
-	memset(&dp_display->dp_mode, 0x0, sizeof(struct dp_display_mode));
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
 
-	if (dp_display_check_video_test(dp))
-		dp_display->dp_mode.bpp = dp_display_get_test_bpp(dp);
-	else /* Default num_components per pixel = 3 */
-		dp_display->dp_mode.bpp = dp->connector->display_info.bpc * 3;
+	msm_dp_display_set_mode(msm_dp, adjusted_mode, msm_dp_panel);
 
-	if (!dp_display->dp_mode.bpp)
-		dp_display->dp_mode.bpp = 24; /* Default bpp */
+	/* populate wide_bus_support to different layers */
+	msm_dp_display->ctrl->wide_bus_en =
+		msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420 ?
+		false : msm_dp_display->wide_bus_supported;
+	msm_dp_display->catalog->wide_bus_en =
+		msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420 ?
+		false : msm_dp_display->wide_bus_supported;
+}
 
-	drm_mode_copy(&dp_display->dp_mode.drm_mode, adjusted_mode);
+void msm_dp_display_mode_set(struct msm_dp *msm_dp,
+			     const struct drm_display_mode *mode,
+			     const struct drm_display_mode *adjusted_mode)
+{
+	struct msm_dp_display_private *msm_dp_display;
 
-	dp_display->dp_mode.v_active_low =
-		!!(dp_display->dp_mode.drm_mode.flags & DRM_MODE_FLAG_NVSYNC);
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
 
-	dp_display->dp_mode.h_active_low =
-		!!(dp_display->dp_mode.drm_mode.flags & DRM_MODE_FLAG_NHSYNC);
+	msm_dp_display_mode_set_helper(msm_dp, mode, adjusted_mode, msm_dp_display->panel);
 }
 
-void dp_bridge_hpd_enable(struct drm_bridge *bridge)
+void msm_dp_bridge_hpd_enable(struct drm_bridge *bridge)
 {
-	struct msm_dp_bridge *dp_bridge = to_dp_bridge(bridge);
-	struct msm_dp *dp_display = dp_bridge->dp_display;
-	struct dp_display_private *dp = container_of(dp_display, struct dp_display_private, dp_display);
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(bridge);
+	struct msm_dp *msm_dp_display = msm_dp_bridge->msm_dp_display;
+	struct msm_dp_display_private *dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
 
 	/*
 	 * this is for external DP with hpd irq enabled case,
-	 * step-1: dp_pm_runtime_resume() enable dp host only
+	 * step-1: msm_dp_pm_runtime_resume() enable dp host only
 	 * step-2: enable hdp block and have hpd irq enabled here
 	 * step-3: waiting for plugin irq while phy is not initialized
 	 * step-4: DP PHY is initialized at plugin handler before link training
 	 *
 	 */
 	mutex_lock(&dp->event_mutex);
-	if (pm_runtime_resume_and_get(&dp_display->pdev->dev)) {
+	if (pm_runtime_resume_and_get(&msm_dp_display->pdev->dev)) {
 		DRM_ERROR("failed to resume power\n");
 		mutex_unlock(&dp->event_mutex);
 		return;
 	}
 
-	dp_catalog_ctrl_hpd_enable(dp->catalog);
+	msm_dp_catalog_ctrl_hpd_enable(dp->catalog);
 
 	/* enable HDP interrupts */
-	dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_INT_MASK, true);
+	msm_dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_INT_MASK, true);
 
-	dp_display->internal_hpd = true;
+	msm_dp_display->internal_hpd = true;
 	mutex_unlock(&dp->event_mutex);
 }
 
-void dp_bridge_hpd_disable(struct drm_bridge *bridge)
+void msm_dp_bridge_hpd_disable(struct drm_bridge *bridge)
 {
-	struct msm_dp_bridge *dp_bridge = to_dp_bridge(bridge);
-	struct msm_dp *dp_display = dp_bridge->dp_display;
-	struct dp_display_private *dp = container_of(dp_display, struct dp_display_private, dp_display);
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(bridge);
+	struct msm_dp *msm_dp_display = msm_dp_bridge->msm_dp_display;
+	struct msm_dp_display_private *dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
 
 	mutex_lock(&dp->event_mutex);
 	/* disable HDP interrupts */
-	dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_INT_MASK, false);
-	dp_catalog_ctrl_hpd_disable(dp->catalog);
+	msm_dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_INT_MASK, false);
+	msm_dp_catalog_ctrl_hpd_disable(dp->catalog);
 
-	dp_display->internal_hpd = false;
+	msm_dp_display->internal_hpd = false;
 
-	pm_runtime_put_sync(&dp_display->pdev->dev);
+	pm_runtime_put_sync(&msm_dp_display->pdev->dev);
 	mutex_unlock(&dp->event_mutex);
 }
 
-void dp_bridge_hpd_notify(struct drm_bridge *bridge,
+void msm_dp_bridge_hpd_notify(struct drm_bridge *bridge,
 			  enum drm_connector_status status)
 {
-	struct msm_dp_bridge *dp_bridge = to_dp_bridge(bridge);
-	struct msm_dp *dp_display = dp_bridge->dp_display;
-	struct dp_display_private *dp = container_of(dp_display, struct dp_display_private, dp_display);
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(bridge);
+	struct msm_dp *msm_dp_display = msm_dp_bridge->msm_dp_display;
+	struct msm_dp_display_private *dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
 
 	/* Without next_bridge interrupts are handled by the DP core directly */
-	if (dp_display->internal_hpd)
+	if (msm_dp_display->internal_hpd)
 		return;
 
-	if (!dp_display->link_ready && status == connector_status_connected)
-		dp_add_event(dp, EV_HPD_PLUG_INT, 0, 0);
-	else if (dp_display->link_ready && status == connector_status_disconnected)
-		dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
+	if (!msm_dp_display->link_ready && status == connector_status_connected)
+		msm_dp_add_event(dp, EV_HPD_PLUG_INT, 0, 0);
+	else if (msm_dp_display->link_ready && status == connector_status_disconnected)
+		msm_dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_display.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_display.h
@@ -7,40 +7,68 @@
 #define _DP_DISPLAY_H_
 
 #include "dp_panel.h"
+#include "dp_mst_drm.h"
 #include <sound/hdmi-codec.h>
 #include "disp/msm_disp_snapshot.h"
 
+#define DP_MAX_PIXEL_CLK_KHZ	675000
+
 struct msm_dp {
 	struct drm_device *drm_dev;
 	struct platform_device *pdev;
 	struct device *codec_dev;
-	struct drm_bridge *bridge;
 	struct drm_connector *connector;
 	struct drm_bridge *next_bridge;
 	bool link_ready;
 	bool audio_enabled;
-	bool power_on;
+	bool prepared;
+	bool mst_active;
 	unsigned int connector_type;
 	bool is_edp;
 	bool internal_hpd;
 
+	struct msm_dp_mst *msm_dp_mst;
 	hdmi_codec_plugged_cb plugged_cb;
 
-	bool wide_bus_en;
-
-	u32 max_dp_lanes;
-	struct dp_audio *dp_audio;
+	struct msm_dp_audio *msm_dp_audio;
 	bool psr_supported;
 };
 
-int dp_display_set_plugged_cb(struct msm_dp *dp_display,
+int msm_dp_display_set_plugged_cb(struct msm_dp *msm_dp_display,
 		hdmi_codec_plugged_cb fn, struct device *codec_dev);
-int dp_display_get_modes(struct msm_dp *dp_display);
-bool dp_display_check_video_test(struct msm_dp *dp_display);
-int dp_display_get_test_bpp(struct msm_dp *dp_display);
-void dp_display_signal_audio_start(struct msm_dp *dp_display);
-void dp_display_signal_audio_complete(struct msm_dp *dp_display);
-void dp_display_set_psr(struct msm_dp *dp, bool enter);
-void dp_display_debugfs_init(struct msm_dp *dp_display, struct dentry *dentry, bool is_edp);
+int msm_dp_display_get_modes(struct msm_dp *msm_dp_display);
+bool msm_dp_display_check_video_test(struct msm_dp *msm_dp_display);
+int msm_dp_display_get_test_bpp(struct msm_dp *msm_dp_display);
+void msm_dp_display_signal_audio_start(struct msm_dp *msm_dp_display);
+void msm_dp_display_signal_audio_complete(struct msm_dp *msm_dp_display);
+void msm_dp_display_set_psr(struct msm_dp *dp, bool enter);
+void msm_dp_display_debugfs_init(struct msm_dp *msm_dp_display, struct dentry *dentry, bool is_edp);
+void msm_dp_display_atomic_post_disable(struct msm_dp *dp_display);
+void msm_dp_display_atomic_disable(struct msm_dp *dp_display);
+void msm_dp_display_atomic_enable(struct msm_dp *dp_display);
+void msm_dp_display_atomic_prepare(struct msm_dp *dp);
+void msm_dp_display_mode_set(struct msm_dp *dp,
+			     const struct drm_display_mode *mode,
+			     const struct drm_display_mode *adjusted_mode);
+enum drm_mode_status msm_dp_display_mode_valid(struct msm_dp *dp,
+					       const struct drm_display_info *info,
+					       const struct drm_display_mode *mode);
+int msm_dp_display_set_stream_info(struct msm_dp *dp,
+				   struct msm_dp_panel *panel, u32 strm_id,
+				   u32 start_slot, u32 num_slots, u32 pbn, int vcpi);
+void msm_dp_display_enable_helper(struct msm_dp *msm_dp, struct msm_dp_panel *msm_dp_panel);
+void msm_dp_display_disable_helper(struct msm_dp *msm_dp, struct msm_dp_panel *msm_dp_panel);
+void msm_dp_display_mode_set_helper(struct msm_dp *msm_dp,
+				    const struct drm_display_mode *mode,
+				    const struct drm_display_mode *adjusted_mode,
+				    struct msm_dp_panel *msm_dp_panel);
+void msm_dp_display_atomic_post_disable_helper(struct msm_dp *msm_dp,
+					       struct msm_dp_panel *msm_dp_panel);
+
+void msm_dp_display_unprepare(struct msm_dp *dp);
+
+int msm_dp_display_get_active_stream_cnt(struct msm_dp *msm_dp);
+
+struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *dp_display);
 
 #endif /* _DP_DISPLAY_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_drm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_drm.c
@@ -14,31 +14,31 @@
 #include "dp_drm.h"
 
 /**
- * dp_bridge_detect - callback to determine if connector is connected
+ * msm_dp_bridge_detect - callback to determine if connector is connected
  * @bridge: Pointer to drm bridge structure
  * Returns: Bridge's 'is connected' status
  */
-static enum drm_connector_status dp_bridge_detect(struct drm_bridge *bridge)
+static enum drm_connector_status msm_dp_bridge_detect(struct drm_bridge *bridge)
 {
 	struct msm_dp *dp;
 
-	dp = to_dp_bridge(bridge)->dp_display;
+	dp = to_dp_bridge(bridge)->msm_dp_display;
 
 	drm_dbg_dp(dp->drm_dev, "link_ready = %s\n",
 		(dp->link_ready) ? "true" : "false");
 
-	return (dp->link_ready) ? connector_status_connected :
+	return (dp->link_ready && !dp->mst_active) ? connector_status_connected :
 					connector_status_disconnected;
 }
 
-static int dp_bridge_atomic_check(struct drm_bridge *bridge,
+static int msm_dp_bridge_atomic_check(struct drm_bridge *bridge,
 			    struct drm_bridge_state *bridge_state,
 			    struct drm_crtc_state *crtc_state,
 			    struct drm_connector_state *conn_state)
 {
 	struct msm_dp *dp;
 
-	dp = to_dp_bridge(bridge)->dp_display;
+	dp = to_dp_bridge(bridge)->msm_dp_display;
 
 	drm_dbg_dp(dp->drm_dev, "link_ready = %s\n",
 		(dp->link_ready) ? "true" : "false");
@@ -62,12 +62,12 @@
 
 
 /**
- * dp_bridge_get_modes - callback to add drm modes via drm_mode_probed_add()
+ * msm_dp_bridge_get_modes - callback to add drm modes via drm_mode_probed_add()
  * @bridge: Poiner to drm bridge
  * @connector: Pointer to drm connector structure
  * Returns: Number of modes added
  */
-static int dp_bridge_get_modes(struct drm_bridge *bridge, struct drm_connector *connector)
+static int msm_dp_bridge_get_modes(struct drm_bridge *bridge, struct drm_connector *connector)
 {
 	int rc = 0;
 	struct msm_dp *dp;
@@ -75,11 +75,11 @@
 	if (!connector)
 		return 0;
 
-	dp = to_dp_bridge(bridge)->dp_display;
+	dp = to_dp_bridge(bridge)->msm_dp_display;
 
 	/* pluggable case assumes EDID is read when HPD */
 	if (dp->link_ready) {
-		rc = dp_display_get_modes(dp);
+		rc = msm_dp_display_get_modes(dp);
 		if (rc <= 0) {
 			DRM_ERROR("failed to get DP sink modes, rc=%d\n", rc);
 			return rc;
@@ -90,37 +90,85 @@
 	return rc;
 }
 
-static void dp_bridge_debugfs_init(struct drm_bridge *bridge, struct dentry *root)
+static void msm_dp_bridge_debugfs_init(struct drm_bridge *bridge, struct dentry *root)
 {
-	struct msm_dp *dp = to_dp_bridge(bridge)->dp_display;
+	struct msm_dp *dp = to_dp_bridge(bridge)->msm_dp_display;
 
-	dp_display_debugfs_init(dp, root, false);
+	msm_dp_display_debugfs_init(dp, root, false);
 }
 
-static const struct drm_bridge_funcs dp_bridge_ops = {
+static void msm_dp_bridge_atomic_enable(struct drm_bridge *drm_bridge,
+					struct drm_bridge_state *old_bridge_state)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	msm_dp_display_atomic_prepare(dp);
+	msm_dp_display_atomic_enable(dp);
+}
+
+static void msm_dp_bridge_atomic_disable(struct drm_bridge *drm_bridge,
+					 struct drm_bridge_state *old_bridge_state)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	msm_dp_display_atomic_disable(dp);
+}
+
+static void msm_dp_bridge_atomic_post_disable(struct drm_bridge *drm_bridge,
+					      struct drm_bridge_state *old_bridge_state)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	msm_dp_display_atomic_post_disable(dp);
+}
+
+static void msm_dp_bridge_mode_set(struct drm_bridge *drm_bridge,
+				   const struct drm_display_mode *mode,
+				   const struct drm_display_mode *adjusted_mode)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	msm_dp_display_mode_set(dp, mode, adjusted_mode);
+}
+
+static enum drm_mode_status msm_dp_bridge_mode_valid(struct drm_bridge *drm_bridge,
+						     const struct drm_display_info *info,
+						     const struct drm_display_mode *mode)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	return msm_dp_display_mode_valid(dp, info, mode);
+}
+
+static const struct drm_bridge_funcs msm_dp_bridge_ops = {
 	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
 	.atomic_destroy_state   = drm_atomic_helper_bridge_destroy_state,
 	.atomic_reset           = drm_atomic_helper_bridge_reset,
-	.atomic_enable          = dp_bridge_atomic_enable,
-	.atomic_disable         = dp_bridge_atomic_disable,
-	.atomic_post_disable    = dp_bridge_atomic_post_disable,
-	.mode_set     = dp_bridge_mode_set,
-	.mode_valid   = dp_bridge_mode_valid,
-	.get_modes    = dp_bridge_get_modes,
-	.detect       = dp_bridge_detect,
-	.atomic_check = dp_bridge_atomic_check,
-	.hpd_enable   = dp_bridge_hpd_enable,
-	.hpd_disable  = dp_bridge_hpd_disable,
-	.hpd_notify   = dp_bridge_hpd_notify,
-	.debugfs_init = dp_bridge_debugfs_init,
+	.atomic_enable          = msm_dp_bridge_atomic_enable,
+	.atomic_disable         = msm_dp_bridge_atomic_disable,
+	.atomic_post_disable    = msm_dp_bridge_atomic_post_disable,
+	.mode_set     = msm_dp_bridge_mode_set,
+	.mode_valid   = msm_dp_bridge_mode_valid,
+	.get_modes    = msm_dp_bridge_get_modes,
+	.detect       = msm_dp_bridge_detect,
+	.atomic_check = msm_dp_bridge_atomic_check,
+	.hpd_enable   = msm_dp_bridge_hpd_enable,
+	.hpd_disable  = msm_dp_bridge_hpd_disable,
+	.hpd_notify   = msm_dp_bridge_hpd_notify,
+	.debugfs_init = msm_dp_bridge_debugfs_init,
 };
 
-static int edp_bridge_atomic_check(struct drm_bridge *drm_bridge,
+static int msm_edp_bridge_atomic_check(struct drm_bridge *drm_bridge,
 				   struct drm_bridge_state *bridge_state,
 				   struct drm_crtc_state *crtc_state,
 				   struct drm_connector_state *conn_state)
 {
-	struct msm_dp *dp = to_dp_bridge(drm_bridge)->dp_display;
+	struct msm_dp *dp = to_dp_bridge(drm_bridge)->msm_dp_display;
 
 	if (WARN_ON(!conn_state))
 		return -ENODEV;
@@ -136,18 +184,18 @@
 	return 0;
 }
 
-static void edp_bridge_atomic_enable(struct drm_bridge *drm_bridge,
+static void msm_edp_bridge_atomic_enable(struct drm_bridge *drm_bridge,
 				     struct drm_bridge_state *old_bridge_state)
 {
 	struct drm_atomic_state *atomic_state = old_bridge_state->base.state;
 	struct drm_crtc *crtc;
 	struct drm_crtc_state *old_crtc_state;
-	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
-	struct msm_dp *dp = dp_bridge->dp_display;
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = msm_dp_bridge->msm_dp_display;
 
 	/*
 	 * Check the old state of the crtc to determine if the panel
-	 * was put into psr state previously by the edp_bridge_atomic_disable.
+	 * was put into psr state previously by the msm_edp_bridge_atomic_disable.
 	 * If the panel is in psr, just exit psr state and skip the full
 	 * bridge enable sequence.
 	 */
@@ -159,21 +207,22 @@
 	old_crtc_state = drm_atomic_get_old_crtc_state(atomic_state, crtc);
 
 	if (old_crtc_state && old_crtc_state->self_refresh_active) {
-		dp_display_set_psr(dp, false);
+		msm_dp_display_set_psr(dp, false);
 		return;
 	}
 
-	dp_bridge_atomic_enable(drm_bridge, old_bridge_state);
+	msm_dp_display_atomic_prepare(dp);
+	msm_dp_display_atomic_enable(dp);
 }
 
-static void edp_bridge_atomic_disable(struct drm_bridge *drm_bridge,
+static void msm_edp_bridge_atomic_disable(struct drm_bridge *drm_bridge,
 				      struct drm_bridge_state *old_bridge_state)
 {
 	struct drm_atomic_state *atomic_state = old_bridge_state->base.state;
 	struct drm_crtc *crtc;
 	struct drm_crtc_state *new_crtc_state = NULL, *old_crtc_state = NULL;
-	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
-	struct msm_dp *dp = dp_bridge->dp_display;
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = msm_dp_bridge->msm_dp_display;
 
 	crtc = drm_atomic_get_old_crtc_for_encoder(atomic_state,
 						   drm_bridge->encoder);
@@ -194,24 +243,24 @@
 	 * If old crtc state is active, then this is a display disable
 	 * call while the sink is in psr state. So, exit psr here.
 	 * The eDP controller will be disabled in the
-	 * edp_bridge_atomic_post_disable function.
+	 * msm_edp_bridge_atomic_post_disable function.
 	 *
 	 * We observed sink is stuck in self refresh if psr exit is skipped
 	 * when display disable occurs while the sink is in psr state.
 	 */
 	if (new_crtc_state->self_refresh_active) {
-		dp_display_set_psr(dp, true);
+		msm_dp_display_set_psr(dp, true);
 		return;
 	} else if (old_crtc_state->self_refresh_active) {
-		dp_display_set_psr(dp, false);
+		msm_dp_display_set_psr(dp, false);
 		return;
 	}
 
 out:
-	dp_bridge_atomic_disable(drm_bridge, old_bridge_state);
+	msm_dp_bridge_atomic_disable(drm_bridge, old_bridge_state);
 }
 
-static void edp_bridge_atomic_post_disable(struct drm_bridge *drm_bridge,
+static void msm_edp_bridge_atomic_post_disable(struct drm_bridge *drm_bridge,
 				struct drm_bridge_state *old_bridge_state)
 {
 	struct drm_atomic_state *atomic_state = old_bridge_state->base.state;
@@ -228,29 +277,29 @@
 		return;
 
 	/*
-	 * Self refresh mode is already set in edp_bridge_atomic_disable.
+	 * Self refresh mode is already set in msm_edp_bridge_atomic_disable.
 	 */
 	if (new_crtc_state->self_refresh_active)
 		return;
 
-	dp_bridge_atomic_post_disable(drm_bridge, old_bridge_state);
+	msm_dp_bridge_atomic_post_disable(drm_bridge, old_bridge_state);
 }
 
 /**
- * edp_bridge_mode_valid - callback to determine if specified mode is valid
+ * msm_edp_bridge_mode_valid - callback to determine if specified mode is valid
  * @bridge: Pointer to drm bridge structure
  * @info: display info
  * @mode: Pointer to drm mode structure
  * Returns: Validity status for specified mode
  */
-static enum drm_mode_status edp_bridge_mode_valid(struct drm_bridge *bridge,
+static enum drm_mode_status msm_edp_bridge_mode_valid(struct drm_bridge *bridge,
 					  const struct drm_display_info *info,
 					  const struct drm_display_mode *mode)
 {
 	struct msm_dp *dp;
 	int mode_pclk_khz = mode->clock;
 
-	dp = to_dp_bridge(bridge)->dp_display;
+	dp = to_dp_bridge(bridge)->msm_dp_display;
 
 	if (!dp || !mode_pclk_khz || !dp->connector) {
 		DRM_ERROR("invalid params\n");
@@ -268,42 +317,43 @@
 	return MODE_OK;
 }
 
-static void edp_bridge_debugfs_init(struct drm_bridge *bridge, struct dentry *root)
+static void msm_edp_bridge_debugfs_init(struct drm_bridge *bridge, struct dentry *root)
 {
-	struct msm_dp *dp = to_dp_bridge(bridge)->dp_display;
+	struct msm_dp *dp = to_dp_bridge(bridge)->msm_dp_display;
 
-	dp_display_debugfs_init(dp, root, true);
+	msm_dp_display_debugfs_init(dp, root, true);
 }
 
-static const struct drm_bridge_funcs edp_bridge_ops = {
-	.atomic_enable = edp_bridge_atomic_enable,
-	.atomic_disable = edp_bridge_atomic_disable,
-	.atomic_post_disable = edp_bridge_atomic_post_disable,
-	.mode_set = dp_bridge_mode_set,
-	.mode_valid = edp_bridge_mode_valid,
+static const struct drm_bridge_funcs msm_edp_bridge_ops = {
+	.atomic_enable = msm_edp_bridge_atomic_enable,
+	.atomic_disable = msm_edp_bridge_atomic_disable,
+	.atomic_post_disable = msm_edp_bridge_atomic_post_disable,
+	.mode_set = msm_dp_bridge_mode_set,
+	.mode_valid = msm_edp_bridge_mode_valid,
 	.atomic_reset = drm_atomic_helper_bridge_reset,
 	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
-	.atomic_check = edp_bridge_atomic_check,
-	.debugfs_init = edp_bridge_debugfs_init,
+	.atomic_check = msm_edp_bridge_atomic_check,
+	.debugfs_init = msm_edp_bridge_debugfs_init,
 };
 
-int dp_bridge_init(struct msm_dp *dp_display, struct drm_device *dev,
-			struct drm_encoder *encoder)
+int msm_dp_bridge_init(struct msm_dp *msm_dp_display, struct drm_device *dev,
+		   struct drm_encoder *encoder, bool yuv_supported)
 {
 	int rc;
-	struct msm_dp_bridge *dp_bridge;
+	struct msm_dp_bridge *msm_dp_bridge;
 	struct drm_bridge *bridge;
 
-	dp_bridge = devm_kzalloc(dev->dev, sizeof(*dp_bridge), GFP_KERNEL);
-	if (!dp_bridge)
+	msm_dp_bridge = devm_kzalloc(dev->dev, sizeof(*msm_dp_bridge), GFP_KERNEL);
+	if (!msm_dp_bridge)
 		return -ENOMEM;
 
-	dp_bridge->dp_display = dp_display;
+	msm_dp_bridge->msm_dp_display = msm_dp_display;
 
-	bridge = &dp_bridge->bridge;
-	bridge->funcs = dp_display->is_edp ? &edp_bridge_ops : &dp_bridge_ops;
-	bridge->type = dp_display->connector_type;
+	bridge = &msm_dp_bridge->bridge;
+	bridge->funcs = msm_dp_display->is_edp ? &msm_edp_bridge_ops : &msm_dp_bridge_ops;
+	bridge->type = msm_dp_display->connector_type;
+	bridge->ycbcr_420_allowed = yuv_supported;
 
 	/*
 	 * Many ops only make sense for DP. Why?
@@ -316,7 +366,7 @@
 	 *   allows the panel driver to properly power itself on to read the
 	 *   modes.
 	 */
-	if (!dp_display->is_edp) {
+	if (!msm_dp_display->is_edp) {
 		bridge->ops =
 			DRM_BRIDGE_OP_DETECT |
 			DRM_BRIDGE_OP_HPD |
@@ -337,9 +387,9 @@
 		return rc;
 	}
 
-	if (dp_display->next_bridge) {
+	if (msm_dp_display->next_bridge) {
 		rc = drm_bridge_attach(encoder,
-					dp_display->next_bridge, bridge,
+					msm_dp_display->next_bridge, bridge,
 					DRM_BRIDGE_ATTACH_NO_CONNECTOR);
 		if (rc < 0) {
 			DRM_ERROR("failed to attach panel bridge: %d\n", rc);
@@ -347,21 +397,20 @@
 		}
 	}
 
-	dp_display->bridge = bridge;
-
 	return 0;
 }
 
 /* connector initialization */
-struct drm_connector *dp_drm_connector_init(struct msm_dp *dp_display, struct drm_encoder *encoder)
+struct drm_connector *msm_dp_drm_connector_init(struct msm_dp *msm_dp_display,
+					    struct drm_encoder *encoder)
 {
 	struct drm_connector *connector = NULL;
 
-	connector = drm_bridge_connector_init(dp_display->drm_dev, encoder);
+	connector = drm_bridge_connector_init(msm_dp_display->drm_dev, encoder);
 	if (IS_ERR(connector))
 		return connector;
 
-	if (!dp_display->is_edp)
+	if (!msm_dp_display->is_edp)
 		drm_connector_attach_dp_subconnector_property(connector);
 
 	drm_connector_attach_encoder(connector, encoder);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_drm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_drm.h
@@ -14,30 +14,20 @@
 
 struct msm_dp_bridge {
 	struct drm_bridge bridge;
-	struct msm_dp *dp_display;
+	struct msm_dp *msm_dp_display;
 };
 
 #define to_dp_bridge(x)     container_of((x), struct msm_dp_bridge, bridge)
 
-struct drm_connector *dp_drm_connector_init(struct msm_dp *dp_display, struct drm_encoder *encoder);
-int dp_bridge_init(struct msm_dp *dp_display, struct drm_device *dev,
-			struct drm_encoder *encoder);
+struct drm_connector *msm_dp_drm_connector_init(struct msm_dp *msm_dp_display,
+					    struct drm_encoder *encoder);
+int msm_dp_bridge_init(struct msm_dp *msm_dp_display, struct drm_device *dev,
+		   struct drm_encoder *encoder,
+		   bool yuv_supported);
 
-void dp_bridge_atomic_enable(struct drm_bridge *drm_bridge,
-			     struct drm_bridge_state *old_bridge_state);
-void dp_bridge_atomic_disable(struct drm_bridge *drm_bridge,
-			      struct drm_bridge_state *old_bridge_state);
-void dp_bridge_atomic_post_disable(struct drm_bridge *drm_bridge,
-				   struct drm_bridge_state *old_bridge_state);
-enum drm_mode_status dp_bridge_mode_valid(struct drm_bridge *bridge,
-					  const struct drm_display_info *info,
-					  const struct drm_display_mode *mode);
-void dp_bridge_mode_set(struct drm_bridge *drm_bridge,
-			const struct drm_display_mode *mode,
-			const struct drm_display_mode *adjusted_mode);
-void dp_bridge_hpd_enable(struct drm_bridge *bridge);
-void dp_bridge_hpd_disable(struct drm_bridge *bridge);
-void dp_bridge_hpd_notify(struct drm_bridge *bridge,
+void msm_dp_bridge_hpd_enable(struct drm_bridge *bridge);
+void msm_dp_bridge_hpd_disable(struct drm_bridge *bridge);
+void msm_dp_bridge_hpd_notify(struct drm_bridge *bridge,
 			  enum drm_connector_status status);
 
 #endif /* _DP_DRM_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_link.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_link.c
@@ -28,26 +28,25 @@
 	AUDIO_TEST_PATTERN_SAWTOOTH		= 0x01,
 };
 
-struct dp_link_request {
+struct msm_dp_link_request {
 	u32 test_requested;
 	u32 test_link_rate;
 	u32 test_lane_count;
 };
 
-struct dp_link_private {
+struct msm_dp_link_private {
 	u32 prev_sink_count;
-	struct device *dev;
 	struct drm_device *drm_dev;
 	struct drm_dp_aux *aux;
-	struct dp_link dp_link;
+	struct msm_dp_link msm_dp_link;
 
-	struct dp_link_request request;
+	struct msm_dp_link_request request;
 	struct mutex psm_mutex;
 	u8 link_status[DP_LINK_STATUS_SIZE];
 };
 
-static int dp_aux_link_power_up(struct drm_dp_aux *aux,
-					struct dp_link_info *link)
+static int msm_dp_aux_link_power_up(struct drm_dp_aux *aux,
+					struct msm_dp_link_info *link)
 {
 	u8 value;
 	ssize_t len;
@@ -74,8 +73,8 @@
 	return 0;
 }
 
-static int dp_aux_link_power_down(struct drm_dp_aux *aux,
-					struct dp_link_info *link)
+static int msm_dp_aux_link_power_down(struct drm_dp_aux *aux,
+					struct msm_dp_link_info *link)
 {
 	u8 value;
 	int err;
@@ -97,7 +96,7 @@
 	return 0;
 }
 
-static int dp_link_get_period(struct dp_link_private *link, int const addr)
+static int msm_dp_link_get_period(struct msm_dp_link_private *link, int const addr)
 {
 	int ret = 0;
 	u8 data;
@@ -123,19 +122,19 @@
 	return ret;
 }
 
-static int dp_link_parse_audio_channel_period(struct dp_link_private *link)
+static int msm_dp_link_parse_audio_channel_period(struct msm_dp_link_private *link)
 {
 	int ret = 0;
-	struct dp_link_test_audio *req = &link->dp_link.test_audio;
+	struct msm_dp_link_test_audio *req = &link->msm_dp_link.test_audio;
 
-	ret = dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH1);
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH1);
 	if (ret == -EINVAL)
 		goto exit;
 
 	req->test_audio_period_ch_1 = ret;
 	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_1 = 0x%x\n", ret);
 
-	ret = dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH2);
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH2);
 	if (ret == -EINVAL)
 		goto exit;
 
@@ -143,42 +142,42 @@
 	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_2 = 0x%x\n", ret);
 
 	/* TEST_AUDIO_PERIOD_CH_3 (Byte 0x275) */
-	ret = dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH3);
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH3);
 	if (ret == -EINVAL)
 		goto exit;
 
 	req->test_audio_period_ch_3 = ret;
 	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_3 = 0x%x\n", ret);
 
-	ret = dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH4);
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH4);
 	if (ret == -EINVAL)
 		goto exit;
 
 	req->test_audio_period_ch_4 = ret;
 	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_4 = 0x%x\n", ret);
 
-	ret = dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH5);
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH5);
 	if (ret == -EINVAL)
 		goto exit;
 
 	req->test_audio_period_ch_5 = ret;
 	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_5 = 0x%x\n", ret);
 
-	ret = dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH6);
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH6);
 	if (ret == -EINVAL)
 		goto exit;
 
 	req->test_audio_period_ch_6 = ret;
 	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_6 = 0x%x\n", ret);
 
-	ret = dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH7);
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH7);
 	if (ret == -EINVAL)
 		goto exit;
 
 	req->test_audio_period_ch_7 = ret;
 	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_7 = 0x%x\n", ret);
 
-	ret = dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH8);
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH8);
 	if (ret == -EINVAL)
 		goto exit;
 
@@ -188,7 +187,7 @@
 	return ret;
 }
 
-static int dp_link_parse_audio_pattern_type(struct dp_link_private *link)
+static int msm_dp_link_parse_audio_pattern_type(struct msm_dp_link_private *link)
 {
 	int ret = 0;
 	u8 data;
@@ -209,13 +208,13 @@
 		goto exit;
 	}
 
-	link->dp_link.test_audio.test_audio_pattern_type = data;
+	link->msm_dp_link.test_audio.test_audio_pattern_type = data;
 	drm_dbg_dp(link->drm_dev, "audio pattern type = 0x%x\n", data);
 exit:
 	return ret;
 }
 
-static int dp_link_parse_audio_mode(struct dp_link_private *link)
+static int msm_dp_link_parse_audio_mode(struct msm_dp_link_private *link)
 {
 	int ret = 0;
 	u8 data;
@@ -249,8 +248,8 @@
 		goto exit;
 	}
 
-	link->dp_link.test_audio.test_audio_sampling_rate = sampling_rate;
-	link->dp_link.test_audio.test_audio_channel_count = channel_count;
+	link->msm_dp_link.test_audio.test_audio_sampling_rate = sampling_rate;
+	link->msm_dp_link.test_audio.test_audio_channel_count = channel_count;
 	drm_dbg_dp(link->drm_dev,
 			"sampling_rate = 0x%x, channel_count = 0x%x\n",
 			sampling_rate, channel_count);
@@ -258,25 +257,25 @@
 	return ret;
 }
 
-static int dp_link_parse_audio_pattern_params(struct dp_link_private *link)
+static int msm_dp_link_parse_audio_pattern_params(struct msm_dp_link_private *link)
 {
 	int ret = 0;
 
-	ret = dp_link_parse_audio_mode(link);
+	ret = msm_dp_link_parse_audio_mode(link);
 	if (ret)
 		goto exit;
 
-	ret = dp_link_parse_audio_pattern_type(link);
+	ret = msm_dp_link_parse_audio_pattern_type(link);
 	if (ret)
 		goto exit;
 
-	ret = dp_link_parse_audio_channel_period(link);
+	ret = msm_dp_link_parse_audio_channel_period(link);
 
 exit:
 	return ret;
 }
 
-static bool dp_link_is_video_pattern_valid(u32 pattern)
+static bool msm_dp_link_is_video_pattern_valid(u32 pattern)
 {
 	switch (pattern) {
 	case DP_NO_TEST_PATTERN:
@@ -290,12 +289,12 @@
 }
 
 /**
- * dp_link_is_bit_depth_valid() - validates the bit depth requested
+ * msm_dp_link_is_bit_depth_valid() - validates the bit depth requested
  * @tbd: bit depth requested by the sink
  *
  * Returns true if the requested bit depth is supported.
  */
-static bool dp_link_is_bit_depth_valid(u32 tbd)
+static bool msm_dp_link_is_bit_depth_valid(u32 tbd)
 {
 	/* DP_TEST_VIDEO_PATTERN_NONE is treated as invalid */
 	switch (tbd) {
@@ -308,7 +307,7 @@
 	}
 }
 
-static int dp_link_parse_timing_params1(struct dp_link_private *link,
+static int msm_dp_link_parse_timing_params1(struct msm_dp_link_private *link,
 					int addr, int len, u32 *val)
 {
 	u8 bp[2];
@@ -329,7 +328,7 @@
 	return 0;
 }
 
-static int dp_link_parse_timing_params2(struct dp_link_private *link,
+static int msm_dp_link_parse_timing_params2(struct msm_dp_link_private *link,
 					int addr, int len,
 					u32 *val1, u32 *val2)
 {
@@ -352,7 +351,7 @@
 	return 0;
 }
 
-static int dp_link_parse_timing_params3(struct dp_link_private *link,
+static int msm_dp_link_parse_timing_params3(struct msm_dp_link_private *link,
 					int addr, u32 *val)
 {
 	u8 bp;
@@ -370,13 +369,13 @@
 }
 
 /**
- * dp_link_parse_video_pattern_params() - parses video pattern parameters from DPCD
+ * msm_dp_link_parse_video_pattern_params() - parses video pattern parameters from DPCD
  * @link: Display Port Driver data
  *
  * Returns 0 if it successfully parses the video link pattern and the link
  * bit depth requested by the sink and, and if the values parsed are valid.
  */
-static int dp_link_parse_video_pattern_params(struct dp_link_private *link)
+static int msm_dp_link_parse_video_pattern_params(struct msm_dp_link_private *link)
 {
 	int ret = 0;
 	ssize_t rlen;
@@ -389,13 +388,13 @@
 		return rlen;
 	}
 
-	if (!dp_link_is_video_pattern_valid(bp)) {
+	if (!msm_dp_link_is_video_pattern_valid(bp)) {
 		DRM_ERROR("invalid link video pattern = 0x%x\n", bp);
 		ret = -EINVAL;
 		return ret;
 	}
 
-	link->dp_link.test_video.test_video_pattern = bp;
+	link->msm_dp_link.test_video.test_video_pattern = bp;
 
 	/* Read the requested color bit depth and dynamic range (Byte 0x232) */
 	rlen = drm_dp_dpcd_readb(link->aux, DP_TEST_MISC0, &bp);
@@ -405,88 +404,88 @@
 	}
 
 	/* Dynamic Range */
-	link->dp_link.test_video.test_dyn_range =
+	link->msm_dp_link.test_video.test_dyn_range =
 			(bp & DP_TEST_DYNAMIC_RANGE_CEA);
 
 	/* Color bit depth */
 	bp &= DP_TEST_BIT_DEPTH_MASK;
-	if (!dp_link_is_bit_depth_valid(bp)) {
+	if (!msm_dp_link_is_bit_depth_valid(bp)) {
 		DRM_ERROR("invalid link bit depth = 0x%x\n", bp);
 		ret = -EINVAL;
 		return ret;
 	}
 
-	link->dp_link.test_video.test_bit_depth = bp;
+	link->msm_dp_link.test_video.test_bit_depth = bp;
 
 	/* resolution timing params */
-	ret = dp_link_parse_timing_params1(link, DP_TEST_H_TOTAL_HI, 2,
-			&link->dp_link.test_video.test_h_total);
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_H_TOTAL_HI, 2,
+			&link->msm_dp_link.test_video.test_h_total);
 	if (ret) {
 		DRM_ERROR("failed to parse test_htotal(DP_TEST_H_TOTAL_HI)\n");
 		return ret;
 	}
 
-	ret = dp_link_parse_timing_params1(link, DP_TEST_V_TOTAL_HI, 2,
-			&link->dp_link.test_video.test_v_total);
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_V_TOTAL_HI, 2,
+			&link->msm_dp_link.test_video.test_v_total);
 	if (ret) {
 		DRM_ERROR("failed to parse test_v_total(DP_TEST_V_TOTAL_HI)\n");
 		return ret;
 	}
 
-	ret = dp_link_parse_timing_params1(link, DP_TEST_H_START_HI, 2,
-			&link->dp_link.test_video.test_h_start);
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_H_START_HI, 2,
+			&link->msm_dp_link.test_video.test_h_start);
 	if (ret) {
 		DRM_ERROR("failed to parse test_h_start(DP_TEST_H_START_HI)\n");
 		return ret;
 	}
 
-	ret = dp_link_parse_timing_params1(link, DP_TEST_V_START_HI, 2,
-			&link->dp_link.test_video.test_v_start);
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_V_START_HI, 2,
+			&link->msm_dp_link.test_video.test_v_start);
 	if (ret) {
 		DRM_ERROR("failed to parse test_v_start(DP_TEST_V_START_HI)\n");
 		return ret;
 	}
 
-	ret = dp_link_parse_timing_params2(link, DP_TEST_HSYNC_HI, 2,
-			&link->dp_link.test_video.test_hsync_pol,
-			&link->dp_link.test_video.test_hsync_width);
+	ret = msm_dp_link_parse_timing_params2(link, DP_TEST_HSYNC_HI, 2,
+			&link->msm_dp_link.test_video.test_hsync_pol,
+			&link->msm_dp_link.test_video.test_hsync_width);
 	if (ret) {
 		DRM_ERROR("failed to parse (DP_TEST_HSYNC_HI)\n");
 		return ret;
 	}
 
-	ret = dp_link_parse_timing_params2(link, DP_TEST_VSYNC_HI, 2,
-			&link->dp_link.test_video.test_vsync_pol,
-			&link->dp_link.test_video.test_vsync_width);
+	ret = msm_dp_link_parse_timing_params2(link, DP_TEST_VSYNC_HI, 2,
+			&link->msm_dp_link.test_video.test_vsync_pol,
+			&link->msm_dp_link.test_video.test_vsync_width);
 	if (ret) {
 		DRM_ERROR("failed to parse (DP_TEST_VSYNC_HI)\n");
 		return ret;
 	}
 
-	ret = dp_link_parse_timing_params1(link, DP_TEST_H_WIDTH_HI, 2,
-			&link->dp_link.test_video.test_h_width);
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_H_WIDTH_HI, 2,
+			&link->msm_dp_link.test_video.test_h_width);
 	if (ret) {
 		DRM_ERROR("failed to parse test_h_width(DP_TEST_H_WIDTH_HI)\n");
 		return ret;
 	}
 
-	ret = dp_link_parse_timing_params1(link, DP_TEST_V_HEIGHT_HI, 2,
-			&link->dp_link.test_video.test_v_height);
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_V_HEIGHT_HI, 2,
+			&link->msm_dp_link.test_video.test_v_height);
 	if (ret) {
 		DRM_ERROR("failed to parse test_v_height\n");
 		return ret;
 	}
 
-	ret = dp_link_parse_timing_params3(link, DP_TEST_MISC1,
-		&link->dp_link.test_video.test_rr_d);
-	link->dp_link.test_video.test_rr_d &= DP_TEST_REFRESH_DENOMINATOR;
+	ret = msm_dp_link_parse_timing_params3(link, DP_TEST_MISC1,
+		&link->msm_dp_link.test_video.test_rr_d);
+	link->msm_dp_link.test_video.test_rr_d &= DP_TEST_REFRESH_DENOMINATOR;
 	if (ret) {
 		DRM_ERROR("failed to parse test_rr_d (DP_TEST_MISC1)\n");
 		return ret;
 	}
 
-	ret = dp_link_parse_timing_params3(link, DP_TEST_REFRESH_RATE_NUMERATOR,
-		&link->dp_link.test_video.test_rr_n);
+	ret = msm_dp_link_parse_timing_params3(link, DP_TEST_REFRESH_RATE_NUMERATOR,
+		&link->msm_dp_link.test_video.test_rr_n);
 	if (ret) {
 		DRM_ERROR("failed to parse test_rr_n\n");
 		return ret;
@@ -506,34 +505,34 @@
 		"TEST_V_HEIGHT = %d\n"
 		"TEST_REFRESH_DENOMINATOR = %d\n"
 		 "TEST_REFRESH_NUMERATOR = %d\n",
-		link->dp_link.test_video.test_video_pattern,
-		link->dp_link.test_video.test_dyn_range,
-		link->dp_link.test_video.test_bit_depth,
-		link->dp_link.test_video.test_h_total,
-		link->dp_link.test_video.test_v_total,
-		link->dp_link.test_video.test_h_start,
-		link->dp_link.test_video.test_v_start,
-		link->dp_link.test_video.test_hsync_pol,
-		link->dp_link.test_video.test_hsync_width,
-		link->dp_link.test_video.test_vsync_pol,
-		link->dp_link.test_video.test_vsync_width,
-		link->dp_link.test_video.test_h_width,
-		link->dp_link.test_video.test_v_height,
-		link->dp_link.test_video.test_rr_d,
-		link->dp_link.test_video.test_rr_n);
+		link->msm_dp_link.test_video.test_video_pattern,
+		link->msm_dp_link.test_video.test_dyn_range,
+		link->msm_dp_link.test_video.test_bit_depth,
+		link->msm_dp_link.test_video.test_h_total,
+		link->msm_dp_link.test_video.test_v_total,
+		link->msm_dp_link.test_video.test_h_start,
+		link->msm_dp_link.test_video.test_v_start,
+		link->msm_dp_link.test_video.test_hsync_pol,
+		link->msm_dp_link.test_video.test_hsync_width,
+		link->msm_dp_link.test_video.test_vsync_pol,
+		link->msm_dp_link.test_video.test_vsync_width,
+		link->msm_dp_link.test_video.test_h_width,
+		link->msm_dp_link.test_video.test_v_height,
+		link->msm_dp_link.test_video.test_rr_d,
+		link->msm_dp_link.test_video.test_rr_n);
 
 	return ret;
 }
 
 /**
- * dp_link_parse_link_training_params() - parses link training parameters from
+ * msm_dp_link_parse_link_training_params() - parses link training parameters from
  * DPCD
  * @link: Display Port Driver data
  *
  * Returns 0 if it successfully parses the link rate (Byte 0x219) and lane
  * count (Byte 0x220), and if these values parse are valid.
  */
-static int dp_link_parse_link_training_params(struct dp_link_private *link)
+static int msm_dp_link_parse_link_training_params(struct msm_dp_link_private *link)
 {
 	u8 bp;
 	ssize_t rlen;
@@ -572,13 +571,13 @@
 }
 
 /**
- * dp_link_parse_phy_test_params() - parses the phy link parameters
+ * msm_dp_link_parse_phy_test_params() - parses the phy link parameters
  * @link: Display Port Driver data
  *
  * Parses the DPCD (Byte 0x248) for the DP PHY link pattern that is being
  * requested.
  */
-static int dp_link_parse_phy_test_params(struct dp_link_private *link)
+static int msm_dp_link_parse_phy_test_params(struct msm_dp_link_private *link)
 {
 	u8 data;
 	ssize_t rlen;
@@ -590,7 +589,7 @@
 		return rlen;
 	}
 
-	link->dp_link.phy_params.phy_test_pattern_sel = data & 0x07;
+	link->msm_dp_link.phy_params.phy_test_pattern_sel = data & 0x07;
 
 	drm_dbg_dp(link->drm_dev, "phy_test_pattern_sel = 0x%x\n", data);
 
@@ -609,12 +608,12 @@
 }
 
 /**
- * dp_link_is_video_audio_test_requested() - checks for audio/video link request
+ * msm_dp_link_is_video_audio_test_requested() - checks for audio/video link request
  * @link: link requested by the sink
  *
  * Returns true if the requested link is a permitted audio/video link.
  */
-static bool dp_link_is_video_audio_test_requested(u32 link)
+static bool msm_dp_link_is_video_audio_test_requested(u32 link)
 {
 	u8 video_audio_test = (DP_TEST_LINK_VIDEO_PATTERN |
 				DP_TEST_LINK_AUDIO_PATTERN |
@@ -625,13 +624,13 @@
 }
 
 /**
- * dp_link_parse_request() - parses link request parameters from sink
+ * msm_dp_link_parse_request() - parses link request parameters from sink
  * @link: Display Port Driver data
  *
  * Parses the DPCD to check if an automated link is requested (Byte 0x201),
  * and what type of link automation is being requested (Byte 0x218).
  */
-static int dp_link_parse_request(struct dp_link_private *link)
+static int msm_dp_link_parse_request(struct msm_dp_link_private *link)
 {
 	int ret = 0;
 	u8 data;
@@ -673,27 +672,27 @@
 	drm_dbg_dp(link->drm_dev, "Test:(0x%x) requested\n", data);
 	link->request.test_requested = data;
 	if (link->request.test_requested == DP_TEST_LINK_PHY_TEST_PATTERN) {
-		ret = dp_link_parse_phy_test_params(link);
+		ret = msm_dp_link_parse_phy_test_params(link);
 		if (ret)
 			goto end;
-		ret = dp_link_parse_link_training_params(link);
+		ret = msm_dp_link_parse_link_training_params(link);
 		if (ret)
 			goto end;
 	}
 
 	if (link->request.test_requested == DP_TEST_LINK_TRAINING) {
-		ret = dp_link_parse_link_training_params(link);
+		ret = msm_dp_link_parse_link_training_params(link);
 		if (ret)
 			goto end;
 	}
 
-	if (dp_link_is_video_audio_test_requested(
+	if (msm_dp_link_is_video_audio_test_requested(
 			link->request.test_requested)) {
-		ret = dp_link_parse_video_pattern_params(link);
+		ret = msm_dp_link_parse_video_pattern_params(link);
 		if (ret)
 			goto end;
 
-		ret = dp_link_parse_audio_pattern_params(link);
+		ret = msm_dp_link_parse_audio_pattern_params(link);
 	}
 end:
 	/*
@@ -701,29 +700,29 @@
 	 * a DP_TEST_NAK.
 	 */
 	if (ret) {
-		link->dp_link.test_response = DP_TEST_NAK;
+		link->msm_dp_link.test_response = DP_TEST_NAK;
 	} else {
 		if (link->request.test_requested != DP_TEST_LINK_EDID_READ)
-			link->dp_link.test_response = DP_TEST_ACK;
+			link->msm_dp_link.test_response = DP_TEST_ACK;
 		else
-			link->dp_link.test_response =
+			link->msm_dp_link.test_response =
 				DP_TEST_EDID_CHECKSUM_WRITE;
 	}
 
 	return ret;
 }
 
-static int dp_link_parse_sink_status_field(struct dp_link_private *link)
+static int msm_dp_link_parse_sink_status_field(struct msm_dp_link_private *link)
 {
 	int len;
 
-	link->prev_sink_count = link->dp_link.sink_count;
+	link->prev_sink_count = link->msm_dp_link.sink_count;
 	len = drm_dp_read_sink_count(link->aux);
 	if (len < 0) {
 		DRM_ERROR("DP parse sink count failed\n");
 		return len;
 	}
-	link->dp_link.sink_count = len;
+	link->msm_dp_link.sink_count = len;
 
 	len = drm_dp_dpcd_read_link_status(link->aux,
 		link->link_status);
@@ -732,11 +731,11 @@
 		return len;
 	}
 
-	return dp_link_parse_request(link);
+	return msm_dp_link_parse_request(link);
 }
 
 /**
- * dp_link_process_link_training_request() - processes new training requests
+ * msm_dp_link_process_link_training_request() - processes new training requests
  * @link: Display Port link data
  *
  * This function will handle new link training requests that are initiated by
@@ -746,7 +745,7 @@
  * The function will return 0 if a link training request has been processed,
  * otherwise it will return -EINVAL.
  */
-static int dp_link_process_link_training_request(struct dp_link_private *link)
+static int msm_dp_link_process_link_training_request(struct msm_dp_link_private *link)
 {
 	if (link->request.test_requested != DP_TEST_LINK_TRAINING)
 		return -EINVAL;
@@ -757,78 +756,76 @@
 			link->request.test_link_rate,
 			link->request.test_lane_count);
 
-	link->dp_link.link_params.num_lanes = link->request.test_lane_count;
-	link->dp_link.link_params.rate =
+	link->msm_dp_link.link_params.num_lanes = link->request.test_lane_count;
+	link->msm_dp_link.link_params.rate =
 		drm_dp_bw_code_to_link_rate(link->request.test_link_rate);
 
 	return 0;
 }
 
-bool dp_link_send_test_response(struct dp_link *dp_link)
+bool msm_dp_link_send_test_response(struct msm_dp_link *msm_dp_link)
 {
-	struct dp_link_private *link = NULL;
+	struct msm_dp_link_private *link = NULL;
 	int ret = 0;
 
-	if (!dp_link) {
+	if (!msm_dp_link) {
 		DRM_ERROR("invalid input\n");
 		return false;
 	}
 
-	link = container_of(dp_link, struct dp_link_private, dp_link);
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
 
 	ret = drm_dp_dpcd_writeb(link->aux, DP_TEST_RESPONSE,
-			dp_link->test_response);
+			msm_dp_link->test_response);
 
 	return ret == 1;
 }
 
-int dp_link_psm_config(struct dp_link *dp_link,
-			      struct dp_link_info *link_info, bool enable)
+int msm_dp_link_psm_config(struct msm_dp_link *msm_dp_link,
+			      struct msm_dp_link_info *link_info, bool enable)
 {
-	struct dp_link_private *link = NULL;
+	struct msm_dp_link_private *link = NULL;
 	int ret = 0;
 
-	if (!dp_link) {
+	if (!msm_dp_link) {
 		DRM_ERROR("invalid params\n");
 		return -EINVAL;
 	}
 
-	link = container_of(dp_link, struct dp_link_private, dp_link);
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
 
 	mutex_lock(&link->psm_mutex);
 	if (enable)
-		ret = dp_aux_link_power_down(link->aux, link_info);
+		ret = msm_dp_aux_link_power_down(link->aux, link_info);
 	else
-		ret = dp_aux_link_power_up(link->aux, link_info);
+		ret = msm_dp_aux_link_power_up(link->aux, link_info);
 
 	if (ret)
 		DRM_ERROR("Failed to %s low power mode\n", enable ?
 							"enter" : "exit");
-	else
-		dp_link->psm_enabled = enable;
 
 	mutex_unlock(&link->psm_mutex);
 	return ret;
 }
 
-bool dp_link_send_edid_checksum(struct dp_link *dp_link, u8 checksum)
+bool msm_dp_link_send_edid_checksum(struct msm_dp_link *msm_dp_link, u8 checksum)
 {
-	struct dp_link_private *link = NULL;
+	struct msm_dp_link_private *link = NULL;
 	int ret = 0;
 
-	if (!dp_link) {
+	if (!msm_dp_link) {
 		DRM_ERROR("invalid input\n");
 		return false;
 	}
 
-	link = container_of(dp_link, struct dp_link_private, dp_link);
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
 
 	ret = drm_dp_dpcd_writeb(link->aux, DP_TEST_EDID_CHECKSUM,
 						checksum);
 	return ret == 1;
 }
 
-static void dp_link_parse_vx_px(struct dp_link_private *link)
+static void msm_dp_link_parse_vx_px(struct msm_dp_link_private *link)
 {
 	drm_dbg_dp(link->drm_dev, "vx: 0=%d, 1=%d, 2=%d, 3=%d\n",
 		drm_dp_get_adjust_request_voltage(link->link_status, 0),
@@ -848,31 +845,31 @@
 	 */
 	drm_dbg_dp(link->drm_dev,
 			 "Current: v_level = 0x%x, p_level = 0x%x\n",
-			link->dp_link.phy_params.v_level,
-			link->dp_link.phy_params.p_level);
-	link->dp_link.phy_params.v_level =
+			link->msm_dp_link.phy_params.v_level,
+			link->msm_dp_link.phy_params.p_level);
+	link->msm_dp_link.phy_params.v_level =
 		drm_dp_get_adjust_request_voltage(link->link_status, 0);
-	link->dp_link.phy_params.p_level =
+	link->msm_dp_link.phy_params.p_level =
 		drm_dp_get_adjust_request_pre_emphasis(link->link_status, 0);
 
-	link->dp_link.phy_params.p_level >>= DP_TRAIN_PRE_EMPHASIS_SHIFT;
+	link->msm_dp_link.phy_params.p_level >>= DP_TRAIN_PRE_EMPHASIS_SHIFT;
 
 	drm_dbg_dp(link->drm_dev,
 			"Requested: v_level = 0x%x, p_level = 0x%x\n",
-			link->dp_link.phy_params.v_level,
-			link->dp_link.phy_params.p_level);
+			link->msm_dp_link.phy_params.v_level,
+			link->msm_dp_link.phy_params.p_level);
 }
 
 /**
- * dp_link_process_phy_test_pattern_request() - process new phy link requests
+ * msm_dp_link_process_phy_test_pattern_request() - process new phy link requests
  * @link: Display Port Driver data
  *
  * This function will handle new phy link pattern requests that are initiated
  * by the sink. The function will return 0 if a phy link pattern has been
  * processed, otherwise it will return -EINVAL.
  */
-static int dp_link_process_phy_test_pattern_request(
-		struct dp_link_private *link)
+static int msm_dp_link_process_phy_test_pattern_request(
+		struct msm_dp_link_private *link)
 {
 	if (!(link->request.test_requested & DP_TEST_LINK_PHY_TEST_PATTERN)) {
 		drm_dbg_dp(link->drm_dev, "no phy test\n");
@@ -889,24 +886,24 @@
 
 	drm_dbg_dp(link->drm_dev,
 			"Current: rate = 0x%x, lane count = 0x%x\n",
-			link->dp_link.link_params.rate,
-			link->dp_link.link_params.num_lanes);
+			link->msm_dp_link.link_params.rate,
+			link->msm_dp_link.link_params.num_lanes);
 
 	drm_dbg_dp(link->drm_dev,
 			"Requested: rate = 0x%x, lane count = 0x%x\n",
 			link->request.test_link_rate,
 			link->request.test_lane_count);
 
-	link->dp_link.link_params.num_lanes = link->request.test_lane_count;
-	link->dp_link.link_params.rate =
+	link->msm_dp_link.link_params.num_lanes = link->request.test_lane_count;
+	link->msm_dp_link.link_params.rate =
 		drm_dp_bw_code_to_link_rate(link->request.test_link_rate);
 
-	dp_link_parse_vx_px(link);
+	msm_dp_link_parse_vx_px(link);
 
 	return 0;
 }
 
-static bool dp_link_read_psr_error_status(struct dp_link_private *link)
+static bool msm_dp_link_read_psr_error_status(struct msm_dp_link_private *link)
 {
 	u8 status;
 
@@ -924,7 +921,7 @@
 	return true;
 }
 
-static bool dp_link_psr_capability_changed(struct dp_link_private *link)
+static bool msm_dp_link_psr_capability_changed(struct msm_dp_link_private *link)
 {
 	u8 status;
 
@@ -944,7 +941,7 @@
 }
 
 /**
- * dp_link_process_link_status_update() - processes link status updates
+ * msm_dp_link_process_link_status_update() - processes link status updates
  * @link: Display Port link module data
  *
  * This function will check for changes in the link status, e.g. clock
@@ -954,13 +951,13 @@
  * The function will return 0 if the a link status update has been processed,
  * otherwise it will return -EINVAL.
  */
-static int dp_link_process_link_status_update(struct dp_link_private *link)
+static int msm_dp_link_process_link_status_update(struct msm_dp_link_private *link)
 {
 	bool channel_eq_done = drm_dp_channel_eq_ok(link->link_status,
-			link->dp_link.link_params.num_lanes);
+			link->msm_dp_link.link_params.num_lanes);
 
 	bool clock_recovery_done = drm_dp_clock_recovery_ok(link->link_status,
-			link->dp_link.link_params.num_lanes);
+			link->msm_dp_link.link_params.num_lanes);
 
 	drm_dbg_dp(link->drm_dev,
 		       "channel_eq_done = %d, clock_recovery_done = %d\n",
@@ -973,7 +970,7 @@
 }
 
 /**
- * dp_link_process_ds_port_status_change() - process port status changes
+ * msm_dp_link_process_ds_port_status_change() - process port status changes
  * @link: Display Port Driver data
  *
  * This function will handle downstream port updates that are initiated by
@@ -983,122 +980,122 @@
  * The function will return 0 if a downstream port update has been
  * processed, otherwise it will return -EINVAL.
  */
-static int dp_link_process_ds_port_status_change(struct dp_link_private *link)
+static int msm_dp_link_process_ds_port_status_change(struct msm_dp_link_private *link)
 {
 	if (get_link_status(link->link_status, DP_LANE_ALIGN_STATUS_UPDATED) &
 					DP_DOWNSTREAM_PORT_STATUS_CHANGED)
 		goto reset;
 
-	if (link->prev_sink_count == link->dp_link.sink_count)
+	if (link->prev_sink_count == link->msm_dp_link.sink_count)
 		return -EINVAL;
 
 reset:
 	/* reset prev_sink_count */
-	link->prev_sink_count = link->dp_link.sink_count;
+	link->prev_sink_count = link->msm_dp_link.sink_count;
 
 	return 0;
 }
 
-static bool dp_link_is_video_pattern_requested(struct dp_link_private *link)
+static bool msm_dp_link_is_video_pattern_requested(struct msm_dp_link_private *link)
 {
 	return (link->request.test_requested & DP_TEST_LINK_VIDEO_PATTERN)
 		&& !(link->request.test_requested &
 		DP_TEST_LINK_AUDIO_DISABLED_VIDEO);
 }
 
-static bool dp_link_is_audio_pattern_requested(struct dp_link_private *link)
+static bool msm_dp_link_is_audio_pattern_requested(struct msm_dp_link_private *link)
 {
 	return (link->request.test_requested & DP_TEST_LINK_AUDIO_PATTERN);
 }
 
-static void dp_link_reset_data(struct dp_link_private *link)
+static void msm_dp_link_reset_data(struct msm_dp_link_private *link)
 {
-	link->request = (const struct dp_link_request){ 0 };
-	link->dp_link.test_video = (const struct dp_link_test_video){ 0 };
-	link->dp_link.test_video.test_bit_depth = DP_TEST_BIT_DEPTH_UNKNOWN;
-	link->dp_link.test_audio = (const struct dp_link_test_audio){ 0 };
-	link->dp_link.phy_params.phy_test_pattern_sel = 0;
-	link->dp_link.sink_request = 0;
-	link->dp_link.test_response = 0;
+	link->request = (const struct msm_dp_link_request){ 0 };
+	link->msm_dp_link.test_video = (const struct msm_dp_link_test_video){ 0 };
+	link->msm_dp_link.test_video.test_bit_depth = DP_TEST_BIT_DEPTH_UNKNOWN;
+	link->msm_dp_link.test_audio = (const struct msm_dp_link_test_audio){ 0 };
+	link->msm_dp_link.phy_params.phy_test_pattern_sel = 0;
+	link->msm_dp_link.sink_request = 0;
+	link->msm_dp_link.test_response = 0;
 }
 
 /**
- * dp_link_process_request() - handle HPD IRQ transition to HIGH
- * @dp_link: pointer to link module data
+ * msm_dp_link_process_request() - handle HPD IRQ transition to HIGH
+ * @msm_dp_link: pointer to link module data
  *
  * This function will handle the HPD IRQ state transitions from LOW to HIGH
  * (including cases when there are back to back HPD IRQ HIGH) indicating
  * the start of a new link training request or sink status update.
  */
-int dp_link_process_request(struct dp_link *dp_link)
+int msm_dp_link_process_request(struct msm_dp_link *msm_dp_link)
 {
 	int ret = 0;
-	struct dp_link_private *link;
+	struct msm_dp_link_private *link;
 
-	if (!dp_link) {
+	if (!msm_dp_link) {
 		DRM_ERROR("invalid input\n");
 		return -EINVAL;
 	}
 
-	link = container_of(dp_link, struct dp_link_private, dp_link);
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
 
-	dp_link_reset_data(link);
+	msm_dp_link_reset_data(link);
 
-	ret = dp_link_parse_sink_status_field(link);
+	ret = msm_dp_link_parse_sink_status_field(link);
 	if (ret)
 		return ret;
 
 	if (link->request.test_requested == DP_TEST_LINK_EDID_READ) {
-		dp_link->sink_request |= DP_TEST_LINK_EDID_READ;
-	} else if (!dp_link_process_ds_port_status_change(link)) {
-		dp_link->sink_request |= DS_PORT_STATUS_CHANGED;
-	} else if (!dp_link_process_link_training_request(link)) {
-		dp_link->sink_request |= DP_TEST_LINK_TRAINING;
-	} else if (!dp_link_process_phy_test_pattern_request(link)) {
-		dp_link->sink_request |= DP_TEST_LINK_PHY_TEST_PATTERN;
-	} else if (dp_link_read_psr_error_status(link)) {
+		msm_dp_link->sink_request |= DP_TEST_LINK_EDID_READ;
+	} else if (!msm_dp_link_process_ds_port_status_change(link)) {
+		msm_dp_link->sink_request |= DS_PORT_STATUS_CHANGED;
+	} else if (!msm_dp_link_process_link_training_request(link)) {
+		msm_dp_link->sink_request |= DP_TEST_LINK_TRAINING;
+	} else if (!msm_dp_link_process_phy_test_pattern_request(link)) {
+		msm_dp_link->sink_request |= DP_TEST_LINK_PHY_TEST_PATTERN;
+	} else if (msm_dp_link_read_psr_error_status(link)) {
 		DRM_ERROR("PSR IRQ_HPD received\n");
-	} else if (dp_link_psr_capability_changed(link)) {
+	} else if (msm_dp_link_psr_capability_changed(link)) {
 		drm_dbg_dp(link->drm_dev, "PSR Capability changed\n");
 	} else {
-		ret = dp_link_process_link_status_update(link);
+		ret = msm_dp_link_process_link_status_update(link);
 		if (!ret) {
-			dp_link->sink_request |= DP_LINK_STATUS_UPDATED;
+			msm_dp_link->sink_request |= DP_LINK_STATUS_UPDATED;
 		} else {
-			if (dp_link_is_video_pattern_requested(link)) {
+			if (msm_dp_link_is_video_pattern_requested(link)) {
 				ret = 0;
-				dp_link->sink_request |= DP_TEST_LINK_VIDEO_PATTERN;
+				msm_dp_link->sink_request |= DP_TEST_LINK_VIDEO_PATTERN;
 			}
-			if (dp_link_is_audio_pattern_requested(link)) {
-				dp_link->sink_request |= DP_TEST_LINK_AUDIO_PATTERN;
+			if (msm_dp_link_is_audio_pattern_requested(link)) {
+				msm_dp_link->sink_request |= DP_TEST_LINK_AUDIO_PATTERN;
 				ret = -EINVAL;
 			}
 		}
 	}
 
 	drm_dbg_dp(link->drm_dev, "sink request=%#x\n",
-				dp_link->sink_request);
+				msm_dp_link->sink_request);
 	return ret;
 }
 
-int dp_link_get_colorimetry_config(struct dp_link *dp_link)
+int msm_dp_link_get_colorimetry_config(struct msm_dp_link *msm_dp_link)
 {
 	u32 cc = DP_MISC0_COLORIMERY_CFG_LEGACY_RGB;
-	struct dp_link_private *link;
+	struct msm_dp_link_private *link;
 
-	if (!dp_link) {
+	if (!msm_dp_link) {
 		DRM_ERROR("invalid input\n");
 		return -EINVAL;
 	}
 
-	link = container_of(dp_link, struct dp_link_private, dp_link);
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
 
 	/*
 	 * Unless a video pattern CTS test is ongoing, use RGB_VESA
 	 * Only RGB_VESA and RGB_CEA supported for now
 	 */
-	if (dp_link_is_video_pattern_requested(link)) {
-		if (link->dp_link.test_video.test_dyn_range &
+	if (msm_dp_link_is_video_pattern_requested(link)) {
+		if (link->msm_dp_link.test_video.test_dyn_range &
 					DP_TEST_DYNAMIC_RANGE_CEA)
 			cc = DP_MISC0_COLORIMERY_CFG_CEA_RGB;
 	}
@@ -1106,21 +1103,22 @@
 	return cc;
 }
 
-int dp_link_adjust_levels(struct dp_link *dp_link, u8 *link_status)
+int msm_dp_link_adjust_levels(struct msm_dp_link *msm_dp_link, u8 *link_status)
 {
 	int i;
+	u8 max_p_level;
 	int v_max = 0, p_max = 0;
-	struct dp_link_private *link;
+	struct msm_dp_link_private *link;
 
-	if (!dp_link) {
+	if (!msm_dp_link) {
 		DRM_ERROR("invalid input\n");
 		return -EINVAL;
 	}
 
-	link = container_of(dp_link, struct dp_link_private, dp_link);
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
 
 	/* use the max level across lanes */
-	for (i = 0; i < dp_link->link_params.num_lanes; i++) {
+	for (i = 0; i < msm_dp_link->link_params.num_lanes; i++) {
 		u8 data_v = drm_dp_get_adjust_request_voltage(link_status, i);
 		u8 data_p = drm_dp_get_adjust_request_pre_emphasis(link_status,
 									 i);
@@ -1133,57 +1131,56 @@
 			p_max = data_p;
 	}
 
-	dp_link->phy_params.v_level = v_max >> DP_TRAIN_VOLTAGE_SWING_SHIFT;
-	dp_link->phy_params.p_level = p_max >> DP_TRAIN_PRE_EMPHASIS_SHIFT;
+	msm_dp_link->phy_params.v_level = v_max >> DP_TRAIN_VOLTAGE_SWING_SHIFT;
+	msm_dp_link->phy_params.p_level = p_max >> DP_TRAIN_PRE_EMPHASIS_SHIFT;
 
 	/**
 	 * Adjust the voltage swing and pre-emphasis level combination to within
 	 * the allowable range.
 	 */
-	if (dp_link->phy_params.v_level > DP_TRAIN_VOLTAGE_SWING_MAX) {
+	if (msm_dp_link->phy_params.v_level > DP_TRAIN_LEVEL_MAX) {
 		drm_dbg_dp(link->drm_dev,
 			"Requested vSwingLevel=%d, change to %d\n",
-			dp_link->phy_params.v_level,
-			DP_TRAIN_VOLTAGE_SWING_MAX);
-		dp_link->phy_params.v_level = DP_TRAIN_VOLTAGE_SWING_MAX;
+			msm_dp_link->phy_params.v_level,
+			DP_TRAIN_LEVEL_MAX);
+		msm_dp_link->phy_params.v_level = DP_TRAIN_LEVEL_MAX;
 	}
 
-	if (dp_link->phy_params.p_level > DP_TRAIN_PRE_EMPHASIS_MAX) {
+	if (msm_dp_link->phy_params.p_level > DP_TRAIN_LEVEL_MAX) {
 		drm_dbg_dp(link->drm_dev,
 			"Requested preEmphasisLevel=%d, change to %d\n",
-			dp_link->phy_params.p_level,
-			DP_TRAIN_PRE_EMPHASIS_MAX);
-		dp_link->phy_params.p_level = DP_TRAIN_PRE_EMPHASIS_MAX;
+			msm_dp_link->phy_params.p_level,
+			DP_TRAIN_LEVEL_MAX);
+		msm_dp_link->phy_params.p_level = DP_TRAIN_LEVEL_MAX;
 	}
 
-	if ((dp_link->phy_params.p_level > DP_TRAIN_PRE_EMPHASIS_LVL_1)
-		&& (dp_link->phy_params.v_level ==
-			DP_TRAIN_VOLTAGE_SWING_LVL_2)) {
+	max_p_level = DP_TRAIN_LEVEL_MAX - msm_dp_link->phy_params.v_level;
+	if (msm_dp_link->phy_params.p_level > max_p_level) {
 		drm_dbg_dp(link->drm_dev,
 			"Requested preEmphasisLevel=%d, change to %d\n",
-			dp_link->phy_params.p_level,
-			DP_TRAIN_PRE_EMPHASIS_LVL_1);
-		dp_link->phy_params.p_level = DP_TRAIN_PRE_EMPHASIS_LVL_1;
+			msm_dp_link->phy_params.p_level,
+			max_p_level);
+		msm_dp_link->phy_params.p_level = max_p_level;
 	}
 
 	drm_dbg_dp(link->drm_dev, "adjusted: v_level=%d, p_level=%d\n",
-		dp_link->phy_params.v_level, dp_link->phy_params.p_level);
+		msm_dp_link->phy_params.v_level, msm_dp_link->phy_params.p_level);
 
 	return 0;
 }
 
-void dp_link_reset_phy_params_vx_px(struct dp_link *dp_link)
+void msm_dp_link_reset_phy_params_vx_px(struct msm_dp_link *msm_dp_link)
 {
-	dp_link->phy_params.v_level = 0;
-	dp_link->phy_params.p_level = 0;
+	msm_dp_link->phy_params.v_level = 0;
+	msm_dp_link->phy_params.p_level = 0;
 }
 
-u32 dp_link_get_test_bits_depth(struct dp_link *dp_link, u32 bpp)
+u32 msm_dp_link_get_test_bits_depth(struct msm_dp_link *msm_dp_link, u32 bpp)
 {
 	u32 tbd;
-	struct dp_link_private *link;
+	struct msm_dp_link_private *link;
 
-	link = container_of(dp_link, struct dp_link_private, dp_link);
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
 
 	/*
 	 * Few simplistic rules and assumptions made here:
@@ -1212,10 +1209,10 @@
 	return tbd;
 }
 
-struct dp_link *dp_link_get(struct device *dev, struct drm_dp_aux *aux)
+struct msm_dp_link *msm_dp_link_get(struct device *dev, struct drm_dp_aux *aux)
 {
-	struct dp_link_private *link;
-	struct dp_link *dp_link;
+	struct msm_dp_link_private *link;
+	struct msm_dp_link *msm_dp_link;
 
 	if (!dev || !aux) {
 		DRM_ERROR("invalid input\n");
@@ -1226,11 +1223,10 @@
 	if (!link)
 		return ERR_PTR(-ENOMEM);
 
-	link->dev   = dev;
 	link->aux   = aux;
 
 	mutex_init(&link->psm_mutex);
-	dp_link = &link->dp_link;
+	msm_dp_link = &link->msm_dp_link;
 
-	return dp_link;
+	return msm_dp_link;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_link.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_link.h
@@ -12,28 +12,16 @@
 #define DP_TEST_BIT_DEPTH_UNKNOWN 0xFFFFFFFF
 #define DP_LINK_CAP_ENHANCED_FRAMING (1 << 0)
 
-struct dp_link_info {
+struct msm_dp_link_info {
 	unsigned char revision;
 	unsigned int rate;
 	unsigned int num_lanes;
 	unsigned long capabilities;
 };
 
-enum dp_link_voltage_level {
-	DP_TRAIN_VOLTAGE_SWING_LVL_0	= 0,
-	DP_TRAIN_VOLTAGE_SWING_LVL_1	= 1,
-	DP_TRAIN_VOLTAGE_SWING_LVL_2	= 2,
-	DP_TRAIN_VOLTAGE_SWING_MAX	= DP_TRAIN_VOLTAGE_SWING_LVL_2,
-};
-
-enum dp_link_preemaphasis_level {
-	DP_TRAIN_PRE_EMPHASIS_LVL_0	= 0,
-	DP_TRAIN_PRE_EMPHASIS_LVL_1	= 1,
-	DP_TRAIN_PRE_EMPHASIS_LVL_2	= 2,
-	DP_TRAIN_PRE_EMPHASIS_MAX	= DP_TRAIN_PRE_EMPHASIS_LVL_2,
-};
+#define DP_TRAIN_LEVEL_MAX	3
 
-struct dp_link_test_video {
+struct msm_dp_link_test_video {
 	u32 test_video_pattern;
 	u32 test_bit_depth;
 	u32 test_dyn_range;
@@ -51,7 +39,7 @@
 	u32 test_rr_n;
 };
 
-struct dp_link_test_audio {
+struct msm_dp_link_test_audio {
 	u32 test_audio_sampling_rate;
 	u32 test_audio_channel_count;
 	u32 test_audio_pattern_type;
@@ -65,22 +53,21 @@
 	u32 test_audio_period_ch_8;
 };
 
-struct dp_link_phy_params {
+struct msm_dp_link_phy_params {
 	u32 phy_test_pattern_sel;
 	u8 v_level;
 	u8 p_level;
 };
 
-struct dp_link {
+struct msm_dp_link {
 	u32 sink_request;
 	u32 test_response;
-	bool psm_enabled;
 
 	u8 sink_count;
-	struct dp_link_test_video test_video;
-	struct dp_link_test_audio test_audio;
-	struct dp_link_phy_params phy_params;
-	struct dp_link_info link_params;
+	struct msm_dp_link_test_video test_video;
+	struct msm_dp_link_test_audio test_audio;
+	struct msm_dp_link_phy_params phy_params;
+	struct msm_dp_link_info link_params;
 };
 
 /**
@@ -91,7 +78,7 @@
  * git bit depth value. This function assumes that bit depth has
  * already been validated.
  */
-static inline u32 dp_link_bit_depth_to_bpp(u32 tbd)
+static inline u32 msm_dp_link_bit_depth_to_bpp(u32 tbd)
 {
 	/*
 	 * Few simplistic rules and assumptions made here:
@@ -112,45 +99,22 @@
 	}
 }
 
-/**
- * dp_test_bit_depth_to_bpc() - convert test bit depth to bpc
- * @tbd: test bit depth
- *
- * Returns the bits per comp (bpc) to be used corresponding to the
- * bit depth value. This function assumes that bit depth has
- * already been validated.
- */
-static inline u32 dp_link_bit_depth_to_bpc(u32 tbd)
-{
-	switch (tbd) {
-	case DP_TEST_BIT_DEPTH_6:
-		return 6;
-	case DP_TEST_BIT_DEPTH_8:
-		return 8;
-	case DP_TEST_BIT_DEPTH_10:
-		return 10;
-	case DP_TEST_BIT_DEPTH_UNKNOWN:
-	default:
-		return 0;
-	}
-}
-
-void dp_link_reset_phy_params_vx_px(struct dp_link *dp_link);
-u32 dp_link_get_test_bits_depth(struct dp_link *dp_link, u32 bpp);
-int dp_link_process_request(struct dp_link *dp_link);
-int dp_link_get_colorimetry_config(struct dp_link *dp_link);
-int dp_link_adjust_levels(struct dp_link *dp_link, u8 *link_status);
-bool dp_link_send_test_response(struct dp_link *dp_link);
-int dp_link_psm_config(struct dp_link *dp_link,
-		struct dp_link_info *link_info, bool enable);
-bool dp_link_send_edid_checksum(struct dp_link *dp_link, u8 checksum);
+void msm_dp_link_reset_phy_params_vx_px(struct msm_dp_link *msm_dp_link);
+u32 msm_dp_link_get_test_bits_depth(struct msm_dp_link *msm_dp_link, u32 bpp);
+int msm_dp_link_process_request(struct msm_dp_link *msm_dp_link);
+int msm_dp_link_get_colorimetry_config(struct msm_dp_link *msm_dp_link);
+int msm_dp_link_adjust_levels(struct msm_dp_link *msm_dp_link, u8 *link_status);
+bool msm_dp_link_send_test_response(struct msm_dp_link *msm_dp_link);
+int msm_dp_link_psm_config(struct msm_dp_link *msm_dp_link,
+		struct msm_dp_link_info *link_info, bool enable);
+bool msm_dp_link_send_edid_checksum(struct msm_dp_link *msm_dp_link, u8 checksum);
 
 /**
- * dp_link_get() - get the functionalities of dp test module
+ * msm_dp_link_get() - get the functionalities of dp test module
  *
  *
- * return: a pointer to dp_link struct
+ * return: a pointer to msm_dp_link struct
  */
-struct dp_link *dp_link_get(struct device *dev, struct drm_dp_aux *aux);
+struct msm_dp_link *msm_dp_link_get(struct device *dev, struct drm_dp_aux *aux);
 
 #endif /* _DP_LINK_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_mst_drm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_mst_drm.c
@@ -0,0 +1,1097 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <drm/drm_edid.h>
+#include "dp_mst_drm.h"
+
+static struct drm_private_state *msm_dp_mst_duplicate_bridge_state(struct drm_private_obj *obj)
+{
+	struct msm_dp_mst_bridge_state *state;
+
+	state = kmemdup(obj->state, sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return NULL;
+
+	__drm_atomic_helper_private_obj_duplicate_state(obj, &state->base);
+
+	return &state->base;
+}
+
+static void msm_dp_mst_destroy_bridge_state(struct drm_private_obj *obj,
+					    struct drm_private_state *state)
+{
+	struct msm_dp_mst_bridge_state *priv_state =
+		to_msm_dp_mst_bridge_priv_state(state);
+
+	kfree(priv_state);
+}
+
+static const struct drm_private_state_funcs msm_dp_mst_bridge_state_funcs = {
+	.atomic_duplicate_state = msm_dp_mst_duplicate_bridge_state,
+	.atomic_destroy_state = msm_dp_mst_destroy_bridge_state,
+};
+
+/**
+ * dp_mst_find_vcpi_slots() - Find VCPI slots for this PBN value
+ * @mgr: manager to use
+ * @pbn: payload bandwidth to convert into slots.
+ *
+ * Calculate the number of VCPI slots that will be required for the given PBN
+ * value.
+ *
+ * RETURNS:
+ * The total slots required for this port, or error.
+ */
+static int msm_dp_mst_find_vcpi_slots(struct drm_dp_mst_topology_mgr *mgr, int pbn)
+{
+	int num_slots;
+	struct drm_dp_mst_topology_state *state;
+
+	state = to_drm_dp_mst_topology_state(mgr->base.state);
+	num_slots = DIV_ROUND_UP(pbn, state->pbn_div.full);
+
+	/* max. time slots - one slot for MTP header */
+	if (num_slots > 63)
+		return -ENOSPC;
+	return num_slots;
+}
+
+static int msm_dp_mst_calc_pbn_mode(struct drm_display_mode *mode, u32 bpp)
+{
+	int pbn;
+
+	// note : we can even drop dp_mst_calc_pbn_mode and just use this
+	// directly
+	pbn = drm_dp_calc_pbn_mode(mode->clock, bpp << 4);
+
+	return pbn;
+}
+
+static int msm_dp_mst_get_mst_pbn_div(struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_link_info *link_info;
+
+	link_info = &msm_dp_panel->link_info;
+
+	return link_info->rate * link_info->num_lanes / 54000;
+}
+
+static int _msm_dp_mst_compute_config(struct drm_atomic_state *state,
+				      struct msm_dp_mst *mst, struct drm_connector *connector,
+				      struct drm_display_mode *mode)
+{
+	int slots = 0, pbn;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	int rc = 0;
+	struct drm_dp_mst_topology_state *mst_state;
+
+	struct msm_dp *dp_display = mst->msm_dp;
+	u32 bpp;
+
+	bpp = connector->display_info.bpc * 3;
+	//default to 24
+	if (!bpp)
+		bpp = 24;
+
+	pbn = msm_dp_mst_calc_pbn_mode(mode, bpp);
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+
+	if (!mst_state->pbn_div.full)
+		mst_state->pbn_div.full = msm_dp_mst_get_mst_pbn_div(mst_conn->dp_panel);
+
+	rc = drm_dp_atomic_find_time_slots(state, &mst->mst_mgr, mst_conn->mst_port, pbn);
+	if (rc < 0) {
+		DRM_ERROR("conn:%d failed to find vcpi slots. pbn:%d, rc:%d\n",
+			  connector->base.id, pbn, rc);
+		goto end;
+	}
+
+	slots = rc;
+
+	rc = drm_dp_mst_atomic_check(state);
+	if (rc) {
+		DRM_ERROR("conn:%d mst atomic check failed: rc=%d\n", connector->base.id, rc);
+		slots = 0;
+		goto end;
+	}
+
+	drm_dbg_dp(dp_display->drm_dev, "conn:%d pbn:%d slots:%d rc:%d\n",
+		   connector->base.id, pbn, slots, rc);
+
+end:
+	return (rc < 0 ? rc : slots);
+}
+
+static void _msm_dp_mst_update_timeslots(struct msm_dp_mst *mst,
+					 struct msm_dp_mst_bridge *mst_bridge,
+					 struct drm_dp_mst_port *port)
+{
+	int i;
+	struct msm_dp_mst_bridge *msm_dp_bridge;
+	struct drm_dp_mst_topology_state *mst_state;
+	struct drm_dp_mst_atomic_payload *payload;
+	int prev_start = 0;
+	int prev_slots = 0;
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+	payload = drm_atomic_get_mst_payload_state(mst_state, port);
+
+	if (!payload) {
+		DRM_ERROR("mst bridge [%d] update_timeslots failed, null payload\n",
+			  mst_bridge->id);
+		return;
+	}
+
+	for (i = 0; i < mst->max_streams; i++) {
+		msm_dp_bridge = &mst->mst_bridge[i];
+		if (mst_bridge == msm_dp_bridge) {
+			/*
+			 * When a payload was removed make sure to move any payloads after it
+			 * to the left so all payloads are aligned to the left.
+			 */
+			if (payload->vc_start_slot < 0) {
+				// cache the payload
+				prev_start = msm_dp_bridge->start_slot;
+				prev_slots = msm_dp_bridge->num_slots;
+				msm_dp_bridge->pbn = 0;
+				msm_dp_bridge->start_slot = 1;
+				msm_dp_bridge->num_slots = 0;
+				msm_dp_bridge->vcpi = 0;
+			} else { //add payload
+				msm_dp_bridge->pbn = payload->pbn;
+				msm_dp_bridge->start_slot = payload->vc_start_slot;
+				msm_dp_bridge->num_slots = payload->time_slots;
+				msm_dp_bridge->vcpi = payload->vcpi;
+			}
+		}
+	}
+
+	// Now commit all the updated payloads
+	for (i = 0; i < mst->max_streams; i++) {
+		msm_dp_bridge = &mst->mst_bridge[i];
+
+		//Shift payloads to the left if there was a removed payload.
+		if (payload->vc_start_slot < 0 && msm_dp_bridge->start_slot > prev_start)
+			msm_dp_bridge->start_slot -= prev_slots;
+
+		msm_dp_display_set_stream_info(mst->msm_dp, msm_dp_bridge->msm_dp_panel,
+					       msm_dp_bridge->id, msm_dp_bridge->start_slot,
+					       msm_dp_bridge->num_slots,
+					       msm_dp_bridge->pbn, msm_dp_bridge->vcpi);
+		drm_dbg_dp(mst->msm_dp->drm_dev,
+			   "conn:%d vcpi:%d start_slot:%d num_slots:%d, pbn:%d\n",
+			   DP_MST_CONN_ID(msm_dp_bridge), msm_dp_bridge->vcpi,
+			   msm_dp_bridge->start_slot,
+			   msm_dp_bridge->num_slots, msm_dp_bridge->pbn);
+	}
+}
+
+static int _msm_dp_mst_bridge_pre_enable_part1(struct msm_dp_mst_bridge *dp_bridge)
+{
+	struct msm_dp *msm_dp = dp_bridge->display;
+	struct msm_dp_mst *mst = msm_dp->msm_dp_mst;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(dp_bridge->connector);
+	struct drm_dp_mst_port *port = mst_conn->mst_port;
+	struct drm_dp_mst_topology_state *mst_state;
+	struct drm_dp_mst_atomic_payload *payload;
+	struct msm_dp_panel *dp_panel = mst_conn->dp_panel;
+	int pbn, slots;
+	int rc = 0;
+
+	pbn = msm_dp_mst_calc_pbn_mode(&dp_panel->msm_dp_mode.drm_mode,
+				       msm_dp->connector->display_info.bpc * 3);
+
+	slots = msm_dp_mst_find_vcpi_slots(&mst->mst_mgr, pbn);
+
+	drm_dbg_dp(msm_dp->drm_dev, "conn:%d pbn:%d, slots:%d\n", DP_MST_CONN_ID(dp_bridge),
+		   pbn, slots);
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+	payload = drm_atomic_get_mst_payload_state(mst_state, port);
+	if (!payload || payload->time_slots <= 0) {
+		DRM_ERROR("time slots not allocated for conn:%d\n", DP_MST_CONN_ID(dp_bridge));
+		rc = -EINVAL;
+		return rc;
+	}
+
+	drm_dp_mst_update_slots(mst_state, DP_CAP_ANSI_8B10B);
+
+	rc = drm_dp_add_payload_part1(&mst->mst_mgr, mst_state, payload);
+	if (rc) {
+		DRM_ERROR("payload allocation failure for conn:%d\n", DP_MST_CONN_ID(dp_bridge));
+		return rc;
+	}
+
+	_msm_dp_mst_update_timeslots(mst, dp_bridge, port);
+
+	return rc;
+}
+
+static void _msm_dp_mst_bridge_pre_enable_part2(struct msm_dp_mst_bridge *dp_bridge)
+{
+	struct msm_dp *msm_dp = dp_bridge->display;
+	struct msm_dp_mst *mst = msm_dp->msm_dp_mst;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(dp_bridge->connector);
+	struct drm_dp_mst_port *port = mst_conn->mst_port;
+	struct drm_dp_mst_topology_state *mst_state;
+	struct drm_dp_mst_atomic_payload *payload;
+
+	drm_dp_check_act_status(&mst->mst_mgr);
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+	payload = drm_atomic_get_mst_payload_state(mst_state, port);
+
+	if (!payload) {
+		DRM_ERROR("mst bridge [%d] null payload\n", dp_bridge->id);
+		return;
+	}
+
+	if (!payload->port) {
+		DRM_ERROR("mst bridge [%d] null port\n", dp_bridge->id);
+		return;
+	}
+
+	if (!payload->port->connector) {
+		DRM_ERROR("mst bridge [%d] part-2 failed, null connector\n",
+			  dp_bridge->id);
+		return;
+	}
+
+	if (payload->vc_start_slot == -1) {
+		DRM_ERROR("mst bridge [%d] part-2 failed, payload alloc part 1 failed\n",
+			  dp_bridge->id);
+		return;
+	}
+
+	drm_dp_add_payload_part2(&mst->mst_mgr, payload);
+	drm_dbg_dp(msm_dp->drm_dev, "mst bridge [%d] _pre enable part-2 complete\n",
+		   dp_bridge->id);
+}
+
+static void _msm_dp_mst_bridge_pre_disable_part1(struct msm_dp_mst_bridge *dp_bridge)
+{
+	struct msm_dp *msm_dp = dp_bridge->display;
+	struct msm_dp_mst *mst = msm_dp->msm_dp_mst;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(dp_bridge->connector);
+	struct drm_dp_mst_port *port = mst_conn->mst_port;
+	struct drm_dp_mst_topology_state *mst_state;
+	struct drm_dp_mst_atomic_payload *payload;
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+	payload = drm_atomic_get_mst_payload_state(mst_state, port);
+
+	if (!payload) {
+		DRM_ERROR("mst bridge [%d] _pre disable part-1 failed, null payload\n",
+			  dp_bridge->id);
+		return;
+	}
+
+	drm_dp_remove_payload_part1(&mst->mst_mgr, mst_state, payload);
+	_msm_dp_mst_update_timeslots(mst, dp_bridge, port);
+
+	drm_dbg_dp(msm_dp->drm_dev, "mst bridge [%d] _pre disable part-1 complete\n",
+		   dp_bridge->id);
+}
+
+static void _msm_dp_mst_bridge_pre_disable_part2(struct msm_dp_mst_bridge *dp_bridge)
+{
+	struct msm_dp *msm_dp = dp_bridge->display;
+	struct msm_dp_mst *mst = msm_dp->msm_dp_mst;
+
+	drm_dp_check_act_status(&mst->mst_mgr);
+
+	drm_dbg_dp(msm_dp->drm_dev, "mst bridge [%d] _pre disable part-2 complete\n",
+		   dp_bridge->id);
+}
+
+static void msm_dp_mst_bridge_atomic_pre_enable(struct drm_bridge *drm_bridge,
+						struct drm_bridge_state *old_bridge_state)
+{
+	int rc = 0;
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp *dp;
+	struct msm_dp_mst_bridge_state *msm_dp_bridge_state;
+	struct msm_dp_mst *dp_mst;
+
+	if (!drm_bridge) {
+		DRM_ERROR("Invalid params\n");
+		return;
+	}
+
+	bridge = to_msm_dp_mst_bridge(drm_bridge);
+	msm_dp_bridge_state = to_msm_dp_mst_bridge_state(bridge);
+	dp = bridge->display;
+	dp_mst = dp->msm_dp_mst;
+
+	/* to cover cases of bridge_disable/bridge_enable without modeset */
+	bridge->connector = msm_dp_bridge_state->connector;
+	bridge->msm_dp_panel = msm_dp_bridge_state->msm_dp_panel;
+
+	if (!bridge->connector) {
+		DRM_ERROR("Invalid connector\n");
+		return;
+	}
+
+	mutex_lock(&dp_mst->mst_lock);
+	msm_dp_display_atomic_prepare(dp);
+
+	rc = _msm_dp_mst_bridge_pre_enable_part1(bridge);
+	if (rc) {
+		DRM_ERROR("[%d] DP display pre-enable failed, rc=%d\n", bridge->id, rc);
+		msm_dp_display_unprepare(dp);
+		mutex_unlock(&dp_mst->mst_lock);
+		return;
+	}
+
+	msm_dp_display_enable_helper(dp, bridge->msm_dp_panel);
+
+	_msm_dp_mst_bridge_pre_enable_part2(bridge);
+
+	drm_dbg_dp(dp->drm_dev, "conn:%d mode:%s fps:%d vcpi:%d slots:%d to %d\n",
+		   DP_MST_CONN_ID(bridge), bridge->drm_mode.name,
+		   drm_mode_vrefresh(&bridge->drm_mode),
+		   bridge->vcpi, bridge->start_slot,
+		   bridge->start_slot + bridge->num_slots);
+
+	mutex_unlock(&dp_mst->mst_lock);
+}
+
+static void msm_dp_mst_bridge_atomic_disable(struct drm_bridge *drm_bridge,
+					     struct drm_bridge_state *old_bridge_state)
+{
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp *dp;
+	struct msm_dp_mst *mst;
+
+	if (!drm_bridge) {
+		DRM_ERROR("Invalid params\n");
+		return;
+	}
+
+	bridge = to_msm_dp_mst_bridge(drm_bridge);
+	if (!bridge->connector) {
+		DRM_ERROR("Invalid connector\n");
+		return;
+	}
+
+	dp = bridge->display;
+	mst = dp->msm_dp_mst;
+
+	mutex_lock(&mst->mst_lock);
+
+	_msm_dp_mst_bridge_pre_disable_part1(bridge);
+
+	msm_dp_display_disable_helper(dp, bridge->msm_dp_panel);
+
+	_msm_dp_mst_bridge_pre_disable_part2(bridge);
+
+	drm_dbg_dp(dp->drm_dev, "mst bridge:%d conn:%d disable complete\n", bridge->id,
+		   DP_MST_CONN_ID(bridge));
+
+	mutex_unlock(&mst->mst_lock);
+}
+
+static void msm_dp_mst_bridge_atomic_post_disable(struct drm_bridge *drm_bridge,
+						  struct drm_bridge_state *old_bridge_state)
+{
+	int conn = 0;
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp *dp;
+	struct msm_dp_mst *mst;
+
+	if (!drm_bridge) {
+		DRM_ERROR("Invalid params\n");
+		return;
+	}
+
+	bridge = to_msm_dp_mst_bridge(drm_bridge);
+	if (!bridge->connector) {
+		DRM_ERROR("Invalid connector\n");
+		return;
+	}
+
+	conn = DP_MST_CONN_ID(bridge);
+
+	dp = bridge->display;
+	mst = dp->msm_dp_mst;
+
+	mutex_lock(&mst->mst_lock);
+
+	msm_dp_display_atomic_post_disable_helper(dp, bridge->msm_dp_panel);
+
+	if (!dp->mst_active)
+		msm_dp_display_unprepare(dp);
+
+	bridge->connector = NULL;
+	bridge->msm_dp_panel =  NULL;
+
+	drm_dbg_dp(dp->drm_dev, "mst bridge:%d conn:%d post disable complete\n",
+		   bridge->id, conn);
+
+	mutex_unlock(&mst->mst_lock);
+}
+
+static void msm_dp_mst_bridge_mode_set(struct drm_bridge *drm_bridge,
+				       const struct drm_display_mode *mode,
+				       const struct drm_display_mode *adjusted_mode)
+{
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp_mst_bridge_state *dp_bridge_state;
+	struct msm_dp *dp;
+	struct msm_dp_panel *msm_dp_panel;
+
+	if (!drm_bridge || !mode || !adjusted_mode) {
+		DRM_ERROR("Invalid params\n");
+		return;
+	}
+
+	bridge = to_msm_dp_mst_bridge(drm_bridge);
+
+	dp_bridge_state = to_msm_dp_mst_bridge_state(bridge);
+	bridge->connector = dp_bridge_state->connector;
+	bridge->msm_dp_panel = dp_bridge_state->msm_dp_panel;
+
+	msm_dp_panel = bridge->msm_dp_panel;
+
+	dp = bridge->display;
+
+	memset(&bridge->msm_dp_mode, 0x0, sizeof(struct msm_dp_display_mode));
+	memcpy(&bridge->drm_mode, adjusted_mode, sizeof(bridge->drm_mode));
+
+	msm_dp_display_mode_set_helper(dp, mode, adjusted_mode, bridge->msm_dp_panel);
+	msm_dp_panel->mst_caps.pbn = msm_dp_mst_calc_pbn_mode(&msm_dp_panel->msm_dp_mode.drm_mode,
+							      msm_dp_panel->msm_dp_mode.bpp);
+	memcpy(&bridge->msm_dp_mode, &bridge->msm_dp_panel->msm_dp_mode,
+	       sizeof(struct msm_dp_display_mode));
+
+	drm_dbg_dp(dp->drm_dev, "mst bridge:%d conn:%d mode set complete %s\n", bridge->id,
+		   DP_MST_CONN_ID(bridge), mode->name);
+}
+
+/* DP MST Bridge APIs */
+static const struct drm_bridge_funcs msm_dp_mst_bridge_ops = {
+	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
+	.atomic_destroy_state   = drm_atomic_helper_bridge_destroy_state,
+	.atomic_reset           = drm_atomic_helper_bridge_reset,
+	.atomic_pre_enable   = msm_dp_mst_bridge_atomic_pre_enable,
+	.atomic_disable      = msm_dp_mst_bridge_atomic_disable,
+	.atomic_post_disable = msm_dp_mst_bridge_atomic_post_disable,
+	.mode_set     = msm_dp_mst_bridge_mode_set,
+};
+
+int msm_dp_mst_drm_bridge_init(struct msm_dp *dp, struct drm_encoder *encoder)
+{
+	int rc = 0;
+	struct msm_dp_mst_bridge *bridge = NULL;
+	struct msm_dp_mst_bridge_state *state;
+	struct drm_device *dev;
+	struct msm_dp_mst *mst = dp->msm_dp_mst;
+	int i;
+
+	for (i = 0; i < mst->max_streams; i++) {
+		if (!mst->mst_bridge[i].in_use) {
+			bridge = &mst->mst_bridge[i];
+			bridge->encoder = encoder;
+			bridge->in_use = true;
+			bridge->id = i;
+			break;
+		}
+	}
+
+	if (i == mst->max_streams) {
+		DRM_ERROR("mst supports only %d bridges\n", i);
+		rc = -EACCES;
+		goto end;
+	}
+
+	dev = dp->drm_dev;
+	bridge->display = dp;
+	bridge->base.funcs = &msm_dp_mst_bridge_ops;
+	bridge->base.encoder = encoder;
+	bridge->base.type = dp->connector_type;
+	bridge->base.ops = DRM_BRIDGE_OP_MODES;
+	drm_bridge_add(&bridge->base);
+
+	rc = drm_bridge_attach(encoder, &bridge->base, NULL, 0);
+	if (rc) {
+		DRM_ERROR("failed to attach bridge, rc=%d\n", rc);
+		goto end;
+	}
+
+	state = kzalloc(sizeof(*state), GFP_KERNEL);
+	if (!state) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	drm_atomic_private_obj_init(dev, &bridge->obj,
+				    &state->base,
+				    &msm_dp_mst_bridge_state_funcs);
+
+	drm_dbg_dp(dp->drm_dev, "mst drm bridge init. bridge id:%d\n", i);
+
+	return 0;
+
+end:
+	return rc;
+}
+
+static struct msm_dp_mst_bridge_state *msm_dp_mst_br_priv_state(struct drm_atomic_state *st,
+								struct msm_dp_mst_bridge *bridge)
+{
+	struct drm_device *dev = bridge->base.dev;
+
+	WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex));
+
+	return to_msm_dp_mst_bridge_priv_state(drm_atomic_get_private_obj_state(st,
+										&bridge->obj));
+}
+
+static void msm_dp_mst_clear_panel_edid(struct msm_dp *dp_display)
+{
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	struct msm_dp_mst_connector *mst_conn;
+	struct msm_dp_panel *dp_panel;
+	struct msm_dp_mst_bridge *dp_bridge;
+	int i;
+
+	if (!dp_display) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
+
+	for (i = 0; i < mst->max_streams; i++) {
+		dp_bridge = &mst->mst_bridge[i];
+		mst_conn = to_msm_dp_mst_connector(dp_bridge->connector);
+		dp_panel = dp_bridge->msm_dp_panel;
+
+		if (!dp_panel || !mst_conn || !mst_conn->mst_port)
+			continue;
+
+		if (dp_panel->drm_edid) {
+			drm_edid_free(dp_panel->drm_edid);
+			dp_panel->drm_edid = NULL;
+		}
+	}
+}
+
+/* DP MST HPD IRQ callback */
+void msm_dp_mst_display_hpd_irq(struct msm_dp *dp_display)
+{
+	int rc;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	u8 ack[8] = {};
+	u8 esi[14];
+	unsigned int esi_res = DP_SINK_COUNT_ESI + 1;
+	bool handled;
+
+	rc = drm_dp_dpcd_read(mst->dp_aux, DP_SINK_COUNT_ESI, esi, 14);
+	if (rc != 14) {
+		DRM_ERROR("dpcd sink status read failed, rlen=%d\n", rc);
+		return;
+	}
+
+	drm_dbg_dp(dp_display->drm_dev, "mst irq: esi1[0x%x] esi2[0x%x] esi3[0x%x]\n",
+		   esi[1], esi[2], esi[3]);
+
+	rc = drm_dp_mst_hpd_irq_handle_event(&mst->mst_mgr, esi, ack, &handled);
+
+	/* ack the request */
+	if (handled) {
+		rc = drm_dp_dpcd_writeb(mst->dp_aux, esi_res, ack[1]);
+
+		if (ack[1] & DP_UP_REQ_MSG_RDY)
+			msm_dp_mst_clear_panel_edid(dp_display);
+
+		if (rc != 1)
+			DRM_ERROR("dpcd esi_res failed. rc=%d\n", rc);
+
+		drm_dp_mst_hpd_irq_send_new_request(&mst->mst_mgr);
+	}
+	drm_dbg_dp(dp_display->drm_dev, "mst display hpd_irq handled:%d rc:%d\n", handled, rc);
+}
+
+/* DP MST Connector OPs */
+static int
+msm_dp_mst_connector_detect(struct drm_connector *connector,
+			    struct drm_modeset_acquire_ctx *ctx,
+			    bool force)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	enum drm_connector_status status = connector_status_disconnected;
+
+	if (dp_display->link_ready && dp_display->mst_active)
+		status = drm_dp_mst_detect_port(connector,
+						ctx, &mst->mst_mgr, mst_conn->mst_port);
+
+	drm_dbg_dp(dp_display->drm_dev, "conn:%d status:%d\n", connector->base.id, status);
+
+	return (int)status;
+}
+
+static int msm_dp_mst_connector_get_modes(struct drm_connector *connector)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	struct msm_dp_panel *dp_panel = mst_conn->dp_panel;
+
+	if (dp_panel->drm_edid)
+		goto duplicate_edid;
+
+	drm_edid_free(dp_panel->drm_edid);
+
+	dp_panel->drm_edid = drm_dp_mst_edid_read(connector, &mst->mst_mgr, mst_conn->mst_port);
+	if (!dp_panel->drm_edid) {
+		DRM_ERROR("get edid failed. id: %d\n", connector->base.id);
+		return -EINVAL;
+	}
+
+duplicate_edid:
+	drm_edid_connector_update(connector, dp_panel->drm_edid);
+
+	return drm_edid_connector_add_modes(connector);
+}
+
+static enum drm_mode_status msm_dp_mst_connector_mode_valid(struct drm_connector *connector,
+							    struct drm_display_mode *mode)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct drm_dp_mst_port *mst_port;
+	struct msm_dp_panel *dp_panel;
+	struct msm_dp_mst *mst;
+	u16 full_pbn, required_pbn;
+	int available_slots, required_slots;
+	struct msm_dp_mst_bridge_state *dp_bridge_state;
+	int i, slots_in_use = 0, active_enc_cnt = 0;
+	const u32 tot_slots = 63;
+
+	if (!connector || !mode || !dp_display) {
+		DRM_ERROR("invalid input\n");
+		return 0;
+	}
+
+	mst = dp_display->msm_dp_mst;
+	mst_conn = to_msm_dp_mst_connector(connector);
+	mst_port = mst_conn->mst_port;
+	dp_panel = mst_conn->dp_panel;
+
+	if (!dp_panel || !mst_port)
+		return MODE_ERROR;
+
+	/* dp bridge state is protected by drm_mode_config.connection_mutex */
+	for (i = 0; i < mst->max_streams; i++) {
+		dp_bridge_state = to_msm_dp_mst_bridge_state(&mst->mst_bridge[i]);
+		if (dp_bridge_state->connector &&
+		    dp_bridge_state->connector != connector) {
+			active_enc_cnt++;
+			slots_in_use += dp_bridge_state->num_slots;
+		}
+	}
+
+	if (active_enc_cnt < DP_STREAM_MAX) {
+		full_pbn = mst_port->full_pbn;
+		available_slots = tot_slots - slots_in_use;
+	} else {
+		DRM_ERROR("all mst streams are active\n");
+		return MODE_BAD;
+	}
+
+	required_pbn = msm_dp_mst_calc_pbn_mode(mode, connector->display_info.bpc * 3);
+
+	required_slots = msm_dp_mst_find_vcpi_slots(&mst->mst_mgr, required_pbn);
+
+	if (required_pbn > full_pbn || required_slots > available_slots) {
+		drm_dbg_dp(dp_display->drm_dev,
+			   "mode:%s not supported. pbn %d vs %d slots %d vs %d\n",
+			   mode->name, required_pbn, full_pbn,
+			   required_slots, available_slots);
+		return MODE_BAD;
+	}
+
+	return msm_dp_display_mode_valid(dp_display, &dp_display->connector->display_info, mode);
+}
+
+static struct drm_encoder *
+msm_dp_mst_atomic_best_encoder(struct drm_connector *connector, struct drm_atomic_state *state)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	struct drm_encoder *enc = NULL;
+	struct msm_dp_mst_bridge_state *bridge_state;
+	u32 i;
+	struct drm_connector_state *conn_state = drm_atomic_get_new_connector_state(state,
+										    connector);
+
+	if (conn_state && conn_state->best_encoder)
+		return conn_state->best_encoder;
+
+	for (i = 0; i < mst->max_streams; i++) {
+		bridge_state = msm_dp_mst_br_priv_state(state, &mst->mst_bridge[i]);
+		if (IS_ERR(bridge_state))
+			goto end;
+
+		if (bridge_state->connector == connector) {
+			enc = mst->mst_bridge[i].encoder;
+			goto end;
+		}
+	}
+
+	for (i = 0; i < mst->max_streams; i++) {
+		bridge_state = msm_dp_mst_br_priv_state(state, &mst->mst_bridge[i]);
+
+		if (!bridge_state->connector) {
+			bridge_state->connector = connector;
+			bridge_state->msm_dp_panel = mst_conn->dp_panel;
+			enc = mst->mst_bridge[i].encoder;
+			break;
+		}
+	}
+
+end:
+	if (enc)
+		drm_dbg_dp(dp_display->drm_dev, "mst connector:%d atomic best encoder:%d\n",
+			   connector->base.id, i);
+	else
+		drm_dbg_dp(dp_display->drm_dev, "mst connector:%d atomic best encoder failed\n",
+			   connector->base.id);
+
+	return enc;
+}
+
+static int msm_dp_mst_connector_atomic_check(struct drm_connector *connector,
+					     struct drm_atomic_state *state)
+{
+	int rc = 0, slots, i;
+	bool vcpi_released = false;
+	struct drm_connector_state *old_conn_state;
+	struct drm_connector_state *new_conn_state;
+	struct drm_crtc *old_crtc;
+	struct drm_crtc_state *crtc_state;
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp_mst_bridge_state *bridge_state;
+	struct drm_bridge *drm_bridge;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+
+	if (!state)
+		return rc;
+
+	new_conn_state = drm_atomic_get_new_connector_state(state, connector);
+	if (!new_conn_state)
+		return rc;
+
+	old_conn_state = drm_atomic_get_old_connector_state(state, connector);
+	if (!old_conn_state)
+		goto mode_set;
+
+	old_crtc = old_conn_state->crtc;
+	if (!old_crtc)
+		goto mode_set;
+
+	crtc_state = drm_atomic_get_new_crtc_state(state, old_crtc);
+
+	for (i = 0; i < mst->max_streams; i++) {
+		bridge = &mst->mst_bridge[i];
+		drm_dbg_dp(dp_display->drm_dev, "bridge id:%d, vcpi:%d, pbn:%d, slots:%d\n",
+			   bridge->id, bridge->vcpi, bridge->pbn,
+			   bridge->num_slots);
+	}
+
+	/*attempt to release vcpi slots on a modeset change for crtc state*/
+	if (drm_atomic_crtc_needs_modeset(crtc_state)) {
+		if (WARN_ON(!old_conn_state->best_encoder)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		drm_bridge = drm_bridge_chain_get_first_bridge(old_conn_state->best_encoder);
+		if (WARN_ON(!drm_bridge)) {
+			rc = -EINVAL;
+			goto end;
+		}
+		bridge = to_msm_dp_mst_bridge(drm_bridge);
+
+		bridge_state = msm_dp_mst_br_priv_state(state, bridge);
+		if (IS_ERR(bridge_state)) {
+			rc = PTR_ERR(bridge_state);
+			goto end;
+		}
+
+		if (WARN_ON(bridge_state->connector != connector)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		slots = bridge_state->num_slots;
+		if (slots > 0) {
+			rc = drm_dp_atomic_release_time_slots(state,
+							      &mst->mst_mgr,
+							      mst_conn->mst_port);
+			if (rc) {
+				DRM_ERROR("failed releasing %d vcpi slots %d\n", slots, rc);
+				goto end;
+			}
+			vcpi_released = true;
+		}
+
+		if (!new_conn_state->crtc) {
+			/* for cases where crtc is not disabled the slots are not
+			 * freed by drm_dp_atomic_release_time_slots. this results
+			 * in subsequent atomic_check failing since internal slots
+			 * were freed but not the dp mst mgr's
+			 */
+			bridge_state->num_slots = 0;
+			bridge_state->connector = NULL;
+			bridge_state->msm_dp_panel = NULL;
+
+			drm_dbg_dp(dp_display->drm_dev, "clear best encoder: %d\n", bridge->id);
+		}
+	}
+
+mode_set:
+	if (!new_conn_state->crtc)
+		goto end;
+
+	crtc_state = drm_atomic_get_new_crtc_state(state, new_conn_state->crtc);
+
+	if (drm_atomic_crtc_needs_modeset(crtc_state) && crtc_state->active) {
+		if (WARN_ON(!new_conn_state->best_encoder)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		drm_bridge = drm_bridge_chain_get_first_bridge(new_conn_state->best_encoder);
+		if (WARN_ON(!drm_bridge)) {
+			rc = -EINVAL;
+			goto end;
+		}
+		bridge = to_msm_dp_mst_bridge(drm_bridge);
+
+		bridge_state = msm_dp_mst_br_priv_state(state, bridge);
+		if (IS_ERR(bridge_state)) {
+			rc = PTR_ERR(bridge_state);
+			goto end;
+		}
+
+		if (WARN_ON(bridge_state->connector != connector)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/*
+		 * check if vcpi slots are trying to get allocated in same phase
+		 * as deallocation. If so, go to end to avoid allocation.
+		 */
+		if (vcpi_released) {
+			drm_dbg_dp(dp_display->drm_dev,
+				   "skipping allocation since vcpi was released in the same state\n");
+			goto end;
+		}
+
+		if (WARN_ON(bridge_state->num_slots)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		slots = _msm_dp_mst_compute_config(state, mst, connector, &crtc_state->mode);
+		if (slots < 0) {
+			rc = slots;
+			goto end;
+		}
+
+		bridge_state->num_slots = slots;
+	}
+
+end:
+	drm_dbg_dp(dp_display->drm_dev, "mst connector:%d atomic check ret %d\n",
+		   connector->base.id, rc);
+	return rc;
+}
+
+static void dp_mst_connector_destroy(struct drm_connector *connector)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp_panel *dp_panel = mst_conn->dp_panel;
+
+	drm_connector_cleanup(connector);
+	drm_edid_free(dp_panel->drm_edid);
+	dp_panel->drm_edid = NULL;
+	drm_dp_mst_put_port_malloc(mst_conn->mst_port);
+	msm_dp_panel_put(mst_conn->dp_panel);
+}
+
+/* DRM MST callbacks */
+static const struct drm_connector_helper_funcs dp_drm_mst_connector_helper_funcs = {
+	.get_modes =    msm_dp_mst_connector_get_modes,
+	.detect_ctx =   msm_dp_mst_connector_detect,
+	.mode_valid =   msm_dp_mst_connector_mode_valid,
+	.atomic_best_encoder = msm_dp_mst_atomic_best_encoder,
+	.atomic_check = msm_dp_mst_connector_atomic_check,
+};
+
+static const struct drm_connector_funcs dp_drm_mst_connector_funcs = {
+	.reset = drm_atomic_helper_connector_reset,
+	.destroy = dp_mst_connector_destroy,
+	.fill_modes = drm_helper_probe_single_connector_modes,
+	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+};
+
+static struct drm_connector *
+msm_dp_mst_add_connector(struct drm_dp_mst_topology_mgr *mgr,
+			 struct drm_dp_mst_port *port, const char *pathprop)
+{
+	struct msm_dp_mst *dp_mst;
+	struct drm_device *dev;
+	struct msm_dp *dp_display;
+	struct msm_dp_mst_connector *mst_connector;
+	struct drm_connector *connector;
+	int rc, i;
+
+	dp_mst = container_of(mgr, struct msm_dp_mst, mst_mgr);
+
+	dp_display = dp_mst->msm_dp;
+	dev = dp_display->drm_dev;
+
+	mst_connector = devm_kzalloc(dev->dev, sizeof(*mst_connector), GFP_KERNEL);
+
+	/* make sure connector is not accessed before reset */
+	drm_modeset_lock_all(dev);
+
+	rc = drm_connector_init(dev, &mst_connector->connector, &dp_drm_mst_connector_funcs,
+				DRM_MODE_CONNECTOR_DisplayPort);
+	if (rc) {
+		drm_modeset_unlock_all(dev);
+		return NULL;
+	}
+
+	mst_connector->dp_panel = msm_dp_display_get_panel(dp_display);
+	if (!mst_connector->dp_panel) {
+		DRM_ERROR("failed to get dp_panel for connector\n");
+		drm_modeset_unlock_all(dev);
+		return NULL;
+	}
+
+	mst_connector->dp_panel->connector = &mst_connector->connector;
+	mst_connector->msm_dp = dp_display;
+	connector = &mst_connector->connector;
+	drm_connector_helper_add(&mst_connector->connector, &dp_drm_mst_connector_helper_funcs);
+
+	if (connector->funcs->reset)
+		connector->funcs->reset(connector);
+
+	/* add all encoders as possible encoders */
+	for (i = 0; i < dp_mst->max_streams; i++) {
+		rc = drm_connector_attach_encoder(&mst_connector->connector,
+						  dp_mst->mst_bridge[i].encoder);
+		if (rc) {
+			DRM_ERROR("failed to attach encoder to connector, %d\n", rc);
+			drm_modeset_unlock_all(dev);
+			return NULL;
+		}
+	}
+
+	mst_connector->mst_port = port;
+	drm_dp_mst_get_port_malloc(mst_connector->mst_port);
+
+	/* check if we need to call connector_reset here */
+
+	drm_object_attach_property(&mst_connector->connector.base,
+				   dev->mode_config.path_property, 0);
+	drm_object_attach_property(&mst_connector->connector.base,
+				   dev->mode_config.tile_property, 0);
+
+	/* unlock connector and make it accessible */
+	drm_modeset_unlock_all(dev);
+
+	drm_dbg_dp(dp_display->drm_dev, "add mst connector id:%d\n",
+		   mst_connector->connector.base.id);
+
+	return &mst_connector->connector;
+}
+
+int msm_dp_mst_display_set_mgr_state(struct msm_dp *dp_display, bool state)
+{
+	int rc;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+
+	/*
+	 * on hpd high, set_mgr_state is called before hotplug event is sent
+	 * to usermode and mst_session_state should be updated here.
+	 * on hpd_low, set_mgr_state is called after hotplug event is sent and
+	 * the session_state was already updated prior to that.
+	 */
+	if (state)
+		mst->mst_session_hpd_state = state;
+
+	rc = drm_dp_mst_topology_mgr_set_mst(&mst->mst_mgr, state);
+	if (rc < 0) {
+		DRM_ERROR("failed to set topology mgr state to %d. rc %d\n",
+			  state, rc);
+	}
+
+	drm_dbg_dp(dp_display->drm_dev, "dp_mst_display_set_mgr_state state:%d\n", state);
+	return rc;
+}
+
+static const struct drm_dp_mst_topology_cbs msm_dp_mst_drm_cbs = {
+	.add_connector = msm_dp_mst_add_connector,
+};
+
+int msm_dp_mst_init(struct msm_dp *dp_display, u32 max_streams, u32 max_dpcd_transaction_bytes,
+		    struct drm_dp_aux *drm_aux)
+{
+	struct drm_device *dev;
+	int conn_base_id = 0;
+	int ret;
+	struct msm_dp_mst *msm_dp_mst;
+
+	if (!dp_display) {
+		DRM_ERROR("invalid params\n");
+		return 0;
+	}
+
+	dev = dp_display->drm_dev;
+
+	msm_dp_mst = devm_kzalloc(dev->dev, sizeof(*msm_dp_mst), GFP_KERNEL);
+	if (!msm_dp_mst)
+		return -ENOMEM;
+
+	// will expost the callbacks as direct APIs for hotplug
+	// lets drop install_info for now
+	memset(&msm_dp_mst->mst_mgr, 0, sizeof(msm_dp_mst->mst_mgr));
+	msm_dp_mst->mst_mgr.cbs = &msm_dp_mst_drm_cbs;
+	conn_base_id = dp_display->connector->base.id;
+	msm_dp_mst->msm_dp = dp_display;
+	msm_dp_mst->dp_aux = drm_aux;
+	msm_dp_mst->max_streams = max_streams;
+
+	ret = drm_dp_mst_topology_mgr_init(&msm_dp_mst->mst_mgr, dev,
+					   drm_aux,
+					   max_dpcd_transaction_bytes,
+					   max_streams,
+					   conn_base_id);
+	if (ret) {
+		DRM_ERROR("dp drm mst topology manager init failed\n");
+		return ret;
+	}
+
+	dp_display->msm_dp_mst = msm_dp_mst;
+
+	mutex_init(&msm_dp_mst->mst_lock);
+
+	msm_dp_mst->mst_initialized = true;
+
+	drm_dbg_dp(dp_display->drm_dev, "dp drm mst topology manager init completed\n");
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_mst_drm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_mst_drm.h
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DP_MST_DRM_H_
+#define _DP_MST_DRM_H_
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/version.h>
+
+#include <drm/drm_atomic_helper.h>
+#include <drm/drm_atomic.h>
+#include <drm/drm_bridge.h>
+#include <drm/drm_crtc.h>
+#include <drm/drm_fixed.h>
+#include <drm/drm_connector.h>
+#include <drm/display/drm_dp_helper.h>
+#include <drm/display/drm_dp_mst_helper.h>
+
+#include "dp_panel.h"
+#include "dp_display.h"
+
+#define MAX_DP_MST_DRM_BRIDGES         4
+
+#define DP_MST_CONN_ID(bridge) ((bridge)->connector ? \
+		(bridge)->connector->base.id : 0)
+
+struct msm_dp_mst_bridge {
+	struct drm_bridge base;
+	struct drm_private_obj obj;
+	u32 id;
+
+	bool in_use;
+
+	struct msm_dp *display;
+	struct drm_encoder *encoder;
+
+	struct drm_display_mode drm_mode;
+	struct msm_dp_display_mode msm_dp_mode;
+	struct drm_connector *connector;
+	struct msm_dp_panel *msm_dp_panel;
+
+	int vcpi;
+	int pbn;
+	int num_slots;
+	int start_slot;
+};
+
+struct msm_dp_mst_bridge_state {
+	struct drm_private_state base;
+	struct drm_connector *connector;
+	struct msm_dp_panel *msm_dp_panel;
+	int num_slots;
+};
+
+struct msm_dp_mst {
+	bool mst_initialized;
+	struct drm_dp_mst_topology_mgr mst_mgr;
+	struct msm_dp_mst_bridge mst_bridge[MAX_DP_MST_DRM_BRIDGES];
+	struct msm_dp *msm_dp;
+	struct drm_dp_aux *dp_aux;
+	bool mst_session_hpd_state;
+	u32 max_streams;
+	struct mutex mst_lock;
+};
+
+struct msm_dp_mst_connector {
+	struct drm_connector connector;
+	struct drm_dp_mst_port *mst_port;
+	struct msm_dp *msm_dp;
+	struct msm_dp_panel *dp_panel;
+};
+
+#define to_msm_dp_mst_bridge(x)     container_of((x), struct msm_dp_mst_bridge, base)
+#define to_msm_dp_mst_bridge_priv(x) \
+		container_of((x), struct msm_dp_mst_bridge, obj)
+#define to_msm_dp_mst_bridge_priv_state(x) \
+		container_of((x), struct msm_dp_mst_bridge_state, base)
+#define to_msm_dp_mst_bridge_state(x) \
+		to_msm_dp_mst_bridge_priv_state((x)->obj.state)
+#define to_msm_dp_mst_connector(x) \
+		container_of((x), struct msm_dp_mst_connector, connector)
+int msm_dp_mst_drm_bridge_init(struct msm_dp *dp, struct drm_encoder *encoder);
+
+int msm_dp_mst_init(struct msm_dp *dp_display, u32 max_streams,
+		    u32 max_dpcd_transaction_bytes, struct drm_dp_aux *drm_aux);
+
+void msm_dp_mst_display_hpd_irq(struct msm_dp *dp_display);
+int msm_dp_mst_display_set_mgr_state(struct msm_dp *dp_display, bool state);
+
+#endif /* _DP_MST_DRM_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_panel.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -4,56 +4,62 @@
  */
 
 #include "dp_panel.h"
+#include "dp_utils.h"
 
 #include <drm/drm_connector.h>
 #include <drm/drm_edid.h>
+#include <drm/drm_of.h>
 #include <drm/drm_print.h>
 
-struct dp_panel_private {
+#define DP_MAX_NUM_DP_LANES	4
+#define DP_LINK_RATE_HBR2	540000 /* kbytes */
+
+struct msm_dp_panel_private {
 	struct device *dev;
 	struct drm_device *drm_dev;
-	struct dp_panel dp_panel;
+	struct msm_dp_panel msm_dp_panel;
 	struct drm_dp_aux *aux;
-	struct dp_link *link;
-	struct dp_catalog *catalog;
+	struct msm_dp_link *link;
+	struct msm_dp_catalog *catalog;
 	bool panel_on;
 };
 
-static void dp_panel_read_psr_cap(struct dp_panel_private *panel)
+static void msm_dp_panel_read_psr_cap(struct msm_dp_panel_private *panel)
 {
 	ssize_t rlen;
-	struct dp_panel *dp_panel;
+	struct msm_dp_panel *msm_dp_panel;
 
-	dp_panel = &panel->dp_panel;
+	msm_dp_panel = &panel->msm_dp_panel;
 
 	/* edp sink */
-	if (dp_panel->dpcd[DP_EDP_CONFIGURATION_CAP]) {
+	if (msm_dp_panel->dpcd[DP_EDP_CONFIGURATION_CAP]) {
 		rlen = drm_dp_dpcd_read(panel->aux, DP_PSR_SUPPORT,
-				&dp_panel->psr_cap, sizeof(dp_panel->psr_cap));
-		if (rlen == sizeof(dp_panel->psr_cap)) {
+				&msm_dp_panel->psr_cap, sizeof(msm_dp_panel->psr_cap));
+		if (rlen == sizeof(msm_dp_panel->psr_cap)) {
 			drm_dbg_dp(panel->drm_dev,
 				"psr version: 0x%x, psr_cap: 0x%x\n",
-				dp_panel->psr_cap.version,
-				dp_panel->psr_cap.capabilities);
+				msm_dp_panel->psr_cap.version,
+				msm_dp_panel->psr_cap.capabilities);
 		} else
 			DRM_ERROR("failed to read psr info, rlen=%zd\n", rlen);
 	}
 }
 
-static int dp_panel_read_dpcd(struct dp_panel *dp_panel)
+static int msm_dp_panel_read_dpcd(struct msm_dp_panel *msm_dp_panel)
 {
 	int rc;
-	struct dp_panel_private *panel;
-	struct dp_link_info *link_info;
+	struct msm_dp_panel_private *panel;
+	struct msm_dp_link_info *link_info;
 	u8 *dpcd, major, minor;
 
-	panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
-	dpcd = dp_panel->dpcd;
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+	dpcd = msm_dp_panel->dpcd;
 	rc = drm_dp_read_dpcd_caps(panel->aux, dpcd);
 	if (rc)
 		return rc;
 
-	link_info = &dp_panel->link_info;
+	msm_dp_panel->vsc_sdp_supported = drm_dp_vsc_sdp_supported(panel->aux, dpcd);
+	link_info = &msm_dp_panel->link_info;
 	link_info->revision = dpcd[DP_DPCD_REV];
 	major = (link_info->revision >> 4) & 0x0f;
 	minor = link_info->revision & 0x0f;
@@ -62,12 +68,12 @@
 	link_info->num_lanes = drm_dp_max_lane_count(dpcd);
 
 	/* Limit data lanes from data-lanes of endpoint property of dtsi */
-	if (link_info->num_lanes > dp_panel->max_dp_lanes)
-		link_info->num_lanes = dp_panel->max_dp_lanes;
+	if (link_info->num_lanes > msm_dp_panel->max_dp_lanes)
+		link_info->num_lanes = msm_dp_panel->max_dp_lanes;
 
 	/* Limit link rate from link-frequencies of endpoint property of dtsi */
-	if (link_info->rate > dp_panel->max_dp_link_rate)
-		link_info->rate = dp_panel->max_dp_link_rate;
+	if (link_info->rate > msm_dp_panel->max_dp_link_rate)
+		link_info->rate = msm_dp_panel->max_dp_link_rate;
 
 	drm_dbg_dp(panel->drm_dev, "version: %d.%d\n", major, minor);
 	drm_dbg_dp(panel->drm_dev, "link_rate=%d\n", link_info->rate);
@@ -76,84 +82,79 @@
 	if (drm_dp_enhanced_frame_cap(dpcd))
 		link_info->capabilities |= DP_LINK_CAP_ENHANCED_FRAMING;
 
-	dp_panel_read_psr_cap(panel);
+	msm_dp_panel_read_psr_cap(panel);
 
 	return rc;
 }
 
-static u32 dp_panel_get_supported_bpp(struct dp_panel *dp_panel,
+static u32 msm_dp_panel_get_supported_bpp(struct msm_dp_panel *msm_dp_panel,
 		u32 mode_edid_bpp, u32 mode_pclk_khz)
 {
-	struct dp_link_info *link_info;
+	const struct msm_dp_link_info *link_info;
 	const u32 max_supported_bpp = 30, min_supported_bpp = 18;
-	u32 bpp = 0, data_rate_khz = 0;
+	u32 bpp, data_rate_khz;
 
-	bpp = min_t(u32, mode_edid_bpp, max_supported_bpp);
+	bpp = min(mode_edid_bpp, max_supported_bpp);
 
-	link_info = &dp_panel->link_info;
+	link_info = &msm_dp_panel->link_info;
 	data_rate_khz = link_info->num_lanes * link_info->rate * 8;
 
-	while (bpp > min_supported_bpp) {
+	do {
 		if (mode_pclk_khz * bpp <= data_rate_khz)
-			break;
+			return bpp;
 		bpp -= 6;
-	}
+	} while (bpp > min_supported_bpp);
 
-	return bpp;
+	return min_supported_bpp;
 }
 
-static int dp_panel_update_modes(struct drm_connector *connector,
-	struct edid *edid)
+bool msm_dp_panel_read_mst_cap(struct msm_dp_panel *msm_dp_panel)
 {
-	int rc = 0;
+	struct msm_dp_panel_private *panel;
 
-	if (edid) {
-		rc = drm_connector_update_edid_property(connector, edid);
-		if (rc) {
-			DRM_ERROR("failed to update edid property %d\n", rc);
-			return rc;
-		}
-		rc = drm_add_edid_modes(connector, edid);
-		return rc;
+	if (!msm_dp_panel) {
+		DRM_ERROR("invalid input\n");
+		return false;
 	}
 
-	rc = drm_connector_update_edid_property(connector, NULL);
-	if (rc)
-		DRM_ERROR("failed to update edid property %d\n", rc);
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
 
-	return rc;
+	return drm_dp_read_mst_cap(panel->aux, msm_dp_panel->dpcd);
 }
 
-int dp_panel_read_sink_caps(struct dp_panel *dp_panel,
-	struct drm_connector *connector)
+int msm_dp_panel_read_link_caps(struct msm_dp_panel *msm_dp_panel,
+		struct drm_connector *connector)
 {
 	int rc, bw_code;
 	int count;
-	struct dp_panel_private *panel;
+	struct msm_dp_panel_private *panel;
 
-	if (!dp_panel || !connector) {
+	if (!msm_dp_panel || !connector) {
 		DRM_ERROR("invalid input\n");
 		return -EINVAL;
 	}
 
-	panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
 
-	rc = dp_panel_read_dpcd(dp_panel);
+	drm_dbg_dp(panel->drm_dev, "max_lanes=%d max_link_rate=%d\n",
+		msm_dp_panel->max_dp_lanes, msm_dp_panel->max_dp_link_rate);
+
+	rc = msm_dp_panel_read_dpcd(msm_dp_panel);
 	if (rc) {
 		DRM_ERROR("read dpcd failed %d\n", rc);
 		return rc;
 	}
 
-	bw_code = drm_dp_link_rate_to_bw_code(dp_panel->link_info.rate);
+	bw_code = drm_dp_link_rate_to_bw_code(msm_dp_panel->link_info.rate);
 	if (!is_link_rate_valid(bw_code) ||
-			!is_lane_count_valid(dp_panel->link_info.num_lanes) ||
-			(bw_code > dp_panel->max_bw_code)) {
-		DRM_ERROR("Illegal link rate=%d lane=%d\n", dp_panel->link_info.rate,
-				dp_panel->link_info.num_lanes);
+			!is_lane_count_valid(msm_dp_panel->link_info.num_lanes) ||
+			(bw_code > msm_dp_panel->max_bw_code)) {
+		DRM_ERROR("Illegal link rate=%d lane=%d\n", msm_dp_panel->link_info.rate,
+				msm_dp_panel->link_info.num_lanes);
 		return -EINVAL;
 	}
 
-	if (drm_dp_is_branch(dp_panel->dpcd)) {
+	if (drm_dp_is_branch(msm_dp_panel->dpcd)) {
 		count = drm_dp_read_sink_count(panel->aux);
 		if (!count) {
 			panel->link->sink_count = 0;
@@ -161,108 +162,119 @@
 		}
 	}
 
-	rc = drm_dp_read_downstream_info(panel->aux, dp_panel->dpcd,
-					 dp_panel->downstream_ports);
-	if (rc)
-		return rc;
+	return drm_dp_read_downstream_info(panel->aux, msm_dp_panel->dpcd,
+			 msm_dp_panel->downstream_ports);
+}
 
-	kfree(dp_panel->edid);
-	dp_panel->edid = NULL;
+int msm_dp_panel_read_edid(struct msm_dp_panel *msm_dp_panel, struct drm_connector *connector)
+{
+	struct msm_dp_panel_private *panel;
+
+	if (!msm_dp_panel || !connector) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
 
-	dp_panel->edid = drm_get_edid(connector,
-					      &panel->aux->ddc);
-	if (!dp_panel->edid) {
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+
+	drm_edid_free(msm_dp_panel->drm_edid);
+
+	msm_dp_panel->drm_edid = drm_edid_read_ddc(connector, &panel->aux->ddc);
+
+	drm_edid_connector_update(connector, msm_dp_panel->drm_edid);
+
+	if (!msm_dp_panel->drm_edid) {
 		DRM_ERROR("panel edid read failed\n");
 		/* check edid read fail is due to unplug */
-		if (!dp_catalog_link_is_connected(panel->catalog)) {
-			rc = -ETIMEDOUT;
-			goto end;
+		if (!msm_dp_catalog_link_is_connected(panel->catalog)) {
+			return -ETIMEDOUT;
 		}
 	}
 
-end:
-	return rc;
+	return 0;
 }
 
-u32 dp_panel_get_mode_bpp(struct dp_panel *dp_panel,
+u32 msm_dp_panel_get_mode_bpp(struct msm_dp_panel *msm_dp_panel,
 		u32 mode_edid_bpp, u32 mode_pclk_khz)
 {
-	struct dp_panel_private *panel;
+	struct msm_dp_panel_private *panel;
 	u32 bpp;
 
-	if (!dp_panel || !mode_edid_bpp || !mode_pclk_khz) {
+	if (!msm_dp_panel || !mode_edid_bpp || !mode_pclk_khz) {
 		DRM_ERROR("invalid input\n");
 		return 0;
 	}
 
-	panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
 
-	if (dp_panel->video_test)
-		bpp = dp_link_bit_depth_to_bpp(
+	if (msm_dp_panel->video_test)
+		bpp = msm_dp_link_bit_depth_to_bpp(
 				panel->link->test_video.test_bit_depth);
 	else
-		bpp = dp_panel_get_supported_bpp(dp_panel, mode_edid_bpp,
+		bpp = msm_dp_panel_get_supported_bpp(msm_dp_panel, mode_edid_bpp,
 				mode_pclk_khz);
 
 	return bpp;
 }
 
-int dp_panel_get_modes(struct dp_panel *dp_panel,
+int msm_dp_panel_get_modes(struct msm_dp_panel *msm_dp_panel,
 	struct drm_connector *connector)
 {
-	if (!dp_panel) {
+	if (!msm_dp_panel) {
 		DRM_ERROR("invalid input\n");
 		return -EINVAL;
 	}
 
-	if (dp_panel->edid)
-		return dp_panel_update_modes(connector, dp_panel->edid);
+	if (msm_dp_panel->drm_edid)
+		return drm_edid_connector_add_modes(connector);
 
 	return 0;
 }
 
-static u8 dp_panel_get_edid_checksum(struct edid *edid)
+static u8 msm_dp_panel_get_edid_checksum(const struct edid *edid)
 {
 	edid += edid->extensions;
 
 	return edid->checksum;
 }
 
-void dp_panel_handle_sink_request(struct dp_panel *dp_panel)
+void msm_dp_panel_handle_sink_request(struct msm_dp_panel *msm_dp_panel)
 {
-	struct dp_panel_private *panel;
+	struct msm_dp_panel_private *panel;
 
-	if (!dp_panel) {
+	if (!msm_dp_panel) {
 		DRM_ERROR("invalid input\n");
 		return;
 	}
 
-	panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
 
 	if (panel->link->sink_request & DP_TEST_LINK_EDID_READ) {
+		/* FIXME: get rid of drm_edid_raw() */
+		const struct edid *edid = drm_edid_raw(msm_dp_panel->drm_edid);
 		u8 checksum;
 
-		if (dp_panel->edid)
-			checksum = dp_panel_get_edid_checksum(dp_panel->edid);
+		if (edid)
+			checksum = msm_dp_panel_get_edid_checksum(edid);
 		else
-			checksum = dp_panel->connector->real_edid_checksum;
+			checksum = msm_dp_panel->connector->real_edid_checksum;
 
-		dp_link_send_edid_checksum(panel->link, checksum);
-		dp_link_send_test_response(panel->link);
+		msm_dp_link_send_edid_checksum(panel->link, checksum);
+		msm_dp_link_send_test_response(panel->link);
 	}
 }
 
-void dp_panel_tpg_config(struct dp_panel *dp_panel, bool enable)
+void msm_dp_panel_tpg_config(struct msm_dp_panel *msm_dp_panel, bool enable)
 {
-	struct dp_catalog *catalog;
-	struct dp_panel_private *panel;
+	struct msm_dp_catalog *catalog;
+	struct msm_dp_panel_private *panel;
 
-	if (!dp_panel) {
+	if (!msm_dp_panel) {
 		DRM_ERROR("invalid input\n");
 		return;
 	}
 
-	panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
 	catalog = panel->catalog;
 
 	if (!panel->panel_on) {
@@ -272,35 +284,87 @@
 	}
 
 	if (!enable) {
-		dp_catalog_panel_tpg_disable(catalog);
+		msm_dp_catalog_panel_tpg_disable(catalog);
 		return;
 	}
 
 	drm_dbg_dp(panel->drm_dev, "calling catalog tpg_enable\n");
-	dp_catalog_panel_tpg_enable(catalog, &panel->dp_panel.dp_mode.drm_mode);
+	msm_dp_catalog_panel_tpg_enable(catalog, &panel->msm_dp_panel.msm_dp_mode.drm_mode);
 }
 
-void dp_panel_dump_regs(struct dp_panel *dp_panel)
+static int msm_dp_panel_setup_vsc_sdp_yuv_420(struct msm_dp_panel *msm_dp_panel)
 {
-	struct dp_catalog *catalog;
-	struct dp_panel_private *panel;
+	struct msm_dp_catalog *catalog;
+	struct msm_dp_panel_private *panel;
+	struct msm_dp_display_mode *msm_dp_mode;
+	struct drm_dp_vsc_sdp vsc_sdp_data;
+	struct dp_sdp vsc_sdp;
+	ssize_t len;
 
-	panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
+	if (!msm_dp_panel) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
 	catalog = panel->catalog;
+	msm_dp_mode = &msm_dp_panel->msm_dp_mode;
+	catalog->stream_id = msm_dp_panel->stream_id;
+
+	memset(&vsc_sdp_data, 0, sizeof(vsc_sdp_data));
+
+	/* VSC SDP header as per table 2-118 of DP 1.4 specification */
+	vsc_sdp_data.sdp_type = DP_SDP_VSC;
+	vsc_sdp_data.revision = 0x05;
+	vsc_sdp_data.length = 0x13;
+
+	/* VSC SDP Payload for DB16 */
+	vsc_sdp_data.pixelformat = DP_PIXELFORMAT_YUV420;
+	vsc_sdp_data.colorimetry = DP_COLORIMETRY_DEFAULT;
+
+	/* VSC SDP Payload for DB17 */
+	vsc_sdp_data.bpc = msm_dp_mode->bpp / 3;
+	vsc_sdp_data.dynamic_range = DP_DYNAMIC_RANGE_CTA;
+
+	/* VSC SDP Payload for DB18 */
+	vsc_sdp_data.content_type = DP_CONTENT_TYPE_GRAPHICS;
+
+	len = drm_dp_vsc_sdp_pack(&vsc_sdp_data, &vsc_sdp);
+	if (len < 0) {
+		DRM_ERROR("unable to pack vsc sdp\n");
+		return len;
+	}
 
-	dp_catalog_dump_regs(catalog);
+	msm_dp_catalog_panel_enable_vsc_sdp(catalog, &vsc_sdp);
+
+	return 0;
 }
 
-int dp_panel_timing_cfg(struct dp_panel *dp_panel)
+void msm_dp_panel_dump_regs(struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_catalog *catalog;
+	struct msm_dp_panel_private *panel;
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+	catalog = panel->catalog;
+
+	msm_dp_catalog_dump_regs(catalog);
+}
+
+int msm_dp_panel_timing_cfg(struct msm_dp_panel *msm_dp_panel)
 {
 	u32 data, total_ver, total_hor;
-	struct dp_catalog *catalog;
-	struct dp_panel_private *panel;
+	struct msm_dp_catalog *catalog;
+	struct msm_dp_panel_private *panel;
 	struct drm_display_mode *drm_mode;
+	u32 width_blanking;
+	u32 sync_start;
+	u32 msm_dp_active;
+	u32 total;
 
-	panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
 	catalog = panel->catalog;
-	drm_mode = &panel->dp_panel.dp_mode.drm_mode;
+	drm_mode = &panel->msm_dp_panel.msm_dp_mode.drm_mode;
 
 	drm_dbg_dp(panel->drm_dev, "width=%d hporch= %d %d %d\n",
 		drm_mode->hdisplay, drm_mode->htotal - drm_mode->hsync_end,
@@ -320,42 +384,46 @@
 	data <<= 16;
 	data |= total_hor;
 
-	catalog->total = data;
+	total = data;
 
 	data = (drm_mode->vtotal - drm_mode->vsync_start);
 	data <<= 16;
 	data |= (drm_mode->htotal - drm_mode->hsync_start);
 
-	catalog->sync_start = data;
+	sync_start = data;
 
 	data = drm_mode->vsync_end - drm_mode->vsync_start;
 	data <<= 16;
-	data |= (panel->dp_panel.dp_mode.v_active_low << 31);
+	data |= (panel->msm_dp_panel.msm_dp_mode.v_active_low << 31);
 	data |= drm_mode->hsync_end - drm_mode->hsync_start;
-	data |= (panel->dp_panel.dp_mode.h_active_low << 15);
+	data |= (panel->msm_dp_panel.msm_dp_mode.h_active_low << 15);
 
-	catalog->width_blanking = data;
+	width_blanking = data;
 
 	data = drm_mode->vdisplay;
 	data <<= 16;
 	data |= drm_mode->hdisplay;
 
-	catalog->dp_active = data;
+	msm_dp_active = data;
+
+	msm_dp_catalog_panel_timing_cfg(catalog, total, sync_start, width_blanking, msm_dp_active);
+
+	if (msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420)
+		msm_dp_panel_setup_vsc_sdp_yuv_420(msm_dp_panel);
 
-	dp_catalog_panel_timing_cfg(catalog);
 	panel->panel_on = true;
 
 	return 0;
 }
 
-int dp_panel_init_panel_info(struct dp_panel *dp_panel)
+int msm_dp_panel_init_panel_info(struct msm_dp_panel *msm_dp_panel)
 {
 	struct drm_display_mode *drm_mode;
-	struct dp_panel_private *panel;
+	struct msm_dp_panel_private *panel;
 
-	drm_mode = &dp_panel->dp_mode.drm_mode;
+	drm_mode = &msm_dp_panel->msm_dp_mode.drm_mode;
 
-	panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
 
 	/*
 	 * print resolution info as this is a result
@@ -376,20 +444,76 @@
 			drm_mode->vsync_end - drm_mode->vsync_start);
 	drm_dbg_dp(panel->drm_dev, "pixel clock (KHz)=(%d)\n",
 				drm_mode->clock);
-	drm_dbg_dp(panel->drm_dev, "bpp = %d\n", dp_panel->dp_mode.bpp);
+	drm_dbg_dp(panel->drm_dev, "bpp = %d\n", msm_dp_panel->msm_dp_mode.bpp);
+
+	msm_dp_panel->msm_dp_mode.bpp = msm_dp_panel_get_mode_bpp(msm_dp_panel, msm_dp_panel->msm_dp_mode.bpp,
+						      msm_dp_panel->msm_dp_mode.drm_mode.clock);
 
-	dp_panel->dp_mode.bpp = max_t(u32, 18,
-				min_t(u32, dp_panel->dp_mode.bpp, 30));
 	drm_dbg_dp(panel->drm_dev, "updated bpp = %d\n",
-				dp_panel->dp_mode.bpp);
+				msm_dp_panel->msm_dp_mode.bpp);
+
+	return 0;
+}
+
+static u32 msm_dp_panel_link_frequencies(struct device_node *of_node)
+{
+	struct device_node *endpoint;
+	u64 frequency = 0;
+	int cnt;
+
+	endpoint = of_graph_get_endpoint_by_regs(of_node, 1, 0); /* port@1 */
+	if (!endpoint)
+		return 0;
+
+	cnt = of_property_count_u64_elems(endpoint, "link-frequencies");
+
+	if (cnt > 0)
+		of_property_read_u64_index(endpoint, "link-frequencies",
+						cnt - 1, &frequency);
+	of_node_put(endpoint);
+
+	do_div(frequency,
+		10 * /* from symbol rate to link rate */
+		1000); /* kbytes */
+
+	return frequency;
+}
+
+static int msm_dp_panel_parse_dt(struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_panel_private *panel;
+	struct device_node *of_node;
+	int cnt;
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+	of_node = panel->dev->of_node;
+
+	/*
+	 * data-lanes is the property of msm_dp_out endpoint
+	 */
+	cnt = drm_of_get_data_lanes_count_ep(of_node, 1, 0, 1, DP_MAX_NUM_DP_LANES);
+	if (cnt < 0) {
+		/* legacy code, data-lanes is the property of mdss_dp node */
+		cnt = drm_of_get_data_lanes_count(of_node, 1, DP_MAX_NUM_DP_LANES);
+	}
+
+	if (cnt > 0)
+		msm_dp_panel->max_dp_lanes = cnt;
+	else
+		msm_dp_panel->max_dp_lanes = DP_MAX_NUM_DP_LANES; /* 4 lanes */
+
+	msm_dp_panel->max_dp_link_rate = msm_dp_panel_link_frequencies(of_node);
+	if (!msm_dp_panel->max_dp_link_rate)
+		msm_dp_panel->max_dp_link_rate = DP_LINK_RATE_HBR2;
 
 	return 0;
 }
 
-struct dp_panel *dp_panel_get(struct dp_panel_in *in)
+struct msm_dp_panel *msm_dp_panel_get(struct msm_dp_panel_in *in)
 {
-	struct dp_panel_private *panel;
-	struct dp_panel *dp_panel;
+	struct msm_dp_panel_private *panel;
+	struct msm_dp_panel *msm_dp_panel;
+	int ret;
 
 	if (!in->dev || !in->catalog || !in->aux || !in->link) {
 		DRM_ERROR("invalid input\n");
@@ -405,16 +529,20 @@
 	panel->catalog = in->catalog;
 	panel->link = in->link;
 
-	dp_panel = &panel->dp_panel;
-	dp_panel->max_bw_code = DP_LINK_BW_8_1;
+	msm_dp_panel = &panel->msm_dp_panel;
+	msm_dp_panel->max_bw_code = DP_LINK_BW_8_1;
+
+	ret = msm_dp_panel_parse_dt(msm_dp_panel);
+	if (ret)
+		return ERR_PTR(ret);
 
-	return dp_panel;
+	return msm_dp_panel;
 }
 
-void dp_panel_put(struct dp_panel *dp_panel)
+void msm_dp_panel_put(struct msm_dp_panel *msm_dp_panel)
 {
-	if (!dp_panel)
+	if (!msm_dp_panel)
 		return;
 
-	kfree(dp_panel->edid);
+	drm_edid_free(msm_dp_panel->drm_edid);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_panel.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_panel.h
@@ -13,58 +13,68 @@
 
 struct edid;
 
-struct dp_display_mode {
+struct msm_dp_display_mode {
 	struct drm_display_mode drm_mode;
-	u32 capabilities;
 	u32 bpp;
 	u32 h_active_low;
 	u32 v_active_low;
+	bool out_fmt_is_yuv_420;
 };
 
-struct dp_panel_in {
+struct msm_dp_panel_in {
 	struct device *dev;
 	struct drm_dp_aux *aux;
-	struct dp_link *link;
-	struct dp_catalog *catalog;
+	struct msm_dp_link *link;
+	struct msm_dp_catalog *catalog;
 };
 
-struct dp_panel_psr {
+struct msm_dp_panel_psr {
 	u8 version;
 	u8 capabilities;
 };
 
-struct dp_panel {
+struct mst_caps {
+	u32 pbn_no_overhead;
+	u32 pbn;
+};
+
+struct msm_dp_panel {
 	/* dpcd raw data */
 	u8 dpcd[DP_RECEIVER_CAP_SIZE];
 	u8 downstream_ports[DP_MAX_DOWNSTREAM_PORTS];
 
-	struct dp_link_info link_info;
-	struct drm_dp_desc desc;
-	struct edid *edid;
+	struct msm_dp_link_info link_info;
+	const struct drm_edid *drm_edid;
 	struct drm_connector *connector;
-	struct dp_display_mode dp_mode;
-	struct dp_panel_psr psr_cap;
+	struct msm_dp_display_mode msm_dp_mode;
+	struct msm_dp_panel_psr psr_cap;
 	bool video_test;
+	bool vsc_sdp_supported;
+
+	enum msm_dp_stream_id stream_id;
 
-	u32 vic;
 	u32 max_dp_lanes;
 	u32 max_dp_link_rate;
 
 	u32 max_bw_code;
+
+	struct mst_caps mst_caps;
 };
 
-int dp_panel_init_panel_info(struct dp_panel *dp_panel);
-int dp_panel_deinit(struct dp_panel *dp_panel);
-int dp_panel_timing_cfg(struct dp_panel *dp_panel);
-void dp_panel_dump_regs(struct dp_panel *dp_panel);
-int dp_panel_read_sink_caps(struct dp_panel *dp_panel,
+int msm_dp_panel_init_panel_info(struct msm_dp_panel *msm_dp_panel);
+int msm_dp_panel_deinit(struct msm_dp_panel *msm_dp_panel);
+int msm_dp_panel_timing_cfg(struct msm_dp_panel *msm_dp_panel);
+void msm_dp_panel_dump_regs(struct msm_dp_panel *msm_dp_panel);
+u32 msm_dp_panel_get_mode_bpp(struct msm_dp_panel *msm_dp_panel, u32 mode_max_bpp,
+	u32 mode_pclk_khz);
+int msm_dp_panel_read_link_caps(struct msm_dp_panel *msm_dp_panel,
 		struct drm_connector *connector);
-u32 dp_panel_get_mode_bpp(struct dp_panel *dp_panel, u32 mode_max_bpp,
-			u32 mode_pclk_khz);
-int dp_panel_get_modes(struct dp_panel *dp_panel,
+int msm_dp_panel_read_edid(struct msm_dp_panel *msm_dp_panel, struct drm_connector *connector);
+int msm_dp_panel_get_modes(struct msm_dp_panel *msm_dp_panel,
 		struct drm_connector *connector);
-void dp_panel_handle_sink_request(struct dp_panel *dp_panel);
-void dp_panel_tpg_config(struct dp_panel *dp_panel, bool enable);
+void msm_dp_panel_handle_sink_request(struct msm_dp_panel *msm_dp_panel);
+void msm_dp_panel_tpg_config(struct msm_dp_panel *msm_dp_panel, bool enable);
+bool msm_dp_panel_read_mst_cap(struct msm_dp_panel *msm_dp_panel);
 
 /**
  * is_link_rate_valid() - validates the link rate
@@ -81,7 +91,7 @@
 }
 
 /**
- * dp_link_is_lane_count_valid() - validates the lane count
+ * msm_dp_link_is_lane_count_valid() - validates the lane count
  * @lane_count: lane count requested by the sink
  *
  * Returns true if the requested lane count is supported.
@@ -93,6 +103,6 @@
 		lane_count == 4);
 }
 
-struct dp_panel *dp_panel_get(struct dp_panel_in *in);
-void dp_panel_put(struct dp_panel *dp_panel);
+struct msm_dp_panel *msm_dp_panel_get(struct msm_dp_panel_in *in);
+void msm_dp_panel_put(struct msm_dp_panel *msm_dp_panel);
 #endif /* _DP_PANEL_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_reg.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_reg.h
@@ -6,6 +6,9 @@
 #ifndef _DP_REG_H_
 #define _DP_REG_H_
 
+#include <linux/bitfield.h>
+#include <linux/bits.h>
+
 /* DP_TX Registers */
 #define REG_DP_HW_VERSION			(0x00000000)
 
@@ -21,8 +24,9 @@
 #define REG_DP_INTR_STATUS			(0x00000020)
 #define REG_DP_INTR_STATUS2			(0x00000024)
 #define REG_DP_INTR_STATUS3			(0x00000028)
-
 #define REG_DP_INTR_STATUS4			(0x0000002C)
+#define REG_DP_INTR_STATUS5			(0x00000034)
+
 #define PSR_UPDATE_INT				(0x00000001)
 #define PSR_CAPTURE_INT				(0x00000004)
 #define PSR_EXIT_INT				(0x00000010)
@@ -102,6 +106,9 @@
 #define DP_MAINLINK_CTRL_ENABLE			(0x00000001)
 #define DP_MAINLINK_CTRL_RESET			(0x00000002)
 #define DP_MAINLINK_CTRL_SW_BYPASS_SCRAMBLER	(0x00000010)
+#define DP_MAINLINK_CTRL_FLUSH_MODE_MASK	GENMASK(24, 23)
+#define DP_MAINLINK_FLUSH_MODE_UPDATE_SDP	FIELD_PREP(DP_MAINLINK_CTRL_FLUSH_MODE_MASK, 1)
+#define DP_MAINLINK_FLUSH_MODE_SDE_PERIPH_UPDATE	FIELD_PREP(DP_MAINLINK_CTRL_FLUSH_MODE_MASK, 3)
 #define DP_MAINLINK_FB_BOUNDARY_SEL		(0x02000000)
 
 #define REG_DP_STATE_CTRL			(0x00000004)
@@ -132,16 +139,21 @@
 #define DP_CONFIGURATION_CTRL_LSCLK_DIV_SHIFT	(0x0D)
 
 #define REG_DP_SOFTWARE_MVID			(0x00000010)
+#define REG_DP1_SOFTWARE_MVID			(0x00000414)
 #define REG_DP_SOFTWARE_NVID			(0x00000018)
+#define REG_DP1_SOFTWARE_NVID			(0x00000418)
 #define REG_DP_TOTAL_HOR_VER			(0x0000001C)
+#define REG_DP1_TOTAL_HOR_VER			(0x0000041C)
 #define REG_DP_START_HOR_VER_FROM_SYNC		(0x00000020)
 #define REG_DP_HSYNC_VSYNC_WIDTH_POLARITY	(0x00000024)
 #define REG_DP_ACTIVE_HOR_VER			(0x00000028)
-
 #define REG_DP_MISC1_MISC0			(0x0000002C)
+#define REG_DP1_MISC1_MISC0			(0x0000042C)
+
 #define DP_MISC0_SYNCHRONOUS_CLK		(0x00000001)
 #define DP_MISC0_COLORIMETRY_CFG_SHIFT		(0x00000001)
 #define DP_MISC0_TEST_BITS_DEPTH_SHIFT		(0x00000005)
+#define DP_MISC1_VSC_SDP			(0x00004000)
 
 #define DP_MISC0_COLORIMERY_CFG_LEGACY_RGB	(0)
 #define DP_MISC0_COLORIMERY_CFG_CEA_RGB		(0x04)
@@ -204,14 +216,21 @@
 #define MMSS_DP_AUDIO_CTRL_RESET		(0x00000214)
 
 #define MMSS_DP_SDP_CFG				(0x00000228)
+#define MMSS_DP1_SDP_CFG			(0x000004E0)
+#define GEN0_SDP_EN				(0x00020000)
 #define MMSS_DP_SDP_CFG2			(0x0000022C)
+#define MMSS_DP1_SDP_CFG2			(0x000004E4)
+
 #define MMSS_DP_AUDIO_TIMESTAMP_0		(0x00000230)
 #define MMSS_DP_AUDIO_TIMESTAMP_1		(0x00000234)
+#define GENERIC0_SDPSIZE_VALID			(0x00010000)
 
 #define MMSS_DP_AUDIO_STREAM_0			(0x00000240)
 #define MMSS_DP_AUDIO_STREAM_1			(0x00000244)
 
 #define MMSS_DP_SDP_CFG3			(0x0000024c)
+#define MMSS_DP1_SDP_CFG3			(0x000004E8)
+
 #define UPDATE_SDP				(0x00000001)
 
 #define MMSS_DP_EXTENSION_0			(0x00000250)
@@ -261,6 +280,8 @@
 #define MMSS_DP_GENERIC1_8			(0x00000348)
 #define MMSS_DP_GENERIC1_9			(0x0000034C)
 
+#define MMSS_DP1_GENERIC0_0			(0x00000490)
+
 #define MMSS_DP_VSCEXT_0			(0x000002D0)
 #define MMSS_DP_VSCEXT_1			(0x000002D4)
 #define MMSS_DP_VSCEXT_2			(0x000002D8)
@@ -310,6 +331,15 @@
 #define REG_DP_PHY_AUX_BIST_CFG			(0x00000050)
 #define REG_DP_PHY_AUX_INTERRUPT_STATUS         (0x000000BC)
 
+/* DP MST related registers */
+#define REG_DP_MST_ACT                          (0x00000500)
+#define REG_DP_DP0_RG				(0x000004F8)
+#define REG_DP_DP1_RG				(0x000004FC)
+#define REG_DP_DP0_TIMESLOT_1_32		(0x00000404)
+#define REG_DP_DP0_TIMESLOT_33_63		(0x00000408)
+#define REG_DP_DP1_TIMESLOT_1_32		(0x0000040C)
+#define REG_DP_DP1_TIMESLOT_33_63		(0x00000410)
+
 /* DP HDCP 1.3 registers */
 #define DP_HDCP_CTRL                                   (0x0A0)
 #define DP_HDCP_STATUS                                 (0x0A4)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_utils.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_utils.c
@@ -0,0 +1,96 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/types.h>
+
+#include "dp_utils.h"
+
+#define DP_SDP_HEADER_SIZE		8
+
+u8 msm_dp_utils_get_g0_value(u8 data)
+{
+	u8 c[4];
+	u8 g[4];
+	u8 ret_data = 0;
+	u8 i;
+
+	for (i = 0; i < 4; i++)
+		c[i] = (data >> i) & 0x01;
+
+	g[0] = c[3];
+	g[1] = c[0] ^ c[3];
+	g[2] = c[1];
+	g[3] = c[2];
+
+	for (i = 0; i < 4; i++)
+		ret_data = ((g[i] & 0x01) << i) | ret_data;
+
+	return ret_data;
+}
+
+u8 msm_dp_utils_get_g1_value(u8 data)
+{
+	u8 c[4];
+	u8 g[4];
+	u8 ret_data = 0;
+	u8 i;
+
+	for (i = 0; i < 4; i++)
+		c[i] = (data >> i) & 0x01;
+
+	g[0] = c[0] ^ c[3];
+	g[1] = c[0] ^ c[1] ^ c[3];
+	g[2] = c[1] ^ c[2];
+	g[3] = c[2] ^ c[3];
+
+	for (i = 0; i < 4; i++)
+		ret_data = ((g[i] & 0x01) << i) | ret_data;
+
+	return ret_data;
+}
+
+u8 msm_dp_utils_calculate_parity(u32 data)
+{
+	u8 x0 = 0;
+	u8 x1 = 0;
+	u8 ci = 0;
+	u8 iData = 0;
+	u8 i = 0;
+	u8 parity_byte;
+	u8 num_byte = (data & 0xFF00) > 0 ? 8 : 2;
+
+	for (i = 0; i < num_byte; i++) {
+		iData = (data >> i * 4) & 0xF;
+
+		ci = iData ^ x1;
+		x1 = x0 ^ msm_dp_utils_get_g1_value(ci);
+		x0 = msm_dp_utils_get_g0_value(ci);
+	}
+
+	parity_byte = x1 | (x0 << 4);
+
+	return parity_byte;
+}
+
+ssize_t msm_dp_utils_pack_sdp_header(struct dp_sdp_header *sdp_header, u32 *header_buff)
+{
+	size_t length;
+
+	length = sizeof(header_buff);
+	if (length < DP_SDP_HEADER_SIZE)
+		return -ENOSPC;
+
+	header_buff[0] = FIELD_PREP(HEADER_0_MASK, sdp_header->HB0) |
+		FIELD_PREP(PARITY_0_MASK, msm_dp_utils_calculate_parity(sdp_header->HB0)) |
+		FIELD_PREP(HEADER_1_MASK, sdp_header->HB1) |
+		FIELD_PREP(PARITY_1_MASK, msm_dp_utils_calculate_parity(sdp_header->HB1));
+
+	header_buff[1] = FIELD_PREP(HEADER_2_MASK, sdp_header->HB2) |
+		FIELD_PREP(PARITY_2_MASK, msm_dp_utils_calculate_parity(sdp_header->HB2)) |
+		FIELD_PREP(HEADER_3_MASK, sdp_header->HB3) |
+		FIELD_PREP(PARITY_3_MASK, msm_dp_utils_calculate_parity(sdp_header->HB3));
+
+	return length;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dp/dp_utils.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dp/dp_utils.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_UTILS_H_
+#define _DP_UTILS_H_
+
+#include <linux/bitfield.h>
+#include <linux/bits.h>
+#include <drm/display/drm_dp_helper.h>
+
+#define HEADER_BYTE_0_BIT	 0
+#define PARITY_BYTE_0_BIT	 8
+#define HEADER_BYTE_1_BIT	16
+#define PARITY_BYTE_1_BIT	24
+#define HEADER_BYTE_2_BIT	 0
+#define PARITY_BYTE_2_BIT	 8
+#define HEADER_BYTE_3_BIT	16
+#define PARITY_BYTE_3_BIT	24
+
+#define HEADER_0_MASK	    GENMASK(7, 0)
+#define PARITY_0_MASK	    GENMASK(15, 8)
+#define HEADER_1_MASK	    GENMASK(23, 16)
+#define PARITY_1_MASK	    GENMASK(31, 24)
+#define HEADER_2_MASK	    GENMASK(7, 0)
+#define PARITY_2_MASK	    GENMASK(15, 8)
+#define HEADER_3_MASK	    GENMASK(23, 16)
+#define PARITY_3_MASK	    GENMASK(31, 24)
+
+u8 msm_dp_utils_get_g0_value(u8 data);
+u8 msm_dp_utils_get_g1_value(u8 data);
+u8 msm_dp_utils_calculate_parity(u32 data);
+ssize_t msm_dp_utils_pack_sdp_header(struct dp_sdp_header *sdp_header, u32 *header_buff);
+
+#endif /* _DP_UTILS_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dsi/dsi_cfg.c
@@ -221,6 +221,22 @@
 	},
 };
 
+static const struct regulator_bulk_data sa8775_dsi_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 30100 },    /* 1.2 V */
+	{ .supply = "refgen" },
+};
+
+static const struct msm_dsi_config sa8775_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = sa8775_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(sa8775_dsi_regulators),
+	.bus_clk_names = dsi_v2_4_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_v2_4_clk_names),
+	.io_start = {
+		{ 0xae94000, 0xae96000 },
+	},
+};
+
 static const struct msm_dsi_host_cfg_ops msm_dsi_v2_host_ops = {
 	.link_clk_set_rate = dsi_link_clk_set_rate_v2,
 	.link_clk_enable = dsi_link_clk_enable_v2,
@@ -294,6 +310,8 @@
 		&sc7280_dsi_cfg, &msm_dsi_6g_v2_host_ops},
 	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_6_0,
 		&sdm845_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_5_1,
+		&sa8775_dsi_cfg, &msm_dsi_6g_v2_host_ops},
 	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_7_0,
 		&sm8550_dsi_cfg, &msm_dsi_6g_v2_host_ops},
 	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_8_0,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dsi/dsi_cfg.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dsi/dsi_cfg.h
@@ -26,6 +26,7 @@
 #define MSM_DSI_6G_VER_MINOR_V2_4_0	0x20040000
 #define MSM_DSI_6G_VER_MINOR_V2_4_1	0x20040001
 #define MSM_DSI_6G_VER_MINOR_V2_5_0	0x20050000
+#define MSM_DSI_6G_VER_MINOR_V2_5_1	0x20050001
 #define MSM_DSI_6G_VER_MINOR_V2_6_0	0x20060000
 #define MSM_DSI_6G_VER_MINOR_V2_7_0	0x20070000
 #define MSM_DSI_6G_VER_MINOR_V2_8_0	0x20080000
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -366,8 +366,8 @@
 {
 	int ret;
 
-	DBG("Set clk rates: pclk=%d, byteclk=%lu",
-		msm_host->mode->clock, msm_host->byte_clk_rate);
+	DBG("Set clk rates: pclk=%lu, byteclk=%lu",
+	    msm_host->pixel_clk_rate, msm_host->byte_clk_rate);
 
 	ret = dev_pm_opp_set_rate(&msm_host->pdev->dev,
 				  msm_host->byte_clk_rate);
@@ -440,9 +440,9 @@
 {
 	int ret;
 
-	DBG("Set clk rates: pclk=%d, byteclk=%lu, esc_clk=%lu, dsi_src_clk=%lu",
-		msm_host->mode->clock, msm_host->byte_clk_rate,
-		msm_host->esc_clk_rate, msm_host->src_clk_rate);
+	DBG("Set clk rates: pclk=%lu, byteclk=%lu, esc_clk=%lu, dsi_src_clk=%lu",
+	    msm_host->pixel_clk_rate, msm_host->byte_clk_rate,
+	    msm_host->esc_clk_rate, msm_host->src_clk_rate);
 
 	ret = clk_set_rate(msm_host->byte_clk, msm_host->byte_clk_rate);
 	if (ret) {
@@ -537,7 +537,7 @@
 
 	int new_htotal = mode->htotal - mode->hdisplay + new_hdisplay;
 
-	return new_htotal * mode->vtotal * drm_mode_vrefresh(mode);
+	return mult_frac(mode->clock * 1000u, new_htotal, mode->htotal);
 }
 
 static unsigned long dsi_get_pclk_rate(const struct drm_display_mode *mode,
@@ -545,7 +545,7 @@
 {
 	unsigned long pclk_rate;
 
-	pclk_rate = mode->clock * 1000;
+	pclk_rate = mode->clock * 1000u;
 
 	if (dsc)
 		pclk_rate = dsi_adjust_pclk_for_compression(mode, dsc);
@@ -745,6 +745,8 @@
 		data |= DSI_VID_CFG0_TRAFFIC_MODE(dsi_get_traffic_mode(flags));
 		data |= DSI_VID_CFG0_DST_FORMAT(dsi_get_vid_fmt(mipi_fmt));
 		data |= DSI_VID_CFG0_VIRT_CHANNEL(msm_host->channel);
+		if (msm_dsi_host_is_wide_bus_enabled(&msm_host->base))
+			data |= DSI_VID_CFG0_DATABUS_WIDEN;
 		dsi_write(msm_host, REG_DSI_VID_CFG0, data);
 
 		/* Do not swap RGB colors */
@@ -769,7 +771,6 @@
 			if (cfg_hnd->minor >= MSM_DSI_6G_VER_MINOR_V1_3)
 				data |= DSI_CMD_MODE_MDP_CTRL2_BURST_MODE;
 
-			/* TODO: Allow for video-mode support once tested/fixed */
 			if (msm_dsi_host_is_wide_bus_enabled(&msm_host->base))
 				data |= DSI_CMD_MODE_MDP_CTRL2_DATABUS_WIDEN;
 
@@ -847,6 +848,7 @@
 	u32 slice_per_intf, total_bytes_per_intf;
 	u32 pkt_per_line;
 	u32 eol_byte_num;
+	u32 bytes_per_pkt;
 
 	/* first calculate dsc parameters and then program
 	 * compress mode registers
@@ -854,6 +856,7 @@
 	slice_per_intf = msm_dsc_get_slices_per_intf(dsc, hdisplay);
 
 	total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf;
+	bytes_per_pkt = dsc->slice_chunk_size; /* * slice_per_pkt; */
 
 	eol_byte_num = total_bytes_per_intf % 3;
 
@@ -891,6 +894,7 @@
 		dsi_write(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL, reg_ctrl);
 		dsi_write(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL2, reg_ctrl2);
 	} else {
+		reg |= DSI_VIDEO_COMPRESSION_MODE_CTRL_WC(bytes_per_pkt);
 		dsi_write(msm_host, REG_DSI_VIDEO_COMPRESSION_MODE_CTRL, reg);
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
@@ -583,6 +583,8 @@
 	  .data = &dsi_phy_7nm_6375_cfgs },
 	{ .compatible = "qcom,sm8350-dsi-phy-5nm",
 	  .data = &dsi_phy_5nm_8350_cfgs },
+	{ .compatible = "qcom,sa8775p-dsi-phy-5nm",
+	  .data = &dsi_phy_5nm_8775_cfgs },
 	{ .compatible = "qcom,sm8450-dsi-phy-5nm",
 	  .data = &dsi_phy_5nm_8450_cfgs },
 	{ .compatible = "qcom,sm8550-dsi-phy-4nm",
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h
@@ -60,6 +60,7 @@
 extern const struct msm_dsi_phy_cfg dsi_phy_7nm_8150_cfgs;
 extern const struct msm_dsi_phy_cfg dsi_phy_7nm_7280_cfgs;
 extern const struct msm_dsi_phy_cfg dsi_phy_5nm_8350_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_5nm_8775_cfgs;
 extern const struct msm_dsi_phy_cfg dsi_phy_5nm_8450_cfgs;
 extern const struct msm_dsi_phy_cfg dsi_phy_4nm_8550_cfgs;
 extern const struct msm_dsi_phy_cfg dsi_phy_4nm_8650_cfgs;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
@@ -135,7 +135,7 @@
 			config->pll_clock_inverters = 0x00;
 		else
 			config->pll_clock_inverters = 0x40;
-	} else {
+	} else if (pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_1) {
 		if (pll_freq <= 1000000000ULL)
 			config->pll_clock_inverters = 0xa0;
 		else if (pll_freq <= 2500000000ULL)
@@ -144,6 +144,16 @@
 			config->pll_clock_inverters = 0x00;
 		else
 			config->pll_clock_inverters = 0x40;
+	} else {
+		/* 4.2, 4.3 */
+		if (pll_freq <= 1000000000ULL)
+			config->pll_clock_inverters = 0xa0;
+		else if (pll_freq <= 2500000000ULL)
+			config->pll_clock_inverters = 0x20;
+		else if (pll_freq <= 3500000000ULL)
+			config->pll_clock_inverters = 0x00;
+		else
+			config->pll_clock_inverters = 0x40;
 	}
 
 	config->decimal_div_start = dec;
@@ -1121,6 +1131,10 @@
 	{ .supply = "vdds", .init_load_uA = 37550 },
 };
 
+static const struct regulator_bulk_data dsi_phy_7nm_115000uA_regulators[] = {
+	{ .supply = "vdds", .init_load_uA = 115000 },
+};
+
 static const struct regulator_bulk_data dsi_phy_7nm_98000uA_regulators[] = {
 	{ .supply = "vdds", .init_load_uA = 98000 },
 };
@@ -1224,6 +1238,29 @@
 	.ops = {
 		.enable = dsi_7nm_phy_enable,
 		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+		.set_continuous_clock = dsi_7nm_set_continuous_clock,
+	},
+	.min_pll_rate = 600000000UL,
+#ifdef CONFIG_64BIT
+	.max_pll_rate = 5000000000UL,
+#else
+	.max_pll_rate = ULONG_MAX,
+#endif
+	.io_start = { 0xae94400, 0xae96400 },
+	.num_dsi_phy = 2,
+	.quirks = DSI_PHY_7NM_QUIRK_V4_2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_5nm_8775_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_7nm_115000uA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_7nm_115000uA_regulators),
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
 		.pll_init = dsi_pll_7nm_init,
 		.save_pll_state = dsi_7nm_pll_save_state,
 		.restore_pll_state = dsi_7nm_pll_restore_state,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/hdmi/hdmi.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/hdmi/hdmi.h
@@ -137,6 +137,7 @@
 	MSM_HDMI_PHY_8960,
 	MSM_HDMI_PHY_8x74,
 	MSM_HDMI_PHY_8996,
+	MSM_HDMI_PHY_8998,
 	MSM_HDMI_PHY_MAX,
 };
 
@@ -154,6 +155,7 @@
 extern const struct hdmi_phy_cfg msm_hdmi_phy_8960_cfg;
 extern const struct hdmi_phy_cfg msm_hdmi_phy_8x74_cfg;
 extern const struct hdmi_phy_cfg msm_hdmi_phy_8996_cfg;
+extern const struct hdmi_phy_cfg msm_hdmi_phy_8998_cfg;
 
 struct hdmi_phy {
 	struct platform_device *pdev;
@@ -184,6 +186,7 @@
 #ifdef CONFIG_COMMON_CLK
 int msm_hdmi_pll_8960_init(struct platform_device *pdev);
 int msm_hdmi_pll_8996_init(struct platform_device *pdev);
+int msm_hdmi_pll_8998_init(struct platform_device *pdev);
 #else
 static inline int msm_hdmi_pll_8960_init(struct platform_device *pdev)
 {
@@ -194,6 +197,11 @@
 {
 	return -ENODEV;
 }
+
+static inline int msm_hdmi_pll_8998_init(struct platform_device *pdev)
+{
+	return -ENODEV;
+}
 #endif
 
 /*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
@@ -118,6 +118,9 @@
 	case MSM_HDMI_PHY_8996:
 		ret = msm_hdmi_pll_8996_init(pdev);
 		break;
+	case MSM_HDMI_PHY_8998:
+		ret = msm_hdmi_pll_8998_init(pdev);
+		break;
 	/*
 	 * we don't have PLL support for these, don't report an error for now
 	 */
@@ -193,6 +196,8 @@
 	  .data = &msm_hdmi_phy_8x74_cfg },
 	{ .compatible = "qcom,hdmi-phy-8996",
 	  .data = &msm_hdmi_phy_8996_cfg },
+	{ .compatible = "qcom,hdmi-phy-8998",
+	  .data = &msm_hdmi_phy_8998_cfg },
 	{}
 };
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/hdmi/hdmi_phy_8998.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/hdmi/hdmi_phy_8998.c
@@ -0,0 +1,779 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Freebox SAS
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+
+#include "hdmi.h"
+
+#define HDMI_VCO_MAX_FREQ			12000000000UL
+#define HDMI_VCO_MIN_FREQ			8000000000UL
+
+#define HDMI_PCLK_MAX_FREQ			600000000
+#define HDMI_PCLK_MIN_FREQ			25000000
+
+#define HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD	3400000000UL
+#define HDMI_DIG_FREQ_BIT_CLK_THRESHOLD		1500000000UL
+#define HDMI_MID_FREQ_BIT_CLK_THRESHOLD		750000000UL
+#define HDMI_CORECLK_DIV			5
+#define HDMI_DEFAULT_REF_CLOCK			19200000
+#define HDMI_PLL_CMP_CNT			1024
+
+#define HDMI_PLL_POLL_MAX_READS			100
+#define HDMI_PLL_POLL_TIMEOUT_US		150
+
+#define HDMI_NUM_TX_CHANNEL			4
+
+struct hdmi_pll_8998 {
+	struct platform_device *pdev;
+	struct clk_hw clk_hw;
+	unsigned long rate;
+
+	/* pll mmio base */
+	void __iomem *mmio_qserdes_com;
+	/* tx channel base */
+	void __iomem *mmio_qserdes_tx[HDMI_NUM_TX_CHANNEL];
+};
+
+#define hw_clk_to_pll(x) container_of(x, struct hdmi_pll_8998, clk_hw)
+
+struct hdmi_8998_phy_pll_reg_cfg {
+	u32 com_svs_mode_clk_sel;
+	u32 com_hsclk_sel;
+	u32 com_pll_cctrl_mode0;
+	u32 com_pll_rctrl_mode0;
+	u32 com_cp_ctrl_mode0;
+	u32 com_dec_start_mode0;
+	u32 com_div_frac_start1_mode0;
+	u32 com_div_frac_start2_mode0;
+	u32 com_div_frac_start3_mode0;
+	u32 com_integloop_gain0_mode0;
+	u32 com_integloop_gain1_mode0;
+	u32 com_lock_cmp_en;
+	u32 com_lock_cmp1_mode0;
+	u32 com_lock_cmp2_mode0;
+	u32 com_lock_cmp3_mode0;
+	u32 com_core_clk_en;
+	u32 com_coreclk_div_mode0;
+
+	u32 tx_lx_tx_band[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_tx_drv_lvl[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_tx_emp_post1_lvl[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_pre_driver_1[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_pre_driver_2[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_res_code_offset[HDMI_NUM_TX_CHANNEL];
+
+	u32 phy_mode;
+};
+
+struct hdmi_8998_post_divider {
+	u64 vco_freq;
+	int hsclk_divsel;
+	int vco_ratio;
+	int tx_band_sel;
+	int half_rate_mode;
+};
+
+static inline struct hdmi_phy *pll_get_phy(struct hdmi_pll_8998 *pll)
+{
+	return platform_get_drvdata(pll->pdev);
+}
+
+static inline void hdmi_pll_write(struct hdmi_pll_8998 *pll, int offset,
+				  u32 data)
+{
+	writel(data, pll->mmio_qserdes_com + offset);
+}
+
+static inline u32 hdmi_pll_read(struct hdmi_pll_8998 *pll, int offset)
+{
+	return readl(pll->mmio_qserdes_com + offset);
+}
+
+static inline void hdmi_tx_chan_write(struct hdmi_pll_8998 *pll, int channel,
+				      int offset, int data)
+{
+	 writel(data, pll->mmio_qserdes_tx[channel] + offset);
+}
+
+static inline u32 pll_get_cpctrl(u64 frac_start, unsigned long ref_clk,
+				 bool gen_ssc)
+{
+	if ((frac_start != 0) || gen_ssc)
+		return 0x8;
+
+	return 0x30;
+}
+
+static inline u32 pll_get_rctrl(u64 frac_start, bool gen_ssc)
+{
+	if ((frac_start != 0) || gen_ssc)
+		return 0x16;
+
+	return 0x18;
+}
+
+static inline u32 pll_get_cctrl(u64 frac_start, bool gen_ssc)
+{
+	if ((frac_start != 0) || gen_ssc)
+		return 0x34;
+
+	return 0x2;
+}
+
+static inline u32 pll_get_integloop_gain(u64 frac_start, u64 bclk, u32 ref_clk,
+					 bool gen_ssc)
+{
+	int digclk_divsel = bclk > HDMI_DIG_FREQ_BIT_CLK_THRESHOLD ? 1 : 2;
+	u64 base;
+
+	if ((frac_start != 0) || gen_ssc)
+		base = 0x3F;
+	else
+		base = 0xC4;
+
+	base <<= (digclk_divsel == 2 ? 1 : 0);
+
+	return (base <= 2046 ? base : 2046);
+}
+
+static inline u32 pll_get_pll_cmp(u64 fdata, unsigned long ref_clk)
+{
+	u64 dividend = HDMI_PLL_CMP_CNT * fdata;
+	u32 divisor = ref_clk * 10;
+	u32 rem;
+
+	rem = do_div(dividend, divisor);
+	if (rem > (divisor >> 1))
+		dividend++;
+
+	return dividend - 1;
+}
+
+static inline u64 pll_cmp_to_fdata(u32 pll_cmp, unsigned long ref_clk)
+{
+	u64 fdata = ((u64)pll_cmp) * ref_clk * 10;
+
+	do_div(fdata, HDMI_PLL_CMP_CNT);
+
+	return fdata;
+}
+
+#define HDMI_REF_CLOCK_HZ ((u64)19200000)
+#define HDMI_MHZ_TO_HZ ((u64)1000000)
+static int pll_get_post_div(struct hdmi_8998_post_divider *pd, u64 bclk)
+{
+	u32 const ratio_list[] = {1, 2, 3, 4, 5, 6,
+				     9, 10, 12, 15, 25};
+	u32 const band_list[] = {0, 1, 2, 3};
+	u32 const sz_ratio = ARRAY_SIZE(ratio_list);
+	u32 const sz_band = ARRAY_SIZE(band_list);
+	u32 const cmp_cnt = 1024;
+	u32 const th_min = 500, th_max = 1000;
+	u32 half_rate_mode = 0;
+	u32 list_elements;
+	int optimal_index;
+	u32 i, j, k;
+	u32 found_hsclk_divsel = 0, found_vco_ratio;
+	u32 found_tx_band_sel;
+	u64 const min_freq = HDMI_VCO_MIN_FREQ, max_freq = HDMI_VCO_MAX_FREQ;
+	u64 freq_list[ARRAY_SIZE(ratio_list) * ARRAY_SIZE(band_list)];
+	u64 found_vco_freq;
+	u64 freq_optimal;
+
+find_optimal_index:
+	freq_optimal = max_freq;
+	optimal_index = -1;
+	list_elements = 0;
+
+	for (i = 0; i < sz_ratio; i++) {
+		for (j = 0; j < sz_band; j++) {
+			u64 freq = div_u64(bclk, (1 << half_rate_mode));
+
+			freq *= (ratio_list[i] * (1 << band_list[j]));
+			freq_list[list_elements++] = freq;
+		}
+	}
+
+	for (k = 0; k < ARRAY_SIZE(freq_list); k++) {
+		u32 const clks_pll_div = 2, core_clk_div = 5;
+		u32 const rng1 = 16, rng2 = 8;
+		u32 th1, th2;
+		u64 core_clk, rvar1, rem;
+
+		core_clk = div_u64(freq_list[k],
+				   ratio_list[k / sz_band] * clks_pll_div *
+				   core_clk_div);
+
+		rvar1 = HDMI_REF_CLOCK_HZ * rng1 * HDMI_MHZ_TO_HZ;
+		rvar1 = div64_u64_rem(rvar1, (cmp_cnt * core_clk), &rem);
+		if (rem > ((cmp_cnt * core_clk) >> 1))
+			rvar1++;
+		th1 = rvar1;
+
+		rvar1 = HDMI_REF_CLOCK_HZ * rng2 * HDMI_MHZ_TO_HZ;
+		rvar1 = div64_u64_rem(rvar1, (cmp_cnt * core_clk), &rem);
+		if (rem > ((cmp_cnt * core_clk) >> 1))
+			rvar1++;
+		th2 = rvar1;
+
+		if (freq_list[k] >= min_freq &&
+				freq_list[k] <= max_freq) {
+			if ((th1 >= th_min && th1 <= th_max) ||
+					(th2 >= th_min && th2 <= th_max)) {
+				if (freq_list[k] <= freq_optimal) {
+					freq_optimal = freq_list[k];
+					optimal_index = k;
+				}
+			}
+		}
+	}
+
+	if (optimal_index == -1) {
+		if (!half_rate_mode) {
+			half_rate_mode = 1;
+			goto find_optimal_index;
+		} else {
+			return -EINVAL;
+		}
+	} else {
+		found_vco_ratio = ratio_list[optimal_index / sz_band];
+		found_tx_band_sel = band_list[optimal_index % sz_band];
+		found_vco_freq = freq_optimal;
+	}
+
+	switch (found_vco_ratio) {
+	case 1:
+		found_hsclk_divsel = 15;
+		break;
+	case 2:
+		found_hsclk_divsel = 0;
+		break;
+	case 3:
+		found_hsclk_divsel = 4;
+		break;
+	case 4:
+		found_hsclk_divsel = 8;
+		break;
+	case 5:
+		found_hsclk_divsel = 12;
+		break;
+	case 6:
+		found_hsclk_divsel = 1;
+		break;
+	case 9:
+		found_hsclk_divsel = 5;
+		break;
+	case 10:
+		found_hsclk_divsel = 2;
+		break;
+	case 12:
+		found_hsclk_divsel = 9;
+		break;
+	case 15:
+		found_hsclk_divsel = 13;
+		break;
+	case 25:
+		found_hsclk_divsel = 14;
+		break;
+	};
+
+	pd->vco_freq = found_vco_freq;
+	pd->tx_band_sel = found_tx_band_sel;
+	pd->vco_ratio = found_vco_ratio;
+	pd->hsclk_divsel = found_hsclk_divsel;
+
+	return 0;
+}
+
+static int pll_calculate(unsigned long pix_clk, unsigned long ref_clk,
+			 struct hdmi_8998_phy_pll_reg_cfg *cfg)
+{
+	struct hdmi_8998_post_divider pd;
+	u64 bclk;
+	u64 dec_start;
+	u64 frac_start;
+	u64 fdata;
+	u32 pll_divisor;
+	u32 rem;
+	u32 cpctrl;
+	u32 rctrl;
+	u32 cctrl;
+	u32 integloop_gain;
+	u32 pll_cmp;
+	int i, ret;
+
+	/* bit clk = 10 * pix_clk */
+	bclk = ((u64)pix_clk) * 10;
+
+	ret = pll_get_post_div(&pd, bclk);
+	if (ret)
+		return ret;
+
+	dec_start = pd.vco_freq;
+	pll_divisor = 4 * ref_clk;
+	do_div(dec_start, pll_divisor);
+
+	frac_start = pd.vco_freq * (1 << 20);
+
+	rem = do_div(frac_start, pll_divisor);
+	frac_start -= dec_start * (1 << 20);
+	if (rem > (pll_divisor >> 1))
+		frac_start++;
+
+	cpctrl = pll_get_cpctrl(frac_start, ref_clk, false);
+	rctrl = pll_get_rctrl(frac_start, false);
+	cctrl = pll_get_cctrl(frac_start, false);
+	integloop_gain = pll_get_integloop_gain(frac_start, bclk,
+						ref_clk, false);
+
+	fdata = pd.vco_freq;
+	do_div(fdata, pd.vco_ratio);
+
+	pll_cmp = pll_get_pll_cmp(fdata, ref_clk);
+
+	/* Convert these values to register specific values */
+	if (bclk > HDMI_DIG_FREQ_BIT_CLK_THRESHOLD)
+		cfg->com_svs_mode_clk_sel = 1;
+	else
+		cfg->com_svs_mode_clk_sel = 2;
+
+	cfg->com_hsclk_sel = (0x20 | pd.hsclk_divsel);
+	cfg->com_pll_cctrl_mode0 = cctrl;
+	cfg->com_pll_rctrl_mode0 = rctrl;
+	cfg->com_cp_ctrl_mode0 = cpctrl;
+	cfg->com_dec_start_mode0 = dec_start;
+	cfg->com_div_frac_start1_mode0 = (frac_start & 0xff);
+	cfg->com_div_frac_start2_mode0 = ((frac_start & 0xff00) >> 8);
+	cfg->com_div_frac_start3_mode0 = ((frac_start & 0xf0000) >> 16);
+	cfg->com_integloop_gain0_mode0 = (integloop_gain & 0xff);
+	cfg->com_integloop_gain1_mode0 = ((integloop_gain & 0xf00) >> 8);
+	cfg->com_lock_cmp1_mode0 = (pll_cmp & 0xff);
+	cfg->com_lock_cmp2_mode0 = ((pll_cmp & 0xff00) >> 8);
+	cfg->com_lock_cmp3_mode0 = ((pll_cmp & 0x30000) >> 16);
+	cfg->com_lock_cmp_en = 0x0;
+	cfg->com_core_clk_en = 0x2c;
+	cfg->com_coreclk_div_mode0 = HDMI_CORECLK_DIV;
+	cfg->phy_mode = (bclk > HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD) ? 0x5 : 0x4;
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++)
+		cfg->tx_lx_tx_band[i] = pd.tx_band_sel;
+
+	if (bclk > HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD) {
+		cfg->tx_lx_tx_drv_lvl[0] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[1] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[2] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[3] = 0x0f;
+		cfg->tx_lx_tx_emp_post1_lvl[0] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[1] = 0x02;
+		cfg->tx_lx_tx_emp_post1_lvl[2] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[3] = 0x00;
+		cfg->tx_lx_pre_driver_1[0] = 0x00;
+		cfg->tx_lx_pre_driver_1[1] = 0x00;
+		cfg->tx_lx_pre_driver_1[2] = 0x00;
+		cfg->tx_lx_pre_driver_1[3] = 0x00;
+		cfg->tx_lx_pre_driver_2[0] = 0x1C;
+		cfg->tx_lx_pre_driver_2[1] = 0x1C;
+		cfg->tx_lx_pre_driver_2[2] = 0x1C;
+		cfg->tx_lx_pre_driver_2[3] = 0x00;
+		cfg->tx_lx_res_code_offset[0] = 0x03;
+		cfg->tx_lx_res_code_offset[1] = 0x00;
+		cfg->tx_lx_res_code_offset[2] = 0x00;
+		cfg->tx_lx_res_code_offset[3] = 0x03;
+	} else if (bclk > HDMI_DIG_FREQ_BIT_CLK_THRESHOLD) {
+		cfg->tx_lx_tx_drv_lvl[0] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[1] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[2] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[3] = 0x0f;
+		cfg->tx_lx_tx_emp_post1_lvl[0] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[1] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[2] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[3] = 0x00;
+		cfg->tx_lx_pre_driver_1[0] = 0x00;
+		cfg->tx_lx_pre_driver_1[1] = 0x00;
+		cfg->tx_lx_pre_driver_1[2] = 0x00;
+		cfg->tx_lx_pre_driver_1[3] = 0x00;
+		cfg->tx_lx_pre_driver_2[0] = 0x16;
+		cfg->tx_lx_pre_driver_2[1] = 0x16;
+		cfg->tx_lx_pre_driver_2[2] = 0x16;
+		cfg->tx_lx_pre_driver_2[3] = 0x18;
+		cfg->tx_lx_res_code_offset[0] = 0x03;
+		cfg->tx_lx_res_code_offset[1] = 0x00;
+		cfg->tx_lx_res_code_offset[2] = 0x00;
+		cfg->tx_lx_res_code_offset[3] = 0x00;
+	} else if (bclk > HDMI_MID_FREQ_BIT_CLK_THRESHOLD) {
+		cfg->tx_lx_tx_drv_lvl[0] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[1] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[2] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[3] = 0x0f;
+		cfg->tx_lx_tx_emp_post1_lvl[0] = 0x05;
+		cfg->tx_lx_tx_emp_post1_lvl[1] = 0x05;
+		cfg->tx_lx_tx_emp_post1_lvl[2] = 0x05;
+		cfg->tx_lx_tx_emp_post1_lvl[3] = 0x00;
+		cfg->tx_lx_pre_driver_1[0] = 0x00;
+		cfg->tx_lx_pre_driver_1[1] = 0x00;
+		cfg->tx_lx_pre_driver_1[2] = 0x00;
+		cfg->tx_lx_pre_driver_1[3] = 0x00;
+		cfg->tx_lx_pre_driver_2[0] = 0x0E;
+		cfg->tx_lx_pre_driver_2[1] = 0x0E;
+		cfg->tx_lx_pre_driver_2[2] = 0x0E;
+		cfg->tx_lx_pre_driver_2[3] = 0x0E;
+		cfg->tx_lx_res_code_offset[0] = 0x00;
+		cfg->tx_lx_res_code_offset[1] = 0x00;
+		cfg->tx_lx_res_code_offset[2] = 0x00;
+		cfg->tx_lx_res_code_offset[3] = 0x00;
+	} else {
+		cfg->tx_lx_tx_drv_lvl[0] = 0x01;
+		cfg->tx_lx_tx_drv_lvl[1] = 0x01;
+		cfg->tx_lx_tx_drv_lvl[2] = 0x01;
+		cfg->tx_lx_tx_drv_lvl[3] = 0x00;
+		cfg->tx_lx_tx_emp_post1_lvl[0] = 0x00;
+		cfg->tx_lx_tx_emp_post1_lvl[1] = 0x00;
+		cfg->tx_lx_tx_emp_post1_lvl[2] = 0x00;
+		cfg->tx_lx_tx_emp_post1_lvl[3] = 0x00;
+		cfg->tx_lx_pre_driver_1[0] = 0x00;
+		cfg->tx_lx_pre_driver_1[1] = 0x00;
+		cfg->tx_lx_pre_driver_1[2] = 0x00;
+		cfg->tx_lx_pre_driver_1[3] = 0x00;
+		cfg->tx_lx_pre_driver_2[0] = 0x16;
+		cfg->tx_lx_pre_driver_2[1] = 0x16;
+		cfg->tx_lx_pre_driver_2[2] = 0x16;
+		cfg->tx_lx_pre_driver_2[3] = 0x18;
+		cfg->tx_lx_res_code_offset[0] = 0x00;
+		cfg->tx_lx_res_code_offset[1] = 0x00;
+		cfg->tx_lx_res_code_offset[2] = 0x00;
+		cfg->tx_lx_res_code_offset[3] = 0x00;
+	}
+
+	return 0;
+}
+
+static int hdmi_8998_pll_set_clk_rate(struct clk_hw *hw, unsigned long rate,
+				      unsigned long parent_rate)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+	struct hdmi_8998_phy_pll_reg_cfg cfg = {};
+	int i, ret;
+
+	ret = pll_calculate(rate, parent_rate, &cfg);
+	if (ret) {
+		DRM_ERROR("PLL calculation failed\n");
+		return ret;
+	}
+
+	/* Initially shut down PHY */
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_PD_CTL, 0x0);
+	udelay(500);
+
+	/* Power up sequence */
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_PD_CTL, 0x1);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_RESETSM_CNTRL, 0x20);
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CMN_CTRL, 0x6);
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_INTERFACE_SELECT_TX_BAND,
+				   cfg.tx_lx_tx_band[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_CLKBUF_TERM_ENABLE,
+				   0x1);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_LANE_MODE,
+				   0x20);
+	}
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_SYSCLK_BUF_ENABLE, 0x02);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_BIAS_EN_CLKBUFLR_EN, 0x0B);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_SYSCLK_EN_SEL, 0x37);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_SYS_CLK_CTRL, 0x02);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CLK_ENABLE1, 0x0E);
+
+	/* Bypass VCO calibration */
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_SVS_MODE_CLK_SEL,
+		       cfg.com_svs_mode_clk_sel);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_PLL_IVCO, 0x07);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_VCO_TUNE_CTRL, 0x00);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CLK_SEL, 0x30);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_HSCLK_SEL,
+		       cfg.com_hsclk_sel);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_LOCK_CMP_EN,
+		       cfg.com_lock_cmp_en);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_PLL_CCTRL_MODE0,
+		       cfg.com_pll_cctrl_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_PLL_RCTRL_MODE0,
+		       cfg.com_pll_rctrl_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CP_CTRL_MODE0,
+		       cfg.com_cp_ctrl_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_DEC_START_MODE0,
+		       cfg.com_dec_start_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_DIV_FRAC_START1_MODE0,
+		       cfg.com_div_frac_start1_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_DIV_FRAC_START2_MODE0,
+		       cfg.com_div_frac_start2_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_DIV_FRAC_START3_MODE0,
+		       cfg.com_div_frac_start3_mode0);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_INTEGLOOP_GAIN0_MODE0,
+		       cfg.com_integloop_gain0_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_INTEGLOOP_GAIN1_MODE0,
+		       cfg.com_integloop_gain1_mode0);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_LOCK_CMP1_MODE0,
+		       cfg.com_lock_cmp1_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_LOCK_CMP2_MODE0,
+		       cfg.com_lock_cmp2_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_LOCK_CMP3_MODE0,
+		       cfg.com_lock_cmp3_mode0);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_VCO_TUNE_MAP, 0x00);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CORE_CLK_EN,
+		       cfg.com_core_clk_en);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CORECLK_DIV_MODE0,
+		       cfg.com_coreclk_div_mode0);
+
+	/* TX lanes setup (TX 0/1/2/3) */
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_DRV_LVL,
+				   cfg.tx_lx_tx_drv_lvl[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_EMP_POST1_LVL,
+				   cfg.tx_lx_tx_emp_post1_lvl[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_PRE_DRIVER_1,
+				   cfg.tx_lx_pre_driver_1[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_PRE_DRIVER_2,
+				   cfg.tx_lx_pre_driver_2[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_DRV_LVL_RES_CODE_OFFSET,
+				   cfg.tx_lx_res_code_offset[i]);
+	}
+
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_MODE, cfg.phy_mode);
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_LANE_CONFIG,
+				   0x10);
+	}
+
+	/*
+	 * Ensure that vco configuration gets flushed to hardware before
+	 * enabling the PLL
+	 */
+	wmb();
+
+	pll->rate = rate;
+
+	return 0;
+}
+
+static int hdmi_8998_phy_ready_status(struct hdmi_phy *phy)
+{
+	u32 nb_tries = HDMI_PLL_POLL_MAX_READS;
+	unsigned long timeout = HDMI_PLL_POLL_TIMEOUT_US;
+	u32 status;
+	int phy_ready = 0;
+
+	while (nb_tries--) {
+		status = hdmi_phy_read(phy, REG_HDMI_8998_PHY_STATUS);
+		phy_ready = status & BIT(0);
+
+		if (phy_ready)
+			break;
+
+		udelay(timeout);
+	}
+
+	return phy_ready;
+}
+
+static int hdmi_8998_pll_lock_status(struct hdmi_pll_8998 *pll)
+{
+	u32 status;
+	int nb_tries = HDMI_PLL_POLL_MAX_READS;
+	unsigned long timeout = HDMI_PLL_POLL_TIMEOUT_US;
+	int pll_locked = 0;
+
+	while (nb_tries--) {
+		status = hdmi_pll_read(pll,
+				       REG_HDMI_8998_PHY_QSERDES_COM_C_READY_STATUS);
+		pll_locked = status & BIT(0);
+
+		if (pll_locked)
+			break;
+
+		udelay(timeout);
+	}
+
+	return pll_locked;
+}
+
+static int hdmi_8998_pll_prepare(struct clk_hw *hw)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+	int i, ret = 0;
+
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CFG, 0x1);
+	udelay(100);
+
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CFG, 0x59);
+	udelay(100);
+
+	ret = hdmi_8998_pll_lock_status(pll);
+	if (!ret)
+		return ret;
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_LANE_CONFIG, 0x1F);
+	}
+
+	/* Ensure all registers are flushed to hardware */
+	wmb();
+
+	ret = hdmi_8998_phy_ready_status(phy);
+	if (!ret)
+		return ret;
+
+	/* Restart the retiming buffer */
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CFG, 0x58);
+	udelay(1);
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CFG, 0x59);
+
+	/* Ensure all registers are flushed to hardware */
+	wmb();
+
+	return 0;
+}
+
+static long hdmi_8998_pll_round_rate(struct clk_hw *hw,
+				     unsigned long rate,
+				     unsigned long *parent_rate)
+{
+	if (rate < HDMI_PCLK_MIN_FREQ)
+		return HDMI_PCLK_MIN_FREQ;
+	else if (rate > HDMI_PCLK_MAX_FREQ)
+		return HDMI_PCLK_MAX_FREQ;
+	else
+		return rate;
+}
+
+static unsigned long hdmi_8998_pll_recalc_rate(struct clk_hw *hw,
+					       unsigned long parent_rate)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	return pll->rate;
+}
+
+static void hdmi_8998_pll_unprepare(struct clk_hw *hw)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_PD_CTL, 0);
+	usleep_range(100, 150);
+}
+
+static int hdmi_8998_pll_is_enabled(struct clk_hw *hw)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	u32 status;
+	int pll_locked;
+
+	status = hdmi_pll_read(pll, REG_HDMI_8998_PHY_QSERDES_COM_C_READY_STATUS);
+	pll_locked = status & BIT(0);
+
+	return pll_locked;
+}
+
+static const struct clk_ops hdmi_8998_pll_ops = {
+	.set_rate = hdmi_8998_pll_set_clk_rate,
+	.round_rate = hdmi_8998_pll_round_rate,
+	.recalc_rate = hdmi_8998_pll_recalc_rate,
+	.prepare = hdmi_8998_pll_prepare,
+	.unprepare = hdmi_8998_pll_unprepare,
+	.is_enabled = hdmi_8998_pll_is_enabled,
+};
+
+static const struct clk_init_data pll_init = {
+	.name = "hdmipll",
+	.ops = &hdmi_8998_pll_ops,
+	.parent_data = (const struct clk_parent_data[]){
+		{ .fw_name = "xo", .name = "xo_board" },
+	},
+	.num_parents = 1,
+	.flags = CLK_IGNORE_UNUSED,
+};
+
+int msm_hdmi_pll_8998_init(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct hdmi_pll_8998 *pll;
+	int ret, i;
+
+	pll = devm_kzalloc(dev, sizeof(*pll), GFP_KERNEL);
+	if (!pll)
+		return -ENOMEM;
+
+	pll->pdev = pdev;
+
+	pll->mmio_qserdes_com = msm_ioremap(pdev, "hdmi_pll");
+	if (IS_ERR(pll->mmio_qserdes_com)) {
+		DRM_DEV_ERROR(dev, "failed to map pll base\n");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		char name[32];
+
+		snprintf(name, sizeof(name), "hdmi_tx_l%d", i);
+
+		pll->mmio_qserdes_tx[i] = msm_ioremap(pdev, name);
+		if (IS_ERR(pll->mmio_qserdes_tx[i])) {
+			DRM_DEV_ERROR(dev, "failed to map pll base\n");
+			return -ENOMEM;
+		}
+	}
+	pll->clk_hw.init = &pll_init;
+
+	ret = devm_clk_hw_register(dev, &pll->clk_hw);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to register pll clock\n");
+		return ret;
+	}
+
+	ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, &pll->clk_hw);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to register clk provider: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static const char * const hdmi_phy_8998_reg_names[] = {
+	"vddio",
+	"vcca",
+};
+
+static const char * const hdmi_phy_8998_clk_names[] = {
+	"iface", "ref", "xo",
+};
+
+const struct hdmi_phy_cfg msm_hdmi_phy_8998_cfg = {
+	.type = MSM_HDMI_PHY_8998,
+	.reg_names = hdmi_phy_8998_reg_names,
+	.num_regs = ARRAY_SIZE(hdmi_phy_8998_reg_names),
+	.clk_names = hdmi_phy_8998_clk_names,
+	.num_clks = ARRAY_SIZE(hdmi_phy_8998_clk_names),
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/msm_atomic.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/msm_atomic.c
@@ -210,6 +210,8 @@
 
 	trace_msm_atomic_commit_tail_start(async, crtc_mask);
 
+	drm_dp_mst_atomic_wait_for_dependencies(state);
+
 	kms->funcs->enable_commit(kms);
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/msm_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/msm_drv.c
@@ -17,8 +17,9 @@
 
 #include "msm_drv.h"
 #include "msm_debugfs.h"
+#include "msm_gem.h"
+#include "msm_gpu.h"
 #include "msm_kms.h"
-#include "adreno/adreno_gpu.h"
 
 /*
  * MSM driver version:
@@ -1037,10 +1038,6 @@
 			return ret;
 	}
 
-	ret = add_gpu_components(master_dev, &match);
-	if (ret)
-		return ret;
-
 	/* on all devices that I am aware of, iommu's which can map
 	 * any address the cpu can see are used:
 	 */
@@ -1089,7 +1086,6 @@
 	msm_dsi_register();
 	msm_hdmi_register();
 	msm_dp_register();
-	adreno_register();
 	msm_mdp4_register();
 	msm_mdss_register();
 	return platform_driver_register(&msm_platform_driver);
@@ -1103,7 +1099,6 @@
 	msm_mdp4_unregister();
 	msm_dp_unregister();
 	msm_hdmi_unregister();
-	adreno_unregister();
 	msm_dsi_unregister();
 	msm_mdp_unregister();
 	msm_dpu_unregister();
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/msm_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/msm_drv.h
@@ -30,6 +30,7 @@
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_probe_helper.h>
 #include <drm/display/drm_dsc.h>
+#include <drm/display/drm_dp_mst_helper.h>
 #include <drm/msm_drm.h>
 #include <drm/drm_gem.h>
 
@@ -75,16 +76,6 @@
 #define MAX_H_TILES_PER_DISPLAY 2
 
 /**
- * enum msm_event_wait - type of HW events to wait for
- * @MSM_ENC_COMMIT_DONE - wait for the driver to flush the registers to HW
- * @MSM_ENC_TX_COMPLETE - wait for the HW to transfer the frame to panel
- */
-enum msm_event_wait {
-	MSM_ENC_COMMIT_DONE = 0,
-	MSM_ENC_TX_COMPLETE,
-};
-
-/**
  * struct msm_display_topology - defines a display topology pipeline
  * @num_lm:       number of layer mixers used
  * @num_intf:     number of interfaces the panel is mounted on
@@ -385,11 +376,22 @@
 int __init msm_dp_register(void);
 void __exit msm_dp_unregister(void);
 int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev,
-			 struct drm_encoder *encoder);
+			 struct drm_encoder *encoder, bool yuv_supported);
 void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp_display);
-
+bool msm_dp_is_yuv_420_enabled(const struct msm_dp *dp_display,
+			       const struct drm_display_mode *mode);
+bool msm_dp_needs_periph_flush(const struct msm_dp *dp_display,
+			       const struct drm_display_mode *mode);
 bool msm_dp_wide_bus_available(const struct msm_dp *dp_display);
 
+int msm_dp_get_mst_max_stream(const struct msm_dp *dp_display);
+
+int msm_dp_mst_bridge_init(struct msm_dp *dp_display, struct drm_encoder *encoder);
+
+int msm_dp_mst_register(struct msm_dp *dp_display);
+
+int msm_dp_get_mst_intf_id(struct msm_dp *dp_display, int stream_id);
+
 #else
 static inline int __init msm_dp_register(void)
 {
@@ -400,7 +402,23 @@
 }
 static inline int msm_dp_modeset_init(struct msm_dp *dp_display,
 				       struct drm_device *dev,
-				       struct drm_encoder *encoder)
+				       struct drm_encoder *encoder,
+				       bool yuv_supported)
+{
+	return -EINVAL;
+}
+
+static inline int msm_dp_get_mst_max_stream(struct msm_dp *dp_display)
+{
+	return -EINVAL;
+}
+
+static inline int msm_dp_mst_register(struct msm_dp *dp_display)
+{
+	return -EINVAL;
+}
+
+static inline int msm_dp_mst_bridge_init(struct msm_dp *dp_display, struct drm_encoder *encoder)
 {
 	return -EINVAL;
 }
@@ -409,11 +427,28 @@
 {
 }
 
+static inline bool msm_dp_is_yuv_420_enabled(const struct msm_dp *dp_display,
+					     const struct drm_display_mode *mode)
+{
+	return false;
+}
+
+static inline bool msm_dp_needs_periph_flush(const struct msm_dp *dp_display,
+					     const struct drm_display_mode *mode)
+{
+	return false;
+}
+
 static inline bool msm_dp_wide_bus_available(const struct msm_dp *dp_display)
 {
 	return false;
 }
 
+static inline int msm_dp_get_mst_intf_id(struct msm_dp *dp_display, int stream_id)
+{
+	return -EINVAL;
+}
+
 #endif
 
 #ifdef CONFIG_DRM_MSM_MDP4
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/msm_fb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/msm_fb.c
@@ -89,7 +89,7 @@
 
 	for (i = 0; i < n; i++) {
 		ret = msm_gem_get_and_pin_iova(fb->obj[i], aspace, &msm_fb->iova[i]);
-		drm_dbg_state(fb->dev, "FB[%u]: iova[%d]: %08llx (%d)",
+		drm_dbg_state(fb->dev, "FB[%u]: iova[%d]: %08llx (%d)\n",
 			      fb->base.id, i, msm_fb->iova[i], ret);
 		if (ret)
 			return ret;
@@ -176,7 +176,7 @@
 	const struct msm_format *format;
 	int ret, i, n;
 
-	drm_dbg_state(dev, "create framebuffer: mode_cmd=%p (%dx%d@%4.4s)",
+	drm_dbg_state(dev, "create framebuffer: mode_cmd=%p (%dx%d@%4.4s)\n",
 			mode_cmd, mode_cmd->width, mode_cmd->height,
 			(char *)&mode_cmd->pixel_format);
 
@@ -232,7 +232,7 @@
 
 	refcount_set(&msm_fb->dirtyfb, 1);
 
-	drm_dbg_state(dev, "create: FB ID: %d (%p)", fb->base.id, fb);
+	drm_dbg_state(dev, "create: FB ID: %d (%p)\n", fb->base.id, fb);
 
 	return fb;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/msm_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/msm_gpu.c
@@ -11,7 +11,7 @@
 #include "msm_mmu.h"
 #include "msm_fence.h"
 #include "msm_gpu_trace.h"
-#include "adreno/adreno_gpu.h"
+//#include "adreno/adreno_gpu.h"
 
 #include <generated/utsrelease.h>
 #include <linux/string_helpers.h>
@@ -929,7 +929,6 @@
 	if (IS_ERR(gpu->gpu_cx))
 		gpu->gpu_cx = NULL;
 
-	gpu->pdev = pdev;
 	platform_set_drvdata(pdev, &gpu->adreno_smmu);
 
 	msm_devfreq_init(gpu);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/msm_gpu_devfreq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/msm_gpu_devfreq.c
@@ -140,6 +140,7 @@
 {
 	struct msm_gpu_devfreq *df = &gpu->devfreq;
 	struct msm_drm_private *priv = gpu->dev->dev_private;
+	int ret;
 
 	/* We need target support to do devfreq */
 	if (!gpu->funcs->gpu_busy)
@@ -156,8 +157,12 @@
 
 	mutex_init(&df->lock);
 
-	dev_pm_qos_add_request(&gpu->pdev->dev, &df->boost_freq,
-			       DEV_PM_QOS_MIN_FREQUENCY, 0);
+	ret = dev_pm_qos_add_request(&gpu->pdev->dev, &df->boost_freq,
+				     DEV_PM_QOS_MIN_FREQUENCY, 0);
+	if (ret < 0) {
+		DRM_DEV_ERROR(&gpu->pdev->dev, "Couldn't initialize QoS\n");
+		return;
+	}
 
 	msm_devfreq_profile.initial_freq = gpu->fast_rate;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/msm_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/msm_kms.c
@@ -28,6 +28,7 @@
 
 static const struct drm_mode_config_helper_funcs mode_config_helper_funcs = {
 	.atomic_commit_tail = msm_atomic_commit_tail,
+	.atomic_commit_setup = drm_dp_mst_atomic_setup_commit,
 };
 
 static irqreturn_t msm_irq(int irq, void *arg)
@@ -149,7 +150,7 @@
 	struct msm_kms *kms = priv->kms;
 	if (!kms)
 		return -ENXIO;
-	drm_dbg_vbl(dev, "crtc=%u", crtc->base.id);
+	drm_dbg_vbl(dev, "crtc=%u\n", crtc->base.id);
 	return vblank_ctrl_queue_work(priv, crtc, true);
 }
 
@@ -160,7 +161,7 @@
 	struct msm_kms *kms = priv->kms;
 	if (!kms)
 		return;
-	drm_dbg_vbl(dev, "crtc=%u", crtc->base.id);
+	drm_dbg_vbl(dev, "crtc=%u\n", crtc->base.id);
 	vblank_ctrl_queue_work(priv, crtc, false);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/msm_mdss.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/msm_mdss.c
@@ -526,7 +526,7 @@
 	.ubwc_enc_version = UBWC_2_0,
 	.ubwc_dec_version = UBWC_2_0,
 	.ubwc_static = 0x1e,
-	.highest_bank_bit = 0x3,
+	.highest_bank_bit = 0x1,
 	.reg_bus_bw = 76800,
 };
 
@@ -602,6 +602,7 @@
 	.ubwc_dec_version = UBWC_3_0,
 	.ubwc_swizzle = 1,
 	.highest_bank_bit = 1,
+	.reg_bus_bw = 76800,
 };
 
 static const struct msm_mdss_data sm8250_data = {
@@ -626,6 +627,24 @@
 	.reg_bus_bw = 74000,
 };
 
+static const struct msm_mdss_data qcs8300_data = {
+	.ubwc_enc_version = UBWC_4_0,
+	.ubwc_dec_version = UBWC_4_0,
+	.ubwc_swizzle = 6,
+	.ubwc_static = 1,
+	.highest_bank_bit = 3,
+	.macrotile_mode = 1,
+};
+
+static const struct msm_mdss_data sa8775p_data = {
+	.ubwc_enc_version = UBWC_4_0,
+	.ubwc_dec_version = UBWC_4_0,
+	.ubwc_swizzle = 4,
+	.ubwc_static = 1,
+	.highest_bank_bit = 0,
+	.macrotile_mode = 1,
+};
+
 static const struct msm_mdss_data sm8550_data = {
 	.ubwc_enc_version = UBWC_4_0,
 	.ubwc_dec_version = UBWC_4_3,
@@ -654,6 +673,8 @@
 	{ .compatible = "qcom,sm8250-mdss", .data = &sm8250_data },
 	{ .compatible = "qcom,sm8350-mdss", .data = &sm8350_data },
 	{ .compatible = "qcom,sm8450-mdss", .data = &sm8350_data },
+	{ .compatible = "qcom,qcs8300-mdss", .data = &qcs8300_data },
+	{ .compatible = "qcom,sa8775p-mdss", .data = &sa8775p_data },
 	{ .compatible = "qcom,sm8550-mdss", .data = &sm8550_data },
 	{ .compatible = "qcom,sm8650-mdss", .data = &sm8550_data},
 	{}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/msm_mmu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/msm_mmu.h
@@ -42,7 +42,6 @@
 
 struct msm_mmu *msm_iommu_new(struct device *dev, unsigned long quirks);
 struct msm_mmu *msm_iommu_gpu_new(struct device *dev, struct msm_gpu *gpu, unsigned long quirks);
-struct msm_mmu *msm_gpummu_new(struct device *dev, struct msm_gpu *gpu);
 
 static inline void msm_mmu_set_fault_handler(struct msm_mmu *mmu, void *arg,
 		int (*handler)(void *arg, unsigned long iova, int flags, void *data))
@@ -53,10 +52,6 @@
 
 struct msm_mmu *msm_iommu_pagetable_create(struct msm_mmu *parent);
 
-void msm_gpummu_params(struct msm_mmu *mmu, dma_addr_t *pt_base,
-		dma_addr_t *tran_error);
-
-
 int msm_iommu_pagetable_params(struct msm_mmu *mmu, phys_addr_t *ttbr,
 		int *asid);
 struct iommu_domain_geometry *msm_iommu_get_geometry(struct msm_mmu *mmu);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/adreno/a2xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/adreno/a2xx.xml
@@ -0,0 +1,1865 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+
+<enum name="a2xx_rb_dither_type">
+	<value name="DITHER_PIXEL" value="0"/>
+	<value name="DITHER_SUBPIXEL" value="1"/>
+</enum>
+
+<enum name="a2xx_colorformatx">
+	<value name="COLORX_4_4_4_4" value="0"/>
+	<value name="COLORX_1_5_5_5" value="1"/>
+	<value name="COLORX_5_6_5" value="2"/>
+	<value name="COLORX_8" value="3"/>
+	<value name="COLORX_8_8" value="4"/>
+	<value name="COLORX_8_8_8_8" value="5"/>
+	<value name="COLORX_S8_8_8_8" value="6"/>
+	<value name="COLORX_16_FLOAT" value="7"/>
+	<value name="COLORX_16_16_FLOAT" value="8"/>
+	<value name="COLORX_16_16_16_16_FLOAT" value="9"/>
+	<value name="COLORX_32_FLOAT" value="10"/>
+	<value name="COLORX_32_32_FLOAT" value="11"/>
+	<value name="COLORX_32_32_32_32_FLOAT" value="12"/>
+	<value name="COLORX_2_3_3" value="13"/>
+	<value name="COLORX_8_8_8" value="14"/>
+</enum>
+
+<enum name="a2xx_sq_surfaceformat">
+	<value name="FMT_1_REVERSE" value="0"/>
+	<value name="FMT_1" value="1"/>
+	<value name="FMT_8" value="2"/>
+	<value name="FMT_1_5_5_5" value="3"/>
+	<value name="FMT_5_6_5" value="4"/>
+	<value name="FMT_6_5_5" value="5"/>
+	<value name="FMT_8_8_8_8" value="6"/>
+	<value name="FMT_2_10_10_10" value="7"/>
+	<value name="FMT_8_A" value="8"/>
+	<value name="FMT_8_B" value="9"/>
+	<value name="FMT_8_8" value="10"/>
+	<value name="FMT_Cr_Y1_Cb_Y0" value="11"/>
+	<value name="FMT_Y1_Cr_Y0_Cb" value="12"/>
+	<value name="FMT_5_5_5_1" value="13"/>
+	<value name="FMT_8_8_8_8_A" value="14"/>
+	<value name="FMT_4_4_4_4" value="15"/>
+	<value name="FMT_8_8_8" value="16"/>
+	<value name="FMT_DXT1" value="18"/>
+	<value name="FMT_DXT2_3" value="19"/>
+	<value name="FMT_DXT4_5" value="20"/>
+	<value name="FMT_10_10_10_2" value="21"/>
+	<value name="FMT_24_8" value="22"/>
+	<value name="FMT_16" value="24"/>
+	<value name="FMT_16_16" value="25"/>
+	<value name="FMT_16_16_16_16" value="26"/>
+	<value name="FMT_16_EXPAND" value="27"/>
+	<value name="FMT_16_16_EXPAND" value="28"/>
+	<value name="FMT_16_16_16_16_EXPAND" value="29"/>
+	<value name="FMT_16_FLOAT" value="30"/>
+	<value name="FMT_16_16_FLOAT" value="31"/>
+	<value name="FMT_16_16_16_16_FLOAT" value="32"/>
+	<value name="FMT_32" value="33"/>
+	<value name="FMT_32_32" value="34"/>
+	<value name="FMT_32_32_32_32" value="35"/>
+	<value name="FMT_32_FLOAT" value="36"/>
+	<value name="FMT_32_32_FLOAT" value="37"/>
+	<value name="FMT_32_32_32_32_FLOAT" value="38"/>
+	<value name="FMT_ATI_TC_RGB" value="39"/>
+	<value name="FMT_ATI_TC_RGBA" value="40"/>
+	<value name="FMT_ATI_TC_555_565_RGB" value="41"/>
+	<value name="FMT_ATI_TC_555_565_RGBA" value="42"/>
+	<value name="FMT_ATI_TC_RGBA_INTERP" value="43"/>
+	<value name="FMT_ATI_TC_555_565_RGBA_INTERP" value="44"/>
+	<value name="FMT_ETC1_RGBA_INTERP" value="46"/>
+	<value name="FMT_ETC1_RGB" value="47"/>
+	<value name="FMT_ETC1_RGBA" value="48"/>
+	<value name="FMT_DXN" value="49"/>
+	<value name="FMT_2_3_3" value="51"/>
+	<value name="FMT_2_10_10_10_AS_16_16_16_16" value="54"/>
+	<value name="FMT_10_10_10_2_AS_16_16_16_16" value="55"/>
+	<value name="FMT_32_32_32_FLOAT" value="57"/>
+	<value name="FMT_DXT3A" value="58"/>
+	<value name="FMT_DXT5A" value="59"/>
+	<value name="FMT_CTX1" value="60"/>
+</enum>
+
+<enum name="a2xx_sq_ps_vtx_mode">
+	<value name="POSITION_1_VECTOR" value="0"/>
+	<value name="POSITION_2_VECTORS_UNUSED" value="1"/>
+	<value name="POSITION_2_VECTORS_SPRITE" value="2"/>
+	<value name="POSITION_2_VECTORS_EDGE" value="3"/>
+	<value name="POSITION_2_VECTORS_KILL" value="4"/>
+	<value name="POSITION_2_VECTORS_SPRITE_KILL" value="5"/>
+	<value name="POSITION_2_VECTORS_EDGE_KILL" value="6"/>
+	<value name="MULTIPASS" value="7"/>
+</enum>
+
+<enum name="a2xx_sq_sample_cntl">
+	<value name="CENTROIDS_ONLY" value="0"/>
+	<value name="CENTERS_ONLY" value="1"/>
+	<value name="CENTROIDS_AND_CENTERS" value="2"/>
+</enum>
+
+<enum name="a2xx_dx_clip_space">
+	<value name="DXCLIP_OPENGL" value="0"/>
+	<value name="DXCLIP_DIRECTX" value="1"/>
+</enum>
+
+<enum name="a2xx_pa_su_sc_polymode">
+	<value name="POLY_DISABLED" value="0"/>
+	<value name="POLY_DUALMODE" value="1"/>
+</enum>
+
+<enum name="a2xx_rb_edram_mode">
+	<value name="EDRAM_NOP" value="0"/>
+	<value name="COLOR_DEPTH" value="4"/>
+	<value name="DEPTH_ONLY" value="5"/>
+	<value name="EDRAM_COPY" value="6"/>
+</enum>
+
+<enum name="a2xx_pa_sc_pattern_bit_order">
+	<value name="LITTLE" value="0"/>
+	<value name="BIG" value="1"/>
+</enum>
+
+<enum name="a2xx_pa_sc_auto_reset_cntl">
+	<value name="NEVER" value="0"/>
+	<value name="EACH_PRIMITIVE" value="1"/>
+	<value name="EACH_PACKET" value="2"/>
+</enum>
+
+<enum name="a2xx_pa_pixcenter">
+	<value name="PIXCENTER_D3D" value="0"/>
+	<value name="PIXCENTER_OGL" value="1"/>
+</enum>
+
+<enum name="a2xx_pa_roundmode">
+	<value name="TRUNCATE" value="0"/>
+	<value name="ROUND" value="1"/>
+	<value name="ROUNDTOEVEN" value="2"/>
+	<value name="ROUNDTOODD" value="3"/>
+</enum>
+
+<enum name="a2xx_pa_quantmode">
+	<value name="ONE_SIXTEENTH" value="0"/>
+	<value name="ONE_EIGTH" value="1"/>
+	<value name="ONE_QUARTER" value="2"/>
+	<value name="ONE_HALF" value="3"/>
+	<value name="ONE" value="4"/>
+</enum>
+
+<enum name="a2xx_rb_copy_sample_select">
+	<value name="SAMPLE_0" value="0"/>
+	<value name="SAMPLE_1" value="1"/>
+	<value name="SAMPLE_2" value="2"/>
+	<value name="SAMPLE_3" value="3"/>
+	<value name="SAMPLE_01" value="4"/>
+	<value name="SAMPLE_23" value="5"/>
+	<value name="SAMPLE_0123" value="6"/>
+</enum>
+
+<enum name="a2xx_rb_blend_opcode">
+	<value name="BLEND2_DST_PLUS_SRC" value="0"/>
+	<value name="BLEND2_SRC_MINUS_DST" value="1"/>
+	<value name="BLEND2_MIN_DST_SRC" value="2"/>
+	<value name="BLEND2_MAX_DST_SRC" value="3"/>
+	<value name="BLEND2_DST_MINUS_SRC" value="4"/>
+	<value name="BLEND2_DST_PLUS_SRC_BIAS" value="5"/>
+</enum>
+
+<enum name="a2xx_su_perfcnt_select">
+	<value value="0" name="PERF_PAPC_PASX_REQ"/>
+	<value value="2" name="PERF_PAPC_PASX_FIRST_VECTOR"/>
+	<value value="3" name="PERF_PAPC_PASX_SECOND_VECTOR"/>
+	<value value="4" name="PERF_PAPC_PASX_FIRST_DEAD"/>
+	<value value="5" name="PERF_PAPC_PASX_SECOND_DEAD"/>
+	<value value="6" name="PERF_PAPC_PASX_VTX_KILL_DISCARD"/>
+	<value value="7" name="PERF_PAPC_PASX_VTX_NAN_DISCARD"/>
+	<value value="8" name="PERF_PAPC_PA_INPUT_PRIM"/>
+	<value value="9" name="PERF_PAPC_PA_INPUT_NULL_PRIM"/>
+	<value value="10" name="PERF_PAPC_PA_INPUT_EVENT_FLAG"/>
+	<value value="11" name="PERF_PAPC_PA_INPUT_FIRST_PRIM_SLOT"/>
+	<value value="12" name="PERF_PAPC_PA_INPUT_END_OF_PACKET"/>
+	<value value="13" name="PERF_PAPC_CLPR_CULL_PRIM"/>
+	<value value="15" name="PERF_PAPC_CLPR_VV_CULL_PRIM"/>
+	<value value="17" name="PERF_PAPC_CLPR_VTX_KILL_CULL_PRIM"/>
+	<value value="18" name="PERF_PAPC_CLPR_VTX_NAN_CULL_PRIM"/>
+	<value value="19" name="PERF_PAPC_CLPR_CULL_TO_NULL_PRIM"/>
+	<value value="21" name="PERF_PAPC_CLPR_VV_CLIP_PRIM"/>
+	<value value="23" name="PERF_PAPC_CLPR_POINT_CLIP_CANDIDATE"/>
+	<value value="24" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_1"/>
+	<value value="25" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_2"/>
+	<value value="26" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_3"/>
+	<value value="27" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_4"/>
+	<value value="28" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_5"/>
+	<value value="29" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_6"/>
+	<value value="30" name="PERF_PAPC_CLPR_CLIP_PLANE_NEAR"/>
+	<value value="31" name="PERF_PAPC_CLPR_CLIP_PLANE_FAR"/>
+	<value value="32" name="PERF_PAPC_CLPR_CLIP_PLANE_LEFT"/>
+	<value value="33" name="PERF_PAPC_CLPR_CLIP_PLANE_RIGHT"/>
+	<value value="34" name="PERF_PAPC_CLPR_CLIP_PLANE_TOP"/>
+	<value value="35" name="PERF_PAPC_CLPR_CLIP_PLANE_BOTTOM"/>
+	<value value="36" name="PERF_PAPC_CLSM_NULL_PRIM"/>
+	<value value="37" name="PERF_PAPC_CLSM_TOTALLY_VISIBLE_PRIM"/>
+	<value value="38" name="PERF_PAPC_CLSM_CLIP_PRIM"/>
+	<value value="39" name="PERF_PAPC_CLSM_CULL_TO_NULL_PRIM"/>
+	<value value="40" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_1"/>
+	<value value="41" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_2"/>
+	<value value="42" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_3"/>
+	<value value="43" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_4"/>
+	<value value="44" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_5"/>
+	<value value="45" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_6_7"/>
+	<value value="46" name="PERF_PAPC_CLSM_NON_TRIVIAL_CULL"/>
+	<value value="47" name="PERF_PAPC_SU_INPUT_PRIM"/>
+	<value value="48" name="PERF_PAPC_SU_INPUT_CLIP_PRIM"/>
+	<value value="49" name="PERF_PAPC_SU_INPUT_NULL_PRIM"/>
+	<value value="50" name="PERF_PAPC_SU_ZERO_AREA_CULL_PRIM"/>
+	<value value="51" name="PERF_PAPC_SU_BACK_FACE_CULL_PRIM"/>
+	<value value="52" name="PERF_PAPC_SU_FRONT_FACE_CULL_PRIM"/>
+	<value value="53" name="PERF_PAPC_SU_POLYMODE_FACE_CULL"/>
+	<value value="54" name="PERF_PAPC_SU_POLYMODE_BACK_CULL"/>
+	<value value="55" name="PERF_PAPC_SU_POLYMODE_FRONT_CULL"/>
+	<value value="56" name="PERF_PAPC_SU_POLYMODE_INVALID_FILL"/>
+	<value value="57" name="PERF_PAPC_SU_OUTPUT_PRIM"/>
+	<value value="58" name="PERF_PAPC_SU_OUTPUT_CLIP_PRIM"/>
+	<value value="59" name="PERF_PAPC_SU_OUTPUT_NULL_PRIM"/>
+	<value value="60" name="PERF_PAPC_SU_OUTPUT_EVENT_FLAG"/>
+	<value value="61" name="PERF_PAPC_SU_OUTPUT_FIRST_PRIM_SLOT"/>
+	<value value="62" name="PERF_PAPC_SU_OUTPUT_END_OF_PACKET"/>
+	<value value="63" name="PERF_PAPC_SU_OUTPUT_POLYMODE_FACE"/>
+	<value value="64" name="PERF_PAPC_SU_OUTPUT_POLYMODE_BACK"/>
+	<value value="65" name="PERF_PAPC_SU_OUTPUT_POLYMODE_FRONT"/>
+	<value value="66" name="PERF_PAPC_SU_OUT_CLIP_POLYMODE_FACE"/>
+	<value value="67" name="PERF_PAPC_SU_OUT_CLIP_POLYMODE_BACK"/>
+	<value value="68" name="PERF_PAPC_SU_OUT_CLIP_POLYMODE_FRONT"/>
+	<value value="69" name="PERF_PAPC_PASX_REQ_IDLE"/>
+	<value value="70" name="PERF_PAPC_PASX_REQ_BUSY"/>
+	<value value="71" name="PERF_PAPC_PASX_REQ_STALLED"/>
+	<value value="72" name="PERF_PAPC_PASX_REC_IDLE"/>
+	<value value="73" name="PERF_PAPC_PASX_REC_BUSY"/>
+	<value value="74" name="PERF_PAPC_PASX_REC_STARVED_SX"/>
+	<value value="75" name="PERF_PAPC_PASX_REC_STALLED"/>
+	<value value="76" name="PERF_PAPC_PASX_REC_STALLED_POS_MEM"/>
+	<value value="77" name="PERF_PAPC_PASX_REC_STALLED_CCGSM_IN"/>
+	<value value="78" name="PERF_PAPC_CCGSM_IDLE"/>
+	<value value="79" name="PERF_PAPC_CCGSM_BUSY"/>
+	<value value="80" name="PERF_PAPC_CCGSM_STALLED"/>
+	<value value="81" name="PERF_PAPC_CLPRIM_IDLE"/>
+	<value value="82" name="PERF_PAPC_CLPRIM_BUSY"/>
+	<value value="83" name="PERF_PAPC_CLPRIM_STALLED"/>
+	<value value="84" name="PERF_PAPC_CLPRIM_STARVED_CCGSM"/>
+	<value value="85" name="PERF_PAPC_CLIPSM_IDLE"/>
+	<value value="86" name="PERF_PAPC_CLIPSM_BUSY"/>
+	<value value="87" name="PERF_PAPC_CLIPSM_WAIT_CLIP_VERT_ENGH"/>
+	<value value="88" name="PERF_PAPC_CLIPSM_WAIT_HIGH_PRI_SEQ"/>
+	<value value="89" name="PERF_PAPC_CLIPSM_WAIT_CLIPGA"/>
+	<value value="90" name="PERF_PAPC_CLIPSM_WAIT_AVAIL_VTE_CLIP"/>
+	<value value="91" name="PERF_PAPC_CLIPSM_WAIT_CLIP_OUTSM"/>
+	<value value="92" name="PERF_PAPC_CLIPGA_IDLE"/>
+	<value value="93" name="PERF_PAPC_CLIPGA_BUSY"/>
+	<value value="94" name="PERF_PAPC_CLIPGA_STARVED_VTE_CLIP"/>
+	<value value="95" name="PERF_PAPC_CLIPGA_STALLED"/>
+	<value value="96" name="PERF_PAPC_CLIP_IDLE"/>
+	<value value="97" name="PERF_PAPC_CLIP_BUSY"/>
+	<value value="98" name="PERF_PAPC_SU_IDLE"/>
+	<value value="99" name="PERF_PAPC_SU_BUSY"/>
+	<value value="100" name="PERF_PAPC_SU_STARVED_CLIP"/>
+	<value value="101" name="PERF_PAPC_SU_STALLED_SC"/>
+	<value value="102" name="PERF_PAPC_SU_FACENESS_CULL"/>
+</enum>
+
+<enum name="a2xx_sc_perfcnt_select">
+	<value value="0" name="SC_SR_WINDOW_VALID"/>
+	<value value="1" name="SC_CW_WINDOW_VALID"/>
+	<value value="2" name="SC_QM_WINDOW_VALID"/>
+	<value value="3" name="SC_FW_WINDOW_VALID"/>
+	<value value="4" name="SC_EZ_WINDOW_VALID"/>
+	<value value="5" name="SC_IT_WINDOW_VALID"/>
+	<value value="6" name="SC_STARVED_BY_PA"/>
+	<value value="7" name="SC_STALLED_BY_RB_TILE"/>
+	<value value="8" name="SC_STALLED_BY_RB_SAMP"/>
+	<value value="9" name="SC_STARVED_BY_RB_EZ"/>
+	<value value="10" name="SC_STALLED_BY_SAMPLE_FF"/>
+	<value value="11" name="SC_STALLED_BY_SQ"/>
+	<value value="12" name="SC_STALLED_BY_SP"/>
+	<value value="13" name="SC_TOTAL_NO_PRIMS"/>
+	<value value="14" name="SC_NON_EMPTY_PRIMS"/>
+	<value value="15" name="SC_NO_TILES_PASSING_QM"/>
+	<value value="16" name="SC_NO_PIXELS_PRE_EZ"/>
+	<value value="17" name="SC_NO_PIXELS_POST_EZ"/>
+</enum>
+
+<enum name="a2xx_vgt_perfcount_select">
+	<value value="0" name="VGT_SQ_EVENT_WINDOW_ACTIVE"/>
+	<value value="1" name="VGT_SQ_SEND"/>
+	<value value="2" name="VGT_SQ_STALLED"/>
+	<value value="3" name="VGT_SQ_STARVED_BUSY"/>
+	<value value="4" name="VGT_SQ_STARVED_IDLE"/>
+	<value value="5" name="VGT_SQ_STATIC"/>
+	<value value="6" name="VGT_PA_EVENT_WINDOW_ACTIVE"/>
+	<value value="7" name="VGT_PA_CLIP_V_SEND"/>
+	<value value="8" name="VGT_PA_CLIP_V_STALLED"/>
+	<value value="9" name="VGT_PA_CLIP_V_STARVED_BUSY"/>
+	<value value="10" name="VGT_PA_CLIP_V_STARVED_IDLE"/>
+	<value value="11" name="VGT_PA_CLIP_V_STATIC"/>
+	<value value="12" name="VGT_PA_CLIP_P_SEND"/>
+	<value value="13" name="VGT_PA_CLIP_P_STALLED"/>
+	<value value="14" name="VGT_PA_CLIP_P_STARVED_BUSY"/>
+	<value value="15" name="VGT_PA_CLIP_P_STARVED_IDLE"/>
+	<value value="16" name="VGT_PA_CLIP_P_STATIC"/>
+	<value value="17" name="VGT_PA_CLIP_S_SEND"/>
+	<value value="18" name="VGT_PA_CLIP_S_STALLED"/>
+	<value value="19" name="VGT_PA_CLIP_S_STARVED_BUSY"/>
+	<value value="20" name="VGT_PA_CLIP_S_STARVED_IDLE"/>
+	<value value="21" name="VGT_PA_CLIP_S_STATIC"/>
+	<value value="22" name="RBIU_FIFOS_EVENT_WINDOW_ACTIVE"/>
+	<value value="23" name="RBIU_IMMED_DATA_FIFO_STARVED"/>
+	<value value="24" name="RBIU_IMMED_DATA_FIFO_STALLED"/>
+	<value value="25" name="RBIU_DMA_REQUEST_FIFO_STARVED"/>
+	<value value="26" name="RBIU_DMA_REQUEST_FIFO_STALLED"/>
+	<value value="27" name="RBIU_DRAW_INITIATOR_FIFO_STARVED"/>
+	<value value="28" name="RBIU_DRAW_INITIATOR_FIFO_STALLED"/>
+	<value value="29" name="BIN_PRIM_NEAR_CULL"/>
+	<value value="30" name="BIN_PRIM_ZERO_CULL"/>
+	<value value="31" name="BIN_PRIM_FAR_CULL"/>
+	<value value="32" name="BIN_PRIM_BIN_CULL"/>
+	<value value="33" name="BIN_PRIM_FACE_CULL"/>
+	<value value="34" name="SPARE34"/>
+	<value value="35" name="SPARE35"/>
+	<value value="36" name="SPARE36"/>
+	<value value="37" name="SPARE37"/>
+	<value value="38" name="SPARE38"/>
+	<value value="39" name="SPARE39"/>
+	<value value="40" name="TE_SU_IN_VALID"/>
+	<value value="41" name="TE_SU_IN_READ"/>
+	<value value="42" name="TE_SU_IN_PRIM"/>
+	<value value="43" name="TE_SU_IN_EOP"/>
+	<value value="44" name="TE_SU_IN_NULL_PRIM"/>
+	<value value="45" name="TE_WK_IN_VALID"/>
+	<value value="46" name="TE_WK_IN_READ"/>
+	<value value="47" name="TE_OUT_PRIM_VALID"/>
+	<value value="48" name="TE_OUT_PRIM_READ"/>
+</enum>
+
+<enum name="a2xx_tcr_perfcount_select">
+	<value value="0" name="DGMMPD_IPMUX0_STALL"/>
+	<value value="4" name="DGMMPD_IPMUX_ALL_STALL"/>
+	<value value="5" name="OPMUX0_L2_WRITES"/>
+</enum>
+
+<enum name="a2xx_tp_perfcount_select">
+	<value value="0" name="POINT_QUADS"/>
+	<value value="1" name="BILIN_QUADS"/>
+	<value value="2" name="ANISO_QUADS"/>
+	<value value="3" name="MIP_QUADS"/>
+	<value value="4" name="VOL_QUADS"/>
+	<value value="5" name="MIP_VOL_QUADS"/>
+	<value value="6" name="MIP_ANISO_QUADS"/>
+	<value value="7" name="VOL_ANISO_QUADS"/>
+	<value value="8" name="ANISO_2_1_QUADS"/>
+	<value value="9" name="ANISO_4_1_QUADS"/>
+	<value value="10" name="ANISO_6_1_QUADS"/>
+	<value value="11" name="ANISO_8_1_QUADS"/>
+	<value value="12" name="ANISO_10_1_QUADS"/>
+	<value value="13" name="ANISO_12_1_QUADS"/>
+	<value value="14" name="ANISO_14_1_QUADS"/>
+	<value value="15" name="ANISO_16_1_QUADS"/>
+	<value value="16" name="MIP_VOL_ANISO_QUADS"/>
+	<value value="17" name="ALIGN_2_QUADS"/>
+	<value value="18" name="ALIGN_4_QUADS"/>
+	<value value="19" name="PIX_0_QUAD"/>
+	<value value="20" name="PIX_1_QUAD"/>
+	<value value="21" name="PIX_2_QUAD"/>
+	<value value="22" name="PIX_3_QUAD"/>
+	<value value="23" name="PIX_4_QUAD"/>
+	<value value="24" name="TP_MIPMAP_LOD0"/>
+	<value value="25" name="TP_MIPMAP_LOD1"/>
+	<value value="26" name="TP_MIPMAP_LOD2"/>
+	<value value="27" name="TP_MIPMAP_LOD3"/>
+	<value value="28" name="TP_MIPMAP_LOD4"/>
+	<value value="29" name="TP_MIPMAP_LOD5"/>
+	<value value="30" name="TP_MIPMAP_LOD6"/>
+	<value value="31" name="TP_MIPMAP_LOD7"/>
+	<value value="32" name="TP_MIPMAP_LOD8"/>
+	<value value="33" name="TP_MIPMAP_LOD9"/>
+	<value value="34" name="TP_MIPMAP_LOD10"/>
+	<value value="35" name="TP_MIPMAP_LOD11"/>
+	<value value="36" name="TP_MIPMAP_LOD12"/>
+	<value value="37" name="TP_MIPMAP_LOD13"/>
+	<value value="38" name="TP_MIPMAP_LOD14"/>
+</enum>
+
+<enum name="a2xx_tcm_perfcount_select">
+	<value value="0" name="QUAD0_RD_LAT_FIFO_EMPTY"/>
+	<value value="3" name="QUAD0_RD_LAT_FIFO_4TH_FULL"/>
+	<value value="4" name="QUAD0_RD_LAT_FIFO_HALF_FULL"/>
+	<value value="5" name="QUAD0_RD_LAT_FIFO_FULL"/>
+	<value value="6" name="QUAD0_RD_LAT_FIFO_LT_4TH_FULL"/>
+	<value value="28" name="READ_STARVED_QUAD0"/>
+	<value value="32" name="READ_STARVED"/>
+	<value value="33" name="READ_STALLED_QUAD0"/>
+	<value value="37" name="READ_STALLED"/>
+	<value value="38" name="VALID_READ_QUAD0"/>
+	<value value="42" name="TC_TP_STARVED_QUAD0"/>
+	<value value="46" name="TC_TP_STARVED"/>
+</enum>
+
+<enum name="a2xx_tcf_perfcount_select">
+	<value value="0" name="VALID_CYCLES"/>
+	<value value="1" name="SINGLE_PHASES"/>
+	<value value="2" name="ANISO_PHASES"/>
+	<value value="3" name="MIP_PHASES"/>
+	<value value="4" name="VOL_PHASES"/>
+	<value value="5" name="MIP_VOL_PHASES"/>
+	<value value="6" name="MIP_ANISO_PHASES"/>
+	<value value="7" name="VOL_ANISO_PHASES"/>
+	<value value="8" name="ANISO_2_1_PHASES"/>
+	<value value="9" name="ANISO_4_1_PHASES"/>
+	<value value="10" name="ANISO_6_1_PHASES"/>
+	<value value="11" name="ANISO_8_1_PHASES"/>
+	<value value="12" name="ANISO_10_1_PHASES"/>
+	<value value="13" name="ANISO_12_1_PHASES"/>
+	<value value="14" name="ANISO_14_1_PHASES"/>
+	<value value="15" name="ANISO_16_1_PHASES"/>
+	<value value="16" name="MIP_VOL_ANISO_PHASES"/>
+	<value value="17" name="ALIGN_2_PHASES"/>
+	<value value="18" name="ALIGN_4_PHASES"/>
+	<value value="19" name="TPC_BUSY"/>
+	<value value="20" name="TPC_STALLED"/>
+	<value value="21" name="TPC_STARVED"/>
+	<value value="22" name="TPC_WORKING"/>
+	<value value="23" name="TPC_WALKER_BUSY"/>
+	<value value="24" name="TPC_WALKER_STALLED"/>
+	<value value="25" name="TPC_WALKER_WORKING"/>
+	<value value="26" name="TPC_ALIGNER_BUSY"/>
+	<value value="27" name="TPC_ALIGNER_STALLED"/>
+	<value value="28" name="TPC_ALIGNER_STALLED_BY_BLEND"/>
+	<value value="29" name="TPC_ALIGNER_STALLED_BY_CACHE"/>
+	<value value="30" name="TPC_ALIGNER_WORKING"/>
+	<value value="31" name="TPC_BLEND_BUSY"/>
+	<value value="32" name="TPC_BLEND_SYNC"/>
+	<value value="33" name="TPC_BLEND_STARVED"/>
+	<value value="34" name="TPC_BLEND_WORKING"/>
+	<value value="35" name="OPCODE_0x00"/>
+	<value value="36" name="OPCODE_0x01"/>
+	<value value="37" name="OPCODE_0x04"/>
+	<value value="38" name="OPCODE_0x10"/>
+	<value value="39" name="OPCODE_0x11"/>
+	<value value="40" name="OPCODE_0x12"/>
+	<value value="41" name="OPCODE_0x13"/>
+	<value value="42" name="OPCODE_0x18"/>
+	<value value="43" name="OPCODE_0x19"/>
+	<value value="44" name="OPCODE_0x1A"/>
+	<value value="45" name="OPCODE_OTHER"/>
+	<value value="56" name="IN_FIFO_0_EMPTY"/>
+	<value value="57" name="IN_FIFO_0_LT_HALF_FULL"/>
+	<value value="58" name="IN_FIFO_0_HALF_FULL"/>
+	<value value="59" name="IN_FIFO_0_FULL"/>
+	<value value="72" name="IN_FIFO_TPC_EMPTY"/>
+	<value value="73" name="IN_FIFO_TPC_LT_HALF_FULL"/>
+	<value value="74" name="IN_FIFO_TPC_HALF_FULL"/>
+	<value value="75" name="IN_FIFO_TPC_FULL"/>
+	<value value="76" name="TPC_TC_XFC"/>
+	<value value="77" name="TPC_TC_STATE"/>
+	<value value="78" name="TC_STALL"/>
+	<value value="79" name="QUAD0_TAPS"/>
+	<value value="83" name="QUADS"/>
+	<value value="84" name="TCA_SYNC_STALL"/>
+	<value value="85" name="TAG_STALL"/>
+	<value value="88" name="TCB_SYNC_STALL"/>
+	<value value="89" name="TCA_VALID"/>
+	<value value="90" name="PROBES_VALID"/>
+	<value value="91" name="MISS_STALL"/>
+	<value value="92" name="FETCH_FIFO_STALL"/>
+	<value value="93" name="TCO_STALL"/>
+	<value value="94" name="ANY_STALL"/>
+	<value value="95" name="TAG_MISSES"/>
+	<value value="96" name="TAG_HITS"/>
+	<value value="97" name="SUB_TAG_MISSES"/>
+	<value value="98" name="SET0_INVALIDATES"/>
+	<value value="99" name="SET1_INVALIDATES"/>
+	<value value="100" name="SET2_INVALIDATES"/>
+	<value value="101" name="SET3_INVALIDATES"/>
+	<value value="102" name="SET0_TAG_MISSES"/>
+	<value value="103" name="SET1_TAG_MISSES"/>
+	<value value="104" name="SET2_TAG_MISSES"/>
+	<value value="105" name="SET3_TAG_MISSES"/>
+	<value value="106" name="SET0_TAG_HITS"/>
+	<value value="107" name="SET1_TAG_HITS"/>
+	<value value="108" name="SET2_TAG_HITS"/>
+	<value value="109" name="SET3_TAG_HITS"/>
+	<value value="110" name="SET0_SUB_TAG_MISSES"/>
+	<value value="111" name="SET1_SUB_TAG_MISSES"/>
+	<value value="112" name="SET2_SUB_TAG_MISSES"/>
+	<value value="113" name="SET3_SUB_TAG_MISSES"/>
+	<value value="114" name="SET0_EVICT1"/>
+	<value value="115" name="SET0_EVICT2"/>
+	<value value="116" name="SET0_EVICT3"/>
+	<value value="117" name="SET0_EVICT4"/>
+	<value value="118" name="SET0_EVICT5"/>
+	<value value="119" name="SET0_EVICT6"/>
+	<value value="120" name="SET0_EVICT7"/>
+	<value value="121" name="SET0_EVICT8"/>
+	<value value="130" name="SET1_EVICT1"/>
+	<value value="131" name="SET1_EVICT2"/>
+	<value value="132" name="SET1_EVICT3"/>
+	<value value="133" name="SET1_EVICT4"/>
+	<value value="134" name="SET1_EVICT5"/>
+	<value value="135" name="SET1_EVICT6"/>
+	<value value="136" name="SET1_EVICT7"/>
+	<value value="137" name="SET1_EVICT8"/>
+	<value value="146" name="SET2_EVICT1"/>
+	<value value="147" name="SET2_EVICT2"/>
+	<value value="148" name="SET2_EVICT3"/>
+	<value value="149" name="SET2_EVICT4"/>
+	<value value="150" name="SET2_EVICT5"/>
+	<value value="151" name="SET2_EVICT6"/>
+	<value value="152" name="SET2_EVICT7"/>
+	<value value="153" name="SET2_EVICT8"/>
+	<value value="162" name="SET3_EVICT1"/>
+	<value value="163" name="SET3_EVICT2"/>
+	<value value="164" name="SET3_EVICT3"/>
+	<value value="165" name="SET3_EVICT4"/>
+	<value value="166" name="SET3_EVICT5"/>
+	<value value="167" name="SET3_EVICT6"/>
+	<value value="168" name="SET3_EVICT7"/>
+	<value value="169" name="SET3_EVICT8"/>
+	<value value="178" name="FF_EMPTY"/>
+	<value value="179" name="FF_LT_HALF_FULL"/>
+	<value value="180" name="FF_HALF_FULL"/>
+	<value value="181" name="FF_FULL"/>
+	<value value="182" name="FF_XFC"/>
+	<value value="183" name="FF_STALLED"/>
+	<value value="184" name="FG_MASKS"/>
+	<value value="185" name="FG_LEFT_MASKS"/>
+	<value value="186" name="FG_LEFT_MASK_STALLED"/>
+	<value value="187" name="FG_LEFT_NOT_DONE_STALL"/>
+	<value value="188" name="FG_LEFT_FG_STALL"/>
+	<value value="189" name="FG_LEFT_SECTORS"/>
+	<value value="195" name="FG0_REQUESTS"/>
+	<value value="196" name="FG0_STALLED"/>
+	<value value="199" name="MEM_REQ512"/>
+	<value value="200" name="MEM_REQ_SENT"/>
+	<value value="202" name="MEM_LOCAL_READ_REQ"/>
+	<value value="203" name="TC0_MH_STALLED"/>
+</enum>
+
+<enum name="a2xx_sq_perfcnt_select">
+	<value value="0" name="SQ_PIXEL_VECTORS_SUB"/>
+	<value value="1" name="SQ_VERTEX_VECTORS_SUB"/>
+	<value value="2" name="SQ_ALU0_ACTIVE_VTX_SIMD0"/>
+	<value value="3" name="SQ_ALU1_ACTIVE_VTX_SIMD0"/>
+	<value value="4" name="SQ_ALU0_ACTIVE_PIX_SIMD0"/>
+	<value value="5" name="SQ_ALU1_ACTIVE_PIX_SIMD0"/>
+	<value value="6" name="SQ_ALU0_ACTIVE_VTX_SIMD1"/>
+	<value value="7" name="SQ_ALU1_ACTIVE_VTX_SIMD1"/>
+	<value value="8" name="SQ_ALU0_ACTIVE_PIX_SIMD1"/>
+	<value value="9" name="SQ_ALU1_ACTIVE_PIX_SIMD1"/>
+	<value value="10" name="SQ_EXPORT_CYCLES"/>
+	<value value="11" name="SQ_ALU_CST_WRITTEN"/>
+	<value value="12" name="SQ_TEX_CST_WRITTEN"/>
+	<value value="13" name="SQ_ALU_CST_STALL"/>
+	<value value="14" name="SQ_ALU_TEX_STALL"/>
+	<value value="15" name="SQ_INST_WRITTEN"/>
+	<value value="16" name="SQ_BOOLEAN_WRITTEN"/>
+	<value value="17" name="SQ_LOOPS_WRITTEN"/>
+	<value value="18" name="SQ_PIXEL_SWAP_IN"/>
+	<value value="19" name="SQ_PIXEL_SWAP_OUT"/>
+	<value value="20" name="SQ_VERTEX_SWAP_IN"/>
+	<value value="21" name="SQ_VERTEX_SWAP_OUT"/>
+	<value value="22" name="SQ_ALU_VTX_INST_ISSUED"/>
+	<value value="23" name="SQ_TEX_VTX_INST_ISSUED"/>
+	<value value="24" name="SQ_VC_VTX_INST_ISSUED"/>
+	<value value="25" name="SQ_CF_VTX_INST_ISSUED"/>
+	<value value="26" name="SQ_ALU_PIX_INST_ISSUED"/>
+	<value value="27" name="SQ_TEX_PIX_INST_ISSUED"/>
+	<value value="28" name="SQ_VC_PIX_INST_ISSUED"/>
+	<value value="29" name="SQ_CF_PIX_INST_ISSUED"/>
+	<value value="30" name="SQ_ALU0_FIFO_EMPTY_SIMD0"/>
+	<value value="31" name="SQ_ALU1_FIFO_EMPTY_SIMD0"/>
+	<value value="32" name="SQ_ALU0_FIFO_EMPTY_SIMD1"/>
+	<value value="33" name="SQ_ALU1_FIFO_EMPTY_SIMD1"/>
+	<value value="34" name="SQ_ALU_NOPS"/>
+	<value value="35" name="SQ_PRED_SKIP"/>
+	<value value="36" name="SQ_SYNC_ALU_STALL_SIMD0_VTX"/>
+	<value value="37" name="SQ_SYNC_ALU_STALL_SIMD1_VTX"/>
+	<value value="38" name="SQ_SYNC_TEX_STALL_VTX"/>
+	<value value="39" name="SQ_SYNC_VC_STALL_VTX"/>
+	<value value="40" name="SQ_CONSTANTS_USED_SIMD0"/>
+	<value value="41" name="SQ_CONSTANTS_SENT_SP_SIMD0"/>
+	<value value="42" name="SQ_GPR_STALL_VTX"/>
+	<value value="43" name="SQ_GPR_STALL_PIX"/>
+	<value value="44" name="SQ_VTX_RS_STALL"/>
+	<value value="45" name="SQ_PIX_RS_STALL"/>
+	<value value="46" name="SQ_SX_PC_FULL"/>
+	<value value="47" name="SQ_SX_EXP_BUFF_FULL"/>
+	<value value="48" name="SQ_SX_POS_BUFF_FULL"/>
+	<value value="49" name="SQ_INTERP_QUADS"/>
+	<value value="50" name="SQ_INTERP_ACTIVE"/>
+	<value value="51" name="SQ_IN_PIXEL_STALL"/>
+	<value value="52" name="SQ_IN_VTX_STALL"/>
+	<value value="53" name="SQ_VTX_CNT"/>
+	<value value="54" name="SQ_VTX_VECTOR2"/>
+	<value value="55" name="SQ_VTX_VECTOR3"/>
+	<value value="56" name="SQ_VTX_VECTOR4"/>
+	<value value="57" name="SQ_PIXEL_VECTOR1"/>
+	<value value="58" name="SQ_PIXEL_VECTOR23"/>
+	<value value="59" name="SQ_PIXEL_VECTOR4"/>
+	<value value="60" name="SQ_CONSTANTS_USED_SIMD1"/>
+	<value value="61" name="SQ_CONSTANTS_SENT_SP_SIMD1"/>
+	<value value="62" name="SQ_SX_MEM_EXP_FULL"/>
+	<value value="63" name="SQ_ALU0_ACTIVE_VTX_SIMD2"/>
+	<value value="64" name="SQ_ALU1_ACTIVE_VTX_SIMD2"/>
+	<value value="65" name="SQ_ALU0_ACTIVE_PIX_SIMD2"/>
+	<value value="66" name="SQ_ALU1_ACTIVE_PIX_SIMD2"/>
+	<value value="67" name="SQ_ALU0_ACTIVE_VTX_SIMD3"/>
+	<value value="68" name="SQ_PERFCOUNT_VTX_QUAL_TP_DONE"/>
+	<value value="69" name="SQ_ALU0_ACTIVE_PIX_SIMD3"/>
+	<value value="70" name="SQ_PERFCOUNT_PIX_QUAL_TP_DONE"/>
+	<value value="71" name="SQ_ALU0_FIFO_EMPTY_SIMD2"/>
+	<value value="72" name="SQ_ALU1_FIFO_EMPTY_SIMD2"/>
+	<value value="73" name="SQ_ALU0_FIFO_EMPTY_SIMD3"/>
+	<value value="74" name="SQ_ALU1_FIFO_EMPTY_SIMD3"/>
+	<value value="75" name="SQ_SYNC_ALU_STALL_SIMD2_VTX"/>
+	<value value="76" name="SQ_PERFCOUNT_VTX_POP_THREAD"/>
+	<value value="77" name="SQ_SYNC_ALU_STALL_SIMD0_PIX"/>
+	<value value="78" name="SQ_SYNC_ALU_STALL_SIMD1_PIX"/>
+	<value value="79" name="SQ_SYNC_ALU_STALL_SIMD2_PIX"/>
+	<value value="80" name="SQ_PERFCOUNT_PIX_POP_THREAD"/>
+	<value value="81" name="SQ_SYNC_TEX_STALL_PIX"/>
+	<value value="82" name="SQ_SYNC_VC_STALL_PIX"/>
+	<value value="83" name="SQ_CONSTANTS_USED_SIMD2"/>
+	<value value="84" name="SQ_CONSTANTS_SENT_SP_SIMD2"/>
+	<value value="85" name="SQ_PERFCOUNT_VTX_DEALLOC_ACK"/>
+	<value value="86" name="SQ_PERFCOUNT_PIX_DEALLOC_ACK"/>
+	<value value="87" name="SQ_ALU0_FIFO_FULL_SIMD0"/>
+	<value value="88" name="SQ_ALU1_FIFO_FULL_SIMD0"/>
+	<value value="89" name="SQ_ALU0_FIFO_FULL_SIMD1"/>
+	<value value="90" name="SQ_ALU1_FIFO_FULL_SIMD1"/>
+	<value value="91" name="SQ_ALU0_FIFO_FULL_SIMD2"/>
+	<value value="92" name="SQ_ALU1_FIFO_FULL_SIMD2"/>
+	<value value="93" name="SQ_ALU0_FIFO_FULL_SIMD3"/>
+	<value value="94" name="SQ_ALU1_FIFO_FULL_SIMD3"/>
+	<value value="95" name="VC_PERF_STATIC"/>
+	<value value="96" name="VC_PERF_STALLED"/>
+	<value value="97" name="VC_PERF_STARVED"/>
+	<value value="98" name="VC_PERF_SEND"/>
+	<value value="99" name="VC_PERF_ACTUAL_STARVED"/>
+	<value value="100" name="PIXEL_THREAD_0_ACTIVE"/>
+	<value value="101" name="VERTEX_THREAD_0_ACTIVE"/>
+	<value value="102" name="PIXEL_THREAD_0_NUMBER"/>
+	<value value="103" name="VERTEX_THREAD_0_NUMBER"/>
+	<value value="104" name="VERTEX_EVENT_NUMBER"/>
+	<value value="105" name="PIXEL_EVENT_NUMBER"/>
+	<value value="106" name="PTRBUFF_EF_PUSH"/>
+	<value value="107" name="PTRBUFF_EF_POP_EVENT"/>
+	<value value="108" name="PTRBUFF_EF_POP_NEW_VTX"/>
+	<value value="109" name="PTRBUFF_EF_POP_DEALLOC"/>
+	<value value="110" name="PTRBUFF_EF_POP_PVECTOR"/>
+	<value value="111" name="PTRBUFF_EF_POP_PVECTOR_X"/>
+	<value value="112" name="PTRBUFF_EF_POP_PVECTOR_VNZ"/>
+	<value value="113" name="PTRBUFF_PB_DEALLOC"/>
+	<value value="114" name="PTRBUFF_PI_STATE_PPB_POP"/>
+	<value value="115" name="PTRBUFF_PI_RTR"/>
+	<value value="116" name="PTRBUFF_PI_READ_EN"/>
+	<value value="117" name="PTRBUFF_PI_BUFF_SWAP"/>
+	<value value="118" name="PTRBUFF_SQ_FREE_BUFF"/>
+	<value value="119" name="PTRBUFF_SQ_DEC"/>
+	<value value="120" name="PTRBUFF_SC_VALID_CNTL_EVENT"/>
+	<value value="121" name="PTRBUFF_SC_VALID_IJ_XFER"/>
+	<value value="122" name="PTRBUFF_SC_NEW_VECTOR_1_Q"/>
+	<value value="123" name="PTRBUFF_QUAL_NEW_VECTOR"/>
+	<value value="124" name="PTRBUFF_QUAL_EVENT"/>
+	<value value="125" name="PTRBUFF_END_BUFFER"/>
+	<value value="126" name="PTRBUFF_FILL_QUAD"/>
+	<value value="127" name="VERTS_WRITTEN_SPI"/>
+	<value value="128" name="TP_FETCH_INSTR_EXEC"/>
+	<value value="129" name="TP_FETCH_INSTR_REQ"/>
+	<value value="130" name="TP_DATA_RETURN"/>
+	<value value="131" name="SPI_WRITE_CYCLES_SP"/>
+	<value value="132" name="SPI_WRITES_SP"/>
+	<value value="133" name="SP_ALU_INSTR_EXEC"/>
+	<value value="134" name="SP_CONST_ADDR_TO_SQ"/>
+	<value value="135" name="SP_PRED_KILLS_TO_SQ"/>
+	<value value="136" name="SP_EXPORT_CYCLES_TO_SX"/>
+	<value value="137" name="SP_EXPORTS_TO_SX"/>
+	<value value="138" name="SQ_CYCLES_ELAPSED"/>
+	<value value="139" name="SQ_TCFS_OPT_ALLOC_EXEC"/>
+	<value value="140" name="SQ_TCFS_NO_OPT_ALLOC"/>
+	<value value="141" name="SQ_ALU0_NO_OPT_ALLOC"/>
+	<value value="142" name="SQ_ALU1_NO_OPT_ALLOC"/>
+	<value value="143" name="SQ_TCFS_ARB_XFC_CNT"/>
+	<value value="144" name="SQ_ALU0_ARB_XFC_CNT"/>
+	<value value="145" name="SQ_ALU1_ARB_XFC_CNT"/>
+	<value value="146" name="SQ_TCFS_CFS_UPDATE_CNT"/>
+	<value value="147" name="SQ_ALU0_CFS_UPDATE_CNT"/>
+	<value value="148" name="SQ_ALU1_CFS_UPDATE_CNT"/>
+	<value value="149" name="SQ_VTX_PUSH_THREAD_CNT"/>
+	<value value="150" name="SQ_VTX_POP_THREAD_CNT"/>
+	<value value="151" name="SQ_PIX_PUSH_THREAD_CNT"/>
+	<value value="152" name="SQ_PIX_POP_THREAD_CNT"/>
+	<value value="153" name="SQ_PIX_TOTAL"/>
+	<value value="154" name="SQ_PIX_KILLED"/>
+</enum>
+
+<enum name="a2xx_sx_perfcnt_select">
+	<value value="0" name="SX_EXPORT_VECTORS"/>
+	<value value="1" name="SX_DUMMY_QUADS"/>
+	<value value="2" name="SX_ALPHA_FAIL"/>
+	<value value="3" name="SX_RB_QUAD_BUSY"/>
+	<value value="4" name="SX_RB_COLOR_BUSY"/>
+	<value value="5" name="SX_RB_QUAD_STALL"/>
+	<value value="6" name="SX_RB_COLOR_STALL"/>
+</enum>
+
+<enum name="a2xx_rbbm_perfcount1_sel">
+	<value value="0" name="RBBM1_COUNT"/>
+	<value value="1" name="RBBM1_NRT_BUSY"/>
+	<value value="2" name="RBBM1_RB_BUSY"/>
+	<value value="3" name="RBBM1_SQ_CNTX0_BUSY"/>
+	<value value="4" name="RBBM1_SQ_CNTX17_BUSY"/>
+	<value value="5" name="RBBM1_VGT_BUSY"/>
+	<value value="6" name="RBBM1_VGT_NODMA_BUSY"/>
+	<value value="7" name="RBBM1_PA_BUSY"/>
+	<value value="8" name="RBBM1_SC_CNTX_BUSY"/>
+	<value value="9" name="RBBM1_TPC_BUSY"/>
+	<value value="10" name="RBBM1_TC_BUSY"/>
+	<value value="11" name="RBBM1_SX_BUSY"/>
+	<value value="12" name="RBBM1_CP_COHER_BUSY"/>
+	<value value="13" name="RBBM1_CP_NRT_BUSY"/>
+	<value value="14" name="RBBM1_GFX_IDLE_STALL"/>
+	<value value="15" name="RBBM1_INTERRUPT"/>
+</enum>
+
+<enum name="a2xx_cp_perfcount_sel">
+	<value value="0" name="ALWAYS_COUNT"/>
+	<value value="1" name="TRANS_FIFO_FULL"/>
+	<value value="2" name="TRANS_FIFO_AF"/>
+	<value value="3" name="RCIU_PFPTRANS_WAIT"/>
+	<value value="6" name="RCIU_NRTTRANS_WAIT"/>
+	<value value="8" name="CSF_NRT_READ_WAIT"/>
+	<value value="9" name="CSF_I1_FIFO_FULL"/>
+	<value value="10" name="CSF_I2_FIFO_FULL"/>
+	<value value="11" name="CSF_ST_FIFO_FULL"/>
+	<value value="13" name="CSF_RING_ROQ_FULL"/>
+	<value value="14" name="CSF_I1_ROQ_FULL"/>
+	<value value="15" name="CSF_I2_ROQ_FULL"/>
+	<value value="16" name="CSF_ST_ROQ_FULL"/>
+	<value value="18" name="MIU_TAG_MEM_FULL"/>
+	<value value="19" name="MIU_WRITECLEAN"/>
+	<value value="22" name="MIU_NRT_WRITE_STALLED"/>
+	<value value="23" name="MIU_NRT_READ_STALLED"/>
+	<value value="24" name="ME_WRITE_CONFIRM_FIFO_FULL"/>
+	<value value="25" name="ME_VS_DEALLOC_FIFO_FULL"/>
+	<value value="26" name="ME_PS_DEALLOC_FIFO_FULL"/>
+	<value value="27" name="ME_REGS_VS_EVENT_FIFO_FULL"/>
+	<value value="28" name="ME_REGS_PS_EVENT_FIFO_FULL"/>
+	<value value="29" name="ME_REGS_CF_EVENT_FIFO_FULL"/>
+	<value value="30" name="ME_MICRO_RB_STARVED"/>
+	<value value="31" name="ME_MICRO_I1_STARVED"/>
+	<value value="32" name="ME_MICRO_I2_STARVED"/>
+	<value value="33" name="ME_MICRO_ST_STARVED"/>
+	<value value="40" name="RCIU_RBBM_DWORD_SENT"/>
+	<value value="41" name="ME_BUSY_CLOCKS"/>
+	<value value="42" name="ME_WAIT_CONTEXT_AVAIL"/>
+	<value value="43" name="PFP_TYPE0_PACKET"/>
+	<value value="44" name="PFP_TYPE3_PACKET"/>
+	<value value="45" name="CSF_RB_WPTR_NEQ_RPTR"/>
+	<value value="46" name="CSF_I1_SIZE_NEQ_ZERO"/>
+	<value value="47" name="CSF_I2_SIZE_NEQ_ZERO"/>
+	<value value="48" name="CSF_RBI1I2_FETCHING"/>
+</enum>
+
+<enum name="a2xx_rb_perfcnt_select">
+	<value value="0" name="RBPERF_CNTX_BUSY"/>
+	<value value="1" name="RBPERF_CNTX_BUSY_MAX"/>
+	<value value="2" name="RBPERF_SX_QUAD_STARVED"/>
+	<value value="3" name="RBPERF_SX_QUAD_STARVED_MAX"/>
+	<value value="4" name="RBPERF_GA_GC_CH0_SYS_REQ"/>
+	<value value="5" name="RBPERF_GA_GC_CH0_SYS_REQ_MAX"/>
+	<value value="6" name="RBPERF_GA_GC_CH1_SYS_REQ"/>
+	<value value="7" name="RBPERF_GA_GC_CH1_SYS_REQ_MAX"/>
+	<value value="8" name="RBPERF_MH_STARVED"/>
+	<value value="9" name="RBPERF_MH_STARVED_MAX"/>
+	<value value="10" name="RBPERF_AZ_BC_COLOR_BUSY"/>
+	<value value="11" name="RBPERF_AZ_BC_COLOR_BUSY_MAX"/>
+	<value value="12" name="RBPERF_AZ_BC_Z_BUSY"/>
+	<value value="13" name="RBPERF_AZ_BC_Z_BUSY_MAX"/>
+	<value value="14" name="RBPERF_RB_SC_TILE_RTR_N"/>
+	<value value="15" name="RBPERF_RB_SC_TILE_RTR_N_MAX"/>
+	<value value="16" name="RBPERF_RB_SC_SAMP_RTR_N"/>
+	<value value="17" name="RBPERF_RB_SC_SAMP_RTR_N_MAX"/>
+	<value value="18" name="RBPERF_RB_SX_QUAD_RTR_N"/>
+	<value value="19" name="RBPERF_RB_SX_QUAD_RTR_N_MAX"/>
+	<value value="20" name="RBPERF_RB_SX_COLOR_RTR_N"/>
+	<value value="21" name="RBPERF_RB_SX_COLOR_RTR_N_MAX"/>
+	<value value="22" name="RBPERF_RB_SC_SAMP_LZ_BUSY"/>
+	<value value="23" name="RBPERF_RB_SC_SAMP_LZ_BUSY_MAX"/>
+	<value value="24" name="RBPERF_ZXP_STALL"/>
+	<value value="25" name="RBPERF_ZXP_STALL_MAX"/>
+	<value value="26" name="RBPERF_EVENT_PENDING"/>
+	<value value="27" name="RBPERF_EVENT_PENDING_MAX"/>
+	<value value="28" name="RBPERF_RB_MH_VALID"/>
+	<value value="29" name="RBPERF_RB_MH_VALID_MAX"/>
+	<value value="30" name="RBPERF_SX_RB_QUAD_SEND"/>
+	<value value="31" name="RBPERF_SX_RB_COLOR_SEND"/>
+	<value value="32" name="RBPERF_SC_RB_TILE_SEND"/>
+	<value value="33" name="RBPERF_SC_RB_SAMPLE_SEND"/>
+	<value value="34" name="RBPERF_SX_RB_MEM_EXPORT"/>
+	<value value="35" name="RBPERF_SX_RB_QUAD_EVENT"/>
+	<value value="36" name="RBPERF_SC_RB_TILE_EVENT_FILTERED"/>
+	<value value="37" name="RBPERF_SC_RB_TILE_EVENT_ALL"/>
+	<value value="38" name="RBPERF_RB_SC_EZ_SEND"/>
+	<value value="39" name="RBPERF_RB_SX_INDEX_SEND"/>
+	<value value="40" name="RBPERF_GMEM_INTFO_RD"/>
+	<value value="41" name="RBPERF_GMEM_INTF1_RD"/>
+	<value value="42" name="RBPERF_GMEM_INTFO_WR"/>
+	<value value="43" name="RBPERF_GMEM_INTF1_WR"/>
+	<value value="44" name="RBPERF_RB_CP_CONTEXT_DONE"/>
+	<value value="45" name="RBPERF_RB_CP_CACHE_FLUSH"/>
+	<value value="46" name="RBPERF_ZPASS_DONE"/>
+	<value value="47" name="RBPERF_ZCMD_VALID"/>
+	<value value="48" name="RBPERF_CCMD_VALID"/>
+	<value value="49" name="RBPERF_ACCUM_GRANT"/>
+	<value value="50" name="RBPERF_ACCUM_C0_GRANT"/>
+	<value value="51" name="RBPERF_ACCUM_C1_GRANT"/>
+	<value value="52" name="RBPERF_ACCUM_FULL_BE_WR"/>
+	<value value="53" name="RBPERF_ACCUM_REQUEST_NO_GRANT"/>
+	<value value="54" name="RBPERF_ACCUM_TIMEOUT_PULSE"/>
+	<value value="55" name="RBPERF_ACCUM_LIN_TIMEOUT_PULSE"/>
+	<value value="56" name="RBPERF_ACCUM_CAM_HIT_FLUSHING"/>
+</enum>
+
+<enum name="a2xx_mh_perfcnt_select">
+	<value value="0" name="CP_R0_REQUESTS"/>
+	<value value="1" name="CP_R1_REQUESTS"/>
+	<value value="2" name="CP_R2_REQUESTS"/>
+	<value value="3" name="CP_R3_REQUESTS"/>
+	<value value="4" name="CP_R4_REQUESTS"/>
+	<value value="5" name="CP_TOTAL_READ_REQUESTS"/>
+	<value value="6" name="CP_TOTAL_WRITE_REQUESTS"/>
+	<value value="7" name="CP_TOTAL_REQUESTS"/>
+	<value value="8" name="CP_DATA_BYTES_WRITTEN"/>
+	<value value="9" name="CP_WRITE_CLEAN_RESPONSES"/>
+	<value value="10" name="CP_R0_READ_BURSTS_RECEIVED"/>
+	<value value="11" name="CP_R1_READ_BURSTS_RECEIVED"/>
+	<value value="12" name="CP_R2_READ_BURSTS_RECEIVED"/>
+	<value value="13" name="CP_R3_READ_BURSTS_RECEIVED"/>
+	<value value="14" name="CP_R4_READ_BURSTS_RECEIVED"/>
+	<value value="15" name="CP_TOTAL_READ_BURSTS_RECEIVED"/>
+	<value value="16" name="CP_R0_DATA_BEATS_READ"/>
+	<value value="17" name="CP_R1_DATA_BEATS_READ"/>
+	<value value="18" name="CP_R2_DATA_BEATS_READ"/>
+	<value value="19" name="CP_R3_DATA_BEATS_READ"/>
+	<value value="20" name="CP_R4_DATA_BEATS_READ"/>
+	<value value="21" name="CP_TOTAL_DATA_BEATS_READ"/>
+	<value value="22" name="VGT_R0_REQUESTS"/>
+	<value value="23" name="VGT_R1_REQUESTS"/>
+	<value value="24" name="VGT_TOTAL_REQUESTS"/>
+	<value value="25" name="VGT_R0_READ_BURSTS_RECEIVED"/>
+	<value value="26" name="VGT_R1_READ_BURSTS_RECEIVED"/>
+	<value value="27" name="VGT_TOTAL_READ_BURSTS_RECEIVED"/>
+	<value value="28" name="VGT_R0_DATA_BEATS_READ"/>
+	<value value="29" name="VGT_R1_DATA_BEATS_READ"/>
+	<value value="30" name="VGT_TOTAL_DATA_BEATS_READ"/>
+	<value value="31" name="TC_TOTAL_REQUESTS"/>
+	<value value="32" name="TC_ROQ_REQUESTS"/>
+	<value value="33" name="TC_INFO_SENT"/>
+	<value value="34" name="TC_READ_BURSTS_RECEIVED"/>
+	<value value="35" name="TC_DATA_BEATS_READ"/>
+	<value value="36" name="TCD_BURSTS_READ"/>
+	<value value="37" name="RB_REQUESTS"/>
+	<value value="38" name="RB_DATA_BYTES_WRITTEN"/>
+	<value value="39" name="RB_WRITE_CLEAN_RESPONSES"/>
+	<value value="40" name="AXI_READ_REQUESTS_ID_0"/>
+	<value value="41" name="AXI_READ_REQUESTS_ID_1"/>
+	<value value="42" name="AXI_READ_REQUESTS_ID_2"/>
+	<value value="43" name="AXI_READ_REQUESTS_ID_3"/>
+	<value value="44" name="AXI_READ_REQUESTS_ID_4"/>
+	<value value="45" name="AXI_READ_REQUESTS_ID_5"/>
+	<value value="46" name="AXI_READ_REQUESTS_ID_6"/>
+	<value value="47" name="AXI_READ_REQUESTS_ID_7"/>
+	<value value="48" name="AXI_TOTAL_READ_REQUESTS"/>
+	<value value="49" name="AXI_WRITE_REQUESTS_ID_0"/>
+	<value value="50" name="AXI_WRITE_REQUESTS_ID_1"/>
+	<value value="51" name="AXI_WRITE_REQUESTS_ID_2"/>
+	<value value="52" name="AXI_WRITE_REQUESTS_ID_3"/>
+	<value value="53" name="AXI_WRITE_REQUESTS_ID_4"/>
+	<value value="54" name="AXI_WRITE_REQUESTS_ID_5"/>
+	<value value="55" name="AXI_WRITE_REQUESTS_ID_6"/>
+	<value value="56" name="AXI_WRITE_REQUESTS_ID_7"/>
+	<value value="57" name="AXI_TOTAL_WRITE_REQUESTS"/>
+	<value value="58" name="AXI_TOTAL_REQUESTS_ID_0"/>
+	<value value="59" name="AXI_TOTAL_REQUESTS_ID_1"/>
+	<value value="60" name="AXI_TOTAL_REQUESTS_ID_2"/>
+	<value value="61" name="AXI_TOTAL_REQUESTS_ID_3"/>
+	<value value="62" name="AXI_TOTAL_REQUESTS_ID_4"/>
+	<value value="63" name="AXI_TOTAL_REQUESTS_ID_5"/>
+	<value value="64" name="AXI_TOTAL_REQUESTS_ID_6"/>
+	<value value="65" name="AXI_TOTAL_REQUESTS_ID_7"/>
+	<value value="66" name="AXI_TOTAL_REQUESTS"/>
+	<value value="67" name="AXI_READ_CHANNEL_BURSTS_ID_0"/>
+	<value value="68" name="AXI_READ_CHANNEL_BURSTS_ID_1"/>
+	<value value="69" name="AXI_READ_CHANNEL_BURSTS_ID_2"/>
+	<value value="70" name="AXI_READ_CHANNEL_BURSTS_ID_3"/>
+	<value value="71" name="AXI_READ_CHANNEL_BURSTS_ID_4"/>
+	<value value="72" name="AXI_READ_CHANNEL_BURSTS_ID_5"/>
+	<value value="73" name="AXI_READ_CHANNEL_BURSTS_ID_6"/>
+	<value value="74" name="AXI_READ_CHANNEL_BURSTS_ID_7"/>
+	<value value="75" name="AXI_READ_CHANNEL_TOTAL_BURSTS"/>
+	<value value="76" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_0"/>
+	<value value="77" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_1"/>
+	<value value="78" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_2"/>
+	<value value="79" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_3"/>
+	<value value="80" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_4"/>
+	<value value="81" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_5"/>
+	<value value="82" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_6"/>
+	<value value="83" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_7"/>
+	<value value="84" name="AXI_READ_CHANNEL_TOTAL_DATA_BEATS_READ"/>
+	<value value="85" name="AXI_WRITE_CHANNEL_BURSTS_ID_0"/>
+	<value value="86" name="AXI_WRITE_CHANNEL_BURSTS_ID_1"/>
+	<value value="87" name="AXI_WRITE_CHANNEL_BURSTS_ID_2"/>
+	<value value="88" name="AXI_WRITE_CHANNEL_BURSTS_ID_3"/>
+	<value value="89" name="AXI_WRITE_CHANNEL_BURSTS_ID_4"/>
+	<value value="90" name="AXI_WRITE_CHANNEL_BURSTS_ID_5"/>
+	<value value="91" name="AXI_WRITE_CHANNEL_BURSTS_ID_6"/>
+	<value value="92" name="AXI_WRITE_CHANNEL_BURSTS_ID_7"/>
+	<value value="93" name="AXI_WRITE_CHANNEL_TOTAL_BURSTS"/>
+	<value value="94" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_0"/>
+	<value value="95" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_1"/>
+	<value value="96" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_2"/>
+	<value value="97" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_3"/>
+	<value value="98" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_4"/>
+	<value value="99" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_5"/>
+	<value value="100" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_6"/>
+	<value value="101" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_7"/>
+	<value value="102" name="AXI_WRITE_CHANNEL_TOTAL_DATA_BYTES_WRITTEN"/>
+	<value value="103" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_0"/>
+	<value value="104" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_1"/>
+	<value value="105" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_2"/>
+	<value value="106" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_3"/>
+	<value value="107" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_4"/>
+	<value value="108" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_5"/>
+	<value value="109" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_6"/>
+	<value value="110" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_7"/>
+	<value value="111" name="AXI_WRITE_RESPONSE_CHANNEL_TOTAL_RESPONSES"/>
+	<value value="112" name="TOTAL_MMU_MISSES"/>
+	<value value="113" name="MMU_READ_MISSES"/>
+	<value value="114" name="MMU_WRITE_MISSES"/>
+	<value value="115" name="TOTAL_MMU_HITS"/>
+	<value value="116" name="MMU_READ_HITS"/>
+	<value value="117" name="MMU_WRITE_HITS"/>
+	<value value="118" name="SPLIT_MODE_TC_HITS"/>
+	<value value="119" name="SPLIT_MODE_TC_MISSES"/>
+	<value value="120" name="SPLIT_MODE_NON_TC_HITS"/>
+	<value value="121" name="SPLIT_MODE_NON_TC_MISSES"/>
+	<value value="122" name="STALL_AWAITING_TLB_MISS_FETCH"/>
+	<value value="123" name="MMU_TLB_MISS_READ_BURSTS_RECEIVED"/>
+	<value value="124" name="MMU_TLB_MISS_DATA_BEATS_READ"/>
+	<value value="125" name="CP_CYCLES_HELD_OFF"/>
+	<value value="126" name="VGT_CYCLES_HELD_OFF"/>
+	<value value="127" name="TC_CYCLES_HELD_OFF"/>
+	<value value="128" name="TC_ROQ_CYCLES_HELD_OFF"/>
+	<value value="129" name="TC_CYCLES_HELD_OFF_TCD_FULL"/>
+	<value value="130" name="RB_CYCLES_HELD_OFF"/>
+	<value value="131" name="TOTAL_CYCLES_ANY_CLNT_HELD_OFF"/>
+	<value value="132" name="TLB_MISS_CYCLES_HELD_OFF"/>
+	<value value="133" name="AXI_READ_REQUEST_HELD_OFF"/>
+	<value value="134" name="AXI_WRITE_REQUEST_HELD_OFF"/>
+	<value value="135" name="AXI_REQUEST_HELD_OFF"/>
+	<value value="136" name="AXI_REQUEST_HELD_OFF_INFLIGHT_LIMIT"/>
+	<value value="137" name="AXI_WRITE_DATA_HELD_OFF"/>
+	<value value="138" name="CP_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="139" name="VGT_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="140" name="TC_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="141" name="TC_ARB_HOLD_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="142" name="RB_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="143" name="TOTAL_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="144" name="CP_SAME_PAGE_BANK_REQUESTS_KILLED_FAIRNESS_LIMIT"/>
+	<value value="145" name="VGT_SAME_PAGE_BANK_REQUESTS_KILLED_FAIRNESS_LIMIT"/>
+	<value value="146" name="TC_SAME_PAGE_BANK_REQUESTS_KILLED_FAIRNESS_LIMIT"/>
+	<value value="147" name="RB_SAME_PAGE_BANK_REQUESTS_KILLED_FAIRNESS_LIMIT"/>
+	<value value="148" name="TOTAL_SAME_PAGE_BANK_KILLED_FAIRNESS_LIMIT"/>
+	<value value="149" name="TOTAL_MH_READ_REQUESTS"/>
+	<value value="150" name="TOTAL_MH_WRITE_REQUESTS"/>
+	<value value="151" name="TOTAL_MH_REQUESTS"/>
+	<value value="152" name="MH_BUSY"/>
+	<value value="153" name="CP_NTH_ACCESS_SAME_PAGE_BANK_SEQUENCE"/>
+	<value value="154" name="VGT_NTH_ACCESS_SAME_PAGE_BANK_SEQUENCE"/>
+	<value value="155" name="TC_NTH_ACCESS_SAME_PAGE_BANK_SEQUENCE"/>
+	<value value="156" name="RB_NTH_ACCESS_SAME_PAGE_BANK_SEQUENCE"/>
+	<value value="157" name="TC_ROQ_N_VALID_ENTRIES"/>
+	<value value="158" name="ARQ_N_ENTRIES"/>
+	<value value="159" name="WDB_N_ENTRIES"/>
+	<value value="160" name="MH_READ_LATENCY_OUTST_REQ_SUM"/>
+	<value value="161" name="MC_READ_LATENCY_OUTST_REQ_SUM"/>
+	<value value="162" name="MC_TOTAL_READ_REQUESTS"/>
+	<value value="163" name="ELAPSED_CYCLES_MH_GATED_CLK"/>
+	<value value="164" name="ELAPSED_CLK_CYCLES"/>
+	<value value="165" name="CP_W_16B_REQUESTS"/>
+	<value value="166" name="CP_W_32B_REQUESTS"/>
+	<value value="167" name="TC_16B_REQUESTS"/>
+	<value value="168" name="TC_32B_REQUESTS"/>
+	<value value="169" name="PA_REQUESTS"/>
+	<value value="170" name="PA_DATA_BYTES_WRITTEN"/>
+	<value value="171" name="PA_WRITE_CLEAN_RESPONSES"/>
+	<value value="172" name="PA_CYCLES_HELD_OFF"/>
+	<value value="173" name="AXI_READ_REQUEST_DATA_BEATS_ID_0"/>
+	<value value="174" name="AXI_READ_REQUEST_DATA_BEATS_ID_1"/>
+	<value value="175" name="AXI_READ_REQUEST_DATA_BEATS_ID_2"/>
+	<value value="176" name="AXI_READ_REQUEST_DATA_BEATS_ID_3"/>
+	<value value="177" name="AXI_READ_REQUEST_DATA_BEATS_ID_4"/>
+	<value value="178" name="AXI_READ_REQUEST_DATA_BEATS_ID_5"/>
+	<value value="179" name="AXI_READ_REQUEST_DATA_BEATS_ID_6"/>
+	<value value="180" name="AXI_READ_REQUEST_DATA_BEATS_ID_7"/>
+	<value value="181" name="AXI_TOTAL_READ_REQUEST_DATA_BEATS"/>
+</enum>
+
+<enum name="perf_mode_cnt">
+	<value name="PERF_STATE_RESET" value="0"/>
+	<value name="PERF_STATE_ENABLE" value="1"/>
+	<value name="PERF_STATE_FREEZE" value="2"/>
+</enum>
+
+<domain name="A2XX" width="32">
+
+	<bitset name="a2xx_vgt_current_bin_id_min_max" inline="yes">
+		<bitfield name="COLUMN" low="0" high="2" type="uint"/>
+		<bitfield name="ROW" low="3" high="5" type="uint"/>
+		<bitfield name="GUARD_BAND_MASK" low="6" high="8" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x0001" name="RBBM_PATCH_RELEASE"/>
+	<reg32 offset="0x003b" name="RBBM_CNTL"/>
+	<reg32 offset="0x003c" name="RBBM_SOFT_RESET"/>
+	<reg32 offset="0x00c0" name="CP_PFP_UCODE_ADDR"/>
+	<reg32 offset="0x00c1" name="CP_PFP_UCODE_DATA"/>
+
+	<enum name="adreno_mmu_clnt_beh">
+		<value name="BEH_NEVR" value="0"/>
+		<value name="BEH_TRAN_RNG" value="1"/>
+		<value name="BEH_TRAN_FLT" value="2"/>
+	</enum>
+
+	<!--
+		Note: these seem applicable only for a2xx devices with gpummu?  At
+		any rate, MH_MMU_CONFIG shows up in places in a3xx firmware where
+		it doesn't make sense, so I think offset 0x40 must be a different
+		register on a3xx.. so moving this back into A2XX domain:
+	 -->
+	<reg32 offset="0x0040" name="MH_MMU_CONFIG">
+		<bitfield name="MMU_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="SPLIT_MODE_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="RB_W_CLNT_BEHAVIOR" low="4" high="5" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_W_CLNT_BEHAVIOR" low="6" high="7" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R0_CLNT_BEHAVIOR" low="8" high="9" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R1_CLNT_BEHAVIOR" low="10" high="11" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R2_CLNT_BEHAVIOR" low="12" high="13" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R3_CLNT_BEHAVIOR" low="14" high="15" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R4_CLNT_BEHAVIOR" low="16" high="17" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="VGT_R0_CLNT_BEHAVIOR" low="18" high="19" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="VGT_R1_CLNT_BEHAVIOR" low="20" high="21" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="TC_R_CLNT_BEHAVIOR" low="22" high="23" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="PA_W_CLNT_BEHAVIOR" low="24" high="25" type="adreno_mmu_clnt_beh"/>
+	</reg32>
+	<reg32 offset="0x0041" name="MH_MMU_VA_RANGE">
+		<bitfield name="NUM_64KB_REGIONS" low="0" high="11" type="uint"/>
+		<bitfield name="VA_BASE" low="12" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0042" name="MH_MMU_PT_BASE"/>
+	<reg32 offset="0x0043" name="MH_MMU_PAGE_FAULT"/>
+	<reg32 offset="0x0044" name="MH_MMU_TRAN_ERROR"/>
+	<reg32 offset="0x0045" name="MH_MMU_INVALIDATE">
+		<bitfield name="INVALIDATE_ALL" pos="0" type="boolean"/>
+		<bitfield name="INVALIDATE_TC" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0046" name="MH_MMU_MPU_BASE"/>
+	<reg32 offset="0x0047" name="MH_MMU_MPU_END"/>
+
+	<reg32 offset="0x0394" name="NQWAIT_UNTIL"/>
+	<reg32 offset="0x0395" name="RBBM_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0396" name="RBBM_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0397" name="RBBM_PERFCOUNTER0_LO"/>
+	<reg32 offset="0x0398" name="RBBM_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0399" name="RBBM_PERFCOUNTER1_LO"/>
+	<reg32 offset="0x039a" name="RBBM_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x039b" name="RBBM_DEBUG"/>
+	<reg32 offset="0x039c" name="RBBM_PM_OVERRIDE1">
+		<bitfield name="RBBM_AHBCLK_PM_OVERRIDE" pos="0" type="boolean"/>
+		<bitfield name="SC_REG_SCLK_PM_OVERRIDE" pos="1" type="boolean"/>
+		<bitfield name="SC_SCLK_PM_OVERRIDE" pos="2" type="boolean"/>
+		<bitfield name="SP_TOP_SCLK_PM_OVERRIDE" pos="3" type="boolean"/>
+		<bitfield name="SP_V0_SCLK_PM_OVERRIDE" pos="4" type="boolean"/>
+		<bitfield name="SQ_REG_SCLK_PM_OVERRIDE" pos="5" type="boolean"/>
+		<bitfield name="SQ_REG_FIFOS_SCLK_PM_OVERRIDE" pos="6" type="boolean"/>
+		<bitfield name="SQ_CONST_MEM_SCLK_PM_OVERRIDE" pos="7" type="boolean"/>
+		<bitfield name="SQ_SQ_SCLK_PM_OVERRIDE" pos="8" type="boolean"/>
+		<bitfield name="SX_SCLK_PM_OVERRIDE" pos="9" type="boolean"/>
+		<bitfield name="SX_REG_SCLK_PM_OVERRIDE" pos="10" type="boolean"/>
+		<bitfield name="TCM_TCO_SCLK_PM_OVERRIDE" pos="11" type="boolean"/>
+		<bitfield name="TCM_TCM_SCLK_PM_OVERRIDE" pos="12" type="boolean"/>
+		<bitfield name="TCM_TCD_SCLK_PM_OVERRIDE" pos="13" type="boolean"/>
+		<bitfield name="TCM_REG_SCLK_PM_OVERRIDE" pos="14" type="boolean"/>
+		<bitfield name="TPC_TPC_SCLK_PM_OVERRIDE" pos="15" type="boolean"/>
+		<bitfield name="TPC_REG_SCLK_PM_OVERRIDE" pos="16" type="boolean"/>
+		<bitfield name="TCF_TCA_SCLK_PM_OVERRIDE" pos="17" type="boolean"/>
+		<bitfield name="TCF_TCB_SCLK_PM_OVERRIDE" pos="18" type="boolean"/>
+		<bitfield name="TCF_TCB_READ_SCLK_PM_OVERRIDE" pos="19" type="boolean"/>
+		<bitfield name="TP_TP_SCLK_PM_OVERRIDE" pos="20" type="boolean"/>
+		<bitfield name="TP_REG_SCLK_PM_OVERRIDE" pos="21" type="boolean"/>
+		<bitfield name="CP_G_SCLK_PM_OVERRIDE" pos="22" type="boolean"/>
+		<bitfield name="CP_REG_SCLK_PM_OVERRIDE" pos="23" type="boolean"/>
+		<bitfield name="CP_G_REG_SCLK_PM_OVERRIDE" pos="24" type="boolean"/>
+		<bitfield name="SPI_SCLK_PM_OVERRIDE" pos="25" type="boolean"/>
+		<bitfield name="RB_REG_SCLK_PM_OVERRIDE" pos="26" type="boolean"/>
+		<bitfield name="RB_SCLK_PM_OVERRIDE" pos="27" type="boolean"/>
+		<bitfield name="MH_MH_SCLK_PM_OVERRIDE" pos="28" type="boolean"/>
+		<bitfield name="MH_REG_SCLK_PM_OVERRIDE" pos="29" type="boolean"/>
+		<bitfield name="MH_MMU_SCLK_PM_OVERRIDE" pos="30" type="boolean"/>
+		<bitfield name="MH_TCROQ_SCLK_PM_OVERRIDE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x039d" name="RBBM_PM_OVERRIDE2">
+		<bitfield name="PA_REG_SCLK_PM_OVERRIDE" pos="0" type="boolean"/>
+		<bitfield name="PA_PA_SCLK_PM_OVERRIDE" pos="1" type="boolean"/>
+		<bitfield name="PA_AG_SCLK_PM_OVERRIDE" pos="2" type="boolean"/>
+		<bitfield name="VGT_REG_SCLK_PM_OVERRIDE" pos="3" type="boolean"/>
+		<bitfield name="VGT_FIFOS_SCLK_PM_OVERRIDE" pos="4" type="boolean"/>
+		<bitfield name="VGT_VGT_SCLK_PM_OVERRIDE" pos="5" type="boolean"/>
+		<bitfield name="DEBUG_PERF_SCLK_PM_OVERRIDE" pos="6" type="boolean"/>
+		<bitfield name="PERM_SCLK_PM_OVERRIDE" pos="7" type="boolean"/>
+		<bitfield name="GC_GA_GMEM0_PM_OVERRIDE" pos="8" type="boolean"/>
+		<bitfield name="GC_GA_GMEM1_PM_OVERRIDE" pos="9" type="boolean"/>
+		<bitfield name="GC_GA_GMEM2_PM_OVERRIDE" pos="10" type="boolean"/>
+		<bitfield name="GC_GA_GMEM3_PM_OVERRIDE" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x03a0" name="RBBM_DEBUG_OUT"/>
+	<reg32 offset="0x03a1" name="RBBM_DEBUG_CNTL"/>
+	<reg32 offset="0x03b3" name="RBBM_READ_ERROR"/>
+	<reg32 offset="0x03b4" name="RBBM_INT_CNTL">
+		<bitfield name="RDERR_INT_MASK" pos="0" type="boolean"/>
+		<bitfield name="DISPLAY_UPDATE_INT_MASK" pos="1" type="boolean"/>
+		<bitfield name="GUI_IDLE_INT_MASK" pos="19" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x03b5" name="RBBM_INT_STATUS"/>
+	<reg32 offset="0x03b6" name="RBBM_INT_ACK"/>
+	<reg32 offset="0x03b7" name="MASTER_INT_SIGNAL">
+		<bitfield name="MH_INT_STAT" pos="5" type="boolean"/>
+		<bitfield name="SQ_INT_STAT" pos="26" type="boolean"/>
+		<bitfield name="CP_INT_STAT" pos="30" type="boolean"/>
+		<bitfield name="RBBM_INT_STAT" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x03f9" name="RBBM_PERIPHID1"/>
+	<reg32 offset="0x03fa" name="RBBM_PERIPHID2"/>
+	<reg32 offset="0x0444" name="CP_PERFMON_CNTL">
+		<!-- The width is uncertain -->
+		<bitfield name="PERF_MODE_CNT" low="0" high="2" type="perf_mode_cnt"/>
+	</reg32>
+	<reg32 offset="0x0445" name="CP_PERFCOUNTER_SELECT"/>
+	<reg32 offset="0x0446" name="CP_PERFCOUNTER_LO"/>
+	<reg32 offset="0x0447" name="CP_PERFCOUNTER_HI"/>
+	<reg32 offset="0x05d0" name="RBBM_STATUS">
+		<bitfield name="CMDFIFO_AVAIL" low="0" high="4" type="uint"/>
+		<bitfield name="TC_BUSY" pos="5" type="boolean"/>
+		<bitfield name="HIRQ_PENDING" pos="8" type="boolean"/>
+		<bitfield name="CPRQ_PENDING" pos="9" type="boolean"/>
+		<bitfield name="CFRQ_PENDING" pos="10" type="boolean"/>
+		<bitfield name="PFRQ_PENDING" pos="11" type="boolean"/>
+		<bitfield name="VGT_BUSY_NO_DMA" pos="12" type="boolean"/>
+		<bitfield name="RBBM_WU_BUSY" pos="14" type="boolean"/>
+		<bitfield name="CP_NRT_BUSY" pos="16" type="boolean"/>
+		<bitfield name="MH_BUSY" pos="18" type="boolean"/>
+		<bitfield name="MH_COHERENCY_BUSY" pos="19" type="boolean"/>
+		<bitfield name="SX_BUSY" pos="21" type="boolean"/>
+		<bitfield name="TPC_BUSY" pos="22" type="boolean"/>
+		<bitfield name="SC_CNTX_BUSY" pos="24" type="boolean"/>
+		<bitfield name="PA_BUSY" pos="25" type="boolean"/>
+		<bitfield name="VGT_BUSY" pos="26" type="boolean"/>
+		<bitfield name="SQ_CNTX17_BUSY" pos="27" type="boolean"/>
+		<bitfield name="SQ_CNTX0_BUSY" pos="28" type="boolean"/>
+		<bitfield name="RB_CNTX_BUSY" pos="30" type="boolean"/>
+		<bitfield name="GUI_ACTIVE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0a40" name="MH_ARBITER_CONFIG">
+		<bitfield name="SAME_PAGE_LIMIT" low="0" high="5" type="uint"/>
+		<bitfield name="SAME_PAGE_GRANULARITY" pos="6" type="boolean"/>
+		<bitfield name="L1_ARB_ENABLE" pos="7" type="boolean"/>
+		<bitfield name="L1_ARB_HOLD_ENABLE" pos="8" type="boolean"/>
+		<bitfield name="L2_ARB_CONTROL" pos="9" type="boolean"/>
+		<bitfield name="PAGE_SIZE" low="10" high="12" type="uint"/>
+		<bitfield name="TC_REORDER_ENABLE" pos="13" type="boolean"/>
+		<bitfield name="TC_ARB_HOLD_ENABLE" pos="14" type="boolean"/>
+		<bitfield name="IN_FLIGHT_LIMIT_ENABLE" pos="15" type="boolean"/>
+		<bitfield name="IN_FLIGHT_LIMIT" low="16" high="21" type="uint"/>
+		<bitfield name="CP_CLNT_ENABLE" pos="22" type="boolean"/>
+		<bitfield name="VGT_CLNT_ENABLE" pos="23" type="boolean"/>
+		<bitfield name="TC_CLNT_ENABLE" pos="24" type="boolean"/>
+		<bitfield name="RB_CLNT_ENABLE" pos="25" type="boolean"/>
+		<bitfield name="PA_CLNT_ENABLE" pos="26" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0a42" name="MH_INTERRUPT_MASK">
+		<bitfield name="AXI_READ_ERROR" pos="0" type="boolean"/>
+		<bitfield name="AXI_WRITE_ERROR" pos="1" type="boolean"/>
+		<bitfield name="MMU_PAGE_FAULT" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0a43" name="MH_INTERRUPT_STATUS"/>
+	<reg32 offset="0x0a44" name="MH_INTERRUPT_CLEAR"/>
+	<reg32 offset="0x0a54" name="MH_CLNT_INTF_CTRL_CONFIG1"/>
+	<reg32 offset="0x0a55" name="MH_CLNT_INTF_CTRL_CONFIG2"/>
+	<reg32 offset="0x0c01" name="A220_VSC_BIN_SIZE">
+		<bitfield name="WIDTH" low="0" high="4" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="5" high="9" shr="5" type="uint"/>
+	</reg32>
+	<array offset="0x0c06" name="VSC_PIPE" stride="3" length="8">
+		<reg32 offset="0x0" name="CONFIG"/>
+		<reg32 offset="0x1" name="DATA_ADDRESS"/>
+		<reg32 offset="0x2" name="DATA_LENGTH"/>
+	</array>
+	<reg32 offset="0x0c38" name="PC_DEBUG_CNTL"/>
+	<reg32 offset="0x0c39" name="PC_DEBUG_DATA"/>
+	<reg32 offset="0x0c44" name="PA_SC_VIZ_QUERY_STATUS"/>
+	<reg32 offset="0x0c80" name="GRAS_DEBUG_CNTL"/>
+	<reg32 offset="0x0c80" name="PA_SU_DEBUG_CNTL"/>
+	<reg32 offset="0x0c81" name="GRAS_DEBUG_DATA"/>
+	<reg32 offset="0x0c81" name="PA_SU_DEBUG_DATA"/>
+	<reg32 offset="0x0c86" name="PA_SU_FACE_DATA">
+		<bitfield name="BASE_ADDR" low="5" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0d00" name="SQ_GPR_MANAGEMENT">
+		<bitfield name="REG_DYNAMIC" pos="0" type="boolean"/>
+		<bitfield name="REG_SIZE_PIX" low="4" high="11" type="uint"/>
+		<bitfield name="REG_SIZE_VTX" low="12" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0d01" name="SQ_FLOW_CONTROL"/>
+	<reg32 offset="0x0d02" name="SQ_INST_STORE_MANAGMENT">
+		<bitfield name="INST_BASE_PIX" low="0" high="11" type="uint"/>
+		<bitfield name="INST_BASE_VTX" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0d05" name="SQ_DEBUG_MISC"/>
+	<reg32 offset="0x0d34" name="SQ_INT_CNTL"/>
+	<reg32 offset="0x0d35" name="SQ_INT_STATUS"/>
+	<reg32 offset="0x0d36" name="SQ_INT_ACK"/>
+	<reg32 offset="0x0dae" name="SQ_DEBUG_INPUT_FSM"/>
+	<reg32 offset="0x0daf" name="SQ_DEBUG_CONST_MGR_FSM"/>
+	<reg32 offset="0x0db0" name="SQ_DEBUG_TP_FSM"/>
+	<reg32 offset="0x0db1" name="SQ_DEBUG_FSM_ALU_0"/>
+	<reg32 offset="0x0db2" name="SQ_DEBUG_FSM_ALU_1"/>
+	<reg32 offset="0x0db3" name="SQ_DEBUG_EXP_ALLOC"/>
+	<reg32 offset="0x0db4" name="SQ_DEBUG_PTR_BUFF"/>
+	<reg32 offset="0x0db5" name="SQ_DEBUG_GPR_VTX"/>
+	<reg32 offset="0x0db6" name="SQ_DEBUG_GPR_PIX"/>
+	<reg32 offset="0x0db7" name="SQ_DEBUG_TB_STATUS_SEL"/>
+	<reg32 offset="0x0db8" name="SQ_DEBUG_VTX_TB_0"/>
+	<reg32 offset="0x0db9" name="SQ_DEBUG_VTX_TB_1"/>
+	<reg32 offset="0x0dba" name="SQ_DEBUG_VTX_TB_STATUS_REG"/>
+	<reg32 offset="0x0dbb" name="SQ_DEBUG_VTX_TB_STATE_MEM"/>
+	<reg32 offset="0x0dbc" name="SQ_DEBUG_PIX_TB_0"/>
+	<reg32 offset="0x0dbd" name="SQ_DEBUG_PIX_TB_STATUS_REG_0"/>
+	<reg32 offset="0x0dbe" name="SQ_DEBUG_PIX_TB_STATUS_REG_1"/>
+	<reg32 offset="0x0dbf" name="SQ_DEBUG_PIX_TB_STATUS_REG_2"/>
+	<reg32 offset="0x0dc0" name="SQ_DEBUG_PIX_TB_STATUS_REG_3"/>
+	<reg32 offset="0x0dc1" name="SQ_DEBUG_PIX_TB_STATE_MEM"/>
+	<reg32 offset="0x0e00" name="TC_CNTL_STATUS">
+		<bitfield name="L2_INVALIDATE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0e1e" name="TP0_CHICKEN"/>
+	<reg32 offset="0x0f01" name="RB_BC_CONTROL">
+		<bitfield name="ACCUM_LINEAR_MODE_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="ACCUM_TIMEOUT_SELECT" low="1" high="2" type="uint"/>
+		<bitfield name="DISABLE_EDRAM_CAM" pos="3" type="boolean"/>
+		<bitfield name="DISABLE_EZ_FAST_CONTEXT_SWITCH" pos="4" type="boolean"/>
+		<bitfield name="DISABLE_EZ_NULL_ZCMD_DROP" pos="5" type="boolean"/>
+		<bitfield name="DISABLE_LZ_NULL_ZCMD_DROP" pos="6" type="boolean"/>
+		<bitfield name="ENABLE_AZ_THROTTLE" pos="7" type="boolean"/>
+		<bitfield name="AZ_THROTTLE_COUNT" low="8" high="12" type="uint"/>
+		<bitfield name="ENABLE_CRC_UPDATE" pos="14" type="boolean"/>
+		<bitfield name="CRC_MODE" pos="15" type="boolean"/>
+		<bitfield name="DISABLE_SAMPLE_COUNTERS" pos="16" type="boolean"/>
+		<bitfield name="DISABLE_ACCUM" pos="17" type="boolean"/>
+		<bitfield name="ACCUM_ALLOC_MASK" low="18" high="21" type="uint"/>
+		<bitfield name="LINEAR_PERFORMANCE_ENABLE" pos="22" type="boolean"/>
+		<bitfield name="ACCUM_DATA_FIFO_LIMIT" low="23" high="26" type="uint"/>
+		<bitfield name="MEM_EXPORT_TIMEOUT_SELECT" low="27" high="28" type="uint"/>
+		<bitfield name="MEM_EXPORT_LINEAR_MODE_ENABLE" pos="29" type="boolean"/>
+		<bitfield name="CRC_SYSTEM" pos="30" type="boolean"/>
+		<bitfield name="RESERVED6" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0f02" name="RB_EDRAM_INFO"/>
+	<reg32 offset="0x0f26" name="RB_DEBUG_CNTL"/>
+	<reg32 offset="0x0f27" name="RB_DEBUG_DATA"/>
+	<reg32 offset="0x2000" name="RB_SURFACE_INFO">
+		<bitfield name="SURFACE_PITCH" low="0" high="13" type="uint"/>
+		<bitfield name="MSAA_SAMPLES" low="14" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2001" name="RB_COLOR_INFO">
+		<bitfield name="FORMAT" low="0" high="3" type="a2xx_colorformatx"/>
+		<bitfield name="ROUND_MODE" low="4" high="5" type="uint"/>
+		<bitfield name="LINEAR" pos="6" type="boolean"/>
+		<bitfield name="ENDIAN" low="7" high="8" type="uint"/>
+		<bitfield name="SWAP" low="9" high="10" type="uint"/>
+		<bitfield name="BASE" low="12" high="31" shr="12"/>
+	</reg32>
+	<reg32 offset="0x2002" name="RB_DEPTH_INFO">
+		<bitfield name="DEPTH_FORMAT" pos="0" type="adreno_rb_depth_format"/>
+		<bitfield name="DEPTH_BASE" low="12" high="31" type="uint" shr="12"/>
+	</reg32>
+	<reg32 offset="0x2005" name="A225_RB_COLOR_INFO3"/>
+	<reg32 offset="0x2006" name="COHER_DEST_BASE_0"/>
+	<reg32 offset="0x200e" name="PA_SC_SCREEN_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x200f" name="PA_SC_SCREEN_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x2080" name="PA_SC_WINDOW_OFFSET">
+		<bitfield name="X" low="0" high="14" type="int"/>
+		<bitfield name="Y" low="16" high="30" type="int"/>
+		<bitfield name="DISABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2081" name="PA_SC_WINDOW_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x2082" name="PA_SC_WINDOW_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x2010" name="UNKNOWN_2010"/>
+	<reg32 offset="0x2100" name="VGT_MAX_VTX_INDX"/>
+	<reg32 offset="0x2101" name="VGT_MIN_VTX_INDX"/>
+	<reg32 offset="0x2102" name="VGT_INDX_OFFSET"/>
+	<reg32 offset="0x2103" name="A225_PC_MULTI_PRIM_IB_RESET_INDX"/>
+	<reg32 offset="0x2104" name="RB_COLOR_MASK">
+		<bitfield name="WRITE_RED" pos="0" type="boolean"/>
+		<bitfield name="WRITE_GREEN" pos="1" type="boolean"/>
+		<bitfield name="WRITE_BLUE" pos="2" type="boolean"/>
+		<bitfield name="WRITE_ALPHA" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2105" name="RB_BLEND_RED"/>
+	<reg32 offset="0x2106" name="RB_BLEND_GREEN"/>
+	<reg32 offset="0x2107" name="RB_BLEND_BLUE"/>
+	<reg32 offset="0x2108" name="RB_BLEND_ALPHA"/>
+	<reg32 offset="0x2109" name="RB_FOG_COLOR">
+		<bitfield name="FOG_RED" low="0" high="7" type="uint"/>
+		<bitfield name="FOG_GREEN" low="8" high="15" type="uint"/>
+		<bitfield name="FOG_BLUE" low="16" high="23" type="uint"/>
+	</reg32>
+	<reg32 offset="0x210c" name="RB_STENCILREFMASK_BF" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x210d" name="RB_STENCILREFMASK" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x210e" name="RB_ALPHA_REF"/>
+	<reg32 offset="0x210f" name="PA_CL_VPORT_XSCALE" type="float"/>
+	<reg32 offset="0x2110" name="PA_CL_VPORT_XOFFSET" type="float"/>
+	<reg32 offset="0x2111" name="PA_CL_VPORT_YSCALE" type="float"/>
+	<reg32 offset="0x2112" name="PA_CL_VPORT_YOFFSET" type="float"/>
+	<reg32 offset="0x2113" name="PA_CL_VPORT_ZSCALE" type="float"/>
+	<reg32 offset="0x2114" name="PA_CL_VPORT_ZOFFSET" type="float"/>
+	<reg32 offset="0x2180" name="SQ_PROGRAM_CNTL">
+		<doc>
+			note: only 0x3f worth of valid register values for VS_REGS and
+			PS_REGS, but high bit is set to indicate '0 registers used':
+		</doc>
+		<bitfield name="VS_REGS" low="0" high="7" type="uint"/>
+		<bitfield name="PS_REGS" low="8" high="15" type="uint"/>
+		<bitfield name="VS_RESOURCE" pos="16" type="boolean"/>
+		<bitfield name="PS_RESOURCE" pos="17" type="boolean"/>
+		<bitfield name="PARAM_GEN" pos="18" type="boolean"/>
+		<bitfield name="GEN_INDEX_PIX" pos="19" type="boolean"/>
+		<bitfield name="VS_EXPORT_COUNT" low="20" high="23" type="uint"/>
+		<bitfield name="VS_EXPORT_MODE" low="24" high="26" type="a2xx_sq_ps_vtx_mode"/>
+		<bitfield name="PS_EXPORT_MODE" low="27" high="30" type="uint"/>
+		<bitfield name="GEN_INDEX_VTX" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2181" name="SQ_CONTEXT_MISC">
+		<bitfield name="INST_PRED_OPTIMIZE" pos="0" type="boolean"/>
+		<bitfield name="SC_OUTPUT_SCREEN_XY" pos="1" type="boolean"/>
+		<bitfield name="SC_SAMPLE_CNTL" low="2" high="3" type="a2xx_sq_sample_cntl"/>
+		<bitfield name="PARAM_GEN_POS" low="8" high="15" type="uint"/>
+		<bitfield name="PERFCOUNTER_REF" pos="16" type="boolean"/>
+		<bitfield name="YEILD_OPTIMIZE" pos="17" type="boolean"/>
+		<bitfield name="TX_CACHE_SEL" pos="18" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2182" name="SQ_INTERPOLATOR_CNTL">
+		<bitfield name="PARAM_SHADE" low="0" high="15" type="uint"/>
+		<bitfield name="SAMPLING_PATTERN" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2183" name="SQ_WRAPPING_0">
+		<bitfield name="PARAM_WRAP_0" low="0" high="3" type="uint"/>
+		<bitfield name="PARAM_WRAP_1" low="4" high="7" type="uint"/>
+		<bitfield name="PARAM_WRAP_2" low="8" high="11" type="uint"/>
+		<bitfield name="PARAM_WRAP_3" low="12" high="15" type="uint"/>
+		<bitfield name="PARAM_WRAP_4" low="16" high="19" type="uint"/>
+		<bitfield name="PARAM_WRAP_5" low="20" high="23" type="uint"/>
+		<bitfield name="PARAM_WRAP_6" low="24" high="27" type="uint"/>
+		<bitfield name="PARAM_WRAP_7" low="28" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2184" name="SQ_WRAPPING_1">
+		<bitfield name="PARAM_WRAP_8" low="0" high="3" type="uint"/>
+		<bitfield name="PARAM_WRAP_9" low="4" high="7" type="uint"/>
+		<bitfield name="PARAM_WRAP_10" low="8" high="11" type="uint"/>
+		<bitfield name="PARAM_WRAP_11" low="12" high="15" type="uint"/>
+		<bitfield name="PARAM_WRAP_12" low="16" high="19" type="uint"/>
+		<bitfield name="PARAM_WRAP_13" low="20" high="23" type="uint"/>
+		<bitfield name="PARAM_WRAP_14" low="24" high="27" type="uint"/>
+		<bitfield name="PARAM_WRAP_15" low="28" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21f6" name="SQ_PS_PROGRAM">
+		<bitfield name="BASE" low="0" high="11" type="uint"/>
+		<bitfield name="SIZE" low="12" high="23" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21f7" name="SQ_VS_PROGRAM">
+		<bitfield name="BASE" low="0" high="11" type="uint"/>
+		<bitfield name="SIZE" low="12" high="23" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21f9" name="VGT_EVENT_INITIATOR"/>
+	<reg32 offset="0x21fc" name="VGT_DRAW_INITIATOR" type="vgt_draw_initiator"/>
+	<reg32 offset="0x21fd" name="VGT_IMMED_DATA"/>
+	<reg32 offset="0x2200" name="RB_DEPTHCONTROL">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="Z_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="EARLY_Z_ENABLE" pos="3" type="boolean"/>
+		<bitfield name="ZFUNC" low="4" high="6" type="adreno_compare_func"/>
+		<bitfield name="BACKFACE_ENABLE" pos="7" type="boolean"/>
+		<bitfield name="STENCILFUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="STENCILFAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="STENCILZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="STENCILZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="STENCILFUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="STENCILFAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="STENCILZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="STENCILZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0x2201" name="RB_BLEND_CONTROL">
+		<bitfield name="COLOR_SRCBLEND" low="0" high="4" type="adreno_rb_blend_factor"/>
+		<bitfield name="COLOR_COMB_FCN" low="5" high="7" type="a2xx_rb_blend_opcode"/>
+		<bitfield name="COLOR_DESTBLEND" low="8" high="12" type="adreno_rb_blend_factor"/>
+		<bitfield name="ALPHA_SRCBLEND" low="16" high="20" type="adreno_rb_blend_factor"/>
+		<bitfield name="ALPHA_COMB_FCN" low="21" high="23" type="a2xx_rb_blend_opcode"/>
+		<bitfield name="ALPHA_DESTBLEND" low="24" high="28" type="adreno_rb_blend_factor"/>
+		<bitfield name="BLEND_FORCE_ENABLE" pos="29" type="boolean"/>
+		<bitfield name="BLEND_FORCE" pos="30" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2202" name="RB_COLORCONTROL">
+		<bitfield name="ALPHA_FUNC" low="0" high="2" type="adreno_compare_func"/>
+		<bitfield name="ALPHA_TEST_ENABLE" pos="3" type="boolean"/>
+		<bitfield name="ALPHA_TO_MASK_ENABLE" pos="4" type="boolean"/>
+		<bitfield name="BLEND_DISABLE" pos="5" type="boolean"/>
+		<bitfield name="VOB_ENABLE" pos="6" type="boolean"/>
+		<bitfield name="VS_EXPORTS_FOG" pos="7" type="boolean"/>
+		<bitfield name="ROP_CODE" low="8" high="11" type="uint"/>
+		<bitfield name="DITHER_MODE" low="12" high="13" type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_TYPE" low="14" high="15" type="a2xx_rb_dither_type"/>
+		<bitfield name="PIXEL_FOG" pos="16" type="boolean"/>
+		<bitfield name="ALPHA_TO_MASK_OFFSET0" low="24" high="25" type="uint"/>
+		<bitfield name="ALPHA_TO_MASK_OFFSET1" low="26" high="27" type="uint"/>
+		<bitfield name="ALPHA_TO_MASK_OFFSET2" low="28" high="29" type="uint"/>
+		<bitfield name="ALPHA_TO_MASK_OFFSET3" low="30" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2203" name="VGT_CURRENT_BIN_ID_MAX" type="a2xx_vgt_current_bin_id_min_max"/>
+	<reg32 offset="0x2204" name="PA_CL_CLIP_CNTL">
+		<bitfield name="CLIP_DISABLE" pos="16" type="boolean"/>
+		<bitfield name="BOUNDARY_EDGE_FLAG_ENA" pos="18" type="boolean"/>
+		<bitfield name="DX_CLIP_SPACE_DEF" pos="19" type="a2xx_dx_clip_space"/>
+		<bitfield name="DIS_CLIP_ERR_DETECT" pos="20" type="boolean"/>
+		<bitfield name="VTX_KILL_OR" pos="21" type="boolean"/>
+		<bitfield name="XY_NAN_RETAIN" pos="22" type="boolean"/>
+		<bitfield name="Z_NAN_RETAIN" pos="23" type="boolean"/>
+		<bitfield name="W_NAN_RETAIN" pos="24" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2205" name="PA_SU_SC_MODE_CNTL">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FACE" pos="2" type="boolean"/>
+		<bitfield name="POLYMODE" low="3" high="4" type="a2xx_pa_su_sc_polymode"/>
+		<bitfield name="FRONT_PTYPE" low="5" high="7" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="BACK_PTYPE" low="8" high="10" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLY_OFFSET_FRONT_ENABLE" pos="11" type="boolean"/>
+		<bitfield name="POLY_OFFSET_BACK_ENABLE" pos="12" type="boolean"/>
+		<bitfield name="POLY_OFFSET_PARA_ENABLE" pos="13" type="boolean"/>
+		<bitfield name="MSAA_ENABLE" pos="15" type="boolean"/>
+		<bitfield name="VTX_WINDOW_OFFSET_ENABLE" pos="16" type="boolean"/>
+		<bitfield name="LINE_STIPPLE_ENABLE" pos="18" type="boolean"/>
+		<bitfield name="PROVOKING_VTX_LAST" pos="19" type="boolean"/>
+		<bitfield name="PERSP_CORR_DIS" pos="20" type="boolean"/>
+		<bitfield name="MULTI_PRIM_IB_ENA" pos="21" type="boolean"/>
+		<bitfield name="QUAD_ORDER_ENABLE" pos="23" type="boolean"/>
+		<bitfield name="WAIT_RB_IDLE_ALL_TRI" pos="25" type="boolean"/>
+		<bitfield name="WAIT_RB_IDLE_FIRST_TRI_NEW_STATE" pos="26" type="boolean"/>
+		<bitfield name="CLAMPED_FACENESS" pos="28" type="boolean"/>
+		<bitfield name="ZERO_AREA_FACENESS" pos="29" type="boolean"/>
+		<bitfield name="FACE_KILL_ENABLE" pos="30" type="boolean"/>
+		<bitfield name="FACE_WRITE_ENABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2206" name="PA_CL_VTE_CNTL">
+		<bitfield name="VPORT_X_SCALE_ENA" pos="0" type="boolean"/>
+		<bitfield name="VPORT_X_OFFSET_ENA" pos="1" type="boolean"/>
+		<bitfield name="VPORT_Y_SCALE_ENA" pos="2" type="boolean"/>
+		<bitfield name="VPORT_Y_OFFSET_ENA" pos="3" type="boolean"/>
+		<bitfield name="VPORT_Z_SCALE_ENA" pos="4" type="boolean"/>
+		<bitfield name="VPORT_Z_OFFSET_ENA" pos="5" type="boolean"/>
+		<bitfield name="VTX_XY_FMT" pos="8" type="boolean"/>
+		<bitfield name="VTX_Z_FMT" pos="9" type="boolean"/>
+		<bitfield name="VTX_W0_FMT" pos="10" type="boolean"/>
+		<bitfield name="PERFCOUNTER_REF" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2207" name="VGT_CURRENT_BIN_ID_MIN" type="a2xx_vgt_current_bin_id_min_max"/>
+	<reg32 offset="0x2208" name="RB_MODECONTROL">
+		<bitfield name="EDRAM_MODE" low="0" high="2" type="a2xx_rb_edram_mode"/>
+	</reg32>
+	<reg32 offset="0x2209" name="A220_RB_LRZ_VSC_CONTROL"/>
+	<reg32 offset="0x220a" name="RB_SAMPLE_POS"/>
+	<reg32 offset="0x220b" name="CLEAR_COLOR">
+		<bitfield name="RED" low="0" high="7"/>
+		<bitfield name="GREEN" low="8" high="15"/>
+		<bitfield name="BLUE" low="16" high="23"/>
+		<bitfield name="ALPHA" low="24" high="31"/>
+	</reg32>
+	<reg32 offset="0x2210" name="A220_GRAS_CONTROL"/>
+	<reg32 offset="0x2280" name="PA_SU_POINT_SIZE">
+		<bitfield name="HEIGHT" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="WIDTH" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2281" name="PA_SU_POINT_MINMAX">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2282" name="PA_SU_LINE_CNTL">
+		<bitfield name="WIDTH" low="0" high="15" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2283" name="PA_SC_LINE_STIPPLE">
+		<bitfield name="LINE_PATTERN" low="0" high="15" type="hex"/>
+		<bitfield name="REPEAT_COUNT" low="16" high="23" type="uint"/>
+		<bitfield name="PATTERN_BIT_ORDER" pos="28" type="a2xx_pa_sc_pattern_bit_order"/>
+		<bitfield name="AUTO_RESET_CNTL" low="29" high="30" type="a2xx_pa_sc_auto_reset_cntl"/>
+	</reg32>
+	<reg32 offset="0x2293" name="PA_SC_VIZ_QUERY">
+		<bitfield name="VIZ_QUERY_ENA" pos="0" type="boolean"/>
+		<bitfield name="VIZ_QUERY_ID" low="1" high="6" type="uint"/>
+		<bitfield name="KILL_PIX_POST_EARLY_Z" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2294" name="VGT_ENHANCE"/>
+	<reg32 offset="0x2300" name="PA_SC_LINE_CNTL">
+		<bitfield name="BRES_CNTL" low="0" high="15" type="uint"/>
+		<bitfield name="USE_BRES_CNTL" pos="8" type="boolean"/>
+		<bitfield name="EXPAND_LINE_WIDTH" pos="9" type="boolean"/>
+		<bitfield name="LAST_PIXEL" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2301" name="PA_SC_AA_CONFIG">
+		<bitfield name="MSAA_NUM_SAMPLES" low="0" high="2" type="uint"/>
+		<bitfield name="MAX_SAMPLE_DIST" low="13" high="16" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2302" name="PA_SU_VTX_CNTL">
+		<bitfield name="PIX_CENTER" pos="0" type="a2xx_pa_pixcenter"/>
+		<bitfield name="ROUND_MODE" low="1" high="2" type="a2xx_pa_roundmode"/>
+		<bitfield name="QUANT_MODE" low="7" high="9" type="a2xx_pa_quantmode"/>
+	</reg32>
+	<reg32 offset="0x2303" name="PA_CL_GB_VERT_CLIP_ADJ" type="float"/>
+	<reg32 offset="0x2304" name="PA_CL_GB_VERT_DISC_ADJ" type="float"/>
+	<reg32 offset="0x2305" name="PA_CL_GB_HORZ_CLIP_ADJ" type="float"/>
+	<reg32 offset="0x2306" name="PA_CL_GB_HORZ_DISC_ADJ" type="float"/>
+	<reg32 offset="0x2307" name="SQ_VS_CONST">
+		<bitfield name="BASE" low="0" high="8" type="uint"/>
+		<bitfield name="SIZE" low="12" high="20" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2308" name="SQ_PS_CONST">
+		<bitfield name="BASE" low="0" high="8" type="uint"/>
+		<bitfield name="SIZE" low="12" high="20" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2309" name="SQ_DEBUG_MISC_0"/>
+	<reg32 offset="0x230a" name="SQ_DEBUG_MISC_1"/>
+	<reg32 offset="0x2312" name="PA_SC_AA_MASK"/>
+	<reg32 offset="0x2316" name="VGT_VERTEX_REUSE_BLOCK_CNTL">
+		<bitfield name="VTX_REUSE_DEPTH" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2317" name="VGT_OUT_DEALLOC_CNTL">
+		<bitfield name="DEALLOC_DIST" low="0" high="1" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2318" name="RB_COPY_CONTROL">
+		<bitfield name="COPY_SAMPLE_SELECT" low="0" high="2" type="a2xx_rb_copy_sample_select"/>
+		<bitfield name="DEPTH_CLEAR_ENABLE" pos="3" type="boolean"/>
+		<bitfield name="CLEAR_MASK" low="4" high="7" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2319" name="RB_COPY_DEST_BASE"/>
+	<reg32 offset="0x231a" name="RB_COPY_DEST_PITCH" shr="5" type="uint"/>
+	<reg32 offset="0x231b" name="RB_COPY_DEST_INFO">
+		<bitfield name="DEST_ENDIAN" low="0" high="2" type="adreno_rb_surface_endian"/>
+		<bitfield name="LINEAR" pos="3" type="boolean"/>
+		<bitfield name="FORMAT" low="4" high="7" type="a2xx_colorformatx"/>
+		<bitfield name="SWAP" low="8" high="9" type="uint"/>
+		<bitfield name="DITHER_MODE" low="10" high="11" type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_TYPE" low="12" high="13" type="a2xx_rb_dither_type"/>
+		<bitfield name="WRITE_RED" pos="14" type="boolean"/>
+		<bitfield name="WRITE_GREEN" pos="15" type="boolean"/>
+		<bitfield name="WRITE_BLUE" pos="16" type="boolean"/>
+		<bitfield name="WRITE_ALPHA" pos="17" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x231c" name="RB_COPY_DEST_OFFSET">
+		<bitfield name="X" low="0" high="12" type="uint"/>
+		<bitfield name="Y" low="13" high="25" type="uint"/>
+	</reg32>
+	<reg32 offset="0x231d" name="RB_DEPTH_CLEAR"/>
+	<reg32 offset="0x2324" name="RB_SAMPLE_COUNT_CTL"/>
+	<reg32 offset="0x2326" name="RB_COLOR_DEST_MASK"/>
+	<reg32 offset="0x2340" name="A225_GRAS_UCP0X"/>
+	<reg32 offset="0x2357" name="A225_GRAS_UCP5W"/>
+	<reg32 offset="0x2360" name="A225_GRAS_UCP_ENABLED"/>
+	<reg32 offset="0x2380" name="PA_SU_POLY_OFFSET_FRONT_SCALE"/>
+	<reg32 offset="0x2381" name="PA_SU_POLY_OFFSET_FRONT_OFFSET"/>
+	<reg32 offset="0x2382" name="PA_SU_POLY_OFFSET_BACK_SCALE"/>
+	<reg32 offset="0x2383" name="PA_SU_POLY_OFFSET_BACK_OFFSET"/>
+	<reg32 offset="0x4000" name="SQ_CONSTANT_0"/>
+	<reg32 offset="0x4800" name="SQ_FETCH_0"/>
+	<reg32 offset="0x4900" name="SQ_CF_BOOLEANS"/>
+	<reg32 offset="0x4908" name="SQ_CF_LOOP"/>
+	<reg32 offset="0xa29" name="COHER_SIZE_PM4"/>
+	<reg32 offset="0xa2a" name="COHER_BASE_PM4"/>
+	<reg32 offset="0xa2b" name="COHER_STATUS_PM4"/>
+
+	<reg32 offset="0x0c88" name="PA_SU_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0c89" name="PA_SU_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0c8a" name="PA_SU_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0c8b" name="PA_SU_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0c8c" name="PA_SU_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0c8d" name="PA_SU_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0c8e" name="PA_SU_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0c8f" name="PA_SU_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0c90" name="PA_SU_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0c91" name="PA_SU_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0c92" name="PA_SU_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0c93" name="PA_SU_PERFCOUNTER3_HI"/>
+	<reg32 offset="0x0c98" name="PA_SC_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0c99" name="PA_SC_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0c9a" name="PA_SC_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0c48" name="VGT_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0c49" name="VGT_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0c4a" name="VGT_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0c4b" name="VGT_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0c4c" name="VGT_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0c4e" name="VGT_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0c50" name="VGT_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0c52" name="VGT_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0c4d" name="VGT_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0c4f" name="VGT_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0c51" name="VGT_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0c53" name="VGT_PERFCOUNTER3_HI"/>
+	<reg32 offset="0x0e05" name="TCR_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0e08" name="TCR_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0e06" name="TCR_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0e09" name="TCR_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0e07" name="TCR_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0e0a" name="TCR_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0e1f" name="TP0_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0e20" name="TP0_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0e21" name="TP0_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0e22" name="TP0_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0e23" name="TP0_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0e24" name="TP0_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0e54" name="TCM_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0e57" name="TCM_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0e55" name="TCM_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0e58" name="TCM_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0e56" name="TCM_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0e59" name="TCM_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0e5a" name="TCF_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0e5d" name="TCF_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0e60" name="TCF_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0e63" name="TCF_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0e66" name="TCF_PERFCOUNTER4_SELECT"/>
+	<reg32 offset="0x0e69" name="TCF_PERFCOUNTER5_SELECT"/>
+	<reg32 offset="0x0e6c" name="TCF_PERFCOUNTER6_SELECT"/>
+	<reg32 offset="0x0e6f" name="TCF_PERFCOUNTER7_SELECT"/>
+	<reg32 offset="0x0e72" name="TCF_PERFCOUNTER8_SELECT"/>
+	<reg32 offset="0x0e75" name="TCF_PERFCOUNTER9_SELECT"/>
+	<reg32 offset="0x0e78" name="TCF_PERFCOUNTER10_SELECT"/>
+	<reg32 offset="0x0e7b" name="TCF_PERFCOUNTER11_SELECT"/>
+	<reg32 offset="0x0e5b" name="TCF_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0e5e" name="TCF_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0e61" name="TCF_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0e64" name="TCF_PERFCOUNTER3_HI"/>
+	<reg32 offset="0x0e67" name="TCF_PERFCOUNTER4_HI"/>
+	<reg32 offset="0x0e6a" name="TCF_PERFCOUNTER5_HI"/>
+	<reg32 offset="0x0e6d" name="TCF_PERFCOUNTER6_HI"/>
+	<reg32 offset="0x0e70" name="TCF_PERFCOUNTER7_HI"/>
+	<reg32 offset="0x0e73" name="TCF_PERFCOUNTER8_HI"/>
+	<reg32 offset="0x0e76" name="TCF_PERFCOUNTER9_HI"/>
+	<reg32 offset="0x0e79" name="TCF_PERFCOUNTER10_HI"/>
+	<reg32 offset="0x0e7c" name="TCF_PERFCOUNTER11_HI"/>
+	<reg32 offset="0x0e5c" name="TCF_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0e5f" name="TCF_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0e62" name="TCF_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0e65" name="TCF_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0e68" name="TCF_PERFCOUNTER4_LOW"/>
+	<reg32 offset="0x0e6b" name="TCF_PERFCOUNTER5_LOW"/>
+	<reg32 offset="0x0e6e" name="TCF_PERFCOUNTER6_LOW"/>
+	<reg32 offset="0x0e71" name="TCF_PERFCOUNTER7_LOW"/>
+	<reg32 offset="0x0e74" name="TCF_PERFCOUNTER8_LOW"/>
+	<reg32 offset="0x0e77" name="TCF_PERFCOUNTER9_LOW"/>
+	<reg32 offset="0x0e7a" name="TCF_PERFCOUNTER10_LOW"/>
+	<reg32 offset="0x0e7d" name="TCF_PERFCOUNTER11_LOW"/>
+	<reg32 offset="0x0dc8" name="SQ_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0dc9" name="SQ_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0dca" name="SQ_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0dcb" name="SQ_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0dcc" name="SQ_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0dcd" name="SQ_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0dce" name="SQ_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0dcf" name="SQ_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0dd0" name="SQ_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0dd1" name="SQ_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0dd2" name="SQ_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0dd3" name="SQ_PERFCOUNTER3_HI"/>
+	<reg32 offset="0x0dd4" name="SX_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0dd8" name="SX_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0dd9" name="SX_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0a46" name="MH_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0a4a" name="MH_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0a47" name="MH_PERFCOUNTER0_CONFIG"/>
+	<reg32 offset="0x0a4b" name="MH_PERFCOUNTER1_CONFIG"/>
+	<reg32 offset="0x0a48" name="MH_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0a4c" name="MH_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0a49" name="MH_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0a4d" name="MH_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0f04" name="RB_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0f05" name="RB_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0f06" name="RB_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0f07" name="RB_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0f08" name="RB_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0f09" name="RB_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0f0a" name="RB_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0f0b" name="RB_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0f0c" name="RB_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0f0d" name="RB_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0f0e" name="RB_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0f0f" name="RB_PERFCOUNTER3_HI"/>
+</domain>
+
+<domain name="A2XX_SQ_TEX" width="32">
+	<doc>Texture state dwords</doc>
+	<enum name="sq_tex_clamp">
+		<value name="SQ_TEX_WRAP" value="0"/>
+		<value name="SQ_TEX_MIRROR" value="1"/>
+		<value name="SQ_TEX_CLAMP_LAST_TEXEL" value="2"/>
+		<value name="SQ_TEX_MIRROR_ONCE_LAST_TEXEL" value="3"/>
+		<value name="SQ_TEX_CLAMP_HALF_BORDER" value="4"/>
+		<value name="SQ_TEX_MIRROR_ONCE_HALF_BORDER" value="5"/>
+		<value name="SQ_TEX_CLAMP_BORDER" value="6"/>
+		<value name="SQ_TEX_MIRROR_ONCE_BORDER" value="7"/>
+	</enum>
+	<enum name="sq_tex_swiz">
+		<value name="SQ_TEX_X" value="0"/>
+		<value name="SQ_TEX_Y" value="1"/>
+		<value name="SQ_TEX_Z" value="2"/>
+		<value name="SQ_TEX_W" value="3"/>
+		<value name="SQ_TEX_ZERO" value="4"/>
+		<value name="SQ_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="sq_tex_filter">
+		<value name="SQ_TEX_FILTER_POINT" value="0"/>
+		<value name="SQ_TEX_FILTER_BILINEAR" value="1"/>
+		<value name="SQ_TEX_FILTER_BASEMAP" value="2"/>
+		<value name="SQ_TEX_FILTER_USE_FETCH_CONST" value="3"/>
+	</enum>
+	<enum name="sq_tex_aniso_filter">
+		<value name="SQ_TEX_ANISO_FILTER_DISABLED" value="0"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_1_1" value="1"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_2_1" value="2"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_4_1" value="3"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_8_1" value="4"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_16_1" value="5"/>
+		<value name="SQ_TEX_ANISO_FILTER_USE_FETCH_CONST" value="7"/>
+	</enum>
+	<enum name="sq_tex_dimension">
+		<value name="SQ_TEX_DIMENSION_1D" value="0"/>
+		<value name="SQ_TEX_DIMENSION_2D" value="1"/>
+		<value name="SQ_TEX_DIMENSION_3D" value="2"/>
+		<value name="SQ_TEX_DIMENSION_CUBE" value="3"/>
+	</enum>
+	<enum name="sq_tex_border_color">
+		<value name="SQ_TEX_BORDER_COLOR_BLACK" value="0"/>
+		<value name="SQ_TEX_BORDER_COLOR_WHITE" value="1"/>
+		<value name="SQ_TEX_BORDER_COLOR_ACBYCR_BLACK" value="2"/>
+		<value name="SQ_TEX_BORDER_COLOR_ACBCRY_BLACK" value="3"/>
+	</enum>
+	<enum name="sq_tex_sign">
+		<value name="SQ_TEX_SIGN_UNSIGNED" value="0"/>
+		<value name="SQ_TEX_SIGN_SIGNED" value="1"/>
+		<!-- biased: 2*color-1 (range -1,1 when sampling) -->
+		<value name="SQ_TEX_SIGN_UNSIGNED_BIASED" value="2"/>
+		<!-- gamma: sRGB to linear - doesn't seem to work on adreno? -->
+		<value name="SQ_TEX_SIGN_GAMMA" value="3"/>
+	</enum>
+	<enum name="sq_tex_endian">
+		<value name="SQ_TEX_ENDIAN_NONE" value="0"/>
+		<value name="SQ_TEX_ENDIAN_8IN16" value="1"/>
+		<value name="SQ_TEX_ENDIAN_8IN32" value="2"/>
+		<value name="SQ_TEX_ENDIAN_16IN32" value="3"/>
+	</enum>
+	<enum name="sq_tex_clamp_policy">
+		<value name="SQ_TEX_CLAMP_POLICY_D3D" value="0"/>
+		<value name="SQ_TEX_CLAMP_POLICY_OGL" value="1"/>
+	</enum>
+	<enum name="sq_tex_num_format">
+		<value name="SQ_TEX_NUM_FORMAT_FRAC" value="0"/>
+		<value name="SQ_TEX_NUM_FORMAT_INT" value="1"/>
+	</enum>
+	<enum name="sq_tex_type">
+		<value name="SQ_TEX_TYPE_0" value="0"/>
+		<value name="SQ_TEX_TYPE_1" value="1"/>
+		<value name="SQ_TEX_TYPE_2" value="2"/>
+		<value name="SQ_TEX_TYPE_3" value="3"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TYPE" low="0" high="1" type="sq_tex_type"/>
+		<bitfield name="SIGN_X" low="2" high="3" type="sq_tex_sign"/>
+		<bitfield name="SIGN_Y" low="4" high="5" type="sq_tex_sign"/>
+		<bitfield name="SIGN_Z" low="6" high="7" type="sq_tex_sign"/>
+		<bitfield name="SIGN_W" low="8" high="9" type="sq_tex_sign"/>
+		<bitfield name="CLAMP_X" low="10" high="12" type="sq_tex_clamp"/>
+		<bitfield name="CLAMP_Y" low="13" high="15" type="sq_tex_clamp"/>
+		<bitfield name="CLAMP_Z" low="16" high="18" type="sq_tex_clamp"/>
+		<bitfield name="PITCH" low="22" high="30" shr="5" type="uint"/>
+		<bitfield name="TILED" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="FORMAT" low="0" high="5" type="a2xx_sq_surfaceformat"/>
+		<bitfield name="ENDIANNESS" low="6" high="7" type="sq_tex_endian"/>
+		<bitfield name="REQUEST_SIZE" low="8" high="9" type="uint"/>
+		<bitfield name="STACKED" pos="10" type="boolean"/>
+		<bitfield name="CLAMP_POLICY" pos="11" type="sq_tex_clamp_policy"/>
+		<bitfield name="BASE_ADDRESS" low="12" high="31" type="uint" shr="12"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="WIDTH" low="0" high="12" type="uint"/>
+		<bitfield name="HEIGHT" low="13" high="25" type="uint"/>
+		<bitfield name="DEPTH" low="26" high="31" type="uint"/>
+		<!-- 1d/3d have different bit configurations -->
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="NUM_FORMAT" pos="0" type="sq_tex_num_format"/>
+		<bitfield name="SWIZ_X" low="1" high="3" type="sq_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="4" high="6" type="sq_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="7" high="9" type="sq_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="10" high="12" type="sq_tex_swiz"/>
+		<bitfield name="EXP_ADJUST" low="13" high="18" type="int"/>
+		<bitfield name="XY_MAG_FILTER" low="19" high="20" type="sq_tex_filter"/>
+		<bitfield name="XY_MIN_FILTER" low="21" high="22" type="sq_tex_filter"/>
+		<bitfield name="MIP_FILTER" low="23" high="24" type="sq_tex_filter"/>
+		<bitfield name="ANISO_FILTER" low="25" high="27" type="sq_tex_aniso_filter"/>
+		<bitfield name="BORDER_SIZE" pos="31" type="uint"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="VOL_MAG_FILTER" pos="0" type="sq_tex_filter"/>
+		<bitfield name="VOL_MIN_FILTER" pos="1" type="sq_tex_filter"/>
+		<bitfield name="MIP_MIN_LEVEL" low="2" high="5" type="uint"/>
+		<bitfield name="MIP_MAX_LEVEL" low="6" high="9" type="uint"/>
+		<bitfield name="MAX_ANISO_WALK" pos="10" type="boolean"/>
+		<bitfield name="MIN_ANISO_WALK" pos="11" type="boolean"/>
+		<bitfield name="LOD_BIAS" low="12" high="21" type="fixed" radix="5"/>
+		<bitfield name="GRAD_EXP_ADJUST_H" low="22" high="26" type="uint"/>
+		<bitfield name="GRAD_EXP_ADJUST_V" low="27" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="BORDER_COLOR" low="0" high="1" type="sq_tex_border_color"/>
+		<bitfield name="FORCE_BCW_MAX" pos="2" type="boolean"/>
+		<bitfield name="TRI_CLAMP" low="3" high="4" type="uint"/>
+		<bitfield name="ANISO_BIAS" low="5" high="8" type="fixed" radix="0"/> <!-- radix unknown -->
+		<bitfield name="DIMENSION" low="9" high="10" type="sq_tex_dimension"/>
+		<bitfield name="PACKED_MIPS" pos="11" type="boolean"/>
+		<bitfield name="MIP_ADDRESS" low="12" high="31" type="uint" shr="12"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/adreno/a3xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/adreno/a3xx.xml
@@ -0,0 +1,1751 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+<enum name="a3xx_tile_mode">
+	<value name="LINEAR" value="0"/>
+	<value name="TILE_4X4" value="1"/>    <!-- "normal" case for textures -->
+	<value name="TILE_32X32" value="2"/>  <!-- only used in GMEM -->
+	<value name="TILE_4X2" value="3"/>    <!-- only used for CrCb -->
+</enum>
+
+<enum name="a3xx_state_block_id">
+	<value name="HLSQ_BLOCK_ID_TP_TEX" value="2"/>
+	<value name="HLSQ_BLOCK_ID_TP_MIPMAP" value="3"/>
+	<value name="HLSQ_BLOCK_ID_SP_VS" value="4"/>
+	<value name="HLSQ_BLOCK_ID_SP_FS" value="6"/>
+</enum>
+
+<enum name="a3xx_cache_opcode">
+	<value name="INVALIDATE" value="1"/>
+</enum>
+
+<enum name="a3xx_vtx_fmt">
+	<value name="VFMT_32_FLOAT" value="0x0"/>
+	<value name="VFMT_32_32_FLOAT" value="0x1"/>
+	<value name="VFMT_32_32_32_FLOAT" value="0x2"/>
+	<value name="VFMT_32_32_32_32_FLOAT" value="0x3"/>
+
+	<value name="VFMT_16_FLOAT" value="0x4"/>
+	<value name="VFMT_16_16_FLOAT" value="0x5"/>
+	<value name="VFMT_16_16_16_FLOAT" value="0x6"/>
+	<value name="VFMT_16_16_16_16_FLOAT" value="0x7"/>
+
+	<value name="VFMT_32_FIXED" value="0x8"/>
+	<value name="VFMT_32_32_FIXED" value="0x9"/>
+	<value name="VFMT_32_32_32_FIXED" value="0xa"/>
+	<value name="VFMT_32_32_32_32_FIXED" value="0xb"/>
+
+	<value name="VFMT_16_SINT" value="0x10"/>
+	<value name="VFMT_16_16_SINT" value="0x11"/>
+	<value name="VFMT_16_16_16_SINT" value="0x12"/>
+	<value name="VFMT_16_16_16_16_SINT" value="0x13"/>
+	<value name="VFMT_16_UINT" value="0x14"/>
+	<value name="VFMT_16_16_UINT" value="0x15"/>
+	<value name="VFMT_16_16_16_UINT" value="0x16"/>
+	<value name="VFMT_16_16_16_16_UINT" value="0x17"/>
+	<value name="VFMT_16_SNORM" value="0x18"/>
+	<value name="VFMT_16_16_SNORM" value="0x19"/>
+	<value name="VFMT_16_16_16_SNORM" value="0x1a"/>
+	<value name="VFMT_16_16_16_16_SNORM" value="0x1b"/>
+	<value name="VFMT_16_UNORM" value="0x1c"/>
+	<value name="VFMT_16_16_UNORM" value="0x1d"/>
+	<value name="VFMT_16_16_16_UNORM" value="0x1e"/>
+	<value name="VFMT_16_16_16_16_UNORM" value="0x1f"/>
+
+	<!-- seems to be no NORM variants for 32bit.. -->
+	<value name="VFMT_32_UINT" value="0x20"/>
+	<value name="VFMT_32_32_UINT" value="0x21"/>
+	<value name="VFMT_32_32_32_UINT" value="0x22"/>
+	<value name="VFMT_32_32_32_32_UINT" value="0x23"/>
+	<value name="VFMT_32_SINT" value="0x24"/>
+	<value name="VFMT_32_32_SINT" value="0x25"/>
+	<value name="VFMT_32_32_32_SINT" value="0x26"/>
+	<value name="VFMT_32_32_32_32_SINT" value="0x27"/>
+
+	<value name="VFMT_8_UINT" value="0x28"/>
+	<value name="VFMT_8_8_UINT" value="0x29"/>
+	<value name="VFMT_8_8_8_UINT" value="0x2a"/>
+	<value name="VFMT_8_8_8_8_UINT" value="0x2b"/>
+	<value name="VFMT_8_UNORM" value="0x2c"/>
+	<value name="VFMT_8_8_UNORM" value="0x2d"/>
+	<value name="VFMT_8_8_8_UNORM" value="0x2e"/>
+	<value name="VFMT_8_8_8_8_UNORM" value="0x2f"/>
+	<value name="VFMT_8_SINT" value="0x30"/>
+	<value name="VFMT_8_8_SINT" value="0x31"/>
+	<value name="VFMT_8_8_8_SINT" value="0x32"/>
+	<value name="VFMT_8_8_8_8_SINT" value="0x33"/>
+	<value name="VFMT_8_SNORM" value="0x34"/>
+	<value name="VFMT_8_8_SNORM" value="0x35"/>
+	<value name="VFMT_8_8_8_SNORM" value="0x36"/>
+	<value name="VFMT_8_8_8_8_SNORM" value="0x37"/>
+	<value name="VFMT_10_10_10_2_UINT" value="0x38"/>
+	<value name="VFMT_10_10_10_2_UNORM" value="0x39"/>
+	<value name="VFMT_10_10_10_2_SINT" value="0x3a"/>
+	<value name="VFMT_10_10_10_2_SNORM" value="0x3b"/>
+	<value name="VFMT_2_10_10_10_UINT" value="0x3c"/>
+	<value name="VFMT_2_10_10_10_UNORM" value="0x3d"/>
+	<value name="VFMT_2_10_10_10_SINT" value="0x3e"/>
+	<value name="VFMT_2_10_10_10_SNORM" value="0x3f"/>
+
+	<value name="VFMT_NONE" value="0xff"/>
+</enum>
+
+<enum name="a3xx_tex_fmt">
+	<value name="TFMT_5_6_5_UNORM" value="0x4"/>
+	<value name="TFMT_5_5_5_1_UNORM" value="0x5"/>
+	<value name="TFMT_4_4_4_4_UNORM" value="0x7"/>
+	<value name="TFMT_Z16_UNORM" value="0x9"/>
+	<value name="TFMT_X8Z24_UNORM" value="0xa"/>
+	<value name="TFMT_Z32_FLOAT" value="0xb"/>
+
+	<!--
+		The NV12 tiled/linear formats seem to require gang'd sampler
+		slots (ie. sampler state N plus N+1) for Y and UV planes.
+		They fetch yuv in single sam instruction, but still require
+		colorspace conversion in the shader.
+	 -->
+	<value name="TFMT_UV_64X32" value="0x10"/>
+	<value name="TFMT_VU_64X32" value="0x11"/>
+	<value name="TFMT_Y_64X32" value="0x12"/>
+	<value name="TFMT_NV12_64X32" value="0x13"/>
+	<value name="TFMT_UV_LINEAR" value="0x14"/>
+	<value name="TFMT_VU_LINEAR" value="0x15"/>
+	<value name="TFMT_Y_LINEAR" value="0x16"/>
+	<value name="TFMT_NV12_LINEAR" value="0x17"/>
+	<value name="TFMT_I420_Y" value="0x18"/>
+	<value name="TFMT_I420_U" value="0x1a"/>
+	<value name="TFMT_I420_V" value="0x1b"/>
+
+	<value name="TFMT_ATC_RGB" value="0x20"/>
+	<value name="TFMT_ATC_RGBA_EXPLICIT" value="0x21"/>
+	<value name="TFMT_ETC1" value="0x22"/>
+	<value name="TFMT_ATC_RGBA_INTERPOLATED" value="0x23"/>
+
+	<value name="TFMT_DXT1" value="0x24"/>
+	<value name="TFMT_DXT3" value="0x25"/>
+	<value name="TFMT_DXT5" value="0x26"/>
+
+	<value name="TFMT_2_10_10_10_UNORM" value="0x28"/>
+	<value name="TFMT_10_10_10_2_UNORM" value="0x29"/>
+	<value name="TFMT_9_9_9_E5_FLOAT" value="0x2a"/>
+	<value name="TFMT_11_11_10_FLOAT" value="0x2b"/>
+	<value name="TFMT_A8_UNORM" value="0x2c"/>    <!-- GL_ALPHA -->
+	<value name="TFMT_L8_UNORM" value="0x2d"/>
+	<value name="TFMT_L8_A8_UNORM" value="0x2f"/> <!-- GL_LUMINANCE_ALPHA -->
+
+	<!--
+		NOTE: GL_ALPHA and GL_LUMINANCE_ALPHA aren't handled in a similar way
+		to float16, float32.. but they seem to use non-standard swizzle too..
+		perhaps we can ditch that if the pattern follows of 0xn0, 0xn1, 0xn2,
+		0xn3 for 1, 2, 3, 4 components respectively..
+
+		Only formats filled in below are the ones that have been observed by
+		the blob or tested.. you can guess what the missing ones are..
+	 -->
+
+	<value name="TFMT_8_UNORM" value="0x30"/>     <!-- GL_LUMINANCE -->
+	<value name="TFMT_8_8_UNORM" value="0x31"/>
+	<value name="TFMT_8_8_8_UNORM" value="0x32"/>
+	<value name="TFMT_8_8_8_8_UNORM" value="0x33"/>
+
+	<value name="TFMT_8_SNORM" value="0x34"/>
+	<value name="TFMT_8_8_SNORM" value="0x35"/>
+	<value name="TFMT_8_8_8_SNORM" value="0x36"/>
+	<value name="TFMT_8_8_8_8_SNORM" value="0x37"/>
+
+	<value name="TFMT_8_UINT" value="0x38"/>
+	<value name="TFMT_8_8_UINT" value="0x39"/>
+	<value name="TFMT_8_8_8_UINT" value="0x3a"/>
+	<value name="TFMT_8_8_8_8_UINT" value="0x3b"/>
+
+	<value name="TFMT_8_SINT" value="0x3c"/>
+	<value name="TFMT_8_8_SINT" value="0x3d"/>
+	<value name="TFMT_8_8_8_SINT" value="0x3e"/>
+	<value name="TFMT_8_8_8_8_SINT" value="0x3f"/>
+
+	<value name="TFMT_16_FLOAT" value="0x40"/>
+	<value name="TFMT_16_16_FLOAT" value="0x41"/>
+	<!-- TFMT_FLOAT_16_16_16 -->
+	<value name="TFMT_16_16_16_16_FLOAT" value="0x43"/>
+
+	<value name="TFMT_16_UINT" value="0x44"/>
+	<value name="TFMT_16_16_UINT" value="0x45"/>
+	<value name="TFMT_16_16_16_16_UINT" value="0x47"/>
+
+	<value name="TFMT_16_SINT" value="0x48"/>
+	<value name="TFMT_16_16_SINT" value="0x49"/>
+	<value name="TFMT_16_16_16_16_SINT" value="0x4b"/>
+
+	<value name="TFMT_16_UNORM" value="0x4c"/>
+	<value name="TFMT_16_16_UNORM" value="0x4d"/>
+	<value name="TFMT_16_16_16_16_UNORM" value="0x4f"/>
+
+	<value name="TFMT_16_SNORM" value="0x50"/>
+	<value name="TFMT_16_16_SNORM" value="0x51"/>
+	<value name="TFMT_16_16_16_16_SNORM" value="0x53"/>
+
+	<value name="TFMT_32_FLOAT" value="0x54"/>
+	<value name="TFMT_32_32_FLOAT" value="0x55"/>
+	<!-- TFMT_32_32_32_FLOAT -->
+	<value name="TFMT_32_32_32_32_FLOAT" value="0x57"/>
+
+	<value name="TFMT_32_UINT" value="0x58"/>
+	<value name="TFMT_32_32_UINT" value="0x59"/>
+	<value name="TFMT_32_32_32_32_UINT" value="0x5b"/>
+
+	<value name="TFMT_32_SINT" value="0x5c"/>
+	<value name="TFMT_32_32_SINT" value="0x5d"/>
+	<value name="TFMT_32_32_32_32_SINT" value="0x5f"/>
+
+	<value name="TFMT_2_10_10_10_UINT" value="0x60"/>
+	<value name="TFMT_10_10_10_2_UINT" value="0x61"/>
+
+	<value name="TFMT_ETC2_RG11_SNORM" value="0x70"/>
+	<value name="TFMT_ETC2_RG11_UNORM" value="0x71"/>
+	<value name="TFMT_ETC2_R11_SNORM" value="0x72"/>
+	<value name="TFMT_ETC2_R11_UNORM" value="0x73"/>
+	<value name="TFMT_ETC2_RGBA8" value="0x74"/>
+	<value name="TFMT_ETC2_RGB8A1" value="0x75"/>
+	<value name="TFMT_ETC2_RGB8" value="0x76"/>
+
+	<value name="TFMT_NONE" value="0xff"/>
+</enum>
+
+<enum name="a3xx_color_fmt">
+	<value name="RB_R5G6B5_UNORM"       value="0x00"/>
+	<value name="RB_R5G5B5A1_UNORM"     value="0x01"/>
+	<value name="RB_R4G4B4A4_UNORM"     value="0x03"/>
+	<value name="RB_R8G8B8_UNORM"	    value="0x04"/>
+	<value name="RB_R8G8B8A8_UNORM"	    value="0x08"/>
+	<value name="RB_R8G8B8A8_SNORM"	    value="0x09"/>
+	<value name="RB_R8G8B8A8_UINT"	    value="0x0a"/>
+	<value name="RB_R8G8B8A8_SINT"	    value="0x0b"/>
+	<value name="RB_R8G8_UNORM"	    value="0x0c"/>
+	<value name="RB_R8G8_SNORM"	    value="0x0d"/>
+	<value name="RB_R8G8_UINT"	    value="0x0e"/>
+	<value name="RB_R8G8_SINT"	    value="0x0f"/>
+	<value name="RB_R10G10B10A2_UNORM"  value="0x10"/>
+	<value name="RB_A2R10G10B10_UNORM"  value="0x11"/>
+	<value name="RB_R10G10B10A2_UINT"   value="0x12"/>
+	<value name="RB_A2R10G10B10_UINT"   value="0x13"/>
+
+	<value name="RB_A8_UNORM"	    value="0x14"/>
+	<value name="RB_R8_UNORM"	    value="0x15"/>
+
+	<value name="RB_R16_FLOAT"          value="0x18"/>
+	<value name="RB_R16G16_FLOAT"       value="0x19"/>
+	<value name="RB_R16G16B16A16_FLOAT" value="0x1b"/> <!-- GL_HALF_FLOAT_OES -->
+	<value name="RB_R11G11B10_FLOAT"    value="0x1c"/>
+
+	<value name="RB_R16_SNORM"          value="0x20"/>
+	<value name="RB_R16G16_SNORM"       value="0x21"/>
+	<value name="RB_R16G16B16A16_SNORM" value="0x23"/>
+
+	<value name="RB_R16_UNORM"          value="0x24"/>
+	<value name="RB_R16G16_UNORM"       value="0x25"/>
+	<value name="RB_R16G16B16A16_UNORM" value="0x27"/>
+
+	<value name="RB_R16_SINT"	    value="0x28"/>
+	<value name="RB_R16G16_SINT"	    value="0x29"/>
+	<value name="RB_R16G16B16A16_SINT"  value="0x2b"/>
+
+	<value name="RB_R16_UINT"	    value="0x2c"/>
+	<value name="RB_R16G16_UINT"	    value="0x2d"/>
+	<value name="RB_R16G16B16A16_UINT"  value="0x2f"/>
+
+	<value name="RB_R32_FLOAT"          value="0x30"/>
+	<value name="RB_R32G32_FLOAT"       value="0x31"/>
+	<value name="RB_R32G32B32A32_FLOAT" value="0x33"/> <!-- GL_FLOAT -->
+
+	<value name="RB_R32_SINT"	    value="0x34"/>
+	<value name="RB_R32G32_SINT"	    value="0x35"/>
+	<value name="RB_R32G32B32A32_SINT"  value="0x37"/>
+
+	<value name="RB_R32_UINT"	    value="0x38"/>
+	<value name="RB_R32G32_UINT"	    value="0x39"/>
+	<value name="RB_R32G32B32A32_UINT"  value="0x3b"/>
+
+	<value name="RB_NONE"               value="0xff"/>
+</enum>
+
+<enum name="a3xx_cp_perfcounter_select">
+	<value value="0x00" name="CP_ALWAYS_COUNT"/>
+	<value value="0x03" name="CP_AHB_PFPTRANS_WAIT"/>
+	<value value="0x06" name="CP_AHB_NRTTRANS_WAIT"/>
+	<value value="0x08" name="CP_CSF_NRT_READ_WAIT"/>
+	<value value="0x09" name="CP_CSF_I1_FIFO_FULL"/>
+	<value value="0x0a" name="CP_CSF_I2_FIFO_FULL"/>
+	<value value="0x0b" name="CP_CSF_ST_FIFO_FULL"/>
+	<value value="0x0c" name="CP_RESERVED_12"/>
+	<value value="0x0d" name="CP_CSF_RING_ROQ_FULL"/>
+	<value value="0x0e" name="CP_CSF_I1_ROQ_FULL"/>
+	<value value="0x0f" name="CP_CSF_I2_ROQ_FULL"/>
+	<value value="0x10" name="CP_CSF_ST_ROQ_FULL"/>
+	<value value="0x11" name="CP_RESERVED_17"/>
+	<value value="0x12" name="CP_MIU_TAG_MEM_FULL"/>
+	<value value="0x16" name="CP_MIU_NRT_WRITE_STALLED"/>
+	<value value="0x17" name="CP_MIU_NRT_READ_STALLED"/>
+	<value value="0x1a" name="CP_ME_REGS_RB_DONE_FIFO_FULL"/>
+	<value value="0x1b" name="CP_ME_REGS_VS_EVENT_FIFO_FULL"/>
+	<value value="0x1c" name="CP_ME_REGS_PS_EVENT_FIFO_FULL"/>
+	<value value="0x1d" name="CP_ME_REGS_CF_EVENT_FIFO_FULL"/>
+	<value value="0x1e" name="CP_ME_MICRO_RB_STARVED"/>
+	<value value="0x28" name="CP_AHB_RBBM_DWORD_SENT"/>
+	<value value="0x29" name="CP_ME_BUSY_CLOCKS"/>
+	<value value="0x2a" name="CP_ME_WAIT_CONTEXT_AVAIL"/>
+	<value value="0x2b" name="CP_PFP_TYPE0_PACKET"/>
+	<value value="0x2c" name="CP_PFP_TYPE3_PACKET"/>
+	<value value="0x2d" name="CP_CSF_RB_WPTR_NEQ_RPTR"/>
+	<value value="0x2e" name="CP_CSF_I1_SIZE_NEQ_ZERO"/>
+	<value value="0x2f" name="CP_CSF_I2_SIZE_NEQ_ZERO"/>
+	<value value="0x30" name="CP_CSF_RBI1I2_FETCHING"/>
+</enum>
+
+<enum name="a3xx_gras_tse_perfcounter_select">
+	<value value="0x00" name="GRAS_TSEPERF_INPUT_PRIM"/>
+	<value value="0x01" name="GRAS_TSEPERF_INPUT_NULL_PRIM"/>
+	<value value="0x02" name="GRAS_TSEPERF_TRIVAL_REJ_PRIM"/>
+	<value value="0x03" name="GRAS_TSEPERF_CLIPPED_PRIM"/>
+	<value value="0x04" name="GRAS_TSEPERF_NEW_PRIM"/>
+	<value value="0x05" name="GRAS_TSEPERF_ZERO_AREA_PRIM"/>
+	<value value="0x06" name="GRAS_TSEPERF_FACENESS_CULLED_PRIM"/>
+	<value value="0x07" name="GRAS_TSEPERF_ZERO_PIXEL_PRIM"/>
+	<value value="0x08" name="GRAS_TSEPERF_OUTPUT_NULL_PRIM"/>
+	<value value="0x09" name="GRAS_TSEPERF_OUTPUT_VISIBLE_PRIM"/>
+	<value value="0x0a" name="GRAS_TSEPERF_PRE_CLIP_PRIM"/>
+	<value value="0x0b" name="GRAS_TSEPERF_POST_CLIP_PRIM"/>
+	<value value="0x0c" name="GRAS_TSEPERF_WORKING_CYCLES"/>
+	<value value="0x0d" name="GRAS_TSEPERF_PC_STARVE"/>
+	<value value="0x0e" name="GRAS_TSERASPERF_STALL"/>
+</enum>
+
+<enum name="a3xx_gras_ras_perfcounter_select">
+	<value value="0x00" name="GRAS_RASPERF_16X16_TILES"/>
+	<value value="0x01" name="GRAS_RASPERF_8X8_TILES"/>
+	<value value="0x02" name="GRAS_RASPERF_4X4_TILES"/>
+	<value value="0x03" name="GRAS_RASPERF_WORKING_CYCLES"/>
+	<value value="0x04" name="GRAS_RASPERF_STALL_CYCLES_BY_RB"/>
+	<value value="0x05" name="GRAS_RASPERF_STALL_CYCLES_BY_VSC"/>
+	<value value="0x06" name="GRAS_RASPERF_STARVE_CYCLES_BY_TSE"/>
+</enum>
+
+<enum name="a3xx_hlsq_perfcounter_select">
+	<value value="0x00" name="HLSQ_PERF_SP_VS_CONSTANT"/>
+	<value value="0x01" name="HLSQ_PERF_SP_VS_INSTRUCTIONS"/>
+	<value value="0x02" name="HLSQ_PERF_SP_FS_CONSTANT"/>
+	<value value="0x03" name="HLSQ_PERF_SP_FS_INSTRUCTIONS"/>
+	<value value="0x04" name="HLSQ_PERF_TP_STATE"/>
+	<value value="0x05" name="HLSQ_PERF_QUADS"/>
+	<value value="0x06" name="HLSQ_PERF_PIXELS"/>
+	<value value="0x07" name="HLSQ_PERF_VERTICES"/>
+	<value value="0x08" name="HLSQ_PERF_FS8_THREADS"/>
+	<value value="0x09" name="HLSQ_PERF_FS16_THREADS"/>
+	<value value="0x0a" name="HLSQ_PERF_FS32_THREADS"/>
+	<value value="0x0b" name="HLSQ_PERF_VS8_THREADS"/>
+	<value value="0x0c" name="HLSQ_PERF_VS16_THREADS"/>
+	<value value="0x0d" name="HLSQ_PERF_SP_VS_DATA_BYTES"/>
+	<value value="0x0e" name="HLSQ_PERF_SP_FS_DATA_BYTES"/>
+	<value value="0x0f" name="HLSQ_PERF_ACTIVE_CYCLES"/>
+	<value value="0x10" name="HLSQ_PERF_STALL_CYCLES_SP_STATE"/>
+	<value value="0x11" name="HLSQ_PERF_STALL_CYCLES_SP_VS"/>
+	<value value="0x12" name="HLSQ_PERF_STALL_CYCLES_SP_FS"/>
+	<value value="0x13" name="HLSQ_PERF_STALL_CYCLES_UCHE"/>
+	<value value="0x14" name="HLSQ_PERF_RBBM_LOAD_CYCLES"/>
+	<value value="0x15" name="HLSQ_PERF_DI_TO_VS_START_SP0"/>
+	<value value="0x16" name="HLSQ_PERF_DI_TO_FS_START_SP0"/>
+	<value value="0x17" name="HLSQ_PERF_VS_START_TO_DONE_SP0"/>
+	<value value="0x18" name="HLSQ_PERF_FS_START_TO_DONE_SP0"/>
+	<value value="0x19" name="HLSQ_PERF_SP_STATE_COPY_CYCLES_VS"/>
+	<value value="0x1a" name="HLSQ_PERF_SP_STATE_COPY_CYCLES_FS"/>
+	<value value="0x1b" name="HLSQ_PERF_UCHE_LATENCY_CYCLES"/>
+	<value value="0x1c" name="HLSQ_PERF_UCHE_LATENCY_COUNT"/>
+</enum>
+
+<enum name="a3xx_pc_perfcounter_select">
+	<value value="0x00" name="PC_PCPERF_VISIBILITY_STREAMS"/>
+	<value value="0x01" name="PC_PCPERF_TOTAL_INSTANCES"/>
+	<value value="0x02" name="PC_PCPERF_PRIMITIVES_PC_VPC"/>
+	<value value="0x03" name="PC_PCPERF_PRIMITIVES_KILLED_BY_VS"/>
+	<value value="0x04" name="PC_PCPERF_PRIMITIVES_VISIBLE_BY_VS"/>
+	<value value="0x05" name="PC_PCPERF_DRAWCALLS_KILLED_BY_VS"/>
+	<value value="0x06" name="PC_PCPERF_DRAWCALLS_VISIBLE_BY_VS"/>
+	<value value="0x07" name="PC_PCPERF_VERTICES_TO_VFD"/>
+	<value value="0x08" name="PC_PCPERF_REUSED_VERTICES"/>
+	<value value="0x09" name="PC_PCPERF_CYCLES_STALLED_BY_VFD"/>
+	<value value="0x0a" name="PC_PCPERF_CYCLES_STALLED_BY_TSE"/>
+	<value value="0x0b" name="PC_PCPERF_CYCLES_STALLED_BY_VBIF"/>
+	<value value="0x0c" name="PC_PCPERF_CYCLES_IS_WORKING"/>
+</enum>
+
+<enum name="a3xx_rb_perfcounter_select">
+	<value value="0x00" name="RB_RBPERF_ACTIVE_CYCLES_ANY"/>
+	<value value="0x01" name="RB_RBPERF_ACTIVE_CYCLES_ALL"/>
+	<value value="0x02" name="RB_RBPERF_STARVE_CYCLES_BY_SP"/>
+	<value value="0x03" name="RB_RBPERF_STARVE_CYCLES_BY_RAS"/>
+	<value value="0x04" name="RB_RBPERF_STARVE_CYCLES_BY_MARB"/>
+	<value value="0x05" name="RB_RBPERF_STALL_CYCLES_BY_MARB"/>
+	<value value="0x06" name="RB_RBPERF_STALL_CYCLES_BY_HLSQ"/>
+	<value value="0x07" name="RB_RBPERF_RB_MARB_DATA"/>
+	<value value="0x08" name="RB_RBPERF_SP_RB_QUAD"/>
+	<value value="0x09" name="RB_RBPERF_RAS_EARLY_Z_QUADS"/>
+	<value value="0x0a" name="RB_RBPERF_GMEM_CH0_READ"/>
+	<value value="0x0b" name="RB_RBPERF_GMEM_CH1_READ"/>
+	<value value="0x0c" name="RB_RBPERF_GMEM_CH0_WRITE"/>
+	<value value="0x0d" name="RB_RBPERF_GMEM_CH1_WRITE"/>
+	<value value="0x0e" name="RB_RBPERF_CP_CONTEXT_DONE"/>
+	<value value="0x0f" name="RB_RBPERF_CP_CACHE_FLUSH"/>
+	<value value="0x10" name="RB_RBPERF_CP_ZPASS_DONE"/>
+</enum>
+
+<enum name="a3xx_rbbm_perfcounter_select">
+	<value value="0" name="RBBM_ALAWYS_ON"/>
+	<value value="1" name="RBBM_VBIF_BUSY"/>
+	<value value="2" name="RBBM_TSE_BUSY"/>
+	<value value="3" name="RBBM_RAS_BUSY"/>
+	<value value="4" name="RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="RBBM_VFD_BUSY"/>
+	<value value="7" name="RBBM_VPC_BUSY"/>
+	<value value="8" name="RBBM_UCHE_BUSY"/>
+	<value value="9" name="RBBM_VSC_BUSY"/>
+	<value value="10" name="RBBM_HLSQ_BUSY"/>
+	<value value="11" name="RBBM_ANY_RB_BUSY"/>
+	<value value="12" name="RBBM_ANY_TEX_BUSY"/>
+	<value value="13" name="RBBM_ANY_USP_BUSY"/>
+	<value value="14" name="RBBM_ANY_MARB_BUSY"/>
+	<value value="15" name="RBBM_ANY_ARB_BUSY"/>
+	<value value="16" name="RBBM_AHB_STATUS_BUSY"/>
+	<value value="17" name="RBBM_AHB_STATUS_STALLED"/>
+	<value value="18" name="RBBM_AHB_STATUS_TXFR"/>
+	<value value="19" name="RBBM_AHB_STATUS_TXFR_SPLIT"/>
+	<value value="20" name="RBBM_AHB_STATUS_TXFR_ERROR"/>
+	<value value="21" name="RBBM_AHB_STATUS_LONG_STALL"/>
+	<value value="22" name="RBBM_RBBM_STATUS_MASKED"/>
+</enum>
+
+<enum name="a3xx_sp_perfcounter_select">
+	<value value="0x00" name="SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="0x01" name="SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="0x02" name="SP_LM_ATOMICS"/>
+	<value value="0x03" name="SP_UCHE_LOAD_INSTRUCTIONS"/>
+	<value value="0x04" name="SP_UCHE_STORE_INSTRUCTIONS"/>
+	<value value="0x05" name="SP_UCHE_ATOMICS"/>
+	<value value="0x06" name="SP_VS_TEX_INSTRUCTIONS"/>
+	<value value="0x07" name="SP_VS_CFLOW_INSTRUCTIONS"/>
+	<value value="0x08" name="SP_VS_EFU_INSTRUCTIONS"/>
+	<value value="0x09" name="SP_VS_FULL_ALU_INSTRUCTIONS"/>
+	<value value="0x0a" name="SP_VS_HALF_ALU_INSTRUCTIONS"/>
+	<value value="0x0b" name="SP_FS_TEX_INSTRUCTIONS"/>
+	<value value="0x0c" name="SP_FS_CFLOW_INSTRUCTIONS"/>
+	<value value="0x0d" name="SP_FS_EFU_INSTRUCTIONS"/>
+	<value value="0x0e" name="SP_FS_FULL_ALU_INSTRUCTIONS"/>
+	<value value="0x0f" name="SP_FS_HALF_ALU_INSTRUCTIONS"/>
+	<value value="0x10" name="SP_FS_BARY_INSTRUCTIONS"/>
+	<value value="0x11" name="SP_VS_INSTRUCTIONS"/>
+	<value value="0x12" name="SP_FS_INSTRUCTIONS"/>
+	<value value="0x13" name="SP_ADDR_LOCK_COUNT"/>
+	<value value="0x14" name="SP_UCHE_READ_TRANS"/>
+	<value value="0x15" name="SP_UCHE_WRITE_TRANS"/>
+	<value value="0x16" name="SP_EXPORT_VPC_TRANS"/>
+	<value value="0x17" name="SP_EXPORT_RB_TRANS"/>
+	<value value="0x18" name="SP_PIXELS_KILLED"/>
+	<value value="0x19" name="SP_ICL1_REQUESTS"/>
+	<value value="0x1a" name="SP_ICL1_MISSES"/>
+	<value value="0x1b" name="SP_ICL0_REQUESTS"/>
+	<value value="0x1c" name="SP_ICL0_MISSES"/>
+	<value value="0x1d" name="SP_ALU_ACTIVE_CYCLES"/>
+	<value value="0x1e" name="SP_EFU_ACTIVE_CYCLES"/>
+	<value value="0x1f" name="SP_STALL_CYCLES_BY_VPC"/>
+	<value value="0x20" name="SP_STALL_CYCLES_BY_TP"/>
+	<value value="0x21" name="SP_STALL_CYCLES_BY_UCHE"/>
+	<value value="0x22" name="SP_STALL_CYCLES_BY_RB"/>
+	<value value="0x23" name="SP_ACTIVE_CYCLES_ANY"/>
+	<value value="0x24" name="SP_ACTIVE_CYCLES_ALL"/>
+</enum>
+
+<enum name="a3xx_tp_perfcounter_select">
+	<value value="0x00" name="TPL1_TPPERF_L1_REQUESTS"/>
+	<value value="0x01" name="TPL1_TPPERF_TP0_L1_REQUESTS"/>
+	<value value="0x02" name="TPL1_TPPERF_TP0_L1_MISSES"/>
+	<value value="0x03" name="TPL1_TPPERF_TP1_L1_REQUESTS"/>
+	<value value="0x04" name="TPL1_TPPERF_TP1_L1_MISSES"/>
+	<value value="0x05" name="TPL1_TPPERF_TP2_L1_REQUESTS"/>
+	<value value="0x06" name="TPL1_TPPERF_TP2_L1_MISSES"/>
+	<value value="0x07" name="TPL1_TPPERF_TP3_L1_REQUESTS"/>
+	<value value="0x08" name="TPL1_TPPERF_TP3_L1_MISSES"/>
+	<value value="0x09" name="TPL1_TPPERF_OUTPUT_TEXELS_POINT"/>
+	<value value="0x0a" name="TPL1_TPPERF_OUTPUT_TEXELS_BILINEAR"/>
+	<value value="0x0b" name="TPL1_TPPERF_OUTPUT_TEXELS_MIP"/>
+	<value value="0x0c" name="TPL1_TPPERF_OUTPUT_TEXELS_ANISO"/>
+	<value value="0x0d" name="TPL1_TPPERF_BILINEAR_OPS"/>
+	<value value="0x0e" name="TPL1_TPPERF_QUADSQUADS_OFFSET"/>
+	<value value="0x0f" name="TPL1_TPPERF_QUADQUADS_SHADOW"/>
+	<value value="0x10" name="TPL1_TPPERF_QUADS_ARRAY"/>
+	<value value="0x11" name="TPL1_TPPERF_QUADS_PROJECTION"/>
+	<value value="0x12" name="TPL1_TPPERF_QUADS_GRADIENT"/>
+	<value value="0x13" name="TPL1_TPPERF_QUADS_1D2D"/>
+	<value value="0x14" name="TPL1_TPPERF_QUADS_3DCUBE"/>
+	<value value="0x15" name="TPL1_TPPERF_ZERO_LOD"/>
+	<value value="0x16" name="TPL1_TPPERF_OUTPUT_TEXELS"/>
+	<value value="0x17" name="TPL1_TPPERF_ACTIVE_CYCLES_ANY"/>
+	<value value="0x18" name="TPL1_TPPERF_ACTIVE_CYCLES_ALL"/>
+	<value value="0x19" name="TPL1_TPPERF_STALL_CYCLES_BY_ARB"/>
+	<value value="0x1a" name="TPL1_TPPERF_LATENCY"/>
+	<value value="0x1b" name="TPL1_TPPERF_LATENCY_TRANS"/>
+</enum>
+
+<enum name="a3xx_vfd_perfcounter_select">
+	<value value="0" name="VFD_PERF_UCHE_BYTE_FETCHED"/>
+	<value value="1" name="VFD_PERF_UCHE_TRANS"/>
+	<value value="2" name="VFD_PERF_VPC_BYPASS_COMPONENTS"/>
+	<value value="3" name="VFD_PERF_FETCH_INSTRUCTIONS"/>
+	<value value="4" name="VFD_PERF_DECODE_INSTRUCTIONS"/>
+	<value value="5" name="VFD_PERF_ACTIVE_CYCLES"/>
+	<value value="6" name="VFD_PERF_STALL_CYCLES_UCHE"/>
+	<value value="7" name="VFD_PERF_STALL_CYCLES_HLSQ"/>
+	<value value="8" name="VFD_PERF_STALL_CYCLES_VPC_BYPASS"/>
+	<value value="9" name="VFD_PERF_STALL_CYCLES_VPC_ALLOC"/>
+</enum>
+
+<enum name="a3xx_vpc_perfcounter_select">
+	<value value="0" name="VPC_PERF_SP_LM_PRIMITIVES"/>
+	<value value="1" name="VPC_PERF_COMPONENTS_FROM_SP"/>
+	<value value="2" name="VPC_PERF_SP_LM_COMPONENTS"/>
+	<value value="3" name="VPC_PERF_ACTIVE_CYCLES"/>
+	<value value="4" name="VPC_PERF_STALL_CYCLES_LM"/>
+	<value value="5" name="VPC_PERF_STALL_CYCLES_RAS"/>
+</enum>
+
+<enum name="a3xx_uche_perfcounter_select">
+	<value value="0x00" name="UCHE_UCHEPERF_VBIF_READ_BEATS_TP"/>
+	<value value="0x01" name="UCHE_UCHEPERF_VBIF_READ_BEATS_VFD"/>
+	<value value="0x02" name="UCHE_UCHEPERF_VBIF_READ_BEATS_HLSQ"/>
+	<value value="0x03" name="UCHE_UCHEPERF_VBIF_READ_BEATS_MARB"/>
+	<value value="0x04" name="UCHE_UCHEPERF_VBIF_READ_BEATS_SP"/>
+	<value value="0x08" name="UCHE_UCHEPERF_READ_REQUESTS_TP"/>
+	<value value="0x09" name="UCHE_UCHEPERF_READ_REQUESTS_VFD"/>
+	<value value="0x0a" name="UCHE_UCHEPERF_READ_REQUESTS_HLSQ"/>
+	<value value="0x0b" name="UCHE_UCHEPERF_READ_REQUESTS_MARB"/>
+	<value value="0x0c" name="UCHE_UCHEPERF_READ_REQUESTS_SP"/>
+	<value value="0x0d" name="UCHE_UCHEPERF_WRITE_REQUESTS_MARB"/>
+	<value value="0x0e" name="UCHE_UCHEPERF_WRITE_REQUESTS_SP"/>
+	<value value="0x0f" name="UCHE_UCHEPERF_TAG_CHECK_FAILS"/>
+	<value value="0x10" name="UCHE_UCHEPERF_EVICTS"/>
+	<value value="0x11" name="UCHE_UCHEPERF_FLUSHES"/>
+	<value value="0x12" name="UCHE_UCHEPERF_VBIF_LATENCY_CYCLES"/>
+	<value value="0x13" name="UCHE_UCHEPERF_VBIF_LATENCY_SAMPLES"/>
+	<value value="0x14" name="UCHE_UCHEPERF_ACTIVE_CYCLES"/>
+</enum>
+
+<enum name="a3xx_intp_mode">
+	<value name="SMOOTH" value="0"/>
+	<value name="FLAT" value="1"/>
+	<value name="ZERO" value="2"/>
+	<value name="ONE" value="3"/>
+</enum>
+
+<enum name="a3xx_repl_mode">
+	<value name="S" value="1"/>
+	<value name="T" value="2"/>
+	<value name="ONE_T" value="3"/>
+</enum>
+
+<domain name="A3XX" width="32">
+	<!-- RBBM registers -->
+	<reg32 offset="0x0000" name="RBBM_HW_VERSION"/>
+	<reg32 offset="0x0001" name="RBBM_HW_RELEASE"/>
+	<reg32 offset="0x0002" name="RBBM_HW_CONFIGURATION"/>
+	<reg32 offset="0x0010" name="RBBM_CLOCK_CTL"/>
+	<reg32 offset="0x0012" name="RBBM_SP_HYST_CNT"/>
+	<reg32 offset="0x0018" name="RBBM_SW_RESET_CMD"/>
+	<reg32 offset="0x0020" name="RBBM_AHB_CTL0"/>
+	<reg32 offset="0x0021" name="RBBM_AHB_CTL1"/>
+	<reg32 offset="0x0022" name="RBBM_AHB_CMD"/>
+	<reg32 offset="0x0027" name="RBBM_AHB_ERROR_STATUS"/>
+	<reg32 offset="0x002e" name="RBBM_GPR0_CTL"/>
+	<reg32 offset="0x0030" name="RBBM_STATUS">
+		<bitfield name="HI_BUSY" pos="0" type="boolean"/>
+		<bitfield name="CP_ME_BUSY" pos="1" type="boolean"/>
+		<bitfield name="CP_PFP_BUSY" pos="2" type="boolean"/>
+		<bitfield name="CP_NRT_BUSY" pos="14" type="boolean"/>
+		<bitfield name="VBIF_BUSY" pos="15" type="boolean"/>
+		<bitfield name="TSE_BUSY" pos="16" type="boolean"/>
+		<bitfield name="RAS_BUSY" pos="17" type="boolean"/>
+		<bitfield name="RB_BUSY" pos="18" type="boolean"/>
+		<bitfield name="PC_DCALL_BUSY" pos="19" type="boolean"/>
+		<bitfield name="PC_VSD_BUSY" pos="20" type="boolean"/>
+		<bitfield name="VFD_BUSY" pos="21" type="boolean"/>
+		<bitfield name="VPC_BUSY" pos="22" type="boolean"/>
+		<bitfield name="UCHE_BUSY" pos="23" type="boolean"/>
+		<bitfield name="SP_BUSY" pos="24" type="boolean"/>
+		<bitfield name="TPL1_BUSY" pos="25" type="boolean"/>
+		<bitfield name="MARB_BUSY" pos="26" type="boolean"/>
+		<bitfield name="VSC_BUSY" pos="27" type="boolean"/>
+		<bitfield name="ARB_BUSY" pos="28" type="boolean"/>
+		<bitfield name="HLSQ_BUSY" pos="29" type="boolean"/>
+		<bitfield name="GPU_BUSY_NOHC" pos="30" type="boolean"/>
+		<bitfield name="GPU_BUSY" pos="31" type="boolean"/>
+	</reg32>
+	<!-- used in fw CP_WAIT_FOR_IDLE, similar to NQWAIT_UNTIL on a2xx: -->
+	<reg32 offset="0x0040" name="RBBM_NQWAIT_UNTIL"/>
+	<reg32 offset="0x0033" name="RBBM_WAIT_IDLE_CLOCKS_CTL"/>
+	<reg32 offset="0x0050" name="RBBM_INTERFACE_HANG_INT_CTL"/>
+	<reg32 offset="0x0051" name="RBBM_INTERFACE_HANG_MASK_CTL0"/>
+	<reg32 offset="0x0054" name="RBBM_INTERFACE_HANG_MASK_CTL1"/>
+	<reg32 offset="0x0057" name="RBBM_INTERFACE_HANG_MASK_CTL2"/>
+	<reg32 offset="0x005a" name="RBBM_INTERFACE_HANG_MASK_CTL3"/>
+
+	<bitset name="A3XX_INT0">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="RBBM_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="RBBM_REG_TIMEOUT" pos="2" type="boolean"/>
+		<bitfield name="RBBM_ME_MS_TIMEOUT" pos="3" type="boolean"/>
+		<bitfield name="RBBM_PFP_MS_TIMEOUT" pos="4" type="boolean"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="5" type="boolean"/>
+		<bitfield name="VFD_ERROR" pos="6" type="boolean"/>
+		<bitfield name="CP_SW_INT" pos="7" type="boolean"/>
+		<bitfield name="CP_T0_PACKET_IN_IB" pos="8" type="boolean"/>
+		<bitfield name="CP_OPCODE_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_RESERVED_BIT_ERROR" pos="10" type="boolean"/>
+		<bitfield name="CP_HW_FAULT" pos="11" type="boolean"/>
+		<bitfield name="CP_DMA" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2_INT" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1_INT" pos="14" type="boolean"/>
+		<bitfield name="CP_RB_INT" pos="15" type="boolean"/>
+		<bitfield name="CP_REG_PROTECT_FAULT" pos="16" type="boolean"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_VS_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="CP_PS_DONE_TS" pos="19" type="boolean"/>
+		<bitfield name="CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR_HALT" pos="21" type="boolean"/>
+		<bitfield name="MISC_HANG_DETECT" pos="24" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="25" type="boolean"/>
+	</bitset>
+
+
+	<!--
+		set in pm4 fw INVALID_JUMP_TABLE_ENTRY and CP_INTERRUPT (compare
+		to CP_INT_STATUS in a2xx firmware), so this seems to be the a3xx
+		way for fw to raise and irq:
+	 -->
+	<reg32 offset="0x0060" name="RBBM_INT_SET_CMD" type="A3XX_INT0"/>
+	<reg32 offset="0x0061" name="RBBM_INT_CLEAR_CMD" type="A3XX_INT0"/>
+	<reg32 offset="0x0063" name="RBBM_INT_0_MASK" type="A3XX_INT0"/>
+	<reg32 offset="0x0064" name="RBBM_INT_0_STATUS" type="A3XX_INT0"/>
+	<reg32 offset="0x0080" name="RBBM_PERFCTR_CTL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0081" name="RBBM_PERFCTR_LOAD_CMD0"/>
+	<reg32 offset="0x0082" name="RBBM_PERFCTR_LOAD_CMD1"/>
+	<reg32 offset="0x0084" name="RBBM_PERFCTR_LOAD_VALUE_LO"/>
+	<reg32 offset="0x0085" name="RBBM_PERFCTR_LOAD_VALUE_HI"/>
+	<reg32 offset="0x0086" name="RBBM_PERFCOUNTER0_SELECT" type="a3xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0087" name="RBBM_PERFCOUNTER1_SELECT" type="a3xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0088" name="RBBM_GPU_BUSY_MASKED"/>
+	<reg32 offset="0x0090" name="RBBM_PERFCTR_CP_0_LO"/>
+	<reg32 offset="0x0091" name="RBBM_PERFCTR_CP_0_HI"/>
+	<reg32 offset="0x0092" name="RBBM_PERFCTR_RBBM_0_LO"/>
+	<reg32 offset="0x0093" name="RBBM_PERFCTR_RBBM_0_HI"/>
+	<reg32 offset="0x0094" name="RBBM_PERFCTR_RBBM_1_LO"/>
+	<reg32 offset="0x0095" name="RBBM_PERFCTR_RBBM_1_HI"/>
+	<reg32 offset="0x0096" name="RBBM_PERFCTR_PC_0_LO"/>
+	<reg32 offset="0x0097" name="RBBM_PERFCTR_PC_0_HI"/>
+	<reg32 offset="0x0098" name="RBBM_PERFCTR_PC_1_LO"/>
+	<reg32 offset="0x0099" name="RBBM_PERFCTR_PC_1_HI"/>
+	<reg32 offset="0x009a" name="RBBM_PERFCTR_PC_2_LO"/>
+	<reg32 offset="0x009b" name="RBBM_PERFCTR_PC_2_HI"/>
+	<reg32 offset="0x009c" name="RBBM_PERFCTR_PC_3_LO"/>
+	<reg32 offset="0x009d" name="RBBM_PERFCTR_PC_3_HI"/>
+	<reg32 offset="0x009e" name="RBBM_PERFCTR_VFD_0_LO"/>
+	<reg32 offset="0x009f" name="RBBM_PERFCTR_VFD_0_HI"/>
+	<reg32 offset="0x00a0" name="RBBM_PERFCTR_VFD_1_LO"/>
+	<reg32 offset="0x00a1" name="RBBM_PERFCTR_VFD_1_HI"/>
+	<reg32 offset="0x00a2" name="RBBM_PERFCTR_HLSQ_0_LO"/>
+	<reg32 offset="0x00a3" name="RBBM_PERFCTR_HLSQ_0_HI"/>
+	<reg32 offset="0x00a4" name="RBBM_PERFCTR_HLSQ_1_LO"/>
+	<reg32 offset="0x00a5" name="RBBM_PERFCTR_HLSQ_1_HI"/>
+	<reg32 offset="0x00a6" name="RBBM_PERFCTR_HLSQ_2_LO"/>
+	<reg32 offset="0x00a7" name="RBBM_PERFCTR_HLSQ_2_HI"/>
+	<reg32 offset="0x00a8" name="RBBM_PERFCTR_HLSQ_3_LO"/>
+	<reg32 offset="0x00a9" name="RBBM_PERFCTR_HLSQ_3_HI"/>
+	<reg32 offset="0x00aa" name="RBBM_PERFCTR_HLSQ_4_LO"/>
+	<reg32 offset="0x00ab" name="RBBM_PERFCTR_HLSQ_4_HI"/>
+	<reg32 offset="0x00ac" name="RBBM_PERFCTR_HLSQ_5_LO"/>
+	<reg32 offset="0x00ad" name="RBBM_PERFCTR_HLSQ_5_HI"/>
+	<reg32 offset="0x00ae" name="RBBM_PERFCTR_VPC_0_LO"/>
+	<reg32 offset="0x00af" name="RBBM_PERFCTR_VPC_0_HI"/>
+	<reg32 offset="0x00b0" name="RBBM_PERFCTR_VPC_1_LO"/>
+	<reg32 offset="0x00b1" name="RBBM_PERFCTR_VPC_1_HI"/>
+	<reg32 offset="0x00b2" name="RBBM_PERFCTR_TSE_0_LO"/>
+	<reg32 offset="0x00b3" name="RBBM_PERFCTR_TSE_0_HI"/>
+	<reg32 offset="0x00b4" name="RBBM_PERFCTR_TSE_1_LO"/>
+	<reg32 offset="0x00b5" name="RBBM_PERFCTR_TSE_1_HI"/>
+	<reg32 offset="0x00b6" name="RBBM_PERFCTR_RAS_0_LO"/>
+	<reg32 offset="0x00b7" name="RBBM_PERFCTR_RAS_0_HI"/>
+	<reg32 offset="0x00b8" name="RBBM_PERFCTR_RAS_1_LO"/>
+	<reg32 offset="0x00b9" name="RBBM_PERFCTR_RAS_1_HI"/>
+	<reg32 offset="0x00ba" name="RBBM_PERFCTR_UCHE_0_LO"/>
+	<reg32 offset="0x00bb" name="RBBM_PERFCTR_UCHE_0_HI"/>
+	<reg32 offset="0x00bc" name="RBBM_PERFCTR_UCHE_1_LO"/>
+	<reg32 offset="0x00bd" name="RBBM_PERFCTR_UCHE_1_HI"/>
+	<reg32 offset="0x00be" name="RBBM_PERFCTR_UCHE_2_LO"/>
+	<reg32 offset="0x00bf" name="RBBM_PERFCTR_UCHE_2_HI"/>
+	<reg32 offset="0x00c0" name="RBBM_PERFCTR_UCHE_3_LO"/>
+	<reg32 offset="0x00c1" name="RBBM_PERFCTR_UCHE_3_HI"/>
+	<reg32 offset="0x00c2" name="RBBM_PERFCTR_UCHE_4_LO"/>
+	<reg32 offset="0x00c3" name="RBBM_PERFCTR_UCHE_4_HI"/>
+	<reg32 offset="0x00c4" name="RBBM_PERFCTR_UCHE_5_LO"/>
+	<reg32 offset="0x00c5" name="RBBM_PERFCTR_UCHE_5_HI"/>
+	<reg32 offset="0x00c6" name="RBBM_PERFCTR_TP_0_LO"/>
+	<reg32 offset="0x00c7" name="RBBM_PERFCTR_TP_0_HI"/>
+	<reg32 offset="0x00c8" name="RBBM_PERFCTR_TP_1_LO"/>
+	<reg32 offset="0x00c9" name="RBBM_PERFCTR_TP_1_HI"/>
+	<reg32 offset="0x00ca" name="RBBM_PERFCTR_TP_2_LO"/>
+	<reg32 offset="0x00cb" name="RBBM_PERFCTR_TP_2_HI"/>
+	<reg32 offset="0x00cc" name="RBBM_PERFCTR_TP_3_LO"/>
+	<reg32 offset="0x00cd" name="RBBM_PERFCTR_TP_3_HI"/>
+	<reg32 offset="0x00ce" name="RBBM_PERFCTR_TP_4_LO"/>
+	<reg32 offset="0x00cf" name="RBBM_PERFCTR_TP_4_HI"/>
+	<reg32 offset="0x00d0" name="RBBM_PERFCTR_TP_5_LO"/>
+	<reg32 offset="0x00d1" name="RBBM_PERFCTR_TP_5_HI"/>
+	<reg32 offset="0x00d2" name="RBBM_PERFCTR_SP_0_LO"/>
+	<reg32 offset="0x00d3" name="RBBM_PERFCTR_SP_0_HI"/>
+	<reg32 offset="0x00d4" name="RBBM_PERFCTR_SP_1_LO"/>
+	<reg32 offset="0x00d5" name="RBBM_PERFCTR_SP_1_HI"/>
+	<reg32 offset="0x00d6" name="RBBM_PERFCTR_SP_2_LO"/>
+	<reg32 offset="0x00d7" name="RBBM_PERFCTR_SP_2_HI"/>
+	<reg32 offset="0x00d8" name="RBBM_PERFCTR_SP_3_LO"/>
+	<reg32 offset="0x00d9" name="RBBM_PERFCTR_SP_3_HI"/>
+	<reg32 offset="0x00da" name="RBBM_PERFCTR_SP_4_LO"/>
+	<reg32 offset="0x00db" name="RBBM_PERFCTR_SP_4_HI"/>
+	<reg32 offset="0x00dc" name="RBBM_PERFCTR_SP_5_LO"/>
+	<reg32 offset="0x00dd" name="RBBM_PERFCTR_SP_5_HI"/>
+	<reg32 offset="0x00de" name="RBBM_PERFCTR_SP_6_LO"/>
+	<reg32 offset="0x00df" name="RBBM_PERFCTR_SP_6_HI"/>
+	<reg32 offset="0x00e0" name="RBBM_PERFCTR_SP_7_LO"/>
+	<reg32 offset="0x00e1" name="RBBM_PERFCTR_SP_7_HI"/>
+	<reg32 offset="0x00e2" name="RBBM_PERFCTR_RB_0_LO"/>
+	<reg32 offset="0x00e3" name="RBBM_PERFCTR_RB_0_HI"/>
+	<reg32 offset="0x00e4" name="RBBM_PERFCTR_RB_1_LO"/>
+	<reg32 offset="0x00e5" name="RBBM_PERFCTR_RB_1_HI"/>
+	<reg32 offset="0x00ea" name="RBBM_PERFCTR_PWR_0_LO"/>
+	<reg32 offset="0x00eb" name="RBBM_PERFCTR_PWR_0_HI"/>
+	<reg32 offset="0x00ec" name="RBBM_PERFCTR_PWR_1_LO"/>
+	<reg32 offset="0x00ed" name="RBBM_PERFCTR_PWR_1_HI"/>
+	<reg32 offset="0x0100" name="RBBM_RBBM_CTL"/>
+	<reg32 offset="0x0111" name="RBBM_DEBUG_BUS_CTL"/>
+	<reg32 offset="0x0112" name="RBBM_DEBUG_BUS_DATA_STATUS"/>
+
+	<!-- CP registers -->
+	<reg32 offset="0x01c9" name="CP_PFP_UCODE_ADDR"/>
+	<reg32 offset="0x01ca" name="CP_PFP_UCODE_DATA"/>
+	<reg32 offset="0x01cc" name="CP_ROQ_ADDR"/>
+	<reg32 offset="0x01cd" name="CP_ROQ_DATA"/>
+	<reg32 offset="0x01d1" name="CP_MERCIU_ADDR"/>
+	<reg32 offset="0x01d2" name="CP_MERCIU_DATA"/>
+	<reg32 offset="0x01d3" name="CP_MERCIU_DATA2"/>
+	<!-- see a3xx_snapshot_cp_meq().. looks like the way to dump queue between pfp and pm4 -->
+	<reg32 offset="0x01da" name="CP_MEQ_ADDR"/>
+	<reg32 offset="0x01db" name="CP_MEQ_DATA"/>
+	<reg32 offset="0x01f5" name="CP_WFI_PEND_CTR"/>
+	<reg32 offset="0x039d" name="RBBM_PM_OVERRIDE2"/>
+
+	<reg32 offset="0x0445" name="CP_PERFCOUNTER_SELECT" type="a3xx_cp_perfcounter_select"/>
+	<reg32 offset="0x045c" name="CP_HW_FAULT"/>
+	<reg32 offset="0x045e" name="CP_PROTECT_CTRL"/>
+	<reg32 offset="0x045f" name="CP_PROTECT_STATUS"/>
+	<array offset="0x0460" name="CP_PROTECT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x054d" name="CP_AHB_FAULT"/>
+
+	<reg32 offset="0x0d00" name="SQ_GPR_MANAGEMENT"/>
+	<reg32 offset="0x0d02" name="SQ_INST_STORE_MANAGMENT"/>
+	<reg32 offset="0x0e1e" name="TP0_CHICKEN"/>
+
+	<!-- these I guess or either SP or HLSQ since related to shader core setup: -->
+	<reg32 offset="0x0e22" name="SP_GLOBAL_MEM_SIZE" type="uint">
+		<doc>
+			The pair of MEM_SIZE/ADDR registers get programmed
+			in sequence with the size/addr of each buffer.
+		</doc>
+	</reg32>
+	<reg32 offset="0x0e23" name="SP_GLOBAL_MEM_ADDR"/>
+
+	<!-- GRAS registers -->
+	<reg32 offset="0x2040" name="GRAS_CL_CLIP_CNTL">
+		<bitfield name="IJ_PERSP_CENTER" pos="12" type="boolean"/>
+		<bitfield name="IJ_NON_PERSP_CENTER" pos="13" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="14" type="boolean"/>
+		<bitfield name="IJ_NON_PERSP_CENTROID" pos="15" type="boolean"/>
+		<bitfield name="CLIP_DISABLE" pos="16" type="boolean"/>
+		<bitfield name="ZFAR_CLIP_DISABLE" pos="17" type="boolean"/>
+		<bitfield name="VP_CLIP_CODE_IGNORE" pos="19" type="boolean"/>
+		<bitfield name="VP_XFORM_DISABLE" pos="20" type="boolean"/>
+		<bitfield name="PERSP_DIVISION_DISABLE" pos="21" type="boolean"/>
+		<bitfield name="ZERO_GB_SCALE_Z" pos="22" type="boolean">
+			<doc>aka clip_halfz</doc>
+		</bitfield>
+		<!-- set when gl_FragCoord.z is enabled in frag shader: -->
+		<bitfield name="ZCOORD" pos="23" type="boolean"/>
+		<bitfield name="WCOORD" pos="24" type="boolean"/>
+		<!-- set when frag shader writes z (so early z test disabled: -->
+		<bitfield name="ZCLIP_DISABLE" pos="25" type="boolean"/>
+		<bitfield name="NUM_USER_CLIP_PLANES" low="26" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2044" name="GRAS_CL_GB_CLIP_ADJ">
+		<bitfield name="HORZ" low="0" high="9" type="uint"/>
+		<bitfield name="VERT" low="10" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2048" name="GRAS_CL_VPORT_XOFFSET" type="float"/>
+	<reg32 offset="0x2049" name="GRAS_CL_VPORT_XSCALE" type="float"/>
+	<reg32 offset="0x204a" name="GRAS_CL_VPORT_YOFFSET" type="float"/>
+	<reg32 offset="0x204b" name="GRAS_CL_VPORT_YSCALE" type="float"/>
+	<reg32 offset="0x204c" name="GRAS_CL_VPORT_ZOFFSET" type="float"/>
+	<reg32 offset="0x204d" name="GRAS_CL_VPORT_ZSCALE" type="float"/>
+	<reg32 offset="0x2068" name="GRAS_SU_POINT_MINMAX">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2069" name="GRAS_SU_POINT_SIZE" type="fixed" radix="4"/>
+	<reg32 offset="0x206c" name="GRAS_SU_POLY_OFFSET_SCALE">
+		<bitfield name="VAL" low="0" high="23" type="fixed" radix="20"/>
+		<doc>range of -8.0 to 8.0</doc>
+	</reg32>
+	<reg32 offset="0x206d" name="GRAS_SU_POLY_OFFSET_OFFSET" radix="6" type="fixed">
+		<doc>range of -512.0 to 512.0</doc>
+	</reg32>
+	<reg32 offset="0x2070" name="GRAS_SU_MODE_CONTROL">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FRONT_CW" pos="2" type="boolean"/>
+		<bitfield name="LINEHALFWIDTH" low="3" high="10" radix="2" type="fixed"/>
+		<bitfield name="POLY_OFFSET" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2072" name="GRAS_SC_CONTROL">
+		<!-- complete wild-ass-guess for sizes of these bitfields.. -->
+		<bitfield name="RENDER_MODE" low="4" high="7" type="a3xx_render_mode"/>
+		<bitfield name="MSAA_SAMPLES" low="8" high="11" type="a3xx_msaa_samples"/>
+		<bitfield name="RASTER_MODE" low="12" high="15"/>
+	</reg32>
+
+	<reg32 offset="0x2074" name="GRAS_SC_SCREEN_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x2075" name="GRAS_SC_SCREEN_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x2079" name="GRAS_SC_WINDOW_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x207a" name="GRAS_SC_WINDOW_SCISSOR_BR" type="adreno_reg_xy"/>
+
+	<!-- RB registers -->
+	<reg32 offset="0x20c0" name="RB_MODE_CONTROL">
+		<!-- guess on the # of bits here.. -->
+		<bitfield name="GMEM_BYPASS" pos="7" type="boolean"/>
+		<doc>
+			RENDER_MODE is RB_RESOLVE_PASS for gmem->mem, otherwise RB_RENDER_PASS
+		</doc>
+		<bitfield name="RENDER_MODE" low="8" high="10" type="a3xx_render_mode"/>
+		<bitfield name="MRT" low="12" high="13" type="uint">
+			<doc>render targets - 1</doc>
+		</bitfield>
+		<bitfield name="MARB_CACHE_SPLIT_MODE" pos="15" type="boolean"/>
+		<bitfield name="PACKER_TIMER_ENABLE" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x20c1" name="RB_RENDER_CONTROL">
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="YUV_IN_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="COV_VALUE_INPUT_ENABLE" pos="2" type="boolean"/>
+		<!-- set when gl_FrontFacing is accessed in frag shader: -->
+		<bitfield name="FACENESS" pos="3" type="boolean"/>
+		<bitfield name="BIN_WIDTH" low="4" high="11" shr="5" type="uint"/>
+		<bitfield name="DISABLE_COLOR_PIPE" pos="12" type="boolean"/>
+		<!--
+			ENABLE_GMEM not set on mem2gmem..  so possibly it is actually
+			controlling blend or readback from GMEM??
+		 -->
+		<bitfield name="ENABLE_GMEM" pos="13" type="boolean"/>
+		<bitfield name="COORD_MASK" low="14" high="17" type="hex"/>
+		<bitfield name="I_CLAMP_ENABLE" pos="19" type="boolean"/>
+		<bitfield name="COV_VALUE_OUTPUT_ENABLE" pos="20" type="boolean"/>
+		<bitfield name="ALPHA_TEST" pos="22" type="boolean"/>
+		<bitfield name="ALPHA_TEST_FUNC" low="24" high="26" type="adreno_compare_func"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="30" type="boolean"/>
+		<bitfield name="ALPHA_TO_ONE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x20c2" name="RB_MSAA_CONTROL">
+		<bitfield name="DISABLE" pos="10" type="boolean"/>
+		<bitfield name="SAMPLES" low="12" high="15" type="a3xx_msaa_samples"/>
+		<bitfield name="SAMPLE_MASK" low="16" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20c3" name="RB_ALPHA_REF">
+		<bitfield name="UINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<array offset="0x20c4" name="RB_MRT" stride="4" length="4">
+		<reg32 offset="0x0" name="CONTROL">
+			<bitfield name="READ_DEST_ENABLE" pos="3" type="boolean"/>
+			<!-- both these bits seem to get set when enabling GL_BLEND.. -->
+			<bitfield name="BLEND" pos="4" type="boolean"/>
+			<bitfield name="BLEND2" pos="5" type="boolean"/>
+			<bitfield name="ROP_CODE" low="8" high="11" type="a3xx_rop_code"/>
+			<bitfield name="DITHER_MODE" low="12" high="13" type="adreno_rb_dither_mode"/>
+			<bitfield name="COMPONENT_ENABLE" low="24" high="27" type="hex"/>
+		</reg32>
+		<reg32 offset="0x1" name="BUF_INFO">
+			<bitfield name="COLOR_FORMAT" low="0" high="5" type="a3xx_color_fmt"/>
+			<bitfield name="COLOR_TILE_MODE" low="6" high="7" type="a3xx_tile_mode"/>
+			<bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+			<bitfield name="COLOR_SRGB" pos="14" type="boolean"/>
+			<doc>
+				Pitch (actually, appears to be pitch in bytes, so really is a stride)
+				in GMEM, so pitch of the current tile.
+			</doc>
+			<bitfield name="COLOR_BUF_PITCH" low="17" high="31" shr="5" type="uint"/>
+		</reg32>
+		<reg32 offset="0x2" name="BUF_BASE">
+			<doc>offset into GMEM (or system memory address in bypass mode)</doc>
+			<bitfield name="COLOR_BUF_BASE" low="4" high="31" shr="5" type="hex"/>
+		</reg32>
+		<reg32 offset="0x3" name="BLEND_CONTROL">
+			<bitfield name="RGB_SRC_FACTOR" low="0" high="4" type="adreno_rb_blend_factor"/>
+			<bitfield name="RGB_BLEND_OPCODE" low="5" high="7" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="RGB_DEST_FACTOR" low="8" high="12" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_SRC_FACTOR" low="16" high="20" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_BLEND_OPCODE" low="21" high="23" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="ALPHA_DEST_FACTOR" low="24" high="28" type="adreno_rb_blend_factor"/>
+			<bitfield name="CLAMP_ENABLE" pos="29" type="boolean"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0x20e4" name="RB_BLEND_RED">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20e5" name="RB_BLEND_GREEN">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20e6" name="RB_BLEND_BLUE">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20e7" name="RB_BLEND_ALPHA">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+
+	<reg32 offset="0x20e8" name="RB_CLEAR_COLOR_DW0"/>
+	<reg32 offset="0x20e9" name="RB_CLEAR_COLOR_DW1"/>
+	<reg32 offset="0x20ea" name="RB_CLEAR_COLOR_DW2"/>
+	<reg32 offset="0x20eb" name="RB_CLEAR_COLOR_DW3"/>
+	<reg32 offset="0x20ec" name="RB_COPY_CONTROL">
+		<!-- not sure # of bits -->
+		<bitfield name="MSAA_RESOLVE" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="DEPTHCLEAR" pos="3" type="boolean"/>
+		<bitfield name="MODE" low="4" high="6" type="adreno_rb_copy_control_mode"/>
+		<bitfield name="MSAA_SRGB_DOWNSAMPLE" pos="7" type="boolean"/>
+		<bitfield name="FASTCLEAR" low="8" high="11" type="hex"/>
+		<bitfield name="DEPTH32_RESOLVE" pos="12" type="boolean"/> <!-- enabled on a Z32F copy -->
+		<bitfield name="GMEM_BASE" low="14" high="31" shr="14" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20ed" name="RB_COPY_DEST_BASE">
+		<bitfield name="BASE" low="4" high="31" shr="5" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20ee" name="RB_COPY_DEST_PITCH">
+		<doc>actually, appears to be pitch in bytes, so really is a stride</doc>
+		<!-- not actually sure about max pitch... -->
+		<bitfield name="PITCH" low="0" high="31" shr="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0x20ef" name="RB_COPY_DEST_INFO">
+		<bitfield name="TILE" low="0" high="1" type="a3xx_tile_mode"/>
+		<bitfield name="FORMAT" low="2" high="7" type="a3xx_color_fmt"/>
+		<bitfield name="SWAP" low="8" high="9" type="a3xx_color_swap"/>
+		<bitfield name="DITHER_MODE" low="10" high="11" type="adreno_rb_dither_mode"/>
+		<bitfield name="COMPONENT_ENABLE" low="14" high="17" type="hex"/>
+		<bitfield name="ENDIAN" low="18" high="20" type="adreno_rb_surface_endian"/>
+	</reg32>
+	<reg32 offset="0x2100" name="RB_DEPTH_CONTROL">
+		<!--
+			guessing that this matches a2xx with the stencil fields
+			moved out into RB_STENCIL_CONTROL?
+		 -->
+		<bitfield name="FRAG_WRITES_Z" pos="0" type="boolean"/>
+		<bitfield name="Z_TEST_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="EARLY_Z_DISABLE" pos="3" type="boolean"/>
+		<bitfield name="ZFUNC" low="4" high="6" type="adreno_compare_func"/>
+		<bitfield name="Z_CLAMP_ENABLE" pos="7" type="boolean"/>
+		<doc>Z_READ_ENABLE bit is set for zfunc other than GL_ALWAYS or GL_NEVER</doc>
+		<bitfield name="Z_READ_ENABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2101" name="RB_DEPTH_CLEAR">
+		<doc>seems to be always set to 0x00000000</doc>
+	</reg32>
+	<reg32 offset="0x2102" name="RB_DEPTH_INFO">
+		<bitfield name="DEPTH_FORMAT" low="0" high="1" type="adreno_rb_depth_format"/>
+		<doc>
+			DEPTH_BASE is offset in GMEM to depth/stencil buffer, ie
+			bin_w * bin_h / 1024 (possible rounded up to multiple of
+			something??  ie. 39 becomes 40, 78 becomes 80.. 75 becomes
+			80.. so maybe it needs to be multiple of 8??
+		</doc>
+		<bitfield name="DEPTH_BASE" low="11" high="31" shr="12" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2103" name="RB_DEPTH_PITCH" shr="3" type="uint">
+		<doc>
+			Pitch of depth buffer or combined depth+stencil buffer
+			in z24s8 cases.
+		</doc>
+	</reg32>
+	<reg32 offset="0x2104" name="RB_STENCIL_CONTROL">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="STENCIL_ENABLE_BF" pos="1" type="boolean"/>
+		<!--
+			set for stencil operations that require read from stencil
+			buffer, but not for example for stencil clear (which does
+			not require read).. so guessing this is analogous to
+			READ_DEST_ENABLE for color buffer..
+		 -->
+		<bitfield name="STENCIL_READ" pos="2" type="boolean"/>
+		<bitfield name="FUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="FAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="FUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="FAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0x2105" name="RB_STENCIL_CLEAR">
+		<doc>seems to be always set to 0x00000000</doc>
+	</reg32>
+	<reg32 offset="0x2106" name="RB_STENCIL_INFO">
+		<doc>Base address for stencil when not using interleaved depth/stencil</doc>
+		<bitfield name="STENCIL_BASE" low="11" high="31" shr="12" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2107" name="RB_STENCIL_PITCH" shr="3" type="uint">
+		<doc>pitch of stencil buffer when not using interleaved depth/stencil</doc>
+	</reg32>
+	<reg32 offset="0x2108" name="RB_STENCILREFMASK" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x2109" name="RB_STENCILREFMASK_BF" type="adreno_rb_stencilrefmask"/>
+	<!-- VSC == visibility stream c?? -->
+	<reg32 offset="0x210c" name="RB_LRZ_VSC_CONTROL">
+		<doc>seems to be set to 0x00000002 during binning pass</doc>
+		<bitfield name="BINNING_ENABLE" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x210e" name="RB_WINDOW_OFFSET">
+		<doc>X/Y offset of current bin</doc>
+		<bitfield name="X" low="0" high="15" type="uint"/>
+		<bitfield name="Y" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2110" name="RB_SAMPLE_COUNT_CONTROL">
+		<bitfield name="RESET" pos="0" type="boolean"/>
+		<bitfield name="COPY" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2111" name="RB_SAMPLE_COUNT_ADDR"/>
+	<reg32 offset="0x2114" name="RB_Z_CLAMP_MIN"/>
+	<reg32 offset="0x2115" name="RB_Z_CLAMP_MAX"/>
+
+	<!-- PC registers -->
+	<reg32 offset="0x21e1" name="VGT_BIN_BASE">
+		<doc>
+			seems to be where firmware writes BIN_DATA_ADDR from
+			CP_SET_BIN_DATA packet..  probably should be called
+			PC_BIN_BASE (just using name from yamato for now)
+		</doc>
+	</reg32>
+	<reg32 offset="0x21e2" name="VGT_BIN_SIZE">
+		<doc>probably should be PC_BIN_SIZE</doc>
+	</reg32>
+	<reg32 offset="0x21e4" name="PC_VSTREAM_CONTROL">
+		<doc>SIZE is current pipe width * height (in tiles)</doc>
+		<bitfield name="SIZE" low="16" high="21" type="uint"/>
+		<doc>
+			N is some sort of slot # between 0..(SIZE-1).  In case
+			multiple tiles use same pipe, each tile gets unique slot #
+		</doc>
+		<bitfield name="N" low="22" high="26" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21ea" name="PC_VERTEX_REUSE_BLOCK_CNTL"/>
+	<reg32 offset="0x21ec" name="PC_PRIM_VTX_CNTL">
+		<doc>
+			STRIDE_IN_VPC: ALIGN(next_outloc - 8, 4) / 4
+			(but, in cases where you'd expect 1, the blob driver uses
+			2, so possibly 0 (no varying) or minimum of 2)
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="4" type="uint"/>
+		<bitfield name="POLYMODE_FRONT_PTYPE" low="5" high="7" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_BACK_PTYPE" low="8" high="10" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_ENABLE" pos="12" type="boolean"/>
+		<bitfield name="PRIMITIVE_RESTART" pos="20" type="boolean"/>
+		<bitfield name="PROVOKING_VTX_LAST" pos="25" type="boolean"/>
+		<!-- PSIZE bit set if gl_PointSize written: -->
+		<bitfield name="PSIZE" pos="26" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x21ed" name="PC_RESTART_INDEX"/>
+
+	<!-- HLSQ registers -->
+	<bitset name="a3xx_hlsq_vs_fs_control_reg" inline="yes">
+		<bitfield name="CONSTLENGTH" low="0" high="9" type="uint"/>
+		<bitfield name="CONSTSTARTOFFSET" low="12" high="20" type="uint"/>
+		<bitfield name="INSTRLENGTH" low="24" high="31" type="uint"/>
+	</bitset>
+	<bitset name="a3xx_hlsq_const_vs_fs_presv_range_reg" inline="yes">
+		<!-- are these a3xx_regid?? -->
+		<bitfield name="STARTENTRY" low="0" high="8"/>
+		<bitfield name="ENDENTRY" low="16" high="24"/>
+	</bitset>
+
+	<reg32 offset="0x2200" name="HLSQ_CONTROL_0_REG">
+		<bitfield name="FSTHREADSIZE" low="4" high="5" type="a3xx_threadsize"/>
+		<bitfield name="FSSUPERTHREADENABLE" pos="6" type="boolean"/>
+		<bitfield name="COMPUTEMODE" pos="8" type="boolean"/>
+		<bitfield name="SPSHADERRESTART" pos="9" type="boolean"/>
+		<bitfield name="RESERVED2" pos="10" type="boolean"/>
+		<bitfield name="CYCLETIMEOUTLIMITVPC" low="12" high="23" type="uint"/>
+		<bitfield name="FSONLYTEX" pos="25" type="boolean"/>
+		<bitfield name="CHUNKDISABLE" pos="26" type="boolean"/>
+		<bitfield name="CONSTMODE" pos="27" type="uint"/>
+		<bitfield name="LAZYUPDATEDISABLE" pos="28" type="boolean"/>
+		<bitfield name="SPCONSTFULLUPDATE" pos="29" type="boolean"/>
+		<bitfield name="TPFULLUPDATE" pos="30" type="boolean"/>
+		<bitfield name="SINGLECONTEXT" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2201" name="HLSQ_CONTROL_1_REG">
+		<bitfield name="VSTHREADSIZE" low="6" high="7" type="a3xx_threadsize"/>
+		<bitfield name="VSSUPERTHREADENABLE" pos="8" type="boolean"/>
+		<bitfield name="FRAGCOORDXYREGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="FRAGCOORDZWREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2202" name="HLSQ_CONTROL_2_REG">
+		<bitfield name="FACENESSREGID" low="2" high="9" type="a3xx_regid"/>
+		<bitfield name="COVVALUEREGID" low="18" high="25" type="a3xx_regid"/>
+		<bitfield name="PRIMALLOCTHRESHOLD" low="26" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2203" name="HLSQ_CONTROL_3_REG">
+		<bitfield name="IJPERSPCENTERREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJNONPERSPCENTERREGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="IJPERSPCENTROIDREGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="IJNONPERSPCENTROIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2204" name="HLSQ_VS_CONTROL_REG" type="a3xx_hlsq_vs_fs_control_reg"/>
+	<reg32 offset="0x2205" name="HLSQ_FS_CONTROL_REG" type="a3xx_hlsq_vs_fs_control_reg"/>
+	<reg32 offset="0x2206" name="HLSQ_CONST_VSPRESV_RANGE_REG" type="a3xx_hlsq_const_vs_fs_presv_range_reg"/>
+	<reg32 offset="0x2207" name="HLSQ_CONST_FSPRESV_RANGE_REG" type="a3xx_hlsq_const_vs_fs_presv_range_reg"/>
+	<reg32 offset="0x220a" name="HLSQ_CL_NDRANGE_0_REG">
+		<bitfield name="WORKDIM" low="0" high="1" type="uint"/>
+		<bitfield name="LOCALSIZE0" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZE1" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZE2" low="22" high="31" type="uint"/>
+	</reg32>
+	<array offset="0x220b" name="HLSQ_CL_GLOBAL_WORK" stride="2" length="3">
+		<doc>indexed by dimension</doc>
+		<reg32 offset="0" name="SIZE" type="uint"/>
+		<reg32 offset="1" name="OFFSET" type="uint"/>
+	</array>
+	<reg32 offset="0x2211" name="HLSQ_CL_CONTROL_0_REG"/>
+	<reg32 offset="0x2212" name="HLSQ_CL_CONTROL_1_REG"/>
+	<reg32 offset="0x2214" name="HLSQ_CL_KERNEL_CONST_REG"/>
+	<array offset="0x2215" name="HLSQ_CL_KERNEL_GROUP" stride="1" length="3">
+		<doc>indexed by dimension, global_size / local_size</doc>
+		<reg32 offset="0" name="RATIO" type="uint"/>
+	</array>
+	<reg32 offset="0x2216" name="HLSQ_CL_KERNEL_GROUP_Y_REG" type="uint"/>
+	<reg32 offset="0x2217" name="HLSQ_CL_KERNEL_GROUP_Z_REG" type="uint"/>
+	<reg32 offset="0x221a" name="HLSQ_CL_WG_OFFSET_REG"/>
+
+	<!-- VFD registers -->
+	<reg32 offset="0x2240" name="VFD_CONTROL_0">
+		<doc>
+			TOTALATTRTOVS is # of attributes to vertex shader, in register
+			slots (ie. vec4+vec3 -> 7)
+		</doc>
+		<bitfield name="TOTALATTRTOVS" low="0" high="17" type="uint"/>
+		<bitfield name="PACKETSIZE" low="18" high="21" type="uint"/>
+		<doc>STRMDECINSTRCNT is # of VFD_DECODE_INSTR registers valid</doc>
+		<bitfield name="STRMDECINSTRCNT" low="22" high="26" type="uint"/>
+		<doc>STRMFETCHINSTRCNT is # of VFD_FETCH_INSTR registers valid</doc>
+		<bitfield name="STRMFETCHINSTRCNT" low="27" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2241" name="VFD_CONTROL_1">
+		<doc>MAXSTORAGE could be # of attributes/vbo's</doc>
+		<bitfield name="MAXSTORAGE" low="0" high="3" type="uint"/>
+		<bitfield name="MAXTHRESHOLD" low="4" high="7" type="uint"/>
+		<bitfield name="MINTHRESHOLD" low="8" high="11" type="uint"/>
+		<bitfield name="REGID4VTX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID4INST" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2242" name="VFD_INDEX_MIN" type="uint"/>
+	<reg32 offset="0x2243" name="VFD_INDEX_MAX" type="uint"/>
+	<reg32 offset="0x2244" name="VFD_INSTANCEID_OFFSET" type="uint"/>
+	<reg32 offset="0x2245" name="VFD_INDEX_OFFSET" type="uint"/>
+	<array offset="0x2246" name="VFD_FETCH" stride="2" length="16">
+		<reg32 offset="0x0" name="INSTR_0">
+			<bitfield name="FETCHSIZE" low="0" high="6" type="uint"/>
+			<bitfield name="BUFSTRIDE" low="7" high="15" type="uint"/>
+			<bitfield name="INSTANCED" pos="16" type="boolean"/>
+			<bitfield name="SWITCHNEXT" pos="17" type="boolean"/>
+			<bitfield name="INDEXCODE" low="18" high="23" type="uint"/>
+			<bitfield name="STEPRATE" low="24" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x1" name="INSTR_1"/>
+	</array>
+	<array offset="0x2266" name="VFD_DECODE" stride="1" length="16">
+		<reg32 offset="0x0" name="INSTR">
+			<bitfield name="WRITEMASK" low="0" high="3" type="hex"/>
+			<!-- not sure if this is a bit flag and another flag above it, or?? -->
+			<bitfield name="CONSTFILL" pos="4" type="boolean"/>
+			<bitfield name="FORMAT" low="6" high="11" type="a3xx_vtx_fmt"/>
+			<bitfield name="REGID" low="12" high="19" type="a3xx_regid"/>
+			<bitfield name="INT" pos="20" type="boolean"/>
+			<doc>SHIFTCNT appears to be size, ie. FLOAT_32_32_32 is 12, and BYTE_8 is 1</doc>
+			<bitfield name="SWAP" low="22" high="23" type="a3xx_color_swap"/>
+			<bitfield name="SHIFTCNT" low="24" high="28" type="uint"/>
+			<bitfield name="LASTCOMPVALID" pos="29" type="boolean"/>
+			<bitfield name="SWITCHNEXT" pos="30" type="boolean"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x227e" name="VFD_VS_THREADING_THRESHOLD">
+		<bitfield name="REGID_THRESHOLD" low="0" high="3" type="uint"/>
+		<!-- <bitfield name="RESERVED6" low="4" high="7" type="uint"/> -->
+		<bitfield name="REGID_VTXCNT" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+
+	<!-- VPC registers -->
+	<reg32 offset="0x2280" name="VPC_ATTR">
+		<bitfield name="TOTALATTR" low="0" high="8" type="uint"/>
+		<!-- PSIZE bit set if gl_PointSize written: -->
+		<bitfield name="PSIZE" pos="9" type="boolean"/>
+		<bitfield name="THRDASSIGN" low="12" high="27" type="uint"/>
+		<bitfield name="LMSIZE" low="28" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2281" name="VPC_PACK">
+		<!-- these are always seem to be set to same as TOTALATTR -->
+		<bitfield name="NUMFPNONPOSVAR" low="8" high="15" type="uint"/>
+		<bitfield name="NUMNONPOSVSVAR" low="16" high="23" type="uint"/>
+	</reg32>
+	<!--
+		varying interpolate mode.  One field per scalar/component
+		(since varying slots are scalar, so things don't have to
+		be aligned to vec4).
+		4 regs * 16 scalar components each => 16 vec4
+	 -->
+	<array offset="0x2282" name="VPC_VARYING_INTERP" stride="1" length="4">
+		<reg32 offset="0x0" name="MODE">
+			<bitfield name="C0" low="0"  high="1"  type="a3xx_intp_mode"/>
+			<bitfield name="C1" low="2"  high="3"  type="a3xx_intp_mode"/>
+			<bitfield name="C2" low="4"  high="5"  type="a3xx_intp_mode"/>
+			<bitfield name="C3" low="6"  high="7"  type="a3xx_intp_mode"/>
+			<bitfield name="C4" low="8"  high="9"  type="a3xx_intp_mode"/>
+			<bitfield name="C5" low="10" high="11" type="a3xx_intp_mode"/>
+			<bitfield name="C6" low="12" high="13" type="a3xx_intp_mode"/>
+			<bitfield name="C7" low="14" high="15" type="a3xx_intp_mode"/>
+			<bitfield name="C8" low="16" high="17" type="a3xx_intp_mode"/>
+			<bitfield name="C9" low="18" high="19" type="a3xx_intp_mode"/>
+			<bitfield name="CA" low="20" high="21" type="a3xx_intp_mode"/>
+			<bitfield name="CB" low="22" high="23" type="a3xx_intp_mode"/>
+			<bitfield name="CC" low="24" high="25" type="a3xx_intp_mode"/>
+			<bitfield name="CD" low="26" high="27" type="a3xx_intp_mode"/>
+			<bitfield name="CE" low="28" high="29" type="a3xx_intp_mode"/>
+			<bitfield name="CF" low="30" high="31" type="a3xx_intp_mode"/>
+		</reg32>
+	</array>
+	<array offset="0x2286" name="VPC_VARYING_PS_REPL" stride="1" length="4">
+		<reg32 offset="0x0" name="MODE">
+			<bitfield name="C0" low="0"  high="1"  type="a3xx_repl_mode"/>
+			<bitfield name="C1" low="2"  high="3"  type="a3xx_repl_mode"/>
+			<bitfield name="C2" low="4"  high="5"  type="a3xx_repl_mode"/>
+			<bitfield name="C3" low="6"  high="7"  type="a3xx_repl_mode"/>
+			<bitfield name="C4" low="8"  high="9"  type="a3xx_repl_mode"/>
+			<bitfield name="C5" low="10" high="11" type="a3xx_repl_mode"/>
+			<bitfield name="C6" low="12" high="13" type="a3xx_repl_mode"/>
+			<bitfield name="C7" low="14" high="15" type="a3xx_repl_mode"/>
+			<bitfield name="C8" low="16" high="17" type="a3xx_repl_mode"/>
+			<bitfield name="C9" low="18" high="19" type="a3xx_repl_mode"/>
+			<bitfield name="CA" low="20" high="21" type="a3xx_repl_mode"/>
+			<bitfield name="CB" low="22" high="23" type="a3xx_repl_mode"/>
+			<bitfield name="CC" low="24" high="25" type="a3xx_repl_mode"/>
+			<bitfield name="CD" low="26" high="27" type="a3xx_repl_mode"/>
+			<bitfield name="CE" low="28" high="29" type="a3xx_repl_mode"/>
+			<bitfield name="CF" low="30" high="31" type="a3xx_repl_mode"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x228a" name="VPC_VARY_CYLWRAP_ENABLE_0"/>
+	<reg32 offset="0x228b" name="VPC_VARY_CYLWRAP_ENABLE_1"/>
+
+	<!-- SP registers -->
+	<bitset name="a3xx_vs_fs_length_reg" inline="yes">
+		<bitfield name="SHADERLENGTH" low="0" high="31" type="uint"/>
+	</bitset>
+
+	<bitset name="sp_vs_fs_obj_offset_reg" inline="yes">
+		<bitfield name="FIRSTEXECINSTROFFSET" low="0" high="15" type="uint"/>
+		<doc>
+			From register spec:
+			SP_FS_OBJ_OFFSET_REG.CONSTOBJECTSTARTOFFSET [16:24]: Constant object
+			start offset in on chip RAM,
+			128bit aligned
+		</doc>
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x22c0" name="SP_SP_CTRL_REG">
+		<!-- this bit is set during resolve pass: -->
+		<bitfield name="RESOLVE" pos="16" type="boolean"/>
+		<bitfield name="CONSTMODE" pos="18" type="uint"/>
+		<bitfield name="BINNING" pos="19" type="boolean"/>
+		<bitfield name="SLEEPMODE" low="20" high="21" type="uint"/>
+		<!-- L0MODE==1 when oxiliForceSpL0ModeBuffer=1 -->
+		<bitfield name="L0MODE" low="22" high="23" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22c4" name="SP_VS_CTRL_REG0">
+		<bitfield name="THREADMODE" pos="0" type="a3xx_threadmode"/>
+		<bitfield name="INSTRBUFFERMODE" pos="1" type="a3xx_instrbuffermode"/>
+		<!-- maybe CACHEINVALID is two bits?? -->
+		<bitfield name="CACHEINVALID" pos="2" type="boolean"/>
+		<bitfield name="ALUSCHMODE" pos="3" type="boolean"/>
+		<doc>
+			The full/half register footprint is in units of four components,
+			so if r0.x is used, that counts as all of r0.[xyzw] as used.
+			There are separate full/half register footprint values as the
+			full and half registers are independent (not overlapping).
+			Presumably the thread scheduler hardware allocates the full/half
+			register names from the actual physical register file and
+			handles the register renaming.
+		</doc>
+		<bitfield name="HALFREGFOOTPRINT" low="4" high="9" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="10" high="15" type="uint"/>
+		<bitfield name="THREADSIZE" pos="20" type="a3xx_threadsize"/>
+		<bitfield name="SUPERTHREADMODE" pos="21" type="boolean"/>
+		<doc>
+			From regspec:
+			SP_FS_CTRL_REG0.FS_LENGTH [31:24]: FS length, unit = 256bits.
+			If bit31 is 1, it means overflow
+			or any long shader.
+		</doc>
+		<bitfield name="LENGTH" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22c5" name="SP_VS_CTRL_REG1">
+		<bitfield name="CONSTLENGTH" low="0" high="9" type="uint"/>
+		<!--
+			not sure about full vs half const.. I can't get blob generate
+			something with a mediump/lowp uniform.
+		 -->
+		<bitfield name="CONSTFOOTPRINT" low="10" high="19" type="uint"/>
+		<bitfield name="INITIALOUTSTANDING" low="24" high="30" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22c6" name="SP_VS_PARAM_REG">
+		<bitfield name="POSREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="PSIZEREGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="POS2DMODE" pos="16" type="boolean"/>
+		<bitfield name="TOTALVSOUTVAR" low="20" high="24" type="uint"/>
+	</reg32>
+	<array offset="0x22c7" name="SP_VS_OUT" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_HALF" pos="8" type="boolean"/>
+			<bitfield name="A_COMPMASK" low="9" high="12" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_HALF" pos="24" type="boolean"/>
+			<bitfield name="B_COMPMASK" low="25" high="28" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0x22d0" name="SP_VS_VPC_DST" stride="1" length="4">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				These seem to be offsets for storage of the varyings.
+				Always seems to start from 8, possibly loc 0 and 4
+				are for gl_Position and gl_PointSize?
+			</doc>
+			<bitfield name="OUTLOC0" low="0" high="6" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="14" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="22" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="30" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x22d4" name="SP_VS_OBJ_OFFSET_REG" type="sp_vs_fs_obj_offset_reg"/>
+	<doc>
+		SP_VS_OBJ_START_REG contains pointer to the vertex shader program,
+		immediately followed by the binning shader program (although I
+		guess that is probably just re-using the same gpu buffer)
+	</doc>
+	<reg32 offset="0x22d5" name="SP_VS_OBJ_START_REG"/>
+	<reg32 offset="0x22d6" name="SP_VS_PVT_MEM_PARAM_REG">
+		<bitfield name="MEMSIZEPERITEM" low="0" high="7" shr="7">
+			<doc>The size of memory that ldp/stp can address, in 128 byte increments.</doc>
+		</bitfield>
+		<bitfield name="HWSTACKOFFSET" low="8" high="23" type="uint"/>
+		<bitfield name="HWSTACKSIZEPERTHREAD" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22d7" name="SP_VS_PVT_MEM_ADDR_REG">
+		<bitfield name="BURSTLEN" low="0" high="4"/>
+		<bitfield name="SHADERSTARTADDRESS" shr="5" low="5" high="31"/>
+	</reg32>
+	<reg32 offset="0x22d8" name="SP_VS_PVT_MEM_SIZE_REG"/>
+	<reg32 offset="0x22df" name="SP_VS_LENGTH_REG" type="a3xx_vs_fs_length_reg"/>
+	<reg32 offset="0x22e0" name="SP_FS_CTRL_REG0">
+		<bitfield name="THREADMODE" pos="0" type="a3xx_threadmode"/>
+		<bitfield name="INSTRBUFFERMODE" pos="1" type="a3xx_instrbuffermode"/>
+		<!-- maybe CACHEINVALID is two bits?? -->
+		<bitfield name="CACHEINVALID" pos="2" type="boolean"/>
+		<bitfield name="ALUSCHMODE" pos="3" type="boolean"/>
+		<doc>
+			The full/half register footprint is in units of four components,
+			so if r0.x is used, that counts as all of r0.[xyzw] as used.
+			There are separate full/half register footprint values as the
+			full and half registers are independent (not overlapping).
+			Presumably the thread scheduler hardware allocates the full/half
+			register names from the actual physical register file and
+			handles the register renaming.
+		</doc>
+		<bitfield name="HALFREGFOOTPRINT" low="4" high="9" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="10" high="15" type="uint"/>
+		<bitfield name="FSBYPASSENABLE" pos="17" type="boolean"/>
+		<bitfield name="INOUTREGOVERLAP" pos="18" type="boolean"/>
+		<bitfield name="OUTORDERED" pos="19" type="boolean"/>
+		<bitfield name="THREADSIZE" pos="20" type="a3xx_threadsize"/>
+		<bitfield name="SUPERTHREADMODE" pos="21" type="boolean"/>
+		<bitfield name="PIXLODENABLE" pos="22" type="boolean"/>
+		<bitfield name="COMPUTEMODE" pos="23" type="boolean"/>
+		<doc>
+			From regspec:
+			SP_FS_CTRL_REG0.FS_LENGTH [31:24]: FS length, unit = 256bits.
+			If bit31 is 1, it means overflow
+			or any long shader.
+		</doc>
+		<bitfield name="LENGTH" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22e1" name="SP_FS_CTRL_REG1">
+		<bitfield name="CONSTLENGTH" low="0" high="9" type="uint"/>
+		<bitfield name="CONSTFOOTPRINT" low="10" high="19" type="uint"/>
+		<bitfield name="INITIALOUTSTANDING" low="20" high="23" type="uint"/>
+		<bitfield name="HALFPRECVAROFFSET" low="24" high="30" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22e2" name="SP_FS_OBJ_OFFSET_REG" type="sp_vs_fs_obj_offset_reg"/>
+	<doc>SP_FS_OBJ_START_REG contains pointer to fragment shader program</doc>
+	<reg32 offset="0x22e3" name="SP_FS_OBJ_START_REG"/>
+	<reg32 offset="0x22e4" name="SP_FS_PVT_MEM_PARAM_REG">
+		<bitfield name="MEMSIZEPERITEM" low="0" high="7" type="uint"/>
+		<bitfield name="HWSTACKOFFSET" low="8" high="23" type="uint"/>
+		<bitfield name="HWSTACKSIZEPERTHREAD" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22e5" name="SP_FS_PVT_MEM_ADDR_REG">
+		<bitfield name="BURSTLEN" low="0" high="4"/>
+		<bitfield name="SHADERSTARTADDRESS" shr="5" low="5" high="31"/>
+	</reg32>
+	<reg32 offset="0x22e6" name="SP_FS_PVT_MEM_SIZE_REG"/>
+	<reg32 offset="0x22e8" name="SP_FS_FLAT_SHAD_MODE_REG_0">
+		<doc>seems to be one bit per scalar, '1' for flat, '0' for smooth</doc>
+	</reg32>
+	<reg32 offset="0x22e9" name="SP_FS_FLAT_SHAD_MODE_REG_1">
+		<doc>seems to be one bit per scalar, '1' for flat, '0' for smooth</doc>
+	</reg32>
+	<reg32 offset="0x22ec" name="SP_FS_OUTPUT_REG">
+		<bitfield name="MRT" low="0" high="1" type="uint">
+			<doc>render targets - 1</doc>
+		</bitfield>
+		<bitfield name="DEPTH_ENABLE" pos="7" type="boolean"/>
+		<bitfield name="DEPTH_REGID" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+	<array offset="0x22f0" name="SP_FS_MRT" stride="1" length="4">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="HALF_PRECISION" pos="8" type="boolean"/>
+			<bitfield name="SINT" pos="10" type="boolean"/>
+			<bitfield name="UINT" pos="11" type="boolean"/>
+		</reg32>
+	</array>
+	<array offset="0x22f4" name="SP_FS_IMAGE_OUTPUT" stride="1" length="4">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="MRTFORMAT" low="0" high="5" type="a3xx_color_fmt"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x22ff" name="SP_FS_LENGTH_REG" type="a3xx_vs_fs_length_reg"/>
+
+	<reg32 offset="0x2301" name="PA_SC_AA_CONFIG"/>
+	<!-- TPL1 registers -->
+	<!-- assume VS/FS_TEX_OFFSET is same -->
+	<bitset name="a3xx_tpl1_tp_vs_fs_tex_offset" inline="yes">
+		<bitfield name="SAMPLEROFFSET" low="0" high="7" type="uint"/>
+		<bitfield name="MEMOBJOFFSET" low="8" high="15" type="uint"/>
+		<!-- not sure the size of this: -->
+		<bitfield name="BASETABLEPTR" low="16" high="31" type="uint"/>
+	</bitset>
+	<reg32 offset="0x2340" name="TPL1_TP_VS_TEX_OFFSET" type="a3xx_tpl1_tp_vs_fs_tex_offset"/>
+	<reg32 offset="0x2341" name="TPL1_TP_VS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x2342" name="TPL1_TP_FS_TEX_OFFSET" type="a3xx_tpl1_tp_vs_fs_tex_offset"/>
+	<reg32 offset="0x2343" name="TPL1_TP_FS_BORDER_COLOR_BASE_ADDR"/>
+
+	<!-- VBIF registers -->
+	<reg32 offset="0x3001" name="VBIF_CLKON"/>
+	<reg32 offset="0x300c" name="VBIF_FIXED_SORT_EN"/>
+	<reg32 offset="0x300d" name="VBIF_FIXED_SORT_SEL0"/>
+	<reg32 offset="0x300e" name="VBIF_FIXED_SORT_SEL1"/>
+	<reg32 offset="0x301c" name="VBIF_ABIT_SORT"/>
+	<reg32 offset="0x301d" name="VBIF_ABIT_SORT_CONF"/>
+	<reg32 offset="0x302a" name="VBIF_GATE_OFF_WRREQ_EN"/>
+	<reg32 offset="0x302c" name="VBIF_IN_RD_LIM_CONF0"/>
+	<reg32 offset="0x302d" name="VBIF_IN_RD_LIM_CONF1"/>
+	<reg32 offset="0x3030" name="VBIF_IN_WR_LIM_CONF0"/>
+	<reg32 offset="0x3031" name="VBIF_IN_WR_LIM_CONF1"/>
+	<reg32 offset="0x3034" name="VBIF_OUT_RD_LIM_CONF0"/>
+	<reg32 offset="0x3035" name="VBIF_OUT_WR_LIM_CONF0"/>
+	<reg32 offset="0x3036" name="VBIF_DDR_OUT_MAX_BURST"/>
+	<reg32 offset="0x303c" name="VBIF_ARB_CTL"/>
+	<reg32 offset="0x3049" name="VBIF_ROUND_ROBIN_QOS_ARB"/>
+	<reg32 offset="0x3058" name="VBIF_OUT_AXI_AMEMTYPE_CONF0"/>
+	<reg32 offset="0x305e" name="VBIF_OUT_AXI_AOOO_EN"/>
+	<reg32 offset="0x305f" name="VBIF_OUT_AXI_AOOO"/>
+
+	<bitset name="a3xx_vbif_perf_cnt" inline="yes">
+		<bitfield name="CNT0" pos="0" type="boolean"/>
+		<bitfield name="CNT1" pos="1" type="boolean"/>
+		<bitfield name="PWRCNT0" pos="2" type="boolean"/>
+		<bitfield name="PWRCNT1" pos="3" type="boolean"/>
+		<bitfield name="PWRCNT2" pos="4" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x3070" name="VBIF_PERF_CNT_EN" type="a3xx_vbif_perf_cnt"/>
+	<reg32 offset="0x3071" name="VBIF_PERF_CNT_CLR" type="a3xx_vbif_perf_cnt"/>
+	<reg32 offset="0x3072" name="VBIF_PERF_CNT_SEL"/>
+	<reg32 offset="0x3073" name="VBIF_PERF_CNT0_LO"/>
+	<reg32 offset="0x3074" name="VBIF_PERF_CNT0_HI"/>
+	<reg32 offset="0x3075" name="VBIF_PERF_CNT1_LO"/>
+	<reg32 offset="0x3076" name="VBIF_PERF_CNT1_HI"/>
+	<reg32 offset="0x3077" name="VBIF_PERF_PWR_CNT0_LO"/>
+	<reg32 offset="0x3078" name="VBIF_PERF_PWR_CNT0_HI"/>
+	<reg32 offset="0x3079" name="VBIF_PERF_PWR_CNT1_LO"/>
+	<reg32 offset="0x307a" name="VBIF_PERF_PWR_CNT1_HI"/>
+	<reg32 offset="0x307b" name="VBIF_PERF_PWR_CNT2_LO"/>
+	<reg32 offset="0x307c" name="VBIF_PERF_PWR_CNT2_HI"/>
+
+
+	<reg32 offset="0x0c01" name="VSC_BIN_SIZE">
+		<bitfield name="WIDTH" low="0" high="4" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="5" high="9" shr="5" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0c02" name="VSC_SIZE_ADDRESS"/>
+	<array offset="0x0c06" name="VSC_PIPE" stride="3" length="8">
+		<reg32 offset="0x0" name="CONFIG">
+			<doc>
+				Configures the mapping between VSC_PIPE buffer and
+				bin, X/Y specify the bin index in the horiz/vert
+				direction (0,0 is upper left, 0,1 is leftmost bin
+				on second row, and so on).  W/H specify the number
+				of bins assigned to this VSC_PIPE in the horiz/vert
+				dimension.
+			</doc>
+			<bitfield name="X" low="0" high="9" type="uint"/>
+			<bitfield name="Y" low="10" high="19" type="uint"/>
+			<bitfield name="W" low="20" high="23" type="uint"/>
+			<bitfield name="H" low="24" high="27" type="uint"/>
+		</reg32>
+		<reg32 offset="0x1" name="DATA_ADDRESS"/>
+		<reg32 offset="0x2" name="DATA_LENGTH"/>
+	</array>
+	<reg32 offset="0x0c3c" name="VSC_BIN_CONTROL">
+		<doc>seems to be set to 0x00000001 during binning pass</doc>
+		<bitfield name="BINNING_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0c3d" name="UNKNOWN_0C3D">
+		<doc>seems to be always set to 0x00000001</doc>
+	</reg32>
+	<reg32 offset="0x0c48" name="PC_PERFCOUNTER0_SELECT" type="a3xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0c49" name="PC_PERFCOUNTER1_SELECT" type="a3xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0c4a" name="PC_PERFCOUNTER2_SELECT" type="a3xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0c4b" name="PC_PERFCOUNTER3_SELECT" type="a3xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0c81" name="GRAS_TSE_DEBUG_ECO">
+		<doc>seems to be always set to 0x00000001</doc>
+	</reg32>
+
+	<reg32 offset="0x0c88" name="GRAS_PERFCOUNTER0_SELECT" type="a3xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c89" name="GRAS_PERFCOUNTER1_SELECT" type="a3xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c8a" name="GRAS_PERFCOUNTER2_SELECT" type="a3xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x0c8b" name="GRAS_PERFCOUNTER3_SELECT" type="a3xx_gras_ras_perfcounter_select"/>
+	<array offset="0x0ca0" name="GRAS_CL_USER_PLANE" stride="4" length="6">
+		<reg32 offset="0x0" name="X"/>
+		<reg32 offset="0x1" name="Y"/>
+		<reg32 offset="0x2" name="Z"/>
+		<reg32 offset="0x3" name="W"/>
+	</array>
+	<reg32 offset="0x0cc0" name="RB_GMEM_BASE_ADDR"/>
+	<reg32 offset="0x0cc1" name="RB_DEBUG_ECO_CONTROLS_ADDR"/>
+	<reg32 offset="0x0cc6" name="RB_PERFCOUNTER0_SELECT" type="a3xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cc7" name="RB_PERFCOUNTER1_SELECT" type="a3xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ce0" name="RB_FRAME_BUFFER_DIMENSION">
+		<bitfield name="WIDTH" low="0" high="13" type="uint"/>
+		<bitfield name="HEIGHT" low="14" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0e00" name="HLSQ_PERFCOUNTER0_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e01" name="HLSQ_PERFCOUNTER1_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e02" name="HLSQ_PERFCOUNTER2_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e03" name="HLSQ_PERFCOUNTER3_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e04" name="HLSQ_PERFCOUNTER4_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e05" name="HLSQ_PERFCOUNTER5_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e43" name="UNKNOWN_0E43">
+		<doc>seems to be always set to 0x00000001</doc>
+	</reg32>
+	<reg32 offset="0x0e44" name="VFD_PERFCOUNTER0_SELECT" type="a3xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e45" name="VFD_PERFCOUNTER1_SELECT" type="a3xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e61" name="VPC_VPC_DEBUG_RAM_SEL"/>
+	<reg32 offset="0x0e62" name="VPC_VPC_DEBUG_RAM_READ"/>
+	<reg32 offset="0x0e64" name="VPC_PERFCOUNTER0_SELECT" type="a3xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e65" name="VPC_PERFCOUNTER1_SELECT" type="a3xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e82" name="UCHE_CACHE_MODE_CONTROL_REG"/>
+	<reg32 offset="0x0e84" name="UCHE_PERFCOUNTER0_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e85" name="UCHE_PERFCOUNTER1_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e86" name="UCHE_PERFCOUNTER2_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e87" name="UCHE_PERFCOUNTER3_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e88" name="UCHE_PERFCOUNTER4_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e89" name="UCHE_PERFCOUNTER5_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea0" name="UCHE_CACHE_INVALIDATE0_REG">
+		<!-- might be shifted right by 5, assuming 32byte cache line size.. -->
+		<bitfield name="ADDR" low="0" high="27" type="hex"/>
+	</reg32>
+	<reg32 offset="0x0ea1" name="UCHE_CACHE_INVALIDATE1_REG">
+		<!-- might be shifted right by 5, assuming 32byte cache line size.. -->
+		<bitfield name="ADDR" low="0" high="27" type="hex"/>
+		<!-- I'd assume 2 bits, for FLUSH/INVALIDATE/CLEAN? -->
+		<bitfield name="OPCODE" low="28" high="29" type="a3xx_cache_opcode"/>
+		<bitfield name="ENTIRE_CACHE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0ea6" name="UNKNOWN_0EA6"/>
+	<reg32 offset="0x0ec4" name="SP_PERFCOUNTER0_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec5" name="SP_PERFCOUNTER1_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec6" name="SP_PERFCOUNTER2_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec7" name="SP_PERFCOUNTER3_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec8" name="SP_PERFCOUNTER4_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec9" name="SP_PERFCOUNTER5_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0eca" name="SP_PERFCOUNTER6_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecb" name="SP_PERFCOUNTER7_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ee0" name="UNKNOWN_0EE0">
+		<doc>seems to be always set to 0x00000003</doc>
+	</reg32>
+	<reg32 offset="0x0f03" name="UNKNOWN_0F03">
+		<doc>seems to be always set to 0x00000001</doc>
+	</reg32>
+	<reg32 offset="0x0f04" name="TP_PERFCOUNTER0_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f05" name="TP_PERFCOUNTER1_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f06" name="TP_PERFCOUNTER2_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f07" name="TP_PERFCOUNTER3_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f08" name="TP_PERFCOUNTER4_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f09" name="TP_PERFCOUNTER5_SELECT" type="a3xx_tp_perfcounter_select"/>
+
+	<!-- this seems to be the register that CP_RUN_OPENCL writes: -->
+	<reg32 offset="0x21f0" name="VGT_CL_INITIATOR"/>
+
+	<!-- seems to be same as a2xx according to fwdump.. -->
+	<reg32 offset="0x21f9" name="VGT_EVENT_INITIATOR"/>
+	<reg32 offset="0x21fc" name="VGT_DRAW_INITIATOR" type="vgt_draw_initiator"/>
+	<reg32 offset="0x21fd" name="VGT_IMMED_DATA"/>
+</domain>
+
+<domain name="A3XX_TEX_SAMP" width="32">
+	<doc>Texture sampler dwords</doc>
+	<enum name="a3xx_tex_filter">
+		<value name="A3XX_TEX_NEAREST" value="0"/>
+		<value name="A3XX_TEX_LINEAR" value="1"/>
+		<value name="A3XX_TEX_ANISO" value="2"/>
+	</enum>
+	<enum name="a3xx_tex_clamp">
+		<value name="A3XX_TEX_REPEAT" value="0"/>
+		<value name="A3XX_TEX_CLAMP_TO_EDGE" value="1"/>
+		<value name="A3XX_TEX_MIRROR_REPEAT" value="2"/>
+		<value name="A3XX_TEX_CLAMP_TO_BORDER" value="3"/>
+		<value name="A3XX_TEX_MIRROR_CLAMP" value="4"/>
+	</enum>
+	<enum name="a3xx_tex_aniso">
+		<value name="A3XX_TEX_ANISO_1" value="0"/>
+		<value name="A3XX_TEX_ANISO_2" value="1"/>
+		<value name="A3XX_TEX_ANISO_4" value="2"/>
+		<value name="A3XX_TEX_ANISO_8" value="3"/>
+		<value name="A3XX_TEX_ANISO_16" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="CLAMPENABLE" pos="0" type="boolean"/>
+		<bitfield name="MIPFILTER_LINEAR" pos="1" type="boolean"/>
+		<bitfield name="XY_MAG" low="2" high="3" type="a3xx_tex_filter"/>
+		<bitfield name="XY_MIN" low="4" high="5" type="a3xx_tex_filter"/>
+		<bitfield name="WRAP_S" low="6" high="8" type="a3xx_tex_clamp"/>
+		<bitfield name="WRAP_T" low="9" high="11" type="a3xx_tex_clamp"/>
+		<bitfield name="WRAP_R" low="12" high="14" type="a3xx_tex_clamp"/>
+		<bitfield name="ANISO" low="15" high="17" type="a3xx_tex_aniso"/>
+		<bitfield name="COMPARE_FUNC" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="24" type="boolean"/>
+		<!-- UNNORM_COORDS == CLK_NORMALIZED_COORDS_FALSE -->
+		<bitfield name="UNNORM_COORDS" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="LOD_BIAS" low="0" high="10" type="fixed" radix="6"/>
+		<bitfield name="MAX_LOD" low="12" high="21" type="ufixed" radix="6"/>
+		<bitfield name="MIN_LOD" low="22" high="31" type="ufixed" radix="6"/>
+	</reg32>
+</domain>
+
+<domain name="A3XX_TEX_CONST" width="32">
+	<doc>Texture constant dwords</doc>
+	<enum name="a3xx_tex_swiz">
+		<!-- same as a2xx? -->
+		<value name="A3XX_TEX_X" value="0"/>
+		<value name="A3XX_TEX_Y" value="1"/>
+		<value name="A3XX_TEX_Z" value="2"/>
+		<value name="A3XX_TEX_W" value="3"/>
+		<value name="A3XX_TEX_ZERO" value="4"/>
+		<value name="A3XX_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="a3xx_tex_type">
+		<value name="A3XX_TEX_1D" value="0"/>
+		<value name="A3XX_TEX_2D" value="1"/>
+		<value name="A3XX_TEX_CUBE" value="2"/>
+		<value name="A3XX_TEX_3D" value="3"/>
+	</enum>
+	<enum name="a3xx_tex_msaa">
+		<value name="A3XX_TPL1_MSAA1X" value="0"/>
+		<value name="A3XX_TPL1_MSAA2X" value="1"/>
+		<value name="A3XX_TPL1_MSAA4X" value="2"/>
+		<value name="A3XX_TPL1_MSAA8X" value="3"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TILE_MODE" low="0" high="1" type="a3xx_tile_mode"/>
+		<bitfield name="SRGB" pos="2" type="boolean"/>
+		<bitfield name="SWIZ_X" low="4" high="6" type="a3xx_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="7" high="9" type="a3xx_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="10" high="12" type="a3xx_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="13" high="15" type="a3xx_tex_swiz"/>
+		<bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
+		<bitfield name="MSAATEX" low="20" high="21" type="a3xx_tex_msaa"/>
+		<bitfield name="FMT" low="22" high="28" type="a3xx_tex_fmt"/>
+		<bitfield name="NOCONVERT" pos="29" type="boolean"/>
+		<bitfield name="TYPE" low="30" high="31" type="a3xx_tex_type"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="HEIGHT" low="0" high="13" type="uint"/>
+		<bitfield name="WIDTH" low="14" high="27" type="uint"/>
+		<!-- minimum pitch (for mipmap levels): log2(pitchalign / 16) -->
+		<bitfield name="PITCHALIGN" low="28" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<doc>INDX is index of texture address(es) in MIPMAP state block</doc>
+		<bitfield name="INDX" low="0" high="8" type="uint"/>
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="12" high="29" type="uint"/>
+		<doc>SWAP bit is set for BGRA instead of RGBA</doc>
+		<bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!--
+		Update: the two LAYERSZn seem not to be the same thing.
+		According to Ilia's experimentation the first one goes up
+		to at *least* bit 14..
+		 -->
+		<bitfield name="LAYERSZ1" low="0" high="16" shr="12" type="uint"/>
+		<bitfield name="DEPTH" low="17" high="27" type="uint"/>
+		<bitfield name="LAYERSZ2" low="28" high="31" shr="12" type="uint"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/adreno/a4xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/adreno/a4xx.xml
@@ -0,0 +1,2409 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+<enum name="a4xx_color_fmt">
+	<value name="RB4_A8_UNORM" value="0x01"/>
+	<value name="RB4_R8_UNORM" value="0x02"/>
+	<value name="RB4_R8_SNORM" value="0x03"/>
+	<value name="RB4_R8_UINT" value="0x04"/>
+	<value name="RB4_R8_SINT" value="0x05"/>
+
+	<value name="RB4_R4G4B4A4_UNORM" value="0x08"/>
+	<value name="RB4_R5G5B5A1_UNORM" value="0x0a"/>
+	<value name="RB4_R5G6B5_UNORM" value="0x0e"/>
+	<value name="RB4_R8G8_UNORM" value="0x0f"/>
+	<value name="RB4_R8G8_SNORM" value="0x10"/>
+	<value name="RB4_R8G8_UINT" value="0x11"/>
+	<value name="RB4_R8G8_SINT" value="0x12"/>
+	<value name="RB4_R16_UNORM" value="0x13"/>
+	<value name="RB4_R16_SNORM" value="0x14"/>
+	<value name="RB4_R16_FLOAT" value="0x15"/>
+	<value name="RB4_R16_UINT" value="0x16"/>
+	<value name="RB4_R16_SINT" value="0x17"/>
+
+	<value name="RB4_R8G8B8_UNORM" value="0x19"/>
+
+	<value name="RB4_R8G8B8A8_UNORM" value="0x1a"/>
+	<value name="RB4_R8G8B8A8_SNORM" value="0x1c"/>
+	<value name="RB4_R8G8B8A8_UINT" value="0x1d"/>
+	<value name="RB4_R8G8B8A8_SINT" value="0x1e"/>
+	<value name="RB4_R10G10B10A2_UNORM" value="0x1f"/>
+	<value name="RB4_R10G10B10A2_UINT" value="0x22"/>
+	<value name="RB4_R11G11B10_FLOAT" value="0x27"/>
+	<value name="RB4_R16G16_UNORM" value="0x28"/>
+	<value name="RB4_R16G16_SNORM" value="0x29"/>
+	<value name="RB4_R16G16_FLOAT" value="0x2a"/>
+	<value name="RB4_R16G16_UINT" value="0x2b"/>
+	<value name="RB4_R16G16_SINT" value="0x2c"/>
+	<value name="RB4_R32_FLOAT" value="0x2d"/>
+	<value name="RB4_R32_UINT" value="0x2e"/>
+	<value name="RB4_R32_SINT" value="0x2f"/>
+
+	<value name="RB4_R16G16B16A16_UNORM" value="0x34"/>
+	<value name="RB4_R16G16B16A16_SNORM" value="0x35"/>
+	<value name="RB4_R16G16B16A16_FLOAT" value="0x36"/>
+	<value name="RB4_R16G16B16A16_UINT" value="0x37"/>
+	<value name="RB4_R16G16B16A16_SINT" value="0x38"/>
+	<value name="RB4_R32G32_FLOAT" value="0x39"/>
+	<value name="RB4_R32G32_UINT" value="0x3a"/>
+	<value name="RB4_R32G32_SINT" value="0x3b"/>
+
+	<value name="RB4_R32G32B32A32_FLOAT" value="0x3c"/>
+	<value name="RB4_R32G32B32A32_UINT" value="0x3d"/>
+	<value name="RB4_R32G32B32A32_SINT" value="0x3e"/>
+
+	<value name="RB4_NONE" value="0xff"/>
+</enum>
+
+<enum name="a4xx_tile_mode">
+	<value name="TILE4_LINEAR" value="0"/>
+	<value name="TILE4_2" value="2"/>
+	<value name="TILE4_3" value="3"/>
+</enum>
+
+<enum name="a4xx_vtx_fmt" prefix="chipset">
+	<!-- hmm, shifted one compared to a3xx?!?  -->
+	<value name="VFMT4_32_FLOAT" value="0x1"/>
+	<value name="VFMT4_32_32_FLOAT" value="0x2"/>
+	<value name="VFMT4_32_32_32_FLOAT" value="0x3"/>
+	<value name="VFMT4_32_32_32_32_FLOAT" value="0x4"/>
+
+	<value name="VFMT4_16_FLOAT" value="0x5"/>
+	<value name="VFMT4_16_16_FLOAT" value="0x6"/>
+	<value name="VFMT4_16_16_16_FLOAT" value="0x7"/>
+	<value name="VFMT4_16_16_16_16_FLOAT" value="0x8"/>
+
+	<value name="VFMT4_32_FIXED" value="0x9"/>
+	<value name="VFMT4_32_32_FIXED" value="0xa"/>
+	<value name="VFMT4_32_32_32_FIXED" value="0xb"/>
+	<value name="VFMT4_32_32_32_32_FIXED" value="0xc"/>
+
+	<value name="VFMT4_11_11_10_FLOAT" value="0xd"/>
+
+	<!-- beyond here it does not appear to be shifted -->
+	<value name="VFMT4_16_SINT" value="0x10"/>
+	<value name="VFMT4_16_16_SINT" value="0x11"/>
+	<value name="VFMT4_16_16_16_SINT" value="0x12"/>
+	<value name="VFMT4_16_16_16_16_SINT" value="0x13"/>
+	<value name="VFMT4_16_UINT" value="0x14"/>
+	<value name="VFMT4_16_16_UINT" value="0x15"/>
+	<value name="VFMT4_16_16_16_UINT" value="0x16"/>
+	<value name="VFMT4_16_16_16_16_UINT" value="0x17"/>
+	<value name="VFMT4_16_SNORM" value="0x18"/>
+	<value name="VFMT4_16_16_SNORM" value="0x19"/>
+	<value name="VFMT4_16_16_16_SNORM" value="0x1a"/>
+	<value name="VFMT4_16_16_16_16_SNORM" value="0x1b"/>
+	<value name="VFMT4_16_UNORM" value="0x1c"/>
+	<value name="VFMT4_16_16_UNORM" value="0x1d"/>
+	<value name="VFMT4_16_16_16_UNORM" value="0x1e"/>
+	<value name="VFMT4_16_16_16_16_UNORM" value="0x1f"/>
+
+	<value name="VFMT4_32_UINT" value="0x20"/>
+	<value name="VFMT4_32_32_UINT" value="0x21"/>
+	<value name="VFMT4_32_32_32_UINT" value="0x22"/>
+	<value name="VFMT4_32_32_32_32_UINT" value="0x23"/>
+	<value name="VFMT4_32_SINT" value="0x24"/>
+	<value name="VFMT4_32_32_SINT" value="0x25"/>
+	<value name="VFMT4_32_32_32_SINT" value="0x26"/>
+	<value name="VFMT4_32_32_32_32_SINT" value="0x27"/>
+
+	<value name="VFMT4_8_UINT" value="0x28"/>
+	<value name="VFMT4_8_8_UINT" value="0x29"/>
+	<value name="VFMT4_8_8_8_UINT" value="0x2a"/>
+	<value name="VFMT4_8_8_8_8_UINT" value="0x2b"/>
+	<value name="VFMT4_8_UNORM" value="0x2c"/>
+	<value name="VFMT4_8_8_UNORM" value="0x2d"/>
+	<value name="VFMT4_8_8_8_UNORM" value="0x2e"/>
+	<value name="VFMT4_8_8_8_8_UNORM" value="0x2f"/>
+	<value name="VFMT4_8_SINT" value="0x30"/>
+	<value name="VFMT4_8_8_SINT" value="0x31"/>
+	<value name="VFMT4_8_8_8_SINT" value="0x32"/>
+	<value name="VFMT4_8_8_8_8_SINT" value="0x33"/>
+	<value name="VFMT4_8_SNORM" value="0x34"/>
+	<value name="VFMT4_8_8_SNORM" value="0x35"/>
+	<value name="VFMT4_8_8_8_SNORM" value="0x36"/>
+	<value name="VFMT4_8_8_8_8_SNORM" value="0x37"/>
+
+	<value name="VFMT4_10_10_10_2_UINT" value="0x38"/>
+	<value name="VFMT4_10_10_10_2_UNORM" value="0x39"/>
+	<value name="VFMT4_10_10_10_2_SINT" value="0x3a"/>
+	<value name="VFMT4_10_10_10_2_SNORM" value="0x3b"/>
+	<value name="VFMT4_2_10_10_10_UINT" value="0x3c"/>
+	<value name="VFMT4_2_10_10_10_UNORM" value="0x3d"/>
+	<value name="VFMT4_2_10_10_10_SINT" value="0x3e"/>
+	<value name="VFMT4_2_10_10_10_SNORM" value="0x3f"/>
+
+	<value name="VFMT4_NONE" value="0xff"/>
+</enum>
+
+<enum name="a4xx_tex_fmt">
+	<!-- 0x00 .. 0x02 -->
+
+	<!-- 8-bit formats -->
+	<value name="TFMT4_A8_UNORM" value="0x03"/>
+	<value name="TFMT4_8_UNORM"  value="0x04"/>
+	<value name="TFMT4_8_SNORM"  value="0x05"/>
+	<value name="TFMT4_8_UINT"   value="0x06"/>
+	<value name="TFMT4_8_SINT"   value="0x07"/>
+
+	<!-- 16-bit formats -->
+	<value name="TFMT4_4_4_4_4_UNORM" value="0x08"/>
+	<value name="TFMT4_5_5_5_1_UNORM" value="0x09"/>
+	<!-- 0x0a -->
+	<value name="TFMT4_5_6_5_UNORM"   value="0x0b"/>
+
+	<!-- 0x0c -->
+
+	<value name="TFMT4_L8_A8_UNORM" value="0x0d"/>
+	<value name="TFMT4_8_8_UNORM"   value="0x0e"/>
+	<value name="TFMT4_8_8_SNORM"   value="0x0f"/>
+	<value name="TFMT4_8_8_UINT"    value="0x10"/>
+	<value name="TFMT4_8_8_SINT"    value="0x11"/>
+
+	<value name="TFMT4_16_UNORM" value="0x12"/>
+	<value name="TFMT4_16_SNORM" value="0x13"/>
+	<value name="TFMT4_16_FLOAT" value="0x14"/>
+	<value name="TFMT4_16_UINT"  value="0x15"/>
+	<value name="TFMT4_16_SINT"  value="0x16"/>
+
+	<!-- 0x17 .. 0x1b -->
+
+	<!-- 32-bit formats -->
+	<value name="TFMT4_8_8_8_8_UNORM" value="0x1c"/>
+	<value name="TFMT4_8_8_8_8_SNORM" value="0x1d"/>
+	<value name="TFMT4_8_8_8_8_UINT"  value="0x1e"/>
+	<value name="TFMT4_8_8_8_8_SINT"  value="0x1f"/>
+
+	<value name="TFMT4_9_9_9_E5_FLOAT"   value="0x20"/>
+	<value name="TFMT4_10_10_10_2_UNORM" value="0x21"/>
+	<value name="TFMT4_10_10_10_2_UINT"  value="0x22"/>
+	<!-- 0x23 .. 0x24 -->
+	<value name="TFMT4_11_11_10_FLOAT"   value="0x25"/>
+
+	<value name="TFMT4_16_16_UNORM" value="0x26"/>
+	<value name="TFMT4_16_16_SNORM" value="0x27"/>
+	<value name="TFMT4_16_16_FLOAT" value="0x28"/>
+	<value name="TFMT4_16_16_UINT"  value="0x29"/>
+	<value name="TFMT4_16_16_SINT"  value="0x2a"/>
+
+	<value name="TFMT4_32_FLOAT" value="0x2b"/>
+	<value name="TFMT4_32_UINT"  value="0x2c"/>
+	<value name="TFMT4_32_SINT"  value="0x2d"/>
+
+	<!-- 0x2e .. 0x32 -->
+
+	<!-- 64-bit formats -->
+	<value name="TFMT4_16_16_16_16_UNORM" value="0x33"/>
+	<value name="TFMT4_16_16_16_16_SNORM" value="0x34"/>
+	<value name="TFMT4_16_16_16_16_FLOAT" value="0x35"/>
+	<value name="TFMT4_16_16_16_16_UINT"  value="0x36"/>
+	<value name="TFMT4_16_16_16_16_SINT"  value="0x37"/>
+
+	<value name="TFMT4_32_32_FLOAT" value="0x38"/>
+	<value name="TFMT4_32_32_UINT"  value="0x39"/>
+	<value name="TFMT4_32_32_SINT"  value="0x3a"/>
+
+	<!-- 96-bit formats -->
+	<value name="TFMT4_32_32_32_FLOAT" value="0x3b"/>
+	<value name="TFMT4_32_32_32_UINT"  value="0x3c"/>
+	<value name="TFMT4_32_32_32_SINT"  value="0x3d"/>
+
+	<!-- 0x3e -->
+
+	<!-- 128-bit formats -->
+	<value name="TFMT4_32_32_32_32_FLOAT" value="0x3f"/>
+	<value name="TFMT4_32_32_32_32_UINT"  value="0x40"/>
+	<value name="TFMT4_32_32_32_32_SINT"  value="0x41"/>
+
+	<!-- 0x42 .. 0x46 -->
+	<value name="TFMT4_X8Z24_UNORM" value="0x47"/>
+	<!-- 0x48 .. 0x55 -->
+
+	<!-- compressed formats -->
+	<value name="TFMT4_DXT1"                  value="0x56"/>
+	<value name="TFMT4_DXT3"                  value="0x57"/>
+	<value name="TFMT4_DXT5"                  value="0x58"/>
+	<!-- 0x59 -->
+	<value name="TFMT4_RGTC1_UNORM"           value="0x5a"/>
+	<value name="TFMT4_RGTC1_SNORM"           value="0x5b"/>
+	<!-- 0x5c .. 0x5d -->
+	<value name="TFMT4_RGTC2_UNORM"           value="0x5e"/>
+	<value name="TFMT4_RGTC2_SNORM"           value="0x5f"/>
+	<!-- 0x60 -->
+	<value name="TFMT4_BPTC_UFLOAT"           value="0x61"/>
+	<value name="TFMT4_BPTC_FLOAT"            value="0x62"/>
+	<value name="TFMT4_BPTC"                  value="0x63"/>
+	<value name="TFMT4_ATC_RGB"               value="0x64"/>
+	<value name="TFMT4_ATC_RGBA_EXPLICIT"     value="0x65"/>
+	<value name="TFMT4_ATC_RGBA_INTERPOLATED" value="0x66"/>
+	<value name="TFMT4_ETC2_RG11_UNORM"       value="0x67"/>
+	<value name="TFMT4_ETC2_RG11_SNORM"       value="0x68"/>
+	<value name="TFMT4_ETC2_R11_UNORM"        value="0x69"/>
+	<value name="TFMT4_ETC2_R11_SNORM"        value="0x6a"/>
+	<value name="TFMT4_ETC1"                  value="0x6b"/>
+	<value name="TFMT4_ETC2_RGB8"             value="0x6c"/>
+	<value name="TFMT4_ETC2_RGBA8"            value="0x6d"/>
+	<value name="TFMT4_ETC2_RGB8A1"           value="0x6e"/>
+	<value name="TFMT4_ASTC_4x4"              value="0x6f"/>
+	<value name="TFMT4_ASTC_5x4"              value="0x70"/>
+	<value name="TFMT4_ASTC_5x5"              value="0x71"/>
+	<value name="TFMT4_ASTC_6x5"              value="0x72"/>
+	<value name="TFMT4_ASTC_6x6"              value="0x73"/>
+	<value name="TFMT4_ASTC_8x5"              value="0x74"/>
+	<value name="TFMT4_ASTC_8x6"              value="0x75"/>
+	<value name="TFMT4_ASTC_8x8"              value="0x76"/>
+	<value name="TFMT4_ASTC_10x5"             value="0x77"/>
+	<value name="TFMT4_ASTC_10x6"             value="0x78"/>
+	<value name="TFMT4_ASTC_10x8"             value="0x79"/>
+	<value name="TFMT4_ASTC_10x10"            value="0x7a"/>
+	<value name="TFMT4_ASTC_12x10"            value="0x7b"/>
+	<value name="TFMT4_ASTC_12x12"            value="0x7c"/>
+	<!-- 0x7d .. 0x7f -->
+
+	<value name="TFMT4_NONE"                  value="0xff"/>
+</enum>
+
+<enum name="a4xx_depth_format">
+	<value name="DEPTH4_NONE" value="0"/>
+	<value name="DEPTH4_16" value="1"/>
+	<value name="DEPTH4_24_8" value="2"/>
+	<value name="DEPTH4_32" value="3"/>
+</enum>
+
+<!--
+NOTE counters extracted from test-perf log with the following awful
+script:
+##################
+#!/bin/bash
+
+log=$1
+
+grep -F "counter
+countable
+group" $log | grep -v gl > shortlist.txt
+
+countable=""
+IFS=$'\n'; for line in $(cat shortlist.txt); do
+	# parse ######### group[$n]: $name
+	l=${line########### group}
+	if [ $l != $line ];  then
+		group=`echo $line | awk '{print $3}'`
+		echo "Group: $group"
+		continue
+	fi
+	# parse #########   counter[$n]: $name
+	l=${line###########   counter}
+	if [ $l != $line ]; then
+		countable=`echo $line | awk '{print $3}'`
+		#echo "  Countable: $countable"
+		continue
+	fi
+	# parse 		countable:
+	l=${line##		countable:}
+	if [ $l != $line ]; then
+		val=`echo $line | awk '{print $2}'`
+		echo "<value value=\"$val\" name=\"$countable\"/>"
+	fi
+
+done
+##################
+ -->
+<enum name="a4xx_ccu_perfcounter_select">
+	<value value="0" name="CCU_BUSY_CYCLES"/>
+	<value value="2" name="CCU_RB_DEPTH_RETURN_STALL"/>
+	<value value="3" name="CCU_RB_COLOR_RETURN_STALL"/>
+	<value value="6" name="CCU_DEPTH_BLOCKS"/>
+	<value value="7" name="CCU_COLOR_BLOCKS"/>
+	<value value="8" name="CCU_DEPTH_BLOCK_HIT"/>
+	<value value="9" name="CCU_COLOR_BLOCK_HIT"/>
+	<value value="10" name="CCU_DEPTH_FLAG1_COUNT"/>
+	<value value="11" name="CCU_DEPTH_FLAG2_COUNT"/>
+	<value value="12" name="CCU_DEPTH_FLAG3_COUNT"/>
+	<value value="13" name="CCU_DEPTH_FLAG4_COUNT"/>
+	<value value="14" name="CCU_COLOR_FLAG1_COUNT"/>
+	<value value="15" name="CCU_COLOR_FLAG2_COUNT"/>
+	<value value="16" name="CCU_COLOR_FLAG3_COUNT"/>
+	<value value="17" name="CCU_COLOR_FLAG4_COUNT"/>
+	<value value="18" name="CCU_PARTIAL_BLOCK_READ"/>
+</enum>
+
+<!--
+NOTE other than CP_ALWAYS_COUNT (which is the only one we use so far),
+on a3xx the countable #'s from AMD_performance_monitor disagreed with
+TRM.  All these #'s for a4xx come from AMD_performance_monitor, so
+perhaps they should be taken with a grain of salt
+-->
+<enum name="a4xx_cp_perfcounter_select">
+	<!-- first ctr at least seems same as a3xx, so we can measure freq -->
+	<value value="0" name="CP_ALWAYS_COUNT"/>
+	<value value="1" name="CP_BUSY"/>
+	<value value="2" name="CP_PFP_IDLE"/>
+	<value value="3" name="CP_PFP_BUSY_WORKING"/>
+	<value value="4" name="CP_PFP_STALL_CYCLES_ANY"/>
+	<value value="5" name="CP_PFP_STARVE_CYCLES_ANY"/>
+	<value value="6" name="CP_PFP_STARVED_PER_LOAD_ADDR"/>
+	<value value="7" name="CP_PFP_STALLED_PER_STORE_ADDR"/>
+	<value value="8" name="CP_PFP_PC_PROFILE"/>
+	<value value="9" name="CP_PFP_MATCH_PM4_PKT_PROFILE"/>
+	<value value="10" name="CP_PFP_COND_INDIRECT_DISCARDED"/>
+	<value value="11" name="CP_LONG_RESUMPTIONS"/>
+	<value value="12" name="CP_RESUME_CYCLES"/>
+	<value value="13" name="CP_RESUME_TO_BOUNDARY_CYCLES"/>
+	<value value="14" name="CP_LONG_PREEMPTIONS"/>
+	<value value="15" name="CP_PREEMPT_CYCLES"/>
+	<value value="16" name="CP_PREEMPT_TO_BOUNDARY_CYCLES"/>
+	<value value="17" name="CP_ME_FIFO_EMPTY_PFP_IDLE"/>
+	<value value="18" name="CP_ME_FIFO_EMPTY_PFP_BUSY"/>
+	<value value="19" name="CP_ME_FIFO_NOT_EMPTY_NOT_FULL"/>
+	<value value="20" name="CP_ME_FIFO_FULL_ME_BUSY"/>
+	<value value="21" name="CP_ME_FIFO_FULL_ME_NON_WORKING"/>
+	<value value="22" name="CP_ME_WAITING_FOR_PACKETS"/>
+	<value value="23" name="CP_ME_BUSY_WORKING"/>
+	<value value="24" name="CP_ME_STARVE_CYCLES_ANY"/>
+	<value value="25" name="CP_ME_STARVE_CYCLES_PER_PROFILE"/>
+	<value value="26" name="CP_ME_STALL_CYCLES_PER_PROFILE"/>
+	<value value="27" name="CP_ME_PC_PROFILE"/>
+	<value value="28" name="CP_RCIU_FIFO_EMPTY"/>
+	<value value="29" name="CP_RCIU_FIFO_NOT_EMPTY_NOT_FULL"/>
+	<value value="30" name="CP_RCIU_FIFO_FULL"/>
+	<value value="31" name="CP_RCIU_FIFO_FULL_NO_CONTEXT"/>
+	<value value="32" name="CP_RCIU_FIFO_FULL_AHB_MASTER"/>
+	<value value="33" name="CP_RCIU_FIFO_FULL_OTHER"/>
+	<value value="34" name="CP_AHB_IDLE"/>
+	<value value="35" name="CP_AHB_STALL_ON_GRANT_NO_SPLIT"/>
+	<value value="36" name="CP_AHB_STALL_ON_GRANT_SPLIT"/>
+	<value value="37" name="CP_AHB_STALL_ON_GRANT_SPLIT_PROFILE"/>
+	<value value="38" name="CP_AHB_BUSY_WORKING"/>
+	<value value="39" name="CP_AHB_BUSY_STALL_ON_HRDY"/>
+	<value value="40" name="CP_AHB_BUSY_STALL_ON_HRDY_PROFILE"/>
+</enum>
+
+<enum name="a4xx_gras_ras_perfcounter_select">
+	<value value="0" name="RAS_SUPER_TILES"/>
+	<value value="1" name="RAS_8X8_TILES"/>
+	<value value="2" name="RAS_4X4_TILES"/>
+	<value value="3" name="RAS_BUSY_CYCLES"/>
+	<value value="4" name="RAS_STALL_CYCLES_BY_RB"/>
+	<value value="5" name="RAS_STALL_CYCLES_BY_VSC"/>
+	<value value="6" name="RAS_STARVE_CYCLES_BY_TSE"/>
+	<value value="7" name="RAS_SUPERTILE_CYCLES"/>
+	<value value="8" name="RAS_TILE_CYCLES"/>
+	<value value="9" name="RAS_FULLY_COVERED_SUPER_TILES"/>
+	<value value="10" name="RAS_FULLY_COVERED_8X8_TILES"/>
+	<value value="11" name="RAS_4X4_PRIM"/>
+	<value value="12" name="RAS_8X4_4X8_PRIM"/>
+	<value value="13" name="RAS_8X8_PRIM"/>
+</enum>
+
+<enum name="a4xx_gras_tse_perfcounter_select">
+	<value value="0" name="TSE_INPUT_PRIM"/>
+	<value value="1" name="TSE_INPUT_NULL_PRIM"/>
+	<value value="2" name="TSE_TRIVAL_REJ_PRIM"/>
+	<value value="3" name="TSE_CLIPPED_PRIM"/>
+	<value value="4" name="TSE_NEW_PRIM"/>
+	<value value="5" name="TSE_ZERO_AREA_PRIM"/>
+	<value value="6" name="TSE_FACENESS_CULLED_PRIM"/>
+	<value value="7" name="TSE_ZERO_PIXEL_PRIM"/>
+	<value value="8" name="TSE_OUTPUT_NULL_PRIM"/>
+	<value value="9" name="TSE_OUTPUT_VISIBLE_PRIM"/>
+	<value value="10" name="TSE_PRE_CLIP_PRIM"/>
+	<value value="11" name="TSE_POST_CLIP_PRIM"/>
+	<value value="12" name="TSE_BUSY_CYCLES"/>
+	<value value="13" name="TSE_PC_STARVE"/>
+	<value value="14" name="TSE_RAS_STALL"/>
+	<value value="15" name="TSE_STALL_BARYPLANE_FIFO_FULL"/>
+	<value value="16" name="TSE_STALL_ZPLANE_FIFO_FULL"/>
+</enum>
+
+<enum name="a4xx_hlsq_perfcounter_select">
+	<value value="0" name="HLSQ_SP_VS_STAGE_CONSTANT"/>
+	<value value="1" name="HLSQ_SP_VS_STAGE_INSTRUCTIONS"/>
+	<value value="2" name="HLSQ_SP_FS_STAGE_CONSTANT"/>
+	<value value="3" name="HLSQ_SP_FS_STAGE_INSTRUCTIONS"/>
+	<value value="4" name="HLSQ_TP_STATE"/>
+	<value value="5" name="HLSQ_QUADS"/>
+	<value value="6" name="HLSQ_PIXELS"/>
+	<value value="7" name="HLSQ_VERTICES"/>
+	<value value="13" name="HLSQ_SP_VS_STAGE_DATA_BYTES"/>
+	<value value="14" name="HLSQ_SP_FS_STAGE_DATA_BYTES"/>
+	<value value="15" name="HLSQ_BUSY_CYCLES"/>
+	<value value="16" name="HLSQ_STALL_CYCLES_SP_STATE"/>
+	<value value="17" name="HLSQ_STALL_CYCLES_SP_VS_STAGE"/>
+	<value value="18" name="HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+	<value value="19" name="HLSQ_STALL_CYCLES_UCHE"/>
+	<value value="20" name="HLSQ_RBBM_LOAD_CYCLES"/>
+	<value value="21" name="HLSQ_DI_TO_VS_START_SP"/>
+	<value value="22" name="HLSQ_DI_TO_FS_START_SP"/>
+	<value value="23" name="HLSQ_VS_STAGE_START_TO_DONE_SP"/>
+	<value value="24" name="HLSQ_FS_STAGE_START_TO_DONE_SP"/>
+	<value value="25" name="HLSQ_SP_STATE_COPY_CYCLES_VS_STAGE"/>
+	<value value="26" name="HLSQ_SP_STATE_COPY_CYCLES_FS_STAGE"/>
+	<value value="27" name="HLSQ_UCHE_LATENCY_CYCLES"/>
+	<value value="28" name="HLSQ_UCHE_LATENCY_COUNT"/>
+	<value value="29" name="HLSQ_STARVE_CYCLES_VFD"/>
+</enum>
+
+<enum name="a4xx_pc_perfcounter_select">
+	<value value="0" name="PC_VIS_STREAMS_LOADED"/>
+	<value value="2" name="PC_VPC_PRIMITIVES"/>
+	<value value="3" name="PC_DEAD_PRIM"/>
+	<value value="4" name="PC_LIVE_PRIM"/>
+	<value value="5" name="PC_DEAD_DRAWCALLS"/>
+	<value value="6" name="PC_LIVE_DRAWCALLS"/>
+	<value value="7" name="PC_VERTEX_MISSES"/>
+	<value value="9" name="PC_STALL_CYCLES_VFD"/>
+	<value value="10" name="PC_STALL_CYCLES_TSE"/>
+	<value value="11" name="PC_STALL_CYCLES_UCHE"/>
+	<value value="12" name="PC_WORKING_CYCLES"/>
+	<value value="13" name="PC_IA_VERTICES"/>
+	<value value="14" name="PC_GS_PRIMITIVES"/>
+	<value value="15" name="PC_HS_INVOCATIONS"/>
+	<value value="16" name="PC_DS_INVOCATIONS"/>
+	<value value="17" name="PC_DS_PRIMITIVES"/>
+	<value value="20" name="PC_STARVE_CYCLES_FOR_INDEX"/>
+	<value value="21" name="PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+	<value value="22" name="PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+	<value value="23" name="PC_STALL_CYCLES_TESS"/>
+	<value value="24" name="PC_STARVE_CYCLES_FOR_POSITION"/>
+	<value value="25" name="PC_MODE0_DRAWCALL"/>
+	<value value="26" name="PC_MODE1_DRAWCALL"/>
+	<value value="27" name="PC_MODE2_DRAWCALL"/>
+	<value value="28" name="PC_MODE3_DRAWCALL"/>
+	<value value="29" name="PC_MODE4_DRAWCALL"/>
+	<value value="30" name="PC_PREDICATED_DEAD_DRAWCALL"/>
+	<value value="31" name="PC_STALL_CYCLES_BY_TSE_ONLY"/>
+	<value value="32" name="PC_STALL_CYCLES_BY_VPC_ONLY"/>
+	<value value="33" name="PC_VPC_POS_DATA_TRANSACTION"/>
+	<value value="34" name="PC_BUSY_CYCLES"/>
+	<value value="35" name="PC_STARVE_CYCLES_DI"/>
+	<value value="36" name="PC_STALL_CYCLES_VPC"/>
+	<value value="37" name="TESS_WORKING_CYCLES"/>
+	<value value="38" name="TESS_NUM_CYCLES_SETUP_WORKING"/>
+	<value value="39" name="TESS_NUM_CYCLES_PTGEN_WORKING"/>
+	<value value="40" name="TESS_NUM_CYCLES_CONNGEN_WORKING"/>
+	<value value="41" name="TESS_BUSY_CYCLES"/>
+	<value value="42" name="TESS_STARVE_CYCLES_PC"/>
+	<value value="43" name="TESS_STALL_CYCLES_PC"/>
+</enum>
+
+<enum name="a4xx_pwr_perfcounter_select">
+	<!-- NOTE not actually used.. see RBBM_RBBM_CTL.RESET_PWR_CTR0/1 -->
+	<value value="0" name="PWR_CORE_CLOCK_CYCLES"/>
+	<value value="1" name="PWR_BUSY_CLOCK_CYCLES"/>
+</enum>
+
+<enum name="a4xx_rb_perfcounter_select">
+	<value value="0" name="RB_BUSY_CYCLES"/>
+	<value value="1" name="RB_BUSY_CYCLES_BINNING"/>
+	<value value="2" name="RB_BUSY_CYCLES_RENDERING"/>
+	<value value="3" name="RB_BUSY_CYCLES_RESOLVE"/>
+	<value value="4" name="RB_STARVE_CYCLES_BY_SP"/>
+	<value value="5" name="RB_STARVE_CYCLES_BY_RAS"/>
+	<value value="6" name="RB_STARVE_CYCLES_BY_MARB"/>
+	<value value="7" name="RB_STALL_CYCLES_BY_MARB"/>
+	<value value="8" name="RB_STALL_CYCLES_BY_HLSQ"/>
+	<value value="9" name="RB_RB_RB_MARB_DATA"/>
+	<value value="10" name="RB_SP_RB_QUAD"/>
+	<value value="11" name="RB_RAS_RB_Z_QUADS"/>
+	<value value="12" name="RB_GMEM_CH0_READ"/>
+	<value value="13" name="RB_GMEM_CH1_READ"/>
+	<value value="14" name="RB_GMEM_CH0_WRITE"/>
+	<value value="15" name="RB_GMEM_CH1_WRITE"/>
+	<value value="16" name="RB_CP_CONTEXT_DONE"/>
+	<value value="17" name="RB_CP_CACHE_FLUSH"/>
+	<value value="18" name="RB_CP_ZPASS_DONE"/>
+	<value value="19" name="RB_STALL_FIFO0_FULL"/>
+	<value value="20" name="RB_STALL_FIFO1_FULL"/>
+	<value value="21" name="RB_STALL_FIFO2_FULL"/>
+	<value value="22" name="RB_STALL_FIFO3_FULL"/>
+	<value value="23" name="RB_RB_HLSQ_TRANSACTIONS"/>
+	<value value="24" name="RB_Z_READ"/>
+	<value value="25" name="RB_Z_WRITE"/>
+	<value value="26" name="RB_C_READ"/>
+	<value value="27" name="RB_C_WRITE"/>
+	<value value="28" name="RB_C_READ_LATENCY"/>
+	<value value="29" name="RB_Z_READ_LATENCY"/>
+	<value value="30" name="RB_STALL_BY_UCHE"/>
+	<value value="31" name="RB_MARB_UCHE_TRANSACTIONS"/>
+	<value value="32" name="RB_CACHE_STALL_MISS"/>
+	<value value="33" name="RB_CACHE_STALL_FIFO_FULL"/>
+	<value value="34" name="RB_8BIT_BLENDER_UNITS_ACTIVE"/>
+	<value value="35" name="RB_16BIT_BLENDER_UNITS_ACTIVE"/>
+	<value value="36" name="RB_SAMPLER_UNITS_ACTIVE"/>
+	<value value="38" name="RB_TOTAL_PASS"/>
+	<value value="39" name="RB_Z_PASS"/>
+	<value value="40" name="RB_Z_FAIL"/>
+	<value value="41" name="RB_S_FAIL"/>
+	<value value="42" name="RB_POWER0"/>
+	<value value="43" name="RB_POWER1"/>
+	<value value="44" name="RB_POWER2"/>
+	<value value="45" name="RB_POWER3"/>
+	<value value="46" name="RB_POWER4"/>
+	<value value="47" name="RB_POWER5"/>
+	<value value="48" name="RB_POWER6"/>
+	<value value="49" name="RB_POWER7"/>
+</enum>
+
+<enum name="a4xx_rbbm_perfcounter_select">
+	<value value="0" name="RBBM_ALWAYS_ON"/>
+	<value value="1" name="RBBM_VBIF_BUSY"/>
+	<value value="2" name="RBBM_TSE_BUSY"/>
+	<value value="3" name="RBBM_RAS_BUSY"/>
+	<value value="4" name="RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="RBBM_VFD_BUSY"/>
+	<value value="7" name="RBBM_VPC_BUSY"/>
+	<value value="8" name="RBBM_UCHE_BUSY"/>
+	<value value="9" name="RBBM_VSC_BUSY"/>
+	<value value="10" name="RBBM_HLSQ_BUSY"/>
+	<value value="11" name="RBBM_ANY_RB_BUSY"/>
+	<value value="12" name="RBBM_ANY_TPL1_BUSY"/>
+	<value value="13" name="RBBM_ANY_SP_BUSY"/>
+	<value value="14" name="RBBM_ANY_MARB_BUSY"/>
+	<value value="15" name="RBBM_ANY_ARB_BUSY"/>
+	<value value="16" name="RBBM_AHB_STATUS_BUSY"/>
+	<value value="17" name="RBBM_AHB_STATUS_STALLED"/>
+	<value value="18" name="RBBM_AHB_STATUS_TXFR"/>
+	<value value="19" name="RBBM_AHB_STATUS_TXFR_SPLIT"/>
+	<value value="20" name="RBBM_AHB_STATUS_TXFR_ERROR"/>
+	<value value="21" name="RBBM_AHB_STATUS_LONG_STALL"/>
+	<value value="22" name="RBBM_STATUS_MASKED"/>
+	<value value="23" name="RBBM_CP_BUSY_GFX_CORE_IDLE"/>
+	<value value="24" name="RBBM_TESS_BUSY"/>
+	<value value="25" name="RBBM_COM_BUSY"/>
+	<value value="32" name="RBBM_DCOM_BUSY"/>
+	<value value="33" name="RBBM_ANY_CCU_BUSY"/>
+	<value value="34" name="RBBM_DPM_BUSY"/>
+</enum>
+
+<enum name="a4xx_sp_perfcounter_select">
+	<value value="0" name="SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="1" name="SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="2" name="SP_LM_ATOMICS"/>
+	<value value="3" name="SP_GM_LOAD_INSTRUCTIONS"/>
+	<value value="4" name="SP_GM_STORE_INSTRUCTIONS"/>
+	<value value="5" name="SP_GM_ATOMICS"/>
+	<value value="6" name="SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="7" name="SP_VS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="8" name="SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="9" name="SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="10" name="SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="11" name="SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="12" name="SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="13" name="SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="14" name="SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="15" name="SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="17" name="SP_VS_INSTRUCTIONS"/>
+	<value value="18" name="SP_FS_INSTRUCTIONS"/>
+	<value value="19" name="SP_ADDR_LOCK_COUNT"/>
+	<value value="20" name="SP_UCHE_READ_TRANS"/>
+	<value value="21" name="SP_UCHE_WRITE_TRANS"/>
+	<value value="22" name="SP_EXPORT_VPC_TRANS"/>
+	<value value="23" name="SP_EXPORT_RB_TRANS"/>
+	<value value="24" name="SP_PIXELS_KILLED"/>
+	<value value="25" name="SP_ICL1_REQUESTS"/>
+	<value value="26" name="SP_ICL1_MISSES"/>
+	<value value="27" name="SP_ICL0_REQUESTS"/>
+	<value value="28" name="SP_ICL0_MISSES"/>
+	<value value="29" name="SP_ALU_WORKING_CYCLES"/>
+	<value value="30" name="SP_EFU_WORKING_CYCLES"/>
+	<value value="31" name="SP_STALL_CYCLES_BY_VPC"/>
+	<value value="32" name="SP_STALL_CYCLES_BY_TP"/>
+	<value value="33" name="SP_STALL_CYCLES_BY_UCHE"/>
+	<value value="34" name="SP_STALL_CYCLES_BY_RB"/>
+	<value value="35" name="SP_BUSY_CYCLES"/>
+	<value value="36" name="SP_HS_INSTRUCTIONS"/>
+	<value value="37" name="SP_DS_INSTRUCTIONS"/>
+	<value value="38" name="SP_GS_INSTRUCTIONS"/>
+	<value value="39" name="SP_CS_INSTRUCTIONS"/>
+	<value value="40" name="SP_SCHEDULER_NON_WORKING"/>
+	<value value="41" name="SP_WAVE_CONTEXTS"/>
+	<value value="42" name="SP_WAVE_CONTEXT_CYCLES"/>
+	<value value="43" name="SP_POWER0"/>
+	<value value="44" name="SP_POWER1"/>
+	<value value="45" name="SP_POWER2"/>
+	<value value="46" name="SP_POWER3"/>
+	<value value="47" name="SP_POWER4"/>
+	<value value="48" name="SP_POWER5"/>
+	<value value="49" name="SP_POWER6"/>
+	<value value="50" name="SP_POWER7"/>
+	<value value="51" name="SP_POWER8"/>
+	<value value="52" name="SP_POWER9"/>
+	<value value="53" name="SP_POWER10"/>
+	<value value="54" name="SP_POWER11"/>
+	<value value="55" name="SP_POWER12"/>
+	<value value="56" name="SP_POWER13"/>
+	<value value="57" name="SP_POWER14"/>
+	<value value="58" name="SP_POWER15"/>
+</enum>
+
+<enum name="a4xx_tp_perfcounter_select">
+	<value value="0" name="TP_L1_REQUESTS"/>
+	<value value="1" name="TP_L1_MISSES"/>
+	<value value="8" name="TP_QUADS_OFFSET"/>
+	<value value="9" name="TP_QUAD_SHADOW"/>
+	<value value="10" name="TP_QUADS_ARRAY"/>
+	<value value="11" name="TP_QUADS_GRADIENT"/>
+	<value value="12" name="TP_QUADS_1D2D"/>
+	<value value="13" name="TP_QUADS_3DCUBE"/>
+	<value value="16" name="TP_BUSY_CYCLES"/>
+	<value value="17" name="TP_STALL_CYCLES_BY_ARB"/>
+	<value value="20" name="TP_STATE_CACHE_REQUESTS"/>
+	<value value="21" name="TP_STATE_CACHE_MISSES"/>
+	<value value="22" name="TP_POWER0"/>
+	<value value="23" name="TP_POWER1"/>
+	<value value="24" name="TP_POWER2"/>
+	<value value="25" name="TP_POWER3"/>
+	<value value="26" name="TP_POWER4"/>
+	<value value="27" name="TP_POWER5"/>
+	<value value="28" name="TP_POWER6"/>
+	<value value="29" name="TP_POWER7"/>
+</enum>
+
+<enum name="a4xx_uche_perfcounter_select">
+	<value value="0" name="UCHE_VBIF_READ_BEATS_TP"/>
+	<value value="1" name="UCHE_VBIF_READ_BEATS_VFD"/>
+	<value value="2" name="UCHE_VBIF_READ_BEATS_HLSQ"/>
+	<value value="3" name="UCHE_VBIF_READ_BEATS_MARB"/>
+	<value value="4" name="UCHE_VBIF_READ_BEATS_SP"/>
+	<value value="5" name="UCHE_READ_REQUESTS_TP"/>
+	<value value="6" name="UCHE_READ_REQUESTS_VFD"/>
+	<value value="7" name="UCHE_READ_REQUESTS_HLSQ"/>
+	<value value="8" name="UCHE_READ_REQUESTS_MARB"/>
+	<value value="9" name="UCHE_READ_REQUESTS_SP"/>
+	<value value="10" name="UCHE_WRITE_REQUESTS_MARB"/>
+	<value value="11" name="UCHE_WRITE_REQUESTS_SP"/>
+	<value value="12" name="UCHE_TAG_CHECK_FAILS"/>
+	<value value="13" name="UCHE_EVICTS"/>
+	<value value="14" name="UCHE_FLUSHES"/>
+	<value value="15" name="UCHE_VBIF_LATENCY_CYCLES"/>
+	<value value="16" name="UCHE_VBIF_LATENCY_SAMPLES"/>
+	<value value="17" name="UCHE_BUSY_CYCLES"/>
+	<value value="18" name="UCHE_VBIF_READ_BEATS_PC"/>
+	<value value="19" name="UCHE_READ_REQUESTS_PC"/>
+	<value value="20" name="UCHE_WRITE_REQUESTS_VPC"/>
+	<value value="21" name="UCHE_STALL_BY_VBIF"/>
+	<value value="22" name="UCHE_WRITE_REQUESTS_VSC"/>
+	<value value="23" name="UCHE_POWER0"/>
+	<value value="24" name="UCHE_POWER1"/>
+	<value value="25" name="UCHE_POWER2"/>
+	<value value="26" name="UCHE_POWER3"/>
+	<value value="27" name="UCHE_POWER4"/>
+	<value value="28" name="UCHE_POWER5"/>
+	<value value="29" name="UCHE_POWER6"/>
+	<value value="30" name="UCHE_POWER7"/>
+</enum>
+
+<enum name="a4xx_vbif_perfcounter_select">
+	<value value="0" name="AXI_READ_REQUESTS_ID_0"/>
+	<value value="1" name="AXI_READ_REQUESTS_ID_1"/>
+	<value value="2" name="AXI_READ_REQUESTS_ID_2"/>
+	<value value="3" name="AXI_READ_REQUESTS_ID_3"/>
+	<value value="4" name="AXI_READ_REQUESTS_ID_4"/>
+	<value value="5" name="AXI_READ_REQUESTS_ID_5"/>
+	<value value="6" name="AXI_READ_REQUESTS_ID_6"/>
+	<value value="7" name="AXI_READ_REQUESTS_ID_7"/>
+	<value value="8" name="AXI_READ_REQUESTS_ID_8"/>
+	<value value="9" name="AXI_READ_REQUESTS_ID_9"/>
+	<value value="10" name="AXI_READ_REQUESTS_ID_10"/>
+	<value value="11" name="AXI_READ_REQUESTS_ID_11"/>
+	<value value="12" name="AXI_READ_REQUESTS_ID_12"/>
+	<value value="13" name="AXI_READ_REQUESTS_ID_13"/>
+	<value value="14" name="AXI_READ_REQUESTS_ID_14"/>
+	<value value="15" name="AXI_READ_REQUESTS_ID_15"/>
+	<value value="16" name="AXI0_READ_REQUESTS_TOTAL"/>
+	<value value="17" name="AXI1_READ_REQUESTS_TOTAL"/>
+	<value value="18" name="AXI2_READ_REQUESTS_TOTAL"/>
+	<value value="19" name="AXI3_READ_REQUESTS_TOTAL"/>
+	<value value="20" name="AXI_READ_REQUESTS_TOTAL"/>
+	<value value="21" name="AXI_WRITE_REQUESTS_ID_0"/>
+	<value value="22" name="AXI_WRITE_REQUESTS_ID_1"/>
+	<value value="23" name="AXI_WRITE_REQUESTS_ID_2"/>
+	<value value="24" name="AXI_WRITE_REQUESTS_ID_3"/>
+	<value value="25" name="AXI_WRITE_REQUESTS_ID_4"/>
+	<value value="26" name="AXI_WRITE_REQUESTS_ID_5"/>
+	<value value="27" name="AXI_WRITE_REQUESTS_ID_6"/>
+	<value value="28" name="AXI_WRITE_REQUESTS_ID_7"/>
+	<value value="29" name="AXI_WRITE_REQUESTS_ID_8"/>
+	<value value="30" name="AXI_WRITE_REQUESTS_ID_9"/>
+	<value value="31" name="AXI_WRITE_REQUESTS_ID_10"/>
+	<value value="32" name="AXI_WRITE_REQUESTS_ID_11"/>
+	<value value="33" name="AXI_WRITE_REQUESTS_ID_12"/>
+	<value value="34" name="AXI_WRITE_REQUESTS_ID_13"/>
+	<value value="35" name="AXI_WRITE_REQUESTS_ID_14"/>
+	<value value="36" name="AXI_WRITE_REQUESTS_ID_15"/>
+	<value value="37" name="AXI0_WRITE_REQUESTS_TOTAL"/>
+	<value value="38" name="AXI1_WRITE_REQUESTS_TOTAL"/>
+	<value value="39" name="AXI2_WRITE_REQUESTS_TOTAL"/>
+	<value value="40" name="AXI3_WRITE_REQUESTS_TOTAL"/>
+	<value value="41" name="AXI_WRITE_REQUESTS_TOTAL"/>
+	<value value="42" name="AXI_TOTAL_REQUESTS"/>
+	<value value="43" name="AXI_READ_DATA_BEATS_ID_0"/>
+	<value value="44" name="AXI_READ_DATA_BEATS_ID_1"/>
+	<value value="45" name="AXI_READ_DATA_BEATS_ID_2"/>
+	<value value="46" name="AXI_READ_DATA_BEATS_ID_3"/>
+	<value value="47" name="AXI_READ_DATA_BEATS_ID_4"/>
+	<value value="48" name="AXI_READ_DATA_BEATS_ID_5"/>
+	<value value="49" name="AXI_READ_DATA_BEATS_ID_6"/>
+	<value value="50" name="AXI_READ_DATA_BEATS_ID_7"/>
+	<value value="51" name="AXI_READ_DATA_BEATS_ID_8"/>
+	<value value="52" name="AXI_READ_DATA_BEATS_ID_9"/>
+	<value value="53" name="AXI_READ_DATA_BEATS_ID_10"/>
+	<value value="54" name="AXI_READ_DATA_BEATS_ID_11"/>
+	<value value="55" name="AXI_READ_DATA_BEATS_ID_12"/>
+	<value value="56" name="AXI_READ_DATA_BEATS_ID_13"/>
+	<value value="57" name="AXI_READ_DATA_BEATS_ID_14"/>
+	<value value="58" name="AXI_READ_DATA_BEATS_ID_15"/>
+	<value value="59" name="AXI0_READ_DATA_BEATS_TOTAL"/>
+	<value value="60" name="AXI1_READ_DATA_BEATS_TOTAL"/>
+	<value value="61" name="AXI2_READ_DATA_BEATS_TOTAL"/>
+	<value value="62" name="AXI3_READ_DATA_BEATS_TOTAL"/>
+	<value value="63" name="AXI_READ_DATA_BEATS_TOTAL"/>
+	<value value="64" name="AXI_WRITE_DATA_BEATS_ID_0"/>
+	<value value="65" name="AXI_WRITE_DATA_BEATS_ID_1"/>
+	<value value="66" name="AXI_WRITE_DATA_BEATS_ID_2"/>
+	<value value="67" name="AXI_WRITE_DATA_BEATS_ID_3"/>
+	<value value="68" name="AXI_WRITE_DATA_BEATS_ID_4"/>
+	<value value="69" name="AXI_WRITE_DATA_BEATS_ID_5"/>
+	<value value="70" name="AXI_WRITE_DATA_BEATS_ID_6"/>
+	<value value="71" name="AXI_WRITE_DATA_BEATS_ID_7"/>
+	<value value="72" name="AXI_WRITE_DATA_BEATS_ID_8"/>
+	<value value="73" name="AXI_WRITE_DATA_BEATS_ID_9"/>
+	<value value="74" name="AXI_WRITE_DATA_BEATS_ID_10"/>
+	<value value="75" name="AXI_WRITE_DATA_BEATS_ID_11"/>
+	<value value="76" name="AXI_WRITE_DATA_BEATS_ID_12"/>
+	<value value="77" name="AXI_WRITE_DATA_BEATS_ID_13"/>
+	<value value="78" name="AXI_WRITE_DATA_BEATS_ID_14"/>
+	<value value="79" name="AXI_WRITE_DATA_BEATS_ID_15"/>
+	<value value="80" name="AXI0_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="81" name="AXI1_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="82" name="AXI2_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="83" name="AXI3_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="84" name="AXI_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="85" name="AXI_DATA_BEATS_TOTAL"/>
+	<value value="86" name="CYCLES_HELD_OFF_ID_0"/>
+	<value value="87" name="CYCLES_HELD_OFF_ID_1"/>
+	<value value="88" name="CYCLES_HELD_OFF_ID_2"/>
+	<value value="89" name="CYCLES_HELD_OFF_ID_3"/>
+	<value value="90" name="CYCLES_HELD_OFF_ID_4"/>
+	<value value="91" name="CYCLES_HELD_OFF_ID_5"/>
+	<value value="92" name="CYCLES_HELD_OFF_ID_6"/>
+	<value value="93" name="CYCLES_HELD_OFF_ID_7"/>
+	<value value="94" name="CYCLES_HELD_OFF_ID_8"/>
+	<value value="95" name="CYCLES_HELD_OFF_ID_9"/>
+	<value value="96" name="CYCLES_HELD_OFF_ID_10"/>
+	<value value="97" name="CYCLES_HELD_OFF_ID_11"/>
+	<value value="98" name="CYCLES_HELD_OFF_ID_12"/>
+	<value value="99" name="CYCLES_HELD_OFF_ID_13"/>
+	<value value="100" name="CYCLES_HELD_OFF_ID_14"/>
+	<value value="101" name="CYCLES_HELD_OFF_ID_15"/>
+	<value value="102" name="AXI_READ_REQUEST_HELD_OFF"/>
+	<value value="103" name="AXI_WRITE_REQUEST_HELD_OFF"/>
+	<value value="104" name="AXI_REQUEST_HELD_OFF"/>
+	<value value="105" name="AXI_WRITE_DATA_HELD_OFF"/>
+	<value value="106" name="OCMEM_AXI_READ_REQUEST_HELD_OFF"/>
+	<value value="107" name="OCMEM_AXI_WRITE_REQUEST_HELD_OFF"/>
+	<value value="108" name="OCMEM_AXI_REQUEST_HELD_OFF"/>
+	<value value="109" name="OCMEM_AXI_WRITE_DATA_HELD_OFF"/>
+	<value value="110" name="ELAPSED_CYCLES_DDR"/>
+	<value value="111" name="ELAPSED_CYCLES_OCMEM"/>
+</enum>
+
+<enum name="a4xx_vfd_perfcounter_select">
+	<value value="0" name="VFD_UCHE_BYTE_FETCHED"/>
+	<value value="1" name="VFD_UCHE_TRANS"/>
+	<value value="3" name="VFD_FETCH_INSTRUCTIONS"/>
+	<value value="5" name="VFD_BUSY_CYCLES"/>
+	<value value="6" name="VFD_STALL_CYCLES_UCHE"/>
+	<value value="7" name="VFD_STALL_CYCLES_HLSQ"/>
+	<value value="8" name="VFD_STALL_CYCLES_VPC_BYPASS"/>
+	<value value="9" name="VFD_STALL_CYCLES_VPC_ALLOC"/>
+	<value value="13" name="VFD_MODE_0_FIBERS"/>
+	<value value="14" name="VFD_MODE_1_FIBERS"/>
+	<value value="15" name="VFD_MODE_2_FIBERS"/>
+	<value value="16" name="VFD_MODE_3_FIBERS"/>
+	<value value="17" name="VFD_MODE_4_FIBERS"/>
+	<value value="18" name="VFD_BFIFO_STALL"/>
+	<value value="19" name="VFD_NUM_VERTICES_TOTAL"/>
+	<value value="20" name="VFD_PACKER_FULL"/>
+	<value value="21" name="VFD_UCHE_REQUEST_FIFO_FULL"/>
+	<value value="22" name="VFD_STARVE_CYCLES_PC"/>
+	<value value="23" name="VFD_STARVE_CYCLES_UCHE"/>
+</enum>
+
+<enum name="a4xx_vpc_perfcounter_select">
+	<value value="2" name="VPC_SP_LM_COMPONENTS"/>
+	<value value="3" name="VPC_SP0_LM_BYTES"/>
+	<value value="4" name="VPC_SP1_LM_BYTES"/>
+	<value value="5" name="VPC_SP2_LM_BYTES"/>
+	<value value="6" name="VPC_SP3_LM_BYTES"/>
+	<value value="7" name="VPC_WORKING_CYCLES"/>
+	<value value="8" name="VPC_STALL_CYCLES_LM"/>
+	<value value="9" name="VPC_STARVE_CYCLES_RAS"/>
+	<value value="10" name="VPC_STREAMOUT_CYCLES"/>
+	<value value="12" name="VPC_UCHE_TRANSACTIONS"/>
+	<value value="13" name="VPC_STALL_CYCLES_UCHE"/>
+	<value value="14" name="VPC_BUSY_CYCLES"/>
+	<value value="15" name="VPC_STARVE_CYCLES_SP"/>
+</enum>
+
+<enum name="a4xx_vsc_perfcounter_select">
+	<value value="0" name="VSC_BUSY_CYCLES"/>
+	<value value="1" name="VSC_WORKING_CYCLES"/>
+	<value value="2" name="VSC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="VSC_STARVE_CYCLES_RAS"/>
+	<value value="4" name="VSC_EOT_NUM"/>
+</enum>
+
+<domain name="A4XX" width="32">
+	<!-- RB registers -->
+	<reg32 offset="0x0cc0" name="RB_GMEM_BASE_ADDR"/>
+	<reg32 offset="0x0cc7" name="RB_PERFCTR_RB_SEL_0" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cc8" name="RB_PERFCTR_RB_SEL_1" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cc9" name="RB_PERFCTR_RB_SEL_2" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cca" name="RB_PERFCTR_RB_SEL_3" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ccb" name="RB_PERFCTR_RB_SEL_4" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ccc" name="RB_PERFCTR_RB_SEL_5" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ccd" name="RB_PERFCTR_RB_SEL_6" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cce" name="RB_PERFCTR_RB_SEL_7" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ccf" name="RB_PERFCTR_CCU_SEL_0" type="a4xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cd0" name="RB_PERFCTR_CCU_SEL_1" type="a4xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cd1" name="RB_PERFCTR_CCU_SEL_2" type="a4xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cd2" name="RB_PERFCTR_CCU_SEL_3" type="a4xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0ce0" name="RB_FRAME_BUFFER_DIMENSION">
+		<bitfield name="WIDTH" low="0" high="13" type="uint"/>
+		<bitfield name="HEIGHT" low="16" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="0x20cc" name="RB_CLEAR_COLOR_DW0"/>
+	<reg32 offset="0x20cd" name="RB_CLEAR_COLOR_DW1"/>
+	<reg32 offset="0x20ce" name="RB_CLEAR_COLOR_DW2"/>
+	<reg32 offset="0x20cf" name="RB_CLEAR_COLOR_DW3"/>
+	<reg32 offset="0x20a0" name="RB_MODE_CONTROL">
+		<!--
+		for non-bypass mode, these are bin width/height..  although
+		possibly bigger bitfields to hold entire width/height for
+		gmem-bypass??  Either way, it appears to need to be multiple
+		of 32..
+		-->
+		<bitfield name="WIDTH" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="8" high="13" shr="5" type="uint"/>
+		<bitfield name="ENABLE_GMEM" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x20a1" name="RB_RENDER_CONTROL">
+		<bitfield name="BINNING_PASS" pos="0" type="boolean"/>
+		<!-- nearly everything has bit3 set.. -->
+		<!-- bit5 set on resolve and tiling pass -->
+		<bitfield name="DISABLE_COLOR_PIPE" pos="5" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x20a2" name="RB_MSAA_CONTROL">
+		<bitfield name="DISABLE" pos="12" type="boolean"/>
+		<bitfield name="SAMPLES" low="13" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x20a3" name="RB_RENDER_CONTROL2">
+		<bitfield name="COORD_MASK" low="0" high="3" type="hex"/>
+		<bitfield name="SAMPLEMASK" pos="4" type="boolean"/>
+		<bitfield name="FACENESS" pos="5" type="boolean"/>
+		<bitfield name="SAMPLEID" pos="6" type="boolean"/>
+		<bitfield name="MSAA_SAMPLES" low="7" high="9" type="uint"/>
+		<bitfield name="SAMPLEID_HR" pos="11" type="boolean"/>
+		<bitfield name="IJ_PERSP_PIXEL" pos="12" type="boolean"/>
+		<!-- the 2 below are just educated guesses -->
+		<bitfield name="IJ_PERSP_CENTROID" pos="13" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="14" type="boolean"/>
+		<!-- needs to be enabled to get nopersp values,
+		     perhaps other cases too? -->
+		<bitfield name="SIZE" pos="15" type="boolean"/>
+	</reg32>
+	<array offset="0x20a4" name="RB_MRT" stride="5" length="8">
+		<reg32 offset="0x0" name="CONTROL">
+			<bitfield name="READ_DEST_ENABLE" pos="3" type="boolean"/>
+			<!-- both these bits seem to get set when enabling GL_BLEND.. -->
+			<bitfield name="BLEND" pos="4" type="boolean"/>
+			<bitfield name="BLEND2" pos="5" type="boolean"/>
+			<bitfield name="ROP_ENABLE" pos="6" type="boolean"/>
+			<bitfield name="ROP_CODE" low="8" high="11" type="a3xx_rop_code"/>
+			<bitfield name="COMPONENT_ENABLE" low="24" high="27" type="hex"/>
+		</reg32>
+		<reg32 offset="0x1" name="BUF_INFO">
+			<bitfield name="COLOR_FORMAT" low="0" high="5" type="a4xx_color_fmt"/>
+			<!--
+			    guestimate position of COLOR_TILE_MODE..  this works out if
+			    common value is 2, like on a3xx..
+			 -->
+			<bitfield name="COLOR_TILE_MODE" low="6" high="7" type="a4xx_tile_mode"/>
+			<bitfield name="DITHER_MODE" low="9" high="10" type="adreno_rb_dither_mode"/>
+			<bitfield name="COLOR_SWAP" low="11" high="12" type="a3xx_color_swap"/>
+			<bitfield name="COLOR_SRGB" pos="13" type="boolean"/>
+			<!-- note: possibly some # of lsb's aren't there: -->
+			<doc>
+				Pitch (actually, appears to be pitch in bytes, so really is a stride)
+				in GMEM, so pitch of the current tile.
+			</doc>
+			<bitfield name="COLOR_BUF_PITCH" low="14" high="31" shr="4" type="uint"/>
+		</reg32>
+		<reg32 offset="0x2" name="BASE"/>
+		<reg32 offset="0x3" name="CONTROL3">
+			<!-- probably missing some lsb's.. and guessing upper size -->
+			<!-- pitch * cpp * msaa: -->
+			<bitfield name="STRIDE" low="3" high="25" type="uint"/>
+		</reg32>
+		<reg32 offset="0x4" name="BLEND_CONTROL">
+			<bitfield name="RGB_SRC_FACTOR" low="0" high="4" type="adreno_rb_blend_factor"/>
+			<bitfield name="RGB_BLEND_OPCODE" low="5" high="7" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="RGB_DEST_FACTOR" low="8" high="12" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_SRC_FACTOR" low="16" high="20" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_BLEND_OPCODE" low="21" high="23" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="ALPHA_DEST_FACTOR" low="24" high="28" type="adreno_rb_blend_factor"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0x20f0" name="RB_BLEND_RED">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20f1" name="RB_BLEND_RED_F32" type="float"/>
+
+	<reg32 offset="0x20f2" name="RB_BLEND_GREEN">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20f3" name="RB_BLEND_GREEN_F32" type="float"/>
+
+	<reg32 offset="0x20f4" name="RB_BLEND_BLUE">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20f5" name="RB_BLEND_BLUE_F32" type="float"/>
+
+	<reg32 offset="0x20f6" name="RB_BLEND_ALPHA">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20f7" name="RB_BLEND_ALPHA_F32" type="float"/>
+
+	<reg32 offset="0x20f8" name="RB_ALPHA_CONTROL">
+		<bitfield name="ALPHA_REF" low="0" high="7" type="hex"/>
+		<bitfield name="ALPHA_TEST" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TEST_FUNC" low="9" high="11" type="adreno_compare_func"/>
+	</reg32>
+	<reg32 offset="0x20f9" name="RB_FS_OUTPUT">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="INDEPENDENT_BLEND" pos="8" type="boolean"/>
+		<!-- a guess? -->
+		<bitfield name="SAMPLE_MASK" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x20fa" name="RB_SAMPLE_COUNT_CONTROL">
+		<bitfield name="COPY" pos="1" type="boolean"/>
+		<bitfield name="ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+	<!-- always 00000000 for binning pass, else 0000000f: -->
+	<reg32 offset="0x20fb" name="RB_RENDER_COMPONENTS">
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+
+	<reg32 offset="0x20fc" name="RB_COPY_CONTROL">
+		<!-- not sure # of bits -->
+		<bitfield name="MSAA_RESOLVE" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MODE" low="4" high="6" type="adreno_rb_copy_control_mode"/>
+		<bitfield name="FASTCLEAR" low="8" high="11" type="hex"/>
+		<bitfield name="GMEM_BASE" low="14" high="31" shr="14" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20fd" name="RB_COPY_DEST_BASE">
+		<bitfield name="BASE" low="5" high="31" shr="5" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20fe" name="RB_COPY_DEST_PITCH">
+		<doc>actually, appears to be pitch in bytes, so really is a stride</doc>
+		<!-- not actually sure about max pitch... -->
+		<bitfield name="PITCH" low="0" high="31" shr="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0x20ff" name="RB_COPY_DEST_INFO">
+		<bitfield name="FORMAT" low="2" high="7" type="a4xx_color_fmt"/>
+		<bitfield name="SWAP" low="8" high="9" type="a3xx_color_swap"/>
+		<bitfield name="DITHER_MODE" low="10" high="11" type="adreno_rb_dither_mode"/>
+		<bitfield name="COMPONENT_ENABLE" low="14" high="17" type="hex"/>
+		<bitfield name="ENDIAN" low="18" high="20" type="adreno_rb_surface_endian"/>
+		<bitfield name="TILE" low="24" high="25" type="a4xx_tile_mode"/>
+	</reg32>
+	<reg32 offset="0x2100" name="RB_FS_OUTPUT_REG">
+		<!-- bit0 set except for binning pass.. -->
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+		<bitfield name="FRAG_WRITES_Z" pos="5" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2101" name="RB_DEPTH_CONTROL">
+		<!--
+			guessing that this matches a2xx with the stencil fields
+			moved out into RB_STENCIL_CONTROL?
+		 -->
+		<bitfield name="FRAG_WRITES_Z" pos="0" type="boolean"/>
+		<bitfield name="Z_TEST_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="ZFUNC" low="4" high="6" type="adreno_compare_func"/>
+		<bitfield name="Z_CLAMP_ENABLE" pos="7" type="boolean"/>
+		<bitfield name="EARLY_Z_DISABLE" pos="16" type="boolean"/>
+		<bitfield name="FORCE_FRAGZ_TO_FS" pos="17" type="boolean"/>
+		<doc>Z_READ_ENABLE bit is set for zfunc other than GL_ALWAYS or GL_NEVER</doc>
+		<bitfield name="Z_READ_ENABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2102" name="RB_DEPTH_CLEAR"/>
+	<reg32 offset="0x2103" name="RB_DEPTH_INFO">
+		<bitfield name="DEPTH_FORMAT" low="0" high="1" type="a4xx_depth_format"/>
+		<doc>
+			DEPTH_BASE is offset in GMEM to depth/stencil buffer, ie
+			bin_w * bin_h / 1024 (possible rounded up to multiple of
+			something??  ie. 39 becomes 40, 78 becomes 80.. 75 becomes
+			80.. so maybe it needs to be multiple of 8??
+		</doc>
+		<bitfield name="DEPTH_BASE" low="12" high="31" shr="12" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2104" name="RB_DEPTH_PITCH" shr="5" type="uint">
+		<doc>stride of depth/stencil buffer</doc>
+	</reg32>
+	<reg32 offset="0x2105" name="RB_DEPTH_PITCH2" shr="5" type="uint">
+		<doc>???</doc>
+	</reg32>
+	<reg32 offset="0x2106" name="RB_STENCIL_CONTROL">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="STENCIL_ENABLE_BF" pos="1" type="boolean"/>
+		<!--
+			set for stencil operations that require read from stencil
+			buffer, but not for example for stencil clear (which does
+			not require read).. so guessing this is analogous to
+			READ_DEST_ENABLE for color buffer..
+		 -->
+		<bitfield name="STENCIL_READ" pos="2" type="boolean"/>
+		<bitfield name="FUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="FAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="FUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="FAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0x2107" name="RB_STENCIL_CONTROL2">
+		<!--
+		This seems to be set by blob if there is a stencil buffer
+		at all in GMEM, regardless of whether it is enabled for
+		a particular draw (ie. RB_STENCIL_CONTROL).  Not really
+		sure if that is required or just a quirk of the blob
+		-->
+		<bitfield name="STENCIL_BUFFER" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2108" name="RB_STENCIL_INFO">
+		<bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+		<doc>Base address for stencil when not using interleaved depth/stencil</doc>
+		<bitfield name="STENCIL_BASE" low="12" high="31" shr="12" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2109" name="RB_STENCIL_PITCH" shr="5" type="uint">
+		<doc>pitch of stencil buffer when not using interleaved depth/stencil</doc>
+	</reg32>
+
+	<reg32 offset="0x210b" name="RB_STENCILREFMASK" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x210c" name="RB_STENCILREFMASK_BF" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x210d" name="RB_BIN_OFFSET" type="adreno_reg_xy"/>
+	<array offset="0x2120" name="RB_VPORT_Z_CLAMP" stride="2" length="16">
+		<reg32 offset="0x0" name="MIN"/>
+		<reg32 offset="0x1" name="MAX"/>
+	</array>
+
+	<!-- RBBM registers -->
+	<reg32 offset="0x0000" name="RBBM_HW_VERSION"/>
+	<reg32 offset="0x0002" name="RBBM_HW_CONFIGURATION"/>
+	<array offset="0x4" name="RBBM_CLOCK_CTL_TP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x8" name="RBBM_CLOCK_CTL2_TP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0xc" name="RBBM_CLOCK_HYST_TP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x10" name="RBBM_CLOCK_DELAY_TP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x0014" name="RBBM_CLOCK_CTL_UCHE "/>
+	<reg32 offset="0x0015" name="RBBM_CLOCK_CTL2_UCHE"/>
+	<reg32 offset="0x0016" name="RBBM_CLOCK_CTL3_UCHE"/>
+	<reg32 offset="0x0017" name="RBBM_CLOCK_CTL4_UCHE"/>
+	<reg32 offset="0x0018" name="RBBM_CLOCK_HYST_UCHE"/>
+	<reg32 offset="0x0019" name="RBBM_CLOCK_DELAY_UCHE"/>
+	<reg32 offset="0x001a" name="RBBM_CLOCK_MODE_GPC"/>
+	<reg32 offset="0x001b" name="RBBM_CLOCK_DELAY_GPC"/>
+	<reg32 offset="0x001c" name="RBBM_CLOCK_HYST_GPC"/>
+	<reg32 offset="0x001d" name="RBBM_CLOCK_CTL_TSE_RAS_RBBM"/>
+	<reg32 offset="0x001e" name="RBBM_CLOCK_HYST_TSE_RAS_RBBM"/>
+	<reg32 offset="0x001f" name="RBBM_CLOCK_DELAY_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0020" name="RBBM_CLOCK_CTL"/>
+	<reg32 offset="0x0021" name="RBBM_SP_HYST_CNT"/>
+	<reg32 offset="0x0022" name="RBBM_SW_RESET_CMD"/>
+	<reg32 offset="0x0023" name="RBBM_AHB_CTL0"/>
+	<reg32 offset="0x0024" name="RBBM_AHB_CTL1"/>
+	<reg32 offset="0x0025" name="RBBM_AHB_CMD"/>
+	<reg32 offset="0x0026" name="RBBM_RB_SUB_BLOCK_SEL_CTL"/>
+	<reg32 offset="0x0028" name="RBBM_RAM_ACC_63_32"/>
+	<reg32 offset="0x002b" name="RBBM_WAIT_IDLE_CLOCKS_CTL"/>
+	<reg32 offset="0x002f" name="RBBM_INTERFACE_HANG_INT_CTL"/>
+	<reg32 offset="0x0034" name="RBBM_INTERFACE_HANG_MASK_CTL4"/>
+	<reg32 offset="0x0036" name="RBBM_INT_CLEAR_CMD"/>
+	<reg32 offset="0x0037" name="RBBM_INT_0_MASK"/>
+	<reg32 offset="0x003e" name="RBBM_RBBM_CTL"/>
+	<reg32 offset="0x003f" name="RBBM_AHB_DEBUG_CTL"/>
+	<reg32 offset="0x0041" name="RBBM_VBIF_DEBUG_CTL"/>
+	<reg32 offset="0x0042" name="RBBM_CLOCK_CTL2"/>
+	<reg32 offset="0x0045" name="RBBM_BLOCK_SW_RESET_CMD"/>
+	<reg32 offset="0x0047" name="RBBM_RESET_CYCLES"/>
+	<reg32 offset="0x0049" name="RBBM_EXT_TRACE_BUS_CTL"/>
+	<reg32 offset="0x004a" name="RBBM_CFG_DEBBUS_SEL_A"/>
+	<reg32 offset="0x004b" name="RBBM_CFG_DEBBUS_SEL_B"/>
+	<reg32 offset="0x004c" name="RBBM_CFG_DEBBUS_SEL_C"/>
+	<reg32 offset="0x004d" name="RBBM_CFG_DEBBUS_SEL_D"/>
+	<reg32 offset="0x0098" name="RBBM_POWER_CNTL_IP">
+		<bitfield name="SW_COLLAPSE" pos="0" type="boolean"/>
+		<bitfield name="SP_TP_PWR_ON" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x009c" name="RBBM_PERFCTR_CP_0_LO"/>
+	<reg32 offset="0x009d" name="RBBM_PERFCTR_CP_0_HI"/>
+	<reg32 offset="0x009e" name="RBBM_PERFCTR_CP_1_LO"/>
+	<reg32 offset="0x009f" name="RBBM_PERFCTR_CP_1_HI"/>
+	<reg32 offset="0x00a0" name="RBBM_PERFCTR_CP_2_LO"/>
+	<reg32 offset="0x00a1" name="RBBM_PERFCTR_CP_2_HI"/>
+	<reg32 offset="0x00a2" name="RBBM_PERFCTR_CP_3_LO"/>
+	<reg32 offset="0x00a3" name="RBBM_PERFCTR_CP_3_HI"/>
+	<reg32 offset="0x00a4" name="RBBM_PERFCTR_CP_4_LO"/>
+	<reg32 offset="0x00a5" name="RBBM_PERFCTR_CP_4_HI"/>
+	<reg32 offset="0x00a6" name="RBBM_PERFCTR_CP_5_LO"/>
+	<reg32 offset="0x00a7" name="RBBM_PERFCTR_CP_5_HI"/>
+	<reg32 offset="0x00a8" name="RBBM_PERFCTR_CP_6_LO"/>
+	<reg32 offset="0x00a9" name="RBBM_PERFCTR_CP_6_HI"/>
+	<reg32 offset="0x00aa" name="RBBM_PERFCTR_CP_7_LO"/>
+	<reg32 offset="0x00ab" name="RBBM_PERFCTR_CP_7_HI"/>
+	<reg32 offset="0x00ac" name="RBBM_PERFCTR_RBBM_0_LO"/>
+	<reg32 offset="0x00ad" name="RBBM_PERFCTR_RBBM_0_HI"/>
+	<reg32 offset="0x00ae" name="RBBM_PERFCTR_RBBM_1_LO"/>
+	<reg32 offset="0x00af" name="RBBM_PERFCTR_RBBM_1_HI"/>
+	<reg32 offset="0x00b0" name="RBBM_PERFCTR_RBBM_2_LO"/>
+	<reg32 offset="0x00b1" name="RBBM_PERFCTR_RBBM_2_HI"/>
+	<reg32 offset="0x00b2" name="RBBM_PERFCTR_RBBM_3_LO"/>
+	<reg32 offset="0x00b3" name="RBBM_PERFCTR_RBBM_3_HI"/>
+	<reg32 offset="0x00b4" name="RBBM_PERFCTR_PC_0_LO"/>
+	<reg32 offset="0x00b5" name="RBBM_PERFCTR_PC_0_HI"/>
+	<reg32 offset="0x00b6" name="RBBM_PERFCTR_PC_1_LO"/>
+	<reg32 offset="0x00b7" name="RBBM_PERFCTR_PC_1_HI"/>
+	<reg32 offset="0x00b8" name="RBBM_PERFCTR_PC_2_LO"/>
+	<reg32 offset="0x00b9" name="RBBM_PERFCTR_PC_2_HI"/>
+	<reg32 offset="0x00ba" name="RBBM_PERFCTR_PC_3_LO"/>
+	<reg32 offset="0x00bb" name="RBBM_PERFCTR_PC_3_HI"/>
+	<reg32 offset="0x00bc" name="RBBM_PERFCTR_PC_4_LO"/>
+	<reg32 offset="0x00bd" name="RBBM_PERFCTR_PC_4_HI"/>
+	<reg32 offset="0x00be" name="RBBM_PERFCTR_PC_5_LO"/>
+	<reg32 offset="0x00bf" name="RBBM_PERFCTR_PC_5_HI"/>
+	<reg32 offset="0x00c0" name="RBBM_PERFCTR_PC_6_LO"/>
+	<reg32 offset="0x00c1" name="RBBM_PERFCTR_PC_6_HI"/>
+	<reg32 offset="0x00c2" name="RBBM_PERFCTR_PC_7_LO"/>
+	<reg32 offset="0x00c3" name="RBBM_PERFCTR_PC_7_HI"/>
+	<reg32 offset="0x00c4" name="RBBM_PERFCTR_VFD_0_LO"/>
+	<reg32 offset="0x00c5" name="RBBM_PERFCTR_VFD_0_HI"/>
+	<reg32 offset="0x00c6" name="RBBM_PERFCTR_VFD_1_LO"/>
+	<reg32 offset="0x00c7" name="RBBM_PERFCTR_VFD_1_HI"/>
+	<reg32 offset="0x00c8" name="RBBM_PERFCTR_VFD_2_LO"/>
+	<reg32 offset="0x00c9" name="RBBM_PERFCTR_VFD_2_HI"/>
+	<reg32 offset="0x00ca" name="RBBM_PERFCTR_VFD_3_LO"/>
+	<reg32 offset="0x00cb" name="RBBM_PERFCTR_VFD_3_HI"/>
+	<reg32 offset="0x00cc" name="RBBM_PERFCTR_VFD_4_LO"/>
+	<reg32 offset="0x00cd" name="RBBM_PERFCTR_VFD_4_HI"/>
+	<reg32 offset="0x00ce" name="RBBM_PERFCTR_VFD_5_LO"/>
+	<reg32 offset="0x00cf" name="RBBM_PERFCTR_VFD_5_HI"/>
+	<reg32 offset="0x00d0" name="RBBM_PERFCTR_VFD_6_LO"/>
+	<reg32 offset="0x00d1" name="RBBM_PERFCTR_VFD_6_HI"/>
+	<reg32 offset="0x00d2" name="RBBM_PERFCTR_VFD_7_LO"/>
+	<reg32 offset="0x00d3" name="RBBM_PERFCTR_VFD_7_HI"/>
+	<reg32 offset="0x00d4" name="RBBM_PERFCTR_HLSQ_0_LO"/>
+	<reg32 offset="0x00d5" name="RBBM_PERFCTR_HLSQ_0_HI"/>
+	<reg32 offset="0x00d6" name="RBBM_PERFCTR_HLSQ_1_LO"/>
+	<reg32 offset="0x00d7" name="RBBM_PERFCTR_HLSQ_1_HI"/>
+	<reg32 offset="0x00d8" name="RBBM_PERFCTR_HLSQ_2_LO"/>
+	<reg32 offset="0x00d9" name="RBBM_PERFCTR_HLSQ_2_HI"/>
+	<reg32 offset="0x00da" name="RBBM_PERFCTR_HLSQ_3_LO"/>
+	<reg32 offset="0x00db" name="RBBM_PERFCTR_HLSQ_3_HI"/>
+	<reg32 offset="0x00dc" name="RBBM_PERFCTR_HLSQ_4_LO"/>
+	<reg32 offset="0x00dd" name="RBBM_PERFCTR_HLSQ_4_HI"/>
+	<reg32 offset="0x00de" name="RBBM_PERFCTR_HLSQ_5_LO"/>
+	<reg32 offset="0x00df" name="RBBM_PERFCTR_HLSQ_5_HI"/>
+	<reg32 offset="0x00e0" name="RBBM_PERFCTR_HLSQ_6_LO"/>
+	<reg32 offset="0x00e1" name="RBBM_PERFCTR_HLSQ_6_HI"/>
+	<reg32 offset="0x00e2" name="RBBM_PERFCTR_HLSQ_7_LO"/>
+	<reg32 offset="0x00e3" name="RBBM_PERFCTR_HLSQ_7_HI"/>
+	<reg32 offset="0x00e4" name="RBBM_PERFCTR_VPC_0_LO"/>
+	<reg32 offset="0x00e5" name="RBBM_PERFCTR_VPC_0_HI"/>
+	<reg32 offset="0x00e6" name="RBBM_PERFCTR_VPC_1_LO"/>
+	<reg32 offset="0x00e7" name="RBBM_PERFCTR_VPC_1_HI"/>
+	<reg32 offset="0x00e8" name="RBBM_PERFCTR_VPC_2_LO"/>
+	<reg32 offset="0x00e9" name="RBBM_PERFCTR_VPC_2_HI"/>
+	<reg32 offset="0x00ea" name="RBBM_PERFCTR_VPC_3_LO"/>
+	<reg32 offset="0x00eb" name="RBBM_PERFCTR_VPC_3_HI"/>
+	<reg32 offset="0x00ec" name="RBBM_PERFCTR_CCU_0_LO"/>
+	<reg32 offset="0x00ed" name="RBBM_PERFCTR_CCU_0_HI"/>
+	<reg32 offset="0x00ee" name="RBBM_PERFCTR_CCU_1_LO"/>
+	<reg32 offset="0x00ef" name="RBBM_PERFCTR_CCU_1_HI"/>
+	<reg32 offset="0x00f0" name="RBBM_PERFCTR_CCU_2_LO"/>
+	<reg32 offset="0x00f1" name="RBBM_PERFCTR_CCU_2_HI"/>
+	<reg32 offset="0x00f2" name="RBBM_PERFCTR_CCU_3_LO"/>
+	<reg32 offset="0x00f3" name="RBBM_PERFCTR_CCU_3_HI"/>
+	<reg32 offset="0x00f4" name="RBBM_PERFCTR_TSE_0_LO"/>
+	<reg32 offset="0x00f5" name="RBBM_PERFCTR_TSE_0_HI"/>
+	<reg32 offset="0x00f6" name="RBBM_PERFCTR_TSE_1_LO"/>
+	<reg32 offset="0x00f7" name="RBBM_PERFCTR_TSE_1_HI"/>
+	<reg32 offset="0x00f8" name="RBBM_PERFCTR_TSE_2_LO"/>
+	<reg32 offset="0x00f9" name="RBBM_PERFCTR_TSE_2_HI"/>
+	<reg32 offset="0x00fa" name="RBBM_PERFCTR_TSE_3_LO"/>
+	<reg32 offset="0x00fb" name="RBBM_PERFCTR_TSE_3_HI"/>
+	<reg32 offset="0x00fc" name="RBBM_PERFCTR_RAS_0_LO"/>
+	<reg32 offset="0x00fd" name="RBBM_PERFCTR_RAS_0_HI"/>
+	<reg32 offset="0x00fe" name="RBBM_PERFCTR_RAS_1_LO"/>
+	<reg32 offset="0x00ff" name="RBBM_PERFCTR_RAS_1_HI"/>
+	<reg32 offset="0x0100" name="RBBM_PERFCTR_RAS_2_LO"/>
+	<reg32 offset="0x0101" name="RBBM_PERFCTR_RAS_2_HI"/>
+	<reg32 offset="0x0102" name="RBBM_PERFCTR_RAS_3_LO"/>
+	<reg32 offset="0x0103" name="RBBM_PERFCTR_RAS_3_HI"/>
+	<reg32 offset="0x0104" name="RBBM_PERFCTR_UCHE_0_LO"/>
+	<reg32 offset="0x0105" name="RBBM_PERFCTR_UCHE_0_HI"/>
+	<reg32 offset="0x0106" name="RBBM_PERFCTR_UCHE_1_LO"/>
+	<reg32 offset="0x0107" name="RBBM_PERFCTR_UCHE_1_HI"/>
+	<reg32 offset="0x0108" name="RBBM_PERFCTR_UCHE_2_LO"/>
+	<reg32 offset="0x0109" name="RBBM_PERFCTR_UCHE_2_HI"/>
+	<reg32 offset="0x010a" name="RBBM_PERFCTR_UCHE_3_LO"/>
+	<reg32 offset="0x010b" name="RBBM_PERFCTR_UCHE_3_HI"/>
+	<reg32 offset="0x010c" name="RBBM_PERFCTR_UCHE_4_LO"/>
+	<reg32 offset="0x010d" name="RBBM_PERFCTR_UCHE_4_HI"/>
+	<reg32 offset="0x010e" name="RBBM_PERFCTR_UCHE_5_LO"/>
+	<reg32 offset="0x010f" name="RBBM_PERFCTR_UCHE_5_HI"/>
+	<reg32 offset="0x0110" name="RBBM_PERFCTR_UCHE_6_LO"/>
+	<reg32 offset="0x0111" name="RBBM_PERFCTR_UCHE_6_HI"/>
+	<reg32 offset="0x0112" name="RBBM_PERFCTR_UCHE_7_LO"/>
+	<reg32 offset="0x0113" name="RBBM_PERFCTR_UCHE_7_HI"/>
+	<reg32 offset="0x0114" name="RBBM_PERFCTR_TP_0_LO"/>
+	<reg32 offset="0x0115" name="RBBM_PERFCTR_TP_0_HI"/>
+	<reg32 offset="0x0116" name="RBBM_PERFCTR_TP_1_LO"/>
+	<reg32 offset="0x0117" name="RBBM_PERFCTR_TP_1_HI"/>
+	<reg32 offset="0x0118" name="RBBM_PERFCTR_TP_2_LO"/>
+	<reg32 offset="0x0119" name="RBBM_PERFCTR_TP_2_HI"/>
+	<reg32 offset="0x011a" name="RBBM_PERFCTR_TP_3_LO"/>
+	<reg32 offset="0x011b" name="RBBM_PERFCTR_TP_3_HI"/>
+	<reg32 offset="0x011c" name="RBBM_PERFCTR_TP_4_LO"/>
+	<reg32 offset="0x011d" name="RBBM_PERFCTR_TP_4_HI"/>
+	<reg32 offset="0x011e" name="RBBM_PERFCTR_TP_5_LO"/>
+	<reg32 offset="0x011f" name="RBBM_PERFCTR_TP_5_HI"/>
+	<reg32 offset="0x0120" name="RBBM_PERFCTR_TP_6_LO"/>
+	<reg32 offset="0x0121" name="RBBM_PERFCTR_TP_6_HI"/>
+	<reg32 offset="0x0122" name="RBBM_PERFCTR_TP_7_LO"/>
+	<reg32 offset="0x0123" name="RBBM_PERFCTR_TP_7_HI"/>
+	<reg32 offset="0x0124" name="RBBM_PERFCTR_SP_0_LO"/>
+	<reg32 offset="0x0125" name="RBBM_PERFCTR_SP_0_HI"/>
+	<reg32 offset="0x0126" name="RBBM_PERFCTR_SP_1_LO"/>
+	<reg32 offset="0x0127" name="RBBM_PERFCTR_SP_1_HI"/>
+	<reg32 offset="0x0128" name="RBBM_PERFCTR_SP_2_LO"/>
+	<reg32 offset="0x0129" name="RBBM_PERFCTR_SP_2_HI"/>
+	<reg32 offset="0x012a" name="RBBM_PERFCTR_SP_3_LO"/>
+	<reg32 offset="0x012b" name="RBBM_PERFCTR_SP_3_HI"/>
+	<reg32 offset="0x012c" name="RBBM_PERFCTR_SP_4_LO"/>
+	<reg32 offset="0x012d" name="RBBM_PERFCTR_SP_4_HI"/>
+	<reg32 offset="0x012e" name="RBBM_PERFCTR_SP_5_LO"/>
+	<reg32 offset="0x012f" name="RBBM_PERFCTR_SP_5_HI"/>
+	<reg32 offset="0x0130" name="RBBM_PERFCTR_SP_6_LO"/>
+	<reg32 offset="0x0131" name="RBBM_PERFCTR_SP_6_HI"/>
+	<reg32 offset="0x0132" name="RBBM_PERFCTR_SP_7_LO"/>
+	<reg32 offset="0x0133" name="RBBM_PERFCTR_SP_7_HI"/>
+	<reg32 offset="0x0134" name="RBBM_PERFCTR_SP_8_LO"/>
+	<reg32 offset="0x0135" name="RBBM_PERFCTR_SP_8_HI"/>
+	<reg32 offset="0x0136" name="RBBM_PERFCTR_SP_9_LO"/>
+	<reg32 offset="0x0137" name="RBBM_PERFCTR_SP_9_HI"/>
+	<reg32 offset="0x0138" name="RBBM_PERFCTR_SP_10_LO"/>
+	<reg32 offset="0x0139" name="RBBM_PERFCTR_SP_10_HI"/>
+	<reg32 offset="0x013a" name="RBBM_PERFCTR_SP_11_LO"/>
+	<reg32 offset="0x013b" name="RBBM_PERFCTR_SP_11_HI"/>
+	<reg32 offset="0x013c" name="RBBM_PERFCTR_RB_0_LO"/>
+	<reg32 offset="0x013d" name="RBBM_PERFCTR_RB_0_HI"/>
+	<reg32 offset="0x013e" name="RBBM_PERFCTR_RB_1_LO"/>
+	<reg32 offset="0x013f" name="RBBM_PERFCTR_RB_1_HI"/>
+	<reg32 offset="0x0140" name="RBBM_PERFCTR_RB_2_LO"/>
+	<reg32 offset="0x0141" name="RBBM_PERFCTR_RB_2_HI"/>
+	<reg32 offset="0x0142" name="RBBM_PERFCTR_RB_3_LO"/>
+	<reg32 offset="0x0143" name="RBBM_PERFCTR_RB_3_HI"/>
+	<reg32 offset="0x0144" name="RBBM_PERFCTR_RB_4_LO"/>
+	<reg32 offset="0x0145" name="RBBM_PERFCTR_RB_4_HI"/>
+	<reg32 offset="0x0146" name="RBBM_PERFCTR_RB_5_LO"/>
+	<reg32 offset="0x0147" name="RBBM_PERFCTR_RB_5_HI"/>
+	<reg32 offset="0x0148" name="RBBM_PERFCTR_RB_6_LO"/>
+	<reg32 offset="0x0149" name="RBBM_PERFCTR_RB_6_HI"/>
+	<reg32 offset="0x014a" name="RBBM_PERFCTR_RB_7_LO"/>
+	<reg32 offset="0x014b" name="RBBM_PERFCTR_RB_7_HI"/>
+	<reg32 offset="0x014c" name="RBBM_PERFCTR_VSC_0_LO"/>
+	<reg32 offset="0x014d" name="RBBM_PERFCTR_VSC_0_HI"/>
+	<reg32 offset="0x014e" name="RBBM_PERFCTR_VSC_1_LO"/>
+	<reg32 offset="0x014f" name="RBBM_PERFCTR_VSC_1_HI"/>
+	<reg32 offset="0x0166" name="RBBM_PERFCTR_PWR_0_LO"/>
+	<reg32 offset="0x0167" name="RBBM_PERFCTR_PWR_0_HI"/>
+	<reg32 offset="0x0168" name="RBBM_PERFCTR_PWR_1_LO"/>
+	<reg32 offset="0x0169" name="RBBM_PERFCTR_PWR_1_HI"/>
+	<reg32 offset="0x016e" name="RBBM_ALWAYSON_COUNTER_LO"/>
+	<reg32 offset="0x016f" name="RBBM_ALWAYSON_COUNTER_HI"/>
+	<array offset="0x0068" name="RBBM_CLOCK_CTL_SP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x006c" name="RBBM_CLOCK_CTL2_SP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0070" name="RBBM_CLOCK_HYST_SP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0074" name="RBBM_CLOCK_DELAY_SP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0078" name="RBBM_CLOCK_CTL_RB" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x007c" name="RBBM_CLOCK_CTL2_RB" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0082" name="RBBM_CLOCK_CTL_MARB_CCU" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0086" name="RBBM_CLOCK_HYST_RB_MARB_CCU" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x0080" name="RBBM_CLOCK_HYST_COM_DCOM"/>
+	<reg32 offset="0x0081" name="RBBM_CLOCK_CTL_COM_DCOM"/>
+	<reg32 offset="0x008a" name="RBBM_CLOCK_CTL_HLSQ"/>
+	<reg32 offset="0x008b" name="RBBM_CLOCK_HYST_HLSQ"/>
+	<reg32 offset="0x008c" name="RBBM_CLOCK_DELAY_HLSQ"/>
+	<bitset name="A4XX_CGC_HLSQ">
+		<bitfield name="EARLY_CYC" low="20" high="22" type="uint"/>
+	</bitset>
+	<reg32 offset="0x008d" name="RBBM_CLOCK_DELAY_COM_DCOM"/>
+	<array offset="0x008e" name="RBBM_CLOCK_DELAY_RB_MARB_CCU_L1" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<bitset name="A4XX_INT0">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="RBBM_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="RBBM_REG_TIMEOUT" pos="2" type="boolean"/>
+		<bitfield name="RBBM_ME_MS_TIMEOUT" pos="3" type="boolean"/>
+		<bitfield name="RBBM_PFP_MS_TIMEOUT" pos="4" type="boolean"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="5" type="boolean"/>
+		<bitfield name="VFD_ERROR" pos="6" type="boolean"/>
+		<bitfield name="CP_SW_INT" pos="7" type="boolean"/>
+		<bitfield name="CP_T0_PACKET_IN_IB" pos="8" type="boolean"/>
+		<bitfield name="CP_OPCODE_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_RESERVED_BIT_ERROR" pos="10" type="boolean"/>
+		<bitfield name="CP_HW_FAULT" pos="11" type="boolean"/>
+		<bitfield name="CP_DMA" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2_INT" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1_INT" pos="14" type="boolean"/>
+		<bitfield name="CP_RB_INT" pos="15" type="boolean"/>
+		<bitfield name="CP_REG_PROTECT_FAULT" pos="16" type="boolean"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_VS_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="CP_PS_DONE_TS" pos="19" type="boolean"/>
+		<bitfield name="CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR_HALT" pos="21" type="boolean"/>
+		<bitfield name="MISC_HANG_DETECT" pos="24" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="25" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x0099" name="RBBM_SP_REGFILE_SLEEP_CNTL_0"/>
+	<reg32 offset="0x009a" name="RBBM_SP_REGFILE_SLEEP_CNTL_1"/>
+	<reg32 offset="0x0170" name="RBBM_PERFCTR_CTL"/>
+	<reg32 offset="0x0171" name="RBBM_PERFCTR_LOAD_CMD0"/>
+	<reg32 offset="0x0172" name="RBBM_PERFCTR_LOAD_CMD1"/>
+	<reg32 offset="0x0173" name="RBBM_PERFCTR_LOAD_CMD2"/>
+	<reg32 offset="0x0174" name="RBBM_PERFCTR_LOAD_VALUE_LO"/>
+	<reg32 offset="0x0175" name="RBBM_PERFCTR_LOAD_VALUE_HI"/>
+	<reg32 offset="0x0176" name="RBBM_PERFCTR_RBBM_SEL_0" type="a4xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0177" name="RBBM_PERFCTR_RBBM_SEL_1" type="a4xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0178" name="RBBM_PERFCTR_RBBM_SEL_2" type="a4xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0179" name="RBBM_PERFCTR_RBBM_SEL_3" type="a4xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x017a" name="RBBM_GPU_BUSY_MASKED"/>
+	<reg32 offset="0x017d" name="RBBM_INT_0_STATUS"/>
+	<reg32 offset="0x0182" name="RBBM_CLOCK_STATUS"/>
+	<reg32 offset="0x0189" name="RBBM_AHB_STATUS"/>
+	<reg32 offset="0x018c" name="RBBM_AHB_ME_SPLIT_STATUS"/>
+	<reg32 offset="0x018d" name="RBBM_AHB_PFP_SPLIT_STATUS"/>
+	<reg32 offset="0x018f" name="RBBM_AHB_ERROR_STATUS"/>
+	<reg32 offset="0x0191" name="RBBM_STATUS">
+		<bitfield name="HI_BUSY" pos="0" type="boolean"/>
+		<bitfield name="CP_ME_BUSY" pos="1" type="boolean"/>
+		<bitfield name="CP_PFP_BUSY" pos="2" type="boolean"/>
+		<bitfield name="CP_NRT_BUSY" pos="14" type="boolean"/>
+		<bitfield name="VBIF_BUSY" pos="15" type="boolean"/>
+		<bitfield name="TSE_BUSY" pos="16" type="boolean"/>
+		<bitfield name="RAS_BUSY" pos="17" type="boolean"/>
+		<bitfield name="RB_BUSY" pos="18" type="boolean"/>
+		<bitfield name="PC_DCALL_BUSY" pos="19" type="boolean"/>
+		<bitfield name="PC_VSD_BUSY" pos="20" type="boolean"/>
+		<bitfield name="VFD_BUSY" pos="21" type="boolean"/>
+		<bitfield name="VPC_BUSY" pos="22" type="boolean"/>
+		<bitfield name="UCHE_BUSY" pos="23" type="boolean"/>
+		<bitfield name="SP_BUSY" pos="24" type="boolean"/>
+		<bitfield name="TPL1_BUSY" pos="25" type="boolean"/>
+		<bitfield name="MARB_BUSY" pos="26" type="boolean"/>
+		<bitfield name="VSC_BUSY" pos="27" type="boolean"/>
+		<bitfield name="ARB_BUSY" pos="28" type="boolean"/>
+		<bitfield name="HLSQ_BUSY" pos="29" type="boolean"/>
+		<bitfield name="GPU_BUSY_NOHC" pos="30" type="boolean"/>
+		<bitfield name="GPU_BUSY" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x019f" name="RBBM_INTERFACE_RRDY_STATUS5"/>
+	<reg32 offset="0x01b0" name="RBBM_POWER_STATUS">
+		<bitfield name="SP_TP_PWR_ON" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01b8" name="RBBM_WAIT_IDLE_CLOCKS_CTL2"/>
+
+	<!-- CP registers -->
+	<reg32 offset="0x0228" name="CP_SCRATCH_UMASK"/>
+	<reg32 offset="0x0229" name="CP_SCRATCH_ADDR"/>
+	<reg32 offset="0x0200" name="CP_RB_BASE"/>
+	<reg32 offset="0x0201" name="CP_RB_CNTL"/>
+	<reg32 offset="0x0205" name="CP_RB_WPTR"/>
+	<reg32 offset="0x0203" name="CP_RB_RPTR_ADDR"/>
+	<reg32 offset="0x0204" name="CP_RB_RPTR"/>
+	<reg32 offset="0x0206" name="CP_IB1_BASE"/>
+	<reg32 offset="0x0207" name="CP_IB1_BUFSZ"/>
+	<reg32 offset="0x0208" name="CP_IB2_BASE"/>
+	<reg32 offset="0x0209" name="CP_IB2_BUFSZ"/>
+	<reg32 offset="0x020c" name="CP_ME_NRT_ADDR"/>
+	<reg32 offset="0x020d" name="CP_ME_NRT_DATA"/>
+	<reg32 offset="0x0217" name="CP_ME_RB_DONE_DATA"/>
+	<reg32 offset="0x0219" name="CP_QUEUE_THRESH2"/>
+	<reg32 offset="0x021b" name="CP_MERCIU_SIZE"/>
+	<reg32 offset="0x021c" name="CP_ROQ_ADDR"/>
+	<reg32 offset="0x021d" name="CP_ROQ_DATA"/>
+	<reg32 offset="0x021e" name="CP_MEQ_ADDR"/>
+	<reg32 offset="0x021f" name="CP_MEQ_DATA"/>
+	<reg32 offset="0x0220" name="CP_MERCIU_ADDR"/>
+	<reg32 offset="0x0221" name="CP_MERCIU_DATA"/>
+	<reg32 offset="0x0222" name="CP_MERCIU_DATA2"/>
+	<reg32 offset="0x0223" name="CP_PFP_UCODE_ADDR"/>
+	<reg32 offset="0x0224" name="CP_PFP_UCODE_DATA"/>
+	<reg32 offset="0x0225" name="CP_ME_RAM_WADDR"/>
+	<reg32 offset="0x0226" name="CP_ME_RAM_RADDR"/>
+	<reg32 offset="0x0227" name="CP_ME_RAM_DATA"/>
+	<reg32 offset="0x022a" name="CP_PREEMPT"/>
+	<reg32 offset="0x022c" name="CP_CNTL"/>
+	<reg32 offset="0x022d" name="CP_ME_CNTL"/>
+	<reg32 offset="0x022e" name="CP_DEBUG"/>
+	<reg32 offset="0x0231" name="CP_DEBUG_ECO_CONTROL"/>
+	<reg32 offset="0x0232" name="CP_DRAW_STATE_ADDR"/>
+	<array offset="0x0240" name="CP_PROTECT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG" type="adreno_cp_protect"/>
+	</array>
+	<reg32 offset="0x0250" name="CP_PROTECT_CTRL"/>
+	<reg32 offset="0x04c0" name="CP_ST_BASE"/>
+	<reg32 offset="0x04ce" name="CP_STQ_AVAIL"/>
+	<reg32 offset="0x04d0" name="CP_MERCIU_STAT"/>
+	<reg32 offset="0x04d2" name="CP_WFI_PEND_CTR"/>
+	<reg32 offset="0x04d8" name="CP_HW_FAULT"/>
+	<reg32 offset="0x04da" name="CP_PROTECT_STATUS"/>
+	<reg32 offset="0x04dd" name="CP_EVENTS_IN_FLIGHT"/>
+	<reg32 offset="0x0500" name="CP_PERFCTR_CP_SEL_0" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0501" name="CP_PERFCTR_CP_SEL_1" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0502" name="CP_PERFCTR_CP_SEL_2" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0503" name="CP_PERFCTR_CP_SEL_3" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0504" name="CP_PERFCTR_CP_SEL_4" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0505" name="CP_PERFCTR_CP_SEL_5" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0506" name="CP_PERFCTR_CP_SEL_6" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0507" name="CP_PERFCTR_CP_SEL_7" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x050b" name="CP_PERFCOMBINER_SELECT"/>
+	<array offset="0x0578" name="CP_SCRATCH" stride="1" length="23">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+
+
+	<!-- SP registers -->
+	<reg32 offset="0x0ec0" name="SP_VS_STATUS"/>
+	<reg32 offset="0x0ec3" name="SP_MODE_CONTROL"/>
+
+	<reg32 offset="0x0ec4" name="SP_PERFCTR_SP_SEL_0" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec5" name="SP_PERFCTR_SP_SEL_1" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec6" name="SP_PERFCTR_SP_SEL_2" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec7" name="SP_PERFCTR_SP_SEL_3" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec8" name="SP_PERFCTR_SP_SEL_4" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec9" name="SP_PERFCTR_SP_SEL_5" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0eca" name="SP_PERFCTR_SP_SEL_6" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecb" name="SP_PERFCTR_SP_SEL_7" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecc" name="SP_PERFCTR_SP_SEL_8" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecd" name="SP_PERFCTR_SP_SEL_9" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ece" name="SP_PERFCTR_SP_SEL_10" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecf" name="SP_PERFCTR_SP_SEL_11" type="a4xx_sp_perfcounter_select"/>
+
+	<reg32 offset="0x22c0" name="SP_SP_CTRL_REG">
+		<bitfield name="BINNING_PASS" pos="19" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x22c1" name="SP_INSTR_CACHE_CTRL">
+		<!-- set when VS in buffer mode: -->
+		<bitfield name="VS_BUFFER" pos="7" type="boolean"/>
+		<!-- set when FS in buffer mode: -->
+		<bitfield name="FS_BUFFER" pos="8" type="boolean"/>
+		<!-- set when both VS or FS in buffer mode: -->
+		<bitfield name="INSTR_BUFFER" pos="10" type="boolean"/>
+		<!-- TODO other bits probably matter when other stages active? -->
+	</reg32>
+
+	<bitset name="a4xx_sp_vs_fs_ctrl_reg0" inline="yes">
+		<!--
+			NOTE that SP_{VS,FS}_CTRL_REG1 are different, but so far REG0
+			appears to be the same..
+		-->
+		<bitfield name="THREADMODE" pos="0" type="a3xx_threadmode"/>
+		<!-- VARYING bit only for FS.. think it controls emitting (ei) flag? -->
+		<bitfield name="VARYING" pos="1" type="boolean"/>
+		<!-- maybe CACHEINVALID is two bits?? -->
+		<bitfield name="CACHEINVALID" pos="2" type="boolean"/>
+		<doc>
+			The full/half register footprint is in units of four components,
+			so if r0.x is used, that counts as all of r0.[xyzw] as used.
+			There are separate full/half register footprint values as the
+			full and half registers are independent (not overlapping).
+			Presumably the thread scheduler hardware allocates the full/half
+			register names from the actual physical register file and
+			handles the register renaming.
+		</doc>
+		<bitfield name="HALFREGFOOTPRINT" low="4" high="9" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="10" high="15" type="uint"/>
+		<!-- maybe INOUTREGOVERLAP is a bitflag? -->
+		<bitfield name="INOUTREGOVERLAP" low="18" high="19" type="uint"/>
+		<bitfield name="THREADSIZE" pos="20" type="a3xx_threadsize"/>
+		<bitfield name="SUPERTHREADMODE" pos="21" type="boolean"/>
+		<bitfield name="PIXLODENABLE" pos="22" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x22c4" name="SP_VS_CTRL_REG0" type="a4xx_sp_vs_fs_ctrl_reg0"/>
+	<reg32 offset="0x22c5" name="SP_VS_CTRL_REG1">
+		<bitfield name="CONSTLENGTH" low="0" high="7" type="uint"/>
+		<bitfield name="INITIALOUTSTANDING" low="24" high="30" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22c6" name="SP_VS_PARAM_REG">
+		<bitfield name="POSREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="PSIZEREGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="TOTALVSOUTVAR" low="20" high="31" type="uint"/>
+	</reg32>
+	<array offset="0x22c7" name="SP_VS_OUT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="8" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="9" high="12" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="24" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="25" high="28" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0x22d8" name="SP_VS_VPC_DST" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				These seem to be offsets for storage of the varyings.
+				Always seems to start from 8, possibly loc 0 and 4
+				are for gl_Position and gl_PointSize?
+			</doc>
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0x22e0" name="SP_VS_OBJ_OFFSET_REG">
+		<!-- always 00000000: -->
+		<doc>
+			From register spec:
+			SP_FS_OBJ_OFFSET_REG.CONSTOBJECTSTARTOFFSET [16:24]: Constant object
+			start offset in on chip RAM,
+			128bit aligned
+		</doc>
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22e1" name="SP_VS_OBJ_START"/>
+	<reg32 offset="0x22e2" name="SP_VS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x22e3" name="SP_VS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x22e5" name="SP_VS_LENGTH_REG" type="uint"/>
+	<reg32 offset="0x22e8" name="SP_FS_CTRL_REG0" type="a4xx_sp_vs_fs_ctrl_reg0"/>
+	<reg32 offset="0x22e9" name="SP_FS_CTRL_REG1">
+		<bitfield name="CONSTLENGTH" low="0" high="7" type="uint"/>
+		<bitfield name="FACENESS" pos="19" type="boolean"/>
+		<bitfield name="VARYING" pos="20" type="boolean"/>
+		<bitfield name="FRAGCOORD" pos="21" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x22ea" name="SP_FS_OBJ_OFFSET_REG">
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22eb" name="SP_FS_OBJ_START"/>
+	<reg32 offset="0x22ec" name="SP_FS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x22ed" name="SP_FS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x22ef" name="SP_FS_LENGTH_REG" type="uint"/>
+	<reg32 offset="0x22f0" name="SP_FS_OUTPUT_REG">
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+		<bitfield name="DEPTH_ENABLE" pos="7" type="boolean"/>
+		<!-- TODO double check.. for now assume same as a3xx -->
+		<bitfield name="DEPTH_REGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK_REGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<array offset="0x22f1" name="SP_FS_MRT" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="HALF_PRECISION" pos="8" type="boolean"/>
+			<bitfield name="COLOR_SINT" pos="10" type="boolean"/>
+			<bitfield name="COLOR_UINT" pos="11" type="boolean"/>
+			<bitfield name="MRTFORMAT" low="12" high="17" type="a4xx_color_fmt"/>
+			<bitfield name="COLOR_SRGB" pos="18" type="boolean"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x2300" name="SP_CS_CTRL_REG0" type="a4xx_sp_vs_fs_ctrl_reg0"/>
+	<reg32 offset="0x2301" name="SP_CS_OBJ_OFFSET_REG"/>
+	<reg32 offset="0x2302" name="SP_CS_OBJ_START"/>
+	<reg32 offset="0x2303" name="SP_CS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x2304" name="SP_CS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x2305" name="SP_CS_PVT_MEM_SIZE"/>
+	<reg32 offset="0x2306" name="SP_CS_LENGTH_REG" type="uint"/>
+	<reg32 offset="0x230d" name="SP_HS_OBJ_OFFSET_REG">
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x230e" name="SP_HS_OBJ_START"/>
+	<reg32 offset="0x230f" name="SP_HS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x2310" name="SP_HS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x2312" name="SP_HS_LENGTH_REG" type="uint"/>
+
+	<reg32 offset="0x231a" name="SP_DS_PARAM_REG">
+		<bitfield name="POSREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="TOTALGSOUTVAR" low="20" high="31" type="uint"/>
+	</reg32>
+	<array offset="0x231b" name="SP_DS_OUT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="8" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="9" high="12" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="24" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="25" high="28" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0x232c" name="SP_DS_VPC_DST" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				These seem to be offsets for storage of the varyings.
+				Always seems to start from 8, possibly loc 0 and 4
+				are for gl_Position and gl_PointSize?
+			</doc>
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x2334" name="SP_DS_OBJ_OFFSET_REG">
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2335" name="SP_DS_OBJ_START"/>
+	<reg32 offset="0x2336" name="SP_DS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x2337" name="SP_DS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x2339" name="SP_DS_LENGTH_REG" type="uint"/>
+
+	<reg32 offset="0x2341" name="SP_GS_PARAM_REG">
+		<bitfield name="POSREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="PRIMREGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="TOTALGSOUTVAR" low="20" high="31" type="uint"/>
+	</reg32>
+	<array offset="0x2342" name="SP_GS_OUT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="8" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="9" high="12" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="24" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="25" high="28" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0x2353" name="SP_GS_VPC_DST" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				These seem to be offsets for storage of the varyings.
+				Always seems to start from 8, possibly loc 0 and 4
+				are for gl_Position and gl_PointSize?
+			</doc>
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x235b" name="SP_GS_OBJ_OFFSET_REG">
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x235c" name="SP_GS_OBJ_START"/>
+	<reg32 offset="0x235d" name="SP_GS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x235e" name="SP_GS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x2360" name="SP_GS_LENGTH_REG" type="uint"/>
+
+	<!-- VPC registers -->
+	<reg32 offset="0x0e60" name="VPC_DEBUG_RAM_SEL"/>
+	<reg32 offset="0x0e61" name="VPC_DEBUG_RAM_READ"/>
+	<reg32 offset="0x0e64" name="VPC_DEBUG_ECO_CONTROL"/>
+	<reg32 offset="0x0e65" name="VPC_PERFCTR_VPC_SEL_0" type="a4xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e66" name="VPC_PERFCTR_VPC_SEL_1" type="a4xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e67" name="VPC_PERFCTR_VPC_SEL_2" type="a4xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e68" name="VPC_PERFCTR_VPC_SEL_3" type="a4xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x2140" name="VPC_ATTR">
+		<bitfield name="TOTALATTR" low="0" high="8" type="uint"/>
+		<!-- PSIZE bit set if gl_PointSize written: -->
+		<bitfield name="PSIZE" pos="9" type="boolean"/>
+		<bitfield name="THRDASSIGN" low="12" high="13" type="uint"/>
+		<bitfield name="ENABLE" pos="25" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2141" name="VPC_PACK">
+		<bitfield name="NUMBYPASSVAR" low="0" high="7" type="uint"/>
+		<bitfield name="NUMFPNONPOSVAR" low="8" high="15" type="uint"/>
+		<bitfield name="NUMNONPOSVSVAR" low="16" high="23" type="uint"/>
+	</reg32>
+	<array offset="0x2142" name="VPC_VARYING_INTERP" stride="1" length="8">
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+	<array offset="0x214a" name="VPC_VARYING_PS_REPL" stride="1" length="8">
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+
+	<reg32 offset="0x216e" name="VPC_SO_FLUSH_WADDR_3"/>
+
+	<!-- VSC registers -->
+	<reg32 offset="0x0c00" name="VSC_BIN_SIZE">
+		<bitfield name="WIDTH" low="0" high="4" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="5" high="9" shr="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0c01" name="VSC_SIZE_ADDRESS"/>
+	<reg32 offset="0x0c02" name="VSC_SIZE_ADDRESS2"/>
+	<reg32 offset="0x0c03" name="VSC_DEBUG_ECO_CONTROL"/>
+	<array offset="0x0c08" name="VSC_PIPE_CONFIG" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				Configures the mapping between VSC_PIPE buffer and
+				bin, X/Y specify the bin index in the horiz/vert
+				direction (0,0 is upper left, 0,1 is leftmost bin
+				on second row, and so on).  W/H specify the number
+				of bins assigned to this VSC_PIPE in the horiz/vert
+				dimension.
+			</doc>
+			<bitfield name="X" low="0" high="9" type="uint"/>
+			<bitfield name="Y" low="10" high="19" type="uint"/>
+			<bitfield name="W" low="20" high="23" type="uint"/>
+			<bitfield name="H" low="24" high="27" type="uint"/>
+		</reg32>
+	</array>
+	<array offset="0x0c10" name="VSC_PIPE_DATA_ADDRESS" stride="1" length="8">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0c18" name="VSC_PIPE_DATA_LENGTH" stride="1" length="8">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x0c41" name="VSC_PIPE_PARTIAL_POSN_1"/>
+	<reg32 offset="0x0c50" name="VSC_PERFCTR_VSC_SEL_0" type="a4xx_vsc_perfcounter_select"/>
+	<reg32 offset="0x0c51" name="VSC_PERFCTR_VSC_SEL_1" type="a4xx_vsc_perfcounter_select"/>
+
+	<!-- VFD registers -->
+	<reg32 offset="0x0e40" name="VFD_DEBUG_CONTROL"/>
+	<reg32 offset="0x0e43" name="VFD_PERFCTR_VFD_SEL_0" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e44" name="VFD_PERFCTR_VFD_SEL_1" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e45" name="VFD_PERFCTR_VFD_SEL_2" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e46" name="VFD_PERFCTR_VFD_SEL_3" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e47" name="VFD_PERFCTR_VFD_SEL_4" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e48" name="VFD_PERFCTR_VFD_SEL_5" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e49" name="VFD_PERFCTR_VFD_SEL_6" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e4a" name="VFD_PERFCTR_VFD_SEL_7" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x21d0" name="VGT_CL_INITIATOR"/>
+	<reg32 offset="0x21d9" name="VGT_EVENT_INITIATOR"/>
+	<reg32 offset="0x2200" name="VFD_CONTROL_0">
+		<doc>
+			TOTALATTRTOVS is # of attributes to vertex shader, in register
+			slots (ie. vec4+vec3 -> 7)
+		</doc>
+		<bitfield name="TOTALATTRTOVS" low="0" high="7" type="uint"/>
+		<doc>
+		BYPASSATTROVS seems to count varyings that are just directly
+		assigned from attributes (ie, "vFoo = aFoo;")
+		</doc>
+		<bitfield name="BYPASSATTROVS" low="9" high="16" type="uint"/>
+		<doc>STRMDECINSTRCNT is # of VFD_DECODE_INSTR registers valid</doc>
+		<bitfield name="STRMDECINSTRCNT" low="20" high="25" type="uint"/>
+		<doc>STRMFETCHINSTRCNT is # of VFD_FETCH_INSTR registers valid</doc>
+		<bitfield name="STRMFETCHINSTRCNT" low="26" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2201" name="VFD_CONTROL_1">
+		<doc>MAXSTORAGE could be # of attributes/vbo's</doc>
+		<bitfield name="MAXSTORAGE" low="0" high="15" type="uint"/>
+		<bitfield name="REGID4VTX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID4INST" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2202" name="VFD_CONTROL_2"/>
+	<reg32 offset="0x2203" name="VFD_CONTROL_3">
+		<bitfield name="REGID_VTXCNT" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSY" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2204" name="VFD_CONTROL_4"/>
+	<reg32 offset="0x2208" name="VFD_INDEX_OFFSET"/>
+	<array offset="0x220a" name="VFD_FETCH" stride="4" length="32">
+		<reg32 offset="0x0" name="INSTR_0">
+			<bitfield name="FETCHSIZE" low="0" high="6" type="uint"/>
+			<bitfield name="BUFSTRIDE" low="7" high="16" type="uint"/>
+			<bitfield name="SWITCHNEXT" pos="19" type="boolean"/>
+			<bitfield name="INSTANCED" pos="20" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x1" name="INSTR_1"/>
+		<reg32 offset="0x2" name="INSTR_2">
+			<bitfield name="SIZE" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="0x3" name="INSTR_3">
+			<!-- might well be bigger.. -->
+			<bitfield name="STEPRATE" low="0" high="8" type="uint"/>
+		</reg32>
+	</array>
+	<array offset="0x228a" name="VFD_DECODE" stride="1" length="32">
+		<reg32 offset="0x0" name="INSTR">
+			<bitfield name="WRITEMASK" low="0" high="3" type="hex"/>
+			<!-- not sure if this is a bit flag and another flag above it, or?? -->
+			<bitfield name="CONSTFILL" pos="4" type="boolean"/>
+			<bitfield name="FORMAT" low="6" high="11" type="a4xx_vtx_fmt"/>
+			<bitfield name="REGID" low="12" high="19" type="a3xx_regid"/>
+			<bitfield name="INT" pos="20" type="boolean"/>
+			<doc>SHIFTCNT appears to be size, ie. FLOAT_32_32_32 is 12, and BYTE_8 is 1</doc>
+			<bitfield name="SWAP" low="22" high="23" type="a3xx_color_swap"/>
+			<bitfield name="SHIFTCNT" low="24" high="28" type="uint"/>
+			<bitfield name="LASTCOMPVALID" pos="29" type="boolean"/>
+			<bitfield name="SWITCHNEXT" pos="30" type="boolean"/>
+		</reg32>
+	</array>
+
+	<!-- TPL1 registers -->
+	<reg32 offset="0x0f00" name="TPL1_DEBUG_ECO_CONTROL"/>
+	<!-- always 0000003a: -->
+	<reg32 offset="0x0f03" name="TPL1_TP_MODE_CONTROL"/>
+	<reg32 offset="0x0f04" name="TPL1_PERFCTR_TP_SEL_0" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f05" name="TPL1_PERFCTR_TP_SEL_1" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f06" name="TPL1_PERFCTR_TP_SEL_2" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f07" name="TPL1_PERFCTR_TP_SEL_3" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f08" name="TPL1_PERFCTR_TP_SEL_4" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f09" name="TPL1_PERFCTR_TP_SEL_5" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f0a" name="TPL1_PERFCTR_TP_SEL_6" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f0b" name="TPL1_PERFCTR_TP_SEL_7" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x2380" name="TPL1_TP_TEX_OFFSET"/>
+	<reg32 offset="0x2381" name="TPL1_TP_TEX_COUNT">
+		<bitfield name="VS" low="0" high="7" type="uint"/>
+		<bitfield name="HS" low="8" high="15" type="uint"/>
+		<bitfield name="DS" low="16" high="23" type="uint"/>
+		<bitfield name="GS" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2384" name="TPL1_TP_VS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x2387" name="TPL1_TP_HS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x238a" name="TPL1_TP_DS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x238d" name="TPL1_TP_GS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x23a0" name="TPL1_TP_FS_TEX_COUNT">
+		<bitfield name="FS" low="0" high="7" type="uint"/>
+		<bitfield name="CS" low="8" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23a1" name="TPL1_TP_FS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x23a4" name="TPL1_TP_CS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x23a5" name="TPL1_TP_CS_SAMPLER_BASE_ADDR"/>
+	<reg32 offset="0x23a6" name="TPL1_TP_CS_TEXMEMOBJ_BASE_ADDR"/>
+
+	<!-- GRAS registers -->
+	<reg32 offset="0x0c80" name="GRAS_TSE_STATUS"/>
+	<reg32 offset="0x0c81" name="GRAS_DEBUG_ECO_CONTROL"/>
+	<reg32 offset="0x0c88" name="GRAS_PERFCTR_TSE_SEL_0" type="a4xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c89" name="GRAS_PERFCTR_TSE_SEL_1" type="a4xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c8a" name="GRAS_PERFCTR_TSE_SEL_2" type="a4xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c8b" name="GRAS_PERFCTR_TSE_SEL_3" type="a4xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c8c" name="GRAS_PERFCTR_RAS_SEL_0" type="a4xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x0c8d" name="GRAS_PERFCTR_RAS_SEL_1" type="a4xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x0c8e" name="GRAS_PERFCTR_RAS_SEL_2" type="a4xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x0c8f" name="GRAS_PERFCTR_RAS_SEL_3" type="a4xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x2000" name="GRAS_CL_CLIP_CNTL">
+		<bitfield name="CLIP_DISABLE" pos="15" type="boolean"/>
+		<bitfield name="ZNEAR_CLIP_DISABLE" pos="16" type="boolean"/>
+		<bitfield name="ZFAR_CLIP_DISABLE" pos="17" type="boolean"/>
+		<bitfield name="ZERO_GB_SCALE_Z" pos="22" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2003" name="GRAS_CNTL">
+		<bitfield name="IJ_PERSP" pos="0" type="boolean"/>
+		<bitfield name="IJ_LINEAR" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2004" name="GRAS_CL_GB_CLIP_ADJ">
+		<bitfield name="HORZ" low="0" high="9" type="uint"/>
+		<bitfield name="VERT" low="10" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2008" name="GRAS_CL_VPORT_XOFFSET_0" type="float"/>
+	<reg32 offset="0x2009" name="GRAS_CL_VPORT_XSCALE_0" type="float"/>
+	<reg32 offset="0x200a" name="GRAS_CL_VPORT_YOFFSET_0" type="float"/>
+	<reg32 offset="0x200b" name="GRAS_CL_VPORT_YSCALE_0" type="float"/>
+	<reg32 offset="0x200c" name="GRAS_CL_VPORT_ZOFFSET_0" type="float"/>
+	<reg32 offset="0x200d" name="GRAS_CL_VPORT_ZSCALE_0" type="float"/>
+	<reg32 offset="0x2070" name="GRAS_SU_POINT_MINMAX">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2071" name="GRAS_SU_POINT_SIZE" type="fixed" radix="4"/>
+	<reg32 offset="0x2073" name="GRAS_ALPHA_CONTROL">
+		<bitfield name="ALPHA_TEST_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="FORCE_FRAGZ_TO_FS" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2074" name="GRAS_SU_POLY_OFFSET_SCALE" type="float"/>
+	<reg32 offset="0x2075" name="GRAS_SU_POLY_OFFSET_OFFSET" type="float"/>
+	<reg32 offset="0x2076" name="GRAS_SU_POLY_OFFSET_CLAMP" type="float"/>
+	<reg32 offset="0x2077" name="GRAS_DEPTH_CONTROL">
+		<!-- guestimating that this is GRAS based on addr -->
+		<bitfield name="FORMAT" low="0" high="1" type="a4xx_depth_format"/>
+	</reg32>
+	<reg32 offset="0x2078" name="GRAS_SU_MODE_CONTROL">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FRONT_CW" pos="2" type="boolean"/>
+		<bitfield name="LINEHALFWIDTH" low="3" high="10" radix="2" type="fixed"/>
+		<bitfield name="POLY_OFFSET" pos="11" type="boolean"/>
+		<bitfield name="MSAA_ENABLE" pos="13" type="boolean"/>
+		<!-- bit20 set whenever RENDER_MODE = RB_RENDERING_PASS -->
+		<bitfield name="RENDERING_PASS" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x207b" name="GRAS_SC_CONTROL">
+		<!-- complete wild-ass-guess for sizes of these bitfields.. -->
+		<bitfield name="RENDER_MODE" low="2" high="3" type="a3xx_render_mode"/>
+		<bitfield name="MSAA_SAMPLES" low="7" high="9" type="uint"/>
+		<bitfield name="MSAA_DISABLE" pos="11" type="boolean"/>
+		<bitfield name="RASTER_MODE" low="12" high="15"/>
+	</reg32>
+	<reg32 offset="0x207c" name="GRAS_SC_SCREEN_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x207d" name="GRAS_SC_SCREEN_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x209c" name="GRAS_SC_WINDOW_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x209d" name="GRAS_SC_WINDOW_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x209e" name="GRAS_SC_EXTENT_WINDOW_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x209f" name="GRAS_SC_EXTENT_WINDOW_TL" type="adreno_reg_xy"/>
+
+	<!-- UCHE registers -->
+	<reg32 offset="0x0e80" name="UCHE_CACHE_MODE_CONTROL"/>
+	<reg32 offset="0x0e83" name="UCHE_TRAP_BASE_LO"/>
+	<reg32 offset="0x0e84" name="UCHE_TRAP_BASE_HI"/>
+	<reg32 offset="0x0e88" name="UCHE_CACHE_STATUS"/>
+	<reg32 offset="0x0e8a" name="UCHE_INVALIDATE0"/>
+	<reg32 offset="0x0e8b" name="UCHE_INVALIDATE1"/>
+	<reg32 offset="0x0e8c" name="UCHE_CACHE_WAYS_VFD"/>
+	<reg32 offset="0x0e8e" name="UCHE_PERFCTR_UCHE_SEL_0" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e8f" name="UCHE_PERFCTR_UCHE_SEL_1" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e90" name="UCHE_PERFCTR_UCHE_SEL_2" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e91" name="UCHE_PERFCTR_UCHE_SEL_3" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e92" name="UCHE_PERFCTR_UCHE_SEL_4" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e93" name="UCHE_PERFCTR_UCHE_SEL_5" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e94" name="UCHE_PERFCTR_UCHE_SEL_6" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e95" name="UCHE_PERFCTR_UCHE_SEL_7" type="a4xx_uche_perfcounter_select"/>
+
+	<!-- HLSQ registers -->
+	<reg32 offset="0x0e00" name="HLSQ_TIMEOUT_THRESHOLD"/>
+	<reg32 offset="0x0e04" name="HLSQ_DEBUG_ECO_CONTROL"/>
+	<!-- always 00000000: -->
+	<reg32 offset="0x0e05" name="HLSQ_MODE_CONTROL"/>
+	<reg32 offset="0x0e0e" name="HLSQ_PERF_PIPE_MASK"/>
+	<reg32 offset="0x0e06" name="HLSQ_PERFCTR_HLSQ_SEL_0" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e07" name="HLSQ_PERFCTR_HLSQ_SEL_1" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e08" name="HLSQ_PERFCTR_HLSQ_SEL_2" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e09" name="HLSQ_PERFCTR_HLSQ_SEL_3" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e0a" name="HLSQ_PERFCTR_HLSQ_SEL_4" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e0b" name="HLSQ_PERFCTR_HLSQ_SEL_5" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e0c" name="HLSQ_PERFCTR_HLSQ_SEL_6" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e0d" name="HLSQ_PERFCTR_HLSQ_SEL_7" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x23c0" name="HLSQ_CONTROL_0_REG">
+		<!-- I guess same as a3xx, but so far only seen 08000050 -->
+		<bitfield name="FSTHREADSIZE" pos="4" type="a3xx_threadsize"/>
+		<bitfield name="FSSUPERTHREADENABLE" pos="6" type="boolean"/>
+		<bitfield name="SPSHADERRESTART" pos="9" type="boolean"/>
+		<bitfield name="RESERVED2" pos="10" type="boolean"/>
+		<bitfield name="CHUNKDISABLE" pos="26" type="boolean"/>
+		<bitfield name="CONSTMODE" pos="27" type="uint"/>
+		<bitfield name="LAZYUPDATEDISABLE" pos="28" type="boolean"/>
+		<bitfield name="SPCONSTFULLUPDATE" pos="29" type="boolean"/>
+		<bitfield name="TPFULLUPDATE" pos="30" type="boolean"/>
+		<bitfield name="SINGLECONTEXT" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x23c1" name="HLSQ_CONTROL_1_REG">
+		<bitfield name="VSTHREADSIZE" pos="6" type="a3xx_threadsize"/>
+		<bitfield name="VSSUPERTHREADENABLE" pos="8" type="boolean"/>
+		<bitfield name="RESERVED1" pos="9" type="boolean"/>
+		<bitfield name="COORDREGID" low="16" high="23" type="a3xx_regid"/>
+		<!-- set if gl_FragCoord.[zw] used in frag shader: -->
+		<bitfield name="ZWCOORDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23c2" name="HLSQ_CONTROL_2_REG">
+		<bitfield name="PRIMALLOCTHRESHOLD" low="26" high="31" type="uint"/>
+		<bitfield name="FACEREGID" low="2" high="9" type="a3xx_regid"/>
+		<bitfield name="SAMPLEID_REGID" low="10" high="17" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK_REGID" low="18" high="25" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23c3" name="HLSQ_CONTROL_3_REG">
+		<!-- register loaded with position (bary.f) -->
+		<bitfield name="IJ_PERSP_PIXEL" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_PIXEL" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="IJ_PERSP_CENTROID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_CENTROID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<!-- 0x23c4 3 regids, lowest one goes to 0 when *not* per-sample shading -->
+	<reg32 offset="0x23c4" name="HLSQ_CONTROL_4_REG">
+		<bitfield name="IJ_PERSP_SAMPLE" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+
+	<bitset name="a4xx_xs_control_reg" inline="yes">
+		<bitfield name="CONSTLENGTH" low="0" high="7" type="uint"/>
+		<bitfield name="CONSTOBJECTOFFSET" low="8" high="14" type="uint"/>
+		<bitfield name="SSBO_ENABLE" pos="15" type="boolean"/>
+		<bitfield name="ENABLED" pos="16" type="boolean"/>
+		<bitfield name="SHADEROBJOFFSET" low="17" high="23" type="uint"/>
+		<bitfield name="INSTRLENGTH" low="24" high="31" type="uint"/>
+	</bitset>
+	<reg32 offset="0x23c5" name="HLSQ_VS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23c6" name="HLSQ_FS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23c7" name="HLSQ_HS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23c8" name="HLSQ_DS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23c9" name="HLSQ_GS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23ca" name="HLSQ_CS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23cd" name="HLSQ_CL_NDRANGE_0">
+		<bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23ce" name="HLSQ_CL_NDRANGE_1">
+		<bitfield name="SIZE_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23cf" name="HLSQ_CL_NDRANGE_2"/>
+	<reg32 offset="0x23d0" name="HLSQ_CL_NDRANGE_3">
+		<bitfield name="SIZE_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23d1" name="HLSQ_CL_NDRANGE_4"/>
+	<reg32 offset="0x23d2" name="HLSQ_CL_NDRANGE_5">
+		<bitfield name="SIZE_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23d3" name="HLSQ_CL_NDRANGE_6"/>
+	<reg32 offset="0x23d4" name="HLSQ_CL_CONTROL_0">
+		<bitfield name="WGIDCONSTID" low="0" high="11" type="a3xx_regid"/>
+		<bitfield name="KERNELDIMCONSTID" low="12" high="23" type="a3xx_regid"/>
+		<bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23d5" name="HLSQ_CL_CONTROL_1">
+		<!-- GLOBALSIZECONSTID? "kernel size" -->
+		<bitfield name="UNK0CONSTID" low="0" high="11" type="a3xx_regid"/>
+		<bitfield name="WORKGROUPSIZECONSTID" low="12" high="23" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23d6" name="HLSQ_CL_KERNEL_CONST">
+		<!-- GLOBALOFFSETCONSTID -->
+		<bitfield name="UNK0CONSTID" low="0" high="11" type="a3xx_regid"/>
+		<bitfield name="NUMWGCONSTID" low="12" high="23" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23d7" name="HLSQ_CL_KERNEL_GROUP_X"/>
+	<reg32 offset="0x23d8" name="HLSQ_CL_KERNEL_GROUP_Y"/>
+	<reg32 offset="0x23d9" name="HLSQ_CL_KERNEL_GROUP_Z"/>
+	<reg32 offset="0x23da" name="HLSQ_CL_WG_OFFSET">
+		<!-- WGOFFSETCONSTID -->
+		<bitfield name="UNK0CONSTID" low="0" high="11" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23db" name="HLSQ_UPDATE_CONTROL"/>
+
+	<!-- PC registers -->
+	<reg32 offset="0x0d00" name="PC_BINNING_COMMAND">
+		<bitfield name="BINNING_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0d08" name="PC_TESSFACTOR_ADDR"/>
+	<reg32 offset="0x0d0c" name="PC_DRAWCALL_SETUP_OVERRIDE"/>
+	<reg32 offset="0x0d10" name="PC_PERFCTR_PC_SEL_0" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d11" name="PC_PERFCTR_PC_SEL_1" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d12" name="PC_PERFCTR_PC_SEL_2" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d13" name="PC_PERFCTR_PC_SEL_3" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d14" name="PC_PERFCTR_PC_SEL_4" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d15" name="PC_PERFCTR_PC_SEL_5" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d16" name="PC_PERFCTR_PC_SEL_6" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d17" name="PC_PERFCTR_PC_SEL_7" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x21c0" name="PC_BIN_BASE"/>
+	<reg32 offset="0x21c2" name="PC_VSTREAM_CONTROL">
+		<doc>SIZE is current pipe width * height (in tiles)</doc>
+		<bitfield name="SIZE" low="16" high="21" type="uint"/>
+		<doc>
+			N is some sort of slot # between 0..(SIZE-1).  In case
+			multiple tiles use same pipe, each tile gets unique slot #
+		</doc>
+		<bitfield name="N" low="22" high="26" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21c4" name="PC_PRIM_VTX_CNTL">
+		<!-- bit0 set if there is >= 1 varying (actually used by FS) -->
+		<bitfield name="VAROUT" low="0" high="3" type="uint">
+			<doc>in groups of 4x vec4, blob only uses values
+			0, 1, 2, 4, 6, 8</doc>
+		</bitfield>
+		<bitfield name="PRIMITIVE_RESTART" pos="20" type="boolean"/>
+		<bitfield name="PROVOKING_VTX_LAST" pos="25" type="boolean"/>
+		<!-- PSIZE bit set if gl_PointSize written: -->
+		<bitfield name="PSIZE" pos="26" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x21c5" name="PC_PRIM_VTX_CNTL2">
+		<bitfield name="POLYMODE_FRONT_PTYPE" low="0" high="2" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_BACK_PTYPE" low="3" high="5" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_ENABLE" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x21c6" name="PC_RESTART_INDEX"/>
+	<reg32 offset="0x21e5" name="PC_GS_PARAM">
+		<bitfield name="MAX_VERTICES" low="0" high="9" type="uint"/><!-- +1, i.e. max is 1024 -->
+		<bitfield name="INVOCATIONS" low="11" high="15" type="uint"/><!-- +1, i.e. max is 32 -->
+		<bitfield name="PRIMTYPE" low="23" high="24" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="LAYER" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x21e7" name="PC_HS_PARAM">
+		<bitfield name="VERTICES_OUT" low="0" high="5" type="uint"/>
+		<bitfield name="SPACING" low="21" high="22" type="a4xx_tess_spacing"/>
+		<bitfield name="CW" pos="23" type="boolean"/>
+		<bitfield name="CONNECTED" pos="24" type="boolean"/>
+	</reg32>
+
+	<!-- VBIF registers -->
+	<reg32 offset="0x3000" name="VBIF_VERSION"/>
+	<reg32 offset="0x3001" name="VBIF_CLKON">
+		<bitfield name="FORCE_ON_TESTBUS" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x301c" name="VBIF_ABIT_SORT"/>
+	<reg32 offset="0x301d" name="VBIF_ABIT_SORT_CONF"/>
+	<reg32 offset="0x302a" name="VBIF_GATE_OFF_WRREQ_EN"/>
+	<reg32 offset="0x302c" name="VBIF_IN_RD_LIM_CONF0"/>
+	<reg32 offset="0x302d" name="VBIF_IN_RD_LIM_CONF1"/>
+	<reg32 offset="0x3030" name="VBIF_IN_WR_LIM_CONF0"/>
+	<reg32 offset="0x3031" name="VBIF_IN_WR_LIM_CONF1"/>
+	<reg32 offset="0x3049" name="VBIF_ROUND_ROBIN_QOS_ARB"/>
+	<reg32 offset="0x30c0" name="VBIF_PERF_CNT_EN0"/>
+	<reg32 offset="0x30c1" name="VBIF_PERF_CNT_EN1"/>
+	<reg32 offset="0x30c2" name="VBIF_PERF_CNT_EN2"/>
+	<reg32 offset="0x30c3" name="VBIF_PERF_CNT_EN3"/>
+	<reg32 offset="0x30d0" name="VBIF_PERF_CNT_SEL0" type="a4xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d1" name="VBIF_PERF_CNT_SEL1" type="a4xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d2" name="VBIF_PERF_CNT_SEL2" type="a4xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d3" name="VBIF_PERF_CNT_SEL3" type="a4xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d8" name="VBIF_PERF_CNT_LOW0"/>
+	<reg32 offset="0x30d9" name="VBIF_PERF_CNT_LOW1"/>
+	<reg32 offset="0x30da" name="VBIF_PERF_CNT_LOW2"/>
+	<reg32 offset="0x30db" name="VBIF_PERF_CNT_LOW3"/>
+	<reg32 offset="0x30e0" name="VBIF_PERF_CNT_HIGH0"/>
+	<reg32 offset="0x30e1" name="VBIF_PERF_CNT_HIGH1"/>
+	<reg32 offset="0x30e2" name="VBIF_PERF_CNT_HIGH2"/>
+	<reg32 offset="0x30e3" name="VBIF_PERF_CNT_HIGH3"/>
+	<reg32 offset="0x3100" name="VBIF_PERF_PWR_CNT_EN0"/>
+	<reg32 offset="0x3101" name="VBIF_PERF_PWR_CNT_EN1"/>
+	<reg32 offset="0x3102" name="VBIF_PERF_PWR_CNT_EN2"/>
+
+	<!--
+	Unknown registers:
+	(mostly related to DX11 features not used yet, I guess?)
+	-->
+
+	<!-- always 00000006: -->
+	<reg32 offset="0x0cc5" name="UNKNOWN_0CC5"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x0cc6" name="UNKNOWN_0CC6"/>
+
+	<!-- always 00000001: -->
+	<reg32 offset="0x0d01" name="UNKNOWN_0D01"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x0e42" name="UNKNOWN_0E42"/>
+
+	<!-- always 00040000: -->
+	<reg32 offset="0x0ec2" name="UNKNOWN_0EC2"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2001" name="UNKNOWN_2001"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x209b" name="UNKNOWN_209B"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x20ef" name="UNKNOWN_20EF"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2152" name="UNKNOWN_2152"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2153" name="UNKNOWN_2153"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2154" name="UNKNOWN_2154"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2155" name="UNKNOWN_2155"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2156" name="UNKNOWN_2156"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2157" name="UNKNOWN_2157"/>
+
+	<!-- always 0000000b: -->
+	<reg32 offset="0x21c3" name="UNKNOWN_21C3"/>
+
+	<!-- always 00000001: -->
+	<reg32 offset="0x21e6" name="UNKNOWN_21E6"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2209" name="UNKNOWN_2209"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x22d7" name="UNKNOWN_22D7"/>
+
+        <!-- always 00fcfc00: -->
+        <reg32 offset="0x2352" name="UNKNOWN_2352"/>
+
+</domain>
+
+
+<domain name="A4XX_TEX_SAMP" width="32">
+	<doc>Texture sampler dwords</doc>
+	<enum name="a4xx_tex_filter">
+		<value name="A4XX_TEX_NEAREST" value="0"/>
+		<value name="A4XX_TEX_LINEAR" value="1"/>
+		<value name="A4XX_TEX_ANISO" value="2"/>
+	</enum>
+	<enum name="a4xx_tex_clamp">
+		<value name="A4XX_TEX_REPEAT" value="0"/>
+		<value name="A4XX_TEX_CLAMP_TO_EDGE" value="1"/>
+		<value name="A4XX_TEX_MIRROR_REPEAT" value="2"/>
+		<value name="A4XX_TEX_CLAMP_TO_BORDER" value="3"/>
+		<value name="A4XX_TEX_MIRROR_CLAMP" value="4"/>
+	</enum>
+	<enum name="a4xx_tex_aniso">
+		<value name="A4XX_TEX_ANISO_1" value="0"/>
+		<value name="A4XX_TEX_ANISO_2" value="1"/>
+		<value name="A4XX_TEX_ANISO_4" value="2"/>
+		<value name="A4XX_TEX_ANISO_8" value="3"/>
+		<value name="A4XX_TEX_ANISO_16" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="MIPFILTER_LINEAR_NEAR" pos="0" type="boolean"/>
+		<bitfield name="XY_MAG" low="1" high="2" type="a4xx_tex_filter"/>
+		<bitfield name="XY_MIN" low="3" high="4" type="a4xx_tex_filter"/>
+		<bitfield name="WRAP_S" low="5" high="7" type="a4xx_tex_clamp"/>
+		<bitfield name="WRAP_T" low="8" high="10" type="a4xx_tex_clamp"/>
+		<bitfield name="WRAP_R" low="11" high="13" type="a4xx_tex_clamp"/>
+		<bitfield name="ANISO" low="14" high="16" type="a4xx_tex_aniso"/>
+		<bitfield name="LOD_BIAS" low="19" high="31" type="fixed" radix="8"/><!-- no idea how many bits for real -->
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="COMPARE_FUNC" low="1" high="3" type="adreno_compare_func"/>
+		<bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="4" type="boolean"/>
+		<bitfield name="UNNORM_COORDS" pos="5" type="boolean"/>
+		<bitfield name="MIPFILTER_LINEAR_FAR" pos="6" type="boolean"/>
+		<bitfield name="MAX_LOD" low="8" high="19" type="ufixed" radix="8"/>
+		<bitfield name="MIN_LOD" low="20" high="31" type="ufixed" radix="8"/>
+	</reg32>
+</domain>
+
+<domain name="A4XX_TEX_CONST" width="32">
+	<doc>Texture constant dwords</doc>
+	<enum name="a4xx_tex_swiz">
+		<!-- same as a2xx? -->
+		<value name="A4XX_TEX_X" value="0"/>
+		<value name="A4XX_TEX_Y" value="1"/>
+		<value name="A4XX_TEX_Z" value="2"/>
+		<value name="A4XX_TEX_W" value="3"/>
+		<value name="A4XX_TEX_ZERO" value="4"/>
+		<value name="A4XX_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="a4xx_tex_type">
+		<value name="A4XX_TEX_1D" value="0"/>
+		<value name="A4XX_TEX_2D" value="1"/>
+		<value name="A4XX_TEX_CUBE" value="2"/>
+		<value name="A4XX_TEX_3D" value="3"/>
+		<value name="A4XX_TEX_BUFFER" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TILED" pos="0" type="boolean"/>
+		<bitfield name="SRGB" pos="2" type="boolean"/>
+		<bitfield name="SWIZ_X" low="4" high="6" type="a4xx_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="7" high="9" type="a4xx_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="10" high="12" type="a4xx_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="13" high="15" type="a4xx_tex_swiz"/>
+		<bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
+		<bitfield name="FMT" low="22" high="28" type="a4xx_tex_fmt"/>
+		<bitfield name="TYPE" low="29" high="31" type="a4xx_tex_type"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="HEIGHT" low="0" high="14" type="uint"/>
+		<bitfield name="WIDTH" low="15" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<!-- minimum pitch (for mipmap levels): log2(pitchalign / 32) -->
+		<bitfield name="PITCHALIGN" low="0" high="3" type="uint"/>
+		<bitfield name="BUFFER" pos="6" type="boolean"/>
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="9" high="29" type="uint"/>
+		<bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="LAYERSZ" low="0" high="13" shr="12" type="uint"/>
+		<bitfield name="DEPTH" low="18" high="30" type="uint"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<!--
+		like a3xx we seem to have two LAYERSZ's.. although this one
+		seems too small to be useful, and when it overflows blob just
+		sets it to zero..
+		 -->
+		<bitfield name="LAYERSZ" low="0" high="3" shr="12" type="uint"/>
+		<bitfield name="BASE" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="5" name="5"/>
+	<reg32 offset="6" name="6"/>
+	<reg32 offset="7" name="7"/>
+</domain>
+
+<domain name="A4XX_SSBO_0" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="0" high="21" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ARRAY_PITCH" low="12" high="25" shr="12" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!-- bytes per pixel: -->
+		<bitfield name="CPP" low="0" high="5" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="A4XX_SSBO_1" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="CPP" low="0" high="4" type="uint"/>
+		<bitfield name="FMT" low="8" high="15" type="a4xx_color_fmt"/>
+		<bitfield name="WIDTH" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="HEIGHT" low="0" high="15" type="uint"/>
+		<bitfield name="DEPTH" low="16" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/adreno/a5xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/adreno/a5xx.xml
@@ -0,0 +1,3039 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+<enum name="a5xx_color_fmt">
+	<value value="0x02" name="RB5_A8_UNORM"/>
+	<value value="0x03" name="RB5_R8_UNORM"/>
+	<value value="0x04" name="RB5_R8_SNORM"/>
+	<value value="0x05" name="RB5_R8_UINT"/>
+	<value value="0x06" name="RB5_R8_SINT"/>
+	<value value="0x08" name="RB5_R4G4B4A4_UNORM"/>
+	<value value="0x0a" name="RB5_R5G5B5A1_UNORM"/>
+	<value value="0x0e" name="RB5_R5G6B5_UNORM"/>
+	<value value="0x0f" name="RB5_R8G8_UNORM"/>
+	<value value="0x10" name="RB5_R8G8_SNORM"/>
+	<value value="0x11" name="RB5_R8G8_UINT"/>
+	<value value="0x12" name="RB5_R8G8_SINT"/>
+	<value value="0x15" name="RB5_R16_UNORM"/>
+	<value value="0x16" name="RB5_R16_SNORM"/>
+	<value value="0x17" name="RB5_R16_FLOAT"/>
+	<value value="0x18" name="RB5_R16_UINT"/>
+	<value value="0x19" name="RB5_R16_SINT"/>
+	<value value="0x30" name="RB5_R8G8B8A8_UNORM"/>
+	<value value="0x31" name="RB5_R8G8B8_UNORM"/>
+	<value value="0x32" name="RB5_R8G8B8A8_SNORM"/>
+	<value value="0x33" name="RB5_R8G8B8A8_UINT"/>
+	<value value="0x34" name="RB5_R8G8B8A8_SINT"/>
+	<value value="0x37" name="RB5_R10G10B10A2_UNORM"/>  <!-- GL_RGB10_A2 -->
+	<value value="0x3a" name="RB5_R10G10B10A2_UINT"/>   <!-- GL_RGB10_A2UI -->
+	<value value="0x42" name="RB5_R11G11B10_FLOAT"/>    <!-- GL_R11F_G11F_B10F -->
+	<value value="0x43" name="RB5_R16G16_UNORM"/>
+	<value value="0x44" name="RB5_R16G16_SNORM"/>
+	<value value="0x45" name="RB5_R16G16_FLOAT"/>
+	<value value="0x46" name="RB5_R16G16_UINT"/>
+	<value value="0x47" name="RB5_R16G16_SINT"/>
+	<value value="0x4a" name="RB5_R32_FLOAT"/>
+	<value value="0x4b" name="RB5_R32_UINT"/>
+	<value value="0x4c" name="RB5_R32_SINT"/>
+	<value value="0x60" name="RB5_R16G16B16A16_UNORM"/>
+	<value value="0x61" name="RB5_R16G16B16A16_SNORM"/>
+	<value value="0x62" name="RB5_R16G16B16A16_FLOAT"/>
+	<value value="0x63" name="RB5_R16G16B16A16_UINT"/>
+	<value value="0x64" name="RB5_R16G16B16A16_SINT"/>
+	<value value="0x67" name="RB5_R32G32_FLOAT"/>
+	<value value="0x68" name="RB5_R32G32_UINT"/>
+	<value value="0x69" name="RB5_R32G32_SINT"/>
+	<value value="0x82" name="RB5_R32G32B32A32_FLOAT"/>
+	<value value="0x83" name="RB5_R32G32B32A32_UINT"/>
+	<value value="0x84" name="RB5_R32G32B32A32_SINT"/>
+
+	<value value="0xff" name="RB5_NONE"/>
+</enum>
+
+<enum name="a5xx_tile_mode">
+	<value name="TILE5_LINEAR" value="0"/>
+	<value name="TILE5_2" value="2"/>
+	<value name="TILE5_3" value="3"/>
+</enum>
+
+<enum name="a5xx_vtx_fmt" prefix="chipset">
+	<value value="0x03" name="VFMT5_8_UNORM"/>
+	<value value="0x04" name="VFMT5_8_SNORM"/>
+	<value value="0x05" name="VFMT5_8_UINT"/>
+	<value value="0x06" name="VFMT5_8_SINT"/>
+
+	<value value="0x0f" name="VFMT5_8_8_UNORM"/>
+	<value value="0x10" name="VFMT5_8_8_SNORM"/>
+	<value value="0x11" name="VFMT5_8_8_UINT"/>
+	<value value="0x12" name="VFMT5_8_8_SINT"/>
+
+	<value value="0x15" name="VFMT5_16_UNORM"/>
+	<value value="0x16" name="VFMT5_16_SNORM"/>
+	<value value="0x17" name="VFMT5_16_FLOAT"/>
+	<value value="0x18" name="VFMT5_16_UINT"/>
+	<value value="0x19" name="VFMT5_16_SINT"/>
+
+	<value value="0x21" name="VFMT5_8_8_8_UNORM"/>
+	<value value="0x22" name="VFMT5_8_8_8_SNORM"/>
+	<value value="0x23" name="VFMT5_8_8_8_UINT"/>
+	<value value="0x24" name="VFMT5_8_8_8_SINT"/>
+
+	<value value="0x30" name="VFMT5_8_8_8_8_UNORM"/>
+	<value value="0x32" name="VFMT5_8_8_8_8_SNORM"/>
+	<value value="0x33" name="VFMT5_8_8_8_8_UINT"/>
+	<value value="0x34" name="VFMT5_8_8_8_8_SINT"/>
+
+	<value value="0x36" name="VFMT5_10_10_10_2_UNORM"/>
+	<value value="0x39" name="VFMT5_10_10_10_2_SNORM"/>
+	<value value="0x3a" name="VFMT5_10_10_10_2_UINT"/>
+	<value value="0x3b" name="VFMT5_10_10_10_2_SINT"/>
+
+	<value value="0x42" name="VFMT5_11_11_10_FLOAT"/>
+
+	<value value="0x43" name="VFMT5_16_16_UNORM"/>
+	<value value="0x44" name="VFMT5_16_16_SNORM"/>
+	<value value="0x45" name="VFMT5_16_16_FLOAT"/>
+	<value value="0x46" name="VFMT5_16_16_UINT"/>
+	<value value="0x47" name="VFMT5_16_16_SINT"/>
+
+	<value value="0x48" name="VFMT5_32_UNORM"/>
+	<value value="0x49" name="VFMT5_32_SNORM"/>
+	<value value="0x4a" name="VFMT5_32_FLOAT"/>
+	<value value="0x4b" name="VFMT5_32_UINT"/>
+	<value value="0x4c" name="VFMT5_32_SINT"/>
+	<value value="0x4d" name="VFMT5_32_FIXED"/>
+
+	<value value="0x58" name="VFMT5_16_16_16_UNORM"/>
+	<value value="0x59" name="VFMT5_16_16_16_SNORM"/>
+	<value value="0x5a" name="VFMT5_16_16_16_FLOAT"/>
+	<value value="0x5b" name="VFMT5_16_16_16_UINT"/>
+	<value value="0x5c" name="VFMT5_16_16_16_SINT"/>
+
+	<value value="0x60" name="VFMT5_16_16_16_16_UNORM"/>
+	<value value="0x61" name="VFMT5_16_16_16_16_SNORM"/>
+	<value value="0x62" name="VFMT5_16_16_16_16_FLOAT"/>
+	<value value="0x63" name="VFMT5_16_16_16_16_UINT"/>
+	<value value="0x64" name="VFMT5_16_16_16_16_SINT"/>
+
+	<value value="0x65" name="VFMT5_32_32_UNORM"/>
+	<value value="0x66" name="VFMT5_32_32_SNORM"/>
+	<value value="0x67" name="VFMT5_32_32_FLOAT"/>
+	<value value="0x68" name="VFMT5_32_32_UINT"/>
+	<value value="0x69" name="VFMT5_32_32_SINT"/>
+	<value value="0x6a" name="VFMT5_32_32_FIXED"/>
+
+	<value value="0x70" name="VFMT5_32_32_32_UNORM"/>
+	<value value="0x71" name="VFMT5_32_32_32_SNORM"/>
+	<value value="0x72" name="VFMT5_32_32_32_UINT"/>
+	<value value="0x73" name="VFMT5_32_32_32_SINT"/>
+	<value value="0x74" name="VFMT5_32_32_32_FLOAT"/>
+	<value value="0x75" name="VFMT5_32_32_32_FIXED"/>
+
+	<value value="0x80" name="VFMT5_32_32_32_32_UNORM"/>
+	<value value="0x81" name="VFMT5_32_32_32_32_SNORM"/>
+	<value value="0x82" name="VFMT5_32_32_32_32_FLOAT"/>
+	<value value="0x83" name="VFMT5_32_32_32_32_UINT"/>
+	<value value="0x84" name="VFMT5_32_32_32_32_SINT"/>
+	<value value="0x85" name="VFMT5_32_32_32_32_FIXED"/>
+
+	<value value="0xff" name="VFMT5_NONE"/>
+</enum>
+
+<enum name="a5xx_tex_fmt">
+	<value value="0x02" name="TFMT5_A8_UNORM"/>
+	<value value="0x03" name="TFMT5_8_UNORM"/>
+	<value value="0x04" name="TFMT5_8_SNORM"/>
+	<value value="0x05" name="TFMT5_8_UINT"/>
+	<value value="0x06" name="TFMT5_8_SINT"/>
+	<value value="0x08" name="TFMT5_4_4_4_4_UNORM"/>
+	<value value="0x0a" name="TFMT5_5_5_5_1_UNORM"/>
+	<value value="0x0e" name="TFMT5_5_6_5_UNORM"/>
+	<value value="0x0f" name="TFMT5_8_8_UNORM"/>
+	<value value="0x10" name="TFMT5_8_8_SNORM"/>
+	<value value="0x11" name="TFMT5_8_8_UINT"/>
+	<value value="0x12" name="TFMT5_8_8_SINT"/>
+	<value value="0x13" name="TFMT5_L8_A8_UNORM"/>
+	<value value="0x15" name="TFMT5_16_UNORM"/>
+	<value value="0x16" name="TFMT5_16_SNORM"/>
+	<value value="0x17" name="TFMT5_16_FLOAT"/>
+	<value value="0x18" name="TFMT5_16_UINT"/>
+	<value value="0x19" name="TFMT5_16_SINT"/>
+	<value value="0x30" name="TFMT5_8_8_8_8_UNORM"/>
+	<value value="0x31" name="TFMT5_8_8_8_UNORM"/>
+	<value value="0x32" name="TFMT5_8_8_8_8_SNORM"/>
+	<value value="0x33" name="TFMT5_8_8_8_8_UINT"/>
+	<value value="0x34" name="TFMT5_8_8_8_8_SINT"/>
+	<value value="0x35" name="TFMT5_9_9_9_E5_FLOAT"/>
+	<value value="0x36" name="TFMT5_10_10_10_2_UNORM"/>
+	<value value="0x3a" name="TFMT5_10_10_10_2_UINT"/>
+	<value value="0x42" name="TFMT5_11_11_10_FLOAT"/>
+	<value value="0x43" name="TFMT5_16_16_UNORM"/>
+	<value value="0x44" name="TFMT5_16_16_SNORM"/>
+	<value value="0x45" name="TFMT5_16_16_FLOAT"/>
+	<value value="0x46" name="TFMT5_16_16_UINT"/>
+	<value value="0x47" name="TFMT5_16_16_SINT"/>
+	<value value="0x4a" name="TFMT5_32_FLOAT"/>
+	<value value="0x4b" name="TFMT5_32_UINT"/>
+	<value value="0x4c" name="TFMT5_32_SINT"/>
+	<value value="0x60" name="TFMT5_16_16_16_16_UNORM"/>
+	<value value="0x61" name="TFMT5_16_16_16_16_SNORM"/>
+	<value value="0x62" name="TFMT5_16_16_16_16_FLOAT"/>
+	<value value="0x63" name="TFMT5_16_16_16_16_UINT"/>
+	<value value="0x64" name="TFMT5_16_16_16_16_SINT"/>
+	<value value="0x67" name="TFMT5_32_32_FLOAT"/>
+	<value value="0x68" name="TFMT5_32_32_UINT"/>
+	<value value="0x69" name="TFMT5_32_32_SINT"/>
+	<value value="0x72" name="TFMT5_32_32_32_UINT"/>
+	<value value="0x73" name="TFMT5_32_32_32_SINT"/>
+	<value value="0x74" name="TFMT5_32_32_32_FLOAT"/>
+	<value value="0x82" name="TFMT5_32_32_32_32_FLOAT"/>
+	<value value="0x83" name="TFMT5_32_32_32_32_UINT"/>
+	<value value="0x84" name="TFMT5_32_32_32_32_SINT"/>
+	<value value="0xa0" name="TFMT5_X8Z24_UNORM"/>
+
+	<value value="0xab" name="TFMT5_ETC2_RG11_UNORM"/>
+	<value value="0xac" name="TFMT5_ETC2_RG11_SNORM"/>
+	<value value="0xad" name="TFMT5_ETC2_R11_UNORM"/>
+	<value value="0xae" name="TFMT5_ETC2_R11_SNORM"/>
+	<value value="0xaf" name="TFMT5_ETC1"/>
+	<value value="0xb0" name="TFMT5_ETC2_RGB8"/>
+	<value value="0xb1" name="TFMT5_ETC2_RGBA8"/>
+	<value value="0xb2" name="TFMT5_ETC2_RGB8A1"/>
+	<value value="0xb3" name="TFMT5_DXT1"/>
+	<value value="0xb4" name="TFMT5_DXT3"/>
+	<value value="0xb5" name="TFMT5_DXT5"/>
+	<value value="0xb7" name="TFMT5_RGTC1_UNORM"/>
+	<value value="0xb8" name="TFMT5_RGTC1_SNORM"/>
+	<value value="0xbb" name="TFMT5_RGTC2_UNORM"/>
+	<value value="0xbc" name="TFMT5_RGTC2_SNORM"/>
+	<value value="0xbe" name="TFMT5_BPTC_UFLOAT"/>
+	<value value="0xbf" name="TFMT5_BPTC_FLOAT"/>
+	<value value="0xc0" name="TFMT5_BPTC"/>
+	<value value="0xc1" name="TFMT5_ASTC_4x4"/>
+	<value value="0xc2" name="TFMT5_ASTC_5x4"/>
+	<value value="0xc3" name="TFMT5_ASTC_5x5"/>
+	<value value="0xc4" name="TFMT5_ASTC_6x5"/>
+	<value value="0xc5" name="TFMT5_ASTC_6x6"/>
+	<value value="0xc6" name="TFMT5_ASTC_8x5"/>
+	<value value="0xc7" name="TFMT5_ASTC_8x6"/>
+	<value value="0xc8" name="TFMT5_ASTC_8x8"/>
+	<value value="0xc9" name="TFMT5_ASTC_10x5"/>
+	<value value="0xca" name="TFMT5_ASTC_10x6"/>
+	<value value="0xcb" name="TFMT5_ASTC_10x8"/>
+	<value value="0xcc" name="TFMT5_ASTC_10x10"/>
+	<value value="0xcd" name="TFMT5_ASTC_12x10"/>
+	<value value="0xce" name="TFMT5_ASTC_12x12"/>
+
+	<value value="0xff" name="TFMT5_NONE"/>
+</enum>
+
+<enum name="a5xx_depth_format">
+	<value name="DEPTH5_NONE" value="0"/>
+	<value name="DEPTH5_16" value="1"/>
+	<value name="DEPTH5_24_8" value="2"/>
+	<value name="DEPTH5_32" value="4"/>
+</enum>
+
+<enum name="a5xx_blit_buf">
+	<value value="0" name="BLIT_MRT0"/>
+	<value value="1" name="BLIT_MRT1"/>
+	<value value="2" name="BLIT_MRT2"/>
+	<value value="3" name="BLIT_MRT3"/>
+	<value value="4" name="BLIT_MRT4"/>
+	<value value="5" name="BLIT_MRT5"/>
+	<value value="6" name="BLIT_MRT6"/>
+	<value value="7" name="BLIT_MRT7"/>
+	<value value="8" name="BLIT_ZS"/>       <!-- depth or combined depth+stencil -->
+	<value value="9" name="BLIT_S"/>        <!-- separate stencil -->
+</enum>
+
+<!-- see comment in a4xx.xml about script to extract countables from test-perf output -->
+<enum name="a5xx_cp_perfcounter_select">
+	<value value="0" name="PERF_CP_ALWAYS_COUNT"/>
+	<value value="1" name="PERF_CP_BUSY_GFX_CORE_IDLE"/>
+	<value value="2" name="PERF_CP_BUSY_CYCLES"/>
+	<value value="3" name="PERF_CP_PFP_IDLE"/>
+	<value value="4" name="PERF_CP_PFP_BUSY_WORKING"/>
+	<value value="5" name="PERF_CP_PFP_STALL_CYCLES_ANY"/>
+	<value value="6" name="PERF_CP_PFP_STARVE_CYCLES_ANY"/>
+	<value value="7" name="PERF_CP_PFP_ICACHE_MISS"/>
+	<value value="8" name="PERF_CP_PFP_ICACHE_HIT"/>
+	<value value="9" name="PERF_CP_PFP_MATCH_PM4_PKT_PROFILE"/>
+	<value value="10" name="PERF_CP_ME_BUSY_WORKING"/>
+	<value value="11" name="PERF_CP_ME_IDLE"/>
+	<value value="12" name="PERF_CP_ME_STARVE_CYCLES_ANY"/>
+	<value value="13" name="PERF_CP_ME_FIFO_EMPTY_PFP_IDLE"/>
+	<value value="14" name="PERF_CP_ME_FIFO_EMPTY_PFP_BUSY"/>
+	<value value="15" name="PERF_CP_ME_FIFO_FULL_ME_BUSY"/>
+	<value value="16" name="PERF_CP_ME_FIFO_FULL_ME_NON_WORKING"/>
+	<value value="17" name="PERF_CP_ME_STALL_CYCLES_ANY"/>
+	<value value="18" name="PERF_CP_ME_ICACHE_MISS"/>
+	<value value="19" name="PERF_CP_ME_ICACHE_HIT"/>
+	<value value="20" name="PERF_CP_NUM_PREEMPTIONS"/>
+	<value value="21" name="PERF_CP_PREEMPTION_REACTION_DELAY"/>
+	<value value="22" name="PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
+	<value value="23" name="PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
+	<value value="24" name="PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
+	<value value="25" name="PERF_CP_PREDICATED_DRAWS_KILLED"/>
+	<value value="26" name="PERF_CP_MODE_SWITCH"/>
+	<value value="27" name="PERF_CP_ZPASS_DONE"/>
+	<value value="28" name="PERF_CP_CONTEXT_DONE"/>
+	<value value="29" name="PERF_CP_CACHE_FLUSH"/>
+	<value value="30" name="PERF_CP_LONG_PREEMPTIONS"/>
+</enum>
+
+<enum name="a5xx_rbbm_perfcounter_select">
+	<value value="0" name="PERF_RBBM_ALWAYS_COUNT"/>
+	<value value="1" name="PERF_RBBM_ALWAYS_ON"/>
+	<value value="2" name="PERF_RBBM_TSE_BUSY"/>
+	<value value="3" name="PERF_RBBM_RAS_BUSY"/>
+	<value value="4" name="PERF_RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="PERF_RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="PERF_RBBM_STATUS_MASKED"/>
+	<value value="7" name="PERF_RBBM_COM_BUSY"/>
+	<value value="8" name="PERF_RBBM_DCOM_BUSY"/>
+	<value value="9" name="PERF_RBBM_VBIF_BUSY"/>
+	<value value="10" name="PERF_RBBM_VSC_BUSY"/>
+	<value value="11" name="PERF_RBBM_TESS_BUSY"/>
+	<value value="12" name="PERF_RBBM_UCHE_BUSY"/>
+	<value value="13" name="PERF_RBBM_HLSQ_BUSY"/>
+</enum>
+
+<enum name="a5xx_pc_perfcounter_select">
+	<value value="0" name="PERF_PC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_PC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_PC_STALL_CYCLES_VFD"/>
+	<value value="3" name="PERF_PC_STALL_CYCLES_TSE"/>
+	<value value="4" name="PERF_PC_STALL_CYCLES_VPC"/>
+	<value value="5" name="PERF_PC_STALL_CYCLES_UCHE"/>
+	<value value="6" name="PERF_PC_STALL_CYCLES_TESS"/>
+	<value value="7" name="PERF_PC_STALL_CYCLES_TSE_ONLY"/>
+	<value value="8" name="PERF_PC_STALL_CYCLES_VPC_ONLY"/>
+	<value value="9" name="PERF_PC_PASS1_TF_STALL_CYCLES"/>
+	<value value="10" name="PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
+	<value value="11" name="PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+	<value value="12" name="PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+	<value value="13" name="PERF_PC_STARVE_CYCLES_FOR_POSITION"/>
+	<value value="14" name="PERF_PC_STARVE_CYCLES_DI"/>
+	<value value="15" name="PERF_PC_VIS_STREAMS_LOADED"/>
+	<value value="16" name="PERF_PC_INSTANCES"/>
+	<value value="17" name="PERF_PC_VPC_PRIMITIVES"/>
+	<value value="18" name="PERF_PC_DEAD_PRIM"/>
+	<value value="19" name="PERF_PC_LIVE_PRIM"/>
+	<value value="20" name="PERF_PC_VERTEX_HITS"/>
+	<value value="21" name="PERF_PC_IA_VERTICES"/>
+	<value value="22" name="PERF_PC_IA_PRIMITIVES"/>
+	<value value="23" name="PERF_PC_GS_PRIMITIVES"/>
+	<value value="24" name="PERF_PC_HS_INVOCATIONS"/>
+	<value value="25" name="PERF_PC_DS_INVOCATIONS"/>
+	<value value="26" name="PERF_PC_VS_INVOCATIONS"/>
+	<value value="27" name="PERF_PC_GS_INVOCATIONS"/>
+	<value value="28" name="PERF_PC_DS_PRIMITIVES"/>
+	<value value="29" name="PERF_PC_VPC_POS_DATA_TRANSACTION"/>
+	<value value="30" name="PERF_PC_3D_DRAWCALLS"/>
+	<value value="31" name="PERF_PC_2D_DRAWCALLS"/>
+	<value value="32" name="PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
+	<value value="33" name="PERF_TESS_BUSY_CYCLES"/>
+	<value value="34" name="PERF_TESS_WORKING_CYCLES"/>
+	<value value="35" name="PERF_TESS_STALL_CYCLES_PC"/>
+	<value value="36" name="PERF_TESS_STARVE_CYCLES_PC"/>
+</enum>
+
+<enum name="a5xx_vfd_perfcounter_select">
+	<value value="0" name="PERF_VFD_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VFD_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
+	<value value="3" name="PERF_VFD_STALL_CYCLES_MISS_VB"/>
+	<value value="4" name="PERF_VFD_STALL_CYCLES_MISS_Q"/>
+	<value value="5" name="PERF_VFD_STALL_CYCLES_SP_INFO"/>
+	<value value="6" name="PERF_VFD_STALL_CYCLES_SP_ATTR"/>
+	<value value="7" name="PERF_VFD_STALL_CYCLES_VFDP_VB"/>
+	<value value="8" name="PERF_VFD_STALL_CYCLES_VFDP_Q"/>
+	<value value="9" name="PERF_VFD_DECODER_PACKER_STALL"/>
+	<value value="10" name="PERF_VFD_STARVE_CYCLES_UCHE"/>
+	<value value="11" name="PERF_VFD_RBUFFER_FULL"/>
+	<value value="12" name="PERF_VFD_ATTR_INFO_FIFO_FULL"/>
+	<value value="13" name="PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
+	<value value="14" name="PERF_VFD_NUM_ATTRIBUTES"/>
+	<value value="15" name="PERF_VFD_INSTRUCTIONS"/>
+	<value value="16" name="PERF_VFD_UPPER_SHADER_FIBERS"/>
+	<value value="17" name="PERF_VFD_LOWER_SHADER_FIBERS"/>
+	<value value="18" name="PERF_VFD_MODE_0_FIBERS"/>
+	<value value="19" name="PERF_VFD_MODE_1_FIBERS"/>
+	<value value="20" name="PERF_VFD_MODE_2_FIBERS"/>
+	<value value="21" name="PERF_VFD_MODE_3_FIBERS"/>
+	<value value="22" name="PERF_VFD_MODE_4_FIBERS"/>
+	<value value="23" name="PERF_VFD_TOTAL_VERTICES"/>
+	<value value="24" name="PERF_VFD_NUM_ATTR_MISS"/>
+	<value value="25" name="PERF_VFD_1_BURST_REQ"/>
+	<value value="26" name="PERF_VFDP_STALL_CYCLES_VFD"/>
+	<value value="27" name="PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
+	<value value="28" name="PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
+	<value value="29" name="PERF_VFDP_STARVE_CYCLES_PC"/>
+	<value value="30" name="PERF_VFDP_VS_STAGE_32_WAVES"/>
+</enum>
+
+<enum name="a5xx_hlsq_perfcounter_select">
+	<value value="0" name="PERF_HLSQ_BUSY_CYCLES"/>
+	<value value="1" name="PERF_HLSQ_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
+	<value value="3" name="PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+	<value value="4" name="PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
+	<value value="5" name="PERF_HLSQ_UCHE_LATENCY_COUNT"/>
+	<value value="6" name="PERF_HLSQ_FS_STAGE_32_WAVES"/>
+	<value value="7" name="PERF_HLSQ_FS_STAGE_64_WAVES"/>
+	<value value="8" name="PERF_HLSQ_QUADS"/>
+	<value value="9" name="PERF_HLSQ_SP_STATE_COPY_TRANS_FS_STAGE"/>
+	<value value="10" name="PERF_HLSQ_SP_STATE_COPY_TRANS_VS_STAGE"/>
+	<value value="11" name="PERF_HLSQ_TP_STATE_COPY_TRANS_FS_STAGE"/>
+	<value value="12" name="PERF_HLSQ_TP_STATE_COPY_TRANS_VS_STAGE"/>
+	<value value="13" name="PERF_HLSQ_CS_INVOCATIONS"/>
+	<value value="14" name="PERF_HLSQ_COMPUTE_DRAWCALLS"/>
+</enum>
+
+<enum name="a5xx_vpc_perfcounter_select">
+	<value value="0" name="PERF_VPC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VPC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_VPC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="PERF_VPC_STALL_CYCLES_VFD_WACK"/>
+	<value value="4" name="PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
+	<value value="5" name="PERF_VPC_STALL_CYCLES_PC"/>
+	<value value="6" name="PERF_VPC_STALL_CYCLES_SP_LM"/>
+	<value value="7" name="PERF_VPC_POS_EXPORT_STALL_CYCLES"/>
+	<value value="8" name="PERF_VPC_STARVE_CYCLES_SP"/>
+	<value value="9" name="PERF_VPC_STARVE_CYCLES_LRZ"/>
+	<value value="10" name="PERF_VPC_PC_PRIMITIVES"/>
+	<value value="11" name="PERF_VPC_SP_COMPONENTS"/>
+	<value value="12" name="PERF_VPC_SP_LM_PRIMITIVES"/>
+	<value value="13" name="PERF_VPC_SP_LM_COMPONENTS"/>
+	<value value="14" name="PERF_VPC_SP_LM_DWORDS"/>
+	<value value="15" name="PERF_VPC_STREAMOUT_COMPONENTS"/>
+	<value value="16" name="PERF_VPC_GRANT_PHASES"/>
+</enum>
+
+<enum name="a5xx_tse_perfcounter_select">
+	<value value="0" name="PERF_TSE_BUSY_CYCLES"/>
+	<value value="1" name="PERF_TSE_CLIPPING_CYCLES"/>
+	<value value="2" name="PERF_TSE_STALL_CYCLES_RAS"/>
+	<value value="3" name="PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
+	<value value="4" name="PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
+	<value value="5" name="PERF_TSE_STARVE_CYCLES_PC"/>
+	<value value="6" name="PERF_TSE_INPUT_PRIM"/>
+	<value value="7" name="PERF_TSE_INPUT_NULL_PRIM"/>
+	<value value="8" name="PERF_TSE_TRIVAL_REJ_PRIM"/>
+	<value value="9" name="PERF_TSE_CLIPPED_PRIM"/>
+	<value value="10" name="PERF_TSE_ZERO_AREA_PRIM"/>
+	<value value="11" name="PERF_TSE_FACENESS_CULLED_PRIM"/>
+	<value value="12" name="PERF_TSE_ZERO_PIXEL_PRIM"/>
+	<value value="13" name="PERF_TSE_OUTPUT_NULL_PRIM"/>
+	<value value="14" name="PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
+	<value value="15" name="PERF_TSE_CINVOCATION"/>
+	<value value="16" name="PERF_TSE_CPRIMITIVES"/>
+	<value value="17" name="PERF_TSE_2D_INPUT_PRIM"/>
+	<value value="18" name="PERF_TSE_2D_ALIVE_CLCLES"/>
+</enum>
+
+<enum name="a5xx_ras_perfcounter_select">
+	<value value="0" name="PERF_RAS_BUSY_CYCLES"/>
+	<value value="1" name="PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
+	<value value="2" name="PERF_RAS_STALL_CYCLES_LRZ"/>
+	<value value="3" name="PERF_RAS_STARVE_CYCLES_TSE"/>
+	<value value="4" name="PERF_RAS_SUPER_TILES"/>
+	<value value="5" name="PERF_RAS_8X4_TILES"/>
+	<value value="6" name="PERF_RAS_MASKGEN_ACTIVE"/>
+	<value value="7" name="PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
+	<value value="8" name="PERF_RAS_FULLY_COVERED_8X4_TILES"/>
+	<value value="9" name="PERF_RAS_PRIM_KILLED_INVISILBE"/>
+</enum>
+
+<enum name="a5xx_lrz_perfcounter_select">
+	<value value="0" name="PERF_LRZ_BUSY_CYCLES"/>
+	<value value="1" name="PERF_LRZ_STARVE_CYCLES_RAS"/>
+	<value value="2" name="PERF_LRZ_STALL_CYCLES_RB"/>
+	<value value="3" name="PERF_LRZ_STALL_CYCLES_VSC"/>
+	<value value="4" name="PERF_LRZ_STALL_CYCLES_VPC"/>
+	<value value="5" name="PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
+	<value value="6" name="PERF_LRZ_STALL_CYCLES_UCHE"/>
+	<value value="7" name="PERF_LRZ_LRZ_READ"/>
+	<value value="8" name="PERF_LRZ_LRZ_WRITE"/>
+	<value value="9" name="PERF_LRZ_READ_LATENCY"/>
+	<value value="10" name="PERF_LRZ_MERGE_CACHE_UPDATING"/>
+	<value value="11" name="PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
+	<value value="12" name="PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
+	<value value="13" name="PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
+	<value value="14" name="PERF_LRZ_FULL_8X8_TILES"/>
+	<value value="15" name="PERF_LRZ_PARTIAL_8X8_TILES"/>
+	<value value="16" name="PERF_LRZ_TILE_KILLED"/>
+	<value value="17" name="PERF_LRZ_TOTAL_PIXEL"/>
+	<value value="18" name="PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
+</enum>
+
+<enum name="a5xx_uche_perfcounter_select">
+	<value value="0" name="PERF_UCHE_BUSY_CYCLES"/>
+	<value value="1" name="PERF_UCHE_STALL_CYCLES_VBIF"/>
+	<value value="2" name="PERF_UCHE_VBIF_LATENCY_CYCLES"/>
+	<value value="3" name="PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
+	<value value="4" name="PERF_UCHE_VBIF_READ_BEATS_TP"/>
+	<value value="5" name="PERF_UCHE_VBIF_READ_BEATS_VFD"/>
+	<value value="6" name="PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
+	<value value="7" name="PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
+	<value value="8" name="PERF_UCHE_VBIF_READ_BEATS_SP"/>
+	<value value="9" name="PERF_UCHE_READ_REQUESTS_TP"/>
+	<value value="10" name="PERF_UCHE_READ_REQUESTS_VFD"/>
+	<value value="11" name="PERF_UCHE_READ_REQUESTS_HLSQ"/>
+	<value value="12" name="PERF_UCHE_READ_REQUESTS_LRZ"/>
+	<value value="13" name="PERF_UCHE_READ_REQUESTS_SP"/>
+	<value value="14" name="PERF_UCHE_WRITE_REQUESTS_LRZ"/>
+	<value value="15" name="PERF_UCHE_WRITE_REQUESTS_SP"/>
+	<value value="16" name="PERF_UCHE_WRITE_REQUESTS_VPC"/>
+	<value value="17" name="PERF_UCHE_WRITE_REQUESTS_VSC"/>
+	<value value="18" name="PERF_UCHE_EVICTS"/>
+	<value value="19" name="PERF_UCHE_BANK_REQ0"/>
+	<value value="20" name="PERF_UCHE_BANK_REQ1"/>
+	<value value="21" name="PERF_UCHE_BANK_REQ2"/>
+	<value value="22" name="PERF_UCHE_BANK_REQ3"/>
+	<value value="23" name="PERF_UCHE_BANK_REQ4"/>
+	<value value="24" name="PERF_UCHE_BANK_REQ5"/>
+	<value value="25" name="PERF_UCHE_BANK_REQ6"/>
+	<value value="26" name="PERF_UCHE_BANK_REQ7"/>
+	<value value="27" name="PERF_UCHE_VBIF_READ_BEATS_CH0"/>
+	<value value="28" name="PERF_UCHE_VBIF_READ_BEATS_CH1"/>
+	<value value="29" name="PERF_UCHE_GMEM_READ_BEATS"/>
+	<value value="30" name="PERF_UCHE_FLAG_COUNT"/>
+</enum>
+
+<enum name="a5xx_tp_perfcounter_select">
+	<value value="0" name="PERF_TP_BUSY_CYCLES"/>
+	<value value="1" name="PERF_TP_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_TP_LATENCY_CYCLES"/>
+	<value value="3" name="PERF_TP_LATENCY_TRANS"/>
+	<value value="4" name="PERF_TP_FLAG_CACHE_REQUEST_SAMPLES"/>
+	<value value="5" name="PERF_TP_FLAG_CACHE_REQUEST_LATENCY"/>
+	<value value="6" name="PERF_TP_L1_CACHELINE_REQUESTS"/>
+	<value value="7" name="PERF_TP_L1_CACHELINE_MISSES"/>
+	<value value="8" name="PERF_TP_SP_TP_TRANS"/>
+	<value value="9" name="PERF_TP_TP_SP_TRANS"/>
+	<value value="10" name="PERF_TP_OUTPUT_PIXELS"/>
+	<value value="11" name="PERF_TP_FILTER_WORKLOAD_16BIT"/>
+	<value value="12" name="PERF_TP_FILTER_WORKLOAD_32BIT"/>
+	<value value="13" name="PERF_TP_QUADS_RECEIVED"/>
+	<value value="14" name="PERF_TP_QUADS_OFFSET"/>
+	<value value="15" name="PERF_TP_QUADS_SHADOW"/>
+	<value value="16" name="PERF_TP_QUADS_ARRAY"/>
+	<value value="17" name="PERF_TP_QUADS_GRADIENT"/>
+	<value value="18" name="PERF_TP_QUADS_1D"/>
+	<value value="19" name="PERF_TP_QUADS_2D"/>
+	<value value="20" name="PERF_TP_QUADS_BUFFER"/>
+	<value value="21" name="PERF_TP_QUADS_3D"/>
+	<value value="22" name="PERF_TP_QUADS_CUBE"/>
+	<value value="23" name="PERF_TP_STATE_CACHE_REQUESTS"/>
+	<value value="24" name="PERF_TP_STATE_CACHE_MISSES"/>
+	<value value="25" name="PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
+	<value value="26" name="PERF_TP_BINDLESS_STATE_CACHE_REQUESTS"/>
+	<value value="27" name="PERF_TP_BINDLESS_STATE_CACHE_MISSES"/>
+	<value value="28" name="PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
+	<value value="29" name="PERF_TP_OUTPUT_PIXELS_POINT"/>
+	<value value="30" name="PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="31" name="PERF_TP_OUTPUT_PIXELS_MIP"/>
+	<value value="32" name="PERF_TP_OUTPUT_PIXELS_ANISO"/>
+	<value value="33" name="PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
+	<value value="34" name="PERF_TP_FLAG_CACHE_REQUESTS"/>
+	<value value="35" name="PERF_TP_FLAG_CACHE_MISSES"/>
+	<value value="36" name="PERF_TP_L1_5_L2_REQUESTS"/>
+	<value value="37" name="PERF_TP_2D_OUTPUT_PIXELS"/>
+	<value value="38" name="PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
+	<value value="39" name="PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="40" name="PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
+	<value value="41" name="PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
+</enum>
+
+<enum name="a5xx_sp_perfcounter_select">
+	<value value="0" name="PERF_SP_BUSY_CYCLES"/>
+	<value value="1" name="PERF_SP_ALU_WORKING_CYCLES"/>
+	<value value="2" name="PERF_SP_EFU_WORKING_CYCLES"/>
+	<value value="3" name="PERF_SP_STALL_CYCLES_VPC"/>
+	<value value="4" name="PERF_SP_STALL_CYCLES_TP"/>
+	<value value="5" name="PERF_SP_STALL_CYCLES_UCHE"/>
+	<value value="6" name="PERF_SP_STALL_CYCLES_RB"/>
+	<value value="7" name="PERF_SP_SCHEDULER_NON_WORKING"/>
+	<value value="8" name="PERF_SP_WAVE_CONTEXTS"/>
+	<value value="9" name="PERF_SP_WAVE_CONTEXT_CYCLES"/>
+	<value value="10" name="PERF_SP_FS_STAGE_WAVE_CYCLES"/>
+	<value value="11" name="PERF_SP_FS_STAGE_WAVE_SAMPLES"/>
+	<value value="12" name="PERF_SP_VS_STAGE_WAVE_CYCLES"/>
+	<value value="13" name="PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
+	<value value="14" name="PERF_SP_FS_STAGE_DURATION_CYCLES"/>
+	<value value="15" name="PERF_SP_VS_STAGE_DURATION_CYCLES"/>
+	<value value="16" name="PERF_SP_WAVE_CTRL_CYCLES"/>
+	<value value="17" name="PERF_SP_WAVE_LOAD_CYCLES"/>
+	<value value="18" name="PERF_SP_WAVE_EMIT_CYCLES"/>
+	<value value="19" name="PERF_SP_WAVE_NOP_CYCLES"/>
+	<value value="20" name="PERF_SP_WAVE_WAIT_CYCLES"/>
+	<value value="21" name="PERF_SP_WAVE_FETCH_CYCLES"/>
+	<value value="22" name="PERF_SP_WAVE_IDLE_CYCLES"/>
+	<value value="23" name="PERF_SP_WAVE_END_CYCLES"/>
+	<value value="24" name="PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
+	<value value="25" name="PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
+	<value value="26" name="PERF_SP_WAVE_JOIN_CYCLES"/>
+	<value value="27" name="PERF_SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="28" name="PERF_SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="29" name="PERF_SP_LM_ATOMICS"/>
+	<value value="30" name="PERF_SP_GM_LOAD_INSTRUCTIONS"/>
+	<value value="31" name="PERF_SP_GM_STORE_INSTRUCTIONS"/>
+	<value value="32" name="PERF_SP_GM_ATOMICS"/>
+	<value value="33" name="PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="34" name="PERF_SP_VS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="35" name="PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="36" name="PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="37" name="PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="38" name="PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="39" name="PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="40" name="PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="41" name="PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="42" name="PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="43" name="PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
+	<value value="44" name="PERF_SP_VS_INSTRUCTIONS"/>
+	<value value="45" name="PERF_SP_FS_INSTRUCTIONS"/>
+	<value value="46" name="PERF_SP_ADDR_LOCK_COUNT"/>
+	<value value="47" name="PERF_SP_UCHE_READ_TRANS"/>
+	<value value="48" name="PERF_SP_UCHE_WRITE_TRANS"/>
+	<value value="49" name="PERF_SP_EXPORT_VPC_TRANS"/>
+	<value value="50" name="PERF_SP_EXPORT_RB_TRANS"/>
+	<value value="51" name="PERF_SP_PIXELS_KILLED"/>
+	<value value="52" name="PERF_SP_ICL1_REQUESTS"/>
+	<value value="53" name="PERF_SP_ICL1_MISSES"/>
+	<value value="54" name="PERF_SP_ICL0_REQUESTS"/>
+	<value value="55" name="PERF_SP_ICL0_MISSES"/>
+	<value value="56" name="PERF_SP_HS_INSTRUCTIONS"/>
+	<value value="57" name="PERF_SP_DS_INSTRUCTIONS"/>
+	<value value="58" name="PERF_SP_GS_INSTRUCTIONS"/>
+	<value value="59" name="PERF_SP_CS_INSTRUCTIONS"/>
+	<value value="60" name="PERF_SP_GPR_READ"/>
+	<value value="61" name="PERF_SP_GPR_WRITE"/>
+	<value value="62" name="PERF_SP_LM_CH0_REQUESTS"/>
+	<value value="63" name="PERF_SP_LM_CH1_REQUESTS"/>
+	<value value="64" name="PERF_SP_LM_BANK_CONFLICTS"/>
+</enum>
+
+<enum name="a5xx_rb_perfcounter_select">
+	<value value="0" name="PERF_RB_BUSY_CYCLES"/>
+	<value value="1" name="PERF_RB_STALL_CYCLES_CCU"/>
+	<value value="2" name="PERF_RB_STALL_CYCLES_HLSQ"/>
+	<value value="3" name="PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
+	<value value="4" name="PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
+	<value value="5" name="PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
+	<value value="6" name="PERF_RB_STARVE_CYCLES_SP"/>
+	<value value="7" name="PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
+	<value value="8" name="PERF_RB_STARVE_CYCLES_CCU"/>
+	<value value="9" name="PERF_RB_STARVE_CYCLES_Z_PLANE"/>
+	<value value="10" name="PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
+	<value value="11" name="PERF_RB_Z_WORKLOAD"/>
+	<value value="12" name="PERF_RB_HLSQ_ACTIVE"/>
+	<value value="13" name="PERF_RB_Z_READ"/>
+	<value value="14" name="PERF_RB_Z_WRITE"/>
+	<value value="15" name="PERF_RB_C_READ"/>
+	<value value="16" name="PERF_RB_C_WRITE"/>
+	<value value="17" name="PERF_RB_TOTAL_PASS"/>
+	<value value="18" name="PERF_RB_Z_PASS"/>
+	<value value="19" name="PERF_RB_Z_FAIL"/>
+	<value value="20" name="PERF_RB_S_FAIL"/>
+	<value value="21" name="PERF_RB_BLENDED_FXP_COMPONENTS"/>
+	<value value="22" name="PERF_RB_BLENDED_FP16_COMPONENTS"/>
+	<value value="23" name="RB_RESERVED"/>
+	<value value="24" name="PERF_RB_2D_ALIVE_CYCLES"/>
+	<value value="25" name="PERF_RB_2D_STALL_CYCLES_A2D"/>
+	<value value="26" name="PERF_RB_2D_STARVE_CYCLES_SRC"/>
+	<value value="27" name="PERF_RB_2D_STARVE_CYCLES_SP"/>
+	<value value="28" name="PERF_RB_2D_STARVE_CYCLES_DST"/>
+	<value value="29" name="PERF_RB_2D_VALID_PIXELS"/>
+</enum>
+
+<enum name="a5xx_rb_samples_perfcounter_select">
+	<value value="0" name="TOTAL_SAMPLES"/>
+	<value value="1" name="ZPASS_SAMPLES"/>
+	<value value="2" name="ZFAIL_SAMPLES"/>
+	<value value="3" name="SFAIL_SAMPLES"/>
+</enum>
+
+<enum name="a5xx_vsc_perfcounter_select">
+	<value value="0" name="PERF_VSC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VSC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_VSC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="PERF_VSC_EOT_NUM"/>
+</enum>
+
+<enum name="a5xx_ccu_perfcounter_select">
+	<value value="0" name="PERF_CCU_BUSY_CYCLES"/>
+	<value value="1" name="PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
+	<value value="2" name="PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
+	<value value="3" name="PERF_CCU_STARVE_CYCLES_FLAG_RETURN"/>
+	<value value="4" name="PERF_CCU_DEPTH_BLOCKS"/>
+	<value value="5" name="PERF_CCU_COLOR_BLOCKS"/>
+	<value value="6" name="PERF_CCU_DEPTH_BLOCK_HIT"/>
+	<value value="7" name="PERF_CCU_COLOR_BLOCK_HIT"/>
+	<value value="8" name="PERF_CCU_PARTIAL_BLOCK_READ"/>
+	<value value="9" name="PERF_CCU_GMEM_READ"/>
+	<value value="10" name="PERF_CCU_GMEM_WRITE"/>
+	<value value="11" name="PERF_CCU_DEPTH_READ_FLAG0_COUNT"/>
+	<value value="12" name="PERF_CCU_DEPTH_READ_FLAG1_COUNT"/>
+	<value value="13" name="PERF_CCU_DEPTH_READ_FLAG2_COUNT"/>
+	<value value="14" name="PERF_CCU_DEPTH_READ_FLAG3_COUNT"/>
+	<value value="15" name="PERF_CCU_DEPTH_READ_FLAG4_COUNT"/>
+	<value value="16" name="PERF_CCU_COLOR_READ_FLAG0_COUNT"/>
+	<value value="17" name="PERF_CCU_COLOR_READ_FLAG1_COUNT"/>
+	<value value="18" name="PERF_CCU_COLOR_READ_FLAG2_COUNT"/>
+	<value value="19" name="PERF_CCU_COLOR_READ_FLAG3_COUNT"/>
+	<value value="20" name="PERF_CCU_COLOR_READ_FLAG4_COUNT"/>
+	<value value="21" name="PERF_CCU_2D_BUSY_CYCLES"/>
+	<value value="22" name="PERF_CCU_2D_RD_REQ"/>
+	<value value="23" name="PERF_CCU_2D_WR_REQ"/>
+	<value value="24" name="PERF_CCU_2D_REORDER_STARVE_CYCLES"/>
+	<value value="25" name="PERF_CCU_2D_PIXELS"/>
+</enum>
+
+<enum name="a5xx_cmp_perfcounter_select">
+	<value value="0" name="PERF_CMPDECMP_STALL_CYCLES_VBIF"/>
+	<value value="1" name="PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
+	<value value="2" name="PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
+	<value value="3" name="PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
+	<value value="4" name="PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
+	<value value="5" name="PERF_CMPDECMP_VBIF_READ_REQUEST"/>
+	<value value="6" name="PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
+	<value value="7" name="PERF_CMPDECMP_VBIF_READ_DATA"/>
+	<value value="8" name="PERF_CMPDECMP_VBIF_WRITE_DATA"/>
+	<value value="9" name="PERF_CMPDECMP_FLAG_FETCH_CYCLES"/>
+	<value value="10" name="PERF_CMPDECMP_FLAG_FETCH_SAMPLES"/>
+	<value value="11" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
+	<value value="12" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
+	<value value="13" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
+	<value value="14" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
+	<value value="15" name="PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
+	<value value="16" name="PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
+	<value value="17" name="PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
+	<value value="18" name="PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
+	<value value="19" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_REQ"/>
+	<value value="20" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_WR"/>
+	<value value="21" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_RETURN"/>
+	<value value="22" name="PERF_CMPDECMP_2D_RD_DATA"/>
+	<value value="23" name="PERF_CMPDECMP_2D_WR_DATA"/>
+</enum>
+
+<enum name="a5xx_vbif_perfcounter_select">
+	<value value="0" name="AXI_READ_REQUESTS_ID_0"/>
+	<value value="1" name="AXI_READ_REQUESTS_ID_1"/>
+	<value value="2" name="AXI_READ_REQUESTS_ID_2"/>
+	<value value="3" name="AXI_READ_REQUESTS_ID_3"/>
+	<value value="4" name="AXI_READ_REQUESTS_ID_4"/>
+	<value value="5" name="AXI_READ_REQUESTS_ID_5"/>
+	<value value="6" name="AXI_READ_REQUESTS_ID_6"/>
+	<value value="7" name="AXI_READ_REQUESTS_ID_7"/>
+	<value value="8" name="AXI_READ_REQUESTS_ID_8"/>
+	<value value="9" name="AXI_READ_REQUESTS_ID_9"/>
+	<value value="10" name="AXI_READ_REQUESTS_ID_10"/>
+	<value value="11" name="AXI_READ_REQUESTS_ID_11"/>
+	<value value="12" name="AXI_READ_REQUESTS_ID_12"/>
+	<value value="13" name="AXI_READ_REQUESTS_ID_13"/>
+	<value value="14" name="AXI_READ_REQUESTS_ID_14"/>
+	<value value="15" name="AXI_READ_REQUESTS_ID_15"/>
+	<value value="16" name="AXI0_READ_REQUESTS_TOTAL"/>
+	<value value="17" name="AXI1_READ_REQUESTS_TOTAL"/>
+	<value value="18" name="AXI2_READ_REQUESTS_TOTAL"/>
+	<value value="19" name="AXI3_READ_REQUESTS_TOTAL"/>
+	<value value="20" name="AXI_READ_REQUESTS_TOTAL"/>
+	<value value="21" name="AXI_WRITE_REQUESTS_ID_0"/>
+	<value value="22" name="AXI_WRITE_REQUESTS_ID_1"/>
+	<value value="23" name="AXI_WRITE_REQUESTS_ID_2"/>
+	<value value="24" name="AXI_WRITE_REQUESTS_ID_3"/>
+	<value value="25" name="AXI_WRITE_REQUESTS_ID_4"/>
+	<value value="26" name="AXI_WRITE_REQUESTS_ID_5"/>
+	<value value="27" name="AXI_WRITE_REQUESTS_ID_6"/>
+	<value value="28" name="AXI_WRITE_REQUESTS_ID_7"/>
+	<value value="29" name="AXI_WRITE_REQUESTS_ID_8"/>
+	<value value="30" name="AXI_WRITE_REQUESTS_ID_9"/>
+	<value value="31" name="AXI_WRITE_REQUESTS_ID_10"/>
+	<value value="32" name="AXI_WRITE_REQUESTS_ID_11"/>
+	<value value="33" name="AXI_WRITE_REQUESTS_ID_12"/>
+	<value value="34" name="AXI_WRITE_REQUESTS_ID_13"/>
+	<value value="35" name="AXI_WRITE_REQUESTS_ID_14"/>
+	<value value="36" name="AXI_WRITE_REQUESTS_ID_15"/>
+	<value value="37" name="AXI0_WRITE_REQUESTS_TOTAL"/>
+	<value value="38" name="AXI1_WRITE_REQUESTS_TOTAL"/>
+	<value value="39" name="AXI2_WRITE_REQUESTS_TOTAL"/>
+	<value value="40" name="AXI3_WRITE_REQUESTS_TOTAL"/>
+	<value value="41" name="AXI_WRITE_REQUESTS_TOTAL"/>
+	<value value="42" name="AXI_TOTAL_REQUESTS"/>
+	<value value="43" name="AXI_READ_DATA_BEATS_ID_0"/>
+	<value value="44" name="AXI_READ_DATA_BEATS_ID_1"/>
+	<value value="45" name="AXI_READ_DATA_BEATS_ID_2"/>
+	<value value="46" name="AXI_READ_DATA_BEATS_ID_3"/>
+	<value value="47" name="AXI_READ_DATA_BEATS_ID_4"/>
+	<value value="48" name="AXI_READ_DATA_BEATS_ID_5"/>
+	<value value="49" name="AXI_READ_DATA_BEATS_ID_6"/>
+	<value value="50" name="AXI_READ_DATA_BEATS_ID_7"/>
+	<value value="51" name="AXI_READ_DATA_BEATS_ID_8"/>
+	<value value="52" name="AXI_READ_DATA_BEATS_ID_9"/>
+	<value value="53" name="AXI_READ_DATA_BEATS_ID_10"/>
+	<value value="54" name="AXI_READ_DATA_BEATS_ID_11"/>
+	<value value="55" name="AXI_READ_DATA_BEATS_ID_12"/>
+	<value value="56" name="AXI_READ_DATA_BEATS_ID_13"/>
+	<value value="57" name="AXI_READ_DATA_BEATS_ID_14"/>
+	<value value="58" name="AXI_READ_DATA_BEATS_ID_15"/>
+	<value value="59" name="AXI0_READ_DATA_BEATS_TOTAL"/>
+	<value value="60" name="AXI1_READ_DATA_BEATS_TOTAL"/>
+	<value value="61" name="AXI2_READ_DATA_BEATS_TOTAL"/>
+	<value value="62" name="AXI3_READ_DATA_BEATS_TOTAL"/>
+	<value value="63" name="AXI_READ_DATA_BEATS_TOTAL"/>
+	<value value="64" name="AXI_WRITE_DATA_BEATS_ID_0"/>
+	<value value="65" name="AXI_WRITE_DATA_BEATS_ID_1"/>
+	<value value="66" name="AXI_WRITE_DATA_BEATS_ID_2"/>
+	<value value="67" name="AXI_WRITE_DATA_BEATS_ID_3"/>
+	<value value="68" name="AXI_WRITE_DATA_BEATS_ID_4"/>
+	<value value="69" name="AXI_WRITE_DATA_BEATS_ID_5"/>
+	<value value="70" name="AXI_WRITE_DATA_BEATS_ID_6"/>
+	<value value="71" name="AXI_WRITE_DATA_BEATS_ID_7"/>
+	<value value="72" name="AXI_WRITE_DATA_BEATS_ID_8"/>
+	<value value="73" name="AXI_WRITE_DATA_BEATS_ID_9"/>
+	<value value="74" name="AXI_WRITE_DATA_BEATS_ID_10"/>
+	<value value="75" name="AXI_WRITE_DATA_BEATS_ID_11"/>
+	<value value="76" name="AXI_WRITE_DATA_BEATS_ID_12"/>
+	<value value="77" name="AXI_WRITE_DATA_BEATS_ID_13"/>
+	<value value="78" name="AXI_WRITE_DATA_BEATS_ID_14"/>
+	<value value="79" name="AXI_WRITE_DATA_BEATS_ID_15"/>
+	<value value="80" name="AXI0_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="81" name="AXI1_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="82" name="AXI2_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="83" name="AXI3_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="84" name="AXI_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="85" name="AXI_DATA_BEATS_TOTAL"/>
+</enum>
+
+<domain name="A5XX" width="32">
+	<bitset name="A5XX_INT0">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="RBBM_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="RBBM_TRANSFER_TIMEOUT" pos="2" type="boolean"/>
+		<bitfield name="RBBM_ME_MS_TIMEOUT" pos="3" type="boolean"/>
+		<bitfield name="RBBM_PFP_MS_TIMEOUT" pos="4" type="boolean"/>
+		<bitfield name="RBBM_ETS_MS_TIMEOUT" pos="5" type="boolean"/>
+		<bitfield name="RBBM_ATB_ASYNC_OVERFLOW" pos="6" type="boolean"/>
+		<bitfield name="RBBM_GPC_ERROR" pos="7" type="boolean"/>
+		<bitfield name="CP_SW" pos="8" type="boolean"/>
+		<bitfield name="CP_HW_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_DEPTH_TS" pos="10" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_COLOR_TS" pos="11" type="boolean"/>
+		<bitfield name="CP_CCU_RESOLVE_TS" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1" pos="14" type="boolean"/>
+		<bitfield name="CP_RB" pos="15" type="boolean"/>
+		<bitfield name="CP_UNUSED_1" pos="16" type="boolean"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_WT_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="UNKNOWN_1" pos="19" type="boolean"/>
+		<bitfield name="CP_CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="UNUSED_2" pos="21" type="boolean"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="22" type="boolean"/>
+		<bitfield name="MISC_HANG_DETECT" pos="23" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="24" type="boolean"/>
+		<bitfield name="UCHE_TRAP_INTR" pos="25" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_0" pos="26" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_1" pos="27" type="boolean"/>
+		<bitfield name="GPMU_VOLTAGE_DROOP" pos="28" type="boolean"/>
+		<bitfield name="GPMU_FIRMWARE" pos="29" type="boolean"/>
+		<bitfield name="ISDB_CPU_IRQ" pos="30" type="boolean"/>
+		<bitfield name="ISDB_UNDER_DEBUG" pos="31" type="boolean"/>
+	</bitset>
+
+	<!-- CP Interrupt bits -->
+	<bitset name="A5XX_CP_INT">
+		<bitfield name="CP_OPCODE_ERROR" pos="0" type="boolean"/>
+		<bitfield name="CP_RESERVED_BIT_ERROR" pos="1" type="boolean"/>
+		<bitfield name="CP_HW_FAULT_ERROR" pos="2" type="boolean"/>
+		<bitfield name="CP_DMA_ERROR" pos="3" type="boolean"/>
+		<bitfield name="CP_REGISTER_PROTECTION_ERROR" pos="4" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR" pos="5" type="boolean"/>
+	</bitset>
+
+	<!-- CP registers -->
+	<reg32 offset="0x0800" name="CP_RB_BASE"/>
+	<reg32 offset="0x0801" name="CP_RB_BASE_HI"/>
+	<reg32 offset="0x0802" name="CP_RB_CNTL"/>
+	<reg32 offset="0x0804" name="CP_RB_RPTR_ADDR"/>
+	<reg32 offset="0x0805" name="CP_RB_RPTR_ADDR_HI"/>
+	<reg32 offset="0x0806" name="CP_RB_RPTR"/>
+	<reg32 offset="0x0807" name="CP_RB_WPTR"/>
+	<reg32 offset="0x0808" name="CP_PFP_STAT_ADDR"/>
+	<reg32 offset="0x0809" name="CP_PFP_STAT_DATA"/>
+	<reg32 offset="0x080b" name="CP_DRAW_STATE_ADDR"/>
+	<reg32 offset="0x080c" name="CP_DRAW_STATE_DATA"/>
+	<reg32 offset="0x080d" name="CP_ME_NRT_ADDR_LO"/>
+	<reg32 offset="0x080e" name="CP_ME_NRT_ADDR_HI"/>
+	<reg32 offset="0x0810" name="CP_ME_NRT_DATA"/>
+	<reg32 offset="0x0817" name="CP_CRASH_SCRIPT_BASE_LO"/>
+	<reg32 offset="0x0818" name="CP_CRASH_SCRIPT_BASE_HI"/>
+	<reg32 offset="0x0819" name="CP_CRASH_DUMP_CNTL"/>
+	<reg32 offset="0x081a" name="CP_ME_STAT_ADDR"/>
+	<reg32 offset="0x081f" name="CP_ROQ_THRESHOLDS_1"/>
+	<reg32 offset="0x0820" name="CP_ROQ_THRESHOLDS_2"/>
+	<reg32 offset="0x0821" name="CP_ROQ_DBG_ADDR"/>
+	<reg32 offset="0x0822" name="CP_ROQ_DBG_DATA"/>
+	<reg32 offset="0x0823" name="CP_MEQ_DBG_ADDR"/>
+	<reg32 offset="0x0824" name="CP_MEQ_DBG_DATA"/>
+	<reg32 offset="0x0825" name="CP_MEQ_THRESHOLDS"/>
+	<reg32 offset="0x0826" name="CP_MERCIU_SIZE"/>
+	<reg32 offset="0x0827" name="CP_MERCIU_DBG_ADDR"/>
+	<reg32 offset="0x0828" name="CP_MERCIU_DBG_DATA_1"/>
+	<reg32 offset="0x0829" name="CP_MERCIU_DBG_DATA_2"/>
+	<reg32 offset="0x082a" name="CP_PFP_UCODE_DBG_ADDR"/>
+	<reg32 offset="0x082b" name="CP_PFP_UCODE_DBG_DATA"/>
+	<reg32 offset="0x082f" name="CP_ME_UCODE_DBG_ADDR"/>
+	<reg32 offset="0x0830" name="CP_ME_UCODE_DBG_DATA"/>
+	<reg32 offset="0x0831" name="CP_CNTL"/>
+	<reg32 offset="0x0832" name="CP_PFP_ME_CNTL"/>
+	<reg32 offset="0x0833" name="CP_CHICKEN_DBG"/>
+	<reg32 offset="0x0835" name="CP_PFP_INSTR_BASE_LO"/>
+	<reg32 offset="0x0836" name="CP_PFP_INSTR_BASE_HI"/>
+	<reg32 offset="0x0838" name="CP_ME_INSTR_BASE_LO"/>
+	<reg32 offset="0x0839" name="CP_ME_INSTR_BASE_HI"/>
+	<reg32 offset="0x083b" name="CP_CONTEXT_SWITCH_CNTL"/>
+	<reg32 offset="0x083c" name="CP_CONTEXT_SWITCH_RESTORE_ADDR_LO"/>
+	<reg32 offset="0x083d" name="CP_CONTEXT_SWITCH_RESTORE_ADDR_HI"/>
+	<reg32 offset="0x083e" name="CP_CONTEXT_SWITCH_SAVE_ADDR_LO"/>
+	<reg32 offset="0x083f" name="CP_CONTEXT_SWITCH_SAVE_ADDR_HI"/>
+	<reg32 offset="0x0840" name="CP_CONTEXT_SWITCH_SMMU_INFO_LO"/>
+	<reg32 offset="0x0841" name="CP_CONTEXT_SWITCH_SMMU_INFO_HI"/>
+	<reg32 offset="0x0860" name="CP_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0b14" name="CP_ME_STAT_DATA"/>
+	<reg32 offset="0x0b15" name="CP_WFI_PEND_CTR"/>
+	<reg32 offset="0x0b18" name="CP_INTERRUPT_STATUS"/>
+	<reg32 offset="0x0b1a" name="CP_HW_FAULT"/>
+	<reg32 offset="0x0b1c" name="CP_PROTECT_STATUS"/>
+	<reg32 offset="0x0b1f" name="CP_IB1_BASE"/>
+	<reg32 offset="0x0b20" name="CP_IB1_BASE_HI"/>
+	<reg32 offset="0x0b21" name="CP_IB1_BUFSZ"/>
+	<reg32 offset="0x0b22" name="CP_IB2_BASE"/>
+	<reg32 offset="0x0b23" name="CP_IB2_BASE_HI"/>
+	<reg32 offset="0x0b24" name="CP_IB2_BUFSZ"/>
+	<array offset="0x0b78" name="CP_SCRATCH" stride="1" length="8">
+		<reg32 offset="0x0" name="REG" type="uint"/>
+	</array>
+	<array offset="0x0880" name="CP_PROTECT" stride="1" length="32">
+		<reg32 offset="0x0" name="REG" type="adreno_cp_protect"/>
+	</array>
+	<reg32 offset="0x08a0" name="CP_PROTECT_CNTL"/>
+	<reg32 offset="0x0b1b" name="CP_AHB_FAULT"/>
+	<reg32 offset="0x0bb0" name="CP_PERFCTR_CP_SEL_0" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb1" name="CP_PERFCTR_CP_SEL_1" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb2" name="CP_PERFCTR_CP_SEL_2" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb3" name="CP_PERFCTR_CP_SEL_3" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb4" name="CP_PERFCTR_CP_SEL_4" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb5" name="CP_PERFCTR_CP_SEL_5" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb6" name="CP_PERFCTR_CP_SEL_6" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb7" name="CP_PERFCTR_CP_SEL_7" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bc1" name="VSC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0bba" name="CP_POWERCTR_CP_SEL_0"/>
+	<reg32 offset="0x0bbb" name="CP_POWERCTR_CP_SEL_1"/>
+	<reg32 offset="0x0bbc" name="CP_POWERCTR_CP_SEL_2"/>
+	<reg32 offset="0x0bbd" name="CP_POWERCTR_CP_SEL_3"/>
+
+	<!-- RBBM registers -->
+	<reg32 offset="0x0004" name="RBBM_CFG_DBGBUS_SEL_A"/>
+	<reg32 offset="0x0005" name="RBBM_CFG_DBGBUS_SEL_B"/>
+	<reg32 offset="0x0006" name="RBBM_CFG_DBGBUS_SEL_C"/>
+	<reg32 offset="0x0007" name="RBBM_CFG_DBGBUS_SEL_D"/>
+<!--
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PING_INDEX_SHIFT    0x0
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PING_BLK_SEL_SHIFT  0x8
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PONG_INDEX_SHIFT    0x10
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PONG_BLK_SEL_SHIFT  0x18
+ -->
+	<reg32 offset="0x0008" name="RBBM_CFG_DBGBUS_CNTLT"/>
+	<reg32 offset="0x0009" name="RBBM_CFG_DBGBUS_CNTLM"/>
+	<reg32 offset="0x0018" name="RBBM_CFG_DEBBUS_CTLTM_ENABLE_SHIFT"/>
+	<reg32 offset="0x000a" name="RBBM_CFG_DBGBUS_OPL"/>
+	<reg32 offset="0x000b" name="RBBM_CFG_DBGBUS_OPE"/>
+	<reg32 offset="0x000c" name="RBBM_CFG_DBGBUS_IVTL_0"/>
+	<reg32 offset="0x000d" name="RBBM_CFG_DBGBUS_IVTL_1"/>
+	<reg32 offset="0x000e" name="RBBM_CFG_DBGBUS_IVTL_2"/>
+	<reg32 offset="0x000f" name="RBBM_CFG_DBGBUS_IVTL_3"/>
+	<reg32 offset="0x0010" name="RBBM_CFG_DBGBUS_MASKL_0"/>
+	<reg32 offset="0x0011" name="RBBM_CFG_DBGBUS_MASKL_1"/>
+	<reg32 offset="0x0012" name="RBBM_CFG_DBGBUS_MASKL_2"/>
+	<reg32 offset="0x0013" name="RBBM_CFG_DBGBUS_MASKL_3"/>
+	<reg32 offset="0x0014" name="RBBM_CFG_DBGBUS_BYTEL_0"/>
+	<reg32 offset="0x0015" name="RBBM_CFG_DBGBUS_BYTEL_1"/>
+	<reg32 offset="0x0016" name="RBBM_CFG_DBGBUS_IVTE_0"/>
+	<reg32 offset="0x0017" name="RBBM_CFG_DBGBUS_IVTE_1"/>
+	<reg32 offset="0x0018" name="RBBM_CFG_DBGBUS_IVTE_2"/>
+	<reg32 offset="0x0019" name="RBBM_CFG_DBGBUS_IVTE_3"/>
+	<reg32 offset="0x001a" name="RBBM_CFG_DBGBUS_MASKE_0"/>
+	<reg32 offset="0x001b" name="RBBM_CFG_DBGBUS_MASKE_1"/>
+	<reg32 offset="0x001c" name="RBBM_CFG_DBGBUS_MASKE_2"/>
+	<reg32 offset="0x001d" name="RBBM_CFG_DBGBUS_MASKE_3"/>
+	<reg32 offset="0x001e" name="RBBM_CFG_DBGBUS_NIBBLEE"/>
+	<reg32 offset="0x001f" name="RBBM_CFG_DBGBUS_PTRC0"/>
+	<reg32 offset="0x0020" name="RBBM_CFG_DBGBUS_PTRC1"/>
+	<reg32 offset="0x0021" name="RBBM_CFG_DBGBUS_LOADREG"/>
+	<reg32 offset="0x0022" name="RBBM_CFG_DBGBUS_IDX"/>
+	<reg32 offset="0x0023" name="RBBM_CFG_DBGBUS_CLRC"/>
+	<reg32 offset="0x0024" name="RBBM_CFG_DBGBUS_LOADIVT"/>
+	<reg32 offset="0x002f" name="RBBM_INTERFACE_HANG_INT_CNTL"/>
+	<reg32 offset="0x0037" name="RBBM_INT_CLEAR_CMD"/>
+	<reg32 offset="0x0038" name="RBBM_INT_0_MASK">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="RBBM_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="RBBM_TRANSFER_TIMEOUT" pos="2" type="boolean"/>
+		<bitfield name="RBBM_ME_MS_TIMEOUT" pos="3" type="boolean"/>
+		<bitfield name="RBBM_PFP_MS_TIMEOUT" pos="4" type="boolean"/>
+		<bitfield name="RBBM_ETS_MS_TIMEOUT" pos="5" type="boolean"/>
+		<bitfield name="RBBM_ATB_ASYNC_OVERFLOW" pos="6" type="boolean"/>
+		<bitfield name="RBBM_GPC_ERROR" pos="7" type="boolean"/>
+		<bitfield name="CP_SW" pos="8" type="boolean"/>
+		<bitfield name="CP_HW_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_DEPTH_TS" pos="10" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_COLOR_TS" pos="11" type="boolean"/>
+		<bitfield name="CP_CCU_RESOLVE_TS" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1" pos="14" type="boolean"/>
+		<bitfield name="CP_RB" pos="15" type="boolean"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_WT_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="CP_CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="22" type="boolean"/>
+		<bitfield name="MISC_HANG_DETECT" pos="23" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="24" type="boolean"/>
+		<bitfield name="UCHE_TRAP_INTR" pos="25" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_0" pos="26" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_1" pos="27" type="boolean"/>
+		<bitfield name="GPMU_VOLTAGE_DROOP" pos="28" type="boolean"/>
+		<bitfield name="GPMU_FIRMWARE" pos="29" type="boolean"/>
+		<bitfield name="ISDB_CPU_IRQ" pos="30" type="boolean"/>
+		<bitfield name="ISDB_UNDER_DEBUG" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x003f" name="RBBM_AHB_DBG_CNTL"/>
+	<reg32 offset="0x0041" name="RBBM_EXT_VBIF_DBG_CNTL"/>
+	<reg32 offset="0x0043" name="RBBM_SW_RESET_CMD"/>
+	<reg32 offset="0x0045" name="RBBM_BLOCK_SW_RESET_CMD"/>
+	<reg32 offset="0x0046" name="RBBM_BLOCK_SW_RESET_CMD2"/>
+	<reg32 offset="0x0048" name="RBBM_DBG_LO_HI_GPIO"/>
+	<reg32 offset="0x0049" name="RBBM_EXT_TRACE_BUS_CNTL"/>
+	<reg32 offset="0x004a" name="RBBM_CLOCK_CNTL_TP0"/>
+	<reg32 offset="0x004b" name="RBBM_CLOCK_CNTL_TP1"/>
+	<reg32 offset="0x004c" name="RBBM_CLOCK_CNTL_TP2"/>
+	<reg32 offset="0x004d" name="RBBM_CLOCK_CNTL_TP3"/>
+	<reg32 offset="0x004e" name="RBBM_CLOCK_CNTL2_TP0"/>
+	<reg32 offset="0x004f" name="RBBM_CLOCK_CNTL2_TP1"/>
+	<reg32 offset="0x0050" name="RBBM_CLOCK_CNTL2_TP2"/>
+	<reg32 offset="0x0051" name="RBBM_CLOCK_CNTL2_TP3"/>
+	<reg32 offset="0x0052" name="RBBM_CLOCK_CNTL3_TP0"/>
+	<reg32 offset="0x0053" name="RBBM_CLOCK_CNTL3_TP1"/>
+	<reg32 offset="0x0054" name="RBBM_CLOCK_CNTL3_TP2"/>
+	<reg32 offset="0x0055" name="RBBM_CLOCK_CNTL3_TP3"/>
+	<reg32 offset="0x0059" name="RBBM_READ_AHB_THROUGH_DBG"/>
+	<reg32 offset="0x005a" name="RBBM_CLOCK_CNTL_UCHE"/>
+	<reg32 offset="0x005b" name="RBBM_CLOCK_CNTL2_UCHE"/>
+	<reg32 offset="0x005c" name="RBBM_CLOCK_CNTL3_UCHE"/>
+	<reg32 offset="0x005d" name="RBBM_CLOCK_CNTL4_UCHE"/>
+	<reg32 offset="0x005e" name="RBBM_CLOCK_HYST_UCHE"/>
+	<reg32 offset="0x005f" name="RBBM_CLOCK_DELAY_UCHE"/>
+	<reg32 offset="0x0060" name="RBBM_CLOCK_MODE_GPC"/>
+	<reg32 offset="0x0061" name="RBBM_CLOCK_DELAY_GPC"/>
+	<reg32 offset="0x0062" name="RBBM_CLOCK_HYST_GPC"/>
+	<reg32 offset="0x0063" name="RBBM_CLOCK_CNTL_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0064" name="RBBM_CLOCK_HYST_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0065" name="RBBM_CLOCK_DELAY_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0066" name="RBBM_CLOCK_DELAY_HLSQ"/>
+	<reg32 offset="0x0067" name="RBBM_CLOCK_CNTL"/>
+	<reg32 offset="0x0068" name="RBBM_CLOCK_CNTL_SP0"/>
+	<reg32 offset="0x0069" name="RBBM_CLOCK_CNTL_SP1"/>
+	<reg32 offset="0x006a" name="RBBM_CLOCK_CNTL_SP2"/>
+	<reg32 offset="0x006b" name="RBBM_CLOCK_CNTL_SP3"/>
+	<reg32 offset="0x006c" name="RBBM_CLOCK_CNTL2_SP0"/>
+	<reg32 offset="0x006d" name="RBBM_CLOCK_CNTL2_SP1"/>
+	<reg32 offset="0x006e" name="RBBM_CLOCK_CNTL2_SP2"/>
+	<reg32 offset="0x006f" name="RBBM_CLOCK_CNTL2_SP3"/>
+	<reg32 offset="0x0070" name="RBBM_CLOCK_HYST_SP0"/>
+	<reg32 offset="0x0071" name="RBBM_CLOCK_HYST_SP1"/>
+	<reg32 offset="0x0072" name="RBBM_CLOCK_HYST_SP2"/>
+	<reg32 offset="0x0073" name="RBBM_CLOCK_HYST_SP3"/>
+	<reg32 offset="0x0074" name="RBBM_CLOCK_DELAY_SP0"/>
+	<reg32 offset="0x0075" name="RBBM_CLOCK_DELAY_SP1"/>
+	<reg32 offset="0x0076" name="RBBM_CLOCK_DELAY_SP2"/>
+	<reg32 offset="0x0077" name="RBBM_CLOCK_DELAY_SP3"/>
+	<reg32 offset="0x0078" name="RBBM_CLOCK_CNTL_RB0"/>
+	<reg32 offset="0x0079" name="RBBM_CLOCK_CNTL_RB1"/>
+	<reg32 offset="0x007a" name="RBBM_CLOCK_CNTL_RB2"/>
+	<reg32 offset="0x007b" name="RBBM_CLOCK_CNTL_RB3"/>
+	<reg32 offset="0x007c" name="RBBM_CLOCK_CNTL2_RB0"/>
+	<reg32 offset="0x007d" name="RBBM_CLOCK_CNTL2_RB1"/>
+	<reg32 offset="0x007e" name="RBBM_CLOCK_CNTL2_RB2"/>
+	<reg32 offset="0x007f" name="RBBM_CLOCK_CNTL2_RB3"/>
+	<reg32 offset="0x0080" name="RBBM_CLOCK_HYST_RAC"/>
+	<reg32 offset="0x0081" name="RBBM_CLOCK_DELAY_RAC"/>
+	<reg32 offset="0x0082" name="RBBM_CLOCK_CNTL_CCU0"/>
+	<reg32 offset="0x0083" name="RBBM_CLOCK_CNTL_CCU1"/>
+	<reg32 offset="0x0084" name="RBBM_CLOCK_CNTL_CCU2"/>
+	<reg32 offset="0x0085" name="RBBM_CLOCK_CNTL_CCU3"/>
+	<reg32 offset="0x0086" name="RBBM_CLOCK_HYST_RB_CCU0"/>
+	<reg32 offset="0x0087" name="RBBM_CLOCK_HYST_RB_CCU1"/>
+	<reg32 offset="0x0088" name="RBBM_CLOCK_HYST_RB_CCU2"/>
+	<reg32 offset="0x0089" name="RBBM_CLOCK_HYST_RB_CCU3"/>
+	<reg32 offset="0x008a" name="RBBM_CLOCK_CNTL_RAC"/>
+	<reg32 offset="0x008b" name="RBBM_CLOCK_CNTL2_RAC"/>
+	<reg32 offset="0x008c" name="RBBM_CLOCK_DELAY_RB_CCU_L1_0"/>
+	<reg32 offset="0x008d" name="RBBM_CLOCK_DELAY_RB_CCU_L1_1"/>
+	<reg32 offset="0x008e" name="RBBM_CLOCK_DELAY_RB_CCU_L1_2"/>
+	<reg32 offset="0x008f" name="RBBM_CLOCK_DELAY_RB_CCU_L1_3"/>
+	<reg32 offset="0x0090" name="RBBM_CLOCK_HYST_VFD"/>
+	<reg32 offset="0x0091" name="RBBM_CLOCK_MODE_VFD"/>
+	<reg32 offset="0x0092" name="RBBM_CLOCK_DELAY_VFD"/>
+	<reg32 offset="0x0093" name="RBBM_AHB_CNTL0"/>
+	<reg32 offset="0x0094" name="RBBM_AHB_CNTL1"/>
+	<reg32 offset="0x0095" name="RBBM_AHB_CNTL2"/>
+	<reg32 offset="0x0096" name="RBBM_AHB_CMD"/>
+	<reg32 offset="0x009c" name="RBBM_INTERFACE_HANG_MASK_CNTL11"/>
+	<reg32 offset="0x009d" name="RBBM_INTERFACE_HANG_MASK_CNTL12"/>
+	<reg32 offset="0x009e" name="RBBM_INTERFACE_HANG_MASK_CNTL13"/>
+	<reg32 offset="0x009f" name="RBBM_INTERFACE_HANG_MASK_CNTL14"/>
+	<reg32 offset="0x00a0" name="RBBM_INTERFACE_HANG_MASK_CNTL15"/>
+	<reg32 offset="0x00a1" name="RBBM_INTERFACE_HANG_MASK_CNTL16"/>
+	<reg32 offset="0x00a2" name="RBBM_INTERFACE_HANG_MASK_CNTL17"/>
+	<reg32 offset="0x00a3" name="RBBM_INTERFACE_HANG_MASK_CNTL18"/>
+	<reg32 offset="0x00a4" name="RBBM_CLOCK_DELAY_TP0"/>
+	<reg32 offset="0x00a5" name="RBBM_CLOCK_DELAY_TP1"/>
+	<reg32 offset="0x00a6" name="RBBM_CLOCK_DELAY_TP2"/>
+	<reg32 offset="0x00a7" name="RBBM_CLOCK_DELAY_TP3"/>
+	<reg32 offset="0x00a8" name="RBBM_CLOCK_DELAY2_TP0"/>
+	<reg32 offset="0x00a9" name="RBBM_CLOCK_DELAY2_TP1"/>
+	<reg32 offset="0x00aa" name="RBBM_CLOCK_DELAY2_TP2"/>
+	<reg32 offset="0x00ab" name="RBBM_CLOCK_DELAY2_TP3"/>
+	<reg32 offset="0x00ac" name="RBBM_CLOCK_DELAY3_TP0"/>
+	<reg32 offset="0x00ad" name="RBBM_CLOCK_DELAY3_TP1"/>
+	<reg32 offset="0x00ae" name="RBBM_CLOCK_DELAY3_TP2"/>
+	<reg32 offset="0x00af" name="RBBM_CLOCK_DELAY3_TP3"/>
+	<reg32 offset="0x00b0" name="RBBM_CLOCK_HYST_TP0"/>
+	<reg32 offset="0x00b1" name="RBBM_CLOCK_HYST_TP1"/>
+	<reg32 offset="0x00b2" name="RBBM_CLOCK_HYST_TP2"/>
+	<reg32 offset="0x00b3" name="RBBM_CLOCK_HYST_TP3"/>
+	<reg32 offset="0x00b4" name="RBBM_CLOCK_HYST2_TP0"/>
+	<reg32 offset="0x00b5" name="RBBM_CLOCK_HYST2_TP1"/>
+	<reg32 offset="0x00b6" name="RBBM_CLOCK_HYST2_TP2"/>
+	<reg32 offset="0x00b7" name="RBBM_CLOCK_HYST2_TP3"/>
+	<reg32 offset="0x00b8" name="RBBM_CLOCK_HYST3_TP0"/>
+	<reg32 offset="0x00b9" name="RBBM_CLOCK_HYST3_TP1"/>
+	<reg32 offset="0x00ba" name="RBBM_CLOCK_HYST3_TP2"/>
+	<reg32 offset="0x00bb" name="RBBM_CLOCK_HYST3_TP3"/>
+	<reg32 offset="0x00c8" name="RBBM_CLOCK_CNTL_GPMU"/>
+	<reg32 offset="0x00c9" name="RBBM_CLOCK_DELAY_GPMU"/>
+	<reg32 offset="0x00ca" name="RBBM_CLOCK_HYST_GPMU"/>
+	<reg32 offset="0x03a0" name="RBBM_PERFCTR_CP_0_LO"/>
+	<reg32 offset="0x03a1" name="RBBM_PERFCTR_CP_0_HI"/>
+	<reg32 offset="0x03a2" name="RBBM_PERFCTR_CP_1_LO"/>
+	<reg32 offset="0x03a3" name="RBBM_PERFCTR_CP_1_HI"/>
+	<reg32 offset="0x03a4" name="RBBM_PERFCTR_CP_2_LO"/>
+	<reg32 offset="0x03a5" name="RBBM_PERFCTR_CP_2_HI"/>
+	<reg32 offset="0x03a6" name="RBBM_PERFCTR_CP_3_LO"/>
+	<reg32 offset="0x03a7" name="RBBM_PERFCTR_CP_3_HI"/>
+	<reg32 offset="0x03a8" name="RBBM_PERFCTR_CP_4_LO"/>
+	<reg32 offset="0x03a9" name="RBBM_PERFCTR_CP_4_HI"/>
+	<reg32 offset="0x03aa" name="RBBM_PERFCTR_CP_5_LO"/>
+	<reg32 offset="0x03ab" name="RBBM_PERFCTR_CP_5_HI"/>
+	<reg32 offset="0x03ac" name="RBBM_PERFCTR_CP_6_LO"/>
+	<reg32 offset="0x03ad" name="RBBM_PERFCTR_CP_6_HI"/>
+	<reg32 offset="0x03ae" name="RBBM_PERFCTR_CP_7_LO"/>
+	<reg32 offset="0x03af" name="RBBM_PERFCTR_CP_7_HI"/>
+	<reg32 offset="0x03b0" name="RBBM_PERFCTR_RBBM_0_LO"/>
+	<reg32 offset="0x03b1" name="RBBM_PERFCTR_RBBM_0_HI"/>
+	<reg32 offset="0x03b2" name="RBBM_PERFCTR_RBBM_1_LO"/>
+	<reg32 offset="0x03b3" name="RBBM_PERFCTR_RBBM_1_HI"/>
+	<reg32 offset="0x03b4" name="RBBM_PERFCTR_RBBM_2_LO"/>
+	<reg32 offset="0x03b5" name="RBBM_PERFCTR_RBBM_2_HI"/>
+	<reg32 offset="0x03b6" name="RBBM_PERFCTR_RBBM_3_LO"/>
+	<reg32 offset="0x03b7" name="RBBM_PERFCTR_RBBM_3_HI"/>
+	<reg32 offset="0x03b8" name="RBBM_PERFCTR_PC_0_LO"/>
+	<reg32 offset="0x03b9" name="RBBM_PERFCTR_PC_0_HI"/>
+	<reg32 offset="0x03ba" name="RBBM_PERFCTR_PC_1_LO"/>
+	<reg32 offset="0x03bb" name="RBBM_PERFCTR_PC_1_HI"/>
+	<reg32 offset="0x03bc" name="RBBM_PERFCTR_PC_2_LO"/>
+	<reg32 offset="0x03bd" name="RBBM_PERFCTR_PC_2_HI"/>
+	<reg32 offset="0x03be" name="RBBM_PERFCTR_PC_3_LO"/>
+	<reg32 offset="0x03bf" name="RBBM_PERFCTR_PC_3_HI"/>
+	<reg32 offset="0x03c0" name="RBBM_PERFCTR_PC_4_LO"/>
+	<reg32 offset="0x03c1" name="RBBM_PERFCTR_PC_4_HI"/>
+	<reg32 offset="0x03c2" name="RBBM_PERFCTR_PC_5_LO"/>
+	<reg32 offset="0x03c3" name="RBBM_PERFCTR_PC_5_HI"/>
+	<reg32 offset="0x03c4" name="RBBM_PERFCTR_PC_6_LO"/>
+	<reg32 offset="0x03c5" name="RBBM_PERFCTR_PC_6_HI"/>
+	<reg32 offset="0x03c6" name="RBBM_PERFCTR_PC_7_LO"/>
+	<reg32 offset="0x03c7" name="RBBM_PERFCTR_PC_7_HI"/>
+	<reg32 offset="0x03c8" name="RBBM_PERFCTR_VFD_0_LO"/>
+	<reg32 offset="0x03c9" name="RBBM_PERFCTR_VFD_0_HI"/>
+	<reg32 offset="0x03ca" name="RBBM_PERFCTR_VFD_1_LO"/>
+	<reg32 offset="0x03cb" name="RBBM_PERFCTR_VFD_1_HI"/>
+	<reg32 offset="0x03cc" name="RBBM_PERFCTR_VFD_2_LO"/>
+	<reg32 offset="0x03cd" name="RBBM_PERFCTR_VFD_2_HI"/>
+	<reg32 offset="0x03ce" name="RBBM_PERFCTR_VFD_3_LO"/>
+	<reg32 offset="0x03cf" name="RBBM_PERFCTR_VFD_3_HI"/>
+	<reg32 offset="0x03d0" name="RBBM_PERFCTR_VFD_4_LO"/>
+	<reg32 offset="0x03d1" name="RBBM_PERFCTR_VFD_4_HI"/>
+	<reg32 offset="0x03d2" name="RBBM_PERFCTR_VFD_5_LO"/>
+	<reg32 offset="0x03d3" name="RBBM_PERFCTR_VFD_5_HI"/>
+	<reg32 offset="0x03d4" name="RBBM_PERFCTR_VFD_6_LO"/>
+	<reg32 offset="0x03d5" name="RBBM_PERFCTR_VFD_6_HI"/>
+	<reg32 offset="0x03d6" name="RBBM_PERFCTR_VFD_7_LO"/>
+	<reg32 offset="0x03d7" name="RBBM_PERFCTR_VFD_7_HI"/>
+	<reg32 offset="0x03d8" name="RBBM_PERFCTR_HLSQ_0_LO"/>
+	<reg32 offset="0x03d9" name="RBBM_PERFCTR_HLSQ_0_HI"/>
+	<reg32 offset="0x03da" name="RBBM_PERFCTR_HLSQ_1_LO"/>
+	<reg32 offset="0x03db" name="RBBM_PERFCTR_HLSQ_1_HI"/>
+	<reg32 offset="0x03dc" name="RBBM_PERFCTR_HLSQ_2_LO"/>
+	<reg32 offset="0x03dd" name="RBBM_PERFCTR_HLSQ_2_HI"/>
+	<reg32 offset="0x03de" name="RBBM_PERFCTR_HLSQ_3_LO"/>
+	<reg32 offset="0x03df" name="RBBM_PERFCTR_HLSQ_3_HI"/>
+	<reg32 offset="0x03e0" name="RBBM_PERFCTR_HLSQ_4_LO"/>
+	<reg32 offset="0x03e1" name="RBBM_PERFCTR_HLSQ_4_HI"/>
+	<reg32 offset="0x03e2" name="RBBM_PERFCTR_HLSQ_5_LO"/>
+	<reg32 offset="0x03e3" name="RBBM_PERFCTR_HLSQ_5_HI"/>
+	<reg32 offset="0x03e4" name="RBBM_PERFCTR_HLSQ_6_LO"/>
+	<reg32 offset="0x03e5" name="RBBM_PERFCTR_HLSQ_6_HI"/>
+	<reg32 offset="0x03e6" name="RBBM_PERFCTR_HLSQ_7_LO"/>
+	<reg32 offset="0x03e7" name="RBBM_PERFCTR_HLSQ_7_HI"/>
+	<reg32 offset="0x03e8" name="RBBM_PERFCTR_VPC_0_LO"/>
+	<reg32 offset="0x03e9" name="RBBM_PERFCTR_VPC_0_HI"/>
+	<reg32 offset="0x03ea" name="RBBM_PERFCTR_VPC_1_LO"/>
+	<reg32 offset="0x03eb" name="RBBM_PERFCTR_VPC_1_HI"/>
+	<reg32 offset="0x03ec" name="RBBM_PERFCTR_VPC_2_LO"/>
+	<reg32 offset="0x03ed" name="RBBM_PERFCTR_VPC_2_HI"/>
+	<reg32 offset="0x03ee" name="RBBM_PERFCTR_VPC_3_LO"/>
+	<reg32 offset="0x03ef" name="RBBM_PERFCTR_VPC_3_HI"/>
+	<reg32 offset="0x03f0" name="RBBM_PERFCTR_CCU_0_LO"/>
+	<reg32 offset="0x03f1" name="RBBM_PERFCTR_CCU_0_HI"/>
+	<reg32 offset="0x03f2" name="RBBM_PERFCTR_CCU_1_LO"/>
+	<reg32 offset="0x03f3" name="RBBM_PERFCTR_CCU_1_HI"/>
+	<reg32 offset="0x03f4" name="RBBM_PERFCTR_CCU_2_LO"/>
+	<reg32 offset="0x03f5" name="RBBM_PERFCTR_CCU_2_HI"/>
+	<reg32 offset="0x03f6" name="RBBM_PERFCTR_CCU_3_LO"/>
+	<reg32 offset="0x03f7" name="RBBM_PERFCTR_CCU_3_HI"/>
+	<reg32 offset="0x03f8" name="RBBM_PERFCTR_TSE_0_LO"/>
+	<reg32 offset="0x03f9" name="RBBM_PERFCTR_TSE_0_HI"/>
+	<reg32 offset="0x03fa" name="RBBM_PERFCTR_TSE_1_LO"/>
+	<reg32 offset="0x03fb" name="RBBM_PERFCTR_TSE_1_HI"/>
+	<reg32 offset="0x03fc" name="RBBM_PERFCTR_TSE_2_LO"/>
+	<reg32 offset="0x03fd" name="RBBM_PERFCTR_TSE_2_HI"/>
+	<reg32 offset="0x03fe" name="RBBM_PERFCTR_TSE_3_LO"/>
+	<reg32 offset="0x03ff" name="RBBM_PERFCTR_TSE_3_HI"/>
+	<reg32 offset="0x0400" name="RBBM_PERFCTR_RAS_0_LO"/>
+	<reg32 offset="0x0401" name="RBBM_PERFCTR_RAS_0_HI"/>
+	<reg32 offset="0x0402" name="RBBM_PERFCTR_RAS_1_LO"/>
+	<reg32 offset="0x0403" name="RBBM_PERFCTR_RAS_1_HI"/>
+	<reg32 offset="0x0404" name="RBBM_PERFCTR_RAS_2_LO"/>
+	<reg32 offset="0x0405" name="RBBM_PERFCTR_RAS_2_HI"/>
+	<reg32 offset="0x0406" name="RBBM_PERFCTR_RAS_3_LO"/>
+	<reg32 offset="0x0407" name="RBBM_PERFCTR_RAS_3_HI"/>
+	<reg32 offset="0x0408" name="RBBM_PERFCTR_UCHE_0_LO"/>
+	<reg32 offset="0x0409" name="RBBM_PERFCTR_UCHE_0_HI"/>
+	<reg32 offset="0x040a" name="RBBM_PERFCTR_UCHE_1_LO"/>
+	<reg32 offset="0x040b" name="RBBM_PERFCTR_UCHE_1_HI"/>
+	<reg32 offset="0x040c" name="RBBM_PERFCTR_UCHE_2_LO"/>
+	<reg32 offset="0x040d" name="RBBM_PERFCTR_UCHE_2_HI"/>
+	<reg32 offset="0x040e" name="RBBM_PERFCTR_UCHE_3_LO"/>
+	<reg32 offset="0x040f" name="RBBM_PERFCTR_UCHE_3_HI"/>
+	<reg32 offset="0x0410" name="RBBM_PERFCTR_UCHE_4_LO"/>
+	<reg32 offset="0x0411" name="RBBM_PERFCTR_UCHE_4_HI"/>
+	<reg32 offset="0x0412" name="RBBM_PERFCTR_UCHE_5_LO"/>
+	<reg32 offset="0x0413" name="RBBM_PERFCTR_UCHE_5_HI"/>
+	<reg32 offset="0x0414" name="RBBM_PERFCTR_UCHE_6_LO"/>
+	<reg32 offset="0x0415" name="RBBM_PERFCTR_UCHE_6_HI"/>
+	<reg32 offset="0x0416" name="RBBM_PERFCTR_UCHE_7_LO"/>
+	<reg32 offset="0x0417" name="RBBM_PERFCTR_UCHE_7_HI"/>
+	<reg32 offset="0x0418" name="RBBM_PERFCTR_TP_0_LO"/>
+	<reg32 offset="0x0419" name="RBBM_PERFCTR_TP_0_HI"/>
+	<reg32 offset="0x041a" name="RBBM_PERFCTR_TP_1_LO"/>
+	<reg32 offset="0x041b" name="RBBM_PERFCTR_TP_1_HI"/>
+	<reg32 offset="0x041c" name="RBBM_PERFCTR_TP_2_LO"/>
+	<reg32 offset="0x041d" name="RBBM_PERFCTR_TP_2_HI"/>
+	<reg32 offset="0x041e" name="RBBM_PERFCTR_TP_3_LO"/>
+	<reg32 offset="0x041f" name="RBBM_PERFCTR_TP_3_HI"/>
+	<reg32 offset="0x0420" name="RBBM_PERFCTR_TP_4_LO"/>
+	<reg32 offset="0x0421" name="RBBM_PERFCTR_TP_4_HI"/>
+	<reg32 offset="0x0422" name="RBBM_PERFCTR_TP_5_LO"/>
+	<reg32 offset="0x0423" name="RBBM_PERFCTR_TP_5_HI"/>
+	<reg32 offset="0x0424" name="RBBM_PERFCTR_TP_6_LO"/>
+	<reg32 offset="0x0425" name="RBBM_PERFCTR_TP_6_HI"/>
+	<reg32 offset="0x0426" name="RBBM_PERFCTR_TP_7_LO"/>
+	<reg32 offset="0x0427" name="RBBM_PERFCTR_TP_7_HI"/>
+	<reg32 offset="0x0428" name="RBBM_PERFCTR_SP_0_LO"/>
+	<reg32 offset="0x0429" name="RBBM_PERFCTR_SP_0_HI"/>
+	<reg32 offset="0x042a" name="RBBM_PERFCTR_SP_1_LO"/>
+	<reg32 offset="0x042b" name="RBBM_PERFCTR_SP_1_HI"/>
+	<reg32 offset="0x042c" name="RBBM_PERFCTR_SP_2_LO"/>
+	<reg32 offset="0x042d" name="RBBM_PERFCTR_SP_2_HI"/>
+	<reg32 offset="0x042e" name="RBBM_PERFCTR_SP_3_LO"/>
+	<reg32 offset="0x042f" name="RBBM_PERFCTR_SP_3_HI"/>
+	<reg32 offset="0x0430" name="RBBM_PERFCTR_SP_4_LO"/>
+	<reg32 offset="0x0431" name="RBBM_PERFCTR_SP_4_HI"/>
+	<reg32 offset="0x0432" name="RBBM_PERFCTR_SP_5_LO"/>
+	<reg32 offset="0x0433" name="RBBM_PERFCTR_SP_5_HI"/>
+	<reg32 offset="0x0434" name="RBBM_PERFCTR_SP_6_LO"/>
+	<reg32 offset="0x0435" name="RBBM_PERFCTR_SP_6_HI"/>
+	<reg32 offset="0x0436" name="RBBM_PERFCTR_SP_7_LO"/>
+	<reg32 offset="0x0437" name="RBBM_PERFCTR_SP_7_HI"/>
+	<reg32 offset="0x0438" name="RBBM_PERFCTR_SP_8_LO"/>
+	<reg32 offset="0x0439" name="RBBM_PERFCTR_SP_8_HI"/>
+	<reg32 offset="0x043a" name="RBBM_PERFCTR_SP_9_LO"/>
+	<reg32 offset="0x043b" name="RBBM_PERFCTR_SP_9_HI"/>
+	<reg32 offset="0x043c" name="RBBM_PERFCTR_SP_10_LO"/>
+	<reg32 offset="0x043d" name="RBBM_PERFCTR_SP_10_HI"/>
+	<reg32 offset="0x043e" name="RBBM_PERFCTR_SP_11_LO"/>
+	<reg32 offset="0x043f" name="RBBM_PERFCTR_SP_11_HI"/>
+	<reg32 offset="0x0440" name="RBBM_PERFCTR_RB_0_LO"/>
+	<reg32 offset="0x0441" name="RBBM_PERFCTR_RB_0_HI"/>
+	<reg32 offset="0x0442" name="RBBM_PERFCTR_RB_1_LO"/>
+	<reg32 offset="0x0443" name="RBBM_PERFCTR_RB_1_HI"/>
+	<reg32 offset="0x0444" name="RBBM_PERFCTR_RB_2_LO"/>
+	<reg32 offset="0x0445" name="RBBM_PERFCTR_RB_2_HI"/>
+	<reg32 offset="0x0446" name="RBBM_PERFCTR_RB_3_LO"/>
+	<reg32 offset="0x0447" name="RBBM_PERFCTR_RB_3_HI"/>
+	<reg32 offset="0x0448" name="RBBM_PERFCTR_RB_4_LO"/>
+	<reg32 offset="0x0449" name="RBBM_PERFCTR_RB_4_HI"/>
+	<reg32 offset="0x044a" name="RBBM_PERFCTR_RB_5_LO"/>
+	<reg32 offset="0x044b" name="RBBM_PERFCTR_RB_5_HI"/>
+	<reg32 offset="0x044c" name="RBBM_PERFCTR_RB_6_LO"/>
+	<reg32 offset="0x044d" name="RBBM_PERFCTR_RB_6_HI"/>
+	<reg32 offset="0x044e" name="RBBM_PERFCTR_RB_7_LO"/>
+	<reg32 offset="0x044f" name="RBBM_PERFCTR_RB_7_HI"/>
+	<reg32 offset="0x0450" name="RBBM_PERFCTR_VSC_0_LO"/>
+	<reg32 offset="0x0451" name="RBBM_PERFCTR_VSC_0_HI"/>
+	<reg32 offset="0x0452" name="RBBM_PERFCTR_VSC_1_LO"/>
+	<reg32 offset="0x0453" name="RBBM_PERFCTR_VSC_1_HI"/>
+	<reg32 offset="0x0454" name="RBBM_PERFCTR_LRZ_0_LO"/>
+	<reg32 offset="0x0455" name="RBBM_PERFCTR_LRZ_0_HI"/>
+	<reg32 offset="0x0456" name="RBBM_PERFCTR_LRZ_1_LO"/>
+	<reg32 offset="0x0457" name="RBBM_PERFCTR_LRZ_1_HI"/>
+	<reg32 offset="0x0458" name="RBBM_PERFCTR_LRZ_2_LO"/>
+	<reg32 offset="0x0459" name="RBBM_PERFCTR_LRZ_2_HI"/>
+	<reg32 offset="0x045a" name="RBBM_PERFCTR_LRZ_3_LO"/>
+	<reg32 offset="0x045b" name="RBBM_PERFCTR_LRZ_3_HI"/>
+	<reg32 offset="0x045c" name="RBBM_PERFCTR_CMP_0_LO"/>
+	<reg32 offset="0x045d" name="RBBM_PERFCTR_CMP_0_HI"/>
+	<reg32 offset="0x045e" name="RBBM_PERFCTR_CMP_1_LO"/>
+	<reg32 offset="0x045f" name="RBBM_PERFCTR_CMP_1_HI"/>
+	<reg32 offset="0x0460" name="RBBM_PERFCTR_CMP_2_LO"/>
+	<reg32 offset="0x0461" name="RBBM_PERFCTR_CMP_2_HI"/>
+	<reg32 offset="0x0462" name="RBBM_PERFCTR_CMP_3_LO"/>
+	<reg32 offset="0x0463" name="RBBM_PERFCTR_CMP_3_HI"/>
+	<reg32 offset="0x046b" name="RBBM_PERFCTR_RBBM_SEL_0" type="a5xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x046c" name="RBBM_PERFCTR_RBBM_SEL_1" type="a5xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x046d" name="RBBM_PERFCTR_RBBM_SEL_2" type="a5xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x046e" name="RBBM_PERFCTR_RBBM_SEL_3" type="a5xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x04d2" name="RBBM_ALWAYSON_COUNTER_LO"/>
+	<reg32 offset="0x04d3" name="RBBM_ALWAYSON_COUNTER_HI"/>
+	<reg32 offset="0x04f5" name="RBBM_STATUS">
+		<bitfield high="31" low="31" name="GPU_BUSY_IGN_AHB" />
+		<bitfield high="30" low="30" name="GPU_BUSY_IGN_AHB_CP" />
+		<bitfield high="29" low="29" name="HLSQ_BUSY" />
+		<bitfield high="28" low="28" name="VSC_BUSY" />
+		<bitfield high="27" low="27" name="TPL1_BUSY" />
+		<bitfield high="26" low="26" name="SP_BUSY" />
+		<bitfield high="25" low="25" name="UCHE_BUSY" />
+		<bitfield high="24" low="24" name="VPC_BUSY" />
+		<bitfield high="23" low="23" name="VFDP_BUSY" />
+		<bitfield high="22" low="22" name="VFD_BUSY" />
+		<bitfield high="21" low="21" name="TESS_BUSY" />
+		<bitfield high="20" low="20" name="PC_VSD_BUSY" />
+		<bitfield high="19" low="19" name="PC_DCALL_BUSY" />
+		<bitfield high="18" low="18" name="GPMU_SLAVE_BUSY" />
+		<bitfield high="17" low="17" name="DCOM_BUSY" />
+		<bitfield high="16" low="16" name="COM_BUSY" />
+		<bitfield high="15" low="15" name="LRZ_BUZY" />
+		<bitfield high="14" low="14" name="A2D_DSP_BUSY" />
+		<bitfield high="13" low="13" name="CCUFCHE_BUSY" />
+		<bitfield high="12" low="12" name="RB_BUSY" />
+		<bitfield high="11" low="11" name="RAS_BUSY" />
+		<bitfield high="10" low="10" name="TSE_BUSY" />
+		<bitfield high="9" low="9" name="VBIF_BUSY" />
+		<bitfield high="8" low="8" name="GPU_BUSY_IGN_AHB_HYST" />
+		<bitfield high="7" low="7" name="CP_BUSY_IGN_HYST" />
+		<bitfield high="6" low="6" name="CP_BUSY" />
+		<bitfield high="5" low="5" name="GPMU_MASTER_BUSY" />
+		<bitfield high="4" low="4" name="CP_CRASH_BUSY" />
+		<bitfield high="3" low="3" name="CP_ETS_BUSY" />
+		<bitfield high="2" low="2" name="CP_PFP_BUSY" />
+		<bitfield high="1" low="1" name="CP_ME_BUSY" />
+		<bitfield high="0" low="0" name="HI_BUSY" />
+	</reg32>
+	<reg32 offset="0x0530" name="RBBM_STATUS3">
+		<bitfield pos="24" name="SMMU_STALLED_ON_FAULT" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x04e1" name="RBBM_INT_0_STATUS"/>
+	<reg32 offset="0x04f0" name="RBBM_AHB_ME_SPLIT_STATUS"/>
+	<reg32 offset="0x04f1" name="RBBM_AHB_PFP_SPLIT_STATUS"/>
+	<reg32 offset="0x04f3" name="RBBM_AHB_ETS_SPLIT_STATUS"/>
+	<reg32 offset="0x04f4" name="RBBM_AHB_ERROR_STATUS"/>
+	<reg32 offset="0x0464" name="RBBM_PERFCTR_CNTL"/>
+	<reg32 offset="0x0465" name="RBBM_PERFCTR_LOAD_CMD0"/>
+	<reg32 offset="0x0466" name="RBBM_PERFCTR_LOAD_CMD1"/>
+	<reg32 offset="0x0467" name="RBBM_PERFCTR_LOAD_CMD2"/>
+	<reg32 offset="0x0468" name="RBBM_PERFCTR_LOAD_CMD3"/>
+	<reg32 offset="0x0469" name="RBBM_PERFCTR_LOAD_VALUE_LO"/>
+	<reg32 offset="0x046a" name="RBBM_PERFCTR_LOAD_VALUE_HI"/>
+	<reg32 offset="0x046f" name="RBBM_PERFCTR_GPU_BUSY_MASKED"/>
+	<reg32 offset="0x04ed" name="RBBM_AHB_ERROR"/>
+	<reg32 offset="0x0504" name="RBBM_CFG_DBGBUS_EVENT_LOGIC"/>
+	<reg32 offset="0x0505" name="RBBM_CFG_DBGBUS_OVER"/>
+	<reg32 offset="0x0506" name="RBBM_CFG_DBGBUS_COUNT0"/>
+	<reg32 offset="0x0507" name="RBBM_CFG_DBGBUS_COUNT1"/>
+	<reg32 offset="0x0508" name="RBBM_CFG_DBGBUS_COUNT2"/>
+	<reg32 offset="0x0509" name="RBBM_CFG_DBGBUS_COUNT3"/>
+	<reg32 offset="0x050a" name="RBBM_CFG_DBGBUS_COUNT4"/>
+	<reg32 offset="0x050b" name="RBBM_CFG_DBGBUS_COUNT5"/>
+	<reg32 offset="0x050c" name="RBBM_CFG_DBGBUS_TRACE_ADDR"/>
+	<reg32 offset="0x050d" name="RBBM_CFG_DBGBUS_TRACE_BUF0"/>
+	<reg32 offset="0x050e" name="RBBM_CFG_DBGBUS_TRACE_BUF1"/>
+	<reg32 offset="0x050f" name="RBBM_CFG_DBGBUS_TRACE_BUF2"/>
+	<reg32 offset="0x0510" name="RBBM_CFG_DBGBUS_TRACE_BUF3"/>
+	<reg32 offset="0x0511" name="RBBM_CFG_DBGBUS_TRACE_BUF4"/>
+	<reg32 offset="0x0512" name="RBBM_CFG_DBGBUS_MISR0"/>
+	<reg32 offset="0x0513" name="RBBM_CFG_DBGBUS_MISR1"/>
+	<reg32 offset="0x0533" name="RBBM_ISDB_CNT"/>
+	<reg32 offset="0xf000" name="RBBM_SECVID_TRUST_CONFIG"/>
+	<reg32 offset="0xf400" name="RBBM_SECVID_TRUST_CNTL"/>
+	<reg32 offset="0xf800" name="RBBM_SECVID_TSB_TRUSTED_BASE_LO"/>
+	<reg32 offset="0xf801" name="RBBM_SECVID_TSB_TRUSTED_BASE_HI"/>
+	<reg32 offset="0xf802" name="RBBM_SECVID_TSB_TRUSTED_SIZE"/>
+	<reg32 offset="0xf803" name="RBBM_SECVID_TSB_CNTL"/>
+	<reg32 offset="0xf804" name="RBBM_SECVID_TSB_COMP_STATUS_LO"/>
+	<reg32 offset="0xf805" name="RBBM_SECVID_TSB_COMP_STATUS_HI"/>
+	<reg32 offset="0xf806" name="RBBM_SECVID_TSB_UCHE_STATUS_LO"/>
+	<reg32 offset="0xf807" name="RBBM_SECVID_TSB_UCHE_STATUS_HI"/>
+	<reg32 offset="0xf810" name="RBBM_SECVID_TSB_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+
+	<!-- VSC registers -->
+	<reg32 offset="0x0bc2" name="VSC_BIN_SIZE">
+		<bitfield name="WIDTH" low="0" high="7" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="9" high="16" shr="5" type="uint"/>
+		<!-- b17 maybe BYPASS like RB_CNTL, but reg not written for bypass -->
+	</reg32>
+	<reg32 offset="0x0bc3" name="VSC_SIZE_ADDRESS_LO"/>
+	<reg32 offset="0x0bc4" name="VSC_SIZE_ADDRESS_HI"/>
+	<reg32 offset="0x0bc5" name="UNKNOWN_0BC5"/> <!-- always 00000000? -->
+	<reg32 offset="0x0bc6" name="UNKNOWN_0BC6"/> <!-- always 00000000? -->
+	<array offset="0x0bd0" name="VSC_PIPE_CONFIG" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				Configures the mapping between VSC_PIPE buffer and
+				bin, X/Y specify the bin index in the horiz/vert
+				direction (0,0 is upper left, 0,1 is leftmost bin
+				on second row, and so on).  W/H specify the number
+				of bins assigned to this VSC_PIPE in the horiz/vert
+				dimension.
+			</doc>
+			<bitfield name="X" low="0" high="9" type="uint"/>
+			<bitfield name="Y" low="10" high="19" type="uint"/>
+			<bitfield name="W" low="20" high="23" type="uint"/>
+			<bitfield name="H" low="24" high="27" type="uint"/>
+		</reg32>
+	</array>
+	<array offset="0x0be0" name="VSC_PIPE_DATA_ADDRESS" stride="2" length="16">
+		<reg32 offset="0x0" name="LO"/>
+		<reg32 offset="0x1" name="HI"/>
+	</array>
+	<array offset="0x0c00" name="VSC_PIPE_DATA_LENGTH" stride="1" length="16">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x0c60" name="VSC_PERFCTR_VSC_SEL_0" type="a5xx_vsc_perfcounter_select"/>
+	<reg32 offset="0x0c61" name="VSC_PERFCTR_VSC_SEL_1" type="a5xx_vsc_perfcounter_select"/>
+
+	<!-- used for some blits?? -->
+	<reg32 offset="0x0cdd" name="VSC_RESOLVE_CNTL" type="adreno_reg_xy"/>
+
+	<!-- GRAS registers -->
+	<reg32 offset="0x0c81" name="GRAS_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0c90" name="GRAS_PERFCTR_TSE_SEL_0" type="a5xx_tse_perfcounter_select"/>
+	<reg32 offset="0x0c91" name="GRAS_PERFCTR_TSE_SEL_1" type="a5xx_tse_perfcounter_select"/>
+	<reg32 offset="0x0c92" name="GRAS_PERFCTR_TSE_SEL_2" type="a5xx_tse_perfcounter_select"/>
+	<reg32 offset="0x0c93" name="GRAS_PERFCTR_TSE_SEL_3" type="a5xx_tse_perfcounter_select"/>
+	<reg32 offset="0x0c94" name="GRAS_PERFCTR_RAS_SEL_0" type="a5xx_ras_perfcounter_select"/>
+	<reg32 offset="0x0c95" name="GRAS_PERFCTR_RAS_SEL_1" type="a5xx_ras_perfcounter_select"/>
+	<reg32 offset="0x0c96" name="GRAS_PERFCTR_RAS_SEL_2" type="a5xx_ras_perfcounter_select"/>
+	<reg32 offset="0x0c97" name="GRAS_PERFCTR_RAS_SEL_3" type="a5xx_ras_perfcounter_select"/>
+	<reg32 offset="0x0c98" name="GRAS_PERFCTR_LRZ_SEL_0" type="a5xx_lrz_perfcounter_select"/>
+	<reg32 offset="0x0c99" name="GRAS_PERFCTR_LRZ_SEL_1" type="a5xx_lrz_perfcounter_select"/>
+	<reg32 offset="0x0c9a" name="GRAS_PERFCTR_LRZ_SEL_2" type="a5xx_lrz_perfcounter_select"/>
+	<reg32 offset="0x0c9b" name="GRAS_PERFCTR_LRZ_SEL_3" type="a5xx_lrz_perfcounter_select"/>
+
+	<reg32 offset="0x0cc4" name="RB_DBG_ECO_CNTL"/> <!-- always 00100000? -->
+	<reg32 offset="0x0cc5" name="RB_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0cc6" name="RB_MODE_CNTL"/> <!-- always 00000044? -->
+	<reg32 offset="0x0cc7" name="RB_CCU_CNTL"/> <!-- always b0056080 or 10000000? -->
+	<reg32 offset="0x0cd0" name="RB_PERFCTR_RB_SEL_0" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd1" name="RB_PERFCTR_RB_SEL_1" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd2" name="RB_PERFCTR_RB_SEL_2" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd3" name="RB_PERFCTR_RB_SEL_3" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd4" name="RB_PERFCTR_RB_SEL_4" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd5" name="RB_PERFCTR_RB_SEL_5" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd6" name="RB_PERFCTR_RB_SEL_6" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd7" name="RB_PERFCTR_RB_SEL_7" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd8" name="RB_PERFCTR_CCU_SEL_0" type="a5xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cd9" name="RB_PERFCTR_CCU_SEL_1" type="a5xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cda" name="RB_PERFCTR_CCU_SEL_2" type="a5xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cdb" name="RB_PERFCTR_CCU_SEL_3" type="a5xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0ce0" name="RB_POWERCTR_RB_SEL_0"/>
+	<reg32 offset="0x0ce1" name="RB_POWERCTR_RB_SEL_1"/>
+	<reg32 offset="0x0ce2" name="RB_POWERCTR_RB_SEL_2"/>
+	<reg32 offset="0x0ce3" name="RB_POWERCTR_RB_SEL_3"/>
+	<reg32 offset="0x0ce4" name="RB_POWERCTR_CCU_SEL_0"/>
+	<reg32 offset="0x0ce5" name="RB_POWERCTR_CCU_SEL_1"/>
+	<reg32 offset="0x0cec" name="RB_PERFCTR_CMP_SEL_0" type="a5xx_cmp_perfcounter_select"/>
+	<reg32 offset="0x0ced" name="RB_PERFCTR_CMP_SEL_1" type="a5xx_cmp_perfcounter_select"/>
+	<reg32 offset="0x0cee" name="RB_PERFCTR_CMP_SEL_2" type="a5xx_cmp_perfcounter_select"/>
+	<reg32 offset="0x0cef" name="RB_PERFCTR_CMP_SEL_3" type="a5xx_cmp_perfcounter_select"/>
+
+	<reg32 offset="0x0d00" name="PC_DBG_ECO_CNTL">
+		<bitfield name="TWOPASSUSEWFI" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0d01" name="PC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0d02" name="PC_MODE_CNTL"/> <!-- always 0000001f? -->
+	<reg32 offset="0x0d04" name="PC_INDEX_BUF_LO"/>
+	<reg32 offset="0x0d05" name="PC_INDEX_BUF_HI"/>
+	<reg32 offset="0x0d06" name="PC_START_INDEX"/>
+	<reg32 offset="0x0d07" name="PC_MAX_INDEX"/>
+	<reg32 offset="0x0d08" name="PC_TESSFACTOR_ADDR_LO"/>
+	<reg32 offset="0x0d09" name="PC_TESSFACTOR_ADDR_HI"/>
+	<reg32 offset="0x0d10" name="PC_PERFCTR_PC_SEL_0" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d11" name="PC_PERFCTR_PC_SEL_1" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d12" name="PC_PERFCTR_PC_SEL_2" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d13" name="PC_PERFCTR_PC_SEL_3" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d14" name="PC_PERFCTR_PC_SEL_4" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d15" name="PC_PERFCTR_PC_SEL_5" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d16" name="PC_PERFCTR_PC_SEL_6" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d17" name="PC_PERFCTR_PC_SEL_7" type="a5xx_pc_perfcounter_select"/>
+
+	<reg32 offset="0x0e00" name="HLSQ_TIMEOUT_THRESHOLD_0"/>
+	<reg32 offset="0x0e01" name="HLSQ_TIMEOUT_THRESHOLD_1"/>
+	<reg32 offset="0x0e04" name="HLSQ_DBG_ECO_CNTL"/>
+	<reg32 offset="0x0e05" name="HLSQ_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0e06" name="HLSQ_MODE_CNTL"/> <!-- always 00000001? -->
+	<reg32 offset="0x0e10" name="HLSQ_PERFCTR_HLSQ_SEL_0" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e11" name="HLSQ_PERFCTR_HLSQ_SEL_1" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e12" name="HLSQ_PERFCTR_HLSQ_SEL_2" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e13" name="HLSQ_PERFCTR_HLSQ_SEL_3" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e14" name="HLSQ_PERFCTR_HLSQ_SEL_4" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e15" name="HLSQ_PERFCTR_HLSQ_SEL_5" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e16" name="HLSQ_PERFCTR_HLSQ_SEL_6" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e17" name="HLSQ_PERFCTR_HLSQ_SEL_7" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0f08" name="HLSQ_SPTP_RDSEL"/>
+	<reg32 offset="0xbc00" name="HLSQ_DBG_READ_SEL"/>
+	<reg32 offset="0xa000" name="HLSQ_DBG_AHB_READ_APERTURE"/>
+
+	<reg32 offset="0x0e41" name="VFD_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0e42" name="VFD_MODE_CNTL"/> <!-- always 00000000? -->
+	<reg32 offset="0x0e50" name="VFD_PERFCTR_VFD_SEL_0" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e51" name="VFD_PERFCTR_VFD_SEL_1" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e52" name="VFD_PERFCTR_VFD_SEL_2" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e53" name="VFD_PERFCTR_VFD_SEL_3" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e54" name="VFD_PERFCTR_VFD_SEL_4" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e55" name="VFD_PERFCTR_VFD_SEL_5" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e56" name="VFD_PERFCTR_VFD_SEL_6" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e57" name="VFD_PERFCTR_VFD_SEL_7" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e60" name="VPC_DBG_ECO_CNTL">
+		<bitfield name="ALLFLATOPTDIS" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0e61" name="VPC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0e62" name="VPC_MODE_CNTL">
+		<bitfield name="BINNING_PASS" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0e64" name="VPC_PERFCTR_VPC_SEL_0" type="a5xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e65" name="VPC_PERFCTR_VPC_SEL_1" type="a5xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e66" name="VPC_PERFCTR_VPC_SEL_2" type="a5xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e67" name="VPC_PERFCTR_VPC_SEL_3" type="a5xx_vpc_perfcounter_select"/>
+
+	<reg32 offset="0x0e80" name="UCHE_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0e81" name="UCHE_MODE_CNTL"/>
+	<reg32 offset="0x0e82" name="UCHE_SVM_CNTL"/>
+	<reg32 offset="0x0e87" name="UCHE_WRITE_THRU_BASE_LO"/>
+	<reg32 offset="0x0e88" name="UCHE_WRITE_THRU_BASE_HI"/>
+	<reg32 offset="0x0e89" name="UCHE_TRAP_BASE_LO"/>
+	<reg32 offset="0x0e8a" name="UCHE_TRAP_BASE_HI"/>
+	<reg32 offset="0x0e8b" name="UCHE_GMEM_RANGE_MIN_LO"/>
+	<reg32 offset="0x0e8c" name="UCHE_GMEM_RANGE_MIN_HI"/>
+	<reg32 offset="0x0e8d" name="UCHE_GMEM_RANGE_MAX_LO"/>
+	<reg32 offset="0x0e8e" name="UCHE_GMEM_RANGE_MAX_HI"/>
+	<reg32 offset="0x0e8f" name="UCHE_DBG_ECO_CNTL_2"/>
+	<reg32 offset="0x0e90" name="UCHE_DBG_ECO_CNTL"/>
+	<reg32 offset="0x0e91" name="UCHE_CACHE_INVALIDATE_MIN_LO"/>
+	<reg32 offset="0x0e92" name="UCHE_CACHE_INVALIDATE_MIN_HI"/>
+	<reg32 offset="0x0e93" name="UCHE_CACHE_INVALIDATE_MAX_LO"/>
+	<reg32 offset="0x0e94" name="UCHE_CACHE_INVALIDATE_MAX_HI"/>
+	<reg32 offset="0x0e95" name="UCHE_CACHE_INVALIDATE"/>
+	<reg32 offset="0x0e96" name="UCHE_CACHE_WAYS"/>
+	<reg32 offset="0x0ea0" name="UCHE_PERFCTR_UCHE_SEL_0" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea1" name="UCHE_PERFCTR_UCHE_SEL_1" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea2" name="UCHE_PERFCTR_UCHE_SEL_2" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea3" name="UCHE_PERFCTR_UCHE_SEL_3" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea4" name="UCHE_PERFCTR_UCHE_SEL_4" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea5" name="UCHE_PERFCTR_UCHE_SEL_5" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea6" name="UCHE_PERFCTR_UCHE_SEL_6" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea7" name="UCHE_PERFCTR_UCHE_SEL_7" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea8" name="UCHE_POWERCTR_UCHE_SEL_0"/>
+	<reg32 offset="0x0ea9" name="UCHE_POWERCTR_UCHE_SEL_1"/>
+	<reg32 offset="0x0eaa" name="UCHE_POWERCTR_UCHE_SEL_2"/>
+	<reg32 offset="0x0eab" name="UCHE_POWERCTR_UCHE_SEL_3"/>
+	<reg32 offset="0x0eb1" name="UCHE_TRAP_LOG_LO"/>
+	<reg32 offset="0x0eb2" name="UCHE_TRAP_LOG_HI"/>
+
+	<reg32 offset="0x0ec0" name="SP_DBG_ECO_CNTL"/>
+	<reg32 offset="0x0ec1" name="SP_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0ec2" name="SP_MODE_CNTL"/> <!-- always 0000001e? -->
+	<reg32 offset="0x0ed0" name="SP_PERFCTR_SP_SEL_0"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed1" name="SP_PERFCTR_SP_SEL_1"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed2" name="SP_PERFCTR_SP_SEL_2"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed3" name="SP_PERFCTR_SP_SEL_3"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed4" name="SP_PERFCTR_SP_SEL_4"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed5" name="SP_PERFCTR_SP_SEL_5"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed6" name="SP_PERFCTR_SP_SEL_6"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed7" name="SP_PERFCTR_SP_SEL_7"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed8" name="SP_PERFCTR_SP_SEL_8"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed9" name="SP_PERFCTR_SP_SEL_9"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0eda" name="SP_PERFCTR_SP_SEL_10" type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0edb" name="SP_PERFCTR_SP_SEL_11" type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0edc" name="SP_POWERCTR_SP_SEL_0"/>
+	<reg32 offset="0x0edd" name="SP_POWERCTR_SP_SEL_1"/>
+	<reg32 offset="0x0ede" name="SP_POWERCTR_SP_SEL_2"/>
+	<reg32 offset="0x0edf" name="SP_POWERCTR_SP_SEL_3"/>
+
+	<reg32 offset="0x0f01" name="TPL1_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0f02" name="TPL1_MODE_CNTL"/> <!-- always 00000544? -->
+	<reg32 offset="0x0f10" name="TPL1_PERFCTR_TP_SEL_0" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f11" name="TPL1_PERFCTR_TP_SEL_1" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f12" name="TPL1_PERFCTR_TP_SEL_2" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f13" name="TPL1_PERFCTR_TP_SEL_3" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f14" name="TPL1_PERFCTR_TP_SEL_4" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f15" name="TPL1_PERFCTR_TP_SEL_5" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f16" name="TPL1_PERFCTR_TP_SEL_6" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f17" name="TPL1_PERFCTR_TP_SEL_7" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f18" name="TPL1_POWERCTR_TP_SEL_0"/>
+	<reg32 offset="0x0f19" name="TPL1_POWERCTR_TP_SEL_1"/>
+	<reg32 offset="0x0f1a" name="TPL1_POWERCTR_TP_SEL_2"/>
+	<reg32 offset="0x0f1b" name="TPL1_POWERCTR_TP_SEL_3"/>
+
+	<reg32 offset="0x3000" name="VBIF_VERSION"/>
+	<reg32 offset="0x3001" name="VBIF_CLKON"/>
+<!--
+#define A5XX_VBIF_CLKON_FORCE_ON_TESTBUS_MASK   0x1
+#define A5XX_VBIF_CLKON_FORCE_ON_TESTBUS_SHIFT  0x1
+ -->
+	<reg32 offset="0x3028" name="VBIF_ABIT_SORT"/>
+	<reg32 offset="0x3029" name="VBIF_ABIT_SORT_CONF"/>
+	<reg32 offset="0x3049" name="VBIF_ROUND_ROBIN_QOS_ARB"/>
+	<reg32 offset="0x302a" name="VBIF_GATE_OFF_WRREQ_EN"/>
+	<reg32 offset="0x302c" name="VBIF_IN_RD_LIM_CONF0"/>
+	<reg32 offset="0x302d" name="VBIF_IN_RD_LIM_CONF1"/>
+	<reg32 offset="0x3080" name="VBIF_XIN_HALT_CTRL0"/>
+<!--
+#define A5XX_VBIF_XIN_HALT_CTRL0_MASK	   0xF
+#define A510_VBIF_XIN_HALT_CTRL0_MASK	   0x7
+ -->
+	<reg32 offset="0x3081" name="VBIF_XIN_HALT_CTRL1"/>
+	<reg32 offset="0x3084" name="VBIF_TEST_BUS_OUT_CTRL"/>
+<!--
+#define A5XX_VBIF_TEST_BUS_OUT_CTRL_EN_MASK    0x1
+#define A5XX_VBIF_TEST_BUS_OUT_CTRL_EN_SHIFT   0x0
+ -->
+	<reg32 offset="0x3085" name="VBIF_TEST_BUS1_CTRL0"/>
+	<reg32 offset="0x3086" name="VBIF_TEST_BUS1_CTRL1"/>
+<!--
+#define A5XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_MASK  0xF
+#define A5XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_SHIFT 0x0
+ -->
+	<reg32 offset="0x3087" name="VBIF_TEST_BUS2_CTRL0"/>
+	<reg32 offset="0x3088" name="VBIF_TEST_BUS2_CTRL1"/>
+<!--
+#define A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_MASK     0xF
+#define A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_SHIFT    0x0
+ -->
+	<reg32 offset="0x308c" name="VBIF_TEST_BUS_OUT"/>
+	<reg32 offset="0x30c0" name="VBIF_PERF_CNT_EN0"/>
+	<reg32 offset="0x30c1" name="VBIF_PERF_CNT_EN1"/>
+	<reg32 offset="0x30c2" name="VBIF_PERF_CNT_EN2"/>
+	<reg32 offset="0x30c3" name="VBIF_PERF_CNT_EN3"/>
+	<reg32 offset="0x30c8" name="VBIF_PERF_CNT_CLR0"/>
+	<reg32 offset="0x30c9" name="VBIF_PERF_CNT_CLR1"/>
+	<reg32 offset="0x30ca" name="VBIF_PERF_CNT_CLR2"/>
+	<reg32 offset="0x30cb" name="VBIF_PERF_CNT_CLR3"/>
+	<reg32 offset="0x30d0" name="VBIF_PERF_CNT_SEL0" type="a5xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d1" name="VBIF_PERF_CNT_SEL1" type="a5xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d2" name="VBIF_PERF_CNT_SEL2" type="a5xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d3" name="VBIF_PERF_CNT_SEL3" type="a5xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d8" name="VBIF_PERF_CNT_LOW0"/>
+	<reg32 offset="0x30d9" name="VBIF_PERF_CNT_LOW1"/>
+	<reg32 offset="0x30da" name="VBIF_PERF_CNT_LOW2"/>
+	<reg32 offset="0x30db" name="VBIF_PERF_CNT_LOW3"/>
+	<reg32 offset="0x30e0" name="VBIF_PERF_CNT_HIGH0"/>
+	<reg32 offset="0x30e1" name="VBIF_PERF_CNT_HIGH1"/>
+	<reg32 offset="0x30e2" name="VBIF_PERF_CNT_HIGH2"/>
+	<reg32 offset="0x30e3" name="VBIF_PERF_CNT_HIGH3"/>
+	<reg32 offset="0x3100" name="VBIF_PERF_PWR_CNT_EN0"/>
+	<reg32 offset="0x3101" name="VBIF_PERF_PWR_CNT_EN1"/>
+	<reg32 offset="0x3102" name="VBIF_PERF_PWR_CNT_EN2"/>
+	<reg32 offset="0x3110" name="VBIF_PERF_PWR_CNT_LOW0"/>
+	<reg32 offset="0x3111" name="VBIF_PERF_PWR_CNT_LOW1"/>
+	<reg32 offset="0x3112" name="VBIF_PERF_PWR_CNT_LOW2"/>
+	<reg32 offset="0x3118" name="VBIF_PERF_PWR_CNT_HIGH0"/>
+	<reg32 offset="0x3119" name="VBIF_PERF_PWR_CNT_HIGH1"/>
+	<reg32 offset="0x311a" name="VBIF_PERF_PWR_CNT_HIGH2"/>
+
+	<reg32 offset="0x8800" name="GPMU_INST_RAM_BASE"/>
+	<reg32 offset="0x9800" name="GPMU_DATA_RAM_BASE"/>
+
+<!--
+/* COUNTABLE FOR SP PERFCOUNTER */
+#define A5XX_SP_ALU_ACTIVE_CYCLES          0x1
+#define A5XX_SP0_ICL1_MISSES               0x35
+#define A5XX_SP_FS_CFLOW_INSTRUCTIONS      0x27
+
+/* COUNTABLE FOR TSE PERFCOUNTER */
+#define A5XX_TSE_INPUT_PRIM_NUM            0x6
+ -->
+	<reg32 offset="0xa840" name="SP_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa841" name="SP_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa842" name="SP_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa843" name="SP_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa844" name="SP_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa845" name="SP_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa846" name="SP_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa847" name="SP_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa848" name="TP_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa849" name="TP_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa84a" name="TP_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa84b" name="TP_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa84c" name="TP_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa84d" name="TP_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa84e" name="TP_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa84f" name="TP_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa850" name="RB_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa851" name="RB_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa852" name="RB_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa853" name="RB_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa854" name="RB_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa855" name="RB_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa856" name="RB_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa857" name="RB_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa858" name="CCU_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa859" name="CCU_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa85a" name="CCU_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa85b" name="CCU_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa85c" name="UCHE_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa85d" name="UCHE_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa85e" name="UCHE_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa85f" name="UCHE_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa860" name="UCHE_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa861" name="UCHE_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa862" name="UCHE_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa863" name="UCHE_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa864" name="CP_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa865" name="CP_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa866" name="CP_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa867" name="CP_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa868" name="CP_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa869" name="CP_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa86a" name="CP_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa86b" name="CP_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa86c" name="GPMU_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa86d" name="GPMU_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa86e" name="GPMU_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa86f" name="GPMU_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa870" name="GPMU_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa871" name="GPMU_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa872" name="GPMU_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa873" name="GPMU_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa874" name="GPMU_POWER_COUNTER_4_LO"/>
+	<reg32 offset="0xa875" name="GPMU_POWER_COUNTER_4_HI"/>
+	<reg32 offset="0xa876" name="GPMU_POWER_COUNTER_5_LO"/>
+	<reg32 offset="0xa877" name="GPMU_POWER_COUNTER_5_HI"/>
+	<reg32 offset="0xa878" name="GPMU_POWER_COUNTER_ENABLE"/>
+	<reg32 offset="0xa879" name="GPMU_ALWAYS_ON_COUNTER_LO"/>
+	<reg32 offset="0xa87a" name="GPMU_ALWAYS_ON_COUNTER_HI"/>
+	<reg32 offset="0xa87b" name="GPMU_ALWAYS_ON_COUNTER_RESET"/>
+	<reg32 offset="0xa87c" name="GPMU_POWER_COUNTER_SELECT_0"/>
+	<reg32 offset="0xa87d" name="GPMU_POWER_COUNTER_SELECT_1"/>
+
+	<reg32 offset="0xa880" name="GPMU_GPMU_SP_CLOCK_CONTROL"/>
+	<reg32 offset="0xa881" name="GPMU_SP_POWER_CNTL"/>
+	<reg32 offset="0xa886" name="GPMU_RBCCU_CLOCK_CNTL"/>
+	<reg32 offset="0xa887" name="GPMU_RBCCU_POWER_CNTL"/>
+	<reg32 offset="0xa88b" name="GPMU_SP_PWR_CLK_STATUS">
+		<bitfield name="PWR_ON" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa88d" name="GPMU_RBCCU_PWR_CLK_STATUS">
+		<bitfield name="PWR_ON" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa891" name="GPMU_PWR_COL_STAGGER_DELAY"/>
+	<reg32 offset="0xa892" name="GPMU_PWR_COL_INTER_FRAME_CTRL"/>
+	<reg32 offset="0xa893" name="GPMU_PWR_COL_INTER_FRAME_HYST"/>
+	<reg32 offset="0xa894" name="GPMU_PWR_COL_BINNING_CTRL"/>
+	<reg32 offset="0xa8a3" name="GPMU_CLOCK_THROTTLE_CTRL"/>
+	<reg32 offset="0xa8a8" name="GPMU_THROTTLE_UNMASK_FORCE_CTRL"/>
+	<reg32 offset="0xa8c1" name="GPMU_WFI_CONFIG"/>
+	<reg32 offset="0xa8d6" name="GPMU_RBBM_INTR_INFO"/>
+	<reg32 offset="0xa8d8" name="GPMU_CM3_SYSRESET"/>
+	<reg32 offset="0xa8e0" name="GPMU_GENERAL_0"/>
+	<reg32 offset="0xa8e1" name="GPMU_GENERAL_1"/>
+	<reg32 offset="0xac00" name="GPMU_TEMP_SENSOR_ID"/>
+	<reg32 offset="0xac01" name="GPMU_TEMP_SENSOR_CONFIG"/>
+	<reg32 offset="0xac02" name="GPMU_TEMP_VAL"/>
+	<reg32 offset="0xac03" name="GPMU_DELTA_TEMP_THRESHOLD"/>
+	<reg32 offset="0xac05" name="GPMU_TEMP_THRESHOLD_INTR_STATUS"/>
+	<reg32 offset="0xac06" name="GPMU_TEMP_THRESHOLD_INTR_EN_MASK"/>
+	<reg32 offset="0xac40" name="GPMU_LEAKAGE_TEMP_COEFF_0_1"/>
+	<reg32 offset="0xac41" name="GPMU_LEAKAGE_TEMP_COEFF_2_3"/>
+	<reg32 offset="0xac42" name="GPMU_LEAKAGE_VTG_COEFF_0_1"/>
+	<reg32 offset="0xac43" name="GPMU_LEAKAGE_VTG_COEFF_2_3"/>
+	<reg32 offset="0xac46" name="GPMU_BASE_LEAKAGE"/>
+	<reg32 offset="0xac60" name="GPMU_GPMU_VOLTAGE"/>
+	<reg32 offset="0xac61" name="GPMU_GPMU_VOLTAGE_INTR_STATUS"/>
+	<reg32 offset="0xac62" name="GPMU_GPMU_VOLTAGE_INTR_EN_MASK"/>
+	<reg32 offset="0xac80" name="GPMU_GPMU_PWR_THRESHOLD"/>
+	<reg32 offset="0xacc4" name="GPMU_GPMU_LLM_GLM_SLEEP_CTRL"/>
+	<reg32 offset="0xacc5" name="GPMU_GPMU_LLM_GLM_SLEEP_STATUS"/>
+	<reg32 offset="0xb80c" name="GDPM_CONFIG1"/>
+	<reg32 offset="0xb80d" name="GDPM_CONFIG2"/>
+	<reg32 offset="0xb80f" name="GDPM_INT_EN"/>
+	<reg32 offset="0xb811" name="GDPM_INT_MASK"/>
+	<reg32 offset="0xb9a0" name="GPMU_BEC_ENABLE"/>
+	<reg32 offset="0xc41a" name="GPU_CS_SENSOR_GENERAL_STATUS"/>
+	<reg32 offset="0xc41d" name="GPU_CS_AMP_CALIBRATION_STATUS1_0"/>
+	<reg32 offset="0xc41f" name="GPU_CS_AMP_CALIBRATION_STATUS1_2"/>
+	<reg32 offset="0xc421" name="GPU_CS_AMP_CALIBRATION_STATUS1_4"/>
+	<reg32 offset="0xc520" name="GPU_CS_ENABLE_REG"/>
+	<reg32 offset="0xc557" name="GPU_CS_AMP_CALIBRATION_CONTROL1"/>
+
+
+	<reg32 offset="0xe000" name="GRAS_CL_CNTL">
+		<bitfield name="ZERO_GB_SCALE_Z" pos="6" type="boolean"/>
+	</reg32>
+	<bitset name="a5xx_gras_xs_cl_cntl" inline="yes">
+		<bitfield name="CLIP_MASK" low="0" high="7"/>
+		<bitfield name="CULL_MASK" low="8" high="15"/>
+	</bitset>
+	<reg32 offset="0xe001" name="GRAS_VS_CL_CNTL" type="a5xx_gras_xs_cl_cntl"/>
+	<reg32 offset="0xe004" name="UNKNOWN_E004"/> <!-- always 00000000? -->
+	<reg32 offset="0xe005" name="GRAS_CNTL">
+		<!-- see also RB_RENDER_CONTROL0 -->
+		<bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+		<bitfield name="IJ_LINEAR_PIXEL" pos="3" type="boolean"/>
+		<bitfield name="IJ_LINEAR_CENTROID" pos="4" type="boolean"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" pos="5" type="boolean"/>
+		<bitfield name="COORD_MASK" low="6" high="9" type="hex"/>
+	</reg32>
+	<reg32 offset="0xe006" name="GRAS_CL_GUARDBAND_CLIP_ADJ">
+		<bitfield name="HORZ" low="0" high="9" type="uint"/>
+		<bitfield name="VERT" low="10" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe010" name="GRAS_CL_VPORT_XOFFSET_0" type="float"/>
+	<reg32 offset="0xe011" name="GRAS_CL_VPORT_XSCALE_0" type="float"/>
+	<reg32 offset="0xe012" name="GRAS_CL_VPORT_YOFFSET_0" type="float"/>
+	<reg32 offset="0xe013" name="GRAS_CL_VPORT_YSCALE_0" type="float"/>
+	<reg32 offset="0xe014" name="GRAS_CL_VPORT_ZOFFSET_0" type="float"/>
+	<reg32 offset="0xe015" name="GRAS_CL_VPORT_ZSCALE_0" type="float"/>
+	<reg32 offset="0xe090" name="GRAS_SU_CNTL">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FRONT_CW" pos="2" type="boolean"/>
+		<bitfield name="LINEHALFWIDTH" low="3" high="10" radix="2" type="fixed"/>
+		<bitfield name="POLY_OFFSET" pos="11" type="boolean"/>
+		<bitfield name="LINE_MODE" pos="13" type="a5xx_line_mode"/>
+		<!-- probably LINEHALFWIDTH is the same as a4xx.. -->
+	</reg32>
+	<reg32 offset="0xe091" name="GRAS_SU_POINT_MINMAX">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0xe092" name="GRAS_SU_POINT_SIZE" type="fixed" radix="4"/>
+	<reg32 offset="0xe093" name="GRAS_SU_LAYERED"/>
+	<reg32 offset="0xe094" name="GRAS_SU_DEPTH_PLANE_CNTL">
+		<bitfield name="FRAG_WRITES_Z" pos="0" type="boolean"/>
+		<bitfield name="UNK1" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe095" name="GRAS_SU_POLY_OFFSET_SCALE" type="float"/>
+	<reg32 offset="0xe096" name="GRAS_SU_POLY_OFFSET_OFFSET" type="float"/>
+	<reg32 offset="0xe097" name="GRAS_SU_POLY_OFFSET_OFFSET_CLAMP" type="float"/>
+	<!-- duplicates RB_DEPTH_INFO0: -->
+	<reg32 offset="0xe098" name="GRAS_SU_DEPTH_BUFFER_INFO">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a5xx_depth_format"/>
+	</reg32>
+	<reg32 offset="0xe099" name="GRAS_SU_CONSERVATIVE_RAS_CNTL"/> <!-- always 00000000? -->
+	<!--
+	guessing about window/screen/extent, I think they can in the end be
+	used interchangeably?
+	 -->
+	<reg32 offset="0xe0a0" name="GRAS_SC_CNTL">
+		<bitfield name="BINNING_PASS" pos="0" type="boolean"/>
+		<bitfield name="SAMPLES_PASSED" pos="15" type="boolean"/>
+	</reg32>
+	<!-- note, 0x4 for binning pass when frag writes z?? -->
+	<reg32 offset="0xe0a1" name="GRAS_SC_BIN_CNTL"/> <!-- always 00000000? -->
+	<reg32 offset="0xe0a2" name="GRAS_SC_RAS_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+	</reg32>
+	<reg32 offset="0xe0a3" name="GRAS_SC_DEST_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe0a4" name="GRAS_SC_SCREEN_SCISSOR_CNTL"/> <!-- always 00000000? -->
+	<reg32 offset="0xe0aa" name="GRAS_SC_SCREEN_SCISSOR_TL_0" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0ab" name="GRAS_SC_SCREEN_SCISSOR_BR_0" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0ca" name="GRAS_SC_VIEWPORT_SCISSOR_TL_0" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0cb" name="GRAS_SC_VIEWPORT_SCISSOR_BR_0" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0ea" name="GRAS_SC_WINDOW_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0eb" name="GRAS_SC_WINDOW_SCISSOR_BR" type="adreno_reg_xy"/>
+
+	<doc>
+		LRZ:  (Low Resolution Z ??)
+		----
+
+		I think it serves two functions, early discard of primitives in binning
+		pass without needing full resolution depth buffer, and also functions as
+		a depth-prepass, used during the GMEM draws to discard primitives that
+		would not be visible due to later draws.
+
+		The LRZ buffer always seems to be z16 format, regardless of actual
+		depth buffer format.
+
+		Note that LRZ write should be disabled when blend/stencil/etc is enabled,
+		since the occluded primitive can still contribute to final color value
+		of a fragment.
+
+		Only enabled for GL_LESS/GL_LEQUAL/GL_GREATER/GL_GEQUAL?
+	</doc>
+	<reg32 offset="0xe100" name="GRAS_LRZ_CNTL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<doc>LRZ write also disabled for blend/etc.</doc>
+		<bitfield name="LRZ_WRITE" pos="1" type="boolean"/>
+		<doc>update MAX instead of MIN value, ie. GL_GREATER/GL_GEQUAL</doc>
+		<bitfield name="GREATER" pos="2" type="boolean"/>
+		<!--
+		b3 set sometimes, when depth buffer isn't cleared.. maybe it
+		invalidates the LRZ buffer?  (Or just the covered positions?
+		 -->
+	</reg32>
+	<reg32 offset="0xe101" name="GRAS_LRZ_BUFFER_BASE_LO"/>
+	<reg32 offset="0xe102" name="GRAS_LRZ_BUFFER_BASE_HI"/>
+	<!--
+	lzr pitch is depth pitch (in pixels) / 8 (aligned to 32)..
+	 -->
+	<doc>
+		Pitch is depth width (in pixels) / 8 (aligned to 32).  Height
+		is also divided by 8 (ie. covers 8x8 pixels)
+	</doc>
+	<reg32 offset="0xe103" name="GRAS_LRZ_BUFFER_PITCH" shr="5" type="uint"/>
+	<reg32 offset="0xe104" name="GRAS_LRZ_FAST_CLEAR_BUFFER_BASE_LO"/>
+	<reg32 offset="0xe105" name="GRAS_LRZ_FAST_CLEAR_BUFFER_BASE_HI"/>
+
+	<reg32 offset="0xe140" name="RB_CNTL">
+		<bitfield name="WIDTH" low="0" high="7" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="9" high="16" shr="5" type="uint"/>
+		<bitfield name="BYPASS" pos="17" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe141" name="RB_RENDER_CNTL">
+<!--
+bit 3 set for normal draws
+bit 7 for RECTLIST (clear) when z32s8 (used for clear of depth32?  not set
+	for z32 with no stencil, but maybe in that case separate z/s not used?
+	see mrt-fbo-* zs=2)
+ -->
+		<bitfield name="BINNING_PASS" pos="0" type="boolean"/>
+		<bitfield name="SAMPLES_PASSED" pos="6" type="boolean"/>
+		<bitfield name="DISABLE_COLOR_PIPE" pos="7" type="boolean"/>
+		<!-- why everything twice?? maybe read vs write? -->
+		<!-- UBWC flag buffer enabled for depth/stencil: -->
+		<bitfield name="FLAG_DEPTH" pos="14" type="boolean"/>
+		<bitfield name="FLAG_DEPTH2" pos="15" type="boolean"/>
+		<!-- bitmask of MRTs using UBWC flag buffer: -->
+		<bitfield name="FLAG_MRTS" low="16" high="23"/>
+		<bitfield name="FLAG_MRTS2" low="24" high="31"/>
+	</reg32>
+	<reg32 offset="0xe142" name="RB_RAS_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+	</reg32>
+	<reg32 offset="0xe143" name="RB_DEST_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+	<!--
+	note: maybe not actually called RB_RENDER_CONTROLn (since RB_RENDER_CNTL
+	name comes from kernel and is probably right)
+	 -->
+	<reg32 offset="0xe144" name="RB_RENDER_CONTROL0">
+		<!-- see also GRAS_CNTL -->
+		<bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+		<bitfield name="IJ_LINEAR_PIXEL" pos="3" type="boolean"/>
+		<bitfield name="IJ_LINEAR_CENTROID" pos="4" type="boolean"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" pos="5" type="boolean"/>
+		<bitfield name="COORD_MASK" low="6" high="9" type="hex"/>
+	</reg32>
+	<reg32 offset="0xe145" name="RB_RENDER_CONTROL1">
+		<bitfield name="SAMPLEMASK" pos="0" type="boolean"/>
+		<bitfield name="FACENESS" pos="1" type="boolean"/>
+		<bitfield name="SAMPLEID" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe146" name="RB_FS_OUTPUT_CNTL">
+		<!-- bit0 set except for binning pass.. -->
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+		<bitfield name="FRAG_WRITES_Z" pos="5" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe147" name="RB_RENDER_COMPONENTS">
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+	<array offset="0xe150" name="RB_MRT" stride="7" length="8">
+		<reg32 offset="0x0" name="CONTROL">
+			<bitfield name="BLEND" pos="0" type="boolean"/>
+			<bitfield name="BLEND2" pos="1" type="boolean"/>
+			<bitfield name="ROP_ENABLE" pos="2" type="boolean"/>
+			<bitfield name="ROP_CODE" low="3" high="6" type="a3xx_rop_code"/>
+			<bitfield name="COMPONENT_ENABLE" low="7" high="10" type="hex"/>
+		</reg32>
+		<reg32 offset="0x1" name="BLEND_CONTROL">
+			<bitfield name="RGB_SRC_FACTOR" low="0" high="4" type="adreno_rb_blend_factor"/>
+			<bitfield name="RGB_BLEND_OPCODE" low="5" high="7" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="RGB_DEST_FACTOR" low="8" high="12" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_SRC_FACTOR" low="16" high="20" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_BLEND_OPCODE" low="21" high="23" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="ALPHA_DEST_FACTOR" low="24" high="28" type="adreno_rb_blend_factor"/>
+		</reg32>
+		<reg32 offset="0x2" name="BUF_INFO">
+			<!--
+			not sure if there is a separate COLOR_SWAP field like on a3xx/a4xx,
+			or if it is inherent in the format.  Will have to play with bits
+			once we get things working and see what happens.  If it is a diff
+			field, it doesn't seem to have the same encoding as a3xx/a4xx.
+			 -->
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a5xx_color_fmt"/>
+			<bitfield name="COLOR_TILE_MODE" low="8" high="9" type="a5xx_tile_mode"/>
+			<bitfield name="DITHER_MODE" low="11" high="12" type="adreno_rb_dither_mode"/>
+			<bitfield name="COLOR_SWAP" low="13" high="14" type="a3xx_color_swap"/>
+			<bitfield name="COLOR_SRGB" pos="15" type="boolean"/>
+		</reg32>
+		<!--
+		at least in gmem, things seem to be aligned to pitch of 64..
+		maybe an artifact of tiled format used in gmem?
+		 -->
+		<reg32 offset="0x3" name="PITCH" shr="6" type="uint"/>
+		<reg32 offset="0x4" name="ARRAY_PITCH" shr="6" type="uint"/>
+		<reg32 offset="0x5" name="BASE_LO"/>
+		<reg32 offset="0x6" name="BASE_HI"/>
+	</array>
+	<reg32 offset="0xe1a0" name="RB_BLEND_RED">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0xe1a1" name="RB_BLEND_RED_F32" type="float"/>
+	<reg32 offset="0xe1a2" name="RB_BLEND_GREEN">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0xe1a3" name="RB_BLEND_GREEN_F32" type="float"/>
+	<reg32 offset="0xe1a4" name="RB_BLEND_BLUE">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0xe1a5" name="RB_BLEND_BLUE_F32" type="float"/>
+	<reg32 offset="0xe1a6" name="RB_BLEND_ALPHA">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0xe1a7" name="RB_BLEND_ALPHA_F32" type="float"/>
+	<reg32 offset="0xe1a8" name="RB_ALPHA_CONTROL">
+		<bitfield name="ALPHA_REF" low="0" high="7" type="hex"/>
+		<bitfield name="ALPHA_TEST" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TEST_FUNC" low="9" high="11" type="adreno_compare_func"/>
+	</reg32>
+	<reg32 offset="0xe1a9" name="RB_BLEND_CNTL">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="INDEPENDENT_BLEND" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="10" type="boolean"/>
+		<!-- a guess? -->
+		<bitfield name="SAMPLE_MASK" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0xe1b0" name="RB_DEPTH_PLANE_CNTL">
+		<bitfield name="FRAG_WRITES_Z" pos="0" type="boolean"/>
+		<bitfield name="UNK1" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe1b1" name="RB_DEPTH_CNTL">
+		<bitfield name="Z_TEST_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="ZFUNC" low="2" high="4" type="adreno_compare_func"/>
+		<doc>Z_READ_ENABLE bit is set for zfunc other than GL_ALWAYS or GL_NEVER</doc>
+		<bitfield name="Z_READ_ENABLE" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe1b2" name="RB_DEPTH_BUFFER_INFO">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a5xx_depth_format"/>
+	</reg32>
+	<reg32 offset="0xe1b3" name="RB_DEPTH_BUFFER_BASE_LO"/>
+	<reg32 offset="0xe1b4" name="RB_DEPTH_BUFFER_BASE_HI"/>
+	<reg32 offset="0xe1b5" name="RB_DEPTH_BUFFER_PITCH" shr="6" type="uint">
+		<doc>stride of depth/stencil buffer</doc>
+	</reg32>
+	<reg32 offset="0xe1b6" name="RB_DEPTH_BUFFER_ARRAY_PITCH" shr="6" type="uint">
+		<doc>size of layer</doc>
+	</reg32>
+	<reg32 offset="0xe1c0" name="RB_STENCIL_CONTROL">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="STENCIL_ENABLE_BF" pos="1" type="boolean"/>
+		<!--
+			set for stencil operations that require read from stencil
+			buffer, but not for example for stencil clear (which does
+			not require read).. so guessing this is analogous to
+			READ_DEST_ENABLE for color buffer..
+		 -->
+		<bitfield name="STENCIL_READ" pos="2" type="boolean"/>
+		<bitfield name="FUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="FAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="FUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="FAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0xe1c1" name="RB_STENCIL_INFO">
+		<bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe1c2" name="RB_STENCIL_BASE_LO"/>
+	<reg32 offset="0xe1c3" name="RB_STENCIL_BASE_HI"/>
+	<reg32 offset="0xe1c4" name="RB_STENCIL_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0xe1c5" name="RB_STENCIL_ARRAY_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0xe1c6" name="RB_STENCILREFMASK" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0xe1c7" name="RB_STENCILREFMASK_BF" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0xe1d0" name="RB_WINDOW_OFFSET" type="adreno_reg_xy"/>
+	<reg32 offset="0xe1d1" name="RB_SAMPLE_COUNT_CONTROL">
+		<bitfield name="COPY" pos="1" type="boolean"/>
+	</reg32>
+
+	<doc>
+		Blits:
+		------
+
+		Blits are triggered by CP_EVENT_WRITE:BLIT, compared to previous
+		generations where they shared most of the gl pipeline and were
+		triggered by CP_DRAW_INDX*
+
+		For gmem->mem blob uses RB_BLIT_CNTL.BUF to specify src of
+		blit (ie MRTn, ZS, etc) and RB_BLIT_DST_LO/HI for destination
+		gpuaddr.  The gmem offset is taken from RB_MRT[n].BASE_LO/HI
+
+		For mem->gmem blob uses just MRT0 or ZS and RB_BLIT_DST_LO/HI
+		for the GMEM offset, and gpuaddr from RB_MRT[0].BASE_LO/HI
+		(I suppose this is just to avoid trashing RB_MRT[1..7]??)
+	</doc>
+	<reg32 offset="0xe210" name="RB_BLIT_CNTL">
+		<bitfield name="BUF" low="0" high="3" type="a5xx_blit_buf"/>
+	</reg32>
+	<reg32 offset="0xe211" name="RB_RESOLVE_CNTL_1" type="adreno_reg_xy"/>
+	<reg32 offset="0xe212" name="RB_RESOLVE_CNTL_2" type="adreno_reg_xy"/>
+	<reg32 offset="0xe213" name="RB_RESOLVE_CNTL_3">
+		<!-- if b0 set, output is in TILE5_3 format -->
+		<bitfield name="TILED" pos="0" type="boolean"/>
+	<!--
+		0xe213:
+		        0x0 mem->gmem
+		        0xf gmem->mem with flag buffer (color)
+		        0x4 gmem->mem without flag buffer (color)
+		        0x7 BYPASS mode flag buffer result (ie. on readpix)
+		            also for gmem->mem preserving tiling
+	-->
+	</reg32>
+	<reg32 offset="0xe214" name="RB_BLIT_DST_LO"/>
+	<reg32 offset="0xe215" name="RB_BLIT_DST_HI"/>
+	<reg32 offset="0xe216" name="RB_BLIT_DST_PITCH" shr="6" type="uint"/>
+	<!-- array-pitch is size of layer -->
+	<reg32 offset="0xe217" name="RB_BLIT_DST_ARRAY_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0xe218" name="RB_CLEAR_COLOR_DW0"/>
+	<reg32 offset="0xe219" name="RB_CLEAR_COLOR_DW1"/>
+	<reg32 offset="0xe21a" name="RB_CLEAR_COLOR_DW2"/>
+	<reg32 offset="0xe21b" name="RB_CLEAR_COLOR_DW3"/>
+	<reg32 offset="0xe21c" name="RB_CLEAR_CNTL">
+		<bitfield name="FAST_CLEAR" pos="1" type="boolean"/>
+		<bitfield name="MSAA_RESOLVE" pos="2" type="boolean"/>
+		<doc>
+			For MASK, if RB_BLIT_CNTL.BUF=BLIT_ZS:
+				1 - depth
+				2 - stencil
+				3 - depth+stencil
+			if RB_BLIT_CNTL.BUF=BLIT_MRTn
+				then probably a component mask, I always see 0xf
+		</doc>
+		<bitfield name="MASK" low="4" high="7"/>
+	</reg32>
+
+	<doc>
+		Buffer Metadata (flag buffers):
+		-------------------------------
+
+		Blob seems to stick some metadata at the front of the buffer,
+		both z/s and MRT.  I think this is same as UBWC (bandwidth
+		compression) metadata that mdp 1.7 and later supports.  See
+		1d3fae5698ce5358caab87a15383b690941697e8 in downstream kernel.
+		UBWC seems to stand for "universal bandwidth compression".
+
+		Before glReadPixels() it does a pair of BYPASS blits (at least
+		if metadata is used) presumably to resolve metadata.
+
+		NOTES: see: getUBwcBlockSize(), getUBwcMetaBufferSize() at
+		https://android.googlesource.com/platform/hardware/qcom/display/+/android-6.0.1_r40/msm8994/libgralloc/alloc_controller.cpp
+		(note that bpp in bytes, not bits, so really cpp)
+
+		Example Layout 2d w/ mipmap levels:
+
+			100x2000, ifmt=GL_RG, fmt=GL_RG16F, type=GL_FLOAT, meta=64x512@0x8000 (7x500)
+				base=c072e000, offset=16384, size=1703936
+
+				color		flags
+			0	c073a000	c0732000	- level 0 flags is address
+			1	c0838000	c0834000	  programmed in texture state
+			2	c0879000	c0877000
+			3	c089a000	c0899000
+			4	c08ab000	c08aa000
+			5	c08b4000	c08b3000
+			6	c08b9000	c08b8000
+			7	c08bc000	c08bb000
+			8	c08be000	c08bd000
+			9	c08c0000	c08bf000
+			10	c08c2000	c08c1000
+
+		ARRAY_PITCH is the combined size of all the levels plus flags,
+		so 0xc08c3000 - 0xc0732000 = 0x00191000 (1642496); each level
+		takes up a minimum of 2 pages (since color and flags parts are
+		each page aligned.
+
+			{ TILE_MODE = TILE5_3 | SWIZ_X = A5XX_TEX_X | SWIZ_Y = A5XX_TEX_Y | SWIZ_Z = A5XX_TEX_ZERO | SWIZ_W = A5XX_TEX_ONE | MIPLVLS = 0 | FMT = TFMT5_16_16_FLOAT | SWAP = WZYX }
+			{ WIDTH = 100 | HEIGHT = 2000 }
+			{ FETCHSIZE = TFETCH5_4_BYTE | PITCH = 512 | TYPE = A5XX_TEX_2D }
+			{ ARRAY_PITCH = 1642496 | 0x18800000 }  - NOTE c2dc always has 0x18800000 but
+			{ BASE_LO = 0xc0732000 }                  this varies for blob gles driver..
+			{ BASE_HI = 0 | DEPTH = 1 }               not sure what it is
+
+
+	</doc>
+	<reg32 offset="0xe240" name="RB_DEPTH_FLAG_BUFFER_BASE_LO"/>
+	<reg32 offset="0xe241" name="RB_DEPTH_FLAG_BUFFER_BASE_HI"/>
+	<reg32 offset="0xe242" name="RB_DEPTH_FLAG_BUFFER_PITCH">
+	</reg32>
+	<array offset="0xe243" name="RB_MRT_FLAG_BUFFER" stride="4" length="8">
+		<reg32 offset="0" name="ADDR_LO"/>
+		<reg32 offset="1" name="ADDR_HI"/>
+		<reg32 offset="2" name="PITCH" shr="6" type="uint"/>
+		<!-- array-pitch is size of layer -->
+		<reg32 offset="3" name="ARRAY_PITCH" shr="6" type="uint"/>
+	</array>
+	<reg32 offset="0xe263" name="RB_BLIT_FLAG_DST_LO"/>
+	<reg32 offset="0xe264" name="RB_BLIT_FLAG_DST_HI"/>
+	<reg32 offset="0xe265" name="RB_BLIT_FLAG_DST_PITCH" shr="6" type="uint"/>
+	<!-- array-pitch is size of layer -->
+	<reg32 offset="0xe266" name="RB_BLIT_FLAG_DST_ARRAY_PITCH" shr="6" type="uint"/>
+
+	<reg32 offset="0xe267" name="RB_SAMPLE_COUNT_ADDR_LO"/>
+	<reg32 offset="0xe268" name="RB_SAMPLE_COUNT_ADDR_HI"/>
+
+	<reg32 offset="0xe280" name="VPC_CNTL_0">
+		<doc>
+			num of varyings plus four for gl_Position (plus one if gl_PointSize)
+			plus # of transform-feedback (streamout) varyings if using the
+			hw streamout (rather than stg instructions in shader)
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="6" type="uint"/>
+		<bitfield name="VARYING" pos="11" type="boolean"/>
+	</reg32>
+	<array offset="0xe282" name="VPC_VARYING_INTERP" stride="1" length="8">
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+	<array offset="0xe28a" name="VPC_VARYING_PS_REPL" stride="1" length="8">
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+	<reg32 offset="0xe292" name="UNKNOWN_E292"/>
+	<reg32 offset="0xe293" name="UNKNOWN_E293"/>
+	<array offset="0xe294" name="VPC_VAR" stride="1" length="4">
+		<!-- one bit per varying component: -->
+		<reg32 offset="0" name="DISABLE"/>
+	</array>
+	<reg32 offset="0xe298" name="VPC_GS_SIV_CNTL"/>
+	<reg32 offset="0xe29a" name="VPC_CLIP_CNTL">
+		<bitfield name="CLIP_MASK" low="0" high="7" type="uint"/>
+		<!-- there can be up to 8 total clip/cull distance outputs,
+		     but apparenly VPC can only deal with vec4, so when there are
+		     more than 4 outputs a second location needs to be programmed
+		-->
+		<bitfield name="CLIP_DIST_03_LOC" low="8" high="15" type="uint"/>
+		<bitfield name="CLIP_DIST_47_LOC" low="16" high="23" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0xe29d" name="VPC_PACK">
+		<bitfield name="NUMNONPOSVAR" low="0" high="7" type="uint"/>
+		<!--
+		This seems to be the OUTLOC for the psize output.  It could possibly
+		be the max-OUTLOC position, but it is only set when VS writes psize
+		(and blob always puts psize at highest OUTLOC)
+		 -->
+		<bitfield name="PSIZELOC" low="8" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe2a0" name="VPC_FS_PRIMITIVEID_CNTL"/>
+
+	<doc>
+		Stream-Out:
+		-----------
+
+		VPC_SO[0..3] registers setup details about streamout buffers, and
+		number of components to write to each.
+
+		VPC_SO_PROG provides the mapping between output varyings and the SO
+		buffers.  It is written multiple times (via a CP_CONTEXT_REG_BUNCH
+		packet, not sure if that matters), each write can handle up to two
+		components of stream-out output.  Order matches up to OUTLOC,
+		including padding.  So, if outputting first 3 varyings:
+
+			SP_VS_OUT[0].REG: { A_REGID = r0.w | A_COMPMASK = 0xf | B_REGID = r0.x | B_COMPMASK = 0x7 }
+			SP_VS_OUT[0x1].REG: { A_REGID = r1.w | A_COMPMASK = 0x3 | B_REGID = r2.y | B_COMPMASK = 0xf }
+			SP_VS_VPC_DST[0].REG: { OUTLOC0 = 0 | OUTLOC1 = 4 | OUTLOC2 = 8 | OUTLOC3 = 12 }
+
+		Then:
+
+			VPC_SO_PROG: { A_BUF = 0 | A_OFF = 0 | A_EN | A_BUF = 0 | B_OFF = 4 | B_EN }
+			VPC_SO_PROG: { A_BUF = 0 | A_OFF = 8 | A_EN | A_BUF = 0 | B_OFF = 12 | B_EN }
+			VPC_SO_PROG: { A_BUF = 2 | A_OFF = 0 | A_EN | A_BUF = 2 | B_OFF = 4 | B_EN }
+			VPC_SO_PROG: { A_BUF = 2 | A_OFF = 8 | A_EN | A_BUF = 0 | B_OFF = 0 }
+			VPC_SO_PROG: { A_BUF = 1 | A_OFF = 0 | A_EN | A_BUF = 1 | B_OFF = 4 | B_EN }
+
+		Note that varying order is OUTLOC0, OUTLOC2, OUTLOC1, and note
+		the padding between OUTLOC1 and OUTLOC2.
+
+		The BUF bitfield indicates which of the four streamout buffers
+		to write into at the specified offset.
+
+		The VPC_SO[n].FLUSH_BASE_LO/HI is used for hw to write back next
+		offset which gets loaded back into VPC_SO[n].BUFFER_OFFSET via a
+		CP_MEM_TO_REG.  Probably can be ignored until we have GS/etc, at
+		which point we can't calculate the offset on the CPU.
+	</doc>
+	<reg32 offset="0xe2a1" name="VPC_SO_BUF_CNTL">
+		<bitfield name="BUF0" pos="0" type="boolean"/>
+		<bitfield name="BUF1" pos="3" type="boolean"/>
+		<bitfield name="BUF2" pos="6" type="boolean"/>
+		<bitfield name="BUF3" pos="9" type="boolean"/>
+		<bitfield name="ENABLE" pos="15" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe2a2" name="VPC_SO_OVERRIDE">
+		<bitfield name="SO_DISABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe2a3" name="VPC_SO_CNTL">
+		<!-- always 0x10000 when SO enabled.. -->
+		<bitfield name="ENABLE" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe2a4" name="VPC_SO_PROG">
+		<bitfield name="A_BUF" low="0" high="1" type="uint"/>
+		<bitfield name="A_OFF" low="2" high="10" shr="2" type="uint"/>
+		<bitfield name="A_EN" pos="11" type="boolean"/>
+		<bitfield name="B_BUF" low="12" high="13" type="uint"/>
+		<bitfield name="B_OFF" low="14" high="22" shr="2" type="uint"/>
+		<bitfield name="B_EN" pos="23" type="boolean"/>
+	</reg32>
+	<array offset="0xe2a7" name="VPC_SO" stride="7" length="4">
+		<reg32 offset="0" name="BUFFER_BASE_LO"/>
+		<reg32 offset="1" name="BUFFER_BASE_HI"/>
+		<reg32 offset="2" name="BUFFER_SIZE"/>
+		<reg32 offset="3" name="NCOMP"/>  <!-- component count -->
+		<reg32 offset="4" name="BUFFER_OFFSET"/>
+		<reg32 offset="5" name="FLUSH_BASE_LO"/>
+		<reg32 offset="6" name="FLUSH_BASE_HI"/>
+	</array>
+
+	<reg32 offset="0xe384" name="PC_PRIMITIVE_CNTL">
+		<!-- # of varyings plus four for gl_Position (plus one if gl_PointSize) -->
+		<bitfield name="STRIDE_IN_VPC" low="0" high="6" type="uint"/>
+		<bitfield name="PRIMITIVE_RESTART" pos="8" type="boolean"/>
+		<bitfield name="COUNT_PRIMITIVES" pos="9" type="boolean"/><!-- enabled when gl_PrimitiveIDIn is used -->
+		<bitfield name="PROVOKING_VTX_LAST" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe385" name="PC_PRIM_VTX_CNTL">
+		<bitfield name="PSIZE" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe388" name="PC_RASTER_CNTL">
+		<bitfield name="POLYMODE_FRONT_PTYPE" low="0" high="2" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_BACK_PTYPE" low="3" high="5" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_ENABLE" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe389" name="PC_CLIP_CNTL">
+		<bitfield name="CLIP_MASK" low="0" high="7"/>
+	</reg32>
+	<reg32 offset="0xe38c" name="PC_RESTART_INDEX"/>
+	<reg32 offset="0xe38d" name="PC_GS_LAYERED"/>
+	<reg32 offset="0xe38e" name="PC_GS_PARAM">
+		<bitfield name="MAX_VERTICES" low="0" high="9" type="uint"/><!-- vertices - 1 -->
+		<bitfield name="INVOCATIONS" low="11" high="15" type="uint"/><!-- invoc - 1 -->
+		<bitfield name="PRIMTYPE" low="23" high="24" type="adreno_pa_su_sc_draw"/>
+	</reg32>
+	<reg32 offset="0xe38f" name="PC_HS_PARAM">
+		<bitfield name="VERTICES_OUT" low="0" high="5" type="uint"/>
+		<bitfield name="SPACING" low="21" high="22" type="a4xx_tess_spacing"/>
+		<bitfield name="CW" pos="23" type="boolean"/>
+		<bitfield name="CONNECTED" pos="24" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe3b0" name="PC_POWER_CNTL"/>
+
+	<reg32 offset="0xe400" name="VFD_CONTROL_0">
+		<bitfield name="VTXCNT" low="0" high="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe401" name="VFD_CONTROL_1">
+		<bitfield name="REGID4VTX" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="REGID4INST" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID4PRIMID" low="16" high="23" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe402" name="VFD_CONTROL_2">
+		<bitfield name="REGID_PATCHID" low="0" high="7" type="a3xx_regid"/><!-- same as VFD_CONTROL_3.REGID_PATCHID? -->
+	</reg32>
+	<reg32 offset="0xe403" name="VFD_CONTROL_3">
+		<bitfield name="REGID_PATCHID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSY" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe404" name="VFD_CONTROL_4">
+	</reg32>
+	<reg32 offset="0xe405" name="VFD_CONTROL_5">
+		<!-- b0 set if gl_PrimitiveID used in fs ?? -->
+	</reg32>
+	<reg32 offset="0xe408" name="VFD_INDEX_OFFSET"/>
+	<reg32 offset="0xe409" name="VFD_INSTANCE_START_OFFSET"/>
+	<array offset="0xe40a" name="VFD_FETCH" stride="4" length="32">
+		<reg32 offset="0x0" name="BASE_LO"/>
+		<reg32 offset="0x1" name="BASE_HI"/>
+		<reg32 offset="0x2" name="SIZE" type="uint"/>
+		<reg32 offset="0x3" name="STRIDE" type="uint"/>
+	</array>
+	<array offset="0xe48a" name="VFD_DECODE" stride="2" length="32">
+		<reg32 offset="0x0" name="INSTR">
+			<!-- IDX appears to index into VFD_FETCH[] -->
+			<bitfield name="IDX" low="0" high="4" type="uint"/>
+			<bitfield name="INSTANCED" pos="17" type="boolean"/>
+			<bitfield name="FORMAT" low="20" high="27" type="a5xx_vtx_fmt"/>
+			<bitfield name="SWAP" low="28" high="29" type="a3xx_color_swap"/>
+			<bitfield name="UNK30" pos="30" type="boolean"/>
+			<bitfield name="FLOAT" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x1" name="STEP_RATE"/> <!-- ??? -->
+	</array>
+	<array offset="0xe4ca" name="VFD_DEST_CNTL" stride="1" length="32">
+		<reg32 offset="0x0" name="INSTR">
+			<bitfield name="WRITEMASK" low="0" high="3" type="hex"/>
+			<bitfield name="REGID" low="4" high="11" type="a3xx_regid"/>
+		</reg32>
+	</array>
+	<reg32 offset="0xe4f0" name="VFD_POWER_CNTL"/>
+
+	<!-- 0x0 for compute, 0x10 for 3d? -->
+	<reg32 offset="0xe580" name="SP_SP_CNTL"/>
+
+	<bitset name="a5xx_xs_config" inline="yes">
+		<bitfield name="ENABLED" pos="0" type="boolean"/>
+		<bitfield name="CONSTOBJECTOFFSET" low="1" high="7" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="8" high="14" type="uint"/>
+	</bitset>
+	<bitset name="a5xx_xs_cntl" inline="yes">
+		<bitfield name="SSBO_ENABLE" pos="0" type="boolean"/>
+		<!--
+		no idea high bit.. could be this is amount of on-chip memory used
+		rather than total size?
+		 -->
+		<bitfield name="INSTRLEN" low="1" high="31" type="uint"/>
+	</bitset>
+	<bitset name="a5xx_sp_xs_ctrl_reg0" inline="yes">
+		<!-- bit1 almost always set -->
+		<!-- set for "buffer mode" (ie. shader small enough to fit internally) -->
+		<bitfield name="BUFFER" pos="2" type="boolean"/>
+		<!-- 24 or more (full size) GPRS and blob uses TWO_QUADS instead of FOUR_QUADS -->
+		<bitfield name="THREADSIZE" pos="3" type="a3xx_threadsize"/>
+		<bitfield name="HALFREGFOOTPRINT" low="4" high="9" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="10" high="15" type="uint"/>
+		<bitfield name="VARYING" pos="16" type="boolean"/>
+		<bitfield name="PIXLODENABLE" pos="20" type="boolean"/>
+		<!-- seems to be nesting level for flow control:.. -->
+		<bitfield name="BRANCHSTACK" low="25" high="31" type="uint"/>
+	</bitset>
+	<!-- assuming things appear in same relative order as a4xx: -->
+	<!-- duplicated exactly w/ corresponding HLSQ_ regs starting at 0xe78b.. -->
+	<reg32 offset="0xe584" name="SP_VS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe585" name="SP_FS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe586" name="SP_HS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe587" name="SP_DS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe588" name="SP_GS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe589" name="SP_CS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe58a" name="SP_VS_CONFIG_MAX_CONST"/>
+	<reg32 offset="0xe58b" name="SP_FS_CONFIG_MAX_CONST"/>
+	<reg32 offset="0xe590" name="SP_VS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe592" name="SP_PRIMITIVE_CNTL">
+		<!-- # of VS outputs including pos/psize -->
+		<bitfield name="VSOUT" low="0" high="4" type="uint"/>
+	</reg32>
+	<array offset="0xe593" name="SP_VS_OUT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="24" high="27" type="hex"/>
+		</reg32>
+	</array>
+	<!--
+	Starting with a5xx, position/psize outputs from shader end up in the
+	SP_VS_OUT map, with highest OUTLOCn position.  (Generally they are
+	the last entries too, except when gl_PointCoord is used, blob inserts
+	an extra varying after, but with a lower OUTLOC position.  If present,
+	psize is last, preceded by position.
+	 -->
+	<array offset="0xe5a3" name="SP_VS_VPC_DST" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0xe5ab" name="UNKNOWN_E5AB"/>
+	<reg32 offset="0xe5ac" name="SP_VS_OBJ_START_LO"/>
+	<reg32 offset="0xe5ad" name="SP_VS_OBJ_START_HI"/>
+
+	<bitset name="a5xx_sp_xs_pvt_mem_param" inline="yes">
+		<bitfield name="MEMSIZEPERITEM" low="0" high="7" shr="9">
+			<doc>The size of memory that ldp/stp can address.</doc>
+		</bitfield>
+		<bitfield name="HWSTACKOFFSET" low="8" high="23" shr="11" type="uint"/>
+		<bitfield name="HWSTACKSIZEPERTHREAD" low="24" high="31">
+                        <doc>Guessing that this is the same as a3xx/a6xx.</doc>
+		</bitfield>
+	</bitset>
+
+	<bitset name="a5xx_sp_xs_pvt_mem_size" inline="yes">
+		<bitfield name="TOTALPVTMEMSIZE" low="0" high="17" shr="12"/>
+	</bitset>
+
+	<reg32 offset="0xe5ae" name="SP_VS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe5af" name="SP_VS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe5b1" name="SP_VS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+	<reg32 offset="0xe5c0" name="SP_FS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe5c2" name="UNKNOWN_E5C2"/>
+	<reg32 offset="0xe5c3" name="SP_FS_OBJ_START_LO"/>
+	<reg32 offset="0xe5c4" name="SP_FS_OBJ_START_HI"/>
+	<reg32 offset="0xe5c5" name="SP_FS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe5c6" name="SP_FS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe5c8" name="SP_FS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+	<reg32 offset="0xe5c9" name="SP_BLEND_CNTL">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="UNK8" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe5ca" name="SP_FS_OUTPUT_CNTL">
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+		<bitfield name="DEPTH_REGID" low="5" high="12" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK_REGID" low="13" high="20" type="a3xx_regid"/>
+	</reg32>
+	<array offset="0xe5cb" name="SP_FS_OUTPUT" stride="1" length="8">
+		<doc>per MRT</doc>
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="HALF_PRECISION" pos="8" type="boolean"/>
+		</reg32>
+	</array>
+	<array offset="0xe5d3" name="SP_FS_MRT" stride="1" length="8">
+		<reg32 offset="0" name="REG">
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a5xx_color_fmt"/>
+			<bitfield name="COLOR_SINT" pos="8" type="boolean"/>
+			<bitfield name="COLOR_UINT" pos="9" type="boolean"/>
+			<bitfield name="COLOR_SRGB" pos="10" type="boolean"/>
+		</reg32>
+	</array>
+	<!--
+	e5db/e5dc seems to look related to some optimization to do sample from
+	texture using varying value directly before shader thread starts?  I
+	guess that could optimize common simple frag shaders..
+	 -->
+	<reg32 offset="0xe5db" name="UNKNOWN_E5DB"/>
+	<reg32 offset="0xe5f0" name="SP_CS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe5f2" name="UNKNOWN_E5F2"/>
+	<reg32 offset="0xe5f3" name="SP_CS_OBJ_START_LO"/>
+	<reg32 offset="0xe5f4" name="SP_CS_OBJ_START_HI"/>
+	<reg32 offset="0xe5f5" name="SP_CS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe5f6" name="SP_CS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe5f8" name="SP_CS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+
+	<!-- e5f9 something compute related.. seems to change when HLSQ_CS_CNTL_1 changes -->
+
+	<reg32 offset="0xe600" name="SP_HS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe602" name="UNKNOWN_E602"/>
+	<reg32 offset="0xe603" name="SP_HS_OBJ_START_LO"/>
+	<reg32 offset="0xe604" name="SP_HS_OBJ_START_HI"/>
+	<reg32 offset="0xe605" name="SP_HS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe606" name="SP_HS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe608" name="SP_HS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+	<reg32 offset="0xe610" name="SP_DS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe62b" name="UNKNOWN_E62B"/>
+	<reg32 offset="0xe62c" name="SP_DS_OBJ_START_LO"/>
+	<reg32 offset="0xe62d" name="SP_DS_OBJ_START_HI"/>
+	<reg32 offset="0xe62e" name="SP_DS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe62f" name="SP_DS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe631" name="SP_DS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+	<reg32 offset="0xe640" name="SP_GS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe65b" name="UNKNOWN_E65B"/>
+	<reg32 offset="0xe65c" name="SP_GS_OBJ_START_LO"/>
+	<reg32 offset="0xe65d" name="SP_GS_OBJ_START_HI"/>
+	<reg32 offset="0xe65e" name="SP_GS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe65f" name="SP_GS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe661" name="SP_GS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+
+	<reg32 offset="0xe704" name="TPL1_TP_RAS_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+	</reg32>
+	<reg32 offset="0xe705" name="TPL1_TP_DEST_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+	<!-- either blob is doing it wrong, or this is not per-stage anymore: -->
+	<reg32 offset="0xe706" name="TPL1_TP_BORDER_COLOR_BASE_ADDR_LO"/>
+	<reg32 offset="0xe707" name="TPL1_TP_BORDER_COLOR_BASE_ADDR_HI"/>
+
+	<!--
+	so these have the same info that is normally in the CP_LOAD_STATE
+	packets.. not sure if they are normally written by pm4/me or if the
+	CP_LOAD_STATE mechanism is deprecated?
+	 -->
+	<reg32 offset="0xe700" name="TPL1_VS_TEX_COUNT" type="uint"/>
+	<reg32 offset="0xe701" name="TPL1_HS_TEX_COUNT" type="uint"/>
+	<reg32 offset="0xe702" name="TPL1_DS_TEX_COUNT" type="uint"/>
+	<reg32 offset="0xe703" name="TPL1_GS_TEX_COUNT" type="uint"/>
+
+	<reg32 offset="0xe722" name="TPL1_VS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe723" name="TPL1_VS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe724" name="TPL1_HS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe725" name="TPL1_HS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe726" name="TPL1_DS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe727" name="TPL1_DS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe728" name="TPL1_GS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe729" name="TPL1_GS_TEX_SAMP_HI"/>
+
+	<reg32 offset="0xe72a" name="TPL1_VS_TEX_CONST_LO"/>
+	<reg32 offset="0xe72b" name="TPL1_VS_TEX_CONST_HI"/>
+	<reg32 offset="0xe72c" name="TPL1_HS_TEX_CONST_LO"/>
+	<reg32 offset="0xe72d" name="TPL1_HS_TEX_CONST_HI"/>
+	<reg32 offset="0xe72e" name="TPL1_DS_TEX_CONST_LO"/>
+	<reg32 offset="0xe72f" name="TPL1_DS_TEX_CONST_HI"/>
+	<reg32 offset="0xe730" name="TPL1_GS_TEX_CONST_LO"/>
+	<reg32 offset="0xe731" name="TPL1_GS_TEX_CONST_HI"/>
+
+	<reg32 offset="0xe750" name="TPL1_FS_TEX_COUNT" type="uint"/>
+	<reg32 offset="0xe751" name="TPL1_CS_TEX_COUNT" type="uint"/>
+
+	<reg32 offset="0xe75a" name="TPL1_FS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe75b" name="TPL1_FS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe75c" name="TPL1_CS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe75d" name="TPL1_CS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe75e" name="TPL1_FS_TEX_CONST_LO"/>
+	<reg32 offset="0xe75f" name="TPL1_FS_TEX_CONST_HI"/>
+	<reg32 offset="0xe760" name="TPL1_CS_TEX_CONST_LO"/>
+	<reg32 offset="0xe761" name="TPL1_CS_TEX_CONST_HI"/>
+
+	<reg32 offset="0xe764" name="TPL1_TP_FS_ROTATION_CNTL"/>
+
+	<reg32 offset="0xe784" name="HLSQ_CONTROL_0_REG">
+		<!-- 24 or more (full size) GPRS and blob uses TWO_QUADS instead of FOUR_QUADS -->
+		<bitfield name="FSTHREADSIZE" pos="0" type="a3xx_threadsize"/>
+		<bitfield name="CSTHREADSIZE" pos="2" type="a3xx_threadsize"/>
+	</reg32>
+	<reg32 offset="0xe785" name="HLSQ_CONTROL_1_REG">
+		<!-- I guess.. not set exactly same as a4xx, but similar: -->
+		<bitfield name="PRIMALLOCTHRESHOLD" low="0" high="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe786" name="HLSQ_CONTROL_2_REG">
+		<bitfield name="FACEREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- SAMPLEID is loaded into a half-precision register: -->
+		<bitfield name="SAMPLEID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="CENTERRHW" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe787" name="HLSQ_CONTROL_3_REG">
+		<!-- register loaded with position (bary.f) -->
+		<bitfield name="IJ_PERSP_PIXEL" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_PIXEL" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="IJ_PERSP_CENTROID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_CENTROID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe788" name="HLSQ_CONTROL_4_REG">
+		<bitfield name="IJ_PERSP_SAMPLE" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="XYCOORDREGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="ZWCOORDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<!--
+	0x020fffff for normal draws, 0x1f00000 for compute.. maybe what state
+	is enabled?  We could probably try disabling different bits and see
+	what breaks to figure out which is what:
+	 -->
+	<reg32 offset="0xe78a" name="HLSQ_UPDATE_CNTL"/>
+	<reg32 offset="0xe78b" name="HLSQ_VS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe78c" name="HLSQ_FS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe78d" name="HLSQ_HS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe78e" name="HLSQ_DS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe78f" name="HLSQ_GS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe790" name="HLSQ_CS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe791" name="HLSQ_VS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe792" name="HLSQ_FS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe793" name="HLSQ_HS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe794" name="HLSQ_DS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe795" name="HLSQ_GS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe796" name="HLSQ_CS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe7b9" name="HLSQ_CS_KERNEL_GROUP_X"/>
+	<reg32 offset="0xe7ba" name="HLSQ_CS_KERNEL_GROUP_Y"/>
+	<reg32 offset="0xe7bb" name="HLSQ_CS_KERNEL_GROUP_Z"/>
+	<reg32 offset="0xe7b0" name="HLSQ_CS_NDRANGE_0">
+		<bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b1" name="HLSQ_CS_NDRANGE_1">
+		<bitfield name="GLOBALSIZE_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b2" name="HLSQ_CS_NDRANGE_2">
+		<bitfield name="GLOBALOFF_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b3" name="HLSQ_CS_NDRANGE_3">
+		<bitfield name="GLOBALSIZE_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b4" name="HLSQ_CS_NDRANGE_4">
+		<bitfield name="GLOBALOFF_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b5" name="HLSQ_CS_NDRANGE_5">
+		<bitfield name="GLOBALSIZE_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b6" name="HLSQ_CS_NDRANGE_6">
+		<bitfield name="GLOBALOFF_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b7" name="HLSQ_CS_CNTL_0">
+		<bitfield name="WGIDCONSTID" low="0" high="7" type="a3xx_regid"/>
+		<!-- possibly one of these is KERNELDIMCONSTID? -->
+		<!--
+		UNK0 appears to be NUMWGCONSTID.. but only works in certain
+		cases?  Blob doesn't appear to use it, but instead emits
+		these via const (uniform).  Which requires some shenanigans
+		for indirect draws when the offset is not strongly aligned
+		enough to use as EXT_SRC_ADDR in CP_LOAD_STATE
+		 -->
+		<bitfield name="UNK0" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="UNK1" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe7b8" name="HLSQ_CS_CNTL_1"/>
+	<reg32 offset="0xe7c0" name="UNKNOWN_E7C0"/>
+	<reg32 offset="0xe7c3" name="HLSQ_VS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7c4" name="HLSQ_VS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7c5" name="UNKNOWN_E7C5"/>
+	<reg32 offset="0xe7c8" name="HLSQ_HS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7c9" name="HLSQ_HS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7ca" name="UNKNOWN_E7CA"/>
+	<reg32 offset="0xe7cd" name="HLSQ_DS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7ce" name="HLSQ_DS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7cf" name="UNKNOWN_E7CF"/>
+	<reg32 offset="0xe7d2" name="HLSQ_GS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7d3" name="HLSQ_GS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7d4" name="UNKNOWN_E7D4"/>
+	<reg32 offset="0xe7d7" name="HLSQ_FS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7d8" name="HLSQ_FS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7d9" name="UNKNOWN_E7D9"/>
+	<reg32 offset="0xe7dc" name="HLSQ_CS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7dd" name="HLSQ_CS_INSTRLEN" type="uint"/>
+
+	<!--
+		Separate blit/2d or dma engine?  Seems to get used sometimes for
+		texture uploads, where a4xx blob would use normal draws.  Used
+		in render-mode 0x5..
+
+		Note seems mostly to be used for small blits, large blits seem
+		to use the CP_EVENT_WRITE:BLIT style of doing things.  See
+		cubemap-0003 (40x40) vs cubemap-0004 (256x256).
+
+		see cube-0000, cubemap-(1..3 but not 4+), quad-textured-10..17
+
+		Other nearby registers are probably color formats, etc.  The
+		blit coords are in CP packet.  Play more w/ glTexSubImage2D()
+		to work it out.
+
+		Separate this into a different domain??  Would that help to
+		restrict which registers we dump based on mode?
+
+		regs 0x2000 to 0x2004 (plus all-zero regs 0x2005-0x2009) look
+		like 2nd source for blending?  Used in mipmap generation.. but
+		maybe layout is a bit different.  (Possibly used for reading
+		src via sampler, to enable scaling??)  0x2040 also used in this
+		case.
+	 -->
+	<reg32 offset="0x2100" name="RB_2D_BLIT_CNTL"/>  <!-- same as 0x2180 -->
+	<reg32 offset="0x2101" name="RB_2D_SRC_SOLID_DW0"/>
+	<reg32 offset="0x2102" name="RB_2D_SRC_SOLID_DW1"/>
+	<reg32 offset="0x2103" name="RB_2D_SRC_SOLID_DW2"/>
+	<reg32 offset="0x2104" name="RB_2D_SRC_SOLID_DW3"/>
+
+	<bitset name="a5xx_2d_surf_info" inline="yes">
+		<bitfield name="COLOR_FORMAT" low="0" high="7" type="a5xx_color_fmt"/>
+		<bitfield name="TILE_MODE" low="8" high="9" type="a5xx_tile_mode"/>
+		<bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+		<!-- b12 seems to be set when UBWC "FLAGS" buffer enabled -->
+		<bitfield name="FLAGS" pos="12" type="boolean"/>
+		<bitfield name="SRGB" pos="13" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x2107" name="RB_2D_SRC_INFO" type="a5xx_2d_surf_info"/>
+	<reg32 offset="0x2108" name="RB_2D_SRC_LO"/>
+	<reg32 offset="0x2109" name="RB_2D_SRC_HI"/>
+	<reg32 offset="0x210a" name="RB_2D_SRC_SIZE">
+		<bitfield name="PITCH" low="0" high="15" shr="6" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="16" high="31" shr="6" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x2110" name="RB_2D_DST_INFO" type="a5xx_2d_surf_info"/>
+	<reg32 offset="0x2111" name="RB_2D_DST_LO"/>
+	<reg32 offset="0x2112" name="RB_2D_DST_HI"/>
+	<reg32 offset="0x2113" name="RB_2D_DST_SIZE">
+		<bitfield name="PITCH" low="0" high="15" shr="6" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="16" high="31" shr="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2140" name="RB_2D_SRC_FLAGS_LO"/>
+	<reg32 offset="0x2141" name="RB_2D_SRC_FLAGS_HI"/>
+        <reg32 offset="0x2142" name="RB_2D_SRC_FLAGS_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0x2143" name="RB_2D_DST_FLAGS_LO"/>
+	<reg32 offset="0x2144" name="RB_2D_DST_FLAGS_HI"/>
+        <reg32 offset="0x2145" name="RB_2D_DST_FLAGS_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0x2180" name="GRAS_2D_BLIT_CNTL"/> <!-- same as 0x2100 -->
+	<!-- looks same as 0x2107: -->
+	<reg32 offset="0x2181" name="GRAS_2D_SRC_INFO" type="a5xx_2d_surf_info"/>
+	<!-- looks same as 0x2110: -->
+	<reg32 offset="0x2182" name="GRAS_2D_DST_INFO" type="a5xx_2d_surf_info"/>
+<!--
+0x2100 and 0x2180 look like same thing (RB and GRAS versions)..
+   0x86000000 for copy, 0x00000000 for fill?
+
+0x2184 0x9 for copy, 0x1 for blit (maybe bitmask of enabled src/dst???)
+ -->
+	<reg32 offset="0x2184" name="UNKNOWN_2184"/>
+</domain>
+
+<domain name="A5XX_TEX_SAMP" width="32">
+	<doc>Texture sampler dwords</doc>
+	<enum name="a5xx_tex_filter"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_NEAREST" value="0"/>
+		<value name="A5XX_TEX_LINEAR" value="1"/>
+		<value name="A5XX_TEX_ANISO" value="2"/>
+	</enum>
+	<enum name="a5xx_tex_clamp"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_REPEAT" value="0"/>
+		<value name="A5XX_TEX_CLAMP_TO_EDGE" value="1"/>
+		<value name="A5XX_TEX_MIRROR_REPEAT" value="2"/>
+		<value name="A5XX_TEX_CLAMP_TO_BORDER" value="3"/>
+		<value name="A5XX_TEX_MIRROR_CLAMP" value="4"/>
+	</enum>
+	<enum name="a5xx_tex_aniso"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_ANISO_1" value="0"/>
+		<value name="A5XX_TEX_ANISO_2" value="1"/>
+		<value name="A5XX_TEX_ANISO_4" value="2"/>
+		<value name="A5XX_TEX_ANISO_8" value="3"/>
+		<value name="A5XX_TEX_ANISO_16" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="MIPFILTER_LINEAR_NEAR" pos="0" type="boolean"/>
+		<bitfield name="XY_MAG" low="1" high="2" type="a5xx_tex_filter"/>
+		<bitfield name="XY_MIN" low="3" high="4" type="a5xx_tex_filter"/>
+		<bitfield name="WRAP_S" low="5" high="7" type="a5xx_tex_clamp"/>
+		<bitfield name="WRAP_T" low="8" high="10" type="a5xx_tex_clamp"/>
+		<bitfield name="WRAP_R" low="11" high="13" type="a5xx_tex_clamp"/>
+		<bitfield name="ANISO" low="14" high="16" type="a5xx_tex_aniso"/>
+		<bitfield name="LOD_BIAS" low="19" high="31" type="fixed" radix="8"/><!-- no idea how many bits for real -->
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="COMPARE_FUNC" low="1" high="3" type="adreno_compare_func"/>
+		<bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="4" type="boolean"/>
+		<bitfield name="UNNORM_COORDS" pos="5" type="boolean"/>
+		<bitfield name="MIPFILTER_LINEAR_FAR" pos="6" type="boolean"/>
+		<bitfield name="MAX_LOD" low="8" high="19" type="ufixed" radix="8"/>
+		<bitfield name="MIN_LOD" low="20" high="31" type="ufixed" radix="8"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<!--
+		offset into border-color buffer?  Blob always uses 0x80 for FS state
+		if both VS and FS have border-color.
+Seems like when both VS and FS have bcolor, one starts 0x300 after other..
+and 0x80 in TEX_SAMP.2 ..  blob doesn't seem to be able to cope w/ multiple
+different border-color states per texture..  Looks something like:
+0000: 3f000000 00000000 00000000 3f800000 00008000 ffff0000 00004000 7fff0000
+0020: 00003800 3c000000 80100010 0000f008 ff000080 7f000040 c0000200 00800000
+0040: 00003800 3c000000 00000000 00000000 00000000 00000000 00000000 00000000
+*
+0300: 3f800000 3f800000 3f800000 3f800000 ffffffff ffffffff 7fff7fff 7fff7fff
+0320: 3c003c00 3c003c00 ffffffff 0000ffff ffffffff 7f7f7f7f ffffffff 00ffffff
+0340: 3c003c00 3c003c00 00000000 00000000 00000000 00000000 00000000 00000000
+
+		 -->
+		<bitfield name="BCOLOR_OFFSET" low="7" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3"/>
+</domain>
+
+<domain name="A5XX_TEX_CONST" width="32">
+	<doc>Texture constant dwords</doc>
+	<enum name="a5xx_tex_swiz"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_X" value="0"/>
+		<value name="A5XX_TEX_Y" value="1"/>
+		<value name="A5XX_TEX_Z" value="2"/>
+		<value name="A5XX_TEX_W" value="3"/>
+		<value name="A5XX_TEX_ZERO" value="4"/>
+		<value name="A5XX_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="a5xx_tex_type"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_1D" value="0"/>
+		<value name="A5XX_TEX_2D" value="1"/>
+		<value name="A5XX_TEX_CUBE" value="2"/>
+		<value name="A5XX_TEX_3D" value="3"/>
+		<value name="A5XX_TEX_BUFFER" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TILE_MODE" low="0" high="1" type="a5xx_tile_mode"/>
+		<bitfield name="SRGB" pos="2" type="boolean"/>
+		<bitfield name="SWIZ_X" low="4" high="6" type="a5xx_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="7" high="9" type="a5xx_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="10" high="12" type="a5xx_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="13" high="15" type="a5xx_tex_swiz"/>
+		<bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
+		<bitfield name="SAMPLES" low="20" high="21" type="a3xx_msaa_samples"/>
+		<bitfield name="FMT" low="22" high="29" type="a5xx_tex_fmt"/>
+		<bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="WIDTH" low="0" high="14" type="uint"/>
+		<bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<!--
+		b4 and b31 set for buffer/ssbo case, in which case low 15 bits
+		of size encoded in WIDTH, and high 15 bits encoded in HEIGHT
+
+		b31 is probably the 'BUFFER' bit.. it is the one that changes
+		behavior of texture in dEQP-GLES31.functional.texture.texture_buffer.render.as_fragment_texture.buffer_size_131071
+		 -->
+		<bitfield name="BUFFER" pos="4" type="boolean"/>
+		<!-- minimum pitch (for mipmap levels): log2(pitchalign / 64) -->
+		<bitfield name="PITCHALIGN" low="0" high="3" type="uint"/>
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="7" high="28" type="uint"/>
+		<bitfield name="TYPE" low="29" high="31" type="a5xx_tex_type"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!--
+		ARRAY_PITCH is basically LAYERSZ for the first mipmap level, and
+		for 3d textures (laid out mipmap level first) MIN_LAYERSZ is the
+		layer size at the point that it stops being reduced moving to
+		higher (smaller) mipmap levels
+		 -->
+		<bitfield name="ARRAY_PITCH" low="0" high="13" shr="12" type="uint"/>
+		<bitfield name="MIN_LAYERSZ" low="23" high="26" shr="12"/>
+		<!--
+		by default levels with w < 16 are linear
+		TILE_ALL makes all levels have tiling
+		seems required when using UBWC, since all levels have UBWC (can possibly be disabled?)
+		 -->
+		<bitfield name="TILE_ALL" pos="27" type="boolean"/>
+		<bitfield name="FLAG" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="BASE_LO" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="BASE_HI" low="0" high="16"/>
+		<bitfield name="DEPTH" low="17" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="6" name="6"/>
+	<reg32 offset="7" name="7"/>
+	<reg32 offset="8" name="8"/>
+	<reg32 offset="9" name="9"/>
+	<reg32 offset="10" name="10"/>
+	<reg32 offset="11" name="11"/>
+</domain>
+
+<!--
+Note the "SSBO" state blocks are actually used for both images and SSBOs,
+naming is just because I r/e'd SSBOs first.  I should probably come up
+with a better name.
+-->
+<domain name="A5XX_SSBO_0" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE_LO" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<!-- no BASE_HI here?  Maybe this is only used for 32b mode? -->
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="0" high="21" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ARRAY_PITCH" low="12" high="25" shr="12" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!-- bytes per pixel: -->
+		<bitfield name="CPP" low="0" high="5" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="A5XX_SSBO_1" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="FMT" low="8" high="15" type="a5xx_tex_fmt"/>
+		<bitfield name="WIDTH" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="HEIGHT" low="0" high="15" type="uint"/>
+		<bitfield name="DEPTH" low="16" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="A5XX_SSBO_2" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="BASE_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="A5XX_UBO" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="BASE_HI" low="0" high="16"/>
+		<!-- size probably in high bits -->
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/adreno/a6xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/adreno/a6xx.xml
@@ -0,0 +1,6092 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+<!--
+Each register that is actually being used by driver should have "usage" defined,
+currently there are following usages:
+- "cmd" - the register is used outside of renderpass and blits,
+		roughly corresponds to registers used in ib1 for Freedreno
+- "rp_blit" - the register is used inside renderpass or blits
+		(ib2 for Freedreno)
+
+It is expected that register with "cmd" usage may be written into only at
+the start of the command buffer (ib1), while "rp_blit" usage indicates that register
+is either overwritten by renderpass/blit (ib2) or not used if not overwritten
+by a particular renderpass/blit.
+-->
+
+<!-- these might be same as a5xx -->
+<enum name="a6xx_tile_mode">
+	<value name="TILE6_LINEAR" value="0"/>
+	<value name="TILE6_2" value="2"/>
+	<value name="TILE6_3" value="3"/>
+</enum>
+
+<enum name="a6xx_format">
+	<value value="0x02" name="FMT6_A8_UNORM"/>
+	<value value="0x03" name="FMT6_8_UNORM"/>
+	<value value="0x04" name="FMT6_8_SNORM"/>
+	<value value="0x05" name="FMT6_8_UINT"/>
+	<value value="0x06" name="FMT6_8_SINT"/>
+
+	<value value="0x08" name="FMT6_4_4_4_4_UNORM"/>
+	<value value="0x0a" name="FMT6_5_5_5_1_UNORM"/>
+	<value value="0x0c" name="FMT6_1_5_5_5_UNORM"/> <!-- read only -->
+	<value value="0x0e" name="FMT6_5_6_5_UNORM"/>
+
+	<value value="0x0f" name="FMT6_8_8_UNORM"/>
+	<value value="0x10" name="FMT6_8_8_SNORM"/>
+	<value value="0x11" name="FMT6_8_8_UINT"/>
+	<value value="0x12" name="FMT6_8_8_SINT"/>
+	<value value="0x13" name="FMT6_L8_A8_UNORM"/>
+
+	<value value="0x15" name="FMT6_16_UNORM"/>
+	<value value="0x16" name="FMT6_16_SNORM"/>
+	<value value="0x17" name="FMT6_16_FLOAT"/>
+	<value value="0x18" name="FMT6_16_UINT"/>
+	<value value="0x19" name="FMT6_16_SINT"/>
+
+	<value value="0x21" name="FMT6_8_8_8_UNORM"/>
+	<value value="0x22" name="FMT6_8_8_8_SNORM"/>
+	<value value="0x23" name="FMT6_8_8_8_UINT"/>
+	<value value="0x24" name="FMT6_8_8_8_SINT"/>
+
+	<value value="0x30" name="FMT6_8_8_8_8_UNORM"/>
+	<value value="0x31" name="FMT6_8_8_8_X8_UNORM"/> <!-- samples 1 for alpha -->
+	<value value="0x32" name="FMT6_8_8_8_8_SNORM"/>
+	<value value="0x33" name="FMT6_8_8_8_8_UINT"/>
+	<value value="0x34" name="FMT6_8_8_8_8_SINT"/>
+
+	<value value="0x35" name="FMT6_9_9_9_E5_FLOAT"/>
+
+	<value value="0x36" name="FMT6_10_10_10_2_UNORM"/>
+	<value value="0x37" name="FMT6_10_10_10_2_UNORM_DEST"/>
+	<value value="0x39" name="FMT6_10_10_10_2_SNORM"/>
+	<value value="0x3a" name="FMT6_10_10_10_2_UINT"/>
+	<value value="0x3b" name="FMT6_10_10_10_2_SINT"/>
+
+	<value value="0x42" name="FMT6_11_11_10_FLOAT"/>
+
+	<value value="0x43" name="FMT6_16_16_UNORM"/>
+	<value value="0x44" name="FMT6_16_16_SNORM"/>
+	<value value="0x45" name="FMT6_16_16_FLOAT"/>
+	<value value="0x46" name="FMT6_16_16_UINT"/>
+	<value value="0x47" name="FMT6_16_16_SINT"/>
+
+	<value value="0x48" name="FMT6_32_UNORM"/>
+	<value value="0x49" name="FMT6_32_SNORM"/>
+	<value value="0x4a" name="FMT6_32_FLOAT"/>
+	<value value="0x4b" name="FMT6_32_UINT"/>
+	<value value="0x4c" name="FMT6_32_SINT"/>
+	<value value="0x4d" name="FMT6_32_FIXED"/>
+
+	<value value="0x58" name="FMT6_16_16_16_UNORM"/>
+	<value value="0x59" name="FMT6_16_16_16_SNORM"/>
+	<value value="0x5a" name="FMT6_16_16_16_FLOAT"/>
+	<value value="0x5b" name="FMT6_16_16_16_UINT"/>
+	<value value="0x5c" name="FMT6_16_16_16_SINT"/>
+
+	<value value="0x60" name="FMT6_16_16_16_16_UNORM"/>
+	<value value="0x61" name="FMT6_16_16_16_16_SNORM"/>
+	<value value="0x62" name="FMT6_16_16_16_16_FLOAT"/>
+	<value value="0x63" name="FMT6_16_16_16_16_UINT"/>
+	<value value="0x64" name="FMT6_16_16_16_16_SINT"/>
+
+	<value value="0x65" name="FMT6_32_32_UNORM"/>
+	<value value="0x66" name="FMT6_32_32_SNORM"/>
+	<value value="0x67" name="FMT6_32_32_FLOAT"/>
+	<value value="0x68" name="FMT6_32_32_UINT"/>
+	<value value="0x69" name="FMT6_32_32_SINT"/>
+	<value value="0x6a" name="FMT6_32_32_FIXED"/>
+
+	<value value="0x70" name="FMT6_32_32_32_UNORM"/>
+	<value value="0x71" name="FMT6_32_32_32_SNORM"/>
+	<value value="0x72" name="FMT6_32_32_32_UINT"/>
+	<value value="0x73" name="FMT6_32_32_32_SINT"/>
+	<value value="0x74" name="FMT6_32_32_32_FLOAT"/>
+	<value value="0x75" name="FMT6_32_32_32_FIXED"/>
+
+	<value value="0x80" name="FMT6_32_32_32_32_UNORM"/>
+	<value value="0x81" name="FMT6_32_32_32_32_SNORM"/>
+	<value value="0x82" name="FMT6_32_32_32_32_FLOAT"/>
+	<value value="0x83" name="FMT6_32_32_32_32_UINT"/>
+	<value value="0x84" name="FMT6_32_32_32_32_SINT"/>
+	<value value="0x85" name="FMT6_32_32_32_32_FIXED"/>
+
+	<value value="0x8c" name="FMT6_G8R8B8R8_422_UNORM"/> <!-- UYVY -->
+	<value value="0x8d" name="FMT6_R8G8R8B8_422_UNORM"/> <!-- YUYV -->
+	<value value="0x8e" name="FMT6_R8_G8B8_2PLANE_420_UNORM"/> <!-- NV12 -->
+	<value value="0x8f" name="FMT6_NV21"/>
+	<value value="0x90" name="FMT6_R8_G8_B8_3PLANE_420_UNORM"/> <!-- YV12 -->
+
+	<value value="0x91" name="FMT6_Z24_UNORM_S8_UINT_AS_R8G8B8A8"/>
+
+	<!-- Note: tiling/UBWC for these may be different from equivalent formats
+	For example FMT6_NV12_Y is not compatible with FMT6_8_UNORM
+	-->
+	<value value="0x94" name="FMT6_NV12_Y"/>
+	<value value="0x95" name="FMT6_NV12_UV"/>
+	<value value="0x96" name="FMT6_NV12_VU"/>
+	<value value="0x97" name="FMT6_NV12_4R"/>
+	<value value="0x98" name="FMT6_NV12_4R_Y"/>
+	<value value="0x99" name="FMT6_NV12_4R_UV"/>
+	<value value="0x9a" name="FMT6_P010"/>
+	<value value="0x9b" name="FMT6_P010_Y"/>
+	<value value="0x9c" name="FMT6_P010_UV"/>
+	<value value="0x9d" name="FMT6_TP10"/>
+	<value value="0x9e" name="FMT6_TP10_Y"/>
+	<value value="0x9f" name="FMT6_TP10_UV"/>
+
+	<value value="0xa0" name="FMT6_Z24_UNORM_S8_UINT"/>
+
+	<value value="0xab" name="FMT6_ETC2_RG11_UNORM"/>
+	<value value="0xac" name="FMT6_ETC2_RG11_SNORM"/>
+	<value value="0xad" name="FMT6_ETC2_R11_UNORM"/>
+	<value value="0xae" name="FMT6_ETC2_R11_SNORM"/>
+	<value value="0xaf" name="FMT6_ETC1"/>
+	<value value="0xb0" name="FMT6_ETC2_RGB8"/>
+	<value value="0xb1" name="FMT6_ETC2_RGBA8"/>
+	<value value="0xb2" name="FMT6_ETC2_RGB8A1"/>
+	<value value="0xb3" name="FMT6_DXT1"/>
+	<value value="0xb4" name="FMT6_DXT3"/>
+	<value value="0xb5" name="FMT6_DXT5"/>
+	<value value="0xb7" name="FMT6_RGTC1_UNORM"/>
+	<value value="0xb8" name="FMT6_RGTC1_SNORM"/>
+	<value value="0xbb" name="FMT6_RGTC2_UNORM"/>
+	<value value="0xbc" name="FMT6_RGTC2_SNORM"/>
+	<value value="0xbe" name="FMT6_BPTC_UFLOAT"/>
+	<value value="0xbf" name="FMT6_BPTC_FLOAT"/>
+	<value value="0xc0" name="FMT6_BPTC"/>
+	<value value="0xc1" name="FMT6_ASTC_4x4"/>
+	<value value="0xc2" name="FMT6_ASTC_5x4"/>
+	<value value="0xc3" name="FMT6_ASTC_5x5"/>
+	<value value="0xc4" name="FMT6_ASTC_6x5"/>
+	<value value="0xc5" name="FMT6_ASTC_6x6"/>
+	<value value="0xc6" name="FMT6_ASTC_8x5"/>
+	<value value="0xc7" name="FMT6_ASTC_8x6"/>
+	<value value="0xc8" name="FMT6_ASTC_8x8"/>
+	<value value="0xc9" name="FMT6_ASTC_10x5"/>
+	<value value="0xca" name="FMT6_ASTC_10x6"/>
+	<value value="0xcb" name="FMT6_ASTC_10x8"/>
+	<value value="0xcc" name="FMT6_ASTC_10x10"/>
+	<value value="0xcd" name="FMT6_ASTC_12x10"/>
+	<value value="0xce" name="FMT6_ASTC_12x12"/>
+
+	<!-- for sampling stencil (integer, 2nd channel), not available on a630 -->
+	<value value="0xea" name="FMT6_Z24_UINT_S8_UINT"/>
+
+	<!-- Not a hw enum, used internally in driver -->
+	<value value="0xff" name="FMT6_NONE"/>
+
+</enum>
+
+<!-- probably same as a5xx -->
+<enum name="a6xx_polygon_mode">
+	<value name="POLYMODE6_POINTS" value="1"/>
+	<value name="POLYMODE6_LINES" value="2"/>
+	<value name="POLYMODE6_TRIANGLES" value="3"/>
+</enum>
+
+<enum name="a6xx_depth_format">
+	<value name="DEPTH6_NONE" value="0"/>
+	<value name="DEPTH6_16" value="1"/>
+	<value name="DEPTH6_24_8" value="2"/>
+	<value name="DEPTH6_32" value="4"/>
+</enum>
+
+<bitset name="a6x_cp_protect" inline="yes">
+	<bitfield name="BASE_ADDR" low="0" high="17"/>
+	<bitfield name="MASK_LEN" low="18" high="30"/>
+	<bitfield name="READ" pos="31" type="boolean"/>
+</bitset>
+
+<enum name="a6xx_shader_id">
+	<value value="0x9" name="A6XX_TP0_TMO_DATA"/>
+	<value value="0xa" name="A6XX_TP0_SMO_DATA"/>
+	<value value="0xb" name="A6XX_TP0_MIPMAP_BASE_DATA"/>
+	<value value="0x19" name="A6XX_TP1_TMO_DATA"/>
+	<value value="0x1a" name="A6XX_TP1_SMO_DATA"/>
+	<value value="0x1b" name="A6XX_TP1_MIPMAP_BASE_DATA"/>
+	<value value="0x29" name="A6XX_SP_INST_DATA"/>
+	<value value="0x2a" name="A6XX_SP_LB_0_DATA"/>
+	<value value="0x2b" name="A6XX_SP_LB_1_DATA"/>
+	<value value="0x2c" name="A6XX_SP_LB_2_DATA"/>
+	<value value="0x2d" name="A6XX_SP_LB_3_DATA"/>
+	<value value="0x2e" name="A6XX_SP_LB_4_DATA"/>
+	<value value="0x2f" name="A6XX_SP_LB_5_DATA"/>
+	<value value="0x30" name="A6XX_SP_CB_BINDLESS_DATA"/>
+	<value value="0x31" name="A6XX_SP_CB_LEGACY_DATA"/>
+	<value value="0x32" name="A6XX_SP_UAV_DATA"/>
+	<value value="0x33" name="A6XX_SP_INST_TAG"/>
+	<value value="0x34" name="A6XX_SP_CB_BINDLESS_TAG"/>
+	<value value="0x35" name="A6XX_SP_TMO_UMO_TAG"/>
+	<value value="0x36" name="A6XX_SP_SMO_TAG"/>
+	<value value="0x37" name="A6XX_SP_STATE_DATA"/>
+	<value value="0x49" name="A6XX_HLSQ_CHUNK_CVS_RAM"/>
+	<value value="0x4a" name="A6XX_HLSQ_CHUNK_CPS_RAM"/>
+	<value value="0x4b" name="A6XX_HLSQ_CHUNK_CVS_RAM_TAG"/>
+	<value value="0x4c" name="A6XX_HLSQ_CHUNK_CPS_RAM_TAG"/>
+	<value value="0x4d" name="A6XX_HLSQ_ICB_CVS_CB_BASE_TAG"/>
+	<value value="0x4e" name="A6XX_HLSQ_ICB_CPS_CB_BASE_TAG"/>
+	<value value="0x50" name="A6XX_HLSQ_CVS_MISC_RAM"/>
+	<value value="0x51" name="A6XX_HLSQ_CPS_MISC_RAM"/>
+	<value value="0x52" name="A6XX_HLSQ_INST_RAM"/>
+	<value value="0x53" name="A6XX_HLSQ_GFX_CVS_CONST_RAM"/>
+	<value value="0x54" name="A6XX_HLSQ_GFX_CPS_CONST_RAM"/>
+	<value value="0x55" name="A6XX_HLSQ_CVS_MISC_RAM_TAG"/>
+	<value value="0x56" name="A6XX_HLSQ_CPS_MISC_RAM_TAG"/>
+	<value value="0x57" name="A6XX_HLSQ_INST_RAM_TAG"/>
+	<value value="0x58" name="A6XX_HLSQ_GFX_CVS_CONST_RAM_TAG"/>
+	<value value="0x59" name="A6XX_HLSQ_GFX_CPS_CONST_RAM_TAG"/>
+	<value value="0x5a" name="A6XX_HLSQ_PWR_REST_RAM"/>
+	<value value="0x5b" name="A6XX_HLSQ_PWR_REST_TAG"/>
+	<value value="0x60" name="A6XX_HLSQ_DATAPATH_META"/>
+	<value value="0x61" name="A6XX_HLSQ_FRONTEND_META"/>
+	<value value="0x62" name="A6XX_HLSQ_INDIRECT_META"/>
+	<value value="0x63" name="A6XX_HLSQ_BACKEND_META"/>
+	<value value="0x70" name="A6XX_SP_LB_6_DATA"/>
+	<value value="0x71" name="A6XX_SP_LB_7_DATA"/>
+	<value value="0x73" name="A6XX_HLSQ_INST_RAM_1"/>
+</enum>
+
+<enum name="a7xx_statetype_id">
+	<value value="0" name="A7XX_TP0_NCTX_REG"/>
+	<value value="1" name="A7XX_TP0_CTX0_3D_CVS_REG"/>
+	<value value="2" name="A7XX_TP0_CTX0_3D_CPS_REG"/>
+	<value value="3" name="A7XX_TP0_CTX1_3D_CVS_REG"/>
+	<value value="4" name="A7XX_TP0_CTX1_3D_CPS_REG"/>
+	<value value="5" name="A7XX_TP0_CTX2_3D_CPS_REG"/>
+	<value value="6" name="A7XX_TP0_CTX3_3D_CPS_REG"/>
+	<value value="9" name="A7XX_TP0_TMO_DATA"/>
+	<value value="10" name="A7XX_TP0_SMO_DATA"/>
+	<value value="11" name="A7XX_TP0_MIPMAP_BASE_DATA"/>
+	<value value="32" name="A7XX_SP_NCTX_REG"/>
+	<value value="33" name="A7XX_SP_CTX0_3D_CVS_REG"/>
+	<value value="34" name="A7XX_SP_CTX0_3D_CPS_REG"/>
+	<value value="35" name="A7XX_SP_CTX1_3D_CVS_REG"/>
+	<value value="36" name="A7XX_SP_CTX1_3D_CPS_REG"/>
+	<value value="37" name="A7XX_SP_CTX2_3D_CPS_REG"/>
+	<value value="38" name="A7XX_SP_CTX3_3D_CPS_REG"/>
+	<value value="39" name="A7XX_SP_INST_DATA"/>
+	<value value="40" name="A7XX_SP_INST_DATA_1"/>
+	<value value="41" name="A7XX_SP_LB_0_DATA"/>
+	<value value="42" name="A7XX_SP_LB_1_DATA"/>
+	<value value="43" name="A7XX_SP_LB_2_DATA"/>
+	<value value="44" name="A7XX_SP_LB_3_DATA"/>
+	<value value="45" name="A7XX_SP_LB_4_DATA"/>
+	<value value="46" name="A7XX_SP_LB_5_DATA"/>
+	<value value="47" name="A7XX_SP_LB_6_DATA"/>
+	<value value="48" name="A7XX_SP_LB_7_DATA"/>
+	<value value="49" name="A7XX_SP_CB_RAM"/>
+	<value value="50" name="A7XX_SP_LB_13_DATA"/>
+	<value value="51" name="A7XX_SP_LB_14_DATA"/>
+	<value value="52" name="A7XX_SP_INST_TAG"/>
+	<value value="53" name="A7XX_SP_INST_DATA_2"/>
+	<value value="54" name="A7XX_SP_TMO_TAG"/>
+	<value value="55" name="A7XX_SP_SMO_TAG"/>
+	<value value="56" name="A7XX_SP_STATE_DATA"/>
+	<value value="57" name="A7XX_SP_HWAVE_RAM"/>
+	<value value="58" name="A7XX_SP_L0_INST_BUF"/>
+	<value value="59" name="A7XX_SP_LB_8_DATA"/>
+	<value value="60" name="A7XX_SP_LB_9_DATA"/>
+	<value value="61" name="A7XX_SP_LB_10_DATA"/>
+	<value value="62" name="A7XX_SP_LB_11_DATA"/>
+	<value value="63" name="A7XX_SP_LB_12_DATA"/>
+	<value value="64" name="A7XX_HLSQ_DATAPATH_DSTR_META"/>
+	<value value="67" name="A7XX_HLSQ_L2STC_TAG_RAM"/>
+	<value value="68" name="A7XX_HLSQ_L2STC_INFO_CMD"/>
+	<value value="69" name="A7XX_HLSQ_CVS_BE_CTXT_BUF_RAM_TAG"/>
+	<value value="70" name="A7XX_HLSQ_CPS_BE_CTXT_BUF_RAM_TAG"/>
+	<value value="71" name="A7XX_HLSQ_GFX_CVS_BE_CTXT_BUF_RAM"/>
+	<value value="72" name="A7XX_HLSQ_GFX_CPS_BE_CTXT_BUF_RAM"/>
+	<value value="73" name="A7XX_HLSQ_CHUNK_CVS_RAM"/>
+	<value value="74" name="A7XX_HLSQ_CHUNK_CPS_RAM"/>
+	<value value="75" name="A7XX_HLSQ_CHUNK_CVS_RAM_TAG"/>
+	<value value="76" name="A7XX_HLSQ_CHUNK_CPS_RAM_TAG"/>
+	<value value="77" name="A7XX_HLSQ_ICB_CVS_CB_BASE_TAG"/>
+	<value value="78" name="A7XX_HLSQ_ICB_CPS_CB_BASE_TAG"/>
+	<value value="79" name="A7XX_HLSQ_CVS_MISC_RAM"/>
+	<value value="80" name="A7XX_HLSQ_CPS_MISC_RAM"/>
+	<value value="81" name="A7XX_HLSQ_CPS_MISC_RAM_1"/>
+	<value value="82" name="A7XX_HLSQ_INST_RAM"/>
+	<value value="83" name="A7XX_HLSQ_GFX_CVS_CONST_RAM"/>
+	<value value="84" name="A7XX_HLSQ_GFX_CPS_CONST_RAM"/>
+	<value value="85" name="A7XX_HLSQ_CVS_MISC_RAM_TAG"/>
+	<value value="86" name="A7XX_HLSQ_CPS_MISC_RAM_TAG"/>
+	<value value="87" name="A7XX_HLSQ_INST_RAM_TAG"/>
+	<value value="88" name="A7XX_HLSQ_GFX_CVS_CONST_RAM_TAG"/>
+	<value value="89" name="A7XX_HLSQ_GFX_CPS_CONST_RAM_TAG"/>
+	<value value="90" name="A7XX_HLSQ_GFX_LOCAL_MISC_RAM"/>
+	<value value="91" name="A7XX_HLSQ_GFX_LOCAL_MISC_RAM_TAG"/>
+	<value value="92" name="A7XX_HLSQ_INST_RAM_1"/>
+	<value value="93" name="A7XX_HLSQ_STPROC_META"/>
+	<value value="94" name="A7XX_HLSQ_BV_BE_META"/>
+	<value value="95" name="A7XX_HLSQ_INST_RAM_2"/>
+	<value value="96" name="A7XX_HLSQ_DATAPATH_META"/>
+	<value value="97" name="A7XX_HLSQ_FRONTEND_META"/>
+	<value value="98" name="A7XX_HLSQ_INDIRECT_META"/>
+	<value value="99" name="A7XX_HLSQ_BACKEND_META"/>
+</enum>
+
+<enum name="a6xx_debugbus_id">
+	<value value="0x1" name="A6XX_DBGBUS_CP"/>
+	<value value="0x2" name="A6XX_DBGBUS_RBBM"/>
+	<value value="0x3" name="A6XX_DBGBUS_VBIF"/>
+	<value value="0x4" name="A6XX_DBGBUS_HLSQ"/>
+	<value value="0x5" name="A6XX_DBGBUS_UCHE"/>
+	<value value="0x6" name="A6XX_DBGBUS_DPM"/>
+	<value value="0x7" name="A6XX_DBGBUS_TESS"/>
+	<value value="0x8" name="A6XX_DBGBUS_PC"/>
+	<value value="0x9" name="A6XX_DBGBUS_VFDP"/>
+	<value value="0xa" name="A6XX_DBGBUS_VPC"/>
+	<value value="0xb" name="A6XX_DBGBUS_TSE"/>
+	<value value="0xc" name="A6XX_DBGBUS_RAS"/>
+	<value value="0xd" name="A6XX_DBGBUS_VSC"/>
+	<value value="0xe" name="A6XX_DBGBUS_COM"/>
+	<value value="0x10" name="A6XX_DBGBUS_LRZ"/>
+	<value value="0x11" name="A6XX_DBGBUS_A2D"/>
+	<value value="0x12" name="A6XX_DBGBUS_CCUFCHE"/>
+	<value value="0x13" name="A6XX_DBGBUS_GMU_CX"/>
+	<value value="0x14" name="A6XX_DBGBUS_RBP"/>
+	<value value="0x15" name="A6XX_DBGBUS_DCS"/>
+	<value value="0x16" name="A6XX_DBGBUS_DBGC"/>
+	<value value="0x17" name="A6XX_DBGBUS_CX"/>
+	<value value="0x18" name="A6XX_DBGBUS_GMU_GX"/>
+	<value value="0x19" name="A6XX_DBGBUS_TPFCHE"/>
+	<value value="0x1a" name="A6XX_DBGBUS_GBIF_GX"/>
+	<value value="0x1d" name="A6XX_DBGBUS_GPC"/>
+	<value value="0x1e" name="A6XX_DBGBUS_LARC"/>
+	<value value="0x1f" name="A6XX_DBGBUS_HLSQ_SPTP"/>
+	<value value="0x20" name="A6XX_DBGBUS_RB_0"/>
+	<value value="0x21" name="A6XX_DBGBUS_RB_1"/>
+	<value value="0x22" name="A6XX_DBGBUS_RB_2"/>
+	<value value="0x24" name="A6XX_DBGBUS_UCHE_WRAPPER"/>
+	<value value="0x28" name="A6XX_DBGBUS_CCU_0"/>
+	<value value="0x29" name="A6XX_DBGBUS_CCU_1"/>
+	<value value="0x2a" name="A6XX_DBGBUS_CCU_2"/>
+	<value value="0x38" name="A6XX_DBGBUS_VFD_0"/>
+	<value value="0x39" name="A6XX_DBGBUS_VFD_1"/>
+	<value value="0x3a" name="A6XX_DBGBUS_VFD_2"/>
+	<value value="0x3b" name="A6XX_DBGBUS_VFD_3"/>
+	<value value="0x3c" name="A6XX_DBGBUS_VFD_4"/>
+	<value value="0x3d" name="A6XX_DBGBUS_VFD_5"/>
+	<value value="0x40" name="A6XX_DBGBUS_SP_0"/>
+	<value value="0x41" name="A6XX_DBGBUS_SP_1"/>
+	<value value="0x42" name="A6XX_DBGBUS_SP_2"/>
+	<value value="0x48" name="A6XX_DBGBUS_TPL1_0"/>
+	<value value="0x49" name="A6XX_DBGBUS_TPL1_1"/>
+	<value value="0x4a" name="A6XX_DBGBUS_TPL1_2"/>
+	<value value="0x4b" name="A6XX_DBGBUS_TPL1_3"/>
+	<value value="0x4c" name="A6XX_DBGBUS_TPL1_4"/>
+	<value value="0x4d" name="A6XX_DBGBUS_TPL1_5"/>
+	<value value="0x58" name="A6XX_DBGBUS_SPTP_0"/>
+	<value value="0x59" name="A6XX_DBGBUS_SPTP_1"/>
+	<value value="0x5a" name="A6XX_DBGBUS_SPTP_2"/>
+	<value value="0x5b" name="A6XX_DBGBUS_SPTP_3"/>
+	<value value="0x5c" name="A6XX_DBGBUS_SPTP_4"/>
+	<value value="0x5d" name="A6XX_DBGBUS_SPTP_5"/>
+</enum>
+
+<enum name="a7xx_state_location">
+	<value value="0" name="A7XX_HLSQ_STATE"/>
+	<value value="1" name="A7XX_HLSQ_DP"/>
+	<value value="2" name="A7XX_SP_TOP"/>
+	<value value="3" name="A7XX_USPTP"/>
+	<value value="4" name="A7XX_HLSQ_DP_STR"/>
+</enum>
+
+<enum name="a7xx_pipe">
+	<value value="0" name="A7XX_PIPE_NONE"/>
+	<value value="1" name="A7XX_PIPE_BR"/>
+	<value value="2" name="A7XX_PIPE_BV"/>
+	<value value="3" name="A7XX_PIPE_LPAC"/>
+</enum>
+
+<enum name="a7xx_cluster">
+	<value value="0" name="A7XX_CLUSTER_NONE"/>
+	<value value="1" name="A7XX_CLUSTER_FE"/>
+	<value value="2" name="A7XX_CLUSTER_SP_VS"/>
+	<value value="3" name="A7XX_CLUSTER_PC_VS"/>
+	<value value="4" name="A7XX_CLUSTER_GRAS"/>
+	<value value="5" name="A7XX_CLUSTER_SP_PS"/>
+	<value value="6" name="A7XX_CLUSTER_VPC_PS"/>
+	<value value="7" name="A7XX_CLUSTER_PS"/>
+</enum>
+
+<enum name="a7xx_debugbus_id">
+	<value value="1" name="A7XX_DBGBUS_CP_0_0"/>
+	<value value="2" name="A7XX_DBGBUS_CP_0_1"/>
+	<value value="3" name="A7XX_DBGBUS_RBBM"/>
+	<value value="5" name="A7XX_DBGBUS_GBIF_GX"/>
+	<value value="6" name="A7XX_DBGBUS_GBIF_CX"/>
+	<value value="7" name="A7XX_DBGBUS_HLSQ"/>
+	<value value="9" name="A7XX_DBGBUS_UCHE_0"/>
+	<value value="10" name="A7XX_DBGBUS_UCHE_1"/>
+	<value value="13" name="A7XX_DBGBUS_TESS_BR"/>
+	<value value="14" name="A7XX_DBGBUS_TESS_BV"/>
+	<value value="17" name="A7XX_DBGBUS_PC_BR"/>
+	<value value="18" name="A7XX_DBGBUS_PC_BV"/>
+	<value value="21" name="A7XX_DBGBUS_VFDP_BR"/>
+	<value value="22" name="A7XX_DBGBUS_VFDP_BV"/>
+	<value value="25" name="A7XX_DBGBUS_VPC_BR"/>
+	<value value="26" name="A7XX_DBGBUS_VPC_BV"/>
+	<value value="29" name="A7XX_DBGBUS_TSE_BR"/>
+	<value value="30" name="A7XX_DBGBUS_TSE_BV"/>
+	<value value="33" name="A7XX_DBGBUS_RAS_BR"/>
+	<value value="34" name="A7XX_DBGBUS_RAS_BV"/>
+	<value value="37" name="A7XX_DBGBUS_VSC"/>
+	<value value="39" name="A7XX_DBGBUS_COM_0"/>
+	<value value="43" name="A7XX_DBGBUS_LRZ_BR"/>
+	<value value="44" name="A7XX_DBGBUS_LRZ_BV"/>
+	<value value="47" name="A7XX_DBGBUS_UFC_0"/>
+	<value value="48" name="A7XX_DBGBUS_UFC_1"/>
+	<value value="55" name="A7XX_DBGBUS_GMU_GX"/>
+	<value value="59" name="A7XX_DBGBUS_DBGC"/>
+	<value value="60" name="A7XX_DBGBUS_CX"/>
+	<value value="61" name="A7XX_DBGBUS_GMU_CX"/>
+	<value value="62" name="A7XX_DBGBUS_GPC_BR"/>
+	<value value="63" name="A7XX_DBGBUS_GPC_BV"/>
+	<value value="66" name="A7XX_DBGBUS_LARC"/>
+	<value value="68" name="A7XX_DBGBUS_HLSQ_SPTP"/>
+	<value value="70" name="A7XX_DBGBUS_RB_0"/>
+	<value value="71" name="A7XX_DBGBUS_RB_1"/>
+	<value value="72" name="A7XX_DBGBUS_RB_2"/>
+	<value value="73" name="A7XX_DBGBUS_RB_3"/>
+	<value value="74" name="A7XX_DBGBUS_RB_4"/>
+	<value value="75" name="A7XX_DBGBUS_RB_5"/>
+	<value value="102" name="A7XX_DBGBUS_UCHE_WRAPPER"/>
+	<value value="106" name="A7XX_DBGBUS_CCU_0"/>
+	<value value="107" name="A7XX_DBGBUS_CCU_1"/>
+	<value value="108" name="A7XX_DBGBUS_CCU_2"/>
+	<value value="109" name="A7XX_DBGBUS_CCU_3"/>
+	<value value="110" name="A7XX_DBGBUS_CCU_4"/>
+	<value value="111" name="A7XX_DBGBUS_CCU_5"/>
+	<value value="138" name="A7XX_DBGBUS_VFD_BR_0"/>
+	<value value="139" name="A7XX_DBGBUS_VFD_BR_1"/>
+	<value value="140" name="A7XX_DBGBUS_VFD_BR_2"/>
+	<value value="141" name="A7XX_DBGBUS_VFD_BR_3"/>
+	<value value="142" name="A7XX_DBGBUS_VFD_BR_4"/>
+	<value value="143" name="A7XX_DBGBUS_VFD_BR_5"/>
+	<value value="144" name="A7XX_DBGBUS_VFD_BR_6"/>
+	<value value="145" name="A7XX_DBGBUS_VFD_BR_7"/>
+	<value value="202" name="A7XX_DBGBUS_VFD_BV_0"/>
+	<value value="203" name="A7XX_DBGBUS_VFD_BV_1"/>
+	<value value="204" name="A7XX_DBGBUS_VFD_BV_2"/>
+	<value value="205" name="A7XX_DBGBUS_VFD_BV_3"/>
+	<value value="234" name="A7XX_DBGBUS_USP_0"/>
+	<value value="235" name="A7XX_DBGBUS_USP_1"/>
+	<value value="236" name="A7XX_DBGBUS_USP_2"/>
+	<value value="237" name="A7XX_DBGBUS_USP_3"/>
+	<value value="238" name="A7XX_DBGBUS_USP_4"/>
+	<value value="239" name="A7XX_DBGBUS_USP_5"/>
+	<value value="266" name="A7XX_DBGBUS_TP_0"/>
+	<value value="267" name="A7XX_DBGBUS_TP_1"/>
+	<value value="268" name="A7XX_DBGBUS_TP_2"/>
+	<value value="269" name="A7XX_DBGBUS_TP_3"/>
+	<value value="270" name="A7XX_DBGBUS_TP_4"/>
+	<value value="271" name="A7XX_DBGBUS_TP_5"/>
+	<value value="272" name="A7XX_DBGBUS_TP_6"/>
+	<value value="273" name="A7XX_DBGBUS_TP_7"/>
+	<value value="274" name="A7XX_DBGBUS_TP_8"/>
+	<value value="275" name="A7XX_DBGBUS_TP_9"/>
+	<value value="276" name="A7XX_DBGBUS_TP_10"/>
+	<value value="277" name="A7XX_DBGBUS_TP_11"/>
+	<value value="330" name="A7XX_DBGBUS_USPTP_0"/>
+	<value value="331" name="A7XX_DBGBUS_USPTP_1"/>
+	<value value="332" name="A7XX_DBGBUS_USPTP_2"/>
+	<value value="333" name="A7XX_DBGBUS_USPTP_3"/>
+	<value value="334" name="A7XX_DBGBUS_USPTP_4"/>
+	<value value="335" name="A7XX_DBGBUS_USPTP_5"/>
+	<value value="336" name="A7XX_DBGBUS_USPTP_6"/>
+	<value value="337" name="A7XX_DBGBUS_USPTP_7"/>
+	<value value="338" name="A7XX_DBGBUS_USPTP_8"/>
+	<value value="339" name="A7XX_DBGBUS_USPTP_9"/>
+	<value value="340" name="A7XX_DBGBUS_USPTP_10"/>
+	<value value="341" name="A7XX_DBGBUS_USPTP_11"/>
+	<value value="396" name="A7XX_DBGBUS_CCHE_0"/>
+	<value value="397" name="A7XX_DBGBUS_CCHE_1"/>
+	<value value="398" name="A7XX_DBGBUS_CCHE_2"/>
+	<value value="408" name="A7XX_DBGBUS_VPC_DSTR_0"/>
+	<value value="409" name="A7XX_DBGBUS_VPC_DSTR_1"/>
+	<value value="410" name="A7XX_DBGBUS_VPC_DSTR_2"/>
+	<value value="411" name="A7XX_DBGBUS_HLSQ_DP_STR_0"/>
+	<value value="412" name="A7XX_DBGBUS_HLSQ_DP_STR_1"/>
+	<value value="413" name="A7XX_DBGBUS_HLSQ_DP_STR_2"/>
+	<value value="414" name="A7XX_DBGBUS_HLSQ_DP_STR_3"/>
+	<value value="415" name="A7XX_DBGBUS_HLSQ_DP_STR_4"/>
+	<value value="416" name="A7XX_DBGBUS_HLSQ_DP_STR_5"/>
+	<value value="443" name="A7XX_DBGBUS_UFC_DSTR_0"/>
+	<value value="444" name="A7XX_DBGBUS_UFC_DSTR_1"/>
+	<value value="445" name="A7XX_DBGBUS_UFC_DSTR_2"/>
+	<value value="446" name="A7XX_DBGBUS_CGC_SUBCORE"/>
+	<value value="447" name="A7XX_DBGBUS_CGC_CORE"/>
+</enum>
+
+<enum name="a6xx_cp_perfcounter_select">
+	<value value="0" name="PERF_CP_ALWAYS_COUNT"/>
+	<value value="1" name="PERF_CP_BUSY_GFX_CORE_IDLE"/>
+	<value value="2" name="PERF_CP_BUSY_CYCLES"/>
+	<value value="3" name="PERF_CP_NUM_PREEMPTIONS"/>
+	<value value="4" name="PERF_CP_PREEMPTION_REACTION_DELAY"/>
+	<value value="5" name="PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
+	<value value="6" name="PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
+	<value value="7" name="PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
+	<value value="8" name="PERF_CP_PREDICATED_DRAWS_KILLED"/>
+	<value value="9" name="PERF_CP_MODE_SWITCH"/>
+	<value value="10" name="PERF_CP_ZPASS_DONE"/>
+	<value value="11" name="PERF_CP_CONTEXT_DONE"/>
+	<value value="12" name="PERF_CP_CACHE_FLUSH"/>
+	<value value="13" name="PERF_CP_LONG_PREEMPTIONS"/>
+	<value value="14" name="PERF_CP_SQE_I_CACHE_STARVE"/>
+	<value value="15" name="PERF_CP_SQE_IDLE"/>
+	<value value="16" name="PERF_CP_SQE_PM4_STARVE_RB_IB"/>
+	<value value="17" name="PERF_CP_SQE_PM4_STARVE_SDS"/>
+	<value value="18" name="PERF_CP_SQE_MRB_STARVE"/>
+	<value value="19" name="PERF_CP_SQE_RRB_STARVE"/>
+	<value value="20" name="PERF_CP_SQE_VSD_STARVE"/>
+	<value value="21" name="PERF_CP_VSD_DECODE_STARVE"/>
+	<value value="22" name="PERF_CP_SQE_PIPE_OUT_STALL"/>
+	<value value="23" name="PERF_CP_SQE_SYNC_STALL"/>
+	<value value="24" name="PERF_CP_SQE_PM4_WFI_STALL"/>
+	<value value="25" name="PERF_CP_SQE_SYS_WFI_STALL"/>
+	<value value="26" name="PERF_CP_SQE_T4_EXEC"/>
+	<value value="27" name="PERF_CP_SQE_LOAD_STATE_EXEC"/>
+	<value value="28" name="PERF_CP_SQE_SAVE_SDS_STATE"/>
+	<value value="29" name="PERF_CP_SQE_DRAW_EXEC"/>
+	<value value="30" name="PERF_CP_SQE_CTXT_REG_BUNCH_EXEC"/>
+	<value value="31" name="PERF_CP_SQE_EXEC_PROFILED"/>
+	<value value="32" name="PERF_CP_MEMORY_POOL_EMPTY"/>
+	<value value="33" name="PERF_CP_MEMORY_POOL_SYNC_STALL"/>
+	<value value="34" name="PERF_CP_MEMORY_POOL_ABOVE_THRESH"/>
+	<value value="35" name="PERF_CP_AHB_WR_STALL_PRE_DRAWS"/>
+	<value value="36" name="PERF_CP_AHB_STALL_SQE_GMU"/>
+	<value value="37" name="PERF_CP_AHB_STALL_SQE_WR_OTHER"/>
+	<value value="38" name="PERF_CP_AHB_STALL_SQE_RD_OTHER"/>
+	<value value="39" name="PERF_CP_CLUSTER0_EMPTY"/>
+	<value value="40" name="PERF_CP_CLUSTER1_EMPTY"/>
+	<value value="41" name="PERF_CP_CLUSTER2_EMPTY"/>
+	<value value="42" name="PERF_CP_CLUSTER3_EMPTY"/>
+	<value value="43" name="PERF_CP_CLUSTER4_EMPTY"/>
+	<value value="44" name="PERF_CP_CLUSTER5_EMPTY"/>
+	<value value="45" name="PERF_CP_PM4_DATA"/>
+	<value value="46" name="PERF_CP_PM4_HEADERS"/>
+	<value value="47" name="PERF_CP_VBIF_READ_BEATS"/>
+	<value value="48" name="PERF_CP_VBIF_WRITE_BEATS"/>
+	<value value="49" name="PERF_CP_SQE_INSTR_COUNTER"/>
+</enum>
+
+<enum name="a6xx_rbbm_perfcounter_select">
+	<value value="0" name="PERF_RBBM_ALWAYS_COUNT"/>
+	<value value="1" name="PERF_RBBM_ALWAYS_ON"/>
+	<value value="2" name="PERF_RBBM_TSE_BUSY"/>
+	<value value="3" name="PERF_RBBM_RAS_BUSY"/>
+	<value value="4" name="PERF_RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="PERF_RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="PERF_RBBM_STATUS_MASKED"/>
+	<value value="7" name="PERF_RBBM_COM_BUSY"/>
+	<value value="8" name="PERF_RBBM_DCOM_BUSY"/>
+	<value value="9" name="PERF_RBBM_VBIF_BUSY"/>
+	<value value="10" name="PERF_RBBM_VSC_BUSY"/>
+	<value value="11" name="PERF_RBBM_TESS_BUSY"/>
+	<value value="12" name="PERF_RBBM_UCHE_BUSY"/>
+	<value value="13" name="PERF_RBBM_HLSQ_BUSY"/>
+</enum>
+
+<enum name="a6xx_pc_perfcounter_select">
+	<value value="0" name="PERF_PC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_PC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_PC_STALL_CYCLES_VFD"/>
+	<value value="3" name="PERF_PC_STALL_CYCLES_TSE"/>
+	<value value="4" name="PERF_PC_STALL_CYCLES_VPC"/>
+	<value value="5" name="PERF_PC_STALL_CYCLES_UCHE"/>
+	<value value="6" name="PERF_PC_STALL_CYCLES_TESS"/>
+	<value value="7" name="PERF_PC_STALL_CYCLES_TSE_ONLY"/>
+	<value value="8" name="PERF_PC_STALL_CYCLES_VPC_ONLY"/>
+	<value value="9" name="PERF_PC_PASS1_TF_STALL_CYCLES"/>
+	<value value="10" name="PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
+	<value value="11" name="PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+	<value value="12" name="PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+	<value value="13" name="PERF_PC_STARVE_CYCLES_FOR_POSITION"/>
+	<value value="14" name="PERF_PC_STARVE_CYCLES_DI"/>
+	<value value="15" name="PERF_PC_VIS_STREAMS_LOADED"/>
+	<value value="16" name="PERF_PC_INSTANCES"/>
+	<value value="17" name="PERF_PC_VPC_PRIMITIVES"/>
+	<value value="18" name="PERF_PC_DEAD_PRIM"/>
+	<value value="19" name="PERF_PC_LIVE_PRIM"/>
+	<value value="20" name="PERF_PC_VERTEX_HITS"/>
+	<value value="21" name="PERF_PC_IA_VERTICES"/>
+	<value value="22" name="PERF_PC_IA_PRIMITIVES"/>
+	<value value="23" name="PERF_PC_GS_PRIMITIVES"/>
+	<value value="24" name="PERF_PC_HS_INVOCATIONS"/>
+	<value value="25" name="PERF_PC_DS_INVOCATIONS"/>
+	<value value="26" name="PERF_PC_VS_INVOCATIONS"/>
+	<value value="27" name="PERF_PC_GS_INVOCATIONS"/>
+	<value value="28" name="PERF_PC_DS_PRIMITIVES"/>
+	<value value="29" name="PERF_PC_VPC_POS_DATA_TRANSACTION"/>
+	<value value="30" name="PERF_PC_3D_DRAWCALLS"/>
+	<value value="31" name="PERF_PC_2D_DRAWCALLS"/>
+	<value value="32" name="PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
+	<value value="33" name="PERF_TESS_BUSY_CYCLES"/>
+	<value value="34" name="PERF_TESS_WORKING_CYCLES"/>
+	<value value="35" name="PERF_TESS_STALL_CYCLES_PC"/>
+	<value value="36" name="PERF_TESS_STARVE_CYCLES_PC"/>
+	<value value="37" name="PERF_PC_TSE_TRANSACTION"/>
+	<value value="38" name="PERF_PC_TSE_VERTEX"/>
+	<value value="39" name="PERF_PC_TESS_PC_UV_TRANS"/>
+	<value value="40" name="PERF_PC_TESS_PC_UV_PATCHES"/>
+	<value value="41" name="PERF_PC_TESS_FACTOR_TRANS"/>
+</enum>
+
+<enum name="a6xx_vfd_perfcounter_select">
+	<value value="0" name="PERF_VFD_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VFD_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
+	<value value="3" name="PERF_VFD_STALL_CYCLES_SP_INFO"/>
+	<value value="4" name="PERF_VFD_STALL_CYCLES_SP_ATTR"/>
+	<value value="5" name="PERF_VFD_STARVE_CYCLES_UCHE"/>
+	<value value="6" name="PERF_VFD_RBUFFER_FULL"/>
+	<value value="7" name="PERF_VFD_ATTR_INFO_FIFO_FULL"/>
+	<value value="8" name="PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
+	<value value="9" name="PERF_VFD_NUM_ATTRIBUTES"/>
+	<value value="10" name="PERF_VFD_UPPER_SHADER_FIBERS"/>
+	<value value="11" name="PERF_VFD_LOWER_SHADER_FIBERS"/>
+	<value value="12" name="PERF_VFD_MODE_0_FIBERS"/>
+	<value value="13" name="PERF_VFD_MODE_1_FIBERS"/>
+	<value value="14" name="PERF_VFD_MODE_2_FIBERS"/>
+	<value value="15" name="PERF_VFD_MODE_3_FIBERS"/>
+	<value value="16" name="PERF_VFD_MODE_4_FIBERS"/>
+	<value value="17" name="PERF_VFD_TOTAL_VERTICES"/>
+	<value value="18" name="PERF_VFDP_STALL_CYCLES_VFD"/>
+	<value value="19" name="PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
+	<value value="20" name="PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
+	<value value="21" name="PERF_VFDP_STARVE_CYCLES_PC"/>
+	<value value="22" name="PERF_VFDP_VS_STAGE_WAVES"/>
+</enum>
+
+<enum name="a6xx_hlsq_perfcounter_select">
+	<value value="0" name="PERF_HLSQ_BUSY_CYCLES"/>
+	<value value="1" name="PERF_HLSQ_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
+	<value value="3" name="PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+	<value value="4" name="PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
+	<value value="5" name="PERF_HLSQ_UCHE_LATENCY_COUNT"/>
+	<value value="6" name="PERF_HLSQ_FS_STAGE_1X_WAVES"/>
+	<value value="7" name="PERF_HLSQ_FS_STAGE_2X_WAVES"/>
+	<value value="8" name="PERF_HLSQ_QUADS"/>
+	<value value="9" name="PERF_HLSQ_CS_INVOCATIONS"/>
+	<value value="10" name="PERF_HLSQ_COMPUTE_DRAWCALLS"/>
+	<value value="11" name="PERF_HLSQ_FS_DATA_WAIT_PROGRAMMING"/>
+	<value value="12" name="PERF_HLSQ_DUAL_FS_PROG_ACTIVE"/>
+	<value value="13" name="PERF_HLSQ_DUAL_VS_PROG_ACTIVE"/>
+	<value value="14" name="PERF_HLSQ_FS_BATCH_COUNT_ZERO"/>
+	<value value="15" name="PERF_HLSQ_VS_BATCH_COUNT_ZERO"/>
+	<value value="16" name="PERF_HLSQ_WAVE_PENDING_NO_QUAD"/>
+	<value value="17" name="PERF_HLSQ_WAVE_PENDING_NO_PRIM_BASE"/>
+	<value value="18" name="PERF_HLSQ_STALL_CYCLES_VPC"/>
+	<value value="19" name="PERF_HLSQ_PIXELS"/>
+	<value value="20" name="PERF_HLSQ_DRAW_MODE_SWITCH_VSFS_SYNC"/>
+</enum>
+
+<enum name="a6xx_vpc_perfcounter_select">
+	<value value="0" name="PERF_VPC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VPC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_VPC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="PERF_VPC_STALL_CYCLES_VFD_WACK"/>
+	<value value="4" name="PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
+	<value value="5" name="PERF_VPC_STALL_CYCLES_PC"/>
+	<value value="6" name="PERF_VPC_STALL_CYCLES_SP_LM"/>
+	<value value="7" name="PERF_VPC_STARVE_CYCLES_SP"/>
+	<value value="8" name="PERF_VPC_STARVE_CYCLES_LRZ"/>
+	<value value="9" name="PERF_VPC_PC_PRIMITIVES"/>
+	<value value="10" name="PERF_VPC_SP_COMPONENTS"/>
+	<value value="11" name="PERF_VPC_STALL_CYCLES_VPCRAM_POS"/>
+	<value value="12" name="PERF_VPC_LRZ_ASSIGN_PRIMITIVES"/>
+	<value value="13" name="PERF_VPC_RB_VISIBLE_PRIMITIVES"/>
+	<value value="14" name="PERF_VPC_LM_TRANSACTION"/>
+	<value value="15" name="PERF_VPC_STREAMOUT_TRANSACTION"/>
+	<value value="16" name="PERF_VPC_VS_BUSY_CYCLES"/>
+	<value value="17" name="PERF_VPC_PS_BUSY_CYCLES"/>
+	<value value="18" name="PERF_VPC_VS_WORKING_CYCLES"/>
+	<value value="19" name="PERF_VPC_PS_WORKING_CYCLES"/>
+	<value value="20" name="PERF_VPC_STARVE_CYCLES_RB"/>
+	<value value="21" name="PERF_VPC_NUM_VPCRAM_READ_POS"/>
+	<value value="22" name="PERF_VPC_WIT_FULL_CYCLES"/>
+	<value value="23" name="PERF_VPC_VPCRAM_FULL_CYCLES"/>
+	<value value="24" name="PERF_VPC_LM_FULL_WAIT_FOR_INTP_END"/>
+	<value value="25" name="PERF_VPC_NUM_VPCRAM_WRITE"/>
+	<value value="26" name="PERF_VPC_NUM_VPCRAM_READ_SO"/>
+	<value value="27" name="PERF_VPC_NUM_ATTR_REQ_LM"/>
+</enum>
+
+<enum name="a6xx_tse_perfcounter_select">
+	<value value="0" name="PERF_TSE_BUSY_CYCLES"/>
+	<value value="1" name="PERF_TSE_CLIPPING_CYCLES"/>
+	<value value="2" name="PERF_TSE_STALL_CYCLES_RAS"/>
+	<value value="3" name="PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
+	<value value="4" name="PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
+	<value value="5" name="PERF_TSE_STARVE_CYCLES_PC"/>
+	<value value="6" name="PERF_TSE_INPUT_PRIM"/>
+	<value value="7" name="PERF_TSE_INPUT_NULL_PRIM"/>
+	<value value="8" name="PERF_TSE_TRIVAL_REJ_PRIM"/>
+	<value value="9" name="PERF_TSE_CLIPPED_PRIM"/>
+	<value value="10" name="PERF_TSE_ZERO_AREA_PRIM"/>
+	<value value="11" name="PERF_TSE_FACENESS_CULLED_PRIM"/>
+	<value value="12" name="PERF_TSE_ZERO_PIXEL_PRIM"/>
+	<value value="13" name="PERF_TSE_OUTPUT_NULL_PRIM"/>
+	<value value="14" name="PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
+	<value value="15" name="PERF_TSE_CINVOCATION"/>
+	<value value="16" name="PERF_TSE_CPRIMITIVES"/>
+	<value value="17" name="PERF_TSE_2D_INPUT_PRIM"/>
+	<value value="18" name="PERF_TSE_2D_ALIVE_CYCLES"/>
+	<value value="19" name="PERF_TSE_CLIP_PLANES"/>
+</enum>
+
+<enum name="a6xx_ras_perfcounter_select">
+	<value value="0" name="PERF_RAS_BUSY_CYCLES"/>
+	<value value="1" name="PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
+	<value value="2" name="PERF_RAS_STALL_CYCLES_LRZ"/>
+	<value value="3" name="PERF_RAS_STARVE_CYCLES_TSE"/>
+	<value value="4" name="PERF_RAS_SUPER_TILES"/>
+	<value value="5" name="PERF_RAS_8X4_TILES"/>
+	<value value="6" name="PERF_RAS_MASKGEN_ACTIVE"/>
+	<value value="7" name="PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
+	<value value="8" name="PERF_RAS_FULLY_COVERED_8X4_TILES"/>
+	<value value="9" name="PERF_RAS_PRIM_KILLED_INVISILBE"/>
+	<value value="10" name="PERF_RAS_SUPERTILE_GEN_ACTIVE_CYCLES"/>
+	<value value="11" name="PERF_RAS_LRZ_INTF_WORKING_CYCLES"/>
+	<value value="12" name="PERF_RAS_BLOCKS"/>
+</enum>
+
+<enum name="a6xx_uche_perfcounter_select">
+	<value value="0" name="PERF_UCHE_BUSY_CYCLES"/>
+	<value value="1" name="PERF_UCHE_STALL_CYCLES_ARBITER"/>
+	<value value="2" name="PERF_UCHE_VBIF_LATENCY_CYCLES"/>
+	<value value="3" name="PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
+	<value value="4" name="PERF_UCHE_VBIF_READ_BEATS_TP"/>
+	<value value="5" name="PERF_UCHE_VBIF_READ_BEATS_VFD"/>
+	<value value="6" name="PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
+	<value value="7" name="PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
+	<value value="8" name="PERF_UCHE_VBIF_READ_BEATS_SP"/>
+	<value value="9" name="PERF_UCHE_READ_REQUESTS_TP"/>
+	<value value="10" name="PERF_UCHE_READ_REQUESTS_VFD"/>
+	<value value="11" name="PERF_UCHE_READ_REQUESTS_HLSQ"/>
+	<value value="12" name="PERF_UCHE_READ_REQUESTS_LRZ"/>
+	<value value="13" name="PERF_UCHE_READ_REQUESTS_SP"/>
+	<value value="14" name="PERF_UCHE_WRITE_REQUESTS_LRZ"/>
+	<value value="15" name="PERF_UCHE_WRITE_REQUESTS_SP"/>
+	<value value="16" name="PERF_UCHE_WRITE_REQUESTS_VPC"/>
+	<value value="17" name="PERF_UCHE_WRITE_REQUESTS_VSC"/>
+	<value value="18" name="PERF_UCHE_EVICTS"/>
+	<value value="19" name="PERF_UCHE_BANK_REQ0"/>
+	<value value="20" name="PERF_UCHE_BANK_REQ1"/>
+	<value value="21" name="PERF_UCHE_BANK_REQ2"/>
+	<value value="22" name="PERF_UCHE_BANK_REQ3"/>
+	<value value="23" name="PERF_UCHE_BANK_REQ4"/>
+	<value value="24" name="PERF_UCHE_BANK_REQ5"/>
+	<value value="25" name="PERF_UCHE_BANK_REQ6"/>
+	<value value="26" name="PERF_UCHE_BANK_REQ7"/>
+	<value value="27" name="PERF_UCHE_VBIF_READ_BEATS_CH0"/>
+	<value value="28" name="PERF_UCHE_VBIF_READ_BEATS_CH1"/>
+	<value value="29" name="PERF_UCHE_GMEM_READ_BEATS"/>
+	<value value="30" name="PERF_UCHE_TPH_REF_FULL"/>
+	<value value="31" name="PERF_UCHE_TPH_VICTIM_FULL"/>
+	<value value="32" name="PERF_UCHE_TPH_EXT_FULL"/>
+	<value value="33" name="PERF_UCHE_VBIF_STALL_WRITE_DATA"/>
+	<value value="34" name="PERF_UCHE_DCMP_LATENCY_SAMPLES"/>
+	<value value="35" name="PERF_UCHE_DCMP_LATENCY_CYCLES"/>
+	<value value="36" name="PERF_UCHE_VBIF_READ_BEATS_PC"/>
+	<value value="37" name="PERF_UCHE_READ_REQUESTS_PC"/>
+	<value value="38" name="PERF_UCHE_RAM_READ_REQ"/>
+	<value value="39" name="PERF_UCHE_RAM_WRITE_REQ"/>
+</enum>
+
+<enum name="a6xx_tp_perfcounter_select">
+	<value value="0" name="PERF_TP_BUSY_CYCLES"/>
+	<value value="1" name="PERF_TP_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_TP_LATENCY_CYCLES"/>
+	<value value="3" name="PERF_TP_LATENCY_TRANS"/>
+	<value value="4" name="PERF_TP_FLAG_CACHE_REQUEST_SAMPLES"/>
+	<value value="5" name="PERF_TP_FLAG_CACHE_REQUEST_LATENCY"/>
+	<value value="6" name="PERF_TP_L1_CACHELINE_REQUESTS"/>
+	<value value="7" name="PERF_TP_L1_CACHELINE_MISSES"/>
+	<value value="8" name="PERF_TP_SP_TP_TRANS"/>
+	<value value="9" name="PERF_TP_TP_SP_TRANS"/>
+	<value value="10" name="PERF_TP_OUTPUT_PIXELS"/>
+	<value value="11" name="PERF_TP_FILTER_WORKLOAD_16BIT"/>
+	<value value="12" name="PERF_TP_FILTER_WORKLOAD_32BIT"/>
+	<value value="13" name="PERF_TP_QUADS_RECEIVED"/>
+	<value value="14" name="PERF_TP_QUADS_OFFSET"/>
+	<value value="15" name="PERF_TP_QUADS_SHADOW"/>
+	<value value="16" name="PERF_TP_QUADS_ARRAY"/>
+	<value value="17" name="PERF_TP_QUADS_GRADIENT"/>
+	<value value="18" name="PERF_TP_QUADS_1D"/>
+	<value value="19" name="PERF_TP_QUADS_2D"/>
+	<value value="20" name="PERF_TP_QUADS_BUFFER"/>
+	<value value="21" name="PERF_TP_QUADS_3D"/>
+	<value value="22" name="PERF_TP_QUADS_CUBE"/>
+	<value value="23" name="PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
+	<value value="24" name="PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
+	<value value="25" name="PERF_TP_OUTPUT_PIXELS_POINT"/>
+	<value value="26" name="PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="27" name="PERF_TP_OUTPUT_PIXELS_MIP"/>
+	<value value="28" name="PERF_TP_OUTPUT_PIXELS_ANISO"/>
+	<value value="29" name="PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
+	<value value="30" name="PERF_TP_FLAG_CACHE_REQUESTS"/>
+	<value value="31" name="PERF_TP_FLAG_CACHE_MISSES"/>
+	<value value="32" name="PERF_TP_L1_5_L2_REQUESTS"/>
+	<value value="33" name="PERF_TP_2D_OUTPUT_PIXELS"/>
+	<value value="34" name="PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
+	<value value="35" name="PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="36" name="PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
+	<value value="37" name="PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
+	<value value="38" name="PERF_TP_TPA2TPC_TRANS"/>
+	<value value="39" name="PERF_TP_L1_MISSES_ASTC_1TILE"/>
+	<value value="40" name="PERF_TP_L1_MISSES_ASTC_2TILE"/>
+	<value value="41" name="PERF_TP_L1_MISSES_ASTC_4TILE"/>
+	<value value="42" name="PERF_TP_L1_5_L2_COMPRESS_REQS"/>
+	<value value="43" name="PERF_TP_L1_5_L2_COMPRESS_MISS"/>
+	<value value="44" name="PERF_TP_L1_BANK_CONFLICT"/>
+	<value value="45" name="PERF_TP_L1_5_MISS_LATENCY_CYCLES"/>
+	<value value="46" name="PERF_TP_L1_5_MISS_LATENCY_TRANS"/>
+	<value value="47" name="PERF_TP_QUADS_CONSTANT_MULTIPLIED"/>
+	<value value="48" name="PERF_TP_FRONTEND_WORKING_CYCLES"/>
+	<value value="49" name="PERF_TP_L1_TAG_WORKING_CYCLES"/>
+	<value value="50" name="PERF_TP_L1_DATA_WRITE_WORKING_CYCLES"/>
+	<value value="51" name="PERF_TP_PRE_L1_DECOM_WORKING_CYCLES"/>
+	<value value="52" name="PERF_TP_BACKEND_WORKING_CYCLES"/>
+	<value value="53" name="PERF_TP_FLAG_CACHE_WORKING_CYCLES"/>
+	<value value="54" name="PERF_TP_L1_5_CACHE_WORKING_CYCLES"/>
+	<value value="55" name="PERF_TP_STARVE_CYCLES_SP"/>
+	<value value="56" name="PERF_TP_STARVE_CYCLES_UCHE"/>
+</enum>
+
+<enum name="a6xx_sp_perfcounter_select">
+	<value value="0" name="PERF_SP_BUSY_CYCLES"/>
+	<value value="1" name="PERF_SP_ALU_WORKING_CYCLES"/>
+	<value value="2" name="PERF_SP_EFU_WORKING_CYCLES"/>
+	<value value="3" name="PERF_SP_STALL_CYCLES_VPC"/>
+	<value value="4" name="PERF_SP_STALL_CYCLES_TP"/>
+	<value value="5" name="PERF_SP_STALL_CYCLES_UCHE"/>
+	<value value="6" name="PERF_SP_STALL_CYCLES_RB"/>
+	<value value="7" name="PERF_SP_NON_EXECUTION_CYCLES"/>
+	<value value="8" name="PERF_SP_WAVE_CONTEXTS"/>
+	<value value="9" name="PERF_SP_WAVE_CONTEXT_CYCLES"/>
+	<value value="10" name="PERF_SP_FS_STAGE_WAVE_CYCLES"/>
+	<value value="11" name="PERF_SP_FS_STAGE_WAVE_SAMPLES"/>
+	<value value="12" name="PERF_SP_VS_STAGE_WAVE_CYCLES"/>
+	<value value="13" name="PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
+	<value value="14" name="PERF_SP_FS_STAGE_DURATION_CYCLES"/>
+	<value value="15" name="PERF_SP_VS_STAGE_DURATION_CYCLES"/>
+	<value value="16" name="PERF_SP_WAVE_CTRL_CYCLES"/>
+	<value value="17" name="PERF_SP_WAVE_LOAD_CYCLES"/>
+	<value value="18" name="PERF_SP_WAVE_EMIT_CYCLES"/>
+	<value value="19" name="PERF_SP_WAVE_NOP_CYCLES"/>
+	<value value="20" name="PERF_SP_WAVE_WAIT_CYCLES"/>
+	<value value="21" name="PERF_SP_WAVE_FETCH_CYCLES"/>
+	<value value="22" name="PERF_SP_WAVE_IDLE_CYCLES"/>
+	<value value="23" name="PERF_SP_WAVE_END_CYCLES"/>
+	<value value="24" name="PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
+	<value value="25" name="PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
+	<value value="26" name="PERF_SP_WAVE_JOIN_CYCLES"/>
+	<value value="27" name="PERF_SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="28" name="PERF_SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="29" name="PERF_SP_LM_ATOMICS"/>
+	<value value="30" name="PERF_SP_GM_LOAD_INSTRUCTIONS"/>
+	<value value="31" name="PERF_SP_GM_STORE_INSTRUCTIONS"/>
+	<value value="32" name="PERF_SP_GM_ATOMICS"/>
+	<value value="33" name="PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="34" name="PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="35" name="PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="36" name="PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="37" name="PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="38" name="PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="39" name="PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="40" name="PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="41" name="PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="42" name="PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
+	<value value="43" name="PERF_SP_VS_INSTRUCTIONS"/>
+	<value value="44" name="PERF_SP_FS_INSTRUCTIONS"/>
+	<value value="45" name="PERF_SP_ADDR_LOCK_COUNT"/>
+	<value value="46" name="PERF_SP_UCHE_READ_TRANS"/>
+	<value value="47" name="PERF_SP_UCHE_WRITE_TRANS"/>
+	<value value="48" name="PERF_SP_EXPORT_VPC_TRANS"/>
+	<value value="49" name="PERF_SP_EXPORT_RB_TRANS"/>
+	<value value="50" name="PERF_SP_PIXELS_KILLED"/>
+	<value value="51" name="PERF_SP_ICL1_REQUESTS"/>
+	<value value="52" name="PERF_SP_ICL1_MISSES"/>
+	<value value="53" name="PERF_SP_HS_INSTRUCTIONS"/>
+	<value value="54" name="PERF_SP_DS_INSTRUCTIONS"/>
+	<value value="55" name="PERF_SP_GS_INSTRUCTIONS"/>
+	<value value="56" name="PERF_SP_CS_INSTRUCTIONS"/>
+	<value value="57" name="PERF_SP_GPR_READ"/>
+	<value value="58" name="PERF_SP_GPR_WRITE"/>
+	<value value="59" name="PERF_SP_FS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+	<value value="60" name="PERF_SP_VS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+	<value value="61" name="PERF_SP_LM_BANK_CONFLICTS"/>
+	<value value="62" name="PERF_SP_TEX_CONTROL_WORKING_CYCLES"/>
+	<value value="63" name="PERF_SP_LOAD_CONTROL_WORKING_CYCLES"/>
+	<value value="64" name="PERF_SP_FLOW_CONTROL_WORKING_CYCLES"/>
+	<value value="65" name="PERF_SP_LM_WORKING_CYCLES"/>
+	<value value="66" name="PERF_SP_DISPATCHER_WORKING_CYCLES"/>
+	<value value="67" name="PERF_SP_SEQUENCER_WORKING_CYCLES"/>
+	<value value="68" name="PERF_SP_LOW_EFFICIENCY_STARVED_BY_TP"/>
+	<value value="69" name="PERF_SP_STARVE_CYCLES_HLSQ"/>
+	<value value="70" name="PERF_SP_NON_EXECUTION_LS_CYCLES"/>
+	<value value="71" name="PERF_SP_WORKING_EU"/>
+	<value value="72" name="PERF_SP_ANY_EU_WORKING"/>
+	<value value="73" name="PERF_SP_WORKING_EU_FS_STAGE"/>
+	<value value="74" name="PERF_SP_ANY_EU_WORKING_FS_STAGE"/>
+	<value value="75" name="PERF_SP_WORKING_EU_VS_STAGE"/>
+	<value value="76" name="PERF_SP_ANY_EU_WORKING_VS_STAGE"/>
+	<value value="77" name="PERF_SP_WORKING_EU_CS_STAGE"/>
+	<value value="78" name="PERF_SP_ANY_EU_WORKING_CS_STAGE"/>
+	<value value="79" name="PERF_SP_GPR_READ_PREFETCH"/>
+	<value value="80" name="PERF_SP_GPR_READ_CONFLICT"/>
+	<value value="81" name="PERF_SP_GPR_WRITE_CONFLICT"/>
+	<value value="82" name="PERF_SP_GM_LOAD_LATENCY_CYCLES"/>
+	<value value="83" name="PERF_SP_GM_LOAD_LATENCY_SAMPLES"/>
+	<value value="84" name="PERF_SP_EXECUTABLE_WAVES"/>
+</enum>
+
+<enum name="a6xx_rb_perfcounter_select">
+	<value value="0" name="PERF_RB_BUSY_CYCLES"/>
+	<value value="1" name="PERF_RB_STALL_CYCLES_HLSQ"/>
+	<value value="2" name="PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
+	<value value="3" name="PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
+	<value value="4" name="PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
+	<value value="5" name="PERF_RB_STARVE_CYCLES_SP"/>
+	<value value="6" name="PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
+	<value value="7" name="PERF_RB_STARVE_CYCLES_CCU"/>
+	<value value="8" name="PERF_RB_STARVE_CYCLES_Z_PLANE"/>
+	<value value="9" name="PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
+	<value value="10" name="PERF_RB_Z_WORKLOAD"/>
+	<value value="11" name="PERF_RB_HLSQ_ACTIVE"/>
+	<value value="12" name="PERF_RB_Z_READ"/>
+	<value value="13" name="PERF_RB_Z_WRITE"/>
+	<value value="14" name="PERF_RB_C_READ"/>
+	<value value="15" name="PERF_RB_C_WRITE"/>
+	<value value="16" name="PERF_RB_TOTAL_PASS"/>
+	<value value="17" name="PERF_RB_Z_PASS"/>
+	<value value="18" name="PERF_RB_Z_FAIL"/>
+	<value value="19" name="PERF_RB_S_FAIL"/>
+	<value value="20" name="PERF_RB_BLENDED_FXP_COMPONENTS"/>
+	<value value="21" name="PERF_RB_BLENDED_FP16_COMPONENTS"/>
+	<value value="22" name="PERF_RB_PS_INVOCATIONS"/>
+	<value value="23" name="PERF_RB_2D_ALIVE_CYCLES"/>
+	<value value="24" name="PERF_RB_2D_STALL_CYCLES_A2D"/>
+	<value value="25" name="PERF_RB_2D_STARVE_CYCLES_SRC"/>
+	<value value="26" name="PERF_RB_2D_STARVE_CYCLES_SP"/>
+	<value value="27" name="PERF_RB_2D_STARVE_CYCLES_DST"/>
+	<value value="28" name="PERF_RB_2D_VALID_PIXELS"/>
+	<value value="29" name="PERF_RB_3D_PIXELS"/>
+	<value value="30" name="PERF_RB_BLENDER_WORKING_CYCLES"/>
+	<value value="31" name="PERF_RB_ZPROC_WORKING_CYCLES"/>
+	<value value="32" name="PERF_RB_CPROC_WORKING_CYCLES"/>
+	<value value="33" name="PERF_RB_SAMPLER_WORKING_CYCLES"/>
+	<value value="34" name="PERF_RB_STALL_CYCLES_CCU_COLOR_READ"/>
+	<value value="35" name="PERF_RB_STALL_CYCLES_CCU_COLOR_WRITE"/>
+	<value value="36" name="PERF_RB_STALL_CYCLES_CCU_DEPTH_READ"/>
+	<value value="37" name="PERF_RB_STALL_CYCLES_CCU_DEPTH_WRITE"/>
+	<value value="38" name="PERF_RB_STALL_CYCLES_VPC"/>
+	<value value="39" name="PERF_RB_2D_INPUT_TRANS"/>
+	<value value="40" name="PERF_RB_2D_OUTPUT_RB_DST_TRANS"/>
+	<value value="41" name="PERF_RB_2D_OUTPUT_RB_SRC_TRANS"/>
+	<value value="42" name="PERF_RB_BLENDED_FP32_COMPONENTS"/>
+	<value value="43" name="PERF_RB_COLOR_PIX_TILES"/>
+	<value value="44" name="PERF_RB_STALL_CYCLES_CCU"/>
+	<value value="45" name="PERF_RB_EARLY_Z_ARB3_GRANT"/>
+	<value value="46" name="PERF_RB_LATE_Z_ARB3_GRANT"/>
+	<value value="47" name="PERF_RB_EARLY_Z_SKIP_GRANT"/>
+</enum>
+
+<enum name="a6xx_vsc_perfcounter_select">
+	<value value="0" name="PERF_VSC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VSC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_VSC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="PERF_VSC_EOT_NUM"/>
+	<value value="4" name="PERF_VSC_INPUT_TILES"/>
+</enum>
+
+<enum name="a6xx_ccu_perfcounter_select">
+	<value value="0" name="PERF_CCU_BUSY_CYCLES"/>
+	<value value="1" name="PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
+	<value value="2" name="PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
+	<value value="3" name="PERF_CCU_STARVE_CYCLES_FLAG_RETURN"/>
+	<value value="4" name="PERF_CCU_DEPTH_BLOCKS"/>
+	<value value="5" name="PERF_CCU_COLOR_BLOCKS"/>
+	<value value="6" name="PERF_CCU_DEPTH_BLOCK_HIT"/>
+	<value value="7" name="PERF_CCU_COLOR_BLOCK_HIT"/>
+	<value value="8" name="PERF_CCU_PARTIAL_BLOCK_READ"/>
+	<value value="9" name="PERF_CCU_GMEM_READ"/>
+	<value value="10" name="PERF_CCU_GMEM_WRITE"/>
+	<value value="11" name="PERF_CCU_DEPTH_READ_FLAG0_COUNT"/>
+	<value value="12" name="PERF_CCU_DEPTH_READ_FLAG1_COUNT"/>
+	<value value="13" name="PERF_CCU_DEPTH_READ_FLAG2_COUNT"/>
+	<value value="14" name="PERF_CCU_DEPTH_READ_FLAG3_COUNT"/>
+	<value value="15" name="PERF_CCU_DEPTH_READ_FLAG4_COUNT"/>
+	<value value="16" name="PERF_CCU_DEPTH_READ_FLAG5_COUNT"/>
+	<value value="17" name="PERF_CCU_DEPTH_READ_FLAG6_COUNT"/>
+	<value value="18" name="PERF_CCU_DEPTH_READ_FLAG8_COUNT"/>
+	<value value="19" name="PERF_CCU_COLOR_READ_FLAG0_COUNT"/>
+	<value value="20" name="PERF_CCU_COLOR_READ_FLAG1_COUNT"/>
+	<value value="21" name="PERF_CCU_COLOR_READ_FLAG2_COUNT"/>
+	<value value="22" name="PERF_CCU_COLOR_READ_FLAG3_COUNT"/>
+	<value value="23" name="PERF_CCU_COLOR_READ_FLAG4_COUNT"/>
+	<value value="24" name="PERF_CCU_COLOR_READ_FLAG5_COUNT"/>
+	<value value="25" name="PERF_CCU_COLOR_READ_FLAG6_COUNT"/>
+	<value value="26" name="PERF_CCU_COLOR_READ_FLAG8_COUNT"/>
+	<value value="27" name="PERF_CCU_2D_RD_REQ"/>
+	<value value="28" name="PERF_CCU_2D_WR_REQ"/>
+</enum>
+
+<enum name="a6xx_lrz_perfcounter_select">
+	<value value="0" name="PERF_LRZ_BUSY_CYCLES"/>
+	<value value="1" name="PERF_LRZ_STARVE_CYCLES_RAS"/>
+	<value value="2" name="PERF_LRZ_STALL_CYCLES_RB"/>
+	<value value="3" name="PERF_LRZ_STALL_CYCLES_VSC"/>
+	<value value="4" name="PERF_LRZ_STALL_CYCLES_VPC"/>
+	<value value="5" name="PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
+	<value value="6" name="PERF_LRZ_STALL_CYCLES_UCHE"/>
+	<value value="7" name="PERF_LRZ_LRZ_READ"/>
+	<value value="8" name="PERF_LRZ_LRZ_WRITE"/>
+	<value value="9" name="PERF_LRZ_READ_LATENCY"/>
+	<value value="10" name="PERF_LRZ_MERGE_CACHE_UPDATING"/>
+	<value value="11" name="PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
+	<value value="12" name="PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
+	<value value="13" name="PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
+	<value value="14" name="PERF_LRZ_FULL_8X8_TILES"/>
+	<value value="15" name="PERF_LRZ_PARTIAL_8X8_TILES"/>
+	<value value="16" name="PERF_LRZ_TILE_KILLED"/>
+	<value value="17" name="PERF_LRZ_TOTAL_PIXEL"/>
+	<value value="18" name="PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
+	<value value="19" name="PERF_LRZ_FULLY_COVERED_TILES"/>
+	<value value="20" name="PERF_LRZ_PARTIAL_COVERED_TILES"/>
+	<value value="21" name="PERF_LRZ_FEEDBACK_ACCEPT"/>
+	<value value="22" name="PERF_LRZ_FEEDBACK_DISCARD"/>
+	<value value="23" name="PERF_LRZ_FEEDBACK_STALL"/>
+	<value value="24" name="PERF_LRZ_STALL_CYCLES_RB_ZPLANE"/>
+	<value value="25" name="PERF_LRZ_STALL_CYCLES_RB_BPLANE"/>
+	<value value="26" name="PERF_LRZ_STALL_CYCLES_VC"/>
+	<value value="27" name="PERF_LRZ_RAS_MASK_TRANS"/>
+</enum>
+
+<enum name="a6xx_cmp_perfcounter_select">
+	<value value="0" name="PERF_CMPDECMP_STALL_CYCLES_ARB"/>
+	<value value="1" name="PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
+	<value value="2" name="PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
+	<value value="3" name="PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
+	<value value="4" name="PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
+	<value value="5" name="PERF_CMPDECMP_VBIF_READ_REQUEST"/>
+	<value value="6" name="PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
+	<value value="7" name="PERF_CMPDECMP_VBIF_READ_DATA"/>
+	<value value="8" name="PERF_CMPDECMP_VBIF_WRITE_DATA"/>
+	<value value="9" name="PERF_CMPDECMP_FLAG_FETCH_CYCLES"/>
+	<value value="10" name="PERF_CMPDECMP_FLAG_FETCH_SAMPLES"/>
+	<value value="11" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
+	<value value="12" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
+	<value value="13" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
+	<value value="14" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
+	<value value="15" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG5_COUNT"/>
+	<value value="16" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG6_COUNT"/>
+	<value value="17" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG8_COUNT"/>
+	<value value="18" name="PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
+	<value value="19" name="PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
+	<value value="20" name="PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
+	<value value="21" name="PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
+	<value value="22" name="PERF_CMPDECMP_COLOR_WRITE_FLAG5_COUNT"/>
+	<value value="23" name="PERF_CMPDECMP_COLOR_WRITE_FLAG6_COUNT"/>
+	<value value="24" name="PERF_CMPDECMP_COLOR_WRITE_FLAG8_COUNT"/>
+	<value value="25" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_REQ"/>
+	<value value="26" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_WR"/>
+	<value value="27" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_RETURN"/>
+	<value value="28" name="PERF_CMPDECMP_2D_RD_DATA"/>
+	<value value="29" name="PERF_CMPDECMP_2D_WR_DATA"/>
+	<value value="30" name="PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH0"/>
+	<value value="31" name="PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH1"/>
+	<value value="32" name="PERF_CMPDECMP_2D_OUTPUT_TRANS"/>
+	<value value="33" name="PERF_CMPDECMP_VBIF_WRITE_DATA_UCHE"/>
+	<value value="34" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG0_COUNT"/>
+	<value value="35" name="PERF_CMPDECMP_COLOR_WRITE_FLAG0_COUNT"/>
+	<value value="36" name="PERF_CMPDECMP_COLOR_WRITE_FLAGALPHA_COUNT"/>
+	<value value="37" name="PERF_CMPDECMP_2D_BUSY_CYCLES"/>
+	<value value="38" name="PERF_CMPDECMP_2D_REORDER_STARVE_CYCLES"/>
+	<value value="39" name="PERF_CMPDECMP_2D_PIXELS"/>
+</enum>
+
+<!--
+Used in a6xx_2d_blit_cntl.. the value mostly seems to correlate to the
+component type/size, so I think it relates to internal format used for
+blending?  The one exception is that 16b unorm and 32b float use the
+same value... maybe 16b unorm is uncommon enough that it was just easier
+to upconvert to 32b float internally?
+
+ 8b unorm:  10 (sometimes 0, is the high bit part of something else?)
+16b unorm:   4
+
+32b int:     7
+16b int:     6
+ 8b int:     5
+
+32b float:   4
+16b float:   3
+ -->
+<enum name="a6xx_2d_ifmt">
+	<value value="0x10" name="R2D_UNORM8"/>
+	<value value="0x7"  name="R2D_INT32"/>
+	<value value="0x6"  name="R2D_INT16"/>
+	<value value="0x5"  name="R2D_INT8"/>
+	<value value="0x4"  name="R2D_FLOAT32"/>
+	<value value="0x3"  name="R2D_FLOAT16"/>
+	<value value="0x1"  name="R2D_UNORM8_SRGB"/>
+	<value value="0x0"  name="R2D_RAW"/>
+</enum>
+
+<enum name="a6xx_ztest_mode">
+	<doc>Allow early z-test and early-lrz (if applicable)</doc>
+	<value value="0x0" name="A6XX_EARLY_Z"/>
+	<doc>Disable early z-test and early-lrz test (if applicable)</doc>
+	<value value="0x1" name="A6XX_LATE_Z"/>
+	<doc>
+		A special mode that allows early-lrz test but disables
+		early-z test.  Which might sound a bit funny, since
+		lrz-test happens before z-test.  But as long as a couple
+		conditions are maintained this allows using lrz-test in
+		cases where fragment shader has kill/discard:
+
+		1) Disable lrz-write in cases where it is uncertain during
+		   binning pass that a fragment will pass.  Ie.  if frag
+		   shader has-kill, writes-z, or alpha/stencil test is
+		   enabled.  (For correctness, lrz-write must be disabled
+		   when blend is enabled.)  This is analogous to how a
+		   z-prepass works.
+
+		2) Disable lrz-write and test if a depth-test direction
+		   reversal is detected.  Due to condition (1), the contents
+		   of the lrz buffer are a conservative estimation of the
+		   depth buffer during the draw pass.  Meaning that geometry
+		   that we know for certain will not be visible will not pass
+		   lrz-test.  But geometry which may be (or contributes to
+		   blend) will pass the lrz-test.
+
+		This allows us to keep early-lrz-test in cases where the frag
+		shader does not write-z (ie. we know the z-value before FS)
+		and does not have side-effects (image/ssbo writes, etc), but
+		does have kill/discard.  Which turns out to be a common
+		enough case that it is useful to keep early-lrz test against
+		the conservative lrz buffer to discard fragments that we
+		know will definitely not be visible.
+	</doc>
+	<value value="0x2" name="A6XX_EARLY_LRZ_LATE_Z"/>
+	<doc>Not a real hw value, used internally by mesa</doc>
+	<value value="0x3" name="A6XX_INVALID_ZTEST"/>
+</enum>
+
+<enum name="a6xx_tess_spacing">
+	<value value="0x0" name="TESS_EQUAL"/>
+	<value value="0x2" name="TESS_FRACTIONAL_ODD"/>
+	<value value="0x3" name="TESS_FRACTIONAL_EVEN"/>
+</enum>
+<enum name="a6xx_tess_output">
+	<value value="0x0" name="TESS_POINTS"/>
+	<value value="0x1" name="TESS_LINES"/>
+	<value value="0x2" name="TESS_CW_TRIS"/>
+	<value value="0x3" name="TESS_CCW_TRIS"/>
+</enum>
+
+<enum name="a7xx_cp_perfcounter_select">
+	<value value="0" name="A7XX_PERF_CP_ALWAYS_COUNT"/>
+	<value value="1" name="A7XX_PERF_CP_BUSY_GFX_CORE_IDLE"/>
+	<value value="2" name="A7XX_PERF_CP_BUSY_CYCLES"/>
+	<value value="3" name="A7XX_PERF_CP_NUM_PREEMPTIONS"/>
+	<value value="4" name="A7XX_PERF_CP_PREEMPTION_REACTION_DELAY"/>
+	<value value="5" name="A7XX_PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
+	<value value="6" name="A7XX_PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
+	<value value="7" name="A7XX_PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
+	<value value="8" name="A7XX_PERF_CP_PREDICATED_DRAWS_KILLED"/>
+	<value value="9" name="A7XX_PERF_CP_MODE_SWITCH"/>
+	<value value="10" name="A7XX_PERF_CP_ZPASS_DONE"/>
+	<value value="11" name="A7XX_PERF_CP_CONTEXT_DONE"/>
+	<value value="12" name="A7XX_PERF_CP_CACHE_FLUSH"/>
+	<value value="13" name="A7XX_PERF_CP_LONG_PREEMPTIONS"/>
+	<value value="14" name="A7XX_PERF_CP_SQE_I_CACHE_STARVE"/>
+	<value value="15" name="A7XX_PERF_CP_SQE_IDLE"/>
+	<value value="16" name="A7XX_PERF_CP_SQE_PM4_STARVE_RB_IB"/>
+	<value value="17" name="A7XX_PERF_CP_SQE_PM4_STARVE_SDS"/>
+	<value value="18" name="A7XX_PERF_CP_SQE_MRB_STARVE"/>
+	<value value="19" name="A7XX_PERF_CP_SQE_RRB_STARVE"/>
+	<value value="20" name="A7XX_PERF_CP_SQE_VSD_STARVE"/>
+	<value value="21" name="A7XX_PERF_CP_VSD_DECODE_STARVE"/>
+	<value value="22" name="A7XX_PERF_CP_SQE_PIPE_OUT_STALL"/>
+	<value value="23" name="A7XX_PERF_CP_SQE_SYNC_STALL"/>
+	<value value="24" name="A7XX_PERF_CP_SQE_PM4_WFI_STALL"/>
+	<value value="25" name="A7XX_PERF_CP_SQE_SYS_WFI_STALL"/>
+	<value value="26" name="A7XX_PERF_CP_SQE_T4_EXEC"/>
+	<value value="27" name="A7XX_PERF_CP_SQE_LOAD_STATE_EXEC"/>
+	<value value="28" name="A7XX_PERF_CP_SQE_SAVE_SDS_STATE"/>
+	<value value="29" name="A7XX_PERF_CP_SQE_DRAW_EXEC"/>
+	<value value="30" name="A7XX_PERF_CP_SQE_CTXT_REG_BUNCH_EXEC"/>
+	<value value="31" name="A7XX_PERF_CP_SQE_EXEC_PROFILED"/>
+	<value value="32" name="A7XX_PERF_CP_MEMORY_POOL_EMPTY"/>
+	<value value="33" name="A7XX_PERF_CP_MEMORY_POOL_SYNC_STALL"/>
+	<value value="34" name="A7XX_PERF_CP_MEMORY_POOL_ABOVE_THRESH"/>
+	<value value="35" name="A7XX_PERF_CP_AHB_WR_STALL_PRE_DRAWS"/>
+	<value value="36" name="A7XX_PERF_CP_AHB_STALL_SQE_GMU"/>
+	<value value="37" name="A7XX_PERF_CP_AHB_STALL_SQE_WR_OTHER"/>
+	<value value="38" name="A7XX_PERF_CP_AHB_STALL_SQE_RD_OTHER"/>
+	<value value="39" name="A7XX_PERF_CP_CLUSTER0_EMPTY"/>
+	<value value="40" name="A7XX_PERF_CP_CLUSTER1_EMPTY"/>
+	<value value="41" name="A7XX_PERF_CP_CLUSTER2_EMPTY"/>
+	<value value="42" name="A7XX_PERF_CP_CLUSTER3_EMPTY"/>
+	<value value="43" name="A7XX_PERF_CP_CLUSTER4_EMPTY"/>
+	<value value="44" name="A7XX_PERF_CP_CLUSTER5_EMPTY"/>
+	<value value="45" name="A7XX_PERF_CP_PM4_DATA"/>
+	<value value="46" name="A7XX_PERF_CP_PM4_HEADERS"/>
+	<value value="47" name="A7XX_PERF_CP_VBIF_READ_BEATS"/>
+	<value value="48" name="A7XX_PERF_CP_VBIF_WRITE_BEATS"/>
+	<value value="49" name="A7XX_PERF_CP_SQE_INSTR_COUNTER"/>
+	<value value="50" name="A7XX_PERF_CP_RESERVED_50"/>
+	<value value="51" name="A7XX_PERF_CP_RESERVED_51"/>
+	<value value="52" name="A7XX_PERF_CP_RESERVED_52"/>
+	<value value="53" name="A7XX_PERF_CP_RESERVED_53"/>
+	<value value="54" name="A7XX_PERF_CP_RESERVED_54"/>
+	<value value="55" name="A7XX_PERF_CP_RESERVED_55"/>
+	<value value="56" name="A7XX_PERF_CP_RESERVED_56"/>
+	<value value="57" name="A7XX_PERF_CP_RESERVED_57"/>
+	<value value="58" name="A7XX_PERF_CP_RESERVED_58"/>
+	<value value="59" name="A7XX_PERF_CP_RESERVED_59"/>
+	<value value="60" name="A7XX_PERF_CP_CLUSTER0_FULL"/>
+	<value value="61" name="A7XX_PERF_CP_CLUSTER1_FULL"/>
+	<value value="62" name="A7XX_PERF_CP_CLUSTER2_FULL"/>
+	<value value="63" name="A7XX_PERF_CP_CLUSTER3_FULL"/>
+	<value value="64" name="A7XX_PERF_CP_CLUSTER4_FULL"/>
+	<value value="65" name="A7XX_PERF_CP_CLUSTER5_FULL"/>
+	<value value="66" name="A7XX_PERF_CP_CLUSTER6_FULL"/>
+	<value value="67" name="A7XX_PERF_CP_CLUSTER6_EMPTY"/>
+	<value value="68" name="A7XX_PERF_CP_ICACHE_MISSES"/>
+	<value value="69" name="A7XX_PERF_CP_ICACHE_HITS"/>
+	<value value="70" name="A7XX_PERF_CP_ICACHE_STALL"/>
+	<value value="71" name="A7XX_PERF_CP_DCACHE_MISSES"/>
+	<value value="72" name="A7XX_PERF_CP_DCACHE_HITS"/>
+	<value value="73" name="A7XX_PERF_CP_DCACHE_STALLS"/>
+	<value value="74" name="A7XX_PERF_CP_AQE_SQE_STALL"/>
+	<value value="75" name="A7XX_PERF_CP_SQE_AQE_STARVE"/>
+	<value value="76" name="A7XX_PERF_CP_PREEMPT_LATENCY"/>
+	<value value="77" name="A7XX_PERF_CP_SQE_MD8_STALL_CYCLES"/>
+	<value value="78" name="A7XX_PERF_CP_SQE_MESH_EXEC_CYCLES"/>
+	<value value="79" name="A7XX_PERF_CP_AQE_NUM_AS_CHUNKS"/>
+	<value value="80" name="A7XX_PERF_CP_AQE_NUM_MS_CHUNKS"/>
+</enum>
+
+<enum name="a7xx_rbbm_perfcounter_select">
+	<value value="0" name="A7XX_PERF_RBBM_ALWAYS_COUNT"/>
+	<value value="1" name="A7XX_PERF_RBBM_ALWAYS_ON"/>
+	<value value="2" name="A7XX_PERF_RBBM_TSE_BUSY"/>
+	<value value="3" name="A7XX_PERF_RBBM_RAS_BUSY"/>
+	<value value="4" name="A7XX_PERF_RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="A7XX_PERF_RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="A7XX_PERF_RBBM_STATUS_MASKED"/>
+	<value value="7" name="A7XX_PERF_RBBM_COM_BUSY"/>
+	<value value="8" name="A7XX_PERF_RBBM_DCOM_BUSY"/>
+	<value value="9" name="A7XX_PERF_RBBM_VBIF_BUSY"/>
+	<value value="10" name="A7XX_PERF_RBBM_VSC_BUSY"/>
+	<value value="11" name="A7XX_PERF_RBBM_TESS_BUSY"/>
+	<value value="12" name="A7XX_PERF_RBBM_UCHE_BUSY"/>
+	<value value="13" name="A7XX_PERF_RBBM_HLSQ_BUSY"/>
+</enum>
+
+<enum name="a7xx_pc_perfcounter_select">
+	<value value="0" name="A7XX_PERF_PC_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_PC_WORKING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_PC_STALL_CYCLES_VFD"/>
+	<value value="3" name="A7XX_PERF_PC_RESERVED"/>
+	<value value="4" name="A7XX_PERF_PC_STALL_CYCLES_VPC"/>
+	<value value="5" name="A7XX_PERF_PC_STALL_CYCLES_UCHE"/>
+	<value value="6" name="A7XX_PERF_PC_STALL_CYCLES_TESS"/>
+	<value value="7" name="A7XX_PERF_PC_STALL_CYCLES_VFD_ONLY"/>
+	<value value="8" name="A7XX_PERF_PC_STALL_CYCLES_VPC_ONLY"/>
+	<value value="9" name="A7XX_PERF_PC_PASS1_TF_STALL_CYCLES"/>
+	<value value="10" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
+	<value value="11" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+	<value value="12" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+	<value value="13" name="A7XX_PERF_PC_STARVE_CYCLES_DI"/>
+	<value value="14" name="A7XX_PERF_PC_VIS_STREAMS_LOADED"/>
+	<value value="15" name="A7XX_PERF_PC_INSTANCES"/>
+	<value value="16" name="A7XX_PERF_PC_VPC_PRIMITIVES"/>
+	<value value="17" name="A7XX_PERF_PC_DEAD_PRIM"/>
+	<value value="18" name="A7XX_PERF_PC_LIVE_PRIM"/>
+	<value value="19" name="A7XX_PERF_PC_VERTEX_HITS"/>
+	<value value="20" name="A7XX_PERF_PC_IA_VERTICES"/>
+	<value value="21" name="A7XX_PERF_PC_IA_PRIMITIVES"/>
+	<value value="22" name="A7XX_PERF_PC_RESERVED_22"/>
+	<value value="23" name="A7XX_PERF_PC_HS_INVOCATIONS"/>
+	<value value="24" name="A7XX_PERF_PC_DS_INVOCATIONS"/>
+	<value value="25" name="A7XX_PERF_PC_VS_INVOCATIONS"/>
+	<value value="26" name="A7XX_PERF_PC_GS_INVOCATIONS"/>
+	<value value="27" name="A7XX_PERF_PC_DS_PRIMITIVES"/>
+	<value value="28" name="A7XX_PERF_PC_3D_DRAWCALLS"/>
+	<value value="29" name="A7XX_PERF_PC_2D_DRAWCALLS"/>
+	<value value="30" name="A7XX_PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
+	<value value="31" name="A7XX_PERF_PC_TESS_BUSY_CYCLES"/>
+	<value value="32" name="A7XX_PERF_PC_TESS_WORKING_CYCLES"/>
+	<value value="33" name="A7XX_PERF_PC_TESS_STALL_CYCLES_PC"/>
+	<value value="34" name="A7XX_PERF_PC_TESS_STARVE_CYCLES_PC"/>
+	<value value="35" name="A7XX_PERF_PC_TESS_SINGLE_PRIM_CYCLES"/>
+	<value value="36" name="A7XX_PERF_PC_TESS_PC_UV_TRANS"/>
+	<value value="37" name="A7XX_PERF_PC_TESS_PC_UV_PATCHES"/>
+	<value value="38" name="A7XX_PERF_PC_TESS_FACTOR_TRANS"/>
+	<value value="39" name="A7XX_PERF_PC_TAG_CHECKED_VERTICES"/>
+	<value value="40" name="A7XX_PERF_PC_MESH_VS_WAVES"/>
+	<value value="41" name="A7XX_PERF_PC_MESH_DRAWS"/>
+	<value value="42" name="A7XX_PERF_PC_MESH_DEAD_DRAWS"/>
+	<value value="43" name="A7XX_PERF_PC_MESH_MVIS_EN_DRAWS"/>
+	<value value="44" name="A7XX_PERF_PC_MESH_DEAD_PRIM"/>
+	<value value="45" name="A7XX_PERF_PC_MESH_LIVE_PRIM"/>
+	<value value="46" name="A7XX_PERF_PC_MESH_PA_EN_PRIM"/>
+	<value value="47" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_MVIS_STREAM"/>
+	<value value="48" name="A7XX_PERF_PC_STARVE_CYCLES_PREDRAW"/>
+	<value value="49" name="A7XX_PERF_PC_STALL_CYCLES_COMPUTE_GFX"/>
+	<value value="50" name="A7XX_PERF_PC_STALL_CYCLES_GFX_COMPUTE"/>
+	<value value="51" name="A7XX_PERF_PC_TESS_PC_MULTI_PATCH_TRANS"/>
+</enum>
+
+<enum name="a7xx_vfd_perfcounter_select">
+	<value value="0" name="A7XX_PERF_VFD_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_VFD_STALL_CYCLES_UCHE"/>
+	<value value="2" name="A7XX_PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
+	<value value="3" name="A7XX_PERF_VFD_STALL_CYCLES_SP_INFO"/>
+	<value value="4" name="A7XX_PERF_VFD_STALL_CYCLES_SP_ATTR"/>
+	<value value="5" name="A7XX_PERF_VFD_STARVE_CYCLES_UCHE"/>
+	<value value="6" name="A7XX_PERF_VFD_RBUFFER_FULL"/>
+	<value value="7" name="A7XX_PERF_VFD_ATTR_INFO_FIFO_FULL"/>
+	<value value="8" name="A7XX_PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
+	<value value="9" name="A7XX_PERF_VFD_NUM_ATTRIBUTES"/>
+	<value value="10" name="A7XX_PERF_VFD_UPPER_SHADER_FIBERS"/>
+	<value value="11" name="A7XX_PERF_VFD_LOWER_SHADER_FIBERS"/>
+	<value value="12" name="A7XX_PERF_VFD_MODE_0_FIBERS"/>
+	<value value="13" name="A7XX_PERF_VFD_MODE_1_FIBERS"/>
+	<value value="14" name="A7XX_PERF_VFD_MODE_2_FIBERS"/>
+	<value value="15" name="A7XX_PERF_VFD_MODE_3_FIBERS"/>
+	<value value="16" name="A7XX_PERF_VFD_MODE_4_FIBERS"/>
+	<value value="17" name="A7XX_PERF_VFD_TOTAL_VERTICES"/>
+	<value value="18" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD"/>
+	<value value="19" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
+	<value value="20" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
+	<value value="21" name="A7XX_PERF_VFDP_STARVE_CYCLES_PC"/>
+	<value value="22" name="A7XX_PERF_VFDP_VS_STAGE_WAVES"/>
+	<value value="23" name="A7XX_PERF_VFD_STALL_CYCLES_PRG_END_FE"/>
+	<value value="24" name="A7XX_PERF_VFD_STALL_CYCLES_CBSYNC"/>
+</enum>
+
+<enum name="a7xx_hlsq_perfcounter_select">
+	<value value="0" name="A7XX_PERF_HLSQ_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_HLSQ_STALL_CYCLES_UCHE"/>
+	<value value="2" name="A7XX_PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
+	<value value="3" name="A7XX_PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+	<value value="4" name="A7XX_PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
+	<value value="5" name="A7XX_PERF_HLSQ_UCHE_LATENCY_COUNT"/>
+	<value value="6" name="A7XX_PERF_HLSQ_RESERVED_6"/>
+	<value value="7" name="A7XX_PERF_HLSQ_RESERVED_7"/>
+	<value value="8" name="A7XX_PERF_HLSQ_RESERVED_8"/>
+	<value value="9" name="A7XX_PERF_HLSQ_RESERVED_9"/>
+	<value value="10" name="A7XX_PERF_HLSQ_COMPUTE_DRAWCALLS"/>
+	<value value="11" name="A7XX_PERF_HLSQ_FS_DATA_WAIT_PROGRAMMING"/>
+	<value value="12" name="A7XX_PERF_HLSQ_DUAL_FS_PROG_ACTIVE"/>
+	<value value="13" name="A7XX_PERF_HLSQ_DUAL_VS_PROG_ACTIVE"/>
+	<value value="14" name="A7XX_PERF_HLSQ_FS_BATCH_COUNT_ZERO"/>
+	<value value="15" name="A7XX_PERF_HLSQ_VS_BATCH_COUNT_ZERO"/>
+	<value value="16" name="A7XX_PERF_HLSQ_WAVE_PENDING_NO_QUAD"/>
+	<value value="17" name="A7XX_PERF_HLSQ_WAVE_PENDING_NO_PRIM_BASE"/>
+	<value value="18" name="A7XX_PERF_HLSQ_STALL_CYCLES_VPC"/>
+	<value value="19" name="A7XX_PERF_HLSQ_RESERVED_19"/>
+	<value value="20" name="A7XX_PERF_HLSQ_DRAW_MODE_SWITCH_VSFS_SYNC"/>
+	<value value="21" name="A7XX_PERF_HLSQ_VSBR_STALL_CYCLES"/>
+	<value value="22" name="A7XX_PERF_HLSQ_FS_STALL_CYCLES"/>
+	<value value="23" name="A7XX_PERF_HLSQ_LPAC_STALL_CYCLES"/>
+	<value value="24" name="A7XX_PERF_HLSQ_BV_STALL_CYCLES"/>
+	<value value="25" name="A7XX_PERF_HLSQ_VSBR_DEREF_CYCLES"/>
+	<value value="26" name="A7XX_PERF_HLSQ_FS_DEREF_CYCLES"/>
+	<value value="27" name="A7XX_PERF_HLSQ_LPAC_DEREF_CYCLES"/>
+	<value value="28" name="A7XX_PERF_HLSQ_BV_DEREF_CYCLES"/>
+	<value value="29" name="A7XX_PERF_HLSQ_VSBR_S2W_CYCLES"/>
+	<value value="30" name="A7XX_PERF_HLSQ_FS_S2W_CYCLES"/>
+	<value value="31" name="A7XX_PERF_HLSQ_LPAC_S2W_CYCLES"/>
+	<value value="32" name="A7XX_PERF_HLSQ_BV_S2W_CYCLES"/>
+	<value value="33" name="A7XX_PERF_HLSQ_VSBR_WAIT_FS_S2W"/>
+	<value value="34" name="A7XX_PERF_HLSQ_FS_WAIT_VS_S2W"/>
+	<value value="35" name="A7XX_PERF_HLSQ_LPAC_WAIT_VS_S2W"/>
+	<value value="36" name="A7XX_PERF_HLSQ_BV_WAIT_FS_S2W"/>
+	<value value="37" name="A7XX_PERF_HLSQ_VS_WAIT_CONST_RESOURCE"/>
+	<value value="38" name="A7XX_PERF_HLSQ_FS_WAIT_SAME_VS_S2W"/>
+	<value value="39" name="A7XX_PERF_HLSQ_FS_STARVING_SP"/>
+	<value value="40" name="A7XX_PERF_HLSQ_VS_DATA_WAIT_PROGRAMMING"/>
+	<value value="41" name="A7XX_PERF_HLSQ_BV_DATA_WAIT_PROGRAMMING"/>
+	<value value="42" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_VS"/>
+	<value value="43" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_VS"/>
+	<value value="44" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_FS"/>
+	<value value="45" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_FS"/>
+	<value value="46" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_BV"/>
+	<value value="47" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_BV"/>
+	<value value="48" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_LPAC"/>
+	<value value="49" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_LPAC"/>
+	<value value="50" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_VS"/>
+	<value value="51" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_FS"/>
+	<value value="52" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_BV"/>
+	<value value="53" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_LPAC"/>
+	<value value="54" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_VS"/>
+	<value value="55" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_FS"/>
+	<value value="56" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_BV"/>
+	<value value="57" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_LPAC"/>
+</enum>
+
+<enum name="a7xx_vpc_perfcounter_select">
+	<value value="0" name="A7XX_PERF_VPC_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_VPC_WORKING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_VPC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="A7XX_PERF_VPC_STALL_CYCLES_VFD_WACK"/>
+	<value value="4" name="A7XX_PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
+	<value value="5" name="A7XX_PERF_VPC_RESERVED_5"/>
+	<value value="6" name="A7XX_PERF_VPC_STALL_CYCLES_SP_LM"/>
+	<value value="7" name="A7XX_PERF_VPC_STARVE_CYCLES_SP"/>
+	<value value="8" name="A7XX_PERF_VPC_STARVE_CYCLES_LRZ"/>
+	<value value="9" name="A7XX_PERF_VPC_PC_PRIMITIVES"/>
+	<value value="10" name="A7XX_PERF_VPC_SP_COMPONENTS"/>
+	<value value="11" name="A7XX_PERF_VPC_STALL_CYCLES_VPCRAM_POS"/>
+	<value value="12" name="A7XX_PERF_VPC_LRZ_ASSIGN_PRIMITIVES"/>
+	<value value="13" name="A7XX_PERF_VPC_RB_VISIBLE_PRIMITIVES"/>
+	<value value="14" name="A7XX_PERF_VPC_LM_TRANSACTION"/>
+	<value value="15" name="A7XX_PERF_VPC_STREAMOUT_TRANSACTION"/>
+	<value value="16" name="A7XX_PERF_VPC_VS_BUSY_CYCLES"/>
+	<value value="17" name="A7XX_PERF_VPC_PS_BUSY_CYCLES"/>
+	<value value="18" name="A7XX_PERF_VPC_VS_WORKING_CYCLES"/>
+	<value value="19" name="A7XX_PERF_VPC_PS_WORKING_CYCLES"/>
+	<value value="20" name="A7XX_PERF_VPC_STARVE_CYCLES_RB"/>
+	<value value="21" name="A7XX_PERF_VPC_NUM_VPCRAM_READ_POS"/>
+	<value value="22" name="A7XX_PERF_VPC_WIT_FULL_CYCLES"/>
+	<value value="23" name="A7XX_PERF_VPC_VPCRAM_FULL_CYCLES"/>
+	<value value="24" name="A7XX_PERF_VPC_LM_FULL_WAIT_FOR_INTP_END"/>
+	<value value="25" name="A7XX_PERF_VPC_NUM_VPCRAM_WRITE"/>
+	<value value="26" name="A7XX_PERF_VPC_NUM_VPCRAM_READ_SO"/>
+	<value value="27" name="A7XX_PERF_VPC_NUM_ATTR_REQ_LM"/>
+	<value value="28" name="A7XX_PERF_VPC_STALL_CYCLE_TSE"/>
+	<value value="29" name="A7XX_PERF_VPC_TSE_PRIMITIVES"/>
+	<value value="30" name="A7XX_PERF_VPC_GS_PRIMITIVES"/>
+	<value value="31" name="A7XX_PERF_VPC_TSE_TRANSACTIONS"/>
+	<value value="32" name="A7XX_PERF_VPC_STALL_CYCLES_CCU"/>
+	<value value="33" name="A7XX_PERF_VPC_NUM_WM_HIT"/>
+	<value value="34" name="A7XX_PERF_VPC_STALL_DQ_WACK"/>
+	<value value="35" name="A7XX_PERF_VPC_STALL_CYCLES_CCHE"/>
+	<value value="36" name="A7XX_PERF_VPC_STARVE_CYCLES_CCHE"/>
+	<value value="37" name="A7XX_PERF_VPC_NUM_PA_REQ"/>
+	<value value="38" name="A7XX_PERF_VPC_NUM_LM_REQ_HIT"/>
+	<value value="39" name="A7XX_PERF_VPC_CCHE_REQBUF_FULL"/>
+	<value value="40" name="A7XX_PERF_VPC_STALL_CYCLES_LM_ACK"/>
+	<value value="41" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_FE"/>
+	<value value="42" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_PCVS"/>
+	<value value="43" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_VPCPS"/>
+</enum>
+
+<enum name="a7xx_tse_perfcounter_select">
+	<value value="0" name="A7XX_PERF_TSE_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_TSE_CLIPPING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_TSE_STALL_CYCLES_RAS"/>
+	<value value="3" name="A7XX_PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
+	<value value="4" name="A7XX_PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
+	<value value="5" name="A7XX_PERF_TSE_STARVE_CYCLES_PC"/>
+	<value value="6" name="A7XX_PERF_TSE_INPUT_PRIM"/>
+	<value value="7" name="A7XX_PERF_TSE_INPUT_NULL_PRIM"/>
+	<value value="8" name="A7XX_PERF_TSE_TRIVAL_REJ_PRIM"/>
+	<value value="9" name="A7XX_PERF_TSE_CLIPPED_PRIM"/>
+	<value value="10" name="A7XX_PERF_TSE_ZERO_AREA_PRIM"/>
+	<value value="11" name="A7XX_PERF_TSE_FACENESS_CULLED_PRIM"/>
+	<value value="12" name="A7XX_PERF_TSE_ZERO_PIXEL_PRIM"/>
+	<value value="13" name="A7XX_PERF_TSE_OUTPUT_NULL_PRIM"/>
+	<value value="14" name="A7XX_PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
+	<value value="15" name="A7XX_PERF_TSE_CINVOCATION"/>
+	<value value="16" name="A7XX_PERF_TSE_CPRIMITIVES"/>
+	<value value="17" name="A7XX_PERF_TSE_2D_INPUT_PRIM"/>
+	<value value="18" name="A7XX_PERF_TSE_2D_ALIVE_CYCLES"/>
+	<value value="19" name="A7XX_PERF_TSE_CLIP_PLANES"/>
+</enum>
+
+<enum name="a7xx_ras_perfcounter_select">
+	<value value="0" name="A7XX_PERF_RAS_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
+	<value value="2" name="A7XX_PERF_RAS_STALL_CYCLES_LRZ"/>
+	<value value="3" name="A7XX_PERF_RAS_STARVE_CYCLES_TSE"/>
+	<value value="4" name="A7XX_PERF_RAS_SUPER_TILES"/>
+	<value value="5" name="A7XX_PERF_RAS_8X4_TILES"/>
+	<value value="6" name="A7XX_PERF_RAS_MASKGEN_ACTIVE"/>
+	<value value="7" name="A7XX_PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
+	<value value="8" name="A7XX_PERF_RAS_FULLY_COVERED_8X4_TILES"/>
+	<value value="9" name="A7XX_PERF_RAS_PRIM_KILLED_INVISILBE"/>
+	<value value="10" name="A7XX_PERF_RAS_SUPERTILE_GEN_ACTIVE_CYCLES"/>
+	<value value="11" name="A7XX_PERF_RAS_LRZ_INTF_WORKING_CYCLES"/>
+	<value value="12" name="A7XX_PERF_RAS_BLOCKS"/>
+	<value value="13" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_0_WORKING_CC_l2"/>
+	<value value="14" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_1_WORKING_CC_l2"/>
+	<value value="15" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_2_WORKING_CC_l2"/>
+	<value value="16" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_3_WORKING_CC_l2"/>
+	<value value="17" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_4_WORKING_CC_l2"/>
+	<value value="18" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_5_WORKING_CC_l2"/>
+	<value value="19" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_6_WORKING_CC_l2"/>
+	<value value="20" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_7_WORKING_CC_l2"/>
+	<value value="21" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_8_WORKING_CC_l2"/>
+	<value value="22" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_9_WORKING_CC_l2"/>
+	<value value="23" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_10_WORKING_CC_l2"/>
+	<value value="24" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_11_WORKING_CC_l2"/>
+	<value value="25" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_12_WORKING_CC_l2"/>
+	<value value="26" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_13_WORKING_CC_l2"/>
+	<value value="27" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_14_WORKING_CC_l2"/>
+	<value value="28" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_15_WORKING_CC_l2"/>
+	<value value="29" name="A7XX_PERF_RAS_FALSE_PARTIAL_STILE"/>
+
+</enum>
+
+<enum name="a7xx_uche_perfcounter_select">
+	<value value="0" name="A7XX_PERF_UCHE_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_UCHE_STALL_CYCLES_ARBITER"/>
+	<value value="2" name="A7XX_PERF_UCHE_VBIF_LATENCY_CYCLES"/>
+	<value value="3" name="A7XX_PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
+	<value value="4" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_TP"/>
+	<value value="5" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_VFD"/>
+	<value value="6" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
+	<value value="7" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
+	<value value="8" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_SP"/>
+	<value value="9" name="A7XX_PERF_UCHE_READ_REQUESTS_TP"/>
+	<value value="10" name="A7XX_PERF_UCHE_READ_REQUESTS_VFD"/>
+	<value value="11" name="A7XX_PERF_UCHE_READ_REQUESTS_HLSQ"/>
+	<value value="12" name="A7XX_PERF_UCHE_READ_REQUESTS_LRZ"/>
+	<value value="13" name="A7XX_PERF_UCHE_READ_REQUESTS_SP"/>
+	<value value="14" name="A7XX_PERF_UCHE_WRITE_REQUESTS_LRZ"/>
+	<value value="15" name="A7XX_PERF_UCHE_WRITE_REQUESTS_SP"/>
+	<value value="16" name="A7XX_PERF_UCHE_WRITE_REQUESTS_VPC"/>
+	<value value="17" name="A7XX_PERF_UCHE_WRITE_REQUESTS_VSC"/>
+	<value value="18" name="A7XX_PERF_UCHE_EVICTS"/>
+	<value value="19" name="A7XX_PERF_UCHE_BANK_REQ0"/>
+	<value value="20" name="A7XX_PERF_UCHE_BANK_REQ1"/>
+	<value value="21" name="A7XX_PERF_UCHE_BANK_REQ2"/>
+	<value value="22" name="A7XX_PERF_UCHE_BANK_REQ3"/>
+	<value value="23" name="A7XX_PERF_UCHE_BANK_REQ4"/>
+	<value value="24" name="A7XX_PERF_UCHE_BANK_REQ5"/>
+	<value value="25" name="A7XX_PERF_UCHE_BANK_REQ6"/>
+	<value value="26" name="A7XX_PERF_UCHE_BANK_REQ7"/>
+	<value value="27" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_CH0"/>
+	<value value="28" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_CH1"/>
+	<value value="29" name="A7XX_PERF_UCHE_GMEM_READ_BEATS"/>
+	<value value="30" name="A7XX_PERF_UCHE_TPH_REF_FULL"/>
+	<value value="31" name="A7XX_PERF_UCHE_TPH_VICTIM_FULL"/>
+	<value value="32" name="A7XX_PERF_UCHE_TPH_EXT_FULL"/>
+	<value value="33" name="A7XX_PERF_UCHE_VBIF_STALL_WRITE_DATA"/>
+	<value value="34" name="A7XX_PERF_UCHE_DCMP_LATENCY_SAMPLES"/>
+	<value value="35" name="A7XX_PERF_UCHE_DCMP_LATENCY_CYCLES"/>
+	<value value="36" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_PC"/>
+	<value value="37" name="A7XX_PERF_UCHE_READ_REQUESTS_PC"/>
+	<value value="38" name="A7XX_PERF_UCHE_RAM_READ_REQ"/>
+	<value value="39" name="A7XX_PERF_UCHE_RAM_WRITE_REQ"/>
+	<value value="40" name="A7XX_PERF_UCHE_STARVED_CYCLES_VBIF_DECMP"/>
+	<value value="41" name="A7XX_PERF_UCHE_STALL_CYCLES_DECMP"/>
+	<value value="42" name="A7XX_PERF_UCHE_ARBITER_STALL_CYCLES_VBIF"/>
+	<value value="43" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_UBWC"/>
+	<value value="44" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_NONUBWC"/>
+	<value value="45" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_GMEM"/>
+	<value value="46" name="A7XX_PERF_UCHE_LONG_LINE_ALL_EVICTS_KAILUA"/>
+	<value value="47" name="A7XX_PERF_UCHE_LONG_LINE_PARTIAL_EVICTS_KAILUA"/>
+	<value value="48" name="A7XX_PERF_UCHE_TPH_CONFLICT_CL_CCHE"/>
+	<value value="49" name="A7XX_PERF_UCHE_TPH_CONFLICT_CL_OTHER_KAILUA"/>
+	<value value="50" name="A7XX_PERF_UCHE_DBANK_CONFLICT_CL_CCHE"/>
+	<value value="51" name="A7XX_PERF_UCHE_DBANK_CONFLICT_CL_OTHER_CLIENTS"/>
+	<value value="52" name="A7XX_PERF_UCHE_VBIF_WRITE_BEATS_CH0"/>
+	<value value="53" name="A7XX_PERF_UCHE_VBIF_WRITE_BEATS_CH1"/>
+	<value value="54" name="A7XX_PERF_UCHE_CCHE_TPH_QUEUE_FULL"/>
+	<value value="55" name="A7XX_PERF_UCHE_CCHE_DPH_QUEUE_FULL"/>
+	<value value="56" name="A7XX_PERF_UCHE_GMEM_WRITE_BEATS"/>
+	<value value="57" name="A7XX_PERF_UCHE_UBWC_READ_BEATS"/>
+	<value value="58" name="A7XX_PERF_UCHE_UBWC_WRITE_BEATS"/>
+</enum>
+
+<enum name="a7xx_tp_perfcounter_select">
+	<value value="0" name="A7XX_PERF_TP_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_TP_STALL_CYCLES_UCHE"/>
+	<value value="2" name="A7XX_PERF_TP_LATENCY_CYCLES"/>
+	<value value="3" name="A7XX_PERF_TP_LATENCY_TRANS"/>
+	<value value="4" name="A7XX_PERF_TP_FLAG_FIFO_DELAY_SAMPLES"/>
+	<value value="5" name="A7XX_PERF_TP_FLAG_FIFO_DELAY_CYCLES"/>
+	<value value="6" name="A7XX_PERF_TP_L1_CACHELINE_REQUESTS"/>
+	<value value="7" name="A7XX_PERF_TP_L1_CACHELINE_MISSES"/>
+	<value value="8" name="A7XX_PERF_TP_SP_TP_TRANS"/>
+	<value value="9" name="A7XX_PERF_TP_TP_SP_TRANS"/>
+	<value value="10" name="A7XX_PERF_TP_OUTPUT_PIXELS"/>
+	<value value="11" name="A7XX_PERF_TP_FILTER_WORKLOAD_16BIT"/>
+	<value value="12" name="A7XX_PERF_TP_FILTER_WORKLOAD_32BIT"/>
+	<value value="13" name="A7XX_PERF_TP_QUADS_RECEIVED"/>
+	<value value="14" name="A7XX_PERF_TP_QUADS_OFFSET"/>
+	<value value="15" name="A7XX_PERF_TP_QUADS_SHADOW"/>
+	<value value="16" name="A7XX_PERF_TP_QUADS_ARRAY"/>
+	<value value="17" name="A7XX_PERF_TP_QUADS_GRADIENT"/>
+	<value value="18" name="A7XX_PERF_TP_QUADS_1D"/>
+	<value value="19" name="A7XX_PERF_TP_QUADS_2D"/>
+	<value value="20" name="A7XX_PERF_TP_QUADS_BUFFER"/>
+	<value value="21" name="A7XX_PERF_TP_QUADS_3D"/>
+	<value value="22" name="A7XX_PERF_TP_QUADS_CUBE"/>
+	<value value="23" name="A7XX_PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
+	<value value="24" name="A7XX_PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
+	<value value="25" name="A7XX_PERF_TP_OUTPUT_PIXELS_POINT"/>
+	<value value="26" name="A7XX_PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="27" name="A7XX_PERF_TP_OUTPUT_PIXELS_MIP"/>
+	<value value="28" name="A7XX_PERF_TP_OUTPUT_PIXELS_ANISO"/>
+	<value value="29" name="A7XX_PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
+	<value value="30" name="A7XX_PERF_TP_FLAG_CACHE_REQUESTS"/>
+	<value value="31" name="A7XX_PERF_TP_FLAG_CACHE_MISSES"/>
+	<value value="32" name="A7XX_PERF_TP_L1_5_L2_REQUESTS"/>
+	<value value="33" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS"/>
+	<value value="34" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
+	<value value="35" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="36" name="A7XX_PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
+	<value value="37" name="A7XX_PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
+	<value value="38" name="A7XX_PERF_TP_TPA2TPC_TRANS"/>
+	<value value="39" name="A7XX_PERF_TP_L1_MISSES_ASTC_1TILE"/>
+	<value value="40" name="A7XX_PERF_TP_L1_MISSES_ASTC_2TILE"/>
+	<value value="41" name="A7XX_PERF_TP_L1_MISSES_ASTC_4TILE"/>
+	<value value="42" name="A7XX_PERF_TP_L1_5_COMPRESS_REQS"/>
+	<value value="43" name="A7XX_PERF_TP_L1_5_L2_COMPRESS_MISS"/>
+	<value value="44" name="A7XX_PERF_TP_L1_BANK_CONFLICT"/>
+	<value value="45" name="A7XX_PERF_TP_L1_5_MISS_LATENCY_CYCLES"/>
+	<value value="46" name="A7XX_PERF_TP_L1_5_MISS_LATENCY_TRANS"/>
+	<value value="47" name="A7XX_PERF_TP_QUADS_CONSTANT_MULTIPLIED"/>
+	<value value="48" name="A7XX_PERF_TP_FRONTEND_WORKING_CYCLES"/>
+	<value value="49" name="A7XX_PERF_TP_L1_TAG_WORKING_CYCLES"/>
+	<value value="50" name="A7XX_PERF_TP_L1_DATA_WRITE_WORKING_CYCLES"/>
+	<value value="51" name="A7XX_PERF_TP_PRE_L1_DECOM_WORKING_CYCLES"/>
+	<value value="52" name="A7XX_PERF_TP_BACKEND_WORKING_CYCLES"/>
+	<value value="53" name="A7XX_PERF_TP_L1_5_CACHE_WORKING_CYCLES"/>
+	<value value="54" name="A7XX_PERF_TP_STARVE_CYCLES_SP"/>
+	<value value="55" name="A7XX_PERF_TP_STARVE_CYCLES_UCHE"/>
+	<value value="56" name="A7XX_PERF_TP_STALL_CYCLES_UFC"/>
+	<value value="57" name="A7XX_PERF_TP_FORMAT_DECOMP"/>
+	<value value="58" name="A7XX_PERF_TP_FILTER_POINT_FP16"/>
+	<value value="59" name="A7XX_PERF_TP_FILTER_POINT_FP32"/>
+	<value value="60" name="A7XX_PERF_TP_LATENCY_FIFO_FULL"/>
+	<value value="61" name="A7XX_PERF_TP_RESERVED_61"/>
+	<value value="62" name="A7XX_PERF_TP_RESERVED_62"/>
+	<value value="63" name="A7XX_PERF_TP_RESERVED_63"/>
+	<value value="64" name="A7XX_PERF_TP_RESERVED_64"/>
+	<value value="65" name="A7XX_PERF_TP_RESERVED_65"/>
+	<value value="66" name="A7XX_PERF_TP_RESERVED_66"/>
+	<value value="67" name="A7XX_PERF_TP_RESERVED_67"/>
+	<value value="68" name="A7XX_PERF_TP_RESERVED_68"/>
+	<value value="69" name="A7XX_PERF_TP_RESERVED_69"/>
+	<value value="70" name="A7XX_PERF_TP_RESERVED_70"/>
+	<value value="71" name="A7XX_PERF_TP_RESERVED_71"/>
+	<value value="72" name="A7XX_PERF_TP_RESERVED_72"/>
+	<value value="73" name="A7XX_PERF_TP_RESERVED_73"/>
+	<value value="74" name="A7XX_PERF_TP_RESERVED_74"/>
+	<value value="75" name="A7XX_PERF_TP_RESERVED_75"/>
+	<value value="76" name="A7XX_PERF_TP_RESERVED_76"/>
+	<value value="77" name="A7XX_PERF_TP_RESERVED_77"/>
+	<value value="78" name="A7XX_PERF_TP_RESERVED_78"/>
+	<value value="79" name="A7XX_PERF_TP_RESERVED_79"/>
+	<value value="80" name="A7XX_PERF_TP_RESERVED_80"/>
+	<value value="81" name="A7XX_PERF_TP_RESERVED_81"/>
+	<value value="82" name="A7XX_PERF_TP_RESERVED_82"/>
+	<value value="83" name="A7XX_PERF_TP_RESERVED_83"/>
+	<value value="84" name="A7XX_PERF_TP_RESERVED_84"/>
+	<value value="85" name="A7XX_PERF_TP_RESERVED_85"/>
+	<value value="86" name="A7XX_PERF_TP_RESERVED_86"/>
+	<value value="87" name="A7XX_PERF_TP_RESERVED_87"/>
+	<value value="88" name="A7XX_PERF_TP_RESERVED_88"/>
+	<value value="89" name="A7XX_PERF_TP_RESERVED_89"/>
+	<value value="90" name="A7XX_PERF_TP_RESERVED_90"/>
+	<value value="91" name="A7XX_PERF_TP_RESERVED_91"/>
+	<value value="92" name="A7XX_PERF_TP_RESERVED_92"/>
+	<value value="93" name="A7XX_PERF_TP_RESERVED_93"/>
+	<value value="94" name="A7XX_PERF_TP_RESERVED_94"/>
+	<value value="95" name="A7XX_PERF_TP_RESERVED_95"/>
+	<value value="96" name="A7XX_PERF_TP_RESERVED_96"/>
+	<value value="97" name="A7XX_PERF_TP_RESERVED_97"/>
+	<value value="98" name="A7XX_PERF_TP_RESERVED_98"/>
+	<value value="99" name="A7XX_PERF_TP_RESERVED_99"/>
+	<value value="100" name="A7XX_PERF_TP_RESERVED_100"/>
+	<value value="101" name="A7XX_PERF_TP_RESERVED_101"/>
+	<value value="102" name="A7XX_PERF_TP_RESERVED_102"/>
+	<value value="103" name="A7XX_PERF_TP_RESERVED_103"/>
+	<value value="104" name="A7XX_PERF_TP_RESERVED_104"/>
+	<value value="105" name="A7XX_PERF_TP_RESERVED_105"/>
+	<value value="106" name="A7XX_PERF_TP_RESERVED_106"/>
+	<value value="107" name="A7XX_PERF_TP_RESERVED_107"/>
+	<value value="108" name="A7XX_PERF_TP_RESERVED_108"/>
+	<value value="109" name="A7XX_PERF_TP_RESERVED_109"/>
+	<value value="110" name="A7XX_PERF_TP_RESERVED_110"/>
+	<value value="111" name="A7XX_PERF_TP_RESERVED_111"/>
+	<value value="112" name="A7XX_PERF_TP_RESERVED_112"/>
+	<value value="113" name="A7XX_PERF_TP_RESERVED_113"/>
+	<value value="114" name="A7XX_PERF_TP_RESERVED_114"/>
+	<value value="115" name="A7XX_PERF_TP_RESERVED_115"/>
+	<value value="116" name="A7XX_PERF_TP_RESERVED_116"/>
+	<value value="117" name="A7XX_PERF_TP_RESERVED_117"/>
+	<value value="118" name="A7XX_PERF_TP_RESERVED_118"/>
+	<value value="119" name="A7XX_PERF_TP_RESERVED_119"/>
+	<value value="120" name="A7XX_PERF_TP_RESERVED_120"/>
+	<value value="121" name="A7XX_PERF_TP_RESERVED_121"/>
+	<value value="122" name="A7XX_PERF_TP_RESERVED_122"/>
+	<value value="123" name="A7XX_PERF_TP_RESERVED_123"/>
+	<value value="124" name="A7XX_PERF_TP_RESERVED_124"/>
+	<value value="125" name="A7XX_PERF_TP_RESERVED_125"/>
+	<value value="126" name="A7XX_PERF_TP_RESERVED_126"/>
+	<value value="127" name="A7XX_PERF_TP_RESERVED_127"/>
+	<value value="128" name="A7XX_PERF_TP_FORMAT_DECOMP_BILINEAR"/>
+	<value value="129" name="A7XX_PERF_TP_PACKED_POINT_BOTH_VALID_FP16"/>
+	<value value="130" name="A7XX_PERF_TP_PACKED_POINT_SINGLE_VALID_FP16"/>
+	<value value="131" name="A7XX_PERF_TP_PACKED_POINT_BOTH_VALID_FP32"/>
+	<value value="132" name="A7XX_PERF_TP_PACKED_POINT_SINGLE_VALID_FP32"/>
+</enum>
+
+<enum name="a7xx_sp_perfcounter_select">
+	<value value="0" name="A7XX_PERF_SP_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_SP_ALU_WORKING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_SP_EFU_WORKING_CYCLES"/>
+	<value value="3" name="A7XX_PERF_SP_STALL_CYCLES_VPC"/>
+	<value value="4" name="A7XX_PERF_SP_STALL_CYCLES_TP"/>
+	<value value="5" name="A7XX_PERF_SP_STALL_CYCLES_UCHE"/>
+	<value value="6" name="A7XX_PERF_SP_STALL_CYCLES_RB"/>
+	<value value="7" name="A7XX_PERF_SP_NON_EXECUTION_CYCLES"/>
+	<value value="8" name="A7XX_PERF_SP_WAVE_CONTEXTS"/>
+	<value value="9" name="A7XX_PERF_SP_WAVE_CONTEXT_CYCLES"/>
+	<value value="10" name="A7XX_PERF_SP_STAGE_WAVE_CYCLES"/>
+	<value value="11" name="A7XX_PERF_SP_STAGE_WAVE_SAMPLES"/>
+	<value value="12" name="A7XX_PERF_SP_VS_STAGE_WAVE_CYCLES"/>
+	<value value="13" name="A7XX_PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
+	<value value="14" name="A7XX_PERF_SP_FS_STAGE_DURATION_CYCLES"/>
+	<value value="15" name="A7XX_PERF_SP_VS_STAGE_DURATION_CYCLES"/>
+	<value value="16" name="A7XX_PERF_SP_WAVE_CTRL_CYCLES"/>
+	<value value="17" name="A7XX_PERF_SP_WAVE_LOAD_CYCLES"/>
+	<value value="18" name="A7XX_PERF_SP_WAVE_EMIT_CYCLES"/>
+	<value value="19" name="A7XX_PERF_SP_WAVE_NOP_CYCLES"/>
+	<value value="20" name="A7XX_PERF_SP_WAVE_WAIT_CYCLES"/>
+	<value value="21" name="A7XX_PERF_SP_WAVE_FETCH_CYCLES"/>
+	<value value="22" name="A7XX_PERF_SP_WAVE_IDLE_CYCLES"/>
+	<value value="23" name="A7XX_PERF_SP_WAVE_END_CYCLES"/>
+	<value value="24" name="A7XX_PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
+	<value value="25" name="A7XX_PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
+	<value value="26" name="A7XX_PERF_SP_WAVE_JOIN_CYCLES"/>
+	<value value="27" name="A7XX_PERF_SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="28" name="A7XX_PERF_SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="29" name="A7XX_PERF_SP_LM_ATOMICS"/>
+	<value value="30" name="A7XX_PERF_SP_GM_LOAD_INSTRUCTIONS"/>
+	<value value="31" name="A7XX_PERF_SP_GM_STORE_INSTRUCTIONS"/>
+	<value value="32" name="A7XX_PERF_SP_GM_ATOMICS"/>
+	<value value="33" name="A7XX_PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="34" name="A7XX_PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="35" name="A7XX_PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="36" name="A7XX_PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="37" name="A7XX_PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="38" name="A7XX_PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="39" name="A7XX_PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="40" name="A7XX_PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="41" name="A7XX_PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="42" name="A7XX_PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
+	<value value="43" name="A7XX_PERF_SP_VS_INSTRUCTIONS"/>
+	<value value="44" name="A7XX_PERF_SP_FS_INSTRUCTIONS"/>
+	<value value="45" name="A7XX_PERF_SP_ADDR_LOCK_COUNT"/>
+	<value value="46" name="A7XX_PERF_SP_UCHE_READ_TRANS"/>
+	<value value="47" name="A7XX_PERF_SP_UCHE_WRITE_TRANS"/>
+	<value value="48" name="A7XX_PERF_SP_EXPORT_VPC_TRANS"/>
+	<value value="49" name="A7XX_PERF_SP_EXPORT_RB_TRANS"/>
+	<value value="50" name="A7XX_PERF_SP_PIXELS_KILLED"/>
+	<value value="51" name="A7XX_PERF_SP_ICL1_REQUESTS"/>
+	<value value="52" name="A7XX_PERF_SP_ICL1_MISSES"/>
+	<value value="53" name="A7XX_PERF_SP_HS_INSTRUCTIONS"/>
+	<value value="54" name="A7XX_PERF_SP_DS_INSTRUCTIONS"/>
+	<value value="55" name="A7XX_PERF_SP_GS_INSTRUCTIONS"/>
+	<value value="56" name="A7XX_PERF_SP_CS_INSTRUCTIONS"/>
+	<value value="57" name="A7XX_PERF_SP_GPR_READ"/>
+	<value value="58" name="A7XX_PERF_SP_GPR_WRITE"/>
+	<value value="59" name="A7XX_PERF_SP_FS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+	<value value="60" name="A7XX_PERF_SP_VS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+	<value value="61" name="A7XX_PERF_SP_LM_BANK_CONFLICTS"/>
+	<value value="62" name="A7XX_PERF_SP_TEX_CONTROL_WORKING_CYCLES"/>
+	<value value="63" name="A7XX_PERF_SP_LOAD_CONTROL_WORKING_CYCLES"/>
+	<value value="64" name="A7XX_PERF_SP_FLOW_CONTROL_WORKING_CYCLES"/>
+	<value value="65" name="A7XX_PERF_SP_LM_WORKING_CYCLES"/>
+	<value value="66" name="A7XX_PERF_SP_DISPATCHER_WORKING_CYCLES"/>
+	<value value="67" name="A7XX_PERF_SP_SEQUENCER_WORKING_CYCLES"/>
+	<value value="68" name="A7XX_PERF_SP_LOW_EFFICIENCY_STARVED_BY_TP"/>
+	<value value="69" name="A7XX_PERF_SP_STARVE_CYCLES_HLSQ"/>
+	<value value="70" name="A7XX_PERF_SP_NON_EXECUTION_LS_CYCLES"/>
+	<value value="71" name="A7XX_PERF_SP_WORKING_EU"/>
+	<value value="72" name="A7XX_PERF_SP_ANY_EU_WORKING"/>
+	<value value="73" name="A7XX_PERF_SP_WORKING_EU_FS_STAGE"/>
+	<value value="74" name="A7XX_PERF_SP_ANY_EU_WORKING_FS_STAGE"/>
+	<value value="75" name="A7XX_PERF_SP_WORKING_EU_VS_STAGE"/>
+	<value value="76" name="A7XX_PERF_SP_ANY_EU_WORKING_VS_STAGE"/>
+	<value value="77" name="A7XX_PERF_SP_WORKING_EU_CS_STAGE"/>
+	<value value="78" name="A7XX_PERF_SP_ANY_EU_WORKING_CS_STAGE"/>
+	<value value="79" name="A7XX_PERF_SP_GPR_READ_PREFETCH"/>
+	<value value="80" name="A7XX_PERF_SP_GPR_READ_CONFLICT"/>
+	<value value="81" name="A7XX_PERF_SP_GPR_WRITE_CONFLICT"/>
+	<value value="82" name="A7XX_PERF_SP_GM_LOAD_LATENCY_CYCLES"/>
+	<value value="83" name="A7XX_PERF_SP_GM_LOAD_LATENCY_SAMPLES"/>
+	<value value="84" name="A7XX_PERF_SP_EXECUTABLE_WAVES"/>
+	<value value="85" name="A7XX_PERF_SP_ICL1_MISS_FETCH_CYCLES"/>
+	<value value="86" name="A7XX_PERF_SP_WORKING_EU_LPAC"/>
+	<value value="87" name="A7XX_PERF_SP_BYPASS_BUSY_CYCLES"/>
+	<value value="88" name="A7XX_PERF_SP_ANY_EU_WORKING_LPAC"/>
+	<value value="89" name="A7XX_PERF_SP_WAVE_ALU_CYCLES"/>
+	<value value="90" name="A7XX_PERF_SP_WAVE_EFU_CYCLES"/>
+	<value value="91" name="A7XX_PERF_SP_WAVE_INT_CYCLES"/>
+	<value value="92" name="A7XX_PERF_SP_WAVE_CSP_CYCLES"/>
+	<value value="93" name="A7XX_PERF_SP_EWAVE_CONTEXTS"/>
+	<value value="94" name="A7XX_PERF_SP_EWAVE_CONTEXT_CYCLES"/>
+	<value value="95" name="A7XX_PERF_SP_LPAC_BUSY_CYCLES"/>
+	<value value="96" name="A7XX_PERF_SP_LPAC_INSTRUCTIONS"/>
+	<value value="97" name="A7XX_PERF_SP_FS_STAGE_1X_WAVES"/>
+	<value value="98" name="A7XX_PERF_SP_FS_STAGE_2X_WAVES"/>
+	<value value="99" name="A7XX_PERF_SP_QUADS"/>
+	<value value="100" name="A7XX_PERF_SP_CS_INVOCATIONS"/>
+	<value value="101" name="A7XX_PERF_SP_PIXELS"/>
+	<value value="102" name="A7XX_PERF_SP_LPAC_DRAWCALLS"/>
+	<value value="103" name="A7XX_PERF_SP_PI_WORKING_CYCLES"/>
+	<value value="104" name="A7XX_PERF_SP_WAVE_INPUT_CYCLES"/>
+	<value value="105" name="A7XX_PERF_SP_WAVE_OUTPUT_CYCLES"/>
+	<value value="106" name="A7XX_PERF_SP_WAVE_HWAVE_WAIT_CYCLES"/>
+	<value value="107" name="A7XX_PERF_SP_WAVE_HWAVE_SYNC"/>
+	<value value="108" name="A7XX_PERF_SP_OUTPUT_3D_PIXELS"/>
+	<value value="109" name="A7XX_PERF_SP_FULL_ALU_MAD_INSTRUCTIONS"/>
+	<value value="110" name="A7XX_PERF_SP_HALF_ALU_MAD_INSTRUCTIONS"/>
+	<value value="111" name="A7XX_PERF_SP_FULL_ALU_MUL_INSTRUCTIONS"/>
+	<value value="112" name="A7XX_PERF_SP_HALF_ALU_MUL_INSTRUCTIONS"/>
+	<value value="113" name="A7XX_PERF_SP_FULL_ALU_ADD_INSTRUCTIONS"/>
+	<value value="114" name="A7XX_PERF_SP_HALF_ALU_ADD_INSTRUCTIONS"/>
+	<value value="115" name="A7XX_PERF_SP_BARY_FP32_INSTRUCTIONS"/>
+	<value value="116" name="A7XX_PERF_SP_ALU_GPR_READ_CYCLES"/>
+	<value value="117" name="A7XX_PERF_SP_ALU_DATA_FORWARDING_CYCLES"/>
+	<value value="118" name="A7XX_PERF_SP_LM_FULL_CYCLES"/>
+	<value value="119" name="A7XX_PERF_SP_TEXTURE_FETCH_LATENCY_CYCLES"/>
+	<value value="120" name="A7XX_PERF_SP_TEXTURE_FETCH_LATENCY_SAMPLES"/>
+	<value value="121" name="A7XX_PERF_SP_FS_STAGE_PI_TEX_INSTRUCTION"/>
+	<value value="122" name="A7XX_PERF_SP_RAY_QUERY_INSTRUCTIONS"/>
+	<value value="123" name="A7XX_PERF_SP_RBRT_KICKOFF_FIBERS"/>
+	<value value="124" name="A7XX_PERF_SP_RBRT_KICKOFF_DQUADS"/>
+	<value value="125" name="A7XX_PERF_SP_RTU_BUSY_CYCLES"/>
+	<value value="126" name="A7XX_PERF_SP_RTU_L0_HITS"/>
+	<value value="127" name="A7XX_PERF_SP_RTU_L0_MISSES"/>
+	<value value="128" name="A7XX_PERF_SP_RTU_L0_HIT_ON_MISS"/>
+	<value value="129" name="A7XX_PERF_SP_RTU_STALL_CYCLES_WAVE_QUEUE"/>
+	<value value="130" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0_HIT_QUEUE"/>
+	<value value="131" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0_MISS_QUEUE"/>
+	<value value="132" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0D_IDX_QUEUE"/>
+	<value value="133" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0DATA"/>
+	<value value="134" name="A7XX_PERF_SP_RTU_STALL_CYCLES_REPLACE_CNT"/>
+	<value value="135" name="A7XX_PERF_SP_RTU_STALL_CYCLES_MRG_CNT"/>
+	<value value="136" name="A7XX_PERF_SP_RTU_STALL_CYCLES_UCHE"/>
+	<value value="137" name="A7XX_PERF_SP_RTU_OPERAND_FETCH_STALL_CYCLES_L0"/>
+	<value value="138" name="A7XX_PERF_SP_RTU_OPERAND_FETCH_STALL_CYCLES_INS_FIFO"/>
+	<value value="139" name="A7XX_PERF_SP_RTU_BVH_FETCH_LATENCY_CYCLES"/>
+	<value value="140" name="A7XX_PERF_SP_RTU_BVH_FETCH_LATENCY_SAMPLES"/>
+	<value value="141" name="A7XX_PERF_SP_STCHE_MISS_INC_VS"/>
+	<value value="142" name="A7XX_PERF_SP_STCHE_MISS_INC_FS"/>
+	<value value="143" name="A7XX_PERF_SP_STCHE_MISS_INC_BV"/>
+	<value value="144" name="A7XX_PERF_SP_STCHE_MISS_INC_LPAC"/>
+	<value value="145" name="A7XX_PERF_SP_VGPR_ACTIVE_CONTEXTS"/>
+	<value value="146" name="A7XX_PERF_SP_PGPR_ALLOC_CONTEXTS"/>
+	<value value="147" name="A7XX_PERF_SP_VGPR_ALLOC_CONTEXTS"/>
+	<value value="148" name="A7XX_PERF_SP_RTU_RAY_BOX_INTERSECTIONS"/>
+	<value value="149" name="A7XX_PERF_SP_RTU_RAY_TRIANGLE_INTERSECTIONS"/>
+	<value value="150" name="A7XX_PERF_SP_SCH_STALL_CYCLES_RTU"/>
+</enum>
+
+<enum name="a7xx_rb_perfcounter_select">
+	<value value="0" name="A7XX_PERF_RB_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_RB_STALL_CYCLES_HLSQ"/>
+	<value value="2" name="A7XX_PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
+	<value value="3" name="A7XX_PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
+	<value value="4" name="A7XX_PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
+	<value value="5" name="A7XX_PERF_RB_STARVE_CYCLES_SP"/>
+	<value value="6" name="A7XX_PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
+	<value value="7" name="A7XX_PERF_RB_STARVE_CYCLES_CCU"/>
+	<value value="8" name="A7XX_PERF_RB_STARVE_CYCLES_Z_PLANE"/>
+	<value value="9" name="A7XX_PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
+	<value value="10" name="A7XX_PERF_RB_Z_WORKLOAD"/>
+	<value value="11" name="A7XX_PERF_RB_HLSQ_ACTIVE"/>
+	<value value="12" name="A7XX_PERF_RB_Z_READ"/>
+	<value value="13" name="A7XX_PERF_RB_Z_WRITE"/>
+	<value value="14" name="A7XX_PERF_RB_C_READ"/>
+	<value value="15" name="A7XX_PERF_RB_C_WRITE"/>
+	<value value="16" name="A7XX_PERF_RB_TOTAL_PASS"/>
+	<value value="17" name="A7XX_PERF_RB_Z_PASS"/>
+	<value value="18" name="A7XX_PERF_RB_Z_FAIL"/>
+	<value value="19" name="A7XX_PERF_RB_S_FAIL"/>
+	<value value="20" name="A7XX_PERF_RB_BLENDED_FXP_COMPONENTS"/>
+	<value value="21" name="A7XX_PERF_RB_BLENDED_FP16_COMPONENTS"/>
+	<value value="22" name="A7XX_PERF_RB_PS_INVOCATIONS"/>
+	<value value="23" name="A7XX_PERF_RB_2D_ALIVE_CYCLES"/>
+	<value value="24" name="A7XX_PERF_RB_2D_STALL_CYCLES_A2D"/>
+	<value value="25" name="A7XX_PERF_RB_2D_STARVE_CYCLES_SRC"/>
+	<value value="26" name="A7XX_PERF_RB_2D_STARVE_CYCLES_SP"/>
+	<value value="27" name="A7XX_PERF_RB_2D_STARVE_CYCLES_DST"/>
+	<value value="28" name="A7XX_PERF_RB_2D_VALID_PIXELS"/>
+	<value value="29" name="A7XX_PERF_RB_3D_PIXELS"/>
+	<value value="30" name="A7XX_PERF_RB_BLENDER_WORKING_CYCLES"/>
+	<value value="31" name="A7XX_PERF_RB_ZPROC_WORKING_CYCLES"/>
+	<value value="32" name="A7XX_PERF_RB_CPROC_WORKING_CYCLES"/>
+	<value value="33" name="A7XX_PERF_RB_SAMPLER_WORKING_CYCLES"/>
+	<value value="34" name="A7XX_PERF_RB_STALL_CYCLES_CCU_COLOR_READ"/>
+	<value value="35" name="A7XX_PERF_RB_STALL_CYCLES_CCU_COLOR_WRITE"/>
+	<value value="36" name="A7XX_PERF_RB_STALL_CYCLES_CCU_DEPTH_READ"/>
+	<value value="37" name="A7XX_PERF_RB_STALL_CYCLES_CCU_DEPTH_WRITE"/>
+	<value value="38" name="A7XX_PERF_RB_STALL_CYCLES_VPC"/>
+	<value value="39" name="A7XX_PERF_RB_2D_INPUT_TRANS"/>
+	<value value="40" name="A7XX_PERF_RB_2D_OUTPUT_RB_DST_TRANS"/>
+	<value value="41" name="A7XX_PERF_RB_2D_OUTPUT_RB_SRC_TRANS"/>
+	<value value="42" name="A7XX_PERF_RB_BLENDED_FP32_COMPONENTS"/>
+	<value value="43" name="A7XX_PERF_RB_COLOR_PIX_TILES"/>
+	<value value="44" name="A7XX_PERF_RB_STALL_CYCLES_CCU"/>
+	<value value="45" name="A7XX_PERF_RB_EARLY_Z_ARB3_GRANT"/>
+	<value value="46" name="A7XX_PERF_RB_LATE_Z_ARB3_GRANT"/>
+	<value value="47" name="A7XX_PERF_RB_EARLY_Z_SKIP_GRANT"/>
+	<value value="48" name="A7XX_PERF_RB_VRS_1x1_QUADS"/>
+	<value value="49" name="A7XX_PERF_RB_VRS_2x1_QUADS"/>
+	<value value="50" name="A7XX_PERF_RB_VRS_1x2_QUADS"/>
+	<value value="51" name="A7XX_PERF_RB_VRS_2x2_QUADS"/>
+	<value value="52" name="A7XX_PERF_RB_VRS_4x2_QUADS"/>
+	<value value="53" name="A7XX_PERF_RB_VRS_4x4_QUADS"/>
+</enum>
+
+<enum name="a7xx_vsc_perfcounter_select">
+	<value value="0" name="A7XX_PERF_VSC_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_VSC_WORKING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_VSC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="A7XX_PERF_VSC_EOT_NUM"/>
+	<value value="4" name="A7XX_PERF_VSC_INPUT_TILES"/>
+</enum>
+
+<enum name="a7xx_ccu_perfcounter_select">
+	<value value="0" name="A7XX_PERF_CCU_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
+	<value value="2" name="A7XX_PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
+	<value value="3" name="A7XX_PERF_CCU_DEPTH_BLOCKS"/>
+	<value value="4" name="A7XX_PERF_CCU_COLOR_BLOCKS"/>
+	<value value="5" name="A7XX_PERF_CCU_DEPTH_BLOCK_HIT"/>
+	<value value="6" name="A7XX_PERF_CCU_COLOR_BLOCK_HIT"/>
+	<value value="7" name="A7XX_PERF_CCU_PARTIAL_BLOCK_READ"/>
+	<value value="8" name="A7XX_PERF_CCU_GMEM_READ"/>
+	<value value="9" name="A7XX_PERF_CCU_GMEM_WRITE"/>
+	<value value="10" name="A7XX_PERF_CCU_2D_RD_REQ"/>
+	<value value="11" name="A7XX_PERF_CCU_2D_WR_REQ"/>
+	<value value="12" name="A7XX_PERF_CCU_UBWC_COLOR_BLOCKS_CONCURRENT"/>
+	<value value="13" name="A7XX_PERF_CCU_UBWC_DEPTH_BLOCKS_CONCURRENT"/>
+	<value value="14" name="A7XX_PERF_CCU_COLOR_RESOLVE_DROPPED"/>
+	<value value="15" name="A7XX_PERF_CCU_DEPTH_RESOLVE_DROPPED"/>
+	<value value="16" name="A7XX_PERF_CCU_COLOR_RENDER_CONCURRENT"/>
+	<value value="17" name="A7XX_PERF_CCU_DEPTH_RENDER_CONCURRENT"/>
+	<value value="18" name="A7XX_PERF_CCU_COLOR_RESOLVE_AFTER_RENDER"/>
+	<value value="19" name="A7XX_PERF_CCU_DEPTH_RESOLVE_AFTER_RENDER"/>
+	<value value="20" name="A7XX_PERF_CCU_GMEM_EXTRA_DEPTH_READ"/>
+	<value value="21" name="A7XX_PERF_CCU_GMEM_COLOR_READ_4AA"/>
+	<value value="22" name="A7XX_PERF_CCU_GMEM_COLOR_READ_4AA_FULL"/>
+</enum>
+
+<enum name="a7xx_lrz_perfcounter_select">
+	<value value="0" name="A7XX_PERF_LRZ_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_LRZ_STARVE_CYCLES_RAS"/>
+	<value value="2" name="A7XX_PERF_LRZ_STALL_CYCLES_RB"/>
+	<value value="3" name="A7XX_PERF_LRZ_STALL_CYCLES_VSC"/>
+	<value value="4" name="A7XX_PERF_LRZ_STALL_CYCLES_VPC"/>
+	<value value="5" name="A7XX_PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
+	<value value="6" name="A7XX_PERF_LRZ_STALL_CYCLES_UCHE"/>
+	<value value="7" name="A7XX_PERF_LRZ_LRZ_READ"/>
+	<value value="8" name="A7XX_PERF_LRZ_LRZ_WRITE"/>
+	<value value="9" name="A7XX_PERF_LRZ_READ_LATENCY"/>
+	<value value="10" name="A7XX_PERF_LRZ_MERGE_CACHE_UPDATING"/>
+	<value value="11" name="A7XX_PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
+	<value value="12" name="A7XX_PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
+	<value value="13" name="A7XX_PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
+	<value value="14" name="A7XX_PERF_LRZ_FULL_8X8_TILES"/>
+	<value value="15" name="A7XX_PERF_LRZ_PARTIAL_8X8_TILES"/>
+	<value value="16" name="A7XX_PERF_LRZ_TILE_KILLED"/>
+	<value value="17" name="A7XX_PERF_LRZ_TOTAL_PIXEL"/>
+	<value value="18" name="A7XX_PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
+	<value value="19" name="A7XX_PERF_LRZ_FEEDBACK_ACCEPT"/>
+	<value value="20" name="A7XX_PERF_LRZ_FEEDBACK_DISCARD"/>
+	<value value="21" name="A7XX_PERF_LRZ_FEEDBACK_STALL"/>
+	<value value="22" name="A7XX_PERF_LRZ_STALL_CYCLES_RB_ZPLANE"/>
+	<value value="23" name="A7XX_PERF_LRZ_STALL_CYCLES_RB_BPLANE"/>
+	<value value="24" name="A7XX_PERF_LRZ_RAS_MASK_TRANS"/>
+	<value value="25" name="A7XX_PERF_LRZ_STALL_CYCLES_MVC"/>
+	<value value="26" name="A7XX_PERF_LRZ_TILE_KILLED_BY_IMAGE_VRS"/>
+	<value value="27" name="A7XX_PERF_LRZ_TILE_KILLED_BY_Z"/>
+</enum>
+
+<enum name="a7xx_cmp_perfcounter_select">
+	<value value="0" name="A7XX_PERF_CMPDECMP_STALL_CYCLES_ARB"/>
+	<value value="1" name="A7XX_PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
+	<value value="2" name="A7XX_PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
+	<value value="3" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
+	<value value="4" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
+	<value value="5" name="A7XX_PERF_CMPDECMP_VBIF_READ_REQUEST"/>
+	<value value="6" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
+	<value value="7" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA"/>
+	<value value="8" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA"/>
+	<value value="9" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
+	<value value="10" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
+	<value value="11" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
+	<value value="12" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
+	<value value="13" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG5_COUNT"/>
+	<value value="14" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG6_COUNT"/>
+	<value value="15" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG8_COUNT"/>
+	<value value="16" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
+	<value value="17" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
+	<value value="18" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
+	<value value="19" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
+	<value value="20" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG5_COUNT"/>
+	<value value="21" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG6_COUNT"/>
+	<value value="22" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG8_COUNT"/>
+	<value value="23" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH0"/>
+	<value value="24" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH1"/>
+	<value value="25" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA_UCHE"/>
+	<value value="26" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG0_COUNT"/>
+	<value value="27" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG0_COUNT"/>
+	<value value="28" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAGALPHA_COUNT"/>
+	<value value="29" name="A7XX_PERF_CMPDECMP_RESOLVE_EVENTS"/>
+	<value value="30" name="A7XX_PERF_CMPDECMP_CONCURRENT_RESOLVE_EVENTS"/>
+	<value value="31" name="A7XX_PERF_CMPDECMP_DROPPED_CLEAR_EVENTS"/>
+	<value value="32" name="A7XX_PERF_CMPDECMP_ST_BLOCKS_CONCURRENT"/>
+	<value value="33" name="A7XX_PERF_CMPDECMP_LRZ_ST_BLOCKS_CONCURRENT"/>
+	<value value="34" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG0_COUNT"/>
+	<value value="35" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG1_COUNT"/>
+	<value value="36" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG2_COUNT"/>
+	<value value="37" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG3_COUNT"/>
+	<value value="38" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG4_COUNT"/>
+	<value value="39" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG5_COUNT"/>
+	<value value="40" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG6_COUNT"/>
+	<value value="41" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG8_COUNT"/>
+	<value value="42" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG0_COUNT"/>
+	<value value="43" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG1_COUNT"/>
+	<value value="44" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG2_COUNT"/>
+	<value value="45" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG3_COUNT"/>
+	<value value="46" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG4_COUNT"/>
+	<value value="47" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG5_COUNT"/>
+	<value value="48" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG6_COUNT"/>
+	<value value="49" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG8_COUNT"/>
+</enum>
+
+<enum name="a7xx_gbif_perfcounter_select">
+	<value value="0" name="A7XX_PERF_GBIF_RESERVED_0"/>
+	<value value="1" name="A7XX_PERF_GBIF_RESERVED_1"/>
+	<value value="2" name="A7XX_PERF_GBIF_RESERVED_2"/>
+	<value value="3" name="A7XX_PERF_GBIF_RESERVED_3"/>
+	<value value="4" name="A7XX_PERF_GBIF_RESERVED_4"/>
+	<value value="5" name="A7XX_PERF_GBIF_RESERVED_5"/>
+	<value value="6" name="A7XX_PERF_GBIF_RESERVED_6"/>
+	<value value="7" name="A7XX_PERF_GBIF_RESERVED_7"/>
+	<value value="8" name="A7XX_PERF_GBIF_RESERVED_8"/>
+	<value value="9" name="A7XX_PERF_GBIF_RESERVED_9"/>
+	<value value="10" name="A7XX_PERF_GBIF_AXI0_READ_REQUESTS_TOTAL"/>
+	<value value="11" name="A7XX_PERF_GBIF_AXI1_READ_REQUESTS_TOTAL"/>
+	<value value="12" name="A7XX_PERF_GBIF_RESERVED_12"/>
+	<value value="13" name="A7XX_PERF_GBIF_RESERVED_13"/>
+	<value value="14" name="A7XX_PERF_GBIF_RESERVED_14"/>
+	<value value="15" name="A7XX_PERF_GBIF_RESERVED_15"/>
+	<value value="16" name="A7XX_PERF_GBIF_RESERVED_16"/>
+	<value value="17" name="A7XX_PERF_GBIF_RESERVED_17"/>
+	<value value="18" name="A7XX_PERF_GBIF_RESERVED_18"/>
+	<value value="19" name="A7XX_PERF_GBIF_RESERVED_19"/>
+	<value value="20" name="A7XX_PERF_GBIF_RESERVED_20"/>
+	<value value="21" name="A7XX_PERF_GBIF_RESERVED_21"/>
+	<value value="22" name="A7XX_PERF_GBIF_AXI0_WRITE_REQUESTS_TOTAL"/>
+	<value value="23" name="A7XX_PERF_GBIF_AXI1_WRITE_REQUESTS_TOTAL"/>
+	<value value="24" name="A7XX_PERF_GBIF_RESERVED_24"/>
+	<value value="25" name="A7XX_PERF_GBIF_RESERVED_25"/>
+	<value value="26" name="A7XX_PERF_GBIF_RESERVED_26"/>
+	<value value="27" name="A7XX_PERF_GBIF_RESERVED_27"/>
+	<value value="28" name="A7XX_PERF_GBIF_RESERVED_28"/>
+	<value value="29" name="A7XX_PERF_GBIF_RESERVED_29"/>
+	<value value="30" name="A7XX_PERF_GBIF_RESERVED_30"/>
+	<value value="31" name="A7XX_PERF_GBIF_RESERVED_31"/>
+	<value value="32" name="A7XX_PERF_GBIF_RESERVED_32"/>
+	<value value="33" name="A7XX_PERF_GBIF_RESERVED_33"/>
+	<value value="34" name="A7XX_PERF_GBIF_AXI0_READ_DATA_BEATS_TOTAL"/>
+	<value value="35" name="A7XX_PERF_GBIF_AXI1_READ_DATA_BEATS_TOTAL"/>
+	<value value="36" name="A7XX_PERF_GBIF_RESERVED_36"/>
+	<value value="37" name="A7XX_PERF_GBIF_RESERVED_37"/>
+	<value value="38" name="A7XX_PERF_GBIF_RESERVED_38"/>
+	<value value="39" name="A7XX_PERF_GBIF_RESERVED_39"/>
+	<value value="40" name="A7XX_PERF_GBIF_RESERVED_40"/>
+	<value value="41" name="A7XX_PERF_GBIF_RESERVED_41"/>
+	<value value="42" name="A7XX_PERF_GBIF_RESERVED_42"/>
+	<value value="43" name="A7XX_PERF_GBIF_RESERVED_43"/>
+	<value value="44" name="A7XX_PERF_GBIF_RESERVED_44"/>
+	<value value="45" name="A7XX_PERF_GBIF_RESERVED_45"/>
+	<value value="46" name="A7XX_PERF_GBIF_AXI0_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="47" name="A7XX_PERF_GBIF_AXI1_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="48" name="A7XX_PERF_GBIF_RESERVED_48"/>
+	<value value="49" name="A7XX_PERF_GBIF_RESERVED_49"/>
+	<value value="50" name="A7XX_PERF_GBIF_RESERVED_50"/>
+	<value value="51" name="A7XX_PERF_GBIF_RESERVED_51"/>
+	<value value="52" name="A7XX_PERF_GBIF_RESERVED_52"/>
+	<value value="53" name="A7XX_PERF_GBIF_RESERVED_53"/>
+	<value value="54" name="A7XX_PERF_GBIF_RESERVED_54"/>
+	<value value="55" name="A7XX_PERF_GBIF_RESERVED_55"/>
+	<value value="56" name="A7XX_PERF_GBIF_RESERVED_56"/>
+	<value value="57" name="A7XX_PERF_GBIF_RESERVED_57"/>
+	<value value="58" name="A7XX_PERF_GBIF_RESERVED_58"/>
+	<value value="59" name="A7XX_PERF_GBIF_RESERVED_59"/>
+	<value value="60" name="A7XX_PERF_GBIF_RESERVED_60"/>
+	<value value="61" name="A7XX_PERF_GBIF_RESERVED_61"/>
+	<value value="62" name="A7XX_PERF_GBIF_RESERVED_62"/>
+	<value value="63" name="A7XX_PERF_GBIF_RESERVED_63"/>
+	<value value="64" name="A7XX_PERF_GBIF_RESERVED_64"/>
+	<value value="65" name="A7XX_PERF_GBIF_RESERVED_65"/>
+	<value value="66" name="A7XX_PERF_GBIF_RESERVED_66"/>
+	<value value="67" name="A7XX_PERF_GBIF_RESERVED_67"/>
+	<value value="68" name="A7XX_PERF_GBIF_CYCLES_CH0_HELD_OFF_RD_ALL"/>
+	<value value="69" name="A7XX_PERF_GBIF_CYCLES_CH1_HELD_OFF_RD_ALL"/>
+	<value value="70" name="A7XX_PERF_GBIF_CYCLES_CH0_HELD_OFF_WR_ALL"/>
+	<value value="71" name="A7XX_PERF_GBIF_CYCLES_CH1_HELD_OFF_WR_ALL"/>
+	<value value="72" name="A7XX_PERF_GBIF_AXI_CH0_REQUEST_HELD_OFF"/>
+	<value value="73" name="A7XX_PERF_GBIF_AXI_CH1_REQUEST_HELD_OFF"/>
+	<value value="74" name="A7XX_PERF_GBIF_AXI_REQUEST_HELD_OFF"/>
+	<value value="75" name="A7XX_PERF_GBIF_AXI_CH0_WRITE_DATA_HELD_OFF"/>
+	<value value="76" name="A7XX_PERF_GBIF_AXI_CH1_WRITE_DATA_HELD_OFF"/>
+	<value value="77" name="A7XX_PERF_GBIF_AXI_ALL_WRITE_DATA_HELD_OFF"/>
+	<value value="78" name="A7XX_PERF_GBIF_AXI_ALL_READ_BEATS"/>
+	<value value="79" name="A7XX_PERF_GBIF_AXI_ALL_WRITE_BEATS"/>
+	<value value="80" name="A7XX_PERF_GBIF_AXI_ALL_BEATS"/>
+</enum>
+
+<enum name="a7xx_ufc_perfcounter_select">
+	<value value="0" name="A7XX_PERF_UFC_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_UFC_READ_DATA_VBIF"/>
+	<value value="2" name="A7XX_PERF_UFC_WRITE_DATA_VBIF"/>
+	<value value="3" name="A7XX_PERF_UFC_READ_REQUEST_VBIF"/>
+	<value value="4" name="A7XX_PERF_UFC_WRITE_REQUEST_VBIF"/>
+	<value value="5" name="A7XX_PERF_UFC_LRZ_FILTER_HIT"/>
+	<value value="6" name="A7XX_PERF_UFC_LRZ_FILTER_MISS"/>
+	<value value="7" name="A7XX_PERF_UFC_CRE_FILTER_HIT"/>
+	<value value="8" name="A7XX_PERF_UFC_CRE_FILTER_MISS"/>
+	<value value="9" name="A7XX_PERF_UFC_SP_FILTER_HIT"/>
+	<value value="10" name="A7XX_PERF_UFC_SP_FILTER_MISS"/>
+	<value value="11" name="A7XX_PERF_UFC_SP_REQUESTS"/>
+	<value value="12" name="A7XX_PERF_UFC_TP_FILTER_HIT"/>
+	<value value="13" name="A7XX_PERF_UFC_TP_FILTER_MISS"/>
+	<value value="14" name="A7XX_PERF_UFC_TP_REQUESTS"/>
+	<value value="15" name="A7XX_PERF_UFC_MAIN_HIT_LRZ_PREFETCH"/>
+	<value value="16" name="A7XX_PERF_UFC_MAIN_HIT_CRE_PREFETCH"/>
+	<value value="17" name="A7XX_PERF_UFC_MAIN_HIT_SP_PREFETCH"/>
+	<value value="18" name="A7XX_PERF_UFC_MAIN_HIT_TP_PREFETCH"/>
+	<value value="19" name="A7XX_PERF_UFC_MAIN_HIT_UBWC_READ"/>
+	<value value="20" name="A7XX_PERF_UFC_MAIN_HIT_UBWC_WRITE"/>
+	<value value="21" name="A7XX_PERF_UFC_MAIN_MISS_LRZ_PREFETCH"/>
+	<value value="22" name="A7XX_PERF_UFC_MAIN_MISS_CRE_PREFETCH"/>
+	<value value="23" name="A7XX_PERF_UFC_MAIN_MISS_SP_PREFETCH"/>
+	<value value="24" name="A7XX_PERF_UFC_MAIN_MISS_TP_PREFETCH"/>
+	<value value="25" name="A7XX_PERF_UFC_MAIN_MISS_UBWC_READ"/>
+	<value value="26" name="A7XX_PERF_UFC_MAIN_MISS_UBWC_WRITE"/>
+	<value value="27" name="A7XX_PERF_UFC_UBWC_READ_UFC_TRANS"/>
+	<value value="28" name="A7XX_PERF_UFC_UBWC_WRITE_UFC_TRANS"/>
+	<value value="29" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_CMD"/>
+	<value value="30" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_RDATA"/>
+	<value value="31" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_WDATA"/>
+	<value value="32" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_WR_FLAG"/>
+	<value value="33" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_FLAG_RTN"/>
+	<value value="34" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_EVENT"/>
+	<value value="35" name="A7XX_PERF_UFC_LRZ_PREFETCH_STALLED_CYCLES"/>
+	<value value="36" name="A7XX_PERF_UFC_CRE_PREFETCH_STALLED_CYCLES"/>
+	<value value="37" name="A7XX_PERF_UFC_SPTP_PREFETCH_STALLED_CYCLES"/>
+	<value value="38" name="A7XX_PERF_UFC_UBWC_RD_STALLED_CYCLES"/>
+	<value value="39" name="A7XX_PERF_UFC_UBWC_WR_STALLED_CYCLES"/>
+	<value value="40" name="A7XX_PERF_UFC_PREFETCH_STALLED_CYCLES"/>
+	<value value="41" name="A7XX_PERF_UFC_EVICTION_STALLED_CYCLES"/>
+	<value value="42" name="A7XX_PERF_UFC_LOCK_STALLED_CYCLES"/>
+	<value value="43" name="A7XX_PERF_UFC_MISS_LATENCY_CYCLES"/>
+	<value value="44" name="A7XX_PERF_UFC_MISS_LATENCY_SAMPLES"/>
+	<value value="45" name="A7XX_PERF_UFC_UBWC_REQ_STALLED_CYCLES"/>
+	<value value="46" name="A7XX_PERF_UFC_TP_HINT_TAG_MISS"/>
+	<value value="47" name="A7XX_PERF_UFC_TP_HINT_TAG_HIT_RDY"/>
+	<value value="48" name="A7XX_PERF_UFC_TP_HINT_TAG_HIT_NRDY"/>
+	<value value="49" name="A7XX_PERF_UFC_TP_HINT_IS_FCLEAR"/>
+	<value value="50" name="A7XX_PERF_UFC_TP_HINT_IS_ALPHA0"/>
+	<value value="51" name="A7XX_PERF_UFC_SP_L1_FILTER_HIT"/>
+	<value value="52" name="A7XX_PERF_UFC_SP_L1_FILTER_MISS"/>
+	<value value="53" name="A7XX_PERF_UFC_SP_L1_FILTER_REQUESTS"/>
+	<value value="54" name="A7XX_PERF_UFC_TP_L1_TAG_HIT_RDY"/>
+	<value value="55" name="A7XX_PERF_UFC_TP_L1_TAG_HIT_NRDY"/>
+	<value value="56" name="A7XX_PERF_UFC_TP_L1_TAG_MISS"/>
+	<value value="57" name="A7XX_PERF_UFC_TP_L1_FILTER_REQUESTS"/>
+</enum>
+
+<domain name="A6XX" width="32" prefix="variant" varset="chip">
+	<bitset name="A6XX_RBBM_INT_0_MASK" inline="no" varset="chip">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="CP_IPC_INTR_0" pos="4" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_IPC_INTR_1" pos="5" type="boolean" variants="A7XX-"/>
+		<bitfield name="RBBM_ATB_ASYNCFIFO_OVERFLOW" pos="6" type="boolean"/>
+		<bitfield name="RBBM_GPC_ERROR" pos="7" type="boolean"/>
+		<bitfield name="CP_SW" pos="8" type="boolean"/>
+		<bitfield name="CP_HW_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_DEPTH_TS" pos="10" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_COLOR_TS" pos="11" type="boolean"/>
+		<bitfield name="CP_CCU_RESOLVE_TS" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1" pos="14" type="boolean"/>
+		<bitfield name="CP_RB" pos="15" type="boolean" variants="A6XX"/>
+		<!-- Same as above but different name??: -->
+		<bitfield name="PM4CPINTERRUPT" pos="15" type="boolean" variants="A7XX-"/>
+		<bitfield name="PM4CPINTERRUPTLPAC" pos="16" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_WT_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="CP_CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="CP_CACHE_FLUSH_TS_LPAC" pos="21" type="boolean" variants="A7XX-"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="22" type="boolean"/>
+		<bitfield name="RBBM_HANG_DETECT" pos="23" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="24" type="boolean"/>
+		<bitfield name="UCHE_TRAP_INTR" pos="25" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_0" pos="26" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_1" pos="27" type="boolean"/>
+		<bitfield name="TSBWRITEERROR" pos="28" type="boolean" variants="A7XX-"/>
+		<bitfield name="SWFUSEVIOLATION" pos="29" type="boolean" variants="A7XX-"/>
+		<bitfield name="ISDB_CPU_IRQ" pos="30" type="boolean"/>
+		<bitfield name="ISDB_UNDER_DEBUG" pos="31" type="boolean"/>
+	</bitset>
+
+	<!--
+		Note the _LPAC bits probably *actually* first appeared in a660, but the
+		_BV bits are new in a7xx
+	 -->
+	<bitset name="A6XX_CP_INT" varset="chip">
+		<bitfield name="CP_OPCODE_ERROR" pos="0" type="boolean"/>
+		<bitfield name="CP_UCODE_ERROR" pos="1" type="boolean"/>
+		<bitfield name="CP_HW_FAULT_ERROR" pos="2" type="boolean"/>
+		<bitfield name="CP_REGISTER_PROTECTION_ERROR" pos="4" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR" pos="5" type="boolean"/>
+		<bitfield name="CP_VSD_PARITY_ERROR" pos="6" type="boolean"/>
+		<bitfield name="CP_ILLEGAL_INSTR_ERROR" pos="7" type="boolean"/>
+		<bitfield name="CP_OPCODE_ERROR_LPAC" pos="8" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_UCODE_ERROR_LPAC" pos="9" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_HW_FAULT_ERROR_LPAC" pos="10" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_REGISTER_PROTECTION_ERROR_LPAC" pos="11" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_ILLEGAL_INSTR_ERROR_LPAC" pos="12" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_OPCODE_ERROR_BV" pos="13" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_UCODE_ERROR_BV" pos="14" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_HW_FAULT_ERROR_BV" pos="15" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_REGISTER_PROTECTION_ERROR_BV" pos="16" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_ILLEGAL_INSTR_ERROR_BV" pos="17" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<reg64 offset="0x0800" name="CP_RB_BASE"/>
+	<reg32 offset="0x0802" name="CP_RB_CNTL"/>
+	<reg64 offset="0x0804" name="CP_RB_RPTR_ADDR"/>
+	<reg32 offset="0x0806" name="CP_RB_RPTR"/>
+	<reg32 offset="0x0807" name="CP_RB_WPTR"/>
+	<reg32 offset="0x0808" name="CP_SQE_CNTL"/>
+	<reg32 offset="0x0812" name="CP_CP2GMU_STATUS">
+		<bitfield name="IFPC" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0821" name="CP_HW_FAULT"/>
+	<reg32 offset="0x0823" name="CP_INTERRUPT_STATUS" type="A6XX_CP_INT"/>
+	<reg32 offset="0x0824" name="CP_PROTECT_STATUS"/>
+	<reg32 offset="0x0825" name="CP_STATUS_1"/>
+	<reg64 offset="0x0830" name="CP_SQE_INSTR_BASE"/>
+	<reg32 offset="0x0840" name="CP_MISC_CNTL"/>
+	<reg32 offset="0x0844" name="CP_APRIV_CNTL">
+		<!-- Crashdumper writes -->
+		<bitfield pos="6" name="CDWRITE" type="boolean"/>
+		<!-- Crashdumper reads -->
+		<bitfield pos="5" name="CDREAD" type="boolean"/>
+
+		<!-- 4 is unknown -->
+
+		<!-- RPTR shadow writes -->
+		<bitfield pos="3" name="RBRPWB" type="boolean"/>
+		<!-- Memory accesses from PM4 packets in the ringbuffer -->
+		<bitfield pos="2" name="RBPRIVLEVEL" type="boolean"/>
+		<!-- Ringbuffer reads -->
+		<bitfield pos="1" name="RBFETCH" type="boolean"/>
+		<!-- Instruction cache fetches -->
+		<bitfield pos="0" name="ICACHE" type="boolean"/>
+	</reg32>
+	<!-- Preemptions taking longer than this threshold increment PERF_CP_LONG_PREEMPTIONS: -->
+	<reg32 offset="0x08C0" name="CP_PREEMPT_THRESHOLD"/>
+	<!-- all the threshold values seem to be in units of quad-dwords: -->
+	<reg32 offset="0x08C1" name="CP_ROQ_THRESHOLDS_1">
+		<doc>
+			b0..7 identifies where MRB data starts (and RB data ends)
+			b8.15 identifies where VSD data starts (and MRB data ends)
+			b16..23 identifies where IB1 data starts (and RB data ends)
+			b24..31 identifies where IB2 data starts (and IB1 data ends)
+		</doc>
+		<bitfield name="MRB_START" low="0" high="7" shr="2"/>
+		<bitfield name="VSD_START" low="8" high="15" shr="2"/>
+		<bitfield name="IB1_START" low="16" high="23" shr="2"/>
+		<bitfield name="IB2_START" low="24" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="0x08C2" name="CP_ROQ_THRESHOLDS_2">
+		<doc>
+			low bits identify where CP_SET_DRAW_STATE stateobj
+			processing starts (and IB2 data ends). I'm guessing
+			b8 is part of this since (from downstream kgsl):
+
+				/* ROQ sizes are twice as big on a640/a680 than on a630 */
+				if (adreno_is_a640(adreno_dev) || adreno_is_a680(adreno_dev)) {
+					kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_2, 0x02000140);
+					kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_1, 0x8040362C);
+				} ...
+		</doc>
+		<bitfield name="SDS_START" low="0" high="8" shr="2"/>
+		<!-- total ROQ size: -->
+		<bitfield name="ROQ_SIZE" low="16" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="0x08C3" name="CP_MEM_POOL_SIZE"/>
+	<reg32 offset="0x0841" name="CP_CHICKEN_DBG"/>
+	<reg32 offset="0x0842" name="CP_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0843" name="CP_DBG_ECO_CNTL"/>
+	<reg32 offset="0x084F" name="CP_PROTECT_CNTL">
+		<bitfield pos="3" name="LAST_SPAN_INF_RANGE" type="boolean"/>
+		<bitfield pos="1" name="ACCESS_FAULT_ON_VIOL_EN" type="boolean"/>
+		<bitfield pos="0" name="ACCESS_PROT_EN" type="boolean"/>
+	</reg32>
+
+	<array offset="0x0883" name="CP_SCRATCH" stride="1" length="8">
+		<reg32 offset="0x0" name="REG" type="uint"/>
+	</array>
+	<array offset="0x0850" name="CP_PROTECT" stride="1" length="32">
+		<reg32 offset="0x0" name="REG" type="a6x_cp_protect"/>
+	</array>
+
+	<reg32 offset="0x08A0" name="CP_CONTEXT_SWITCH_CNTL">
+		<bitfield name="STOP" pos="0" type="boolean"/>
+		<bitfield name="LEVEL" low="6" high="7"/>
+		<bitfield name="USES_GMEM" pos="8" type="boolean"/>
+		<bitfield name="SKIP_SAVE_RESTORE" pos="9" type="boolean"/>
+	</reg32>
+	<reg64 offset="0x08A1" name="CP_CONTEXT_SWITCH_SMMU_INFO"/>
+	<reg64 offset="0x08A3" name="CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR"/>
+	<reg64 offset="0x08A5" name="CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR"/>
+	<reg64 offset="0x08A7" name="CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR"/>
+	<reg32 offset="0x08ab" name="CP_CONTEXT_SWITCH_LEVEL_STATUS" variants="A7XX-"/>
+	<array offset="0x08D0" name="CP_PERFCTR_CP_SEL" stride="1" length="14"/>
+	<array offset="0x08e0" name="CP_BV_PERFCTR_CP_SEL" stride="1" length="7" variants="A7XX-"/>
+	<reg64 offset="0x0900" name="CP_CRASH_SCRIPT_BASE"/>
+	<reg32 offset="0x0902" name="CP_CRASH_DUMP_CNTL"/>
+	<reg32 offset="0x0903" name="CP_CRASH_DUMP_STATUS"/>
+	<reg32 offset="0x0908" name="CP_SQE_STAT_ADDR"/>
+	<reg32 offset="0x0909" name="CP_SQE_STAT_DATA"/>
+	<reg32 offset="0x090A" name="CP_DRAW_STATE_ADDR"/>
+	<reg32 offset="0x090B" name="CP_DRAW_STATE_DATA"/>
+	<reg32 offset="0x090C" name="CP_ROQ_DBG_ADDR"/>
+	<reg32 offset="0x090D" name="CP_ROQ_DBG_DATA"/>
+	<reg32 offset="0x090E" name="CP_MEM_POOL_DBG_ADDR"/>
+	<reg32 offset="0x090F" name="CP_MEM_POOL_DBG_DATA"/>
+	<reg32 offset="0x0910" name="CP_SQE_UCODE_DBG_ADDR"/>
+	<reg32 offset="0x0911" name="CP_SQE_UCODE_DBG_DATA"/>
+	<reg64 offset="0x0928" name="CP_IB1_BASE"/>
+	<reg32 offset="0x092A" name="CP_IB1_REM_SIZE"/>
+	<reg64 offset="0x092B" name="CP_IB2_BASE"/>
+	<reg32 offset="0x092D" name="CP_IB2_REM_SIZE"/>
+	<!-- SDS == CP_SET_DRAW_STATE: -->
+	<reg64 offset="0x092e" name="CP_SDS_BASE"/>
+	<reg32 offset="0x0930" name="CP_SDS_REM_SIZE"/>
+	<!-- MRB == MEM_READ_ADDR/$addr in SQE firmware -->
+	<reg64 offset="0x0931" name="CP_MRB_BASE"/>
+	<reg32 offset="0x0933" name="CP_MRB_REM_SIZE"/>
+	<!--
+	VSD == Visibility Stream Decode
+	This is used by CP to read the draw stream and skip empty draws
+	-->
+	<reg64 offset="0x0934" name="CP_VSD_BASE"/>
+
+	<bitset name="a6xx_roq_stat" inline="yes">
+		<bitfield name="RPTR" low="0" high="9"/>
+		<bitfield name="WPTR" low="16" high="25"/>
+	</bitset>
+	<reg32 offset="0x0939" name="CP_ROQ_RB_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093a" name="CP_ROQ_IB1_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093b" name="CP_ROQ_IB2_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093c" name="CP_ROQ_SDS_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093d" name="CP_ROQ_MRB_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093e" name="CP_ROQ_VSD_STAT" type="a6xx_roq_stat"/>
+
+	<reg32 offset="0x0943" name="CP_IB1_DWORDS"/>
+	<reg32 offset="0x0944" name="CP_IB2_DWORDS"/>
+	<reg32 offset="0x0945" name="CP_SDS_DWORDS"/>
+	<reg32 offset="0x0946" name="CP_MRB_DWORDS"/>
+	<reg32 offset="0x0947" name="CP_VSD_DWORDS"/>
+
+	<reg32 offset="0x0948" name="CP_ROQ_AVAIL_RB">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x0949" name="CP_ROQ_AVAIL_IB1">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x094a" name="CP_ROQ_AVAIL_IB2">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x094b" name="CP_ROQ_AVAIL_SDS">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x094c" name="CP_ROQ_AVAIL_MRB">
+		<doc>number of dwords that have already been read but haven't been consumed by $addr</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x094d" name="CP_ROQ_AVAIL_VSD">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+
+	<bitset name="a7xx_aperture_cntl" inline="yes">
+		<bitfield name="PIPE" low="12" high="13" type="a7xx_pipe"/>
+		<bitfield name="CLUSTER" low="8" high="10" type="a7xx_cluster"/>
+		<bitfield name="CONTEXT" low="4" high="5"/>
+	</bitset>
+	<reg64 offset="0x0980" name="CP_ALWAYS_ON_COUNTER"/>
+	<reg32 offset="0x098D" name="CP_AHB_CNTL"/>
+	<reg32 offset="0x0A00" name="CP_APERTURE_CNTL_HOST" variants="A6XX"/>
+	<reg32 offset="0x0A00" name="CP_APERTURE_CNTL_HOST" type="a7xx_aperture_cntl" variants="A7XX-"/>
+	<reg32 offset="0x0A03" name="CP_APERTURE_CNTL_CD" variants="A6XX"/>
+	<reg32 offset="0x0A03" name="CP_APERTURE_CNTL_CD" type="a7xx_aperture_cntl" variants="A7XX-"/>
+
+	<reg32 offset="0x0a61" name="CP_BV_PROTECT_STATUS" variants="A7XX-"/>
+	<reg32 offset="0x0a64" name="CP_BV_HW_FAULT" variants="A7XX-"/>
+	<reg32 offset="0x0a81" name="CP_BV_DRAW_STATE_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a82" name="CP_BV_DRAW_STATE_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0a83" name="CP_BV_ROQ_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a84" name="CP_BV_ROQ_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0a85" name="CP_BV_SQE_UCODE_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a86" name="CP_BV_SQE_UCODE_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0a87" name="CP_BV_SQE_STAT_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a88" name="CP_BV_SQE_STAT_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0a96" name="CP_BV_MEM_POOL_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a97" name="CP_BV_MEM_POOL_DBG_DATA" variants="A7XX-"/>
+	<reg64 offset="0x0a98" name="CP_BV_RB_RPTR_ADDR" variants="A7XX-"/>
+
+	<reg32 offset="0x0a9a" name="CP_RESOURCE_TBL_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a9b" name="CP_RESOURCE_TBL_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0ad0" name="CP_BV_APRIV_CNTL" variants="A7XX-"/>
+	<reg32 offset="0x0ada" name="CP_BV_CHICKEN_DBG" variants="A7XX-"/>
+
+	<reg32 offset="0x0b0a" name="CP_LPAC_DRAW_STATE_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b0b" name="CP_LPAC_DRAW_STATE_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0b0c" name="CP_LPAC_ROQ_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b27" name="CP_SQE_AC_UCODE_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b28" name="CP_SQE_AC_UCODE_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0b29" name="CP_SQE_AC_STAT_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b2a" name="CP_SQE_AC_STAT_DATA" variants="A7XX-"/>
+
+	<reg32 offset="0x0b31" name="CP_LPAC_APRIV_CNTL" variants="A7XX-"/>
+	<reg32 offset="0x0B34" name="CP_LPAC_PROG_FIFO_SIZE"/>
+	<reg32 offset="0x0b35" name="CP_LPAC_ROQ_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0b36" name="CP_LPAC_FIFO_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0b40" name="CP_LPAC_FIFO_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b81" name="CP_LPAC_SQE_CNTL"/>
+	<reg64 offset="0x0b82" name="CP_LPAC_SQE_INSTR_BASE"/>
+
+	<reg64 offset="0x0b70" name="CP_AQE_INSTR_BASE_0" variants="A7XX-"/>
+	<reg64 offset="0x0b72" name="CP_AQE_INSTR_BASE_1" variants="A7XX-"/>
+	<reg32 offset="0x0b78" name="CP_AQE_APRIV_CNTL" variants="A7XX-"/>
+
+	<reg32 offset="0x0ba8" name="CP_AQE_ROQ_DBG_ADDR_0" variants="A7XX-"/>
+	<reg32 offset="0x0ba9" name="CP_AQE_ROQ_DBG_ADDR_1" variants="A7XX-"/>
+	<reg32 offset="0x0bac" name="CP_AQE_ROQ_DBG_DATA_0" variants="A7XX-"/>
+	<reg32 offset="0x0bad" name="CP_AQE_ROQ_DBG_DATA_1" variants="A7XX-"/>
+	<reg32 offset="0x0bb0" name="CP_AQE_UCODE_DBG_ADDR_0" variants="A7XX-"/>
+	<reg32 offset="0x0bb1" name="CP_AQE_UCODE_DBG_ADDR_1" variants="A7XX-"/>
+	<reg32 offset="0x0bb4" name="CP_AQE_UCODE_DBG_DATA_0" variants="A7XX-"/>
+	<reg32 offset="0x0bb5" name="CP_AQE_UCODE_DBG_DATA_1" variants="A7XX-"/>
+	<reg32 offset="0x0bb8" name="CP_AQE_STAT_ADDR_0" variants="A7XX-"/>
+	<reg32 offset="0x0bb9" name="CP_AQE_STAT_ADDR_1" variants="A7XX-"/>
+	<reg32 offset="0x0bbc" name="CP_AQE_STAT_DATA_0" variants="A7XX-"/>
+	<reg32 offset="0x0bbd" name="CP_AQE_STAT_DATA_1" variants="A7XX-"/>
+
+	<reg32 offset="0x0C01" name="VSC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0018" name="RBBM_GPR0_CNTL"/>
+	<reg32 offset="0x0201" name="RBBM_INT_0_STATUS" type="A6XX_RBBM_INT_0_MASK"/>
+	<reg32 offset="0x0210" name="RBBM_STATUS">
+		<bitfield pos="23" name="GPU_BUSY_IGN_AHB" type="boolean"/>
+		<bitfield pos="22" name="GPU_BUSY_IGN_AHB_CP" type="boolean"/>
+		<bitfield pos="21" name="HLSQ_BUSY" type="boolean"/>
+		<bitfield pos="20" name="VSC_BUSY" type="boolean"/>
+		<bitfield pos="19" name="TPL1_BUSY" type="boolean"/>
+		<bitfield pos="18" name="SP_BUSY" type="boolean"/>
+		<bitfield pos="17" name="UCHE_BUSY" type="boolean"/>
+		<bitfield pos="16" name="VPC_BUSY" type="boolean"/>
+		<bitfield pos="15" name="VFD_BUSY" type="boolean"/>
+		<bitfield pos="14" name="TESS_BUSY" type="boolean"/>
+		<bitfield pos="13" name="PC_VSD_BUSY" type="boolean"/>
+		<bitfield pos="12" name="PC_DCALL_BUSY" type="boolean"/>
+		<bitfield pos="11" name="COM_DCOM_BUSY" type="boolean"/>
+		<bitfield pos="10" name="LRZ_BUSY" type="boolean"/>
+		<bitfield pos="9"  name="A2D_BUSY" type="boolean"/>
+		<bitfield pos="8"  name="CCU_BUSY" type="boolean"/>
+		<bitfield pos="7"  name="RB_BUSY" type="boolean"/>
+		<bitfield pos="6"  name="RAS_BUSY" type="boolean"/>
+		<bitfield pos="5"  name="TSE_BUSY" type="boolean"/>
+		<bitfield pos="4"  name="VBIF_BUSY" type="boolean"/>
+		<bitfield pos="3"  name="GFX_DBGC_BUSY" type="boolean"/>
+		<bitfield pos="2"  name="CP_BUSY" type="boolean"/>
+		<bitfield pos="1"  name="CP_AHB_BUSY_CP_MASTER" type="boolean"/>
+		<bitfield pos="0"  name="CP_AHB_BUSY_CX_MASTER" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0211" name="RBBM_STATUS1"/>
+	<reg32 offset="0x0212" name="RBBM_STATUS2"/>
+	<reg32 offset="0x0213" name="RBBM_STATUS3">
+		<bitfield pos="24" name="SMMU_STALLED_ON_FAULT" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0215" name="RBBM_VBIF_GX_RESET_STATUS"/>
+
+	<reg32 offset="0x0260" name="RBBM_CLOCK_MODE_CP" variants="A7XX-"/>
+	<reg32 offset="0x0284" name="RBBM_CLOCK_MODE_BV_LRZ" variants="A7XX-"/>
+	<reg32 offset="0x0285" name="RBBM_CLOCK_MODE_BV_GRAS" variants="A7XX-"/>
+	<reg32 offset="0x0286" name="RBBM_CLOCK_MODE2_GRAS" variants="A7XX-"/>
+	<reg32 offset="0x0287" name="RBBM_CLOCK_MODE_BV_VFD" variants="A7XX-"/>
+	<reg32 offset="0x0288" name="RBBM_CLOCK_MODE_BV_GPC" variants="A7XX-"/>
+
+	<reg32 offset="0x02c0" name="RBBM_SW_FUSE_INT_STATUS" variants="A7XX-"/>
+	<reg32 offset="0x02c1" name="RBBM_SW_FUSE_INT_MASK" variants="A7XX-"/>
+
+	<array offset="0x0400" name="RBBM_PERFCTR_CP" stride="2" length="14" variants="A6XX"/>
+	<array offset="0x041c" name="RBBM_PERFCTR_RBBM" stride="2" length="4" variants="A6XX"/>
+	<array offset="0x0424" name="RBBM_PERFCTR_PC" stride="2" length="8" variants="A6XX"/>
+	<array offset="0x0434" name="RBBM_PERFCTR_VFD" stride="2" length="8" variants="A6XX"/>
+	<array offset="0x0444" name="RBBM_PERFCTR_HLSQ" stride="2" length="6" variants="A6XX"/>
+	<array offset="0x0450" name="RBBM_PERFCTR_VPC" stride="2" length="6" variants="A6XX"/>
+	<array offset="0x045c" name="RBBM_PERFCTR_CCU" stride="2" length="5" variants="A6XX"/>
+	<array offset="0x0466" name="RBBM_PERFCTR_TSE" stride="2" length="4" variants="A6XX"/>
+	<array offset="0x046e" name="RBBM_PERFCTR_RAS" stride="2" length="4" variants="A6XX"/>
+	<array offset="0x0476" name="RBBM_PERFCTR_UCHE" stride="2" length="12" variants="A6XX"/>
+	<array offset="0x048e" name="RBBM_PERFCTR_TP" stride="2" length="12" variants="A6XX"/>
+	<array offset="0x04a6" name="RBBM_PERFCTR_SP" stride="2" length="24" variants="A6XX"/>
+	<array offset="0x04d6" name="RBBM_PERFCTR_RB" stride="2" length="8" variants="A6XX"/>
+	<array offset="0x04e6" name="RBBM_PERFCTR_VSC" stride="2" length="2" variants="A6XX"/>
+	<array offset="0x04ea" name="RBBM_PERFCTR_LRZ" stride="2" length="4" variants="A6XX"/>
+	<array offset="0x04f2" name="RBBM_PERFCTR_CMP" stride="2" length="4" variants="A6XX"/>
+
+	<array offset="0x0300" name="RBBM_PERFCTR_CP" stride="2" length="14" variants="A7XX-"/>
+	<array offset="0x031c" name="RBBM_PERFCTR_RBBM" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x0324" name="RBBM_PERFCTR_PC" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x0334" name="RBBM_PERFCTR_VFD" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x0344" name="RBBM_PERFCTR_HLSQ" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x0350" name="RBBM_PERFCTR_VPC" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x035c" name="RBBM_PERFCTR_CCU" stride="2" length="5" variants="A7XX-"/>
+	<array offset="0x0366" name="RBBM_PERFCTR_TSE" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x036e" name="RBBM_PERFCTR_RAS" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x0376" name="RBBM_PERFCTR_UCHE" stride="2" length="12" variants="A7XX-"/>
+	<array offset="0x038e" name="RBBM_PERFCTR_TP" stride="2" length="12" variants="A7XX-"/>
+	<array offset="0x03a6" name="RBBM_PERFCTR_SP" stride="2" length="24" variants="A7XX-"/>
+	<array offset="0x03d6" name="RBBM_PERFCTR_RB" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x03e6" name="RBBM_PERFCTR_VSC" stride="2" length="2" variants="A7XX-"/>
+	<array offset="0x03ea" name="RBBM_PERFCTR_LRZ" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x03f2" name="RBBM_PERFCTR_CMP" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x03fa" name="RBBM_PERFCTR_UFC" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x0410" name="RBBM_PERFCTR2_HLSQ" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x041c" name="RBBM_PERFCTR2_CP" stride="2" length="7" variants="A7XX-"/>
+	<array offset="0x042a" name="RBBM_PERFCTR2_SP" stride="2" length="12" variants="A7XX-"/>
+	<array offset="0x0442" name="RBBM_PERFCTR2_TP" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x044e" name="RBBM_PERFCTR2_UFC" stride="2" length="2" variants="A7XX-"/>
+	<array offset="0x0460" name="RBBM_PERFCTR_BV_PC" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x0470" name="RBBM_PERFCTR_BV_VFD" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x0480" name="RBBM_PERFCTR_BV_VPC" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x048c" name="RBBM_PERFCTR_BV_TSE" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x0494" name="RBBM_PERFCTR_BV_RAS" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x049c" name="RBBM_PERFCTR_BV_LRZ" stride="2" length="4" variants="A7XX-"/>
+
+	<reg32 offset="0x0500" name="RBBM_PERFCTR_CNTL"/>
+	<reg32 offset="0x0501" name="RBBM_PERFCTR_LOAD_CMD0"/>
+	<reg32 offset="0x0502" name="RBBM_PERFCTR_LOAD_CMD1"/>
+	<reg32 offset="0x0503" name="RBBM_PERFCTR_LOAD_CMD2"/>
+	<reg32 offset="0x0504" name="RBBM_PERFCTR_LOAD_CMD3"/>
+	<reg32 offset="0x0505" name="RBBM_PERFCTR_LOAD_VALUE_LO"/>
+	<reg32 offset="0x0506" name="RBBM_PERFCTR_LOAD_VALUE_HI"/>
+	<array offset="0x0507" name="RBBM_PERFCTR_RBBM_SEL" stride="1" length="4"/>
+	<reg32 offset="0x050B" name="RBBM_PERFCTR_GPU_BUSY_MASKED"/>
+	<reg32 offset="0x050e" name="RBBM_PERFCTR_SRAM_INIT_CMD"/>
+	<reg32 offset="0x050f" name="RBBM_PERFCTR_SRAM_INIT_STATUS"/>
+	<reg32 offset="0x0533" name="RBBM_ISDB_CNT"/>
+	<reg32 offset="0x0534" name="RBBM_NC_MODE_CNTL"/>
+	<reg32 offset="0x0535" name="RBBM_SNAPSHOT_STATUS" variants="A7XX-"/>
+
+	<!---
+	    This block of registers aren't tied to perf counters. They
+	    count various geometry stats, for example number of
+	    vertices in, number of primnitives assembled etc.
+	-->
+
+	<reg32 offset="0x0540" name="RBBM_PRIMCTR_0_LO"/>  <!-- vs vertices in -->
+	<reg32 offset="0x0541" name="RBBM_PRIMCTR_0_HI"/>
+	<reg32 offset="0x0542" name="RBBM_PRIMCTR_1_LO"/>  <!-- vs primitives out -->
+	<reg32 offset="0x0543" name="RBBM_PRIMCTR_1_HI"/>
+	<reg32 offset="0x0544" name="RBBM_PRIMCTR_2_LO"/>  <!-- hs vertices in -->
+	<reg32 offset="0x0545" name="RBBM_PRIMCTR_2_HI"/>
+	<reg32 offset="0x0546" name="RBBM_PRIMCTR_3_LO"/>  <!-- hs patches out -->
+	<reg32 offset="0x0547" name="RBBM_PRIMCTR_3_HI"/>
+	<reg32 offset="0x0548" name="RBBM_PRIMCTR_4_LO"/>  <!-- dss vertices in -->
+	<reg32 offset="0x0549" name="RBBM_PRIMCTR_4_HI"/>
+	<reg32 offset="0x054a" name="RBBM_PRIMCTR_5_LO"/>  <!-- ds primitives out -->
+	<reg32 offset="0x054b" name="RBBM_PRIMCTR_5_HI"/>
+	<reg32 offset="0x054c" name="RBBM_PRIMCTR_6_LO"/>  <!-- gs primitives in -->
+	<reg32 offset="0x054d" name="RBBM_PRIMCTR_6_HI"/>
+	<reg32 offset="0x054e" name="RBBM_PRIMCTR_7_LO"/>  <!-- gs primitives out -->
+	<reg32 offset="0x054f" name="RBBM_PRIMCTR_7_HI"/>
+	<reg32 offset="0x0550" name="RBBM_PRIMCTR_8_LO"/>  <!-- gs primitives out -->
+	<reg32 offset="0x0551" name="RBBM_PRIMCTR_8_HI"/>
+	<reg32 offset="0x0552" name="RBBM_PRIMCTR_9_LO"/>  <!-- raster primitives in -->
+	<reg32 offset="0x0553" name="RBBM_PRIMCTR_9_HI"/>
+	<reg32 offset="0x0554" name="RBBM_PRIMCTR_10_LO"/>
+	<reg32 offset="0x0555" name="RBBM_PRIMCTR_10_HI"/>
+
+	<reg32 offset="0xF400" name="RBBM_SECVID_TRUST_CNTL"/>
+	<reg64 offset="0xF800" name="RBBM_SECVID_TSB_TRUSTED_BASE"/>
+	<reg32 offset="0xF802" name="RBBM_SECVID_TSB_TRUSTED_SIZE"/>
+	<reg32 offset="0xF803" name="RBBM_SECVID_TSB_CNTL"/>
+	<reg32 offset="0xF810" name="RBBM_SECVID_TSB_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg64 offset="0xfc00" name="RBBM_SECVID_TSB_STATUS" variants="A7XX-"/>
+	<reg32 offset="0x00010" name="RBBM_VBIF_CLIENT_QOS_CNTL"/>
+	<reg32 offset="0x00011" name="RBBM_GBIF_CLIENT_QOS_CNTL"/>
+	<reg32 offset="0x00016" name="RBBM_GBIF_HALT"/>
+	<reg32 offset="0x00017" name="RBBM_GBIF_HALT_ACK"/>
+	<reg32 offset="0x0001c" name="RBBM_WAIT_FOR_GPU_IDLE_CMD">
+		<bitfield pos="0" name="WAIT_GPU_IDLE" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00016" name="RBBM_GBIF_HALT" variants="A7XX-"/>
+	<reg32 offset="0x00017" name="RBBM_GBIF_HALT_ACK" variants="A7XX-"/>
+	<reg32 offset="0x0001f" name="RBBM_INTERFACE_HANG_INT_CNTL"/>
+	<reg32 offset="0x00037" name="RBBM_INT_CLEAR_CMD" type="A6XX_RBBM_INT_0_MASK"/>
+	<reg32 offset="0x00038" name="RBBM_INT_0_MASK" type="A6XX_RBBM_INT_0_MASK"/>
+	<reg32 offset="0x0003a" name="RBBM_INT_2_MASK" variants="A7XX-"/>
+	<reg32 offset="0x00042" name="RBBM_SP_HYST_CNT"/>
+	<reg32 offset="0x00043" name="RBBM_SW_RESET_CMD"/>
+	<reg32 offset="0x00044" name="RBBM_RAC_THRESHOLD_CNT"/>
+	<reg32 offset="0x00045" name="RBBM_BLOCK_SW_RESET_CMD"/>
+	<reg32 offset="0x00046" name="RBBM_BLOCK_SW_RESET_CMD2"/>
+	<reg32 offset="0x000ad" name="RBBM_CLOCK_CNTL_GLOBAL" variants="A7XX-"/>
+	<reg32 offset="0x000ae" name="RBBM_CLOCK_CNTL"/>
+	<reg32 offset="0x000b0" name="RBBM_CLOCK_CNTL_SP0"/>
+	<reg32 offset="0x000b1" name="RBBM_CLOCK_CNTL_SP1"/>
+	<reg32 offset="0x000b2" name="RBBM_CLOCK_CNTL_SP2"/>
+	<reg32 offset="0x000b3" name="RBBM_CLOCK_CNTL_SP3"/>
+	<reg32 offset="0x000b4" name="RBBM_CLOCK_CNTL2_SP0"/>
+	<reg32 offset="0x000b5" name="RBBM_CLOCK_CNTL2_SP1"/>
+	<reg32 offset="0x000b6" name="RBBM_CLOCK_CNTL2_SP2"/>
+	<reg32 offset="0x000b7" name="RBBM_CLOCK_CNTL2_SP3"/>
+	<reg32 offset="0x000b8" name="RBBM_CLOCK_DELAY_SP0"/>
+	<reg32 offset="0x000b9" name="RBBM_CLOCK_DELAY_SP1"/>
+	<reg32 offset="0x000ba" name="RBBM_CLOCK_DELAY_SP2"/>
+	<reg32 offset="0x000bb" name="RBBM_CLOCK_DELAY_SP3"/>
+	<reg32 offset="0x000bc" name="RBBM_CLOCK_HYST_SP0"/>
+	<reg32 offset="0x000bd" name="RBBM_CLOCK_HYST_SP1"/>
+	<reg32 offset="0x000be" name="RBBM_CLOCK_HYST_SP2"/>
+	<reg32 offset="0x000bf" name="RBBM_CLOCK_HYST_SP3"/>
+	<reg32 offset="0x000c0" name="RBBM_CLOCK_CNTL_TP0"/>
+	<reg32 offset="0x000c1" name="RBBM_CLOCK_CNTL_TP1"/>
+	<reg32 offset="0x000c2" name="RBBM_CLOCK_CNTL_TP2"/>
+	<reg32 offset="0x000c3" name="RBBM_CLOCK_CNTL_TP3"/>
+	<reg32 offset="0x000c4" name="RBBM_CLOCK_CNTL2_TP0"/>
+	<reg32 offset="0x000c5" name="RBBM_CLOCK_CNTL2_TP1"/>
+	<reg32 offset="0x000c6" name="RBBM_CLOCK_CNTL2_TP2"/>
+	<reg32 offset="0x000c7" name="RBBM_CLOCK_CNTL2_TP3"/>
+	<reg32 offset="0x000c8" name="RBBM_CLOCK_CNTL3_TP0"/>
+	<reg32 offset="0x000c9" name="RBBM_CLOCK_CNTL3_TP1"/>
+	<reg32 offset="0x000ca" name="RBBM_CLOCK_CNTL3_TP2"/>
+	<reg32 offset="0x000cb" name="RBBM_CLOCK_CNTL3_TP3"/>
+	<reg32 offset="0x000cc" name="RBBM_CLOCK_CNTL4_TP0"/>
+	<reg32 offset="0x000cd" name="RBBM_CLOCK_CNTL4_TP1"/>
+	<reg32 offset="0x000ce" name="RBBM_CLOCK_CNTL4_TP2"/>
+	<reg32 offset="0x000cf" name="RBBM_CLOCK_CNTL4_TP3"/>
+	<reg32 offset="0x000d0" name="RBBM_CLOCK_DELAY_TP0"/>
+	<reg32 offset="0x000d1" name="RBBM_CLOCK_DELAY_TP1"/>
+	<reg32 offset="0x000d2" name="RBBM_CLOCK_DELAY_TP2"/>
+	<reg32 offset="0x000d3" name="RBBM_CLOCK_DELAY_TP3"/>
+	<reg32 offset="0x000d4" name="RBBM_CLOCK_DELAY2_TP0"/>
+	<reg32 offset="0x000d5" name="RBBM_CLOCK_DELAY2_TP1"/>
+	<reg32 offset="0x000d6" name="RBBM_CLOCK_DELAY2_TP2"/>
+	<reg32 offset="0x000d7" name="RBBM_CLOCK_DELAY2_TP3"/>
+	<reg32 offset="0x000d8" name="RBBM_CLOCK_DELAY3_TP0"/>
+	<reg32 offset="0x000d9" name="RBBM_CLOCK_DELAY3_TP1"/>
+	<reg32 offset="0x000da" name="RBBM_CLOCK_DELAY3_TP2"/>
+	<reg32 offset="0x000db" name="RBBM_CLOCK_DELAY3_TP3"/>
+	<reg32 offset="0x000dc" name="RBBM_CLOCK_DELAY4_TP0"/>
+	<reg32 offset="0x000dd" name="RBBM_CLOCK_DELAY4_TP1"/>
+	<reg32 offset="0x000de" name="RBBM_CLOCK_DELAY4_TP2"/>
+	<reg32 offset="0x000df" name="RBBM_CLOCK_DELAY4_TP3"/>
+	<reg32 offset="0x000e0" name="RBBM_CLOCK_HYST_TP0"/>
+	<reg32 offset="0x000e1" name="RBBM_CLOCK_HYST_TP1"/>
+	<reg32 offset="0x000e2" name="RBBM_CLOCK_HYST_TP2"/>
+	<reg32 offset="0x000e3" name="RBBM_CLOCK_HYST_TP3"/>
+	<reg32 offset="0x000e4" name="RBBM_CLOCK_HYST2_TP0"/>
+	<reg32 offset="0x000e5" name="RBBM_CLOCK_HYST2_TP1"/>
+	<reg32 offset="0x000e6" name="RBBM_CLOCK_HYST2_TP2"/>
+	<reg32 offset="0x000e7" name="RBBM_CLOCK_HYST2_TP3"/>
+	<reg32 offset="0x000e8" name="RBBM_CLOCK_HYST3_TP0"/>
+	<reg32 offset="0x000e9" name="RBBM_CLOCK_HYST3_TP1"/>
+	<reg32 offset="0x000ea" name="RBBM_CLOCK_HYST3_TP2"/>
+	<reg32 offset="0x000eb" name="RBBM_CLOCK_HYST3_TP3"/>
+	<reg32 offset="0x000ec" name="RBBM_CLOCK_HYST4_TP0"/>
+	<reg32 offset="0x000ed" name="RBBM_CLOCK_HYST4_TP1"/>
+	<reg32 offset="0x000ee" name="RBBM_CLOCK_HYST4_TP2"/>
+	<reg32 offset="0x000ef" name="RBBM_CLOCK_HYST4_TP3"/>
+	<reg32 offset="0x000f0" name="RBBM_CLOCK_CNTL_RB0"/>
+	<reg32 offset="0x000f1" name="RBBM_CLOCK_CNTL_RB1"/>
+	<reg32 offset="0x000f2" name="RBBM_CLOCK_CNTL_RB2"/>
+	<reg32 offset="0x000f3" name="RBBM_CLOCK_CNTL_RB3"/>
+	<reg32 offset="0x000f4" name="RBBM_CLOCK_CNTL2_RB0"/>
+	<reg32 offset="0x000f5" name="RBBM_CLOCK_CNTL2_RB1"/>
+	<reg32 offset="0x000f6" name="RBBM_CLOCK_CNTL2_RB2"/>
+	<reg32 offset="0x000f7" name="RBBM_CLOCK_CNTL2_RB3"/>
+	<reg32 offset="0x000f8" name="RBBM_CLOCK_CNTL_CCU0"/>
+	<reg32 offset="0x000f9" name="RBBM_CLOCK_CNTL_CCU1"/>
+	<reg32 offset="0x000fa" name="RBBM_CLOCK_CNTL_CCU2"/>
+	<reg32 offset="0x000fb" name="RBBM_CLOCK_CNTL_CCU3"/>
+	<reg32 offset="0x00100" name="RBBM_CLOCK_HYST_RB_CCU0"/>
+	<reg32 offset="0x00101" name="RBBM_CLOCK_HYST_RB_CCU1"/>
+	<reg32 offset="0x00102" name="RBBM_CLOCK_HYST_RB_CCU2"/>
+	<reg32 offset="0x00103" name="RBBM_CLOCK_HYST_RB_CCU3"/>
+	<reg32 offset="0x00104" name="RBBM_CLOCK_CNTL_RAC"/>
+	<reg32 offset="0x00105" name="RBBM_CLOCK_CNTL2_RAC"/>
+	<reg32 offset="0x00106" name="RBBM_CLOCK_DELAY_RAC"/>
+	<reg32 offset="0x00107" name="RBBM_CLOCK_HYST_RAC"/>
+	<reg32 offset="0x00108" name="RBBM_CLOCK_CNTL_TSE_RAS_RBBM"/>
+	<reg32 offset="0x00109" name="RBBM_CLOCK_DELAY_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0010a" name="RBBM_CLOCK_HYST_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0010b" name="RBBM_CLOCK_CNTL_UCHE"/>
+	<reg32 offset="0x0010c" name="RBBM_CLOCK_CNTL2_UCHE"/>
+	<reg32 offset="0x0010d" name="RBBM_CLOCK_CNTL3_UCHE"/>
+	<reg32 offset="0x0010e" name="RBBM_CLOCK_CNTL4_UCHE"/>
+	<reg32 offset="0x0010f" name="RBBM_CLOCK_DELAY_UCHE"/>
+	<reg32 offset="0x00110" name="RBBM_CLOCK_HYST_UCHE"/>
+	<reg32 offset="0x00111" name="RBBM_CLOCK_MODE_VFD"/>
+	<reg32 offset="0x00112" name="RBBM_CLOCK_DELAY_VFD"/>
+	<reg32 offset="0x00113" name="RBBM_CLOCK_HYST_VFD"/>
+	<reg32 offset="0x00114" name="RBBM_CLOCK_MODE_GPC"/>
+	<reg32 offset="0x00115" name="RBBM_CLOCK_DELAY_GPC"/>
+	<reg32 offset="0x00116" name="RBBM_CLOCK_HYST_GPC"/>
+	<reg32 offset="0x00117" name="RBBM_CLOCK_DELAY_HLSQ_2"/>
+	<reg32 offset="0x00118" name="RBBM_CLOCK_CNTL_GMU_GX"/>
+	<reg32 offset="0x00119" name="RBBM_CLOCK_DELAY_GMU_GX"/>
+	<reg32 offset="0x0011a" name="RBBM_CLOCK_HYST_GMU_GX"/>
+	<reg32 offset="0x0011b" name="RBBM_CLOCK_MODE_HLSQ"/>
+	<reg32 offset="0x0011c" name="RBBM_CLOCK_DELAY_HLSQ"/>
+	<reg32 offset="0x0011d" name="RBBM_CLOCK_HYST_HLSQ"/>
+	<reg32 offset="0x0011e" name="RBBM_CGC_GLOBAL_LOAD_CMD" variants="A7XX-"/>
+	<reg32 offset="0x0011f" name="RBBM_CGC_P2S_TRIG_CMD" variants="A7XX-"/>
+	<reg32 offset="0x00120" name="RBBM_CLOCK_CNTL_TEX_FCHE"/>
+	<reg32 offset="0x00121" name="RBBM_CLOCK_DELAY_TEX_FCHE"/>
+	<reg32 offset="0x00122" name="RBBM_CLOCK_HYST_TEX_FCHE"/>
+	<reg32 offset="0x00122" name="RBBM_CGC_P2S_STATUS" variants="A7XX-">
+		<bitfield name="TXDONE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00123" name="RBBM_CLOCK_CNTL_FCHE"/>
+	<reg32 offset="0x00124" name="RBBM_CLOCK_DELAY_FCHE"/>
+	<reg32 offset="0x00125" name="RBBM_CLOCK_HYST_FCHE"/>
+	<reg32 offset="0x00126" name="RBBM_CLOCK_CNTL_MHUB"/>
+	<reg32 offset="0x00127" name="RBBM_CLOCK_DELAY_MHUB"/>
+	<reg32 offset="0x00128" name="RBBM_CLOCK_HYST_MHUB"/>
+	<reg32 offset="0x00129" name="RBBM_CLOCK_DELAY_GLC"/>
+	<reg32 offset="0x0012a" name="RBBM_CLOCK_HYST_GLC"/>
+	<reg32 offset="0x0012b" name="RBBM_CLOCK_CNTL_GLC"/>
+	<reg32 offset="0x0012f" name="RBBM_CLOCK_HYST2_VFD" variants="A7XX-"/>
+	<reg32 offset="0x005ff" name="RBBM_LPAC_GBIF_CLIENT_QOS_CNTL"/>
+
+	<reg32 offset="0x0600" name="DBGC_CFG_DBGBUS_SEL_A"/>
+	<reg32 offset="0x0601" name="DBGC_CFG_DBGBUS_SEL_B"/>
+	<reg32 offset="0x0602" name="DBGC_CFG_DBGBUS_SEL_C"/>
+	<reg32 offset="0x0603" name="DBGC_CFG_DBGBUS_SEL_D">
+		<bitfield high="7" low="0" name="PING_INDEX"/>
+		<bitfield high="15" low="8" name="PING_BLK_SEL"/>
+	</reg32>
+	<reg32 offset="0x0604" name="DBGC_CFG_DBGBUS_CNTLT">
+		<bitfield high="5" low="0" name="TRACEEN"/>
+		<bitfield high="14" low="12" name="GRANU"/>
+		<bitfield high="31" low="28" name="SEGT"/>
+	</reg32>
+	<reg32 offset="0x0605" name="DBGC_CFG_DBGBUS_CNTLM">
+		<bitfield high="27" low="24" name="ENABLE"/>
+	</reg32>
+	<reg32 offset="0x0608" name="DBGC_CFG_DBGBUS_IVTL_0"/>
+	<reg32 offset="0x0609" name="DBGC_CFG_DBGBUS_IVTL_1"/>
+	<reg32 offset="0x060a" name="DBGC_CFG_DBGBUS_IVTL_2"/>
+	<reg32 offset="0x060b" name="DBGC_CFG_DBGBUS_IVTL_3"/>
+	<reg32 offset="0x060c" name="DBGC_CFG_DBGBUS_MASKL_0"/>
+	<reg32 offset="0x060d" name="DBGC_CFG_DBGBUS_MASKL_1"/>
+	<reg32 offset="0x060e" name="DBGC_CFG_DBGBUS_MASKL_2"/>
+	<reg32 offset="0x060f" name="DBGC_CFG_DBGBUS_MASKL_3"/>
+	<reg32 offset="0x0610" name="DBGC_CFG_DBGBUS_BYTEL_0">
+		<bitfield high="3" low="0" name="BYTEL0"/>
+		<bitfield high="7" low="4" name="BYTEL1"/>
+		<bitfield high="11" low="8" name="BYTEL2"/>
+		<bitfield high="15" low="12" name="BYTEL3"/>
+		<bitfield high="19" low="16" name="BYTEL4"/>
+		<bitfield high="23" low="20" name="BYTEL5"/>
+		<bitfield high="27" low="24" name="BYTEL6"/>
+		<bitfield high="31" low="28" name="BYTEL7"/>
+	</reg32>
+	<reg32 offset="0x0611" name="DBGC_CFG_DBGBUS_BYTEL_1">
+		<bitfield high="3" low="0" name="BYTEL8"/>
+		<bitfield high="7" low="4" name="BYTEL9"/>
+		<bitfield high="11" low="8" name="BYTEL10"/>
+		<bitfield high="15" low="12" name="BYTEL11"/>
+		<bitfield high="19" low="16" name="BYTEL12"/>
+		<bitfield high="23" low="20" name="BYTEL13"/>
+		<bitfield high="27" low="24" name="BYTEL14"/>
+		<bitfield high="31" low="28" name="BYTEL15"/>
+	</reg32>
+	<reg32 offset="0x062f" name="DBGC_CFG_DBGBUS_TRACE_BUF1"/>
+	<reg32 offset="0x0630" name="DBGC_CFG_DBGBUS_TRACE_BUF2"/>
+	<array offset="0x0CD8" name="VSC_PERFCTR_VSC_SEL" stride="1" length="2"/>
+	<reg32 offset="0x0CD8" name="VSC_UNKNOWN_0CD8" variants="A7XX">
+		<doc>
+			Set to true when binning, isn't changed afterwards
+		</doc>
+		<bitfield name="BINNING" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xC800" name="HLSQ_DBG_AHB_READ_APERTURE"/>
+	<reg32 offset="0xD000" name="HLSQ_DBG_READ_SEL"/>
+	<reg32 offset="0x0E00" name="UCHE_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0E01" name="UCHE_MODE_CNTL"/>
+	<reg64 offset="0x0E05" name="UCHE_WRITE_RANGE_MAX"/>
+	<reg64 offset="0x0E07" name="UCHE_WRITE_THRU_BASE"/>
+	<reg64 offset="0x0E09" name="UCHE_TRAP_BASE"/>
+	<reg64 offset="0x0E0B" name="UCHE_GMEM_RANGE_MIN"/>
+	<reg64 offset="0x0E0D" name="UCHE_GMEM_RANGE_MAX"/>
+	<reg32 offset="0x0E17" name="UCHE_CACHE_WAYS" usage="cmd"/>
+	<reg32 offset="0x0E18" name="UCHE_FILTER_CNTL"/>
+	<reg32 offset="0x0E19" name="UCHE_CLIENT_PF" usage="cmd">
+		<bitfield high="7" low="0" name="PERFSEL"/>
+	</reg32>
+	<array offset="0x0E1C" name="UCHE_PERFCTR_UCHE_SEL" stride="1" length="12"/>
+	<reg32 offset="0x0e3a" name="UCHE_GBIF_GX_CONFIG"/>
+	<reg32 offset="0x0e3c" name="UCHE_CMDQ_CONFIG"/>
+
+	<reg32 offset="0x3000" name="VBIF_VERSION"/>
+	<reg32 offset="0x3001" name="VBIF_CLKON">
+		<bitfield pos="1" name="FORCE_ON_TESTBUS" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x302A" name="VBIF_GATE_OFF_WRREQ_EN"/>
+	<reg32 offset="0x3080" name="VBIF_XIN_HALT_CTRL0"/>
+	<reg32 offset="0x3081" name="VBIF_XIN_HALT_CTRL1"/>
+	<reg32 offset="0x3084" name="VBIF_TEST_BUS_OUT_CTRL"/>
+	<reg32 offset="0x3085" name="VBIF_TEST_BUS1_CTRL0"/>
+	<reg32 offset="0x3086" name="VBIF_TEST_BUS1_CTRL1">
+		<bitfield low="0" high="3" name="DATA_SEL"/>
+	</reg32>
+	<reg32 offset="0x3087" name="VBIF_TEST_BUS2_CTRL0"/>
+	<reg32 offset="0x3088" name="VBIF_TEST_BUS2_CTRL1">
+		<bitfield low="0" high="8" name="DATA_SEL"/>
+	</reg32>
+	<reg32 offset="0x308c" name="VBIF_TEST_BUS_OUT"/>
+	<reg32 offset="0x30d0" name="VBIF_PERF_CNT_SEL0"/>
+	<reg32 offset="0x30d1" name="VBIF_PERF_CNT_SEL1"/>
+	<reg32 offset="0x30d2" name="VBIF_PERF_CNT_SEL2"/>
+	<reg32 offset="0x30d3" name="VBIF_PERF_CNT_SEL3"/>
+	<reg32 offset="0x30d8" name="VBIF_PERF_CNT_LOW0"/>
+	<reg32 offset="0x30d9" name="VBIF_PERF_CNT_LOW1"/>
+	<reg32 offset="0x30da" name="VBIF_PERF_CNT_LOW2"/>
+	<reg32 offset="0x30db" name="VBIF_PERF_CNT_LOW3"/>
+	<reg32 offset="0x30e0" name="VBIF_PERF_CNT_HIGH0"/>
+	<reg32 offset="0x30e1" name="VBIF_PERF_CNT_HIGH1"/>
+	<reg32 offset="0x30e2" name="VBIF_PERF_CNT_HIGH2"/>
+	<reg32 offset="0x30e3" name="VBIF_PERF_CNT_HIGH3"/>
+	<reg32 offset="0x3100" name="VBIF_PERF_PWR_CNT_EN0"/>
+	<reg32 offset="0x3101" name="VBIF_PERF_PWR_CNT_EN1"/>
+	<reg32 offset="0x3102" name="VBIF_PERF_PWR_CNT_EN2"/>
+	<reg32 offset="0x3110" name="VBIF_PERF_PWR_CNT_LOW0"/>
+	<reg32 offset="0x3111" name="VBIF_PERF_PWR_CNT_LOW1"/>
+	<reg32 offset="0x3112" name="VBIF_PERF_PWR_CNT_LOW2"/>
+	<reg32 offset="0x3118" name="VBIF_PERF_PWR_CNT_HIGH0"/>
+	<reg32 offset="0x3119" name="VBIF_PERF_PWR_CNT_HIGH1"/>
+	<reg32 offset="0x311a" name="VBIF_PERF_PWR_CNT_HIGH2"/>
+
+	<reg32 offset="0x3c01" name="GBIF_SCACHE_CNTL0"/>
+	<reg32 offset="0x3c02" name="GBIF_SCACHE_CNTL1"/>
+	<reg32 offset="0x3c03" name="GBIF_QSB_SIDE0"/>
+	<reg32 offset="0x3c04" name="GBIF_QSB_SIDE1"/>
+	<reg32 offset="0x3c05" name="GBIF_QSB_SIDE2"/>
+	<reg32 offset="0x3c06" name="GBIF_QSB_SIDE3"/>
+	<reg32 offset="0x3c45" name="GBIF_HALT"/>
+	<reg32 offset="0x3c46" name="GBIF_HALT_ACK"/>
+	<reg32 offset="0x3cc0" name="GBIF_PERF_PWR_CNT_EN"/>
+	<reg32 offset="0x3cc1" name="GBIF_PERF_PWR_CNT_CLR"/>
+	<reg32 offset="0x3cc2" name="GBIF_PERF_CNT_SEL"/>
+	<reg32 offset="0x3cc3" name="GBIF_PERF_PWR_CNT_SEL"/>
+	<reg32 offset="0x3cc4" name="GBIF_PERF_CNT_LOW0"/>
+	<reg32 offset="0x3cc5" name="GBIF_PERF_CNT_LOW1"/>
+	<reg32 offset="0x3cc6" name="GBIF_PERF_CNT_LOW2"/>
+	<reg32 offset="0x3cc7" name="GBIF_PERF_CNT_LOW3"/>
+	<reg32 offset="0x3cc8" name="GBIF_PERF_CNT_HIGH0"/>
+	<reg32 offset="0x3cc9" name="GBIF_PERF_CNT_HIGH1"/>
+	<reg32 offset="0x3cca" name="GBIF_PERF_CNT_HIGH2"/>
+	<reg32 offset="0x3ccb" name="GBIF_PERF_CNT_HIGH3"/>
+	<reg32 offset="0x3ccc" name="GBIF_PWR_CNT_LOW0"/>
+	<reg32 offset="0x3ccd" name="GBIF_PWR_CNT_LOW1"/>
+	<reg32 offset="0x3cce" name="GBIF_PWR_CNT_LOW2"/>
+	<reg32 offset="0x3ccf" name="GBIF_PWR_CNT_HIGH0"/>
+	<reg32 offset="0x3cd0" name="GBIF_PWR_CNT_HIGH1"/>
+	<reg32 offset="0x3cd1" name="GBIF_PWR_CNT_HIGH2"/>
+
+	<reg32 offset="0x0c00" name="VSC_DBG_ECO_CNTL"/>
+	<reg32 offset="0x0c02" name="VSC_BIN_SIZE" usage="rp_blit">
+		<bitfield name="WIDTH" low="0" high="7" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="8" high="16" shr="4" type="uint"/>
+	</reg32>
+	<reg64 offset="0x0c03" name="VSC_DRAW_STRM_SIZE_ADDRESS" type="waddress" usage="cmd"/>
+	<reg32 offset="0x0c06" name="VSC_BIN_COUNT" usage="rp_blit">
+		<bitfield name="NX" low="1" high="10" type="uint"/>
+		<bitfield name="NY" low="11" high="20" type="uint"/>
+	</reg32>
+	<array offset="0x0c10" name="VSC_PIPE_CONFIG" stride="1" length="32" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				Configures the mapping between VSC_PIPE buffer and
+				bin, X/Y specify the bin index in the horiz/vert
+				direction (0,0 is upper left, 0,1 is leftmost bin
+				on second row, and so on).  W/H specify the number
+				of bins assigned to this VSC_PIPE in the horiz/vert
+				dimension.
+			</doc>
+			<bitfield name="X" low="0" high="9" type="uint"/>
+			<bitfield name="Y" low="10" high="19" type="uint"/>
+			<bitfield name="W" low="20" high="25" type="uint"/>
+			<bitfield name="H" low="26" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<!--
+	HW binning primitive & draw streams, which enable draws and primitives
+	within a draw to be skipped in the main tile pass.  See:
+	https://github.com/freedreno/freedreno/wiki/Visibility-Stream-Format
+
+	Compared to a5xx and earlier, we just program the address of the first
+	stream and hw adds (pipe_num * VSC_*_STRM_PITCH)
+
+	LIMIT is set to PITCH - 64, to make room for a bit of overflow
+	 -->
+	<reg64 offset="0x0c30" name="VSC_PRIM_STRM_ADDRESS" type="waddress" usage="cmd"/>
+	<reg32 offset="0x0c32" name="VSC_PRIM_STRM_PITCH" usage="cmd"/>
+	<reg32 offset="0x0c33" name="VSC_PRIM_STRM_LIMIT" usage="cmd"/>
+	<reg64 offset="0x0c34" name="VSC_DRAW_STRM_ADDRESS" type="waddress" usage="cmd"/>
+	<reg32 offset="0x0c36" name="VSC_DRAW_STRM_PITCH" usage="cmd"/>
+	<reg32 offset="0x0c37" name="VSC_DRAW_STRM_LIMIT" usage="cmd"/>
+
+	<array offset="0x0c38" name="VSC_STATE" stride="1" length="32" usage="rp_blit">
+		<doc>
+			Seems to be a bitmap of which tiles mapped to the VSC
+			pipe contain geometry.
+
+			I suppose we can connect a maximum of 32 tiles to a
+			single VSC pipe.
+		</doc>
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+
+	<array offset="0x0c58" name="VSC_PRIM_STRM_SIZE" stride="1" length="32" variants="A6XX" usage="rp_blit">
+		<doc>
+			Has the size of data written to corresponding VSC_PRIM_STRM
+			buffer.
+		</doc>
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+
+	<array offset="0x0c78" name="VSC_DRAW_STRM_SIZE" stride="1" length="32" variants="A6XX" usage="rp_blit">
+		<doc>
+			Has the size of data written to corresponding VSC pipe, ie.
+			same thing that is written out to VSC_DRAW_STRM_SIZE_ADDRESS_LO/HI
+		</doc>
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+
+	<reg32 offset="0x0d08" name="VSC_UNKNOWN_0D08" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0x0E10" name="UCHE_UNKNOWN_0E10" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x0E11" name="UCHE_UNKNOWN_0E11" variants="A7XX-" usage="cmd"/>
+	<!-- always 0x03200000 ? -->
+	<reg32 offset="0x0e12" name="UCHE_UNKNOWN_0E12"  usage="cmd"/>
+
+	<!-- adreno_reg_xy has 15 bits per coordinate, but a6xx registers only have 14 -->
+	<bitset name="a6xx_reg_xy" inline="yes">
+		<bitfield name="X" low="0" high="13" type="uint"/>
+		<bitfield name="Y" low="16" high="29" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x8000" name="GRAS_CL_CNTL" usage="rp_blit">
+		<bitfield name="CLIP_DISABLE" pos="0" type="boolean"/>
+		<bitfield name="ZNEAR_CLIP_DISABLE" pos="1" type="boolean"/>
+		<bitfield name="ZFAR_CLIP_DISABLE" pos="2" type="boolean"/>
+		<bitfield name="Z_CLAMP_ENABLE" pos="5" type="boolean"/>
+		<!-- controls near z clip behavior (set for vulkan) -->
+		<bitfield name="ZERO_GB_SCALE_Z" pos="6" type="boolean"/>
+		<!-- guess based on a3xx and meaning of bits 8 and 9
+		     if the guess is right then this is related to point sprite clipping -->
+		<bitfield name="VP_CLIP_CODE_IGNORE" pos="7" type="boolean"/>
+		<bitfield name="VP_XFORM_DISABLE" pos="8" type="boolean"/>
+		<bitfield name="PERSP_DIVISION_DISABLE" pos="9" type="boolean"/>
+	</reg32>
+
+	<bitset name="a6xx_gras_xs_cl_cntl" inline="yes">
+		<bitfield name="CLIP_MASK" low="0" high="7"/>
+		<bitfield name="CULL_MASK" low="8" high="15"/>
+	</bitset>
+	<reg32 offset="0x8001" name="GRAS_VS_CL_CNTL" type="a6xx_gras_xs_cl_cntl" usage="rp_blit"/>
+	<reg32 offset="0x8002" name="GRAS_DS_CL_CNTL" type="a6xx_gras_xs_cl_cntl" usage="rp_blit"/>
+	<reg32 offset="0x8003" name="GRAS_GS_CL_CNTL" type="a6xx_gras_xs_cl_cntl" usage="rp_blit"/>
+	<reg32 offset="0x8004" name="GRAS_MAX_LAYER_INDEX" low="0" high="10" type="uint" usage="rp_blit"/>
+
+	<reg32 offset="0x8005" name="GRAS_CNTL" usage="rp_blit">
+		<!-- see also RB_RENDER_CONTROL0 -->
+		<bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+		<bitfield name="IJ_LINEAR_PIXEL" pos="3" type="boolean"/>
+		<bitfield name="IJ_LINEAR_CENTROID" pos="4" type="boolean"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" pos="5" type="boolean"/>
+		<bitfield name="COORD_MASK" low="6" high="9" type="hex"/>
+		<bitfield name="UNK10" pos="10" type="boolean" variants="A7XX-"/>
+		<bitfield name="UNK11" pos="11" type="boolean" variants="A7XX-"/>
+	</reg32>
+	<reg32 offset="0x8006" name="GRAS_CL_GUARDBAND_CLIP_ADJ" usage="rp_blit">
+		<bitfield name="HORZ" low="0" high="8" type="uint"/>
+		<bitfield name="VERT" low="10" high="18" type="uint"/>
+	</reg32>
+
+	<!-- Something connected to depth-stencil attachment size -->
+	<reg32 offset="0x8007" name="GRAS_UNKNOWN_8007" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0x8008" name="GRAS_UNKNOWN_8008" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0x8009" name="GRAS_UNKNOWN_8009" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x800a" name="GRAS_UNKNOWN_800A" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x800b" name="GRAS_UNKNOWN_800B" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x800c" name="GRAS_UNKNOWN_800C" variants="A7XX-" usage="cmd"/>
+
+	<!-- <reg32 offset="0x80f0" name="GRAS_UNKNOWN_80F0" type="a6xx_reg_xy"/> -->
+
+	<!-- 0x8006-0x800f invalid -->
+	<array offset="0x8010" name="GRAS_CL_VPORT" stride="6" length="16" usage="rp_blit">
+		<reg32 offset="0" name="XOFFSET" type="float"/>
+		<reg32 offset="1" name="XSCALE" type="float"/>
+		<reg32 offset="2" name="YOFFSET" type="float"/>
+		<reg32 offset="3" name="YSCALE" type="float"/>
+		<reg32 offset="4" name="ZOFFSET" type="float"/>
+		<reg32 offset="5" name="ZSCALE" type="float"/>
+	</array>
+	<array offset="0x8070" name="GRAS_CL_Z_CLAMP" stride="2" length="16" usage="rp_blit">
+		<reg32 offset="0" name="MIN" type="float"/>
+		<reg32 offset="1" name="MAX" type="float"/>
+	</array>
+
+	<reg32 offset="0x8090" name="GRAS_SU_CNTL" usage="rp_blit">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FRONT_CW" pos="2" type="boolean"/>
+		<bitfield name="LINEHALFWIDTH" low="3" high="10" radix="2" type="fixed"/>
+		<bitfield name="POLY_OFFSET" pos="11" type="boolean"/>
+		<bitfield name="UNK12" pos="12"/>
+		<bitfield name="LINE_MODE" pos="13" type="a5xx_line_mode"/>
+		<bitfield name="UNK15" low="15" high="16"/>
+		<!--
+                        On gen1 only MULTIVIEW_ENABLE exists. On gen3 we have
+                        the ability to add the view index to either the RT array
+                        index or the viewport index, and it seems that
+                        MULTIVIEW_ENABLE doesn't do anything, instead we need to
+                        set at least one of RENDERTARGETINDEXINCR or
+                        VIEWPORTINDEXINCR to enable multiview. The blob still
+                        sets MULTIVIEW_ENABLE regardless.
+                        TODO: what about gen2 (a640)?
+		-->
+		<bitfield name="MULTIVIEW_ENABLE" pos="17" type="boolean"/>
+		<bitfield name="RENDERTARGETINDEXINCR" pos="18" type="boolean"/>
+		<bitfield name="VIEWPORTINDEXINCR" pos="19" type="boolean"/>
+		<bitfield name="UNK20" low="20" high="22"/>
+	</reg32>
+	<reg32 offset="0x8091" name="GRAS_SU_POINT_MINMAX" usage="rp_blit">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x8092" name="GRAS_SU_POINT_SIZE" low="0" high="15" type="fixed" radix="4" usage="rp_blit"/>
+	<!-- 0x8093 invalid -->
+	<reg32 offset="0x8094" name="GRAS_SU_DEPTH_PLANE_CNTL" usage="rp_blit">
+		<bitfield name="Z_MODE" low="0" high="1" type="a6xx_ztest_mode"/>
+	</reg32>
+	<reg32 offset="0x8095" name="GRAS_SU_POLY_OFFSET_SCALE" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8096" name="GRAS_SU_POLY_OFFSET_OFFSET" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8097" name="GRAS_SU_POLY_OFFSET_OFFSET_CLAMP" type="float" usage="rp_blit"/>
+	<!-- duplicates RB_DEPTH_BUFFER_INFO: -->
+	<reg32 offset="0x8098" name="GRAS_SU_DEPTH_BUFFER_INFO" usage="rp_blit">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a6xx_depth_format"/>
+		<bitfield name="UNK3" pos="3"/>
+	</reg32>
+
+	<reg32 offset="0x8099" name="GRAS_SU_CONSERVATIVE_RAS_CNTL" usage="cmd">
+		<bitfield name="CONSERVATIVERASEN" pos="0" type="boolean"/>
+		<bitfield name="SHIFTAMOUNT" low="1" high="2"/>
+		<bitfield name="INNERCONSERVATIVERASEN" pos="3" type="boolean"/>
+		<bitfield name="UNK4" low="4" high="5"/>
+	</reg32>
+	<reg32 offset="0x809a" name="GRAS_SU_PATH_RENDERING_CNTL">
+		<bitfield name="UNK0" pos="0" type="boolean"/>
+		<bitfield name="LINELENGTHEN" pos="1" type="boolean"/>
+	</reg32>
+
+	<bitset name="a6xx_gras_layer_cntl" inline="yes">
+		<bitfield name="WRITES_LAYER" pos="0" type="boolean"/>
+		<bitfield name="WRITES_VIEW" pos="1" type="boolean"/>
+	</bitset>
+	<reg32 offset="0x809b" name="GRAS_VS_LAYER_CNTL" type="a6xx_gras_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x809c" name="GRAS_GS_LAYER_CNTL" type="a6xx_gras_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x809d" name="GRAS_DS_LAYER_CNTL" type="a6xx_gras_layer_cntl" usage="rp_blit"/>
+	<!-- 0x809e/0x809f invalid -->
+
+	<enum name="a6xx_sequenced_thread_dist">
+		<value value="0x0" name="DIST_SCREEN_COORD"/>
+		<value value="0x1" name="DIST_ALL_TO_RB0"/>
+	</enum>
+
+	<enum name="a6xx_single_prim_mode">
+		<value value="0x0" name="NO_FLUSH"/>
+		<doc>
+			In addition to FLUSH_PER_OVERLAP, guarantee that UCHE
+			and CCU don't get out of sync when fetching the previous
+			value for the current pixel. With NO_FLUSH, there's the
+			possibility that the flags for the current pixel are
+			flushed before the data or vice-versa, leading to
+			texture fetches via UCHE getting out of sync values.
+			This mode should eliminate that. It's used in bypass
+			mode for coherent blending
+			(GL_KHR_blend_equation_advanced_coherent) as well as
+			non-coherent blending.
+		</doc>
+		<value value="0x1" name="FLUSH_PER_OVERLAP_AND_OVERWRITE"/>
+		<doc>
+			Invalidate UCHE and wait for any pending work to finish
+			if there was possibly an overlapping primitive prior to
+			the current one. This is similar to a combination of
+			GRAS_SC_CONTROL::INJECT_L2_INVALIDATE_EVENT and
+			WAIT_RB_IDLE_ALL_TRI on a3xx. It's used in GMEM mode for
+			coherent blending
+			(GL_KHR_blend_equation_advanced_coherent).
+		</doc>
+		<value value="0x3" name="FLUSH_PER_OVERLAP"/>
+	</enum>
+
+	<!-- this probably has the same meaning as a3xx GRAS_SC_CONTROL::RASTER_MODE -->
+	<enum name="a6xx_raster_mode">
+		<value value="0x0" name="TYPE_TILED"/>
+		<value value="0x1" name="TYPE_WRITER"/>
+	</enum>
+
+	<!-- I'm guessing this is the same as a3xx -->
+	<enum name="a6xx_raster_direction">
+		<value value="0x0" name="LR_TB"/>
+		<value value="0x1" name="RL_TB"/>
+		<value value="0x2" name="LR_BT"/>
+		<value value="0x3" name="RB_BT"/>
+	</enum>
+
+	<reg32 offset="0x80a0" name="GRAS_SC_CNTL" usage="rp_blit">
+		<bitfield name="CCUSINGLECACHELINESIZE" low="0" high="2"/>
+		<bitfield name="SINGLE_PRIM_MODE" low="3" high="4" type="a6xx_single_prim_mode"/>
+		<bitfield name="RASTER_MODE" pos="5" type="a6xx_raster_mode"/>
+		<bitfield name="RASTER_DIRECTION" low="6" high="7" type="a6xx_raster_direction"/>
+		<bitfield name="SEQUENCED_THREAD_DISTRIBUTION" pos="8" type="a6xx_sequenced_thread_dist"/>
+		<!-- CCUSINGLECACHELINESIZE is ignored unless bit 9 is set -->
+		<bitfield name="UNK9" pos="9" type="boolean"/>
+		<bitfield name="ROTATION" low="10" high="11" type="uint"/>
+		<bitfield name="EARLYVIZOUTEN" pos="12" type="boolean"/>
+	</reg32>
+
+	<enum name="a6xx_render_mode">
+		<value value="0x0" name="RENDERING_PASS"/>
+		<value value="0x1" name="BINNING_PASS"/>
+	</enum>
+
+	<enum name="a6xx_buffers_location">
+		<value value="0" name="BUFFERS_IN_GMEM"/>
+		<value value="3" name="BUFFERS_IN_SYSMEM"/>
+	</enum>
+
+	<enum name="a6xx_lrz_feedback_mask">
+		<value value="0x0" name="LRZ_FEEDBACK_NONE"/>
+		<value value="0x1" name="LRZ_FEEDBACK_EARLY_Z"/>
+		<value value="0x2" name="LRZ_FEEDBACK_EARLY_LRZ_LATE_Z"/>
+		<!-- We don't have a flag type and this flags combination is often used -->
+		<value value="0x3" name="LRZ_FEEDBACK_EARLY_Z_OR_EARLY_LRZ_LATE_Z"/>
+		<value value="0x4" name="LRZ_FEEDBACK_LATE_Z"/>
+	</enum>
+
+	<reg32 offset="0x80a1" name="GRAS_BIN_CONTROL" usage="rp_blit">
+		<bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+		<bitfield name="RENDER_MODE" low="18" high="20" type="a6xx_render_mode"/>
+		<doc>Disable LRZ feedback writes</doc>
+		<bitfield name="FORCE_LRZ_WRITE_DIS" pos="21" type="boolean"/>
+		<bitfield name="BUFFERS_LOCATION" low="22" high="23" type="a6xx_buffers_location" variants="A6XX"/>
+		<doc>
+			Allows draws that don't have GRAS_LRZ_CNTL.LRZ_WRITE but have
+			GRAS_LRZ_CNTL.ENABLE to contribute to LRZ during RENDERING pass.
+			In sysmem mode GRAS_LRZ_CNTL.LRZ_WRITE is not considered.
+		</doc>
+		<bitfield name="LRZ_FEEDBACK_ZMODE_MASK" low="24" high="26" type="a6xx_lrz_feedback_mask"/>
+		<bitfield name="UNK27" pos="27"/>
+	</reg32>
+
+	<reg32 offset="0x80a2" name="GRAS_RAS_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="UNK2" pos="2"/>
+		<bitfield name="UNK3" pos="3"/>
+	</reg32>
+	<reg32 offset="0x80a3" name="GRAS_DEST_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+
+	<bitset name="a6xx_sample_config" inline="yes">
+		<bitfield name="UNK0" pos="0"/>
+		<bitfield name="LOCATION_ENABLE" pos="1" type="boolean"/>
+	</bitset>
+
+	<bitset name="a6xx_sample_locations" inline="yes">
+		<bitfield name="SAMPLE_0_X" low="0" high="3" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_0_Y" low="4" high="7" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_1_X" low="8" high="11" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_1_Y" low="12" high="15" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_2_X" low="16" high="19" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_2_Y" low="20" high="23" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_3_X" low="24" high="27" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_3_Y" low="28" high="31" radix="4" type="fixed"/>
+	</bitset>
+
+	<reg32 offset="0x80a4" name="GRAS_SAMPLE_CONFIG" type="a6xx_sample_config" usage="rp_blit"/>
+	<reg32 offset="0x80a5" name="GRAS_SAMPLE_LOCATION_0" type="a6xx_sample_locations" usage="rp_blit"/>
+	<reg32 offset="0x80a6" name="GRAS_SAMPLE_LOCATION_1" type="a6xx_sample_locations" usage="rp_blit"/>
+
+	<reg32 offset="0x80a7" name="GRAS_UNKNOWN_80A7" variants="A7XX-" usage="cmd"/>
+
+	<!-- 0x80a7-0x80ae invalid -->
+	<reg32 offset="0x80af" name="GRAS_UNKNOWN_80AF" pos="0" usage="cmd"/>
+
+	<bitset name="a6xx_scissor_xy" inline="yes">
+		<bitfield name="X" low="0" high="15" type="uint"/>
+		<bitfield name="Y" low="16" high="31" type="uint"/>
+	</bitset>
+	<array offset="0x80b0" name="GRAS_SC_SCREEN_SCISSOR" stride="2" length="16" usage="rp_blit">
+		<reg32 offset="0" name="TL" type="a6xx_scissor_xy"/>
+		<reg32 offset="1" name="BR" type="a6xx_scissor_xy"/>
+	</array>
+	<array offset="0x80d0" name="GRAS_SC_VIEWPORT_SCISSOR" stride="2" length="16" usage="rp_blit">
+		<reg32 offset="0" name="TL" type="a6xx_scissor_xy"/>
+		<reg32 offset="1" name="BR" type="a6xx_scissor_xy"/>
+	</array>
+
+	<reg32 offset="0x80f0" name="GRAS_SC_WINDOW_SCISSOR_TL" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x80f1" name="GRAS_SC_WINDOW_SCISSOR_BR" type="a6xx_reg_xy" usage="rp_blit"/>
+
+	<!-- 0x80f4 - 0x80fa are used for VK_KHR_fragment_shading_rate -->
+	<reg64 offset="0x80f4" name="GRAS_UNKNOWN_80F4" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80f5" name="GRAS_UNKNOWN_80F5" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80f6" name="GRAS_UNKNOWN_80F6" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80f8" name="GRAS_UNKNOWN_80F8" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80f9" name="GRAS_UNKNOWN_80F9" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80fa" name="GRAS_UNKNOWN_80FA" variants="A7XX-" usage="cmd"/>
+
+	<enum name="a6xx_lrz_dir_status">
+		<value value="0x1" name="LRZ_DIR_LE"/>
+		<value value="0x2" name="LRZ_DIR_GE"/>
+		<value value="0x3" name="LRZ_DIR_INVALID"/>
+	</enum>
+
+	<reg32 offset="0x8100" name="GRAS_LRZ_CNTL" usage="rp_blit">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<doc>LRZ write also disabled for blend/etc.</doc>
+		<bitfield name="LRZ_WRITE" pos="1" type="boolean"/>
+		<doc>update MAX instead of MIN value, ie. GL_GREATER/GL_GEQUAL</doc>
+		<bitfield name="GREATER" pos="2" type="boolean"/>
+		<doc>
+			Clears the LRZ block being touched to:
+			- 0.0 if GREATER
+			- 1.0 if LESS
+		</doc>
+		<bitfield name="FC_ENABLE" pos="3" type="boolean" variants="A6XX"/>
+		<!-- set when depth-test + depth-write enabled -->
+		<bitfield name="Z_TEST_ENABLE" pos="4" type="boolean"/>
+		<bitfield name="Z_BOUNDS_ENABLE" pos="5" type="boolean"/>
+		<bitfield name="DIR" low="6" high="7" type="a6xx_lrz_dir_status"/>
+		<doc>
+			If DISABLE_ON_WRONG_DIR enabled - write new LRZ direction into
+			buffer, in case of mismatched direction writes 0 (disables LRZ).
+		</doc>
+		<bitfield name="DIR_WRITE" pos="8" type="boolean"/>
+		<doc>
+			Disable LRZ based on previous direction and the current one.
+			If DIR_WRITE is not enabled - there is no write to direction buffer.
+		</doc>
+		<bitfield name="DISABLE_ON_WRONG_DIR" pos="9" type="boolean" variants="A6XX"/>
+		<bitfield name="Z_FUNC" low="11" high="13" type="adreno_compare_func" variants="A7XX-"/>
+	</reg32>
+
+	<enum name="a6xx_fragcoord_sample_mode">
+		<value value="0" name="FRAGCOORD_CENTER"/>
+		<value value="3" name="FRAGCOORD_SAMPLE"/>
+	</enum>
+
+	<reg32 offset="0x8101" name="GRAS_LRZ_PS_INPUT_CNTL" low="0" high="2" usage="rp_blit">
+		<bitfield name="SAMPLEID" pos="0" type="boolean"/>
+		<bitfield name="FRAGCOORDSAMPLEMODE" low="1" high="2" type="a6xx_fragcoord_sample_mode"/>
+	</reg32>
+
+	<reg32 offset="0x8102" name="GRAS_LRZ_MRT_BUF_INFO_0" usage="rp_blit">
+		<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+	</reg32>
+	<reg64 offset="0x8103" name="GRAS_LRZ_BUFFER_BASE" align="256" type="waddress" usage="rp_blit"/>
+	<reg32 offset="0x8105" name="GRAS_LRZ_BUFFER_PITCH" usage="rp_blit">
+		<!-- TODO: fix the shr fields -->
+		<bitfield name="PITCH" low="0" high="7" shr="5" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="10" high="28" shr="4" type="uint"/>
+	</reg32>
+
+	<!--
+	The LRZ "fast clear" buffer is initialized to zero's by blob, and
+	read/written when GRAS_LRZ_CNTL.FC_ENABLE (b3) is set.  It appears
+	to store 1b/block.  It appears that '0' means block has original
+	depth clear value, and '1' means that the corresponding block in
+	LRZ has been modified.  Ignoring alignment/padding, the size is
+	given by the formula:
+
+		// calculate LRZ size from depth size:
+		if (nr_samples == 4) {
+			width *= 2;
+			height *= 2;
+		} else if (nr_samples == 2) {
+			height *= 2;
+		}
+
+		lrz_width = div_round_up(width, 8);
+		lrz_heigh = div_round_up(height, 8);
+
+		// calculate # of blocks:
+		nblocksx = div_round_up(lrz_width, 16);
+		nblocksy = div_round_up(lrz_height, 4);
+
+		// fast-clear buffer is 1bit/block:
+		fc_sz = div_round_up(nblocksx * nblocksy, 8);
+
+	In practice the blob seems to switch off FC_ENABLE once the size
+	increases beyond 1 page.  Not sure if that is an actual limit or
+	not.
+	 -->
+	<reg64 offset="0x8106" name="GRAS_LRZ_FAST_CLEAR_BUFFER_BASE" align="64" type="waddress" usage="rp_blit"/>
+	<!-- 0x8108 invalid -->
+	<reg32 offset="0x8109" name="GRAS_SAMPLE_CNTL" usage="rp_blit">
+		<bitfield name="PER_SAMP_MODE" pos="0" type="boolean"/>
+	</reg32>
+	<!--
+	LRZ buffer represents a single array layer + mip level, and there is
+	a single buffer per depth image. Thus to reuse LRZ between renderpasses
+	it is necessary to track the depth view used in the past renderpass, which
+	GRAS_LRZ_DEPTH_VIEW is for.
+	GRAS_LRZ_CNTL checks if current value of GRAS_LRZ_DEPTH_VIEW is equal to
+	the value stored in the LRZ buffer, if not - LRZ is disabled.
+	-->
+	<reg32 offset="0x810a" name="GRAS_LRZ_DEPTH_VIEW" usage="cmd">
+		<bitfield name="BASE_LAYER" low="0" high="10" type="uint"/>
+		<bitfield name="LAYER_COUNT" low="16" high="26" type="uint"/>
+		<bitfield name="BASE_MIP_LEVEL" low="28" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x810b" name="GRAS_LRZ_CNTL2" variants="A7XX-" usage="rp_blit">
+		<bitfield name="DISABLE_ON_WRONG_DIR" pos="0" type="boolean"/>
+		<bitfield name="FC_ENABLE" pos="1" type="boolean"/>
+	</reg32>
+
+	<!-- 0x810c-0x810f invalid -->
+
+	<reg32 offset="0x8110" name="GRAS_UNKNOWN_8110" low="0" high="1" usage="cmd"/>
+
+	<!-- A bit tentative but it's a color and it is followed by LRZ_CLEAR -->
+	<reg32 offset="0x8111" name="GRAS_LRZ_CLEAR_DEPTH_F32" type="float" variants="A7XX-"/>
+
+	<reg32 offset="0x8113" name="GRAS_LRZ_DEPTH_BUFFER_INFO" variants="A7XX-" usage="rp_blit">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a6xx_depth_format"/>
+		<bitfield name="UNK3" pos="3"/>
+	</reg32>
+
+	<!-- Always written together and always equal 09510840 00000a62 -->
+	<reg32 offset="0x8120" name="GRAS_UNKNOWN_8120" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x8121" name="GRAS_UNKNOWN_8121" variants="A7XX-" usage="cmd"/>
+
+	<!-- 0x8112-0x83ff invalid -->
+
+	<enum name="a6xx_rotation">
+		<value value="0x0" name="ROTATE_0"/>
+		<value value="0x1" name="ROTATE_90"/>
+		<value value="0x2" name="ROTATE_180"/>
+		<value value="0x3" name="ROTATE_270"/>
+		<value value="0x4" name="ROTATE_HFLIP"/>
+		<value value="0x5" name="ROTATE_VFLIP"/>
+	</enum>
+
+	<bitset name="a6xx_2d_blit_cntl" inline="yes">
+		<bitfield name="ROTATE" low="0" high="2" type="a6xx_rotation"/>
+		<bitfield name="OVERWRITEEN" pos="3" type="boolean"/>
+		<bitfield name="UNK4" low="4" high="6"/>
+		<bitfield name="SOLID_COLOR" pos="7" type="boolean"/>
+		<bitfield name="COLOR_FORMAT" low="8" high="15" type="a6xx_format"/>
+		<bitfield name="SCISSOR" pos="16" type="boolean"/>
+		<bitfield name="UNK17" low="17" high="18"/>
+		<!-- required when blitting D24S8/D24X8 -->
+		<bitfield name="D24S8" pos="19" type="boolean"/>
+		<!-- some sort of channel mask, disabled channels are set to zero ? -->
+		<bitfield name="MASK" low="20" high="23"/>
+		<bitfield name="IFMT" low="24" high="28" type="a6xx_2d_ifmt"/>
+		<bitfield name="RASTER_MODE" pos="29" type="a6xx_raster_mode"/>
+		<bitfield name="UNK30" pos="30" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<reg32 offset="0x8400" name="GRAS_2D_BLIT_CNTL" type="a6xx_2d_blit_cntl" usage="rp_blit"/>
+	<!-- note: the low 8 bits for src coords are valid, probably fixed point
+	     it would be a bit weird though, since we subtract 1 from BR coords
+	     apparently signed, gallium driver uses negative coords and it works?
+	 -->
+	<reg32 offset="0x8401" name="GRAS_2D_SRC_TL_X" low="8" high="24" type="int" usage="rp_blit"/>
+	<reg32 offset="0x8402" name="GRAS_2D_SRC_BR_X" low="8" high="24" type="int" usage="rp_blit"/>
+	<reg32 offset="0x8403" name="GRAS_2D_SRC_TL_Y" low="8" high="24" type="int" usage="rp_blit"/>
+	<reg32 offset="0x8404" name="GRAS_2D_SRC_BR_Y" low="8" high="24" type="int" usage="rp_blit"/>
+	<reg32 offset="0x8405" name="GRAS_2D_DST_TL" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x8406" name="GRAS_2D_DST_BR" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x8407" name="GRAS_2D_UNKNOWN_8407" low="0" high="31"/>
+	<reg32 offset="0x8408" name="GRAS_2D_UNKNOWN_8408" low="0" high="31"/>
+	<reg32 offset="0x8409" name="GRAS_2D_UNKNOWN_8409" low="0" high="31"/>
+	<reg32 offset="0x840a" name="GRAS_2D_RESOLVE_CNTL_1" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x840b" name="GRAS_2D_RESOLVE_CNTL_2" type="a6xx_reg_xy" usage="rp_blit"/>
+	<!-- 0x840c-0x85ff invalid -->
+
+	<!-- always 0x880 ? (and 0 in a640/a650 traces?) -->
+	<reg32 offset="0x8600" name="GRAS_DBG_ECO_CNTL" usage="cmd">
+		<bitfield name="UNK7" pos="7" type="boolean"/>
+		<bitfield name="LRZCACHELOCKDIS" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8601" name="GRAS_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode"/>
+	<reg32 offset="0x8602" name="GRAS_NC_MODE_CNTL" variants="A7XX-"/>
+	<array offset="0x8610" name="GRAS_PERFCTR_TSE_SEL" stride="1" length="4"/>
+	<array offset="0x8614" name="GRAS_PERFCTR_RAS_SEL" stride="1" length="4"/>
+	<array offset="0x8618" name="GRAS_PERFCTR_LRZ_SEL" stride="1" length="4"/>
+
+	<!-- note 0x8620-0x87ff are not all invalid
+	(in particular, 0x8631/0x8632 have 0x3fff3fff mask and would be xy coords)
+	-->
+
+	<!-- same as GRAS_BIN_CONTROL, but without bit 27: -->
+	<reg32 offset="0x8800" name="RB_BIN_CONTROL" variants="A6XX" usage="rp_blit">
+		<bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+		<bitfield name="RENDER_MODE" low="18" high="20" type="a6xx_render_mode"/>
+		<bitfield name="FORCE_LRZ_WRITE_DIS" pos="21" type="boolean"/>
+		<bitfield name="BUFFERS_LOCATION" low="22" high="23" type="a6xx_buffers_location"/>
+		<bitfield name="LRZ_FEEDBACK_ZMODE_MASK" low="24" high="26" type="a6xx_lrz_feedback_mask"/>
+	</reg32>
+
+	<reg32 offset="0x8800" name="RB_BIN_CONTROL" variants="A7XX-" usage="rp_blit">
+		<bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+		<bitfield name="RENDER_MODE" low="18" high="20" type="a6xx_render_mode"/>
+		<bitfield name="FORCE_LRZ_WRITE_DIS" pos="21" type="boolean"/>
+		<bitfield name="LRZ_FEEDBACK_ZMODE_MASK" low="24" high="26" type="a6xx_lrz_feedback_mask"/>
+	</reg32>
+
+	<reg32 offset="0x8801" name="RB_RENDER_CNTL" variants="A6XX" usage="rp_blit">
+		<bitfield name="CCUSINGLECACHELINESIZE" low="3" high="5"/>
+		<bitfield name="EARLYVIZOUTEN" pos="6" type="boolean"/>
+		<!-- set during binning pass: -->
+		<bitfield name="BINNING" pos="7" type="boolean"/>
+		<bitfield name="UNK8" low="8" high="10"/>
+		<bitfield name="RASTER_MODE" pos="8" type="a6xx_raster_mode"/>
+		<bitfield name="RASTER_DIRECTION" low="9" high="10" type="a6xx_raster_direction"/>
+		<bitfield name="CONSERVATIVERASEN" pos="11" type="boolean"/>
+		<bitfield name="INNERCONSERVATIVERASEN" pos="12" type="boolean"/>
+		<!-- bit seems to be set whenever depth buffer enabled: -->
+		<bitfield name="FLAG_DEPTH" pos="14" type="boolean"/>
+		<!-- bitmask of MRTs using UBWC flag buffer: -->
+		<bitfield name="FLAG_MRTS" low="16" high="23"/>
+	</reg32>
+	<reg32 offset="0x8801" name="RB_RENDER_CNTL" variants="A7XX-" usage="rp_blit">
+		<bitfield name="EARLYVIZOUTEN" pos="6" type="boolean"/>
+		<!-- set during binning pass: -->
+		<bitfield name="BINNING" pos="7" type="boolean"/>
+		<bitfield name="RASTER_MODE" pos="8" type="a6xx_raster_mode"/>
+		<bitfield name="RASTER_DIRECTION" low="9" high="10" type="a6xx_raster_direction"/>
+		<bitfield name="CONSERVATIVERASEN" pos="11" type="boolean"/>
+		<bitfield name="INNERCONSERVATIVERASEN" pos="12" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8116" name="GRAS_SU_RENDER_CNTL" variants="A7XX-" usage="rp_blit">
+		<bitfield name="BINNING" pos="7" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x8802" name="RB_RAS_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="UNK2" pos="2"/>
+		<bitfield name="UNK3" pos="3"/>
+	</reg32>
+	<reg32 offset="0x8803" name="RB_DEST_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x8804" name="RB_SAMPLE_CONFIG" type="a6xx_sample_config" usage="rp_blit"/>
+	<reg32 offset="0x8805" name="RB_SAMPLE_LOCATION_0" type="a6xx_sample_locations" usage="rp_blit"/>
+	<reg32 offset="0x8806" name="RB_SAMPLE_LOCATION_1" type="a6xx_sample_locations" usage="rp_blit"/>
+	<!-- 0x8807-0x8808 invalid -->
+	<!--
+	note: maybe not actually called RB_RENDER_CONTROLn (since RB_RENDER_CNTL
+	name comes from kernel and is probably right)
+	 -->
+	<reg32 offset="0x8809" name="RB_RENDER_CONTROL0" usage="rp_blit">
+		<!-- see also GRAS_CNTL -->
+		<bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+		<bitfield name="IJ_LINEAR_PIXEL" pos="3" type="boolean"/>
+		<bitfield name="IJ_LINEAR_CENTROID" pos="4" type="boolean"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" pos="5" type="boolean"/>
+		<bitfield name="COORD_MASK" low="6" high="9" type="hex"/>
+		<bitfield name="UNK10" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x880a" name="RB_RENDER_CONTROL1" usage="rp_blit">
+		<!-- enable bits for various FS sysvalue regs: -->
+		<bitfield name="SAMPLEMASK" pos="0" type="boolean"/>
+		<bitfield name="POSTDEPTHCOVERAGE" pos="1" type="boolean"/>
+		<bitfield name="FACENESS" pos="2" type="boolean"/>
+		<bitfield name="SAMPLEID" pos="3" type="boolean"/>
+		<bitfield name="FRAGCOORDSAMPLEMODE" low="4" high="5" type="a6xx_fragcoord_sample_mode"/>
+		<bitfield name="CENTERRHW" pos="6" type="boolean"/>
+		<bitfield name="LINELENGTHEN" pos="7" type="boolean"/>
+		<bitfield name="FOVEATION" pos="8" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x880b" name="RB_FS_OUTPUT_CNTL0" usage="rp_blit">
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="FRAG_WRITES_Z" pos="1" type="boolean"/>
+		<bitfield name="FRAG_WRITES_SAMPMASK" pos="2" type="boolean"/>
+		<bitfield name="FRAG_WRITES_STENCILREF" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x880c" name="RB_FS_OUTPUT_CNTL1" usage="rp_blit">
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+	</reg32>
+	<reg32 offset="0x880d" name="RB_RENDER_COMPONENTS" usage="rp_blit">
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+	<reg32 offset="0x880e" name="RB_DITHER_CNTL" usage="cmd">
+		<bitfield name="DITHER_MODE_MRT0" low="0"  high="1"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT1" low="2"  high="3"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT2" low="4"  high="5"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT3" low="6"  high="7"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT4" low="8"  high="9"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT5" low="10" high="11" type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT6" low="12" high="13" type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT7" low="14" high="15" type="adreno_rb_dither_mode"/>
+	</reg32>
+	<reg32 offset="0x880f" name="RB_SRGB_CNTL" usage="rp_blit">
+		<!-- Same as SP_SRGB_CNTL -->
+		<bitfield name="SRGB_MRT0" pos="0" type="boolean"/>
+		<bitfield name="SRGB_MRT1" pos="1" type="boolean"/>
+		<bitfield name="SRGB_MRT2" pos="2" type="boolean"/>
+		<bitfield name="SRGB_MRT3" pos="3" type="boolean"/>
+		<bitfield name="SRGB_MRT4" pos="4" type="boolean"/>
+		<bitfield name="SRGB_MRT5" pos="5" type="boolean"/>
+		<bitfield name="SRGB_MRT6" pos="6" type="boolean"/>
+		<bitfield name="SRGB_MRT7" pos="7" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x8810" name="RB_SAMPLE_CNTL" usage="rp_blit">
+		<bitfield name="PER_SAMP_MODE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8811" name="RB_UNKNOWN_8811" low="4" high="6" usage="cmd"/>
+	<reg32 offset="0x8812" name="RB_UNKNOWN_8812" variants="A7XX-" usage="rp_blit"/>
+	<!-- 0x8813-0x8817 invalid -->
+	<!-- always 0x0 ? -->
+	<reg32 offset="0x8818" name="RB_UNKNOWN_8818" low="0" high="6" usage="cmd"/>
+	<!-- 0x8819-0x881e all 32 bits -->
+	<reg32 offset="0x8819" name="RB_UNKNOWN_8819" usage="cmd"/>
+	<reg32 offset="0x881a" name="RB_UNKNOWN_881A" usage="cmd"/>
+	<reg32 offset="0x881b" name="RB_UNKNOWN_881B" usage="cmd"/>
+	<reg32 offset="0x881c" name="RB_UNKNOWN_881C" usage="cmd"/>
+	<reg32 offset="0x881d" name="RB_UNKNOWN_881D" usage="cmd"/>
+	<reg32 offset="0x881e" name="RB_UNKNOWN_881E" usage="cmd"/>
+	<!-- 0x881f invalid -->
+	<array offset="0x8820" name="RB_MRT" stride="8" length="8" usage="rp_blit">
+		<reg32 offset="0x0" name="CONTROL">
+			<bitfield name="BLEND" pos="0" type="boolean"/>
+			<bitfield name="BLEND2" pos="1" type="boolean"/>
+			<bitfield name="ROP_ENABLE" pos="2" type="boolean"/>
+			<bitfield name="ROP_CODE" low="3" high="6" type="a3xx_rop_code"/>
+			<bitfield name="COMPONENT_ENABLE" low="7" high="10" type="hex"/>
+		</reg32>
+		<reg32 offset="0x1" name="BLEND_CONTROL">
+			<bitfield name="RGB_SRC_FACTOR" low="0" high="4" type="adreno_rb_blend_factor"/>
+			<bitfield name="RGB_BLEND_OPCODE" low="5" high="7" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="RGB_DEST_FACTOR" low="8" high="12" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_SRC_FACTOR" low="16" high="20" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_BLEND_OPCODE" low="21" high="23" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="ALPHA_DEST_FACTOR" low="24" high="28" type="adreno_rb_blend_factor"/>
+		</reg32>
+		<reg32 offset="0x2" name="BUF_INFO" variants="A6XX">
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+			<bitfield name="COLOR_TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+			<bitfield name="UNK10" pos="10"/>
+			<bitfield name="COLOR_SWAP" low="13" high="14" type="a3xx_color_swap"/>
+		</reg32>
+		<reg32 offset="0x2" name="BUF_INFO" variants="A7XX-">
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+			<bitfield name="COLOR_TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+			<bitfield name="UNK10" pos="10"/>
+			<bitfield name="LOSSLESSCOMPEN" pos="11" type="boolean"/>
+			<bitfield name="COLOR_SWAP" low="13" high="14" type="a3xx_color_swap"/>
+			<bitfield name="MUTABLEEN" pos="16" type="boolean" variants="A7XX-"/>
+		</reg32>
+		<!--
+		at least in gmem, things seem to be aligned to pitch of 64..
+		maybe an artifact of tiled format used in gmem?
+		 -->
+		<reg32 offset="0x3" name="PITCH" shr="6" high="15" type="uint"/>
+		<reg32 offset="0x4" name="ARRAY_PITCH" shr="6" high="28" type="uint"/>
+		<!--
+		Compared to a5xx and before, we configure both a GMEM base and
+		external base.  Not sure if this is to facilitate GMEM save/
+		restore for context switch, or just to simplify state setup to
+		not have to care about GMEM vs BYPASS mode.
+		 -->
+		<!-- maybe something in low bits since alignment of 1 doesn't make sense? -->
+		<reg64 offset="0x5" name="BASE" type="waddress" align="1"/>
+
+		<reg32 offset="0x7" name="BASE_GMEM" low="12" high="31" shr="12"/>
+	</array>
+
+	<reg32 offset="0x8860" name="RB_BLEND_RED_F32" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8861" name="RB_BLEND_GREEN_F32" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8862" name="RB_BLEND_BLUE_F32" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8863" name="RB_BLEND_ALPHA_F32" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8864" name="RB_ALPHA_CONTROL" usage="cmd">
+		<bitfield name="ALPHA_REF" low="0" high="7" type="hex"/>
+		<bitfield name="ALPHA_TEST" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TEST_FUNC" low="9" high="11" type="adreno_compare_func"/>
+	</reg32>
+	<reg32 offset="0x8865" name="RB_BLEND_CNTL" usage="rp_blit">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="INDEPENDENT_BLEND" pos="8" type="boolean"/>
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="9" type="boolean"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="10" type="boolean"/>
+		<bitfield name="ALPHA_TO_ONE" pos="11" type="boolean"/>
+		<bitfield name="SAMPLE_MASK" low="16" high="31"/>
+	</reg32>
+	<!-- 0x8866-0x886f invalid -->
+	<reg32 offset="0x8870" name="RB_DEPTH_PLANE_CNTL" usage="rp_blit">
+		<bitfield name="Z_MODE" low="0" high="1" type="a6xx_ztest_mode"/>
+	</reg32>
+
+	<reg32 offset="0x8871" name="RB_DEPTH_CNTL" usage="rp_blit">
+		<bitfield name="Z_TEST_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="ZFUNC" low="2" high="4" type="adreno_compare_func"/>
+		<bitfield name="Z_CLAMP_ENABLE" pos="5" type="boolean"/>
+		<doc>
+		Z_READ_ENABLE bit is set for zfunc other than GL_ALWAYS or GL_NEVER
+		also set when Z_BOUNDS_ENABLE is set
+		</doc>
+		<bitfield name="Z_READ_ENABLE" pos="6" type="boolean"/>
+		<bitfield name="Z_BOUNDS_ENABLE" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8114" name="GRAS_SU_DEPTH_CNTL" usage="rp_blit">
+		<bitfield name="Z_TEST_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<!-- duplicates GRAS_SU_DEPTH_BUFFER_INFO: -->
+	<reg32 offset="0x8872" name="RB_DEPTH_BUFFER_INFO" variants="A6XX" usage="rp_blit">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a6xx_depth_format"/>
+		<bitfield name="UNK3" low="3" high="4"/>
+	</reg32>
+	<!-- first 4 bits duplicates GRAS_SU_DEPTH_BUFFER_INFO -->
+	<reg32 offset="0x8872" name="RB_DEPTH_BUFFER_INFO" variants="A7XX-" usage="rp_blit">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a6xx_depth_format"/>
+		<bitfield name="UNK3" low="3" high="4"/>
+		<bitfield name="TILEMODE" low="5" high="6" type="a6xx_tile_mode"/>
+		<bitfield name="LOSSLESSCOMPEN" pos="7" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x8873" name="RB_DEPTH_BUFFER_PITCH" low="0" high="13" shr="6" type="uint" usage="rp_blit"/>
+	<reg32 offset="0x8874" name="RB_DEPTH_BUFFER_ARRAY_PITCH" low="0" high="27" shr="6" type="uint" usage="rp_blit"/>
+	<reg64 offset="0x8875" name="RB_DEPTH_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8877" name="RB_DEPTH_BUFFER_BASE_GMEM" low="12" high="31" shr="12" usage="rp_blit"/>
+
+	<reg32 offset="0x8878" name="RB_Z_BOUNDS_MIN" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8879" name="RB_Z_BOUNDS_MAX" type="float" usage="rp_blit"/>
+	<!-- 0x887a-0x887f invalid -->
+	<reg32 offset="0x8880" name="RB_STENCIL_CONTROL" usage="rp_blit">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="STENCIL_ENABLE_BF" pos="1" type="boolean"/>
+		<!--
+			set for stencil operations that require read from stencil
+			buffer, but not for example for stencil clear (which does
+			not require read).. so guessing this is analogous to
+			READ_DEST_ENABLE for color buffer..
+		 -->
+		<bitfield name="STENCIL_READ" pos="2" type="boolean"/>
+		<bitfield name="FUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="FAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="FUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="FAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0x8115" name="GRAS_SU_STENCIL_CNTL" usage="rp_blit">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8881" name="RB_STENCIL_INFO" variants="A6XX" usage="rp_blit">
+		<bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+		<bitfield name="UNK1" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8881" name="RB_STENCIL_INFO" variants="A7XX-" usage="rp_blit">
+		<bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+		<bitfield name="UNK1" pos="1" type="boolean"/>
+		<bitfield name="TILEMODE" low="2" high="3" type="a6xx_tile_mode"/>
+	</reg32>
+	<reg32 offset="0x8882" name="RB_STENCIL_BUFFER_PITCH" low="0" high="11" shr="6" type="uint" usage="rp_blit"/>
+	<reg32 offset="0x8883" name="RB_STENCIL_BUFFER_ARRAY_PITCH" low="0" high="23" shr="6" type="uint" usage="rp_blit"/>
+	<reg64 offset="0x8884" name="RB_STENCIL_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8886" name="RB_STENCIL_BUFFER_BASE_GMEM" low="12" high="31" shr="12" usage="rp_blit"/>
+	<reg32 offset="0x8887" name="RB_STENCILREF" usage="rp_blit">
+		<bitfield name="REF" low="0" high="7"/>
+		<bitfield name="BFREF" low="8" high="15"/>
+	</reg32>
+	<reg32 offset="0x8888" name="RB_STENCILMASK" usage="rp_blit">
+		<bitfield name="MASK" low="0" high="7"/>
+		<bitfield name="BFMASK" low="8" high="15"/>
+	</reg32>
+	<reg32 offset="0x8889" name="RB_STENCILWRMASK" usage="rp_blit">
+		<bitfield name="WRMASK" low="0" high="7"/>
+		<bitfield name="BFWRMASK" low="8" high="15"/>
+	</reg32>
+	<!-- 0x888a-0x888f invalid -->
+	<reg32 offset="0x8890" name="RB_WINDOW_OFFSET" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x8891" name="RB_SAMPLE_COUNT_CONTROL" usage="cmd">
+		<bitfield name="DISABLE" pos="0" type="boolean"/>
+		<bitfield name="COPY" pos="1" type="boolean"/>
+	</reg32>
+	<!-- 0x8892-0x8897 invalid -->
+	<reg32 offset="0x8898" name="RB_LRZ_CNTL" usage="rp_blit">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8899" name="RB_UNKNOWN_8899" variants="A7XX-" usage="cmd"/>
+	<!-- 0x8899-0x88bf invalid -->
+	<!-- clamps depth value for depth test/write -->
+	<reg32 offset="0x88c0" name="RB_Z_CLAMP_MIN" type="float" usage="rp_blit"/>
+	<reg32 offset="0x88c1" name="RB_Z_CLAMP_MAX" type="float" usage="rp_blit"/>
+	<!-- 0x88c2-0x88cf invalid-->
+	<reg32 offset="0x88d0" name="RB_UNKNOWN_88D0" usage="rp_blit">
+		<bitfield name="UNK0" low="0" high="12"/>
+		<bitfield name="UNK16" low="16" high="26"/>
+	</reg32>
+	<reg32 offset="0x88d1" name="RB_BLIT_SCISSOR_TL" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x88d2" name="RB_BLIT_SCISSOR_BR" type="a6xx_reg_xy" usage="rp_blit"/>
+	<!-- weird to duplicate other regs from same block?? -->
+	<reg32 offset="0x88d3" name="RB_BIN_CONTROL2" usage="rp_blit">
+		<bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+	</reg32>
+	<reg32 offset="0x88d4" name="RB_WINDOW_OFFSET2" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x88d5" name="RB_BLIT_GMEM_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="3" high="4" type="a3xx_msaa_samples"/>
+	</reg32>
+	<reg32 offset="0x88d6" name="RB_BLIT_BASE_GMEM" low="12" high="31" shr="12" usage="rp_blit"/>
+	<!-- s/DST_FORMAT/DST_INFO/ probably: -->
+	<reg32 offset="0x88d7" name="RB_BLIT_DST_INFO" usage="rp_blit">
+		<bitfield name="TILE_MODE" low="0" high="1" type="a6xx_tile_mode"/>
+		<bitfield name="FLAGS" pos="2" type="boolean"/>
+		<bitfield name="SAMPLES" low="3" high="4" type="a3xx_msaa_samples"/>
+		<bitfield name="COLOR_SWAP" low="5" high="6" type="a3xx_color_swap"/>
+		<bitfield name="COLOR_FORMAT" low="7" high="14" type="a6xx_format"/>
+		<bitfield name="UNK15" pos="15" type="boolean"/>
+		<bitfield name="MUTABLEEN" pos="16" type="boolean" variants="A7XX-"/>
+	</reg32>
+	<reg64 offset="0x88d8" name="RB_BLIT_DST" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x88da" name="RB_BLIT_DST_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
+	<!-- array-pitch is size of layer -->
+	<reg32 offset="0x88db" name="RB_BLIT_DST_ARRAY_PITCH" low="0" high="28" shr="6" type="uint" usage="rp_blit"/>
+	<reg64 offset="0x88dc" name="RB_BLIT_FLAG_DST" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x88de" name="RB_BLIT_FLAG_DST_PITCH" usage="rp_blit">
+		<bitfield name="PITCH" low="0" high="10" shr="6" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="11" high="27" shr="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x88df" name="RB_BLIT_CLEAR_COLOR_DW0" usage="rp_blit"/>
+	<reg32 offset="0x88e0" name="RB_BLIT_CLEAR_COLOR_DW1" usage="rp_blit"/>
+	<reg32 offset="0x88e1" name="RB_BLIT_CLEAR_COLOR_DW2" usage="rp_blit"/>
+	<reg32 offset="0x88e2" name="RB_BLIT_CLEAR_COLOR_DW3" usage="rp_blit"/>
+
+	<!-- seems somewhat similar to what we called RB_CLEAR_CNTL on a5xx: -->
+	<reg32 offset="0x88e3" name="RB_BLIT_INFO" usage="rp_blit">
+		<bitfield name="UNK0" pos="0" type="boolean"/> <!-- s8 stencil restore/clear?  But also color restore? -->
+		<bitfield name="GMEM" pos="1" type="boolean"/> <!-- set for restore and clear to gmem? -->
+		<bitfield name="SAMPLE_0" pos="2" type="boolean"/> <!-- takes sample 0 instead of averaging -->
+		<bitfield name="DEPTH" pos="3" type="boolean"/> <!-- z16/z32/z24s8/x24x8 clear or resolve? -->
+		<doc>
+			For clearing depth/stencil
+				1 - depth
+				2 - stencil
+				3 - depth+stencil
+			For clearing color buffer:
+				then probably a component mask, I always see 0xf
+		</doc>
+		<bitfield name="CLEAR_MASK" low="4" high="7"/>
+		<!-- set when this is the last resolve on a650+ -->
+		<bitfield name="LAST" low="8" high="9"/>
+		<!--
+			a618 GLES: color render target number being resolved for RM6_RESOLVE, 0x8 for depth, 0x9 for separate stencil.
+			a618 VK: 0x8 for depth RM6_RESOLVE, 0x9 for separate stencil, 0 otherwise.
+
+			We believe this is related to concurrent resolves
+		 -->
+		<bitfield name="BUFFER_ID" low="12" high="15"/>
+	</reg32>
+	<reg32 offset="0x88e4" name="RB_UNKNOWN_88E4" variants="A7XX-" usage="rp_blit">
+		<!-- Value conditioned based on predicate, changed before blits -->
+		<bitfield name="UNK0" pos="0" type="boolean"/>
+	</reg32>
+
+	<enum name="a6xx_ccu_cache_size">
+		<value value="0x0" name="CCU_CACHE_SIZE_FULL"/>
+		<value value="0x1" name="CCU_CACHE_SIZE_HALF"/>
+		<value value="0x2" name="CCU_CACHE_SIZE_QUARTER"/>
+		<value value="0x3" name="CCU_CACHE_SIZE_EIGHTH"/>
+	</enum>
+	<reg32 offset="0x88e5" name="RB_CCU_CNTL2" variants="A7XX-" usage="cmd">
+		<bitfield name="DEPTH_OFFSET_HI" pos="0" type="hex"/>
+		<bitfield name="COLOR_OFFSET_HI" pos="2" type="hex"/>
+		<bitfield name="DEPTH_CACHE_SIZE" low="10" high="11" type="a6xx_ccu_cache_size"/>
+		<!-- GMEM offset of CCU depth cache -->
+		<bitfield name="DEPTH_OFFSET" low="12" high="20" shr="12" type="hex"/>
+		<bitfield name="COLOR_CACHE_SIZE" low="21" high="22" type="a6xx_ccu_cache_size"/>
+		<!-- GMEM offset of CCU color cache
+			for GMEM rendering, we set it to GMEM size minus the minimum
+			CCU color cache size. CCU color cache will be needed in some
+			resolve cases, and in those cases we need to reserve the end
+			of GMEM for color cache.
+		-->
+		<bitfield name="COLOR_OFFSET" low="23" high="31" shr="12" type="hex"/>
+	</reg32>
+	<!-- 0x88e6-0x88ef invalid -->
+	<!-- always 0x0 ? -->
+	<reg32 offset="0x88f0" name="RB_UNKNOWN_88F0" low="0" high="11" usage="cmd"/>
+	<!-- could be for separate stencil? (or may not be a flag buffer at all) -->
+	<reg64 offset="0x88f1" name="RB_UNK_FLAG_BUFFER_BASE" type="waddress" align="64"/>
+	<reg32 offset="0x88f3" name="RB_UNK_FLAG_BUFFER_PITCH">
+		<bitfield name="PITCH" low="0" high="10" shr="6" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="11" high="23" shr="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x88f4" name="RB_UNKNOWN_88F4" low="0" high="2"/>
+	<!-- Connected to VK_EXT_fragment_density_map? -->
+	<reg32 offset="0x88f5" name="RB_UNKNOWN_88F5" variants="A7XX-"/>
+	<!-- 0x88f6-0x88ff invalid -->
+	<reg64 offset="0x8900" name="RB_DEPTH_FLAG_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8902" name="RB_DEPTH_FLAG_BUFFER_PITCH" usage="rp_blit">
+		<bitfield name="PITCH" low="0" high="6" shr="6" type="uint"/>
+		<!-- TODO: actually part of array pitch -->
+		<bitfield name="UNK8" low="8" high="10"/>
+		<bitfield name="ARRAY_PITCH" low="11" high="27" shr="7" type="uint"/>
+	</reg32>
+	<array offset="0x8903" name="RB_MRT_FLAG_BUFFER" stride="3" length="8" usage="rp_blit">
+		<reg64 offset="0" name="ADDR" type="waddress" align="64"/>
+		<reg32 offset="2" name="PITCH">
+			<bitfield name="PITCH" low="0" high="10" shr="6" type="uint"/>
+			<bitfield name="ARRAY_PITCH" low="11" high="28" shr="7" type="uint"/>
+		</reg32>
+	</array>
+	<!-- 0x891b-0x8926 invalid -->
+	<doc>
+		RB_SAMPLE_COUNT_ADDR register is used up to (and including) a730. After that
+		the address is specified through CP_EVENT_WRITE7::WRITE_SAMPLE_COUNT.
+	</doc>
+	<reg64 offset="0x8927" name="RB_SAMPLE_COUNT_ADDR" type="waddress" align="16" usage="cmd"/>
+	<!-- 0x8929-0x89ff invalid -->
+
+	<!-- TODO: there are some registers in the 0x8a00-0x8bff range -->
+
+	<!--
+		These show up in a6xx gen3+ but so far haven't found an example of
+		blob writing non-zero:
+	 -->
+	<reg32 offset="0x8a00" name="RB_UNKNOWN_8A00" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0x8a10" name="RB_UNKNOWN_8A10" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0x8a20" name="RB_UNKNOWN_8A20" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0x8a30" name="RB_UNKNOWN_8A30" variants="A6XX" usage="rp_blit"/>
+
+	<reg32 offset="0x8c00" name="RB_2D_BLIT_CNTL" type="a6xx_2d_blit_cntl" usage="rp_blit"/>
+	<reg32 offset="0x8c01" name="RB_2D_UNKNOWN_8C01" low="0" high="31" usage="rp_blit"/>
+
+	<bitset name="a6xx_2d_src_surf_info" inline="yes">
+		<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+		<bitfield name="TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+		<bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+		<bitfield name="FLAGS" pos="12" type="boolean"/>
+		<bitfield name="SRGB" pos="13" type="boolean"/>
+		<bitfield name="SAMPLES" low="14" high="15" type="a3xx_msaa_samples"/>
+		<bitfield name="FILTER" pos="16" type="boolean"/>
+		<bitfield name="UNK17" pos="17" type="boolean"/>
+		<bitfield name="SAMPLES_AVERAGE" pos="18" type="boolean"/>
+		<bitfield name="UNK19" pos="19" type="boolean"/>
+		<bitfield name="UNK20" pos="20" type="boolean"/>
+		<bitfield name="UNK21" pos="21" type="boolean"/>
+		<bitfield name="UNK22" pos="22" type="boolean"/>
+		<bitfield name="UNK23" low="23" high="26"/>
+		<bitfield name="UNK28" pos="28" type="boolean"/>
+		<bitfield name="MUTABLEEN" pos="29" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<bitset name="a6xx_2d_dst_surf_info" inline="yes">
+		<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+		<bitfield name="TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+		<bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+		<bitfield name="FLAGS" pos="12" type="boolean"/>
+		<bitfield name="SRGB" pos="13" type="boolean"/>
+		<bitfield name="SAMPLES" low="14" high="15" type="a3xx_msaa_samples"/>
+		<bitfield name="MUTABLEEN" pos="17" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<!-- 0x8c02-0x8c16 invalid -->
+	<reg32 offset="0x8c17" name="RB_2D_DST_INFO" type="a6xx_2d_dst_surf_info" usage="rp_blit"/>
+	<reg64 offset="0x8c18" name="RB_2D_DST" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8c1a" name="RB_2D_DST_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
+	<!-- this is a guess but seems likely (for NV12/IYUV): -->
+	<reg64 offset="0x8c1b" name="RB_2D_DST_PLANE1" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8c1d" name="RB_2D_DST_PLANE_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
+	<reg64 offset="0x8c1e" name="RB_2D_DST_PLANE2" type="waddress" align="64" usage="rp_blit"/>
+
+	<reg64 offset="0x8c20" name="RB_2D_DST_FLAGS" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8c22" name="RB_2D_DST_FLAGS_PITCH" low="0" high="7" shr="6" type="uint" usage="rp_blit"/>
+	<!-- this is a guess but seems likely (for NV12 with UBWC): -->
+	<reg64 offset="0x8c23" name="RB_2D_DST_FLAGS_PLANE" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8c25" name="RB_2D_DST_FLAGS_PLANE_PITCH" low="0" high="7" shr="6" type="uint" usage="rp_blit"/>
+
+	<!-- TODO: 0x8c26-0x8c33 are all full 32-bit registers -->
+	<!-- unlike a5xx, these are per channel values rather than packed -->
+	<reg32 offset="0x8c2c" name="RB_2D_SRC_SOLID_C0" usage="rp_blit"/>
+	<reg32 offset="0x8c2d" name="RB_2D_SRC_SOLID_C1" usage="rp_blit"/>
+	<reg32 offset="0x8c2e" name="RB_2D_SRC_SOLID_C2" usage="rp_blit"/>
+	<reg32 offset="0x8c2f" name="RB_2D_SRC_SOLID_C3" usage="rp_blit"/>
+
+	<reg32 offset="0x8c34" name="RB_UNKNOWN_8C34" variants="A7XX-" usage="cmd"/>
+
+	<!-- 0x8c35-0x8dff invalid -->
+
+	<!-- always 0x1 ? either doesn't exist for a650 or write-only: -->
+	<reg32 offset="0x8e01" name="RB_UNKNOWN_8E01" usage="cmd"/>
+	<!-- 0x8e00-0x8e03 invalid -->
+	<reg32 offset="0x8e04" name="RB_DBG_ECO_CNTL" usage="cmd"/> <!-- TODO: valid mask 0xfffffeff -->
+	<reg32 offset="0x8e05" name="RB_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode"/>
+	<!-- 0x02080000 in GMEM, zero otherwise?  -->
+	<reg32 offset="0x8e06" name="RB_UNKNOWN_8E06" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0x8e07" name="RB_CCU_CNTL" usage="cmd" variants="A6XX">
+		<bitfield name="GMEM_FAST_CLEAR_DISABLE" pos="0" type="boolean"/>
+		<!-- concurrent resolves are apparently a 2-bit enum on a650+ -->
+		<bitfield name="CONCURRENT_RESOLVE" pos="2" type="boolean"/>
+		<bitfield name="DEPTH_OFFSET_HI" pos="7" type="hex"/>
+		<bitfield name="COLOR_OFFSET_HI" pos="9" type="hex"/>
+		<bitfield name="DEPTH_CACHE_SIZE" low="10" high="11" type="a6xx_ccu_cache_size"/>
+		<!-- GMEM offset of CCU depth cache -->
+		<bitfield name="DEPTH_OFFSET" low="12" high="20" shr="12" type="hex"/>
+		<bitfield name="COLOR_CACHE_SIZE" low="21" high="22" type="a6xx_ccu_cache_size"/>
+		<!-- GMEM offset of CCU color cache
+			for GMEM rendering, we set it to GMEM size minus the minimum
+			CCU color cache size. CCU color cache will be needed in some
+			resolve cases, and in those cases we need to reserve the end
+			of GMEM for color cache.
+		-->
+		<bitfield name="COLOR_OFFSET" low="23" high="31" shr="12" type="hex"/>
+		<!--TODO: valid mask 0xfffffc1f -->
+	</reg32>
+	<reg32 offset="0x8e07" name="RB_CCU_CNTL" usage="cmd" variants="A7XX-">
+		<bitfield name="GMEM_FAST_CLEAR_DISABLE" pos="0" type="boolean"/>
+		<bitfield name="CONCURRENT_RESOLVE" pos="2" type="boolean"/>
+		<!-- rest of the bits were moved to RB_CCU_CNTL2 -->
+	</reg32>
+	<reg32 offset="0x8e08" name="RB_NC_MODE_CNTL">
+		<bitfield name="MODE" pos="0" type="boolean"/>
+		<bitfield name="LOWER_BIT" low="1" high="2" type="uint"/>
+		<bitfield name="MIN_ACCESS_LENGTH" pos="3" type="boolean"/> <!-- true=64b false=32b -->
+		<bitfield name="AMSBC" pos="4" type="boolean"/>
+		<bitfield name="UPPER_BIT" pos="10" type="uint"/>
+		<bitfield name="RGB565_PREDICATOR" pos="11" type="boolean"/>
+		<bitfield name="UNK12" low="12" high="13"/>
+	</reg32>
+	<reg32 offset="0x8e09" name="RB_UNKNOWN_8E09" variants="A7XX-" usage="cmd"/>
+	<!-- 0x8e09-0x8e0f invalid -->
+	<array offset="0x8e10" name="RB_PERFCTR_RB_SEL" stride="1" length="8"/>
+	<array offset="0x8e18" name="RB_PERFCTR_CCU_SEL" stride="1" length="5"/>
+	<!-- 0x8e1d-0x8e1f invalid -->
+	<!-- 0x8e20-0x8e25 more perfcntr sel? -->
+	<!-- 0x8e26-0x8e27 invalid -->
+	<reg32 offset="0x8e28" name="RB_CMP_DBG_ECO_CNTL"/>
+	<!-- 0x8e29-0x8e2b invalid -->
+	<array offset="0x8e2c" name="RB_PERFCTR_CMP_SEL" stride="1" length="4"/>
+	<array offset="0x8e30" name="RB_PERFCTR_UFC_SEL" stride="1" length="6" variants="A7XX-"/>
+	<reg32 offset="0x8e3b" name="RB_RB_SUB_BLOCK_SEL_CNTL_HOST"/>
+	<reg32 offset="0x8e3d" name="RB_RB_SUB_BLOCK_SEL_CNTL_CD"/>
+	<!-- 0x8e3e-0x8e4f invalid -->
+	<!-- GMEM save/restore for preemption: -->
+	<reg32 offset="0x8e50" name="RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE" pos="0" type="boolean"/>
+	<!-- address for GMEM save/restore? -->
+	<reg32 offset="0x8e51" name="RB_UNKNOWN_8E51" type="waddress" align="1"/>
+	<!-- 0x8e53-0x8e7f invalid -->
+	<reg32 offset="0x8e79" name="RB_UNKNOWN_8E79" variants="A7XX-" usage="cmd"/>
+	<!-- 0x8e80-0x8e83 are valid -->
+	<!-- 0x8e84-0x90ff invalid -->
+
+	<!-- 0x9000-0x90ff invalid -->
+
+	<reg32 offset="0x9100" name="VPC_GS_PARAM" variants="A6XX" usage="rp_blit">
+		<bitfield name="LINELENGTHLOC" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<bitset name="a6xx_vpc_xs_clip_cntl" inline="yes">
+		<bitfield name="CLIP_MASK" low="0" high="7" type="uint"/>
+		<!-- there can be up to 8 total clip/cull distance outputs,
+		     but apparenly VPC can only deal with vec4, so when there are
+		     more than 4 outputs a second location needs to be programmed
+		-->
+		<bitfield name="CLIP_DIST_03_LOC" low="8" high="15" type="uint"/>
+		<bitfield name="CLIP_DIST_47_LOC" low="16" high="23" type="uint"/>
+	</bitset>
+	<reg32 offset="0x9101" name="VPC_VS_CLIP_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9102" name="VPC_GS_CLIP_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9103" name="VPC_DS_CLIP_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+
+	<reg32 offset="0x9311" name="VPC_VS_CLIP_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9312" name="VPC_GS_CLIP_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9313" name="VPC_DS_CLIP_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+
+	<bitset name="a6xx_vpc_xs_layer_cntl" inline="yes">
+		<bitfield name="LAYERLOC" low="0" high="7" type="uint"/>
+		<bitfield name="VIEWLOC" low="8" high="15" type="uint"/>
+		<bitfield name="SHADINGRATELOC" low="16" high="23" type="uint" variants="A7XX-"/>
+	</bitset>
+
+	<reg32 offset="0x9104" name="VPC_VS_LAYER_CNTL" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9105" name="VPC_GS_LAYER_CNTL" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9106" name="VPC_DS_LAYER_CNTL" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+
+	<reg32 offset="0x9314" name="VPC_VS_LAYER_CNTL_V2" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9315" name="VPC_GS_LAYER_CNTL_V2" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9316" name="VPC_DS_LAYER_CNTL_V2" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+
+	<reg32 offset="0x9107" name="VPC_UNKNOWN_9107" variants="A6XX" usage="rp_blit">
+		<!-- this mirrors PC_RASTER_CNTL::DISCARD, although it seems it's unused -->
+		<bitfield name="RASTER_DISCARD" pos="0" type="boolean"/>
+		<bitfield name="UNK2" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x9108" name="VPC_POLYGON_MODE" usage="rp_blit">
+		<bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+	</reg32>
+
+	<bitset name="a6xx_primitive_cntl_0" inline="yes">
+		<bitfield name="PRIMITIVE_RESTART" pos="0" type="boolean"/>
+		<bitfield name="PROVOKING_VTX_LAST" pos="1" type="boolean"/>
+		<bitfield name="D3D_VERTEX_ORDERING" pos="2" type="boolean">
+			<doc>
+				Swaps TESS_CW_TRIS/TESS_CCW_TRIS, and also makes
+				triangle fans and triangle strips use the D3D
+				order instead of the OpenGL order.
+			</doc>
+		</bitfield>
+		<bitfield name="UNK3" pos="3" type="boolean"/>
+	</bitset>
+
+	<bitset name="a6xx_primitive_cntl_5" inline="yes">
+		<doc>
+		  geometry shader
+		</doc>
+		<!-- TODO: first 16 bits are valid so something is wrong or missing here -->
+		<bitfield name="GS_VERTICES_OUT" low="0" high="7" type="uint"/>
+		<bitfield name="GS_INVOCATIONS" low="10" high="14" type="uint"/>
+		<bitfield name="LINELENGTHEN" pos="15" type="boolean"/>
+		<bitfield name="GS_OUTPUT" low="16" high="17" type="a6xx_tess_output"/>
+		<bitfield name="UNK18" pos="18"/>
+	</bitset>
+
+	<bitset name="a6xx_multiview_cntl" inline="yes">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="DISABLEMULTIPOS" pos="1" type="boolean">
+			<doc>
+				Multi-position output lets the last geometry
+				stage shader write multiple copies of
+				gl_Position. If disabled then the VS is run once
+				for each view, and ViewID is passed as a
+				register to the VS.
+			</doc>
+		</bitfield>
+		<bitfield name="VIEWS" low="2" high="6" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x9109" name="VPC_PRIMITIVE_CNTL_0" type="a6xx_primitive_cntl_0" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0x910a" name="VPC_PRIMITIVE_CNTL_5" type="a6xx_primitive_cntl_5" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0x910b" name="VPC_MULTIVIEW_MASK" type="hex" low="0" high="15" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0x910c" name="VPC_MULTIVIEW_CNTL" type="a6xx_multiview_cntl" variants="A7XX-" usage="rp_blit"/>
+
+	<enum name="a6xx_varying_interp_mode">
+		<value value="0" name="INTERP_SMOOTH"/>
+		<value value="1" name="INTERP_FLAT"/>
+		<value value="2" name="INTERP_ZERO"/>
+		<value value="3" name="INTERP_ONE"/>
+	</enum>
+
+	<enum name="a6xx_varying_ps_repl_mode">
+		<value value="0" name="PS_REPL_NONE"/>
+		<value value="1" name="PS_REPL_S"/>
+		<value value="2" name="PS_REPL_T"/>
+		<value value="3" name="PS_REPL_ONE_MINUS_T"/>
+	</enum>
+
+	<!-- 0x9109-0x91ff invalid -->
+	<array offset="0x9200" name="VPC_VARYING_INTERP" stride="1" length="8" usage="rp_blit">
+		<doc>Packed array of a6xx_varying_interp_mode</doc>
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+	<array offset="0x9208" name="VPC_VARYING_PS_REPL" stride="1" length="8" usage="rp_blit">
+		<doc>Packed array of a6xx_varying_ps_repl_mode</doc>
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+
+	<!-- always 0x0 -->
+	<reg32 offset="0x9210" name="VPC_UNKNOWN_9210" low="0" high="31" variants="A6XX" usage="cmd"/>
+	<reg32 offset="0x9211" name="VPC_UNKNOWN_9211" low="0" high="31" variants="A6XX" usage="cmd"/>
+
+	<array offset="0x9212" name="VPC_VAR" stride="1" length="4" usage="rp_blit">
+		<!-- one bit per varying component: -->
+		<reg32 offset="0" name="DISABLE"/>
+	</array>
+
+	<reg32 offset="0x9216" name="VPC_SO_CNTL" usage="rp_blit">
+		<!--
+			Choose which DWORD to write to. There is an array of
+			(4 * 64) DWORD's, dumped in the devcoredump at
+			HLSQ_INST_RAM dword 0x400. Each DWORD corresponds to a
+			(VPC location, stream) pair like so:
+
+			location 0, stream 0
+			location 2, stream 0
+			...
+			location 126, stream 0
+			location 0, stream 1
+			location 2, stream 1
+			...
+			location 126, stream 1
+			location 0, stream 2
+			...
+
+			When EmitStreamVertex(N) happens, the HW goes to DWORD
+			64 * N and then "executes" the next 64 DWORD's.
+
+			This field is auto-incremented when VPC_SO_PROG is
+			written to.
+		-->
+		<bitfield name="ADDR" low="0" high="7" type="hex"/>
+		<!-- clear all A_EN and B_EN bits for all DWORD's -->
+		<bitfield name="RESET" pos="16" type="boolean"/>
+	</reg32>
+	<!-- special register, write multiple times to load SO program (not readable) -->
+	<reg32 offset="0x9217" name="VPC_SO_PROG" usage="rp_blit">
+		<bitfield name="A_BUF" low="0" high="1" type="uint"/>
+		<bitfield name="A_OFF" low="2" high="10" shr="2" type="uint"/>
+		<bitfield name="A_EN" pos="11" type="boolean"/>
+		<bitfield name="B_BUF" low="12" high="13" type="uint"/>
+		<bitfield name="B_OFF" low="14" high="22" shr="2" type="uint"/>
+		<bitfield name="B_EN" pos="23" type="boolean"/>
+	</reg32>
+
+	<reg64 offset="0x9218" name="VPC_SO_STREAM_COUNTS" type="waddress" align="32" usage="cmd"/>
+
+	<array offset="0x921a" name="VPC_SO" stride="7" length="4" usage="cmd">
+		<reg64 offset="0" name="BUFFER_BASE" type="waddress" align="32"/>
+		<reg32 offset="2" name="BUFFER_SIZE" low="2" high="31" shr="2"/>
+		<reg32 offset="3" name="BUFFER_STRIDE" low="0" high="9" shr="2"/>
+		<reg32 offset="4" name="BUFFER_OFFSET" low="2" high="31" shr="2"/>
+		<reg64 offset="5" name="FLUSH_BASE" type="waddress" align="32"/>
+	</array>
+
+	<reg32 offset="0x9236" name="VPC_POINT_COORD_INVERT" usage="cmd">
+		<bitfield name="INVERT" pos="0" type="boolean"/>
+	</reg32>
+	<!-- 0x9237-0x92ff invalid -->
+	<!-- always 0x0 ? -->
+	<reg32 offset="0x9300" name="VPC_UNKNOWN_9300" low="0" high="2" usage="cmd"/>
+
+	<bitset name="a6xx_vpc_xs_pack" inline="yes">
+		<doc>
+			num of varyings plus four for gl_Position (plus one if gl_PointSize)
+			plus # of transform-feedback (streamout) varyings if using the
+			hw streamout (rather than stg instructions in shader)
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="7" type="uint"/>
+		<bitfield name="POSITIONLOC" low="8" high="15" type="uint"/>
+		<bitfield name="PSIZELOC" low="16" high="23" type="uint"/>
+		<bitfield name="EXTRAPOS" low="24" high="27" type="uint">
+			<doc>
+				The number of extra copies of POSITION, i.e.
+				number of views minus one when multi-position
+				output is enabled, otherwise 0.
+			</doc>
+		</bitfield>
+	</bitset>
+	<reg32 offset="0x9301" name="VPC_VS_PACK" type="a6xx_vpc_xs_pack" usage="rp_blit"/>
+	<reg32 offset="0x9302" name="VPC_GS_PACK" type="a6xx_vpc_xs_pack" usage="rp_blit"/>
+	<reg32 offset="0x9303" name="VPC_DS_PACK" type="a6xx_vpc_xs_pack" usage="rp_blit"/>
+
+	<reg32 offset="0x9304" name="VPC_CNTL_0" usage="rp_blit">
+		<bitfield name="NUMNONPOSVAR" low="0" high="7" type="uint"/>
+		<!-- for fixed-function (i.e. no GS) gl_PrimitiveID in FS -->
+		<bitfield name="PRIMIDLOC" low="8" high="15" type="uint"/>
+		<bitfield name="VARYING" pos="16" type="boolean"/>
+		<bitfield name="VIEWIDLOC" low="24" high="31" type="uint">
+			<doc>
+				This VPC location will be overwritten with
+				ViewID when multiview is enabled. It's used when
+				fragment shaders read ViewID. It's only
+				strictly required for multi-position output,
+				where the same VS invocation is used for all the
+				views at once, but it can be used when multi-pos
+				output is disabled too, to avoid having to pass
+				ViewID through the VS.
+			</doc>
+		</bitfield>
+	</reg32>
+
+	<reg32 offset="0x9305" name="VPC_SO_STREAM_CNTL" usage="rp_blit">
+		<!--
+		It's offset by 1, and 0 means "disabled"
+		-->
+		<bitfield name="BUF0_STREAM" low="0" high="2" type="uint"/>
+		<bitfield name="BUF1_STREAM" low="3" high="5" type="uint"/>
+		<bitfield name="BUF2_STREAM" low="6" high="8" type="uint"/>
+		<bitfield name="BUF3_STREAM" low="9" high="11" type="uint"/>
+		<bitfield name="STREAM_ENABLE" low="15" high="18" type="hex"/>
+	</reg32>
+	<reg32 offset="0x9306" name="VPC_SO_DISABLE" usage="rp_blit">
+		<bitfield name="DISABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x9307" name="VPC_POLYGON_MODE2" variants="A7XX-" usage="rp_blit">
+		<bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+	</reg32>
+	<reg32 offset="0x9308" name="VPC_ATTR_BUF_SIZE_GMEM" variants="A7XX-" usage="rp_blit">
+		<bitfield name="SIZE_GMEM" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="0x9309" name="VPC_ATTR_BUF_BASE_GMEM" variants="A7XX-" usage="rp_blit">
+		<bitfield name="BASE_GMEM" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="0x9b09" name="PC_ATTR_BUF_SIZE_GMEM" variants="A7XX-" usage="rp_blit">
+		<bitfield name="SIZE_GMEM" low="0" high="31"/>
+	</reg32>
+
+	<!-- 0x9307-0x95ff invalid -->
+
+	<!-- TODO: 0x9600-0x97ff range -->
+	<reg32 offset="0x9600" name="VPC_DBG_ECO_CNTL" usage="cmd"/> <!-- always 0x0 ? TODO: 0x1fbf37ff valid mask -->
+	<reg32 offset="0x9601" name="VPC_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode" usage="cmd"/>
+	<reg32 offset="0x9602" name="VPC_UNKNOWN_9602" pos="0" usage="cmd"/> <!-- always 0x0 ? -->
+	<reg32 offset="0x9603" name="VPC_UNKNOWN_9603" low="0" high="26"/>
+	<array offset="0x9604" name="VPC_PERFCTR_VPC_SEL" stride="1" length="6" variants="A6XX"/>
+	<array offset="0x960b" name="VPC_PERFCTR_VPC_SEL" stride="1" length="12" variants="A7XX-"/>
+	<!-- 0x960a-0x9623 invalid -->
+	<!-- TODO: regs from 0x9624-0x963a -->
+	<!-- 0x963b-0x97ff invalid -->
+
+	<reg32 offset="0x9800" name="PC_TESS_NUM_VERTEX" low="0" high="5" type="uint" usage="rp_blit"/>
+
+	<!-- always 0x0 ? -->
+	<reg32 offset="0x9801" name="PC_HS_INPUT_SIZE" usage="rp_blit">
+		<bitfield name="SIZE" low="0" high="10" type="uint"/>
+		<bitfield name="UNK13" pos="13"/>
+	</reg32>
+
+	<reg32 offset="0x9802" name="PC_TESS_CNTL" usage="rp_blit">
+		<bitfield name="SPACING" low="0" high="1" type="a6xx_tess_spacing"/>
+		<bitfield name="OUTPUT" low="2" high="3" type="a6xx_tess_output"/>
+	</reg32>
+
+	<reg32 offset="0x9803" name="PC_RESTART_INDEX" low="0" high="31" type="uint" usage="rp_blit"/>
+	<reg32 offset="0x9804" name="PC_MODE_CNTL" low="0" high="7" usage="rp_blit"/>
+
+	<reg32 offset="0x9805" name="PC_POWER_CNTL" low="0" high="2" usage="rp_blit"/>
+
+	<reg32 offset="0x9806" name="PC_PS_CNTL" usage="rp_blit">
+		<bitfield name="PRIMITIVEIDEN" pos="0" type="boolean"/>
+	</reg32>
+
+	<!-- New in a6xx gen3+ -->
+	<reg32 offset="0x9808" name="PC_SO_STREAM_CNTL" usage="rp_blit">
+		<bitfield name="STREAM_ENABLE" low="15" high="18" type="hex"/>
+	</reg32>
+
+	<reg32 offset="0x980a" name="PC_DGEN_SU_CONSERVATIVE_RAS_CNTL">
+		<bitfield name="CONSERVATIVERASEN" pos="0" type="boolean"/>
+	</reg32>
+	<!-- 0x980b-0x983f invalid -->
+
+	<!-- 0x9840 - 0x9842 are not readable -->
+	<reg32 offset="0x9840" name="PC_DRAW_CMD">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0x9841" name="PC_DISPATCH_CMD">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0x9842" name="PC_EVENT_CMD">
+		<!-- I think only the low bit is actually used? -->
+		<bitfield name="STATE_ID" low="16" high="23"/>
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+	</reg32>
+
+	<!--
+		0x9880 written in a lot of places by SQE, same value gets written
+		to control reg 0x12a.  Set by CP_SET_MARKER, so lets name it after
+		that
+	 -->
+	<reg32 offset="0x9880" name="PC_MARKER"/>
+
+	<!-- 0x9843-0x997f invalid -->
+
+	<reg32 offset="0x9981" name="PC_POLYGON_MODE" variants="A6XX" usage="rp_blit">
+		<bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+	</reg32>
+	<reg32 offset="0x9809" name="PC_POLYGON_MODE" variants="A7XX-" usage="rp_blit">
+		<bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+	</reg32>
+
+	<reg32 offset="0x9980" name="PC_RASTER_CNTL" variants="A6XX" usage="rp_blit">
+		<!-- which stream to send to GRAS -->
+		<bitfield name="STREAM" low="0" high="1" type="uint"/>
+		<!-- discard primitives before rasterization -->
+		<bitfield name="DISCARD" pos="2" type="boolean"/>
+	</reg32>
+	<!-- VPC_RASTER_CNTL -->
+	<reg32 offset="0x9107" name="PC_RASTER_CNTL" variants="A7XX-" usage="rp_blit">
+		<!-- which stream to send to GRAS -->
+		<bitfield name="STREAM" low="0" high="1" type="uint"/>
+		<!-- discard primitives before rasterization -->
+		<bitfield name="DISCARD" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x9317" name="PC_RASTER_CNTL_V2" variants="A7XX-" usage="rp_blit">
+		<!-- which stream to send to GRAS -->
+		<bitfield name="STREAM" low="0" high="1" type="uint"/>
+		<!-- discard primitives before rasterization -->
+		<bitfield name="DISCARD" pos="2" type="boolean"/>
+	</reg32>
+
+	<!-- Both are a750+.
+	     Probably needed to correctly overlap execution of several draws.
+	-->
+	<reg32 offset="0x9885" name="PC_TESS_PARAM_SIZE" variants="A7XX-" usage="cmd"/>
+	<!-- Blob adds a bit more space {0x10, 0x20, 0x30, 0x40} bytes, but the meaning of
+	     this additional space is not known.
+	-->
+	<reg32 offset="0x9886" name="PC_TESS_FACTOR_SIZE" variants="A7XX-" usage="cmd"/>
+
+	<!-- 0x9982-0x9aff invalid -->
+
+	<reg32 offset="0x9b00" name="PC_PRIMITIVE_CNTL_0" type="a6xx_primitive_cntl_0" usage="rp_blit"/>
+
+	<bitset name="a6xx_xs_out_cntl" inline="yes">
+		<doc>
+			num of varyings plus four for gl_Position (plus one if gl_PointSize)
+			plus # of transform-feedback (streamout) varyings if using the
+			hw streamout (rather than stg instructions in shader)
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="7" type="uint"/>
+		<bitfield name="PSIZE" pos="8" type="boolean"/>
+		<bitfield name="LAYER" pos="9" type="boolean"/>
+		<bitfield name="VIEW" pos="10" type="boolean"/>
+		<!-- note: PC_VS_OUT_CNTL doesn't have the PRIMITIVE_ID bit -->
+		<bitfield name="PRIMITIVE_ID" pos="11" type="boolean"/>
+		<bitfield name="CLIP_MASK" low="16" high="23" type="uint"/>
+		<bitfield name="SHADINGRATE" pos="24" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<reg32 offset="0x9b01" name="PC_VS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9b02" name="PC_GS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+	<!-- since HS can't output anything, only PRIMITIVE_ID is valid -->
+	<reg32 offset="0x9b03" name="PC_HS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9b04" name="PC_DS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+
+	<reg32 offset="0x9b05" name="PC_PRIMITIVE_CNTL_5" type="a6xx_primitive_cntl_5" usage="rp_blit"/>
+
+	<reg32 offset="0x9b06" name="PC_PRIMITIVE_CNTL_6" variants="A6XX" usage="rp_blit">
+		<doc>
+		  size in vec4s of per-primitive storage for gs. TODO: not actually in VPC
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="10" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x9b07" name="PC_MULTIVIEW_CNTL" type="a6xx_multiview_cntl" usage="rp_blit"/>
+	<!-- mask of enabled views, doesn't exist on A630 -->
+	<reg32 offset="0x9b08" name="PC_MULTIVIEW_MASK" type="hex" low="0" high="15" usage="rp_blit"/>
+	<!-- 0x9b09-0x9bff invalid -->
+	<reg32 offset="0x9c00" name="PC_2D_EVENT_CMD">
+		<!-- special register (but note first 8 bits can be written/read) -->
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+		<bitfield name="STATE_ID" low="8" high="15"/>
+	</reg32>
+	<!-- 0x9c01-0x9dff invalid -->
+	<!-- TODO: 0x9e00-0xa000 range incomplete -->
+	<reg32 offset="0x9e00" name="PC_DBG_ECO_CNTL"/>
+	<reg32 offset="0x9e01" name="PC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg64 offset="0x9e04" name="PC_DRAW_INDX_BASE"/>
+	<reg32 offset="0x9e06" name="PC_DRAW_FIRST_INDX" type="uint"/>
+	<reg32 offset="0x9e07" name="PC_DRAW_MAX_INDICES" type="uint"/>
+	<reg64 offset="0x9e08" name="PC_TESSFACTOR_ADDR" variants="A6XX" type="waddress" align="32" usage="cmd"/>
+	<reg64 offset="0x9810" name="PC_TESSFACTOR_ADDR" variants="A7XX-" type="waddress" align="32" usage="cmd"/>
+
+	<reg32 offset="0x9e0b" name="PC_DRAW_INITIATOR" type="vgt_draw_initiator_a4xx">
+		<doc>
+			Possibly not really "initiating" the draw but the layout is similar
+			to VGT_DRAW_INITIATOR on older gens
+		</doc>
+	</reg32>
+	<reg32 offset="0x9e0c" name="PC_DRAW_NUM_INSTANCES" type="uint"/>
+	<reg32 offset="0x9e0d" name="PC_DRAW_NUM_INDICES" type="uint"/>
+
+	<!-- These match the contents of CP_SET_BIN_DATA (not written directly) -->
+	<reg32 offset="0x9e11" name="PC_VSTREAM_CONTROL">
+		<bitfield name="UNK0" low="0" high="15"/>
+		<bitfield name="VSC_SIZE" low="16" high="21" type="uint"/>
+		<bitfield name="VSC_N" low="22" high="26" type="uint"/>
+	</reg32>
+	<reg64 offset="0x9e12" name="PC_BIN_PRIM_STRM" type="waddress" align="32"/>
+	<reg64 offset="0x9e14" name="PC_BIN_DRAW_STRM" type="waddress" align="32"/>
+
+	<reg32 offset="0x9e1c" name="PC_VISIBILITY_OVERRIDE">
+		<doc>Written by CP_SET_VISIBILITY_OVERRIDE handler</doc>
+		<bitfield name="OVERRIDE" pos="0" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x9e24" name="PC_UNKNOWN_9E24" variants="A7XX-" usage="cmd"/>
+
+	<array offset="0x9e34" name="PC_PERFCTR_PC_SEL" stride="1" length="8" variants="A6XX"/>
+	<array offset="0x9e42" name="PC_PERFCTR_PC_SEL" stride="1" length="16" variants="A7XX-"/>
+
+	<!-- always 0x0 -->
+	<reg32 offset="0x9e72" name="PC_UNKNOWN_9E72" usage="cmd"/>
+
+	<reg32 offset="0xa000" name="VFD_CONTROL_0" usage="rp_blit">
+		<bitfield name="FETCH_CNT" low="0" high="5" type="uint"/>
+		<bitfield name="DECODE_CNT" low="8" high="13" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa001" name="VFD_CONTROL_1" usage="rp_blit">
+		<bitfield name="REGID4VTX" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="REGID4INST" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID4PRIMID" low="16" high="23" type="a3xx_regid"/>
+		<!-- only used for VS in non-multi-position-output case -->
+		<bitfield name="REGID4VIEWID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa002" name="VFD_CONTROL_2" usage="rp_blit">
+		<bitfield name="REGID_HSRELPATCHID" low="0" high="7" type="a3xx_regid">
+			<doc>
+				This is the ID of the current patch within the
+				subdraw, used to calculate the offset of the
+				patch within the HS->DS buffers. When a draw is
+				split into multiple subdraws then this differs
+				from gl_PrimitiveID on the second, third, etc.
+				subdraws.
+			</doc>
+		</bitfield>
+		<bitfield name="REGID_INVOCATIONID" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa003" name="VFD_CONTROL_3" usage="rp_blit">
+		<bitfield name="REGID_DSPRIMID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="REGID_DSRELPATCHID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSY" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa004" name="VFD_CONTROL_4" usage="rp_blit">
+		<bitfield name="UNK0" low="0" high="7" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa005" name="VFD_CONTROL_5" usage="rp_blit">
+		<bitfield name="REGID_GSHEADER" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="UNK8" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa006" name="VFD_CONTROL_6" usage="rp_blit">
+		<!--
+			True if gl_PrimitiveID is read via the FS
+		-->
+		<bitfield name="PRIMID4PSEN" pos="0" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xa007" name="VFD_MODE_CNTL" usage="cmd">
+		<bitfield name="RENDER_MODE" low="0" high="2" type="a6xx_render_mode"/>
+	</reg32>
+
+	<reg32 offset="0xa008" name="VFD_MULTIVIEW_CNTL" type="a6xx_multiview_cntl" usage="rp_blit"/>
+	<reg32 offset="0xa009" name="VFD_ADD_OFFSET" usage="cmd">
+		<!-- add VFD_INDEX_OFFSET to REGID4VTX -->
+		<bitfield name="VERTEX" pos="0" type="boolean"/>
+		<!-- add VFD_INSTANCE_START_OFFSET to REGID4INST -->
+		<bitfield name="INSTANCE" pos="1" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xa00e" name="VFD_INDEX_OFFSET" usage="rp_blit"/>
+	<reg32 offset="0xa00f" name="VFD_INSTANCE_START_OFFSET" usage="rp_blit"/>
+	<array offset="0xa010" name="VFD_FETCH" stride="4" length="32" usage="rp_blit">
+		<reg64 offset="0x0" name="BASE" type="address" align="1"/>
+		<reg32 offset="0x2" name="SIZE" type="uint"/>
+		<reg32 offset="0x3" name="STRIDE" low="0" high="11" type="uint"/>
+	</array>
+	<array offset="0xa090" name="VFD_DECODE" stride="2" length="32" usage="rp_blit">
+		<reg32 offset="0x0" name="INSTR">
+			<!-- IDX and byte OFFSET into VFD_FETCH -->
+			<bitfield name="IDX" low="0" high="4" type="uint"/>
+			<bitfield name="OFFSET" low="5" high="16"/>
+			<bitfield name="INSTANCED" pos="17" type="boolean"/>
+			<bitfield name="FORMAT" low="20" high="27" type="a6xx_format"/>
+			<bitfield name="SWAP" low="28" high="29" type="a3xx_color_swap"/>
+			<bitfield name="UNK30" pos="30" type="boolean"/>
+			<bitfield name="FLOAT" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x1" name="STEP_RATE" type="uint"/>
+	</array>
+	<array offset="0xa0d0" name="VFD_DEST_CNTL" stride="1" length="32" usage="rp_blit">
+		<reg32 offset="0x0" name="INSTR">
+			<bitfield name="WRITEMASK" low="0" high="3" type="hex"/>
+			<bitfield name="REGID" low="4" high="11" type="a3xx_regid"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0xa0f8" name="VFD_POWER_CNTL" low="0" high="2" usage="rp_blit"/>
+
+	<reg32 offset="0xa600" name="VFD_UNKNOWN_A600" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa601" name="VFD_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<array offset="0xa610" name="VFD_PERFCTR_VFD_SEL" stride="1" length="8" variants="A6XX"/>
+	<array offset="0xa610" name="VFD_PERFCTR_VFD_SEL" stride="1" length="16" variants="A7XX-"/>
+
+	<!--
+	Note: this seems to always be paired with another bit in another
+	block.
+	-->
+	<enum name="a6xx_threadsize">
+		<value value="0" name="THREAD64"/>
+		<value value="1" name="THREAD128"/>
+	</enum>
+
+	<bitset name="a6xx_sp_xs_ctrl_reg0" inline="yes">
+		<!-- if set to SINGLE, only use 1 concurrent wave on each SP -->
+		<bitfield name="THREADMODE" pos="0" type="a3xx_threadmode"/>
+		<!--
+		When b31 set we just see FULLREGFOOTPRINT set.  The pattern of
+		used registers is a bit odd too:
+			- used (half): 0-15 68-179 (cnt=128, max=179)
+			- used (full): 0-33 50-69 71 73 75 77 79 81 83 85 87 89-105 107 109 111 113 115 117 119 121 123 125 127>
+		whereas we usually see a (mostly) contiguous range of regs used.  But if
+		I merge the full and half ranges (ie. rN counts as hr(N*2) and hr(N*2+1)),
+		then:
+			- used (merged): 0-191 (cnt=192, max=191)
+		So I think if b31 is set, then the half precision registers overlap
+		the full precision registers.  (Which seems like a pretty sensible
+		feature, actually I'm not sure when you *wouldn't* want to use that,
+		since it gives register allocation more flexibility)
+		 -->
+		<bitfield name="HALFREGFOOTPRINT" low="1" high="6" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="7" high="12" type="uint"/>
+		<!-- could it be a low bit of branchstack? -->
+		<bitfield name="UNK13" pos="13" type="boolean"/>
+		<!-- seems to be nesting level for flow control:.. -->
+		<bitfield name="BRANCHSTACK" low="14" high="19" type="uint"/>
+	</bitset>
+
+	<bitset name="a6xx_sp_xs_config" inline="yes">
+		<!--
+		Each of these are set if the given resource type is used
+		with the Vulkan/bindless binding model.
+		-->
+		<bitfield name="BINDLESS_TEX" pos="0" type="boolean"/>
+		<bitfield name="BINDLESS_SAMP" pos="1" type="boolean"/>
+		<bitfield name="BINDLESS_IBO" pos="2" type="boolean"/>
+		<bitfield name="BINDLESS_UBO" pos="3" type="boolean"/>
+
+		<bitfield name="ENABLED" pos="8" type="boolean"/>
+		<!--
+		number of textures and samplers.. these might be swapped, with GL I
+		always see the same value for both.
+		 -->
+		<bitfield name="NTEX" low="9" high="16" type="uint"/>
+		<bitfield name="NSAMP" low="17" high="21" type="uint"/>
+		<bitfield name="NIBO" low="22" high="28" type="uint"/>
+	</bitset>
+
+	<bitset name="a6xx_sp_xs_prim_cntl" inline="yes">
+		<!-- # of VS outputs including pos/psize -->
+		<bitfield name="OUT" low="0" high="5" type="uint"/>
+		<!-- FLAGS_REGID only for GS -->
+		<bitfield name="FLAGS_REGID" low="6" high="13" type="a3xx_regid"/>
+	</bitset>
+
+	<reg32 offset="0xa800" name="SP_VS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<!--
+		This field actually controls all geometry stages. TCS, TES, and
+		GS must have the same mergedregs setting as VS.
+		-->
+		<bitfield name="MERGEDREGS" pos="20" type="boolean"/>
+		<!--
+		Creates a separate preamble-only thread?
+
+		Early preamble has the following limitations:
+		- Only shared, a1, and consts regs could be used
+		  (accessing other regs would result in GPU fault);
+		- No cat5/cat6, only stc/ldc variants are working;
+		- Values writen to shared regs are not accessible by the rest
+		  of the shader;
+		- Instructions before shps are also considered to be a part of
+		  early preamble;
+
+		Note, for all shaders from d3d11 games blob produced preambles
+		compatible with early preamble mode.
+		-->
+		<bitfield name="EARLYPREAMBLE" pos="21" type="boolean"/>
+	</reg32>
+	<!-- bitmask of true/false conditions for VS brac.N instructions,
+	     bit N corresponds to brac.N -->
+	<reg32 offset="0xa801" name="SP_VS_BRANCH_COND" type="hex"/>
+	<!-- # of VS outputs including pos/psize -->
+	<reg32 offset="0xa802" name="SP_VS_PRIMITIVE_CNTL" type="a6xx_sp_xs_prim_cntl" usage="rp_blit"/>
+	<array offset="0xa803" name="SP_VS_OUT" stride="1" length="16" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="24" high="27" type="hex"/>
+		</reg32>
+	</array>
+	<!--
+	Starting with a5xx, position/psize outputs from shader end up in the
+	SP_VS_OUT map, with highest OUTLOCn position.  (Generally they are
+	the last entries too, except when gl_PointCoord is used, blob inserts
+	an extra varying after, but with a lower OUTLOC position.  If present,
+	psize is last, preceded by position.
+	 -->
+	<array offset="0xa813" name="SP_VS_VPC_DST" stride="1" length="8" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<bitset name="a6xx_sp_xs_pvt_mem_param" inline="yes">
+		<bitfield name="MEMSIZEPERITEM" low="0" high="7" shr="9">
+			<doc>The size of memory that ldp/stp can address.</doc>
+		</bitfield>
+		<bitfield name="HWSTACKSIZEPERTHREAD" low="24" high="31">
+                        <doc>
+				Seems to be the same as a3xx. The maximum stack
+				size in units of 4 calls, so a call depth of 7
+				would result in a value of 2.
+				TODO: What's the actual size per call, i.e. the
+				size of the PC? a3xx docs say it's 16 bits
+				there, but the length register now takes 28 bits
+				so it's probably been bumped to 32 bits.
+                        </doc>
+		</bitfield>
+	</bitset>
+
+	<bitset name="a6xx_sp_xs_pvt_mem_size" inline="yes">
+		<bitfield name="TOTALPVTMEMSIZE" low="0" high="17" shr="12"/>
+		<bitfield name="PERWAVEMEMLAYOUT" pos="31" type="boolean">
+			<doc>
+				There are four indices used to compute the
+				private memory location for an access:
+
+				- stp/ldp offset
+				- fiber id
+				- wavefront id (a swizzled version of what "getwid" returns)
+				- SP ID (the same as what "getspid" returns)
+
+				The stride for the SP ID is always set by
+				TOTALPVTMEMSIZE. In the per-wave layout, the
+				indices are used in this order:
+
+				- offset % 4 (offset within dword)
+				- fiber id
+				- offset / 4
+				- wavefront id
+				- SP ID
+
+				and the stride for the wavefront ID is
+				MEMSIZEPERITEM, multiplied by 128 (fibers per
+				wavefront). In the per-fiber layout, the indices
+				are used in this order:
+
+				- offset
+				- fiber id % 4
+				- wavefront id
+				- fiber id / 4
+				- SP ID
+
+				and the stride for the fiber id/wavefront id
+				combo is MEMSIZEPERITEM.
+
+				Note: Accesses of more than 1 dword do not work
+				with per-fiber layout. The blob will fall back
+				to per-wave instead.
+			</doc>
+		</bitfield>
+	</bitset>
+
+	<bitset name="a6xx_sp_xs_pvt_mem_hw_stack_offset" inline="yes">
+		<doc>
+			This seems to be be the equivalent of HWSTACKOFFSET in
+			a3xx. The ldp/stp offset formula above isn't affected by
+			HWSTACKSIZEPERTHREAD at all, so the HW return address
+			stack seems to be after all the normal per-SP private
+			memory.
+		</doc>
+		<bitfield name="OFFSET" low="0" high="18" shr="11"/>
+	</bitset>
+
+	<reg32 offset="0xa81b" name="SP_VS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa81c" name="SP_VS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa81e" name="SP_VS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa81f" name="SP_VS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa821" name="SP_VS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+	<reg32 offset="0xa822" name="SP_VS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa823" name="SP_VS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xa824" name="SP_VS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa825" name="SP_VS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+	<reg32 offset="0xa82d" name="SP_VS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa830" name="SP_HS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<!-- There is no mergedregs bit, that comes from the VS. -->
+		<bitfield name="EARLYPREAMBLE" pos="20" type="boolean"/>
+	</reg32>
+	<!--
+	Total size of local storage in dwords divided by the wave size.
+	The maximum value is 64. With the wave size being always 64 for HS,
+	the maximum size of local storage should be:
+	 64 (wavesize) * 64 (SP_HS_WAVE_INPUT_SIZE) * 4 = 16k
+	-->
+	<reg32 offset="0xa831" name="SP_HS_WAVE_INPUT_SIZE" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa832" name="SP_HS_BRANCH_COND" type="hex" usage="rp_blit"/>
+
+	<!-- TODO: exact same layout as 0xa81b-0xa825 -->
+	<reg32 offset="0xa833" name="SP_HS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa834" name="SP_HS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa836" name="SP_HS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa837" name="SP_HS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa839" name="SP_HS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+	<reg32 offset="0xa83a" name="SP_HS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa83b" name="SP_HS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xa83c" name="SP_HS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa83d" name="SP_HS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+	<reg32 offset="0xa82f" name="SP_HS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa840" name="SP_DS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<!-- There is no mergedregs bit, that comes from the VS. -->
+		<bitfield name="EARLYPREAMBLE" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa841" name="SP_DS_BRANCH_COND" type="hex"/>
+
+	<!-- TODO: exact same layout as 0xa802-0xa81a -->
+	<reg32 offset="0xa842" name="SP_DS_PRIMITIVE_CNTL" type="a6xx_sp_xs_prim_cntl" usage="rp_blit"/>
+	<array offset="0xa843" name="SP_DS_OUT" stride="1" length="16" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="24" high="27" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0xa853" name="SP_DS_VPC_DST" stride="1" length="8" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<!-- TODO: exact same layout as 0xa81b-0xa825 -->
+	<reg32 offset="0xa85b" name="SP_DS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa85c" name="SP_DS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa85e" name="SP_DS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa85f" name="SP_DS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa861" name="SP_DS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+	<reg32 offset="0xa862" name="SP_DS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa863" name="SP_DS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xa864" name="SP_DS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa865" name="SP_DS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+	<reg32 offset="0xa868" name="SP_DS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa870" name="SP_GS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<!-- There is no mergedregs bit, that comes from the VS. -->
+		<bitfield name="EARLYPREAMBLE" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa871" name="SP_GS_PRIM_SIZE" low="0" high="7" type="uint" usage="rp_blit">
+		<doc>
+			Normally the size of the output of the last stage in
+			dwords. It should be programmed as follows:
+
+			size less than 63    - size
+			size of 63 (?) or 64 - 63
+			size greater than 64 - 64
+
+			What to program when the size is 61-63 is a guess, but
+			both the blob and ir3 align the size to 4 dword's so it
+			doesn't matter in practice.
+		</doc>
+	</reg32>
+	<reg32 offset="0xa872" name="SP_GS_BRANCH_COND" type="hex" usage="rp_blit"/>
+
+	<!-- TODO: exact same layout as 0xa802-0xa81a -->
+	<reg32 offset="0xa873" name="SP_GS_PRIMITIVE_CNTL" type="a6xx_sp_xs_prim_cntl" usage="rp_blit"/>
+	<array offset="0xa874" name="SP_GS_OUT" stride="1" length="16" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="24" high="27" type="hex"/>
+		</reg32>
+	</array>
+
+	<array offset="0xa884" name="SP_GS_VPC_DST" stride="1" length="8" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<!-- TODO: exact same layout as 0xa81b-0xa825 -->
+	<reg32 offset="0xa88c" name="SP_GS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa88d" name="SP_GS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa88f" name="SP_GS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa890" name="SP_GS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa892" name="SP_GS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+	<reg32 offset="0xa893" name="SP_GS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa894" name="SP_GS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xa895" name="SP_GS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa896" name="SP_GS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+	<reg32 offset="0xa899" name="SP_GS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<reg64 offset="0xa8a0" name="SP_VS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa8a2" name="SP_HS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa8a4" name="SP_DS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa8a6" name="SP_GS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa8a8" name="SP_VS_TEX_CONST" type="address" align="64" usage="cmd"/>
+	<reg64 offset="0xa8aa" name="SP_HS_TEX_CONST" type="address" align="64" usage="cmd"/>
+	<reg64 offset="0xa8ac" name="SP_DS_TEX_CONST" type="address" align="64" usage="cmd"/>
+	<reg64 offset="0xa8ae" name="SP_GS_TEX_CONST" type="address" align="64" usage="cmd"/>
+
+	<!-- TODO: 4 unknown bool registers 0xa8c0-0xa8c3 -->
+
+	<reg32 offset="0xa980" name="SP_FS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<bitfield name="THREADSIZE" pos="20" type="a6xx_threadsize"/>
+		<bitfield name="UNK21" pos="21" type="boolean"/>
+		<bitfield name="VARYING" pos="22" type="boolean"/>
+		<bitfield name="LODPIXMASK" pos="23" type="boolean">
+			<doc>
+				Enable ALL helper invocations in a quad. Necessary for
+				fine derivatives and quad subgroup ops.
+			</doc>
+		</bitfield>
+		<!-- note: vk blob uses bit24 -->
+		<bitfield name="UNK24" pos="24" type="boolean"/>
+		<bitfield name="UNK25" pos="25" type="boolean"/>
+		<bitfield name="PIXLODENABLE" pos="26" type="boolean">
+			<doc>
+				Enable helper invocations. Enables 3 out of 4 fragments,
+				because the coarse derivatives only use half of the quad
+				and so one pixel's value is always unused.
+			</doc>
+		</bitfield>
+		<bitfield name="UNK27" pos="27" type="boolean"/>
+		<bitfield name="EARLYPREAMBLE" pos="28" type="boolean"/>
+		<bitfield name="MERGEDREGS" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa981" name="SP_FS_BRANCH_COND" type="hex"/>
+	<reg32 offset="0xa982" name="SP_FS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa983" name="SP_FS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa985" name="SP_FS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa986" name="SP_FS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa988" name="SP_FS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+
+	<reg32 offset="0xa989" name="SP_BLEND_CNTL" usage="rp_blit">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="UNK8" pos="8" type="boolean"/>
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="9" type="boolean"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa98a" name="SP_SRGB_CNTL" usage="rp_blit">
+		<!-- Same as RB_SRGB_CNTL -->
+		<bitfield name="SRGB_MRT0" pos="0" type="boolean"/>
+		<bitfield name="SRGB_MRT1" pos="1" type="boolean"/>
+		<bitfield name="SRGB_MRT2" pos="2" type="boolean"/>
+		<bitfield name="SRGB_MRT3" pos="3" type="boolean"/>
+		<bitfield name="SRGB_MRT4" pos="4" type="boolean"/>
+		<bitfield name="SRGB_MRT5" pos="5" type="boolean"/>
+		<bitfield name="SRGB_MRT6" pos="6" type="boolean"/>
+		<bitfield name="SRGB_MRT7" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa98b" name="SP_FS_RENDER_COMPONENTS" usage="rp_blit">
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+	<reg32 offset="0xa98c" name="SP_FS_OUTPUT_CNTL0" usage="rp_blit">
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="DEPTH_REGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPMASK_REGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="STENCILREF_REGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa98d" name="SP_FS_OUTPUT_CNTL1" usage="rp_blit">
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+	</reg32>
+
+	<array offset="0xa98e" name="SP_FS_OUTPUT" stride="1" length="8" usage="rp_blit">
+		<doc>per MRT</doc>
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="HALF_PRECISION" pos="8" type="boolean"/>
+		</reg32>
+	</array>
+
+	<array offset="0xa996" name="SP_FS_MRT" stride="1" length="8" usage="rp_blit">
+		<reg32 offset="0" name="REG">
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+			<bitfield name="COLOR_SINT" pos="8" type="boolean"/>
+			<bitfield name="COLOR_UINT" pos="9" type="boolean"/>
+			<bitfield name="UNK10" pos="10" type="boolean"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0xa99e" name="SP_FS_PREFETCH_CNTL" usage="rp_blit">
+		<bitfield name="COUNT" low="0" high="2" type="uint"/>
+		<bitfield name="IJ_WRITE_DISABLE" pos="3" type="boolean"/>
+		<doc>
+			Similar to "(eq)" flag but disables helper invocations
+			after the texture prefetch.
+		</doc>
+		<bitfield name="ENDOFQUAD" pos="4" type="boolean" />
+		<doc>
+			Bypass writing to regs and overwrite output with color from
+			CONSTSLOTID const regs.
+		</doc>
+		<bitfield name="WRITE_COLOR_TO_OUTPUT" pos="5" type="boolean"/>
+		<bitfield name="CONSTSLOTID" low="6" high="14" type="uint"/>
+		<!-- Blob never uses it -->
+		<bitfield name="CONSTSLOTID4COORD" low="16" high="24" type="uint" variants="A7XX-"/>
+	</reg32>
+	<array offset="0xa99f" name="SP_FS_PREFETCH" stride="1" length="4" variants="A6XX" usage="rp_blit">
+		<reg32 offset="0" name="CMD" variants="A6XX">
+			<bitfield name="SRC" low="0" high="6" type="uint"/>
+			<bitfield name="SAMP_ID" low="7" high="10" type="uint"/>
+			<bitfield name="TEX_ID" low="11" high="15" type="uint"/>
+			<bitfield name="DST" low="16" high="21" type="a3xx_regid"/>
+			<bitfield name="WRMASK" low="22" high="25" type="hex"/>
+			<bitfield name="HALF" pos="26" type="boolean"/>
+			<doc>Results in color being zero</doc>
+			<bitfield name="UNK27" pos="27" type="boolean"/>
+			<bitfield name="BINDLESS" pos="28" type="boolean"/>
+			<bitfield name="CMD" low="29" high="31" type="a6xx_tex_prefetch_cmd"/>
+		</reg32>
+	</array>
+	<array offset="0xa99f" name="SP_FS_PREFETCH" stride="1" length="4" variants="A7XX-" usage="rp_blit">
+		<reg32 offset="0" name="CMD" variants="A7XX-">
+			<bitfield name="SRC" low="0" high="6" type="uint"/>
+			<bitfield name="SAMP_ID" low="7" high="9" type="uint"/>
+			<bitfield name="TEX_ID" low="10" high="12" type="uint"/>
+			<bitfield name="DST" low="13" high="18" type="a3xx_regid"/>
+			<bitfield name="WRMASK" low="19" high="22" type="hex"/>
+			<bitfield name="HALF" pos="23" type="boolean"/>
+			<bitfield name="BINDLESS" pos="25" type="boolean"/>
+			<bitfield name="CMD" low="26" high="29" type="a6xx_tex_prefetch_cmd"/>
+		</reg32>
+	</array>
+	<array offset="0xa9a3" name="SP_FS_BINDLESS_PREFETCH" stride="1" length="4" usage="rp_blit">
+		<reg32 offset="0" name="CMD">
+			<bitfield name="SAMP_ID" low="0" high="15" type="uint"/>
+			<bitfield name="TEX_ID" low="16" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0xa9a7" name="SP_FS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa9a8" name="SP_UNKNOWN_A9A8" low="0" high="16" usage="cmd"/> <!-- always 0x0 ? -->
+	<reg32 offset="0xa9a9" name="SP_FS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+
+	<!-- TODO: unknown bool register at 0xa9aa, likely same as 0xa8c0-0xa8c3 but for FS -->
+
+
+
+
+	<reg32 offset="0xa9b0" name="SP_CS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="cmd">
+		<bitfield name="THREADSIZE" pos="20" type="a6xx_threadsize"/>
+		<!-- seems to make SP use less concurrent threads when possible? -->
+		<bitfield name="UNK21" pos="21" type="boolean"/>
+		<!-- has a small impact on performance, not clear what it does -->
+		<bitfield name="UNK22" pos="22" type="boolean"/>
+		<bitfield name="EARLYPREAMBLE" pos="23" type="boolean"/>
+		<bitfield name="MERGEDREGS" pos="31" type="boolean"/>
+	</reg32>
+
+	<!-- set for compute shaders -->
+	<reg32 offset="0xa9b1" name="SP_CS_UNKNOWN_A9B1" usage="cmd">
+		<bitfield name="SHARED_SIZE" low="0" high="4" type="uint">
+			<doc>
+				If 0 - all 32k of shared storage is enabled, otherwise
+				(SHARED_SIZE + 1) * 1k is enabled.
+				The ldl/stl offset seems to be rewritten to 0 when it is beyond
+				this limit. This is different from ldlw/stlw, which wraps at
+				64k (and has 36k of storage on A640 - reads between 36k-64k
+				always return 0)
+			</doc>
+		</bitfield>
+		<bitfield name="UNK5" pos="5" type="boolean"/>
+		<!-- always 1 ? -->
+		<bitfield name="UNK6" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa9b2" name="SP_CS_BRANCH_COND" type="hex" usage="cmd"/>
+	<reg32 offset="0xa9b3" name="SP_CS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="cmd"/>
+	<reg64 offset="0xa9b4" name="SP_CS_OBJ_START" type="address" align="32" usage="cmd"/>
+	<reg32 offset="0xa9b6" name="SP_CS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="cmd"/>
+	<reg64 offset="0xa9b7" name="SP_CS_PVT_MEM_ADDR" align="32" usage="cmd"/>
+	<reg32 offset="0xa9b9" name="SP_CS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="cmd"/>
+	<reg32 offset="0xa9ba" name="SP_CS_TEX_COUNT" low="0" high="7" type="uint" usage="cmd"/>
+	<reg32 offset="0xa9bb" name="SP_CS_CONFIG" type="a6xx_sp_xs_config" usage="cmd"/>
+	<reg32 offset="0xa9bc" name="SP_CS_INSTRLEN" low="0" high="27" type="uint" usage="cmd"/>
+	<reg32 offset="0xa9bd" name="SP_CS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="cmd"/>
+	<reg32 offset="0xa9be" name="SP_CS_UNKNOWN_A9BE" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xa9c5" name="SP_CS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<!-- new in a6xx gen4, matches HLSQ_CS_CNTL_0 -->
+	<reg32 offset="0xa9c2" name="SP_CS_CNTL_0" usage="cmd">
+		<bitfield name="WGIDCONSTID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="WGSIZECONSTID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="WGOFFSETCONSTID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<!-- new in a6xx gen4, matches HLSQ_CS_CNTL_1 -->
+	<reg32 offset="0xa9c3" name="SP_CS_CNTL_1" variants="A6XX" usage="cmd">
+		<!-- gl_LocalInvocationIndex -->
+		<bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- a650 has 6 "SP cores" (but 3 "SP"). this makes it use only
+		     one of those 6 "SP cores" -->
+		<bitfield name="SINGLE_SP_CORE" pos="8" type="boolean"/>
+		<!-- Must match SP_CS_CTRL -->
+		<bitfield name="THREADSIZE" pos="9" type="a6xx_threadsize"/>
+		<!-- 1 thread per wave (ignored if bit9 set) -->
+		<bitfield name="THREADSIZE_SCALAR" pos="10" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xa9c3" name="SP_CS_CNTL_1" variants="A7XX-" usage="cmd">
+		<!-- gl_LocalInvocationIndex -->
+		<bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- Must match SP_CS_CTRL -->
+		<bitfield name="THREADSIZE" pos="8" type="a6xx_threadsize"/>
+		<!-- 1 thread per wave (would hang if THREAD128 is also set) -->
+		<bitfield name="THREADSIZE_SCALAR" pos="9" type="boolean"/>
+
+		<!-- Affects getone. If enabled, getone sometimes executed 1? less times
+		     than there are subgroups.
+		 -->
+		<bitfield name="UNK15" pos="15" type="boolean"/>
+	</reg32>
+
+	<!-- TODO: two 64kb aligned addresses at a9d0/a9d2 -->
+
+	<reg64 offset="0xa9e0" name="SP_FS_TEX_SAMP" type="address" align="16" usage="rp_blit"/>
+	<reg64 offset="0xa9e2" name="SP_CS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa9e4" name="SP_FS_TEX_CONST" type="address" align="64" usage="rp_blit"/>
+	<reg64 offset="0xa9e6" name="SP_CS_TEX_CONST" type="address" align="64" usage="cmd"/>
+
+	<enum name="a6xx_bindless_descriptor_size">
+		<doc>
+			This can alternatively be interpreted as a pitch shift, ie, the
+			descriptor size is 2 &lt;&lt; N dwords
+		</doc>
+		<value value="1" name="BINDLESS_DESCRIPTOR_16B"/>
+		<value value="3" name="BINDLESS_DESCRIPTOR_64B"/>
+	</enum>
+
+	<array offset="0xa9e8" name="SP_CS_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="cmd">
+		<reg64 offset="0" name="DESCRIPTOR" variants="A6XX">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+	<array offset="0xa9e8" name="SP_CS_BINDLESS_BASE" stride="2" length="8" variants="A7XX-" usage="cmd">
+		<reg64 offset="0" name="DESCRIPTOR" variants="A7XX-">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+
+	<!--
+	IBO state for compute shader:
+	 -->
+	<reg64 offset="0xa9f2" name="SP_CS_IBO" type="address" align="16"/>
+	<reg32 offset="0xaa00" name="SP_CS_IBO_COUNT" low="0" high="6" type="uint"/>
+
+	<!-- Correlated with avgs/uvgs usage in FS -->
+	<reg32 offset="0xaa01" name="SP_FS_VGPR_CONFIG" type="uint" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xaa02" name="SP_PS_ALIASED_COMPONENTS_CONTROL" variants="A7XX-" usage="cmd">
+		<bitfield name="ENABLED" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xaa03" name="SP_PS_ALIASED_COMPONENTS" variants="A7XX-" usage="cmd">
+		<doc>
+			Specify for which components the output color should be read
+			from alias, e.g. for:
+
+				alias.1.b32.0 r3.x, c8.x
+				alias.1.b32.0 r2.x, c4.x
+				alias.1.b32.0 r1.x, c4.x
+				alias.1.b32.0 r0.x, c0.x
+
+			the SP_PS_ALIASED_COMPONENTS would be 0x00001111
+		</doc>
+
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+
+	<reg32 offset="0xaaf2" name="SP_UNKNOWN_AAF2" type="uint" usage="cmd"/>
+
+	<!--
+                This enum is probably similar in purpose to SNORMMODE on a3xx,
+                minus the snorm stuff, i.e. it controls what happens with an
+                out-of-bounds isam/isamm. GL and Vulkan robustness require us to
+                return 0 on out-of-bound textureFetch().
+	-->
+	<enum name="a6xx_isam_mode">
+		<value value="0x1" name="ISAMMODE_CL"/>
+		<value value="0x2" name="ISAMMODE_GL"/>
+	</enum>
+
+	<reg32 offset="0xab00" name="SP_MODE_CONTROL" usage="rp_blit">
+	  <!--
+	  When set, half register loads from the constant file will
+	  load a 32-bit value (so hc0.y loads the same value as c0.y)
+	  and implicitly convert it to 16b (f2f16, or u2u16, based on
+	  operand type).  When unset, half register loads from the
+	  constant file will load 16 bits from the packed constant
+	  file (so hc0.y loads the top 16 bits of the value of c0.x)
+	  -->
+		<bitfield name="CONSTANT_DEMOTION_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="ISAMMODE" low="1" high="2" type="a6xx_isam_mode"/>
+		<bitfield name="SHARED_CONSTS_ENABLE" pos="3" type="boolean"/> <!-- see HLSQ_SHARED_CONSTS -->
+	</reg32>
+
+	<reg32 offset="0xab01" name="SP_UNKNOWN_AB01" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xab02" name="SP_UNKNOWN_AB02" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xab04" name="SP_FS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xab05" name="SP_FS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+
+	<array offset="0xab10" name="SP_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="rp_blit">
+		<reg64 offset="0" name="DESCRIPTOR" variants="A6XX">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+	<array offset="0xab0a" name="SP_BINDLESS_BASE" stride="2" length="8" variants="A7XX-" usage="rp_blit">
+		<reg64 offset="0" name="DESCRIPTOR" variants="A7XX-">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+
+	<!--
+	Combined IBO state for 3d pipe, used for Image and SSBO write/atomic
+	instructions VS/HS/DS/GS/FS.  See SP_CS_IBO_* for compute shaders.
+	 -->
+	<reg64 offset="0xab1a" name="SP_IBO" type="address" align="16" usage="cmd"/>
+	<reg32 offset="0xab20" name="SP_IBO_COUNT" low="0" high="6" type="uint" usage="cmd"/>
+
+	<reg32 offset="0xab22" name="SP_UNKNOWN_AB22" variants="A7XX-" usage="cmd"/>
+
+	<bitset name="a6xx_sp_2d_dst_format" inline="yes">
+		<bitfield name="NORM" pos="0" type="boolean"/>
+		<bitfield name="SINT" pos="1" type="boolean"/>
+		<bitfield name="UINT" pos="2" type="boolean"/>
+		<!-- looks like HW only cares about the base type of this format,
+		     which matches the ifmt? -->
+		<bitfield name="COLOR_FORMAT" low="3" high="10" type="a6xx_format"/>
+		<!-- set when ifmt is R2D_UNORM8_SRGB -->
+		<bitfield name="SRGB" pos="11" type="boolean"/>
+		<!-- some sort of channel mask, not sure what it is for -->
+		<bitfield name="MASK" low="12" high="15"/>
+	</bitset>
+
+	<reg32 offset="0xacc0" name="SP_2D_DST_FORMAT" type="a6xx_sp_2d_dst_format" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xa9bf" name="SP_2D_DST_FORMAT" type="a6xx_sp_2d_dst_format" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0xae00" name="SP_DBG_ECO_CNTL" usage="cmd"/>
+	<reg32 offset="0xae01" name="SP_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode"/>
+	<reg32 offset="0xae02" name="SP_NC_MODE_CNTL">
+		<!-- TODO: valid bits 0x3c3f, see kernel -->
+	</reg32>
+	<reg32 offset="0xae03" name="SP_CHICKEN_BITS" usage="cmd"/>
+	<reg32 offset="0xae04" name="SP_FLOAT_CNTL" usage="cmd">
+		<bitfield name="F16_NO_INF" pos="3" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xae06" name="SP_UNKNOWN_AE06" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae08" name="SP_UNKNOWN_AE08" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae09" name="SP_UNKNOWN_AE09" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae0a" name="SP_UNKNOWN_AE0A" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xae0f" name="SP_PERFCTR_ENABLE" usage="cmd">
+		<!-- some perfcntrs are affected by a per-stage enable bit
+		     (PERF_SP_ALU_WORKING_CYCLES for example)
+		     TODO: verify position of HS/DS/GS bits -->
+		<bitfield name="VS" pos="0" type="boolean"/>
+		<bitfield name="HS" pos="1" type="boolean"/>
+		<bitfield name="DS" pos="2" type="boolean"/>
+		<bitfield name="GS" pos="3" type="boolean"/>
+		<bitfield name="FS" pos="4" type="boolean"/>
+		<bitfield name="CS" pos="5" type="boolean"/>
+	</reg32>
+	<array offset="0xae10" name="SP_PERFCTR_SP_SEL" stride="1" length="24"/>
+	<array offset="0xae60" name="SP_PERFCTR_HLSQ_SEL" stride="1" length="6" variants="A7XX-"/>
+	<reg32 offset="0xae6a" name="SP_UNKNOWN_AE6A" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae6b" name="SP_UNKNOWN_AE6B" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae6c" name="SP_UNKNOWN_AE6C" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae6d" name="SP_READ_SEL" variants="A7XX-">
+		<bitfield name="LOCATION" low="18" high="19" type="a7xx_state_location"/>
+		<bitfield name="PIPE" low="16" high="17" type="a7xx_pipe"/>
+		<bitfield name="STATETYPE" low="8" high="15" type="a7xx_statetype_id"/>
+		<bitfield name="USPTP" low="4" high="7"/>
+		<bitfield name="SPTP" low="0" high="3"/>
+	</reg32>
+	<reg32 offset="0xae71" name="SP_DBG_CNTL" variants="A7XX-"/>
+	<reg32 offset="0xae73" name="SP_UNKNOWN_AE73" variants="A7XX-" usage="cmd"/>
+	<array offset="0xae80" name="SP_PERFCTR_SP_SEL" stride="1" length="36" variants="A7XX-"/>
+	<!-- TODO: there are 4 more percntr select registers (0xae28-0xae2b) -->
+	<!-- TODO: there are a few unknown registers in the 0xae30-0xae52 range -->
+	<reg32 offset="0xbe22" name="SP_CONTEXT_SWITCH_GFX_PREEMPTION_SAFE_MODE"/>
+
+	<!--
+	The downstream kernel calls the debug cluster of registers
+	"a6xx_sp_ps_tp_cluster" but this actually specifies the border
+	color base for compute shaders.
+	-->
+	<reg64 offset="0xb180" name="SP_PS_TP_BORDER_COLOR_BASE_ADDR" type="address" align="128" usage="cmd"/>
+	<reg32 offset="0xb182" name="SP_UNKNOWN_B182" low="0" high="2" usage="cmd"/>
+	<reg32 offset="0xb183" name="SP_UNKNOWN_B183" low="0" high="23" usage="cmd"/>
+
+	<reg32 offset="0xb190" name="SP_UNKNOWN_B190"/>
+	<reg32 offset="0xb191" name="SP_UNKNOWN_B191"/>
+
+	<!-- could be all the stuff below here is actually TPL1?? -->
+
+	<reg32 offset="0xb300" name="SP_TP_RAS_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="UNK2" low="2" high="3"/>
+	</reg32>
+	<reg32 offset="0xb301" name="SP_TP_DEST_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+
+	<!-- looks to work in the same way as a5xx: -->
+	<reg64 offset="0xb302" name="SP_TP_BORDER_COLOR_BASE_ADDR" type="address" align="128" usage="cmd"/>
+	<reg32 offset="0xb304" name="SP_TP_SAMPLE_CONFIG" type="a6xx_sample_config" usage="rp_blit"/>
+	<reg32 offset="0xb305" name="SP_TP_SAMPLE_LOCATION_0" type="a6xx_sample_locations" usage="rp_blit"/>
+	<reg32 offset="0xb306" name="SP_TP_SAMPLE_LOCATION_1" type="a6xx_sample_locations" usage="rp_blit"/>
+	<reg32 offset="0xb307" name="SP_TP_WINDOW_OFFSET" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0xb309" name="SP_TP_MODE_CNTL" usage="cmd">
+		<bitfield name="ISAMMODE" low="0" high="1" type="a6xx_isam_mode"/>
+		<bitfield name="UNK3" low="2" high="7"/>
+	</reg32>
+	<reg32 offset="0xb310" name="SP_UNKNOWN_B310" variants="A7XX-" usage="cmd"/>
+
+	<!--
+	Equiv to corresponding RB_2D_SRC_* regs on a5xx.. which were either
+	badly named or the functionality moved in a6xx.  But downstream kernel
+	calls this "a6xx_sp_ps_tp_2d_cluster"
+	 -->
+	<reg32 offset="0xb4c0" name="SP_PS_2D_SRC_INFO" type="a6xx_2d_src_surf_info" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb4c1" name="SP_PS_2D_SRC_SIZE" variants="A6XX" usage="rp_blit">
+		<bitfield name="WIDTH" low="0" high="14" type="uint"/>
+		<bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+	</reg32>
+	<reg64 offset="0xb4c2" name="SP_PS_2D_SRC" type="address" align="16" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb4c4" name="SP_PS_2D_SRC_PITCH" variants="A6XX" usage="rp_blit">
+		<bitfield name="UNK0" low="0" high="8"/>
+		<bitfield name="PITCH" low="9" high="23" shr="6" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0xb2c0" name="SP_PS_2D_SRC_INFO" type="a6xx_2d_src_surf_info" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xb2c1" name="SP_PS_2D_SRC_SIZE" variants="A7XX">
+		<bitfield name="WIDTH" low="0" high="14" type="uint"/>
+		<bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+	</reg32>
+	<reg64 offset="0xb2c2" name="SP_PS_2D_SRC" type="address" align="16" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xb2c4" name="SP_PS_2D_SRC_PITCH" variants="A7XX">
+		<bitfield name="UNK0" low="0" high="8"/>
+		<bitfield name="PITCH" low="9" high="23" shr="6" type="uint"/>
+	</reg32>
+
+	<!-- planes for NV12, etc. (TODO: not tested) -->
+	<reg64 offset="0xb4c5" name="SP_PS_2D_SRC_PLANE1" type="address" align="16" variants="A6XX"/>
+	<reg32 offset="0xb4c7" name="SP_PS_2D_SRC_PLANE_PITCH" low="0" high="11" shr="6" type="uint" variants="A6XX"/>
+	<reg64 offset="0xb4c8" name="SP_PS_2D_SRC_PLANE2" type="address" align="16" variants="A6XX"/>
+
+	<reg64 offset="0xb2c5" name="SP_PS_2D_SRC_PLANE1" type="address" align="16" variants="A7XX-"/>
+	<reg32 offset="0xb2c7" name="SP_PS_2D_SRC_PLANE_PITCH" low="0" high="11" shr="6" type="uint" variants="A7XX-"/>
+	<reg64 offset="0xb2c8" name="SP_PS_2D_SRC_PLANE2" type="address" align="16" variants="A7XX-"/>
+
+	<reg64 offset="0xb4ca" name="SP_PS_2D_SRC_FLAGS" type="address" align="16" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb4cc" name="SP_PS_2D_SRC_FLAGS_PITCH" low="0" high="7" shr="6" type="uint" variants="A6XX" usage="rp_blit"/>
+
+	<reg64 offset="0xb2ca" name="SP_PS_2D_SRC_FLAGS" type="address" align="16" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xb2cc" name="SP_PS_2D_SRC_FLAGS_PITCH" low="0" high="7" shr="6" type="uint" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0xb4cd" name="SP_PS_UNKNOWN_B4CD" low="6" high="31" variants="A6XX"/>
+	<reg32 offset="0xb4ce" name="SP_PS_UNKNOWN_B4CE" low="0" high="31" variants="A6XX"/>
+	<reg32 offset="0xb4cf" name="SP_PS_UNKNOWN_B4CF" low="0" high="30" variants="A6XX"/>
+	<reg32 offset="0xb4d0" name="SP_PS_UNKNOWN_B4D0" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb4d1" name="SP_WINDOW_OFFSET" type="a6xx_reg_xy" variants="A6XX" usage="rp_blit"/>
+
+	<reg32 offset="0xb2cd" name="SP_PS_UNKNOWN_B4CD" low="6" high="31" variants="A7XX"/>
+	<reg32 offset="0xb2ce" name="SP_PS_UNKNOWN_B4CE" low="0" high="31" variants="A7XX"/>
+	<reg32 offset="0xb2cf" name="SP_PS_UNKNOWN_B4CF" low="0" high="30" variants="A7XX"/>
+	<reg32 offset="0xb2d0" name="SP_PS_UNKNOWN_B4D0" low="0" high="29" variants="A7XX"/>
+	<reg32 offset="0xb2d1" name="SP_PS_2D_WINDOW_OFFSET" type="a6xx_reg_xy" variants="A7XX"/>
+	<reg32 offset="0xb2d2" name="SP_PS_UNKNOWN_B2D2" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xab21" name="SP_WINDOW_OFFSET" type="a6xx_reg_xy" variants="A7XX-" usage="rp_blit"/>
+
+	<!-- always 0x100000 or 0x1000000? -->
+	<reg32 offset="0xb600" name="TPL1_DBG_ECO_CNTL" low="0" high="25" usage="cmd"/>
+	<reg32 offset="0xb601" name="TPL1_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0xb602" name="TPL1_DBG_ECO_CNTL1" usage="cmd">
+		<!-- Affects UBWC in some way, if BLIT_OP_SCALE is done with this bit set
+		     and if other blit is done without it - UBWC image may be copied incorrectly.
+		 -->
+		<bitfield name="TP_UBWC_FLAG_HINT" pos="18" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xb604" name="TPL1_NC_MODE_CNTL">
+		<bitfield name="MODE" pos="0" type="boolean"/>
+		<bitfield name="LOWER_BIT" low="1" high="2" type="uint"/>
+		<bitfield name="MIN_ACCESS_LENGTH" pos="3" type="boolean"/> <!-- true=64b false=32b -->
+		<bitfield name="UPPER_BIT" pos="4" type="uint"/>
+		<bitfield name="UNK6" low="6" high="7"/>
+	</reg32>
+	<reg32 offset="0xb605" name="TPL1_UNKNOWN_B605" low="0" high="7" type="uint" variants="A6XX" usage="cmd"/> <!-- always 0x0 or 0x44 ? -->
+
+	<reg32 offset="0xb608" name="TPL1_BICUBIC_WEIGHTS_TABLE_0" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb609" name="TPL1_BICUBIC_WEIGHTS_TABLE_1" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb60a" name="TPL1_BICUBIC_WEIGHTS_TABLE_2" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb60b" name="TPL1_BICUBIC_WEIGHTS_TABLE_3" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb60c" name="TPL1_BICUBIC_WEIGHTS_TABLE_4" low="0" high="29" variants="A6XX"/>
+
+	<reg32 offset="0xb608" name="TPL1_BICUBIC_WEIGHTS_TABLE_0" low="0" high="29" variants="A7XX" usage="cmd"/>
+	<reg32 offset="0xb609" name="TPL1_BICUBIC_WEIGHTS_TABLE_1" low="0" high="29" variants="A7XX" usage="cmd"/>
+	<reg32 offset="0xb60a" name="TPL1_BICUBIC_WEIGHTS_TABLE_2" low="0" high="29" variants="A7XX" usage="cmd"/>
+	<reg32 offset="0xb60b" name="TPL1_BICUBIC_WEIGHTS_TABLE_3" low="0" high="29" variants="A7XX" usage="cmd"/>
+	<reg32 offset="0xb60c" name="TPL1_BICUBIC_WEIGHTS_TABLE_4" low="0" high="29" variants="A7XX" usage="cmd"/>
+
+	<array offset="0xb610" name="TPL1_PERFCTR_TP_SEL" stride="1" length="12" variants="A6XX"/>
+	<array offset="0xb610" name="TPL1_PERFCTR_TP_SEL" stride="1" length="18" variants="A7XX"/>
+
+	<!-- TODO: 4 more perfcntr sel at 0xb620 ? -->
+
+	<bitset name="a6xx_hlsq_xs_cntl" inline="yes">
+		<bitfield name="CONSTLEN" low="0" high="7" shr="2" type="uint"/>
+		<bitfield name="ENABLED" pos="8" type="boolean"/>
+		<bitfield name="READ_IMM_SHARED_CONSTS" pos="9" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<reg32 offset="0xb800" name="HLSQ_VS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb801" name="HLSQ_HS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb802" name="HLSQ_DS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb803" name="HLSQ_GS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+
+	<reg32 offset="0xa827" name="HLSQ_VS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa83f" name="HLSQ_HS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa867" name="HLSQ_DS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa898" name="HLSQ_GS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0xa9aa" name="HLSQ_FS_UNKNOWN_A9AA" variants="A7XX-" usage="rp_blit">
+		<!-- Tentatively named, appears to disable consts being loaded via CP_LOAD_STATE6_FRAG -->
+		<bitfield name="CONSTS_LOAD_DISABLE" pos="0" type="boolean"/>
+	</reg32>
+
+	<!-- Always 0 -->
+	<reg32 offset="0xa9ac" name="HLSQ_UNKNOWN_A9AC" variants="A7XX-" usage="cmd"/>
+
+	<!-- Used in VK_KHR_fragment_shading_rate -->
+	<reg32 offset="0xa9ad" name="HLSQ_UNKNOWN_A9AD" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa9ae" name="HLSQ_UNKNOWN_A9AE" variants="A7XX-" usage="rp_blit">
+		<bitfield name="SYSVAL_REGS_COUNT" low="0" high="7" type="uint"/>
+		<!-- UNK8 is set on a730/a740 -->
+		<bitfield name="UNK8" pos="8" type="boolean"/>
+		<!-- UNK9 is set on a750 -->
+		<bitfield name="UNK9" pos="9" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xb820" name="HLSQ_LOAD_STATE_GEOM_CMD"/>
+	<reg64 offset="0xb821" name="HLSQ_LOAD_STATE_GEOM_EXT_SRC_ADDR" align="16" type="address"/>
+	<reg32 offset="0xb823" name="HLSQ_LOAD_STATE_GEOM_DATA"/>
+
+
+	<bitset name="a6xx_hlsq_fs_cntl_0" inline="yes">
+		<!-- must match SP_FS_CTRL -->
+		<bitfield name="THREADSIZE" pos="0" type="a6xx_threadsize"/>
+		<bitfield name="VARYINGS" pos="1" type="boolean"/>
+		<bitfield name="UNK2" low="2" high="11"/>
+	</bitset>
+	<bitset name="a6xx_hlsq_control_3_reg" inline="yes">
+		<!-- register loaded with position (bary.f) -->
+		<bitfield name="IJ_PERSP_PIXEL" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_PIXEL" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="IJ_PERSP_CENTROID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_CENTROID" low="24" high="31" type="a3xx_regid"/>
+	</bitset>
+	<bitset name="a6xx_hlsq_control_4_reg" inline="yes">
+		<bitfield name="IJ_PERSP_SAMPLE" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="XYCOORDREGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="ZWCOORDREGID" low="24" high="31" type="a3xx_regid"/>
+	</bitset>
+	<bitset name="a6xx_hlsq_control_5_reg" inline="yes">
+		<bitfield name="LINELENGTHREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="FOVEATIONQUALITYREGID" low="8" high="15" type="a3xx_regid"/>
+	</bitset>
+
+	<reg32 offset="0xb980" type="a6xx_hlsq_fs_cntl_0" name="HLSQ_FS_CNTL_0" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb981" name="HLSQ_UNKNOWN_B981" pos="0" type="boolean" variants="A6XX"/> <!-- never used by blob -->
+	<reg32 offset="0xb982" name="HLSQ_CONTROL_1_REG" low="0" high="2" variants="A6XX" usage="rp_blit">
+		<!-- Sets the maximum number of primitives allowed in one FS wave minus one, similarly to the
+				 A3xx field, except that it's not necessary to set it to anything but the maximum, since
+				 the hardware will simply emit smaller waves when it runs out of space.	-->
+		<bitfield name="PRIMALLOCTHRESHOLD" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb983" name="HLSQ_CONTROL_2_REG" variants="A6XX" usage="rp_blit">
+		<bitfield name="FACEREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- SAMPLEID is loaded into a half-precision register: -->
+		<bitfield name="SAMPLEID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="CENTERRHW" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xb984" type="a6xx_hlsq_control_3_reg" name="HLSQ_CONTROL_3_REG" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb985" type="a6xx_hlsq_control_4_reg" name="HLSQ_CONTROL_4_REG" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb986" type="a6xx_hlsq_control_5_reg" name="HLSQ_CONTROL_5_REG" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb987" name="HLSQ_CS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="cmd"/>
+	<reg32 offset="0xa9c6" type="a6xx_hlsq_fs_cntl_0" name="HLSQ_FS_CNTL_0" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9c7" name="HLSQ_CONTROL_1_REG" low="0" high="2" variants="A7XX-" usage="rp_blit">
+			<bitfield name="PRIMALLOCTHRESHOLD" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9c8" name="HLSQ_CONTROL_2_REG" variants="A7XX-" usage="rp_blit">
+		<bitfield name="FACEREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- SAMPLEID is loaded into a half-precision register: -->
+		<bitfield name="SAMPLEID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="CENTERRHW" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa9c9" type="a6xx_hlsq_control_3_reg" name="HLSQ_CONTROL_3_REG" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9ca" type="a6xx_hlsq_control_4_reg" name="HLSQ_CONTROL_4_REG" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9cb" type="a6xx_hlsq_control_5_reg" name="HLSQ_CONTROL_5_REG" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9cd" name="HLSQ_CS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="cmd"/>
+
+	<!-- TODO: what does KERNELDIM do exactly (blob sets it differently from turnip) -->
+	<reg32 offset="0xb990" name="HLSQ_CS_NDRANGE_0" variants="A6XX" usage="rp_blit">
+		<bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb991" name="HLSQ_CS_NDRANGE_1" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb992" name="HLSQ_CS_NDRANGE_2" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALOFF_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb993" name="HLSQ_CS_NDRANGE_3" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb994" name="HLSQ_CS_NDRANGE_4" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALOFF_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb995" name="HLSQ_CS_NDRANGE_5" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb996" name="HLSQ_CS_NDRANGE_6" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALOFF_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb997" name="HLSQ_CS_CNTL_0" variants="A6XX" usage="rp_blit">
+		<!-- these are all vec3. first 3 need to be high regs
+		     WGSIZECONSTID is the local size (from HLSQ_CS_NDRANGE_0)
+		     WGOFFSETCONSTID is WGIDCONSTID*WGSIZECONSTID
+		-->
+		<bitfield name="WGIDCONSTID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="WGSIZECONSTID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="WGOFFSETCONSTID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xb998" name="HLSQ_CS_CNTL_1" variants="A6XX" usage="rp_blit">
+		<!-- gl_LocalInvocationIndex -->
+		<bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- a650 has 6 "SP cores" (but 3 "SP"). this makes it use only
+		     one of those 6 "SP cores" -->
+		<bitfield name="SINGLE_SP_CORE" pos="8" type="boolean"/>
+		<!-- Must match SP_CS_CTRL -->
+		<bitfield name="THREADSIZE" pos="9" type="a6xx_threadsize"/>
+		<!-- 1 thread per wave (ignored if bit9 set) -->
+		<bitfield name="THREADSIZE_SCALAR" pos="10" type="boolean"/>
+	</reg32>
+	<!--note: vulkan blob doesn't use these -->
+	<reg32 offset="0xb999" name="HLSQ_CS_KERNEL_GROUP_X" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb99a" name="HLSQ_CS_KERNEL_GROUP_Y" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb99b" name="HLSQ_CS_KERNEL_GROUP_Z" variants="A6XX" usage="rp_blit"/>
+
+	<!-- TODO: what does KERNELDIM do exactly (blob sets it differently from turnip) -->
+	<reg32 offset="0xa9d4" name="HLSQ_CS_NDRANGE_0" variants="A7XX-" usage="rp_blit">
+		<bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d5" name="HLSQ_CS_NDRANGE_1" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d6" name="HLSQ_CS_NDRANGE_2" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALOFF_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d7" name="HLSQ_CS_NDRANGE_3" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d8" name="HLSQ_CS_NDRANGE_4" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALOFF_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d9" name="HLSQ_CS_NDRANGE_5" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9da" name="HLSQ_CS_NDRANGE_6" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALOFF_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<!--note: vulkan blob doesn't use these -->
+	<reg32 offset="0xa9dc" name="HLSQ_CS_KERNEL_GROUP_X" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9dd" name="HLSQ_CS_KERNEL_GROUP_Y" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9de" name="HLSQ_CS_KERNEL_GROUP_Z" variants="A7XX-" usage="rp_blit"/>
+
+	<enum name="a7xx_cs_yalign">
+		<value name="CS_YALIGN_1" value="8"/>
+		<value name="CS_YALIGN_2" value="4"/>
+		<value name="CS_YALIGN_4" value="2"/>
+		<value name="CS_YALIGN_8" value="1"/>
+	</enum>
+
+	<reg32 offset="0xa9db" name="HLSQ_CS_CNTL_1" variants="A7XX-" usage="rp_blit">
+		<!-- gl_LocalInvocationIndex -->
+		<bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- Must match SP_CS_CTRL -->
+		<bitfield name="THREADSIZE" pos="9" type="a6xx_threadsize"/>
+		<bitfield name="UNK11" pos="11" type="boolean"/>
+		<bitfield name="UNK22" pos="22" type="boolean"/>
+		<bitfield name="UNK26" pos="26" type="boolean"/>
+		<bitfield name="YALIGN" low="27" high="30" type="a7xx_cs_yalign"/>
+	</reg32>
+
+	<reg32 offset="0xa9df" name="HLSQ_CS_LOCAL_SIZE" variants="A7XX-" usage="cmd">
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0xb9a0" name="HLSQ_LOAD_STATE_FRAG_CMD"/>
+	<reg64 offset="0xb9a1" name="HLSQ_LOAD_STATE_FRAG_EXT_SRC_ADDR" align="16" type="address"/>
+	<reg32 offset="0xb9a3" name="HLSQ_LOAD_STATE_FRAG_DATA"/>
+
+	<!-- mirror of SP_CS_BINDLESS_BASE -->
+	<array offset="0xb9c0" name="HLSQ_CS_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="rp_blit">
+		<reg64 offset="0" name="DESCRIPTOR">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+
+	<!-- new in a6xx gen4, mirror of SP_CS_UNKNOWN_A9B1? -->
+	<reg32 offset="0xb9d0" name="HLSQ_CS_UNKNOWN_B9D0" variants="A6XX" usage="cmd">
+		<bitfield name="SHARED_SIZE" low="0" high="4" type="uint"/>
+		<bitfield name="UNK5" pos="5" type="boolean"/>
+		<!-- always 1 ? -->
+		<bitfield name="UNK6" pos="6" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xbb00" name="HLSQ_DRAW_CMD" variants="A6XX">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0xbb01" name="HLSQ_DISPATCH_CMD" variants="A6XX">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0xbb02" name="HLSQ_EVENT_CMD" variants="A6XX">
+		<!-- I think only the low bit is actually used? -->
+		<bitfield name="STATE_ID" low="16" high="23"/>
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+	</reg32>
+
+	<reg32 offset="0xbb08" name="HLSQ_INVALIDATE_CMD" variants="A6XX" usage="cmd">
+		<doc>
+			This register clears pending loads queued up by
+			CP_LOAD_STATE6. Each bit resets a particular kind(s) of
+			CP_LOAD_STATE6.
+		</doc>
+
+		<!-- per-stage state: shader, non-bindless UBO, textures, and samplers -->
+		<bitfield name="VS_STATE" pos="0" type="boolean"/>
+		<bitfield name="HS_STATE" pos="1" type="boolean"/>
+		<bitfield name="DS_STATE" pos="2" type="boolean"/>
+		<bitfield name="GS_STATE" pos="3" type="boolean"/>
+		<bitfield name="FS_STATE" pos="4" type="boolean"/>
+		<bitfield name="CS_STATE" pos="5" type="boolean"/>
+
+		<bitfield name="CS_IBO" pos="6" type="boolean"/>
+		<bitfield name="GFX_IBO" pos="7" type="boolean"/>
+
+		<!-- Note: these only do something when HLSQ_SHARED_CONSTS is set to 1 -->
+		<bitfield name="CS_SHARED_CONST" pos="19" type="boolean"/>
+		<bitfield name="GFX_SHARED_CONST" pos="8" type="boolean"/>
+
+		<!-- SS6_BINDLESS: one bit per bindless base -->
+		<bitfield name="CS_BINDLESS" low="9" high="13" type="hex"/>
+		<bitfield name="GFX_BINDLESS" low="14" high="18" type="hex"/>
+	</reg32>
+
+	<reg32 offset="0xab1c" name="HLSQ_DRAW_CMD" variants="A7XX-">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0xab1d" name="HLSQ_DISPATCH_CMD" variants="A7XX-">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0xab1e" name="HLSQ_EVENT_CMD" variants="A7XX-">
+		<bitfield name="STATE_ID" low="16" high="23"/>
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+	</reg32>
+
+	<reg32 offset="0xab1f" name="HLSQ_INVALIDATE_CMD" variants="A7XX-" usage="cmd">
+		<doc>
+			This register clears pending loads queued up by
+			CP_LOAD_STATE6. Each bit resets a particular kind(s) of
+			CP_LOAD_STATE6.
+		</doc>
+
+		<!-- per-stage state: shader, non-bindless UBO, textures, and samplers -->
+		<bitfield name="VS_STATE" pos="0" type="boolean"/>
+		<bitfield name="HS_STATE" pos="1" type="boolean"/>
+		<bitfield name="DS_STATE" pos="2" type="boolean"/>
+		<bitfield name="GS_STATE" pos="3" type="boolean"/>
+		<bitfield name="FS_STATE" pos="4" type="boolean"/>
+		<bitfield name="CS_STATE" pos="5" type="boolean"/>
+
+		<bitfield name="CS_IBO" pos="6" type="boolean"/>
+		<bitfield name="GFX_IBO" pos="7" type="boolean"/>
+
+		<!-- SS6_BINDLESS: one bit per bindless base -->
+		<bitfield name="CS_BINDLESS" low="9" high="16" type="hex"/>
+		<bitfield name="GFX_BINDLESS" low="17" high="24" type="hex"/>
+	</reg32>
+
+	<reg32 offset="0xbb10" name="HLSQ_FS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xab03" name="HLSQ_FS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+
+	<array offset="0xab40" name="HLSQ_SHARED_CONSTS_IMM" stride="1" length="64" variants="A7XX-"/>
+
+	<reg32 offset="0xbb11" name="HLSQ_SHARED_CONSTS" variants="A6XX" usage="cmd">
+		<doc>
+			Shared constants are intended to be used for Vulkan push
+			constants. When enabled, 8 vec4's are reserved in the FS
+			const pool and 16 in the geometry const pool although
+			only 8 are actually used (why?) and they are mapped to
+			c504-c511 in each stage. Both VS and FS shared consts
+			are written using ST6_CONSTANTS/SB6_IBO, so that both
+			the geometry and FS shared consts can be written at once
+			by using CP_LOAD_STATE6 rather than
+			CP_LOAD_STATE6_FRAG/CP_LOAD_STATE6_GEOM. In addition
+			DST_OFF and NUM_UNIT are in units of dwords instead of
+			vec4's.
+
+			There is also a separate shared constant pool for CS,
+			which is loaded through CP_LOAD_STATE6_FRAG with
+			ST6_UBO/ST6_IBO. However the only real difference for CS
+			is the dword units.
+		</doc>
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+
+	<!-- mirror of SP_BINDLESS_BASE -->
+	<array offset="0xbb20" name="HLSQ_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="cmd">
+		<reg64 offset="0" name="DESCRIPTOR">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+
+	<reg32 offset="0xbd80" name="HLSQ_2D_EVENT_CMD">
+		<bitfield name="STATE_ID" low="8" high="15"/>
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+	</reg32>
+
+	<reg32 offset="0xbe00" name="HLSQ_UNKNOWN_BE00" variants="A6XX" usage="cmd"/> <!-- all bits valid except bit 29 -->
+	<reg32 offset="0xbe01" name="HLSQ_UNKNOWN_BE01" low="4" high="6" variants="A6XX" usage="cmd"/>
+	<reg32 offset="0xbe04" name="HLSQ_DBG_ECO_CNTL" variants="A6XX" usage="cmd"/>
+	<reg32 offset="0xbe05" name="HLSQ_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0xbe08" name="HLSQ_UNKNOWN_BE08" low="0" high="15"/>
+	<array offset="0xbe10" name="HLSQ_PERFCTR_HLSQ_SEL" stride="1" length="6"/>
+
+	<!-- TODO: some valid registers between 0xbe20 and 0xbe33 -->
+	<reg32 offset="0xbe22" name="HLSQ_CONTEXT_SWITCH_GFX_PREEMPTION_SAFE_MODE"/>
+
+	<reg32 offset="0xc000" name="SP_AHB_READ_APERTURE" variants="A7XX-"/>
+
+	<!-- Don't know if these are SP, always 0 -->
+	<reg64 offset="0x0ce2" name="SP_UNKNOWN_0CE2" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x0ce4" name="SP_UNKNOWN_0CE4" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x0ce6" name="SP_UNKNOWN_0CE6" variants="A7XX-" usage="cmd"/>
+
+	<!--
+		These special registers signal the beginning/end of an event
+		sequence. The sequence used internally for an event looks like:
+		- write EVENT_CMD pipe register
+		- write CP_EVENT_START
+		- write HLSQ_EVENT_CMD with event or HLSQ_DRAW_CMD
+		- write PC_EVENT_CMD with event or PC_DRAW_CMD
+		- write HLSQ_EVENT_CMD(CONTEXT_DONE)
+		- write PC_EVENT_CMD(CONTEXT_DONE)
+		- write CP_EVENT_END
+		Writing to CP_EVENT_END seems to actually trigger the context roll
+	-->
+	<reg32 offset="0xd600" name="CP_EVENT_START">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+	<reg32 offset="0xd601" name="CP_EVENT_END">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+	<reg32 offset="0xd700" name="CP_2D_EVENT_START">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+	<reg32 offset="0xd701" name="CP_2D_EVENT_END">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+</domain>
+
+<!-- Seems basically the same as a5xx, maybe move to common.xml.. -->
+<domain name="A6XX_TEX_SAMP" width="32">
+	<doc>Texture sampler dwords</doc>
+	<enum name="a6xx_tex_filter"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_NEAREST" value="0"/>
+		<value name="A6XX_TEX_LINEAR" value="1"/>
+		<value name="A6XX_TEX_ANISO" value="2"/>
+		<value name="A6XX_TEX_CUBIC" value="3"/> <!-- a650 only -->
+	</enum>
+	<enum name="a6xx_tex_clamp"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_REPEAT" value="0"/>
+		<value name="A6XX_TEX_CLAMP_TO_EDGE" value="1"/>
+		<value name="A6XX_TEX_MIRROR_REPEAT" value="2"/>
+		<value name="A6XX_TEX_CLAMP_TO_BORDER" value="3"/>
+		<value name="A6XX_TEX_MIRROR_CLAMP" value="4"/>
+	</enum>
+	<enum name="a6xx_tex_aniso"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_ANISO_1" value="0"/>
+		<value name="A6XX_TEX_ANISO_2" value="1"/>
+		<value name="A6XX_TEX_ANISO_4" value="2"/>
+		<value name="A6XX_TEX_ANISO_8" value="3"/>
+		<value name="A6XX_TEX_ANISO_16" value="4"/>
+	</enum>
+	<enum name="a6xx_reduction_mode">
+		<value name="A6XX_REDUCTION_MODE_AVERAGE" value="0"/>
+		<value name="A6XX_REDUCTION_MODE_MIN" value="1"/>
+		<value name="A6XX_REDUCTION_MODE_MAX" value="2"/>
+	</enum>
+
+	<reg32 offset="0" name="0">
+		<bitfield name="MIPFILTER_LINEAR_NEAR" pos="0" type="boolean"/>
+		<bitfield name="XY_MAG" low="1" high="2" type="a6xx_tex_filter"/>
+		<bitfield name="XY_MIN" low="3" high="4" type="a6xx_tex_filter"/>
+		<bitfield name="WRAP_S" low="5" high="7" type="a6xx_tex_clamp"/>
+		<bitfield name="WRAP_T" low="8" high="10" type="a6xx_tex_clamp"/>
+		<bitfield name="WRAP_R" low="11" high="13" type="a6xx_tex_clamp"/>
+		<bitfield name="ANISO" low="14" high="16" type="a6xx_tex_aniso"/>
+		<bitfield name="LOD_BIAS" low="19" high="31" type="fixed" radix="8"/><!-- no idea how many bits for real -->
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="CLAMPENABLE" pos="0" type="boolean">
+			<doc>
+				clamp result to [0, 1] if the format is unorm or
+				[-1, 1] if the format is snorm, *after*
+				filtering. Has no effect for other formats.
+			</doc>
+		</bitfield>
+		<bitfield name="COMPARE_FUNC" low="1" high="3" type="adreno_compare_func"/>
+		<bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="4" type="boolean"/>
+		<bitfield name="UNNORM_COORDS" pos="5" type="boolean"/>
+		<bitfield name="MIPFILTER_LINEAR_FAR" pos="6" type="boolean"/>
+		<bitfield name="MAX_LOD" low="8" high="19" type="ufixed" radix="8"/>
+		<bitfield name="MIN_LOD" low="20" high="31" type="ufixed" radix="8"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="REDUCTION_MODE" low="0" high="1" type="a6xx_reduction_mode"/>
+		<bitfield name="CHROMA_LINEAR" pos="5" type="boolean"/>
+		<bitfield name="BCOLOR" low="7" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3"/>
+</domain>
+
+<domain name="A6XX_TEX_CONST" width="32" varset="chip">
+	<doc>Texture constant dwords</doc>
+	<enum name="a6xx_tex_swiz"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_X" value="0"/>
+		<value name="A6XX_TEX_Y" value="1"/>
+		<value name="A6XX_TEX_Z" value="2"/>
+		<value name="A6XX_TEX_W" value="3"/>
+		<value name="A6XX_TEX_ZERO" value="4"/>
+		<value name="A6XX_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="a6xx_tex_type"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_1D" value="0"/>
+		<value name="A6XX_TEX_2D" value="1"/>
+		<value name="A6XX_TEX_CUBE" value="2"/>
+		<value name="A6XX_TEX_3D" value="3"/>
+		<value name="A6XX_TEX_BUFFER" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TILE_MODE" low="0" high="1" type="a6xx_tile_mode"/>
+		<bitfield name="SRGB" pos="2" type="boolean"/>
+		<bitfield name="SWIZ_X" low="4" high="6" type="a6xx_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="7" high="9" type="a6xx_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="10" high="12" type="a6xx_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="13" high="15" type="a6xx_tex_swiz"/>
+		<bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
+		<!-- overlaps with MIPLVLS -->
+		<bitfield name="CHROMA_MIDPOINT_X" pos="16" type="boolean"/>
+		<bitfield name="CHROMA_MIDPOINT_Y" pos="18" type="boolean"/>
+		<bitfield name="SAMPLES" low="20" high="21" type="a3xx_msaa_samples"/>
+		<bitfield name="FMT" low="22" high="29" type="a6xx_format"/>
+		<!--
+			Why is the swap needed in addition to SWIZ_*? The swap
+			is performed before border color replacement, while the
+			swizzle is applied after after it.
+		-->
+		<bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="WIDTH" low="0" high="14" type="uint"/>
+		<bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+		<bitfield name="MUTABLEEN" pos="31" type="boolean" variants="A7XX-"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<!--
+			These fields overlap PITCH, and are used instead of
+			PITCH/PITCHALIGN when TYPE is A6XX_TEX_BUFFER.
+		 -->
+		<doc> probably for D3D structured UAVs, normally set to 1 </doc>
+		<bitfield name="STRUCTSIZETEXELS" low="4" high="15" type="uint"/>
+		<bitfield name="STARTOFFSETTEXELS" low="16" high="21" type="uint"/>
+
+		<!-- minimum pitch (for mipmap levels): log2(pitchalign / 64) -->
+		<bitfield name="PITCHALIGN" low="0" high="3" type="uint"/>
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="7" high="28" type="uint"/>
+		<bitfield name="TYPE" low="29" high="31" type="a6xx_tex_type"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!--
+		ARRAY_PITCH is basically LAYERSZ for the first mipmap level, and
+		for 3d textures (laid out mipmap level first) MIN_LAYERSZ is the
+		layer size at the point that it stops being reduced moving to
+		higher (smaller) mipmap levels
+		 -->
+		<bitfield name="ARRAY_PITCH" low="0" high="22" shr="12" type="uint"/>
+		<bitfield name="MIN_LAYERSZ" low="23" high="26" shr="12"/>
+		<!--
+		by default levels with w < 16 are linear
+		TILE_ALL makes all levels have tiling
+		seems required when using UBWC, since all levels have UBWC (can possibly be disabled?)
+		 -->
+		<bitfield name="TILE_ALL" pos="27" type="boolean"/>
+		<bitfield name="FLAG" pos="28" type="boolean"/>
+	</reg32>
+	<!-- for 2-3 plane format, BASE is flag buffer address (if enabled)
+	     the address of the non-flag base buffer is determined automatically,
+	     and must follow the flag buffer
+	 -->
+	<reg32 offset="4" name="4">
+		<bitfield name="BASE_LO" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="BASE_HI" low="0" high="16"/>
+		<bitfield name="DEPTH" low="17" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<!-- overlaps with PLANE_PITCH -->
+		<bitfield name="MIN_LOD_CLAMP" low="0" high="11" type="ufixed" radix="8"/>
+		<!-- pitch for plane 2 / plane 3 -->
+		<bitfield name="PLANE_PITCH" low="8" high="31" type="uint"/>
+	</reg32>
+	<!-- 7/8 is plane 2 address for planar formats -->
+	<reg32 offset="7" name="7">
+		<bitfield name="FLAG_LO" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="8" name="8">
+		<bitfield name="FLAG_HI" low="0" high="16"/>
+	</reg32>
+	<!-- 9/10 is plane 3 address for planar formats -->
+	<reg32 offset="9" name="9">
+		<bitfield name="FLAG_BUFFER_ARRAY_PITCH" low="0" high="16" shr="4" type="uint"/>
+	</reg32>
+	<reg32 offset="10" name="10">
+		<bitfield name="FLAG_BUFFER_PITCH" low="0" high="6" shr="6" type="uint"/>
+		<!-- log2 size of the first level, required for mipmapping -->
+		<bitfield name="FLAG_BUFFER_LOGW" low="8" high="11" type="uint"/>
+		<bitfield name="FLAG_BUFFER_LOGH" low="12" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="11" name="11"/>
+	<reg32 offset="12" name="12"/>
+	<reg32 offset="13" name="13"/>
+	<reg32 offset="14" name="14"/>
+	<reg32 offset="15" name="15"/>
+</domain>
+
+<domain name="A6XX_UBO" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="BASE_HI" low="0" high="16"/>
+		<bitfield name="SIZE" low="17" high="31"/> <!-- size in vec4 (4xDWORD) units -->
+	</reg32>
+</domain>
+
+<domain name="A6XX_PDC" width="32">
+	<reg32 offset="0x1140" name="GPU_ENABLE_PDC"/>
+	<reg32 offset="0x1148" name="GPU_SEQ_START_ADDR"/>
+	<reg32 offset="0x1540" name="GPU_TCS0_CONTROL"/>
+	<reg32 offset="0x1541" name="GPU_TCS0_CMD_ENABLE_BANK"/>
+	<reg32 offset="0x1542" name="GPU_TCS0_CMD_WAIT_FOR_CMPL_BANK"/>
+	<reg32 offset="0x1543" name="GPU_TCS0_CMD0_MSGID"/>
+	<reg32 offset="0x1544" name="GPU_TCS0_CMD0_ADDR"/>
+	<reg32 offset="0x1545" name="GPU_TCS0_CMD0_DATA"/>
+	<reg32 offset="0x1572" name="GPU_TCS1_CONTROL"/>
+	<reg32 offset="0x1573" name="GPU_TCS1_CMD_ENABLE_BANK"/>
+	<reg32 offset="0x1574" name="GPU_TCS1_CMD_WAIT_FOR_CMPL_BANK"/>
+	<reg32 offset="0x1575" name="GPU_TCS1_CMD0_MSGID"/>
+	<reg32 offset="0x1576" name="GPU_TCS1_CMD0_ADDR"/>
+	<reg32 offset="0x1577" name="GPU_TCS1_CMD0_DATA"/>
+	<reg32 offset="0x15A4" name="GPU_TCS2_CONTROL"/>
+	<reg32 offset="0x15A5" name="GPU_TCS2_CMD_ENABLE_BANK"/>
+	<reg32 offset="0x15A6" name="GPU_TCS2_CMD_WAIT_FOR_CMPL_BANK"/>
+	<reg32 offset="0x15A7" name="GPU_TCS2_CMD0_MSGID"/>
+	<reg32 offset="0x15A8" name="GPU_TCS2_CMD0_ADDR"/>
+	<reg32 offset="0x15A9" name="GPU_TCS2_CMD0_DATA"/>
+	<reg32 offset="0x15D6" name="GPU_TCS3_CONTROL"/>
+	<reg32 offset="0x15D7" name="GPU_TCS3_CMD_ENABLE_BANK"/>
+	<reg32 offset="0x15D8" name="GPU_TCS3_CMD_WAIT_FOR_CMPL_BANK"/>
+	<reg32 offset="0x15D9" name="GPU_TCS3_CMD0_MSGID"/>
+	<reg32 offset="0x15DA" name="GPU_TCS3_CMD0_ADDR"/>
+	<reg32 offset="0x15DB" name="GPU_TCS3_CMD0_DATA"/>
+</domain>
+
+<domain name="A6XX_PDC_GPU_SEQ" width="32">
+	<reg32 offset="0x0" name="MEM_0"/>
+</domain>
+
+<domain name="A6XX_CX_DBGC" width="32">
+	<reg32 offset="0x0000" name="CFG_DBGBUS_SEL_A">
+		<bitfield high="7" low="0" name="PING_INDEX"/>
+		<bitfield high="15" low="8" name="PING_BLK_SEL"/>
+	</reg32>
+	<reg32 offset="0x0001" name="CFG_DBGBUS_SEL_B"/>
+	<reg32 offset="0x0002" name="CFG_DBGBUS_SEL_C"/>
+	<reg32 offset="0x0003" name="CFG_DBGBUS_SEL_D"/>
+	<reg32 offset="0x0004" name="CFG_DBGBUS_CNTLT">
+		<bitfield high="5" low="0" name="TRACEEN"/>
+		<bitfield high="14" low="12" name="GRANU"/>
+		<bitfield high="31" low="28" name="SEGT"/>
+	</reg32>
+	<reg32 offset="0x0005" name="CFG_DBGBUS_CNTLM">
+		<bitfield high="27" low="24" name="ENABLE"/>
+	</reg32>
+	<reg32 offset="0x0008" name="CFG_DBGBUS_IVTL_0"/>
+	<reg32 offset="0x0009" name="CFG_DBGBUS_IVTL_1"/>
+	<reg32 offset="0x000a" name="CFG_DBGBUS_IVTL_2"/>
+	<reg32 offset="0x000b" name="CFG_DBGBUS_IVTL_3"/>
+	<reg32 offset="0x000c" name="CFG_DBGBUS_MASKL_0"/>
+	<reg32 offset="0x000d" name="CFG_DBGBUS_MASKL_1"/>
+	<reg32 offset="0x000e" name="CFG_DBGBUS_MASKL_2"/>
+	<reg32 offset="0x000f" name="CFG_DBGBUS_MASKL_3"/>
+	<reg32 offset="0x0010" name="CFG_DBGBUS_BYTEL_0">
+		<bitfield high="3" low="0" name="BYTEL0"/>
+		<bitfield high="7" low="4" name="BYTEL1"/>
+		<bitfield high="11" low="8" name="BYTEL2"/>
+		<bitfield high="15" low="12" name="BYTEL3"/>
+		<bitfield high="19" low="16" name="BYTEL4"/>
+		<bitfield high="23" low="20" name="BYTEL5"/>
+		<bitfield high="27" low="24" name="BYTEL6"/>
+		<bitfield high="31" low="28" name="BYTEL7"/>
+	</reg32>
+	<reg32 offset="0x0011" name="CFG_DBGBUS_BYTEL_1">
+		<bitfield high="3" low="0" name="BYTEL8"/>
+		<bitfield high="7" low="4" name="BYTEL9"/>
+		<bitfield high="11" low="8" name="BYTEL10"/>
+		<bitfield high="15" low="12" name="BYTEL11"/>
+		<bitfield high="19" low="16" name="BYTEL12"/>
+		<bitfield high="23" low="20" name="BYTEL13"/>
+		<bitfield high="27" low="24" name="BYTEL14"/>
+		<bitfield high="31" low="28" name="BYTEL15"/>
+	</reg32>
+
+	<reg32 offset="0x002f" name="CFG_DBGBUS_TRACE_BUF1"/>
+	<reg32 offset="0x0030" name="CFG_DBGBUS_TRACE_BUF2"/>
+</domain>
+
+<domain name="A6XX_CX_MISC" width="32" prefix="variant" varset="chip">
+	<reg32 offset="0x0001" name="SYSTEM_CACHE_CNTL_0"/>
+	<reg32 offset="0x0002" name="SYSTEM_CACHE_CNTL_1"/>
+	<reg32 offset="0x0039" name="CX_MISC_TCM_RET_CNTL" variants="A7XX-"/>
+	<reg32 offset="0x0400" name="CX_MISC_SW_FUSE_VALUE" variants="A7XX-">
+		<bitfield pos="0" name="FASTBLEND" type="boolean"/>
+		<bitfield pos="1" name="LPAC" type="boolean"/>
+		<bitfield pos="2" name="RAYTRACING" type="boolean"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/adreno/a6xx_gmu.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/adreno/a6xx_gmu.xml
@@ -0,0 +1,228 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+
+<domain name="A6XX" width="32" prefix="variant" varset="chip">
+
+	<bitset name="A6XX_GMU_GPU_IDLE_STATUS">
+		<bitfield name="BUSY_IGN_AHB" pos="23"/>
+		<bitfield name="CX_GX_CPU_BUSY_IGN_AHB" pos="30"/>
+	</bitset>
+
+	<bitset name="A6XX_GMU_OOB">
+		<bitfield name="BOOT_SLUMBER_SET_MASK" pos="22"/>
+		<bitfield name="BOOT_SLUMBER_CHECK_MASK" pos="30"/>
+		<bitfield name="BOOT_SLUMBER_CLEAR_MASK" pos="30"/>
+		<bitfield name="DCVS_SET_MASK" pos="23"/>
+		<bitfield name="DCVS_CHECK_MASK" pos="31"/>
+		<bitfield name="DCVS_CLEAR_MASK" pos="31"/>
+		<bitfield name="GPU_SET_MASK" pos="18"/>
+		<bitfield name="GPU_CHECK_MASK" pos="26"/>
+		<bitfield name="GPU_CLEAR_MASK" pos="26"/>
+		<bitfield name="PERFCNTR_SET_MASK" pos="17"/>
+		<bitfield name="PERFCNTR_CHECK_MASK" pos="25"/>
+		<bitfield name="PERFCNTR_CLEAR_MASK" pos="25"/>
+	</bitset>
+
+	<bitset name="A6XX_HFI_IRQ">
+		<bitfield name="MSGQ_MASK" pos="0" />
+		<bitfield name="DSGQ_MASK" pos="1"/>
+		<bitfield name="BLOCKED_MSG_MASK" pos="2"/>
+		<bitfield name="CM3_FAULT_MASK" pos="23"/>
+		<bitfield name="GMU_ERR_MASK" low="16" high="22"/>
+		<bitfield name="OOB_MASK" low="24" high="31"/>
+	</bitset>
+
+	<bitset name="A6XX_HFI_H2F">
+		<bitfield name="IRQ_MASK_BIT" pos="0" />
+	</bitset>
+
+	<reg32 offset="0x80" name="GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL"/>
+	<reg32 offset="0x81" name="GMU_GX_SPTPRAC_POWER_CONTROL"/>
+	<reg32 offset="0xc00" name="GMU_CM3_ITCM_START"/>
+	<reg32 offset="0x1c00" name="GMU_CM3_DTCM_START"/>
+	<reg32 offset="0x23f0" name="GMU_NMI_CONTROL_STATUS"/>
+	<reg32 offset="0x23f8" name="GMU_BOOT_SLUMBER_OPTION"/>
+	<reg32 offset="0x23f9" name="GMU_GX_VOTE_IDX"/>
+	<reg32 offset="0x23fa" name="GMU_MX_VOTE_IDX"/>
+	<reg32 offset="0x23fc" name="GMU_DCVS_ACK_OPTION"/>
+	<reg32 offset="0x23fd" name="GMU_DCVS_PERF_SETTING"/>
+	<reg32 offset="0x23fe" name="GMU_DCVS_BW_SETTING"/>
+	<reg32 offset="0x23ff" name="GMU_DCVS_RETURN"/>
+	<reg32 offset="0x4c00" name="GMU_ICACHE_CONFIG"/>
+	<reg32 offset="0x4c01" name="GMU_DCACHE_CONFIG"/>
+	<reg32 offset="0x4c0f" name="GMU_SYS_BUS_CONFIG"/>
+	<reg32 offset="0x5000" name="GMU_CM3_SYSRESET"/>
+	<reg32 offset="0x5001" name="GMU_CM3_BOOT_CONFIG"/>
+	<reg32 offset="0x501a" name="GMU_CM3_FW_BUSY"/>
+	<reg32 offset="0x501c" name="GMU_CM3_FW_INIT_RESULT"/>
+	<reg32 offset="0x502d" name="GMU_CM3_CFG"/>
+	<reg32 offset="0x5040" name="GMU_CX_GMU_POWER_COUNTER_ENABLE"/>
+	<reg32 offset="0x5041" name="GMU_CX_GMU_POWER_COUNTER_SELECT_0"/>
+	<reg32 offset="0x5042" name="GMU_CX_GMU_POWER_COUNTER_SELECT_1"/>
+	<reg32 offset="0x5044" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L"/>
+	<reg32 offset="0x5045" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_0_H"/>
+	<reg32 offset="0x5046" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_1_L"/>
+	<reg32 offset="0x5047" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_1_H"/>
+	<reg32 offset="0x5048" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_2_L"/>
+	<reg32 offset="0x5049" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_2_H"/>
+	<reg32 offset="0x504a" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_3_L"/>
+	<reg32 offset="0x504b" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_3_H"/>
+	<reg32 offset="0x504c" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_4_L"/>
+	<reg32 offset="0x504d" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_4_H"/>
+	<reg32 offset="0x504e" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_5_L"/>
+	<reg32 offset="0x504f" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_5_H"/>
+	<reg32 offset="0x50c0" name="GMU_PWR_COL_INTER_FRAME_CTRL">
+		<bitfield name="IFPC_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="HM_POWER_COLLAPSE_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="SPTPRAC_POWER_CONTROL_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="NUM_PASS_SKIPS" low="10" high="13"/>
+		<bitfield name="MIN_PASS_LENGTH" low="14" high="31"/>
+	</reg32>
+	<reg32 offset="0x50c1" name="GMU_PWR_COL_INTER_FRAME_HYST"/>
+	<reg32 offset="0x50c2" name="GMU_PWR_COL_SPTPRAC_HYST"/>
+	<reg32 offset="0x50d0" name="GMU_SPTPRAC_PWR_CLK_STATUS">
+		<bitfield name="SPTPRAC_GDSC_POWERING_OFF" pos="0" type="boolean"/>
+		<bitfield name="SPTPRAC_GDSC_POWERING_ON" pos="1" type="boolean"/>
+		<bitfield name="SPTPRAC_GDSC_POWER_OFF" pos="2" type="boolean"/>
+		<bitfield name="SPTPRAC_GDSC_POWER_ON" pos="3" type="boolean"/>
+		<bitfield name="SP_CLOCK_OFF" pos="4" type="boolean"/>
+		<bitfield name="GMU_UP_POWER_STATE" pos="5" type="boolean"/>
+		<bitfield name="GX_HM_GDSC_POWER_OFF" pos="6" type="boolean"/>
+		<bitfield name="GX_HM_CLK_OFF" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x50e4" name="GMU_GPU_NAP_CTRL">
+		<bitfield name="HW_NAP_ENABLE" pos="0"/>
+		<bitfield name="SID" low="4" high="8"/>
+	</reg32>
+	<reg32 offset="0x50e8" name="GMU_RPMH_CTRL">
+		<bitfield name="RPMH_INTERFACE_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="LLC_VOTE_ENABLE" pos="4" type="boolean"/>
+		<bitfield name="DDR_VOTE_ENABLE" pos="8" type="boolean"/>
+		<bitfield name="MX_VOTE_ENABLE" pos="9" type="boolean"/>
+		<bitfield name="CX_VOTE_ENABLE" pos="10" type="boolean"/>
+		<bitfield name="GFX_VOTE_ENABLE" pos="11" type="boolean"/>
+		<bitfield name="DDR_MIN_VOTE_ENABLE" pos="12" type="boolean"/>
+		<bitfield name="MX_MIN_VOTE_ENABLE" pos="13" type="boolean"/>
+		<bitfield name="CX_MIN_VOTE_ENABLE" pos="14" type="boolean"/>
+		<bitfield name="GFX_MIN_VOTE_ENABLE" pos="15" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x50e9" name="GMU_RPMH_HYST_CTRL"/>
+	<reg32 offset="0x50ec" name="GPU_GMU_CX_GMU_RPMH_POWER_STATE"/>
+	<reg32 offset="0x50f0" name="GPU_GMU_CX_GMU_CX_FAL_INTF"/>
+	<reg32 offset="0x50f1" name="GPU_GMU_CX_GMU_CX_FALNEXT_INTF"/>
+	<reg32 offset="0x5100" name="GPU_GMU_CX_GMU_PWR_COL_CP_MSG"/>
+	<reg32 offset="0x5101" name="GPU_GMU_CX_GMU_PWR_COL_CP_RESP"/>
+	<reg32 offset="0x51f0" name="GMU_BOOT_KMD_LM_HANDSHAKE"/>
+	<reg32 offset="0x5157" name="GMU_LLM_GLM_SLEEP_CTRL"/>
+	<reg32 offset="0x5158" name="GMU_LLM_GLM_SLEEP_STATUS"/>
+	<reg32 offset="0x5088" name="GMU_ALWAYS_ON_COUNTER_L"/>
+	<reg32 offset="0x5089" name="GMU_ALWAYS_ON_COUNTER_H"/>
+	<reg32 offset="0x50c3" name="GMU_GMU_PWR_COL_KEEPALIVE"/>
+	<reg32 offset="0x5180" name="GMU_HFI_CTRL_STATUS"/>
+	<reg32 offset="0x5181" name="GMU_HFI_VERSION_INFO"/>
+	<reg32 offset="0x5182" name="GMU_HFI_SFR_ADDR"/>
+	<reg32 offset="0x5183" name="GMU_HFI_MMAP_ADDR"/>
+	<reg32 offset="0x5184" name="GMU_HFI_QTBL_INFO"/>
+	<reg32 offset="0x5185" name="GMU_HFI_QTBL_ADDR"/>
+	<reg32 offset="0x5186" name="GMU_HFI_CTRL_INIT"/>
+	<reg32 offset="0x5190" name="GMU_GMU2HOST_INTR_SET"/>
+	<reg32 offset="0x5191" name="GMU_GMU2HOST_INTR_CLR"/>
+	<reg32 offset="0x5192" name="GMU_GMU2HOST_INTR_INFO">
+		<bitfield name="MSGQ" pos="0" type="boolean"/>
+		<bitfield name="CM3_FAULT" pos="23" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x5193" name="GMU_GMU2HOST_INTR_MASK"/>
+	<reg32 offset="0x5194" name="GMU_HOST2GMU_INTR_SET"/>
+	<reg32 offset="0x5195" name="GMU_HOST2GMU_INTR_CLR"/>
+	<reg32 offset="0x5196" name="GMU_HOST2GMU_INTR_RAW_INFO"/>
+	<reg32 offset="0x5197" name="GMU_HOST2GMU_INTR_EN_0"/>
+	<reg32 offset="0x5198" name="GMU_HOST2GMU_INTR_EN_1"/>
+	<reg32 offset="0x5199" name="GMU_HOST2GMU_INTR_EN_2"/>
+	<reg32 offset="0x519a" name="GMU_HOST2GMU_INTR_EN_3"/>
+	<reg32 offset="0x519b" name="GMU_HOST2GMU_INTR_INFO_0"/>
+	<reg32 offset="0x519c" name="GMU_HOST2GMU_INTR_INFO_1"/>
+	<reg32 offset="0x519d" name="GMU_HOST2GMU_INTR_INFO_2"/>
+	<reg32 offset="0x519e" name="GMU_HOST2GMU_INTR_INFO_3"/>
+	<reg32 offset="0x51c5" name="GMU_GENERAL_0"/>
+	<reg32 offset="0x51c6" name="GMU_GENERAL_1"/>
+	<reg32 offset="0x51cb" name="GMU_GENERAL_6"/>
+	<reg32 offset="0x51cc" name="GMU_GENERAL_7"/>
+	<reg32 offset="0x51cd" name="GMU_GENERAL_8" variants="A7XX"/>
+	<reg32 offset="0x51ce" name="GMU_GENERAL_9" variants="A7XX"/>
+	<reg32 offset="0x51cf" name="GMU_GENERAL_10" variants="A7XX"/>
+	<reg32 offset="0x515d" name="GMU_ISENSE_CTRL"/>
+	<reg32 offset="0x8920" name="GPU_CS_ENABLE_REG"/>
+	<reg32 offset="0x515d" name="GPU_GMU_CX_GMU_ISENSE_CTRL"/>
+	<reg32 offset="0x8578" name="GPU_CS_AMP_CALIBRATION_CONTROL3"/>
+	<reg32 offset="0x8558" name="GPU_CS_AMP_CALIBRATION_CONTROL2"/>
+	<reg32 offset="0x8580" name="GPU_CS_A_SENSOR_CTRL_0"/>
+	<reg32 offset="0x27ada" name="GPU_CS_A_SENSOR_CTRL_2"/>
+	<reg32 offset="0x881a" name="GPU_CS_SENSOR_GENERAL_STATUS"/>
+	<reg32 offset="0x8957" name="GPU_CS_AMP_CALIBRATION_CONTROL1"/>
+	<reg32 offset="0x881a" name="GPU_CS_SENSOR_GENERAL_STATUS"/>
+	<reg32 offset="0x881d" name="GPU_CS_AMP_CALIBRATION_STATUS1_0"/>
+	<reg32 offset="0x881f" name="GPU_CS_AMP_CALIBRATION_STATUS1_2"/>
+	<reg32 offset="0x8821" name="GPU_CS_AMP_CALIBRATION_STATUS1_4"/>
+	<reg32 offset="0x8965" name="GPU_CS_AMP_CALIBRATION_DONE"/>
+	<reg32 offset="0x896d" name="GPU_CS_AMP_PERIOD_CTRL"/>
+	<reg32 offset="0x8965" name="GPU_CS_AMP_CALIBRATION_DONE"/>
+	<reg32 offset="0x514d" name="GPU_GMU_CX_GMU_PWR_THRESHOLD"/>
+	<reg32 offset="0x9303" name="GMU_AO_INTERRUPT_EN"/>
+	<reg32 offset="0x9304" name="GMU_AO_HOST_INTERRUPT_CLR"/>
+	<reg32 offset="0x9305" name="GMU_AO_HOST_INTERRUPT_STATUS">
+		<bitfield name="WDOG_BITE" pos="0" type="boolean"/>
+		<bitfield name="RSCC_COMP" pos="1" type="boolean"/>
+		<bitfield name="VDROOP" pos="2" type="boolean"/>
+		<bitfield name="FENCE_ERR" pos="3" type="boolean"/>
+		<bitfield name="DBD_WAKEUP" pos="4" type="boolean"/>
+		<bitfield name="HOST_AHB_BUS_ERROR" pos="5" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x9306" name="GMU_AO_HOST_INTERRUPT_MASK"/>
+	<reg32 offset="0x9309" name="GPU_GMU_AO_GMU_CGC_MODE_CNTL"/>
+	<reg32 offset="0x930a" name="GPU_GMU_AO_GMU_CGC_DELAY_CNTL"/>
+	<reg32 offset="0x930b" name="GPU_GMU_AO_GMU_CGC_HYST_CNTL"/>
+	<reg32 offset="0x930c" name="GPU_GMU_AO_GPU_CX_BUSY_STATUS">
+		<bitfield name = "GPUBUSYIGNAHB" pos="23" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x930d" name="GPU_GMU_AO_GPU_CX_BUSY_STATUS2"/>
+	<reg32 offset="0x930e" name="GPU_GMU_AO_GPU_CX_BUSY_MASK"/>
+	<reg32 offset="0x9310" name="GMU_AO_AHB_FENCE_CTRL"/>
+	<reg32 offset="0x9313" name="GMU_AHB_FENCE_STATUS"/>
+	<reg32 offset="0x9314" name="GMU_AHB_FENCE_STATUS_CLR"/>
+	<reg32 offset="0x9315" name="GMU_RBBM_INT_UNMASKED_STATUS"/>
+	<reg32 offset="0x9316" name="GMU_AO_SPARE_CNTL"/>
+	<reg32 offset="0x9307" name="GMU_RSCC_CONTROL_REQ"/>
+	<reg32 offset="0x9308" name="GMU_RSCC_CONTROL_ACK"/>
+	<reg32 offset="0x9311" name="GMU_AHB_FENCE_RANGE_0"/>
+	<reg32 offset="0x9312" name="GMU_AHB_FENCE_RANGE_1"/>
+	<reg32 offset="0x9c03" name="GPU_CC_GX_GDSCR"/>
+	<reg32 offset="0x9d42" name="GPU_CC_GX_DOMAIN_MISC"/>
+	<reg32 offset="0xc001" name="GPU_CPR_FSM_CTL"/>
+
+	<!-- starts at offset 0x8c00 on most gpus -->
+	<reg32 offset="0x0004" name="GPU_RSCC_RSC_STATUS0_DRV0"/>
+	<reg32 offset="0x0008" name="RSCC_PDC_SEQ_START_ADDR"/>
+	<reg32 offset="0x0009" name="RSCC_PDC_MATCH_VALUE_LO"/>
+	<reg32 offset="0x000a" name="RSCC_PDC_MATCH_VALUE_HI"/>
+	<reg32 offset="0x000b" name="RSCC_PDC_SLAVE_ID_DRV0"/>
+	<reg32 offset="0x000d" name="RSCC_HIDDEN_TCS_CMD0_ADDR"/>
+	<reg32 offset="0x000e" name="RSCC_HIDDEN_TCS_CMD0_DATA"/>
+	<reg32 offset="0x0082" name="RSCC_TIMESTAMP_UNIT0_TIMESTAMP_L_DRV0"/>
+	<reg32 offset="0x0083" name="RSCC_TIMESTAMP_UNIT0_TIMESTAMP_H_DRV0"/>
+	<reg32 offset="0x0089" name="RSCC_TIMESTAMP_UNIT1_EN_DRV0"/>
+	<reg32 offset="0x008c" name="RSCC_TIMESTAMP_UNIT1_OUTPUT_DRV0"/>
+	<reg32 offset="0x0100" name="RSCC_OVERRIDE_START_ADDR"/>
+	<reg32 offset="0x0101" name="RSCC_SEQ_BUSY_DRV0"/>
+	<reg32 offset="0x0154" name="RSCC_SEQ_MEM_0_DRV0_A740" variants="A7XX"/>
+	<reg32 offset="0x0180" name="RSCC_SEQ_MEM_0_DRV0"/>
+	<reg32 offset="0x0346" name="RSCC_TCS0_DRV0_STATUS"/>
+	<reg32 offset="0x03ee" name="RSCC_TCS1_DRV0_STATUS"/>
+	<reg32 offset="0x0496" name="RSCC_TCS2_DRV0_STATUS"/>
+	<reg32 offset="0x053e" name="RSCC_TCS3_DRV0_STATUS"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/adreno/adreno_common.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/adreno/adreno_common.xml
@@ -0,0 +1,400 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<enum name="chip" bare="yes">
+	<value name="A2XX" value="2"/>
+	<value name="A3XX" value="3"/>
+	<value name="A4XX" value="4"/>
+	<value name="A5XX" value="5"/>
+	<value name="A6XX" value="6"/>
+	<value name="A7XX" value="7"/>
+</enum>
+
+<enum name="adreno_pa_su_sc_draw">
+	<value name="PC_DRAW_POINTS" value="0"/>
+	<value name="PC_DRAW_LINES" value="1"/>
+	<value name="PC_DRAW_TRIANGLES" value="2"/>
+</enum>
+
+<enum name="adreno_compare_func">
+	<value name="FUNC_NEVER" value="0"/>
+	<value name="FUNC_LESS" value="1"/>
+	<value name="FUNC_EQUAL" value="2"/>
+	<value name="FUNC_LEQUAL" value="3"/>
+	<value name="FUNC_GREATER" value="4"/>
+	<value name="FUNC_NOTEQUAL" value="5"/>
+	<value name="FUNC_GEQUAL" value="6"/>
+	<value name="FUNC_ALWAYS" value="7"/>
+</enum>
+
+<enum name="adreno_stencil_op">
+	<value name="STENCIL_KEEP" value="0"/>
+	<value name="STENCIL_ZERO" value="1"/>
+	<value name="STENCIL_REPLACE" value="2"/>
+	<value name="STENCIL_INCR_CLAMP" value="3"/>
+	<value name="STENCIL_DECR_CLAMP" value="4"/>
+	<value name="STENCIL_INVERT" value="5"/>
+	<value name="STENCIL_INCR_WRAP" value="6"/>
+	<value name="STENCIL_DECR_WRAP" value="7"/>
+</enum>
+
+<enum name="adreno_rb_blend_factor">
+	<value name="FACTOR_ZERO" value="0"/>
+	<value name="FACTOR_ONE" value="1"/>
+	<value name="FACTOR_SRC_COLOR" value="4"/>
+	<value name="FACTOR_ONE_MINUS_SRC_COLOR" value="5"/>
+	<value name="FACTOR_SRC_ALPHA" value="6"/>
+	<value name="FACTOR_ONE_MINUS_SRC_ALPHA" value="7"/>
+	<value name="FACTOR_DST_COLOR" value="8"/>
+	<value name="FACTOR_ONE_MINUS_DST_COLOR" value="9"/>
+	<value name="FACTOR_DST_ALPHA" value="10"/>
+	<value name="FACTOR_ONE_MINUS_DST_ALPHA" value="11"/>
+	<value name="FACTOR_CONSTANT_COLOR" value="12"/>
+	<value name="FACTOR_ONE_MINUS_CONSTANT_COLOR" value="13"/>
+	<value name="FACTOR_CONSTANT_ALPHA" value="14"/>
+	<value name="FACTOR_ONE_MINUS_CONSTANT_ALPHA" value="15"/>
+	<value name="FACTOR_SRC_ALPHA_SATURATE" value="16"/>
+	<value name="FACTOR_SRC1_COLOR" value="20"/>
+	<value name="FACTOR_ONE_MINUS_SRC1_COLOR" value="21"/>
+	<value name="FACTOR_SRC1_ALPHA" value="22"/>
+	<value name="FACTOR_ONE_MINUS_SRC1_ALPHA" value="23"/>
+</enum>
+
+<bitset name="adreno_rb_stencilrefmask" inline="yes">
+	<bitfield name="STENCILREF" low="0" high="7" type="hex"/>
+	<bitfield name="STENCILMASK" low="8" high="15" type="hex"/>
+	<bitfield name="STENCILWRITEMASK" low="16" high="23" type="hex"/>
+</bitset>
+
+<enum name="adreno_rb_surface_endian">
+	<value name="ENDIAN_NONE" value="0"/>
+	<value name="ENDIAN_8IN16" value="1"/>
+	<value name="ENDIAN_8IN32" value="2"/>
+	<value name="ENDIAN_16IN32" value="3"/>
+	<value name="ENDIAN_8IN64" value="4"/>
+	<value name="ENDIAN_8IN128" value="5"/>
+</enum>
+
+<enum name="adreno_rb_dither_mode">
+	<value name="DITHER_DISABLE" value="0"/>
+	<value name="DITHER_ALWAYS" value="1"/>
+	<value name="DITHER_IF_ALPHA_OFF" value="2"/>
+</enum>
+
+<enum name="adreno_rb_depth_format">
+	<value name="DEPTHX_16" value="0"/>
+	<value name="DEPTHX_24_8" value="1"/>
+	<value name="DEPTHX_32" value="2"/>
+</enum>
+
+<enum name="adreno_rb_copy_control_mode">
+	<value name="RB_COPY_RESOLVE" value="1"/>
+	<value name="RB_COPY_CLEAR" value="2"/>
+	<value name="RB_COPY_DEPTH_STENCIL" value="5"/>  <!-- not sure if this is part of MODE or another bitfield?? -->
+</enum>
+
+<bitset name="adreno_reg_xy" inline="yes">
+	<bitfield name="WINDOW_OFFSET_DISABLE" pos="31" type="boolean"/>
+	<bitfield name="X" low="0" high="14" type="uint"/>
+	<bitfield name="Y" low="16" high="30" type="uint"/>
+</bitset>
+
+<bitset name="adreno_cp_protect" inline="yes">
+	<bitfield name="BASE_ADDR" low="0" high="16"/>
+	<bitfield name="MASK_LEN" low="24" high="28"/>
+	<bitfield name="TRAP_WRITE" pos="29"/>
+	<bitfield name="TRAP_READ" pos="30"/>
+</bitset>
+
+<domain name="AXXX" width="32">
+	<brief>Registers in common between a2xx and a3xx</brief>
+
+	<reg32 offset="0x01c0" name="CP_RB_BASE"/>
+	<reg32 offset="0x01c1" name="CP_RB_CNTL">
+		<bitfield name="BUFSZ" low="0" high="5"/>
+		<bitfield name="BLKSZ" low="8" high="13"/>
+		<bitfield name="BUF_SWAP" low="16" high="17"/>
+		<bitfield name="POLL_EN" pos="20" type="boolean"/>
+		<bitfield name="NO_UPDATE" pos="27" type="boolean"/>
+		<bitfield name="RPTR_WR_EN" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01c3" name="CP_RB_RPTR_ADDR">
+		<bitfield name="SWAP" low="0" high="1" type="uint"/>
+		<bitfield name="ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="0x01c4" name="CP_RB_RPTR" type="uint"/>
+	<reg32 offset="0x01c5" name="CP_RB_WPTR" type="uint"/>
+	<reg32 offset="0x01c6" name="CP_RB_WPTR_DELAY"/>
+	<reg32 offset="0x01c7" name="CP_RB_RPTR_WR"/>
+	<reg32 offset="0x01c8" name="CP_RB_WPTR_BASE"/>
+	<reg32 offset="0x01d5" name="CP_QUEUE_THRESHOLDS">
+		<bitfield name="CSQ_IB1_START" low="0" high="3" type="uint"/>
+		<bitfield name="CSQ_IB2_START" low="8" high="11" type="uint"/>
+		<bitfield name="CSQ_ST_START" low="16" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01d6" name="CP_MEQ_THRESHOLDS">
+		<bitfield name="MEQ_END" low="16" high="20" type="uint"/>
+		<bitfield name="ROQ_END" low="24" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01d7" name="CP_CSQ_AVAIL">
+		<bitfield name="RING" low="0" high="6" type="uint"/>
+		<bitfield name="IB1" low="8" high="14" type="uint"/>
+		<bitfield name="IB2" low="16" high="22" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01d8" name="CP_STQ_AVAIL">
+		<bitfield name="ST" low="0" high="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01d9" name="CP_MEQ_AVAIL">
+		<bitfield name="MEQ" low="0" high="4" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01dc" name="SCRATCH_UMSK">
+		<bitfield name="UMSK" low="0" high="7" type="uint"/>
+		<bitfield name="SWAP" low="16" high="17" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01dd" name="SCRATCH_ADDR"/>
+	<reg32 offset="0x01ea" name="CP_ME_RDADDR"/>
+
+	<reg32 offset="0x01ec" name="CP_STATE_DEBUG_INDEX"/>
+	<reg32 offset="0x01ed" name="CP_STATE_DEBUG_DATA"/>
+	<reg32 offset="0x01f2" name="CP_INT_CNTL">
+		<bitfield name="SW_INT_MASK" pos="19" type="boolean"/>
+		<bitfield name="T0_PACKET_IN_IB_MASK" pos="23" type="boolean"/>
+		<bitfield name="OPCODE_ERROR_MASK" pos="24" type="boolean"/>
+		<bitfield name="PROTECTED_MODE_ERROR_MASK" pos="25" type="boolean"/>
+		<bitfield name="RESERVED_BIT_ERROR_MASK" pos="26" type="boolean"/>
+		<bitfield name="IB_ERROR_MASK" pos="27" type="boolean"/>
+		<bitfield name="IB2_INT_MASK" pos="29" type="boolean"/>
+		<bitfield name="IB1_INT_MASK" pos="30" type="boolean"/>
+		<bitfield name="RB_INT_MASK" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01f3" name="CP_INT_STATUS"/>
+	<reg32 offset="0x01f4" name="CP_INT_ACK"/>
+	<reg32 offset="0x01f6" name="CP_ME_CNTL">
+		<bitfield name="BUSY" pos="29" type="boolean"/>
+		<bitfield name="HALT" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01f7" name="CP_ME_STATUS"/>
+	<reg32 offset="0x01f8" name="CP_ME_RAM_WADDR"/>
+	<reg32 offset="0x01f9" name="CP_ME_RAM_RADDR"/>
+	<reg32 offset="0x01fa" name="CP_ME_RAM_DATA"/>
+	<reg32 offset="0x01fc" name="CP_DEBUG">
+		<bitfield name="PREDICATE_DISABLE" pos="23" type="boolean"/>
+		<bitfield name="PROG_END_PTR_ENABLE" pos="24" type="boolean"/>
+		<bitfield name="MIU_128BIT_WRITE_ENABLE" pos="25" type="boolean"/>
+		<bitfield name="PREFETCH_PASS_NOPS" pos="26" type="boolean"/>
+		<bitfield name="DYNAMIC_CLK_DISABLE" pos="27" type="boolean"/>
+		<bitfield name="PREFETCH_MATCH_DISABLE" pos="28" type="boolean"/>
+		<bitfield name="SIMPLE_ME_FLOW_CONTROL" pos="30" type="boolean"/>
+		<bitfield name="MIU_WRITE_PACK_DISABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01fd" name="CP_CSQ_RB_STAT">
+		<bitfield name="RPTR" low="0" high="6" type="uint"/>
+		<bitfield name="WPTR" low="16" high="22" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01fe" name="CP_CSQ_IB1_STAT">
+		<bitfield name="RPTR" low="0" high="6" type="uint"/>
+		<bitfield name="WPTR" low="16" high="22" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01ff" name="CP_CSQ_IB2_STAT">
+		<bitfield name="RPTR" low="0" high="6" type="uint"/>
+		<bitfield name="WPTR" low="16" high="22" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0440" name="CP_NON_PREFETCH_CNTRS"/>
+	<reg32 offset="0x0443" name="CP_STQ_ST_STAT"/>
+	<reg32 offset="0x044d" name="CP_ST_BASE"/>
+	<reg32 offset="0x044e" name="CP_ST_BUFSZ"/>
+	<reg32 offset="0x044f" name="CP_MEQ_STAT"/>
+	<reg32 offset="0x0452" name="CP_MIU_TAG_STAT"/>
+	<reg32 offset="0x0454" name="CP_BIN_MASK_LO"/>
+	<reg32 offset="0x0455" name="CP_BIN_MASK_HI"/>
+	<reg32 offset="0x0456" name="CP_BIN_SELECT_LO"/>
+	<reg32 offset="0x0457" name="CP_BIN_SELECT_HI"/>
+	<reg32 offset="0x0458" name="CP_IB1_BASE"/>
+	<reg32 offset="0x0459" name="CP_IB1_BUFSZ"/>
+	<reg32 offset="0x045a" name="CP_IB2_BASE"/>
+	<reg32 offset="0x045b" name="CP_IB2_BUFSZ"/>
+	<reg32 offset="0x047f" name="CP_STAT">
+		<bitfield pos="31" name="CP_BUSY"/>
+		<bitfield pos="30" name="VS_EVENT_FIFO_BUSY"/>
+		<bitfield pos="29" name="PS_EVENT_FIFO_BUSY"/>
+		<bitfield pos="28" name="CF_EVENT_FIFO_BUSY"/>
+		<bitfield pos="27" name="RB_EVENT_FIFO_BUSY"/>
+		<bitfield pos="26" name="ME_BUSY"/>
+		<bitfield pos="25" name="MIU_WR_C_BUSY"/>
+		<bitfield pos="23" name="CP_3D_BUSY"/>
+		<bitfield pos="22" name="CP_NRT_BUSY"/>
+		<bitfield pos="21" name="RBIU_SCRATCH_BUSY"/>
+		<bitfield pos="20" name="RCIU_ME_BUSY"/>
+		<bitfield pos="19" name="RCIU_PFP_BUSY"/>
+		<bitfield pos="18" name="MEQ_RING_BUSY"/>
+		<bitfield pos="17" name="PFP_BUSY"/>
+		<bitfield pos="16" name="ST_QUEUE_BUSY"/>
+		<bitfield pos="13" name="INDIRECT2_QUEUE_BUSY"/>
+		<bitfield pos="12" name="INDIRECTS_QUEUE_BUSY"/>
+		<bitfield pos="11" name="RING_QUEUE_BUSY"/>
+		<bitfield pos="10" name="CSF_BUSY"/>
+		<bitfield pos="9"  name="CSF_ST_BUSY"/>
+		<bitfield pos="8"  name="EVENT_BUSY"/>
+		<bitfield pos="7"  name="CSF_INDIRECT2_BUSY"/>
+		<bitfield pos="6"  name="CSF_INDIRECTS_BUSY"/>
+		<bitfield pos="5"  name="CSF_RING_BUSY"/>
+		<bitfield pos="4"  name="RCIU_BUSY"/>
+		<bitfield pos="3"  name="RBIU_BUSY"/>
+		<bitfield pos="2"  name="MIU_RD_RETURN_BUSY"/>
+		<bitfield pos="1"  name="MIU_RD_REQ_BUSY"/>
+		<bitfield pos="0"  name="MIU_WR_BUSY"/>
+	</reg32>
+	<reg32 offset="0x0578" name="CP_SCRATCH_REG0" type="uint"/>
+	<reg32 offset="0x0579" name="CP_SCRATCH_REG1" type="uint"/>
+	<reg32 offset="0x057a" name="CP_SCRATCH_REG2" type="uint"/>
+	<reg32 offset="0x057b" name="CP_SCRATCH_REG3" type="uint"/>
+	<reg32 offset="0x057c" name="CP_SCRATCH_REG4" type="uint"/>
+	<reg32 offset="0x057d" name="CP_SCRATCH_REG5" type="uint"/>
+	<reg32 offset="0x057e" name="CP_SCRATCH_REG6" type="uint"/>
+	<reg32 offset="0x057f" name="CP_SCRATCH_REG7" type="uint"/>
+
+	<reg32 offset="0x0600" name="CP_ME_VS_EVENT_SRC"/>
+	<reg32 offset="0x0601" name="CP_ME_VS_EVENT_ADDR"/>
+	<reg32 offset="0x0602" name="CP_ME_VS_EVENT_DATA"/>
+	<reg32 offset="0x0603" name="CP_ME_VS_EVENT_ADDR_SWM"/>
+	<reg32 offset="0x0604" name="CP_ME_VS_EVENT_DATA_SWM"/>
+	<reg32 offset="0x0605" name="CP_ME_PS_EVENT_SRC"/>
+	<reg32 offset="0x0606" name="CP_ME_PS_EVENT_ADDR"/>
+	<reg32 offset="0x0607" name="CP_ME_PS_EVENT_DATA"/>
+	<reg32 offset="0x0608" name="CP_ME_PS_EVENT_ADDR_SWM"/>
+	<reg32 offset="0x0609" name="CP_ME_PS_EVENT_DATA_SWM"/>
+	<reg32 offset="0x060a" name="CP_ME_CF_EVENT_SRC"/>
+	<reg32 offset="0x060b" name="CP_ME_CF_EVENT_ADDR"/>
+	<reg32 offset="0x060c" name="CP_ME_CF_EVENT_DATA" type="uint"/>
+	<reg32 offset="0x060d" name="CP_ME_NRT_ADDR"/>
+	<reg32 offset="0x060e" name="CP_ME_NRT_DATA"/>
+	<reg32 offset="0x0612" name="CP_ME_VS_FETCH_DONE_SRC"/>
+	<reg32 offset="0x0613" name="CP_ME_VS_FETCH_DONE_ADDR"/>
+	<reg32 offset="0x0614" name="CP_ME_VS_FETCH_DONE_DATA"/>
+
+</domain>
+
+<!--
+	Common between A3xx and A4xx:
+ -->
+
+<enum name="a3xx_rop_code">
+	<value name="ROP_CLEAR"         value="0"/>
+	<value name="ROP_NOR"           value="1"/>
+	<value name="ROP_AND_INVERTED"  value="2"/>
+	<value name="ROP_COPY_INVERTED" value="3"/>
+	<value name="ROP_AND_REVERSE"   value="4"/>
+	<value name="ROP_INVERT"        value="5"/>
+	<value name="ROP_XOR"           value="6"/>
+	<value name="ROP_NAND"          value="7"/>
+	<value name="ROP_AND"           value="8"/>
+	<value name="ROP_EQUIV"         value="9"/>
+	<value name="ROP_NOOP"          value="10"/>
+	<value name="ROP_OR_INVERTED"   value="11"/>
+	<value name="ROP_COPY"          value="12"/>
+	<value name="ROP_OR_REVERSE"    value="13"/>
+	<value name="ROP_OR"            value="14"/>
+	<value name="ROP_SET"           value="15"/>
+</enum>
+
+<enum name="a3xx_render_mode">
+	<value name="RB_RENDERING_PASS" value="0"/>
+	<value name="RB_TILING_PASS" value="1"/>
+	<value name="RB_RESOLVE_PASS" value="2"/>
+	<value name="RB_COMPUTE_PASS" value="3"/>
+</enum>
+
+<enum name="a3xx_msaa_samples">
+	<value name="MSAA_ONE" value="0"/>
+	<value name="MSAA_TWO" value="1"/>
+	<value name="MSAA_FOUR" value="2"/>
+	<value name="MSAA_EIGHT" value="3"/>
+</enum>
+
+<enum name="a3xx_threadmode">
+	<value value="0" name="MULTI"/>
+	<value value="1" name="SINGLE"/>
+</enum>
+
+<enum name="a3xx_instrbuffermode">
+	<!--
+	When shader size goes above ~128 or so, blob switches to '0'
+	and doesn't emit shader in cmdstream.  When either is '0' it
+	doesn't get emitted via CP_LOAD_STATE.  When only one is
+	'0' the other gets size 256-others_size.  So I think that:
+		BUFFER => execute out of state memory
+		CACHE  => use available state memory as local cache
+	NOTE that when CACHE mode, also set CACHEINVALID flag!
+
+	TODO check if that 256 size is same for all a3xx
+	 -->
+	<value value="0" name="CACHE"/>
+	<value value="1" name="BUFFER"/>
+</enum>
+
+<enum name="a3xx_threadsize">
+	<value value="0" name="TWO_QUADS"/>
+	<value value="1" name="FOUR_QUADS"/>
+</enum>
+
+<enum name="a3xx_color_swap">
+	<value name="WZYX" value="0"/>
+	<value name="WXYZ" value="1"/>
+	<value name="ZYXW" value="2"/>
+	<value name="XYZW" value="3"/>
+</enum>
+
+<enum name="a3xx_rb_blend_opcode">
+	<value name="BLEND_DST_PLUS_SRC" value="0"/>
+	<value name="BLEND_SRC_MINUS_DST" value="1"/>
+	<value name="BLEND_DST_MINUS_SRC" value="2"/>
+	<value name="BLEND_MIN_DST_SRC" value="3"/>
+	<value name="BLEND_MAX_DST_SRC" value="4"/>
+</enum>
+
+<enum name="a4xx_tess_spacing">
+	<value name="EQUAL_SPACING" value="0"/>
+	<value name="ODD_SPACING" value="2"/>
+	<value name="EVEN_SPACING" value="3"/>
+</enum>
+
+<doc>Address mode for a5xx+</doc>
+<enum name="a5xx_address_mode">
+	<value name="ADDR_32B" value="0"/>
+	<value name="ADDR_64B" value="1"/>
+</enum>
+
+<doc>
+    Line mode for a5xx+
+	Note that Bresenham lines are only supported with MSAA disabled.
+</doc>
+<enum name="a5xx_line_mode">
+	<value value="0x0"  name="BRESENHAM"/>
+	<value value="0x1"  name="RECTANGULAR"/>
+</enum>
+
+<doc>
+	Blob (v615) seem to only use SAM and I wasn't able to coerce
+	it to produce any other command.
+	Probably valid for a4xx+ but not enabled or tested on anything
+	but a6xx.
+</doc>
+<enum name="a6xx_tex_prefetch_cmd">
+	<doc> Produces garbage </doc>
+	<value value="0x0" name="TEX_PREFETCH_UNK0"/>
+	<value value="0x1" name="TEX_PREFETCH_SAM"/>
+	<value value="0x2" name="TEX_PREFETCH_GATHER4R"/>
+	<value value="0x3" name="TEX_PREFETCH_GATHER4G"/>
+	<value value="0x4" name="TEX_PREFETCH_GATHER4B"/>
+	<value value="0x5" name="TEX_PREFETCH_GATHER4A"/>
+	<doc> Causes reads from an invalid address </doc>
+	<value value="0x6" name="TEX_PREFETCH_UNK6"/>
+	<doc> Results in color being zero </doc>
+	<value value="0x7" name="TEX_PREFETCH_UNK7"/>
+</enum>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
@@ -0,0 +1,2263 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+
+<enum name="vgt_event_type" varset="chip">
+	<value name="VS_DEALLOC" value="0"/>
+	<value name="PS_DEALLOC" value="1" variants="A2XX-A6XX"/>
+	<value name="VS_DONE_TS" value="2"/>
+	<value name="PS_DONE_TS" value="3"/>
+	<doc>
+		Flushes dirty data from UCHE, and also writes a GPU timestamp to
+		the address if one is provided.
+	</doc>
+	<value name="CACHE_FLUSH_TS" value="4"/>
+	<value name="CONTEXT_DONE" value="5"/>
+	<value name="CACHE_FLUSH" value="6" variants="A2XX-A4XX"/>
+	<value name="VIZQUERY_START" value="7" variants="A2XX"/>
+	<value name="HLSQ_FLUSH" value="7" variants="A3XX-A4XX"/>
+	<value name="VIZQUERY_END" value="8" variants="A2XX"/>
+	<value name="SC_WAIT_WC" value="9" variants="A2XX"/>
+	<value name="WRITE_PRIMITIVE_COUNTS" value="9" variants="A6XX"/>
+	<value name="START_PRIMITIVE_CTRS" value="11" variants="A6XX"/>
+	<value name="STOP_PRIMITIVE_CTRS" value="12" variants="A6XX"/>
+	<!-- Not sure that these 4 events don't have the same meaning as on A5XX+ -->
+	<value name="RST_PIX_CNT" value="13" variants="A2XX-A4XX"/>
+	<value name="RST_VTX_CNT" value="14" variants="A2XX-A4XX"/>
+	<value name="TILE_FLUSH" value="15" variants="A2XX-A4XX"/>
+	<value name="STAT_EVENT" value="16" variants="A2XX-A4XX"/>
+	<value name="CACHE_FLUSH_AND_INV_TS_EVENT" value="20" variants="A2XX-A4XX"/>
+	<doc>
+		If A6XX_RB_SAMPLE_COUNT_CONTROL.copy is true, writes OQ Z passed
+		sample counts to RB_SAMPLE_COUNT_ADDR.  This writes to main
+		memory, skipping UCHE.
+	</doc>
+	<value name="ZPASS_DONE" value="21"/>
+	<value name="CACHE_FLUSH_AND_INV_EVENT" value="22" variants="A2XX"/>
+
+	<doc>
+		Writes the GPU timestamp to the address that follows, once RB
+		access and flushes are complete.
+	</doc>
+	<value name="RB_DONE_TS" value="22" variants="A3XX-"/>
+
+	<value name="PERFCOUNTER_START" value="23" variants="A2XX-A4XX"/>
+	<value name="PERFCOUNTER_STOP" value="24" variants="A2XX-A4XX"/>
+	<value name="VS_FETCH_DONE" value="27"/>
+	<value name="FACENESS_FLUSH" value="28" variants="A2XX-A4XX"/>
+
+	<!-- a5xx events -->
+	<value name="WT_DONE_TS" value="8" variants="A5XX-"/>
+	<value name="START_FRAGMENT_CTRS" value="13" variants="A5XX-"/>
+	<value name="STOP_FRAGMENT_CTRS" value="14" variants="A5XX-"/>
+	<value name="START_COMPUTE_CTRS" value="15" variants="A5XX-"/>
+	<value name="STOP_COMPUTE_CTRS" value="16" variants="A5XX-"/>
+	<value name="FLUSH_SO_0" value="17" variants="A5XX-"/>
+	<value name="FLUSH_SO_1" value="18" variants="A5XX-"/>
+	<value name="FLUSH_SO_2" value="19" variants="A5XX-"/>
+	<value name="FLUSH_SO_3" value="20" variants="A5XX-"/>
+
+	<doc>
+		Invalidates depth attachment data from the CCU.  We assume this
+		happens in the last stage.
+	</doc>
+	<value name="PC_CCU_INVALIDATE_DEPTH" value="24" variants="A5XX-"/>
+
+	<doc>
+		Invalidates color attachment data from the CCU.  We assume this
+		happens in the last stage.
+	</doc>
+	<value name="PC_CCU_INVALIDATE_COLOR" value="25" variants="A5XX-"/>
+
+	<doc>
+		Flushes the small cache used by CP_EVENT_WRITE::BLIT (which,
+		along with its registers, would be better named RESOLVE).
+	</doc>
+	<value name="PC_CCU_RESOLVE_TS" value="26" variants="A6XX"/>
+
+	<doc>
+		Flushes depth attachment data from the CCU.  We assume this
+		happens in the last stage.
+	</doc>
+	<value name="PC_CCU_FLUSH_DEPTH_TS" value="28" variants="A5XX-"/>
+
+	<doc>
+		Flushes color attachment data from the CCU.  We assume this
+		happens in the last stage.
+	</doc>
+	<value name="PC_CCU_FLUSH_COLOR_TS" value="29" variants="A5XX-"/>
+
+	<doc>
+		2D blit to resolve GMEM to system memory (skipping CCU) at the
+		end of a render pass.  Compare to CP_BLIT's BLIT_OP_SCALE for
+		more general blitting.
+	</doc>
+	<value name="BLIT" value="30" variants="A5XX-"/>
+
+	<doc>
+		Clears based on GRAS_LRZ_CNTL configuration, could clear
+		fast-clear buffer or LRZ direction.
+		LRZ direction is stored at lrz_fc_offset + 0x200, has 1 byte which
+		could be expressed by enum:
+			CUR_DIR_DISABLED = 0x0
+			CUR_DIR_GE = 0x1
+			CUR_DIR_LE = 0x2
+			CUR_DIR_UNSET = 0x3
+		Clear of direction means setting the direction to CUR_DIR_UNSET.
+	</doc>
+	<value name="LRZ_CLEAR" value="37" variants="A5XX-"/>
+
+	<value name="LRZ_FLUSH" value="38" variants="A5XX-"/>
+	<value name="BLIT_OP_FILL_2D" value="39" variants="A5XX-"/>
+	<value name="BLIT_OP_COPY_2D" value="40" variants="A5XX-A6XX"/>
+	<value name="UNK_40" value="40" variants="A7XX"/>
+	<value name="BLIT_OP_SCALE_2D" value="42" variants="A5XX-"/>
+	<value name="CONTEXT_DONE_2D" value="43" variants="A5XX-"/>
+	<value name="UNK_2C" value="44" variants="A5XX-"/>
+	<value name="UNK_2D" value="45" variants="A5XX-"/>
+
+	<!-- a6xx events -->
+	<doc>
+		Invalidates UCHE.
+	</doc>
+	<value name="CACHE_INVALIDATE" value="49" variants="A6XX"/>
+
+	<value name="LABEL" value="63" variants="A6XX-"/>
+
+	<!-- note, some of these are the same as a6xx, just named differently -->
+
+	<doc> Doesn't seem to do anything </doc>
+	<value name="DUMMY_EVENT" value="1" variants="A7XX"/>
+	<value name="CCU_INVALIDATE_DEPTH" value="24" variants="A7XX"/>
+	<value name="CCU_INVALIDATE_COLOR" value="25" variants="A7XX"/>
+	<value name="CCU_RESOLVE_CLEAN" value="26" variants="A7XX"/>
+	<value name="CCU_FLUSH_DEPTH" value="28" variants="A7XX"/>
+	<value name="CCU_FLUSH_COLOR" value="29" variants="A7XX"/>
+	<value name="CCU_RESOLVE" value="30" variants="A7XX"/>
+	<value name="CCU_END_RESOLVE_GROUP" value="31" variants="A7XX"/>
+	<value name="CCU_CLEAN_DEPTH" value="32" variants="A7XX"/>
+	<value name="CCU_CLEAN_COLOR" value="33" variants="A7XX"/>
+	<value name="CACHE_RESET" value="48" variants="A7XX"/>
+	<value name="CACHE_CLEAN" value="49" variants="A7XX"/>
+	<!-- TODO: deal with name conflicts with other gens -->
+	<value name="CACHE_FLUSH7" value="50" variants="A7XX"/>
+	<value name="CACHE_INVALIDATE7" value="51" variants="A7XX"/>
+</enum>
+
+<enum name="pc_di_primtype">
+	<value name="DI_PT_NONE" value="0"/>
+	<!-- POINTLIST_PSIZE is used on a3xx/a4xx when gl_PointSize is written: -->
+	<value name="DI_PT_POINTLIST_PSIZE" value="1"/>
+	<value name="DI_PT_LINELIST" value="2"/>
+	<value name="DI_PT_LINESTRIP" value="3"/>
+	<value name="DI_PT_TRILIST" value="4"/>
+	<value name="DI_PT_TRIFAN" value="5"/>
+	<value name="DI_PT_TRISTRIP" value="6"/>
+	<value name="DI_PT_LINELOOP" value="7"/>  <!-- a22x, a3xx -->
+	<value name="DI_PT_RECTLIST" value="8"/>
+	<value name="DI_PT_POINTLIST" value="9"/>
+	<value name="DI_PT_LINE_ADJ" value="0xa"/>
+	<value name="DI_PT_LINESTRIP_ADJ" value="0xb"/>
+	<value name="DI_PT_TRI_ADJ" value="0xc"/>
+	<value name="DI_PT_TRISTRIP_ADJ" value="0xd"/>
+
+	<value name="DI_PT_PATCHES0" value="0x1f"/>
+	<value name="DI_PT_PATCHES1" value="0x20"/>
+	<value name="DI_PT_PATCHES2" value="0x21"/>
+	<value name="DI_PT_PATCHES3" value="0x22"/>
+	<value name="DI_PT_PATCHES4" value="0x23"/>
+	<value name="DI_PT_PATCHES5" value="0x24"/>
+	<value name="DI_PT_PATCHES6" value="0x25"/>
+	<value name="DI_PT_PATCHES7" value="0x26"/>
+	<value name="DI_PT_PATCHES8" value="0x27"/>
+	<value name="DI_PT_PATCHES9" value="0x28"/>
+	<value name="DI_PT_PATCHES10" value="0x29"/>
+	<value name="DI_PT_PATCHES11" value="0x2a"/>
+	<value name="DI_PT_PATCHES12" value="0x2b"/>
+	<value name="DI_PT_PATCHES13" value="0x2c"/>
+	<value name="DI_PT_PATCHES14" value="0x2d"/>
+	<value name="DI_PT_PATCHES15" value="0x2e"/>
+	<value name="DI_PT_PATCHES16" value="0x2f"/>
+	<value name="DI_PT_PATCHES17" value="0x30"/>
+	<value name="DI_PT_PATCHES18" value="0x31"/>
+	<value name="DI_PT_PATCHES19" value="0x32"/>
+	<value name="DI_PT_PATCHES20" value="0x33"/>
+	<value name="DI_PT_PATCHES21" value="0x34"/>
+	<value name="DI_PT_PATCHES22" value="0x35"/>
+	<value name="DI_PT_PATCHES23" value="0x36"/>
+	<value name="DI_PT_PATCHES24" value="0x37"/>
+	<value name="DI_PT_PATCHES25" value="0x38"/>
+	<value name="DI_PT_PATCHES26" value="0x39"/>
+	<value name="DI_PT_PATCHES27" value="0x3a"/>
+	<value name="DI_PT_PATCHES28" value="0x3b"/>
+	<value name="DI_PT_PATCHES29" value="0x3c"/>
+	<value name="DI_PT_PATCHES30" value="0x3d"/>
+	<value name="DI_PT_PATCHES31" value="0x3e"/>
+</enum>
+
+<enum name="pc_di_src_sel">
+	<value name="DI_SRC_SEL_DMA" value="0"/>
+	<value name="DI_SRC_SEL_IMMEDIATE" value="1"/>
+	<value name="DI_SRC_SEL_AUTO_INDEX" value="2"/>
+	<value name="DI_SRC_SEL_AUTO_XFB" value="3"/>
+</enum>
+
+<enum name="pc_di_face_cull_sel">
+	<value name="DI_FACE_CULL_NONE" value="0"/>
+	<value name="DI_FACE_CULL_FETCH" value="1"/>
+	<value name="DI_FACE_BACKFACE_CULL" value="2"/>
+	<value name="DI_FACE_FRONTFACE_CULL" value="3"/>
+</enum>
+
+<enum name="pc_di_index_size">
+	<value name="INDEX_SIZE_IGN" value="0"/>
+	<value name="INDEX_SIZE_16_BIT" value="0"/>
+	<value name="INDEX_SIZE_32_BIT" value="1"/>
+	<value name="INDEX_SIZE_8_BIT" value="2"/>
+	<value name="INDEX_SIZE_INVALID"/>
+</enum>
+
+<enum name="pc_di_vis_cull_mode">
+	<value name="IGNORE_VISIBILITY" value="0"/>
+	<value name="USE_VISIBILITY" value="1"/>
+</enum>
+
+<enum name="adreno_pm4_packet_type">
+	<value name="CP_TYPE0_PKT" value="0x00000000"/>
+	<value name="CP_TYPE1_PKT" value="0x40000000"/>
+	<value name="CP_TYPE2_PKT" value="0x80000000"/>
+	<value name="CP_TYPE3_PKT" value="0xc0000000"/>
+	<value name="CP_TYPE4_PKT" value="0x40000000"/>
+	<value name="CP_TYPE7_PKT" value="0x70000000"/>
+</enum>
+
+<!--
+   Note that in some cases, the same packet id is recycled on a later
+   generation, so variants attribute is used to distinguish.   They
+   may not be completely accurate, we would probably have to analyze
+   the pfp and me/pm4 firmware to verify the packet is actually
+   handled on a particular generation.  But it is at least enough to
+   disambiguate the packet-id's that were re-used for different
+   packets starting with a5xx.
+ -->
+<enum name="adreno_pm4_type3_packets" varset="chip">
+	<doc>initialize CP's micro-engine</doc>
+	<value name="CP_ME_INIT" value="0x48"/>
+	<doc>skip N 32-bit words to get to the next packet</doc>
+	<value name="CP_NOP" value="0x10"/>
+	<doc>
+		indirect buffer dispatch.  prefetch parser uses this packet
+		type to determine whether to pre-fetch the IB
+	</doc>
+	<value name="CP_PREEMPT_ENABLE" value="0x1c" variants="A5XX"/>
+	<value name="CP_PREEMPT_TOKEN" value="0x1e" variants="A5XX"/>
+	<value name="CP_INDIRECT_BUFFER" value="0x3f"/>
+	<doc>
+		Takes the same arguments as CP_INDIRECT_BUFFER, but jumps to
+		another buffer at the same level. Must be at the end of IB, and
+		doesn't work with draw state IB's.
+	</doc>
+	<value name="CP_INDIRECT_BUFFER_CHAIN" value="0x57" variants="A5XX-"/>
+	<doc>indirect buffer dispatch.  same as IB, but init is pipelined</doc>
+	<value name="CP_INDIRECT_BUFFER_PFD" value="0x37"/>
+	<doc>
+		Waits for the IDLE state of the engine before further drawing.
+		This is pipelined, so the CP may continue.
+	</doc>
+	<value name="CP_WAIT_FOR_IDLE" value="0x26"/>
+	<doc>wait until a register or memory location is a specific value</doc>
+	<value name="CP_WAIT_REG_MEM" value="0x3c"/>
+	<doc>wait until a register location is equal to a specific value</doc>
+	<value name="CP_WAIT_REG_EQ" value="0x52"/>
+	<doc>wait until a register location is >= a specific value</doc>
+	<value name="CP_WAIT_REG_GTE" value="0x53" variants="A2XX-A4XX"/>
+	<doc>wait until a read completes</doc>
+	<value name="CP_WAIT_UNTIL_READ" value="0x5c" variants="A2XX-A4XX"/>
+	<doc>wait until all base/size writes from an IB_PFD packet have completed</doc>
+	<!--
+		NOTE: CP_WAIT_IB_PFD_COMPLETE unimplemented at least since a5xx fw, and
+		recycled for something new on a7xx
+	 -->
+	<value name="CP_WAIT_IB_PFD_COMPLETE" value="0x5d" varset="chip" variants="A2XX-A4XX"/>
+	<doc>register read/modify/write</doc>
+	<value name="CP_REG_RMW" value="0x21"/>
+	<doc>Set binning configuration registers</doc>
+	<value name="CP_SET_BIN_DATA" value="0x2f" variants="A2XX-A4XX"/>
+	<value name="CP_SET_BIN_DATA5" value="0x2f" variants="A5XX-"/>
+	<doc>reads register in chip and writes to memory</doc>
+	<value name="CP_REG_TO_MEM" value="0x3e"/>
+	<doc>write N 32-bit words to memory</doc>
+	<value name="CP_MEM_WRITE" value="0x3d"/>
+	<doc>write CP_PROG_COUNTER value to memory</doc>
+	<value name="CP_MEM_WRITE_CNTR" value="0x4f"/>
+	<doc>conditional execution of a sequence of packets</doc>
+	<value name="CP_COND_EXEC" value="0x44"/>
+	<doc>conditional write to memory or register</doc>
+	<value name="CP_COND_WRITE" value="0x45" variants="A2XX-A4XX"/>
+	<value name="CP_COND_WRITE5" value="0x45" variants="A5XX-"/>
+	<doc>generate an event that creates a write to memory when completed</doc>
+	<value name="CP_EVENT_WRITE" value="0x46" variants="A2XX-A6XX"/>
+	<value name="CP_EVENT_WRITE7" value="0x46" variants="A7XX-"/>
+	<doc>generate a VS|PS_done event</doc>
+	<value name="CP_EVENT_WRITE_SHD" value="0x58"/>
+	<doc>generate a cache flush done event</doc>
+	<value name="CP_EVENT_WRITE_CFL" value="0x59"/>
+	<doc>generate a z_pass done event</doc>
+	<value name="CP_EVENT_WRITE_ZPD" value="0x5b"/>
+	<doc>
+		not sure the real name, but this seems to be what is used for
+		opencl, instead of CP_DRAW_INDX..
+	</doc>
+	<value name="CP_RUN_OPENCL" value="0x31"/>
+	<doc>initiate fetch of index buffer and draw</doc>
+	<value name="CP_DRAW_INDX" value="0x22"/>
+	<doc>draw using supplied indices in packet</doc>
+	<value name="CP_DRAW_INDX_2" value="0x36" variants="A2XX-A4XX"/>  <!-- this is something different on a6xx and unused on a5xx -->
+	<doc>initiate fetch of index buffer and binIDs and draw</doc>
+	<value name="CP_DRAW_INDX_BIN" value="0x34" variants="A2XX-A4XX"/>
+	<doc>initiate fetch of bin IDs and draw using supplied indices</doc>
+	<value name="CP_DRAW_INDX_2_BIN" value="0x35" variants="A2XX-A4XX"/>
+	<doc>begin/end initiator for viz query extent processing</doc>
+	<value name="CP_VIZ_QUERY" value="0x23" variants="A2XX-A4XX"/>
+	<doc>fetch state sub-blocks and initiate shader code DMAs</doc>
+	<value name="CP_SET_STATE" value="0x25"/>
+	<doc>load constant into chip and to memory</doc>
+	<value name="CP_SET_CONSTANT" value="0x2d" variants="A2XX"/>
+	<doc>load sequencer instruction memory (pointer-based)</doc>
+	<value name="CP_IM_LOAD" value="0x27"/>
+	<doc>load sequencer instruction memory (code embedded in packet)</doc>
+	<value name="CP_IM_LOAD_IMMEDIATE" value="0x2b"/>
+	<doc>load constants from a location in memory</doc>
+	<value name="CP_LOAD_CONSTANT_CONTEXT" value="0x2e" variants="A2XX"/>
+	<doc>selective invalidation of state pointers</doc>
+	<value name="CP_INVALIDATE_STATE" value="0x3b"/>
+	<doc>dynamically changes shader instruction memory partition</doc>
+	<value name="CP_SET_SHADER_BASES" value="0x4a" variants="A2XX-A4XX"/>
+	<doc>sets the 64-bit BIN_MASK register in the PFP</doc>
+	<value name="CP_SET_BIN_MASK" value="0x50" variants="A2XX-A4XX"/>
+	<doc>sets the 64-bit BIN_SELECT register in the PFP</doc>
+	<value name="CP_SET_BIN_SELECT" value="0x51" variants="A2XX-A4XX"/>
+	<doc>updates the current context, if needed</doc>
+	<value name="CP_CONTEXT_UPDATE" value="0x5e"/>
+	<doc>generate interrupt from the command stream</doc>
+	<value name="CP_INTERRUPT" value="0x40"/>
+	<doc>copy sequencer instruction memory to system memory</doc>
+	<value name="CP_IM_STORE" value="0x2c" variants="A2XX"/>
+
+	<!-- For a20x -->
+<!-- TODO handle variants..
+	<doc>
+		Program an offset that will added to the BIN_BASE value of
+		the 3D_DRAW_INDX_BIN packet
+	</doc>
+	<value name="CP_SET_BIN_BASE_OFFSET" value="0x4b"/>
+ -->
+
+	<!-- for a22x -->
+	<doc>
+		sets draw initiator flags register in PFP, gets bitwise-ORed into
+		every draw initiator
+	</doc>
+	<value name="CP_SET_DRAW_INIT_FLAGS" value="0x4b"/>
+	<doc>sets the register protection mode</doc>
+	<value name="CP_SET_PROTECTED_MODE" value="0x5f"/>
+
+	<value name="CP_BOOTSTRAP_UCODE" value="0x6f"/>
+
+	<!-- for a3xx -->
+	<doc>load high level sequencer command</doc>
+	<value name="CP_LOAD_STATE" value="0x30" variants="A3XX"/>
+	<value name="CP_LOAD_STATE4" value="0x30" variants="A4XX-A5XX"/>
+	<doc>Conditionally load a IB based on a flag, prefetch enabled</doc>
+	<value name="CP_COND_INDIRECT_BUFFER_PFE" value="0x3a"/>
+	<doc>Conditionally load a IB based on a flag, prefetch disabled</doc>
+	<value name="CP_COND_INDIRECT_BUFFER_PFD" value="0x32" variants="A3XX"/>
+	<doc>Load a buffer with pre-fetch enabled</doc>
+	<value name="CP_INDIRECT_BUFFER_PFE" value="0x3f" variants="A5XX"/>
+	<doc>Set bin (?)</doc>
+	<value name="CP_SET_BIN" value="0x4c" variants="A2XX"/>
+
+	<doc>test 2 memory locations to dword values specified</doc>
+	<value name="CP_TEST_TWO_MEMS" value="0x71"/>
+
+	<doc>Write register, ignoring context state for context sensitive registers</doc>
+	<value name="CP_REG_WR_NO_CTXT" value="0x78"/>
+
+	<doc>Record the real-time when this packet is processed by PFP</doc>
+	<value name="CP_RECORD_PFP_TIMESTAMP" value="0x11"/>
+
+	<!-- Used to switch GPU between secure and non-secure modes -->
+	<value name="CP_SET_SECURE_MODE" value="0x66"/>
+
+	<doc>PFP waits until the FIFO between the PFP and the ME is empty</doc>
+	<value name="CP_WAIT_FOR_ME" value="0x13"/>
+
+	<!-- for a4xx -->
+	<doc>
+		Used a bit like CP_SET_CONSTANT on a2xx, but can write multiple
+		groups of registers.  Looks like it can be used to create state
+		objects in GPU memory, and on state change only emit pointer
+		(via CP_SET_DRAW_STATE), which should be nice for reducing CPU
+		overhead:
+
+		(A4x) save PM4 stream pointers to execute upon a visible draw
+	</doc>
+	<value name="CP_SET_DRAW_STATE" value="0x43" variants="A4XX-"/>
+	<value name="CP_DRAW_INDX_OFFSET" value="0x38"/>
+	<value name="CP_DRAW_INDIRECT" value="0x28" variants="A4XX-"/>
+	<value name="CP_DRAW_INDX_INDIRECT" value="0x29" variants="A4XX-"/>
+	<value name="CP_DRAW_INDIRECT_MULTI" value="0x2a" variants="A6XX-"/>
+	<value name="CP_DRAW_AUTO" value="0x24"/>
+
+	<doc>
+		Enable or disable predication globally. Also resets the
+		predicate to "passing" and the local bit to enabled when
+		enabling global predication.
+	</doc>
+	<value name="CP_DRAW_PRED_ENABLE_GLOBAL" value="0x19"/>
+
+	<doc>
+		Enable or disable predication locally. Unlike globally enabling
+		predication, this packet doesn't touch any other state.
+		Predication only happens when enabled globally and locally and a
+		predicate has been set. This should be used for internal draws
+		which aren't supposed to use the predication state:
+
+		CP_DRAW_PRED_ENABLE_LOCAL(0)
+		... do draw...
+		CP_DRAW_PRED_ENABLE_LOCAL(1)
+	</doc>
+	<value name="CP_DRAW_PRED_ENABLE_LOCAL" value="0x1a"/>
+
+	<doc>
+		Latch a draw predicate into the internal register.
+	</doc>
+	<value name="CP_DRAW_PRED_SET" value="0x4e"/>
+
+	<doc>
+		for A4xx
+		Write to register with address that does not fit into type-0 pkt
+	</doc>
+	<value name="CP_WIDE_REG_WRITE" value="0x74" variants="A4XX"/>
+
+	<doc>copy from ME scratch RAM to a register</doc>
+	<value name="CP_SCRATCH_TO_REG" value="0x4d"/>
+
+	<doc>Copy from REG to ME scratch RAM</doc>
+	<value name="CP_REG_TO_SCRATCH" value="0x4a"/>
+
+	<doc>Wait for memory writes to complete</doc>
+	<value name="CP_WAIT_MEM_WRITES" value="0x12"/>
+
+	<doc>Conditional execution based on register comparison</doc>
+	<value name="CP_COND_REG_EXEC" value="0x47"/>
+
+	<doc>Memory to REG copy</doc>
+	<value name="CP_MEM_TO_REG" value="0x42"/>
+
+	<value name="CP_EXEC_CS_INDIRECT" value="0x41" variants="A4XX-"/>
+	<value name="CP_EXEC_CS" value="0x33"/>
+
+	<doc>
+		for a5xx
+	</doc>
+	<value name="CP_PERFCOUNTER_ACTION" value="0x50" variants="A5XX"/>
+	<!-- switches SMMU pagetable, used on a5xx+ only -->
+	<value name="CP_SMMU_TABLE_UPDATE" value="0x53" variants="A5XX-"/>
+	<!-- for a6xx -->
+	<doc>Tells CP the current mode of GPU operation</doc>
+	<value name="CP_SET_MARKER" value="0x65" variants="A6XX-"/>
+	<doc>Instruct CP to set a few internal CP registers</doc>
+	<value name="CP_SET_PSEUDO_REG" value="0x56" variants="A6XX-"/>
+	<!--
+	pairs of regid and value.. seems to be used to program some TF
+	related regs:
+	 -->
+	<value name="CP_CONTEXT_REG_BUNCH" value="0x5c" variants="A5XX-"/>
+	<!-- A5XX Enable yield in RB only -->
+	<value name="CP_YIELD_ENABLE" value="0x1c" variants="A5XX"/>
+	<doc>
+		Enables IB2 skipping.  If both GLOBAL and LOCAL are 1 and
+		nothing is left in the visibility stream, then
+		CP_INDIRECT_BUFFER will be skipped, and draws will early return
+		from their IB.
+	</doc>
+	<value name="CP_SKIP_IB2_ENABLE_GLOBAL" value="0x1d" variants="A5XX-"/>
+	<value name="CP_SKIP_IB2_ENABLE_LOCAL" value="0x23" variants="A5XX-"/>
+	<value name="CP_SET_SUBDRAW_SIZE" value="0x35" variants="A5XX-"/>
+	<value name="CP_WHERE_AM_I" value="0x62" variants="A5XX-"/>
+	<value name="CP_SET_VISIBILITY_OVERRIDE" value="0x64" variants="A5XX-"/>
+	<!-- Enable/Disable/Defer A5x global preemption model -->
+	<value name="CP_PREEMPT_ENABLE_GLOBAL" value="0x69" variants="A5XX"/>
+	<!-- Enable/Disable A5x local preemption model -->
+	<value name="CP_PREEMPT_ENABLE_LOCAL" value="0x6a" variants="A5XX"/>
+	<!-- Yield token on a5xx similar to CP_PREEMPT on a4xx -->
+	<value name="CP_CONTEXT_SWITCH_YIELD" value="0x6b" variants="A5XX-"/>
+	<!-- Inform CP about current render mode (needed for a5xx preemption) -->
+	<value name="CP_SET_RENDER_MODE" value="0x6c" variants="A5XX"/>
+	<value name="CP_COMPUTE_CHECKPOINT" value="0x6e" variants="A5XX"/>
+	<!-- check if this works on earlier.. -->
+	<value name="CP_MEM_TO_MEM" value="0x73" variants="A5XX-"/>
+
+	<doc>
+		General purpose 2D blit engine for image transfers and mipmap
+		generation.  Reads through UCHE, writes through the CCU cache in
+		the PS stage.
+	</doc>
+	<value name="CP_BLIT" value="0x2c" variants="A5XX-"/>
+
+	<!-- Test specified bit in specified register and set predicate -->
+	<value name="CP_REG_TEST" value="0x39" variants="A5XX-"/>
+
+	<!--
+	Seems to set the mode flags which control which CP_SET_DRAW_STATE
+	packets are executed, based on their ENABLE_MASK values
+	
+	CP_SET_MODE w/ payload of 0x1 seems to cause CP_SET_DRAW_STATE
+	packets w/ ENABLE_MASK & 0x6 to execute immediately
+	 -->
+	<value name="CP_SET_MODE" value="0x63" variants="A6XX-"/>
+
+	<!--
+	Seems like there are now separate blocks of state for VS vs FS/CS
+	(probably these amounts to geometry vs fragments so that geometry
+	stage of the pipeline for next draw can start while fragment stage
+	of current draw is still running.  The format of the payload of the
+	packets is the same, the only difference is the offsets of the regs
+	the firmware code that handles the packet writes.
+
+	Note that for CL, starting with a6xx, the preferred # of local
+	threads is no longer the same as the max, implying that the shader
+	core can now run warps from unrelated shaders (ie.
+	CL_KERNEL_PREFERRED_WORK_GROUP_SIZE_MULTIPLE vs
+	CL_KERNEL_WORK_GROUP_SIZE)
+	 -->
+	<value name="CP_LOAD_STATE6_GEOM" value="0x32" variants="A6XX-"/>
+	<value name="CP_LOAD_STATE6_FRAG" value="0x34" variants="A6XX-"/>
+	<!--
+	Note: For IBO state (Image/SSBOs) which have shared state across
+	shader stages, for 3d pipeline CP_LOAD_STATE6 is used.  But for
+	compute shaders, CP_LOAD_STATE6_FRAG is used.  Possibly they are
+	interchangable.
+	 -->
+	<value name="CP_LOAD_STATE6" value="0x36" variants="A6XX-"/>
+
+	<!-- internal packets: -->
+	<value name="IN_IB_PREFETCH_END" value="0x17" variants="A2XX"/>
+	<value name="IN_SUBBLK_PREFETCH" value="0x1f" variants="A2XX"/>
+	<value name="IN_INSTR_PREFETCH" value="0x20" variants="A2XX"/>
+	<value name="IN_INSTR_MATCH" value="0x47" variants="A2XX"/>
+	<value name="IN_CONST_PREFETCH" value="0x49" variants="A2XX"/>
+	<value name="IN_INCR_UPDT_STATE" value="0x55" variants="A2XX"/>
+	<value name="IN_INCR_UPDT_CONST" value="0x56" variants="A2XX"/>
+	<value name="IN_INCR_UPDT_INSTR" value="0x57" variants="A2XX"/>
+
+	<!-- internal jumptable entries on a6xx+, possibly a5xx: -->
+
+	<!-- jmptable entry used to handle type4 packet on a5xx+: -->
+	<value name="PKT4" value="0x04" variants="A5XX-"/>
+	<!-- called when ROQ is empty, "returns" from an IB or merged sequence of IBs -->
+	<value name="IN_IB_END" value="0x0a" variants="A6XX-"/>
+	<!-- handles IFPC save/restore -->
+	<value name="IN_GMU_INTERRUPT" value="0x0b" variants="A6XX-"/>
+	<!-- preemption/context-swtich routine -->
+	<value name="IN_PREEMPT" value="0x0f" variants="A6XX-"/>
+
+	<!-- TODO do these exist on A5xx? -->
+	<value name="CP_SCRATCH_WRITE" value="0x4c" variants="A6XX"/>
+	<value name="CP_REG_TO_MEM_OFFSET_MEM" value="0x74" variants="A6XX-"/>
+	<value name="CP_REG_TO_MEM_OFFSET_REG" value="0x72" variants="A6XX-"/>
+	<value name="CP_WAIT_MEM_GTE" value="0x14" variants="A6XX"/>
+	<value name="CP_WAIT_TWO_REGS" value="0x70" variants="A6XX"/>
+	<value name="CP_MEMCPY" value="0x75" variants="A6XX-"/>
+	<value name="CP_SET_BIN_DATA5_OFFSET" value="0x2e" variants="A6XX-"/>
+	<!-- A750+, set in place of CP_SET_BIN_DATA5_OFFSET but has different values -->
+	<value name="CP_SET_UNK_BIN_DATA" value="0x2d" variants="A7XX-"/>
+	<doc>
+                Write CP_CONTEXT_SWITCH_*_INFO from CP to the following dwords,
+                and forcibly switch to the indicated context.
+	</doc>
+	<value name="CP_CONTEXT_SWITCH" value="0x54" variants="A6XX"/>
+	<value name="CP_SET_AMBLE" value="0x55" variants="A6XX-"/>
+
+	<!--
+	Seems to always have the payload:
+	  00000002 00008801 00004010
+	or:
+	  00000002 00008801 00004090
+	or:
+	  00000002 00008801 00000010
+	  00000002 00008801 00010010
+	  00000002 00008801 00d64010
+	  ...
+	Note set for compute shaders..
+	Is 0x8801 a register offset?
+	This appears to be a special sort of register write packet
+	more or less, but the firmware has some special handling..
+	Seems like it intercepts/modifies certain register offsets,
+	but others are treated like a normal PKT4 reg write.  I
+	guess there are some registers that the fw controls certain
+	bits.
+	 -->
+	<value name="CP_REG_WRITE" value="0x6d" variants="A6XX"/>
+
+	<doc>
+		These first appear in a650_sqe.bin. They can in theory be used
+		to loop any sequence of IB1 commands, but in practice they are
+		used to loop over bins. There is a fixed-size per-iteration
+		prefix, used to set per-bin state, and then the following IB1
+		commands are executed until CP_END_BIN which are always the same
+		for each iteration and usually contain a list of
+		CP_INDIRECT_BUFFER calls to IB2 commands which setup state and
+		execute restore/draw/save commands. This replaces the previous
+		technique of just repeating the CP_INDIRECT_BUFFER calls and
+		"unrolling" the loop.
+	</doc>
+	<value name="CP_START_BIN" value="0x50" variants="A6XX-"/>
+	<value name="CP_END_BIN" value="0x51" variants="A6XX-"/>
+
+	<doc> Make next dword 1 to disable preemption, 0 to re-enable it. </doc>
+	<value name="CP_PREEMPT_DISABLE" value="0x6c" variants="A6XX"/>
+
+	<value name="CP_WAIT_TIMESTAMP" value="0x14" variants="A7XX-"/>
+	<value name="CP_GLOBAL_TIMESTAMP" value="0x15" variants="A7XX-"/>  <!-- payload 1 dword -->
+	<value name="CP_LOCAL_TIMESTAMP" value="0x16" variants="A7XX-"/>  <!-- payload 1 dword, follows 0x15 -->
+	<value name="CP_THREAD_CONTROL" value="0x17" variants="A7XX-"/>
+	<!-- payload 4 dwords, last two could be render target addr (one pkt per MRT), possibly used for GMEM save/restore?-->
+	<value name="CP_RESOURCE_LIST" value="0x18" variants="A7XX-"/>
+	<doc> Can clear BV/BR counters, or wait until one catches up to another </doc>
+	<value name="CP_BV_BR_COUNT_OPS" value="0x1b" variants="A7XX-"/>
+	<doc> Clears, adds to local, or adds to global timestamp </doc>
+	<value name="CP_MODIFY_TIMESTAMP" value="0x1c" variants="A7XX-"/>
+	<!-- similar to CP_CONTEXT_REG_BUNCH, but discards first two dwords?? -->
+	<value name="CP_CONTEXT_REG_BUNCH2" value="0x5d" variants="A7XX-"/>
+	<doc>
+		Write to a scratch memory that is read by CP_REG_TEST with
+		SOURCE_SCRATCH_MEM set. It's not the same scratch as scratch registers.
+		However it uses the same memory space.
+	</doc>
+	<value name="CP_MEM_TO_SCRATCH_MEM" value="0x49" variants="A7XX-"/>
+
+	<doc>
+		Executes an array of fixed-size command buffers where each
+		buffer is assumed to have one draw call, skipping buffers with
+		non-visible draw calls.
+	</doc>
+	<value name="CP_FIXED_STRIDE_DRAW_TABLE" value="0x7f" variants="A7XX-"/>
+
+	<doc>Reset various on-chip state used for synchronization</doc>
+	<value name="CP_RESET_CONTEXT_STATE" value="0x1f" variants="A7XX-"/>
+</enum>
+
+
+<domain name="CP_LOAD_STATE" width="32">
+	<doc>Load state, a3xx (and later?)</doc>
+	<enum name="adreno_state_block">
+		<value name="SB_VERT_TEX" value="0"/>
+		<value name="SB_VERT_MIPADDR" value="1"/>
+		<value name="SB_FRAG_TEX" value="2"/>
+		<value name="SB_FRAG_MIPADDR" value="3"/>
+		<value name="SB_VERT_SHADER" value="4"/>
+		<value name="SB_GEOM_SHADER" value="5"/>
+		<value name="SB_FRAG_SHADER" value="6"/>
+		<value name="SB_COMPUTE_SHADER" value="7"/>
+	</enum>
+	<enum name="adreno_state_type">
+		<value name="ST_SHADER" value="0"/>
+		<value name="ST_CONSTANTS" value="1"/>
+	</enum>
+	<enum name="adreno_state_src">
+		<value name="SS_DIRECT" value="0">
+			<doc>inline with the CP_LOAD_STATE packet</doc>
+		</value>
+		<value name="SS_INVALID_ALL_IC" value="2"/>
+		<value name="SS_INVALID_PART_IC" value="3"/>
+		<value name="SS_INDIRECT" value="4">
+			<doc>in buffer pointed to by EXT_SRC_ADDR</doc>
+		</value>
+		<value name="SS_INDIRECT_TCM" value="5"/>
+		<value name="SS_INDIRECT_STM" value="6"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="DST_OFF" low="0" high="15" type="uint"/>
+		<bitfield name="STATE_SRC" low="16" high="18" type="adreno_state_src"/>
+		<bitfield name="STATE_BLOCK" low="19" high="21" type="adreno_state_block"/>
+		<bitfield name="NUM_UNIT" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="STATE_TYPE" low="0" high="1" type="adreno_state_type"/>
+		<bitfield name="EXT_SRC_ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+</domain>
+
+<domain name="CP_LOAD_STATE4" width="32" varset="chip">
+	<doc>Load state, a4xx+</doc>
+	<enum name="a4xx_state_block">
+		<!--
+		unknown: 0x7 and 0xf <- seen in compute shader
+
+		STATE_BLOCK = 0x6, STATE_TYPE = 0x2 possibly used for preemption?
+		Seen in some GL shaders.  Payload is NUM_UNIT dwords, and it contains
+		the gpuaddr of the following shader constants block.  DST_OFF seems
+		to specify which shader stage:
+
+		    16 -> vert
+		    36 -> tcs
+		    56 -> tes
+		    76 -> geom
+		    96 -> frag
+
+		Example:
+
+opcode: CP_LOAD_STATE4 (30) (12 dwords)
+        { DST_OFF = 16 | STATE_SRC = SS4_DIRECT | STATE_BLOCK = 0x6 | NUM_UNIT = 4 }
+        { STATE_TYPE = 0x2 | EXT_SRC_ADDR = 0 }
+        { EXT_SRC_ADDR_HI = 0 }
+                        0000: c0264100 00000000 00000000 00000000
+                0000: 70b0000b 01180010 00000002 00000000 c0264100 00000000 00000000 00000000
+
+opcode: CP_LOAD_STATE4 (30) (4 dwords)
+        { DST_OFF = 16 | STATE_SRC = SS4_INDIRECT | STATE_BLOCK = SB4_VS_SHADER | NUM_UNIT = 4 }
+        { STATE_TYPE = ST4_CONSTANTS | EXT_SRC_ADDR = 0xc0264100 }
+        { EXT_SRC_ADDR_HI = 0 }
+                        0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000
+                        0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000
+                        0000: 00000040 0000000c 00000000 00000000 00000000 00000000 00000000 00000000
+
+		STATE_BLOCK = 0x6, STATE_TYPE = 0x1, seen in compute shader.  NUM_UNITS * 2 dwords.
+
+		 -->
+		<value name="SB4_VS_TEX"    value="0x0"/>
+		<value name="SB4_HS_TEX"    value="0x1"/>    <!-- aka. TCS -->
+		<value name="SB4_DS_TEX"    value="0x2"/>    <!-- aka. TES -->
+		<value name="SB4_GS_TEX"    value="0x3"/>
+		<value name="SB4_FS_TEX"    value="0x4"/>
+		<value name="SB4_CS_TEX"    value="0x5"/>
+		<value name="SB4_VS_SHADER" value="0x8"/>
+		<value name="SB4_HS_SHADER" value="0x9"/>
+		<value name="SB4_DS_SHADER" value="0xa"/>
+		<value name="SB4_GS_SHADER" value="0xb"/>
+		<value name="SB4_FS_SHADER" value="0xc"/>
+		<value name="SB4_CS_SHADER" value="0xd"/>
+		<!--
+		for SSBO, STATE_TYPE=0 appears to be addresses (four dwords each),
+		STATE_TYPE=1 sizes, STATE_TYPE=2 addresses again (two dwords each)
+
+		Compute has it's own dedicated SSBO state, it seems, but the rest
+		of the stages share state
+		 -->
+		<value name="SB4_SSBO"   value="0xe"/>
+		<value name="SB4_CS_SSBO"   value="0xf"/>
+	</enum>
+	<enum name="a4xx_state_type">
+		<value name="ST4_SHADER" value="0"/>
+		<value name="ST4_CONSTANTS" value="1"/>
+		<value name="ST4_UBO" value="2"/>
+	</enum>
+	<enum name="a4xx_state_src">
+		<value name="SS4_DIRECT" value="0"/>
+		<value name="SS4_INDIRECT" value="2"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="DST_OFF" low="0" high="13" type="uint"/>
+		<bitfield name="STATE_SRC" low="16" high="17" type="a4xx_state_src"/>
+		<bitfield name="STATE_BLOCK" low="18" high="21" type="a4xx_state_block"/>
+		<bitfield name="NUM_UNIT" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="STATE_TYPE" low="0" high="1" type="a4xx_state_type"/>
+		<bitfield name="EXT_SRC_ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="EXT_SRC_ADDR_HI" low="0" high="31" shr="0"/>
+	</reg32>
+</domain>
+
+<!-- looks basically same CP_LOAD_STATE4 -->
+<domain name="CP_LOAD_STATE6" width="32" varset="chip">
+	<doc>Load state, a6xx+</doc>
+	<enum name="a6xx_state_block">
+		<value name="SB6_VS_TEX"    value="0x0"/>
+		<value name="SB6_HS_TEX"    value="0x1"/>    <!-- aka. TCS -->
+		<value name="SB6_DS_TEX"    value="0x2"/>    <!-- aka. TES -->
+		<value name="SB6_GS_TEX"    value="0x3"/>
+		<value name="SB6_FS_TEX"    value="0x4"/>
+		<value name="SB6_CS_TEX"    value="0x5"/>
+		<value name="SB6_VS_SHADER" value="0x8"/>
+		<value name="SB6_HS_SHADER" value="0x9"/>
+		<value name="SB6_DS_SHADER" value="0xa"/>
+		<value name="SB6_GS_SHADER" value="0xb"/>
+		<value name="SB6_FS_SHADER" value="0xc"/>
+		<value name="SB6_CS_SHADER" value="0xd"/>
+		<value name="SB6_IBO"       value="0xe"/>
+		<value name="SB6_CS_IBO"    value="0xf"/>
+	</enum>
+	<enum name="a6xx_state_type">
+		<value name="ST6_SHADER" value="0"/>
+		<value name="ST6_CONSTANTS" value="1"/>
+		<value name="ST6_UBO" value="2"/>
+		<value name="ST6_IBO" value="3"/>
+	</enum>
+	<enum name="a6xx_state_src">
+		<value name="SS6_DIRECT" value="0"/>
+		<value name="SS6_BINDLESS" value="1"/> <!-- TODO does this exist on a4xx/a5xx? -->
+		<value name="SS6_INDIRECT" value="2"/>
+		<doc>
+		SS6_UBO used by the a6xx vulkan blob with tesselation constants
+		in this case, EXT_SRC_ADDR is (ubo_id shl 16 | offset)
+		to load constants from a UBO loaded with DST_OFF = 14 and offset 0,
+		EXT_SRC_ADDR = 0xe0000
+		(offset is a guess, should be in bytes given that maxUniformBufferRange=64k)
+		</doc>
+		<value name="SS6_UBO" value="3"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="DST_OFF" low="0" high="13" type="uint"/>
+		<bitfield name="STATE_TYPE" low="14" high="15" type="a6xx_state_type"/>
+		<bitfield name="STATE_SRC" low="16" high="17" type="a6xx_state_src"/>
+		<bitfield name="STATE_BLOCK" low="18" high="21" type="a6xx_state_block"/>
+		<bitfield name="NUM_UNIT" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="EXT_SRC_ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="EXT_SRC_ADDR_HI" low="0" high="31" shr="0"/>
+	</reg32>
+	<reg64 offset="1" name="EXT_SRC_ADDR" type="address"/>
+</domain>
+
+<bitset name="vgt_draw_initiator" inline="yes">
+	<bitfield name="PRIM_TYPE" low="0" high="5" type="pc_di_primtype"/>
+	<bitfield name="SOURCE_SELECT" low="6" high="7" type="pc_di_src_sel"/>
+	<bitfield name="VIS_CULL" low="9" high="10" type="pc_di_vis_cull_mode"/>
+	<bitfield name="INDEX_SIZE" pos="11" type="pc_di_index_size"/>
+	<bitfield name="NOT_EOP" pos="12" type="boolean"/>
+	<bitfield name="SMALL_INDEX" pos="13" type="boolean"/>
+	<bitfield name="PRE_DRAW_INITIATOR_ENABLE" pos="14" type="boolean"/>
+	<bitfield name="NUM_INSTANCES" low="24" high="31" type="uint"/>
+</bitset>
+
+<!-- changed on a4xx: -->
+<enum name="a4xx_index_size">
+	<value name="INDEX4_SIZE_8_BIT" value="0"/>
+	<value name="INDEX4_SIZE_16_BIT" value="1"/>
+	<value name="INDEX4_SIZE_32_BIT" value="2"/>
+</enum>
+
+<enum name="a6xx_patch_type">
+  <value name="TESS_QUADS" value="0"/>
+  <value name="TESS_TRIANGLES" value="1"/>
+  <value name="TESS_ISOLINES" value="2"/>
+</enum>
+
+<bitset name="vgt_draw_initiator_a4xx" inline="yes">
+	<!-- When the 0x20 bit is set, it's the number of patch vertices - 1 -->
+	<bitfield name="PRIM_TYPE" low="0" high="5" type="pc_di_primtype"/>
+	<bitfield name="SOURCE_SELECT" low="6" high="7" type="pc_di_src_sel"/>
+	<bitfield name="VIS_CULL" low="8" high="9" type="pc_di_vis_cull_mode"/>
+	<bitfield name="INDEX_SIZE" low="10" high="11" type="a4xx_index_size"/>
+	<bitfield name="PATCH_TYPE" low="12" high="13" type="a6xx_patch_type"/>
+	<bitfield name="GS_ENABLE" pos="16" type="boolean"/>
+	<bitfield name="TESS_ENABLE" pos="17" type="boolean"/>
+</bitset>
+
+<domain name="CP_DRAW_INDX" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="VIZ_QUERY" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1" type="vgt_draw_initiator"/>
+	<reg32 offset="2" name="2">
+		<bitfield name="NUM_INDICES" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="INDX_BASE" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="INDX_SIZE" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_INDX_2" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="VIZ_QUERY" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1" type="vgt_draw_initiator"/>
+	<reg32 offset="2" name="2">
+		<bitfield name="NUM_INDICES" low="0" high="31" type="uint"/>
+	</reg32>
+	<!-- followed by NUM_INDICES indices.. -->
+</domain>
+
+<domain name="CP_DRAW_INDX_OFFSET" width="32">
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="NUM_INSTANCES" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="NUM_INDICES" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="FIRST_INDX" low="0" high="31"/>
+	</reg32>
+
+	<stripe varset="chip" variants="A5XX-">
+		<reg32 offset="4" name="4">
+			<bitfield name="INDX_BASE_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="5" name="5">
+			<bitfield name="INDX_BASE_HI" low="0" high="31"/>
+		</reg32>
+		<reg64 offset="4" name="INDX_BASE" type="address"/>
+		<reg32 offset="6" name="6">
+			<!-- max # of elements in index buffer -->
+			<bitfield name="MAX_INDICES" low="0" high="31"/>
+		</reg32>
+	</stripe>
+
+	<reg32 offset="4" name="4">
+		<bitfield name="INDX_BASE" low="0" high="31" type="address"/>
+	</reg32>
+
+	<reg32 offset="5" name="5">
+		<bitfield name="INDX_SIZE" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_INDIRECT" width="32" varset="chip" prefix="chip" variants="A4XX-">
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<stripe varset="chip" variants="A4XX">
+		<reg32 offset="1" name="1">
+			<bitfield name="INDIRECT" low="0" high="31"/>
+		</reg32>
+	</stripe>
+	<stripe varset="chip" variants="A5XX-">
+		<reg32 offset="1" name="1">
+			<bitfield name="INDIRECT_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="INDIRECT_HI" low="0" high="31"/>
+		</reg32>
+		<reg64 offset="1" name="INDIRECT" type="address"/>
+	</stripe>
+</domain>
+
+<domain name="CP_DRAW_INDX_INDIRECT" width="32" varset="chip" prefix="chip" variants="A4XX-">
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<stripe varset="chip" variants="A4XX">
+		<reg32 offset="1" name="1">
+			<bitfield name="INDX_BASE" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<!-- max # of bytes in index buffer -->
+			<bitfield name="INDX_SIZE" low="0" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="3" name="3">
+			<bitfield name="INDIRECT" low="0" high="31"/>
+		</reg32>
+	</stripe>
+	<stripe varset="chip" variants="A5XX-">
+		<reg32 offset="1" name="1">
+			<bitfield name="INDX_BASE_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="INDX_BASE_HI" low="0" high="31"/>
+		</reg32>
+		<reg64 offset="1" name="INDX_BASE" type="address"/>
+		<reg32 offset="3" name="3">
+			<!-- max # of elements in index buffer -->
+			<bitfield name="MAX_INDICES" low="0" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="4" name="4">
+			<bitfield name="INDIRECT_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="5" name="5">
+			<bitfield name="INDIRECT_HI" low="0" high="31"/>
+		</reg32>
+		<reg64 offset="4" name="INDIRECT" type="address"/>
+	</stripe>
+</domain>
+
+<domain name="CP_DRAW_INDIRECT_MULTI" width="32" varset="chip" prefix="chip" variants="A6XX-">
+	<enum name="a6xx_draw_indirect_opcode">
+		<value name="INDIRECT_OP_NORMAL"  value="0x2"/>
+		<value name="INDIRECT_OP_INDEXED" value="0x4"/>
+		<value name="INDIRECT_OP_INDIRECT_COUNT" value="0x6"/>
+		<value name="INDIRECT_OP_INDIRECT_COUNT_INDEXED" value="0x7"/>
+	</enum>
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="OPCODE" low="0" high="3" type="a6xx_draw_indirect_opcode" addvariant="yes"/>
+		<doc>
+		DST_OFF same as in CP_LOAD_STATE6 - vec4 VS const at this offset will
+		be updated for each draw to {draw_id, first_vertex, first_instance, 0}
+		value of 0 disables it
+		</doc>
+		<bitfield name="DST_OFF" low="8" high="21" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="DRAW_COUNT" type="uint"/>
+	<stripe varset="a6xx_draw_indirect_opcode" variants="INDIRECT_OP_NORMAL">
+		<reg64 offset="3" name="INDIRECT" type="address"/>
+		<reg32 offset="5" name="STRIDE" type="uint"/>
+	</stripe>
+	<stripe varset="a6xx_draw_indirect_opcode" variants="INDIRECT_OP_INDEXED" prefix="INDEXED">
+		<reg64 offset="3" name="INDEX" type="address"/>
+		<reg32 offset="5" name="MAX_INDICES" type="uint"/>
+		<reg64 offset="6" name="INDIRECT" type="address"/>
+		<reg32 offset="8" name="STRIDE" type="uint"/>
+	</stripe>
+	<stripe varset="a6xx_draw_indirect_opcode" variants="INDIRECT_OP_INDIRECT_COUNT" prefix="INDIRECT">
+		<reg64 offset="3" name="INDIRECT" type="address"/>
+		<reg64 offset="5" name="INDIRECT_COUNT" type="address"/>
+		<reg32 offset="7" name="STRIDE" type="uint"/>
+	</stripe>
+	<stripe varset="a6xx_draw_indirect_opcode" variants="INDIRECT_OP_INDIRECT_COUNT_INDEXED" prefix="INDIRECT_INDEXED">
+		<reg64 offset="3" name="INDEX" type="address"/>
+		<reg32 offset="5" name="MAX_INDICES" type="uint"/>
+		<reg64 offset="6" name="INDIRECT" type="address"/>
+		<reg64 offset="8" name="INDIRECT_COUNT" type="address"/>
+		<reg32 offset="10" name="STRIDE" type="uint"/>
+	</stripe>
+</domain>
+
+<domain name="CP_DRAW_AUTO" width="32">
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="NUM_INSTANCES" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg64 offset="2" name="NUM_VERTICES_BASE" type="address"/>
+	<reg32 offset="4" name="4">
+		<bitfield name="NUM_VERTICES_OFFSET" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="STRIDE" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_PRED_ENABLE_GLOBAL" width="32" varset="chip">
+	<reg32 offset="0" name="0">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_PRED_ENABLE_LOCAL" width="32" varset="chip">
+	<reg32 offset="0" name="0">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_PRED_SET" width="32" varset="chip">
+	<enum name="cp_draw_pred_src">
+		<!--
+			Sources 1-4 seem to be about combining reading
+			SO/primitive queries and setting the predicate, which is
+			a DX11-specific optimization (since in DX11 you can only
+			predicate on the result of queries).
+		-->
+		<value name="PRED_SRC_MEM" value="5">
+			<doc>
+				Read a 64-bit value at the given address and
+				test if it equals/doesn't equal 0.
+			</doc>
+		</value>
+	</enum>
+	<enum name="cp_draw_pred_test">
+		<value name="NE_0_PASS" value="0"/>
+		<value name="EQ_0_PASS" value="1"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="SRC" low="4" high="7" type="cp_draw_pred_src"/>
+		<bitfield name="TEST" pos="8" type="cp_draw_pred_test"/>
+	</reg32>
+	<reg64 offset="1" name="MEM_ADDR" type="address"/>
+</domain>
+
+<domain name="CP_SET_DRAW_STATE" width="32" varset="chip" variants="A4XX-">
+	<array offset="0" stride="3" length="100">
+		<reg32 offset="0" name="0">
+			<bitfield name="COUNT" low="0" high="15" type="uint"/>
+			<bitfield name="DIRTY" pos="16" type="boolean"/>
+			<bitfield name="DISABLE" pos="17" type="boolean"/>
+			<bitfield name="DISABLE_ALL_GROUPS" pos="18" type="boolean"/>
+			<bitfield name="LOAD_IMMED" pos="19" type="boolean"/>
+			<bitfield name="BINNING" pos="20" varset="chip" variants="A6XX-" type="boolean"/>
+			<bitfield name="GMEM" pos="21" varset="chip" variants="A6XX-" type="boolean"/>
+			<bitfield name="SYSMEM" pos="22" varset="chip" variants="A6XX-" type="boolean"/>
+			<bitfield name="GROUP_ID" low="24" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="1" name="1">
+			<bitfield name="ADDR_LO" low="0" high="31" type="hex"/>
+		</reg32>
+		<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+			<bitfield name="ADDR_HI" low="0" high="31" type="hex"/>
+		</reg32>
+	</array>
+</domain>
+
+<domain name="CP_SET_BIN" width="32">
+	<doc>value at offset 0 always seems to be 0x00000000..</doc>
+	<reg32 offset="0" name="0"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="X1" low="0" high="15" type="uint"/>
+		<bitfield name="Y1" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="X2" low="0" high="15" type="uint"/>
+		<bitfield name="Y2" low="16" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_BIN_DATA" width="32">
+	<reg32 offset="0" name="0">
+		<!-- corresponds to VSC_PIPE[n].DATA_ADDR -->
+		<bitfield name="BIN_DATA_ADDR" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<!-- seesm to correspond to VSC_SIZE_ADDRESS -->
+		<bitfield name="BIN_SIZE_ADDRESS" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_BIN_DATA5" width="32">
+	<reg32 offset="0" name="0">
+		<!-- equiv to PC_VSTREAM_CONTROL.SIZE on a3xx/a4xx: -->
+		<bitfield name="VSC_SIZE" low="16" high="21" type="uint"/>
+		<!-- equiv to PC_VSTREAM_CONTROL.N on a3xx/a4xx: -->
+		<bitfield name="VSC_N" low="22" high="26" type="uint"/>
+	</reg32>
+	<!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
+	<reg32 offset="1" name="1">
+		<bitfield name="BIN_DATA_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="BIN_DATA_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
+	<reg32 offset="3" name="3">
+		<bitfield name="BIN_SIZE_ADDRESS_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="BIN_SIZE_ADDRESS_HI" low="0" high="31"/>
+	</reg32>
+	<!-- new on a6xx, where BIN_DATA_ADDR is the DRAW_STRM: -->
+	<reg32 offset="5" name="5">
+		<bitfield name="BIN_PRIM_STRM_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<bitfield name="BIN_PRIM_STRM_HI" low="0" high="31"/>
+	</reg32>
+	<!--
+		a7xx adds a few more addresses to the end of the pkt
+	 -->
+	<reg64 offset="7" name="7"/>
+	<reg64 offset="9" name="9"/>
+</domain>
+
+<domain name="CP_SET_BIN_DATA5_OFFSET" width="32">
+	<doc>
+                Like CP_SET_BIN_DATA5, but set the pointers as offsets from the
+                pointers stored in VSC_PIPE_{DATA,DATA2,SIZE}_ADDRESS. Useful
+                for Vulkan where these values aren't known when the command
+                stream is recorded.
+	</doc>
+	<reg32 offset="0" name="0">
+		<!-- equiv to PC_VSTREAM_CONTROL.SIZE on a3xx/a4xx: -->
+		<bitfield name="VSC_SIZE" low="16" high="21" type="uint"/>
+		<!-- equiv to PC_VSTREAM_CONTROL.N on a3xx/a4xx: -->
+		<bitfield name="VSC_N" low="22" high="26" type="uint"/>
+	</reg32>
+	<!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
+	<reg32 offset="1" name="1">
+		<bitfield name="BIN_DATA_OFFSET" low="0" high="31" type="uint"/>
+	</reg32>
+	<!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
+	<reg32 offset="2" name="2">
+		<bitfield name="BIN_SIZE_OFFSET" low="0" high="31" type="uint"/>
+	</reg32>
+	<!-- BIN_DATA2_ADDR -> VSC_PIPE[p].DATA2_ADDRESS -->
+	<reg32 offset="3" name="3">
+		<bitfield name="BIN_DATA2_OFFSET" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_RMW" width="32">
+	<doc>
+                Modifies DST_REG using two sources that can either be registers
+                or immediates. If SRC1_ADD is set, then do the following:
+
+			$dst = (($dst &amp; $src0) rot $rotate) + $src1
+
+		Otherwise:
+
+			$dst = (($dst &amp; $src0) rot $rotate) | $src1
+
+		Here "rot" means rotate left.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="DST_REG" low="0" high="17" type="hex"/>
+		<bitfield name="ROTATE" low="24" high="28" type="uint"/>
+		<bitfield name="SRC1_ADD" pos="29" type="boolean"/>
+		<bitfield name="SRC1_IS_REG" pos="30" type="boolean"/>
+		<bitfield name="SRC0_IS_REG" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="SRC0" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="SRC1" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_TO_MEM" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- number of registers/dwords copied is max(CNT, 1). -->
+		<bitfield name="CNT" low="18" high="29" type="uint"/>
+		<bitfield name="64B" pos="30" type="boolean"/>
+		<bitfield name="ACCUMULATE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="DEST" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="DEST_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_TO_MEM_OFFSET_REG" width="32">
+	<doc>
+                Like CP_REG_TO_MEM, but the memory address to write to can be
+                offsetted using either one or two registers or scratch
+                registers.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- number of registers/dwords copied is max(CNT, 1). -->
+		<bitfield name="CNT" low="18" high="29" type="uint"/>
+		<bitfield name="64B" pos="30" type="boolean"/>
+		<bitfield name="ACCUMULATE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="DEST" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="DEST_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="OFFSET0" low="0" high="17" type="hex"/>
+		<bitfield name="OFFSET0_SCRATCH" pos="19" type="boolean"/>
+	</reg32>
+	<!-- followed by an optional identical OFFSET1 dword -->
+</domain>
+
+<domain name="CP_REG_TO_MEM_OFFSET_MEM" width="32">
+	<doc>
+                Like CP_REG_TO_MEM, but the memory address to write to can be
+                offsetted using a DWORD in memory.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- number of registers/dwords copied is max(CNT, 1). -->
+		<bitfield name="CNT" low="18" high="29" type="uint"/>
+		<bitfield name="64B" pos="30" type="boolean"/>
+		<bitfield name="ACCUMULATE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="DEST" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="DEST_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="OFFSET_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="OFFSET_HI" low="0" high="31" type="hex"/>
+	</reg32>
+</domain>
+
+<domain name="CP_MEM_TO_REG" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- number of registers/dwords copied is max(CNT, 1). -->
+		<bitfield name="CNT" low="19" high="29" type="uint"/>
+		<!-- shift each DWORD left by 2 while copying -->
+		<bitfield name="SHIFT_BY_2" pos="30" type="boolean"/>
+		<!-- does the same thing as CP_MEM_TO_MEM::UNK31 -->
+		<bitfield name="UNK31" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="SRC" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="SRC_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_MEM_TO_MEM" width="32">
+	<reg32 offset="0" name="0">
+		<!--
+		not sure how many src operands we have, but the low
+		bits negate the n'th src argument.
+		 -->
+		<bitfield name="NEG_A" pos="0" type="boolean"/>
+		<bitfield name="NEG_B" pos="1" type="boolean"/>
+		<bitfield name="NEG_C" pos="2" type="boolean"/>
+
+		<!-- if set treat src/dst as 64bit values -->
+		<bitfield name="DOUBLE" pos="29" type="boolean"/>
+		<!-- execute CP_WAIT_FOR_MEM_WRITES beforehand -->
+		<bitfield name="WAIT_FOR_MEM_WRITES" pos="30" type="boolean"/>
+		<!-- some other kind of wait -->
+		<bitfield name="UNK31" pos="31" type="boolean"/>
+	</reg32>
+	<!--
+	followed by sequence of addresses.. the first is the
+	destination and the rest are N src addresses which are
+	summed (after being negated if NEG_x bit set) allowing
+	to do things like 'result += end - start' (which turns
+	out to be useful for queries and accumulating results
+	across multiple tiles)
+	 -->
+</domain>
+
+<domain name="CP_MEMCPY" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="DWORDS" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="SRC_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="SRC_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="DST_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="DST_HI" low="0" high="31" type="hex"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_TO_SCRATCH" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<bitfield name="SCRATCH" low="20" high="22" type="uint"/>
+		<!-- number of registers/dwords copied is CNT + 1. -->
+		<bitfield name="CNT" low="24" high="26" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SCRATCH_TO_REG" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- note: CP_MEM_TO_REG always sets this when writing to the register -->
+		<bitfield name="UNK18" pos="18" type="boolean"/>
+		<bitfield name="SCRATCH" low="20" high="22" type="uint"/>
+		<!-- number of registers/dwords copied is CNT + 1. -->
+		<bitfield name="CNT" low="24" high="26" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SCRATCH_WRITE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="SCRATCH" low="20" high="22" type="uint"/>
+	</reg32>
+	<!-- followed by one or more DWORDs to write to scratch registers -->
+</domain>
+
+<domain name="CP_MEM_WRITE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="ADDR_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_HI" low="0" high="31"/>
+	</reg32>
+	<!-- followed by the DWORDs to write -->
+</domain>
+
+<enum name="cp_cond_function">
+	<value value="0" name="WRITE_ALWAYS"/>
+	<value value="1" name="WRITE_LT"/>
+	<value value="2" name="WRITE_LE"/>
+	<value value="3" name="WRITE_EQ"/>
+	<value value="4" name="WRITE_NE"/>
+	<value value="5" name="WRITE_GE"/>
+	<value value="6" name="WRITE_GT"/>
+</enum>
+
+<domain name="CP_COND_WRITE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="FUNCTION" low="0" high="2" type="cp_cond_function"/>
+		<bitfield name="POLL_MEMORY" pos="4" type="boolean"/>
+		<bitfield name="WRITE_MEMORY" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="POLL_ADDR" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="MASK" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="WRITE_ADDR" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="WRITE_DATA" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<enum name="poll_memory_type">
+	<value value="0" name="POLL_REGISTER"/>
+	<value value="1" name="POLL_MEMORY"/>
+	<value value="2" name="POLL_SCRATCH"/>
+	<value value="3" name="POLL_ON_CHIP" varset="chip" variants="A7XX-"/>
+</enum>
+
+<domain name="CP_COND_WRITE5" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="FUNCTION" low="0" high="2" type="cp_cond_function"/>
+		<bitfield name="SIGNED_COMPARE" pos="3" type="boolean"/>
+		<!-- POLL_REGISTER polls a register at POLL_ADDR_LO. -->
+		<bitfield name="POLL" low="4" high="5" type="poll_memory_type"/>
+		<bitfield name="WRITE_MEMORY" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="POLL_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="POLL_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="MASK" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="WRITE_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<bitfield name="WRITE_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="7" name="7">
+		<bitfield name="WRITE_DATA" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_WAIT_MEM_GTE" width="32">
+        <doc>
+                Wait until a memory value is greater than or equal to the
+                reference, using signed comparison.
+	</doc>
+	<reg32 offset="0" name="0">
+		<!-- Reserved for flags, presumably? Unused in FW -->
+		<bitfield name="RESERVED" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="POLL_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="POLL_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_WAIT_REG_MEM" width="32">
+        <doc>
+                This uses the same internal comparison as CP_COND_WRITE,
+                but waits until the comparison is true instead. It busy-loops in
+                the CP for the given number of cycles before trying again.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="FUNCTION" low="0" high="2" type="cp_cond_function"/>
+		<bitfield name="SIGNED_COMPARE" pos="3" type="boolean"/>
+		<bitfield name="POLL" low="4" high="5" type="poll_memory_type"/>
+		<bitfield name="WRITE_MEMORY" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="POLL_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="POLL_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="MASK" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="DELAY_LOOP_CYCLES" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_WAIT_TWO_REGS" width="32">
+	<doc>
+		Waits for REG0 to not be 0 or REG1 to not equal REF
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="REG0" low="0" high="17" type="hex"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="REG1" low="0" high="17" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="REF" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DISPATCH_COMPUTE" width="32">
+	<reg32 offset="0" name="0"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="X" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="Y" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="Z" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_RENDER_MODE" width="32">
+	<enum name="render_mode_cmd">
+		<value value="1" name="BYPASS"/>
+		<value value="2" name="BINNING"/>
+		<value value="3" name="GMEM"/>
+		<value value="5" name="BLIT2D"/>
+		<!-- placeholder name.. used when CP_BLIT packets with BLIT_OP_SCALE?? -->
+		<value value="7" name="BLIT2DSCALE"/>
+		<!-- 8 set before going back to BYPASS exiting 2D -->
+		<value value="8" name="END2D"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="MODE" low="0" high="8" type="render_mode_cmd"/>
+		<!--
+		normally 0x1/0x3, sometimes see 0x5/0x8 with unknown registers in
+		0x21xx range.. possibly (at least some) a5xx variants have a
+		2d core?
+		 -->
+	</reg32>
+	<!-- I think first buffer is for GPU to save context in case of ctx switch? -->
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ADDR_0_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!--
+		set when in GMEM.. maybe indicates GMEM contents need to be
+		preserved on ctx switch?
+		 -->
+		<bitfield name="VSC_ENABLE" pos="3" type="boolean"/>
+		<bitfield name="GMEM_ENABLE" pos="4" type="boolean"/>
+	</reg32>
+	<reg32 offset="4" name="4"/>
+	<!-- second buffer looks like some cmdstream.. length in dwords: -->
+	<reg32 offset="5" name="5">
+		<bitfield name="ADDR_1_LEN" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<bitfield name="ADDR_1_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="7" name="7">
+		<bitfield name="ADDR_1_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<!-- this looks fairly similar to CP_SET_RENDER_MODE minus first dword -->
+<domain name="CP_COMPUTE_CHECKPOINT" width="32">
+	<!-- I think first buffer is for GPU to save context in case of ctx switch? -->
+	<reg32 offset="0" name="0">
+		<bitfield name="ADDR_0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_0_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+	</reg32>
+	<reg32 offset="3" name="3"/>
+	<!-- second buffer looks like some cmdstream.. length in dwords: -->
+	<reg32 offset="4" name="4">
+		<bitfield name="ADDR_1_LEN" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="ADDR_1_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<bitfield name="ADDR_1_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="7" name="7"/>
+</domain>
+
+<domain name="CP_PERFCOUNTER_ACTION" width="32">
+	<reg32 offset="0" name="0">
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ADDR_0_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain varset="chip" name="CP_EVENT_WRITE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="EVENT" low="0" high="7" type="vgt_event_type"/>
+		<!-- when set, write back timestamp instead of value from packet: -->
+		<bitfield name="TIMESTAMP" pos="30" type="boolean"/>
+		<bitfield name="IRQ" pos="31" type="boolean"/>
+	</reg32>
+	<!--
+	TODO what is gpuaddr for, seems to be all 0's.. maybe needed for
+	context switch?
+	 -->
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ADDR_0_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!-- ??? -->
+	</reg32>
+</domain>
+
+<domain varset="chip" name="CP_EVENT_WRITE7" width="32">
+	<enum name="event_write_src">
+		<!-- Write payload[0] -->
+		<value value="0" name="EV_WRITE_USER_32B"/>
+		<!-- Write payload[0] payload[1] -->
+		<value value="1" name="EV_WRITE_USER_64B"/>
+		<!-- Write (TIMESTAMP_GLOBAL + TIMESTAMP_LOCAL) -->
+		<value value="2" name="EV_WRITE_TIMESTAMP_SUM"/>
+		<value value="3" name="EV_WRITE_ALWAYSON"/>
+		<!-- Write payload[1] regs starting at payload[0] offset -->
+		<value value="4" name="EV_WRITE_REGS_CONTENT"/>
+	</enum>
+
+	<enum name="event_write_dst">
+		<value value="0" name="EV_DST_RAM"/>
+		<value value="1" name="EV_DST_ONCHIP"/>
+	</enum>
+
+	<reg32 offset="0" name="0">
+		<bitfield name="EVENT" low="0" high="7" type="vgt_event_type"/>
+		<bitfield name="WRITE_SAMPLE_COUNT" pos="12" type="boolean"/>
+		<!-- Write sample count at (iova + 16) -->
+		<bitfield name="SAMPLE_COUNT_END_OFFSET" pos="13" type="boolean"/>
+		<!-- *(iova + 8) = *(iova + 16) - *iova -->
+		<bitfield name="WRITE_SAMPLE_COUNT_DIFF" pos="14" type="boolean"/>
+
+		<!-- Next 4 flags are valid to set only when concurrent binning is enabled -->
+		<!-- Increment 16b BV counter. Valid only in BV pipe -->
+		<bitfield name="INC_BV_COUNT" pos="16" type="boolean"/>
+		<!-- Increment 16b BR counter. Valid only in BR pipe -->
+		<bitfield name="INC_BR_COUNT" pos="17" type="boolean"/>
+		<bitfield name="CLEAR_RENDER_RESOURCE" pos="18" type="boolean"/>
+		<bitfield name="CLEAR_LRZ_RESOURCE" pos="19" type="boolean"/>
+
+		<bitfield name="WRITE_SRC" low="20" high="22" type="event_write_src"/>
+		<bitfield name="WRITE_DST" pos="24" type="event_write_dst" addvariant="yes"/>
+		<!-- Writes into WRITE_DST from WRITE_SRC. RB_DONE_TS requires WRITE_ENABLED. -->
+		<bitfield name="WRITE_ENABLED" pos="27" type="boolean"/>
+	</reg32>
+
+	<stripe varset="event_write_dst" variants="EV_DST_RAM">
+		<reg32 offset="1" name="1">
+			<bitfield name="ADDR_0_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="ADDR_0_HI" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="3" name="3">
+			<bitfield name="PAYLOAD_0" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="4" name="4">
+			<bitfield name="PAYLOAD_1" low="0" high="31"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="event_write_dst" variants="EV_DST_ONCHIP">
+		<reg32 offset="1" name="1">
+			<bitfield name="ONCHIP_ADDR_0" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="3" name="3">
+			<bitfield name="PAYLOAD_0" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="4" name="4">
+			<bitfield name="PAYLOAD_1" low="0" high="31"/>
+		</reg32>
+	</stripe>
+</domain>
+
+<domain name="CP_BLIT" width="32">
+	<enum name="cp_blit_cmd">
+		<value value="0" name="BLIT_OP_FILL"/>
+		<value value="1" name="BLIT_OP_COPY"/>
+		<value value="3" name="BLIT_OP_SCALE"/> <!-- used for mipmap generation -->
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="OP" low="0" high="3" type="cp_blit_cmd"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="SRC_X1" low="0" high="13" type="uint"/>
+		<bitfield name="SRC_Y1" low="16" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="SRC_X2" low="0" high="13" type="uint"/>
+		<bitfield name="SRC_Y2" low="16" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="DST_X1" low="0" high="13" type="uint"/>
+		<bitfield name="DST_Y1" low="16" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="DST_X2" low="0" high="13" type="uint"/>
+		<bitfield name="DST_Y2" low="16" high="29" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_EXEC_CS" width="32">
+	<reg32 offset="0" name="0">
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="NGROUPS_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="NGROUPS_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="NGROUPS_Z" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_EXEC_CS_INDIRECT" width="32" varset="chip" prefix="chip" variants="A4XX-">
+	<reg32 offset="0" name="0">
+	</reg32>
+	<stripe varset="chip" variants="A4XX">
+		<reg32 offset="1" name="1">
+			<bitfield name="ADDR" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<!-- localsize is value minus one: -->
+			<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+			<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+			<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+		</reg32>
+	</stripe>
+	<stripe varset="chip" variants="A5XX-">
+		<reg32 offset="1" name="1">
+			<bitfield name="ADDR_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="ADDR_HI" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="3" name="3">
+			<!-- localsize is value minus one: -->
+			<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+			<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+			<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+		</reg32>
+	</stripe>
+</domain>
+
+<domain name="CP_SET_MARKER" width="32" varset="chip" prefix="chip" variants="A6XX-">
+	<doc>Tell CP the current operation mode, indicates save and restore procedure</doc>
+	<enum name="a6xx_marker">
+		<value value="1" name="RM6_BYPASS"/>
+		<value value="2" name="RM6_BINNING"/>
+		<value value="4" name="RM6_GMEM"/>
+		<value value="5" name="RM6_ENDVIS"/>
+		<value value="6" name="RM6_RESOLVE"/>
+		<value value="7" name="RM6_YIELD"/>
+		<value value="8" name="RM6_COMPUTE"/>
+		<value value="0xc" name="RM6_BLIT2DSCALE"/>  <!-- no-op (at least on current sqe fw) -->
+
+		<!--
+			These values come from a6xx_set_marker() in the
+			downstream kernel, and they can only be set by the kernel
+		-->
+		<value value="0xd" name="RM6_IB1LIST_START"/>
+		<value value="0xe" name="RM6_IB1LIST_END"/>
+		<!-- IFPC - inter-frame power collapse -->
+		<value value="0x100" name="RM6_IFPC_ENABLE"/>
+		<value value="0x101" name="RM6_IFPC_DISABLE"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<!--
+			NOTE: blob driver and some versions of freedreno/turnip set
+			b4, which is unused (at least by current sqe fw), but interferes
+			with parsing if we extend the size of the bitfield to include
+			b8 (only sent by kernel mode driver).  Really, the way the
+			parsing works in the firmware, only b0-b3 are considered, but
+			if b8 is set, the low bits are interpreted differently.  To
+			model this, without getting confused by spurious b4, this is
+			described as two overlapping bitfields:
+		 -->
+		<bitfield name="MODE" low="0" high="8" type="a6xx_marker"/>
+		<bitfield name="MARKER" low="0" high="3" type="a6xx_marker"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_PSEUDO_REG" width="32" varset="chip" prefix="chip" variants="A6XX-">
+	<doc>Set internal CP registers, used to indicate context save data addresses</doc>
+	<enum name="pseudo_reg">
+		<value value="0" name="SMMU_INFO"/>
+		<value value="1" name="NON_SECURE_SAVE_ADDR"/>
+		<value value="2" name="SECURE_SAVE_ADDR"/>
+		<value value="3" name="NON_PRIV_SAVE_ADDR"/>
+		<value value="4" name="COUNTER"/>
+
+		<!--
+			On a6xx the registers are set directly and CP_SET_BIN_DATA5_OFFSET reads them,
+			but that doesn't work with concurrent binning because BR will be reading from
+			a different set of streams than BV is writing, so on a7xx we have these
+			pseudo-regs instead, which do the right thing.
+
+			The corresponding VSC registers exist, and they're written by BV when it
+			encounters CP_SET_PSEUDO_REG. When BR later encounters the same CP_SET_PSEUDO_REG
+			it will only write some private scratch registers which are read by
+			CP_SET_BIN_DATA5_OFFSET.
+
+			If concurrent binning is disabled then BR also does binning so it will also
+			write the "real" registers in BR.
+		-->
+		<value value="8" name="DRAW_STRM_ADDRESS"/>
+		<value value="9" name="DRAW_STRM_SIZE_ADDRESS"/>
+		<value value="10" name="PRIM_STRM_ADDRESS"/>
+		<value value="11" name="UNK_STRM_ADDRESS"/>
+		<value value="12" name="UNK_STRM_SIZE_ADDRESS"/>
+
+		<value value="16" name="BINDLESS_BASE_0_ADDR"/>
+		<value value="17" name="BINDLESS_BASE_1_ADDR"/>
+		<value value="18" name="BINDLESS_BASE_2_ADDR"/>
+		<value value="19" name="BINDLESS_BASE_3_ADDR"/>
+		<value value="20" name="BINDLESS_BASE_4_ADDR"/>
+		<value value="21" name="BINDLESS_BASE_5_ADDR"/>
+		<value value="22" name="BINDLESS_BASE_6_ADDR"/>
+	</enum>
+	<array offset="0" stride="3" length="100">
+		<reg32 offset="0" name="0">
+			<bitfield name="PSEUDO_REG" low="0" high="10" type="pseudo_reg"/>
+		</reg32>
+		<reg32 offset="1" name="1">
+			<bitfield name="LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="HI" low="0" high="31"/>
+		</reg32>
+	</array>
+</domain>
+
+<domain name="CP_REG_TEST" width="32" varset="chip" prefix="chip" variants="A6XX-">
+	<doc>
+		Tests bit in specified register and sets predicate for CP_COND_REG_EXEC.
+		So:
+
+			opcode: CP_REG_TEST (39) (2 dwords)
+			        { REG = 0xc10 | BIT = 0 }
+			               0000: 70b90001 00000c10
+			opcode: CP_COND_REG_EXEC (47) (3 dwords)
+			               0000: 70c70002 10000000 00000004
+			opcode: CP_INDIRECT_BUFFER (3f) (4 dwords)
+
+		Will execute the CP_INDIRECT_BUFFER only if b0 in the register at
+		offset 0x0c10 is 1
+	</doc>
+	<enum name="source_type">
+		<value value="0" name="SOURCE_REG"/>
+		<!-- Don't confuse with scratch registers, this is a separate memory
+			 written into by CP_MEM_TO_SCRATCH_MEM. -->
+		<value value="1" name="SOURCE_SCRATCH_MEM" varset="chip" variants="A7XX-"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<!-- the register to test -->
+		<bitfield name="REG" low="0" high="17" varset="source_type" variants="SOURCE_REG"/>
+		<bitfield name="SCRATCH_MEM_OFFSET" low="0" high="17" varset="source_type" variants="SOURCE_SCRATCH_MEM"/>
+		<bitfield name="SOURCE" pos="18" type="source_type" addvariant="yes"/>
+		<!-- the bit to test -->
+		<bitfield name="BIT" low="20" high="24" type="uint"/>
+		<!-- skip implied CP_WAIT_FOR_ME -->
+		<bitfield name="SKIP_WAIT_FOR_ME" pos="25" type="boolean"/>
+		<!-- the predicate bit to set (new in gen3+) -->
+		<bitfield name="PRED_BIT" low="26" high="30" type="uint"/>
+		<!-- update the predicate reg directly (new in gen3+) -->
+		<bitfield name="PRED_UPDATE" pos="31" type="boolean"/>
+	</reg32>
+
+        <!--
+		In PRED_UPDATE mode, the predicate reg is updated directly using two
+		more dwords, ignoring other bits:
+
+			PRED_REG = (PRED_REG & ~PRED_MASK) | (PRED_VAL & PRED_MASK);
+	-->
+	<reg32 offset="1" name="PRED_MASK" type="hex"/>
+	<reg32 offset="2" name="PRED_VAL" type="hex"/>
+</domain>
+
+<!-- I *think* this existed at least as far back as a4xx -->
+<domain name="CP_COND_REG_EXEC" width="32">
+	<enum name="compare_mode">
+		<!-- use the predicate bit set by CP_REG_TEST -->
+		<value value="1" name="PRED_TEST"/>
+		<!-- compare two registers directly for equality -->
+		<value value="2" name="REG_COMPARE"/>
+		<!-- test if certain render modes are set via CP_SET_MARKER -->
+		<value value="3" name="RENDER_MODE" varset="chip" variants="A6XX-"/>
+		<!-- compare REG0 for equality with immediate -->
+		<value value="4" name="REG_COMPARE_IMM" varset="chip" variants="A7XX-"/>
+		<!-- test which of BR/BV are enabled -->
+		<value value="5" name="THREAD_MODE" varset="chip" variants="A7XX-"/>
+	</enum>
+	<reg32 offset="0" name="0" varset="compare_mode">
+		<bitfield name="REG0" low="0" high="17" variants="REG_COMPARE" type="hex"/>
+
+		<!-- the predicate bit to test (new in gen3+) -->
+		<bitfield name="PRED_BIT" low="18" high="22" variants="PRED_TEST" type="uint"/>
+		<bitfield name="SKIP_WAIT_FOR_ME" pos="23" varset="chip" variants="A7XX-" type="boolean"/>
+		<!-- With REG_COMPARE instead of register read from ONCHIP memory -->
+		<bitfield name="ONCHIP_MEM" pos="24" varset="chip" variants="A7XX-" type="boolean"/>
+
+		<!--
+			Note: these bits have the same meaning, and use the same
+			internal mechanism as the bits in CP_SET_DRAW_STATE.
+			When RENDER_MODE is selected, they're used as
+			a bitmask of which modes pass the test.
+		-->
+
+		<!-- RM6_BINNING -->
+		<bitfield name="BINNING" pos="25" variants="RENDER_MODE" type="boolean"/>
+		<!-- all others -->
+		<bitfield name="GMEM" pos="26" variants="RENDER_MODE" type="boolean"/>
+		<!-- RM6_BYPASS -->
+		<bitfield name="SYSMEM" pos="27" variants="RENDER_MODE" type="boolean"/>
+
+		<bitfield name="BV" pos="25" variants="THREAD_MODE" type="boolean"/>
+		<bitfield name="BR" pos="26" variants="THREAD_MODE" type="boolean"/>
+		<bitfield name="LPAC" pos="27" variants="THREAD_MODE" type="boolean"/>
+
+		<bitfield name="MODE" low="28" high="31" type="compare_mode" addvariant="yes"/>
+	</reg32>
+
+	<stripe varset="compare_mode" variants="PRED_TEST">
+		<reg32 offset="1" name="1">
+			<bitfield name="DWORDS" low="0" high="23" type="uint"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="compare_mode" variants="REG_COMPARE">
+		<reg32 offset="1" name="1">
+			<bitfield name="REG1" low="0" high="17" type="hex"/>
+			<!-- Instead of register read from ONCHIP memory -->
+			<bitfield name="ONCHIP_MEM" pos="24" varset="chip" variants="A7XX-" type="boolean"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="compare_mode" variants="RENDER_MODE">
+		<reg32 offset="1" name="1">
+			<bitfield name="DWORDS" low="0" high="23" type="uint"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="compare_mode" variants="REG_COMPARE_IMM">
+		<reg32 offset="1" name="1">
+			<bitfield name="IMM" low="0" high="31"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="compare_mode" variants="THREAD_MODE">
+		<reg32 offset="1" name="1">
+			<bitfield name="DWORDS" low="0" high="23" type="uint"/>
+		</reg32>
+	</stripe>
+
+	<reg32 offset="2" name="2">
+		<bitfield name="DWORDS" low="0" high="23" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_COND_EXEC" width="32">
+	<doc>
+                Executes the following DWORDs of commands if the dword at ADDR0
+                is not equal to 0 and the dword at ADDR1 is less than REF
+                (signed comparison).
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="ADDR0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR0_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ADDR1_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="ADDR1_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="DWORDS" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_AMBLE" width="32">
+	<doc>
+                Used by the userspace and kernel drivers to set various IB's
+                which are executed during context save/restore for handling
+                state that isn't restored by the context switch routine itself.
+  </doc>
+	<enum name="amble_type">
+		<value name="PREAMBLE_AMBLE_TYPE" value="0">
+			<doc>Executed unconditionally when switching back to the context.</doc>
+		</value>
+		<value name="BIN_PREAMBLE_AMBLE_TYPE" value="1">
+                        <doc>
+				Executed when switching back after switching
+				away during execution of
+				a CP_SET_MARKER packet with RM6_BIN_RENDER_END as the
+				payload *and* skipsaverestore is set. This is
+				expected to restore static register values not
+				saved when skipsaverestore is set.
+			</doc>
+		</value>
+		<value name="POSTAMBLE_AMBLE_TYPE" value="2">
+                        <doc>
+				Executed when switching away from the context,
+				except for context switches initiated via
+				CP_YIELD.
+                        </doc>
+		</value>
+		<value name="KMD_AMBLE_TYPE" value="3">
+			<doc>
+				This can only be set by the RB (i.e. the kernel)
+				and executes with protected mode off, but
+				is otherwise similar to POSTAMBLE_AMBLE_TYPE.
+			</doc>
+		</value>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="ADDR_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="DWORDS" low="0" high="19" type="uint"/>
+		<bitfield name="TYPE" low="20" high="21" type="amble_type"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_WRITE" width="32">
+	<enum name="reg_tracker">
+		<doc>
+			Keep shadow copies of these registers and only set them
+			when drawing, avoiding redundant writes:
+			- VPC_CNTL_0
+			- HLSQ_CONTROL_1_REG
+			- HLSQ_UNKNOWN_B980
+		</doc>
+		<value name="TRACK_CNTL_REG" value="0x1"/>
+		<doc>
+			Track RB_RENDER_CNTL, and insert a WFI in the following
+			situation:
+			- There is a write that disables binning
+			- There was a draw with binning left enabled, but in
+			  BYPASS mode
+			Presumably this is a hang workaround?
+		</doc>
+		<value name="TRACK_RENDER_CNTL" value="0x2"/>
+		<doc>
+			Do a mysterious CP_EVENT_WRITE 0x3f when the low bit of
+			the data to write is 0. Used by the Vulkan blob with
+			PC_MULTIVIEW_CNTL, but this isn't predicated on particular
+			register(s) like the others.
+		</doc>
+		<value name="UNK_EVENT_WRITE" value="0x4"/>
+		<doc>
+			Tracks GRAS_LRZ_CNTL::GREATER, GRAS_LRZ_CNTL::DIR, and
+			GRAS_LRZ_DEPTH_VIEW with previous values, and if one of
+			the following is true:
+			- GRAS_LRZ_CNTL::GREATER has changed
+			- GRAS_LRZ_CNTL::DIR has changed, the old value is not
+			  CUR_DIR_GE, and the new value is not CUR_DIR_DISABLED
+			- GRAS_LRZ_DEPTH_VIEW has changed
+			then it does a LRZ_FLUSH with GRAS_LRZ_CNTL::ENABLE
+			forced to 1.
+			Only exists in a650_sqe.fw.
+		</doc>
+		<value name="TRACK_LRZ" value="0x8"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TRACKER" low="0" high="3" type="reg_tracker"/>
+	</reg32>
+	<reg32 offset="1" name="1"/>
+	<reg32 offset="2" name="2"/>
+</domain>
+
+<domain name="CP_SMMU_TABLE_UPDATE" width="32">
+	<doc>
+		Note that the SMMU's definition of TTBRn can take different forms
+		depending on the pgtable format.  But a5xx+ only uses aarch64
+		format.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="TTBR0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="TTBR0_HI" low="0" high="15"/>
+		<bitfield name="ASID" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<doc>Unused, does not apply to aarch64 pgtable format</doc>
+		<bitfield name="CONTEXTIDR" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="CONTEXTBANK" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_START_BIN" width="32">
+	<reg32 offset="0" name="BIN_COUNT" type="uint"/>
+	<reg64 offset="1" name="PREFIX_ADDR" type="address"/>
+	<reg32 offset="3" name="PREFIX_DWORDS">
+		<doc>
+			Size of prefix for each bin. For each bin index i, the
+			prefix commands at PREFIX_ADDR + i * PREFIX_DWORDS are
+			executed in an IB2 before the IB1 commands following
+			this packet.
+		</doc>
+	</reg32>
+	<reg32 offset="4" name="BODY_DWORDS">
+		<doc>Number of dwords after this packet until CP_END_BIN</doc>
+	</reg32>
+</domain>
+
+<domain name="CP_WAIT_TIMESTAMP" width="32">
+	<enum name="ts_wait_value_src">
+		<!-- Wait for value at memory address to be >= SRC_0 (signed comparison) -->
+		<value value="0" name="TS_WAIT_GE_32B"/>
+		<!-- Wait for value at memory address to be >= SRC_0 (unsigned) -->
+		<value value="1" name="TS_WAIT_GE_64B"/>
+		<!-- Write (TIMESTAMP_GLOBAL + TIMESTAMP_LOCAL) -->
+		<value value="2" name="TS_WAIT_GE_TIMESTAMP_SUM"/>
+	</enum>
+
+	<enum name="ts_wait_type">
+		<value value="0" name="TS_WAIT_RAM"/>
+		<value value="1" name="TS_WAIT_ONCHIP"/>
+	</enum>
+
+	<reg32 offset="0" name="0">
+		<bitfield name="WAIT_VALUE_SRC" low="0" high="1" type="ts_wait_value_src"/>
+		<bitfield name="WAIT_DST" pos="4" type="ts_wait_type" addvariant="yes"/>
+	</reg32>
+
+	<stripe varset="ts_wait_type" variants="TS_WAIT_RAM">
+		<reg64 offset="1" name="ADDR" type="address"/>
+	</stripe>
+
+	<stripe varset="ts_wait_type" variants="TS_WAIT_ONCHIP">
+		<reg32 offset="1" name="ONCHIP_ADDR_0" low="0" high="31"/>
+	</stripe>
+
+	<reg32 offset="3" name="SRC_0"/>
+	<reg32 offset="4" name="SRC_1"/>
+</domain>
+
+<domain name="CP_BV_BR_COUNT_OPS" width="32">
+	<enum name="pipe_count_op">
+		<value name="PIPE_CLEAR_BV_BR" value="0x1"/>
+		<value name="PIPE_SET_BR_OFFSET" value="0x2"/>
+		<!-- Wait until for BV_counter > BR_counter -->
+		<value name="PIPE_BR_WAIT_FOR_BV" value="0x3"/>
+		<!-- Wait until (BR_counter + BR_OFFSET) > BV_counter -->
+		<value name="PIPE_BV_WAIT_FOR_BR" value="0x4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="OP" low="0" high="3" type="pipe_count_op"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="BR_OFFSET" low="0" high="15" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_MODIFY_TIMESTAMP" width="32">
+	<enum name="timestamp_op">
+		<value name="MODIFY_TIMESTAMP_CLEAR" value="0"/>
+		<value name="MODIFY_TIMESTAMP_ADD_GLOBAL" value="1"/>
+		<value name="MODIFY_TIMESTAMP_ADD_LOCAL" value="2"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="ADD" low="0" high="7" type="uint"/>
+		<bitfield name="OP" low="28" high="31" type="timestamp_op"/>
+	</reg32>
+</domain>
+
+<domain name="CP_MEM_TO_SCRATCH_MEM" width="32">
+	<doc>
+		Best guess is that it is a faster way to fetch all the VSC_STATE registers
+		and keep them in a local scratch memory instead of fetching every time
+		when skipping IBs.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="CNT" low="0" high="5" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<doc>Scratch memory size is 48 dwords`</doc>
+		<bitfield name="OFFSET" low="0" high="5" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="SRC" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="SRC_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_THREAD_CONTROL" width="32">
+	<enum name="cp_thread">
+		<value name="CP_SET_THREAD_BR" value="1"/>    <!-- Render -->
+		<value name="CP_SET_THREAD_BV" value="2"/>    <!-- Visibility -->
+		<value name="CP_SET_THREAD_BOTH" value="3"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield low="0" high="1" name="THREAD" type="cp_thread"/>
+		<bitfield pos="27" name="CONCURRENT_BIN_DISABLE" type="boolean"/>
+		<bitfield pos="31" name="SYNC_THREADS" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="CP_FIXED_STRIDE_DRAW_TABLE" width="32">
+	<reg64 offset="0" name="IB_BASE"/>
+	<reg32 offset="2" name="2">
+		<!-- STRIDE * COUNT -->
+		<bitfield name="IB_SIZE" low="0" high="11"/>
+		<bitfield name="STRIDE" low="20" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="COUNT" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_RESET_CONTEXT_STATE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="CLEAR_ON_CHIP_TS" pos="0" type="boolean"/>
+		<bitfield name="CLEAR_RESOURCE_TABLE" pos="1" type="boolean"/>
+		<bitfield name="CLEAR_GLOBAL_LOCAL_TS" pos="2" type="boolean"/>
+	</reg32>
+</domain>
+
+</database>
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/dsi.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/dsi.xml
@@ -0,0 +1,390 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI" width="32">
+	<enum name="dsi_traffic_mode">
+		<value name="NON_BURST_SYNCH_PULSE" value="0"/>
+		<value name="NON_BURST_SYNCH_EVENT" value="1"/>
+		<value name="BURST_MODE" value="2"/>
+	</enum>
+	<enum name="dsi_vid_dst_format">
+		<value name="VID_DST_FORMAT_RGB565" value="0"/>
+		<value name="VID_DST_FORMAT_RGB666" value="1"/>
+		<value name="VID_DST_FORMAT_RGB666_LOOSE" value="2"/>
+		<value name="VID_DST_FORMAT_RGB888" value="3"/>
+	</enum>
+	<enum name="dsi_rgb_swap">
+		<value name="SWAP_RGB" value="0"/>
+		<value name="SWAP_RBG" value="1"/>
+		<value name="SWAP_BGR" value="2"/>
+		<value name="SWAP_BRG" value="3"/>
+		<value name="SWAP_GRB" value="4"/>
+		<value name="SWAP_GBR" value="5"/>
+	</enum>
+	<enum name="dsi_cmd_trigger">
+		<value name="TRIGGER_NONE" value="0"/>
+		<value name="TRIGGER_SEOF" value="1"/>
+		<value name="TRIGGER_TE" value="2"/>
+		<value name="TRIGGER_SW" value="4"/>
+		<value name="TRIGGER_SW_SEOF" value="5"/>
+		<value name="TRIGGER_SW_TE" value="6"/>
+	</enum>
+	<enum name="dsi_cmd_dst_format">
+		<value name="CMD_DST_FORMAT_RGB111" value="0"/>
+		<value name="CMD_DST_FORMAT_RGB332" value="3"/>
+		<value name="CMD_DST_FORMAT_RGB444" value="4"/>
+		<value name="CMD_DST_FORMAT_RGB565" value="6"/>
+		<value name="CMD_DST_FORMAT_RGB666" value="7"/>
+		<value name="CMD_DST_FORMAT_RGB888" value="8"/>
+	</enum>
+	<enum name="dsi_lane_swap">
+		<value name="LANE_SWAP_0123" value="0"/>
+		<value name="LANE_SWAP_3012" value="1"/>
+		<value name="LANE_SWAP_2301" value="2"/>
+		<value name="LANE_SWAP_1230" value="3"/>
+		<value name="LANE_SWAP_0321" value="4"/>
+		<value name="LANE_SWAP_1032" value="5"/>
+		<value name="LANE_SWAP_2103" value="6"/>
+		<value name="LANE_SWAP_3210" value="7"/>
+	</enum>
+		<enum name="video_config_bpp">
+		<value name="VIDEO_CONFIG_18BPP" value="0"/>
+		<value name="VIDEO_CONFIG_24BPP" value="1"/>
+	</enum>
+	<enum name="video_pattern_sel">
+		<value name="VID_PRBS" value="0"/>
+		<value name="VID_INCREMENTAL" value="1"/>
+		<value name="VID_FIXED" value="2"/>
+		<value name="VID_MDSS_GENERAL_PATTERN" value="3"/>
+	</enum>
+	<enum name="cmd_mdp_stream0_pattern_sel">
+		<value name="CMD_MDP_PRBS" value="0"/>
+		<value name="CMD_MDP_INCREMENTAL" value="1"/>
+		<value name="CMD_MDP_FIXED" value="2"/>
+		<value name="CMD_MDP_MDSS_GENERAL_PATTERN" value="3"/>
+	</enum>
+	<enum name="cmd_dma_pattern_sel">
+		<value name="CMD_DMA_PRBS" value="0"/>
+		<value name="CMD_DMA_INCREMENTAL" value="1"/>
+		<value name="CMD_DMA_FIXED" value="2"/>
+		<value name="CMD_DMA_CUSTOM_PATTERN_DMA_FIFO" value="3"/>
+	</enum>
+	<bitset name="DSI_IRQ">
+		<bitfield name="CMD_DMA_DONE" pos="0" type="boolean"/>
+		<bitfield name="MASK_CMD_DMA_DONE" pos="1" type="boolean"/>
+		<bitfield name="CMD_MDP_DONE" pos="8" type="boolean"/>
+		<bitfield name="MASK_CMD_MDP_DONE" pos="9" type="boolean"/>
+		<bitfield name="VIDEO_DONE" pos="16" type="boolean"/>
+		<bitfield name="MASK_VIDEO_DONE" pos="17" type="boolean"/>
+		<bitfield name="BTA_DONE" pos="20" type="boolean"/>
+		<bitfield name="MASK_BTA_DONE" pos="21" type="boolean"/>
+		<bitfield name="ERROR" pos="24" type="boolean"/>
+		<bitfield name="MASK_ERROR" pos="25" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x00000" name="6G_HW_VERSION">
+		<bitfield name="MAJOR" low="28" high="31" type="uint"/>
+		<bitfield name="MINOR" low="16" high="27" type="uint"/>
+		<bitfield name="STEP" low="0" high="15" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00000" name="CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="VID_MODE_EN" pos="1" type="boolean"/>
+		<bitfield name="CMD_MODE_EN" pos="2" type="boolean"/>
+		<bitfield name="LANE0" pos="4" type="boolean"/>
+		<bitfield name="LANE1" pos="5" type="boolean"/>
+		<bitfield name="LANE2" pos="6" type="boolean"/>
+		<bitfield name="LANE3" pos="7" type="boolean"/>
+		<bitfield name="CLK_EN" pos="8" type="boolean"/>
+		<bitfield name="ECC_CHECK" pos="20" type="boolean"/>
+		<bitfield name="CRC_CHECK" pos="24" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00004" name="STATUS0">
+		<bitfield name="CMD_MODE_ENGINE_BUSY" pos="0" type="boolean"/>
+		<bitfield name="CMD_MODE_DMA_BUSY" pos="1" type="boolean"/>
+		<bitfield name="CMD_MODE_MDP_BUSY" pos="2" type="boolean"/>
+		<bitfield name="VIDEO_MODE_ENGINE_BUSY" pos="3" type="boolean"/>
+		<bitfield name="DSI_BUSY" pos="4" type="boolean"/>  <!-- see mipi_dsi_cmd_bta_sw_trigger() -->
+		<bitfield name="INTERLEAVE_OP_CONTENTION" pos="31" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00008" name="FIFO_STATUS">
+		<bitfield name="VIDEO_MDP_FIFO_OVERFLOW" pos="0" type="boolean"/>
+		<bitfield name="VIDEO_MDP_FIFO_UNDERFLOW" pos="3" type="boolean"/>
+		<bitfield name="CMD_MDP_FIFO_UNDERFLOW" pos="7" type="boolean"/>
+		<bitfield name="CMD_DMA_FIFO_RD_WATERMARK_REACH" pos="8" type="boolean"/>
+		<bitfield name="CMD_DMA_FIFO_WR_WATERMARK_REACH" pos="9" type="boolean"/>
+		<bitfield name="CMD_DMA_FIFO_UNDERFLOW" pos="10" type="boolean"/>
+		<bitfield name="DLN0_LP_FIFO_EMPTY"     pos="12" type="boolean"/>
+		<bitfield name="DLN0_LP_FIFO_FULL"      pos="13" type="boolean"/>
+		<bitfield name="DLN0_LP_FIFO_OVERFLOW"  pos="14" type="boolean"/>
+		<bitfield name="DLN0_HS_FIFO_EMPTY"     pos="16" type="boolean"/>
+		<bitfield name="DLN0_HS_FIFO_FULL"      pos="17" type="boolean"/>
+		<bitfield name="DLN0_HS_FIFO_OVERFLOW"  pos="18" type="boolean"/>
+		<bitfield name="DLN0_HS_FIFO_UNDERFLOW" pos="19" type="boolean"/>
+		<bitfield name="DLN1_HS_FIFO_EMPTY"     pos="20" type="boolean"/>
+		<bitfield name="DLN1_HS_FIFO_FULL"      pos="21" type="boolean"/>
+		<bitfield name="DLN1_HS_FIFO_OVERFLOW"  pos="22" type="boolean"/>
+		<bitfield name="DLN1_HS_FIFO_UNDERFLOW" pos="23" type="boolean"/>
+		<bitfield name="DLN2_HS_FIFO_EMPTY"     pos="24" type="boolean"/>
+		<bitfield name="DLN2_HS_FIFO_FULL"      pos="25" type="boolean"/>
+		<bitfield name="DLN2_HS_FIFO_OVERFLOW"  pos="26" type="boolean"/>
+		<bitfield name="DLN2_HS_FIFO_UNDERFLOW" pos="27" type="boolean"/>
+		<bitfield name="DLN3_HS_FIFO_EMPTY"     pos="28" type="boolean"/>
+		<bitfield name="DLN3_HS_FIFO_FULL"      pos="29" type="boolean"/>
+		<bitfield name="DLN3_HS_FIFO_OVERFLOW"  pos="30" type="boolean"/>
+		<bitfield name="DLN3_HS_FIFO_UNDERFLOW" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0000c" name="VID_CFG0">
+		<bitfield name="VIRT_CHANNEL" low="0" high="1" type="uint"/>  <!-- always zero? -->
+		<bitfield name="DST_FORMAT" low="4" high="5" type="dsi_vid_dst_format"/>
+		<bitfield name="TRAFFIC_MODE" low="8" high="9" type="dsi_traffic_mode"/>
+		<bitfield name="BLLP_POWER_STOP" pos="12" type="boolean"/>
+		<bitfield name="EOF_BLLP_POWER_STOP" pos="15" type="boolean"/>
+		<bitfield name="HSA_POWER_STOP" pos="16" type="boolean"/>
+		<bitfield name="HBP_POWER_STOP" pos="20" type="boolean"/>
+		<bitfield name="HFP_POWER_STOP" pos="24" type="boolean"/>
+		<bitfield name="DATABUS_WIDEN" pos="25" type="boolean"/>
+		<bitfield name="PULSE_MODE_HSA_HE" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0001c" name="VID_CFG1">
+		<bitfield name="R_SEL" pos="0" type="boolean"/>
+		<bitfield name="G_SEL" pos="4" type="boolean"/>
+		<bitfield name="B_SEL" pos="8" type="boolean"/>
+		<bitfield name="RGB_SWAP" low="12" high="14" type="dsi_rgb_swap"/>
+	</reg32>
+	<reg32 offset="0x00020" name="ACTIVE_H">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00024" name="ACTIVE_V">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00028" name="TOTAL">
+		<bitfield name="H_TOTAL" low="0" high="11" type="uint"/>
+		<bitfield name="V_TOTAL" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0002c" name="ACTIVE_HSYNC">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00030" name="ACTIVE_VSYNC_HPOS">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00034" name="ACTIVE_VSYNC_VPOS">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00038" name="CMD_DMA_CTRL">
+		<bitfield name="BROADCAST_EN" pos="31" type="boolean"/>
+		<bitfield name="FROM_FRAME_BUFFER" pos="28" type="boolean"/>
+		<bitfield name="LOW_POWER" pos="26" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0003c" name="CMD_CFG0">
+		<bitfield name="DST_FORMAT" low="0" high="3" type="dsi_cmd_dst_format"/>
+		<bitfield name="R_SEL" pos="4" type="boolean"/>
+		<bitfield name="G_SEL" pos="8" type="boolean"/>
+		<bitfield name="B_SEL" pos="12" type="boolean"/>
+		<bitfield name="INTERLEAVE_MAX" low="20" high="23" type="uint"/>
+		<bitfield name="RGB_SWAP" low="16" high="18" type="dsi_rgb_swap"/>
+	</reg32>
+	<reg32 offset="0x00040" name="CMD_CFG1">
+		<bitfield name="WR_MEM_START" low="0" high="7" type="uint"/>
+		<bitfield name="WR_MEM_CONTINUE" low="8" high="15" type="uint"/>
+		<bitfield name="INSERT_DCS_COMMAND" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00044" name="DMA_BASE"/>
+	<reg32 offset="0x00048" name="DMA_LEN"/>
+	<reg32 offset="0x00054" name="CMD_MDP_STREAM0_CTRL">
+		<bitfield name="DATA_TYPE" low="0" high="5" type="uint"/>
+		<bitfield name="VIRTUAL_CHANNEL" low="8" high="9" type="uint"/>
+		<bitfield name="WORD_COUNT" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00058" name="CMD_MDP_STREAM0_TOTAL">
+		<bitfield name="H_TOTAL" low="0" high="11" type="uint"/>
+		<bitfield name="V_TOTAL" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0005c" name="CMD_MDP_STREAM1_CTRL">
+		<bitfield name="DATA_TYPE" low="0" high="5" type="uint"/>
+		<bitfield name="VIRTUAL_CHANNEL" low="8" high="9" type="uint"/>
+		<bitfield name="WORD_COUNT" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00060" name="CMD_MDP_STREAM1_TOTAL">
+		<bitfield name="H_TOTAL" low="0" high="15" type="uint"/>
+		<bitfield name="V_TOTAL" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00064" name="ACK_ERR_STATUS"/>
+	<array offset="0x00068" name="RDBK" length="4" stride="4">
+		<reg32 offset="0x0" name="DATA"/>
+	</array>
+	<reg32 offset="0x00080" name="TRIG_CTRL">
+		<bitfield name="DMA_TRIGGER" low="0" high="2" type="dsi_cmd_trigger"/>
+		<bitfield name="MDP_TRIGGER" low="4" high="6" type="dsi_cmd_trigger"/>
+		<bitfield name="STREAM" low="8" high="9" type="uint"/>
+		<bitfield name="BLOCK_DMA_WITHIN_FRAME" pos="12" type="boolean"/>
+		<bitfield name="TE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0008c" name="TRIG_DMA"/>
+	<reg32 offset="0x000b0" name="DLN0_PHY_ERR">
+		<bitfield name="DLN0_ERR_ESC" pos="0" type="boolean"/>
+		<bitfield name="DLN0_ERR_SYNC_ESC" pos="4" type="boolean"/>
+		<bitfield name="DLN0_ERR_CONTROL" pos="8" type="boolean"/>
+		<bitfield name="DLN0_ERR_CONTENTION_LP0" pos="12" type="boolean"/>
+		<bitfield name="DLN0_ERR_CONTENTION_LP1" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000b4" name="LP_TIMER_CTRL">
+		<bitfield name="LP_RX_TO" low="0" high="15" type="uint"/>
+		<bitfield name="BTA_TO" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x000b8" name="HS_TIMER_CTRL">
+		<bitfield name="HS_TX_TO" low="0" high="15" type="uint"/>
+		<bitfield name="TIMER_RESOLUTION" low="16" high="19" type="uint"/>
+		<bitfield name="HS_TX_TO_STOP_EN" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000bc" name="TIMEOUT_STATUS"/>
+	<reg32 offset="0x000c0" name="CLKOUT_TIMING_CTRL">
+		<bitfield name="T_CLK_PRE" low="0" high="5" type="uint"/>
+		<bitfield name="T_CLK_POST" low="8" high="13" type="uint"/>
+	</reg32>
+	<reg32 offset="0x000c8" name="EOT_PACKET_CTRL">
+		<bitfield name="TX_EOT_APPEND" pos="0" type="boolean"/>
+		<bitfield name="RX_EOT_IGNORE" pos="4" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000a4" name="LANE_STATUS">
+		<bitfield name="DLN0_STOPSTATE" pos="0" type="boolean"/>
+		<bitfield name="DLN1_STOPSTATE" pos="1" type="boolean"/>
+		<bitfield name="DLN2_STOPSTATE" pos="2" type="boolean"/>
+		<bitfield name="DLN3_STOPSTATE" pos="3" type="boolean"/>
+		<bitfield name="CLKLN_STOPSTATE" pos="4" type="boolean"/>
+		<bitfield name="DLN0_ULPS_ACTIVE_NOT" pos="8" type="boolean"/>
+		<bitfield name="DLN1_ULPS_ACTIVE_NOT" pos="9" type="boolean"/>
+		<bitfield name="DLN2_ULPS_ACTIVE_NOT" pos="10" type="boolean"/>
+		<bitfield name="DLN3_ULPS_ACTIVE_NOT" pos="11" type="boolean"/>
+		<bitfield name="CLKLN_ULPS_ACTIVE_NOT" pos="12" type="boolean"/>
+		<bitfield name="DLN0_DIRECTION" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000a8" name="LANE_CTRL">
+		<bitfield name="HS_REQ_SEL_PHY" pos="24" type="boolean"/>
+		<bitfield name="CLKLN_HS_FORCE_REQUEST" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000ac" name="LANE_SWAP_CTRL">
+		<bitfield name="DLN_SWAP_SEL" low="0" high="2" type="dsi_lane_swap"/>
+	</reg32>
+	<reg32 offset="0x00108" name="ERR_INT_MASK0"/>
+	<reg32 offset="0x0010c" name="INTR_CTRL" type="DSI_IRQ"/>
+	<reg32 offset="0x00114" name="RESET"/>
+	<reg32 offset="0x00118" name="CLK_CTRL">
+		<bitfield name="AHBS_HCLK_ON" pos="0" type="boolean"/>
+		<bitfield name="AHBM_SCLK_ON" pos="1" type="boolean"/>
+		<bitfield name="PCLK_ON" pos="2" type="boolean"/>
+		<bitfield name="DSICLK_ON" pos="3" type="boolean"/>
+		<bitfield name="BYTECLK_ON" pos="4" type="boolean"/>
+		<bitfield name="ESCCLK_ON" pos="5" type="boolean"/>
+		<bitfield name="FORCE_ON_DYN_AHBM_HCLK" pos="9" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0011c" name="CLK_STATUS">
+		<bitfield name="DSI_AON_AHBM_HCLK_ACTIVE" pos="0" type="boolean"/>
+		<bitfield name="DSI_DYN_AHBM_HCLK_ACTIVE" pos="1" type="boolean"/>
+		<bitfield name="DSI_AON_AHBS_HCLK_ACTIVE" pos="2" type="boolean"/>
+		<bitfield name="DSI_DYN_AHBS_HCLK_ACTIVE" pos="3" type="boolean"/>
+		<bitfield name="DSI_AON_DSICLK_ACTIVE" pos="4" type="boolean"/>
+		<bitfield name="DSI_DYN_DSICLK_ACTIVE" pos="5" type="boolean"/>
+		<bitfield name="DSI_AON_BYTECLK_ACTIVE" pos="6" type="boolean"/>
+		<bitfield name="DSI_DYN_BYTECLK_ACTIVE" pos="7" type="boolean"/>
+		<bitfield name="DSI_AON_ESCCLK_ACTIVE" pos="8" type="boolean"/>
+		<bitfield name="DSI_AON_PCLK_ACTIVE" pos="9" type="boolean"/>
+		<bitfield name="DSI_DYN_PCLK_ACTIVE" pos="10" type="boolean"/>
+		<bitfield name="DSI_DYN_CMD_PCLK_ACTIVE" pos="12" type="boolean"/>
+		<bitfield name="DSI_CMD_PCLK_ACTIVE" pos="13" type="boolean"/>
+		<bitfield name="DSI_VID_PCLK_ACTIVE" pos="14" type="boolean"/>
+		<bitfield name="DSI_CAM_BIST_PCLK_ACT" pos="15" type="boolean"/>
+		<bitfield name="PLL_UNLOCKED" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00128" name="PHY_RESET">
+		<bitfield name="RESET" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00160" name="TEST_PATTERN_GEN_VIDEO_INIT_VAL"/>
+	<reg32 offset="0x00198" name="TPG_MAIN_CONTROL">
+		<bitfield name="CHECKERED_RECTANGLE_PATTERN" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001a0" name="TPG_VIDEO_CONFIG">
+		<bitfield name="BPP" low="0" high="1" type="video_config_bpp"/>
+		<bitfield name="RGB" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00158" name="TEST_PATTERN_GEN_CTRL">
+		<bitfield name="CMD_DMA_PATTERN_SEL" low="16" high="17" type="cmd_dma_pattern_sel"/>
+		<bitfield name="CMD_MDP_STREAM0_PATTERN_SEL" low="8" high="9" type="cmd_mdp_stream0_pattern_sel"/>
+		<bitfield name="VIDEO_PATTERN_SEL" low="4" high="5" type="video_pattern_sel"/>
+		<bitfield name="TPG_DMA_FIFO_MODE" pos="2" type="boolean"/>
+		<bitfield name="CMD_DMA_TPG_EN" pos="1" type="boolean"/>
+		<bitfield name="EN" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00168" name="TEST_PATTERN_GEN_CMD_MDP_INIT_VAL0"/>
+	<reg32 offset="0x00180" name="TEST_PATTERN_GEN_CMD_STREAM0_TRIGGER">
+		<bitfield name="SW_TRIGGER" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0019c" name="TPG_MAIN_CONTROL2">
+		<bitfield name="CMD_MDP0_CHECKERED_RECTANGLE_PATTERN" pos="7" type="boolean"/>
+		<bitfield name="CMD_MDP1_CHECKERED_RECTANGLE_PATTERN" pos="16" type="boolean"/>
+		<bitfield name="CMD_MDP2_CHECKERED_RECTANGLE_PATTERN" pos="25" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0017c" name="T_CLK_PRE_EXTEND">
+		<bitfield name="INC_BY_2_BYTECLK" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001b4" name="CMD_MODE_MDP_CTRL2">
+		<bitfield name="DST_FORMAT2" low="0" high="3" type="dsi_cmd_dst_format"/>
+		<bitfield name="R_SEL" pos="4" type="boolean"/>
+		<bitfield name="G_SEL" pos="5" type="boolean"/>
+		<bitfield name="B_SEL" pos="6" type="boolean"/>
+		<bitfield name="BYTE_MSB_LSB_FLIP" pos="7" type="boolean"/>
+		<bitfield name="RGB_SWAP" low="8" high="10" type="dsi_rgb_swap"/>
+		<bitfield name="INPUT_RGB_SWAP" low="12" high="14" type="dsi_rgb_swap"/>
+		<bitfield name="BURST_MODE" pos="16" type="boolean"/>
+		<bitfield name="DATABUS_WIDEN" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001b8" name="CMD_MODE_MDP_STREAM2_CTRL">
+		<bitfield name="DATA_TYPE" low="0" high="5" type="uint"/>
+		<bitfield name="VIRTUAL_CHANNEL" low="8" high="9" type="uint"/>
+		<bitfield name="WORD_COUNT" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x001d0" name="RDBK_DATA_CTRL">
+		<bitfield name="COUNT" low="16" high="23" type="uint"/>
+		<bitfield name="CLR" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001f0" name="VERSION">
+		<bitfield name="MAJOR" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002d4" name="CPHY_MODE_CTRL"/>
+	<reg32 offset="0x0029c" name="VIDEO_COMPRESSION_MODE_CTRL">
+		<bitfield name="WC" low="16" high="31" type="uint"/>
+		<bitfield name="DATATYPE" low="8" high="13" type="uint"/>
+		<bitfield name="PKT_PER_LINE" low="6" high="7" type="uint"/>
+		<bitfield name="EOL_BYTE_NUM" low="4" high="5" type="uint"/>
+		<bitfield name="EN" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002a4" name="COMMAND_COMPRESSION_MODE_CTRL">
+		<bitfield name="STREAM1_DATATYPE" low="24" high="29" type="uint"/>
+		<bitfield name="STREAM1_PKT_PER_LINE" low="22" high="23" type="uint"/>
+		<bitfield name="STREAM1_EOL_BYTE_NUM" low="20" high="21" type="uint"/>
+		<bitfield name="STREAM1_EN" pos="16" type="boolean"/>
+		<bitfield name="STREAM0_DATATYPE" low="8" high="13" type="uint"/>
+		<bitfield name="STREAM0_PKT_PER_LINE" low="6" high="7" type="uint"/>
+		<bitfield name="STREAM0_EOL_BYTE_NUM" low="4" high="5" type="uint"/>
+		<bitfield name="STREAM0_EN" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002a8" name="COMMAND_COMPRESSION_MODE_CTRL2">
+		<bitfield name="STREAM1_SLICE_WIDTH" low="16" high="31" type="uint"/>
+		<bitfield name="STREAM0_SLICE_WIDTH" low="0" high="15" type="uint"/>
+	</reg32>
+
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/dsi_phy_10nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/dsi_phy_10nm.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_10nm_PHY_CMN" width="32">
+	<reg32 offset="0x00000" name="REVISION_ID0"/>
+	<reg32 offset="0x00004" name="REVISION_ID1"/>
+	<reg32 offset="0x00008" name="REVISION_ID2"/>
+	<reg32 offset="0x0000c" name="REVISION_ID3"/>
+	<reg32 offset="0x00010" name="CLK_CFG0"/>
+	<reg32 offset="0x00014" name="CLK_CFG1"/>
+	<reg32 offset="0x00018" name="GLBL_CTRL"/>
+	<reg32 offset="0x0001c" name="RBUF_CTRL"/>
+	<reg32 offset="0x00020" name="VREG_CTRL"/>
+	<reg32 offset="0x00024" name="CTRL_0"/>
+	<reg32 offset="0x00028" name="CTRL_1"/>
+	<reg32 offset="0x0002c" name="CTRL_2"/>
+	<reg32 offset="0x00030" name="LANE_CFG0"/>
+	<reg32 offset="0x00034" name="LANE_CFG1"/>
+	<reg32 offset="0x00038" name="PLL_CNTRL"/>
+	<reg32 offset="0x00098" name="LANE_CTRL0"/>
+	<reg32 offset="0x0009c" name="LANE_CTRL1"/>
+	<reg32 offset="0x000a0" name="LANE_CTRL2"/>
+	<reg32 offset="0x000a4" name="LANE_CTRL3"/>
+	<reg32 offset="0x000a8" name="LANE_CTRL4"/>
+	<reg32 offset="0x000ac" name="TIMING_CTRL_0"/>
+	<reg32 offset="0x000b0" name="TIMING_CTRL_1"/>
+	<reg32 offset="0x000b4" name="TIMING_CTRL_2"/>
+	<reg32 offset="0x000b8" name="TIMING_CTRL_3"/>
+	<reg32 offset="0x000bc" name="TIMING_CTRL_4"/>
+	<reg32 offset="0x000c0" name="TIMING_CTRL_5"/>
+	<reg32 offset="0x000c4" name="TIMING_CTRL_6"/>
+	<reg32 offset="0x000c8" name="TIMING_CTRL_7"/>
+	<reg32 offset="0x000cc" name="TIMING_CTRL_8"/>
+	<reg32 offset="0x000d0" name="TIMING_CTRL_9"/>
+	<reg32 offset="0x000d4" name="TIMING_CTRL_10"/>
+	<reg32 offset="0x000d8" name="TIMING_CTRL_11"/>
+	<reg32 offset="0x000ec" name="PHY_STATUS"/>
+	<reg32 offset="0x000f4" name="LANE_STATUS0"/>
+	<reg32 offset="0x000f8" name="LANE_STATUS1"/>
+</domain>
+
+<domain name="DSI_10nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="5" stride="0x80">
+		<reg32 offset="0x00" name="CFG0"/>
+		<reg32 offset="0x04" name="CFG1"/>
+		<reg32 offset="0x08" name="CFG2"/>
+		<reg32 offset="0x0c" name="CFG3"/>
+		<reg32 offset="0x10" name="TEST_DATAPATH"/>
+		<reg32 offset="0x14" name="PIN_SWAP"/>
+		<reg32 offset="0x18" name="HSTX_STR_CTRL"/>
+		<reg32 offset="0x1c" name="OFFSET_TOP_CTRL"/>
+		<reg32 offset="0x20" name="OFFSET_BOT_CTRL"/>
+		<reg32 offset="0x24" name="LPTX_STR_CTRL"/>
+		<reg32 offset="0x28" name="LPRX_CTRL"/>
+		<reg32 offset="0x2c" name="TX_DCTRL"/>
+	</array>
+</domain>
+
+<domain name="DSI_10nm_PHY_PLL" width="32">
+	<reg32 offset="0x0000" name="ANALOG_CONTROLS_ONE"/>
+	<reg32 offset="0x0004" name="ANALOG_CONTROLS_TWO"/>
+	<reg32 offset="0x0010" name="ANALOG_CONTROLS_THREE"/>
+	<reg32 offset="0x001c" name="DSM_DIVIDER"/>
+	<reg32 offset="0x0020" name="FEEDBACK_DIVIDER"/>
+	<reg32 offset="0x0024" name="SYSTEM_MUXES"/>
+	<reg32 offset="0x002c" name="CMODE"/>
+	<reg32 offset="0x0030" name="CALIBRATION_SETTINGS"/>
+	<reg32 offset="0x0054" name="BAND_SEL_CAL_SETTINGS_THREE"/>
+	<reg32 offset="0x0064" name="FREQ_DETECT_SETTINGS_ONE"/>
+	<reg32 offset="0x007c" name="PFILT"/>
+	<reg32 offset="0x0080" name="IFILT"/>
+	<reg32 offset="0x0094" name="OUTDIV"/>
+	<reg32 offset="0x00a4" name="CORE_OVERRIDE"/>
+	<reg32 offset="0x00a8" name="CORE_INPUT_OVERRIDE"/>
+	<reg32 offset="0x00b4" name="PLL_DIGITAL_TIMERS_TWO"/>
+	<reg32 offset="0x00cc" name="DECIMAL_DIV_START_1"/>
+	<reg32 offset="0x00d0" name="FRAC_DIV_START_LOW_1"/>
+	<reg32 offset="0x00d4" name="FRAC_DIV_START_MID_1"/>
+	<reg32 offset="0x00d8" name="FRAC_DIV_START_HIGH_1"/>
+	<reg32 offset="0x010c" name="SSC_STEPSIZE_LOW_1"/>
+	<reg32 offset="0x0110" name="SSC_STEPSIZE_HIGH_1"/>
+	<reg32 offset="0x0114" name="SSC_DIV_PER_LOW_1"/>
+	<reg32 offset="0x0118" name="SSC_DIV_PER_HIGH_1"/>
+	<reg32 offset="0x011c" name="SSC_DIV_ADJPER_LOW_1"/>
+	<reg32 offset="0x0120" name="SSC_DIV_ADJPER_HIGH_1"/>
+	<reg32 offset="0x013c" name="SSC_CONTROL"/>
+	<reg32 offset="0x0140" name="PLL_OUTDIV_RATE"/>
+	<reg32 offset="0x0144" name="PLL_LOCKDET_RATE_1"/>
+	<reg32 offset="0x014c" name="PLL_PROP_GAIN_RATE_1"/>
+	<reg32 offset="0x0154" name="PLL_BAND_SET_RATE_1"/>
+	<reg32 offset="0x015c" name="PLL_INT_GAIN_IFILT_BAND_1"/>
+	<reg32 offset="0x0164" name="PLL_FL_INT_GAIN_PFILT_BAND_1"/>
+	<reg32 offset="0x0180" name="PLL_LOCK_OVERRIDE"/>
+	<reg32 offset="0x0184" name="PLL_LOCK_DELAY"/>
+	<reg32 offset="0x018c" name="CLOCK_INVERTERS"/>
+	<reg32 offset="0x01a0" name="COMMON_STATUS_ONE"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/dsi_phy_14nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/dsi_phy_14nm.xml
@@ -0,0 +1,135 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_14nm_PHY_CMN" width="32">
+	<reg32 offset="0x00000" name="REVISION_ID0"/>
+	<reg32 offset="0x00004" name="REVISION_ID1"/>
+	<reg32 offset="0x00008" name="REVISION_ID2"/>
+	<reg32 offset="0x0000c" name="REVISION_ID3"/>
+	<reg32 offset="0x00010" name="CLK_CFG0">
+		<bitfield name="DIV_CTRL_3_0" low="4" high="7" type="uint"/>
+		<bitfield name="DIV_CTRL_7_4" low="4" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00014" name="CLK_CFG1">
+		<bitfield name="DSICLK_SEL" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00018" name="GLBL_TEST_CTRL">
+		<bitfield name="BITCLK_HS_SEL" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0001C" name="CTRL_0"/>
+	<reg32 offset="0x00020" name="CTRL_1">
+	</reg32>
+	<reg32 offset="0x00024" name="HW_TRIGGER"/>
+	<reg32 offset="0x00028" name="SW_CFG0"/>
+	<reg32 offset="0x0002C" name="SW_CFG1"/>
+	<reg32 offset="0x00030" name="SW_CFG2"/>
+	<reg32 offset="0x00034" name="HW_CFG0"/>
+	<reg32 offset="0x00038" name="HW_CFG1"/>
+	<reg32 offset="0x0003C" name="HW_CFG2"/>
+	<reg32 offset="0x00040" name="HW_CFG3"/>
+	<reg32 offset="0x00044" name="HW_CFG4"/>
+	<reg32 offset="0x00048" name="PLL_CNTRL">
+		<bitfield name="PLL_START" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0004C" name="LDO_CNTRL">
+		<bitfield name="VREG_CTRL" low="0" high="5" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="DSI_14nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="5" stride="0x80">
+		<reg32 offset="0x00" name="CFG0">
+			<bitfield name="PREPARE_DLY" low="6" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x04" name="CFG1">
+			<bitfield name="HALFBYTECLK_EN" pos="0" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x08" name="CFG2"/>
+		<reg32 offset="0x0c" name="CFG3"/>
+		<reg32 offset="0x10" name="TEST_DATAPATH"/>
+		<reg32 offset="0x14" name="TEST_STR"/>
+		<reg32 offset="0x18" name="TIMING_CTRL_4">
+			<bitfield name="HS_EXIT" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x1c" name="TIMING_CTRL_5">
+			<bitfield name="HS_ZERO" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x20" name="TIMING_CTRL_6">
+			<bitfield name="HS_PREPARE" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x24" name="TIMING_CTRL_7">
+			<bitfield name="HS_TRAIL" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x28" name="TIMING_CTRL_8">
+			<bitfield name="HS_RQST" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x2c" name="TIMING_CTRL_9">
+			<bitfield name="TA_GO" low="0" high="2" type="uint"/>
+			<bitfield name="TA_SURE" low="4" high="6" type="uint"/>
+		</reg32>
+		<reg32 offset="0x30" name="TIMING_CTRL_10">
+			<bitfield name="TA_GET" low="0" high="2" type="uint"/>
+		</reg32>
+		<reg32 offset="0x34" name="TIMING_CTRL_11">
+			<bitfield name="TRIG3_CMD" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x38" name="STRENGTH_CTRL_0"/>
+		<reg32 offset="0x3c" name="STRENGTH_CTRL_1"/>
+		<reg32 offset="0x64" name="VREG_CNTRL"/>
+	</array>
+</domain>
+
+<domain name="DSI_14nm_PHY_PLL" width="32">
+	<reg32 offset="0x000" name="IE_TRIM"/>
+	<reg32 offset="0x004" name="IP_TRIM"/>
+	<reg32 offset="0x010" name="IPTAT_TRIM"/>
+	<reg32 offset="0x01c" name="CLKBUFLR_EN"/>
+	<reg32 offset="0x028" name="SYSCLK_EN_RESET"/>
+	<reg32 offset="0x02c" name="RESETSM_CNTRL"/>
+	<reg32 offset="0x030" name="RESETSM_CNTRL2"/>
+	<reg32 offset="0x034" name="RESETSM_CNTRL3"/>
+	<reg32 offset="0x038" name="RESETSM_CNTRL4"/>
+	<reg32 offset="0x03c" name="RESETSM_CNTRL5"/>
+	<reg32 offset="0x040" name="KVCO_DIV_REF1"/>
+	<reg32 offset="0x044" name="KVCO_DIV_REF2"/>
+	<reg32 offset="0x048" name="KVCO_COUNT1"/>
+	<reg32 offset="0x04c" name="KVCO_COUNT2"/>
+	<reg32 offset="0x05c" name="VREF_CFG1"/>
+	<reg32 offset="0x058" name="KVCO_CODE"/>
+	<reg32 offset="0x06c" name="VCO_DIV_REF1"/>
+	<reg32 offset="0x070" name="VCO_DIV_REF2"/>
+	<reg32 offset="0x074" name="VCO_COUNT1"/>
+	<reg32 offset="0x078" name="VCO_COUNT2"/>
+	<reg32 offset="0x07c" name="PLLLOCK_CMP1"/>
+	<reg32 offset="0x080" name="PLLLOCK_CMP2"/>
+	<reg32 offset="0x084" name="PLLLOCK_CMP3"/>
+	<reg32 offset="0x088" name="PLLLOCK_CMP_EN"/>
+	<reg32 offset="0x08c" name="PLL_VCO_TUNE"/>
+	<reg32 offset="0x090" name="DEC_START"/>
+	<reg32 offset="0x094" name="SSC_EN_CENTER"/>
+	<reg32 offset="0x098" name="SSC_ADJ_PER1"/>
+	<reg32 offset="0x09c" name="SSC_ADJ_PER2"/>
+	<reg32 offset="0x0a0" name="SSC_PER1"/>
+	<reg32 offset="0x0a4" name="SSC_PER2"/>
+	<reg32 offset="0x0a8" name="SSC_STEP_SIZE1"/>
+	<reg32 offset="0x0ac" name="SSC_STEP_SIZE2"/>
+	<reg32 offset="0x0b4" name="DIV_FRAC_START1"/>
+	<reg32 offset="0x0b8" name="DIV_FRAC_START2"/>
+	<reg32 offset="0x0bc" name="DIV_FRAC_START3"/>
+	<reg32 offset="0x0c0" name="TXCLK_EN"/>
+	<reg32 offset="0x0c4" name="PLL_CRCTRL"/>
+	<reg32 offset="0x0cc" name="RESET_SM_READY_STATUS"/>
+	<reg32 offset="0x0e8" name="PLL_MISC1"/>
+	<reg32 offset="0x0f0" name="CP_SET_CUR"/>
+	<reg32 offset="0x0f4" name="PLL_ICPMSET"/>
+	<reg32 offset="0x0f8" name="PLL_ICPCSET"/>
+	<reg32 offset="0x0fc" name="PLL_ICP_SET"/>
+	<reg32 offset="0x100" name="PLL_LPF1"/>
+	<reg32 offset="0x104" name="PLL_LPF2_POSTDIV"/>
+	<reg32 offset="0x108" name="PLL_BANDGAP"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/dsi_phy_20nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/dsi_phy_20nm.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_20nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="4" stride="0x40">
+		<reg32 offset="0x00" name="CFG_0"/>
+		<reg32 offset="0x04" name="CFG_1"/>
+		<reg32 offset="0x08" name="CFG_2"/>
+		<reg32 offset="0x0c" name="CFG_3"/>
+		<reg32 offset="0x10" name="CFG_4"/>
+		<reg32 offset="0x14" name="TEST_DATAPATH"/>
+		<reg32 offset="0x18" name="DEBUG_SEL"/>
+		<reg32 offset="0x1c" name="TEST_STR_0"/>
+		<reg32 offset="0x20" name="TEST_STR_1"/>
+	</array>
+
+	<reg32 offset="0x00100" name="LNCK_CFG_0"/>
+	<reg32 offset="0x00104" name="LNCK_CFG_1"/>
+	<reg32 offset="0x00108" name="LNCK_CFG_2"/>
+	<reg32 offset="0x0010c" name="LNCK_CFG_3"/>
+	<reg32 offset="0x00110" name="LNCK_CFG_4"/>
+	<reg32 offset="0x00114" name="LNCK_TEST_DATAPATH"/>
+	<reg32 offset="0x00118" name="LNCK_DEBUG_SEL"/>
+	<reg32 offset="0x0011c" name="LNCK_TEST_STR0"/>
+	<reg32 offset="0x00120" name="LNCK_TEST_STR1"/>
+
+	<reg32 offset="0x00140" name="TIMING_CTRL_0">
+		<bitfield name="CLK_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00144" name="TIMING_CTRL_1">
+		<bitfield name="CLK_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00148" name="TIMING_CTRL_2">
+		<bitfield name="CLK_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0014c" name="TIMING_CTRL_3">
+		<bitfield name="CLK_ZERO_8" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00150" name="TIMING_CTRL_4">
+		<bitfield name="HS_EXIT" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00154" name="TIMING_CTRL_5">
+		<bitfield name="HS_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00158" name="TIMING_CTRL_6">
+		<bitfield name="HS_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0015c" name="TIMING_CTRL_7">
+		<bitfield name="HS_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00160" name="TIMING_CTRL_8">
+		<bitfield name="HS_RQST" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00164" name="TIMING_CTRL_9">
+		<bitfield name="TA_GO" low="0" high="2" type="uint"/>
+		<bitfield name="TA_SURE" low="4" high="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00168" name="TIMING_CTRL_10">
+		<bitfield name="TA_GET" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0016c" name="TIMING_CTRL_11">
+		<bitfield name="TRIG3_CMD" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00170" name="CTRL_0"/>
+	<reg32 offset="0x00174" name="CTRL_1"/>
+	<reg32 offset="0x00178" name="CTRL_2"/>
+	<reg32 offset="0x0017c" name="CTRL_3"/>
+	<reg32 offset="0x00180" name="CTRL_4"/>
+
+	<reg32 offset="0x00184" name="STRENGTH_0"/>
+	<reg32 offset="0x00188" name="STRENGTH_1"/>
+
+	<reg32 offset="0x001b4" name="BIST_CTRL_0"/>
+	<reg32 offset="0x001b8" name="BIST_CTRL_1"/>
+	<reg32 offset="0x001bc" name="BIST_CTRL_2"/>
+	<reg32 offset="0x001c0" name="BIST_CTRL_3"/>
+	<reg32 offset="0x001c4" name="BIST_CTRL_4"/>
+	<reg32 offset="0x001c8" name="BIST_CTRL_5"/>
+
+	<reg32 offset="0x001d4" name="GLBL_TEST_CTRL">
+		<bitfield name="BITCLK_HS_SEL" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001dc" name="LDO_CNTRL"/>
+</domain>
+
+<domain name="DSI_20nm_PHY_REGULATOR" width="32">
+	<reg32 offset="0x00000" name="CTRL_0"/>
+	<reg32 offset="0x00004" name="CTRL_1"/>
+	<reg32 offset="0x00008" name="CTRL_2"/>
+	<reg32 offset="0x0000c" name="CTRL_3"/>
+	<reg32 offset="0x00010" name="CTRL_4"/>
+	<reg32 offset="0x00014" name="CTRL_5"/>
+	<reg32 offset="0x00018" name="CAL_PWR_CFG"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/dsi_phy_28nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/dsi_phy_28nm.xml
@@ -0,0 +1,180 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_28nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="4" stride="0x40">
+		<reg32 offset="0x00" name="CFG_0"/>
+		<reg32 offset="0x04" name="CFG_1"/>
+		<reg32 offset="0x08" name="CFG_2"/>
+		<reg32 offset="0x0c" name="CFG_3"/>
+		<reg32 offset="0x10" name="CFG_4"/>
+		<reg32 offset="0x14" name="TEST_DATAPATH"/>
+		<reg32 offset="0x18" name="DEBUG_SEL"/>
+		<reg32 offset="0x1c" name="TEST_STR_0"/>
+		<reg32 offset="0x20" name="TEST_STR_1"/>
+	</array>
+
+	<reg32 offset="0x00100" name="LNCK_CFG_0"/>
+	<reg32 offset="0x00104" name="LNCK_CFG_1"/>
+	<reg32 offset="0x00108" name="LNCK_CFG_2"/>
+	<reg32 offset="0x0010c" name="LNCK_CFG_3"/>
+	<reg32 offset="0x00110" name="LNCK_CFG_4"/>
+	<reg32 offset="0x00114" name="LNCK_TEST_DATAPATH"/>
+	<reg32 offset="0x00118" name="LNCK_DEBUG_SEL"/>
+	<reg32 offset="0x0011c" name="LNCK_TEST_STR0"/>
+	<reg32 offset="0x00120" name="LNCK_TEST_STR1"/>
+
+	<reg32 offset="0x00140" name="TIMING_CTRL_0">
+		<bitfield name="CLK_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00144" name="TIMING_CTRL_1">
+		<bitfield name="CLK_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00148" name="TIMING_CTRL_2">
+		<bitfield name="CLK_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0014c" name="TIMING_CTRL_3">
+		<bitfield name="CLK_ZERO_8" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00150" name="TIMING_CTRL_4">
+		<bitfield name="HS_EXIT" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00154" name="TIMING_CTRL_5">
+		<bitfield name="HS_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00158" name="TIMING_CTRL_6">
+		<bitfield name="HS_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0015c" name="TIMING_CTRL_7">
+		<bitfield name="HS_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00160" name="TIMING_CTRL_8">
+		<bitfield name="HS_RQST" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00164" name="TIMING_CTRL_9">
+		<bitfield name="TA_GO" low="0" high="2" type="uint"/>
+		<bitfield name="TA_SURE" low="4" high="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00168" name="TIMING_CTRL_10">
+		<bitfield name="TA_GET" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0016c" name="TIMING_CTRL_11">
+		<bitfield name="TRIG3_CMD" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00170" name="CTRL_0"/>
+	<reg32 offset="0x00174" name="CTRL_1"/>
+	<reg32 offset="0x00178" name="CTRL_2"/>
+	<reg32 offset="0x0017c" name="CTRL_3"/>
+	<reg32 offset="0x00180" name="CTRL_4"/>
+
+	<reg32 offset="0x00184" name="STRENGTH_0"/>
+	<reg32 offset="0x00188" name="STRENGTH_1"/>
+
+	<reg32 offset="0x001b4" name="BIST_CTRL_0"/>
+	<reg32 offset="0x001b8" name="BIST_CTRL_1"/>
+	<reg32 offset="0x001bc" name="BIST_CTRL_2"/>
+	<reg32 offset="0x001c0" name="BIST_CTRL_3"/>
+	<reg32 offset="0x001c4" name="BIST_CTRL_4"/>
+	<reg32 offset="0x001c8" name="BIST_CTRL_5"/>
+
+	<reg32 offset="0x001d4" name="GLBL_TEST_CTRL">
+		<bitfield name="BITCLK_HS_SEL" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001dc" name="LDO_CNTRL"/>
+</domain>
+
+<domain name="DSI_28nm_PHY_REGULATOR" width="32">
+	<reg32 offset="0x00000" name="CTRL_0"/>
+	<reg32 offset="0x00004" name="CTRL_1"/>
+	<reg32 offset="0x00008" name="CTRL_2"/>
+	<reg32 offset="0x0000c" name="CTRL_3"/>
+	<reg32 offset="0x00010" name="CTRL_4"/>
+	<reg32 offset="0x00014" name="CTRL_5"/>
+	<reg32 offset="0x00018" name="CAL_PWR_CFG"/>
+</domain>
+
+<domain name="DSI_28nm_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="REFCLK_CFG">
+		<bitfield name="DBLR" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00004" name="POSTDIV1_CFG"/>
+	<reg32 offset="0x00008" name="CHGPUMP_CFG"/>
+	<reg32 offset="0x0000C" name="VCOLPF_CFG"/>
+	<reg32 offset="0x00010" name="VREG_CFG">
+		<bitfield name="POSTDIV1_BYPASS_B" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00014" name="PWRGEN_CFG"/>
+	<reg32 offset="0x00018" name="DMUX_CFG"/>
+	<reg32 offset="0x0001C" name="AMUX_CFG"/>
+	<reg32 offset="0x00020" name="GLB_CFG">
+		<bitfield name="PLL_PWRDN_B" pos="0" type="boolean"/>
+		<bitfield name="PLL_LDO_PWRDN_B" pos="1" type="boolean"/>
+		<bitfield name="PLL_PWRGEN_PWRDN_B" pos="2" type="boolean"/>
+		<bitfield name="PLL_ENABLE" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00024" name="POSTDIV2_CFG"/>
+	<reg32 offset="0x00028" name="POSTDIV3_CFG"/>
+	<reg32 offset="0x0002C" name="LPFR_CFG"/>
+	<reg32 offset="0x00030" name="LPFC1_CFG"/>
+	<reg32 offset="0x00034" name="LPFC2_CFG"/>
+	<reg32 offset="0x00038" name="SDM_CFG0">
+		<bitfield name="BYP_DIV" low="0" high="5" type="uint"/>
+		<bitfield name="BYP" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0003C" name="SDM_CFG1">
+		<bitfield name="DC_OFFSET" low="0" high="5" type="uint"/>
+		<bitfield name="DITHER_EN" pos="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00040" name="SDM_CFG2">
+		<bitfield name="FREQ_SEED_7_0" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00044" name="SDM_CFG3">
+		<bitfield name="FREQ_SEED_15_8" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00048" name="SDM_CFG4"/>
+	<reg32 offset="0x0004C" name="SSC_CFG0"/>
+	<reg32 offset="0x00050" name="SSC_CFG1"/>
+	<reg32 offset="0x00054" name="SSC_CFG2"/>
+	<reg32 offset="0x00058" name="SSC_CFG3"/>
+	<reg32 offset="0x0005C" name="LKDET_CFG0"/>
+	<reg32 offset="0x00060" name="LKDET_CFG1"/>
+	<reg32 offset="0x00064" name="LKDET_CFG2"/>
+	<reg32 offset="0x00068" name="TEST_CFG">
+		<bitfield name="PLL_SW_RESET" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0006C" name="CAL_CFG0"/>
+	<reg32 offset="0x00070" name="CAL_CFG1"/>
+	<reg32 offset="0x00074" name="CAL_CFG2"/>
+	<reg32 offset="0x00078" name="CAL_CFG3"/>
+	<reg32 offset="0x0007C" name="CAL_CFG4"/>
+	<reg32 offset="0x00080" name="CAL_CFG5"/>
+	<reg32 offset="0x00084" name="CAL_CFG6"/>
+	<reg32 offset="0x00088" name="CAL_CFG7"/>
+	<reg32 offset="0x0008C" name="CAL_CFG8"/>
+	<reg32 offset="0x00090" name="CAL_CFG9"/>
+	<reg32 offset="0x00094" name="CAL_CFG10"/>
+	<reg32 offset="0x00098" name="CAL_CFG11"/>
+	<reg32 offset="0x0009C" name="EFUSE_CFG"/>
+	<reg32 offset="0x000A0" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x000A4" name="CTRL_42"/>
+	<reg32 offset="0x000A8" name="CTRL_43"/>
+	<reg32 offset="0x000AC" name="CTRL_44"/>
+	<reg32 offset="0x000B0" name="CTRL_45"/>
+	<reg32 offset="0x000B4" name="CTRL_46"/>
+	<reg32 offset="0x000B8" name="CTRL_47"/>
+	<reg32 offset="0x000BC" name="CTRL_48"/>
+	<reg32 offset="0x000C0" name="STATUS">
+		<bitfield name="PLL_RDY" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000C4" name="DEBUG_BUS0"/>
+	<reg32 offset="0x000C8" name="DEBUG_BUS1"/>
+	<reg32 offset="0x000CC" name="DEBUG_BUS2"/>
+	<reg32 offset="0x000D0" name="DEBUG_BUS3"/>
+	<reg32 offset="0x000D4" name="CTRL_54"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/dsi_phy_28nm_8960.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/dsi_phy_28nm_8960.xml
@@ -0,0 +1,134 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_28nm_8960_PHY" width="32">
+
+	<array offset="0x00000" name="LN" length="4" stride="0x40">
+		<reg32 offset="0x00" name="CFG_0"/>
+		<reg32 offset="0x04" name="CFG_1"/>
+		<reg32 offset="0x08" name="CFG_2"/>
+		<reg32 offset="0x0c" name="TEST_DATAPATH"/>
+		<reg32 offset="0x14" name="TEST_STR_0"/>
+		<reg32 offset="0x18" name="TEST_STR_1"/>
+	</array>
+
+	<reg32 offset="0x00100" name="LNCK_CFG_0"/>
+	<reg32 offset="0x00104" name="LNCK_CFG_1"/>
+	<reg32 offset="0x00108" name="LNCK_CFG_2"/>
+
+	<reg32 offset="0x0010c" name="LNCK_TEST_DATAPATH"/>
+	<reg32 offset="0x00114" name="LNCK_TEST_STR0"/>
+	<reg32 offset="0x00118" name="LNCK_TEST_STR1"/>
+
+	<reg32 offset="0x00140" name="TIMING_CTRL_0">
+		<bitfield name="CLK_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00144" name="TIMING_CTRL_1">
+		<bitfield name="CLK_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00148" name="TIMING_CTRL_2">
+		<bitfield name="CLK_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0014c" name="TIMING_CTRL_3"/>
+
+	<reg32 offset="0x00150" name="TIMING_CTRL_4">
+		<bitfield name="HS_EXIT" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00154" name="TIMING_CTRL_5">
+		<bitfield name="HS_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00158" name="TIMING_CTRL_6">
+		<bitfield name="HS_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0015c" name="TIMING_CTRL_7">
+		<bitfield name="HS_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00160" name="TIMING_CTRL_8">
+		<bitfield name="HS_RQST" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00164" name="TIMING_CTRL_9">
+		<bitfield name="TA_GO" low="0" high="2" type="uint"/>
+		<bitfield name="TA_SURE" low="4" high="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00168" name="TIMING_CTRL_10">
+		<bitfield name="TA_GET" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0016c" name="TIMING_CTRL_11">
+		<bitfield name="TRIG3_CMD" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00170" name="CTRL_0"/>
+	<reg32 offset="0x00174" name="CTRL_1"/>
+	<reg32 offset="0x00178" name="CTRL_2"/>
+	<reg32 offset="0x0017c" name="CTRL_3"/>
+
+	<reg32 offset="0x00180" name="STRENGTH_0"/>
+	<reg32 offset="0x00184" name="STRENGTH_1"/>
+	<reg32 offset="0x00188" name="STRENGTH_2"/>
+
+	<reg32 offset="0x0018c" name="BIST_CTRL_0"/>
+	<reg32 offset="0x00190" name="BIST_CTRL_1"/>
+	<reg32 offset="0x00194" name="BIST_CTRL_2"/>
+	<reg32 offset="0x00198" name="BIST_CTRL_3"/>
+	<reg32 offset="0x0019c" name="BIST_CTRL_4"/>
+
+	<reg32 offset="0x001b0" name="LDO_CTRL"/>
+</domain>
+
+<domain name="DSI_28nm_8960_PHY_MISC" width="32">
+	<reg32 offset="0x00000" name="REGULATOR_CTRL_0"/>
+	<reg32 offset="0x00004" name="REGULATOR_CTRL_1"/>
+	<reg32 offset="0x00008" name="REGULATOR_CTRL_2"/>
+	<reg32 offset="0x0000c" name="REGULATOR_CTRL_3"/>
+	<reg32 offset="0x00010" name="REGULATOR_CTRL_4"/>
+	<reg32 offset="0x00014" name="REGULATOR_CTRL_5"/>
+	<reg32 offset="0x00018" name="REGULATOR_CAL_PWR_CFG"/>
+	<reg32 offset="0x00028" name="CAL_HW_TRIGGER"/>
+	<reg32 offset="0x0002c" name="CAL_SW_CFG_0"/>
+	<reg32 offset="0x00030" name="CAL_SW_CFG_1"/>
+	<reg32 offset="0x00034" name="CAL_SW_CFG_2"/>
+	<reg32 offset="0x00038" name="CAL_HW_CFG_0"/>
+	<reg32 offset="0x0003c" name="CAL_HW_CFG_1"/>
+	<reg32 offset="0x00040" name="CAL_HW_CFG_2"/>
+	<reg32 offset="0x00044" name="CAL_HW_CFG_3"/>
+	<reg32 offset="0x00048" name="CAL_HW_CFG_4"/>
+	<reg32 offset="0x00050" name="CAL_STATUS">
+		<bitfield name="CAL_BUSY" pos="4" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="DSI_28nm_8960_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="CTRL_0">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00004" name="CTRL_1"/>
+	<reg32 offset="0x00008" name="CTRL_2"/>
+	<reg32 offset="0x0000c" name="CTRL_3"/>
+	<reg32 offset="0x00010" name="CTRL_4"/>
+	<reg32 offset="0x00014" name="CTRL_5"/>
+	<reg32 offset="0x00018" name="CTRL_6"/>
+	<reg32 offset="0x0001c" name="CTRL_7"/>
+	<reg32 offset="0x00020" name="CTRL_8"/>
+	<reg32 offset="0x00024" name="CTRL_9"/>
+	<reg32 offset="0x00028" name="CTRL_10"/>
+	<reg32 offset="0x0002c" name="CTRL_11"/>
+	<reg32 offset="0x00030" name="CTRL_12"/>
+	<reg32 offset="0x00034" name="CTRL_13"/>
+	<reg32 offset="0x00038" name="CTRL_14"/>
+	<reg32 offset="0x0003c" name="CTRL_15"/>
+	<reg32 offset="0x00040" name="CTRL_16"/>
+	<reg32 offset="0x00044" name="CTRL_17"/>
+	<reg32 offset="0x00048" name="CTRL_18"/>
+	<reg32 offset="0x0004c" name="CTRL_19"/>
+	<reg32 offset="0x00050" name="CTRL_20"/>
+
+	<reg32 offset="0x00080" name="RDY">
+		<bitfield name="PLL_RDY" pos="0" type="boolean"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml
@@ -0,0 +1,230 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_7nm_PHY_CMN" width="32">
+	<reg32 offset="0x00000" name="REVISION_ID0"/>
+	<reg32 offset="0x00004" name="REVISION_ID1"/>
+	<reg32 offset="0x00008" name="REVISION_ID2"/>
+	<reg32 offset="0x0000c" name="REVISION_ID3"/>
+	<reg32 offset="0x00010" name="CLK_CFG0"/>
+	<reg32 offset="0x00014" name="CLK_CFG1"/>
+	<reg32 offset="0x00018" name="GLBL_CTRL"/>
+	<reg32 offset="0x0001c" name="RBUF_CTRL"/>
+	<reg32 offset="0x00020" name="VREG_CTRL_0"/>
+	<reg32 offset="0x00024" name="CTRL_0"/>
+	<reg32 offset="0x00028" name="CTRL_1"/>
+	<reg32 offset="0x0002c" name="CTRL_2"/>
+	<reg32 offset="0x00030" name="CTRL_3"/>
+	<reg32 offset="0x00034" name="LANE_CFG0"/>
+	<reg32 offset="0x00038" name="LANE_CFG1"/>
+	<reg32 offset="0x0003c" name="PLL_CNTRL"/>
+	<reg32 offset="0x00040" name="DPHY_SOT"/>
+	<reg32 offset="0x000a0" name="LANE_CTRL0"/>
+	<reg32 offset="0x000a4" name="LANE_CTRL1"/>
+	<reg32 offset="0x000a8" name="LANE_CTRL2"/>
+	<reg32 offset="0x000ac" name="LANE_CTRL3"/>
+	<reg32 offset="0x000b0" name="LANE_CTRL4"/>
+	<reg32 offset="0x000b4" name="TIMING_CTRL_0"/>
+	<reg32 offset="0x000b8" name="TIMING_CTRL_1"/>
+	<reg32 offset="0x000bc" name="TIMING_CTRL_2"/>
+	<reg32 offset="0x000c0" name="TIMING_CTRL_3"/>
+	<reg32 offset="0x000c4" name="TIMING_CTRL_4"/>
+	<reg32 offset="0x000c8" name="TIMING_CTRL_5"/>
+	<reg32 offset="0x000cc" name="TIMING_CTRL_6"/>
+	<reg32 offset="0x000d0" name="TIMING_CTRL_7"/>
+	<reg32 offset="0x000d4" name="TIMING_CTRL_8"/>
+	<reg32 offset="0x000d8" name="TIMING_CTRL_9"/>
+	<reg32 offset="0x000dc" name="TIMING_CTRL_10"/>
+	<reg32 offset="0x000e0" name="TIMING_CTRL_11"/>
+	<reg32 offset="0x000e4" name="TIMING_CTRL_12"/>
+	<reg32 offset="0x000e8" name="TIMING_CTRL_13"/>
+	<reg32 offset="0x000ec" name="GLBL_HSTX_STR_CTRL_0"/>
+	<reg32 offset="0x000f0" name="GLBL_HSTX_STR_CTRL_1"/>
+	<reg32 offset="0x000f4" name="GLBL_RESCODE_OFFSET_TOP_CTRL"/>
+	<reg32 offset="0x000f8" name="GLBL_RESCODE_OFFSET_BOT_CTRL"/>
+	<reg32 offset="0x000fc" name="GLBL_RESCODE_OFFSET_MID_CTRL"/>
+	<reg32 offset="0x00100" name="GLBL_LPTX_STR_CTRL"/>
+	<reg32 offset="0x00104" name="GLBL_PEMPH_CTRL_0"/>
+	<reg32 offset="0x00108" name="GLBL_PEMPH_CTRL_1"/>
+	<reg32 offset="0x0010c" name="GLBL_STR_SWI_CAL_SEL_CTRL"/>
+	<reg32 offset="0x00110" name="VREG_CTRL_1"/>
+	<reg32 offset="0x00114" name="CTRL_4"/>
+	<reg32 offset="0x00128" name="GLBL_DIGTOP_SPARE4"/>
+	<reg32 offset="0x00140" name="PHY_STATUS"/>
+	<reg32 offset="0x00148" name="LANE_STATUS0"/>
+	<reg32 offset="0x0014c" name="LANE_STATUS1"/>
+	<reg32 offset="0x001ac" name="GLBL_DIGTOP_SPARE10"/>
+</domain>
+
+<domain name="DSI_7nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="5" stride="0x80">
+		<reg32 offset="0x00" name="CFG0"/>
+		<reg32 offset="0x04" name="CFG1"/>
+		<reg32 offset="0x08" name="CFG2"/>
+		<reg32 offset="0x0c" name="TEST_DATAPATH"/>
+		<reg32 offset="0x10" name="PIN_SWAP"/>
+		<reg32 offset="0x14" name="LPRX_CTRL"/>
+		<reg32 offset="0x18" name="TX_DCTRL"/>
+	</array>
+</domain>
+
+<domain name="DSI_7nm_PHY_PLL" width="32">
+	<reg32 offset="0x0000" name="ANALOG_CONTROLS_ONE"/>
+	<reg32 offset="0x0004" name="ANALOG_CONTROLS_TWO"/>
+	<reg32 offset="0x0008" name="INT_LOOP_SETTINGS"/>
+	<reg32 offset="0x000c" name="INT_LOOP_SETTINGS_TWO"/>
+	<reg32 offset="0x0010" name="ANALOG_CONTROLS_THREE"/>
+	<reg32 offset="0x0014" name="ANALOG_CONTROLS_FOUR"/>
+	<reg32 offset="0x0018" name="ANALOG_CONTROLS_FIVE"/>
+	<reg32 offset="0x001c" name="INT_LOOP_CONTROLS"/>
+	<reg32 offset="0x0020" name="DSM_DIVIDER"/>
+	<reg32 offset="0x0024" name="FEEDBACK_DIVIDER"/>
+	<reg32 offset="0x0028" name="SYSTEM_MUXES"/>
+	<reg32 offset="0x002c" name="FREQ_UPDATE_CONTROL_OVERRIDES"/>
+	<reg32 offset="0x0030" name="CMODE"/>
+	<reg32 offset="0x0034" name="PSM_CTRL"/>
+	<reg32 offset="0x0038" name="RSM_CTRL"/>
+	<reg32 offset="0x003c" name="VCO_TUNE_MAP"/>
+	<reg32 offset="0x0040" name="PLL_CNTRL"/>
+	<reg32 offset="0x0044" name="CALIBRATION_SETTINGS"/>
+	<reg32 offset="0x0048" name="BAND_SEL_CAL_TIMER_LOW"/>
+	<reg32 offset="0x004c" name="BAND_SEL_CAL_TIMER_HIGH"/>
+	<reg32 offset="0x0050" name="BAND_SEL_CAL_SETTINGS"/>
+	<reg32 offset="0x0054" name="BAND_SEL_MIN"/>
+	<reg32 offset="0x0058" name="BAND_SEL_MAX"/>
+	<reg32 offset="0x005c" name="BAND_SEL_PFILT"/>
+	<reg32 offset="0x0060" name="BAND_SEL_IFILT"/>
+	<reg32 offset="0x0064" name="BAND_SEL_CAL_SETTINGS_TWO"/>
+	<reg32 offset="0x0068" name="BAND_SEL_CAL_SETTINGS_THREE"/>
+	<reg32 offset="0x006c" name="BAND_SEL_CAL_SETTINGS_FOUR"/>
+	<reg32 offset="0x0070" name="BAND_SEL_ICODE_HIGH"/>
+	<reg32 offset="0x0074" name="BAND_SEL_ICODE_LOW"/>
+	<reg32 offset="0x0078" name="FREQ_DETECT_SETTINGS_ONE"/>
+	<reg32 offset="0x007c" name="FREQ_DETECT_THRESH"/>
+	<reg32 offset="0x0080" name="FREQ_DET_REFCLK_HIGH"/>
+	<reg32 offset="0x0084" name="FREQ_DET_REFCLK_LOW"/>
+	<reg32 offset="0x0088" name="FREQ_DET_PLLCLK_HIGH"/>
+	<reg32 offset="0x008c" name="FREQ_DET_PLLCLK_LOW"/>
+	<reg32 offset="0x0090" name="PFILT"/>
+	<reg32 offset="0x0094" name="IFILT"/>
+	<reg32 offset="0x0098" name="PLL_GAIN"/>
+	<reg32 offset="0x009c" name="ICODE_LOW"/>
+	<reg32 offset="0x00a0" name="ICODE_HIGH"/>
+	<reg32 offset="0x00a4" name="LOCKDET"/>
+	<reg32 offset="0x00a8" name="OUTDIV"/>
+	<reg32 offset="0x00ac" name="FASTLOCK_CONTROL"/>
+	<reg32 offset="0x00b0" name="PASS_OUT_OVERRIDE_ONE"/>
+	<reg32 offset="0x00b4" name="PASS_OUT_OVERRIDE_TWO"/>
+	<reg32 offset="0x00b8" name="CORE_OVERRIDE"/>
+	<reg32 offset="0x00bc" name="CORE_INPUT_OVERRIDE"/>
+	<reg32 offset="0x00c0" name="RATE_CHANGE"/>
+	<reg32 offset="0x00c4" name="PLL_DIGITAL_TIMERS"/>
+	<reg32 offset="0x00c8" name="PLL_DIGITAL_TIMERS_TWO"/>
+	<reg32 offset="0x00cc" name="DECIMAL_DIV_START"/>
+	<reg32 offset="0x00d0" name="FRAC_DIV_START_LOW"/>
+	<reg32 offset="0x00d4" name="FRAC_DIV_START_MID"/>
+	<reg32 offset="0x00d8" name="FRAC_DIV_START_HIGH"/>
+	<reg32 offset="0x00dc" name="DEC_FRAC_MUXES"/>
+	<reg32 offset="0x00e0" name="DECIMAL_DIV_START_1"/>
+	<reg32 offset="0x00e4" name="FRAC_DIV_START_LOW_1"/>
+	<reg32 offset="0x00e8" name="FRAC_DIV_START_MID_1"/>
+	<reg32 offset="0x00ec" name="FRAC_DIV_START_HIGH_1"/>
+	<reg32 offset="0x00f0" name="DECIMAL_DIV_START_2"/>
+	<reg32 offset="0x00f4" name="FRAC_DIV_START_LOW_2"/>
+	<reg32 offset="0x00f8" name="FRAC_DIV_START_MID_2"/>
+	<reg32 offset="0x00fc" name="FRAC_DIV_START_HIGH_2"/>
+	<reg32 offset="0x0100" name="MASH_CONTROL"/>
+	<reg32 offset="0x0104" name="SSC_STEPSIZE_LOW"/>
+	<reg32 offset="0x0108" name="SSC_STEPSIZE_HIGH"/>
+	<reg32 offset="0x010c" name="SSC_DIV_PER_LOW"/>
+	<reg32 offset="0x0110" name="SSC_DIV_PER_HIGH"/>
+	<reg32 offset="0x0114" name="SSC_ADJPER_LOW"/>
+	<reg32 offset="0x0118" name="SSC_ADJPER_HIGH"/>
+	<reg32 offset="0x011c" name="SSC_MUX_CONTROL"/>
+	<reg32 offset="0x0120" name="SSC_STEPSIZE_LOW_1"/>
+	<reg32 offset="0x0124" name="SSC_STEPSIZE_HIGH_1"/>
+	<reg32 offset="0x0128" name="SSC_DIV_PER_LOW_1"/>
+	<reg32 offset="0x012c" name="SSC_DIV_PER_HIGH_1"/>
+	<reg32 offset="0x0130" name="SSC_ADJPER_LOW_1"/>
+	<reg32 offset="0x0134" name="SSC_ADJPER_HIGH_1"/>
+	<reg32 offset="0x0138" name="SSC_STEPSIZE_LOW_2"/>
+	<reg32 offset="0x013c" name="SSC_STEPSIZE_HIGH_2"/>
+	<reg32 offset="0x0140" name="SSC_DIV_PER_LOW_2"/>
+	<reg32 offset="0x0144" name="SSC_DIV_PER_HIGH_2"/>
+	<reg32 offset="0x0148" name="SSC_ADJPER_LOW_2"/>
+	<reg32 offset="0x014c" name="SSC_ADJPER_HIGH_2"/>
+	<reg32 offset="0x0150" name="SSC_CONTROL"/>
+	<reg32 offset="0x0154" name="PLL_OUTDIV_RATE"/>
+	<reg32 offset="0x0158" name="PLL_LOCKDET_RATE_1"/>
+	<reg32 offset="0x015c" name="PLL_LOCKDET_RATE_2"/>
+	<reg32 offset="0x0160" name="PLL_PROP_GAIN_RATE_1"/>
+	<reg32 offset="0x0164" name="PLL_PROP_GAIN_RATE_2"/>
+	<reg32 offset="0x0168" name="PLL_BAND_SEL_RATE_1"/>
+	<reg32 offset="0x016c" name="PLL_BAND_SEL_RATE_2"/>
+	<reg32 offset="0x0170" name="PLL_INT_GAIN_IFILT_BAND_1"/>
+	<reg32 offset="0x0174" name="PLL_INT_GAIN_IFILT_BAND_2"/>
+	<reg32 offset="0x0178" name="PLL_FL_INT_GAIN_PFILT_BAND_1"/>
+	<reg32 offset="0x017c" name="PLL_FL_INT_GAIN_PFILT_BAND_2"/>
+	<reg32 offset="0x0180" name="PLL_FASTLOCK_EN_BAND"/>
+	<reg32 offset="0x0184" name="FREQ_TUNE_ACCUM_INIT_MID"/>
+	<reg32 offset="0x0188" name="FREQ_TUNE_ACCUM_INIT_HIGH"/>
+	<reg32 offset="0x018c" name="FREQ_TUNE_ACCUM_INIT_MUX"/>
+	<reg32 offset="0x0190" name="PLL_LOCK_OVERRIDE"/>
+	<reg32 offset="0x0194" name="PLL_LOCK_DELAY"/>
+	<reg32 offset="0x0198" name="PLL_LOCK_MIN_DELAY"/>
+	<reg32 offset="0x019c" name="CLOCK_INVERTERS"/>
+	<reg32 offset="0x01a0" name="SPARE_AND_JPC_OVERRIDES"/>
+	<reg32 offset="0x01a4" name="BIAS_CONTROL_1"/>
+	<reg32 offset="0x01a8" name="BIAS_CONTROL_2"/>
+	<reg32 offset="0x01ac" name="ALOG_OBSV_BUS_CTRL_1"/>
+	<reg32 offset="0x01b0" name="COMMON_STATUS_ONE"/>
+	<reg32 offset="0x01b4" name="COMMON_STATUS_TWO"/>
+	<reg32 offset="0x01b8" name="BAND_SEL_CAL"/>
+	<reg32 offset="0x01bc" name="ICODE_ACCUM_STATUS_LOW"/>
+	<reg32 offset="0x01c0" name="ICODE_ACCUM_STATUS_HIGH"/>
+	<reg32 offset="0x01c4" name="FD_OUT_LOW"/>
+	<reg32 offset="0x01c8" name="FD_OUT_HIGH"/>
+	<reg32 offset="0x01cc" name="ALOG_OBSV_BUS_STATUS_1"/>
+	<reg32 offset="0x01d0" name="PLL_MISC_CONFIG"/>
+	<reg32 offset="0x01d4" name="FLL_CONFIG"/>
+	<reg32 offset="0x01d8" name="FLL_FREQ_ACQ_TIME"/>
+	<reg32 offset="0x01dc" name="FLL_CODE0"/>
+	<reg32 offset="0x01e0" name="FLL_CODE1"/>
+	<reg32 offset="0x01e4" name="FLL_GAIN0"/>
+	<reg32 offset="0x01e8" name="FLL_GAIN1"/>
+	<reg32 offset="0x01ec" name="SW_RESET"/>
+	<reg32 offset="0x01f0" name="FAST_PWRUP"/>
+	<reg32 offset="0x01f4" name="LOCKTIME0"/>
+	<reg32 offset="0x01f8" name="LOCKTIME1"/>
+	<reg32 offset="0x01fc" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x0200" name="DEBUG_BUS0"/>
+	<reg32 offset="0x0204" name="DEBUG_BUS1"/>
+	<reg32 offset="0x0208" name="DEBUG_BUS2"/>
+	<reg32 offset="0x020c" name="DEBUG_BUS3"/>
+	<reg32 offset="0x0210" name="ANALOG_FLL_CONTROL_OVERRIDES"/>
+	<reg32 offset="0x0214" name="VCO_CONFIG"/>
+	<reg32 offset="0x0218" name="VCO_CAL_CODE1_MODE0_STATUS"/>
+	<reg32 offset="0x021c" name="VCO_CAL_CODE1_MODE1_STATUS"/>
+	<reg32 offset="0x0220" name="RESET_SM_STATUS"/>
+	<reg32 offset="0x0224" name="TDC_OFFSET"/>
+	<reg32 offset="0x0228" name="PS3_PWRDOWN_CONTROLS"/>
+	<reg32 offset="0x022c" name="PS4_PWRDOWN_CONTROLS"/>
+	<reg32 offset="0x0230" name="PLL_RST_CONTROLS"/>
+	<reg32 offset="0x0234" name="GEAR_BAND_SELECT_CONTROLS"/>
+	<reg32 offset="0x0238" name="PSM_CLK_CONTROLS"/>
+	<reg32 offset="0x023c" name="SYSTEM_MUXES_2"/>
+	<reg32 offset="0x0240" name="VCO_CONFIG_1"/>
+	<reg32 offset="0x0244" name="VCO_CONFIG_2"/>
+	<reg32 offset="0x0248" name="CLOCK_INVERTERS_1"/>
+	<reg32 offset="0x024c" name="CLOCK_INVERTERS_2"/>
+	<reg32 offset="0x0250" name="CMODE_1"/>
+	<reg32 offset="0x0254" name="CMODE_2"/>
+	<reg32 offset="0x0258" name="ANALOG_CONTROLS_FIVE_1"/>
+	<reg32 offset="0x025c" name="ANALOG_CONTROLS_FIVE_2"/>
+	<reg32 offset="0x0260" name="PERF_OPTIMIZE"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/edp.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/edp.xml
@@ -0,0 +1,239 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="EDP" width="32">
+	<enum name="edp_color_depth">
+		<value name="EDP_6BIT"  value="0"/>
+		<value name="EDP_8BIT"  value="1"/>
+		<value name="EDP_10BIT" value="2"/>
+		<value name="EDP_12BIT" value="3"/>
+		<value name="EDP_16BIT" value="4"/>
+	</enum>
+
+	<enum name="edp_component_format">
+		<value name="EDP_RGB" value="0"/>
+		<value name="EDP_YUV422" value="1"/>
+		<value name="EDP_YUV444" value="2"/>
+	</enum>
+
+	<reg32 offset="0x0004" name="MAINLINK_CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="RESET"  pos="1" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0008" name="STATE_CTRL">
+		<bitfield name="TRAIN_PATTERN_1"       pos="0" type="boolean"/>
+		<bitfield name="TRAIN_PATTERN_2"       pos="1" type="boolean"/>
+		<bitfield name="TRAIN_PATTERN_3"       pos="2" type="boolean"/>
+		<bitfield name="SYMBOL_ERR_RATE_MEAS"  pos="3" type="boolean"/>
+		<bitfield name="PRBS7"                 pos="4" type="boolean"/>
+		<bitfield name="CUSTOM_80_BIT_PATTERN" pos="5" type="boolean"/>
+		<bitfield name="SEND_VIDEO"            pos="6" type="boolean"/>
+		<bitfield name="PUSH_IDLE"             pos="7" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x000c" name="CONFIGURATION_CTRL">
+		<!-- next two may be swapped? -->
+		<bitfield name="SYNC_CLK" pos="0" type="boolean"/>
+		<bitfield name="STATIC_MVID" pos="1" type="boolean"/>
+		<bitfield name="PROGRESSIVE" pos="2" type="boolean"/>
+		<!-- # of lanes minus one: -->
+		<bitfield name="LANES" low="4" high="5" type="uint"/>
+		<bitfield name="ENHANCED_FRAMING" pos="6" type="boolean"/>
+		<!--
+		   NOTE: only 6bit and 8bit valid
+		 -->
+		<bitfield name="COLOR" pos="8" type="edp_color_depth"/>
+	</reg32>
+
+	<reg32 offset="0x0014" name="SOFTWARE_MVID" type="uint"/>
+	<reg32 offset="0x0018" name="SOFTWARE_NVID" type="uint"/>
+
+	<reg32 offset="0x001c" name="TOTAL_HOR_VER">
+		<bitfield name="HORIZ" low="0" high="15" type="uint"/>
+		<bitfield name="VERT"  low="16" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0020" name="START_HOR_VER_FROM_SYNC">
+		<bitfield name="HORIZ" low="0" high="15" type="uint"/>
+		<bitfield name="VERT"  low="16" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0024" name="HSYNC_VSYNC_WIDTH_POLARITY">
+		<bitfield name="HORIZ"  low="0" high="14" type="uint"/>
+		<bitfield name="NHSYNC" pos="15" type="boolean"/>
+		<bitfield name="VERT"   low="16" high="30" type="uint"/>
+		<bitfield name="NVSYNC" pos="31" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0028" name="ACTIVE_HOR_VER">
+		<bitfield name="HORIZ" low="0" high="15" type="uint"/>
+		<bitfield name="VERT"  low="16" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x002c" name="MISC1_MISC0">
+		<!-- MISC0 from DisplayPort v1.2 spec: -->
+		<bitfield name="MISC0" low="0" high="7"/>
+		<!-- aliased MISC0 bitfields: -->
+		<bitfield name="SYNC" pos="0" type="boolean"/>
+		<bitfield name="COMPONENT_FORMAT" low="1" high="2" type="edp_component_format"/>
+		<!-- CEA (vs VESA) color range: -->
+		<bitfield name="CEA" pos="3" type="boolean"/>
+		<!-- YCbCr Colorimetry ITU-R BT709-5 (vs ITU-R BT601-5): -->
+		<bitfield name="BT709_5" pos="4" type="boolean"/>
+		<bitfield name="COLOR" low="5" high="7" type="edp_color_depth"/>
+
+		<!-- MISC1 from DisplayPort v1.2 spec: -->
+		<bitfield name="MISC1" low="8" high="15"/>
+		<!-- aliased MISC1 bitfields: -->
+		<bitfield name="INTERLACED_ODD" pos="8" type="boolean"/>
+		<bitfield name="STEREO" low="9" high="10" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0074" name="PHY_CTRL">
+		<bitfield name="SW_RESET_PLL" pos="0" type="boolean"/>
+		<bitfield name="SW_RESET" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0084" name="MAINLINK_READY">
+		<bitfield name="TRAIN_PATTERN_1_READY" pos="3" type="boolean"/>
+		<bitfield name="TRAIN_PATTERN_2_READY" pos="4" type="boolean"/>
+		<bitfield name="TRAIN_PATTERN_3_READY" pos="5" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0300" name="AUX_CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="RESET"  pos="1" type="boolean"/>
+	</reg32>
+
+	<!-- interrupt registers come in sets of 3 bits, status/ack/en -->
+	<reg32 offset="0x0308" name="INTERRUPT_REG_1">
+		<bitfield name="HPD"                    pos="0"  type="boolean"/>
+		<bitfield name="HPD_ACK"                pos="1"  type="boolean"/>
+		<bitfield name="HPD_EN"                 pos="2"  type="boolean"/>
+		<bitfield name="AUX_I2C_DONE"           pos="3"  type="boolean"/>
+		<bitfield name="AUX_I2C_DONE_ACK"       pos="4"  type="boolean"/>
+		<bitfield name="AUX_I2C_DONE_EN"        pos="5"  type="boolean"/>
+		<bitfield name="WRONG_ADDR"             pos="6"  type="boolean"/>
+		<bitfield name="WRONG_ADDR_ACK"         pos="7"  type="boolean"/>
+		<bitfield name="WRONG_ADDR_EN"          pos="8"  type="boolean"/>
+		<bitfield name="TIMEOUT"                pos="9"  type="boolean"/>
+		<bitfield name="TIMEOUT_ACK"            pos="10" type="boolean"/>
+		<bitfield name="TIMEOUT_EN"             pos="11" type="boolean"/>
+		<bitfield name="NACK_DEFER"             pos="12" type="boolean"/>
+		<bitfield name="NACK_DEFER_ACK"         pos="13" type="boolean"/>
+		<bitfield name="NACK_DEFER_EN"          pos="14" type="boolean"/>
+		<bitfield name="WRONG_DATA_CNT"         pos="15" type="boolean"/>
+		<bitfield name="WRONG_DATA_CNT_ACK"     pos="16" type="boolean"/>
+		<bitfield name="WRONG_DATA_CNT_EN"      pos="17" type="boolean"/>
+		<bitfield name="I2C_NACK"               pos="18" type="boolean"/>
+		<bitfield name="I2C_NACK_ACK"           pos="19" type="boolean"/>
+		<bitfield name="I2C_NACK_EN"            pos="20" type="boolean"/>
+		<bitfield name="I2C_DEFER"              pos="21" type="boolean"/>
+		<bitfield name="I2C_DEFER_ACK"          pos="22" type="boolean"/>
+		<bitfield name="I2C_DEFER_EN"           pos="23" type="boolean"/>
+		<bitfield name="PLL_UNLOCK"             pos="24" type="boolean"/>
+		<bitfield name="PLL_UNLOCK_ACK"         pos="25" type="boolean"/>
+		<bitfield name="PLL_UNLOCK_EN"          pos="26" type="boolean"/>
+		<bitfield name="AUX_ERROR"              pos="27" type="boolean"/>
+		<bitfield name="AUX_ERROR_ACK"          pos="28" type="boolean"/>
+		<bitfield name="AUX_ERROR_EN"           pos="29" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x030c" name="INTERRUPT_REG_2">
+		<bitfield name="READY_FOR_VIDEO"        pos="0"  type="boolean"/>
+		<bitfield name="READY_FOR_VIDEO_ACK"    pos="1"  type="boolean"/>
+		<bitfield name="READY_FOR_VIDEO_EN"     pos="2"  type="boolean"/>
+		<bitfield name="IDLE_PATTERNs_SENT"     pos="3"  type="boolean"/>
+		<bitfield name="IDLE_PATTERNs_SENT_ACK" pos="4"  type="boolean"/>
+		<bitfield name="IDLE_PATTERNs_SENT_EN"  pos="5"  type="boolean"/>
+		<bitfield name="FRAME_END"              pos="9"  type="boolean"/>
+		<bitfield name="FRAME_END_ACK"          pos="7"  type="boolean"/>
+		<bitfield name="FRAME_END_EN"           pos="8"  type="boolean"/>
+		<bitfield name="CRC_UPDATED"            pos="9"  type="boolean"/>
+		<bitfield name="CRC_UPDATED_ACK"        pos="10" type="boolean"/>
+		<bitfield name="CRC_UPDATED_EN"         pos="11" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0310" name="INTERRUPT_TRANS_NUM"/>
+	<reg32 offset="0x0314" name="AUX_DATA">
+		<bitfield name="READ" pos="0" type="boolean"/>
+		<bitfield name="DATA" low="8" high="15"/>
+		<bitfield name="INDEX" low="16" high="23"/>
+		<bitfield name="INDEX_WRITE" pos="31" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0318" name="AUX_TRANS_CTRL">
+		<bitfield name="I2C" pos="8" type="boolean"/>
+		<bitfield name="GO"  pos="9" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0324" name="AUX_STATUS"/>
+</domain>
+
+<domain name="EDP_PHY" width="32">
+	<array offset="0x0400" name="LN" length="4" stride="0x40">
+		<reg32 offset="0x04" name="PD_CTL"/>
+	</array>
+	<reg32 offset="0x0510" name="GLB_VM_CFG0"/>
+	<reg32 offset="0x0514" name="GLB_VM_CFG1"/>
+	<reg32 offset="0x0518" name="GLB_MISC9"/>
+	<reg32 offset="0x0528" name="GLB_CFG"/>
+	<reg32 offset="0x052c" name="GLB_PD_CTL"/>
+	<reg32 offset="0x0598" name="GLB_PHY_STATUS"/>
+</domain>
+
+<domain name="EDP_28nm_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="REFCLK_CFG"/>
+	<reg32 offset="0x00004" name="POSTDIV1_CFG"/>
+	<reg32 offset="0x00008" name="CHGPUMP_CFG"/>
+	<reg32 offset="0x0000C" name="VCOLPF_CFG"/>
+	<reg32 offset="0x00010" name="VREG_CFG"/>
+	<reg32 offset="0x00014" name="PWRGEN_CFG"/>
+	<reg32 offset="0x00018" name="DMUX_CFG"/>
+	<reg32 offset="0x0001C" name="AMUX_CFG"/>
+	<reg32 offset="0x00020" name="GLB_CFG">
+		<bitfield name="PLL_PWRDN_B" pos="0" type="boolean"/>
+		<bitfield name="PLL_LDO_PWRDN_B" pos="1" type="boolean"/>
+		<bitfield name="PLL_PWRGEN_PWRDN_B" pos="2" type="boolean"/>
+		<bitfield name="PLL_ENABLE" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00024" name="POSTDIV2_CFG"/>
+	<reg32 offset="0x00028" name="POSTDIV3_CFG"/>
+	<reg32 offset="0x0002C" name="LPFR_CFG"/>
+	<reg32 offset="0x00030" name="LPFC1_CFG"/>
+	<reg32 offset="0x00034" name="LPFC2_CFG"/>
+	<reg32 offset="0x00038" name="SDM_CFG0"/>
+	<reg32 offset="0x0003C" name="SDM_CFG1"/>
+	<reg32 offset="0x00040" name="SDM_CFG2"/>
+	<reg32 offset="0x00044" name="SDM_CFG3"/>
+	<reg32 offset="0x00048" name="SDM_CFG4"/>
+	<reg32 offset="0x0004C" name="SSC_CFG0"/>
+	<reg32 offset="0x00050" name="SSC_CFG1"/>
+	<reg32 offset="0x00054" name="SSC_CFG2"/>
+	<reg32 offset="0x00058" name="SSC_CFG3"/>
+	<reg32 offset="0x0005C" name="LKDET_CFG0"/>
+	<reg32 offset="0x00060" name="LKDET_CFG1"/>
+	<reg32 offset="0x00064" name="LKDET_CFG2"/>
+	<reg32 offset="0x00068" name="TEST_CFG">
+		<bitfield name="PLL_SW_RESET" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0006C" name="CAL_CFG0"/>
+	<reg32 offset="0x00070" name="CAL_CFG1"/>
+	<reg32 offset="0x00074" name="CAL_CFG2"/>
+	<reg32 offset="0x00078" name="CAL_CFG3"/>
+	<reg32 offset="0x0007C" name="CAL_CFG4"/>
+	<reg32 offset="0x00080" name="CAL_CFG5"/>
+	<reg32 offset="0x00084" name="CAL_CFG6"/>
+	<reg32 offset="0x00088" name="CAL_CFG7"/>
+	<reg32 offset="0x0008C" name="CAL_CFG8"/>
+	<reg32 offset="0x00090" name="CAL_CFG9"/>
+	<reg32 offset="0x00094" name="CAL_CFG10"/>
+	<reg32 offset="0x00098" name="CAL_CFG11"/>
+	<reg32 offset="0x0009C" name="EFUSE_CFG"/>
+	<reg32 offset="0x000A0" name="DEBUG_BUS_SEL"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/hdmi.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/hdmi.xml
@@ -0,0 +1,1104 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<!--
+	NOTE: also see mdss_hdmi_util.h.. newer devices using MDSS appear
+	to have the same HDMI block (or maybe a newer version?) but for
+	some reason duplicate the code under drivers/video/msm/mdss
+ -->
+
+<domain name="HDMI" width="32">
+	<enum name="hdmi_hdcp_key_state">
+		<value name="HDCP_KEYS_STATE_NO_KEYS" value="0"/>
+		<value name="HDCP_KEYS_STATE_NOT_CHECKED" value="1"/>
+		<value name="HDCP_KEYS_STATE_CHECKING" value="2"/>
+		<value name="HDCP_KEYS_STATE_VALID" value="3"/>
+		<value name="HDCP_KEYS_STATE_AKSV_NOT_VALID" value="4"/>
+		<value name="HDCP_KEYS_STATE_CHKSUM_MISMATCH" value="5"/>
+		<value name="HDCP_KEYS_STATE_PROD_AKSV" value="6"/>
+		<value name="HDCP_KEYS_STATE_RESERVED" value="7"/>
+	</enum>
+	<enum name="hdmi_ddc_read_write">
+		<value name="DDC_WRITE" value="0"/>
+		<value name="DDC_READ" value="1"/>
+	</enum>
+	<enum name="hdmi_acr_cts">
+		<value name="ACR_NONE" value="0"/>
+		<value name="ACR_32" value="1"/>
+		<value name="ACR_44" value="2"/>
+		<value name="ACR_48" value="3"/>
+	</enum>
+
+	<enum name="hdmi_cec_tx_status">
+		<value name="CEC_TX_OK" value="0"/>
+		<value name="CEC_TX_NACK" value="1"/>
+		<value name="CEC_TX_ARB_LOSS" value="2"/>
+		<value name="CEC_TX_MAX_RETRIES" value="3"/>
+	</enum>
+
+	<reg32 offset="0x00000" name="CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="HDMI" pos="1" type="boolean"/>
+		<bitfield name="ENCRYPTED" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00020" name="AUDIO_PKT_CTRL1">
+		<bitfield name="AUDIO_SAMPLE_SEND" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00024" name="ACR_PKT_CTRL">
+		<!--
+			Guessing on order of bitfields from these comments:
+				/* AUDIO_PRIORITY | SOURCE */
+				acr_pck_ctrl_reg |= 0x80000100;
+				/* N_MULTIPLE(multiplier) */
+				acr_pck_ctrl_reg |= (multiplier & 7) << 16;
+				/* SEND | CONT */
+				acr_pck_ctrl_reg |= 0x00000003;
+		 -->
+		<bitfield name="CONT" pos="0" type="boolean"/>
+		<bitfield name="SEND" pos="1" type="boolean"/>
+		<bitfield name="SELECT" low="4" high="5" type="hdmi_acr_cts"/>
+		<bitfield name="SOURCE" pos="8" type="boolean"/>
+		<bitfield name="N_MULTIPLIER" low="16" high="18" type="uint"/>
+		<bitfield name="AUDIO_PRIORITY" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0028" name="VBI_PKT_CTRL">
+		<!--
+			Guessing on the order of bits from:
+				/* GC packet enable (every frame) */
+				/* HDMI_VBI_PKT_CTRL[0x0028] */
+				hdmi_msm_rmw32or(0x0028, 3 << 4);
+				/* HDMI_VBI_PKT_CTRL[0x0028] */
+				/* ISRC Send + Continuous */
+				hdmi_msm_rmw32or(0x0028, 3 << 8);
+				/* HDMI_VBI_PKT_CTRL[0x0028] */
+				/* ACP send, s/w source */
+				hdmi_msm_rmw32or(0x0028, 3 << 12);
+		 -->
+		<bitfield name="GC_ENABLE" pos="4" type="boolean"/>
+		<bitfield name="GC_EVERY_FRAME" pos="5" type="boolean"/>
+		<bitfield name="ISRC_SEND" pos="8" type="boolean"/>
+		<bitfield name="ISRC_CONTINUOUS" pos="9" type="boolean"/>
+		<bitfield name="ACP_SEND" pos="12" type="boolean"/>
+		<bitfield name="ACP_SRC_SW" pos="13" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0002c" name="INFOFRAME_CTRL0">
+		<!--
+			Guessing on the order of these flags, from this comment:
+				/* Set these flags */
+				/* AUDIO_INFO_UPDATE | AUDIO_INFO_SOURCE | AUDIO_INFO_CONT
+				 | AUDIO_INFO_SEND */
+				audio_info_ctrl_reg |= 0x000000F0;
+				/* 0x3 for AVI InfFrame enable (every frame) */
+				HDMI_OUTP(0x002C, HDMI_INP(0x002C) | 0x00000003L);
+		 -->
+		<bitfield name="AVI_SEND" pos="0" type="boolean"/>
+		<bitfield name="AVI_CONT" pos="1" type="boolean"/>           <!-- every frame -->
+		<bitfield name="AUDIO_INFO_SEND" pos="4" type="boolean"/>
+		<bitfield name="AUDIO_INFO_CONT" pos="5" type="boolean"/>    <!-- every frame -->
+		<bitfield name="AUDIO_INFO_SOURCE" pos="6" type="boolean"/>
+		<bitfield name="AUDIO_INFO_UPDATE" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00030" name="INFOFRAME_CTRL1">
+		<bitfield name="AVI_INFO_LINE" low="0" high="5" type="uint"/>
+		<bitfield name="AUDIO_INFO_LINE" low="8" high="13" type="uint"/>
+		<bitfield name="MPEG_INFO_LINE" low="16" high="21" type="uint"/>
+		<bitfield name="VENSPEC_INFO_LINE" low="24" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00034" name="GEN_PKT_CTRL">
+		<!--
+			0x0034 GEN_PKT_CTRL
+			  GENERIC0_SEND   0      0 = Disable Generic0 Packet Transmission
+			                         1 = Enable Generic0 Packet Transmission
+			  GENERIC0_CONT   1      0 = Send Generic0 Packet on next frame only
+			                         1 = Send Generic0 Packet on every frame
+			  GENERIC0_UPDATE 2      NUM
+			  GENERIC1_SEND   4      0 = Disable Generic1 Packet Transmission
+			                         1 = Enable Generic1 Packet Transmission
+			  GENERIC1_CONT   5      0 = Send Generic1 Packet on next frame only
+			                         1 = Send Generic1 Packet on every frame
+			  GENERIC0_LINE   21:16  NUM
+			  GENERIC1_LINE   29:24  NUM
+			
+			GENERIC0_LINE | GENERIC0_UPDATE | GENERIC0_CONT | GENERIC0_SEND
+			Setup HDMI TX generic packet control
+			Enable this packet to transmit every frame
+			Enable this packet to transmit every frame
+			Enable HDMI TX engine to transmit Generic packet 0
+			  HDMI_OUTP(0x0034, (1 << 16) | (1 << 2) | BIT(1) | BIT(0));
+		 -->
+		<bitfield name="GENERIC0_SEND" pos="0" type="boolean"/>
+		<bitfield name="GENERIC0_CONT" pos="1" type="boolean"/>
+		<bitfield name="GENERIC0_UPDATE" low="2" high="3" type="uint"/> <!-- ??? -->
+		<bitfield name="GENERIC1_SEND" pos="4" type="boolean"/>
+		<bitfield name="GENERIC1_CONT" pos="5" type="boolean"/>
+		<bitfield name="GENERIC0_LINE" low="16" high="21" type="uint"/>
+		<bitfield name="GENERIC1_LINE" low="24" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00040" name="GC">
+		<bitfield name="MUTE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00044" name="AUDIO_PKT_CTRL2">
+		<bitfield name="OVERRIDE" pos="0" type="boolean"/>
+		<bitfield name="LAYOUT" pos="1" type="boolean"/> <!-- 1 for >2 channels -->
+	</reg32>
+
+	<!--
+		AVI_INFO appears to be the infoframe in a slightly weird order..
+		starts with PB0 (checksum), and ends with version..
+	-->
+	<reg32 offset="0x0006c" name="AVI_INFO" stride="4" length="4"/>
+
+	<reg32 offset="0x00084" name="GENERIC0_HDR"/>
+	<reg32 offset="0x00088" name="GENERIC0" stride="4" length="7"/>
+
+	<reg32 offset="0x000a4" name="GENERIC1_HDR"/>
+	<reg32 offset="0x000a8" name="GENERIC1" stride="4" length="7"/>
+
+	<!--
+		TODO add a way to show symbolic offsets into array: hdmi_acr_cts-1
+	 -->
+	<array offset="0x00c4" name="ACR" length="3" stride="8" index="hdmi_acr_cts">
+		<reg32 offset="0" name="0">
+			<bitfield name="CTS" low="12" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="4" name="1">
+			<!-- not sure the actual # of bits.. -->
+			<bitfield name="N" low="0" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0x000e4" name="AUDIO_INFO0">
+		<bitfield name="CHECKSUM" low="0" high="7"/>
+		<bitfield name="CC" low="8" high="10" type="uint"/> <!-- channel count -->
+	</reg32>
+	<reg32 offset="0x000e8" name="AUDIO_INFO1">
+		<bitfield name="CA" low="0" high="7"/>        <!-- Channel Allocation -->
+		<bitfield name="LSV" low="11" high="14"/>     <!-- Level Shift -->
+		<bitfield name="DM_INH" pos="15" type="boolean"/>  <!-- down-mix inhibit flag -->
+	</reg32>
+	<reg32 offset="0x00110" name="HDCP_CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="ENCRYPTION_ENABLE" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00114" name="HDCP_DEBUG_CTRL">
+		<bitfield name="RNG_CIPHER" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00118" name="HDCP_INT_CTRL">
+		<bitfield name="AUTH_SUCCESS_INT" pos="0" type="boolean"/>
+		<bitfield name="AUTH_SUCCESS_ACK" pos="1" type="boolean"/>
+		<bitfield name="AUTH_SUCCESS_MASK" pos="2" type="boolean"/>
+		<bitfield name="AUTH_FAIL_INT" pos="4" type="boolean"/>
+		<bitfield name="AUTH_FAIL_ACK" pos="5" type="boolean"/>
+		<bitfield name="AUTH_FAIL_MASK" pos="6" type="boolean"/>
+		<bitfield name="AUTH_FAIL_INFO_ACK" pos="7" type="boolean"/>
+		<bitfield name="AUTH_XFER_REQ_INT" pos="8" type="boolean"/>
+		<bitfield name="AUTH_XFER_REQ_ACK" pos="9" type="boolean"/>
+		<bitfield name="AUTH_XFER_REQ_MASK" pos="10" type="boolean"/>
+		<bitfield name="AUTH_XFER_DONE_INT" pos="12" type="boolean"/>
+		<bitfield name="AUTH_XFER_DONE_ACK" pos="13" type="boolean"/>
+		<bitfield name="AUTH_XFER_DONE_MASK" pos="14" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0011c" name="HDCP_LINK0_STATUS">
+		<bitfield name="AN_0_READY" pos="8" type="boolean"/>
+		<bitfield name="AN_1_READY" pos="9" type="boolean"/>
+		<bitfield name="RI_MATCHES" pos="12" type="boolean"/>
+		<bitfield name="V_MATCHES" pos="20" type="boolean"/>
+		<bitfield name="KEY_STATE" low="28" high="30" type="hdmi_hdcp_key_state"/>
+	</reg32>
+	<reg32 offset="0x00120" name="HDCP_DDC_CTRL_0">
+		<bitfield name="DISABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00124" name="HDCP_DDC_CTRL_1">
+		<bitfield name="FAILED_ACK" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00128" name="HDCP_DDC_STATUS">
+		<bitfield name="XFER_REQ" pos="4" type="boolean"/>
+		<bitfield name="XFER_DONE" pos="10" type="boolean"/>
+		<bitfield name="ABORTED" pos="12" type="boolean"/>
+		<bitfield name="TIMEOUT" pos="13" type="boolean"/>
+		<bitfield name="NACK0" pos="14" type="boolean"/>
+		<bitfield name="NACK1" pos="15" type="boolean"/>
+		<bitfield name="FAILED" pos="16" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0012c" name="HDCP_ENTROPY_CTRL0"/>
+	<reg32 offset="0x0025c" name="HDCP_ENTROPY_CTRL1"/>
+
+	<reg32 offset="0x00130" name="HDCP_RESET">
+		<bitfield name="LINK0_DEAUTHENTICATE" pos="0" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00134" name="HDCP_RCVPORT_DATA0"/>
+	<reg32 offset="0x00138" name="HDCP_RCVPORT_DATA1"/>
+	<reg32 offset="0x0013C" name="HDCP_RCVPORT_DATA2_0"/>
+	<reg32 offset="0x00140" name="HDCP_RCVPORT_DATA2_1"/>
+	<reg32 offset="0x00144" name="HDCP_RCVPORT_DATA3"/>
+	<reg32 offset="0x00148" name="HDCP_RCVPORT_DATA4"/>
+	<reg32 offset="0x0014c" name="HDCP_RCVPORT_DATA5"/>
+	<reg32 offset="0x00150" name="HDCP_RCVPORT_DATA6"/>
+	<reg32 offset="0x00154" name="HDCP_RCVPORT_DATA7"/>
+	<reg32 offset="0x00158" name="HDCP_RCVPORT_DATA8"/>
+	<reg32 offset="0x0015c" name="HDCP_RCVPORT_DATA9"/>
+	<reg32 offset="0x00160" name="HDCP_RCVPORT_DATA10"/>
+	<reg32 offset="0x00164" name="HDCP_RCVPORT_DATA11"/>
+	<reg32 offset="0x00168" name="HDCP_RCVPORT_DATA12"/>
+
+	<reg32 offset="0x0016c" name="VENSPEC_INFO0"/>
+	<reg32 offset="0x00170" name="VENSPEC_INFO1"/>
+	<reg32 offset="0x00174" name="VENSPEC_INFO2"/>
+	<reg32 offset="0x00178" name="VENSPEC_INFO3"/>
+	<reg32 offset="0x0017c" name="VENSPEC_INFO4"/>
+	<reg32 offset="0x00180" name="VENSPEC_INFO5"/>
+	<reg32 offset="0x00184" name="VENSPEC_INFO6"/>
+
+	<reg32 offset="0x001d0" name="AUDIO_CFG">
+		<bitfield name="ENGINE_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="FIFO_WATERMARK" low="4" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00208" name="USEC_REFTIMER"/>
+	<reg32 offset="0x0020c" name="DDC_CTRL">
+		<!--
+			 0x020C HDMI_DDC_CTRL
+			[21:20] TRANSACTION_CNT
+				Number of transactions to be done in current transfer.
+				* 0x0: transaction0 only
+				* 0x1: transaction0, transaction1
+				* 0x2: transaction0, transaction1, transaction2
+				* 0x3: transaction0, transaction1, transaction2, transaction3
+			[3] SW_STATUS_RESET
+				Write 1 to reset HDMI_DDC_SW_STATUS flags, will reset SW_DONE,
+				ABORTED, TIMEOUT, SW_INTERRUPTED, BUFFER_OVERFLOW,
+				STOPPED_ON_NACK, NACK0, NACK1, NACK2, NACK3
+			[2] SEND_RESET Set to 1 to send reset sequence (9 clocks with no
+				data) at start of transfer.  This sequence is sent after GO is
+				written to 1, before the first transaction only.
+			[1] SOFT_RESET Write 1 to reset DDC controller
+			[0] GO WRITE ONLY. Write 1 to start DDC transfer.
+		 -->
+		<bitfield name="GO" pos="0" type="boolean"/>
+		<bitfield name="SOFT_RESET" pos="1" type="boolean"/>
+		<bitfield name="SEND_RESET" pos="2" type="boolean"/>
+		<bitfield name="SW_STATUS_RESET" pos="3" type="boolean"/>
+		<bitfield name="TRANSACTION_CNT" low="20" high="21" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00210" name="DDC_ARBITRATION">
+		<bitfield name="HW_ARBITRATION" pos="4" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00214" name="DDC_INT_CTRL">
+		<!--
+			HDMI_DDC_INT_CTRL[0x0214]
+			   [2] SW_DONE_MK Mask bit for SW_DONE_INT. Set to 1 to enable
+			       interrupt.
+			   [1] SW_DONE_ACK WRITE ONLY. Acknowledge bit for SW_DONE_INT.
+			       Write 1 to clear interrupt.
+			   [0] SW_DONE_INT READ ONLY. SW_DONE interrupt status */
+		 -->
+		<bitfield name="SW_DONE_INT" pos="0" type="boolean"/>
+		<bitfield name="SW_DONE_ACK" pos="1" type="boolean"/>
+		<bitfield name="SW_DONE_MASK" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00218" name="DDC_SW_STATUS">
+		<bitfield name="NACK0" pos="12" type="boolean"/>
+		<bitfield name="NACK1" pos="13" type="boolean"/>
+		<bitfield name="NACK2" pos="14" type="boolean"/>
+		<bitfield name="NACK3" pos="15" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0021c" name="DDC_HW_STATUS">
+		<bitfield name="DONE" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00220" name="DDC_SPEED">
+		<!--
+		   0x0220 HDMI_DDC_SPEED
+		   [31:16] PRESCALE prescale = (m * xtal_frequency) /
+			(desired_i2c_speed), where m is multiply
+			factor, default: m = 1
+		   [1:0]   THRESHOLD Select threshold to use to determine whether value
+			sampled on SDA is a 1 or 0. Specified in terms of the ratio
+			between the number of sampled ones and the total number of times
+			SDA is sampled.
+			* 0x0: >0
+			* 0x1: 1/4 of total samples
+			* 0x2: 1/2 of total samples
+			* 0x3: 3/4 of total samples */
+		 -->
+		<bitfield name="THRESHOLD" low="0" high="1" type="uint"/>
+		<bitfield name="PRESCALE" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00224" name="DDC_SETUP">
+		<!--
+			 * 0x0224 HDMI_DDC_SETUP
+			 * Setting 31:24 bits : Time units to wait before timeout
+			 * when clock is being stalled by external sink device
+		 -->
+		<bitfield name="TIMEOUT" low="24" high="31" type="uint"/>
+	</reg32>
+	<!-- Guessing length is 4, as elsewhere the are references to trans0 thru trans3 -->
+	<array offset="0x00228" name="I2C_TRANSACTION" length="4" stride="4">
+		<reg32 offset="0" name="REG">
+			<!--
+				0x0228 HDMI_DDC_TRANS0
+				[23:16] CNT0 Byte count for first transaction (excluding the first
+					byte, which is usually the address).
+				[13] STOP0 Determines whether a stop bit will be sent after the first
+					transaction
+					* 0: NO STOP
+					* 1: STOP
+				[12] START0 Determines whether a start bit will be sent before the
+					first transaction
+					* 0: NO START
+					* 1: START
+				[8] STOP_ON_NACK0 Determines whether the current transfer will stop
+					if a NACK is received during the first transaction (current
+					transaction always stops).
+					* 0: STOP CURRENT TRANSACTION, GO TO NEXT TRANSACTION
+					* 1: STOP ALL TRANSACTIONS, SEND STOP BIT
+				[0] RW0 Read/write indicator for first transaction - set to 0 for
+					write, 1 for read. This bit only controls HDMI_DDC behaviour -
+					the R/W bit in the transaction is programmed into the DDC buffer
+					as the LSB of the address byte.
+					* 0: WRITE
+					* 1: READ
+			 -->
+			<bitfield name="RW" pos="0" type="hdmi_ddc_read_write"/>
+			<bitfield name="STOP_ON_NACK" pos="8" type="boolean"/>
+			<bitfield name="START" pos="12" type="boolean"/>
+			<bitfield name="STOP" pos="13" type="boolean"/>
+			<bitfield name="CNT" low="16" high="23" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x00238" name="DDC_DATA">
+		<!--
+			0x0238 HDMI_DDC_DATA
+			[31] INDEX_WRITE WRITE ONLY. To write index field, set this bit to
+				1 while writing HDMI_DDC_DATA.
+			[23:16] INDEX Use to set index into DDC buffer for next read or
+				current write, or to read index of current read or next write.
+				Writable only when INDEX_WRITE=1.
+			[15:8] DATA Use to fill or read the DDC buffer
+			[0] DATA_RW Select whether buffer access will be a read or write.
+				For writes, address auto-increments on write to HDMI_DDC_DATA.
+				For reads, address autoincrements on reads to HDMI_DDC_DATA.
+				* 0: Write
+				* 1: Read
+		 -->
+		<bitfield name="DATA_RW" pos="0" type="hdmi_ddc_read_write"/>
+		<bitfield name="DATA" low="8" high="15" type="uint"/>
+		<bitfield name="INDEX" low="16" high="23" type="uint"/>
+		<bitfield name="INDEX_WRITE" pos="31" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0023c" name="HDCP_SHA_CTRL"/>
+	<reg32 offset="0x00240" name="HDCP_SHA_STATUS">
+		<bitfield name="BLOCK_DONE" pos="0" type="boolean"/>
+		<bitfield name="COMP_DONE" pos="4" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00244" name="HDCP_SHA_DATA">
+		<bitfield name="DONE" pos="0" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00250" name="HPD_INT_STATUS">
+		<bitfield name="INT" pos="0" type="boolean"/>  <!-- an irq has occurred -->
+		<bitfield name="CABLE_DETECTED" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00254" name="HPD_INT_CTRL">
+		<!-- (this useful comment was removed in df6b645.. git archaeology is fun)
+			HPD_INT_CTRL[0x0254]
+			31:10 Reserved
+			9     RCV_PLUGIN_DET_MASK  receiver plug in interrupt mask.
+			                           When programmed to 1,
+			                           RCV_PLUGIN_DET_INT will toggle
+			                           the interrupt line
+			8:6   Reserved
+			5     RX_INT_EN            Panel RX interrupt enable
+			      0: Disable
+			      1: Enable
+			4     RX_INT_ACK           WRITE ONLY. Panel RX interrupt
+			                           ack
+			3     Reserved
+			2     INT_EN               Panel interrupt control
+			      0: Disable
+			      1: Enable
+			1     INT_POLARITY         Panel interrupt polarity
+			      0: generate interrupt on disconnect
+			      1: generate interrupt on connect
+			0     INT_ACK              WRITE ONLY. Panel interrupt ack
+		 -->
+		<bitfield name="INT_ACK" pos="0" type="boolean"/>
+		<bitfield name="INT_CONNECT" pos="1" type="boolean"/>
+		<bitfield name="INT_EN" pos="2" type="boolean"/>
+		<bitfield name="RX_INT_ACK" pos="4" type="boolean"/>
+		<bitfield name="RX_INT_EN" pos="5" type="boolean"/>
+		<bitfield name="RCV_PLUGIN_DET_MASK" pos="9" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00258" name="HPD_CTRL">
+		<bitfield name="TIMEOUT" low="0" high="12" type="uint"/>
+		<bitfield name="ENABLE" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0027c" name="DDC_REF">
+		<!--
+			0x027C HDMI_DDC_REF
+			[16] REFTIMER_ENABLE	Enable the timer
+				* 0: Disable
+				* 1: Enable
+			[15:0] REFTIMER	Value to set the register in order to generate
+				DDC strobe. This register counts on HDCP application clock
+
+			/* Enable reference timer
+			 * 27 micro-seconds */
+			HDMI_OUTP_ND(0x027C, (1 << 16) | (27 << 0));
+		 -->
+		<bitfield name="REFTIMER_ENABLE" pos="16" type="boolean"/>
+		<bitfield name="REFTIMER" low="0" high="15" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00284" name="HDCP_SW_UPPER_AKSV"/>
+	<reg32 offset="0x00288" name="HDCP_SW_LOWER_AKSV"/>
+
+	<reg32 offset="0x0028c" name="CEC_CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="SEND_TRIGGER" pos="1" type="boolean"/>
+		<bitfield name="FRAME_SIZE" low="4" high="8" type="uint"/>
+		<bitfield name="LINE_OE" pos="9" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00290" name="CEC_WR_DATA">
+		<bitfield name="BROADCAST" pos="0" type="boolean"/>
+		<bitfield name="DATA" low="8" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00294" name="CEC_RETRANSMIT">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="COUNT" low="1" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00298" name="CEC_STATUS">
+		<bitfield name="BUSY" pos="0" type="boolean"/>
+		<bitfield name="TX_FRAME_DONE" pos="3" type="boolean"/>
+		<bitfield name="TX_STATUS" low="4" high="7" type="hdmi_cec_tx_status"/>
+	</reg32>
+	<reg32 offset="0x0029c" name="CEC_INT">
+		<bitfield name="TX_DONE" pos="0" type="boolean"/>
+		<bitfield name="TX_DONE_MASK" pos="1" type="boolean"/>
+		<bitfield name="TX_ERROR" pos="2" type="boolean"/>
+		<bitfield name="TX_ERROR_MASK" pos="3" type="boolean"/>
+		<bitfield name="MONITOR" pos="4" type="boolean"/>
+		<bitfield name="MONITOR_MASK" pos="5" type="boolean"/>
+		<bitfield name="RX_DONE" pos="6" type="boolean"/>
+		<bitfield name="RX_DONE_MASK" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002a0" name="CEC_ADDR"/>
+	<reg32 offset="0x002a4" name="CEC_TIME">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="SIGNAL_FREE_TIME" low="7" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002a8" name="CEC_REFTIMER">
+		<bitfield name="REFTIMER" low="0" high="15" type="uint"/>
+		<bitfield name="ENABLE" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002ac" name="CEC_RD_DATA">
+		<bitfield name="DATA" low="0" high="7" type="uint"/>
+		<bitfield name="SIZE" low="8" high="12" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002b0" name="CEC_RD_FILTER"/>
+
+	<reg32 offset="0x002b4" name="ACTIVE_HSYNC">
+		<bitfield name="START" low="0" high="12" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002b8" name="ACTIVE_VSYNC">
+		<bitfield name="START" low="0" high="12" type="uint"/>
+		<bitfield name="END" low="16" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002bc" name="VSYNC_ACTIVE_F2">
+		<!-- interlaced, frame 2 -->
+		<bitfield name="START" low="0" high="12" type="uint"/>
+		<bitfield name="END" low="16" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002c0" name="TOTAL">
+		<bitfield name="H_TOTAL" low="0" high="12" type="uint"/>
+		<bitfield name="V_TOTAL" low="16" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002c4" name="VSYNC_TOTAL_F2">
+		<!-- interlaced, frame 2 -->
+		<bitfield name="V_TOTAL" low="0" high="12" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002c8" name="FRAME_CTRL">
+		<bitfield name="RGB_MUX_SEL_BGR" pos="12" type="boolean"/>
+		<bitfield name="VSYNC_LOW" pos="28" type="boolean"/>
+		<bitfield name="HSYNC_LOW" pos="29" type="boolean"/>
+		<bitfield name="INTERLACED_EN" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002cc" name="AUD_INT">
+		<!--
+			HDMI_AUD_INT[0x02CC]
+			[3] AUD_SAM_DROP_MASK [R/W]
+			[2] AUD_SAM_DROP_ACK [W], AUD_SAM_DROP_INT [R]
+			[1] AUD_FIFO_URUN_MASK [R/W]
+			[0] AUD_FIFO_URUN_ACK [W], AUD_FIFO_URUN_INT [R]
+		 -->
+		<bitfield name="AUD_FIFO_URUN_INT" pos="0" type="boolean"/>  <!-- write to ack irq -->
+		<bitfield name="AUD_FIFO_URAN_MASK" pos="1" type="boolean"/> <!-- r/w, enables irq -->
+		<bitfield name="AUD_SAM_DROP_INT" pos="2" type="boolean"/>   <!-- write to ack irq -->
+		<bitfield name="AUD_SAM_DROP_MASK" pos="3" type="boolean"/>  <!-- r/w, enables irq -->
+	</reg32>
+	<reg32 offset="0x002d4" name="PHY_CTRL">
+		<!--
+			in hdmi_phy_reset() it appears to be toggling SW_RESET/
+			SW_RESET_PLL based on the value of the bit above, so
+			I'm guessing the bit above is a polarit bit
+		 -->
+		<bitfield name="SW_RESET_PLL" pos="0" type="boolean"/>
+		<bitfield name="SW_RESET_PLL_LOW" pos="1" type="boolean"/>
+		<bitfield name="SW_RESET" pos="2" type="boolean"/>
+		<bitfield name="SW_RESET_LOW" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002dc" name="CEC_WR_RANGE"/>
+	<reg32 offset="0x002e0" name="CEC_RD_RANGE"/>
+	<reg32 offset="0x002e4" name="VERSION"/>
+	<reg32 offset="0x00360" name="CEC_COMPL_CTL"/>
+	<reg32 offset="0x00364" name="CEC_RD_START_RANGE"/>
+	<reg32 offset="0x00368" name="CEC_RD_TOTAL_RANGE"/>
+	<reg32 offset="0x0036c" name="CEC_RD_ERR_RESP_LO"/>
+	<reg32 offset="0x00370" name="CEC_WR_CHECK_CONFIG"/>
+
+</domain>
+
+<domain name="HDMI_8x60" width="32">
+	<reg32 offset="0x00000" name="PHY_REG0">
+		<bitfield name="DESER_DEL_CTRL" low="2" high="4" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00004" name="PHY_REG1">
+		<bitfield name="DTEST_MUX_SEL" low="4" high="7" type="uint"/>
+		<bitfield name="OUTVOL_SWING_CTRL" low="0" high="3" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00008" name="PHY_REG2">
+		<bitfield name="PD_DESER" pos="0" type="boolean"/>
+		<bitfield name="PD_DRIVE_1" pos="1" type="boolean"/>
+		<bitfield name="PD_DRIVE_2" pos="2" type="boolean"/>
+		<bitfield name="PD_DRIVE_3" pos="3" type="boolean"/>
+		<bitfield name="PD_DRIVE_4" pos="4" type="boolean"/>
+		<bitfield name="PD_PLL" pos="5" type="boolean"/>
+		<bitfield name="PD_PWRGEN" pos="6" type="boolean"/>
+		<bitfield name="RCV_SENSE_EN" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0000c" name="PHY_REG3">
+		<bitfield name="PLL_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00010" name="PHY_REG4"/>
+	<reg32 offset="0x00014" name="PHY_REG5"/>
+	<reg32 offset="0x00018" name="PHY_REG6"/>
+	<reg32 offset="0x0001c" name="PHY_REG7"/>
+	<reg32 offset="0x00020" name="PHY_REG8"/>
+	<reg32 offset="0x00024" name="PHY_REG9"/>
+	<reg32 offset="0x00028" name="PHY_REG10"/>
+	<reg32 offset="0x0002c" name="PHY_REG11"/>
+	<reg32 offset="0x00030" name="PHY_REG12">
+		<bitfield name="RETIMING_EN" pos="0" type="boolean"/>
+		<bitfield name="PLL_LOCK_DETECT_EN" pos="1" type="boolean"/>
+		<bitfield name="FORCE_LOCK" pos="4" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="HDMI_8960" width="32">
+	<!--
+		some of the bitfields may be same as 8x60.. but no helpful comments
+		in msm_dss_io_8960.c
+	 -->
+	<reg32 offset="0x00000" name="PHY_REG0"/>
+	<reg32 offset="0x00004" name="PHY_REG1"/>
+	<reg32 offset="0x00008" name="PHY_REG2"/>
+	<reg32 offset="0x0000c" name="PHY_REG3"/>
+	<reg32 offset="0x00010" name="PHY_REG4"/>
+	<reg32 offset="0x00014" name="PHY_REG5"/>
+	<reg32 offset="0x00018" name="PHY_REG6"/>
+	<reg32 offset="0x0001c" name="PHY_REG7"/>
+	<reg32 offset="0x00020" name="PHY_REG8"/>
+	<reg32 offset="0x00024" name="PHY_REG9"/>
+	<reg32 offset="0x00028" name="PHY_REG10"/>
+	<reg32 offset="0x0002c" name="PHY_REG11"/>
+	<reg32 offset="0x00030" name="PHY_REG12">
+		<bitfield name="SW_RESET" pos="5" type="boolean"/>
+		<bitfield name="PWRDN_B" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00034" name="PHY_REG_BIST_CFG"/>
+	<reg32 offset="0x00038" name="PHY_DEBUG_BUS_SEL"/>
+	<reg32 offset="0x0003c" name="PHY_REG_MISC0"/>
+	<reg32 offset="0x00040" name="PHY_REG13"/>
+	<reg32 offset="0x00044" name="PHY_REG14"/>
+	<reg32 offset="0x00048" name="PHY_REG15"/>
+</domain>
+
+<domain name="HDMI_8960_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="REFCLK_CFG"/>
+	<reg32 offset="0x00004" name="CHRG_PUMP_CFG"/>
+	<reg32 offset="0x00008" name="LOOP_FLT_CFG0"/>
+	<reg32 offset="0x0000c" name="LOOP_FLT_CFG1"/>
+	<reg32 offset="0x00010" name="IDAC_ADJ_CFG"/>
+	<reg32 offset="0x00014" name="I_VI_KVCO_CFG"/>
+	<reg32 offset="0x00018" name="PWRDN_B">
+		<bitfield name="PD_PLL" pos="1" type="boolean"/>
+		<bitfield name="PLL_PWRDN_B" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0001c" name="SDM_CFG0"/>
+	<reg32 offset="0x00020" name="SDM_CFG1"/>
+	<reg32 offset="0x00024" name="SDM_CFG2"/>
+	<reg32 offset="0x00028" name="SDM_CFG3"/>
+	<reg32 offset="0x0002c" name="SDM_CFG4"/>
+	<reg32 offset="0x00030" name="SSC_CFG0"/>
+	<reg32 offset="0x00034" name="SSC_CFG1"/>
+	<reg32 offset="0x00038" name="SSC_CFG2"/>
+	<reg32 offset="0x0003c" name="SSC_CFG3"/>
+	<reg32 offset="0x00040" name="LOCKDET_CFG0"/>
+	<reg32 offset="0x00044" name="LOCKDET_CFG1"/>
+	<reg32 offset="0x00048" name="LOCKDET_CFG2"/>
+	<reg32 offset="0x0004c" name="VCOCAL_CFG0"/>
+	<reg32 offset="0x00050" name="VCOCAL_CFG1"/>
+	<reg32 offset="0x00054" name="VCOCAL_CFG2"/>
+	<reg32 offset="0x00058" name="VCOCAL_CFG3"/>
+	<reg32 offset="0x0005c" name="VCOCAL_CFG4"/>
+	<reg32 offset="0x00060" name="VCOCAL_CFG5"/>
+	<reg32 offset="0x00064" name="VCOCAL_CFG6"/>
+	<reg32 offset="0x00068" name="VCOCAL_CFG7"/>
+	<reg32 offset="0x0006c" name="DEBUG_SEL"/>
+	<reg32 offset="0x00070" name="MISC0"/>
+	<reg32 offset="0x00074" name="MISC1"/>
+	<reg32 offset="0x00078" name="MISC2"/>
+	<reg32 offset="0x0007c" name="MISC3"/>
+	<reg32 offset="0x00080" name="MISC4"/>
+	<reg32 offset="0x00084" name="MISC5"/>
+	<reg32 offset="0x00088" name="MISC6"/>
+	<reg32 offset="0x0008c" name="DEBUG_BUS0"/>
+	<reg32 offset="0x00090" name="DEBUG_BUS1"/>
+	<reg32 offset="0x00094" name="DEBUG_BUS2"/>
+	<reg32 offset="0x00098" name="STATUS0">
+		<bitfield name="PLL_LOCK" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0009c" name="STATUS1"/>
+</domain>
+
+<domain name="HDMI_8x74" width="32">
+	<!--
+		seems to be all mdp5+ have same?
+	 -->
+	<reg32 offset="0x00000" name="ANA_CFG0"/>
+	<reg32 offset="0x00004" name="ANA_CFG1"/>
+	<reg32 offset="0x00008" name="ANA_CFG2"/>
+	<reg32 offset="0x0000c" name="ANA_CFG3"/>
+	<reg32 offset="0x00010" name="PD_CTRL0"/>
+	<reg32 offset="0x00014" name="PD_CTRL1"/>
+	<reg32 offset="0x00018" name="GLB_CFG"/>
+	<reg32 offset="0x0001c" name="DCC_CFG0"/>
+	<reg32 offset="0x00020" name="DCC_CFG1"/>
+	<reg32 offset="0x00024" name="TXCAL_CFG0"/>
+	<reg32 offset="0x00028" name="TXCAL_CFG1"/>
+	<reg32 offset="0x0002c" name="TXCAL_CFG2"/>
+	<reg32 offset="0x00030" name="TXCAL_CFG3"/>
+	<reg32 offset="0x00034" name="BIST_CFG0"/>
+	<reg32 offset="0x0003c" name="BIST_PATN0"/>
+	<reg32 offset="0x00040" name="BIST_PATN1"/>
+	<reg32 offset="0x00044" name="BIST_PATN2"/>
+	<reg32 offset="0x00048" name="BIST_PATN3"/>
+	<reg32 offset="0x0005c" name="STATUS"/>
+</domain>
+
+<domain name="HDMI_28nm_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="REFCLK_CFG"/>
+	<reg32 offset="0x00004" name="POSTDIV1_CFG"/>
+	<reg32 offset="0x00008" name="CHGPUMP_CFG"/>
+	<reg32 offset="0x0000C" name="VCOLPF_CFG"/>
+	<reg32 offset="0x00010" name="VREG_CFG"/>
+	<reg32 offset="0x00014" name="PWRGEN_CFG"/>
+	<reg32 offset="0x00018" name="DMUX_CFG"/>
+	<reg32 offset="0x0001C" name="AMUX_CFG"/>
+	<reg32 offset="0x00020" name="GLB_CFG">
+		<bitfield name="PLL_PWRDN_B" pos="0" type="boolean"/>
+		<bitfield name="PLL_LDO_PWRDN_B" pos="1" type="boolean"/>
+		<bitfield name="PLL_PWRGEN_PWRDN_B" pos="2" type="boolean"/>
+		<bitfield name="PLL_ENABLE" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00024" name="POSTDIV2_CFG"/>
+	<reg32 offset="0x00028" name="POSTDIV3_CFG"/>
+	<reg32 offset="0x0002C" name="LPFR_CFG"/>
+	<reg32 offset="0x00030" name="LPFC1_CFG"/>
+	<reg32 offset="0x00034" name="LPFC2_CFG"/>
+	<reg32 offset="0x00038" name="SDM_CFG0"/>
+	<reg32 offset="0x0003C" name="SDM_CFG1"/>
+	<reg32 offset="0x00040" name="SDM_CFG2"/>
+	<reg32 offset="0x00044" name="SDM_CFG3"/>
+	<reg32 offset="0x00048" name="SDM_CFG4"/>
+	<reg32 offset="0x0004C" name="SSC_CFG0"/>
+	<reg32 offset="0x00050" name="SSC_CFG1"/>
+	<reg32 offset="0x00054" name="SSC_CFG2"/>
+	<reg32 offset="0x00058" name="SSC_CFG3"/>
+	<reg32 offset="0x0005C" name="LKDET_CFG0"/>
+	<reg32 offset="0x00060" name="LKDET_CFG1"/>
+	<reg32 offset="0x00064" name="LKDET_CFG2"/>
+	<reg32 offset="0x00068" name="TEST_CFG">
+		<bitfield name="PLL_SW_RESET" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0006C" name="CAL_CFG0"/>
+	<reg32 offset="0x00070" name="CAL_CFG1"/>
+	<reg32 offset="0x00074" name="CAL_CFG2"/>
+	<reg32 offset="0x00078" name="CAL_CFG3"/>
+	<reg32 offset="0x0007C" name="CAL_CFG4"/>
+	<reg32 offset="0x00080" name="CAL_CFG5"/>
+	<reg32 offset="0x00084" name="CAL_CFG6"/>
+	<reg32 offset="0x00088" name="CAL_CFG7"/>
+	<reg32 offset="0x0008C" name="CAL_CFG8"/>
+	<reg32 offset="0x00090" name="CAL_CFG9"/>
+	<reg32 offset="0x00094" name="CAL_CFG10"/>
+	<reg32 offset="0x00098" name="CAL_CFG11"/>
+	<reg32 offset="0x0009C" name="EFUSE_CFG"/>
+	<reg32 offset="0x000A0" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x000C0" name="STATUS"/>
+</domain>
+
+<domain name="HDMI_8996_PHY" width="32">
+	<reg32 offset="0x00000" name="CFG"/>
+	<reg32 offset="0x00004" name="PD_CTL"/>
+	<reg32 offset="0x00008" name="MODE"/>
+	<reg32 offset="0x0000C" name="MISR_CLEAR"/>
+	<reg32 offset="0x00010" name="TX0_TX1_BIST_CFG0"/>
+	<reg32 offset="0x00014" name="TX0_TX1_BIST_CFG1"/>
+	<reg32 offset="0x00018" name="TX0_TX1_PRBS_SEED_BYTE0"/>
+	<reg32 offset="0x0001C" name="TX0_TX1_PRBS_SEED_BYTE1"/>
+	<reg32 offset="0x00020" name="TX0_TX1_BIST_PATTERN0"/>
+	<reg32 offset="0x00024" name="TX0_TX1_BIST_PATTERN1"/>
+	<reg32 offset="0x00028" name="TX2_TX3_BIST_CFG0"/>
+	<reg32 offset="0x0002C" name="TX2_TX3_BIST_CFG1"/>
+	<reg32 offset="0x00030" name="TX2_TX3_PRBS_SEED_BYTE0"/>
+	<reg32 offset="0x00034" name="TX2_TX3_PRBS_SEED_BYTE1"/>
+	<reg32 offset="0x00038" name="TX2_TX3_BIST_PATTERN0"/>
+	<reg32 offset="0x0003C" name="TX2_TX3_BIST_PATTERN1"/>
+	<reg32 offset="0x00040" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x00044" name="TXCAL_CFG0"/>
+	<reg32 offset="0x00048" name="TXCAL_CFG1"/>
+	<reg32 offset="0x0004C" name="TX0_TX1_LANE_CTL"/>
+	<reg32 offset="0x00050" name="TX2_TX3_LANE_CTL"/>
+	<reg32 offset="0x00054" name="LANE_BIST_CONFIG"/>
+	<reg32 offset="0x00058" name="CLOCK"/>
+	<reg32 offset="0x0005C" name="MISC1"/>
+	<reg32 offset="0x00060" name="MISC2"/>
+	<reg32 offset="0x00064" name="TX0_TX1_BIST_STATUS0"/>
+	<reg32 offset="0x00068" name="TX0_TX1_BIST_STATUS1"/>
+	<reg32 offset="0x0006C" name="TX0_TX1_BIST_STATUS2"/>
+	<reg32 offset="0x00070" name="TX2_TX3_BIST_STATUS0"/>
+	<reg32 offset="0x00074" name="TX2_TX3_BIST_STATUS1"/>
+	<reg32 offset="0x00078" name="TX2_TX3_BIST_STATUS2"/>
+	<reg32 offset="0x0007C" name="PRE_MISR_STATUS0"/>
+	<reg32 offset="0x00080" name="PRE_MISR_STATUS1"/>
+	<reg32 offset="0x00084" name="PRE_MISR_STATUS2"/>
+	<reg32 offset="0x00088" name="PRE_MISR_STATUS3"/>
+	<reg32 offset="0x0008C" name="POST_MISR_STATUS0"/>
+	<reg32 offset="0x00090" name="POST_MISR_STATUS1"/>
+	<reg32 offset="0x00094" name="POST_MISR_STATUS2"/>
+	<reg32 offset="0x00098" name="POST_MISR_STATUS3"/>
+	<reg32 offset="0x0009C" name="STATUS"/>
+	<reg32 offset="0x000A0" name="MISC3_STATUS"/>
+	<reg32 offset="0x000A4" name="MISC4_STATUS"/>
+	<reg32 offset="0x000A8" name="DEBUG_BUS0"/>
+	<reg32 offset="0x000AC" name="DEBUG_BUS1"/>
+	<reg32 offset="0x000B0" name="DEBUG_BUS2"/>
+	<reg32 offset="0x000B4" name="DEBUG_BUS3"/>
+	<reg32 offset="0x000B8" name="PHY_REVISION_ID0"/>
+	<reg32 offset="0x000BC" name="PHY_REVISION_ID1"/>
+	<reg32 offset="0x000C0" name="PHY_REVISION_ID2"/>
+	<reg32 offset="0x000C4" name="PHY_REVISION_ID3"/>
+</domain>
+
+<domain name="HDMI_PHY_QSERDES_COM" width="32">
+	<reg32 offset="0x00000" name="ATB_SEL1"/>
+	<reg32 offset="0x00004" name="ATB_SEL2"/>
+	<reg32 offset="0x00008" name="FREQ_UPDATE"/>
+	<reg32 offset="0x0000C" name="BG_TIMER"/>
+	<reg32 offset="0x00010" name="SSC_EN_CENTER"/>
+	<reg32 offset="0x00014" name="SSC_ADJ_PER1"/>
+	<reg32 offset="0x00018" name="SSC_ADJ_PER2"/>
+	<reg32 offset="0x0001C" name="SSC_PER1"/>
+	<reg32 offset="0x00020" name="SSC_PER2"/>
+	<reg32 offset="0x00024" name="SSC_STEP_SIZE1"/>
+	<reg32 offset="0x00028" name="SSC_STEP_SIZE2"/>
+	<reg32 offset="0x0002C" name="POST_DIV"/>
+	<reg32 offset="0x00030" name="POST_DIV_MUX"/>
+	<reg32 offset="0x00034" name="BIAS_EN_CLKBUFLR_EN"/>
+	<reg32 offset="0x00038" name="CLK_ENABLE1"/>
+	<reg32 offset="0x0003C" name="SYS_CLK_CTRL"/>
+	<reg32 offset="0x00040" name="SYSCLK_BUF_ENABLE"/>
+	<reg32 offset="0x00044" name="PLL_EN"/>
+	<reg32 offset="0x00048" name="PLL_IVCO"/>
+	<reg32 offset="0x0004C" name="LOCK_CMP1_MODE0"/>
+	<reg32 offset="0x00050" name="LOCK_CMP2_MODE0"/>
+	<reg32 offset="0x00054" name="LOCK_CMP3_MODE0"/>
+	<reg32 offset="0x00058" name="LOCK_CMP1_MODE1"/>
+	<reg32 offset="0x0005C" name="LOCK_CMP2_MODE1"/>
+	<reg32 offset="0x00060" name="LOCK_CMP3_MODE1"/>
+	<reg32 offset="0x00064" name="LOCK_CMP1_MODE2"/>
+	<reg32 offset="0x00064" name="CMN_RSVD0"/>
+	<reg32 offset="0x00068" name="LOCK_CMP2_MODE2"/>
+	<reg32 offset="0x00068" name="EP_CLOCK_DETECT_CTRL"/>
+	<reg32 offset="0x0006C" name="LOCK_CMP3_MODE2"/>
+	<reg32 offset="0x0006C" name="SYSCLK_DET_COMP_STATUS"/>
+	<reg32 offset="0x00070" name="BG_TRIM"/>
+	<reg32 offset="0x00074" name="CLK_EP_DIV"/>
+	<reg32 offset="0x00078" name="CP_CTRL_MODE0"/>
+	<reg32 offset="0x0007C" name="CP_CTRL_MODE1"/>
+	<reg32 offset="0x00080" name="CP_CTRL_MODE2"/>
+	<reg32 offset="0x00080" name="CMN_RSVD1"/>
+	<reg32 offset="0x00084" name="PLL_RCTRL_MODE0"/>
+	<reg32 offset="0x00088" name="PLL_RCTRL_MODE1"/>
+	<reg32 offset="0x0008C" name="PLL_RCTRL_MODE2"/>
+	<reg32 offset="0x0008C" name="CMN_RSVD2"/>
+	<reg32 offset="0x00090" name="PLL_CCTRL_MODE0"/>
+	<reg32 offset="0x00094" name="PLL_CCTRL_MODE1"/>
+	<reg32 offset="0x00098" name="PLL_CCTRL_MODE2"/>
+	<reg32 offset="0x00098" name="CMN_RSVD3"/>
+	<reg32 offset="0x0009C" name="PLL_CNTRL"/>
+	<reg32 offset="0x000A0" name="PHASE_SEL_CTRL"/>
+	<reg32 offset="0x000A4" name="PHASE_SEL_DC"/>
+	<reg32 offset="0x000A8" name="CORE_CLK_IN_SYNC_SEL"/>
+	<reg32 offset="0x000A8" name="BIAS_EN_CTRL_BY_PSM"/>
+	<reg32 offset="0x000AC" name="SYSCLK_EN_SEL"/>
+	<reg32 offset="0x000B0" name="CML_SYSCLK_SEL"/>
+	<reg32 offset="0x000B4" name="RESETSM_CNTRL"/>
+	<reg32 offset="0x000B8" name="RESETSM_CNTRL2"/>
+	<reg32 offset="0x000BC" name="RESTRIM_CTRL"/>
+	<reg32 offset="0x000C0" name="RESTRIM_CTRL2"/>
+	<reg32 offset="0x000C4" name="RESCODE_DIV_NUM"/>
+	<reg32 offset="0x000C8" name="LOCK_CMP_EN"/>
+	<reg32 offset="0x000CC" name="LOCK_CMP_CFG"/>
+	<reg32 offset="0x000D0" name="DEC_START_MODE0"/>
+	<reg32 offset="0x000D4" name="DEC_START_MODE1"/>
+	<reg32 offset="0x000D8" name="DEC_START_MODE2"/>
+	<reg32 offset="0x000D8" name="VCOCAL_DEADMAN_CTRL"/>
+	<reg32 offset="0x000DC" name="DIV_FRAC_START1_MODE0"/>
+	<reg32 offset="0x000E0" name="DIV_FRAC_START2_MODE0"/>
+	<reg32 offset="0x000E4" name="DIV_FRAC_START3_MODE0"/>
+	<reg32 offset="0x000E8" name="DIV_FRAC_START1_MODE1"/>
+	<reg32 offset="0x000EC" name="DIV_FRAC_START2_MODE1"/>
+	<reg32 offset="0x000F0" name="DIV_FRAC_START3_MODE1"/>
+	<reg32 offset="0x000F4" name="DIV_FRAC_START1_MODE2"/>
+	<reg32 offset="0x000F4" name="VCO_TUNE_MINVAL1"/>
+	<reg32 offset="0x000F8" name="DIV_FRAC_START2_MODE2"/>
+	<reg32 offset="0x000F8" name="VCO_TUNE_MINVAL2"/>
+	<reg32 offset="0x000FC" name="DIV_FRAC_START3_MODE2"/>
+	<reg32 offset="0x000FC" name="CMN_RSVD4"/>
+	<reg32 offset="0x00100" name="INTEGLOOP_INITVAL"/>
+	<reg32 offset="0x00104" name="INTEGLOOP_EN"/>
+	<reg32 offset="0x00108" name="INTEGLOOP_GAIN0_MODE0"/>
+	<reg32 offset="0x0010C" name="INTEGLOOP_GAIN1_MODE0"/>
+	<reg32 offset="0x00110" name="INTEGLOOP_GAIN0_MODE1"/>
+	<reg32 offset="0x00114" name="INTEGLOOP_GAIN1_MODE1"/>
+	<reg32 offset="0x00118" name="INTEGLOOP_GAIN0_MODE2"/>
+	<reg32 offset="0x00118" name="VCO_TUNE_MAXVAL1"/>
+	<reg32 offset="0x0011C" name="INTEGLOOP_GAIN1_MODE2"/>
+	<reg32 offset="0x0011C" name="VCO_TUNE_MAXVAL2"/>
+	<reg32 offset="0x00120" name="RES_TRIM_CONTROL2"/>
+	<reg32 offset="0x00124" name="VCO_TUNE_CTRL"/>
+	<reg32 offset="0x00128" name="VCO_TUNE_MAP"/>
+	<reg32 offset="0x0012C" name="VCO_TUNE1_MODE0"/>
+	<reg32 offset="0x00130" name="VCO_TUNE2_MODE0"/>
+	<reg32 offset="0x00134" name="VCO_TUNE1_MODE1"/>
+	<reg32 offset="0x00138" name="VCO_TUNE2_MODE1"/>
+	<reg32 offset="0x0013C" name="VCO_TUNE1_MODE2"/>
+	<reg32 offset="0x0013C" name="VCO_TUNE_INITVAL1"/>
+	<reg32 offset="0x00140" name="VCO_TUNE2_MODE2"/>
+	<reg32 offset="0x00140" name="VCO_TUNE_INITVAL2"/>
+	<reg32 offset="0x00144" name="VCO_TUNE_TIMER1"/>
+	<reg32 offset="0x00148" name="VCO_TUNE_TIMER2"/>
+	<reg32 offset="0x0014C" name="SAR"/>
+	<reg32 offset="0x00150" name="SAR_CLK"/>
+	<reg32 offset="0x00154" name="SAR_CODE_OUT_STATUS"/>
+	<reg32 offset="0x00158" name="SAR_CODE_READY_STATUS"/>
+	<reg32 offset="0x0015C" name="CMN_STATUS"/>
+	<reg32 offset="0x00160" name="RESET_SM_STATUS"/>
+	<reg32 offset="0x00164" name="RESTRIM_CODE_STATUS"/>
+	<reg32 offset="0x00168" name="PLLCAL_CODE1_STATUS"/>
+	<reg32 offset="0x0016C" name="PLLCAL_CODE2_STATUS"/>
+	<reg32 offset="0x00170" name="BG_CTRL"/>
+	<reg32 offset="0x00174" name="CLK_SELECT"/>
+	<reg32 offset="0x00178" name="HSCLK_SEL"/>
+	<reg32 offset="0x0017C" name="INTEGLOOP_BINCODE_STATUS"/>
+	<reg32 offset="0x00180" name="PLL_ANALOG"/>
+	<reg32 offset="0x00184" name="CORECLK_DIV"/>
+	<reg32 offset="0x00188" name="SW_RESET"/>
+	<reg32 offset="0x0018C" name="CORE_CLK_EN"/>
+	<reg32 offset="0x00190" name="C_READY_STATUS"/>
+	<reg32 offset="0x00194" name="CMN_CONFIG"/>
+	<reg32 offset="0x00198" name="CMN_RATE_OVERRIDE"/>
+	<reg32 offset="0x0019C" name="SVS_MODE_CLK_SEL"/>
+	<reg32 offset="0x001A0" name="DEBUG_BUS0"/>
+	<reg32 offset="0x001A4" name="DEBUG_BUS1"/>
+	<reg32 offset="0x001A8" name="DEBUG_BUS2"/>
+	<reg32 offset="0x001AC" name="DEBUG_BUS3"/>
+	<reg32 offset="0x001B0" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x001B4" name="CMN_MISC1"/>
+	<reg32 offset="0x001B8" name="CMN_MISC2"/>
+	<reg32 offset="0x001BC" name="CORECLK_DIV_MODE1"/>
+	<reg32 offset="0x001C0" name="CORECLK_DIV_MODE2"/>
+	<reg32 offset="0x001C4" name="CMN_RSVD5"/>
+</domain>
+
+
+<domain name="HDMI_PHY_QSERDES_TX_LX" width="32">
+		<reg32 offset="0x00000" name="BIST_MODE_LANENO"/>
+		<reg32 offset="0x00004" name="BIST_INVERT"/>
+		<reg32 offset="0x00008" name="CLKBUF_ENABLE"/>
+		<reg32 offset="0x0000C" name="CMN_CONTROL_ONE"/>
+		<reg32 offset="0x00010" name="CMN_CONTROL_TWO"/>
+		<reg32 offset="0x00014" name="CMN_CONTROL_THREE"/>
+		<reg32 offset="0x00018" name="TX_EMP_POST1_LVL"/>
+		<reg32 offset="0x0001C" name="TX_POST2_EMPH"/>
+		<reg32 offset="0x00020" name="TX_BOOST_LVL_UP_DN"/>
+		<reg32 offset="0x00024" name="HP_PD_ENABLES"/>
+		<reg32 offset="0x00028" name="TX_IDLE_LVL_LARGE_AMP"/>
+		<reg32 offset="0x0002C" name="TX_DRV_LVL"/>
+		<reg32 offset="0x00030" name="TX_DRV_LVL_OFFSET"/>
+		<reg32 offset="0x00034" name="RESET_TSYNC_EN"/>
+		<reg32 offset="0x00038" name="PRE_STALL_LDO_BOOST_EN"/>
+		<reg32 offset="0x0003C" name="TX_BAND"/>
+		<reg32 offset="0x00040" name="SLEW_CNTL"/>
+		<reg32 offset="0x00044" name="INTERFACE_SELECT"/>
+		<reg32 offset="0x00048" name="LPB_EN"/>
+		<reg32 offset="0x0004C" name="RES_CODE_LANE_TX"/>
+		<reg32 offset="0x00050" name="RES_CODE_LANE_RX"/>
+		<reg32 offset="0x00054" name="RES_CODE_LANE_OFFSET"/>
+		<reg32 offset="0x00058" name="PERL_LENGTH1"/>
+		<reg32 offset="0x0005C" name="PERL_LENGTH2"/>
+		<reg32 offset="0x00060" name="SERDES_BYP_EN_OUT"/>
+		<reg32 offset="0x00064" name="DEBUG_BUS_SEL"/>
+		<reg32 offset="0x00068" name="HIGHZ_TRANSCEIVEREN_BIAS_DRVR_EN"/>
+		<reg32 offset="0x0006C" name="TX_POL_INV"/>
+		<reg32 offset="0x00070" name="PARRATE_REC_DETECT_IDLE_EN"/>
+		<reg32 offset="0x00074" name="BIST_PATTERN1"/>
+		<reg32 offset="0x00078" name="BIST_PATTERN2"/>
+		<reg32 offset="0x0007C" name="BIST_PATTERN3"/>
+		<reg32 offset="0x00080" name="BIST_PATTERN4"/>
+		<reg32 offset="0x00084" name="BIST_PATTERN5"/>
+		<reg32 offset="0x00088" name="BIST_PATTERN6"/>
+		<reg32 offset="0x0008C" name="BIST_PATTERN7"/>
+		<reg32 offset="0x00090" name="BIST_PATTERN8"/>
+		<reg32 offset="0x00094" name="LANE_MODE"/>
+		<reg32 offset="0x00098" name="IDAC_CAL_LANE_MODE"/>
+		<reg32 offset="0x0009C" name="IDAC_CAL_LANE_MODE_CONFIGURATION"/>
+		<reg32 offset="0x000A0" name="ATB_SEL1"/>
+		<reg32 offset="0x000A4" name="ATB_SEL2"/>
+		<reg32 offset="0x000A8" name="RCV_DETECT_LVL"/>
+		<reg32 offset="0x000AC" name="RCV_DETECT_LVL_2"/>
+		<reg32 offset="0x000B0" name="PRBS_SEED1"/>
+		<reg32 offset="0x000B4" name="PRBS_SEED2"/>
+		<reg32 offset="0x000B8" name="PRBS_SEED3"/>
+		<reg32 offset="0x000BC" name="PRBS_SEED4"/>
+		<reg32 offset="0x000C0" name="RESET_GEN"/>
+		<reg32 offset="0x000C4" name="RESET_GEN_MUXES"/>
+		<reg32 offset="0x000C8" name="TRAN_DRVR_EMP_EN"/>
+		<reg32 offset="0x000CC" name="TX_INTERFACE_MODE"/>
+		<reg32 offset="0x000D0" name="PWM_CTRL"/>
+		<reg32 offset="0x000D4" name="PWM_ENCODED_OR_DATA"/>
+		<reg32 offset="0x000D8" name="PWM_GEAR_1_DIVIDER_BAND2"/>
+		<reg32 offset="0x000DC" name="PWM_GEAR_2_DIVIDER_BAND2"/>
+		<reg32 offset="0x000E0" name="PWM_GEAR_3_DIVIDER_BAND2"/>
+		<reg32 offset="0x000E4" name="PWM_GEAR_4_DIVIDER_BAND2"/>
+		<reg32 offset="0x000E8" name="PWM_GEAR_1_DIVIDER_BAND0_1"/>
+		<reg32 offset="0x000EC" name="PWM_GEAR_2_DIVIDER_BAND0_1"/>
+		<reg32 offset="0x000F0" name="PWM_GEAR_3_DIVIDER_BAND0_1"/>
+		<reg32 offset="0x000F4" name="PWM_GEAR_4_DIVIDER_BAND0_1"/>
+		<reg32 offset="0x000F8" name="VMODE_CTRL1"/>
+		<reg32 offset="0x000FC" name="VMODE_CTRL2"/>
+		<reg32 offset="0x00100" name="TX_ALOG_INTF_OBSV_CNTL"/>
+		<reg32 offset="0x00104" name="BIST_STATUS"/>
+		<reg32 offset="0x00108" name="BIST_ERROR_COUNT1"/>
+		<reg32 offset="0x0010C" name="BIST_ERROR_COUNT2"/>
+		<reg32 offset="0x00110" name="TX_ALOG_INTF_OBSV"/>
+</domain>
+
+<domain name="HDMI_8998_PHY" width="32">
+	<reg32 offset="0x00000" name="CFG"/>
+	<reg32 offset="0x00004" name="PD_CTL"/>
+	<reg32 offset="0x00010" name="MODE"/>
+	<reg32 offset="0x0005C" name="CLOCK"/>
+	<reg32 offset="0x00068" name="CMN_CTRL"/>
+	<reg32 offset="0x000B4" name="STATUS"/>
+</domain>
+
+<domain name="HDMI_8998_PHY_QSERDES_COM" width="32">
+	<reg32 offset="0x0000" name="ATB_SEL1"/>
+	<reg32 offset="0x0004" name="ATB_SEL2"/>
+	<reg32 offset="0x0008" name="FREQ_UPDATE"/>
+	<reg32 offset="0x000C" name="BG_TIMER"/>
+	<reg32 offset="0x0010" name="SSC_EN_CENTER"/>
+	<reg32 offset="0x0014" name="SSC_ADJ_PER1"/>
+	<reg32 offset="0x0018" name="SSC_ADJ_PER2"/>
+	<reg32 offset="0x001C" name="SSC_PER1"/>
+	<reg32 offset="0x0020" name="SSC_PER2"/>
+	<reg32 offset="0x0024" name="SSC_STEP_SIZE1"/>
+	<reg32 offset="0x0028" name="SSC_STEP_SIZE2"/>
+	<reg32 offset="0x002C" name="POST_DIV"/>
+	<reg32 offset="0x0030" name="POST_DIV_MUX"/>
+	<reg32 offset="0x0034" name="BIAS_EN_CLKBUFLR_EN"/>
+	<reg32 offset="0x0038" name="CLK_ENABLE1"/>
+	<reg32 offset="0x003C" name="SYS_CLK_CTRL"/>
+	<reg32 offset="0x0040" name="SYSCLK_BUF_ENABLE"/>
+	<reg32 offset="0x0044" name="PLL_EN"/>
+	<reg32 offset="0x0048" name="PLL_IVCO"/>
+	<reg32 offset="0x004C" name="CMN_IETRIM"/>
+	<reg32 offset="0x0050" name="CMN_IPTRIM"/>
+	<reg32 offset="0x0060" name="CP_CTRL_MODE0"/>
+	<reg32 offset="0x0064" name="CP_CTRL_MODE1"/>
+	<reg32 offset="0x0068" name="PLL_RCTRL_MODE0"/>
+	<reg32 offset="0x006C" name="PLL_RCTRL_MODE1"/>
+	<reg32 offset="0x0070" name="PLL_CCTRL_MODE0"/>
+	<reg32 offset="0x0074" name="PLL_CCTRL_MODE1"/>
+	<reg32 offset="0x0078" name="PLL_CNTRL"/>
+	<reg32 offset="0x007C" name="BIAS_EN_CTRL_BY_PSM"/>
+	<reg32 offset="0x0080" name="SYSCLK_EN_SEL"/>
+	<reg32 offset="0x0084" name="CML_SYSCLK_SEL"/>
+	<reg32 offset="0x0088" name="RESETSM_CNTRL"/>
+	<reg32 offset="0x008C" name="RESETSM_CNTRL2"/>
+	<reg32 offset="0x0090" name="LOCK_CMP_EN"/>
+	<reg32 offset="0x0094" name="LOCK_CMP_CFG"/>
+	<reg32 offset="0x0098" name="LOCK_CMP1_MODE0"/>
+	<reg32 offset="0x009C" name="LOCK_CMP2_MODE0"/>
+	<reg32 offset="0x00A0" name="LOCK_CMP3_MODE0"/>
+	<reg32 offset="0x00B0" name="DEC_START_MODE0"/>
+	<reg32 offset="0x00B4" name="DEC_START_MODE1"/>
+	<reg32 offset="0x00B8" name="DIV_FRAC_START1_MODE0"/>
+	<reg32 offset="0x00BC" name="DIV_FRAC_START2_MODE0"/>
+	<reg32 offset="0x00C0" name="DIV_FRAC_START3_MODE0"/>
+	<reg32 offset="0x00C4" name="DIV_FRAC_START1_MODE1"/>
+	<reg32 offset="0x00C8" name="DIV_FRAC_START2_MODE1"/>
+	<reg32 offset="0x00CC" name="DIV_FRAC_START3_MODE1"/>
+	<reg32 offset="0x00D0" name="INTEGLOOP_INITVAL"/>
+	<reg32 offset="0x00D4" name="INTEGLOOP_EN"/>
+	<reg32 offset="0x00D8" name="INTEGLOOP_GAIN0_MODE0"/>
+	<reg32 offset="0x00DC" name="INTEGLOOP_GAIN1_MODE0"/>
+	<reg32 offset="0x00E0" name="INTEGLOOP_GAIN0_MODE1"/>
+	<reg32 offset="0x00E4" name="INTEGLOOP_GAIN1_MODE1"/>
+	<reg32 offset="0x00E8" name="VCOCAL_DEADMAN_CTRL"/>
+	<reg32 offset="0x00EC" name="VCO_TUNE_CTRL"/>
+	<reg32 offset="0x00F0" name="VCO_TUNE_MAP"/>
+	<reg32 offset="0x0124" name="CMN_STATUS"/>
+	<reg32 offset="0x0128" name="RESET_SM_STATUS"/>
+	<reg32 offset="0x0138" name="CLK_SEL"/>
+	<reg32 offset="0x013C" name="HSCLK_SEL"/>
+	<reg32 offset="0x0148" name="CORECLK_DIV_MODE0"/>
+	<reg32 offset="0x0150" name="SW_RESET"/>
+	<reg32 offset="0x0154" name="CORE_CLK_EN"/>
+	<reg32 offset="0x0158" name="C_READY_STATUS"/>
+	<reg32 offset="0x015C" name="CMN_CONFIG"/>
+	<reg32 offset="0x0164" name="SVS_MODE_CLK_SEL"/>
+</domain>
+
+<domain name="HDMI_8998_PHY_TXn" width="32">
+	<reg32 offset="0x0000" name="EMP_POST1_LVL"/>
+	<reg32 offset="0x0008" name="INTERFACE_SELECT_TX_BAND"/>
+	<reg32 offset="0x000C" name="CLKBUF_TERM_ENABLE"/>
+	<reg32 offset="0x0014" name="DRV_LVL_RES_CODE_OFFSET"/>
+	<reg32 offset="0x0018" name="DRV_LVL"/>
+	<reg32 offset="0x001C" name="LANE_CONFIG"/>
+	<reg32 offset="0x0024" name="PRE_DRIVER_1"/>
+	<reg32 offset="0x0028" name="PRE_DRIVER_2"/>
+	<reg32 offset="0x002C" name="LANE_MODE"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/mdp4.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/mdp4.xml
@@ -0,0 +1,504 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="display/mdp_common.xml"/>
+
+<domain name="MDP4" width="32">
+	<enum name="mdp4_pipe">
+		<brief>pipe names, index into PIPE[]</brief>
+		<value name="VG1" value="0"/>
+		<value name="VG2" value="1"/>
+		<value name="RGB1" value="2"/>
+		<value name="RGB2" value="3"/>
+		<value name="RGB3" value="4"/>
+		<value name="VG3" value="5"/>
+		<value name="VG4" value="6"/>
+	</enum>
+
+	<enum name="mdp4_mixer">
+		<value name="MIXER0" value="0"/>
+		<value name="MIXER1" value="1"/>
+		<value name="MIXER2" value="2"/>
+	</enum>
+
+	<enum name="mdp4_intf">
+		<!--
+			A bit confusing the enums for interface selection:
+				enum {
+					LCDC_RGB_INTF,			/* 0 */
+					DTV_INTF = LCDC_RGB_INTF,	/* 0 */
+					MDDI_LCDC_INTF,			/* 1 */
+					MDDI_INTF,			/* 2 */
+					EBI2_INTF,			/* 3 */
+					TV_INTF = EBI2_INTF,		/* 3 */
+					DSI_VIDEO_INTF,
+					DSI_CMD_INTF
+				};
+			there is some overlap, and not all the values end up getting
+			written to hw (mdp4_display_intf_sel() remaps the last two
+			values to MDDI_LCDC_INTF/MDDI_INTF with extra bits set).. so
+			taking some liberties in guessing the actual meanings/names:
+		 -->
+		<value name="INTF_LCDC_DTV" value="0"/>  <!-- LCDC RGB or DTV (external) -->
+		<value name="INTF_DSI_VIDEO" value="1"/>
+		<value name="INTF_DSI_CMD" value="2"/>
+		<value name="INTF_EBI2_TV" value="3"/>   <!-- EBI2 or TV (external) -->
+	</enum>
+	<enum name="mdp4_cursor_format">
+		<value name="CURSOR_ARGB" value="1"/>
+		<value name="CURSOR_XRGB" value="2"/>
+	</enum>
+	<enum name="mdp4_frame_format">
+		<value name="FRAME_LINEAR" value="0"/>
+		<value name="FRAME_TILE_ARGB_4X4" value="1"/>
+		<value name="FRAME_TILE_YCBCR_420" value="2"/>
+	</enum>
+	<enum name="mdp4_scale_unit">
+		<value name="SCALE_FIR" value="0"/>
+		<value name="SCALE_MN_PHASE" value="1"/>
+		<value name="SCALE_PIXEL_RPT" value="2"/>
+	</enum>
+
+	<bitset name="mdp4_layermixer_in_cfg" inline="yes">
+		<brief>appears to map pipe to mixer stage</brief>
+		<bitfield name="PIPE0" low="0"  high="2"  type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE0_MIXER1" pos="3" type="boolean"/>
+		<bitfield name="PIPE1" low="4"  high="6"  type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE1_MIXER1" pos="7" type="boolean"/>
+		<bitfield name="PIPE2" low="8"  high="10" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE2_MIXER1" pos="11" type="boolean"/>
+		<bitfield name="PIPE3" low="12" high="14" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE3_MIXER1" pos="15" type="boolean"/>
+		<bitfield name="PIPE4" low="16" high="18" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE4_MIXER1" pos="19" type="boolean"/>
+		<bitfield name="PIPE5" low="20" high="22" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE5_MIXER1" pos="23" type="boolean"/>
+		<bitfield name="PIPE6" low="24" high="26" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE6_MIXER1" pos="27" type="boolean"/>
+		<bitfield name="PIPE7" low="28" high="30" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE7_MIXER1" pos="31" type="boolean"/>
+	</bitset>
+
+	<bitset name="MDP4_IRQ">
+		<bitfield name="OVERLAY0_DONE" pos="0" type="boolean"/>
+		<bitfield name="OVERLAY1_DONE" pos="1" type="boolean"/>
+		<bitfield name="DMA_S_DONE" pos="2" type="boolean"/>
+		<bitfield name="DMA_E_DONE" pos="3" type="boolean"/>
+		<bitfield name="DMA_P_DONE" pos="4" type="boolean"/>
+		<bitfield name="VG1_HISTOGRAM" pos="5" type="boolean"/>
+		<bitfield name="VG2_HISTOGRAM" pos="6" type="boolean"/>
+		<bitfield name="PRIMARY_VSYNC" pos="7" type="boolean"/>
+		<bitfield name="PRIMARY_INTF_UDERRUN" pos="8" type="boolean"/>
+		<bitfield name="EXTERNAL_VSYNC" pos="9" type="boolean"/>
+		<bitfield name="EXTERNAL_INTF_UDERRUN" pos="10" type="boolean"/>
+		<bitfield name="PRIMARY_RDPTR" pos="11" type="boolean"/>  <!-- read pointer -->
+		<bitfield name="DMA_P_HISTOGRAM" pos="17" type="boolean"/>
+		<bitfield name="DMA_S_HISTOGRAM" pos="26" type="boolean"/>
+		<bitfield name="OVERLAY2_DONE" pos="30" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x00000" name="VERSION">
+		<!--
+			from mdp_probe() we can see minor rev starts at 16.. assume
+			major is above that.. not sure the rest of bits but doesn't
+			really seem to matter
+		 -->
+		<bitfield name="MINOR" low="16" high="23" type="uint"/>
+		<bitfield name="MAJOR" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00004" name="OVLP0_KICK"/>
+	<reg32 offset="0x00008" name="OVLP1_KICK"/>
+	<reg32 offset="0x000d0" name="OVLP2_KICK"/>
+	<reg32 offset="0x0000c" name="DMA_P_KICK"/>
+	<reg32 offset="0x00010" name="DMA_S_KICK"/>
+	<reg32 offset="0x00014" name="DMA_E_KICK"/>
+	<reg32 offset="0x00018" name="DISP_STATUS"/>
+
+	<reg32 offset="0x00038" name="DISP_INTF_SEL">
+		<bitfield name="PRIM" low="0" high="1" type="mdp4_intf"/>
+		<bitfield name="SEC" low="2" high="3" type="mdp4_intf"/>
+		<bitfield name="EXT" low="4" high="5" type="mdp4_intf"/>
+		<bitfield name="DSI_VIDEO" pos="6" type="boolean"/>
+		<bitfield name="DSI_CMD" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0003c" name="RESET_STATUS"/>  <!-- only mdp4 >v2.1 -->
+	<reg32 offset="0x0004c" name="READ_CNFG"/>  <!-- something about # of pending requests.. -->
+	<reg32 offset="0x00050" name="INTR_ENABLE" type="MDP4_IRQ"/>
+	<reg32 offset="0x00054" name="INTR_STATUS" type="MDP4_IRQ"/>
+	<reg32 offset="0x00058" name="INTR_CLEAR" type="MDP4_IRQ"/>
+	<reg32 offset="0x00060" name="EBI2_LCD0"/>
+	<reg32 offset="0x00064" name="EBI2_LCD1"/>
+	<reg32 offset="0x00070" name="PORTMAP_MODE"/>
+
+	<!-- mdp chip-select controller: -->
+	<reg32 offset="0x000c0" name="CS_CONTROLLER0"/>
+	<reg32 offset="0x000c4" name="CS_CONTROLLER1"/>
+
+	<reg32 offset="0x100f0" name="LAYERMIXER2_IN_CFG" type="mdp4_layermixer_in_cfg"/>
+	<reg32 offset="0x100fc" name="LAYERMIXER_IN_CFG_UPDATE_METHOD"/>
+	<reg32 offset="0x10100" name="LAYERMIXER_IN_CFG" type="mdp4_layermixer_in_cfg"/>
+
+	<reg32 offset="0x30050" name="VG2_SRC_FORMAT"/>
+	<reg32 offset="0x31008" name="VG2_CONST_COLOR"/>
+
+	<reg32 offset="0x18000" name="OVERLAY_FLUSH">
+		<bitfield name="OVLP0" pos="0" type="boolean"/>
+		<bitfield name="OVLP1" pos="1" type="boolean"/>
+		<bitfield name="VG1" pos="2" type="boolean"/>
+		<bitfield name="VG2" pos="3" type="boolean"/>
+		<bitfield name="RGB1" pos="4" type="boolean"/>
+		<bitfield name="RGB2" pos="5" type="boolean"/>
+	</reg32>
+
+	<array offsets="0x10000,0x18000,0x88000" name="OVLP" length="3" stride="0x8000">
+		<reg32 offset="0x0004" name="CFG"/>
+		<reg32 offset="0x0008" name="SIZE" type="reg_wh"/>
+		<reg32 offset="0x000c" name="BASE"/>
+		<reg32 offset="0x0010" name="STRIDE" type="uint"/>
+		<reg32 offset="0x0014" name="OPMODE"/>
+
+		<array offsets="0x0104,0x0124,0x0144,0x0160" name="STAGE" length="4" stride="0x1c">
+			<reg32 offset="0x00" name="OP">
+				<bitfield name="FG_ALPHA" low="0" high="1" type="mdp_alpha_type"/>
+				<bitfield name="FG_INV_ALPHA" pos="2" type="boolean"/>
+				<bitfield name="FG_MOD_ALPHA" pos="3" type="boolean"/>
+				<bitfield name="BG_ALPHA" low="4" high="5" type="mdp_alpha_type"/>
+				<bitfield name="BG_INV_ALPHA" pos="6" type="boolean"/>
+				<bitfield name="BG_MOD_ALPHA" pos="7" type="boolean"/>
+				<bitfield name="FG_TRANSP" pos="8" type="boolean"/>
+				<bitfield name="BG_TRANSP" pos="9" type="boolean"/>
+			</reg32>
+			<reg32 offset="0x04" name="FG_ALPHA"/>
+			<reg32 offset="0x08" name="BG_ALPHA"/>
+			<reg32 offset="0x0c" name="TRANSP_LOW0"/>
+			<reg32 offset="0x10" name="TRANSP_LOW1"/>
+			<reg32 offset="0x14" name="TRANSP_HIGH0"/>
+			<reg32 offset="0x18" name="TRANSP_HIGH1"/>
+		</array>
+
+		<array offsets="0x1004,0x1404,0x1804,0x1b84" name="STAGE_CO3" length="4" stride="4">
+			<reg32 offset="0" name="SEL">
+				<bitfield name="FG_ALPHA" pos="0" type="boolean"/> <!-- otherwise bg alpha -->
+			</reg32>
+		</array>
+
+		<reg32 offset="0x0180" name="TRANSP_LOW0"/>
+		<reg32 offset="0x0184" name="TRANSP_LOW1"/>
+		<reg32 offset="0x0188" name="TRANSP_HIGH0"/>
+		<reg32 offset="0x018c" name="TRANSP_HIGH1"/>
+
+		<reg32 offset="0x0200" name="CSC_CONFIG"/>
+
+		<array offset="0x2000" name="CSC" length="1" stride="0x700">
+			<array offset="0x400" name="MV" length="9" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x500" name="PRE_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x580" name="POST_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x600" name="PRE_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x680" name="POST_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+		</array>
+	</array>
+
+	<enum name="mdp4_dma">
+		<value name="DMA_P" value="0"/>
+		<value name="DMA_S" value="1"/>
+		<value name="DMA_E" value="2"/>
+	</enum>
+	<reg32 offset="0x90070" name="DMA_P_OP_MODE"/>
+	<array offset="0x94800" name="LUTN" length="2" stride="0x400">
+		<array offset="0" name="LUT" length="0x100" stride="4">
+			<reg32 offset="0" name="VAL"/>
+		</array>
+	</array>
+	<reg32 offset="0xa0028" name="DMA_S_OP_MODE"/>
+	<!-- I guess if DMA_S has an OP_MODE, it must have a LUT too.. -->
+	<reg32 offset="0xb0070" name="DMA_E_QUANT" length="3" stride="4"/>
+	<array offsets="0x90000,0xa0000,0xb0000" name="DMA" length="3" stride="0x10000" index="mdp4_dma">
+		<reg32 offset="0x0000" name="CONFIG">
+			<bitfield name="G_BPC" low="0" high="1" type="mdp_bpc"/>
+			<bitfield name="B_BPC" low="2" high="3" type="mdp_bpc"/>
+			<bitfield name="R_BPC" low="4" high="5" type="mdp_bpc"/>
+			<bitfield name="PACK_ALIGN_MSB" pos="7" type="boolean"/>
+			<bitfield name="PACK" low="8" high="15"/>
+			<!-- bit 24 is DITHER_EN on DMA_P, DEFLKR_EN on DMA_E -->
+			<bitfield name="DEFLKR_EN" pos="24" type="boolean"/>
+			<bitfield name="DITHER_EN" pos="24" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x0004" name="SRC_SIZE" type="reg_wh"/>
+		<reg32 offset="0x0008" name="SRC_BASE"/>
+		<reg32 offset="0x000c" name="SRC_STRIDE" type="uint"/>
+		<reg32 offset="0x0010" name="DST_SIZE" type="reg_wh"/>
+
+		<reg32 offset="0x0044" name="CURSOR_SIZE">
+			<!-- seems the limit is 64x64: -->
+			<bitfield name="WIDTH" low="0" high="6" type="uint"/>
+			<bitfield name="HEIGHT" low="16" high="22" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0048" name="CURSOR_BASE"/>
+		<reg32 offset="0x004c" name="CURSOR_POS">
+			<bitfield name="X" low="0" high="15" type="uint"/>
+			<bitfield name="Y" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0060" name="CURSOR_BLEND_CONFIG">
+			<bitfield name="CURSOR_EN" pos="0" type="boolean"/>
+			<bitfield name="FORMAT" low="1" high="2" type="mdp4_cursor_format"/>
+			<bitfield name="TRANSP_EN" pos="3" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x0064" name="CURSOR_BLEND_PARAM"/>
+		<reg32 offset="0x0068" name="BLEND_TRANS_LOW"/>
+		<reg32 offset="0x006c" name="BLEND_TRANS_HIGH"/>
+
+		<reg32 offset="0x1004" name="FETCH_CONFIG"/>
+		<array offset="0x3000" name="CSC" length="1" stride="0x700">
+			<array offset="0x400" name="MV" length="9" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x500" name="PRE_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x580" name="POST_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x600" name="PRE_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x680" name="POST_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+		</array>
+	</array>
+
+	<!--
+		TODO length should be 7, but that would collide w/ OVLP2..!?!
+		this register map is a bit strange..
+	 -->
+	<array offset="0x20000" name="PIPE" length="6" stride="0x10000" index="mdp4_pipe">
+		<reg32 offset="0x0000" name="SRC_SIZE" type="reg_wh"/>
+		<reg32 offset="0x0004" name="SRC_XY" type="reg_xy"/>
+		<reg32 offset="0x0008" name="DST_SIZE" type="reg_wh"/>
+		<reg32 offset="0x000c" name="DST_XY" type="reg_xy"/>
+		<reg32 offset="0x0010" name="SRCP0_BASE"/>
+		<reg32 offset="0x0014" name="SRCP1_BASE"/>
+		<reg32 offset="0x0018" name="SRCP2_BASE"/>
+		<reg32 offset="0x001c" name="SRCP3_BASE"/>
+		<reg32 offset="0x0040" name="SRC_STRIDE_A">
+			<bitfield name="P0" low="0" high="15" type="uint"/>
+			<bitfield name="P1" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0044" name="SRC_STRIDE_B">
+			<bitfield name="P2" low="0" high="15" type="uint"/>
+			<bitfield name="P3" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0048" name="SSTILE_FRAME_SIZE" type="reg_wh"/>
+		<reg32 offset="0x0050" name="SRC_FORMAT">
+			<bitfield name="G_BPC" low="0" high="1" type="mdp_bpc"/>
+			<bitfield name="B_BPC" low="2" high="3" type="mdp_bpc"/>
+			<bitfield name="R_BPC" low="4" high="5" type="mdp_bpc"/>
+			<bitfield name="A_BPC" low="6" high="7" type="mdp_bpc_alpha"/>
+			<bitfield name="ALPHA_ENABLE" pos="8" type="boolean"/>
+			<bitfield name="CPP" low="9" high="10" type="uint">
+				<brief>8bit characters per pixel minus 1</brief>
+			</bitfield>
+			<bitfield name="ROTATED_90" pos="12" type="boolean"/>
+			<bitfield name="UNPACK_COUNT" low="13" high="14" type="uint"/>
+			<bitfield name="UNPACK_TIGHT" pos="17" type="boolean"/>
+			<bitfield name="UNPACK_ALIGN_MSB" pos="18" type="boolean"/>
+			<bitfield name="FETCH_PLANES" low="19" high="20" type="uint"/>
+			<bitfield name="SOLID_FILL" pos="22" type="boolean"/>
+			<bitfield name="CHROMA_SAMP" low="26" high="27" type="mdp_chroma_samp_type"/>
+			<bitfield name="FRAME_FORMAT" low="29" high="30" type="mdp4_frame_format"/>
+		</reg32>
+		<reg32 offset="0x0054" name="SRC_UNPACK" type="mdp_unpack_pattern"/>
+		<reg32 offset="0x0058" name="OP_MODE">
+			<bitfield name="SCALEX_EN" pos="0" type="boolean"/>
+			<bitfield name="SCALEY_EN" pos="1" type="boolean"/>
+			<bitfield name="SCALEX_UNIT_SEL" low="2" high="3" type="mdp4_scale_unit"/>
+			<bitfield name="SCALEY_UNIT_SEL" low="4" high="5" type="mdp4_scale_unit"/>
+			<bitfield name="SRC_YCBCR" pos="9" type="boolean"/>
+			<bitfield name="DST_YCBCR" pos="10" type="boolean"/>
+			<bitfield name="CSC_EN" pos="11" type="boolean"/>
+			<bitfield name="FLIP_LR" pos="13" type="boolean"/>
+			<bitfield name="FLIP_UD" pos="14" type="boolean"/>
+			<bitfield name="DITHER_EN" pos="15" type="boolean"/>
+			<bitfield name="IGC_LUT_EN" pos="16" type="boolean"/>
+			<bitfield name="DEINT_EN" pos="18" type="boolean"/>
+			<bitfield name="DEINT_ODD_REF" pos="19" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x005c" name="PHASEX_STEP"/>
+		<reg32 offset="0x0060" name="PHASEY_STEP"/>
+		<reg32 offset="0x1004" name="FETCH_CONFIG"/>
+		<reg32 offset="0x1008" name="SOLID_COLOR"/>
+
+		<array offset="0x4000" name="CSC" length="1" stride="0x700">
+			<array offset="0x400" name="MV" length="9" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x500" name="PRE_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x580" name="POST_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x600" name="PRE_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x680" name="POST_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+		</array>
+	</array>
+
+	<!--
+		ENCODERS
+			LCDC and DSI seem the same, DTV is just slightly different..
+	 -->
+
+	<bitset name="mdp4_ctrl_polarity" inline="yes">
+		<!-- not entirely sure if these bits mean hi or low.. -->
+		<bitfield name="HSYNC_LOW" pos="0" type="boolean"/>
+		<bitfield name="VSYNC_LOW" pos="1" type="boolean"/>
+		<bitfield name="DATA_EN_LOW" pos="2" type="boolean"/>
+	</bitset>
+
+	<bitset name="mdp4_active_hctl" inline="yes">
+		<bitfield name="START" low="0" high="14" type="uint"/>
+		<bitfield name="END" low="16" high="30" type="uint"/>
+		<bitfield name="ACTIVE_START_X" pos="31" type="boolean"/>
+	</bitset>
+
+	<bitset name="mdp4_display_hctl" inline="yes">
+		<bitfield name="START" low="0" high="15" type="uint"/>
+		<bitfield name="END" low="16" high="31" type="uint"/>
+	</bitset>
+
+	<bitset name="mdp4_hsync_ctrl" inline="yes">
+		<bitfield name="PULSEW" low="0" high="15" type="uint"/>
+		<bitfield name="PERIOD" low="16" high="31" type="uint"/>
+	</bitset>
+
+	<bitset name="mdp4_underflow_clr" inline="yes">
+		<bitfield name="COLOR" low="0" high="23"/>
+		<bitfield name="ENABLE_RECOVERY" pos="31" type="boolean"/>
+	</bitset>
+
+	<!-- offset is 0xe0000 on !mdp4.. -->
+	<array offset="0xc0000" name="LCDC" length="1" stride="0x1000">
+		<reg32 offset="0x0000" name="ENABLE"/>
+		<reg32 offset="0x0004" name="HSYNC_CTRL" type="mdp4_hsync_ctrl"/>
+		<reg32 offset="0x0008" name="VSYNC_PERIOD" type="uint"/>
+		<reg32 offset="0x000c" name="VSYNC_LEN" type="uint"/>
+		<reg32 offset="0x0010" name="DISPLAY_HCTRL" type="mdp4_display_hctl"/>
+		<reg32 offset="0x0014" name="DISPLAY_VSTART" type="uint"/>
+		<reg32 offset="0x0018" name="DISPLAY_VEND" type="uint"/>
+		<reg32 offset="0x001c" name="ACTIVE_HCTL" type="mdp4_active_hctl"/>
+		<reg32 offset="0x0020" name="ACTIVE_VSTART" type="uint"/>
+		<reg32 offset="0x0024" name="ACTIVE_VEND" type="uint"/>
+		<reg32 offset="0x0028" name="BORDER_CLR"/>
+		<reg32 offset="0x002c" name="UNDERFLOW_CLR" type="mdp4_underflow_clr"/>
+		<reg32 offset="0x0030" name="HSYNC_SKEW"/>
+		<reg32 offset="0x0034" name="TEST_CNTL"/>
+		<reg32 offset="0x0038" name="CTRL_POLARITY" type="mdp4_ctrl_polarity"/>
+	</array>
+
+	<reg32 offset="0xc2000" name="LCDC_LVDS_INTF_CTL">
+		<bitfield name="MODE_SEL"           pos="2"  type="boolean"/>
+		<bitfield name="RGB_OUT"            pos="3"  type="boolean"/>
+		<bitfield name="CH_SWAP"            pos="4"  type="boolean"/>
+		<bitfield name="CH1_RES_BIT"        pos="5"  type="boolean"/>
+		<bitfield name="CH2_RES_BIT"        pos="6"  type="boolean"/>
+		<bitfield name="ENABLE"             pos="7"  type="boolean"/>
+		<bitfield name="CH1_DATA_LANE0_EN"  pos="8"  type="boolean"/>
+		<bitfield name="CH1_DATA_LANE1_EN"  pos="9"  type="boolean"/>
+		<bitfield name="CH1_DATA_LANE2_EN"  pos="10" type="boolean"/>
+		<bitfield name="CH1_DATA_LANE3_EN"  pos="11" type="boolean"/>
+		<bitfield name="CH2_DATA_LANE0_EN"  pos="12" type="boolean"/>
+		<bitfield name="CH2_DATA_LANE1_EN"  pos="13" type="boolean"/>
+		<bitfield name="CH2_DATA_LANE2_EN"  pos="14" type="boolean"/>
+		<bitfield name="CH2_DATA_LANE3_EN"  pos="15" type="boolean"/>
+		<bitfield name="CH1_CLK_LANE_EN"    pos="16" type="boolean"/>
+		<bitfield name="CH2_CLK_LANE_EN"    pos="17" type="boolean"/>
+	</reg32>
+
+	<array offset="0xc2014" name="LCDC_LVDS_MUX_CTL" length="4" stride="0x8">
+		<reg32 offset="0x0" name="3_TO_0">
+			<bitfield name="BIT0" low="0"  high="7"/>
+			<bitfield name="BIT1" low="8"  high="15"/>
+			<bitfield name="BIT2" low="16" high="23"/>
+			<bitfield name="BIT3" low="24" high="31"/>
+		</reg32>
+		<reg32 offset="0x4" name="6_TO_4">
+			<bitfield name="BIT4" low="0"  high="7"/>
+			<bitfield name="BIT5" low="8"  high="15"/>
+			<bitfield name="BIT6" low="16" high="23"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0xc2034" name="LCDC_LVDS_PHY_RESET"/>
+
+	<reg32 offset="0xc3000" name="LVDS_PHY_PLL_CTRL_0"/>
+	<reg32 offset="0xc3004" name="LVDS_PHY_PLL_CTRL_1"/>
+	<reg32 offset="0xc3008" name="LVDS_PHY_PLL_CTRL_2"/>
+	<reg32 offset="0xc300c" name="LVDS_PHY_PLL_CTRL_3"/>
+	<reg32 offset="0xc3014" name="LVDS_PHY_PLL_CTRL_5"/>
+	<reg32 offset="0xc3018" name="LVDS_PHY_PLL_CTRL_6"/>
+	<reg32 offset="0xc301c" name="LVDS_PHY_PLL_CTRL_7"/>
+	<reg32 offset="0xc3020" name="LVDS_PHY_PLL_CTRL_8"/>
+	<reg32 offset="0xc3024" name="LVDS_PHY_PLL_CTRL_9"/>
+	<reg32 offset="0xc3080" name="LVDS_PHY_PLL_LOCKED"/>
+	<reg32 offset="0xc3108" name="LVDS_PHY_CFG2"/>
+
+	<reg32 offset="0xc3100" name="LVDS_PHY_CFG0">
+		<bitfield name="SERIALIZATION_ENBLE" pos="4" type="boolean"/>
+		<bitfield name="CHANNEL0" pos="6" type="boolean"/>
+		<bitfield name="CHANNEL1" pos="7" type="boolean"/>
+	</reg32>
+
+	<array offset="0xd0000" name="DTV" length="1" stride="0x1000">
+		<reg32 offset="0x0000" name="ENABLE"/>
+		<reg32 offset="0x0004" name="HSYNC_CTRL" type="mdp4_hsync_ctrl"/>
+		<reg32 offset="0x0008" name="VSYNC_PERIOD" type="uint"/>
+		<reg32 offset="0x000c" name="VSYNC_LEN" type="uint"/>
+		<reg32 offset="0x0018" name="DISPLAY_HCTRL" type="mdp4_display_hctl"/>
+		<reg32 offset="0x001c" name="DISPLAY_VSTART" type="uint"/>
+		<reg32 offset="0x0020" name="DISPLAY_VEND" type="uint"/>
+		<reg32 offset="0x002c" name="ACTIVE_HCTL" type="mdp4_active_hctl"/>
+		<reg32 offset="0x0030" name="ACTIVE_VSTART" type="uint"/>
+		<reg32 offset="0x0038" name="ACTIVE_VEND" type="uint"/>
+		<reg32 offset="0x0040" name="BORDER_CLR"/>
+		<reg32 offset="0x0044" name="UNDERFLOW_CLR" type="mdp4_underflow_clr"/>
+		<reg32 offset="0x0048" name="HSYNC_SKEW"/>
+		<reg32 offset="0x004c" name="TEST_CNTL"/>
+		<reg32 offset="0x0050" name="CTRL_POLARITY" type="mdp4_ctrl_polarity"/>
+	</array>
+
+	<array offset="0xe0000" name="DSI" length="1" stride="0x1000">
+		<reg32 offset="0x0000" name="ENABLE"/>
+		<reg32 offset="0x0004" name="HSYNC_CTRL" type="mdp4_hsync_ctrl"/>
+		<reg32 offset="0x0008" name="VSYNC_PERIOD" type="uint"/>
+		<reg32 offset="0x000c" name="VSYNC_LEN" type="uint"/>
+		<reg32 offset="0x0010" name="DISPLAY_HCTRL" type="mdp4_display_hctl"/>
+		<reg32 offset="0x0014" name="DISPLAY_VSTART" type="uint"/>
+		<reg32 offset="0x0018" name="DISPLAY_VEND" type="uint"/>
+		<reg32 offset="0x001c" name="ACTIVE_HCTL" type="mdp4_active_hctl"/>
+		<reg32 offset="0x0020" name="ACTIVE_VSTART" type="uint"/>
+		<reg32 offset="0x0024" name="ACTIVE_VEND" type="uint"/>
+		<reg32 offset="0x0028" name="BORDER_CLR"/>
+		<reg32 offset="0x002c" name="UNDERFLOW_CLR" type="mdp4_underflow_clr"/>
+		<reg32 offset="0x0030" name="HSYNC_SKEW"/>
+		<reg32 offset="0x0034" name="TEST_CNTL"/>
+		<reg32 offset="0x0038" name="CTRL_POLARITY" type="mdp4_ctrl_polarity"/>
+	</array>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/mdp5.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/mdp5.xml
@@ -0,0 +1,790 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="display/mdp_common.xml"/>
+
+<!-- where does this belong? -->
+<domain name="VBIF" width="32">
+</domain>
+
+<domain name="MDP5" width="32">
+
+	<enum name="mdp5_intf_type">
+		<value name="INTF_DISABLED" value="0x0"/>
+		<value name="INTF_DSI"  value="0x1"/>
+		<value name="INTF_HDMI" value="0x3"/>
+		<value name="INTF_LCDC" value="0x5"/>
+		<value name="INTF_eDP"  value="0x9"/>
+		<value name="INTF_VIRTUAL"  value="0x64"/>
+		<!-- non-display interfaces are listed below: -->
+		<value name="INTF_WB"  value="0x65"/>
+	</enum>
+
+	<enum name="mdp5_intfnum">
+		<value name="NO_INTF" value="0"/>
+		<value name="INTF0"   value="1"/>
+		<value name="INTF1"   value="2"/>
+		<value name="INTF2"   value="3"/>
+		<value name="INTF3"   value="4"/>
+	</enum>
+
+	<enum name="mdp5_pipe">
+		<value name="SSPP_NONE" value="0"/>
+		<value name="SSPP_VIG0" value="1"/>
+		<value name="SSPP_VIG1" value="2"/>
+		<value name="SSPP_VIG2" value="3"/>
+		<value name="SSPP_RGB0" value="4"/>
+		<value name="SSPP_RGB1" value="5"/>
+		<value name="SSPP_RGB2" value="6"/>
+		<value name="SSPP_DMA0" value="7"/>
+		<value name="SSPP_DMA1" value="8"/>
+		<value name="SSPP_VIG3" value="9"/>
+		<value name="SSPP_RGB3" value="10"/>
+		<value name="SSPP_CURSOR0" value="11"/>
+		<value name="SSPP_CURSOR1" value="12"/>
+	</enum>
+
+	<enum name="mdp5_format">
+		<!-- TODO -->
+		<value name="DUMMY" value="0"/>
+	</enum>
+
+	<enum name="mdp5_ctl_mode">
+		<value name="MODE_NONE" value="0"/>
+		<value name="MODE_WB_0_BLOCK" value="1"/>
+		<value name="MODE_WB_1_BLOCK" value="2"/>
+		<value name="MODE_WB_0_LINE" value="3"/>
+		<value name="MODE_WB_1_LINE" value="4"/>
+		<value name="MODE_WB_2_LINE" value="5"/>
+	</enum>
+
+	<enum name="mdp5_pack_3d">
+		<value name="PACK_3D_FRAME_INT" value="0"/>
+		<value name="PACK_3D_H_ROW_INT" value="1"/>
+		<value name="PACK_3D_V_ROW_INT" value="2"/>
+		<value name="PACK_3D_COL_INT"   value="3"/>
+	</enum>
+
+	<enum name="mdp5_scale_filter">
+		<value name="SCALE_FILTER_NEAREST" value="0"/>
+		<value name="SCALE_FILTER_BIL" value="1"/>
+		<value name="SCALE_FILTER_PCMN" value="2"/>
+		<value name="SCALE_FILTER_CA" value="3"/>
+	</enum>
+
+	<enum name="mdp5_pipe_bwc">
+		<value name="BWC_LOSSLESS" value="0"/>
+		<value name="BWC_Q_HIGH"   value="1"/>
+		<value name="BWC_Q_MED"    value="2"/>
+	</enum>
+
+	<enum name="mdp5_cursor_format">
+		<value name="CURSOR_FMT_ARGB8888" value="0"/>
+		<value name="CURSOR_FMT_ARGB1555" value="2"/>
+		<value name="CURSOR_FMT_ARGB4444" value="4"/>
+	</enum>
+
+	<enum name="mdp5_cursor_alpha">
+		<value name="CURSOR_ALPHA_CONST" value="0"/>
+		<value name="CURSOR_ALPHA_PER_PIXEL" value="2"/>
+	</enum>
+
+	<bitset name="MDP5_IRQ">
+		<bitfield name="WB_0_DONE"                pos="0"  type="boolean"/>
+		<bitfield name="WB_1_DONE"                pos="1"  type="boolean"/>
+		<bitfield name="WB_2_DONE"                pos="4"  type="boolean"/>
+		<bitfield name="PING_PONG_0_DONE"         pos="8"  type="boolean"/>
+		<bitfield name="PING_PONG_1_DONE"         pos="9"  type="boolean"/>
+		<bitfield name="PING_PONG_2_DONE"         pos="10" type="boolean"/>
+		<bitfield name="PING_PONG_3_DONE"         pos="11" type="boolean"/>
+		<bitfield name="PING_PONG_0_RD_PTR"       pos="12" type="boolean"/>
+		<bitfield name="PING_PONG_1_RD_PTR"       pos="13" type="boolean"/>
+		<bitfield name="PING_PONG_2_RD_PTR"       pos="14" type="boolean"/>
+		<bitfield name="PING_PONG_3_RD_PTR"       pos="15" type="boolean"/>
+		<bitfield name="PING_PONG_0_WR_PTR"       pos="16" type="boolean"/>
+		<bitfield name="PING_PONG_1_WR_PTR"       pos="17" type="boolean"/>
+		<bitfield name="PING_PONG_2_WR_PTR"       pos="18" type="boolean"/>
+		<bitfield name="PING_PONG_3_WR_PTR"       pos="19" type="boolean"/>
+		<bitfield name="PING_PONG_0_AUTO_REF"     pos="20" type="boolean"/>
+		<bitfield name="PING_PONG_1_AUTO_REF"     pos="21" type="boolean"/>
+		<bitfield name="PING_PONG_2_AUTO_REF"     pos="22" type="boolean"/>
+		<bitfield name="PING_PONG_3_AUTO_REF"     pos="23" type="boolean"/>
+		<bitfield name="INTF0_UNDER_RUN"          pos="24" type="boolean"/>
+		<bitfield name="INTF0_VSYNC"              pos="25" type="boolean"/>
+		<bitfield name="INTF1_UNDER_RUN"          pos="26" type="boolean"/>
+		<bitfield name="INTF1_VSYNC"              pos="27" type="boolean"/>
+		<bitfield name="INTF2_UNDER_RUN"          pos="28" type="boolean"/>
+		<bitfield name="INTF2_VSYNC"              pos="29" type="boolean"/>
+		<bitfield name="INTF3_UNDER_RUN"          pos="30" type="boolean"/>
+		<bitfield name="INTF3_VSYNC"              pos="31" type="boolean"/>
+	</bitset>
+
+	<bitset name="mdp5_smp_alloc" inline="yes">
+        <!-- Use "mdp5_cfg->mdp.smp.clients[enum mdp5_pipe]" instead -->
+		<bitfield name="CLIENT0" low="0"  high="7"  type="uint"/>
+		<bitfield name="CLIENT1" low="8"  high="15" type="uint"/>
+		<bitfield name="CLIENT2" low="16" high="23" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x00000" name="HW_VERSION">
+		<bitfield name="STEP" low="0" high="15" type="uint"/>
+		<bitfield name="MINOR" low="16" high="27" type="uint"/>
+		<bitfield name="MAJOR" low="28" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00004" name="DISP_INTF_SEL">
+		<bitfield name="INTF0" low="0"  high="7"  type="mdp5_intf_type"/>
+		<bitfield name="INTF1" low="8"  high="15" type="mdp5_intf_type"/>
+		<bitfield name="INTF2" low="16" high="23" type="mdp5_intf_type"/>
+		<bitfield name="INTF3" low="24" high="31" type="mdp5_intf_type"/>
+	</reg32>
+	<reg32 offset="0x00010" name="INTR_EN" type="MDP5_IRQ"/>
+	<reg32 offset="0x00014" name="INTR_STATUS" type="MDP5_IRQ"/>
+	<reg32 offset="0x00018" name="INTR_CLEAR" type="MDP5_IRQ"/>
+	<reg32 offset="0x0001C" name="HIST_INTR_EN"/>
+	<reg32 offset="0x00020" name="HIST_INTR_STATUS"/>
+	<reg32 offset="0x00024" name="HIST_INTR_CLEAR"/>
+	<reg32 offset="0x00028" name="SPARE_0">
+		<bitfield name="SPLIT_DPL_SINGLE_FLUSH_EN" pos="0"/>
+	</reg32>
+
+	<array offset="0x00080" name="SMP_ALLOC_W" length="8" stride="4">
+		<reg32 offset="0" name="REG" type="mdp5_smp_alloc"/>
+	</array>
+	<array offset="0x00130" name="SMP_ALLOC_R" length="8" stride="4">
+		<reg32 offset="0" name="REG" type="mdp5_smp_alloc"/>
+	</array>
+
+	<enum name="mdp5_igc_type">
+		<value name="IGC_VIG" value="0"/>		<!-- 0x200 -->
+		<value name="IGC_RGB" value="1"/>		<!-- 0x210 -->
+		<value name="IGC_DMA" value="2"/>		<!-- 0x220 -->
+		<value name="IGC_DSPP" value="3"/>		<!-- 0x300 -->
+	</enum>
+	<array offsets="0x00200,0x00210,0x00220,0x00300" name="IGC" length="3" stride="0x10" index="mdp5_igc_type">
+		<array offset="0x00" name="LUT" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VAL" low="0" high="11"/>
+				<bitfield name="INDEX_UPDATE" pos="25" type="boolean"/>
+				<!--
+					not sure about these:
+						/* INDEX_UPDATE */
+						data = (1 << 25) | (((~(1 << blk_idx)) & 0x7) << 28);
+						MDSS_MDP_REG_WRITE(offset, (cfg->c0_c1_data[0] & 0xFFF) | data);
+				-->
+				<bitfield name="DISABLE_PIPE_0" pos="28" type="boolean"/>
+				<bitfield name="DISABLE_PIPE_1" pos="29" type="boolean"/>
+				<bitfield name="DISABLE_PIPE_2" pos="30" type="boolean"/>
+			</reg32>
+		</array>
+	</array>
+	<reg32 offset="0x002f4" name="SPLIT_DPL_EN"/>
+	<reg32 offset="0x002f8" name="SPLIT_DPL_UPPER">
+		<bitfield name="SMART_PANEL" pos="1" type="boolean"/>
+		<bitfield name="SMART_PANEL_FREE_RUN" pos="2" type="boolean"/>
+		<bitfield name="INTF1_SW_TRG_MUX" pos="4" type="boolean"/>
+		<bitfield name="INTF2_SW_TRG_MUX" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x003f0" name="SPLIT_DPL_LOWER">
+		<bitfield name="SMART_PANEL" pos="1" type="boolean"/>
+		<bitfield name="SMART_PANEL_FREE_RUN" pos="2" type="boolean"/>
+		<bitfield name="INTF1_TG_SYNC" pos="4" type="boolean"/>
+		<bitfield name="INTF2_TG_SYNC" pos="8" type="boolean"/>
+	</reg32>
+
+<!-- check length/index.. -->
+	<array doffsets="mdp5_cfg->ctl.base[0],mdp5_cfg->ctl.base[1],mdp5_cfg->ctl.base[2],mdp5_cfg->ctl.base[3],mdp5_cfg->ctl.base[4]" name="CTL" length="5" stride="0x400">
+		<array offsets="0x000,0x004,0x008,0x00C,0x010,0x024" name="LAYER" length="6" stride="4">
+			<!--
+			NOTE: for backwards compat (from when there were fewer stages),
+			this register has the low three bits of mdp_mixer_stage_id, with
+			the high bit coming from LAYER_EXT
+			 -->
+			<reg32 offset="0" name="REG">
+				<bitfield name="VIG0"  low="0"  high="2"  type="uint"/>
+				<bitfield name="VIG1"  low="3"  high="5"  type="uint"/>
+				<bitfield name="VIG2"  low="6"  high="8"  type="uint"/>
+				<bitfield name="RGB0"  low="9"  high="11" type="uint"/>
+				<bitfield name="RGB1"  low="12" high="14" type="uint"/>
+				<bitfield name="RGB2"  low="15" high="17" type="uint"/>
+				<bitfield name="DMA0"  low="18" high="20" type="uint"/>
+				<bitfield name="DMA1"  low="21" high="23" type="uint"/>
+				<bitfield name="BORDER_COLOR" pos="24" type="boolean"/>
+				<bitfield name="CURSOR_OUT"   pos="25" type="boolean"/>
+				<bitfield name="VIG3"  low="26"  high="28"  type="uint"/>
+				<bitfield name="RGB3"  low="29" high="31" type="uint"/>
+			</reg32>
+		</array>
+		<reg32 offset="0x014" name="OP">
+			<bitfield name="MODE" low="0" high="3" type="mdp5_ctl_mode"/>
+			<bitfield name="INTF_NUM" low="4" high="6" type="mdp5_intfnum"/>
+			<bitfield name="CMD_MODE" pos="17" type="boolean"/>
+			<bitfield name="PACK_3D_ENABLE" pos="19" type="boolean"/>
+			<bitfield name="PACK_3D" low="20" high="21" type="mdp5_pack_3d"/>
+		</reg32>
+		<reg32 offset="0x018" name="FLUSH">
+			<bitfield name="VIG0" pos="0"  type="boolean"/>
+			<bitfield name="VIG1" pos="1"  type="boolean"/>
+			<bitfield name="VIG2" pos="2"  type="boolean"/>
+			<bitfield name="RGB0" pos="3"  type="boolean"/>
+			<bitfield name="RGB1" pos="4"  type="boolean"/>
+			<bitfield name="RGB2" pos="5"  type="boolean"/>
+			<bitfield name="LM0"  pos="6"  type="boolean"/>
+			<bitfield name="LM1"  pos="7"  type="boolean"/>
+			<bitfield name="LM2"  pos="8"  type="boolean"/>
+			<bitfield name="LM3"  pos="9"  type="boolean"/>
+			<bitfield name="LM4"  pos="10"  type="boolean"/>
+			<bitfield name="DMA0" pos="11" type="boolean"/>
+			<bitfield name="DMA1" pos="12" type="boolean"/>
+			<bitfield name="DSPP0" pos="13" type="boolean"/>
+			<bitfield name="DSPP1" pos="14" type="boolean"/>
+			<bitfield name="DSPP2" pos="15" type="boolean"/>
+			<bitfield name="WB"   pos="16" type="boolean"/>
+			<bitfield name="CTL"   pos="17" type="boolean"/>
+			<bitfield name="VIG3" pos="18"  type="boolean"/>
+			<bitfield name="RGB3" pos="19"  type="boolean"/>
+			<bitfield name="LM5"  pos="20"  type="boolean"/>
+			<bitfield name="DSPP3" pos="21" type="boolean"/>
+			<bitfield name="CURSOR_0" pos="22" type="boolean"/>
+			<bitfield name="CURSOR_1" pos="23" type="boolean"/>
+			<bitfield name="CHROMADOWN_0" pos="26" type="boolean"/>
+			<bitfield name="TIMING_3" pos="28" type="boolean"/>
+			<bitfield name="TIMING_2" pos="29" type="boolean"/>
+			<bitfield name="TIMING_1" pos="30" type="boolean"/>
+			<bitfield name="TIMING_0" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x01C" name="START"/>
+		<reg32 offset="0x020" name="PACK_3D"/>
+		<array offsets="0x040,0x044,0x048,0x04C,0x050,0x054" name="LAYER_EXT" length="6" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VIG0_BIT3"  pos="0"  type="boolean"/>
+				<bitfield name="VIG1_BIT3"  pos="2"  type="boolean"/>
+				<bitfield name="VIG2_BIT3"  pos="4"  type="boolean"/>
+				<bitfield name="VIG3_BIT3"  pos="6"  type="boolean"/>
+				<bitfield name="RGB0_BIT3"  pos="8"  type="boolean"/>
+				<bitfield name="RGB1_BIT3"  pos="10"  type="boolean"/>
+				<bitfield name="RGB2_BIT3"  pos="12"  type="boolean"/>
+				<bitfield name="RGB3_BIT3"  pos="14"  type="boolean"/>
+				<bitfield name="DMA0_BIT3"  pos="16"  type="boolean"/>
+				<bitfield name="DMA1_BIT3"  pos="18"  type="boolean"/>
+				<bitfield name="CURSOR0" low="20"  high="23"  type="mdp_mixer_stage_id"/>
+				<bitfield name="CURSOR1" low="26"  high="29"  type="mdp_mixer_stage_id"/>
+			</reg32>
+		</array>
+	</array>
+
+	<enum name="mdp5_data_format">
+		<value name="DATA_FORMAT_RGB" value="0"/>
+		<value name="DATA_FORMAT_YUV" value="1"/>
+	</enum>
+
+	<array doffsets="INVALID_IDX(idx),mdp5_cfg->pipe_vig.base[0],mdp5_cfg->pipe_vig.base[1],mdp5_cfg->pipe_vig.base[2],mdp5_cfg->pipe_rgb.base[0],mdp5_cfg->pipe_rgb.base[1],mdp5_cfg->pipe_rgb.base[2],mdp5_cfg->pipe_dma.base[0],mdp5_cfg->pipe_dma.base[1],mdp5_cfg->pipe_vig.base[3],mdp5_cfg->pipe_rgb.base[3],mdp5_cfg->pipe_cursor.base[0],mdp5_cfg->pipe_cursor.base[1]" name="PIPE" length="10" stride="0x400" index="mdp5_pipe">
+		<reg32 offset="0x200" name="OP_MODE">
+			<bitfield name="CSC_DST_DATA_FORMAT" pos="19" type="mdp5_data_format"/>
+			<bitfield name="CSC_SRC_DATA_FORMAT" pos="18" type="mdp5_data_format"/>
+			<bitfield name="CSC_1_EN" pos="17" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x2C4" name="HIST_CTL_BASE"/>
+		<reg32 offset="0x2F0" name="HIST_LUT_BASE"/>
+		<reg32 offset="0x300" name="HIST_LUT_SWAP"/>
+		<reg32 offset="0x320" name="CSC_1_MATRIX_COEFF_0">
+			<bitfield name="COEFF_11" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_12" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x324" name="CSC_1_MATRIX_COEFF_1">
+			<bitfield name="COEFF_13" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_21" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x328" name="CSC_1_MATRIX_COEFF_2">
+			<bitfield name="COEFF_22" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_23" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x32c" name="CSC_1_MATRIX_COEFF_3">
+			<bitfield name="COEFF_31" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_32" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x330" name="CSC_1_MATRIX_COEFF_4">
+			<bitfield name="COEFF_33" low="0" high="12" type="uint"/>
+		</reg32>
+		<array offset="0x334" name="CSC_1_PRE_CLAMP" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="HIGH"  low="0"  high="7"  type="uint"/>
+				<bitfield name="LOW"  low="8"  high="15"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x340" name="CSC_1_POST_CLAMP" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="HIGH"  low="0"  high="7"  type="uint"/>
+				<bitfield name="LOW"  low="8"  high="15"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x34c" name="CSC_1_PRE_BIAS" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VALUE"  low="0"  high="8"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x358" name="CSC_1_POST_BIAS" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VALUE"  low="0"  high="8"  type="uint"/>
+			</reg32>
+		</array>
+		<!-- SSPP: -->
+		<reg32 offset="0x000" name="SRC_SIZE" type="reg_wh"/>
+		<reg32 offset="0x004" name="SRC_IMG_SIZE" type="reg_wh"/>
+		<reg32 offset="0x008" name="SRC_XY" type="reg_xy"/>
+		<reg32 offset="0x00C" name="OUT_SIZE" type="reg_wh"/>
+		<reg32 offset="0x010" name="OUT_XY" type="reg_xy"/>
+		<reg32 offset="0x014" name="SRC0_ADDR"/>
+		<reg32 offset="0x018" name="SRC1_ADDR"/>
+		<reg32 offset="0x01C" name="SRC2_ADDR"/>
+		<reg32 offset="0x020" name="SRC3_ADDR"/>
+		<reg32 offset="0x024" name="SRC_STRIDE_A">
+			<bitfield name="P0" low="0" high="15" type="uint"/>
+			<bitfield name="P1" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x028" name="SRC_STRIDE_B">
+			<bitfield name="P2" low="0" high="15" type="uint"/>
+			<bitfield name="P3" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x02C" name="STILE_FRAME_SIZE"/>
+		<reg32 offset="0x030" name="SRC_FORMAT">
+			<bitfield name="G_BPC" low="0" high="1" type="mdp_bpc"/>
+			<bitfield name="B_BPC" low="2" high="3" type="mdp_bpc"/>
+			<bitfield name="R_BPC" low="4" high="5" type="mdp_bpc"/>
+			<bitfield name="A_BPC" low="6" high="7" type="mdp_bpc_alpha"/>
+			<bitfield name="ALPHA_ENABLE" pos="8" type="boolean"/>
+			<bitfield name="CPP" low="9" high="10" type="uint">
+				<brief>8bit characters per pixel minus 1</brief>
+			</bitfield>
+			<bitfield name="ROT90" pos="11" type="boolean"/>
+			<bitfield name="UNPACK_COUNT" low="12" high="13" type="uint"/>
+			<bitfield name="UNPACK_TIGHT" pos="17" type="boolean"/>
+			<bitfield name="UNPACK_ALIGN_MSB" pos="18" type="boolean"/>
+			<bitfield name="FETCH_TYPE" low="19" high="20" type="mdp_fetch_type"/>
+			<bitfield name="CHROMA_SAMP" low="23" high="24" type="mdp_chroma_samp_type"/>
+		</reg32>
+		<reg32 offset="0x034" name="SRC_UNPACK" type="mdp_unpack_pattern"/>
+		<reg32 offset="0x038" name="SRC_OP_MODE">
+			<bitfield name="BWC_EN" pos="0" type="boolean"/>
+			<bitfield name="BWC" low="1" high="2" type="mdp5_pipe_bwc"/>
+			<bitfield name="FLIP_LR" pos="13" type="boolean"/>
+			<bitfield name="FLIP_UD" pos="14" type="boolean"/>
+			<bitfield name="IGC_EN" pos="16" type="boolean"/>
+			<bitfield name="IGC_ROM_0" pos="17" type="boolean"/>
+			<bitfield name="IGC_ROM_1" pos="18" type="boolean"/>
+			<bitfield name="DEINTERLACE" pos="22" type="boolean"/>
+			<bitfield name="DEINTERLACE_ODD" pos="23" type="boolean"/>
+			<bitfield name="SW_PIX_EXT_OVERRIDE" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x03c" name="SRC_CONSTANT_COLOR"/>
+		<reg32 offset="0x048" name="FETCH_CONFIG"/>
+		<reg32 offset="0x04c" name="VC1_RANGE"/>
+		<reg32 offset="0x050" name="REQPRIO_FIFO_WM_0"/>
+		<reg32 offset="0x054" name="REQPRIO_FIFO_WM_1"/>
+		<reg32 offset="0x058" name="REQPRIO_FIFO_WM_2"/>
+		<reg32 offset="0x070" name="SRC_ADDR_SW_STATUS"/>
+		<reg32 offset="0x0a4" name="CURRENT_SRC0_ADDR"/>
+		<reg32 offset="0x0a8" name="CURRENT_SRC1_ADDR"/>
+		<reg32 offset="0x0ac" name="CURRENT_SRC2_ADDR"/>
+		<reg32 offset="0x0b0" name="CURRENT_SRC3_ADDR"/>
+		<reg32 offset="0x0b4" name="DECIMATION">
+			<bitfield name="VERT" low="0" high="7" type="uint"/>
+			<bitfield name="HORZ" low="8" high="15" type="uint"/>
+		</reg32>
+		<array offsets="0x100,0x110,0x120" name="SW_PIX_EXT" length="3" stride="0x10" index="mdp_component_type">
+			<!--
+				Notes:
+				o These value only take effect if SW_PIX_EXT_OVERRIDE is set in SRC_OP_MODE register
+				o For signed values (int): + indicates overfetch, - indicates line drop
+			-->
+                        <reg32 offset="0x00" name="LR">
+				<bitfield name="LEFT_RPT" low="0" high="7" type="uint"/>
+				<bitfield name="LEFT_OVF" low="8" high="15" type="int"/>
+				<bitfield name="RIGHT_RPT" low="16" high="23" type="uint"/>
+				<bitfield name="RIGHT_OVF" low="24" high="31" type="int"/>
+			</reg32>
+			<reg32 offset="0x04" name="TB">
+				<bitfield name="TOP_RPT" low="0" high="7" type="uint"/>
+				<bitfield name="TOP_OVF" low="8" high="15" type="int"/>
+				<bitfield name="BOTTOM_RPT" low="16" high="23" type="uint"/>
+				<bitfield name="BOTTOM_OVF" low="24" high="31" type="int"/>
+			</reg32>
+			<reg32 offset="0x08" name="REQ_PIXELS">
+				<bitfield name="LEFT_RIGHT" low="0" high="15" type="uint"/>
+				<bitfield name="TOP_BOTTOM" low="16" high="31" type="uint"/>
+			</reg32>
+		</array>
+		<reg32 offset="0x204" name="SCALE_CONFIG">
+			<bitfield name="SCALEX_EN" pos="0" type="boolean"/>
+			<bitfield name="SCALEY_EN" pos="1" type="boolean"/>
+			<bitfield name="SCALEX_FILTER_COMP_0" low="8"  high="9"  type="mdp5_scale_filter"/>
+			<bitfield name="SCALEY_FILTER_COMP_0" low="10" high="11" type="mdp5_scale_filter"/>
+			<bitfield name="SCALEX_FILTER_COMP_1_2"  low="12" high="13" type="mdp5_scale_filter"/>
+			<bitfield name="SCALEY_FILTER_COMP_1_2"  low="14" high="15" type="mdp5_scale_filter"/>
+			<bitfield name="SCALEX_FILTER_COMP_3" low="16" high="17" type="mdp5_scale_filter"/>
+			<bitfield name="SCALEY_FILTER_COMP_3" low="18" high="19" type="mdp5_scale_filter"/>
+		</reg32>
+		<reg32 offset="0x210" name="SCALE_PHASE_STEP_X"/>
+		<reg32 offset="0x214" name="SCALE_PHASE_STEP_Y"/>
+		<reg32 offset="0x218" name="SCALE_CR_PHASE_STEP_X"/>
+		<reg32 offset="0x21c" name="SCALE_CR_PHASE_STEP_Y"/>
+		<reg32 offset="0x220" name="SCALE_INIT_PHASE_X"/>
+		<reg32 offset="0x224" name="SCALE_INIT_PHASE_Y"/>
+	</array>
+
+	<array doffsets="mdp5_cfg->lm.base[0],mdp5_cfg->lm.base[1],mdp5_cfg->lm.base[2],mdp5_cfg->lm.base[3],mdp5_cfg->lm.base[4],mdp5_cfg->lm.base[5]" name="LM" length="6" stride="0x400">
+		<reg32 offset="0x000" name="BLEND_COLOR_OUT">
+			<bitfield name="STAGE0_FG_ALPHA" pos="1" type="boolean"/>
+			<bitfield name="STAGE1_FG_ALPHA" pos="2" type="boolean"/>
+			<bitfield name="STAGE2_FG_ALPHA" pos="3" type="boolean"/>
+			<bitfield name="STAGE3_FG_ALPHA" pos="4" type="boolean"/>
+			<bitfield name="STAGE4_FG_ALPHA" pos="5" type="boolean"/>
+			<bitfield name="STAGE5_FG_ALPHA" pos="6" type="boolean"/>
+			<bitfield name="STAGE6_FG_ALPHA" pos="7" type="boolean"/>
+			<bitfield name="SPLIT_LEFT_RIGHT" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x004" name="OUT_SIZE" type="reg_wh"/>
+		<reg32 offset="0x008" name="BORDER_COLOR_0"/>
+		<reg32 offset="0x010" name="BORDER_COLOR_1"/>
+		<array offsets="0x020,0x050,0x080,0x0B0,0x230,0x260,0x290" name="BLEND" length="7" stride="0x30">
+			<reg32 offset="0x00" name="OP_MODE">
+				<bitfield name="FG_ALPHA" low="0" high="1" type="mdp_alpha_type"/>
+				<bitfield name="FG_INV_ALPHA"     pos="2"  type="boolean"/>
+				<bitfield name="FG_MOD_ALPHA"     pos="3"  type="boolean"/>
+				<bitfield name="FG_INV_MOD_ALPHA" pos="4"  type="boolean"/>
+				<bitfield name="FG_TRANSP_EN"     pos="5"  type="boolean"/>
+				<bitfield name="BG_ALPHA" low="8" high="9" type="mdp_alpha_type"/>
+				<bitfield name="BG_INV_ALPHA"     pos="10" type="boolean"/>
+				<bitfield name="BG_MOD_ALPHA"     pos="11" type="boolean"/>
+				<bitfield name="BG_INV_MOD_ALPHA" pos="12" type="boolean"/>
+				<bitfield name="BG_TRANSP_EN"     pos="13" type="boolean"/>
+			</reg32>
+			<reg32 offset="0x04" name="FG_ALPHA"/>
+			<reg32 offset="0x08" name="BG_ALPHA"/>
+			<reg32 offset="0x0c" name="FG_TRANSP_LOW0"/>
+			<reg32 offset="0x10" name="FG_TRANSP_LOW1"/>
+			<reg32 offset="0x14" name="FG_TRANSP_HIGH0"/>
+			<reg32 offset="0x18" name="FG_TRANSP_HIGH1"/>
+			<reg32 offset="0x1c" name="BG_TRANSP_LOW0"/>
+			<reg32 offset="0x20" name="BG_TRANSP_LOW1"/>
+			<reg32 offset="0x24" name="BG_TRANSP_HIGH0"/>
+			<reg32 offset="0x28" name="BG_TRANSP_HIGH1"/>
+		</array>
+		<reg32 offset="0x0e0" name="CURSOR_IMG_SIZE">
+			<bitfield name="SRC_W" low="0" high="15" type="uint"/>
+			<bitfield name="SRC_H" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0e4" name="CURSOR_SIZE">
+			<bitfield name="ROI_W" low="0" high="15" type="uint"/>
+			<bitfield name="ROI_H" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0e8" name="CURSOR_XY">
+			<bitfield name="SRC_X" low="0" high="15" type="uint"/>
+			<bitfield name="SRC_Y" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0dc" name="CURSOR_STRIDE">
+			<bitfield name="STRIDE" low="0"  high="15"  type="uint"/>
+		</reg32>
+		<reg32 offset="0x0ec" name="CURSOR_FORMAT">
+			<bitfield name="FORMAT" low="0"  high="2"  type="mdp5_cursor_format"/>
+		</reg32>
+		<reg32 offset="0x0f0" name="CURSOR_BASE_ADDR"/>
+		<reg32 offset="0x0f4" name="CURSOR_START_XY">
+			<bitfield name="X_START" low="0" high="15" type="uint"/>
+			<bitfield name="Y_START" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0f8" name="CURSOR_BLEND_CONFIG">
+			<bitfield name="BLEND_EN" pos="0" type="boolean"/>
+			<bitfield name="BLEND_ALPHA_SEL" low="1"  high="2"  type="mdp5_cursor_alpha"/>
+			<bitfield name="BLEND_TRANSP_EN" pos="3" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x0fc" name="CURSOR_BLEND_PARAM"/>
+		<reg32 offset="0x100" name="CURSOR_BLEND_TRANSP_LOW0"/>
+		<reg32 offset="0x104" name="CURSOR_BLEND_TRANSP_LOW1"/>
+		<reg32 offset="0x108" name="CURSOR_BLEND_TRANSP_HIGH0"/>
+		<reg32 offset="0x10c" name="CURSOR_BLEND_TRANSP_HIGH1"/>
+		<reg32 offset="0x110" name="GC_LUT_BASE"/>
+	</array>
+
+	<array doffsets="mdp5_cfg->dspp.base[0],mdp5_cfg->dspp.base[1],mdp5_cfg->dspp.base[2],mdp5_cfg->dspp.base[3]" name="DSPP" length="4" stride="0x400">
+		<reg32 offset="0x000" name="OP_MODE">
+			<bitfield name="IGC_LUT_EN" pos="0" type="boolean"/>
+			<bitfield name="IGC_TBL_IDX" low="1" high="3" type="uint"/>
+			<bitfield name="PCC_EN" pos="4" type="boolean"/>
+			<bitfield name="DITHER_EN" pos="8" type="boolean"/>
+			<bitfield name="HIST_EN" pos="16" type="boolean"/>
+			<bitfield name="AUTO_CLEAR" pos="17" type="boolean"/>
+			<bitfield name="HIST_LUT_EN" pos="19" type="boolean"/>
+			<bitfield name="PA_EN" pos="20" type="boolean"/>
+			<bitfield name="GAMUT_EN" pos="23" type="boolean"/>
+			<bitfield name="GAMUT_ORDER" pos="24" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x030" name="PCC_BASE"/>
+		<reg32 offset="0x150" name="DITHER_DEPTH"/>
+		<reg32 offset="0x210" name="HIST_CTL_BASE"/>
+		<reg32 offset="0x230" name="HIST_LUT_BASE"/>
+		<reg32 offset="0x234" name="HIST_LUT_SWAP"/>
+		<reg32 offset="0x238" name="PA_BASE"/>
+		<reg32 offset="0x2dc" name="GAMUT_BASE"/>
+		<reg32 offset="0x2b0" name="GC_BASE"/>
+	</array>
+
+	<array doffsets="mdp5_cfg->pp.base[0],mdp5_cfg->pp.base[1],mdp5_cfg->pp.base[2],mdp5_cfg->pp.base[3]" name="PP" length="4" stride="0x100">
+		<reg32 offset="0x000" name="TEAR_CHECK_EN"/>
+		<reg32 offset="0x004" name="SYNC_CONFIG_VSYNC">
+			<bitfield name="COUNT" low="0" high="18" type="uint"/>
+			<bitfield name="COUNTER_EN" pos="19" type="boolean"/>
+			<bitfield name="IN_EN" pos="20" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x008" name="SYNC_CONFIG_HEIGHT"/>
+		<reg32 offset="0x00c" name="SYNC_WRCOUNT">
+			<bitfield name="LINE_COUNT" low="0" high="15" type="uint"/>
+			<bitfield name="FRAME_COUNT" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x010" name="VSYNC_INIT_VAL"/>
+		<reg32 offset="0x014" name="INT_COUNT_VAL">
+			<bitfield name="LINE_COUNT" low="0" high="15" type="uint"/>
+			<bitfield name="FRAME_COUNT" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x018" name="SYNC_THRESH">
+			<bitfield name="START" low="0" high="15" type="uint"/>
+			<bitfield name="CONTINUE" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x01c" name="START_POS"/>
+		<reg32 offset="0x020" name="RD_PTR_IRQ"/>
+		<reg32 offset="0x024" name="WR_PTR_IRQ"/>
+		<reg32 offset="0x028" name="OUT_LINE_COUNT"/>
+		<reg32 offset="0x02c" name="PP_LINE_COUNT"/>
+		<reg32 offset="0x030" name="AUTOREFRESH_CONFIG"/>
+		<reg32 offset="0x034" name="FBC_MODE"/>
+		<reg32 offset="0x038" name="FBC_BUDGET_CTL"/>
+		<reg32 offset="0x03c" name="FBC_LOSSY_MODE"/>
+	</array>
+
+	<enum name="mdp5_block_size">
+		<value name="BLOCK_SIZE_64" value="0"/>
+		<value name="BLOCK_SIZE_128" value="1"/>
+	</enum>
+
+	<enum name="mdp5_rotate_mode">
+		<value name="ROTATE_0" value="0"/>
+		<value name="ROTATE_90" value="1"/>
+	</enum>
+
+	<enum name="mdp5_chroma_downsample_method">
+		<value name="DS_MTHD_NO_PIXEL_DROP" value="0"/>
+		<value name="DS_MTHD_PIXEL_DROP" value="1"/>
+	</enum>
+
+	<array doffsets="mdp5_cfg->wb.base[0],mdp5_cfg->wb.base[1],mdp5_cfg->wb.base[2],mdp5_cfg->wb.base[3],mdp5_cfg->wb.base[4]" name="WB" length="5" stride="0x400">
+		<reg32 offset="0x000" name="DST_FORMAT">
+			<bitfield name="DSTC0_OUT" low="0" high="1" type="uint"/>
+			<bitfield name="DSTC1_OUT" low="2" high="3" type="uint"/>
+			<bitfield name="DSTC2_OUT" low="4" high="5" type="uint"/>
+			<bitfield name="DSTC3_OUT" low="6" high="7" type="uint"/>
+			<bitfield name="DSTC3_EN" pos="8" type="boolean"/>
+			<bitfield name="DST_BPP" low="9" high="10" type="uint"/>
+			<bitfield name="PACK_COUNT" low="12" high="13" type="uint"/>
+			<bitfield name="DST_ALPHA_X" pos="14" type="boolean"/>
+			<bitfield name="PACK_TIGHT" pos="17" type="boolean"/>
+			<bitfield name="PACK_ALIGN_MSB" pos="18" type="boolean"/>
+			<bitfield name="WRITE_PLANES" low="19" high="20" type="uint"/>
+			<bitfield name="DST_DITHER_EN" pos="22" type="boolean"/>
+			<bitfield name="DST_CHROMA_SAMP" low="23" high="25" type="uint"/>
+			<bitfield name="DST_CHROMA_SITE" low="26" high="29" type="uint"/>
+			<bitfield name="FRAME_FORMAT" low="30" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x004" name="DST_OP_MODE">
+			<bitfield name="BWC_ENC_EN" pos="0" type="boolean"/>
+			<bitfield name="BWC_ENC_OP" low="1" high="2" type="uint"/>
+			<bitfield name="BLOCK_SIZE" low="4" high="4" type="uint"/>
+			<bitfield name="ROT_MODE" low="5" high="5" type="uint"/>
+			<bitfield name="ROT_EN" pos="6" type="boolean"/>
+			<bitfield name="CSC_EN" pos="8" type="boolean"/>
+			<bitfield name="CSC_SRC_DATA_FORMAT" low="9" high="9" type="uint"/>
+			<bitfield name="CSC_DST_DATA_FORMAT" low="10" high="10" type="uint"/>
+			<bitfield name="CHROMA_DWN_SAMPLE_EN" pos="11" type="boolean"/>
+			<bitfield name="CHROMA_DWN_SAMPLE_FORMAT" low="12" high="12" type="uint"/>
+			<bitfield name="CHROMA_DWN_SAMPLE_H_MTHD" low="13" high="13" type="uint"/>
+			<bitfield name="CHROMA_DWN_SAMPLE_V_MTHD" low="14" high="14" type="uint"/>
+		</reg32>
+		<reg32 offset="0x008" name="DST_PACK_PATTERN">
+			<bitfield name="ELEMENT0" low="0" high="1" type="uint"/>
+			<bitfield name="ELEMENT1" low="8" high="9" type="uint"/>
+			<bitfield name="ELEMENT2" low="16" high="17" type="uint"/>
+			<bitfield name="ELEMENT3" low="24" high="25" type="uint"/>
+		</reg32>
+		<reg32 offset="0x00c" name="DST0_ADDR"/>
+		<reg32 offset="0x010" name="DST1_ADDR"/>
+		<reg32 offset="0x014" name="DST2_ADDR"/>
+		<reg32 offset="0x018" name="DST3_ADDR"/>
+		<reg32 offset="0x01c" name="DST_YSTRIDE0">
+			<bitfield name="DST0_YSTRIDE" low="0" high="15" type="uint"/>
+			<bitfield name="DST1_YSTRIDE" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x020" name="DST_YSTRIDE1">
+			<bitfield name="DST2_YSTRIDE" low="0" high="15" type="uint"/>
+			<bitfield name="DST3_YSTRIDE" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x024" name="DST_DITHER_BITDEPTH"/>
+		<reg32 offset="0x030" name="DITHER_MATRIX_ROW0"/>
+		<reg32 offset="0x034" name="DITHER_MATRIX_ROW1"/>
+		<reg32 offset="0x038" name="DITHER_MATRIX_ROW2"/>
+		<reg32 offset="0x03c" name="DITHER_MATRIX_ROW3"/>
+		<reg32 offset="0x048" name="DST_WRITE_CONFIG"/>
+		<reg32 offset="0x050" name="ROTATION_DNSCALER"/>
+		<reg32 offset="0x060" name="N16_INIT_PHASE_X_0_3"/>
+		<reg32 offset="0x064" name="N16_INIT_PHASE_X_1_2"/>
+		<reg32 offset="0x068" name="N16_INIT_PHASE_Y_0_3"/>
+		<reg32 offset="0x06c" name="N16_INIT_PHASE_Y_1_2"/>
+		<reg32 offset="0x074" name="OUT_SIZE">
+			<bitfield name="DST_W" low="0" high="15" type="uint"/>
+			<bitfield name="DST_H" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x078" name="ALPHA_X_VALUE"/>
+		<reg32 offset="0x260" name="CSC_MATRIX_COEFF_0">
+			<bitfield name="COEFF_11" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_12" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x264" name="CSC_MATRIX_COEFF_1">
+			<bitfield name="COEFF_13" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_21" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x268" name="CSC_MATRIX_COEFF_2">
+			<bitfield name="COEFF_22" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_23" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x26c" name="CSC_MATRIX_COEFF_3">
+			<bitfield name="COEFF_31" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_32" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x270" name="CSC_MATRIX_COEFF_4">
+			<bitfield name="COEFF_33" low="0" high="12" type="uint"/>
+		</reg32>
+		<array offset="0x274" name="CSC_COMP_PRECLAMP" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="HIGH"  low="0"  high="7"  type="uint"/>
+				<bitfield name="LOW"  low="8"  high="15"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x280" name="CSC_COMP_POSTCLAMP" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="HIGH"  low="0"  high="7"  type="uint"/>
+				<bitfield name="LOW"  low="8"  high="15"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x28c" name="CSC_COMP_PREBIAS" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VALUE"  low="0"  high="8"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x298" name="CSC_COMP_POSTBIAS" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VALUE"  low="0"  high="8"  type="uint"/>
+			</reg32>
+		</array>
+	</array>
+
+	<array doffsets="mdp5_cfg->intf.base[0],mdp5_cfg->intf.base[1],mdp5_cfg->intf.base[2],mdp5_cfg->intf.base[3],mdp5_cfg->intf.base[4]" name="INTF" length="5" stride="0x200">
+		<reg32 offset="0x000" name="TIMING_ENGINE_EN"/>
+		<reg32 offset="0x004" name="CONFIG"/>
+		<reg32 offset="0x008" name="HSYNC_CTL">
+			<bitfield name="PULSEW" low="0" high="15" type="uint"/>
+			<bitfield name="PERIOD" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x00c" name="VSYNC_PERIOD_F0" type="uint"/>
+		<reg32 offset="0x010" name="VSYNC_PERIOD_F1" type="uint"/>
+		<reg32 offset="0x014" name="VSYNC_LEN_F0" type="uint"/>
+		<reg32 offset="0x018" name="VSYNC_LEN_F1" type="uint"/>
+		<reg32 offset="0x01c" name="DISPLAY_VSTART_F0" type="uint"/>
+		<reg32 offset="0x020" name="DISPLAY_VSTART_F1" type="uint"/>
+		<reg32 offset="0x024" name="DISPLAY_VEND_F0" type="uint"/>
+		<reg32 offset="0x028" name="DISPLAY_VEND_F1" type="uint"/>
+		<reg32 offset="0x02c" name="ACTIVE_VSTART_F0">
+			<bitfield name="VAL" low="0" high="30" type="uint"/>
+			<bitfield name="ACTIVE_V_ENABLE" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x030" name="ACTIVE_VSTART_F1">
+			<bitfield name="VAL" low="0" high="30" type="uint"/>
+		</reg32>
+		<reg32 offset="0x034" name="ACTIVE_VEND_F0" type="uint"/>
+		<reg32 offset="0x038" name="ACTIVE_VEND_F1" type="uint"/>
+		<reg32 offset="0x03c" name="DISPLAY_HCTL">
+			<bitfield name="START" low="0"  high="15" type="uint"/>
+			<bitfield name="END"   low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x040" name="ACTIVE_HCTL">
+			<bitfield name="START" low="0"  high="14" type="uint"/>
+			<bitfield name="END"   low="16" high="30" type="uint"/>
+			<bitfield name="ACTIVE_H_ENABLE" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x044" name="BORDER_COLOR"/>
+		<reg32 offset="0x048" name="UNDERFLOW_COLOR"/>
+		<reg32 offset="0x04c" name="HSYNC_SKEW"/>
+		<reg32 offset="0x050" name="POLARITY_CTL">
+			<bitfield name="HSYNC_LOW" pos="0" type="boolean"/>
+			<bitfield name="VSYNC_LOW" pos="1" type="boolean"/>
+			<bitfield name="DATA_EN_LOW" pos="2" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x054" name="TEST_CTL"/>
+		<reg32 offset="0x058" name="TP_COLOR0"/>
+		<reg32 offset="0x05c" name="TP_COLOR1"/>
+		<reg32 offset="0x084" name="DSI_CMD_MODE_TRIGGER_EN"/>
+		<reg32 offset="0x090" name="PANEL_FORMAT" type="mdp5_format"/>
+		<reg32 offset="0x0a8" name="FRAME_LINE_COUNT_EN"/>
+		<reg32 offset="0x0ac" name="FRAME_COUNT"/>
+		<reg32 offset="0x0b0" name="LINE_COUNT"/>
+		<reg32 offset="0x0f0" name="DEFLICKER_CONFIG"/>
+		<reg32 offset="0x0f4" name="DEFLICKER_STRNG_COEFF"/>
+		<reg32 offset="0x0f8" name="DEFLICKER_WEAK_COEFF"/>
+		<reg32 offset="0x100" name="TPG_ENABLE"/>
+		<reg32 offset="0x104" name="TPG_MAIN_CONTROL"/>
+		<reg32 offset="0x108" name="TPG_VIDEO_CONFIG"/>
+		<reg32 offset="0x10c" name="TPG_COMPONENT_LIMITS"/>
+		<reg32 offset="0x110" name="TPG_RECTANGLE"/>
+		<reg32 offset="0x114" name="TPG_INITIAL_VALUE"/>
+		<reg32 offset="0x118" name="TPG_BLK_WHITE_PATTERN_FRAME"/>
+		<reg32 offset="0x11c" name="TPG_RGB_MAPPING"/>
+	</array>
+
+	<array doffsets="mdp5_cfg->ad.base[0],mdp5_cfg->ad.base[1]" name="AD" length="2" stride="0x200">
+		<reg32 offset="0x000" name="BYPASS"/>
+		<reg32 offset="0x004" name="CTRL_0"/>
+		<reg32 offset="0x008" name="CTRL_1"/>
+		<reg32 offset="0x00c" name="FRAME_SIZE"/>
+		<reg32 offset="0x010" name="CON_CTRL_0"/>
+		<reg32 offset="0x014" name="CON_CTRL_1"/>
+		<reg32 offset="0x018" name="STR_MAN"/>
+		<reg32 offset="0x01c" name="VAR"/>
+		<reg32 offset="0x020" name="DITH"/>
+		<reg32 offset="0x024" name="DITH_CTRL"/>
+		<reg32 offset="0x028" name="AMP_LIM"/>
+		<reg32 offset="0x02c" name="SLOPE"/>
+		<reg32 offset="0x030" name="BW_LVL"/>
+		<reg32 offset="0x034" name="LOGO_POS"/>
+		<reg32 offset="0x038" name="LUT_FI"/>
+		<reg32 offset="0x07c" name="LUT_CC"/>
+		<reg32 offset="0x0c8" name="STR_LIM"/>
+		<reg32 offset="0x0cc" name="CALIB_AB"/>
+		<reg32 offset="0x0d0" name="CALIB_CD"/>
+		<reg32 offset="0x0d4" name="MODE_SEL"/>
+		<reg32 offset="0x0d8" name="TFILT_CTRL"/>
+		<reg32 offset="0x0dc" name="BL_MINMAX"/>
+		<reg32 offset="0x0e0" name="BL"/>
+		<reg32 offset="0x0e8" name="BL_MAX"/>
+		<reg32 offset="0x0ec" name="AL"/>
+		<reg32 offset="0x0f0" name="AL_MIN"/>
+		<reg32 offset="0x0f4" name="AL_FILT"/>
+		<reg32 offset="0x0f8" name="CFG_BUF"/>
+		<reg32 offset="0x100" name="LUT_AL"/>
+		<reg32 offset="0x144" name="TARG_STR"/>
+		<reg32 offset="0x148" name="START_CALC"/>
+		<reg32 offset="0x14c" name="STR_OUT"/>
+		<reg32 offset="0x154" name="BL_OUT"/>
+		<reg32 offset="0x158" name="CALC_DONE"/>
+	</array>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/mdp_common.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/mdp_common.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+
+<!-- random bits that seem same between mdp4 and mdp5 (ie. not much) -->
+
+<enum name="mdp_chroma_samp_type">
+    <value name="CHROMA_FULL"  value="0"/>
+    <value name="CHROMA_H2V1" value="1"/>
+    <value name="CHROMA_H1V2" value="2"/>
+    <value name="CHROMA_420"  value="3"/>
+</enum>
+
+<enum name="mdp_fetch_type">
+    <value name="MDP_PLANE_INTERLEAVED"   value="0"/>
+    <value name="MDP_PLANE_PLANAR"        value="1"/>
+    <value name="MDP_PLANE_PSEUDO_PLANAR" value="2"/>
+</enum>
+
+<enum name="mdp_mixer_stage_id">
+	<value name="STAGE_UNUSED" value="0"/>
+	<value name="STAGE_BASE" value="1"/>
+	<value name="STAGE0" value="2"/>   <!-- zorder 0 -->
+	<value name="STAGE1" value="3"/>   <!-- zorder 1 -->
+	<value name="STAGE2" value="4"/>   <!-- zorder 2 -->
+	<value name="STAGE3" value="5"/>   <!-- zorder 3 -->
+	<value name="STAGE4" value="6"/>   <!-- zorder 4 -->
+	<value name="STAGE5" value="7"/>   <!-- zorder 5 -->
+	<value name="STAGE6" value="8"/>   <!-- zorder 6 -->
+	<value name="STAGE_MAX" value="8"/> <!-- maximum zorder -->
+</enum>
+
+<enum name="mdp_alpha_type">
+	<value name="FG_CONST" value="0"/>
+	<value name="BG_CONST" value="1"/>
+	<value name="FG_PIXEL" value="2"/>
+	<value name="BG_PIXEL" value="3"/>
+</enum>
+
+<enum name="mdp_component_type">
+        <value name="COMP_0" value="0"/>	<!-- Y component -->
+        <value name="COMP_1_2" value="1"/>	<!-- Cb/Cr comp. -->
+        <value name="COMP_3" value="2"/>	<!-- Trans comp. -->
+        <value name="COMP_MAX" value="3"/>
+</enum>
+
+<enum name="mdp_bpc">
+	<brief>bits per component (non-alpha channel)</brief>
+	<value name="BPC4" value="0"/> <!-- 4 bits -->
+	<value name="BPC5" value="1"/> <!-- 5 bits -->
+	<value name="BPC6" value="2"/> <!-- 6 bits -->
+	<value name="BPC8" value="3"/> <!-- 8 bits -->
+</enum>
+
+<enum name="mdp_bpc_alpha">
+	<brief>bits per component (alpha channel)</brief>
+	<value name="BPC1A" value="0"/> <!-- 1 bit -->
+	<value name="BPC4A" value="1"/> <!-- 4 bits -->
+	<value name="BPC6A" value="2"/> <!-- 6 bits -->
+	<value name="BPC8A" value="3"/> <!-- 8 bits -->
+</enum>
+
+<enum name="mdp_fetch_mode">
+	<value name="MDP_FETCH_LINEAR" value="0"/>
+	<value name="MDP_FETCH_TILE" value="1"/>
+	<value name="MDP_FETCH_UBWC" value="2"/>
+</enum>
+
+<bitset name="reg_wh" inline="yes">
+    <bitfield name="HEIGHT" low="16" high="31" type="uint"/>
+    <bitfield name="WIDTH" low="0" high="15" type="uint"/>
+</bitset>
+
+<bitset name="reg_xy" inline="yes">
+    <bitfield name="Y" low="16" high="31" type="uint"/>
+    <bitfield name="X" low="0" high="15" type="uint"/>
+</bitset>
+
+<bitset name="mdp_unpack_pattern" inline="yes">
+	<bitfield name="ELEM0" low="0"  high="7"/>
+	<bitfield name="ELEM1" low="8"  high="15"/>
+	<bitfield name="ELEM2" low="16" high="23"/>
+	<bitfield name="ELEM3" low="24" high="31"/>
+</bitset>
+
+</database>
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/mdss.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/mdss.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="MDSS" width="32">
+	<reg32 offset="0x00000" name="HW_VERSION">
+		<bitfield name="STEP" low="0" high="15" type="uint"/>
+		<bitfield name="MINOR" low="16" high="27" type="uint"/>
+		<bitfield name="MAJOR" low="28" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00010" name="HW_INTR_STATUS">
+		<bitfield name="INTR_MDP"  pos="0"  type="boolean"/>
+		<bitfield name="INTR_DSI0" pos="4"  type="boolean"/>
+		<bitfield name="INTR_DSI1" pos="5"  type="boolean"/>
+		<bitfield name="INTR_HDMI" pos="8"  type="boolean"/>
+		<bitfield name="INTR_EDP"  pos="12" type="boolean"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/msm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/msm.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="http://nouveau.freedesktop.org/ rules-ng.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<doc>
+	Register definitions for the display related hw blocks on
+	msm/snapdragon
+</doc>
+
+<!--
+<enum name="chipset">
+	<value name="MDP40"/>
+	<value name="MDP50"/>
+</enum>
+-->
+
+<import file="mdp4.xml"/>
+<import file="mdp5.xml"/>
+<import file="dsi.xml"/>
+<import file="dsi_phy_28nm_8960.xml"/>
+<import file="dsi_phy_28nm.xml"/>
+<import file="dsi_phy_20nm.xml"/>
+<import file="dsi_phy_14nm.xml"/>
+<import file="dsi_phy_10nm.xml"/>
+<import file="dsi_phy_7nm.xml"/>
+<import file="sfpb.xml"/>
+<import file="hdmi.xml"/>
+<import file="edp.xml"/>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/display/sfpb.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/display/sfpb.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="SFPB" width="32">
+	<enum name="sfpb_ahb_arb_master_port_en">
+		<value name="SFPB_MASTER_PORT_ENABLE" value="3"/>
+		<value name="SFPB_MASTER_PORT_DISABLE" value="0"/>
+	</enum>
+	<reg32 offset="0x0058" name="GPREG">
+		<bitfield name="MASTER_PORT_EN" low="11" high="12" type="sfpb_ahb_arb_master_port_en"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/freedreno_copyright.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/freedreno_copyright.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+
+<copyright year="2013">
+
+<author name="Rob Clark" email="robdclark@gmail.com"><nick name="robclark"/>
+Initial Author.
+</author>
+
+<author name="Ilia Mirkin" email="imirkin@alum.mit.edu"><nick name="imirkin"/>
+many a3xx/a4xx contributions
+</author>
+
+<license>
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice (including the
+next paragraph) shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+</license>
+
+</copyright>
+</database>
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/gen_header.py
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/gen_header.py
@@ -0,0 +1,971 @@
+#!/usr/bin/python3
+#
+# Copyright © 2019-2024 Google, Inc.
+#
+# SPDX-License-Identifier: MIT
+
+import xml.parsers.expat
+import sys
+import os
+import collections
+import argparse
+import time
+import datetime
+
+class Error(Exception):
+	def __init__(self, message):
+		self.message = message
+
+class Enum(object):
+	def __init__(self, name):
+		self.name = name
+		self.values = []
+
+	def has_name(self, name):
+		for (n, value) in self.values:
+			if n == name:
+				return True
+		return False
+
+	def names(self):
+		return [n for (n, value) in self.values]
+
+	def dump(self):
+		use_hex = False
+		for (name, value) in self.values:
+			if value > 0x1000:
+				use_hex = True
+
+		print("enum %s {" % self.name)
+		for (name, value) in self.values:
+			if use_hex:
+				print("\t%s = 0x%08x," % (name, value))
+			else:
+				print("\t%s = %d," % (name, value))
+		print("};\n")
+
+	def dump_pack_struct(self):
+		pass
+
+class Field(object):
+	def __init__(self, name, low, high, shr, type, parser):
+		self.name = name
+		self.low = low
+		self.high = high
+		self.shr = shr
+		self.type = type
+
+		builtin_types = [ None, "a3xx_regid", "boolean", "uint", "hex", "int", "fixed", "ufixed", "float", "address", "waddress" ]
+
+		maxpos = parser.current_bitsize - 1
+
+		if low < 0 or low > maxpos:
+			raise parser.error("low attribute out of range: %d" % low)
+		if high < 0 or high > maxpos:
+			raise parser.error("high attribute out of range: %d" % high)
+		if high < low:
+			raise parser.error("low is greater than high: low=%d, high=%d" % (low, high))
+		if self.type == "boolean" and not low == high:
+			raise parser.error("booleans should be 1 bit fields")
+		elif self.type == "float" and not (high - low == 31 or high - low == 15):
+			raise parser.error("floats should be 16 or 32 bit fields")
+		elif not self.type in builtin_types and not self.type in parser.enums:
+			raise parser.error("unknown type '%s'" % self.type)
+
+	def ctype(self, var_name):
+		if self.type == None:
+			type = "uint32_t"
+			val = var_name
+		elif self.type == "boolean":
+			type = "bool"
+			val = var_name
+		elif self.type == "uint" or self.type == "hex" or self.type == "a3xx_regid":
+			type = "uint32_t"
+			val = var_name
+		elif self.type == "int":
+			type = "int32_t"
+			val = var_name
+		elif self.type == "fixed":
+			type = "float"
+			val = "((int32_t)(%s * %d.0))" % (var_name, 1 << self.radix)
+		elif self.type == "ufixed":
+			type = "float"
+			val = "((uint32_t)(%s * %d.0))" % (var_name, 1 << self.radix)
+		elif self.type == "float" and self.high - self.low == 31:
+			type = "float"
+			val = "fui(%s)" % var_name
+		elif self.type == "float" and self.high - self.low == 15:
+			type = "float"
+			val = "_mesa_float_to_half(%s)" % var_name
+		elif self.type in [ "address", "waddress" ]:
+			type = "uint64_t"
+			val = var_name
+		else:
+			type = "enum %s" % self.type
+			val = var_name
+
+		if self.shr > 0:
+			val = "(%s >> %d)" % (val, self.shr)
+
+		return (type, val)
+
+def tab_to(name, value):
+	tab_count = (68 - (len(name) & ~7)) // 8
+	if tab_count <= 0:
+		tab_count = 1
+	print(name + ('\t' * tab_count) + value)
+
+def mask(low, high):
+	return ((0xffffffffffffffff >> (64 - (high + 1 - low))) << low)
+
+def field_name(reg, f):
+	if f.name:
+		name = f.name.lower()
+	else:
+		# We hit this path when a reg is defined with no bitset fields, ie.
+		# 	<reg32 offset="0x88db" name="RB_BLIT_DST_ARRAY_PITCH" low="0" high="28" shr="6" type="uint"/>
+		name = reg.name.lower()
+
+	if (name in [ "double", "float", "int" ]) or not (name[0].isalpha()):
+			name = "_" + name
+
+	return name
+
+# indices - array of (ctype, stride, __offsets_NAME)
+def indices_varlist(indices):
+	return ", ".join(["i%d" % i for i in range(len(indices))])
+
+def indices_prototype(indices):
+	return ", ".join(["%s i%d" % (ctype, idx)
+			for (idx, (ctype, stride, offset)) in  enumerate(indices)])
+
+def indices_strides(indices):
+	return " + ".join(["0x%x*i%d" % (stride, idx)
+					if stride else
+					"%s(i%d)" % (offset, idx)
+			for (idx, (ctype, stride, offset)) in  enumerate(indices)])
+
+class Bitset(object):
+	def __init__(self, name, template):
+		self.name = name
+		self.inline = False
+		if template:
+			self.fields = template.fields[:]
+		else:
+			self.fields = []
+
+	# Get address field if there is one in the bitset, else return None:
+	def get_address_field(self):
+		for f in self.fields:
+			if f.type in [ "address", "waddress" ]:
+				return f
+		return None
+
+	def dump_regpair_builder(self, reg):
+		print("#ifndef NDEBUG")
+		known_mask = 0
+		for f in self.fields:
+			known_mask |= mask(f.low, f.high)
+			if f.type in [ "boolean", "address", "waddress" ]:
+				continue
+			type, val = f.ctype("fields.%s" % field_name(reg, f))
+			print("    assert((%-40s & 0x%08x) == 0);" % (val, 0xffffffff ^ mask(0 , f.high - f.low)))
+		print("    assert((%-40s & 0x%08x) == 0);" % ("fields.unknown", known_mask))
+		print("#endif\n")
+
+		print("    return (struct fd_reg_pair) {")
+		if reg.array:
+			print("        .reg = REG_%s(__i)," % reg.full_name)
+		else:
+			print("        .reg = REG_%s," % reg.full_name)
+
+		print("        .value =")
+		for f in self.fields:
+			if f.type in [ "address", "waddress" ]:
+				continue
+			else:
+				type, val = f.ctype("fields.%s" % field_name(reg, f))
+				print("            (%-40s << %2d) |" % (val, f.low))
+		value_name = "dword"
+		if reg.bit_size == 64:
+			value_name = "qword"
+		print("            fields.unknown | fields.%s," % (value_name,))
+
+		address = self.get_address_field()
+		if address:
+			print("        .bo = fields.bo,")
+			print("        .is_address = true,")
+			if f.type == "waddress":
+				print("        .bo_write = true,")
+			print("        .bo_offset = fields.bo_offset,")
+			print("        .bo_shift = %d," % address.shr)
+			print("        .bo_low = %d," % address.low)
+
+		print("    };")
+
+	def dump_pack_struct(self, reg=None):
+		if not reg:
+			return
+
+		prefix = reg.full_name
+
+		print("struct %s {" % prefix)
+		for f in self.fields:
+			if f.type in [ "address", "waddress" ]:
+				tab_to("    __bo_type", "bo;")
+				tab_to("    uint32_t", "bo_offset;")
+				continue
+			name = field_name(reg, f)
+
+			type, val = f.ctype("var")
+
+			tab_to("    %s" % type, "%s;" % name)
+		if reg.bit_size == 64:
+			tab_to("    uint64_t", "unknown;")
+			tab_to("    uint64_t", "qword;")
+		else:
+			tab_to("    uint32_t", "unknown;")
+			tab_to("    uint32_t", "dword;")
+		print("};\n")
+
+		if reg.array:
+			print("static inline struct fd_reg_pair\npack_%s(uint32_t __i, struct %s fields)\n{" %
+				  (prefix, prefix))
+		else:
+			print("static inline struct fd_reg_pair\npack_%s(struct %s fields)\n{" %
+				  (prefix, prefix))
+
+		self.dump_regpair_builder(reg)
+
+		print("\n}\n")
+
+		if self.get_address_field():
+			skip = ", { .reg = 0 }"
+		else:
+			skip = ""
+
+		if reg.array:
+			print("#define %s(__i, ...) pack_%s(__i, __struct_cast(%s) { __VA_ARGS__ })%s\n" %
+				  (prefix, prefix, prefix, skip))
+		else:
+			print("#define %s(...) pack_%s(__struct_cast(%s) { __VA_ARGS__ })%s\n" %
+				  (prefix, prefix, prefix, skip))
+
+
+	def dump(self, prefix=None):
+		if prefix == None:
+			prefix = self.name
+		for f in self.fields:
+			if f.name:
+				name = prefix + "_" + f.name
+			else:
+				name = prefix
+
+			if not f.name and f.low == 0 and f.shr == 0 and not f.type in ["float", "fixed", "ufixed"]:
+				pass
+			elif f.type == "boolean" or (f.type == None and f.low == f.high):
+				tab_to("#define %s" % name, "0x%08x" % (1 << f.low))
+			else:
+				tab_to("#define %s__MASK" % name, "0x%08x" % mask(f.low, f.high))
+				tab_to("#define %s__SHIFT" % name, "%d" % f.low)
+				type, val = f.ctype("val")
+
+				print("static inline uint32_t %s(%s val)\n{" % (name, type))
+				if f.shr > 0:
+					print("\tassert(!(val & 0x%x));" % mask(0, f.shr - 1))
+				print("\treturn ((%s) << %s__SHIFT) & %s__MASK;\n}" % (val, name, name))
+		print()
+
+class Array(object):
+	def __init__(self, attrs, domain, variant, parent, index_type):
+		if "name" in attrs:
+			self.local_name = attrs["name"]
+		else:
+			self.local_name = ""
+		self.domain = domain
+		self.variant = variant
+		self.parent = parent
+		if self.parent:
+			self.name = self.parent.name + "_" + self.local_name
+		else:
+			self.name = self.local_name
+		if "offsets" in attrs:
+			self.offsets = map(lambda i: "0x%08x" % int(i, 0), attrs["offsets"].split(","))
+			self.fixed_offsets = True
+		elif "doffsets" in attrs:
+			self.offsets = map(lambda s: "(%s)" % s , attrs["doffsets"].split(","))
+			self.fixed_offsets = True
+		else:
+			self.offset = int(attrs["offset"], 0)
+			self.stride = int(attrs["stride"], 0)
+			self.fixed_offsets = False
+		if "index" in attrs:
+			self.index_type = index_type
+		else:
+			self.index_type = None
+		self.length = int(attrs["length"], 0)
+		if "usage" in attrs:
+			self.usages = attrs["usage"].split(',')
+		else:
+			self.usages = None
+
+	def index_ctype(self):
+		if not self.index_type:
+			return "uint32_t"
+		else:
+			return "enum %s" % self.index_type.name
+
+	# Generate array of (ctype, stride, __offsets_NAME)
+	def indices(self):
+		if self.parent:
+			indices = self.parent.indices()
+		else:
+			indices = []
+		if self.length != 1:
+			if self.fixed_offsets:
+				indices.append((self.index_ctype(), None, "__offset_%s" % self.local_name))
+			else:
+				indices.append((self.index_ctype(), self.stride, None))
+		return indices
+
+	def total_offset(self):
+		offset = 0
+		if not self.fixed_offsets:
+			offset += self.offset
+		if self.parent:
+			offset += self.parent.total_offset()
+		return offset
+
+	def dump(self):
+		proto = indices_varlist(self.indices())
+		strides = indices_strides(self.indices())
+		array_offset = self.total_offset()
+		if self.fixed_offsets:
+			print("static inline uint32_t __offset_%s(%s idx)" % (self.local_name, self.index_ctype()))
+			print("{\n\tswitch (idx) {")
+			if self.index_type:
+				for val, offset in zip(self.index_type.names(), self.offsets):
+					print("\t\tcase %s: return %s;" % (val, offset))
+			else:
+				for idx, offset in enumerate(self.offsets):
+					print("\t\tcase %d: return %s;" % (idx, offset))
+			print("\t\tdefault: return INVALID_IDX(idx);")
+			print("\t}\n}")
+		if proto == '':
+			tab_to("#define REG_%s_%s" % (self.domain, self.name), "0x%08x\n" % array_offset)
+		else:
+			tab_to("#define REG_%s_%s(%s)" % (self.domain, self.name, proto), "(0x%08x + %s )\n" % (array_offset, strides))
+
+	def dump_pack_struct(self):
+		pass
+
+	def dump_regpair_builder(self):
+		pass
+
+class Reg(object):
+	def __init__(self, attrs, domain, array, bit_size):
+		self.name = attrs["name"]
+		self.domain = domain
+		self.array = array
+		self.offset = int(attrs["offset"], 0)
+		self.type = None
+		self.bit_size = bit_size
+		if array:
+			self.name = array.name + "_" + self.name
+		self.full_name = self.domain + "_" + self.name
+		if "stride" in attrs:
+			self.stride = int(attrs["stride"], 0)
+			self.length = int(attrs["length"], 0)
+		else:
+			self.stride = None
+			self.length = None
+
+	# Generate array of (ctype, stride, __offsets_NAME)
+	def indices(self):
+		if self.array:
+			indices = self.array.indices()
+		else:
+			indices = []
+		if self.stride:
+			indices.append(("uint32_t", self.stride, None))
+		return indices
+
+	def total_offset(self):
+		if self.array:
+			return self.array.total_offset() + self.offset
+		else:
+			return self.offset
+
+	def dump(self):
+		proto = indices_prototype(self.indices())
+		strides = indices_strides(self.indices())
+		offset = self.total_offset()
+		if proto == '':
+			tab_to("#define REG_%s" % self.full_name, "0x%08x" % offset)
+		else:
+			print("static inline uint32_t REG_%s(%s) { return 0x%08x + %s; }" % (self.full_name, proto, offset, strides))
+
+		if self.bitset.inline:
+			self.bitset.dump(self.full_name)
+
+	def dump_pack_struct(self):
+		if self.bitset.inline:
+			self.bitset.dump_pack_struct(self)
+
+	def dump_regpair_builder(self):
+		if self.bitset.inline:
+			self.bitset.dump_regpair_builder(self)
+
+	def dump_py(self):
+		print("\tREG_%s = 0x%08x" % (self.full_name, self.offset))
+
+
+class Parser(object):
+	def __init__(self):
+		self.current_array = None
+		self.current_domain = None
+		self.current_prefix = None
+		self.current_prefix_type = None
+		self.current_stripe = None
+		self.current_bitset = None
+		self.current_bitsize = 32
+		# The varset attribute on the domain specifies the enum which
+		# specifies all possible hw variants:
+		self.current_varset = None
+		# Regs that have multiple variants.. we only generated the C++
+		# template based struct-packers for these
+		self.variant_regs = {}
+		# Information in which contexts regs are used, to be used in
+		# debug options
+		self.usage_regs = collections.defaultdict(list)
+		self.bitsets = {}
+		self.enums = {}
+		self.variants = set()
+		self.file = []
+		self.xml_files = []
+		self.copyright_year = None
+		self.authors = []
+		self.license = None
+
+	def error(self, message):
+		parser, filename = self.stack[-1]
+		return Error("%s:%d:%d: %s" % (filename, parser.CurrentLineNumber, parser.CurrentColumnNumber, message))
+
+	def prefix(self, variant=None):
+		if self.current_prefix_type == "variant" and variant:
+			return variant
+		elif self.current_stripe:
+			return self.current_stripe + "_" + self.current_domain
+		elif self.current_prefix:
+			return self.current_prefix + "_" + self.current_domain
+		else:
+			return self.current_domain
+
+	def parse_field(self, name, attrs):
+		try:
+			if "pos" in attrs:
+				high = low = int(attrs["pos"], 0)
+			elif "high" in attrs and "low" in attrs:
+				high = int(attrs["high"], 0)
+				low = int(attrs["low"], 0)
+			else:
+				low = 0
+				high = self.current_bitsize - 1
+
+			if "type" in attrs:
+				type = attrs["type"]
+			else:
+				type = None
+
+			if "shr" in attrs:
+				shr = int(attrs["shr"], 0)
+			else:
+				shr = 0
+
+			b = Field(name, low, high, shr, type, self)
+
+			if type == "fixed" or type == "ufixed":
+				b.radix = int(attrs["radix"], 0)
+
+			self.current_bitset.fields.append(b)
+		except ValueError as e:
+			raise self.error(e)
+
+	def parse_varset(self, attrs):
+		# Inherit the varset from the enclosing domain if not overriden:
+		varset = self.current_varset
+		if "varset" in attrs:
+			varset = self.enums[attrs["varset"]]
+		return varset
+
+	def parse_variants(self, attrs):
+		if not "variants" in attrs:
+				return None
+		variant = attrs["variants"].split(",")[0]
+		if "-" in variant:
+			variant = variant[:variant.index("-")]
+
+		varset = self.parse_varset(attrs)
+
+		assert varset.has_name(variant)
+
+		return variant
+
+	def add_all_variants(self, reg, attrs, parent_variant):
+		# TODO this should really handle *all* variants, including dealing
+		# with open ended ranges (ie. "A2XX,A4XX-") (we have the varset
+		# enum now to make that possible)
+		variant = self.parse_variants(attrs)
+		if not variant:
+			variant = parent_variant
+
+		if reg.name not in self.variant_regs:
+			self.variant_regs[reg.name] = {}
+		else:
+			# All variants must be same size:
+			v = next(iter(self.variant_regs[reg.name]))
+			assert self.variant_regs[reg.name][v].bit_size == reg.bit_size
+
+		self.variant_regs[reg.name][variant] = reg
+
+	def add_all_usages(self, reg, usages):
+		if not usages:
+			return
+
+		for usage in usages:
+			self.usage_regs[usage].append(reg)
+
+		self.variants.add(reg.domain)
+
+	def do_validate(self, schemafile):
+		if not self.validate:
+			return
+
+		try:
+			from lxml import etree
+
+			parser, filename = self.stack[-1]
+			dirname = os.path.dirname(filename)
+
+			# we expect this to look like <namespace url> schema.xsd.. I think
+			# technically it is supposed to be just a URL, but that doesn't
+			# quite match up to what we do.. Just skip over everything up to
+			# and including the first whitespace character:
+			schemafile = schemafile[schemafile.rindex(" ")+1:]
+
+			# this is a bit cheezy, but the xml file to validate could be
+			# in a child director, ie. we don't really know where the schema
+			# file is, the way the rnn C code does.  So if it doesn't exist
+			# just look one level up
+			if not os.path.exists(dirname + "/" + schemafile):
+				schemafile = "../" + schemafile
+
+			if not os.path.exists(dirname + "/" + schemafile):
+				raise self.error("Cannot find schema for: " + filename)
+
+			xmlschema_doc = etree.parse(dirname + "/" + schemafile)
+			xmlschema = etree.XMLSchema(xmlschema_doc)
+
+			xml_doc = etree.parse(filename)
+			if not xmlschema.validate(xml_doc):
+				error_str = str(xmlschema.error_log.filter_from_errors()[0])
+				raise self.error("Schema validation failed for: " + filename + "\n" + error_str)
+		except ImportError as e:
+			if self.validate:
+				raise e
+
+			print("lxml not found, skipping validation", file=sys.stderr)
+
+	def do_parse(self, filename):
+		filepath = os.path.abspath(filename)
+		if filepath in self.xml_files:
+			return
+		self.xml_files.append(filepath)
+		file = open(filename, "rb")
+		parser = xml.parsers.expat.ParserCreate()
+		self.stack.append((parser, filename))
+		parser.StartElementHandler = self.start_element
+		parser.EndElementHandler = self.end_element
+		parser.CharacterDataHandler = self.character_data
+		parser.buffer_text = True
+		parser.ParseFile(file)
+		self.stack.pop()
+		file.close()
+
+	def parse(self, rnn_path, filename, validate):
+		self.path = rnn_path
+		self.stack = []
+		self.validate = validate
+		self.do_parse(filename)
+
+	def parse_reg(self, attrs, bit_size):
+		self.current_bitsize = bit_size
+		if "type" in attrs and attrs["type"] in self.bitsets:
+			bitset = self.bitsets[attrs["type"]]
+			if bitset.inline:
+				self.current_bitset = Bitset(attrs["name"], bitset)
+				self.current_bitset.inline = True
+			else:
+				self.current_bitset = bitset
+		else:
+			self.current_bitset = Bitset(attrs["name"], None)
+			self.current_bitset.inline = True
+			if "type" in attrs:
+				self.parse_field(None, attrs)
+
+		variant = self.parse_variants(attrs)
+		if not variant and self.current_array:
+			variant = self.current_array.variant
+
+		self.current_reg = Reg(attrs, self.prefix(variant), self.current_array, bit_size)
+		self.current_reg.bitset = self.current_bitset
+
+		if len(self.stack) == 1:
+			self.file.append(self.current_reg)
+
+		if variant is not None:
+			self.add_all_variants(self.current_reg, attrs, variant)
+
+		usages = None
+		if "usage" in attrs:
+			usages = attrs["usage"].split(',')
+		elif self.current_array:
+			usages = self.current_array.usages
+
+		self.add_all_usages(self.current_reg, usages)
+
+	def start_element(self, name, attrs):
+		self.cdata = ""
+		if name == "import":
+			filename = attrs["file"]
+			self.do_parse(os.path.join(self.path, filename))
+		elif name == "domain":
+			self.current_domain = attrs["name"]
+			if "prefix" in attrs:
+				self.current_prefix = self.parse_variants(attrs)
+				self.current_prefix_type = attrs["prefix"]
+			else:
+				self.current_prefix = None
+				self.current_prefix_type = None
+			if "varset" in attrs:
+				self.current_varset = self.enums[attrs["varset"]]
+		elif name == "stripe":
+			self.current_stripe = self.parse_variants(attrs)
+		elif name == "enum":
+			self.current_enum_value = 0
+			self.current_enum = Enum(attrs["name"])
+			self.enums[attrs["name"]] = self.current_enum
+			if len(self.stack) == 1:
+				self.file.append(self.current_enum)
+		elif name == "value":
+			if "value" in attrs:
+				value = int(attrs["value"], 0)
+			else:
+				value = self.current_enum_value
+			self.current_enum.values.append((attrs["name"], value))
+		elif name == "reg32":
+			self.parse_reg(attrs, 32)
+		elif name == "reg64":
+			self.parse_reg(attrs, 64)
+		elif name == "array":
+			self.current_bitsize = 32
+			variant = self.parse_variants(attrs)
+			index_type = self.enums[attrs["index"]] if "index" in attrs else None
+			self.current_array = Array(attrs, self.prefix(variant), variant, self.current_array, index_type)
+			if len(self.stack) == 1:
+				self.file.append(self.current_array)
+		elif name == "bitset":
+			self.current_bitset = Bitset(attrs["name"], None)
+			if "inline" in attrs and attrs["inline"] == "yes":
+				self.current_bitset.inline = True
+			self.bitsets[self.current_bitset.name] = self.current_bitset
+			if len(self.stack) == 1 and not self.current_bitset.inline:
+				self.file.append(self.current_bitset)
+		elif name == "bitfield" and self.current_bitset:
+			self.parse_field(attrs["name"], attrs)
+		elif name == "database":
+			self.do_validate(attrs["xsi:schemaLocation"])
+		elif name == "copyright":
+			self.copyright_year = attrs["year"]
+		elif name == "author":
+			self.authors.append(attrs["name"] + " <" + attrs["email"] + "> " + attrs["name"])
+
+	def end_element(self, name):
+		if name == "domain":
+			self.current_domain = None
+			self.current_prefix = None
+			self.current_prefix_type = None
+		elif name == "stripe":
+			self.current_stripe = None
+		elif name == "bitset":
+			self.current_bitset = None
+		elif name == "reg32":
+			self.current_reg = None
+		elif name == "array":
+			self.current_array = self.current_array.parent
+		elif name == "enum":
+			self.current_enum = None
+		elif name == "license":
+			self.license = self.cdata
+
+	def character_data(self, data):
+		self.cdata += data
+
+	def dump_reg_usages(self):
+		d = collections.defaultdict(list)
+		for usage, regs in self.usage_regs.items():
+			for reg in regs:
+				variants = self.variant_regs.get(reg.name)
+				if variants:
+					for variant, vreg in variants.items():
+						if reg == vreg:
+							d[(usage, variant)].append(reg)
+				else:
+					for variant in self.variants:
+						d[(usage, variant)].append(reg)
+
+		print("#ifdef __cplusplus")
+
+		for usage, regs in self.usage_regs.items():
+			print("template<chip CHIP> constexpr inline uint16_t %s_REGS[] = {};" % (usage.upper()))
+
+		for (usage, variant), regs in d.items():
+			offsets = []
+
+			for reg in regs:
+				if reg.array:
+					for i in range(reg.array.length):
+						offsets.append(reg.array.offset + reg.offset + i * reg.array.stride)
+						if reg.bit_size == 64:
+							offsets.append(offsets[-1] + 1)
+				else:
+					offsets.append(reg.offset)
+					if reg.bit_size == 64:
+						offsets.append(offsets[-1] + 1)
+
+			offsets.sort()
+
+			print("template<> constexpr inline uint16_t %s_REGS<%s>[] = {" % (usage.upper(), variant))
+			for offset in offsets:
+				print("\t%s," % hex(offset))
+			print("};")
+
+		print("#endif")
+
+	def dump(self):
+		enums = []
+		bitsets = []
+		regs = []
+		for e in self.file:
+			if isinstance(e, Enum):
+				enums.append(e)
+			elif isinstance(e, Bitset):
+				bitsets.append(e)
+			else:
+				regs.append(e)
+
+		for e in enums + bitsets + regs:
+			e.dump()
+
+		self.dump_reg_usages()
+
+
+	def dump_regs_py(self):
+		regs = []
+		for e in self.file:
+			if isinstance(e, Reg):
+				regs.append(e)
+
+		for e in regs:
+			e.dump_py()
+
+
+	def dump_reg_variants(self, regname, variants):
+		# Don't bother for things that only have a single variant:
+		if len(variants) == 1:
+			return
+		print("#ifdef __cplusplus")
+		print("struct __%s {" % regname)
+		# TODO be more clever.. we should probably figure out which
+		# fields have the same type in all variants (in which they
+		# appear) and stuff everything else in a variant specific
+		# sub-structure.
+		seen_fields = []
+		bit_size = 32
+		array = False
+		address = None
+		for variant in variants.keys():
+			print("    /* %s fields: */" % variant)
+			reg = variants[variant]
+			bit_size = reg.bit_size
+			array = reg.array
+			for f in reg.bitset.fields:
+				fld_name = field_name(reg, f)
+				if fld_name in seen_fields:
+					continue
+				seen_fields.append(fld_name)
+				name = fld_name.lower()
+				if f.type in [ "address", "waddress" ]:
+					if address:
+						continue
+					address = f
+					tab_to("    __bo_type", "bo;")
+					tab_to("    uint32_t", "bo_offset;")
+					continue
+				type, val = f.ctype("var")
+				tab_to("    %s" %type, "%s;" %name)
+		print("    /* fallback fields: */")
+		if bit_size == 64:
+			tab_to("    uint64_t", "unknown;")
+			tab_to("    uint64_t", "qword;")
+		else:
+			tab_to("    uint32_t", "unknown;")
+			tab_to("    uint32_t", "dword;")
+		print("};")
+		# TODO don't hardcode the varset enum name
+		varenum = "chip"
+		print("template <%s %s>" % (varenum, varenum.upper()))
+		print("static inline struct fd_reg_pair")
+		xtra = ""
+		xtravar = ""
+		if array:
+			xtra = "int __i, "
+			xtravar = "__i, "
+		print("__%s(%sstruct __%s fields) {" % (regname, xtra, regname))
+		for variant in variants.keys():
+			print("  if (%s == %s) {" % (varenum.upper(), variant))
+			reg = variants[variant]
+			reg.dump_regpair_builder()
+			print("  } else")
+		print("    assert(!\"invalid variant\");")
+		print("}")
+
+		if bit_size == 64:
+			skip = ", { .reg = 0 }"
+		else:
+			skip = ""
+
+		print("#define %s(VARIANT, %s...) __%s<VARIANT>(%s{__VA_ARGS__})%s" % (regname, xtravar, regname, xtravar, skip))
+		print("#endif /* __cplusplus */")
+
+	def dump_structs(self):
+		for e in self.file:
+			e.dump_pack_struct()
+
+		for regname in self.variant_regs:
+			self.dump_reg_variants(regname, self.variant_regs[regname])
+
+
+def dump_c(args, guard, func):
+	p = Parser()
+
+	try:
+		p.parse(args.rnn, args.xml, args.validate)
+	except Error as e:
+		print(e, file=sys.stderr)
+		exit(1)
+
+	print("#ifndef %s\n#define %s\n" % (guard, guard))
+
+	print("""/* Autogenerated file, DO NOT EDIT manually!
+
+This file was generated by the rules-ng-ng gen_header.py tool in this git repository:
+http://gitlab.freedesktop.org/mesa/mesa/
+git clone https://gitlab.freedesktop.org/mesa/mesa.git
+
+The rules-ng-ng source files this header was generated from are:
+""")
+	maxlen = 0
+	for filepath in p.xml_files:
+		maxlen = max(maxlen, len(filepath))
+	for filepath in p.xml_files:
+		pad = " " * (maxlen - len(filepath))
+		filesize = str(os.path.getsize(filepath))
+		filesize = " " * (7 - len(filesize)) + filesize
+		filetime = time.ctime(os.path.getmtime(filepath))
+		print("- " + filepath + pad + " (" + filesize + " bytes, from " + filetime + ")")
+	if p.copyright_year:
+		current_year = str(datetime.date.today().year)
+		print()
+		print("Copyright (C) %s-%s by the following authors:" % (p.copyright_year, current_year))
+		for author in p.authors:
+			print("- " + author)
+	if p.license:
+		print(p.license)
+	print("*/")
+
+	print()
+	print("#ifdef __KERNEL__")
+	print("#include <linux/bug.h>")
+	print("#define assert(x) BUG_ON(!(x))")
+	print("#else")
+	print("#include <assert.h>")
+	print("#endif")
+	print()
+
+	print("#ifdef __cplusplus")
+	print("#define __struct_cast(X)")
+	print("#else")
+	print("#define __struct_cast(X) (struct X)")
+	print("#endif")
+	print()
+
+	func(p)
+
+	print("\n#endif /* %s */" % guard)
+
+
+def dump_c_defines(args):
+	guard = str.replace(os.path.basename(args.xml), '.', '_').upper()
+	dump_c(args, guard, lambda p: p.dump())
+
+
+def dump_c_pack_structs(args):
+	guard = str.replace(os.path.basename(args.xml), '.', '_').upper() + '_STRUCTS'
+	dump_c(args, guard, lambda p: p.dump_structs())
+
+
+def dump_py_defines(args):
+	p = Parser()
+
+	try:
+		p.parse(args.rnn, args.xml)
+	except Error as e:
+		print(e, file=sys.stderr)
+		exit(1)
+
+	file_name = os.path.splitext(os.path.basename(args.xml))[0]
+
+	print("from enum import IntEnum")
+	print("class %sRegs(IntEnum):" % file_name.upper())
+
+	os.path.basename(args.xml)
+
+	p.dump_regs_py()
+
+
+def main():
+	parser = argparse.ArgumentParser()
+	parser.add_argument('--rnn', type=str, required=True)
+	parser.add_argument('--xml', type=str, required=True)
+	parser.add_argument('--validate', default=False, action='store_true')
+	parser.add_argument('--no-validate', dest='validate', action='store_false')
+
+	subparsers = parser.add_subparsers()
+	subparsers.required = True
+
+	parser_c_defines = subparsers.add_parser('c-defines')
+	parser_c_defines.set_defaults(func=dump_c_defines)
+
+	parser_c_pack_structs = subparsers.add_parser('c-pack-structs')
+	parser_c_pack_structs.set_defaults(func=dump_c_pack_structs)
+
+	parser_py_defines = subparsers.add_parser('py-defines')
+	parser_py_defines.set_defaults(func=dump_py_defines)
+
+	args = parser.parse_args()
+	args.func(args)
+
+
+if __name__ == '__main__':
+	main()
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm/registers/rules-fd.xsd
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm/registers/rules-fd.xsd
@@ -0,0 +1,404 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema"
+	targetNamespace="http://nouveau.freedesktop.org/"
+	xmlns:rng="http://nouveau.freedesktop.org/"
+	elementFormDefault="qualified">
+
+	<annotation>
+		<documentation>
+			An updated version of the old rules.xml file from the
+			RivaTV project. Specifications by Pekka Paalanen,
+			preliminary attempt by KoalaBR,
+			first working version by Jakob Bornecrantz.
+			For specifications, see the file rules-ng-format.txt
+			in Nouveau CVS module 'rules-ng'.
+		</documentation>
+		<documentation>Version 0.1</documentation>
+	</annotation>
+
+
+	<!-- Elements -->
+
+	<element name="database"       type="rng:databaseType" />
+	<element name="import"         type="rng:importType" />
+	<element name="copyright"      type="rng:copyrightType" />
+	<element name="domain"         type="rng:domainType" />
+	<element name="array"          type="rng:arrayType" />
+	<element name="stripe"         type="rng:stripeType" />
+	<element name="reg64"          type="rng:registerType" />
+	<element name="reg32"          type="rng:registerType" />
+	<element name="bitset"         type="rng:bitsetType" />
+	<element name="bitfield"       type="rng:bitfieldType" />
+	<element name="enum"           type="rng:enumType" />
+	<element name="value"          type="rng:valueType" />
+
+	<!-- Copyright elements -->
+	<element name="author"         type="rng:authorType" />
+	<element name="nick"           type="rng:nickType" />
+	<element name="license"        type="rng:docType" />
+
+	<!-- Documentation elements -->
+	
+	<!-- FIXME: allowed only one  per parent element -->
+	<element name="brief" type="rng:briefType" />
+	
+	<element name="doc"  type="rng:docType" />
+	<element name="b"    type="rng:textformatType" />
+	<element name="i"    type="rng:textformatType" />
+	<element name="u"    type="rng:textformatType" />
+	<element name="code" type="rng:textcodeType" />
+	<element name="ul"   type="rng:listType" />
+	<element name="ol"   type="rng:listType" />
+	<element name="li"   type="rng:listitemType" />
+
+	<!-- Copyright element types -->
+
+	<complexType name="authorType" mixed="true">
+		<annotation>
+			<documentation>
+				register database author
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<element ref="rng:nick" />
+		</choice>
+		<attribute name="name" type="string" use="required" />
+		<attribute name="email" type="string" use="required" />
+	</complexType>
+
+	<complexType name="nickType">
+		<annotation>
+			<documentation>nickType</documentation>
+		</annotation>
+		<attribute name="name" type="string" use="required" />
+	</complexType>
+
+	<!-- Database element types -->
+
+	<complexType name="databaseType">
+		<annotation>
+			<documentation>databaseType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+	</complexType>
+
+	<complexType name="importType">
+		<annotation>
+			<documentation>importType</documentation>
+		</annotation>
+		<attribute name="file" type="string" use="required" />
+	</complexType>
+
+	<complexType name="copyrightType">
+		<annotation>
+			<documentation>copyrightType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<element ref="rng:author" />
+			<element ref="rng:license" />
+		</choice>
+		<attribute name="year" type="nonNegativeInteger" use="optional" />
+	</complexType>
+
+	<complexType name="domainType">
+		<annotation>
+			<documentation>domainType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<group ref="rng:regarrayGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="prefix" type="NMTOKENS" use="optional" />
+		<attribute name="width" type="rng:DomainWidth" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+	</complexType>
+
+	<complexType name="arrayType">
+		<annotation>
+			<documentation>arrayType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<group ref="rng:regarrayGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="optional" />
+		<attribute name="offset" type="rng:HexOrNumber" use="optional" />
+		<attribute name="offsets" type="string" use="optional"/>
+		<attribute name="doffsets" type="string" use="optional"/>
+		<attribute name="index" type="NMTOKENS" use="optional"/>
+		<attribute name="stride" type="rng:HexOrNumber" use="required" />
+		<attribute name="length" type="rng:HexOrNumber" use="required" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+		<attribute name="usage" type="string" use="optional" />
+	</complexType>
+
+	<complexType name="stripeType">
+		<annotation>
+			<documentation>stripeType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<group ref="rng:regarrayGroup" minOccurs="0" />
+		</choice>
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+		<attribute name="prefix" type="NMTOKENS" use="optional" />
+	</complexType>
+
+	<complexType name="registerType">
+		<annotation>
+			<documentation>
+				registerType used by reg32, reg64
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<element ref="rng:value" />
+			<element ref="rng:bitfield" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="offset" type="rng:HexOrNumber" use="required" />
+		<attribute name="type" type="NMTOKENS" use="optional" />
+		<attribute name="shr" type="nonNegativeInteger" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+		<attribute name="stride" type="rng:HexOrNumber" use="optional" />
+		<attribute name="length" type="rng:HexOrNumber" use="optional" />
+		<attribute name="high" type="nonNegativeInteger" use="optional" />
+		<attribute name="low" type="nonNegativeInteger" use="optional" />
+		<attribute name="pos" type="nonNegativeInteger" use="optional" />
+		<attribute name="align" type="nonNegativeInteger" use="optional" />
+		<attribute name="radix" type="nonNegativeInteger" use="optional" />
+		<attribute name="usage" type="string" use="optional" />
+	</complexType>
+
+	<complexType name="bitsetType">
+		<annotation>
+			<documentation>bitsetType</documentation>
+		</annotation>
+		<choice maxOccurs="unbounded">
+			<element ref="rng:bitfield" />
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="inline" type="rng:Boolean" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+	</complexType>
+
+	<complexType name="bitfieldType">
+		<annotation>
+			<documentation>bitfieldType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<element ref="rng:value" maxOccurs="unbounded" />
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="high" type="nonNegativeInteger" use="optional" />
+		<attribute name="low" type="nonNegativeInteger" use="optional" />
+		<attribute name="pos" type="nonNegativeInteger" use="optional" />
+		<attribute name="radix" type="nonNegativeInteger" use="optional" />
+		<attribute name="type" type="NMTOKENS" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+		<attribute name="addvariant" type="rng:Boolean" use="optional" />
+		<attribute name="shr" type="nonNegativeInteger" use="optional" />
+	</complexType>
+
+	<complexType name="enumType">
+		<annotation>
+			<documentation>enumType</documentation>
+		</annotation>
+		<choice maxOccurs="unbounded">
+			<element ref="rng:value" />
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="bare" type="rng:Boolean" use="optional" />
+		<attribute name="prefix" type="NMTOKENS" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+	</complexType>
+
+	<complexType name="valueType">
+		<annotation>
+			<documentation>valueType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="value" type="string" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+	</complexType>
+
+	<!-- Documentation element types -->
+
+	<complexType name="briefType">
+		<annotation>
+			<documentation>
+				brief documentation, no markup
+			</documentation>
+		</annotation>
+		<simpleContent>
+			<extension base="string" />
+		</simpleContent>
+	</complexType>
+	
+	<complexType name="docType" mixed="true">
+		<annotation>
+			<documentation>
+				root element of documentation sub-tree
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:textformatGroup" />
+			<group ref="rng:listGroup" />
+			<element ref="rng:code" />
+		</choice>
+	</complexType>
+	
+	<complexType name="textformatType" mixed="true">
+		<annotation>
+			<documentation>
+				for bold, underline, italics
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:textformatGroup" />
+		</choice>
+	</complexType>
+	
+	<complexType name="textcodeType">
+		<simpleContent>
+			<extension base="string">
+				<attribute name="title" type="string" />
+			</extension>
+		</simpleContent>
+	</complexType>
+	
+	<complexType name="listType">
+		<annotation>
+			<documentation>
+				definition of a list, ordered or unordered
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<element ref="rng:li" />
+		</choice>
+	</complexType>
+	
+	<complexType name="listitemType" mixed="true">
+		<annotation>
+			<documentation>
+				items of a list
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:textformatGroup" />
+			<group ref="rng:listGroup" />
+			<element ref="rng:code" />
+		</choice>
+	</complexType>
+
+
+
+	<!-- Attribute value types -->
+
+	<simpleType name="Hexadecimal">
+		<restriction base="string">
+			<pattern value="0x[0-9a-f]+" />
+			<pattern value="0x[0-9A-F]+" />
+			<pattern value="[0-9]" />
+		</restriction>
+	</simpleType>
+
+	<simpleType name="HexOrNumber">
+		<annotation>
+			<documentation>HexOrNumber</documentation>
+		</annotation>
+		<union memberTypes="rng:Hexadecimal nonNegativeInteger" />
+	</simpleType>
+
+	<simpleType name="Boolean">
+		<restriction base="string">
+			<enumeration value="true" />
+			<enumeration value="1" />
+			<enumeration value="yes" />
+			<enumeration value="false" />
+			<enumeration value="0" />
+			<enumeration value="no" />
+		</restriction>
+	</simpleType>
+
+	<simpleType name="DomainWidth">
+		<annotation>
+			<documentation>DomainWidth</documentation>
+		</annotation>
+		<restriction base="string">
+			<enumeration value="32" />
+		</restriction>
+	</simpleType>
+
+
+
+	<!-- Element groups -->
+
+	<group name="topGroup">
+		<choice>
+			<element ref="rng:copyright" />
+			<element ref="rng:domain" />
+			<element ref="rng:enum" />
+			<element ref="rng:bitset" />
+			<element ref="rng:import" />
+		</choice>
+	</group>
+	
+	<group name="regarrayGroup">
+		<choice>
+			<element ref="rng:reg64" />
+			<element ref="rng:reg32" />
+			<element ref="rng:array" />
+			<element ref="rng:stripe" />
+		</choice>
+	</group>
+	
+	<group name="docGroup">
+		<choice>
+			<element ref="rng:brief" />
+			<element ref="rng:doc" />
+		</choice>
+	</group>
+	
+	<group name="textformatGroup">
+		<choice>
+			<element ref="rng:b" />
+			<element ref="rng:i" />
+			<element ref="rng:u" />
+		</choice>
+	</group>
+	
+	<group name="listGroup">
+		<choice>
+			<element ref="rng:ul" />
+			<element ref="rng:ol" />
+		</choice>
+	</group>
+
+</schema>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/Kconfig
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/Kconfig
@@ -0,0 +1,178 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+config DRM_MSM
+	tristate "MSM DRM"
+	depends on DRM
+	depends on ARCH_QCOM || SOC_IMX5 || COMPILE_TEST
+	depends on COMMON_CLK
+	depends on IOMMU_SUPPORT
+	depends on QCOM_AOSS_QMP || QCOM_AOSS_QMP=n
+	depends on QCOM_OCMEM || QCOM_OCMEM=n
+	depends on QCOM_LLCC || QCOM_LLCC=n
+	depends on QCOM_COMMAND_DB || QCOM_COMMAND_DB=n
+	depends on PM
+	select IOMMU_IO_PGTABLE
+	select QCOM_MDT_LOADER if ARCH_QCOM
+	select REGULATOR
+	select DRM_DP_AUX_BUS
+	select DRM_DISPLAY_DP_HELPER
+	select DRM_DISPLAY_HELPER
+	select DRM_EXEC
+	select DRM_KMS_HELPER
+	select DRM_PANEL
+	select DRM_BRIDGE
+	select DRM_PANEL_BRIDGE
+	select DRM_SCHED
+	select FB_SYSMEM_HELPERS if DRM_FBDEV_EMULATION
+	select SHMEM
+	select TMPFS
+	select QCOM_SCM
+	select WANT_DEV_COREDUMP
+	select SND_SOC_HDMI_CODEC if SND_SOC
+	select SYNC_FILE
+	select PM_OPP
+	select NVMEM
+	select PM_GENERIC_DOMAINS
+	help
+	  DRM/KMS driver for MSM/snapdragon.
+
+config DRM_MSM_GPU_STATE
+	bool
+	depends on DRM_MSM && (DEBUG_FS || DEV_COREDUMP)
+	default y
+
+config DRM_MSM_GPU_SUDO
+	bool "Enable SUDO flag on submits"
+	depends on DRM_MSM && EXPERT
+	default n
+	help
+	  Enable userspace that has CAP_SYS_RAWIO to submit GPU commands
+	  that are run from RB instead of IB1.  This essentially gives
+	  userspace kernel level access, but is useful for firmware
+	  debugging.
+
+	  Only use this if you are a driver developer.  This should *not*
+	  be enabled for production kernels.  If unsure, say N.
+
+config DRM_MSM_VALIDATE_XML
+	bool "Validate XML register files against schema"
+	depends on DRM_MSM && EXPERT && n
+	depends on $(success,$(PYTHON3) -c "import lxml")
+	help
+	  Validate XML files with register definitions against rules-fd schema.
+	  This option is mostly targeting DRM MSM developers. If unsure, say N.
+
+config DRM_MSM_MDSS
+	bool
+	depends on DRM_MSM
+	default n
+
+config DRM_MSM_MDP4
+	bool "Enable MDP4 support in MSM DRM driver"
+	depends on DRM_MSM
+	default y
+	help
+	  Compile in support for the Mobile Display Processor v4 (MDP4) in
+	  the MSM DRM driver. It is the older display controller found in
+	  devices using APQ8064/MSM8960/MSM8x60 platforms.
+
+config DRM_MSM_MDP5
+	bool "Enable MDP5 support in MSM DRM driver"
+	depends on DRM_MSM
+	select DRM_MSM_MDSS
+	default y
+	help
+	  Compile in support for the Mobile Display Processor v5 (MDP5) in
+	  the MSM DRM driver. It is the display controller found in devices
+	  using e.g. APQ8016/MSM8916/APQ8096/MSM8996/MSM8974/SDM6x0 platforms.
+
+config DRM_MSM_DPU
+	bool "Enable DPU support in MSM DRM driver"
+	depends on DRM_MSM
+	select DRM_MSM_MDSS
+	default y
+	help
+	  Compile in support for the Display Processing Unit in
+	  the MSM DRM driver. It is the display controller found in devices
+	  using e.g. SDM845 and newer platforms.
+
+config DRM_MSM_DP
+	bool "Enable DisplayPort support in MSM DRM driver"
+	depends on DRM_MSM
+	select RATIONAL
+	default y
+	help
+	  Compile in support for DP driver in MSM DRM driver. DP external
+	  display support is enabled through this config option. It can
+	  be primary or secondary display on device.
+
+config DRM_MSM_DSI
+	bool "Enable DSI support in MSM DRM driver"
+	depends on DRM_MSM
+	select DRM_PANEL
+	select DRM_MIPI_DSI
+	default y
+	help
+	  Choose this option if you have a need for MIPI DSI connector
+	  support.
+
+config DRM_MSM_DSI_28NM_PHY
+	bool "Enable DSI 28nm PHY driver in MSM DRM"
+	depends on DRM_MSM_DSI
+	default y
+	help
+	  Choose this option if the 28nm DSI PHY is used on the platform.
+
+config DRM_MSM_DSI_20NM_PHY
+	bool "Enable DSI 20nm PHY driver in MSM DRM"
+	depends on DRM_MSM_DSI
+	default y
+	help
+	  Choose this option if the 20nm DSI PHY is used on the platform.
+
+config DRM_MSM_DSI_28NM_8960_PHY
+	bool "Enable DSI 28nm 8960 PHY driver in MSM DRM"
+	depends on DRM_MSM_DSI
+	default y
+	help
+	  Choose this option if the 28nm DSI PHY 8960 variant is used on the
+	  platform.
+
+config DRM_MSM_DSI_14NM_PHY
+	bool "Enable DSI 14nm PHY driver in MSM DRM (used by MSM8996/APQ8096)"
+	depends on DRM_MSM_DSI
+	default y
+	help
+	  Choose this option if DSI PHY on 8996 is used on the platform.
+
+config DRM_MSM_DSI_10NM_PHY
+	bool "Enable DSI 10nm PHY driver in MSM DRM (used by SDM845)"
+	depends on DRM_MSM_DSI
+	default y
+	help
+	  Choose this option if DSI PHY on SDM845 is used on the platform.
+
+config DRM_MSM_DSI_7NM_PHY
+	bool "Enable DSI 7nm/5nm/4nm PHY driver in MSM DRM"
+	depends on DRM_MSM_DSI
+	default y
+	help
+	  Choose this option if DSI PHY on SM8150/SM8250/SM8350/SM8450/SM8550/SC7280
+	  is used on the platform.
+
+config DRM_MSM_HDMI
+	bool "Enable HDMI support in MSM DRM driver"
+	depends on DRM_MSM
+	default y
+	help
+	  Compile in support for the HDMI output MSM DRM driver. It can
+	  be a primary or a secondary display on device. Note that this is used
+	  only for the direct HDMI output. If the device outputs HDMI data
+	  through some kind of DSI-to-HDMI bridge, this option can be disabled.
+
+config DRM_MSM_HDMI_HDCP
+	bool "Enable HDMI HDCP support in MSM DRM driver"
+	depends on DRM_MSM && DRM_MSM_HDMI
+	default y
+	help
+	  Choose this option to enable HDCP state machine
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/Makefile
@@ -0,0 +1,220 @@
+# SPDX-License-Identifier: GPL-2.0
+ccflags-y := -I $(srctree)/$(src)
+ccflags-y += -I $(obj)/generated
+ccflags-y += -I $(srctree)/$(src)/disp/dpu1
+ccflags-$(CONFIG_DRM_MSM_DSI) += -I $(srctree)/$(src)/dsi
+ccflags-$(CONFIG_DRM_MSM_DP) += -I $(srctree)/$(src)/dp
+
+adreno-y := \
+	adreno/adreno_device.o \
+	adreno/adreno_gpu.o \
+	adreno/a2xx_catalog.o \
+	adreno/a2xx_gpu.o \
+	adreno/a2xx_gpummu.o \
+	adreno/a3xx_catalog.o \
+	adreno/a3xx_gpu.o \
+	adreno/a4xx_catalog.o \
+	adreno/a4xx_gpu.o \
+	adreno/a5xx_catalog.o \
+	adreno/a5xx_gpu.o \
+	adreno/a5xx_power.o \
+	adreno/a5xx_preempt.o \
+	adreno/a6xx_catalog.o \
+	adreno/a6xx_gpu.o \
+	adreno/a6xx_gmu.o \
+	adreno/a6xx_hfi.o \
+
+adreno-$(CONFIG_DEBUG_FS) += adreno/a5xx_debugfs.o \
+
+adreno-$(CONFIG_DRM_MSM_GPU_STATE)	+= adreno/a6xx_gpu_state.o
+
+msm-display-$(CONFIG_DRM_MSM_HDMI) += \
+	hdmi/hdmi.o \
+	hdmi/hdmi_audio.o \
+	hdmi/hdmi_bridge.o \
+	hdmi/hdmi_hpd.o \
+	hdmi/hdmi_i2c.o \
+	hdmi/hdmi_phy.o \
+	hdmi/hdmi_phy_8960.o \
+	hdmi/hdmi_phy_8996.o \
+	hdmi/hdmi_phy_8998.o \
+	hdmi/hdmi_phy_8x60.o \
+	hdmi/hdmi_phy_8x74.o \
+	hdmi/hdmi_pll_8960.o \
+
+msm-display-$(CONFIG_DRM_MSM_MDP4) += \
+	disp/mdp4/mdp4_crtc.o \
+	disp/mdp4/mdp4_dsi_encoder.o \
+	disp/mdp4/mdp4_dtv_encoder.o \
+	disp/mdp4/mdp4_lcdc_encoder.o \
+	disp/mdp4/mdp4_lvds_connector.o \
+	disp/mdp4/mdp4_lvds_pll.o \
+	disp/mdp4/mdp4_irq.o \
+	disp/mdp4/mdp4_kms.o \
+	disp/mdp4/mdp4_plane.o \
+
+msm-display-$(CONFIG_DRM_MSM_MDP5) += \
+	disp/mdp5/mdp5_cfg.o \
+	disp/mdp5/mdp5_cmd_encoder.o \
+	disp/mdp5/mdp5_ctl.o \
+	disp/mdp5/mdp5_crtc.o \
+	disp/mdp5/mdp5_encoder.o \
+	disp/mdp5/mdp5_irq.o \
+	disp/mdp5/mdp5_kms.o \
+	disp/mdp5/mdp5_pipe.o \
+	disp/mdp5/mdp5_mixer.o \
+	disp/mdp5/mdp5_plane.o \
+	disp/mdp5/mdp5_smp.o \
+
+msm-display-$(CONFIG_DRM_MSM_DPU) += \
+	disp/dpu1/dpu_core_perf.o \
+	disp/dpu1/dpu_crtc.o \
+	disp/dpu1/dpu_encoder.o \
+	disp/dpu1/dpu_encoder_phys_cmd.o \
+	disp/dpu1/dpu_encoder_phys_vid.o \
+	disp/dpu1/dpu_encoder_phys_wb.o \
+	disp/dpu1/dpu_formats.o \
+	disp/dpu1/dpu_hw_catalog.o \
+	disp/dpu1/dpu_hw_cdm.o \
+	disp/dpu1/dpu_hw_ctl.o \
+	disp/dpu1/dpu_hw_dsc.o \
+	disp/dpu1/dpu_hw_dsc_1_2.o \
+	disp/dpu1/dpu_hw_interrupts.o \
+	disp/dpu1/dpu_hw_intf.o \
+	disp/dpu1/dpu_hw_lm.o \
+	disp/dpu1/dpu_hw_pingpong.o \
+	disp/dpu1/dpu_hw_sspp.o \
+	disp/dpu1/dpu_hw_dspp.o \
+	disp/dpu1/dpu_hw_merge3d.o \
+	disp/dpu1/dpu_hw_top.o \
+	disp/dpu1/dpu_hw_util.o \
+	disp/dpu1/dpu_hw_vbif.o \
+	disp/dpu1/dpu_hw_wb.o \
+	disp/dpu1/dpu_kms.o \
+	disp/dpu1/dpu_plane.o \
+	disp/dpu1/dpu_rm.o \
+	disp/dpu1/dpu_vbif.o \
+	disp/dpu1/dpu_writeback.o
+
+msm-display-$(CONFIG_DRM_MSM_MDSS) += \
+	msm_mdss.o \
+
+msm-display-y += \
+	disp/mdp_format.o \
+	disp/mdp_kms.o \
+	disp/msm_disp_snapshot.o \
+	disp/msm_disp_snapshot_util.o \
+
+msm-y += \
+	msm_atomic.o \
+	msm_atomic_tracepoints.o \
+	msm_debugfs.o \
+	msm_drv.o \
+	msm_fb.o \
+	msm_fence.o \
+	msm_gem.o \
+	msm_gem_prime.o \
+	msm_gem_shrinker.o \
+	msm_gem_submit.o \
+	msm_gem_vma.o \
+	msm_gpu.o \
+	msm_gpu_devfreq.o \
+	msm_io_utils.o \
+	msm_iommu.o \
+	msm_kms.o \
+	msm_perf.o \
+	msm_rd.o \
+	msm_ringbuffer.o \
+	msm_submitqueue.o \
+	msm_gpu_tracepoints.o \
+
+msm-$(CONFIG_DRM_FBDEV_EMULATION) += msm_fbdev.o
+
+msm-display-$(CONFIG_DEBUG_FS) += \
+	dp/dp_debug.o
+
+msm-display-$(CONFIG_DRM_MSM_DP)+= dp/dp_aux.o \
+	dp/dp_catalog.o \
+	dp/dp_ctrl.o \
+	dp/dp_display.o \
+	dp/dp_drm.o \
+	dp/dp_link.o \
+	dp/dp_panel.o \
+	dp/dp_audio.o \
+	dp/dp_utils.o \
+	dp/dp_mst_drm.o
+
+msm-display-$(CONFIG_DRM_MSM_HDMI_HDCP) += hdmi/hdmi_hdcp.o
+
+msm-display-$(CONFIG_DRM_MSM_DSI) += dsi/dsi.o \
+			dsi/dsi_cfg.o \
+			dsi/dsi_host.o \
+			dsi/dsi_manager.o \
+			dsi/phy/dsi_phy.o
+
+msm-display-$(CONFIG_DRM_MSM_DSI_28NM_PHY) += dsi/phy/dsi_phy_28nm.o
+msm-display-$(CONFIG_DRM_MSM_DSI_20NM_PHY) += dsi/phy/dsi_phy_20nm.o
+msm-display-$(CONFIG_DRM_MSM_DSI_28NM_8960_PHY) += dsi/phy/dsi_phy_28nm_8960.o
+msm-display-$(CONFIG_DRM_MSM_DSI_14NM_PHY) += dsi/phy/dsi_phy_14nm.o
+msm-display-$(CONFIG_DRM_MSM_DSI_10NM_PHY) += dsi/phy/dsi_phy_10nm.o
+msm-display-$(CONFIG_DRM_MSM_DSI_7NM_PHY) += dsi/phy/dsi_phy_7nm.o
+
+msm-y += $(adreno-y) $(msm-display-y)
+
+obj-$(CONFIG_DRM_MSM)	+= msm.o
+
+ifeq (y,$(CONFIG_DRM_MSM_VALIDATE_XML))
+	headergen-opts += --validate
+else
+	headergen-opts += --no-validate
+endif
+
+quiet_cmd_headergen = GENHDR  $@
+      cmd_headergen = mkdir -p $(obj)/generated && $(PYTHON3) $(srctree)/$(src)/registers/gen_header.py \
+		      $(headergen-opts) --rnn $(srctree)/$(src)/registers --xml $< c-defines > $@
+
+$(obj)/generated/%.xml.h: $(src)/registers/adreno/%.xml \
+		$(src)/registers/adreno/adreno_common.xml \
+		$(src)/registers/adreno/adreno_pm4.xml \
+		$(src)/registers/freedreno_copyright.xml \
+		$(src)/registers/gen_header.py \
+		$(src)/registers/rules-fd.xsd \
+		FORCE
+	$(call if_changed,headergen)
+
+$(obj)/generated/%.xml.h: $(src)/registers/display/%.xml \
+		$(src)/registers/freedreno_copyright.xml \
+		$(src)/registers/gen_header.py \
+		$(src)/registers/rules-fd.xsd \
+		FORCE
+	$(call if_changed,headergen)
+
+ADRENO_HEADERS = \
+	generated/a2xx.xml.h \
+	generated/a3xx.xml.h \
+	generated/a4xx.xml.h \
+	generated/a5xx.xml.h \
+	generated/a6xx.xml.h \
+	generated/a6xx_gmu.xml.h \
+	generated/adreno_common.xml.h \
+	generated/adreno_pm4.xml.h \
+
+DISPLAY_HEADERS = \
+	generated/dsi_phy_7nm.xml.h \
+	generated/dsi_phy_10nm.xml.h \
+	generated/dsi_phy_14nm.xml.h \
+	generated/dsi_phy_20nm.xml.h \
+	generated/dsi_phy_28nm_8960.xml.h \
+	generated/dsi_phy_28nm.xml.h \
+	generated/dsi.xml.h \
+	generated/hdmi.xml.h \
+	generated/mdp4.xml.h \
+	generated/mdp5.xml.h \
+	generated/mdp_common.xml.h \
+	generated/mdss.xml.h \
+	generated/sfpb.xml.h
+
+$(addprefix $(obj)/,$(adreno-y)): $(addprefix $(obj)/,$(ADRENO_HEADERS))
+$(addprefix $(obj)/,$(msm-display-y)): $(addprefix $(obj)/,$(DISPLAY_HEADERS))
+
+targets += $(ADRENO_HEADERS) $(DISPLAY_HEADERS)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/NOTES
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/NOTES
@@ -0,0 +1,87 @@
+NOTES about msm drm/kms driver:
+
+In the current snapdragon SoC's, we have (at least) 3 different
+display controller blocks at play:
+ + MDP3 - ?? seems to be what is on geeksphone peak device
+ + MDP4 - S3 (APQ8060, touchpad), S4-pro (APQ8064, nexus4 & ifc6410)
+ + MDP5 - snapdragon 800
+
+(I don't have a completely clear picture on which display controller
+maps to which part #)
+
+Plus a handful of blocks around them for HDMI/DSI/etc output.
+
+And on gpu side of things:
+ + zero, one, or two 2d cores (z180)
+ + and either a2xx or a3xx 3d core.
+
+But, HDMI/DSI/etc blocks seem like they can be shared across multiple
+display controller blocks.  And I for sure don't want to have to deal
+with N different kms devices from xf86-video-freedreno.  Plus, it
+seems like we can do some clever tricks like use GPU to trigger
+pageflip after rendering completes (ie. have the kms/crtc code build
+up gpu cmdstream to update scanout and write FLUSH register after).
+
+So, the approach is one drm driver, with some modularity.  Different
+'struct msm_kms' implementations, depending on display controller.
+And one or more 'struct msm_gpu' for the various different gpu sub-
+modules.
+
+(Second part is not implemented yet.  So far this is just basic KMS
+driver, and not exposing any custom ioctls to userspace for now.)
+
+The kms module provides the plane, crtc, and encoder objects, and
+loads whatever connectors are appropriate.
+
+For MDP4, the mapping is:
+
+  plane   -> PIPE{RGBn,VGn}              \
+  crtc    -> OVLP{n} + DMA{P,S,E} (??)   |-> MDP "device"
+  encoder -> DTV/LCDC/DSI (within MDP4)  /
+  connector -> HDMI/DSI/etc              --> other device(s)
+
+Since the irq's that drm core mostly cares about are vblank/framedone,
+we'll let msm_mdp4_kms provide the irq install/uninstall/etc functions
+and treat the MDP4 block's irq as "the" irq.  Even though the connectors
+may have their own irqs which they install themselves.  For this reason
+the display controller is the "master" device.
+
+For MDP5, the mapping is:
+
+  plane   -> PIPE{RGBn,VIGn}             \
+  crtc    -> LM (layer mixer)            |-> MDP "device"
+  encoder -> INTF                        /
+  connector -> HDMI/DSI/eDP/etc          --> other device(s)
+
+Unlike MDP4, it appears we can get by with a single encoder, rather
+than needing a different implementation for DTV, DSI, etc.  (Ie. the
+register interface is same, just different bases.)
+
+Also unlike MDP4, with MDP5 all the IRQs for other blocks (HDMI, DSI,
+etc) are routed through MDP.
+
+And finally, MDP5 has this "Shared Memory Pool" (called "SMP"), from
+which blocks need to be allocated to the active pipes based on fetch
+stride.
+
+Each connector probably ends up being a separate device, just for the
+logistics of finding/mapping io region, irq, etc.  Idealy we would
+have a better way than just stashing the platform device in a global
+(ie. like DT super-node.. but I don't have any snapdragon hw yet that
+is using DT).
+
+Note that so far I've not been able to get any docs on the hw, and it
+seems that access to such docs would prevent me from working on the
+freedreno gallium driver.  So there may be some mistakes in register
+names (I had to invent a few, since no sufficient hint was given in
+the downstream android fbdev driver), bitfield sizes, etc.  My current
+state of understanding the registers is given in the envytools rnndb
+files at:
+
+  https://github.com/freedreno/envytools/tree/master/rnndb
+  (the mdp4/hdmi/dsi directories)
+
+These files are used both for a parser tool (in the same tree) to
+parse logged register reads/writes (both from downstream android fbdev
+driver, and this driver with register logging enabled), as well as to
+generate the register level headers.
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a2xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a2xx_catalog.c
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+
+static const struct adreno_info a2xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x02000000),
+		.family = ADRENO_2XX_GEN1,
+		.revn  = 200,
+		.fw = {
+			[ADRENO_FW_PM4] = "yamato_pm4.fw",
+			[ADRENO_FW_PFP] = "yamato_pfp.fw",
+		},
+		.gmem  = SZ_256K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a2xx_gpu_init,
+	}, { /* a200 on i.mx51 has only 128kib gmem */
+		.chip_ids = ADRENO_CHIP_IDS(0x02000001),
+		.family = ADRENO_2XX_GEN1,
+		.revn  = 201,
+		.fw = {
+			[ADRENO_FW_PM4] = "yamato_pm4.fw",
+			[ADRENO_FW_PFP] = "yamato_pfp.fw",
+		},
+		.gmem  = SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a2xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x02020000),
+		.family = ADRENO_2XX_GEN2,
+		.revn  = 220,
+		.fw = {
+			[ADRENO_FW_PM4] = "leia_pm4_470.fw",
+			[ADRENO_FW_PFP] = "leia_pfp_470.fw",
+		},
+		.gmem  = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a2xx_gpu_init,
+	}
+};
+DECLARE_ADRENO_GPULIST(a2xx);
+
+MODULE_FIRMWARE("qcom/leia_pfp_470.fw");
+MODULE_FIRMWARE("qcom/leia_pm4_470.fw");
+MODULE_FIRMWARE("qcom/yamato_pfp.fw");
+MODULE_FIRMWARE("qcom/yamato_pm4.fw");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a2xx_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a2xx_gpu.c
@@ -0,0 +1,569 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2018 The Linux Foundation. All rights reserved. */
+
+#include "a2xx_gpu.h"
+#include "msm_gem.h"
+#include "msm_mmu.h"
+
+extern bool hang_debug;
+
+static void a2xx_dump(struct msm_gpu *gpu);
+static bool a2xx_idle(struct msm_gpu *gpu);
+
+static void a2xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+{
+	struct msm_ringbuffer *ring = submit->ring;
+	unsigned int i;
+
+	for (i = 0; i < submit->nr_cmds; i++) {
+		switch (submit->cmd[i].type) {
+		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
+			/* ignore IB-targets */
+			break;
+		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
+			/* ignore if there has not been a ctx switch: */
+			if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)
+				break;
+			fallthrough;
+		case MSM_SUBMIT_CMD_BUF:
+			OUT_PKT3(ring, CP_INDIRECT_BUFFER_PFD, 2);
+			OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
+			OUT_RING(ring, submit->cmd[i].size);
+			OUT_PKT2(ring);
+			break;
+		}
+	}
+
+	OUT_PKT0(ring, REG_AXXX_CP_SCRATCH_REG2, 1);
+	OUT_RING(ring, submit->seqno);
+
+	/* wait for idle before cache flush/interrupt */
+	OUT_PKT3(ring, CP_WAIT_FOR_IDLE, 1);
+	OUT_RING(ring, 0x00000000);
+
+	OUT_PKT3(ring, CP_EVENT_WRITE, 3);
+	OUT_RING(ring, CACHE_FLUSH_TS);
+	OUT_RING(ring, rbmemptr(ring, fence));
+	OUT_RING(ring, submit->seqno);
+	OUT_PKT3(ring, CP_INTERRUPT, 1);
+	OUT_RING(ring, 0x80000000);
+
+	adreno_flush(gpu, ring, REG_AXXX_CP_RB_WPTR);
+}
+
+static bool a2xx_me_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a2xx_gpu *a2xx_gpu = to_a2xx_gpu(adreno_gpu);
+	struct msm_ringbuffer *ring = gpu->rb[0];
+
+	OUT_PKT3(ring, CP_ME_INIT, 18);
+
+	/* All fields present (bits 9:0) */
+	OUT_RING(ring, 0x000003ff);
+	/* Disable/Enable Real-Time Stream processing (present but ignored) */
+	OUT_RING(ring, 0x00000000);
+	/* Enable (2D <-> 3D) implicit synchronization (present but ignored) */
+	OUT_RING(ring, 0x00000000);
+
+	OUT_RING(ring, REG_A2XX_RB_SURFACE_INFO - 0x2000);
+	OUT_RING(ring, REG_A2XX_PA_SC_WINDOW_OFFSET - 0x2000);
+	OUT_RING(ring, REG_A2XX_VGT_MAX_VTX_INDX - 0x2000);
+	OUT_RING(ring, REG_A2XX_SQ_PROGRAM_CNTL - 0x2000);
+	OUT_RING(ring, REG_A2XX_RB_DEPTHCONTROL - 0x2000);
+	OUT_RING(ring, REG_A2XX_PA_SU_POINT_SIZE - 0x2000);
+	OUT_RING(ring, REG_A2XX_PA_SC_LINE_CNTL - 0x2000);
+	OUT_RING(ring, REG_A2XX_PA_SU_POLY_OFFSET_FRONT_SCALE - 0x2000);
+
+	/* Vertex and Pixel Shader Start Addresses in instructions
+	 * (3 DWORDS per instruction) */
+	OUT_RING(ring, 0x80000180);
+	/* Maximum Contexts */
+	OUT_RING(ring, 0x00000001);
+	/* Write Confirm Interval and The CP will wait the
+	 * wait_interval * 16 clocks between polling  */
+	OUT_RING(ring, 0x00000000);
+	/* NQ and External Memory Swap */
+	OUT_RING(ring, 0x00000000);
+	/* protected mode error checking (0x1f2 is REG_AXXX_CP_INT_CNTL) */
+	if (a2xx_gpu->protection_disabled)
+		OUT_RING(ring, 0x00000000);
+	else
+		OUT_RING(ring, 0x200001f2);
+	/* Disable header dumping and Header dump address */
+	OUT_RING(ring, 0x00000000);
+	/* Header dump size */
+	OUT_RING(ring, 0x00000000);
+
+	if (!a2xx_gpu->protection_disabled) {
+		/* enable protected mode */
+		OUT_PKT3(ring, CP_SET_PROTECTED_MODE, 1);
+		OUT_RING(ring, 1);
+	}
+
+	adreno_flush(gpu, ring, REG_AXXX_CP_RB_WPTR);
+	return a2xx_idle(gpu);
+}
+
+static int a2xx_hw_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a2xx_gpu *a2xx_gpu = to_a2xx_gpu(adreno_gpu);
+	dma_addr_t pt_base, tran_error;
+	uint32_t *ptr, len;
+	int i, ret;
+
+	a2xx_gpummu_params(gpu->aspace->mmu, &pt_base, &tran_error);
+
+	DBG("%s", gpu->name);
+
+	/* halt ME to avoid ucode upload issues on a20x */
+	gpu_write(gpu, REG_AXXX_CP_ME_CNTL, AXXX_CP_ME_CNTL_HALT);
+
+	gpu_write(gpu, REG_A2XX_RBBM_PM_OVERRIDE1, 0xfffffffe);
+	gpu_write(gpu, REG_A2XX_RBBM_PM_OVERRIDE2, 0xffffffff);
+
+	/* note: kgsl uses 0x00000001 after first reset on a22x */
+	gpu_write(gpu, REG_A2XX_RBBM_SOFT_RESET, 0xffffffff);
+	msleep(30);
+	gpu_write(gpu, REG_A2XX_RBBM_SOFT_RESET, 0x00000000);
+
+	if (adreno_is_a225(adreno_gpu))
+		gpu_write(gpu, REG_A2XX_SQ_FLOW_CONTROL, 0x18000000);
+
+	/* note: kgsl uses 0x0000ffff for a20x */
+	gpu_write(gpu, REG_A2XX_RBBM_CNTL, 0x00004442);
+
+	/* MPU: physical range */
+	gpu_write(gpu, REG_A2XX_MH_MMU_MPU_BASE, 0x00000000);
+	gpu_write(gpu, REG_A2XX_MH_MMU_MPU_END, 0xfffff000);
+
+	gpu_write(gpu, REG_A2XX_MH_MMU_CONFIG, A2XX_MH_MMU_CONFIG_MMU_ENABLE |
+		A2XX_MH_MMU_CONFIG_RB_W_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_CP_W_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_CP_R0_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_CP_R1_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_CP_R2_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_CP_R3_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_CP_R4_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_VGT_R0_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_VGT_R1_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_TC_R_CLNT_BEHAVIOR(BEH_TRAN_RNG) |
+		A2XX_MH_MMU_CONFIG_PA_W_CLNT_BEHAVIOR(BEH_TRAN_RNG));
+
+	/* same as parameters in adreno_gpu */
+	gpu_write(gpu, REG_A2XX_MH_MMU_VA_RANGE, SZ_16M |
+		A2XX_MH_MMU_VA_RANGE_NUM_64KB_REGIONS(0xfff));
+
+	gpu_write(gpu, REG_A2XX_MH_MMU_PT_BASE, pt_base);
+	gpu_write(gpu, REG_A2XX_MH_MMU_TRAN_ERROR, tran_error);
+
+	gpu_write(gpu, REG_A2XX_MH_MMU_INVALIDATE,
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_ALL |
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_TC);
+
+	gpu_write(gpu, REG_A2XX_MH_ARBITER_CONFIG,
+		A2XX_MH_ARBITER_CONFIG_SAME_PAGE_LIMIT(16) |
+		A2XX_MH_ARBITER_CONFIG_L1_ARB_ENABLE |
+		A2XX_MH_ARBITER_CONFIG_L1_ARB_HOLD_ENABLE |
+		A2XX_MH_ARBITER_CONFIG_PAGE_SIZE(1) |
+		A2XX_MH_ARBITER_CONFIG_TC_REORDER_ENABLE |
+		A2XX_MH_ARBITER_CONFIG_TC_ARB_HOLD_ENABLE |
+		A2XX_MH_ARBITER_CONFIG_IN_FLIGHT_LIMIT_ENABLE |
+		A2XX_MH_ARBITER_CONFIG_IN_FLIGHT_LIMIT(8) |
+		A2XX_MH_ARBITER_CONFIG_CP_CLNT_ENABLE |
+		A2XX_MH_ARBITER_CONFIG_VGT_CLNT_ENABLE |
+		A2XX_MH_ARBITER_CONFIG_TC_CLNT_ENABLE |
+		A2XX_MH_ARBITER_CONFIG_RB_CLNT_ENABLE |
+		A2XX_MH_ARBITER_CONFIG_PA_CLNT_ENABLE);
+	if (!adreno_is_a20x(adreno_gpu))
+		gpu_write(gpu, REG_A2XX_MH_CLNT_INTF_CTRL_CONFIG1, 0x00032f07);
+
+	gpu_write(gpu, REG_A2XX_SQ_VS_PROGRAM, 0x00000000);
+	gpu_write(gpu, REG_A2XX_SQ_PS_PROGRAM, 0x00000000);
+
+	gpu_write(gpu, REG_A2XX_RBBM_PM_OVERRIDE1, 0); /* 0x200 for msm8960? */
+	gpu_write(gpu, REG_A2XX_RBBM_PM_OVERRIDE2, 0); /* 0x80/0x1a0 for a22x? */
+
+	/* note: gsl doesn't set this */
+	gpu_write(gpu, REG_A2XX_RBBM_DEBUG, 0x00080000);
+
+	gpu_write(gpu, REG_A2XX_RBBM_INT_CNTL,
+		A2XX_RBBM_INT_CNTL_RDERR_INT_MASK);
+	gpu_write(gpu, REG_AXXX_CP_INT_CNTL,
+		AXXX_CP_INT_CNTL_T0_PACKET_IN_IB_MASK |
+		AXXX_CP_INT_CNTL_OPCODE_ERROR_MASK |
+		AXXX_CP_INT_CNTL_PROTECTED_MODE_ERROR_MASK |
+		AXXX_CP_INT_CNTL_RESERVED_BIT_ERROR_MASK |
+		AXXX_CP_INT_CNTL_IB_ERROR_MASK |
+		AXXX_CP_INT_CNTL_IB1_INT_MASK |
+		AXXX_CP_INT_CNTL_RB_INT_MASK);
+	gpu_write(gpu, REG_A2XX_SQ_INT_CNTL, 0);
+	gpu_write(gpu, REG_A2XX_MH_INTERRUPT_MASK,
+		A2XX_MH_INTERRUPT_MASK_AXI_READ_ERROR |
+		A2XX_MH_INTERRUPT_MASK_AXI_WRITE_ERROR |
+		A2XX_MH_INTERRUPT_MASK_MMU_PAGE_FAULT);
+
+	for (i = 3; i <= 5; i++)
+		if ((SZ_16K << i) == adreno_gpu->info->gmem)
+			break;
+	gpu_write(gpu, REG_A2XX_RB_EDRAM_INFO, i);
+
+	ret = adreno_hw_init(gpu);
+	if (ret)
+		return ret;
+
+	gpu_write(gpu, REG_AXXX_CP_RB_CNTL,
+		MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
+
+	gpu_write(gpu, REG_AXXX_CP_RB_BASE, lower_32_bits(gpu->rb[0]->iova));
+
+	/* NOTE: PM4/micro-engine firmware registers look to be the same
+	 * for a2xx and a3xx.. we could possibly push that part down to
+	 * adreno_gpu base class.  Or push both PM4 and PFP but
+	 * parameterize the pfp ucode addr/data registers..
+	 */
+
+	/* Load PM4: */
+	ptr = (uint32_t *)(adreno_gpu->fw[ADRENO_FW_PM4]->data);
+	len = adreno_gpu->fw[ADRENO_FW_PM4]->size / 4;
+	DBG("loading PM4 ucode version: %x", ptr[1]);
+
+	/*
+	 * New firmware files seem to have GPU and firmware version in this
+	 * word (0x20xxxx for A200, 0x220xxx for A220, 0x225xxx for A225).
+	 * Older firmware files, which lack protection support, have 0 instead.
+	 */
+	if (ptr[1] == 0) {
+		dev_warn(gpu->dev->dev,
+			 "Legacy firmware detected, disabling protection support\n");
+		a2xx_gpu->protection_disabled = true;
+	}
+
+	gpu_write(gpu, REG_AXXX_CP_DEBUG,
+			AXXX_CP_DEBUG_MIU_128BIT_WRITE_ENABLE);
+	gpu_write(gpu, REG_AXXX_CP_ME_RAM_WADDR, 0);
+	for (i = 1; i < len; i++)
+		gpu_write(gpu, REG_AXXX_CP_ME_RAM_DATA, ptr[i]);
+
+	/* Load PFP: */
+	ptr = (uint32_t *)(adreno_gpu->fw[ADRENO_FW_PFP]->data);
+	len = adreno_gpu->fw[ADRENO_FW_PFP]->size / 4;
+	DBG("loading PFP ucode version: %x", ptr[5]);
+
+	gpu_write(gpu, REG_A2XX_CP_PFP_UCODE_ADDR, 0);
+	for (i = 1; i < len; i++)
+		gpu_write(gpu, REG_A2XX_CP_PFP_UCODE_DATA, ptr[i]);
+
+	gpu_write(gpu, REG_AXXX_CP_QUEUE_THRESHOLDS, 0x000C0804);
+
+	/* clear ME_HALT to start micro engine */
+	gpu_write(gpu, REG_AXXX_CP_ME_CNTL, 0);
+
+	return a2xx_me_init(gpu) ? 0 : -EINVAL;
+}
+
+static void a2xx_recover(struct msm_gpu *gpu)
+{
+	int i;
+
+	adreno_dump_info(gpu);
+
+	for (i = 0; i < 8; i++) {
+		printk("CP_SCRATCH_REG%d: %u\n", i,
+			gpu_read(gpu, REG_AXXX_CP_SCRATCH_REG0 + i));
+	}
+
+	/* dump registers before resetting gpu, if enabled: */
+	if (hang_debug)
+		a2xx_dump(gpu);
+
+	gpu_write(gpu, REG_A2XX_RBBM_SOFT_RESET, 1);
+	gpu_read(gpu, REG_A2XX_RBBM_SOFT_RESET);
+	gpu_write(gpu, REG_A2XX_RBBM_SOFT_RESET, 0);
+	adreno_recover(gpu);
+}
+
+static void a2xx_destroy(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a2xx_gpu *a2xx_gpu = to_a2xx_gpu(adreno_gpu);
+
+	DBG("%s", gpu->name);
+
+	adreno_gpu_cleanup(adreno_gpu);
+
+	kfree(a2xx_gpu);
+}
+
+static bool a2xx_idle(struct msm_gpu *gpu)
+{
+	/* wait for ringbuffer to drain: */
+	if (!adreno_idle(gpu, gpu->rb[0]))
+		return false;
+
+	/* then wait for GPU to finish: */
+	if (spin_until(!(gpu_read(gpu, REG_A2XX_RBBM_STATUS) &
+			A2XX_RBBM_STATUS_GUI_ACTIVE))) {
+		DRM_ERROR("%s: timeout waiting for GPU to idle!\n", gpu->name);
+
+		/* TODO maybe we need to reset GPU here to recover from hang? */
+		return false;
+	}
+
+	return true;
+}
+
+static irqreturn_t a2xx_irq(struct msm_gpu *gpu)
+{
+	uint32_t mstatus, status;
+
+	mstatus = gpu_read(gpu, REG_A2XX_MASTER_INT_SIGNAL);
+
+	if (mstatus & A2XX_MASTER_INT_SIGNAL_MH_INT_STAT) {
+		status = gpu_read(gpu, REG_A2XX_MH_INTERRUPT_STATUS);
+
+		dev_warn(gpu->dev->dev, "MH_INT: %08X\n", status);
+		dev_warn(gpu->dev->dev, "MMU_PAGE_FAULT: %08X\n",
+			gpu_read(gpu, REG_A2XX_MH_MMU_PAGE_FAULT));
+
+		gpu_write(gpu, REG_A2XX_MH_INTERRUPT_CLEAR, status);
+	}
+
+	if (mstatus & A2XX_MASTER_INT_SIGNAL_CP_INT_STAT) {
+		status = gpu_read(gpu, REG_AXXX_CP_INT_STATUS);
+
+		/* only RB_INT is expected */
+		if (status & ~AXXX_CP_INT_CNTL_RB_INT_MASK)
+			dev_warn(gpu->dev->dev, "CP_INT: %08X\n", status);
+
+		gpu_write(gpu, REG_AXXX_CP_INT_ACK, status);
+	}
+
+	if (mstatus & A2XX_MASTER_INT_SIGNAL_RBBM_INT_STAT) {
+		status = gpu_read(gpu, REG_A2XX_RBBM_INT_STATUS);
+
+		dev_warn(gpu->dev->dev, "RBBM_INT: %08X\n", status);
+
+		gpu_write(gpu, REG_A2XX_RBBM_INT_ACK, status);
+	}
+
+	msm_gpu_retire(gpu);
+
+	return IRQ_HANDLED;
+}
+
+static const unsigned int a200_registers[] = {
+	0x0000, 0x0002, 0x0004, 0x000B, 0x003B, 0x003D, 0x0040, 0x0044,
+	0x0046, 0x0047, 0x01C0, 0x01C1, 0x01C3, 0x01C8, 0x01D5, 0x01D9,
+	0x01DC, 0x01DD, 0x01EA, 0x01EA, 0x01EE, 0x01F3, 0x01F6, 0x01F7,
+	0x01FC, 0x01FF, 0x0391, 0x0392, 0x039B, 0x039E, 0x03B2, 0x03B5,
+	0x03B7, 0x03B7, 0x03F8, 0x03FB, 0x0440, 0x0440, 0x0443, 0x0444,
+	0x044B, 0x044B, 0x044D, 0x044F, 0x0452, 0x0452, 0x0454, 0x045B,
+	0x047F, 0x047F, 0x0578, 0x0587, 0x05C9, 0x05C9, 0x05D0, 0x05D0,
+	0x0601, 0x0604, 0x0606, 0x0609, 0x060B, 0x060E, 0x0613, 0x0614,
+	0x0A29, 0x0A2B, 0x0A2F, 0x0A31, 0x0A40, 0x0A43, 0x0A45, 0x0A45,
+	0x0A4E, 0x0A4F, 0x0C2C, 0x0C2C, 0x0C30, 0x0C30, 0x0C38, 0x0C3C,
+	0x0C40, 0x0C40, 0x0C44, 0x0C44, 0x0C80, 0x0C86, 0x0C88, 0x0C94,
+	0x0C99, 0x0C9A, 0x0CA4, 0x0CA5, 0x0D00, 0x0D03, 0x0D06, 0x0D06,
+	0x0D08, 0x0D0B, 0x0D34, 0x0D35, 0x0DAE, 0x0DC1, 0x0DC8, 0x0DD4,
+	0x0DD8, 0x0DD9, 0x0E00, 0x0E00, 0x0E02, 0x0E04, 0x0E17, 0x0E1E,
+	0x0EC0, 0x0EC9, 0x0ECB, 0x0ECC, 0x0ED0, 0x0ED0, 0x0ED4, 0x0ED7,
+	0x0EE0, 0x0EE2, 0x0F01, 0x0F02, 0x0F0C, 0x0F0C, 0x0F0E, 0x0F12,
+	0x0F26, 0x0F2A, 0x0F2C, 0x0F2C, 0x2000, 0x2002, 0x2006, 0x200F,
+	0x2080, 0x2082, 0x2100, 0x2109, 0x210C, 0x2114, 0x2180, 0x2184,
+	0x21F5, 0x21F7, 0x2200, 0x2208, 0x2280, 0x2283, 0x2293, 0x2294,
+	0x2300, 0x2308, 0x2312, 0x2312, 0x2316, 0x231D, 0x2324, 0x2326,
+	0x2380, 0x2383, 0x2400, 0x2402, 0x2406, 0x240F, 0x2480, 0x2482,
+	0x2500, 0x2509, 0x250C, 0x2514, 0x2580, 0x2584, 0x25F5, 0x25F7,
+	0x2600, 0x2608, 0x2680, 0x2683, 0x2693, 0x2694, 0x2700, 0x2708,
+	0x2712, 0x2712, 0x2716, 0x271D, 0x2724, 0x2726, 0x2780, 0x2783,
+	0x4000, 0x4003, 0x4800, 0x4805, 0x4900, 0x4900, 0x4908, 0x4908,
+	~0   /* sentinel */
+};
+
+static const unsigned int a220_registers[] = {
+	0x0000, 0x0002, 0x0004, 0x000B, 0x003B, 0x003D, 0x0040, 0x0044,
+	0x0046, 0x0047, 0x01C0, 0x01C1, 0x01C3, 0x01C8, 0x01D5, 0x01D9,
+	0x01DC, 0x01DD, 0x01EA, 0x01EA, 0x01EE, 0x01F3, 0x01F6, 0x01F7,
+	0x01FC, 0x01FF, 0x0391, 0x0392, 0x039B, 0x039E, 0x03B2, 0x03B5,
+	0x03B7, 0x03B7, 0x03F8, 0x03FB, 0x0440, 0x0440, 0x0443, 0x0444,
+	0x044B, 0x044B, 0x044D, 0x044F, 0x0452, 0x0452, 0x0454, 0x045B,
+	0x047F, 0x047F, 0x0578, 0x0587, 0x05C9, 0x05C9, 0x05D0, 0x05D0,
+	0x0601, 0x0604, 0x0606, 0x0609, 0x060B, 0x060E, 0x0613, 0x0614,
+	0x0A29, 0x0A2B, 0x0A2F, 0x0A31, 0x0A40, 0x0A40, 0x0A42, 0x0A43,
+	0x0A45, 0x0A45, 0x0A4E, 0x0A4F, 0x0C30, 0x0C30, 0x0C38, 0x0C39,
+	0x0C3C, 0x0C3C, 0x0C80, 0x0C81, 0x0C88, 0x0C93, 0x0D00, 0x0D03,
+	0x0D05, 0x0D06, 0x0D08, 0x0D0B, 0x0D34, 0x0D35, 0x0DAE, 0x0DC1,
+	0x0DC8, 0x0DD4, 0x0DD8, 0x0DD9, 0x0E00, 0x0E00, 0x0E02, 0x0E04,
+	0x0E17, 0x0E1E, 0x0EC0, 0x0EC9, 0x0ECB, 0x0ECC, 0x0ED0, 0x0ED0,
+	0x0ED4, 0x0ED7, 0x0EE0, 0x0EE2, 0x0F01, 0x0F02, 0x2000, 0x2002,
+	0x2006, 0x200F, 0x2080, 0x2082, 0x2100, 0x2102, 0x2104, 0x2109,
+	0x210C, 0x2114, 0x2180, 0x2184, 0x21F5, 0x21F7, 0x2200, 0x2202,
+	0x2204, 0x2204, 0x2208, 0x2208, 0x2280, 0x2282, 0x2294, 0x2294,
+	0x2300, 0x2308, 0x2309, 0x230A, 0x2312, 0x2312, 0x2316, 0x2316,
+	0x2318, 0x231D, 0x2324, 0x2326, 0x2380, 0x2383, 0x2400, 0x2402,
+	0x2406, 0x240F, 0x2480, 0x2482, 0x2500, 0x2502, 0x2504, 0x2509,
+	0x250C, 0x2514, 0x2580, 0x2584, 0x25F5, 0x25F7, 0x2600, 0x2602,
+	0x2604, 0x2606, 0x2608, 0x2608, 0x2680, 0x2682, 0x2694, 0x2694,
+	0x2700, 0x2708, 0x2712, 0x2712, 0x2716, 0x2716, 0x2718, 0x271D,
+	0x2724, 0x2726, 0x2780, 0x2783, 0x4000, 0x4003, 0x4800, 0x4805,
+	0x4900, 0x4900, 0x4908, 0x4908,
+	~0   /* sentinel */
+};
+
+static const unsigned int a225_registers[] = {
+	0x0000, 0x0002, 0x0004, 0x000B, 0x003B, 0x003D, 0x0040, 0x0044,
+	0x0046, 0x0047, 0x013C, 0x013C, 0x0140, 0x014F, 0x01C0, 0x01C1,
+	0x01C3, 0x01C8, 0x01D5, 0x01D9, 0x01DC, 0x01DD, 0x01EA, 0x01EA,
+	0x01EE, 0x01F3, 0x01F6, 0x01F7, 0x01FC, 0x01FF, 0x0391, 0x0392,
+	0x039B, 0x039E, 0x03B2, 0x03B5, 0x03B7, 0x03B7, 0x03F8, 0x03FB,
+	0x0440, 0x0440, 0x0443, 0x0444, 0x044B, 0x044B, 0x044D, 0x044F,
+	0x0452, 0x0452, 0x0454, 0x045B, 0x047F, 0x047F, 0x0578, 0x0587,
+	0x05C9, 0x05C9, 0x05D0, 0x05D0, 0x0601, 0x0604, 0x0606, 0x0609,
+	0x060B, 0x060E, 0x0613, 0x0614, 0x0A29, 0x0A2B, 0x0A2F, 0x0A31,
+	0x0A40, 0x0A40, 0x0A42, 0x0A43, 0x0A45, 0x0A45, 0x0A4E, 0x0A4F,
+	0x0C01, 0x0C1D, 0x0C30, 0x0C30, 0x0C38, 0x0C39, 0x0C3C, 0x0C3C,
+	0x0C80, 0x0C81, 0x0C88, 0x0C93, 0x0D00, 0x0D03, 0x0D05, 0x0D06,
+	0x0D08, 0x0D0B, 0x0D34, 0x0D35, 0x0DAE, 0x0DC1, 0x0DC8, 0x0DD4,
+	0x0DD8, 0x0DD9, 0x0E00, 0x0E00, 0x0E02, 0x0E04, 0x0E17, 0x0E1E,
+	0x0EC0, 0x0EC9, 0x0ECB, 0x0ECC, 0x0ED0, 0x0ED0, 0x0ED4, 0x0ED7,
+	0x0EE0, 0x0EE2, 0x0F01, 0x0F02, 0x2000, 0x200F, 0x2080, 0x2082,
+	0x2100, 0x2109, 0x210C, 0x2114, 0x2180, 0x2184, 0x21F5, 0x21F7,
+	0x2200, 0x2202, 0x2204, 0x2206, 0x2208, 0x2210, 0x2220, 0x2222,
+	0x2280, 0x2282, 0x2294, 0x2294, 0x2297, 0x2297, 0x2300, 0x230A,
+	0x2312, 0x2312, 0x2315, 0x2316, 0x2318, 0x231D, 0x2324, 0x2326,
+	0x2340, 0x2357, 0x2360, 0x2360, 0x2380, 0x2383, 0x2400, 0x240F,
+	0x2480, 0x2482, 0x2500, 0x2509, 0x250C, 0x2514, 0x2580, 0x2584,
+	0x25F5, 0x25F7, 0x2600, 0x2602, 0x2604, 0x2606, 0x2608, 0x2610,
+	0x2620, 0x2622, 0x2680, 0x2682, 0x2694, 0x2694, 0x2697, 0x2697,
+	0x2700, 0x270A, 0x2712, 0x2712, 0x2715, 0x2716, 0x2718, 0x271D,
+	0x2724, 0x2726, 0x2740, 0x2757, 0x2760, 0x2760, 0x2780, 0x2783,
+	0x4000, 0x4003, 0x4800, 0x4806, 0x4808, 0x4808, 0x4900, 0x4900,
+	0x4908, 0x4908,
+	~0   /* sentinel */
+};
+
+/* would be nice to not have to duplicate the _show() stuff with printk(): */
+static void a2xx_dump(struct msm_gpu *gpu)
+{
+	printk("status:   %08x\n",
+			gpu_read(gpu, REG_A2XX_RBBM_STATUS));
+	adreno_dump(gpu);
+}
+
+static struct msm_gpu_state *a2xx_gpu_state_get(struct msm_gpu *gpu)
+{
+	struct msm_gpu_state *state = kzalloc(sizeof(*state), GFP_KERNEL);
+
+	if (!state)
+		return ERR_PTR(-ENOMEM);
+
+	adreno_gpu_state_get(gpu, state);
+
+	state->rbbm_status = gpu_read(gpu, REG_A2XX_RBBM_STATUS);
+
+	return state;
+}
+
+static struct msm_gem_address_space *
+a2xx_create_address_space(struct msm_gpu *gpu, struct platform_device *pdev)
+{
+	struct msm_mmu *mmu = a2xx_gpummu_new(&pdev->dev, gpu);
+	struct msm_gem_address_space *aspace;
+
+	aspace = msm_gem_address_space_create(mmu, "gpu", SZ_16M,
+		0xfff * SZ_64K);
+
+	if (IS_ERR(aspace) && !IS_ERR(mmu))
+		mmu->funcs->destroy(mmu);
+
+	return aspace;
+}
+
+static u32 a2xx_get_rptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	ring->memptrs->rptr = gpu_read(gpu, REG_AXXX_CP_RB_RPTR);
+	return ring->memptrs->rptr;
+}
+
+static const struct adreno_gpu_funcs funcs = {
+	.base = {
+		.get_param = adreno_get_param,
+		.set_param = adreno_set_param,
+		.hw_init = a2xx_hw_init,
+		.pm_suspend = msm_gpu_pm_suspend,
+		.pm_resume = msm_gpu_pm_resume,
+		.recover = a2xx_recover,
+		.submit = a2xx_submit,
+		.active_ring = adreno_active_ring,
+		.irq = a2xx_irq,
+		.destroy = a2xx_destroy,
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
+		.show = adreno_show,
+#endif
+		.gpu_state_get = a2xx_gpu_state_get,
+		.gpu_state_put = adreno_gpu_state_put,
+		.create_address_space = a2xx_create_address_space,
+		.get_rptr = a2xx_get_rptr,
+	},
+};
+
+static const struct msm_gpu_perfcntr perfcntrs[] = {
+/* TODO */
+};
+
+struct msm_gpu *a2xx_gpu_init(struct drm_device *dev)
+{
+	struct a2xx_gpu *a2xx_gpu = NULL;
+	struct adreno_gpu *adreno_gpu;
+	struct msm_gpu *gpu;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct platform_device *pdev = priv->gpu_pdev;
+	int ret;
+
+	if (!pdev) {
+		dev_err(dev->dev, "no a2xx device\n");
+		ret = -ENXIO;
+		goto fail;
+	}
+
+	a2xx_gpu = kzalloc(sizeof(*a2xx_gpu), GFP_KERNEL);
+	if (!a2xx_gpu) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	adreno_gpu = &a2xx_gpu->base;
+	gpu = &adreno_gpu->base;
+
+	gpu->perfcntrs = perfcntrs;
+	gpu->num_perfcntrs = ARRAY_SIZE(perfcntrs);
+
+	ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
+	if (ret)
+		goto fail;
+
+	if (adreno_is_a20x(adreno_gpu))
+		adreno_gpu->registers = a200_registers;
+	else if (adreno_is_a225(adreno_gpu))
+		adreno_gpu->registers = a225_registers;
+	else
+		adreno_gpu->registers = a220_registers;
+
+	if (!gpu->aspace) {
+		dev_err(dev->dev, "No memory protection without MMU\n");
+		if (!allow_vram_carveout) {
+			ret = -ENXIO;
+			goto fail;
+		}
+	}
+
+	return gpu;
+
+fail:
+	if (a2xx_gpu)
+		a2xx_destroy(&a2xx_gpu->base.base);
+
+	return ERR_PTR(ret);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a2xx_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a2xx_gpu.h
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2018 The Linux Foundation. All rights reserved. */
+
+#ifndef __A2XX_GPU_H__
+#define __A2XX_GPU_H__
+
+#include "adreno_gpu.h"
+
+/* arrg, somehow fb.h is getting pulled in: */
+#undef ROP_COPY
+#undef ROP_XOR
+
+#include "a2xx.xml.h"
+
+struct a2xx_gpu {
+	struct adreno_gpu base;
+	bool pm_enabled;
+	bool protection_disabled;
+};
+#define to_a2xx_gpu(x) container_of(x, struct a2xx_gpu, base)
+
+struct msm_mmu *a2xx_gpummu_new(struct device *dev, struct msm_gpu *gpu);
+void a2xx_gpummu_params(struct msm_mmu *mmu, dma_addr_t *pt_base,
+		dma_addr_t *tran_error);
+
+#endif /* __A2XX_GPU_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a2xx_gpummu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a2xx_gpummu.c
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2018 The Linux Foundation. All rights reserved. */
+
+#include <linux/dma-mapping.h>
+
+#include "msm_drv.h"
+#include "msm_mmu.h"
+
+#include "adreno_gpu.h"
+#include "a2xx_gpu.h"
+
+#include "a2xx.xml.h"
+
+struct a2xx_gpummu {
+	struct msm_mmu base;
+	struct msm_gpu *gpu;
+	dma_addr_t pt_base;
+	uint32_t *table;
+};
+#define to_a2xx_gpummu(x) container_of(x, struct a2xx_gpummu, base)
+
+#define GPUMMU_VA_START SZ_16M
+#define GPUMMU_VA_RANGE (0xfff * SZ_64K)
+#define GPUMMU_PAGE_SIZE SZ_4K
+#define TABLE_SIZE (sizeof(uint32_t) * GPUMMU_VA_RANGE / GPUMMU_PAGE_SIZE)
+
+static void a2xx_gpummu_detach(struct msm_mmu *mmu)
+{
+}
+
+static int a2xx_gpummu_map(struct msm_mmu *mmu, uint64_t iova,
+		struct sg_table *sgt, size_t len, int prot)
+{
+	struct a2xx_gpummu *gpummu = to_a2xx_gpummu(mmu);
+	unsigned idx = (iova - GPUMMU_VA_START) / GPUMMU_PAGE_SIZE;
+	struct sg_dma_page_iter dma_iter;
+	unsigned prot_bits = 0;
+
+	if (prot & IOMMU_WRITE)
+		prot_bits |= 1;
+	if (prot & IOMMU_READ)
+		prot_bits |= 2;
+
+	for_each_sgtable_dma_page(sgt, &dma_iter, 0) {
+		dma_addr_t addr = sg_page_iter_dma_address(&dma_iter);
+		int i;
+
+		for (i = 0; i < PAGE_SIZE; i += GPUMMU_PAGE_SIZE)
+			gpummu->table[idx++] = (addr + i) | prot_bits;
+	}
+
+	/* we can improve by deferring flush for multiple map() */
+	gpu_write(gpummu->gpu, REG_A2XX_MH_MMU_INVALIDATE,
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_ALL |
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_TC);
+	return 0;
+}
+
+static int a2xx_gpummu_unmap(struct msm_mmu *mmu, uint64_t iova, size_t len)
+{
+	struct a2xx_gpummu *gpummu = to_a2xx_gpummu(mmu);
+	unsigned idx = (iova - GPUMMU_VA_START) / GPUMMU_PAGE_SIZE;
+	unsigned i;
+
+	for (i = 0; i < len / GPUMMU_PAGE_SIZE; i++, idx++)
+                gpummu->table[idx] = 0;
+
+	gpu_write(gpummu->gpu, REG_A2XX_MH_MMU_INVALIDATE,
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_ALL |
+		A2XX_MH_MMU_INVALIDATE_INVALIDATE_TC);
+	return 0;
+}
+
+static void a2xx_gpummu_resume_translation(struct msm_mmu *mmu)
+{
+}
+
+static void a2xx_gpummu_destroy(struct msm_mmu *mmu)
+{
+	struct a2xx_gpummu *gpummu = to_a2xx_gpummu(mmu);
+
+	dma_free_attrs(mmu->dev, TABLE_SIZE, gpummu->table, gpummu->pt_base,
+		DMA_ATTR_FORCE_CONTIGUOUS);
+
+	kfree(gpummu);
+}
+
+static const struct msm_mmu_funcs funcs = {
+		.detach = a2xx_gpummu_detach,
+		.map = a2xx_gpummu_map,
+		.unmap = a2xx_gpummu_unmap,
+		.destroy = a2xx_gpummu_destroy,
+		.resume_translation = a2xx_gpummu_resume_translation,
+};
+
+struct msm_mmu *a2xx_gpummu_new(struct device *dev, struct msm_gpu *gpu)
+{
+	struct a2xx_gpummu *gpummu;
+
+	gpummu = kzalloc(sizeof(*gpummu), GFP_KERNEL);
+	if (!gpummu)
+		return ERR_PTR(-ENOMEM);
+
+	gpummu->table = dma_alloc_attrs(dev, TABLE_SIZE + 32, &gpummu->pt_base,
+		GFP_KERNEL | __GFP_ZERO, DMA_ATTR_FORCE_CONTIGUOUS);
+	if (!gpummu->table) {
+		kfree(gpummu);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	gpummu->gpu = gpu;
+	msm_mmu_init(&gpummu->base, dev, &funcs, MSM_MMU_GPUMMU);
+
+	return &gpummu->base;
+}
+
+void a2xx_gpummu_params(struct msm_mmu *mmu, dma_addr_t *pt_base,
+		dma_addr_t *tran_error)
+{
+	dma_addr_t base = to_a2xx_gpummu(mmu)->pt_base;
+
+	*pt_base = base;
+	*tran_error = base + TABLE_SIZE; /* 32-byte aligned */
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a3xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a3xx_catalog.c
@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+
+static const struct adreno_info a3xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x03000512),
+		.family = ADRENO_3XX,
+		.fw = {
+			[ADRENO_FW_PM4] = "a330_pm4.fw",
+			[ADRENO_FW_PFP] = "a330_pfp.fw",
+		},
+		.gmem  = SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x03000520),
+		.family = ADRENO_3XX,
+		.revn  = 305,
+		.fw = {
+			[ADRENO_FW_PM4] = "a300_pm4.fw",
+			[ADRENO_FW_PFP] = "a300_pfp.fw",
+		},
+		.gmem  = SZ_256K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x03000600),
+		.family = ADRENO_3XX,
+		.revn  = 307,        /* because a305c is revn==306 */
+		.fw = {
+			[ADRENO_FW_PM4] = "a300_pm4.fw",
+			[ADRENO_FW_PFP] = "a300_pfp.fw",
+		},
+		.gmem  = SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(
+			0x03020000,
+			0x03020001,
+			0x03020002
+		),
+		.family = ADRENO_3XX,
+		.revn  = 320,
+		.fw = {
+			[ADRENO_FW_PM4] = "a300_pm4.fw",
+			[ADRENO_FW_PFP] = "a300_pfp.fw",
+		},
+		.gmem  = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(
+			0x03030000,
+			0x03030001,
+			0x03030002
+		),
+		.family = ADRENO_3XX,
+		.revn  = 330,
+		.fw = {
+			[ADRENO_FW_PM4] = "a330_pm4.fw",
+			[ADRENO_FW_PFP] = "a330_pfp.fw",
+		},
+		.gmem  = SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a3xx_gpu_init,
+	}
+};
+DECLARE_ADRENO_GPULIST(a3xx);
+
+MODULE_FIRMWARE("qcom/a300_pm4.fw");
+MODULE_FIRMWARE("qcom/a300_pfp.fw");
+MODULE_FIRMWARE("qcom/a330_pm4.fw");
+MODULE_FIRMWARE("qcom/a330_pfp.fw");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a3xx_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a3xx_gpu.c
@@ -0,0 +1,622 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ */
+
+#include "a3xx_gpu.h"
+
+#define A3XX_INT0_MASK \
+	(A3XX_INT0_RBBM_AHB_ERROR |        \
+	 A3XX_INT0_RBBM_ATB_BUS_OVERFLOW | \
+	 A3XX_INT0_CP_T0_PACKET_IN_IB |    \
+	 A3XX_INT0_CP_OPCODE_ERROR |       \
+	 A3XX_INT0_CP_RESERVED_BIT_ERROR | \
+	 A3XX_INT0_CP_HW_FAULT |           \
+	 A3XX_INT0_CP_IB1_INT |            \
+	 A3XX_INT0_CP_IB2_INT |            \
+	 A3XX_INT0_CP_RB_INT |             \
+	 A3XX_INT0_CP_REG_PROTECT_FAULT |  \
+	 A3XX_INT0_CP_AHB_ERROR_HALT |     \
+	 A3XX_INT0_CACHE_FLUSH_TS |        \
+	 A3XX_INT0_UCHE_OOB_ACCESS)
+
+extern bool hang_debug;
+
+static void a3xx_dump(struct msm_gpu *gpu);
+static bool a3xx_idle(struct msm_gpu *gpu);
+
+static void a3xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+{
+	struct msm_ringbuffer *ring = submit->ring;
+	unsigned int i;
+
+	for (i = 0; i < submit->nr_cmds; i++) {
+		switch (submit->cmd[i].type) {
+		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
+			/* ignore IB-targets */
+			break;
+		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
+			/* ignore if there has not been a ctx switch: */
+			if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)
+				break;
+			fallthrough;
+		case MSM_SUBMIT_CMD_BUF:
+			OUT_PKT3(ring, CP_INDIRECT_BUFFER_PFD, 2);
+			OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
+			OUT_RING(ring, submit->cmd[i].size);
+			OUT_PKT2(ring);
+			break;
+		}
+	}
+
+	OUT_PKT0(ring, REG_AXXX_CP_SCRATCH_REG2, 1);
+	OUT_RING(ring, submit->seqno);
+
+	/* Flush HLSQ lazy updates to make sure there is nothing
+	 * pending for indirect loads after the timestamp has
+	 * passed:
+	 */
+	OUT_PKT3(ring, CP_EVENT_WRITE, 1);
+	OUT_RING(ring, HLSQ_FLUSH);
+
+	/* wait for idle before cache flush/interrupt */
+	OUT_PKT3(ring, CP_WAIT_FOR_IDLE, 1);
+	OUT_RING(ring, 0x00000000);
+
+	/* BIT(31) of CACHE_FLUSH_TS triggers CACHE_FLUSH_TS IRQ from GPU */
+	OUT_PKT3(ring, CP_EVENT_WRITE, 3);
+	OUT_RING(ring, CACHE_FLUSH_TS | CP_EVENT_WRITE_0_IRQ);
+	OUT_RING(ring, rbmemptr(ring, fence));
+	OUT_RING(ring, submit->seqno);
+
+#if 0
+	/* Dummy set-constant to trigger context rollover */
+	OUT_PKT3(ring, CP_SET_CONSTANT, 2);
+	OUT_RING(ring, CP_REG(REG_A3XX_HLSQ_CL_KERNEL_GROUP_X_REG));
+	OUT_RING(ring, 0x00000000);
+#endif
+
+	adreno_flush(gpu, ring, REG_AXXX_CP_RB_WPTR);
+}
+
+static bool a3xx_me_init(struct msm_gpu *gpu)
+{
+	struct msm_ringbuffer *ring = gpu->rb[0];
+
+	OUT_PKT3(ring, CP_ME_INIT, 17);
+	OUT_RING(ring, 0x000003f7);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000080);
+	OUT_RING(ring, 0x00000100);
+	OUT_RING(ring, 0x00000180);
+	OUT_RING(ring, 0x00006600);
+	OUT_RING(ring, 0x00000150);
+	OUT_RING(ring, 0x0000014e);
+	OUT_RING(ring, 0x00000154);
+	OUT_RING(ring, 0x00000001);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+
+	adreno_flush(gpu, ring, REG_AXXX_CP_RB_WPTR);
+	return a3xx_idle(gpu);
+}
+
+static int a3xx_hw_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a3xx_gpu *a3xx_gpu = to_a3xx_gpu(adreno_gpu);
+	uint32_t *ptr, len;
+	int i, ret;
+
+	DBG("%s", gpu->name);
+
+	if (adreno_is_a305(adreno_gpu)) {
+		/* Set up 16 deep read/write request queues: */
+		gpu_write(gpu, REG_A3XX_VBIF_IN_RD_LIM_CONF0, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_RD_LIM_CONF1, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_RD_LIM_CONF0, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_WR_LIM_CONF0, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_DDR_OUT_MAX_BURST, 0x0000303);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_WR_LIM_CONF0, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_WR_LIM_CONF1, 0x10101010);
+		/* Enable WR-REQ: */
+		gpu_write(gpu, REG_A3XX_VBIF_GATE_OFF_WRREQ_EN, 0x0000ff);
+		/* Set up round robin arbitration between both AXI ports: */
+		gpu_write(gpu, REG_A3XX_VBIF_ARB_CTL, 0x00000030);
+		/* Set up AOOO: */
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_AXI_AOOO_EN, 0x0000003c);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_AXI_AOOO, 0x003c003c);
+	} else if (adreno_is_a305b(adreno_gpu)) {
+		gpu_write(gpu, REG_A3XX_VBIF_IN_RD_LIM_CONF0, 0x00181818);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_WR_LIM_CONF0, 0x00181818);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_RD_LIM_CONF0, 0x00000018);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_WR_LIM_CONF0, 0x00000018);
+		gpu_write(gpu, REG_A3XX_VBIF_DDR_OUT_MAX_BURST, 0x00000303);
+		gpu_write(gpu, REG_A3XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x0003);
+	} else if (adreno_is_a306(adreno_gpu)) {
+		gpu_write(gpu, REG_A3XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x0003);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_RD_LIM_CONF0, 0x0000000a);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_WR_LIM_CONF0, 0x0000000a);
+	} else if (adreno_is_a320(adreno_gpu)) {
+		/* Set up 16 deep read/write request queues: */
+		gpu_write(gpu, REG_A3XX_VBIF_IN_RD_LIM_CONF0, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_RD_LIM_CONF1, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_RD_LIM_CONF0, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_WR_LIM_CONF0, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_DDR_OUT_MAX_BURST, 0x0000303);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_WR_LIM_CONF0, 0x10101010);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_WR_LIM_CONF1, 0x10101010);
+		/* Enable WR-REQ: */
+		gpu_write(gpu, REG_A3XX_VBIF_GATE_OFF_WRREQ_EN, 0x0000ff);
+		/* Set up round robin arbitration between both AXI ports: */
+		gpu_write(gpu, REG_A3XX_VBIF_ARB_CTL, 0x00000030);
+		/* Set up AOOO: */
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_AXI_AOOO_EN, 0x0000003c);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_AXI_AOOO, 0x003c003c);
+		/* Enable 1K sort: */
+		gpu_write(gpu, REG_A3XX_VBIF_ABIT_SORT, 0x000000ff);
+		gpu_write(gpu, REG_A3XX_VBIF_ABIT_SORT_CONF, 0x000000a4);
+
+	} else if (adreno_is_a330v2(adreno_gpu)) {
+		/*
+		 * Most of the VBIF registers on 8974v2 have the correct
+		 * values at power on, so we won't modify those if we don't
+		 * need to
+		 */
+		/* Enable 1k sort: */
+		gpu_write(gpu, REG_A3XX_VBIF_ABIT_SORT, 0x0001003f);
+		gpu_write(gpu, REG_A3XX_VBIF_ABIT_SORT_CONF, 0x000000a4);
+		/* Enable WR-REQ: */
+		gpu_write(gpu, REG_A3XX_VBIF_GATE_OFF_WRREQ_EN, 0x00003f);
+		gpu_write(gpu, REG_A3XX_VBIF_DDR_OUT_MAX_BURST, 0x0000303);
+		/* Set up VBIF_ROUND_ROBIN_QOS_ARB: */
+		gpu_write(gpu, REG_A3XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x0003);
+
+	} else if (adreno_is_a330(adreno_gpu)) {
+		/* Set up 16 deep read/write request queues: */
+		gpu_write(gpu, REG_A3XX_VBIF_IN_RD_LIM_CONF0, 0x18181818);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_RD_LIM_CONF1, 0x18181818);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_RD_LIM_CONF0, 0x18181818);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_WR_LIM_CONF0, 0x18181818);
+		gpu_write(gpu, REG_A3XX_VBIF_DDR_OUT_MAX_BURST, 0x0000303);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_WR_LIM_CONF0, 0x18181818);
+		gpu_write(gpu, REG_A3XX_VBIF_IN_WR_LIM_CONF1, 0x18181818);
+		/* Enable WR-REQ: */
+		gpu_write(gpu, REG_A3XX_VBIF_GATE_OFF_WRREQ_EN, 0x00003f);
+		/* Set up round robin arbitration between both AXI ports: */
+		gpu_write(gpu, REG_A3XX_VBIF_ARB_CTL, 0x00000030);
+		/* Set up VBIF_ROUND_ROBIN_QOS_ARB: */
+		gpu_write(gpu, REG_A3XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x0001);
+		/* Set up AOOO: */
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_AXI_AOOO_EN, 0x0000003f);
+		gpu_write(gpu, REG_A3XX_VBIF_OUT_AXI_AOOO, 0x003f003f);
+		/* Enable 1K sort: */
+		gpu_write(gpu, REG_A3XX_VBIF_ABIT_SORT, 0x0001003f);
+		gpu_write(gpu, REG_A3XX_VBIF_ABIT_SORT_CONF, 0x000000a4);
+		/* Disable VBIF clock gating. This is to enable AXI running
+		 * higher frequency than GPU:
+		 */
+		gpu_write(gpu, REG_A3XX_VBIF_CLKON, 0x00000001);
+
+	} else {
+		BUG();
+	}
+
+	/* Make all blocks contribute to the GPU BUSY perf counter: */
+	gpu_write(gpu, REG_A3XX_RBBM_GPU_BUSY_MASKED, 0xffffffff);
+
+	/* Tune the hystersis counters for SP and CP idle detection: */
+	gpu_write(gpu, REG_A3XX_RBBM_SP_HYST_CNT, 0x10);
+	gpu_write(gpu, REG_A3XX_RBBM_WAIT_IDLE_CLOCKS_CTL, 0x10);
+
+	/* Enable the RBBM error reporting bits.  This lets us get
+	 * useful information on failure:
+	 */
+	gpu_write(gpu, REG_A3XX_RBBM_AHB_CTL0, 0x00000001);
+
+	/* Enable AHB error reporting: */
+	gpu_write(gpu, REG_A3XX_RBBM_AHB_CTL1, 0xa6ffffff);
+
+	/* Turn on the power counters: */
+	gpu_write(gpu, REG_A3XX_RBBM_RBBM_CTL, 0x00030000);
+
+	/* Turn on hang detection - this spews a lot of useful information
+	 * into the RBBM registers on a hang:
+	 */
+	gpu_write(gpu, REG_A3XX_RBBM_INTERFACE_HANG_INT_CTL, 0x00010fff);
+
+	/* Enable 64-byte cacheline size. HW Default is 32-byte (0x000000E0): */
+	gpu_write(gpu, REG_A3XX_UCHE_CACHE_MODE_CONTROL_REG, 0x00000001);
+
+	/* Enable Clock gating: */
+	if (adreno_is_a305b(adreno_gpu) || adreno_is_a306(adreno_gpu))
+		gpu_write(gpu, REG_A3XX_RBBM_CLOCK_CTL, 0xaaaaaaaa);
+	else if (adreno_is_a320(adreno_gpu))
+		gpu_write(gpu, REG_A3XX_RBBM_CLOCK_CTL, 0xbfffffff);
+	else if (adreno_is_a330v2(adreno_gpu))
+		gpu_write(gpu, REG_A3XX_RBBM_CLOCK_CTL, 0xaaaaaaaa);
+	else if (adreno_is_a330(adreno_gpu))
+		gpu_write(gpu, REG_A3XX_RBBM_CLOCK_CTL, 0xbffcffff);
+
+	if (adreno_is_a330v2(adreno_gpu))
+		gpu_write(gpu, REG_A3XX_RBBM_GPR0_CTL, 0x05515455);
+	else if (adreno_is_a330(adreno_gpu))
+		gpu_write(gpu, REG_A3XX_RBBM_GPR0_CTL, 0x00000000);
+
+	/* Set the OCMEM base address for A330, etc */
+	if (a3xx_gpu->ocmem.hdl) {
+		gpu_write(gpu, REG_A3XX_RB_GMEM_BASE_ADDR,
+			(unsigned int)(a3xx_gpu->ocmem.base >> 14));
+	}
+
+	/* Turn on performance counters: */
+	gpu_write(gpu, REG_A3XX_RBBM_PERFCTR_CTL, 0x01);
+
+	/* Enable the perfcntrs that we use.. */
+	for (i = 0; i < gpu->num_perfcntrs; i++) {
+		const struct msm_gpu_perfcntr *perfcntr = &gpu->perfcntrs[i];
+		gpu_write(gpu, perfcntr->select_reg, perfcntr->select_val);
+	}
+
+	gpu_write(gpu, REG_A3XX_RBBM_INT_0_MASK, A3XX_INT0_MASK);
+
+	ret = adreno_hw_init(gpu);
+	if (ret)
+		return ret;
+
+	/*
+	 * Use the default ringbuffer size and block size but disable the RPTR
+	 * shadow
+	 */
+	gpu_write(gpu, REG_AXXX_CP_RB_CNTL,
+		MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
+
+	/* Set the ringbuffer address */
+	gpu_write(gpu, REG_AXXX_CP_RB_BASE, lower_32_bits(gpu->rb[0]->iova));
+
+	/* setup access protection: */
+	gpu_write(gpu, REG_A3XX_CP_PROTECT_CTRL, 0x00000007);
+
+	/* RBBM registers */
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(0), 0x63000040);
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(1), 0x62000080);
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(2), 0x600000cc);
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(3), 0x60000108);
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(4), 0x64000140);
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(5), 0x66000400);
+
+	/* CP registers */
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(6), 0x65000700);
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(7), 0x610007d8);
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(8), 0x620007e0);
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(9), 0x61001178);
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(10), 0x64001180);
+
+	/* RB registers */
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(11), 0x60003300);
+
+	/* VBIF registers */
+	gpu_write(gpu, REG_A3XX_CP_PROTECT(12), 0x6b00c000);
+
+	/* NOTE: PM4/micro-engine firmware registers look to be the same
+	 * for a2xx and a3xx.. we could possibly push that part down to
+	 * adreno_gpu base class.  Or push both PM4 and PFP but
+	 * parameterize the pfp ucode addr/data registers..
+	 */
+
+	/* Load PM4: */
+	ptr = (uint32_t *)(adreno_gpu->fw[ADRENO_FW_PM4]->data);
+	len = adreno_gpu->fw[ADRENO_FW_PM4]->size / 4;
+	DBG("loading PM4 ucode version: %x", ptr[1]);
+
+	gpu_write(gpu, REG_AXXX_CP_DEBUG,
+			AXXX_CP_DEBUG_DYNAMIC_CLK_DISABLE |
+			AXXX_CP_DEBUG_MIU_128BIT_WRITE_ENABLE);
+	gpu_write(gpu, REG_AXXX_CP_ME_RAM_WADDR, 0);
+	for (i = 1; i < len; i++)
+		gpu_write(gpu, REG_AXXX_CP_ME_RAM_DATA, ptr[i]);
+
+	/* Load PFP: */
+	ptr = (uint32_t *)(adreno_gpu->fw[ADRENO_FW_PFP]->data);
+	len = adreno_gpu->fw[ADRENO_FW_PFP]->size / 4;
+	DBG("loading PFP ucode version: %x", ptr[5]);
+
+	gpu_write(gpu, REG_A3XX_CP_PFP_UCODE_ADDR, 0);
+	for (i = 1; i < len; i++)
+		gpu_write(gpu, REG_A3XX_CP_PFP_UCODE_DATA, ptr[i]);
+
+	/* CP ROQ queue sizes (bytes) - RB:16, ST:16, IB1:32, IB2:64 */
+	if (adreno_is_a305(adreno_gpu) || adreno_is_a306(adreno_gpu) ||
+			adreno_is_a320(adreno_gpu)) {
+		gpu_write(gpu, REG_AXXX_CP_QUEUE_THRESHOLDS,
+				AXXX_CP_QUEUE_THRESHOLDS_CSQ_IB1_START(2) |
+				AXXX_CP_QUEUE_THRESHOLDS_CSQ_IB2_START(6) |
+				AXXX_CP_QUEUE_THRESHOLDS_CSQ_ST_START(14));
+	} else if (adreno_is_a330(adreno_gpu) || adreno_is_a305b(adreno_gpu)) {
+		/* NOTE: this (value take from downstream android driver)
+		 * includes some bits outside of the known bitfields.  But
+		 * A330 has this "MERCIU queue" thing too, which might
+		 * explain a new bitfield or reshuffling:
+		 */
+		gpu_write(gpu, REG_AXXX_CP_QUEUE_THRESHOLDS, 0x003e2008);
+	}
+
+	/* clear ME_HALT to start micro engine */
+	gpu_write(gpu, REG_AXXX_CP_ME_CNTL, 0);
+
+	return a3xx_me_init(gpu) ? 0 : -EINVAL;
+}
+
+static void a3xx_recover(struct msm_gpu *gpu)
+{
+	int i;
+
+	adreno_dump_info(gpu);
+
+	for (i = 0; i < 8; i++) {
+		printk("CP_SCRATCH_REG%d: %u\n", i,
+			gpu_read(gpu, REG_AXXX_CP_SCRATCH_REG0 + i));
+	}
+
+	/* dump registers before resetting gpu, if enabled: */
+	if (hang_debug)
+		a3xx_dump(gpu);
+
+	gpu_write(gpu, REG_A3XX_RBBM_SW_RESET_CMD, 1);
+	gpu_read(gpu, REG_A3XX_RBBM_SW_RESET_CMD);
+	gpu_write(gpu, REG_A3XX_RBBM_SW_RESET_CMD, 0);
+	adreno_recover(gpu);
+}
+
+static void a3xx_destroy(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a3xx_gpu *a3xx_gpu = to_a3xx_gpu(adreno_gpu);
+
+	DBG("%s", gpu->name);
+
+	adreno_gpu_cleanup(adreno_gpu);
+
+	adreno_gpu_ocmem_cleanup(&a3xx_gpu->ocmem);
+
+	kfree(a3xx_gpu);
+}
+
+static bool a3xx_idle(struct msm_gpu *gpu)
+{
+	/* wait for ringbuffer to drain: */
+	if (!adreno_idle(gpu, gpu->rb[0]))
+		return false;
+
+	/* then wait for GPU to finish: */
+	if (spin_until(!(gpu_read(gpu, REG_A3XX_RBBM_STATUS) &
+			A3XX_RBBM_STATUS_GPU_BUSY))) {
+		DRM_ERROR("%s: timeout waiting for GPU to idle!\n", gpu->name);
+
+		/* TODO maybe we need to reset GPU here to recover from hang? */
+		return false;
+	}
+
+	return true;
+}
+
+static irqreturn_t a3xx_irq(struct msm_gpu *gpu)
+{
+	uint32_t status;
+
+	status = gpu_read(gpu, REG_A3XX_RBBM_INT_0_STATUS);
+	DBG("%s: %08x", gpu->name, status);
+
+	// TODO
+
+	gpu_write(gpu, REG_A3XX_RBBM_INT_CLEAR_CMD, status);
+
+	msm_gpu_retire(gpu);
+
+	return IRQ_HANDLED;
+}
+
+static const unsigned int a3xx_registers[] = {
+	0x0000, 0x0002, 0x0010, 0x0012, 0x0018, 0x0018, 0x0020, 0x0027,
+	0x0029, 0x002b, 0x002e, 0x0033, 0x0040, 0x0042, 0x0050, 0x005c,
+	0x0060, 0x006c, 0x0080, 0x0082, 0x0084, 0x0088, 0x0090, 0x00e5,
+	0x00ea, 0x00ed, 0x0100, 0x0100, 0x0110, 0x0123, 0x01c0, 0x01c1,
+	0x01c3, 0x01c5, 0x01c7, 0x01c7, 0x01d5, 0x01d9, 0x01dc, 0x01dd,
+	0x01ea, 0x01ea, 0x01ee, 0x01f1, 0x01f5, 0x01f5, 0x01fc, 0x01ff,
+	0x0440, 0x0440, 0x0443, 0x0443, 0x0445, 0x0445, 0x044d, 0x044f,
+	0x0452, 0x0452, 0x0454, 0x046f, 0x047c, 0x047c, 0x047f, 0x047f,
+	0x0578, 0x057f, 0x0600, 0x0602, 0x0605, 0x0607, 0x060a, 0x060e,
+	0x0612, 0x0614, 0x0c01, 0x0c02, 0x0c06, 0x0c1d, 0x0c3d, 0x0c3f,
+	0x0c48, 0x0c4b, 0x0c80, 0x0c80, 0x0c88, 0x0c8b, 0x0ca0, 0x0cb7,
+	0x0cc0, 0x0cc1, 0x0cc6, 0x0cc7, 0x0ce4, 0x0ce5, 0x0e00, 0x0e05,
+	0x0e0c, 0x0e0c, 0x0e22, 0x0e23, 0x0e41, 0x0e45, 0x0e64, 0x0e65,
+	0x0e80, 0x0e82, 0x0e84, 0x0e89, 0x0ea0, 0x0ea1, 0x0ea4, 0x0ea7,
+	0x0ec4, 0x0ecb, 0x0ee0, 0x0ee0, 0x0f00, 0x0f01, 0x0f03, 0x0f09,
+	0x2040, 0x2040, 0x2044, 0x2044, 0x2048, 0x204d, 0x2068, 0x2069,
+	0x206c, 0x206d, 0x2070, 0x2070, 0x2072, 0x2072, 0x2074, 0x2075,
+	0x2079, 0x207a, 0x20c0, 0x20d3, 0x20e4, 0x20ef, 0x2100, 0x2109,
+	0x210c, 0x210c, 0x210e, 0x210e, 0x2110, 0x2111, 0x2114, 0x2115,
+	0x21e4, 0x21e4, 0x21ea, 0x21ea, 0x21ec, 0x21ed, 0x21f0, 0x21f0,
+	0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e,
+	0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
+	0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
+	0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444,
+	0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470,
+	0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3,
+	0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e,
+	0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea,
+	0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617,
+	0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0,
+	0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9,
+	0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
+	0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d,
+	0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f,
+	~0   /* sentinel */
+};
+
+/* would be nice to not have to duplicate the _show() stuff with printk(): */
+static void a3xx_dump(struct msm_gpu *gpu)
+{
+	printk("status:   %08x\n",
+			gpu_read(gpu, REG_A3XX_RBBM_STATUS));
+	adreno_dump(gpu);
+}
+
+static struct msm_gpu_state *a3xx_gpu_state_get(struct msm_gpu *gpu)
+{
+	struct msm_gpu_state *state = kzalloc(sizeof(*state), GFP_KERNEL);
+
+	if (!state)
+		return ERR_PTR(-ENOMEM);
+
+	adreno_gpu_state_get(gpu, state);
+
+	state->rbbm_status = gpu_read(gpu, REG_A3XX_RBBM_STATUS);
+
+	return state;
+}
+
+static u64 a3xx_gpu_busy(struct msm_gpu *gpu, unsigned long *out_sample_rate)
+{
+	u64 busy_cycles;
+
+	busy_cycles = gpu_read64(gpu, REG_A3XX_RBBM_PERFCTR_RBBM_1_LO);
+	*out_sample_rate = clk_get_rate(gpu->core_clk);
+
+	return busy_cycles;
+}
+
+static u32 a3xx_get_rptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	ring->memptrs->rptr = gpu_read(gpu, REG_AXXX_CP_RB_RPTR);
+	return ring->memptrs->rptr;
+}
+
+static const struct adreno_gpu_funcs funcs = {
+	.base = {
+		.get_param = adreno_get_param,
+		.set_param = adreno_set_param,
+		.hw_init = a3xx_hw_init,
+		.pm_suspend = msm_gpu_pm_suspend,
+		.pm_resume = msm_gpu_pm_resume,
+		.recover = a3xx_recover,
+		.submit = a3xx_submit,
+		.active_ring = adreno_active_ring,
+		.irq = a3xx_irq,
+		.destroy = a3xx_destroy,
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
+		.show = adreno_show,
+#endif
+		.gpu_busy = a3xx_gpu_busy,
+		.gpu_state_get = a3xx_gpu_state_get,
+		.gpu_state_put = adreno_gpu_state_put,
+		.create_address_space = adreno_create_address_space,
+		.get_rptr = a3xx_get_rptr,
+	},
+};
+
+static const struct msm_gpu_perfcntr perfcntrs[] = {
+	{ REG_A3XX_SP_PERFCOUNTER6_SELECT, REG_A3XX_RBBM_PERFCTR_SP_6_LO,
+			SP_ALU_ACTIVE_CYCLES, "ALUACTIVE" },
+	{ REG_A3XX_SP_PERFCOUNTER7_SELECT, REG_A3XX_RBBM_PERFCTR_SP_7_LO,
+			SP_FS_FULL_ALU_INSTRUCTIONS, "ALUFULL" },
+};
+
+struct msm_gpu *a3xx_gpu_init(struct drm_device *dev)
+{
+	struct a3xx_gpu *a3xx_gpu = NULL;
+	struct adreno_gpu *adreno_gpu;
+	struct msm_gpu *gpu;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct platform_device *pdev = priv->gpu_pdev;
+	struct icc_path *ocmem_icc_path;
+	struct icc_path *icc_path;
+	int ret;
+
+	if (!pdev) {
+		DRM_DEV_ERROR(dev->dev, "no a3xx device\n");
+		ret = -ENXIO;
+		goto fail;
+	}
+
+	a3xx_gpu = kzalloc(sizeof(*a3xx_gpu), GFP_KERNEL);
+	if (!a3xx_gpu) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	adreno_gpu = &a3xx_gpu->base;
+	gpu = &adreno_gpu->base;
+
+	gpu->perfcntrs = perfcntrs;
+	gpu->num_perfcntrs = ARRAY_SIZE(perfcntrs);
+
+	adreno_gpu->registers = a3xx_registers;
+
+	ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
+	if (ret)
+		goto fail;
+
+	/* if needed, allocate gmem: */
+	if (adreno_is_a330(adreno_gpu) || adreno_is_a305b(adreno_gpu)) {
+		ret = adreno_gpu_ocmem_init(&adreno_gpu->base.pdev->dev,
+					    adreno_gpu, &a3xx_gpu->ocmem);
+		if (ret)
+			goto fail;
+	}
+
+	if (!gpu->aspace) {
+		/* TODO we think it is possible to configure the GPU to
+		 * restrict access to VRAM carveout.  But the required
+		 * registers are unknown.  For now just bail out and
+		 * limp along with just modesetting.  If it turns out
+		 * to not be possible to restrict access, then we must
+		 * implement a cmdstream validator.
+		 */
+		DRM_DEV_ERROR(dev->dev, "No memory protection without IOMMU\n");
+		if (!allow_vram_carveout) {
+			ret = -ENXIO;
+			goto fail;
+		}
+	}
+
+	icc_path = devm_of_icc_get(&pdev->dev, "gfx-mem");
+	if (IS_ERR(icc_path)) {
+		ret = PTR_ERR(icc_path);
+		goto fail;
+	}
+
+	ocmem_icc_path = devm_of_icc_get(&pdev->dev, "ocmem");
+	if (IS_ERR(ocmem_icc_path)) {
+		ret = PTR_ERR(ocmem_icc_path);
+		/* allow -ENODATA, ocmem icc is optional */
+		if (ret != -ENODATA)
+			goto fail;
+		ocmem_icc_path = NULL;
+	}
+
+
+	/*
+	 * Set the ICC path to maximum speed for now by multiplying the fastest
+	 * frequency by the bus width (8). We'll want to scale this later on to
+	 * improve battery life.
+	 */
+	icc_set_bw(icc_path, 0, Bps_to_icc(gpu->fast_rate) * 8);
+	icc_set_bw(ocmem_icc_path, 0, Bps_to_icc(gpu->fast_rate) * 8);
+
+	return gpu;
+
+fail:
+	if (a3xx_gpu)
+		a3xx_destroy(&a3xx_gpu->base.base);
+
+	return ERR_PTR(ret);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a3xx_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a3xx_gpu.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __A3XX_GPU_H__
+#define __A3XX_GPU_H__
+
+#include "adreno_gpu.h"
+
+/* arrg, somehow fb.h is getting pulled in: */
+#undef ROP_COPY
+#undef ROP_XOR
+
+#include "a3xx.xml.h"
+
+struct a3xx_gpu {
+	struct adreno_gpu base;
+
+	/* if OCMEM is used for GMEM: */
+	struct adreno_ocmem ocmem;
+};
+#define to_a3xx_gpu(x) container_of(x, struct a3xx_gpu, base)
+
+#endif /* __A3XX_GPU_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a4xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a4xx_catalog.c
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+
+static const struct adreno_info a4xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x04000500),
+		.family = ADRENO_4XX,
+		.revn  = 405,
+		.fw = {
+			[ADRENO_FW_PM4] = "a420_pm4.fw",
+			[ADRENO_FW_PFP] = "a420_pfp.fw",
+		},
+		.gmem  = SZ_256K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a4xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x04020000),
+		.family = ADRENO_4XX,
+		.revn  = 420,
+		.fw = {
+			[ADRENO_FW_PM4] = "a420_pm4.fw",
+			[ADRENO_FW_PFP] = "a420_pfp.fw",
+		},
+		.gmem  = (SZ_1M + SZ_512K),
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a4xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x04030002),
+		.family = ADRENO_4XX,
+		.revn  = 430,
+		.fw = {
+			[ADRENO_FW_PM4] = "a420_pm4.fw",
+			[ADRENO_FW_PFP] = "a420_pfp.fw",
+		},
+		.gmem  = (SZ_1M + SZ_512K),
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init  = a4xx_gpu_init,
+	}
+};
+DECLARE_ADRENO_GPULIST(a4xx);
+
+MODULE_FIRMWARE("qcom/a420_pm4.fw");
+MODULE_FIRMWARE("qcom/a420_pfp.fw");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a4xx_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a4xx_gpu.c
@@ -0,0 +1,741 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ */
+#include "a4xx_gpu.h"
+
+#define A4XX_INT0_MASK \
+	(A4XX_INT0_RBBM_AHB_ERROR |        \
+	 A4XX_INT0_RBBM_ATB_BUS_OVERFLOW | \
+	 A4XX_INT0_CP_T0_PACKET_IN_IB |    \
+	 A4XX_INT0_CP_OPCODE_ERROR |       \
+	 A4XX_INT0_CP_RESERVED_BIT_ERROR | \
+	 A4XX_INT0_CP_HW_FAULT |           \
+	 A4XX_INT0_CP_IB1_INT |            \
+	 A4XX_INT0_CP_IB2_INT |            \
+	 A4XX_INT0_CP_RB_INT |             \
+	 A4XX_INT0_CP_REG_PROTECT_FAULT |  \
+	 A4XX_INT0_CP_AHB_ERROR_HALT |     \
+	 A4XX_INT0_CACHE_FLUSH_TS |        \
+	 A4XX_INT0_UCHE_OOB_ACCESS)
+
+extern bool hang_debug;
+static void a4xx_dump(struct msm_gpu *gpu);
+static bool a4xx_idle(struct msm_gpu *gpu);
+
+static void a4xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+{
+	struct msm_ringbuffer *ring = submit->ring;
+	unsigned int i;
+
+	for (i = 0; i < submit->nr_cmds; i++) {
+		switch (submit->cmd[i].type) {
+		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
+			/* ignore IB-targets */
+			break;
+		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
+			/* ignore if there has not been a ctx switch: */
+			if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)
+				break;
+			fallthrough;
+		case MSM_SUBMIT_CMD_BUF:
+			OUT_PKT3(ring, CP_INDIRECT_BUFFER_PFE, 2);
+			OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
+			OUT_RING(ring, submit->cmd[i].size);
+			OUT_PKT2(ring);
+			break;
+		}
+	}
+
+	OUT_PKT0(ring, REG_AXXX_CP_SCRATCH_REG2, 1);
+	OUT_RING(ring, submit->seqno);
+
+	/* Flush HLSQ lazy updates to make sure there is nothing
+	 * pending for indirect loads after the timestamp has
+	 * passed:
+	 */
+	OUT_PKT3(ring, CP_EVENT_WRITE, 1);
+	OUT_RING(ring, HLSQ_FLUSH);
+
+	/* wait for idle before cache flush/interrupt */
+	OUT_PKT3(ring, CP_WAIT_FOR_IDLE, 1);
+	OUT_RING(ring, 0x00000000);
+
+	/* BIT(31) of CACHE_FLUSH_TS triggers CACHE_FLUSH_TS IRQ from GPU */
+	OUT_PKT3(ring, CP_EVENT_WRITE, 3);
+	OUT_RING(ring, CACHE_FLUSH_TS | CP_EVENT_WRITE_0_IRQ);
+	OUT_RING(ring, rbmemptr(ring, fence));
+	OUT_RING(ring, submit->seqno);
+
+	adreno_flush(gpu, ring, REG_A4XX_CP_RB_WPTR);
+}
+
+/*
+ * a4xx_enable_hwcg() - Program the clock control registers
+ * @device: The adreno device pointer
+ */
+static void a4xx_enable_hwcg(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	unsigned int i;
+	for (i = 0; i < 4; i++)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL_TP(i), 0x02222202);
+	for (i = 0; i < 4; i++)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL2_TP(i), 0x00002222);
+	for (i = 0; i < 4; i++)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_HYST_TP(i), 0x0E739CE7);
+	for (i = 0; i < 4; i++)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_DELAY_TP(i), 0x00111111);
+	for (i = 0; i < 4; i++)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL_SP(i), 0x22222222);
+	for (i = 0; i < 4; i++)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL2_SP(i), 0x00222222);
+	for (i = 0; i < 4; i++)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_HYST_SP(i), 0x00000104);
+	for (i = 0; i < 4; i++)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_DELAY_SP(i), 0x00000081);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL_UCHE, 0x22222222);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL2_UCHE, 0x02222222);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL3_UCHE, 0x00000000);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL4_UCHE, 0x00000000);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_HYST_UCHE, 0x00004444);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_DELAY_UCHE, 0x00001112);
+	for (i = 0; i < 4; i++)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL_RB(i), 0x22222222);
+
+	/* Disable L1 clocking in A420 due to CCU issues with it */
+	for (i = 0; i < 4; i++) {
+		if (adreno_is_a420(adreno_gpu)) {
+			gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL2_RB(i),
+					0x00002020);
+		} else {
+			gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL2_RB(i),
+					0x00022020);
+		}
+	}
+
+	/* No CCU for A405 */
+	if (!adreno_is_a405(adreno_gpu)) {
+		for (i = 0; i < 4; i++) {
+			gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL_MARB_CCU(i),
+					0x00000922);
+		}
+
+		for (i = 0; i < 4; i++) {
+			gpu_write(gpu, REG_A4XX_RBBM_CLOCK_HYST_RB_MARB_CCU(i),
+					0x00000000);
+		}
+
+		for (i = 0; i < 4; i++) {
+			gpu_write(gpu, REG_A4XX_RBBM_CLOCK_DELAY_RB_MARB_CCU_L1(i),
+					0x00000001);
+		}
+	}
+
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_MODE_GPC, 0x02222222);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_HYST_GPC, 0x04100104);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_DELAY_GPC, 0x00022222);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL_COM_DCOM, 0x00000022);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_HYST_COM_DCOM, 0x0000010F);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_DELAY_COM_DCOM, 0x00000022);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL_TSE_RAS_RBBM, 0x00222222);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00004104);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00000222);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL_HLSQ , 0x00000000);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_DELAY_HLSQ, 0x00220000);
+	/* Early A430's have a timing issue with SP/TP power collapse;
+	   disabling HW clock gating prevents it. */
+	if (adreno_is_a430(adreno_gpu) && adreno_patchid(adreno_gpu) < 2)
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL, 0);
+	else
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL, 0xAAAAAAAA);
+	gpu_write(gpu, REG_A4XX_RBBM_CLOCK_CTL2, 0);
+}
+
+
+static bool a4xx_me_init(struct msm_gpu *gpu)
+{
+	struct msm_ringbuffer *ring = gpu->rb[0];
+
+	OUT_PKT3(ring, CP_ME_INIT, 17);
+	OUT_RING(ring, 0x000003f7);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000080);
+	OUT_RING(ring, 0x00000100);
+	OUT_RING(ring, 0x00000180);
+	OUT_RING(ring, 0x00006600);
+	OUT_RING(ring, 0x00000150);
+	OUT_RING(ring, 0x0000014e);
+	OUT_RING(ring, 0x00000154);
+	OUT_RING(ring, 0x00000001);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+
+	adreno_flush(gpu, ring, REG_A4XX_CP_RB_WPTR);
+	return a4xx_idle(gpu);
+}
+
+static int a4xx_hw_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a4xx_gpu *a4xx_gpu = to_a4xx_gpu(adreno_gpu);
+	uint32_t *ptr, len;
+	int i, ret;
+
+	if (adreno_is_a405(adreno_gpu)) {
+		gpu_write(gpu, REG_A4XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x00000003);
+	} else if (adreno_is_a420(adreno_gpu)) {
+		gpu_write(gpu, REG_A4XX_VBIF_ABIT_SORT, 0x0001001F);
+		gpu_write(gpu, REG_A4XX_VBIF_ABIT_SORT_CONF, 0x000000A4);
+		gpu_write(gpu, REG_A4XX_VBIF_GATE_OFF_WRREQ_EN, 0x00000001);
+		gpu_write(gpu, REG_A4XX_VBIF_IN_RD_LIM_CONF0, 0x18181818);
+		gpu_write(gpu, REG_A4XX_VBIF_IN_RD_LIM_CONF1, 0x00000018);
+		gpu_write(gpu, REG_A4XX_VBIF_IN_WR_LIM_CONF0, 0x18181818);
+		gpu_write(gpu, REG_A4XX_VBIF_IN_WR_LIM_CONF1, 0x00000018);
+		gpu_write(gpu, REG_A4XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x00000003);
+	} else if (adreno_is_a430(adreno_gpu)) {
+		gpu_write(gpu, REG_A4XX_VBIF_GATE_OFF_WRREQ_EN, 0x00000001);
+		gpu_write(gpu, REG_A4XX_VBIF_IN_RD_LIM_CONF0, 0x18181818);
+		gpu_write(gpu, REG_A4XX_VBIF_IN_RD_LIM_CONF1, 0x00000018);
+		gpu_write(gpu, REG_A4XX_VBIF_IN_WR_LIM_CONF0, 0x18181818);
+		gpu_write(gpu, REG_A4XX_VBIF_IN_WR_LIM_CONF1, 0x00000018);
+		gpu_write(gpu, REG_A4XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x00000003);
+	} else {
+		BUG();
+	}
+
+	/* Make all blocks contribute to the GPU BUSY perf counter */
+	gpu_write(gpu, REG_A4XX_RBBM_GPU_BUSY_MASKED, 0xffffffff);
+
+	/* Tune the hystersis counters for SP and CP idle detection */
+	gpu_write(gpu, REG_A4XX_RBBM_SP_HYST_CNT, 0x10);
+	gpu_write(gpu, REG_A4XX_RBBM_WAIT_IDLE_CLOCKS_CTL, 0x10);
+
+	if (adreno_is_a430(adreno_gpu)) {
+		gpu_write(gpu, REG_A4XX_RBBM_WAIT_IDLE_CLOCKS_CTL2, 0x30);
+	}
+
+	 /* Enable the RBBM error reporting bits */
+	gpu_write(gpu, REG_A4XX_RBBM_AHB_CTL0, 0x00000001);
+
+	/* Enable AHB error reporting*/
+	gpu_write(gpu, REG_A4XX_RBBM_AHB_CTL1, 0xa6ffffff);
+
+	/* Enable power counters*/
+	gpu_write(gpu, REG_A4XX_RBBM_RBBM_CTL, 0x00000030);
+
+	/*
+	 * Turn on hang detection - this spews a lot of useful information
+	 * into the RBBM registers on a hang:
+	 */
+	gpu_write(gpu, REG_A4XX_RBBM_INTERFACE_HANG_INT_CTL,
+			(1 << 30) | 0xFFFF);
+
+	gpu_write(gpu, REG_A4XX_RB_GMEM_BASE_ADDR,
+			(unsigned int)(a4xx_gpu->ocmem.base >> 14));
+
+	/* Turn on performance counters: */
+	gpu_write(gpu, REG_A4XX_RBBM_PERFCTR_CTL, 0x01);
+
+	/* use the first CP counter for timestamp queries.. userspace may set
+	 * this as well but it selects the same counter/countable:
+	 */
+	gpu_write(gpu, REG_A4XX_CP_PERFCTR_CP_SEL_0, CP_ALWAYS_COUNT);
+
+	if (adreno_is_a430(adreno_gpu))
+		gpu_write(gpu, REG_A4XX_UCHE_CACHE_WAYS_VFD, 0x07);
+
+	/* Disable L2 bypass to avoid UCHE out of bounds errors */
+	gpu_write(gpu, REG_A4XX_UCHE_TRAP_BASE_LO, 0xffff0000);
+	gpu_write(gpu, REG_A4XX_UCHE_TRAP_BASE_HI, 0xffff0000);
+
+	gpu_write(gpu, REG_A4XX_CP_DEBUG, (1 << 25) |
+			(adreno_is_a420(adreno_gpu) ? (1 << 29) : 0));
+
+	/* On A430 enable SP regfile sleep for power savings */
+	/* TODO downstream does this for !420, so maybe applies for 405 too? */
+	if (!adreno_is_a420(adreno_gpu)) {
+		gpu_write(gpu, REG_A4XX_RBBM_SP_REGFILE_SLEEP_CNTL_0,
+			0x00000441);
+		gpu_write(gpu, REG_A4XX_RBBM_SP_REGFILE_SLEEP_CNTL_1,
+			0x00000441);
+	}
+
+	a4xx_enable_hwcg(gpu);
+
+	/*
+	 * For A420 set RBBM_CLOCK_DELAY_HLSQ.CGC_HLSQ_TP_EARLY_CYC >= 2
+	 * due to timing issue with HLSQ_TP_CLK_EN
+	 */
+	if (adreno_is_a420(adreno_gpu)) {
+		unsigned int val;
+		val = gpu_read(gpu, REG_A4XX_RBBM_CLOCK_DELAY_HLSQ);
+		val &= ~A4XX_CGC_HLSQ_EARLY_CYC__MASK;
+		val |= 2 << A4XX_CGC_HLSQ_EARLY_CYC__SHIFT;
+		gpu_write(gpu, REG_A4XX_RBBM_CLOCK_DELAY_HLSQ, val);
+	}
+
+	/* setup access protection: */
+	gpu_write(gpu, REG_A4XX_CP_PROTECT_CTRL, 0x00000007);
+
+	/* RBBM registers */
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(0), 0x62000010);
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(1), 0x63000020);
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(2), 0x64000040);
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(3), 0x65000080);
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(4), 0x66000100);
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(5), 0x64000200);
+
+	/* CP registers */
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(6), 0x67000800);
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(7), 0x64001600);
+
+
+	/* RB registers */
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(8), 0x60003300);
+
+	/* HLSQ registers */
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(9), 0x60003800);
+
+	/* VPC registers */
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(10), 0x61003980);
+
+	/* SMMU registers */
+	gpu_write(gpu, REG_A4XX_CP_PROTECT(11), 0x6e010000);
+
+	gpu_write(gpu, REG_A4XX_RBBM_INT_0_MASK, A4XX_INT0_MASK);
+
+	ret = adreno_hw_init(gpu);
+	if (ret)
+		return ret;
+
+	/*
+	 * Use the default ringbuffer size and block size but disable the RPTR
+	 * shadow
+	 */
+	gpu_write(gpu, REG_A4XX_CP_RB_CNTL,
+		MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
+
+	/* Set the ringbuffer address */
+	gpu_write(gpu, REG_A4XX_CP_RB_BASE, lower_32_bits(gpu->rb[0]->iova));
+
+	/* Load PM4: */
+	ptr = (uint32_t *)(adreno_gpu->fw[ADRENO_FW_PM4]->data);
+	len = adreno_gpu->fw[ADRENO_FW_PM4]->size / 4;
+	DBG("loading PM4 ucode version: %u", ptr[0]);
+	gpu_write(gpu, REG_A4XX_CP_ME_RAM_WADDR, 0);
+	for (i = 1; i < len; i++)
+		gpu_write(gpu, REG_A4XX_CP_ME_RAM_DATA, ptr[i]);
+
+	/* Load PFP: */
+	ptr = (uint32_t *)(adreno_gpu->fw[ADRENO_FW_PFP]->data);
+	len = adreno_gpu->fw[ADRENO_FW_PFP]->size / 4;
+	DBG("loading PFP ucode version: %u", ptr[0]);
+
+	gpu_write(gpu, REG_A4XX_CP_PFP_UCODE_ADDR, 0);
+	for (i = 1; i < len; i++)
+		gpu_write(gpu, REG_A4XX_CP_PFP_UCODE_DATA, ptr[i]);
+
+	/* clear ME_HALT to start micro engine */
+	gpu_write(gpu, REG_A4XX_CP_ME_CNTL, 0);
+
+	return a4xx_me_init(gpu) ? 0 : -EINVAL;
+}
+
+static void a4xx_recover(struct msm_gpu *gpu)
+{
+	int i;
+
+	adreno_dump_info(gpu);
+
+	for (i = 0; i < 8; i++) {
+		printk("CP_SCRATCH_REG%d: %u\n", i,
+			gpu_read(gpu, REG_AXXX_CP_SCRATCH_REG0 + i));
+	}
+
+	/* dump registers before resetting gpu, if enabled: */
+	if (hang_debug)
+		a4xx_dump(gpu);
+
+	gpu_write(gpu, REG_A4XX_RBBM_SW_RESET_CMD, 1);
+	gpu_read(gpu, REG_A4XX_RBBM_SW_RESET_CMD);
+	gpu_write(gpu, REG_A4XX_RBBM_SW_RESET_CMD, 0);
+	adreno_recover(gpu);
+}
+
+static void a4xx_destroy(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a4xx_gpu *a4xx_gpu = to_a4xx_gpu(adreno_gpu);
+
+	DBG("%s", gpu->name);
+
+	adreno_gpu_cleanup(adreno_gpu);
+
+	adreno_gpu_ocmem_cleanup(&a4xx_gpu->ocmem);
+
+	kfree(a4xx_gpu);
+}
+
+static bool a4xx_idle(struct msm_gpu *gpu)
+{
+	/* wait for ringbuffer to drain: */
+	if (!adreno_idle(gpu, gpu->rb[0]))
+		return false;
+
+	/* then wait for GPU to finish: */
+	if (spin_until(!(gpu_read(gpu, REG_A4XX_RBBM_STATUS) &
+					A4XX_RBBM_STATUS_GPU_BUSY))) {
+		DRM_ERROR("%s: timeout waiting for GPU to idle!\n", gpu->name);
+		/* TODO maybe we need to reset GPU here to recover from hang? */
+		return false;
+	}
+
+	return true;
+}
+
+static irqreturn_t a4xx_irq(struct msm_gpu *gpu)
+{
+	uint32_t status;
+
+	status = gpu_read(gpu, REG_A4XX_RBBM_INT_0_STATUS);
+	DBG("%s: Int status %08x", gpu->name, status);
+
+	if (status & A4XX_INT0_CP_REG_PROTECT_FAULT) {
+		uint32_t reg = gpu_read(gpu, REG_A4XX_CP_PROTECT_STATUS);
+		printk("CP | Protected mode error| %s | addr=%x\n",
+			reg & (1 << 24) ? "WRITE" : "READ",
+			(reg & 0xFFFFF) >> 2);
+	}
+
+	gpu_write(gpu, REG_A4XX_RBBM_INT_CLEAR_CMD, status);
+
+	msm_gpu_retire(gpu);
+
+	return IRQ_HANDLED;
+}
+
+static const unsigned int a4xx_registers[] = {
+	/* RBBM */
+	0x0000, 0x0002, 0x0004, 0x0021, 0x0023, 0x0024, 0x0026, 0x0026,
+	0x0028, 0x002B, 0x002E, 0x0034, 0x0037, 0x0044, 0x0047, 0x0066,
+	0x0068, 0x0095, 0x009C, 0x0170, 0x0174, 0x01AF,
+	/* CP */
+	0x0200, 0x0233, 0x0240, 0x0250, 0x04C0, 0x04DD, 0x0500, 0x050B,
+	0x0578, 0x058F,
+	/* VSC */
+	0x0C00, 0x0C03, 0x0C08, 0x0C41, 0x0C50, 0x0C51,
+	/* GRAS */
+	0x0C80, 0x0C81, 0x0C88, 0x0C8F,
+	/* RB */
+	0x0CC0, 0x0CC0, 0x0CC4, 0x0CD2,
+	/* PC */
+	0x0D00, 0x0D0C, 0x0D10, 0x0D17, 0x0D20, 0x0D23,
+	/* VFD */
+	0x0E40, 0x0E4A,
+	/* VPC */
+	0x0E60, 0x0E61, 0x0E63, 0x0E68,
+	/* UCHE */
+	0x0E80, 0x0E84, 0x0E88, 0x0E95,
+	/* VMIDMT */
+	0x1000, 0x1000, 0x1002, 0x1002, 0x1004, 0x1004, 0x1008, 0x100A,
+	0x100C, 0x100D, 0x100F, 0x1010, 0x1012, 0x1016, 0x1024, 0x1024,
+	0x1027, 0x1027, 0x1100, 0x1100, 0x1102, 0x1102, 0x1104, 0x1104,
+	0x1110, 0x1110, 0x1112, 0x1116, 0x1124, 0x1124, 0x1300, 0x1300,
+	0x1380, 0x1380,
+	/* GRAS CTX 0 */
+	0x2000, 0x2004, 0x2008, 0x2067, 0x2070, 0x2078, 0x207B, 0x216E,
+	/* PC CTX 0 */
+	0x21C0, 0x21C6, 0x21D0, 0x21D0, 0x21D9, 0x21D9, 0x21E5, 0x21E7,
+	/* VFD CTX 0 */
+	0x2200, 0x2204, 0x2208, 0x22A9,
+	/* GRAS CTX 1 */
+	0x2400, 0x2404, 0x2408, 0x2467, 0x2470, 0x2478, 0x247B, 0x256E,
+	/* PC CTX 1 */
+	0x25C0, 0x25C6, 0x25D0, 0x25D0, 0x25D9, 0x25D9, 0x25E5, 0x25E7,
+	/* VFD CTX 1 */
+	0x2600, 0x2604, 0x2608, 0x26A9,
+	/* XPU */
+	0x2C00, 0x2C01, 0x2C10, 0x2C10, 0x2C12, 0x2C16, 0x2C1D, 0x2C20,
+	0x2C28, 0x2C28, 0x2C30, 0x2C30, 0x2C32, 0x2C36, 0x2C40, 0x2C40,
+	0x2C50, 0x2C50, 0x2C52, 0x2C56, 0x2C80, 0x2C80, 0x2C94, 0x2C95,
+	/* VBIF */
+	0x3000, 0x3007, 0x300C, 0x3014, 0x3018, 0x301D, 0x3020, 0x3022,
+	0x3024, 0x3026, 0x3028, 0x302A, 0x302C, 0x302D, 0x3030, 0x3031,
+	0x3034, 0x3036, 0x3038, 0x3038, 0x303C, 0x303D, 0x3040, 0x3040,
+	0x3049, 0x3049, 0x3058, 0x3058, 0x305B, 0x3061, 0x3064, 0x3068,
+	0x306C, 0x306D, 0x3080, 0x3088, 0x308B, 0x308C, 0x3090, 0x3094,
+	0x3098, 0x3098, 0x309C, 0x309C, 0x30C0, 0x30C0, 0x30C8, 0x30C8,
+	0x30D0, 0x30D0, 0x30D8, 0x30D8, 0x30E0, 0x30E0, 0x3100, 0x3100,
+	0x3108, 0x3108, 0x3110, 0x3110, 0x3118, 0x3118, 0x3120, 0x3120,
+	0x3124, 0x3125, 0x3129, 0x3129, 0x3131, 0x3131, 0x330C, 0x330C,
+	0x3310, 0x3310, 0x3400, 0x3401, 0x3410, 0x3410, 0x3412, 0x3416,
+	0x341D, 0x3420, 0x3428, 0x3428, 0x3430, 0x3430, 0x3432, 0x3436,
+	0x3440, 0x3440, 0x3450, 0x3450, 0x3452, 0x3456, 0x3480, 0x3480,
+	0x3494, 0x3495, 0x4000, 0x4000, 0x4002, 0x4002, 0x4004, 0x4004,
+	0x4008, 0x400A, 0x400C, 0x400D, 0x400F, 0x4012, 0x4014, 0x4016,
+	0x401D, 0x401D, 0x4020, 0x4027, 0x4060, 0x4062, 0x4200, 0x4200,
+	0x4300, 0x4300, 0x4400, 0x4400, 0x4500, 0x4500, 0x4800, 0x4802,
+	0x480F, 0x480F, 0x4811, 0x4811, 0x4813, 0x4813, 0x4815, 0x4816,
+	0x482B, 0x482B, 0x4857, 0x4857, 0x4883, 0x4883, 0x48AF, 0x48AF,
+	0x48C5, 0x48C5, 0x48E5, 0x48E5, 0x4905, 0x4905, 0x4925, 0x4925,
+	0x4945, 0x4945, 0x4950, 0x4950, 0x495B, 0x495B, 0x4980, 0x498E,
+	0x4B00, 0x4B00, 0x4C00, 0x4C00, 0x4D00, 0x4D00, 0x4E00, 0x4E00,
+	0x4E80, 0x4E80, 0x4F00, 0x4F00, 0x4F08, 0x4F08, 0x4F10, 0x4F10,
+	0x4F18, 0x4F18, 0x4F20, 0x4F20, 0x4F30, 0x4F30, 0x4F60, 0x4F60,
+	0x4F80, 0x4F81, 0x4F88, 0x4F89, 0x4FEE, 0x4FEE, 0x4FF3, 0x4FF3,
+	0x6000, 0x6001, 0x6008, 0x600F, 0x6014, 0x6016, 0x6018, 0x601B,
+	0x61FD, 0x61FD, 0x623C, 0x623C, 0x6380, 0x6380, 0x63A0, 0x63A0,
+	0x63C0, 0x63C1, 0x63C8, 0x63C9, 0x63D0, 0x63D4, 0x63D6, 0x63D6,
+	0x63EE, 0x63EE, 0x6400, 0x6401, 0x6408, 0x640F, 0x6414, 0x6416,
+	0x6418, 0x641B, 0x65FD, 0x65FD, 0x663C, 0x663C, 0x6780, 0x6780,
+	0x67A0, 0x67A0, 0x67C0, 0x67C1, 0x67C8, 0x67C9, 0x67D0, 0x67D4,
+	0x67D6, 0x67D6, 0x67EE, 0x67EE, 0x6800, 0x6801, 0x6808, 0x680F,
+	0x6814, 0x6816, 0x6818, 0x681B, 0x69FD, 0x69FD, 0x6A3C, 0x6A3C,
+	0x6B80, 0x6B80, 0x6BA0, 0x6BA0, 0x6BC0, 0x6BC1, 0x6BC8, 0x6BC9,
+	0x6BD0, 0x6BD4, 0x6BD6, 0x6BD6, 0x6BEE, 0x6BEE,
+	~0 /* sentinel */
+};
+
+static const unsigned int a405_registers[] = {
+	/* RBBM */
+	0x0000, 0x0002, 0x0004, 0x0021, 0x0023, 0x0024, 0x0026, 0x0026,
+	0x0028, 0x002B, 0x002E, 0x0034, 0x0037, 0x0044, 0x0047, 0x0066,
+	0x0068, 0x0095, 0x009C, 0x0170, 0x0174, 0x01AF,
+	/* CP */
+	0x0200, 0x0233, 0x0240, 0x0250, 0x04C0, 0x04DD, 0x0500, 0x050B,
+	0x0578, 0x058F,
+	/* VSC */
+	0x0C00, 0x0C03, 0x0C08, 0x0C41, 0x0C50, 0x0C51,
+	/* GRAS */
+	0x0C80, 0x0C81, 0x0C88, 0x0C8F,
+	/* RB */
+	0x0CC0, 0x0CC0, 0x0CC4, 0x0CD2,
+	/* PC */
+	0x0D00, 0x0D0C, 0x0D10, 0x0D17, 0x0D20, 0x0D23,
+	/* VFD */
+	0x0E40, 0x0E4A,
+	/* VPC */
+	0x0E60, 0x0E61, 0x0E63, 0x0E68,
+	/* UCHE */
+	0x0E80, 0x0E84, 0x0E88, 0x0E95,
+	/* GRAS CTX 0 */
+	0x2000, 0x2004, 0x2008, 0x2067, 0x2070, 0x2078, 0x207B, 0x216E,
+	/* PC CTX 0 */
+	0x21C0, 0x21C6, 0x21D0, 0x21D0, 0x21D9, 0x21D9, 0x21E5, 0x21E7,
+	/* VFD CTX 0 */
+	0x2200, 0x2204, 0x2208, 0x22A9,
+	/* GRAS CTX 1 */
+	0x2400, 0x2404, 0x2408, 0x2467, 0x2470, 0x2478, 0x247B, 0x256E,
+	/* PC CTX 1 */
+	0x25C0, 0x25C6, 0x25D0, 0x25D0, 0x25D9, 0x25D9, 0x25E5, 0x25E7,
+	/* VFD CTX 1 */
+	0x2600, 0x2604, 0x2608, 0x26A9,
+	/* VBIF version 0x20050000*/
+	0x3000, 0x3007, 0x302C, 0x302C, 0x3030, 0x3030, 0x3034, 0x3036,
+	0x3038, 0x3038, 0x303C, 0x303D, 0x3040, 0x3040, 0x3049, 0x3049,
+	0x3058, 0x3058, 0x305B, 0x3061, 0x3064, 0x3068, 0x306C, 0x306D,
+	0x3080, 0x3088, 0x308B, 0x308C, 0x3090, 0x3094, 0x3098, 0x3098,
+	0x309C, 0x309C, 0x30C0, 0x30C0, 0x30C8, 0x30C8, 0x30D0, 0x30D0,
+	0x30D8, 0x30D8, 0x30E0, 0x30E0, 0x3100, 0x3100, 0x3108, 0x3108,
+	0x3110, 0x3110, 0x3118, 0x3118, 0x3120, 0x3120, 0x3124, 0x3125,
+	0x3129, 0x3129, 0x340C, 0x340C, 0x3410, 0x3410,
+	~0 /* sentinel */
+};
+
+static struct msm_gpu_state *a4xx_gpu_state_get(struct msm_gpu *gpu)
+{
+	struct msm_gpu_state *state = kzalloc(sizeof(*state), GFP_KERNEL);
+
+	if (!state)
+		return ERR_PTR(-ENOMEM);
+
+	adreno_gpu_state_get(gpu, state);
+
+	state->rbbm_status = gpu_read(gpu, REG_A4XX_RBBM_STATUS);
+
+	return state;
+}
+
+static void a4xx_dump(struct msm_gpu *gpu)
+{
+	printk("status:   %08x\n",
+			gpu_read(gpu, REG_A4XX_RBBM_STATUS));
+	adreno_dump(gpu);
+}
+
+static int a4xx_pm_resume(struct msm_gpu *gpu) {
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int ret;
+
+	ret = msm_gpu_pm_resume(gpu);
+	if (ret)
+		return ret;
+
+	if (adreno_is_a430(adreno_gpu)) {
+		unsigned int reg;
+		/* Set the default register values; set SW_COLLAPSE to 0 */
+		gpu_write(gpu, REG_A4XX_RBBM_POWER_CNTL_IP, 0x778000);
+		do {
+			udelay(5);
+			reg = gpu_read(gpu, REG_A4XX_RBBM_POWER_STATUS);
+		} while (!(reg & A4XX_RBBM_POWER_CNTL_IP_SP_TP_PWR_ON));
+	}
+	return 0;
+}
+
+static int a4xx_pm_suspend(struct msm_gpu *gpu) {
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int ret;
+
+	ret = msm_gpu_pm_suspend(gpu);
+	if (ret)
+		return ret;
+
+	if (adreno_is_a430(adreno_gpu)) {
+		/* Set the default register values; set SW_COLLAPSE to 1 */
+		gpu_write(gpu, REG_A4XX_RBBM_POWER_CNTL_IP, 0x778001);
+	}
+	return 0;
+}
+
+static int a4xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+{
+	*value = gpu_read64(gpu, REG_A4XX_RBBM_PERFCTR_CP_0_LO);
+
+	return 0;
+}
+
+static u64 a4xx_gpu_busy(struct msm_gpu *gpu, unsigned long *out_sample_rate)
+{
+	u64 busy_cycles;
+
+	busy_cycles = gpu_read64(gpu, REG_A4XX_RBBM_PERFCTR_RBBM_1_LO);
+	*out_sample_rate = clk_get_rate(gpu->core_clk);
+
+	return busy_cycles;
+}
+
+static u32 a4xx_get_rptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	ring->memptrs->rptr = gpu_read(gpu, REG_A4XX_CP_RB_RPTR);
+	return ring->memptrs->rptr;
+}
+
+static const struct adreno_gpu_funcs funcs = {
+	.base = {
+		.get_param = adreno_get_param,
+		.set_param = adreno_set_param,
+		.hw_init = a4xx_hw_init,
+		.pm_suspend = a4xx_pm_suspend,
+		.pm_resume = a4xx_pm_resume,
+		.recover = a4xx_recover,
+		.submit = a4xx_submit,
+		.active_ring = adreno_active_ring,
+		.irq = a4xx_irq,
+		.destroy = a4xx_destroy,
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
+		.show = adreno_show,
+#endif
+		.gpu_busy = a4xx_gpu_busy,
+		.gpu_state_get = a4xx_gpu_state_get,
+		.gpu_state_put = adreno_gpu_state_put,
+		.create_address_space = adreno_create_address_space,
+		.get_rptr = a4xx_get_rptr,
+	},
+	.get_timestamp = a4xx_get_timestamp,
+};
+
+struct msm_gpu *a4xx_gpu_init(struct drm_device *dev)
+{
+	struct a4xx_gpu *a4xx_gpu = NULL;
+	struct adreno_gpu *adreno_gpu;
+	struct msm_gpu *gpu;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct platform_device *pdev = priv->gpu_pdev;
+	struct icc_path *ocmem_icc_path;
+	struct icc_path *icc_path;
+	int ret;
+
+	if (!pdev) {
+		DRM_DEV_ERROR(dev->dev, "no a4xx device\n");
+		ret = -ENXIO;
+		goto fail;
+	}
+
+	a4xx_gpu = kzalloc(sizeof(*a4xx_gpu), GFP_KERNEL);
+	if (!a4xx_gpu) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	adreno_gpu = &a4xx_gpu->base;
+	gpu = &adreno_gpu->base;
+
+	gpu->perfcntrs = NULL;
+	gpu->num_perfcntrs = 0;
+
+	ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
+	if (ret)
+		goto fail;
+
+	adreno_gpu->registers = adreno_is_a405(adreno_gpu) ? a405_registers :
+							     a4xx_registers;
+
+	/* if needed, allocate gmem: */
+	ret = adreno_gpu_ocmem_init(dev->dev, adreno_gpu,
+				    &a4xx_gpu->ocmem);
+	if (ret)
+		goto fail;
+
+	if (!gpu->aspace) {
+		/* TODO we think it is possible to configure the GPU to
+		 * restrict access to VRAM carveout.  But the required
+		 * registers are unknown.  For now just bail out and
+		 * limp along with just modesetting.  If it turns out
+		 * to not be possible to restrict access, then we must
+		 * implement a cmdstream validator.
+		 */
+		DRM_DEV_ERROR(dev->dev, "No memory protection without IOMMU\n");
+		if (!allow_vram_carveout) {
+			ret = -ENXIO;
+			goto fail;
+		}
+	}
+
+	icc_path = devm_of_icc_get(&pdev->dev, "gfx-mem");
+	if (IS_ERR(icc_path)) {
+		ret = PTR_ERR(icc_path);
+		goto fail;
+	}
+
+	ocmem_icc_path = devm_of_icc_get(&pdev->dev, "ocmem");
+	if (IS_ERR(ocmem_icc_path)) {
+		ret = PTR_ERR(ocmem_icc_path);
+		/* allow -ENODATA, ocmem icc is optional */
+		if (ret != -ENODATA)
+			goto fail;
+		ocmem_icc_path = NULL;
+	}
+
+	/*
+	 * Set the ICC path to maximum speed for now by multiplying the fastest
+	 * frequency by the bus width (8). We'll want to scale this later on to
+	 * improve battery life.
+	 */
+	icc_set_bw(icc_path, 0, Bps_to_icc(gpu->fast_rate) * 8);
+	icc_set_bw(ocmem_icc_path, 0, Bps_to_icc(gpu->fast_rate) * 8);
+
+	return gpu;
+
+fail:
+	if (a4xx_gpu)
+		a4xx_destroy(&a4xx_gpu->base.base);
+
+	return ERR_PTR(ret);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a4xx_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a4xx_gpu.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ */
+#ifndef __A4XX_GPU_H__
+#define __A4XX_GPU_H__
+
+#include "adreno_gpu.h"
+
+/* arrg, somehow fb.h is getting pulled in: */
+#undef ROP_COPY
+#undef ROP_XOR
+
+#include "a4xx.xml.h"
+
+struct a4xx_gpu {
+	struct adreno_gpu base;
+
+	/* if OCMEM is used for GMEM: */
+	struct adreno_ocmem ocmem;
+};
+#define to_a4xx_gpu(x) container_of(x, struct a4xx_gpu, base)
+
+#endif /* __A4XX_GPU_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a5xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a5xx_catalog.c
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+
+static const struct adreno_info a5xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x05000600),
+		.family = ADRENO_5XX,
+		.revn = 506,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = (SZ_128K + SZ_8K),
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_TWO_PASS_USE_WFI |
+			  ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		.zapfw = "a506_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05000800),
+		.family = ADRENO_5XX,
+		.revn = 508,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = (SZ_128K + SZ_8K),
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		.zapfw = "a508_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05000900),
+		.family = ADRENO_5XX,
+		.revn = 509,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = (SZ_256K + SZ_16K),
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		/* Adreno 509 uses the same ZAP as 512 */
+		.zapfw = "a512_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05010000),
+		.family = ADRENO_5XX,
+		.revn = 510,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = SZ_256K,
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.init = a5xx_gpu_init,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05010200),
+		.family = ADRENO_5XX,
+		.revn = 512,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+		},
+		.gmem = (SZ_256K + SZ_16K),
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		.zapfw = "a512_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(
+			0x05030002,
+			0x05030004
+		),
+		.family = ADRENO_5XX,
+		.revn = 530,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+			[ADRENO_FW_GPMU] = "a530v3_gpmu.fw2",
+		},
+		.gmem = SZ_1M,
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_TWO_PASS_USE_WFI |
+			ADRENO_QUIRK_FAULT_DETECT_MASK,
+		.init = a5xx_gpu_init,
+		.zapfw = "a530_zap.mdt",
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x05040001),
+		.family = ADRENO_5XX,
+		.revn = 540,
+		.fw = {
+			[ADRENO_FW_PM4] = "a530_pm4.fw",
+			[ADRENO_FW_PFP] = "a530_pfp.fw",
+			[ADRENO_FW_GPMU] = "a540_gpmu.fw2",
+		},
+		.gmem = SZ_1M,
+		/*
+		 * Increase inactive period to 250 to avoid bouncing
+		 * the GDSC which appears to make it grumpy
+		 */
+		.inactive_period = 250,
+		.quirks = ADRENO_QUIRK_LMLOADKILL_DISABLE,
+		.init = a5xx_gpu_init,
+		.zapfw = "a540_zap.mdt",
+	}
+};
+DECLARE_ADRENO_GPULIST(a5xx);
+
+MODULE_FIRMWARE("qcom/a530_pm4.fw");
+MODULE_FIRMWARE("qcom/a530_pfp.fw");
+MODULE_FIRMWARE("qcom/a530v3_gpmu.fw2");
+MODULE_FIRMWARE("qcom/a530_zap.mdt");
+MODULE_FIRMWARE("qcom/a530_zap.b00");
+MODULE_FIRMWARE("qcom/a530_zap.b01");
+MODULE_FIRMWARE("qcom/a530_zap.b02");
+MODULE_FIRMWARE("qcom/a540_gpmu.fw2");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a5xx_debugfs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a5xx_debugfs.c
@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/types.h>
+#include <linux/debugfs.h>
+
+#include <drm/drm_debugfs.h>
+#include <drm/drm_file.h>
+#include <drm/drm_print.h>
+
+#include "a5xx_gpu.h"
+
+static void pfp_print(struct msm_gpu *gpu, struct drm_printer *p)
+{
+	int i;
+
+	drm_printf(p, "PFP state:\n");
+
+	for (i = 0; i < 36; i++) {
+		gpu_write(gpu, REG_A5XX_CP_PFP_STAT_ADDR, i);
+		drm_printf(p, "  %02x: %08x\n", i,
+			gpu_read(gpu, REG_A5XX_CP_PFP_STAT_DATA));
+	}
+}
+
+static void me_print(struct msm_gpu *gpu, struct drm_printer *p)
+{
+	int i;
+
+	drm_printf(p, "ME state:\n");
+
+	for (i = 0; i < 29; i++) {
+		gpu_write(gpu, REG_A5XX_CP_ME_STAT_ADDR, i);
+		drm_printf(p, "  %02x: %08x\n", i,
+			gpu_read(gpu, REG_A5XX_CP_ME_STAT_DATA));
+	}
+}
+
+static void meq_print(struct msm_gpu *gpu, struct drm_printer *p)
+{
+	int i;
+
+	drm_printf(p, "MEQ state:\n");
+	gpu_write(gpu, REG_A5XX_CP_MEQ_DBG_ADDR, 0);
+
+	for (i = 0; i < 64; i++) {
+		drm_printf(p, "  %02x: %08x\n", i,
+			gpu_read(gpu, REG_A5XX_CP_MEQ_DBG_DATA));
+	}
+}
+
+static void roq_print(struct msm_gpu *gpu, struct drm_printer *p)
+{
+	int i;
+
+	drm_printf(p, "ROQ state:\n");
+	gpu_write(gpu, REG_A5XX_CP_ROQ_DBG_ADDR, 0);
+
+	for (i = 0; i < 512 / 4; i++) {
+		uint32_t val[4];
+		int j;
+		for (j = 0; j < 4; j++)
+			val[j] = gpu_read(gpu, REG_A5XX_CP_ROQ_DBG_DATA);
+		drm_printf(p, "  %02x: %08x %08x %08x %08x\n", i,
+			val[0], val[1], val[2], val[3]);
+	}
+}
+
+static int show(struct seq_file *m, void *arg)
+{
+	struct drm_info_node *node = m->private;
+	struct drm_device *dev = node->minor->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct drm_printer p = drm_seq_file_printer(m);
+	void (*show)(struct msm_gpu *gpu, struct drm_printer *p) =
+		node->info_ent->data;
+
+	show(priv->gpu, &p);
+	return 0;
+}
+
+#define ENT(n) { .name = #n, .show = show, .data = n ##_print }
+static struct drm_info_list a5xx_debugfs_list[] = {
+	ENT(pfp),
+	ENT(me),
+	ENT(meq),
+	ENT(roq),
+};
+
+/* for debugfs files that can be written to, we can't use drm helper: */
+static int
+reset_set(void *data, u64 val)
+{
+	struct drm_device *dev = data;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_gpu *gpu = priv->gpu;
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EINVAL;
+
+	/* TODO do we care about trying to make sure the GPU is idle?
+	 * Since this is just a debug feature limited to CAP_SYS_ADMIN,
+	 * maybe it is fine to let the user keep both pieces if they
+	 * try to reset an active GPU.
+	 */
+
+	mutex_lock(&gpu->lock);
+
+	release_firmware(adreno_gpu->fw[ADRENO_FW_PM4]);
+	adreno_gpu->fw[ADRENO_FW_PM4] = NULL;
+
+	release_firmware(adreno_gpu->fw[ADRENO_FW_PFP]);
+	adreno_gpu->fw[ADRENO_FW_PFP] = NULL;
+
+	if (a5xx_gpu->pm4_bo) {
+		msm_gem_unpin_iova(a5xx_gpu->pm4_bo, gpu->aspace);
+		drm_gem_object_put(a5xx_gpu->pm4_bo);
+		a5xx_gpu->pm4_bo = NULL;
+	}
+
+	if (a5xx_gpu->pfp_bo) {
+		msm_gem_unpin_iova(a5xx_gpu->pfp_bo, gpu->aspace);
+		drm_gem_object_put(a5xx_gpu->pfp_bo);
+		a5xx_gpu->pfp_bo = NULL;
+	}
+
+	gpu->needs_hw_init = true;
+
+	pm_runtime_get_sync(&gpu->pdev->dev);
+	gpu->funcs->recover(gpu);
+
+	pm_runtime_put_sync(&gpu->pdev->dev);
+	mutex_unlock(&gpu->lock);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(reset_fops, NULL, reset_set, "%llx\n");
+
+
+void a5xx_debugfs_init(struct msm_gpu *gpu, struct drm_minor *minor)
+{
+	struct drm_device *dev;
+
+	if (!minor)
+		return;
+
+	dev = minor->dev;
+
+	drm_debugfs_create_files(a5xx_debugfs_list,
+				 ARRAY_SIZE(a5xx_debugfs_list),
+				 minor->debugfs_root, minor);
+
+	debugfs_create_file_unsafe("reset", S_IWUGO, minor->debugfs_root, dev,
+				&reset_fops);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a5xx_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a5xx_gpu.c
@@ -0,0 +1,1804 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/cpumask.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/pm_opp.h>
+#include <linux/nvmem-consumer.h>
+#include <linux/slab.h>
+#include "msm_gem.h"
+#include "msm_mmu.h"
+#include "a5xx_gpu.h"
+
+extern bool hang_debug;
+static void a5xx_dump(struct msm_gpu *gpu);
+
+#define GPU_PAS_ID 13
+
+static void update_shadow_rptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+
+	if (a5xx_gpu->has_whereami) {
+		OUT_PKT7(ring, CP_WHERE_AM_I, 2);
+		OUT_RING(ring, lower_32_bits(shadowptr(a5xx_gpu, ring)));
+		OUT_RING(ring, upper_32_bits(shadowptr(a5xx_gpu, ring)));
+	}
+}
+
+void a5xx_flush(struct msm_gpu *gpu, struct msm_ringbuffer *ring,
+		bool sync)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	uint32_t wptr;
+	unsigned long flags;
+
+	/*
+	 * Most flush operations need to issue a WHERE_AM_I opcode to sync up
+	 * the rptr shadow
+	 */
+	if (sync)
+		update_shadow_rptr(gpu, ring);
+
+	spin_lock_irqsave(&ring->preempt_lock, flags);
+
+	/* Copy the shadow to the actual register */
+	ring->cur = ring->next;
+
+	/* Make sure to wrap wptr if we need to */
+	wptr = get_wptr(ring);
+
+	spin_unlock_irqrestore(&ring->preempt_lock, flags);
+
+	/* Make sure everything is posted before making a decision */
+	mb();
+
+	/* Update HW if this is the current ring and we are not in preempt */
+	if (a5xx_gpu->cur_ring == ring && !a5xx_in_preempt(a5xx_gpu))
+		gpu_write(gpu, REG_A5XX_CP_RB_WPTR, wptr);
+}
+
+static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	struct msm_ringbuffer *ring = submit->ring;
+	struct drm_gem_object *obj;
+	uint32_t *ptr, dwords;
+	unsigned int i;
+
+	for (i = 0; i < submit->nr_cmds; i++) {
+		switch (submit->cmd[i].type) {
+		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
+			break;
+		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
+			if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)
+				break;
+			fallthrough;
+		case MSM_SUBMIT_CMD_BUF:
+			/* copy commands into RB: */
+			obj = submit->bos[submit->cmd[i].idx].obj;
+			dwords = submit->cmd[i].size;
+
+			ptr = msm_gem_get_vaddr(obj);
+
+			/* _get_vaddr() shouldn't fail at this point,
+			 * since we've already mapped it once in
+			 * submit_reloc()
+			 */
+			if (WARN_ON(IS_ERR_OR_NULL(ptr)))
+				return;
+
+			for (i = 0; i < dwords; i++) {
+				/* normally the OUT_PKTn() would wait
+				 * for space for the packet.  But since
+				 * we just OUT_RING() the whole thing,
+				 * need to call adreno_wait_ring()
+				 * ourself:
+				 */
+				adreno_wait_ring(ring, 1);
+				OUT_RING(ring, ptr[i]);
+			}
+
+			msm_gem_put_vaddr(obj);
+
+			break;
+		}
+	}
+
+	a5xx_gpu->last_seqno[ring->id] = submit->seqno;
+	a5xx_flush(gpu, ring, true);
+	a5xx_preempt_trigger(gpu);
+
+	/* we might not necessarily have a cmd from userspace to
+	 * trigger an event to know that submit has completed, so
+	 * do this manually:
+	 */
+	a5xx_idle(gpu, ring);
+	ring->memptrs->fence = submit->seqno;
+	msm_gpu_retire(gpu);
+}
+
+static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	struct msm_ringbuffer *ring = submit->ring;
+	unsigned int i, ibs = 0;
+
+	if (IS_ENABLED(CONFIG_DRM_MSM_GPU_SUDO) && submit->in_rb) {
+		gpu->cur_ctx_seqno = 0;
+		a5xx_submit_in_rb(gpu, submit);
+		return;
+	}
+
+	OUT_PKT7(ring, CP_PREEMPT_ENABLE_GLOBAL, 1);
+	OUT_RING(ring, 0x02);
+
+	/* Turn off protected mode to write to special registers */
+	OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
+	OUT_RING(ring, 0);
+
+	/* Set the save preemption record for the ring/command */
+	OUT_PKT4(ring, REG_A5XX_CP_CONTEXT_SWITCH_SAVE_ADDR_LO, 2);
+	OUT_RING(ring, lower_32_bits(a5xx_gpu->preempt_iova[submit->ring->id]));
+	OUT_RING(ring, upper_32_bits(a5xx_gpu->preempt_iova[submit->ring->id]));
+
+	/* Turn back on protected mode */
+	OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
+	OUT_RING(ring, 1);
+
+	/*
+	 * Disable local preemption by default because it requires
+	 * user-space to be aware of it and provide additional handling
+	 * to restore rendering state or do various flushes on switch.
+	 */
+	OUT_PKT7(ring, CP_PREEMPT_ENABLE_LOCAL, 1);
+	OUT_RING(ring, 0x0);
+
+	/* Allow CP_CONTEXT_SWITCH_YIELD packets in the IB2 */
+	OUT_PKT7(ring, CP_YIELD_ENABLE, 1);
+	OUT_RING(ring, 0x02);
+
+	/* Submit the commands */
+	for (i = 0; i < submit->nr_cmds; i++) {
+		switch (submit->cmd[i].type) {
+		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
+			break;
+		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
+			if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)
+				break;
+			fallthrough;
+		case MSM_SUBMIT_CMD_BUF:
+			OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
+			OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
+			OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
+			OUT_RING(ring, submit->cmd[i].size);
+			ibs++;
+			break;
+		}
+
+		/*
+		 * Periodically update shadow-wptr if needed, so that we
+		 * can see partial progress of submits with large # of
+		 * cmds.. otherwise we could needlessly stall waiting for
+		 * ringbuffer state, simply due to looking at a shadow
+		 * rptr value that has not been updated
+		 */
+		if ((ibs % 32) == 0)
+			update_shadow_rptr(gpu, ring);
+	}
+
+	/*
+	 * Write the render mode to NULL (0) to indicate to the CP that the IBs
+	 * are done rendering - otherwise a lucky preemption would start
+	 * replaying from the last checkpoint
+	 */
+	OUT_PKT7(ring, CP_SET_RENDER_MODE, 5);
+	OUT_RING(ring, 0);
+	OUT_RING(ring, 0);
+	OUT_RING(ring, 0);
+	OUT_RING(ring, 0);
+	OUT_RING(ring, 0);
+
+	/* Turn off IB level preemptions */
+	OUT_PKT7(ring, CP_YIELD_ENABLE, 1);
+	OUT_RING(ring, 0x01);
+
+	/* Write the fence to the scratch register */
+	OUT_PKT4(ring, REG_A5XX_CP_SCRATCH_REG(2), 1);
+	OUT_RING(ring, submit->seqno);
+	a5xx_gpu->last_seqno[ring->id] = submit->seqno;
+
+	/*
+	 * Execute a CACHE_FLUSH_TS event. This will ensure that the
+	 * timestamp is written to the memory and then triggers the interrupt
+	 */
+	OUT_PKT7(ring, CP_EVENT_WRITE, 4);
+	OUT_RING(ring, CP_EVENT_WRITE_0_EVENT(CACHE_FLUSH_TS) |
+		CP_EVENT_WRITE_0_IRQ);
+	OUT_RING(ring, lower_32_bits(rbmemptr(ring, fence)));
+	OUT_RING(ring, upper_32_bits(rbmemptr(ring, fence)));
+	OUT_RING(ring, submit->seqno);
+
+	/* Yield the floor on command completion */
+	OUT_PKT7(ring, CP_CONTEXT_SWITCH_YIELD, 4);
+	/*
+	 * If dword[2:1] are non zero, they specify an address for the CP to
+	 * write the value of dword[3] to on preemption complete. Write 0 to
+	 * skip the write
+	 */
+	OUT_RING(ring, 0x00);
+	OUT_RING(ring, 0x00);
+	/* Data value - not used if the address above is 0 */
+	OUT_RING(ring, 0x01);
+	/* Set bit 0 to trigger an interrupt on preempt complete */
+	OUT_RING(ring, 0x01);
+
+	/* A WHERE_AM_I packet is not needed after a YIELD */
+	a5xx_flush(gpu, ring, false);
+
+	/* Check to see if we need to start preemption */
+	a5xx_preempt_trigger(gpu);
+}
+
+static const struct adreno_five_hwcg_regs {
+	u32 offset;
+	u32 value;
+} a5xx_hwcg[] = {
+	{REG_A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_SP2, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_SP3, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_SP1, 0x02222220},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_SP2, 0x02222220},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_SP3, 0x02222220},
+	{REG_A5XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A5XX_RBBM_CLOCK_HYST_SP1, 0x0000F3CF},
+	{REG_A5XX_RBBM_CLOCK_HYST_SP2, 0x0000F3CF},
+	{REG_A5XX_RBBM_CLOCK_HYST_SP3, 0x0000F3CF},
+	{REG_A5XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A5XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
+	{REG_A5XX_RBBM_CLOCK_DELAY_SP2, 0x00000080},
+	{REG_A5XX_RBBM_CLOCK_DELAY_SP3, 0x00000080},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TP1, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TP2, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TP3, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_TP2, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_TP3, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_TP0, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_TP1, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_TP2, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_TP3, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST_TP2, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST_TP3, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST2_TP2, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST2_TP3, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST3_TP0, 0x00007777},
+	{REG_A5XX_RBBM_CLOCK_HYST3_TP1, 0x00007777},
+	{REG_A5XX_RBBM_CLOCK_HYST3_TP2, 0x00007777},
+	{REG_A5XX_RBBM_CLOCK_HYST3_TP3, 0x00007777},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TP2, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TP3, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY2_TP2, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY2_TP3, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY3_TP0, 0x00001111},
+	{REG_A5XX_RBBM_CLOCK_DELAY3_TP1, 0x00001111},
+	{REG_A5XX_RBBM_CLOCK_DELAY3_TP2, 0x00001111},
+	{REG_A5XX_RBBM_CLOCK_DELAY3_TP3, 0x00001111},
+	{REG_A5XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_HYST_UCHE, 0x00444444},
+	{REG_A5XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RB2, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RB3, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RB0, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RB1, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RB2, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RB3, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_CCU0, 0x00022220},
+	{REG_A5XX_RBBM_CLOCK_CNTL_CCU1, 0x00022220},
+	{REG_A5XX_RBBM_CLOCK_CNTL_CCU2, 0x00022220},
+	{REG_A5XX_RBBM_CLOCK_CNTL_CCU3, 0x00022220},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RAC, 0x05522222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RAC, 0x00505555},
+	{REG_A5XX_RBBM_CLOCK_HYST_RB_CCU0, 0x04040404},
+	{REG_A5XX_RBBM_CLOCK_HYST_RB_CCU1, 0x04040404},
+	{REG_A5XX_RBBM_CLOCK_HYST_RB_CCU2, 0x04040404},
+	{REG_A5XX_RBBM_CLOCK_HYST_RB_CCU3, 0x04040404},
+	{REG_A5XX_RBBM_CLOCK_HYST_RAC, 0x07444044},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_0, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_1, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_2, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_3, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RAC, 0x00010011},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A5XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A5XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A5XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A5XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A5XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222}
+}, a50x_hwcg[] = {
+	{REG_A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A5XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A5XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_TP0, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST3_TP0, 0x00007777},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY3_TP0, 0x00001111},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_HYST_UCHE, 0x00FFFFF4},
+	{REG_A5XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RB0, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_CCU0, 0x00022220},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RAC, 0x05522222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RAC, 0x00505555},
+	{REG_A5XX_RBBM_CLOCK_HYST_RB_CCU0, 0x04040404},
+	{REG_A5XX_RBBM_CLOCK_HYST_RAC, 0x07444044},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_0, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RAC, 0x00010011},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A5XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A5XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A5XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A5XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A5XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+}, a512_hwcg[] = {
+	{REG_A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_SP1, 0x02222220},
+	{REG_A5XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A5XX_RBBM_CLOCK_HYST_SP1, 0x0000F3CF},
+	{REG_A5XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A5XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TP1, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_TP0, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_TP1, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{REG_A5XX_RBBM_CLOCK_HYST3_TP0, 0x00007777},
+	{REG_A5XX_RBBM_CLOCK_HYST3_TP1, 0x00007777},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{REG_A5XX_RBBM_CLOCK_DELAY3_TP0, 0x00001111},
+	{REG_A5XX_RBBM_CLOCK_DELAY3_TP1, 0x00001111},
+	{REG_A5XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_HYST_UCHE, 0x00444444},
+	{REG_A5XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RB0, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RB1, 0x00222222},
+	{REG_A5XX_RBBM_CLOCK_CNTL_CCU0, 0x00022220},
+	{REG_A5XX_RBBM_CLOCK_CNTL_CCU1, 0x00022220},
+	{REG_A5XX_RBBM_CLOCK_CNTL_RAC, 0x05522222},
+	{REG_A5XX_RBBM_CLOCK_CNTL2_RAC, 0x00505555},
+	{REG_A5XX_RBBM_CLOCK_HYST_RB_CCU0, 0x04040404},
+	{REG_A5XX_RBBM_CLOCK_HYST_RB_CCU1, 0x04040404},
+	{REG_A5XX_RBBM_CLOCK_HYST_RAC, 0x07444044},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_0, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_1, 0x00000002},
+	{REG_A5XX_RBBM_CLOCK_DELAY_RAC, 0x00010011},
+	{REG_A5XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A5XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{REG_A5XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A5XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A5XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A5XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A5XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A5XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A5XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+};
+
+void a5xx_set_hwcg(struct msm_gpu *gpu, bool state)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	const struct adreno_five_hwcg_regs *regs;
+	unsigned int i, sz;
+
+	if (adreno_is_a506(adreno_gpu) || adreno_is_a508(adreno_gpu)) {
+		regs = a50x_hwcg;
+		sz = ARRAY_SIZE(a50x_hwcg);
+	} else if (adreno_is_a509(adreno_gpu) || adreno_is_a512(adreno_gpu)) {
+		regs = a512_hwcg;
+		sz = ARRAY_SIZE(a512_hwcg);
+	} else {
+		regs = a5xx_hwcg;
+		sz = ARRAY_SIZE(a5xx_hwcg);
+	}
+
+	for (i = 0; i < sz; i++)
+		gpu_write(gpu, regs[i].offset,
+			  state ? regs[i].value : 0);
+
+	if (adreno_is_a540(adreno_gpu)) {
+		gpu_write(gpu, REG_A5XX_RBBM_CLOCK_DELAY_GPMU, state ? 0x00000770 : 0);
+		gpu_write(gpu, REG_A5XX_RBBM_CLOCK_HYST_GPMU, state ? 0x00000004 : 0);
+	}
+
+	gpu_write(gpu, REG_A5XX_RBBM_CLOCK_CNTL, state ? 0xAAA8AA00 : 0);
+	gpu_write(gpu, REG_A5XX_RBBM_ISDB_CNT, state ? 0x182 : 0x180);
+}
+
+static int a5xx_me_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct msm_ringbuffer *ring = gpu->rb[0];
+
+	OUT_PKT7(ring, CP_ME_INIT, 8);
+
+	OUT_RING(ring, 0x0000002F);
+
+	/* Enable multiple hardware contexts */
+	OUT_RING(ring, 0x00000003);
+
+	/* Enable error detection */
+	OUT_RING(ring, 0x20000000);
+
+	/* Don't enable header dump */
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+
+	/* Specify workarounds for various microcode issues */
+	if (adreno_is_a506(adreno_gpu) || adreno_is_a530(adreno_gpu)) {
+		/* Workaround for token end syncs
+		 * Force a WFI after every direct-render 3D mode draw and every
+		 * 2D mode 3 draw
+		 */
+		OUT_RING(ring, 0x0000000B);
+	} else if (adreno_is_a510(adreno_gpu)) {
+		/* Workaround for token and syncs */
+		OUT_RING(ring, 0x00000001);
+	} else {
+		/* No workarounds enabled */
+		OUT_RING(ring, 0x00000000);
+	}
+
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+
+	a5xx_flush(gpu, ring, true);
+	return a5xx_idle(gpu, ring) ? 0 : -EINVAL;
+}
+
+static int a5xx_preempt_start(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	struct msm_ringbuffer *ring = gpu->rb[0];
+
+	if (gpu->nr_rings == 1)
+		return 0;
+
+	/* Turn off protected mode to write to special registers */
+	OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
+	OUT_RING(ring, 0);
+
+	/* Set the save preemption record for the ring/command */
+	OUT_PKT4(ring, REG_A5XX_CP_CONTEXT_SWITCH_SAVE_ADDR_LO, 2);
+	OUT_RING(ring, lower_32_bits(a5xx_gpu->preempt_iova[ring->id]));
+	OUT_RING(ring, upper_32_bits(a5xx_gpu->preempt_iova[ring->id]));
+
+	/* Turn back on protected mode */
+	OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
+	OUT_RING(ring, 1);
+
+	OUT_PKT7(ring, CP_PREEMPT_ENABLE_GLOBAL, 1);
+	OUT_RING(ring, 0x00);
+
+	OUT_PKT7(ring, CP_PREEMPT_ENABLE_LOCAL, 1);
+	OUT_RING(ring, 0x01);
+
+	OUT_PKT7(ring, CP_YIELD_ENABLE, 1);
+	OUT_RING(ring, 0x01);
+
+	/* Yield the floor on command completion */
+	OUT_PKT7(ring, CP_CONTEXT_SWITCH_YIELD, 4);
+	OUT_RING(ring, 0x00);
+	OUT_RING(ring, 0x00);
+	OUT_RING(ring, 0x01);
+	OUT_RING(ring, 0x01);
+
+	/* The WHERE_AMI_I packet is not needed after a YIELD is issued */
+	a5xx_flush(gpu, ring, false);
+
+	return a5xx_idle(gpu, ring) ? 0 : -EINVAL;
+}
+
+static void a5xx_ucode_check_version(struct a5xx_gpu *a5xx_gpu,
+		struct drm_gem_object *obj)
+{
+	u32 *buf = msm_gem_get_vaddr(obj);
+
+	if (IS_ERR(buf))
+		return;
+
+	/*
+	 * If the lowest nibble is 0xa that is an indication that this microcode
+	 * has been patched. The actual version is in dword [3] but we only care
+	 * about the patchlevel which is the lowest nibble of dword [3]
+	 */
+	if (((buf[0] & 0xf) == 0xa) && (buf[2] & 0xf) >= 1)
+		a5xx_gpu->has_whereami = true;
+
+	msm_gem_put_vaddr(obj);
+}
+
+static int a5xx_ucode_load(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	int ret;
+
+	if (!a5xx_gpu->pm4_bo) {
+		a5xx_gpu->pm4_bo = adreno_fw_create_bo(gpu,
+			adreno_gpu->fw[ADRENO_FW_PM4], &a5xx_gpu->pm4_iova);
+
+
+		if (IS_ERR(a5xx_gpu->pm4_bo)) {
+			ret = PTR_ERR(a5xx_gpu->pm4_bo);
+			a5xx_gpu->pm4_bo = NULL;
+			DRM_DEV_ERROR(gpu->dev->dev, "could not allocate PM4: %d\n",
+				ret);
+			return ret;
+		}
+
+		msm_gem_object_set_name(a5xx_gpu->pm4_bo, "pm4fw");
+	}
+
+	if (!a5xx_gpu->pfp_bo) {
+		a5xx_gpu->pfp_bo = adreno_fw_create_bo(gpu,
+			adreno_gpu->fw[ADRENO_FW_PFP], &a5xx_gpu->pfp_iova);
+
+		if (IS_ERR(a5xx_gpu->pfp_bo)) {
+			ret = PTR_ERR(a5xx_gpu->pfp_bo);
+			a5xx_gpu->pfp_bo = NULL;
+			DRM_DEV_ERROR(gpu->dev->dev, "could not allocate PFP: %d\n",
+				ret);
+			return ret;
+		}
+
+		msm_gem_object_set_name(a5xx_gpu->pfp_bo, "pfpfw");
+		a5xx_ucode_check_version(a5xx_gpu, a5xx_gpu->pfp_bo);
+	}
+
+	if (a5xx_gpu->has_whereami) {
+		if (!a5xx_gpu->shadow_bo) {
+			a5xx_gpu->shadow = msm_gem_kernel_new(gpu->dev,
+				sizeof(u32) * gpu->nr_rings,
+				MSM_BO_WC | MSM_BO_MAP_PRIV,
+				gpu->aspace, &a5xx_gpu->shadow_bo,
+				&a5xx_gpu->shadow_iova);
+
+			if (IS_ERR(a5xx_gpu->shadow))
+				return PTR_ERR(a5xx_gpu->shadow);
+
+			msm_gem_object_set_name(a5xx_gpu->shadow_bo, "shadow");
+		}
+	} else if (gpu->nr_rings > 1) {
+		/* Disable preemption if WHERE_AM_I isn't available */
+		a5xx_preempt_fini(gpu);
+		gpu->nr_rings = 1;
+	}
+
+	return 0;
+}
+
+#define SCM_GPU_ZAP_SHADER_RESUME 0
+
+static int a5xx_zap_shader_resume(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int ret;
+
+	/*
+	 * Adreno 506 have CPZ Retention feature and doesn't require
+	 * to resume zap shader
+	 */
+	if (adreno_is_a506(adreno_gpu))
+		return 0;
+
+	ret = qcom_scm_set_remote_state(SCM_GPU_ZAP_SHADER_RESUME, GPU_PAS_ID);
+	if (ret)
+		DRM_ERROR("%s: zap-shader resume failed: %d\n",
+			gpu->name, ret);
+
+	return ret;
+}
+
+static int a5xx_zap_shader_init(struct msm_gpu *gpu)
+{
+	static bool loaded;
+	int ret;
+
+	/*
+	 * If the zap shader is already loaded into memory we just need to kick
+	 * the remote processor to reinitialize it
+	 */
+	if (loaded)
+		return a5xx_zap_shader_resume(gpu);
+
+	ret = adreno_zap_shader_load(gpu, GPU_PAS_ID);
+
+	loaded = !ret;
+	return ret;
+}
+
+#define A5XX_INT_MASK (A5XX_RBBM_INT_0_MASK_RBBM_AHB_ERROR | \
+	  A5XX_RBBM_INT_0_MASK_RBBM_TRANSFER_TIMEOUT | \
+	  A5XX_RBBM_INT_0_MASK_RBBM_ME_MS_TIMEOUT | \
+	  A5XX_RBBM_INT_0_MASK_RBBM_PFP_MS_TIMEOUT | \
+	  A5XX_RBBM_INT_0_MASK_RBBM_ETS_MS_TIMEOUT | \
+	  A5XX_RBBM_INT_0_MASK_RBBM_ATB_ASYNC_OVERFLOW | \
+	  A5XX_RBBM_INT_0_MASK_CP_HW_ERROR | \
+	  A5XX_RBBM_INT_0_MASK_MISC_HANG_DETECT | \
+	  A5XX_RBBM_INT_0_MASK_CP_SW | \
+	  A5XX_RBBM_INT_0_MASK_CP_CACHE_FLUSH_TS | \
+	  A5XX_RBBM_INT_0_MASK_UCHE_OOB_ACCESS | \
+	  A5XX_RBBM_INT_0_MASK_GPMU_VOLTAGE_DROOP)
+
+static int a5xx_hw_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	u32 hbb;
+	int ret;
+
+	gpu_write(gpu, REG_A5XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x00000003);
+
+	if (adreno_is_a509(adreno_gpu) || adreno_is_a512(adreno_gpu) ||
+	    adreno_is_a540(adreno_gpu))
+		gpu_write(gpu, REG_A5XX_VBIF_GATE_OFF_WRREQ_EN, 0x00000009);
+
+	/* Make all blocks contribute to the GPU BUSY perf counter */
+	gpu_write(gpu, REG_A5XX_RBBM_PERFCTR_GPU_BUSY_MASKED, 0xFFFFFFFF);
+
+	/* Enable RBBM error reporting bits */
+	gpu_write(gpu, REG_A5XX_RBBM_AHB_CNTL0, 0x00000001);
+
+	if (adreno_gpu->info->quirks & ADRENO_QUIRK_FAULT_DETECT_MASK) {
+		/*
+		 * Mask out the activity signals from RB1-3 to avoid false
+		 * positives
+		 */
+
+		gpu_write(gpu, REG_A5XX_RBBM_INTERFACE_HANG_MASK_CNTL11,
+			0xF0000000);
+		gpu_write(gpu, REG_A5XX_RBBM_INTERFACE_HANG_MASK_CNTL12,
+			0xFFFFFFFF);
+		gpu_write(gpu, REG_A5XX_RBBM_INTERFACE_HANG_MASK_CNTL13,
+			0xFFFFFFFF);
+		gpu_write(gpu, REG_A5XX_RBBM_INTERFACE_HANG_MASK_CNTL14,
+			0xFFFFFFFF);
+		gpu_write(gpu, REG_A5XX_RBBM_INTERFACE_HANG_MASK_CNTL15,
+			0xFFFFFFFF);
+		gpu_write(gpu, REG_A5XX_RBBM_INTERFACE_HANG_MASK_CNTL16,
+			0xFFFFFFFF);
+		gpu_write(gpu, REG_A5XX_RBBM_INTERFACE_HANG_MASK_CNTL17,
+			0xFFFFFFFF);
+		gpu_write(gpu, REG_A5XX_RBBM_INTERFACE_HANG_MASK_CNTL18,
+			0xFFFFFFFF);
+	}
+
+	/* Enable fault detection */
+	gpu_write(gpu, REG_A5XX_RBBM_INTERFACE_HANG_INT_CNTL,
+		(1 << 30) | 0xFFFF);
+
+	/* Turn on performance counters */
+	gpu_write(gpu, REG_A5XX_RBBM_PERFCTR_CNTL, 0x01);
+
+	/* Select CP0 to always count cycles */
+	gpu_write(gpu, REG_A5XX_CP_PERFCTR_CP_SEL_0, PERF_CP_ALWAYS_COUNT);
+
+	/* Select RBBM0 to countable 6 to get the busy status for devfreq */
+	gpu_write(gpu, REG_A5XX_RBBM_PERFCTR_RBBM_SEL_0, 6);
+
+	/* Increase VFD cache access so LRZ and other data gets evicted less */
+	gpu_write(gpu, REG_A5XX_UCHE_CACHE_WAYS, 0x02);
+
+	/* Disable L2 bypass in the UCHE */
+	gpu_write(gpu, REG_A5XX_UCHE_TRAP_BASE_LO, 0xFFFF0000);
+	gpu_write(gpu, REG_A5XX_UCHE_TRAP_BASE_HI, 0x0001FFFF);
+	gpu_write(gpu, REG_A5XX_UCHE_WRITE_THRU_BASE_LO, 0xFFFF0000);
+	gpu_write(gpu, REG_A5XX_UCHE_WRITE_THRU_BASE_HI, 0x0001FFFF);
+
+	/* Set the GMEM VA range (0 to gpu->gmem) */
+	gpu_write(gpu, REG_A5XX_UCHE_GMEM_RANGE_MIN_LO, 0x00100000);
+	gpu_write(gpu, REG_A5XX_UCHE_GMEM_RANGE_MIN_HI, 0x00000000);
+	gpu_write(gpu, REG_A5XX_UCHE_GMEM_RANGE_MAX_LO,
+		0x00100000 + adreno_gpu->info->gmem - 1);
+	gpu_write(gpu, REG_A5XX_UCHE_GMEM_RANGE_MAX_HI, 0x00000000);
+
+	if (adreno_is_a506(adreno_gpu) || adreno_is_a508(adreno_gpu) ||
+	    adreno_is_a510(adreno_gpu)) {
+		gpu_write(gpu, REG_A5XX_CP_MEQ_THRESHOLDS, 0x20);
+		if (adreno_is_a506(adreno_gpu) || adreno_is_a508(adreno_gpu))
+			gpu_write(gpu, REG_A5XX_CP_MERCIU_SIZE, 0x400);
+		else
+			gpu_write(gpu, REG_A5XX_CP_MERCIU_SIZE, 0x20);
+		gpu_write(gpu, REG_A5XX_CP_ROQ_THRESHOLDS_2, 0x40000030);
+		gpu_write(gpu, REG_A5XX_CP_ROQ_THRESHOLDS_1, 0x20100D0A);
+	} else {
+		gpu_write(gpu, REG_A5XX_CP_MEQ_THRESHOLDS, 0x40);
+		if (adreno_is_a530(adreno_gpu))
+			gpu_write(gpu, REG_A5XX_CP_MERCIU_SIZE, 0x40);
+		else
+			gpu_write(gpu, REG_A5XX_CP_MERCIU_SIZE, 0x400);
+		gpu_write(gpu, REG_A5XX_CP_ROQ_THRESHOLDS_2, 0x80000060);
+		gpu_write(gpu, REG_A5XX_CP_ROQ_THRESHOLDS_1, 0x40201B16);
+	}
+
+	if (adreno_is_a506(adreno_gpu) || adreno_is_a508(adreno_gpu))
+		gpu_write(gpu, REG_A5XX_PC_DBG_ECO_CNTL,
+			  (0x100 << 11 | 0x100 << 22));
+	else if (adreno_is_a509(adreno_gpu) || adreno_is_a510(adreno_gpu) ||
+		 adreno_is_a512(adreno_gpu))
+		gpu_write(gpu, REG_A5XX_PC_DBG_ECO_CNTL,
+			  (0x200 << 11 | 0x200 << 22));
+	else
+		gpu_write(gpu, REG_A5XX_PC_DBG_ECO_CNTL,
+			  (0x400 << 11 | 0x300 << 22));
+
+	if (adreno_gpu->info->quirks & ADRENO_QUIRK_TWO_PASS_USE_WFI)
+		gpu_rmw(gpu, REG_A5XX_PC_DBG_ECO_CNTL, 0, (1 << 8));
+
+	/*
+	 * Disable the RB sampler datapath DP2 clock gating optimization
+	 * for 1-SP GPUs, as it is enabled by default.
+	 */
+	if (adreno_is_a506(adreno_gpu) || adreno_is_a508(adreno_gpu) ||
+	    adreno_is_a509(adreno_gpu) || adreno_is_a512(adreno_gpu))
+		gpu_rmw(gpu, REG_A5XX_RB_DBG_ECO_CNTL, 0, (1 << 9));
+
+	/* Disable UCHE global filter as SP can invalidate/flush independently */
+	gpu_write(gpu, REG_A5XX_UCHE_MODE_CNTL, BIT(29));
+
+	/* Enable USE_RETENTION_FLOPS */
+	gpu_write(gpu, REG_A5XX_CP_CHICKEN_DBG, 0x02000000);
+
+	/* Enable ME/PFP split notification */
+	gpu_write(gpu, REG_A5XX_RBBM_AHB_CNTL1, 0xA6FFFFFF);
+
+	/*
+	 *  In A5x, CCU can send context_done event of a particular context to
+	 *  UCHE which ultimately reaches CP even when there is valid
+	 *  transaction of that context inside CCU. This can let CP to program
+	 *  config registers, which will make the "valid transaction" inside
+	 *  CCU to be interpreted differently. This can cause gpu fault. This
+	 *  bug is fixed in latest A510 revision. To enable this bug fix -
+	 *  bit[11] of RB_DBG_ECO_CNTL need to be set to 0, default is 1
+	 *  (disable). For older A510 version this bit is unused.
+	 */
+	if (adreno_is_a510(adreno_gpu))
+		gpu_rmw(gpu, REG_A5XX_RB_DBG_ECO_CNTL, (1 << 11), 0);
+
+	/* Enable HWCG */
+	a5xx_set_hwcg(gpu, true);
+
+	gpu_write(gpu, REG_A5XX_RBBM_AHB_CNTL2, 0x0000003F);
+
+	BUG_ON(adreno_gpu->ubwc_config.highest_bank_bit < 13);
+	hbb = adreno_gpu->ubwc_config.highest_bank_bit - 13;
+
+	gpu_write(gpu, REG_A5XX_TPL1_MODE_CNTL, hbb << 7);
+	gpu_write(gpu, REG_A5XX_RB_MODE_CNTL, hbb << 1);
+
+	if (adreno_is_a509(adreno_gpu) || adreno_is_a512(adreno_gpu) ||
+	    adreno_is_a540(adreno_gpu))
+		gpu_write(gpu, REG_A5XX_UCHE_DBG_ECO_CNTL_2, hbb);
+
+	/* Disable All flat shading optimization (ALLFLATOPTDIS) */
+	gpu_rmw(gpu, REG_A5XX_VPC_DBG_ECO_CNTL, 0, (1 << 10));
+
+	/* Protect registers from the CP */
+	gpu_write(gpu, REG_A5XX_CP_PROTECT_CNTL, 0x00000007);
+
+	/* RBBM */
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(0), ADRENO_PROTECT_RW(0x04, 4));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(1), ADRENO_PROTECT_RW(0x08, 8));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(2), ADRENO_PROTECT_RW(0x10, 16));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(3), ADRENO_PROTECT_RW(0x20, 32));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(4), ADRENO_PROTECT_RW(0x40, 64));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(5), ADRENO_PROTECT_RW(0x80, 64));
+
+	/* Content protect */
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(6),
+		ADRENO_PROTECT_RW(REG_A5XX_RBBM_SECVID_TSB_TRUSTED_BASE_LO,
+			16));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(7),
+		ADRENO_PROTECT_RW(REG_A5XX_RBBM_SECVID_TRUST_CNTL, 2));
+
+	/* CP */
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(8), ADRENO_PROTECT_RW(0x800, 64));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(9), ADRENO_PROTECT_RW(0x840, 8));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(10), ADRENO_PROTECT_RW(0x880, 32));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(11), ADRENO_PROTECT_RW(0xAA0, 1));
+
+	/* RB */
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(12), ADRENO_PROTECT_RW(0xCC0, 1));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(13), ADRENO_PROTECT_RW(0xCF0, 2));
+
+	/* VPC */
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(14), ADRENO_PROTECT_RW(0xE68, 8));
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(15), ADRENO_PROTECT_RW(0xE70, 16));
+
+	/* UCHE */
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(16), ADRENO_PROTECT_RW(0xE80, 16));
+
+	/* SMMU */
+	gpu_write(gpu, REG_A5XX_CP_PROTECT(17),
+			ADRENO_PROTECT_RW(0x10000, 0x8000));
+
+	gpu_write(gpu, REG_A5XX_RBBM_SECVID_TSB_CNTL, 0);
+	/*
+	 * Disable the trusted memory range - we don't actually supported secure
+	 * memory rendering at this point in time and we don't want to block off
+	 * part of the virtual memory space.
+	 */
+	gpu_write64(gpu, REG_A5XX_RBBM_SECVID_TSB_TRUSTED_BASE_LO, 0x00000000);
+	gpu_write(gpu, REG_A5XX_RBBM_SECVID_TSB_TRUSTED_SIZE, 0x00000000);
+
+	/* Put the GPU into 64 bit by default */
+	gpu_write(gpu, REG_A5XX_CP_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_VSC_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_GRAS_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_RB_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_PC_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_HLSQ_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_VFD_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_VPC_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_UCHE_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_SP_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_TPL1_ADDR_MODE_CNTL, 0x1);
+	gpu_write(gpu, REG_A5XX_RBBM_SECVID_TSB_ADDR_MODE_CNTL, 0x1);
+
+	/*
+	 * VPC corner case with local memory load kill leads to corrupt
+	 * internal state. Normal Disable does not work for all a5x chips.
+	 * So do the following setting to disable it.
+	 */
+	if (adreno_gpu->info->quirks & ADRENO_QUIRK_LMLOADKILL_DISABLE) {
+		gpu_rmw(gpu, REG_A5XX_VPC_DBG_ECO_CNTL, 0, BIT(23));
+		gpu_rmw(gpu, REG_A5XX_HLSQ_DBG_ECO_CNTL, BIT(18), 0);
+	}
+
+	ret = adreno_hw_init(gpu);
+	if (ret)
+		return ret;
+
+	if (adreno_is_a530(adreno_gpu) || adreno_is_a540(adreno_gpu))
+		a5xx_gpmu_ucode_init(gpu);
+
+	gpu_write64(gpu, REG_A5XX_CP_ME_INSTR_BASE_LO, a5xx_gpu->pm4_iova);
+	gpu_write64(gpu, REG_A5XX_CP_PFP_INSTR_BASE_LO, a5xx_gpu->pfp_iova);
+
+	/* Set the ringbuffer address */
+	gpu_write64(gpu, REG_A5XX_CP_RB_BASE, gpu->rb[0]->iova);
+
+	/*
+	 * If the microcode supports the WHERE_AM_I opcode then we can use that
+	 * in lieu of the RPTR shadow and enable preemption. Otherwise, we
+	 * can't safely use the RPTR shadow or preemption. In either case, the
+	 * RPTR shadow should be disabled in hardware.
+	 */
+	gpu_write(gpu, REG_A5XX_CP_RB_CNTL,
+		MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
+
+	/* Configure the RPTR shadow if needed: */
+	if (a5xx_gpu->shadow_bo) {
+		gpu_write64(gpu, REG_A5XX_CP_RB_RPTR_ADDR,
+			    shadowptr(a5xx_gpu, gpu->rb[0]));
+	}
+
+	a5xx_preempt_hw_init(gpu);
+
+	/* Disable the interrupts through the initial bringup stage */
+	gpu_write(gpu, REG_A5XX_RBBM_INT_0_MASK, A5XX_INT_MASK);
+
+	/* Clear ME_HALT to start the micro engine */
+	gpu_write(gpu, REG_A5XX_CP_PFP_ME_CNTL, 0);
+	ret = a5xx_me_init(gpu);
+	if (ret)
+		return ret;
+
+	ret = a5xx_power_init(gpu);
+	if (ret)
+		return ret;
+
+	/*
+	 * Send a pipeline event stat to get misbehaving counters to start
+	 * ticking correctly
+	 */
+	if (adreno_is_a530(adreno_gpu)) {
+		OUT_PKT7(gpu->rb[0], CP_EVENT_WRITE, 1);
+		OUT_RING(gpu->rb[0], CP_EVENT_WRITE_0_EVENT(STAT_EVENT));
+
+		a5xx_flush(gpu, gpu->rb[0], true);
+		if (!a5xx_idle(gpu, gpu->rb[0]))
+			return -EINVAL;
+	}
+
+	/*
+	 * If the chip that we are using does support loading one, then
+	 * try to load a zap shader into the secure world. If successful
+	 * we can use the CP to switch out of secure mode. If not then we
+	 * have no resource but to try to switch ourselves out manually. If we
+	 * guessed wrong then access to the RBBM_SECVID_TRUST_CNTL register will
+	 * be blocked and a permissions violation will soon follow.
+	 */
+	ret = a5xx_zap_shader_init(gpu);
+	if (!ret) {
+		OUT_PKT7(gpu->rb[0], CP_SET_SECURE_MODE, 1);
+		OUT_RING(gpu->rb[0], 0x00000000);
+
+		a5xx_flush(gpu, gpu->rb[0], true);
+		if (!a5xx_idle(gpu, gpu->rb[0]))
+			return -EINVAL;
+	} else if (ret == -ENODEV) {
+		/*
+		 * This device does not use zap shader (but print a warning
+		 * just in case someone got their dt wrong.. hopefully they
+		 * have a debug UART to realize the error of their ways...
+		 * if you mess this up you are about to crash horribly)
+		 */
+		dev_warn_once(gpu->dev->dev,
+			"Zap shader not enabled - using SECVID_TRUST_CNTL instead\n");
+		gpu_write(gpu, REG_A5XX_RBBM_SECVID_TRUST_CNTL, 0x0);
+	} else {
+		return ret;
+	}
+
+	/* Last step - yield the ringbuffer */
+	a5xx_preempt_start(gpu);
+
+	return 0;
+}
+
+static void a5xx_recover(struct msm_gpu *gpu)
+{
+	int i;
+
+	adreno_dump_info(gpu);
+
+	for (i = 0; i < 8; i++) {
+		printk("CP_SCRATCH_REG%d: %u\n", i,
+			gpu_read(gpu, REG_A5XX_CP_SCRATCH_REG(i)));
+	}
+
+	if (hang_debug)
+		a5xx_dump(gpu);
+
+	gpu_write(gpu, REG_A5XX_RBBM_SW_RESET_CMD, 1);
+	gpu_read(gpu, REG_A5XX_RBBM_SW_RESET_CMD);
+	gpu_write(gpu, REG_A5XX_RBBM_SW_RESET_CMD, 0);
+	adreno_recover(gpu);
+}
+
+static void a5xx_destroy(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+
+	DBG("%s", gpu->name);
+
+	a5xx_preempt_fini(gpu);
+
+	if (a5xx_gpu->pm4_bo) {
+		msm_gem_unpin_iova(a5xx_gpu->pm4_bo, gpu->aspace);
+		drm_gem_object_put(a5xx_gpu->pm4_bo);
+	}
+
+	if (a5xx_gpu->pfp_bo) {
+		msm_gem_unpin_iova(a5xx_gpu->pfp_bo, gpu->aspace);
+		drm_gem_object_put(a5xx_gpu->pfp_bo);
+	}
+
+	if (a5xx_gpu->gpmu_bo) {
+		msm_gem_unpin_iova(a5xx_gpu->gpmu_bo, gpu->aspace);
+		drm_gem_object_put(a5xx_gpu->gpmu_bo);
+	}
+
+	if (a5xx_gpu->shadow_bo) {
+		msm_gem_unpin_iova(a5xx_gpu->shadow_bo, gpu->aspace);
+		drm_gem_object_put(a5xx_gpu->shadow_bo);
+	}
+
+	adreno_gpu_cleanup(adreno_gpu);
+	kfree(a5xx_gpu);
+}
+
+static inline bool _a5xx_check_idle(struct msm_gpu *gpu)
+{
+	if (gpu_read(gpu, REG_A5XX_RBBM_STATUS) & ~A5XX_RBBM_STATUS_HI_BUSY)
+		return false;
+
+	/*
+	 * Nearly every abnormality ends up pausing the GPU and triggering a
+	 * fault so we can safely just watch for this one interrupt to fire
+	 */
+	return !(gpu_read(gpu, REG_A5XX_RBBM_INT_0_STATUS) &
+		A5XX_RBBM_INT_0_MASK_MISC_HANG_DETECT);
+}
+
+bool a5xx_idle(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+
+	if (ring != a5xx_gpu->cur_ring) {
+		WARN(1, "Tried to idle a non-current ringbuffer\n");
+		return false;
+	}
+
+	/* wait for CP to drain ringbuffer: */
+	if (!adreno_idle(gpu, ring))
+		return false;
+
+	if (spin_until(_a5xx_check_idle(gpu))) {
+		DRM_ERROR("%s: %ps: timeout waiting for GPU to idle: status %8.8X irq %8.8X rptr/wptr %d/%d\n",
+			gpu->name, __builtin_return_address(0),
+			gpu_read(gpu, REG_A5XX_RBBM_STATUS),
+			gpu_read(gpu, REG_A5XX_RBBM_INT_0_STATUS),
+			gpu_read(gpu, REG_A5XX_CP_RB_RPTR),
+			gpu_read(gpu, REG_A5XX_CP_RB_WPTR));
+		return false;
+	}
+
+	return true;
+}
+
+static int a5xx_fault_handler(void *arg, unsigned long iova, int flags, void *data)
+{
+	struct msm_gpu *gpu = arg;
+	struct adreno_smmu_fault_info *info = data;
+	char block[12] = "unknown";
+	u32 scratch[] = {
+			gpu_read(gpu, REG_A5XX_CP_SCRATCH_REG(4)),
+			gpu_read(gpu, REG_A5XX_CP_SCRATCH_REG(5)),
+			gpu_read(gpu, REG_A5XX_CP_SCRATCH_REG(6)),
+			gpu_read(gpu, REG_A5XX_CP_SCRATCH_REG(7)),
+	};
+
+	if (info)
+		snprintf(block, sizeof(block), "%x", info->fsynr1);
+
+	return adreno_fault_handler(gpu, iova, flags, info, block, scratch);
+}
+
+static void a5xx_cp_err_irq(struct msm_gpu *gpu)
+{
+	u32 status = gpu_read(gpu, REG_A5XX_CP_INTERRUPT_STATUS);
+
+	if (status & A5XX_CP_INT_CP_OPCODE_ERROR) {
+		u32 val;
+
+		gpu_write(gpu, REG_A5XX_CP_PFP_STAT_ADDR, 0);
+
+		/*
+		 * REG_A5XX_CP_PFP_STAT_DATA is indexed, and we want index 1 so
+		 * read it twice
+		 */
+
+		gpu_read(gpu, REG_A5XX_CP_PFP_STAT_DATA);
+		val = gpu_read(gpu, REG_A5XX_CP_PFP_STAT_DATA);
+
+		dev_err_ratelimited(gpu->dev->dev, "CP | opcode error | possible opcode=0x%8.8X\n",
+			val);
+	}
+
+	if (status & A5XX_CP_INT_CP_HW_FAULT_ERROR)
+		dev_err_ratelimited(gpu->dev->dev, "CP | HW fault | status=0x%8.8X\n",
+			gpu_read(gpu, REG_A5XX_CP_HW_FAULT));
+
+	if (status & A5XX_CP_INT_CP_DMA_ERROR)
+		dev_err_ratelimited(gpu->dev->dev, "CP | DMA error\n");
+
+	if (status & A5XX_CP_INT_CP_REGISTER_PROTECTION_ERROR) {
+		u32 val = gpu_read(gpu, REG_A5XX_CP_PROTECT_STATUS);
+
+		dev_err_ratelimited(gpu->dev->dev,
+			"CP | protected mode error | %s | addr=0x%8.8X | status=0x%8.8X\n",
+			val & (1 << 24) ? "WRITE" : "READ",
+			(val & 0xFFFFF) >> 2, val);
+	}
+
+	if (status & A5XX_CP_INT_CP_AHB_ERROR) {
+		u32 status = gpu_read(gpu, REG_A5XX_CP_AHB_FAULT);
+		const char *access[16] = { "reserved", "reserved",
+			"timestamp lo", "timestamp hi", "pfp read", "pfp write",
+			"", "", "me read", "me write", "", "", "crashdump read",
+			"crashdump write" };
+
+		dev_err_ratelimited(gpu->dev->dev,
+			"CP | AHB error | addr=%X access=%s error=%d | status=0x%8.8X\n",
+			status & 0xFFFFF, access[(status >> 24) & 0xF],
+			(status & (1 << 31)), status);
+	}
+}
+
+static void a5xx_rbbm_err_irq(struct msm_gpu *gpu, u32 status)
+{
+	if (status & A5XX_RBBM_INT_0_MASK_RBBM_AHB_ERROR) {
+		u32 val = gpu_read(gpu, REG_A5XX_RBBM_AHB_ERROR_STATUS);
+
+		dev_err_ratelimited(gpu->dev->dev,
+			"RBBM | AHB bus error | %s | addr=0x%X | ports=0x%X:0x%X\n",
+			val & (1 << 28) ? "WRITE" : "READ",
+			(val & 0xFFFFF) >> 2, (val >> 20) & 0x3,
+			(val >> 24) & 0xF);
+
+		/* Clear the error */
+		gpu_write(gpu, REG_A5XX_RBBM_AHB_CMD, (1 << 4));
+
+		/* Clear the interrupt */
+		gpu_write(gpu, REG_A5XX_RBBM_INT_CLEAR_CMD,
+			A5XX_RBBM_INT_0_MASK_RBBM_AHB_ERROR);
+	}
+
+	if (status & A5XX_RBBM_INT_0_MASK_RBBM_TRANSFER_TIMEOUT)
+		dev_err_ratelimited(gpu->dev->dev, "RBBM | AHB transfer timeout\n");
+
+	if (status & A5XX_RBBM_INT_0_MASK_RBBM_ME_MS_TIMEOUT)
+		dev_err_ratelimited(gpu->dev->dev, "RBBM | ME master split | status=0x%X\n",
+			gpu_read(gpu, REG_A5XX_RBBM_AHB_ME_SPLIT_STATUS));
+
+	if (status & A5XX_RBBM_INT_0_MASK_RBBM_PFP_MS_TIMEOUT)
+		dev_err_ratelimited(gpu->dev->dev, "RBBM | PFP master split | status=0x%X\n",
+			gpu_read(gpu, REG_A5XX_RBBM_AHB_PFP_SPLIT_STATUS));
+
+	if (status & A5XX_RBBM_INT_0_MASK_RBBM_ETS_MS_TIMEOUT)
+		dev_err_ratelimited(gpu->dev->dev, "RBBM | ETS master split | status=0x%X\n",
+			gpu_read(gpu, REG_A5XX_RBBM_AHB_ETS_SPLIT_STATUS));
+
+	if (status & A5XX_RBBM_INT_0_MASK_RBBM_ATB_ASYNC_OVERFLOW)
+		dev_err_ratelimited(gpu->dev->dev, "RBBM | ATB ASYNC overflow\n");
+
+	if (status & A5XX_RBBM_INT_0_MASK_RBBM_ATB_BUS_OVERFLOW)
+		dev_err_ratelimited(gpu->dev->dev, "RBBM | ATB bus overflow\n");
+}
+
+static void a5xx_uche_err_irq(struct msm_gpu *gpu)
+{
+	uint64_t addr = (uint64_t) gpu_read(gpu, REG_A5XX_UCHE_TRAP_LOG_HI);
+
+	addr |= gpu_read(gpu, REG_A5XX_UCHE_TRAP_LOG_LO);
+
+	dev_err_ratelimited(gpu->dev->dev, "UCHE | Out of bounds access | addr=0x%llX\n",
+		addr);
+}
+
+static void a5xx_gpmu_err_irq(struct msm_gpu *gpu)
+{
+	dev_err_ratelimited(gpu->dev->dev, "GPMU | voltage droop\n");
+}
+
+static void a5xx_fault_detect_irq(struct msm_gpu *gpu)
+{
+	struct drm_device *dev = gpu->dev;
+	struct msm_ringbuffer *ring = gpu->funcs->active_ring(gpu);
+
+	/*
+	 * If stalled on SMMU fault, we could trip the GPU's hang detection,
+	 * but the fault handler will trigger the devcore dump, and we want
+	 * to otherwise resume normally rather than killing the submit, so
+	 * just bail.
+	 */
+	if (gpu_read(gpu, REG_A5XX_RBBM_STATUS3) & BIT(24))
+		return;
+
+	DRM_DEV_ERROR(dev->dev, "gpu fault ring %d fence %x status %8.8X rb %4.4x/%4.4x ib1 %16.16llX/%4.4x ib2 %16.16llX/%4.4x\n",
+		ring ? ring->id : -1, ring ? ring->fctx->last_fence : 0,
+		gpu_read(gpu, REG_A5XX_RBBM_STATUS),
+		gpu_read(gpu, REG_A5XX_CP_RB_RPTR),
+		gpu_read(gpu, REG_A5XX_CP_RB_WPTR),
+		gpu_read64(gpu, REG_A5XX_CP_IB1_BASE),
+		gpu_read(gpu, REG_A5XX_CP_IB1_BUFSZ),
+		gpu_read64(gpu, REG_A5XX_CP_IB2_BASE),
+		gpu_read(gpu, REG_A5XX_CP_IB2_BUFSZ));
+
+	/* Turn off the hangcheck timer to keep it from bothering us */
+	del_timer(&gpu->hangcheck_timer);
+
+	kthread_queue_work(gpu->worker, &gpu->recover_work);
+}
+
+#define RBBM_ERROR_MASK \
+	(A5XX_RBBM_INT_0_MASK_RBBM_AHB_ERROR | \
+	A5XX_RBBM_INT_0_MASK_RBBM_TRANSFER_TIMEOUT | \
+	A5XX_RBBM_INT_0_MASK_RBBM_ME_MS_TIMEOUT | \
+	A5XX_RBBM_INT_0_MASK_RBBM_PFP_MS_TIMEOUT | \
+	A5XX_RBBM_INT_0_MASK_RBBM_ETS_MS_TIMEOUT | \
+	A5XX_RBBM_INT_0_MASK_RBBM_ATB_ASYNC_OVERFLOW)
+
+static irqreturn_t a5xx_irq(struct msm_gpu *gpu)
+{
+	struct msm_drm_private *priv = gpu->dev->dev_private;
+	u32 status = gpu_read(gpu, REG_A5XX_RBBM_INT_0_STATUS);
+
+	/*
+	 * Clear all the interrupts except RBBM_AHB_ERROR - if we clear it
+	 * before the source is cleared the interrupt will storm.
+	 */
+	gpu_write(gpu, REG_A5XX_RBBM_INT_CLEAR_CMD,
+		status & ~A5XX_RBBM_INT_0_MASK_RBBM_AHB_ERROR);
+
+	if (priv->disable_err_irq) {
+		status &= A5XX_RBBM_INT_0_MASK_CP_CACHE_FLUSH_TS |
+			  A5XX_RBBM_INT_0_MASK_CP_SW;
+	}
+
+	/* Pass status to a5xx_rbbm_err_irq because we've already cleared it */
+	if (status & RBBM_ERROR_MASK)
+		a5xx_rbbm_err_irq(gpu, status);
+
+	if (status & A5XX_RBBM_INT_0_MASK_CP_HW_ERROR)
+		a5xx_cp_err_irq(gpu);
+
+	if (status & A5XX_RBBM_INT_0_MASK_MISC_HANG_DETECT)
+		a5xx_fault_detect_irq(gpu);
+
+	if (status & A5XX_RBBM_INT_0_MASK_UCHE_OOB_ACCESS)
+		a5xx_uche_err_irq(gpu);
+
+	if (status & A5XX_RBBM_INT_0_MASK_GPMU_VOLTAGE_DROOP)
+		a5xx_gpmu_err_irq(gpu);
+
+	if (status & A5XX_RBBM_INT_0_MASK_CP_CACHE_FLUSH_TS) {
+		a5xx_preempt_trigger(gpu);
+		msm_gpu_retire(gpu);
+	}
+
+	if (status & A5XX_RBBM_INT_0_MASK_CP_SW)
+		a5xx_preempt_irq(gpu);
+
+	return IRQ_HANDLED;
+}
+
+static const u32 a5xx_registers[] = {
+	0x0000, 0x0002, 0x0004, 0x0020, 0x0022, 0x0026, 0x0029, 0x002B,
+	0x002E, 0x0035, 0x0038, 0x0042, 0x0044, 0x0044, 0x0047, 0x0095,
+	0x0097, 0x00BB, 0x03A0, 0x0464, 0x0469, 0x046F, 0x04D2, 0x04D3,
+	0x04E0, 0x0533, 0x0540, 0x0555, 0x0800, 0x081A, 0x081F, 0x0841,
+	0x0860, 0x0860, 0x0880, 0x08A0, 0x0B00, 0x0B12, 0x0B15, 0x0B28,
+	0x0B78, 0x0B7F, 0x0BB0, 0x0BBD, 0x0BC0, 0x0BC6, 0x0BD0, 0x0C53,
+	0x0C60, 0x0C61, 0x0C80, 0x0C82, 0x0C84, 0x0C85, 0x0C90, 0x0C98,
+	0x0CA0, 0x0CA0, 0x0CB0, 0x0CB2, 0x2180, 0x2185, 0x2580, 0x2585,
+	0x0CC1, 0x0CC1, 0x0CC4, 0x0CC7, 0x0CCC, 0x0CCC, 0x0CD0, 0x0CD8,
+	0x0CE0, 0x0CE5, 0x0CE8, 0x0CE8, 0x0CEC, 0x0CF1, 0x0CFB, 0x0D0E,
+	0x2100, 0x211E, 0x2140, 0x2145, 0x2500, 0x251E, 0x2540, 0x2545,
+	0x0D10, 0x0D17, 0x0D20, 0x0D23, 0x0D30, 0x0D30, 0x20C0, 0x20C0,
+	0x24C0, 0x24C0, 0x0E40, 0x0E43, 0x0E4A, 0x0E4A, 0x0E50, 0x0E57,
+	0x0E60, 0x0E7C, 0x0E80, 0x0E8E, 0x0E90, 0x0E96, 0x0EA0, 0x0EA8,
+	0x0EB0, 0x0EB2, 0xE140, 0xE147, 0xE150, 0xE187, 0xE1A0, 0xE1A9,
+	0xE1B0, 0xE1B6, 0xE1C0, 0xE1C7, 0xE1D0, 0xE1D1, 0xE200, 0xE201,
+	0xE210, 0xE21C, 0xE240, 0xE268, 0xE000, 0xE006, 0xE010, 0xE09A,
+	0xE0A0, 0xE0A4, 0xE0AA, 0xE0EB, 0xE100, 0xE105, 0xE380, 0xE38F,
+	0xE3B0, 0xE3B0, 0xE400, 0xE405, 0xE408, 0xE4E9, 0xE4F0, 0xE4F0,
+	0xE280, 0xE280, 0xE282, 0xE2A3, 0xE2A5, 0xE2C2, 0xE940, 0xE947,
+	0xE950, 0xE987, 0xE9A0, 0xE9A9, 0xE9B0, 0xE9B6, 0xE9C0, 0xE9C7,
+	0xE9D0, 0xE9D1, 0xEA00, 0xEA01, 0xEA10, 0xEA1C, 0xEA40, 0xEA68,
+	0xE800, 0xE806, 0xE810, 0xE89A, 0xE8A0, 0xE8A4, 0xE8AA, 0xE8EB,
+	0xE900, 0xE905, 0xEB80, 0xEB8F, 0xEBB0, 0xEBB0, 0xEC00, 0xEC05,
+	0xEC08, 0xECE9, 0xECF0, 0xECF0, 0xEA80, 0xEA80, 0xEA82, 0xEAA3,
+	0xEAA5, 0xEAC2, 0xA800, 0xA800, 0xA820, 0xA828, 0xA840, 0xA87D,
+	0XA880, 0xA88D, 0xA890, 0xA8A3, 0xA8D0, 0xA8D8, 0xA8E0, 0xA8F5,
+	0xAC60, 0xAC60, ~0,
+};
+
+static void a5xx_dump(struct msm_gpu *gpu)
+{
+	DRM_DEV_INFO(gpu->dev->dev, "status:   %08x\n",
+		gpu_read(gpu, REG_A5XX_RBBM_STATUS));
+	adreno_dump(gpu);
+}
+
+static int a5xx_pm_resume(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int ret;
+
+	/* Turn on the core power */
+	ret = msm_gpu_pm_resume(gpu);
+	if (ret)
+		return ret;
+
+	/* Adreno 506, 508, 509, 510, 512 needs manual RBBM sus/res control */
+	if (!(adreno_is_a530(adreno_gpu) || adreno_is_a540(adreno_gpu))) {
+		/* Halt the sp_input_clk at HM level */
+		gpu_write(gpu, REG_A5XX_RBBM_CLOCK_CNTL, 0x00000055);
+		a5xx_set_hwcg(gpu, true);
+		/* Turn on sp_input_clk at HM level */
+		gpu_rmw(gpu, REG_A5XX_RBBM_CLOCK_CNTL, 0xff, 0);
+		return 0;
+	}
+
+	/* Turn the RBCCU domain first to limit the chances of voltage droop */
+	gpu_write(gpu, REG_A5XX_GPMU_RBCCU_POWER_CNTL, 0x778000);
+
+	/* Wait 3 usecs before polling */
+	udelay(3);
+
+	ret = spin_usecs(gpu, 20, REG_A5XX_GPMU_RBCCU_PWR_CLK_STATUS,
+		(1 << 20), (1 << 20));
+	if (ret) {
+		DRM_ERROR("%s: timeout waiting for RBCCU GDSC enable: %X\n",
+			gpu->name,
+			gpu_read(gpu, REG_A5XX_GPMU_RBCCU_PWR_CLK_STATUS));
+		return ret;
+	}
+
+	/* Turn on the SP domain */
+	gpu_write(gpu, REG_A5XX_GPMU_SP_POWER_CNTL, 0x778000);
+	ret = spin_usecs(gpu, 20, REG_A5XX_GPMU_SP_PWR_CLK_STATUS,
+		(1 << 20), (1 << 20));
+	if (ret)
+		DRM_ERROR("%s: timeout waiting for SP GDSC enable\n",
+			gpu->name);
+
+	return ret;
+}
+
+static int a5xx_pm_suspend(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	u32 mask = 0xf;
+	int i, ret;
+
+	/* A506, A508, A510 have 3 XIN ports in VBIF */
+	if (adreno_is_a506(adreno_gpu) || adreno_is_a508(adreno_gpu) ||
+	    adreno_is_a510(adreno_gpu))
+		mask = 0x7;
+
+	/* Clear the VBIF pipe before shutting down */
+	gpu_write(gpu, REG_A5XX_VBIF_XIN_HALT_CTRL0, mask);
+	spin_until((gpu_read(gpu, REG_A5XX_VBIF_XIN_HALT_CTRL1) &
+				mask) == mask);
+
+	gpu_write(gpu, REG_A5XX_VBIF_XIN_HALT_CTRL0, 0);
+
+	/*
+	 * Reset the VBIF before power collapse to avoid issue with FIFO
+	 * entries on Adreno A510 and A530 (the others will tend to lock up)
+	 */
+	if (adreno_is_a510(adreno_gpu) || adreno_is_a530(adreno_gpu)) {
+		gpu_write(gpu, REG_A5XX_RBBM_BLOCK_SW_RESET_CMD, 0x003C0000);
+		gpu_write(gpu, REG_A5XX_RBBM_BLOCK_SW_RESET_CMD, 0x00000000);
+	}
+
+	ret = msm_gpu_pm_suspend(gpu);
+	if (ret)
+		return ret;
+
+	if (a5xx_gpu->has_whereami)
+		for (i = 0; i < gpu->nr_rings; i++)
+			a5xx_gpu->shadow[i] = 0;
+
+	return 0;
+}
+
+static int a5xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+{
+	*value = gpu_read64(gpu, REG_A5XX_RBBM_ALWAYSON_COUNTER_LO);
+
+	return 0;
+}
+
+struct a5xx_crashdumper {
+	void *ptr;
+	struct drm_gem_object *bo;
+	u64 iova;
+};
+
+struct a5xx_gpu_state {
+	struct msm_gpu_state base;
+	u32 *hlsqregs;
+};
+
+static int a5xx_crashdumper_init(struct msm_gpu *gpu,
+		struct a5xx_crashdumper *dumper)
+{
+	dumper->ptr = msm_gem_kernel_new(gpu->dev,
+		SZ_1M, MSM_BO_WC, gpu->aspace,
+		&dumper->bo, &dumper->iova);
+
+	if (!IS_ERR(dumper->ptr))
+		msm_gem_object_set_name(dumper->bo, "crashdump");
+
+	return PTR_ERR_OR_ZERO(dumper->ptr);
+}
+
+static int a5xx_crashdumper_run(struct msm_gpu *gpu,
+		struct a5xx_crashdumper *dumper)
+{
+	u32 val;
+
+	if (IS_ERR_OR_NULL(dumper->ptr))
+		return -EINVAL;
+
+	gpu_write64(gpu, REG_A5XX_CP_CRASH_SCRIPT_BASE_LO, dumper->iova);
+
+	gpu_write(gpu, REG_A5XX_CP_CRASH_DUMP_CNTL, 1);
+
+	return gpu_poll_timeout(gpu, REG_A5XX_CP_CRASH_DUMP_CNTL, val,
+		val & 0x04, 100, 10000);
+}
+
+/*
+ * These are a list of the registers that need to be read through the HLSQ
+ * aperture through the crashdumper.  These are not nominally accessible from
+ * the CPU on a secure platform.
+ */
+static const struct {
+	u32 type;
+	u32 regoffset;
+	u32 count;
+} a5xx_hlsq_aperture_regs[] = {
+	{ 0x35, 0xe00, 0x32 },   /* HSLQ non-context */
+	{ 0x31, 0x2080, 0x1 },   /* HLSQ 2D context 0 */
+	{ 0x33, 0x2480, 0x1 },   /* HLSQ 2D context 1 */
+	{ 0x32, 0xe780, 0x62 },  /* HLSQ 3D context 0 */
+	{ 0x34, 0xef80, 0x62 },  /* HLSQ 3D context 1 */
+	{ 0x3f, 0x0ec0, 0x40 },  /* SP non-context */
+	{ 0x3d, 0x2040, 0x1 },   /* SP 2D context 0 */
+	{ 0x3b, 0x2440, 0x1 },   /* SP 2D context 1 */
+	{ 0x3e, 0xe580, 0x170 }, /* SP 3D context 0 */
+	{ 0x3c, 0xed80, 0x170 }, /* SP 3D context 1 */
+	{ 0x3a, 0x0f00, 0x1c },  /* TP non-context */
+	{ 0x38, 0x2000, 0xa },   /* TP 2D context 0 */
+	{ 0x36, 0x2400, 0xa },   /* TP 2D context 1 */
+	{ 0x39, 0xe700, 0x80 },  /* TP 3D context 0 */
+	{ 0x37, 0xef00, 0x80 },  /* TP 3D context 1 */
+};
+
+static void a5xx_gpu_state_get_hlsq_regs(struct msm_gpu *gpu,
+		struct a5xx_gpu_state *a5xx_state)
+{
+	struct a5xx_crashdumper dumper = { 0 };
+	u32 offset, count = 0;
+	u64 *ptr;
+	int i;
+
+	if (a5xx_crashdumper_init(gpu, &dumper))
+		return;
+
+	/* The script will be written at offset 0 */
+	ptr = dumper.ptr;
+
+	/* Start writing the data at offset 256k */
+	offset = dumper.iova + (256 * SZ_1K);
+
+	/* Count how many additional registers to get from the HLSQ aperture */
+	for (i = 0; i < ARRAY_SIZE(a5xx_hlsq_aperture_regs); i++)
+		count += a5xx_hlsq_aperture_regs[i].count;
+
+	a5xx_state->hlsqregs = kcalloc(count, sizeof(u32), GFP_KERNEL);
+	if (!a5xx_state->hlsqregs)
+		return;
+
+	/* Build the crashdump script */
+	for (i = 0; i < ARRAY_SIZE(a5xx_hlsq_aperture_regs); i++) {
+		u32 type = a5xx_hlsq_aperture_regs[i].type;
+		u32 c = a5xx_hlsq_aperture_regs[i].count;
+
+		/* Write the register to select the desired bank */
+		*ptr++ = ((u64) type << 8);
+		*ptr++ = (((u64) REG_A5XX_HLSQ_DBG_READ_SEL) << 44) |
+			(1 << 21) | 1;
+
+		*ptr++ = offset;
+		*ptr++ = (((u64) REG_A5XX_HLSQ_DBG_AHB_READ_APERTURE) << 44)
+			| c;
+
+		offset += c * sizeof(u32);
+	}
+
+	/* Write two zeros to close off the script */
+	*ptr++ = 0;
+	*ptr++ = 0;
+
+	if (a5xx_crashdumper_run(gpu, &dumper)) {
+		kfree(a5xx_state->hlsqregs);
+		msm_gem_kernel_put(dumper.bo, gpu->aspace);
+		return;
+	}
+
+	/* Copy the data from the crashdumper to the state */
+	memcpy(a5xx_state->hlsqregs, dumper.ptr + (256 * SZ_1K),
+		count * sizeof(u32));
+
+	msm_gem_kernel_put(dumper.bo, gpu->aspace);
+}
+
+static struct msm_gpu_state *a5xx_gpu_state_get(struct msm_gpu *gpu)
+{
+	struct a5xx_gpu_state *a5xx_state = kzalloc(sizeof(*a5xx_state),
+			GFP_KERNEL);
+	bool stalled = !!(gpu_read(gpu, REG_A5XX_RBBM_STATUS3) & BIT(24));
+
+	if (!a5xx_state)
+		return ERR_PTR(-ENOMEM);
+
+	/* Temporarily disable hardware clock gating before reading the hw */
+	a5xx_set_hwcg(gpu, false);
+
+	/* First get the generic state from the adreno core */
+	adreno_gpu_state_get(gpu, &(a5xx_state->base));
+
+	a5xx_state->base.rbbm_status = gpu_read(gpu, REG_A5XX_RBBM_STATUS);
+
+	/*
+	 * Get the HLSQ regs with the help of the crashdumper, but only if
+	 * we are not stalled in an iommu fault (in which case the crashdumper
+	 * would not have access to memory)
+	 */
+	if (!stalled)
+		a5xx_gpu_state_get_hlsq_regs(gpu, a5xx_state);
+
+	a5xx_set_hwcg(gpu, true);
+
+	return &a5xx_state->base;
+}
+
+static void a5xx_gpu_state_destroy(struct kref *kref)
+{
+	struct msm_gpu_state *state = container_of(kref,
+		struct msm_gpu_state, ref);
+	struct a5xx_gpu_state *a5xx_state = container_of(state,
+		struct a5xx_gpu_state, base);
+
+	kfree(a5xx_state->hlsqregs);
+
+	adreno_gpu_state_destroy(state);
+	kfree(a5xx_state);
+}
+
+static int a5xx_gpu_state_put(struct msm_gpu_state *state)
+{
+	if (IS_ERR_OR_NULL(state))
+		return 1;
+
+	return kref_put(&state->ref, a5xx_gpu_state_destroy);
+}
+
+
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
+static void a5xx_show(struct msm_gpu *gpu, struct msm_gpu_state *state,
+		      struct drm_printer *p)
+{
+	int i, j;
+	u32 pos = 0;
+	struct a5xx_gpu_state *a5xx_state = container_of(state,
+		struct a5xx_gpu_state, base);
+
+	if (IS_ERR_OR_NULL(state))
+		return;
+
+	adreno_show(gpu, state, p);
+
+	/* Dump the additional a5xx HLSQ registers */
+	if (!a5xx_state->hlsqregs)
+		return;
+
+	drm_printf(p, "registers-hlsq:\n");
+
+	for (i = 0; i < ARRAY_SIZE(a5xx_hlsq_aperture_regs); i++) {
+		u32 o = a5xx_hlsq_aperture_regs[i].regoffset;
+		u32 c = a5xx_hlsq_aperture_regs[i].count;
+
+		for (j = 0; j < c; j++, pos++, o++) {
+			/*
+			 * To keep the crashdump simple we pull the entire range
+			 * for each register type but not all of the registers
+			 * in the range are valid. Fortunately invalid registers
+			 * stick out like a sore thumb with a value of
+			 * 0xdeadbeef
+			 */
+			if (a5xx_state->hlsqregs[pos] == 0xdeadbeef)
+				continue;
+
+			drm_printf(p, "  - { offset: 0x%04x, value: 0x%08x }\n",
+				o << 2, a5xx_state->hlsqregs[pos]);
+		}
+	}
+}
+#endif
+
+static struct msm_ringbuffer *a5xx_active_ring(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+
+	return a5xx_gpu->cur_ring;
+}
+
+static u64 a5xx_gpu_busy(struct msm_gpu *gpu, unsigned long *out_sample_rate)
+{
+	u64 busy_cycles;
+
+	busy_cycles = gpu_read64(gpu, REG_A5XX_RBBM_PERFCTR_RBBM_0_LO);
+	*out_sample_rate = clk_get_rate(gpu->core_clk);
+
+	return busy_cycles;
+}
+
+static uint32_t a5xx_get_rptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+
+	if (a5xx_gpu->has_whereami)
+		return a5xx_gpu->shadow[ring->id];
+
+	return ring->memptrs->rptr = gpu_read(gpu, REG_A5XX_CP_RB_RPTR);
+}
+
+static const struct adreno_gpu_funcs funcs = {
+	.base = {
+		.get_param = adreno_get_param,
+		.set_param = adreno_set_param,
+		.hw_init = a5xx_hw_init,
+		.ucode_load = a5xx_ucode_load,
+		.pm_suspend = a5xx_pm_suspend,
+		.pm_resume = a5xx_pm_resume,
+		.recover = a5xx_recover,
+		.submit = a5xx_submit,
+		.active_ring = a5xx_active_ring,
+		.irq = a5xx_irq,
+		.destroy = a5xx_destroy,
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
+		.show = a5xx_show,
+#endif
+#if defined(CONFIG_DEBUG_FS)
+		.debugfs_init = a5xx_debugfs_init,
+#endif
+		.gpu_busy = a5xx_gpu_busy,
+		.gpu_state_get = a5xx_gpu_state_get,
+		.gpu_state_put = a5xx_gpu_state_put,
+		.create_address_space = adreno_create_address_space,
+		.get_rptr = a5xx_get_rptr,
+	},
+	.get_timestamp = a5xx_get_timestamp,
+};
+
+static void check_speed_bin(struct device *dev)
+{
+	struct nvmem_cell *cell;
+	u32 val;
+
+	/*
+	 * If the OPP table specifies a opp-supported-hw property then we have
+	 * to set something with dev_pm_opp_set_supported_hw() or the table
+	 * doesn't get populated so pick an arbitrary value that should
+	 * ensure the default frequencies are selected but not conflict with any
+	 * actual bins
+	 */
+	val = 0x80;
+
+	cell = nvmem_cell_get(dev, "speed_bin");
+
+	if (!IS_ERR(cell)) {
+		void *buf = nvmem_cell_read(cell, NULL);
+
+		if (!IS_ERR(buf)) {
+			u8 bin = *((u8 *) buf);
+
+			val = (1 << bin);
+			kfree(buf);
+		}
+
+		nvmem_cell_put(cell);
+	}
+
+	devm_pm_opp_set_supported_hw(dev, &val, 1);
+}
+
+struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct platform_device *pdev = priv->gpu_pdev;
+	struct adreno_platform_config *config = pdev->dev.platform_data;
+	struct a5xx_gpu *a5xx_gpu = NULL;
+	struct adreno_gpu *adreno_gpu;
+	struct msm_gpu *gpu;
+	unsigned int nr_rings;
+	int ret;
+
+	if (!pdev) {
+		DRM_DEV_ERROR(dev->dev, "No A5XX device is defined\n");
+		return ERR_PTR(-ENXIO);
+	}
+
+	a5xx_gpu = kzalloc(sizeof(*a5xx_gpu), GFP_KERNEL);
+	if (!a5xx_gpu)
+		return ERR_PTR(-ENOMEM);
+
+	adreno_gpu = &a5xx_gpu->base;
+	gpu = &adreno_gpu->base;
+
+	adreno_gpu->registers = a5xx_registers;
+
+	a5xx_gpu->lm_leakage = 0x4E001A;
+
+	check_speed_bin(&pdev->dev);
+
+	nr_rings = 4;
+
+	if (config->info->revn == 510)
+		nr_rings = 1;
+
+	ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, nr_rings);
+	if (ret) {
+		a5xx_destroy(&(a5xx_gpu->base.base));
+		return ERR_PTR(ret);
+	}
+
+	if (gpu->aspace)
+		msm_mmu_set_fault_handler(gpu->aspace->mmu, gpu, a5xx_fault_handler);
+
+	/* Set up the preemption specific bits and pieces for each ringbuffer */
+	a5xx_preempt_init(gpu);
+
+	/* Set the highest bank bit */
+	if (adreno_is_a540(adreno_gpu) || adreno_is_a530(adreno_gpu))
+		adreno_gpu->ubwc_config.highest_bank_bit = 15;
+	else
+		adreno_gpu->ubwc_config.highest_bank_bit = 14;
+
+	/* a5xx only supports UBWC 1.0, these are not configurable */
+	adreno_gpu->ubwc_config.macrotile_mode = 0;
+	adreno_gpu->ubwc_config.ubwc_swizzle = 0x7;
+
+	return gpu;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a5xx_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a5xx_gpu.h
@@ -0,0 +1,176 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
+ */
+#ifndef __A5XX_GPU_H__
+#define __A5XX_GPU_H__
+
+#include "adreno_gpu.h"
+
+/* Bringing over the hack from the previous targets */
+#undef ROP_COPY
+#undef ROP_XOR
+
+#include "a5xx.xml.h"
+
+struct a5xx_gpu {
+	struct adreno_gpu base;
+
+	struct drm_gem_object *pm4_bo;
+	uint64_t pm4_iova;
+
+	struct drm_gem_object *pfp_bo;
+	uint64_t pfp_iova;
+
+	struct drm_gem_object *gpmu_bo;
+	uint64_t gpmu_iova;
+	uint32_t gpmu_dwords;
+
+	uint32_t lm_leakage;
+
+	struct msm_ringbuffer *cur_ring;
+	struct msm_ringbuffer *next_ring;
+
+	struct drm_gem_object *preempt_bo[MSM_GPU_MAX_RINGS];
+	struct drm_gem_object *preempt_counters_bo[MSM_GPU_MAX_RINGS];
+	struct a5xx_preempt_record *preempt[MSM_GPU_MAX_RINGS];
+	uint64_t preempt_iova[MSM_GPU_MAX_RINGS];
+	uint32_t last_seqno[MSM_GPU_MAX_RINGS];
+
+	atomic_t preempt_state;
+	spinlock_t preempt_start_lock;
+	struct timer_list preempt_timer;
+
+	struct drm_gem_object *shadow_bo;
+	uint64_t shadow_iova;
+	uint32_t *shadow;
+
+	/* True if the microcode supports the WHERE_AM_I opcode */
+	bool has_whereami;
+};
+
+#define to_a5xx_gpu(x) container_of(x, struct a5xx_gpu, base)
+
+#ifdef CONFIG_DEBUG_FS
+void a5xx_debugfs_init(struct msm_gpu *gpu, struct drm_minor *minor);
+#endif
+
+/*
+ * In order to do lockless preemption we use a simple state machine to progress
+ * through the process.
+ *
+ * PREEMPT_NONE - no preemption in progress.  Next state START.
+ * PREEMPT_START - The trigger is evaulating if preemption is possible. Next
+ * states: TRIGGERED, NONE
+ * PREEMPT_ABORT - An intermediate state before moving back to NONE. Next
+ * state: NONE.
+ * PREEMPT_TRIGGERED: A preemption has been executed on the hardware. Next
+ * states: FAULTED, PENDING
+ * PREEMPT_FAULTED: A preemption timed out (never completed). This will trigger
+ * recovery.  Next state: N/A
+ * PREEMPT_PENDING: Preemption complete interrupt fired - the callback is
+ * checking the success of the operation. Next state: FAULTED, NONE.
+ */
+
+enum preempt_state {
+	PREEMPT_NONE = 0,
+	PREEMPT_START,
+	PREEMPT_ABORT,
+	PREEMPT_TRIGGERED,
+	PREEMPT_FAULTED,
+	PREEMPT_PENDING,
+};
+
+/*
+ * struct a5xx_preempt_record is a shared buffer between the microcode and the
+ * CPU to store the state for preemption. The record itself is much larger
+ * (64k) but most of that is used by the CP for storage.
+ *
+ * There is a preemption record assigned per ringbuffer. When the CPU triggers a
+ * preemption, it fills out the record with the useful information (wptr, ring
+ * base, etc) and the microcode uses that information to set up the CP following
+ * the preemption.  When a ring is switched out, the CP will save the ringbuffer
+ * state back to the record. In this way, once the records are properly set up
+ * the CPU can quickly switch back and forth between ringbuffers by only
+ * updating a few registers (often only the wptr).
+ *
+ * These are the CPU aware registers in the record:
+ * @magic: Must always be 0x27C4BAFC
+ * @info: Type of the record - written 0 by the CPU, updated by the CP
+ * @data: Data field from SET_RENDER_MODE or a checkpoint. Written and used by
+ * the CP
+ * @cntl: Value of RB_CNTL written by CPU, save/restored by CP
+ * @rptr: Value of RB_RPTR written by CPU, save/restored by CP
+ * @wptr: Value of RB_WPTR written by CPU, save/restored by CP
+ * @rptr_addr: Value of RB_RPTR_ADDR written by CPU, save/restored by CP
+ * @rbase: Value of RB_BASE written by CPU, save/restored by CP
+ * @counter: GPU address of the storage area for the performance counters
+ */
+struct a5xx_preempt_record {
+	uint32_t magic;
+	uint32_t info;
+	uint32_t data;
+	uint32_t cntl;
+	uint32_t rptr;
+	uint32_t wptr;
+	uint64_t rptr_addr;
+	uint64_t rbase;
+	uint64_t counter;
+};
+
+/* Magic identifier for the preemption record */
+#define A5XX_PREEMPT_RECORD_MAGIC 0x27C4BAFCUL
+
+/*
+ * Even though the structure above is only a few bytes, we need a full 64k to
+ * store the entire preemption record from the CP
+ */
+#define A5XX_PREEMPT_RECORD_SIZE (64 * 1024)
+
+/*
+ * The preemption counter block is a storage area for the value of the
+ * preemption counters that are saved immediately before context switch. We
+ * append it on to the end of the allocation for the preemption record.
+ */
+#define A5XX_PREEMPT_COUNTER_SIZE (16 * 4)
+
+
+int a5xx_power_init(struct msm_gpu *gpu);
+void a5xx_gpmu_ucode_init(struct msm_gpu *gpu);
+
+static inline int spin_usecs(struct msm_gpu *gpu, uint32_t usecs,
+		uint32_t reg, uint32_t mask, uint32_t value)
+{
+	while (usecs--) {
+		udelay(1);
+		if ((gpu_read(gpu, reg) & mask) == value)
+			return 0;
+		cpu_relax();
+	}
+
+	return -ETIMEDOUT;
+}
+
+#define shadowptr(a5xx_gpu, ring) ((a5xx_gpu)->shadow_iova + \
+		((ring)->id * sizeof(uint32_t)))
+
+bool a5xx_idle(struct msm_gpu *gpu, struct msm_ringbuffer *ring);
+void a5xx_set_hwcg(struct msm_gpu *gpu, bool state);
+
+void a5xx_preempt_init(struct msm_gpu *gpu);
+void a5xx_preempt_hw_init(struct msm_gpu *gpu);
+void a5xx_preempt_trigger(struct msm_gpu *gpu);
+void a5xx_preempt_irq(struct msm_gpu *gpu);
+void a5xx_preempt_fini(struct msm_gpu *gpu);
+
+void a5xx_flush(struct msm_gpu *gpu, struct msm_ringbuffer *ring, bool sync);
+
+/* Return true if we are in a preempt state */
+static inline bool a5xx_in_preempt(struct a5xx_gpu *a5xx_gpu)
+{
+	int preempt_state = atomic_read(&a5xx_gpu->preempt_state);
+
+	return !(preempt_state == PREEMPT_NONE ||
+			preempt_state == PREEMPT_ABORT);
+}
+
+#endif /* __A5XX_GPU_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a5xx_power.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a5xx_power.c
@@ -0,0 +1,390 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2016 The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/pm_opp.h>
+#include "a5xx_gpu.h"
+
+/*
+ * The GPMU data block is a block of shared registers that can be used to
+ * communicate back and forth. These "registers" are by convention with the GPMU
+ * firwmare and not bound to any specific hardware design
+ */
+
+#define AGC_INIT_BASE REG_A5XX_GPMU_DATA_RAM_BASE
+#define AGC_INIT_MSG_MAGIC (AGC_INIT_BASE + 5)
+#define AGC_MSG_BASE (AGC_INIT_BASE + 7)
+
+#define AGC_MSG_STATE (AGC_MSG_BASE + 0)
+#define AGC_MSG_COMMAND (AGC_MSG_BASE + 1)
+#define AGC_MSG_PAYLOAD_SIZE (AGC_MSG_BASE + 3)
+#define AGC_MSG_PAYLOAD(_o) ((AGC_MSG_BASE + 5) + (_o))
+
+#define AGC_POWER_CONFIG_PRODUCTION_ID 1
+#define AGC_INIT_MSG_VALUE 0xBABEFACE
+
+/* AGC_LM_CONFIG (A540+) */
+#define AGC_LM_CONFIG (136/4)
+#define AGC_LM_CONFIG_GPU_VERSION_SHIFT 17
+#define AGC_LM_CONFIG_ENABLE_GPMU_ADAPTIVE 1
+#define AGC_LM_CONFIG_THROTTLE_DISABLE (2 << 8)
+#define AGC_LM_CONFIG_ISENSE_ENABLE (1 << 4)
+#define AGC_LM_CONFIG_ENABLE_ERROR (3 << 4)
+#define AGC_LM_CONFIG_LLM_ENABLED (1 << 16)
+#define AGC_LM_CONFIG_BCL_DISABLED (1 << 24)
+
+#define AGC_LEVEL_CONFIG (140/4)
+
+static struct {
+	uint32_t reg;
+	uint32_t value;
+} a5xx_sequence_regs[] = {
+	{ 0xB9A1, 0x00010303 },
+	{ 0xB9A2, 0x13000000 },
+	{ 0xB9A3, 0x00460020 },
+	{ 0xB9A4, 0x10000000 },
+	{ 0xB9A5, 0x040A1707 },
+	{ 0xB9A6, 0x00010000 },
+	{ 0xB9A7, 0x0E000904 },
+	{ 0xB9A8, 0x10000000 },
+	{ 0xB9A9, 0x01165000 },
+	{ 0xB9AA, 0x000E0002 },
+	{ 0xB9AB, 0x03884141 },
+	{ 0xB9AC, 0x10000840 },
+	{ 0xB9AD, 0x572A5000 },
+	{ 0xB9AE, 0x00000003 },
+	{ 0xB9AF, 0x00000000 },
+	{ 0xB9B0, 0x10000000 },
+	{ 0xB828, 0x6C204010 },
+	{ 0xB829, 0x6C204011 },
+	{ 0xB82A, 0x6C204012 },
+	{ 0xB82B, 0x6C204013 },
+	{ 0xB82C, 0x6C204014 },
+	{ 0xB90F, 0x00000004 },
+	{ 0xB910, 0x00000002 },
+	{ 0xB911, 0x00000002 },
+	{ 0xB912, 0x00000002 },
+	{ 0xB913, 0x00000002 },
+	{ 0xB92F, 0x00000004 },
+	{ 0xB930, 0x00000005 },
+	{ 0xB931, 0x00000005 },
+	{ 0xB932, 0x00000005 },
+	{ 0xB933, 0x00000005 },
+	{ 0xB96F, 0x00000001 },
+	{ 0xB970, 0x00000003 },
+	{ 0xB94F, 0x00000004 },
+	{ 0xB950, 0x0000000B },
+	{ 0xB951, 0x0000000B },
+	{ 0xB952, 0x0000000B },
+	{ 0xB953, 0x0000000B },
+	{ 0xB907, 0x00000019 },
+	{ 0xB927, 0x00000019 },
+	{ 0xB947, 0x00000019 },
+	{ 0xB967, 0x00000019 },
+	{ 0xB987, 0x00000019 },
+	{ 0xB906, 0x00220001 },
+	{ 0xB926, 0x00220001 },
+	{ 0xB946, 0x00220001 },
+	{ 0xB966, 0x00220001 },
+	{ 0xB986, 0x00300000 },
+	{ 0xAC40, 0x0340FF41 },
+	{ 0xAC41, 0x03BEFED0 },
+	{ 0xAC42, 0x00331FED },
+	{ 0xAC43, 0x021FFDD3 },
+	{ 0xAC44, 0x5555AAAA },
+	{ 0xAC45, 0x5555AAAA },
+	{ 0xB9BA, 0x00000008 },
+};
+
+/*
+ * Get the actual voltage value for the operating point at the specified
+ * frequency
+ */
+static inline uint32_t _get_mvolts(struct msm_gpu *gpu, uint32_t freq)
+{
+	struct drm_device *dev = gpu->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct platform_device *pdev = priv->gpu_pdev;
+	struct dev_pm_opp *opp;
+	u32 ret = 0;
+
+	opp = dev_pm_opp_find_freq_exact(&pdev->dev, freq, true);
+
+	if (!IS_ERR(opp)) {
+		ret = dev_pm_opp_get_voltage(opp) / 1000;
+		dev_pm_opp_put(opp);
+	}
+
+	return ret;
+}
+
+/* Setup thermal limit management */
+static void a530_lm_setup(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	unsigned int i;
+
+	/* Write the block of sequence registers */
+	for (i = 0; i < ARRAY_SIZE(a5xx_sequence_regs); i++)
+		gpu_write(gpu, a5xx_sequence_regs[i].reg,
+			a5xx_sequence_regs[i].value);
+
+	/* Hard code the A530 GPU thermal sensor ID for the GPMU */
+	gpu_write(gpu, REG_A5XX_GPMU_TEMP_SENSOR_ID, 0x60007);
+	gpu_write(gpu, REG_A5XX_GPMU_DELTA_TEMP_THRESHOLD, 0x01);
+	gpu_write(gpu, REG_A5XX_GPMU_TEMP_SENSOR_CONFIG, 0x01);
+
+	/* Until we get clock scaling 0 is always the active power level */
+	gpu_write(gpu, REG_A5XX_GPMU_GPMU_VOLTAGE, 0x80000000 | 0);
+
+	gpu_write(gpu, REG_A5XX_GPMU_BASE_LEAKAGE, a5xx_gpu->lm_leakage);
+
+	/* The threshold is fixed at 6000 for A530 */
+	gpu_write(gpu, REG_A5XX_GPMU_GPMU_PWR_THRESHOLD, 0x80000000 | 6000);
+
+	gpu_write(gpu, REG_A5XX_GPMU_BEC_ENABLE, 0x10001FFF);
+	gpu_write(gpu, REG_A5XX_GDPM_CONFIG1, 0x00201FF1);
+
+	/* Write the voltage table */
+	gpu_write(gpu, REG_A5XX_GPMU_BEC_ENABLE, 0x10001FFF);
+	gpu_write(gpu, REG_A5XX_GDPM_CONFIG1, 0x201FF1);
+
+	gpu_write(gpu, AGC_MSG_STATE, 1);
+	gpu_write(gpu, AGC_MSG_COMMAND, AGC_POWER_CONFIG_PRODUCTION_ID);
+
+	/* Write the max power - hard coded to 5448 for A530 */
+	gpu_write(gpu, AGC_MSG_PAYLOAD(0), 5448);
+	gpu_write(gpu, AGC_MSG_PAYLOAD(1), 1);
+
+	/*
+	 * For now just write the one voltage level - we will do more when we
+	 * can do scaling
+	 */
+	gpu_write(gpu, AGC_MSG_PAYLOAD(2), _get_mvolts(gpu, gpu->fast_rate));
+	gpu_write(gpu, AGC_MSG_PAYLOAD(3), gpu->fast_rate / 1000000);
+
+	gpu_write(gpu, AGC_MSG_PAYLOAD_SIZE, 4 * sizeof(uint32_t));
+	gpu_write(gpu, AGC_INIT_MSG_MAGIC, AGC_INIT_MSG_VALUE);
+}
+
+#define PAYLOAD_SIZE(_size) ((_size) * sizeof(u32))
+#define LM_DCVS_LIMIT 1
+#define LEVEL_CONFIG ~(0x303)
+
+static void a540_lm_setup(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	u32 config;
+
+	/* The battery current limiter isn't enabled for A540 */
+	config = AGC_LM_CONFIG_BCL_DISABLED;
+	config |= adreno_patchid(adreno_gpu) << AGC_LM_CONFIG_GPU_VERSION_SHIFT;
+
+	/* For now disable GPMU side throttling */
+	config |= AGC_LM_CONFIG_THROTTLE_DISABLE;
+
+	/* Until we get clock scaling 0 is always the active power level */
+	gpu_write(gpu, REG_A5XX_GPMU_GPMU_VOLTAGE, 0x80000000 | 0);
+
+	/* Fixed at 6000 for now */
+	gpu_write(gpu, REG_A5XX_GPMU_GPMU_PWR_THRESHOLD, 0x80000000 | 6000);
+
+	gpu_write(gpu, AGC_MSG_STATE, 0x80000001);
+	gpu_write(gpu, AGC_MSG_COMMAND, AGC_POWER_CONFIG_PRODUCTION_ID);
+
+	gpu_write(gpu, AGC_MSG_PAYLOAD(0), 5448);
+	gpu_write(gpu, AGC_MSG_PAYLOAD(1), 1);
+
+	gpu_write(gpu, AGC_MSG_PAYLOAD(2), _get_mvolts(gpu, gpu->fast_rate));
+	gpu_write(gpu, AGC_MSG_PAYLOAD(3), gpu->fast_rate / 1000000);
+
+	gpu_write(gpu, AGC_MSG_PAYLOAD(AGC_LM_CONFIG), config);
+	gpu_write(gpu, AGC_MSG_PAYLOAD(AGC_LEVEL_CONFIG), LEVEL_CONFIG);
+	gpu_write(gpu, AGC_MSG_PAYLOAD_SIZE,
+	PAYLOAD_SIZE(AGC_LEVEL_CONFIG + 1));
+
+	gpu_write(gpu, AGC_INIT_MSG_MAGIC, AGC_INIT_MSG_VALUE);
+}
+
+/* Enable SP/TP cpower collapse */
+static void a5xx_pc_init(struct msm_gpu *gpu)
+{
+	gpu_write(gpu, REG_A5XX_GPMU_PWR_COL_INTER_FRAME_CTRL, 0x7F);
+	gpu_write(gpu, REG_A5XX_GPMU_PWR_COL_BINNING_CTRL, 0);
+	gpu_write(gpu, REG_A5XX_GPMU_PWR_COL_INTER_FRAME_HYST, 0xA0080);
+	gpu_write(gpu, REG_A5XX_GPMU_PWR_COL_STAGGER_DELAY, 0x600040);
+}
+
+/* Enable the GPMU microcontroller */
+static int a5xx_gpmu_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	struct msm_ringbuffer *ring = gpu->rb[0];
+
+	if (!a5xx_gpu->gpmu_dwords)
+		return 0;
+
+	/* Turn off protected mode for this operation */
+	OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
+	OUT_RING(ring, 0);
+
+	/* Kick off the IB to load the GPMU microcode */
+	OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
+	OUT_RING(ring, lower_32_bits(a5xx_gpu->gpmu_iova));
+	OUT_RING(ring, upper_32_bits(a5xx_gpu->gpmu_iova));
+	OUT_RING(ring, a5xx_gpu->gpmu_dwords);
+
+	/* Turn back on protected mode */
+	OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
+	OUT_RING(ring, 1);
+
+	a5xx_flush(gpu, ring, true);
+
+	if (!a5xx_idle(gpu, ring)) {
+		DRM_ERROR("%s: Unable to load GPMU firmware. GPMU will not be active\n",
+			gpu->name);
+		return -EINVAL;
+	}
+
+	if (adreno_is_a530(adreno_gpu))
+		gpu_write(gpu, REG_A5XX_GPMU_WFI_CONFIG, 0x4014);
+
+	/* Kick off the GPMU */
+	gpu_write(gpu, REG_A5XX_GPMU_CM3_SYSRESET, 0x0);
+
+	/*
+	 * Wait for the GPMU to respond. It isn't fatal if it doesn't, we just
+	 * won't have advanced power collapse.
+	 */
+	if (spin_usecs(gpu, 25, REG_A5XX_GPMU_GENERAL_0, 0xFFFFFFFF,
+		0xBABEFACE))
+		DRM_ERROR("%s: GPMU firmware initialization timed out\n",
+			gpu->name);
+
+	if (!adreno_is_a530(adreno_gpu)) {
+		u32 val = gpu_read(gpu, REG_A5XX_GPMU_GENERAL_1);
+
+		if (val)
+			DRM_ERROR("%s: GPMU firmware initialization failed: %d\n",
+				  gpu->name, val);
+	}
+
+	return 0;
+}
+
+/* Enable limits management */
+static void a5xx_lm_enable(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+
+	/* This init sequence only applies to A530 */
+	if (!adreno_is_a530(adreno_gpu))
+		return;
+
+	gpu_write(gpu, REG_A5XX_GDPM_INT_MASK, 0x0);
+	gpu_write(gpu, REG_A5XX_GDPM_INT_EN, 0x0A);
+	gpu_write(gpu, REG_A5XX_GPMU_GPMU_VOLTAGE_INTR_EN_MASK, 0x01);
+	gpu_write(gpu, REG_A5XX_GPMU_TEMP_THRESHOLD_INTR_EN_MASK, 0x50000);
+	gpu_write(gpu, REG_A5XX_GPMU_THROTTLE_UNMASK_FORCE_CTRL, 0x30000);
+
+	gpu_write(gpu, REG_A5XX_GPMU_CLOCK_THROTTLE_CTRL, 0x011);
+}
+
+int a5xx_power_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int ret;
+
+	/* Not all A5xx chips have a GPMU */
+	if (!(adreno_is_a530(adreno_gpu) || adreno_is_a540(adreno_gpu)))
+		return 0;
+
+	/* Set up the limits management */
+	if (adreno_is_a530(adreno_gpu))
+		a530_lm_setup(gpu);
+	else if (adreno_is_a540(adreno_gpu))
+		a540_lm_setup(gpu);
+
+	/* Set up SP/TP power collpase */
+	a5xx_pc_init(gpu);
+
+	/* Start the GPMU */
+	ret = a5xx_gpmu_init(gpu);
+	if (ret)
+		return ret;
+
+	/* Start the limits management */
+	a5xx_lm_enable(gpu);
+
+	return 0;
+}
+
+void a5xx_gpmu_ucode_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	struct drm_device *drm = gpu->dev;
+	uint32_t dwords = 0, offset = 0, bosize;
+	unsigned int *data, *ptr, *cmds;
+	unsigned int cmds_size;
+
+	if (!(adreno_is_a530(adreno_gpu) || adreno_is_a540(adreno_gpu)))
+		return;
+
+	if (a5xx_gpu->gpmu_bo)
+		return;
+
+	data = (unsigned int *) adreno_gpu->fw[ADRENO_FW_GPMU]->data;
+
+	/*
+	 * The first dword is the size of the remaining data in dwords. Use it
+	 * as a checksum of sorts and make sure it matches the actual size of
+	 * the firmware that we read
+	 */
+
+	if (adreno_gpu->fw[ADRENO_FW_GPMU]->size < 8 ||
+		(data[0] < 2) || (data[0] >=
+			(adreno_gpu->fw[ADRENO_FW_GPMU]->size >> 2)))
+		return;
+
+	/* The second dword is an ID - look for 2 (GPMU_FIRMWARE_ID) */
+	if (data[1] != 2)
+		return;
+
+	cmds = data + data[2] + 3;
+	cmds_size = data[0] - data[2] - 2;
+
+	/*
+	 * A single type4 opcode can only have so many values attached so
+	 * add enough opcodes to load the all the commands
+	 */
+	bosize = (cmds_size + (cmds_size / TYPE4_MAX_PAYLOAD) + 1) << 2;
+
+	ptr = msm_gem_kernel_new(drm, bosize,
+		MSM_BO_WC | MSM_BO_GPU_READONLY, gpu->aspace,
+		&a5xx_gpu->gpmu_bo, &a5xx_gpu->gpmu_iova);
+	if (IS_ERR(ptr))
+		return;
+
+	msm_gem_object_set_name(a5xx_gpu->gpmu_bo, "gpmufw");
+
+	while (cmds_size > 0) {
+		int i;
+		uint32_t _size = cmds_size > TYPE4_MAX_PAYLOAD ?
+			TYPE4_MAX_PAYLOAD : cmds_size;
+
+		ptr[dwords++] = PKT4(REG_A5XX_GPMU_INST_RAM_BASE + offset,
+			_size);
+
+		for (i = 0; i < _size; i++)
+			ptr[dwords++] = *cmds++;
+
+		offset += _size;
+		cmds_size -= _size;
+	}
+
+	msm_gem_put_vaddr(a5xx_gpu->gpmu_bo);
+	a5xx_gpu->gpmu_dwords = dwords;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a5xx_preempt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a5xx_preempt.c
@@ -0,0 +1,328 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "msm_gem.h"
+#include "a5xx_gpu.h"
+
+/*
+ * Try to transition the preemption state from old to new. Return
+ * true on success or false if the original state wasn't 'old'
+ */
+static inline bool try_preempt_state(struct a5xx_gpu *a5xx_gpu,
+		enum preempt_state old, enum preempt_state new)
+{
+	enum preempt_state cur = atomic_cmpxchg(&a5xx_gpu->preempt_state,
+		old, new);
+
+	return (cur == old);
+}
+
+/*
+ * Force the preemption state to the specified state.  This is used in cases
+ * where the current state is known and won't change
+ */
+static inline void set_preempt_state(struct a5xx_gpu *gpu,
+		enum preempt_state new)
+{
+	/*
+	 * preempt_state may be read by other cores trying to trigger a
+	 * preemption or in the interrupt handler so barriers are needed
+	 * before...
+	 */
+	smp_mb__before_atomic();
+	atomic_set(&gpu->preempt_state, new);
+	/* ... and after*/
+	smp_mb__after_atomic();
+}
+
+/* Write the most recent wptr for the given ring into the hardware */
+static inline void update_wptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	unsigned long flags;
+	uint32_t wptr;
+
+	if (!ring)
+		return;
+
+	spin_lock_irqsave(&ring->preempt_lock, flags);
+	wptr = get_wptr(ring);
+	spin_unlock_irqrestore(&ring->preempt_lock, flags);
+
+	gpu_write(gpu, REG_A5XX_CP_RB_WPTR, wptr);
+}
+
+/* Return the highest priority ringbuffer with something in it */
+static struct msm_ringbuffer *get_next_ring(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	unsigned long flags;
+	int i;
+
+	for (i = 0; i < gpu->nr_rings; i++) {
+		bool empty;
+		struct msm_ringbuffer *ring = gpu->rb[i];
+
+		spin_lock_irqsave(&ring->preempt_lock, flags);
+		empty = (get_wptr(ring) == gpu->funcs->get_rptr(gpu, ring));
+		if (!empty && ring == a5xx_gpu->cur_ring)
+			empty = ring->memptrs->fence == a5xx_gpu->last_seqno[i];
+		spin_unlock_irqrestore(&ring->preempt_lock, flags);
+
+		if (!empty)
+			return ring;
+	}
+
+	return NULL;
+}
+
+static void a5xx_preempt_timer(struct timer_list *t)
+{
+	struct a5xx_gpu *a5xx_gpu = from_timer(a5xx_gpu, t, preempt_timer);
+	struct msm_gpu *gpu = &a5xx_gpu->base.base;
+	struct drm_device *dev = gpu->dev;
+
+	if (!try_preempt_state(a5xx_gpu, PREEMPT_TRIGGERED, PREEMPT_FAULTED))
+		return;
+
+	DRM_DEV_ERROR(dev->dev, "%s: preemption timed out\n", gpu->name);
+	kthread_queue_work(gpu->worker, &gpu->recover_work);
+}
+
+/* Try to trigger a preemption switch */
+void a5xx_preempt_trigger(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	unsigned long flags;
+	struct msm_ringbuffer *ring;
+
+	if (gpu->nr_rings == 1)
+		return;
+
+	/*
+	 * Serialize preemption start to ensure that we always make
+	 * decision on latest state. Otherwise we can get stuck in
+	 * lower priority or empty ring.
+	 */
+	spin_lock_irqsave(&a5xx_gpu->preempt_start_lock, flags);
+
+	/*
+	 * Try to start preemption by moving from NONE to START. If
+	 * unsuccessful, a preemption is already in flight
+	 */
+	if (!try_preempt_state(a5xx_gpu, PREEMPT_NONE, PREEMPT_START))
+		goto out;
+
+	/* Get the next ring to preempt to */
+	ring = get_next_ring(gpu);
+
+	/*
+	 * If no ring is populated or the highest priority ring is the current
+	 * one do nothing except to update the wptr to the latest and greatest
+	 */
+	if (!ring || (a5xx_gpu->cur_ring == ring)) {
+		/*
+		 * Its possible that while a preemption request is in progress
+		 * from an irq context, a user context trying to submit might
+		 * fail to update the write pointer, because it determines
+		 * that the preempt state is not PREEMPT_NONE.
+		 *
+		 * Close the race by introducing an intermediate
+		 * state PREEMPT_ABORT to let the submit path
+		 * know that the ringbuffer is not going to change
+		 * and can safely update the write pointer.
+		 */
+
+		set_preempt_state(a5xx_gpu, PREEMPT_ABORT);
+		update_wptr(gpu, a5xx_gpu->cur_ring);
+		set_preempt_state(a5xx_gpu, PREEMPT_NONE);
+		goto out;
+	}
+
+	spin_unlock_irqrestore(&a5xx_gpu->preempt_start_lock, flags);
+
+	/* Make sure the wptr doesn't update while we're in motion */
+	spin_lock_irqsave(&ring->preempt_lock, flags);
+	a5xx_gpu->preempt[ring->id]->wptr = get_wptr(ring);
+	spin_unlock_irqrestore(&ring->preempt_lock, flags);
+
+	/* Set the address of the incoming preemption record */
+	gpu_write64(gpu, REG_A5XX_CP_CONTEXT_SWITCH_RESTORE_ADDR_LO,
+		a5xx_gpu->preempt_iova[ring->id]);
+
+	a5xx_gpu->next_ring = ring;
+
+	/* Start a timer to catch a stuck preemption */
+	mod_timer(&a5xx_gpu->preempt_timer, jiffies + msecs_to_jiffies(10000));
+
+	/* Set the preemption state to triggered */
+	set_preempt_state(a5xx_gpu, PREEMPT_TRIGGERED);
+
+	/* Make sure everything is written before hitting the button */
+	wmb();
+
+	/* And actually start the preemption */
+	gpu_write(gpu, REG_A5XX_CP_CONTEXT_SWITCH_CNTL, 1);
+	return;
+
+out:
+	spin_unlock_irqrestore(&a5xx_gpu->preempt_start_lock, flags);
+}
+
+void a5xx_preempt_irq(struct msm_gpu *gpu)
+{
+	uint32_t status;
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	struct drm_device *dev = gpu->dev;
+
+	if (!try_preempt_state(a5xx_gpu, PREEMPT_TRIGGERED, PREEMPT_PENDING))
+		return;
+
+	/* Delete the preemption watchdog timer */
+	del_timer(&a5xx_gpu->preempt_timer);
+
+	/*
+	 * The hardware should be setting CP_CONTEXT_SWITCH_CNTL to zero before
+	 * firing the interrupt, but there is a non zero chance of a hardware
+	 * condition or a software race that could set it again before we have a
+	 * chance to finish. If that happens, log and go for recovery
+	 */
+	status = gpu_read(gpu, REG_A5XX_CP_CONTEXT_SWITCH_CNTL);
+	if (unlikely(status)) {
+		set_preempt_state(a5xx_gpu, PREEMPT_FAULTED);
+		DRM_DEV_ERROR(dev->dev, "%s: Preemption failed to complete\n",
+			gpu->name);
+		kthread_queue_work(gpu->worker, &gpu->recover_work);
+		return;
+	}
+
+	a5xx_gpu->cur_ring = a5xx_gpu->next_ring;
+	a5xx_gpu->next_ring = NULL;
+
+	update_wptr(gpu, a5xx_gpu->cur_ring);
+
+	set_preempt_state(a5xx_gpu, PREEMPT_NONE);
+
+	/*
+	 * Try to trigger preemption again in case there was a submit or
+	 * retire during ring switch
+	 */
+	a5xx_preempt_trigger(gpu);
+}
+
+void a5xx_preempt_hw_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	int i;
+
+	/* Always come up on rb 0 */
+	a5xx_gpu->cur_ring = gpu->rb[0];
+
+	/* No preemption if we only have one ring */
+	if (gpu->nr_rings == 1)
+		return;
+
+	for (i = 0; i < gpu->nr_rings; i++) {
+		a5xx_gpu->preempt[i]->data = 0;
+		a5xx_gpu->preempt[i]->info = 0;
+		a5xx_gpu->preempt[i]->wptr = 0;
+		a5xx_gpu->preempt[i]->rptr = 0;
+		a5xx_gpu->preempt[i]->rbase = gpu->rb[i]->iova;
+		a5xx_gpu->preempt[i]->rptr_addr = shadowptr(a5xx_gpu, gpu->rb[i]);
+	}
+
+	/* Write a 0 to signal that we aren't switching pagetables */
+	gpu_write64(gpu, REG_A5XX_CP_CONTEXT_SWITCH_SMMU_INFO_LO, 0);
+
+	/* Reset the preemption state */
+	set_preempt_state(a5xx_gpu, PREEMPT_NONE);
+}
+
+static int preempt_init_ring(struct a5xx_gpu *a5xx_gpu,
+		struct msm_ringbuffer *ring)
+{
+	struct adreno_gpu *adreno_gpu = &a5xx_gpu->base;
+	struct msm_gpu *gpu = &adreno_gpu->base;
+	struct a5xx_preempt_record *ptr;
+	void *counters;
+	struct drm_gem_object *bo = NULL, *counters_bo = NULL;
+	u64 iova = 0, counters_iova = 0;
+
+	ptr = msm_gem_kernel_new(gpu->dev,
+		A5XX_PREEMPT_RECORD_SIZE + A5XX_PREEMPT_COUNTER_SIZE,
+		MSM_BO_WC | MSM_BO_MAP_PRIV, gpu->aspace, &bo, &iova);
+
+	if (IS_ERR(ptr))
+		return PTR_ERR(ptr);
+
+	/* The buffer to store counters needs to be unprivileged */
+	counters = msm_gem_kernel_new(gpu->dev,
+		A5XX_PREEMPT_COUNTER_SIZE,
+		MSM_BO_WC, gpu->aspace, &counters_bo, &counters_iova);
+	if (IS_ERR(counters)) {
+		msm_gem_kernel_put(bo, gpu->aspace);
+		return PTR_ERR(counters);
+	}
+
+	msm_gem_object_set_name(bo, "preempt");
+	msm_gem_object_set_name(counters_bo, "preempt_counters");
+
+	a5xx_gpu->preempt_bo[ring->id] = bo;
+	a5xx_gpu->preempt_counters_bo[ring->id] = counters_bo;
+	a5xx_gpu->preempt_iova[ring->id] = iova;
+	a5xx_gpu->preempt[ring->id] = ptr;
+
+	/* Set up the defaults on the preemption record */
+
+	ptr->magic = A5XX_PREEMPT_RECORD_MAGIC;
+	ptr->info = 0;
+	ptr->data = 0;
+	ptr->cntl = MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE;
+
+	ptr->counter = counters_iova;
+
+	return 0;
+}
+
+void a5xx_preempt_fini(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	int i;
+
+	for (i = 0; i < gpu->nr_rings; i++) {
+		msm_gem_kernel_put(a5xx_gpu->preempt_bo[i], gpu->aspace);
+		msm_gem_kernel_put(a5xx_gpu->preempt_counters_bo[i], gpu->aspace);
+	}
+}
+
+void a5xx_preempt_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+	int i;
+
+	/* No preemption if we only have one ring */
+	if (gpu->nr_rings <= 1)
+		return;
+
+	for (i = 0; i < gpu->nr_rings; i++) {
+		if (preempt_init_ring(a5xx_gpu, gpu->rb[i])) {
+			/*
+			 * On any failure our adventure is over. Clean up and
+			 * set nr_rings to 1 to force preemption off
+			 */
+			a5xx_preempt_fini(gpu);
+			gpu->nr_rings = 1;
+
+			return;
+		}
+	}
+
+	spin_lock_init(&a5xx_gpu->preempt_start_lock);
+	timer_setup(&a5xx_gpu->preempt_timer, a5xx_preempt_timer, 0);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a6xx_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a6xx_catalog.c
@@ -0,0 +1,1339 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+#include "a6xx_gpu.h"
+#include "a6xx.xml.h"
+#include "a6xx_gmu.xml.h"
+
+static const struct adreno_reglist a612_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000081},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01202222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05522022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+/* For a615 family (a615, a616, a618 and a619) */
+static const struct adreno_reglist a615_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0,  0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0,  0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0,  0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP1,  0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP1, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0,  0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP1,  0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP1, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP1, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE,  0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE,  0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002020},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU1, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU2, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU3, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU1, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU2, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU3, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05022022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a630_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP2, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP3, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02022220},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP1, 0x02022220},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP2, 0x02022220},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP3, 0x02022220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP2, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP3, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP1, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP2, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP3, 0x0000f3cf},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP1, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP2, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP3, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP2, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP3, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP2, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP3, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP1, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP2, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP3, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP2, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP3, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP2, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP3, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP1, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP2, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP3, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP1, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP2, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP3, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP2, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP3, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP2, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP3, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP1, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP2, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP3, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP1, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP2, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP3, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB2, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB3, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB1, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB2, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB3, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU1, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU2, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU3, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU1, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU2, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU3, 0x00040f00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05022022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a640_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05222022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a650_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a660_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{},
+};
+
+static const struct adreno_reglist a690_hwcg[] = {
+	{REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{REG_A6XX_RBBM_CLOCK_CNTL, 0x8AA8AA82},
+	{REG_A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{REG_A6XX_GPU_GMU_AO_GMU_CGC_MODE_CNTL, 0x20200},
+	{REG_A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x10111},
+	{REG_A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x5555},
+	{}
+};
+
+/* For a615, a616, a618, a619, a630, a640 and a680 */
+static const u32 a630_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
+	A6XX_PROTECT_RDONLY(0x00501, 0x0005),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00800, 0x0082),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
+	A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
+	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
+	A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
+	A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
+	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
+	A6XX_PROTECT_NORDWR(0x09e70, 0x0001),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x032f),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
+	A6XX_PROTECT_NORDWR(0x0be20, 0x17df),
+	A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x11c00, 0x0000), /* note: infinite range */
+};
+DECLARE_ADRENO_PROTECT(a630_protect, 32);
+
+/* These are for a620 and a650 */
+static const u32 a650_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
+	A6XX_PROTECT_RDONLY(0x00501, 0x0005),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00800, 0x0082),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
+	A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
+	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
+	A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
+	A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
+	A6XX_PROTECT_NORDWR(0x08e80, 0x027f),
+	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
+	A6XX_PROTECT_NORDWR(0x09e60, 0x0011),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x032f),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0b608, 0x0007),
+	A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
+	A6XX_PROTECT_NORDWR(0x0be20, 0x17df),
+	A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x18400, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1a800, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
+	A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
+	A6XX_PROTECT_NORDWR(0x1f887, 0x001b),
+	A6XX_PROTECT_NORDWR(0x1f8c0, 0x0000), /* note: infinite range */
+};
+DECLARE_ADRENO_PROTECT(a650_protect, 48);
+
+/* These are for a635 and a660 */
+static const u32 a660_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
+	A6XX_PROTECT_RDONLY(0x00501, 0x0005),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x02f4),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00800, 0x0082),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
+	A6XX_PROTECT_RDONLY(0x008de, 0x00ae),
+	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x0272),
+	A6XX_PROTECT_NORDWR(0x00e00, 0x0001),
+	A6XX_PROTECT_NORDWR(0x00e03, 0x000c),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
+	A6XX_PROTECT_NORDWR(0x08e80, 0x027f),
+	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
+	A6XX_PROTECT_NORDWR(0x09e60, 0x0011),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x012f),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0b608, 0x0006),
+	A6XX_PROTECT_NORDWR(0x0be02, 0x0001),
+	A6XX_PROTECT_NORDWR(0x0be20, 0x015f),
+	A6XX_PROTECT_NORDWR(0x0d000, 0x05ff),
+	A6XX_PROTECT_NORDWR(0x0f000, 0x0bff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x18400, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1a400, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
+	A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
+	A6XX_PROTECT_NORDWR(0x1f860, 0x0000),
+	A6XX_PROTECT_NORDWR(0x1f887, 0x001b),
+	A6XX_PROTECT_NORDWR(0x1f8c0, 0x0000), /* note: infinite range */
+};
+DECLARE_ADRENO_PROTECT(a660_protect, 48);
+
+/* These are for a690 */
+static const u32 a690_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x004ff),
+	A6XX_PROTECT_RDONLY(0x00501, 0x00001),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x002f4),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x00000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x00000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x00000),
+	A6XX_PROTECT_NORDWR(0x00800, 0x00082),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x00008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x00024),
+	A6XX_PROTECT_RDONLY(0x008de, 0x000ae),
+	A6XX_PROTECT_NORDWR(0x00900, 0x0004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x00272),
+	A6XX_PROTECT_NORDWR(0x00e00, 0x00001),
+	A6XX_PROTECT_NORDWR(0x00e03, 0x0000c),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x000c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x01fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x001cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x00000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x00007),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x0001f),
+	A6XX_PROTECT_NORDWR(0x08e80, 0x0027f),
+	A6XX_PROTECT_NORDWR(0x09624, 0x001db),
+	A6XX_PROTECT_NORDWR(0x09e60, 0x00011),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x00187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x001cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x00000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x0012f),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x00000),
+	A6XX_PROTECT_NORDWR(0x0b608, 0x00006),
+	A6XX_PROTECT_NORDWR(0x0be02, 0x00001),
+	A6XX_PROTECT_NORDWR(0x0be20, 0x0015f),
+	A6XX_PROTECT_NORDWR(0x0d000, 0x005ff),
+	A6XX_PROTECT_NORDWR(0x0f000, 0x00bff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x01fff),
+	A6XX_PROTECT_NORDWR(0x11c00, 0x00000), /*note: infiite range */
+};
+DECLARE_ADRENO_PROTECT(a690_protect, 48);
+
+static const struct adreno_info a6xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x06010000),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 610,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+		},
+		.gmem = (SZ_128K + SZ_4K),
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init = a6xx_gpu_init,
+		.zapfw = "a610_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a612_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00080000,
+		},
+		/*
+		 * There are (at least) three SoCs implementing A610: SM6125
+		 * (trinket), SM6115 (bengal) and SM6225 (khaje). Trinket does
+		 * not have speedbinning, as only a single SKU exists and we
+		 * don't support khaje upstream yet.  Hence, this matching
+		 * table is only valid for bengal.
+		 */
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 206, 1 },
+			{ 200, 2 },
+			{ 157, 3 },
+			{ 127, 4 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06010500),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 615,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a630_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x0018000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			/*
+			 * The default speed bin (0) has the same values as
+			 * speed bin 90 which goes up to 432 MHz.
+			 */
+			{ 0,   0 },
+			{ 90,  0 },
+			{ 105, 1 },
+			{ 146, 2 },
+			{ 163, 3 },
+		),
+	}, {
+		.machine = "qcom,sm7150",
+		.chip_ids = ADRENO_CHIP_IDS(0x06010800),
+		.family = ADRENO_6XX_GEN1,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a630_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mbn",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00180000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 128, 1 },
+			{ 146, 2 },
+			{ 167, 3 },
+			{ 172, 4 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06010800),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 618,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a630_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.a6xx = &(const struct a6xx_info) {
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00180000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 169, 1 },
+			{ 174, 2 },
+		),
+	}, {
+		.machine = "qcom,sm4350",
+		.chip_ids = ADRENO_CHIP_IDS(0x06010900),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 619,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a619_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00018000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 138, 1 },
+			{ 92,  2 },
+		),
+	}, {
+		.machine = "qcom,sm6375",
+		.chip_ids = ADRENO_CHIP_IDS(0x06010901),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 619,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a619_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00018000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 190, 1 },
+			{ 177, 2 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06010900),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 619,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a619_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a615_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a615_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00000222,
+			.prim_fifo_threshold = 0x00018000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 120, 4 },
+			{ 138, 3 },
+			{ 169, 2 },
+			{ 180, 1 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(
+			0x06030001,
+			0x06030002
+		),
+		.family = ADRENO_6XX_GEN1,
+		.revn = 630,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a630_gmu.bin",
+		},
+		.gmem = SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a630_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a630_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00180000,
+		},
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06040001),
+		.family = ADRENO_6XX_GEN2,
+		.revn = 640,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a640_gmu.bin",
+		},
+		.gmem = SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a640_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a640_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00180000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0, 0 },
+			{ 1, 1 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06050002),
+		.family = ADRENO_6XX_GEN3,
+		.revn = 650,
+		.fw = {
+			[ADRENO_FW_SQE] = "a650_sqe.fw",
+			[ADRENO_FW_GMU] = "a650_gmu.bin",
+		},
+		.gmem = SZ_1M + SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a650_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a650_hwcg,
+			.protect = &a650_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00300200,
+		},
+		.address_space_size = SZ_16G,
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0, 0 },
+			{ 1, 1 },
+			{ 2, 3 }, /* Yep, 2 and 3 are swapped! :/ */
+			{ 3, 2 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06060001),
+		.family = ADRENO_6XX_GEN4,
+		.revn = 660,
+		.fw = {
+			[ADRENO_FW_SQE] = "a660_sqe.fw",
+			[ADRENO_FW_GMU] = "a660_gmu.bin",
+		},
+		.gmem = SZ_1M + SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a660_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a660_hwcg,
+			.protect = &a660_protect,
+			.gmu_cgc_mode = 0x00020000,
+			.prim_fifo_threshold = 0x00300200,
+		},
+		.address_space_size = SZ_16G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06060300),
+		.family = ADRENO_6XX_GEN4,
+		.fw = {
+			[ADRENO_FW_SQE] = "a660_sqe.fw",
+			[ADRENO_FW_GMU] = "a663_gmu.bin",
+		},
+		.gmem = SZ_1M + SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a690_hwcg,
+			.protect = &a660_protect,
+			.gmu_cgc_mode = 0x00020200,
+			.prim_fifo_threshold = 0x00300200,
+		},
+		.address_space_size = SZ_16G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06030500),
+		.family = ADRENO_6XX_GEN4,
+		.fw = {
+			[ADRENO_FW_SQE] = "a660_sqe.fw",
+			[ADRENO_FW_GMU] = "a660_gmu.bin",
+		},
+		.gmem = SZ_512K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a660_zap.mbn",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a660_hwcg,
+			.protect = &a660_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00200200,
+		},
+		.address_space_size = SZ_16G,
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 117, 0 },
+			{ 172, 2 }, /* Called speedbin 1 downstream, but let's not break things! */
+			{ 190, 1 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06080001),
+		.family = ADRENO_6XX_GEN2,
+		.revn = 680,
+		.fw = {
+			[ADRENO_FW_SQE] = "a630_sqe.fw",
+			[ADRENO_FW_GMU] = "a640_gmu.bin",
+		},
+		.gmem = SZ_2M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT,
+		.init = a6xx_gpu_init,
+		.zapfw = "a640_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a640_hwcg,
+			.protect = &a630_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x00200200,
+		},
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x06090000),
+		.family = ADRENO_6XX_GEN4,
+		.fw = {
+			[ADRENO_FW_SQE] = "a660_sqe.fw",
+			[ADRENO_FW_GMU] = "a660_gmu.bin",
+		},
+		.gmem = SZ_4M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a690_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a690_hwcg,
+			.protect = &a690_protect,
+			.gmu_cgc_mode = 0x00020200,
+			.prim_fifo_threshold = 0x00800200,
+		},
+		.address_space_size = SZ_16G,
+	}
+};
+DECLARE_ADRENO_GPULIST(a6xx);
+
+MODULE_FIRMWARE("qcom/a615_zap.mbn");
+MODULE_FIRMWARE("qcom/a619_gmu.bin");
+MODULE_FIRMWARE("qcom/a630_sqe.fw");
+MODULE_FIRMWARE("qcom/a630_gmu.bin");
+MODULE_FIRMWARE("qcom/a630_zap.mbn");
+MODULE_FIRMWARE("qcom/a640_gmu.bin");
+MODULE_FIRMWARE("qcom/a650_gmu.bin");
+MODULE_FIRMWARE("qcom/a650_sqe.fw");
+MODULE_FIRMWARE("qcom/a660_gmu.bin");
+MODULE_FIRMWARE("qcom/a660_sqe.fw");
+
+static const struct adreno_reglist a702_hwcg[] = {
+	{ REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000081 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01202222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040f00 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x05522022 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002 },
+	{ REG_A6XX_RBBM_ISDB_CNT, 0x00000182 },
+	{ REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_FCHE, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_FCHE, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_FCHE, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_GLC, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GLC, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GLC, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_MHUB, 0x00000002 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_MHUB, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_MHUB, 0x00000000 },
+	{}
+};
+
+static const struct adreno_reglist a730_hwcg[] = {
+	{ REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02022222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222220 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x44000f00 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00555555 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00440044 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE2_GRAS, 0x00000222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GRAS, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222223 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GPC, 0x00222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_LRZ, 0x55555552 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_CP, 0x00000223 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL, 0x8aa8aa82 },
+	{ REG_A6XX_RBBM_ISDB_CNT, 0x00000182 },
+	{ REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
+	{},
+};
+
+static const struct adreno_reglist a740_hwcg[] = {
+	{ REG_A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_SP0, 0x22022222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_SP0, 0x003cf3cf },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222220 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
+	{ REG_A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000444 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x44000f00 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00555555 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_RAC, 0x00440044 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE2_GRAS, 0x00000222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GRAS, 0x00222222 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_GPC, 0x02222223 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_VFD, 0x00222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_GPC, 0x00222222 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_VFD, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_VFD, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_BV_LRZ, 0x55555552 },
+	{ REG_A7XX_RBBM_CLOCK_HYST2_VFD, 0x00000000 },
+	{ REG_A7XX_RBBM_CLOCK_MODE_CP, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL, 0x8aa8aa82 },
+	{ REG_A6XX_RBBM_ISDB_CNT, 0x00000182 },
+	{ REG_A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_SP_HYST_CNT, 0x00000000 },
+	{ REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
+	{ REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
+	{ REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
+	{},
+};
+
+static const u32 a730_protect_regs[] = {
+	A6XX_PROTECT_RDONLY(0x00000, 0x04ff),
+	A6XX_PROTECT_RDONLY(0x0050b, 0x0058),
+	A6XX_PROTECT_NORDWR(0x0050e, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00510, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00534, 0x0000),
+	A6XX_PROTECT_RDONLY(0x005fb, 0x009d),
+	A6XX_PROTECT_NORDWR(0x00699, 0x01e9),
+	A6XX_PROTECT_NORDWR(0x008a0, 0x0008),
+	A6XX_PROTECT_NORDWR(0x008ab, 0x0024),
+	/* 0x008d0-0x008dd and 0x008e0-0x008e6 are unprotected on purpose for tools like perfetto */
+	A6XX_PROTECT_NORDWR(0x008de, 0x0001),
+	A6XX_PROTECT_RDONLY(0x008e7, 0x014b),
+	A6XX_PROTECT_NORDWR(0x00900, 0x004d),
+	A6XX_PROTECT_NORDWR(0x0098d, 0x00b2),
+	A6XX_PROTECT_NORDWR(0x00a41, 0x01be),
+	A6XX_PROTECT_NORDWR(0x00df0, 0x0001),
+	A6XX_PROTECT_NORDWR(0x00e01, 0x0000),
+	A6XX_PROTECT_NORDWR(0x00e07, 0x0008),
+	A6XX_PROTECT_NORDWR(0x03c00, 0x00c3),
+	A6XX_PROTECT_RDONLY(0x03cc4, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x08630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x08e00, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e08, 0x0000),
+	A6XX_PROTECT_NORDWR(0x08e50, 0x001f),
+	A6XX_PROTECT_NORDWR(0x08e80, 0x0280),
+	A6XX_PROTECT_NORDWR(0x09624, 0x01db),
+	A6XX_PROTECT_NORDWR(0x09e40, 0x0000),
+	A6XX_PROTECT_NORDWR(0x09e64, 0x000d),
+	A6XX_PROTECT_NORDWR(0x09e78, 0x0187),
+	A6XX_PROTECT_NORDWR(0x0a630, 0x01cf),
+	A6XX_PROTECT_NORDWR(0x0ae02, 0x0000),
+	A6XX_PROTECT_NORDWR(0x0ae50, 0x000f),
+	A6XX_PROTECT_NORDWR(0x0ae66, 0x0003),
+	A6XX_PROTECT_NORDWR(0x0ae6f, 0x0003),
+	A6XX_PROTECT_NORDWR(0x0b604, 0x0003),
+	A6XX_PROTECT_NORDWR(0x0ec00, 0x0fff),
+	A6XX_PROTECT_RDONLY(0x0fc00, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x18400, 0x0053),
+	A6XX_PROTECT_RDONLY(0x18454, 0x0004),
+	A6XX_PROTECT_NORDWR(0x18459, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1a459, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1c459, 0x1fff),
+	A6XX_PROTECT_NORDWR(0x1f400, 0x0443),
+	A6XX_PROTECT_RDONLY(0x1f844, 0x007b),
+	A6XX_PROTECT_NORDWR(0x1f860, 0x0000),
+	A6XX_PROTECT_NORDWR(0x1f878, 0x002a),
+	/* CP_PROTECT_REG[45, 46] are left untouched! */
+	0,
+	0,
+	A6XX_PROTECT_NORDWR(0x1f8c0, 0x00000),
+};
+DECLARE_ADRENO_PROTECT(a730_protect, 48);
+
+static const struct adreno_info a7xx_gpus[] = {
+	{
+		.chip_ids = ADRENO_CHIP_IDS(0x07000200),
+		.family = ADRENO_6XX_GEN1, /* NOT a mistake! */
+		.fw = {
+			[ADRENO_FW_SQE] = "a702_sqe.fw",
+		},
+		.gmem = SZ_128K,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a702_zap.mbn",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a702_hwcg,
+			.protect = &a650_protect,
+			.gmu_cgc_mode = 0x00020202,
+			.prim_fifo_threshold = 0x0000c000,
+		},
+		.speedbins = ADRENO_SPEEDBINS(
+			{ 0,   0 },
+			{ 236, 1 },
+			{ 178, 2 },
+			{ 142, 3 },
+		),
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x07030001),
+		.family = ADRENO_7XX_GEN1,
+		.fw = {
+			[ADRENO_FW_SQE] = "a730_sqe.fw",
+			[ADRENO_FW_GMU] = "gmu_gen70000.bin",
+		},
+		.gmem = SZ_2M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			  ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a730_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a730_hwcg,
+			.protect = &a730_protect,
+			.gmu_cgc_mode = 0x00020000,
+		},
+		.address_space_size = SZ_16G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x43050a01), /* "C510v2" */
+		.family = ADRENO_7XX_GEN2,
+		.fw = {
+			[ADRENO_FW_SQE] = "a740_sqe.fw",
+			[ADRENO_FW_GMU] = "gmu_gen70200.bin",
+		},
+		.gmem = 3 * SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			  ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "a740_zap.mdt",
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a740_hwcg,
+			.protect = &a730_protect,
+			.gmu_chipid = 0x7020100,
+			.gmu_cgc_mode = 0x00020202,
+		},
+		.address_space_size = SZ_16G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x43050c01), /* "C512v2" */
+		.family = ADRENO_7XX_GEN2,
+		.fw = {
+			[ADRENO_FW_SQE] = "gen70500_sqe.fw",
+			[ADRENO_FW_GMU] = "gen70500_gmu.bin",
+		},
+		.gmem = 3 * SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			  ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.a6xx = &(const struct a6xx_info) {
+			.hwcg = a740_hwcg,
+			.protect = &a730_protect,
+			.gmu_chipid = 0x7050001,
+			.gmu_cgc_mode = 0x00020202,
+		},
+		.address_space_size = SZ_256G,
+	}, {
+		.chip_ids = ADRENO_CHIP_IDS(0x43051401), /* "C520v2" */
+		.family = ADRENO_7XX_GEN3,
+		.fw = {
+			[ADRENO_FW_SQE] = "gen70900_sqe.fw",
+			[ADRENO_FW_GMU] = "gmu_gen70900.bin",
+		},
+		.gmem = 3 * SZ_1M,
+		.inactive_period = DRM_MSM_INACTIVE_PERIOD,
+		.quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT |
+			  ADRENO_QUIRK_HAS_HW_APRIV,
+		.init = a6xx_gpu_init,
+		.zapfw = "gen70900_zap.mbn",
+		.a6xx = &(const struct a6xx_info) {
+			.protect = &a730_protect,
+			.gmu_chipid = 0x7090100,
+			.gmu_cgc_mode = 0x00020202,
+		},
+		.address_space_size = SZ_16G,
+	}
+};
+DECLARE_ADRENO_GPULIST(a7xx);
+
+static inline void __build_asserts(void)
+{
+	BUILD_BUG_ON(a630_protect.count > a630_protect.count_max);
+	BUILD_BUG_ON(a650_protect.count > a650_protect.count_max);
+	BUILD_BUG_ON(a660_protect.count > a660_protect.count_max);
+	BUILD_BUG_ON(a690_protect.count > a690_protect.count_max);
+	BUILD_BUG_ON(a730_protect.count > a730_protect.count_max);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a6xx_gmu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a6xx_gmu.c
@@ -0,0 +1,1829 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2017-2019 The Linux Foundation. All rights reserved. */
+
+#include <linux/bitfield.h>
+#include <linux/clk.h>
+#include <linux/interconnect.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/pm_domain.h>
+#include <linux/pm_opp.h>
+#include <soc/qcom/cmd-db.h>
+#include <drm/drm_gem.h>
+
+#include "a6xx_gpu.h"
+#include "a6xx_gmu.xml.h"
+#include "msm_gem.h"
+#include "msm_gpu_trace.h"
+#include "msm_mmu.h"
+
+static void a6xx_gmu_fault(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct msm_gpu *gpu = &adreno_gpu->base;
+
+	/* FIXME: add a banner here */
+	gmu->hung = true;
+
+	/* Turn off the hangcheck timer while we are resetting */
+	del_timer(&gpu->hangcheck_timer);
+
+	/* Queue the GPU handler because we need to treat this as a recovery */
+	kthread_queue_work(gpu->worker, &gpu->recover_work);
+}
+
+static irqreturn_t a6xx_gmu_irq(int irq, void *data)
+{
+	struct a6xx_gmu *gmu = data;
+	u32 status;
+
+	status = gmu_read(gmu, REG_A6XX_GMU_AO_HOST_INTERRUPT_STATUS);
+	gmu_write(gmu, REG_A6XX_GMU_AO_HOST_INTERRUPT_CLR, status);
+
+	if (status & A6XX_GMU_AO_HOST_INTERRUPT_STATUS_WDOG_BITE) {
+		dev_err_ratelimited(gmu->dev, "GMU watchdog expired\n");
+
+		a6xx_gmu_fault(gmu);
+	}
+
+	if (status &  A6XX_GMU_AO_HOST_INTERRUPT_STATUS_HOST_AHB_BUS_ERROR)
+		dev_err_ratelimited(gmu->dev, "GMU AHB bus error\n");
+
+	if (status & A6XX_GMU_AO_HOST_INTERRUPT_STATUS_FENCE_ERR)
+		dev_err_ratelimited(gmu->dev, "GMU fence error: 0x%x\n",
+			gmu_read(gmu, REG_A6XX_GMU_AHB_FENCE_STATUS));
+
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t a6xx_hfi_irq(int irq, void *data)
+{
+	struct a6xx_gmu *gmu = data;
+	u32 status;
+
+	status = gmu_read(gmu, REG_A6XX_GMU_GMU2HOST_INTR_INFO);
+	gmu_write(gmu, REG_A6XX_GMU_GMU2HOST_INTR_CLR, status);
+
+	if (status & A6XX_GMU_GMU2HOST_INTR_INFO_CM3_FAULT) {
+		dev_err_ratelimited(gmu->dev, "GMU firmware fault\n");
+
+		a6xx_gmu_fault(gmu);
+	}
+
+	return IRQ_HANDLED;
+}
+
+bool a6xx_gmu_sptprac_is_on(struct a6xx_gmu *gmu)
+{
+	u32 val;
+
+	/* This can be called from gpu state code so make sure GMU is valid */
+	if (!gmu->initialized)
+		return false;
+
+	val = gmu_read(gmu, REG_A6XX_GMU_SPTPRAC_PWR_CLK_STATUS);
+
+	return !(val &
+		(A6XX_GMU_SPTPRAC_PWR_CLK_STATUS_SPTPRAC_GDSC_POWER_OFF |
+		A6XX_GMU_SPTPRAC_PWR_CLK_STATUS_SP_CLOCK_OFF));
+}
+
+/* Check to see if the GX rail is still powered */
+bool a6xx_gmu_gx_is_on(struct a6xx_gmu *gmu)
+{
+	u32 val;
+
+	/* This can be called from gpu state code so make sure GMU is valid */
+	if (!gmu->initialized)
+		return false;
+
+	val = gmu_read(gmu, REG_A6XX_GMU_SPTPRAC_PWR_CLK_STATUS);
+
+	return !(val &
+		(A6XX_GMU_SPTPRAC_PWR_CLK_STATUS_GX_HM_GDSC_POWER_OFF |
+		A6XX_GMU_SPTPRAC_PWR_CLK_STATUS_GX_HM_CLK_OFF));
+}
+
+void a6xx_gmu_set_freq(struct msm_gpu *gpu, struct dev_pm_opp *opp,
+		       bool suspended)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	u32 perf_index;
+	unsigned long gpu_freq;
+	int ret = 0;
+
+	gpu_freq = dev_pm_opp_get_freq(opp);
+
+	if (gpu_freq == gmu->freq)
+		return;
+
+	for (perf_index = 0; perf_index < gmu->nr_gpu_freqs - 1; perf_index++)
+		if (gpu_freq == gmu->gpu_freqs[perf_index])
+			break;
+
+	gmu->current_perf_index = perf_index;
+	gmu->freq = gmu->gpu_freqs[perf_index];
+
+	trace_msm_gmu_freq_change(gmu->freq, perf_index);
+
+	/*
+	 * This can get called from devfreq while the hardware is idle. Don't
+	 * bring up the power if it isn't already active. All we're doing here
+	 * is updating the frequency so that when we come back online we're at
+	 * the right rate.
+	 */
+	if (suspended)
+		return;
+
+	if (!gmu->legacy) {
+		a6xx_hfi_set_freq(gmu, perf_index);
+		dev_pm_opp_set_opp(&gpu->pdev->dev, opp);
+		return;
+	}
+
+	gmu_write(gmu, REG_A6XX_GMU_DCVS_ACK_OPTION, 0);
+
+	gmu_write(gmu, REG_A6XX_GMU_DCVS_PERF_SETTING,
+			((3 & 0xf) << 28) | perf_index);
+
+	/*
+	 * Send an invalid index as a vote for the bus bandwidth and let the
+	 * firmware decide on the right vote
+	 */
+	gmu_write(gmu, REG_A6XX_GMU_DCVS_BW_SETTING, 0xff);
+
+	/* Set and clear the OOB for DCVS to trigger the GMU */
+	a6xx_gmu_set_oob(gmu, GMU_OOB_DCVS_SET);
+	a6xx_gmu_clear_oob(gmu, GMU_OOB_DCVS_SET);
+
+	ret = gmu_read(gmu, REG_A6XX_GMU_DCVS_RETURN);
+	if (ret)
+		dev_err(gmu->dev, "GMU set GPU frequency error: %d\n", ret);
+
+	dev_pm_opp_set_opp(&gpu->pdev->dev, opp);
+}
+
+unsigned long a6xx_gmu_get_freq(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+
+	return  gmu->freq;
+}
+
+static bool a6xx_gmu_check_idle_level(struct a6xx_gmu *gmu)
+{
+	u32 val;
+	int local = gmu->idle_level;
+
+	/* SPTP and IFPC both report as IFPC */
+	if (gmu->idle_level == GMU_IDLE_STATE_SPTP)
+		local = GMU_IDLE_STATE_IFPC;
+
+	val = gmu_read(gmu, REG_A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE);
+
+	if (val == local) {
+		if (gmu->idle_level != GMU_IDLE_STATE_IFPC ||
+			!a6xx_gmu_gx_is_on(gmu))
+			return true;
+	}
+
+	return false;
+}
+
+/* Wait for the GMU to get to its most idle state */
+int a6xx_gmu_wait_for_idle(struct a6xx_gmu *gmu)
+{
+	return spin_until(a6xx_gmu_check_idle_level(gmu));
+}
+
+static int a6xx_gmu_start(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	u32 mask, reset_val, val;
+	int ret;
+
+	val = gmu_read(gmu, REG_A6XX_GMU_CM3_DTCM_START + 0xff8);
+	if (val <= 0x20010004) {
+		mask = 0xffffffff;
+		reset_val = 0xbabeface;
+	} else {
+		mask = 0x1ff;
+		reset_val = 0x100;
+	}
+
+	gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 1);
+
+	/* Set the log wptr index
+	 * note: downstream saves the value in poweroff and restores it here
+	 */
+	if (adreno_is_a7xx(adreno_gpu))
+		gmu_write(gmu, REG_A7XX_GMU_GENERAL_9, 0);
+	else
+		gmu_write(gmu, REG_A6XX_GPU_GMU_CX_GMU_PWR_COL_CP_RESP, 0);
+
+
+	gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 0);
+
+	ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_CM3_FW_INIT_RESULT, val,
+		(val & mask) == reset_val, 100, 10000);
+
+	if (ret)
+		DRM_DEV_ERROR(gmu->dev, "GMU firmware initialization timed out\n");
+
+	return ret;
+}
+
+static int a6xx_gmu_hfi_start(struct a6xx_gmu *gmu)
+{
+	u32 val;
+	int ret;
+
+	gmu_write(gmu, REG_A6XX_GMU_HFI_CTRL_INIT, 1);
+
+	ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_HFI_CTRL_STATUS, val,
+		val & 1, 100, 10000);
+	if (ret)
+		DRM_DEV_ERROR(gmu->dev, "Unable to start the HFI queues\n");
+
+	return ret;
+}
+
+struct a6xx_gmu_oob_bits {
+	int set, ack, set_new, ack_new, clear, clear_new;
+	const char *name;
+};
+
+/* These are the interrupt / ack bits for each OOB request that are set
+ * in a6xx_gmu_set_oob and a6xx_clear_oob
+ */
+static const struct a6xx_gmu_oob_bits a6xx_gmu_oob_bits[] = {
+	[GMU_OOB_GPU_SET] = {
+		.name = "GPU_SET",
+		.set = 16,
+		.ack = 24,
+		.set_new = 30,
+		.ack_new = 31,
+		.clear = 24,
+		.clear_new = 31,
+	},
+
+	[GMU_OOB_PERFCOUNTER_SET] = {
+		.name = "PERFCOUNTER",
+		.set = 17,
+		.ack = 25,
+		.set_new = 28,
+		.ack_new = 30,
+		.clear = 25,
+		.clear_new = 29,
+	},
+
+	[GMU_OOB_BOOT_SLUMBER] = {
+		.name = "BOOT_SLUMBER",
+		.set = 22,
+		.ack = 30,
+		.clear = 30,
+	},
+
+	[GMU_OOB_DCVS_SET] = {
+		.name = "GPU_DCVS",
+		.set = 23,
+		.ack = 31,
+		.clear = 31,
+	},
+};
+
+/* Trigger a OOB (out of band) request to the GMU */
+int a6xx_gmu_set_oob(struct a6xx_gmu *gmu, enum a6xx_gmu_oob_state state)
+{
+	int ret;
+	u32 val;
+	int request, ack;
+
+	WARN_ON_ONCE(!mutex_is_locked(&gmu->lock));
+
+	if (state >= ARRAY_SIZE(a6xx_gmu_oob_bits))
+		return -EINVAL;
+
+	if (gmu->legacy) {
+		request = a6xx_gmu_oob_bits[state].set;
+		ack = a6xx_gmu_oob_bits[state].ack;
+	} else {
+		request = a6xx_gmu_oob_bits[state].set_new;
+		ack = a6xx_gmu_oob_bits[state].ack_new;
+		if (!request || !ack) {
+			DRM_DEV_ERROR(gmu->dev,
+				      "Invalid non-legacy GMU request %s\n",
+				      a6xx_gmu_oob_bits[state].name);
+			return -EINVAL;
+		}
+	}
+
+	/* Trigger the equested OOB operation */
+	gmu_write(gmu, REG_A6XX_GMU_HOST2GMU_INTR_SET, 1 << request);
+
+	/* Wait for the acknowledge interrupt */
+	ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_GMU2HOST_INTR_INFO, val,
+		val & (1 << ack), 100, 10000);
+
+	if (ret)
+		DRM_DEV_ERROR(gmu->dev,
+			"Timeout waiting for GMU OOB set %s: 0x%x\n",
+				a6xx_gmu_oob_bits[state].name,
+				gmu_read(gmu, REG_A6XX_GMU_GMU2HOST_INTR_INFO));
+
+	/* Clear the acknowledge interrupt */
+	gmu_write(gmu, REG_A6XX_GMU_GMU2HOST_INTR_CLR, 1 << ack);
+
+	return ret;
+}
+
+/* Clear a pending OOB state in the GMU */
+void a6xx_gmu_clear_oob(struct a6xx_gmu *gmu, enum a6xx_gmu_oob_state state)
+{
+	int bit;
+
+	WARN_ON_ONCE(!mutex_is_locked(&gmu->lock));
+
+	if (state >= ARRAY_SIZE(a6xx_gmu_oob_bits))
+		return;
+
+	if (gmu->legacy)
+		bit = a6xx_gmu_oob_bits[state].clear;
+	else
+		bit = a6xx_gmu_oob_bits[state].clear_new;
+
+	gmu_write(gmu, REG_A6XX_GMU_HOST2GMU_INTR_SET, 1 << bit);
+}
+
+/* Enable CPU control of SPTP power power collapse */
+int a6xx_sptprac_enable(struct a6xx_gmu *gmu)
+{
+	int ret;
+	u32 val;
+
+	if (!gmu->legacy)
+		return 0;
+
+	gmu_write(gmu, REG_A6XX_GMU_GX_SPTPRAC_POWER_CONTROL, 0x778000);
+
+	ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, val,
+		(val & 0x38) == 0x28, 1, 100);
+
+	if (ret) {
+		DRM_DEV_ERROR(gmu->dev, "Unable to power on SPTPRAC: 0x%x\n",
+			gmu_read(gmu, REG_A6XX_GMU_SPTPRAC_PWR_CLK_STATUS));
+	}
+
+	return 0;
+}
+
+/* Disable CPU control of SPTP power power collapse */
+void a6xx_sptprac_disable(struct a6xx_gmu *gmu)
+{
+	u32 val;
+	int ret;
+
+	if (!gmu->legacy)
+		return;
+
+	/* Make sure retention is on */
+	gmu_rmw(gmu, REG_A6XX_GPU_CC_GX_GDSCR, 0, (1 << 11));
+
+	gmu_write(gmu, REG_A6XX_GMU_GX_SPTPRAC_POWER_CONTROL, 0x778001);
+
+	ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, val,
+		(val & 0x04), 100, 10000);
+
+	if (ret)
+		DRM_DEV_ERROR(gmu->dev, "failed to power off SPTPRAC: 0x%x\n",
+			gmu_read(gmu, REG_A6XX_GMU_SPTPRAC_PWR_CLK_STATUS));
+}
+
+/* Let the GMU know we are starting a boot sequence */
+static int a6xx_gmu_gfx_rail_on(struct a6xx_gmu *gmu)
+{
+	u32 vote;
+
+	/* Let the GMU know we are getting ready for boot */
+	gmu_write(gmu, REG_A6XX_GMU_BOOT_SLUMBER_OPTION, 0);
+
+	/* Choose the "default" power level as the highest available */
+	vote = gmu->gx_arc_votes[gmu->nr_gpu_freqs - 1];
+
+	gmu_write(gmu, REG_A6XX_GMU_GX_VOTE_IDX, vote & 0xff);
+	gmu_write(gmu, REG_A6XX_GMU_MX_VOTE_IDX, (vote >> 8) & 0xff);
+
+	/* Let the GMU know the boot sequence has started */
+	return a6xx_gmu_set_oob(gmu, GMU_OOB_BOOT_SLUMBER);
+}
+
+/* Let the GMU know that we are about to go into slumber */
+static int a6xx_gmu_notify_slumber(struct a6xx_gmu *gmu)
+{
+	int ret;
+
+	/* Disable the power counter so the GMU isn't busy */
+	gmu_write(gmu, REG_A6XX_GMU_CX_GMU_POWER_COUNTER_ENABLE, 0);
+
+	/* Disable SPTP_PC if the CPU is responsible for it */
+	if (gmu->idle_level < GMU_IDLE_STATE_SPTP)
+		a6xx_sptprac_disable(gmu);
+
+	if (!gmu->legacy) {
+		ret = a6xx_hfi_send_prep_slumber(gmu);
+		goto out;
+	}
+
+	/* Tell the GMU to get ready to slumber */
+	gmu_write(gmu, REG_A6XX_GMU_BOOT_SLUMBER_OPTION, 1);
+
+	ret = a6xx_gmu_set_oob(gmu, GMU_OOB_BOOT_SLUMBER);
+	a6xx_gmu_clear_oob(gmu, GMU_OOB_BOOT_SLUMBER);
+
+	if (!ret) {
+		/* Check to see if the GMU really did slumber */
+		if (gmu_read(gmu, REG_A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE)
+			!= 0x0f) {
+			DRM_DEV_ERROR(gmu->dev, "The GMU did not go into slumber\n");
+			ret = -ETIMEDOUT;
+		}
+	}
+
+out:
+	/* Put fence into allow mode */
+	gmu_write(gmu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+	return ret;
+}
+
+static int a6xx_rpmh_start(struct a6xx_gmu *gmu)
+{
+	int ret;
+	u32 val;
+
+	gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 1 << 1);
+	/* Wait for the register to finish posting */
+	wmb();
+
+	ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_RSCC_CONTROL_ACK, val,
+		val & (1 << 1), 100, 10000);
+	if (ret) {
+		DRM_DEV_ERROR(gmu->dev, "Unable to power on the GPU RSC\n");
+		return ret;
+	}
+
+	ret = gmu_poll_timeout_rscc(gmu, REG_A6XX_RSCC_SEQ_BUSY_DRV0, val,
+		!val, 100, 10000);
+
+	if (ret) {
+		DRM_DEV_ERROR(gmu->dev, "GPU RSC sequence stuck while waking up the GPU\n");
+		return ret;
+	}
+
+	gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 0);
+
+	return 0;
+}
+
+static void a6xx_rpmh_stop(struct a6xx_gmu *gmu)
+{
+	int ret;
+	u32 val;
+
+	gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 1);
+
+	ret = gmu_poll_timeout_rscc(gmu, REG_A6XX_GPU_RSCC_RSC_STATUS0_DRV0,
+		val, val & (1 << 16), 100, 10000);
+	if (ret)
+		DRM_DEV_ERROR(gmu->dev, "Unable to power off the GPU RSC\n");
+
+	gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 0);
+}
+
+static inline void pdc_write(void __iomem *ptr, u32 offset, u32 value)
+{
+	msm_writel(value, ptr + (offset << 2));
+}
+
+static void __iomem *a6xx_gmu_get_mmio(struct platform_device *pdev,
+		const char *name);
+
+static void a6xx_gmu_rpmh_init(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct platform_device *pdev = to_platform_device(gmu->dev);
+	void __iomem *pdcptr = a6xx_gmu_get_mmio(pdev, "gmu_pdc");
+	u32 seqmem0_drv0_reg = REG_A6XX_RSCC_SEQ_MEM_0_DRV0;
+	void __iomem *seqptr = NULL;
+	uint32_t pdc_address_offset;
+	bool pdc_in_aop = false;
+
+	if (IS_ERR(pdcptr))
+		goto err;
+
+	if (adreno_is_a650(adreno_gpu) ||
+	    adreno_is_a660_family(adreno_gpu) ||
+	    adreno_is_a7xx(adreno_gpu))
+		pdc_in_aop = true;
+	else if (adreno_is_a618(adreno_gpu) || adreno_is_a640_family(adreno_gpu))
+		pdc_address_offset = 0x30090;
+	else if (adreno_is_a619(adreno_gpu))
+		pdc_address_offset = 0x300a0;
+	else
+		pdc_address_offset = 0x30080;
+
+	if (!pdc_in_aop) {
+		seqptr = a6xx_gmu_get_mmio(pdev, "gmu_pdc_seq");
+		if (IS_ERR(seqptr))
+			goto err;
+	}
+
+	/* Disable SDE clock gating */
+	gmu_write_rscc(gmu, REG_A6XX_GPU_RSCC_RSC_STATUS0_DRV0, BIT(24));
+
+	/* Setup RSC PDC handshake for sleep and wakeup */
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_PDC_SLAVE_ID_DRV0, 1);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_HIDDEN_TCS_CMD0_DATA, 0);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_HIDDEN_TCS_CMD0_ADDR, 0);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_HIDDEN_TCS_CMD0_DATA + 2, 0);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_HIDDEN_TCS_CMD0_ADDR + 2, 0);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_HIDDEN_TCS_CMD0_DATA + 4,
+		       adreno_is_a740_family(adreno_gpu) ? 0x80000021 : 0x80000000);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_HIDDEN_TCS_CMD0_ADDR + 4, 0);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_OVERRIDE_START_ADDR, 0);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_PDC_SEQ_START_ADDR, 0x4520);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_PDC_MATCH_VALUE_LO, 0x4510);
+	gmu_write_rscc(gmu, REG_A6XX_RSCC_PDC_MATCH_VALUE_HI, 0x4514);
+
+	/* The second spin of A7xx GPUs messed with some register offsets.. */
+	if (adreno_is_a740_family(adreno_gpu))
+		seqmem0_drv0_reg = REG_A7XX_RSCC_SEQ_MEM_0_DRV0_A740;
+
+	/* Load RSC sequencer uCode for sleep and wakeup */
+	if (adreno_is_a650_family(adreno_gpu) ||
+	    adreno_is_a7xx(adreno_gpu)) {
+		gmu_write_rscc(gmu, seqmem0_drv0_reg, 0xeaaae5a0);
+		gmu_write_rscc(gmu, seqmem0_drv0_reg + 1, 0xe1a1ebab);
+		gmu_write_rscc(gmu, seqmem0_drv0_reg + 2, 0xa2e0a581);
+		gmu_write_rscc(gmu, seqmem0_drv0_reg + 3, 0xecac82e2);
+		gmu_write_rscc(gmu, seqmem0_drv0_reg + 4, 0x0020edad);
+	} else {
+		gmu_write_rscc(gmu, REG_A6XX_RSCC_SEQ_MEM_0_DRV0, 0xa7a506a0);
+		gmu_write_rscc(gmu, REG_A6XX_RSCC_SEQ_MEM_0_DRV0 + 1, 0xa1e6a6e7);
+		gmu_write_rscc(gmu, REG_A6XX_RSCC_SEQ_MEM_0_DRV0 + 2, 0xa2e081e1);
+		gmu_write_rscc(gmu, REG_A6XX_RSCC_SEQ_MEM_0_DRV0 + 3, 0xe9a982e2);
+		gmu_write_rscc(gmu, REG_A6XX_RSCC_SEQ_MEM_0_DRV0 + 4, 0x0020e8a8);
+	}
+
+	if (pdc_in_aop)
+		goto setup_pdc;
+
+	/* Load PDC sequencer uCode for power up and power down sequence */
+	pdc_write(seqptr, REG_A6XX_PDC_GPU_SEQ_MEM_0, 0xfebea1e1);
+	pdc_write(seqptr, REG_A6XX_PDC_GPU_SEQ_MEM_0 + 1, 0xa5a4a3a2);
+	pdc_write(seqptr, REG_A6XX_PDC_GPU_SEQ_MEM_0 + 2, 0x8382a6e0);
+	pdc_write(seqptr, REG_A6XX_PDC_GPU_SEQ_MEM_0 + 3, 0xbce3e284);
+	pdc_write(seqptr, REG_A6XX_PDC_GPU_SEQ_MEM_0 + 4, 0x002081fc);
+
+	/* Set TCS commands used by PDC sequence for low power modes */
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD_ENABLE_BANK, 7);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD_WAIT_FOR_CMPL_BANK, 0);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CONTROL, 0);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD0_MSGID, 0x10108);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD0_ADDR, 0x30010);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD0_DATA, 1);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD0_MSGID + 4, 0x10108);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD0_ADDR + 4, 0x30000);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD0_DATA + 4, 0x0);
+
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD0_MSGID + 8, 0x10108);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD0_ADDR + 8, pdc_address_offset);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS1_CMD0_DATA + 8, 0x0);
+
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD_ENABLE_BANK, 7);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD_WAIT_FOR_CMPL_BANK, 0);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CONTROL, 0);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_MSGID, 0x10108);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_ADDR, 0x30010);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_DATA, 2);
+
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_MSGID + 4, 0x10108);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_ADDR + 4, 0x30000);
+	if (adreno_is_a618(adreno_gpu) || adreno_is_a619(adreno_gpu) ||
+			adreno_is_a650_family(adreno_gpu))
+		pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_DATA + 4, 0x2);
+	else
+		pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_DATA + 4, 0x3);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_MSGID + 8, 0x10108);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_ADDR + 8, pdc_address_offset);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_TCS3_CMD0_DATA + 8, 0x3);
+
+	/* Setup GPU PDC */
+setup_pdc:
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_SEQ_START_ADDR, 0);
+	pdc_write(pdcptr, REG_A6XX_PDC_GPU_ENABLE_PDC, 0x80000001);
+
+	/* ensure no writes happen before the uCode is fully written */
+	wmb();
+
+	a6xx_rpmh_stop(gmu);
+
+err:
+	if (!IS_ERR_OR_NULL(pdcptr))
+		iounmap(pdcptr);
+	if (!IS_ERR_OR_NULL(seqptr))
+		iounmap(seqptr);
+}
+
+/*
+ * The lowest 16 bits of this value are the number of XO clock cycles for main
+ * hysteresis which is set at 0x1680 cycles (300 us).  The higher 16 bits are
+ * for the shorter hysteresis that happens after main - this is 0xa (.5 us)
+ */
+
+#define GMU_PWR_COL_HYST 0x000a1680
+
+/* Set up the idle state for the GMU */
+static void a6xx_gmu_power_config(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+
+	/* Disable GMU WB/RB buffer */
+	gmu_write(gmu, REG_A6XX_GMU_SYS_BUS_CONFIG, 0x1);
+	gmu_write(gmu, REG_A6XX_GMU_ICACHE_CONFIG, 0x1);
+	gmu_write(gmu, REG_A6XX_GMU_DCACHE_CONFIG, 0x1);
+
+	/* A7xx knows better by default! */
+	if (adreno_is_a7xx(adreno_gpu))
+		return;
+
+	gmu_write(gmu, REG_A6XX_GMU_PWR_COL_INTER_FRAME_CTRL, 0x9c40400);
+
+	switch (gmu->idle_level) {
+	case GMU_IDLE_STATE_IFPC:
+		gmu_write(gmu, REG_A6XX_GMU_PWR_COL_INTER_FRAME_HYST,
+			GMU_PWR_COL_HYST);
+		gmu_rmw(gmu, REG_A6XX_GMU_PWR_COL_INTER_FRAME_CTRL, 0,
+			A6XX_GMU_PWR_COL_INTER_FRAME_CTRL_IFPC_ENABLE |
+			A6XX_GMU_PWR_COL_INTER_FRAME_CTRL_HM_POWER_COLLAPSE_ENABLE);
+		fallthrough;
+	case GMU_IDLE_STATE_SPTP:
+		gmu_write(gmu, REG_A6XX_GMU_PWR_COL_SPTPRAC_HYST,
+			GMU_PWR_COL_HYST);
+		gmu_rmw(gmu, REG_A6XX_GMU_PWR_COL_INTER_FRAME_CTRL, 0,
+			A6XX_GMU_PWR_COL_INTER_FRAME_CTRL_IFPC_ENABLE |
+			A6XX_GMU_PWR_COL_INTER_FRAME_CTRL_SPTPRAC_POWER_CONTROL_ENABLE);
+	}
+
+	/* Enable RPMh GPU client */
+	gmu_rmw(gmu, REG_A6XX_GMU_RPMH_CTRL, 0,
+		A6XX_GMU_RPMH_CTRL_RPMH_INTERFACE_ENABLE |
+		A6XX_GMU_RPMH_CTRL_LLC_VOTE_ENABLE |
+		A6XX_GMU_RPMH_CTRL_DDR_VOTE_ENABLE |
+		A6XX_GMU_RPMH_CTRL_MX_VOTE_ENABLE |
+		A6XX_GMU_RPMH_CTRL_CX_VOTE_ENABLE |
+		A6XX_GMU_RPMH_CTRL_GFX_VOTE_ENABLE);
+}
+
+struct block_header {
+	u32 addr;
+	u32 size;
+	u32 type;
+	u32 value;
+	u32 data[];
+};
+
+static bool fw_block_mem(struct a6xx_gmu_bo *bo, const struct block_header *blk)
+{
+	if (!in_range(blk->addr, bo->iova, bo->size))
+		return false;
+
+	memcpy(bo->virt + blk->addr - bo->iova, blk->data, blk->size);
+	return true;
+}
+
+static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	const struct firmware *fw_image = adreno_gpu->fw[ADRENO_FW_GMU];
+	const struct block_header *blk;
+	u32 reg_offset;
+
+	u32 itcm_base = 0x00000000;
+	u32 dtcm_base = 0x00040000;
+
+	if (adreno_is_a650_family(adreno_gpu) || adreno_is_a7xx(adreno_gpu))
+		dtcm_base = 0x10004000;
+
+	if (gmu->legacy) {
+		/* Sanity check the size of the firmware that was loaded */
+		if (fw_image->size > 0x8000) {
+			DRM_DEV_ERROR(gmu->dev,
+				"GMU firmware is bigger than the available region\n");
+			return -EINVAL;
+		}
+
+		gmu_write_bulk(gmu, REG_A6XX_GMU_CM3_ITCM_START,
+			       (u32*) fw_image->data, fw_image->size);
+		return 0;
+	}
+
+
+	for (blk = (const struct block_header *) fw_image->data;
+	     (const u8*) blk < fw_image->data + fw_image->size;
+	     blk = (const struct block_header *) &blk->data[blk->size >> 2]) {
+		if (blk->size == 0)
+			continue;
+
+		if (in_range(blk->addr, itcm_base, SZ_16K)) {
+			reg_offset = (blk->addr - itcm_base) >> 2;
+			gmu_write_bulk(gmu,
+				REG_A6XX_GMU_CM3_ITCM_START + reg_offset,
+				blk->data, blk->size);
+		} else if (in_range(blk->addr, dtcm_base, SZ_16K)) {
+			reg_offset = (blk->addr - dtcm_base) >> 2;
+			gmu_write_bulk(gmu,
+				REG_A6XX_GMU_CM3_DTCM_START + reg_offset,
+				blk->data, blk->size);
+		} else if (!fw_block_mem(&gmu->icache, blk) &&
+			   !fw_block_mem(&gmu->dcache, blk) &&
+			   !fw_block_mem(&gmu->dummy, blk)) {
+			DRM_DEV_ERROR(gmu->dev,
+				"failed to match fw block (addr=%.8x size=%d data[0]=%.8x)\n",
+				blk->addr, blk->size, blk->data[0]);
+		}
+	}
+
+	return 0;
+}
+
+static int a6xx_gmu_fw_start(struct a6xx_gmu *gmu, unsigned int state)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	const struct a6xx_info *a6xx_info = adreno_gpu->info->a6xx;
+	u32 fence_range_lower, fence_range_upper;
+	u32 chipid = 0;
+	int ret;
+
+	/* Vote veto for FAL10 */
+	if (adreno_is_a650_family(adreno_gpu) || adreno_is_a7xx(adreno_gpu)) {
+		gmu_write(gmu, REG_A6XX_GPU_GMU_CX_GMU_CX_FALNEXT_INTF, 1);
+		gmu_write(gmu, REG_A6XX_GPU_GMU_CX_GMU_CX_FAL_INTF, 1);
+	}
+
+	/* Turn on TCM (Tightly Coupled Memory) retention */
+	if (adreno_is_a7xx(adreno_gpu))
+		a6xx_llc_write(a6xx_gpu, REG_A7XX_CX_MISC_TCM_RET_CNTL, 1);
+	else
+		gmu_write(gmu, REG_A6XX_GMU_GENERAL_7, 1);
+
+	if (state == GMU_WARM_BOOT) {
+		ret = a6xx_rpmh_start(gmu);
+		if (ret)
+			return ret;
+	} else {
+		if (WARN(!adreno_gpu->fw[ADRENO_FW_GMU],
+			"GMU firmware is not loaded\n"))
+			return -ENOENT;
+
+		ret = a6xx_rpmh_start(gmu);
+		if (ret)
+			return ret;
+
+		ret = a6xx_gmu_fw_load(gmu);
+		if (ret)
+			return ret;
+	}
+
+	/* Clear init result to make sure we are getting a fresh value */
+	gmu_write(gmu, REG_A6XX_GMU_CM3_FW_INIT_RESULT, 0);
+	gmu_write(gmu, REG_A6XX_GMU_CM3_BOOT_CONFIG, 0x02);
+
+	/* Write the iova of the HFI table */
+	gmu_write(gmu, REG_A6XX_GMU_HFI_QTBL_ADDR, gmu->hfi.iova);
+	gmu_write(gmu, REG_A6XX_GMU_HFI_QTBL_INFO, 1);
+
+	if (adreno_is_a7xx(adreno_gpu)) {
+		fence_range_upper = 0x32;
+		fence_range_lower = 0x8a0;
+	} else {
+		fence_range_upper = 0xa;
+		fence_range_lower = 0xa0;
+	}
+
+	gmu_write(gmu, REG_A6XX_GMU_AHB_FENCE_RANGE_0,
+		  BIT(31) |
+		  FIELD_PREP(GENMASK(30, 18), fence_range_upper) |
+		  FIELD_PREP(GENMASK(17, 0), fence_range_lower));
+
+	/*
+	 * Snapshots toggle the NMI bit which will result in a jump to the NMI
+	 * handler instead of __main. Set the M3 config value to avoid that.
+	 */
+	gmu_write(gmu, REG_A6XX_GMU_CM3_CFG, 0x4052);
+
+	if (a6xx_info->gmu_chipid) {
+		chipid = a6xx_info->gmu_chipid;
+	} else {
+		/*
+		 * Note that the GMU has a slightly different layout for
+		 * chip_id, for whatever reason, so a bit of massaging
+		 * is needed.  The upper 16b are the same, but minor and
+		 * patchid are packed in four bits each with the lower
+		 * 8b unused:
+		 */
+		chipid  = adreno_gpu->chip_id & 0xffff0000;
+		chipid |= (adreno_gpu->chip_id << 4) & 0xf000; /* minor */
+		chipid |= (adreno_gpu->chip_id << 8) & 0x0f00; /* patchid */
+	}
+
+	if (adreno_is_a7xx(adreno_gpu)) {
+		gmu_write(gmu, REG_A7XX_GMU_GENERAL_10, chipid);
+		gmu_write(gmu, REG_A7XX_GMU_GENERAL_8,
+			  (gmu->log.iova & GENMASK(31, 12)) |
+			  ((gmu->log.size / SZ_4K - 1) & GENMASK(7, 0)));
+	} else {
+		gmu_write(gmu, REG_A6XX_GMU_HFI_SFR_ADDR, chipid);
+
+		gmu_write(gmu, REG_A6XX_GPU_GMU_CX_GMU_PWR_COL_CP_MSG,
+			  gmu->log.iova | (gmu->log.size / SZ_4K - 1));
+	}
+
+	/* Set up the lowest idle level on the GMU */
+	a6xx_gmu_power_config(gmu);
+
+	ret = a6xx_gmu_start(gmu);
+	if (ret)
+		return ret;
+
+	if (gmu->legacy) {
+		ret = a6xx_gmu_gfx_rail_on(gmu);
+		if (ret)
+			return ret;
+	}
+
+	/* Enable SPTP_PC if the CPU is responsible for it */
+	if (gmu->idle_level < GMU_IDLE_STATE_SPTP) {
+		ret = a6xx_sptprac_enable(gmu);
+		if (ret)
+			return ret;
+	}
+
+	ret = a6xx_gmu_hfi_start(gmu);
+	if (ret)
+		return ret;
+
+	/* FIXME: Do we need this wmb() here? */
+	wmb();
+
+	return 0;
+}
+
+#define A6XX_HFI_IRQ_MASK \
+	(A6XX_GMU_GMU2HOST_INTR_INFO_CM3_FAULT)
+
+#define A6XX_GMU_IRQ_MASK \
+	(A6XX_GMU_AO_HOST_INTERRUPT_STATUS_WDOG_BITE | \
+	 A6XX_GMU_AO_HOST_INTERRUPT_STATUS_HOST_AHB_BUS_ERROR | \
+	 A6XX_GMU_AO_HOST_INTERRUPT_STATUS_FENCE_ERR)
+
+static void a6xx_gmu_irq_disable(struct a6xx_gmu *gmu)
+{
+	disable_irq(gmu->gmu_irq);
+	disable_irq(gmu->hfi_irq);
+
+	gmu_write(gmu, REG_A6XX_GMU_AO_HOST_INTERRUPT_MASK, ~0);
+	gmu_write(gmu, REG_A6XX_GMU_GMU2HOST_INTR_MASK, ~0);
+}
+
+static void a6xx_gmu_rpmh_off(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	u32 val, seqmem_off = 0;
+
+	/* The second spin of A7xx GPUs messed with some register offsets.. */
+	if (adreno_is_a740_family(adreno_gpu))
+		seqmem_off = 4;
+
+	/* Make sure there are no outstanding RPMh votes */
+	gmu_poll_timeout_rscc(gmu, REG_A6XX_RSCC_TCS0_DRV0_STATUS + seqmem_off,
+		val, (val & 1), 100, 10000);
+	gmu_poll_timeout_rscc(gmu, REG_A6XX_RSCC_TCS1_DRV0_STATUS + seqmem_off,
+		val, (val & 1), 100, 10000);
+	gmu_poll_timeout_rscc(gmu, REG_A6XX_RSCC_TCS2_DRV0_STATUS + seqmem_off,
+		val, (val & 1), 100, 10000);
+	gmu_poll_timeout_rscc(gmu, REG_A6XX_RSCC_TCS3_DRV0_STATUS + seqmem_off,
+		val, (val & 1), 100, 1000);
+}
+
+/* Force the GMU off in case it isn't responsive */
+static void a6xx_gmu_force_off(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct msm_gpu *gpu = &adreno_gpu->base;
+
+	/*
+	 * Turn off keep alive that might have been enabled by the hang
+	 * interrupt
+	 */
+	gmu_write(&a6xx_gpu->gmu, REG_A6XX_GMU_GMU_PWR_COL_KEEPALIVE, 0);
+
+	/* Flush all the queues */
+	a6xx_hfi_stop(gmu);
+
+	/* Stop the interrupts */
+	a6xx_gmu_irq_disable(gmu);
+
+	/* Force off SPTP in case the GMU is managing it */
+	a6xx_sptprac_disable(gmu);
+
+	/* Make sure there are no outstanding RPMh votes */
+	a6xx_gmu_rpmh_off(gmu);
+
+	/* Clear the WRITEDROPPED fields and put fence into allow mode */
+	gmu_write(gmu, REG_A6XX_GMU_AHB_FENCE_STATUS_CLR, 0x7);
+	gmu_write(gmu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+
+	/* Make sure the above writes go through */
+	wmb();
+
+	/* Halt the gmu cm3 core */
+	gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 1);
+
+	a6xx_bus_clear_pending_transactions(adreno_gpu, true);
+
+	/* Reset GPU core blocks */
+	a6xx_gpu_sw_reset(gpu, true);
+}
+
+static void a6xx_gmu_set_initial_freq(struct msm_gpu *gpu, struct a6xx_gmu *gmu)
+{
+	struct dev_pm_opp *gpu_opp;
+	unsigned long gpu_freq = gmu->gpu_freqs[gmu->current_perf_index];
+
+	gpu_opp = dev_pm_opp_find_freq_exact(&gpu->pdev->dev, gpu_freq, true);
+	if (IS_ERR(gpu_opp))
+		return;
+
+	gmu->freq = 0; /* so a6xx_gmu_set_freq() doesn't exit early */
+	a6xx_gmu_set_freq(gpu, gpu_opp, false);
+	dev_pm_opp_put(gpu_opp);
+}
+
+static void a6xx_gmu_set_initial_bw(struct msm_gpu *gpu, struct a6xx_gmu *gmu)
+{
+	struct dev_pm_opp *gpu_opp;
+	unsigned long gpu_freq = gmu->gpu_freqs[gmu->current_perf_index];
+
+	gpu_opp = dev_pm_opp_find_freq_exact(&gpu->pdev->dev, gpu_freq, true);
+	if (IS_ERR(gpu_opp))
+		return;
+
+	dev_pm_opp_set_opp(&gpu->pdev->dev, gpu_opp);
+	dev_pm_opp_put(gpu_opp);
+}
+
+int a6xx_gmu_resume(struct a6xx_gpu *a6xx_gpu)
+{
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct msm_gpu *gpu = &adreno_gpu->base;
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	int status, ret;
+
+	if (WARN(!gmu->initialized, "The GMU is not set up yet\n"))
+		return -EINVAL;
+
+	gmu->hung = false;
+
+	/* Notify AOSS about the ACD state (unimplemented for now => disable it) */
+	if (!IS_ERR(gmu->qmp)) {
+		ret = qmp_send(gmu->qmp, "{class: gpu, res: acd, val: %d}",
+			       0 /* Hardcode ACD to be disabled for now */);
+		if (ret)
+			dev_err(gmu->dev, "failed to send GPU ACD state\n");
+	}
+
+	/* Turn on the resources */
+	pm_runtime_get_sync(gmu->dev);
+
+	/*
+	 * "enable" the GX power domain which won't actually do anything but it
+	 * will make sure that the refcounting is correct in case we need to
+	 * bring down the GX after a GMU failure
+	 */
+	if (!IS_ERR_OR_NULL(gmu->gxpd))
+		pm_runtime_get_sync(gmu->gxpd);
+
+	/* Use a known rate to bring up the GMU */
+	clk_set_rate(gmu->core_clk, 200000000);
+	clk_set_rate(gmu->hub_clk, adreno_is_a740_family(adreno_gpu) ?
+		     200000000 : 150000000);
+	ret = clk_bulk_prepare_enable(gmu->nr_clocks, gmu->clocks);
+	if (ret) {
+		pm_runtime_put(gmu->gxpd);
+		pm_runtime_put(gmu->dev);
+		return ret;
+	}
+
+	/* Set the bus quota to a reasonable value for boot */
+	a6xx_gmu_set_initial_bw(gpu, gmu);
+
+	/* Enable the GMU interrupt */
+	gmu_write(gmu, REG_A6XX_GMU_AO_HOST_INTERRUPT_CLR, ~0);
+	gmu_write(gmu, REG_A6XX_GMU_AO_HOST_INTERRUPT_MASK, ~A6XX_GMU_IRQ_MASK);
+	enable_irq(gmu->gmu_irq);
+
+	/* Check to see if we are doing a cold or warm boot */
+	if (adreno_is_a7xx(adreno_gpu)) {
+		status = a6xx_llc_read(a6xx_gpu, REG_A7XX_CX_MISC_TCM_RET_CNTL) == 1 ?
+			GMU_WARM_BOOT : GMU_COLD_BOOT;
+	} else if (gmu->legacy) {
+		status = gmu_read(gmu, REG_A6XX_GMU_GENERAL_7) == 1 ?
+			GMU_WARM_BOOT : GMU_COLD_BOOT;
+	} else {
+		/*
+		 * Warm boot path does not work on newer A6xx GPUs
+		 * Presumably this is because icache/dcache regions must be restored
+		 */
+		status = GMU_COLD_BOOT;
+	}
+
+	ret = a6xx_gmu_fw_start(gmu, status);
+	if (ret)
+		goto out;
+
+	ret = a6xx_hfi_start(gmu, status);
+	if (ret)
+		goto out;
+
+	/*
+	 * Turn on the GMU firmware fault interrupt after we know the boot
+	 * sequence is successful
+	 */
+	gmu_write(gmu, REG_A6XX_GMU_GMU2HOST_INTR_CLR, ~0);
+	gmu_write(gmu, REG_A6XX_GMU_GMU2HOST_INTR_MASK, ~A6XX_HFI_IRQ_MASK);
+	enable_irq(gmu->hfi_irq);
+
+	/* Set the GPU to the current freq */
+	a6xx_gmu_set_initial_freq(gpu, gmu);
+
+out:
+	/* On failure, shut down the GMU to leave it in a good state */
+	if (ret) {
+		disable_irq(gmu->gmu_irq);
+		a6xx_rpmh_stop(gmu);
+		pm_runtime_put(gmu->gxpd);
+		pm_runtime_put(gmu->dev);
+	}
+
+	return ret;
+}
+
+bool a6xx_gmu_isidle(struct a6xx_gmu *gmu)
+{
+	u32 reg;
+
+	if (!gmu->initialized)
+		return true;
+
+	reg = gmu_read(gmu, REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS);
+
+	if (reg &  A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS_GPUBUSYIGNAHB)
+		return false;
+
+	return true;
+}
+
+/* Gracefully try to shut down the GMU and by extension the GPU */
+static void a6xx_gmu_shutdown(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	u32 val;
+
+	/*
+	 * The GMU may still be in slumber unless the GPU started so check and
+	 * skip putting it back into slumber if so
+	 */
+	val = gmu_read(gmu, REG_A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE);
+
+	if (val != 0xf) {
+		int ret = a6xx_gmu_wait_for_idle(gmu);
+
+		/* If the GMU isn't responding assume it is hung */
+		if (ret) {
+			a6xx_gmu_force_off(gmu);
+			return;
+		}
+
+		a6xx_bus_clear_pending_transactions(adreno_gpu, a6xx_gpu->hung);
+
+		/* tell the GMU we want to slumber */
+		ret = a6xx_gmu_notify_slumber(gmu);
+		if (ret) {
+			a6xx_gmu_force_off(gmu);
+			return;
+		}
+
+		ret = gmu_poll_timeout(gmu,
+			REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, val,
+			!(val & A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS_GPUBUSYIGNAHB),
+			100, 10000);
+
+		/*
+		 * Let the user know we failed to slumber but don't worry too
+		 * much because we are powering down anyway
+		 */
+
+		if (ret)
+			DRM_DEV_ERROR(gmu->dev,
+				"Unable to slumber GMU: status = 0%x/0%x\n",
+				gmu_read(gmu,
+					REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS),
+				gmu_read(gmu,
+					REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS2));
+	}
+
+	/* Turn off HFI */
+	a6xx_hfi_stop(gmu);
+
+	/* Stop the interrupts and mask the hardware */
+	a6xx_gmu_irq_disable(gmu);
+
+	/* Tell RPMh to power off the GPU */
+	a6xx_rpmh_stop(gmu);
+}
+
+
+int a6xx_gmu_stop(struct a6xx_gpu *a6xx_gpu)
+{
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	struct msm_gpu *gpu = &a6xx_gpu->base.base;
+
+	if (!pm_runtime_active(gmu->dev))
+		return 0;
+
+	/*
+	 * Force the GMU off if we detected a hang, otherwise try to shut it
+	 * down gracefully
+	 */
+	if (gmu->hung)
+		a6xx_gmu_force_off(gmu);
+	else
+		a6xx_gmu_shutdown(gmu);
+
+	/* Remove the bus vote */
+	dev_pm_opp_set_opp(&gpu->pdev->dev, NULL);
+
+	/*
+	 * Make sure the GX domain is off before turning off the GMU (CX)
+	 * domain. Usually the GMU does this but only if the shutdown sequence
+	 * was successful
+	 */
+	if (!IS_ERR_OR_NULL(gmu->gxpd))
+		pm_runtime_put_sync(gmu->gxpd);
+
+	clk_bulk_disable_unprepare(gmu->nr_clocks, gmu->clocks);
+
+	pm_runtime_put_sync(gmu->dev);
+
+	return 0;
+}
+
+static void a6xx_gmu_memory_free(struct a6xx_gmu *gmu)
+{
+	msm_gem_kernel_put(gmu->hfi.obj, gmu->aspace);
+	msm_gem_kernel_put(gmu->debug.obj, gmu->aspace);
+	msm_gem_kernel_put(gmu->icache.obj, gmu->aspace);
+	msm_gem_kernel_put(gmu->dcache.obj, gmu->aspace);
+	msm_gem_kernel_put(gmu->dummy.obj, gmu->aspace);
+	msm_gem_kernel_put(gmu->log.obj, gmu->aspace);
+
+	gmu->aspace->mmu->funcs->detach(gmu->aspace->mmu);
+	msm_gem_address_space_put(gmu->aspace);
+}
+
+static int a6xx_gmu_memory_alloc(struct a6xx_gmu *gmu, struct a6xx_gmu_bo *bo,
+		size_t size, u64 iova, const char *name)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct drm_device *dev = a6xx_gpu->base.base.dev;
+	uint32_t flags = MSM_BO_WC;
+	u64 range_start, range_end;
+	int ret;
+
+	size = PAGE_ALIGN(size);
+	if (!iova) {
+		/* no fixed address - use GMU's uncached range */
+		range_start = 0x60000000 + PAGE_SIZE; /* skip dummy page */
+		range_end = 0x80000000;
+	} else {
+		/* range for fixed address */
+		range_start = iova;
+		range_end = iova + size;
+		/* use IOMMU_PRIV for icache/dcache */
+		flags |= MSM_BO_MAP_PRIV;
+	}
+
+	bo->obj = msm_gem_new(dev, size, flags);
+	if (IS_ERR(bo->obj))
+		return PTR_ERR(bo->obj);
+
+	ret = msm_gem_get_and_pin_iova_range(bo->obj, gmu->aspace, &bo->iova,
+					     range_start, range_end);
+	if (ret) {
+		drm_gem_object_put(bo->obj);
+		return ret;
+	}
+
+	bo->virt = msm_gem_get_vaddr(bo->obj);
+	bo->size = size;
+
+	msm_gem_object_set_name(bo->obj, name);
+
+	return 0;
+}
+
+static int a6xx_gmu_memory_probe(struct a6xx_gmu *gmu)
+{
+	struct msm_mmu *mmu;
+
+	mmu = msm_iommu_new(gmu->dev, 0);
+	if (!mmu)
+		return -ENODEV;
+	if (IS_ERR(mmu))
+		return PTR_ERR(mmu);
+
+	gmu->aspace = msm_gem_address_space_create(mmu, "gmu", 0x0, 0x80000000);
+	if (IS_ERR(gmu->aspace))
+		return PTR_ERR(gmu->aspace);
+
+	return 0;
+}
+
+/* Return the 'arc-level' for the given frequency */
+static unsigned int a6xx_gmu_get_arc_level(struct device *dev,
+					   unsigned long freq)
+{
+	struct dev_pm_opp *opp;
+	unsigned int val;
+
+	if (!freq)
+		return 0;
+
+	opp = dev_pm_opp_find_freq_exact(dev, freq, true);
+	if (IS_ERR(opp))
+		return 0;
+
+	val = dev_pm_opp_get_level(opp);
+
+	dev_pm_opp_put(opp);
+
+	return val;
+}
+
+static int a6xx_gmu_rpmh_arc_votes_init(struct device *dev, u32 *votes,
+		unsigned long *freqs, int freqs_count, const char *id)
+{
+	int i, j;
+	const u16 *pri, *sec;
+	size_t pri_count, sec_count;
+
+	pri = cmd_db_read_aux_data(id, &pri_count);
+	if (IS_ERR(pri))
+		return PTR_ERR(pri);
+	/*
+	 * The data comes back as an array of unsigned shorts so adjust the
+	 * count accordingly
+	 */
+	pri_count >>= 1;
+	if (!pri_count)
+		return -EINVAL;
+
+	/*
+	 * Some targets have a separate gfx mxc rail. So try to read that first and then fall back
+	 * to regular mx rail if it is missing
+	 */
+	sec = cmd_db_read_aux_data("gmxc.lvl", &sec_count);
+	if (IS_ERR(sec) && sec != ERR_PTR(-EPROBE_DEFER))
+		sec = cmd_db_read_aux_data("mx.lvl", &sec_count);
+	if (IS_ERR(sec))
+		return PTR_ERR(sec);
+
+	sec_count >>= 1;
+	if (!sec_count)
+		return -EINVAL;
+
+	/* Construct a vote for each frequency */
+	for (i = 0; i < freqs_count; i++) {
+		u8 pindex = 0, sindex = 0;
+		unsigned int level = a6xx_gmu_get_arc_level(dev, freqs[i]);
+
+		/* Get the primary index that matches the arc level */
+		for (j = 0; j < pri_count; j++) {
+			if (pri[j] >= level) {
+				pindex = j;
+				break;
+			}
+		}
+
+		if (j == pri_count) {
+			DRM_DEV_ERROR(dev,
+				      "Level %u not found in the RPMh list\n",
+				      level);
+			DRM_DEV_ERROR(dev, "Available levels:\n");
+			for (j = 0; j < pri_count; j++)
+				DRM_DEV_ERROR(dev, "  %u\n", pri[j]);
+
+			return -EINVAL;
+		}
+
+		/*
+		 * Look for a level in in the secondary list that matches. If
+		 * nothing fits, use the maximum non zero vote
+		 */
+
+		for (j = 0; j < sec_count; j++) {
+			if (sec[j] >= level) {
+				sindex = j;
+				break;
+			} else if (sec[j]) {
+				sindex = j;
+			}
+		}
+
+		/* Construct the vote */
+		votes[i] = ((pri[pindex] & 0xffff) << 16) |
+			(sindex << 8) | pindex;
+	}
+
+	return 0;
+}
+
+/*
+ * The GMU votes with the RPMh for itself and on behalf of the GPU but we need
+ * to construct the list of votes on the CPU and send it over. Query the RPMh
+ * voltage levels and build the votes
+ */
+
+static int a6xx_gmu_rpmh_votes_init(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct msm_gpu *gpu = &adreno_gpu->base;
+	int ret;
+
+	/* Build the GX votes */
+	ret = a6xx_gmu_rpmh_arc_votes_init(&gpu->pdev->dev, gmu->gx_arc_votes,
+		gmu->gpu_freqs, gmu->nr_gpu_freqs, "gfx.lvl");
+
+	/* Build the CX votes */
+	ret |= a6xx_gmu_rpmh_arc_votes_init(gmu->dev, gmu->cx_arc_votes,
+		gmu->gmu_freqs, gmu->nr_gmu_freqs, "cx.lvl");
+
+	return ret;
+}
+
+static int a6xx_gmu_build_freq_table(struct device *dev, unsigned long *freqs,
+		u32 size)
+{
+	int count = dev_pm_opp_get_opp_count(dev);
+	struct dev_pm_opp *opp;
+	int i, index = 0;
+	unsigned long freq = 1;
+
+	/*
+	 * The OPP table doesn't contain the "off" frequency level so we need to
+	 * add 1 to the table size to account for it
+	 */
+
+	if (WARN(count + 1 > size,
+		"The GMU frequency table is being truncated\n"))
+		count = size - 1;
+
+	/* Set the "off" frequency */
+	freqs[index++] = 0;
+
+	for (i = 0; i < count; i++) {
+		opp = dev_pm_opp_find_freq_ceil(dev, &freq);
+		if (IS_ERR(opp))
+			break;
+
+		dev_pm_opp_put(opp);
+		freqs[index++] = freq++;
+	}
+
+	return index;
+}
+
+static int a6xx_gmu_pwrlevels_probe(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct msm_gpu *gpu = &adreno_gpu->base;
+
+	int ret = 0;
+
+	/*
+	 * The GMU handles its own frequency switching so build a list of
+	 * available frequencies to send during initialization
+	 */
+	ret = devm_pm_opp_of_add_table(gmu->dev);
+	if (ret) {
+		DRM_DEV_ERROR(gmu->dev, "Unable to set the OPP table for the GMU\n");
+		return ret;
+	}
+
+	gmu->nr_gmu_freqs = a6xx_gmu_build_freq_table(gmu->dev,
+		gmu->gmu_freqs, ARRAY_SIZE(gmu->gmu_freqs));
+
+	/*
+	 * The GMU also handles GPU frequency switching so build a list
+	 * from the GPU OPP table
+	 */
+	gmu->nr_gpu_freqs = a6xx_gmu_build_freq_table(&gpu->pdev->dev,
+		gmu->gpu_freqs, ARRAY_SIZE(gmu->gpu_freqs));
+
+	gmu->current_perf_index = gmu->nr_gpu_freqs - 1;
+
+	/* Build the list of RPMh votes that we'll send to the GMU */
+	return a6xx_gmu_rpmh_votes_init(gmu);
+}
+
+static int a6xx_gmu_clocks_probe(struct a6xx_gmu *gmu)
+{
+	int ret = devm_clk_bulk_get_all(gmu->dev, &gmu->clocks);
+
+	if (ret < 1)
+		return ret;
+
+	gmu->nr_clocks = ret;
+
+	gmu->core_clk = msm_clk_bulk_get_clock(gmu->clocks,
+		gmu->nr_clocks, "gmu");
+
+	gmu->hub_clk = msm_clk_bulk_get_clock(gmu->clocks,
+		gmu->nr_clocks, "hub");
+
+	return 0;
+}
+
+static void __iomem *a6xx_gmu_get_mmio(struct platform_device *pdev,
+		const char *name)
+{
+	void __iomem *ret;
+	struct resource *res = platform_get_resource_byname(pdev,
+			IORESOURCE_MEM, name);
+
+	if (!res) {
+		DRM_DEV_ERROR(&pdev->dev, "Unable to find the %s registers\n", name);
+		return ERR_PTR(-EINVAL);
+	}
+
+	ret = ioremap(res->start, resource_size(res));
+	if (!ret) {
+		DRM_DEV_ERROR(&pdev->dev, "Unable to map the %s registers\n", name);
+		return ERR_PTR(-EINVAL);
+	}
+
+	return ret;
+}
+
+static int a6xx_gmu_get_irq(struct a6xx_gmu *gmu, struct platform_device *pdev,
+		const char *name, irq_handler_t handler)
+{
+	int irq, ret;
+
+	irq = platform_get_irq_byname(pdev, name);
+
+	ret = request_irq(irq, handler, IRQF_TRIGGER_HIGH, name, gmu);
+	if (ret) {
+		DRM_DEV_ERROR(&pdev->dev, "Unable to get interrupt %s %d\n",
+			      name, ret);
+		return ret;
+	}
+
+	disable_irq(irq);
+
+	return irq;
+}
+
+void a6xx_gmu_remove(struct a6xx_gpu *a6xx_gpu)
+{
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	struct platform_device *pdev = to_platform_device(gmu->dev);
+
+	mutex_lock(&gmu->lock);
+	if (!gmu->initialized) {
+		mutex_unlock(&gmu->lock);
+		return;
+	}
+
+	gmu->initialized = false;
+
+	mutex_unlock(&gmu->lock);
+
+	pm_runtime_force_suspend(gmu->dev);
+
+	/*
+	 * Since cxpd is a virt device, the devlink with gmu-dev will be removed
+	 * automatically when we do detach
+	 */
+	dev_pm_domain_detach(gmu->cxpd, false);
+
+	if (!IS_ERR_OR_NULL(gmu->gxpd)) {
+		pm_runtime_disable(gmu->gxpd);
+		dev_pm_domain_detach(gmu->gxpd, false);
+	}
+
+	if (!IS_ERR_OR_NULL(gmu->qmp))
+		qmp_put(gmu->qmp);
+
+	iounmap(gmu->mmio);
+	if (platform_get_resource_byname(pdev, IORESOURCE_MEM, "rscc"))
+		iounmap(gmu->rscc);
+	gmu->mmio = NULL;
+	gmu->rscc = NULL;
+
+	if (!adreno_has_gmu_wrapper(adreno_gpu)) {
+		a6xx_gmu_memory_free(gmu);
+
+		free_irq(gmu->gmu_irq, gmu);
+		free_irq(gmu->hfi_irq, gmu);
+	}
+
+	/* Drop reference taken in of_find_device_by_node */
+	put_device(gmu->dev);
+}
+
+static int cxpd_notifier_cb(struct notifier_block *nb,
+			unsigned long action, void *data)
+{
+	struct a6xx_gmu *gmu = container_of(nb, struct a6xx_gmu, pd_nb);
+
+	if (action == GENPD_NOTIFY_OFF)
+		complete_all(&gmu->pd_gate);
+
+	return 0;
+}
+
+int a6xx_gmu_wrapper_init(struct a6xx_gpu *a6xx_gpu, struct device_node *node)
+{
+	struct platform_device *pdev = of_find_device_by_node(node);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	int ret;
+
+	if (!pdev)
+		return -ENODEV;
+
+	gmu->dev = &pdev->dev;
+
+	of_dma_configure(gmu->dev, node, true);
+
+	pm_runtime_enable(gmu->dev);
+
+	/* Mark legacy for manual SPTPRAC control */
+	gmu->legacy = true;
+
+	/* Map the GMU registers */
+	gmu->mmio = a6xx_gmu_get_mmio(pdev, "gmu");
+	if (IS_ERR(gmu->mmio)) {
+		ret = PTR_ERR(gmu->mmio);
+		goto err_mmio;
+	}
+
+	gmu->cxpd = dev_pm_domain_attach_by_name(gmu->dev, "cx");
+	if (IS_ERR(gmu->cxpd)) {
+		ret = PTR_ERR(gmu->cxpd);
+		goto err_mmio;
+	}
+
+	if (!device_link_add(gmu->dev, gmu->cxpd, DL_FLAG_PM_RUNTIME)) {
+		ret = -ENODEV;
+		goto detach_cxpd;
+	}
+
+	init_completion(&gmu->pd_gate);
+	complete_all(&gmu->pd_gate);
+	gmu->pd_nb.notifier_call = cxpd_notifier_cb;
+
+	/* Get a link to the GX power domain to reset the GPU */
+	gmu->gxpd = dev_pm_domain_attach_by_name(gmu->dev, "gx");
+	if (IS_ERR(gmu->gxpd)) {
+		ret = PTR_ERR(gmu->gxpd);
+		goto err_mmio;
+	}
+
+	gmu->initialized = true;
+
+	return 0;
+
+detach_cxpd:
+	dev_pm_domain_detach(gmu->cxpd, false);
+
+err_mmio:
+	iounmap(gmu->mmio);
+
+	/* Drop reference taken in of_find_device_by_node */
+	put_device(gmu->dev);
+
+	return ret;
+}
+
+int a6xx_gmu_init(struct a6xx_gpu *a6xx_gpu, struct device_node *node)
+{
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	struct platform_device *pdev = of_find_device_by_node(node);
+	struct device_link *link;
+	int ret;
+
+	if (!pdev)
+		return -ENODEV;
+
+	gmu->dev = &pdev->dev;
+
+	of_dma_configure(gmu->dev, node, true);
+
+	/* Fow now, don't do anything fancy until we get our feet under us */
+	gmu->idle_level = GMU_IDLE_STATE_ACTIVE;
+
+	pm_runtime_enable(gmu->dev);
+
+	/* Get the list of clocks */
+	ret = a6xx_gmu_clocks_probe(gmu);
+	if (ret)
+		goto err_put_device;
+
+	ret = a6xx_gmu_memory_probe(gmu);
+	if (ret)
+		goto err_put_device;
+
+
+	/* A660 now requires handling "prealloc requests" in GMU firmware
+	 * For now just hardcode allocations based on the known firmware.
+	 * note: there is no indication that these correspond to "dummy" or
+	 * "debug" regions, but this "guess" allows reusing these BOs which
+	 * are otherwise unused by a660.
+	 */
+	gmu->dummy.size = SZ_4K;
+	if (adreno_is_a660_family(adreno_gpu) ||
+	    adreno_is_a7xx(adreno_gpu)) {
+		ret = a6xx_gmu_memory_alloc(gmu, &gmu->debug, SZ_4K * 7,
+					    0x60400000, "debug");
+		if (ret)
+			goto err_memory;
+
+		gmu->dummy.size = SZ_8K;
+	}
+
+	/* Allocate memory for the GMU dummy page */
+	ret = a6xx_gmu_memory_alloc(gmu, &gmu->dummy, gmu->dummy.size,
+				    0x60000000, "dummy");
+	if (ret)
+		goto err_memory;
+
+	/* Note that a650 family also includes a660 family: */
+	if (adreno_is_a650_family(adreno_gpu) ||
+	    adreno_is_a7xx(adreno_gpu)) {
+		ret = a6xx_gmu_memory_alloc(gmu, &gmu->icache,
+			SZ_16M - SZ_16K, 0x04000, "icache");
+		if (ret)
+			goto err_memory;
+	/*
+	 * NOTE: when porting legacy ("pre-650-family") GPUs you may be tempted to add a condition
+	 * to allocate icache/dcache here, as per downstream code flow, but it may not actually be
+	 * necessary. If you omit this step and you don't get random pagefaults, you are likely
+	 * good to go without this!
+	 */
+	} else if (adreno_is_a640_family(adreno_gpu)) {
+		ret = a6xx_gmu_memory_alloc(gmu, &gmu->icache,
+			SZ_256K - SZ_16K, 0x04000, "icache");
+		if (ret)
+			goto err_memory;
+
+		ret = a6xx_gmu_memory_alloc(gmu, &gmu->dcache,
+			SZ_256K - SZ_16K, 0x44000, "dcache");
+		if (ret)
+			goto err_memory;
+	} else if (adreno_is_a630_family(adreno_gpu)) {
+		/* HFI v1, has sptprac */
+		gmu->legacy = true;
+
+		/* Allocate memory for the GMU debug region */
+		ret = a6xx_gmu_memory_alloc(gmu, &gmu->debug, SZ_16K, 0, "debug");
+		if (ret)
+			goto err_memory;
+	}
+
+	/* Allocate memory for the GMU log region */
+	ret = a6xx_gmu_memory_alloc(gmu, &gmu->log, SZ_16K, 0, "log");
+	if (ret)
+		goto err_memory;
+
+	/* Allocate memory for for the HFI queues */
+	ret = a6xx_gmu_memory_alloc(gmu, &gmu->hfi, SZ_16K, 0, "hfi");
+	if (ret)
+		goto err_memory;
+
+	/* Map the GMU registers */
+	gmu->mmio = a6xx_gmu_get_mmio(pdev, "gmu");
+	if (IS_ERR(gmu->mmio)) {
+		ret = PTR_ERR(gmu->mmio);
+		goto err_memory;
+	}
+
+	if (adreno_is_a650_family(adreno_gpu) ||
+	    adreno_is_a7xx(adreno_gpu)) {
+		gmu->rscc = a6xx_gmu_get_mmio(pdev, "rscc");
+		if (IS_ERR(gmu->rscc)) {
+			ret = -ENODEV;
+			goto err_mmio;
+		}
+	} else {
+		gmu->rscc = gmu->mmio + 0x23000;
+	}
+
+	/* Get the HFI and GMU interrupts */
+	gmu->hfi_irq = a6xx_gmu_get_irq(gmu, pdev, "hfi", a6xx_hfi_irq);
+	gmu->gmu_irq = a6xx_gmu_get_irq(gmu, pdev, "gmu", a6xx_gmu_irq);
+
+	if (gmu->hfi_irq < 0 || gmu->gmu_irq < 0) {
+		ret = -ENODEV;
+		goto err_mmio;
+	}
+
+	gmu->cxpd = dev_pm_domain_attach_by_name(gmu->dev, "cx");
+	if (IS_ERR(gmu->cxpd)) {
+		ret = PTR_ERR(gmu->cxpd);
+		goto err_mmio;
+	}
+
+	link = device_link_add(gmu->dev, gmu->cxpd, DL_FLAG_PM_RUNTIME);
+	if (!link) {
+		ret = -ENODEV;
+		goto detach_cxpd;
+	}
+
+	gmu->qmp = qmp_get(gmu->dev);
+	if (IS_ERR(gmu->qmp) && adreno_is_a7xx(adreno_gpu)) {
+		ret = PTR_ERR(gmu->qmp);
+		goto remove_device_link;
+	}
+
+	init_completion(&gmu->pd_gate);
+	complete_all(&gmu->pd_gate);
+	gmu->pd_nb.notifier_call = cxpd_notifier_cb;
+
+	/*
+	 * Get a link to the GX power domain to reset the GPU in case of GMU
+	 * crash
+	 */
+	gmu->gxpd = dev_pm_domain_attach_by_name(gmu->dev, "gx");
+
+	/* Get the power levels for the GMU and GPU */
+	a6xx_gmu_pwrlevels_probe(gmu);
+
+	/* Set up the HFI queues */
+	a6xx_hfi_init(gmu);
+
+	/* Initialize RPMh */
+	a6xx_gmu_rpmh_init(gmu);
+
+	gmu->initialized = true;
+
+	return 0;
+
+remove_device_link:
+	device_link_del(link);
+
+detach_cxpd:
+	dev_pm_domain_detach(gmu->cxpd, false);
+
+err_mmio:
+	iounmap(gmu->mmio);
+	if (platform_get_resource_byname(pdev, IORESOURCE_MEM, "rscc"))
+		iounmap(gmu->rscc);
+	free_irq(gmu->gmu_irq, gmu);
+	free_irq(gmu->hfi_irq, gmu);
+
+err_memory:
+	a6xx_gmu_memory_free(gmu);
+err_put_device:
+	/* Drop reference taken in of_find_device_by_node */
+	put_device(gmu->dev);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a6xx_gmu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a6xx_gmu.h
@@ -0,0 +1,202 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (c) 2017 The Linux Foundation. All rights reserved. */
+
+#ifndef _A6XX_GMU_H_
+#define _A6XX_GMU_H_
+
+#include <linux/completion.h>
+#include <linux/iopoll.h>
+#include <linux/interrupt.h>
+#include <linux/notifier.h>
+#include <linux/soc/qcom/qcom_aoss.h>
+#include "msm_drv.h"
+#include "a6xx_hfi.h"
+
+struct a6xx_gmu_bo {
+	struct drm_gem_object *obj;
+	void *virt;
+	size_t size;
+	u64 iova;
+};
+
+/*
+ * These define the different GMU wake up options - these define how both the
+ * CPU and the GMU bring up the hardware
+ */
+
+/* THe GMU has already been booted and the rentention registers are active */
+#define GMU_WARM_BOOT 0
+
+/* the GMU is coming up for the first time or back from a power collapse */
+#define GMU_COLD_BOOT 1
+
+/*
+ * These define the level of control that the GMU has - the higher the number
+ * the more things that the GMU hardware controls on its own.
+ */
+
+/* The GMU does not do any idle state management */
+#define GMU_IDLE_STATE_ACTIVE 0
+
+/* The GMU manages SPTP power collapse */
+#define GMU_IDLE_STATE_SPTP 2
+
+/* The GMU does automatic IFPC (intra-frame power collapse) */
+#define GMU_IDLE_STATE_IFPC 3
+
+struct a6xx_gmu {
+	struct device *dev;
+
+	/* For serializing communication with the GMU: */
+	struct mutex lock;
+
+	struct msm_gem_address_space *aspace;
+
+	void __iomem *mmio;
+	void __iomem *rscc;
+
+	int hfi_irq;
+	int gmu_irq;
+
+	struct device *gxpd;
+	struct device *cxpd;
+
+	int idle_level;
+
+	struct a6xx_gmu_bo hfi;
+	struct a6xx_gmu_bo debug;
+	struct a6xx_gmu_bo icache;
+	struct a6xx_gmu_bo dcache;
+	struct a6xx_gmu_bo dummy;
+	struct a6xx_gmu_bo log;
+
+	int nr_clocks;
+	struct clk_bulk_data *clocks;
+	struct clk *core_clk;
+	struct clk *hub_clk;
+
+	/* current performance index set externally */
+	int current_perf_index;
+
+	int nr_gpu_freqs;
+	unsigned long gpu_freqs[16];
+	u32 gx_arc_votes[16];
+
+	int nr_gmu_freqs;
+	unsigned long gmu_freqs[4];
+	u32 cx_arc_votes[4];
+
+	unsigned long freq;
+
+	struct a6xx_hfi_queue queues[2];
+
+	bool initialized;
+	bool hung;
+	bool legacy; /* a618 or a630 */
+
+	/* For power domain callback */
+	struct notifier_block pd_nb;
+	struct completion pd_gate;
+
+	struct qmp *qmp;
+};
+
+static inline u32 gmu_read(struct a6xx_gmu *gmu, u32 offset)
+{
+	return msm_readl(gmu->mmio + (offset << 2));
+}
+
+static inline void gmu_write(struct a6xx_gmu *gmu, u32 offset, u32 value)
+{
+	msm_writel(value, gmu->mmio + (offset << 2));
+}
+
+static inline void
+gmu_write_bulk(struct a6xx_gmu *gmu, u32 offset, const u32 *data, u32 size)
+{
+	memcpy_toio(gmu->mmio + (offset << 2), data, size);
+	wmb();
+}
+
+static inline void gmu_rmw(struct a6xx_gmu *gmu, u32 reg, u32 mask, u32 or)
+{
+	u32 val = gmu_read(gmu, reg);
+
+	val &= ~mask;
+
+	gmu_write(gmu, reg, val | or);
+}
+
+static inline u64 gmu_read64(struct a6xx_gmu *gmu, u32 lo, u32 hi)
+{
+	u64 val;
+
+	val = (u64) msm_readl(gmu->mmio + (lo << 2));
+	val |= ((u64) msm_readl(gmu->mmio + (hi << 2)) << 32);
+
+	return val;
+}
+
+#define gmu_poll_timeout(gmu, addr, val, cond, interval, timeout) \
+	readl_poll_timeout((gmu)->mmio + ((addr) << 2), val, cond, \
+		interval, timeout)
+
+static inline u32 gmu_read_rscc(struct a6xx_gmu *gmu, u32 offset)
+{
+	return msm_readl(gmu->rscc + (offset << 2));
+}
+
+static inline void gmu_write_rscc(struct a6xx_gmu *gmu, u32 offset, u32 value)
+{
+	msm_writel(value, gmu->rscc + (offset << 2));
+}
+
+#define gmu_poll_timeout_rscc(gmu, addr, val, cond, interval, timeout) \
+	readl_poll_timeout((gmu)->rscc + ((addr) << 2), val, cond, \
+		interval, timeout)
+
+/*
+ * These are the available OOB (out of band requests) to the GMU where "out of
+ * band" means that the CPU talks to the GMU directly and not through HFI.
+ * Normally this works by writing a ITCM/DTCM register and then triggering a
+ * interrupt (the "request" bit) and waiting for an acknowledgment (the "ack"
+ * bit). The state is cleared by writing the "clear' bit to the GMU interrupt.
+ *
+ * These are used to force the GMU/GPU to stay on during a critical sequence or
+ * for hardware workarounds.
+ */
+
+enum a6xx_gmu_oob_state {
+	/*
+	 * Let the GMU know that a boot or slumber operation has started. The value in
+	 * REG_A6XX_GMU_BOOT_SLUMBER_OPTION lets the GMU know which operation we are
+	 * doing
+	 */
+	GMU_OOB_BOOT_SLUMBER = 0,
+	/*
+	 * Let the GMU know to not turn off any GPU registers while the CPU is in a
+	 * critical section
+	 */
+	GMU_OOB_GPU_SET,
+	/*
+	 * Set a new power level for the GPU when the CPU is doing frequency scaling
+	 */
+	GMU_OOB_DCVS_SET,
+	/*
+	 * Used to keep the GPU on for CPU-side reads of performance counters.
+	 */
+	GMU_OOB_PERFCOUNTER_SET,
+};
+
+void a6xx_hfi_init(struct a6xx_gmu *gmu);
+int a6xx_hfi_start(struct a6xx_gmu *gmu, int boot_state);
+void a6xx_hfi_stop(struct a6xx_gmu *gmu);
+int a6xx_hfi_send_prep_slumber(struct a6xx_gmu *gmu);
+int a6xx_hfi_set_freq(struct a6xx_gmu *gmu, int index);
+
+bool a6xx_gmu_gx_is_on(struct a6xx_gmu *gmu);
+bool a6xx_gmu_sptprac_is_on(struct a6xx_gmu *gmu);
+void a6xx_sptprac_disable(struct a6xx_gmu *gmu);
+int a6xx_sptprac_enable(struct a6xx_gmu *gmu);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a6xx_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a6xx_gpu.c
@@ -0,0 +1,2165 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2017-2019 The Linux Foundation. All rights reserved. */
+
+
+#include "msm_gem.h"
+#include "msm_mmu.h"
+#include "msm_gpu_trace.h"
+#include "a6xx_gpu.h"
+#include "a6xx_gmu.xml.h"
+
+#include <linux/bitfield.h>
+#include <linux/devfreq.h>
+#include <linux/pm_domain.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+
+#define GPU_PAS_ID 13
+
+static inline bool _a6xx_check_idle(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+	/* Check that the GMU is idle */
+	if (!adreno_has_gmu_wrapper(adreno_gpu) && !a6xx_gmu_isidle(&a6xx_gpu->gmu))
+		return false;
+
+	/* Check tha the CX master is idle */
+	if (gpu_read(gpu, REG_A6XX_RBBM_STATUS) &
+			~A6XX_RBBM_STATUS_CP_AHB_BUSY_CX_MASTER)
+		return false;
+
+	return !(gpu_read(gpu, REG_A6XX_RBBM_INT_0_STATUS) &
+		A6XX_RBBM_INT_0_MASK_RBBM_HANG_DETECT);
+}
+
+static bool a6xx_idle(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	/* wait for CP to drain ringbuffer: */
+	if (!adreno_idle(gpu, ring))
+		return false;
+
+	if (spin_until(_a6xx_check_idle(gpu))) {
+		DRM_ERROR("%s: %ps: timeout waiting for GPU to idle: status %8.8X irq %8.8X rptr/wptr %d/%d\n",
+			gpu->name, __builtin_return_address(0),
+			gpu_read(gpu, REG_A6XX_RBBM_STATUS),
+			gpu_read(gpu, REG_A6XX_RBBM_INT_0_STATUS),
+			gpu_read(gpu, REG_A6XX_CP_RB_RPTR),
+			gpu_read(gpu, REG_A6XX_CP_RB_WPTR));
+		return false;
+	}
+
+	return true;
+}
+
+static void update_shadow_rptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+	/* Expanded APRIV doesn't need to issue the WHERE_AM_I opcode */
+	if (a6xx_gpu->has_whereami && !adreno_gpu->base.hw_apriv) {
+		OUT_PKT7(ring, CP_WHERE_AM_I, 2);
+		OUT_RING(ring, lower_32_bits(shadowptr(a6xx_gpu, ring)));
+		OUT_RING(ring, upper_32_bits(shadowptr(a6xx_gpu, ring)));
+	}
+}
+
+static void a6xx_flush(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	uint32_t wptr;
+	unsigned long flags;
+
+	update_shadow_rptr(gpu, ring);
+
+	spin_lock_irqsave(&ring->preempt_lock, flags);
+
+	/* Copy the shadow to the actual register */
+	ring->cur = ring->next;
+
+	/* Make sure to wrap wptr if we need to */
+	wptr = get_wptr(ring);
+
+	spin_unlock_irqrestore(&ring->preempt_lock, flags);
+
+	/* Make sure everything is posted before making a decision */
+	mb();
+
+	gpu_write(gpu, REG_A6XX_CP_RB_WPTR, wptr);
+}
+
+static void get_stats_counter(struct msm_ringbuffer *ring, u32 counter,
+		u64 iova)
+{
+	OUT_PKT7(ring, CP_REG_TO_MEM, 3);
+	OUT_RING(ring, CP_REG_TO_MEM_0_REG(counter) |
+		CP_REG_TO_MEM_0_CNT(2) |
+		CP_REG_TO_MEM_0_64B);
+	OUT_RING(ring, lower_32_bits(iova));
+	OUT_RING(ring, upper_32_bits(iova));
+}
+
+static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,
+		struct msm_ringbuffer *ring, struct msm_file_private *ctx)
+{
+	bool sysprof = refcount_read(&a6xx_gpu->base.base.sysprof_active) > 1;
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	phys_addr_t ttbr;
+	u32 asid;
+	u64 memptr = rbmemptr(ring, ttbr0);
+
+	if (ctx->seqno == a6xx_gpu->base.base.cur_ctx_seqno)
+		return;
+
+	if (msm_iommu_pagetable_params(ctx->aspace->mmu, &ttbr, &asid))
+		return;
+
+	if (!sysprof) {
+		if (!adreno_is_a7xx(adreno_gpu)) {
+			/* Turn off protected mode to write to special registers */
+			OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
+			OUT_RING(ring, 0);
+		}
+
+		OUT_PKT4(ring, REG_A6XX_RBBM_PERFCTR_SRAM_INIT_CMD, 1);
+		OUT_RING(ring, 1);
+	}
+
+	/* Execute the table update */
+	OUT_PKT7(ring, CP_SMMU_TABLE_UPDATE, 4);
+	OUT_RING(ring, CP_SMMU_TABLE_UPDATE_0_TTBR0_LO(lower_32_bits(ttbr)));
+
+	OUT_RING(ring,
+		CP_SMMU_TABLE_UPDATE_1_TTBR0_HI(upper_32_bits(ttbr)) |
+		CP_SMMU_TABLE_UPDATE_1_ASID(asid));
+	OUT_RING(ring, CP_SMMU_TABLE_UPDATE_2_CONTEXTIDR(0));
+	OUT_RING(ring, CP_SMMU_TABLE_UPDATE_3_CONTEXTBANK(0));
+
+	/*
+	 * Write the new TTBR0 to the memstore. This is good for debugging.
+	 */
+	OUT_PKT7(ring, CP_MEM_WRITE, 4);
+	OUT_RING(ring, CP_MEM_WRITE_0_ADDR_LO(lower_32_bits(memptr)));
+	OUT_RING(ring, CP_MEM_WRITE_1_ADDR_HI(upper_32_bits(memptr)));
+	OUT_RING(ring, lower_32_bits(ttbr));
+	OUT_RING(ring, (asid << 16) | upper_32_bits(ttbr));
+
+	/*
+	 * Sync both threads after switching pagetables and enable BR only
+	 * to make sure BV doesn't race ahead while BR is still switching
+	 * pagetables.
+	 */
+	if (adreno_is_a7xx(&a6xx_gpu->base)) {
+		OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
+		OUT_RING(ring, CP_THREAD_CONTROL_0_SYNC_THREADS | CP_SET_THREAD_BR);
+	}
+
+	/*
+	 * And finally, trigger a uche flush to be sure there isn't anything
+	 * lingering in that part of the GPU
+	 */
+
+	OUT_PKT7(ring, CP_EVENT_WRITE, 1);
+	OUT_RING(ring, CACHE_INVALIDATE);
+
+	if (!sysprof) {
+		/*
+		 * Wait for SRAM clear after the pgtable update, so the
+		 * two can happen in parallel:
+		 */
+		OUT_PKT7(ring, CP_WAIT_REG_MEM, 6);
+		OUT_RING(ring, CP_WAIT_REG_MEM_0_FUNCTION(WRITE_EQ));
+		OUT_RING(ring, CP_WAIT_REG_MEM_1_POLL_ADDR_LO(
+				REG_A6XX_RBBM_PERFCTR_SRAM_INIT_STATUS));
+		OUT_RING(ring, CP_WAIT_REG_MEM_2_POLL_ADDR_HI(0));
+		OUT_RING(ring, CP_WAIT_REG_MEM_3_REF(0x1));
+		OUT_RING(ring, CP_WAIT_REG_MEM_4_MASK(0x1));
+		OUT_RING(ring, CP_WAIT_REG_MEM_5_DELAY_LOOP_CYCLES(0));
+
+		if (!adreno_is_a7xx(adreno_gpu)) {
+			/* Re-enable protected mode: */
+			OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
+			OUT_RING(ring, 1);
+		}
+	}
+}
+
+static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+{
+	unsigned int index = submit->seqno % MSM_GPU_SUBMIT_STATS_COUNT;
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct msm_ringbuffer *ring = submit->ring;
+	unsigned int i, ibs = 0;
+
+	a6xx_set_pagetable(a6xx_gpu, ring, submit->queue->ctx);
+
+	get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP(0),
+		rbmemptr_stats(ring, index, cpcycles_start));
+
+	/*
+	 * For PM4 the GMU register offsets are calculated from the base of the
+	 * GPU registers so we need to add 0x1a800 to the register value on A630
+	 * to get the right value from PM4.
+	 */
+	get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER,
+		rbmemptr_stats(ring, index, alwayson_start));
+
+	/* Invalidate CCU depth and color */
+	OUT_PKT7(ring, CP_EVENT_WRITE, 1);
+	OUT_RING(ring, CP_EVENT_WRITE_0_EVENT(PC_CCU_INVALIDATE_DEPTH));
+
+	OUT_PKT7(ring, CP_EVENT_WRITE, 1);
+	OUT_RING(ring, CP_EVENT_WRITE_0_EVENT(PC_CCU_INVALIDATE_COLOR));
+
+	/* Submit the commands */
+	for (i = 0; i < submit->nr_cmds; i++) {
+		switch (submit->cmd[i].type) {
+		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
+			break;
+		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
+			if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)
+				break;
+			fallthrough;
+		case MSM_SUBMIT_CMD_BUF:
+			OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
+			OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
+			OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
+			OUT_RING(ring, submit->cmd[i].size);
+			ibs++;
+			break;
+		}
+
+		/*
+		 * Periodically update shadow-wptr if needed, so that we
+		 * can see partial progress of submits with large # of
+		 * cmds.. otherwise we could needlessly stall waiting for
+		 * ringbuffer state, simply due to looking at a shadow
+		 * rptr value that has not been updated
+		 */
+		if ((ibs % 32) == 0)
+			update_shadow_rptr(gpu, ring);
+	}
+
+	get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP(0),
+		rbmemptr_stats(ring, index, cpcycles_end));
+	get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER,
+		rbmemptr_stats(ring, index, alwayson_end));
+
+	/* Write the fence to the scratch register */
+	OUT_PKT4(ring, REG_A6XX_CP_SCRATCH_REG(2), 1);
+	OUT_RING(ring, submit->seqno);
+
+	/*
+	 * Execute a CACHE_FLUSH_TS event. This will ensure that the
+	 * timestamp is written to the memory and then triggers the interrupt
+	 */
+	OUT_PKT7(ring, CP_EVENT_WRITE, 4);
+	OUT_RING(ring, CP_EVENT_WRITE_0_EVENT(CACHE_FLUSH_TS) |
+		CP_EVENT_WRITE_0_IRQ);
+	OUT_RING(ring, lower_32_bits(rbmemptr(ring, fence)));
+	OUT_RING(ring, upper_32_bits(rbmemptr(ring, fence)));
+	OUT_RING(ring, submit->seqno);
+
+	trace_msm_gpu_submit_flush(submit,
+		gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER));
+
+	a6xx_flush(gpu, ring);
+}
+
+static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+{
+	unsigned int index = submit->seqno % MSM_GPU_SUBMIT_STATS_COUNT;
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct msm_ringbuffer *ring = submit->ring;
+	unsigned int i, ibs = 0;
+
+	/*
+	 * Toggle concurrent binning for pagetable switch and set the thread to
+	 * BR since only it can execute the pagetable switch packets.
+	 */
+	OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
+	OUT_RING(ring, CP_THREAD_CONTROL_0_SYNC_THREADS | CP_SET_THREAD_BR);
+
+	a6xx_set_pagetable(a6xx_gpu, ring, submit->queue->ctx);
+
+	get_stats_counter(ring, REG_A7XX_RBBM_PERFCTR_CP(0),
+		rbmemptr_stats(ring, index, cpcycles_start));
+	get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER,
+		rbmemptr_stats(ring, index, alwayson_start));
+
+	OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
+	OUT_RING(ring, CP_SET_THREAD_BOTH);
+
+	OUT_PKT7(ring, CP_SET_MARKER, 1);
+	OUT_RING(ring, 0x101); /* IFPC disable */
+
+	OUT_PKT7(ring, CP_SET_MARKER, 1);
+	OUT_RING(ring, 0x00d); /* IB1LIST start */
+
+	/* Submit the commands */
+	for (i = 0; i < submit->nr_cmds; i++) {
+		switch (submit->cmd[i].type) {
+		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
+			break;
+		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
+			if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)
+				break;
+			fallthrough;
+		case MSM_SUBMIT_CMD_BUF:
+			OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
+			OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
+			OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
+			OUT_RING(ring, submit->cmd[i].size);
+			ibs++;
+			break;
+		}
+
+		/*
+		 * Periodically update shadow-wptr if needed, so that we
+		 * can see partial progress of submits with large # of
+		 * cmds.. otherwise we could needlessly stall waiting for
+		 * ringbuffer state, simply due to looking at a shadow
+		 * rptr value that has not been updated
+		 */
+		if ((ibs % 32) == 0)
+			update_shadow_rptr(gpu, ring);
+	}
+
+	OUT_PKT7(ring, CP_SET_MARKER, 1);
+	OUT_RING(ring, 0x00e); /* IB1LIST end */
+
+	get_stats_counter(ring, REG_A7XX_RBBM_PERFCTR_CP(0),
+		rbmemptr_stats(ring, index, cpcycles_end));
+	get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER,
+		rbmemptr_stats(ring, index, alwayson_end));
+
+	/* Write the fence to the scratch register */
+	OUT_PKT4(ring, REG_A6XX_CP_SCRATCH_REG(2), 1);
+	OUT_RING(ring, submit->seqno);
+
+	OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
+	OUT_RING(ring, CP_SET_THREAD_BR);
+
+	OUT_PKT7(ring, CP_EVENT_WRITE, 1);
+	OUT_RING(ring, CCU_INVALIDATE_DEPTH);
+
+	OUT_PKT7(ring, CP_EVENT_WRITE, 1);
+	OUT_RING(ring, CCU_INVALIDATE_COLOR);
+
+	OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
+	OUT_RING(ring, CP_SET_THREAD_BV);
+
+	/*
+	 * Make sure the timestamp is committed once BV pipe is
+	 * completely done with this submission.
+	 */
+	OUT_PKT7(ring, CP_EVENT_WRITE, 4);
+	OUT_RING(ring, CACHE_CLEAN | BIT(27));
+	OUT_RING(ring, lower_32_bits(rbmemptr(ring, bv_fence)));
+	OUT_RING(ring, upper_32_bits(rbmemptr(ring, bv_fence)));
+	OUT_RING(ring, submit->seqno);
+
+	OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
+	OUT_RING(ring, CP_SET_THREAD_BR);
+
+	/*
+	 * This makes sure that BR doesn't race ahead and commit
+	 * timestamp to memstore while BV is still processing
+	 * this submission.
+	 */
+	OUT_PKT7(ring, CP_WAIT_TIMESTAMP, 4);
+	OUT_RING(ring, 0);
+	OUT_RING(ring, lower_32_bits(rbmemptr(ring, bv_fence)));
+	OUT_RING(ring, upper_32_bits(rbmemptr(ring, bv_fence)));
+	OUT_RING(ring, submit->seqno);
+
+	/* write the ringbuffer timestamp */
+	OUT_PKT7(ring, CP_EVENT_WRITE, 4);
+	OUT_RING(ring, CACHE_CLEAN | CP_EVENT_WRITE_0_IRQ | BIT(27));
+	OUT_RING(ring, lower_32_bits(rbmemptr(ring, fence)));
+	OUT_RING(ring, upper_32_bits(rbmemptr(ring, fence)));
+	OUT_RING(ring, submit->seqno);
+
+	OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
+	OUT_RING(ring, CP_SET_THREAD_BOTH);
+
+	OUT_PKT7(ring, CP_SET_MARKER, 1);
+	OUT_RING(ring, 0x100); /* IFPC enable */
+
+	trace_msm_gpu_submit_flush(submit,
+		gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER));
+
+	a6xx_flush(gpu, ring);
+}
+
+static void a6xx_set_hwcg(struct msm_gpu *gpu, bool state)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	const struct adreno_reglist *reg;
+	unsigned int i;
+	u32 val, clock_cntl_on, cgc_mode;
+
+	if (!(adreno_gpu->info->a6xx->hwcg || adreno_is_a7xx(adreno_gpu)))
+		return;
+
+	if (adreno_is_a630(adreno_gpu))
+		clock_cntl_on = 0x8aa8aa02;
+	else if (adreno_is_a610(adreno_gpu))
+		clock_cntl_on = 0xaaa8aa82;
+	else if (adreno_is_a702(adreno_gpu))
+		clock_cntl_on = 0xaaaaaa82;
+	else
+		clock_cntl_on = 0x8aa8aa82;
+
+	if (adreno_is_a7xx(adreno_gpu)) {
+		cgc_mode = adreno_is_a740_family(adreno_gpu) ? 0x20222 : 0x20000;
+
+		gmu_write(&a6xx_gpu->gmu, REG_A6XX_GPU_GMU_AO_GMU_CGC_MODE_CNTL,
+			  state ? cgc_mode : 0);
+		gmu_write(&a6xx_gpu->gmu, REG_A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL,
+			  state ? 0x10111 : 0);
+		gmu_write(&a6xx_gpu->gmu, REG_A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL,
+			  state ? 0x5555 : 0);
+	}
+
+	if (!adreno_gpu->info->a6xx->hwcg) {
+		gpu_write(gpu, REG_A7XX_RBBM_CLOCK_CNTL_GLOBAL, 1);
+		gpu_write(gpu, REG_A7XX_RBBM_CGC_GLOBAL_LOAD_CMD, state ? 1 : 0);
+
+		if (state) {
+			gpu_write(gpu, REG_A7XX_RBBM_CGC_P2S_TRIG_CMD, 1);
+
+			if (gpu_poll_timeout(gpu, REG_A7XX_RBBM_CGC_P2S_STATUS, val,
+					     val & A7XX_RBBM_CGC_P2S_STATUS_TXDONE, 1, 10)) {
+				dev_err(&gpu->pdev->dev, "RBBM_CGC_P2S_STATUS TXDONE Poll failed\n");
+				return;
+			}
+
+			gpu_write(gpu, REG_A7XX_RBBM_CLOCK_CNTL_GLOBAL, 0);
+		}
+
+		return;
+	}
+
+	val = gpu_read(gpu, REG_A6XX_RBBM_CLOCK_CNTL);
+
+	/* Don't re-program the registers if they are already correct */
+	if ((!state && !val) || (state && (val == clock_cntl_on)))
+		return;
+
+	/* Disable SP clock before programming HWCG registers */
+	if (!adreno_is_a610_family(adreno_gpu) && !adreno_is_a7xx(adreno_gpu))
+		gmu_rmw(gmu, REG_A6XX_GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL, 1, 0);
+
+	for (i = 0; (reg = &adreno_gpu->info->a6xx->hwcg[i], reg->offset); i++)
+		gpu_write(gpu, reg->offset, state ? reg->value : 0);
+
+	/* Enable SP clock */
+	if (!adreno_is_a610_family(adreno_gpu) && !adreno_is_a7xx(adreno_gpu))
+		gmu_rmw(gmu, REG_A6XX_GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL, 0, 1);
+
+	gpu_write(gpu, REG_A6XX_RBBM_CLOCK_CNTL, state ? clock_cntl_on : 0);
+}
+
+static void a6xx_set_cp_protect(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	const struct adreno_protect *protect = adreno_gpu->info->a6xx->protect;
+	unsigned i;
+
+	/*
+	 * Enable access protection to privileged registers, fault on an access
+	 * protect violation and select the last span to protect from the start
+	 * address all the way to the end of the register address space
+	 */
+	gpu_write(gpu, REG_A6XX_CP_PROTECT_CNTL,
+		  A6XX_CP_PROTECT_CNTL_ACCESS_PROT_EN |
+		  A6XX_CP_PROTECT_CNTL_ACCESS_FAULT_ON_VIOL_EN |
+		  A6XX_CP_PROTECT_CNTL_LAST_SPAN_INF_RANGE);
+
+	for (i = 0; i < protect->count - 1; i++) {
+		/* Intentionally skip writing to some registers */
+		if (protect->regs[i])
+			gpu_write(gpu, REG_A6XX_CP_PROTECT(i), protect->regs[i]);
+	}
+	/* last CP_PROTECT to have "infinite" length on the last entry */
+	gpu_write(gpu, REG_A6XX_CP_PROTECT(protect->count_max - 1), protect->regs[i]);
+}
+
+static void a6xx_calc_ubwc_config(struct adreno_gpu *gpu)
+{
+	gpu->ubwc_config.rgb565_predicator = 0;
+	gpu->ubwc_config.uavflagprd_inv = 0;
+	gpu->ubwc_config.min_acc_len = 0;
+	gpu->ubwc_config.ubwc_swizzle = 0x6;
+	gpu->ubwc_config.macrotile_mode = 0;
+	gpu->ubwc_config.highest_bank_bit = 15;
+
+	if (adreno_is_a610(gpu)) {
+		gpu->ubwc_config.highest_bank_bit = 13;
+		gpu->ubwc_config.min_acc_len = 1;
+		gpu->ubwc_config.ubwc_swizzle = 0x7;
+	}
+
+	if (adreno_is_a618(gpu))
+		gpu->ubwc_config.highest_bank_bit = 14;
+
+	if (adreno_is_a619(gpu))
+		/* TODO: Should be 14 but causes corruption at e.g. 1920x1200 on DP */
+		gpu->ubwc_config.highest_bank_bit = 13;
+
+	if (adreno_is_a619_holi(gpu))
+		gpu->ubwc_config.highest_bank_bit = 13;
+
+	if (adreno_is_a640_family(gpu))
+		gpu->ubwc_config.amsbc = 1;
+
+	if (adreno_is_a650(gpu) ||
+	    adreno_is_a660(gpu) ||
+	    adreno_is_a690(gpu) ||
+	    adreno_is_a730(gpu) ||
+	    adreno_is_a740_family(gpu)) {
+		/* TODO: get ddr type from bootloader and use 2 for LPDDR4 */
+		gpu->ubwc_config.highest_bank_bit = 16;
+		gpu->ubwc_config.amsbc = 1;
+		gpu->ubwc_config.rgb565_predicator = 1;
+		gpu->ubwc_config.uavflagprd_inv = 2;
+		gpu->ubwc_config.macrotile_mode = 1;
+	}
+
+	if (adreno_is_a663(gpu)) {
+		gpu->ubwc_config.highest_bank_bit = 13;
+		gpu->ubwc_config.amsbc = 1;
+		gpu->ubwc_config.rgb565_predicator = 1;
+		gpu->ubwc_config.uavflagprd_inv = 2;
+		gpu->ubwc_config.macrotile_mode = 1;
+		gpu->ubwc_config.ubwc_swizzle = 0x4;
+	}
+
+	if (adreno_is_7c3(gpu)) {
+		gpu->ubwc_config.highest_bank_bit = 14;
+		gpu->ubwc_config.amsbc = 1;
+		gpu->ubwc_config.rgb565_predicator = 1;
+		gpu->ubwc_config.uavflagprd_inv = 2;
+		gpu->ubwc_config.macrotile_mode = 1;
+	}
+
+	if (adreno_is_a702(gpu)) {
+		gpu->ubwc_config.highest_bank_bit = 14;
+		gpu->ubwc_config.min_acc_len = 1;
+	}
+}
+
+static void a6xx_set_ubwc_config(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	/*
+	 * We subtract 13 from the highest bank bit (13 is the minimum value
+	 * allowed by hw) and write the lowest two bits of the remaining value
+	 * as hbb_lo and the one above it as hbb_hi to the hardware.
+	 */
+	BUG_ON(adreno_gpu->ubwc_config.highest_bank_bit < 13);
+	u32 hbb = adreno_gpu->ubwc_config.highest_bank_bit - 13;
+	u32 hbb_hi = hbb >> 2;
+	u32 hbb_lo = hbb & 3;
+	u32 ubwc_mode = adreno_gpu->ubwc_config.ubwc_swizzle & 1;
+	u32 level2_swizzling_dis = !(adreno_gpu->ubwc_config.ubwc_swizzle & 2);
+
+	gpu_write(gpu, REG_A6XX_RB_NC_MODE_CNTL,
+		  level2_swizzling_dis << 12 |
+		  adreno_gpu->ubwc_config.rgb565_predicator << 11 |
+		  hbb_hi << 10 | adreno_gpu->ubwc_config.amsbc << 4 |
+		  adreno_gpu->ubwc_config.min_acc_len << 3 |
+		  hbb_lo << 1 | ubwc_mode);
+
+	gpu_write(gpu, REG_A6XX_TPL1_NC_MODE_CNTL,
+		  level2_swizzling_dis << 6 | hbb_hi << 4 |
+		  adreno_gpu->ubwc_config.min_acc_len << 3 |
+		  hbb_lo << 1 | ubwc_mode);
+
+	gpu_write(gpu, REG_A6XX_SP_NC_MODE_CNTL,
+		  level2_swizzling_dis << 12 | hbb_hi << 10 |
+		  adreno_gpu->ubwc_config.uavflagprd_inv << 4 |
+		  adreno_gpu->ubwc_config.min_acc_len << 3 |
+		  hbb_lo << 1 | ubwc_mode);
+
+	if (adreno_is_a7xx(adreno_gpu))
+		gpu_write(gpu, REG_A7XX_GRAS_NC_MODE_CNTL,
+			  FIELD_PREP(GENMASK(8, 5), hbb_lo));
+
+	gpu_write(gpu, REG_A6XX_UCHE_MODE_CNTL,
+		  adreno_gpu->ubwc_config.min_acc_len << 23 | hbb_lo << 21);
+
+	gpu_write(gpu, REG_A6XX_RBBM_NC_MODE_CNTL,
+		  adreno_gpu->ubwc_config.macrotile_mode);
+}
+
+static int a6xx_cp_init(struct msm_gpu *gpu)
+{
+	struct msm_ringbuffer *ring = gpu->rb[0];
+
+	OUT_PKT7(ring, CP_ME_INIT, 8);
+
+	OUT_RING(ring, 0x0000002f);
+
+	/* Enable multiple hardware contexts */
+	OUT_RING(ring, 0x00000003);
+
+	/* Enable error detection */
+	OUT_RING(ring, 0x20000000);
+
+	/* Don't enable header dump */
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+
+	/* No workarounds enabled */
+	OUT_RING(ring, 0x00000000);
+
+	/* Pad rest of the cmds with 0's */
+	OUT_RING(ring, 0x00000000);
+	OUT_RING(ring, 0x00000000);
+
+	a6xx_flush(gpu, ring);
+	return a6xx_idle(gpu, ring) ? 0 : -EINVAL;
+}
+
+static int a7xx_cp_init(struct msm_gpu *gpu)
+{
+	struct msm_ringbuffer *ring = gpu->rb[0];
+	u32 mask;
+
+	/* Disable concurrent binning before sending CP init */
+	OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
+	OUT_RING(ring, BIT(27));
+
+	OUT_PKT7(ring, CP_ME_INIT, 7);
+
+	/* Use multiple HW contexts */
+	mask = BIT(0);
+
+	/* Enable error detection */
+	mask |= BIT(1);
+
+	/* Set default reset state */
+	mask |= BIT(3);
+
+	/* Disable save/restore of performance counters across preemption */
+	mask |= BIT(6);
+
+	/* Enable the register init list with the spinlock */
+	mask |= BIT(8);
+
+	OUT_RING(ring, mask);
+
+	/* Enable multiple hardware contexts */
+	OUT_RING(ring, 0x00000003);
+
+	/* Enable error detection */
+	OUT_RING(ring, 0x20000000);
+
+	/* Operation mode mask */
+	OUT_RING(ring, 0x00000002);
+
+	/* *Don't* send a power up reg list for concurrent binning (TODO) */
+	/* Lo address */
+	OUT_RING(ring, 0x00000000);
+	/* Hi address */
+	OUT_RING(ring, 0x00000000);
+	/* BIT(31) set => read the regs from the list */
+	OUT_RING(ring, 0x00000000);
+
+	a6xx_flush(gpu, ring);
+	return a6xx_idle(gpu, ring) ? 0 : -EINVAL;
+}
+
+/*
+ * Check that the microcode version is new enough to include several key
+ * security fixes. Return true if the ucode is safe.
+ */
+static bool a6xx_ucode_check_version(struct a6xx_gpu *a6xx_gpu,
+		struct drm_gem_object *obj)
+{
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct msm_gpu *gpu = &adreno_gpu->base;
+	const char *sqe_name = adreno_gpu->info->fw[ADRENO_FW_SQE];
+	u32 *buf = msm_gem_get_vaddr(obj);
+	bool ret = false;
+
+	if (IS_ERR(buf))
+		return false;
+
+	/* A7xx is safe! */
+	if (adreno_is_a7xx(adreno_gpu) || adreno_is_a702(adreno_gpu))
+		return true;
+
+	/*
+	 * Targets up to a640 (a618, a630 and a640) need to check for a
+	 * microcode version that is patched to support the whereami opcode or
+	 * one that is new enough to include it by default.
+	 *
+	 * a650 tier targets don't need whereami but still need to be
+	 * equal to or newer than 0.95 for other security fixes
+	 *
+	 * a660 targets have all the critical security fixes from the start
+	 */
+	if (!strcmp(sqe_name, "a630_sqe.fw")) {
+		/*
+		 * If the lowest nibble is 0xa that is an indication that this
+		 * microcode has been patched. The actual version is in dword
+		 * [3] but we only care about the patchlevel which is the lowest
+		 * nibble of dword [3]
+		 *
+		 * Otherwise check that the firmware is greater than or equal
+		 * to 1.90 which was the first version that had this fix built
+		 * in
+		 */
+		if ((((buf[0] & 0xf) == 0xa) && (buf[2] & 0xf) >= 1) ||
+			(buf[0] & 0xfff) >= 0x190) {
+			a6xx_gpu->has_whereami = true;
+			ret = true;
+			goto out;
+		}
+
+		DRM_DEV_ERROR(&gpu->pdev->dev,
+			"a630 SQE ucode is too old. Have version %x need at least %x\n",
+			buf[0] & 0xfff, 0x190);
+	} else if (!strcmp(sqe_name, "a650_sqe.fw")) {
+		if ((buf[0] & 0xfff) >= 0x095) {
+			ret = true;
+			goto out;
+		}
+
+		DRM_DEV_ERROR(&gpu->pdev->dev,
+			"a650 SQE ucode is too old. Have version %x need at least %x\n",
+			buf[0] & 0xfff, 0x095);
+	} else if (!strcmp(sqe_name, "a660_sqe.fw")) {
+		ret = true;
+	} else {
+		DRM_DEV_ERROR(&gpu->pdev->dev,
+			"unknown GPU, add it to a6xx_ucode_check_version()!!\n");
+	}
+out:
+	msm_gem_put_vaddr(obj);
+	return ret;
+}
+
+static int a6xx_ucode_load(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+	if (!a6xx_gpu->sqe_bo) {
+		a6xx_gpu->sqe_bo = adreno_fw_create_bo(gpu,
+			adreno_gpu->fw[ADRENO_FW_SQE], &a6xx_gpu->sqe_iova);
+
+		if (IS_ERR(a6xx_gpu->sqe_bo)) {
+			int ret = PTR_ERR(a6xx_gpu->sqe_bo);
+
+			a6xx_gpu->sqe_bo = NULL;
+			DRM_DEV_ERROR(&gpu->pdev->dev,
+				"Could not allocate SQE ucode: %d\n", ret);
+
+			return ret;
+		}
+
+		msm_gem_object_set_name(a6xx_gpu->sqe_bo, "sqefw");
+		if (!a6xx_ucode_check_version(a6xx_gpu, a6xx_gpu->sqe_bo)) {
+			msm_gem_unpin_iova(a6xx_gpu->sqe_bo, gpu->aspace);
+			drm_gem_object_put(a6xx_gpu->sqe_bo);
+
+			a6xx_gpu->sqe_bo = NULL;
+			return -EPERM;
+		}
+	}
+
+	/*
+	 * Expanded APRIV and targets that support WHERE_AM_I both need a
+	 * privileged buffer to store the RPTR shadow
+	 */
+	if ((adreno_gpu->base.hw_apriv || a6xx_gpu->has_whereami) &&
+	    !a6xx_gpu->shadow_bo) {
+		a6xx_gpu->shadow = msm_gem_kernel_new(gpu->dev,
+						      sizeof(u32) * gpu->nr_rings,
+						      MSM_BO_WC | MSM_BO_MAP_PRIV,
+						      gpu->aspace, &a6xx_gpu->shadow_bo,
+						      &a6xx_gpu->shadow_iova);
+
+		if (IS_ERR(a6xx_gpu->shadow))
+			return PTR_ERR(a6xx_gpu->shadow);
+
+		msm_gem_object_set_name(a6xx_gpu->shadow_bo, "shadow");
+	}
+
+	return 0;
+}
+
+static int a6xx_zap_shader_init(struct msm_gpu *gpu)
+{
+	static bool loaded;
+	int ret;
+
+	if (loaded)
+		return 0;
+
+	ret = adreno_zap_shader_load(gpu, GPU_PAS_ID);
+
+	loaded = !ret;
+	return ret;
+}
+
+#define A6XX_INT_MASK (A6XX_RBBM_INT_0_MASK_CP_AHB_ERROR | \
+		       A6XX_RBBM_INT_0_MASK_RBBM_ATB_ASYNCFIFO_OVERFLOW | \
+		       A6XX_RBBM_INT_0_MASK_CP_HW_ERROR | \
+		       A6XX_RBBM_INT_0_MASK_CP_IB2 | \
+		       A6XX_RBBM_INT_0_MASK_CP_IB1 | \
+		       A6XX_RBBM_INT_0_MASK_CP_RB | \
+		       A6XX_RBBM_INT_0_MASK_CP_CACHE_FLUSH_TS | \
+		       A6XX_RBBM_INT_0_MASK_RBBM_ATB_BUS_OVERFLOW | \
+		       A6XX_RBBM_INT_0_MASK_RBBM_HANG_DETECT | \
+		       A6XX_RBBM_INT_0_MASK_UCHE_OOB_ACCESS | \
+		       A6XX_RBBM_INT_0_MASK_UCHE_TRAP_INTR)
+
+#define A7XX_INT_MASK (A6XX_RBBM_INT_0_MASK_CP_AHB_ERROR | \
+		       A6XX_RBBM_INT_0_MASK_RBBM_ATB_ASYNCFIFO_OVERFLOW | \
+		       A6XX_RBBM_INT_0_MASK_RBBM_GPC_ERROR | \
+		       A6XX_RBBM_INT_0_MASK_CP_SW | \
+		       A6XX_RBBM_INT_0_MASK_CP_HW_ERROR | \
+		       A6XX_RBBM_INT_0_MASK_PM4CPINTERRUPT | \
+		       A6XX_RBBM_INT_0_MASK_CP_RB_DONE_TS | \
+		       A6XX_RBBM_INT_0_MASK_CP_CACHE_FLUSH_TS | \
+		       A6XX_RBBM_INT_0_MASK_RBBM_ATB_BUS_OVERFLOW | \
+		       A6XX_RBBM_INT_0_MASK_RBBM_HANG_DETECT | \
+		       A6XX_RBBM_INT_0_MASK_UCHE_OOB_ACCESS | \
+		       A6XX_RBBM_INT_0_MASK_UCHE_TRAP_INTR | \
+		       A6XX_RBBM_INT_0_MASK_TSBWRITEERROR)
+
+#define A7XX_APRIV_MASK (A6XX_CP_APRIV_CNTL_ICACHE | \
+			 A6XX_CP_APRIV_CNTL_RBFETCH | \
+			 A6XX_CP_APRIV_CNTL_RBPRIVLEVEL | \
+			 A6XX_CP_APRIV_CNTL_RBRPWB)
+
+#define A7XX_BR_APRIVMASK (A7XX_APRIV_MASK | \
+			   A6XX_CP_APRIV_CNTL_CDREAD | \
+			   A6XX_CP_APRIV_CNTL_CDWRITE)
+
+static int hw_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	u64 gmem_range_min;
+	int ret;
+
+	if (!adreno_has_gmu_wrapper(adreno_gpu)) {
+		/* Make sure the GMU keeps the GPU on while we set it up */
+		ret = a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET);
+		if (ret)
+			return ret;
+	}
+
+	/* Clear GBIF halt in case GX domain was not collapsed */
+	if (adreno_is_a619_holi(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_GBIF_HALT, 0);
+		gpu_write(gpu, REG_A6XX_RBBM_GPR0_CNTL, 0);
+		/* Let's make extra sure that the GPU can access the memory.. */
+		mb();
+	} else if (a6xx_has_gbif(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_GBIF_HALT, 0);
+		gpu_write(gpu, REG_A6XX_RBBM_GBIF_HALT, 0);
+		/* Let's make extra sure that the GPU can access the memory.. */
+		mb();
+	}
+
+	/* Some GPUs are stubborn and take their sweet time to unhalt GBIF! */
+	if (adreno_is_a7xx(adreno_gpu) && a6xx_has_gbif(adreno_gpu))
+		spin_until(!gpu_read(gpu, REG_A6XX_GBIF_HALT_ACK));
+
+	gpu_write(gpu, REG_A6XX_RBBM_SECVID_TSB_CNTL, 0);
+
+	if (adreno_is_a619_holi(adreno_gpu))
+		a6xx_sptprac_enable(gmu);
+
+	/*
+	 * Disable the trusted memory range - we don't actually supported secure
+	 * memory rendering at this point in time and we don't want to block off
+	 * part of the virtual memory space.
+	 */
+	gpu_write64(gpu, REG_A6XX_RBBM_SECVID_TSB_TRUSTED_BASE, 0x00000000);
+	gpu_write(gpu, REG_A6XX_RBBM_SECVID_TSB_TRUSTED_SIZE, 0x00000000);
+
+	if (!adreno_is_a7xx(adreno_gpu)) {
+		/* Turn on 64 bit addressing for all blocks */
+		gpu_write(gpu, REG_A6XX_CP_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_VSC_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_GRAS_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_RB_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_PC_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_HLSQ_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_VFD_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_VPC_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_UCHE_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_SP_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_TPL1_ADDR_MODE_CNTL, 0x1);
+		gpu_write(gpu, REG_A6XX_RBBM_SECVID_TSB_ADDR_MODE_CNTL, 0x1);
+	}
+
+	/* enable hardware clockgating */
+	a6xx_set_hwcg(gpu, true);
+
+	/* VBIF/GBIF start*/
+	if (adreno_is_a610_family(adreno_gpu) ||
+	    adreno_is_a640_family(adreno_gpu) ||
+	    adreno_is_a650_family(adreno_gpu) ||
+	    adreno_is_a7xx(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_GBIF_QSB_SIDE0, 0x00071620);
+		gpu_write(gpu, REG_A6XX_GBIF_QSB_SIDE1, 0x00071620);
+		gpu_write(gpu, REG_A6XX_GBIF_QSB_SIDE2, 0x00071620);
+		gpu_write(gpu, REG_A6XX_GBIF_QSB_SIDE3, 0x00071620);
+		gpu_write(gpu, REG_A6XX_RBBM_GBIF_CLIENT_QOS_CNTL,
+			  adreno_is_a7xx(adreno_gpu) ? 0x2120212 : 0x3);
+	} else {
+		gpu_write(gpu, REG_A6XX_RBBM_VBIF_CLIENT_QOS_CNTL, 0x3);
+	}
+
+	if (adreno_is_a630(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_VBIF_GATE_OFF_WRREQ_EN, 0x00000009);
+
+	if (adreno_is_a7xx(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_UCHE_GBIF_GX_CONFIG, 0x10240e0);
+
+	/* Make all blocks contribute to the GPU BUSY perf counter */
+	gpu_write(gpu, REG_A6XX_RBBM_PERFCTR_GPU_BUSY_MASKED, 0xffffffff);
+
+	/* Disable L2 bypass in the UCHE */
+	if (adreno_is_a7xx(adreno_gpu)) {
+		gpu_write64(gpu, REG_A6XX_UCHE_TRAP_BASE, 0x0001fffffffff000llu);
+		gpu_write64(gpu, REG_A6XX_UCHE_WRITE_THRU_BASE, 0x0001fffffffff000llu);
+	} else {
+		gpu_write64(gpu, REG_A6XX_UCHE_WRITE_RANGE_MAX, 0x0001ffffffffffc0llu);
+		gpu_write64(gpu, REG_A6XX_UCHE_TRAP_BASE, 0x0001fffffffff000llu);
+		gpu_write64(gpu, REG_A6XX_UCHE_WRITE_THRU_BASE, 0x0001fffffffff000llu);
+	}
+
+	if (!(adreno_is_a650_family(adreno_gpu) ||
+	      adreno_is_a702(adreno_gpu) ||
+	      adreno_is_a730(adreno_gpu))) {
+		gmem_range_min = adreno_is_a740_family(adreno_gpu) ? SZ_16M : SZ_1M;
+
+		/* Set the GMEM VA range [0x100000:0x100000 + gpu->gmem - 1] */
+		gpu_write64(gpu, REG_A6XX_UCHE_GMEM_RANGE_MIN, gmem_range_min);
+
+		gpu_write64(gpu, REG_A6XX_UCHE_GMEM_RANGE_MAX,
+			gmem_range_min + adreno_gpu->info->gmem - 1);
+	}
+
+	if (adreno_is_a7xx(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_UCHE_CACHE_WAYS, BIT(23));
+	else {
+		gpu_write(gpu, REG_A6XX_UCHE_FILTER_CNTL, 0x804);
+		gpu_write(gpu, REG_A6XX_UCHE_CACHE_WAYS, 0x4);
+	}
+
+	if (adreno_is_a640_family(adreno_gpu) || adreno_is_a650_family(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_2, 0x02000140);
+		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_1, 0x8040362c);
+	} else if (adreno_is_a610_family(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_2, 0x00800060);
+		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_1, 0x40201b16);
+	} else if (!adreno_is_a7xx(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_2, 0x010000c0);
+		gpu_write(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_1, 0x8040362c);
+	}
+
+	if (adreno_is_a660_family(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_CP_LPAC_PROG_FIFO_SIZE, 0x00000020);
+
+	/* Setting the mem pool size */
+	if (adreno_is_a610(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_SIZE, 48);
+		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_DBG_ADDR, 47);
+	} else if (adreno_is_a702(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_SIZE, 64);
+		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_DBG_ADDR, 63);
+	} else if (!adreno_is_a7xx(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_CP_MEM_POOL_SIZE, 128);
+
+
+	/* Set the default primFifo threshold values */
+	if (adreno_gpu->info->a6xx->prim_fifo_threshold)
+		gpu_write(gpu, REG_A6XX_PC_DBG_ECO_CNTL,
+			  adreno_gpu->info->a6xx->prim_fifo_threshold);
+
+	/* Set the AHB default slave response to "ERROR" */
+	gpu_write(gpu, REG_A6XX_CP_AHB_CNTL, 0x1);
+
+	/* Turn on performance counters */
+	gpu_write(gpu, REG_A6XX_RBBM_PERFCTR_CNTL, 0x1);
+
+	if (adreno_is_a7xx(adreno_gpu)) {
+		/* Turn on the IFPC counter (countable 4 on XOCLK4) */
+		gmu_write(&a6xx_gpu->gmu, REG_A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_1,
+			  FIELD_PREP(GENMASK(7, 0), 0x4));
+	}
+
+	/* Select CP0 to always count cycles */
+	gpu_write(gpu, REG_A6XX_CP_PERFCTR_CP_SEL(0), PERF_CP_ALWAYS_COUNT);
+
+	a6xx_set_ubwc_config(gpu);
+
+	/* Enable fault detection */
+	if (adreno_is_a730(adreno_gpu) ||
+	    adreno_is_a740_family(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0xcfffff);
+	else if (adreno_is_a690(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x4fffff);
+	else if (adreno_is_a619(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x3fffff);
+	else if (adreno_is_a610(adreno_gpu) || adreno_is_a702(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x3ffff);
+	else
+		gpu_write(gpu, REG_A6XX_RBBM_INTERFACE_HANG_INT_CNTL, (1 << 30) | 0x1fffff);
+
+	gpu_write(gpu, REG_A6XX_UCHE_CLIENT_PF, BIT(7) | 0x1);
+
+	/* Set weights for bicubic filtering */
+	if (adreno_is_a650_family(adreno_gpu) || adreno_is_x185(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_0, 0);
+		gpu_write(gpu, REG_A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_1,
+			0x3fe05ff4);
+		gpu_write(gpu, REG_A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_2,
+			0x3fa0ebee);
+		gpu_write(gpu, REG_A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_3,
+			0x3f5193ed);
+		gpu_write(gpu, REG_A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_4,
+			0x3f0243f0);
+	}
+
+	/* Set up the CX GMU counter 0 to count busy ticks */
+	gmu_write(gmu, REG_A6XX_GPU_GMU_AO_GPU_CX_BUSY_MASK, 0xff000000);
+
+	/* Enable the power counter */
+	gmu_rmw(gmu, REG_A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_0, 0xff, BIT(5));
+	gmu_write(gmu, REG_A6XX_GMU_CX_GMU_POWER_COUNTER_ENABLE, 1);
+
+	/* Protect registers from the CP */
+	a6xx_set_cp_protect(gpu);
+
+	if (adreno_is_a660_family(adreno_gpu)) {
+		if (adreno_is_a690(adreno_gpu))
+			gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, 0x00028801);
+		else
+			gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, 0x1);
+		gpu_write(gpu, REG_A6XX_RBBM_GBIF_CLIENT_QOS_CNTL, 0x0);
+	} else if (adreno_is_a702(adreno_gpu)) {
+		/* Something to do with the HLSQ cluster */
+		gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, BIT(24));
+	}
+
+	if (adreno_is_a690(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_UCHE_CMDQ_CONFIG, 0x90);
+	/* Set dualQ + disable afull for A660 GPU */
+	else if (adreno_is_a660(adreno_gpu) || adreno_is_a663(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_UCHE_CMDQ_CONFIG, 0x66906);
+	else if (adreno_is_a7xx(adreno_gpu))
+		gpu_write(gpu, REG_A6XX_UCHE_CMDQ_CONFIG,
+			  FIELD_PREP(GENMASK(19, 16), 6) |
+			  FIELD_PREP(GENMASK(15, 12), 6) |
+			  FIELD_PREP(GENMASK(11, 8), 9) |
+			  BIT(3) | BIT(2) |
+			  FIELD_PREP(GENMASK(1, 0), 2));
+
+	/* Enable expanded apriv for targets that support it */
+	if (gpu->hw_apriv) {
+		if (adreno_is_a7xx(adreno_gpu)) {
+			gpu_write(gpu, REG_A6XX_CP_APRIV_CNTL,
+				  A7XX_BR_APRIVMASK);
+			gpu_write(gpu, REG_A7XX_CP_BV_APRIV_CNTL,
+				  A7XX_APRIV_MASK);
+			gpu_write(gpu, REG_A7XX_CP_LPAC_APRIV_CNTL,
+				  A7XX_APRIV_MASK);
+		} else
+			gpu_write(gpu, REG_A6XX_CP_APRIV_CNTL,
+				  BIT(6) | BIT(5) | BIT(3) | BIT(2) | BIT(1));
+	}
+
+	/* Enable interrupts */
+	gpu_write(gpu, REG_A6XX_RBBM_INT_0_MASK,
+		  adreno_is_a7xx(adreno_gpu) ? A7XX_INT_MASK : A6XX_INT_MASK);
+
+	ret = adreno_hw_init(gpu);
+	if (ret)
+		goto out;
+
+	gpu_write64(gpu, REG_A6XX_CP_SQE_INSTR_BASE, a6xx_gpu->sqe_iova);
+
+	/* Set the ringbuffer address */
+	gpu_write64(gpu, REG_A6XX_CP_RB_BASE, gpu->rb[0]->iova);
+
+	/* Targets that support extended APRIV can use the RPTR shadow from
+	 * hardware but all the other ones need to disable the feature. Targets
+	 * that support the WHERE_AM_I opcode can use that instead
+	 */
+	if (adreno_gpu->base.hw_apriv)
+		gpu_write(gpu, REG_A6XX_CP_RB_CNTL, MSM_GPU_RB_CNTL_DEFAULT);
+	else
+		gpu_write(gpu, REG_A6XX_CP_RB_CNTL,
+			MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
+
+	/* Configure the RPTR shadow if needed: */
+	if (a6xx_gpu->shadow_bo) {
+		gpu_write64(gpu, REG_A6XX_CP_RB_RPTR_ADDR,
+			shadowptr(a6xx_gpu, gpu->rb[0]));
+	}
+
+	/* ..which means "always" on A7xx, also for BV shadow */
+	if (adreno_is_a7xx(adreno_gpu)) {
+		gpu_write64(gpu, REG_A7XX_CP_BV_RB_RPTR_ADDR,
+			    rbmemptr(gpu->rb[0], bv_fence));
+	}
+
+	/* Always come up on rb 0 */
+	a6xx_gpu->cur_ring = gpu->rb[0];
+
+	gpu->cur_ctx_seqno = 0;
+
+	/* Enable the SQE_to start the CP engine */
+	gpu_write(gpu, REG_A6XX_CP_SQE_CNTL, 1);
+
+	ret = adreno_is_a7xx(adreno_gpu) ? a7xx_cp_init(gpu) : a6xx_cp_init(gpu);
+	if (ret)
+		goto out;
+
+	/*
+	 * Try to load a zap shader into the secure world. If successful
+	 * we can use the CP to switch out of secure mode. If not then we
+	 * have no resource but to try to switch ourselves out manually. If we
+	 * guessed wrong then access to the RBBM_SECVID_TRUST_CNTL register will
+	 * be blocked and a permissions violation will soon follow.
+	 */
+	ret = a6xx_zap_shader_init(gpu);
+	if (!ret) {
+		OUT_PKT7(gpu->rb[0], CP_SET_SECURE_MODE, 1);
+		OUT_RING(gpu->rb[0], 0x00000000);
+
+		a6xx_flush(gpu, gpu->rb[0]);
+		if (!a6xx_idle(gpu, gpu->rb[0]))
+			return -EINVAL;
+	} else if (ret == -ENODEV) {
+		/*
+		 * This device does not use zap shader (but print a warning
+		 * just in case someone got their dt wrong.. hopefully they
+		 * have a debug UART to realize the error of their ways...
+		 * if you mess this up you are about to crash horribly)
+		 */
+		dev_warn_once(gpu->dev->dev,
+			"Zap shader not enabled - using SECVID_TRUST_CNTL instead\n");
+		gpu_write(gpu, REG_A6XX_RBBM_SECVID_TRUST_CNTL, 0x0);
+		ret = 0;
+	} else {
+		return ret;
+	}
+
+out:
+	if (adreno_has_gmu_wrapper(adreno_gpu))
+		return ret;
+	/*
+	 * Tell the GMU that we are done touching the GPU and it can start power
+	 * management
+	 */
+	a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET);
+
+	if (a6xx_gpu->gmu.legacy) {
+		/* Take the GMU out of its special boot mode */
+		a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_BOOT_SLUMBER);
+	}
+
+	return ret;
+}
+
+static int a6xx_hw_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	int ret;
+
+	mutex_lock(&a6xx_gpu->gmu.lock);
+	ret = hw_init(gpu);
+	mutex_unlock(&a6xx_gpu->gmu.lock);
+
+	return ret;
+}
+
+static void a6xx_dump(struct msm_gpu *gpu)
+{
+	DRM_DEV_INFO(&gpu->pdev->dev, "status:   %08x\n",
+			gpu_read(gpu, REG_A6XX_RBBM_STATUS));
+	adreno_dump(gpu);
+}
+
+static void a6xx_recover(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	int i, active_submits;
+
+	adreno_dump_info(gpu);
+
+	for (i = 0; i < 8; i++)
+		DRM_DEV_INFO(&gpu->pdev->dev, "CP_SCRATCH_REG%d: %u\n", i,
+			gpu_read(gpu, REG_A6XX_CP_SCRATCH_REG(i)));
+
+	if (hang_debug)
+		a6xx_dump(gpu);
+
+	/*
+	 * To handle recovery specific sequences during the rpm suspend we are
+	 * about to trigger
+	 */
+	a6xx_gpu->hung = true;
+
+	/* Halt SQE first */
+	gpu_write(gpu, REG_A6XX_CP_SQE_CNTL, 3);
+
+	pm_runtime_dont_use_autosuspend(&gpu->pdev->dev);
+
+	/* active_submit won't change until we make a submission */
+	mutex_lock(&gpu->active_lock);
+	active_submits = gpu->active_submits;
+
+	/*
+	 * Temporarily clear active_submits count to silence a WARN() in the
+	 * runtime suspend cb
+	 */
+	gpu->active_submits = 0;
+
+	if (adreno_has_gmu_wrapper(adreno_gpu)) {
+		/* Drain the outstanding traffic on memory buses */
+		a6xx_bus_clear_pending_transactions(adreno_gpu, true);
+
+		/* Reset the GPU to a clean state */
+		a6xx_gpu_sw_reset(gpu, true);
+		a6xx_gpu_sw_reset(gpu, false);
+	}
+
+	reinit_completion(&gmu->pd_gate);
+	dev_pm_genpd_add_notifier(gmu->cxpd, &gmu->pd_nb);
+	dev_pm_genpd_synced_poweroff(gmu->cxpd);
+
+	/* Drop the rpm refcount from active submits */
+	if (active_submits)
+		pm_runtime_put(&gpu->pdev->dev);
+
+	/* And the final one from recover worker */
+	pm_runtime_put_sync(&gpu->pdev->dev);
+
+	if (!wait_for_completion_timeout(&gmu->pd_gate, msecs_to_jiffies(1000)))
+		DRM_DEV_ERROR(&gpu->pdev->dev, "cx gdsc didn't collapse\n");
+
+	dev_pm_genpd_remove_notifier(gmu->cxpd);
+
+	pm_runtime_use_autosuspend(&gpu->pdev->dev);
+
+	if (active_submits)
+		pm_runtime_get(&gpu->pdev->dev);
+
+	pm_runtime_get_sync(&gpu->pdev->dev);
+
+	gpu->active_submits = active_submits;
+	mutex_unlock(&gpu->active_lock);
+
+	msm_gpu_hw_init(gpu);
+	a6xx_gpu->hung = false;
+}
+
+static const char *a6xx_uche_fault_block(struct msm_gpu *gpu, u32 mid)
+{
+	static const char *uche_clients[7] = {
+		"VFD", "SP", "VSC", "VPC", "HLSQ", "PC", "LRZ",
+	};
+	u32 val;
+
+	if (mid < 1 || mid > 3)
+		return "UNKNOWN";
+
+	/*
+	 * The source of the data depends on the mid ID read from FSYNR1.
+	 * and the client ID read from the UCHE block
+	 */
+	val = gpu_read(gpu, REG_A6XX_UCHE_CLIENT_PF);
+
+	/* mid = 3 is most precise and refers to only one block per client */
+	if (mid == 3)
+		return uche_clients[val & 7];
+
+	/* For mid=2 the source is TP or VFD except when the client id is 0 */
+	if (mid == 2)
+		return ((val & 7) == 0) ? "TP" : "TP|VFD";
+
+	/* For mid=1 just return "UCHE" as a catchall for everything else */
+	return "UCHE";
+}
+
+static const char *a6xx_fault_block(struct msm_gpu *gpu, u32 id)
+{
+	if (id == 0)
+		return "CP";
+	else if (id == 4)
+		return "CCU";
+	else if (id == 6)
+		return "CDP Prefetch";
+
+	return a6xx_uche_fault_block(gpu, id);
+}
+
+static int a6xx_fault_handler(void *arg, unsigned long iova, int flags, void *data)
+{
+	struct msm_gpu *gpu = arg;
+	struct adreno_smmu_fault_info *info = data;
+	const char *block = "unknown";
+
+	u32 scratch[] = {
+			gpu_read(gpu, REG_A6XX_CP_SCRATCH_REG(4)),
+			gpu_read(gpu, REG_A6XX_CP_SCRATCH_REG(5)),
+			gpu_read(gpu, REG_A6XX_CP_SCRATCH_REG(6)),
+			gpu_read(gpu, REG_A6XX_CP_SCRATCH_REG(7)),
+	};
+
+	if (info)
+		block = a6xx_fault_block(gpu, info->fsynr1 & 0xff);
+
+	return adreno_fault_handler(gpu, iova, flags, info, block, scratch);
+}
+
+static void a6xx_cp_hw_err_irq(struct msm_gpu *gpu)
+{
+	u32 status = gpu_read(gpu, REG_A6XX_CP_INTERRUPT_STATUS);
+
+	if (status & A6XX_CP_INT_CP_OPCODE_ERROR) {
+		u32 val;
+
+		gpu_write(gpu, REG_A6XX_CP_SQE_STAT_ADDR, 1);
+		val = gpu_read(gpu, REG_A6XX_CP_SQE_STAT_DATA);
+		dev_err_ratelimited(&gpu->pdev->dev,
+			"CP | opcode error | possible opcode=0x%8.8X\n",
+			val);
+	}
+
+	if (status & A6XX_CP_INT_CP_UCODE_ERROR)
+		dev_err_ratelimited(&gpu->pdev->dev,
+			"CP ucode error interrupt\n");
+
+	if (status & A6XX_CP_INT_CP_HW_FAULT_ERROR)
+		dev_err_ratelimited(&gpu->pdev->dev, "CP | HW fault | status=0x%8.8X\n",
+			gpu_read(gpu, REG_A6XX_CP_HW_FAULT));
+
+	if (status & A6XX_CP_INT_CP_REGISTER_PROTECTION_ERROR) {
+		u32 val = gpu_read(gpu, REG_A6XX_CP_PROTECT_STATUS);
+
+		dev_err_ratelimited(&gpu->pdev->dev,
+			"CP | protected mode error | %s | addr=0x%8.8X | status=0x%8.8X\n",
+			val & (1 << 20) ? "READ" : "WRITE",
+			(val & 0x3ffff), val);
+	}
+
+	if (status & A6XX_CP_INT_CP_AHB_ERROR && !adreno_is_a7xx(to_adreno_gpu(gpu)))
+		dev_err_ratelimited(&gpu->pdev->dev, "CP AHB error interrupt\n");
+
+	if (status & A6XX_CP_INT_CP_VSD_PARITY_ERROR)
+		dev_err_ratelimited(&gpu->pdev->dev, "CP VSD decoder parity error\n");
+
+	if (status & A6XX_CP_INT_CP_ILLEGAL_INSTR_ERROR)
+		dev_err_ratelimited(&gpu->pdev->dev, "CP illegal instruction error\n");
+
+}
+
+static void a6xx_fault_detect_irq(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct msm_ringbuffer *ring = gpu->funcs->active_ring(gpu);
+
+	/*
+	 * If stalled on SMMU fault, we could trip the GPU's hang detection,
+	 * but the fault handler will trigger the devcore dump, and we want
+	 * to otherwise resume normally rather than killing the submit, so
+	 * just bail.
+	 */
+	if (gpu_read(gpu, REG_A6XX_RBBM_STATUS3) & A6XX_RBBM_STATUS3_SMMU_STALLED_ON_FAULT)
+		return;
+
+	/*
+	 * Force the GPU to stay on until after we finish
+	 * collecting information
+	 */
+	if (!adreno_has_gmu_wrapper(adreno_gpu))
+		gmu_write(&a6xx_gpu->gmu, REG_A6XX_GMU_GMU_PWR_COL_KEEPALIVE, 1);
+
+	DRM_DEV_ERROR(&gpu->pdev->dev,
+		"gpu fault ring %d fence %x status %8.8X rb %4.4x/%4.4x ib1 %16.16llX/%4.4x ib2 %16.16llX/%4.4x\n",
+		ring ? ring->id : -1, ring ? ring->fctx->last_fence : 0,
+		gpu_read(gpu, REG_A6XX_RBBM_STATUS),
+		gpu_read(gpu, REG_A6XX_CP_RB_RPTR),
+		gpu_read(gpu, REG_A6XX_CP_RB_WPTR),
+		gpu_read64(gpu, REG_A6XX_CP_IB1_BASE),
+		gpu_read(gpu, REG_A6XX_CP_IB1_REM_SIZE),
+		gpu_read64(gpu, REG_A6XX_CP_IB2_BASE),
+		gpu_read(gpu, REG_A6XX_CP_IB2_REM_SIZE));
+
+	/* Turn off the hangcheck timer to keep it from bothering us */
+	del_timer(&gpu->hangcheck_timer);
+
+	kthread_queue_work(gpu->worker, &gpu->recover_work);
+}
+
+static irqreturn_t a6xx_irq(struct msm_gpu *gpu)
+{
+	struct msm_drm_private *priv = gpu->dev->dev_private;
+	u32 status = gpu_read(gpu, REG_A6XX_RBBM_INT_0_STATUS);
+
+	gpu_write(gpu, REG_A6XX_RBBM_INT_CLEAR_CMD, status);
+
+	if (priv->disable_err_irq)
+		status &= A6XX_RBBM_INT_0_MASK_CP_CACHE_FLUSH_TS;
+
+	if (status & A6XX_RBBM_INT_0_MASK_RBBM_HANG_DETECT)
+		a6xx_fault_detect_irq(gpu);
+
+	if (status & A6XX_RBBM_INT_0_MASK_CP_AHB_ERROR)
+		dev_err_ratelimited(&gpu->pdev->dev, "CP | AHB bus error\n");
+
+	if (status & A6XX_RBBM_INT_0_MASK_CP_HW_ERROR)
+		a6xx_cp_hw_err_irq(gpu);
+
+	if (status & A6XX_RBBM_INT_0_MASK_RBBM_ATB_ASYNCFIFO_OVERFLOW)
+		dev_err_ratelimited(&gpu->pdev->dev, "RBBM | ATB ASYNC overflow\n");
+
+	if (status & A6XX_RBBM_INT_0_MASK_RBBM_ATB_BUS_OVERFLOW)
+		dev_err_ratelimited(&gpu->pdev->dev, "RBBM | ATB bus overflow\n");
+
+	if (status & A6XX_RBBM_INT_0_MASK_UCHE_OOB_ACCESS)
+		dev_err_ratelimited(&gpu->pdev->dev, "UCHE | Out of bounds access\n");
+
+	if (status & A6XX_RBBM_INT_0_MASK_CP_CACHE_FLUSH_TS)
+		msm_gpu_retire(gpu);
+
+	return IRQ_HANDLED;
+}
+
+static void a6xx_llc_deactivate(struct a6xx_gpu *a6xx_gpu)
+{
+	llcc_slice_deactivate(a6xx_gpu->llc_slice);
+	llcc_slice_deactivate(a6xx_gpu->htw_llc_slice);
+}
+
+static void a6xx_llc_activate(struct a6xx_gpu *a6xx_gpu)
+{
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct msm_gpu *gpu = &adreno_gpu->base;
+	u32 cntl1_regval = 0;
+
+	if (IS_ERR(a6xx_gpu->llc_mmio))
+		return;
+
+	if (!llcc_slice_activate(a6xx_gpu->llc_slice)) {
+		u32 gpu_scid = llcc_get_slice_id(a6xx_gpu->llc_slice);
+
+		gpu_scid &= 0x1f;
+		cntl1_regval = (gpu_scid << 0) | (gpu_scid << 5) | (gpu_scid << 10) |
+			       (gpu_scid << 15) | (gpu_scid << 20);
+
+		/* On A660, the SCID programming for UCHE traffic is done in
+		 * A6XX_GBIF_SCACHE_CNTL0[14:10]
+		 */
+		if (adreno_is_a660_family(adreno_gpu))
+			gpu_rmw(gpu, REG_A6XX_GBIF_SCACHE_CNTL0, (0x1f << 10) |
+				(1 << 8), (gpu_scid << 10) | (1 << 8));
+	}
+
+	/*
+	 * For targets with a MMU500, activate the slice but don't program the
+	 * register.  The XBL will take care of that.
+	 */
+	if (!llcc_slice_activate(a6xx_gpu->htw_llc_slice)) {
+		if (!a6xx_gpu->have_mmu500) {
+			u32 gpuhtw_scid = llcc_get_slice_id(a6xx_gpu->htw_llc_slice);
+
+			gpuhtw_scid &= 0x1f;
+			cntl1_regval |= FIELD_PREP(GENMASK(29, 25), gpuhtw_scid);
+		}
+	}
+
+	if (!cntl1_regval)
+		return;
+
+	/*
+	 * Program the slice IDs for the various GPU blocks and GPU MMU
+	 * pagetables
+	 */
+	if (!a6xx_gpu->have_mmu500) {
+		a6xx_llc_write(a6xx_gpu,
+			REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_1, cntl1_regval);
+
+		/*
+		 * Program cacheability overrides to not allocate cache
+		 * lines on a write miss
+		 */
+		a6xx_llc_rmw(a6xx_gpu,
+			REG_A6XX_CX_MISC_SYSTEM_CACHE_CNTL_0, 0xF, 0x03);
+		return;
+	}
+
+	gpu_rmw(gpu, REG_A6XX_GBIF_SCACHE_CNTL1, GENMASK(24, 0), cntl1_regval);
+}
+
+static void a7xx_llc_activate(struct a6xx_gpu *a6xx_gpu)
+{
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+	struct msm_gpu *gpu = &adreno_gpu->base;
+
+	if (IS_ERR(a6xx_gpu->llc_mmio))
+		return;
+
+	if (!llcc_slice_activate(a6xx_gpu->llc_slice)) {
+		u32 gpu_scid = llcc_get_slice_id(a6xx_gpu->llc_slice);
+
+		gpu_scid &= GENMASK(4, 0);
+
+		gpu_write(gpu, REG_A6XX_GBIF_SCACHE_CNTL1,
+			  FIELD_PREP(GENMASK(29, 25), gpu_scid) |
+			  FIELD_PREP(GENMASK(24, 20), gpu_scid) |
+			  FIELD_PREP(GENMASK(19, 15), gpu_scid) |
+			  FIELD_PREP(GENMASK(14, 10), gpu_scid) |
+			  FIELD_PREP(GENMASK(9, 5), gpu_scid) |
+			  FIELD_PREP(GENMASK(4, 0), gpu_scid));
+
+		gpu_write(gpu, REG_A6XX_GBIF_SCACHE_CNTL0,
+			  FIELD_PREP(GENMASK(14, 10), gpu_scid) |
+			  BIT(8));
+	}
+
+	llcc_slice_activate(a6xx_gpu->htw_llc_slice);
+}
+
+static void a6xx_llc_slices_destroy(struct a6xx_gpu *a6xx_gpu)
+{
+	/* No LLCC on non-RPMh (and by extension, non-GMU) SoCs */
+	if (adreno_has_gmu_wrapper(&a6xx_gpu->base))
+		return;
+
+	llcc_slice_putd(a6xx_gpu->llc_slice);
+	llcc_slice_putd(a6xx_gpu->htw_llc_slice);
+}
+
+static void a6xx_llc_slices_init(struct platform_device *pdev,
+		struct a6xx_gpu *a6xx_gpu, bool is_a7xx)
+{
+	struct device_node *phandle;
+
+	/* No LLCC on non-RPMh (and by extension, non-GMU) SoCs */
+	if (adreno_has_gmu_wrapper(&a6xx_gpu->base))
+		return;
+
+	/*
+	 * There is a different programming path for A6xx targets with an
+	 * mmu500 attached, so detect if that is the case
+	 */
+	phandle = of_parse_phandle(pdev->dev.of_node, "iommus", 0);
+	a6xx_gpu->have_mmu500 = (phandle &&
+		of_device_is_compatible(phandle, "arm,mmu-500"));
+	of_node_put(phandle);
+
+	if (is_a7xx || !a6xx_gpu->have_mmu500)
+		a6xx_gpu->llc_mmio = msm_ioremap(pdev, "cx_mem");
+	else
+		a6xx_gpu->llc_mmio = NULL;
+
+	a6xx_gpu->llc_slice = llcc_slice_getd(LLCC_GPU);
+	a6xx_gpu->htw_llc_slice = llcc_slice_getd(LLCC_GPUHTW);
+
+	if (IS_ERR_OR_NULL(a6xx_gpu->llc_slice) && IS_ERR_OR_NULL(a6xx_gpu->htw_llc_slice))
+		a6xx_gpu->llc_mmio = ERR_PTR(-EINVAL);
+}
+
+#define GBIF_CLIENT_HALT_MASK		BIT(0)
+#define GBIF_ARB_HALT_MASK		BIT(1)
+#define VBIF_XIN_HALT_CTRL0_MASK	GENMASK(3, 0)
+#define VBIF_RESET_ACK_MASK		0xF0
+#define GPR0_GBIF_HALT_REQUEST		0x1E0
+
+void a6xx_bus_clear_pending_transactions(struct adreno_gpu *adreno_gpu, bool gx_off)
+{
+	struct msm_gpu *gpu = &adreno_gpu->base;
+
+	if (adreno_is_a619_holi(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_RBBM_GPR0_CNTL, GPR0_GBIF_HALT_REQUEST);
+		spin_until((gpu_read(gpu, REG_A6XX_RBBM_VBIF_GX_RESET_STATUS) &
+				(VBIF_RESET_ACK_MASK)) == VBIF_RESET_ACK_MASK);
+	} else if (!a6xx_has_gbif(adreno_gpu)) {
+		gpu_write(gpu, REG_A6XX_VBIF_XIN_HALT_CTRL0, VBIF_XIN_HALT_CTRL0_MASK);
+		spin_until((gpu_read(gpu, REG_A6XX_VBIF_XIN_HALT_CTRL1) &
+				(VBIF_XIN_HALT_CTRL0_MASK)) == VBIF_XIN_HALT_CTRL0_MASK);
+		gpu_write(gpu, REG_A6XX_VBIF_XIN_HALT_CTRL0, 0);
+
+		return;
+	}
+
+	if (gx_off) {
+		/* Halt the gx side of GBIF */
+		gpu_write(gpu, REG_A6XX_RBBM_GBIF_HALT, 1);
+		spin_until(gpu_read(gpu, REG_A6XX_RBBM_GBIF_HALT_ACK) & 1);
+	}
+
+	/* Halt new client requests on GBIF */
+	gpu_write(gpu, REG_A6XX_GBIF_HALT, GBIF_CLIENT_HALT_MASK);
+	spin_until((gpu_read(gpu, REG_A6XX_GBIF_HALT_ACK) &
+			(GBIF_CLIENT_HALT_MASK)) == GBIF_CLIENT_HALT_MASK);
+
+	/* Halt all AXI requests on GBIF */
+	gpu_write(gpu, REG_A6XX_GBIF_HALT, GBIF_ARB_HALT_MASK);
+	spin_until((gpu_read(gpu,  REG_A6XX_GBIF_HALT_ACK) &
+			(GBIF_ARB_HALT_MASK)) == GBIF_ARB_HALT_MASK);
+
+	/* The GBIF halt needs to be explicitly cleared */
+	gpu_write(gpu, REG_A6XX_GBIF_HALT, 0x0);
+}
+
+void a6xx_gpu_sw_reset(struct msm_gpu *gpu, bool assert)
+{
+	/* 11nm chips (e.g. ones with A610) have hw issues with the reset line! */
+	if (adreno_is_a610(to_adreno_gpu(gpu)))
+		return;
+
+	gpu_write(gpu, REG_A6XX_RBBM_SW_RESET_CMD, assert);
+	/* Perform a bogus read and add a brief delay to ensure ordering. */
+	gpu_read(gpu, REG_A6XX_RBBM_SW_RESET_CMD);
+	udelay(1);
+
+	/* The reset line needs to be asserted for at least 100 us */
+	if (assert)
+		udelay(100);
+}
+
+static int a6xx_gmu_pm_resume(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	int ret;
+
+	gpu->needs_hw_init = true;
+
+	trace_msm_gpu_resume(0);
+
+	mutex_lock(&a6xx_gpu->gmu.lock);
+	ret = a6xx_gmu_resume(a6xx_gpu);
+	mutex_unlock(&a6xx_gpu->gmu.lock);
+	if (ret)
+		return ret;
+
+	msm_devfreq_resume(gpu);
+
+	adreno_is_a7xx(adreno_gpu) ? a7xx_llc_activate(a6xx_gpu) : a6xx_llc_activate(a6xx_gpu);
+
+	return ret;
+}
+
+static int a6xx_pm_resume(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	unsigned long freq = gpu->fast_rate;
+	struct dev_pm_opp *opp;
+	int ret;
+
+	gpu->needs_hw_init = true;
+
+	trace_msm_gpu_resume(0);
+
+	mutex_lock(&a6xx_gpu->gmu.lock);
+
+	opp = dev_pm_opp_find_freq_ceil(&gpu->pdev->dev, &freq);
+	if (IS_ERR(opp)) {
+		ret = PTR_ERR(opp);
+		goto err_set_opp;
+	}
+	dev_pm_opp_put(opp);
+
+	/* Set the core clock and bus bw, having VDD scaling in mind */
+	dev_pm_opp_set_opp(&gpu->pdev->dev, opp);
+
+	pm_runtime_resume_and_get(gmu->dev);
+	pm_runtime_resume_and_get(gmu->gxpd);
+
+	ret = clk_bulk_prepare_enable(gpu->nr_clocks, gpu->grp_clks);
+	if (ret)
+		goto err_bulk_clk;
+
+	if (adreno_is_a619_holi(adreno_gpu))
+		a6xx_sptprac_enable(gmu);
+
+	/* If anything goes south, tear the GPU down piece by piece.. */
+	if (ret) {
+err_bulk_clk:
+		pm_runtime_put(gmu->gxpd);
+		pm_runtime_put(gmu->dev);
+		dev_pm_opp_set_opp(&gpu->pdev->dev, NULL);
+	}
+err_set_opp:
+	mutex_unlock(&a6xx_gpu->gmu.lock);
+
+	if (!ret)
+		msm_devfreq_resume(gpu);
+
+	return ret;
+}
+
+static int a6xx_gmu_pm_suspend(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	int i, ret;
+
+	trace_msm_gpu_suspend(0);
+
+	a6xx_llc_deactivate(a6xx_gpu);
+
+	msm_devfreq_suspend(gpu);
+
+	mutex_lock(&a6xx_gpu->gmu.lock);
+	ret = a6xx_gmu_stop(a6xx_gpu);
+	mutex_unlock(&a6xx_gpu->gmu.lock);
+	if (ret)
+		return ret;
+
+	if (a6xx_gpu->shadow_bo)
+		for (i = 0; i < gpu->nr_rings; i++)
+			a6xx_gpu->shadow[i] = 0;
+
+	gpu->suspend_count++;
+
+	return 0;
+}
+
+static int a6xx_pm_suspend(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	int i;
+
+	trace_msm_gpu_suspend(0);
+
+	msm_devfreq_suspend(gpu);
+
+	mutex_lock(&a6xx_gpu->gmu.lock);
+
+	/* Drain the outstanding traffic on memory buses */
+	a6xx_bus_clear_pending_transactions(adreno_gpu, true);
+
+	if (adreno_is_a619_holi(adreno_gpu))
+		a6xx_sptprac_disable(gmu);
+
+	clk_bulk_disable_unprepare(gpu->nr_clocks, gpu->grp_clks);
+
+	pm_runtime_put_sync(gmu->gxpd);
+	dev_pm_opp_set_opp(&gpu->pdev->dev, NULL);
+	pm_runtime_put_sync(gmu->dev);
+
+	mutex_unlock(&a6xx_gpu->gmu.lock);
+
+	if (a6xx_gpu->shadow_bo)
+		for (i = 0; i < gpu->nr_rings; i++)
+			a6xx_gpu->shadow[i] = 0;
+
+	gpu->suspend_count++;
+
+	return 0;
+}
+
+static int a6xx_gmu_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+	mutex_lock(&a6xx_gpu->gmu.lock);
+
+	/* Force the GPU power on so we can read this register */
+	a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_PERFCOUNTER_SET);
+
+	*value = gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER);
+
+	a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_PERFCOUNTER_SET);
+
+	mutex_unlock(&a6xx_gpu->gmu.lock);
+
+	return 0;
+}
+
+static int a6xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+{
+	*value = gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER);
+	return 0;
+}
+
+static struct msm_ringbuffer *a6xx_active_ring(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+	return a6xx_gpu->cur_ring;
+}
+
+static void a6xx_destroy(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+	if (a6xx_gpu->sqe_bo) {
+		msm_gem_unpin_iova(a6xx_gpu->sqe_bo, gpu->aspace);
+		drm_gem_object_put(a6xx_gpu->sqe_bo);
+	}
+
+	if (a6xx_gpu->shadow_bo) {
+		msm_gem_unpin_iova(a6xx_gpu->shadow_bo, gpu->aspace);
+		drm_gem_object_put(a6xx_gpu->shadow_bo);
+	}
+
+	a6xx_llc_slices_destroy(a6xx_gpu);
+
+	a6xx_gmu_remove(a6xx_gpu);
+
+	adreno_gpu_cleanup(adreno_gpu);
+
+	kfree(a6xx_gpu);
+}
+
+static u64 a6xx_gpu_busy(struct msm_gpu *gpu, unsigned long *out_sample_rate)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	u64 busy_cycles;
+
+	/* 19.2MHz */
+	*out_sample_rate = 19200000;
+
+	busy_cycles = gmu_read64(&a6xx_gpu->gmu,
+			REG_A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L,
+			REG_A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_H);
+
+	return busy_cycles;
+}
+
+static void a6xx_gpu_set_freq(struct msm_gpu *gpu, struct dev_pm_opp *opp,
+			      bool suspended)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+	mutex_lock(&a6xx_gpu->gmu.lock);
+	a6xx_gmu_set_freq(gpu, opp, suspended);
+	mutex_unlock(&a6xx_gpu->gmu.lock);
+}
+
+static struct msm_gem_address_space *
+a6xx_create_address_space(struct msm_gpu *gpu, struct platform_device *pdev)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	unsigned long quirks = 0;
+
+	/*
+	 * This allows GPU to set the bus attributes required to use system
+	 * cache on behalf of the iommu page table walker.
+	 */
+	if (!IS_ERR_OR_NULL(a6xx_gpu->htw_llc_slice) &&
+	    !device_iommu_capable(&pdev->dev, IOMMU_CAP_CACHE_COHERENCY))
+		quirks |= IO_PGTABLE_QUIRK_ARM_OUTER_WBWA;
+
+	return adreno_iommu_create_address_space(gpu, pdev, quirks);
+}
+
+static struct msm_gem_address_space *
+a6xx_create_private_address_space(struct msm_gpu *gpu)
+{
+	struct msm_mmu *mmu;
+
+	mmu = msm_iommu_pagetable_create(gpu->aspace->mmu);
+
+	if (IS_ERR(mmu))
+		return ERR_CAST(mmu);
+
+	return msm_gem_address_space_create(mmu,
+		"gpu", 0x100000000ULL,
+		adreno_private_address_space_size(gpu));
+}
+
+static uint32_t a6xx_get_rptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+	if (adreno_gpu->base.hw_apriv || a6xx_gpu->has_whereami)
+		return a6xx_gpu->shadow[ring->id];
+
+	return ring->memptrs->rptr = gpu_read(gpu, REG_A6XX_CP_RB_RPTR);
+}
+
+static bool a6xx_progress(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	struct msm_cp_state cp_state = {
+		.ib1_base = gpu_read64(gpu, REG_A6XX_CP_IB1_BASE),
+		.ib2_base = gpu_read64(gpu, REG_A6XX_CP_IB2_BASE),
+		.ib1_rem  = gpu_read(gpu, REG_A6XX_CP_IB1_REM_SIZE),
+		.ib2_rem  = gpu_read(gpu, REG_A6XX_CP_IB2_REM_SIZE),
+	};
+	bool progress;
+
+	/*
+	 * Adjust the remaining data to account for what has already been
+	 * fetched from memory, but not yet consumed by the SQE.
+	 *
+	 * This is not *technically* correct, the amount buffered could
+	 * exceed the IB size due to hw prefetching ahead, but:
+	 *
+	 * (1) We aren't trying to find the exact position, just whether
+	 *     progress has been made
+	 * (2) The CP_REG_TO_MEM at the end of a submit should be enough
+	 *     to prevent prefetching into an unrelated submit.  (And
+	 *     either way, at some point the ROQ will be full.)
+	 */
+	cp_state.ib1_rem += gpu_read(gpu, REG_A6XX_CP_ROQ_AVAIL_IB1) >> 16;
+	cp_state.ib2_rem += gpu_read(gpu, REG_A6XX_CP_ROQ_AVAIL_IB2) >> 16;
+
+	progress = !!memcmp(&cp_state, &ring->last_cp_state, sizeof(cp_state));
+
+	ring->last_cp_state = cp_state;
+
+	return progress;
+}
+
+static u32 fuse_to_supp_hw(const struct adreno_info *info, u32 fuse)
+{
+	if (!info->speedbins)
+		return UINT_MAX;
+
+	for (int i = 0; info->speedbins[i].fuse != SHRT_MAX; i++)
+		if (info->speedbins[i].fuse == fuse)
+			return BIT(info->speedbins[i].speedbin);
+
+	return UINT_MAX;
+}
+
+static int a6xx_set_supported_hw(struct device *dev, const struct adreno_info *info)
+{
+	u32 supp_hw;
+	u32 speedbin;
+	int ret;
+
+	ret = adreno_read_speedbin(dev, &speedbin);
+	/*
+	 * -ENOENT means that the platform doesn't support speedbin which is
+	 * fine
+	 */
+	if (ret == -ENOENT) {
+		return 0;
+	} else if (ret) {
+		dev_err_probe(dev, ret,
+			      "failed to read speed-bin. Some OPPs may not be supported by hardware\n");
+		return ret;
+	}
+
+	supp_hw = fuse_to_supp_hw(info, speedbin);
+
+	if (supp_hw == UINT_MAX) {
+		DRM_DEV_ERROR(dev,
+			"missing support for speed-bin: %u. Some OPPs may not be supported by hardware\n",
+			speedbin);
+		supp_hw = BIT(0); /* Default */
+	}
+
+	ret = devm_pm_opp_set_supported_hw(dev, &supp_hw, 1);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static const struct adreno_gpu_funcs funcs = {
+	.base = {
+		.get_param = adreno_get_param,
+		.set_param = adreno_set_param,
+		.hw_init = a6xx_hw_init,
+		.ucode_load = a6xx_ucode_load,
+		.pm_suspend = a6xx_gmu_pm_suspend,
+		.pm_resume = a6xx_gmu_pm_resume,
+		.recover = a6xx_recover,
+		.submit = a6xx_submit,
+		.active_ring = a6xx_active_ring,
+		.irq = a6xx_irq,
+		.destroy = a6xx_destroy,
+#if defined(CONFIG_DRM_MSM_GPU_STATE)
+		.show = a6xx_show,
+#endif
+		.gpu_busy = a6xx_gpu_busy,
+		.gpu_get_freq = a6xx_gmu_get_freq,
+		.gpu_set_freq = a6xx_gpu_set_freq,
+#if defined(CONFIG_DRM_MSM_GPU_STATE)
+		.gpu_state_get = a6xx_gpu_state_get,
+		.gpu_state_put = a6xx_gpu_state_put,
+#endif
+		.create_address_space = a6xx_create_address_space,
+		.create_private_address_space = a6xx_create_private_address_space,
+		.get_rptr = a6xx_get_rptr,
+		.progress = a6xx_progress,
+	},
+	.get_timestamp = a6xx_gmu_get_timestamp,
+};
+
+static const struct adreno_gpu_funcs funcs_gmuwrapper = {
+	.base = {
+		.get_param = adreno_get_param,
+		.set_param = adreno_set_param,
+		.hw_init = a6xx_hw_init,
+		.ucode_load = a6xx_ucode_load,
+		.pm_suspend = a6xx_pm_suspend,
+		.pm_resume = a6xx_pm_resume,
+		.recover = a6xx_recover,
+		.submit = a6xx_submit,
+		.active_ring = a6xx_active_ring,
+		.irq = a6xx_irq,
+		.destroy = a6xx_destroy,
+#if defined(CONFIG_DRM_MSM_GPU_STATE)
+		.show = a6xx_show,
+#endif
+		.gpu_busy = a6xx_gpu_busy,
+#if defined(CONFIG_DRM_MSM_GPU_STATE)
+		.gpu_state_get = a6xx_gpu_state_get,
+		.gpu_state_put = a6xx_gpu_state_put,
+#endif
+		.create_address_space = a6xx_create_address_space,
+		.create_private_address_space = a6xx_create_private_address_space,
+		.get_rptr = a6xx_get_rptr,
+		.progress = a6xx_progress,
+	},
+	.get_timestamp = a6xx_get_timestamp,
+};
+
+static const struct adreno_gpu_funcs funcs_a7xx = {
+	.base = {
+		.get_param = adreno_get_param,
+		.set_param = adreno_set_param,
+		.hw_init = a6xx_hw_init,
+		.ucode_load = a6xx_ucode_load,
+		.pm_suspend = a6xx_gmu_pm_suspend,
+		.pm_resume = a6xx_gmu_pm_resume,
+		.recover = a6xx_recover,
+		.submit = a7xx_submit,
+		.active_ring = a6xx_active_ring,
+		.irq = a6xx_irq,
+		.destroy = a6xx_destroy,
+#if defined(CONFIG_DRM_MSM_GPU_STATE)
+		.show = a6xx_show,
+#endif
+		.gpu_busy = a6xx_gpu_busy,
+		.gpu_get_freq = a6xx_gmu_get_freq,
+		.gpu_set_freq = a6xx_gpu_set_freq,
+#if defined(CONFIG_DRM_MSM_GPU_STATE)
+		.gpu_state_get = a6xx_gpu_state_get,
+		.gpu_state_put = a6xx_gpu_state_put,
+#endif
+		.create_address_space = a6xx_create_address_space,
+		.create_private_address_space = a6xx_create_private_address_space,
+		.get_rptr = a6xx_get_rptr,
+		.progress = a6xx_progress,
+	},
+	.get_timestamp = a6xx_gmu_get_timestamp,
+};
+
+struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct platform_device *pdev = priv->gpu_pdev;
+	struct adreno_platform_config *config = pdev->dev.platform_data;
+	struct device_node *node;
+	struct a6xx_gpu *a6xx_gpu;
+	struct adreno_gpu *adreno_gpu;
+	struct msm_gpu *gpu;
+	bool is_a7xx;
+	int ret;
+
+	a6xx_gpu = kzalloc(sizeof(*a6xx_gpu), GFP_KERNEL);
+	if (!a6xx_gpu)
+		return ERR_PTR(-ENOMEM);
+
+	adreno_gpu = &a6xx_gpu->base;
+	gpu = &adreno_gpu->base;
+
+	mutex_init(&a6xx_gpu->gmu.lock);
+
+	adreno_gpu->registers = NULL;
+
+	/* Check if there is a GMU phandle and set it up */
+	node = of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
+	/* FIXME: How do we gracefully handle this? */
+	BUG_ON(!node);
+
+	adreno_gpu->gmu_is_wrapper = of_device_is_compatible(node, "qcom,adreno-gmu-wrapper");
+
+	adreno_gpu->base.hw_apriv =
+		!!(config->info->quirks & ADRENO_QUIRK_HAS_HW_APRIV);
+
+	/* gpu->info only gets assigned in adreno_gpu_init() */
+	is_a7xx = config->info->family == ADRENO_7XX_GEN1 ||
+		  config->info->family == ADRENO_7XX_GEN2 ||
+		  config->info->family == ADRENO_7XX_GEN3;
+
+	a6xx_llc_slices_init(pdev, a6xx_gpu, is_a7xx);
+
+	ret = a6xx_set_supported_hw(&pdev->dev, config->info);
+	if (ret) {
+		a6xx_llc_slices_destroy(a6xx_gpu);
+		kfree(a6xx_gpu);
+		return ERR_PTR(ret);
+	}
+
+	if (is_a7xx)
+		ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs_a7xx, 1);
+	else if (adreno_has_gmu_wrapper(adreno_gpu))
+		ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs_gmuwrapper, 1);
+	else
+		ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
+	if (ret) {
+		a6xx_destroy(&(a6xx_gpu->base.base));
+		return ERR_PTR(ret);
+	}
+
+	/*
+	 * For now only clamp to idle freq for devices where this is known not
+	 * to cause power supply issues:
+	 */
+	if (adreno_is_a618(adreno_gpu) || adreno_is_7c3(adreno_gpu))
+		priv->gpu_clamp_to_idle = true;
+
+	if (adreno_has_gmu_wrapper(adreno_gpu))
+		ret = a6xx_gmu_wrapper_init(a6xx_gpu, node);
+	else
+		ret = a6xx_gmu_init(a6xx_gpu, node);
+	of_node_put(node);
+	if (ret) {
+		a6xx_destroy(&(a6xx_gpu->base.base));
+		return ERR_PTR(ret);
+	}
+
+	if (gpu->aspace)
+		msm_mmu_set_fault_handler(gpu->aspace->mmu, gpu,
+				a6xx_fault_handler);
+
+	a6xx_calc_ubwc_config(adreno_gpu);
+
+	return gpu;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a6xx_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a6xx_gpu.h
@@ -0,0 +1,124 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (c) 2017, 2019 The Linux Foundation. All rights reserved. */
+
+#ifndef __A6XX_GPU_H__
+#define __A6XX_GPU_H__
+
+
+#include "adreno_gpu.h"
+#include "a6xx.xml.h"
+
+#include "a6xx_gmu.h"
+
+extern bool hang_debug;
+
+/**
+ * struct a6xx_info - a6xx specific information from device table
+ *
+ * @hwcg: hw clock gating register sequence
+ * @protect: CP_PROTECT settings
+ */
+struct a6xx_info {
+	const struct adreno_reglist *hwcg;
+	const struct adreno_protect *protect;
+	u32 gmu_chipid;
+	u32 gmu_cgc_mode;
+	u32 prim_fifo_threshold;
+};
+
+struct a6xx_gpu {
+	struct adreno_gpu base;
+
+	struct drm_gem_object *sqe_bo;
+	uint64_t sqe_iova;
+
+	struct msm_ringbuffer *cur_ring;
+
+	struct a6xx_gmu gmu;
+
+	struct drm_gem_object *shadow_bo;
+	uint64_t shadow_iova;
+	uint32_t *shadow;
+
+	bool has_whereami;
+
+	void __iomem *llc_mmio;
+	void *llc_slice;
+	void *htw_llc_slice;
+	bool have_mmu500;
+	bool hung;
+};
+
+#define to_a6xx_gpu(x) container_of(x, struct a6xx_gpu, base)
+
+/*
+ * Given a register and a count, return a value to program into
+ * REG_CP_PROTECT_REG(n) - this will block both reads and writes for
+ * _len + 1 registers starting at _reg.
+ */
+#define A6XX_PROTECT_NORDWR(_reg, _len) \
+	((1 << 31) | \
+	(((_len) & 0x3FFF) << 18) | ((_reg) & 0x3FFFF))
+
+/*
+ * Same as above, but allow reads over the range. For areas of mixed use (such
+ * as performance counters) this allows us to protect a much larger range with a
+ * single register
+ */
+#define A6XX_PROTECT_RDONLY(_reg, _len) \
+	((((_len) & 0x3FFF) << 18) | ((_reg) & 0x3FFFF))
+
+static inline bool a6xx_has_gbif(struct adreno_gpu *gpu)
+{
+	if(adreno_is_a630(gpu))
+		return false;
+
+	return true;
+}
+
+static inline void a6xx_llc_rmw(struct a6xx_gpu *a6xx_gpu, u32 reg, u32 mask, u32 or)
+{
+	return msm_rmw(a6xx_gpu->llc_mmio + (reg << 2), mask, or);
+}
+
+static inline u32 a6xx_llc_read(struct a6xx_gpu *a6xx_gpu, u32 reg)
+{
+	return msm_readl(a6xx_gpu->llc_mmio + (reg << 2));
+}
+
+static inline void a6xx_llc_write(struct a6xx_gpu *a6xx_gpu, u32 reg, u32 value)
+{
+	msm_writel(value, a6xx_gpu->llc_mmio + (reg << 2));
+}
+
+#define shadowptr(_a6xx_gpu, _ring) ((_a6xx_gpu)->shadow_iova + \
+		((_ring)->id * sizeof(uint32_t)))
+
+int a6xx_gmu_resume(struct a6xx_gpu *gpu);
+int a6xx_gmu_stop(struct a6xx_gpu *gpu);
+
+int a6xx_gmu_wait_for_idle(struct a6xx_gmu *gmu);
+
+bool a6xx_gmu_isidle(struct a6xx_gmu *gmu);
+
+int a6xx_gmu_set_oob(struct a6xx_gmu *gmu, enum a6xx_gmu_oob_state state);
+void a6xx_gmu_clear_oob(struct a6xx_gmu *gmu, enum a6xx_gmu_oob_state state);
+
+int a6xx_gmu_init(struct a6xx_gpu *a6xx_gpu, struct device_node *node);
+int a6xx_gmu_wrapper_init(struct a6xx_gpu *a6xx_gpu, struct device_node *node);
+void a6xx_gmu_remove(struct a6xx_gpu *a6xx_gpu);
+
+void a6xx_gmu_set_freq(struct msm_gpu *gpu, struct dev_pm_opp *opp,
+		       bool suspended);
+unsigned long a6xx_gmu_get_freq(struct msm_gpu *gpu);
+
+void a6xx_show(struct msm_gpu *gpu, struct msm_gpu_state *state,
+		struct drm_printer *p);
+
+struct msm_gpu_state *a6xx_gpu_state_get(struct msm_gpu *gpu);
+int a6xx_gpu_state_put(struct msm_gpu_state *state);
+
+void a6xx_bus_clear_pending_transactions(struct adreno_gpu *adreno_gpu, bool gx_off);
+void a6xx_gpu_sw_reset(struct msm_gpu *gpu, bool assert);
+
+#endif /* __A6XX_GPU_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a6xx_gpu_state.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a6xx_gpu_state.c
@@ -0,0 +1,1460 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. */
+
+#include <linux/ascii85.h>
+#include "msm_gem.h"
+#include "a6xx_gpu.h"
+#include "a6xx_gmu.h"
+#include "a6xx_gpu_state.h"
+#include "a6xx_gmu.xml.h"
+
+struct a6xx_gpu_state_obj {
+	const void *handle;
+	u32 *data;
+};
+
+struct a6xx_gpu_state {
+	struct msm_gpu_state base;
+
+	struct a6xx_gpu_state_obj *gmu_registers;
+	int nr_gmu_registers;
+
+	struct a6xx_gpu_state_obj *registers;
+	int nr_registers;
+
+	struct a6xx_gpu_state_obj *shaders;
+	int nr_shaders;
+
+	struct a6xx_gpu_state_obj *clusters;
+	int nr_clusters;
+
+	struct a6xx_gpu_state_obj *dbgahb_clusters;
+	int nr_dbgahb_clusters;
+
+	struct a6xx_gpu_state_obj *indexed_regs;
+	int nr_indexed_regs;
+
+	struct a6xx_gpu_state_obj *debugbus;
+	int nr_debugbus;
+
+	struct a6xx_gpu_state_obj *vbif_debugbus;
+
+	struct a6xx_gpu_state_obj *cx_debugbus;
+	int nr_cx_debugbus;
+
+	struct msm_gpu_state_bo *gmu_log;
+	struct msm_gpu_state_bo *gmu_hfi;
+	struct msm_gpu_state_bo *gmu_debug;
+
+	s32 hfi_queue_history[2][HFI_HISTORY_SZ];
+
+	struct list_head objs;
+
+	bool gpu_initialized;
+};
+
+static inline int CRASHDUMP_WRITE(u64 *in, u32 reg, u32 val)
+{
+	in[0] = val;
+	in[1] = (((u64) reg) << 44 | (1 << 21) | 1);
+
+	return 2;
+}
+
+static inline int CRASHDUMP_READ(u64 *in, u32 reg, u32 dwords, u64 target)
+{
+	in[0] = target;
+	in[1] = (((u64) reg) << 44 | dwords);
+
+	return 2;
+}
+
+static inline int CRASHDUMP_FINI(u64 *in)
+{
+	in[0] = 0;
+	in[1] = 0;
+
+	return 2;
+}
+
+struct a6xx_crashdumper {
+	void *ptr;
+	struct drm_gem_object *bo;
+	u64 iova;
+};
+
+struct a6xx_state_memobj {
+	struct list_head node;
+	unsigned long long data[];
+};
+
+static void *state_kcalloc(struct a6xx_gpu_state *a6xx_state, int nr, size_t objsize)
+{
+	struct a6xx_state_memobj *obj =
+		kvzalloc((nr * objsize) + sizeof(*obj), GFP_KERNEL);
+
+	if (!obj)
+		return NULL;
+
+	list_add_tail(&obj->node, &a6xx_state->objs);
+	return &obj->data;
+}
+
+static void *state_kmemdup(struct a6xx_gpu_state *a6xx_state, void *src,
+		size_t size)
+{
+	void *dst = state_kcalloc(a6xx_state, 1, size);
+
+	if (dst)
+		memcpy(dst, src, size);
+	return dst;
+}
+
+/*
+ * Allocate 1MB for the crashdumper scratch region - 8k for the script and
+ * the rest for the data
+ */
+#define A6XX_CD_DATA_OFFSET 8192
+#define A6XX_CD_DATA_SIZE  (SZ_1M - 8192)
+
+static int a6xx_crashdumper_init(struct msm_gpu *gpu,
+		struct a6xx_crashdumper *dumper)
+{
+	dumper->ptr = msm_gem_kernel_new(gpu->dev,
+		SZ_1M, MSM_BO_WC, gpu->aspace,
+		&dumper->bo, &dumper->iova);
+
+	if (!IS_ERR(dumper->ptr))
+		msm_gem_object_set_name(dumper->bo, "crashdump");
+
+	return PTR_ERR_OR_ZERO(dumper->ptr);
+}
+
+static int a6xx_crashdumper_run(struct msm_gpu *gpu,
+		struct a6xx_crashdumper *dumper)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	u32 val;
+	int ret;
+
+	if (IS_ERR_OR_NULL(dumper->ptr))
+		return -EINVAL;
+
+	if (!a6xx_gmu_sptprac_is_on(&a6xx_gpu->gmu))
+		return -EINVAL;
+
+	/* Make sure all pending memory writes are posted */
+	wmb();
+
+	gpu_write64(gpu, REG_A6XX_CP_CRASH_SCRIPT_BASE, dumper->iova);
+
+	gpu_write(gpu, REG_A6XX_CP_CRASH_DUMP_CNTL, 1);
+
+	ret = gpu_poll_timeout(gpu, REG_A6XX_CP_CRASH_DUMP_STATUS, val,
+		val & 0x02, 100, 10000);
+
+	gpu_write(gpu, REG_A6XX_CP_CRASH_DUMP_CNTL, 0);
+
+	return ret;
+}
+
+/* read a value from the GX debug bus */
+static int debugbus_read(struct msm_gpu *gpu, u32 block, u32 offset,
+		u32 *data)
+{
+	u32 reg = A6XX_DBGC_CFG_DBGBUS_SEL_D_PING_INDEX(offset) |
+		A6XX_DBGC_CFG_DBGBUS_SEL_D_PING_BLK_SEL(block);
+
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_SEL_A, reg);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_SEL_B, reg);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_SEL_C, reg);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_SEL_D, reg);
+
+	/* Wait 1 us to make sure the data is flowing */
+	udelay(1);
+
+	data[0] = gpu_read(gpu, REG_A6XX_DBGC_CFG_DBGBUS_TRACE_BUF2);
+	data[1] = gpu_read(gpu, REG_A6XX_DBGC_CFG_DBGBUS_TRACE_BUF1);
+
+	return 2;
+}
+
+#define cxdbg_write(ptr, offset, val) \
+	msm_writel((val), (ptr) + ((offset) << 2))
+
+#define cxdbg_read(ptr, offset) \
+	msm_readl((ptr) + ((offset) << 2))
+
+/* read a value from the CX debug bus */
+static int cx_debugbus_read(void __iomem *cxdbg, u32 block, u32 offset,
+		u32 *data)
+{
+	u32 reg = A6XX_CX_DBGC_CFG_DBGBUS_SEL_A_PING_INDEX(offset) |
+		A6XX_CX_DBGC_CFG_DBGBUS_SEL_A_PING_BLK_SEL(block);
+
+	cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_SEL_A, reg);
+	cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_SEL_B, reg);
+	cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_SEL_C, reg);
+	cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_SEL_D, reg);
+
+	/* Wait 1 us to make sure the data is flowing */
+	udelay(1);
+
+	data[0] = cxdbg_read(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_TRACE_BUF2);
+	data[1] = cxdbg_read(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_TRACE_BUF1);
+
+	return 2;
+}
+
+/* Read a chunk of data from the VBIF debug bus */
+static int vbif_debugbus_read(struct msm_gpu *gpu, u32 ctrl0, u32 ctrl1,
+		u32 reg, int count, u32 *data)
+{
+	int i;
+
+	gpu_write(gpu, ctrl0, reg);
+
+	for (i = 0; i < count; i++) {
+		gpu_write(gpu, ctrl1, i);
+		data[i] = gpu_read(gpu, REG_A6XX_VBIF_TEST_BUS_OUT);
+	}
+
+	return count;
+}
+
+#define AXI_ARB_BLOCKS 2
+#define XIN_AXI_BLOCKS 5
+#define XIN_CORE_BLOCKS 4
+
+#define VBIF_DEBUGBUS_BLOCK_SIZE \
+	((16 * AXI_ARB_BLOCKS) + \
+	 (18 * XIN_AXI_BLOCKS) + \
+	 (12 * XIN_CORE_BLOCKS))
+
+static void a6xx_get_vbif_debugbus_block(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		struct a6xx_gpu_state_obj *obj)
+{
+	u32 clk, *ptr;
+	int i;
+
+	obj->data = state_kcalloc(a6xx_state, VBIF_DEBUGBUS_BLOCK_SIZE,
+		sizeof(u32));
+	if (!obj->data)
+		return;
+
+	obj->handle = NULL;
+
+	/* Get the current clock setting */
+	clk = gpu_read(gpu, REG_A6XX_VBIF_CLKON);
+
+	/* Force on the bus so we can read it */
+	gpu_write(gpu, REG_A6XX_VBIF_CLKON,
+		clk | A6XX_VBIF_CLKON_FORCE_ON_TESTBUS);
+
+	/* We will read from BUS2 first, so disable BUS1 */
+	gpu_write(gpu, REG_A6XX_VBIF_TEST_BUS1_CTRL0, 0);
+
+	/* Enable the VBIF bus for reading */
+	gpu_write(gpu, REG_A6XX_VBIF_TEST_BUS_OUT_CTRL, 1);
+
+	ptr = obj->data;
+
+	for (i = 0; i < AXI_ARB_BLOCKS; i++)
+		ptr += vbif_debugbus_read(gpu,
+			REG_A6XX_VBIF_TEST_BUS2_CTRL0,
+			REG_A6XX_VBIF_TEST_BUS2_CTRL1,
+			1 << (i + 16), 16, ptr);
+
+	for (i = 0; i < XIN_AXI_BLOCKS; i++)
+		ptr += vbif_debugbus_read(gpu,
+			REG_A6XX_VBIF_TEST_BUS2_CTRL0,
+			REG_A6XX_VBIF_TEST_BUS2_CTRL1,
+			1 << i, 18, ptr);
+
+	/* Stop BUS2 so we can turn on BUS1 */
+	gpu_write(gpu, REG_A6XX_VBIF_TEST_BUS2_CTRL0, 0);
+
+	for (i = 0; i < XIN_CORE_BLOCKS; i++)
+		ptr += vbif_debugbus_read(gpu,
+			REG_A6XX_VBIF_TEST_BUS1_CTRL0,
+			REG_A6XX_VBIF_TEST_BUS1_CTRL1,
+			1 << i, 12, ptr);
+
+	/* Restore the VBIF clock setting */
+	gpu_write(gpu, REG_A6XX_VBIF_CLKON, clk);
+}
+
+static void a6xx_get_debugbus_block(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		const struct a6xx_debugbus_block *block,
+		struct a6xx_gpu_state_obj *obj)
+{
+	int i;
+	u32 *ptr;
+
+	obj->data = state_kcalloc(a6xx_state, block->count, sizeof(u64));
+	if (!obj->data)
+		return;
+
+	obj->handle = block;
+
+	for (ptr = obj->data, i = 0; i < block->count; i++)
+		ptr += debugbus_read(gpu, block->id, i, ptr);
+}
+
+static void a6xx_get_cx_debugbus_block(void __iomem *cxdbg,
+		struct a6xx_gpu_state *a6xx_state,
+		const struct a6xx_debugbus_block *block,
+		struct a6xx_gpu_state_obj *obj)
+{
+	int i;
+	u32 *ptr;
+
+	obj->data = state_kcalloc(a6xx_state, block->count, sizeof(u64));
+	if (!obj->data)
+		return;
+
+	obj->handle = block;
+
+	for (ptr = obj->data, i = 0; i < block->count; i++)
+		ptr += cx_debugbus_read(cxdbg, block->id, i, ptr);
+}
+
+static void a6xx_get_debugbus(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state)
+{
+	struct resource *res;
+	void __iomem *cxdbg = NULL;
+	int nr_debugbus_blocks;
+
+	/* Set up the GX debug bus */
+
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_CNTLT,
+		A6XX_DBGC_CFG_DBGBUS_CNTLT_SEGT(0xf));
+
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_CNTLM,
+		A6XX_DBGC_CFG_DBGBUS_CNTLM_ENABLE(0xf));
+
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_0, 0);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_1, 0);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_2, 0);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_3, 0);
+
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_BYTEL_0, 0x76543210);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_BYTEL_1, 0xFEDCBA98);
+
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_0, 0);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_1, 0);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_2, 0);
+	gpu_write(gpu, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_3, 0);
+
+	/* Set up the CX debug bus - it lives elsewhere in the system so do a
+	 * temporary ioremap for the registers
+	 */
+	res = platform_get_resource_byname(gpu->pdev, IORESOURCE_MEM,
+			"cx_dbgc");
+
+	if (res)
+		cxdbg = ioremap(res->start, resource_size(res));
+
+	if (cxdbg) {
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_CNTLT,
+			A6XX_DBGC_CFG_DBGBUS_CNTLT_SEGT(0xf));
+
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_CNTLM,
+			A6XX_DBGC_CFG_DBGBUS_CNTLM_ENABLE(0xf));
+
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_0, 0);
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_1, 0);
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_2, 0);
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_3, 0);
+
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_0,
+			0x76543210);
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_1,
+			0xFEDCBA98);
+
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_0, 0);
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_1, 0);
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_2, 0);
+		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_3, 0);
+	}
+
+	nr_debugbus_blocks = ARRAY_SIZE(a6xx_debugbus_blocks) +
+		(a6xx_has_gbif(to_adreno_gpu(gpu)) ? 1 : 0);
+
+	if (adreno_is_a650_family(to_adreno_gpu(gpu)))
+		nr_debugbus_blocks += ARRAY_SIZE(a650_debugbus_blocks);
+
+	a6xx_state->debugbus = state_kcalloc(a6xx_state, nr_debugbus_blocks,
+			sizeof(*a6xx_state->debugbus));
+
+	if (a6xx_state->debugbus) {
+		int i;
+
+		for (i = 0; i < ARRAY_SIZE(a6xx_debugbus_blocks); i++)
+			a6xx_get_debugbus_block(gpu,
+				a6xx_state,
+				&a6xx_debugbus_blocks[i],
+				&a6xx_state->debugbus[i]);
+
+		a6xx_state->nr_debugbus = ARRAY_SIZE(a6xx_debugbus_blocks);
+
+		/*
+		 * GBIF has same debugbus as of other GPU blocks, fall back to
+		 * default path if GPU uses GBIF, also GBIF uses exactly same
+		 * ID as of VBIF.
+		 */
+		if (a6xx_has_gbif(to_adreno_gpu(gpu))) {
+			a6xx_get_debugbus_block(gpu, a6xx_state,
+				&a6xx_gbif_debugbus_block,
+				&a6xx_state->debugbus[i]);
+
+			a6xx_state->nr_debugbus += 1;
+		}
+
+
+		if (adreno_is_a650_family(to_adreno_gpu(gpu))) {
+			for (i = 0; i < ARRAY_SIZE(a650_debugbus_blocks); i++)
+				a6xx_get_debugbus_block(gpu,
+					a6xx_state,
+					&a650_debugbus_blocks[i],
+					&a6xx_state->debugbus[i]);
+		}
+	}
+
+	/*  Dump the VBIF debugbus on applicable targets */
+	if (!a6xx_has_gbif(to_adreno_gpu(gpu))) {
+		a6xx_state->vbif_debugbus =
+			state_kcalloc(a6xx_state, 1,
+					sizeof(*a6xx_state->vbif_debugbus));
+
+		if (a6xx_state->vbif_debugbus)
+			a6xx_get_vbif_debugbus_block(gpu, a6xx_state,
+					a6xx_state->vbif_debugbus);
+	}
+
+	if (cxdbg) {
+		a6xx_state->cx_debugbus =
+			state_kcalloc(a6xx_state,
+			ARRAY_SIZE(a6xx_cx_debugbus_blocks),
+			sizeof(*a6xx_state->cx_debugbus));
+
+		if (a6xx_state->cx_debugbus) {
+			int i;
+
+			for (i = 0; i < ARRAY_SIZE(a6xx_cx_debugbus_blocks); i++)
+				a6xx_get_cx_debugbus_block(cxdbg,
+					a6xx_state,
+					&a6xx_cx_debugbus_blocks[i],
+					&a6xx_state->cx_debugbus[i]);
+
+			a6xx_state->nr_cx_debugbus =
+				ARRAY_SIZE(a6xx_cx_debugbus_blocks);
+		}
+
+		iounmap(cxdbg);
+	}
+}
+
+#define RANGE(reg, a) ((reg)[(a) + 1] - (reg)[(a)] + 1)
+
+/* Read a data cluster from behind the AHB aperture */
+static void a6xx_get_dbgahb_cluster(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		const struct a6xx_dbgahb_cluster *dbgahb,
+		struct a6xx_gpu_state_obj *obj,
+		struct a6xx_crashdumper *dumper)
+{
+	u64 *in = dumper->ptr;
+	u64 out = dumper->iova + A6XX_CD_DATA_OFFSET;
+	size_t datasize;
+	int i, regcount = 0;
+
+	for (i = 0; i < A6XX_NUM_CONTEXTS; i++) {
+		int j;
+
+		in += CRASHDUMP_WRITE(in, REG_A6XX_HLSQ_DBG_READ_SEL,
+			(dbgahb->statetype + i * 2) << 8);
+
+		for (j = 0; j < dbgahb->count; j += 2) {
+			int count = RANGE(dbgahb->registers, j);
+			u32 offset = REG_A6XX_HLSQ_DBG_AHB_READ_APERTURE +
+				dbgahb->registers[j] - (dbgahb->base >> 2);
+
+			in += CRASHDUMP_READ(in, offset, count, out);
+
+			out += count * sizeof(u32);
+
+			if (i == 0)
+				regcount += count;
+		}
+	}
+
+	CRASHDUMP_FINI(in);
+
+	datasize = regcount * A6XX_NUM_CONTEXTS * sizeof(u32);
+
+	if (WARN_ON(datasize > A6XX_CD_DATA_SIZE))
+		return;
+
+	if (a6xx_crashdumper_run(gpu, dumper))
+		return;
+
+	obj->handle = dbgahb;
+	obj->data = state_kmemdup(a6xx_state, dumper->ptr + A6XX_CD_DATA_OFFSET,
+		datasize);
+}
+
+static void a6xx_get_dbgahb_clusters(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		struct a6xx_crashdumper *dumper)
+{
+	int i;
+
+	a6xx_state->dbgahb_clusters = state_kcalloc(a6xx_state,
+		ARRAY_SIZE(a6xx_dbgahb_clusters),
+		sizeof(*a6xx_state->dbgahb_clusters));
+
+	if (!a6xx_state->dbgahb_clusters)
+		return;
+
+	a6xx_state->nr_dbgahb_clusters = ARRAY_SIZE(a6xx_dbgahb_clusters);
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_dbgahb_clusters); i++)
+		a6xx_get_dbgahb_cluster(gpu, a6xx_state,
+			&a6xx_dbgahb_clusters[i],
+			&a6xx_state->dbgahb_clusters[i], dumper);
+}
+
+/* Read a data cluster from the CP aperture with the crashdumper */
+static void a6xx_get_cluster(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		const struct a6xx_cluster *cluster,
+		struct a6xx_gpu_state_obj *obj,
+		struct a6xx_crashdumper *dumper)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	u64 *in = dumper->ptr;
+	u64 out = dumper->iova + A6XX_CD_DATA_OFFSET;
+	size_t datasize;
+	int i, regcount = 0;
+	u32 id = cluster->id;
+
+	/* Skip registers that are not present on older generation */
+	if (!adreno_is_a660_family(adreno_gpu) &&
+			cluster->registers == a660_fe_cluster)
+		return;
+
+	if (adreno_is_a650_family(adreno_gpu) &&
+			cluster->registers == a6xx_ps_cluster)
+		id = CLUSTER_VPC_PS;
+
+	/* Some clusters need a selector register to be programmed too */
+	if (cluster->sel_reg)
+		in += CRASHDUMP_WRITE(in, cluster->sel_reg, cluster->sel_val);
+
+	for (i = 0; i < A6XX_NUM_CONTEXTS; i++) {
+		int j;
+
+		in += CRASHDUMP_WRITE(in, REG_A6XX_CP_APERTURE_CNTL_CD,
+			(id << 8) | (i << 4) | i);
+
+		for (j = 0; j < cluster->count; j += 2) {
+			int count = RANGE(cluster->registers, j);
+
+			in += CRASHDUMP_READ(in, cluster->registers[j],
+				count, out);
+
+			out += count * sizeof(u32);
+
+			if (i == 0)
+				regcount += count;
+		}
+	}
+
+	CRASHDUMP_FINI(in);
+
+	datasize = regcount * A6XX_NUM_CONTEXTS * sizeof(u32);
+
+	if (WARN_ON(datasize > A6XX_CD_DATA_SIZE))
+		return;
+
+	if (a6xx_crashdumper_run(gpu, dumper))
+		return;
+
+	obj->handle = cluster;
+	obj->data = state_kmemdup(a6xx_state, dumper->ptr + A6XX_CD_DATA_OFFSET,
+		datasize);
+}
+
+static void a6xx_get_clusters(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		struct a6xx_crashdumper *dumper)
+{
+	int i;
+
+	a6xx_state->clusters = state_kcalloc(a6xx_state,
+		ARRAY_SIZE(a6xx_clusters), sizeof(*a6xx_state->clusters));
+
+	if (!a6xx_state->clusters)
+		return;
+
+	a6xx_state->nr_clusters = ARRAY_SIZE(a6xx_clusters);
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_clusters); i++)
+		a6xx_get_cluster(gpu, a6xx_state, &a6xx_clusters[i],
+			&a6xx_state->clusters[i], dumper);
+}
+
+/* Read a shader / debug block from the HLSQ aperture with the crashdumper */
+static void a6xx_get_shader_block(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		const struct a6xx_shader_block *block,
+		struct a6xx_gpu_state_obj *obj,
+		struct a6xx_crashdumper *dumper)
+{
+	u64 *in = dumper->ptr;
+	size_t datasize = block->size * A6XX_NUM_SHADER_BANKS * sizeof(u32);
+	int i;
+
+	if (WARN_ON(datasize > A6XX_CD_DATA_SIZE))
+		return;
+
+	for (i = 0; i < A6XX_NUM_SHADER_BANKS; i++) {
+		in += CRASHDUMP_WRITE(in, REG_A6XX_HLSQ_DBG_READ_SEL,
+			(block->type << 8) | i);
+
+		in += CRASHDUMP_READ(in, REG_A6XX_HLSQ_DBG_AHB_READ_APERTURE,
+			block->size, dumper->iova + A6XX_CD_DATA_OFFSET);
+	}
+
+	CRASHDUMP_FINI(in);
+
+	if (a6xx_crashdumper_run(gpu, dumper))
+		return;
+
+	obj->handle = block;
+	obj->data = state_kmemdup(a6xx_state, dumper->ptr + A6XX_CD_DATA_OFFSET,
+		datasize);
+}
+
+static void a6xx_get_shaders(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		struct a6xx_crashdumper *dumper)
+{
+	int i;
+
+	a6xx_state->shaders = state_kcalloc(a6xx_state,
+		ARRAY_SIZE(a6xx_shader_blocks), sizeof(*a6xx_state->shaders));
+
+	if (!a6xx_state->shaders)
+		return;
+
+	a6xx_state->nr_shaders = ARRAY_SIZE(a6xx_shader_blocks);
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_shader_blocks); i++)
+		a6xx_get_shader_block(gpu, a6xx_state, &a6xx_shader_blocks[i],
+			&a6xx_state->shaders[i], dumper);
+}
+
+/* Read registers from behind the HLSQ aperture with the crashdumper */
+static void a6xx_get_crashdumper_hlsq_registers(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		const struct a6xx_registers *regs,
+		struct a6xx_gpu_state_obj *obj,
+		struct a6xx_crashdumper *dumper)
+
+{
+	u64 *in = dumper->ptr;
+	u64 out = dumper->iova + A6XX_CD_DATA_OFFSET;
+	int i, regcount = 0;
+
+	in += CRASHDUMP_WRITE(in, REG_A6XX_HLSQ_DBG_READ_SEL, regs->val1);
+
+	for (i = 0; i < regs->count; i += 2) {
+		u32 count = RANGE(regs->registers, i);
+		u32 offset = REG_A6XX_HLSQ_DBG_AHB_READ_APERTURE +
+			regs->registers[i] - (regs->val0 >> 2);
+
+		in += CRASHDUMP_READ(in, offset, count, out);
+
+		out += count * sizeof(u32);
+		regcount += count;
+	}
+
+	CRASHDUMP_FINI(in);
+
+	if (WARN_ON((regcount * sizeof(u32)) > A6XX_CD_DATA_SIZE))
+		return;
+
+	if (a6xx_crashdumper_run(gpu, dumper))
+		return;
+
+	obj->handle = regs;
+	obj->data = state_kmemdup(a6xx_state, dumper->ptr + A6XX_CD_DATA_OFFSET,
+		regcount * sizeof(u32));
+}
+
+/* Read a block of registers using the crashdumper */
+static void a6xx_get_crashdumper_registers(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		const struct a6xx_registers *regs,
+		struct a6xx_gpu_state_obj *obj,
+		struct a6xx_crashdumper *dumper)
+
+{
+	u64 *in = dumper->ptr;
+	u64 out = dumper->iova + A6XX_CD_DATA_OFFSET;
+	int i, regcount = 0;
+
+	/* Skip unsupported registers on older generations */
+	if (!adreno_is_a660_family(to_adreno_gpu(gpu)) &&
+			(regs->registers == a660_registers))
+		return;
+
+	/* Some blocks might need to program a selector register first */
+	if (regs->val0)
+		in += CRASHDUMP_WRITE(in, regs->val0, regs->val1);
+
+	for (i = 0; i < regs->count; i += 2) {
+		u32 count = RANGE(regs->registers, i);
+
+		in += CRASHDUMP_READ(in, regs->registers[i], count, out);
+
+		out += count * sizeof(u32);
+		regcount += count;
+	}
+
+	CRASHDUMP_FINI(in);
+
+	if (WARN_ON((regcount * sizeof(u32)) > A6XX_CD_DATA_SIZE))
+		return;
+
+	if (a6xx_crashdumper_run(gpu, dumper))
+		return;
+
+	obj->handle = regs;
+	obj->data = state_kmemdup(a6xx_state, dumper->ptr + A6XX_CD_DATA_OFFSET,
+		regcount * sizeof(u32));
+}
+
+/* Read a block of registers via AHB */
+static void a6xx_get_ahb_gpu_registers(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		const struct a6xx_registers *regs,
+		struct a6xx_gpu_state_obj *obj)
+{
+	int i, regcount = 0, index = 0;
+
+	/* Skip unsupported registers on older generations */
+	if (!adreno_is_a660_family(to_adreno_gpu(gpu)) &&
+			(regs->registers == a660_registers))
+		return;
+
+	for (i = 0; i < regs->count; i += 2)
+		regcount += RANGE(regs->registers, i);
+
+	obj->handle = (const void *) regs;
+	obj->data = state_kcalloc(a6xx_state, regcount, sizeof(u32));
+	if (!obj->data)
+		return;
+
+	for (i = 0; i < regs->count; i += 2) {
+		u32 count = RANGE(regs->registers, i);
+		int j;
+
+		for (j = 0; j < count; j++)
+			obj->data[index++] = gpu_read(gpu,
+				regs->registers[i] + j);
+	}
+}
+
+/* Read a block of GMU registers */
+static void _a6xx_get_gmu_registers(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		const struct a6xx_registers *regs,
+		struct a6xx_gpu_state_obj *obj,
+		bool rscc)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	int i, regcount = 0, index = 0;
+
+	for (i = 0; i < regs->count; i += 2)
+		regcount += RANGE(regs->registers, i);
+
+	obj->handle = (const void *) regs;
+	obj->data = state_kcalloc(a6xx_state, regcount, sizeof(u32));
+	if (!obj->data)
+		return;
+
+	for (i = 0; i < regs->count; i += 2) {
+		u32 count = RANGE(regs->registers, i);
+		int j;
+
+		for (j = 0; j < count; j++) {
+			u32 offset = regs->registers[i] + j;
+			u32 val;
+
+			if (rscc)
+				val = gmu_read_rscc(gmu, offset);
+			else
+				val = gmu_read(gmu, offset);
+
+			obj->data[index++] = val;
+		}
+	}
+}
+
+static void a6xx_get_gmu_registers(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+	a6xx_state->gmu_registers = state_kcalloc(a6xx_state,
+		3, sizeof(*a6xx_state->gmu_registers));
+
+	if (!a6xx_state->gmu_registers)
+		return;
+
+	a6xx_state->nr_gmu_registers = 3;
+
+	/* Get the CX GMU registers from AHB */
+	_a6xx_get_gmu_registers(gpu, a6xx_state, &a6xx_gmu_reglist[0],
+		&a6xx_state->gmu_registers[0], false);
+	_a6xx_get_gmu_registers(gpu, a6xx_state, &a6xx_gmu_reglist[1],
+		&a6xx_state->gmu_registers[1], true);
+
+	if (!a6xx_gmu_gx_is_on(&a6xx_gpu->gmu))
+		return;
+
+	/* Set the fence to ALLOW mode so we can access the registers */
+	gpu_write(gpu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+
+	_a6xx_get_gmu_registers(gpu, a6xx_state, &a6xx_gmu_reglist[2],
+		&a6xx_state->gmu_registers[2], false);
+}
+
+static struct msm_gpu_state_bo *a6xx_snapshot_gmu_bo(
+		struct a6xx_gpu_state *a6xx_state, struct a6xx_gmu_bo *bo)
+{
+	struct msm_gpu_state_bo *snapshot;
+
+	if (!bo->size)
+		return NULL;
+
+	snapshot = state_kcalloc(a6xx_state, 1, sizeof(*snapshot));
+	if (!snapshot)
+		return NULL;
+
+	snapshot->iova = bo->iova;
+	snapshot->size = bo->size;
+	snapshot->data = kvzalloc(snapshot->size, GFP_KERNEL);
+	if (!snapshot->data)
+		return NULL;
+
+	memcpy(snapshot->data, bo->virt, bo->size);
+
+	return snapshot;
+}
+
+static void a6xx_snapshot_gmu_hfi_history(struct msm_gpu *gpu,
+					  struct a6xx_gpu_state *a6xx_state)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
+	unsigned i, j;
+
+	BUILD_BUG_ON(ARRAY_SIZE(gmu->queues) != ARRAY_SIZE(a6xx_state->hfi_queue_history));
+
+	for (i = 0; i < ARRAY_SIZE(gmu->queues); i++) {
+		struct a6xx_hfi_queue *queue = &gmu->queues[i];
+		for (j = 0; j < HFI_HISTORY_SZ; j++) {
+			unsigned idx = (j + queue->history_idx) % HFI_HISTORY_SZ;
+			a6xx_state->hfi_queue_history[i][j] = queue->history[idx];
+		}
+	}
+}
+
+#define A6XX_REGLIST_SIZE        1
+#define A6XX_GBIF_REGLIST_SIZE   1
+static void a6xx_get_registers(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		struct a6xx_crashdumper *dumper)
+{
+	int i, count = A6XX_REGLIST_SIZE +
+		ARRAY_SIZE(a6xx_reglist) +
+		ARRAY_SIZE(a6xx_hlsq_reglist) + A6XX_GBIF_REGLIST_SIZE;
+	int index = 0;
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+
+	a6xx_state->registers = state_kcalloc(a6xx_state,
+		count, sizeof(*a6xx_state->registers));
+
+	if (!a6xx_state->registers)
+		return;
+
+	a6xx_state->nr_registers = count;
+
+	if (adreno_is_a7xx(adreno_gpu))
+		a6xx_get_ahb_gpu_registers(gpu,
+			a6xx_state, &a7xx_ahb_reglist,
+			&a6xx_state->registers[index++]);
+	else
+		a6xx_get_ahb_gpu_registers(gpu,
+			a6xx_state, &a6xx_ahb_reglist,
+			&a6xx_state->registers[index++]);
+
+	if (adreno_is_a7xx(adreno_gpu))
+		a6xx_get_ahb_gpu_registers(gpu,
+				a6xx_state, &a7xx_gbif_reglist,
+				&a6xx_state->registers[index++]);
+	else if (a6xx_has_gbif(adreno_gpu))
+		a6xx_get_ahb_gpu_registers(gpu,
+				a6xx_state, &a6xx_gbif_reglist,
+				&a6xx_state->registers[index++]);
+	else
+		a6xx_get_ahb_gpu_registers(gpu,
+				a6xx_state, &a6xx_vbif_reglist,
+				&a6xx_state->registers[index++]);
+	if (!dumper) {
+		/*
+		 * We can't use the crashdumper when the SMMU is stalled,
+		 * because the GPU has no memory access until we resume
+		 * translation (but we don't want to do that until after
+		 * we have captured as much useful GPU state as possible).
+		 * So instead collect registers via the CPU:
+		 */
+		for (i = 0; i < ARRAY_SIZE(a6xx_reglist); i++)
+			a6xx_get_ahb_gpu_registers(gpu,
+				a6xx_state, &a6xx_reglist[i],
+				&a6xx_state->registers[index++]);
+		return;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_reglist); i++)
+		a6xx_get_crashdumper_registers(gpu,
+			a6xx_state, &a6xx_reglist[i],
+			&a6xx_state->registers[index++],
+			dumper);
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_hlsq_reglist); i++)
+		a6xx_get_crashdumper_hlsq_registers(gpu,
+			a6xx_state, &a6xx_hlsq_reglist[i],
+			&a6xx_state->registers[index++],
+			dumper);
+}
+
+static u32 a6xx_get_cp_roq_size(struct msm_gpu *gpu)
+{
+	/* The value at [16:31] is in 4dword units. Convert it to dwords */
+	return gpu_read(gpu, REG_A6XX_CP_ROQ_THRESHOLDS_2) >> 14;
+}
+
+static u32 a7xx_get_cp_roq_size(struct msm_gpu *gpu)
+{
+	/*
+	 * The value at CP_ROQ_THRESHOLDS_2[20:31] is in 4dword units.
+	 * That register however is not directly accessible from APSS on A7xx.
+	 * Program the SQE_UCODE_DBG_ADDR with offset=0x70d3 and read the value.
+	 */
+	gpu_write(gpu, REG_A6XX_CP_SQE_UCODE_DBG_ADDR, 0x70d3);
+
+	return 4 * (gpu_read(gpu, REG_A6XX_CP_SQE_UCODE_DBG_DATA) >> 20);
+}
+
+/* Read a block of data from an indexed register pair */
+static void a6xx_get_indexed_regs(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state,
+		struct a6xx_indexed_registers *indexed,
+		struct a6xx_gpu_state_obj *obj)
+{
+	int i;
+
+	obj->handle = (const void *) indexed;
+	if (indexed->count_fn)
+		indexed->count = indexed->count_fn(gpu);
+
+	obj->data = state_kcalloc(a6xx_state, indexed->count, sizeof(u32));
+	if (!obj->data)
+		return;
+
+	/* All the indexed banks start at address 0 */
+	gpu_write(gpu, indexed->addr, 0);
+
+	/* Read the data - each read increments the internal address by 1 */
+	for (i = 0; i < indexed->count; i++)
+		obj->data[i] = gpu_read(gpu, indexed->data);
+}
+
+static void a6xx_get_indexed_registers(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state)
+{
+	u32 mempool_size;
+	int count = ARRAY_SIZE(a6xx_indexed_reglist) + 1;
+	int i;
+
+	a6xx_state->indexed_regs = state_kcalloc(a6xx_state, count,
+		sizeof(*a6xx_state->indexed_regs));
+	if (!a6xx_state->indexed_regs)
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_indexed_reglist); i++)
+		a6xx_get_indexed_regs(gpu, a6xx_state, &a6xx_indexed_reglist[i],
+			&a6xx_state->indexed_regs[i]);
+
+	if (adreno_is_a650_family(to_adreno_gpu(gpu))) {
+		u32 val;
+
+		val = gpu_read(gpu, REG_A6XX_CP_CHICKEN_DBG);
+		gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, val | 4);
+
+		/* Get the contents of the CP mempool */
+		a6xx_get_indexed_regs(gpu, a6xx_state, &a6xx_cp_mempool_indexed,
+			&a6xx_state->indexed_regs[i]);
+
+		gpu_write(gpu, REG_A6XX_CP_CHICKEN_DBG, val);
+		a6xx_state->nr_indexed_regs = count;
+		return;
+	}
+
+	/* Set the CP mempool size to 0 to stabilize it while dumping */
+	mempool_size = gpu_read(gpu, REG_A6XX_CP_MEM_POOL_SIZE);
+	gpu_write(gpu, REG_A6XX_CP_MEM_POOL_SIZE, 0);
+
+	/* Get the contents of the CP mempool */
+	a6xx_get_indexed_regs(gpu, a6xx_state, &a6xx_cp_mempool_indexed,
+		&a6xx_state->indexed_regs[i]);
+
+	/*
+	 * Offset 0x2000 in the mempool is the size - copy the saved size over
+	 * so the data is consistent
+	 */
+	a6xx_state->indexed_regs[i].data[0x2000] = mempool_size;
+
+	/* Restore the size in the hardware */
+	gpu_write(gpu, REG_A6XX_CP_MEM_POOL_SIZE, mempool_size);
+}
+
+static void a7xx_get_indexed_registers(struct msm_gpu *gpu,
+		struct a6xx_gpu_state *a6xx_state)
+{
+	int i, indexed_count, mempool_count;
+
+	indexed_count = ARRAY_SIZE(a7xx_indexed_reglist);
+	mempool_count = ARRAY_SIZE(a7xx_cp_bv_mempool_indexed);
+
+	a6xx_state->indexed_regs = state_kcalloc(a6xx_state,
+					indexed_count + mempool_count,
+					sizeof(*a6xx_state->indexed_regs));
+	if (!a6xx_state->indexed_regs)
+		return;
+
+	a6xx_state->nr_indexed_regs = indexed_count + mempool_count;
+
+	/* First read the common regs */
+	for (i = 0; i < indexed_count; i++)
+		a6xx_get_indexed_regs(gpu, a6xx_state, &a7xx_indexed_reglist[i],
+			&a6xx_state->indexed_regs[i]);
+
+	gpu_rmw(gpu, REG_A6XX_CP_CHICKEN_DBG, 0, BIT(2));
+	gpu_rmw(gpu, REG_A7XX_CP_BV_CHICKEN_DBG, 0, BIT(2));
+
+	/* Get the contents of the CP_BV mempool */
+	for (i = 0; i < mempool_count; i++)
+		a6xx_get_indexed_regs(gpu, a6xx_state, a7xx_cp_bv_mempool_indexed,
+			&a6xx_state->indexed_regs[indexed_count - 1 + i]);
+
+	gpu_rmw(gpu, REG_A6XX_CP_CHICKEN_DBG, BIT(2), 0);
+	gpu_rmw(gpu, REG_A7XX_CP_BV_CHICKEN_DBG, BIT(2), 0);
+	return;
+}
+
+struct msm_gpu_state *a6xx_gpu_state_get(struct msm_gpu *gpu)
+{
+	struct a6xx_crashdumper _dumper = { 0 }, *dumper = NULL;
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	struct a6xx_gpu_state *a6xx_state = kzalloc(sizeof(*a6xx_state),
+		GFP_KERNEL);
+	bool stalled = !!(gpu_read(gpu, REG_A6XX_RBBM_STATUS3) &
+			A6XX_RBBM_STATUS3_SMMU_STALLED_ON_FAULT);
+
+	if (!a6xx_state)
+		return ERR_PTR(-ENOMEM);
+
+	INIT_LIST_HEAD(&a6xx_state->objs);
+
+	/* Get the generic state from the adreno core */
+	adreno_gpu_state_get(gpu, &a6xx_state->base);
+
+	if (!adreno_has_gmu_wrapper(adreno_gpu)) {
+		a6xx_get_gmu_registers(gpu, a6xx_state);
+
+		a6xx_state->gmu_log = a6xx_snapshot_gmu_bo(a6xx_state, &a6xx_gpu->gmu.log);
+		a6xx_state->gmu_hfi = a6xx_snapshot_gmu_bo(a6xx_state, &a6xx_gpu->gmu.hfi);
+		a6xx_state->gmu_debug = a6xx_snapshot_gmu_bo(a6xx_state, &a6xx_gpu->gmu.debug);
+
+		a6xx_snapshot_gmu_hfi_history(gpu, a6xx_state);
+	}
+
+	/* If GX isn't on the rest of the data isn't going to be accessible */
+	if (!adreno_has_gmu_wrapper(adreno_gpu) && !a6xx_gmu_gx_is_on(&a6xx_gpu->gmu))
+		return &a6xx_state->base;
+
+	/* Get the banks of indexed registers */
+	if (adreno_is_a7xx(adreno_gpu)) {
+		a7xx_get_indexed_registers(gpu, a6xx_state);
+		/* Further codeflow is untested on A7xx. */
+		return &a6xx_state->base;
+	}
+
+	a6xx_get_indexed_registers(gpu, a6xx_state);
+
+	/*
+	 * Try to initialize the crashdumper, if we are not dumping state
+	 * with the SMMU stalled.  The crashdumper needs memory access to
+	 * write out GPU state, so we need to skip this when the SMMU is
+	 * stalled in response to an iova fault
+	 */
+	if (!stalled && !gpu->needs_hw_init &&
+	    !a6xx_crashdumper_init(gpu, &_dumper)) {
+		dumper = &_dumper;
+	}
+
+	a6xx_get_registers(gpu, a6xx_state, dumper);
+
+	if (dumper) {
+		a6xx_get_shaders(gpu, a6xx_state, dumper);
+		a6xx_get_clusters(gpu, a6xx_state, dumper);
+		a6xx_get_dbgahb_clusters(gpu, a6xx_state, dumper);
+
+		msm_gem_kernel_put(dumper->bo, gpu->aspace);
+	}
+
+	if (snapshot_debugbus)
+		a6xx_get_debugbus(gpu, a6xx_state);
+
+	a6xx_state->gpu_initialized = !gpu->needs_hw_init;
+
+	return  &a6xx_state->base;
+}
+
+static void a6xx_gpu_state_destroy(struct kref *kref)
+{
+	struct a6xx_state_memobj *obj, *tmp;
+	struct msm_gpu_state *state = container_of(kref,
+			struct msm_gpu_state, ref);
+	struct a6xx_gpu_state *a6xx_state = container_of(state,
+			struct a6xx_gpu_state, base);
+
+	if (a6xx_state->gmu_log)
+		kvfree(a6xx_state->gmu_log->data);
+
+	if (a6xx_state->gmu_hfi)
+		kvfree(a6xx_state->gmu_hfi->data);
+
+	if (a6xx_state->gmu_debug)
+		kvfree(a6xx_state->gmu_debug->data);
+
+	list_for_each_entry_safe(obj, tmp, &a6xx_state->objs, node) {
+		list_del(&obj->node);
+		kvfree(obj);
+	}
+
+	adreno_gpu_state_destroy(state);
+	kfree(a6xx_state);
+}
+
+int a6xx_gpu_state_put(struct msm_gpu_state *state)
+{
+	if (IS_ERR_OR_NULL(state))
+		return 1;
+
+	return kref_put(&state->ref, a6xx_gpu_state_destroy);
+}
+
+static void a6xx_show_registers(const u32 *registers, u32 *data, size_t count,
+		struct drm_printer *p)
+{
+	int i, index = 0;
+
+	if (!data)
+		return;
+
+	for (i = 0; i < count; i += 2) {
+		u32 count = RANGE(registers, i);
+		u32 offset = registers[i];
+		int j;
+
+		for (j = 0; j < count; index++, offset++, j++) {
+			if (data[index] == 0xdeafbead)
+				continue;
+
+			drm_printf(p, "  - { offset: 0x%06x, value: 0x%08x }\n",
+				offset << 2, data[index]);
+		}
+	}
+}
+
+static void print_ascii85(struct drm_printer *p, size_t len, u32 *data)
+{
+	char out[ASCII85_BUFSZ];
+	long i, l, datalen = 0;
+
+	for (i = 0; i < len >> 2; i++) {
+		if (data[i])
+			datalen = (i + 1) << 2;
+	}
+
+	if (datalen == 0)
+		return;
+
+	drm_puts(p, "    data: !!ascii85 |\n");
+	drm_puts(p, "      ");
+
+
+	l = ascii85_encode_len(datalen);
+
+	for (i = 0; i < l; i++)
+		drm_puts(p, ascii85_encode(data[i], out));
+
+	drm_puts(p, "\n");
+}
+
+static void print_name(struct drm_printer *p, const char *fmt, const char *name)
+{
+	drm_puts(p, fmt);
+	drm_puts(p, name);
+	drm_puts(p, "\n");
+}
+
+static void a6xx_show_shader(struct a6xx_gpu_state_obj *obj,
+		struct drm_printer *p)
+{
+	const struct a6xx_shader_block *block = obj->handle;
+	int i;
+
+	if (!obj->handle)
+		return;
+
+	print_name(p, "  - type: ", block->name);
+
+	for (i = 0; i < A6XX_NUM_SHADER_BANKS; i++) {
+		drm_printf(p, "    - bank: %d\n", i);
+		drm_printf(p, "      size: %d\n", block->size);
+
+		if (!obj->data)
+			continue;
+
+		print_ascii85(p, block->size << 2,
+			obj->data + (block->size * i));
+	}
+}
+
+static void a6xx_show_cluster_data(const u32 *registers, int size, u32 *data,
+		struct drm_printer *p)
+{
+	int ctx, index = 0;
+
+	for (ctx = 0; ctx < A6XX_NUM_CONTEXTS; ctx++) {
+		int j;
+
+		drm_printf(p, "    - context: %d\n", ctx);
+
+		for (j = 0; j < size; j += 2) {
+			u32 count = RANGE(registers, j);
+			u32 offset = registers[j];
+			int k;
+
+			for (k = 0; k < count; index++, offset++, k++) {
+				if (data[index] == 0xdeafbead)
+					continue;
+
+				drm_printf(p, "      - { offset: 0x%06x, value: 0x%08x }\n",
+					offset << 2, data[index]);
+			}
+		}
+	}
+}
+
+static void a6xx_show_dbgahb_cluster(struct a6xx_gpu_state_obj *obj,
+		struct drm_printer *p)
+{
+	const struct a6xx_dbgahb_cluster *dbgahb = obj->handle;
+
+	if (dbgahb) {
+		print_name(p, "  - cluster-name: ", dbgahb->name);
+		a6xx_show_cluster_data(dbgahb->registers, dbgahb->count,
+			obj->data, p);
+	}
+}
+
+static void a6xx_show_cluster(struct a6xx_gpu_state_obj *obj,
+		struct drm_printer *p)
+{
+	const struct a6xx_cluster *cluster = obj->handle;
+
+	if (cluster) {
+		print_name(p, "  - cluster-name: ", cluster->name);
+		a6xx_show_cluster_data(cluster->registers, cluster->count,
+			obj->data, p);
+	}
+}
+
+static void a6xx_show_indexed_regs(struct a6xx_gpu_state_obj *obj,
+		struct drm_printer *p)
+{
+	const struct a6xx_indexed_registers *indexed = obj->handle;
+
+	if (!indexed)
+		return;
+
+	print_name(p, "  - regs-name: ", indexed->name);
+	drm_printf(p, "    dwords: %d\n", indexed->count);
+
+	print_ascii85(p, indexed->count << 2, obj->data);
+}
+
+static void a6xx_show_debugbus_block(const struct a6xx_debugbus_block *block,
+		u32 *data, struct drm_printer *p)
+{
+	if (block) {
+		print_name(p, "  - debugbus-block: ", block->name);
+
+		/*
+		 * count for regular debugbus data is in quadwords,
+		 * but print the size in dwords for consistency
+		 */
+		drm_printf(p, "    count: %d\n", block->count << 1);
+
+		print_ascii85(p, block->count << 3, data);
+	}
+}
+
+static void a6xx_show_debugbus(struct a6xx_gpu_state *a6xx_state,
+		struct drm_printer *p)
+{
+	int i;
+
+	for (i = 0; i < a6xx_state->nr_debugbus; i++) {
+		struct a6xx_gpu_state_obj *obj = &a6xx_state->debugbus[i];
+
+		a6xx_show_debugbus_block(obj->handle, obj->data, p);
+	}
+
+	if (a6xx_state->vbif_debugbus) {
+		struct a6xx_gpu_state_obj *obj = a6xx_state->vbif_debugbus;
+
+		drm_puts(p, "  - debugbus-block: A6XX_DBGBUS_VBIF\n");
+		drm_printf(p, "    count: %d\n", VBIF_DEBUGBUS_BLOCK_SIZE);
+
+		/* vbif debugbus data is in dwords.  Confusing, huh? */
+		print_ascii85(p, VBIF_DEBUGBUS_BLOCK_SIZE << 2, obj->data);
+	}
+
+	for (i = 0; i < a6xx_state->nr_cx_debugbus; i++) {
+		struct a6xx_gpu_state_obj *obj = &a6xx_state->cx_debugbus[i];
+
+		a6xx_show_debugbus_block(obj->handle, obj->data, p);
+	}
+}
+
+void a6xx_show(struct msm_gpu *gpu, struct msm_gpu_state *state,
+		struct drm_printer *p)
+{
+	struct a6xx_gpu_state *a6xx_state = container_of(state,
+			struct a6xx_gpu_state, base);
+	int i;
+
+	if (IS_ERR_OR_NULL(state))
+		return;
+
+	drm_printf(p, "gpu-initialized: %d\n", a6xx_state->gpu_initialized);
+
+	adreno_show(gpu, state, p);
+
+	drm_puts(p, "gmu-log:\n");
+	if (a6xx_state->gmu_log) {
+		struct msm_gpu_state_bo *gmu_log = a6xx_state->gmu_log;
+
+		drm_printf(p, "    iova: 0x%016llx\n", gmu_log->iova);
+		drm_printf(p, "    size: %zu\n", gmu_log->size);
+		adreno_show_object(p, &gmu_log->data, gmu_log->size,
+				&gmu_log->encoded);
+	}
+
+	drm_puts(p, "gmu-hfi:\n");
+	if (a6xx_state->gmu_hfi) {
+		struct msm_gpu_state_bo *gmu_hfi = a6xx_state->gmu_hfi;
+		unsigned i, j;
+
+		drm_printf(p, "    iova: 0x%016llx\n", gmu_hfi->iova);
+		drm_printf(p, "    size: %zu\n", gmu_hfi->size);
+		for (i = 0; i < ARRAY_SIZE(a6xx_state->hfi_queue_history); i++) {
+			drm_printf(p, "    queue-history[%u]:", i);
+			for (j = 0; j < HFI_HISTORY_SZ; j++) {
+				drm_printf(p, " %d", a6xx_state->hfi_queue_history[i][j]);
+			}
+			drm_printf(p, "\n");
+		}
+		adreno_show_object(p, &gmu_hfi->data, gmu_hfi->size,
+				&gmu_hfi->encoded);
+	}
+
+	drm_puts(p, "gmu-debug:\n");
+	if (a6xx_state->gmu_debug) {
+		struct msm_gpu_state_bo *gmu_debug = a6xx_state->gmu_debug;
+
+		drm_printf(p, "    iova: 0x%016llx\n", gmu_debug->iova);
+		drm_printf(p, "    size: %zu\n", gmu_debug->size);
+		adreno_show_object(p, &gmu_debug->data, gmu_debug->size,
+				&gmu_debug->encoded);
+	}
+
+	drm_puts(p, "registers:\n");
+	for (i = 0; i < a6xx_state->nr_registers; i++) {
+		struct a6xx_gpu_state_obj *obj = &a6xx_state->registers[i];
+		const struct a6xx_registers *regs = obj->handle;
+
+		if (!obj->handle)
+			continue;
+
+		a6xx_show_registers(regs->registers, obj->data, regs->count, p);
+	}
+
+	drm_puts(p, "registers-gmu:\n");
+	for (i = 0; i < a6xx_state->nr_gmu_registers; i++) {
+		struct a6xx_gpu_state_obj *obj = &a6xx_state->gmu_registers[i];
+		const struct a6xx_registers *regs = obj->handle;
+
+		if (!obj->handle)
+			continue;
+
+		a6xx_show_registers(regs->registers, obj->data, regs->count, p);
+	}
+
+	drm_puts(p, "indexed-registers:\n");
+	for (i = 0; i < a6xx_state->nr_indexed_regs; i++)
+		a6xx_show_indexed_regs(&a6xx_state->indexed_regs[i], p);
+
+	drm_puts(p, "shader-blocks:\n");
+	for (i = 0; i < a6xx_state->nr_shaders; i++)
+		a6xx_show_shader(&a6xx_state->shaders[i], p);
+
+	drm_puts(p, "clusters:\n");
+	for (i = 0; i < a6xx_state->nr_clusters; i++)
+		a6xx_show_cluster(&a6xx_state->clusters[i], p);
+
+	for (i = 0; i < a6xx_state->nr_dbgahb_clusters; i++)
+		a6xx_show_dbgahb_cluster(&a6xx_state->dbgahb_clusters[i], p);
+
+	drm_puts(p, "debugbus:\n");
+	a6xx_show_debugbus(a6xx_state, p);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a6xx_gpu_state.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a6xx_gpu_state.h
@@ -0,0 +1,537 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. */
+
+#ifndef _A6XX_CRASH_DUMP_H_
+#define _A6XX_CRASH_DUMP_H_
+
+#include "a6xx.xml.h"
+
+#define A6XX_NUM_CONTEXTS 2
+#define A6XX_NUM_SHADER_BANKS 3
+
+static const u32 a6xx_gras_cluster[] = {
+	0x8000, 0x8006, 0x8010, 0x8092, 0x8094, 0x809d, 0x80a0, 0x80a6,
+	0x80af, 0x80f1, 0x8100, 0x8107, 0x8109, 0x8109, 0x8110, 0x8110,
+	0x8400, 0x840b,
+};
+
+static const u32 a6xx_ps_cluster_rac[] = {
+	0x8800, 0x8806, 0x8809, 0x8811, 0x8818, 0x881e, 0x8820, 0x8865,
+	0x8870, 0x8879, 0x8880, 0x8889, 0x8890, 0x8891, 0x8898, 0x8898,
+	0x88c0, 0x88c1, 0x88d0, 0x88e3, 0x8900, 0x890c, 0x890f, 0x891a,
+	0x8c00, 0x8c01, 0x8c08, 0x8c10, 0x8c17, 0x8c1f, 0x8c26, 0x8c33,
+};
+
+static const u32 a6xx_ps_cluster_rbp[] = {
+	0x88f0, 0x88f3, 0x890d, 0x890e, 0x8927, 0x8928, 0x8bf0, 0x8bf1,
+	0x8c02, 0x8c07, 0x8c11, 0x8c16, 0x8c20, 0x8c25,
+};
+
+static const u32 a6xx_ps_cluster[] = {
+	0x9200, 0x9216, 0x9218, 0x9236, 0x9300, 0x9306,
+};
+
+static const u32 a6xx_fe_cluster[] = {
+	0x9300, 0x9306, 0x9800, 0x9806, 0x9b00, 0x9b07, 0xa000, 0xa009,
+	0xa00e, 0xa0ef, 0xa0f8, 0xa0f8,
+};
+
+static const u32 a660_fe_cluster[] = {
+	0x9807, 0x9807,
+};
+
+static const u32 a6xx_pc_vs_cluster[] = {
+	0x9100, 0x9108, 0x9300, 0x9306, 0x9980, 0x9981, 0x9b00, 0x9b07,
+};
+
+#define CLUSTER_FE	0
+#define CLUSTER_SP_VS	1
+#define CLUSTER_PC_VS	2
+#define CLUSTER_GRAS	3
+#define CLUSTER_SP_PS	4
+#define CLUSTER_PS	5
+#define CLUSTER_VPC_PS	6
+
+#define CLUSTER(_id, _reg, _sel_reg, _sel_val) \
+	{ .id = _id, .name = #_id,\
+		.registers = _reg, \
+		.count = ARRAY_SIZE(_reg), \
+		.sel_reg = _sel_reg, .sel_val = _sel_val }
+
+static const struct a6xx_cluster {
+	u32 id;
+	const char *name;
+	const u32 *registers;
+	size_t count;
+	u32 sel_reg;
+	u32 sel_val;
+} a6xx_clusters[] = {
+	CLUSTER(CLUSTER_GRAS, a6xx_gras_cluster, 0, 0),
+	CLUSTER(CLUSTER_PS, a6xx_ps_cluster_rac, REG_A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_CD, 0x0),
+	CLUSTER(CLUSTER_PS, a6xx_ps_cluster_rbp, REG_A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_CD, 0x9),
+	CLUSTER(CLUSTER_PS, a6xx_ps_cluster, 0, 0),
+	CLUSTER(CLUSTER_FE, a6xx_fe_cluster, 0, 0),
+	CLUSTER(CLUSTER_PC_VS, a6xx_pc_vs_cluster, 0, 0),
+	CLUSTER(CLUSTER_FE, a660_fe_cluster, 0, 0),
+};
+
+static const u32 a6xx_sp_vs_hlsq_cluster[] = {
+	0xb800, 0xb803, 0xb820, 0xb822,
+};
+
+static const u32 a6xx_sp_vs_sp_cluster[] = {
+	0xa800, 0xa824, 0xa830, 0xa83c, 0xa840, 0xa864, 0xa870, 0xa895,
+	0xa8a0, 0xa8af, 0xa8c0, 0xa8c3,
+};
+
+static const u32 a6xx_hlsq_duplicate_cluster[] = {
+	0xbb10, 0xbb11, 0xbb20, 0xbb29,
+};
+
+static const u32 a6xx_hlsq_2d_duplicate_cluster[] = {
+	0xbd80, 0xbd80,
+};
+
+static const u32 a6xx_sp_duplicate_cluster[] = {
+	0xab00, 0xab00, 0xab04, 0xab05, 0xab10, 0xab1b, 0xab20, 0xab20,
+};
+
+static const u32 a6xx_tp_duplicate_cluster[] = {
+	0xb300, 0xb307, 0xb309, 0xb309, 0xb380, 0xb382,
+};
+
+static const u32 a6xx_sp_ps_hlsq_cluster[] = {
+	0xb980, 0xb980, 0xb982, 0xb987, 0xb990, 0xb99b, 0xb9a0, 0xb9a2,
+	0xb9c0, 0xb9c9,
+};
+
+static const u32 a6xx_sp_ps_hlsq_2d_cluster[] = {
+	0xbd80, 0xbd80,
+};
+
+static const u32 a6xx_sp_ps_sp_cluster[] = {
+	0xa980, 0xa9a8, 0xa9b0, 0xa9bc, 0xa9d0, 0xa9d3, 0xa9e0, 0xa9f3,
+	0xaa00, 0xaa00, 0xaa30, 0xaa31, 0xaaf2, 0xaaf2,
+};
+
+static const u32 a6xx_sp_ps_sp_2d_cluster[] = {
+	0xacc0, 0xacc0,
+};
+
+static const u32 a6xx_sp_ps_tp_cluster[] = {
+	0xb180, 0xb183, 0xb190, 0xb191,
+};
+
+static const u32 a6xx_sp_ps_tp_2d_cluster[] = {
+	0xb4c0, 0xb4d1,
+};
+
+#define CLUSTER_DBGAHB(_id, _base, _type, _reg) \
+	{ .name = #_id, .statetype = _type, .base = _base, \
+		.registers = _reg, .count = ARRAY_SIZE(_reg) }
+
+static const struct a6xx_dbgahb_cluster {
+	const char *name;
+	u32 statetype;
+	u32 base;
+	const u32 *registers;
+	size_t count;
+} a6xx_dbgahb_clusters[] = {
+	CLUSTER_DBGAHB(CLUSTER_SP_VS, 0x0002e000, 0x41, a6xx_sp_vs_hlsq_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_VS, 0x0002a000, 0x21, a6xx_sp_vs_sp_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_VS, 0x0002e000, 0x41, a6xx_hlsq_duplicate_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_VS, 0x0002f000, 0x45, a6xx_hlsq_2d_duplicate_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_VS, 0x0002a000, 0x21, a6xx_sp_duplicate_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_VS, 0x0002c000, 0x1, a6xx_tp_duplicate_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_PS, 0x0002e000, 0x42, a6xx_sp_ps_hlsq_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_PS, 0x0002f000, 0x46, a6xx_sp_ps_hlsq_2d_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_PS, 0x0002a000, 0x22, a6xx_sp_ps_sp_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_PS, 0x0002b000, 0x26, a6xx_sp_ps_sp_2d_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_PS, 0x0002c000, 0x2, a6xx_sp_ps_tp_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_PS, 0x0002d000, 0x6, a6xx_sp_ps_tp_2d_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_PS, 0x0002e000, 0x42, a6xx_hlsq_duplicate_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_PS, 0x0002a000, 0x22, a6xx_sp_duplicate_cluster),
+	CLUSTER_DBGAHB(CLUSTER_SP_PS, 0x0002c000, 0x2, a6xx_tp_duplicate_cluster),
+};
+
+static const u32 a6xx_hlsq_registers[] = {
+	0xbe00, 0xbe01, 0xbe04, 0xbe05, 0xbe08, 0xbe09, 0xbe10, 0xbe15,
+	0xbe20, 0xbe23,
+};
+
+static const u32 a6xx_sp_registers[] = {
+	0xae00, 0xae04, 0xae0c, 0xae0c, 0xae0f, 0xae2b, 0xae30, 0xae32,
+	0xae35, 0xae35, 0xae3a, 0xae3f, 0xae50, 0xae52,
+};
+
+static const u32 a6xx_tp_registers[] = {
+	0xb600, 0xb601, 0xb604, 0xb605, 0xb610, 0xb61b, 0xb620, 0xb623,
+};
+
+struct a6xx_registers {
+	const u32 *registers;
+	size_t count;
+	u32 val0;
+	u32 val1;
+};
+
+#define HLSQ_DBG_REGS(_base, _type, _array) \
+	{ .val0 = _base, .val1 = _type, .registers = _array, \
+		.count = ARRAY_SIZE(_array), }
+
+static const struct a6xx_registers a6xx_hlsq_reglist[] = {
+	HLSQ_DBG_REGS(0x0002F800, 0x40, a6xx_hlsq_registers),
+	HLSQ_DBG_REGS(0x0002B800, 0x20, a6xx_sp_registers),
+	HLSQ_DBG_REGS(0x0002D800, 0x0, a6xx_tp_registers),
+};
+
+#define SHADER(_type, _size) \
+	{ .type = _type, .name = #_type, .size = _size }
+
+static const struct a6xx_shader_block {
+	const char *name;
+	u32 type;
+	u32 size;
+} a6xx_shader_blocks[] = {
+	SHADER(A6XX_TP0_TMO_DATA, 0x200),
+	SHADER(A6XX_TP0_SMO_DATA, 0x80),
+	SHADER(A6XX_TP0_MIPMAP_BASE_DATA, 0x3c0),
+	SHADER(A6XX_TP1_TMO_DATA, 0x200),
+	SHADER(A6XX_TP1_SMO_DATA, 0x80),
+	SHADER(A6XX_TP1_MIPMAP_BASE_DATA, 0x3c0),
+	SHADER(A6XX_SP_INST_DATA, 0x800),
+	SHADER(A6XX_SP_LB_0_DATA, 0x800),
+	SHADER(A6XX_SP_LB_1_DATA, 0x800),
+	SHADER(A6XX_SP_LB_2_DATA, 0x800),
+	SHADER(A6XX_SP_LB_3_DATA, 0x800),
+	SHADER(A6XX_SP_LB_4_DATA, 0x800),
+	SHADER(A6XX_SP_LB_5_DATA, 0x200),
+	SHADER(A6XX_SP_CB_BINDLESS_DATA, 0x800),
+	SHADER(A6XX_SP_CB_LEGACY_DATA, 0x280),
+	SHADER(A6XX_SP_UAV_DATA, 0x80),
+	SHADER(A6XX_SP_INST_TAG, 0x80),
+	SHADER(A6XX_SP_CB_BINDLESS_TAG, 0x80),
+	SHADER(A6XX_SP_TMO_UMO_TAG, 0x80),
+	SHADER(A6XX_SP_SMO_TAG, 0x80),
+	SHADER(A6XX_SP_STATE_DATA, 0x3f),
+	SHADER(A6XX_HLSQ_CHUNK_CVS_RAM, 0x1c0),
+	SHADER(A6XX_HLSQ_CHUNK_CPS_RAM, 0x280),
+	SHADER(A6XX_HLSQ_CHUNK_CVS_RAM_TAG, 0x40),
+	SHADER(A6XX_HLSQ_CHUNK_CPS_RAM_TAG, 0x40),
+	SHADER(A6XX_HLSQ_ICB_CVS_CB_BASE_TAG, 0x4),
+	SHADER(A6XX_HLSQ_ICB_CPS_CB_BASE_TAG, 0x4),
+	SHADER(A6XX_HLSQ_CVS_MISC_RAM, 0x1c0),
+	SHADER(A6XX_HLSQ_CPS_MISC_RAM, 0x580),
+	SHADER(A6XX_HLSQ_INST_RAM, 0x800),
+	SHADER(A6XX_HLSQ_GFX_CVS_CONST_RAM, 0x800),
+	SHADER(A6XX_HLSQ_GFX_CPS_CONST_RAM, 0x800),
+	SHADER(A6XX_HLSQ_CVS_MISC_RAM_TAG, 0x8),
+	SHADER(A6XX_HLSQ_CPS_MISC_RAM_TAG, 0x4),
+	SHADER(A6XX_HLSQ_INST_RAM_TAG, 0x80),
+	SHADER(A6XX_HLSQ_GFX_CVS_CONST_RAM_TAG, 0xc),
+	SHADER(A6XX_HLSQ_GFX_CPS_CONST_RAM_TAG, 0x10),
+	SHADER(A6XX_HLSQ_PWR_REST_RAM, 0x28),
+	SHADER(A6XX_HLSQ_PWR_REST_TAG, 0x14),
+	SHADER(A6XX_HLSQ_DATAPATH_META, 0x40),
+	SHADER(A6XX_HLSQ_FRONTEND_META, 0x40),
+	SHADER(A6XX_HLSQ_INDIRECT_META, 0x40),
+	SHADER(A6XX_SP_LB_6_DATA, 0x200),
+	SHADER(A6XX_SP_LB_7_DATA, 0x200),
+	SHADER(A6XX_HLSQ_INST_RAM_1, 0x200),
+};
+
+static const u32 a6xx_rb_rac_registers[] = {
+	0x8e04, 0x8e05, 0x8e07, 0x8e08, 0x8e10, 0x8e1c, 0x8e20, 0x8e25,
+	0x8e28, 0x8e28, 0x8e2c, 0x8e2f, 0x8e50, 0x8e52,
+};
+
+static const u32 a6xx_rb_rbp_registers[] = {
+	0x8e01, 0x8e01, 0x8e0c, 0x8e0c, 0x8e3b, 0x8e3e, 0x8e40, 0x8e43,
+	0x8e53, 0x8e5f, 0x8e70, 0x8e77,
+};
+
+static const u32 a6xx_registers[] = {
+	/* RBBM */
+	0x0000, 0x0002, 0x0010, 0x0010, 0x0012, 0x0012, 0x0018, 0x001b,
+	0x001e, 0x0032, 0x0038, 0x003c, 0x0042, 0x0042, 0x0044, 0x0044,
+	0x0047, 0x0047, 0x0056, 0x0056, 0x00ad, 0x00ae, 0x00b0, 0x00fb,
+	0x0100, 0x011d, 0x0200, 0x020d, 0x0218, 0x023d, 0x0400, 0x04f9,
+	0x0500, 0x0500, 0x0505, 0x050b, 0x050e, 0x0511, 0x0533, 0x0533,
+	0x0540, 0x0555,
+	/* CP */
+	0x0800, 0x0808, 0x0810, 0x0813, 0x0820, 0x0821, 0x0823, 0x0824,
+	0x0826, 0x0827, 0x0830, 0x0833, 0x0840, 0x0845, 0x084f, 0x086f,
+	0x0880, 0x088a, 0x08a0, 0x08ab, 0x08c0, 0x08c4, 0x08d0, 0x08dd,
+	0x08f0, 0x08f3, 0x0900, 0x0903, 0x0908, 0x0911, 0x0928, 0x093e,
+	0x0942, 0x094d, 0x0980, 0x0984, 0x098d, 0x0996, 0x0998, 0x099e,
+	0x09a0, 0x09a6, 0x09a8, 0x09ae, 0x09b0, 0x09b1, 0x09c2, 0x09c8,
+	0x0a00, 0x0a03,
+	/* VSC */
+	0x0c00, 0x0c04, 0x0c06, 0x0c06, 0x0c10, 0x0cd9, 0x0e00, 0x0e0e,
+	/* UCHE */
+	0x0e10, 0x0e13, 0x0e17, 0x0e19, 0x0e1c, 0x0e2b, 0x0e30, 0x0e32,
+	0x0e38, 0x0e39,
+	/* GRAS */
+	0x8600, 0x8601, 0x8610, 0x861b, 0x8620, 0x8620, 0x8628, 0x862b,
+	0x8630, 0x8637,
+	/* VPC */
+	0x9600, 0x9604, 0x9624, 0x9637,
+	/* PC */
+	0x9e00, 0x9e01, 0x9e03, 0x9e0e, 0x9e11, 0x9e16, 0x9e19, 0x9e19,
+	0x9e1c, 0x9e1c, 0x9e20, 0x9e23, 0x9e30, 0x9e31, 0x9e34, 0x9e34,
+	0x9e70, 0x9e72, 0x9e78, 0x9e79, 0x9e80, 0x9fff,
+	/* VFD */
+	0xa600, 0xa601, 0xa603, 0xa603, 0xa60a, 0xa60a, 0xa610, 0xa617,
+	0xa630, 0xa630,
+	/* HLSQ */
+	0xd002, 0xd003,
+};
+
+static const u32 a660_registers[] = {
+	/* UCHE */
+	0x0e3c, 0x0e3c,
+};
+
+#define REGS(_array, _sel_reg, _sel_val) \
+	{ .registers = _array, .count = ARRAY_SIZE(_array), \
+		.val0 = _sel_reg, .val1 = _sel_val }
+
+static const struct a6xx_registers a6xx_reglist[] = {
+	REGS(a6xx_registers, 0, 0),
+	REGS(a660_registers, 0, 0),
+	REGS(a6xx_rb_rac_registers, REG_A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_CD, 0),
+	REGS(a6xx_rb_rbp_registers, REG_A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_CD, 9),
+};
+
+static const u32 a6xx_ahb_registers[] = {
+	/* RBBM_STATUS - RBBM_STATUS3 */
+	0x210, 0x213,
+	/* CP_STATUS_1 */
+	0x825, 0x825,
+};
+
+static const u32 a6xx_vbif_registers[] = {
+	0x3000, 0x3007, 0x300c, 0x3014, 0x3018, 0x302d, 0x3030, 0x3031,
+	0x3034, 0x3036, 0x303c, 0x303d, 0x3040, 0x3040, 0x3042, 0x3042,
+	0x3049, 0x3049, 0x3058, 0x3058, 0x305a, 0x3061, 0x3064, 0x3068,
+	0x306c, 0x306d, 0x3080, 0x3088, 0x308b, 0x308c, 0x3090, 0x3094,
+	0x3098, 0x3098, 0x309c, 0x309c, 0x30c0, 0x30c0, 0x30c8, 0x30c8,
+	0x30d0, 0x30d0, 0x30d8, 0x30d8, 0x30e0, 0x30e0, 0x3100, 0x3100,
+	0x3108, 0x3108, 0x3110, 0x3110, 0x3118, 0x3118, 0x3120, 0x3120,
+	0x3124, 0x3125, 0x3129, 0x3129, 0x3131, 0x3131, 0x3154, 0x3154,
+	0x3156, 0x3156, 0x3158, 0x3158, 0x315a, 0x315a, 0x315c, 0x315c,
+	0x315e, 0x315e, 0x3160, 0x3160, 0x3162, 0x3162, 0x340c, 0x340c,
+	0x3410, 0x3410, 0x3800, 0x3801,
+};
+
+static const u32 a6xx_gbif_registers[] = {
+	0x3C00, 0X3C0B, 0X3C40, 0X3C47, 0X3CC0, 0X3CD1, 0xE3A, 0xE3A,
+};
+
+static const struct a6xx_registers a6xx_ahb_reglist =
+	REGS(a6xx_ahb_registers, 0, 0);
+
+static const struct a6xx_registers a6xx_vbif_reglist =
+			REGS(a6xx_vbif_registers, 0, 0);
+
+static const struct a6xx_registers a6xx_gbif_reglist =
+			REGS(a6xx_gbif_registers, 0, 0);
+
+static const u32 a7xx_ahb_registers[] = {
+	/* RBBM_STATUS */
+	0x210, 0x210,
+	/* RBBM_STATUS2-3 */
+	0x212, 0x213,
+};
+
+static const u32 a7xx_gbif_registers[] = {
+	0x3c00, 0x3c0b,
+	0x3c40, 0x3c42,
+	0x3c45, 0x3c47,
+	0x3c49, 0x3c4a,
+	0x3cc0, 0x3cd1,
+};
+
+static const struct a6xx_registers a7xx_ahb_reglist=
+	REGS(a7xx_ahb_registers, 0, 0);
+
+static const struct a6xx_registers a7xx_gbif_reglist =
+	REGS(a7xx_gbif_registers, 0, 0);
+
+static const u32 a6xx_gmu_gx_registers[] = {
+	/* GMU GX */
+	0x0000, 0x0000, 0x0010, 0x0013, 0x0016, 0x0016, 0x0018, 0x001b,
+	0x001e, 0x001e, 0x0020, 0x0023, 0x0026, 0x0026, 0x0028, 0x002b,
+	0x002e, 0x002e, 0x0030, 0x0033, 0x0036, 0x0036, 0x0038, 0x003b,
+	0x003e, 0x003e, 0x0040, 0x0043, 0x0046, 0x0046, 0x0080, 0x0084,
+	0x0100, 0x012b, 0x0140, 0x0140,
+};
+
+static const u32 a6xx_gmu_cx_registers[] = {
+	/* GMU CX */
+	0x4c00, 0x4c07, 0x4c10, 0x4c12, 0x4d00, 0x4d00, 0x4d07, 0x4d0a,
+	0x5000, 0x5004, 0x5007, 0x5008, 0x500b, 0x500c, 0x500f, 0x501c,
+	0x5024, 0x502a, 0x502d, 0x5030, 0x5040, 0x5053, 0x5087, 0x5089,
+	0x50a0, 0x50a2, 0x50a4, 0x50af, 0x50c0, 0x50c3, 0x50d0, 0x50d0,
+	0x50e4, 0x50e4, 0x50e8, 0x50ec, 0x5100, 0x5103, 0x5140, 0x5140,
+	0x5142, 0x5144, 0x514c, 0x514d, 0x514f, 0x5151, 0x5154, 0x5154,
+	0x5157, 0x5158, 0x515d, 0x515d, 0x5162, 0x5162, 0x5164, 0x5165,
+	0x5180, 0x5186, 0x5190, 0x519e, 0x51c0, 0x51c0, 0x51c5, 0x51cc,
+	0x51e0, 0x51e2, 0x51f0, 0x51f0, 0x5200, 0x5201,
+	/* GMU AO */
+	0x9300, 0x9316, 0x9400, 0x9400,
+	/* GPU CC */
+	0x9800, 0x9812, 0x9840, 0x9852, 0x9c00, 0x9c04, 0x9c07, 0x9c0b,
+	0x9c15, 0x9c1c, 0x9c1e, 0x9c2d, 0x9c3c, 0x9c3d, 0x9c3f, 0x9c40,
+	0x9c42, 0x9c49, 0x9c58, 0x9c5a, 0x9d40, 0x9d5e, 0xa000, 0xa002,
+	0xa400, 0xa402, 0xac00, 0xac02, 0xb000, 0xb002, 0xb400, 0xb402,
+	0xb800, 0xb802,
+	/* GPU CC ACD */
+	0xbc00, 0xbc16, 0xbc20, 0xbc27,
+};
+
+static const u32 a6xx_gmu_cx_rscc_registers[] = {
+	/* GPU RSCC */
+	0x008c, 0x008c, 0x0101, 0x0102, 0x0340, 0x0342, 0x0344, 0x0347,
+	0x034c, 0x0387, 0x03ec, 0x03ef, 0x03f4, 0x042f, 0x0494, 0x0497,
+	0x049c, 0x04d7, 0x053c, 0x053f, 0x0544, 0x057f,
+};
+
+static const struct a6xx_registers a6xx_gmu_reglist[] = {
+	REGS(a6xx_gmu_cx_registers, 0, 0),
+	REGS(a6xx_gmu_cx_rscc_registers, 0, 0),
+	REGS(a6xx_gmu_gx_registers, 0, 0),
+};
+
+static u32 a6xx_get_cp_roq_size(struct msm_gpu *gpu);
+static u32 a7xx_get_cp_roq_size(struct msm_gpu *gpu);
+
+struct a6xx_indexed_registers {
+	const char *name;
+	u32 addr;
+	u32 data;
+	u32 count;
+	u32 (*count_fn)(struct msm_gpu *gpu);
+};
+
+static struct a6xx_indexed_registers a6xx_indexed_reglist[] = {
+	{ "CP_SQE_STAT", REG_A6XX_CP_SQE_STAT_ADDR,
+		REG_A6XX_CP_SQE_STAT_DATA, 0x33, NULL },
+	{ "CP_DRAW_STATE", REG_A6XX_CP_DRAW_STATE_ADDR,
+		REG_A6XX_CP_DRAW_STATE_DATA, 0x100, NULL },
+	{ "CP_UCODE_DBG_DATA", REG_A6XX_CP_SQE_UCODE_DBG_ADDR,
+		REG_A6XX_CP_SQE_UCODE_DBG_DATA, 0x8000, NULL },
+	{ "CP_ROQ", REG_A6XX_CP_ROQ_DBG_ADDR,
+		REG_A6XX_CP_ROQ_DBG_DATA, 0, a6xx_get_cp_roq_size},
+};
+
+static struct a6xx_indexed_registers a7xx_indexed_reglist[] = {
+	{ "CP_SQE_STAT", REG_A6XX_CP_SQE_STAT_ADDR,
+		REG_A6XX_CP_SQE_STAT_DATA, 0x33, NULL },
+	{ "CP_DRAW_STATE", REG_A6XX_CP_DRAW_STATE_ADDR,
+		REG_A6XX_CP_DRAW_STATE_DATA, 0x100, NULL },
+	{ "CP_UCODE_DBG_DATA", REG_A6XX_CP_SQE_UCODE_DBG_ADDR,
+		REG_A6XX_CP_SQE_UCODE_DBG_DATA, 0x8000, NULL },
+	{ "CP_BV_SQE_STAT_ADDR", REG_A7XX_CP_BV_SQE_STAT_ADDR,
+		REG_A7XX_CP_BV_SQE_STAT_DATA, 0x33, NULL },
+	{ "CP_BV_DRAW_STATE_ADDR", REG_A7XX_CP_BV_DRAW_STATE_ADDR,
+		REG_A7XX_CP_BV_DRAW_STATE_DATA, 0x100, NULL },
+	{ "CP_BV_SQE_UCODE_DBG_ADDR", REG_A7XX_CP_BV_SQE_UCODE_DBG_ADDR,
+		REG_A7XX_CP_BV_SQE_UCODE_DBG_DATA, 0x8000, NULL },
+	{ "CP_SQE_AC_STAT_ADDR", REG_A7XX_CP_SQE_AC_STAT_ADDR,
+		REG_A7XX_CP_SQE_AC_STAT_DATA, 0x33, NULL },
+	{ "CP_LPAC_DRAW_STATE_ADDR", REG_A7XX_CP_LPAC_DRAW_STATE_ADDR,
+		REG_A7XX_CP_LPAC_DRAW_STATE_DATA, 0x100, NULL },
+	{ "CP_SQE_AC_UCODE_DBG_ADDR", REG_A7XX_CP_SQE_AC_UCODE_DBG_ADDR,
+		REG_A7XX_CP_SQE_AC_UCODE_DBG_DATA, 0x8000, NULL },
+	{ "CP_LPAC_FIFO_DBG_ADDR", REG_A7XX_CP_LPAC_FIFO_DBG_ADDR,
+		REG_A7XX_CP_LPAC_FIFO_DBG_DATA, 0x40, NULL },
+	{ "CP_ROQ", REG_A6XX_CP_ROQ_DBG_ADDR,
+		REG_A6XX_CP_ROQ_DBG_DATA, 0, a7xx_get_cp_roq_size },
+};
+
+static struct a6xx_indexed_registers a6xx_cp_mempool_indexed = {
+	"CP_MEMPOOL", REG_A6XX_CP_MEM_POOL_DBG_ADDR,
+		REG_A6XX_CP_MEM_POOL_DBG_DATA, 0x2060, NULL,
+};
+
+static struct a6xx_indexed_registers a7xx_cp_bv_mempool_indexed[] = {
+	{ "CP_MEMPOOL", REG_A6XX_CP_MEM_POOL_DBG_ADDR,
+		REG_A6XX_CP_MEM_POOL_DBG_DATA, 0x2100, NULL },
+	{ "CP_BV_MEMPOOL", REG_A7XX_CP_BV_MEM_POOL_DBG_ADDR,
+		REG_A7XX_CP_BV_MEM_POOL_DBG_DATA, 0x2100, NULL },
+};
+
+#define DEBUGBUS(_id, _count) { .id = _id, .name = #_id, .count = _count }
+
+static const struct a6xx_debugbus_block {
+	const char *name;
+	u32 id;
+	u32 count;
+} a6xx_debugbus_blocks[] = {
+	DEBUGBUS(A6XX_DBGBUS_CP, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_RBBM, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_HLSQ, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_UCHE, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_DPM, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_TESS, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_PC, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_VFDP, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_VPC, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_TSE, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_RAS, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_VSC, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_COM, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_LRZ, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_A2D, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_CCUFCHE, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_RBP, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_DCS, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_DBGC, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_GMU_GX, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_TPFCHE, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_GPC, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_LARC, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_HLSQ_SPTP, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_RB_0, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_RB_1, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_UCHE_WRAPPER, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_CCU_0, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_CCU_1, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_VFD_0, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_VFD_1, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_VFD_2, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_VFD_3, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_SP_0, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_SP_1, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_TPL1_0, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_TPL1_1, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_TPL1_2, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_TPL1_3, 0x100),
+};
+
+static const struct a6xx_debugbus_block a6xx_gbif_debugbus_block =
+			DEBUGBUS(A6XX_DBGBUS_VBIF, 0x100);
+
+static const struct a6xx_debugbus_block a6xx_cx_debugbus_blocks[] = {
+	DEBUGBUS(A6XX_DBGBUS_GMU_CX, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_CX, 0x100),
+};
+
+static const struct a6xx_debugbus_block a650_debugbus_blocks[] = {
+	DEBUGBUS(A6XX_DBGBUS_RB_2, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_CCU_2, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_VFD_4, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_VFD_5, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_SP_2, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_TPL1_4, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_TPL1_5, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_SPTP_0, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_SPTP_1, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_SPTP_2, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_SPTP_3, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_SPTP_4, 0x100),
+	DEBUGBUS(A6XX_DBGBUS_SPTP_5, 0x100),
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a6xx_hfi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a6xx_hfi.c
@@ -0,0 +1,888 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2017-2018 The Linux Foundation. All rights reserved. */
+
+#include <linux/completion.h>
+#include <linux/circ_buf.h>
+#include <linux/list.h>
+
+#include <soc/qcom/cmd-db.h>
+
+#include "a6xx_gmu.h"
+#include "a6xx_gmu.xml.h"
+#include "a6xx_gpu.h"
+
+#define HFI_MSG_ID(val) [val] = #val
+
+static const char * const a6xx_hfi_msg_id[] = {
+	HFI_MSG_ID(HFI_H2F_MSG_INIT),
+	HFI_MSG_ID(HFI_H2F_MSG_FW_VERSION),
+	HFI_MSG_ID(HFI_H2F_MSG_BW_TABLE),
+	HFI_MSG_ID(HFI_H2F_MSG_PERF_TABLE),
+	HFI_MSG_ID(HFI_H2F_MSG_TEST),
+	HFI_MSG_ID(HFI_H2F_MSG_START),
+	HFI_MSG_ID(HFI_H2F_MSG_CORE_FW_START),
+	HFI_MSG_ID(HFI_H2F_MSG_GX_BW_PERF_VOTE),
+	HFI_MSG_ID(HFI_H2F_MSG_PREPARE_SLUMBER),
+};
+
+static int a6xx_hfi_queue_read(struct a6xx_gmu *gmu,
+	struct a6xx_hfi_queue *queue, u32 *data, u32 dwords)
+{
+	struct a6xx_hfi_queue_header *header = queue->header;
+	u32 i, hdr, index = header->read_index;
+
+	if (header->read_index == header->write_index) {
+		header->rx_request = 1;
+		return 0;
+	}
+
+	hdr = queue->data[index];
+
+	queue->history[(queue->history_idx++) % HFI_HISTORY_SZ] = index;
+
+	/*
+	 * If we are to assume that the GMU firmware is in fact a rational actor
+	 * and is programmed to not send us a larger response than we expect
+	 * then we can also assume that if the header size is unexpectedly large
+	 * that it is due to memory corruption and/or hardware failure. In this
+	 * case the only reasonable course of action is to BUG() to help harden
+	 * the failure.
+	 */
+
+	BUG_ON(HFI_HEADER_SIZE(hdr) > dwords);
+
+	for (i = 0; i < HFI_HEADER_SIZE(hdr); i++) {
+		data[i] = queue->data[index];
+		index = (index + 1) % header->size;
+	}
+
+	if (!gmu->legacy)
+		index = ALIGN(index, 4) % header->size;
+
+	header->read_index = index;
+	return HFI_HEADER_SIZE(hdr);
+}
+
+static int a6xx_hfi_queue_write(struct a6xx_gmu *gmu,
+	struct a6xx_hfi_queue *queue, u32 *data, u32 dwords)
+{
+	struct a6xx_hfi_queue_header *header = queue->header;
+	u32 i, space, index = header->write_index;
+
+	spin_lock(&queue->lock);
+
+	space = CIRC_SPACE(header->write_index, header->read_index,
+		header->size);
+	if (space < dwords) {
+		header->dropped++;
+		spin_unlock(&queue->lock);
+		return -ENOSPC;
+	}
+
+	queue->history[(queue->history_idx++) % HFI_HISTORY_SZ] = index;
+
+	for (i = 0; i < dwords; i++) {
+		queue->data[index] = data[i];
+		index = (index + 1) % header->size;
+	}
+
+	/* Cookify any non used data at the end of the write buffer */
+	if (!gmu->legacy) {
+		for (; index % 4; index = (index + 1) % header->size)
+			queue->data[index] = 0xfafafafa;
+	}
+
+	header->write_index = index;
+	spin_unlock(&queue->lock);
+
+	gmu_write(gmu, REG_A6XX_GMU_HOST2GMU_INTR_SET, 0x01);
+	return 0;
+}
+
+static int a6xx_hfi_wait_for_ack(struct a6xx_gmu *gmu, u32 id, u32 seqnum,
+		u32 *payload, u32 payload_size)
+{
+	struct a6xx_hfi_queue *queue = &gmu->queues[HFI_RESPONSE_QUEUE];
+	u32 val;
+	int ret;
+
+	/* Wait for a response */
+	ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_GMU2HOST_INTR_INFO, val,
+		val & A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ, 100, 5000);
+
+	if (ret) {
+		DRM_DEV_ERROR(gmu->dev,
+			"Message %s id %d timed out waiting for response\n",
+			a6xx_hfi_msg_id[id], seqnum);
+		return -ETIMEDOUT;
+	}
+
+	/* Clear the interrupt */
+	gmu_write(gmu, REG_A6XX_GMU_GMU2HOST_INTR_CLR,
+		A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ);
+
+	for (;;) {
+		struct a6xx_hfi_msg_response resp;
+
+		/* Get the next packet */
+		ret = a6xx_hfi_queue_read(gmu, queue, (u32 *) &resp,
+			sizeof(resp) >> 2);
+
+		/* If the queue is empty our response never made it */
+		if (!ret) {
+			DRM_DEV_ERROR(gmu->dev,
+				"The HFI response queue is unexpectedly empty\n");
+
+			return -ENOENT;
+		}
+
+		if (HFI_HEADER_ID(resp.header) == HFI_F2H_MSG_ERROR) {
+			struct a6xx_hfi_msg_error *error =
+				(struct a6xx_hfi_msg_error *) &resp;
+
+			DRM_DEV_ERROR(gmu->dev, "GMU firmware error %d\n",
+				error->code);
+			continue;
+		}
+
+		if (seqnum != HFI_HEADER_SEQNUM(resp.ret_header)) {
+			DRM_DEV_ERROR(gmu->dev,
+				"Unexpected message id %d on the response queue\n",
+				HFI_HEADER_SEQNUM(resp.ret_header));
+			continue;
+		}
+
+		if (resp.error) {
+			DRM_DEV_ERROR(gmu->dev,
+				"Message %s id %d returned error %d\n",
+				a6xx_hfi_msg_id[id], seqnum, resp.error);
+			return -EINVAL;
+		}
+
+		/* All is well, copy over the buffer */
+		if (payload && payload_size)
+			memcpy(payload, resp.payload,
+				min_t(u32, payload_size, sizeof(resp.payload)));
+
+		return 0;
+	}
+}
+
+static int a6xx_hfi_send_msg(struct a6xx_gmu *gmu, int id,
+		void *data, u32 size, u32 *payload, u32 payload_size)
+{
+	struct a6xx_hfi_queue *queue = &gmu->queues[HFI_COMMAND_QUEUE];
+	int ret, dwords = size >> 2;
+	u32 seqnum;
+
+	seqnum = atomic_inc_return(&queue->seqnum) % 0xfff;
+
+	/* First dword of the message is the message header - fill it in */
+	*((u32 *) data) = (seqnum << 20) | (HFI_MSG_CMD << 16) |
+		(dwords << 8) | id;
+
+	ret = a6xx_hfi_queue_write(gmu, queue, data, dwords);
+	if (ret) {
+		DRM_DEV_ERROR(gmu->dev, "Unable to send message %s id %d\n",
+			a6xx_hfi_msg_id[id], seqnum);
+		return ret;
+	}
+
+	return a6xx_hfi_wait_for_ack(gmu, id, seqnum, payload, payload_size);
+}
+
+static int a6xx_hfi_send_gmu_init(struct a6xx_gmu *gmu, int boot_state)
+{
+	struct a6xx_hfi_msg_gmu_init_cmd msg = { 0 };
+
+	msg.dbg_buffer_addr = (u32) gmu->debug.iova;
+	msg.dbg_buffer_size = (u32) gmu->debug.size;
+	msg.boot_state = boot_state;
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_INIT, &msg, sizeof(msg),
+		NULL, 0);
+}
+
+static int a6xx_hfi_get_fw_version(struct a6xx_gmu *gmu, u32 *version)
+{
+	struct a6xx_hfi_msg_fw_version msg = { 0 };
+
+	/* Currently supporting version 1.10 */
+	msg.supported_version = (1 << 28) | (1 << 19) | (1 << 17);
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_FW_VERSION, &msg, sizeof(msg),
+		version, sizeof(*version));
+}
+
+static int a6xx_hfi_send_perf_table_v1(struct a6xx_gmu *gmu)
+{
+	struct a6xx_hfi_msg_perf_table_v1 msg = { 0 };
+	int i;
+
+	msg.num_gpu_levels = gmu->nr_gpu_freqs;
+	msg.num_gmu_levels = gmu->nr_gmu_freqs;
+
+	for (i = 0; i < gmu->nr_gpu_freqs; i++) {
+		msg.gx_votes[i].vote = gmu->gx_arc_votes[i];
+		msg.gx_votes[i].freq = gmu->gpu_freqs[i] / 1000;
+	}
+
+	for (i = 0; i < gmu->nr_gmu_freqs; i++) {
+		msg.cx_votes[i].vote = gmu->cx_arc_votes[i];
+		msg.cx_votes[i].freq = gmu->gmu_freqs[i] / 1000;
+	}
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_PERF_TABLE, &msg, sizeof(msg),
+		NULL, 0);
+}
+
+static int a6xx_hfi_send_perf_table(struct a6xx_gmu *gmu)
+{
+	struct a6xx_hfi_msg_perf_table msg = { 0 };
+	int i;
+
+	msg.num_gpu_levels = gmu->nr_gpu_freqs;
+	msg.num_gmu_levels = gmu->nr_gmu_freqs;
+
+	for (i = 0; i < gmu->nr_gpu_freqs; i++) {
+		msg.gx_votes[i].vote = gmu->gx_arc_votes[i];
+		msg.gx_votes[i].acd = 0xffffffff;
+		msg.gx_votes[i].freq = gmu->gpu_freqs[i] / 1000;
+	}
+
+	for (i = 0; i < gmu->nr_gmu_freqs; i++) {
+		msg.cx_votes[i].vote = gmu->cx_arc_votes[i];
+		msg.cx_votes[i].freq = gmu->gmu_freqs[i] / 1000;
+	}
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_PERF_TABLE, &msg, sizeof(msg),
+		NULL, 0);
+}
+
+static void a618_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	/* Send a single "off" entry since the 618 GMU doesn't do bus scaling */
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x01;
+
+	msg->ddr_cmds_addrs[0] = 0x50000;
+	msg->ddr_cmds_addrs[1] = 0x5003c;
+	msg->ddr_cmds_addrs[2] = 0x5000c;
+
+	msg->ddr_cmds_data[0][0] =  0x40000000;
+	msg->ddr_cmds_data[0][1] =  0x40000000;
+	msg->ddr_cmds_data[0][2] =  0x40000000;
+
+	/*
+	 * These are the CX (CNOC) votes - these are used by the GMU but the
+	 * votes are known and fixed for the target
+	 */
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x01;
+
+	msg->cnoc_cmds_addrs[0] = 0x5007c;
+	msg->cnoc_cmds_data[0][0] =  0x40000000;
+	msg->cnoc_cmds_data[1][0] =  0x60000001;
+}
+
+static void a619_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	msg->bw_level_num = 13;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x0;
+
+	msg->ddr_cmds_addrs[0] = 0x50000;
+	msg->ddr_cmds_addrs[1] = 0x50004;
+	msg->ddr_cmds_addrs[2] = 0x50080;
+
+	msg->ddr_cmds_data[0][0]  = 0x40000000;
+	msg->ddr_cmds_data[0][1]  = 0x40000000;
+	msg->ddr_cmds_data[0][2]  = 0x40000000;
+	msg->ddr_cmds_data[1][0]  = 0x6000030c;
+	msg->ddr_cmds_data[1][1]  = 0x600000db;
+	msg->ddr_cmds_data[1][2]  = 0x60000008;
+	msg->ddr_cmds_data[2][0]  = 0x60000618;
+	msg->ddr_cmds_data[2][1]  = 0x600001b6;
+	msg->ddr_cmds_data[2][2]  = 0x60000008;
+	msg->ddr_cmds_data[3][0]  = 0x60000925;
+	msg->ddr_cmds_data[3][1]  = 0x60000291;
+	msg->ddr_cmds_data[3][2]  = 0x60000008;
+	msg->ddr_cmds_data[4][0]  = 0x60000dc1;
+	msg->ddr_cmds_data[4][1]  = 0x600003dc;
+	msg->ddr_cmds_data[4][2]  = 0x60000008;
+	msg->ddr_cmds_data[5][0]  = 0x600010ad;
+	msg->ddr_cmds_data[5][1]  = 0x600004ae;
+	msg->ddr_cmds_data[5][2]  = 0x60000008;
+	msg->ddr_cmds_data[6][0]  = 0x600014c3;
+	msg->ddr_cmds_data[6][1]  = 0x600005d4;
+	msg->ddr_cmds_data[6][2]  = 0x60000008;
+	msg->ddr_cmds_data[7][0]  = 0x6000176a;
+	msg->ddr_cmds_data[7][1]  = 0x60000693;
+	msg->ddr_cmds_data[7][2]  = 0x60000008;
+	msg->ddr_cmds_data[8][0]  = 0x60001f01;
+	msg->ddr_cmds_data[8][1]  = 0x600008b5;
+	msg->ddr_cmds_data[8][2]  = 0x60000008;
+	msg->ddr_cmds_data[9][0]  = 0x60002940;
+	msg->ddr_cmds_data[9][1]  = 0x60000b95;
+	msg->ddr_cmds_data[9][2]  = 0x60000008;
+	msg->ddr_cmds_data[10][0] = 0x60002f68;
+	msg->ddr_cmds_data[10][1] = 0x60000d50;
+	msg->ddr_cmds_data[10][2] = 0x60000008;
+	msg->ddr_cmds_data[11][0] = 0x60003700;
+	msg->ddr_cmds_data[11][1] = 0x60000f71;
+	msg->ddr_cmds_data[11][2] = 0x60000008;
+	msg->ddr_cmds_data[12][0] = 0x60003fce;
+	msg->ddr_cmds_data[12][1] = 0x600011ea;
+	msg->ddr_cmds_data[12][2] = 0x60000008;
+
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x0;
+
+	msg->cnoc_cmds_addrs[0] = 0x50054;
+
+	msg->cnoc_cmds_data[0][0] = 0x40000000;
+}
+
+static void a640_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	/*
+	 * Send a single "off" entry just to get things running
+	 * TODO: bus scaling
+	 */
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x01;
+
+	msg->ddr_cmds_addrs[0] = 0x50000;
+	msg->ddr_cmds_addrs[1] = 0x5003c;
+	msg->ddr_cmds_addrs[2] = 0x5000c;
+
+	msg->ddr_cmds_data[0][0] =  0x40000000;
+	msg->ddr_cmds_data[0][1] =  0x40000000;
+	msg->ddr_cmds_data[0][2] =  0x40000000;
+
+	/*
+	 * These are the CX (CNOC) votes - these are used by the GMU but the
+	 * votes are known and fixed for the target
+	 */
+	msg->cnoc_cmds_num = 3;
+	msg->cnoc_wait_bitmask = 0x01;
+
+	msg->cnoc_cmds_addrs[0] = 0x50034;
+	msg->cnoc_cmds_addrs[1] = 0x5007c;
+	msg->cnoc_cmds_addrs[2] = 0x5004c;
+
+	msg->cnoc_cmds_data[0][0] =  0x40000000;
+	msg->cnoc_cmds_data[0][1] =  0x00000000;
+	msg->cnoc_cmds_data[0][2] =  0x40000000;
+
+	msg->cnoc_cmds_data[1][0] =  0x60000001;
+	msg->cnoc_cmds_data[1][1] =  0x20000001;
+	msg->cnoc_cmds_data[1][2] =  0x60000001;
+}
+
+static void a650_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	/*
+	 * Send a single "off" entry just to get things running
+	 * TODO: bus scaling
+	 */
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x01;
+
+	msg->ddr_cmds_addrs[0] = 0x50000;
+	msg->ddr_cmds_addrs[1] = 0x50004;
+	msg->ddr_cmds_addrs[2] = 0x5007c;
+
+	msg->ddr_cmds_data[0][0] =  0x40000000;
+	msg->ddr_cmds_data[0][1] =  0x40000000;
+	msg->ddr_cmds_data[0][2] =  0x40000000;
+
+	/*
+	 * These are the CX (CNOC) votes - these are used by the GMU but the
+	 * votes are known and fixed for the target
+	 */
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x01;
+
+	msg->cnoc_cmds_addrs[0] = 0x500a4;
+	msg->cnoc_cmds_data[0][0] =  0x40000000;
+	msg->cnoc_cmds_data[1][0] =  0x60000001;
+}
+
+static void a690_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	/*
+	 * Send a single "off" entry just to get things running
+	 * TODO: bus scaling
+	 */
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x01;
+
+	msg->ddr_cmds_addrs[0] = 0x50004;
+	msg->ddr_cmds_addrs[1] = 0x50000;
+	msg->ddr_cmds_addrs[2] = 0x500ac;
+
+	msg->ddr_cmds_data[0][0] =  0x40000000;
+	msg->ddr_cmds_data[0][1] =  0x40000000;
+	msg->ddr_cmds_data[0][2] =  0x40000000;
+
+	/*
+	 * These are the CX (CNOC) votes - these are used by the GMU but the
+	 * votes are known and fixed for the target
+	 */
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x01;
+
+	msg->cnoc_cmds_addrs[0] = 0x5003c;
+	msg->cnoc_cmds_data[0][0] =  0x40000000;
+	msg->cnoc_cmds_data[1][0] =  0x60000001;
+}
+
+static void a660_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	/*
+	 * Send a single "off" entry just to get things running
+	 * TODO: bus scaling
+	 */
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x01;
+
+	msg->ddr_cmds_addrs[0] = 0x50004;
+	msg->ddr_cmds_addrs[1] = 0x500a0;
+	msg->ddr_cmds_addrs[2] = 0x50000;
+
+	msg->ddr_cmds_data[0][0] =  0x40000000;
+	msg->ddr_cmds_data[0][1] =  0x40000000;
+	msg->ddr_cmds_data[0][2] =  0x40000000;
+
+	/*
+	 * These are the CX (CNOC) votes - these are used by the GMU but the
+	 * votes are known and fixed for the target
+	 */
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x01;
+
+	msg->cnoc_cmds_addrs[0] = 0x50070;
+	msg->cnoc_cmds_data[0][0] =  0x40000000;
+	msg->cnoc_cmds_data[1][0] =  0x60000001;
+}
+
+static void a663_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	/*
+	 * Send a single "off" entry just to get things running
+	 * TODO: bus scaling
+	 */
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x07;
+
+	msg->ddr_cmds_addrs[0] = 0x50004;
+	msg->ddr_cmds_addrs[1] = 0x50000;
+	msg->ddr_cmds_addrs[2] = 0x500b4;
+
+	msg->ddr_cmds_data[0][0] =  0x40000000;
+	msg->ddr_cmds_data[0][1] =  0x40000000;
+	msg->ddr_cmds_data[0][2] =  0x40000000;
+
+	/*
+	 * These are the CX (CNOC) votes - these are used by the GMU but the
+	 * votes are known and fixed for the target
+	 */
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x01;
+
+	msg->cnoc_cmds_addrs[0] = 0x50058;
+	msg->cnoc_cmds_data[0][0] =  0x40000000;
+	msg->cnoc_cmds_data[1][0] =  0x60000001;
+}
+
+static void adreno_7c3_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	/*
+	 * Send a single "off" entry just to get things running
+	 * TODO: bus scaling
+	 */
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x07;
+
+	msg->ddr_cmds_addrs[0] = 0x50004;
+	msg->ddr_cmds_addrs[1] = 0x50000;
+	msg->ddr_cmds_addrs[2] = 0x50088;
+
+	msg->ddr_cmds_data[0][0] =  0x40000000;
+	msg->ddr_cmds_data[0][1] =  0x40000000;
+	msg->ddr_cmds_data[0][2] =  0x40000000;
+
+	/*
+	 * These are the CX (CNOC) votes - these are used by the GMU but the
+	 * votes are known and fixed for the target
+	 */
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x01;
+
+	msg->cnoc_cmds_addrs[0] = 0x5006c;
+	msg->cnoc_cmds_data[0][0] =  0x40000000;
+	msg->cnoc_cmds_data[1][0] =  0x60000001;
+}
+
+static void a730_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	msg->bw_level_num = 12;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x7;
+
+	msg->ddr_cmds_addrs[0] = cmd_db_read_addr("SH0");
+	msg->ddr_cmds_addrs[1] = cmd_db_read_addr("MC0");
+	msg->ddr_cmds_addrs[2] = cmd_db_read_addr("ACV");
+
+	msg->ddr_cmds_data[0][0] = 0x40000000;
+	msg->ddr_cmds_data[0][1] = 0x40000000;
+	msg->ddr_cmds_data[0][2] = 0x40000000;
+	msg->ddr_cmds_data[1][0] = 0x600002e8;
+	msg->ddr_cmds_data[1][1] = 0x600003d0;
+	msg->ddr_cmds_data[1][2] = 0x60000008;
+	msg->ddr_cmds_data[2][0] = 0x6000068d;
+	msg->ddr_cmds_data[2][1] = 0x6000089a;
+	msg->ddr_cmds_data[2][2] = 0x60000008;
+	msg->ddr_cmds_data[3][0] = 0x600007f2;
+	msg->ddr_cmds_data[3][1] = 0x60000a6e;
+	msg->ddr_cmds_data[3][2] = 0x60000008;
+	msg->ddr_cmds_data[4][0] = 0x600009e5;
+	msg->ddr_cmds_data[4][1] = 0x60000cfd;
+	msg->ddr_cmds_data[4][2] = 0x60000008;
+	msg->ddr_cmds_data[5][0] = 0x60000b29;
+	msg->ddr_cmds_data[5][1] = 0x60000ea6;
+	msg->ddr_cmds_data[5][2] = 0x60000008;
+	msg->ddr_cmds_data[6][0] = 0x60001698;
+	msg->ddr_cmds_data[6][1] = 0x60001da8;
+	msg->ddr_cmds_data[6][2] = 0x60000008;
+	msg->ddr_cmds_data[7][0] = 0x600018d2;
+	msg->ddr_cmds_data[7][1] = 0x60002093;
+	msg->ddr_cmds_data[7][2] = 0x60000008;
+	msg->ddr_cmds_data[8][0] = 0x60001e66;
+	msg->ddr_cmds_data[8][1] = 0x600027e6;
+	msg->ddr_cmds_data[8][2] = 0x60000008;
+	msg->ddr_cmds_data[9][0] = 0x600027c2;
+	msg->ddr_cmds_data[9][1] = 0x6000342f;
+	msg->ddr_cmds_data[9][2] = 0x60000008;
+	msg->ddr_cmds_data[10][0] = 0x60002e71;
+	msg->ddr_cmds_data[10][1] = 0x60003cf5;
+	msg->ddr_cmds_data[10][2] = 0x60000008;
+	msg->ddr_cmds_data[11][0] = 0x600030ae;
+	msg->ddr_cmds_data[11][1] = 0x60003fe5;
+	msg->ddr_cmds_data[11][2] = 0x60000008;
+
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x1;
+
+	msg->cnoc_cmds_addrs[0] = cmd_db_read_addr("CN0");
+	msg->cnoc_cmds_data[0][0] = 0x40000000;
+	msg->cnoc_cmds_data[1][0] = 0x60000001;
+}
+
+static void a740_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x7;
+
+	msg->ddr_cmds_addrs[0] = cmd_db_read_addr("SH0");
+	msg->ddr_cmds_addrs[1] = cmd_db_read_addr("MC0");
+	msg->ddr_cmds_addrs[2] = cmd_db_read_addr("ACV");
+
+	msg->ddr_cmds_data[0][0] = 0x40000000;
+	msg->ddr_cmds_data[0][1] = 0x40000000;
+	msg->ddr_cmds_data[0][2] = 0x40000000;
+
+	/* TODO: add a proper dvfs table */
+
+	msg->cnoc_cmds_num = 1;
+	msg->cnoc_wait_bitmask = 0x1;
+
+	msg->cnoc_cmds_addrs[0] = cmd_db_read_addr("CN0");
+	msg->cnoc_cmds_data[0][0] = 0x40000000;
+	msg->cnoc_cmds_data[1][0] = 0x60000001;
+}
+
+static void a6xx_build_bw_table(struct a6xx_hfi_msg_bw_table *msg)
+{
+	/* Send a single "off" entry since the 630 GMU doesn't do bus scaling */
+	msg->bw_level_num = 1;
+
+	msg->ddr_cmds_num = 3;
+	msg->ddr_wait_bitmask = 0x07;
+
+	msg->ddr_cmds_addrs[0] = 0x50000;
+	msg->ddr_cmds_addrs[1] = 0x5005c;
+	msg->ddr_cmds_addrs[2] = 0x5000c;
+
+	msg->ddr_cmds_data[0][0] =  0x40000000;
+	msg->ddr_cmds_data[0][1] =  0x40000000;
+	msg->ddr_cmds_data[0][2] =  0x40000000;
+
+	/*
+	 * These are the CX (CNOC) votes.  This is used but the values for the
+	 * sdm845 GMU are known and fixed so we can hard code them.
+	 */
+
+	msg->cnoc_cmds_num = 3;
+	msg->cnoc_wait_bitmask = 0x05;
+
+	msg->cnoc_cmds_addrs[0] = 0x50034;
+	msg->cnoc_cmds_addrs[1] = 0x5007c;
+	msg->cnoc_cmds_addrs[2] = 0x5004c;
+
+	msg->cnoc_cmds_data[0][0] =  0x40000000;
+	msg->cnoc_cmds_data[0][1] =  0x00000000;
+	msg->cnoc_cmds_data[0][2] =  0x40000000;
+
+	msg->cnoc_cmds_data[1][0] =  0x60000001;
+	msg->cnoc_cmds_data[1][1] =  0x20000001;
+	msg->cnoc_cmds_data[1][2] =  0x60000001;
+}
+
+
+static int a6xx_hfi_send_bw_table(struct a6xx_gmu *gmu)
+{
+	struct a6xx_hfi_msg_bw_table msg = { 0 };
+	struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
+	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
+
+	if (adreno_is_a618(adreno_gpu))
+		a618_build_bw_table(&msg);
+	else if (adreno_is_a619(adreno_gpu))
+		a619_build_bw_table(&msg);
+	else if (adreno_is_a640_family(adreno_gpu))
+		a640_build_bw_table(&msg);
+	else if (adreno_is_a650(adreno_gpu))
+		a650_build_bw_table(&msg);
+	else if (adreno_is_7c3(adreno_gpu))
+		adreno_7c3_build_bw_table(&msg);
+	else if (adreno_is_a660(adreno_gpu))
+		a660_build_bw_table(&msg);
+	else if (adreno_is_a663(adreno_gpu))
+		a663_build_bw_table(&msg);
+	else if (adreno_is_a690(adreno_gpu))
+		a690_build_bw_table(&msg);
+	else if (adreno_is_a730(adreno_gpu))
+		a730_build_bw_table(&msg);
+	else if (adreno_is_a740_family(adreno_gpu))
+		a740_build_bw_table(&msg);
+	else
+		a6xx_build_bw_table(&msg);
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_BW_TABLE, &msg, sizeof(msg),
+		NULL, 0);
+}
+
+static int a6xx_hfi_send_test(struct a6xx_gmu *gmu)
+{
+	struct a6xx_hfi_msg_test msg = { 0 };
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_TEST, &msg, sizeof(msg),
+		NULL, 0);
+}
+
+static int a6xx_hfi_send_start(struct a6xx_gmu *gmu)
+{
+	struct a6xx_hfi_msg_start msg = { 0 };
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_START, &msg, sizeof(msg),
+		NULL, 0);
+}
+
+static int a6xx_hfi_send_core_fw_start(struct a6xx_gmu *gmu)
+{
+	struct a6xx_hfi_msg_core_fw_start msg = { 0 };
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_CORE_FW_START, &msg,
+		sizeof(msg), NULL, 0);
+}
+
+int a6xx_hfi_set_freq(struct a6xx_gmu *gmu, int index)
+{
+	struct a6xx_hfi_gx_bw_perf_vote_cmd msg = { 0 };
+
+	msg.ack_type = 1; /* blocking */
+	msg.freq = index;
+	msg.bw = 0; /* TODO: bus scaling */
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_GX_BW_PERF_VOTE, &msg,
+		sizeof(msg), NULL, 0);
+}
+
+int a6xx_hfi_send_prep_slumber(struct a6xx_gmu *gmu)
+{
+	struct a6xx_hfi_prep_slumber_cmd msg = { 0 };
+
+	/* TODO: should freq and bw fields be non-zero ? */
+
+	return a6xx_hfi_send_msg(gmu, HFI_H2F_MSG_PREPARE_SLUMBER, &msg,
+		sizeof(msg), NULL, 0);
+}
+
+static int a6xx_hfi_start_v1(struct a6xx_gmu *gmu, int boot_state)
+{
+	int ret;
+
+	ret = a6xx_hfi_send_gmu_init(gmu, boot_state);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hfi_get_fw_version(gmu, NULL);
+	if (ret)
+		return ret;
+
+	/*
+	 * We have to get exchange version numbers per the sequence but at this
+	 * point th kernel driver doesn't need to know the exact version of
+	 * the GMU firmware
+	 */
+
+	ret = a6xx_hfi_send_perf_table_v1(gmu);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hfi_send_bw_table(gmu);
+	if (ret)
+		return ret;
+
+	/*
+	 * Let the GMU know that there won't be any more HFI messages until next
+	 * boot
+	 */
+	a6xx_hfi_send_test(gmu);
+
+	return 0;
+}
+
+int a6xx_hfi_start(struct a6xx_gmu *gmu, int boot_state)
+{
+	int ret;
+
+	if (gmu->legacy)
+		return a6xx_hfi_start_v1(gmu, boot_state);
+
+
+	ret = a6xx_hfi_send_perf_table(gmu);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hfi_send_bw_table(gmu);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hfi_send_core_fw_start(gmu);
+	if (ret)
+		return ret;
+
+	/*
+	 * Downstream driver sends this in its "a6xx_hw_init" equivalent,
+	 * but seems to be no harm in sending it here
+	 */
+	ret = a6xx_hfi_send_start(gmu);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+void a6xx_hfi_stop(struct a6xx_gmu *gmu)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(gmu->queues); i++) {
+		struct a6xx_hfi_queue *queue = &gmu->queues[i];
+
+		if (!queue->header)
+			continue;
+
+		if (queue->header->read_index != queue->header->write_index)
+			DRM_DEV_ERROR(gmu->dev, "HFI queue %d is not empty\n", i);
+
+		queue->header->read_index = 0;
+		queue->header->write_index = 0;
+
+		memset(&queue->history, 0xff, sizeof(queue->history));
+		queue->history_idx = 0;
+	}
+}
+
+static void a6xx_hfi_queue_init(struct a6xx_hfi_queue *queue,
+		struct a6xx_hfi_queue_header *header, void *virt, u64 iova,
+		u32 id)
+{
+	spin_lock_init(&queue->lock);
+	queue->header = header;
+	queue->data = virt;
+	atomic_set(&queue->seqnum, 0);
+
+	memset(&queue->history, 0xff, sizeof(queue->history));
+	queue->history_idx = 0;
+
+	/* Set up the shared memory header */
+	header->iova = iova;
+	header->type =  10 << 8 | id;
+	header->status = 1;
+	header->size = SZ_4K >> 2;
+	header->msg_size = 0;
+	header->dropped = 0;
+	header->rx_watermark = 1;
+	header->tx_watermark = 1;
+	header->rx_request = 1;
+	header->tx_request = 0;
+	header->read_index = 0;
+	header->write_index = 0;
+}
+
+void a6xx_hfi_init(struct a6xx_gmu *gmu)
+{
+	struct a6xx_gmu_bo *hfi = &gmu->hfi;
+	struct a6xx_hfi_queue_table_header *table = hfi->virt;
+	struct a6xx_hfi_queue_header *headers = hfi->virt + sizeof(*table);
+	u64 offset;
+	int table_size;
+
+	/*
+	 * The table size is the size of the table header plus all of the queue
+	 * headers
+	 */
+	table_size = sizeof(*table);
+	table_size += (ARRAY_SIZE(gmu->queues) *
+		sizeof(struct a6xx_hfi_queue_header));
+
+	table->version = 0;
+	table->size = table_size;
+	/* First queue header is located immediately after the table header */
+	table->qhdr0_offset = sizeof(*table) >> 2;
+	table->qhdr_size = sizeof(struct a6xx_hfi_queue_header) >> 2;
+	table->num_queues = ARRAY_SIZE(gmu->queues);
+	table->active_queues = ARRAY_SIZE(gmu->queues);
+
+	/* Command queue */
+	offset = SZ_4K;
+	a6xx_hfi_queue_init(&gmu->queues[0], &headers[0], hfi->virt + offset,
+		hfi->iova + offset, 0);
+
+	/* GMU response queue */
+	offset += SZ_4K;
+	a6xx_hfi_queue_init(&gmu->queues[1], &headers[1], hfi->virt + offset,
+		hfi->iova + offset, gmu->legacy ? 4 : 1);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/a6xx_hfi.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/a6xx_hfi.h
@@ -0,0 +1,184 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (c) 2017 The Linux Foundation. All rights reserved. */
+
+#ifndef _A6XX_HFI_H_
+#define _A6XX_HFI_H_
+
+struct a6xx_hfi_queue_table_header {
+	u32 version;
+	u32 size;		/* Size of the queue table in dwords */
+	u32 qhdr0_offset;	/* Offset of the first queue header */
+	u32 qhdr_size;		/* Size of the queue headers */
+	u32 num_queues;		/* Number of total queues */
+	u32 active_queues;	/* Number of active queues */
+};
+
+struct a6xx_hfi_queue_header {
+	u32 status;
+	u32 iova;
+	u32 type;
+	u32 size;
+	u32 msg_size;
+	u32 dropped;
+	u32 rx_watermark;
+	u32 tx_watermark;
+	u32 rx_request;
+	u32 tx_request;
+	u32 read_index;
+	u32 write_index;
+};
+
+struct a6xx_hfi_queue {
+	struct a6xx_hfi_queue_header *header;
+	spinlock_t lock;
+	u32 *data;
+	atomic_t seqnum;
+
+	/*
+	 * Tracking for the start index of the last N messages in the
+	 * queue, for the benefit of devcore dump / crashdec (since
+	 * parsing in the reverse direction to decode the last N
+	 * messages is difficult to do and would rely on heuristics
+	 * which are not guaranteed to be correct)
+	 */
+#define HFI_HISTORY_SZ 8
+	s32 history[HFI_HISTORY_SZ];
+	u8  history_idx;
+};
+
+/* This is the outgoing queue to the GMU */
+#define HFI_COMMAND_QUEUE 0
+
+/* THis is the incoming response queue from the GMU */
+#define HFI_RESPONSE_QUEUE 1
+
+#define HFI_HEADER_ID(msg) ((msg) & 0xff)
+#define HFI_HEADER_SIZE(msg) (((msg) >> 8) & 0xff)
+#define HFI_HEADER_SEQNUM(msg) (((msg) >> 20) & 0xfff)
+
+/* FIXME: Do we need this or can we use ARRAY_SIZE? */
+#define HFI_RESPONSE_PAYLOAD_SIZE 16
+
+/* HFI message types */
+
+#define HFI_MSG_CMD 0
+#define HFI_MSG_ACK 1
+#define HFI_MSG_ACK_V1 2
+
+#define HFI_F2H_MSG_ACK 126
+
+struct a6xx_hfi_msg_response {
+	u32 header;
+	u32 ret_header;
+	u32 error;
+	u32 payload[HFI_RESPONSE_PAYLOAD_SIZE];
+};
+
+#define HFI_F2H_MSG_ERROR 100
+
+struct a6xx_hfi_msg_error {
+	u32 header;
+	u32 code;
+	u32 payload[2];
+};
+
+#define HFI_H2F_MSG_INIT 0
+
+struct a6xx_hfi_msg_gmu_init_cmd {
+	u32 header;
+	u32 seg_id;
+	u32 dbg_buffer_addr;
+	u32 dbg_buffer_size;
+	u32 boot_state;
+};
+
+#define HFI_H2F_MSG_FW_VERSION 1
+
+struct a6xx_hfi_msg_fw_version {
+	u32 header;
+	u32 supported_version;
+};
+
+#define HFI_H2F_MSG_PERF_TABLE 4
+
+struct perf_level {
+	u32 vote;
+	u32 freq;
+};
+
+struct perf_gx_level {
+	u32 vote;
+	u32 acd;
+	u32 freq;
+};
+
+struct a6xx_hfi_msg_perf_table_v1 {
+	u32 header;
+	u32 num_gpu_levels;
+	u32 num_gmu_levels;
+
+	struct perf_level gx_votes[16];
+	struct perf_level cx_votes[4];
+};
+
+struct a6xx_hfi_msg_perf_table {
+	u32 header;
+	u32 num_gpu_levels;
+	u32 num_gmu_levels;
+
+	struct perf_gx_level gx_votes[16];
+	struct perf_level cx_votes[4];
+};
+
+#define HFI_H2F_MSG_BW_TABLE 3
+
+struct a6xx_hfi_msg_bw_table {
+	u32 header;
+	u32 bw_level_num;
+	u32 cnoc_cmds_num;
+	u32 ddr_cmds_num;
+	u32 cnoc_wait_bitmask;
+	u32 ddr_wait_bitmask;
+	u32 cnoc_cmds_addrs[6];
+	u32 cnoc_cmds_data[2][6];
+	u32 ddr_cmds_addrs[8];
+	u32 ddr_cmds_data[16][8];
+};
+
+#define HFI_H2F_MSG_TEST 5
+
+struct a6xx_hfi_msg_test {
+	u32 header;
+};
+
+#define HFI_H2F_MSG_START 10
+
+struct a6xx_hfi_msg_start {
+	u32 header;
+};
+
+#define HFI_H2F_MSG_CORE_FW_START 14
+
+struct a6xx_hfi_msg_core_fw_start {
+	u32 header;
+	u32 handle;
+};
+
+#define HFI_H2F_MSG_GX_BW_PERF_VOTE 30
+
+struct a6xx_hfi_gx_bw_perf_vote_cmd {
+	u32 header;
+	u32 ack_type;
+	u32 freq;
+	u32 bw;
+};
+
+#define HFI_H2F_MSG_PREPARE_SLUMBER 33
+
+struct a6xx_hfi_prep_slumber_cmd {
+	u32 header;
+	u32 bw;
+	u32 freq;
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/adreno_device.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/adreno_device.c
@@ -0,0 +1,409 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno_gpu.h"
+
+bool hang_debug = false;
+MODULE_PARM_DESC(hang_debug, "Dump registers when hang is detected (can be slow!)");
+module_param_named(hang_debug, hang_debug, bool, 0600);
+
+bool snapshot_debugbus = false;
+MODULE_PARM_DESC(snapshot_debugbus, "Include debugbus sections in GPU devcoredump (if not fused off)");
+module_param_named(snapshot_debugbus, snapshot_debugbus, bool, 0600);
+
+bool allow_vram_carveout = false;
+MODULE_PARM_DESC(allow_vram_carveout, "Allow using VRAM Carveout, in place of IOMMU");
+module_param_named(allow_vram_carveout, allow_vram_carveout, bool, 0600);
+
+extern const struct adreno_gpulist a2xx_gpulist;
+extern const struct adreno_gpulist a3xx_gpulist;
+extern const struct adreno_gpulist a4xx_gpulist;
+extern const struct adreno_gpulist a5xx_gpulist;
+extern const struct adreno_gpulist a6xx_gpulist;
+extern const struct adreno_gpulist a7xx_gpulist;
+
+static const struct adreno_gpulist *gpulists[] = {
+	&a2xx_gpulist,
+	&a3xx_gpulist,
+	&a4xx_gpulist,
+	&a5xx_gpulist,
+	&a6xx_gpulist,
+	&a6xx_gpulist,
+};
+
+static const struct adreno_info *adreno_info(uint32_t chip_id)
+{
+	/* identify gpu: */
+	for (int i = 0; i < ARRAY_SIZE(gpulists); i++) {
+		for (int j = 0; j < gpulists[i]->gpus_count; j++) {
+			const struct adreno_info *info = &gpulists[i]->gpus[j];
+
+			if (info->machine && !of_machine_is_compatible(info->machine))
+				continue;
+
+			for (int k = 0; info->chip_ids[k]; k++)
+				if (info->chip_ids[k] == chip_id)
+					return info;
+		}
+	}
+
+	return NULL;
+}
+
+struct msm_gpu *adreno_load_gpu(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct platform_device *pdev = priv->gpu_pdev;
+	struct msm_gpu *gpu = NULL;
+	struct adreno_gpu *adreno_gpu;
+	int ret;
+
+	if (pdev)
+		gpu = dev_to_gpu(&pdev->dev);
+
+	if (!gpu) {
+		dev_err_once(dev->dev, "no GPU device was found\n");
+		return NULL;
+	}
+
+	adreno_gpu = to_adreno_gpu(gpu);
+
+	/*
+	 * The number one reason for HW init to fail is if the firmware isn't
+	 * loaded yet. Try that first and don't bother continuing on
+	 * otherwise
+	 */
+
+	ret = adreno_load_fw(adreno_gpu);
+	if (ret)
+		return NULL;
+
+	if (gpu->funcs->ucode_load) {
+		ret = gpu->funcs->ucode_load(gpu);
+		if (ret)
+			return NULL;
+	}
+
+	/*
+	 * Now that we have firmware loaded, and are ready to begin
+	 * booting the gpu, go ahead and enable runpm:
+	 */
+	pm_runtime_enable(&pdev->dev);
+
+	ret = pm_runtime_get_sync(&pdev->dev);
+	if (ret < 0) {
+		pm_runtime_put_noidle(&pdev->dev);
+		DRM_DEV_ERROR(dev->dev, "Couldn't power up the GPU: %d\n", ret);
+		goto err_disable_rpm;
+	}
+
+	mutex_lock(&gpu->lock);
+	ret = msm_gpu_hw_init(gpu);
+	mutex_unlock(&gpu->lock);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "gpu hw init failed: %d\n", ret);
+		goto err_put_rpm;
+	}
+
+	pm_runtime_put_autosuspend(&pdev->dev);
+
+#ifdef CONFIG_DEBUG_FS
+	if (gpu->funcs->debugfs_init) {
+		gpu->funcs->debugfs_init(gpu, dev->primary);
+		gpu->funcs->debugfs_init(gpu, dev->render);
+	}
+#endif
+
+	return gpu;
+
+err_put_rpm:
+	pm_runtime_put_sync_suspend(&pdev->dev);
+err_disable_rpm:
+	pm_runtime_disable(&pdev->dev);
+
+	return NULL;
+}
+
+static int find_chipid(struct device *dev, uint32_t *chipid)
+{
+	struct device_node *node = dev->of_node;
+	const char *compat;
+	int ret;
+
+	/* first search the compat strings for qcom,adreno-XYZ.W: */
+	ret = of_property_read_string_index(node, "compatible", 0, &compat);
+	if (ret == 0) {
+		unsigned int r, patch;
+
+		if (sscanf(compat, "qcom,adreno-%u.%u", &r, &patch) == 2 ||
+		    sscanf(compat, "amd,imageon-%u.%u", &r, &patch) == 2) {
+			uint32_t core, major, minor;
+
+			core = r / 100;
+			r %= 100;
+			major = r / 10;
+			r %= 10;
+			minor = r;
+
+			*chipid = (core << 24) |
+				(major << 16) |
+				(minor << 8) |
+				patch;
+
+			return 0;
+		}
+
+		if (sscanf(compat, "qcom,adreno-%08x", chipid) == 1)
+			return 0;
+	}
+
+	/* and if that fails, fall back to legacy "qcom,chipid" property: */
+	ret = of_property_read_u32(node, "qcom,chipid", chipid);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "could not parse qcom,chipid: %d\n", ret);
+		return ret;
+	}
+
+	dev_warn(dev, "Using legacy qcom,chipid binding!\n");
+
+	return 0;
+}
+
+static int adreno_bind(struct device *dev, struct device *master, void *data)
+{
+	static struct adreno_platform_config config = {};
+	const struct adreno_info *info;
+	struct msm_drm_private *priv = dev_get_drvdata(master);
+	struct drm_device *drm = priv->dev;
+	struct msm_gpu *gpu;
+	int ret;
+
+	ret = find_chipid(dev, &config.chip_id);
+	if (ret)
+		return ret;
+
+	dev->platform_data = &config;
+	priv->gpu_pdev = to_platform_device(dev);
+
+	info = adreno_info(config.chip_id);
+	if (!info) {
+		dev_warn(drm->dev, "Unknown GPU revision: %"ADRENO_CHIPID_FMT"\n",
+			ADRENO_CHIPID_ARGS(config.chip_id));
+		return -ENXIO;
+	}
+
+	config.info = info;
+
+	DBG("Found GPU: %"ADRENO_CHIPID_FMT, ADRENO_CHIPID_ARGS(config.chip_id));
+
+	priv->is_a2xx = info->family < ADRENO_3XX;
+	priv->has_cached_coherent =
+		!!(info->quirks & ADRENO_QUIRK_HAS_CACHED_COHERENT);
+
+	gpu = info->init(drm);
+	if (IS_ERR(gpu)) {
+		dev_warn(drm->dev, "failed to load adreno gpu\n");
+		return PTR_ERR(gpu);
+	}
+
+	ret = dev_pm_opp_of_find_icc_paths(dev, NULL);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int adreno_system_suspend(struct device *dev);
+static void adreno_unbind(struct device *dev, struct device *master,
+		void *data)
+{
+	struct msm_drm_private *priv = dev_get_drvdata(master);
+	struct msm_gpu *gpu = dev_to_gpu(dev);
+
+	if (pm_runtime_enabled(dev))
+		WARN_ON_ONCE(adreno_system_suspend(dev));
+	gpu->funcs->destroy(gpu);
+
+	priv->gpu_pdev = NULL;
+}
+
+static const struct component_ops a3xx_ops = {
+	.bind   = adreno_bind,
+	.unbind = adreno_unbind,
+};
+
+static void adreno_device_register_headless(void)
+{
+	/* on imx5, we don't have a top-level mdp/dpu node
+	 * this creates a dummy node for the driver for that case
+	 */
+	struct platform_device_info dummy_info = {
+		.parent = NULL,
+		.name = "msm",
+		.id = -1,
+		.res = NULL,
+		.num_res = 0,
+		.data = NULL,
+		.size_data = 0,
+		.dma_mask = ~0,
+	};
+	platform_device_register_full(&dummy_info);
+}
+
+static int adreno_probe(struct platform_device *pdev)
+{
+
+	int ret;
+
+	ret = component_add(&pdev->dev, &a3xx_ops);
+	if (ret)
+		return ret;
+
+	if (of_device_is_compatible(pdev->dev.of_node, "amd,imageon"))
+		adreno_device_register_headless();
+
+	return 0;
+}
+
+static void adreno_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &a3xx_ops);
+}
+
+static void adreno_shutdown(struct platform_device *pdev)
+{
+	WARN_ON_ONCE(adreno_system_suspend(&pdev->dev));
+}
+
+static const struct of_device_id dt_match[] = {
+	{ .compatible = "qcom,adreno" },
+	{ .compatible = "qcom,adreno-3xx" },
+	/* for compatibility with imx5 gpu: */
+	{ .compatible = "amd,imageon" },
+	/* for backwards compat w/ downstream kgsl DT files: */
+	{ .compatible = "qcom,kgsl-3d0" },
+	{}
+};
+
+static int adreno_runtime_resume(struct device *dev)
+{
+	struct msm_gpu *gpu = dev_to_gpu(dev);
+
+	return gpu->funcs->pm_resume(gpu);
+}
+
+static int adreno_runtime_suspend(struct device *dev)
+{
+	struct msm_gpu *gpu = dev_to_gpu(dev);
+
+	/*
+	 * We should be holding a runpm ref, which will prevent
+	 * runtime suspend.  In the system suspend path, we've
+	 * already waited for active jobs to complete.
+	 */
+	WARN_ON_ONCE(gpu->active_submits);
+
+	return gpu->funcs->pm_suspend(gpu);
+}
+
+static void suspend_scheduler(struct msm_gpu *gpu)
+{
+	int i;
+
+	/*
+	 * Shut down the scheduler before we force suspend, so that
+	 * suspend isn't racing with scheduler kthread feeding us
+	 * more work.
+	 *
+	 * Note, we just want to park the thread, and let any jobs
+	 * that are already on the hw queue complete normally, as
+	 * opposed to the drm_sched_stop() path used for handling
+	 * faulting/timed-out jobs.  We can't really cancel any jobs
+	 * already on the hw queue without racing with the GPU.
+	 */
+	for (i = 0; i < gpu->nr_rings; i++) {
+		struct drm_gpu_scheduler *sched = &gpu->rb[i]->sched;
+
+		drm_sched_wqueue_stop(sched);
+	}
+}
+
+static void resume_scheduler(struct msm_gpu *gpu)
+{
+	int i;
+
+	for (i = 0; i < gpu->nr_rings; i++) {
+		struct drm_gpu_scheduler *sched = &gpu->rb[i]->sched;
+
+		drm_sched_wqueue_start(sched);
+	}
+}
+
+static int adreno_system_suspend(struct device *dev)
+{
+	struct msm_gpu *gpu = dev_to_gpu(dev);
+	int remaining, ret;
+
+	if (!gpu)
+		return 0;
+
+	suspend_scheduler(gpu);
+
+	remaining = wait_event_timeout(gpu->retire_event,
+				       gpu->active_submits == 0,
+				       msecs_to_jiffies(1000));
+	if (remaining == 0) {
+		dev_err(dev, "Timeout waiting for GPU to suspend\n");
+		ret = -EBUSY;
+		goto out;
+	}
+
+	ret = pm_runtime_force_suspend(dev);
+out:
+	if (ret)
+		resume_scheduler(gpu);
+
+	return ret;
+}
+
+static int adreno_system_resume(struct device *dev)
+{
+	struct msm_gpu *gpu = dev_to_gpu(dev);
+
+	if (!gpu)
+		return 0;
+
+	resume_scheduler(gpu);
+	return pm_runtime_force_resume(dev);
+}
+
+static const struct dev_pm_ops adreno_pm_ops = {
+	SYSTEM_SLEEP_PM_OPS(adreno_system_suspend, adreno_system_resume)
+	RUNTIME_PM_OPS(adreno_runtime_suspend, adreno_runtime_resume, NULL)
+};
+
+static struct platform_driver adreno_driver = {
+	.probe = adreno_probe,
+	.remove_new = adreno_remove,
+	.shutdown = adreno_shutdown,
+	.driver = {
+		.name = "adreno",
+		.of_match_table = dt_match,
+		.pm = &adreno_pm_ops,
+	},
+};
+
+void __init adreno_register(void)
+{
+	platform_driver_register(&adreno_driver);
+}
+
+void __exit adreno_unregister(void)
+{
+	platform_driver_unregister(&adreno_driver);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/adreno_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/adreno_gpu.c
@@ -0,0 +1,1151 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/ascii85.h>
+#include <linux/interconnect.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/kernel.h>
+#include <linux/of_address.h>
+#include <linux/pm_opp.h>
+#include <linux/slab.h>
+#include <linux/soc/qcom/mdt_loader.h>
+#include <linux/nvmem-consumer.h>
+#include <soc/qcom/ocmem.h>
+#include "adreno_gpu.h"
+#include "a6xx_gpu.h"
+#include "msm_gem.h"
+#include "msm_mmu.h"
+
+static u64 address_space_size = 0;
+MODULE_PARM_DESC(address_space_size, "Override for size of processes private GPU address space");
+module_param(address_space_size, ullong, 0600);
+
+static bool zap_available = true;
+
+static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname,
+		u32 pasid)
+{
+	struct device *dev = &gpu->pdev->dev;
+	const struct firmware *fw;
+	const char *signed_fwname = NULL;
+	struct device_node *np, *mem_np;
+	struct resource r;
+	phys_addr_t mem_phys;
+	ssize_t mem_size;
+	void *mem_region = NULL;
+	int ret;
+
+	if (!IS_ENABLED(CONFIG_ARCH_QCOM)) {
+		zap_available = false;
+		return -EINVAL;
+	}
+
+	np = of_get_child_by_name(dev->of_node, "zap-shader");
+	if (!np) {
+		zap_available = false;
+		return -ENODEV;
+	}
+
+	mem_np = of_parse_phandle(np, "memory-region", 0);
+	of_node_put(np);
+	if (!mem_np) {
+		zap_available = false;
+		return -EINVAL;
+	}
+
+	ret = of_address_to_resource(mem_np, 0, &r);
+	of_node_put(mem_np);
+	if (ret)
+		return ret;
+
+	mem_phys = r.start;
+
+	/*
+	 * Check for a firmware-name property.  This is the new scheme
+	 * to handle firmware that may be signed with device specific
+	 * keys, allowing us to have a different zap fw path for different
+	 * devices.
+	 *
+	 * If the firmware-name property is found, we bypass the
+	 * adreno_request_fw() mechanism, because we don't need to handle
+	 * the /lib/firmware/qcom/... vs /lib/firmware/... case.
+	 *
+	 * If the firmware-name property is not found, for backwards
+	 * compatibility we fall back to the fwname from the gpulist
+	 * table.
+	 */
+	of_property_read_string_index(np, "firmware-name", 0, &signed_fwname);
+	if (signed_fwname) {
+		fwname = signed_fwname;
+		ret = request_firmware_direct(&fw, fwname, gpu->dev->dev);
+		if (ret)
+			fw = ERR_PTR(ret);
+	} else if (fwname) {
+		/* Request the MDT file from the default location: */
+		fw = adreno_request_fw(to_adreno_gpu(gpu), fwname);
+	} else {
+		/*
+		 * For new targets, we require the firmware-name property,
+		 * if a zap-shader is required, rather than falling back
+		 * to a firmware name specified in gpulist.
+		 *
+		 * Because the firmware is signed with a (potentially)
+		 * device specific key, having the name come from gpulist
+		 * was a bad idea, and is only provided for backwards
+		 * compatibility for older targets.
+		 */
+		return -ENOENT;
+	}
+
+	if (IS_ERR(fw)) {
+		DRM_DEV_ERROR(dev, "Unable to load %s\n", fwname);
+		return PTR_ERR(fw);
+	}
+
+	/* Figure out how much memory we need */
+	mem_size = qcom_mdt_get_size(fw);
+	if (mem_size < 0) {
+		ret = mem_size;
+		goto out;
+	}
+
+	if (mem_size > resource_size(&r)) {
+		DRM_DEV_ERROR(dev,
+			"memory region is too small to load the MDT\n");
+		ret = -E2BIG;
+		goto out;
+	}
+
+	/* Allocate memory for the firmware image */
+	mem_region = memremap(mem_phys, mem_size,  MEMREMAP_WC);
+	if (!mem_region) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	/*
+	 * Load the rest of the MDT
+	 *
+	 * Note that we could be dealing with two different paths, since
+	 * with upstream linux-firmware it would be in a qcom/ subdir..
+	 * adreno_request_fw() handles this, but qcom_mdt_load() does
+	 * not.  But since we've already gotten through adreno_request_fw()
+	 * we know which of the two cases it is:
+	 */
+	if (signed_fwname || (to_adreno_gpu(gpu)->fwloc == FW_LOCATION_LEGACY)) {
+		ret = qcom_mdt_load(dev, fw, fwname, pasid,
+				mem_region, mem_phys, mem_size, NULL);
+	} else {
+		char *newname;
+
+		newname = kasprintf(GFP_KERNEL, "qcom/%s", fwname);
+
+		ret = qcom_mdt_load(dev, fw, newname, pasid,
+				mem_region, mem_phys, mem_size, NULL);
+		kfree(newname);
+	}
+	if (ret)
+		goto out;
+
+	/* Send the image to the secure world */
+	ret = qcom_scm_pas_auth_and_reset(pasid);
+
+	/*
+	 * If the scm call returns -EOPNOTSUPP we assume that this target
+	 * doesn't need/support the zap shader so quietly fail
+	 */
+	if (ret == -EOPNOTSUPP)
+		zap_available = false;
+	else if (ret)
+		DRM_DEV_ERROR(dev, "Unable to authorize the image\n");
+
+out:
+	if (mem_region)
+		memunmap(mem_region);
+
+	release_firmware(fw);
+
+	return ret;
+}
+
+int adreno_zap_shader_load(struct msm_gpu *gpu, u32 pasid)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct platform_device *pdev = gpu->pdev;
+
+	/* Short cut if we determine the zap shader isn't available/needed */
+	if (!zap_available)
+		return -ENODEV;
+
+	/* We need SCM to be able to load the firmware */
+	if (!qcom_scm_is_available()) {
+		DRM_DEV_ERROR(&pdev->dev, "SCM is not available\n");
+		return -EPROBE_DEFER;
+	}
+
+	return zap_shader_load_mdt(gpu, adreno_gpu->info->zapfw, pasid);
+}
+
+struct msm_gem_address_space *
+adreno_create_address_space(struct msm_gpu *gpu,
+			    struct platform_device *pdev)
+{
+	return adreno_iommu_create_address_space(gpu, pdev, 0);
+}
+
+struct msm_gem_address_space *
+adreno_iommu_create_address_space(struct msm_gpu *gpu,
+				  struct platform_device *pdev,
+				  unsigned long quirks)
+{
+	struct iommu_domain_geometry *geometry;
+	struct msm_mmu *mmu;
+	struct msm_gem_address_space *aspace;
+	u64 start, size;
+
+	mmu = msm_iommu_gpu_new(&pdev->dev, gpu, quirks);
+	if (IS_ERR_OR_NULL(mmu))
+		return ERR_CAST(mmu);
+
+	geometry = msm_iommu_get_geometry(mmu);
+	if (IS_ERR(geometry))
+		return ERR_CAST(geometry);
+
+	/*
+	 * Use the aperture start or SZ_16M, whichever is greater. This will
+	 * ensure that we align with the allocated pagetable range while still
+	 * allowing room in the lower 32 bits for GMEM and whatnot
+	 */
+	start = max_t(u64, SZ_16M, geometry->aperture_start);
+	size = geometry->aperture_end - start + 1;
+
+	aspace = msm_gem_address_space_create(mmu, "gpu",
+		start & GENMASK_ULL(48, 0), size);
+
+	if (IS_ERR(aspace) && !IS_ERR(mmu))
+		mmu->funcs->destroy(mmu);
+
+	return aspace;
+}
+
+u64 adreno_private_address_space_size(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+
+	if (address_space_size)
+		return address_space_size;
+
+	if (adreno_gpu->info->address_space_size)
+		return adreno_gpu->info->address_space_size;
+
+	return SZ_4G;
+}
+
+#define ARM_SMMU_FSR_TF                 BIT(1)
+#define ARM_SMMU_FSR_PF			BIT(3)
+#define ARM_SMMU_FSR_EF			BIT(4)
+
+int adreno_fault_handler(struct msm_gpu *gpu, unsigned long iova, int flags,
+			 struct adreno_smmu_fault_info *info, const char *block,
+			 u32 scratch[4])
+{
+	const char *type = "UNKNOWN";
+	bool do_devcoredump = info && !READ_ONCE(gpu->crashstate);
+
+	/*
+	 * If we aren't going to be resuming later from fault_worker, then do
+	 * it now.
+	 */
+	if (!do_devcoredump) {
+		gpu->aspace->mmu->funcs->resume_translation(gpu->aspace->mmu);
+	}
+
+	/*
+	 * Print a default message if we couldn't get the data from the
+	 * adreno-smmu-priv
+	 */
+	if (!info) {
+		pr_warn_ratelimited("*** gpu fault: iova=%.16lx flags=%d (%u,%u,%u,%u)\n",
+			iova, flags,
+			scratch[0], scratch[1], scratch[2], scratch[3]);
+
+		return 0;
+	}
+
+	if (info->fsr & ARM_SMMU_FSR_TF)
+		type = "TRANSLATION";
+	else if (info->fsr & ARM_SMMU_FSR_PF)
+		type = "PERMISSION";
+	else if (info->fsr & ARM_SMMU_FSR_EF)
+		type = "EXTERNAL";
+
+	pr_warn_ratelimited("*** gpu fault: ttbr0=%.16llx iova=%.16lx dir=%s type=%s source=%s (%u,%u,%u,%u)\n",
+			info->ttbr0, iova,
+			flags & IOMMU_FAULT_WRITE ? "WRITE" : "READ",
+			type, block,
+			scratch[0], scratch[1], scratch[2], scratch[3]);
+
+	if (do_devcoredump) {
+		/* Turn off the hangcheck timer to keep it from bothering us */
+		del_timer(&gpu->hangcheck_timer);
+
+		gpu->fault_info.ttbr0 = info->ttbr0;
+		gpu->fault_info.iova  = iova;
+		gpu->fault_info.flags = flags;
+		gpu->fault_info.type  = type;
+		gpu->fault_info.block = block;
+
+		kthread_queue_work(gpu->worker, &gpu->fault_work);
+	}
+
+	return 0;
+}
+
+int adreno_get_param(struct msm_gpu *gpu, struct msm_file_private *ctx,
+		     uint32_t param, uint64_t *value, uint32_t *len)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+
+	/* No pointer params yet */
+	if (*len != 0)
+		return -EINVAL;
+
+	switch (param) {
+	case MSM_PARAM_GPU_ID:
+		*value = adreno_gpu->info->revn;
+		return 0;
+	case MSM_PARAM_GMEM_SIZE:
+		*value = adreno_gpu->info->gmem;
+		return 0;
+	case MSM_PARAM_GMEM_BASE:
+		if (adreno_is_a650_family(adreno_gpu) ||
+		    adreno_is_a740_family(adreno_gpu))
+			*value = 0;
+		else
+			*value = 0x100000;
+		return 0;
+	case MSM_PARAM_CHIP_ID:
+		*value = adreno_gpu->chip_id;
+		if (!adreno_gpu->info->revn)
+			*value |= ((uint64_t) adreno_gpu->speedbin) << 32;
+		return 0;
+	case MSM_PARAM_MAX_FREQ:
+		*value = adreno_gpu->base.fast_rate;
+		return 0;
+	case MSM_PARAM_TIMESTAMP:
+		if (adreno_gpu->funcs->get_timestamp) {
+			int ret;
+
+			pm_runtime_get_sync(&gpu->pdev->dev);
+			ret = adreno_gpu->funcs->get_timestamp(gpu, value);
+			pm_runtime_put_autosuspend(&gpu->pdev->dev);
+
+			return ret;
+		}
+		return -EINVAL;
+	case MSM_PARAM_PRIORITIES:
+		*value = gpu->nr_rings * NR_SCHED_PRIORITIES;
+		return 0;
+	case MSM_PARAM_PP_PGTABLE:
+		*value = 0;
+		return 0;
+	case MSM_PARAM_FAULTS:
+		if (ctx->aspace)
+			*value = gpu->global_faults + ctx->aspace->faults;
+		else
+			*value = gpu->global_faults;
+		return 0;
+	case MSM_PARAM_SUSPENDS:
+		*value = gpu->suspend_count;
+		return 0;
+	case MSM_PARAM_VA_START:
+		if (ctx->aspace == gpu->aspace)
+			return -EINVAL;
+		*value = ctx->aspace->va_start;
+		return 0;
+	case MSM_PARAM_VA_SIZE:
+		if (ctx->aspace == gpu->aspace)
+			return -EINVAL;
+		*value = ctx->aspace->va_size;
+		return 0;
+	case MSM_PARAM_HIGHEST_BANK_BIT:
+		*value = adreno_gpu->ubwc_config.highest_bank_bit;
+		return 0;
+	default:
+		DBG("%s: invalid param: %u", gpu->name, param);
+		return -EINVAL;
+	}
+}
+
+int adreno_set_param(struct msm_gpu *gpu, struct msm_file_private *ctx,
+		     uint32_t param, uint64_t value, uint32_t len)
+{
+	switch (param) {
+	case MSM_PARAM_COMM:
+	case MSM_PARAM_CMDLINE:
+		/* kstrdup_quotable_cmdline() limits to PAGE_SIZE, so
+		 * that should be a reasonable upper bound
+		 */
+		if (len > PAGE_SIZE)
+			return -EINVAL;
+		break;
+	default:
+		if (len != 0)
+			return -EINVAL;
+	}
+
+	switch (param) {
+	case MSM_PARAM_COMM:
+	case MSM_PARAM_CMDLINE: {
+		char *str, **paramp;
+
+		str = memdup_user_nul(u64_to_user_ptr(value), len);
+		if (IS_ERR(str))
+			return PTR_ERR(str);
+
+		mutex_lock(&gpu->lock);
+
+		if (param == MSM_PARAM_COMM) {
+			paramp = &ctx->comm;
+		} else {
+			paramp = &ctx->cmdline;
+		}
+
+		kfree(*paramp);
+		*paramp = str;
+
+		mutex_unlock(&gpu->lock);
+
+		return 0;
+	}
+	case MSM_PARAM_SYSPROF:
+		if (!capable(CAP_SYS_ADMIN))
+			return -EPERM;
+		return msm_file_private_set_sysprof(ctx, gpu, value);
+	default:
+		DBG("%s: invalid param: %u", gpu->name, param);
+		return -EINVAL;
+	}
+}
+
+const struct firmware *
+adreno_request_fw(struct adreno_gpu *adreno_gpu, const char *fwname)
+{
+	struct drm_device *drm = adreno_gpu->base.dev;
+	const struct firmware *fw = NULL;
+	char *newname;
+	int ret;
+
+	newname = kasprintf(GFP_KERNEL, "qcom/%s", fwname);
+	if (!newname)
+		return ERR_PTR(-ENOMEM);
+
+	/*
+	 * Try first to load from qcom/$fwfile using a direct load (to avoid
+	 * a potential timeout waiting for usermode helper)
+	 */
+	if ((adreno_gpu->fwloc == FW_LOCATION_UNKNOWN) ||
+	    (adreno_gpu->fwloc == FW_LOCATION_NEW)) {
+
+		ret = request_firmware_direct(&fw, newname, drm->dev);
+		if (!ret) {
+			DRM_DEV_INFO(drm->dev, "loaded %s from new location\n",
+				newname);
+			adreno_gpu->fwloc = FW_LOCATION_NEW;
+			goto out;
+		} else if (adreno_gpu->fwloc != FW_LOCATION_UNKNOWN) {
+			DRM_DEV_ERROR(drm->dev, "failed to load %s: %d\n",
+				newname, ret);
+			fw = ERR_PTR(ret);
+			goto out;
+		}
+	}
+
+	/*
+	 * Then try the legacy location without qcom/ prefix
+	 */
+	if ((adreno_gpu->fwloc == FW_LOCATION_UNKNOWN) ||
+	    (adreno_gpu->fwloc == FW_LOCATION_LEGACY)) {
+
+		ret = request_firmware_direct(&fw, fwname, drm->dev);
+		if (!ret) {
+			DRM_DEV_INFO(drm->dev, "loaded %s from legacy location\n",
+				fwname);
+			adreno_gpu->fwloc = FW_LOCATION_LEGACY;
+			goto out;
+		} else if (adreno_gpu->fwloc != FW_LOCATION_UNKNOWN) {
+			DRM_DEV_ERROR(drm->dev, "failed to load %s: %d\n",
+				fwname, ret);
+			fw = ERR_PTR(ret);
+			goto out;
+		}
+	}
+
+	/*
+	 * Finally fall back to request_firmware() for cases where the
+	 * usermode helper is needed (I think mainly android)
+	 */
+	if ((adreno_gpu->fwloc == FW_LOCATION_UNKNOWN) ||
+	    (adreno_gpu->fwloc == FW_LOCATION_HELPER)) {
+
+		ret = request_firmware(&fw, newname, drm->dev);
+		if (!ret) {
+			DRM_DEV_INFO(drm->dev, "loaded %s with helper\n",
+				newname);
+			adreno_gpu->fwloc = FW_LOCATION_HELPER;
+			goto out;
+		} else if (adreno_gpu->fwloc != FW_LOCATION_UNKNOWN) {
+			DRM_DEV_ERROR(drm->dev, "failed to load %s: %d\n",
+				newname, ret);
+			fw = ERR_PTR(ret);
+			goto out;
+		}
+	}
+
+	DRM_DEV_ERROR(drm->dev, "failed to load %s\n", fwname);
+	fw = ERR_PTR(-ENOENT);
+out:
+	kfree(newname);
+	return fw;
+}
+
+int adreno_load_fw(struct adreno_gpu *adreno_gpu)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++) {
+		const struct firmware *fw;
+
+		if (!adreno_gpu->info->fw[i])
+			continue;
+
+		/* Skip loading GMU firwmare with GMU Wrapper */
+		if (adreno_has_gmu_wrapper(adreno_gpu) && i == ADRENO_FW_GMU)
+			continue;
+
+		/* Skip if the firmware has already been loaded */
+		if (adreno_gpu->fw[i])
+			continue;
+
+		fw = adreno_request_fw(adreno_gpu, adreno_gpu->info->fw[i]);
+		if (IS_ERR(fw))
+			return PTR_ERR(fw);
+
+		adreno_gpu->fw[i] = fw;
+	}
+
+	return 0;
+}
+
+struct drm_gem_object *adreno_fw_create_bo(struct msm_gpu *gpu,
+		const struct firmware *fw, u64 *iova)
+{
+	struct drm_gem_object *bo;
+	void *ptr;
+
+	ptr = msm_gem_kernel_new(gpu->dev, fw->size - 4,
+		MSM_BO_WC | MSM_BO_GPU_READONLY, gpu->aspace, &bo, iova);
+
+	if (IS_ERR(ptr))
+		return ERR_CAST(ptr);
+
+	memcpy(ptr, &fw->data[4], fw->size - 4);
+
+	msm_gem_put_vaddr(bo);
+
+	return bo;
+}
+
+int adreno_hw_init(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int ret;
+
+	VERB("%s", gpu->name);
+
+	if (adreno_gpu->info->family >= ADRENO_6XX_GEN1 &&
+	    qcom_scm_set_gpu_smmu_aperture_is_available()) {
+		/* We currently always use context bank 0, so hard code this */
+		ret = qcom_scm_set_gpu_smmu_aperture(0);
+		if (ret)
+			DRM_DEV_ERROR(gpu->dev->dev, "unable to set SMMU aperture: %d\n", ret);
+	}
+
+	for (int i = 0; i < gpu->nr_rings; i++) {
+		struct msm_ringbuffer *ring = gpu->rb[i];
+
+		if (!ring)
+			continue;
+
+		ring->cur = ring->start;
+		ring->next = ring->start;
+		ring->memptrs->rptr = 0;
+		ring->memptrs->bv_fence = ring->fctx->completed_fence;
+
+		/* Detect and clean up an impossible fence, ie. if GPU managed
+		 * to scribble something invalid, we don't want that to confuse
+		 * us into mistakingly believing that submits have completed.
+		 */
+		if (fence_before(ring->fctx->last_fence, ring->memptrs->fence)) {
+			ring->memptrs->fence = ring->fctx->last_fence;
+		}
+	}
+
+	return 0;
+}
+
+/* Use this helper to read rptr, since a430 doesn't update rptr in memory */
+static uint32_t get_rptr(struct adreno_gpu *adreno_gpu,
+		struct msm_ringbuffer *ring)
+{
+	struct msm_gpu *gpu = &adreno_gpu->base;
+
+	return gpu->funcs->get_rptr(gpu, ring);
+}
+
+struct msm_ringbuffer *adreno_active_ring(struct msm_gpu *gpu)
+{
+	return gpu->rb[0];
+}
+
+void adreno_recover(struct msm_gpu *gpu)
+{
+	struct drm_device *dev = gpu->dev;
+	int ret;
+
+	// XXX pm-runtime??  we *need* the device to be off after this
+	// so maybe continuing to call ->pm_suspend/resume() is better?
+
+	gpu->funcs->pm_suspend(gpu);
+	gpu->funcs->pm_resume(gpu);
+
+	ret = msm_gpu_hw_init(gpu);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "gpu hw init failed: %d\n", ret);
+		/* hmm, oh well? */
+	}
+}
+
+void adreno_flush(struct msm_gpu *gpu, struct msm_ringbuffer *ring, u32 reg)
+{
+	uint32_t wptr;
+
+	/* Copy the shadow to the actual register */
+	ring->cur = ring->next;
+
+	/*
+	 * Mask wptr value that we calculate to fit in the HW range. This is
+	 * to account for the possibility that the last command fit exactly into
+	 * the ringbuffer and rb->next hasn't wrapped to zero yet
+	 */
+	wptr = get_wptr(ring);
+
+	/* ensure writes to ringbuffer have hit system memory: */
+	mb();
+
+	gpu_write(gpu, reg, wptr);
+}
+
+bool adreno_idle(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	uint32_t wptr = get_wptr(ring);
+
+	/* wait for CP to drain ringbuffer: */
+	if (!spin_until(get_rptr(adreno_gpu, ring) == wptr))
+		return true;
+
+	/* TODO maybe we need to reset GPU here to recover from hang? */
+	DRM_ERROR("%s: timeout waiting to drain ringbuffer %d rptr/wptr = %X/%X\n",
+		gpu->name, ring->id, get_rptr(adreno_gpu, ring), wptr);
+
+	return false;
+}
+
+int adreno_gpu_state_get(struct msm_gpu *gpu, struct msm_gpu_state *state)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int i, count = 0;
+
+	WARN_ON(!mutex_is_locked(&gpu->lock));
+
+	kref_init(&state->ref);
+
+	ktime_get_real_ts64(&state->time);
+
+	for (i = 0; i < gpu->nr_rings; i++) {
+		int size = 0, j;
+
+		state->ring[i].fence = gpu->rb[i]->memptrs->fence;
+		state->ring[i].iova = gpu->rb[i]->iova;
+		state->ring[i].seqno = gpu->rb[i]->fctx->last_fence;
+		state->ring[i].rptr = get_rptr(adreno_gpu, gpu->rb[i]);
+		state->ring[i].wptr = get_wptr(gpu->rb[i]);
+
+		/* Copy at least 'wptr' dwords of the data */
+		size = state->ring[i].wptr;
+
+		/* After wptr find the last non zero dword to save space */
+		for (j = state->ring[i].wptr; j < MSM_GPU_RINGBUFFER_SZ >> 2; j++)
+			if (gpu->rb[i]->start[j])
+				size = j + 1;
+
+		if (size) {
+			state->ring[i].data = kvmalloc(size << 2, GFP_KERNEL);
+			if (state->ring[i].data) {
+				memcpy(state->ring[i].data, gpu->rb[i]->start, size << 2);
+				state->ring[i].data_size = size << 2;
+			}
+		}
+	}
+
+	/* Some targets prefer to collect their own registers */
+	if (!adreno_gpu->registers)
+		return 0;
+
+	/* Count the number of registers */
+	for (i = 0; adreno_gpu->registers[i] != ~0; i += 2)
+		count += adreno_gpu->registers[i + 1] -
+			adreno_gpu->registers[i] + 1;
+
+	state->registers = kcalloc(count * 2, sizeof(u32), GFP_KERNEL);
+	if (state->registers) {
+		int pos = 0;
+
+		for (i = 0; adreno_gpu->registers[i] != ~0; i += 2) {
+			u32 start = adreno_gpu->registers[i];
+			u32 end   = adreno_gpu->registers[i + 1];
+			u32 addr;
+
+			for (addr = start; addr <= end; addr++) {
+				state->registers[pos++] = addr;
+				state->registers[pos++] = gpu_read(gpu, addr);
+			}
+		}
+
+		state->nr_registers = count;
+	}
+
+	return 0;
+}
+
+void adreno_gpu_state_destroy(struct msm_gpu_state *state)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(state->ring); i++)
+		kvfree(state->ring[i].data);
+
+	for (i = 0; state->bos && i < state->nr_bos; i++)
+		kvfree(state->bos[i].data);
+
+	kfree(state->bos);
+	kfree(state->comm);
+	kfree(state->cmd);
+	kfree(state->registers);
+}
+
+static void adreno_gpu_state_kref_destroy(struct kref *kref)
+{
+	struct msm_gpu_state *state = container_of(kref,
+		struct msm_gpu_state, ref);
+
+	adreno_gpu_state_destroy(state);
+	kfree(state);
+}
+
+int adreno_gpu_state_put(struct msm_gpu_state *state)
+{
+	if (IS_ERR_OR_NULL(state))
+		return 1;
+
+	return kref_put(&state->ref, adreno_gpu_state_kref_destroy);
+}
+
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
+
+static char *adreno_gpu_ascii85_encode(u32 *src, size_t len)
+{
+	void *buf;
+	size_t buf_itr = 0, buffer_size;
+	char out[ASCII85_BUFSZ];
+	long l;
+	int i;
+
+	if (!src || !len)
+		return NULL;
+
+	l = ascii85_encode_len(len);
+
+	/*
+	 * Ascii85 outputs either a 5 byte string or a 1 byte string. So we
+	 * account for the worst case of 5 bytes per dword plus the 1 for '\0'
+	 */
+	buffer_size = (l * 5) + 1;
+
+	buf = kvmalloc(buffer_size, GFP_KERNEL);
+	if (!buf)
+		return NULL;
+
+	for (i = 0; i < l; i++)
+		buf_itr += scnprintf(buf + buf_itr, buffer_size - buf_itr, "%s",
+				ascii85_encode(src[i], out));
+
+	return buf;
+}
+
+/* len is expected to be in bytes
+ *
+ * WARNING: *ptr should be allocated with kvmalloc or friends.  It can be free'd
+ * with kvfree() and replaced with a newly kvmalloc'd buffer on the first call
+ * when the unencoded raw data is encoded
+ */
+void adreno_show_object(struct drm_printer *p, void **ptr, int len,
+		bool *encoded)
+{
+	if (!*ptr || !len)
+		return;
+
+	if (!*encoded) {
+		long datalen, i;
+		u32 *buf = *ptr;
+
+		/*
+		 * Only dump the non-zero part of the buffer - rarely will
+		 * any data completely fill the entire allocated size of
+		 * the buffer.
+		 */
+		for (datalen = 0, i = 0; i < len >> 2; i++)
+			if (buf[i])
+				datalen = ((i + 1) << 2);
+
+		/*
+		 * If we reach here, then the originally captured binary buffer
+		 * will be replaced with the ascii85 encoded string
+		 */
+		*ptr = adreno_gpu_ascii85_encode(buf, datalen);
+
+		kvfree(buf);
+
+		*encoded = true;
+	}
+
+	if (!*ptr)
+		return;
+
+	drm_puts(p, "    data: !!ascii85 |\n");
+	drm_puts(p, "     ");
+
+	drm_puts(p, *ptr);
+
+	drm_puts(p, "\n");
+}
+
+void adreno_show(struct msm_gpu *gpu, struct msm_gpu_state *state,
+		struct drm_printer *p)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int i;
+
+	if (IS_ERR_OR_NULL(state))
+		return;
+
+	drm_printf(p, "revision: %u (%"ADRENO_CHIPID_FMT")\n",
+			adreno_gpu->info->revn,
+			ADRENO_CHIPID_ARGS(adreno_gpu->chip_id));
+	/*
+	 * If this is state collected due to iova fault, so fault related info
+	 *
+	 * TTBR0 would not be zero, so this is a good way to distinguish
+	 */
+	if (state->fault_info.ttbr0) {
+		const struct msm_gpu_fault_info *info = &state->fault_info;
+
+		drm_puts(p, "fault-info:\n");
+		drm_printf(p, "  - ttbr0=%.16llx\n", info->ttbr0);
+		drm_printf(p, "  - iova=%.16lx\n", info->iova);
+		drm_printf(p, "  - dir=%s\n", info->flags & IOMMU_FAULT_WRITE ? "WRITE" : "READ");
+		drm_printf(p, "  - type=%s\n", info->type);
+		drm_printf(p, "  - source=%s\n", info->block);
+	}
+
+	drm_printf(p, "rbbm-status: 0x%08x\n", state->rbbm_status);
+
+	drm_puts(p, "ringbuffer:\n");
+
+	for (i = 0; i < gpu->nr_rings; i++) {
+		drm_printf(p, "  - id: %d\n", i);
+		drm_printf(p, "    iova: 0x%016llx\n", state->ring[i].iova);
+		drm_printf(p, "    last-fence: %u\n", state->ring[i].seqno);
+		drm_printf(p, "    retired-fence: %u\n", state->ring[i].fence);
+		drm_printf(p, "    rptr: %u\n", state->ring[i].rptr);
+		drm_printf(p, "    wptr: %u\n", state->ring[i].wptr);
+		drm_printf(p, "    size: %u\n", MSM_GPU_RINGBUFFER_SZ);
+
+		adreno_show_object(p, &state->ring[i].data,
+			state->ring[i].data_size, &state->ring[i].encoded);
+	}
+
+	if (state->bos) {
+		drm_puts(p, "bos:\n");
+
+		for (i = 0; i < state->nr_bos; i++) {
+			drm_printf(p, "  - iova: 0x%016llx\n",
+				state->bos[i].iova);
+			drm_printf(p, "    size: %zd\n", state->bos[i].size);
+			drm_printf(p, "    name: %-32s\n", state->bos[i].name);
+
+			adreno_show_object(p, &state->bos[i].data,
+				state->bos[i].size, &state->bos[i].encoded);
+		}
+	}
+
+	if (state->nr_registers) {
+		drm_puts(p, "registers:\n");
+
+		for (i = 0; i < state->nr_registers; i++) {
+			drm_printf(p, "  - { offset: 0x%04x, value: 0x%08x }\n",
+				state->registers[i * 2] << 2,
+				state->registers[(i * 2) + 1]);
+		}
+	}
+}
+#endif
+
+/* Dump common gpu status and scratch registers on any hang, to make
+ * the hangcheck logs more useful.  The scratch registers seem always
+ * safe to read when GPU has hung (unlike some other regs, depending
+ * on how the GPU hung), and they are useful to match up to cmdstream
+ * dumps when debugging hangs:
+ */
+void adreno_dump_info(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int i;
+
+	printk("revision: %u (%"ADRENO_CHIPID_FMT")\n",
+			adreno_gpu->info->revn,
+			ADRENO_CHIPID_ARGS(adreno_gpu->chip_id));
+
+	for (i = 0; i < gpu->nr_rings; i++) {
+		struct msm_ringbuffer *ring = gpu->rb[i];
+
+		printk("rb %d: fence:    %d/%d\n", i,
+			ring->memptrs->fence,
+			ring->fctx->last_fence);
+
+		printk("rptr:     %d\n", get_rptr(adreno_gpu, ring));
+		printk("rb wptr:  %d\n", get_wptr(ring));
+	}
+}
+
+/* would be nice to not have to duplicate the _show() stuff with printk(): */
+void adreno_dump(struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	int i;
+
+	if (!adreno_gpu->registers)
+		return;
+
+	/* dump these out in a form that can be parsed by demsm: */
+	printk("IO:region %s 00000000 00020000\n", gpu->name);
+	for (i = 0; adreno_gpu->registers[i] != ~0; i += 2) {
+		uint32_t start = adreno_gpu->registers[i];
+		uint32_t end   = adreno_gpu->registers[i+1];
+		uint32_t addr;
+
+		for (addr = start; addr <= end; addr++) {
+			uint32_t val = gpu_read(gpu, addr);
+			printk("IO:R %08x %08x\n", addr<<2, val);
+		}
+	}
+}
+
+static uint32_t ring_freewords(struct msm_ringbuffer *ring)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(ring->gpu);
+	uint32_t size = MSM_GPU_RINGBUFFER_SZ >> 2;
+	/* Use ring->next to calculate free size */
+	uint32_t wptr = ring->next - ring->start;
+	uint32_t rptr = get_rptr(adreno_gpu, ring);
+	return (rptr + (size - 1) - wptr) % size;
+}
+
+void adreno_wait_ring(struct msm_ringbuffer *ring, uint32_t ndwords)
+{
+	if (spin_until(ring_freewords(ring) >= ndwords))
+		DRM_DEV_ERROR(ring->gpu->dev->dev,
+			"timeout waiting for space in ringbuffer %d\n",
+			ring->id);
+}
+
+static int adreno_get_pwrlevels(struct device *dev,
+		struct msm_gpu *gpu)
+{
+	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	unsigned long freq = ULONG_MAX;
+	struct dev_pm_opp *opp;
+	int ret;
+
+	gpu->fast_rate = 0;
+
+	/* devm_pm_opp_of_add_table may error out but will still create an OPP table */
+	ret = devm_pm_opp_of_add_table(dev);
+	if (ret == -ENODEV) {
+		/* Special cases for ancient hw with ancient DT bindings */
+		if (adreno_is_a2xx(adreno_gpu)) {
+			dev_warn(dev, "Unable to find the OPP table. Falling back to 200 MHz.\n");
+			dev_pm_opp_add(dev, 200000000, 0);
+		} else if (adreno_is_a320(adreno_gpu)) {
+			dev_warn(dev, "Unable to find the OPP table. Falling back to 450 MHz.\n");
+			dev_pm_opp_add(dev, 450000000, 0);
+		} else {
+			DRM_DEV_ERROR(dev, "Unable to find the OPP table\n");
+			return -ENODEV;
+		}
+	} else if (ret) {
+		DRM_DEV_ERROR(dev, "Unable to set the OPP table\n");
+		return ret;
+	}
+
+	/* Find the fastest defined rate */
+	opp = dev_pm_opp_find_freq_floor(dev, &freq);
+	if (IS_ERR(opp))
+		return PTR_ERR(opp);
+
+	gpu->fast_rate = freq;
+	dev_pm_opp_put(opp);
+
+	DBG("fast_rate=%u, slow_rate=27000000", gpu->fast_rate);
+
+	return 0;
+}
+
+int adreno_gpu_ocmem_init(struct device *dev, struct adreno_gpu *adreno_gpu,
+			  struct adreno_ocmem *adreno_ocmem)
+{
+	struct ocmem_buf *ocmem_hdl;
+	struct ocmem *ocmem;
+
+	ocmem = of_get_ocmem(dev);
+	if (IS_ERR(ocmem)) {
+		if (PTR_ERR(ocmem) == -ENODEV) {
+			/*
+			 * Return success since either the ocmem property was
+			 * not specified in device tree, or ocmem support is
+			 * not compiled into the kernel.
+			 */
+			return 0;
+		}
+
+		return PTR_ERR(ocmem);
+	}
+
+	ocmem_hdl = ocmem_allocate(ocmem, OCMEM_GRAPHICS, adreno_gpu->info->gmem);
+	if (IS_ERR(ocmem_hdl))
+		return PTR_ERR(ocmem_hdl);
+
+	adreno_ocmem->ocmem = ocmem;
+	adreno_ocmem->base = ocmem_hdl->addr;
+	adreno_ocmem->hdl = ocmem_hdl;
+
+	if (WARN_ON(ocmem_hdl->len != adreno_gpu->info->gmem))
+		return -ENOMEM;
+
+	return 0;
+}
+
+void adreno_gpu_ocmem_cleanup(struct adreno_ocmem *adreno_ocmem)
+{
+	if (adreno_ocmem && adreno_ocmem->base)
+		ocmem_free(adreno_ocmem->ocmem, OCMEM_GRAPHICS,
+			   adreno_ocmem->hdl);
+}
+
+int adreno_read_speedbin(struct device *dev, u32 *speedbin)
+{
+	return nvmem_cell_read_variable_le_u32(dev, "speed_bin", speedbin);
+}
+
+int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+		struct adreno_gpu *adreno_gpu,
+		const struct adreno_gpu_funcs *funcs, int nr_rings)
+{
+	struct device *dev = &pdev->dev;
+	struct adreno_platform_config *config = dev->platform_data;
+	struct msm_gpu_config adreno_gpu_config  = { 0 };
+	struct msm_gpu *gpu = &adreno_gpu->base;
+	const char *gpu_name;
+	u32 speedbin;
+	int ret;
+
+	adreno_gpu->funcs = funcs;
+	adreno_gpu->info = config->info;
+	adreno_gpu->chip_id = config->chip_id;
+
+	gpu->allow_relocs = config->info->family < ADRENO_6XX_GEN1;
+	gpu->pdev = pdev;
+
+	/* Only handle the core clock when GMU is not in use (or is absent). */
+	if (adreno_has_gmu_wrapper(adreno_gpu) ||
+	    adreno_gpu->info->family < ADRENO_6XX_GEN1) {
+		/*
+		 * This can only be done before devm_pm_opp_of_add_table(), or
+		 * dev_pm_opp_set_config() will WARN_ON()
+		 */
+		if (IS_ERR(devm_clk_get(dev, "core"))) {
+			/*
+			 * If "core" is absent, go for the legacy clock name.
+			 * If we got this far in probing, it's a given one of
+			 * them exists.
+			 */
+			devm_pm_opp_set_clkname(dev, "core_clk");
+		} else
+			devm_pm_opp_set_clkname(dev, "core");
+	}
+
+	if (adreno_read_speedbin(dev, &speedbin) || !speedbin)
+		speedbin = 0xffff;
+	adreno_gpu->speedbin = (uint16_t) (0xffff & speedbin);
+
+	gpu_name = devm_kasprintf(dev, GFP_KERNEL, "%"ADRENO_CHIPID_FMT,
+			ADRENO_CHIPID_ARGS(config->chip_id));
+	if (!gpu_name)
+		return -ENOMEM;
+
+	adreno_gpu_config.ioname = "kgsl_3d0_reg_memory";
+
+	adreno_gpu_config.nr_rings = nr_rings;
+
+	ret = adreno_get_pwrlevels(dev, gpu);
+	if (ret)
+		return ret;
+
+	pm_runtime_set_autosuspend_delay(dev,
+		adreno_gpu->info->inactive_period);
+	pm_runtime_use_autosuspend(dev);
+
+	return msm_gpu_init(drm, pdev, &adreno_gpu->base, &funcs->base,
+			gpu_name, &adreno_gpu_config);
+}
+
+void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu)
+{
+	struct msm_gpu *gpu = &adreno_gpu->base;
+	struct msm_drm_private *priv = gpu->dev ? gpu->dev->dev_private : NULL;
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++)
+		release_firmware(adreno_gpu->fw[i]);
+
+	if (priv && pm_runtime_enabled(&priv->gpu_pdev->dev))
+		pm_runtime_disable(&priv->gpu_pdev->dev);
+
+	msm_gpu_cleanup(&adreno_gpu->base);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/adreno/adreno_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/adreno/adreno_gpu.h
@@ -0,0 +1,688 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ *
+ * Copyright (c) 2014,2017, 2019 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __ADRENO_GPU_H__
+#define __ADRENO_GPU_H__
+
+#include <linux/firmware.h>
+#include <linux/iopoll.h>
+
+#include "msm_gpu.h"
+
+#include "adreno_common.xml.h"
+#include "adreno_pm4.xml.h"
+
+extern bool snapshot_debugbus;
+extern bool allow_vram_carveout;
+
+enum {
+	ADRENO_FW_PM4 = 0,
+	ADRENO_FW_SQE = 0, /* a6xx */
+	ADRENO_FW_PFP = 1,
+	ADRENO_FW_GMU = 1, /* a6xx */
+	ADRENO_FW_GPMU = 2,
+	ADRENO_FW_MAX,
+};
+
+/**
+ * @enum adreno_family: identify generation and possibly sub-generation
+ *
+ * In some cases there are distinct sub-generations within a major revision
+ * so it helps to be able to group the GPU devices by generation and if
+ * necessary sub-generation.
+ */
+enum adreno_family {
+	ADRENO_2XX_GEN1,  /* a20x */
+	ADRENO_2XX_GEN2,  /* a22x */
+	ADRENO_3XX,
+	ADRENO_4XX,
+	ADRENO_5XX,
+	ADRENO_6XX_GEN1,  /* a630 family */
+	ADRENO_6XX_GEN2,  /* a640 family */
+	ADRENO_6XX_GEN3,  /* a650 family */
+	ADRENO_6XX_GEN4,  /* a660 family */
+	ADRENO_7XX_GEN1,  /* a730 family */
+	ADRENO_7XX_GEN2,  /* a740 family */
+	ADRENO_7XX_GEN3,  /* a750 family */
+};
+
+#define ADRENO_QUIRK_TWO_PASS_USE_WFI		BIT(0)
+#define ADRENO_QUIRK_FAULT_DETECT_MASK		BIT(1)
+#define ADRENO_QUIRK_LMLOADKILL_DISABLE		BIT(2)
+#define ADRENO_QUIRK_HAS_HW_APRIV		BIT(3)
+#define ADRENO_QUIRK_HAS_CACHED_COHERENT	BIT(4)
+
+/* Helper for formating the chip_id in the way that userspace tools like
+ * crashdec expect.
+ */
+#define ADRENO_CHIPID_FMT "u.%u.%u.%u"
+#define ADRENO_CHIPID_ARGS(_c) \
+	(((_c) >> 24) & 0xff), \
+	(((_c) >> 16) & 0xff), \
+	(((_c) >> 8)  & 0xff), \
+	((_c) & 0xff)
+
+struct adreno_gpu_funcs {
+	struct msm_gpu_funcs base;
+	int (*get_timestamp)(struct msm_gpu *gpu, uint64_t *value);
+};
+
+struct adreno_reglist {
+	u32 offset;
+	u32 value;
+};
+
+struct adreno_speedbin {
+	uint16_t fuse;
+	uint16_t speedbin;
+};
+
+struct a6xx_info;
+
+struct adreno_info {
+	const char *machine;
+	/**
+	 * @chipids: Table of matching chip-ids
+	 *
+	 * Terminated with 0 sentinal
+	 */
+	uint32_t *chip_ids;
+	enum adreno_family family;
+	uint32_t revn;
+	const char *fw[ADRENO_FW_MAX];
+	uint32_t gmem;
+	u64 quirks;
+	struct msm_gpu *(*init)(struct drm_device *dev);
+	const char *zapfw;
+	u32 inactive_period;
+	union {
+		const struct a6xx_info *a6xx;
+	};
+	u64 address_space_size;
+	/**
+	 * @speedbins: Optional table of fuse to speedbin mappings
+	 *
+	 * Consists of pairs of fuse, index mappings, terminated with
+	 * {SHRT_MAX, 0} sentinal.
+	 */
+	struct adreno_speedbin *speedbins;
+};
+
+#define ADRENO_CHIP_IDS(tbl...) (uint32_t[]) { tbl, 0 }
+
+struct adreno_gpulist {
+	const struct adreno_info *gpus;
+	unsigned gpus_count;
+};
+
+#define DECLARE_ADRENO_GPULIST(name)                  \
+const struct adreno_gpulist name ## _gpulist = {      \
+	name ## _gpus, ARRAY_SIZE(name ## _gpus)      \
+}
+
+/*
+ * Helper to build a speedbin table, ie. the table:
+ *      fuse | speedbin
+ *      -----+---------
+ *        0  |   0
+ *       169 |   1
+ *       174 |   2
+ *
+ * would be declared as:
+ *
+ *     .speedbins = ADRENO_SPEEDBINS(
+ *                      { 0,   0 },
+ *                      { 169, 1 },
+ *                      { 174, 2 },
+ *     ),
+ */
+#define ADRENO_SPEEDBINS(tbl...) (struct adreno_speedbin[]) { tbl {SHRT_MAX, 0} }
+
+struct adreno_protect {
+	const uint32_t *regs;
+	uint32_t count;
+	uint32_t count_max;
+};
+
+#define DECLARE_ADRENO_PROTECT(name, __count_max)	\
+static const struct adreno_protect name = {		\
+	.regs = name ## _regs,				\
+	.count = ARRAY_SIZE(name ## _regs),		\
+	.count_max = __count_max,			\
+};
+
+struct adreno_gpu {
+	struct msm_gpu base;
+	const struct adreno_info *info;
+	uint32_t chip_id;
+	uint16_t speedbin;
+	const struct adreno_gpu_funcs *funcs;
+
+	/* interesting register offsets to dump: */
+	const unsigned int *registers;
+
+	/*
+	 * Are we loading fw from legacy path?  Prior to addition
+	 * of gpu firmware to linux-firmware, the fw files were
+	 * placed in toplevel firmware directory, following qcom's
+	 * android kernel.  But linux-firmware preferred they be
+	 * placed in a 'qcom' subdirectory.
+	 *
+	 * For backwards compatibility, we try first to load from
+	 * the new path, using request_firmware_direct() to avoid
+	 * any potential timeout waiting for usermode helper, then
+	 * fall back to the old path (with direct load).  And
+	 * finally fall back to request_firmware() with the new
+	 * path to allow the usermode helper.
+	 */
+	enum {
+		FW_LOCATION_UNKNOWN = 0,
+		FW_LOCATION_NEW,       /* /lib/firmware/qcom/$fwfile */
+		FW_LOCATION_LEGACY,    /* /lib/firmware/$fwfile */
+		FW_LOCATION_HELPER,
+	} fwloc;
+
+	/* firmware: */
+	const struct firmware *fw[ADRENO_FW_MAX];
+
+	struct {
+		/**
+		 * @rgb565_predicator: Unknown, introduced with A650 family,
+		 * related to UBWC mode/ver 4
+		 */
+		u32 rgb565_predicator;
+		/** @uavflagprd_inv: Unknown, introduced with A650 family */
+		u32 uavflagprd_inv;
+		/** @min_acc_len: Whether the minimum access length is 64 bits */
+		u32 min_acc_len;
+		/**
+		 * @ubwc_swizzle: Whether to enable level 1, 2 & 3 bank swizzling.
+		 *
+		 * UBWC 1.0 always enables all three levels.
+		 * UBWC 2.0 removes level 1 bank swizzling, leaving levels 2 & 3.
+		 * UBWC 4.0 adds the optional ability to disable levels 2 & 3.
+		 *
+		 * This is a bitmask where BIT(0) enables level 1, BIT(1)
+		 * controls level 2, and BIT(2) enables level 3.
+		 */
+		u32 ubwc_swizzle;
+		/**
+		 * @highest_bank_bit: Highest Bank Bit
+		 *
+		 * The Highest Bank Bit value represents the bit of the highest
+		 * DDR bank.  This should ideally use DRAM type detection.
+		 */
+		u32 highest_bank_bit;
+		u32 amsbc;
+		/**
+		 * @macrotile_mode: Macrotile Mode
+		 *
+		 * Whether to use 4-channel macrotiling mode or the newer
+		 * 8-channel macrotiling mode introduced in UBWC 3.1. 0 is
+		 * 4-channel and 1 is 8-channel.
+		 */
+		u32 macrotile_mode;
+	} ubwc_config;
+
+	/*
+	 * Register offsets are different between some GPUs.
+	 * GPU specific offsets will be exported by GPU specific
+	 * code (a3xx_gpu.c) and stored in this common location.
+	 */
+	const unsigned int *reg_offsets;
+	bool gmu_is_wrapper;
+};
+#define to_adreno_gpu(x) container_of(x, struct adreno_gpu, base)
+
+struct adreno_ocmem {
+	struct ocmem *ocmem;
+	unsigned long base;
+	void *hdl;
+};
+
+/* platform config data (ie. from DT, or pdata) */
+struct adreno_platform_config {
+	uint32_t chip_id;
+	const struct adreno_info *info;
+};
+
+#define ADRENO_IDLE_TIMEOUT msecs_to_jiffies(1000)
+
+#define spin_until(X) ({                                   \
+	int __ret = -ETIMEDOUT;                            \
+	unsigned long __t = jiffies + ADRENO_IDLE_TIMEOUT; \
+	do {                                               \
+		if (X) {                                   \
+			__ret = 0;                         \
+			break;                             \
+		}                                          \
+	} while (time_before(jiffies, __t));               \
+	__ret;                                             \
+})
+
+static inline uint8_t adreno_patchid(const struct adreno_gpu *gpu)
+{
+	/* It is probably ok to assume legacy "adreno_rev" format
+	 * for all a6xx devices, but probably best to limit this
+	 * to older things.
+	 */
+	WARN_ON_ONCE(gpu->info->family >= ADRENO_6XX_GEN1);
+	return gpu->chip_id & 0xff;
+}
+
+static inline bool adreno_is_revn(const struct adreno_gpu *gpu, uint32_t revn)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+	return gpu->info->revn == revn;
+}
+
+static inline bool adreno_has_gmu_wrapper(const struct adreno_gpu *gpu)
+{
+	return gpu->gmu_is_wrapper;
+}
+
+static inline bool adreno_is_a2xx(const struct adreno_gpu *gpu)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+	return gpu->info->family <= ADRENO_2XX_GEN2;
+}
+
+static inline bool adreno_is_a20x(const struct adreno_gpu *gpu)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+	return gpu->info->family == ADRENO_2XX_GEN1;
+}
+
+static inline bool adreno_is_a225(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 225);
+}
+
+static inline bool adreno_is_a305(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 305);
+}
+
+static inline bool adreno_is_a305b(const struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x03000512;
+}
+
+static inline bool adreno_is_a306(const struct adreno_gpu *gpu)
+{
+	/* yes, 307, because a305c is 306 */
+	return adreno_is_revn(gpu, 307);
+}
+
+static inline bool adreno_is_a320(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 320);
+}
+
+static inline bool adreno_is_a330(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 330);
+}
+
+static inline bool adreno_is_a330v2(const struct adreno_gpu *gpu)
+{
+	return adreno_is_a330(gpu) && (adreno_patchid(gpu) > 0);
+}
+
+static inline int adreno_is_a405(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 405);
+}
+
+static inline int adreno_is_a420(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 420);
+}
+
+static inline int adreno_is_a430(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 430);
+}
+
+static inline int adreno_is_a506(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 506);
+}
+
+static inline int adreno_is_a508(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 508);
+}
+
+static inline int adreno_is_a509(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 509);
+}
+
+static inline int adreno_is_a510(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 510);
+}
+
+static inline int adreno_is_a512(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 512);
+}
+
+static inline int adreno_is_a530(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 530);
+}
+
+static inline int adreno_is_a540(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 540);
+}
+
+static inline int adreno_is_a610(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 610);
+}
+
+static inline int adreno_is_a618(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 618);
+}
+
+static inline int adreno_is_a619(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 619);
+}
+
+static inline int adreno_is_a619_holi(const struct adreno_gpu *gpu)
+{
+	return adreno_is_a619(gpu) && adreno_has_gmu_wrapper(gpu);
+}
+
+static inline int adreno_is_a630(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 630);
+}
+
+static inline int adreno_is_a640(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 640);
+}
+
+static inline int adreno_is_a650(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 650);
+}
+
+static inline int adreno_is_7c3(const struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x06030500;
+}
+
+static inline int adreno_is_a660(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 660);
+}
+
+static inline int adreno_is_a680(const struct adreno_gpu *gpu)
+{
+	return adreno_is_revn(gpu, 680);
+}
+
+static inline int adreno_is_a663(const struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x06060300;
+}
+
+static inline int adreno_is_a690(const struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x06090000;
+}
+
+static inline int adreno_is_a702(const struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x07000200;
+}
+
+static inline int adreno_is_a610_family(const struct adreno_gpu *gpu)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+
+	/* TODO: A612 */
+	return adreno_is_a610(gpu) || adreno_is_a702(gpu);
+}
+
+/* check for a615, a616, a618, a619 or any a630 derivatives */
+static inline int adreno_is_a630_family(const struct adreno_gpu *gpu)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+	return gpu->info->family == ADRENO_6XX_GEN1;
+}
+
+static inline int adreno_is_a660_family(const struct adreno_gpu *gpu)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+	return gpu->info->family == ADRENO_6XX_GEN4;
+}
+
+/* check for a650, a660, or any derivatives */
+static inline int adreno_is_a650_family(const struct adreno_gpu *gpu)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+	return gpu->info->family == ADRENO_6XX_GEN3 ||
+	       gpu->info->family == ADRENO_6XX_GEN4;
+}
+
+static inline int adreno_is_a640_family(const struct adreno_gpu *gpu)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+	return gpu->info->family == ADRENO_6XX_GEN2;
+}
+
+static inline int adreno_is_a730(struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x07030001;
+}
+
+static inline int adreno_is_a740(struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x43050a01;
+}
+
+static inline int adreno_is_a750(struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x43051401;
+}
+
+static inline int adreno_is_x185(struct adreno_gpu *gpu)
+{
+	return gpu->info->chip_ids[0] == 0x43050c01;
+}
+
+static inline int adreno_is_a740_family(struct adreno_gpu *gpu)
+{
+	if (WARN_ON_ONCE(!gpu->info))
+		return false;
+	return gpu->info->family == ADRENO_7XX_GEN2 ||
+	       gpu->info->family == ADRENO_7XX_GEN3;
+}
+
+static inline int adreno_is_a7xx(struct adreno_gpu *gpu)
+{
+	/* Update with non-fake (i.e. non-A702) Gen 7 GPUs */
+	return gpu->info->family == ADRENO_7XX_GEN1 ||
+	       adreno_is_a740_family(gpu);
+}
+
+u64 adreno_private_address_space_size(struct msm_gpu *gpu);
+int adreno_get_param(struct msm_gpu *gpu, struct msm_file_private *ctx,
+		     uint32_t param, uint64_t *value, uint32_t *len);
+int adreno_set_param(struct msm_gpu *gpu, struct msm_file_private *ctx,
+		     uint32_t param, uint64_t value, uint32_t len);
+const struct firmware *adreno_request_fw(struct adreno_gpu *adreno_gpu,
+		const char *fwname);
+struct drm_gem_object *adreno_fw_create_bo(struct msm_gpu *gpu,
+		const struct firmware *fw, u64 *iova);
+int adreno_hw_init(struct msm_gpu *gpu);
+void adreno_recover(struct msm_gpu *gpu);
+void adreno_flush(struct msm_gpu *gpu, struct msm_ringbuffer *ring, u32 reg);
+bool adreno_idle(struct msm_gpu *gpu, struct msm_ringbuffer *ring);
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
+void adreno_show(struct msm_gpu *gpu, struct msm_gpu_state *state,
+		struct drm_printer *p);
+#endif
+void adreno_dump_info(struct msm_gpu *gpu);
+void adreno_dump(struct msm_gpu *gpu);
+void adreno_wait_ring(struct msm_ringbuffer *ring, uint32_t ndwords);
+struct msm_ringbuffer *adreno_active_ring(struct msm_gpu *gpu);
+
+int adreno_gpu_ocmem_init(struct device *dev, struct adreno_gpu *adreno_gpu,
+			  struct adreno_ocmem *ocmem);
+void adreno_gpu_ocmem_cleanup(struct adreno_ocmem *ocmem);
+
+int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+		struct adreno_gpu *gpu, const struct adreno_gpu_funcs *funcs,
+		int nr_rings);
+void adreno_gpu_cleanup(struct adreno_gpu *gpu);
+int adreno_load_fw(struct adreno_gpu *adreno_gpu);
+
+void adreno_gpu_state_destroy(struct msm_gpu_state *state);
+
+int adreno_gpu_state_get(struct msm_gpu *gpu, struct msm_gpu_state *state);
+int adreno_gpu_state_put(struct msm_gpu_state *state);
+void adreno_show_object(struct drm_printer *p, void **ptr, int len,
+		bool *encoded);
+
+/*
+ * Common helper function to initialize the default address space for arm-smmu
+ * attached targets
+ */
+struct msm_gem_address_space *
+adreno_create_address_space(struct msm_gpu *gpu,
+			    struct platform_device *pdev);
+
+struct msm_gem_address_space *
+adreno_iommu_create_address_space(struct msm_gpu *gpu,
+				  struct platform_device *pdev,
+				  unsigned long quirks);
+
+int adreno_fault_handler(struct msm_gpu *gpu, unsigned long iova, int flags,
+			 struct adreno_smmu_fault_info *info, const char *block,
+			 u32 scratch[4]);
+
+int adreno_read_speedbin(struct device *dev, u32 *speedbin);
+
+/*
+ * For a5xx and a6xx targets load the zap shader that is used to pull the GPU
+ * out of secure mode
+ */
+int adreno_zap_shader_load(struct msm_gpu *gpu, u32 pasid);
+
+/* ringbuffer helpers (the parts that are adreno specific) */
+
+static inline void
+OUT_PKT0(struct msm_ringbuffer *ring, uint16_t regindx, uint16_t cnt)
+{
+	adreno_wait_ring(ring, cnt+1);
+	OUT_RING(ring, CP_TYPE0_PKT | ((cnt-1) << 16) | (regindx & 0x7FFF));
+}
+
+/* no-op packet: */
+static inline void
+OUT_PKT2(struct msm_ringbuffer *ring)
+{
+	adreno_wait_ring(ring, 1);
+	OUT_RING(ring, CP_TYPE2_PKT);
+}
+
+static inline void
+OUT_PKT3(struct msm_ringbuffer *ring, uint8_t opcode, uint16_t cnt)
+{
+	adreno_wait_ring(ring, cnt+1);
+	OUT_RING(ring, CP_TYPE3_PKT | ((cnt-1) << 16) | ((opcode & 0xFF) << 8));
+}
+
+static inline u32 PM4_PARITY(u32 val)
+{
+	return (0x9669 >> (0xF & (val ^
+		(val >> 4) ^ (val >> 8) ^ (val >> 12) ^
+		(val >> 16) ^ ((val) >> 20) ^ (val >> 24) ^
+		(val >> 28)))) & 1;
+}
+
+/* Maximum number of values that can be executed for one opcode */
+#define TYPE4_MAX_PAYLOAD 127
+
+#define PKT4(_reg, _cnt) \
+	(CP_TYPE4_PKT | ((_cnt) << 0) | (PM4_PARITY((_cnt)) << 7) | \
+	 (((_reg) & 0x3FFFF) << 8) | (PM4_PARITY((_reg)) << 27))
+
+static inline void
+OUT_PKT4(struct msm_ringbuffer *ring, uint16_t regindx, uint16_t cnt)
+{
+	adreno_wait_ring(ring, cnt + 1);
+	OUT_RING(ring, PKT4(regindx, cnt));
+}
+
+static inline void
+OUT_PKT7(struct msm_ringbuffer *ring, uint8_t opcode, uint16_t cnt)
+{
+	adreno_wait_ring(ring, cnt + 1);
+	OUT_RING(ring, CP_TYPE7_PKT | (cnt << 0) | (PM4_PARITY(cnt) << 15) |
+		((opcode & 0x7F) << 16) | (PM4_PARITY(opcode) << 23));
+}
+
+struct msm_gpu *a2xx_gpu_init(struct drm_device *dev);
+struct msm_gpu *a3xx_gpu_init(struct drm_device *dev);
+struct msm_gpu *a4xx_gpu_init(struct drm_device *dev);
+struct msm_gpu *a5xx_gpu_init(struct drm_device *dev);
+struct msm_gpu *a6xx_gpu_init(struct drm_device *dev);
+
+static inline uint32_t get_wptr(struct msm_ringbuffer *ring)
+{
+	return (ring->cur - ring->start) % (MSM_GPU_RINGBUFFER_SZ >> 2);
+}
+
+/*
+ * Given a register and a count, return a value to program into
+ * REG_CP_PROTECT_REG(n) - this will block both reads and writes for _len
+ * registers starting at _reg.
+ *
+ * The register base needs to be a multiple of the length. If it is not, the
+ * hardware will quietly mask off the bits for you and shift the size. For
+ * example, if you intend the protection to start at 0x07 for a length of 4
+ * (0x07-0x0A) the hardware will actually protect (0x04-0x07) which might
+ * expose registers you intended to protect!
+ */
+#define ADRENO_PROTECT_RW(_reg, _len) \
+	((1 << 30) | (1 << 29) | \
+	((ilog2((_len)) & 0x1F) << 24) | (((_reg) << 2) & 0xFFFFF))
+
+/*
+ * Same as above, but allow reads over the range. For areas of mixed use (such
+ * as performance counters) this allows us to protect a much larger range with a
+ * single register
+ */
+#define ADRENO_PROTECT_RDONLY(_reg, _len) \
+	((1 << 29) \
+	((ilog2((_len)) & 0x1F) << 24) | (((_reg) << 2) & 0xFFFFF))
+
+
+#define gpu_poll_timeout(gpu, addr, val, cond, interval, timeout) \
+	readl_poll_timeout((gpu)->mmio + ((addr) << 2), val, cond, \
+		interval, timeout)
+
+#endif /* __ADRENO_GPU_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_10_0_sm8650.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_10_0_sm8650.h
@@ -0,0 +1,457 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_10_0_SM8650_H
+#define _DPU_10_0_SM8650_H
+
+static const struct dpu_caps sm8650_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 8192,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sm8650_mdp = {
+	.name = "top_0",
+	.base = 0, .len = 0x494,
+	.features = BIT(DPU_MDP_PERIPH_0_REMOVED),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg sm8650_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x1000,
+		.features = CTL_SM8550_MASK | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x1000,
+		.features = CTL_SM8550_MASK | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x1000,
+		.features = CTL_SM8550_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x1000,
+		.features = CTL_SM8550_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x19000, .len = 0x1000,
+		.features = CTL_SM8550_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a000, .len = 0x1000,
+		.features = CTL_SM8550_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sm8650_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x344,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_3,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x344,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_3,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x344,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_3,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x344,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_3,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x344,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x344,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x344,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x344,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_12", .id = SSPP_DMA4,
+		.base = 0x2c000, .len = 0x344,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 14,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_13", .id = SSPP_DMA5,
+		.base = 0x2e000, .len = 0x344,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 15,
+		.type = SSPP_TYPE_DMA,
+	},
+};
+
+static const struct dpu_lm_cfg sm8650_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sm8650_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sm8650_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x6d000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x6e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	}, {
+		.name = "pingpong_6", .id = PINGPONG_6,
+		.base = 0x66000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	}, {
+		.name = "pingpong_7", .id = PINGPONG_7,
+		.base = 0x66400, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	}, {
+		.name = "pingpong_8", .id = PINGPONG_8,
+		.base = 0x7e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_4,
+	}, {
+		.name = "pingpong_9", .id = PINGPONG_9,
+		.base = 0x7e400, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_4,
+	},
+};
+
+static const struct dpu_merge_3d_cfg sm8650_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x4e000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x4f000, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x50000, .len = 0x8,
+	}, {
+		.name = "merge_3d_3", .id = MERGE_3D_3,
+		.base = 0x66700, .len = 0x8,
+	}, {
+		.name = "merge_3d_4", .id = MERGE_3D_4,
+		.base = 0x7e700, .len = 0x8,
+	},
+};
+
+/*
+ * NOTE: Each display compression engine (DCE) contains dual hard
+ * slice DSC encoders so both share same base address but with
+ * its own different sub block address.
+ */
+static const struct dpu_dsc_cfg sm8650_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x6,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_0_1", .id = DSC_1,
+		.base = 0x80000, .len = 0x6,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_1_0", .id = DSC_2,
+		.base = 0x81000, .len = 0x6,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_1_1", .id = DSC_3,
+		.base = 0x81000, .len = 0x6,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_2_0", .id = DSC_4,
+		.base = 0x82000, .len = 0x6,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_2_1", .id = DSC_5,
+		.base = 0x82000, .len = 0x6,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	},
+};
+
+static const struct dpu_wb_cfg sm8650_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb),
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+
+static const struct dpu_intf_cfg sm8650_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x36000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x37000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	},
+};
+
+static const struct dpu_perf_cfg sm8650_perf_data = {
+	.max_bw_low = 17000000,
+	.max_bw_high = 27000000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 35,
+	/* FIXME: lut tables */
+	.danger_lut_tbl = {0x3ffff, 0x3ffff, 0x0},
+	.safe_lut_tbl = {0xfe00, 0xfe00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc7180_qos_linear),
+		.entries = sc7180_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm8650_mdss_ver = {
+	.core_major_ver = 10,
+	.core_minor_ver = 0,
+};
+
+const struct dpu_mdss_cfg dpu_sm8650_cfg = {
+	.mdss_ver = &sm8650_mdss_ver,
+	.caps = &sm8650_dpu_caps,
+	.mdp = &sm8650_mdp,
+	.ctl_count = ARRAY_SIZE(sm8650_ctl),
+	.ctl = sm8650_ctl,
+	.sspp_count = ARRAY_SIZE(sm8650_sspp),
+	.sspp = sm8650_sspp,
+	.mixer_count = ARRAY_SIZE(sm8650_lm),
+	.mixer = sm8650_lm,
+	.dspp_count = ARRAY_SIZE(sm8650_dspp),
+	.dspp = sm8650_dspp,
+	.pingpong_count = ARRAY_SIZE(sm8650_pp),
+	.pingpong = sm8650_pp,
+	.dsc_count = ARRAY_SIZE(sm8650_dsc),
+	.dsc = sm8650_dsc,
+	.merge_3d_count = ARRAY_SIZE(sm8650_merge_3d),
+	.merge_3d = sm8650_merge_3d,
+	.wb_count = ARRAY_SIZE(sm8650_wb),
+	.wb = sm8650_wb,
+	.intf_count = ARRAY_SIZE(sm8650_intf),
+	.intf = sm8650_intf,
+	.vbif_count = ARRAY_SIZE(sm8650_vbif),
+	.vbif = sm8650_vbif,
+	.perf = &sm8650_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_3_0_msm8998.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_3_0_msm8998.h
@@ -0,0 +1,336 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_3_0_MSM8998_H
+#define _DPU_3_0_MSM8998_H
+
+static const struct dpu_caps msm8998_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0x7,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+	.max_hdeci_exp = MAX_HORZ_DECIMATION,
+	.max_vdeci_exp = MAX_VERT_DECIMATION,
+};
+
+static const struct dpu_mdp_cfg msm8998_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x458,
+	.features = BIT(DPU_MDP_VSYNC_SEL),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 12 },
+		[DPU_CLK_CTRL_CURSOR0] = { .reg_off = 0x3a8, .bit_off = 16 },
+		[DPU_CLK_CTRL_CURSOR1] = { .reg_off = 0x3b0, .bit_off = 16 },
+	},
+};
+
+static const struct dpu_ctl_cfg msm8998_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x94,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x1200, .len = 0x94,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x1400, .len = 0x94,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x1600, .len = 0x94,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x1800, .len = 0x94,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	},
+};
+
+static const struct dpu_sspp_cfg msm8998_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1ac,
+		.features = VIG_MSM8998_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_2,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x1ac,
+		.features = VIG_MSM8998_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_2,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x1ac,
+		.features = VIG_MSM8998_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_2,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x1ac,
+		.features = VIG_MSM8998_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_2,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1ac,
+		.features = DMA_MSM8998_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1ac,
+		.features = DMA_MSM8998_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1ac,
+		.features = DMA_CURSOR_MSM8998_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x1ac,
+		.features = DMA_CURSOR_MSM8998_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg msm8998_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_MSM8998_MASK,
+		.sblk = &msm8998_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_MSM8998_MASK,
+		.sblk = &msm8998_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_MSM8998_MASK,
+		.sblk = &msm8998_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x320,
+		.features = MIXER_MSM8998_MASK,
+		.sblk = &msm8998_lm_sblk,
+		.pingpong = PINGPONG_NONE,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x320,
+		.features = MIXER_MSM8998_MASK,
+		.sblk = &msm8998_lm_sblk,
+		.pingpong = PINGPONG_NONE,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x320,
+		.features = MIXER_MSM8998_MASK,
+		.sblk = &msm8998_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+	},
+};
+
+static const struct dpu_pingpong_cfg msm8998_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SDM845_TE2_MASK,
+		.sblk = &sdm845_pp_sblk_te,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+		.intr_rdptr = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 12),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x70800, .len = 0xd4,
+		.features = PINGPONG_SDM845_TE2_MASK,
+		.sblk = &sdm845_pp_sblk_te,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+		.intr_rdptr = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 13),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x71000, .len = 0xd4,
+		.features = PINGPONG_SDM845_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+		.intr_rdptr = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 14),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x71800, .len = 0xd4,
+		.features = PINGPONG_SDM845_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+		.intr_rdptr = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 15),
+	},
+};
+
+static const struct dpu_dsc_cfg msm8998_dsc[] = {
+	{
+		.name = "dsc_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x140,
+	}, {
+		.name = "dsc_1", .id = DSC_1,
+		.base = 0x80400, .len = 0x140,
+	},
+};
+
+static const struct dpu_dspp_cfg msm8998_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &msm8998_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &msm8998_dspp_sblk,
+	},
+};
+
+static const struct dpu_intf_cfg msm8998_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x6a000, .len = 0x280,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 21,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x280,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 21,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x6b000, .len = 0x280,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 21,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x6b800, .len = 0x280,
+		.type = INTF_HDMI,
+		.prog_fetch_lines_worst_case = 21,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	},
+};
+
+static const struct dpu_perf_cfg msm8998_perf_data = {
+	.max_bw_low = 6700000,
+	.max_bw_high = 6700000,
+	.min_core_ib = 2400000,
+	.min_llcc_ib = 800000,
+	.min_dram_ib = 800000,
+	.undersized_prefill_lines = 2,
+	.xtra_prefill_lines = 2,
+	.dest_scale_prefill_lines = 3,
+	.macrotile_prefill_lines = 4,
+	.yuv_nv12_prefill_lines = 8,
+	.linear_prefill_lines = 1,
+	.downscaling_prefill_lines = 1,
+	.amortizable_threshold = 25,
+	.min_prefill_lines = 25,
+	.danger_lut_tbl = {0xf, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfffc, 0xff00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(msm8998_qos_linear),
+		.entries = msm8998_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(msm8998_qos_macrotile),
+		.entries = msm8998_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(msm8998_qos_nrt),
+		.entries = msm8998_qos_nrt
+		},
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 200,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version msm8998_mdss_ver = {
+	.core_major_ver = 3,
+	.core_minor_ver = 0,
+};
+
+const struct dpu_mdss_cfg dpu_msm8998_cfg = {
+	.mdss_ver = &msm8998_mdss_ver,
+	.caps = &msm8998_dpu_caps,
+	.mdp = &msm8998_mdp,
+	.ctl_count = ARRAY_SIZE(msm8998_ctl),
+	.ctl = msm8998_ctl,
+	.sspp_count = ARRAY_SIZE(msm8998_sspp),
+	.sspp = msm8998_sspp,
+	.mixer_count = ARRAY_SIZE(msm8998_lm),
+	.mixer = msm8998_lm,
+	.dspp_count = ARRAY_SIZE(msm8998_dspp),
+	.dspp = msm8998_dspp,
+	.pingpong_count = ARRAY_SIZE(msm8998_pp),
+	.pingpong = msm8998_pp,
+	.dsc_count = ARRAY_SIZE(msm8998_dsc),
+	.dsc = msm8998_dsc,
+	.intf_count = ARRAY_SIZE(msm8998_intf),
+	.intf = msm8998_intf,
+	.vbif_count = ARRAY_SIZE(msm8998_vbif),
+	.vbif = msm8998_vbif,
+	.perf = &msm8998_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_4_0_sdm845.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_4_0_sdm845.h
@@ -0,0 +1,353 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_4_0_SDM845_H
+#define _DPU_4_0_SDM845_H
+
+static const struct dpu_caps sdm845_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+	.max_hdeci_exp = MAX_HORZ_DECIMATION,
+	.max_vdeci_exp = MAX_VERT_DECIMATION,
+};
+
+static const struct dpu_mdp_cfg sdm845_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x45c,
+	.features = BIT(DPU_MDP_AUDIO_SELECT) | BIT(DPU_MDP_VSYNC_SEL),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+	},
+};
+
+static const struct dpu_ctl_cfg sdm845_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0xe4,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x1200, .len = 0xe4,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x1400, .len = 0xe4,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x1600, .len = 0xe4,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x1800, .len = 0xe4,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	},
+};
+
+static const struct dpu_sspp_cfg sdm845_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1c8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_1_3,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x1c8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_1_3,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x1c8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_1_3,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x1c8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_1_3,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1c8,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1c8,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1c8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x1c8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg sdm845_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_2,
+		.dspp = DSPP_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x0, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.pingpong = PINGPONG_NONE,
+		.dspp = DSPP_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x0, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.pingpong = PINGPONG_NONE,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+	},
+};
+
+static const struct dpu_dspp_cfg sdm845_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sdm845_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SDM845_TE2_MASK,
+		.sblk = &sdm845_pp_sblk_te,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+		.intr_rdptr = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 12),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x70800, .len = 0xd4,
+		.features = PINGPONG_SDM845_TE2_MASK,
+		.sblk = &sdm845_pp_sblk_te,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+		.intr_rdptr = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 13),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x71000, .len = 0xd4,
+		.features = PINGPONG_SDM845_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+		.intr_rdptr = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 14),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x71800, .len = 0xd4,
+		.features = PINGPONG_SDM845_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+		.intr_rdptr = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 15),
+	},
+};
+
+static const struct dpu_dsc_cfg sdm845_dsc[] = {
+	{
+		.name = "dsc_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x140,
+	}, {
+		.name = "dsc_1", .id = DSC_1,
+		.base = 0x80400, .len = 0x140,
+	}, {
+		.name = "dsc_2", .id = DSC_2,
+		.base = 0x80800, .len = 0x140,
+	}, {
+		.name = "dsc_3", .id = DSC_3,
+		.base = 0x80c00, .len = 0x140,
+	},
+};
+
+static const struct dpu_intf_cfg sdm845_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x6a000, .len = 0x280,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x280,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x6b000, .len = 0x280,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x6b800, .len = 0x280,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	},
+};
+
+static const struct dpu_perf_cfg sdm845_perf_data = {
+	.max_bw_low = 6800000,
+	.max_bw_high = 6800000,
+	.min_core_ib = 2400000,
+	.min_llcc_ib = 800000,
+	.min_dram_ib = 800000,
+	.undersized_prefill_lines = 2,
+	.xtra_prefill_lines = 2,
+	.dest_scale_prefill_lines = 3,
+	.macrotile_prefill_lines = 4,
+	.yuv_nv12_prefill_lines = 8,
+	.linear_prefill_lines = 1,
+	.downscaling_prefill_lines = 1,
+	.amortizable_threshold = 25,
+	.min_prefill_lines = 24,
+	.danger_lut_tbl = {0xf, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfff0, 0xf000, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sdm845_qos_linear),
+		.entries = sdm845_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sdm845_qos_macrotile),
+		.entries = sdm845_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sdm845_qos_nrt),
+		.entries = sdm845_qos_nrt
+		},
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sdm845_mdss_ver = {
+	.core_major_ver = 4,
+	.core_minor_ver = 0,
+};
+
+const struct dpu_mdss_cfg dpu_sdm845_cfg = {
+	.mdss_ver = &sdm845_mdss_ver,
+	.caps = &sdm845_dpu_caps,
+	.mdp = &sdm845_mdp,
+	.ctl_count = ARRAY_SIZE(sdm845_ctl),
+	.ctl = sdm845_ctl,
+	.sspp_count = ARRAY_SIZE(sdm845_sspp),
+	.sspp = sdm845_sspp,
+	.mixer_count = ARRAY_SIZE(sdm845_lm),
+	.mixer = sdm845_lm,
+	.dspp_count = ARRAY_SIZE(sdm845_dspp),
+	.dspp = sdm845_dspp,
+	.pingpong_count = ARRAY_SIZE(sdm845_pp),
+	.pingpong = sdm845_pp,
+	.dsc_count = ARRAY_SIZE(sdm845_dsc),
+	.dsc = sdm845_dsc,
+	.intf_count = ARRAY_SIZE(sdm845_intf),
+	.intf = sdm845_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sdm845_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_4_1_sdm670.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_4_1_sdm670.h
@@ -0,0 +1,104 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023, Richard Acayan. All rights reserved.
+ */
+
+#ifndef _DPU_4_1_SDM670_H
+#define _DPU_4_1_SDM670_H
+
+static const struct dpu_mdp_cfg sdm670_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x45c,
+	.features = BIT(DPU_MDP_AUDIO_SELECT),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+	},
+};
+
+static const struct dpu_sspp_cfg sdm670_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1c8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_1_3,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x1c8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_1_3,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1c8,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1c8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1c8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	},
+};
+
+static const struct dpu_dsc_cfg sdm670_dsc[] = {
+	{
+		.name = "dsc_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x140,
+	}, {
+		.name = "dsc_1", .id = DSC_1,
+		.base = 0x80400, .len = 0x140,
+	},
+};
+
+static const struct dpu_mdss_version sdm670_mdss_ver = {
+	.core_major_ver = 4,
+	.core_minor_ver = 1,
+};
+
+const struct dpu_mdss_cfg dpu_sdm670_cfg = {
+	.mdss_ver = &sdm670_mdss_ver,
+	.caps = &sdm845_dpu_caps,
+	.mdp = &sdm670_mdp,
+	.ctl_count = ARRAY_SIZE(sdm845_ctl),
+	.ctl = sdm845_ctl,
+	.sspp_count = ARRAY_SIZE(sdm670_sspp),
+	.sspp = sdm670_sspp,
+	.mixer_count = ARRAY_SIZE(sdm845_lm),
+	.mixer = sdm845_lm,
+	.pingpong_count = ARRAY_SIZE(sdm845_pp),
+	.pingpong = sdm845_pp,
+	.dsc_count = ARRAY_SIZE(sdm670_dsc),
+	.dsc = sdm670_dsc,
+	.intf_count = ARRAY_SIZE(sdm845_intf),
+	.intf = sdm845_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sdm845_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_5_0_sm8150.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_5_0_sm8150.h
@@ -0,0 +1,394 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_5_0_SM8150_H
+#define _DPU_5_0_SM8150_H
+
+static const struct dpu_caps sm8150_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 4096,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+	.max_hdeci_exp = MAX_HORZ_DECIMATION,
+	.max_vdeci_exp = MAX_VERT_DECIMATION,
+};
+
+static const struct dpu_mdp_cfg sm8150_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x45c,
+	.features = BIT(DPU_MDP_AUDIO_SELECT),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg sm8150_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG) | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x1200, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG) | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x1400, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x1600, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x1800, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a00, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sm8150_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f0,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_4,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x1f0,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_4,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x1f0,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_4,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x1f0,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_4,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f0,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1f0,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1f0,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x1f0,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg sm8150_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sm8150_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sm8150_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x70800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x71000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x71800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x72000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x72800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	},
+};
+
+static const struct dpu_merge_3d_cfg sm8150_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x83000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x83100, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x83200, .len = 0x8,
+	},
+};
+
+static const struct dpu_dsc_cfg sm8150_dsc[] = {
+	{
+		.name = "dsc_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_1", .id = DSC_1,
+		.base = 0x80400, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_2", .id = DSC_2,
+		.base = 0x80800, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_3", .id = DSC_3,
+		.base = 0x80c00, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	},
+};
+
+static const struct dpu_intf_cfg sm8150_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x6a000, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x2bc,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x6b000, .len = 0x2bc,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x6b800, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	},
+};
+
+static const struct dpu_perf_cfg sm8150_perf_data = {
+	.max_bw_low = 12800000,
+	.max_bw_high = 12800000,
+	.min_core_ib = 2400000,
+	.min_llcc_ib = 800000,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 24,
+	.danger_lut_tbl = {0xf, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfff8, 0xf000, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sm8150_qos_linear),
+		.entries = sm8150_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm8150_mdss_ver = {
+	.core_major_ver = 5,
+	.core_minor_ver = 0,
+};
+
+const struct dpu_mdss_cfg dpu_sm8150_cfg = {
+	.mdss_ver = &sm8150_mdss_ver,
+	.caps = &sm8150_dpu_caps,
+	.mdp = &sm8150_mdp,
+	.ctl_count = ARRAY_SIZE(sm8150_ctl),
+	.ctl = sm8150_ctl,
+	.sspp_count = ARRAY_SIZE(sm8150_sspp),
+	.sspp = sm8150_sspp,
+	.mixer_count = ARRAY_SIZE(sm8150_lm),
+	.mixer = sm8150_lm,
+	.dspp_count = ARRAY_SIZE(sm8150_dspp),
+	.dspp = sm8150_dspp,
+	.dsc_count = ARRAY_SIZE(sm8150_dsc),
+	.dsc = sm8150_dsc,
+	.pingpong_count = ARRAY_SIZE(sm8150_pp),
+	.pingpong = sm8150_pp,
+	.merge_3d_count = ARRAY_SIZE(sm8150_merge_3d),
+	.merge_3d = sm8150_merge_3d,
+	.intf_count = ARRAY_SIZE(sm8150_intf),
+	.intf = sm8150_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sm8150_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_5_1_sc8180x.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_5_1_sc8180x.h
@@ -0,0 +1,420 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_5_1_SC8180X_H
+#define _DPU_5_1_SC8180X_H
+
+static const struct dpu_caps sc8180x_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 4096,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+	.max_hdeci_exp = MAX_HORZ_DECIMATION,
+	.max_vdeci_exp = MAX_VERT_DECIMATION,
+};
+
+static const struct dpu_mdp_cfg sc8180x_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x45c,
+	.features = BIT(DPU_MDP_AUDIO_SELECT),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+	},
+};
+
+static const struct dpu_ctl_cfg sc8180x_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG) | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x1200, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG) | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x1400, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x1600, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x1800, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a00, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sc8180x_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f0,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_4,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x1f0,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_4,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x1f0,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_4,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x1f0,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_1_4,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f0,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1f0,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1f0,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x1f0,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg sc8180x_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sc8180x_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sc8180x_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x70800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x71000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x71800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x72000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x72800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	},
+};
+
+static const struct dpu_merge_3d_cfg sc8180x_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x83000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x83100, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x83200, .len = 0x8,
+	},
+};
+
+static const struct dpu_dsc_cfg sc8180x_dsc[] = {
+	{
+		.name = "dsc_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_1", .id = DSC_1,
+		.base = 0x80400, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_2", .id = DSC_2,
+		.base = 0x80800, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_3", .id = DSC_3,
+		.base = 0x80c00, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_4", .id = DSC_4,
+		.base = 0x81000, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_5", .id = DSC_5,
+		.base = 0x81400, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	},
+};
+
+static const struct dpu_intf_cfg sc8180x_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x6a000, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x2bc,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x6b000, .len = 0x2bc,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	},
+	/* INTF_3 is for MST, wired to INTF_DP 0 and 1, use dummy index until this is supported */
+	{
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x6b800, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = 999,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	}, {
+		.name = "intf_4", .id = INTF_4,
+		.base = 0x6c000, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 20),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 21),
+	}, {
+		.name = "intf_5", .id = INTF_5,
+		.base = 0x6c800, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_2,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 22),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 23),
+	},
+};
+
+static const struct dpu_perf_cfg sc8180x_perf_data = {
+	.max_bw_low = 9600000,
+	.max_bw_high = 9600000,
+	.min_core_ib = 2400000,
+	.min_llcc_ib = 800000,
+	.min_dram_ib = 800000,
+	.danger_lut_tbl = {0xf, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfff0, 0xf000, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc7180_qos_linear),
+		.entries = sc7180_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sc8180x_mdss_ver = {
+	.core_major_ver = 5,
+	.core_minor_ver = 1,
+};
+
+const struct dpu_mdss_cfg dpu_sc8180x_cfg = {
+	.mdss_ver = &sc8180x_mdss_ver,
+	.caps = &sc8180x_dpu_caps,
+	.mdp = &sc8180x_mdp,
+	.ctl_count = ARRAY_SIZE(sc8180x_ctl),
+	.ctl = sc8180x_ctl,
+	.sspp_count = ARRAY_SIZE(sc8180x_sspp),
+	.sspp = sc8180x_sspp,
+	.mixer_count = ARRAY_SIZE(sc8180x_lm),
+	.mixer = sc8180x_lm,
+	.dspp_count = ARRAY_SIZE(sc8180x_dspp),
+	.dspp = sc8180x_dspp,
+	.dsc_count = ARRAY_SIZE(sc8180x_dsc),
+	.dsc = sc8180x_dsc,
+	.pingpong_count = ARRAY_SIZE(sc8180x_pp),
+	.pingpong = sc8180x_pp,
+	.merge_3d_count = ARRAY_SIZE(sc8180x_merge_3d),
+	.merge_3d = sc8180x_merge_3d,
+	.intf_count = ARRAY_SIZE(sc8180x_intf),
+	.intf = sc8180x_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sc8180x_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_5_4_sm6125.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_5_4_sm6125.h
@@ -0,0 +1,220 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023 Marijn Suijten <marijn.suijten@somainline.org>. All rights reserved.
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_5_4_SM6125_H
+#define _DPU_5_4_SM6125_H
+
+static const struct dpu_caps sm6125_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0x6,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.max_linewidth = 2160,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+	.max_hdeci_exp = MAX_HORZ_DECIMATION,
+	.max_vdeci_exp = MAX_VERT_DECIMATION,
+};
+
+static const struct dpu_mdp_cfg sm6125_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x45c,
+	.features = 0,
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+	},
+};
+
+static const struct dpu_ctl_cfg sm6125_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x1200, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x1400, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x1600, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x1800, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a00, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sm6125_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f0,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_2_4,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f0,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1f0,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	},
+};
+
+static const struct dpu_lm_cfg sm6125_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_QCM2290_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+		.lm_pair = LM_1,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_QCM2290_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.pingpong = PINGPONG_1,
+		.dspp = 0,
+		.lm_pair = LM_0,
+	},
+};
+
+static const struct dpu_dspp_cfg sm6125_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sm6125_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.merge_3d = 0,
+		.sblk = &sdm845_pp_sblk,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x70800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.merge_3d = 0,
+		.sblk = &sdm845_pp_sblk,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	},
+};
+
+static const struct dpu_intf_cfg sm6125_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x6a000, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x2c0,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = 0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	},
+};
+
+static const struct dpu_perf_cfg sm6125_perf_data = {
+	.max_bw_low = 4100000,
+	.max_bw_high = 4100000,
+	.min_core_ib = 2400000,
+	.min_llcc_ib = 0, /* No LLCC on this SoC */
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 24,
+	.danger_lut_tbl = {0xf, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfff8, 0xf000, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sm8150_qos_linear),
+		.entries = sm8150_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm6125_mdss_ver = {
+	.core_major_ver = 5,
+	.core_minor_ver = 4,
+};
+
+const struct dpu_mdss_cfg dpu_sm6125_cfg = {
+	.mdss_ver = &sm6125_mdss_ver,
+	.caps = &sm6125_dpu_caps,
+	.mdp = &sm6125_mdp,
+	.ctl_count = ARRAY_SIZE(sm6125_ctl),
+	.ctl = sm6125_ctl,
+	.sspp_count = ARRAY_SIZE(sm6125_sspp),
+	.sspp = sm6125_sspp,
+	.mixer_count = ARRAY_SIZE(sm6125_lm),
+	.mixer = sm6125_lm,
+	.dspp_count = ARRAY_SIZE(sm6125_dspp),
+	.dspp = sm6125_dspp,
+	.pingpong_count = ARRAY_SIZE(sm6125_pp),
+	.pingpong = sm6125_pp,
+	.intf_count = ARRAY_SIZE(sm6125_intf),
+	.intf = sm6125_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sm6125_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_0_sm8250.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_0_sm8250.h
@@ -0,0 +1,411 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_6_0_SM8250_H
+#define _DPU_6_0_SM8250_H
+
+static const struct dpu_caps sm8250_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 4096,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sm8250_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg sm8250_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG) | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x1200, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG) | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x1400, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x1600, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x1800, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a00, .len = 0x1e0,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sm8250_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg sm8250_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sm8250_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sm8250_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x70800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x71000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x71800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x72000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x72800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	},
+};
+
+static const struct dpu_merge_3d_cfg sm8250_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x83000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x83100, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x83200, .len = 0x8,
+	},
+};
+
+static const struct dpu_dsc_cfg sm8250_dsc[] = {
+	{
+		.name = "dsc_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_1", .id = DSC_1,
+		.base = 0x80400, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_2", .id = DSC_2,
+		.base = 0x80800, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	}, {
+		.name = "dsc_3", .id = DSC_3,
+		.base = 0x80c00, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	},
+};
+
+static const struct dpu_intf_cfg sm8250_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x6a000, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x2c0,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x6b000, .len = 0x2c0,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x6b800, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	},
+};
+
+static const struct dpu_wb_cfg sm8250_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb_yuv,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb_yuv),
+		.clk_ctrl = DPU_CLK_CTRL_WB2,
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+
+static const struct dpu_perf_cfg sm8250_perf_data = {
+	.max_bw_low = 13700000,
+	.max_bw_high = 16600000,
+	.min_core_ib = 4800000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 35,
+	.danger_lut_tbl = {0xf, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfff0, 0xff00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc7180_qos_linear),
+		.entries = sc7180_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm8250_mdss_ver = {
+	.core_major_ver = 6,
+	.core_minor_ver = 0,
+};
+
+const struct dpu_mdss_cfg dpu_sm8250_cfg = {
+	.mdss_ver = &sm8250_mdss_ver,
+	.caps = &sm8250_dpu_caps,
+	.mdp = &sm8250_mdp,
+	.cdm = &sc7280_cdm,
+	.ctl_count = ARRAY_SIZE(sm8250_ctl),
+	.ctl = sm8250_ctl,
+	.sspp_count = ARRAY_SIZE(sm8250_sspp),
+	.sspp = sm8250_sspp,
+	.mixer_count = ARRAY_SIZE(sm8250_lm),
+	.mixer = sm8250_lm,
+	.dspp_count = ARRAY_SIZE(sm8250_dspp),
+	.dspp = sm8250_dspp,
+	.dsc_count = ARRAY_SIZE(sm8250_dsc),
+	.dsc = sm8250_dsc,
+	.pingpong_count = ARRAY_SIZE(sm8250_pp),
+	.pingpong = sm8250_pp,
+	.merge_3d_count = ARRAY_SIZE(sm8250_merge_3d),
+	.merge_3d = sm8250_merge_3d,
+	.intf_count = ARRAY_SIZE(sm8250_intf),
+	.intf = sm8250_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.wb_count = ARRAY_SIZE(sm8250_wb),
+	.wb = sm8250_wb,
+	.perf = &sm8250_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_2_sc7180.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_2_sc7180.h
@@ -0,0 +1,226 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_6_2_SC7180_H
+#define _DPU_6_2_SC7180_H
+
+static const struct dpu_caps sc7180_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0x9,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.max_linewidth = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sc7180_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+	},
+};
+
+static const struct dpu_ctl_cfg sc7180_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x1200, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x1400, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	},
+};
+
+static const struct dpu_sspp_cfg sc7180_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	},
+};
+
+static const struct dpu_lm_cfg sc7180_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sc7180_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sc7180_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+	},
+};
+
+static const struct dpu_dspp_cfg sc7180_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sc7180_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x70800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	},
+};
+
+static const struct dpu_intf_cfg sc7180_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x6a000, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x2c0,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	},
+};
+
+static const struct dpu_wb_cfg sc7180_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb),
+		.clk_ctrl = DPU_CLK_CTRL_WB2,
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+
+static const struct dpu_perf_cfg sc7180_perf_data = {
+	.max_bw_low = 6800000,
+	.max_bw_high = 6800000,
+	.min_core_ib = 2400000,
+	.min_llcc_ib = 800000,
+	.min_dram_ib = 1600000,
+	.min_prefill_lines = 24,
+	.danger_lut_tbl = {0xff, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfff0, 0xff00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc7180_qos_linear),
+		.entries = sc7180_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sc7180_mdss_ver = {
+	.core_major_ver = 6,
+	.core_minor_ver = 2,
+};
+
+const struct dpu_mdss_cfg dpu_sc7180_cfg = {
+	.mdss_ver = &sc7180_mdss_ver,
+	.caps = &sc7180_dpu_caps,
+	.mdp = &sc7180_mdp,
+	.ctl_count = ARRAY_SIZE(sc7180_ctl),
+	.ctl = sc7180_ctl,
+	.sspp_count = ARRAY_SIZE(sc7180_sspp),
+	.sspp = sc7180_sspp,
+	.mixer_count = ARRAY_SIZE(sc7180_lm),
+	.mixer = sc7180_lm,
+	.dspp_count = ARRAY_SIZE(sc7180_dspp),
+	.dspp = sc7180_dspp,
+	.pingpong_count = ARRAY_SIZE(sc7180_pp),
+	.pingpong = sc7180_pp,
+	.intf_count = ARRAY_SIZE(sc7180_intf),
+	.intf = sc7180_intf,
+	.wb_count = ARRAY_SIZE(sc7180_wb),
+	.wb = sc7180_wb,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sc7180_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_3_sm6115.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_3_sm6115.h
@@ -0,0 +1,157 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_6_3_SM6115_H
+#define _DPU_6_3_SM6115_H
+
+static const struct dpu_caps sm6115_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_LINE_WIDTH,
+	.max_mixer_blendstages = 0x4,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.max_linewidth = 2160,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sm6115_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+	},
+};
+
+static const struct dpu_ctl_cfg sm6115_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	},
+};
+
+static const struct dpu_sspp_cfg sm6115_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	},
+};
+
+static const struct dpu_lm_cfg sm6115_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_QCM2290_MASK,
+		.sblk = &qcm2290_lm_sblk,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	},
+};
+
+static const struct dpu_dspp_cfg sm6115_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sm6115_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	},
+};
+
+static const struct dpu_intf_cfg sm6115_intf[] = {
+	{
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x2c0,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	},
+};
+
+static const struct dpu_perf_cfg sm6115_perf_data = {
+	.max_bw_low = 3100000,
+	.max_bw_high = 4000000,
+	.min_core_ib = 2400000,
+	.min_llcc_ib = 800000,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 24,
+	.danger_lut_tbl = {0xff, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfff0, 0xff00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc7180_qos_linear),
+		.entries = sc7180_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm6115_mdss_ver = {
+	.core_major_ver = 6,
+	.core_minor_ver = 3,
+};
+
+const struct dpu_mdss_cfg dpu_sm6115_cfg = {
+	.mdss_ver = &sm6115_mdss_ver,
+	.caps = &sm6115_dpu_caps,
+	.mdp = &sm6115_mdp,
+	.ctl_count = ARRAY_SIZE(sm6115_ctl),
+	.ctl = sm6115_ctl,
+	.sspp_count = ARRAY_SIZE(sm6115_sspp),
+	.sspp = sm6115_sspp,
+	.mixer_count = ARRAY_SIZE(sm6115_lm),
+	.mixer = sm6115_lm,
+	.dspp_count = ARRAY_SIZE(sm6115_dspp),
+	.dspp = sm6115_dspp,
+	.pingpong_count = ARRAY_SIZE(sm6115_pp),
+	.pingpong = sm6115_pp,
+	.intf_count = ARRAY_SIZE(sm6115_intf),
+	.intf = sm6115_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sm6115_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_4_sm6350.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_4_sm6350.h
@@ -0,0 +1,228 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Linaro Limited
+ */
+
+#ifndef _DPU_6_4_SM6350_H
+#define _DPU_6_4_SM6350_H
+
+static const struct dpu_caps sm6350_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0x7,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.max_linewidth = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sm6350_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+static const struct dpu_ctl_cfg sm6350_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x1200, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x1400, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x1600, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	},
+};
+
+static const struct dpu_sspp_cfg sm6350_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	},
+};
+
+static const struct dpu_lm_cfg sm6350_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sc7180_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sc7180_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = 0,
+	},
+};
+
+static const struct dpu_dspp_cfg sm6350_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static struct dpu_pingpong_cfg sm6350_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x70800, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	},
+};
+
+static const struct dpu_dsc_cfg sm6350_dsc[] = {
+	{
+		.name = "dsc_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	},
+};
+
+static const struct dpu_intf_cfg sm6350_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x6a000, .len = 0x280,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 35,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x2c0,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 35,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	},
+};
+
+static const struct dpu_perf_cfg sm6350_perf_data = {
+	.max_bw_low = 4200000,
+	.max_bw_high = 5100000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 1600000,
+	.min_prefill_lines = 35,
+	/* TODO: confirm danger_lut_tbl */
+	.danger_lut_tbl = {0xffff, 0xffff, 0x0},
+	.safe_lut_tbl = {0xff00, 0xff00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm6350_mdss_ver = {
+	.core_major_ver = 6,
+	.core_minor_ver = 4,
+};
+
+const struct dpu_mdss_cfg dpu_sm6350_cfg = {
+	.mdss_ver = &sm6350_mdss_ver,
+	.caps = &sm6350_dpu_caps,
+	.mdp = &sm6350_mdp,
+	.ctl_count = ARRAY_SIZE(sm6350_ctl),
+	.ctl = sm6350_ctl,
+	.sspp_count = ARRAY_SIZE(sm6350_sspp),
+	.sspp = sm6350_sspp,
+	.mixer_count = ARRAY_SIZE(sm6350_lm),
+	.mixer = sm6350_lm,
+	.dspp_count = ARRAY_SIZE(sm6350_dspp),
+	.dspp = sm6350_dspp,
+	.dsc_count = ARRAY_SIZE(sm6350_dsc),
+	.dsc = sm6350_dsc,
+	.pingpong_count = ARRAY_SIZE(sm6350_pp),
+	.pingpong = sm6350_pp,
+	.intf_count = ARRAY_SIZE(sm6350_intf),
+	.intf = sm6350_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sm6350_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_5_qcm2290.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_5_qcm2290.h
@@ -0,0 +1,150 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_6_5_QCM2290_H
+#define _DPU_6_5_QCM2290_H
+
+static const struct dpu_caps qcm2290_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_LINE_WIDTH,
+	.max_mixer_blendstages = 0x4,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.max_linewidth = 2160,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg qcm2290_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+	},
+};
+
+static const struct dpu_ctl_cfg qcm2290_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	},
+};
+
+static const struct dpu_sspp_cfg qcm2290_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f8,
+		.features = VIG_QCM2290_MASK,
+		.sblk = &dpu_vig_sblk_noscale,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	},
+};
+
+static const struct dpu_lm_cfg qcm2290_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_QCM2290_MASK,
+		.sblk = &qcm2290_lm_sblk,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	},
+};
+
+static const struct dpu_dspp_cfg qcm2290_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg qcm2290_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	},
+};
+
+static const struct dpu_intf_cfg qcm2290_intf[] = {
+	{
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x2c0,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	},
+};
+
+static const struct dpu_perf_cfg qcm2290_perf_data = {
+	.max_bw_low = 2700000,
+	.max_bw_high = 2700000,
+	.min_core_ib = 1300000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 1600000,
+	.min_prefill_lines = 24,
+	.danger_lut_tbl = {0xff, 0x0, 0x0},
+	.safe_lut_tbl = {0xfff0, 0x0, 0x0},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(qcm2290_qos_linear),
+		.entries = qcm2290_qos_linear
+		},
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version qcm2290_mdss_ver = {
+	.core_major_ver = 6,
+	.core_minor_ver = 5,
+};
+
+const struct dpu_mdss_cfg dpu_qcm2290_cfg = {
+	.mdss_ver = &qcm2290_mdss_ver,
+	.caps = &qcm2290_dpu_caps,
+	.mdp = &qcm2290_mdp,
+	.ctl_count = ARRAY_SIZE(qcm2290_ctl),
+	.ctl = qcm2290_ctl,
+	.sspp_count = ARRAY_SIZE(qcm2290_sspp),
+	.sspp = qcm2290_sspp,
+	.mixer_count = ARRAY_SIZE(qcm2290_lm),
+	.mixer = qcm2290_lm,
+	.dspp_count = ARRAY_SIZE(qcm2290_dspp),
+	.dspp = qcm2290_dspp,
+	.pingpong_count = ARRAY_SIZE(qcm2290_pp),
+	.pingpong = qcm2290_pp,
+	.intf_count = ARRAY_SIZE(qcm2290_intf),
+	.intf = qcm2290_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &qcm2290_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_9_sm6375.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_6_9_sm6375.h
@@ -0,0 +1,169 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Linaro Limited
+ */
+
+#ifndef _DPU_6_9_SM6375_H
+#define _DPU_6_9_SM6375_H
+
+static const struct dpu_caps sm6375_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_LINE_WIDTH,
+	.max_mixer_blendstages = 0x4,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.max_linewidth = 2160,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sm6375_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+	},
+};
+
+static const struct dpu_ctl_cfg sm6375_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x1000, .len = 0x1dc,
+		.features = BIT(DPU_CTL_ACTIVE_CFG),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	},
+};
+
+static const struct dpu_sspp_cfg sm6375_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	},
+};
+
+static const struct dpu_lm_cfg sm6375_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_QCM2290_MASK,
+		.sblk = &qcm2290_lm_sblk,
+		.lm_pair = 0,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	},
+};
+
+static const struct dpu_dspp_cfg sm6375_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sm6375_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x70000, .len = 0xd4,
+		.features = PINGPONG_SM8150_MASK,
+		.sblk = &sdm845_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	},
+};
+
+static const struct dpu_dsc_cfg sm6375_dsc[] = {
+	{
+		.name = "dsc_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x140,
+		.features = BIT(DPU_DSC_OUTPUT_CTRL),
+	},
+};
+
+static const struct dpu_intf_cfg sm6375_intf[] = {
+	{
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x6a800, .len = 0x2c0,
+		.features = INTF_SC7180_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	},
+};
+
+static const struct dpu_perf_cfg sm6375_perf_data = {
+	.max_bw_low = 5200000,
+	.max_bw_high = 6200000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0, /* No LLCC on this SoC */
+	.min_dram_ib = 1600000,
+	.min_prefill_lines = 24,
+	/* TODO: confirm danger_lut_tbl */
+	.danger_lut_tbl = {0xffff, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfe00, 0xfe00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm6375_mdss_ver = {
+	.core_major_ver = 6,
+	.core_minor_ver = 9,
+};
+
+const struct dpu_mdss_cfg dpu_sm6375_cfg = {
+	.mdss_ver = &sm6375_mdss_ver,
+	.caps = &sm6375_dpu_caps,
+	.mdp = &sm6375_mdp,
+	.ctl_count = ARRAY_SIZE(sm6375_ctl),
+	.ctl = sm6375_ctl,
+	.sspp_count = ARRAY_SIZE(sm6375_sspp),
+	.sspp = sm6375_sspp,
+	.mixer_count = ARRAY_SIZE(sm6375_lm),
+	.mixer = sm6375_lm,
+	.dspp_count = ARRAY_SIZE(sm6375_dspp),
+	.dspp = sm6375_dspp,
+	.dsc_count = ARRAY_SIZE(sm6375_dsc),
+	.dsc = sm6375_dsc,
+	.pingpong_count = ARRAY_SIZE(sm6375_pp),
+	.pingpong = sm6375_pp,
+	.intf_count = ARRAY_SIZE(sm6375_intf),
+	.intf = sm6375_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sm6375_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_7_0_sm8350.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_7_0_sm8350.h
@@ -0,0 +1,420 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_7_0_SM8350_H
+#define _DPU_7_0_SM8350_H
+
+static const struct dpu_caps sm8350_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 4096,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sm8350_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg sm8350_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x1e8,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x1e8,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x1e8,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x1e8,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x19000, .len = 0x1e8,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a000, .len = 0x1e8,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sm8350_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x1f8,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg sm8350_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sm8350_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sm8350_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x6d000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x6e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	},
+};
+
+static const struct dpu_merge_3d_cfg sm8350_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x4e000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x4f000, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x50000, .len = 0x8,
+	},
+};
+
+/*
+ * NOTE: Each display compression engine (DCE) contains dual hard
+ * slice DSC encoders so both share same base address but with
+ * its own different sub block address.
+ */
+static const struct dpu_dsc_cfg sm8350_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_0_1", .id = DSC_1,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_1_0", .id = DSC_2,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_1_1", .id = DSC_3,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	},
+};
+
+static const struct dpu_wb_cfg sm8350_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb),
+		.clk_ctrl = DPU_CLK_CTRL_WB2,
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+
+static const struct dpu_intf_cfg sm8350_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x2c4,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x36000, .len = 0x2c4,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x37000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	},
+};
+
+static const struct dpu_perf_cfg sm8350_perf_data = {
+	.max_bw_low = 11800000,
+	.max_bw_high = 15500000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 40,
+	/* FIXME: lut tables */
+	.danger_lut_tbl = {0x3ffff, 0x3ffff, 0x0},
+	.safe_lut_tbl = {0xfe00, 0xfe00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc7180_qos_linear),
+		.entries = sc7180_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm8350_mdss_ver = {
+	.core_major_ver = 7,
+	.core_minor_ver = 0,
+};
+
+const struct dpu_mdss_cfg dpu_sm8350_cfg = {
+	.mdss_ver = &sm8350_mdss_ver,
+	.caps = &sm8350_dpu_caps,
+	.mdp = &sm8350_mdp,
+	.ctl_count = ARRAY_SIZE(sm8350_ctl),
+	.ctl = sm8350_ctl,
+	.sspp_count = ARRAY_SIZE(sm8350_sspp),
+	.sspp = sm8350_sspp,
+	.mixer_count = ARRAY_SIZE(sm8350_lm),
+	.mixer = sm8350_lm,
+	.dspp_count = ARRAY_SIZE(sm8350_dspp),
+	.dspp = sm8350_dspp,
+	.pingpong_count = ARRAY_SIZE(sm8350_pp),
+	.pingpong = sm8350_pp,
+	.dsc_count = ARRAY_SIZE(sm8350_dsc),
+	.dsc = sm8350_dsc,
+	.merge_3d_count = ARRAY_SIZE(sm8350_merge_3d),
+	.merge_3d = sm8350_merge_3d,
+	.wb_count = ARRAY_SIZE(sm8350_wb),
+	.wb = sm8350_wb,
+	.intf_count = ARRAY_SIZE(sm8350_intf),
+	.intf = sm8350_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sm8350_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_7_2_sc7280.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_7_2_sc7280.h
@@ -0,0 +1,273 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_7_2_SC7280_H
+#define _DPU_7_2_SC7280_H
+
+static const struct dpu_caps sc7280_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0x7,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.max_linewidth = 2400,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sc7280_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x2014,
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+	},
+};
+
+static const struct dpu_ctl_cfg sc7280_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x1e8,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x1e8,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x1e8,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x1e8,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	},
+};
+
+static const struct dpu_sspp_cfg sc7280_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x1f8,
+		.features = VIG_SC7280_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_0_rot_v2,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x1f8,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x1f8,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	},
+};
+
+static const struct dpu_lm_cfg sc7280_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sc7180_lm_sblk,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sc7180_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sc7180_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+	},
+};
+
+static const struct dpu_dspp_cfg sc7280_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sc7280_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = 0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	},
+};
+
+/* NOTE: sc7280 only has one DSC hard slice encoder */
+static const struct dpu_dsc_cfg sc7280_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	},
+};
+
+static const struct dpu_wb_cfg sc7280_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb_yuv,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb_yuv),
+		.clk_ctrl = DPU_CLK_CTRL_WB2,
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+
+static const struct dpu_intf_cfg sc7280_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x2c4,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_5", .id = INTF_5,
+		.base = 0x39000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 22),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 23),
+	},
+};
+
+static const struct dpu_perf_cfg sc7280_perf_data = {
+	.max_bw_low = 4700000,
+	.max_bw_high = 8800000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 1600000,
+	.min_prefill_lines = 24,
+	.danger_lut_tbl = {0xffff, 0xffff, 0x0},
+	.safe_lut_tbl = {0xff00, 0xff00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sc7280_mdss_ver = {
+	.core_major_ver = 7,
+	.core_minor_ver = 2,
+};
+
+const struct dpu_mdss_cfg dpu_sc7280_cfg = {
+	.mdss_ver = &sc7280_mdss_ver,
+	.caps = &sc7280_dpu_caps,
+	.mdp = &sc7280_mdp,
+	.cdm = &sc7280_cdm,
+	.ctl_count = ARRAY_SIZE(sc7280_ctl),
+	.ctl = sc7280_ctl,
+	.sspp_count = ARRAY_SIZE(sc7280_sspp),
+	.sspp = sc7280_sspp,
+	.dspp_count = ARRAY_SIZE(sc7280_dspp),
+	.dspp = sc7280_dspp,
+	.mixer_count = ARRAY_SIZE(sc7280_lm),
+	.mixer = sc7280_lm,
+	.pingpong_count = ARRAY_SIZE(sc7280_pp),
+	.pingpong = sc7280_pp,
+	.dsc_count = ARRAY_SIZE(sc7280_dsc),
+	.dsc = sc7280_dsc,
+	.wb_count = ARRAY_SIZE(sc7280_wb),
+	.wb = sc7280_wb,
+	.intf_count = ARRAY_SIZE(sc7280_intf),
+	.intf = sc7280_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sc7280_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_8_0_sc8280xp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_8_0_sc8280xp.h
@@ -0,0 +1,459 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_8_0_SC8280XP_H
+#define _DPU_8_0_SC8280XP_H
+
+static const struct dpu_caps sc8280xp_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 11,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 5120,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sc8280xp_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.features = BIT(DPU_MDP_PERIPH_0_REMOVED),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg sc8280xp_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x19000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sc8280xp_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x2ac,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x2ac,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x2ac,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x2ac,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_0,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x2ac,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x2ac,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x2ac,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x2ac,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg sc8280xp_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+		.dspp = DSPP_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+		.dspp = DSPP_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sc8280xp_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sc8280xp_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x6d000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x6e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	},
+};
+
+static const struct dpu_merge_3d_cfg sc8280xp_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x4e000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x4f000, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x50000, .len = 0x8,
+	},
+};
+
+/*
+ * NOTE: Each display compression engine (DCE) contains dual hard
+ * slice DSC encoders so both share same base address but with
+ * its own different sub block address.
+ */
+static const struct dpu_dsc_cfg sc8280xp_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_0_1", .id = DSC_1,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_1_0", .id = DSC_2,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_1_1", .id = DSC_3,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_2_0", .id = DSC_4,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_2_1", .id = DSC_5,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	},
+};
+
+/* TODO: INTF 3, 8 and 7 are used for MST, marked as INTF_NONE for now */
+static const struct dpu_intf_cfg sc8280xp_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x36000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x37000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_NONE,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	}, {
+		.name = "intf_4", .id = INTF_4,
+		.base = 0x38000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 20),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 21),
+	}, {
+		.name = "intf_5", .id = INTF_5,
+		.base = 0x39000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_3,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 22),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 23),
+	}, {
+		.name = "intf_6", .id = INTF_6,
+		.base = 0x3a000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_2,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 16),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 17),
+	}, {
+		.name = "intf_7", .id = INTF_7,
+		.base = 0x3b000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_NONE,
+		.controller_id = MSM_DP_CONTROLLER_2,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 18),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 19),
+	}, {
+		.name = "intf_8", .id = INTF_8,
+		.base = 0x3c000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_NONE,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 12),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 13),
+	},
+};
+
+static const struct dpu_perf_cfg sc8280xp_perf_data = {
+	.max_bw_low = 13600000,
+	.max_bw_high = 18200000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.danger_lut_tbl = {0xf, 0xffff, 0x0},
+	.safe_lut_tbl = {0xfe00, 0xfe00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc8180x_qos_linear),
+		.entries = sc8180x_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc8180x_qos_macrotile),
+		.entries = sc8180x_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sc8280xp_mdss_ver = {
+	.core_major_ver = 8,
+	.core_minor_ver = 0,
+};
+
+const struct dpu_mdss_cfg dpu_sc8280xp_cfg = {
+	.mdss_ver = &sc8280xp_mdss_ver,
+	.caps = &sc8280xp_dpu_caps,
+	.mdp = &sc8280xp_mdp,
+	.ctl_count = ARRAY_SIZE(sc8280xp_ctl),
+	.ctl = sc8280xp_ctl,
+	.sspp_count = ARRAY_SIZE(sc8280xp_sspp),
+	.sspp = sc8280xp_sspp,
+	.mixer_count = ARRAY_SIZE(sc8280xp_lm),
+	.mixer = sc8280xp_lm,
+	.dspp_count = ARRAY_SIZE(sc8280xp_dspp),
+	.dspp = sc8280xp_dspp,
+	.pingpong_count = ARRAY_SIZE(sc8280xp_pp),
+	.pingpong = sc8280xp_pp,
+	.dsc_count = ARRAY_SIZE(sc8280xp_dsc),
+	.dsc = sc8280xp_dsc,
+	.merge_3d_count = ARRAY_SIZE(sc8280xp_merge_3d),
+	.merge_3d = sc8280xp_merge_3d,
+	.intf_count = ARRAY_SIZE(sc8280xp_intf),
+	.intf = sc8280xp_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sc8280xp_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_8_1_sm8450.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_8_1_sm8450.h
@@ -0,0 +1,438 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_8_1_SM8450_H
+#define _DPU_8_1_SM8450_H
+
+static const struct dpu_caps sm8450_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 5120,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sm8450_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.features = BIT(DPU_MDP_PERIPH_0_REMOVED),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg sm8450_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x19000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sm8450_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg sm8450_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+		.dspp = DSPP_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+		.dspp = DSPP_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sm8450_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sm8450_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x6d000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x6e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	}, {
+		.name = "pingpong_6", .id = PINGPONG_6,
+		.base = 0x65800, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	}, {
+		.name = "pingpong_7", .id = PINGPONG_7,
+		.base = 0x65c00, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	},
+};
+
+static const struct dpu_merge_3d_cfg sm8450_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x4e000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x4f000, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x50000, .len = 0x8,
+	}, {
+		.name = "merge_3d_3", .id = MERGE_3D_3,
+		.base = 0x65f00, .len = 0x8,
+	},
+};
+
+/*
+ * NOTE: Each display compression engine (DCE) contains dual hard
+ * slice DSC encoders so both share same base address but with
+ * its own different sub block address.
+ */
+static const struct dpu_dsc_cfg sm8450_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_0_1", .id = DSC_1,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_1_0", .id = DSC_2,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_1_1", .id = DSC_3,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	},
+};
+
+static const struct dpu_wb_cfg sm8450_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb),
+		.clk_ctrl = DPU_CLK_CTRL_WB2,
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+
+static const struct dpu_intf_cfg sm8450_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x36000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x37000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	},
+};
+
+static const struct dpu_perf_cfg sm8450_perf_data = {
+	.max_bw_low = 13600000,
+	.max_bw_high = 18200000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 35,
+	/* FIXME: lut tables */
+	.danger_lut_tbl = {0x3ffff, 0x3ffff, 0x0},
+	.safe_lut_tbl = {0xfe00, 0xfe00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc7180_qos_linear),
+		.entries = sc7180_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm8450_mdss_ver = {
+	.core_major_ver = 8,
+	.core_minor_ver = 1,
+};
+
+const struct dpu_mdss_cfg dpu_sm8450_cfg = {
+	.mdss_ver = &sm8450_mdss_ver,
+	.caps = &sm8450_dpu_caps,
+	.mdp = &sm8450_mdp,
+	.ctl_count = ARRAY_SIZE(sm8450_ctl),
+	.ctl = sm8450_ctl,
+	.sspp_count = ARRAY_SIZE(sm8450_sspp),
+	.sspp = sm8450_sspp,
+	.mixer_count = ARRAY_SIZE(sm8450_lm),
+	.mixer = sm8450_lm,
+	.dspp_count = ARRAY_SIZE(sm8450_dspp),
+	.dspp = sm8450_dspp,
+	.pingpong_count = ARRAY_SIZE(sm8450_pp),
+	.pingpong = sm8450_pp,
+	.dsc_count = ARRAY_SIZE(sm8450_dsc),
+	.dsc = sm8450_dsc,
+	.merge_3d_count = ARRAY_SIZE(sm8450_merge_3d),
+	.merge_3d = sm8450_merge_3d,
+	.wb_count = ARRAY_SIZE(sm8450_wb),
+	.wb = sm8450_wb,
+	.intf_count = ARRAY_SIZE(sm8450_intf),
+	.intf = sm8450_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sm8450_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_8_4_qcs8300.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_8_4_qcs8300.h
@@ -0,0 +1,485 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_8_4_QCS8300_H
+#define _DPU_8_4_QCS8300_H
+
+static const struct dpu_caps qcs8300_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 5120,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg qcs8300_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.features = BIT(DPU_MDP_PERIPH_0_REMOVED),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg qcs8300_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x19000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg qcs8300_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg qcs8300_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+		.dspp = DSPP_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+		.dspp = DSPP_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg qcs8300_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg qcs8300_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x6d000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x6e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	}, {
+		.name = "pingpong_6", .id = PINGPONG_6,
+		.base = 0x65800, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	}, {
+		.name = "pingpong_7", .id = PINGPONG_7,
+		.base = 0x65c00, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	},
+};
+
+static const struct dpu_merge_3d_cfg qcs8300_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x4e000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x4f000, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x50000, .len = 0x8,
+	}, {
+		.name = "merge_3d_3", .id = MERGE_3D_3,
+		.base = 0x65f00, .len = 0x8,
+	},
+};
+
+/*
+ * NOTE: Each display compression engine (DCE) contains dual hard
+ * slice DSC encoders so both share same base address but with
+ * its own different sub block address.
+ */
+static const struct dpu_dsc_cfg qcs8300_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_0_1", .id = DSC_1,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_1_0", .id = DSC_2,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_1_1", .id = DSC_3,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_2_0", .id = DSC_4,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_2_1", .id = DSC_5,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	},
+};
+
+static const struct dpu_wb_cfg qcs8300_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb_yuv,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb_yuv),
+		.clk_ctrl = DPU_CLK_CTRL_WB2,
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+/* TODO: INTF 3, 6, 7 and 8 are used for MST, marked as INTF_NONE for now */
+static const struct dpu_intf_cfg qcs8300_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x36000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x37000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	}, {
+		.name = "intf_4", .id = INTF_4,
+		.base = 0x38000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 20),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 21),
+	}, {
+		.name = "intf_6", .id = INTF_6,
+		.base = 0x3A000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 17),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 16),
+	}, {
+		.name = "intf_7", .id = INTF_7,
+		.base = 0x3b000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 18),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 19),
+	}, {
+		.name = "intf_8", .id = INTF_8,
+		.base = 0x3c000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,	/* pair with intf_4 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 12),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 13),
+	},
+};
+
+static const struct dpu_perf_cfg qcs8300_perf_data = {
+	.max_bw_low = 13600000,
+	.max_bw_high = 18200000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 35,
+	/* FIXME: lut tables */
+	.danger_lut_tbl = {0x3ffff, 0x3ffff, 0x0},
+	.safe_lut_tbl = {0xfff0, 0xfff0, 0x1},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version qcs8300_mdss_ver = {
+	.core_major_ver = 8,
+	.core_minor_ver = 4,
+};
+
+const struct dpu_mdss_cfg dpu_qcs8300_cfg = {
+	.mdss_ver = &qcs8300_mdss_ver,
+	.caps = &qcs8300_dpu_caps,
+	.mdp = &qcs8300_mdp,
+	.cdm = &sc7280_cdm,
+	.ctl_count = ARRAY_SIZE(qcs8300_ctl),
+	.ctl = qcs8300_ctl,
+	.sspp_count = ARRAY_SIZE(qcs8300_sspp),
+	.sspp = qcs8300_sspp,
+	.mixer_count = ARRAY_SIZE(qcs8300_lm),
+	.mixer = qcs8300_lm,
+	.dspp_count = ARRAY_SIZE(qcs8300_dspp),
+	.dspp = qcs8300_dspp,
+	.pingpong_count = ARRAY_SIZE(qcs8300_pp),
+	.pingpong = qcs8300_pp,
+	.dsc_count = ARRAY_SIZE(qcs8300_dsc),
+	.dsc = qcs8300_dsc,
+	.merge_3d_count = ARRAY_SIZE(qcs8300_merge_3d),
+	.merge_3d = qcs8300_merge_3d,
+	.wb_count = ARRAY_SIZE(qcs8300_wb),
+	.wb = qcs8300_wb,
+	.intf_count = ARRAY_SIZE(qcs8300_intf),
+	.intf = qcs8300_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &qcs8300_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_8_4_sa8775p.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_8_4_sa8775p.h
@@ -0,0 +1,485 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_8_4_SA8775P_H
+#define _DPU_8_4_SA8775P_H
+
+static const struct dpu_caps sa8775p_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 5120,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sa8775p_mdp = {
+	.name = "top_0",
+	.base = 0x0, .len = 0x494,
+	.features = BIT(DPU_MDP_PERIPH_0_REMOVED),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_VIG0] = { .reg_off = 0x2ac, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG1] = { .reg_off = 0x2b4, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG2] = { .reg_off = 0x2bc, .bit_off = 0 },
+		[DPU_CLK_CTRL_VIG3] = { .reg_off = 0x2c4, .bit_off = 0 },
+		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg sa8775p_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x204,
+		.features = BIT(DPU_CTL_SPLIT_DISPLAY) | CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x19000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a000, .len = 0x204,
+		.features = CTL_SC7280_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sa8775p_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x32c,
+		.features = VIG_SDM845_MASK_SDMA,
+		.sblk = &dpu_vig_sblk_qseed3_3_1,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA0,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x32c,
+		.features = DMA_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA1,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA2,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x32c,
+		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+		.clk_ctrl = DPU_CLK_CTRL_DMA3,
+	},
+};
+
+static const struct dpu_lm_cfg sa8775p_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+		.dspp = DSPP_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+		.dspp = DSPP_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x400,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sa8775p_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+
+static const struct dpu_pingpong_cfg sa8775p_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x6d000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x6e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	}, {
+		.name = "pingpong_6", .id = PINGPONG_6,
+		.base = 0x65800, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	}, {
+		.name = "pingpong_7", .id = PINGPONG_7,
+		.base = 0x65c00, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	},
+};
+
+static const struct dpu_merge_3d_cfg sa8775p_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x4e000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x4f000, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x50000, .len = 0x8,
+	}, {
+		.name = "merge_3d_3", .id = MERGE_3D_3,
+		.base = 0x65f00, .len = 0x8,
+	},
+};
+
+/*
+ * NOTE: Each display compression engine (DCE) contains dual hard
+ * slice DSC encoders so both share same base address but with
+ * its own different sub block address.
+ */
+static const struct dpu_dsc_cfg sa8775p_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_0_1", .id = DSC_1,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_1_0", .id = DSC_2,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_1_1", .id = DSC_3,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_2_0", .id = DSC_4,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_2_1", .id = DSC_5,
+		.base = 0x82000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	},
+};
+
+static const struct dpu_wb_cfg sa8775p_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb_yuv,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb_yuv),
+		.clk_ctrl = DPU_CLK_CTRL_WB2,
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+/* TODO: INTF 3, 6, 7 and 8 are used for MST, marked as INTF_NONE for now */
+static const struct dpu_intf_cfg sa8775p_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x36000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x37000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	}, {
+		.name = "intf_4", .id = INTF_4,
+		.base = 0x38000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 20),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 21),
+	}, {
+		.name = "intf_6", .id = INTF_6,
+		.base = 0x3A000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 17),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 16),
+	}, {
+		.name = "intf_7", .id = INTF_7,
+		.base = 0x3b000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,	/* pair with intf_0 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 18),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 19),
+	}, {
+		.name = "intf_8", .id = INTF_8,
+		.base = 0x3c000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,	/* pair with intf_4 for DP MST */
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 12),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 13),
+	},
+};
+
+static const struct dpu_perf_cfg sa8775p_perf_data = {
+	.max_bw_low = 13600000,
+	.max_bw_high = 18200000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 35,
+	/* FIXME: lut tables */
+	.danger_lut_tbl = {0x3ffff, 0x3ffff, 0x0},
+	.safe_lut_tbl = {0xfff0, 0xfff0, 0x1},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sm6350_qos_linear_macrotile),
+		.entries = sm6350_qos_linear_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sa8775p_mdss_ver = {
+	.core_major_ver = 8,
+	.core_minor_ver = 4,
+};
+
+const struct dpu_mdss_cfg dpu_sa8775p_cfg = {
+	.mdss_ver = &sa8775p_mdss_ver,
+	.caps = &sa8775p_dpu_caps,
+	.mdp = &sa8775p_mdp,
+	.cdm = &sc7280_cdm,
+	.ctl_count = ARRAY_SIZE(sa8775p_ctl),
+	.ctl = sa8775p_ctl,
+	.sspp_count = ARRAY_SIZE(sa8775p_sspp),
+	.sspp = sa8775p_sspp,
+	.mixer_count = ARRAY_SIZE(sa8775p_lm),
+	.mixer = sa8775p_lm,
+	.dspp_count = ARRAY_SIZE(sa8775p_dspp),
+	.dspp = sa8775p_dspp,
+	.pingpong_count = ARRAY_SIZE(sa8775p_pp),
+	.pingpong = sa8775p_pp,
+	.dsc_count = ARRAY_SIZE(sa8775p_dsc),
+	.dsc = sa8775p_dsc,
+	.merge_3d_count = ARRAY_SIZE(sa8775p_merge_3d),
+	.merge_3d = sa8775p_merge_3d,
+	.wb_count = ARRAY_SIZE(sa8775p_wb),
+	.wb = sa8775p_wb,
+	.intf_count = ARRAY_SIZE(sa8775p_intf),
+	.intf = sa8775p_intf,
+	.vbif_count = ARRAY_SIZE(sdm845_vbif),
+	.vbif = sdm845_vbif,
+	.perf = &sa8775p_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_9_0_sm8550.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/catalog/dpu_9_0_sm8550.h
@@ -0,0 +1,431 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022. Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_9_0_SM8550_H
+#define _DPU_9_0_SM8550_H
+
+static const struct dpu_caps sm8550_dpu_caps = {
+	.max_mixer_width = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.max_mixer_blendstages = 0xb,
+	.has_src_split = true,
+	.has_dim_layer = true,
+	.has_idle_pc = true,
+	.has_3d_merge = true,
+	.max_linewidth = 5120,
+	.pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE,
+};
+
+static const struct dpu_mdp_cfg sm8550_mdp = {
+	.name = "top_0",
+	.base = 0, .len = 0x494,
+	.features = BIT(DPU_MDP_PERIPH_0_REMOVED),
+	.clk_ctrls = {
+		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+	},
+};
+
+/* FIXME: get rid of DPU_CTL_SPLIT_DISPLAY in favour of proper ACTIVE_CTL support */
+static const struct dpu_ctl_cfg sm8550_ctl[] = {
+	{
+		.name = "ctl_0", .id = CTL_0,
+		.base = 0x15000, .len = 0x290,
+		.features = CTL_SM8550_MASK | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9),
+	}, {
+		.name = "ctl_1", .id = CTL_1,
+		.base = 0x16000, .len = 0x290,
+		.features = CTL_SM8550_MASK | BIT(DPU_CTL_SPLIT_DISPLAY),
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10),
+	}, {
+		.name = "ctl_2", .id = CTL_2,
+		.base = 0x17000, .len = 0x290,
+		.features = CTL_SM8550_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11),
+	}, {
+		.name = "ctl_3", .id = CTL_3,
+		.base = 0x18000, .len = 0x290,
+		.features = CTL_SM8550_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12),
+	}, {
+		.name = "ctl_4", .id = CTL_4,
+		.base = 0x19000, .len = 0x290,
+		.features = CTL_SM8550_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13),
+	}, {
+		.name = "ctl_5", .id = CTL_5,
+		.base = 0x1a000, .len = 0x290,
+		.features = CTL_SM8550_MASK,
+		.intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 23),
+	},
+};
+
+static const struct dpu_sspp_cfg sm8550_sspp[] = {
+	{
+		.name = "sspp_0", .id = SSPP_VIG0,
+		.base = 0x4000, .len = 0x344,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_2,
+		.xin_id = 0,
+		.type = SSPP_TYPE_VIG,
+	}, {
+		.name = "sspp_1", .id = SSPP_VIG1,
+		.base = 0x6000, .len = 0x344,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_2,
+		.xin_id = 4,
+		.type = SSPP_TYPE_VIG,
+	}, {
+		.name = "sspp_2", .id = SSPP_VIG2,
+		.base = 0x8000, .len = 0x344,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_2,
+		.xin_id = 8,
+		.type = SSPP_TYPE_VIG,
+	}, {
+		.name = "sspp_3", .id = SSPP_VIG3,
+		.base = 0xa000, .len = 0x344,
+		.features = VIG_SDM845_MASK,
+		.sblk = &dpu_vig_sblk_qseed3_3_2,
+		.xin_id = 12,
+		.type = SSPP_TYPE_VIG,
+	}, {
+		.name = "sspp_8", .id = SSPP_DMA0,
+		.base = 0x24000, .len = 0x344,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 1,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_9", .id = SSPP_DMA1,
+		.base = 0x26000, .len = 0x344,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 5,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_10", .id = SSPP_DMA2,
+		.base = 0x28000, .len = 0x344,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 9,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_11", .id = SSPP_DMA3,
+		.base = 0x2a000, .len = 0x344,
+		.features = DMA_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 13,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_12", .id = SSPP_DMA4,
+		.base = 0x2c000, .len = 0x344,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 14,
+		.type = SSPP_TYPE_DMA,
+	}, {
+		.name = "sspp_13", .id = SSPP_DMA5,
+		.base = 0x2e000, .len = 0x344,
+		.features = DMA_CURSOR_SDM845_MASK,
+		.sblk = &dpu_dma_sblk,
+		.xin_id = 15,
+		.type = SSPP_TYPE_DMA,
+	},
+};
+
+static const struct dpu_lm_cfg sm8550_lm[] = {
+	{
+		.name = "lm_0", .id = LM_0,
+		.base = 0x44000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_1,
+		.pingpong = PINGPONG_0,
+		.dspp = DSPP_0,
+	}, {
+		.name = "lm_1", .id = LM_1,
+		.base = 0x45000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_0,
+		.pingpong = PINGPONG_1,
+		.dspp = DSPP_1,
+	}, {
+		.name = "lm_2", .id = LM_2,
+		.base = 0x46000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_3,
+		.pingpong = PINGPONG_2,
+	}, {
+		.name = "lm_3", .id = LM_3,
+		.base = 0x47000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_2,
+		.pingpong = PINGPONG_3,
+	}, {
+		.name = "lm_4", .id = LM_4,
+		.base = 0x48000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_5,
+		.pingpong = PINGPONG_4,
+	}, {
+		.name = "lm_5", .id = LM_5,
+		.base = 0x49000, .len = 0x320,
+		.features = MIXER_SDM845_MASK,
+		.sblk = &sdm845_lm_sblk,
+		.lm_pair = LM_4,
+		.pingpong = PINGPONG_5,
+	},
+};
+
+static const struct dpu_dspp_cfg sm8550_dspp[] = {
+	{
+		.name = "dspp_0", .id = DSPP_0,
+		.base = 0x54000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_1", .id = DSPP_1,
+		.base = 0x56000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_2", .id = DSPP_2,
+		.base = 0x58000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	}, {
+		.name = "dspp_3", .id = DSPP_3,
+		.base = 0x5a000, .len = 0x1800,
+		.features = DSPP_SC7180_MASK,
+		.sblk = &sdm845_dspp_sblk,
+	},
+};
+static const struct dpu_pingpong_cfg sm8550_pp[] = {
+	{
+		.name = "pingpong_0", .id = PINGPONG_0,
+		.base = 0x69000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 8),
+	}, {
+		.name = "pingpong_1", .id = PINGPONG_1,
+		.base = 0x6a000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_0,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 9),
+	}, {
+		.name = "pingpong_2", .id = PINGPONG_2,
+		.base = 0x6b000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10),
+	}, {
+		.name = "pingpong_3", .id = PINGPONG_3,
+		.base = 0x6c000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_1,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11),
+	}, {
+		.name = "pingpong_4", .id = PINGPONG_4,
+		.base = 0x6d000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 30),
+	}, {
+		.name = "pingpong_5", .id = PINGPONG_5,
+		.base = 0x6e000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_2,
+		.intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 31),
+	}, {
+		.name = "pingpong_6", .id = PINGPONG_6,
+		.base = 0x66000, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	}, {
+		.name = "pingpong_7", .id = PINGPONG_7,
+		.base = 0x66400, .len = 0,
+		.features = BIT(DPU_PINGPONG_DITHER),
+		.sblk = &sc7280_pp_sblk,
+		.merge_3d = MERGE_3D_3,
+	},
+};
+
+static const struct dpu_merge_3d_cfg sm8550_merge_3d[] = {
+	{
+		.name = "merge_3d_0", .id = MERGE_3D_0,
+		.base = 0x4e000, .len = 0x8,
+	}, {
+		.name = "merge_3d_1", .id = MERGE_3D_1,
+		.base = 0x4f000, .len = 0x8,
+	}, {
+		.name = "merge_3d_2", .id = MERGE_3D_2,
+		.base = 0x50000, .len = 0x8,
+	}, {
+		.name = "merge_3d_3", .id = MERGE_3D_3,
+		.base = 0x66700, .len = 0x8,
+	},
+};
+
+/*
+ * NOTE: Each display compression engine (DCE) contains dual hard
+ * slice DSC encoders so both share same base address but with
+ * its own different sub block address.
+ */
+static const struct dpu_dsc_cfg sm8550_dsc[] = {
+	{
+		.name = "dce_0_0", .id = DSC_0,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_0_1", .id = DSC_1,
+		.base = 0x80000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2),
+		.sblk = &dsc_sblk_1,
+	}, {
+		.name = "dce_1_0", .id = DSC_2,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_0,
+	}, {
+		.name = "dce_1_1", .id = DSC_3,
+		.base = 0x81000, .len = 0x4,
+		.features = BIT(DPU_DSC_HW_REV_1_2) | BIT(DPU_DSC_NATIVE_42x_EN),
+		.sblk = &dsc_sblk_1,
+	},
+};
+
+static const struct dpu_wb_cfg sm8550_wb[] = {
+	{
+		.name = "wb_2", .id = WB_2,
+		.base = 0x65000, .len = 0x2c8,
+		.features = WB_SM8250_MASK,
+		.format_list = wb2_formats_rgb,
+		.num_formats = ARRAY_SIZE(wb2_formats_rgb),
+		.xin_id = 6,
+		.vbif_idx = VBIF_RT,
+		.maxlinewidth = 4096,
+		.intr_wb_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 4),
+	},
+};
+
+static const struct dpu_intf_cfg sm8550_intf[] = {
+	{
+		.name = "intf_0", .id = INTF_0,
+		.base = 0x34000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+	}, {
+		.name = "intf_1", .id = INTF_1,
+		.base = 0x35000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_0,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF1_TEAR_INTR, 2),
+	}, {
+		.name = "intf_2", .id = INTF_2,
+		.base = 0x36000, .len = 0x300,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DSI,
+		.controller_id = MSM_DSI_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+		.intr_tear_rd_ptr = DPU_IRQ_IDX(MDP_INTF2_TEAR_INTR, 2),
+	}, {
+		.name = "intf_3", .id = INTF_3,
+		.base = 0x37000, .len = 0x280,
+		.features = INTF_SC7280_MASK,
+		.type = INTF_DP,
+		.controller_id = MSM_DP_CONTROLLER_1,
+		.prog_fetch_lines_worst_case = 24,
+		.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+		.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+	},
+};
+
+static const struct dpu_perf_cfg sm8550_perf_data = {
+	.max_bw_low = 13600000,
+	.max_bw_high = 18200000,
+	.min_core_ib = 2500000,
+	.min_llcc_ib = 0,
+	.min_dram_ib = 800000,
+	.min_prefill_lines = 35,
+	/* FIXME: lut tables */
+	.danger_lut_tbl = {0x3ffff, 0x3ffff, 0x0},
+	.safe_lut_tbl = {0xfe00, 0xfe00, 0xffff},
+	.qos_lut_tbl = {
+		{.nentry = ARRAY_SIZE(sc7180_qos_linear),
+		.entries = sc7180_qos_linear
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_macrotile),
+		.entries = sc7180_qos_macrotile
+		},
+		{.nentry = ARRAY_SIZE(sc7180_qos_nrt),
+		.entries = sc7180_qos_nrt
+		},
+		/* TODO: macrotile-qseed is different from macrotile */
+	},
+	.cdp_cfg = {
+		{.rd_enable = 1, .wr_enable = 1},
+		{.rd_enable = 1, .wr_enable = 0}
+	},
+	.clk_inefficiency_factor = 105,
+	.bw_inefficiency_factor = 120,
+};
+
+static const struct dpu_mdss_version sm8550_mdss_ver = {
+	.core_major_ver = 9,
+	.core_minor_ver = 0,
+};
+
+const struct dpu_mdss_cfg dpu_sm8550_cfg = {
+	.mdss_ver = &sm8550_mdss_ver,
+	.caps = &sm8550_dpu_caps,
+	.mdp = &sm8550_mdp,
+	.ctl_count = ARRAY_SIZE(sm8550_ctl),
+	.ctl = sm8550_ctl,
+	.sspp_count = ARRAY_SIZE(sm8550_sspp),
+	.sspp = sm8550_sspp,
+	.mixer_count = ARRAY_SIZE(sm8550_lm),
+	.mixer = sm8550_lm,
+	.dspp_count = ARRAY_SIZE(sm8550_dspp),
+	.dspp = sm8550_dspp,
+	.pingpong_count = ARRAY_SIZE(sm8550_pp),
+	.pingpong = sm8550_pp,
+	.dsc_count = ARRAY_SIZE(sm8550_dsc),
+	.dsc = sm8550_dsc,
+	.merge_3d_count = ARRAY_SIZE(sm8550_merge_3d),
+	.merge_3d = sm8550_merge_3d,
+	.wb_count = ARRAY_SIZE(sm8550_wb),
+	.wb = sm8550_wb,
+	.intf_count = ARRAY_SIZE(sm8550_intf),
+	.intf = sm8550_intf,
+	.vbif_count = ARRAY_SIZE(sm8550_vbif),
+	.vbif = sm8550_vbif,
+	.perf = &sm8550_perf_data,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_core_irq.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_core_irq.h
@@ -0,0 +1,80 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __DPU_CORE_IRQ_H__
+#define __DPU_CORE_IRQ_H__
+
+#include "dpu_kms.h"
+#include "dpu_hw_interrupts.h"
+
+/**
+ * dpu_core_irq_preinstall - perform pre-installation of core IRQ handler
+ * @kms:		MSM KMS handle
+ * @return:		none
+ */
+void dpu_core_irq_preinstall(struct msm_kms *kms);
+
+/**
+ * dpu_core_irq_uninstall - uninstall core IRQ handler
+ * @kms:		MSM KMS handle
+ * @return:		none
+ */
+void dpu_core_irq_uninstall(struct msm_kms *kms);
+
+/**
+ * dpu_core_irq - core IRQ handler
+ * @kms:		MSM KMS handle
+ * @return:		interrupt handling status
+ */
+irqreturn_t dpu_core_irq(struct msm_kms *kms);
+
+/**
+ * dpu_core_irq_read - IRQ helper function for reading IRQ status
+ * @dpu_kms:		DPU handle
+ * @irq_idx:		irq index
+ * @return:		non-zero if irq detected; otherwise no irq detected
+ */
+u32 dpu_core_irq_read(
+		struct dpu_kms *dpu_kms,
+		unsigned int irq_idx);
+
+/**
+ * dpu_core_irq_register_callback - For registering callback function on IRQ
+ *                             interrupt
+ * @dpu_kms:		DPU handle
+ * @irq_idx:		irq index
+ * @irq_cb:		IRQ callback funcion.
+ * @irq_arg:		IRQ callback argument.
+ * @return:		0 for success registering callback, otherwise failure
+ *
+ * This function supports registration of multiple callbacks for each interrupt.
+ */
+int dpu_core_irq_register_callback(
+		struct dpu_kms *dpu_kms,
+		unsigned int irq_idx,
+		void (*irq_cb)(void *arg),
+		void *irq_arg);
+
+/**
+ * dpu_core_irq_unregister_callback - For unregistering callback function on IRQ
+ *                             interrupt
+ * @dpu_kms:		DPU handle
+ * @irq_idx:		irq index
+ * @return:		0 for success registering callback, otherwise failure
+ *
+ * This function supports registration of multiple callbacks for each interrupt.
+ */
+int dpu_core_irq_unregister_callback(
+		struct dpu_kms *dpu_kms,
+		unsigned int irq_idx);
+
+/**
+ * dpu_debugfs_core_irq_init - register core irq debugfs
+ * @dpu_kms: pointer to kms
+ * @parent: debugfs directory root
+ */
+void dpu_debugfs_core_irq_init(struct dpu_kms *dpu_kms,
+		struct dentry *parent);
+
+#endif /* __DPU_CORE_IRQ_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_core_perf.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_core_perf.c
@@ -0,0 +1,493 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+
+#include <linux/debugfs.h>
+#include <linux/errno.h>
+#include <linux/mutex.h>
+#include <linux/pm_opp.h>
+#include <linux/sort.h>
+#include <linux/clk.h>
+#include <linux/bitmap.h>
+
+#include "dpu_kms.h"
+#include "dpu_trace.h"
+#include "dpu_crtc.h"
+#include "dpu_core_perf.h"
+
+/**
+ * enum dpu_perf_mode - performance tuning mode
+ * @DPU_PERF_MODE_NORMAL: performance controlled by user mode client
+ * @DPU_PERF_MODE_MINIMUM: performance bounded by minimum setting
+ * @DPU_PERF_MODE_FIXED: performance bounded by fixed setting
+ * @DPU_PERF_MODE_MAX: maximum value, used for error checking
+ */
+enum dpu_perf_mode {
+	DPU_PERF_MODE_NORMAL,
+	DPU_PERF_MODE_MINIMUM,
+	DPU_PERF_MODE_FIXED,
+	DPU_PERF_MODE_MAX
+};
+
+/**
+ * _dpu_core_perf_calc_bw() - to calculate BW per crtc
+ * @perf_cfg: performance configuration
+ * @crtc: pointer to a crtc
+ * Return: returns aggregated BW for all planes in crtc.
+ */
+static u64 _dpu_core_perf_calc_bw(const struct dpu_perf_cfg *perf_cfg,
+		struct drm_crtc *crtc)
+{
+	struct drm_plane *plane;
+	struct dpu_plane_state *pstate;
+	u64 crtc_plane_bw = 0;
+	u32 bw_factor;
+
+	drm_atomic_crtc_for_each_plane(plane, crtc) {
+		pstate = to_dpu_plane_state(plane->state);
+		if (!pstate)
+			continue;
+
+		crtc_plane_bw += pstate->plane_fetch_bw;
+	}
+
+	bw_factor = perf_cfg->bw_inefficiency_factor;
+	if (bw_factor) {
+		crtc_plane_bw *= bw_factor;
+		do_div(crtc_plane_bw, 100);
+	}
+
+	return crtc_plane_bw;
+}
+
+/**
+ * _dpu_core_perf_calc_clk() - to calculate clock per crtc
+ * @perf_cfg: performance configuration
+ * @crtc: pointer to a crtc
+ * @state: pointer to a crtc state
+ * Return: returns max clk for all planes in crtc.
+ */
+static u64 _dpu_core_perf_calc_clk(const struct dpu_perf_cfg *perf_cfg,
+		struct drm_crtc *crtc, struct drm_crtc_state *state)
+{
+	struct drm_plane *plane;
+	struct dpu_plane_state *pstate;
+	struct drm_display_mode *mode;
+	u64 crtc_clk;
+	u32 clk_factor;
+
+	mode = &state->adjusted_mode;
+
+	crtc_clk = mode->vtotal * mode->hdisplay * drm_mode_vrefresh(mode);
+
+	drm_atomic_crtc_for_each_plane(plane, crtc) {
+		pstate = to_dpu_plane_state(plane->state);
+		if (!pstate)
+			continue;
+
+		crtc_clk = max(pstate->plane_clk, crtc_clk);
+	}
+
+	clk_factor = perf_cfg->clk_inefficiency_factor;
+	if (clk_factor) {
+		crtc_clk *= clk_factor;
+		do_div(crtc_clk, 100);
+	}
+
+	return crtc_clk;
+}
+
+static struct dpu_kms *_dpu_crtc_get_kms(struct drm_crtc *crtc)
+{
+	struct msm_drm_private *priv;
+	priv = crtc->dev->dev_private;
+	return to_dpu_kms(priv->kms);
+}
+
+static void _dpu_core_perf_calc_crtc(const struct dpu_core_perf *core_perf,
+				     struct drm_crtc *crtc,
+				     struct drm_crtc_state *state,
+				     struct dpu_core_perf_params *perf)
+{
+	const struct dpu_perf_cfg *perf_cfg = core_perf->perf_cfg;
+
+	if (!perf_cfg || !crtc || !state || !perf) {
+		DPU_ERROR("invalid parameters\n");
+		return;
+	}
+
+	memset(perf, 0, sizeof(struct dpu_core_perf_params));
+
+	if (core_perf->perf_tune.mode == DPU_PERF_MODE_MINIMUM) {
+		perf->bw_ctl = 0;
+		perf->max_per_pipe_ib = 0;
+		perf->core_clk_rate = 0;
+	} else if (core_perf->perf_tune.mode == DPU_PERF_MODE_FIXED) {
+		perf->bw_ctl = core_perf->fix_core_ab_vote;
+		perf->max_per_pipe_ib = core_perf->fix_core_ib_vote;
+		perf->core_clk_rate = core_perf->fix_core_clk_rate;
+	} else {
+		perf->bw_ctl = _dpu_core_perf_calc_bw(perf_cfg, crtc);
+		perf->max_per_pipe_ib = perf_cfg->min_dram_ib;
+		perf->core_clk_rate = _dpu_core_perf_calc_clk(perf_cfg, crtc, state);
+	}
+
+	DRM_DEBUG_ATOMIC(
+		"crtc=%d clk_rate=%llu core_ib=%llu core_ab=%llu\n",
+			crtc->base.id, perf->core_clk_rate,
+			perf->max_per_pipe_ib, perf->bw_ctl);
+}
+
+int dpu_core_perf_crtc_check(struct drm_crtc *crtc,
+		struct drm_crtc_state *state)
+{
+	u32 bw, threshold;
+	u64 bw_sum_of_intfs = 0;
+	enum dpu_crtc_client_type curr_client_type;
+	struct dpu_crtc_state *dpu_cstate;
+	struct drm_crtc *tmp_crtc;
+	struct dpu_kms *kms;
+
+	if (!crtc || !state) {
+		DPU_ERROR("invalid crtc\n");
+		return -EINVAL;
+	}
+
+	kms = _dpu_crtc_get_kms(crtc);
+
+	/* we only need bandwidth check on real-time clients (interfaces) */
+	if (dpu_crtc_get_client_type(crtc) == NRT_CLIENT)
+		return 0;
+
+	dpu_cstate = to_dpu_crtc_state(state);
+
+	/* obtain new values */
+	_dpu_core_perf_calc_crtc(&kms->perf, crtc, state, &dpu_cstate->new_perf);
+
+	bw_sum_of_intfs = dpu_cstate->new_perf.bw_ctl;
+	curr_client_type = dpu_crtc_get_client_type(crtc);
+
+	drm_for_each_crtc(tmp_crtc, crtc->dev) {
+		if (tmp_crtc->enabled &&
+		    dpu_crtc_get_client_type(tmp_crtc) == curr_client_type &&
+		    tmp_crtc != crtc) {
+			struct dpu_crtc_state *tmp_cstate =
+				to_dpu_crtc_state(tmp_crtc->state);
+
+			DRM_DEBUG_ATOMIC("crtc:%d bw:%llu ctrl:%d\n",
+					 tmp_crtc->base.id, tmp_cstate->new_perf.bw_ctl,
+					 tmp_cstate->bw_control);
+
+			bw_sum_of_intfs += tmp_cstate->new_perf.bw_ctl;
+		}
+
+		/* convert bandwidth to kb */
+		bw = DIV_ROUND_UP_ULL(bw_sum_of_intfs, 1000);
+		DRM_DEBUG_ATOMIC("calculated bandwidth=%uk\n", bw);
+
+		threshold = kms->perf.perf_cfg->max_bw_high;
+
+		DRM_DEBUG_ATOMIC("final threshold bw limit = %d\n", threshold);
+
+		if (!threshold) {
+			DPU_ERROR("no bandwidth limits specified\n");
+			return -E2BIG;
+		} else if (bw > threshold) {
+			DPU_ERROR("exceeds bandwidth: %ukb > %ukb\n", bw,
+					threshold);
+			return -E2BIG;
+		}
+	}
+
+	return 0;
+}
+
+static int _dpu_core_perf_crtc_update_bus(struct dpu_kms *kms,
+		struct drm_crtc *crtc)
+{
+	struct dpu_core_perf_params perf = { 0 };
+	enum dpu_crtc_client_type curr_client_type
+					= dpu_crtc_get_client_type(crtc);
+	struct drm_crtc *tmp_crtc;
+	struct dpu_crtc_state *dpu_cstate;
+	int i, ret = 0;
+	u64 avg_bw;
+
+	if (!kms->num_paths)
+		return 0;
+
+	drm_for_each_crtc(tmp_crtc, crtc->dev) {
+		if (tmp_crtc->enabled &&
+			curr_client_type ==
+				dpu_crtc_get_client_type(tmp_crtc)) {
+			dpu_cstate = to_dpu_crtc_state(tmp_crtc->state);
+
+			perf.max_per_pipe_ib = max(perf.max_per_pipe_ib,
+					dpu_cstate->new_perf.max_per_pipe_ib);
+
+			perf.bw_ctl += dpu_cstate->new_perf.bw_ctl;
+
+			DRM_DEBUG_ATOMIC("crtc=%d bw=%llu paths:%d\n",
+				  tmp_crtc->base.id,
+				  dpu_cstate->new_perf.bw_ctl, kms->num_paths);
+		}
+	}
+
+	avg_bw = perf.bw_ctl;
+	do_div(avg_bw, (kms->num_paths * 1000)); /*Bps_to_icc*/
+
+	for (i = 0; i < kms->num_paths; i++)
+		icc_set_bw(kms->path[i], avg_bw, perf.max_per_pipe_ib);
+
+	return ret;
+}
+
+/**
+ * dpu_core_perf_crtc_release_bw() - request zero bandwidth
+ * @crtc: pointer to a crtc
+ *
+ * Function checks a state variable for the crtc, if all pending commit
+ * requests are done, meaning no more bandwidth is needed, release
+ * bandwidth request.
+ */
+void dpu_core_perf_crtc_release_bw(struct drm_crtc *crtc)
+{
+	struct dpu_crtc *dpu_crtc;
+	struct dpu_kms *kms;
+
+	if (!crtc) {
+		DPU_ERROR("invalid crtc\n");
+		return;
+	}
+
+	kms = _dpu_crtc_get_kms(crtc);
+	dpu_crtc = to_dpu_crtc(crtc);
+
+	if (atomic_dec_return(&kms->bandwidth_ref) > 0)
+		return;
+
+	/* Release the bandwidth */
+	if (kms->perf.enable_bw_release) {
+		trace_dpu_cmd_release_bw(crtc->base.id);
+		DRM_DEBUG_ATOMIC("Release BW crtc=%d\n", crtc->base.id);
+		dpu_crtc->cur_perf.bw_ctl = 0;
+		_dpu_core_perf_crtc_update_bus(kms, crtc);
+	}
+}
+
+static u64 _dpu_core_perf_get_core_clk_rate(struct dpu_kms *kms)
+{
+	u64 clk_rate;
+	struct drm_crtc *crtc;
+	struct dpu_crtc_state *dpu_cstate;
+
+	if (kms->perf.perf_tune.mode == DPU_PERF_MODE_FIXED)
+		return kms->perf.fix_core_clk_rate;
+
+	if (kms->perf.perf_tune.mode == DPU_PERF_MODE_MINIMUM)
+		return kms->perf.max_core_clk_rate;
+
+	clk_rate = 0;
+	drm_for_each_crtc(crtc, kms->dev) {
+		if (crtc->enabled) {
+			dpu_cstate = to_dpu_crtc_state(crtc->state);
+			clk_rate = max(dpu_cstate->new_perf.core_clk_rate,
+							clk_rate);
+		}
+	}
+
+	return clk_rate;
+}
+
+int dpu_core_perf_crtc_update(struct drm_crtc *crtc,
+			      int params_changed)
+{
+	struct dpu_core_perf_params *new, *old;
+	bool update_bus = false, update_clk = false;
+	u64 clk_rate = 0;
+	struct dpu_crtc *dpu_crtc;
+	struct dpu_crtc_state *dpu_cstate;
+	struct dpu_kms *kms;
+	int ret;
+
+	if (!crtc) {
+		DPU_ERROR("invalid crtc\n");
+		return -EINVAL;
+	}
+
+	kms = _dpu_crtc_get_kms(crtc);
+
+	dpu_crtc = to_dpu_crtc(crtc);
+	dpu_cstate = to_dpu_crtc_state(crtc->state);
+
+	DRM_DEBUG_ATOMIC("crtc:%d enabled:%d core_clk:%llu\n",
+			crtc->base.id, crtc->enabled, kms->perf.core_clk_rate);
+
+	old = &dpu_crtc->cur_perf;
+	new = &dpu_cstate->new_perf;
+
+	if (crtc->enabled) {
+		/*
+		 * cases for bus bandwidth update.
+		 * 1. new bandwidth vote - "ab or ib vote" is higher
+		 *    than current vote for update request.
+		 * 2. new bandwidth vote - "ab or ib vote" is lower
+		 *    than current vote at end of commit or stop.
+		 */
+		if ((params_changed && ((new->bw_ctl > old->bw_ctl) ||
+			(new->max_per_pipe_ib > old->max_per_pipe_ib)))	||
+			(!params_changed && ((new->bw_ctl < old->bw_ctl) ||
+			(new->max_per_pipe_ib < old->max_per_pipe_ib)))) {
+			DRM_DEBUG_ATOMIC("crtc=%d p=%d new_bw=%llu,old_bw=%llu\n",
+				crtc->base.id, params_changed,
+				new->bw_ctl, old->bw_ctl);
+			old->bw_ctl = new->bw_ctl;
+			old->max_per_pipe_ib = new->max_per_pipe_ib;
+			update_bus = true;
+		}
+
+		if ((params_changed && new->core_clk_rate > old->core_clk_rate) ||
+		    (!params_changed && new->core_clk_rate < old->core_clk_rate)) {
+			old->core_clk_rate = new->core_clk_rate;
+			update_clk = true;
+		}
+	} else {
+		DRM_DEBUG_ATOMIC("crtc=%d disable\n", crtc->base.id);
+		memset(old, 0, sizeof(*old));
+		update_bus = true;
+		update_clk = true;
+	}
+
+	trace_dpu_perf_crtc_update(crtc->base.id, new->bw_ctl,
+		new->core_clk_rate, !crtc->enabled, update_bus, update_clk);
+
+	if (update_bus) {
+		ret = _dpu_core_perf_crtc_update_bus(kms, crtc);
+		if (ret) {
+			DPU_ERROR("crtc-%d: failed to update bus bw vote\n",
+				  crtc->base.id);
+			return ret;
+		}
+	}
+
+	/*
+	 * Update the clock after bandwidth vote to ensure
+	 * bandwidth is available before clock rate is increased.
+	 */
+	if (update_clk) {
+		clk_rate = _dpu_core_perf_get_core_clk_rate(kms);
+
+		DRM_DEBUG_ATOMIC("clk:%llu\n", clk_rate);
+
+		trace_dpu_core_perf_update_clk(kms->dev, !crtc->enabled, clk_rate);
+
+		clk_rate = min(clk_rate, kms->perf.max_core_clk_rate);
+		ret = dev_pm_opp_set_rate(&kms->pdev->dev, clk_rate);
+		if (ret) {
+			DPU_ERROR("failed to set core clock rate %llu\n", clk_rate);
+			return ret;
+		}
+
+		kms->perf.core_clk_rate = clk_rate;
+		DRM_DEBUG_ATOMIC("update clk rate = %lld HZ\n", clk_rate);
+	}
+	return 0;
+}
+
+#ifdef CONFIG_DEBUG_FS
+
+static ssize_t _dpu_core_perf_mode_write(struct file *file,
+		    const char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct dpu_core_perf *perf = file->private_data;
+	u32 perf_mode = 0;
+	int ret;
+
+	ret = kstrtouint_from_user(user_buf, count, 0, &perf_mode);
+	if (ret)
+		return ret;
+
+	if (perf_mode >= DPU_PERF_MODE_MAX)
+		return -EINVAL;
+
+	if (perf_mode == DPU_PERF_MODE_FIXED) {
+		DRM_INFO("fix performance mode\n");
+	} else if (perf_mode == DPU_PERF_MODE_MINIMUM) {
+		/* run the driver with max clk and BW vote */
+		DRM_INFO("minimum performance mode\n");
+	} else if (perf_mode == DPU_PERF_MODE_NORMAL) {
+		/* reset the perf tune params to 0 */
+		DRM_INFO("normal performance mode\n");
+	}
+	perf->perf_tune.mode = perf_mode;
+
+	return count;
+}
+
+static ssize_t _dpu_core_perf_mode_read(struct file *file,
+			char __user *buff, size_t count, loff_t *ppos)
+{
+	struct dpu_core_perf *perf = file->private_data;
+	int len;
+	char buf[128];
+
+	len = scnprintf(buf, sizeof(buf),
+			"mode %d\n",
+			perf->perf_tune.mode);
+
+	return simple_read_from_buffer(buff, count, ppos, buf, len);
+}
+
+static const struct file_operations dpu_core_perf_mode_fops = {
+	.open = simple_open,
+	.read = _dpu_core_perf_mode_read,
+	.write = _dpu_core_perf_mode_write,
+};
+
+int dpu_core_perf_debugfs_init(struct dpu_kms *dpu_kms, struct dentry *parent)
+{
+	struct dpu_core_perf *perf = &dpu_kms->perf;
+	struct dentry *entry;
+
+	entry = debugfs_create_dir("core_perf", parent);
+
+	debugfs_create_u64("max_core_clk_rate", 0600, entry,
+			&perf->max_core_clk_rate);
+	debugfs_create_u64("core_clk_rate", 0600, entry,
+			&perf->core_clk_rate);
+	debugfs_create_u32("enable_bw_release", 0600, entry,
+			(u32 *)&perf->enable_bw_release);
+	debugfs_create_u32("threshold_low", 0400, entry,
+			(u32 *)&perf->perf_cfg->max_bw_low);
+	debugfs_create_u32("threshold_high", 0400, entry,
+			(u32 *)&perf->perf_cfg->max_bw_high);
+	debugfs_create_u32("min_core_ib", 0400, entry,
+			(u32 *)&perf->perf_cfg->min_core_ib);
+	debugfs_create_u32("min_llcc_ib", 0400, entry,
+			(u32 *)&perf->perf_cfg->min_llcc_ib);
+	debugfs_create_u32("min_dram_ib", 0400, entry,
+			(u32 *)&perf->perf_cfg->min_dram_ib);
+	debugfs_create_file("perf_mode", 0600, entry,
+			(u32 *)perf, &dpu_core_perf_mode_fops);
+	debugfs_create_u64("fix_core_clk_rate", 0600, entry,
+			&perf->fix_core_clk_rate);
+	debugfs_create_u64("fix_core_ib_vote", 0600, entry,
+			&perf->fix_core_ib_vote);
+	debugfs_create_u64("fix_core_ab_vote", 0600, entry,
+			&perf->fix_core_ab_vote);
+
+	return 0;
+}
+#endif
+
+int dpu_core_perf_init(struct dpu_core_perf *perf,
+		const struct dpu_perf_cfg *perf_cfg,
+		unsigned long max_core_clk_rate)
+{
+	perf->perf_cfg = perf_cfg;
+	perf->max_core_clk_rate = max_core_clk_rate;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_core_perf.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_core_perf.h
@@ -0,0 +1,100 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_CORE_PERF_H_
+#define _DPU_CORE_PERF_H_
+
+#include <linux/types.h>
+#include <linux/dcache.h>
+#include <linux/mutex.h>
+#include <drm/drm_crtc.h>
+
+#include "dpu_hw_catalog.h"
+
+/**
+ * struct dpu_core_perf_params - definition of performance parameters
+ * @max_per_pipe_ib: maximum instantaneous bandwidth request
+ * @bw_ctl: arbitrated bandwidth request
+ * @core_clk_rate: core clock rate request
+ */
+struct dpu_core_perf_params {
+	u64 max_per_pipe_ib;
+	u64 bw_ctl;
+	u64 core_clk_rate;
+};
+
+/**
+ * struct dpu_core_perf_tune - definition of performance tuning control
+ * @mode: performance mode
+ */
+struct dpu_core_perf_tune {
+	u32 mode;
+};
+
+/**
+ * struct dpu_core_perf - definition of core performance context
+ * @perf_cfg: Platform-specific performance configuration
+ * @core_clk_rate: current core clock rate
+ * @max_core_clk_rate: maximum allowable core clock rate
+ * @perf_tune: debug control for performance tuning
+ * @enable_bw_release: debug control for bandwidth release
+ * @fix_core_clk_rate: fixed core clock request in Hz used in mode 2
+ * @fix_core_ib_vote: fixed core ib vote in bps used in mode 2
+ * @fix_core_ab_vote: fixed core ab vote in bps used in mode 2
+ */
+struct dpu_core_perf {
+	const struct dpu_perf_cfg *perf_cfg;
+	u64 core_clk_rate;
+	u64 max_core_clk_rate;
+	struct dpu_core_perf_tune perf_tune;
+	u32 enable_bw_release;
+	u64 fix_core_clk_rate;
+	u64 fix_core_ib_vote;
+	u64 fix_core_ab_vote;
+};
+
+/**
+ * dpu_core_perf_crtc_check - validate performance of the given crtc state
+ * @crtc: Pointer to crtc
+ * @state: Pointer to new crtc state
+ * return: zero if success, or error code otherwise
+ */
+int dpu_core_perf_crtc_check(struct drm_crtc *crtc,
+		struct drm_crtc_state *state);
+
+/**
+ * dpu_core_perf_crtc_update - update performance of the given crtc
+ * @crtc: Pointer to crtc
+ * @params_changed: true if crtc parameters are modified
+ * return: zero if success, or error code otherwise
+ */
+int dpu_core_perf_crtc_update(struct drm_crtc *crtc,
+			      int params_changed);
+
+/**
+ * dpu_core_perf_crtc_release_bw - release bandwidth of the given crtc
+ * @crtc: Pointer to crtc
+ */
+void dpu_core_perf_crtc_release_bw(struct drm_crtc *crtc);
+
+/**
+ * dpu_core_perf_init - initialize the given core performance context
+ * @perf: Pointer to core performance context
+ * @perf_cfg: Pointer to platform performance configuration
+ * @max_core_clk_rate: Maximum core clock rate
+ */
+int dpu_core_perf_init(struct dpu_core_perf *perf,
+		const struct dpu_perf_cfg *perf_cfg,
+		unsigned long max_core_clk_rate);
+
+struct dpu_kms;
+
+/**
+ * dpu_core_perf_debugfs_init - initialize debugfs for core performance context
+ * @dpu_kms: Pointer to the dpu_kms struct
+ * @debugfs_parent: Pointer to parent debugfs
+ */
+int dpu_core_perf_debugfs_init(struct dpu_kms *dpu_kms, struct dentry *parent);
+
+#endif /* _DPU_CORE_PERF_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_crtc.c
@@ -0,0 +1,1498 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2014-2021 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+#include <linux/sort.h>
+#include <linux/debugfs.h>
+#include <linux/ktime.h>
+#include <linux/bits.h>
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_blend.h>
+#include <drm/drm_crtc.h>
+#include <drm/drm_flip_work.h>
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_mode.h>
+#include <drm/drm_probe_helper.h>
+#include <drm/drm_rect.h>
+#include <drm/drm_vblank.h>
+#include <drm/drm_self_refresh_helper.h>
+
+#include "dpu_kms.h"
+#include "dpu_hw_lm.h"
+#include "dpu_hw_ctl.h"
+#include "dpu_hw_dspp.h"
+#include "dpu_crtc.h"
+#include "dpu_plane.h"
+#include "dpu_encoder.h"
+#include "dpu_vbif.h"
+#include "dpu_core_perf.h"
+#include "dpu_trace.h"
+
+/* layer mixer index on dpu_crtc */
+#define LEFT_MIXER 0
+#define RIGHT_MIXER 1
+
+/* timeout in ms waiting for frame done */
+#define DPU_CRTC_FRAME_DONE_TIMEOUT_MS	60
+
+#define	CONVERT_S3_15(val) \
+	(((((u64)val) & ~BIT_ULL(63)) >> 17) & GENMASK_ULL(17, 0))
+
+static struct dpu_kms *_dpu_crtc_get_kms(struct drm_crtc *crtc)
+{
+	struct msm_drm_private *priv = crtc->dev->dev_private;
+
+	return to_dpu_kms(priv->kms);
+}
+
+static struct drm_encoder *get_encoder_from_crtc(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_encoder *encoder;
+
+	drm_for_each_encoder(encoder, dev)
+		if (encoder->crtc == crtc)
+			return encoder;
+
+	return NULL;
+}
+
+static enum dpu_crtc_crc_source dpu_crtc_parse_crc_source(const char *src_name)
+{
+	if (!src_name ||
+	    !strcmp(src_name, "none"))
+		return DPU_CRTC_CRC_SOURCE_NONE;
+	if (!strcmp(src_name, "auto") ||
+	    !strcmp(src_name, "lm"))
+		return DPU_CRTC_CRC_SOURCE_LAYER_MIXER;
+	if (!strcmp(src_name, "encoder"))
+		return DPU_CRTC_CRC_SOURCE_ENCODER;
+
+	return DPU_CRTC_CRC_SOURCE_INVALID;
+}
+
+static int dpu_crtc_verify_crc_source(struct drm_crtc *crtc,
+		const char *src_name, size_t *values_cnt)
+{
+	enum dpu_crtc_crc_source source = dpu_crtc_parse_crc_source(src_name);
+	struct dpu_crtc_state *crtc_state = to_dpu_crtc_state(crtc->state);
+
+	if (source < 0) {
+		DRM_DEBUG_DRIVER("Invalid source %s for CRTC%d\n", src_name, crtc->index);
+		return -EINVAL;
+	}
+
+	if (source == DPU_CRTC_CRC_SOURCE_LAYER_MIXER) {
+		*values_cnt = crtc_state->num_mixers;
+	} else if (source == DPU_CRTC_CRC_SOURCE_ENCODER) {
+		struct drm_encoder *drm_enc;
+
+		*values_cnt = 0;
+
+		drm_for_each_encoder_mask(drm_enc, crtc->dev, crtc->state->encoder_mask)
+			*values_cnt += dpu_encoder_get_crc_values_cnt(drm_enc);
+	}
+
+	return 0;
+}
+
+static void dpu_crtc_setup_lm_misr(struct dpu_crtc_state *crtc_state)
+{
+	struct dpu_crtc_mixer *m;
+	int i;
+
+	for (i = 0; i < crtc_state->num_mixers; ++i) {
+		m = &crtc_state->mixers[i];
+
+		if (!m->hw_lm || !m->hw_lm->ops.setup_misr)
+			continue;
+
+		/* Calculate MISR over 1 frame */
+		m->hw_lm->ops.setup_misr(m->hw_lm);
+	}
+}
+
+static void dpu_crtc_setup_encoder_misr(struct drm_crtc *crtc)
+{
+	struct drm_encoder *drm_enc;
+
+	drm_for_each_encoder_mask(drm_enc, crtc->dev, crtc->state->encoder_mask)
+		dpu_encoder_setup_misr(drm_enc);
+}
+
+static int dpu_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name)
+{
+	enum dpu_crtc_crc_source source = dpu_crtc_parse_crc_source(src_name);
+	enum dpu_crtc_crc_source current_source;
+	struct dpu_crtc_state *crtc_state;
+	struct drm_device *drm_dev = crtc->dev;
+
+	bool was_enabled;
+	bool enable = false;
+	int ret = 0;
+
+	if (source < 0) {
+		DRM_DEBUG_DRIVER("Invalid CRC source %s for CRTC%d\n", src_name, crtc->index);
+		return -EINVAL;
+	}
+
+	ret = drm_modeset_lock(&crtc->mutex, NULL);
+
+	if (ret)
+		return ret;
+
+	enable = (source != DPU_CRTC_CRC_SOURCE_NONE);
+	crtc_state = to_dpu_crtc_state(crtc->state);
+
+	spin_lock_irq(&drm_dev->event_lock);
+	current_source = crtc_state->crc_source;
+	spin_unlock_irq(&drm_dev->event_lock);
+
+	was_enabled = (current_source != DPU_CRTC_CRC_SOURCE_NONE);
+
+	if (!was_enabled && enable) {
+		ret = drm_crtc_vblank_get(crtc);
+
+		if (ret)
+			goto cleanup;
+
+	} else if (was_enabled && !enable) {
+		drm_crtc_vblank_put(crtc);
+	}
+
+	spin_lock_irq(&drm_dev->event_lock);
+	crtc_state->crc_source = source;
+	spin_unlock_irq(&drm_dev->event_lock);
+
+	crtc_state->crc_frame_skip_count = 0;
+
+	if (source == DPU_CRTC_CRC_SOURCE_LAYER_MIXER)
+		dpu_crtc_setup_lm_misr(crtc_state);
+	else if (source == DPU_CRTC_CRC_SOURCE_ENCODER)
+		dpu_crtc_setup_encoder_misr(crtc);
+	else
+		ret = -EINVAL;
+
+cleanup:
+	drm_modeset_unlock(&crtc->mutex);
+
+	return ret;
+}
+
+static u32 dpu_crtc_get_vblank_counter(struct drm_crtc *crtc)
+{
+	struct drm_encoder *encoder = get_encoder_from_crtc(crtc);
+	if (!encoder) {
+		DRM_ERROR("no encoder found for crtc %d\n", crtc->index);
+		return 0;
+	}
+
+	return dpu_encoder_get_vsync_count(encoder);
+}
+
+static int dpu_crtc_get_lm_crc(struct drm_crtc *crtc,
+		struct dpu_crtc_state *crtc_state)
+{
+	struct dpu_crtc_mixer *m;
+	u32 crcs[CRTC_DUAL_MIXERS];
+
+	int rc = 0;
+	int i;
+
+	BUILD_BUG_ON(ARRAY_SIZE(crcs) != ARRAY_SIZE(crtc_state->mixers));
+
+	for (i = 0; i < crtc_state->num_mixers; ++i) {
+
+		m = &crtc_state->mixers[i];
+
+		if (!m->hw_lm || !m->hw_lm->ops.collect_misr)
+			continue;
+
+		rc = m->hw_lm->ops.collect_misr(m->hw_lm, &crcs[i]);
+
+		if (rc) {
+			if (rc != -ENODATA)
+				DRM_DEBUG_DRIVER("MISR read failed\n");
+			return rc;
+		}
+	}
+
+	return drm_crtc_add_crc_entry(crtc, true,
+			drm_crtc_accurate_vblank_count(crtc), crcs);
+}
+
+static int dpu_crtc_get_encoder_crc(struct drm_crtc *crtc)
+{
+	struct drm_encoder *drm_enc;
+	int rc, pos = 0;
+	u32 crcs[INTF_MAX];
+
+	drm_for_each_encoder_mask(drm_enc, crtc->dev, crtc->state->encoder_mask) {
+		rc = dpu_encoder_get_crc(drm_enc, crcs, pos);
+		if (rc < 0) {
+			if (rc != -ENODATA)
+				DRM_DEBUG_DRIVER("MISR read failed\n");
+
+			return rc;
+		}
+
+		pos += rc;
+	}
+
+	return drm_crtc_add_crc_entry(crtc, true,
+			drm_crtc_accurate_vblank_count(crtc), crcs);
+}
+
+static int dpu_crtc_get_crc(struct drm_crtc *crtc)
+{
+	struct dpu_crtc_state *crtc_state = to_dpu_crtc_state(crtc->state);
+
+	/* Skip first 2 frames in case of "uncooked" CRCs */
+	if (crtc_state->crc_frame_skip_count < 2) {
+		crtc_state->crc_frame_skip_count++;
+		return 0;
+	}
+
+	if (crtc_state->crc_source == DPU_CRTC_CRC_SOURCE_LAYER_MIXER)
+		return dpu_crtc_get_lm_crc(crtc, crtc_state);
+	else if (crtc_state->crc_source == DPU_CRTC_CRC_SOURCE_ENCODER)
+		return dpu_crtc_get_encoder_crc(crtc);
+
+	return -EINVAL;
+}
+
+static bool dpu_crtc_get_scanout_position(struct drm_crtc *crtc,
+					   bool in_vblank_irq,
+					   int *vpos, int *hpos,
+					   ktime_t *stime, ktime_t *etime,
+					   const struct drm_display_mode *mode)
+{
+	unsigned int pipe = crtc->index;
+	struct drm_encoder *encoder;
+	int line, vsw, vbp, vactive_start, vactive_end, vfp_end;
+
+	encoder = get_encoder_from_crtc(crtc);
+	if (!encoder) {
+		DRM_ERROR("no encoder found for crtc %d\n", pipe);
+		return false;
+	}
+
+	vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
+	vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
+
+	/*
+	 * the line counter is 1 at the start of the VSYNC pulse and VTOTAL at
+	 * the end of VFP. Translate the porch values relative to the line
+	 * counter positions.
+	 */
+
+	vactive_start = vsw + vbp + 1;
+	vactive_end = vactive_start + mode->crtc_vdisplay;
+
+	/* last scan line before VSYNC */
+	vfp_end = mode->crtc_vtotal;
+
+	if (stime)
+		*stime = ktime_get();
+
+	line = dpu_encoder_get_linecount(encoder);
+
+	if (line < vactive_start)
+		line -= vactive_start;
+	else if (line > vactive_end)
+		line = line - vfp_end - vactive_start;
+	else
+		line -= vactive_start;
+
+	*vpos = line;
+	*hpos = 0;
+
+	if (etime)
+		*etime = ktime_get();
+
+	return true;
+}
+
+static void _dpu_crtc_setup_blend_cfg(struct dpu_crtc_mixer *mixer,
+		struct dpu_plane_state *pstate, struct dpu_format *format)
+{
+	struct dpu_hw_mixer *lm = mixer->hw_lm;
+	uint32_t blend_op;
+	uint32_t fg_alpha, bg_alpha;
+
+	fg_alpha = pstate->base.alpha >> 8;
+	bg_alpha = 0xff - fg_alpha;
+
+	/* default to opaque blending */
+	if (pstate->base.pixel_blend_mode == DRM_MODE_BLEND_PIXEL_NONE ||
+	    !format->alpha_enable) {
+		blend_op = DPU_BLEND_FG_ALPHA_FG_CONST |
+			DPU_BLEND_BG_ALPHA_BG_CONST;
+	} else if (pstate->base.pixel_blend_mode == DRM_MODE_BLEND_PREMULTI) {
+		blend_op = DPU_BLEND_FG_ALPHA_FG_CONST |
+			DPU_BLEND_BG_ALPHA_FG_PIXEL;
+		if (fg_alpha != 0xff) {
+			bg_alpha = fg_alpha;
+			blend_op |= DPU_BLEND_BG_MOD_ALPHA |
+				    DPU_BLEND_BG_INV_MOD_ALPHA;
+		} else {
+			blend_op |= DPU_BLEND_BG_INV_ALPHA;
+		}
+	} else {
+		/* coverage blending */
+		blend_op = DPU_BLEND_FG_ALPHA_FG_PIXEL |
+			DPU_BLEND_BG_ALPHA_FG_PIXEL;
+		if (fg_alpha != 0xff) {
+			bg_alpha = fg_alpha;
+			blend_op |= DPU_BLEND_FG_MOD_ALPHA |
+				    DPU_BLEND_FG_INV_MOD_ALPHA |
+				    DPU_BLEND_BG_MOD_ALPHA |
+				    DPU_BLEND_BG_INV_MOD_ALPHA;
+		} else {
+			blend_op |= DPU_BLEND_BG_INV_ALPHA;
+		}
+	}
+
+	lm->ops.setup_blend_config(lm, pstate->stage,
+				fg_alpha, bg_alpha, blend_op);
+
+	DRM_DEBUG_ATOMIC("format:%p4cc, alpha_en:%u blend_op:0x%x\n",
+		  &format->base.pixel_format, format->alpha_enable, blend_op);
+}
+
+static void _dpu_crtc_program_lm_output_roi(struct drm_crtc *crtc)
+{
+	struct dpu_crtc_state *crtc_state;
+	int lm_idx, lm_horiz_position;
+
+	crtc_state = to_dpu_crtc_state(crtc->state);
+
+	lm_horiz_position = 0;
+	for (lm_idx = 0; lm_idx < crtc_state->num_mixers; lm_idx++) {
+		const struct drm_rect *lm_roi = &crtc_state->lm_bounds[lm_idx];
+		struct dpu_hw_mixer *hw_lm = crtc_state->mixers[lm_idx].hw_lm;
+		struct dpu_hw_mixer_cfg cfg;
+
+		if (!lm_roi || !drm_rect_visible(lm_roi))
+			continue;
+
+		cfg.out_width = drm_rect_width(lm_roi);
+		cfg.out_height = drm_rect_height(lm_roi);
+		cfg.right_mixer = lm_horiz_position++;
+		cfg.flags = 0;
+		hw_lm->ops.setup_mixer_out(hw_lm, &cfg);
+	}
+}
+
+static void _dpu_crtc_blend_setup_pipe(struct drm_crtc *crtc,
+				       struct drm_plane *plane,
+				       struct dpu_crtc_mixer *mixer,
+				       u32 num_mixers,
+				       enum dpu_stage stage,
+				       struct dpu_format *format,
+				       uint64_t modifier,
+				       struct dpu_sw_pipe *pipe,
+				       unsigned int stage_idx,
+				       struct dpu_hw_stage_cfg *stage_cfg
+				      )
+{
+	uint32_t lm_idx;
+	enum dpu_sspp sspp_idx;
+	struct drm_plane_state *state;
+
+	sspp_idx = pipe->sspp->idx;
+
+	state = plane->state;
+
+	trace_dpu_crtc_setup_mixer(DRMID(crtc), DRMID(plane),
+				   state, to_dpu_plane_state(state), stage_idx,
+				   format->base.pixel_format,
+				   modifier);
+
+	DRM_DEBUG_ATOMIC("crtc %d stage:%d - plane %d sspp %d fb %d multirect_idx %d\n",
+			 crtc->base.id,
+			 stage,
+			 plane->base.id,
+			 sspp_idx - SSPP_NONE,
+			 state->fb ? state->fb->base.id : -1,
+			 pipe->multirect_index);
+
+	stage_cfg->stage[stage][stage_idx] = sspp_idx;
+	stage_cfg->multirect_index[stage][stage_idx] = pipe->multirect_index;
+
+	/* blend config update */
+	for (lm_idx = 0; lm_idx < num_mixers; lm_idx++)
+		mixer[lm_idx].lm_ctl->ops.update_pending_flush_sspp(mixer[lm_idx].lm_ctl, sspp_idx);
+}
+
+static void _dpu_crtc_blend_setup_mixer(struct drm_crtc *crtc,
+	struct dpu_crtc *dpu_crtc, struct dpu_crtc_mixer *mixer,
+	struct dpu_hw_stage_cfg *stage_cfg)
+{
+	struct drm_plane *plane;
+	struct drm_framebuffer *fb;
+	struct drm_plane_state *state;
+	struct dpu_crtc_state *cstate = to_dpu_crtc_state(crtc->state);
+	struct dpu_plane_state *pstate = NULL;
+	struct dpu_format *format;
+	struct dpu_hw_ctl *ctl = mixer->lm_ctl;
+
+	uint32_t lm_idx;
+	bool bg_alpha_enable = false;
+	DECLARE_BITMAP(fetch_active, SSPP_MAX);
+
+	memset(fetch_active, 0, sizeof(fetch_active));
+	drm_atomic_crtc_for_each_plane(plane, crtc) {
+		state = plane->state;
+		if (!state)
+			continue;
+
+		if (!state->visible)
+			continue;
+
+		pstate = to_dpu_plane_state(state);
+		fb = state->fb;
+
+		format = to_dpu_format(msm_framebuffer_format(pstate->base.fb));
+
+		if (pstate->stage == DPU_STAGE_BASE && format->alpha_enable)
+			bg_alpha_enable = true;
+
+		set_bit(pstate->pipe.sspp->idx, fetch_active);
+		_dpu_crtc_blend_setup_pipe(crtc, plane,
+					   mixer, cstate->num_mixers,
+					   pstate->stage,
+					   format, fb ? fb->modifier : 0,
+					   &pstate->pipe, 0, stage_cfg);
+
+		if (pstate->r_pipe.sspp) {
+			set_bit(pstate->r_pipe.sspp->idx, fetch_active);
+			_dpu_crtc_blend_setup_pipe(crtc, plane,
+						   mixer, cstate->num_mixers,
+						   pstate->stage,
+						   format, fb ? fb->modifier : 0,
+						   &pstate->r_pipe, 1, stage_cfg);
+		}
+
+		/* blend config update */
+		for (lm_idx = 0; lm_idx < cstate->num_mixers; lm_idx++) {
+			_dpu_crtc_setup_blend_cfg(mixer + lm_idx, pstate, format);
+
+			if (bg_alpha_enable && !format->alpha_enable)
+				mixer[lm_idx].mixer_op_mode = 0;
+			else
+				mixer[lm_idx].mixer_op_mode |=
+						1 << pstate->stage;
+		}
+	}
+
+	if (ctl->ops.set_active_pipes)
+		ctl->ops.set_active_pipes(ctl, fetch_active);
+
+	_dpu_crtc_program_lm_output_roi(crtc);
+}
+
+/**
+ * _dpu_crtc_blend_setup - configure crtc mixers
+ * @crtc: Pointer to drm crtc structure
+ */
+static void _dpu_crtc_blend_setup(struct drm_crtc *crtc)
+{
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+	struct dpu_crtc_state *cstate = to_dpu_crtc_state(crtc->state);
+	struct dpu_crtc_mixer *mixer = cstate->mixers;
+	struct dpu_hw_ctl *ctl;
+	struct dpu_hw_mixer *lm;
+	struct dpu_hw_stage_cfg stage_cfg;
+	int i;
+
+	DRM_DEBUG_ATOMIC("%s\n", dpu_crtc->name);
+
+	for (i = 0; i < cstate->num_mixers; i++) {
+		mixer[i].mixer_op_mode = 0;
+		if (mixer[i].lm_ctl->ops.clear_all_blendstages)
+			mixer[i].lm_ctl->ops.clear_all_blendstages(
+					mixer[i].lm_ctl);
+	}
+
+	/* initialize stage cfg */
+	memset(&stage_cfg, 0, sizeof(struct dpu_hw_stage_cfg));
+
+	_dpu_crtc_blend_setup_mixer(crtc, dpu_crtc, mixer, &stage_cfg);
+
+	for (i = 0; i < cstate->num_mixers; i++) {
+		ctl = mixer[i].lm_ctl;
+		lm = mixer[i].hw_lm;
+
+		lm->ops.setup_alpha_out(lm, mixer[i].mixer_op_mode);
+
+		/* stage config flush mask */
+		ctl->ops.update_pending_flush_mixer(ctl,
+			mixer[i].hw_lm->idx);
+
+		DRM_DEBUG_ATOMIC("lm %d, op_mode 0x%X, ctl %d\n",
+			mixer[i].hw_lm->idx - LM_0,
+			mixer[i].mixer_op_mode,
+			ctl->idx - CTL_0);
+
+		ctl->ops.setup_blendstage(ctl, mixer[i].hw_lm->idx,
+			&stage_cfg);
+	}
+}
+
+/**
+ *  _dpu_crtc_complete_flip - signal pending page_flip events
+ * Any pending vblank events are added to the vblank_event_list
+ * so that the next vblank interrupt shall signal them.
+ * However PAGE_FLIP events are not handled through the vblank_event_list.
+ * This API signals any pending PAGE_FLIP events requested through
+ * DRM_IOCTL_MODE_PAGE_FLIP and are cached in the dpu_crtc->event.
+ * @crtc: Pointer to drm crtc structure
+ */
+static void _dpu_crtc_complete_flip(struct drm_crtc *crtc)
+{
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	if (dpu_crtc->event) {
+		DRM_DEBUG_VBL("%s: send event: %pK\n", dpu_crtc->name,
+			      dpu_crtc->event);
+		trace_dpu_crtc_complete_flip(DRMID(crtc));
+		drm_crtc_send_vblank_event(crtc, dpu_crtc->event);
+		dpu_crtc->event = NULL;
+	}
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
+enum dpu_intf_mode dpu_crtc_get_intf_mode(struct drm_crtc *crtc)
+{
+	struct drm_encoder *encoder;
+
+	/*
+	 * TODO: This function is called from dpu debugfs and as part of atomic
+	 * check. When called from debugfs, the crtc->mutex must be held to
+	 * read crtc->state. However reading crtc->state from atomic check isn't
+	 * allowed (unless you have a good reason, a big comment, and a deep
+	 * understanding of how the atomic/modeset locks work (<- and this is
+	 * probably not possible)). So we'll keep the WARN_ON here for now, but
+	 * really we need to figure out a better way to track our operating mode
+	 */
+	WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
+
+	/* TODO: Returns the first INTF_MODE, could there be multiple values? */
+	drm_for_each_encoder_mask(encoder, crtc->dev, crtc->state->encoder_mask)
+		return dpu_encoder_get_intf_mode(encoder);
+
+	return INTF_MODE_NONE;
+}
+
+void dpu_crtc_vblank_callback(struct drm_crtc *crtc)
+{
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+
+	/* keep statistics on vblank callback - with auto reset via debugfs */
+	if (ktime_compare(dpu_crtc->vblank_cb_time, ktime_set(0, 0)) == 0)
+		dpu_crtc->vblank_cb_time = ktime_get();
+	else
+		dpu_crtc->vblank_cb_count++;
+
+	dpu_crtc_get_crc(crtc);
+
+	drm_crtc_handle_vblank(crtc);
+	trace_dpu_crtc_vblank_cb(DRMID(crtc));
+}
+
+static void dpu_crtc_frame_event_work(struct kthread_work *work)
+{
+	struct dpu_crtc_frame_event *fevent = container_of(work,
+			struct dpu_crtc_frame_event, work);
+	struct drm_crtc *crtc = fevent->crtc;
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+	unsigned long flags;
+	bool frame_done = false;
+
+	DPU_ATRACE_BEGIN("crtc_frame_event");
+
+	DRM_DEBUG_ATOMIC("crtc%d event:%u ts:%lld\n", crtc->base.id, fevent->event,
+			ktime_to_ns(fevent->ts));
+
+	if (fevent->event & (DPU_ENCODER_FRAME_EVENT_DONE
+				| DPU_ENCODER_FRAME_EVENT_ERROR
+				| DPU_ENCODER_FRAME_EVENT_PANEL_DEAD)) {
+
+		if (atomic_read(&dpu_crtc->frame_pending) < 1) {
+			/* ignore vblank when not pending */
+		} else if (atomic_dec_return(&dpu_crtc->frame_pending) == 0) {
+			/* release bandwidth and other resources */
+			trace_dpu_crtc_frame_event_done(DRMID(crtc),
+							fevent->event);
+			dpu_core_perf_crtc_release_bw(crtc);
+		} else {
+			trace_dpu_crtc_frame_event_more_pending(DRMID(crtc),
+								fevent->event);
+		}
+
+		if (fevent->event & (DPU_ENCODER_FRAME_EVENT_DONE
+					| DPU_ENCODER_FRAME_EVENT_ERROR))
+			frame_done = true;
+	}
+
+	if (fevent->event & DPU_ENCODER_FRAME_EVENT_PANEL_DEAD)
+		DPU_ERROR("crtc%d ts:%lld received panel dead event\n",
+				crtc->base.id, ktime_to_ns(fevent->ts));
+
+	if (frame_done)
+		complete_all(&dpu_crtc->frame_done_comp);
+
+	spin_lock_irqsave(&dpu_crtc->spin_lock, flags);
+	list_add_tail(&fevent->list, &dpu_crtc->frame_event_list);
+	spin_unlock_irqrestore(&dpu_crtc->spin_lock, flags);
+	DPU_ATRACE_END("crtc_frame_event");
+}
+
+/**
+ * dpu_crtc_frame_event_cb - crtc frame event callback API
+ * @crtc: Pointer to crtc
+ * @event: Event to process
+ *
+ * Encoder may call this for different events from different context - IRQ,
+ * user thread, commit_thread, etc. Each event should be carefully reviewed and
+ * should be processed in proper task context to avoid schedulin delay or
+ * properly manage the irq context's bottom half processing.
+ */
+void dpu_crtc_frame_event_cb(struct drm_crtc *crtc, u32 event)
+{
+	struct dpu_crtc *dpu_crtc;
+	struct msm_drm_private *priv;
+	struct dpu_crtc_frame_event *fevent;
+	unsigned long flags;
+	u32 crtc_id;
+
+	/* Nothing to do on idle event */
+	if (event & DPU_ENCODER_FRAME_EVENT_IDLE)
+		return;
+
+	dpu_crtc = to_dpu_crtc(crtc);
+	priv = crtc->dev->dev_private;
+	crtc_id = drm_crtc_index(crtc);
+
+	trace_dpu_crtc_frame_event_cb(DRMID(crtc), event);
+
+	spin_lock_irqsave(&dpu_crtc->spin_lock, flags);
+	fevent = list_first_entry_or_null(&dpu_crtc->frame_event_list,
+			struct dpu_crtc_frame_event, list);
+	if (fevent)
+		list_del_init(&fevent->list);
+	spin_unlock_irqrestore(&dpu_crtc->spin_lock, flags);
+
+	if (!fevent) {
+		DRM_ERROR_RATELIMITED("crtc%d event %d overflow\n", crtc->base.id, event);
+		return;
+	}
+
+	fevent->event = event;
+	fevent->crtc = crtc;
+	fevent->ts = ktime_get();
+	kthread_queue_work(priv->event_thread[crtc_id].worker, &fevent->work);
+}
+
+void dpu_crtc_complete_commit(struct drm_crtc *crtc)
+{
+	trace_dpu_crtc_complete_commit(DRMID(crtc));
+	dpu_core_perf_crtc_update(crtc, 0);
+	_dpu_crtc_complete_flip(crtc);
+}
+
+static void _dpu_crtc_setup_lm_bounds(struct drm_crtc *crtc,
+		struct drm_crtc_state *state)
+{
+	struct dpu_crtc_state *cstate = to_dpu_crtc_state(state);
+	struct drm_display_mode *adj_mode = &state->adjusted_mode;
+	u32 crtc_split_width = adj_mode->hdisplay / cstate->num_mixers;
+	int i;
+
+	for (i = 0; i < cstate->num_mixers; i++) {
+		struct drm_rect *r = &cstate->lm_bounds[i];
+		r->x1 = crtc_split_width * i;
+		r->y1 = 0;
+		r->x2 = r->x1 + crtc_split_width;
+		r->y2 = adj_mode->vdisplay;
+
+		trace_dpu_crtc_setup_lm_bounds(DRMID(crtc), i, r);
+	}
+}
+
+static void _dpu_crtc_get_pcc_coeff(struct drm_crtc_state *state,
+		struct dpu_hw_pcc_cfg *cfg)
+{
+	struct drm_color_ctm *ctm;
+
+	memset(cfg, 0, sizeof(struct dpu_hw_pcc_cfg));
+
+	ctm = (struct drm_color_ctm *)state->ctm->data;
+
+	if (!ctm)
+		return;
+
+	cfg->r.r = CONVERT_S3_15(ctm->matrix[0]);
+	cfg->g.r = CONVERT_S3_15(ctm->matrix[1]);
+	cfg->b.r = CONVERT_S3_15(ctm->matrix[2]);
+
+	cfg->r.g = CONVERT_S3_15(ctm->matrix[3]);
+	cfg->g.g = CONVERT_S3_15(ctm->matrix[4]);
+	cfg->b.g = CONVERT_S3_15(ctm->matrix[5]);
+
+	cfg->r.b = CONVERT_S3_15(ctm->matrix[6]);
+	cfg->g.b = CONVERT_S3_15(ctm->matrix[7]);
+	cfg->b.b = CONVERT_S3_15(ctm->matrix[8]);
+}
+
+static void _dpu_crtc_setup_cp_blocks(struct drm_crtc *crtc)
+{
+	struct drm_crtc_state *state = crtc->state;
+	struct dpu_crtc_state *cstate = to_dpu_crtc_state(crtc->state);
+	struct dpu_crtc_mixer *mixer = cstate->mixers;
+	struct dpu_hw_pcc_cfg cfg;
+	struct dpu_hw_ctl *ctl;
+	struct dpu_hw_dspp *dspp;
+	int i;
+
+
+	if (!state->color_mgmt_changed && !drm_atomic_crtc_needs_modeset(state))
+		return;
+
+	for (i = 0; i < cstate->num_mixers; i++) {
+		ctl = mixer[i].lm_ctl;
+		dspp = mixer[i].hw_dspp;
+
+		if (!dspp || !dspp->ops.setup_pcc)
+			continue;
+
+		if (!state->ctm) {
+			dspp->ops.setup_pcc(dspp, NULL);
+		} else {
+			_dpu_crtc_get_pcc_coeff(state, &cfg);
+			dspp->ops.setup_pcc(dspp, &cfg);
+		}
+
+		/* stage config flush mask */
+		ctl->ops.update_pending_flush_dspp(ctl,
+			mixer[i].hw_dspp->idx, DPU_DSPP_PCC);
+	}
+}
+
+static void dpu_crtc_atomic_begin(struct drm_crtc *crtc,
+		struct drm_atomic_state *state)
+{
+	struct dpu_crtc_state *cstate = to_dpu_crtc_state(crtc->state);
+	struct drm_encoder *encoder;
+
+	if (!crtc->state->enable) {
+		DRM_DEBUG_ATOMIC("crtc%d -> enable %d, skip atomic_begin\n",
+				crtc->base.id, crtc->state->enable);
+		return;
+	}
+
+	DRM_DEBUG_ATOMIC("crtc%d\n", crtc->base.id);
+
+	_dpu_crtc_setup_lm_bounds(crtc, crtc->state);
+
+	/* encoder will trigger pending mask now */
+	drm_for_each_encoder_mask(encoder, crtc->dev, crtc->state->encoder_mask)
+		dpu_encoder_trigger_kickoff_pending(encoder);
+
+	/*
+	 * If no mixers have been allocated in dpu_crtc_atomic_check(),
+	 * it means we are trying to flush a CRTC whose state is disabled:
+	 * nothing else needs to be done.
+	 */
+	if (unlikely(!cstate->num_mixers))
+		return;
+
+	_dpu_crtc_blend_setup(crtc);
+
+	_dpu_crtc_setup_cp_blocks(crtc);
+
+	/*
+	 * PP_DONE irq is only used by command mode for now.
+	 * It is better to request pending before FLUSH and START trigger
+	 * to make sure no pp_done irq missed.
+	 * This is safe because no pp_done will happen before SW trigger
+	 * in command mode.
+	 */
+}
+
+static void dpu_crtc_atomic_flush(struct drm_crtc *crtc,
+		struct drm_atomic_state *state)
+{
+	struct dpu_crtc *dpu_crtc;
+	struct drm_device *dev;
+	struct drm_plane *plane;
+	struct msm_drm_private *priv;
+	unsigned long flags;
+	struct dpu_crtc_state *cstate;
+
+	if (!crtc->state->enable) {
+		DRM_DEBUG_ATOMIC("crtc%d -> enable %d, skip atomic_flush\n",
+				crtc->base.id, crtc->state->enable);
+		return;
+	}
+
+	DRM_DEBUG_ATOMIC("crtc%d\n", crtc->base.id);
+
+	dpu_crtc = to_dpu_crtc(crtc);
+	cstate = to_dpu_crtc_state(crtc->state);
+	dev = crtc->dev;
+	priv = dev->dev_private;
+
+	if (crtc->index >= ARRAY_SIZE(priv->event_thread)) {
+		DPU_ERROR("invalid crtc index[%d]\n", crtc->index);
+		return;
+	}
+
+	WARN_ON(dpu_crtc->event);
+	spin_lock_irqsave(&dev->event_lock, flags);
+	dpu_crtc->event = crtc->state->event;
+	crtc->state->event = NULL;
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+
+	/*
+	 * If no mixers has been allocated in dpu_crtc_atomic_check(),
+	 * it means we are trying to flush a CRTC whose state is disabled:
+	 * nothing else needs to be done.
+	 */
+	if (unlikely(!cstate->num_mixers))
+		return;
+
+	/* update performance setting before crtc kickoff */
+	dpu_core_perf_crtc_update(crtc, 1);
+
+	/*
+	 * Final plane updates: Give each plane a chance to complete all
+	 *                      required writes/flushing before crtc's "flush
+	 *                      everything" call below.
+	 */
+	drm_atomic_crtc_for_each_plane(plane, crtc) {
+		if (dpu_crtc->smmu_state.transition_error)
+			dpu_plane_set_error(plane, true);
+		dpu_plane_flush(plane);
+	}
+
+	/* Kickoff will be scheduled by outer layer */
+}
+
+/**
+ * dpu_crtc_destroy_state - state destroy hook
+ * @crtc: drm CRTC
+ * @state: CRTC state object to release
+ */
+static void dpu_crtc_destroy_state(struct drm_crtc *crtc,
+		struct drm_crtc_state *state)
+{
+	struct dpu_crtc_state *cstate = to_dpu_crtc_state(state);
+
+	DRM_DEBUG_ATOMIC("crtc%d\n", crtc->base.id);
+
+	__drm_atomic_helper_crtc_destroy_state(state);
+
+	kfree(cstate);
+}
+
+static int _dpu_crtc_wait_for_frame_done(struct drm_crtc *crtc)
+{
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+	int ret, rc = 0;
+
+	if (!atomic_read(&dpu_crtc->frame_pending)) {
+		DRM_DEBUG_ATOMIC("no frames pending\n");
+		return 0;
+	}
+
+	DPU_ATRACE_BEGIN("frame done completion wait");
+	ret = wait_for_completion_timeout(&dpu_crtc->frame_done_comp,
+			msecs_to_jiffies(DPU_CRTC_FRAME_DONE_TIMEOUT_MS));
+	if (!ret) {
+		DRM_ERROR("frame done wait timed out, ret:%d\n", ret);
+		rc = -ETIMEDOUT;
+	}
+	DPU_ATRACE_END("frame done completion wait");
+
+	return rc;
+}
+
+void dpu_crtc_commit_kickoff(struct drm_crtc *crtc)
+{
+	struct drm_encoder *encoder;
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+	struct dpu_kms *dpu_kms = _dpu_crtc_get_kms(crtc);
+	struct dpu_crtc_state *cstate = to_dpu_crtc_state(crtc->state);
+
+	/*
+	 * If no mixers has been allocated in dpu_crtc_atomic_check(),
+	 * it means we are trying to start a CRTC whose state is disabled:
+	 * nothing else needs to be done.
+	 */
+	if (unlikely(!cstate->num_mixers))
+		return;
+
+	DPU_ATRACE_BEGIN("crtc_commit");
+
+	drm_for_each_encoder_mask(encoder, crtc->dev,
+			crtc->state->encoder_mask) {
+		if (!dpu_encoder_is_valid_for_commit(encoder)) {
+			DRM_DEBUG_ATOMIC("invalid FB not kicking off crtc\n");
+			goto end;
+		}
+	}
+	/*
+	 * Encoder will flush/start now, unless it has a tx pending. If so, it
+	 * may delay and flush at an irq event (e.g. ppdone)
+	 */
+	drm_for_each_encoder_mask(encoder, crtc->dev,
+				  crtc->state->encoder_mask)
+		dpu_encoder_prepare_for_kickoff(encoder);
+
+	if (atomic_inc_return(&dpu_crtc->frame_pending) == 1) {
+		/* acquire bandwidth and other resources */
+		DRM_DEBUG_ATOMIC("crtc%d first commit\n", crtc->base.id);
+	} else
+		DRM_DEBUG_ATOMIC("crtc%d commit\n", crtc->base.id);
+
+	dpu_crtc->play_count++;
+
+	dpu_vbif_clear_errors(dpu_kms);
+
+	drm_for_each_encoder_mask(encoder, crtc->dev, crtc->state->encoder_mask)
+		dpu_encoder_kickoff(encoder);
+
+	reinit_completion(&dpu_crtc->frame_done_comp);
+
+end:
+	DPU_ATRACE_END("crtc_commit");
+}
+
+static void dpu_crtc_reset(struct drm_crtc *crtc)
+{
+	struct dpu_crtc_state *cstate = kzalloc(sizeof(*cstate), GFP_KERNEL);
+
+	if (crtc->state)
+		dpu_crtc_destroy_state(crtc, crtc->state);
+
+	if (cstate)
+		__drm_atomic_helper_crtc_reset(crtc, &cstate->base);
+	else
+		__drm_atomic_helper_crtc_reset(crtc, NULL);
+}
+
+/**
+ * dpu_crtc_duplicate_state - state duplicate hook
+ * @crtc: Pointer to drm crtc structure
+ */
+static struct drm_crtc_state *dpu_crtc_duplicate_state(struct drm_crtc *crtc)
+{
+	struct dpu_crtc_state *cstate, *old_cstate = to_dpu_crtc_state(crtc->state);
+
+	cstate = kmemdup(old_cstate, sizeof(*old_cstate), GFP_KERNEL);
+	if (!cstate) {
+		DPU_ERROR("failed to allocate state\n");
+		return NULL;
+	}
+
+	/* duplicate base helper */
+	__drm_atomic_helper_crtc_duplicate_state(crtc, &cstate->base);
+
+	return &cstate->base;
+}
+
+static void dpu_crtc_atomic_print_state(struct drm_printer *p,
+					const struct drm_crtc_state *state)
+{
+	const struct dpu_crtc_state *cstate = to_dpu_crtc_state(state);
+	int i;
+
+	for (i = 0; i < cstate->num_mixers; i++) {
+		drm_printf(p, "\tlm[%d]=%d\n", i, cstate->mixers[i].hw_lm->idx - LM_0);
+		drm_printf(p, "\tctl[%d]=%d\n", i, cstate->mixers[i].lm_ctl->idx - CTL_0);
+		if (cstate->mixers[i].hw_dspp)
+			drm_printf(p, "\tdspp[%d]=%d\n", i, cstate->mixers[i].hw_dspp->idx - DSPP_0);
+	}
+}
+
+static void dpu_crtc_disable(struct drm_crtc *crtc,
+			     struct drm_atomic_state *state)
+{
+	struct drm_crtc_state *old_crtc_state = drm_atomic_get_old_crtc_state(state,
+									      crtc);
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+	struct dpu_crtc_state *cstate = to_dpu_crtc_state(crtc->state);
+	struct drm_encoder *encoder;
+	unsigned long flags;
+	bool release_bandwidth = false;
+
+	DRM_DEBUG_KMS("crtc%d\n", crtc->base.id);
+
+	/* If disable is triggered while in self refresh mode,
+	 * reset the encoder software state so that in enable
+	 * it won't trigger a warn while assigning crtc.
+	 */
+	if (old_crtc_state->self_refresh_active) {
+		drm_for_each_encoder_mask(encoder, crtc->dev,
+					old_crtc_state->encoder_mask) {
+			dpu_encoder_assign_crtc(encoder, NULL);
+		}
+		return;
+	}
+
+	/* Disable/save vblank irq handling */
+	drm_crtc_vblank_off(crtc);
+
+	drm_for_each_encoder_mask(encoder, crtc->dev,
+				  old_crtc_state->encoder_mask) {
+		/* in video mode, we hold an extra bandwidth reference
+		 * as we cannot drop bandwidth at frame-done if any
+		 * crtc is being used in video mode.
+		 */
+		if (dpu_encoder_get_intf_mode(encoder) == INTF_MODE_VIDEO)
+			release_bandwidth = true;
+
+		/*
+		 * If disable is triggered during psr active(e.g: screen dim in PSR),
+		 * we will need encoder->crtc connection to process the device sleep &
+		 * preserve it during psr sequence.
+		 */
+		if (!crtc->state->self_refresh_active)
+			dpu_encoder_assign_crtc(encoder, NULL);
+	}
+
+	/* wait for frame_event_done completion */
+	if (_dpu_crtc_wait_for_frame_done(crtc))
+		DPU_ERROR("crtc%d wait for frame done failed;frame_pending%d\n",
+				crtc->base.id,
+				atomic_read(&dpu_crtc->frame_pending));
+
+	trace_dpu_crtc_disable(DRMID(crtc), false, dpu_crtc);
+	dpu_crtc->enabled = false;
+
+	if (atomic_read(&dpu_crtc->frame_pending)) {
+		trace_dpu_crtc_disable_frame_pending(DRMID(crtc),
+				     atomic_read(&dpu_crtc->frame_pending));
+		if (release_bandwidth)
+			dpu_core_perf_crtc_release_bw(crtc);
+		atomic_set(&dpu_crtc->frame_pending, 0);
+	}
+
+	dpu_core_perf_crtc_update(crtc, 0);
+
+	/* disable clk & bw control until clk & bw properties are set */
+	cstate->bw_control = false;
+	cstate->bw_split_vote = false;
+
+	if (crtc->state->event && !crtc->state->active) {
+		spin_lock_irqsave(&crtc->dev->event_lock, flags);
+		drm_crtc_send_vblank_event(crtc, crtc->state->event);
+		crtc->state->event = NULL;
+		spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+	}
+
+	pm_runtime_put_sync(crtc->dev->dev);
+}
+
+static void dpu_crtc_enable(struct drm_crtc *crtc,
+		struct drm_atomic_state *state)
+{
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+	struct drm_encoder *encoder;
+	bool request_bandwidth = false;
+	struct drm_crtc_state *old_crtc_state;
+
+	old_crtc_state = drm_atomic_get_old_crtc_state(state, crtc);
+
+	pm_runtime_get_sync(crtc->dev->dev);
+
+	DRM_DEBUG_KMS("crtc%d\n", crtc->base.id);
+
+	drm_for_each_encoder_mask(encoder, crtc->dev, crtc->state->encoder_mask) {
+		/* in video mode, we hold an extra bandwidth reference
+		 * as we cannot drop bandwidth at frame-done if any
+		 * crtc is being used in video mode.
+		 */
+		if (dpu_encoder_get_intf_mode(encoder) == INTF_MODE_VIDEO)
+			request_bandwidth = true;
+	}
+
+	if (request_bandwidth)
+		atomic_inc(&_dpu_crtc_get_kms(crtc)->bandwidth_ref);
+
+	trace_dpu_crtc_enable(DRMID(crtc), true, dpu_crtc);
+	dpu_crtc->enabled = true;
+
+	if (!old_crtc_state->self_refresh_active) {
+		drm_for_each_encoder_mask(encoder, crtc->dev, crtc->state->encoder_mask)
+			dpu_encoder_assign_crtc(encoder, crtc);
+	}
+
+	/* Enable/restore vblank irq handling */
+	drm_crtc_vblank_on(crtc);
+}
+
+static bool dpu_crtc_needs_dirtyfb(struct drm_crtc_state *cstate)
+{
+	struct drm_crtc *crtc = cstate->crtc;
+	struct drm_encoder *encoder;
+
+	if (cstate->self_refresh_active)
+		return true;
+
+	drm_for_each_encoder_mask (encoder, crtc->dev, cstate->encoder_mask) {
+		if (dpu_encoder_get_intf_mode(encoder) == INTF_MODE_CMD) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
+static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
+		struct drm_atomic_state *state)
+{
+	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state,
+									  crtc);
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+	struct dpu_crtc_state *cstate = to_dpu_crtc_state(crtc_state);
+
+	const struct drm_plane_state *pstate;
+	struct drm_plane *plane;
+
+	int rc = 0;
+
+	bool needs_dirtyfb = dpu_crtc_needs_dirtyfb(crtc_state);
+
+	if (!crtc_state->enable || !drm_atomic_crtc_effectively_active(crtc_state)) {
+		DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n",
+				crtc->base.id, crtc_state->enable,
+				crtc_state->active);
+		memset(&cstate->new_perf, 0, sizeof(cstate->new_perf));
+		return 0;
+	}
+
+	DRM_DEBUG_ATOMIC("%s: check\n", dpu_crtc->name);
+
+	/* force a full mode set if active state changed */
+	if (crtc_state->active_changed)
+		crtc_state->mode_changed = true;
+
+	if (cstate->num_mixers)
+		_dpu_crtc_setup_lm_bounds(crtc, crtc_state);
+
+	/* FIXME: move this to dpu_plane_atomic_check? */
+	drm_atomic_crtc_state_for_each_plane_state(plane, pstate, crtc_state) {
+		struct dpu_plane_state *dpu_pstate = to_dpu_plane_state(pstate);
+
+		if (IS_ERR_OR_NULL(pstate)) {
+			rc = PTR_ERR(pstate);
+			DPU_ERROR("%s: failed to get plane%d state, %d\n",
+					dpu_crtc->name, plane->base.id, rc);
+			return rc;
+		}
+
+		if (!pstate->visible)
+			continue;
+
+		dpu_pstate->needs_dirtyfb = needs_dirtyfb;
+	}
+
+	atomic_inc(&_dpu_crtc_get_kms(crtc)->bandwidth_ref);
+
+	rc = dpu_core_perf_crtc_check(crtc, crtc_state);
+	if (rc) {
+		DPU_ERROR("crtc%d failed performance check %d\n",
+				crtc->base.id, rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+int dpu_crtc_vblank(struct drm_crtc *crtc, bool en)
+{
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+	struct drm_encoder *enc;
+
+	trace_dpu_crtc_vblank(DRMID(&dpu_crtc->base), en, dpu_crtc);
+
+	/*
+	 * Normally we would iterate through encoder_mask in crtc state to find
+	 * attached encoders. In this case, we might be disabling vblank _after_
+	 * encoder_mask has been cleared.
+	 *
+	 * Instead, we "assign" a crtc to the encoder in enable and clear it in
+	 * disable (which is also after encoder_mask is cleared). So instead of
+	 * using encoder mask, we'll ask the encoder to toggle itself iff it's
+	 * currently assigned to our crtc.
+	 *
+	 * Note also that this function cannot be called while crtc is disabled
+	 * since we use drm_crtc_vblank_on/off. So we don't need to worry
+	 * about the assigned crtcs being inconsistent with the current state
+	 * (which means no need to worry about modeset locks).
+	 */
+	list_for_each_entry(enc, &crtc->dev->mode_config.encoder_list, head) {
+		trace_dpu_crtc_vblank_enable(DRMID(crtc), DRMID(enc), en,
+					     dpu_crtc);
+
+		dpu_encoder_toggle_vblank_for_crtc(enc, crtc, en);
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_DEBUG_FS
+static int _dpu_debugfs_status_show(struct seq_file *s, void *data)
+{
+	struct dpu_crtc *dpu_crtc;
+	struct dpu_plane_state *pstate = NULL;
+	struct dpu_crtc_mixer *m;
+
+	struct drm_crtc *crtc;
+	struct drm_plane *plane;
+	struct drm_display_mode *mode;
+	struct drm_framebuffer *fb;
+	struct drm_plane_state *state;
+	struct dpu_crtc_state *cstate;
+
+	int i, out_width;
+
+	dpu_crtc = s->private;
+	crtc = &dpu_crtc->base;
+
+	drm_modeset_lock_all(crtc->dev);
+	cstate = to_dpu_crtc_state(crtc->state);
+
+	mode = &crtc->state->adjusted_mode;
+	out_width = mode->hdisplay / cstate->num_mixers;
+
+	seq_printf(s, "crtc:%d width:%d height:%d\n", crtc->base.id,
+				mode->hdisplay, mode->vdisplay);
+
+	seq_puts(s, "\n");
+
+	for (i = 0; i < cstate->num_mixers; ++i) {
+		m = &cstate->mixers[i];
+		seq_printf(s, "\tmixer:%d ctl:%d width:%d height:%d\n",
+			m->hw_lm->idx - LM_0, m->lm_ctl->idx - CTL_0,
+			out_width, mode->vdisplay);
+	}
+
+	seq_puts(s, "\n");
+
+	drm_atomic_crtc_for_each_plane(plane, crtc) {
+		pstate = to_dpu_plane_state(plane->state);
+		state = plane->state;
+
+		if (!pstate || !state)
+			continue;
+
+		seq_printf(s, "\tplane:%u stage:%d\n", plane->base.id,
+			pstate->stage);
+
+		if (plane->state->fb) {
+			fb = plane->state->fb;
+
+			seq_printf(s, "\tfb:%d image format:%4.4s wxh:%ux%u ",
+				fb->base.id, (char *) &fb->format->format,
+				fb->width, fb->height);
+			for (i = 0; i < ARRAY_SIZE(fb->format->cpp); ++i)
+				seq_printf(s, "cpp[%d]:%u ",
+						i, fb->format->cpp[i]);
+			seq_puts(s, "\n\t");
+
+			seq_printf(s, "modifier:%8llu ", fb->modifier);
+			seq_puts(s, "\n");
+
+			seq_puts(s, "\t");
+			for (i = 0; i < ARRAY_SIZE(fb->pitches); i++)
+				seq_printf(s, "pitches[%d]:%8u ", i,
+							fb->pitches[i]);
+			seq_puts(s, "\n");
+
+			seq_puts(s, "\t");
+			for (i = 0; i < ARRAY_SIZE(fb->offsets); i++)
+				seq_printf(s, "offsets[%d]:%8u ", i,
+							fb->offsets[i]);
+			seq_puts(s, "\n");
+		}
+
+		seq_printf(s, "\tsrc_x:%4d src_y:%4d src_w:%4d src_h:%4d\n",
+			state->src_x, state->src_y, state->src_w, state->src_h);
+
+		seq_printf(s, "\tdst x:%4d dst_y:%4d dst_w:%4d dst_h:%4d\n",
+			state->crtc_x, state->crtc_y, state->crtc_w,
+			state->crtc_h);
+		seq_printf(s, "\tsspp[0]:%s\n",
+			   pstate->pipe.sspp->cap->name);
+		seq_printf(s, "\tmultirect[0]: mode: %d index: %d\n",
+			pstate->pipe.multirect_mode, pstate->pipe.multirect_index);
+		if (pstate->r_pipe.sspp) {
+			seq_printf(s, "\tsspp[1]:%s\n",
+				   pstate->r_pipe.sspp->cap->name);
+			seq_printf(s, "\tmultirect[1]: mode: %d index: %d\n",
+				   pstate->r_pipe.multirect_mode, pstate->r_pipe.multirect_index);
+		}
+
+		seq_puts(s, "\n");
+	}
+	if (dpu_crtc->vblank_cb_count) {
+		ktime_t diff = ktime_sub(ktime_get(), dpu_crtc->vblank_cb_time);
+		s64 diff_ms = ktime_to_ms(diff);
+		s64 fps = diff_ms ? div_s64(
+				dpu_crtc->vblank_cb_count * 1000, diff_ms) : 0;
+
+		seq_printf(s,
+			"vblank fps:%lld count:%u total:%llums total_framecount:%llu\n",
+				fps, dpu_crtc->vblank_cb_count,
+				ktime_to_ms(diff), dpu_crtc->play_count);
+
+		/* reset time & count for next measurement */
+		dpu_crtc->vblank_cb_count = 0;
+		dpu_crtc->vblank_cb_time = ktime_set(0, 0);
+	}
+
+	drm_modeset_unlock_all(crtc->dev);
+
+	return 0;
+}
+
+DEFINE_SHOW_ATTRIBUTE(_dpu_debugfs_status);
+
+static int dpu_crtc_debugfs_state_show(struct seq_file *s, void *v)
+{
+	struct drm_crtc *crtc = s->private;
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+
+	seq_printf(s, "client type: %d\n", dpu_crtc_get_client_type(crtc));
+	seq_printf(s, "intf_mode: %d\n", dpu_crtc_get_intf_mode(crtc));
+	seq_printf(s, "core_clk_rate: %llu\n",
+			dpu_crtc->cur_perf.core_clk_rate);
+	seq_printf(s, "bw_ctl: %llu\n", dpu_crtc->cur_perf.bw_ctl);
+	seq_printf(s, "max_per_pipe_ib: %llu\n",
+				dpu_crtc->cur_perf.max_per_pipe_ib);
+
+	return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(dpu_crtc_debugfs_state);
+
+static int _dpu_crtc_init_debugfs(struct drm_crtc *crtc)
+{
+	struct dpu_crtc *dpu_crtc = to_dpu_crtc(crtc);
+
+	debugfs_create_file("status", 0400,
+			crtc->debugfs_entry,
+			dpu_crtc, &_dpu_debugfs_status_fops);
+	debugfs_create_file("state", 0600,
+			crtc->debugfs_entry,
+			&dpu_crtc->base,
+			&dpu_crtc_debugfs_state_fops);
+
+	return 0;
+}
+#else
+static int _dpu_crtc_init_debugfs(struct drm_crtc *crtc)
+{
+	return 0;
+}
+#endif /* CONFIG_DEBUG_FS */
+
+static int dpu_crtc_late_register(struct drm_crtc *crtc)
+{
+	return _dpu_crtc_init_debugfs(crtc);
+}
+
+static const struct drm_crtc_funcs dpu_crtc_funcs = {
+	.set_config = drm_atomic_helper_set_config,
+	.page_flip = drm_atomic_helper_page_flip,
+	.reset = dpu_crtc_reset,
+	.atomic_duplicate_state = dpu_crtc_duplicate_state,
+	.atomic_destroy_state = dpu_crtc_destroy_state,
+	.atomic_print_state = dpu_crtc_atomic_print_state,
+	.late_register = dpu_crtc_late_register,
+	.verify_crc_source = dpu_crtc_verify_crc_source,
+	.set_crc_source = dpu_crtc_set_crc_source,
+	.enable_vblank  = msm_crtc_enable_vblank,
+	.disable_vblank = msm_crtc_disable_vblank,
+	.get_vblank_timestamp = drm_crtc_vblank_helper_get_vblank_timestamp,
+	.get_vblank_counter = dpu_crtc_get_vblank_counter,
+};
+
+static const struct drm_crtc_helper_funcs dpu_crtc_helper_funcs = {
+	.atomic_disable = dpu_crtc_disable,
+	.atomic_enable = dpu_crtc_enable,
+	.atomic_check = dpu_crtc_atomic_check,
+	.atomic_begin = dpu_crtc_atomic_begin,
+	.atomic_flush = dpu_crtc_atomic_flush,
+	.get_scanout_position = dpu_crtc_get_scanout_position,
+};
+
+/* initialize crtc */
+struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane,
+				struct drm_plane *cursor)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms);
+	struct drm_crtc *crtc = NULL;
+	struct dpu_crtc *dpu_crtc;
+	int i, ret;
+
+	dpu_crtc = drmm_crtc_alloc_with_planes(dev, struct dpu_crtc, base,
+					       plane, cursor,
+					       &dpu_crtc_funcs,
+					       NULL);
+
+	if (IS_ERR(dpu_crtc))
+		return ERR_CAST(dpu_crtc);
+
+	crtc = &dpu_crtc->base;
+	crtc->dev = dev;
+
+	spin_lock_init(&dpu_crtc->spin_lock);
+	atomic_set(&dpu_crtc->frame_pending, 0);
+
+	init_completion(&dpu_crtc->frame_done_comp);
+
+	INIT_LIST_HEAD(&dpu_crtc->frame_event_list);
+
+	for (i = 0; i < ARRAY_SIZE(dpu_crtc->frame_events); i++) {
+		INIT_LIST_HEAD(&dpu_crtc->frame_events[i].list);
+		list_add(&dpu_crtc->frame_events[i].list,
+				&dpu_crtc->frame_event_list);
+		kthread_init_work(&dpu_crtc->frame_events[i].work,
+				dpu_crtc_frame_event_work);
+	}
+
+	drm_crtc_helper_add(crtc, &dpu_crtc_helper_funcs);
+
+	if (dpu_kms->catalog->dspp_count)
+		drm_crtc_enable_color_mgmt(crtc, 0, true, 0);
+
+	/* save user friendly CRTC name for later */
+	snprintf(dpu_crtc->name, DPU_CRTC_NAME_SIZE, "crtc%u", crtc->base.id);
+
+	/* initialize event handling */
+	spin_lock_init(&dpu_crtc->event_lock);
+
+	ret = drm_self_refresh_helper_init(crtc);
+	if (ret) {
+		DPU_ERROR("Failed to initialize %s with self-refresh helpers %d\n",
+			crtc->name, ret);
+		return ERR_PTR(ret);
+	}
+
+	DRM_DEBUG_KMS("%s: successfully initialized crtc\n", dpu_crtc->name);
+	return crtc;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_crtc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_crtc.h
@@ -0,0 +1,305 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2021 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef _DPU_CRTC_H_
+#define _DPU_CRTC_H_
+
+#include <linux/kthread.h>
+#include <drm/drm_crtc.h>
+#include "dpu_kms.h"
+#include "dpu_core_perf.h"
+
+#define DPU_CRTC_NAME_SIZE	12
+
+/* define the maximum number of in-flight frame events */
+#define DPU_CRTC_FRAME_EVENT_SIZE	4
+
+/**
+ * enum dpu_crtc_client_type: crtc client type
+ * @RT_CLIENT:	RealTime client like video/cmd mode display
+ *              voting through apps rsc
+ * @NRT_CLIENT:	Non-RealTime client like WB display
+ *              voting through apps rsc
+ */
+enum dpu_crtc_client_type {
+	RT_CLIENT,
+	NRT_CLIENT,
+};
+
+/**
+ * enum dpu_crtc_smmu_state:	smmu state
+ * @ATTACHED:	 all the context banks are attached.
+ * @DETACHED:	 all the context banks are detached.
+ * @ATTACH_ALL_REQ:	 transient state of attaching context banks.
+ * @DETACH_ALL_REQ:	 transient state of detaching context banks.
+ */
+enum dpu_crtc_smmu_state {
+	ATTACHED = 0,
+	DETACHED,
+	ATTACH_ALL_REQ,
+	DETACH_ALL_REQ,
+};
+
+/**
+ * enum dpu_crtc_smmu_state_transition_type: state transition type
+ * @NONE: no pending state transitions
+ * @PRE_COMMIT: state transitions should be done before processing the commit
+ * @POST_COMMIT: state transitions to be done after processing the commit.
+ */
+enum dpu_crtc_smmu_state_transition_type {
+	NONE,
+	PRE_COMMIT,
+	POST_COMMIT
+};
+
+/**
+ * struct dpu_crtc_smmu_state_data: stores the smmu state and transition type
+ * @state: current state of smmu context banks
+ * @transition_type: transition request type
+ * @transition_error: whether there is error while transitioning the state
+ */
+struct dpu_crtc_smmu_state_data {
+	uint32_t state;
+	uint32_t transition_type;
+	uint32_t transition_error;
+};
+
+/**
+ * enum dpu_crtc_crc_source: CRC source
+ * @DPU_CRTC_CRC_SOURCE_NONE: no source set
+ * @DPU_CRTC_CRC_SOURCE_LAYER_MIXER: CRC in layer mixer
+ * @DPU_CRTC_CRC_SOURCE_ENCODER: CRC in encoder
+ * @DPU_CRTC_CRC_SOURCE_INVALID: Invalid source
+ */
+enum dpu_crtc_crc_source {
+	DPU_CRTC_CRC_SOURCE_NONE = 0,
+	DPU_CRTC_CRC_SOURCE_LAYER_MIXER,
+	DPU_CRTC_CRC_SOURCE_ENCODER,
+	DPU_CRTC_CRC_SOURCE_MAX,
+	DPU_CRTC_CRC_SOURCE_INVALID = -1
+};
+
+/**
+ * struct dpu_crtc_mixer: stores the map for each virtual pipeline in the CRTC
+ * @hw_lm:	LM HW Driver context
+ * @lm_ctl:	CTL Path HW driver context
+ * @lm_dspp:	DSPP HW driver context
+ * @mixer_op_mode:	mixer blending operation mode
+ * @flush_mask:	mixer flush mask for ctl, mixer and pipe
+ */
+struct dpu_crtc_mixer {
+	struct dpu_hw_mixer *hw_lm;
+	struct dpu_hw_ctl *lm_ctl;
+	struct dpu_hw_dspp *hw_dspp;
+	u32 mixer_op_mode;
+};
+
+/**
+ * struct dpu_crtc_frame_event: stores crtc frame event for crtc processing
+ * @work:	base work structure
+ * @crtc:	Pointer to crtc handling this event
+ * @list:	event list
+ * @ts:		timestamp at queue entry
+ * @event:	event identifier
+ */
+struct dpu_crtc_frame_event {
+	struct kthread_work work;
+	struct drm_crtc *crtc;
+	struct list_head list;
+	ktime_t ts;
+	u32 event;
+};
+
+/*
+ * Maximum number of free event structures to cache
+ */
+#define DPU_CRTC_MAX_EVENT_COUNT	16
+
+/**
+ * struct dpu_crtc - virtualized CRTC data structure
+ * @base          : Base drm crtc structure
+ * @name          : ASCII description of this crtc
+ * @event         : Pointer to last received drm vblank event. If there is a
+ *                  pending vblank event, this will be non-null.
+ * @vsync_count   : Running count of received vsync events
+ * @drm_requested_vblank : Whether vblanks have been enabled in the encoder
+ * @property_info : Opaque structure for generic property support
+ * @property_defaults : Array of default values for generic property support
+ * @vblank_cb_count : count of vblank callback since last reset
+ * @play_count    : frame count between crtc enable and disable
+ * @vblank_cb_time  : ktime at vblank count reset
+ * @enabled       : whether the DPU CRTC is currently enabled. updated in the
+ *                  commit-thread, not state-swap time which is earlier, so
+ *                  safe to make decisions on during VBLANK on/off work
+ * @feature_list  : list of color processing features supported on a crtc
+ * @active_list   : list of color processing features are active
+ * @dirty_list    : list of color processing features are dirty
+ * @ad_dirty: list containing ad properties that are dirty
+ * @ad_active: list containing ad properties that are active
+ * @frame_pending : Whether or not an update is pending
+ * @frame_events  : static allocation of in-flight frame events
+ * @frame_event_list : available frame event list
+ * @spin_lock     : spin lock for frame event, transaction status, etc...
+ * @frame_done_comp    : for frame_event_done synchronization
+ * @event_thread  : Pointer to event handler thread
+ * @event_worker  : Event worker queue
+ * @event_lock    : Spinlock around event handling code
+ * @phandle: Pointer to power handler
+ * @cur_perf      : current performance committed to clock/bandwidth driver
+ * @crc_source    : CRC source
+ */
+struct dpu_crtc {
+	struct drm_crtc base;
+	char name[DPU_CRTC_NAME_SIZE];
+
+	struct drm_pending_vblank_event *event;
+	u32 vsync_count;
+
+	u32 vblank_cb_count;
+	u64 play_count;
+	ktime_t vblank_cb_time;
+	bool enabled;
+
+	struct list_head feature_list;
+	struct list_head active_list;
+	struct list_head dirty_list;
+	struct list_head ad_dirty;
+	struct list_head ad_active;
+
+	atomic_t frame_pending;
+	struct dpu_crtc_frame_event frame_events[DPU_CRTC_FRAME_EVENT_SIZE];
+	struct list_head frame_event_list;
+	spinlock_t spin_lock;
+	struct completion frame_done_comp;
+
+	/* for handling internal event thread */
+	spinlock_t event_lock;
+
+	struct dpu_core_perf_params cur_perf;
+
+	struct dpu_crtc_smmu_state_data smmu_state;
+};
+
+#define to_dpu_crtc(x) container_of(x, struct dpu_crtc, base)
+
+/**
+ * struct dpu_crtc_state - dpu container for atomic crtc state
+ * @base: Base drm crtc state structure
+ * @bw_control    : true if bw/clk controlled by core bw/clk properties
+ * @bw_split_vote : true if bw controlled by llcc/dram bw properties
+ * @lm_bounds     : LM boundaries based on current mode full resolution, no ROI.
+ *                  Origin top left of CRTC.
+ * @property_state: Local storage for msm_prop properties
+ * @property_values: Current crtc property values
+ * @input_fence_timeout_ns : Cached input fence timeout, in ns
+ * @new_perf: new performance state being requested
+ * @num_mixers    : Number of mixers in use
+ * @mixers        : List of active mixers
+ * @num_ctls      : Number of ctl paths in use
+ * @hw_ctls       : List of active ctl paths
+ * @crc_source    : CRC source
+ * @crc_frame_skip_count: Number of frames skipped before getting CRC
+ */
+struct dpu_crtc_state {
+	struct drm_crtc_state base;
+
+	bool bw_control;
+	bool bw_split_vote;
+	struct drm_rect lm_bounds[CRTC_DUAL_MIXERS];
+
+	uint64_t input_fence_timeout_ns;
+
+	struct dpu_core_perf_params new_perf;
+
+	/* HW Resources reserved for the crtc */
+	u32 num_mixers;
+	struct dpu_crtc_mixer mixers[CRTC_DUAL_MIXERS];
+
+	u32 num_ctls;
+	struct dpu_hw_ctl *hw_ctls[CRTC_DUAL_MIXERS];
+
+	enum dpu_crtc_crc_source crc_source;
+	int crc_frame_skip_count;
+};
+
+#define to_dpu_crtc_state(x) \
+	container_of(x, struct dpu_crtc_state, base)
+
+/**
+ * dpu_crtc_frame_pending - retun the number of pending frames
+ * @crtc: Pointer to drm crtc object
+ */
+static inline int dpu_crtc_frame_pending(struct drm_crtc *crtc)
+{
+	return crtc ? atomic_read(&to_dpu_crtc(crtc)->frame_pending) : -EINVAL;
+}
+
+/**
+ * dpu_crtc_vblank - enable or disable vblanks for this crtc
+ * @crtc: Pointer to drm crtc object
+ * @en: true to enable vblanks, false to disable
+ */
+int dpu_crtc_vblank(struct drm_crtc *crtc, bool en);
+
+/**
+ * dpu_crtc_vblank_callback - called on vblank irq, issues completion events
+ * @crtc: Pointer to drm crtc object
+ */
+void dpu_crtc_vblank_callback(struct drm_crtc *crtc);
+
+/**
+ * dpu_crtc_commit_kickoff - trigger kickoff of the commit for this crtc
+ * @crtc: Pointer to drm crtc object
+ */
+void dpu_crtc_commit_kickoff(struct drm_crtc *crtc);
+
+/**
+ * dpu_crtc_complete_commit - callback signalling completion of current commit
+ * @crtc: Pointer to drm crtc object
+ */
+void dpu_crtc_complete_commit(struct drm_crtc *crtc);
+
+/**
+ * dpu_crtc_init - create a new crtc object
+ * @dev: dpu device
+ * @plane: base plane
+ * @cursor: cursor plane
+ * @Return: new crtc object or error
+ */
+struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane,
+			       struct drm_plane *cursor);
+
+/**
+ * dpu_crtc_register_custom_event - api for enabling/disabling crtc event
+ * @kms: Pointer to dpu_kms
+ * @crtc_drm: Pointer to crtc object
+ * @event: Event that client is interested
+ * @en: Flag to enable/disable the event
+ */
+int dpu_crtc_register_custom_event(struct dpu_kms *kms,
+		struct drm_crtc *crtc_drm, u32 event, bool en);
+
+/**
+ * dpu_crtc_get_intf_mode - get interface mode of the given crtc
+ * @crtc: Pointert to crtc
+ */
+enum dpu_intf_mode dpu_crtc_get_intf_mode(struct drm_crtc *crtc);
+
+/**
+ * dpu_crtc_get_client_type - check the crtc type- rt, nrt etc.
+ * @crtc: Pointer to crtc
+ */
+static inline enum dpu_crtc_client_type dpu_crtc_get_client_type(
+						struct drm_crtc *crtc)
+{
+	return crtc && crtc->state ? RT_CLIENT : NRT_CLIENT;
+}
+
+void dpu_crtc_frame_event_cb(struct drm_crtc *crtc, u32 event);
+
+#endif /* _DPU_CRTC_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder.c
@@ -0,0 +1,2645 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Copyright (c) 2014-2018, 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+#include <linux/debugfs.h>
+#include <linux/kthread.h>
+#include <linux/seq_file.h>
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_crtc.h>
+#include <drm/drm_file.h>
+#include <drm/drm_probe_helper.h>
+#include <drm/drm_framebuffer.h>
+
+#include "msm_drv.h"
+#include "dpu_kms.h"
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_intf.h"
+#include "dpu_hw_ctl.h"
+#include "dpu_hw_dspp.h"
+#include "dpu_hw_dsc.h"
+#include "dpu_hw_merge3d.h"
+#include "dpu_hw_cdm.h"
+#include "dpu_formats.h"
+#include "dpu_encoder_phys.h"
+#include "dpu_crtc.h"
+#include "dpu_trace.h"
+#include "dpu_core_irq.h"
+#include "disp/msm_disp_snapshot.h"
+
+#define DPU_DEBUG_ENC(e, fmt, ...) DRM_DEBUG_ATOMIC("enc%d " fmt,\
+		(e) ? (e)->base.base.id : -1, ##__VA_ARGS__)
+
+#define DPU_ERROR_ENC(e, fmt, ...) DPU_ERROR("enc%d " fmt,\
+		(e) ? (e)->base.base.id : -1, ##__VA_ARGS__)
+
+#define DPU_ERROR_ENC_RATELIMITED(e, fmt, ...) DPU_ERROR_RATELIMITED("enc%d " fmt,\
+		(e) ? (e)->base.base.id : -1, ##__VA_ARGS__)
+
+/*
+ * Two to anticipate panels that can do cmd/vid dynamic switching
+ * plan is to create all possible physical encoder types, and switch between
+ * them at runtime
+ */
+#define NUM_PHYS_ENCODER_TYPES 2
+
+#define MAX_PHYS_ENCODERS_PER_VIRTUAL \
+	(MAX_H_TILES_PER_DISPLAY * NUM_PHYS_ENCODER_TYPES)
+
+#define MAX_CHANNELS_PER_ENC 2
+
+#define IDLE_SHORT_TIMEOUT	1
+
+#define MAX_HDISPLAY_SPLIT 1080
+
+/* timeout in frames waiting for frame done */
+#define DPU_ENCODER_FRAME_DONE_TIMEOUT_FRAMES 5
+
+/**
+ * enum dpu_enc_rc_events - events for resource control state machine
+ * @DPU_ENC_RC_EVENT_KICKOFF:
+ *	This event happens at NORMAL priority.
+ *	Event that signals the start of the transfer. When this event is
+ *	received, enable MDP/DSI core clocks. Regardless of the previous
+ *	state, the resource should be in ON state at the end of this event.
+ * @DPU_ENC_RC_EVENT_FRAME_DONE:
+ *	This event happens at INTERRUPT level.
+ *	Event signals the end of the data transfer after the PP FRAME_DONE
+ *	event. At the end of this event, a delayed work is scheduled to go to
+ *	IDLE_PC state after IDLE_TIMEOUT time.
+ * @DPU_ENC_RC_EVENT_PRE_STOP:
+ *	This event happens at NORMAL priority.
+ *	This event, when received during the ON state, leave the RC STATE
+ *	in the PRE_OFF state. It should be followed by the STOP event as
+ *	part of encoder disable.
+ *	If received during IDLE or OFF states, it will do nothing.
+ * @DPU_ENC_RC_EVENT_STOP:
+ *	This event happens at NORMAL priority.
+ *	When this event is received, disable all the MDP/DSI core clocks, and
+ *	disable IRQs. It should be called from the PRE_OFF or IDLE states.
+ *	IDLE is expected when IDLE_PC has run, and PRE_OFF did nothing.
+ *	PRE_OFF is expected when PRE_STOP was executed during the ON state.
+ *	Resource state should be in OFF at the end of the event.
+ * @DPU_ENC_RC_EVENT_ENTER_IDLE:
+ *	This event happens at NORMAL priority from a work item.
+ *	Event signals that there were no frame updates for IDLE_TIMEOUT time.
+ *	This would disable MDP/DSI core clocks and change the resource state
+ *	to IDLE.
+ */
+enum dpu_enc_rc_events {
+	DPU_ENC_RC_EVENT_KICKOFF = 1,
+	DPU_ENC_RC_EVENT_FRAME_DONE,
+	DPU_ENC_RC_EVENT_PRE_STOP,
+	DPU_ENC_RC_EVENT_STOP,
+	DPU_ENC_RC_EVENT_ENTER_IDLE
+};
+
+/*
+ * enum dpu_enc_rc_states - states that the resource control maintains
+ * @DPU_ENC_RC_STATE_OFF: Resource is in OFF state
+ * @DPU_ENC_RC_STATE_PRE_OFF: Resource is transitioning to OFF state
+ * @DPU_ENC_RC_STATE_ON: Resource is in ON state
+ * @DPU_ENC_RC_STATE_MODESET: Resource is in modeset state
+ * @DPU_ENC_RC_STATE_IDLE: Resource is in IDLE state
+ */
+enum dpu_enc_rc_states {
+	DPU_ENC_RC_STATE_OFF,
+	DPU_ENC_RC_STATE_PRE_OFF,
+	DPU_ENC_RC_STATE_ON,
+	DPU_ENC_RC_STATE_IDLE
+};
+
+/**
+ * struct dpu_encoder_virt - virtual encoder. Container of one or more physical
+ *	encoders. Virtual encoder manages one "logical" display. Physical
+ *	encoders manage one intf block, tied to a specific panel/sub-panel.
+ *	Virtual encoder defers as much as possible to the physical encoders.
+ *	Virtual encoder registers itself with the DRM Framework as the encoder.
+ * @base:		drm_encoder base class for registration with DRM
+ * @enc_spinlock:	Virtual-Encoder-Wide Spin Lock for IRQ purposes
+ * @enabled:		True if the encoder is active, protected by enc_lock
+ * @commit_done_timedout: True if there has been a timeout on commit after
+ *			enabling the encoder.
+ * @num_phys_encs:	Actual number of physical encoders contained.
+ * @phys_encs:		Container of physical encoders managed.
+ * @cur_master:		Pointer to the current master in this mode. Optimization
+ *			Only valid after enable. Cleared as disable.
+ * @cur_slave:		As above but for the slave encoder.
+ * @hw_pp:		Handle to the pingpong blocks used for the display. No.
+ *			pingpong blocks can be different than num_phys_encs.
+ * @hw_dsc:		Handle to the DSC blocks used for the display.
+ * @dsc_mask:		Bitmask of used DSC blocks.
+ * @intfs_swapped:	Whether or not the phys_enc interfaces have been swapped
+ *			for partial update right-only cases, such as pingpong
+ *			split where virtual pingpong does not generate IRQs
+ * @crtc:		Pointer to the currently assigned crtc. Normally you
+ *			would use crtc->state->encoder_mask to determine the
+ *			link between encoder/crtc. However in this case we need
+ *			to track crtc in the disable() hook which is called
+ *			_after_ encoder_mask is cleared.
+ * @connector:		If a mode is set, cached pointer to the active connector
+ * @enc_lock:			Lock around physical encoder
+ *				create/destroy/enable/disable
+ * @frame_busy_mask:		Bitmask tracking which phys_enc we are still
+ *				busy processing current command.
+ *				Bit0 = phys_encs[0] etc.
+ * @frame_done_timeout_ms:	frame done timeout in ms
+ * @frame_done_timeout_cnt:	atomic counter tracking the number of frame
+ * 				done timeouts
+ * @frame_done_timer:		watchdog timer for frame done event
+ * @disp_info:			local copy of msm_display_info struct
+ * @idle_pc_supported:		indicate if idle power collaps is supported
+ * @rc_lock:			resource control mutex lock to protect
+ *				virt encoder over various state changes
+ * @rc_state:			resource controller state
+ * @delayed_off_work:		delayed worker to schedule disabling of
+ *				clks and resources after IDLE_TIMEOUT time.
+ * @topology:                   topology of the display
+ * @idle_timeout:		idle timeout duration in milliseconds
+ * @wide_bus_en:		wide bus is enabled on this interface
+ * @dsc:			drm_dsc_config pointer, for DSC-enabled encoders
+ */
+struct dpu_encoder_virt {
+	struct drm_encoder base;
+	spinlock_t enc_spinlock;
+
+	bool enabled;
+	bool commit_done_timedout;
+
+	unsigned int num_phys_encs;
+	struct dpu_encoder_phys *phys_encs[MAX_PHYS_ENCODERS_PER_VIRTUAL];
+	struct dpu_encoder_phys *cur_master;
+	struct dpu_encoder_phys *cur_slave;
+	struct dpu_hw_pingpong *hw_pp[MAX_CHANNELS_PER_ENC];
+	struct dpu_hw_dsc *hw_dsc[MAX_CHANNELS_PER_ENC];
+
+	unsigned int dsc_mask;
+
+	bool intfs_swapped;
+
+	struct drm_crtc *crtc;
+	struct drm_connector *connector;
+
+	struct mutex enc_lock;
+	DECLARE_BITMAP(frame_busy_mask, MAX_PHYS_ENCODERS_PER_VIRTUAL);
+
+	atomic_t frame_done_timeout_ms;
+	atomic_t frame_done_timeout_cnt;
+	struct timer_list frame_done_timer;
+
+	struct msm_display_info disp_info;
+
+	bool idle_pc_supported;
+	struct mutex rc_lock;
+	enum dpu_enc_rc_states rc_state;
+	struct delayed_work delayed_off_work;
+	struct msm_display_topology topology;
+
+	u32 idle_timeout;
+
+	bool wide_bus_en;
+
+	/* DSC configuration */
+	struct drm_dsc_config *dsc;
+};
+
+#define to_dpu_encoder_virt(x) container_of(x, struct dpu_encoder_virt, base)
+
+static u32 dither_matrix[DITHER_MATRIX_SZ] = {
+	15, 7, 13, 5, 3, 11, 1, 9, 12, 4, 14, 6, 0, 8, 2, 10
+};
+
+u32 dpu_encoder_get_drm_fmt(struct dpu_encoder_phys *phys_enc)
+{
+	struct drm_encoder *drm_enc;
+	struct dpu_encoder_virt *dpu_enc;
+	struct drm_display_info *info;
+	struct drm_display_mode *mode;
+
+	drm_enc = phys_enc->parent;
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	info = &dpu_enc->connector->display_info;
+	mode = &phys_enc->cached_mode;
+
+	if (drm_mode_is_420_only(info, mode))
+		return DRM_FORMAT_YUV420;
+
+	return DRM_FORMAT_RGB888;
+}
+
+bool dpu_encoder_needs_periph_flush(struct dpu_encoder_phys *phys_enc)
+{
+	struct drm_encoder *drm_enc;
+	struct dpu_encoder_virt *dpu_enc;
+	struct msm_display_info *disp_info;
+	struct msm_drm_private *priv;
+	struct drm_display_mode *mode;
+
+	drm_enc = phys_enc->parent;
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	disp_info = &dpu_enc->disp_info;
+	priv = drm_enc->dev->dev_private;
+	mode = &phys_enc->cached_mode;
+
+	return phys_enc->hw_intf->cap->type == INTF_DP &&
+	       msm_dp_needs_periph_flush(priv->dp[disp_info->h_tile_instance[0]], mode);
+}
+
+bool dpu_encoder_is_widebus_enabled(const struct drm_encoder *drm_enc)
+{
+	const struct dpu_encoder_virt *dpu_enc;
+	struct msm_drm_private *priv = drm_enc->dev->dev_private;
+	const struct msm_display_info *disp_info;
+	int index;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	disp_info = &dpu_enc->disp_info;
+	index = disp_info->h_tile_instance[0];
+
+	if (disp_info->intf_type == INTF_DP)
+		return msm_dp_wide_bus_available(priv->dp[index]);
+	else if (disp_info->intf_type == INTF_DSI)
+		return msm_dsi_wide_bus_enabled(priv->dsi[index]);
+
+	return false;
+}
+
+bool dpu_encoder_is_dsc_enabled(const struct drm_encoder *drm_enc)
+{
+	const struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	return dpu_enc->dsc ? true : false;
+}
+
+int dpu_encoder_get_crc_values_cnt(const struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	int i, num_intf = 0;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->hw_intf && phys->hw_intf->ops.setup_misr
+				&& phys->hw_intf->ops.collect_misr)
+			num_intf++;
+	}
+
+	return num_intf;
+}
+
+void dpu_encoder_setup_misr(const struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc;
+
+	int i;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (!phys->hw_intf || !phys->hw_intf->ops.setup_misr)
+			continue;
+
+		phys->hw_intf->ops.setup_misr(phys->hw_intf);
+	}
+}
+
+int dpu_encoder_get_crc(const struct drm_encoder *drm_enc, u32 *crcs, int pos)
+{
+	struct dpu_encoder_virt *dpu_enc;
+
+	int i, rc = 0, entries_added = 0;
+
+	if (!drm_enc->crtc) {
+		DRM_ERROR("no crtc found for encoder %d\n", drm_enc->index);
+		return -EINVAL;
+	}
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (!phys->hw_intf || !phys->hw_intf->ops.collect_misr)
+			continue;
+
+		rc = phys->hw_intf->ops.collect_misr(phys->hw_intf, &crcs[pos + entries_added]);
+		if (rc)
+			return rc;
+		entries_added++;
+	}
+
+	return entries_added;
+}
+
+static void _dpu_encoder_setup_dither(struct dpu_hw_pingpong *hw_pp, unsigned bpc)
+{
+	struct dpu_hw_dither_cfg dither_cfg = { 0 };
+
+	if (!hw_pp->ops.setup_dither)
+		return;
+
+	switch (bpc) {
+	case 6:
+		dither_cfg.c0_bitdepth = 6;
+		dither_cfg.c1_bitdepth = 6;
+		dither_cfg.c2_bitdepth = 6;
+		dither_cfg.c3_bitdepth = 6;
+		dither_cfg.temporal_en = 0;
+		break;
+	default:
+		hw_pp->ops.setup_dither(hw_pp, NULL);
+		return;
+	}
+
+	memcpy(&dither_cfg.matrix, dither_matrix,
+			sizeof(u32) * DITHER_MATRIX_SZ);
+
+	hw_pp->ops.setup_dither(hw_pp, &dither_cfg);
+}
+
+static char *dpu_encoder_helper_get_intf_type(enum dpu_intf_mode intf_mode)
+{
+	switch (intf_mode) {
+	case INTF_MODE_VIDEO:
+		return "INTF_MODE_VIDEO";
+	case INTF_MODE_CMD:
+		return "INTF_MODE_CMD";
+	case INTF_MODE_WB_BLOCK:
+		return "INTF_MODE_WB_BLOCK";
+	case INTF_MODE_WB_LINE:
+		return "INTF_MODE_WB_LINE";
+	default:
+		return "INTF_MODE_UNKNOWN";
+	}
+}
+
+void dpu_encoder_helper_report_irq_timeout(struct dpu_encoder_phys *phys_enc,
+		enum dpu_intr_idx intr_idx)
+{
+	DRM_ERROR("irq timeout id=%u, intf_mode=%s intf=%d wb=%d, pp=%d, intr=%d\n",
+			DRMID(phys_enc->parent),
+			dpu_encoder_helper_get_intf_type(phys_enc->intf_mode),
+			phys_enc->hw_intf ? phys_enc->hw_intf->idx - INTF_0 : -1,
+			phys_enc->hw_wb ? phys_enc->hw_wb->idx - WB_0 : -1,
+			phys_enc->hw_pp->idx - PINGPONG_0, intr_idx);
+
+	dpu_encoder_frame_done_callback(phys_enc->parent, phys_enc,
+				DPU_ENCODER_FRAME_EVENT_ERROR);
+}
+
+static int dpu_encoder_helper_wait_event_timeout(int32_t drm_id,
+		u32 irq_idx, struct dpu_encoder_wait_info *info);
+
+int dpu_encoder_helper_wait_for_irq(struct dpu_encoder_phys *phys_enc,
+		unsigned int irq_idx,
+		void (*func)(void *arg),
+		struct dpu_encoder_wait_info *wait_info)
+{
+	u32 irq_status;
+	int ret;
+
+	if (!wait_info) {
+		DPU_ERROR("invalid params\n");
+		return -EINVAL;
+	}
+	/* note: do master / slave checking outside */
+
+	/* return EWOULDBLOCK since we know the wait isn't necessary */
+	if (phys_enc->enable_state == DPU_ENC_DISABLED) {
+		DRM_ERROR("encoder is disabled id=%u, callback=%ps, IRQ=[%d, %d]\n",
+			  DRMID(phys_enc->parent), func,
+			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+		return -EWOULDBLOCK;
+	}
+
+	if (irq_idx == 0) {
+		DRM_DEBUG_KMS("skip irq wait id=%u, callback=%ps\n",
+			      DRMID(phys_enc->parent), func);
+		return 0;
+	}
+
+	DRM_DEBUG_KMS("id=%u, callback=%ps, IRQ=[%d, %d], pp=%d, pending_cnt=%d\n",
+		      DRMID(phys_enc->parent), func,
+		      DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx), phys_enc->hw_pp->idx - PINGPONG_0,
+		      atomic_read(wait_info->atomic_cnt));
+
+	ret = dpu_encoder_helper_wait_event_timeout(
+			DRMID(phys_enc->parent),
+			irq_idx,
+			wait_info);
+
+	if (ret <= 0) {
+		irq_status = dpu_core_irq_read(phys_enc->dpu_kms, irq_idx);
+		if (irq_status) {
+			unsigned long flags;
+
+			DRM_DEBUG_KMS("IRQ=[%d, %d] not triggered id=%u, callback=%ps, pp=%d, atomic_cnt=%d\n",
+				      DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx),
+				      DRMID(phys_enc->parent), func,
+				      phys_enc->hw_pp->idx - PINGPONG_0,
+				      atomic_read(wait_info->atomic_cnt));
+			local_irq_save(flags);
+			func(phys_enc);
+			local_irq_restore(flags);
+			ret = 0;
+		} else {
+			ret = -ETIMEDOUT;
+			DRM_DEBUG_KMS("IRQ=[%d, %d] timeout id=%u, callback=%ps, pp=%d, atomic_cnt=%d\n",
+				      DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx),
+				      DRMID(phys_enc->parent), func,
+				      phys_enc->hw_pp->idx - PINGPONG_0,
+				      atomic_read(wait_info->atomic_cnt));
+		}
+	} else {
+		ret = 0;
+		trace_dpu_enc_irq_wait_success(DRMID(phys_enc->parent),
+			func, DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx),
+			phys_enc->hw_pp->idx - PINGPONG_0,
+			atomic_read(wait_info->atomic_cnt));
+	}
+
+	return ret;
+}
+
+int dpu_encoder_get_vsync_count(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
+	struct dpu_encoder_phys *phys = dpu_enc ? dpu_enc->cur_master : NULL;
+	return phys ? atomic_read(&phys->vsync_cnt) : 0;
+}
+
+int dpu_encoder_get_linecount(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	struct dpu_encoder_phys *phys;
+	int linecount = 0;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	phys = dpu_enc ? dpu_enc->cur_master : NULL;
+
+	if (phys && phys->ops.get_line_count)
+		linecount = phys->ops.get_line_count(phys);
+
+	return linecount;
+}
+
+void dpu_encoder_helper_split_config(
+		struct dpu_encoder_phys *phys_enc,
+		enum dpu_intf interface)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	struct split_pipe_cfg cfg = { 0 };
+	struct dpu_hw_mdp *hw_mdptop;
+	struct msm_display_info *disp_info;
+
+	if (!phys_enc->hw_mdptop || !phys_enc->parent) {
+		DPU_ERROR("invalid arg(s), encoder %d\n", phys_enc != NULL);
+		return;
+	}
+
+	dpu_enc = to_dpu_encoder_virt(phys_enc->parent);
+	hw_mdptop = phys_enc->hw_mdptop;
+	disp_info = &dpu_enc->disp_info;
+
+	if (disp_info->intf_type != INTF_DSI)
+		return;
+
+	/**
+	 * disable split modes since encoder will be operating in as the only
+	 * encoder, either for the entire use case in the case of, for example,
+	 * single DSI, or for this frame in the case of left/right only partial
+	 * update.
+	 */
+	if (phys_enc->split_role == ENC_ROLE_SOLO) {
+		if (hw_mdptop->ops.setup_split_pipe)
+			hw_mdptop->ops.setup_split_pipe(hw_mdptop, &cfg);
+		return;
+	}
+
+	cfg.en = true;
+	cfg.mode = phys_enc->intf_mode;
+	cfg.intf = interface;
+
+	if (cfg.en && phys_enc->ops.needs_single_flush &&
+			phys_enc->ops.needs_single_flush(phys_enc))
+		cfg.split_flush_en = true;
+
+	if (phys_enc->split_role == ENC_ROLE_MASTER) {
+		DPU_DEBUG_ENC(dpu_enc, "enable %d\n", cfg.en);
+
+		if (hw_mdptop->ops.setup_split_pipe)
+			hw_mdptop->ops.setup_split_pipe(hw_mdptop, &cfg);
+	}
+}
+
+bool dpu_encoder_use_dsc_merge(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
+	int i, intf_count = 0, num_dsc = 0;
+
+	for (i = 0; i < MAX_PHYS_ENCODERS_PER_VIRTUAL; i++)
+		if (dpu_enc->phys_encs[i])
+			intf_count++;
+
+	/* See dpu_encoder_get_topology, we only support 2:2:1 topology */
+	if (dpu_enc->dsc)
+		num_dsc = 2;
+
+	return (num_dsc > 0) && (num_dsc > intf_count);
+}
+
+static struct drm_dsc_config *dpu_encoder_get_dsc_config(struct drm_encoder *drm_enc)
+{
+	struct msm_drm_private *priv = drm_enc->dev->dev_private;
+	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
+	int index = dpu_enc->disp_info.h_tile_instance[0];
+
+	if (dpu_enc->disp_info.intf_type == INTF_DSI)
+		return msm_dsi_get_dsc_config(priv->dsi[index]);
+
+	return NULL;
+}
+
+static struct msm_display_topology dpu_encoder_get_topology(
+			struct dpu_encoder_virt *dpu_enc,
+			struct dpu_kms *dpu_kms,
+			struct drm_display_mode *mode,
+			struct drm_crtc_state *crtc_state,
+			struct drm_dsc_config *dsc)
+{
+	struct msm_display_topology topology = {0};
+	int i, intf_count = 0;
+
+	for (i = 0; i < MAX_PHYS_ENCODERS_PER_VIRTUAL; i++)
+		if (dpu_enc->phys_encs[i])
+			intf_count++;
+
+	/* Datapath topology selection
+	 *
+	 * Dual display
+	 * 2 LM, 2 INTF ( Split display using 2 interfaces)
+	 *
+	 * Single display
+	 * 1 LM, 1 INTF
+	 * 2 LM, 1 INTF (stream merge to support high resolution interfaces)
+	 *
+	 * Add dspps to the reservation requirements if ctm is requested
+	 */
+	if (intf_count == 2)
+		topology.num_lm = 2;
+	else if (!dpu_kms->catalog->caps->has_3d_merge)
+		topology.num_lm = 1;
+	else
+		topology.num_lm = (mode->hdisplay > dpu_kms->catalog->caps->max_mixer_width) ?
+				   2 : 1;
+
+	if (crtc_state->ctm)
+		topology.num_dspp = topology.num_lm;
+
+	topology.num_intf = intf_count;
+
+	if (dsc) {
+		/*
+		 * In case of Display Stream Compression (DSC), we would use
+		 * 2 DSC encoders, 2 layer mixers and 1 interface
+		 * this is power optimal and can drive up to (including) 4k
+		 * screens
+		 */
+		topology.num_dsc = 2;
+		topology.num_lm = 2;
+		topology.num_intf = 1;
+	}
+
+	return topology;
+}
+
+static void dpu_encoder_assign_crtc_resources(struct dpu_kms *dpu_kms,
+					      struct drm_encoder *drm_enc,
+					      struct dpu_global_state *global_state,
+					      struct drm_crtc_state *crtc_state)
+{
+	struct dpu_crtc_state *cstate;
+	struct dpu_hw_blk *hw_ctl[MAX_CHANNELS_PER_ENC];
+	struct dpu_hw_blk *hw_lm[MAX_CHANNELS_PER_ENC];
+	struct dpu_hw_blk *hw_dspp[MAX_CHANNELS_PER_ENC];
+	int num_lm, num_ctl, num_dspp, i;
+
+	cstate = to_dpu_crtc_state(crtc_state);
+
+	memset(cstate->mixers, 0, sizeof(cstate->mixers));
+
+	num_ctl = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+		drm_enc->base.id, DPU_HW_BLK_CTL, hw_ctl, ARRAY_SIZE(hw_ctl));
+	num_lm = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+		drm_enc->base.id, DPU_HW_BLK_LM, hw_lm, ARRAY_SIZE(hw_lm));
+	num_dspp = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+		drm_enc->base.id, DPU_HW_BLK_DSPP, hw_dspp,
+		ARRAY_SIZE(hw_dspp));
+
+	for (i = 0; i < num_lm; i++) {
+		int ctl_idx = (i < num_ctl) ? i : (num_ctl-1);
+
+		cstate->mixers[i].hw_lm = to_dpu_hw_mixer(hw_lm[i]);
+		cstate->mixers[i].lm_ctl = to_dpu_hw_ctl(hw_ctl[ctl_idx]);
+		cstate->mixers[i].hw_dspp = i < num_dspp ? to_dpu_hw_dspp(hw_dspp[i]) : NULL;
+	}
+
+	cstate->num_mixers = num_lm;
+}
+
+static int dpu_encoder_virt_atomic_check(
+		struct drm_encoder *drm_enc,
+		struct drm_crtc_state *crtc_state,
+		struct drm_connector_state *conn_state)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	struct msm_drm_private *priv;
+	struct dpu_kms *dpu_kms;
+	struct drm_display_mode *adj_mode;
+	struct msm_display_topology topology;
+	struct msm_display_info *disp_info;
+	struct dpu_global_state *global_state;
+	struct drm_framebuffer *fb;
+	struct drm_dsc_config *dsc;
+	int i = 0;
+	int ret = 0;
+
+	if (!drm_enc || !crtc_state || !conn_state) {
+		DPU_ERROR("invalid arg(s), drm_enc %d, crtc/conn state %d/%d\n",
+				drm_enc != NULL, crtc_state != NULL, conn_state != NULL);
+		return -EINVAL;
+	}
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	DPU_DEBUG_ENC(dpu_enc, "\n");
+
+	priv = drm_enc->dev->dev_private;
+	disp_info = &dpu_enc->disp_info;
+	dpu_kms = to_dpu_kms(priv->kms);
+	adj_mode = &crtc_state->adjusted_mode;
+	global_state = dpu_kms_get_global_state(crtc_state->state);
+	if (IS_ERR(global_state))
+		return PTR_ERR(global_state);
+
+	trace_dpu_enc_atomic_check(DRMID(drm_enc));
+
+	/* perform atomic check on the first physical encoder (master) */
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->ops.atomic_check)
+			ret = phys->ops.atomic_check(phys, crtc_state,
+					conn_state);
+		if (ret) {
+			DPU_ERROR_ENC(dpu_enc,
+					"mode unsupported, phys idx %d\n", i);
+			return ret;
+		}
+	}
+
+	dsc = dpu_encoder_get_dsc_config(drm_enc);
+
+	topology = dpu_encoder_get_topology(dpu_enc, dpu_kms, adj_mode, crtc_state, dsc);
+
+	/*
+	 * Use CDM only for writeback or DP at the moment as other interfaces cannot handle it.
+	 * If writeback itself cannot handle cdm for some reason it will fail in its atomic_check()
+	 * earlier.
+	 */
+	if (disp_info->intf_type == INTF_WB && conn_state->writeback_job) {
+		fb = conn_state->writeback_job->fb;
+
+		if (fb && DPU_FORMAT_IS_YUV(to_dpu_format(msm_framebuffer_format(fb))))
+			topology.needs_cdm = true;
+	} else if (disp_info->intf_type == INTF_DP) {
+		if (msm_dp_is_yuv_420_enabled(priv->dp[disp_info->h_tile_instance[0]], adj_mode))
+			topology.needs_cdm = true;
+	}
+
+	if (topology.needs_cdm && !dpu_enc->cur_master->hw_cdm)
+		crtc_state->mode_changed = true;
+	else if (!topology.needs_cdm && dpu_enc->cur_master->hw_cdm)
+		crtc_state->mode_changed = true;
+	/*
+	 * Release and Allocate resources on every modeset
+	 * Dont allocate when active is false.
+	 */
+	if (drm_atomic_crtc_needs_modeset(crtc_state)) {
+		dpu_rm_release(global_state, drm_enc);
+
+		if (!crtc_state->active_changed || crtc_state->enable)
+			ret = dpu_rm_reserve(&dpu_kms->rm, global_state,
+					drm_enc, crtc_state, topology);
+		if (!ret)
+			dpu_encoder_assign_crtc_resources(dpu_kms, drm_enc,
+							  global_state, crtc_state);
+	}
+
+	trace_dpu_enc_atomic_check_flags(DRMID(drm_enc), adj_mode->flags);
+
+	return ret;
+}
+
+static void _dpu_encoder_update_vsync_source(struct dpu_encoder_virt *dpu_enc,
+			struct msm_display_info *disp_info)
+{
+	struct dpu_vsync_source_cfg vsync_cfg = { 0 };
+	struct msm_drm_private *priv;
+	struct dpu_kms *dpu_kms;
+	struct dpu_hw_mdp *hw_mdptop;
+	struct drm_encoder *drm_enc;
+	struct dpu_encoder_phys *phys_enc;
+	int i;
+
+	if (!dpu_enc || !disp_info) {
+		DPU_ERROR("invalid param dpu_enc:%d or disp_info:%d\n",
+					dpu_enc != NULL, disp_info != NULL);
+		return;
+	} else if (dpu_enc->num_phys_encs > ARRAY_SIZE(dpu_enc->hw_pp)) {
+		DPU_ERROR("invalid num phys enc %d/%d\n",
+				dpu_enc->num_phys_encs,
+				(int) ARRAY_SIZE(dpu_enc->hw_pp));
+		return;
+	}
+
+	drm_enc = &dpu_enc->base;
+	/* this pointers are checked in virt_enable_helper */
+	priv = drm_enc->dev->dev_private;
+
+	dpu_kms = to_dpu_kms(priv->kms);
+	hw_mdptop = dpu_kms->hw_mdp;
+	if (!hw_mdptop) {
+		DPU_ERROR("invalid mdptop\n");
+		return;
+	}
+
+	if (hw_mdptop->ops.setup_vsync_source &&
+			disp_info->is_cmd_mode) {
+		for (i = 0; i < dpu_enc->num_phys_encs; i++)
+			vsync_cfg.ppnumber[i] = dpu_enc->hw_pp[i]->idx;
+
+		vsync_cfg.pp_count = dpu_enc->num_phys_encs;
+		vsync_cfg.frame_rate = drm_mode_vrefresh(&dpu_enc->base.crtc->state->adjusted_mode);
+
+		if (disp_info->is_te_using_watchdog_timer)
+			vsync_cfg.vsync_source = DPU_VSYNC_SOURCE_WD_TIMER_0;
+		else
+			vsync_cfg.vsync_source = DPU_VSYNC0_SOURCE_GPIO;
+
+		hw_mdptop->ops.setup_vsync_source(hw_mdptop, &vsync_cfg);
+
+		for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+			phys_enc = dpu_enc->phys_encs[i];
+
+			if (phys_enc->has_intf_te && phys_enc->hw_intf->ops.vsync_sel)
+				phys_enc->hw_intf->ops.vsync_sel(phys_enc->hw_intf,
+						vsync_cfg.vsync_source);
+		}
+	}
+}
+
+static void _dpu_encoder_irq_control(struct drm_encoder *drm_enc, bool enable)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	int i;
+
+	if (!drm_enc) {
+		DPU_ERROR("invalid encoder\n");
+		return;
+	}
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	DPU_DEBUG_ENC(dpu_enc, "enable:%d\n", enable);
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->ops.irq_control)
+			phys->ops.irq_control(phys, enable);
+	}
+
+}
+
+static void _dpu_encoder_resource_control_helper(struct drm_encoder *drm_enc,
+		bool enable)
+{
+	struct msm_drm_private *priv;
+	struct dpu_kms *dpu_kms;
+	struct dpu_encoder_virt *dpu_enc;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	priv = drm_enc->dev->dev_private;
+	dpu_kms = to_dpu_kms(priv->kms);
+
+	trace_dpu_enc_rc_helper(DRMID(drm_enc), enable);
+
+	if (!dpu_enc->cur_master) {
+		DPU_ERROR("encoder master not set\n");
+		return;
+	}
+
+	if (enable) {
+		/* enable DPU core clks */
+		pm_runtime_get_sync(&dpu_kms->pdev->dev);
+
+		/* enable all the irq */
+		_dpu_encoder_irq_control(drm_enc, true);
+
+	} else {
+		/* disable all the irq */
+		_dpu_encoder_irq_control(drm_enc, false);
+
+		/* disable DPU core clks */
+		pm_runtime_put_sync(&dpu_kms->pdev->dev);
+	}
+
+}
+
+static int dpu_encoder_resource_control(struct drm_encoder *drm_enc,
+		u32 sw_event)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	struct msm_drm_private *priv;
+	bool is_vid_mode = false;
+
+	if (!drm_enc || !drm_enc->dev || !drm_enc->crtc) {
+		DPU_ERROR("invalid parameters\n");
+		return -EINVAL;
+	}
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	priv = drm_enc->dev->dev_private;
+	is_vid_mode = !dpu_enc->disp_info.is_cmd_mode;
+
+	/*
+	 * when idle_pc is not supported, process only KICKOFF, STOP and MODESET
+	 * events and return early for other events (ie wb display).
+	 */
+	if (!dpu_enc->idle_pc_supported &&
+			(sw_event != DPU_ENC_RC_EVENT_KICKOFF &&
+			sw_event != DPU_ENC_RC_EVENT_STOP &&
+			sw_event != DPU_ENC_RC_EVENT_PRE_STOP))
+		return 0;
+
+	trace_dpu_enc_rc(DRMID(drm_enc), sw_event, dpu_enc->idle_pc_supported,
+			 dpu_enc->rc_state, "begin");
+
+	switch (sw_event) {
+	case DPU_ENC_RC_EVENT_KICKOFF:
+		/* cancel delayed off work, if any */
+		if (cancel_delayed_work_sync(&dpu_enc->delayed_off_work))
+			DPU_DEBUG_ENC(dpu_enc, "sw_event:%d, work cancelled\n",
+					sw_event);
+
+		mutex_lock(&dpu_enc->rc_lock);
+
+		/* return if the resource control is already in ON state */
+		if (dpu_enc->rc_state == DPU_ENC_RC_STATE_ON) {
+			DRM_DEBUG_ATOMIC("id;%u, sw_event:%d, rc in ON state\n",
+				      DRMID(drm_enc), sw_event);
+			mutex_unlock(&dpu_enc->rc_lock);
+			return 0;
+		} else if (dpu_enc->rc_state != DPU_ENC_RC_STATE_OFF &&
+				dpu_enc->rc_state != DPU_ENC_RC_STATE_IDLE) {
+			DRM_DEBUG_ATOMIC("id;%u, sw_event:%d, rc in state %d\n",
+				      DRMID(drm_enc), sw_event,
+				      dpu_enc->rc_state);
+			mutex_unlock(&dpu_enc->rc_lock);
+			return -EINVAL;
+		}
+
+		if (is_vid_mode && dpu_enc->rc_state == DPU_ENC_RC_STATE_IDLE)
+			_dpu_encoder_irq_control(drm_enc, true);
+		else
+			_dpu_encoder_resource_control_helper(drm_enc, true);
+
+		dpu_enc->rc_state = DPU_ENC_RC_STATE_ON;
+
+		trace_dpu_enc_rc(DRMID(drm_enc), sw_event,
+				 dpu_enc->idle_pc_supported, dpu_enc->rc_state,
+				 "kickoff");
+
+		mutex_unlock(&dpu_enc->rc_lock);
+		break;
+
+	case DPU_ENC_RC_EVENT_FRAME_DONE:
+		/*
+		 * mutex lock is not used as this event happens at interrupt
+		 * context. And locking is not required as, the other events
+		 * like KICKOFF and STOP does a wait-for-idle before executing
+		 * the resource_control
+		 */
+		if (dpu_enc->rc_state != DPU_ENC_RC_STATE_ON) {
+			DRM_DEBUG_KMS("id:%d, sw_event:%d,rc:%d-unexpected\n",
+				      DRMID(drm_enc), sw_event,
+				      dpu_enc->rc_state);
+			return -EINVAL;
+		}
+
+		/*
+		 * schedule off work item only when there are no
+		 * frames pending
+		 */
+		if (dpu_crtc_frame_pending(drm_enc->crtc) > 1) {
+			DRM_DEBUG_KMS("id:%d skip schedule work\n",
+				      DRMID(drm_enc));
+			return 0;
+		}
+
+		queue_delayed_work(priv->wq, &dpu_enc->delayed_off_work,
+				   msecs_to_jiffies(dpu_enc->idle_timeout));
+
+		trace_dpu_enc_rc(DRMID(drm_enc), sw_event,
+				 dpu_enc->idle_pc_supported, dpu_enc->rc_state,
+				 "frame done");
+		break;
+
+	case DPU_ENC_RC_EVENT_PRE_STOP:
+		/* cancel delayed off work, if any */
+		if (cancel_delayed_work_sync(&dpu_enc->delayed_off_work))
+			DPU_DEBUG_ENC(dpu_enc, "sw_event:%d, work cancelled\n",
+					sw_event);
+
+		mutex_lock(&dpu_enc->rc_lock);
+
+		if (is_vid_mode &&
+			  dpu_enc->rc_state == DPU_ENC_RC_STATE_IDLE) {
+			_dpu_encoder_irq_control(drm_enc, true);
+		}
+		/* skip if is already OFF or IDLE, resources are off already */
+		else if (dpu_enc->rc_state == DPU_ENC_RC_STATE_OFF ||
+				dpu_enc->rc_state == DPU_ENC_RC_STATE_IDLE) {
+			DRM_DEBUG_KMS("id:%u, sw_event:%d, rc in %d state\n",
+				      DRMID(drm_enc), sw_event,
+				      dpu_enc->rc_state);
+			mutex_unlock(&dpu_enc->rc_lock);
+			return 0;
+		}
+
+		dpu_enc->rc_state = DPU_ENC_RC_STATE_PRE_OFF;
+
+		trace_dpu_enc_rc(DRMID(drm_enc), sw_event,
+				 dpu_enc->idle_pc_supported, dpu_enc->rc_state,
+				 "pre stop");
+
+		mutex_unlock(&dpu_enc->rc_lock);
+		break;
+
+	case DPU_ENC_RC_EVENT_STOP:
+		mutex_lock(&dpu_enc->rc_lock);
+
+		/* return if the resource control is already in OFF state */
+		if (dpu_enc->rc_state == DPU_ENC_RC_STATE_OFF) {
+			DRM_DEBUG_KMS("id: %u, sw_event:%d, rc in OFF state\n",
+				      DRMID(drm_enc), sw_event);
+			mutex_unlock(&dpu_enc->rc_lock);
+			return 0;
+		} else if (dpu_enc->rc_state == DPU_ENC_RC_STATE_ON) {
+			DRM_ERROR("id: %u, sw_event:%d, rc in state %d\n",
+				  DRMID(drm_enc), sw_event, dpu_enc->rc_state);
+			mutex_unlock(&dpu_enc->rc_lock);
+			return -EINVAL;
+		}
+
+		/**
+		 * expect to arrive here only if in either idle state or pre-off
+		 * and in IDLE state the resources are already disabled
+		 */
+		if (dpu_enc->rc_state == DPU_ENC_RC_STATE_PRE_OFF)
+			_dpu_encoder_resource_control_helper(drm_enc, false);
+
+		dpu_enc->rc_state = DPU_ENC_RC_STATE_OFF;
+
+		trace_dpu_enc_rc(DRMID(drm_enc), sw_event,
+				 dpu_enc->idle_pc_supported, dpu_enc->rc_state,
+				 "stop");
+
+		mutex_unlock(&dpu_enc->rc_lock);
+		break;
+
+	case DPU_ENC_RC_EVENT_ENTER_IDLE:
+		mutex_lock(&dpu_enc->rc_lock);
+
+		if (dpu_enc->rc_state != DPU_ENC_RC_STATE_ON) {
+			DRM_ERROR("id: %u, sw_event:%d, rc:%d !ON state\n",
+				  DRMID(drm_enc), sw_event, dpu_enc->rc_state);
+			mutex_unlock(&dpu_enc->rc_lock);
+			return 0;
+		}
+
+		/*
+		 * if we are in ON but a frame was just kicked off,
+		 * ignore the IDLE event, it's probably a stale timer event
+		 */
+		if (dpu_enc->frame_busy_mask[0]) {
+			DRM_ERROR("id:%u, sw_event:%d, rc:%d frame pending\n",
+				  DRMID(drm_enc), sw_event, dpu_enc->rc_state);
+			mutex_unlock(&dpu_enc->rc_lock);
+			return 0;
+		}
+
+		if (is_vid_mode)
+			_dpu_encoder_irq_control(drm_enc, false);
+		else
+			_dpu_encoder_resource_control_helper(drm_enc, false);
+
+		dpu_enc->rc_state = DPU_ENC_RC_STATE_IDLE;
+
+		trace_dpu_enc_rc(DRMID(drm_enc), sw_event,
+				 dpu_enc->idle_pc_supported, dpu_enc->rc_state,
+				 "idle");
+
+		mutex_unlock(&dpu_enc->rc_lock);
+		break;
+
+	default:
+		DRM_ERROR("id:%u, unexpected sw_event: %d\n", DRMID(drm_enc),
+			  sw_event);
+		trace_dpu_enc_rc(DRMID(drm_enc), sw_event,
+				 dpu_enc->idle_pc_supported, dpu_enc->rc_state,
+				 "error");
+		break;
+	}
+
+	trace_dpu_enc_rc(DRMID(drm_enc), sw_event,
+			 dpu_enc->idle_pc_supported, dpu_enc->rc_state,
+			 "end");
+	return 0;
+}
+
+void dpu_encoder_prepare_wb_job(struct drm_encoder *drm_enc,
+		struct drm_writeback_job *job)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	int i;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->ops.prepare_wb_job)
+			phys->ops.prepare_wb_job(phys, job);
+
+	}
+}
+
+void dpu_encoder_cleanup_wb_job(struct drm_encoder *drm_enc,
+		struct drm_writeback_job *job)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	int i;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->ops.cleanup_wb_job)
+			phys->ops.cleanup_wb_job(phys, job);
+
+	}
+}
+
+static void dpu_encoder_virt_atomic_mode_set(struct drm_encoder *drm_enc,
+					     struct drm_crtc_state *crtc_state,
+					     struct drm_connector_state *conn_state)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	struct msm_drm_private *priv;
+	struct dpu_kms *dpu_kms;
+	struct dpu_global_state *global_state;
+	struct dpu_hw_blk *hw_pp[MAX_CHANNELS_PER_ENC];
+	struct dpu_hw_blk *hw_ctl[MAX_CHANNELS_PER_ENC];
+	struct dpu_hw_blk *hw_dsc[MAX_CHANNELS_PER_ENC];
+	int num_ctl, num_pp, num_dsc;
+	unsigned int dsc_mask = 0;
+	int i;
+
+	if (!drm_enc) {
+		DPU_ERROR("invalid encoder\n");
+		return;
+	}
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	DPU_DEBUG_ENC(dpu_enc, "\n");
+
+	priv = drm_enc->dev->dev_private;
+	dpu_kms = to_dpu_kms(priv->kms);
+
+	global_state = dpu_kms_get_existing_global_state(dpu_kms);
+	if (IS_ERR_OR_NULL(global_state)) {
+		DPU_ERROR("Failed to get global state");
+		return;
+	}
+
+	trace_dpu_enc_mode_set(DRMID(drm_enc));
+
+	/* Query resource that have been reserved in atomic check step. */
+	num_pp = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+		drm_enc->base.id, DPU_HW_BLK_PINGPONG, hw_pp,
+		ARRAY_SIZE(hw_pp));
+	num_ctl = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+		drm_enc->base.id, DPU_HW_BLK_CTL, hw_ctl, ARRAY_SIZE(hw_ctl));
+
+	for (i = 0; i < MAX_CHANNELS_PER_ENC; i++)
+		dpu_enc->hw_pp[i] = i < num_pp ? to_dpu_hw_pingpong(hw_pp[i])
+						: NULL;
+
+	num_dsc = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+						drm_enc->base.id, DPU_HW_BLK_DSC,
+						hw_dsc, ARRAY_SIZE(hw_dsc));
+	for (i = 0; i < num_dsc; i++) {
+		dpu_enc->hw_dsc[i] = to_dpu_hw_dsc(hw_dsc[i]);
+		dsc_mask |= BIT(dpu_enc->hw_dsc[i]->idx - DSC_0);
+	}
+
+	dpu_enc->dsc_mask = dsc_mask;
+
+	if ((dpu_enc->disp_info.intf_type == INTF_WB && conn_state->writeback_job) ||
+	    dpu_enc->disp_info.intf_type == INTF_DP) {
+		struct dpu_hw_blk *hw_cdm = NULL;
+
+		dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state,
+					      drm_enc->base.id, DPU_HW_BLK_CDM,
+					      &hw_cdm, 1);
+		dpu_enc->cur_master->hw_cdm = hw_cdm ? to_dpu_hw_cdm(hw_cdm) : NULL;
+	}
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		phys->hw_pp = dpu_enc->hw_pp[i];
+		if (!phys->hw_pp) {
+			DPU_ERROR_ENC(dpu_enc,
+				"no pp block assigned at idx: %d\n", i);
+			return;
+		}
+
+		phys->hw_ctl = i < num_ctl ? to_dpu_hw_ctl(hw_ctl[i]) : NULL;
+		if (!phys->hw_ctl) {
+			DPU_ERROR_ENC(dpu_enc,
+				"no ctl block assigned at idx: %d\n", i);
+			return;
+		}
+
+		phys->cached_mode = crtc_state->adjusted_mode;
+		if (phys->ops.atomic_mode_set)
+			phys->ops.atomic_mode_set(phys, crtc_state, conn_state);
+	}
+}
+
+static void _dpu_encoder_virt_enable_helper(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc = NULL;
+	int i;
+
+	if (!drm_enc || !drm_enc->dev) {
+		DPU_ERROR("invalid parameters\n");
+		return;
+	}
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	if (!dpu_enc || !dpu_enc->cur_master) {
+		DPU_ERROR("invalid dpu encoder/master\n");
+		return;
+	}
+
+
+	if (dpu_enc->disp_info.intf_type == INTF_DP &&
+		dpu_enc->cur_master->hw_mdptop &&
+		dpu_enc->cur_master->hw_mdptop->ops.intf_audio_select)
+		dpu_enc->cur_master->hw_mdptop->ops.intf_audio_select(
+			dpu_enc->cur_master->hw_mdptop);
+
+	_dpu_encoder_update_vsync_source(dpu_enc, &dpu_enc->disp_info);
+
+	if (dpu_enc->disp_info.intf_type == INTF_DSI &&
+			!WARN_ON(dpu_enc->num_phys_encs == 0)) {
+		unsigned bpc = dpu_enc->connector->display_info.bpc;
+		for (i = 0; i < MAX_CHANNELS_PER_ENC; i++) {
+			if (!dpu_enc->hw_pp[i])
+				continue;
+			_dpu_encoder_setup_dither(dpu_enc->hw_pp[i], bpc);
+		}
+	}
+}
+
+void dpu_encoder_virt_runtime_resume(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	mutex_lock(&dpu_enc->enc_lock);
+
+	if (!dpu_enc->enabled)
+		goto out;
+
+	if (dpu_enc->cur_slave && dpu_enc->cur_slave->ops.restore)
+		dpu_enc->cur_slave->ops.restore(dpu_enc->cur_slave);
+	if (dpu_enc->cur_master && dpu_enc->cur_master->ops.restore)
+		dpu_enc->cur_master->ops.restore(dpu_enc->cur_master);
+
+	_dpu_encoder_virt_enable_helper(drm_enc);
+
+out:
+	mutex_unlock(&dpu_enc->enc_lock);
+}
+
+static void dpu_encoder_virt_atomic_enable(struct drm_encoder *drm_enc,
+					struct drm_atomic_state *state)
+{
+	struct dpu_encoder_virt *dpu_enc = NULL;
+	int ret = 0;
+	struct drm_display_mode *cur_mode = NULL;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	dpu_enc->dsc = dpu_encoder_get_dsc_config(drm_enc);
+
+	atomic_set(&dpu_enc->frame_done_timeout_cnt, 0);
+
+	mutex_lock(&dpu_enc->enc_lock);
+
+	dpu_enc->commit_done_timedout = false;
+
+	dpu_enc->connector = drm_atomic_get_new_connector_for_encoder(state, drm_enc);
+
+	cur_mode = &dpu_enc->base.crtc->state->adjusted_mode;
+
+	dpu_enc->wide_bus_en = dpu_encoder_is_widebus_enabled(drm_enc);
+
+	trace_dpu_enc_enable(DRMID(drm_enc), cur_mode->hdisplay,
+			     cur_mode->vdisplay);
+
+	/* always enable slave encoder before master */
+	if (dpu_enc->cur_slave && dpu_enc->cur_slave->ops.enable)
+		dpu_enc->cur_slave->ops.enable(dpu_enc->cur_slave);
+
+	if (dpu_enc->cur_master && dpu_enc->cur_master->ops.enable)
+		dpu_enc->cur_master->ops.enable(dpu_enc->cur_master);
+
+	ret = dpu_encoder_resource_control(drm_enc, DPU_ENC_RC_EVENT_KICKOFF);
+	if (ret) {
+		DPU_ERROR_ENC(dpu_enc, "dpu resource control failed: %d\n",
+				ret);
+		goto out;
+	}
+
+	_dpu_encoder_virt_enable_helper(drm_enc);
+
+	dpu_enc->enabled = true;
+
+out:
+	mutex_unlock(&dpu_enc->enc_lock);
+}
+
+static void dpu_encoder_virt_atomic_disable(struct drm_encoder *drm_enc,
+					struct drm_atomic_state *state)
+{
+	struct dpu_encoder_virt *dpu_enc = NULL;
+	struct drm_crtc *crtc;
+	struct drm_crtc_state *old_state = NULL;
+	int i = 0;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	DPU_DEBUG_ENC(dpu_enc, "\n");
+
+	crtc = drm_atomic_get_old_crtc_for_encoder(state, drm_enc);
+	if (crtc)
+		old_state = drm_atomic_get_old_crtc_state(state, crtc);
+
+	/*
+	 * The encoder is already disabled if self refresh mode was set earlier,
+	 * in the old_state for the corresponding crtc.
+	 */
+	if (old_state && old_state->self_refresh_active)
+		return;
+
+	mutex_lock(&dpu_enc->enc_lock);
+	dpu_enc->enabled = false;
+
+	trace_dpu_enc_disable(DRMID(drm_enc));
+
+	/* wait for idle */
+	dpu_encoder_wait_for_tx_complete(drm_enc);
+
+	dpu_encoder_resource_control(drm_enc, DPU_ENC_RC_EVENT_PRE_STOP);
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->ops.disable)
+			phys->ops.disable(phys);
+	}
+
+
+	/* after phys waits for frame-done, should be no more frames pending */
+	if (atomic_xchg(&dpu_enc->frame_done_timeout_ms, 0)) {
+		DPU_ERROR("enc%d timeout pending\n", drm_enc->base.id);
+		del_timer_sync(&dpu_enc->frame_done_timer);
+	}
+
+	dpu_encoder_resource_control(drm_enc, DPU_ENC_RC_EVENT_STOP);
+
+	dpu_enc->connector = NULL;
+
+	DPU_DEBUG_ENC(dpu_enc, "encoder disabled\n");
+
+	mutex_unlock(&dpu_enc->enc_lock);
+}
+
+static struct dpu_hw_intf *dpu_encoder_get_intf(const struct dpu_mdss_cfg *catalog,
+		struct dpu_rm *dpu_rm,
+		enum dpu_intf_type type, u32 controller_id)
+{
+	int i = 0;
+
+	if (type == INTF_WB)
+		return NULL;
+
+	for (i = 0; i < catalog->intf_count; i++) {
+		if (catalog->intf[i].type == type
+		    && catalog->intf[i].controller_id == controller_id) {
+			return dpu_rm_get_intf(dpu_rm, catalog->intf[i].id);
+		}
+	}
+
+	return NULL;
+}
+
+void dpu_encoder_vblank_callback(struct drm_encoder *drm_enc,
+		struct dpu_encoder_phys *phy_enc)
+{
+	struct dpu_encoder_virt *dpu_enc = NULL;
+	unsigned long lock_flags;
+
+	if (!drm_enc || !phy_enc)
+		return;
+
+	DPU_ATRACE_BEGIN("encoder_vblank_callback");
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	atomic_inc(&phy_enc->vsync_cnt);
+
+	spin_lock_irqsave(&dpu_enc->enc_spinlock, lock_flags);
+	if (dpu_enc->crtc)
+		dpu_crtc_vblank_callback(dpu_enc->crtc);
+	spin_unlock_irqrestore(&dpu_enc->enc_spinlock, lock_flags);
+
+	DPU_ATRACE_END("encoder_vblank_callback");
+}
+
+void dpu_encoder_underrun_callback(struct drm_encoder *drm_enc,
+		struct dpu_encoder_phys *phy_enc)
+{
+	if (!phy_enc)
+		return;
+
+	DPU_ATRACE_BEGIN("encoder_underrun_callback");
+	atomic_inc(&phy_enc->underrun_cnt);
+
+	/* trigger dump only on the first underrun */
+	if (atomic_read(&phy_enc->underrun_cnt) == 1)
+		msm_disp_snapshot_state(drm_enc->dev);
+
+	trace_dpu_enc_underrun_cb(DRMID(drm_enc),
+				  atomic_read(&phy_enc->underrun_cnt));
+	DPU_ATRACE_END("encoder_underrun_callback");
+}
+
+void dpu_encoder_assign_crtc(struct drm_encoder *drm_enc, struct drm_crtc *crtc)
+{
+	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
+	unsigned long lock_flags;
+
+	spin_lock_irqsave(&dpu_enc->enc_spinlock, lock_flags);
+	/* crtc should always be cleared before re-assigning */
+	WARN_ON(crtc && dpu_enc->crtc);
+	dpu_enc->crtc = crtc;
+	spin_unlock_irqrestore(&dpu_enc->enc_spinlock, lock_flags);
+}
+
+void dpu_encoder_toggle_vblank_for_crtc(struct drm_encoder *drm_enc,
+					struct drm_crtc *crtc, bool enable)
+{
+	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
+	unsigned long lock_flags;
+	int i;
+
+	trace_dpu_enc_vblank_cb(DRMID(drm_enc), enable);
+
+	spin_lock_irqsave(&dpu_enc->enc_spinlock, lock_flags);
+	if (dpu_enc->crtc != crtc) {
+		spin_unlock_irqrestore(&dpu_enc->enc_spinlock, lock_flags);
+		return;
+	}
+	spin_unlock_irqrestore(&dpu_enc->enc_spinlock, lock_flags);
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->ops.control_vblank_irq)
+			phys->ops.control_vblank_irq(phys, enable);
+	}
+}
+
+void dpu_encoder_frame_done_callback(
+		struct drm_encoder *drm_enc,
+		struct dpu_encoder_phys *ready_phys, u32 event)
+{
+	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
+	unsigned int i;
+
+	if (event & (DPU_ENCODER_FRAME_EVENT_DONE
+			| DPU_ENCODER_FRAME_EVENT_ERROR
+			| DPU_ENCODER_FRAME_EVENT_PANEL_DEAD)) {
+
+		if (!dpu_enc->frame_busy_mask[0]) {
+			/**
+			 * suppress frame_done without waiter,
+			 * likely autorefresh
+			 */
+			trace_dpu_enc_frame_done_cb_not_busy(DRMID(drm_enc), event,
+					dpu_encoder_helper_get_intf_type(ready_phys->intf_mode),
+					ready_phys->hw_intf ? ready_phys->hw_intf->idx : -1,
+					ready_phys->hw_wb ? ready_phys->hw_wb->idx : -1);
+			return;
+		}
+
+		/* One of the physical encoders has become idle */
+		for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+			if (dpu_enc->phys_encs[i] == ready_phys) {
+				trace_dpu_enc_frame_done_cb(DRMID(drm_enc), i,
+						dpu_enc->frame_busy_mask[0]);
+				clear_bit(i, dpu_enc->frame_busy_mask);
+			}
+		}
+
+		if (!dpu_enc->frame_busy_mask[0]) {
+			atomic_set(&dpu_enc->frame_done_timeout_ms, 0);
+			del_timer(&dpu_enc->frame_done_timer);
+
+			dpu_encoder_resource_control(drm_enc,
+					DPU_ENC_RC_EVENT_FRAME_DONE);
+
+			if (dpu_enc->crtc)
+				dpu_crtc_frame_event_cb(dpu_enc->crtc, event);
+		}
+	} else {
+		if (dpu_enc->crtc)
+			dpu_crtc_frame_event_cb(dpu_enc->crtc, event);
+	}
+}
+
+static void dpu_encoder_off_work(struct work_struct *work)
+{
+	struct dpu_encoder_virt *dpu_enc = container_of(work,
+			struct dpu_encoder_virt, delayed_off_work.work);
+
+	dpu_encoder_resource_control(&dpu_enc->base,
+						DPU_ENC_RC_EVENT_ENTER_IDLE);
+
+	dpu_encoder_frame_done_callback(&dpu_enc->base, NULL,
+				DPU_ENCODER_FRAME_EVENT_IDLE);
+}
+
+/**
+ * _dpu_encoder_trigger_flush - trigger flush for a physical encoder
+ * @drm_enc: Pointer to drm encoder structure
+ * @phys: Pointer to physical encoder structure
+ * @extra_flush_bits: Additional bit mask to include in flush trigger
+ */
+static void _dpu_encoder_trigger_flush(struct drm_encoder *drm_enc,
+		struct dpu_encoder_phys *phys, uint32_t extra_flush_bits)
+{
+	struct dpu_hw_ctl *ctl;
+	int pending_kickoff_cnt;
+	u32 ret = UINT_MAX;
+
+	if (!phys->hw_pp) {
+		DPU_ERROR("invalid pingpong hw\n");
+		return;
+	}
+
+	ctl = phys->hw_ctl;
+	if (!ctl->ops.trigger_flush) {
+		DPU_ERROR("missing trigger cb\n");
+		return;
+	}
+
+	pending_kickoff_cnt = dpu_encoder_phys_inc_pending(phys);
+
+	if (extra_flush_bits && ctl->ops.update_pending_flush)
+		ctl->ops.update_pending_flush(ctl, extra_flush_bits);
+
+	ctl->ops.trigger_flush(ctl);
+
+	if (ctl->ops.get_pending_flush)
+		ret = ctl->ops.get_pending_flush(ctl);
+
+	trace_dpu_enc_trigger_flush(DRMID(drm_enc),
+			dpu_encoder_helper_get_intf_type(phys->intf_mode),
+			phys->hw_intf ? phys->hw_intf->idx : -1,
+			phys->hw_wb ? phys->hw_wb->idx : -1,
+			pending_kickoff_cnt, ctl->idx,
+			extra_flush_bits, ret);
+}
+
+/**
+ * _dpu_encoder_trigger_start - trigger start for a physical encoder
+ * @phys: Pointer to physical encoder structure
+ */
+static void _dpu_encoder_trigger_start(struct dpu_encoder_phys *phys)
+{
+	if (!phys) {
+		DPU_ERROR("invalid argument(s)\n");
+		return;
+	}
+
+	if (!phys->hw_pp) {
+		DPU_ERROR("invalid pingpong hw\n");
+		return;
+	}
+
+	if (phys->ops.trigger_start && phys->enable_state != DPU_ENC_DISABLED)
+		phys->ops.trigger_start(phys);
+}
+
+void dpu_encoder_helper_trigger_start(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_ctl *ctl;
+
+	ctl = phys_enc->hw_ctl;
+	if (ctl->ops.trigger_start) {
+		ctl->ops.trigger_start(ctl);
+		trace_dpu_enc_trigger_start(DRMID(phys_enc->parent), ctl->idx);
+	}
+}
+
+static int dpu_encoder_helper_wait_event_timeout(
+		int32_t drm_id,
+		unsigned int irq_idx,
+		struct dpu_encoder_wait_info *info)
+{
+	int rc = 0;
+	s64 expected_time = ktime_to_ms(ktime_get()) + info->timeout_ms;
+	s64 jiffies = msecs_to_jiffies(info->timeout_ms);
+	s64 time;
+
+	do {
+		rc = wait_event_timeout(*(info->wq),
+				atomic_read(info->atomic_cnt) == 0, jiffies);
+		time = ktime_to_ms(ktime_get());
+
+		trace_dpu_enc_wait_event_timeout(drm_id,
+						 DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx),
+						 rc, time,
+						 expected_time,
+						 atomic_read(info->atomic_cnt));
+	/* If we timed out, counter is valid and time is less, wait again */
+	} while (atomic_read(info->atomic_cnt) && (rc == 0) &&
+			(time < expected_time));
+
+	return rc;
+}
+
+static void dpu_encoder_helper_hw_reset(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	struct dpu_hw_ctl *ctl;
+	int rc;
+	struct drm_encoder *drm_enc;
+
+	dpu_enc = to_dpu_encoder_virt(phys_enc->parent);
+	ctl = phys_enc->hw_ctl;
+	drm_enc = phys_enc->parent;
+
+	if (!ctl->ops.reset)
+		return;
+
+	DRM_DEBUG_KMS("id:%u ctl %d reset\n", DRMID(drm_enc),
+		      ctl->idx);
+
+	rc = ctl->ops.reset(ctl);
+	if (rc) {
+		DPU_ERROR_ENC(dpu_enc, "ctl %d reset failure\n",  ctl->idx);
+		msm_disp_snapshot_state(drm_enc->dev);
+	}
+
+	phys_enc->enable_state = DPU_ENC_ENABLED;
+}
+
+/**
+ * _dpu_encoder_kickoff_phys - handle physical encoder kickoff
+ *	Iterate through the physical encoders and perform consolidated flush
+ *	and/or control start triggering as needed. This is done in the virtual
+ *	encoder rather than the individual physical ones in order to handle
+ *	use cases that require visibility into multiple physical encoders at
+ *	a time.
+ * @dpu_enc: Pointer to virtual encoder structure
+ */
+static void _dpu_encoder_kickoff_phys(struct dpu_encoder_virt *dpu_enc)
+{
+	struct dpu_hw_ctl *ctl;
+	uint32_t i, pending_flush;
+	unsigned long lock_flags;
+
+	pending_flush = 0x0;
+
+	/* update pending counts and trigger kickoff ctl flush atomically */
+	spin_lock_irqsave(&dpu_enc->enc_spinlock, lock_flags);
+
+	/* don't perform flush/start operations for slave encoders */
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->enable_state == DPU_ENC_DISABLED)
+			continue;
+
+		ctl = phys->hw_ctl;
+
+		/*
+		 * This is cleared in frame_done worker, which isn't invoked
+		 * for async commits. So don't set this for async, since it'll
+		 * roll over to the next commit.
+		 */
+		if (phys->split_role != ENC_ROLE_SLAVE)
+			set_bit(i, dpu_enc->frame_busy_mask);
+
+		if (!phys->ops.needs_single_flush ||
+				!phys->ops.needs_single_flush(phys))
+			_dpu_encoder_trigger_flush(&dpu_enc->base, phys, 0x0);
+		else if (ctl->ops.get_pending_flush)
+			pending_flush |= ctl->ops.get_pending_flush(ctl);
+	}
+
+	/* for split flush, combine pending flush masks and send to master */
+	if (pending_flush && dpu_enc->cur_master) {
+		_dpu_encoder_trigger_flush(
+				&dpu_enc->base,
+				dpu_enc->cur_master,
+				pending_flush);
+	}
+
+	_dpu_encoder_trigger_start(dpu_enc->cur_master);
+
+	spin_unlock_irqrestore(&dpu_enc->enc_spinlock, lock_flags);
+}
+
+void dpu_encoder_trigger_kickoff_pending(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	struct dpu_encoder_phys *phys;
+	unsigned int i;
+	struct dpu_hw_ctl *ctl;
+	struct msm_display_info *disp_info;
+
+	if (!drm_enc) {
+		DPU_ERROR("invalid encoder\n");
+		return;
+	}
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	disp_info = &dpu_enc->disp_info;
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		phys = dpu_enc->phys_encs[i];
+
+		ctl = phys->hw_ctl;
+		ctl->ops.clear_pending_flush(ctl);
+
+		/* update only for command mode primary ctl */
+		if ((phys == dpu_enc->cur_master) &&
+		    disp_info->is_cmd_mode
+		    && ctl->ops.trigger_pending)
+			ctl->ops.trigger_pending(ctl);
+	}
+}
+
+static u32 _dpu_encoder_calculate_linetime(struct dpu_encoder_virt *dpu_enc,
+		struct drm_display_mode *mode)
+{
+	u64 pclk_rate;
+	u32 pclk_period;
+	u32 line_time;
+
+	/*
+	 * For linetime calculation, only operate on master encoder.
+	 */
+	if (!dpu_enc->cur_master)
+		return 0;
+
+	if (!dpu_enc->cur_master->ops.get_line_count) {
+		DPU_ERROR("get_line_count function not defined\n");
+		return 0;
+	}
+
+	pclk_rate = mode->clock; /* pixel clock in kHz */
+	if (pclk_rate == 0) {
+		DPU_ERROR("pclk is 0, cannot calculate line time\n");
+		return 0;
+	}
+
+	pclk_period = DIV_ROUND_UP_ULL(1000000000ull, pclk_rate);
+	if (pclk_period == 0) {
+		DPU_ERROR("pclk period is 0\n");
+		return 0;
+	}
+
+	/*
+	 * Line time calculation based on Pixel clock and HTOTAL.
+	 * Final unit is in ns.
+	 */
+	line_time = (pclk_period * mode->htotal) / 1000;
+	if (line_time == 0) {
+		DPU_ERROR("line time calculation is 0\n");
+		return 0;
+	}
+
+	DPU_DEBUG_ENC(dpu_enc,
+			"clk_rate=%lldkHz, clk_period=%d, linetime=%dns\n",
+			pclk_rate, pclk_period, line_time);
+
+	return line_time;
+}
+
+int dpu_encoder_vsync_time(struct drm_encoder *drm_enc, ktime_t *wakeup_time)
+{
+	struct drm_display_mode *mode;
+	struct dpu_encoder_virt *dpu_enc;
+	u32 cur_line;
+	u32 line_time;
+	u32 vtotal, time_to_vsync;
+	ktime_t cur_time;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	if (!drm_enc->crtc || !drm_enc->crtc->state) {
+		DPU_ERROR("crtc/crtc state object is NULL\n");
+		return -EINVAL;
+	}
+	mode = &drm_enc->crtc->state->adjusted_mode;
+
+	line_time = _dpu_encoder_calculate_linetime(dpu_enc, mode);
+	if (!line_time)
+		return -EINVAL;
+
+	cur_line = dpu_enc->cur_master->ops.get_line_count(dpu_enc->cur_master);
+
+	vtotal = mode->vtotal;
+	if (cur_line >= vtotal)
+		time_to_vsync = line_time * vtotal;
+	else
+		time_to_vsync = line_time * (vtotal - cur_line);
+
+	if (time_to_vsync == 0) {
+		DPU_ERROR("time to vsync should not be zero, vtotal=%d\n",
+				vtotal);
+		return -EINVAL;
+	}
+
+	cur_time = ktime_get();
+	*wakeup_time = ktime_add_ns(cur_time, time_to_vsync);
+
+	DPU_DEBUG_ENC(dpu_enc,
+			"cur_line=%u vtotal=%u time_to_vsync=%u, cur_time=%lld, wakeup_time=%lld\n",
+			cur_line, vtotal, time_to_vsync,
+			ktime_to_ms(cur_time),
+			ktime_to_ms(*wakeup_time));
+	return 0;
+}
+
+static u32
+dpu_encoder_dsc_initial_line_calc(struct drm_dsc_config *dsc,
+				  u32 enc_ip_width)
+{
+	int ssm_delay, total_pixels, soft_slice_per_enc;
+
+	soft_slice_per_enc = enc_ip_width / dsc->slice_width;
+
+	/*
+	 * minimum number of initial line pixels is a sum of:
+	 * 1. sub-stream multiplexer delay (83 groups for 8bpc,
+	 *    91 for 10 bpc) * 3
+	 * 2. for two soft slice cases, add extra sub-stream multiplexer * 3
+	 * 3. the initial xmit delay
+	 * 4. total pipeline delay through the "lock step" of encoder (47)
+	 * 5. 6 additional pixels as the output of the rate buffer is
+	 *    48 bits wide
+	 */
+	ssm_delay = ((dsc->bits_per_component < 10) ? 84 : 92);
+	total_pixels = ssm_delay * 3 + dsc->initial_xmit_delay + 47;
+	if (soft_slice_per_enc > 1)
+		total_pixels += (ssm_delay * 3);
+	return DIV_ROUND_UP(total_pixels, dsc->slice_width);
+}
+
+static void dpu_encoder_dsc_pipe_cfg(struct dpu_hw_ctl *ctl,
+				     struct dpu_hw_dsc *hw_dsc,
+				     struct dpu_hw_pingpong *hw_pp,
+				     struct drm_dsc_config *dsc,
+				     u32 common_mode,
+				     u32 initial_lines)
+{
+	if (hw_dsc->ops.dsc_config)
+		hw_dsc->ops.dsc_config(hw_dsc, dsc, common_mode, initial_lines);
+
+	if (hw_dsc->ops.dsc_config_thresh)
+		hw_dsc->ops.dsc_config_thresh(hw_dsc, dsc);
+
+	if (hw_pp->ops.setup_dsc)
+		hw_pp->ops.setup_dsc(hw_pp);
+
+	if (hw_dsc->ops.dsc_bind_pingpong_blk)
+		hw_dsc->ops.dsc_bind_pingpong_blk(hw_dsc, hw_pp->idx);
+
+	if (hw_pp->ops.enable_dsc)
+		hw_pp->ops.enable_dsc(hw_pp);
+
+	if (ctl->ops.update_pending_flush_dsc)
+		ctl->ops.update_pending_flush_dsc(ctl, hw_dsc->idx);
+}
+
+static void dpu_encoder_prep_dsc(struct dpu_encoder_virt *dpu_enc,
+				 struct drm_dsc_config *dsc)
+{
+	/* coding only for 2LM, 2enc, 1 dsc config */
+	struct dpu_encoder_phys *enc_master = dpu_enc->cur_master;
+	struct dpu_hw_ctl *ctl = enc_master->hw_ctl;
+	struct dpu_hw_dsc *hw_dsc[MAX_CHANNELS_PER_ENC];
+	struct dpu_hw_pingpong *hw_pp[MAX_CHANNELS_PER_ENC];
+	int this_frame_slices;
+	int intf_ip_w, enc_ip_w;
+	int dsc_common_mode;
+	int pic_width;
+	u32 initial_lines;
+	int i;
+
+	for (i = 0; i < MAX_CHANNELS_PER_ENC; i++) {
+		hw_pp[i] = dpu_enc->hw_pp[i];
+		hw_dsc[i] = dpu_enc->hw_dsc[i];
+
+		if (!hw_pp[i] || !hw_dsc[i]) {
+			DPU_ERROR_ENC(dpu_enc, "invalid params for DSC\n");
+			return;
+		}
+	}
+
+	dsc_common_mode = 0;
+	pic_width = dsc->pic_width;
+
+	dsc_common_mode = DSC_MODE_SPLIT_PANEL;
+	if (dpu_encoder_use_dsc_merge(enc_master->parent))
+		dsc_common_mode |= DSC_MODE_MULTIPLEX;
+	if (enc_master->intf_mode == INTF_MODE_VIDEO)
+		dsc_common_mode |= DSC_MODE_VIDEO;
+
+	this_frame_slices = pic_width / dsc->slice_width;
+	intf_ip_w = this_frame_slices * dsc->slice_width;
+
+	/*
+	 * dsc merge case: when using 2 encoders for the same stream,
+	 * no. of slices need to be same on both the encoders.
+	 */
+	enc_ip_w = intf_ip_w / 2;
+	initial_lines = dpu_encoder_dsc_initial_line_calc(dsc, enc_ip_w);
+
+	for (i = 0; i < MAX_CHANNELS_PER_ENC; i++)
+		dpu_encoder_dsc_pipe_cfg(ctl, hw_dsc[i], hw_pp[i],
+					 dsc, dsc_common_mode, initial_lines);
+}
+
+void dpu_encoder_prepare_for_kickoff(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	struct dpu_encoder_phys *phys;
+	bool needs_hw_reset = false;
+	unsigned int i;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	trace_dpu_enc_prepare_kickoff(DRMID(drm_enc));
+
+	/* prepare for next kickoff, may include waiting on previous kickoff */
+	DPU_ATRACE_BEGIN("enc_prepare_for_kickoff");
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		phys = dpu_enc->phys_encs[i];
+		if (phys->ops.prepare_for_kickoff)
+			phys->ops.prepare_for_kickoff(phys);
+		if (phys->enable_state == DPU_ENC_ERR_NEEDS_HW_RESET)
+			needs_hw_reset = true;
+	}
+	DPU_ATRACE_END("enc_prepare_for_kickoff");
+
+	dpu_encoder_resource_control(drm_enc, DPU_ENC_RC_EVENT_KICKOFF);
+
+	/* if any phys needs reset, reset all phys, in-order */
+	if (needs_hw_reset) {
+		trace_dpu_enc_prepare_kickoff_reset(DRMID(drm_enc));
+		for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+			dpu_encoder_helper_hw_reset(dpu_enc->phys_encs[i]);
+		}
+	}
+
+	if (dpu_enc->dsc)
+		dpu_encoder_prep_dsc(dpu_enc, dpu_enc->dsc);
+}
+
+bool dpu_encoder_is_valid_for_commit(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	unsigned int i;
+	struct dpu_encoder_phys *phys;
+
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	if (drm_enc->encoder_type == DRM_MODE_ENCODER_VIRTUAL) {
+		for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+			phys = dpu_enc->phys_encs[i];
+			if (phys->ops.is_valid_for_commit && !phys->ops.is_valid_for_commit(phys)) {
+				DPU_DEBUG("invalid FB not kicking off\n");
+				return false;
+			}
+		}
+	}
+
+	return true;
+}
+
+void dpu_encoder_kickoff(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc;
+	struct dpu_encoder_phys *phys;
+	unsigned long timeout_ms;
+	unsigned int i;
+
+	DPU_ATRACE_BEGIN("encoder_kickoff");
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+
+	trace_dpu_enc_kickoff(DRMID(drm_enc));
+
+	timeout_ms = DPU_ENCODER_FRAME_DONE_TIMEOUT_FRAMES * 1000 /
+			drm_mode_vrefresh(&drm_enc->crtc->state->adjusted_mode);
+
+	atomic_set(&dpu_enc->frame_done_timeout_ms, timeout_ms);
+	mod_timer(&dpu_enc->frame_done_timer,
+			jiffies + msecs_to_jiffies(timeout_ms));
+
+	/* All phys encs are ready to go, trigger the kickoff */
+	_dpu_encoder_kickoff_phys(dpu_enc);
+
+	/* allow phys encs to handle any post-kickoff business */
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		phys = dpu_enc->phys_encs[i];
+		if (phys->ops.handle_post_kickoff)
+			phys->ops.handle_post_kickoff(phys);
+	}
+
+	DPU_ATRACE_END("encoder_kickoff");
+}
+
+static void dpu_encoder_helper_reset_mixers(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_mixer_cfg mixer;
+	int i, num_lm;
+	struct dpu_global_state *global_state;
+	struct dpu_hw_blk *hw_lm[2];
+	struct dpu_hw_mixer *hw_mixer[2];
+	struct dpu_hw_ctl *ctl = phys_enc->hw_ctl;
+
+	memset(&mixer, 0, sizeof(mixer));
+
+	/* reset all mixers for this encoder */
+	if (phys_enc->hw_ctl->ops.clear_all_blendstages)
+		phys_enc->hw_ctl->ops.clear_all_blendstages(phys_enc->hw_ctl);
+
+	global_state = dpu_kms_get_existing_global_state(phys_enc->dpu_kms);
+
+	num_lm = dpu_rm_get_assigned_resources(&phys_enc->dpu_kms->rm, global_state,
+		phys_enc->parent->base.id, DPU_HW_BLK_LM, hw_lm, ARRAY_SIZE(hw_lm));
+
+	for (i = 0; i < num_lm; i++) {
+		hw_mixer[i] = to_dpu_hw_mixer(hw_lm[i]);
+		if (phys_enc->hw_ctl->ops.update_pending_flush_mixer)
+			phys_enc->hw_ctl->ops.update_pending_flush_mixer(ctl, hw_mixer[i]->idx);
+
+		/* clear all blendstages */
+		if (phys_enc->hw_ctl->ops.setup_blendstage)
+			phys_enc->hw_ctl->ops.setup_blendstage(ctl, hw_mixer[i]->idx, NULL);
+	}
+}
+
+static void dpu_encoder_dsc_pipe_clr(struct dpu_hw_ctl *ctl,
+				     struct dpu_hw_dsc *hw_dsc,
+				     struct dpu_hw_pingpong *hw_pp)
+{
+	if (hw_dsc->ops.dsc_disable)
+		hw_dsc->ops.dsc_disable(hw_dsc);
+
+	if (hw_pp->ops.disable_dsc)
+		hw_pp->ops.disable_dsc(hw_pp);
+
+	if (hw_dsc->ops.dsc_bind_pingpong_blk)
+		hw_dsc->ops.dsc_bind_pingpong_blk(hw_dsc, PINGPONG_NONE);
+
+	if (ctl->ops.update_pending_flush_dsc)
+		ctl->ops.update_pending_flush_dsc(ctl, hw_dsc->idx);
+}
+
+static void dpu_encoder_unprep_dsc(struct dpu_encoder_virt *dpu_enc)
+{
+	/* coding only for 2LM, 2enc, 1 dsc config */
+	struct dpu_encoder_phys *enc_master = dpu_enc->cur_master;
+	struct dpu_hw_ctl *ctl = enc_master->hw_ctl;
+	struct dpu_hw_dsc *hw_dsc[MAX_CHANNELS_PER_ENC];
+	struct dpu_hw_pingpong *hw_pp[MAX_CHANNELS_PER_ENC];
+	int i;
+
+	for (i = 0; i < MAX_CHANNELS_PER_ENC; i++) {
+		hw_pp[i] = dpu_enc->hw_pp[i];
+		hw_dsc[i] = dpu_enc->hw_dsc[i];
+
+		if (hw_pp[i] && hw_dsc[i])
+			dpu_encoder_dsc_pipe_clr(ctl, hw_dsc[i], hw_pp[i]);
+	}
+}
+
+void dpu_encoder_helper_phys_cleanup(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_ctl *ctl = phys_enc->hw_ctl;
+	struct dpu_hw_intf_cfg intf_cfg = { 0 };
+	int i;
+	struct dpu_encoder_virt *dpu_enc;
+
+	dpu_enc = to_dpu_encoder_virt(phys_enc->parent);
+
+	phys_enc->hw_ctl->ops.reset(ctl);
+
+	dpu_encoder_helper_reset_mixers(phys_enc);
+
+	/*
+	 * TODO: move the once-only operation like CTL flush/trigger
+	 * into dpu_encoder_virt_disable() and all operations which need
+	 * to be done per phys encoder into the phys_disable() op.
+	 */
+	if (phys_enc->hw_wb) {
+		/* disable the PP block */
+		if (phys_enc->hw_wb->ops.bind_pingpong_blk)
+			phys_enc->hw_wb->ops.bind_pingpong_blk(phys_enc->hw_wb, PINGPONG_NONE);
+
+		/* mark WB flush as pending */
+		if (phys_enc->hw_ctl->ops.update_pending_flush_wb)
+			phys_enc->hw_ctl->ops.update_pending_flush_wb(ctl, phys_enc->hw_wb->idx);
+	} else {
+		for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+			if (dpu_enc->phys_encs[i] && phys_enc->hw_intf->ops.bind_pingpong_blk)
+				phys_enc->hw_intf->ops.bind_pingpong_blk(
+						dpu_enc->phys_encs[i]->hw_intf,
+						PINGPONG_NONE);
+
+			/* mark INTF flush as pending */
+			if (phys_enc->hw_ctl->ops.update_pending_flush_intf)
+				phys_enc->hw_ctl->ops.update_pending_flush_intf(phys_enc->hw_ctl,
+						dpu_enc->phys_encs[i]->hw_intf->idx);
+		}
+	}
+
+	/* reset the merge 3D HW block */
+	if (phys_enc->hw_pp && phys_enc->hw_pp->merge_3d) {
+		phys_enc->hw_pp->merge_3d->ops.setup_3d_mode(phys_enc->hw_pp->merge_3d,
+				BLEND_3D_NONE);
+		if (phys_enc->hw_ctl->ops.update_pending_flush_merge_3d)
+			phys_enc->hw_ctl->ops.update_pending_flush_merge_3d(ctl,
+					phys_enc->hw_pp->merge_3d->idx);
+	}
+
+	if (phys_enc->hw_cdm) {
+		if (phys_enc->hw_cdm->ops.bind_pingpong_blk && phys_enc->hw_pp)
+			phys_enc->hw_cdm->ops.bind_pingpong_blk(phys_enc->hw_cdm,
+								PINGPONG_NONE);
+		if (phys_enc->hw_ctl->ops.update_pending_flush_cdm)
+			phys_enc->hw_ctl->ops.update_pending_flush_cdm(phys_enc->hw_ctl,
+								       phys_enc->hw_cdm->idx);
+	}
+
+	if (dpu_enc->dsc) {
+		dpu_encoder_unprep_dsc(dpu_enc);
+		dpu_enc->dsc = NULL;
+	}
+
+	intf_cfg.stream_sel = 0; /* Don't care value for video mode */
+	intf_cfg.mode_3d = dpu_encoder_helper_get_3d_blend_mode(phys_enc);
+	intf_cfg.dsc = dpu_encoder_helper_get_dsc(phys_enc);
+
+	if (phys_enc->hw_intf)
+		intf_cfg.intf = phys_enc->hw_intf->idx;
+	if (phys_enc->hw_wb)
+		intf_cfg.wb = phys_enc->hw_wb->idx;
+
+	if (phys_enc->hw_pp && phys_enc->hw_pp->merge_3d)
+		intf_cfg.merge_3d = phys_enc->hw_pp->merge_3d->idx;
+
+	if (ctl->ops.reset_intf_cfg)
+		ctl->ops.reset_intf_cfg(ctl, &intf_cfg);
+
+	ctl->ops.trigger_flush(ctl);
+	ctl->ops.trigger_start(ctl);
+	ctl->ops.clear_pending_flush(ctl);
+}
+
+void dpu_encoder_helper_phys_setup_cdm(struct dpu_encoder_phys *phys_enc,
+				       const struct dpu_format *dpu_fmt,
+				       u32 output_type)
+{
+	struct dpu_hw_cdm *hw_cdm;
+	struct dpu_hw_cdm_cfg *cdm_cfg;
+	struct dpu_hw_pingpong *hw_pp;
+	int ret;
+
+	if (!phys_enc)
+		return;
+
+	cdm_cfg = &phys_enc->cdm_cfg;
+	hw_pp = phys_enc->hw_pp;
+	hw_cdm = phys_enc->hw_cdm;
+
+	if (!hw_cdm)
+		return;
+
+	if (!DPU_FORMAT_IS_YUV(dpu_fmt)) {
+		DPU_DEBUG("[enc:%d] cdm_disable fmt:%x\n", DRMID(phys_enc->parent),
+			  dpu_fmt->base.pixel_format);
+		if (hw_cdm->ops.bind_pingpong_blk)
+			hw_cdm->ops.bind_pingpong_blk(hw_cdm, PINGPONG_NONE);
+
+		return;
+	}
+
+	memset(cdm_cfg, 0, sizeof(struct dpu_hw_cdm_cfg));
+
+	cdm_cfg->output_width = phys_enc->cached_mode.hdisplay;
+	cdm_cfg->output_height = phys_enc->cached_mode.vdisplay;
+	cdm_cfg->output_fmt = dpu_fmt;
+	cdm_cfg->output_type = output_type;
+	cdm_cfg->output_bit_depth = DPU_FORMAT_IS_DX(dpu_fmt) ?
+			CDM_CDWN_OUTPUT_10BIT : CDM_CDWN_OUTPUT_8BIT;
+	cdm_cfg->csc_cfg = &dpu_csc10_rgb2yuv_601l;
+
+	/* enable 10 bit logic */
+	switch (cdm_cfg->output_fmt->chroma_sample) {
+	case DPU_CHROMA_RGB:
+		cdm_cfg->h_cdwn_type = CDM_CDWN_DISABLE;
+		cdm_cfg->v_cdwn_type = CDM_CDWN_DISABLE;
+		break;
+	case DPU_CHROMA_H2V1:
+		cdm_cfg->h_cdwn_type = CDM_CDWN_COSITE;
+		cdm_cfg->v_cdwn_type = CDM_CDWN_DISABLE;
+		break;
+	case DPU_CHROMA_420:
+		cdm_cfg->h_cdwn_type = CDM_CDWN_COSITE;
+		cdm_cfg->v_cdwn_type = CDM_CDWN_OFFSITE;
+		break;
+	case DPU_CHROMA_H1V2:
+	default:
+		DPU_ERROR("[enc:%d] unsupported chroma sampling type\n",
+			  DRMID(phys_enc->parent));
+		cdm_cfg->h_cdwn_type = CDM_CDWN_DISABLE;
+		cdm_cfg->v_cdwn_type = CDM_CDWN_DISABLE;
+		break;
+	}
+
+	DPU_DEBUG("[enc:%d] cdm_enable:%d,%d,%X,%d,%d,%d,%d]\n",
+		  DRMID(phys_enc->parent), cdm_cfg->output_width,
+		  cdm_cfg->output_height, cdm_cfg->output_fmt->base.pixel_format,
+		  cdm_cfg->output_type, cdm_cfg->output_bit_depth,
+		  cdm_cfg->h_cdwn_type, cdm_cfg->v_cdwn_type);
+
+	if (hw_cdm->ops.enable) {
+		cdm_cfg->pp_id = hw_pp->idx;
+		ret = hw_cdm->ops.enable(hw_cdm, cdm_cfg);
+		if (ret < 0) {
+			DPU_ERROR("[enc:%d] failed to enable CDM; ret:%d\n",
+				  DRMID(phys_enc->parent), ret);
+			return;
+		}
+	}
+}
+
+#ifdef CONFIG_DEBUG_FS
+static int _dpu_encoder_status_show(struct seq_file *s, void *data)
+{
+	struct drm_encoder *drm_enc = s->private;
+	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
+	int i;
+
+	mutex_lock(&dpu_enc->enc_lock);
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		seq_printf(s, "intf:%d  wb:%d  vsync:%8d     underrun:%8d    frame_done_cnt:%d",
+				phys->hw_intf ? phys->hw_intf->idx - INTF_0 : -1,
+				phys->hw_wb ? phys->hw_wb->idx - WB_0 : -1,
+				atomic_read(&phys->vsync_cnt),
+				atomic_read(&phys->underrun_cnt),
+				atomic_read(&dpu_enc->frame_done_timeout_cnt));
+
+		seq_printf(s, "mode: %s\n", dpu_encoder_helper_get_intf_type(phys->intf_mode));
+	}
+	mutex_unlock(&dpu_enc->enc_lock);
+
+	return 0;
+}
+
+DEFINE_SHOW_ATTRIBUTE(_dpu_encoder_status);
+
+static void dpu_encoder_debugfs_init(struct drm_encoder *drm_enc, struct dentry *root)
+{
+	/* don't error check these */
+	debugfs_create_file("status", 0600,
+			    root, drm_enc, &_dpu_encoder_status_fops);
+}
+#else
+#define dpu_encoder_debugfs_init NULL
+#endif
+
+static int dpu_encoder_virt_add_phys_encs(
+		struct drm_device *dev,
+		struct msm_display_info *disp_info,
+		struct dpu_encoder_virt *dpu_enc,
+		struct dpu_enc_phys_init_params *params)
+{
+	struct dpu_encoder_phys *enc = NULL;
+
+	DPU_DEBUG_ENC(dpu_enc, "\n");
+
+	/*
+	 * We may create up to NUM_PHYS_ENCODER_TYPES physical encoder types
+	 * in this function, check up-front.
+	 */
+	if (dpu_enc->num_phys_encs + NUM_PHYS_ENCODER_TYPES >=
+			ARRAY_SIZE(dpu_enc->phys_encs)) {
+		DPU_ERROR_ENC(dpu_enc, "too many physical encoders %d\n",
+			  dpu_enc->num_phys_encs);
+		return -EINVAL;
+	}
+
+
+	if (disp_info->intf_type == INTF_WB) {
+		enc = dpu_encoder_phys_wb_init(dev, params);
+
+		if (IS_ERR(enc)) {
+			DPU_ERROR_ENC(dpu_enc, "failed to init wb enc: %ld\n",
+				PTR_ERR(enc));
+			return PTR_ERR(enc);
+		}
+
+		dpu_enc->phys_encs[dpu_enc->num_phys_encs] = enc;
+		++dpu_enc->num_phys_encs;
+	} else if (disp_info->is_cmd_mode) {
+		enc = dpu_encoder_phys_cmd_init(dev, params);
+
+		if (IS_ERR(enc)) {
+			DPU_ERROR_ENC(dpu_enc, "failed to init cmd enc: %ld\n",
+				PTR_ERR(enc));
+			return PTR_ERR(enc);
+		}
+
+		dpu_enc->phys_encs[dpu_enc->num_phys_encs] = enc;
+		++dpu_enc->num_phys_encs;
+	} else {
+		enc = dpu_encoder_phys_vid_init(dev, params);
+
+		if (IS_ERR(enc)) {
+			DPU_ERROR_ENC(dpu_enc, "failed to init vid enc: %ld\n",
+				PTR_ERR(enc));
+			return PTR_ERR(enc);
+		}
+
+		dpu_enc->phys_encs[dpu_enc->num_phys_encs] = enc;
+		++dpu_enc->num_phys_encs;
+	}
+
+	if (params->split_role == ENC_ROLE_SLAVE)
+		dpu_enc->cur_slave = enc;
+	else
+		dpu_enc->cur_master = enc;
+
+	return 0;
+}
+
+static int dpu_encoder_setup_display(struct dpu_encoder_virt *dpu_enc,
+				 struct dpu_kms *dpu_kms,
+				 struct msm_display_info *disp_info,
+				 int drm_enc_mode)
+{
+	int ret = 0;
+	int i = 0;
+	struct dpu_enc_phys_init_params phys_params;
+	unsigned int intf_id;
+	struct msm_drm_private *priv;
+	struct drm_encoder *drm_enc;
+
+	if (!dpu_enc) {
+		DPU_ERROR("invalid arg(s), enc %d\n", dpu_enc != NULL);
+		return -EINVAL;
+	}
+
+	drm_enc = &dpu_enc->base;
+	priv = drm_enc->dev->dev_private;
+	dpu_enc->cur_master = NULL;
+
+	memset(&phys_params, 0, sizeof(phys_params));
+	phys_params.dpu_kms = dpu_kms;
+	phys_params.parent = &dpu_enc->base;
+	phys_params.enc_spinlock = &dpu_enc->enc_spinlock;
+
+	WARN_ON(disp_info->num_of_h_tiles < 1);
+
+	DPU_DEBUG("dsi_info->num_of_h_tiles %d\n", disp_info->num_of_h_tiles);
+
+	if (disp_info->intf_type != INTF_WB)
+		dpu_enc->idle_pc_supported =
+				dpu_kms->catalog->caps->has_idle_pc;
+
+	mutex_lock(&dpu_enc->enc_lock);
+	for (i = 0; i < disp_info->num_of_h_tiles && !ret; i++) {
+		/*
+		 * Left-most tile is at index 0, content is controller id
+		 * h_tile_instance_ids[2] = {0, 1}; DSI0 = left, DSI1 = right
+		 * h_tile_instance_ids[2] = {1, 0}; DSI1 = left, DSI0 = right
+		 */
+		u32 controller_id = disp_info->h_tile_instance[i];
+
+		if (disp_info->num_of_h_tiles > 1) {
+			if (i == 0)
+				phys_params.split_role = ENC_ROLE_MASTER;
+			else
+				phys_params.split_role = ENC_ROLE_SLAVE;
+		} else {
+			phys_params.split_role = ENC_ROLE_SOLO;
+		}
+
+		DPU_DEBUG("h_tile_instance %d = %d, split_role %d\n",
+				i, controller_id, phys_params.split_role);
+
+		if (drm_enc_mode == DRM_MODE_ENCODER_DPMST) {
+			intf_id = msm_dp_get_mst_intf_id(priv->dp[controller_id],
+							 disp_info->stream_id);
+			DPU_DEBUG("intf_id %d for disp_info->stream_id = %d\n", intf_id,
+				  disp_info->stream_id);
+			phys_params.hw_intf = dpu_rm_get_intf(&dpu_kms->rm, intf_id);
+
+		} else {
+			phys_params.hw_intf = dpu_encoder_get_intf(dpu_kms->catalog, &dpu_kms->rm,
+								   disp_info->intf_type,
+								   controller_id);
+		}
+
+		if (disp_info->intf_type == INTF_WB && controller_id < WB_MAX)
+			phys_params.hw_wb = dpu_rm_get_wb(&dpu_kms->rm, controller_id);
+
+		if (!phys_params.hw_intf && !phys_params.hw_wb) {
+			DPU_ERROR_ENC(dpu_enc, "no intf or wb block assigned at idx: %d\n", i);
+			ret = -EINVAL;
+			break;
+		}
+
+		if (phys_params.hw_intf && phys_params.hw_wb) {
+			DPU_ERROR_ENC(dpu_enc,
+					"invalid phys both intf and wb block at idx: %d\n", i);
+			ret = -EINVAL;
+			break;
+		}
+
+		ret = dpu_encoder_virt_add_phys_encs(dpu_kms->dev, disp_info,
+				dpu_enc, &phys_params);
+		if (ret) {
+			DPU_ERROR_ENC(dpu_enc, "failed to add phys encs\n");
+			break;
+		}
+	}
+
+	mutex_unlock(&dpu_enc->enc_lock);
+
+	return ret;
+}
+
+static void dpu_encoder_frame_done_timeout(struct timer_list *t)
+{
+	struct dpu_encoder_virt *dpu_enc = from_timer(dpu_enc, t,
+			frame_done_timer);
+	struct drm_encoder *drm_enc = &dpu_enc->base;
+	u32 event;
+
+	if (!drm_enc->dev) {
+		DPU_ERROR("invalid parameters\n");
+		return;
+	}
+
+	if (!dpu_enc->frame_busy_mask[0] || !dpu_enc->crtc) {
+		DRM_DEBUG_KMS("id:%u invalid timeout frame_busy_mask=%lu\n",
+			      DRMID(drm_enc), dpu_enc->frame_busy_mask[0]);
+		return;
+	} else if (!atomic_xchg(&dpu_enc->frame_done_timeout_ms, 0)) {
+		DRM_DEBUG_KMS("id:%u invalid timeout\n", DRMID(drm_enc));
+		return;
+	}
+
+	DPU_ERROR_ENC_RATELIMITED(dpu_enc, "frame done timeout\n");
+
+	if (atomic_inc_return(&dpu_enc->frame_done_timeout_cnt) == 1)
+		msm_disp_snapshot_state(drm_enc->dev);
+
+	event = DPU_ENCODER_FRAME_EVENT_ERROR;
+	trace_dpu_enc_frame_done_timeout(DRMID(drm_enc), event);
+	dpu_crtc_frame_event_cb(dpu_enc->crtc, event);
+}
+
+static const struct drm_encoder_helper_funcs dpu_encoder_helper_funcs = {
+	.atomic_mode_set = dpu_encoder_virt_atomic_mode_set,
+	.atomic_disable = dpu_encoder_virt_atomic_disable,
+	.atomic_enable = dpu_encoder_virt_atomic_enable,
+	.atomic_check = dpu_encoder_virt_atomic_check,
+};
+
+static const struct drm_encoder_funcs dpu_encoder_funcs = {
+	.debugfs_init = dpu_encoder_debugfs_init,
+};
+
+struct drm_encoder *dpu_encoder_init(struct drm_device *dev,
+		int drm_enc_mode,
+		struct msm_display_info *disp_info)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms);
+	struct dpu_encoder_virt *dpu_enc;
+	int ret;
+
+	dpu_enc = drmm_encoder_alloc(dev, struct dpu_encoder_virt, base,
+				     &dpu_encoder_funcs, drm_enc_mode, NULL);
+	if (IS_ERR(dpu_enc))
+		return ERR_CAST(dpu_enc);
+
+	drm_encoder_helper_add(&dpu_enc->base, &dpu_encoder_helper_funcs);
+
+	spin_lock_init(&dpu_enc->enc_spinlock);
+	dpu_enc->enabled = false;
+	mutex_init(&dpu_enc->enc_lock);
+	mutex_init(&dpu_enc->rc_lock);
+
+	ret = dpu_encoder_setup_display(dpu_enc, dpu_kms, disp_info, drm_enc_mode);
+	if (ret) {
+		DPU_ERROR("failed to setup encoder\n");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	atomic_set(&dpu_enc->frame_done_timeout_ms, 0);
+	atomic_set(&dpu_enc->frame_done_timeout_cnt, 0);
+	timer_setup(&dpu_enc->frame_done_timer,
+			dpu_encoder_frame_done_timeout, 0);
+
+	INIT_DELAYED_WORK(&dpu_enc->delayed_off_work,
+			dpu_encoder_off_work);
+	dpu_enc->idle_timeout = IDLE_TIMEOUT;
+
+	memcpy(&dpu_enc->disp_info, disp_info, sizeof(*disp_info));
+
+	DPU_DEBUG_ENC(dpu_enc, "created\n");
+
+	return &dpu_enc->base;
+}
+
+/**
+ * dpu_encoder_wait_for_commit_done() - Wait for encoder to flush pending state
+ * @drm_enc:	encoder pointer
+ *
+ * Wait for hardware to have flushed the current pending changes to hardware at
+ * a vblank or CTL_START. Physical encoders will map this differently depending
+ * on the type: vid mode -> vsync_irq, cmd mode -> CTL_START.
+ *
+ * Return: 0 on success, -EWOULDBLOCK if already signaled, error otherwise
+ */
+int dpu_encoder_wait_for_commit_done(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc = NULL;
+	int i, ret = 0;
+
+	if (!drm_enc) {
+		DPU_ERROR("invalid encoder\n");
+		return -EINVAL;
+	}
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	DPU_DEBUG_ENC(dpu_enc, "\n");
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->ops.wait_for_commit_done) {
+			DPU_ATRACE_BEGIN("wait_for_commit_done");
+			ret = phys->ops.wait_for_commit_done(phys);
+			DPU_ATRACE_END("wait_for_commit_done");
+			if (ret == -ETIMEDOUT && !dpu_enc->commit_done_timedout) {
+				dpu_enc->commit_done_timedout = true;
+				msm_disp_snapshot_state(drm_enc->dev);
+			}
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+/**
+ * dpu_encoder_wait_for_tx_complete() - Wait for encoder to transfer pixels to panel
+ * @drm_enc:	encoder pointer
+ *
+ * Wait for the hardware to transfer all the pixels to the panel. Physical
+ * encoders will map this differently depending on the type: vid mode -> vsync_irq,
+ * cmd mode -> pp_done.
+ *
+ * Return: 0 on success, -EWOULDBLOCK if already signaled, error otherwise
+ */
+int dpu_encoder_wait_for_tx_complete(struct drm_encoder *drm_enc)
+{
+	struct dpu_encoder_virt *dpu_enc = NULL;
+	int i, ret = 0;
+
+	if (!drm_enc) {
+		DPU_ERROR("invalid encoder\n");
+		return -EINVAL;
+	}
+	dpu_enc = to_dpu_encoder_virt(drm_enc);
+	DPU_DEBUG_ENC(dpu_enc, "\n");
+
+	for (i = 0; i < dpu_enc->num_phys_encs; i++) {
+		struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
+
+		if (phys->ops.wait_for_tx_complete) {
+			DPU_ATRACE_BEGIN("wait_for_tx_complete");
+			ret = phys->ops.wait_for_tx_complete(phys);
+			DPU_ATRACE_END("wait_for_tx_complete");
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+enum dpu_intf_mode dpu_encoder_get_intf_mode(struct drm_encoder *encoder)
+{
+	struct dpu_encoder_virt *dpu_enc = NULL;
+
+	if (!encoder) {
+		DPU_ERROR("invalid encoder\n");
+		return INTF_MODE_NONE;
+	}
+	dpu_enc = to_dpu_encoder_virt(encoder);
+
+	if (dpu_enc->cur_master)
+		return dpu_enc->cur_master->intf_mode;
+
+	if (dpu_enc->num_phys_encs)
+		return dpu_enc->phys_encs[0]->intf_mode;
+
+	return INTF_MODE_NONE;
+}
+
+unsigned int dpu_encoder_helper_get_dsc(struct dpu_encoder_phys *phys_enc)
+{
+	struct drm_encoder *encoder = phys_enc->parent;
+	struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(encoder);
+
+	return dpu_enc->dsc_mask;
+}
+
+void dpu_encoder_phys_init(struct dpu_encoder_phys *phys_enc,
+			  struct dpu_enc_phys_init_params *p)
+{
+	phys_enc->hw_mdptop = p->dpu_kms->hw_mdp;
+	phys_enc->hw_intf = p->hw_intf;
+	phys_enc->hw_wb = p->hw_wb;
+	phys_enc->parent = p->parent;
+	phys_enc->dpu_kms = p->dpu_kms;
+	phys_enc->split_role = p->split_role;
+	phys_enc->enc_spinlock = p->enc_spinlock;
+	phys_enc->enable_state = DPU_ENC_DISABLED;
+
+	atomic_set(&phys_enc->pending_kickoff_cnt, 0);
+	atomic_set(&phys_enc->pending_ctlstart_cnt, 0);
+
+	atomic_set(&phys_enc->vsync_cnt, 0);
+	atomic_set(&phys_enc->underrun_cnt, 0);
+
+	init_waitqueue_head(&phys_enc->pending_kickoff_wq);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder.h
@@ -0,0 +1,197 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __DPU_ENCODER_H__
+#define __DPU_ENCODER_H__
+
+#include <drm/drm_crtc.h>
+#include "dpu_hw_mdss.h"
+
+#define DPU_ENCODER_FRAME_EVENT_DONE			BIT(0)
+#define DPU_ENCODER_FRAME_EVENT_ERROR			BIT(1)
+#define DPU_ENCODER_FRAME_EVENT_PANEL_DEAD		BIT(2)
+#define DPU_ENCODER_FRAME_EVENT_IDLE			BIT(3)
+
+#define IDLE_TIMEOUT	(66 - 16/2)
+
+/**
+ * struct msm_display_info - defines display properties
+ * @intf_type:          INTF_ type
+ * @num_of_h_tiles:     Number of horizontal tiles in case of split interface
+ * @h_tile_instance:    Controller instance used per tile. Number of elements is
+ *                      based on num_of_h_tiles
+ * @is_cmd_mode		Boolean to indicate if the CMD mode is requested
+ * @stream_id		stream id for which the interface needs to be acquired
+ * @is_te_using_watchdog_timer:  Boolean to indicate watchdog TE is
+ *				 used instead of panel TE in cmd mode panels
+ */
+struct msm_display_info {
+	enum dpu_intf_type intf_type;
+	uint32_t num_of_h_tiles;
+	uint32_t h_tile_instance[MAX_H_TILES_PER_DISPLAY];
+	bool is_cmd_mode;
+	int stream_id;
+	bool is_te_using_watchdog_timer;
+};
+
+/**
+ * dpu_encoder_assign_crtc - Link the encoder to the crtc it's assigned to
+ * @encoder:	encoder pointer
+ * @crtc:	crtc pointer
+ */
+void dpu_encoder_assign_crtc(struct drm_encoder *encoder,
+			     struct drm_crtc *crtc);
+
+/**
+ * dpu_encoder_toggle_vblank_for_crtc - Toggles vblank interrupts on or off if
+ *	the encoder is assigned to the given crtc
+ * @encoder:	encoder pointer
+ * @crtc:	crtc pointer
+ * @enable:	true if vblank should be enabled
+ */
+void dpu_encoder_toggle_vblank_for_crtc(struct drm_encoder *encoder,
+					struct drm_crtc *crtc, bool enable);
+
+/**
+ * dpu_encoder_prepare_for_kickoff - schedule double buffer flip of the ctl
+ *	path (i.e. ctl flush and start) at next appropriate time.
+ *	Immediately: if no previous commit is outstanding.
+ *	Delayed: Block until next trigger can be issued.
+ * @encoder:	encoder pointer
+ */
+void dpu_encoder_prepare_for_kickoff(struct drm_encoder *encoder);
+
+/**
+ * dpu_encoder_trigger_kickoff_pending - Clear the flush bits from previous
+ *        kickoff and trigger the ctl prepare progress for command mode display.
+ * @encoder:	encoder pointer
+ */
+void dpu_encoder_trigger_kickoff_pending(struct drm_encoder *encoder);
+
+/**
+ * dpu_encoder_kickoff - trigger a double buffer flip of the ctl path
+ *	(i.e. ctl flush and start) immediately.
+ * @encoder:	encoder pointer
+ */
+void dpu_encoder_kickoff(struct drm_encoder *encoder);
+
+/**
+ * dpu_encoder_wakeup_time - get the time of the next vsync
+ */
+int dpu_encoder_vsync_time(struct drm_encoder *drm_enc, ktime_t *wakeup_time);
+
+int dpu_encoder_wait_for_commit_done(struct drm_encoder *drm_encoder);
+
+int dpu_encoder_wait_for_tx_complete(struct drm_encoder *drm_encoder);
+
+/*
+ * dpu_encoder_get_intf_mode - get interface mode of the given encoder
+ * @encoder: Pointer to drm encoder object
+ */
+enum dpu_intf_mode dpu_encoder_get_intf_mode(struct drm_encoder *encoder);
+
+/**
+ * dpu_encoder_virt_runtime_resume - pm runtime resume the encoder configs
+ * @encoder:	encoder pointer
+ */
+void dpu_encoder_virt_runtime_resume(struct drm_encoder *encoder);
+
+/**
+ * dpu_encoder_init - initialize virtual encoder object
+ * @dev:        Pointer to drm device structure
+ * @drm_enc_mode: corresponding DRM_MODE_ENCODER_* constant
+ * @disp_info:  Pointer to display information structure
+ * Returns:     Pointer to newly created drm encoder
+ */
+struct drm_encoder *dpu_encoder_init(struct drm_device *dev,
+		int drm_enc_mode,
+		struct msm_display_info *disp_info);
+
+/**
+ * dpu_encoder_set_idle_timeout - set the idle timeout for video
+ *                    and command mode encoders.
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ * @idle_timeout:    idle timeout duration in milliseconds
+ */
+void dpu_encoder_set_idle_timeout(struct drm_encoder *drm_enc,
+							u32 idle_timeout);
+/**
+ * dpu_encoder_get_linecount - get interface line count for the encoder.
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ */
+int dpu_encoder_get_linecount(struct drm_encoder *drm_enc);
+
+/**
+ * dpu_encoder_get_vsync_count - get vsync count for the encoder.
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ */
+int dpu_encoder_get_vsync_count(struct drm_encoder *drm_enc);
+
+/**
+ * dpu_encoder_is_widebus_enabled - return bool value if widebus is enabled
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ */
+bool dpu_encoder_is_widebus_enabled(const struct drm_encoder *drm_enc);
+
+/**
+ * dpu_encoder_is_dsc_enabled - indicate whether dsc is enabled
+ *				for the encoder.
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ */
+bool dpu_encoder_is_dsc_enabled(const struct drm_encoder *drm_enc);
+
+/**
+ * dpu_encoder_get_crc_values_cnt - get number of physical encoders contained
+ *	in virtual encoder that can collect CRC values
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ * Returns:     Number of physical encoders for given drm encoder
+ */
+int dpu_encoder_get_crc_values_cnt(const struct drm_encoder *drm_enc);
+
+/**
+ * dpu_encoder_setup_misr - enable misr calculations
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ */
+void dpu_encoder_setup_misr(const struct drm_encoder *drm_encoder);
+
+/**
+ * dpu_encoder_get_crc - get the crc value from interface blocks
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ * Returns:     0 on success, error otherwise
+ */
+int dpu_encoder_get_crc(const struct drm_encoder *drm_enc, u32 *crcs, int pos);
+
+/**
+ * dpu_encoder_use_dsc_merge - returns true if the encoder uses DSC merge topology.
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ */
+bool dpu_encoder_use_dsc_merge(struct drm_encoder *drm_enc);
+
+/**
+ * dpu_encoder_prepare_wb_job - prepare writeback job for the encoder.
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ * @job:        Pointer to the current drm writeback job
+ */
+void dpu_encoder_prepare_wb_job(struct drm_encoder *drm_enc,
+		struct drm_writeback_job *job);
+
+/**
+ * dpu_encoder_cleanup_wb_job - cleanup writeback job for the encoder.
+ * @drm_enc:    Pointer to previously created drm encoder structure
+ * @job:        Pointer to the current drm writeback job
+ */
+void dpu_encoder_cleanup_wb_job(struct drm_encoder *drm_enc,
+		struct drm_writeback_job *job);
+
+/**
+ * dpu_encoder_is_valid_for_commit - check if encode has valid parameters for commit.
+ * @drm_enc:    Pointer to drm encoder structure
+ */
+bool dpu_encoder_is_valid_for_commit(struct drm_encoder *drm_enc);
+
+#endif /* __DPU_ENCODER_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder_phys.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder_phys.h
@@ -0,0 +1,435 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __DPU_ENCODER_PHYS_H__
+#define __DPU_ENCODER_PHYS_H__
+
+#include <drm/drm_writeback.h>
+#include <linux/jiffies.h>
+
+#include "dpu_kms.h"
+#include "dpu_hw_intf.h"
+#include "dpu_hw_wb.h"
+#include "dpu_hw_pingpong.h"
+#include "dpu_hw_cdm.h"
+#include "dpu_hw_ctl.h"
+#include "dpu_hw_top.h"
+#include "dpu_hw_util.h"
+#include "dpu_encoder.h"
+#include "dpu_crtc.h"
+
+#define DPU_ENCODER_NAME_MAX	16
+
+/* wait for at most 2 vsync for lowest refresh rate (24hz) */
+#define KICKOFF_TIMEOUT_MS		84
+#define KICKOFF_TIMEOUT_JIFFIES		msecs_to_jiffies(KICKOFF_TIMEOUT_MS)
+
+/**
+ * enum dpu_enc_split_role - Role this physical encoder will play in a
+ *	split-panel configuration, where one panel is master, and others slaves.
+ *	Masters have extra responsibilities, like managing the VBLANK IRQ.
+ * @ENC_ROLE_SOLO:	This is the one and only panel. This encoder is master.
+ * @ENC_ROLE_MASTER:	This encoder is the master of a split panel config.
+ * @ENC_ROLE_SLAVE:	This encoder is not the master of a split panel config.
+ */
+enum dpu_enc_split_role {
+	ENC_ROLE_SOLO,
+	ENC_ROLE_MASTER,
+	ENC_ROLE_SLAVE,
+};
+
+/**
+ * enum dpu_enc_enable_state - current enabled state of the physical encoder
+ * @DPU_ENC_DISABLING:	Encoder transitioning to disable state
+ *			Events bounding transition are encoder type specific
+ * @DPU_ENC_DISABLED:	Encoder is disabled
+ * @DPU_ENC_ENABLING:	Encoder transitioning to enabled
+ *			Events bounding transition are encoder type specific
+ * @DPU_ENC_ENABLED:	Encoder is enabled
+ * @DPU_ENC_ERR_NEEDS_HW_RESET:	Encoder is enabled, but requires a hw_reset
+ *				to recover from a previous error
+ */
+enum dpu_enc_enable_state {
+	DPU_ENC_DISABLING,
+	DPU_ENC_DISABLED,
+	DPU_ENC_ENABLING,
+	DPU_ENC_ENABLED,
+	DPU_ENC_ERR_NEEDS_HW_RESET
+};
+
+struct dpu_encoder_phys;
+
+/**
+ * struct dpu_encoder_phys_ops - Interface the physical encoders provide to
+ *	the containing virtual encoder.
+ * @prepare_commit:		MSM Atomic Call, start of atomic commit sequence
+ * @is_master:			Whether this phys_enc is the current master
+ *				encoder. Can be switched at enable time. Based
+ *				on split_role and current mode (CMD/VID).
+ * @atomic_mode_set:		DRM Call. Set a DRM mode.
+ *				This likely caches the mode, for use at enable.
+ * @enable:			DRM Call. Enable a DRM mode.
+ * @disable:			DRM Call. Disable mode.
+ * @atomic_check:		DRM Call. Atomic check new DRM state.
+ * @control_vblank_irq		Register/Deregister for VBLANK IRQ
+ * @wait_for_commit_done:	Wait for hardware to have flushed the
+ *				current pending frames to hardware
+ * @wait_for_tx_complete:	Wait for hardware to transfer the pixels
+ *				to the panel
+ * @wait_for_vblank:		Wait for VBLANK, for sub-driver internal use
+ * @prepare_for_kickoff:	Do any work necessary prior to a kickoff
+ *				For CMD encoder, may wait for previous tx done
+ * @handle_post_kickoff:	Do any work necessary post-kickoff work
+ * @trigger_start:		Process start event on physical encoder
+ * @needs_single_flush:		Whether encoder slaves need to be flushed
+ * @irq_control:		Handler to enable/disable all the encoder IRQs
+ * @prepare_idle_pc:		phys encoder can update the vsync_enable status
+ *                              on idle power collapse prepare
+ * @restore:			Restore all the encoder configs.
+ * @get_line_count:		Obtain current vertical line count
+ */
+
+struct dpu_encoder_phys_ops {
+	void (*prepare_commit)(struct dpu_encoder_phys *encoder);
+	bool (*is_master)(struct dpu_encoder_phys *encoder);
+	void (*atomic_mode_set)(struct dpu_encoder_phys *encoder,
+			struct drm_crtc_state *crtc_state,
+			struct drm_connector_state *conn_state);
+	void (*enable)(struct dpu_encoder_phys *encoder);
+	void (*disable)(struct dpu_encoder_phys *encoder);
+	int (*atomic_check)(struct dpu_encoder_phys *encoder,
+			    struct drm_crtc_state *crtc_state,
+			    struct drm_connector_state *conn_state);
+	int (*control_vblank_irq)(struct dpu_encoder_phys *enc, bool enable);
+	int (*wait_for_commit_done)(struct dpu_encoder_phys *phys_enc);
+	int (*wait_for_tx_complete)(struct dpu_encoder_phys *phys_enc);
+	void (*prepare_for_kickoff)(struct dpu_encoder_phys *phys_enc);
+	void (*handle_post_kickoff)(struct dpu_encoder_phys *phys_enc);
+	void (*trigger_start)(struct dpu_encoder_phys *phys_enc);
+	bool (*needs_single_flush)(struct dpu_encoder_phys *phys_enc);
+	void (*irq_control)(struct dpu_encoder_phys *phys, bool enable);
+	void (*prepare_idle_pc)(struct dpu_encoder_phys *phys_enc);
+	void (*restore)(struct dpu_encoder_phys *phys);
+	int (*get_line_count)(struct dpu_encoder_phys *phys);
+	int (*get_frame_count)(struct dpu_encoder_phys *phys);
+	void (*prepare_wb_job)(struct dpu_encoder_phys *phys_enc,
+			struct drm_writeback_job *job);
+	void (*cleanup_wb_job)(struct dpu_encoder_phys *phys_enc,
+			struct drm_writeback_job *job);
+	bool (*is_valid_for_commit)(struct dpu_encoder_phys *phys_enc);
+};
+
+/**
+ * enum dpu_intr_idx - dpu encoder interrupt index
+ * @INTR_IDX_VSYNC:    Vsync interrupt for video mode panel
+ * @INTR_IDX_PINGPONG: Pingpong done interrupt for cmd mode panel
+ * @INTR_IDX_UNDERRUN: Underrun interrupt for video and cmd mode panel
+ * @INTR_IDX_RDPTR:    Readpointer done interrupt for cmd mode panel
+ * @INTR_IDX_WB_DONE:  Writeback done interrupt for virtual connector
+ */
+enum dpu_intr_idx {
+	INTR_IDX_VSYNC,
+	INTR_IDX_PINGPONG,
+	INTR_IDX_UNDERRUN,
+	INTR_IDX_CTL_START,
+	INTR_IDX_RDPTR,
+	INTR_IDX_WB_DONE,
+	INTR_IDX_MAX,
+};
+
+/**
+ * struct dpu_encoder_phys - physical encoder that drives a single INTF block
+ *	tied to a specific panel / sub-panel. Abstract type, sub-classed by
+ *	phys_vid or phys_cmd for video mode or command mode encs respectively.
+ * @parent:		Pointer to the containing virtual encoder
+ * @ops:		Operations exposed to the virtual encoder
+ * @parent_ops:		Callbacks exposed by the parent to the phys_enc
+ * @hw_mdptop:		Hardware interface to the top registers
+ * @hw_ctl:		Hardware interface to the ctl registers
+ * @hw_pp:		Hardware interface to the ping pong registers
+ * @hw_intf:		Hardware interface to the intf registers
+ * @hw_wb:		Hardware interface to the wb registers
+ * @hw_cdm:		Hardware interface to the CDM registers
+ * @dpu_kms:		Pointer to the dpu_kms top level
+ * @cdm_cfg:		CDM block config needed to store WB/DP block's CDM configuration
+ * @cached_mode:	DRM mode cached at mode_set time, acted on in enable
+ * @vblank_ctl_lock:	Vblank ctl mutex lock to protect vblank_refcount
+ * @enabled:		Whether the encoder has enabled and running a mode
+ * @split_role:		Role to play in a split-panel configuration
+ * @intf_mode:		Interface mode
+ * @enc_spinlock:	Virtual-Encoder-Wide Spin Lock for IRQ purposes
+ * @enable_state:	Enable state tracking
+ * @vblank_refcount:	Reference count of vblank request
+ * @vsync_cnt:		Vsync count for the physical encoder
+ * @underrun_cnt:	Underrun count for the physical encoder
+ * @pending_kickoff_cnt:	Atomic counter tracking the number of kickoffs
+ *				vs. the number of done/vblank irqs. Should hover
+ *				between 0-2 Incremented when a new kickoff is
+ *				scheduled. Decremented in irq handler
+ * @pending_ctlstart_cnt:	Atomic counter tracking the number of ctl start
+ *                              pending.
+ * @pending_kickoff_wq:		Wait queue for blocking until kickoff completes
+ * @irq:			IRQ indices
+ * @has_intf_te:		Interface TE configuration support
+ */
+struct dpu_encoder_phys {
+	struct drm_encoder *parent;
+	struct dpu_encoder_phys_ops ops;
+	struct dpu_hw_mdp *hw_mdptop;
+	struct dpu_hw_ctl *hw_ctl;
+	struct dpu_hw_pingpong *hw_pp;
+	struct dpu_hw_intf *hw_intf;
+	struct dpu_hw_wb *hw_wb;
+	struct dpu_hw_cdm *hw_cdm;
+	struct dpu_kms *dpu_kms;
+	struct dpu_hw_cdm_cfg cdm_cfg;
+	struct drm_display_mode cached_mode;
+	struct mutex vblank_ctl_lock;
+	enum dpu_enc_split_role split_role;
+	enum dpu_intf_mode intf_mode;
+	spinlock_t *enc_spinlock;
+	enum dpu_enc_enable_state enable_state;
+	int vblank_refcount;
+	atomic_t vsync_cnt;
+	atomic_t underrun_cnt;
+	atomic_t pending_ctlstart_cnt;
+	atomic_t pending_kickoff_cnt;
+	wait_queue_head_t pending_kickoff_wq;
+	unsigned int irq[INTR_IDX_MAX];
+	bool has_intf_te;
+};
+
+static inline int dpu_encoder_phys_inc_pending(struct dpu_encoder_phys *phys)
+{
+	atomic_inc_return(&phys->pending_ctlstart_cnt);
+	return atomic_inc_return(&phys->pending_kickoff_cnt);
+}
+
+/**
+ * struct dpu_encoder_phys_wb - sub-class of dpu_encoder_phys to handle command
+ *	mode specific operations
+ * @base:	Baseclass physical encoder structure
+ * @wbirq_refcount:     Reference count of writeback interrupt
+ * @wb_done_timeout_cnt: number of wb done irq timeout errors
+ * @wb_cfg:  writeback block config to store fb related details
+ * @wb_conn: backpointer to writeback connector
+ * @wb_job: backpointer to current writeback job
+ * @dest:   dpu buffer layout for current writeback output buffer
+ */
+struct dpu_encoder_phys_wb {
+	struct dpu_encoder_phys base;
+	atomic_t wbirq_refcount;
+	int wb_done_timeout_cnt;
+	struct dpu_hw_wb_cfg wb_cfg;
+	struct drm_writeback_connector *wb_conn;
+	struct drm_writeback_job *wb_job;
+	struct dpu_hw_fmt_layout dest;
+};
+
+/**
+ * struct dpu_encoder_phys_cmd - sub-class of dpu_encoder_phys to handle command
+ *	mode specific operations
+ * @base:	Baseclass physical encoder structure
+ * @intf_idx:	Intf Block index used by this phys encoder
+ * @stream_sel:	Stream selection for multi-stream interfaces
+ * @serialize_wait4pp:	serialize wait4pp feature waits for pp_done interrupt
+ *			after ctl_start instead of before next frame kickoff
+ * @pp_timeout_report_cnt: number of pingpong done irq timeout errors
+ * @pending_vblank_cnt: Atomic counter tracking pending wait for VBLANK
+ * @pending_vblank_wq: Wait queue for blocking until VBLANK received
+ */
+struct dpu_encoder_phys_cmd {
+	struct dpu_encoder_phys base;
+	int stream_sel;
+	bool serialize_wait4pp;
+	int pp_timeout_report_cnt;
+	atomic_t pending_vblank_cnt;
+	wait_queue_head_t pending_vblank_wq;
+};
+
+/**
+ * struct dpu_enc_phys_init_params - initialization parameters for phys encs
+ * @dpu_kms:		Pointer to the dpu_kms top level
+ * @parent:		Pointer to the containing virtual encoder
+ * @parent_ops:		Callbacks exposed by the parent to the phys_enc
+ * @split_role:		Role to play in a split-panel configuration
+ * @hw_intf:		Hardware interface to the intf registers
+ * @hw_wb:		Hardware interface to the wb registers
+ * @enc_spinlock:	Virtual-Encoder-Wide Spin Lock for IRQ purposes
+ */
+struct dpu_enc_phys_init_params {
+	struct dpu_kms *dpu_kms;
+	struct drm_encoder *parent;
+	enum dpu_enc_split_role split_role;
+	struct dpu_hw_intf *hw_intf;
+	struct dpu_hw_wb *hw_wb;
+	spinlock_t *enc_spinlock;
+};
+
+/**
+ * dpu_encoder_wait_info - container for passing arguments to irq wait functions
+ * @wq: wait queue structure
+ * @atomic_cnt: wait until atomic_cnt equals zero
+ * @timeout_ms: timeout value in milliseconds
+ */
+struct dpu_encoder_wait_info {
+	wait_queue_head_t *wq;
+	atomic_t *atomic_cnt;
+	s64 timeout_ms;
+};
+
+/**
+ * dpu_encoder_phys_vid_init - Construct a new video mode physical encoder
+ * @p:	Pointer to init params structure
+ * Return: Error code or newly allocated encoder
+ */
+struct dpu_encoder_phys *dpu_encoder_phys_vid_init(struct drm_device *dev,
+		struct dpu_enc_phys_init_params *p);
+
+/**
+ * dpu_encoder_phys_cmd_init - Construct a new command mode physical encoder
+ * @dev:  Corresponding device for devres management
+ * @p:	Pointer to init params structure
+ * Return: Error code or newly allocated encoder
+ */
+struct dpu_encoder_phys *dpu_encoder_phys_cmd_init(struct drm_device *dev,
+		struct dpu_enc_phys_init_params *p);
+
+/**
+ * dpu_encoder_phys_wb_init - initialize writeback encoder
+ * @dev:  Corresponding device for devres management
+ * @init:	Pointer to init info structure with initialization params
+ */
+struct dpu_encoder_phys *dpu_encoder_phys_wb_init(struct drm_device *dev,
+		struct dpu_enc_phys_init_params *p);
+
+/**
+ * dpu_encoder_helper_trigger_start - control start helper function
+ *	This helper function may be optionally specified by physical
+ *	encoders if they require ctl_start triggering.
+ * @phys_enc: Pointer to physical encoder structure
+ */
+void dpu_encoder_helper_trigger_start(struct dpu_encoder_phys *phys_enc);
+
+static inline enum dpu_3d_blend_mode dpu_encoder_helper_get_3d_blend_mode(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_crtc_state *dpu_cstate;
+
+	if (!phys_enc || phys_enc->enable_state == DPU_ENC_DISABLING)
+		return BLEND_3D_NONE;
+
+	dpu_cstate = to_dpu_crtc_state(phys_enc->parent->crtc->state);
+
+	/* Use merge_3d unless DSC MERGE topology is used */
+	if (phys_enc->split_role == ENC_ROLE_SOLO &&
+	    dpu_cstate->num_mixers == CRTC_DUAL_MIXERS &&
+	    !dpu_encoder_use_dsc_merge(phys_enc->parent))
+		return BLEND_3D_H_ROW_INT;
+
+	return BLEND_3D_NONE;
+}
+
+/**
+ * dpu_encoder_helper_get_dsc - get DSC blocks mask for the DPU encoder
+ *   This helper function is used by physical encoder to get DSC blocks mask
+ *   used for this encoder.
+ * @phys_enc: Pointer to physical encoder structure
+ */
+unsigned int dpu_encoder_helper_get_dsc(struct dpu_encoder_phys *phys_enc);
+
+/**
+ * dpu_encoder_get_drm_fmt - return DRM fourcc format
+ * @phys_enc: Pointer to physical encoder structure
+ */
+u32 dpu_encoder_get_drm_fmt(struct dpu_encoder_phys *phys_enc);
+
+/**
+ * dpu_encoder_needs_periph_flush - return true if physical encoder requires
+ *	peripheral flush
+ * @phys_enc: Pointer to physical encoder structure
+ */
+bool dpu_encoder_needs_periph_flush(struct dpu_encoder_phys *phys_enc);
+
+/**
+ * dpu_encoder_helper_split_config - split display configuration helper function
+ *	This helper function may be used by physical encoders to configure
+ *	the split display related registers.
+ * @phys_enc: Pointer to physical encoder structure
+ * @interface: enum dpu_intf setting
+ */
+void dpu_encoder_helper_split_config(
+		struct dpu_encoder_phys *phys_enc,
+		enum dpu_intf interface);
+
+/**
+ * dpu_encoder_helper_report_irq_timeout - utility to report error that irq has
+ *	timed out, including reporting frame error event to crtc and debug dump
+ * @phys_enc: Pointer to physical encoder structure
+ * @intr_idx: Failing interrupt index
+ */
+void dpu_encoder_helper_report_irq_timeout(struct dpu_encoder_phys *phys_enc,
+		enum dpu_intr_idx intr_idx);
+
+/**
+ * dpu_encoder_helper_wait_for_irq - utility to wait on an irq.
+ *	note: will call dpu_encoder_helper_wait_for_irq on timeout
+ * @phys_enc: Pointer to physical encoder structure
+ * @irq: IRQ index
+ * @func: IRQ callback to be called in case of timeout
+ * @wait_info: wait info struct
+ * @Return: 0 or -ERROR
+ */
+int dpu_encoder_helper_wait_for_irq(struct dpu_encoder_phys *phys_enc,
+		unsigned int irq,
+		void (*func)(void *arg),
+		struct dpu_encoder_wait_info *wait_info);
+
+/**
+ * dpu_encoder_helper_phys_cleanup - helper to cleanup dpu pipeline
+ * @phys_enc: Pointer to physical encoder structure
+ */
+void dpu_encoder_helper_phys_cleanup(struct dpu_encoder_phys *phys_enc);
+
+/**
+ * dpu_encoder_helper_phys_setup_cdm - setup chroma down sampling block
+ * @phys_enc: Pointer to physical encoder
+ * @output_type: HDMI/WB
+ */
+void dpu_encoder_helper_phys_setup_cdm(struct dpu_encoder_phys *phys_enc,
+				       const struct dpu_format *dpu_fmt,
+				       u32 output_type);
+
+/**
+ * dpu_encoder_vblank_callback - Notify virtual encoder of vblank IRQ reception
+ * @drm_enc:    Pointer to drm encoder structure
+ * @phys_enc:	Pointer to physical encoder
+ * Note: This is called from IRQ handler context.
+ */
+void dpu_encoder_vblank_callback(struct drm_encoder *drm_enc,
+				 struct dpu_encoder_phys *phy_enc);
+
+/** dpu_encoder_underrun_callback - Notify virtual encoder of underrun IRQ reception
+ * @drm_enc:    Pointer to drm encoder structure
+ * @phys_enc:	Pointer to physical encoder
+ * Note: This is called from IRQ handler context.
+ */
+void dpu_encoder_underrun_callback(struct drm_encoder *drm_enc,
+				   struct dpu_encoder_phys *phy_enc);
+
+/** dpu_encoder_frame_done_callback -- Notify virtual encoder that this phys encoder completes last request frame
+ * @drm_enc:    Pointer to drm encoder structure
+ * @phys_enc:	Pointer to physical encoder
+ * @event:	Event to process
+ */
+void dpu_encoder_frame_done_callback(
+		struct drm_encoder *drm_enc,
+		struct dpu_encoder_phys *ready_phys, u32 event);
+
+void dpu_encoder_phys_init(struct dpu_encoder_phys *phys,
+			   struct dpu_enc_phys_init_params *p);
+
+#endif /* __dpu_encoder_phys_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder_phys_cmd.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder_phys_cmd.c
@@ -0,0 +1,764 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015-2018, 2020-2021 The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+#include <linux/delay.h>
+#include "dpu_encoder_phys.h"
+#include "dpu_hw_interrupts.h"
+#include "dpu_hw_pingpong.h"
+#include "dpu_core_irq.h"
+#include "dpu_formats.h"
+#include "dpu_trace.h"
+#include "disp/msm_disp_snapshot.h"
+
+#include <drm/drm_managed.h>
+
+#define DPU_DEBUG_CMDENC(e, fmt, ...) DPU_DEBUG("enc%d intf%d " fmt, \
+		(e) && (e)->base.parent ? \
+		(e)->base.parent->base.id : -1, \
+		(e) ? (e)->base.hw_intf->idx - INTF_0 : -1, ##__VA_ARGS__)
+
+#define DPU_ERROR_CMDENC(e, fmt, ...) DPU_ERROR("enc%d intf%d " fmt, \
+		(e) && (e)->base.parent ? \
+		(e)->base.parent->base.id : -1, \
+		(e) ? (e)->base.hw_intf->idx - INTF_0 : -1, ##__VA_ARGS__)
+
+#define to_dpu_encoder_phys_cmd(x) \
+	container_of(x, struct dpu_encoder_phys_cmd, base)
+
+#define PP_TIMEOUT_MAX_TRIALS	10
+
+/*
+ * Tearcheck sync start and continue thresholds are empirically found
+ * based on common panels In the future, may want to allow panels to override
+ * these default values
+ */
+#define DEFAULT_TEARCHECK_SYNC_THRESH_START	4
+#define DEFAULT_TEARCHECK_SYNC_THRESH_CONTINUE	4
+
+static void dpu_encoder_phys_cmd_enable_te(struct dpu_encoder_phys *phys_enc);
+
+static bool dpu_encoder_phys_cmd_is_master(struct dpu_encoder_phys *phys_enc)
+{
+	return (phys_enc->split_role != ENC_ROLE_SLAVE);
+}
+
+static void _dpu_encoder_phys_cmd_update_intf_cfg(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_cmd *cmd_enc =
+			to_dpu_encoder_phys_cmd(phys_enc);
+	struct dpu_hw_ctl *ctl;
+	struct dpu_hw_intf_cfg intf_cfg = { 0 };
+	struct dpu_hw_intf_cmd_mode_cfg cmd_mode_cfg = {};
+
+	ctl = phys_enc->hw_ctl;
+	if (!ctl->ops.setup_intf_cfg)
+		return;
+
+	intf_cfg.intf = phys_enc->hw_intf->idx;
+	intf_cfg.intf_mode_sel = DPU_CTL_MODE_SEL_CMD;
+	intf_cfg.stream_sel = cmd_enc->stream_sel;
+	intf_cfg.mode_3d = dpu_encoder_helper_get_3d_blend_mode(phys_enc);
+	intf_cfg.dsc = dpu_encoder_helper_get_dsc(phys_enc);
+	ctl->ops.setup_intf_cfg(ctl, &intf_cfg);
+
+	/* setup which pp blk will connect to this intf */
+	if (test_bit(DPU_CTL_ACTIVE_CFG, &ctl->caps->features) && phys_enc->hw_intf->ops.bind_pingpong_blk)
+		phys_enc->hw_intf->ops.bind_pingpong_blk(
+				phys_enc->hw_intf,
+				phys_enc->hw_pp->idx);
+
+	if (intf_cfg.dsc != 0)
+		cmd_mode_cfg.data_compress = true;
+
+	cmd_mode_cfg.wide_bus_en = dpu_encoder_is_widebus_enabled(phys_enc->parent);
+
+	if (phys_enc->hw_intf->ops.program_intf_cmd_cfg)
+		phys_enc->hw_intf->ops.program_intf_cmd_cfg(phys_enc->hw_intf, &cmd_mode_cfg);
+}
+
+static void dpu_encoder_phys_cmd_pp_tx_done_irq(void *arg)
+{
+	struct dpu_encoder_phys *phys_enc = arg;
+	unsigned long lock_flags;
+	int new_cnt;
+	u32 event = DPU_ENCODER_FRAME_EVENT_DONE;
+
+	if (!phys_enc->hw_pp)
+		return;
+
+	DPU_ATRACE_BEGIN("pp_done_irq");
+	/* notify all synchronous clients first, then asynchronous clients */
+	dpu_encoder_frame_done_callback(phys_enc->parent, phys_enc, event);
+
+	spin_lock_irqsave(phys_enc->enc_spinlock, lock_flags);
+	new_cnt = atomic_add_unless(&phys_enc->pending_kickoff_cnt, -1, 0);
+	spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
+
+	trace_dpu_enc_phys_cmd_pp_tx_done(DRMID(phys_enc->parent),
+					  phys_enc->hw_pp->idx - PINGPONG_0,
+					  new_cnt, event);
+
+	/* Signal any waiting atomic commit thread */
+	wake_up_all(&phys_enc->pending_kickoff_wq);
+	DPU_ATRACE_END("pp_done_irq");
+}
+
+static void dpu_encoder_phys_cmd_te_rd_ptr_irq(void *arg)
+{
+	struct dpu_encoder_phys *phys_enc = arg;
+	struct dpu_encoder_phys_cmd *cmd_enc;
+
+	DPU_ATRACE_BEGIN("rd_ptr_irq");
+	cmd_enc = to_dpu_encoder_phys_cmd(phys_enc);
+
+	dpu_encoder_vblank_callback(phys_enc->parent, phys_enc);
+
+	atomic_add_unless(&cmd_enc->pending_vblank_cnt, -1, 0);
+	wake_up_all(&cmd_enc->pending_vblank_wq);
+	DPU_ATRACE_END("rd_ptr_irq");
+}
+
+static void dpu_encoder_phys_cmd_ctl_start_irq(void *arg)
+{
+	struct dpu_encoder_phys *phys_enc = arg;
+
+	DPU_ATRACE_BEGIN("ctl_start_irq");
+
+	atomic_add_unless(&phys_enc->pending_ctlstart_cnt, -1, 0);
+
+	/* Signal any waiting ctl start interrupt */
+	wake_up_all(&phys_enc->pending_kickoff_wq);
+	DPU_ATRACE_END("ctl_start_irq");
+}
+
+static void dpu_encoder_phys_cmd_underrun_irq(void *arg)
+{
+	struct dpu_encoder_phys *phys_enc = arg;
+
+	dpu_encoder_underrun_callback(phys_enc->parent, phys_enc);
+}
+
+static void dpu_encoder_phys_cmd_atomic_mode_set(
+		struct dpu_encoder_phys *phys_enc,
+		struct drm_crtc_state *crtc_state,
+		struct drm_connector_state *conn_state)
+{
+	phys_enc->irq[INTR_IDX_CTL_START] = phys_enc->hw_ctl->caps->intr_start;
+
+	phys_enc->irq[INTR_IDX_PINGPONG] = phys_enc->hw_pp->caps->intr_done;
+
+	if (phys_enc->has_intf_te)
+		phys_enc->irq[INTR_IDX_RDPTR] = phys_enc->hw_intf->cap->intr_tear_rd_ptr;
+	else
+		phys_enc->irq[INTR_IDX_RDPTR] = phys_enc->hw_pp->caps->intr_rdptr;
+
+	phys_enc->irq[INTR_IDX_UNDERRUN] = phys_enc->hw_intf->cap->intr_underrun;
+}
+
+static int _dpu_encoder_phys_cmd_handle_ppdone_timeout(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_cmd *cmd_enc =
+			to_dpu_encoder_phys_cmd(phys_enc);
+	u32 frame_event = DPU_ENCODER_FRAME_EVENT_ERROR;
+	bool do_log = false;
+	struct drm_encoder *drm_enc;
+
+	if (!phys_enc->hw_pp)
+		return -EINVAL;
+
+	drm_enc = phys_enc->parent;
+
+	cmd_enc->pp_timeout_report_cnt++;
+	if (cmd_enc->pp_timeout_report_cnt == PP_TIMEOUT_MAX_TRIALS) {
+		frame_event |= DPU_ENCODER_FRAME_EVENT_PANEL_DEAD;
+		do_log = true;
+	} else if (cmd_enc->pp_timeout_report_cnt == 1) {
+		do_log = true;
+	}
+
+	trace_dpu_enc_phys_cmd_pdone_timeout(DRMID(drm_enc),
+		     phys_enc->hw_pp->idx - PINGPONG_0,
+		     cmd_enc->pp_timeout_report_cnt,
+		     atomic_read(&phys_enc->pending_kickoff_cnt),
+		     frame_event);
+
+	/* to avoid flooding, only log first time, and "dead" time */
+	if (do_log) {
+		DRM_ERROR("id:%d pp:%d kickoff timeout %d cnt %d koff_cnt %d\n",
+			  DRMID(drm_enc),
+			  phys_enc->hw_pp->idx - PINGPONG_0,
+			  phys_enc->hw_ctl->idx - CTL_0,
+			  cmd_enc->pp_timeout_report_cnt,
+			  atomic_read(&phys_enc->pending_kickoff_cnt));
+		msm_disp_snapshot_state(drm_enc->dev);
+		dpu_core_irq_unregister_callback(phys_enc->dpu_kms,
+				phys_enc->irq[INTR_IDX_RDPTR]);
+	}
+
+	atomic_add_unless(&phys_enc->pending_kickoff_cnt, -1, 0);
+
+	/* request a ctl reset before the next kickoff */
+	phys_enc->enable_state = DPU_ENC_ERR_NEEDS_HW_RESET;
+
+	dpu_encoder_frame_done_callback(phys_enc->parent, phys_enc, frame_event);
+
+	return -ETIMEDOUT;
+}
+
+static int _dpu_encoder_phys_cmd_wait_for_idle(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_cmd *cmd_enc =
+			to_dpu_encoder_phys_cmd(phys_enc);
+	struct dpu_encoder_wait_info wait_info;
+	int ret;
+
+	wait_info.wq = &phys_enc->pending_kickoff_wq;
+	wait_info.atomic_cnt = &phys_enc->pending_kickoff_cnt;
+	wait_info.timeout_ms = KICKOFF_TIMEOUT_MS;
+
+	ret = dpu_encoder_helper_wait_for_irq(phys_enc,
+			phys_enc->irq[INTR_IDX_PINGPONG],
+			dpu_encoder_phys_cmd_pp_tx_done_irq,
+			&wait_info);
+	if (ret == -ETIMEDOUT)
+		_dpu_encoder_phys_cmd_handle_ppdone_timeout(phys_enc);
+	else if (!ret)
+		cmd_enc->pp_timeout_report_cnt = 0;
+
+	return ret;
+}
+
+static int dpu_encoder_phys_cmd_control_vblank_irq(
+		struct dpu_encoder_phys *phys_enc,
+		bool enable)
+{
+	int ret = 0;
+	int refcount;
+
+	if (!phys_enc->hw_pp) {
+		DPU_ERROR("invalid encoder\n");
+		return -EINVAL;
+	}
+
+	mutex_lock(&phys_enc->vblank_ctl_lock);
+	refcount = phys_enc->vblank_refcount;
+
+	/* Slave encoders don't report vblank */
+	if (!dpu_encoder_phys_cmd_is_master(phys_enc))
+		goto end;
+
+	/* protect against negative */
+	if (!enable && refcount == 0) {
+		ret = -EINVAL;
+		goto end;
+	}
+
+	DRM_DEBUG_KMS("id:%u pp:%d enable=%s/%d\n", DRMID(phys_enc->parent),
+		      phys_enc->hw_pp->idx - PINGPONG_0,
+		      enable ? "true" : "false", refcount);
+
+	if (enable) {
+		if (phys_enc->vblank_refcount == 0)
+			ret = dpu_core_irq_register_callback(phys_enc->dpu_kms,
+					phys_enc->irq[INTR_IDX_RDPTR],
+					dpu_encoder_phys_cmd_te_rd_ptr_irq,
+					phys_enc);
+		if (!ret)
+			phys_enc->vblank_refcount++;
+	} else if (!enable) {
+		if (phys_enc->vblank_refcount == 1)
+			ret = dpu_core_irq_unregister_callback(phys_enc->dpu_kms,
+					phys_enc->irq[INTR_IDX_RDPTR]);
+		if (!ret)
+			phys_enc->vblank_refcount--;
+	}
+
+end:
+	mutex_unlock(&phys_enc->vblank_ctl_lock);
+	if (ret) {
+		DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n",
+			  DRMID(phys_enc->parent),
+			  phys_enc->hw_pp->idx - PINGPONG_0, ret,
+			  enable ? "true" : "false", refcount);
+	}
+
+	return ret;
+}
+
+static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc,
+		bool enable)
+{
+	trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent),
+			phys_enc->hw_pp->idx - PINGPONG_0,
+			enable, phys_enc->vblank_refcount);
+
+	if (enable) {
+		dpu_core_irq_register_callback(phys_enc->dpu_kms,
+				phys_enc->irq[INTR_IDX_PINGPONG],
+				dpu_encoder_phys_cmd_pp_tx_done_irq,
+				phys_enc);
+		dpu_core_irq_register_callback(phys_enc->dpu_kms,
+				phys_enc->irq[INTR_IDX_UNDERRUN],
+				dpu_encoder_phys_cmd_underrun_irq,
+				phys_enc);
+		dpu_encoder_phys_cmd_control_vblank_irq(phys_enc, true);
+
+		if (dpu_encoder_phys_cmd_is_master(phys_enc))
+			dpu_core_irq_register_callback(phys_enc->dpu_kms,
+					phys_enc->irq[INTR_IDX_CTL_START],
+					dpu_encoder_phys_cmd_ctl_start_irq,
+					phys_enc);
+	} else {
+		if (dpu_encoder_phys_cmd_is_master(phys_enc))
+			dpu_core_irq_unregister_callback(phys_enc->dpu_kms,
+					phys_enc->irq[INTR_IDX_CTL_START]);
+
+		dpu_core_irq_unregister_callback(phys_enc->dpu_kms,
+				phys_enc->irq[INTR_IDX_UNDERRUN]);
+		dpu_encoder_phys_cmd_control_vblank_irq(phys_enc, false);
+		dpu_core_irq_unregister_callback(phys_enc->dpu_kms,
+				phys_enc->irq[INTR_IDX_PINGPONG]);
+	}
+}
+
+static void dpu_encoder_phys_cmd_tearcheck_config(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_cmd *cmd_enc =
+		to_dpu_encoder_phys_cmd(phys_enc);
+	struct dpu_hw_tear_check tc_cfg = { 0 };
+	struct drm_display_mode *mode;
+	bool tc_enable = true;
+	unsigned long vsync_hz;
+	struct dpu_kms *dpu_kms;
+
+	/*
+	 * TODO: if/when resource allocation is refactored, move this to a
+	 * place where the driver can actually return an error.
+	 */
+	if (!phys_enc->has_intf_te &&
+	    (!phys_enc->hw_pp ||
+	     !phys_enc->hw_pp->ops.enable_tearcheck)) {
+		DPU_DEBUG_CMDENC(cmd_enc, "tearcheck not supported\n");
+		return;
+	}
+
+	DPU_DEBUG_CMDENC(cmd_enc, "intf %d pp %d\n",
+			 phys_enc->hw_intf ? phys_enc->hw_intf->idx - INTF_0 : -1,
+			 phys_enc->hw_pp ? phys_enc->hw_pp->idx - PINGPONG_0 : -1);
+
+	mode = &phys_enc->cached_mode;
+
+	dpu_kms = phys_enc->dpu_kms;
+
+	/*
+	 * TE default: dsi byte clock calculated base on 70 fps;
+	 * around 14 ms to complete a kickoff cycle if te disabled;
+	 * vclk_line base on 60 fps; write is faster than read;
+	 * init == start == rdptr;
+	 *
+	 * vsync_count is ratio of MDP VSYNC clock frequency to LCD panel
+	 * frequency divided by the no. of rows (lines) in the LCDpanel.
+	 */
+	vsync_hz = dpu_kms_get_clk_rate(dpu_kms, "vsync");
+	if (!vsync_hz) {
+		DPU_DEBUG_CMDENC(cmd_enc, "invalid - no vsync clock\n");
+		return;
+	}
+
+	tc_cfg.vsync_count = vsync_hz /
+				(mode->vtotal * drm_mode_vrefresh(mode));
+
+	/*
+	 * Set the sync_cfg_height to twice vtotal so that if we lose a
+	 * TE event coming from the display TE pin we won't stall immediately
+	 */
+	tc_cfg.hw_vsync_mode = 1;
+	tc_cfg.sync_cfg_height = mode->vtotal * 2;
+	tc_cfg.vsync_init_val = mode->vdisplay;
+	tc_cfg.sync_threshold_start = DEFAULT_TEARCHECK_SYNC_THRESH_START;
+	tc_cfg.sync_threshold_continue = DEFAULT_TEARCHECK_SYNC_THRESH_CONTINUE;
+	tc_cfg.start_pos = mode->vdisplay;
+	tc_cfg.rd_ptr_irq = mode->vdisplay + 1;
+
+	DPU_DEBUG_CMDENC(cmd_enc,
+		"tc vsync_clk_speed_hz %lu vtotal %u vrefresh %u\n",
+		vsync_hz, mode->vtotal, drm_mode_vrefresh(mode));
+	DPU_DEBUG_CMDENC(cmd_enc,
+		"tc enable %u start_pos %u rd_ptr_irq %u\n",
+		tc_enable, tc_cfg.start_pos, tc_cfg.rd_ptr_irq);
+	DPU_DEBUG_CMDENC(cmd_enc,
+		"tc hw_vsync_mode %u vsync_count %u vsync_init_val %u\n",
+		tc_cfg.hw_vsync_mode, tc_cfg.vsync_count,
+		tc_cfg.vsync_init_val);
+	DPU_DEBUG_CMDENC(cmd_enc,
+		"tc cfgheight %u thresh_start %u thresh_cont %u\n",
+		tc_cfg.sync_cfg_height, tc_cfg.sync_threshold_start,
+		tc_cfg.sync_threshold_continue);
+
+	if (phys_enc->has_intf_te)
+		phys_enc->hw_intf->ops.enable_tearcheck(phys_enc->hw_intf, &tc_cfg);
+	else
+		phys_enc->hw_pp->ops.enable_tearcheck(phys_enc->hw_pp, &tc_cfg);
+}
+
+static void _dpu_encoder_phys_cmd_pingpong_config(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_cmd *cmd_enc =
+		to_dpu_encoder_phys_cmd(phys_enc);
+
+	if (!phys_enc->hw_pp || !phys_enc->hw_ctl->ops.setup_intf_cfg) {
+		DPU_ERROR("invalid arg(s), enc %d\n", phys_enc != NULL);
+		return;
+	}
+
+	DPU_DEBUG_CMDENC(cmd_enc, "pp %d, enabling mode:\n",
+			phys_enc->hw_pp->idx - PINGPONG_0);
+	drm_mode_debug_printmodeline(&phys_enc->cached_mode);
+
+	_dpu_encoder_phys_cmd_update_intf_cfg(phys_enc);
+	dpu_encoder_phys_cmd_tearcheck_config(phys_enc);
+}
+
+static bool dpu_encoder_phys_cmd_needs_single_flush(
+		struct dpu_encoder_phys *phys_enc)
+{
+	/**
+	 * we do separate flush for each CTL and let
+	 * CTL_START synchronize them
+	 */
+	return false;
+}
+
+static void dpu_encoder_phys_cmd_enable_helper(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_ctl *ctl;
+
+	if (!phys_enc->hw_pp) {
+		DPU_ERROR("invalid arg(s), encoder %d\n", phys_enc != NULL);
+		return;
+	}
+
+	dpu_encoder_helper_split_config(phys_enc, phys_enc->hw_intf->idx);
+
+	_dpu_encoder_phys_cmd_pingpong_config(phys_enc);
+
+	ctl = phys_enc->hw_ctl;
+	ctl->ops.update_pending_flush_intf(ctl, phys_enc->hw_intf->idx);
+}
+
+static void dpu_encoder_phys_cmd_enable(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_cmd *cmd_enc =
+		to_dpu_encoder_phys_cmd(phys_enc);
+
+	if (!phys_enc->hw_pp) {
+		DPU_ERROR("invalid phys encoder\n");
+		return;
+	}
+
+	DPU_DEBUG_CMDENC(cmd_enc, "pp %d\n", phys_enc->hw_pp->idx - PINGPONG_0);
+
+	if (phys_enc->enable_state == DPU_ENC_ENABLED) {
+		DPU_ERROR("already enabled\n");
+		return;
+	}
+
+	dpu_encoder_phys_cmd_enable_helper(phys_enc);
+	phys_enc->enable_state = DPU_ENC_ENABLED;
+}
+
+static void _dpu_encoder_phys_cmd_connect_te(
+		struct dpu_encoder_phys *phys_enc, bool enable)
+{
+	if (phys_enc->has_intf_te) {
+		if (!phys_enc->hw_intf || !phys_enc->hw_intf->ops.connect_external_te)
+			return;
+
+		trace_dpu_enc_phys_cmd_connect_te(DRMID(phys_enc->parent), enable);
+		phys_enc->hw_intf->ops.connect_external_te(phys_enc->hw_intf, enable);
+	} else {
+		if (!phys_enc->hw_pp || !phys_enc->hw_pp->ops.connect_external_te)
+			return;
+
+		trace_dpu_enc_phys_cmd_connect_te(DRMID(phys_enc->parent), enable);
+		phys_enc->hw_pp->ops.connect_external_te(phys_enc->hw_pp, enable);
+	}
+}
+
+static void dpu_encoder_phys_cmd_prepare_idle_pc(
+		struct dpu_encoder_phys *phys_enc)
+{
+	_dpu_encoder_phys_cmd_connect_te(phys_enc, false);
+}
+
+static int dpu_encoder_phys_cmd_get_line_count(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_pingpong *hw_pp;
+	struct dpu_hw_intf *hw_intf;
+
+	if (!dpu_encoder_phys_cmd_is_master(phys_enc))
+		return -EINVAL;
+
+	if (phys_enc->has_intf_te) {
+		hw_intf = phys_enc->hw_intf;
+		if (!hw_intf || !hw_intf->ops.get_line_count)
+			return -EINVAL;
+		return hw_intf->ops.get_line_count(hw_intf);
+	}
+
+	hw_pp = phys_enc->hw_pp;
+	if (!hw_pp || !hw_pp->ops.get_line_count)
+		return -EINVAL;
+	return hw_pp->ops.get_line_count(hw_pp);
+}
+
+static void dpu_encoder_phys_cmd_disable(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_cmd *cmd_enc =
+		to_dpu_encoder_phys_cmd(phys_enc);
+	struct dpu_hw_ctl *ctl;
+
+	if (phys_enc->enable_state == DPU_ENC_DISABLED) {
+		DPU_ERROR_CMDENC(cmd_enc, "already disabled\n");
+		return;
+	}
+
+	if (phys_enc->has_intf_te) {
+		DRM_DEBUG_KMS("id:%u intf:%d state:%d\n", DRMID(phys_enc->parent),
+			      phys_enc->hw_intf->idx - INTF_0,
+			      phys_enc->enable_state);
+
+		if (phys_enc->hw_intf->ops.disable_tearcheck)
+			phys_enc->hw_intf->ops.disable_tearcheck(phys_enc->hw_intf);
+	} else {
+		if (!phys_enc->hw_pp) {
+			DPU_ERROR("invalid encoder\n");
+			return;
+		}
+
+		DRM_DEBUG_KMS("id:%u pp:%d state:%d\n", DRMID(phys_enc->parent),
+			      phys_enc->hw_pp->idx - PINGPONG_0,
+			      phys_enc->enable_state);
+
+		if (phys_enc->hw_pp->ops.disable_tearcheck)
+			phys_enc->hw_pp->ops.disable_tearcheck(phys_enc->hw_pp);
+	}
+
+	if (phys_enc->hw_intf->ops.bind_pingpong_blk) {
+		phys_enc->hw_intf->ops.bind_pingpong_blk(
+				phys_enc->hw_intf,
+				PINGPONG_NONE);
+
+		ctl = phys_enc->hw_ctl;
+		ctl->ops.update_pending_flush_intf(ctl, phys_enc->hw_intf->idx);
+	}
+
+	phys_enc->enable_state = DPU_ENC_DISABLED;
+}
+
+static void dpu_encoder_phys_cmd_prepare_for_kickoff(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_cmd *cmd_enc =
+			to_dpu_encoder_phys_cmd(phys_enc);
+	int ret;
+
+	if (!phys_enc->hw_pp) {
+		DPU_ERROR("invalid encoder\n");
+		return;
+	}
+	DRM_DEBUG_KMS("id:%u pp:%d pending_cnt:%d\n", DRMID(phys_enc->parent),
+		      phys_enc->hw_pp->idx - PINGPONG_0,
+		      atomic_read(&phys_enc->pending_kickoff_cnt));
+
+	/*
+	 * Mark kickoff request as outstanding. If there are more than one,
+	 * outstanding, then we have to wait for the previous one to complete
+	 */
+	ret = _dpu_encoder_phys_cmd_wait_for_idle(phys_enc);
+	if (ret) {
+		/* force pending_kickoff_cnt 0 to discard failed kickoff */
+		atomic_set(&phys_enc->pending_kickoff_cnt, 0);
+		DRM_ERROR("failed wait_for_idle: id:%u ret:%d pp:%d\n",
+			  DRMID(phys_enc->parent), ret,
+			  phys_enc->hw_pp->idx - PINGPONG_0);
+	}
+
+	dpu_encoder_phys_cmd_enable_te(phys_enc);
+
+	DPU_DEBUG_CMDENC(cmd_enc, "pp:%d pending_cnt %d\n",
+			phys_enc->hw_pp->idx - PINGPONG_0,
+			atomic_read(&phys_enc->pending_kickoff_cnt));
+}
+
+static void dpu_encoder_phys_cmd_enable_te(struct dpu_encoder_phys *phys_enc)
+{
+	if (!phys_enc)
+		return;
+	if (!dpu_encoder_phys_cmd_is_master(phys_enc))
+		return;
+
+	if (phys_enc->has_intf_te) {
+		if (!phys_enc->hw_intf->ops.disable_autorefresh)
+			return;
+
+		phys_enc->hw_intf->ops.disable_autorefresh(
+				phys_enc->hw_intf,
+				DRMID(phys_enc->parent),
+				phys_enc->cached_mode.vdisplay);
+	} else {
+		if (!phys_enc->hw_pp ||
+		    !phys_enc->hw_pp->ops.disable_autorefresh)
+			return;
+
+		phys_enc->hw_pp->ops.disable_autorefresh(
+				phys_enc->hw_pp,
+				DRMID(phys_enc->parent),
+				phys_enc->cached_mode.vdisplay);
+	}
+}
+
+static int _dpu_encoder_phys_cmd_wait_for_ctl_start(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_cmd *cmd_enc =
+			to_dpu_encoder_phys_cmd(phys_enc);
+	struct dpu_encoder_wait_info wait_info;
+	int ret;
+
+	wait_info.wq = &phys_enc->pending_kickoff_wq;
+	wait_info.atomic_cnt = &phys_enc->pending_ctlstart_cnt;
+	wait_info.timeout_ms = KICKOFF_TIMEOUT_MS;
+
+	ret = dpu_encoder_helper_wait_for_irq(phys_enc,
+			phys_enc->irq[INTR_IDX_CTL_START],
+			dpu_encoder_phys_cmd_ctl_start_irq,
+			&wait_info);
+	if (ret == -ETIMEDOUT) {
+		DPU_ERROR_CMDENC(cmd_enc, "ctl start interrupt wait failed\n");
+		ret = -EINVAL;
+	} else if (!ret)
+		ret = 0;
+
+	return ret;
+}
+
+static int dpu_encoder_phys_cmd_wait_for_tx_complete(
+		struct dpu_encoder_phys *phys_enc)
+{
+	int rc;
+
+	rc = _dpu_encoder_phys_cmd_wait_for_idle(phys_enc);
+	if (rc) {
+		DRM_ERROR("failed wait_for_idle: id:%u ret:%d intf:%d\n",
+			  DRMID(phys_enc->parent), rc,
+			  phys_enc->hw_intf->idx - INTF_0);
+	}
+
+	return rc;
+}
+
+static int dpu_encoder_phys_cmd_wait_for_commit_done(
+		struct dpu_encoder_phys *phys_enc)
+{
+	/* only required for master controller */
+	if (!dpu_encoder_phys_cmd_is_master(phys_enc))
+		return 0;
+
+	if (phys_enc->hw_ctl->ops.is_started(phys_enc->hw_ctl))
+		return dpu_encoder_phys_cmd_wait_for_tx_complete(phys_enc);
+
+	return _dpu_encoder_phys_cmd_wait_for_ctl_start(phys_enc);
+}
+
+static void dpu_encoder_phys_cmd_handle_post_kickoff(
+		struct dpu_encoder_phys *phys_enc)
+{
+	/**
+	 * re-enable external TE, either for the first time after enabling
+	 * or if disabled for Autorefresh
+	 */
+	_dpu_encoder_phys_cmd_connect_te(phys_enc, true);
+}
+
+static void dpu_encoder_phys_cmd_trigger_start(
+		struct dpu_encoder_phys *phys_enc)
+{
+	dpu_encoder_helper_trigger_start(phys_enc);
+}
+
+static void dpu_encoder_phys_cmd_init_ops(
+		struct dpu_encoder_phys_ops *ops)
+{
+	ops->is_master = dpu_encoder_phys_cmd_is_master;
+	ops->atomic_mode_set = dpu_encoder_phys_cmd_atomic_mode_set;
+	ops->enable = dpu_encoder_phys_cmd_enable;
+	ops->disable = dpu_encoder_phys_cmd_disable;
+	ops->control_vblank_irq = dpu_encoder_phys_cmd_control_vblank_irq;
+	ops->wait_for_commit_done = dpu_encoder_phys_cmd_wait_for_commit_done;
+	ops->prepare_for_kickoff = dpu_encoder_phys_cmd_prepare_for_kickoff;
+	ops->wait_for_tx_complete = dpu_encoder_phys_cmd_wait_for_tx_complete;
+	ops->trigger_start = dpu_encoder_phys_cmd_trigger_start;
+	ops->needs_single_flush = dpu_encoder_phys_cmd_needs_single_flush;
+	ops->irq_control = dpu_encoder_phys_cmd_irq_control;
+	ops->restore = dpu_encoder_phys_cmd_enable_helper;
+	ops->prepare_idle_pc = dpu_encoder_phys_cmd_prepare_idle_pc;
+	ops->handle_post_kickoff = dpu_encoder_phys_cmd_handle_post_kickoff;
+	ops->get_line_count = dpu_encoder_phys_cmd_get_line_count;
+}
+
+struct dpu_encoder_phys *dpu_encoder_phys_cmd_init(struct drm_device *dev,
+		struct dpu_enc_phys_init_params *p)
+{
+	struct dpu_encoder_phys *phys_enc = NULL;
+	struct dpu_encoder_phys_cmd *cmd_enc = NULL;
+
+	DPU_DEBUG("intf\n");
+
+	cmd_enc = drmm_kzalloc(dev, sizeof(*cmd_enc), GFP_KERNEL);
+	if (!cmd_enc) {
+		DPU_ERROR("failed to allocate\n");
+		return ERR_PTR(-ENOMEM);
+	}
+	phys_enc = &cmd_enc->base;
+
+	dpu_encoder_phys_init(phys_enc, p);
+
+	mutex_init(&phys_enc->vblank_ctl_lock);
+	phys_enc->vblank_refcount = 0;
+
+	dpu_encoder_phys_cmd_init_ops(&phys_enc->ops);
+	phys_enc->intf_mode = INTF_MODE_CMD;
+	cmd_enc->stream_sel = 0;
+
+	if (!phys_enc->hw_intf) {
+		DPU_ERROR_CMDENC(cmd_enc, "no INTF provided\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	/* DPU before 5.0 use PINGPONG for TE handling */
+	if (phys_enc->dpu_kms->catalog->mdss_ver->core_major_ver >= 5)
+		phys_enc->has_intf_te = true;
+
+	if (phys_enc->has_intf_te && !phys_enc->hw_intf->ops.enable_tearcheck) {
+		DPU_ERROR_CMDENC(cmd_enc, "tearcheck not supported\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	atomic_set(&cmd_enc->pending_vblank_cnt, 0);
+	init_waitqueue_head(&cmd_enc->pending_vblank_wq);
+
+	DPU_DEBUG_CMDENC(cmd_enc, "created\n");
+
+	return phys_enc;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder_phys_vid.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder_phys_vid.c
@@ -0,0 +1,751 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, 2020-2021 The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+#include "dpu_encoder_phys.h"
+#include "dpu_hw_interrupts.h"
+#include "dpu_hw_merge3d.h"
+#include "dpu_core_irq.h"
+#include "dpu_formats.h"
+#include "dpu_trace.h"
+#include "disp/msm_disp_snapshot.h"
+
+#include <drm/drm_managed.h>
+
+#define DPU_DEBUG_VIDENC(e, fmt, ...) DPU_DEBUG("enc%d intf%d " fmt, \
+		(e) && (e)->parent ? \
+		(e)->parent->base.id : -1, \
+		(e) && (e)->hw_intf ? \
+		(e)->hw_intf->idx - INTF_0 : -1, ##__VA_ARGS__)
+
+#define DPU_ERROR_VIDENC(e, fmt, ...) DPU_ERROR("enc%d intf%d " fmt, \
+		(e) && (e)->parent ? \
+		(e)->parent->base.id : -1, \
+		(e) && (e)->hw_intf ? \
+		(e)->hw_intf->idx - INTF_0 : -1, ##__VA_ARGS__)
+
+#define to_dpu_encoder_phys_vid(x) \
+	container_of(x, struct dpu_encoder_phys_vid, base)
+
+static bool dpu_encoder_phys_vid_is_master(
+		struct dpu_encoder_phys *phys_enc)
+{
+	bool ret = false;
+
+	if (phys_enc->split_role != ENC_ROLE_SLAVE)
+		ret = true;
+
+	return ret;
+}
+
+static void drm_mode_to_intf_timing_params(
+		const struct dpu_encoder_phys *phys_enc,
+		const struct drm_display_mode *mode,
+		struct dpu_hw_intf_timing_params *timing)
+{
+	memset(timing, 0, sizeof(*timing));
+
+	if ((mode->htotal < mode->hsync_end)
+			|| (mode->hsync_start < mode->hdisplay)
+			|| (mode->vtotal < mode->vsync_end)
+			|| (mode->vsync_start < mode->vdisplay)
+			|| (mode->hsync_end < mode->hsync_start)
+			|| (mode->vsync_end < mode->vsync_start)) {
+		DPU_ERROR(
+		    "invalid params - hstart:%d,hend:%d,htot:%d,hdisplay:%d\n",
+				mode->hsync_start, mode->hsync_end,
+				mode->htotal, mode->hdisplay);
+		DPU_ERROR("vstart:%d,vend:%d,vtot:%d,vdisplay:%d\n",
+				mode->vsync_start, mode->vsync_end,
+				mode->vtotal, mode->vdisplay);
+		return;
+	}
+
+	/*
+	 * https://www.kernel.org/doc/htmldocs/drm/ch02s05.html
+	 *  Active Region      Front Porch   Sync   Back Porch
+	 * <-----------------><------------><-----><----------->
+	 * <- [hv]display --->
+	 * <--------- [hv]sync_start ------>
+	 * <----------------- [hv]sync_end ------->
+	 * <---------------------------- [hv]total ------------->
+	 */
+	timing->width = mode->hdisplay;	/* active width */
+	timing->height = mode->vdisplay;	/* active height */
+	timing->xres = timing->width;
+	timing->yres = timing->height;
+	timing->h_back_porch = mode->htotal - mode->hsync_end;
+	timing->h_front_porch = mode->hsync_start - mode->hdisplay;
+	timing->v_back_porch = mode->vtotal - mode->vsync_end;
+	timing->v_front_porch = mode->vsync_start - mode->vdisplay;
+	timing->hsync_pulse_width = mode->hsync_end - mode->hsync_start;
+	timing->vsync_pulse_width = mode->vsync_end - mode->vsync_start;
+	timing->hsync_polarity = (mode->flags & DRM_MODE_FLAG_NHSYNC) ? 1 : 0;
+	timing->vsync_polarity = (mode->flags & DRM_MODE_FLAG_NVSYNC) ? 1 : 0;
+	timing->border_clr = 0;
+	timing->underflow_clr = 0xff;
+	timing->hsync_skew = mode->hskew;
+
+	/* DSI controller cannot handle active-low sync signals. */
+	if (phys_enc->hw_intf->cap->type == INTF_DSI) {
+		timing->hsync_polarity = 0;
+		timing->vsync_polarity = 0;
+	}
+
+	/* for DP/EDP, Shift timings to align it to bottom right */
+	if (phys_enc->hw_intf->cap->type == INTF_DP) {
+		timing->h_back_porch += timing->h_front_porch;
+		timing->h_front_porch = 0;
+		timing->v_back_porch += timing->v_front_porch;
+		timing->v_front_porch = 0;
+	}
+
+	timing->wide_bus_en = dpu_encoder_is_widebus_enabled(phys_enc->parent);
+	timing->compression_en = dpu_encoder_is_dsc_enabled(phys_enc->parent);
+
+	/*
+	 * for DP, divide the horizonal parameters by 2 when
+	 * widebus is enabled
+	 */
+	if (phys_enc->hw_intf->cap->type == INTF_DP && timing->wide_bus_en) {
+		timing->width = timing->width >> 1;
+		timing->xres = timing->xres >> 1;
+		timing->h_back_porch = timing->h_back_porch >> 1;
+		timing->h_front_porch = timing->h_front_porch >> 1;
+		timing->hsync_pulse_width = timing->hsync_pulse_width >> 1;
+	}
+}
+
+static u32 get_horizontal_total(const struct dpu_hw_intf_timing_params *timing)
+{
+	u32 active = timing->xres;
+	u32 inactive =
+	    timing->h_back_porch + timing->h_front_porch +
+	    timing->hsync_pulse_width;
+	return active + inactive;
+}
+
+static u32 get_vertical_total(const struct dpu_hw_intf_timing_params *timing)
+{
+	u32 active = timing->yres;
+	u32 inactive =
+	    timing->v_back_porch + timing->v_front_porch +
+	    timing->vsync_pulse_width;
+	return active + inactive;
+}
+
+/*
+ * programmable_fetch_get_num_lines:
+ *	Number of fetch lines in vertical front porch
+ * @timing: Pointer to the intf timing information for the requested mode
+ *
+ * Returns the number of fetch lines in vertical front porch at which mdp
+ * can start fetching the next frame.
+ *
+ * Number of needed prefetch lines is anything that cannot be absorbed in the
+ * start of frame time (back porch + vsync pulse width).
+ *
+ * Some panels have very large VFP, however we only need a total number of
+ * lines based on the chip worst case latencies.
+ */
+static u32 programmable_fetch_get_num_lines(
+		struct dpu_encoder_phys *phys_enc,
+		const struct dpu_hw_intf_timing_params *timing)
+{
+	u32 worst_case_needed_lines =
+	    phys_enc->hw_intf->cap->prog_fetch_lines_worst_case;
+	u32 start_of_frame_lines =
+	    timing->v_back_porch + timing->vsync_pulse_width;
+	u32 needed_vfp_lines = worst_case_needed_lines - start_of_frame_lines;
+	u32 actual_vfp_lines = 0;
+
+	/* Fetch must be outside active lines, otherwise undefined. */
+	if (start_of_frame_lines >= worst_case_needed_lines) {
+		DPU_DEBUG_VIDENC(phys_enc,
+				"prog fetch is not needed, large vbp+vsw\n");
+		actual_vfp_lines = 0;
+	} else if (timing->v_front_porch < needed_vfp_lines) {
+		/* Warn fetch needed, but not enough porch in panel config */
+		pr_warn_once
+			("low vbp+vfp may lead to perf issues in some cases\n");
+		DPU_DEBUG_VIDENC(phys_enc,
+				"less vfp than fetch req, using entire vfp\n");
+		actual_vfp_lines = timing->v_front_porch;
+	} else {
+		DPU_DEBUG_VIDENC(phys_enc, "room in vfp for needed prefetch\n");
+		actual_vfp_lines = needed_vfp_lines;
+	}
+
+	DPU_DEBUG_VIDENC(phys_enc,
+		"v_front_porch %u v_back_porch %u vsync_pulse_width %u\n",
+		timing->v_front_porch, timing->v_back_porch,
+		timing->vsync_pulse_width);
+	DPU_DEBUG_VIDENC(phys_enc,
+		"wc_lines %u needed_vfp_lines %u actual_vfp_lines %u\n",
+		worst_case_needed_lines, needed_vfp_lines, actual_vfp_lines);
+
+	return actual_vfp_lines;
+}
+
+/*
+ * programmable_fetch_config: Programs HW to prefetch lines by offsetting
+ *	the start of fetch into the vertical front porch for cases where the
+ *	vsync pulse width and vertical back porch time is insufficient
+ *
+ *	Gets # of lines to pre-fetch, then calculate VSYNC counter value.
+ *	HW layer requires VSYNC counter of first pixel of tgt VFP line.
+ *
+ * @timing: Pointer to the intf timing information for the requested mode
+ */
+static void programmable_fetch_config(struct dpu_encoder_phys *phys_enc,
+				      const struct dpu_hw_intf_timing_params *timing)
+{
+	struct dpu_hw_intf_prog_fetch f = { 0 };
+	u32 vfp_fetch_lines = 0;
+	u32 horiz_total = 0;
+	u32 vert_total = 0;
+	u32 vfp_fetch_start_vsync_counter = 0;
+	unsigned long lock_flags;
+
+	if (WARN_ON_ONCE(!phys_enc->hw_intf->ops.setup_prg_fetch))
+		return;
+
+	vfp_fetch_lines = programmable_fetch_get_num_lines(phys_enc, timing);
+	if (vfp_fetch_lines) {
+		vert_total = get_vertical_total(timing);
+		horiz_total = get_horizontal_total(timing);
+		vfp_fetch_start_vsync_counter =
+		    (vert_total - vfp_fetch_lines) * horiz_total + 1;
+		f.enable = 1;
+		f.fetch_start = vfp_fetch_start_vsync_counter;
+	}
+
+	DPU_DEBUG_VIDENC(phys_enc,
+		"vfp_fetch_lines %u vfp_fetch_start_vsync_counter %u\n",
+		vfp_fetch_lines, vfp_fetch_start_vsync_counter);
+
+	spin_lock_irqsave(phys_enc->enc_spinlock, lock_flags);
+	phys_enc->hw_intf->ops.setup_prg_fetch(phys_enc->hw_intf, &f);
+	spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
+}
+
+static void dpu_encoder_phys_vid_setup_timing_engine(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct drm_display_mode mode;
+	struct dpu_hw_intf_timing_params timing_params = { 0 };
+	const struct dpu_format *fmt = NULL;
+	u32 fmt_fourcc;
+	unsigned long lock_flags;
+	struct dpu_hw_intf_cfg intf_cfg = { 0 };
+
+	drm_mode_init(&mode, &phys_enc->cached_mode);
+
+	if (!phys_enc->hw_ctl->ops.setup_intf_cfg) {
+		DPU_ERROR("invalid encoder %d\n", phys_enc != NULL);
+		return;
+	}
+
+	if (!phys_enc->hw_intf->ops.setup_timing_gen) {
+		DPU_ERROR("timing engine setup is not supported\n");
+		return;
+	}
+
+	DPU_DEBUG_VIDENC(phys_enc, "enabling mode:\n");
+	drm_mode_debug_printmodeline(&mode);
+
+	fmt_fourcc = dpu_encoder_get_drm_fmt(phys_enc);
+
+	if (phys_enc->split_role != ENC_ROLE_SOLO || fmt_fourcc == DRM_FORMAT_YUV420) {
+		mode.hdisplay >>= 1;
+		mode.htotal >>= 1;
+		mode.hsync_start >>= 1;
+		mode.hsync_end >>= 1;
+		mode.hskew >>= 1;
+
+		DPU_DEBUG_VIDENC(phys_enc,
+			"split_role %d, halve horizontal %d %d %d %d %d\n",
+			phys_enc->split_role,
+			mode.hdisplay, mode.htotal,
+			mode.hsync_start, mode.hsync_end,
+			mode.hskew);
+	}
+
+	drm_mode_to_intf_timing_params(phys_enc, &mode, &timing_params);
+
+	fmt = dpu_get_dpu_format(fmt_fourcc);
+	DPU_DEBUG_VIDENC(phys_enc, "fmt_fourcc 0x%X\n", fmt_fourcc);
+
+	if (phys_enc->hw_cdm)
+		intf_cfg.cdm = phys_enc->hw_cdm->idx;
+	intf_cfg.intf = phys_enc->hw_intf->idx;
+	intf_cfg.intf_mode_sel = DPU_CTL_MODE_SEL_VID;
+	intf_cfg.stream_sel = 0; /* Don't care value for video mode */
+	intf_cfg.mode_3d = dpu_encoder_helper_get_3d_blend_mode(phys_enc);
+	intf_cfg.dsc = dpu_encoder_helper_get_dsc(phys_enc);
+	if (phys_enc->hw_pp->merge_3d)
+		intf_cfg.merge_3d = phys_enc->hw_pp->merge_3d->idx;
+
+	spin_lock_irqsave(phys_enc->enc_spinlock, lock_flags);
+	phys_enc->hw_intf->ops.setup_timing_gen(phys_enc->hw_intf,
+			&timing_params, fmt);
+	phys_enc->hw_ctl->ops.setup_intf_cfg(phys_enc->hw_ctl, &intf_cfg);
+
+	/* setup which pp blk will connect to this intf */
+	if (phys_enc->hw_intf->ops.bind_pingpong_blk)
+		phys_enc->hw_intf->ops.bind_pingpong_blk(
+				phys_enc->hw_intf,
+				phys_enc->hw_pp->idx);
+
+	if (phys_enc->hw_pp->merge_3d)
+		phys_enc->hw_pp->merge_3d->ops.setup_3d_mode(phys_enc->hw_pp->merge_3d, intf_cfg.mode_3d);
+
+	spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
+
+	programmable_fetch_config(phys_enc, &timing_params);
+}
+
+static void dpu_encoder_phys_vid_vblank_irq(void *arg)
+{
+	struct dpu_encoder_phys *phys_enc = arg;
+	struct dpu_hw_ctl *hw_ctl;
+	unsigned long lock_flags;
+	u32 flush_register = 0;
+
+	hw_ctl = phys_enc->hw_ctl;
+
+	DPU_ATRACE_BEGIN("vblank_irq");
+
+	dpu_encoder_vblank_callback(phys_enc->parent, phys_enc);
+
+	atomic_read(&phys_enc->pending_kickoff_cnt);
+
+	/*
+	 * only decrement the pending flush count if we've actually flushed
+	 * hardware. due to sw irq latency, vblank may have already happened
+	 * so we need to double-check with hw that it accepted the flush bits
+	 */
+	spin_lock_irqsave(phys_enc->enc_spinlock, lock_flags);
+	if (hw_ctl->ops.get_flush_register)
+		flush_register = hw_ctl->ops.get_flush_register(hw_ctl);
+
+	if (!(flush_register & hw_ctl->ops.get_pending_flush(hw_ctl)))
+		atomic_add_unless(&phys_enc->pending_kickoff_cnt, -1, 0);
+	spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
+
+	/* Signal any waiting atomic commit thread */
+	wake_up_all(&phys_enc->pending_kickoff_wq);
+
+	dpu_encoder_frame_done_callback(phys_enc->parent, phys_enc,
+			DPU_ENCODER_FRAME_EVENT_DONE);
+
+	DPU_ATRACE_END("vblank_irq");
+}
+
+static void dpu_encoder_phys_vid_underrun_irq(void *arg)
+{
+	struct dpu_encoder_phys *phys_enc = arg;
+
+	dpu_encoder_underrun_callback(phys_enc->parent, phys_enc);
+}
+
+static bool dpu_encoder_phys_vid_needs_single_flush(
+		struct dpu_encoder_phys *phys_enc)
+{
+	return phys_enc->split_role != ENC_ROLE_SOLO;
+}
+
+static void dpu_encoder_phys_vid_atomic_mode_set(
+		struct dpu_encoder_phys *phys_enc,
+		struct drm_crtc_state *crtc_state,
+		struct drm_connector_state *conn_state)
+{
+	phys_enc->irq[INTR_IDX_VSYNC] = phys_enc->hw_intf->cap->intr_vsync;
+
+	phys_enc->irq[INTR_IDX_UNDERRUN] = phys_enc->hw_intf->cap->intr_underrun;
+}
+
+static int dpu_encoder_phys_vid_control_vblank_irq(
+		struct dpu_encoder_phys *phys_enc,
+		bool enable)
+{
+	int ret = 0;
+	int refcount;
+
+	mutex_lock(&phys_enc->vblank_ctl_lock);
+	refcount = phys_enc->vblank_refcount;
+
+	/* Slave encoders don't report vblank */
+	if (!dpu_encoder_phys_vid_is_master(phys_enc))
+		goto end;
+
+	/* protect against negative */
+	if (!enable && refcount == 0) {
+		ret = -EINVAL;
+		goto end;
+	}
+
+	DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable,
+		      refcount);
+
+	if (enable) {
+		if (phys_enc->vblank_refcount == 0)
+			ret = dpu_core_irq_register_callback(phys_enc->dpu_kms,
+					phys_enc->irq[INTR_IDX_VSYNC],
+					dpu_encoder_phys_vid_vblank_irq,
+					phys_enc);
+		if (!ret)
+			phys_enc->vblank_refcount++;
+	} else if (!enable) {
+		if (phys_enc->vblank_refcount == 1)
+			ret = dpu_core_irq_unregister_callback(phys_enc->dpu_kms,
+					phys_enc->irq[INTR_IDX_VSYNC]);
+		if (!ret)
+			phys_enc->vblank_refcount--;
+	}
+
+end:
+	mutex_unlock(&phys_enc->vblank_ctl_lock);
+	if (ret) {
+		DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n",
+			  DRMID(phys_enc->parent),
+			  phys_enc->hw_intf->idx - INTF_0, ret, enable,
+			  refcount);
+	}
+	return ret;
+}
+
+static void dpu_encoder_phys_vid_enable(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_ctl *ctl;
+	const struct dpu_format *fmt;
+	u32 fmt_fourcc;
+
+	ctl = phys_enc->hw_ctl;
+	fmt_fourcc = dpu_encoder_get_drm_fmt(phys_enc);
+	fmt = dpu_get_dpu_format(fmt_fourcc);
+
+	DPU_DEBUG_VIDENC(phys_enc, "\n");
+
+	if (WARN_ON(!phys_enc->hw_intf->ops.enable_timing))
+		return;
+
+	dpu_encoder_helper_split_config(phys_enc, phys_enc->hw_intf->idx);
+
+	dpu_encoder_helper_phys_setup_cdm(phys_enc, fmt, CDM_CDWN_OUTPUT_HDMI);
+
+	dpu_encoder_phys_vid_setup_timing_engine(phys_enc);
+
+	/*
+	 * For single flush cases (dual-ctl or pp-split), skip setting the
+	 * flush bit for the slave intf, since both intfs use same ctl
+	 * and HW will only flush the master.
+	 */
+	if (dpu_encoder_phys_vid_needs_single_flush(phys_enc) &&
+		!dpu_encoder_phys_vid_is_master(phys_enc))
+		goto skip_flush;
+
+	ctl->ops.update_pending_flush_intf(ctl, phys_enc->hw_intf->idx);
+	if (ctl->ops.update_pending_flush_merge_3d && phys_enc->hw_pp->merge_3d)
+		ctl->ops.update_pending_flush_merge_3d(ctl, phys_enc->hw_pp->merge_3d->idx);
+
+	if (ctl->ops.update_pending_flush_cdm && phys_enc->hw_cdm)
+		ctl->ops.update_pending_flush_cdm(ctl, phys_enc->hw_cdm->idx);
+
+	/*
+	 * Peripheral flush must be updated whenever flushing SDP packets is needed.
+	 * SDP packets are required for any YUV format (YUV420, YUV422, YUV444).
+	 */
+	if (ctl->ops.update_pending_flush_periph && dpu_encoder_needs_periph_flush(phys_enc))
+		ctl->ops.update_pending_flush_periph(ctl, phys_enc->hw_intf->idx);
+
+skip_flush:
+	DPU_DEBUG_VIDENC(phys_enc,
+		"update pending flush ctl %d intf %d\n",
+		ctl->idx - CTL_0, phys_enc->hw_intf->idx);
+
+	atomic_set(&phys_enc->underrun_cnt, 0);
+
+	/* ctl_flush & timing engine enable will be triggered by framework */
+	if (phys_enc->enable_state == DPU_ENC_DISABLED)
+		phys_enc->enable_state = DPU_ENC_ENABLING;
+}
+
+static int dpu_encoder_phys_vid_wait_for_tx_complete(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_wait_info wait_info;
+	int ret;
+
+	wait_info.wq = &phys_enc->pending_kickoff_wq;
+	wait_info.atomic_cnt = &phys_enc->pending_kickoff_cnt;
+	wait_info.timeout_ms = KICKOFF_TIMEOUT_MS;
+
+	if (!dpu_encoder_phys_vid_is_master(phys_enc)) {
+		return 0;
+	}
+
+	/* Wait for kickoff to complete */
+	ret = dpu_encoder_helper_wait_for_irq(phys_enc,
+			phys_enc->irq[INTR_IDX_VSYNC],
+			dpu_encoder_phys_vid_vblank_irq,
+			&wait_info);
+
+	if (ret == -ETIMEDOUT) {
+		dpu_encoder_helper_report_irq_timeout(phys_enc, INTR_IDX_VSYNC);
+	}
+
+	return ret;
+}
+
+static int dpu_encoder_phys_vid_wait_for_commit_done(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_ctl *hw_ctl = phys_enc->hw_ctl;
+	int ret;
+
+	if (!hw_ctl)
+		return 0;
+
+	ret = wait_event_timeout(phys_enc->pending_kickoff_wq,
+		(hw_ctl->ops.get_flush_register(hw_ctl) == 0),
+		msecs_to_jiffies(50));
+	if (ret <= 0) {
+		DPU_ERROR("vblank timeout\n");
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+static void dpu_encoder_phys_vid_prepare_for_kickoff(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_ctl *ctl;
+	int rc;
+	struct drm_encoder *drm_enc;
+
+	drm_enc = phys_enc->parent;
+
+	ctl = phys_enc->hw_ctl;
+	if (!ctl->ops.wait_reset_status)
+		return;
+
+	/*
+	 * hw supports hardware initiated ctl reset, so before we kickoff a new
+	 * frame, need to check and wait for hw initiated ctl reset completion
+	 */
+	rc = ctl->ops.wait_reset_status(ctl);
+	if (rc) {
+		DPU_ERROR_VIDENC(phys_enc, "ctl %d reset failure: %d\n",
+				ctl->idx, rc);
+		msm_disp_snapshot_state(drm_enc->dev);
+		dpu_core_irq_unregister_callback(phys_enc->dpu_kms,
+				phys_enc->irq[INTR_IDX_VSYNC]);
+	}
+}
+
+static void dpu_encoder_phys_vid_disable(struct dpu_encoder_phys *phys_enc)
+{
+	unsigned long lock_flags;
+	int ret;
+	struct dpu_hw_intf_status intf_status = {0};
+
+	if (!phys_enc->parent || !phys_enc->parent->dev) {
+		DPU_ERROR("invalid encoder/device\n");
+		return;
+	}
+
+	if (!phys_enc->hw_intf) {
+		DPU_ERROR("invalid hw_intf %d hw_ctl %d\n",
+				phys_enc->hw_intf != NULL, phys_enc->hw_ctl != NULL);
+		return;
+	}
+
+	if (WARN_ON(!phys_enc->hw_intf->ops.enable_timing))
+		return;
+
+	if (phys_enc->enable_state == DPU_ENC_DISABLED) {
+		DPU_ERROR("already disabled\n");
+		return;
+	}
+
+	spin_lock_irqsave(phys_enc->enc_spinlock, lock_flags);
+	phys_enc->hw_intf->ops.enable_timing(phys_enc->hw_intf, 0);
+	if (dpu_encoder_phys_vid_is_master(phys_enc))
+		dpu_encoder_phys_inc_pending(phys_enc);
+	spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
+
+	/*
+	 * Wait for a vsync so we know the ENABLE=0 latched before
+	 * the (connector) source of the vsync's gets disabled,
+	 * otherwise we end up in a funny state if we re-enable
+	 * before the disable latches, which results that some of
+	 * the settings changes for the new modeset (like new
+	 * scanout buffer) don't latch properly..
+	 */
+	if (dpu_encoder_phys_vid_is_master(phys_enc)) {
+		ret = dpu_encoder_phys_vid_wait_for_tx_complete(phys_enc);
+		if (ret) {
+			atomic_set(&phys_enc->pending_kickoff_cnt, 0);
+			DRM_ERROR("wait disable failed: id:%u intf:%d ret:%d\n",
+				  DRMID(phys_enc->parent),
+				  phys_enc->hw_intf->idx - INTF_0, ret);
+		}
+	}
+
+	if (phys_enc->hw_intf && phys_enc->hw_intf->ops.get_status)
+		phys_enc->hw_intf->ops.get_status(phys_enc->hw_intf, &intf_status);
+
+	/*
+	 * Wait for a vsync if timing en status is on after timing engine
+	 * is disabled.
+	 */
+	if (intf_status.is_en && dpu_encoder_phys_vid_is_master(phys_enc)) {
+		spin_lock_irqsave(phys_enc->enc_spinlock, lock_flags);
+		dpu_encoder_phys_inc_pending(phys_enc);
+		spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
+		ret = dpu_encoder_phys_vid_wait_for_tx_complete(phys_enc);
+		if (ret) {
+			atomic_set(&phys_enc->pending_kickoff_cnt, 0);
+			DRM_ERROR("wait disable failed: id:%u intf:%d ret:%d\n",
+				  DRMID(phys_enc->parent),
+				  phys_enc->hw_intf->idx - INTF_0, ret);
+		}
+	}
+
+	dpu_encoder_helper_phys_cleanup(phys_enc);
+	phys_enc->enable_state = DPU_ENC_DISABLED;
+}
+
+static void dpu_encoder_phys_vid_handle_post_kickoff(
+		struct dpu_encoder_phys *phys_enc)
+{
+	unsigned long lock_flags;
+
+	/*
+	 * Video mode must flush CTL before enabling timing engine
+	 * Video encoders need to turn on their interfaces now
+	 */
+	if (phys_enc->enable_state == DPU_ENC_ENABLING) {
+		trace_dpu_enc_phys_vid_post_kickoff(DRMID(phys_enc->parent),
+				    phys_enc->hw_intf->idx - INTF_0);
+		spin_lock_irqsave(phys_enc->enc_spinlock, lock_flags);
+		phys_enc->hw_intf->ops.enable_timing(phys_enc->hw_intf, 1);
+		spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
+		phys_enc->enable_state = DPU_ENC_ENABLED;
+	}
+}
+
+static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc,
+		bool enable)
+{
+	int ret;
+
+	trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent),
+			    phys_enc->hw_intf->idx - INTF_0,
+			    enable,
+			   phys_enc->vblank_refcount);
+
+	if (enable) {
+		ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true);
+		if (WARN_ON(ret))
+			return;
+
+		dpu_core_irq_register_callback(phys_enc->dpu_kms,
+				phys_enc->irq[INTR_IDX_UNDERRUN],
+				dpu_encoder_phys_vid_underrun_irq,
+				phys_enc);
+	} else {
+		dpu_encoder_phys_vid_control_vblank_irq(phys_enc, false);
+		dpu_core_irq_unregister_callback(phys_enc->dpu_kms,
+				phys_enc->irq[INTR_IDX_UNDERRUN]);
+	}
+}
+
+static int dpu_encoder_phys_vid_get_line_count(
+		struct dpu_encoder_phys *phys_enc)
+{
+	if (!dpu_encoder_phys_vid_is_master(phys_enc))
+		return -EINVAL;
+
+	if (!phys_enc->hw_intf || !phys_enc->hw_intf->ops.get_line_count)
+		return -EINVAL;
+
+	return phys_enc->hw_intf->ops.get_line_count(phys_enc->hw_intf);
+}
+
+static int dpu_encoder_phys_vid_get_frame_count(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_intf_status s = {0};
+	u32 fetch_start = 0;
+	struct drm_display_mode mode;
+
+	drm_mode_init(&mode, &phys_enc->cached_mode);
+
+	if (!dpu_encoder_phys_vid_is_master(phys_enc))
+		return -EINVAL;
+
+	if (!phys_enc->hw_intf || !phys_enc->hw_intf->ops.get_status)
+		return -EINVAL;
+
+	phys_enc->hw_intf->ops.get_status(phys_enc->hw_intf, &s);
+
+	if (s.is_prog_fetch_en && s.is_en) {
+		fetch_start = mode.vtotal - (mode.vsync_start - mode.vdisplay);
+		if ((s.line_count > fetch_start) &&
+			(s.line_count <= mode.vtotal))
+			return s.frame_count + 1;
+	}
+
+	return s.frame_count;
+}
+
+static void dpu_encoder_phys_vid_init_ops(struct dpu_encoder_phys_ops *ops)
+{
+	ops->is_master = dpu_encoder_phys_vid_is_master;
+	ops->atomic_mode_set = dpu_encoder_phys_vid_atomic_mode_set;
+	ops->enable = dpu_encoder_phys_vid_enable;
+	ops->disable = dpu_encoder_phys_vid_disable;
+	ops->control_vblank_irq = dpu_encoder_phys_vid_control_vblank_irq;
+	ops->wait_for_commit_done = dpu_encoder_phys_vid_wait_for_commit_done;
+	ops->wait_for_tx_complete = dpu_encoder_phys_vid_wait_for_tx_complete;
+	ops->irq_control = dpu_encoder_phys_vid_irq_control;
+	ops->prepare_for_kickoff = dpu_encoder_phys_vid_prepare_for_kickoff;
+	ops->handle_post_kickoff = dpu_encoder_phys_vid_handle_post_kickoff;
+	ops->needs_single_flush = dpu_encoder_phys_vid_needs_single_flush;
+	ops->get_line_count = dpu_encoder_phys_vid_get_line_count;
+	ops->get_frame_count = dpu_encoder_phys_vid_get_frame_count;
+}
+
+struct dpu_encoder_phys *dpu_encoder_phys_vid_init(struct drm_device *dev,
+		struct dpu_enc_phys_init_params *p)
+{
+	struct dpu_encoder_phys *phys_enc = NULL;
+
+	if (!p) {
+		DPU_ERROR("failed to create encoder due to invalid parameter\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	phys_enc = drmm_kzalloc(dev, sizeof(*phys_enc), GFP_KERNEL);
+	if (!phys_enc) {
+		DPU_ERROR("failed to create encoder due to memory allocation error\n");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	DPU_DEBUG_VIDENC(phys_enc, "\n");
+
+	dpu_encoder_phys_init(phys_enc, p);
+	mutex_init(&phys_enc->vblank_ctl_lock);
+	phys_enc->vblank_refcount = 0;
+
+	dpu_encoder_phys_vid_init_ops(&phys_enc->ops);
+	phys_enc->intf_mode = INTF_MODE_VIDEO;
+
+	DPU_DEBUG_VIDENC(phys_enc, "created intf idx:%d\n", p->hw_intf->idx);
+
+	return phys_enc;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder_phys_wb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_encoder_phys_wb.c
@@ -0,0 +1,694 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+
+#include <linux/debugfs.h>
+
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_managed.h>
+
+#include "dpu_encoder_phys.h"
+#include "dpu_formats.h"
+#include "dpu_hw_top.h"
+#include "dpu_hw_wb.h"
+#include "dpu_hw_lm.h"
+#include "dpu_hw_merge3d.h"
+#include "dpu_hw_interrupts.h"
+#include "dpu_core_irq.h"
+#include "dpu_vbif.h"
+#include "dpu_crtc.h"
+#include "disp/msm_disp_snapshot.h"
+
+#define to_dpu_encoder_phys_wb(x) \
+	container_of(x, struct dpu_encoder_phys_wb, base)
+
+/**
+ * dpu_encoder_phys_wb_is_master - report wb always as master encoder
+ * @phys_enc:	Pointer to physical encoder
+ */
+static bool dpu_encoder_phys_wb_is_master(struct dpu_encoder_phys *phys_enc)
+{
+	/* there is only one physical enc for dpu_writeback */
+	return true;
+}
+
+static bool _dpu_encoder_phys_wb_clk_force_ctrl(struct dpu_hw_wb *wb,
+						struct dpu_hw_mdp *mdp,
+						bool enable, bool *forced_on)
+{
+	if (wb->ops.setup_clk_force_ctrl) {
+		*forced_on = wb->ops.setup_clk_force_ctrl(wb, enable);
+		return true;
+	}
+
+	if (mdp->ops.setup_clk_force_ctrl) {
+		*forced_on = mdp->ops.setup_clk_force_ctrl(mdp, wb->caps->clk_ctrl, enable);
+		return true;
+	}
+
+	return false;
+}
+
+/**
+ * dpu_encoder_phys_wb_set_ot_limit - set OT limit for writeback interface
+ * @phys_enc:	Pointer to physical encoder
+ */
+static void dpu_encoder_phys_wb_set_ot_limit(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_wb *hw_wb = phys_enc->hw_wb;
+	struct dpu_vbif_set_ot_params ot_params;
+	bool forced_on = false;
+
+	memset(&ot_params, 0, sizeof(ot_params));
+	ot_params.xin_id = hw_wb->caps->xin_id;
+	ot_params.num = hw_wb->idx - WB_0;
+	ot_params.width = phys_enc->cached_mode.hdisplay;
+	ot_params.height = phys_enc->cached_mode.vdisplay;
+	ot_params.is_wfd = true;
+	ot_params.frame_rate = drm_mode_vrefresh(&phys_enc->cached_mode);
+	ot_params.vbif_idx = hw_wb->caps->vbif_idx;
+	ot_params.rd = false;
+
+	if (!_dpu_encoder_phys_wb_clk_force_ctrl(hw_wb, phys_enc->dpu_kms->hw_mdp,
+						 true, &forced_on))
+		return;
+
+	dpu_vbif_set_ot_limit(phys_enc->dpu_kms, &ot_params);
+
+	if (forced_on)
+		_dpu_encoder_phys_wb_clk_force_ctrl(hw_wb, phys_enc->dpu_kms->hw_mdp,
+						    false, &forced_on);
+}
+
+/**
+ * dpu_encoder_phys_wb_set_qos_remap - set QoS remapper for writeback
+ * @phys_enc:	Pointer to physical encoder
+ */
+static void dpu_encoder_phys_wb_set_qos_remap(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_wb *hw_wb;
+	struct dpu_vbif_set_qos_params qos_params;
+	bool forced_on = false;
+
+	if (!phys_enc || !phys_enc->parent || !phys_enc->parent->crtc) {
+		DPU_ERROR("invalid arguments\n");
+		return;
+	}
+
+	if (!phys_enc->hw_wb || !phys_enc->hw_wb->caps) {
+		DPU_ERROR("invalid writeback hardware\n");
+		return;
+	}
+
+	hw_wb = phys_enc->hw_wb;
+
+	memset(&qos_params, 0, sizeof(qos_params));
+	qos_params.vbif_idx = hw_wb->caps->vbif_idx;
+	qos_params.xin_id = hw_wb->caps->xin_id;
+	qos_params.num = hw_wb->idx - WB_0;
+	qos_params.is_rt = false;
+
+	DPU_DEBUG("[qos_remap] wb:%d vbif:%d xin:%d is_rt:%d\n",
+			qos_params.num,
+			qos_params.vbif_idx,
+			qos_params.xin_id, qos_params.is_rt);
+
+	if (!_dpu_encoder_phys_wb_clk_force_ctrl(hw_wb, phys_enc->dpu_kms->hw_mdp,
+						 true, &forced_on))
+		return;
+
+	dpu_vbif_set_qos_remap(phys_enc->dpu_kms, &qos_params);
+
+	if (forced_on)
+		_dpu_encoder_phys_wb_clk_force_ctrl(hw_wb, phys_enc->dpu_kms->hw_mdp,
+						    false, &forced_on);
+}
+
+/**
+ * dpu_encoder_phys_wb_set_qos - set QoS/danger/safe LUTs for writeback
+ * @phys_enc:	Pointer to physical encoder
+ */
+static void dpu_encoder_phys_wb_set_qos(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_wb *hw_wb;
+	struct dpu_hw_qos_cfg qos_cfg;
+	const struct dpu_mdss_cfg *catalog;
+	const struct dpu_qos_lut_tbl *qos_lut_tb;
+
+	if (!phys_enc || !phys_enc->dpu_kms || !phys_enc->dpu_kms->catalog) {
+		DPU_ERROR("invalid parameter(s)\n");
+		return;
+	}
+
+	catalog = phys_enc->dpu_kms->catalog;
+
+	hw_wb = phys_enc->hw_wb;
+
+	memset(&qos_cfg, 0, sizeof(struct dpu_hw_qos_cfg));
+	qos_cfg.danger_safe_en = true;
+	qos_cfg.danger_lut =
+		catalog->perf->danger_lut_tbl[DPU_QOS_LUT_USAGE_NRT];
+
+	qos_cfg.safe_lut = catalog->perf->safe_lut_tbl[DPU_QOS_LUT_USAGE_NRT];
+
+	qos_lut_tb = &catalog->perf->qos_lut_tbl[DPU_QOS_LUT_USAGE_NRT];
+	qos_cfg.creq_lut = _dpu_hw_get_qos_lut(qos_lut_tb, 0);
+
+	if (hw_wb->ops.setup_qos_lut)
+		hw_wb->ops.setup_qos_lut(hw_wb, &qos_cfg);
+}
+
+/**
+ * dpu_encoder_phys_wb_setup_fb - setup output framebuffer
+ * @phys_enc:	Pointer to physical encoder
+ * @fb:		Pointer to output framebuffer
+ */
+static void dpu_encoder_phys_wb_setup_fb(struct dpu_encoder_phys *phys_enc,
+		struct drm_framebuffer *fb)
+{
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+	struct dpu_hw_wb *hw_wb;
+	struct dpu_hw_wb_cfg *wb_cfg;
+
+	if (!phys_enc || !phys_enc->dpu_kms || !phys_enc->dpu_kms->catalog) {
+		DPU_ERROR("invalid encoder\n");
+		return;
+	}
+
+	hw_wb = phys_enc->hw_wb;
+	wb_cfg = &wb_enc->wb_cfg;
+
+	wb_cfg->intf_mode = phys_enc->intf_mode;
+	wb_cfg->roi.x1 = 0;
+	wb_cfg->roi.x2 = phys_enc->cached_mode.hdisplay;
+	wb_cfg->roi.y1 = 0;
+	wb_cfg->roi.y2 = phys_enc->cached_mode.vdisplay;
+
+	if (hw_wb->ops.setup_roi)
+		hw_wb->ops.setup_roi(hw_wb, wb_cfg);
+
+	if (hw_wb->ops.setup_outformat)
+		hw_wb->ops.setup_outformat(hw_wb, wb_cfg);
+
+	if (hw_wb->ops.setup_cdp) {
+		const struct dpu_perf_cfg *perf = phys_enc->dpu_kms->catalog->perf;
+
+		hw_wb->ops.setup_cdp(hw_wb, wb_cfg->dest.format,
+				     perf->cdp_cfg[DPU_PERF_CDP_USAGE_NRT].wr_enable);
+	}
+
+	if (hw_wb->ops.setup_outaddress)
+		hw_wb->ops.setup_outaddress(hw_wb, wb_cfg);
+}
+
+/**
+ * dpu_encoder_phys_wb_setup_ctl - setup wb pipeline for ctl path
+ * @phys_enc:Pointer to physical encoder
+ */
+static void dpu_encoder_phys_wb_setup_ctl(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_wb *hw_wb;
+	struct dpu_hw_ctl *ctl;
+	struct dpu_hw_cdm *hw_cdm;
+
+	if (!phys_enc) {
+		DPU_ERROR("invalid encoder\n");
+		return;
+	}
+
+	hw_wb = phys_enc->hw_wb;
+	ctl = phys_enc->hw_ctl;
+	hw_cdm = phys_enc->hw_cdm;
+
+	if (test_bit(DPU_CTL_ACTIVE_CFG, &ctl->caps->features) &&
+		(phys_enc->hw_ctl &&
+		 phys_enc->hw_ctl->ops.setup_intf_cfg)) {
+		struct dpu_hw_intf_cfg intf_cfg = {0};
+		struct dpu_hw_pingpong *hw_pp = phys_enc->hw_pp;
+		enum dpu_3d_blend_mode mode_3d;
+
+		mode_3d = dpu_encoder_helper_get_3d_blend_mode(phys_enc);
+
+		intf_cfg.intf = DPU_NONE;
+		intf_cfg.wb = hw_wb->idx;
+
+		if (mode_3d && hw_pp && hw_pp->merge_3d)
+			intf_cfg.merge_3d = hw_pp->merge_3d->idx;
+
+		if (hw_cdm)
+			intf_cfg.cdm = hw_cdm->idx;
+
+		if (phys_enc->hw_pp->merge_3d && phys_enc->hw_pp->merge_3d->ops.setup_3d_mode)
+			phys_enc->hw_pp->merge_3d->ops.setup_3d_mode(phys_enc->hw_pp->merge_3d,
+					mode_3d);
+
+		/* setup which pp blk will connect to this wb */
+		if (hw_pp && phys_enc->hw_wb->ops.bind_pingpong_blk)
+			phys_enc->hw_wb->ops.bind_pingpong_blk(phys_enc->hw_wb,
+					phys_enc->hw_pp->idx);
+
+		phys_enc->hw_ctl->ops.setup_intf_cfg(phys_enc->hw_ctl, &intf_cfg);
+	} else if (phys_enc->hw_ctl && phys_enc->hw_ctl->ops.setup_intf_cfg) {
+		struct dpu_hw_intf_cfg intf_cfg = {0};
+
+		intf_cfg.intf = DPU_NONE;
+		intf_cfg.wb = hw_wb->idx;
+		intf_cfg.mode_3d =
+			dpu_encoder_helper_get_3d_blend_mode(phys_enc);
+		phys_enc->hw_ctl->ops.setup_intf_cfg(phys_enc->hw_ctl, &intf_cfg);
+	}
+}
+
+/**
+ * _dpu_encoder_phys_wb_update_flush - flush hardware update
+ * @phys_enc:	Pointer to physical encoder
+ */
+static void _dpu_encoder_phys_wb_update_flush(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_wb *hw_wb;
+	struct dpu_hw_ctl *hw_ctl;
+	struct dpu_hw_pingpong *hw_pp;
+	struct dpu_hw_cdm *hw_cdm;
+	u32 pending_flush = 0;
+
+	if (!phys_enc)
+		return;
+
+	hw_wb = phys_enc->hw_wb;
+	hw_pp = phys_enc->hw_pp;
+	hw_ctl = phys_enc->hw_ctl;
+	hw_cdm = phys_enc->hw_cdm;
+
+	DPU_DEBUG("[wb:%d]\n", hw_wb->idx - WB_0);
+
+	if (!hw_ctl) {
+		DPU_DEBUG("[wb:%d] no ctl assigned\n", hw_wb->idx - WB_0);
+		return;
+	}
+
+	if (hw_ctl->ops.update_pending_flush_wb)
+		hw_ctl->ops.update_pending_flush_wb(hw_ctl, hw_wb->idx);
+
+	if (hw_ctl->ops.update_pending_flush_merge_3d && hw_pp && hw_pp->merge_3d)
+		hw_ctl->ops.update_pending_flush_merge_3d(hw_ctl,
+				hw_pp->merge_3d->idx);
+
+	if (hw_cdm && hw_ctl->ops.update_pending_flush_cdm)
+		hw_ctl->ops.update_pending_flush_cdm(hw_ctl, hw_cdm->idx);
+
+	if (hw_ctl->ops.get_pending_flush)
+		pending_flush = hw_ctl->ops.get_pending_flush(hw_ctl);
+
+	DPU_DEBUG("Pending flush mask for CTL_%d is 0x%x, WB %d\n",
+			hw_ctl->idx - CTL_0, pending_flush,
+			hw_wb->idx - WB_0);
+}
+
+/**
+ * dpu_encoder_phys_wb_setup - setup writeback encoder
+ * @phys_enc:	Pointer to physical encoder
+ */
+static void dpu_encoder_phys_wb_setup(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_wb *hw_wb = phys_enc->hw_wb;
+	struct drm_display_mode mode = phys_enc->cached_mode;
+	struct drm_framebuffer *fb = NULL;
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+	struct drm_writeback_job *wb_job;
+	const struct msm_format *format;
+	const struct dpu_format *dpu_fmt;
+
+	wb_job = wb_enc->wb_job;
+	format = msm_framebuffer_format(wb_enc->wb_job->fb);
+	dpu_fmt = dpu_get_dpu_format_ext(format->pixel_format, wb_job->fb->modifier);
+
+	DPU_DEBUG("[mode_set:%d, \"%s\",%d,%d]\n",
+			hw_wb->idx - WB_0, mode.name,
+			mode.hdisplay, mode.vdisplay);
+
+	dpu_encoder_phys_wb_set_ot_limit(phys_enc);
+
+	dpu_encoder_phys_wb_set_qos_remap(phys_enc);
+
+	dpu_encoder_phys_wb_set_qos(phys_enc);
+
+	dpu_encoder_phys_wb_setup_fb(phys_enc, fb);
+
+	dpu_encoder_helper_phys_setup_cdm(phys_enc, dpu_fmt, CDM_CDWN_OUTPUT_WB);
+
+	dpu_encoder_phys_wb_setup_ctl(phys_enc);
+}
+
+/**
+ * dpu_encoder_phys_wb_done_irq - writeback interrupt handler
+ * @arg:	Pointer to writeback encoder
+ */
+static void dpu_encoder_phys_wb_done_irq(void *arg)
+{
+	struct dpu_encoder_phys *phys_enc = arg;
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+
+	struct dpu_hw_wb *hw_wb = phys_enc->hw_wb;
+	unsigned long lock_flags;
+	u32 event = DPU_ENCODER_FRAME_EVENT_DONE;
+
+	DPU_DEBUG("[wb:%d]\n", hw_wb->idx - WB_0);
+
+	dpu_encoder_frame_done_callback(phys_enc->parent, phys_enc, event);
+
+	dpu_encoder_vblank_callback(phys_enc->parent, phys_enc);
+
+	spin_lock_irqsave(phys_enc->enc_spinlock, lock_flags);
+	atomic_add_unless(&phys_enc->pending_kickoff_cnt, -1, 0);
+	spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
+
+	if (wb_enc->wb_conn)
+		drm_writeback_signal_completion(wb_enc->wb_conn, 0);
+
+	/* Signal any waiting atomic commit thread */
+	wake_up_all(&phys_enc->pending_kickoff_wq);
+}
+
+/**
+ * dpu_encoder_phys_wb_irq_ctrl - irq control of WB
+ * @phys:	Pointer to physical encoder
+ * @enable:	indicates enable or disable interrupts
+ */
+static void dpu_encoder_phys_wb_irq_ctrl(
+		struct dpu_encoder_phys *phys, bool enable)
+{
+
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys);
+
+	if (enable && atomic_inc_return(&wb_enc->wbirq_refcount) == 1)
+		dpu_core_irq_register_callback(phys->dpu_kms,
+				phys->irq[INTR_IDX_WB_DONE], dpu_encoder_phys_wb_done_irq, phys);
+	else if (!enable &&
+			atomic_dec_return(&wb_enc->wbirq_refcount) == 0)
+		dpu_core_irq_unregister_callback(phys->dpu_kms, phys->irq[INTR_IDX_WB_DONE]);
+}
+
+static void dpu_encoder_phys_wb_atomic_mode_set(
+		struct dpu_encoder_phys *phys_enc,
+		struct drm_crtc_state *crtc_state,
+		struct drm_connector_state *conn_state)
+{
+
+	phys_enc->irq[INTR_IDX_WB_DONE] = phys_enc->hw_wb->caps->intr_wb_done;
+}
+
+static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+	u32 frame_event = DPU_ENCODER_FRAME_EVENT_ERROR;
+
+	wb_enc->wb_done_timeout_cnt++;
+
+	if (wb_enc->wb_done_timeout_cnt == 1)
+		msm_disp_snapshot_state(phys_enc->parent->dev);
+
+	atomic_add_unless(&phys_enc->pending_kickoff_cnt, -1, 0);
+
+	/* request a ctl reset before the next kickoff */
+	phys_enc->enable_state = DPU_ENC_ERR_NEEDS_HW_RESET;
+
+	if (wb_enc->wb_conn)
+		drm_writeback_signal_completion(wb_enc->wb_conn, 0);
+
+	dpu_encoder_frame_done_callback(phys_enc->parent, phys_enc, frame_event);
+}
+
+/**
+ * dpu_encoder_phys_wb_wait_for_commit_done - wait until request is committed
+ * @phys_enc:	Pointer to physical encoder
+ */
+static int dpu_encoder_phys_wb_wait_for_commit_done(
+		struct dpu_encoder_phys *phys_enc)
+{
+	unsigned long ret;
+	struct dpu_encoder_wait_info wait_info;
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+
+	wait_info.wq = &phys_enc->pending_kickoff_wq;
+	wait_info.atomic_cnt = &phys_enc->pending_kickoff_cnt;
+	wait_info.timeout_ms = KICKOFF_TIMEOUT_MS;
+
+	ret = dpu_encoder_helper_wait_for_irq(phys_enc,
+			phys_enc->irq[INTR_IDX_WB_DONE],
+			dpu_encoder_phys_wb_done_irq, &wait_info);
+	if (ret == -ETIMEDOUT)
+		_dpu_encoder_phys_wb_handle_wbdone_timeout(phys_enc);
+	else if (!ret)
+		wb_enc->wb_done_timeout_cnt = 0;
+
+	return ret;
+}
+
+/**
+ * dpu_encoder_phys_wb_prepare_for_kickoff - pre-kickoff processing
+ * @phys_enc:	Pointer to physical encoder
+ * Returns:	Zero on success
+ */
+static void dpu_encoder_phys_wb_prepare_for_kickoff(
+		struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+	struct drm_connector *drm_conn;
+	struct drm_connector_state *state;
+
+	DPU_DEBUG("[wb:%d]\n", phys_enc->hw_wb->idx - WB_0);
+
+	if (!wb_enc->wb_conn || !wb_enc->wb_job) {
+		DPU_ERROR("invalid wb_conn or wb_job\n");
+		return;
+	}
+
+	drm_conn = &wb_enc->wb_conn->base;
+	state = drm_conn->state;
+
+	if (wb_enc->wb_conn && wb_enc->wb_job)
+		drm_writeback_queue_job(wb_enc->wb_conn, state);
+
+	dpu_encoder_phys_wb_setup(phys_enc);
+
+	_dpu_encoder_phys_wb_update_flush(phys_enc);
+}
+
+/**
+ * dpu_encoder_phys_wb_needs_single_flush - trigger flush processing
+ * @phys_enc:	Pointer to physical encoder
+ */
+static bool dpu_encoder_phys_wb_needs_single_flush(struct dpu_encoder_phys *phys_enc)
+{
+	DPU_DEBUG("[wb:%d]\n", phys_enc->hw_wb->idx - WB_0);
+	return false;
+}
+
+/**
+ * dpu_encoder_phys_wb_handle_post_kickoff - post-kickoff processing
+ * @phys_enc:	Pointer to physical encoder
+ */
+static void dpu_encoder_phys_wb_handle_post_kickoff(
+		struct dpu_encoder_phys *phys_enc)
+{
+	DPU_DEBUG("[wb:%d]\n", phys_enc->hw_wb->idx - WB_0);
+
+}
+
+/**
+ * dpu_encoder_phys_wb_enable - enable writeback encoder
+ * @phys_enc:	Pointer to physical encoder
+ */
+static void dpu_encoder_phys_wb_enable(struct dpu_encoder_phys *phys_enc)
+{
+	DPU_DEBUG("[wb:%d]\n", phys_enc->hw_wb->idx - WB_0);
+	phys_enc->enable_state = DPU_ENC_ENABLED;
+}
+/**
+ * dpu_encoder_phys_wb_disable - disable writeback encoder
+ * @phys_enc:	Pointer to physical encoder
+ */
+static void dpu_encoder_phys_wb_disable(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_hw_wb *hw_wb = phys_enc->hw_wb;
+	struct dpu_hw_ctl *hw_ctl = phys_enc->hw_ctl;
+
+	DPU_DEBUG("[wb:%d]\n", hw_wb->idx - WB_0);
+
+	if (phys_enc->enable_state == DPU_ENC_DISABLED) {
+		DPU_ERROR("encoder is already disabled\n");
+		return;
+	}
+
+	/* reset h/w before final flush */
+	phys_enc->hw_ctl->ops.clear_pending_flush(phys_enc->hw_ctl);
+
+	/*
+	 * New CTL reset sequence from 5.0 MDP onwards.
+	 * If has_3d_merge_reset is not set, legacy reset
+	 * sequence is executed.
+	 *
+	 * Legacy reset sequence has not been implemented yet.
+	 * Any target earlier than SM8150 will need it and when
+	 * WB support is added to those targets will need to add
+	 * the legacy teardown sequence as well.
+	 */
+	if (hw_ctl->caps->features & BIT(DPU_CTL_ACTIVE_CFG))
+		dpu_encoder_helper_phys_cleanup(phys_enc);
+
+	phys_enc->enable_state = DPU_ENC_DISABLED;
+}
+
+static void dpu_encoder_phys_wb_prepare_wb_job(struct dpu_encoder_phys *phys_enc,
+		struct drm_writeback_job *job)
+{
+	const struct msm_format *format;
+	struct msm_gem_address_space *aspace;
+	struct dpu_hw_wb_cfg *wb_cfg;
+	int ret;
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+
+	if (!job->fb)
+		return;
+
+	wb_enc->wb_job = job;
+	wb_enc->wb_conn = job->connector;
+	aspace = phys_enc->dpu_kms->base.aspace;
+
+	wb_cfg = &wb_enc->wb_cfg;
+
+	memset(wb_cfg, 0, sizeof(struct dpu_hw_wb_cfg));
+
+	ret = msm_framebuffer_prepare(job->fb, aspace, false);
+	if (ret) {
+		DPU_ERROR("prep fb failed, %d\n", ret);
+		return;
+	}
+
+	format = msm_framebuffer_format(job->fb);
+
+	wb_cfg->dest.format = dpu_get_dpu_format_ext(
+			format->pixel_format, job->fb->modifier);
+	if (!wb_cfg->dest.format) {
+		/* this error should be detected during atomic_check */
+		DPU_ERROR("failed to get format %x\n", format->pixel_format);
+		return;
+	}
+
+	ret = dpu_format_populate_layout(aspace, job->fb, &wb_cfg->dest);
+	if (ret) {
+		DPU_DEBUG("failed to populate layout %d\n", ret);
+		return;
+	}
+
+	wb_cfg->dest.width = job->fb->width;
+	wb_cfg->dest.height = job->fb->height;
+	wb_cfg->dest.num_planes = wb_cfg->dest.format->num_planes;
+
+	if ((wb_cfg->dest.format->fetch_planes == DPU_PLANE_PLANAR) &&
+			(wb_cfg->dest.format->element[0] == C1_B_Cb))
+		swap(wb_cfg->dest.plane_addr[1], wb_cfg->dest.plane_addr[2]);
+
+	DPU_DEBUG("[fb_offset:%8.8x,%8.8x,%8.8x,%8.8x]\n",
+			wb_cfg->dest.plane_addr[0], wb_cfg->dest.plane_addr[1],
+			wb_cfg->dest.plane_addr[2], wb_cfg->dest.plane_addr[3]);
+
+	DPU_DEBUG("[fb_stride:%8.8x,%8.8x,%8.8x,%8.8x]\n",
+			wb_cfg->dest.plane_pitch[0], wb_cfg->dest.plane_pitch[1],
+			wb_cfg->dest.plane_pitch[2], wb_cfg->dest.plane_pitch[3]);
+}
+
+static void dpu_encoder_phys_wb_cleanup_wb_job(struct dpu_encoder_phys *phys_enc,
+		struct drm_writeback_job *job)
+{
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+	struct msm_gem_address_space *aspace;
+
+	if (!job->fb)
+		return;
+
+	aspace = phys_enc->dpu_kms->base.aspace;
+
+	msm_framebuffer_cleanup(job->fb, aspace, false);
+	wb_enc->wb_job = NULL;
+	wb_enc->wb_conn = NULL;
+}
+
+static bool dpu_encoder_phys_wb_is_valid_for_commit(struct dpu_encoder_phys *phys_enc)
+{
+	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+
+	if (wb_enc->wb_job)
+		return true;
+	else
+		return false;
+}
+
+/**
+ * dpu_encoder_phys_wb_init_ops - initialize writeback operations
+ * @ops:	Pointer to encoder operation table
+ */
+static void dpu_encoder_phys_wb_init_ops(struct dpu_encoder_phys_ops *ops)
+{
+	ops->is_master = dpu_encoder_phys_wb_is_master;
+	ops->atomic_mode_set = dpu_encoder_phys_wb_atomic_mode_set;
+	ops->enable = dpu_encoder_phys_wb_enable;
+	ops->disable = dpu_encoder_phys_wb_disable;
+	ops->wait_for_commit_done = dpu_encoder_phys_wb_wait_for_commit_done;
+	ops->prepare_for_kickoff = dpu_encoder_phys_wb_prepare_for_kickoff;
+	ops->handle_post_kickoff = dpu_encoder_phys_wb_handle_post_kickoff;
+	ops->needs_single_flush = dpu_encoder_phys_wb_needs_single_flush;
+	ops->trigger_start = dpu_encoder_helper_trigger_start;
+	ops->prepare_wb_job = dpu_encoder_phys_wb_prepare_wb_job;
+	ops->cleanup_wb_job = dpu_encoder_phys_wb_cleanup_wb_job;
+	ops->irq_control = dpu_encoder_phys_wb_irq_ctrl;
+	ops->is_valid_for_commit = dpu_encoder_phys_wb_is_valid_for_commit;
+
+}
+
+/**
+ * dpu_encoder_phys_wb_init - initialize writeback encoder
+ * @dev:  Corresponding device for devres management
+ * @p:	Pointer to init info structure with initialization params
+ */
+struct dpu_encoder_phys *dpu_encoder_phys_wb_init(struct drm_device *dev,
+		struct dpu_enc_phys_init_params *p)
+{
+	struct dpu_encoder_phys *phys_enc = NULL;
+	struct dpu_encoder_phys_wb *wb_enc = NULL;
+
+	DPU_DEBUG("\n");
+
+	if (!p || !p->parent) {
+		DPU_ERROR("invalid params\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	wb_enc = drmm_kzalloc(dev, sizeof(*wb_enc), GFP_KERNEL);
+	if (!wb_enc) {
+		DPU_ERROR("failed to allocate wb phys_enc enc\n");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	phys_enc = &wb_enc->base;
+
+	dpu_encoder_phys_init(phys_enc, p);
+
+	dpu_encoder_phys_wb_init_ops(&phys_enc->ops);
+	phys_enc->intf_mode = INTF_MODE_WB_LINE;
+
+	atomic_set(&wb_enc->wbirq_refcount, 0);
+
+	wb_enc->wb_done_timeout_cnt = 0;
+
+	DPU_DEBUG("Created dpu_encoder_phys for wb %d\n", phys_enc->hw_wb->idx);
+
+	return phys_enc;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_formats.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_formats.c
@@ -0,0 +1,1068 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+
+#include <uapi/drm/drm_fourcc.h>
+#include <drm/drm_framebuffer.h>
+
+#include "msm_media_info.h"
+#include "dpu_kms.h"
+#include "dpu_formats.h"
+
+#define DPU_UBWC_META_MACRO_W_H		16
+#define DPU_UBWC_META_BLOCK_SIZE	256
+#define DPU_UBWC_PLANE_SIZE_ALIGNMENT	4096
+
+#define DPU_TILE_HEIGHT_DEFAULT	1
+#define DPU_TILE_HEIGHT_TILED	4
+#define DPU_TILE_HEIGHT_UBWC	4
+#define DPU_TILE_HEIGHT_NV12	8
+
+#define DPU_MAX_IMG_WIDTH		0x3FFF
+#define DPU_MAX_IMG_HEIGHT		0x3FFF
+
+/*
+ * DPU supported format packing, bpp, and other format
+ * information.
+ * DPU currently only supports interleaved RGB formats
+ * UBWC support for a pixel format is indicated by the flag,
+ * there is additional meta data plane for such formats
+ */
+
+#define INTERLEAVED_RGB_FMT(fmt, a, r, g, b, e0, e1, e2, e3, uc, alpha,   \
+bp, flg, fm, np)                                                          \
+{                                                                         \
+	.base.pixel_format = DRM_FORMAT_ ## fmt,                          \
+	.fetch_planes = DPU_PLANE_INTERLEAVED,                            \
+	.alpha_enable = alpha,                                            \
+	.element = { (e0), (e1), (e2), (e3) },                            \
+	.bits = { g, b, r, a },                                           \
+	.chroma_sample = DPU_CHROMA_RGB,                                  \
+	.unpack_align_msb = 0,                                            \
+	.unpack_tight = 1,                                                \
+	.unpack_count = uc,                                               \
+	.bpp = bp,                                                        \
+	.fetch_mode = fm,                                                 \
+	.flag = {(flg)},                                                  \
+	.num_planes = np,                                                 \
+	.tile_height = DPU_TILE_HEIGHT_DEFAULT                            \
+}
+
+#define INTERLEAVED_RGB_FMT_TILED(fmt, a, r, g, b, e0, e1, e2, e3, uc,    \
+alpha, bp, flg, fm, np, th)                                               \
+{                                                                         \
+	.base.pixel_format = DRM_FORMAT_ ## fmt,                          \
+	.fetch_planes = DPU_PLANE_INTERLEAVED,                            \
+	.alpha_enable = alpha,                                            \
+	.element = { (e0), (e1), (e2), (e3) },                            \
+	.bits = { g, b, r, a },                                           \
+	.chroma_sample = DPU_CHROMA_RGB,                                  \
+	.unpack_align_msb = 0,                                            \
+	.unpack_tight = 1,                                                \
+	.unpack_count = uc,                                               \
+	.bpp = bp,                                                        \
+	.fetch_mode = fm,                                                 \
+	.flag = {(flg)},                                                  \
+	.num_planes = np,                                                 \
+	.tile_height = th                                                 \
+}
+
+
+#define INTERLEAVED_YUV_FMT(fmt, a, r, g, b, e0, e1, e2, e3,              \
+alpha, chroma, count, bp, flg, fm, np)                                    \
+{                                                                         \
+	.base.pixel_format = DRM_FORMAT_ ## fmt,                          \
+	.fetch_planes = DPU_PLANE_INTERLEAVED,                            \
+	.alpha_enable = alpha,                                            \
+	.element = { (e0), (e1), (e2), (e3)},                             \
+	.bits = { g, b, r, a },                                           \
+	.chroma_sample = chroma,                                          \
+	.unpack_align_msb = 0,                                            \
+	.unpack_tight = 1,                                                \
+	.unpack_count = count,                                            \
+	.bpp = bp,                                                        \
+	.fetch_mode = fm,                                                 \
+	.flag = {(flg)},                                                  \
+	.num_planes = np,                                                 \
+	.tile_height = DPU_TILE_HEIGHT_DEFAULT                            \
+}
+
+#define PSEUDO_YUV_FMT(fmt, a, r, g, b, e0, e1, chroma, flg, fm, np)      \
+{                                                                         \
+	.base.pixel_format = DRM_FORMAT_ ## fmt,                          \
+	.fetch_planes = DPU_PLANE_PSEUDO_PLANAR,                          \
+	.alpha_enable = false,                                            \
+	.element = { (e0), (e1), 0, 0 },                                  \
+	.bits = { g, b, r, a },                                           \
+	.chroma_sample = chroma,                                          \
+	.unpack_align_msb = 0,                                            \
+	.unpack_tight = 1,                                                \
+	.unpack_count = 2,                                                \
+	.bpp = 2,                                                         \
+	.fetch_mode = fm,                                                 \
+	.flag = {(flg)},                                                  \
+	.num_planes = np,                                                 \
+	.tile_height = DPU_TILE_HEIGHT_DEFAULT                            \
+}
+
+#define PSEUDO_YUV_FMT_TILED(fmt, a, r, g, b, e0, e1, chroma,             \
+flg, fm, np, th)                                                          \
+{                                                                         \
+	.base.pixel_format = DRM_FORMAT_ ## fmt,                          \
+	.fetch_planes = DPU_PLANE_PSEUDO_PLANAR,                          \
+	.alpha_enable = false,                                            \
+	.element = { (e0), (e1), 0, 0 },                                  \
+	.bits = { g, b, r, a },                                           \
+	.chroma_sample = chroma,                                          \
+	.unpack_align_msb = 0,                                            \
+	.unpack_tight = 1,                                                \
+	.unpack_count = 2,                                                \
+	.bpp = 2,                                                         \
+	.fetch_mode = fm,                                                 \
+	.flag = {(flg)},                                                  \
+	.num_planes = np,                                                 \
+	.tile_height = th                                                 \
+}
+
+#define PSEUDO_YUV_FMT_LOOSE(fmt, a, r, g, b, e0, e1, chroma, flg, fm, np)\
+{                                                                         \
+	.base.pixel_format = DRM_FORMAT_ ## fmt,                          \
+	.fetch_planes = DPU_PLANE_PSEUDO_PLANAR,                          \
+	.alpha_enable = false,                                            \
+	.element = { (e0), (e1), 0, 0 },                                  \
+	.bits = { g, b, r, a },                                           \
+	.chroma_sample = chroma,                                          \
+	.unpack_align_msb = 1,                                            \
+	.unpack_tight = 0,                                                \
+	.unpack_count = 2,                                                \
+	.bpp = 2,                                                         \
+	.fetch_mode = fm,                                                 \
+	.flag = {(flg)},                                                  \
+	.num_planes = np,                                                 \
+	.tile_height = DPU_TILE_HEIGHT_DEFAULT                            \
+}
+
+#define PSEUDO_YUV_FMT_LOOSE_TILED(fmt, a, r, g, b, e0, e1, chroma,       \
+flg, fm, np, th)                                                          \
+{                                                                         \
+	.base.pixel_format = DRM_FORMAT_ ## fmt,                          \
+	.fetch_planes = DPU_PLANE_PSEUDO_PLANAR,                          \
+	.alpha_enable = false,                                            \
+	.element = { (e0), (e1), 0, 0 },                                  \
+	.bits = { g, b, r, a },                                           \
+	.chroma_sample = chroma,                                          \
+	.unpack_align_msb = 1,                                            \
+	.unpack_tight = 0,                                                \
+	.unpack_count = 2,                                                \
+	.bpp = 2,                                                         \
+	.fetch_mode = fm,                                                 \
+	.flag = {(flg)},                                                  \
+	.num_planes = np,                                                 \
+	.tile_height = th                                                 \
+}
+
+
+#define PLANAR_YUV_FMT(fmt, a, r, g, b, e0, e1, e2, alpha, chroma, bp,    \
+flg, fm, np)                                                      \
+{                                                                         \
+	.base.pixel_format = DRM_FORMAT_ ## fmt,                          \
+	.fetch_planes = DPU_PLANE_PLANAR,                                 \
+	.alpha_enable = alpha,                                            \
+	.element = { (e0), (e1), (e2), 0 },                               \
+	.bits = { g, b, r, a },                                           \
+	.chroma_sample = chroma,                                          \
+	.unpack_align_msb = 0,                                            \
+	.unpack_tight = 1,                                                \
+	.unpack_count = 1,                                                \
+	.bpp = bp,                                                        \
+	.fetch_mode = fm,                                                 \
+	.flag = {(flg)},                                                  \
+	.num_planes = np,                                                 \
+	.tile_height = DPU_TILE_HEIGHT_DEFAULT                            \
+}
+
+/*
+ * struct dpu_media_color_map - maps drm format to media format
+ * @format: DRM base pixel format
+ * @color: Media API color related to DRM format
+ */
+struct dpu_media_color_map {
+	uint32_t format;
+	uint32_t color;
+};
+
+static const struct dpu_format dpu_format_map[] = {
+	INTERLEAVED_RGB_FMT(ARGB8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, C3_ALPHA, 4,
+		true, 4, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(ABGR8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 4, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(XBGR8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		false, 4, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGBA8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C3_ALPHA, C1_B_Cb, C0_G_Y, C2_R_Cr, 4,
+		true, 4, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGRA8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C3_ALPHA, C2_R_Cr, C0_G_Y, C1_B_Cb, 4,
+		true, 4, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGRX8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C3_ALPHA, C2_R_Cr, C0_G_Y, C1_B_Cb, 4,
+		false, 4, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(XRGB8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, C3_ALPHA, 4,
+		false, 4, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGBX8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C3_ALPHA, C1_B_Cb, C0_G_Y, C2_R_Cr, 4,
+		false, 4, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGB888,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, 0, 3,
+		false, 3, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGR888,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, 0, 3,
+		false, 3, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGB565,
+		0, COLOR_5BIT, COLOR_6BIT, COLOR_5BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, 0, 3,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGR565,
+		0, COLOR_5BIT, COLOR_6BIT, COLOR_5BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, 0, 3,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(ARGB1555,
+		COLOR_ALPHA_1BIT, COLOR_5BIT, COLOR_5BIT, COLOR_5BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, C3_ALPHA, 4,
+		true, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(ABGR1555,
+		COLOR_ALPHA_1BIT, COLOR_5BIT, COLOR_5BIT, COLOR_5BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGBA5551,
+		COLOR_ALPHA_1BIT, COLOR_5BIT, COLOR_5BIT, COLOR_5BIT,
+		C3_ALPHA, C1_B_Cb, C0_G_Y, C2_R_Cr, 4,
+		true, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGRA5551,
+		COLOR_ALPHA_1BIT, COLOR_5BIT, COLOR_5BIT, COLOR_5BIT,
+		C3_ALPHA, C2_R_Cr, C0_G_Y, C1_B_Cb, 4,
+		true, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(XRGB1555,
+		COLOR_ALPHA_1BIT, COLOR_5BIT, COLOR_5BIT, COLOR_5BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, C3_ALPHA, 4,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(XBGR1555,
+		COLOR_ALPHA_1BIT, COLOR_5BIT, COLOR_5BIT, COLOR_5BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGBX5551,
+		COLOR_ALPHA_1BIT, COLOR_5BIT, COLOR_5BIT, COLOR_5BIT,
+		C3_ALPHA, C1_B_Cb, C0_G_Y, C2_R_Cr, 4,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGRX5551,
+		COLOR_ALPHA_1BIT, COLOR_5BIT, COLOR_5BIT, COLOR_5BIT,
+		C3_ALPHA, C2_R_Cr, C0_G_Y, C1_B_Cb, 4,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(ARGB4444,
+		COLOR_ALPHA_4BIT, COLOR_4BIT, COLOR_4BIT, COLOR_4BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, C3_ALPHA, 4,
+		true, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(ABGR4444,
+		COLOR_ALPHA_4BIT, COLOR_4BIT, COLOR_4BIT, COLOR_4BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGBA4444,
+		COLOR_ALPHA_4BIT, COLOR_4BIT, COLOR_4BIT, COLOR_4BIT,
+		C3_ALPHA, C1_B_Cb, C0_G_Y, C2_R_Cr, 4,
+		true, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGRA4444,
+		COLOR_ALPHA_4BIT, COLOR_4BIT, COLOR_4BIT, COLOR_4BIT,
+		C3_ALPHA, C2_R_Cr, C0_G_Y, C1_B_Cb, 4,
+		true, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(XRGB4444,
+		COLOR_ALPHA_4BIT, COLOR_4BIT, COLOR_4BIT, COLOR_4BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, C3_ALPHA, 4,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(XBGR4444,
+		COLOR_ALPHA_4BIT, COLOR_4BIT, COLOR_4BIT, COLOR_4BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGBX4444,
+		COLOR_ALPHA_4BIT, COLOR_4BIT, COLOR_4BIT, COLOR_4BIT,
+		C3_ALPHA, C1_B_Cb, C0_G_Y, C2_R_Cr, 4,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGRX4444,
+		COLOR_ALPHA_4BIT, COLOR_4BIT, COLOR_4BIT, COLOR_4BIT,
+		C3_ALPHA, C2_R_Cr, C0_G_Y, C1_B_Cb, 4,
+		false, 2, 0,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGRA1010102,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C3_ALPHA, C2_R_Cr, C0_G_Y, C1_B_Cb, 4,
+		true, 4, DPU_FORMAT_FLAG_DX,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGBA1010102,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C3_ALPHA, C1_B_Cb, C0_G_Y, C2_R_Cr, 4,
+		true, 4, DPU_FORMAT_FLAG_DX,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(ABGR2101010,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 4, DPU_FORMAT_FLAG_DX,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(ARGB2101010,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, C3_ALPHA, 4,
+		true, 4, DPU_FORMAT_FLAG_DX,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(XRGB2101010,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, C3_ALPHA, 4,
+		false, 4, DPU_FORMAT_FLAG_DX,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(BGRX1010102,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C3_ALPHA, C2_R_Cr, C0_G_Y, C1_B_Cb, 4,
+		false, 4, DPU_FORMAT_FLAG_DX,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(XBGR2101010,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		false, 4, DPU_FORMAT_FLAG_DX,
+		DPU_FETCH_LINEAR, 1),
+
+	INTERLEAVED_RGB_FMT(RGBX1010102,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C3_ALPHA, C1_B_Cb, C0_G_Y, C2_R_Cr, 4,
+		false, 4, DPU_FORMAT_FLAG_DX,
+		DPU_FETCH_LINEAR, 1),
+
+	PSEUDO_YUV_FMT(NV12,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C2_R_Cr,
+		DPU_CHROMA_420, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 2),
+
+	PSEUDO_YUV_FMT(NV21,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C1_B_Cb,
+		DPU_CHROMA_420, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 2),
+
+	PSEUDO_YUV_FMT(NV16,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C2_R_Cr,
+		DPU_CHROMA_H2V1, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 2),
+
+	PSEUDO_YUV_FMT(NV61,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C1_B_Cb,
+		DPU_CHROMA_H2V1, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 2),
+
+	PSEUDO_YUV_FMT_LOOSE(P010,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C2_R_Cr,
+		DPU_CHROMA_420, DPU_FORMAT_FLAG_DX | DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 2),
+
+	INTERLEAVED_YUV_FMT(VYUY,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C0_G_Y,
+		false, DPU_CHROMA_H2V1, 4, 2, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 2),
+
+	INTERLEAVED_YUV_FMT(UYVY,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C0_G_Y, C2_R_Cr, C0_G_Y,
+		false, DPU_CHROMA_H2V1, 4, 2, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 2),
+
+	INTERLEAVED_YUV_FMT(YUYV,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C0_G_Y, C1_B_Cb, C0_G_Y, C2_R_Cr,
+		false, DPU_CHROMA_H2V1, 4, 2, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 2),
+
+	INTERLEAVED_YUV_FMT(YVYU,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C0_G_Y, C2_R_Cr, C0_G_Y, C1_B_Cb,
+		false, DPU_CHROMA_H2V1, 4, 2, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 2),
+
+	PLANAR_YUV_FMT(YUV420,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C1_B_Cb, C0_G_Y,
+		false, DPU_CHROMA_420, 1, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 3),
+
+	PLANAR_YUV_FMT(YVU420,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C2_R_Cr, C0_G_Y,
+		false, DPU_CHROMA_420, 1, DPU_FORMAT_FLAG_YUV,
+		DPU_FETCH_LINEAR, 3),
+};
+
+/*
+ * UBWC formats table:
+ * This table holds the UBWC formats supported.
+ * If a compression ratio needs to be used for this or any other format,
+ * the data will be passed by user-space.
+ */
+static const struct dpu_format dpu_format_map_ubwc[] = {
+	INTERLEAVED_RGB_FMT_TILED(BGR565,
+		0, COLOR_5BIT, COLOR_6BIT, COLOR_5BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, 0, 3,
+		false, 2, DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 2, DPU_TILE_HEIGHT_UBWC),
+
+	INTERLEAVED_RGB_FMT_TILED(ABGR8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 4, DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 2, DPU_TILE_HEIGHT_UBWC),
+
+	/* ARGB8888 and ABGR8888 purposely have the same color
+	 * ordering.  The hardware only supports ABGR8888 UBWC
+	 * natively.
+	 */
+	INTERLEAVED_RGB_FMT_TILED(ARGB8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 4, DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 2, DPU_TILE_HEIGHT_UBWC),
+
+	INTERLEAVED_RGB_FMT_TILED(XBGR8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		false, 4, DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 2, DPU_TILE_HEIGHT_UBWC),
+
+	INTERLEAVED_RGB_FMT_TILED(XRGB8888,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		false, 4, DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 2, DPU_TILE_HEIGHT_UBWC),
+
+	INTERLEAVED_RGB_FMT_TILED(ABGR2101010,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 4, DPU_FORMAT_FLAG_DX | DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 2, DPU_TILE_HEIGHT_UBWC),
+
+	INTERLEAVED_RGB_FMT_TILED(XBGR2101010,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 4, DPU_FORMAT_FLAG_DX | DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 2, DPU_TILE_HEIGHT_UBWC),
+
+	INTERLEAVED_RGB_FMT_TILED(XRGB2101010,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 4, DPU_FORMAT_FLAG_DX | DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 2, DPU_TILE_HEIGHT_UBWC),
+
+	/* XRGB2101010 and ARGB2101010 purposely have the same color
+	* ordering.  The hardware only supports ARGB2101010 UBWC
+	* natively.
+	*/
+	INTERLEAVED_RGB_FMT_TILED(ARGB2101010,
+		COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
+		true, 4, DPU_FORMAT_FLAG_DX | DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 2, DPU_TILE_HEIGHT_UBWC),
+
+	PSEUDO_YUV_FMT_TILED(NV12,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C2_R_Cr,
+		DPU_CHROMA_420, DPU_FORMAT_FLAG_YUV |
+				DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 4, DPU_TILE_HEIGHT_NV12),
+
+	PSEUDO_YUV_FMT_TILED(P010,
+		0, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
+		C1_B_Cb, C2_R_Cr,
+		DPU_CHROMA_420, DPU_FORMAT_FLAG_DX |
+				DPU_FORMAT_FLAG_YUV |
+				DPU_FORMAT_FLAG_COMPRESSED,
+		DPU_FETCH_UBWC, 4, DPU_TILE_HEIGHT_UBWC),
+};
+
+/* _dpu_get_v_h_subsample_rate - Get subsample rates for all formats we support
+ *   Note: Not using the drm_format_*_subsampling since we have formats
+ */
+static void _dpu_get_v_h_subsample_rate(
+	enum dpu_chroma_samp_type chroma_sample,
+	uint32_t *v_sample,
+	uint32_t *h_sample)
+{
+	if (!v_sample || !h_sample)
+		return;
+
+	switch (chroma_sample) {
+	case DPU_CHROMA_H2V1:
+		*v_sample = 1;
+		*h_sample = 2;
+		break;
+	case DPU_CHROMA_H1V2:
+		*v_sample = 2;
+		*h_sample = 1;
+		break;
+	case DPU_CHROMA_420:
+		*v_sample = 2;
+		*h_sample = 2;
+		break;
+	default:
+		*v_sample = 1;
+		*h_sample = 1;
+		break;
+	}
+}
+
+static int _dpu_format_get_media_color_ubwc(const struct dpu_format *fmt)
+{
+	static const struct dpu_media_color_map dpu_media_ubwc_map[] = {
+		{DRM_FORMAT_ABGR8888, COLOR_FMT_RGBA8888_UBWC},
+		{DRM_FORMAT_ARGB8888, COLOR_FMT_RGBA8888_UBWC},
+		{DRM_FORMAT_XBGR8888, COLOR_FMT_RGBA8888_UBWC},
+		{DRM_FORMAT_XRGB8888, COLOR_FMT_RGBA8888_UBWC},
+		{DRM_FORMAT_ABGR2101010, COLOR_FMT_RGBA1010102_UBWC},
+		{DRM_FORMAT_ARGB2101010, COLOR_FMT_RGBA1010102_UBWC},
+		{DRM_FORMAT_XRGB2101010, COLOR_FMT_RGBA1010102_UBWC},
+		{DRM_FORMAT_XBGR2101010, COLOR_FMT_RGBA1010102_UBWC},
+		{DRM_FORMAT_BGR565, COLOR_FMT_RGB565_UBWC},
+	};
+	int color_fmt = -1;
+	int i;
+
+	if (fmt->base.pixel_format == DRM_FORMAT_NV12 ||
+	    fmt->base.pixel_format == DRM_FORMAT_P010) {
+		if (DPU_FORMAT_IS_DX(fmt)) {
+			if (fmt->unpack_tight)
+				color_fmt = COLOR_FMT_NV12_BPP10_UBWC;
+			else
+				color_fmt = COLOR_FMT_P010_UBWC;
+		} else
+			color_fmt = COLOR_FMT_NV12_UBWC;
+		return color_fmt;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(dpu_media_ubwc_map); ++i)
+		if (fmt->base.pixel_format == dpu_media_ubwc_map[i].format) {
+			color_fmt = dpu_media_ubwc_map[i].color;
+			break;
+		}
+	return color_fmt;
+}
+
+static int _dpu_format_get_plane_sizes_ubwc(
+		const struct dpu_format *fmt,
+		const uint32_t width,
+		const uint32_t height,
+		struct dpu_hw_fmt_layout *layout)
+{
+	int i;
+	int color;
+	bool meta = DPU_FORMAT_IS_UBWC(fmt);
+
+	memset(layout, 0, sizeof(struct dpu_hw_fmt_layout));
+	layout->format = fmt;
+	layout->width = width;
+	layout->height = height;
+	layout->num_planes = fmt->num_planes;
+
+	color = _dpu_format_get_media_color_ubwc(fmt);
+	if (color < 0) {
+		DRM_ERROR("UBWC format not supported for fmt: %4.4s\n",
+			(char *)&fmt->base.pixel_format);
+		return -EINVAL;
+	}
+
+	if (DPU_FORMAT_IS_YUV(layout->format)) {
+		uint32_t y_sclines, uv_sclines;
+		uint32_t y_meta_scanlines = 0;
+		uint32_t uv_meta_scanlines = 0;
+
+		layout->num_planes = 2;
+		layout->plane_pitch[0] = VENUS_Y_STRIDE(color, width);
+		y_sclines = VENUS_Y_SCANLINES(color, height);
+		layout->plane_size[0] = MSM_MEDIA_ALIGN(layout->plane_pitch[0] *
+			y_sclines, DPU_UBWC_PLANE_SIZE_ALIGNMENT);
+
+		layout->plane_pitch[1] = VENUS_UV_STRIDE(color, width);
+		uv_sclines = VENUS_UV_SCANLINES(color, height);
+		layout->plane_size[1] = MSM_MEDIA_ALIGN(layout->plane_pitch[1] *
+			uv_sclines, DPU_UBWC_PLANE_SIZE_ALIGNMENT);
+
+		if (!meta)
+			goto done;
+
+		layout->num_planes += 2;
+		layout->plane_pitch[2] = VENUS_Y_META_STRIDE(color, width);
+		y_meta_scanlines = VENUS_Y_META_SCANLINES(color, height);
+		layout->plane_size[2] = MSM_MEDIA_ALIGN(layout->plane_pitch[2] *
+			y_meta_scanlines, DPU_UBWC_PLANE_SIZE_ALIGNMENT);
+
+		layout->plane_pitch[3] = VENUS_UV_META_STRIDE(color, width);
+		uv_meta_scanlines = VENUS_UV_META_SCANLINES(color, height);
+		layout->plane_size[3] = MSM_MEDIA_ALIGN(layout->plane_pitch[3] *
+			uv_meta_scanlines, DPU_UBWC_PLANE_SIZE_ALIGNMENT);
+
+	} else {
+		uint32_t rgb_scanlines, rgb_meta_scanlines;
+
+		layout->num_planes = 1;
+
+		layout->plane_pitch[0] = VENUS_RGB_STRIDE(color, width);
+		rgb_scanlines = VENUS_RGB_SCANLINES(color, height);
+		layout->plane_size[0] = MSM_MEDIA_ALIGN(layout->plane_pitch[0] *
+			rgb_scanlines, DPU_UBWC_PLANE_SIZE_ALIGNMENT);
+
+		if (!meta)
+			goto done;
+		layout->num_planes += 2;
+		layout->plane_pitch[2] = VENUS_RGB_META_STRIDE(color, width);
+		rgb_meta_scanlines = VENUS_RGB_META_SCANLINES(color, height);
+		layout->plane_size[2] = MSM_MEDIA_ALIGN(layout->plane_pitch[2] *
+			rgb_meta_scanlines, DPU_UBWC_PLANE_SIZE_ALIGNMENT);
+	}
+
+done:
+	for (i = 0; i < DPU_MAX_PLANES; i++)
+		layout->total_size += layout->plane_size[i];
+
+	return 0;
+}
+
+static int _dpu_format_get_plane_sizes_linear(
+		const struct dpu_format *fmt,
+		const uint32_t width,
+		const uint32_t height,
+		struct dpu_hw_fmt_layout *layout,
+		const uint32_t *pitches)
+{
+	int i;
+
+	memset(layout, 0, sizeof(struct dpu_hw_fmt_layout));
+	layout->format = fmt;
+	layout->width = width;
+	layout->height = height;
+	layout->num_planes = fmt->num_planes;
+
+	/* Due to memset above, only need to set planes of interest */
+	if (fmt->fetch_planes == DPU_PLANE_INTERLEAVED) {
+		layout->num_planes = 1;
+		layout->plane_size[0] = width * height * layout->format->bpp;
+		layout->plane_pitch[0] = width * layout->format->bpp;
+	} else {
+		uint32_t v_subsample, h_subsample;
+		uint32_t chroma_samp;
+		uint32_t bpp = 1;
+
+		chroma_samp = fmt->chroma_sample;
+		_dpu_get_v_h_subsample_rate(chroma_samp, &v_subsample,
+				&h_subsample);
+
+		if (width % h_subsample || height % v_subsample) {
+			DRM_ERROR("mismatch in subsample vs dimensions\n");
+			return -EINVAL;
+		}
+
+		if ((fmt->base.pixel_format == DRM_FORMAT_NV12) &&
+			(DPU_FORMAT_IS_DX(fmt)))
+			bpp = 2;
+		layout->plane_pitch[0] = width * bpp;
+		layout->plane_pitch[1] = layout->plane_pitch[0] / h_subsample;
+		layout->plane_size[0] = layout->plane_pitch[0] * height;
+		layout->plane_size[1] = layout->plane_pitch[1] *
+				(height / v_subsample);
+
+		if (fmt->fetch_planes == DPU_PLANE_PSEUDO_PLANAR) {
+			layout->num_planes = 2;
+			layout->plane_size[1] *= 2;
+			layout->plane_pitch[1] *= 2;
+		} else {
+			/* planar */
+			layout->num_planes = 3;
+			layout->plane_size[2] = layout->plane_size[1];
+			layout->plane_pitch[2] = layout->plane_pitch[1];
+		}
+	}
+
+	/*
+	 * linear format: allow user allocated pitches if they are greater than
+	 * the requirement.
+	 * ubwc format: pitch values are computed uniformly across
+	 * all the components based on ubwc specifications.
+	 */
+	for (i = 0; i < layout->num_planes && i < DPU_MAX_PLANES; ++i) {
+		if (pitches && layout->plane_pitch[i] < pitches[i])
+			layout->plane_pitch[i] = pitches[i];
+	}
+
+	for (i = 0; i < DPU_MAX_PLANES; i++)
+		layout->total_size += layout->plane_size[i];
+
+	return 0;
+}
+
+static int dpu_format_get_plane_sizes(
+		const struct dpu_format *fmt,
+		const uint32_t w,
+		const uint32_t h,
+		struct dpu_hw_fmt_layout *layout,
+		const uint32_t *pitches)
+{
+	if (!layout || !fmt) {
+		DRM_ERROR("invalid pointer\n");
+		return -EINVAL;
+	}
+
+	if ((w > DPU_MAX_IMG_WIDTH) || (h > DPU_MAX_IMG_HEIGHT)) {
+		DRM_ERROR("image dimensions outside max range\n");
+		return -ERANGE;
+	}
+
+	if (DPU_FORMAT_IS_UBWC(fmt) || DPU_FORMAT_IS_TILE(fmt))
+		return _dpu_format_get_plane_sizes_ubwc(fmt, w, h, layout);
+
+	return _dpu_format_get_plane_sizes_linear(fmt, w, h, layout, pitches);
+}
+
+static int _dpu_format_populate_addrs_ubwc(
+		struct msm_gem_address_space *aspace,
+		struct drm_framebuffer *fb,
+		struct dpu_hw_fmt_layout *layout)
+{
+	uint32_t base_addr = 0;
+	bool meta;
+
+	if (!fb || !layout) {
+		DRM_ERROR("invalid pointers\n");
+		return -EINVAL;
+	}
+
+	if (aspace)
+		base_addr = msm_framebuffer_iova(fb, aspace, 0);
+	if (!base_addr) {
+		DRM_ERROR("failed to retrieve base addr\n");
+		return -EFAULT;
+	}
+
+	meta = DPU_FORMAT_IS_UBWC(layout->format);
+
+	/* Per-format logic for verifying active planes */
+	if (DPU_FORMAT_IS_YUV(layout->format)) {
+		/************************************************/
+		/*      UBWC            **                      */
+		/*      buffer          **      DPU PLANE       */
+		/*      format          **                      */
+		/************************************************/
+		/* -------------------  ** -------------------- */
+		/* |      Y meta     |  ** |    Y bitstream   | */
+		/* |       data      |  ** |       plane      | */
+		/* -------------------  ** -------------------- */
+		/* |    Y bitstream  |  ** |  CbCr bitstream  | */
+		/* |       data      |  ** |       plane      | */
+		/* -------------------  ** -------------------- */
+		/* |   Cbcr metadata |  ** |       Y meta     | */
+		/* |       data      |  ** |       plane      | */
+		/* -------------------  ** -------------------- */
+		/* |  CbCr bitstream |  ** |     CbCr meta    | */
+		/* |       data      |  ** |       plane      | */
+		/* -------------------  ** -------------------- */
+		/************************************************/
+
+		/* configure Y bitstream plane */
+		layout->plane_addr[0] = base_addr + layout->plane_size[2];
+
+		/* configure CbCr bitstream plane */
+		layout->plane_addr[1] = base_addr + layout->plane_size[0]
+			+ layout->plane_size[2] + layout->plane_size[3];
+
+		if (!meta)
+			return 0;
+
+		/* configure Y metadata plane */
+		layout->plane_addr[2] = base_addr;
+
+		/* configure CbCr metadata plane */
+		layout->plane_addr[3] = base_addr + layout->plane_size[0]
+			+ layout->plane_size[2];
+
+	} else {
+		/************************************************/
+		/*      UBWC            **                      */
+		/*      buffer          **      DPU PLANE       */
+		/*      format          **                      */
+		/************************************************/
+		/* -------------------  ** -------------------- */
+		/* |      RGB meta   |  ** |   RGB bitstream  | */
+		/* |       data      |  ** |       plane      | */
+		/* -------------------  ** -------------------- */
+		/* |  RGB bitstream  |  ** |       NONE       | */
+		/* |       data      |  ** |                  | */
+		/* -------------------  ** -------------------- */
+		/*                      ** |     RGB meta     | */
+		/*                      ** |       plane      | */
+		/*                      ** -------------------- */
+		/************************************************/
+
+		layout->plane_addr[0] = base_addr + layout->plane_size[2];
+		layout->plane_addr[1] = 0;
+
+		if (!meta)
+			return 0;
+
+		layout->plane_addr[2] = base_addr;
+		layout->plane_addr[3] = 0;
+	}
+	return 0;
+}
+
+static int _dpu_format_populate_addrs_linear(
+		struct msm_gem_address_space *aspace,
+		struct drm_framebuffer *fb,
+		struct dpu_hw_fmt_layout *layout)
+{
+	unsigned int i;
+
+	/* Can now check the pitches given vs pitches expected */
+	for (i = 0; i < layout->num_planes; ++i) {
+		if (layout->plane_pitch[i] > fb->pitches[i]) {
+			DRM_ERROR("plane %u expected pitch %u, fb %u\n",
+				i, layout->plane_pitch[i], fb->pitches[i]);
+			return -EINVAL;
+		}
+	}
+
+	/* Populate addresses for simple formats here */
+	for (i = 0; i < layout->num_planes; ++i) {
+		if (aspace)
+			layout->plane_addr[i] =
+				msm_framebuffer_iova(fb, aspace, i);
+		if (!layout->plane_addr[i]) {
+			DRM_ERROR("failed to retrieve base addr\n");
+			return -EFAULT;
+		}
+	}
+
+	return 0;
+}
+
+int dpu_format_populate_layout(
+		struct msm_gem_address_space *aspace,
+		struct drm_framebuffer *fb,
+		struct dpu_hw_fmt_layout *layout)
+{
+	int ret;
+
+	if (!fb || !layout) {
+		DRM_ERROR("invalid arguments\n");
+		return -EINVAL;
+	}
+
+	if ((fb->width > DPU_MAX_IMG_WIDTH) ||
+			(fb->height > DPU_MAX_IMG_HEIGHT)) {
+		DRM_ERROR("image dimensions outside max range\n");
+		return -ERANGE;
+	}
+
+	layout->format = to_dpu_format(msm_framebuffer_format(fb));
+
+	/* Populate the plane sizes etc via get_format */
+	ret = dpu_format_get_plane_sizes(layout->format, fb->width, fb->height,
+			layout, fb->pitches);
+	if (ret)
+		return ret;
+
+	/* Populate the addresses given the fb */
+	if (DPU_FORMAT_IS_UBWC(layout->format) ||
+			DPU_FORMAT_IS_TILE(layout->format))
+		ret = _dpu_format_populate_addrs_ubwc(aspace, fb, layout);
+	else
+		ret = _dpu_format_populate_addrs_linear(aspace, fb, layout);
+
+	return ret;
+}
+
+int dpu_format_check_modified_format(
+		const struct msm_kms *kms,
+		const struct msm_format *msm_fmt,
+		const struct drm_mode_fb_cmd2 *cmd,
+		struct drm_gem_object **bos)
+{
+	const struct drm_format_info *info;
+	const struct dpu_format *fmt;
+	struct dpu_hw_fmt_layout layout;
+	uint32_t bos_total_size = 0;
+	int ret, i;
+
+	if (!msm_fmt || !cmd || !bos) {
+		DRM_ERROR("invalid arguments\n");
+		return -EINVAL;
+	}
+
+	fmt = to_dpu_format(msm_fmt);
+	info = drm_format_info(fmt->base.pixel_format);
+	if (!info)
+		return -EINVAL;
+
+	ret = dpu_format_get_plane_sizes(fmt, cmd->width, cmd->height,
+			&layout, cmd->pitches);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < info->num_planes; i++) {
+		if (!bos[i]) {
+			DRM_ERROR("invalid handle for plane %d\n", i);
+			return -EINVAL;
+		}
+		if ((i == 0) || (bos[i] != bos[0]))
+			bos_total_size += bos[i]->size;
+	}
+
+	if (bos_total_size < layout.total_size) {
+		DRM_ERROR("buffers total size too small %u expected %u\n",
+				bos_total_size, layout.total_size);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+const struct dpu_format *dpu_get_dpu_format_ext(
+		const uint32_t format,
+		const uint64_t modifier)
+{
+	uint32_t i = 0;
+	const struct dpu_format *fmt = NULL;
+	const struct dpu_format *map = NULL;
+	ssize_t map_size = 0;
+
+	/*
+	 * Currently only support exactly zero or one modifier.
+	 * All planes use the same modifier.
+	 */
+	DRM_DEBUG_ATOMIC("plane format modifier 0x%llX\n", modifier);
+
+	switch (modifier) {
+	case 0:
+		map = dpu_format_map;
+		map_size = ARRAY_SIZE(dpu_format_map);
+		break;
+	case DRM_FORMAT_MOD_QCOM_COMPRESSED:
+		map = dpu_format_map_ubwc;
+		map_size = ARRAY_SIZE(dpu_format_map_ubwc);
+		DRM_DEBUG_ATOMIC("found fmt: %4.4s  DRM_FORMAT_MOD_QCOM_COMPRESSED\n",
+				(char *)&format);
+		break;
+	default:
+		DPU_ERROR("unsupported format modifier %llX\n", modifier);
+		return NULL;
+	}
+
+	for (i = 0; i < map_size; i++) {
+		if (format == map[i].base.pixel_format) {
+			fmt = &map[i];
+			break;
+		}
+	}
+
+	if (fmt == NULL)
+		DPU_ERROR("unsupported fmt: %4.4s modifier 0x%llX\n",
+			(char *)&format, modifier);
+	else
+		DRM_DEBUG_ATOMIC("fmt %4.4s mod 0x%llX ubwc %d yuv %d\n",
+				(char *)&format, modifier,
+				DPU_FORMAT_IS_UBWC(fmt),
+				DPU_FORMAT_IS_YUV(fmt));
+
+	return fmt;
+}
+
+const struct msm_format *dpu_get_msm_format(
+		struct msm_kms *kms,
+		const uint32_t format,
+		const uint64_t modifiers)
+{
+	const struct dpu_format *fmt = dpu_get_dpu_format_ext(format,
+			modifiers);
+	if (fmt)
+		return &fmt->base;
+	return NULL;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_formats.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_formats.h
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_FORMATS_H
+#define _DPU_FORMATS_H
+
+#include <drm/drm_fourcc.h>
+#include "msm_gem.h"
+#include "dpu_hw_mdss.h"
+
+/**
+ * dpu_get_dpu_format_ext() - Returns dpu format structure pointer.
+ * @format:          DRM FourCC Code
+ * @modifiers:       format modifier array from client, one per plane
+ */
+const struct dpu_format *dpu_get_dpu_format_ext(
+		const uint32_t format,
+		const uint64_t modifier);
+
+#define dpu_get_dpu_format(f) dpu_get_dpu_format_ext(f, 0)
+
+/**
+ * dpu_find_format - validate if the pixel format is supported
+ * @format:		dpu format
+ * @supported_formats:	supported formats by dpu HW
+ * @num_formatss:	total number of formats
+ *
+ * Return: false if not valid format, true on success
+ */
+static inline bool dpu_find_format(u32 format, const u32 *supported_formats,
+					size_t num_formats)
+{
+	int i;
+
+	for (i = 0; i < num_formats; i++) {
+		/* check for valid formats supported */
+		if (format == supported_formats[i])
+			return true;
+	}
+
+	return false;
+}
+
+/**
+ * dpu_get_msm_format - get an dpu_format by its msm_format base
+ *                     callback function registers with the msm_kms layer
+ * @kms:             kms driver
+ * @format:          DRM FourCC Code
+ * @modifiers:       data layout modifier
+ */
+const struct msm_format *dpu_get_msm_format(
+		struct msm_kms *kms,
+		const uint32_t format,
+		const uint64_t modifiers);
+
+/**
+ * dpu_format_check_modified_format - validate format and buffers for
+ *                   dpu non-standard, i.e. modified format
+ * @kms:             kms driver
+ * @msm_fmt:         pointer to the msm_fmt base pointer of an dpu_format
+ * @cmd:             fb_cmd2 structure user request
+ * @bos:             gem buffer object list
+ *
+ * Return: error code on failure, 0 on success
+ */
+int dpu_format_check_modified_format(
+		const struct msm_kms *kms,
+		const struct msm_format *msm_fmt,
+		const struct drm_mode_fb_cmd2 *cmd,
+		struct drm_gem_object **bos);
+
+/**
+ * dpu_format_populate_layout - populate the given format layout based on
+ *                     mmu, fb, and format found in the fb
+ * @aspace:            address space pointer
+ * @fb:                framebuffer pointer
+ * @fmtl:              format layout structure to populate
+ *
+ * Return: error code on failure, -EAGAIN if success but the addresses
+ *         are the same as before or 0 if new addresses were populated
+ */
+int dpu_format_populate_layout(
+		struct msm_gem_address_space *aspace,
+		struct drm_framebuffer *fb,
+		struct dpu_hw_fmt_layout *fmtl);
+
+#endif /*_DPU_FORMATS_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_catalog.c
@@ -0,0 +1,702 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+#include <linux/slab.h>
+#include <linux/of_address.h>
+#include <linux/platform_device.h>
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_interrupts.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_kms.h"
+
+#define VIG_BASE_MASK \
+	(BIT(DPU_SSPP_QOS) |\
+	BIT(DPU_SSPP_CDP) |\
+	BIT(DPU_SSPP_TS_PREFILL) | BIT(DPU_SSPP_EXCL_RECT))
+
+#define VIG_MASK \
+	(VIG_BASE_MASK | \
+	BIT(DPU_SSPP_CSC_10BIT))
+
+#define VIG_MSM8998_MASK \
+	(VIG_MASK | BIT(DPU_SSPP_SCALER_QSEED3_COMPATIBLE))
+
+#define VIG_SDM845_MASK \
+	(VIG_MASK | BIT(DPU_SSPP_QOS_8LVL) | BIT(DPU_SSPP_SCALER_QSEED3_COMPATIBLE))
+
+#define VIG_SDM845_MASK_SDMA \
+	(VIG_SDM845_MASK | BIT(DPU_SSPP_SMART_DMA_V2))
+
+#define VIG_QCM2290_MASK (VIG_BASE_MASK | BIT(DPU_SSPP_QOS_8LVL))
+
+#define DMA_MSM8998_MASK \
+	(BIT(DPU_SSPP_QOS) |\
+	BIT(DPU_SSPP_TS_PREFILL) | BIT(DPU_SSPP_TS_PREFILL_REC1) |\
+	BIT(DPU_SSPP_CDP) | BIT(DPU_SSPP_EXCL_RECT))
+
+#define VIG_SC7280_MASK \
+	(VIG_SDM845_MASK | BIT(DPU_SSPP_INLINE_ROTATION))
+
+#define VIG_SC7280_MASK_SDMA \
+	(VIG_SC7280_MASK | BIT(DPU_SSPP_SMART_DMA_V2))
+
+#define DMA_SDM845_MASK \
+	(BIT(DPU_SSPP_QOS) | BIT(DPU_SSPP_QOS_8LVL) |\
+	BIT(DPU_SSPP_TS_PREFILL) | BIT(DPU_SSPP_TS_PREFILL_REC1) |\
+	BIT(DPU_SSPP_CDP) | BIT(DPU_SSPP_EXCL_RECT))
+
+#define DMA_CURSOR_SDM845_MASK \
+	(DMA_SDM845_MASK | BIT(DPU_SSPP_CURSOR))
+
+#define DMA_SDM845_MASK_SDMA \
+	(DMA_SDM845_MASK | BIT(DPU_SSPP_SMART_DMA_V2))
+
+#define DMA_CURSOR_SDM845_MASK_SDMA \
+	(DMA_CURSOR_SDM845_MASK | BIT(DPU_SSPP_SMART_DMA_V2))
+
+#define DMA_CURSOR_MSM8998_MASK \
+	(DMA_MSM8998_MASK | BIT(DPU_SSPP_CURSOR))
+
+#define MIXER_MSM8998_MASK \
+	(BIT(DPU_MIXER_SOURCESPLIT))
+
+#define MIXER_SDM845_MASK \
+	(BIT(DPU_MIXER_SOURCESPLIT) | BIT(DPU_DIM_LAYER) | BIT(DPU_MIXER_COMBINED_ALPHA))
+
+#define MIXER_QCM2290_MASK \
+	(BIT(DPU_DIM_LAYER) | BIT(DPU_MIXER_COMBINED_ALPHA))
+
+#define PINGPONG_SDM845_MASK \
+	(BIT(DPU_PINGPONG_DITHER) | BIT(DPU_PINGPONG_DSC))
+
+#define PINGPONG_SDM845_TE2_MASK \
+	(PINGPONG_SDM845_MASK | BIT(DPU_PINGPONG_TE2))
+
+#define PINGPONG_SM8150_MASK \
+	(BIT(DPU_PINGPONG_DITHER) | BIT(DPU_PINGPONG_DSC))
+
+#define CTL_SC7280_MASK \
+	(BIT(DPU_CTL_ACTIVE_CFG) | \
+	 BIT(DPU_CTL_FETCH_ACTIVE) | \
+	 BIT(DPU_CTL_VM_CFG) | \
+	 BIT(DPU_CTL_DSPP_SUB_BLOCK_FLUSH))
+
+#define CTL_SM8550_MASK \
+	(CTL_SC7280_MASK | BIT(DPU_CTL_HAS_LAYER_EXT4))
+
+#define DSPP_SC7180_MASK BIT(DPU_DSPP_PCC)
+
+#define INTF_SC7180_MASK \
+	(BIT(DPU_INTF_INPUT_CTRL) | \
+	 BIT(DPU_INTF_STATUS_SUPPORTED) | \
+	 BIT(DPU_DATA_HCTL_EN))
+
+#define INTF_SC7280_MASK (INTF_SC7180_MASK)
+
+#define WB_SM8250_MASK (BIT(DPU_WB_LINE_MODE) | \
+			 BIT(DPU_WB_UBWC) | \
+			 BIT(DPU_WB_YUV_CONFIG) | \
+			 BIT(DPU_WB_PIPE_ALPHA) | \
+			 BIT(DPU_WB_XY_ROI_OFFSET) | \
+			 BIT(DPU_WB_QOS) | \
+			 BIT(DPU_WB_QOS_8LVL) | \
+			 BIT(DPU_WB_CDP) | \
+			 BIT(DPU_WB_INPUT_CTRL))
+
+#define DEFAULT_PIXEL_RAM_SIZE		(50 * 1024)
+#define DEFAULT_DPU_LINE_WIDTH		2048
+#define DEFAULT_DPU_OUTPUT_LINE_WIDTH	2560
+
+#define MAX_HORZ_DECIMATION	4
+#define MAX_VERT_DECIMATION	4
+
+#define MAX_UPSCALE_RATIO	20
+#define MAX_DOWNSCALE_RATIO	4
+#define SSPP_UNITY_SCALE	1
+
+#define STRCAT(X, Y) (X Y)
+
+static const uint32_t plane_formats[] = {
+	DRM_FORMAT_ARGB8888,
+	DRM_FORMAT_ABGR8888,
+	DRM_FORMAT_RGBA8888,
+	DRM_FORMAT_BGRA8888,
+	DRM_FORMAT_XRGB8888,
+	DRM_FORMAT_RGBX8888,
+	DRM_FORMAT_BGRX8888,
+	DRM_FORMAT_XBGR8888,
+	DRM_FORMAT_ARGB2101010,
+	DRM_FORMAT_XRGB2101010,
+	DRM_FORMAT_RGB888,
+	DRM_FORMAT_BGR888,
+	DRM_FORMAT_RGB565,
+	DRM_FORMAT_BGR565,
+	DRM_FORMAT_ARGB1555,
+	DRM_FORMAT_ABGR1555,
+	DRM_FORMAT_RGBA5551,
+	DRM_FORMAT_BGRA5551,
+	DRM_FORMAT_XRGB1555,
+	DRM_FORMAT_XBGR1555,
+	DRM_FORMAT_RGBX5551,
+	DRM_FORMAT_BGRX5551,
+	DRM_FORMAT_ARGB4444,
+	DRM_FORMAT_ABGR4444,
+	DRM_FORMAT_RGBA4444,
+	DRM_FORMAT_BGRA4444,
+	DRM_FORMAT_XRGB4444,
+	DRM_FORMAT_XBGR4444,
+	DRM_FORMAT_RGBX4444,
+	DRM_FORMAT_BGRX4444,
+};
+
+static const uint32_t plane_formats_yuv[] = {
+	DRM_FORMAT_ARGB8888,
+	DRM_FORMAT_ABGR8888,
+	DRM_FORMAT_RGBA8888,
+	DRM_FORMAT_BGRX8888,
+	DRM_FORMAT_BGRA8888,
+	DRM_FORMAT_ARGB2101010,
+	DRM_FORMAT_XRGB2101010,
+	DRM_FORMAT_XRGB8888,
+	DRM_FORMAT_XBGR8888,
+	DRM_FORMAT_RGBX8888,
+	DRM_FORMAT_RGB888,
+	DRM_FORMAT_BGR888,
+	DRM_FORMAT_RGB565,
+	DRM_FORMAT_BGR565,
+	DRM_FORMAT_ARGB1555,
+	DRM_FORMAT_ABGR1555,
+	DRM_FORMAT_RGBA5551,
+	DRM_FORMAT_BGRA5551,
+	DRM_FORMAT_XRGB1555,
+	DRM_FORMAT_XBGR1555,
+	DRM_FORMAT_RGBX5551,
+	DRM_FORMAT_BGRX5551,
+	DRM_FORMAT_ARGB4444,
+	DRM_FORMAT_ABGR4444,
+	DRM_FORMAT_RGBA4444,
+	DRM_FORMAT_BGRA4444,
+	DRM_FORMAT_XRGB4444,
+	DRM_FORMAT_XBGR4444,
+	DRM_FORMAT_RGBX4444,
+	DRM_FORMAT_BGRX4444,
+
+	DRM_FORMAT_P010,
+	DRM_FORMAT_NV12,
+	DRM_FORMAT_NV21,
+	DRM_FORMAT_NV16,
+	DRM_FORMAT_NV61,
+	DRM_FORMAT_VYUY,
+	DRM_FORMAT_UYVY,
+	DRM_FORMAT_YUYV,
+	DRM_FORMAT_YVYU,
+	DRM_FORMAT_YUV420,
+	DRM_FORMAT_YVU420,
+};
+
+static const u32 rotation_v2_formats[] = {
+	DRM_FORMAT_NV12,
+	/* TODO add formats after validation */
+};
+
+static const u32 wb2_formats_rgb[] = {
+	DRM_FORMAT_RGB565,
+	DRM_FORMAT_BGR565,
+	DRM_FORMAT_RGB888,
+	DRM_FORMAT_ARGB8888,
+	DRM_FORMAT_RGBA8888,
+	DRM_FORMAT_ABGR8888,
+	DRM_FORMAT_XRGB8888,
+	DRM_FORMAT_RGBX8888,
+	DRM_FORMAT_XBGR8888,
+	DRM_FORMAT_ARGB1555,
+	DRM_FORMAT_RGBA5551,
+	DRM_FORMAT_XRGB1555,
+	DRM_FORMAT_RGBX5551,
+	DRM_FORMAT_ARGB4444,
+	DRM_FORMAT_RGBA4444,
+	DRM_FORMAT_RGBX4444,
+	DRM_FORMAT_XRGB4444,
+	DRM_FORMAT_BGR888,
+	DRM_FORMAT_BGRA8888,
+	DRM_FORMAT_BGRX8888,
+	DRM_FORMAT_ABGR1555,
+	DRM_FORMAT_BGRA5551,
+	DRM_FORMAT_XBGR1555,
+	DRM_FORMAT_BGRX5551,
+	DRM_FORMAT_ABGR4444,
+	DRM_FORMAT_BGRA4444,
+	DRM_FORMAT_BGRX4444,
+	DRM_FORMAT_XBGR4444,
+};
+
+static const u32 wb2_formats_rgb_yuv[] = {
+	DRM_FORMAT_RGB565,
+	DRM_FORMAT_BGR565,
+	DRM_FORMAT_RGB888,
+	DRM_FORMAT_ARGB8888,
+	DRM_FORMAT_RGBA8888,
+	DRM_FORMAT_ABGR8888,
+	DRM_FORMAT_XRGB8888,
+	DRM_FORMAT_RGBX8888,
+	DRM_FORMAT_XBGR8888,
+	DRM_FORMAT_ARGB1555,
+	DRM_FORMAT_RGBA5551,
+	DRM_FORMAT_XRGB1555,
+	DRM_FORMAT_RGBX5551,
+	DRM_FORMAT_ARGB4444,
+	DRM_FORMAT_RGBA4444,
+	DRM_FORMAT_RGBX4444,
+	DRM_FORMAT_XRGB4444,
+	DRM_FORMAT_BGR888,
+	DRM_FORMAT_BGRA8888,
+	DRM_FORMAT_BGRX8888,
+	DRM_FORMAT_ABGR1555,
+	DRM_FORMAT_BGRA5551,
+	DRM_FORMAT_XBGR1555,
+	DRM_FORMAT_BGRX5551,
+	DRM_FORMAT_ABGR4444,
+	DRM_FORMAT_BGRA4444,
+	DRM_FORMAT_BGRX4444,
+	DRM_FORMAT_XBGR4444,
+	DRM_FORMAT_NV12,
+};
+
+/*************************************************************
+ * SSPP sub blocks config
+ *************************************************************/
+
+#define SSPP_SCALER_VER(maj, min) (((maj) << 16) | (min))
+
+/* SSPP common configuration */
+#define _VIG_SBLK(scaler_ver) \
+	{ \
+	.maxdwnscale = MAX_DOWNSCALE_RATIO, \
+	.maxupscale = MAX_UPSCALE_RATIO, \
+	.scaler_blk = {.name = "scaler", \
+		.version = scaler_ver, \
+		.base = 0xa00, .len = 0xa0,}, \
+	.csc_blk = {.name = "csc", \
+		.base = 0x1a00, .len = 0x100,}, \
+	.format_list = plane_formats_yuv, \
+	.num_formats = ARRAY_SIZE(plane_formats_yuv), \
+	.virt_format_list = plane_formats, \
+	.virt_num_formats = ARRAY_SIZE(plane_formats), \
+	.rotation_cfg = NULL, \
+	}
+
+#define _VIG_SBLK_ROT(scaler_ver, rot_cfg) \
+	{ \
+	.maxdwnscale = MAX_DOWNSCALE_RATIO, \
+	.maxupscale = MAX_UPSCALE_RATIO, \
+	.scaler_blk = {.name = "scaler", \
+		.version = scaler_ver, \
+		.base = 0xa00, .len = 0xa0,}, \
+	.csc_blk = {.name = "csc", \
+		.base = 0x1a00, .len = 0x100,}, \
+	.format_list = plane_formats_yuv, \
+	.num_formats = ARRAY_SIZE(plane_formats_yuv), \
+	.virt_format_list = plane_formats, \
+	.virt_num_formats = ARRAY_SIZE(plane_formats), \
+	.rotation_cfg = rot_cfg, \
+	}
+
+#define _VIG_SBLK_NOSCALE() \
+	{ \
+	.maxdwnscale = SSPP_UNITY_SCALE, \
+	.maxupscale = SSPP_UNITY_SCALE, \
+	.format_list = plane_formats, \
+	.num_formats = ARRAY_SIZE(plane_formats), \
+	.virt_format_list = plane_formats, \
+	.virt_num_formats = ARRAY_SIZE(plane_formats), \
+	}
+
+#define _DMA_SBLK() \
+	{ \
+	.maxdwnscale = SSPP_UNITY_SCALE, \
+	.maxupscale = SSPP_UNITY_SCALE, \
+	.format_list = plane_formats, \
+	.num_formats = ARRAY_SIZE(plane_formats), \
+	.virt_format_list = plane_formats, \
+	.virt_num_formats = ARRAY_SIZE(plane_formats), \
+	}
+
+static const struct dpu_rotation_cfg dpu_rot_sc7280_cfg_v2 = {
+	.rot_maxheight = 1088,
+	.rot_num_formats = ARRAY_SIZE(rotation_v2_formats),
+	.rot_format_list = rotation_v2_formats,
+};
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_noscale =
+				_VIG_SBLK_NOSCALE();
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_qseed3_1_2 =
+				_VIG_SBLK(SSPP_SCALER_VER(1, 2));
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_qseed3_1_3 =
+				_VIG_SBLK(SSPP_SCALER_VER(1, 3));
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_qseed3_1_4 =
+				_VIG_SBLK(SSPP_SCALER_VER(1, 4));
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_qseed3_2_4 =
+				_VIG_SBLK(SSPP_SCALER_VER(2, 4));
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_qseed3_3_0 =
+				_VIG_SBLK(SSPP_SCALER_VER(3, 0));
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_qseed3_3_0_rot_v2 =
+			_VIG_SBLK_ROT(SSPP_SCALER_VER(3, 0),
+				      &dpu_rot_sc7280_cfg_v2);
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_qseed3_3_1 =
+				_VIG_SBLK(SSPP_SCALER_VER(3, 1));
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_qseed3_3_2 =
+				_VIG_SBLK(SSPP_SCALER_VER(3, 2));
+
+static const struct dpu_sspp_sub_blks dpu_vig_sblk_qseed3_3_3 =
+				_VIG_SBLK(SSPP_SCALER_VER(3, 3));
+
+static const struct dpu_sspp_sub_blks dpu_dma_sblk = _DMA_SBLK();
+
+/*************************************************************
+ * MIXER sub blocks config
+ *************************************************************/
+
+/* MSM8998 */
+
+static const struct dpu_lm_sub_blks msm8998_lm_sblk = {
+	.maxwidth = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.maxblendstages = 7, /* excluding base layer */
+	.blendstage_base = { /* offsets relative to mixer base */
+		0x20, 0x50, 0x80, 0xb0, 0x230,
+		0x260, 0x290
+	},
+};
+
+/* SDM845 */
+
+static const struct dpu_lm_sub_blks sdm845_lm_sblk = {
+	.maxwidth = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.maxblendstages = 11, /* excluding base layer */
+	.blendstage_base = { /* offsets relative to mixer base */
+		0x20, 0x38, 0x50, 0x68, 0x80, 0x98,
+		0xb0, 0xc8, 0xe0, 0xf8, 0x110
+	},
+};
+
+/* SC7180 */
+
+static const struct dpu_lm_sub_blks sc7180_lm_sblk = {
+	.maxwidth = DEFAULT_DPU_OUTPUT_LINE_WIDTH,
+	.maxblendstages = 7, /* excluding base layer */
+	.blendstage_base = { /* offsets relative to mixer base */
+		0x20, 0x38, 0x50, 0x68, 0x80, 0x98, 0xb0
+	},
+};
+
+/* QCM2290 */
+
+static const struct dpu_lm_sub_blks qcm2290_lm_sblk = {
+	.maxwidth = DEFAULT_DPU_LINE_WIDTH,
+	.maxblendstages = 4, /* excluding base layer */
+	.blendstage_base = { /* offsets relative to mixer base */
+		0x20, 0x38, 0x50, 0x68
+	},
+};
+
+/*************************************************************
+ * DSPP sub blocks config
+ *************************************************************/
+static const struct dpu_dspp_sub_blks msm8998_dspp_sblk = {
+	.pcc = {.name = "pcc", .base = 0x1700,
+		.len = 0x90, .version = 0x10007},
+};
+
+static const struct dpu_dspp_sub_blks sdm845_dspp_sblk = {
+	.pcc = {.name = "pcc", .base = 0x1700,
+		.len = 0x90, .version = 0x40000},
+};
+
+/*************************************************************
+ * PINGPONG sub blocks config
+ *************************************************************/
+static const struct dpu_pingpong_sub_blks sdm845_pp_sblk_te = {
+	.te2 = {.name = "te2", .base = 0x2000, .len = 0x0,
+		.version = 0x1},
+	.dither = {.name = "dither", .base = 0x30e0,
+		.len = 0x20, .version = 0x10000},
+};
+
+static const struct dpu_pingpong_sub_blks sdm845_pp_sblk = {
+	.dither = {.name = "dither", .base = 0x30e0,
+		.len = 0x20, .version = 0x10000},
+};
+
+static const struct dpu_pingpong_sub_blks sc7280_pp_sblk = {
+	.dither = {.name = "dither", .base = 0xe0,
+	.len = 0x20, .version = 0x20000},
+};
+
+/*************************************************************
+ * DSC sub blocks config
+ *************************************************************/
+static const struct dpu_dsc_sub_blks dsc_sblk_0 = {
+	.enc = {.name = "enc", .base = 0x100, .len = 0x9c},
+	.ctl = {.name = "ctl", .base = 0xF00, .len = 0x10},
+};
+
+static const struct dpu_dsc_sub_blks dsc_sblk_1 = {
+	.enc = {.name = "enc", .base = 0x200, .len = 0x9c},
+	.ctl = {.name = "ctl", .base = 0xF80, .len = 0x10},
+};
+
+/*************************************************************
+ * CDM block config
+ *************************************************************/
+static const struct dpu_cdm_cfg sc7280_cdm = {
+	.name = "cdm_0",
+	.id = CDM_0,
+	.len = 0x228,
+	.base = 0x79200,
+};
+
+/*************************************************************
+ * VBIF sub blocks config
+ *************************************************************/
+/* VBIF QOS remap */
+static const u32 msm8998_rt_pri_lvl[] = {1, 2, 2, 2};
+static const u32 msm8998_nrt_pri_lvl[] = {1, 1, 1, 1};
+static const u32 sdm845_rt_pri_lvl[] = {3, 3, 4, 4, 5, 5, 6, 6};
+static const u32 sdm845_nrt_pri_lvl[] = {3, 3, 3, 3, 3, 3, 3, 3};
+static const u32 sm8650_rt_pri_lvl[] = {4, 4, 5, 5, 5, 5, 5, 6};
+
+static const struct dpu_vbif_dynamic_ot_cfg msm8998_ot_rdwr_cfg[] = {
+	{
+		.pps = 1920 * 1080 * 30,
+		.ot_limit = 2,
+	},
+	{
+		.pps = 1920 * 1080 * 60,
+		.ot_limit = 4,
+	},
+	{
+		.pps = 3840 * 2160 * 30,
+		.ot_limit = 16,
+	},
+};
+
+static const struct dpu_vbif_cfg msm8998_vbif[] = {
+	{
+	.name = "vbif_rt", .id = VBIF_RT,
+	.base = 0, .len = 0x1040,
+	.default_ot_rd_limit = 32,
+	.default_ot_wr_limit = 32,
+	.features = BIT(DPU_VBIF_QOS_REMAP) | BIT(DPU_VBIF_QOS_OTLIM),
+	.xin_halt_timeout = 0x4000,
+	.qos_rp_remap_size = 0x20,
+	.dynamic_ot_rd_tbl = {
+		.count = ARRAY_SIZE(msm8998_ot_rdwr_cfg),
+		.cfg = msm8998_ot_rdwr_cfg,
+		},
+	.dynamic_ot_wr_tbl = {
+		.count = ARRAY_SIZE(msm8998_ot_rdwr_cfg),
+		.cfg = msm8998_ot_rdwr_cfg,
+		},
+	.qos_rt_tbl = {
+		.npriority_lvl = ARRAY_SIZE(msm8998_rt_pri_lvl),
+		.priority_lvl = msm8998_rt_pri_lvl,
+		},
+	.qos_nrt_tbl = {
+		.npriority_lvl = ARRAY_SIZE(msm8998_nrt_pri_lvl),
+		.priority_lvl = msm8998_nrt_pri_lvl,
+		},
+	.memtype_count = 14,
+	.memtype = {2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2},
+	},
+};
+
+static const struct dpu_vbif_cfg sdm845_vbif[] = {
+	{
+	.name = "vbif_rt", .id = VBIF_RT,
+	.base = 0, .len = 0x1040,
+	.features = BIT(DPU_VBIF_QOS_REMAP),
+	.xin_halt_timeout = 0x4000,
+	.qos_rp_remap_size = 0x40,
+	.qos_rt_tbl = {
+		.npriority_lvl = ARRAY_SIZE(sdm845_rt_pri_lvl),
+		.priority_lvl = sdm845_rt_pri_lvl,
+		},
+	.qos_nrt_tbl = {
+		.npriority_lvl = ARRAY_SIZE(sdm845_nrt_pri_lvl),
+		.priority_lvl = sdm845_nrt_pri_lvl,
+		},
+	.memtype_count = 14,
+	.memtype = {3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3},
+	},
+};
+
+static const struct dpu_vbif_cfg sm8550_vbif[] = {
+	{
+	.name = "vbif_rt", .id = VBIF_RT,
+	.base = 0, .len = 0x1040,
+	.features = BIT(DPU_VBIF_QOS_REMAP),
+	.xin_halt_timeout = 0x4000,
+	.qos_rp_remap_size = 0x40,
+	.qos_rt_tbl = {
+		.npriority_lvl = ARRAY_SIZE(sdm845_rt_pri_lvl),
+		.priority_lvl = sdm845_rt_pri_lvl,
+		},
+	.qos_nrt_tbl = {
+		.npriority_lvl = ARRAY_SIZE(sdm845_nrt_pri_lvl),
+		.priority_lvl = sdm845_nrt_pri_lvl,
+		},
+	.memtype_count = 16,
+	.memtype = {3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3},
+	},
+};
+
+static const struct dpu_vbif_cfg sm8650_vbif[] = {
+	{
+	.name = "vbif_rt", .id = VBIF_RT,
+	.base = 0, .len = 0x1074,
+	.features = BIT(DPU_VBIF_QOS_REMAP),
+	.xin_halt_timeout = 0x4000,
+	.qos_rp_remap_size = 0x40,
+	.qos_rt_tbl = {
+		.npriority_lvl = ARRAY_SIZE(sm8650_rt_pri_lvl),
+		.priority_lvl = sm8650_rt_pri_lvl,
+		},
+	.qos_nrt_tbl = {
+		.npriority_lvl = ARRAY_SIZE(sdm845_nrt_pri_lvl),
+		.priority_lvl = sdm845_nrt_pri_lvl,
+		},
+	.memtype_count = 16,
+	.memtype = {3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3},
+	},
+};
+
+/*************************************************************
+ * PERF data config
+ *************************************************************/
+
+/* SSPP QOS LUTs */
+static const struct dpu_qos_lut_entry msm8998_qos_linear[] = {
+	{.fl = 4,  .lut = 0x1b},
+	{.fl = 5,  .lut = 0x5b},
+	{.fl = 6,  .lut = 0x15b},
+	{.fl = 7,  .lut = 0x55b},
+	{.fl = 8,  .lut = 0x155b},
+	{.fl = 9,  .lut = 0x555b},
+	{.fl = 10, .lut = 0x1555b},
+	{.fl = 11, .lut = 0x5555b},
+	{.fl = 12, .lut = 0x15555b},
+	{.fl = 0,  .lut = 0x55555b}
+};
+
+static const struct dpu_qos_lut_entry sdm845_qos_linear[] = {
+	{.fl = 4, .lut = 0x357},
+	{.fl = 5, .lut = 0x3357},
+	{.fl = 6, .lut = 0x23357},
+	{.fl = 7, .lut = 0x223357},
+	{.fl = 8, .lut = 0x2223357},
+	{.fl = 9, .lut = 0x22223357},
+	{.fl = 10, .lut = 0x222223357},
+	{.fl = 11, .lut = 0x2222223357},
+	{.fl = 12, .lut = 0x22222223357},
+	{.fl = 13, .lut = 0x222222223357},
+	{.fl = 14, .lut = 0x1222222223357},
+	{.fl = 0, .lut = 0x11222222223357}
+};
+
+static const struct dpu_qos_lut_entry msm8998_qos_macrotile[] = {
+	{.fl = 10, .lut = 0x1aaff},
+	{.fl = 11, .lut = 0x5aaff},
+	{.fl = 12, .lut = 0x15aaff},
+	{.fl = 0,  .lut = 0x55aaff},
+};
+
+static const struct dpu_qos_lut_entry sc7180_qos_linear[] = {
+	{.fl = 0, .lut = 0x0011222222335777},
+};
+
+static const struct dpu_qos_lut_entry sm6350_qos_linear_macrotile[] = {
+	{.fl = 0, .lut = 0x0011223445566777 },
+};
+
+static const struct dpu_qos_lut_entry sm8150_qos_linear[] = {
+	{.fl = 0, .lut = 0x0011222222223357 },
+};
+
+static const struct dpu_qos_lut_entry sc8180x_qos_linear[] = {
+	{.fl = 4, .lut = 0x0000000000000357 },
+};
+
+static const struct dpu_qos_lut_entry qcm2290_qos_linear[] = {
+	{.fl = 0, .lut = 0x0011222222335777},
+};
+
+static const struct dpu_qos_lut_entry sdm845_qos_macrotile[] = {
+	{.fl = 10, .lut = 0x344556677},
+	{.fl = 11, .lut = 0x3344556677},
+	{.fl = 12, .lut = 0x23344556677},
+	{.fl = 13, .lut = 0x223344556677},
+	{.fl = 14, .lut = 0x1223344556677},
+	{.fl = 0, .lut = 0x112233344556677},
+};
+
+static const struct dpu_qos_lut_entry sc7180_qos_macrotile[] = {
+	{.fl = 0, .lut = 0x0011223344556677},
+};
+
+static const struct dpu_qos_lut_entry sc8180x_qos_macrotile[] = {
+	{.fl = 10, .lut = 0x0000000344556677},
+};
+
+static const struct dpu_qos_lut_entry msm8998_qos_nrt[] = {
+	{.fl = 0, .lut = 0x0},
+};
+
+static const struct dpu_qos_lut_entry sdm845_qos_nrt[] = {
+	{.fl = 0, .lut = 0x0},
+};
+
+static const struct dpu_qos_lut_entry sc7180_qos_nrt[] = {
+	{.fl = 0, .lut = 0x0},
+};
+
+/*************************************************************
+ * Hardware catalog
+ *************************************************************/
+
+#include "catalog/dpu_3_0_msm8998.h"
+
+#include "catalog/dpu_4_0_sdm845.h"
+#include "catalog/dpu_4_1_sdm670.h"
+
+#include "catalog/dpu_5_0_sm8150.h"
+#include "catalog/dpu_5_1_sc8180x.h"
+#include "catalog/dpu_5_4_sm6125.h"
+
+#include "catalog/dpu_6_0_sm8250.h"
+#include "catalog/dpu_6_2_sc7180.h"
+#include "catalog/dpu_6_3_sm6115.h"
+#include "catalog/dpu_6_4_sm6350.h"
+#include "catalog/dpu_6_5_qcm2290.h"
+#include "catalog/dpu_6_9_sm6375.h"
+
+#include "catalog/dpu_7_0_sm8350.h"
+#include "catalog/dpu_7_2_sc7280.h"
+
+#include "catalog/dpu_8_0_sc8280xp.h"
+#include "catalog/dpu_8_1_sm8450.h"
+#include "catalog/dpu_8_4_qcs8300.h"
+#include "catalog/dpu_8_4_sa8775p.h"
+
+#include "catalog/dpu_9_0_sm8550.h"
+
+#include "catalog/dpu_10_0_sm8650.h"
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_catalog.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_catalog.h
@@ -0,0 +1,855 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_CATALOG_H
+#define _DPU_HW_CATALOG_H
+
+#include <linux/kernel.h>
+#include <linux/bug.h>
+#include <linux/bitmap.h>
+#include <linux/err.h>
+
+/**
+ * Max hardware block count: For ex: max 12 SSPP pipes or
+ * 5 ctl paths. In all cases, it can have max 12 hardware blocks
+ * based on current design
+ */
+#define MAX_BLOCKS    12
+
+#define DPU_HW_BLK_NAME_LEN	16
+
+#define MAX_IMG_WIDTH 0x3fff
+#define MAX_IMG_HEIGHT 0x3fff
+
+#define CRTC_DUAL_MIXERS	2
+
+#define MAX_XIN_COUNT 16
+
+/**
+ * MDP TOP BLOCK features
+ * @DPU_MDP_PANIC_PER_PIPE Panic configuration needs to be done per pipe
+ * @DPU_MDP_10BIT_SUPPORT, Chipset supports 10 bit pixel formats
+ * @DPU_MDP_PERIPH_0_REMOVED Indicates that access to periph top0 block results
+ *			   in a failure
+ * @DPU_MDP_VSYNC_SEL      Enables vsync source selection via MDP_VSYNC_SEL register
+ *                         (moved into INTF block since DPU 5.0.0)
+ * @DPU_MDP_MAX            Maximum value
+
+ */
+enum {
+	DPU_MDP_PANIC_PER_PIPE = 0x1,
+	DPU_MDP_10BIT_SUPPORT,
+	DPU_MDP_AUDIO_SELECT,
+	DPU_MDP_PERIPH_0_REMOVED,
+	DPU_MDP_VSYNC_SEL,
+	DPU_MDP_MAX
+};
+
+/**
+ * SSPP sub-blocks/features
+ * @DPU_SSPP_SCALER_QSEED2,  QSEED2 algorithm support
+ * @DPU_SSPP_SCALER_QSEED3_COMPATIBLE,  QSEED3-compatible alogorithm support (includes QSEED3, QSEED3LITE and QSEED4)
+ * @DPU_SSPP_SCALER_RGB,     RGB Scaler, supported by RGB pipes
+ * @DPU_SSPP_CSC,            Support of Color space converion
+ * @DPU_SSPP_CSC_10BIT,      Support of 10-bit Color space conversion
+ * @DPU_SSPP_CURSOR,         SSPP can be used as a cursor layer
+ * @DPU_SSPP_QOS,            SSPP support QoS control, danger/safe/creq
+ * @DPU_SSPP_QOS_8LVL,       SSPP support 8-level QoS control
+ * @DPU_SSPP_EXCL_RECT,      SSPP supports exclusion rect
+ * @DPU_SSPP_SMART_DMA_V1,   SmartDMA 1.0 support
+ * @DPU_SSPP_SMART_DMA_V2,   SmartDMA 2.0 support
+ * @DPU_SSPP_TS_PREFILL      Supports prefill with traffic shaper
+ * @DPU_SSPP_TS_PREFILL_REC1 Supports prefill with traffic shaper multirec
+ * @DPU_SSPP_CDP             Supports client driven prefetch
+ * @DPU_SSPP_INLINE_ROTATION Support inline rotation
+ * @DPU_SSPP_MAX             maximum value
+ */
+enum {
+	DPU_SSPP_SCALER_QSEED2 = 0x1,
+	DPU_SSPP_SCALER_QSEED3_COMPATIBLE,
+	DPU_SSPP_SCALER_RGB,
+	DPU_SSPP_CSC,
+	DPU_SSPP_CSC_10BIT,
+	DPU_SSPP_CURSOR,
+	DPU_SSPP_QOS,
+	DPU_SSPP_QOS_8LVL,
+	DPU_SSPP_EXCL_RECT,
+	DPU_SSPP_SMART_DMA_V1,
+	DPU_SSPP_SMART_DMA_V2,
+	DPU_SSPP_TS_PREFILL,
+	DPU_SSPP_TS_PREFILL_REC1,
+	DPU_SSPP_CDP,
+	DPU_SSPP_INLINE_ROTATION,
+	DPU_SSPP_MAX
+};
+
+/*
+ * MIXER sub-blocks/features
+ * @DPU_MIXER_LAYER           Layer mixer layer blend configuration,
+ * @DPU_MIXER_SOURCESPLIT     Layer mixer supports source-split configuration
+ * @DPU_MIXER_GC              Gamma correction block
+ * @DPU_DIM_LAYER             Layer mixer supports dim layer
+ * @DPU_MIXER_COMBINED_ALPHA  Layer mixer has combined alpha register
+ * @DPU_MIXER_MAX             maximum value
+ */
+enum {
+	DPU_MIXER_LAYER = 0x1,
+	DPU_MIXER_SOURCESPLIT,
+	DPU_MIXER_GC,
+	DPU_DIM_LAYER,
+	DPU_MIXER_COMBINED_ALPHA,
+	DPU_MIXER_MAX
+};
+
+/**
+ * DSPP sub-blocks
+ * @DPU_DSPP_PCC             Panel color correction block
+ */
+enum {
+	DPU_DSPP_PCC = 0x1,
+	DPU_DSPP_MAX
+};
+
+/**
+ * PINGPONG sub-blocks
+ * @DPU_PINGPONG_TE2        Additional tear check block for split pipes
+ * @DPU_PINGPONG_SPLIT      PP block supports split fifo
+ * @DPU_PINGPONG_SLAVE      PP block is a suitable slave for split fifo
+ * @DPU_PINGPONG_DITHER     Dither blocks
+ * @DPU_PINGPONG_DSC        PP block supports DSC
+ * @DPU_PINGPONG_MAX
+ */
+enum {
+	DPU_PINGPONG_TE2 = 0x1,
+	DPU_PINGPONG_SPLIT,
+	DPU_PINGPONG_SLAVE,
+	DPU_PINGPONG_DITHER,
+	DPU_PINGPONG_DSC,
+	DPU_PINGPONG_MAX
+};
+
+/**
+ * CTL sub-blocks
+ * @DPU_CTL_SPLIT_DISPLAY:	CTL supports video mode split display
+ * @DPU_CTL_FETCH_ACTIVE:	Active CTL for fetch HW (SSPPs)
+ * @DPU_CTL_VM_CFG:		CTL config to support multiple VMs
+ * @DPU_CTL_HAS_LAYER_EXT4:	CTL has the CTL_LAYER_EXT4 register
+ * @DPU_CTL_DSPP_BLOCK_FLUSH:	CTL config to support dspp sub-block flush
+ * @DPU_CTL_MAX
+ */
+enum {
+	DPU_CTL_SPLIT_DISPLAY = 0x1,
+	DPU_CTL_ACTIVE_CFG,
+	DPU_CTL_FETCH_ACTIVE,
+	DPU_CTL_VM_CFG,
+	DPU_CTL_HAS_LAYER_EXT4,
+	DPU_CTL_DSPP_SUB_BLOCK_FLUSH,
+	DPU_CTL_MAX
+};
+
+/**
+ * INTF sub-blocks
+ * @DPU_INTF_INPUT_CTRL             Supports the setting of pp block from which
+ *                                  pixel data arrives to this INTF
+ * @DPU_DATA_HCTL_EN                Allows data to be transferred at different rate
+ *                                  than video timing
+ * @DPU_INTF_STATUS_SUPPORTED       INTF block has INTF_STATUS register
+ * @DPU_INTF_MAX
+ */
+enum {
+	DPU_INTF_INPUT_CTRL = 0x1,
+	DPU_DATA_HCTL_EN,
+	DPU_INTF_STATUS_SUPPORTED,
+	DPU_INTF_MAX
+};
+
+/**
+  * WB sub-blocks and features
+  * @DPU_WB_LINE_MODE        Writeback module supports line/linear mode
+  * @DPU_WB_BLOCK_MODE       Writeback module supports block mode read
+  * @DPU_WB_CHROMA_DOWN,     Writeback chroma down block,
+  * @DPU_WB_DOWNSCALE,       Writeback integer downscaler,
+  * @DPU_WB_DITHER,          Dither block
+  * @DPU_WB_TRAFFIC_SHAPER,  Writeback traffic shaper bloc
+  * @DPU_WB_UBWC,            Writeback Universal bandwidth compression
+  * @DPU_WB_YUV_CONFIG       Writeback supports output of YUV colorspace
+  * @DPU_WB_PIPE_ALPHA       Writeback supports pipe alpha
+  * @DPU_WB_XY_ROI_OFFSET    Writeback supports x/y-offset of out ROI in
+  *                          the destination image
+  * @DPU_WB_QOS,             Writeback supports QoS control, danger/safe/creq
+  * @DPU_WB_QOS_8LVL,        Writeback supports 8-level QoS control
+  * @DPU_WB_CDP              Writeback supports client driven prefetch
+  * @DPU_WB_INPUT_CTRL       Writeback supports from which pp block input pixel
+  *                          data arrives.
+  * @DPU_WB_CROP             CWB supports cropping
+  * @DPU_WB_MAX              maximum value
+  */
+enum {
+	DPU_WB_LINE_MODE = 0x1,
+	DPU_WB_BLOCK_MODE,
+	DPU_WB_UBWC,
+	DPU_WB_YUV_CONFIG,
+	DPU_WB_PIPE_ALPHA,
+	DPU_WB_XY_ROI_OFFSET,
+	DPU_WB_QOS,
+	DPU_WB_QOS_8LVL,
+	DPU_WB_CDP,
+	DPU_WB_INPUT_CTRL,
+	DPU_WB_CROP,
+	DPU_WB_MAX
+};
+
+/**
+ * VBIF sub-blocks and features
+ * @DPU_VBIF_QOS_OTLIM        VBIF supports OT Limit
+ * @DPU_VBIF_QOS_REMAP        VBIF supports QoS priority remap
+ * @DPU_VBIF_MAX              maximum value
+ */
+enum {
+	DPU_VBIF_QOS_OTLIM = 0x1,
+	DPU_VBIF_QOS_REMAP,
+	DPU_VBIF_MAX
+};
+
+/**
+ * DSC sub-blocks/features
+ * @DPU_DSC_OUTPUT_CTRL       Configure which PINGPONG block gets
+ *                            the pixel output from this DSC.
+ * @DPU_DSC_HW_REV_1_2        DSC block supports DSC 1.1 and 1.2
+ * @DPU_DSC_NATIVE_42x_EN     Supports NATIVE_422_EN and NATIVE_420_EN encoding
+ * @DPU_DSC_MAX
+ */
+enum {
+	DPU_DSC_OUTPUT_CTRL = 0x1,
+	DPU_DSC_HW_REV_1_2,
+	DPU_DSC_NATIVE_42x_EN,
+	DPU_DSC_MAX
+};
+
+/**
+ * MACRO DPU_HW_BLK_INFO - information of HW blocks inside DPU
+ * @name:              string name for debug purposes
+ * @id:                enum identifying this block
+ * @base:              register base offset to mdss
+ * @len:               length of hardware block
+ * @features           bit mask identifying sub-blocks/features
+ */
+#define DPU_HW_BLK_INFO \
+	char name[DPU_HW_BLK_NAME_LEN]; \
+	u32 id; \
+	u32 base; \
+	u32 len; \
+	unsigned long features
+
+/**
+ * struct dpu_scaler_blk: Scaler information
+ * @name: string name for debug purposes
+ * @base: offset of this sub-block relative to the block offset
+ * @len: register block length of this sub-block
+ * @version: qseed block revision, on QSEED3+ platforms this is the value of
+ *           scaler_blk.base + QSEED3_HW_VERSION registers.
+ */
+struct dpu_scaler_blk {
+	char name[DPU_HW_BLK_NAME_LEN];
+	u32 base;
+	u32 len;
+	u32 version;
+};
+
+struct dpu_csc_blk {
+	char name[DPU_HW_BLK_NAME_LEN];
+	u32 base;
+	u32 len;
+};
+
+/**
+ * struct dpu_pp_blk : Pixel processing sub-blk information
+ * @name: string name for debug purposes
+ * @base: offset of this sub-block relative to the block offset
+ * @len: register block length of this sub-block
+ * @version: HW Algorithm version
+ */
+struct dpu_pp_blk {
+	char name[DPU_HW_BLK_NAME_LEN];
+	u32 base;
+	u32 len;
+	u32 version;
+};
+
+/**
+ * struct dpu_dsc_blk - DSC Encoder sub-blk information
+ * @name: string name for debug purposes
+ * @base: offset of this sub-block relative to the block offset
+ * @len: register block length of this sub-block
+ */
+struct dpu_dsc_blk {
+	char name[DPU_HW_BLK_NAME_LEN];
+	u32 base;
+	u32 len;
+};
+
+/**
+ * enum dpu_qos_lut_usage - define QoS LUT use cases
+ */
+enum dpu_qos_lut_usage {
+	DPU_QOS_LUT_USAGE_LINEAR,
+	DPU_QOS_LUT_USAGE_MACROTILE,
+	DPU_QOS_LUT_USAGE_NRT,
+	DPU_QOS_LUT_USAGE_MAX,
+};
+
+/**
+ * struct dpu_qos_lut_entry - define QoS LUT table entry
+ * @fl: fill level, or zero on last entry to indicate default lut
+ * @lut: lut to use if equal to or less than fill level
+ */
+struct dpu_qos_lut_entry {
+	u32 fl;
+	u64 lut;
+};
+
+/**
+ * struct dpu_qos_lut_tbl - define QoS LUT table
+ * @nentry: number of entry in this table
+ * @entries: Pointer to table entries
+ */
+struct dpu_qos_lut_tbl {
+	u32 nentry;
+	const struct dpu_qos_lut_entry *entries;
+};
+
+/**
+ * struct dpu_rotation_cfg - define inline rotation config
+ * @rot_maxheight: max pre rotated height allowed for rotation
+ * @rot_num_formats: number of elements in @rot_format_list
+ * @rot_format_list: list of supported rotator formats
+ */
+struct dpu_rotation_cfg {
+	u32 rot_maxheight;
+	size_t rot_num_formats;
+	const u32 *rot_format_list;
+};
+
+/**
+ * struct dpu_caps - define DPU capabilities
+ * @max_mixer_width    max layer mixer line width support.
+ * @max_mixer_blendstages max layer mixer blend stages or
+ *                       supported z order
+ * @has_src_split      source split feature status
+ * @has_dim_layer      dim layer feature status
+ * @has_idle_pc        indicate if idle power collapse feature is supported
+ * @has_3d_merge       indicate if 3D merge is supported
+ * @max_linewidth      max linewidth for sspp
+ * @pixel_ram_size     size of latency hiding and de-tiling buffer in bytes
+ * @max_hdeci_exp      max horizontal decimation supported (max is 2^value)
+ * @max_vdeci_exp      max vertical decimation supported (max is 2^value)
+ */
+struct dpu_caps {
+	u32 max_mixer_width;
+	u32 max_mixer_blendstages;
+	bool has_src_split;
+	bool has_dim_layer;
+	bool has_idle_pc;
+	bool has_3d_merge;
+	/* SSPP limits */
+	u32 max_linewidth;
+	u32 pixel_ram_size;
+	u32 max_hdeci_exp;
+	u32 max_vdeci_exp;
+};
+
+/**
+ * struct dpu_sspp_sub_blks : SSPP sub-blocks
+ * common: Pointer to common configurations shared by sub blocks
+ * @maxdwnscale: max downscale ratio supported(without DECIMATION)
+ * @maxupscale:  maxupscale ratio supported
+ * @max_per_pipe_bw: maximum allowable bandwidth of this pipe in kBps
+ * @qseed_ver: qseed version
+ * @scaler_blk:
+ * @csc_blk:
+ * @format_list: Pointer to list of supported formats
+ * @num_formats: Number of supported formats
+ * @virt_format_list: Pointer to list of supported formats for virtual planes
+ * @virt_num_formats: Number of supported formats for virtual planes
+ * @dpu_rotation_cfg: inline rotation configuration
+ */
+struct dpu_sspp_sub_blks {
+	u32 maxdwnscale;
+	u32 maxupscale;
+	u32 max_per_pipe_bw;
+	u32 qseed_ver;
+	struct dpu_scaler_blk scaler_blk;
+	struct dpu_pp_blk csc_blk;
+
+	const u32 *format_list;
+	u32 num_formats;
+	const u32 *virt_format_list;
+	u32 virt_num_formats;
+	const struct dpu_rotation_cfg *rotation_cfg;
+};
+
+/**
+ * struct dpu_lm_sub_blks:      information of mixer block
+ * @maxwidth:               Max pixel width supported by this mixer
+ * @maxblendstages:         Max number of blend-stages supported
+ * @blendstage_base:        Blend-stage register base offset
+ */
+struct dpu_lm_sub_blks {
+	u32 maxwidth;
+	u32 maxblendstages;
+	u32 blendstage_base[MAX_BLOCKS];
+};
+
+/**
+ * struct dpu_dspp_sub_blks: Information of DSPP block
+ * @pcc: pixel color correction block
+ */
+struct dpu_dspp_sub_blks {
+	struct dpu_pp_blk pcc;
+};
+
+struct dpu_pingpong_sub_blks {
+	struct dpu_pp_blk te;
+	struct dpu_pp_blk te2;
+	struct dpu_pp_blk dither;
+};
+
+/**
+ * struct dpu_dsc_sub_blks - DSC sub-blks
+ * @enc: DSC encoder sub-block
+ * @ctl: DSC controller sub-block
+ */
+struct dpu_dsc_sub_blks {
+	struct dpu_dsc_blk enc;
+	struct dpu_dsc_blk ctl;
+};
+
+/**
+ * dpu_clk_ctrl_type - Defines top level clock control signals
+ */
+enum dpu_clk_ctrl_type {
+	DPU_CLK_CTRL_NONE,
+	DPU_CLK_CTRL_VIG0,
+	DPU_CLK_CTRL_VIG1,
+	DPU_CLK_CTRL_VIG2,
+	DPU_CLK_CTRL_VIG3,
+	DPU_CLK_CTRL_VIG4,
+	DPU_CLK_CTRL_RGB0,
+	DPU_CLK_CTRL_RGB1,
+	DPU_CLK_CTRL_RGB2,
+	DPU_CLK_CTRL_RGB3,
+	DPU_CLK_CTRL_DMA0,
+	DPU_CLK_CTRL_DMA1,
+	DPU_CLK_CTRL_DMA2,
+	DPU_CLK_CTRL_DMA3,
+	DPU_CLK_CTRL_DMA4,
+	DPU_CLK_CTRL_DMA5,
+	DPU_CLK_CTRL_CURSOR0,
+	DPU_CLK_CTRL_CURSOR1,
+	DPU_CLK_CTRL_INLINE_ROT0_SSPP,
+	DPU_CLK_CTRL_REG_DMA,
+	DPU_CLK_CTRL_WB2,
+	DPU_CLK_CTRL_MAX,
+};
+
+/* struct dpu_clk_ctrl_reg : Clock control register
+ * @reg_off:           register offset
+ * @bit_off:           bit offset
+ */
+struct dpu_clk_ctrl_reg {
+	u32 reg_off;
+	u32 bit_off;
+};
+
+/* struct dpu_mdp_cfg : MDP TOP-BLK instance info
+ * @id:                index identifying this block
+ * @base:              register base offset to mdss
+ * @features           bit mask identifying sub-blocks/features
+ * @clk_ctrls          clock control register definition
+ */
+struct dpu_mdp_cfg {
+	DPU_HW_BLK_INFO;
+	struct dpu_clk_ctrl_reg clk_ctrls[DPU_CLK_CTRL_MAX];
+};
+
+/* struct dpu_ctl_cfg : MDP CTL instance info
+ * @id:                index identifying this block
+ * @base:              register base offset to mdss
+ * @features           bit mask identifying sub-blocks/features
+ * @intr_start:        interrupt index for CTL_START
+ */
+struct dpu_ctl_cfg {
+	DPU_HW_BLK_INFO;
+	unsigned int intr_start;
+};
+
+/**
+ * struct dpu_sspp_cfg - information of source pipes
+ * @id:                index identifying this block
+ * @base               register offset of this block
+ * @features           bit mask identifying sub-blocks/features
+ * @sblk:              SSPP sub-blocks information
+ * @xin_id:            bus client identifier
+ * @clk_ctrl           clock control identifier
+ * @type               sspp type identifier
+ */
+struct dpu_sspp_cfg {
+	DPU_HW_BLK_INFO;
+	const struct dpu_sspp_sub_blks *sblk;
+	u32 xin_id;
+	enum dpu_clk_ctrl_type clk_ctrl;
+	u32 type;
+};
+
+/**
+ * struct dpu_lm_cfg - information of layer mixer blocks
+ * @id:                index identifying this block
+ * @base               register offset of this block
+ * @features           bit mask identifying sub-blocks/features
+ * @sblk:              LM Sub-blocks information
+ * @pingpong:          ID of connected PingPong, PINGPONG_NONE if unsupported
+ * @lm_pair:           ID of LM that can be controlled by same CTL
+ */
+struct dpu_lm_cfg {
+	DPU_HW_BLK_INFO;
+	const struct dpu_lm_sub_blks *sblk;
+	u32 pingpong;
+	u32 dspp;
+	unsigned long lm_pair;
+};
+
+/**
+ * struct dpu_dspp_cfg - information of DSPP blocks
+ * @id                 enum identifying this block
+ * @base               register offset of this block
+ * @features           bit mask identifying sub-blocks/features
+ *                     supported by this block
+ * @sblk               sub-blocks information
+ */
+struct dpu_dspp_cfg  {
+	DPU_HW_BLK_INFO;
+	const struct dpu_dspp_sub_blks *sblk;
+};
+
+/**
+ * struct dpu_pingpong_cfg - information of PING-PONG blocks
+ * @id                 enum identifying this block
+ * @base               register offset of this block
+ * @features           bit mask identifying sub-blocks/features
+ * @intr_done:         index for PINGPONG done interrupt
+ * @intr_rdptr:        index for PINGPONG readpointer done interrupt
+ * @sblk               sub-blocks information
+ */
+struct dpu_pingpong_cfg  {
+	DPU_HW_BLK_INFO;
+	u32 merge_3d;
+	unsigned int intr_done;
+	unsigned int intr_rdptr;
+	const struct dpu_pingpong_sub_blks *sblk;
+};
+
+/**
+ * struct dpu_merge_3d_cfg - information of DSPP blocks
+ * @id                 enum identifying this block
+ * @base               register offset of this block
+ * @features           bit mask identifying sub-blocks/features
+ *                     supported by this block
+ * @sblk               sub-blocks information
+ */
+struct dpu_merge_3d_cfg  {
+	DPU_HW_BLK_INFO;
+	const struct dpu_merge_3d_sub_blks *sblk;
+};
+
+/**
+ * struct dpu_dsc_cfg - information of DSC blocks
+ * @id                 enum identifying this block
+ * @base               register offset of this block
+ * @len:               length of hardware block
+ * @features           bit mask identifying sub-blocks/features
+ * @sblk:              sub-blocks information
+ */
+struct dpu_dsc_cfg {
+	DPU_HW_BLK_INFO;
+	const struct dpu_dsc_sub_blks *sblk;
+};
+
+/**
+ * struct dpu_intf_cfg - information of timing engine blocks
+ * @id                 enum identifying this block
+ * @base               register offset of this block
+ * @features           bit mask identifying sub-blocks/features
+ * @type:              Interface type(DSI, DP, HDMI)
+ * @controller_id:     Controller Instance ID in case of multiple of intf type
+ * @prog_fetch_lines_worst_case	Worst case latency num lines needed to prefetch
+ * @intr_underrun:	index for INTF underrun interrupt
+ * @intr_vsync:	        index for INTF VSYNC interrupt
+ * @intr_tear_rd_ptr:  Index for INTF TEAR_RD_PTR interrupt
+ */
+struct dpu_intf_cfg  {
+	DPU_HW_BLK_INFO;
+	u32 type;   /* interface type*/
+	u32 controller_id;
+	u32 prog_fetch_lines_worst_case;
+	unsigned int intr_underrun;
+	unsigned int intr_vsync;
+	unsigned int intr_tear_rd_ptr;
+};
+
+/**
+ * struct dpu_wb_cfg - information of writeback blocks
+ * @DPU_HW_BLK_INFO:    refer to the description above for DPU_HW_BLK_INFO
+ * @vbif_idx:           vbif client index
+ * @maxlinewidth:       max line width supported by writeback block
+ * @xin_id:             bus client identifier
+ * @intr_wb_done:       interrupt index for WB_DONE
+ * @format_list:	    list of formats supported by this writeback block
+ * @num_formats:	    number of formats supported by this writeback block
+ * @clk_ctrl:	        clock control identifier
+ */
+struct dpu_wb_cfg {
+	DPU_HW_BLK_INFO;
+	u8 vbif_idx;
+	u32 maxlinewidth;
+	u32 xin_id;
+	unsigned int intr_wb_done;
+	const u32 *format_list;
+	u32 num_formats;
+	enum dpu_clk_ctrl_type clk_ctrl;
+};
+
+/**
+ * struct dpu_vbif_dynamic_ot_cfg - dynamic OT setting
+ * @pps                pixel per seconds
+ * @ot_limit           OT limit to use up to specified pixel per second
+ */
+struct dpu_vbif_dynamic_ot_cfg {
+	u64 pps;
+	u32 ot_limit;
+};
+
+/**
+ * struct dpu_vbif_dynamic_ot_tbl - dynamic OT setting table
+ * @count              length of cfg
+ * @cfg                pointer to array of configuration settings with
+ *                     ascending requirements
+ */
+struct dpu_vbif_dynamic_ot_tbl {
+	u32 count;
+	const struct dpu_vbif_dynamic_ot_cfg *cfg;
+};
+
+/**
+ * struct dpu_vbif_qos_tbl - QoS priority table
+ * @npriority_lvl      num of priority level
+ * @priority_lvl       pointer to array of priority level in ascending order
+ */
+struct dpu_vbif_qos_tbl {
+	u32 npriority_lvl;
+	const u32 *priority_lvl;
+};
+
+/**
+ * struct dpu_vbif_cfg - information of VBIF blocks
+ * @id                 enum identifying this block
+ * @base               register offset of this block
+ * @features           bit mask identifying sub-blocks/features
+ * @ot_rd_limit        default OT read limit
+ * @ot_wr_limit        default OT write limit
+ * @xin_halt_timeout   maximum time (in usec) for xin to halt
+ * @qos_rp_remap_size  size of VBIF_XINL_QOS_RP_REMAP register space
+ * @dynamic_ot_rd_tbl  dynamic OT read configuration table
+ * @dynamic_ot_wr_tbl  dynamic OT write configuration table
+ * @qos_rt_tbl         real-time QoS priority table
+ * @qos_nrt_tbl        non-real-time QoS priority table
+ * @memtype_count      number of defined memtypes
+ * @memtype            array of xin memtype definitions
+ */
+struct dpu_vbif_cfg {
+	DPU_HW_BLK_INFO;
+	u32 default_ot_rd_limit;
+	u32 default_ot_wr_limit;
+	u32 xin_halt_timeout;
+	u32 qos_rp_remap_size;
+	struct dpu_vbif_dynamic_ot_tbl dynamic_ot_rd_tbl;
+	struct dpu_vbif_dynamic_ot_tbl dynamic_ot_wr_tbl;
+	struct dpu_vbif_qos_tbl qos_rt_tbl;
+	struct dpu_vbif_qos_tbl qos_nrt_tbl;
+	u32 memtype_count;
+	u32 memtype[MAX_XIN_COUNT];
+};
+
+/**
+ * struct dpu_cdm_cfg - information of chroma down blocks
+ * @name               string name for debug purposes
+ * @id                 enum identifying this block
+ * @base               register offset of this block
+ * @features           bit mask identifying sub-blocks/features
+ */
+struct dpu_cdm_cfg {
+	DPU_HW_BLK_INFO;
+};
+
+/**
+ * Define CDP use cases
+ * @DPU_PERF_CDP_UDAGE_RT: real-time use cases
+ * @DPU_PERF_CDP_USAGE_NRT: non real-time use cases such as WFD
+ */
+enum {
+	DPU_PERF_CDP_USAGE_RT,
+	DPU_PERF_CDP_USAGE_NRT,
+	DPU_PERF_CDP_USAGE_MAX
+};
+
+/**
+ * struct dpu_perf_cdp_cfg - define CDP use case configuration
+ * @rd_enable: true if read pipe CDP is enabled
+ * @wr_enable: true if write pipe CDP is enabled
+ */
+struct dpu_perf_cdp_cfg {
+	bool rd_enable;
+	bool wr_enable;
+};
+
+/**
+ * struct dpu_mdss_version - DPU's major and minor versions
+ * @core_major_ver: DPU core's major version
+ * @core_minor_ver: DPU core's minor version
+ */
+struct dpu_mdss_version {
+	u8 core_major_ver;
+	u8 core_minor_ver;
+};
+
+/**
+ * struct dpu_perf_cfg - performance control settings
+ * @max_bw_low         low threshold of maximum bandwidth (kbps)
+ * @max_bw_high        high threshold of maximum bandwidth (kbps)
+ * @min_core_ib        minimum bandwidth for core (kbps)
+ * @min_core_ib        minimum mnoc ib vote in kbps
+ * @min_llcc_ib        minimum llcc ib vote in kbps
+ * @min_dram_ib        minimum dram ib vote in kbps
+ * @undersized_prefill_lines   undersized prefill in lines
+ * @xtra_prefill_lines         extra prefill latency in lines
+ * @dest_scale_prefill_lines   destination scaler latency in lines
+ * @macrotile_perfill_lines    macrotile latency in lines
+ * @yuv_nv12_prefill_lines     yuv_nv12 latency in lines
+ * @linear_prefill_lines       linear latency in lines
+ * @downscaling_prefill_lines  downscaling latency in lines
+ * @amortizable_theshold minimum y position for traffic shaping prefill
+ * @min_prefill_lines  minimum pipeline latency in lines
+ * @clk_inefficiency_factor DPU src clock inefficiency factor
+ * @bw_inefficiency_factor DPU axi bus bw inefficiency factor
+ * @safe_lut_tbl: LUT tables for safe signals
+ * @danger_lut_tbl: LUT tables for danger signals
+ * @qos_lut_tbl: LUT tables for QoS signals
+ * @cdp_cfg            cdp use case configurations
+ */
+struct dpu_perf_cfg {
+	u32 max_bw_low;
+	u32 max_bw_high;
+	u32 min_core_ib;
+	u32 min_llcc_ib;
+	u32 min_dram_ib;
+	u32 undersized_prefill_lines;
+	u32 xtra_prefill_lines;
+	u32 dest_scale_prefill_lines;
+	u32 macrotile_prefill_lines;
+	u32 yuv_nv12_prefill_lines;
+	u32 linear_prefill_lines;
+	u32 downscaling_prefill_lines;
+	u32 amortizable_threshold;
+	u32 min_prefill_lines;
+	u32 clk_inefficiency_factor;
+	u32 bw_inefficiency_factor;
+	u32 safe_lut_tbl[DPU_QOS_LUT_USAGE_MAX];
+	u32 danger_lut_tbl[DPU_QOS_LUT_USAGE_MAX];
+	struct dpu_qos_lut_tbl qos_lut_tbl[DPU_QOS_LUT_USAGE_MAX];
+	struct dpu_perf_cdp_cfg cdp_cfg[DPU_PERF_CDP_USAGE_MAX];
+};
+
+/**
+ * struct dpu_mdss_cfg - information of MDSS HW
+ * This is the main catalog data structure representing
+ * this HW version. Contains dpu's major and minor versions,
+ * number of instances, register offsets, capabilities of the
+ * all MDSS HW sub-blocks.
+ *
+ * @dma_formats        Supported formats for dma pipe
+ * @cursor_formats     Supported formats for cursor pipe
+ * @vig_formats        Supported formats for vig pipe
+ */
+struct dpu_mdss_cfg {
+	const struct dpu_mdss_version *mdss_ver;
+
+	const struct dpu_caps *caps;
+
+	const struct dpu_mdp_cfg *mdp;
+
+	u32 ctl_count;
+	const struct dpu_ctl_cfg *ctl;
+
+	u32 sspp_count;
+	const struct dpu_sspp_cfg *sspp;
+
+	u32 mixer_count;
+	const struct dpu_lm_cfg *mixer;
+
+	u32 pingpong_count;
+	const struct dpu_pingpong_cfg *pingpong;
+
+	u32 merge_3d_count;
+	const struct dpu_merge_3d_cfg *merge_3d;
+
+	u32 dsc_count;
+	const struct dpu_dsc_cfg *dsc;
+
+	u32 intf_count;
+	const struct dpu_intf_cfg *intf;
+
+	u32 vbif_count;
+	const struct dpu_vbif_cfg *vbif;
+
+	u32 wb_count;
+	const struct dpu_wb_cfg *wb;
+
+	const struct dpu_cdm_cfg *cdm;
+
+	u32 ad_count;
+
+	u32 dspp_count;
+	const struct dpu_dspp_cfg *dspp;
+
+	/* Add additional block data structures here */
+
+	const struct dpu_perf_cfg *perf;
+	const struct dpu_format_extended *dma_formats;
+	const struct dpu_format_extended *cursor_formats;
+	const struct dpu_format_extended *vig_formats;
+};
+
+extern const struct dpu_mdss_cfg dpu_msm8998_cfg;
+extern const struct dpu_mdss_cfg dpu_sdm845_cfg;
+extern const struct dpu_mdss_cfg dpu_sdm670_cfg;
+extern const struct dpu_mdss_cfg dpu_sm8150_cfg;
+extern const struct dpu_mdss_cfg dpu_sc8180x_cfg;
+extern const struct dpu_mdss_cfg dpu_sm8250_cfg;
+extern const struct dpu_mdss_cfg dpu_sc7180_cfg;
+extern const struct dpu_mdss_cfg dpu_sm6115_cfg;
+extern const struct dpu_mdss_cfg dpu_sm6125_cfg;
+extern const struct dpu_mdss_cfg dpu_sm6350_cfg;
+extern const struct dpu_mdss_cfg dpu_qcm2290_cfg;
+extern const struct dpu_mdss_cfg dpu_sm6375_cfg;
+extern const struct dpu_mdss_cfg dpu_sm8350_cfg;
+extern const struct dpu_mdss_cfg dpu_sc7280_cfg;
+extern const struct dpu_mdss_cfg dpu_sc8280xp_cfg;
+extern const struct dpu_mdss_cfg dpu_sm8450_cfg;
+extern const struct dpu_mdss_cfg dpu_qcs8300_cfg;
+extern const struct dpu_mdss_cfg dpu_sa8775p_cfg;
+extern const struct dpu_mdss_cfg dpu_sm8550_cfg;
+extern const struct dpu_mdss_cfg dpu_sm8650_cfg;
+
+#endif /* _DPU_HW_CATALOG_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_cdm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_cdm.c
@@ -0,0 +1,247 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/bitfield.h>
+
+#include <drm/drm_managed.h>
+
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_cdm.h"
+#include "dpu_kms.h"
+
+#define CDM_CSC_10_OPMODE                  0x000
+#define CDM_CSC_10_BASE                    0x004
+
+#define CDM_CDWN2_OP_MODE                  0x100
+#define CDM_CDWN2_CLAMP_OUT                0x104
+#define CDM_CDWN2_PARAMS_3D_0              0x108
+#define CDM_CDWN2_PARAMS_3D_1              0x10C
+#define CDM_CDWN2_COEFF_COSITE_H_0         0x110
+#define CDM_CDWN2_COEFF_COSITE_H_1         0x114
+#define CDM_CDWN2_COEFF_COSITE_H_2         0x118
+#define CDM_CDWN2_COEFF_OFFSITE_H_0        0x11C
+#define CDM_CDWN2_COEFF_OFFSITE_H_1        0x120
+#define CDM_CDWN2_COEFF_OFFSITE_H_2        0x124
+#define CDM_CDWN2_COEFF_COSITE_V           0x128
+#define CDM_CDWN2_COEFF_OFFSITE_V          0x12C
+#define CDM_CDWN2_OUT_SIZE                 0x130
+
+#define CDM_HDMI_PACK_OP_MODE              0x200
+#define CDM_CSC_10_MATRIX_COEFF_0          0x004
+
+#define CDM_MUX                            0x224
+
+/* CDM CDWN2 sub-block bit definitions */
+#define CDM_CDWN2_OP_MODE_EN                  BIT(0)
+#define CDM_CDWN2_OP_MODE_ENABLE_H            BIT(1)
+#define CDM_CDWN2_OP_MODE_ENABLE_V            BIT(2)
+#define CDM_CDWN2_OP_MODE_BITS_OUT_8BIT       BIT(7)
+#define CDM_CDWN2_V_PIXEL_METHOD_MASK         GENMASK(6, 5)
+#define CDM_CDWN2_H_PIXEL_METHOD_MASK         GENMASK(4, 3)
+
+/* CDM CSC10 sub-block bit definitions */
+#define CDM_CSC10_OP_MODE_EN               BIT(0)
+#define CDM_CSC10_OP_MODE_SRC_FMT_YUV      BIT(1)
+#define CDM_CSC10_OP_MODE_DST_FMT_YUV      BIT(2)
+
+/* CDM HDMI pack sub-block bit definitions */
+#define CDM_HDMI_PACK_OP_MODE_EN           BIT(0)
+
+/*
+ * Horizontal coefficients for cosite chroma downscale
+ * s13 representation of coefficients
+ */
+static u32 cosite_h_coeff[] = {0x00000016, 0x000001cc, 0x0100009e};
+
+/*
+ * Horizontal coefficients for offsite chroma downscale
+ */
+static u32 offsite_h_coeff[] = {0x000b0005, 0x01db01eb, 0x00e40046};
+
+/*
+ * Vertical coefficients for cosite chroma downscale
+ */
+static u32 cosite_v_coeff[] = {0x00080004};
+/*
+ * Vertical coefficients for offsite chroma downscale
+ */
+static u32 offsite_v_coeff[] = {0x00060002};
+
+static int dpu_hw_cdm_setup_cdwn(struct dpu_hw_cdm *ctx, struct dpu_hw_cdm_cfg *cfg)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	u32 opmode;
+	u32 out_size;
+
+	switch (cfg->h_cdwn_type) {
+	case CDM_CDWN_DISABLE:
+		opmode = 0;
+		break;
+	case CDM_CDWN_PIXEL_DROP:
+		opmode = CDM_CDWN2_OP_MODE_ENABLE_H |
+				FIELD_PREP(CDM_CDWN2_H_PIXEL_METHOD_MASK,
+					   CDM_CDWN2_METHOD_PIXEL_DROP);
+		break;
+	case CDM_CDWN_AVG:
+		opmode = CDM_CDWN2_OP_MODE_ENABLE_H |
+				FIELD_PREP(CDM_CDWN2_H_PIXEL_METHOD_MASK,
+					   CDM_CDWN2_METHOD_AVG);
+		break;
+	case CDM_CDWN_COSITE:
+		opmode = CDM_CDWN2_OP_MODE_ENABLE_H |
+				FIELD_PREP(CDM_CDWN2_H_PIXEL_METHOD_MASK,
+					   CDM_CDWN2_METHOD_COSITE);
+		DPU_REG_WRITE(c, CDM_CDWN2_COEFF_COSITE_H_0,
+			      cosite_h_coeff[0]);
+		DPU_REG_WRITE(c, CDM_CDWN2_COEFF_COSITE_H_1,
+			      cosite_h_coeff[1]);
+		DPU_REG_WRITE(c, CDM_CDWN2_COEFF_COSITE_H_2,
+			      cosite_h_coeff[2]);
+		break;
+	case CDM_CDWN_OFFSITE:
+		opmode = CDM_CDWN2_OP_MODE_ENABLE_H |
+				FIELD_PREP(CDM_CDWN2_H_PIXEL_METHOD_MASK, CDM_CDWN2_METHOD_OFFSITE);
+		DPU_REG_WRITE(c, CDM_CDWN2_COEFF_OFFSITE_H_0,
+			      offsite_h_coeff[0]);
+		DPU_REG_WRITE(c, CDM_CDWN2_COEFF_OFFSITE_H_1,
+			      offsite_h_coeff[1]);
+		DPU_REG_WRITE(c, CDM_CDWN2_COEFF_OFFSITE_H_2,
+			      offsite_h_coeff[2]);
+		break;
+	default:
+		DPU_ERROR("%s invalid horz down sampling type\n", __func__);
+		return -EINVAL;
+	}
+
+	switch (cfg->v_cdwn_type) {
+	case CDM_CDWN_DISABLE:
+		/* if its only Horizontal downsample, we dont need to do anything here */
+		break;
+	case CDM_CDWN_PIXEL_DROP:
+		opmode |= CDM_CDWN2_OP_MODE_ENABLE_V |
+				FIELD_PREP(CDM_CDWN2_V_PIXEL_METHOD_MASK,
+					   CDM_CDWN2_METHOD_PIXEL_DROP);
+		break;
+	case CDM_CDWN_AVG:
+		opmode |= CDM_CDWN2_OP_MODE_ENABLE_V |
+				FIELD_PREP(CDM_CDWN2_V_PIXEL_METHOD_MASK,
+					   CDM_CDWN2_METHOD_AVG);
+		break;
+	case CDM_CDWN_COSITE:
+		opmode |= CDM_CDWN2_OP_MODE_ENABLE_V |
+				FIELD_PREP(CDM_CDWN2_V_PIXEL_METHOD_MASK,
+					   CDM_CDWN2_METHOD_COSITE);
+		DPU_REG_WRITE(c,
+			      CDM_CDWN2_COEFF_COSITE_V,
+			      cosite_v_coeff[0]);
+		break;
+	case CDM_CDWN_OFFSITE:
+		opmode |= CDM_CDWN2_OP_MODE_ENABLE_V |
+				FIELD_PREP(CDM_CDWN2_V_PIXEL_METHOD_MASK,
+					   CDM_CDWN2_METHOD_OFFSITE);
+		DPU_REG_WRITE(c,
+			      CDM_CDWN2_COEFF_OFFSITE_V,
+			      offsite_v_coeff[0]);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (cfg->output_bit_depth != CDM_CDWN_OUTPUT_10BIT)
+		opmode |= CDM_CDWN2_OP_MODE_BITS_OUT_8BIT;
+
+	if (cfg->v_cdwn_type || cfg->h_cdwn_type)
+		opmode |= CDM_CDWN2_OP_MODE_EN; /* EN CDWN module */
+	else
+		opmode &= ~CDM_CDWN2_OP_MODE_EN;
+
+	out_size = (cfg->output_width & 0xFFFF) | ((cfg->output_height & 0xFFFF) << 16);
+	DPU_REG_WRITE(c, CDM_CDWN2_OUT_SIZE, out_size);
+	DPU_REG_WRITE(c, CDM_CDWN2_OP_MODE, opmode);
+	DPU_REG_WRITE(c, CDM_CDWN2_CLAMP_OUT, ((0x3FF << 16) | 0x0));
+
+	return 0;
+}
+
+static int dpu_hw_cdm_enable(struct dpu_hw_cdm *ctx, struct dpu_hw_cdm_cfg *cdm)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	const struct dpu_format *fmt;
+	u32 opmode = 0;
+	u32 csc = 0;
+
+	if (!ctx || !cdm)
+		return -EINVAL;
+
+	fmt = cdm->output_fmt;
+
+	if (!DPU_FORMAT_IS_YUV(fmt))
+		return -EINVAL;
+
+	dpu_hw_csc_setup(&ctx->hw, CDM_CSC_10_MATRIX_COEFF_0, cdm->csc_cfg, true);
+	dpu_hw_cdm_setup_cdwn(ctx, cdm);
+
+	if (cdm->output_type == CDM_CDWN_OUTPUT_HDMI) {
+		if (fmt->chroma_sample == DPU_CHROMA_H1V2)
+			return -EINVAL; /*unsupported format */
+		opmode = CDM_HDMI_PACK_OP_MODE_EN;
+		opmode |= (fmt->chroma_sample << 1);
+	}
+
+	csc |= CDM_CSC10_OP_MODE_DST_FMT_YUV;
+	csc &= ~CDM_CSC10_OP_MODE_SRC_FMT_YUV;
+	csc |= CDM_CSC10_OP_MODE_EN;
+
+	if (ctx && ctx->ops.bind_pingpong_blk)
+		ctx->ops.bind_pingpong_blk(ctx, cdm->pp_id);
+
+	DPU_REG_WRITE(c, CDM_CSC_10_OPMODE, csc);
+	DPU_REG_WRITE(c, CDM_HDMI_PACK_OP_MODE, opmode);
+	return 0;
+}
+
+static void dpu_hw_cdm_bind_pingpong_blk(struct dpu_hw_cdm *ctx, const enum dpu_pingpong pp)
+{
+	struct dpu_hw_blk_reg_map *c;
+	int mux_cfg;
+
+	c = &ctx->hw;
+
+	mux_cfg = DPU_REG_READ(c, CDM_MUX);
+	mux_cfg &= ~0xf;
+
+	if (pp)
+		mux_cfg |= (pp - PINGPONG_0) & 0x7;
+	else
+		mux_cfg |= 0xf;
+
+	DPU_REG_WRITE(c, CDM_MUX, mux_cfg);
+}
+
+struct dpu_hw_cdm *dpu_hw_cdm_init(struct drm_device *dev,
+				   const struct dpu_cdm_cfg *cfg, void __iomem *addr,
+				   const struct dpu_mdss_version *mdss_rev)
+{
+	struct dpu_hw_cdm *c;
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_CDM;
+
+	/* Assign ops */
+	c->idx = cfg->id;
+	c->caps = cfg;
+
+	c->ops.enable = dpu_hw_cdm_enable;
+	if (mdss_rev->core_major_ver >= 5)
+		c->ops.bind_pingpong_blk = dpu_hw_cdm_bind_pingpong_blk;
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_cdm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_cdm.h
@@ -0,0 +1,142 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_CDM_H
+#define _DPU_HW_CDM_H
+
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_top.h"
+
+struct dpu_hw_cdm;
+
+/**
+ * struct dpu_hw_cdm_cfg : current configuration of CDM block
+ *
+ *  @output_width:         output ROI width of CDM block
+ *  @output_height:        output ROI height of CDM block
+ *  @output_bit_depth:     output bit-depth of CDM block
+ *  @h_cdwn_type:          downsample type used for horizontal pixels
+ *  @v_cdwn_type:          downsample type used for vertical pixels
+ *  @output_fmt:           handle to dpu_format of CDM block
+ *  @csc_cfg:              handle to CSC matrix programmed for CDM block
+ *  @output_type:          interface to which CDM is paired (HDMI/WB)
+ *  @pp_id:                ping-pong block to which CDM is bound to
+ */
+struct dpu_hw_cdm_cfg {
+	u32 output_width;
+	u32 output_height;
+	u32 output_bit_depth;
+	u32 h_cdwn_type;
+	u32 v_cdwn_type;
+	const struct dpu_format *output_fmt;
+	const struct dpu_csc_cfg *csc_cfg;
+	u32 output_type;
+	int pp_id;
+};
+
+/*
+ * These values are used indicate which type of downsample is used
+ * in the horizontal/vertical direction for the CDM block.
+ */
+enum dpu_hw_cdwn_type {
+	CDM_CDWN_DISABLE,
+	CDM_CDWN_PIXEL_DROP,
+	CDM_CDWN_AVG,
+	CDM_CDWN_COSITE,
+	CDM_CDWN_OFFSITE,
+};
+
+/*
+ * CDM block can be paired with WB or HDMI block. These values match
+ * the input with which the CDM block is paired.
+ */
+enum dpu_hw_cdwn_output_type {
+	CDM_CDWN_OUTPUT_HDMI,
+	CDM_CDWN_OUTPUT_WB,
+};
+
+/*
+ * CDM block can give an 8-bit or 10-bit output. These values
+ * are used to indicate the output bit depth of CDM block
+ */
+enum dpu_hw_cdwn_output_bit_depth {
+	CDM_CDWN_OUTPUT_8BIT,
+	CDM_CDWN_OUTPUT_10BIT,
+};
+
+/*
+ * CDM block can downsample using different methods. These values
+ * are used to indicate the downsample method which can be used
+ * either in the horizontal or vertical direction.
+ */
+enum dpu_hw_cdwn_op_mode_method_h_v {
+	CDM_CDWN2_METHOD_PIXEL_DROP,
+	CDM_CDWN2_METHOD_AVG,
+	CDM_CDWN2_METHOD_COSITE,
+	CDM_CDWN2_METHOD_OFFSITE
+};
+
+/**
+ * struct dpu_hw_cdm_ops : Interface to the chroma down Hw driver functions
+ *                         Assumption is these functions will be called after
+ *                         clocks are enabled
+ *  @enable:               Enables the output to interface and programs the
+ *                         output packer
+ *  @bind_pingpong_blk:    enable/disable the connection with pingpong which
+ *                         will feed pixels to this cdm
+ */
+struct dpu_hw_cdm_ops {
+	/**
+	 * Enable the CDM module
+	 * @cdm         Pointer to chroma down context
+	 */
+	int (*enable)(struct dpu_hw_cdm *cdm, struct dpu_hw_cdm_cfg *cfg);
+
+	/**
+	 * Enable/disable the connection with pingpong
+	 * @cdm         Pointer to chroma down context
+	 * @pp          pingpong block id.
+	 */
+	void (*bind_pingpong_blk)(struct dpu_hw_cdm *cdm, const enum dpu_pingpong pp);
+};
+
+/**
+ * struct dpu_hw_cdm - cdm description
+ * @base: Hardware block base structure
+ * @hw: Block hardware details
+ * @idx: CDM index
+ * @caps: Pointer to cdm_cfg
+ * @ops: handle to operations possible for this CDM
+ */
+struct dpu_hw_cdm {
+	struct dpu_hw_blk base;
+	struct dpu_hw_blk_reg_map hw;
+
+	/* chroma down */
+	const struct dpu_cdm_cfg *caps;
+	enum  dpu_cdm  idx;
+
+	/* ops */
+	struct dpu_hw_cdm_ops ops;
+};
+
+/**
+ * dpu_hw_cdm_init - initializes the cdm hw driver object.
+ * should be called once before accessing every cdm.
+ * @dev: DRM device handle
+ * @cdm: CDM catalog entry for which driver object is required
+ * @addr :   mapped register io address of MDSS
+ * @mdss_rev: mdss hw core revision
+ */
+struct dpu_hw_cdm *dpu_hw_cdm_init(struct drm_device *dev,
+				   const struct dpu_cdm_cfg *cdm, void __iomem *addr,
+				   const struct dpu_mdss_version *mdss_rev);
+
+static inline struct dpu_hw_cdm *to_dpu_hw_cdm(struct dpu_hw_blk *hw)
+{
+	return container_of(hw, struct dpu_hw_cdm, base);
+}
+
+#endif /*_DPU_HW_CDM_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_ctl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_ctl.c
@@ -0,0 +1,761 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+
+#include <drm/drm_managed.h>
+
+#include "dpu_hwio.h"
+#include "dpu_hw_ctl.h"
+#include "dpu_kms.h"
+#include "dpu_trace.h"
+
+#define   CTL_LAYER(lm)                 \
+	(((lm) == LM_5) ? (0x024) : (((lm) - LM_0) * 0x004))
+#define   CTL_LAYER_EXT(lm)             \
+	(0x40 + (((lm) - LM_0) * 0x004))
+#define   CTL_LAYER_EXT2(lm)             \
+	(0x70 + (((lm) - LM_0) * 0x004))
+#define   CTL_LAYER_EXT3(lm)             \
+	(0xA0 + (((lm) - LM_0) * 0x004))
+#define CTL_LAYER_EXT4(lm)             \
+	(0xB8 + (((lm) - LM_0) * 0x004))
+#define   CTL_TOP                       0x014
+#define   CTL_FLUSH                     0x018
+#define   CTL_START                     0x01C
+#define   CTL_PREPARE                   0x0d0
+#define   CTL_SW_RESET                  0x030
+#define   CTL_LAYER_EXTN_OFFSET         0x40
+#define   CTL_MERGE_3D_ACTIVE           0x0E4
+#define   CTL_DSC_ACTIVE                0x0E8
+#define   CTL_WB_ACTIVE                 0x0EC
+#define   CTL_INTF_ACTIVE               0x0F4
+#define   CTL_CDM_ACTIVE                0x0F8
+#define   CTL_FETCH_PIPE_ACTIVE         0x0FC
+#define   CTL_MERGE_3D_FLUSH            0x100
+#define   CTL_DSC_FLUSH                0x104
+#define   CTL_WB_FLUSH                  0x108
+#define   CTL_INTF_FLUSH                0x110
+#define   CTL_CDM_FLUSH                0x114
+#define   CTL_PERIPH_FLUSH              0x128
+#define   CTL_INTF_MASTER               0x134
+#define   CTL_DSPP_n_FLUSH(n)           ((0x13C) + ((n) * 4))
+
+#define CTL_MIXER_BORDER_OUT            BIT(24)
+#define CTL_FLUSH_MASK_CTL              BIT(17)
+
+#define DPU_REG_RESET_TIMEOUT_US        2000
+#define  MERGE_3D_IDX   23
+#define  DSC_IDX        22
+#define CDM_IDX         26
+#define  PERIPH_IDX     30
+#define  INTF_IDX       31
+#define WB_IDX          16
+#define  DSPP_IDX       29  /* From DPU hw rev 7.x.x */
+#define CTL_INVALID_BIT                 0xffff
+#define CTL_DEFAULT_GROUP_ID		0xf
+
+static const u32 fetch_tbl[SSPP_MAX] = {CTL_INVALID_BIT, 16, 17, 18, 19,
+	CTL_INVALID_BIT, CTL_INVALID_BIT, CTL_INVALID_BIT, CTL_INVALID_BIT, 0,
+	1, 2, 3, 4, 5};
+
+static int _mixer_stages(const struct dpu_lm_cfg *mixer, int count,
+		enum dpu_lm lm)
+{
+	int i;
+	int stages = -EINVAL;
+
+	for (i = 0; i < count; i++) {
+		if (lm == mixer[i].id) {
+			stages = mixer[i].sblk->maxblendstages;
+			break;
+		}
+	}
+
+	return stages;
+}
+
+static inline u32 dpu_hw_ctl_get_flush_register(struct dpu_hw_ctl *ctx)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+
+	return DPU_REG_READ(c, CTL_FLUSH);
+}
+
+static inline void dpu_hw_ctl_trigger_start(struct dpu_hw_ctl *ctx)
+{
+	trace_dpu_hw_ctl_trigger_start(ctx->pending_flush_mask,
+				       dpu_hw_ctl_get_flush_register(ctx));
+	DPU_REG_WRITE(&ctx->hw, CTL_START, 0x1);
+}
+
+static inline bool dpu_hw_ctl_is_started(struct dpu_hw_ctl *ctx)
+{
+	return !!(DPU_REG_READ(&ctx->hw, CTL_START) & BIT(0));
+}
+
+static inline void dpu_hw_ctl_trigger_pending(struct dpu_hw_ctl *ctx)
+{
+	trace_dpu_hw_ctl_trigger_prepare(ctx->pending_flush_mask,
+					 dpu_hw_ctl_get_flush_register(ctx));
+	DPU_REG_WRITE(&ctx->hw, CTL_PREPARE, 0x1);
+}
+
+static inline void dpu_hw_ctl_clear_pending_flush(struct dpu_hw_ctl *ctx)
+{
+	trace_dpu_hw_ctl_clear_pending_flush(ctx->pending_flush_mask,
+				     dpu_hw_ctl_get_flush_register(ctx));
+	ctx->pending_flush_mask = 0x0;
+	ctx->pending_intf_flush_mask = 0;
+	ctx->pending_wb_flush_mask = 0;
+	ctx->pending_merge_3d_flush_mask = 0;
+	ctx->pending_dsc_flush_mask = 0;
+	ctx->pending_cdm_flush_mask = 0;
+
+	memset(ctx->pending_dspp_flush_mask, 0,
+		sizeof(ctx->pending_dspp_flush_mask));
+}
+
+static inline void dpu_hw_ctl_update_pending_flush(struct dpu_hw_ctl *ctx,
+		u32 flushbits)
+{
+	trace_dpu_hw_ctl_update_pending_flush(flushbits,
+					      ctx->pending_flush_mask);
+	ctx->pending_flush_mask |= flushbits;
+}
+
+static u32 dpu_hw_ctl_get_pending_flush(struct dpu_hw_ctl *ctx)
+{
+	return ctx->pending_flush_mask;
+}
+
+static inline void dpu_hw_ctl_trigger_flush_v1(struct dpu_hw_ctl *ctx)
+{
+	int dspp;
+
+	if (ctx->pending_flush_mask & BIT(MERGE_3D_IDX))
+		DPU_REG_WRITE(&ctx->hw, CTL_MERGE_3D_FLUSH,
+				ctx->pending_merge_3d_flush_mask);
+	if (ctx->pending_flush_mask & BIT(INTF_IDX))
+		DPU_REG_WRITE(&ctx->hw, CTL_INTF_FLUSH,
+				ctx->pending_intf_flush_mask);
+	if (ctx->pending_flush_mask & BIT(WB_IDX))
+		DPU_REG_WRITE(&ctx->hw, CTL_WB_FLUSH,
+				ctx->pending_wb_flush_mask);
+
+	if (ctx->pending_flush_mask & BIT(DSPP_IDX))
+		for (dspp = DSPP_0; dspp < DSPP_MAX; dspp++) {
+			if (ctx->pending_dspp_flush_mask[dspp - DSPP_0])
+				DPU_REG_WRITE(&ctx->hw,
+				CTL_DSPP_n_FLUSH(dspp - DSPP_0),
+				ctx->pending_dspp_flush_mask[dspp - DSPP_0]);
+		}
+
+	if (ctx->pending_flush_mask & BIT(PERIPH_IDX))
+		DPU_REG_WRITE(&ctx->hw, CTL_PERIPH_FLUSH,
+			      ctx->pending_periph_flush_mask);
+
+	if (ctx->pending_flush_mask & BIT(DSC_IDX))
+		DPU_REG_WRITE(&ctx->hw, CTL_DSC_FLUSH,
+			      ctx->pending_dsc_flush_mask);
+
+	if (ctx->pending_flush_mask & BIT(CDM_IDX))
+		DPU_REG_WRITE(&ctx->hw, CTL_CDM_FLUSH,
+			      ctx->pending_cdm_flush_mask);
+
+	DPU_REG_WRITE(&ctx->hw, CTL_FLUSH, ctx->pending_flush_mask);
+}
+
+static inline void dpu_hw_ctl_trigger_flush(struct dpu_hw_ctl *ctx)
+{
+	trace_dpu_hw_ctl_trigger_pending_flush(ctx->pending_flush_mask,
+				     dpu_hw_ctl_get_flush_register(ctx));
+	DPU_REG_WRITE(&ctx->hw, CTL_FLUSH, ctx->pending_flush_mask);
+}
+
+static void dpu_hw_ctl_update_pending_flush_sspp(struct dpu_hw_ctl *ctx,
+	enum dpu_sspp sspp)
+{
+	switch (sspp) {
+	case SSPP_VIG0:
+		ctx->pending_flush_mask |=  BIT(0);
+		break;
+	case SSPP_VIG1:
+		ctx->pending_flush_mask |= BIT(1);
+		break;
+	case SSPP_VIG2:
+		ctx->pending_flush_mask |= BIT(2);
+		break;
+	case SSPP_VIG3:
+		ctx->pending_flush_mask |= BIT(18);
+		break;
+	case SSPP_RGB0:
+		ctx->pending_flush_mask |= BIT(3);
+		break;
+	case SSPP_RGB1:
+		ctx->pending_flush_mask |= BIT(4);
+		break;
+	case SSPP_RGB2:
+		ctx->pending_flush_mask |= BIT(5);
+		break;
+	case SSPP_RGB3:
+		ctx->pending_flush_mask |= BIT(19);
+		break;
+	case SSPP_DMA0:
+		ctx->pending_flush_mask |= BIT(11);
+		break;
+	case SSPP_DMA1:
+		ctx->pending_flush_mask |= BIT(12);
+		break;
+	case SSPP_DMA2:
+		ctx->pending_flush_mask |= BIT(24);
+		break;
+	case SSPP_DMA3:
+		ctx->pending_flush_mask |= BIT(25);
+		break;
+	case SSPP_DMA4:
+		ctx->pending_flush_mask |= BIT(13);
+		break;
+	case SSPP_DMA5:
+		ctx->pending_flush_mask |= BIT(14);
+		break;
+	case SSPP_CURSOR0:
+		ctx->pending_flush_mask |= BIT(22);
+		break;
+	case SSPP_CURSOR1:
+		ctx->pending_flush_mask |= BIT(23);
+		break;
+	default:
+		break;
+	}
+}
+
+static void dpu_hw_ctl_update_pending_flush_mixer(struct dpu_hw_ctl *ctx,
+	enum dpu_lm lm)
+{
+	switch (lm) {
+	case LM_0:
+		ctx->pending_flush_mask |= BIT(6);
+		break;
+	case LM_1:
+		ctx->pending_flush_mask |= BIT(7);
+		break;
+	case LM_2:
+		ctx->pending_flush_mask |= BIT(8);
+		break;
+	case LM_3:
+		ctx->pending_flush_mask |= BIT(9);
+		break;
+	case LM_4:
+		ctx->pending_flush_mask |= BIT(10);
+		break;
+	case LM_5:
+		ctx->pending_flush_mask |= BIT(20);
+		break;
+	default:
+		break;
+	}
+
+	ctx->pending_flush_mask |= CTL_FLUSH_MASK_CTL;
+}
+
+static void dpu_hw_ctl_update_pending_flush_intf(struct dpu_hw_ctl *ctx,
+		enum dpu_intf intf)
+{
+	switch (intf) {
+	case INTF_0:
+		ctx->pending_flush_mask |= BIT(31);
+		break;
+	case INTF_1:
+		ctx->pending_flush_mask |= BIT(30);
+		break;
+	case INTF_2:
+		ctx->pending_flush_mask |= BIT(29);
+		break;
+	case INTF_3:
+		ctx->pending_flush_mask |= BIT(28);
+		break;
+	default:
+		break;
+	}
+}
+
+static void dpu_hw_ctl_update_pending_flush_wb(struct dpu_hw_ctl *ctx,
+		enum dpu_wb wb)
+{
+	switch (wb) {
+	case WB_0:
+	case WB_1:
+	case WB_2:
+		ctx->pending_flush_mask |= BIT(WB_IDX);
+		break;
+	default:
+		break;
+	}
+}
+
+static void dpu_hw_ctl_update_pending_flush_cdm(struct dpu_hw_ctl *ctx, enum dpu_cdm cdm_num)
+{
+	/* update pending flush only if CDM_0 is flushed */
+	if (cdm_num == CDM_0)
+		ctx->pending_flush_mask |= BIT(CDM_IDX);
+}
+
+static void dpu_hw_ctl_update_pending_flush_wb_v1(struct dpu_hw_ctl *ctx,
+		enum dpu_wb wb)
+{
+	ctx->pending_wb_flush_mask |= BIT(wb - WB_0);
+	ctx->pending_flush_mask |= BIT(WB_IDX);
+}
+
+static void dpu_hw_ctl_update_pending_flush_intf_v1(struct dpu_hw_ctl *ctx,
+		enum dpu_intf intf)
+{
+	ctx->pending_intf_flush_mask |= BIT(intf - INTF_0);
+	ctx->pending_flush_mask |= BIT(INTF_IDX);
+}
+
+static void dpu_hw_ctl_update_pending_flush_periph_v1(struct dpu_hw_ctl *ctx,
+						      enum dpu_intf intf)
+{
+	ctx->pending_periph_flush_mask |= BIT(intf - INTF_0);
+	ctx->pending_flush_mask |= BIT(PERIPH_IDX);
+}
+
+static void dpu_hw_ctl_update_pending_flush_merge_3d_v1(struct dpu_hw_ctl *ctx,
+		enum dpu_merge_3d merge_3d)
+{
+	ctx->pending_merge_3d_flush_mask |= BIT(merge_3d - MERGE_3D_0);
+	ctx->pending_flush_mask |= BIT(MERGE_3D_IDX);
+}
+
+static void dpu_hw_ctl_update_pending_flush_dsc_v1(struct dpu_hw_ctl *ctx,
+						   enum dpu_dsc dsc_num)
+{
+	ctx->pending_dsc_flush_mask |= BIT(dsc_num - DSC_0);
+	ctx->pending_flush_mask |= BIT(DSC_IDX);
+}
+
+static void dpu_hw_ctl_update_pending_flush_cdm_v1(struct dpu_hw_ctl *ctx, enum dpu_cdm cdm_num)
+{
+	ctx->pending_cdm_flush_mask |= BIT(cdm_num - CDM_0);
+	ctx->pending_flush_mask |= BIT(CDM_IDX);
+}
+
+static void dpu_hw_ctl_update_pending_flush_dspp(struct dpu_hw_ctl *ctx,
+	enum dpu_dspp dspp, u32 dspp_sub_blk)
+{
+	switch (dspp) {
+	case DSPP_0:
+		ctx->pending_flush_mask |= BIT(13);
+		break;
+	case DSPP_1:
+		ctx->pending_flush_mask |= BIT(14);
+		break;
+	case DSPP_2:
+		ctx->pending_flush_mask |= BIT(15);
+		break;
+	case DSPP_3:
+		ctx->pending_flush_mask |= BIT(21);
+		break;
+	default:
+		break;
+	}
+}
+
+static void dpu_hw_ctl_update_pending_flush_dspp_sub_blocks(
+	struct dpu_hw_ctl *ctx,	enum dpu_dspp dspp, u32 dspp_sub_blk)
+{
+	if (dspp >= DSPP_MAX)
+		return;
+
+	switch (dspp_sub_blk) {
+	case DPU_DSPP_PCC:
+		ctx->pending_dspp_flush_mask[dspp - DSPP_0] |= BIT(4);
+		break;
+	default:
+		return;
+	}
+
+	ctx->pending_flush_mask |= BIT(DSPP_IDX);
+}
+
+static u32 dpu_hw_ctl_poll_reset_status(struct dpu_hw_ctl *ctx, u32 timeout_us)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	ktime_t timeout;
+	u32 status;
+
+	timeout = ktime_add_us(ktime_get(), timeout_us);
+
+	/*
+	 * it takes around 30us to have mdp finish resetting its ctl path
+	 * poll every 50us so that reset should be completed at 1st poll
+	 */
+	do {
+		status = DPU_REG_READ(c, CTL_SW_RESET);
+		status &= 0x1;
+		if (status)
+			usleep_range(20, 50);
+	} while (status && ktime_compare_safe(ktime_get(), timeout) < 0);
+
+	return status;
+}
+
+static int dpu_hw_ctl_reset_control(struct dpu_hw_ctl *ctx)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+
+	pr_debug("issuing hw ctl reset for ctl:%d\n", ctx->idx);
+	DPU_REG_WRITE(c, CTL_SW_RESET, 0x1);
+	if (dpu_hw_ctl_poll_reset_status(ctx, DPU_REG_RESET_TIMEOUT_US))
+		return -EINVAL;
+
+	return 0;
+}
+
+static int dpu_hw_ctl_wait_reset_status(struct dpu_hw_ctl *ctx)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	u32 status;
+
+	status = DPU_REG_READ(c, CTL_SW_RESET);
+	status &= 0x01;
+	if (!status)
+		return 0;
+
+	pr_debug("hw ctl reset is set for ctl:%d\n", ctx->idx);
+	if (dpu_hw_ctl_poll_reset_status(ctx, DPU_REG_RESET_TIMEOUT_US)) {
+		pr_err("hw recovery is not complete for ctl:%d\n", ctx->idx);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static void dpu_hw_ctl_clear_all_blendstages(struct dpu_hw_ctl *ctx)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	int i;
+
+	for (i = 0; i < ctx->mixer_count; i++) {
+		enum dpu_lm mixer_id = ctx->mixer_hw_caps[i].id;
+
+		DPU_REG_WRITE(c, CTL_LAYER(mixer_id), 0);
+		DPU_REG_WRITE(c, CTL_LAYER_EXT(mixer_id), 0);
+		DPU_REG_WRITE(c, CTL_LAYER_EXT2(mixer_id), 0);
+		DPU_REG_WRITE(c, CTL_LAYER_EXT3(mixer_id), 0);
+	}
+
+	DPU_REG_WRITE(c, CTL_FETCH_PIPE_ACTIVE, 0);
+}
+
+struct ctl_blend_config {
+	int idx, shift, ext_shift;
+};
+
+static const struct ctl_blend_config ctl_blend_config[][2] = {
+	[SSPP_NONE] = { { -1 }, { -1 } },
+	[SSPP_MAX] =  { { -1 }, { -1 } },
+	[SSPP_VIG0] = { { 0, 0,  0  }, { 3, 0 } },
+	[SSPP_VIG1] = { { 0, 3,  2  }, { 3, 4 } },
+	[SSPP_VIG2] = { { 0, 6,  4  }, { 3, 8 } },
+	[SSPP_VIG3] = { { 0, 26, 6  }, { 3, 12 } },
+	[SSPP_RGB0] = { { 0, 9,  8  }, { -1 } },
+	[SSPP_RGB1] = { { 0, 12, 10 }, { -1 } },
+	[SSPP_RGB2] = { { 0, 15, 12 }, { -1 } },
+	[SSPP_RGB3] = { { 0, 29, 14 }, { -1 } },
+	[SSPP_DMA0] = { { 0, 18, 16 }, { 2, 8 } },
+	[SSPP_DMA1] = { { 0, 21, 18 }, { 2, 12 } },
+	[SSPP_DMA2] = { { 2, 0      }, { 2, 16 } },
+	[SSPP_DMA3] = { { 2, 4      }, { 2, 20 } },
+	[SSPP_DMA4] = { { 4, 0      }, { 4, 8 } },
+	[SSPP_DMA5] = { { 4, 4      }, { 4, 12 } },
+	[SSPP_CURSOR0] =  { { 1, 20 }, { -1 } },
+	[SSPP_CURSOR1] =  { { 1, 26 }, { -1 } },
+};
+
+static void dpu_hw_ctl_setup_blendstage(struct dpu_hw_ctl *ctx,
+	enum dpu_lm lm, struct dpu_hw_stage_cfg *stage_cfg)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	u32 mix, ext, mix_ext;
+	u32 mixercfg[5] = { 0 };
+	int i, j;
+	int stages;
+	int pipes_per_stage;
+
+	stages = _mixer_stages(ctx->mixer_hw_caps, ctx->mixer_count, lm);
+	if (stages < 0)
+		return;
+
+	if (test_bit(DPU_MIXER_SOURCESPLIT,
+		&ctx->mixer_hw_caps->features))
+		pipes_per_stage = PIPES_PER_STAGE;
+	else
+		pipes_per_stage = 1;
+
+	mixercfg[0] = CTL_MIXER_BORDER_OUT; /* always set BORDER_OUT */
+
+	if (!stage_cfg)
+		goto exit;
+
+	for (i = 0; i <= stages; i++) {
+		/* overflow to ext register if 'i + 1 > 7' */
+		mix = (i + 1) & 0x7;
+		ext = i >= 7;
+		mix_ext = (i + 1) & 0xf;
+
+		for (j = 0 ; j < pipes_per_stage; j++) {
+			enum dpu_sspp_multirect_index rect_index =
+				stage_cfg->multirect_index[i][j];
+			enum dpu_sspp pipe = stage_cfg->stage[i][j];
+			const struct ctl_blend_config *cfg =
+				&ctl_blend_config[pipe][rect_index == DPU_SSPP_RECT_1];
+
+			/*
+			 * CTL_LAYER has 3-bit field (and extra bits in EXT register),
+			 * all EXT registers has 4-bit fields.
+			 */
+			if (cfg->idx == -1) {
+				continue;
+			} else if (cfg->idx == 0) {
+				mixercfg[0] |= mix << cfg->shift;
+				mixercfg[1] |= ext << cfg->ext_shift;
+			} else {
+				mixercfg[cfg->idx] |= mix_ext << cfg->shift;
+			}
+		}
+	}
+
+exit:
+	DPU_REG_WRITE(c, CTL_LAYER(lm), mixercfg[0]);
+	DPU_REG_WRITE(c, CTL_LAYER_EXT(lm), mixercfg[1]);
+	DPU_REG_WRITE(c, CTL_LAYER_EXT2(lm), mixercfg[2]);
+	DPU_REG_WRITE(c, CTL_LAYER_EXT3(lm), mixercfg[3]);
+	if ((test_bit(DPU_CTL_HAS_LAYER_EXT4, &ctx->caps->features)))
+		DPU_REG_WRITE(c, CTL_LAYER_EXT4(lm), mixercfg[4]);
+}
+
+
+static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx,
+		struct dpu_hw_intf_cfg *cfg)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	u32 intf_active = 0;
+	u32 dsc_active = 0;
+	u32 wb_active = 0;
+	u32 mode_sel = 0;
+
+	/* CTL_TOP[31:28] carries group_id to collate CTL paths
+	 * per VM. Explicitly disable it until VM support is
+	 * added in SW. Power on reset value is not disable.
+	 */
+	if ((test_bit(DPU_CTL_VM_CFG, &ctx->caps->features)))
+		mode_sel = CTL_DEFAULT_GROUP_ID  << 28;
+
+	if (cfg->intf_mode_sel == DPU_CTL_MODE_SEL_CMD)
+		mode_sel |= BIT(17);
+
+	intf_active = DPU_REG_READ(c, CTL_INTF_ACTIVE);
+	wb_active = DPU_REG_READ(c, CTL_WB_ACTIVE);
+	dsc_active = DPU_REG_READ(c, CTL_DSC_ACTIVE);
+
+	if (cfg->intf)
+		intf_active |= BIT(cfg->intf - INTF_0);
+
+	if (cfg->wb)
+		wb_active |= BIT(cfg->wb - WB_0);
+
+	if (cfg->dsc)
+		dsc_active |= cfg->dsc;
+
+	DPU_REG_WRITE(c, CTL_TOP, mode_sel);
+	DPU_REG_WRITE(c, CTL_INTF_ACTIVE, intf_active);
+	DPU_REG_WRITE(c, CTL_WB_ACTIVE, wb_active);
+	DPU_REG_WRITE(c, CTL_DSC_ACTIVE, dsc_active);
+
+	if (cfg->merge_3d)
+		DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE,
+			      BIT(cfg->merge_3d - MERGE_3D_0));
+
+	if (cfg->cdm)
+		DPU_REG_WRITE(c, CTL_CDM_ACTIVE, cfg->cdm);
+}
+
+static void dpu_hw_ctl_intf_cfg(struct dpu_hw_ctl *ctx,
+		struct dpu_hw_intf_cfg *cfg)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	u32 intf_cfg = 0;
+
+	intf_cfg |= (cfg->intf & 0xF) << 4;
+
+	if (cfg->mode_3d) {
+		intf_cfg |= BIT(19);
+		intf_cfg |= (cfg->mode_3d - 0x1) << 20;
+	}
+
+	if (cfg->wb)
+		intf_cfg |= (cfg->wb & 0x3) + 2;
+
+	switch (cfg->intf_mode_sel) {
+	case DPU_CTL_MODE_SEL_VID:
+		intf_cfg &= ~BIT(17);
+		intf_cfg &= ~(0x3 << 15);
+		break;
+	case DPU_CTL_MODE_SEL_CMD:
+		intf_cfg |= BIT(17);
+		intf_cfg |= ((cfg->stream_sel & 0x3) << 15);
+		break;
+	default:
+		pr_err("unknown interface type %d\n", cfg->intf_mode_sel);
+		return;
+	}
+
+	DPU_REG_WRITE(c, CTL_TOP, intf_cfg);
+}
+
+static void dpu_hw_ctl_reset_intf_cfg_v1(struct dpu_hw_ctl *ctx,
+		struct dpu_hw_intf_cfg *cfg)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	u32 intf_active = 0;
+	u32 wb_active = 0;
+	u32 merge3d_active = 0;
+	u32 dsc_active;
+	u32 cdm_active;
+
+	/*
+	 * This API resets each portion of the CTL path namely,
+	 * clearing the sspps staged on the lm, merge_3d block,
+	 * interfaces , writeback etc to ensure clean teardown of the pipeline.
+	 * This will be used for writeback to begin with to have a
+	 * proper teardown of the writeback session but upon further
+	 * validation, this can be extended to all interfaces.
+	 */
+	if (cfg->merge_3d) {
+		merge3d_active = DPU_REG_READ(c, CTL_MERGE_3D_ACTIVE);
+		merge3d_active &= ~BIT(cfg->merge_3d - MERGE_3D_0);
+		DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE,
+				merge3d_active);
+	}
+
+	dpu_hw_ctl_clear_all_blendstages(ctx);
+
+	if (cfg->intf) {
+		intf_active = DPU_REG_READ(c, CTL_INTF_ACTIVE);
+		intf_active &= ~BIT(cfg->intf - INTF_0);
+		DPU_REG_WRITE(c, CTL_INTF_ACTIVE, intf_active);
+	}
+
+	if (cfg->wb) {
+		wb_active = DPU_REG_READ(c, CTL_WB_ACTIVE);
+		wb_active &= ~BIT(cfg->wb - WB_0);
+		DPU_REG_WRITE(c, CTL_WB_ACTIVE, wb_active);
+	}
+
+	if (cfg->dsc) {
+		dsc_active = DPU_REG_READ(c, CTL_DSC_ACTIVE);
+		dsc_active &= ~cfg->dsc;
+		DPU_REG_WRITE(c, CTL_DSC_ACTIVE, dsc_active);
+	}
+
+	if (cfg->cdm) {
+		cdm_active = DPU_REG_READ(c, CTL_CDM_ACTIVE);
+		cdm_active &= ~cfg->cdm;
+		DPU_REG_WRITE(c, CTL_CDM_ACTIVE, cdm_active);
+	}
+}
+
+static void dpu_hw_ctl_set_fetch_pipe_active(struct dpu_hw_ctl *ctx,
+	unsigned long *fetch_active)
+{
+	int i;
+	u32 val = 0;
+
+	if (fetch_active) {
+		for (i = 0; i < SSPP_MAX; i++) {
+			if (test_bit(i, fetch_active) &&
+				fetch_tbl[i] != CTL_INVALID_BIT)
+				val |= BIT(fetch_tbl[i]);
+		}
+	}
+
+	DPU_REG_WRITE(&ctx->hw, CTL_FETCH_PIPE_ACTIVE, val);
+}
+
+static void _setup_ctl_ops(struct dpu_hw_ctl_ops *ops,
+		unsigned long cap)
+{
+	if (cap & BIT(DPU_CTL_ACTIVE_CFG)) {
+		ops->trigger_flush = dpu_hw_ctl_trigger_flush_v1;
+		ops->setup_intf_cfg = dpu_hw_ctl_intf_cfg_v1;
+		ops->reset_intf_cfg = dpu_hw_ctl_reset_intf_cfg_v1;
+		ops->update_pending_flush_intf =
+			dpu_hw_ctl_update_pending_flush_intf_v1;
+
+		ops->update_pending_flush_periph =
+			dpu_hw_ctl_update_pending_flush_periph_v1;
+
+		ops->update_pending_flush_merge_3d =
+			dpu_hw_ctl_update_pending_flush_merge_3d_v1;
+		ops->update_pending_flush_wb = dpu_hw_ctl_update_pending_flush_wb_v1;
+		ops->update_pending_flush_dsc =
+			dpu_hw_ctl_update_pending_flush_dsc_v1;
+		ops->update_pending_flush_cdm = dpu_hw_ctl_update_pending_flush_cdm_v1;
+	} else {
+		ops->trigger_flush = dpu_hw_ctl_trigger_flush;
+		ops->setup_intf_cfg = dpu_hw_ctl_intf_cfg;
+		ops->update_pending_flush_intf =
+			dpu_hw_ctl_update_pending_flush_intf;
+		ops->update_pending_flush_wb = dpu_hw_ctl_update_pending_flush_wb;
+		ops->update_pending_flush_cdm = dpu_hw_ctl_update_pending_flush_cdm;
+	}
+	ops->clear_pending_flush = dpu_hw_ctl_clear_pending_flush;
+	ops->update_pending_flush = dpu_hw_ctl_update_pending_flush;
+	ops->get_pending_flush = dpu_hw_ctl_get_pending_flush;
+	ops->get_flush_register = dpu_hw_ctl_get_flush_register;
+	ops->trigger_start = dpu_hw_ctl_trigger_start;
+	ops->is_started = dpu_hw_ctl_is_started;
+	ops->trigger_pending = dpu_hw_ctl_trigger_pending;
+	ops->reset = dpu_hw_ctl_reset_control;
+	ops->wait_reset_status = dpu_hw_ctl_wait_reset_status;
+	ops->clear_all_blendstages = dpu_hw_ctl_clear_all_blendstages;
+	ops->setup_blendstage = dpu_hw_ctl_setup_blendstage;
+	ops->update_pending_flush_sspp = dpu_hw_ctl_update_pending_flush_sspp;
+	ops->update_pending_flush_mixer = dpu_hw_ctl_update_pending_flush_mixer;
+	if (cap & BIT(DPU_CTL_DSPP_SUB_BLOCK_FLUSH))
+		ops->update_pending_flush_dspp = dpu_hw_ctl_update_pending_flush_dspp_sub_blocks;
+	else
+		ops->update_pending_flush_dspp = dpu_hw_ctl_update_pending_flush_dspp;
+
+	if (cap & BIT(DPU_CTL_FETCH_ACTIVE))
+		ops->set_active_pipes = dpu_hw_ctl_set_fetch_pipe_active;
+};
+
+struct dpu_hw_ctl *dpu_hw_ctl_init(struct drm_device *dev,
+				   const struct dpu_ctl_cfg *cfg,
+				   void __iomem *addr,
+				   u32 mixer_count,
+				   const struct dpu_lm_cfg *mixer)
+{
+	struct dpu_hw_ctl *c;
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_CTL;
+
+	c->caps = cfg;
+	_setup_ctl_ops(&c->ops, c->caps->features);
+	c->idx = cfg->id;
+	c->mixer_count = mixer_count;
+	c->mixer_hw_caps = mixer;
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_ctl.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_ctl.h
@@ -0,0 +1,312 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DPU_HW_CTL_H
+#define _DPU_HW_CTL_H
+
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_sspp.h"
+
+/**
+ * dpu_ctl_mode_sel: Interface mode selection
+ * DPU_CTL_MODE_SEL_VID:    Video mode interface
+ * DPU_CTL_MODE_SEL_CMD:    Command mode interface
+ */
+enum dpu_ctl_mode_sel {
+	DPU_CTL_MODE_SEL_VID = 0,
+	DPU_CTL_MODE_SEL_CMD
+};
+
+struct dpu_hw_ctl;
+/**
+ * struct dpu_hw_stage_cfg - blending stage cfg
+ * @stage : SSPP_ID at each stage
+ * @multirect_index: index of the rectangle of SSPP.
+ */
+struct dpu_hw_stage_cfg {
+	enum dpu_sspp stage[DPU_STAGE_MAX][PIPES_PER_STAGE];
+	enum dpu_sspp_multirect_index multirect_index
+					[DPU_STAGE_MAX][PIPES_PER_STAGE];
+};
+
+/**
+ * struct dpu_hw_intf_cfg :Describes how the DPU writes data to output interface
+ * @intf :                 Interface id
+ * @mode_3d:               3d mux configuration
+ * @merge_3d:              3d merge block used
+ * @intf_mode_sel:         Interface mode, cmd / vid
+ * @cdm:                   CDM block used
+ * @stream_sel:            Stream selection for multi-stream interfaces
+ * @dsc:                   DSC BIT masks used
+ */
+struct dpu_hw_intf_cfg {
+	enum dpu_intf intf;
+	enum dpu_wb wb;
+	enum dpu_3d_blend_mode mode_3d;
+	enum dpu_merge_3d merge_3d;
+	enum dpu_ctl_mode_sel intf_mode_sel;
+	enum dpu_cdm cdm;
+	int stream_sel;
+	unsigned int dsc;
+};
+
+/**
+ * struct dpu_hw_ctl_ops - Interface to the wb Hw driver functions
+ * Assumption is these functions will be called after clocks are enabled
+ */
+struct dpu_hw_ctl_ops {
+	/**
+	 * kickoff hw operation for Sw controlled interfaces
+	 * DSI cmd mode and WB interface are SW controlled
+	 * @ctx       : ctl path ctx pointer
+	 */
+	void (*trigger_start)(struct dpu_hw_ctl *ctx);
+
+	/**
+	 * check if the ctl is started
+	 * @ctx       : ctl path ctx pointer
+	 * @Return: true if started, false if stopped
+	 */
+	bool (*is_started)(struct dpu_hw_ctl *ctx);
+
+	/**
+	 * kickoff prepare is in progress hw operation for sw
+	 * controlled interfaces: DSI cmd mode and WB interface
+	 * are SW controlled
+	 * @ctx       : ctl path ctx pointer
+	 */
+	void (*trigger_pending)(struct dpu_hw_ctl *ctx);
+
+	/**
+	 * Clear the value of the cached pending_flush_mask
+	 * No effect on hardware.
+	 * Required to be implemented.
+	 * @ctx       : ctl path ctx pointer
+	 */
+	void (*clear_pending_flush)(struct dpu_hw_ctl *ctx);
+
+	/**
+	 * Query the value of the cached pending_flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 */
+	u32 (*get_pending_flush)(struct dpu_hw_ctl *ctx);
+
+	/**
+	 * OR in the given flushbits to the cached pending_flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 * @flushbits : module flushmask
+	 */
+	void (*update_pending_flush)(struct dpu_hw_ctl *ctx,
+		u32 flushbits);
+
+	/**
+	 * OR in the given flushbits to the cached pending_(wb_)flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 * @blk       : writeback block index
+	 */
+	void (*update_pending_flush_wb)(struct dpu_hw_ctl *ctx,
+		enum dpu_wb blk);
+
+	/**
+	 * OR in the given flushbits to the cached pending_(intf_)flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 * @blk       : interface block index
+	 */
+	void (*update_pending_flush_intf)(struct dpu_hw_ctl *ctx,
+		enum dpu_intf blk);
+
+	/**
+	 * OR in the given flushbits to the cached pending_(periph_)flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 * @blk       : interface block index
+	 */
+	void (*update_pending_flush_periph)(struct dpu_hw_ctl *ctx,
+					    enum dpu_intf blk);
+
+	/**
+	 * OR in the given flushbits to the cached pending_(merge_3d_)flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 * @blk       : interface block index
+	 */
+	void (*update_pending_flush_merge_3d)(struct dpu_hw_ctl *ctx,
+		enum dpu_merge_3d blk);
+
+	/**
+	 * OR in the given flushbits to the cached pending_flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 * @blk       : SSPP block index
+	 */
+	void (*update_pending_flush_sspp)(struct dpu_hw_ctl *ctx,
+		enum dpu_sspp blk);
+
+	/**
+	 * OR in the given flushbits to the cached pending_flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 * @blk       : LM block index
+	 */
+	void (*update_pending_flush_mixer)(struct dpu_hw_ctl *ctx,
+		enum dpu_lm blk);
+
+	/**
+	 * OR in the given flushbits to the cached pending_flush_mask
+	 * No effect on hardware
+	 * @ctx       : ctl path ctx pointer
+	 * @blk       : DSPP block index
+	 * @dspp_sub_blk : DSPP sub-block index
+	 */
+	void (*update_pending_flush_dspp)(struct dpu_hw_ctl *ctx,
+		enum dpu_dspp blk, u32 dspp_sub_blk);
+
+	/**
+	 * OR in the given flushbits to the cached pending_(dsc_)flush_mask
+	 * No effect on hardware
+	 * @ctx: ctl path ctx pointer
+	 * @blk: interface block index
+	 */
+	void (*update_pending_flush_dsc)(struct dpu_hw_ctl *ctx,
+					 enum dpu_dsc blk);
+
+	/**
+	 * OR in the given flushbits to the cached pending_(cdm_)flush_mask
+	 * No effect on hardware
+	 * @ctx: ctl path ctx pointer
+	 * @cdm_num: idx of cdm to be flushed
+	 */
+	void (*update_pending_flush_cdm)(struct dpu_hw_ctl *ctx, enum dpu_cdm cdm_num);
+
+	/**
+	 * Write the value of the pending_flush_mask to hardware
+	 * @ctx       : ctl path ctx pointer
+	 */
+	void (*trigger_flush)(struct dpu_hw_ctl *ctx);
+
+	/**
+	 * Read the value of the flush register
+	 * @ctx       : ctl path ctx pointer
+	 * @Return: value of the ctl flush register.
+	 */
+	u32 (*get_flush_register)(struct dpu_hw_ctl *ctx);
+
+	/**
+	 * Setup ctl_path interface config
+	 * @ctx
+	 * @cfg    : interface config structure pointer
+	 */
+	void (*setup_intf_cfg)(struct dpu_hw_ctl *ctx,
+		struct dpu_hw_intf_cfg *cfg);
+
+	/**
+	 * reset ctl_path interface config
+	 * @ctx    : ctl path ctx pointer
+	 * @cfg    : interface config structure pointer
+	 */
+	void (*reset_intf_cfg)(struct dpu_hw_ctl *ctx,
+			struct dpu_hw_intf_cfg *cfg);
+
+	int (*reset)(struct dpu_hw_ctl *c);
+
+	/*
+	 * wait_reset_status - checks ctl reset status
+	 * @ctx       : ctl path ctx pointer
+	 *
+	 * This function checks the ctl reset status bit.
+	 * If the reset bit is set, it keeps polling the status till the hw
+	 * reset is complete.
+	 * Returns: 0 on success or -error if reset incomplete within interval
+	 */
+	int (*wait_reset_status)(struct dpu_hw_ctl *ctx);
+
+	/**
+	 * Set all blend stages to disabled
+	 * @ctx       : ctl path ctx pointer
+	 */
+	void (*clear_all_blendstages)(struct dpu_hw_ctl *ctx);
+
+	/**
+	 * Configure layer mixer to pipe configuration
+	 * @ctx       : ctl path ctx pointer
+	 * @lm        : layer mixer enumeration
+	 * @cfg       : blend stage configuration
+	 */
+	void (*setup_blendstage)(struct dpu_hw_ctl *ctx,
+		enum dpu_lm lm, struct dpu_hw_stage_cfg *cfg);
+
+	void (*set_active_pipes)(struct dpu_hw_ctl *ctx,
+		unsigned long *fetch_active);
+};
+
+/**
+ * struct dpu_hw_ctl : CTL PATH driver object
+ * @base: hardware block base structure
+ * @hw: block register map object
+ * @idx: control path index
+ * @caps: control path capabilities
+ * @mixer_count: number of mixers
+ * @mixer_hw_caps: mixer hardware capabilities
+ * @pending_flush_mask: storage for pending ctl_flush managed via ops
+ * @pending_intf_flush_mask: pending INTF flush
+ * @pending_wb_flush_mask: pending WB flush
+ * @pending_dsc_flush_mask: pending DSC flush
+ * @pending_cdm_flush_mask: pending CDM flush
+ * @ops: operation list
+ */
+struct dpu_hw_ctl {
+	struct dpu_hw_blk base;
+	struct dpu_hw_blk_reg_map hw;
+
+	/* ctl path */
+	int idx;
+	const struct dpu_ctl_cfg *caps;
+	int mixer_count;
+	const struct dpu_lm_cfg *mixer_hw_caps;
+	u32 pending_flush_mask;
+	u32 pending_intf_flush_mask;
+	u32 pending_wb_flush_mask;
+	u32 pending_periph_flush_mask;
+	u32 pending_merge_3d_flush_mask;
+	u32 pending_dspp_flush_mask[DSPP_MAX - DSPP_0];
+	u32 pending_dsc_flush_mask;
+	u32 pending_cdm_flush_mask;
+
+	/* ops */
+	struct dpu_hw_ctl_ops ops;
+};
+
+/**
+ * dpu_hw_ctl - convert base object dpu_hw_base to container
+ * @hw: Pointer to base hardware block
+ * return: Pointer to hardware block container
+ */
+static inline struct dpu_hw_ctl *to_dpu_hw_ctl(struct dpu_hw_blk *hw)
+{
+	return container_of(hw, struct dpu_hw_ctl, base);
+}
+
+/**
+ * dpu_hw_ctl_init() - Initializes the ctl_path hw driver object.
+ * Should be called before accessing any ctl_path register.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  ctl_path catalog entry for which driver object is required
+ * @addr: mapped register io address of MDP
+ * @mixer_count: Number of mixers in @mixer
+ * @mixer: Pointer to an array of Layer Mixers defined in the catalog
+ */
+struct dpu_hw_ctl *dpu_hw_ctl_init(struct drm_device *dev,
+				   const struct dpu_ctl_cfg *cfg,
+				   void __iomem *addr,
+				   u32 mixer_count,
+				   const struct dpu_lm_cfg *mixer);
+
+#endif /*_DPU_HW_CTL_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dsc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dsc.c
@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2022, Linaro Limited
+ */
+
+#include <drm/drm_managed.h>
+
+#include <drm/display/drm_dsc_helper.h>
+
+#include "dpu_kms.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hwio.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_dsc.h"
+
+#define DSC_COMMON_MODE                 0x000
+#define DSC_ENC                         0x004
+#define DSC_PICTURE                     0x008
+#define DSC_SLICE                       0x00C
+#define DSC_CHUNK_SIZE                  0x010
+#define DSC_DELAY                       0x014
+#define DSC_SCALE_INITIAL               0x018
+#define DSC_SCALE_DEC_INTERVAL          0x01C
+#define DSC_SCALE_INC_INTERVAL          0x020
+#define DSC_FIRST_LINE_BPG_OFFSET       0x024
+#define DSC_BPG_OFFSET                  0x028
+#define DSC_DSC_OFFSET                  0x02C
+#define DSC_FLATNESS                    0x030
+#define DSC_RC_MODEL_SIZE               0x034
+#define DSC_RC                          0x038
+#define DSC_RC_BUF_THRESH               0x03C
+#define DSC_RANGE_MIN_QP                0x074
+#define DSC_RANGE_MAX_QP                0x0B0
+#define DSC_RANGE_BPG_OFFSET            0x0EC
+
+#define DSC_CTL(m) (0x1800 - 0x3FC * (m - DSC_0))
+
+static void dpu_hw_dsc_disable(struct dpu_hw_dsc *dsc)
+{
+	struct dpu_hw_blk_reg_map *c = &dsc->hw;
+
+	DPU_REG_WRITE(c, DSC_COMMON_MODE, 0);
+}
+
+static void dpu_hw_dsc_config(struct dpu_hw_dsc *hw_dsc,
+			      struct drm_dsc_config *dsc,
+			      u32 mode,
+			      u32 initial_lines)
+{
+	struct dpu_hw_blk_reg_map *c = &hw_dsc->hw;
+	u32 data;
+	u32 slice_last_group_size;
+	u32 det_thresh_flatness;
+	bool is_cmd_mode = !(mode & DSC_MODE_VIDEO);
+
+	DPU_REG_WRITE(c, DSC_COMMON_MODE, mode);
+
+	if (is_cmd_mode)
+		initial_lines += 1;
+
+	slice_last_group_size = (dsc->slice_width + 2) % 3;
+
+	data = (initial_lines << 20);
+	data |= (slice_last_group_size << 18);
+	/* bpp is 6.4 format, 4 LSBs bits are for fractional part */
+	data |= (dsc->bits_per_pixel << 8);
+	data |= (dsc->block_pred_enable << 7);
+	data |= (dsc->line_buf_depth << 3);
+	data |= (dsc->simple_422 << 2);
+	data |= (dsc->convert_rgb << 1);
+	data |= dsc->bits_per_component;
+
+	DPU_REG_WRITE(c, DSC_ENC, data);
+
+	data = dsc->pic_width << 16;
+	data |= dsc->pic_height;
+	DPU_REG_WRITE(c, DSC_PICTURE, data);
+
+	data = dsc->slice_width << 16;
+	data |= dsc->slice_height;
+	DPU_REG_WRITE(c, DSC_SLICE, data);
+
+	data = dsc->slice_chunk_size << 16;
+	DPU_REG_WRITE(c, DSC_CHUNK_SIZE, data);
+
+	data = dsc->initial_dec_delay << 16;
+	data |= dsc->initial_xmit_delay;
+	DPU_REG_WRITE(c, DSC_DELAY, data);
+
+	data = dsc->initial_scale_value;
+	DPU_REG_WRITE(c, DSC_SCALE_INITIAL, data);
+
+	data = dsc->scale_decrement_interval;
+	DPU_REG_WRITE(c, DSC_SCALE_DEC_INTERVAL, data);
+
+	data = dsc->scale_increment_interval;
+	DPU_REG_WRITE(c, DSC_SCALE_INC_INTERVAL, data);
+
+	data = dsc->first_line_bpg_offset;
+	DPU_REG_WRITE(c, DSC_FIRST_LINE_BPG_OFFSET, data);
+
+	data = dsc->nfl_bpg_offset << 16;
+	data |= dsc->slice_bpg_offset;
+	DPU_REG_WRITE(c, DSC_BPG_OFFSET, data);
+
+	data = dsc->initial_offset << 16;
+	data |= dsc->final_offset;
+	DPU_REG_WRITE(c, DSC_DSC_OFFSET, data);
+
+	det_thresh_flatness = drm_dsc_flatness_det_thresh(dsc);
+	data = det_thresh_flatness << 10;
+	data |= dsc->flatness_max_qp << 5;
+	data |= dsc->flatness_min_qp;
+	DPU_REG_WRITE(c, DSC_FLATNESS, data);
+
+	data = dsc->rc_model_size;
+	DPU_REG_WRITE(c, DSC_RC_MODEL_SIZE, data);
+
+	data = dsc->rc_tgt_offset_low << 18;
+	data |= dsc->rc_tgt_offset_high << 14;
+	data |= dsc->rc_quant_incr_limit1 << 9;
+	data |= dsc->rc_quant_incr_limit0 << 4;
+	data |= dsc->rc_edge_factor;
+	DPU_REG_WRITE(c, DSC_RC, data);
+}
+
+static void dpu_hw_dsc_config_thresh(struct dpu_hw_dsc *hw_dsc,
+				     struct drm_dsc_config *dsc)
+{
+	struct drm_dsc_rc_range_parameters *rc = dsc->rc_range_params;
+	struct dpu_hw_blk_reg_map *c = &hw_dsc->hw;
+	u32 off;
+	int i;
+
+	off = DSC_RC_BUF_THRESH;
+	for (i = 0; i < DSC_NUM_BUF_RANGES - 1 ; i++) {
+		DPU_REG_WRITE(c, off, dsc->rc_buf_thresh[i]);
+		off += 4;
+	}
+
+	off = DSC_RANGE_MIN_QP;
+	for (i = 0; i < DSC_NUM_BUF_RANGES; i++) {
+		DPU_REG_WRITE(c, off, rc[i].range_min_qp);
+		off += 4;
+	}
+
+	off = DSC_RANGE_MAX_QP;
+	for (i = 0; i < 15; i++) {
+		DPU_REG_WRITE(c, off, rc[i].range_max_qp);
+		off += 4;
+	}
+
+	off = DSC_RANGE_BPG_OFFSET;
+	for (i = 0; i < 15; i++) {
+		DPU_REG_WRITE(c, off, rc[i].range_bpg_offset);
+		off += 4;
+	}
+}
+
+static void dpu_hw_dsc_bind_pingpong_blk(
+		struct dpu_hw_dsc *hw_dsc,
+		const enum dpu_pingpong pp)
+{
+	struct dpu_hw_blk_reg_map *c = &hw_dsc->hw;
+	int mux_cfg = 0xF;
+	u32 dsc_ctl_offset;
+
+	dsc_ctl_offset = DSC_CTL(hw_dsc->idx);
+
+	if (pp)
+		mux_cfg = (pp - PINGPONG_0) & 0x7;
+
+	if (pp)
+		DRM_DEBUG_KMS("Binding dsc:%d to pp:%d\n",
+			      hw_dsc->idx - DSC_0, pp - PINGPONG_0);
+	else
+		DRM_DEBUG_KMS("Unbinding dsc:%d from any pp\n",
+			      hw_dsc->idx - DSC_0);
+
+	DPU_REG_WRITE(c, dsc_ctl_offset, mux_cfg);
+}
+
+static void _setup_dsc_ops(struct dpu_hw_dsc_ops *ops,
+			   unsigned long cap)
+{
+	ops->dsc_disable = dpu_hw_dsc_disable;
+	ops->dsc_config = dpu_hw_dsc_config;
+	ops->dsc_config_thresh = dpu_hw_dsc_config_thresh;
+	if (cap & BIT(DPU_DSC_OUTPUT_CTRL))
+		ops->dsc_bind_pingpong_blk = dpu_hw_dsc_bind_pingpong_blk;
+};
+
+struct dpu_hw_dsc *dpu_hw_dsc_init(struct drm_device *dev,
+				   const struct dpu_dsc_cfg *cfg,
+				   void __iomem *addr)
+{
+	struct dpu_hw_dsc *c;
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_DSC;
+
+	c->idx = cfg->id;
+	c->caps = cfg;
+	_setup_dsc_ops(&c->ops, c->caps->features);
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dsc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dsc.h
@@ -0,0 +1,98 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2022, Linaro Limited
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved
+ */
+
+#ifndef _DPU_HW_DSC_H
+#define _DPU_HW_DSC_H
+
+#include <drm/display/drm_dsc.h>
+
+#define DSC_MODE_SPLIT_PANEL            BIT(0)
+#define DSC_MODE_MULTIPLEX              BIT(1)
+#define DSC_MODE_VIDEO                  BIT(2)
+
+struct dpu_hw_dsc;
+
+/**
+ * struct dpu_hw_dsc_ops - interface to the dsc hardware driver functions
+ * Assumption is these functions will be called after clocks are enabled
+ */
+struct dpu_hw_dsc_ops {
+	/**
+	 * dsc_disable - disable dsc
+	 * @hw_dsc: Pointer to dsc context
+	 */
+	void (*dsc_disable)(struct dpu_hw_dsc *hw_dsc);
+
+	/**
+	 * dsc_config - configures dsc encoder
+	 * @hw_dsc: Pointer to dsc context
+	 * @dsc: panel dsc parameters
+	 * @mode: dsc topology mode to be set
+	 * @initial_lines: amount of initial lines to be used
+	 */
+	void (*dsc_config)(struct dpu_hw_dsc *hw_dsc,
+			   struct drm_dsc_config *dsc,
+			   u32 mode,
+			   u32 initial_lines);
+
+	/**
+	 * dsc_config_thresh - programs panel thresholds
+	 * @hw_dsc: Pointer to dsc context
+	 * @dsc: panel dsc parameters
+	 */
+	void (*dsc_config_thresh)(struct dpu_hw_dsc *hw_dsc,
+				  struct drm_dsc_config *dsc);
+
+	void (*dsc_bind_pingpong_blk)(struct dpu_hw_dsc *hw_dsc,
+				  enum dpu_pingpong pp);
+};
+
+struct dpu_hw_dsc {
+	struct dpu_hw_blk base;
+	struct dpu_hw_blk_reg_map hw;
+
+	/* dsc */
+	enum dpu_dsc idx;
+	const struct dpu_dsc_cfg *caps;
+
+	/* ops */
+	struct dpu_hw_dsc_ops ops;
+};
+
+/**
+ * dpu_hw_dsc_init() - Initializes the DSC hw driver object.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  DSC catalog entry for which driver object is required
+ * @addr: Mapped register io address of MDP
+ * Return: Error code or allocated dpu_hw_dsc context
+ */
+struct dpu_hw_dsc *dpu_hw_dsc_init(struct drm_device *dev,
+				   const struct dpu_dsc_cfg *cfg,
+				   void __iomem *addr);
+
+/**
+ * dpu_hw_dsc_init_1_2() - initializes the v1.2 DSC hw driver object
+ * @dev:  Corresponding device for devres management
+ * @cfg:  DSC catalog entry for which driver object is required
+ * @addr: Mapped register io address of MDP
+ * Returns: Error code or allocated dpu_hw_dsc context
+ */
+struct dpu_hw_dsc *dpu_hw_dsc_init_1_2(struct drm_device *dev,
+				       const struct dpu_dsc_cfg *cfg,
+				       void __iomem *addr);
+
+/**
+ * dpu_hw_dsc_destroy - destroys dsc driver context
+ * @dsc:   Pointer to dsc driver context returned by dpu_hw_dsc_init
+ */
+void dpu_hw_dsc_destroy(struct dpu_hw_dsc *dsc);
+
+static inline struct dpu_hw_dsc *to_dpu_hw_dsc(struct dpu_hw_blk *hw)
+{
+	return container_of(hw, struct dpu_hw_dsc, base);
+}
+
+#endif /* _DPU_HW_DSC_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dsc_1_2.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dsc_1_2.c
@@ -0,0 +1,390 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved
+ */
+
+#include <drm/drm_managed.h>
+
+#include <drm/display/drm_dsc_helper.h>
+
+#include "dpu_kms.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hwio.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_dsc.h"
+
+#define DSC_CMN_MAIN_CNF           0x00
+
+/* DPU_DSC_ENC register offsets */
+#define ENC_DF_CTRL                0x00
+#define ENC_GENERAL_STATUS         0x04
+#define ENC_HSLICE_STATUS          0x08
+#define ENC_OUT_STATUS             0x0C
+#define ENC_INT_STAT               0x10
+#define ENC_INT_CLR                0x14
+#define ENC_INT_MASK               0x18
+#define DSC_MAIN_CONF              0x30
+#define DSC_PICTURE_SIZE           0x34
+#define DSC_SLICE_SIZE             0x38
+#define DSC_MISC_SIZE              0x3C
+#define DSC_HRD_DELAYS             0x40
+#define DSC_RC_SCALE               0x44
+#define DSC_RC_SCALE_INC_DEC       0x48
+#define DSC_RC_OFFSETS_1           0x4C
+#define DSC_RC_OFFSETS_2           0x50
+#define DSC_RC_OFFSETS_3           0x54
+#define DSC_RC_OFFSETS_4           0x58
+#define DSC_FLATNESS_QP            0x5C
+#define DSC_RC_MODEL_SIZE          0x60
+#define DSC_RC_CONFIG              0x64
+#define DSC_RC_BUF_THRESH_0        0x68
+#define DSC_RC_BUF_THRESH_1        0x6C
+#define DSC_RC_BUF_THRESH_2        0x70
+#define DSC_RC_BUF_THRESH_3        0x74
+#define DSC_RC_MIN_QP_0            0x78
+#define DSC_RC_MIN_QP_1            0x7C
+#define DSC_RC_MIN_QP_2            0x80
+#define DSC_RC_MAX_QP_0            0x84
+#define DSC_RC_MAX_QP_1            0x88
+#define DSC_RC_MAX_QP_2            0x8C
+#define DSC_RC_RANGE_BPG_OFFSETS_0 0x90
+#define DSC_RC_RANGE_BPG_OFFSETS_1 0x94
+#define DSC_RC_RANGE_BPG_OFFSETS_2 0x98
+
+/* DPU_DSC_CTL register offsets */
+#define DSC_CTL                    0x00
+#define DSC_CFG                    0x04
+#define DSC_DATA_IN_SWAP           0x08
+#define DSC_CLK_CTRL               0x0C
+
+static int _dsc_calc_output_buf_max_addr(struct dpu_hw_dsc *hw_dsc, int num_softslice)
+{
+	int max_addr = 2400 / num_softslice;
+
+	if (hw_dsc->caps->features & BIT(DPU_DSC_NATIVE_42x_EN))
+		max_addr /= 2;
+
+	return max_addr - 1;
+};
+
+static void dpu_hw_dsc_disable_1_2(struct dpu_hw_dsc *hw_dsc)
+{
+	struct dpu_hw_blk_reg_map *hw;
+	const struct dpu_dsc_sub_blks *sblk;
+
+	if (!hw_dsc)
+		return;
+
+	hw = &hw_dsc->hw;
+	sblk = hw_dsc->caps->sblk;
+	DPU_REG_WRITE(hw, sblk->ctl.base + DSC_CFG, 0);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + ENC_DF_CTRL, 0);
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_MAIN_CONF, 0);
+}
+
+static void dpu_hw_dsc_config_1_2(struct dpu_hw_dsc *hw_dsc,
+				  struct drm_dsc_config *dsc,
+				  u32 mode,
+				  u32 initial_lines)
+{
+	struct dpu_hw_blk_reg_map *hw;
+	const struct dpu_dsc_sub_blks *sblk;
+	u32 data = 0;
+	u32 det_thresh_flatness;
+	u32 num_active_slice_per_enc;
+	u32 bpp;
+
+	if (!hw_dsc || !dsc)
+		return;
+
+	hw = &hw_dsc->hw;
+
+	sblk = hw_dsc->caps->sblk;
+
+	if (mode & DSC_MODE_SPLIT_PANEL)
+		data |= BIT(0);
+
+	if (mode & DSC_MODE_MULTIPLEX)
+		data |= BIT(1);
+
+	num_active_slice_per_enc = dsc->slice_count;
+	if (mode & DSC_MODE_MULTIPLEX)
+		num_active_slice_per_enc = dsc->slice_count / 2;
+
+	data |= (num_active_slice_per_enc & 0x3) << 7;
+
+	DPU_REG_WRITE(hw, DSC_CMN_MAIN_CNF, data);
+
+	data = (initial_lines & 0xff);
+
+	if (mode & DSC_MODE_VIDEO)
+		data |= BIT(9);
+
+	data |= (_dsc_calc_output_buf_max_addr(hw_dsc, num_active_slice_per_enc) << 18);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + ENC_DF_CTRL, data);
+
+	data = (dsc->dsc_version_minor & 0xf) << 28;
+	if (dsc->dsc_version_minor == 0x2) {
+		if (dsc->native_422)
+			data |= BIT(22);
+		if (dsc->native_420)
+			data |= BIT(21);
+	}
+
+	bpp = dsc->bits_per_pixel;
+	/* as per hw requirement bpp should be programmed
+	 * twice the actual value in case of 420 or 422 encoding
+	 */
+	if (dsc->native_422 || dsc->native_420)
+		bpp = 2 * bpp;
+
+	data |= bpp << 10;
+
+	if (dsc->block_pred_enable)
+		data |= BIT(20);
+
+	if (dsc->convert_rgb)
+		data |= BIT(4);
+
+	data |= (dsc->line_buf_depth & 0xf) << 6;
+	data |= dsc->bits_per_component & 0xf;
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_MAIN_CONF, data);
+
+	data = (dsc->pic_width & 0xffff) |
+		((dsc->pic_height & 0xffff) << 16);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_PICTURE_SIZE, data);
+
+	data = (dsc->slice_width & 0xffff) |
+		((dsc->slice_height & 0xffff) << 16);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_SLICE_SIZE, data);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_MISC_SIZE,
+		      (dsc->slice_chunk_size) & 0xffff);
+
+	data = (dsc->initial_xmit_delay & 0xffff) |
+		((dsc->initial_dec_delay & 0xffff) << 16);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_HRD_DELAYS, data);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_SCALE,
+		      dsc->initial_scale_value & 0x3f);
+
+	data = (dsc->scale_increment_interval & 0xffff) |
+		((dsc->scale_decrement_interval & 0x7ff) << 16);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_SCALE_INC_DEC, data);
+
+	data = (dsc->first_line_bpg_offset & 0x1f) |
+		((dsc->second_line_bpg_offset & 0x1f) << 5);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_OFFSETS_1, data);
+
+	data = (dsc->nfl_bpg_offset & 0xffff) |
+		((dsc->slice_bpg_offset & 0xffff) << 16);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_OFFSETS_2, data);
+
+	data = (dsc->initial_offset & 0xffff) |
+		((dsc->final_offset & 0xffff) << 16);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_OFFSETS_3, data);
+
+	data = (dsc->nsl_bpg_offset & 0xffff) |
+		((dsc->second_line_offset_adj & 0xffff) << 16);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_OFFSETS_4, data);
+
+	det_thresh_flatness = drm_dsc_flatness_det_thresh(dsc);
+	data = (dsc->flatness_min_qp & 0x1f) |
+		((dsc->flatness_max_qp & 0x1f) << 5) |
+		((det_thresh_flatness & 0xff) << 10);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_FLATNESS_QP, data);
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_MODEL_SIZE,
+		      (dsc->rc_model_size) & 0xffff);
+
+	data = dsc->rc_edge_factor & 0xf;
+	data |= (dsc->rc_quant_incr_limit0 & 0x1f) << 8;
+	data |= (dsc->rc_quant_incr_limit1 & 0x1f) << 13;
+	data |= (dsc->rc_tgt_offset_high & 0xf) << 20;
+	data |= (dsc->rc_tgt_offset_low & 0xf) << 24;
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_CONFIG, data);
+
+	/* program the dsc wrapper */
+	data = BIT(0); /* encoder enable */
+	if (dsc->native_422)
+		data |= BIT(8);
+	else if (dsc->native_420)
+		data |= BIT(9);
+	if (!dsc->convert_rgb)
+		data |= BIT(10);
+	if (dsc->bits_per_component == 8)
+		data |= BIT(11);
+	if (mode & DSC_MODE_SPLIT_PANEL)
+		data |= BIT(12);
+	if (mode & DSC_MODE_MULTIPLEX)
+		data |= BIT(13);
+	if (!(mode & DSC_MODE_VIDEO))
+		data |= BIT(17);
+
+	DPU_REG_WRITE(hw, sblk->ctl.base + DSC_CFG, data);
+}
+
+static void dpu_hw_dsc_config_thresh_1_2(struct dpu_hw_dsc *hw_dsc,
+					 struct drm_dsc_config *dsc)
+{
+	struct dpu_hw_blk_reg_map *hw;
+	const struct dpu_dsc_sub_blks *sblk;
+	struct drm_dsc_rc_range_parameters *rc;
+
+	if (!hw_dsc || !dsc)
+		return;
+
+	hw = &hw_dsc->hw;
+
+	sblk = hw_dsc->caps->sblk;
+
+	rc = dsc->rc_range_params;
+
+	/*
+	 * With BUF_THRESH -- 14 in total
+	 * each register contains 4 thresh values with the last register
+	 * containing only 2 thresh values
+	 */
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_BUF_THRESH_0,
+		      (dsc->rc_buf_thresh[0] << 0) |
+		      (dsc->rc_buf_thresh[1] << 8) |
+		      (dsc->rc_buf_thresh[2] << 16) |
+		      (dsc->rc_buf_thresh[3] << 24));
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_BUF_THRESH_1,
+		      (dsc->rc_buf_thresh[4] << 0) |
+		      (dsc->rc_buf_thresh[5] << 8) |
+		      (dsc->rc_buf_thresh[6] << 16) |
+		      (dsc->rc_buf_thresh[7] << 24));
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_BUF_THRESH_2,
+		      (dsc->rc_buf_thresh[8] << 0) |
+		      (dsc->rc_buf_thresh[9] << 8) |
+		      (dsc->rc_buf_thresh[10] << 16) |
+		      (dsc->rc_buf_thresh[11] << 24));
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_BUF_THRESH_3,
+		      (dsc->rc_buf_thresh[12] << 0) |
+		      (dsc->rc_buf_thresh[13] << 8));
+
+	/*
+	 * with min/max_QP -- 5 bits
+	 * each register contains 5 min_qp or max_qp for total of 15
+	 *
+	 * With BPG_OFFSET -- 6 bits
+	 * each register contains 5 BPG_offset for total of 15
+	 */
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_MIN_QP_0,
+		      (rc[0].range_min_qp << 0) |
+		      (rc[1].range_min_qp << 5) |
+		      (rc[2].range_min_qp << 10) |
+		      (rc[3].range_min_qp << 15) |
+		      (rc[4].range_min_qp << 20));
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_MAX_QP_0,
+		      (rc[0].range_max_qp << 0) |
+		      (rc[1].range_max_qp << 5) |
+		      (rc[2].range_max_qp << 10) |
+		      (rc[3].range_max_qp << 15) |
+		      (rc[4].range_max_qp << 20));
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_RANGE_BPG_OFFSETS_0,
+		      (rc[0].range_bpg_offset << 0) |
+		      (rc[1].range_bpg_offset << 6) |
+		      (rc[2].range_bpg_offset << 12) |
+		      (rc[3].range_bpg_offset << 18) |
+		      (rc[4].range_bpg_offset << 24));
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_MIN_QP_1,
+		      (rc[5].range_min_qp << 0) |
+		      (rc[6].range_min_qp << 5) |
+		      (rc[7].range_min_qp << 10) |
+		      (rc[8].range_min_qp << 15) |
+		      (rc[9].range_min_qp << 20));
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_MAX_QP_1,
+		      (rc[5].range_max_qp << 0) |
+		      (rc[6].range_max_qp << 5) |
+		      (rc[7].range_max_qp << 10) |
+		      (rc[8].range_max_qp << 15) |
+		      (rc[9].range_max_qp << 20));
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_RANGE_BPG_OFFSETS_1,
+		      (rc[5].range_bpg_offset << 0) |
+		      (rc[6].range_bpg_offset << 6) |
+		      (rc[7].range_bpg_offset << 12) |
+		      (rc[8].range_bpg_offset << 18) |
+		      (rc[9].range_bpg_offset << 24));
+
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_MIN_QP_2,
+		      (rc[10].range_min_qp << 0) |
+		      (rc[11].range_min_qp << 5) |
+		      (rc[12].range_min_qp << 10) |
+		      (rc[13].range_min_qp << 15) |
+		      (rc[14].range_min_qp << 20));
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_MAX_QP_2,
+		      (rc[10].range_max_qp << 0) |
+		      (rc[11].range_max_qp << 5) |
+		      (rc[12].range_max_qp << 10) |
+		      (rc[13].range_max_qp << 15) |
+		      (rc[14].range_max_qp << 20));
+	DPU_REG_WRITE(hw, sblk->enc.base + DSC_RC_RANGE_BPG_OFFSETS_2,
+		      (rc[10].range_bpg_offset << 0) |
+		      (rc[11].range_bpg_offset << 6) |
+		      (rc[12].range_bpg_offset << 12) |
+		      (rc[13].range_bpg_offset << 18) |
+		      (rc[14].range_bpg_offset << 24));
+}
+
+static void dpu_hw_dsc_bind_pingpong_blk_1_2(struct dpu_hw_dsc *hw_dsc,
+					     const enum dpu_pingpong pp)
+{
+	struct dpu_hw_blk_reg_map *hw;
+	const struct dpu_dsc_sub_blks *sblk;
+	int mux_cfg = 0xf; /* Disabled */
+
+	hw = &hw_dsc->hw;
+
+	sblk = hw_dsc->caps->sblk;
+
+	if (pp)
+		mux_cfg = (pp - PINGPONG_0) & 0x7;
+
+	DPU_REG_WRITE(hw, sblk->ctl.base + DSC_CTL, mux_cfg);
+}
+
+static void _setup_dcs_ops_1_2(struct dpu_hw_dsc_ops *ops,
+			       const unsigned long features)
+{
+	ops->dsc_disable = dpu_hw_dsc_disable_1_2;
+	ops->dsc_config = dpu_hw_dsc_config_1_2;
+	ops->dsc_config_thresh = dpu_hw_dsc_config_thresh_1_2;
+	ops->dsc_bind_pingpong_blk = dpu_hw_dsc_bind_pingpong_blk_1_2;
+}
+
+struct dpu_hw_dsc *dpu_hw_dsc_init_1_2(struct drm_device *dev,
+				       const struct dpu_dsc_cfg *cfg,
+				       void __iomem *addr)
+{
+	struct dpu_hw_dsc *c;
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_DSC;
+
+	c->idx = cfg->id;
+	c->caps = cfg;
+	_setup_dcs_ops_1_2(&c->ops, c->caps->features);
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dspp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dspp.c
@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#include <drm/drm_managed.h>
+
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_lm.h"
+#include "dpu_hw_dspp.h"
+#include "dpu_kms.h"
+
+
+/* DSPP_PCC */
+#define PCC_EN BIT(0)
+#define PCC_DIS 0
+#define PCC_RED_R_OFF 0x10
+#define PCC_RED_G_OFF 0x1C
+#define PCC_RED_B_OFF 0x28
+#define PCC_GREEN_R_OFF 0x14
+#define PCC_GREEN_G_OFF 0x20
+#define PCC_GREEN_B_OFF 0x2C
+#define PCC_BLUE_R_OFF 0x18
+#define PCC_BLUE_G_OFF 0x24
+#define PCC_BLUE_B_OFF 0x30
+
+static void dpu_setup_dspp_pcc(struct dpu_hw_dspp *ctx,
+		struct dpu_hw_pcc_cfg *cfg)
+{
+
+	u32 base;
+
+	if (!ctx) {
+		DRM_ERROR("invalid ctx %pK\n", ctx);
+		return;
+	}
+
+	base = ctx->cap->sblk->pcc.base;
+
+	if (!base) {
+		DRM_ERROR("invalid ctx %pK pcc base 0x%x\n", ctx, base);
+		return;
+	}
+
+	if (!cfg) {
+		DRM_DEBUG_DRIVER("disable pcc feature\n");
+		DPU_REG_WRITE(&ctx->hw, base, PCC_DIS);
+		return;
+	}
+
+	DPU_REG_WRITE(&ctx->hw, base + PCC_RED_R_OFF, cfg->r.r);
+	DPU_REG_WRITE(&ctx->hw, base + PCC_RED_G_OFF, cfg->r.g);
+	DPU_REG_WRITE(&ctx->hw, base + PCC_RED_B_OFF, cfg->r.b);
+
+	DPU_REG_WRITE(&ctx->hw, base + PCC_GREEN_R_OFF, cfg->g.r);
+	DPU_REG_WRITE(&ctx->hw, base + PCC_GREEN_G_OFF, cfg->g.g);
+	DPU_REG_WRITE(&ctx->hw, base + PCC_GREEN_B_OFF, cfg->g.b);
+
+	DPU_REG_WRITE(&ctx->hw, base + PCC_BLUE_R_OFF, cfg->b.r);
+	DPU_REG_WRITE(&ctx->hw, base + PCC_BLUE_G_OFF, cfg->b.g);
+	DPU_REG_WRITE(&ctx->hw, base + PCC_BLUE_B_OFF, cfg->b.b);
+
+	DPU_REG_WRITE(&ctx->hw, base, PCC_EN);
+}
+
+static void _setup_dspp_ops(struct dpu_hw_dspp *c,
+		unsigned long features)
+{
+	if (test_bit(DPU_DSPP_PCC, &features))
+		c->ops.setup_pcc = dpu_setup_dspp_pcc;
+}
+
+struct dpu_hw_dspp *dpu_hw_dspp_init(struct drm_device *dev,
+				     const struct dpu_dspp_cfg *cfg,
+				     void __iomem *addr)
+{
+	struct dpu_hw_dspp *c;
+
+	if (!addr)
+		return ERR_PTR(-EINVAL);
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_DSPP;
+
+	/* Assign ops */
+	c->idx = cfg->id;
+	c->cap = cfg;
+	_setup_dspp_ops(c, c->cap->features);
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dspp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_dspp.h
@@ -0,0 +1,94 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_DSPP_H
+#define _DPU_HW_DSPP_H
+
+struct dpu_hw_dspp;
+
+/**
+ * struct dpu_hw_pcc_coeff - PCC coefficient structure for each color
+ *                            component.
+ * @r: red coefficient.
+ * @g: green coefficient.
+ * @b: blue coefficient.
+ */
+
+struct dpu_hw_pcc_coeff {
+	__u32 r;
+	__u32 g;
+	__u32 b;
+};
+
+/**
+ * struct dpu_hw_pcc - pcc feature structure
+ * @r: red coefficients.
+ * @g: green coefficients.
+ * @b: blue coefficients.
+ */
+struct dpu_hw_pcc_cfg {
+	struct dpu_hw_pcc_coeff r;
+	struct dpu_hw_pcc_coeff g;
+	struct dpu_hw_pcc_coeff b;
+};
+
+/**
+ * struct dpu_hw_dspp_ops - interface to the dspp hardware driver functions
+ * Caller must call the init function to get the dspp context for each dspp
+ * Assumption is these functions will be called after clocks are enabled
+ */
+struct dpu_hw_dspp_ops {
+	/**
+	 * setup_pcc - setup dspp pcc
+	 * @ctx: Pointer to dspp context
+	 * @cfg: Pointer to configuration
+	 */
+	void (*setup_pcc)(struct dpu_hw_dspp *ctx, struct dpu_hw_pcc_cfg *cfg);
+
+};
+
+/**
+ * struct dpu_hw_dspp - dspp description
+ * @base: Hardware block base structure
+ * @hw: Block hardware details
+ * @idx: DSPP index
+ * @cap: Pointer to layer_cfg
+ * @ops: Pointer to operations possible for this DSPP
+ */
+struct dpu_hw_dspp {
+	struct dpu_hw_blk base;
+	struct dpu_hw_blk_reg_map hw;
+
+	/* dspp */
+	int idx;
+	const struct dpu_dspp_cfg *cap;
+
+	/* Ops */
+	struct dpu_hw_dspp_ops ops;
+};
+
+/**
+ * dpu_hw_dspp - convert base object dpu_hw_base to container
+ * @hw: Pointer to base hardware block
+ * return: Pointer to hardware block container
+ */
+static inline struct dpu_hw_dspp *to_dpu_hw_dspp(struct dpu_hw_blk *hw)
+{
+	return container_of(hw, struct dpu_hw_dspp, base);
+}
+
+/**
+ * dpu_hw_dspp_init() - Initializes the DSPP hw driver object.
+ * should be called once before accessing every DSPP.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  DSPP catalog entry for which driver object is required
+ * @addr: Mapped register io address of MDP
+ * Return: pointer to structure or ERR_PTR
+ */
+struct dpu_hw_dspp *dpu_hw_dspp_init(struct drm_device *dev,
+				     const struct dpu_dspp_cfg *cfg,
+				     void __iomem *addr);
+
+#endif /*_DPU_HW_DSPP_H */
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_interrupts.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_interrupts.c
@@ -0,0 +1,676 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/bitops.h>
+#include <linux/debugfs.h>
+#include <linux/slab.h>
+
+#include <drm/drm_managed.h>
+
+#include "dpu_core_irq.h"
+#include "dpu_kms.h"
+#include "dpu_hw_interrupts.h"
+#include "dpu_hw_util.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_trace.h"
+
+/*
+ * Register offsets in MDSS register file for the interrupt registers
+ * w.r.t. the MDP base
+ */
+#define MDP_INTF_OFF(intf)				(0x6A000 + 0x800 * (intf))
+#define MDP_INTF_INTR_EN(intf)				(MDP_INTF_OFF(intf) + 0x1c0)
+#define MDP_INTF_INTR_STATUS(intf)			(MDP_INTF_OFF(intf) + 0x1c4)
+#define MDP_INTF_INTR_CLEAR(intf)			(MDP_INTF_OFF(intf) + 0x1c8)
+#define MDP_INTF_TEAR_OFF(intf)				(0x6D700 + 0x100 * (intf))
+#define MDP_INTF_INTR_TEAR_EN(intf)			(MDP_INTF_TEAR_OFF(intf) + 0x000)
+#define MDP_INTF_INTR_TEAR_STATUS(intf)			(MDP_INTF_TEAR_OFF(intf) + 0x004)
+#define MDP_INTF_INTR_TEAR_CLEAR(intf)			(MDP_INTF_TEAR_OFF(intf) + 0x008)
+#define MDP_AD4_OFF(ad4)				(0x7C000 + 0x1000 * (ad4))
+#define MDP_AD4_INTR_EN_OFF(ad4)			(MDP_AD4_OFF(ad4) + 0x41c)
+#define MDP_AD4_INTR_CLEAR_OFF(ad4)			(MDP_AD4_OFF(ad4) + 0x424)
+#define MDP_AD4_INTR_STATUS_OFF(ad4)			(MDP_AD4_OFF(ad4) + 0x420)
+#define MDP_INTF_REV_7xxx_OFF(intf)			(0x34000 + 0x1000 * (intf))
+#define MDP_INTF_REV_7xxx_INTR_EN(intf)			(MDP_INTF_REV_7xxx_OFF(intf) + 0x1c0)
+#define MDP_INTF_REV_7xxx_INTR_STATUS(intf)		(MDP_INTF_REV_7xxx_OFF(intf) + 0x1c4)
+#define MDP_INTF_REV_7xxx_INTR_CLEAR(intf)		(MDP_INTF_REV_7xxx_OFF(intf) + 0x1c8)
+#define MDP_INTF_REV_7xxx_TEAR_OFF(intf)		(0x34800 + 0x1000 * (intf))
+#define MDP_INTF_REV_7xxx_INTR_TEAR_EN(intf)		(MDP_INTF_REV_7xxx_TEAR_OFF(intf) + 0x000)
+#define MDP_INTF_REV_7xxx_INTR_TEAR_STATUS(intf)	(MDP_INTF_REV_7xxx_TEAR_OFF(intf) + 0x004)
+#define MDP_INTF_REV_7xxx_INTR_TEAR_CLEAR(intf)		(MDP_INTF_REV_7xxx_TEAR_OFF(intf) + 0x008)
+
+/**
+ * struct dpu_intr_reg - array of DPU register sets
+ * @clr_off:	offset to CLEAR reg
+ * @en_off:	offset to ENABLE reg
+ * @status_off:	offset to STATUS reg
+ */
+struct dpu_intr_reg {
+	u32 clr_off;
+	u32 en_off;
+	u32 status_off;
+};
+
+/*
+ * dpu_intr_set_legacy -  List of DPU interrupt registers for DPU <= 6.x
+ */
+static const struct dpu_intr_reg dpu_intr_set_legacy[] = {
+	[MDP_SSPP_TOP0_INTR] = {
+		INTR_CLEAR,
+		INTR_EN,
+		INTR_STATUS
+	},
+	[MDP_SSPP_TOP0_INTR2] = {
+		INTR2_CLEAR,
+		INTR2_EN,
+		INTR2_STATUS
+	},
+	[MDP_SSPP_TOP0_HIST_INTR] = {
+		HIST_INTR_CLEAR,
+		HIST_INTR_EN,
+		HIST_INTR_STATUS
+	},
+	[MDP_INTF0_INTR] = {
+		MDP_INTF_INTR_CLEAR(0),
+		MDP_INTF_INTR_EN(0),
+		MDP_INTF_INTR_STATUS(0)
+	},
+	[MDP_INTF1_INTR] = {
+		MDP_INTF_INTR_CLEAR(1),
+		MDP_INTF_INTR_EN(1),
+		MDP_INTF_INTR_STATUS(1)
+	},
+	[MDP_INTF2_INTR] = {
+		MDP_INTF_INTR_CLEAR(2),
+		MDP_INTF_INTR_EN(2),
+		MDP_INTF_INTR_STATUS(2)
+	},
+	[MDP_INTF3_INTR] = {
+		MDP_INTF_INTR_CLEAR(3),
+		MDP_INTF_INTR_EN(3),
+		MDP_INTF_INTR_STATUS(3)
+	},
+	[MDP_INTF4_INTR] = {
+		MDP_INTF_INTR_CLEAR(4),
+		MDP_INTF_INTR_EN(4),
+		MDP_INTF_INTR_STATUS(4)
+	},
+	[MDP_INTF5_INTR] = {
+		MDP_INTF_INTR_CLEAR(5),
+		MDP_INTF_INTR_EN(5),
+		MDP_INTF_INTR_STATUS(5)
+	},
+	[MDP_INTF1_TEAR_INTR] = {
+		MDP_INTF_INTR_TEAR_CLEAR(1),
+		MDP_INTF_INTR_TEAR_EN(1),
+		MDP_INTF_INTR_TEAR_STATUS(1)
+	},
+	[MDP_INTF2_TEAR_INTR] = {
+		MDP_INTF_INTR_TEAR_CLEAR(2),
+		MDP_INTF_INTR_TEAR_EN(2),
+		MDP_INTF_INTR_TEAR_STATUS(2)
+	},
+	[MDP_AD4_0_INTR] = {
+		MDP_AD4_INTR_CLEAR_OFF(0),
+		MDP_AD4_INTR_EN_OFF(0),
+		MDP_AD4_INTR_STATUS_OFF(0),
+	},
+	[MDP_AD4_1_INTR] = {
+		MDP_AD4_INTR_CLEAR_OFF(1),
+		MDP_AD4_INTR_EN_OFF(1),
+		MDP_AD4_INTR_STATUS_OFF(1),
+	},
+};
+
+/*
+ * dpu_intr_set_7xxx -  List of DPU interrupt registers for DPU >= 7.0
+ */
+static const struct dpu_intr_reg dpu_intr_set_7xxx[] = {
+	[MDP_SSPP_TOP0_INTR] = {
+		INTR_CLEAR,
+		INTR_EN,
+		INTR_STATUS
+	},
+	[MDP_SSPP_TOP0_INTR2] = {
+		INTR2_CLEAR,
+		INTR2_EN,
+		INTR2_STATUS
+	},
+	[MDP_SSPP_TOP0_HIST_INTR] = {
+		HIST_INTR_CLEAR,
+		HIST_INTR_EN,
+		HIST_INTR_STATUS
+	},
+	[MDP_INTF0_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_CLEAR(0),
+		MDP_INTF_REV_7xxx_INTR_EN(0),
+		MDP_INTF_REV_7xxx_INTR_STATUS(0)
+	},
+	[MDP_INTF1_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_CLEAR(1),
+		MDP_INTF_REV_7xxx_INTR_EN(1),
+		MDP_INTF_REV_7xxx_INTR_STATUS(1)
+	},
+	[MDP_INTF1_TEAR_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_TEAR_CLEAR(1),
+		MDP_INTF_REV_7xxx_INTR_TEAR_EN(1),
+		MDP_INTF_REV_7xxx_INTR_TEAR_STATUS(1)
+	},
+	[MDP_INTF2_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_CLEAR(2),
+		MDP_INTF_REV_7xxx_INTR_EN(2),
+		MDP_INTF_REV_7xxx_INTR_STATUS(2)
+	},
+	[MDP_INTF2_TEAR_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_TEAR_CLEAR(2),
+		MDP_INTF_REV_7xxx_INTR_TEAR_EN(2),
+		MDP_INTF_REV_7xxx_INTR_TEAR_STATUS(2)
+	},
+	[MDP_INTF3_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_CLEAR(3),
+		MDP_INTF_REV_7xxx_INTR_EN(3),
+		MDP_INTF_REV_7xxx_INTR_STATUS(3)
+	},
+	[MDP_INTF4_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_CLEAR(4),
+		MDP_INTF_REV_7xxx_INTR_EN(4),
+		MDP_INTF_REV_7xxx_INTR_STATUS(4)
+	},
+	[MDP_INTF5_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_CLEAR(5),
+		MDP_INTF_REV_7xxx_INTR_EN(5),
+		MDP_INTF_REV_7xxx_INTR_STATUS(5)
+	},
+	[MDP_INTF6_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_CLEAR(6),
+		MDP_INTF_REV_7xxx_INTR_EN(6),
+		MDP_INTF_REV_7xxx_INTR_STATUS(6)
+	},
+	[MDP_INTF7_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_CLEAR(7),
+		MDP_INTF_REV_7xxx_INTR_EN(7),
+		MDP_INTF_REV_7xxx_INTR_STATUS(7)
+	},
+	[MDP_INTF8_INTR] = {
+		MDP_INTF_REV_7xxx_INTR_CLEAR(8),
+		MDP_INTF_REV_7xxx_INTR_EN(8),
+		MDP_INTF_REV_7xxx_INTR_STATUS(8)
+	},
+};
+
+#define DPU_IRQ_MASK(irq_idx)	(BIT(DPU_IRQ_BIT(irq_idx)))
+
+static inline bool dpu_core_irq_is_valid(unsigned int irq_idx)
+{
+	return irq_idx && irq_idx <= DPU_NUM_IRQS;
+}
+
+static inline struct dpu_hw_intr_entry *dpu_core_irq_get_entry(struct dpu_hw_intr *intr,
+							       unsigned int irq_idx)
+{
+	return &intr->irq_tbl[irq_idx - 1];
+}
+
+/**
+ * dpu_core_irq_callback_handler - dispatch core interrupts
+ * @dpu_kms:		Pointer to DPU's KMS structure
+ * @irq_idx:		interrupt index
+ */
+static void dpu_core_irq_callback_handler(struct dpu_kms *dpu_kms, unsigned int irq_idx)
+{
+	struct dpu_hw_intr_entry *irq_entry = dpu_core_irq_get_entry(dpu_kms->hw_intr, irq_idx);
+
+	VERB("IRQ=[%d, %d]\n", DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+
+	if (!irq_entry->cb) {
+		DRM_ERROR("no registered cb, IRQ=[%d, %d]\n",
+			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+		return;
+	}
+
+	atomic_inc(&irq_entry->count);
+
+	/*
+	 * Perform registered function callback
+	 */
+	irq_entry->cb(irq_entry->arg);
+}
+
+irqreturn_t dpu_core_irq(struct msm_kms *kms)
+{
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+	struct dpu_hw_intr *intr = dpu_kms->hw_intr;
+	int reg_idx;
+	unsigned int irq_idx;
+	u32 irq_status;
+	u32 enable_mask;
+	int bit;
+	unsigned long irq_flags;
+
+	if (!intr)
+		return IRQ_NONE;
+
+	spin_lock_irqsave(&intr->irq_lock, irq_flags);
+	for (reg_idx = 0; reg_idx < MDP_INTR_MAX; reg_idx++) {
+		if (!test_bit(reg_idx, &intr->irq_mask))
+			continue;
+
+		/* Read interrupt status */
+		irq_status = DPU_REG_READ(&intr->hw, intr->intr_set[reg_idx].status_off);
+
+		/* Read enable mask */
+		enable_mask = DPU_REG_READ(&intr->hw, intr->intr_set[reg_idx].en_off);
+
+		/* and clear the interrupt */
+		if (irq_status)
+			DPU_REG_WRITE(&intr->hw, intr->intr_set[reg_idx].clr_off,
+				     irq_status);
+
+		/* Finally update IRQ status based on enable mask */
+		irq_status &= enable_mask;
+
+		if (!irq_status)
+			continue;
+
+		/*
+		 * Search through matching intr status.
+		 */
+		while ((bit = ffs(irq_status)) != 0) {
+			irq_idx = DPU_IRQ_IDX(reg_idx, bit - 1);
+
+			dpu_core_irq_callback_handler(dpu_kms, irq_idx);
+
+			/*
+			 * When callback finish, clear the irq_status
+			 * with the matching mask. Once irq_status
+			 * is all cleared, the search can be stopped.
+			 */
+			irq_status &= ~BIT(bit - 1);
+		}
+	}
+
+	/* ensure register writes go through */
+	wmb();
+
+	spin_unlock_irqrestore(&intr->irq_lock, irq_flags);
+
+	return IRQ_HANDLED;
+}
+
+static int dpu_hw_intr_enable_irq_locked(struct dpu_hw_intr *intr,
+					 unsigned int irq_idx)
+{
+	int reg_idx;
+	const struct dpu_intr_reg *reg;
+	const char *dbgstr = NULL;
+	uint32_t cache_irq_mask;
+
+	if (!intr)
+		return -EINVAL;
+
+	if (!dpu_core_irq_is_valid(irq_idx)) {
+		pr_err("invalid IRQ=[%d, %d]\n",
+		       DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+		return -EINVAL;
+	}
+
+	/*
+	 * The cache_irq_mask and hardware RMW operations needs to be done
+	 * under irq_lock and it's the caller's responsibility to ensure that's
+	 * held.
+	 */
+	assert_spin_locked(&intr->irq_lock);
+
+	reg_idx = DPU_IRQ_REG(irq_idx);
+	reg = &intr->intr_set[reg_idx];
+
+	/* Is this interrupt register supported on the platform */
+	if (WARN_ON(!reg->en_off))
+		return -EINVAL;
+
+	cache_irq_mask = intr->cache_irq_mask[reg_idx];
+	if (cache_irq_mask & DPU_IRQ_MASK(irq_idx)) {
+		dbgstr = "already ";
+	} else {
+		dbgstr = "";
+
+		cache_irq_mask |= DPU_IRQ_MASK(irq_idx);
+		/* Cleaning any pending interrupt */
+		DPU_REG_WRITE(&intr->hw, reg->clr_off, DPU_IRQ_MASK(irq_idx));
+		/* Enabling interrupts with the new mask */
+		DPU_REG_WRITE(&intr->hw, reg->en_off, cache_irq_mask);
+
+		/* ensure register write goes through */
+		wmb();
+
+		intr->cache_irq_mask[reg_idx] = cache_irq_mask;
+	}
+
+	pr_debug("DPU IRQ=[%d, %d] %senabled: MASK:0x%.8lx, CACHE-MASK:0x%.8x\n",
+		 DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx), dbgstr,
+			DPU_IRQ_MASK(irq_idx), cache_irq_mask);
+
+	return 0;
+}
+
+static int dpu_hw_intr_disable_irq_locked(struct dpu_hw_intr *intr,
+					  unsigned int irq_idx)
+{
+	int reg_idx;
+	const struct dpu_intr_reg *reg;
+	const char *dbgstr = NULL;
+	uint32_t cache_irq_mask;
+
+	if (!intr)
+		return -EINVAL;
+
+	if (!dpu_core_irq_is_valid(irq_idx)) {
+		pr_err("invalid IRQ=[%d, %d]\n",
+		       DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+		return -EINVAL;
+	}
+
+	/*
+	 * The cache_irq_mask and hardware RMW operations needs to be done
+	 * under irq_lock and it's the caller's responsibility to ensure that's
+	 * held.
+	 */
+	assert_spin_locked(&intr->irq_lock);
+
+	reg_idx = DPU_IRQ_REG(irq_idx);
+	reg = &intr->intr_set[reg_idx];
+
+	cache_irq_mask = intr->cache_irq_mask[reg_idx];
+	if ((cache_irq_mask & DPU_IRQ_MASK(irq_idx)) == 0) {
+		dbgstr = "already ";
+	} else {
+		dbgstr = "";
+
+		cache_irq_mask &= ~DPU_IRQ_MASK(irq_idx);
+		/* Disable interrupts based on the new mask */
+		DPU_REG_WRITE(&intr->hw, reg->en_off, cache_irq_mask);
+		/* Cleaning any pending interrupt */
+		DPU_REG_WRITE(&intr->hw, reg->clr_off, DPU_IRQ_MASK(irq_idx));
+
+		/* ensure register write goes through */
+		wmb();
+
+		intr->cache_irq_mask[reg_idx] = cache_irq_mask;
+	}
+
+	pr_debug("DPU IRQ=[%d, %d] %sdisabled: MASK:0x%.8lx, CACHE-MASK:0x%.8x\n",
+		 DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx), dbgstr,
+			DPU_IRQ_MASK(irq_idx), cache_irq_mask);
+
+	return 0;
+}
+
+static void dpu_clear_irqs(struct dpu_kms *dpu_kms)
+{
+	struct dpu_hw_intr *intr = dpu_kms->hw_intr;
+	int i;
+
+	if (!intr)
+		return;
+
+	for (i = 0; i < MDP_INTR_MAX; i++) {
+		if (test_bit(i, &intr->irq_mask))
+			DPU_REG_WRITE(&intr->hw,
+					intr->intr_set[i].clr_off, 0xffffffff);
+	}
+
+	/* ensure register writes go through */
+	wmb();
+}
+
+static void dpu_disable_all_irqs(struct dpu_kms *dpu_kms)
+{
+	struct dpu_hw_intr *intr = dpu_kms->hw_intr;
+	int i;
+
+	if (!intr)
+		return;
+
+	for (i = 0; i < MDP_INTR_MAX; i++) {
+		if (test_bit(i, &intr->irq_mask))
+			DPU_REG_WRITE(&intr->hw,
+					intr->intr_set[i].en_off, 0x00000000);
+	}
+
+	/* ensure register writes go through */
+	wmb();
+}
+
+u32 dpu_core_irq_read(struct dpu_kms *dpu_kms,
+		      unsigned int irq_idx)
+{
+	struct dpu_hw_intr *intr = dpu_kms->hw_intr;
+	int reg_idx;
+	unsigned long irq_flags;
+	u32 intr_status;
+
+	if (!intr)
+		return 0;
+
+	if (!dpu_core_irq_is_valid(irq_idx)) {
+		pr_err("invalid IRQ=[%d, %d]\n", DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+		return 0;
+	}
+
+	spin_lock_irqsave(&intr->irq_lock, irq_flags);
+
+	reg_idx = DPU_IRQ_REG(irq_idx);
+	intr_status = DPU_REG_READ(&intr->hw,
+			intr->intr_set[reg_idx].status_off) &
+		DPU_IRQ_MASK(irq_idx);
+	if (intr_status)
+		DPU_REG_WRITE(&intr->hw, intr->intr_set[reg_idx].clr_off,
+				intr_status);
+
+	/* ensure register writes go through */
+	wmb();
+
+	spin_unlock_irqrestore(&intr->irq_lock, irq_flags);
+
+	return intr_status;
+}
+
+struct dpu_hw_intr *dpu_hw_intr_init(struct drm_device *dev,
+				     void __iomem *addr,
+				     const struct dpu_mdss_cfg *m)
+{
+	struct dpu_hw_intr *intr;
+	unsigned int i;
+
+	if (!addr || !m)
+		return ERR_PTR(-EINVAL);
+
+	intr = drmm_kzalloc(dev, sizeof(*intr), GFP_KERNEL);
+	if (!intr)
+		return ERR_PTR(-ENOMEM);
+
+	if (m->mdss_ver->core_major_ver >= 7)
+		intr->intr_set = dpu_intr_set_7xxx;
+	else
+		intr->intr_set = dpu_intr_set_legacy;
+
+	intr->hw.blk_addr = addr + m->mdp[0].base;
+
+	intr->irq_mask = BIT(MDP_SSPP_TOP0_INTR) |
+			 BIT(MDP_SSPP_TOP0_INTR2) |
+			 BIT(MDP_SSPP_TOP0_HIST_INTR);
+	for (i = 0; i < m->intf_count; i++) {
+		const struct dpu_intf_cfg *intf = &m->intf[i];
+
+		if (intf->type == INTF_NONE)
+			continue;
+
+		intr->irq_mask |= BIT(MDP_INTFn_INTR(intf->id));
+
+		if (intf->intr_tear_rd_ptr)
+			intr->irq_mask |= BIT(DPU_IRQ_REG(intf->intr_tear_rd_ptr));
+	}
+
+	spin_lock_init(&intr->irq_lock);
+
+	return intr;
+}
+
+int dpu_core_irq_register_callback(struct dpu_kms *dpu_kms,
+				   unsigned int irq_idx,
+				   void (*irq_cb)(void *arg),
+				   void *irq_arg)
+{
+	struct dpu_hw_intr_entry *irq_entry;
+	unsigned long irq_flags;
+	int ret;
+
+	if (!irq_cb) {
+		DPU_ERROR("IRQ=[%d, %d] NULL callback\n",
+			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+		return -EINVAL;
+	}
+
+	if (!dpu_core_irq_is_valid(irq_idx)) {
+		DPU_ERROR("invalid IRQ=[%d, %d] irq_cb:%ps\n",
+			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx), irq_cb);
+		return -EINVAL;
+	}
+
+	VERB("[%pS] IRQ=[%d, %d]\n", __builtin_return_address(0),
+	     DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+
+	spin_lock_irqsave(&dpu_kms->hw_intr->irq_lock, irq_flags);
+
+	irq_entry = dpu_core_irq_get_entry(dpu_kms->hw_intr, irq_idx);
+	if (unlikely(WARN_ON(irq_entry->cb))) {
+		spin_unlock_irqrestore(&dpu_kms->hw_intr->irq_lock, irq_flags);
+
+		return -EBUSY;
+	}
+
+	trace_dpu_core_irq_register_callback(DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx), irq_cb);
+	irq_entry->arg = irq_arg;
+	irq_entry->cb = irq_cb;
+
+	ret = dpu_hw_intr_enable_irq_locked(
+				dpu_kms->hw_intr,
+				irq_idx);
+	if (ret)
+		DPU_ERROR("Failed/ to enable IRQ=[%d, %d]\n",
+			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+	spin_unlock_irqrestore(&dpu_kms->hw_intr->irq_lock, irq_flags);
+
+	trace_dpu_irq_register_success(DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+
+	return 0;
+}
+
+int dpu_core_irq_unregister_callback(struct dpu_kms *dpu_kms,
+				     unsigned int irq_idx)
+{
+	struct dpu_hw_intr_entry *irq_entry;
+	unsigned long irq_flags;
+	int ret;
+
+	if (!dpu_core_irq_is_valid(irq_idx)) {
+		DPU_ERROR("invalid IRQ=[%d, %d]\n",
+			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+		return -EINVAL;
+	}
+
+	VERB("[%pS] IRQ=[%d, %d]\n", __builtin_return_address(0),
+	     DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+
+	spin_lock_irqsave(&dpu_kms->hw_intr->irq_lock, irq_flags);
+	trace_dpu_core_irq_unregister_callback(DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+
+	ret = dpu_hw_intr_disable_irq_locked(dpu_kms->hw_intr, irq_idx);
+	if (ret)
+		DPU_ERROR("Failed to disable IRQ=[%d, %d]: %d\n",
+			  DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx), ret);
+
+	irq_entry = dpu_core_irq_get_entry(dpu_kms->hw_intr, irq_idx);
+	irq_entry->cb = NULL;
+	irq_entry->arg = NULL;
+
+	spin_unlock_irqrestore(&dpu_kms->hw_intr->irq_lock, irq_flags);
+
+	trace_dpu_irq_unregister_success(DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+
+	return 0;
+}
+
+#ifdef CONFIG_DEBUG_FS
+static int dpu_debugfs_core_irq_show(struct seq_file *s, void *v)
+{
+	struct dpu_kms *dpu_kms = s->private;
+	struct dpu_hw_intr_entry *irq_entry;
+	unsigned long irq_flags;
+	int i, irq_count;
+	void *cb;
+
+	for (i = 1; i <= DPU_NUM_IRQS; i++) {
+		spin_lock_irqsave(&dpu_kms->hw_intr->irq_lock, irq_flags);
+		irq_entry = dpu_core_irq_get_entry(dpu_kms->hw_intr, i);
+		irq_count = atomic_read(&irq_entry->count);
+		cb = irq_entry->cb;
+		spin_unlock_irqrestore(&dpu_kms->hw_intr->irq_lock, irq_flags);
+
+		if (irq_count || cb)
+			seq_printf(s, "IRQ=[%d, %d] count:%d cb:%ps\n",
+				   DPU_IRQ_REG(i), DPU_IRQ_BIT(i), irq_count, cb);
+	}
+
+	return 0;
+}
+
+DEFINE_SHOW_ATTRIBUTE(dpu_debugfs_core_irq);
+
+void dpu_debugfs_core_irq_init(struct dpu_kms *dpu_kms,
+		struct dentry *parent)
+{
+	debugfs_create_file("core_irq", 0600, parent, dpu_kms,
+		&dpu_debugfs_core_irq_fops);
+}
+#endif
+
+void dpu_core_irq_preinstall(struct msm_kms *kms)
+{
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+	struct dpu_hw_intr_entry *irq_entry;
+	int i;
+
+	pm_runtime_get_sync(&dpu_kms->pdev->dev);
+	dpu_clear_irqs(dpu_kms);
+	dpu_disable_all_irqs(dpu_kms);
+	pm_runtime_put_sync(&dpu_kms->pdev->dev);
+
+	for (i = 1; i <= DPU_NUM_IRQS; i++) {
+		irq_entry = dpu_core_irq_get_entry(dpu_kms->hw_intr, i);
+		atomic_set(&irq_entry->count, 0);
+	}
+}
+
+void dpu_core_irq_uninstall(struct msm_kms *kms)
+{
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+	struct dpu_hw_intr_entry *irq_entry;
+	int i;
+
+	if (!dpu_kms->hw_intr)
+		return;
+
+	pm_runtime_get_sync(&dpu_kms->pdev->dev);
+	for (i = 1; i <= DPU_NUM_IRQS; i++) {
+		irq_entry = dpu_core_irq_get_entry(dpu_kms->hw_intr, i);
+		if (irq_entry->cb)
+			DPU_ERROR("IRQ=[%d, %d] still enabled/registered\n",
+				  DPU_IRQ_REG(i), DPU_IRQ_BIT(i));
+	}
+
+	dpu_clear_irqs(dpu_kms);
+	dpu_disable_all_irqs(dpu_kms);
+	pm_runtime_put_sync(&dpu_kms->pdev->dev);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_interrupts.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_interrupts.h
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_INTERRUPTS_H
+#define _DPU_HW_INTERRUPTS_H
+
+#include <linux/types.h>
+
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_util.h"
+#include "dpu_hw_mdss.h"
+
+/* When making changes be sure to sync with dpu_intr_set */
+enum dpu_hw_intr_reg {
+	MDP_SSPP_TOP0_INTR,
+	MDP_SSPP_TOP0_INTR2,
+	MDP_SSPP_TOP0_HIST_INTR,
+	/* All MDP_INTFn_INTR should come sequentially */
+	MDP_INTF0_INTR,
+	MDP_INTF1_INTR,
+	MDP_INTF2_INTR,
+	MDP_INTF3_INTR,
+	MDP_INTF4_INTR,
+	MDP_INTF5_INTR,
+	MDP_INTF6_INTR,
+	MDP_INTF7_INTR,
+	MDP_INTF8_INTR,
+	MDP_INTF1_TEAR_INTR,
+	MDP_INTF2_TEAR_INTR,
+	MDP_AD4_0_INTR,
+	MDP_AD4_1_INTR,
+	MDP_INTR_MAX,
+};
+
+#define MDP_INTFn_INTR(intf)	(MDP_INTF0_INTR + (intf - INTF_0))
+
+#define DPU_IRQ_IDX(reg_idx, offset)	(1 + reg_idx * 32 + offset)
+#define DPU_IRQ_REG(irq_idx)	((irq_idx - 1) / 32)
+#define DPU_IRQ_BIT(irq_idx)	((irq_idx - 1) % 32)
+
+#define DPU_NUM_IRQS		(MDP_INTR_MAX * 32)
+
+struct dpu_hw_intr_entry {
+	void (*cb)(void *arg);
+	void *arg;
+	atomic_t count;
+};
+
+/**
+ * struct dpu_hw_intr: hw interrupts handling data structure
+ * @hw:               virtual address mapping
+ * @ops:              function pointer mapping for IRQ handling
+ * @cache_irq_mask:   array of IRQ enable masks reg storage created during init
+ * @save_irq_status:  array of IRQ status reg storage created during init
+ * @irq_lock:         spinlock for accessing IRQ resources
+ * @irq_cb_tbl:       array of IRQ callbacks
+ */
+struct dpu_hw_intr {
+	struct dpu_hw_blk_reg_map hw;
+	u32 cache_irq_mask[MDP_INTR_MAX];
+	u32 *save_irq_status;
+	spinlock_t irq_lock;
+	unsigned long irq_mask;
+	const struct dpu_intr_reg *intr_set;
+
+	struct dpu_hw_intr_entry irq_tbl[DPU_NUM_IRQS];
+};
+
+/**
+ * dpu_hw_intr_init(): Initializes the interrupts hw object
+ * @dev:  Corresponding device for devres management
+ * @addr: mapped register io address of MDP
+ * @m:    pointer to MDSS catalog data
+ */
+struct dpu_hw_intr *dpu_hw_intr_init(struct drm_device *dev,
+				     void __iomem *addr,
+				     const struct dpu_mdss_cfg *m);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_intf.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_intf.c
@@ -0,0 +1,590 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_intf.h"
+#include "dpu_kms.h"
+#include "dpu_trace.h"
+
+#include <linux/iopoll.h>
+
+#include <drm/drm_managed.h>
+
+#define INTF_TIMING_ENGINE_EN           0x000
+#define INTF_CONFIG                     0x004
+#define INTF_HSYNC_CTL                  0x008
+#define INTF_VSYNC_PERIOD_F0            0x00C
+#define INTF_VSYNC_PERIOD_F1            0x010
+#define INTF_VSYNC_PULSE_WIDTH_F0       0x014
+#define INTF_VSYNC_PULSE_WIDTH_F1       0x018
+#define INTF_DISPLAY_V_START_F0         0x01C
+#define INTF_DISPLAY_V_START_F1         0x020
+#define INTF_DISPLAY_V_END_F0           0x024
+#define INTF_DISPLAY_V_END_F1           0x028
+#define INTF_ACTIVE_V_START_F0          0x02C
+#define INTF_ACTIVE_V_START_F1          0x030
+#define INTF_ACTIVE_V_END_F0            0x034
+#define INTF_ACTIVE_V_END_F1            0x038
+#define INTF_DISPLAY_HCTL               0x03C
+#define INTF_ACTIVE_HCTL                0x040
+#define INTF_BORDER_COLOR               0x044
+#define INTF_UNDERFLOW_COLOR            0x048
+#define INTF_HSYNC_SKEW                 0x04C
+#define INTF_POLARITY_CTL               0x050
+#define INTF_TEST_CTL                   0x054
+#define INTF_TP_COLOR0                  0x058
+#define INTF_TP_COLOR1                  0x05C
+#define INTF_CONFIG2                    0x060
+#define INTF_DISPLAY_DATA_HCTL          0x064
+#define INTF_ACTIVE_DATA_HCTL           0x068
+
+#define INTF_DSI_CMD_MODE_TRIGGER_EN    0x084
+#define INTF_PANEL_FORMAT               0x090
+
+#define INTF_FRAME_LINE_COUNT_EN        0x0A8
+#define INTF_FRAME_COUNT                0x0AC
+#define INTF_LINE_COUNT                 0x0B0
+
+#define INTF_DEFLICKER_CONFIG           0x0F0
+#define INTF_DEFLICKER_STRNG_COEFF      0x0F4
+#define INTF_DEFLICKER_WEAK_COEFF       0x0F8
+
+#define INTF_TPG_ENABLE                 0x100
+#define INTF_TPG_MAIN_CONTROL           0x104
+#define INTF_TPG_VIDEO_CONFIG           0x108
+#define INTF_TPG_COMPONENT_LIMITS       0x10C
+#define INTF_TPG_RECTANGLE              0x110
+#define INTF_TPG_INITIAL_VALUE          0x114
+#define INTF_TPG_BLK_WHITE_PATTERN_FRAMES 0x118
+#define INTF_TPG_RGB_MAPPING            0x11C
+#define INTF_PROG_FETCH_START           0x170
+#define INTF_PROG_ROT_START             0x174
+
+#define INTF_MISR_CTRL                  0x180
+#define INTF_MISR_SIGNATURE             0x184
+
+#define INTF_MUX                        0x25C
+#define INTF_STATUS                     0x26C
+#define INTF_AVR_CONTROL                0x270
+#define INTF_AVR_MODE                   0x274
+#define INTF_AVR_TRIGGER                0x278
+#define INTF_AVR_VTOTAL                 0x27C
+#define INTF_TEAR_MDP_VSYNC_SEL         0x280
+#define INTF_TEAR_TEAR_CHECK_EN         0x284
+#define INTF_TEAR_SYNC_CONFIG_VSYNC     0x288
+#define INTF_TEAR_SYNC_CONFIG_HEIGHT    0x28C
+#define INTF_TEAR_SYNC_WRCOUNT          0x290
+#define INTF_TEAR_VSYNC_INIT_VAL        0x294
+#define INTF_TEAR_INT_COUNT_VAL         0x298
+#define INTF_TEAR_SYNC_THRESH           0x29C
+#define INTF_TEAR_START_POS             0x2A0
+#define INTF_TEAR_RD_PTR_IRQ            0x2A4
+#define INTF_TEAR_WR_PTR_IRQ            0x2A8
+#define INTF_TEAR_OUT_LINE_COUNT        0x2AC
+#define INTF_TEAR_LINE_COUNT            0x2B0
+#define INTF_TEAR_AUTOREFRESH_CONFIG    0x2B4
+
+#define INTF_CFG_ACTIVE_H_EN	BIT(29)
+#define INTF_CFG_ACTIVE_V_EN	BIT(30)
+
+#define INTF_CFG2_DATABUS_WIDEN	BIT(0)
+#define INTF_CFG2_DATA_HCTL_EN	BIT(4)
+#define INTF_CFG2_DCE_DATA_COMPRESS     BIT(12)
+
+
+static void dpu_hw_intf_setup_timing_engine(struct dpu_hw_intf *ctx,
+		const struct dpu_hw_intf_timing_params *p,
+		const struct dpu_format *fmt)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	u32 hsync_period, vsync_period;
+	u32 display_v_start, display_v_end;
+	u32 hsync_start_x, hsync_end_x;
+	u32 hsync_data_start_x, hsync_data_end_x;
+	u32 active_h_start, active_h_end;
+	u32 active_v_start, active_v_end;
+	u32 active_hctl, display_hctl, hsync_ctl;
+	u32 polarity_ctl, den_polarity;
+	u32 panel_format;
+	u32 intf_cfg, intf_cfg2 = 0;
+	u32 display_data_hctl = 0, active_data_hctl = 0;
+	u32 data_width;
+	bool dp_intf = false;
+
+	/* read interface_cfg */
+	intf_cfg = DPU_REG_READ(c, INTF_CONFIG);
+
+	if (ctx->cap->type == INTF_DP)
+		dp_intf = true;
+
+	hsync_period = p->hsync_pulse_width + p->h_back_porch + p->width +
+	p->h_front_porch;
+	vsync_period = p->vsync_pulse_width + p->v_back_porch + p->height +
+	p->v_front_porch;
+
+	display_v_start = ((p->vsync_pulse_width + p->v_back_porch) *
+	hsync_period) + p->hsync_skew;
+	display_v_end = ((vsync_period - p->v_front_porch) * hsync_period) +
+	p->hsync_skew - 1;
+
+	hsync_start_x = p->h_back_porch + p->hsync_pulse_width;
+	hsync_end_x = hsync_period - p->h_front_porch - 1;
+
+	if (p->width != p->xres) { /* border fill added */
+		active_h_start = hsync_start_x;
+		active_h_end = active_h_start + p->xres - 1;
+	} else {
+		active_h_start = 0;
+		active_h_end = 0;
+	}
+
+	if (p->height != p->yres) { /* border fill added */
+		active_v_start = display_v_start;
+		active_v_end = active_v_start + (p->yres * hsync_period) - 1;
+	} else {
+		active_v_start = 0;
+		active_v_end = 0;
+	}
+
+	if (active_h_end) {
+		active_hctl = (active_h_end << 16) | active_h_start;
+		intf_cfg |= INTF_CFG_ACTIVE_H_EN;
+	} else {
+		active_hctl = 0;
+	}
+
+	if (active_v_end)
+		intf_cfg |= INTF_CFG_ACTIVE_V_EN;
+
+	hsync_ctl = (hsync_period << 16) | p->hsync_pulse_width;
+	display_hctl = (hsync_end_x << 16) | hsync_start_x;
+
+	if (p->wide_bus_en)
+		intf_cfg2 |= INTF_CFG2_DATABUS_WIDEN;
+
+	data_width = p->width;
+
+	hsync_data_start_x = hsync_start_x;
+	hsync_data_end_x =  hsync_start_x + data_width - 1;
+
+	display_data_hctl = (hsync_data_end_x << 16) | hsync_data_start_x;
+
+	if (dp_intf) {
+		/* DP timing adjustment */
+		display_v_start += p->hsync_pulse_width + p->h_back_porch;
+		display_v_end   -= p->h_front_porch;
+
+		active_h_start = hsync_start_x;
+		active_h_end = active_h_start + p->xres - 1;
+		active_v_start = display_v_start;
+		active_v_end = active_v_start + (p->yres * hsync_period) - 1;
+
+		active_hctl = (active_h_end << 16) | active_h_start;
+		display_hctl = active_hctl;
+
+		intf_cfg |= INTF_CFG_ACTIVE_H_EN | INTF_CFG_ACTIVE_V_EN;
+	}
+
+	den_polarity = 0;
+	polarity_ctl = (den_polarity << 2) | /*  DEN Polarity  */
+		(p->vsync_polarity << 1) | /* VSYNC Polarity */
+		(p->hsync_polarity << 0);  /* HSYNC Polarity */
+
+	if (!DPU_FORMAT_IS_YUV(fmt))
+		panel_format = (fmt->bits[C0_G_Y] |
+				(fmt->bits[C1_B_Cb] << 2) |
+				(fmt->bits[C2_R_Cr] << 4) |
+				(0x21 << 8));
+	else
+		/* Interface treats all the pixel data in RGB888 format */
+		panel_format = (COLOR_8BIT |
+				(COLOR_8BIT << 2) |
+				(COLOR_8BIT << 4) |
+				(0x21 << 8));
+
+	DPU_REG_WRITE(c, INTF_HSYNC_CTL, hsync_ctl);
+	DPU_REG_WRITE(c, INTF_VSYNC_PERIOD_F0, vsync_period * hsync_period);
+	DPU_REG_WRITE(c, INTF_VSYNC_PULSE_WIDTH_F0,
+			p->vsync_pulse_width * hsync_period);
+	DPU_REG_WRITE(c, INTF_DISPLAY_HCTL, display_hctl);
+	DPU_REG_WRITE(c, INTF_DISPLAY_V_START_F0, display_v_start);
+	DPU_REG_WRITE(c, INTF_DISPLAY_V_END_F0, display_v_end);
+	DPU_REG_WRITE(c, INTF_ACTIVE_HCTL,  active_hctl);
+	DPU_REG_WRITE(c, INTF_ACTIVE_V_START_F0, active_v_start);
+	DPU_REG_WRITE(c, INTF_ACTIVE_V_END_F0, active_v_end);
+	DPU_REG_WRITE(c, INTF_BORDER_COLOR, p->border_clr);
+	DPU_REG_WRITE(c, INTF_UNDERFLOW_COLOR, p->underflow_clr);
+	DPU_REG_WRITE(c, INTF_HSYNC_SKEW, p->hsync_skew);
+	DPU_REG_WRITE(c, INTF_POLARITY_CTL, polarity_ctl);
+	DPU_REG_WRITE(c, INTF_FRAME_LINE_COUNT_EN, 0x3);
+	DPU_REG_WRITE(c, INTF_CONFIG, intf_cfg);
+	DPU_REG_WRITE(c, INTF_PANEL_FORMAT, panel_format);
+	if (ctx->cap->features & BIT(DPU_DATA_HCTL_EN)) {
+		/*
+		 * DATA_HCTL_EN controls data timing which can be different from
+		 * video timing. It is recommended to enable it for all cases, except
+		 * if compression is enabled in 1 pixel per clock mode
+		 */
+		if (!(p->compression_en && !p->wide_bus_en))
+			intf_cfg2 |= INTF_CFG2_DATA_HCTL_EN;
+
+		DPU_REG_WRITE(c, INTF_CONFIG2, intf_cfg2);
+		DPU_REG_WRITE(c, INTF_DISPLAY_DATA_HCTL, display_data_hctl);
+		DPU_REG_WRITE(c, INTF_ACTIVE_DATA_HCTL, active_data_hctl);
+	}
+}
+
+static void dpu_hw_intf_enable_timing_engine(
+		struct dpu_hw_intf *intf,
+		u8 enable)
+{
+	struct dpu_hw_blk_reg_map *c = &intf->hw;
+	/* Note: Display interface select is handled in top block hw layer */
+	DPU_REG_WRITE(c, INTF_TIMING_ENGINE_EN, enable != 0);
+}
+
+static void dpu_hw_intf_setup_prg_fetch(
+		struct dpu_hw_intf *intf,
+		const struct dpu_hw_intf_prog_fetch *fetch)
+{
+	struct dpu_hw_blk_reg_map *c = &intf->hw;
+	int fetch_enable;
+
+	/*
+	 * Fetch should always be outside the active lines. If the fetching
+	 * is programmed within active region, hardware behavior is unknown.
+	 */
+
+	fetch_enable = DPU_REG_READ(c, INTF_CONFIG);
+	if (fetch->enable) {
+		fetch_enable |= BIT(31);
+		DPU_REG_WRITE(c, INTF_PROG_FETCH_START,
+				fetch->fetch_start);
+	} else {
+		fetch_enable &= ~BIT(31);
+	}
+
+	DPU_REG_WRITE(c, INTF_CONFIG, fetch_enable);
+}
+
+static void dpu_hw_intf_bind_pingpong_blk(
+		struct dpu_hw_intf *intf,
+		const enum dpu_pingpong pp)
+{
+	struct dpu_hw_blk_reg_map *c = &intf->hw;
+	u32 mux_cfg;
+
+	mux_cfg = DPU_REG_READ(c, INTF_MUX);
+	mux_cfg &= ~0xf;
+
+	if (pp)
+		mux_cfg |= (pp - PINGPONG_0) & 0x7;
+	else
+		mux_cfg |= 0xf;
+
+	DPU_REG_WRITE(c, INTF_MUX, mux_cfg);
+}
+
+static void dpu_hw_intf_get_status(
+		struct dpu_hw_intf *intf,
+		struct dpu_hw_intf_status *s)
+{
+	struct dpu_hw_blk_reg_map *c = &intf->hw;
+	unsigned long cap = intf->cap->features;
+
+	if (cap & BIT(DPU_INTF_STATUS_SUPPORTED))
+		s->is_en = DPU_REG_READ(c, INTF_STATUS) & BIT(0);
+	else
+		s->is_en = DPU_REG_READ(c, INTF_TIMING_ENGINE_EN);
+
+	s->is_prog_fetch_en = !!(DPU_REG_READ(c, INTF_CONFIG) & BIT(31));
+	if (s->is_en) {
+		s->frame_count = DPU_REG_READ(c, INTF_FRAME_COUNT);
+		s->line_count = DPU_REG_READ(c, INTF_LINE_COUNT);
+	} else {
+		s->line_count = 0;
+		s->frame_count = 0;
+	}
+}
+
+static u32 dpu_hw_intf_get_line_count(struct dpu_hw_intf *intf)
+{
+	struct dpu_hw_blk_reg_map *c;
+
+	if (!intf)
+		return 0;
+
+	c = &intf->hw;
+
+	return DPU_REG_READ(c, INTF_LINE_COUNT);
+}
+
+static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf)
+{
+	dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, 0x1);
+}
+
+static int dpu_hw_intf_collect_misr(struct dpu_hw_intf *intf, u32 *misr_value)
+{
+	return dpu_hw_collect_misr(&intf->hw, INTF_MISR_CTRL, INTF_MISR_SIGNATURE, misr_value);
+}
+
+static int dpu_hw_intf_enable_te(struct dpu_hw_intf *intf,
+		struct dpu_hw_tear_check *te)
+{
+	struct dpu_hw_blk_reg_map *c;
+	int cfg;
+
+	if (!intf)
+		return -EINVAL;
+
+	c = &intf->hw;
+
+	cfg = BIT(19); /* VSYNC_COUNTER_EN */
+	if (te->hw_vsync_mode)
+		cfg |= BIT(20);
+
+	cfg |= te->vsync_count;
+
+	DPU_REG_WRITE(c, INTF_TEAR_SYNC_CONFIG_VSYNC, cfg);
+	DPU_REG_WRITE(c, INTF_TEAR_SYNC_CONFIG_HEIGHT, te->sync_cfg_height);
+	DPU_REG_WRITE(c, INTF_TEAR_VSYNC_INIT_VAL, te->vsync_init_val);
+	DPU_REG_WRITE(c, INTF_TEAR_RD_PTR_IRQ, te->rd_ptr_irq);
+	DPU_REG_WRITE(c, INTF_TEAR_START_POS, te->start_pos);
+	DPU_REG_WRITE(c, INTF_TEAR_SYNC_THRESH,
+			((te->sync_threshold_continue << 16) |
+			 te->sync_threshold_start));
+	DPU_REG_WRITE(c, INTF_TEAR_SYNC_WRCOUNT,
+			(te->start_pos + te->sync_threshold_start + 1));
+
+	DPU_REG_WRITE(c, INTF_TEAR_TEAR_CHECK_EN, 1);
+
+	return 0;
+}
+
+static void dpu_hw_intf_setup_autorefresh_config(struct dpu_hw_intf *intf,
+		u32 frame_count, bool enable)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 refresh_cfg;
+
+	c = &intf->hw;
+	refresh_cfg = DPU_REG_READ(c, INTF_TEAR_AUTOREFRESH_CONFIG);
+	if (enable)
+		refresh_cfg = BIT(31) | frame_count;
+	else
+		refresh_cfg &= ~BIT(31);
+
+	DPU_REG_WRITE(c, INTF_TEAR_AUTOREFRESH_CONFIG, refresh_cfg);
+}
+
+/*
+ * dpu_hw_intf_get_autorefresh_config - Get autorefresh config from HW
+ * @intf:        DPU intf structure
+ * @frame_count: Used to return the current frame count from hw
+ *
+ * Returns: True if autorefresh enabled, false if disabled.
+ */
+static bool dpu_hw_intf_get_autorefresh_config(struct dpu_hw_intf *intf,
+		u32 *frame_count)
+{
+	u32 val = DPU_REG_READ(&intf->hw, INTF_TEAR_AUTOREFRESH_CONFIG);
+
+	if (frame_count != NULL)
+		*frame_count = val & 0xffff;
+	return !!((val & BIT(31)) >> 31);
+}
+
+static int dpu_hw_intf_disable_te(struct dpu_hw_intf *intf)
+{
+	struct dpu_hw_blk_reg_map *c;
+
+	if (!intf)
+		return -EINVAL;
+
+	c = &intf->hw;
+	DPU_REG_WRITE(c, INTF_TEAR_TEAR_CHECK_EN, 0);
+	return 0;
+}
+
+static int dpu_hw_intf_connect_external_te(struct dpu_hw_intf *intf,
+		bool enable_external_te)
+{
+	struct dpu_hw_blk_reg_map *c = &intf->hw;
+	u32 cfg;
+	int orig;
+
+	if (!intf)
+		return -EINVAL;
+
+	c = &intf->hw;
+	cfg = DPU_REG_READ(c, INTF_TEAR_SYNC_CONFIG_VSYNC);
+	orig = (bool)(cfg & BIT(20));
+	if (enable_external_te)
+		cfg |= BIT(20);
+	else
+		cfg &= ~BIT(20);
+	DPU_REG_WRITE(c, INTF_TEAR_SYNC_CONFIG_VSYNC, cfg);
+	trace_dpu_intf_connect_ext_te(intf->idx - INTF_0, cfg);
+
+	return orig;
+}
+
+static int dpu_hw_intf_get_vsync_info(struct dpu_hw_intf *intf,
+		struct dpu_hw_pp_vsync_info *info)
+{
+	struct dpu_hw_blk_reg_map *c = &intf->hw;
+	u32 val;
+
+	if (!intf || !info)
+		return -EINVAL;
+
+	c = &intf->hw;
+
+	val = DPU_REG_READ(c, INTF_TEAR_VSYNC_INIT_VAL);
+	info->rd_ptr_init_val = val & 0xffff;
+
+	val = DPU_REG_READ(c, INTF_TEAR_INT_COUNT_VAL);
+	info->rd_ptr_frame_count = (val & 0xffff0000) >> 16;
+	info->rd_ptr_line_count = val & 0xffff;
+
+	val = DPU_REG_READ(c, INTF_TEAR_LINE_COUNT);
+	info->wr_ptr_line_count = val & 0xffff;
+
+	val = DPU_REG_READ(c, INTF_FRAME_COUNT);
+	info->intf_frame_count = val;
+
+	return 0;
+}
+
+static void dpu_hw_intf_vsync_sel(struct dpu_hw_intf *intf,
+		u32 vsync_source)
+{
+	struct dpu_hw_blk_reg_map *c;
+
+	if (!intf)
+		return;
+
+	c = &intf->hw;
+
+	DPU_REG_WRITE(c, INTF_TEAR_MDP_VSYNC_SEL, (vsync_source & 0xf));
+}
+
+static void dpu_hw_intf_disable_autorefresh(struct dpu_hw_intf *intf,
+					    uint32_t encoder_id, u16 vdisplay)
+{
+	struct dpu_hw_pp_vsync_info info;
+	int trial = 0;
+
+	/* If autorefresh is already disabled, we have nothing to do */
+	if (!dpu_hw_intf_get_autorefresh_config(intf, NULL))
+		return;
+
+	/*
+	 * If autorefresh is enabled, disable it and make sure it is safe to
+	 * proceed with current frame commit/push. Sequence followed is,
+	 * 1. Disable TE
+	 * 2. Disable autorefresh config
+	 * 4. Poll for frame transfer ongoing to be false
+	 * 5. Enable TE back
+	 */
+
+	dpu_hw_intf_connect_external_te(intf, false);
+	dpu_hw_intf_setup_autorefresh_config(intf, 0, false);
+
+	do {
+		udelay(DPU_ENC_MAX_POLL_TIMEOUT_US);
+		if ((trial * DPU_ENC_MAX_POLL_TIMEOUT_US)
+				> (KICKOFF_TIMEOUT_MS * USEC_PER_MSEC)) {
+			DPU_ERROR("enc%d intf%d disable autorefresh failed\n",
+				  encoder_id, intf->idx - INTF_0);
+			break;
+		}
+
+		trial++;
+
+		dpu_hw_intf_get_vsync_info(intf, &info);
+	} while (info.wr_ptr_line_count > 0 &&
+		 info.wr_ptr_line_count < vdisplay);
+
+	dpu_hw_intf_connect_external_te(intf, true);
+
+	DPU_DEBUG("enc%d intf%d disabled autorefresh\n",
+		  encoder_id, intf->idx - INTF_0);
+
+}
+
+static void dpu_hw_intf_program_intf_cmd_cfg(struct dpu_hw_intf *ctx,
+					     struct dpu_hw_intf_cmd_mode_cfg *cmd_mode_cfg)
+{
+	u32 intf_cfg2 = DPU_REG_READ(&ctx->hw, INTF_CONFIG2);
+
+	if (cmd_mode_cfg->data_compress)
+		intf_cfg2 |= INTF_CFG2_DCE_DATA_COMPRESS;
+
+	if (cmd_mode_cfg->wide_bus_en)
+		intf_cfg2 |= INTF_CFG2_DATABUS_WIDEN;
+
+	DPU_REG_WRITE(&ctx->hw, INTF_CONFIG2, intf_cfg2);
+}
+
+struct dpu_hw_intf *dpu_hw_intf_init(struct drm_device *dev,
+				     const struct dpu_intf_cfg *cfg,
+				     void __iomem *addr,
+				     const struct dpu_mdss_version *mdss_rev)
+{
+	struct dpu_hw_intf *c;
+
+	if (cfg->type == INTF_NONE) {
+		DPU_DEBUG("Skip intf %d with type NONE\n", cfg->id - INTF_0);
+		return NULL;
+	}
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_INTF;
+
+	/*
+	 * Assign ops
+	 */
+	c->idx = cfg->id;
+	c->cap = cfg;
+
+	c->ops.setup_timing_gen = dpu_hw_intf_setup_timing_engine;
+	c->ops.setup_prg_fetch  = dpu_hw_intf_setup_prg_fetch;
+	c->ops.get_status = dpu_hw_intf_get_status;
+	c->ops.enable_timing = dpu_hw_intf_enable_timing_engine;
+	c->ops.get_line_count = dpu_hw_intf_get_line_count;
+	c->ops.setup_misr = dpu_hw_intf_setup_misr;
+	c->ops.collect_misr = dpu_hw_intf_collect_misr;
+
+	if (cfg->features & BIT(DPU_INTF_INPUT_CTRL))
+		c->ops.bind_pingpong_blk = dpu_hw_intf_bind_pingpong_blk;
+
+	/* INTF TE is only for DSI interfaces */
+	if (mdss_rev->core_major_ver >= 5 && cfg->type == INTF_DSI) {
+		WARN_ON(!cfg->intr_tear_rd_ptr);
+
+		c->ops.enable_tearcheck = dpu_hw_intf_enable_te;
+		c->ops.disable_tearcheck = dpu_hw_intf_disable_te;
+		c->ops.connect_external_te = dpu_hw_intf_connect_external_te;
+		c->ops.vsync_sel = dpu_hw_intf_vsync_sel;
+		c->ops.disable_autorefresh = dpu_hw_intf_disable_autorefresh;
+	}
+
+	/* Technically, INTF_CONFIG2 is present for DPU 5.0+, but
+	 * we can configure it for DPU 7.0+ since the wide bus and DSC flags
+	 * would not be set for DPU < 7.0 anyways
+	 */
+	if (mdss_rev->core_major_ver >= 7)
+		c->ops.program_intf_cmd_cfg = dpu_hw_intf_program_intf_cmd_cfg;
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_intf.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_intf.h
@@ -0,0 +1,145 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_INTF_H
+#define _DPU_HW_INTF_H
+
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+
+struct dpu_hw_intf;
+
+/* intf timing settings */
+struct dpu_hw_intf_timing_params {
+	u32 width;		/* active width */
+	u32 height;		/* active height */
+	u32 xres;		/* Display panel width */
+	u32 yres;		/* Display panel height */
+
+	u32 h_back_porch;
+	u32 h_front_porch;
+	u32 v_back_porch;
+	u32 v_front_porch;
+	u32 hsync_pulse_width;
+	u32 vsync_pulse_width;
+	u32 hsync_polarity;
+	u32 vsync_polarity;
+	u32 border_clr;
+	u32 underflow_clr;
+	u32 hsync_skew;
+
+	bool wide_bus_en;
+	bool compression_en;
+};
+
+struct dpu_hw_intf_prog_fetch {
+	u8 enable;
+	/* vsync counter for the front porch pixel line */
+	u32 fetch_start;
+};
+
+struct dpu_hw_intf_status {
+	u8 is_en;		/* interface timing engine is enabled or not */
+	u8 is_prog_fetch_en;	/* interface prog fetch counter is enabled or not */
+	u32 frame_count;	/* frame count since timing engine enabled */
+	u32 line_count;		/* current line count including blanking */
+};
+
+struct dpu_hw_intf_cmd_mode_cfg {
+	u8 data_compress;	/* enable data compress between dpu and dsi */
+	u8 wide_bus_en;		/* enable databus widen mode */
+};
+
+/**
+ * struct dpu_hw_intf_ops : Interface to the interface Hw driver functions
+ *  Assumption is these functions will be called after clocks are enabled
+ * @ setup_timing_gen : programs the timing engine
+ * @ setup_prog_fetch : enables/disables the programmable fetch logic
+ * @ enable_timing: enable/disable timing engine
+ * @ get_status: returns if timing engine is enabled or not
+ * @ get_line_count: reads current vertical line counter
+ * @bind_pingpong_blk: enable/disable the connection with pingpong which will
+ *                     feed pixels to this interface
+ * @setup_misr: enable/disable MISR
+ * @collect_misr: read MISR signature
+ * @enable_tearcheck:           Enables vsync generation and sets up init value of read
+ *                              pointer and programs the tear check configuration
+ * @disable_tearcheck:          Disables tearcheck block
+ * @connect_external_te:        Read, modify, write to either set or clear listening to external TE
+ *                              Return: 1 if TE was originally connected, 0 if not, or -ERROR
+ * @get_vsync_info:             Provides the programmed and current line_count
+ * @setup_autorefresh:          Configure and enable the autorefresh config
+ * @get_autorefresh:            Retrieve autorefresh config from hardware
+ *                              Return: 0 on success, -ETIMEDOUT on timeout
+ * @vsync_sel:                  Select vsync signal for tear-effect configuration
+ * @program_intf_cmd_cfg:       Program the DPU to interface datapath for command mode
+ */
+struct dpu_hw_intf_ops {
+	void (*setup_timing_gen)(struct dpu_hw_intf *intf,
+			const struct dpu_hw_intf_timing_params *p,
+			const struct dpu_format *fmt);
+
+	void (*setup_prg_fetch)(struct dpu_hw_intf *intf,
+			const struct dpu_hw_intf_prog_fetch *fetch);
+
+	void (*enable_timing)(struct dpu_hw_intf *intf,
+			u8 enable);
+
+	void (*get_status)(struct dpu_hw_intf *intf,
+			struct dpu_hw_intf_status *status);
+
+	u32 (*get_line_count)(struct dpu_hw_intf *intf);
+
+	void (*bind_pingpong_blk)(struct dpu_hw_intf *intf,
+			const enum dpu_pingpong pp);
+	void (*setup_misr)(struct dpu_hw_intf *intf);
+	int (*collect_misr)(struct dpu_hw_intf *intf, u32 *misr_value);
+
+	// Tearcheck on INTF since DPU 5.0.0
+
+	int (*enable_tearcheck)(struct dpu_hw_intf *intf, struct dpu_hw_tear_check *cfg);
+
+	int (*disable_tearcheck)(struct dpu_hw_intf *intf);
+
+	int (*connect_external_te)(struct dpu_hw_intf *intf, bool enable_external_te);
+
+	void (*vsync_sel)(struct dpu_hw_intf *intf, u32 vsync_source);
+
+	/**
+	 * Disable autorefresh if enabled
+	 */
+	void (*disable_autorefresh)(struct dpu_hw_intf *intf, uint32_t encoder_id, u16 vdisplay);
+
+	void (*program_intf_cmd_cfg)(struct dpu_hw_intf *intf,
+				     struct dpu_hw_intf_cmd_mode_cfg *cmd_mode_cfg);
+};
+
+struct dpu_hw_intf {
+	struct dpu_hw_blk_reg_map hw;
+
+	/* intf */
+	enum dpu_intf idx;
+	const struct dpu_intf_cfg *cap;
+
+	/* ops */
+	struct dpu_hw_intf_ops ops;
+};
+
+/**
+ * dpu_hw_intf_init() - Initializes the INTF driver for the passed
+ * interface catalog entry.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  interface catalog entry for which driver object is required
+ * @addr: mapped register io address of MDP
+ * @mdss_rev: dpu core's major and minor versions
+ */
+struct dpu_hw_intf *dpu_hw_intf_init(struct drm_device *dev,
+				     const struct dpu_intf_cfg *cfg,
+				     void __iomem *addr,
+				     const struct dpu_mdss_version *mdss_rev);
+
+#endif /*_DPU_HW_INTF_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_lm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_lm.c
@@ -0,0 +1,185 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <drm/drm_managed.h>
+
+#include "dpu_kms.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hwio.h"
+#include "dpu_hw_lm.h"
+#include "dpu_hw_mdss.h"
+
+#define LM_OP_MODE                        0x00
+#define LM_OUT_SIZE                       0x04
+#define LM_BORDER_COLOR_0                 0x08
+#define LM_BORDER_COLOR_1                 0x010
+
+/* These register are offset to mixer base + stage base */
+#define LM_BLEND0_OP                     0x00
+#define LM_BLEND0_CONST_ALPHA            0x04
+#define LM_FG_COLOR_FILL_COLOR_0         0x08
+#define LM_FG_COLOR_FILL_COLOR_1         0x0C
+#define LM_FG_COLOR_FILL_SIZE            0x10
+#define LM_FG_COLOR_FILL_XY              0x14
+
+#define LM_BLEND0_FG_ALPHA               0x04
+#define LM_BLEND0_BG_ALPHA               0x08
+
+#define LM_MISR_CTRL                     0x310
+#define LM_MISR_SIGNATURE                0x314
+
+
+/**
+ * _stage_offset(): returns the relative offset of the blend registers
+ * for the stage to be setup
+ * @ctx:     mixer ctx contains the mixer to be programmed
+ * @stage: stage index to setup
+ */
+static inline int _stage_offset(struct dpu_hw_mixer *ctx, enum dpu_stage stage)
+{
+	const struct dpu_lm_sub_blks *sblk = ctx->cap->sblk;
+	if (stage != DPU_STAGE_BASE && stage <= sblk->maxblendstages)
+		return sblk->blendstage_base[stage - DPU_STAGE_0];
+
+	return -EINVAL;
+}
+
+static void dpu_hw_lm_setup_out(struct dpu_hw_mixer *ctx,
+		struct dpu_hw_mixer_cfg *mixer)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	u32 outsize;
+	u32 op_mode;
+
+	op_mode = DPU_REG_READ(c, LM_OP_MODE);
+
+	outsize = mixer->out_height << 16 | mixer->out_width;
+	DPU_REG_WRITE(c, LM_OUT_SIZE, outsize);
+
+	/* SPLIT_LEFT_RIGHT */
+	if (mixer->right_mixer)
+		op_mode |= BIT(31);
+	else
+		op_mode &= ~BIT(31);
+	DPU_REG_WRITE(c, LM_OP_MODE, op_mode);
+}
+
+static void dpu_hw_lm_setup_border_color(struct dpu_hw_mixer *ctx,
+		struct dpu_mdss_color *color,
+		u8 border_en)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+
+	if (border_en) {
+		DPU_REG_WRITE(c, LM_BORDER_COLOR_0,
+			(color->color_0 & 0xFFF) |
+			((color->color_1 & 0xFFF) << 0x10));
+		DPU_REG_WRITE(c, LM_BORDER_COLOR_1,
+			(color->color_2 & 0xFFF) |
+			((color->color_3 & 0xFFF) << 0x10));
+	}
+}
+
+static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx)
+{
+	dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, 0x0);
+}
+
+static int dpu_hw_lm_collect_misr(struct dpu_hw_mixer *ctx, u32 *misr_value)
+{
+	return dpu_hw_collect_misr(&ctx->hw, LM_MISR_CTRL, LM_MISR_SIGNATURE, misr_value);
+}
+
+static void dpu_hw_lm_setup_blend_config_combined_alpha(struct dpu_hw_mixer *ctx,
+	u32 stage, u32 fg_alpha, u32 bg_alpha, u32 blend_op)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	int stage_off;
+	u32 const_alpha;
+
+	if (stage == DPU_STAGE_BASE)
+		return;
+
+	stage_off = _stage_offset(ctx, stage);
+	if (WARN_ON(stage_off < 0))
+		return;
+
+	const_alpha = (bg_alpha & 0xFF) | ((fg_alpha & 0xFF) << 16);
+	DPU_REG_WRITE(c, LM_BLEND0_CONST_ALPHA + stage_off, const_alpha);
+	DPU_REG_WRITE(c, LM_BLEND0_OP + stage_off, blend_op);
+}
+
+static void dpu_hw_lm_setup_blend_config(struct dpu_hw_mixer *ctx,
+	u32 stage, u32 fg_alpha, u32 bg_alpha, u32 blend_op)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	int stage_off;
+
+	if (stage == DPU_STAGE_BASE)
+		return;
+
+	stage_off = _stage_offset(ctx, stage);
+	if (WARN_ON(stage_off < 0))
+		return;
+
+	DPU_REG_WRITE(c, LM_BLEND0_FG_ALPHA + stage_off, fg_alpha);
+	DPU_REG_WRITE(c, LM_BLEND0_BG_ALPHA + stage_off, bg_alpha);
+	DPU_REG_WRITE(c, LM_BLEND0_OP + stage_off, blend_op);
+}
+
+static void dpu_hw_lm_setup_color3(struct dpu_hw_mixer *ctx,
+	uint32_t mixer_op_mode)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	int op_mode;
+
+	/* read the existing op_mode configuration */
+	op_mode = DPU_REG_READ(c, LM_OP_MODE);
+
+	op_mode = (op_mode & (BIT(31) | BIT(30))) | mixer_op_mode;
+
+	DPU_REG_WRITE(c, LM_OP_MODE, op_mode);
+}
+
+static void _setup_mixer_ops(struct dpu_hw_lm_ops *ops,
+		unsigned long features)
+{
+	ops->setup_mixer_out = dpu_hw_lm_setup_out;
+	if (test_bit(DPU_MIXER_COMBINED_ALPHA, &features))
+		ops->setup_blend_config = dpu_hw_lm_setup_blend_config_combined_alpha;
+	else
+		ops->setup_blend_config = dpu_hw_lm_setup_blend_config;
+	ops->setup_alpha_out = dpu_hw_lm_setup_color3;
+	ops->setup_border_color = dpu_hw_lm_setup_border_color;
+	ops->setup_misr = dpu_hw_lm_setup_misr;
+	ops->collect_misr = dpu_hw_lm_collect_misr;
+}
+
+struct dpu_hw_mixer *dpu_hw_lm_init(struct drm_device *dev,
+				    const struct dpu_lm_cfg *cfg,
+				    void __iomem *addr)
+{
+	struct dpu_hw_mixer *c;
+
+	if (cfg->pingpong == PINGPONG_NONE) {
+		DPU_DEBUG("skip mixer %d without pingpong\n", cfg->id);
+		return NULL;
+	}
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_LM;
+
+	/* Assign ops */
+	c->idx = cfg->id;
+	c->cap = cfg;
+	_setup_mixer_ops(&c->ops, c->cap->features);
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_lm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_lm.h
@@ -0,0 +1,107 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_LM_H
+#define _DPU_HW_LM_H
+
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+
+struct dpu_hw_mixer;
+
+struct dpu_hw_mixer_cfg {
+	u32 out_width;
+	u32 out_height;
+	bool right_mixer;
+	int flags;
+};
+
+struct dpu_hw_color3_cfg {
+	u8 keep_fg[DPU_STAGE_MAX];
+};
+
+/**
+ *
+ * struct dpu_hw_lm_ops : Interface to the mixer Hw driver functions
+ *  Assumption is these functions will be called after clocks are enabled
+ */
+struct dpu_hw_lm_ops {
+	/*
+	 * Sets up mixer output width and height
+	 * and border color if enabled
+	 */
+	void (*setup_mixer_out)(struct dpu_hw_mixer *ctx,
+		struct dpu_hw_mixer_cfg *cfg);
+
+	/*
+	 * Alpha blending configuration
+	 * for the specified stage
+	 */
+	void (*setup_blend_config)(struct dpu_hw_mixer *ctx, uint32_t stage,
+		uint32_t fg_alpha, uint32_t bg_alpha, uint32_t blend_op);
+
+	/*
+	 * Alpha color component selection from either fg or bg
+	 */
+	void (*setup_alpha_out)(struct dpu_hw_mixer *ctx, uint32_t mixer_op);
+
+	/**
+	 * setup_border_color : enable/disable border color
+	 */
+	void (*setup_border_color)(struct dpu_hw_mixer *ctx,
+		struct dpu_mdss_color *color,
+		u8 border_en);
+
+	/**
+	 * setup_misr: Enable/disable MISR
+	 */
+	void (*setup_misr)(struct dpu_hw_mixer *ctx);
+
+	/**
+	 * collect_misr: Read MISR signature
+	 */
+	int (*collect_misr)(struct dpu_hw_mixer *ctx, u32 *misr_value);
+};
+
+struct dpu_hw_mixer {
+	struct dpu_hw_blk base;
+	struct dpu_hw_blk_reg_map hw;
+
+	/* lm */
+	enum dpu_lm  idx;
+	const struct dpu_lm_cfg   *cap;
+	const struct dpu_mdp_cfg  *mdp;
+	const struct dpu_ctl_cfg  *ctl;
+
+	/* ops */
+	struct dpu_hw_lm_ops ops;
+
+	/* store mixer info specific to display */
+	struct dpu_hw_mixer_cfg cfg;
+};
+
+/**
+ * to_dpu_hw_mixer - convert base object dpu_hw_base to container
+ * @hw: Pointer to base hardware block
+ * return: Pointer to hardware block container
+ */
+static inline struct dpu_hw_mixer *to_dpu_hw_mixer(struct dpu_hw_blk *hw)
+{
+	return container_of(hw, struct dpu_hw_mixer, base);
+}
+
+/**
+ * dpu_hw_lm_init() - Initializes the mixer hw driver object.
+ * should be called once before accessing every mixer.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  mixer catalog entry for which driver object is required
+ * @addr: mapped register io address of MDP
+ */
+struct dpu_hw_mixer *dpu_hw_lm_init(struct drm_device *dev,
+				    const struct dpu_lm_cfg *cfg,
+				    void __iomem *addr);
+
+#endif /*_DPU_HW_LM_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_mdss.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_mdss.h
@@ -0,0 +1,520 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_MDSS_H
+#define _DPU_HW_MDSS_H
+
+#include <linux/kernel.h>
+#include <linux/err.h>
+
+#include "msm_drv.h"
+
+#define DPU_DBG_NAME			"dpu"
+
+#define DPU_NONE                        0
+
+#ifndef DPU_CSC_MATRIX_COEFF_SIZE
+#define DPU_CSC_MATRIX_COEFF_SIZE	9
+#endif
+
+#ifndef DPU_CSC_CLAMP_SIZE
+#define DPU_CSC_CLAMP_SIZE		6
+#endif
+
+#ifndef DPU_CSC_BIAS_SIZE
+#define DPU_CSC_BIAS_SIZE		3
+#endif
+
+#ifndef DPU_MAX_PLANES
+#define DPU_MAX_PLANES			4
+#endif
+
+#define PIPES_PER_STAGE			2
+#ifndef DPU_MAX_DE_CURVES
+#define DPU_MAX_DE_CURVES		3
+#endif
+
+enum dpu_format_flags {
+	DPU_FORMAT_FLAG_YUV_BIT,
+	DPU_FORMAT_FLAG_DX_BIT,
+	DPU_FORMAT_FLAG_COMPRESSED_BIT,
+	DPU_FORMAT_FLAG_BIT_MAX,
+};
+
+#define DPU_FORMAT_FLAG_YUV		BIT(DPU_FORMAT_FLAG_YUV_BIT)
+#define DPU_FORMAT_FLAG_DX		BIT(DPU_FORMAT_FLAG_DX_BIT)
+#define DPU_FORMAT_FLAG_COMPRESSED	BIT(DPU_FORMAT_FLAG_COMPRESSED_BIT)
+#define DPU_FORMAT_IS_YUV(X)		\
+	(test_bit(DPU_FORMAT_FLAG_YUV_BIT, (X)->flag))
+#define DPU_FORMAT_IS_DX(X)		\
+	(test_bit(DPU_FORMAT_FLAG_DX_BIT, (X)->flag))
+#define DPU_FORMAT_IS_LINEAR(X)		((X)->fetch_mode == DPU_FETCH_LINEAR)
+#define DPU_FORMAT_IS_TILE(X) \
+	(((X)->fetch_mode == DPU_FETCH_UBWC) && \
+			!test_bit(DPU_FORMAT_FLAG_COMPRESSED_BIT, (X)->flag))
+#define DPU_FORMAT_IS_UBWC(X) \
+	(((X)->fetch_mode == DPU_FETCH_UBWC) && \
+			test_bit(DPU_FORMAT_FLAG_COMPRESSED_BIT, (X)->flag))
+
+#define DPU_BLEND_FG_ALPHA_FG_CONST	(0 << 0)
+#define DPU_BLEND_FG_ALPHA_BG_CONST	(1 << 0)
+#define DPU_BLEND_FG_ALPHA_FG_PIXEL	(2 << 0)
+#define DPU_BLEND_FG_ALPHA_BG_PIXEL	(3 << 0)
+#define DPU_BLEND_FG_INV_ALPHA		(1 << 2)
+#define DPU_BLEND_FG_MOD_ALPHA		(1 << 3)
+#define DPU_BLEND_FG_INV_MOD_ALPHA	(1 << 4)
+#define DPU_BLEND_FG_TRANSP_EN		(1 << 5)
+#define DPU_BLEND_BG_ALPHA_FG_CONST	(0 << 8)
+#define DPU_BLEND_BG_ALPHA_BG_CONST	(1 << 8)
+#define DPU_BLEND_BG_ALPHA_FG_PIXEL	(2 << 8)
+#define DPU_BLEND_BG_ALPHA_BG_PIXEL	(3 << 8)
+#define DPU_BLEND_BG_INV_ALPHA		(1 << 10)
+#define DPU_BLEND_BG_MOD_ALPHA		(1 << 11)
+#define DPU_BLEND_BG_INV_MOD_ALPHA	(1 << 12)
+#define DPU_BLEND_BG_TRANSP_EN		(1 << 13)
+
+#define DPU_VSYNC0_SOURCE_GPIO		0
+#define DPU_VSYNC1_SOURCE_GPIO		1
+#define DPU_VSYNC2_SOURCE_GPIO		2
+#define DPU_VSYNC_SOURCE_INTF_0		3
+#define DPU_VSYNC_SOURCE_INTF_1		4
+#define DPU_VSYNC_SOURCE_INTF_2		5
+#define DPU_VSYNC_SOURCE_INTF_3		6
+#define DPU_VSYNC_SOURCE_WD_TIMER_4	11
+#define DPU_VSYNC_SOURCE_WD_TIMER_3	12
+#define DPU_VSYNC_SOURCE_WD_TIMER_2	13
+#define DPU_VSYNC_SOURCE_WD_TIMER_1	14
+#define DPU_VSYNC_SOURCE_WD_TIMER_0	15
+
+enum dpu_hw_blk_type {
+	DPU_HW_BLK_TOP = 0,
+	DPU_HW_BLK_SSPP,
+	DPU_HW_BLK_LM,
+	DPU_HW_BLK_CTL,
+	DPU_HW_BLK_PINGPONG,
+	DPU_HW_BLK_INTF,
+	DPU_HW_BLK_WB,
+	DPU_HW_BLK_DSPP,
+	DPU_HW_BLK_MERGE_3D,
+	DPU_HW_BLK_DSC,
+	DPU_HW_BLK_CDM,
+	DPU_HW_BLK_MAX,
+};
+
+enum dpu_sspp {
+	SSPP_NONE,
+	SSPP_VIG0,
+	SSPP_VIG1,
+	SSPP_VIG2,
+	SSPP_VIG3,
+	SSPP_RGB0,
+	SSPP_RGB1,
+	SSPP_RGB2,
+	SSPP_RGB3,
+	SSPP_DMA0,
+	SSPP_DMA1,
+	SSPP_DMA2,
+	SSPP_DMA3,
+	SSPP_DMA4,
+	SSPP_DMA5,
+	SSPP_CURSOR0,
+	SSPP_CURSOR1,
+	SSPP_MAX
+};
+
+enum dpu_sspp_type {
+	SSPP_TYPE_VIG,
+	SSPP_TYPE_RGB,
+	SSPP_TYPE_DMA,
+	SSPP_TYPE_CURSOR,
+	SSPP_TYPE_MAX
+};
+
+enum dpu_lm {
+	LM_0 = 1,
+	LM_1,
+	LM_2,
+	LM_3,
+	LM_4,
+	LM_5,
+	LM_6,
+	LM_MAX
+};
+
+enum dpu_stage {
+	DPU_STAGE_BASE = 0,
+	DPU_STAGE_0,
+	DPU_STAGE_1,
+	DPU_STAGE_2,
+	DPU_STAGE_3,
+	DPU_STAGE_4,
+	DPU_STAGE_5,
+	DPU_STAGE_6,
+	DPU_STAGE_7,
+	DPU_STAGE_8,
+	DPU_STAGE_9,
+	DPU_STAGE_10,
+	DPU_STAGE_MAX
+};
+enum dpu_dspp {
+	DSPP_0 = 1,
+	DSPP_1,
+	DSPP_2,
+	DSPP_3,
+	DSPP_MAX
+};
+
+enum dpu_ctl {
+	CTL_0 = 1,
+	CTL_1,
+	CTL_2,
+	CTL_3,
+	CTL_4,
+	CTL_5,
+	CTL_MAX
+};
+
+enum dpu_dsc {
+	DSC_NONE = 0,
+	DSC_0,
+	DSC_1,
+	DSC_2,
+	DSC_3,
+	DSC_4,
+	DSC_5,
+	DSC_MAX
+};
+
+enum dpu_cdm {
+	CDM_0 = 1,
+	CDM_MAX
+};
+
+enum dpu_pingpong {
+	PINGPONG_NONE,
+	PINGPONG_0,
+	PINGPONG_1,
+	PINGPONG_2,
+	PINGPONG_3,
+	PINGPONG_4,
+	PINGPONG_5,
+	PINGPONG_6,
+	PINGPONG_7,
+	PINGPONG_8,
+	PINGPONG_9,
+	PINGPONG_S0,
+	PINGPONG_MAX
+};
+
+enum dpu_merge_3d {
+	MERGE_3D_0 = 1,
+	MERGE_3D_1,
+	MERGE_3D_2,
+	MERGE_3D_3,
+	MERGE_3D_4,
+	MERGE_3D_MAX
+};
+
+enum dpu_intf {
+	INTF_0 = 1,
+	INTF_1,
+	INTF_2,
+	INTF_3,
+	INTF_4,
+	INTF_5,
+	INTF_6,
+	INTF_7,
+	INTF_8,
+	INTF_MAX
+};
+
+/*
+ * Historically these values correspond to the values written to the
+ * DISP_INTF_SEL register, which had to programmed manually. On newer MDP
+ * generations this register is NOP, but we keep the values for historical
+ * reasons.
+ */
+enum dpu_intf_type {
+	INTF_NONE = 0x0,
+	INTF_DSI = 0x1,
+	INTF_HDMI = 0x3,
+	INTF_LCDC = 0x5,
+	/* old eDP found on 8x74 and 8x84 */
+	INTF_EDP = 0x9,
+	/* both DP and eDP,  handled by the new DP driver */
+	INTF_DP = 0xa,
+
+	/* virtual interfaces */
+	INTF_WB = 0x100,
+};
+
+enum dpu_intf_mode {
+	INTF_MODE_NONE = 0,
+	INTF_MODE_CMD,
+	INTF_MODE_VIDEO,
+	INTF_MODE_WB_BLOCK,
+	INTF_MODE_WB_LINE,
+	INTF_MODE_MAX
+};
+
+enum dpu_wb {
+	WB_0 = 1,
+	WB_1,
+	WB_2,
+	WB_3,
+	WB_MAX
+};
+
+enum dpu_cwb {
+	CWB_0 = 0x1,
+	CWB_1,
+	CWB_2,
+	CWB_3,
+	CWB_MAX
+};
+
+enum dpu_wd_timer {
+	WD_TIMER_0 = 0x1,
+	WD_TIMER_1,
+	WD_TIMER_2,
+	WD_TIMER_3,
+	WD_TIMER_4,
+	WD_TIMER_5,
+	WD_TIMER_MAX
+};
+
+enum dpu_vbif {
+	VBIF_RT,
+	VBIF_NRT,
+	VBIF_MAX,
+};
+
+/**
+ * DPU HW,Component order color map
+ */
+enum {
+	C0_G_Y = 0,
+	C1_B_Cb = 1,
+	C2_R_Cr = 2,
+	C3_ALPHA = 3
+};
+
+/**
+ * enum dpu_plane_type - defines how the color component pixel packing
+ * @DPU_PLANE_INTERLEAVED   : Color components in single plane
+ * @DPU_PLANE_PLANAR        : Color component in separate planes
+ * @DPU_PLANE_PSEUDO_PLANAR : Chroma components interleaved in separate plane
+ */
+enum dpu_plane_type {
+	DPU_PLANE_INTERLEAVED,
+	DPU_PLANE_PLANAR,
+	DPU_PLANE_PSEUDO_PLANAR,
+};
+
+/**
+ * enum dpu_chroma_samp_type - chroma sub-samplng type
+ * @DPU_CHROMA_RGB   : No chroma subsampling
+ * @DPU_CHROMA_H2V1  : Chroma pixels are horizontally subsampled
+ * @DPU_CHROMA_H1V2  : Chroma pixels are vertically subsampled
+ * @DPU_CHROMA_420   : 420 subsampling
+ */
+enum dpu_chroma_samp_type {
+	DPU_CHROMA_RGB,
+	DPU_CHROMA_H2V1,
+	DPU_CHROMA_H1V2,
+	DPU_CHROMA_420
+};
+
+/**
+ * dpu_fetch_type - Defines How DPU HW fetches data
+ * @DPU_FETCH_LINEAR   : fetch is line by line
+ * @DPU_FETCH_TILE     : fetches data in Z order from a tile
+ * @DPU_FETCH_UBWC     : fetch and decompress data
+ */
+enum dpu_fetch_type {
+	DPU_FETCH_LINEAR,
+	DPU_FETCH_TILE,
+	DPU_FETCH_UBWC
+};
+
+/**
+ * Value of enum chosen to fit the number of bits
+ * expected by the HW programming.
+ */
+enum {
+	COLOR_ALPHA_1BIT = 0,
+	COLOR_ALPHA_4BIT = 1,
+	COLOR_4BIT = 0,
+	COLOR_5BIT = 1, /* No 5-bit Alpha */
+	COLOR_6BIT = 2, /* 6-Bit Alpha also = 2 */
+	COLOR_8BIT = 3, /* 8-Bit Alpha also = 3 */
+};
+
+/**
+ * enum dpu_3d_blend_mode
+ * Desribes how the 3d data is blended
+ * @BLEND_3D_NONE      : 3d blending not enabled
+ * @BLEND_3D_FRAME_INT : Frame interleaving
+ * @BLEND_3D_H_ROW_INT : Horizontal row interleaving
+ * @BLEND_3D_V_ROW_INT : vertical row interleaving
+ * @BLEND_3D_COL_INT   : column interleaving
+ * @BLEND_3D_MAX       :
+ */
+enum dpu_3d_blend_mode {
+	BLEND_3D_NONE = 0,
+	BLEND_3D_FRAME_INT,
+	BLEND_3D_H_ROW_INT,
+	BLEND_3D_V_ROW_INT,
+	BLEND_3D_COL_INT,
+	BLEND_3D_MAX
+};
+
+/** struct dpu_format - defines the format configuration which
+ * allows DPU HW to correctly fetch and decode the format
+ * @base: base msm_format structure containing fourcc code
+ * @fetch_planes: how the color components are packed in pixel format
+ * @element: element color ordering
+ * @bits: element bit widths
+ * @chroma_sample: chroma sub-samplng type
+ * @unpack_align_msb: unpack aligned, 0 to LSB, 1 to MSB
+ * @unpack_tight: 0 for loose, 1 for tight
+ * @unpack_count: 0 = 1 component, 1 = 2 component
+ * @bpp: bytes per pixel
+ * @alpha_enable: whether the format has an alpha channel
+ * @num_planes: number of planes (including meta data planes)
+ * @fetch_mode: linear, tiled, or ubwc hw fetch behavior
+ * @flag: usage bit flags
+ * @tile_width: format tile width
+ * @tile_height: format tile height
+ */
+struct dpu_format {
+	struct msm_format base;
+	enum dpu_plane_type fetch_planes;
+	u8 element[DPU_MAX_PLANES];
+	u8 bits[DPU_MAX_PLANES];
+	enum dpu_chroma_samp_type chroma_sample;
+	u8 unpack_align_msb;
+	u8 unpack_tight;
+	u8 unpack_count;
+	u8 bpp;
+	u8 alpha_enable;
+	u8 num_planes;
+	enum dpu_fetch_type fetch_mode;
+	DECLARE_BITMAP(flag, DPU_FORMAT_FLAG_BIT_MAX);
+	u16 tile_width;
+	u16 tile_height;
+};
+#define to_dpu_format(x) container_of(x, struct dpu_format, base)
+
+/**
+ * struct dpu_hw_fmt_layout - format information of the source pixel data
+ * @format: pixel format parameters
+ * @num_planes: number of planes (including meta data planes)
+ * @width: image width
+ * @height: image height
+ * @total_size: total size in bytes
+ * @plane_addr: address of each plane
+ * @plane_size: length of each plane
+ * @plane_pitch: pitch of each plane
+ */
+struct dpu_hw_fmt_layout {
+	const struct dpu_format *format;
+	uint32_t num_planes;
+	uint32_t width;
+	uint32_t height;
+	uint32_t total_size;
+	uint32_t plane_addr[DPU_MAX_PLANES];
+	uint32_t plane_size[DPU_MAX_PLANES];
+	uint32_t plane_pitch[DPU_MAX_PLANES];
+};
+
+struct dpu_csc_cfg {
+	/* matrix coefficients in S15.16 format */
+	uint32_t csc_mv[DPU_CSC_MATRIX_COEFF_SIZE];
+	uint32_t csc_pre_bv[DPU_CSC_BIAS_SIZE];
+	uint32_t csc_post_bv[DPU_CSC_BIAS_SIZE];
+	uint32_t csc_pre_lv[DPU_CSC_CLAMP_SIZE];
+	uint32_t csc_post_lv[DPU_CSC_CLAMP_SIZE];
+};
+
+/**
+ * struct dpu_mdss_color - mdss color description
+ * color 0 : green
+ * color 1 : blue
+ * color 2 : red
+ * color 3 : alpha
+ */
+struct dpu_mdss_color {
+	u32 color_0;
+	u32 color_1;
+	u32 color_2;
+	u32 color_3;
+};
+
+/*
+ * Define bit masks for h/w logging.
+ */
+#define DPU_DBG_MASK_NONE     (1 << 0)
+#define DPU_DBG_MASK_INTF     (1 << 1)
+#define DPU_DBG_MASK_LM       (1 << 2)
+#define DPU_DBG_MASK_CTL      (1 << 3)
+#define DPU_DBG_MASK_PINGPONG (1 << 4)
+#define DPU_DBG_MASK_SSPP     (1 << 5)
+#define DPU_DBG_MASK_WB       (1 << 6)
+#define DPU_DBG_MASK_TOP      (1 << 7)
+#define DPU_DBG_MASK_VBIF     (1 << 8)
+#define DPU_DBG_MASK_ROT      (1 << 9)
+#define DPU_DBG_MASK_DSPP     (1 << 10)
+#define DPU_DBG_MASK_DSC      (1 << 11)
+#define DPU_DBG_MASK_CDM      (1 << 12)
+
+/**
+ * struct dpu_hw_tear_check - Struct contains parameters to configure
+ * tear-effect module. This structure is used to configure tear-check
+ * logic present either in ping-pong or in interface module.
+ * @vsync_count:        Ratio of MDP VSYNC clk freq(Hz) to refresh rate divided
+ *                      by no of lines
+ * @sync_cfg_height:    Total vertical lines (display height - 1)
+ * @vsync_init_val:     Init value to which the read pointer gets loaded at
+ *                      vsync edge
+ * @sync_threshold_start:    Read pointer threshold start ROI for write operation
+ * @sync_threshold_continue: The minimum number of lines the write pointer
+ *                           needs to be above the read pointer
+ * @start_pos:          The position from which the start_threshold value is added
+ * @rd_ptr_irq:         The read pointer line at which interrupt has to be generated
+ * @hw_vsync_mode:      Sync with external frame sync input
+ */
+struct dpu_hw_tear_check {
+	/*
+	 * This is ratio of MDP VSYNC clk freq(Hz) to
+	 * refresh rate divided by no of lines
+	 */
+	u32 vsync_count;
+	u32 sync_cfg_height;
+	u32 vsync_init_val;
+	u32 sync_threshold_start;
+	u32 sync_threshold_continue;
+	u32 start_pos;
+	u32 rd_ptr_irq;
+	u8 hw_vsync_mode;
+};
+
+/**
+ * struct dpu_hw_pp_vsync_info - Struct contains parameters to configure
+ * read and write pointers for command mode panels
+ * @rd_ptr_init_val:    Value of rd pointer at vsync edge
+ * @rd_ptr_frame_count: Num frames sent since enabling interface
+ * @rd_ptr_line_count:  Current line on panel (rd ptr)
+ * @wr_ptr_line_count:  Current line within pp fifo (wr ptr)
+ * @intf_frame_count:   Frames read from intf
+ */
+struct dpu_hw_pp_vsync_info {
+	u32 rd_ptr_init_val;
+	u32 rd_ptr_frame_count;
+	u32 rd_ptr_line_count;
+	u32 wr_ptr_line_count;
+	u32 intf_frame_count;
+};
+
+#endif  /* _DPU_HW_MDSS_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_merge3d.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_merge3d.c
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+
+#include <drm/drm_managed.h>
+
+#include "dpu_hw_mdss.h"
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_merge3d.h"
+#include "dpu_kms.h"
+#include "dpu_trace.h"
+
+#define MERGE_3D_MUX  0x000
+#define MERGE_3D_MODE 0x004
+
+static void dpu_hw_merge_3d_setup_3d_mode(struct dpu_hw_merge_3d *merge_3d,
+			enum dpu_3d_blend_mode mode_3d)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 data;
+
+
+	c = &merge_3d->hw;
+	if (mode_3d == BLEND_3D_NONE) {
+		DPU_REG_WRITE(c, MERGE_3D_MODE, 0);
+		DPU_REG_WRITE(c, MERGE_3D_MUX, 0);
+	} else {
+		data = BIT(0) | ((mode_3d - 1) << 1);
+		DPU_REG_WRITE(c, MERGE_3D_MODE, data);
+	}
+}
+
+static void _setup_merge_3d_ops(struct dpu_hw_merge_3d *c,
+				unsigned long features)
+{
+	c->ops.setup_3d_mode = dpu_hw_merge_3d_setup_3d_mode;
+};
+
+struct dpu_hw_merge_3d *dpu_hw_merge_3d_init(struct drm_device *dev,
+					     const struct dpu_merge_3d_cfg *cfg,
+					     void __iomem *addr)
+{
+	struct dpu_hw_merge_3d *c;
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_PINGPONG;
+
+	c->idx = cfg->id;
+	c->caps = cfg;
+	_setup_merge_3d_ops(c, c->caps->features);
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_merge3d.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_merge3d.h
@@ -0,0 +1,60 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_MERGE3D_H
+#define _DPU_HW_MERGE3D_H
+
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+
+struct dpu_hw_merge_3d;
+
+/**
+ *
+ * struct dpu_hw_merge_3d_ops : Interface to the merge_3d Hw driver functions
+ *  Assumption is these functions will be called after clocks are enabled
+ *  @setup_3d_mode : enable 3D merge
+ */
+struct dpu_hw_merge_3d_ops {
+	void (*setup_3d_mode)(struct dpu_hw_merge_3d *merge_3d,
+			enum dpu_3d_blend_mode mode_3d);
+
+};
+
+struct dpu_hw_merge_3d {
+	struct dpu_hw_blk base;
+	struct dpu_hw_blk_reg_map hw;
+
+	/* merge_3d */
+	enum dpu_merge_3d idx;
+	const struct dpu_merge_3d_cfg *caps;
+
+	/* ops */
+	struct dpu_hw_merge_3d_ops ops;
+};
+
+/**
+ * to_dpu_hw_merge_3d - convert base object dpu_hw_base to container
+ * @hw: Pointer to base hardware block
+ * return: Pointer to hardware block container
+ */
+static inline struct dpu_hw_merge_3d *to_dpu_hw_merge_3d(struct dpu_hw_blk *hw)
+{
+	return container_of(hw, struct dpu_hw_merge_3d, base);
+}
+
+/**
+ * dpu_hw_merge_3d_init() - Initializes the merge_3d driver for the passed
+ * merge3d catalog entry.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  Pingpong catalog entry for which driver object is required
+ * @addr: Mapped register io address of MDP
+ * Return: Error code or allocated dpu_hw_merge_3d context
+ */
+struct dpu_hw_merge_3d *dpu_hw_merge_3d_init(struct drm_device *dev,
+					     const struct dpu_merge_3d_cfg *cfg,
+					     void __iomem *addr);
+
+#endif /*_DPU_HW_MERGE3D_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_pingpong.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_pingpong.c
@@ -0,0 +1,323 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+
+#include <drm/drm_managed.h>
+
+#include "dpu_hw_mdss.h"
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_pingpong.h"
+#include "dpu_kms.h"
+#include "dpu_trace.h"
+
+#define PP_TEAR_CHECK_EN                0x000
+#define PP_SYNC_CONFIG_VSYNC            0x004
+#define PP_SYNC_CONFIG_HEIGHT           0x008
+#define PP_SYNC_WRCOUNT                 0x00C
+#define PP_VSYNC_INIT_VAL               0x010
+#define PP_INT_COUNT_VAL                0x014
+#define PP_SYNC_THRESH                  0x018
+#define PP_START_POS                    0x01C
+#define PP_RD_PTR_IRQ                   0x020
+#define PP_WR_PTR_IRQ                   0x024
+#define PP_OUT_LINE_COUNT               0x028
+#define PP_LINE_COUNT                   0x02C
+#define PP_AUTOREFRESH_CONFIG           0x030
+
+#define PP_FBC_MODE                     0x034
+#define PP_FBC_BUDGET_CTL               0x038
+#define PP_FBC_LOSSY_MODE               0x03C
+#define PP_DSC_MODE                     0x0a0
+#define PP_DCE_DATA_IN_SWAP             0x0ac
+#define PP_DCE_DATA_OUT_SWAP            0x0c8
+
+#define PP_DITHER_EN			0x000
+#define PP_DITHER_BITDEPTH		0x004
+#define PP_DITHER_MATRIX		0x008
+
+#define DITHER_DEPTH_MAP_INDEX 9
+
+static u32 dither_depth_map[DITHER_DEPTH_MAP_INDEX] = {
+	0, 0, 0, 0, 0, 0, 0, 1, 2
+};
+
+static void dpu_hw_pp_setup_dither(struct dpu_hw_pingpong *pp,
+				    struct dpu_hw_dither_cfg *cfg)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 i, base, data = 0;
+
+	c = &pp->hw;
+	base = pp->caps->sblk->dither.base;
+	if (!cfg) {
+		DPU_REG_WRITE(c, base + PP_DITHER_EN, 0);
+		return;
+	}
+
+	data = dither_depth_map[cfg->c0_bitdepth] & REG_MASK(2);
+	data |= (dither_depth_map[cfg->c1_bitdepth] & REG_MASK(2)) << 2;
+	data |= (dither_depth_map[cfg->c2_bitdepth] & REG_MASK(2)) << 4;
+	data |= (dither_depth_map[cfg->c3_bitdepth] & REG_MASK(2)) << 6;
+	data |= (cfg->temporal_en) ? (1 << 8) : 0;
+
+	DPU_REG_WRITE(c, base + PP_DITHER_BITDEPTH, data);
+
+	for (i = 0; i < DITHER_MATRIX_SZ - 3; i += 4) {
+		data = (cfg->matrix[i] & REG_MASK(4)) |
+			((cfg->matrix[i + 1] & REG_MASK(4)) << 4) |
+			((cfg->matrix[i + 2] & REG_MASK(4)) << 8) |
+			((cfg->matrix[i + 3] & REG_MASK(4)) << 12);
+		DPU_REG_WRITE(c, base + PP_DITHER_MATRIX + i, data);
+	}
+	DPU_REG_WRITE(c, base + PP_DITHER_EN, 1);
+}
+
+static int dpu_hw_pp_enable_te(struct dpu_hw_pingpong *pp,
+		struct dpu_hw_tear_check *te)
+{
+	struct dpu_hw_blk_reg_map *c;
+	int cfg;
+
+	if (!pp || !te)
+		return -EINVAL;
+	c = &pp->hw;
+
+	cfg = BIT(19); /*VSYNC_COUNTER_EN */
+	if (te->hw_vsync_mode)
+		cfg |= BIT(20);
+
+	cfg |= te->vsync_count;
+
+	DPU_REG_WRITE(c, PP_SYNC_CONFIG_VSYNC, cfg);
+	DPU_REG_WRITE(c, PP_SYNC_CONFIG_HEIGHT, te->sync_cfg_height);
+	DPU_REG_WRITE(c, PP_VSYNC_INIT_VAL, te->vsync_init_val);
+	DPU_REG_WRITE(c, PP_RD_PTR_IRQ, te->rd_ptr_irq);
+	DPU_REG_WRITE(c, PP_START_POS, te->start_pos);
+	DPU_REG_WRITE(c, PP_SYNC_THRESH,
+			((te->sync_threshold_continue << 16) |
+			 te->sync_threshold_start));
+	DPU_REG_WRITE(c, PP_SYNC_WRCOUNT,
+			(te->start_pos + te->sync_threshold_start + 1));
+
+	DPU_REG_WRITE(c, PP_TEAR_CHECK_EN, 1);
+
+	return 0;
+}
+
+static void dpu_hw_pp_setup_autorefresh_config(struct dpu_hw_pingpong *pp,
+					       u32 frame_count, bool enable)
+{
+	DPU_REG_WRITE(&pp->hw, PP_AUTOREFRESH_CONFIG,
+		      enable ? (BIT(31) | frame_count) : 0);
+}
+
+/*
+ * dpu_hw_pp_get_autorefresh_config - Get autorefresh config from HW
+ * @pp:          DPU pingpong structure
+ * @frame_count: Used to return the current frame count from hw
+ *
+ * Returns: True if autorefresh enabled, false if disabled.
+ */
+static bool dpu_hw_pp_get_autorefresh_config(struct dpu_hw_pingpong *pp,
+					     u32 *frame_count)
+{
+	u32 val = DPU_REG_READ(&pp->hw, PP_AUTOREFRESH_CONFIG);
+	if (frame_count != NULL)
+		*frame_count = val & 0xffff;
+	return !!((val & BIT(31)) >> 31);
+}
+
+static int dpu_hw_pp_disable_te(struct dpu_hw_pingpong *pp)
+{
+	struct dpu_hw_blk_reg_map *c;
+
+	if (!pp)
+		return -EINVAL;
+	c = &pp->hw;
+
+	DPU_REG_WRITE(c, PP_TEAR_CHECK_EN, 0);
+	return 0;
+}
+
+static int dpu_hw_pp_connect_external_te(struct dpu_hw_pingpong *pp,
+		bool enable_external_te)
+{
+	struct dpu_hw_blk_reg_map *c = &pp->hw;
+	u32 cfg;
+	int orig;
+
+	if (!pp)
+		return -EINVAL;
+
+	c = &pp->hw;
+	cfg = DPU_REG_READ(c, PP_SYNC_CONFIG_VSYNC);
+	orig = (bool)(cfg & BIT(20));
+	if (enable_external_te)
+		cfg |= BIT(20);
+	else
+		cfg &= ~BIT(20);
+	DPU_REG_WRITE(c, PP_SYNC_CONFIG_VSYNC, cfg);
+	trace_dpu_pp_connect_ext_te(pp->idx - PINGPONG_0, cfg);
+
+	return orig;
+}
+
+static int dpu_hw_pp_get_vsync_info(struct dpu_hw_pingpong *pp,
+		struct dpu_hw_pp_vsync_info *info)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 val;
+
+	if (!pp || !info)
+		return -EINVAL;
+	c = &pp->hw;
+
+	val = DPU_REG_READ(c, PP_VSYNC_INIT_VAL);
+	info->rd_ptr_init_val = val & 0xffff;
+
+	val = DPU_REG_READ(c, PP_INT_COUNT_VAL);
+	info->rd_ptr_frame_count = (val & 0xffff0000) >> 16;
+	info->rd_ptr_line_count = val & 0xffff;
+
+	val = DPU_REG_READ(c, PP_LINE_COUNT);
+	info->wr_ptr_line_count = val & 0xffff;
+
+	return 0;
+}
+
+static u32 dpu_hw_pp_get_line_count(struct dpu_hw_pingpong *pp)
+{
+	struct dpu_hw_blk_reg_map *c = &pp->hw;
+	u32 height, init;
+	u32 line = 0xFFFF;
+
+	if (!pp)
+		return 0;
+	c = &pp->hw;
+
+	init = DPU_REG_READ(c, PP_VSYNC_INIT_VAL) & 0xFFFF;
+	height = DPU_REG_READ(c, PP_SYNC_CONFIG_HEIGHT) & 0xFFFF;
+
+	if (height < init)
+		return line;
+
+	line = DPU_REG_READ(c, PP_INT_COUNT_VAL) & 0xFFFF;
+
+	if (line < init)
+		line += (0xFFFF - init);
+	else
+		line -= init;
+
+	return line;
+}
+
+static void dpu_hw_pp_disable_autorefresh(struct dpu_hw_pingpong *pp,
+					  uint32_t encoder_id, u16 vdisplay)
+{
+	struct dpu_hw_pp_vsync_info info;
+	int trial = 0;
+
+	/* If autorefresh is already disabled, we have nothing to do */
+	if (!dpu_hw_pp_get_autorefresh_config(pp, NULL))
+		return;
+
+	/*
+	 * If autorefresh is enabled, disable it and make sure it is safe to
+	 * proceed with current frame commit/push. Sequence followed is,
+	 * 1. Disable TE
+	 * 2. Disable autorefresh config
+	 * 4. Poll for frame transfer ongoing to be false
+	 * 5. Enable TE back
+	 */
+
+	dpu_hw_pp_connect_external_te(pp, false);
+	dpu_hw_pp_setup_autorefresh_config(pp, 0, false);
+
+	do {
+		udelay(DPU_ENC_MAX_POLL_TIMEOUT_US);
+		if ((trial * DPU_ENC_MAX_POLL_TIMEOUT_US)
+				> (KICKOFF_TIMEOUT_MS * USEC_PER_MSEC)) {
+			DPU_ERROR("enc%d pp%d disable autorefresh failed\n",
+				  encoder_id, pp->idx - PINGPONG_0);
+			break;
+		}
+
+		trial++;
+
+		dpu_hw_pp_get_vsync_info(pp, &info);
+	} while (info.wr_ptr_line_count > 0 &&
+		 info.wr_ptr_line_count < vdisplay);
+
+	dpu_hw_pp_connect_external_te(pp, true);
+
+	DPU_DEBUG("enc%d pp%d disabled autorefresh\n",
+		  encoder_id, pp->idx - PINGPONG_0);
+}
+
+static int dpu_hw_pp_dsc_enable(struct dpu_hw_pingpong *pp)
+{
+	struct dpu_hw_blk_reg_map *c = &pp->hw;
+
+	DPU_REG_WRITE(c, PP_DSC_MODE, 1);
+	return 0;
+}
+
+static void dpu_hw_pp_dsc_disable(struct dpu_hw_pingpong *pp)
+{
+	struct dpu_hw_blk_reg_map *c = &pp->hw;
+
+	DPU_REG_WRITE(c, PP_DSC_MODE, 0);
+}
+
+static int dpu_hw_pp_setup_dsc(struct dpu_hw_pingpong *pp)
+{
+	struct dpu_hw_blk_reg_map *pp_c = &pp->hw;
+	int data;
+
+	data = DPU_REG_READ(pp_c, PP_DCE_DATA_OUT_SWAP);
+	data |= BIT(18); /* endian flip */
+	DPU_REG_WRITE(pp_c, PP_DCE_DATA_OUT_SWAP, data);
+	return 0;
+}
+
+struct dpu_hw_pingpong *dpu_hw_pingpong_init(struct drm_device *dev,
+					     const struct dpu_pingpong_cfg *cfg,
+					     void __iomem *addr,
+					     const struct dpu_mdss_version *mdss_rev)
+{
+	struct dpu_hw_pingpong *c;
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_PINGPONG;
+
+	c->idx = cfg->id;
+	c->caps = cfg;
+
+	if (mdss_rev->core_major_ver < 5) {
+		WARN_ON(!cfg->intr_rdptr);
+
+		c->ops.enable_tearcheck = dpu_hw_pp_enable_te;
+		c->ops.disable_tearcheck = dpu_hw_pp_disable_te;
+		c->ops.connect_external_te = dpu_hw_pp_connect_external_te;
+		c->ops.get_line_count = dpu_hw_pp_get_line_count;
+		c->ops.disable_autorefresh = dpu_hw_pp_disable_autorefresh;
+	}
+
+	if (test_bit(DPU_PINGPONG_DSC, &cfg->features)) {
+		c->ops.setup_dsc = dpu_hw_pp_setup_dsc;
+		c->ops.enable_dsc = dpu_hw_pp_dsc_enable;
+		c->ops.disable_dsc = dpu_hw_pp_dsc_disable;
+	}
+
+	if (test_bit(DPU_PINGPONG_DITHER, &cfg->features))
+		c->ops.setup_dither = dpu_hw_pp_setup_dither;
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_pingpong.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_pingpong.h
@@ -0,0 +1,135 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_PINGPONG_H
+#define _DPU_HW_PINGPONG_H
+
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+
+#define DITHER_MATRIX_SZ 16
+
+struct dpu_hw_pingpong;
+
+/**
+ * struct dpu_hw_dither_cfg - dither feature structure
+ * @flags: for customizing operations
+ * @temporal_en: temperal dither enable
+ * @c0_bitdepth: c0 component bit depth
+ * @c1_bitdepth: c1 component bit depth
+ * @c2_bitdepth: c2 component bit depth
+ * @c3_bitdepth: c2 component bit depth
+ * @matrix: dither strength matrix
+ */
+struct dpu_hw_dither_cfg {
+	u64 flags;
+	u32 temporal_en;
+	u32 c0_bitdepth;
+	u32 c1_bitdepth;
+	u32 c2_bitdepth;
+	u32 c3_bitdepth;
+	u32 matrix[DITHER_MATRIX_SZ];
+};
+
+/**
+ *
+ * struct dpu_hw_pingpong_ops : Interface to the pingpong Hw driver functions
+ *  Assumption is these functions will be called after clocks are enabled
+ *  @enable_tearcheck: program and enable tear check block
+ *  @disable_tearcheck: disable able tear check block
+ *  @setup_dither : function to program the dither hw block
+ *  @get_line_count: obtain current vertical line counter
+ */
+struct dpu_hw_pingpong_ops {
+	/**
+	 * enables vysnc generation and sets up init value of
+	 * read pointer and programs the tear check cofiguration
+	 */
+	int (*enable_tearcheck)(struct dpu_hw_pingpong *pp,
+			struct dpu_hw_tear_check *cfg);
+
+	/**
+	 * disables tear check block
+	 */
+	int (*disable_tearcheck)(struct dpu_hw_pingpong *pp);
+
+	/**
+	 * read, modify, write to either set or clear listening to external TE
+	 * @Return: 1 if TE was originally connected, 0 if not, or -ERROR
+	 */
+	int (*connect_external_te)(struct dpu_hw_pingpong *pp,
+			bool enable_external_te);
+
+	/**
+	 * Obtain current vertical line counter
+	 */
+	u32 (*get_line_count)(struct dpu_hw_pingpong *pp);
+
+	/**
+	 * Disable autorefresh if enabled
+	 */
+	void (*disable_autorefresh)(struct dpu_hw_pingpong *pp, uint32_t encoder_id, u16 vdisplay);
+
+	/**
+	 * Setup dither matix for pingpong block
+	 */
+	void (*setup_dither)(struct dpu_hw_pingpong *pp,
+			struct dpu_hw_dither_cfg *cfg);
+	/**
+	 * Enable DSC
+	 */
+	int (*enable_dsc)(struct dpu_hw_pingpong *pp);
+
+	/**
+	 * Disable DSC
+	 */
+	void (*disable_dsc)(struct dpu_hw_pingpong *pp);
+
+	/**
+	 * Setup DSC
+	 */
+	int (*setup_dsc)(struct dpu_hw_pingpong *pp);
+};
+
+struct dpu_hw_merge_3d;
+
+struct dpu_hw_pingpong {
+	struct dpu_hw_blk base;
+	struct dpu_hw_blk_reg_map hw;
+
+	/* pingpong */
+	enum dpu_pingpong idx;
+	const struct dpu_pingpong_cfg *caps;
+	struct dpu_hw_merge_3d *merge_3d;
+
+	/* ops */
+	struct dpu_hw_pingpong_ops ops;
+};
+
+/**
+ * to_dpu_hw_pingpong - convert base object dpu_hw_base to container
+ * @hw: Pointer to base hardware block
+ * return: Pointer to hardware block container
+ */
+static inline struct dpu_hw_pingpong *to_dpu_hw_pingpong(struct dpu_hw_blk *hw)
+{
+	return container_of(hw, struct dpu_hw_pingpong, base);
+}
+
+/**
+ * dpu_hw_pingpong_init() - initializes the pingpong driver for the passed
+ * pingpong catalog entry.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  Pingpong catalog entry for which driver object is required
+ * @addr: Mapped register io address of MDP
+ * @mdss_rev: dpu core's major and minor versions
+ * Return: Error code or allocated dpu_hw_pingpong context
+ */
+struct dpu_hw_pingpong *dpu_hw_pingpong_init(struct drm_device *dev,
+					     const struct dpu_pingpong_cfg *cfg,
+					     void __iomem *addr,
+					     const struct dpu_mdss_version *mdss_rev);
+
+#endif /*_DPU_HW_PINGPONG_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_sspp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_sspp.c
@@ -0,0 +1,698 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_lm.h"
+#include "dpu_hw_sspp.h"
+#include "dpu_kms.h"
+
+#include "msm_mdss.h"
+
+#include <drm/drm_file.h>
+#include <drm/drm_managed.h>
+
+#define DPU_FETCH_CONFIG_RESET_VALUE   0x00000087
+
+/* SSPP registers */
+#define SSPP_SRC_SIZE                      0x00
+#define SSPP_SRC_XY                        0x08
+#define SSPP_OUT_SIZE                      0x0c
+#define SSPP_OUT_XY                        0x10
+#define SSPP_SRC0_ADDR                     0x14
+#define SSPP_SRC1_ADDR                     0x18
+#define SSPP_SRC2_ADDR                     0x1C
+#define SSPP_SRC3_ADDR                     0x20
+#define SSPP_SRC_YSTRIDE0                  0x24
+#define SSPP_SRC_YSTRIDE1                  0x28
+#define SSPP_SRC_FORMAT                    0x30
+#define SSPP_SRC_UNPACK_PATTERN            0x34
+#define SSPP_SRC_OP_MODE                   0x38
+#define SSPP_SRC_CONSTANT_COLOR            0x3c
+#define SSPP_EXCL_REC_CTL                  0x40
+#define SSPP_UBWC_STATIC_CTRL              0x44
+#define SSPP_FETCH_CONFIG                  0x48
+#define SSPP_DANGER_LUT                    0x60
+#define SSPP_SAFE_LUT                      0x64
+#define SSPP_CREQ_LUT                      0x68
+#define SSPP_QOS_CTRL                      0x6C
+#define SSPP_SRC_ADDR_SW_STATUS            0x70
+#define SSPP_CREQ_LUT_0                    0x74
+#define SSPP_CREQ_LUT_1                    0x78
+#define SSPP_DECIMATION_CONFIG             0xB4
+#define SSPP_SW_PIX_EXT_C0_LR              0x100
+#define SSPP_SW_PIX_EXT_C0_TB              0x104
+#define SSPP_SW_PIX_EXT_C0_REQ_PIXELS      0x108
+#define SSPP_SW_PIX_EXT_C1C2_LR            0x110
+#define SSPP_SW_PIX_EXT_C1C2_TB            0x114
+#define SSPP_SW_PIX_EXT_C1C2_REQ_PIXELS    0x118
+#define SSPP_SW_PIX_EXT_C3_LR              0x120
+#define SSPP_SW_PIX_EXT_C3_TB              0x124
+#define SSPP_SW_PIX_EXT_C3_REQ_PIXELS      0x128
+#define SSPP_TRAFFIC_SHAPER                0x130
+#define SSPP_CDP_CNTL                      0x134
+#define SSPP_UBWC_ERROR_STATUS             0x138
+#define SSPP_CDP_CNTL_REC1                 0x13c
+#define SSPP_TRAFFIC_SHAPER_PREFILL        0x150
+#define SSPP_TRAFFIC_SHAPER_REC1_PREFILL   0x154
+#define SSPP_TRAFFIC_SHAPER_REC1           0x158
+#define SSPP_OUT_SIZE_REC1                 0x160
+#define SSPP_OUT_XY_REC1                   0x164
+#define SSPP_SRC_XY_REC1                   0x168
+#define SSPP_SRC_SIZE_REC1                 0x16C
+#define SSPP_MULTIRECT_OPMODE              0x170
+#define SSPP_SRC_FORMAT_REC1               0x174
+#define SSPP_SRC_UNPACK_PATTERN_REC1       0x178
+#define SSPP_SRC_OP_MODE_REC1              0x17C
+#define SSPP_SRC_CONSTANT_COLOR_REC1       0x180
+#define SSPP_EXCL_REC_SIZE_REC1            0x184
+#define SSPP_EXCL_REC_XY_REC1              0x188
+#define SSPP_EXCL_REC_SIZE                 0x1B4
+#define SSPP_EXCL_REC_XY                   0x1B8
+#define SSPP_CLK_CTRL                      0x330
+
+/* SSPP_SRC_OP_MODE & OP_MODE_REC1 */
+#define MDSS_MDP_OP_DEINTERLACE            BIT(22)
+#define MDSS_MDP_OP_DEINTERLACE_ODD        BIT(23)
+#define MDSS_MDP_OP_IGC_ROM_1              BIT(18)
+#define MDSS_MDP_OP_IGC_ROM_0              BIT(17)
+#define MDSS_MDP_OP_IGC_EN                 BIT(16)
+#define MDSS_MDP_OP_FLIP_UD                BIT(14)
+#define MDSS_MDP_OP_FLIP_LR                BIT(13)
+#define MDSS_MDP_OP_BWC_EN                 BIT(0)
+#define MDSS_MDP_OP_PE_OVERRIDE            BIT(31)
+#define MDSS_MDP_OP_BWC_LOSSLESS           (0 << 1)
+#define MDSS_MDP_OP_BWC_Q_HIGH             (1 << 1)
+#define MDSS_MDP_OP_BWC_Q_MED              (2 << 1)
+
+/* SSPP_QOS_CTRL */
+#define SSPP_QOS_CTRL_VBLANK_EN            BIT(16)
+#define SSPP_QOS_CTRL_DANGER_SAFE_EN       BIT(0)
+#define SSPP_QOS_CTRL_DANGER_VBLANK_MASK   0x3
+#define SSPP_QOS_CTRL_DANGER_VBLANK_OFF    4
+#define SSPP_QOS_CTRL_CREQ_VBLANK_MASK     0x3
+#define SSPP_QOS_CTRL_CREQ_VBLANK_OFF      20
+
+/* DPU_SSPP_SCALER_QSEED2 */
+#define SSPP_VIG_OP_MODE                   0x0
+#define SCALE_CONFIG                       0x04
+#define COMP0_3_PHASE_STEP_X               0x10
+#define COMP0_3_PHASE_STEP_Y               0x14
+#define COMP1_2_PHASE_STEP_X               0x18
+#define COMP1_2_PHASE_STEP_Y               0x1c
+#define COMP0_3_INIT_PHASE_X               0x20
+#define COMP0_3_INIT_PHASE_Y               0x24
+#define COMP1_2_INIT_PHASE_X               0x28
+#define COMP1_2_INIT_PHASE_Y               0x2C
+#define VIG_0_QSEED2_SHARP                 0x30
+
+/* SSPP_TRAFFIC_SHAPER and _REC1 */
+#define SSPP_TRAFFIC_SHAPER_BPC_MAX        0xFF
+
+/*
+ * Definitions for ViG op modes
+ */
+#define VIG_OP_CSC_DST_DATAFMT BIT(19)
+#define VIG_OP_CSC_SRC_DATAFMT BIT(18)
+#define VIG_OP_CSC_EN          BIT(17)
+#define VIG_OP_MEM_PROT_CONT   BIT(15)
+#define VIG_OP_MEM_PROT_VAL    BIT(14)
+#define VIG_OP_MEM_PROT_SAT    BIT(13)
+#define VIG_OP_MEM_PROT_HUE    BIT(12)
+#define VIG_OP_HIST            BIT(8)
+#define VIG_OP_SKY_COL         BIT(7)
+#define VIG_OP_FOIL            BIT(6)
+#define VIG_OP_SKIN_COL        BIT(5)
+#define VIG_OP_PA_EN           BIT(4)
+#define VIG_OP_PA_SAT_ZERO_EXP BIT(2)
+#define VIG_OP_MEM_PROT_BLEND  BIT(1)
+
+/*
+ * Definitions for CSC 10 op modes
+ */
+#define SSPP_VIG_CSC_10_OP_MODE            0x0
+#define VIG_CSC_10_SRC_DATAFMT BIT(1)
+#define VIG_CSC_10_EN          BIT(0)
+#define CSC_10BIT_OFFSET       4
+
+/* traffic shaper clock in Hz */
+#define TS_CLK			19200000
+
+
+static void dpu_hw_sspp_setup_multirect(struct dpu_sw_pipe *pipe)
+{
+	struct dpu_hw_sspp *ctx = pipe->sspp;
+	u32 mode_mask;
+
+	if (!ctx)
+		return;
+
+	if (pipe->multirect_index == DPU_SSPP_RECT_SOLO) {
+		/**
+		 * if rect index is RECT_SOLO, we cannot expect a
+		 * virtual plane sharing the same SSPP id. So we go
+		 * and disable multirect
+		 */
+		mode_mask = 0;
+	} else {
+		mode_mask = DPU_REG_READ(&ctx->hw, SSPP_MULTIRECT_OPMODE);
+		mode_mask |= pipe->multirect_index;
+		if (pipe->multirect_mode == DPU_SSPP_MULTIRECT_TIME_MX)
+			mode_mask |= BIT(2);
+		else
+			mode_mask &= ~BIT(2);
+	}
+
+	DPU_REG_WRITE(&ctx->hw, SSPP_MULTIRECT_OPMODE, mode_mask);
+}
+
+static void _sspp_setup_opmode(struct dpu_hw_sspp *ctx,
+		u32 mask, u8 en)
+{
+	const struct dpu_sspp_sub_blks *sblk = ctx->cap->sblk;
+	u32 opmode;
+
+	if (!test_bit(DPU_SSPP_SCALER_QSEED2, &ctx->cap->features) ||
+		!test_bit(DPU_SSPP_CSC, &ctx->cap->features))
+		return;
+
+	opmode = DPU_REG_READ(&ctx->hw, sblk->scaler_blk.base + SSPP_VIG_OP_MODE);
+
+	if (en)
+		opmode |= mask;
+	else
+		opmode &= ~mask;
+
+	DPU_REG_WRITE(&ctx->hw, sblk->scaler_blk.base + SSPP_VIG_OP_MODE, opmode);
+}
+
+static void _sspp_setup_csc10_opmode(struct dpu_hw_sspp *ctx,
+		u32 mask, u8 en)
+{
+	const struct dpu_sspp_sub_blks *sblk = ctx->cap->sblk;
+	u32 opmode;
+
+	opmode = DPU_REG_READ(&ctx->hw, sblk->csc_blk.base + SSPP_VIG_CSC_10_OP_MODE);
+	if (en)
+		opmode |= mask;
+	else
+		opmode &= ~mask;
+
+	DPU_REG_WRITE(&ctx->hw, sblk->csc_blk.base + SSPP_VIG_CSC_10_OP_MODE, opmode);
+}
+
+/*
+ * Setup source pixel format, flip,
+ */
+static void dpu_hw_sspp_setup_format(struct dpu_sw_pipe *pipe,
+		const struct dpu_format *fmt, u32 flags)
+{
+	struct dpu_hw_sspp *ctx = pipe->sspp;
+	struct dpu_hw_blk_reg_map *c;
+	u32 chroma_samp, unpack, src_format;
+	u32 opmode = 0;
+	u32 fast_clear = 0;
+	u32 op_mode_off, unpack_pat_off, format_off;
+
+	if (!ctx || !fmt)
+		return;
+
+	if (pipe->multirect_index == DPU_SSPP_RECT_SOLO ||
+	    pipe->multirect_index == DPU_SSPP_RECT_0) {
+		op_mode_off = SSPP_SRC_OP_MODE;
+		unpack_pat_off = SSPP_SRC_UNPACK_PATTERN;
+		format_off = SSPP_SRC_FORMAT;
+	} else {
+		op_mode_off = SSPP_SRC_OP_MODE_REC1;
+		unpack_pat_off = SSPP_SRC_UNPACK_PATTERN_REC1;
+		format_off = SSPP_SRC_FORMAT_REC1;
+	}
+
+	c = &ctx->hw;
+	opmode = DPU_REG_READ(c, op_mode_off);
+	opmode &= ~(MDSS_MDP_OP_FLIP_LR | MDSS_MDP_OP_FLIP_UD |
+			MDSS_MDP_OP_BWC_EN | MDSS_MDP_OP_PE_OVERRIDE);
+
+	if (flags & DPU_SSPP_FLIP_LR)
+		opmode |= MDSS_MDP_OP_FLIP_LR;
+	if (flags & DPU_SSPP_FLIP_UD)
+		opmode |= MDSS_MDP_OP_FLIP_UD;
+
+	chroma_samp = fmt->chroma_sample;
+	if (flags & DPU_SSPP_SOURCE_ROTATED_90) {
+		if (chroma_samp == DPU_CHROMA_H2V1)
+			chroma_samp = DPU_CHROMA_H1V2;
+		else if (chroma_samp == DPU_CHROMA_H1V2)
+			chroma_samp = DPU_CHROMA_H2V1;
+	}
+
+	src_format = (chroma_samp << 23) | (fmt->fetch_planes << 19) |
+		(fmt->bits[C3_ALPHA] << 6) | (fmt->bits[C2_R_Cr] << 4) |
+		(fmt->bits[C1_B_Cb] << 2) | (fmt->bits[C0_G_Y] << 0);
+
+	if (flags & DPU_SSPP_ROT_90)
+		src_format |= BIT(11); /* ROT90 */
+
+	if (fmt->alpha_enable && fmt->fetch_planes == DPU_PLANE_INTERLEAVED)
+		src_format |= BIT(8); /* SRCC3_EN */
+
+	if (flags & DPU_SSPP_SOLID_FILL)
+		src_format |= BIT(22);
+
+	unpack = (fmt->element[3] << 24) | (fmt->element[2] << 16) |
+		(fmt->element[1] << 8) | (fmt->element[0] << 0);
+	src_format |= ((fmt->unpack_count - 1) << 12) |
+		(fmt->unpack_tight << 17) |
+		(fmt->unpack_align_msb << 18) |
+		((fmt->bpp - 1) << 9);
+
+	if (fmt->fetch_mode != DPU_FETCH_LINEAR) {
+		if (DPU_FORMAT_IS_UBWC(fmt))
+			opmode |= MDSS_MDP_OP_BWC_EN;
+		src_format |= (fmt->fetch_mode & 3) << 30; /*FRAME_FORMAT */
+		DPU_REG_WRITE(c, SSPP_FETCH_CONFIG,
+			DPU_FETCH_CONFIG_RESET_VALUE |
+			ctx->ubwc->highest_bank_bit << 18);
+		switch (ctx->ubwc->ubwc_enc_version) {
+		case UBWC_1_0:
+			fast_clear = fmt->alpha_enable ? BIT(31) : 0;
+			DPU_REG_WRITE(c, SSPP_UBWC_STATIC_CTRL,
+					fast_clear | (ctx->ubwc->ubwc_swizzle & 0x1) |
+					BIT(8) |
+					(ctx->ubwc->highest_bank_bit << 4));
+			break;
+		case UBWC_2_0:
+			fast_clear = fmt->alpha_enable ? BIT(31) : 0;
+			DPU_REG_WRITE(c, SSPP_UBWC_STATIC_CTRL,
+					fast_clear | (ctx->ubwc->ubwc_swizzle) |
+					(ctx->ubwc->highest_bank_bit << 4));
+			break;
+		case UBWC_3_0:
+			DPU_REG_WRITE(c, SSPP_UBWC_STATIC_CTRL,
+					BIT(30) | (ctx->ubwc->ubwc_swizzle) |
+					(ctx->ubwc->highest_bank_bit << 4));
+			break;
+		case UBWC_4_0:
+			DPU_REG_WRITE(c, SSPP_UBWC_STATIC_CTRL,
+					DPU_FORMAT_IS_YUV(fmt) ? 0 : BIT(30));
+			break;
+		}
+	}
+
+	opmode |= MDSS_MDP_OP_PE_OVERRIDE;
+
+	/* if this is YUV pixel format, enable CSC */
+	if (DPU_FORMAT_IS_YUV(fmt))
+		src_format |= BIT(15);
+
+	if (DPU_FORMAT_IS_DX(fmt))
+		src_format |= BIT(14);
+
+	/* update scaler opmode, if appropriate */
+	if (test_bit(DPU_SSPP_CSC, &ctx->cap->features))
+		_sspp_setup_opmode(ctx, VIG_OP_CSC_EN | VIG_OP_CSC_SRC_DATAFMT,
+			DPU_FORMAT_IS_YUV(fmt));
+	else if (test_bit(DPU_SSPP_CSC_10BIT, &ctx->cap->features))
+		_sspp_setup_csc10_opmode(ctx,
+			VIG_CSC_10_EN | VIG_CSC_10_SRC_DATAFMT,
+			DPU_FORMAT_IS_YUV(fmt));
+
+	DPU_REG_WRITE(c, format_off, src_format);
+	DPU_REG_WRITE(c, unpack_pat_off, unpack);
+	DPU_REG_WRITE(c, op_mode_off, opmode);
+
+	/* clear previous UBWC error */
+	DPU_REG_WRITE(c, SSPP_UBWC_ERROR_STATUS, BIT(31));
+}
+
+static void dpu_hw_sspp_setup_pe_config(struct dpu_hw_sspp *ctx,
+		struct dpu_hw_pixel_ext *pe_ext)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u8 color;
+	u32 lr_pe[4], tb_pe[4], tot_req_pixels[4];
+	const u32 bytemask = 0xff;
+	const u32 shortmask = 0xffff;
+
+	if (!ctx || !pe_ext)
+		return;
+
+	c = &ctx->hw;
+
+	/* program SW pixel extension override for all pipes*/
+	for (color = 0; color < DPU_MAX_PLANES; color++) {
+		/* color 2 has the same set of registers as color 1 */
+		if (color == 2)
+			continue;
+
+		lr_pe[color] = ((pe_ext->right_ftch[color] & bytemask) << 24)|
+			((pe_ext->right_rpt[color] & bytemask) << 16)|
+			((pe_ext->left_ftch[color] & bytemask) << 8)|
+			(pe_ext->left_rpt[color] & bytemask);
+
+		tb_pe[color] = ((pe_ext->btm_ftch[color] & bytemask) << 24)|
+			((pe_ext->btm_rpt[color] & bytemask) << 16)|
+			((pe_ext->top_ftch[color] & bytemask) << 8)|
+			(pe_ext->top_rpt[color] & bytemask);
+
+		tot_req_pixels[color] = (((pe_ext->roi_h[color] +
+			pe_ext->num_ext_pxls_top[color] +
+			pe_ext->num_ext_pxls_btm[color]) & shortmask) << 16) |
+			((pe_ext->roi_w[color] +
+			pe_ext->num_ext_pxls_left[color] +
+			pe_ext->num_ext_pxls_right[color]) & shortmask);
+	}
+
+	/* color 0 */
+	DPU_REG_WRITE(c, SSPP_SW_PIX_EXT_C0_LR, lr_pe[0]);
+	DPU_REG_WRITE(c, SSPP_SW_PIX_EXT_C0_TB, tb_pe[0]);
+	DPU_REG_WRITE(c, SSPP_SW_PIX_EXT_C0_REQ_PIXELS,
+			tot_req_pixels[0]);
+
+	/* color 1 and color 2 */
+	DPU_REG_WRITE(c, SSPP_SW_PIX_EXT_C1C2_LR, lr_pe[1]);
+	DPU_REG_WRITE(c, SSPP_SW_PIX_EXT_C1C2_TB, tb_pe[1]);
+	DPU_REG_WRITE(c, SSPP_SW_PIX_EXT_C1C2_REQ_PIXELS,
+			tot_req_pixels[1]);
+
+	/* color 3 */
+	DPU_REG_WRITE(c, SSPP_SW_PIX_EXT_C3_LR, lr_pe[3]);
+	DPU_REG_WRITE(c, SSPP_SW_PIX_EXT_C3_TB, lr_pe[3]);
+	DPU_REG_WRITE(c, SSPP_SW_PIX_EXT_C3_REQ_PIXELS,
+			tot_req_pixels[3]);
+}
+
+static void _dpu_hw_sspp_setup_scaler3(struct dpu_hw_sspp *ctx,
+		struct dpu_hw_scaler3_cfg *scaler3_cfg,
+		const struct dpu_format *format)
+{
+	if (!ctx || !scaler3_cfg)
+		return;
+
+	dpu_hw_setup_scaler3(&ctx->hw, scaler3_cfg,
+			ctx->cap->sblk->scaler_blk.base,
+			ctx->cap->sblk->scaler_blk.version,
+			format);
+}
+
+/*
+ * dpu_hw_sspp_setup_rects()
+ */
+static void dpu_hw_sspp_setup_rects(struct dpu_sw_pipe *pipe,
+		struct dpu_sw_pipe_cfg *cfg)
+{
+	struct dpu_hw_sspp *ctx = pipe->sspp;
+	struct dpu_hw_blk_reg_map *c;
+	u32 src_size, src_xy, dst_size, dst_xy;
+	u32 src_size_off, src_xy_off, out_size_off, out_xy_off;
+
+	if (!ctx || !cfg)
+		return;
+
+	c = &ctx->hw;
+
+	if (pipe->multirect_index == DPU_SSPP_RECT_SOLO ||
+	    pipe->multirect_index == DPU_SSPP_RECT_0) {
+		src_size_off = SSPP_SRC_SIZE;
+		src_xy_off = SSPP_SRC_XY;
+		out_size_off = SSPP_OUT_SIZE;
+		out_xy_off = SSPP_OUT_XY;
+	} else {
+		src_size_off = SSPP_SRC_SIZE_REC1;
+		src_xy_off = SSPP_SRC_XY_REC1;
+		out_size_off = SSPP_OUT_SIZE_REC1;
+		out_xy_off = SSPP_OUT_XY_REC1;
+	}
+
+
+	/* src and dest rect programming */
+	src_xy = (cfg->src_rect.y1 << 16) | cfg->src_rect.x1;
+	src_size = (drm_rect_height(&cfg->src_rect) << 16) |
+		   drm_rect_width(&cfg->src_rect);
+	dst_xy = (cfg->dst_rect.y1 << 16) | cfg->dst_rect.x1;
+	dst_size = (drm_rect_height(&cfg->dst_rect) << 16) |
+		drm_rect_width(&cfg->dst_rect);
+
+	/* rectangle register programming */
+	DPU_REG_WRITE(c, src_size_off, src_size);
+	DPU_REG_WRITE(c, src_xy_off, src_xy);
+	DPU_REG_WRITE(c, out_size_off, dst_size);
+	DPU_REG_WRITE(c, out_xy_off, dst_xy);
+}
+
+static void dpu_hw_sspp_setup_sourceaddress(struct dpu_sw_pipe *pipe,
+		struct dpu_hw_fmt_layout *layout)
+{
+	struct dpu_hw_sspp *ctx = pipe->sspp;
+	u32 ystride0, ystride1;
+	int i;
+
+	if (!ctx)
+		return;
+
+	if (pipe->multirect_index == DPU_SSPP_RECT_SOLO) {
+		for (i = 0; i < ARRAY_SIZE(layout->plane_addr); i++)
+			DPU_REG_WRITE(&ctx->hw, SSPP_SRC0_ADDR + i * 0x4,
+					layout->plane_addr[i]);
+	} else if (pipe->multirect_index == DPU_SSPP_RECT_0) {
+		DPU_REG_WRITE(&ctx->hw, SSPP_SRC0_ADDR,
+				layout->plane_addr[0]);
+		DPU_REG_WRITE(&ctx->hw, SSPP_SRC2_ADDR,
+				layout->plane_addr[2]);
+	} else {
+		DPU_REG_WRITE(&ctx->hw, SSPP_SRC1_ADDR,
+				layout->plane_addr[0]);
+		DPU_REG_WRITE(&ctx->hw, SSPP_SRC3_ADDR,
+				layout->plane_addr[2]);
+	}
+
+	if (pipe->multirect_index == DPU_SSPP_RECT_SOLO) {
+		ystride0 = (layout->plane_pitch[0]) |
+			(layout->plane_pitch[1] << 16);
+		ystride1 = (layout->plane_pitch[2]) |
+			(layout->plane_pitch[3] << 16);
+	} else {
+		ystride0 = DPU_REG_READ(&ctx->hw, SSPP_SRC_YSTRIDE0);
+		ystride1 = DPU_REG_READ(&ctx->hw, SSPP_SRC_YSTRIDE1);
+
+		if (pipe->multirect_index == DPU_SSPP_RECT_0) {
+			ystride0 = (ystride0 & 0xFFFF0000) |
+				(layout->plane_pitch[0] & 0x0000FFFF);
+			ystride1 = (ystride1 & 0xFFFF0000)|
+				(layout->plane_pitch[2] & 0x0000FFFF);
+		} else {
+			ystride0 = (ystride0 & 0x0000FFFF) |
+				((layout->plane_pitch[0] << 16) &
+				 0xFFFF0000);
+			ystride1 = (ystride1 & 0x0000FFFF) |
+				((layout->plane_pitch[2] << 16) &
+				 0xFFFF0000);
+		}
+	}
+
+	DPU_REG_WRITE(&ctx->hw, SSPP_SRC_YSTRIDE0, ystride0);
+	DPU_REG_WRITE(&ctx->hw, SSPP_SRC_YSTRIDE1, ystride1);
+}
+
+static void dpu_hw_sspp_setup_csc(struct dpu_hw_sspp *ctx,
+		const struct dpu_csc_cfg *data)
+{
+	u32 offset;
+	bool csc10 = false;
+
+	if (!ctx || !data)
+		return;
+
+	offset = ctx->cap->sblk->csc_blk.base;
+
+	if (test_bit(DPU_SSPP_CSC_10BIT, &ctx->cap->features)) {
+		offset += CSC_10BIT_OFFSET;
+		csc10 = true;
+	}
+
+	dpu_hw_csc_setup(&ctx->hw, offset, data, csc10);
+}
+
+static void dpu_hw_sspp_setup_solidfill(struct dpu_sw_pipe *pipe, u32 color)
+{
+	struct dpu_hw_sspp *ctx = pipe->sspp;
+	struct dpu_hw_fmt_layout cfg;
+
+	if (!ctx)
+		return;
+
+	/* cleanup source addresses */
+	memset(&cfg, 0, sizeof(cfg));
+	ctx->ops.setup_sourceaddress(pipe, &cfg);
+
+	if (pipe->multirect_index == DPU_SSPP_RECT_SOLO ||
+	    pipe->multirect_index == DPU_SSPP_RECT_0)
+		DPU_REG_WRITE(&ctx->hw, SSPP_SRC_CONSTANT_COLOR, color);
+	else
+		DPU_REG_WRITE(&ctx->hw, SSPP_SRC_CONSTANT_COLOR_REC1,
+				color);
+}
+
+static void dpu_hw_sspp_setup_qos_lut(struct dpu_hw_sspp *ctx,
+				      struct dpu_hw_qos_cfg *cfg)
+{
+	if (!ctx || !cfg)
+		return;
+
+	_dpu_hw_setup_qos_lut(&ctx->hw, SSPP_DANGER_LUT,
+			      test_bit(DPU_SSPP_QOS_8LVL, &ctx->cap->features),
+			      cfg);
+}
+
+static void dpu_hw_sspp_setup_qos_ctrl(struct dpu_hw_sspp *ctx,
+				       bool danger_safe_en)
+{
+	if (!ctx)
+		return;
+
+	DPU_REG_WRITE(&ctx->hw, SSPP_QOS_CTRL,
+		      danger_safe_en ? SSPP_QOS_CTRL_DANGER_SAFE_EN : 0);
+}
+
+static void dpu_hw_sspp_setup_cdp(struct dpu_sw_pipe *pipe,
+				  const struct dpu_format *fmt,
+				  bool enable)
+{
+	struct dpu_hw_sspp *ctx = pipe->sspp;
+	u32 cdp_cntl_offset = 0;
+
+	if (!ctx)
+		return;
+
+	if (pipe->multirect_index == DPU_SSPP_RECT_SOLO ||
+	    pipe->multirect_index == DPU_SSPP_RECT_0)
+		cdp_cntl_offset = SSPP_CDP_CNTL;
+	else
+		cdp_cntl_offset = SSPP_CDP_CNTL_REC1;
+
+	dpu_setup_cdp(&ctx->hw, cdp_cntl_offset, fmt, enable);
+}
+
+static bool dpu_hw_sspp_setup_clk_force_ctrl(struct dpu_hw_sspp *ctx, bool enable)
+{
+	static const struct dpu_clk_ctrl_reg sspp_clk_ctrl = {
+		.reg_off = SSPP_CLK_CTRL,
+		.bit_off = 0
+	};
+
+	return dpu_hw_clk_force_ctrl(&ctx->hw, &sspp_clk_ctrl, enable);
+}
+
+static void _setup_layer_ops(struct dpu_hw_sspp *c,
+		unsigned long features, const struct dpu_mdss_version *mdss_rev)
+{
+	c->ops.setup_format = dpu_hw_sspp_setup_format;
+	c->ops.setup_rects = dpu_hw_sspp_setup_rects;
+	c->ops.setup_sourceaddress = dpu_hw_sspp_setup_sourceaddress;
+	c->ops.setup_solidfill = dpu_hw_sspp_setup_solidfill;
+	c->ops.setup_pe = dpu_hw_sspp_setup_pe_config;
+
+	if (test_bit(DPU_SSPP_QOS, &features)) {
+		c->ops.setup_qos_lut = dpu_hw_sspp_setup_qos_lut;
+		c->ops.setup_qos_ctrl = dpu_hw_sspp_setup_qos_ctrl;
+	}
+
+	if (test_bit(DPU_SSPP_CSC, &features) ||
+		test_bit(DPU_SSPP_CSC_10BIT, &features))
+		c->ops.setup_csc = dpu_hw_sspp_setup_csc;
+
+	if (test_bit(DPU_SSPP_SMART_DMA_V1, &c->cap->features) ||
+		test_bit(DPU_SSPP_SMART_DMA_V2, &c->cap->features))
+		c->ops.setup_multirect = dpu_hw_sspp_setup_multirect;
+
+	if (test_bit(DPU_SSPP_SCALER_QSEED3_COMPATIBLE, &features))
+		c->ops.setup_scaler = _dpu_hw_sspp_setup_scaler3;
+
+	if (test_bit(DPU_SSPP_CDP, &features))
+		c->ops.setup_cdp = dpu_hw_sspp_setup_cdp;
+
+	if (mdss_rev->core_major_ver >= 9)
+		c->ops.setup_clk_force_ctrl = dpu_hw_sspp_setup_clk_force_ctrl;
+}
+
+#ifdef CONFIG_DEBUG_FS
+int _dpu_hw_sspp_init_debugfs(struct dpu_hw_sspp *hw_pipe, struct dpu_kms *kms,
+			      struct dentry *entry)
+{
+	const struct dpu_sspp_cfg *cfg = hw_pipe->cap;
+	const struct dpu_sspp_sub_blks *sblk = cfg->sblk;
+	struct dentry *debugfs_root;
+	char sspp_name[32];
+
+	snprintf(sspp_name, sizeof(sspp_name), "%d", hw_pipe->idx);
+
+	/* create overall sub-directory for the pipe */
+	debugfs_root =
+		debugfs_create_dir(sspp_name, entry);
+
+	/* don't error check these */
+	debugfs_create_xul("features", 0600,
+			debugfs_root, (unsigned long *)&hw_pipe->cap->features);
+
+	/* add register dump support */
+	dpu_debugfs_create_regset32("src_blk", 0400,
+			debugfs_root,
+			cfg->base,
+			cfg->len,
+			kms);
+
+	if (sblk->scaler_blk.len)
+		dpu_debugfs_create_regset32("scaler_blk", 0400,
+				debugfs_root,
+				sblk->scaler_blk.base + cfg->base,
+				sblk->scaler_blk.len,
+				kms);
+
+	if (cfg->features & BIT(DPU_SSPP_CSC) ||
+			cfg->features & BIT(DPU_SSPP_CSC_10BIT))
+		dpu_debugfs_create_regset32("csc_blk", 0400,
+				debugfs_root,
+				sblk->csc_blk.base + cfg->base,
+				sblk->csc_blk.len,
+				kms);
+
+	debugfs_create_u32("xin_id",
+			0400,
+			debugfs_root,
+			(u32 *) &cfg->xin_id);
+	debugfs_create_u32("clk_ctrl",
+			0400,
+			debugfs_root,
+			(u32 *) &cfg->clk_ctrl);
+
+	return 0;
+}
+#endif
+
+struct dpu_hw_sspp *dpu_hw_sspp_init(struct drm_device *dev,
+				     const struct dpu_sspp_cfg *cfg,
+				     void __iomem *addr,
+				     const struct msm_mdss_data *mdss_data,
+				     const struct dpu_mdss_version *mdss_rev)
+{
+	struct dpu_hw_sspp *hw_pipe;
+
+	if (!addr)
+		return ERR_PTR(-EINVAL);
+
+	hw_pipe = drmm_kzalloc(dev, sizeof(*hw_pipe), GFP_KERNEL);
+	if (!hw_pipe)
+		return ERR_PTR(-ENOMEM);
+
+	hw_pipe->hw.blk_addr = addr + cfg->base;
+	hw_pipe->hw.log_mask = DPU_DBG_MASK_SSPP;
+
+	/* Assign ops */
+	hw_pipe->ubwc = mdss_data;
+	hw_pipe->idx = cfg->id;
+	hw_pipe->cap = cfg;
+	_setup_layer_ops(hw_pipe, hw_pipe->cap->features, mdss_rev);
+
+	return hw_pipe;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_sspp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_sspp.h
@@ -0,0 +1,337 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_SSPP_H
+#define _DPU_HW_SSPP_H
+
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+#include "dpu_formats.h"
+
+struct dpu_hw_sspp;
+
+/**
+ * Flags
+ */
+#define DPU_SSPP_FLIP_LR		BIT(0)
+#define DPU_SSPP_FLIP_UD		BIT(1)
+#define DPU_SSPP_SOURCE_ROTATED_90	BIT(2)
+#define DPU_SSPP_ROT_90			BIT(3)
+#define DPU_SSPP_SOLID_FILL		BIT(4)
+
+/**
+ * Component indices
+ */
+enum {
+	DPU_SSPP_COMP_0,
+	DPU_SSPP_COMP_1_2,
+	DPU_SSPP_COMP_2,
+	DPU_SSPP_COMP_3,
+
+	DPU_SSPP_COMP_MAX
+};
+
+/**
+ * DPU_SSPP_RECT_SOLO - multirect disabled
+ * DPU_SSPP_RECT_0 - rect0 of a multirect pipe
+ * DPU_SSPP_RECT_1 - rect1 of a multirect pipe
+ *
+ * Note: HW supports multirect with either RECT0 or
+ * RECT1. Considering no benefit of such configs over
+ * SOLO mode and to keep the plane management simple,
+ * we dont support single rect multirect configs.
+ */
+enum dpu_sspp_multirect_index {
+	DPU_SSPP_RECT_SOLO = 0,
+	DPU_SSPP_RECT_0,
+	DPU_SSPP_RECT_1,
+};
+
+enum dpu_sspp_multirect_mode {
+	DPU_SSPP_MULTIRECT_NONE = 0,
+	DPU_SSPP_MULTIRECT_PARALLEL,
+	DPU_SSPP_MULTIRECT_TIME_MX,
+};
+
+enum {
+	DPU_FRAME_LINEAR,
+	DPU_FRAME_TILE_A4X,
+	DPU_FRAME_TILE_A5X,
+};
+
+enum dpu_hw_filter {
+	DPU_SCALE_FILTER_NEAREST = 0,
+	DPU_SCALE_FILTER_BIL,
+	DPU_SCALE_FILTER_PCMN,
+	DPU_SCALE_FILTER_CA,
+	DPU_SCALE_FILTER_MAX
+};
+
+enum dpu_hw_filter_alpa {
+	DPU_SCALE_ALPHA_PIXEL_REP,
+	DPU_SCALE_ALPHA_BIL
+};
+
+enum dpu_hw_filter_yuv {
+	DPU_SCALE_2D_4X4,
+	DPU_SCALE_2D_CIR,
+	DPU_SCALE_1D_SEP,
+	DPU_SCALE_BIL
+};
+
+struct dpu_hw_sharp_cfg {
+	u32 strength;
+	u32 edge_thr;
+	u32 smooth_thr;
+	u32 noise_thr;
+};
+
+struct dpu_hw_pixel_ext {
+	/* scaling factors are enabled for this input layer */
+	uint8_t enable_pxl_ext;
+
+	int init_phase_x[DPU_MAX_PLANES];
+	int phase_step_x[DPU_MAX_PLANES];
+	int init_phase_y[DPU_MAX_PLANES];
+	int phase_step_y[DPU_MAX_PLANES];
+
+	/*
+	 * Number of pixels extension in left, right, top and bottom direction
+	 * for all color components. This pixel value for each color component
+	 * should be sum of fetch + repeat pixels.
+	 */
+	int num_ext_pxls_left[DPU_MAX_PLANES];
+	int num_ext_pxls_right[DPU_MAX_PLANES];
+	int num_ext_pxls_top[DPU_MAX_PLANES];
+	int num_ext_pxls_btm[DPU_MAX_PLANES];
+
+	/*
+	 * Number of pixels needs to be overfetched in left, right, top and
+	 * bottom directions from source image for scaling.
+	 */
+	int left_ftch[DPU_MAX_PLANES];
+	int right_ftch[DPU_MAX_PLANES];
+	int top_ftch[DPU_MAX_PLANES];
+	int btm_ftch[DPU_MAX_PLANES];
+
+	/*
+	 * Number of pixels needs to be repeated in left, right, top and
+	 * bottom directions for scaling.
+	 */
+	int left_rpt[DPU_MAX_PLANES];
+	int right_rpt[DPU_MAX_PLANES];
+	int top_rpt[DPU_MAX_PLANES];
+	int btm_rpt[DPU_MAX_PLANES];
+
+	uint32_t roi_w[DPU_MAX_PLANES];
+	uint32_t roi_h[DPU_MAX_PLANES];
+
+	/*
+	 * Filter type to be used for scaling in horizontal and vertical
+	 * directions
+	 */
+	enum dpu_hw_filter horz_filter[DPU_MAX_PLANES];
+	enum dpu_hw_filter vert_filter[DPU_MAX_PLANES];
+
+};
+
+/**
+ * struct dpu_sw_pipe_cfg : software pipe configuration
+ * @src_rect:  src ROI, caller takes into account the different operations
+ *             such as decimation, flip etc to program this field
+ * @dest_rect: destination ROI.
+ */
+struct dpu_sw_pipe_cfg {
+	struct drm_rect src_rect;
+	struct drm_rect dst_rect;
+};
+
+/**
+ * struct dpu_hw_pipe_ts_cfg - traffic shaper configuration
+ * @size: size to prefill in bytes, or zero to disable
+ * @time: time to prefill in usec, or zero to disable
+ */
+struct dpu_hw_pipe_ts_cfg {
+	u64 size;
+	u64 time;
+};
+
+/**
+ * struct dpu_sw_pipe - software pipe description
+ * @sspp:      backing SSPP pipe
+ * @index:     index of the rectangle of SSPP
+ * @mode:      parallel or time multiplex multirect mode
+ */
+struct dpu_sw_pipe {
+	struct dpu_hw_sspp *sspp;
+	enum dpu_sspp_multirect_index multirect_index;
+	enum dpu_sspp_multirect_mode multirect_mode;
+};
+
+/**
+ * struct dpu_hw_sspp_ops - interface to the SSPP Hw driver functions
+ * Caller must call the init function to get the pipe context for each pipe
+ * Assumption is these functions will be called after clocks are enabled
+ */
+struct dpu_hw_sspp_ops {
+	/**
+	 * setup_format - setup pixel format cropping rectangle, flip
+	 * @pipe: Pointer to software pipe context
+	 * @cfg: Pointer to pipe config structure
+	 * @flags: Extra flags for format config
+	 */
+	void (*setup_format)(struct dpu_sw_pipe *pipe,
+			     const struct dpu_format *fmt, u32 flags);
+
+	/**
+	 * setup_rects - setup pipe ROI rectangles
+	 * @pipe: Pointer to software pipe context
+	 * @cfg: Pointer to pipe config structure
+	 */
+	void (*setup_rects)(struct dpu_sw_pipe *pipe,
+			    struct dpu_sw_pipe_cfg *cfg);
+
+	/**
+	 * setup_pe - setup pipe pixel extension
+	 * @ctx: Pointer to pipe context
+	 * @pe_ext: Pointer to pixel ext settings
+	 */
+	void (*setup_pe)(struct dpu_hw_sspp *ctx,
+			struct dpu_hw_pixel_ext *pe_ext);
+
+	/**
+	 * setup_sourceaddress - setup pipe source addresses
+	 * @pipe: Pointer to software pipe context
+	 * @layout: format layout information for programming buffer to hardware
+	 */
+	void (*setup_sourceaddress)(struct dpu_sw_pipe *ctx,
+				    struct dpu_hw_fmt_layout *layout);
+
+	/**
+	 * setup_csc - setup color space coversion
+	 * @ctx: Pointer to pipe context
+	 * @data: Pointer to config structure
+	 */
+	void (*setup_csc)(struct dpu_hw_sspp *ctx, const struct dpu_csc_cfg *data);
+
+	/**
+	 * setup_solidfill - enable/disable colorfill
+	 * @pipe: Pointer to software pipe context
+	 * @const_color: Fill color value
+	 * @flags: Pipe flags
+	 */
+	void (*setup_solidfill)(struct dpu_sw_pipe *pipe, u32 color);
+
+	/**
+	 * setup_multirect - setup multirect configuration
+	 * @pipe: Pointer to software pipe context
+	 */
+
+	void (*setup_multirect)(struct dpu_sw_pipe *pipe);
+
+	/**
+	 * setup_sharpening - setup sharpening
+	 * @ctx: Pointer to pipe context
+	 * @cfg: Pointer to config structure
+	 */
+	void (*setup_sharpening)(struct dpu_hw_sspp *ctx,
+			struct dpu_hw_sharp_cfg *cfg);
+
+
+	/**
+	 * setup_qos_lut - setup QoS LUTs
+	 * @ctx: Pointer to pipe context
+	 * @cfg: LUT configuration
+	 */
+	void (*setup_qos_lut)(struct dpu_hw_sspp *ctx,
+			struct dpu_hw_qos_cfg *cfg);
+
+	/**
+	 * setup_qos_ctrl - setup QoS control
+	 * @ctx: Pointer to pipe context
+	 * @danger_safe_en: flags controlling enabling of danger/safe QoS/LUT
+	 */
+	void (*setup_qos_ctrl)(struct dpu_hw_sspp *ctx,
+			       bool danger_safe_en);
+
+	/**
+	 * setup_clk_force_ctrl - setup clock force control
+	 * @ctx: Pointer to pipe context
+	 * @enable: enable clock force if true
+	 */
+	bool (*setup_clk_force_ctrl)(struct dpu_hw_sspp *ctx,
+				     bool enable);
+
+	/**
+	 * setup_histogram - setup histograms
+	 * @ctx: Pointer to pipe context
+	 * @cfg: Pointer to histogram configuration
+	 */
+	void (*setup_histogram)(struct dpu_hw_sspp *ctx,
+			void *cfg);
+
+	/**
+	 * setup_scaler - setup scaler
+	 * @scaler3_cfg: Pointer to scaler configuration
+	 * @format: pixel format parameters
+	 */
+	void (*setup_scaler)(struct dpu_hw_sspp *ctx,
+		struct dpu_hw_scaler3_cfg *scaler3_cfg,
+		const struct dpu_format *format);
+
+	/**
+	 * setup_cdp - setup client driven prefetch
+	 * @pipe: Pointer to software pipe context
+	 * @fmt: format used by the sw pipe
+	 * @enable: whether the CDP should be enabled for this pipe
+	 */
+	void (*setup_cdp)(struct dpu_sw_pipe *pipe,
+			  const struct dpu_format *fmt,
+			  bool enable);
+};
+
+/**
+ * struct dpu_hw_sspp - pipe description
+ * @base: hardware block base structure
+ * @hw: block hardware details
+ * @ubwc: UBWC configuration data
+ * @idx: pipe index
+ * @cap: pointer to layer_cfg
+ * @ops: pointer to operations possible for this pipe
+ */
+struct dpu_hw_sspp {
+	struct dpu_hw_blk base;
+	struct dpu_hw_blk_reg_map hw;
+	const struct msm_mdss_data *ubwc;
+
+	/* Pipe */
+	enum dpu_sspp idx;
+	const struct dpu_sspp_cfg *cap;
+
+	/* Ops */
+	struct dpu_hw_sspp_ops ops;
+};
+
+struct dpu_kms;
+/**
+ * dpu_hw_sspp_init() - Initializes the sspp hw driver object.
+ * Should be called once before accessing every pipe.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  Pipe catalog entry for which driver object is required
+ * @addr: Mapped register io address of MDP
+ * @mdss_data: UBWC / MDSS configuration data
+ * @mdss_rev: dpu core's major and minor versions
+ */
+struct dpu_hw_sspp *dpu_hw_sspp_init(struct drm_device *dev,
+				     const struct dpu_sspp_cfg *cfg,
+				     void __iomem *addr,
+				     const struct msm_mdss_data *mdss_data,
+				     const struct dpu_mdss_version *mdss_rev);
+
+int _dpu_hw_sspp_init_debugfs(struct dpu_hw_sspp *hw_pipe, struct dpu_kms *kms,
+			      struct dentry *entry);
+
+#endif /*_DPU_HW_SSPP_H */
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_top.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_top.c
@@ -0,0 +1,276 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#include <drm/drm_managed.h>
+
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_top.h"
+#include "dpu_kms.h"
+
+#define FLD_SPLIT_DISPLAY_CMD             BIT(1)
+#define FLD_SMART_PANEL_FREE_RUN          BIT(2)
+#define FLD_INTF_1_SW_TRG_MUX             BIT(4)
+#define FLD_INTF_2_SW_TRG_MUX             BIT(8)
+#define FLD_TE_LINE_INTER_WATERLEVEL_MASK 0xFFFF
+
+#define TRAFFIC_SHAPER_EN                 BIT(31)
+#define TRAFFIC_SHAPER_RD_CLIENT(num)     (0x030 + (num * 4))
+#define TRAFFIC_SHAPER_WR_CLIENT(num)     (0x060 + (num * 4))
+#define TRAFFIC_SHAPER_FIXPOINT_FACTOR    4
+
+#define MDP_TICK_COUNT                    16
+#define XO_CLK_RATE                       19200
+#define MS_TICKS_IN_SEC                   1000
+
+#define CALCULATE_WD_LOAD_VALUE(fps) \
+	((uint32_t)((MS_TICKS_IN_SEC * XO_CLK_RATE)/(MDP_TICK_COUNT * fps)))
+
+static void dpu_hw_setup_split_pipe(struct dpu_hw_mdp *mdp,
+		struct split_pipe_cfg *cfg)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 upper_pipe = 0;
+	u32 lower_pipe = 0;
+
+	if (!mdp || !cfg)
+		return;
+
+	c = &mdp->hw;
+
+	if (cfg->en) {
+		if (cfg->mode == INTF_MODE_CMD) {
+			lower_pipe = FLD_SPLIT_DISPLAY_CMD;
+			/* interface controlling sw trigger */
+			if (cfg->intf == INTF_2)
+				lower_pipe |= FLD_INTF_1_SW_TRG_MUX;
+			else
+				lower_pipe |= FLD_INTF_2_SW_TRG_MUX;
+			upper_pipe = lower_pipe;
+		} else {
+			if (cfg->intf == INTF_2) {
+				lower_pipe = FLD_INTF_1_SW_TRG_MUX;
+				upper_pipe = FLD_INTF_2_SW_TRG_MUX;
+			} else {
+				lower_pipe = FLD_INTF_2_SW_TRG_MUX;
+				upper_pipe = FLD_INTF_1_SW_TRG_MUX;
+			}
+		}
+	}
+
+	DPU_REG_WRITE(c, SSPP_SPARE, cfg->split_flush_en ? 0x1 : 0x0);
+	DPU_REG_WRITE(c, SPLIT_DISPLAY_LOWER_PIPE_CTRL, lower_pipe);
+	DPU_REG_WRITE(c, SPLIT_DISPLAY_UPPER_PIPE_CTRL, upper_pipe);
+	DPU_REG_WRITE(c, SPLIT_DISPLAY_EN, cfg->en & 0x1);
+}
+
+static bool dpu_hw_setup_clk_force_ctrl(struct dpu_hw_mdp *mdp,
+		enum dpu_clk_ctrl_type clk_ctrl, bool enable)
+{
+	if (!mdp)
+		return false;
+
+	if (clk_ctrl <= DPU_CLK_CTRL_NONE || clk_ctrl >= DPU_CLK_CTRL_MAX)
+		return false;
+
+	return dpu_hw_clk_force_ctrl(&mdp->hw, &mdp->caps->clk_ctrls[clk_ctrl], enable);
+}
+
+
+static void dpu_hw_get_danger_status(struct dpu_hw_mdp *mdp,
+		struct dpu_danger_safe_status *status)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 value;
+
+	if (!mdp || !status)
+		return;
+
+	c = &mdp->hw;
+
+	value = DPU_REG_READ(c, DANGER_STATUS);
+	status->mdp = (value >> 0) & 0x3;
+	status->sspp[SSPP_VIG0] = (value >> 4) & 0x3;
+	status->sspp[SSPP_VIG1] = (value >> 6) & 0x3;
+	status->sspp[SSPP_VIG2] = (value >> 8) & 0x3;
+	status->sspp[SSPP_VIG3] = (value >> 10) & 0x3;
+	status->sspp[SSPP_RGB0] = (value >> 12) & 0x3;
+	status->sspp[SSPP_RGB1] = (value >> 14) & 0x3;
+	status->sspp[SSPP_RGB2] = (value >> 16) & 0x3;
+	status->sspp[SSPP_RGB3] = (value >> 18) & 0x3;
+	status->sspp[SSPP_DMA0] = (value >> 20) & 0x3;
+	status->sspp[SSPP_DMA1] = (value >> 22) & 0x3;
+	status->sspp[SSPP_DMA2] = (value >> 28) & 0x3;
+	status->sspp[SSPP_DMA3] = (value >> 30) & 0x3;
+	status->sspp[SSPP_CURSOR0] = (value >> 24) & 0x3;
+	status->sspp[SSPP_CURSOR1] = (value >> 26) & 0x3;
+}
+
+static void dpu_hw_setup_vsync_source(struct dpu_hw_mdp *mdp,
+		struct dpu_vsync_source_cfg *cfg)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 reg, wd_load_value, wd_ctl, wd_ctl2;
+
+	if (!mdp || !cfg)
+		return;
+
+	c = &mdp->hw;
+
+	if (cfg->vsync_source >= DPU_VSYNC_SOURCE_WD_TIMER_4 &&
+			cfg->vsync_source <= DPU_VSYNC_SOURCE_WD_TIMER_0) {
+		switch (cfg->vsync_source) {
+		case DPU_VSYNC_SOURCE_WD_TIMER_4:
+			wd_load_value = MDP_WD_TIMER_4_LOAD_VALUE;
+			wd_ctl = MDP_WD_TIMER_4_CTL;
+			wd_ctl2 = MDP_WD_TIMER_4_CTL2;
+			break;
+		case DPU_VSYNC_SOURCE_WD_TIMER_3:
+			wd_load_value = MDP_WD_TIMER_3_LOAD_VALUE;
+			wd_ctl = MDP_WD_TIMER_3_CTL;
+			wd_ctl2 = MDP_WD_TIMER_3_CTL2;
+			break;
+		case DPU_VSYNC_SOURCE_WD_TIMER_2:
+			wd_load_value = MDP_WD_TIMER_2_LOAD_VALUE;
+			wd_ctl = MDP_WD_TIMER_2_CTL;
+			wd_ctl2 = MDP_WD_TIMER_2_CTL2;
+			break;
+		case DPU_VSYNC_SOURCE_WD_TIMER_1:
+			wd_load_value = MDP_WD_TIMER_1_LOAD_VALUE;
+			wd_ctl = MDP_WD_TIMER_1_CTL;
+			wd_ctl2 = MDP_WD_TIMER_1_CTL2;
+			break;
+		case DPU_VSYNC_SOURCE_WD_TIMER_0:
+		default:
+			wd_load_value = MDP_WD_TIMER_0_LOAD_VALUE;
+			wd_ctl = MDP_WD_TIMER_0_CTL;
+			wd_ctl2 = MDP_WD_TIMER_0_CTL2;
+			break;
+		}
+
+		DPU_REG_WRITE(c, wd_load_value,
+			CALCULATE_WD_LOAD_VALUE(cfg->frame_rate));
+
+		DPU_REG_WRITE(c, wd_ctl, BIT(0)); /* clear timer */
+		reg = DPU_REG_READ(c, wd_ctl2);
+		reg |= BIT(8);		/* enable heartbeat timer */
+		reg |= BIT(0);		/* enable WD timer */
+		DPU_REG_WRITE(c, wd_ctl2, reg);
+
+		/* make sure that timers are enabled/disabled for vsync state */
+		wmb();
+	}
+}
+
+static void dpu_hw_setup_vsync_source_and_vsync_sel(struct dpu_hw_mdp *mdp,
+		struct dpu_vsync_source_cfg *cfg)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 reg, i;
+	static const u32 pp_offset[PINGPONG_MAX] = {0xC, 0x8, 0x4, 0x13, 0x18};
+
+	if (!mdp || !cfg || (cfg->pp_count > ARRAY_SIZE(cfg->ppnumber)))
+		return;
+
+	c = &mdp->hw;
+
+	reg = DPU_REG_READ(c, MDP_VSYNC_SEL);
+	for (i = 0; i < cfg->pp_count; i++) {
+		int pp_idx = cfg->ppnumber[i] - PINGPONG_0;
+
+		if (pp_idx >= ARRAY_SIZE(pp_offset))
+			continue;
+
+		reg &= ~(0xf << pp_offset[pp_idx]);
+		reg |= (cfg->vsync_source & 0xf) << pp_offset[pp_idx];
+	}
+	DPU_REG_WRITE(c, MDP_VSYNC_SEL, reg);
+
+	dpu_hw_setup_vsync_source(mdp, cfg);
+}
+
+static void dpu_hw_get_safe_status(struct dpu_hw_mdp *mdp,
+		struct dpu_danger_safe_status *status)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 value;
+
+	if (!mdp || !status)
+		return;
+
+	c = &mdp->hw;
+
+	value = DPU_REG_READ(c, SAFE_STATUS);
+	status->mdp = (value >> 0) & 0x1;
+	status->sspp[SSPP_VIG0] = (value >> 4) & 0x1;
+	status->sspp[SSPP_VIG1] = (value >> 6) & 0x1;
+	status->sspp[SSPP_VIG2] = (value >> 8) & 0x1;
+	status->sspp[SSPP_VIG3] = (value >> 10) & 0x1;
+	status->sspp[SSPP_RGB0] = (value >> 12) & 0x1;
+	status->sspp[SSPP_RGB1] = (value >> 14) & 0x1;
+	status->sspp[SSPP_RGB2] = (value >> 16) & 0x1;
+	status->sspp[SSPP_RGB3] = (value >> 18) & 0x1;
+	status->sspp[SSPP_DMA0] = (value >> 20) & 0x1;
+	status->sspp[SSPP_DMA1] = (value >> 22) & 0x1;
+	status->sspp[SSPP_DMA2] = (value >> 28) & 0x1;
+	status->sspp[SSPP_DMA3] = (value >> 30) & 0x1;
+	status->sspp[SSPP_CURSOR0] = (value >> 24) & 0x1;
+	status->sspp[SSPP_CURSOR1] = (value >> 26) & 0x1;
+}
+
+static void dpu_hw_intf_audio_select(struct dpu_hw_mdp *mdp)
+{
+	struct dpu_hw_blk_reg_map *c;
+
+	if (!mdp)
+		return;
+
+	c = &mdp->hw;
+
+	DPU_REG_WRITE(c, HDMI_DP_CORE_SELECT, 0x1);
+}
+
+static void _setup_mdp_ops(struct dpu_hw_mdp_ops *ops,
+		unsigned long cap)
+{
+	ops->setup_split_pipe = dpu_hw_setup_split_pipe;
+	ops->setup_clk_force_ctrl = dpu_hw_setup_clk_force_ctrl;
+	ops->get_danger_status = dpu_hw_get_danger_status;
+
+	if (cap & BIT(DPU_MDP_VSYNC_SEL))
+		ops->setup_vsync_source = dpu_hw_setup_vsync_source_and_vsync_sel;
+	else
+		ops->setup_vsync_source = dpu_hw_setup_vsync_source;
+
+	ops->get_safe_status = dpu_hw_get_safe_status;
+
+	if (cap & BIT(DPU_MDP_AUDIO_SELECT))
+		ops->intf_audio_select = dpu_hw_intf_audio_select;
+}
+
+struct dpu_hw_mdp *dpu_hw_mdptop_init(struct drm_device *dev,
+				      const struct dpu_mdp_cfg *cfg,
+				      void __iomem *addr,
+				      const struct dpu_mdss_cfg *m)
+{
+	struct dpu_hw_mdp *mdp;
+
+	if (!addr)
+		return ERR_PTR(-EINVAL);
+
+	mdp = drmm_kzalloc(dev, sizeof(*mdp), GFP_KERNEL);
+	if (!mdp)
+		return ERR_PTR(-ENOMEM);
+
+	mdp->hw.blk_addr = addr + cfg->base;
+	mdp->hw.log_mask = DPU_DBG_MASK_TOP;
+
+	/*
+	 * Assign ops
+	 */
+	mdp->caps = cfg;
+	_setup_mdp_ops(&mdp->ops, mdp->caps->features);
+
+	return mdp;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_top.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_top.h
@@ -0,0 +1,160 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_TOP_H
+#define _DPU_HW_TOP_H
+
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+
+struct dpu_hw_mdp;
+
+/**
+ * struct traffic_shaper_cfg: traffic shaper configuration
+ * @en        : enable/disable traffic shaper
+ * @rd_client : true if read client; false if write client
+ * @client_id : client identifier
+ * @bpc_denom : denominator of byte per clk
+ * @bpc_numer : numerator of byte per clk
+ */
+struct traffic_shaper_cfg {
+	bool en;
+	bool rd_client;
+	u32 client_id;
+	u32 bpc_denom;
+	u64 bpc_numer;
+};
+
+/**
+ * struct split_pipe_cfg - pipe configuration for dual display panels
+ * @en        : Enable/disable dual pipe configuration
+ * @mode      : Panel interface mode
+ * @intf      : Interface id for main control path
+ * @split_flush_en: Allows both the paths to be flushed when master path is
+ *              flushed
+ */
+struct split_pipe_cfg {
+	bool en;
+	enum dpu_intf_mode mode;
+	enum dpu_intf intf;
+	bool split_flush_en;
+};
+
+/**
+ * struct dpu_danger_safe_status: danger and safe status signals
+ * @mdp: top level status
+ * @sspp: source pipe status
+ */
+struct dpu_danger_safe_status {
+	u8 mdp;
+	u8 sspp[SSPP_MAX];
+};
+
+/**
+ * struct dpu_vsync_source_cfg - configure vsync source and configure the
+ *                                    watchdog timers if required.
+ * @pp_count: number of ping pongs active
+ * @frame_rate: Display frame rate
+ * @ppnumber: ping pong index array
+ * @vsync_source: vsync source selection
+ */
+struct dpu_vsync_source_cfg {
+	u32 pp_count;
+	u32 frame_rate;
+	u32 ppnumber[PINGPONG_MAX];
+	u32 vsync_source;
+};
+
+/**
+ * struct dpu_hw_mdp_ops - interface to the MDP TOP Hw driver functions
+ * Assumption is these functions will be called after clocks are enabled.
+ * @setup_split_pipe : Programs the pipe control registers
+ * @setup_pp_split : Programs the pp split control registers
+ * @setup_traffic_shaper : programs traffic shaper control
+ */
+struct dpu_hw_mdp_ops {
+	/** setup_split_pipe() : Registers are not double buffered, thisk
+	 * function should be called before timing control enable
+	 * @mdp  : mdp top context driver
+	 * @cfg  : upper and lower part of pipe configuration
+	 */
+	void (*setup_split_pipe)(struct dpu_hw_mdp *mdp,
+			struct split_pipe_cfg *p);
+
+	/**
+	 * setup_traffic_shaper() : Setup traffic shaper control
+	 * @mdp  : mdp top context driver
+	 * @cfg  : traffic shaper configuration
+	 */
+	void (*setup_traffic_shaper)(struct dpu_hw_mdp *mdp,
+			struct traffic_shaper_cfg *cfg);
+
+	/**
+	 * setup_clk_force_ctrl - set clock force control
+	 * @mdp: mdp top context driver
+	 * @clk_ctrl: clock to be controlled
+	 * @enable: force on enable
+	 * @return: if the clock is forced-on by this function
+	 */
+	bool (*setup_clk_force_ctrl)(struct dpu_hw_mdp *mdp,
+			enum dpu_clk_ctrl_type clk_ctrl, bool enable);
+
+	/**
+	 * get_danger_status - get danger status
+	 * @mdp: mdp top context driver
+	 * @status: Pointer to danger safe status
+	 */
+	void (*get_danger_status)(struct dpu_hw_mdp *mdp,
+			struct dpu_danger_safe_status *status);
+
+	/**
+	 * setup_vsync_source - setup vsync source configuration details
+	 * @mdp: mdp top context driver
+	 * @cfg: vsync source selection configuration
+	 */
+	void (*setup_vsync_source)(struct dpu_hw_mdp *mdp,
+				struct dpu_vsync_source_cfg *cfg);
+
+	/**
+	 * get_safe_status - get safe status
+	 * @mdp: mdp top context driver
+	 * @status: Pointer to danger safe status
+	 */
+	void (*get_safe_status)(struct dpu_hw_mdp *mdp,
+			struct dpu_danger_safe_status *status);
+
+	/**
+	 * intf_audio_select - select the external interface for audio
+	 * @mdp: mdp top context driver
+	 */
+	void (*intf_audio_select)(struct dpu_hw_mdp *mdp);
+};
+
+struct dpu_hw_mdp {
+	struct dpu_hw_blk base;
+	struct dpu_hw_blk_reg_map hw;
+
+	/* top */
+	const struct dpu_mdp_cfg *caps;
+
+	/* ops */
+	struct dpu_hw_mdp_ops ops;
+};
+
+/**
+ * dpu_hw_mdptop_init - initializes the top driver for the passed config
+ * @dev:  Corresponding device for devres management
+ * @cfg:  MDP TOP configuration from catalog
+ * @addr: Mapped register io address of MDP
+ * @m:    Pointer to mdss catalog data
+ */
+struct dpu_hw_mdp *dpu_hw_mdptop_init(struct drm_device *dev,
+				      const struct dpu_mdp_cfg *cfg,
+				      void __iomem *addr,
+				      const struct dpu_mdss_cfg *m);
+
+void dpu_hw_mdp_destroy(struct dpu_hw_mdp *mdp);
+
+#endif /*_DPU_HW_TOP_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_util.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_util.c
@@ -0,0 +1,603 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+
+#include "msm_drv.h"
+#include "dpu_kms.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+
+/* using a file static variables for debugfs access */
+static u32 dpu_hw_util_log_mask = DPU_DBG_MASK_NONE;
+
+/* DPU_SCALER_QSEED3 */
+#define QSEED3_HW_VERSION                  0x00
+#define QSEED3_OP_MODE                     0x04
+#define QSEED3_RGB2Y_COEFF                 0x08
+#define QSEED3_PHASE_INIT                  0x0C
+#define QSEED3_PHASE_STEP_Y_H              0x10
+#define QSEED3_PHASE_STEP_Y_V              0x14
+#define QSEED3_PHASE_STEP_UV_H             0x18
+#define QSEED3_PHASE_STEP_UV_V             0x1C
+#define QSEED3_PRELOAD                     0x20
+#define QSEED3_DE_SHARPEN                  0x24
+#define QSEED3_DE_SHARPEN_CTL              0x28
+#define QSEED3_DE_SHAPE_CTL                0x2C
+#define QSEED3_DE_THRESHOLD                0x30
+#define QSEED3_DE_ADJUST_DATA_0            0x34
+#define QSEED3_DE_ADJUST_DATA_1            0x38
+#define QSEED3_DE_ADJUST_DATA_2            0x3C
+#define QSEED3_SRC_SIZE_Y_RGB_A            0x40
+#define QSEED3_SRC_SIZE_UV                 0x44
+#define QSEED3_DST_SIZE                    0x48
+#define QSEED3_COEF_LUT_CTRL               0x4C
+#define QSEED3_COEF_LUT_SWAP_BIT           0
+#define QSEED3_COEF_LUT_DIR_BIT            1
+#define QSEED3_COEF_LUT_Y_CIR_BIT          2
+#define QSEED3_COEF_LUT_UV_CIR_BIT         3
+#define QSEED3_COEF_LUT_Y_SEP_BIT          4
+#define QSEED3_COEF_LUT_UV_SEP_BIT         5
+#define QSEED3_BUFFER_CTRL                 0x50
+#define QSEED3_CLK_CTRL0                   0x54
+#define QSEED3_CLK_CTRL1                   0x58
+#define QSEED3_CLK_STATUS                  0x5C
+#define QSEED3_PHASE_INIT_Y_H              0x90
+#define QSEED3_PHASE_INIT_Y_V              0x94
+#define QSEED3_PHASE_INIT_UV_H             0x98
+#define QSEED3_PHASE_INIT_UV_V             0x9C
+#define QSEED3_COEF_LUT                    0x100
+#define QSEED3_FILTERS                     5
+#define QSEED3_LUT_REGIONS                 4
+#define QSEED3_CIRCULAR_LUTS               9
+#define QSEED3_SEPARABLE_LUTS              10
+#define QSEED3_LUT_SIZE                    60
+#define QSEED3_ENABLE                      2
+#define QSEED3_DIR_LUT_SIZE                (200 * sizeof(u32))
+#define QSEED3_CIR_LUT_SIZE \
+	(QSEED3_LUT_SIZE * QSEED3_CIRCULAR_LUTS * sizeof(u32))
+#define QSEED3_SEP_LUT_SIZE \
+	(QSEED3_LUT_SIZE * QSEED3_SEPARABLE_LUTS * sizeof(u32))
+
+/* DPU_SCALER_QSEED3LITE */
+#define QSEED3LITE_COEF_LUT_Y_SEP_BIT         4
+#define QSEED3LITE_COEF_LUT_UV_SEP_BIT        5
+#define QSEED3LITE_COEF_LUT_CTRL              0x4C
+#define QSEED3LITE_COEF_LUT_SWAP_BIT          0
+#define QSEED3LITE_DIR_FILTER_WEIGHT          0x60
+#define QSEED3LITE_FILTERS                 2
+#define QSEED3LITE_SEPARABLE_LUTS             10
+#define QSEED3LITE_LUT_SIZE                   33
+#define QSEED3LITE_SEP_LUT_SIZE \
+	        (QSEED3LITE_LUT_SIZE * QSEED3LITE_SEPARABLE_LUTS * sizeof(u32))
+
+/* QOS_LUT */
+#define QOS_DANGER_LUT                    0x00
+#define QOS_SAFE_LUT                      0x04
+#define QOS_CREQ_LUT                      0x08
+#define QOS_QOS_CTRL                      0x0C
+#define QOS_CREQ_LUT_0                    0x14
+#define QOS_CREQ_LUT_1                    0x18
+
+/* QOS_QOS_CTRL */
+#define QOS_QOS_CTRL_DANGER_SAFE_EN       BIT(0)
+#define QOS_QOS_CTRL_DANGER_VBLANK_MASK   GENMASK(5, 4)
+#define QOS_QOS_CTRL_VBLANK_EN            BIT(16)
+#define QOS_QOS_CTRL_CREQ_VBLANK_MASK     GENMASK(21, 20)
+
+void dpu_reg_write(struct dpu_hw_blk_reg_map *c,
+		u32 reg_off,
+		u32 val,
+		const char *name)
+{
+	/* don't need to mutex protect this */
+	if (c->log_mask & dpu_hw_util_log_mask)
+		DPU_DEBUG_DRIVER("[%s:0x%X] <= 0x%X\n",
+				name, reg_off, val);
+	writel_relaxed(val, c->blk_addr + reg_off);
+}
+
+int dpu_reg_read(struct dpu_hw_blk_reg_map *c, u32 reg_off)
+{
+	return readl_relaxed(c->blk_addr + reg_off);
+}
+
+u32 *dpu_hw_util_get_log_mask_ptr(void)
+{
+	return &dpu_hw_util_log_mask;
+}
+
+static void _dpu_hw_setup_scaler3_lut(struct dpu_hw_blk_reg_map *c,
+		struct dpu_hw_scaler3_cfg *scaler3_cfg, u32 offset)
+{
+	int i, j, filter;
+	int config_lut = 0x0;
+	unsigned long lut_flags;
+	u32 lut_addr, lut_offset, lut_len;
+	u32 *lut[QSEED3_FILTERS] = {NULL, NULL, NULL, NULL, NULL};
+	static const uint32_t off_tbl[QSEED3_FILTERS][QSEED3_LUT_REGIONS][2] = {
+		{{18, 0x000}, {12, 0x120}, {12, 0x1E0}, {8, 0x2A0} },
+		{{6, 0x320}, {3, 0x3E0}, {3, 0x440}, {3, 0x4A0} },
+		{{6, 0x500}, {3, 0x5c0}, {3, 0x620}, {3, 0x680} },
+		{{6, 0x380}, {3, 0x410}, {3, 0x470}, {3, 0x4d0} },
+		{{6, 0x560}, {3, 0x5f0}, {3, 0x650}, {3, 0x6b0} },
+	};
+
+	lut_flags = (unsigned long) scaler3_cfg->lut_flag;
+	if (test_bit(QSEED3_COEF_LUT_DIR_BIT, &lut_flags) &&
+		(scaler3_cfg->dir_len == QSEED3_DIR_LUT_SIZE)) {
+		lut[0] = scaler3_cfg->dir_lut;
+		config_lut = 1;
+	}
+	if (test_bit(QSEED3_COEF_LUT_Y_CIR_BIT, &lut_flags) &&
+		(scaler3_cfg->y_rgb_cir_lut_idx < QSEED3_CIRCULAR_LUTS) &&
+		(scaler3_cfg->cir_len == QSEED3_CIR_LUT_SIZE)) {
+		lut[1] = scaler3_cfg->cir_lut +
+			scaler3_cfg->y_rgb_cir_lut_idx * QSEED3_LUT_SIZE;
+		config_lut = 1;
+	}
+	if (test_bit(QSEED3_COEF_LUT_UV_CIR_BIT, &lut_flags) &&
+		(scaler3_cfg->uv_cir_lut_idx < QSEED3_CIRCULAR_LUTS) &&
+		(scaler3_cfg->cir_len == QSEED3_CIR_LUT_SIZE)) {
+		lut[2] = scaler3_cfg->cir_lut +
+			scaler3_cfg->uv_cir_lut_idx * QSEED3_LUT_SIZE;
+		config_lut = 1;
+	}
+	if (test_bit(QSEED3_COEF_LUT_Y_SEP_BIT, &lut_flags) &&
+		(scaler3_cfg->y_rgb_sep_lut_idx < QSEED3_SEPARABLE_LUTS) &&
+		(scaler3_cfg->sep_len == QSEED3_SEP_LUT_SIZE)) {
+		lut[3] = scaler3_cfg->sep_lut +
+			scaler3_cfg->y_rgb_sep_lut_idx * QSEED3_LUT_SIZE;
+		config_lut = 1;
+	}
+	if (test_bit(QSEED3_COEF_LUT_UV_SEP_BIT, &lut_flags) &&
+		(scaler3_cfg->uv_sep_lut_idx < QSEED3_SEPARABLE_LUTS) &&
+		(scaler3_cfg->sep_len == QSEED3_SEP_LUT_SIZE)) {
+		lut[4] = scaler3_cfg->sep_lut +
+			scaler3_cfg->uv_sep_lut_idx * QSEED3_LUT_SIZE;
+		config_lut = 1;
+	}
+
+	if (config_lut) {
+		for (filter = 0; filter < QSEED3_FILTERS; filter++) {
+			if (!lut[filter])
+				continue;
+			lut_offset = 0;
+			for (i = 0; i < QSEED3_LUT_REGIONS; i++) {
+				lut_addr = QSEED3_COEF_LUT + offset
+					+ off_tbl[filter][i][1];
+				lut_len = off_tbl[filter][i][0] << 2;
+				for (j = 0; j < lut_len; j++) {
+					DPU_REG_WRITE(c,
+						lut_addr,
+						(lut[filter])[lut_offset++]);
+					lut_addr += 4;
+				}
+			}
+		}
+	}
+
+	if (test_bit(QSEED3_COEF_LUT_SWAP_BIT, &lut_flags))
+		DPU_REG_WRITE(c, QSEED3_COEF_LUT_CTRL + offset, BIT(0));
+
+}
+
+static void _dpu_hw_setup_scaler3lite_lut(struct dpu_hw_blk_reg_map *c,
+		struct dpu_hw_scaler3_cfg *scaler3_cfg, u32 offset)
+{
+	int j, filter;
+	int config_lut = 0x0;
+	unsigned long lut_flags;
+	u32 lut_addr, lut_offset;
+	u32 *lut[QSEED3LITE_FILTERS] = {NULL, NULL};
+	static const uint32_t off_tbl[QSEED3_FILTERS] = { 0x000, 0x200 };
+
+	DPU_REG_WRITE(c, QSEED3LITE_DIR_FILTER_WEIGHT + offset, scaler3_cfg->dir_weight);
+
+	if (!scaler3_cfg->sep_lut)
+		return;
+
+	lut_flags = (unsigned long) scaler3_cfg->lut_flag;
+	if (test_bit(QSEED3_COEF_LUT_Y_SEP_BIT, &lut_flags) &&
+		(scaler3_cfg->y_rgb_sep_lut_idx < QSEED3LITE_SEPARABLE_LUTS) &&
+		(scaler3_cfg->sep_len == QSEED3LITE_SEP_LUT_SIZE)) {
+		lut[0] = scaler3_cfg->sep_lut +
+			scaler3_cfg->y_rgb_sep_lut_idx * QSEED3LITE_LUT_SIZE;
+		config_lut = 1;
+	}
+	if (test_bit(QSEED3_COEF_LUT_UV_SEP_BIT, &lut_flags) &&
+		(scaler3_cfg->uv_sep_lut_idx < QSEED3LITE_SEPARABLE_LUTS) &&
+		(scaler3_cfg->sep_len == QSEED3LITE_SEP_LUT_SIZE)) {
+		lut[1] = scaler3_cfg->sep_lut +
+			scaler3_cfg->uv_sep_lut_idx * QSEED3LITE_LUT_SIZE;
+		config_lut = 1;
+	}
+
+	if (config_lut) {
+		for (filter = 0; filter < QSEED3LITE_FILTERS; filter++) {
+			if (!lut[filter])
+				continue;
+			lut_offset = 0;
+			lut_addr = QSEED3_COEF_LUT + offset + off_tbl[filter];
+			for (j = 0; j < QSEED3LITE_LUT_SIZE; j++) {
+				DPU_REG_WRITE(c,
+					lut_addr,
+					(lut[filter])[lut_offset++]);
+				lut_addr += 4;
+			}
+		}
+	}
+
+	if (test_bit(QSEED3_COEF_LUT_SWAP_BIT, &lut_flags))
+		DPU_REG_WRITE(c, QSEED3_COEF_LUT_CTRL + offset, BIT(0));
+
+}
+
+static void _dpu_hw_setup_scaler3_de(struct dpu_hw_blk_reg_map *c,
+		struct dpu_hw_scaler3_de_cfg *de_cfg, u32 offset)
+{
+	u32 sharp_lvl, sharp_ctl, shape_ctl, de_thr;
+	u32 adjust_a, adjust_b, adjust_c;
+
+	if (!de_cfg->enable)
+		return;
+
+	sharp_lvl = (de_cfg->sharpen_level1 & 0x1FF) |
+		((de_cfg->sharpen_level2 & 0x1FF) << 16);
+
+	sharp_ctl = ((de_cfg->limit & 0xF) << 9) |
+		((de_cfg->prec_shift & 0x7) << 13) |
+		((de_cfg->clip & 0x7) << 16);
+
+	shape_ctl = (de_cfg->thr_quiet & 0xFF) |
+		((de_cfg->thr_dieout & 0x3FF) << 16);
+
+	de_thr = (de_cfg->thr_low & 0x3FF) |
+		((de_cfg->thr_high & 0x3FF) << 16);
+
+	adjust_a = (de_cfg->adjust_a[0] & 0x3FF) |
+		((de_cfg->adjust_a[1] & 0x3FF) << 10) |
+		((de_cfg->adjust_a[2] & 0x3FF) << 20);
+
+	adjust_b = (de_cfg->adjust_b[0] & 0x3FF) |
+		((de_cfg->adjust_b[1] & 0x3FF) << 10) |
+		((de_cfg->adjust_b[2] & 0x3FF) << 20);
+
+	adjust_c = (de_cfg->adjust_c[0] & 0x3FF) |
+		((de_cfg->adjust_c[1] & 0x3FF) << 10) |
+		((de_cfg->adjust_c[2] & 0x3FF) << 20);
+
+	DPU_REG_WRITE(c, QSEED3_DE_SHARPEN + offset, sharp_lvl);
+	DPU_REG_WRITE(c, QSEED3_DE_SHARPEN_CTL + offset, sharp_ctl);
+	DPU_REG_WRITE(c, QSEED3_DE_SHAPE_CTL + offset, shape_ctl);
+	DPU_REG_WRITE(c, QSEED3_DE_THRESHOLD + offset, de_thr);
+	DPU_REG_WRITE(c, QSEED3_DE_ADJUST_DATA_0 + offset, adjust_a);
+	DPU_REG_WRITE(c, QSEED3_DE_ADJUST_DATA_1 + offset, adjust_b);
+	DPU_REG_WRITE(c, QSEED3_DE_ADJUST_DATA_2 + offset, adjust_c);
+
+}
+
+void dpu_hw_setup_scaler3(struct dpu_hw_blk_reg_map *c,
+		struct dpu_hw_scaler3_cfg *scaler3_cfg,
+		u32 scaler_offset, u32 scaler_version,
+		const struct dpu_format *format)
+{
+	u32 op_mode = 0;
+	u32 phase_init, preload, src_y_rgb, src_uv, dst;
+
+	if (!scaler3_cfg->enable)
+		goto end;
+
+	op_mode |= BIT(0);
+	op_mode |= (scaler3_cfg->y_rgb_filter_cfg & 0x3) << 16;
+
+	if (format && DPU_FORMAT_IS_YUV(format)) {
+		op_mode |= BIT(12);
+		op_mode |= (scaler3_cfg->uv_filter_cfg & 0x3) << 24;
+	}
+
+	op_mode |= (scaler3_cfg->blend_cfg & 1) << 31;
+	op_mode |= (scaler3_cfg->dir_en) ? BIT(4) : 0;
+
+	preload =
+		((scaler3_cfg->preload_x[0] & 0x7F) << 0) |
+		((scaler3_cfg->preload_y[0] & 0x7F) << 8) |
+		((scaler3_cfg->preload_x[1] & 0x7F) << 16) |
+		((scaler3_cfg->preload_y[1] & 0x7F) << 24);
+
+	src_y_rgb = (scaler3_cfg->src_width[0] & 0x1FFFF) |
+		((scaler3_cfg->src_height[0] & 0x1FFFF) << 16);
+
+	src_uv = (scaler3_cfg->src_width[1] & 0x1FFFF) |
+		((scaler3_cfg->src_height[1] & 0x1FFFF) << 16);
+
+	dst = (scaler3_cfg->dst_width & 0x1FFFF) |
+		((scaler3_cfg->dst_height & 0x1FFFF) << 16);
+
+	if (scaler3_cfg->de.enable) {
+		_dpu_hw_setup_scaler3_de(c, &scaler3_cfg->de, scaler_offset);
+		op_mode |= BIT(8);
+	}
+
+	if (scaler3_cfg->lut_flag) {
+		if (scaler_version < 0x2004)
+			_dpu_hw_setup_scaler3_lut(c, scaler3_cfg, scaler_offset);
+		else
+			_dpu_hw_setup_scaler3lite_lut(c, scaler3_cfg, scaler_offset);
+	}
+
+	if (scaler_version == 0x1002) {
+		phase_init =
+			((scaler3_cfg->init_phase_x[0] & 0x3F) << 0) |
+			((scaler3_cfg->init_phase_y[0] & 0x3F) << 8) |
+			((scaler3_cfg->init_phase_x[1] & 0x3F) << 16) |
+			((scaler3_cfg->init_phase_y[1] & 0x3F) << 24);
+		DPU_REG_WRITE(c, QSEED3_PHASE_INIT + scaler_offset, phase_init);
+	} else {
+		DPU_REG_WRITE(c, QSEED3_PHASE_INIT_Y_H + scaler_offset,
+			scaler3_cfg->init_phase_x[0] & 0x1FFFFF);
+		DPU_REG_WRITE(c, QSEED3_PHASE_INIT_Y_V + scaler_offset,
+			scaler3_cfg->init_phase_y[0] & 0x1FFFFF);
+		DPU_REG_WRITE(c, QSEED3_PHASE_INIT_UV_H + scaler_offset,
+			scaler3_cfg->init_phase_x[1] & 0x1FFFFF);
+		DPU_REG_WRITE(c, QSEED3_PHASE_INIT_UV_V + scaler_offset,
+			scaler3_cfg->init_phase_y[1] & 0x1FFFFF);
+	}
+
+	DPU_REG_WRITE(c, QSEED3_PHASE_STEP_Y_H + scaler_offset,
+		scaler3_cfg->phase_step_x[0] & 0xFFFFFF);
+
+	DPU_REG_WRITE(c, QSEED3_PHASE_STEP_Y_V + scaler_offset,
+		scaler3_cfg->phase_step_y[0] & 0xFFFFFF);
+
+	DPU_REG_WRITE(c, QSEED3_PHASE_STEP_UV_H + scaler_offset,
+		scaler3_cfg->phase_step_x[1] & 0xFFFFFF);
+
+	DPU_REG_WRITE(c, QSEED3_PHASE_STEP_UV_V + scaler_offset,
+		scaler3_cfg->phase_step_y[1] & 0xFFFFFF);
+
+	DPU_REG_WRITE(c, QSEED3_PRELOAD + scaler_offset, preload);
+
+	DPU_REG_WRITE(c, QSEED3_SRC_SIZE_Y_RGB_A + scaler_offset, src_y_rgb);
+
+	DPU_REG_WRITE(c, QSEED3_SRC_SIZE_UV + scaler_offset, src_uv);
+
+	DPU_REG_WRITE(c, QSEED3_DST_SIZE + scaler_offset, dst);
+
+end:
+	if (format && !DPU_FORMAT_IS_DX(format))
+		op_mode |= BIT(14);
+
+	if (format && format->alpha_enable) {
+		op_mode |= BIT(10);
+		if (scaler_version == 0x1002)
+			op_mode |= (scaler3_cfg->alpha_filter_cfg & 0x1) << 30;
+		else
+			op_mode |= (scaler3_cfg->alpha_filter_cfg & 0x3) << 29;
+	}
+
+	DPU_REG_WRITE(c, QSEED3_OP_MODE + scaler_offset, op_mode);
+}
+
+void dpu_hw_csc_setup(struct dpu_hw_blk_reg_map *c,
+		u32 csc_reg_off,
+		const struct dpu_csc_cfg *data, bool csc10)
+{
+	static const u32 matrix_shift = 7;
+	u32 clamp_shift = csc10 ? 16 : 8;
+	u32 val;
+
+	/* matrix coeff - convert S15.16 to S4.9 */
+	val = ((data->csc_mv[0] >> matrix_shift) & 0x1FFF) |
+		(((data->csc_mv[1] >> matrix_shift) & 0x1FFF) << 16);
+	DPU_REG_WRITE(c, csc_reg_off, val);
+	val = ((data->csc_mv[2] >> matrix_shift) & 0x1FFF) |
+		(((data->csc_mv[3] >> matrix_shift) & 0x1FFF) << 16);
+	DPU_REG_WRITE(c, csc_reg_off + 0x4, val);
+	val = ((data->csc_mv[4] >> matrix_shift) & 0x1FFF) |
+		(((data->csc_mv[5] >> matrix_shift) & 0x1FFF) << 16);
+	DPU_REG_WRITE(c, csc_reg_off + 0x8, val);
+	val = ((data->csc_mv[6] >> matrix_shift) & 0x1FFF) |
+		(((data->csc_mv[7] >> matrix_shift) & 0x1FFF) << 16);
+	DPU_REG_WRITE(c, csc_reg_off + 0xc, val);
+	val = (data->csc_mv[8] >> matrix_shift) & 0x1FFF;
+	DPU_REG_WRITE(c, csc_reg_off + 0x10, val);
+
+	/* Pre clamp */
+	val = (data->csc_pre_lv[0] << clamp_shift) | data->csc_pre_lv[1];
+	DPU_REG_WRITE(c, csc_reg_off + 0x14, val);
+	val = (data->csc_pre_lv[2] << clamp_shift) | data->csc_pre_lv[3];
+	DPU_REG_WRITE(c, csc_reg_off + 0x18, val);
+	val = (data->csc_pre_lv[4] << clamp_shift) | data->csc_pre_lv[5];
+	DPU_REG_WRITE(c, csc_reg_off + 0x1c, val);
+
+	/* Post clamp */
+	val = (data->csc_post_lv[0] << clamp_shift) | data->csc_post_lv[1];
+	DPU_REG_WRITE(c, csc_reg_off + 0x20, val);
+	val = (data->csc_post_lv[2] << clamp_shift) | data->csc_post_lv[3];
+	DPU_REG_WRITE(c, csc_reg_off + 0x24, val);
+	val = (data->csc_post_lv[4] << clamp_shift) | data->csc_post_lv[5];
+	DPU_REG_WRITE(c, csc_reg_off + 0x28, val);
+
+	/* Pre-Bias */
+	DPU_REG_WRITE(c, csc_reg_off + 0x2c, data->csc_pre_bv[0]);
+	DPU_REG_WRITE(c, csc_reg_off + 0x30, data->csc_pre_bv[1]);
+	DPU_REG_WRITE(c, csc_reg_off + 0x34, data->csc_pre_bv[2]);
+
+	/* Post-Bias */
+	DPU_REG_WRITE(c, csc_reg_off + 0x38, data->csc_post_bv[0]);
+	DPU_REG_WRITE(c, csc_reg_off + 0x3c, data->csc_post_bv[1]);
+	DPU_REG_WRITE(c, csc_reg_off + 0x40, data->csc_post_bv[2]);
+}
+
+/**
+ * _dpu_hw_get_qos_lut - get LUT mapping based on fill level
+ * @tbl:		Pointer to LUT table
+ * @total_fl:		fill level
+ * Return: LUT setting corresponding to the fill level
+ */
+u64 _dpu_hw_get_qos_lut(const struct dpu_qos_lut_tbl *tbl,
+		u32 total_fl)
+{
+	int i;
+
+	if (!tbl || !tbl->nentry || !tbl->entries)
+		return 0;
+
+	for (i = 0; i < tbl->nentry; i++)
+		if (total_fl <= tbl->entries[i].fl)
+			return tbl->entries[i].lut;
+
+	/* if last fl is zero, use as default */
+	if (!tbl->entries[i-1].fl)
+		return tbl->entries[i-1].lut;
+
+	return 0;
+}
+
+void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset,
+			   bool qos_8lvl,
+			   const struct dpu_hw_qos_cfg *cfg)
+{
+	DPU_REG_WRITE(c, offset + QOS_DANGER_LUT, cfg->danger_lut);
+	DPU_REG_WRITE(c, offset + QOS_SAFE_LUT, cfg->safe_lut);
+
+	if (qos_8lvl) {
+		DPU_REG_WRITE(c, offset + QOS_CREQ_LUT_0, cfg->creq_lut);
+		DPU_REG_WRITE(c, offset + QOS_CREQ_LUT_1, cfg->creq_lut >> 32);
+	} else {
+		DPU_REG_WRITE(c, offset + QOS_CREQ_LUT, cfg->creq_lut);
+	}
+
+	DPU_REG_WRITE(c, offset + QOS_QOS_CTRL,
+		      cfg->danger_safe_en ? QOS_QOS_CTRL_DANGER_SAFE_EN : 0);
+}
+
+/*
+ * note: Aside from encoders, input_sel should be set to 0x0 by default
+ */
+void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+		u32 misr_ctrl_offset, u8 input_sel)
+{
+	u32 config = 0;
+
+	DPU_REG_WRITE(c, misr_ctrl_offset, MISR_CTRL_STATUS_CLEAR);
+
+	/* Clear old MISR value (in case it's read before a new value is calculated)*/
+	wmb();
+
+	config = MISR_FRAME_COUNT | MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK |
+		((input_sel & 0xF) << 24);
+	DPU_REG_WRITE(c, misr_ctrl_offset, config);
+}
+
+int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c,
+		u32 misr_ctrl_offset,
+		u32 misr_signature_offset,
+		u32 *misr_value)
+{
+	u32 ctrl = 0;
+
+	if (!misr_value)
+		return -EINVAL;
+
+	ctrl = DPU_REG_READ(c, misr_ctrl_offset);
+
+	if (!(ctrl & MISR_CTRL_ENABLE))
+		return -ENODATA;
+
+	if (!(ctrl & MISR_CTRL_STATUS))
+		return -EINVAL;
+
+	*misr_value = DPU_REG_READ(c, misr_signature_offset);
+
+	return 0;
+}
+
+#define CDP_ENABLE		BIT(0)
+#define CDP_UBWC_META_ENABLE	BIT(1)
+#define CDP_TILE_AMORTIZE_ENABLE BIT(2)
+#define CDP_PRELOAD_AHEAD_64	BIT(3)
+
+void dpu_setup_cdp(struct dpu_hw_blk_reg_map *c, u32 offset,
+		   const struct dpu_format *fmt, bool enable)
+{
+	u32 cdp_cntl = CDP_PRELOAD_AHEAD_64;
+
+	if (enable)
+		cdp_cntl |= CDP_ENABLE;
+	if (DPU_FORMAT_IS_UBWC(fmt))
+		cdp_cntl |= CDP_UBWC_META_ENABLE;
+	if (DPU_FORMAT_IS_UBWC(fmt) ||
+	    DPU_FORMAT_IS_TILE(fmt))
+		cdp_cntl |= CDP_TILE_AMORTIZE_ENABLE;
+
+	DPU_REG_WRITE(c, offset, cdp_cntl);
+}
+
+bool dpu_hw_clk_force_ctrl(struct dpu_hw_blk_reg_map *c,
+			   const struct dpu_clk_ctrl_reg *clk_ctrl_reg,
+			   bool enable)
+{
+	u32 reg_val, new_val;
+	bool clk_forced_on;
+
+	reg_val = DPU_REG_READ(c, clk_ctrl_reg->reg_off);
+
+	if (enable)
+		new_val = reg_val | BIT(clk_ctrl_reg->bit_off);
+	else
+		new_val = reg_val & ~BIT(clk_ctrl_reg->bit_off);
+
+	DPU_REG_WRITE(c, clk_ctrl_reg->reg_off, new_val);
+
+	clk_forced_on = !(reg_val & BIT(clk_ctrl_reg->bit_off));
+
+	return clk_forced_on;
+}
+
+#define TO_S15D16(_x_)((_x_) << 7)
+
+const struct dpu_csc_cfg dpu_csc_YUV2RGB_601L = {
+	{
+		/* S15.16 format */
+		0x00012A00, 0x00000000, 0x00019880,
+		0x00012A00, 0xFFFF9B80, 0xFFFF3000,
+		0x00012A00, 0x00020480, 0x00000000,
+	},
+	/* signed bias */
+	{ 0xfff0, 0xff80, 0xff80,},
+	{ 0x0, 0x0, 0x0,},
+	/* unsigned clamp */
+	{ 0x10, 0xeb, 0x10, 0xf0, 0x10, 0xf0,},
+	{ 0x00, 0xff, 0x00, 0xff, 0x00, 0xff,},
+};
+
+const struct dpu_csc_cfg dpu_csc10_YUV2RGB_601L = {
+	{
+		/* S15.16 format */
+		0x00012A00, 0x00000000, 0x00019880,
+		0x00012A00, 0xFFFF9B80, 0xFFFF3000,
+		0x00012A00, 0x00020480, 0x00000000,
+	},
+	/* signed bias */
+	{ 0xffc0, 0xfe00, 0xfe00,},
+	{ 0x0, 0x0, 0x0,},
+	/* unsigned clamp */
+	{ 0x40, 0x3ac, 0x40, 0x3c0, 0x40, 0x3c0,},
+	{ 0x00, 0x3ff, 0x00, 0x3ff, 0x00, 0x3ff,},
+};
+
+const struct dpu_csc_cfg dpu_csc10_rgb2yuv_601l = {
+	{
+		TO_S15D16(0x0083), TO_S15D16(0x0102), TO_S15D16(0x0032),
+		TO_S15D16(0x1fb5), TO_S15D16(0x1f6c), TO_S15D16(0x00e1),
+		TO_S15D16(0x00e1), TO_S15D16(0x1f45), TO_S15D16(0x1fdc)
+	},
+	{ 0x00, 0x00, 0x00 },
+	{ 0x0040, 0x0200, 0x0200 },
+	{ 0x000, 0x3ff, 0x000, 0x3ff, 0x000, 0x3ff },
+	{ 0x040, 0x3ac, 0x040, 0x3c0, 0x040, 0x3c0 },
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_util.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_util.h
@@ -0,0 +1,375 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_UTIL_H
+#define _DPU_HW_UTIL_H
+
+#include <linux/io.h>
+#include <linux/slab.h>
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_catalog.h"
+
+#define REG_MASK(n)                     ((BIT(n)) - 1)
+#define MISR_FRAME_COUNT                0x1
+#define MISR_CTRL_ENABLE                BIT(8)
+#define MISR_CTRL_STATUS                BIT(9)
+#define MISR_CTRL_STATUS_CLEAR          BIT(10)
+#define MISR_CTRL_FREE_RUN_MASK         BIT(31)
+
+#define TO_S15D16(_x_)((_x_) << 7)
+
+extern const struct dpu_csc_cfg dpu_csc_YUV2RGB_601L;
+extern const struct dpu_csc_cfg dpu_csc10_YUV2RGB_601L;
+extern const struct dpu_csc_cfg dpu_csc10_rgb2yuv_601l;
+
+/*
+ * This is the common struct maintained by each sub block
+ * for mapping the register offsets in this block to the
+ * absoulute IO address
+ * @blk_addr:     hw block register mapped address
+ * @log_mask:     log mask for this block
+ */
+struct dpu_hw_blk_reg_map {
+	void __iomem *blk_addr;
+	u32 log_mask;
+};
+
+/**
+ * struct dpu_hw_blk - opaque hardware block object
+ */
+struct dpu_hw_blk {
+	/* opaque */
+};
+
+/**
+ * struct dpu_hw_scaler3_de_cfg : QSEEDv3 detail enhancer configuration
+ * @enable:         detail enhancer enable/disable
+ * @sharpen_level1: sharpening strength for noise
+ * @sharpen_level2: sharpening strength for signal
+ * @ clip:          clip shift
+ * @ limit:         limit value
+ * @ thr_quiet:     quiet threshold
+ * @ thr_dieout:    dieout threshold
+ * @ thr_high:      low threshold
+ * @ thr_high:      high threshold
+ * @ prec_shift:    precision shift
+ * @ adjust_a:      A-coefficients for mapping curve
+ * @ adjust_b:      B-coefficients for mapping curve
+ * @ adjust_c:      C-coefficients for mapping curve
+ */
+struct dpu_hw_scaler3_de_cfg {
+	u32 enable;
+	int16_t sharpen_level1;
+	int16_t sharpen_level2;
+	uint16_t clip;
+	uint16_t limit;
+	uint16_t thr_quiet;
+	uint16_t thr_dieout;
+	uint16_t thr_low;
+	uint16_t thr_high;
+	uint16_t prec_shift;
+	int16_t adjust_a[DPU_MAX_DE_CURVES];
+	int16_t adjust_b[DPU_MAX_DE_CURVES];
+	int16_t adjust_c[DPU_MAX_DE_CURVES];
+};
+
+
+/**
+ * struct dpu_hw_scaler3_cfg : QSEEDv3 configuration
+ * @enable:        scaler enable
+ * @dir_en:        direction detection block enable
+ * @ init_phase_x: horizontal initial phase
+ * @ phase_step_x: horizontal phase step
+ * @ init_phase_y: vertical initial phase
+ * @ phase_step_y: vertical phase step
+ * @ preload_x:    horizontal preload value
+ * @ preload_y:    vertical preload value
+ * @ src_width:    source width
+ * @ src_height:   source height
+ * @ dst_width:    destination width
+ * @ dst_height:   destination height
+ * @ y_rgb_filter_cfg: y/rgb plane filter configuration
+ * @ uv_filter_cfg: uv plane filter configuration
+ * @ alpha_filter_cfg: alpha filter configuration
+ * @ blend_cfg:    blend coefficients configuration
+ * @ lut_flag:     scaler LUT update flags
+ *                 0x1 swap LUT bank
+ *                 0x2 update 2D filter LUT
+ *                 0x4 update y circular filter LUT
+ *                 0x8 update uv circular filter LUT
+ *                 0x10 update y separable filter LUT
+ *                 0x20 update uv separable filter LUT
+ * @ dir_lut_idx:  2D filter LUT index
+ * @ y_rgb_cir_lut_idx: y circular filter LUT index
+ * @ uv_cir_lut_idx: uv circular filter LUT index
+ * @ y_rgb_sep_lut_idx: y circular filter LUT index
+ * @ uv_sep_lut_idx: uv separable filter LUT index
+ * @ dir_lut:      pointer to 2D LUT
+ * @ cir_lut:      pointer to circular filter LUT
+ * @ sep_lut:      pointer to separable filter LUT
+ * @ de: detail enhancer configuration
+ * @ dir_weight:   Directional weight
+ */
+struct dpu_hw_scaler3_cfg {
+	u32 enable;
+	u32 dir_en;
+	int32_t init_phase_x[DPU_MAX_PLANES];
+	int32_t phase_step_x[DPU_MAX_PLANES];
+	int32_t init_phase_y[DPU_MAX_PLANES];
+	int32_t phase_step_y[DPU_MAX_PLANES];
+
+	u32 preload_x[DPU_MAX_PLANES];
+	u32 preload_y[DPU_MAX_PLANES];
+	u32 src_width[DPU_MAX_PLANES];
+	u32 src_height[DPU_MAX_PLANES];
+
+	u32 dst_width;
+	u32 dst_height;
+
+	u32 y_rgb_filter_cfg;
+	u32 uv_filter_cfg;
+	u32 alpha_filter_cfg;
+	u32 blend_cfg;
+
+	u32 lut_flag;
+	u32 dir_lut_idx;
+
+	u32 y_rgb_cir_lut_idx;
+	u32 uv_cir_lut_idx;
+	u32 y_rgb_sep_lut_idx;
+	u32 uv_sep_lut_idx;
+	u32 *dir_lut;
+	size_t dir_len;
+	u32 *cir_lut;
+	size_t cir_len;
+	u32 *sep_lut;
+	size_t sep_len;
+
+	/*
+	 * Detail enhancer settings
+	 */
+	struct dpu_hw_scaler3_de_cfg de;
+
+	u32 dir_weight;
+};
+
+/**
+ * struct dpu_drm_pix_ext_v1 - version 1 of pixel ext structure
+ * @num_ext_pxls_lr: Number of total horizontal pixels
+ * @num_ext_pxls_tb: Number of total vertical lines
+ * @left_ftch:       Number of extra pixels to overfetch from left
+ * @right_ftch:      Number of extra pixels to overfetch from right
+ * @top_ftch:        Number of extra lines to overfetch from top
+ * @btm_ftch:        Number of extra lines to overfetch from bottom
+ * @left_rpt:        Number of extra pixels to repeat from left
+ * @right_rpt:       Number of extra pixels to repeat from right
+ * @top_rpt:         Number of extra lines to repeat from top
+ * @btm_rpt:         Number of extra lines to repeat from bottom
+ */
+struct dpu_drm_pix_ext_v1 {
+	/*
+	 * Number of pixels ext in left, right, top and bottom direction
+	 * for all color components.
+	 */
+	int32_t num_ext_pxls_lr[DPU_MAX_PLANES];
+	int32_t num_ext_pxls_tb[DPU_MAX_PLANES];
+
+	/*
+	 * Number of pixels needs to be overfetched in left, right, top
+	 * and bottom directions from source image for scaling.
+	 */
+	int32_t left_ftch[DPU_MAX_PLANES];
+	int32_t right_ftch[DPU_MAX_PLANES];
+	int32_t top_ftch[DPU_MAX_PLANES];
+	int32_t btm_ftch[DPU_MAX_PLANES];
+	/*
+	 * Number of pixels needs to be repeated in left, right, top and
+	 * bottom directions for scaling.
+	 */
+	int32_t left_rpt[DPU_MAX_PLANES];
+	int32_t right_rpt[DPU_MAX_PLANES];
+	int32_t top_rpt[DPU_MAX_PLANES];
+	int32_t btm_rpt[DPU_MAX_PLANES];
+
+};
+
+/**
+ * struct dpu_drm_de_v1 - version 1 of detail enhancer structure
+ * @enable:         Enables/disables detail enhancer
+ * @sharpen_level1: Sharpening strength for noise
+ * @sharpen_level2: Sharpening strength for context
+ * @clip:           Clip coefficient
+ * @limit:          Detail enhancer limit factor
+ * @thr_quiet:      Quite zone threshold
+ * @thr_dieout:     Die-out zone threshold
+ * @thr_low:        Linear zone left threshold
+ * @thr_high:       Linear zone right threshold
+ * @prec_shift:     Detail enhancer precision
+ * @adjust_a:       Mapping curves A coefficients
+ * @adjust_b:       Mapping curves B coefficients
+ * @adjust_c:       Mapping curves C coefficients
+ */
+struct dpu_drm_de_v1 {
+	uint32_t enable;
+	int16_t sharpen_level1;
+	int16_t sharpen_level2;
+	uint16_t clip;
+	uint16_t limit;
+	uint16_t thr_quiet;
+	uint16_t thr_dieout;
+	uint16_t thr_low;
+	uint16_t thr_high;
+	uint16_t prec_shift;
+	int16_t adjust_a[DPU_MAX_DE_CURVES];
+	int16_t adjust_b[DPU_MAX_DE_CURVES];
+	int16_t adjust_c[DPU_MAX_DE_CURVES];
+};
+
+/**
+ * struct dpu_drm_scaler_v2 - version 2 of struct dpu_drm_scaler
+ * @enable:            Scaler enable
+ * @dir_en:            Detail enhancer enable
+ * @pe:                Pixel extension settings
+ * @horz_decimate:     Horizontal decimation factor
+ * @vert_decimate:     Vertical decimation factor
+ * @init_phase_x:      Initial scaler phase values for x
+ * @phase_step_x:      Phase step values for x
+ * @init_phase_y:      Initial scaler phase values for y
+ * @phase_step_y:      Phase step values for y
+ * @preload_x:         Horizontal preload value
+ * @preload_y:         Vertical preload value
+ * @src_width:         Source width
+ * @src_height:        Source height
+ * @dst_width:         Destination width
+ * @dst_height:        Destination height
+ * @y_rgb_filter_cfg:  Y/RGB plane filter configuration
+ * @uv_filter_cfg:     UV plane filter configuration
+ * @alpha_filter_cfg:  Alpha filter configuration
+ * @blend_cfg:         Selection of blend coefficients
+ * @lut_flag:          LUT configuration flags
+ * @dir_lut_idx:       2d 4x4 LUT index
+ * @y_rgb_cir_lut_idx: Y/RGB circular LUT index
+ * @uv_cir_lut_idx:    UV circular LUT index
+ * @y_rgb_sep_lut_idx: Y/RGB separable LUT index
+ * @uv_sep_lut_idx:    UV separable LUT index
+ * @de:                Detail enhancer settings
+ */
+struct dpu_drm_scaler_v2 {
+	/*
+	 * General definitions
+	 */
+	uint32_t enable;
+	uint32_t dir_en;
+
+	/*
+	 * Pix ext settings
+	 */
+	struct dpu_drm_pix_ext_v1 pe;
+
+	/*
+	 * Decimation settings
+	 */
+	uint32_t horz_decimate;
+	uint32_t vert_decimate;
+
+	/*
+	 * Phase settings
+	 */
+	int32_t init_phase_x[DPU_MAX_PLANES];
+	int32_t phase_step_x[DPU_MAX_PLANES];
+	int32_t init_phase_y[DPU_MAX_PLANES];
+	int32_t phase_step_y[DPU_MAX_PLANES];
+
+	uint32_t preload_x[DPU_MAX_PLANES];
+	uint32_t preload_y[DPU_MAX_PLANES];
+	uint32_t src_width[DPU_MAX_PLANES];
+	uint32_t src_height[DPU_MAX_PLANES];
+
+	uint32_t dst_width;
+	uint32_t dst_height;
+
+	uint32_t y_rgb_filter_cfg;
+	uint32_t uv_filter_cfg;
+	uint32_t alpha_filter_cfg;
+	uint32_t blend_cfg;
+
+	uint32_t lut_flag;
+	uint32_t dir_lut_idx;
+
+	/* for Y(RGB) and UV planes*/
+	uint32_t y_rgb_cir_lut_idx;
+	uint32_t uv_cir_lut_idx;
+	uint32_t y_rgb_sep_lut_idx;
+	uint32_t uv_sep_lut_idx;
+
+	/*
+	 * Detail enhancer settings
+	 */
+	struct dpu_drm_de_v1 de;
+};
+
+/**
+ * struct dpu_hw_qos_cfg: pipe QoS configuration
+ * @danger_lut: LUT for generate danger level based on fill level
+ * @safe_lut: LUT for generate safe level based on fill level
+ * @creq_lut: LUT for generate creq level based on fill level
+ * @creq_vblank: creq value generated to vbif during vertical blanking
+ * @danger_vblank: danger value generated during vertical blanking
+ * @vblank_en: enable creq_vblank and danger_vblank during vblank
+ * @danger_safe_en: enable danger safe generation
+ */
+struct dpu_hw_qos_cfg {
+	u32 danger_lut;
+	u32 safe_lut;
+	u64 creq_lut;
+	bool danger_safe_en;
+};
+
+u32 *dpu_hw_util_get_log_mask_ptr(void);
+
+void dpu_reg_write(struct dpu_hw_blk_reg_map *c,
+		u32 reg_off,
+		u32 val,
+		const char *name);
+int dpu_reg_read(struct dpu_hw_blk_reg_map *c, u32 reg_off);
+
+#define DPU_REG_WRITE(c, off, val) dpu_reg_write(c, off, val, #off)
+#define DPU_REG_READ(c, off) dpu_reg_read(c, off)
+
+void *dpu_hw_util_get_dir(void);
+
+void dpu_hw_setup_scaler3(struct dpu_hw_blk_reg_map *c,
+		struct dpu_hw_scaler3_cfg *scaler3_cfg,
+		u32 scaler_offset, u32 scaler_version,
+		const struct dpu_format *format);
+
+void dpu_hw_csc_setup(struct dpu_hw_blk_reg_map  *c,
+		u32 csc_reg_off,
+		const struct dpu_csc_cfg *data, bool csc10);
+
+void dpu_setup_cdp(struct dpu_hw_blk_reg_map *c, u32 offset,
+		   const struct dpu_format *fmt, bool enable);
+
+u64 _dpu_hw_get_qos_lut(const struct dpu_qos_lut_tbl *tbl,
+		u32 total_fl);
+
+void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset,
+			   bool qos_8lvl,
+			   const struct dpu_hw_qos_cfg *cfg);
+
+void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+		u32 misr_ctrl_offset, u8 input_sel);
+
+int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c,
+		u32 misr_ctrl_offset,
+		u32 misr_signature_offset,
+		u32 *misr_value);
+
+bool dpu_hw_clk_force_ctrl(struct dpu_hw_blk_reg_map *c,
+			   const struct dpu_clk_ctrl_reg *clk_ctrl_reg,
+			   bool enable);
+
+#endif /* _DPU_HW_UTIL_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_vbif.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_vbif.c
@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#include <drm/drm_managed.h>
+
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_vbif.h"
+
+#define VBIF_VERSION			0x0000
+#define VBIF_CLK_FORCE_CTRL0		0x0008
+#define VBIF_CLK_FORCE_CTRL1		0x000C
+#define VBIF_QOS_REMAP_00		0x0020
+#define VBIF_QOS_REMAP_01		0x0024
+#define VBIF_QOS_REMAP_10		0x0028
+#define VBIF_QOS_REMAP_11		0x002C
+#define VBIF_WRITE_GATHER_EN		0x00AC
+#define VBIF_IN_RD_LIM_CONF0		0x00B0
+#define VBIF_IN_RD_LIM_CONF1		0x00B4
+#define VBIF_IN_RD_LIM_CONF2		0x00B8
+#define VBIF_IN_WR_LIM_CONF0		0x00C0
+#define VBIF_IN_WR_LIM_CONF1		0x00C4
+#define VBIF_IN_WR_LIM_CONF2		0x00C8
+#define VBIF_OUT_RD_LIM_CONF0		0x00D0
+#define VBIF_OUT_WR_LIM_CONF0		0x00D4
+#define VBIF_OUT_AXI_AMEMTYPE_CONF0	0x0160
+#define VBIF_OUT_AXI_AMEMTYPE_CONF1	0x0164
+#define VBIF_XIN_PND_ERR		0x0190
+#define VBIF_XIN_SRC_ERR		0x0194
+#define VBIF_XIN_CLR_ERR		0x019C
+#define VBIF_XIN_HALT_CTRL0		0x0200
+#define VBIF_XIN_HALT_CTRL1		0x0204
+#define VBIF_XINL_QOS_RP_REMAP_000	0x0550
+#define VBIF_XINL_QOS_LVL_REMAP_000(vbif)	(VBIF_XINL_QOS_RP_REMAP_000 + (vbif)->cap->qos_rp_remap_size)
+
+static void dpu_hw_clear_errors(struct dpu_hw_vbif *vbif,
+		u32 *pnd_errors, u32 *src_errors)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 pnd, src;
+
+	if (!vbif)
+		return;
+	c = &vbif->hw;
+	pnd = DPU_REG_READ(c, VBIF_XIN_PND_ERR);
+	src = DPU_REG_READ(c, VBIF_XIN_SRC_ERR);
+
+	if (pnd_errors)
+		*pnd_errors = pnd;
+	if (src_errors)
+		*src_errors = src;
+
+	DPU_REG_WRITE(c, VBIF_XIN_CLR_ERR, pnd | src);
+}
+
+static void dpu_hw_set_mem_type(struct dpu_hw_vbif *vbif,
+		u32 xin_id, u32 value)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 reg_off;
+	u32 bit_off;
+	u32 reg_val;
+
+	/*
+	 * Assume 4 bits per bit field, 8 fields per 32-bit register so
+	 * 16 bit fields maximum across two registers
+	 */
+	if (!vbif || xin_id >= MAX_XIN_COUNT || xin_id >= 16)
+		return;
+
+	c = &vbif->hw;
+
+	if (xin_id >= 8) {
+		xin_id -= 8;
+		reg_off = VBIF_OUT_AXI_AMEMTYPE_CONF1;
+	} else {
+		reg_off = VBIF_OUT_AXI_AMEMTYPE_CONF0;
+	}
+	bit_off = (xin_id & 0x7) * 4;
+	reg_val = DPU_REG_READ(c, reg_off);
+	reg_val &= ~(0x7 << bit_off);
+	reg_val |= (value & 0x7) << bit_off;
+	DPU_REG_WRITE(c, reg_off, reg_val);
+}
+
+static void dpu_hw_set_limit_conf(struct dpu_hw_vbif *vbif,
+		u32 xin_id, bool rd, u32 limit)
+{
+	struct dpu_hw_blk_reg_map *c = &vbif->hw;
+	u32 reg_val;
+	u32 reg_off;
+	u32 bit_off;
+
+	if (rd)
+		reg_off = VBIF_IN_RD_LIM_CONF0;
+	else
+		reg_off = VBIF_IN_WR_LIM_CONF0;
+
+	reg_off += (xin_id / 4) * 4;
+	bit_off = (xin_id % 4) * 8;
+	reg_val = DPU_REG_READ(c, reg_off);
+	reg_val &= ~(0xFF << bit_off);
+	reg_val |= (limit) << bit_off;
+	DPU_REG_WRITE(c, reg_off, reg_val);
+}
+
+static u32 dpu_hw_get_limit_conf(struct dpu_hw_vbif *vbif,
+		u32 xin_id, bool rd)
+{
+	struct dpu_hw_blk_reg_map *c = &vbif->hw;
+	u32 reg_val;
+	u32 reg_off;
+	u32 bit_off;
+	u32 limit;
+
+	if (rd)
+		reg_off = VBIF_IN_RD_LIM_CONF0;
+	else
+		reg_off = VBIF_IN_WR_LIM_CONF0;
+
+	reg_off += (xin_id / 4) * 4;
+	bit_off = (xin_id % 4) * 8;
+	reg_val = DPU_REG_READ(c, reg_off);
+	limit = (reg_val >> bit_off) & 0xFF;
+
+	return limit;
+}
+
+static void dpu_hw_set_halt_ctrl(struct dpu_hw_vbif *vbif,
+		u32 xin_id, bool enable)
+{
+	struct dpu_hw_blk_reg_map *c = &vbif->hw;
+	u32 reg_val;
+
+	reg_val = DPU_REG_READ(c, VBIF_XIN_HALT_CTRL0);
+
+	if (enable)
+		reg_val |= BIT(xin_id);
+	else
+		reg_val &= ~BIT(xin_id);
+
+	DPU_REG_WRITE(c, VBIF_XIN_HALT_CTRL0, reg_val);
+}
+
+static bool dpu_hw_get_halt_ctrl(struct dpu_hw_vbif *vbif,
+		u32 xin_id)
+{
+	struct dpu_hw_blk_reg_map *c = &vbif->hw;
+	u32 reg_val;
+
+	reg_val = DPU_REG_READ(c, VBIF_XIN_HALT_CTRL1);
+
+	return (reg_val & BIT(xin_id)) ? true : false;
+}
+
+static void dpu_hw_set_qos_remap(struct dpu_hw_vbif *vbif,
+		u32 xin_id, u32 level, u32 remap_level)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 reg_lvl, reg_val, reg_val_lvl, mask, reg_high, reg_shift;
+
+	if (!vbif)
+		return;
+
+	c = &vbif->hw;
+
+	reg_lvl = VBIF_XINL_QOS_LVL_REMAP_000(vbif);
+	reg_high = ((xin_id & 0x8) >> 3) * 4 + (level * 8);
+	reg_shift = (xin_id & 0x7) * 4;
+
+	reg_val = DPU_REG_READ(c, VBIF_XINL_QOS_RP_REMAP_000 + reg_high);
+	reg_val_lvl = DPU_REG_READ(c, reg_lvl + reg_high);
+
+	mask = 0x7 << reg_shift;
+
+	reg_val &= ~mask;
+	reg_val |= (remap_level << reg_shift) & mask;
+
+	reg_val_lvl &= ~mask;
+	reg_val_lvl |= (remap_level << reg_shift) & mask;
+
+	DPU_REG_WRITE(c, VBIF_XINL_QOS_RP_REMAP_000 + reg_high, reg_val);
+	DPU_REG_WRITE(c, reg_lvl + reg_high, reg_val_lvl);
+}
+
+static void dpu_hw_set_write_gather_en(struct dpu_hw_vbif *vbif, u32 xin_id)
+{
+	struct dpu_hw_blk_reg_map *c;
+	u32 reg_val;
+
+	if (!vbif || xin_id >= MAX_XIN_COUNT)
+		return;
+
+	c = &vbif->hw;
+
+	reg_val = DPU_REG_READ(c, VBIF_WRITE_GATHER_EN);
+	reg_val |= BIT(xin_id);
+	DPU_REG_WRITE(c, VBIF_WRITE_GATHER_EN, reg_val);
+}
+
+static void _setup_vbif_ops(struct dpu_hw_vbif_ops *ops,
+		unsigned long cap)
+{
+	ops->set_limit_conf = dpu_hw_set_limit_conf;
+	ops->get_limit_conf = dpu_hw_get_limit_conf;
+	ops->set_halt_ctrl = dpu_hw_set_halt_ctrl;
+	ops->get_halt_ctrl = dpu_hw_get_halt_ctrl;
+	if (test_bit(DPU_VBIF_QOS_REMAP, &cap))
+		ops->set_qos_remap = dpu_hw_set_qos_remap;
+	ops->set_mem_type = dpu_hw_set_mem_type;
+	ops->clear_errors = dpu_hw_clear_errors;
+	ops->set_write_gather_en = dpu_hw_set_write_gather_en;
+}
+
+struct dpu_hw_vbif *dpu_hw_vbif_init(struct drm_device *dev,
+				     const struct dpu_vbif_cfg *cfg,
+				     void __iomem *addr)
+{
+	struct dpu_hw_vbif *c;
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_VBIF;
+
+	/*
+	 * Assign ops
+	 */
+	c->idx = cfg->id;
+	c->cap = cfg;
+	_setup_vbif_ops(&c->ops, c->cap->features);
+
+	/* no need to register sub-range in dpu dbg, dump entire vbif io base */
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_vbif.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_vbif.h
@@ -0,0 +1,119 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HW_VBIF_H
+#define _DPU_HW_VBIF_H
+
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_util.h"
+
+struct dpu_hw_vbif;
+
+/**
+ * struct dpu_hw_vbif_ops : Interface to the VBIF hardware driver functions
+ *  Assumption is these functions will be called after clocks are enabled
+ */
+struct dpu_hw_vbif_ops {
+	/**
+	 * set_limit_conf - set transaction limit config
+	 * @vbif: vbif context driver
+	 * @xin_id: client interface identifier
+	 * @rd: true for read limit; false for write limit
+	 * @limit: outstanding transaction limit
+	 */
+	void (*set_limit_conf)(struct dpu_hw_vbif *vbif,
+			u32 xin_id, bool rd, u32 limit);
+
+	/**
+	 * get_limit_conf - get transaction limit config
+	 * @vbif: vbif context driver
+	 * @xin_id: client interface identifier
+	 * @rd: true for read limit; false for write limit
+	 * @return: outstanding transaction limit
+	 */
+	u32 (*get_limit_conf)(struct dpu_hw_vbif *vbif,
+			u32 xin_id, bool rd);
+
+	/**
+	 * set_halt_ctrl - set halt control
+	 * @vbif: vbif context driver
+	 * @xin_id: client interface identifier
+	 * @enable: halt control enable
+	 */
+	void (*set_halt_ctrl)(struct dpu_hw_vbif *vbif,
+			u32 xin_id, bool enable);
+
+	/**
+	 * get_halt_ctrl - get halt control
+	 * @vbif: vbif context driver
+	 * @xin_id: client interface identifier
+	 * @return: halt control enable
+	 */
+	bool (*get_halt_ctrl)(struct dpu_hw_vbif *vbif,
+			u32 xin_id);
+
+	/**
+	 * set_qos_remap - set QoS priority remap
+	 * @vbif: vbif context driver
+	 * @xin_id: client interface identifier
+	 * @level: priority level
+	 * @remap_level: remapped level
+	 */
+	void (*set_qos_remap)(struct dpu_hw_vbif *vbif,
+			u32 xin_id, u32 level, u32 remap_level);
+
+	/**
+	 * set_mem_type - set memory type
+	 * @vbif: vbif context driver
+	 * @xin_id: client interface identifier
+	 * @value: memory type value
+	 */
+	void (*set_mem_type)(struct dpu_hw_vbif *vbif,
+			u32 xin_id, u32 value);
+
+	/**
+	 * clear_errors - clear any vbif errors
+	 *	This function clears any detected pending/source errors
+	 *	on the VBIF interface, and optionally returns the detected
+	 *	error mask(s).
+	 * @vbif: vbif context driver
+	 * @pnd_errors: pointer to pending error reporting variable
+	 * @src_errors: pointer to source error reporting variable
+	 */
+	void (*clear_errors)(struct dpu_hw_vbif *vbif,
+		u32 *pnd_errors, u32 *src_errors);
+
+	/**
+	 * set_write_gather_en - set write_gather enable
+	 * @vbif: vbif context driver
+	 * @xin_id: client interface identifier
+	 */
+	void (*set_write_gather_en)(struct dpu_hw_vbif *vbif, u32 xin_id);
+};
+
+struct dpu_hw_vbif {
+	/* base */
+	struct dpu_hw_blk_reg_map hw;
+
+	/* vbif */
+	enum dpu_vbif idx;
+	const struct dpu_vbif_cfg *cap;
+
+	/* ops */
+	struct dpu_hw_vbif_ops ops;
+};
+
+/**
+ * dpu_hw_vbif_init() - Initializes the VBIF driver for the passed
+ * VBIF catalog entry.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  VBIF catalog entry for which driver object is required
+ * @addr: Mapped register io address of MDSS
+ */
+struct dpu_hw_vbif *dpu_hw_vbif_init(struct drm_device *dev,
+				     const struct dpu_vbif_cfg *cfg,
+				     void __iomem *addr);
+
+#endif /*_DPU_HW_VBIF_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_wb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_wb.c
@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: GPL-2.0-only
+ /*
+  * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved
+  */
+
+#include <drm/drm_managed.h>
+
+#include "dpu_hw_mdss.h"
+#include "dpu_hwio.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_wb.h"
+#include "dpu_formats.h"
+#include "dpu_kms.h"
+
+#define WB_DST_FORMAT                         0x000
+#define WB_DST_OP_MODE                        0x004
+#define WB_DST_PACK_PATTERN                   0x008
+#define WB_DST0_ADDR                          0x00C
+#define WB_DST1_ADDR                          0x010
+#define WB_DST2_ADDR                          0x014
+#define WB_DST3_ADDR                          0x018
+#define WB_DST_YSTRIDE0                       0x01C
+#define WB_DST_YSTRIDE1                       0x020
+#define WB_DST_YSTRIDE1                       0x020
+#define WB_DST_DITHER_BITDEPTH                0x024
+#define WB_DST_MATRIX_ROW0                    0x030
+#define WB_DST_MATRIX_ROW1                    0x034
+#define WB_DST_MATRIX_ROW2                    0x038
+#define WB_DST_MATRIX_ROW3                    0x03C
+#define WB_DST_WRITE_CONFIG                   0x048
+#define WB_ROTATION_DNSCALER                  0x050
+#define WB_ROTATOR_PIPE_DOWNSCALER            0x054
+#define WB_N16_INIT_PHASE_X_C03               0x060
+#define WB_N16_INIT_PHASE_X_C12               0x064
+#define WB_N16_INIT_PHASE_Y_C03               0x068
+#define WB_N16_INIT_PHASE_Y_C12               0x06C
+#define WB_OUT_SIZE                           0x074
+#define WB_ALPHA_X_VALUE                      0x078
+#define WB_DANGER_LUT                         0x084
+#define WB_SAFE_LUT                           0x088
+#define WB_QOS_CTRL                           0x090
+#define WB_CREQ_LUT_0                         0x098
+#define WB_CREQ_LUT_1                         0x09C
+#define WB_UBWC_STATIC_CTRL                   0x144
+#define WB_MUX                                0x150
+#define WB_CROP_CTRL                          0x154
+#define WB_CROP_OFFSET                        0x158
+#define WB_CLK_CTRL                           0x178
+#define WB_CSC_BASE                           0x260
+#define WB_DST_ADDR_SW_STATUS                 0x2B0
+#define WB_CDP_CNTL                           0x2B4
+#define WB_OUT_IMAGE_SIZE                     0x2C0
+#define WB_OUT_XY                             0x2C4
+
+static void dpu_hw_wb_setup_outaddress(struct dpu_hw_wb *ctx,
+		struct dpu_hw_wb_cfg *data)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+
+	DPU_REG_WRITE(c, WB_DST0_ADDR, data->dest.plane_addr[0]);
+	DPU_REG_WRITE(c, WB_DST1_ADDR, data->dest.plane_addr[1]);
+	DPU_REG_WRITE(c, WB_DST2_ADDR, data->dest.plane_addr[2]);
+	DPU_REG_WRITE(c, WB_DST3_ADDR, data->dest.plane_addr[3]);
+}
+
+static void dpu_hw_wb_setup_format(struct dpu_hw_wb *ctx,
+		struct dpu_hw_wb_cfg *data)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	const struct dpu_format *fmt = data->dest.format;
+	u32 dst_format, pattern, ystride0, ystride1, outsize, chroma_samp;
+	u32 write_config = 0;
+	u32 opmode = 0;
+	u32 dst_addr_sw = 0;
+
+	chroma_samp = fmt->chroma_sample;
+
+	dst_format = (chroma_samp << 23) |
+		(fmt->fetch_planes << 19) |
+		(fmt->bits[C3_ALPHA] << 6) |
+		(fmt->bits[C2_R_Cr] << 4) |
+		(fmt->bits[C1_B_Cb] << 2) |
+		(fmt->bits[C0_G_Y] << 0);
+
+	if (fmt->bits[C3_ALPHA] || fmt->alpha_enable) {
+		dst_format |= BIT(8); /* DSTC3_EN */
+		if (!fmt->alpha_enable ||
+			!(ctx->caps->features & BIT(DPU_WB_PIPE_ALPHA)))
+			dst_format |= BIT(14); /* DST_ALPHA_X */
+	}
+
+	if (DPU_FORMAT_IS_YUV(fmt))
+		dst_format |= BIT(15);
+
+	pattern = (fmt->element[3] << 24) |
+		(fmt->element[2] << 16) |
+		(fmt->element[1] << 8)  |
+		(fmt->element[0] << 0);
+
+	dst_format |= (fmt->unpack_align_msb << 18) |
+		(fmt->unpack_tight << 17) |
+		((fmt->unpack_count - 1) << 12) |
+		((fmt->bpp - 1) << 9);
+
+	ystride0 = data->dest.plane_pitch[0] |
+		(data->dest.plane_pitch[1] << 16);
+	ystride1 = data->dest.plane_pitch[2] |
+	(data->dest.plane_pitch[3] << 16);
+
+	if (drm_rect_height(&data->roi) && drm_rect_width(&data->roi))
+		outsize = (drm_rect_height(&data->roi) << 16) | drm_rect_width(&data->roi);
+	else
+		outsize = (data->dest.height << 16) | data->dest.width;
+
+	DPU_REG_WRITE(c, WB_ALPHA_X_VALUE, 0xFF);
+	DPU_REG_WRITE(c, WB_DST_FORMAT, dst_format);
+	DPU_REG_WRITE(c, WB_DST_OP_MODE, opmode);
+	DPU_REG_WRITE(c, WB_DST_PACK_PATTERN, pattern);
+	DPU_REG_WRITE(c, WB_DST_YSTRIDE0, ystride0);
+	DPU_REG_WRITE(c, WB_DST_YSTRIDE1, ystride1);
+	DPU_REG_WRITE(c, WB_OUT_SIZE, outsize);
+	DPU_REG_WRITE(c, WB_DST_WRITE_CONFIG, write_config);
+	DPU_REG_WRITE(c, WB_DST_ADDR_SW_STATUS, dst_addr_sw);
+}
+
+static void dpu_hw_wb_roi(struct dpu_hw_wb *ctx, struct dpu_hw_wb_cfg *wb)
+{
+	struct dpu_hw_blk_reg_map *c = &ctx->hw;
+	u32 image_size, out_size, out_xy;
+
+	image_size = (wb->dest.height << 16) | wb->dest.width;
+	out_xy = 0;
+	out_size = (drm_rect_height(&wb->roi) << 16) | drm_rect_width(&wb->roi);
+
+	DPU_REG_WRITE(c, WB_OUT_IMAGE_SIZE, image_size);
+	DPU_REG_WRITE(c, WB_OUT_XY, out_xy);
+	DPU_REG_WRITE(c, WB_OUT_SIZE, out_size);
+}
+
+static void dpu_hw_wb_setup_qos_lut(struct dpu_hw_wb *ctx,
+		struct dpu_hw_qos_cfg *cfg)
+{
+	if (!ctx || !cfg)
+		return;
+
+	_dpu_hw_setup_qos_lut(&ctx->hw, WB_DANGER_LUT,
+			      test_bit(DPU_WB_QOS_8LVL, &ctx->caps->features),
+			      cfg);
+}
+
+static void dpu_hw_wb_setup_cdp(struct dpu_hw_wb *ctx,
+				const struct dpu_format *fmt,
+				bool enable)
+{
+	if (!ctx)
+		return;
+
+	dpu_setup_cdp(&ctx->hw, WB_CDP_CNTL, fmt, enable);
+}
+
+static void dpu_hw_wb_bind_pingpong_blk(
+		struct dpu_hw_wb *ctx,
+		const enum dpu_pingpong pp)
+{
+	struct dpu_hw_blk_reg_map *c;
+	int mux_cfg;
+
+	if (!ctx)
+		return;
+
+	c = &ctx->hw;
+
+	mux_cfg = DPU_REG_READ(c, WB_MUX);
+	mux_cfg &= ~0xf;
+
+	if (pp)
+		mux_cfg |= (pp - PINGPONG_0) & 0x7;
+	else
+		mux_cfg |= 0xf;
+
+	DPU_REG_WRITE(c, WB_MUX, mux_cfg);
+}
+
+static bool dpu_hw_wb_setup_clk_force_ctrl(struct dpu_hw_wb *ctx, bool enable)
+{
+	static const struct dpu_clk_ctrl_reg wb_clk_ctrl = {
+		.reg_off = WB_CLK_CTRL,
+		.bit_off = 0
+	};
+
+	return dpu_hw_clk_force_ctrl(&ctx->hw, &wb_clk_ctrl, enable);
+}
+
+static void _setup_wb_ops(struct dpu_hw_wb_ops *ops,
+		unsigned long features, const struct dpu_mdss_version *mdss_rev)
+{
+	ops->setup_outaddress = dpu_hw_wb_setup_outaddress;
+	ops->setup_outformat = dpu_hw_wb_setup_format;
+
+	if (test_bit(DPU_WB_XY_ROI_OFFSET, &features))
+		ops->setup_roi = dpu_hw_wb_roi;
+
+	if (test_bit(DPU_WB_QOS, &features))
+		ops->setup_qos_lut = dpu_hw_wb_setup_qos_lut;
+
+	if (test_bit(DPU_WB_CDP, &features))
+		ops->setup_cdp = dpu_hw_wb_setup_cdp;
+
+	if (test_bit(DPU_WB_INPUT_CTRL, &features))
+		ops->bind_pingpong_blk = dpu_hw_wb_bind_pingpong_blk;
+
+	if (mdss_rev->core_major_ver >= 9)
+		ops->setup_clk_force_ctrl = dpu_hw_wb_setup_clk_force_ctrl;
+}
+
+struct dpu_hw_wb *dpu_hw_wb_init(struct drm_device *dev,
+				 const struct dpu_wb_cfg *cfg,
+				 void __iomem *addr,
+				 const struct dpu_mdss_version *mdss_rev)
+{
+	struct dpu_hw_wb *c;
+
+	if (!addr)
+		return ERR_PTR(-EINVAL);
+
+	c = drmm_kzalloc(dev, sizeof(*c), GFP_KERNEL);
+	if (!c)
+		return ERR_PTR(-ENOMEM);
+
+	c->hw.blk_addr = addr + cfg->base;
+	c->hw.log_mask = DPU_DBG_MASK_WB;
+
+	/* Assign ops */
+	c->idx = cfg->id;
+	c->caps = cfg;
+	_setup_wb_ops(&c->ops, c->caps->features, mdss_rev);
+
+	return c;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_wb.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hw_wb.h
@@ -0,0 +1,90 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved
+ */
+
+#ifndef _DPU_HW_WB_H
+#define _DPU_HW_WB_H
+
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_top.h"
+#include "dpu_hw_util.h"
+#include "dpu_hw_pingpong.h"
+
+struct dpu_hw_wb;
+
+struct dpu_hw_wb_cfg {
+	struct dpu_hw_fmt_layout dest;
+	enum dpu_intf_mode intf_mode;
+	struct drm_rect roi;
+	struct drm_rect crop;
+};
+
+/**
+ *
+ * struct dpu_hw_wb_ops : Interface to the wb hw driver functions
+ *  Assumption is these functions will be called after clocks are enabled
+ *  @setup_outaddress: setup output address from the writeback job
+ *  @setup_outformat: setup output format of writeback block from writeback job
+ *  @setup_qos_lut:   setup qos LUT for writeback block based on input
+ *  @setup_cdp:       setup chroma down prefetch block for writeback block
+ *  @setup_clk_force_ctrl: setup clock force control
+ *  @bind_pingpong_blk: enable/disable the connection with ping-pong block
+ */
+struct dpu_hw_wb_ops {
+	void (*setup_outaddress)(struct dpu_hw_wb *ctx,
+			struct dpu_hw_wb_cfg *wb);
+
+	void (*setup_outformat)(struct dpu_hw_wb *ctx,
+			struct dpu_hw_wb_cfg *wb);
+
+	void (*setup_roi)(struct dpu_hw_wb *ctx,
+			struct dpu_hw_wb_cfg *wb);
+
+	void (*setup_qos_lut)(struct dpu_hw_wb *ctx,
+			struct dpu_hw_qos_cfg *cfg);
+
+	void (*setup_cdp)(struct dpu_hw_wb *ctx,
+			  const struct dpu_format *fmt,
+			  bool enable);
+
+	bool (*setup_clk_force_ctrl)(struct dpu_hw_wb *ctx,
+				     bool enable);
+
+	void (*bind_pingpong_blk)(struct dpu_hw_wb *ctx,
+				  const enum dpu_pingpong pp);
+};
+
+/**
+ * struct dpu_hw_wb : WB driver object
+ * @hw: block hardware details
+ * @idx: hardware index number within type
+ * @wb_hw_caps: hardware capabilities
+ * @ops: function pointers
+ */
+struct dpu_hw_wb {
+	struct dpu_hw_blk_reg_map hw;
+
+	/* wb path */
+	int idx;
+	const struct dpu_wb_cfg *caps;
+
+	/* ops */
+	struct dpu_hw_wb_ops ops;
+};
+
+/**
+ * dpu_hw_wb_init() - Initializes the writeback hw driver object.
+ * @dev:  Corresponding device for devres management
+ * @cfg:  wb_path catalog entry for which driver object is required
+ * @addr: mapped register io address of MDP
+ * @mdss_rev: dpu core's major and minor versions
+ * Return: Error code or allocated dpu_hw_wb context
+ */
+struct dpu_hw_wb *dpu_hw_wb_init(struct drm_device *dev,
+				 const struct dpu_wb_cfg *cfg,
+				 void __iomem *addr,
+				 const struct dpu_mdss_version *mdss_rev);
+
+#endif /*_DPU_HW_WB_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hwio.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_hwio.h
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DPU_HWIO_H
+#define _DPU_HWIO_H
+
+#include "dpu_hw_util.h"
+
+/**
+ * MDP TOP block Register and bit fields and defines
+ */
+#define DISP_INTF_SEL                   0x004
+#define INTR_EN                         0x010
+#define INTR_STATUS                     0x014
+#define INTR_CLEAR                      0x018
+#define INTR2_EN                        0x008
+#define INTR2_STATUS                    0x00c
+#define SSPP_SPARE                      0x028
+#define INTR2_CLEAR                     0x02c
+#define HIST_INTR_EN                    0x01c
+#define HIST_INTR_STATUS                0x020
+#define HIST_INTR_CLEAR                 0x024
+#define SPLIT_DISPLAY_EN                0x2F4
+#define SPLIT_DISPLAY_UPPER_PIPE_CTRL   0x2F8
+#define DSPP_IGC_COLOR0_RAM_LUTN        0x300
+#define DSPP_IGC_COLOR1_RAM_LUTN        0x304
+#define DSPP_IGC_COLOR2_RAM_LUTN        0x308
+#define DANGER_STATUS                   0x360
+#define SAFE_STATUS                     0x364
+#define HW_EVENTS_CTL                   0x37C
+#define MDP_WD_TIMER_0_CTL              0x380
+#define MDP_WD_TIMER_0_CTL2             0x384
+#define MDP_WD_TIMER_0_LOAD_VALUE       0x388
+#define MDP_WD_TIMER_1_CTL              0x390
+#define MDP_WD_TIMER_1_CTL2             0x394
+#define MDP_WD_TIMER_1_LOAD_VALUE       0x398
+#define CLK_CTRL3                       0x3A8
+#define CLK_STATUS3                     0x3AC
+#define CLK_CTRL4                       0x3B0
+#define CLK_STATUS4                     0x3B4
+#define CLK_CTRL5                       0x3B8
+#define CLK_STATUS5                     0x3BC
+#define CLK_CTRL7                       0x3D0
+#define CLK_STATUS7                     0x3D4
+#define SPLIT_DISPLAY_LOWER_PIPE_CTRL   0x3F0
+#define SPLIT_DISPLAY_TE_LINE_INTERVAL  0x3F4
+#define INTF_SW_RESET_MASK              0x3FC
+#define HDMI_DP_CORE_SELECT             0x408
+#define MDP_OUT_CTL_0                   0x410
+#define MDP_VSYNC_SEL                   0x414
+#define MDP_WD_TIMER_2_CTL              0x420
+#define MDP_WD_TIMER_2_CTL2             0x424
+#define MDP_WD_TIMER_2_LOAD_VALUE       0x428
+#define MDP_WD_TIMER_3_CTL              0x430
+#define MDP_WD_TIMER_3_CTL2             0x434
+#define MDP_WD_TIMER_3_LOAD_VALUE       0x438
+#define MDP_WD_TIMER_4_CTL              0x440
+#define MDP_WD_TIMER_4_CTL2             0x444
+#define MDP_WD_TIMER_4_LOAD_VALUE       0x448
+#define DCE_SEL                         0x450
+
+#define MDP_PERIPH_TOP0			MDP_WD_TIMER_0_CTL
+#define MDP_PERIPH_TOP0_END		CLK_CTRL3
+
+#endif /*_DPU_HWIO_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_kms.c
@@ -0,0 +1,1402 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Copyright (c) 2014-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+
+#include <linux/debugfs.h>
+#include <linux/dma-buf.h>
+#include <linux/of_irq.h>
+#include <linux/pm_opp.h>
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_file.h>
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_vblank.h>
+#include <drm/drm_writeback.h>
+
+#include "msm_drv.h"
+#include "msm_mmu.h"
+#include "msm_mdss.h"
+#include "msm_gem.h"
+#include "disp/msm_disp_snapshot.h"
+
+#include "dpu_core_irq.h"
+#include "dpu_crtc.h"
+#include "dpu_encoder.h"
+#include "dpu_formats.h"
+#include "dpu_hw_vbif.h"
+#include "dpu_kms.h"
+#include "dpu_plane.h"
+#include "dpu_vbif.h"
+#include "dpu_writeback.h"
+
+#define CREATE_TRACE_POINTS
+#include "dpu_trace.h"
+
+/*
+ * To enable overall DRM driver logging
+ * # echo 0x2 > /sys/module/drm/parameters/debug
+ *
+ * To enable DRM driver h/w logging
+ * # echo <mask> > /sys/kernel/debug/dri/0/debug/hw_log_mask
+ *
+ * See dpu_hw_mdss.h for h/w logging mask definitions (search for DPU_DBG_MASK_)
+ */
+#define DPU_DEBUGFS_DIR "msm_dpu"
+#define DPU_DEBUGFS_HWMASKNAME "hw_log_mask"
+
+static int dpu_kms_hw_init(struct msm_kms *kms);
+static void _dpu_kms_mmu_destroy(struct dpu_kms *dpu_kms);
+
+#ifdef CONFIG_DEBUG_FS
+static int _dpu_danger_signal_status(struct seq_file *s,
+		bool danger_status)
+{
+	struct dpu_danger_safe_status status;
+	struct dpu_kms *kms = s->private;
+	int i;
+
+	if (!kms->hw_mdp) {
+		DPU_ERROR("invalid arg(s)\n");
+		return 0;
+	}
+
+	memset(&status, 0, sizeof(struct dpu_danger_safe_status));
+
+	pm_runtime_get_sync(&kms->pdev->dev);
+	if (danger_status) {
+		seq_puts(s, "\nDanger signal status:\n");
+		if (kms->hw_mdp->ops.get_danger_status)
+			kms->hw_mdp->ops.get_danger_status(kms->hw_mdp,
+					&status);
+	} else {
+		seq_puts(s, "\nSafe signal status:\n");
+		if (kms->hw_mdp->ops.get_safe_status)
+			kms->hw_mdp->ops.get_safe_status(kms->hw_mdp,
+					&status);
+	}
+	pm_runtime_put_sync(&kms->pdev->dev);
+
+	seq_printf(s, "MDP     :  0x%x\n", status.mdp);
+
+	for (i = SSPP_VIG0; i < SSPP_MAX; i++)
+		seq_printf(s, "SSPP%d   :  0x%x  \n", i - SSPP_VIG0,
+				status.sspp[i]);
+	seq_puts(s, "\n");
+
+	return 0;
+}
+
+static int dpu_debugfs_danger_stats_show(struct seq_file *s, void *v)
+{
+	return _dpu_danger_signal_status(s, true);
+}
+DEFINE_SHOW_ATTRIBUTE(dpu_debugfs_danger_stats);
+
+static int dpu_debugfs_safe_stats_show(struct seq_file *s, void *v)
+{
+	return _dpu_danger_signal_status(s, false);
+}
+DEFINE_SHOW_ATTRIBUTE(dpu_debugfs_safe_stats);
+
+static ssize_t _dpu_plane_danger_read(struct file *file,
+			char __user *buff, size_t count, loff_t *ppos)
+{
+	struct dpu_kms *kms = file->private_data;
+	int len;
+	char buf[40];
+
+	len = scnprintf(buf, sizeof(buf), "%d\n", !kms->has_danger_ctrl);
+
+	return simple_read_from_buffer(buff, count, ppos, buf, len);
+}
+
+static void _dpu_plane_set_danger_state(struct dpu_kms *kms, bool enable)
+{
+	struct drm_plane *plane;
+
+	drm_for_each_plane(plane, kms->dev) {
+		if (plane->fb && plane->state) {
+			dpu_plane_danger_signal_ctrl(plane, enable);
+			DPU_DEBUG("plane:%d img:%dx%d ",
+				plane->base.id, plane->fb->width,
+				plane->fb->height);
+			DPU_DEBUG("src[%d,%d,%d,%d] dst[%d,%d,%d,%d]\n",
+				plane->state->src_x >> 16,
+				plane->state->src_y >> 16,
+				plane->state->src_w >> 16,
+				plane->state->src_h >> 16,
+				plane->state->crtc_x, plane->state->crtc_y,
+				plane->state->crtc_w, plane->state->crtc_h);
+		} else {
+			DPU_DEBUG("Inactive plane:%d\n", plane->base.id);
+		}
+	}
+}
+
+static ssize_t _dpu_plane_danger_write(struct file *file,
+		    const char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct dpu_kms *kms = file->private_data;
+	int disable_panic;
+	int ret;
+
+	ret = kstrtouint_from_user(user_buf, count, 0, &disable_panic);
+	if (ret)
+		return ret;
+
+	if (disable_panic) {
+		/* Disable panic signal for all active pipes */
+		DPU_DEBUG("Disabling danger:\n");
+		_dpu_plane_set_danger_state(kms, false);
+		kms->has_danger_ctrl = false;
+	} else {
+		/* Enable panic signal for all active pipes */
+		DPU_DEBUG("Enabling danger:\n");
+		kms->has_danger_ctrl = true;
+		_dpu_plane_set_danger_state(kms, true);
+	}
+
+	return count;
+}
+
+static const struct file_operations dpu_plane_danger_enable = {
+	.open = simple_open,
+	.read = _dpu_plane_danger_read,
+	.write = _dpu_plane_danger_write,
+};
+
+static void dpu_debugfs_danger_init(struct dpu_kms *dpu_kms,
+		struct dentry *parent)
+{
+	struct dentry *entry = debugfs_create_dir("danger", parent);
+
+	debugfs_create_file("danger_status", 0600, entry,
+			dpu_kms, &dpu_debugfs_danger_stats_fops);
+	debugfs_create_file("safe_status", 0600, entry,
+			dpu_kms, &dpu_debugfs_safe_stats_fops);
+	debugfs_create_file("disable_danger", 0600, entry,
+			dpu_kms, &dpu_plane_danger_enable);
+
+}
+
+/*
+ * Companion structure for dpu_debugfs_create_regset32.
+ */
+struct dpu_debugfs_regset32 {
+	uint32_t offset;
+	uint32_t blk_len;
+	struct dpu_kms *dpu_kms;
+};
+
+static int dpu_regset32_show(struct seq_file *s, void *data)
+{
+	struct dpu_debugfs_regset32 *regset = s->private;
+	struct dpu_kms *dpu_kms = regset->dpu_kms;
+	void __iomem *base;
+	uint32_t i, addr;
+
+	if (!dpu_kms->mmio)
+		return 0;
+
+	base = dpu_kms->mmio + regset->offset;
+
+	/* insert padding spaces, if needed */
+	if (regset->offset & 0xF) {
+		seq_printf(s, "[%x]", regset->offset & ~0xF);
+		for (i = 0; i < (regset->offset & 0xF); i += 4)
+			seq_puts(s, "         ");
+	}
+
+	pm_runtime_get_sync(&dpu_kms->pdev->dev);
+
+	/* main register output */
+	for (i = 0; i < regset->blk_len; i += 4) {
+		addr = regset->offset + i;
+		if ((addr & 0xF) == 0x0)
+			seq_printf(s, i ? "\n[%x]" : "[%x]", addr);
+		seq_printf(s, " %08x", readl_relaxed(base + i));
+	}
+	seq_puts(s, "\n");
+	pm_runtime_put_sync(&dpu_kms->pdev->dev);
+
+	return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(dpu_regset32);
+
+void dpu_debugfs_create_regset32(const char *name, umode_t mode,
+		void *parent,
+		uint32_t offset, uint32_t length, struct dpu_kms *dpu_kms)
+{
+	struct dpu_debugfs_regset32 *regset;
+
+	if (WARN_ON(!name || !dpu_kms || !length))
+		return;
+
+	regset = devm_kzalloc(&dpu_kms->pdev->dev, sizeof(*regset), GFP_KERNEL);
+	if (!regset)
+		return;
+
+	/* make sure offset is a multiple of 4 */
+	regset->offset = round_down(offset, 4);
+	regset->blk_len = length;
+	regset->dpu_kms = dpu_kms;
+
+	debugfs_create_file(name, mode, parent, regset, &dpu_regset32_fops);
+}
+
+static void dpu_debugfs_sspp_init(struct dpu_kms *dpu_kms, struct dentry *debugfs_root)
+{
+	struct dentry *entry = debugfs_create_dir("sspp", debugfs_root);
+	int i;
+
+	if (IS_ERR(entry))
+		return;
+
+	for (i = SSPP_NONE; i < SSPP_MAX; i++) {
+		struct dpu_hw_sspp *hw = dpu_rm_get_sspp(&dpu_kms->rm, i);
+
+		if (!hw)
+			continue;
+
+		_dpu_hw_sspp_init_debugfs(hw, dpu_kms, entry);
+	}
+}
+
+static int dpu_kms_debugfs_init(struct msm_kms *kms, struct drm_minor *minor)
+{
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+	void *p = dpu_hw_util_get_log_mask_ptr();
+	struct dentry *entry;
+
+	if (!p)
+		return -EINVAL;
+
+	/* Only create a set of debugfs for the primary node, ignore render nodes */
+	if (minor->type != DRM_MINOR_PRIMARY)
+		return 0;
+
+	entry = debugfs_create_dir("debug", minor->debugfs_root);
+
+	debugfs_create_x32(DPU_DEBUGFS_HWMASKNAME, 0600, entry, p);
+
+	dpu_debugfs_danger_init(dpu_kms, entry);
+	dpu_debugfs_vbif_init(dpu_kms, entry);
+	dpu_debugfs_core_irq_init(dpu_kms, entry);
+	dpu_debugfs_sspp_init(dpu_kms, entry);
+
+	return dpu_core_perf_debugfs_init(dpu_kms, entry);
+}
+#endif
+
+/* Global/shared object state funcs */
+
+/*
+ * This is a helper that returns the private state currently in operation.
+ * Note that this would return the "old_state" if called in the atomic check
+ * path, and the "new_state" after the atomic swap has been done.
+ */
+struct dpu_global_state *
+dpu_kms_get_existing_global_state(struct dpu_kms *dpu_kms)
+{
+	return to_dpu_global_state(dpu_kms->global_state.state);
+}
+
+/*
+ * This acquires the modeset lock set aside for global state, creates
+ * a new duplicated private object state.
+ */
+struct dpu_global_state *dpu_kms_get_global_state(struct drm_atomic_state *s)
+{
+	struct msm_drm_private *priv = s->dev->dev_private;
+	struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms);
+	struct drm_private_state *priv_state;
+	int ret;
+
+	ret = drm_modeset_lock(&dpu_kms->global_state_lock, s->acquire_ctx);
+	if (ret)
+		return ERR_PTR(ret);
+
+	priv_state = drm_atomic_get_private_obj_state(s,
+						&dpu_kms->global_state);
+	if (IS_ERR(priv_state))
+		return ERR_CAST(priv_state);
+
+	return to_dpu_global_state(priv_state);
+}
+
+static struct drm_private_state *
+dpu_kms_global_duplicate_state(struct drm_private_obj *obj)
+{
+	struct dpu_global_state *state;
+
+	state = kmemdup(obj->state, sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return NULL;
+
+	__drm_atomic_helper_private_obj_duplicate_state(obj, &state->base);
+
+	return &state->base;
+}
+
+static void dpu_kms_global_destroy_state(struct drm_private_obj *obj,
+				      struct drm_private_state *state)
+{
+	struct dpu_global_state *dpu_state = to_dpu_global_state(state);
+
+	kfree(dpu_state);
+}
+
+static const struct drm_private_state_funcs dpu_kms_global_state_funcs = {
+	.atomic_duplicate_state = dpu_kms_global_duplicate_state,
+	.atomic_destroy_state = dpu_kms_global_destroy_state,
+};
+
+static int dpu_kms_global_obj_init(struct dpu_kms *dpu_kms)
+{
+	struct dpu_global_state *state;
+
+	drm_modeset_lock_init(&dpu_kms->global_state_lock);
+
+	state = kzalloc(sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return -ENOMEM;
+
+	drm_atomic_private_obj_init(dpu_kms->dev, &dpu_kms->global_state,
+				    &state->base,
+				    &dpu_kms_global_state_funcs);
+	return 0;
+}
+
+static void dpu_kms_global_obj_fini(struct dpu_kms *dpu_kms)
+{
+	drm_atomic_private_obj_fini(&dpu_kms->global_state);
+	drm_modeset_lock_fini(&dpu_kms->global_state_lock);
+}
+
+static int dpu_kms_parse_data_bus_icc_path(struct dpu_kms *dpu_kms)
+{
+	struct icc_path *path0;
+	struct icc_path *path1;
+	struct device *dpu_dev = &dpu_kms->pdev->dev;
+
+	path0 = msm_icc_get(dpu_dev, "mdp0-mem");
+	path1 = msm_icc_get(dpu_dev, "mdp1-mem");
+
+	if (IS_ERR_OR_NULL(path0))
+		return PTR_ERR_OR_ZERO(path0);
+
+	dpu_kms->path[0] = path0;
+	dpu_kms->num_paths = 1;
+
+	if (!IS_ERR_OR_NULL(path1)) {
+		dpu_kms->path[1] = path1;
+		dpu_kms->num_paths++;
+	}
+	return 0;
+}
+
+static int dpu_kms_enable_vblank(struct msm_kms *kms, struct drm_crtc *crtc)
+{
+	return dpu_crtc_vblank(crtc, true);
+}
+
+static void dpu_kms_disable_vblank(struct msm_kms *kms, struct drm_crtc *crtc)
+{
+	dpu_crtc_vblank(crtc, false);
+}
+
+static void dpu_kms_enable_commit(struct msm_kms *kms)
+{
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+	pm_runtime_get_sync(&dpu_kms->pdev->dev);
+}
+
+static void dpu_kms_disable_commit(struct msm_kms *kms)
+{
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+	pm_runtime_put_sync(&dpu_kms->pdev->dev);
+}
+
+static void dpu_kms_flush_commit(struct msm_kms *kms, unsigned crtc_mask)
+{
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+	struct drm_crtc *crtc;
+
+	for_each_crtc_mask(dpu_kms->dev, crtc, crtc_mask) {
+		if (!crtc->state->active)
+			continue;
+
+		trace_dpu_kms_commit(DRMID(crtc));
+		dpu_crtc_commit_kickoff(crtc);
+	}
+}
+
+static void dpu_kms_complete_commit(struct msm_kms *kms, unsigned crtc_mask)
+{
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+	struct drm_crtc *crtc;
+
+	DPU_ATRACE_BEGIN("kms_complete_commit");
+
+	for_each_crtc_mask(dpu_kms->dev, crtc, crtc_mask)
+		dpu_crtc_complete_commit(crtc);
+
+	DPU_ATRACE_END("kms_complete_commit");
+}
+
+static void dpu_kms_wait_for_commit_done(struct msm_kms *kms,
+		struct drm_crtc *crtc)
+{
+	struct drm_encoder *encoder;
+	struct drm_device *dev;
+	int ret;
+
+	if (!kms || !crtc || !crtc->state) {
+		DPU_ERROR("invalid params\n");
+		return;
+	}
+
+	dev = crtc->dev;
+
+	if (!crtc->state->enable) {
+		DPU_DEBUG("[crtc:%d] not enable\n", crtc->base.id);
+		return;
+	}
+
+	if (!drm_atomic_crtc_effectively_active(crtc->state)) {
+		DPU_DEBUG("[crtc:%d] not active\n", crtc->base.id);
+		return;
+	}
+
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		if (encoder->crtc != crtc)
+			continue;
+		/*
+		 * Wait for post-flush if necessary to delay before
+		 * plane_cleanup. For example, wait for vsync in case of video
+		 * mode panels. This may be a no-op for command mode panels.
+		 */
+		trace_dpu_kms_wait_for_commit_done(DRMID(crtc));
+		ret = dpu_encoder_wait_for_commit_done(encoder);
+		if (ret && ret != -EWOULDBLOCK) {
+			DPU_ERROR("wait for commit done returned %d\n", ret);
+			break;
+		}
+	}
+}
+
+static void dpu_kms_wait_flush(struct msm_kms *kms, unsigned crtc_mask)
+{
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+	struct drm_crtc *crtc;
+
+	for_each_crtc_mask(dpu_kms->dev, crtc, crtc_mask)
+		dpu_kms_wait_for_commit_done(kms, crtc);
+}
+
+static int _dpu_kms_initialize_dsi(struct drm_device *dev,
+				    struct msm_drm_private *priv,
+				    struct dpu_kms *dpu_kms)
+{
+	struct drm_encoder *encoder = NULL;
+	struct msm_display_info info;
+	int i, rc = 0;
+
+	if (!(priv->dsi[0] || priv->dsi[1]))
+		return rc;
+
+	/*
+	 * We support following confiurations:
+	 * - Single DSI host (dsi0 or dsi1)
+	 * - Two independent DSI hosts
+	 * - Bonded DSI0 and DSI1 hosts
+	 *
+	 * TODO: Support swapping DSI0 and DSI1 in the bonded setup.
+	 */
+	for (i = 0; i < ARRAY_SIZE(priv->dsi); i++) {
+		int other = (i + 1) % 2;
+
+		if (!priv->dsi[i])
+			continue;
+
+		if (msm_dsi_is_bonded_dsi(priv->dsi[i]) &&
+		    !msm_dsi_is_master_dsi(priv->dsi[i]))
+			continue;
+
+		memset(&info, 0, sizeof(info));
+		info.intf_type = INTF_DSI;
+
+		info.h_tile_instance[info.num_of_h_tiles++] = i;
+		if (msm_dsi_is_bonded_dsi(priv->dsi[i]))
+			info.h_tile_instance[info.num_of_h_tiles++] = other;
+
+		info.is_cmd_mode = msm_dsi_is_cmd_mode(priv->dsi[i]);
+
+		encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_DSI, &info);
+		if (IS_ERR(encoder)) {
+			DPU_ERROR("encoder init failed for dsi display\n");
+			return PTR_ERR(encoder);
+		}
+
+		rc = msm_dsi_modeset_init(priv->dsi[i], dev, encoder);
+		if (rc) {
+			DPU_ERROR("modeset_init failed for dsi[%d], rc = %d\n",
+				i, rc);
+			break;
+		}
+
+		if (msm_dsi_is_bonded_dsi(priv->dsi[i]) && priv->dsi[other]) {
+			rc = msm_dsi_modeset_init(priv->dsi[other], dev, encoder);
+			if (rc) {
+				DPU_ERROR("modeset_init failed for dsi[%d], rc = %d\n",
+					other, rc);
+				break;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int _dpu_kms_initialize_displayport(struct drm_device *dev,
+					    struct msm_drm_private *priv,
+					    struct dpu_kms *dpu_kms)
+{
+	struct drm_encoder *encoder = NULL;
+	struct msm_display_info info;
+	bool yuv_supported;
+	int rc;
+	int i, stream_id;
+	int stream_cnt;
+
+	for (i = 0; i < ARRAY_SIZE(priv->dp); i++) {
+		if (!priv->dp[i])
+			continue;
+
+		memset(&info, 0, sizeof(info));
+		info.num_of_h_tiles = 1;
+		info.h_tile_instance[0] = i;
+		info.intf_type = INTF_DP;
+
+		encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_TMDS, &info);
+		if (IS_ERR(encoder)) {
+			DPU_ERROR("encoder init failed for dsi display\n");
+			return PTR_ERR(encoder);
+		}
+
+		yuv_supported = !!dpu_kms->catalog->cdm;
+		rc = msm_dp_modeset_init(priv->dp[i], dev, encoder, yuv_supported);
+		if (rc) {
+			DPU_ERROR("modeset_init failed for DP, rc = %d\n", rc);
+			return rc;
+		}
+
+		stream_cnt = msm_dp_get_mst_max_stream(priv->dp[i]);
+
+		if (stream_cnt > 1) {
+			rc = msm_dp_mst_register(priv->dp[i]);
+			if (rc) {
+				DPU_ERROR("dp_mst_init failed for DP, rc = %d\n", rc);
+				return rc;
+			}
+
+			for (stream_id = 0; stream_id < stream_cnt; stream_id++) {
+				info.stream_id = stream_id;
+				encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_DPMST, &info);
+				if (IS_ERR(encoder)) {
+					DPU_ERROR("encoder init failed for dp mst display\n");
+					return PTR_ERR(encoder);
+				}
+
+				rc = msm_dp_mst_bridge_init(priv->dp[i], encoder);
+				if (rc) {
+					DPU_ERROR("dp mst bridge %d init failed, %d\n",
+						  stream_id, rc);
+					continue;
+				}
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int _dpu_kms_initialize_hdmi(struct drm_device *dev,
+				    struct msm_drm_private *priv,
+				    struct dpu_kms *dpu_kms)
+{
+	struct drm_encoder *encoder = NULL;
+	struct msm_display_info info;
+	int rc;
+
+	if (!priv->hdmi)
+		return 0;
+
+	memset(&info, 0, sizeof(info));
+	info.num_of_h_tiles = 1;
+	info.h_tile_instance[0] = 0;
+	info.intf_type = INTF_HDMI;
+
+	encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_TMDS, &info);
+	if (IS_ERR(encoder)) {
+		DPU_ERROR("encoder init failed for HDMI display\n");
+		return PTR_ERR(encoder);
+	}
+
+	rc = msm_hdmi_modeset_init(priv->hdmi, dev, encoder);
+	if (rc) {
+		DPU_ERROR("modeset_init failed for DP, rc = %d\n", rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+static int _dpu_kms_initialize_writeback(struct drm_device *dev,
+		struct msm_drm_private *priv, struct dpu_kms *dpu_kms,
+		const u32 *wb_formats, int n_formats)
+{
+	struct drm_encoder *encoder = NULL;
+	struct msm_display_info info;
+	const enum dpu_wb wb_idx = WB_2;
+	u32 maxlinewidth;
+	int rc;
+
+	memset(&info, 0, sizeof(info));
+
+	info.num_of_h_tiles = 1;
+	/* use only WB idx 2 instance for DPU */
+	info.h_tile_instance[0] = wb_idx;
+	info.intf_type = INTF_WB;
+
+	maxlinewidth = dpu_rm_get_wb(&dpu_kms->rm, info.h_tile_instance[0])->caps->maxlinewidth;
+
+	encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_VIRTUAL, &info);
+	if (IS_ERR(encoder)) {
+		DPU_ERROR("encoder init failed for dsi display\n");
+		return PTR_ERR(encoder);
+	}
+
+	rc = dpu_writeback_init(dev, encoder, wb_formats, n_formats, maxlinewidth);
+	if (rc) {
+		DPU_ERROR("dpu_writeback_init, rc = %d\n", rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+/**
+ * _dpu_kms_setup_displays - create encoders, bridges and connectors
+ *                           for underlying displays
+ * @dev:        Pointer to drm device structure
+ * @priv:       Pointer to private drm device data
+ * @dpu_kms:    Pointer to dpu kms structure
+ * Returns:     Zero on success
+ */
+static int _dpu_kms_setup_displays(struct drm_device *dev,
+				    struct msm_drm_private *priv,
+				    struct dpu_kms *dpu_kms)
+{
+	int rc = 0;
+	int i;
+
+	rc = _dpu_kms_initialize_dsi(dev, priv, dpu_kms);
+	if (rc) {
+		DPU_ERROR("initialize_dsi failed, rc = %d\n", rc);
+		return rc;
+	}
+
+	rc = _dpu_kms_initialize_displayport(dev, priv, dpu_kms);
+	if (rc) {
+		DPU_ERROR("initialize_DP failed, rc = %d\n", rc);
+		return rc;
+	}
+
+	rc = _dpu_kms_initialize_hdmi(dev, priv, dpu_kms);
+	if (rc) {
+		DPU_ERROR("initialize HDMI failed, rc = %d\n", rc);
+		return rc;
+	}
+
+	/* Since WB isn't a driver check the catalog before initializing */
+	if (dpu_kms->catalog->wb_count) {
+		for (i = 0; i < dpu_kms->catalog->wb_count; i++) {
+			if (dpu_kms->catalog->wb[i].id == WB_2) {
+				rc = _dpu_kms_initialize_writeback(dev, priv, dpu_kms,
+						dpu_kms->catalog->wb[i].format_list,
+						dpu_kms->catalog->wb[i].num_formats);
+				if (rc) {
+					DPU_ERROR("initialize_WB failed, rc = %d\n", rc);
+					return rc;
+				}
+			}
+		}
+	}
+
+	return rc;
+}
+
+#define MAX_PLANES 20
+static int _dpu_kms_drm_obj_init(struct dpu_kms *dpu_kms)
+{
+	struct drm_device *dev;
+	struct drm_plane *primary_planes[MAX_PLANES], *plane;
+	struct drm_plane *cursor_planes[MAX_PLANES] = { NULL };
+	struct drm_crtc *crtc;
+	struct drm_encoder *encoder;
+	unsigned int num_encoders;
+
+	struct msm_drm_private *priv;
+	const struct dpu_mdss_cfg *catalog;
+
+	int primary_planes_idx = 0, cursor_planes_idx = 0, i, ret;
+	int max_crtc_count;
+	dev = dpu_kms->dev;
+	priv = dev->dev_private;
+	catalog = dpu_kms->catalog;
+
+	/*
+	 * Create encoder and query display drivers to create
+	 * bridges and connectors
+	 */
+	ret = _dpu_kms_setup_displays(dev, priv, dpu_kms);
+	if (ret)
+		return ret;
+
+	num_encoders = 0;
+	drm_for_each_encoder(encoder, dev)
+		num_encoders++;
+
+	max_crtc_count = min(catalog->mixer_count, num_encoders);
+
+	/* Create the planes, keeping track of one primary/cursor per crtc */
+	for (i = 0; i < catalog->sspp_count; i++) {
+		enum drm_plane_type type;
+
+		if ((catalog->sspp[i].features & BIT(DPU_SSPP_CURSOR))
+			&& cursor_planes_idx < max_crtc_count)
+			type = DRM_PLANE_TYPE_CURSOR;
+		else if (primary_planes_idx < max_crtc_count)
+			type = DRM_PLANE_TYPE_PRIMARY;
+		else
+			type = DRM_PLANE_TYPE_OVERLAY;
+
+		DPU_DEBUG("Create plane type %d with features %lx (cur %lx)\n",
+			  type, catalog->sspp[i].features,
+			  catalog->sspp[i].features & BIT(DPU_SSPP_CURSOR));
+
+		plane = dpu_plane_init(dev, catalog->sspp[i].id, type,
+				       (1UL << max_crtc_count) - 1);
+		if (IS_ERR(plane)) {
+			DPU_ERROR("dpu_plane_init failed\n");
+			ret = PTR_ERR(plane);
+			return ret;
+		}
+
+		if (type == DRM_PLANE_TYPE_CURSOR)
+			cursor_planes[cursor_planes_idx++] = plane;
+		else if (type == DRM_PLANE_TYPE_PRIMARY)
+			primary_planes[primary_planes_idx++] = plane;
+	}
+
+	max_crtc_count = min(max_crtc_count, primary_planes_idx);
+
+	/* Create one CRTC per encoder */
+	for (i = 0; i < max_crtc_count; i++) {
+		crtc = dpu_crtc_init(dev, primary_planes[i], cursor_planes[i]);
+		if (IS_ERR(crtc)) {
+			ret = PTR_ERR(crtc);
+			return ret;
+		}
+		priv->num_crtcs++;
+	}
+
+	/* All CRTCs are compatible with all encoders */
+	drm_for_each_encoder(encoder, dev)
+		encoder->possible_crtcs = (1 << priv->num_crtcs) - 1;
+
+	return 0;
+}
+
+static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)
+{
+	int i;
+
+	dpu_kms->hw_intr = NULL;
+
+	/* safe to call these more than once during shutdown */
+	_dpu_kms_mmu_destroy(dpu_kms);
+
+	for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) {
+		dpu_kms->hw_vbif[i] = NULL;
+	}
+
+	dpu_kms_global_obj_fini(dpu_kms);
+
+	dpu_kms->catalog = NULL;
+
+	dpu_kms->hw_mdp = NULL;
+}
+
+static void dpu_kms_destroy(struct msm_kms *kms)
+{
+	struct dpu_kms *dpu_kms;
+
+	if (!kms) {
+		DPU_ERROR("invalid kms\n");
+		return;
+	}
+
+	dpu_kms = to_dpu_kms(kms);
+
+	_dpu_kms_hw_destroy(dpu_kms);
+
+	msm_kms_destroy(&dpu_kms->base);
+
+	if (dpu_kms->rpm_enabled)
+		pm_runtime_disable(&dpu_kms->pdev->dev);
+}
+
+static int dpu_irq_postinstall(struct msm_kms *kms)
+{
+	struct msm_drm_private *priv;
+	struct dpu_kms *dpu_kms = to_dpu_kms(kms);
+
+	if (!dpu_kms || !dpu_kms->dev)
+		return -EINVAL;
+
+	priv = dpu_kms->dev->dev_private;
+	if (!priv)
+		return -EINVAL;
+
+	return 0;
+}
+
+static void dpu_kms_mdp_snapshot(struct msm_disp_state *disp_state, struct msm_kms *kms)
+{
+	int i;
+	struct dpu_kms *dpu_kms;
+	const struct dpu_mdss_cfg *cat;
+	void __iomem *base;
+
+	dpu_kms = to_dpu_kms(kms);
+
+	cat = dpu_kms->catalog;
+
+	pm_runtime_get_sync(&dpu_kms->pdev->dev);
+
+	/* dump CTL sub-blocks HW regs info */
+	for (i = 0; i < cat->ctl_count; i++)
+		msm_disp_snapshot_add_block(disp_state, cat->ctl[i].len,
+				dpu_kms->mmio + cat->ctl[i].base, cat->ctl[i].name);
+
+	/* dump DSPP sub-blocks HW regs info */
+	for (i = 0; i < cat->dspp_count; i++) {
+		base = dpu_kms->mmio + cat->dspp[i].base;
+		msm_disp_snapshot_add_block(disp_state, cat->dspp[i].len, base, cat->dspp[i].name);
+
+		if (cat->dspp[i].sblk && cat->dspp[i].sblk->pcc.len > 0)
+			msm_disp_snapshot_add_block(disp_state, cat->dspp[i].sblk->pcc.len,
+						    base + cat->dspp[i].sblk->pcc.base, "%s_%s",
+						    cat->dspp[i].name,
+						    cat->dspp[i].sblk->pcc.name);
+	}
+
+	/* dump INTF sub-blocks HW regs info */
+	for (i = 0; i < cat->intf_count; i++)
+		msm_disp_snapshot_add_block(disp_state, cat->intf[i].len,
+				dpu_kms->mmio + cat->intf[i].base, cat->intf[i].name);
+
+	/* dump PP sub-blocks HW regs info */
+	for (i = 0; i < cat->pingpong_count; i++) {
+		base = dpu_kms->mmio + cat->pingpong[i].base;
+		msm_disp_snapshot_add_block(disp_state, cat->pingpong[i].len, base,
+					    cat->pingpong[i].name);
+
+		/* TE2 sub-block has length of 0, so will not print it */
+
+		if (cat->pingpong[i].sblk && cat->pingpong[i].sblk->dither.len > 0)
+			msm_disp_snapshot_add_block(disp_state, cat->pingpong[i].sblk->dither.len,
+						    base + cat->pingpong[i].sblk->dither.base,
+						    "%s_%s", cat->pingpong[i].name,
+						    cat->pingpong[i].sblk->dither.name);
+	}
+
+	/* dump SSPP sub-blocks HW regs info */
+	for (i = 0; i < cat->sspp_count; i++) {
+		base = dpu_kms->mmio + cat->sspp[i].base;
+		msm_disp_snapshot_add_block(disp_state, cat->sspp[i].len, base, cat->sspp[i].name);
+
+		if (cat->sspp[i].sblk && cat->sspp[i].sblk->scaler_blk.len > 0)
+			msm_disp_snapshot_add_block(disp_state, cat->sspp[i].sblk->scaler_blk.len,
+						    base + cat->sspp[i].sblk->scaler_blk.base,
+						    "%s_%s", cat->sspp[i].name,
+						    cat->sspp[i].sblk->scaler_blk.name);
+
+		if (cat->sspp[i].sblk && cat->sspp[i].sblk->csc_blk.len > 0)
+			msm_disp_snapshot_add_block(disp_state, cat->sspp[i].sblk->csc_blk.len,
+						    base + cat->sspp[i].sblk->csc_blk.base,
+						    "%s_%s", cat->sspp[i].name,
+						    cat->sspp[i].sblk->csc_blk.name);
+	}
+
+	/* dump LM sub-blocks HW regs info */
+	for (i = 0; i < cat->mixer_count; i++)
+		msm_disp_snapshot_add_block(disp_state, cat->mixer[i].len,
+				dpu_kms->mmio + cat->mixer[i].base, cat->mixer[i].name);
+
+	/* dump WB sub-blocks HW regs info */
+	for (i = 0; i < cat->wb_count; i++)
+		msm_disp_snapshot_add_block(disp_state, cat->wb[i].len,
+				dpu_kms->mmio + cat->wb[i].base, cat->wb[i].name);
+
+	if (cat->mdp[0].features & BIT(DPU_MDP_PERIPH_0_REMOVED)) {
+		msm_disp_snapshot_add_block(disp_state, MDP_PERIPH_TOP0,
+				dpu_kms->mmio + cat->mdp[0].base, "top");
+		msm_disp_snapshot_add_block(disp_state, cat->mdp[0].len - MDP_PERIPH_TOP0_END,
+				dpu_kms->mmio + cat->mdp[0].base + MDP_PERIPH_TOP0_END, "top_2");
+	} else {
+		msm_disp_snapshot_add_block(disp_state, cat->mdp[0].len,
+				dpu_kms->mmio + cat->mdp[0].base, "top");
+	}
+
+	/* dump DSC sub-blocks HW regs info */
+	for (i = 0; i < cat->dsc_count; i++) {
+		base = dpu_kms->mmio + cat->dsc[i].base;
+		msm_disp_snapshot_add_block(disp_state, cat->dsc[i].len, base, cat->dsc[i].name);
+
+		if (cat->dsc[i].features & BIT(DPU_DSC_HW_REV_1_2)) {
+			struct dpu_dsc_blk enc = cat->dsc[i].sblk->enc;
+			struct dpu_dsc_blk ctl = cat->dsc[i].sblk->ctl;
+
+			msm_disp_snapshot_add_block(disp_state, enc.len, base + enc.base, "%s_%s",
+						    cat->dsc[i].name, enc.name);
+			msm_disp_snapshot_add_block(disp_state, ctl.len, base + ctl.base, "%s_%s",
+						    cat->dsc[i].name, ctl.name);
+		}
+	}
+
+	if (cat->cdm)
+		msm_disp_snapshot_add_block(disp_state, cat->cdm->len,
+					    dpu_kms->mmio + cat->cdm->base, cat->cdm->name);
+
+	pm_runtime_put_sync(&dpu_kms->pdev->dev);
+}
+
+static const struct msm_kms_funcs kms_funcs = {
+	.hw_init         = dpu_kms_hw_init,
+	.irq_preinstall  = dpu_core_irq_preinstall,
+	.irq_postinstall = dpu_irq_postinstall,
+	.irq_uninstall   = dpu_core_irq_uninstall,
+	.irq             = dpu_core_irq,
+	.enable_commit   = dpu_kms_enable_commit,
+	.disable_commit  = dpu_kms_disable_commit,
+	.flush_commit    = dpu_kms_flush_commit,
+	.wait_flush      = dpu_kms_wait_flush,
+	.complete_commit = dpu_kms_complete_commit,
+	.enable_vblank   = dpu_kms_enable_vblank,
+	.disable_vblank  = dpu_kms_disable_vblank,
+	.check_modified_format = dpu_format_check_modified_format,
+	.get_format      = dpu_get_msm_format,
+	.destroy         = dpu_kms_destroy,
+	.snapshot        = dpu_kms_mdp_snapshot,
+#ifdef CONFIG_DEBUG_FS
+	.debugfs_init    = dpu_kms_debugfs_init,
+#endif
+};
+
+static void _dpu_kms_mmu_destroy(struct dpu_kms *dpu_kms)
+{
+	struct msm_mmu *mmu;
+
+	if (!dpu_kms->base.aspace)
+		return;
+
+	mmu = dpu_kms->base.aspace->mmu;
+
+	mmu->funcs->detach(mmu);
+	msm_gem_address_space_put(dpu_kms->base.aspace);
+
+	dpu_kms->base.aspace = NULL;
+}
+
+static int _dpu_kms_mmu_init(struct dpu_kms *dpu_kms)
+{
+	struct msm_gem_address_space *aspace;
+
+	aspace = msm_kms_init_aspace(dpu_kms->dev);
+	if (IS_ERR(aspace))
+		return PTR_ERR(aspace);
+
+	dpu_kms->base.aspace = aspace;
+
+	return 0;
+}
+
+unsigned long dpu_kms_get_clk_rate(struct dpu_kms *dpu_kms, char *clock_name)
+{
+	struct clk *clk;
+
+	clk = msm_clk_bulk_get_clock(dpu_kms->clocks, dpu_kms->num_clocks, clock_name);
+	if (!clk)
+		return 0;
+
+	return clk_get_rate(clk);
+}
+
+#define	DPU_PERF_DEFAULT_MAX_CORE_CLK_RATE	412500000
+
+static int dpu_kms_hw_init(struct msm_kms *kms)
+{
+	struct dpu_kms *dpu_kms;
+	struct drm_device *dev;
+	int i, rc = -EINVAL;
+	unsigned long max_core_clk_rate;
+	u32 core_rev;
+
+	if (!kms) {
+		DPU_ERROR("invalid kms\n");
+		return rc;
+	}
+
+	dpu_kms = to_dpu_kms(kms);
+	dev = dpu_kms->dev;
+
+	dev->mode_config.cursor_width = 512;
+	dev->mode_config.cursor_height = 512;
+
+	rc = dpu_kms_global_obj_init(dpu_kms);
+	if (rc)
+		return rc;
+
+	atomic_set(&dpu_kms->bandwidth_ref, 0);
+
+	rc = pm_runtime_resume_and_get(&dpu_kms->pdev->dev);
+	if (rc < 0)
+		goto error;
+
+	core_rev = readl_relaxed(dpu_kms->mmio + 0x0);
+
+	pr_info("dpu hardware revision:0x%x\n", core_rev);
+
+	dpu_kms->catalog = of_device_get_match_data(dev->dev);
+	if (!dpu_kms->catalog) {
+		DPU_ERROR("device config not known!\n");
+		rc = -EINVAL;
+		goto err_pm_put;
+	}
+
+	/*
+	 * Now we need to read the HW catalog and initialize resources such as
+	 * clocks, regulators, GDSC/MMAGIC, ioremap the register ranges etc
+	 */
+	rc = _dpu_kms_mmu_init(dpu_kms);
+	if (rc) {
+		DPU_ERROR("dpu_kms_mmu_init failed: %d\n", rc);
+		goto err_pm_put;
+	}
+
+	dpu_kms->mdss = msm_mdss_get_mdss_data(dpu_kms->pdev->dev.parent);
+	if (IS_ERR(dpu_kms->mdss)) {
+		rc = PTR_ERR(dpu_kms->mdss);
+		DPU_ERROR("failed to get MDSS data: %d\n", rc);
+		goto err_pm_put;
+	}
+
+	if (!dpu_kms->mdss) {
+		rc = -EINVAL;
+		DPU_ERROR("NULL MDSS data\n");
+		goto err_pm_put;
+	}
+
+	rc = dpu_rm_init(dev, &dpu_kms->rm, dpu_kms->catalog, dpu_kms->mdss, dpu_kms->mmio);
+	if (rc) {
+		DPU_ERROR("rm init failed: %d\n", rc);
+		goto err_pm_put;
+	}
+
+	dpu_kms->hw_mdp = dpu_hw_mdptop_init(dev,
+					     dpu_kms->catalog->mdp,
+					     dpu_kms->mmio,
+					     dpu_kms->catalog);
+	if (IS_ERR(dpu_kms->hw_mdp)) {
+		rc = PTR_ERR(dpu_kms->hw_mdp);
+		DPU_ERROR("failed to get hw_mdp: %d\n", rc);
+		dpu_kms->hw_mdp = NULL;
+		goto err_pm_put;
+	}
+
+	for (i = 0; i < dpu_kms->catalog->vbif_count; i++) {
+		struct dpu_hw_vbif *hw;
+		const struct dpu_vbif_cfg *vbif = &dpu_kms->catalog->vbif[i];
+
+		hw = dpu_hw_vbif_init(dev, vbif, dpu_kms->vbif[vbif->id]);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed to init vbif %d: %d\n", vbif->id, rc);
+			goto err_pm_put;
+		}
+
+		dpu_kms->hw_vbif[vbif->id] = hw;
+	}
+
+	/* TODO: use the same max_freq as in dpu_kms_hw_init */
+	max_core_clk_rate = dpu_kms_get_clk_rate(dpu_kms, "core");
+	if (!max_core_clk_rate) {
+		DPU_DEBUG("max core clk rate not determined, using default\n");
+		max_core_clk_rate = DPU_PERF_DEFAULT_MAX_CORE_CLK_RATE;
+	}
+
+	rc = dpu_core_perf_init(&dpu_kms->perf, dpu_kms->catalog->perf, max_core_clk_rate);
+	if (rc) {
+		DPU_ERROR("failed to init perf %d\n", rc);
+		goto err_pm_put;
+	}
+
+	dpu_kms->hw_intr = dpu_hw_intr_init(dev, dpu_kms->mmio, dpu_kms->catalog);
+	if (IS_ERR(dpu_kms->hw_intr)) {
+		rc = PTR_ERR(dpu_kms->hw_intr);
+		DPU_ERROR("hw_intr init failed: %d\n", rc);
+		dpu_kms->hw_intr = NULL;
+		goto err_pm_put;
+	}
+
+	dev->mode_config.min_width = 0;
+	dev->mode_config.min_height = 0;
+
+	/*
+	 * max crtc width is equal to the max mixer width * 2 and max height is
+	 * is 4K
+	 */
+	dev->mode_config.max_width =
+			dpu_kms->catalog->caps->max_mixer_width * 2;
+	dev->mode_config.max_height = 4096;
+
+	dev->max_vblank_count = 0xffffffff;
+	/* Disable vblank irqs aggressively for power-saving */
+	dev->vblank_disable_immediate = true;
+
+	/*
+	 * _dpu_kms_drm_obj_init should create the DRM related objects
+	 * i.e. CRTCs, planes, encoders, connectors and so forth
+	 */
+	rc = _dpu_kms_drm_obj_init(dpu_kms);
+	if (rc) {
+		DPU_ERROR("modeset init failed: %d\n", rc);
+		goto err_pm_put;
+	}
+
+	dpu_vbif_init_memtypes(dpu_kms);
+
+	pm_runtime_put_sync(&dpu_kms->pdev->dev);
+
+	return 0;
+
+err_pm_put:
+	pm_runtime_put_sync(&dpu_kms->pdev->dev);
+error:
+	_dpu_kms_hw_destroy(dpu_kms);
+
+	return rc;
+}
+
+static int dpu_kms_init(struct drm_device *ddev)
+{
+	struct msm_drm_private *priv = ddev->dev_private;
+	struct device *dev = ddev->dev;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms);
+	struct dev_pm_opp *opp;
+	int ret = 0;
+	unsigned long max_freq = ULONG_MAX;
+
+	opp = dev_pm_opp_find_freq_floor(dev, &max_freq);
+	if (!IS_ERR(opp))
+		dev_pm_opp_put(opp);
+
+	dev_pm_opp_set_rate(dev, max_freq);
+
+	ret = msm_kms_init(&dpu_kms->base, &kms_funcs);
+	if (ret) {
+		DPU_ERROR("failed to init kms, ret=%d\n", ret);
+		return ret;
+	}
+	dpu_kms->dev = ddev;
+
+	pm_runtime_enable(&pdev->dev);
+	dpu_kms->rpm_enabled = true;
+
+	return 0;
+}
+
+static int dpu_dev_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct dpu_kms *dpu_kms;
+	int irq;
+	int ret = 0;
+
+	dpu_kms = devm_kzalloc(dev, sizeof(*dpu_kms), GFP_KERNEL);
+	if (!dpu_kms)
+		return -ENOMEM;
+
+	dpu_kms->pdev = pdev;
+
+	ret = devm_pm_opp_set_clkname(dev, "core");
+	if (ret)
+		return ret;
+	/* OPP table is optional */
+	ret = devm_pm_opp_of_add_table(dev);
+	if (ret && ret != -ENODEV)
+		return dev_err_probe(dev, ret, "invalid OPP table in device tree\n");
+
+	ret = devm_clk_bulk_get_all(&pdev->dev, &dpu_kms->clocks);
+	if (ret < 0)
+		return dev_err_probe(dev, ret, "failed to parse clocks\n");
+
+	dpu_kms->num_clocks = ret;
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return dev_err_probe(dev, irq, "failed to get irq\n");
+
+	dpu_kms->base.irq = irq;
+
+	dpu_kms->mmio = msm_ioremap(pdev, "mdp");
+	if (IS_ERR(dpu_kms->mmio)) {
+		ret = PTR_ERR(dpu_kms->mmio);
+		DPU_ERROR("mdp register memory map failed: %d\n", ret);
+		dpu_kms->mmio = NULL;
+		return ret;
+	}
+	DRM_DEBUG("mapped dpu address space @%pK\n", dpu_kms->mmio);
+
+	dpu_kms->vbif[VBIF_RT] = msm_ioremap(pdev, "vbif");
+	if (IS_ERR(dpu_kms->vbif[VBIF_RT])) {
+		ret = PTR_ERR(dpu_kms->vbif[VBIF_RT]);
+		DPU_ERROR("vbif register memory map failed: %d\n", ret);
+		dpu_kms->vbif[VBIF_RT] = NULL;
+		return ret;
+	}
+
+	dpu_kms->vbif[VBIF_NRT] = msm_ioremap_quiet(pdev, "vbif_nrt");
+	if (IS_ERR(dpu_kms->vbif[VBIF_NRT])) {
+		dpu_kms->vbif[VBIF_NRT] = NULL;
+		DPU_DEBUG("VBIF NRT is not defined");
+	}
+
+	ret = dpu_kms_parse_data_bus_icc_path(dpu_kms);
+	if (ret)
+		return ret;
+
+	return msm_drv_probe(&pdev->dev, dpu_kms_init, &dpu_kms->base);
+}
+
+static void dpu_dev_remove(struct platform_device *pdev)
+{
+	component_master_del(&pdev->dev, &msm_drm_ops);
+}
+
+static int __maybe_unused dpu_runtime_suspend(struct device *dev)
+{
+	int i;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct msm_drm_private *priv = platform_get_drvdata(pdev);
+	struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms);
+
+	/* Drop the performance state vote */
+	dev_pm_opp_set_rate(dev, 0);
+	clk_bulk_disable_unprepare(dpu_kms->num_clocks, dpu_kms->clocks);
+
+	for (i = 0; i < dpu_kms->num_paths; i++)
+		icc_set_bw(dpu_kms->path[i], 0, 0);
+
+	return 0;
+}
+
+static int __maybe_unused dpu_runtime_resume(struct device *dev)
+{
+	int rc = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct msm_drm_private *priv = platform_get_drvdata(pdev);
+	struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms);
+	struct drm_encoder *encoder;
+	struct drm_device *ddev;
+
+	ddev = dpu_kms->dev;
+
+	rc = clk_bulk_prepare_enable(dpu_kms->num_clocks, dpu_kms->clocks);
+	if (rc) {
+		DPU_ERROR("clock enable failed rc:%d\n", rc);
+		return rc;
+	}
+
+	dpu_vbif_init_memtypes(dpu_kms);
+
+	drm_for_each_encoder(encoder, ddev)
+		dpu_encoder_virt_runtime_resume(encoder);
+
+	return rc;
+}
+
+static const struct dev_pm_ops dpu_pm_ops = {
+	SET_RUNTIME_PM_OPS(dpu_runtime_suspend, dpu_runtime_resume, NULL)
+	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+				pm_runtime_force_resume)
+	.prepare = msm_kms_pm_prepare,
+	.complete = msm_kms_pm_complete,
+};
+
+static const struct of_device_id dpu_dt_match[] = {
+	{ .compatible = "qcom,msm8998-dpu", .data = &dpu_msm8998_cfg, },
+	{ .compatible = "qcom,qcm2290-dpu", .data = &dpu_qcm2290_cfg, },
+	{ .compatible = "qcom,sdm670-dpu", .data = &dpu_sdm670_cfg, },
+	{ .compatible = "qcom,sdm845-dpu", .data = &dpu_sdm845_cfg, },
+	{ .compatible = "qcom,sc7180-dpu", .data = &dpu_sc7180_cfg, },
+	{ .compatible = "qcom,sc7280-dpu", .data = &dpu_sc7280_cfg, },
+	{ .compatible = "qcom,sc8180x-dpu", .data = &dpu_sc8180x_cfg, },
+	{ .compatible = "qcom,sc8280xp-dpu", .data = &dpu_sc8280xp_cfg, },
+	{ .compatible = "qcom,sm6115-dpu", .data = &dpu_sm6115_cfg, },
+	{ .compatible = "qcom,sm6125-dpu", .data = &dpu_sm6125_cfg, },
+	{ .compatible = "qcom,sm6350-dpu", .data = &dpu_sm6350_cfg, },
+	{ .compatible = "qcom,sm6375-dpu", .data = &dpu_sm6375_cfg, },
+	{ .compatible = "qcom,sm8150-dpu", .data = &dpu_sm8150_cfg, },
+	{ .compatible = "qcom,sm8250-dpu", .data = &dpu_sm8250_cfg, },
+	{ .compatible = "qcom,sm8350-dpu", .data = &dpu_sm8350_cfg, },
+	{ .compatible = "qcom,sm8450-dpu", .data = &dpu_sm8450_cfg, },
+	{ .compatible = "qcom,qcs8300-dpu", .data = &dpu_qcs8300_cfg, },
+	{ .compatible = "qcom,sa8775p-dpu", .data = &dpu_sa8775p_cfg, },
+	{ .compatible = "qcom,sm8550-dpu", .data = &dpu_sm8550_cfg, },
+	{ .compatible = "qcom,sm8650-dpu", .data = &dpu_sm8650_cfg, },
+	{}
+};
+MODULE_DEVICE_TABLE(of, dpu_dt_match);
+
+static struct platform_driver dpu_driver = {
+	.probe = dpu_dev_probe,
+	.remove_new = dpu_dev_remove,
+	.shutdown = msm_kms_shutdown,
+	.driver = {
+		.name = "msm_dpu",
+		.of_match_table = dpu_dt_match,
+		.pm = &dpu_pm_ops,
+	},
+};
+
+void __init msm_dpu_register(void)
+{
+	platform_driver_register(&dpu_driver);
+}
+
+void __exit msm_dpu_unregister(void)
+{
+	platform_driver_unregister(&dpu_driver);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_kms.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_kms.h
@@ -0,0 +1,200 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __DPU_KMS_H__
+#define __DPU_KMS_H__
+
+#include <linux/interconnect.h>
+
+#include <drm/drm_drv.h>
+
+#include "msm_drv.h"
+#include "msm_kms.h"
+#include "msm_mmu.h"
+#include "msm_gem.h"
+#include "dpu_hw_catalog.h"
+#include "dpu_hw_ctl.h"
+#include "dpu_hw_lm.h"
+#include "dpu_hw_interrupts.h"
+#include "dpu_hw_top.h"
+#include "dpu_rm.h"
+#include "dpu_core_perf.h"
+
+#define DRMID(x) ((x) ? (x)->base.id : -1)
+
+/**
+ * DPU_DEBUG - macro for kms/plane/crtc/encoder/connector logs
+ * @fmt: Pointer to format string
+ */
+#define DPU_DEBUG(fmt, ...)                                                \
+	DRM_DEBUG_DRIVER(fmt, ##__VA_ARGS__)
+
+/**
+ * DPU_DEBUG_DRIVER - macro for hardware driver logging
+ * @fmt: Pointer to format string
+ */
+#define DPU_DEBUG_DRIVER(fmt, ...)                                         \
+	DRM_DEBUG_DRIVER(fmt, ##__VA_ARGS__)
+
+#define DPU_ERROR(fmt, ...) pr_err("[dpu error]" fmt, ##__VA_ARGS__)
+#define DPU_ERROR_RATELIMITED(fmt, ...) pr_err_ratelimited("[dpu error]" fmt, ##__VA_ARGS__)
+
+/**
+ * ktime_compare_safe - compare two ktime structures
+ *	This macro is similar to the standard ktime_compare() function, but
+ *	attempts to also handle ktime overflows.
+ * @A: First ktime value
+ * @B: Second ktime value
+ * Returns: -1 if A < B, 0 if A == B, 1 if A > B
+ */
+#define ktime_compare_safe(A, B) \
+	ktime_compare(ktime_sub((A), (B)), ktime_set(0, 0))
+
+struct dpu_kms {
+	struct msm_kms base;
+	struct drm_device *dev;
+	const struct dpu_mdss_cfg *catalog;
+	const struct msm_mdss_data *mdss;
+
+	/* io/register spaces: */
+	void __iomem *mmio, *vbif[VBIF_MAX];
+
+	struct regulator *vdd;
+	struct regulator *mmagic;
+	struct regulator *venus;
+
+	struct dpu_hw_intr *hw_intr;
+
+	struct dpu_core_perf perf;
+
+	/*
+	 * Global private object state, Do not access directly, use
+	 * dpu_kms_global_get_state()
+	 */
+	struct drm_modeset_lock global_state_lock;
+	struct drm_private_obj global_state;
+
+	struct dpu_rm rm;
+
+	struct dpu_hw_vbif *hw_vbif[VBIF_MAX];
+	struct dpu_hw_mdp *hw_mdp;
+
+	bool has_danger_ctrl;
+
+	struct platform_device *pdev;
+	bool rpm_enabled;
+
+	struct clk_bulk_data *clocks;
+	size_t num_clocks;
+
+	/* reference count bandwidth requests, so we know when we can
+	 * release bandwidth.  Each atomic update increments, and frame-
+	 * done event decrements.  Additionally, for video mode, the
+	 * reference is incremented when crtc is enabled, and decremented
+	 * when disabled.
+	 */
+	atomic_t bandwidth_ref;
+	struct icc_path *path[2];
+	u32 num_paths;
+};
+
+struct vsync_info {
+	u32 frame_count;
+	u32 line_count;
+};
+
+#define DPU_ENC_WR_PTR_START_TIMEOUT_US 20000
+
+#define DPU_ENC_MAX_POLL_TIMEOUT_US	2000
+
+#define to_dpu_kms(x) container_of(x, struct dpu_kms, base)
+
+#define to_dpu_global_state(x) container_of(x, struct dpu_global_state, base)
+
+/* Global private object state for tracking resources that are shared across
+ * multiple kms objects (planes/crtcs/etc).
+ */
+struct dpu_global_state {
+	struct drm_private_state base;
+
+	uint32_t pingpong_to_enc_id[PINGPONG_MAX - PINGPONG_0];
+	uint32_t mixer_to_enc_id[LM_MAX - LM_0];
+	uint32_t ctl_to_enc_id[CTL_MAX - CTL_0];
+	uint32_t dspp_to_enc_id[DSPP_MAX - DSPP_0];
+	uint32_t dsc_to_enc_id[DSC_MAX - DSC_0];
+	uint32_t cdm_to_enc_id;
+};
+
+struct dpu_global_state
+	*dpu_kms_get_existing_global_state(struct dpu_kms *dpu_kms);
+struct dpu_global_state
+	*__must_check dpu_kms_get_global_state(struct drm_atomic_state *s);
+
+/**
+ * Debugfs functions - extra helper functions for debugfs support
+ *
+ * Main debugfs documentation is located at,
+ *
+ * Documentation/filesystems/debugfs.rst
+ *
+ * @dpu_debugfs_create_regset32: Create 32-bit register dump file
+ */
+
+/**
+ * dpu_debugfs_create_regset32 - Create register read back file for debugfs
+ *
+ * This function is almost identical to the standard debugfs_create_regset32()
+ * function, with the main difference being that a list of register
+ * names/offsets do not need to be provided. The 'read' function simply outputs
+ * sequential register values over a specified range.
+ *
+ * @name:   File name within debugfs
+ * @mode:   File mode within debugfs
+ * @parent: Parent directory entry within debugfs, can be NULL
+ * @offset: sub-block offset
+ * @length: sub-block length, in bytes
+ * @dpu_kms: pointer to dpu kms structure
+ */
+void dpu_debugfs_create_regset32(const char *name, umode_t mode,
+		void *parent,
+		uint32_t offset, uint32_t length, struct dpu_kms *dpu_kms);
+
+/**
+ * dpu_debugfs_get_root - Return root directory entry for KMS's debugfs
+ *
+ * The return value should be passed as the 'parent' argument to subsequent
+ * debugfs create calls.
+ *
+ * @dpu_kms: Pointer to DPU's KMS structure
+ *
+ * Return: dentry pointer for DPU's debugfs location
+ */
+void *dpu_debugfs_get_root(struct dpu_kms *dpu_kms);
+
+/**
+ * DPU info management functions
+ * These functions/definitions allow for building up a 'dpu_info' structure
+ * containing one or more "key=value\n" entries.
+ */
+#define DPU_KMS_INFO_MAX_SIZE	4096
+
+/**
+ * Vblank enable/disable functions
+ */
+int dpu_enable_vblank(struct msm_kms *kms, struct drm_crtc *crtc);
+void dpu_disable_vblank(struct msm_kms *kms, struct drm_crtc *crtc);
+
+/**
+ * dpu_kms_get_clk_rate() - get the clock rate
+ * @dpu_kms:  pointer to dpu_kms structure
+ * @clock_name: clock name to get the rate
+ *
+ * Return: current clock rate
+ */
+unsigned long dpu_kms_get_clk_rate(struct dpu_kms *dpu_kms, char *clock_name);
+
+#endif /* __dpu_kms_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_plane.c
@@ -0,0 +1,1449 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2014-2018 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+
+#include <linux/debugfs.h>
+#include <linux/dma-buf.h>
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_atomic_uapi.h>
+#include <drm/drm_blend.h>
+#include <drm/drm_damage_helper.h>
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_gem_atomic_helper.h>
+
+#include "msm_drv.h"
+#include "dpu_kms.h"
+#include "dpu_formats.h"
+#include "dpu_hw_sspp.h"
+#include "dpu_hw_util.h"
+#include "dpu_trace.h"
+#include "dpu_crtc.h"
+#include "dpu_vbif.h"
+#include "dpu_plane.h"
+
+#define DPU_DEBUG_PLANE(pl, fmt, ...) DRM_DEBUG_ATOMIC("plane%d " fmt,\
+		(pl) ? (pl)->base.base.id : -1, ##__VA_ARGS__)
+
+#define DPU_ERROR_PLANE(pl, fmt, ...) DPU_ERROR("plane%d " fmt,\
+		(pl) ? (pl)->base.base.id : -1, ##__VA_ARGS__)
+
+#define DECIMATED_DIMENSION(dim, deci) (((dim) + ((1 << (deci)) - 1)) >> (deci))
+#define PHASE_STEP_SHIFT	21
+#define PHASE_STEP_UNIT_SCALE   ((int) (1 << PHASE_STEP_SHIFT))
+#define PHASE_RESIDUAL		15
+
+#define SHARP_STRENGTH_DEFAULT	32
+#define SHARP_EDGE_THR_DEFAULT	112
+#define SHARP_SMOOTH_THR_DEFAULT	8
+#define SHARP_NOISE_THR_DEFAULT	2
+
+#define DPU_PLANE_COLOR_FILL_FLAG	BIT(31)
+#define DPU_ZPOS_MAX 255
+
+/*
+ * Default Preload Values
+ */
+#define DPU_QSEED3_DEFAULT_PRELOAD_H 0x4
+#define DPU_QSEED3_DEFAULT_PRELOAD_V 0x3
+#define DPU_QSEED4_DEFAULT_PRELOAD_V 0x2
+#define DPU_QSEED4_DEFAULT_PRELOAD_H 0x4
+
+#define DEFAULT_REFRESH_RATE	60
+
+static const uint32_t qcom_compressed_supported_formats[] = {
+	DRM_FORMAT_ABGR8888,
+	DRM_FORMAT_ARGB8888,
+	DRM_FORMAT_XBGR8888,
+	DRM_FORMAT_XRGB8888,
+	DRM_FORMAT_ARGB2101010,
+	DRM_FORMAT_XRGB2101010,
+	DRM_FORMAT_BGR565,
+
+	DRM_FORMAT_NV12,
+	DRM_FORMAT_P010,
+};
+
+/*
+ * struct dpu_plane - local dpu plane structure
+ * @aspace: address space pointer
+ * @csc_ptr: Points to dpu_csc_cfg structure to use for current
+ * @catalog: Points to dpu catalog structure
+ * @revalidate: force revalidation of all the plane properties
+ */
+struct dpu_plane {
+	struct drm_plane base;
+
+	enum dpu_sspp pipe;
+
+	uint32_t color_fill;
+	bool is_error;
+	bool is_rt_pipe;
+	const struct dpu_mdss_cfg *catalog;
+};
+
+static const uint64_t supported_format_modifiers[] = {
+	DRM_FORMAT_MOD_QCOM_COMPRESSED,
+	DRM_FORMAT_MOD_LINEAR,
+	DRM_FORMAT_MOD_INVALID
+};
+
+#define to_dpu_plane(x) container_of(x, struct dpu_plane, base)
+
+static struct dpu_kms *_dpu_plane_get_kms(struct drm_plane *plane)
+{
+	struct msm_drm_private *priv = plane->dev->dev_private;
+
+	return to_dpu_kms(priv->kms);
+}
+
+/**
+ * _dpu_plane_calc_bw - calculate bandwidth required for a plane
+ * @catalog: Points to dpu catalog structure
+ * @fmt: Pointer to source buffer format
+ * @mode: Pointer to drm display mode
+ * @pipe_cfg: Pointer to pipe configuration
+ * Result: Updates calculated bandwidth in the plane state.
+ * BW Equation: src_w * src_h * bpp * fps * (v_total / v_dest)
+ * Prefill BW Equation: line src bytes * line_time
+ */
+static u64 _dpu_plane_calc_bw(const struct dpu_mdss_cfg *catalog,
+	const struct dpu_format *fmt,
+	const struct drm_display_mode *mode,
+	struct dpu_sw_pipe_cfg *pipe_cfg)
+{
+	int src_width, src_height, dst_height, fps;
+	u64 plane_pixel_rate, plane_bit_rate;
+	u64 plane_prefill_bw;
+	u64 plane_bw;
+	u32 hw_latency_lines;
+	u64 scale_factor;
+	int vbp, vpw, vfp;
+
+	src_width = drm_rect_width(&pipe_cfg->src_rect);
+	src_height = drm_rect_height(&pipe_cfg->src_rect);
+	dst_height = drm_rect_height(&pipe_cfg->dst_rect);
+	fps = drm_mode_vrefresh(mode);
+	vbp = mode->vtotal - mode->vsync_end;
+	vpw = mode->vsync_end - mode->vsync_start;
+	vfp = mode->vsync_start - mode->vdisplay;
+	hw_latency_lines =  catalog->perf->min_prefill_lines;
+	scale_factor = src_height > dst_height ?
+		mult_frac(src_height, 1, dst_height) : 1;
+
+	plane_pixel_rate = src_width * mode->vtotal * fps;
+	plane_bit_rate = plane_pixel_rate * fmt->bpp;
+
+	plane_bw = plane_bit_rate * scale_factor;
+
+	plane_prefill_bw = plane_bw * hw_latency_lines;
+
+	if ((vbp+vpw) > hw_latency_lines)
+		do_div(plane_prefill_bw, (vbp+vpw));
+	else if ((vbp+vpw+vfp) < hw_latency_lines)
+		do_div(plane_prefill_bw, (vbp+vpw+vfp));
+	else
+		do_div(plane_prefill_bw, hw_latency_lines);
+
+
+	return max(plane_bw, plane_prefill_bw);
+}
+
+/**
+ * _dpu_plane_calc_clk - calculate clock required for a plane
+ * @mode: Pointer to drm display mode
+ * @pipe_cfg: Pointer to pipe configuration
+ * Result: Updates calculated clock in the plane state.
+ * Clock equation: dst_w * v_total * fps * (src_h / dst_h)
+ */
+static u64 _dpu_plane_calc_clk(const struct drm_display_mode *mode,
+		struct dpu_sw_pipe_cfg *pipe_cfg)
+{
+	int dst_width, src_height, dst_height, fps;
+	u64 plane_clk;
+
+	src_height = drm_rect_height(&pipe_cfg->src_rect);
+	dst_width = drm_rect_width(&pipe_cfg->dst_rect);
+	dst_height = drm_rect_height(&pipe_cfg->dst_rect);
+	fps = drm_mode_vrefresh(mode);
+
+	plane_clk =
+		dst_width * mode->vtotal * fps;
+
+	if (src_height > dst_height) {
+		plane_clk *= src_height;
+		do_div(plane_clk, dst_height);
+	}
+
+	return plane_clk;
+}
+
+/**
+ * _dpu_plane_calc_fill_level - calculate fill level of the given source format
+ * @plane:		Pointer to drm plane
+ * @pipe:		Pointer to software pipe
+ * @lut_usage:		LUT usecase
+ * @fmt:		Pointer to source buffer format
+ * @src_width:		width of source buffer
+ * Return: fill level corresponding to the source buffer/format or 0 if error
+ */
+static int _dpu_plane_calc_fill_level(struct drm_plane *plane,
+		struct dpu_sw_pipe *pipe,
+		enum dpu_qos_lut_usage lut_usage,
+		const struct dpu_format *fmt, u32 src_width)
+{
+	struct dpu_plane *pdpu;
+	u32 fixed_buff_size;
+	u32 total_fl;
+
+	if (!fmt || !pipe || !src_width || !fmt->bpp) {
+		DPU_ERROR("invalid arguments\n");
+		return 0;
+	}
+
+	if (lut_usage == DPU_QOS_LUT_USAGE_NRT)
+		return 0;
+
+	pdpu = to_dpu_plane(plane);
+	fixed_buff_size = pdpu->catalog->caps->pixel_ram_size;
+
+	/* FIXME: in multirect case account for the src_width of all the planes */
+
+	if (fmt->fetch_planes == DPU_PLANE_PSEUDO_PLANAR) {
+		if (fmt->chroma_sample == DPU_CHROMA_420) {
+			/* NV12 */
+			total_fl = (fixed_buff_size / 2) /
+				((src_width + 32) * fmt->bpp);
+		} else {
+			/* non NV12 */
+			total_fl = (fixed_buff_size / 2) * 2 /
+				((src_width + 32) * fmt->bpp);
+		}
+	} else {
+		if (pipe->multirect_mode == DPU_SSPP_MULTIRECT_PARALLEL) {
+			total_fl = (fixed_buff_size / 2) * 2 /
+				((src_width + 32) * fmt->bpp);
+		} else {
+			total_fl = (fixed_buff_size) * 2 /
+				((src_width + 32) * fmt->bpp);
+		}
+	}
+
+	DPU_DEBUG_PLANE(pdpu, "pnum:%d fmt: %4.4s w:%u fl:%u\n",
+			pipe->sspp->idx - SSPP_VIG0,
+			(char *)&fmt->base.pixel_format,
+			src_width, total_fl);
+
+	return total_fl;
+}
+
+/**
+ * _dpu_plane_set_qos_lut - set QoS LUT of the given plane
+ * @plane:		Pointer to drm plane
+ * @pipe:		Pointer to software pipe
+ * @fmt:		Pointer to source buffer format
+ * @pipe_cfg:		Pointer to pipe configuration
+ */
+static void _dpu_plane_set_qos_lut(struct drm_plane *plane,
+		struct dpu_sw_pipe *pipe,
+		const struct dpu_format *fmt, struct dpu_sw_pipe_cfg *pipe_cfg)
+{
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct dpu_hw_qos_cfg cfg;
+	u32 total_fl, lut_usage;
+
+	if (!pdpu->is_rt_pipe) {
+		lut_usage = DPU_QOS_LUT_USAGE_NRT;
+	} else {
+		if (fmt && DPU_FORMAT_IS_LINEAR(fmt))
+			lut_usage = DPU_QOS_LUT_USAGE_LINEAR;
+		else
+			lut_usage = DPU_QOS_LUT_USAGE_MACROTILE;
+	}
+
+	total_fl = _dpu_plane_calc_fill_level(plane, pipe, lut_usage, fmt,
+				drm_rect_width(&pipe_cfg->src_rect));
+
+	cfg.creq_lut = _dpu_hw_get_qos_lut(&pdpu->catalog->perf->qos_lut_tbl[lut_usage], total_fl);
+	cfg.danger_lut = pdpu->catalog->perf->danger_lut_tbl[lut_usage];
+	cfg.safe_lut = pdpu->catalog->perf->safe_lut_tbl[lut_usage];
+
+	if (pipe->sspp->idx != SSPP_CURSOR0 &&
+	    pipe->sspp->idx != SSPP_CURSOR1 &&
+	    pdpu->is_rt_pipe)
+		cfg.danger_safe_en = true;
+
+	DPU_DEBUG_PLANE(pdpu, "pnum:%d ds:%d is_rt:%d\n",
+		pdpu->pipe - SSPP_VIG0,
+		cfg.danger_safe_en,
+		pdpu->is_rt_pipe);
+
+	trace_dpu_perf_set_qos_luts(pipe->sspp->idx - SSPP_VIG0,
+			(fmt) ? fmt->base.pixel_format : 0,
+			pdpu->is_rt_pipe, total_fl, cfg.creq_lut, lut_usage);
+
+	DPU_DEBUG_PLANE(pdpu, "pnum:%d fmt: %4.4s rt:%d fl:%u lut:0x%llx\n",
+			pdpu->pipe - SSPP_VIG0,
+			fmt ? (char *)&fmt->base.pixel_format : NULL,
+			pdpu->is_rt_pipe, total_fl, cfg.creq_lut);
+
+	trace_dpu_perf_set_danger_luts(pdpu->pipe - SSPP_VIG0,
+			(fmt) ? fmt->base.pixel_format : 0,
+			(fmt) ? fmt->fetch_mode : 0,
+			cfg.danger_lut,
+			cfg.safe_lut);
+
+	DPU_DEBUG_PLANE(pdpu, "pnum:%d fmt: %4.4s mode:%d luts[0x%x, 0x%x]\n",
+		pdpu->pipe - SSPP_VIG0,
+		fmt ? (char *)&fmt->base.pixel_format : NULL,
+		fmt ? fmt->fetch_mode : -1,
+		cfg.danger_lut,
+		cfg.safe_lut);
+
+	pipe->sspp->ops.setup_qos_lut(pipe->sspp, &cfg);
+}
+
+/**
+ * _dpu_plane_set_qos_ctrl - set QoS control of the given plane
+ * @plane:		Pointer to drm plane
+ * @pipe:		Pointer to software pipe
+ * @enable:		true to enable QoS control
+ */
+static void _dpu_plane_set_qos_ctrl(struct drm_plane *plane,
+	struct dpu_sw_pipe *pipe,
+	bool enable)
+{
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+
+	if (!pdpu->is_rt_pipe)
+		enable = false;
+
+	DPU_DEBUG_PLANE(pdpu, "pnum:%d ds:%d is_rt:%d\n",
+		pdpu->pipe - SSPP_VIG0,
+		enable,
+		pdpu->is_rt_pipe);
+
+	pipe->sspp->ops.setup_qos_ctrl(pipe->sspp,
+				       enable);
+}
+
+static bool _dpu_plane_sspp_clk_force_ctrl(struct dpu_hw_sspp *sspp,
+					   struct dpu_hw_mdp *mdp,
+					   bool enable, bool *forced_on)
+{
+	if (sspp->ops.setup_clk_force_ctrl) {
+		*forced_on = sspp->ops.setup_clk_force_ctrl(sspp, enable);
+		return true;
+	}
+
+	if (mdp->ops.setup_clk_force_ctrl) {
+		*forced_on = mdp->ops.setup_clk_force_ctrl(mdp, sspp->cap->clk_ctrl, enable);
+		return true;
+	}
+
+	return false;
+}
+
+/**
+ * _dpu_plane_set_ot_limit - set OT limit for the given plane
+ * @plane:		Pointer to drm plane
+ * @pipe:		Pointer to software pipe
+ * @pipe_cfg:		Pointer to pipe configuration
+ * @frame_rate:		CRTC's frame rate
+ */
+static void _dpu_plane_set_ot_limit(struct drm_plane *plane,
+		struct dpu_sw_pipe *pipe,
+		struct dpu_sw_pipe_cfg *pipe_cfg,
+		int frame_rate)
+{
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct dpu_vbif_set_ot_params ot_params;
+	struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
+	bool forced_on = false;
+
+	memset(&ot_params, 0, sizeof(ot_params));
+	ot_params.xin_id = pipe->sspp->cap->xin_id;
+	ot_params.num = pipe->sspp->idx - SSPP_NONE;
+	ot_params.width = drm_rect_width(&pipe_cfg->src_rect);
+	ot_params.height = drm_rect_height(&pipe_cfg->src_rect);
+	ot_params.is_wfd = !pdpu->is_rt_pipe;
+	ot_params.frame_rate = frame_rate;
+	ot_params.vbif_idx = VBIF_RT;
+	ot_params.rd = true;
+
+	if (!_dpu_plane_sspp_clk_force_ctrl(pipe->sspp, dpu_kms->hw_mdp,
+					    true, &forced_on))
+		return;
+
+	dpu_vbif_set_ot_limit(dpu_kms, &ot_params);
+
+	if (forced_on)
+		_dpu_plane_sspp_clk_force_ctrl(pipe->sspp, dpu_kms->hw_mdp,
+					       false, &forced_on);
+}
+
+/**
+ * _dpu_plane_set_qos_remap - set vbif QoS for the given plane
+ * @plane:		Pointer to drm plane
+ * @pipe:		Pointer to software pipe
+ */
+static void _dpu_plane_set_qos_remap(struct drm_plane *plane,
+		struct dpu_sw_pipe *pipe)
+{
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct dpu_vbif_set_qos_params qos_params;
+	struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
+	bool forced_on = false;
+
+	memset(&qos_params, 0, sizeof(qos_params));
+	qos_params.vbif_idx = VBIF_RT;
+	qos_params.xin_id = pipe->sspp->cap->xin_id;
+	qos_params.num = pipe->sspp->idx - SSPP_VIG0;
+	qos_params.is_rt = pdpu->is_rt_pipe;
+
+	DPU_DEBUG_PLANE(pdpu, "pipe:%d vbif:%d xin:%d rt:%d\n",
+			qos_params.num,
+			qos_params.vbif_idx,
+			qos_params.xin_id, qos_params.is_rt);
+
+	if (!_dpu_plane_sspp_clk_force_ctrl(pipe->sspp, dpu_kms->hw_mdp,
+					    true, &forced_on))
+		return;
+
+	dpu_vbif_set_qos_remap(dpu_kms, &qos_params);
+
+	if (forced_on)
+		_dpu_plane_sspp_clk_force_ctrl(pipe->sspp, dpu_kms->hw_mdp,
+					       false, &forced_on);
+}
+
+static void _dpu_plane_setup_scaler3(struct dpu_hw_sspp *pipe_hw,
+		uint32_t src_w, uint32_t src_h, uint32_t dst_w, uint32_t dst_h,
+		struct dpu_hw_scaler3_cfg *scale_cfg,
+		const struct dpu_format *fmt,
+		uint32_t chroma_subsmpl_h, uint32_t chroma_subsmpl_v,
+		unsigned int rotation)
+{
+	uint32_t i;
+	bool inline_rotation = rotation & DRM_MODE_ROTATE_90;
+
+	/*
+	 * For inline rotation cases, scaler config is post-rotation,
+	 * so swap the dimensions here. However, pixel extension will
+	 * need pre-rotation settings.
+	 */
+	if (inline_rotation)
+		swap(src_w, src_h);
+
+	scale_cfg->phase_step_x[DPU_SSPP_COMP_0] =
+		mult_frac((1 << PHASE_STEP_SHIFT), src_w, dst_w);
+	scale_cfg->phase_step_y[DPU_SSPP_COMP_0] =
+		mult_frac((1 << PHASE_STEP_SHIFT), src_h, dst_h);
+
+
+	scale_cfg->phase_step_y[DPU_SSPP_COMP_1_2] =
+		scale_cfg->phase_step_y[DPU_SSPP_COMP_0] / chroma_subsmpl_v;
+	scale_cfg->phase_step_x[DPU_SSPP_COMP_1_2] =
+		scale_cfg->phase_step_x[DPU_SSPP_COMP_0] / chroma_subsmpl_h;
+
+	scale_cfg->phase_step_x[DPU_SSPP_COMP_2] =
+		scale_cfg->phase_step_x[DPU_SSPP_COMP_1_2];
+	scale_cfg->phase_step_y[DPU_SSPP_COMP_2] =
+		scale_cfg->phase_step_y[DPU_SSPP_COMP_1_2];
+
+	scale_cfg->phase_step_x[DPU_SSPP_COMP_3] =
+		scale_cfg->phase_step_x[DPU_SSPP_COMP_0];
+	scale_cfg->phase_step_y[DPU_SSPP_COMP_3] =
+		scale_cfg->phase_step_y[DPU_SSPP_COMP_0];
+
+	for (i = 0; i < DPU_MAX_PLANES; i++) {
+		scale_cfg->src_width[i] = src_w;
+		scale_cfg->src_height[i] = src_h;
+		if (i == DPU_SSPP_COMP_1_2 || i == DPU_SSPP_COMP_2) {
+			scale_cfg->src_width[i] /= chroma_subsmpl_h;
+			scale_cfg->src_height[i] /= chroma_subsmpl_v;
+		}
+
+		if (pipe_hw->cap->sblk->scaler_blk.version >= 0x3000) {
+			scale_cfg->preload_x[i] = DPU_QSEED4_DEFAULT_PRELOAD_H;
+			scale_cfg->preload_y[i] = DPU_QSEED4_DEFAULT_PRELOAD_V;
+		} else {
+			scale_cfg->preload_x[i] = DPU_QSEED3_DEFAULT_PRELOAD_H;
+			scale_cfg->preload_y[i] = DPU_QSEED3_DEFAULT_PRELOAD_V;
+		}
+	}
+	if (!(DPU_FORMAT_IS_YUV(fmt)) && (src_h == dst_h)
+		&& (src_w == dst_w))
+		return;
+
+	scale_cfg->dst_width = dst_w;
+	scale_cfg->dst_height = dst_h;
+	scale_cfg->y_rgb_filter_cfg = DPU_SCALE_BIL;
+	scale_cfg->uv_filter_cfg = DPU_SCALE_BIL;
+	scale_cfg->alpha_filter_cfg = DPU_SCALE_ALPHA_BIL;
+	scale_cfg->lut_flag = 0;
+	scale_cfg->blend_cfg = 1;
+	scale_cfg->enable = 1;
+}
+
+static void _dpu_plane_setup_pixel_ext(struct dpu_hw_scaler3_cfg *scale_cfg,
+				struct dpu_hw_pixel_ext *pixel_ext,
+				uint32_t src_w, uint32_t src_h,
+				uint32_t chroma_subsmpl_h, uint32_t chroma_subsmpl_v)
+{
+	int i;
+
+	for (i = 0; i < DPU_MAX_PLANES; i++) {
+		if (i == DPU_SSPP_COMP_1_2 || i == DPU_SSPP_COMP_2) {
+			src_w /= chroma_subsmpl_h;
+			src_h /= chroma_subsmpl_v;
+		}
+
+		pixel_ext->num_ext_pxls_top[i] = src_h;
+		pixel_ext->num_ext_pxls_left[i] = src_w;
+	}
+}
+
+static const struct dpu_csc_cfg *_dpu_plane_get_csc(struct dpu_sw_pipe *pipe,
+						    const struct dpu_format *fmt)
+{
+	const struct dpu_csc_cfg *csc_ptr;
+
+	if (!DPU_FORMAT_IS_YUV(fmt))
+		return NULL;
+
+	if (BIT(DPU_SSPP_CSC_10BIT) & pipe->sspp->cap->features)
+		csc_ptr = &dpu_csc10_YUV2RGB_601L;
+	else
+		csc_ptr = &dpu_csc_YUV2RGB_601L;
+
+	return csc_ptr;
+}
+
+static void _dpu_plane_setup_scaler(struct dpu_sw_pipe *pipe,
+		const struct dpu_format *fmt, bool color_fill,
+		struct dpu_sw_pipe_cfg *pipe_cfg,
+		unsigned int rotation)
+{
+	struct dpu_hw_sspp *pipe_hw = pipe->sspp;
+	const struct drm_format_info *info = drm_format_info(fmt->base.pixel_format);
+	struct dpu_hw_scaler3_cfg scaler3_cfg;
+	struct dpu_hw_pixel_ext pixel_ext;
+	u32 src_width = drm_rect_width(&pipe_cfg->src_rect);
+	u32 src_height = drm_rect_height(&pipe_cfg->src_rect);
+	u32 dst_width = drm_rect_width(&pipe_cfg->dst_rect);
+	u32 dst_height = drm_rect_height(&pipe_cfg->dst_rect);
+
+	memset(&scaler3_cfg, 0, sizeof(scaler3_cfg));
+	memset(&pixel_ext, 0, sizeof(pixel_ext));
+
+	/* don't chroma subsample if decimating */
+	/* update scaler. calculate default config for QSEED3 */
+	_dpu_plane_setup_scaler3(pipe_hw,
+			src_width,
+			src_height,
+			dst_width,
+			dst_height,
+			&scaler3_cfg, fmt,
+			info->hsub, info->vsub,
+			rotation);
+
+	/* configure pixel extension based on scalar config */
+	_dpu_plane_setup_pixel_ext(&scaler3_cfg, &pixel_ext,
+			src_width, src_height, info->hsub, info->vsub);
+
+	if (pipe_hw->ops.setup_pe)
+		pipe_hw->ops.setup_pe(pipe_hw,
+				&pixel_ext);
+
+	/**
+	 * when programmed in multirect mode, scalar block will be
+	 * bypassed. Still we need to update alpha and bitwidth
+	 * ONLY for RECT0
+	 */
+	if (pipe_hw->ops.setup_scaler &&
+			pipe->multirect_index != DPU_SSPP_RECT_1)
+		pipe_hw->ops.setup_scaler(pipe_hw,
+				&scaler3_cfg,
+				fmt);
+}
+
+static void _dpu_plane_color_fill_pipe(struct dpu_plane_state *pstate,
+				       struct dpu_sw_pipe *pipe,
+				       struct drm_rect *dst_rect,
+				       u32 fill_color,
+				       const struct dpu_format *fmt)
+{
+	struct dpu_sw_pipe_cfg pipe_cfg;
+
+	/* update sspp */
+	if (!pipe->sspp->ops.setup_solidfill)
+		return;
+
+	pipe->sspp->ops.setup_solidfill(pipe, fill_color);
+
+	/* override scaler/decimation if solid fill */
+	pipe_cfg.dst_rect = *dst_rect;
+
+	pipe_cfg.src_rect.x1 = 0;
+	pipe_cfg.src_rect.y1 = 0;
+	pipe_cfg.src_rect.x2 =
+		drm_rect_width(&pipe_cfg.dst_rect);
+	pipe_cfg.src_rect.y2 =
+		drm_rect_height(&pipe_cfg.dst_rect);
+
+	if (pipe->sspp->ops.setup_format)
+		pipe->sspp->ops.setup_format(pipe, fmt, DPU_SSPP_SOLID_FILL);
+
+	if (pipe->sspp->ops.setup_rects)
+		pipe->sspp->ops.setup_rects(pipe, &pipe_cfg);
+
+	_dpu_plane_setup_scaler(pipe, fmt, true, &pipe_cfg, pstate->rotation);
+}
+
+/**
+ * _dpu_plane_color_fill - enables color fill on plane
+ * @pdpu:   Pointer to DPU plane object
+ * @color:  RGB fill color value, [23..16] Blue, [15..8] Green, [7..0] Red
+ * @alpha:  8-bit fill alpha value, 255 selects 100% alpha
+ */
+static void _dpu_plane_color_fill(struct dpu_plane *pdpu,
+		uint32_t color, uint32_t alpha)
+{
+	const struct dpu_format *fmt;
+	const struct drm_plane *plane = &pdpu->base;
+	struct dpu_plane_state *pstate = to_dpu_plane_state(plane->state);
+	u32 fill_color = (color & 0xFFFFFF) | ((alpha & 0xFF) << 24);
+
+	DPU_DEBUG_PLANE(pdpu, "\n");
+
+	/*
+	 * select fill format to match user property expectation,
+	 * h/w only supports RGB variants
+	 */
+	fmt = dpu_get_dpu_format(DRM_FORMAT_ABGR8888);
+	/* should not happen ever */
+	if (!fmt)
+		return;
+
+	/* update sspp */
+	_dpu_plane_color_fill_pipe(pstate, &pstate->pipe, &pstate->pipe_cfg.dst_rect,
+				   fill_color, fmt);
+
+	if (pstate->r_pipe.sspp)
+		_dpu_plane_color_fill_pipe(pstate, &pstate->r_pipe, &pstate->r_pipe_cfg.dst_rect,
+					   fill_color, fmt);
+}
+
+static int dpu_plane_prepare_fb(struct drm_plane *plane,
+		struct drm_plane_state *new_state)
+{
+	struct drm_framebuffer *fb = new_state->fb;
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct dpu_plane_state *pstate = to_dpu_plane_state(new_state);
+	struct dpu_hw_fmt_layout layout;
+	struct dpu_kms *kms = _dpu_plane_get_kms(&pdpu->base);
+	int ret;
+
+	if (!new_state->fb)
+		return 0;
+
+	DPU_DEBUG_PLANE(pdpu, "FB[%u]\n", fb->base.id);
+
+	/* cache aspace */
+	pstate->aspace = kms->base.aspace;
+
+	/*
+	 * TODO: Need to sort out the msm_framebuffer_prepare() call below so
+	 *       we can use msm_atomic_prepare_fb() instead of doing the
+	 *       implicit fence and fb prepare by hand here.
+	 */
+	drm_gem_plane_helper_prepare_fb(plane, new_state);
+
+	if (pstate->aspace) {
+		ret = msm_framebuffer_prepare(new_state->fb,
+				pstate->aspace, pstate->needs_dirtyfb);
+		if (ret) {
+			DPU_ERROR("failed to prepare framebuffer\n");
+			return ret;
+		}
+	}
+
+	/* validate framebuffer layout before commit */
+	ret = dpu_format_populate_layout(pstate->aspace,
+			new_state->fb, &layout);
+	if (ret) {
+		DPU_ERROR_PLANE(pdpu, "failed to get format layout, %d\n", ret);
+		if (pstate->aspace)
+			msm_framebuffer_cleanup(new_state->fb, pstate->aspace,
+						pstate->needs_dirtyfb);
+		return ret;
+	}
+
+	return 0;
+}
+
+static void dpu_plane_cleanup_fb(struct drm_plane *plane,
+		struct drm_plane_state *old_state)
+{
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct dpu_plane_state *old_pstate;
+
+	if (!old_state || !old_state->fb)
+		return;
+
+	old_pstate = to_dpu_plane_state(old_state);
+
+	DPU_DEBUG_PLANE(pdpu, "FB[%u]\n", old_state->fb->base.id);
+
+	msm_framebuffer_cleanup(old_state->fb, old_pstate->aspace,
+				old_pstate->needs_dirtyfb);
+}
+
+static int dpu_plane_check_inline_rotation(struct dpu_plane *pdpu,
+						const struct dpu_sspp_sub_blks *sblk,
+						struct drm_rect src, const struct dpu_format *fmt)
+{
+	size_t num_formats;
+	const u32 *supported_formats;
+
+	if (!sblk->rotation_cfg) {
+		DPU_ERROR("invalid rotation cfg\n");
+		return -EINVAL;
+	}
+
+	if (drm_rect_width(&src) > sblk->rotation_cfg->rot_maxheight) {
+		DPU_DEBUG_PLANE(pdpu, "invalid height for inline rot:%d max:%d\n",
+				src.y2, sblk->rotation_cfg->rot_maxheight);
+		return -EINVAL;
+	}
+
+	supported_formats = sblk->rotation_cfg->rot_format_list;
+	num_formats = sblk->rotation_cfg->rot_num_formats;
+
+	if (!DPU_FORMAT_IS_UBWC(fmt) ||
+		!dpu_find_format(fmt->base.pixel_format, supported_formats, num_formats))
+		return -EINVAL;
+
+	return 0;
+}
+
+static int dpu_plane_atomic_check_pipe(struct dpu_plane *pdpu,
+		struct dpu_sw_pipe *pipe,
+		struct dpu_sw_pipe_cfg *pipe_cfg,
+		const struct dpu_format *fmt,
+		const struct drm_display_mode *mode)
+{
+	uint32_t min_src_size;
+	struct dpu_kms *kms = _dpu_plane_get_kms(&pdpu->base);
+
+	min_src_size = DPU_FORMAT_IS_YUV(fmt) ? 2 : 1;
+
+	if (DPU_FORMAT_IS_YUV(fmt) &&
+	    !pipe->sspp->cap->sblk->csc_blk.len) {
+		DPU_DEBUG_PLANE(pdpu,
+				"plane doesn't have csc for yuv\n");
+		return -EINVAL;
+	}
+
+	/* check src bounds */
+	if (drm_rect_width(&pipe_cfg->src_rect) < min_src_size ||
+	    drm_rect_height(&pipe_cfg->src_rect) < min_src_size) {
+		DPU_DEBUG_PLANE(pdpu, "invalid source " DRM_RECT_FMT "\n",
+				DRM_RECT_ARG(&pipe_cfg->src_rect));
+		return -E2BIG;
+	}
+
+	/* valid yuv image */
+	if (DPU_FORMAT_IS_YUV(fmt) &&
+	    (pipe_cfg->src_rect.x1 & 0x1 ||
+	     pipe_cfg->src_rect.y1 & 0x1 ||
+	     drm_rect_width(&pipe_cfg->src_rect) & 0x1 ||
+	     drm_rect_height(&pipe_cfg->src_rect) & 0x1)) {
+		DPU_DEBUG_PLANE(pdpu, "invalid yuv source " DRM_RECT_FMT "\n",
+				DRM_RECT_ARG(&pipe_cfg->src_rect));
+		return -EINVAL;
+	}
+
+	/* min dst support */
+	if (drm_rect_width(&pipe_cfg->dst_rect) < 0x1 ||
+	    drm_rect_height(&pipe_cfg->dst_rect) < 0x1) {
+		DPU_DEBUG_PLANE(pdpu, "invalid dest rect " DRM_RECT_FMT "\n",
+				DRM_RECT_ARG(&pipe_cfg->dst_rect));
+		return -EINVAL;
+	}
+
+	/* max clk check */
+	if (_dpu_plane_calc_clk(mode, pipe_cfg) > kms->perf.max_core_clk_rate) {
+		DPU_DEBUG_PLANE(pdpu, "plane exceeds max mdp core clk limits\n");
+		return -E2BIG;
+	}
+
+	return 0;
+}
+
+static int dpu_plane_atomic_check(struct drm_plane *plane,
+				  struct drm_atomic_state *state)
+{
+	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
+										 plane);
+	int ret = 0, min_scale;
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct dpu_kms *kms = _dpu_plane_get_kms(&pdpu->base);
+	u64 max_mdp_clk_rate = kms->perf.max_core_clk_rate;
+	struct dpu_plane_state *pstate = to_dpu_plane_state(new_plane_state);
+	struct dpu_sw_pipe *pipe = &pstate->pipe;
+	struct dpu_sw_pipe *r_pipe = &pstate->r_pipe;
+	const struct drm_crtc_state *crtc_state = NULL;
+	const struct dpu_format *fmt;
+	struct dpu_sw_pipe_cfg *pipe_cfg = &pstate->pipe_cfg;
+	struct dpu_sw_pipe_cfg *r_pipe_cfg = &pstate->r_pipe_cfg;
+	struct drm_rect fb_rect = { 0 };
+	uint32_t max_linewidth;
+	unsigned int rotation;
+	uint32_t supported_rotations;
+	const struct dpu_sspp_cfg *pipe_hw_caps = pstate->pipe.sspp->cap;
+	const struct dpu_sspp_sub_blks *sblk = pstate->pipe.sspp->cap->sblk;
+
+	if (new_plane_state->crtc)
+		crtc_state = drm_atomic_get_new_crtc_state(state,
+							   new_plane_state->crtc);
+
+	min_scale = FRAC_16_16(1, sblk->maxupscale);
+	ret = drm_atomic_helper_check_plane_state(new_plane_state, crtc_state,
+						  min_scale,
+						  sblk->maxdwnscale << 16,
+						  true, true);
+	if (ret) {
+		DPU_DEBUG_PLANE(pdpu, "Check plane state failed (%d)\n", ret);
+		return ret;
+	}
+	if (!new_plane_state->visible)
+		return 0;
+
+	pipe->multirect_index = DPU_SSPP_RECT_SOLO;
+	pipe->multirect_mode = DPU_SSPP_MULTIRECT_NONE;
+	r_pipe->multirect_index = DPU_SSPP_RECT_SOLO;
+	r_pipe->multirect_mode = DPU_SSPP_MULTIRECT_NONE;
+	r_pipe->sspp = NULL;
+
+	pstate->stage = DPU_STAGE_0 + pstate->base.normalized_zpos;
+	if (pstate->stage >= pdpu->catalog->caps->max_mixer_blendstages) {
+		DPU_ERROR("> %d plane stages assigned\n",
+			  pdpu->catalog->caps->max_mixer_blendstages - DPU_STAGE_0);
+		return -EINVAL;
+	}
+
+	pipe_cfg->src_rect = new_plane_state->src;
+
+	/* state->src is 16.16, src_rect is not */
+	pipe_cfg->src_rect.x1 >>= 16;
+	pipe_cfg->src_rect.x2 >>= 16;
+	pipe_cfg->src_rect.y1 >>= 16;
+	pipe_cfg->src_rect.y2 >>= 16;
+
+	pipe_cfg->dst_rect = new_plane_state->dst;
+
+	fb_rect.x2 = new_plane_state->fb->width;
+	fb_rect.y2 = new_plane_state->fb->height;
+
+	/* Ensure fb size is supported */
+	if (drm_rect_width(&fb_rect) > MAX_IMG_WIDTH ||
+	    drm_rect_height(&fb_rect) > MAX_IMG_HEIGHT) {
+		DPU_DEBUG_PLANE(pdpu, "invalid framebuffer " DRM_RECT_FMT "\n",
+				DRM_RECT_ARG(&fb_rect));
+		return -E2BIG;
+	}
+
+	fmt = to_dpu_format(msm_framebuffer_format(new_plane_state->fb));
+
+	max_linewidth = pdpu->catalog->caps->max_linewidth;
+
+	drm_rect_rotate(&pipe_cfg->src_rect,
+			new_plane_state->fb->width, new_plane_state->fb->height,
+			new_plane_state->rotation);
+
+	if ((drm_rect_width(&pipe_cfg->src_rect) > max_linewidth) ||
+	     _dpu_plane_calc_clk(&crtc_state->adjusted_mode, pipe_cfg) > max_mdp_clk_rate) {
+		/*
+		 * In parallel multirect case only the half of the usual width
+		 * is supported for tiled formats. If we are here, we know that
+		 * full width is more than max_linewidth, thus each rect is
+		 * wider than allowed.
+		 */
+		if (DPU_FORMAT_IS_UBWC(fmt) &&
+		    drm_rect_width(&pipe_cfg->src_rect) > max_linewidth) {
+			DPU_DEBUG_PLANE(pdpu, "invalid src " DRM_RECT_FMT " line:%u, tiled format\n",
+					DRM_RECT_ARG(&pipe_cfg->src_rect), max_linewidth);
+			return -E2BIG;
+		}
+
+		if (drm_rect_width(&pipe_cfg->src_rect) > 2 * max_linewidth) {
+			DPU_DEBUG_PLANE(pdpu, "invalid src " DRM_RECT_FMT " line:%u\n",
+					DRM_RECT_ARG(&pipe_cfg->src_rect), max_linewidth);
+			return -E2BIG;
+		}
+
+		if (drm_rect_width(&pipe_cfg->src_rect) != drm_rect_width(&pipe_cfg->dst_rect) ||
+		    drm_rect_height(&pipe_cfg->src_rect) != drm_rect_height(&pipe_cfg->dst_rect) ||
+		    (!test_bit(DPU_SSPP_SMART_DMA_V1, &pipe->sspp->cap->features) &&
+		     !test_bit(DPU_SSPP_SMART_DMA_V2, &pipe->sspp->cap->features)) ||
+		    DPU_FORMAT_IS_YUV(fmt)) {
+			DPU_DEBUG_PLANE(pdpu, "invalid src " DRM_RECT_FMT " line:%u, can't use split source\n",
+					DRM_RECT_ARG(&pipe_cfg->src_rect), max_linewidth);
+			return -E2BIG;
+		}
+
+		/*
+		 * Use multirect for wide plane. We do not support dynamic
+		 * assignment of SSPPs, so we know the configuration.
+		 */
+		pipe->multirect_index = DPU_SSPP_RECT_0;
+		pipe->multirect_mode = DPU_SSPP_MULTIRECT_PARALLEL;
+
+		r_pipe->sspp = pipe->sspp;
+		r_pipe->multirect_index = DPU_SSPP_RECT_1;
+		r_pipe->multirect_mode = DPU_SSPP_MULTIRECT_PARALLEL;
+
+		*r_pipe_cfg = *pipe_cfg;
+		pipe_cfg->src_rect.x2 = (pipe_cfg->src_rect.x1 + pipe_cfg->src_rect.x2) >> 1;
+		pipe_cfg->dst_rect.x2 = (pipe_cfg->dst_rect.x1 + pipe_cfg->dst_rect.x2) >> 1;
+		r_pipe_cfg->src_rect.x1 = pipe_cfg->src_rect.x2;
+		r_pipe_cfg->dst_rect.x1 = pipe_cfg->dst_rect.x2;
+	}
+
+	drm_rect_rotate_inv(&pipe_cfg->src_rect,
+			    new_plane_state->fb->width, new_plane_state->fb->height,
+			    new_plane_state->rotation);
+	if (r_pipe->sspp)
+		drm_rect_rotate_inv(&r_pipe_cfg->src_rect,
+				    new_plane_state->fb->width, new_plane_state->fb->height,
+				    new_plane_state->rotation);
+
+	ret = dpu_plane_atomic_check_pipe(pdpu, pipe, pipe_cfg, fmt, &crtc_state->adjusted_mode);
+	if (ret)
+		return ret;
+
+	if (r_pipe->sspp) {
+		ret = dpu_plane_atomic_check_pipe(pdpu, r_pipe, r_pipe_cfg, fmt,
+						  &crtc_state->adjusted_mode);
+		if (ret)
+			return ret;
+	}
+
+	supported_rotations = DRM_MODE_REFLECT_MASK | DRM_MODE_ROTATE_0;
+
+	if (pipe_hw_caps->features & BIT(DPU_SSPP_INLINE_ROTATION))
+		supported_rotations |= DRM_MODE_ROTATE_90;
+
+	rotation = drm_rotation_simplify(new_plane_state->rotation,
+					supported_rotations);
+
+	if ((pipe_hw_caps->features & BIT(DPU_SSPP_INLINE_ROTATION)) &&
+		(rotation & DRM_MODE_ROTATE_90)) {
+		ret = dpu_plane_check_inline_rotation(pdpu, sblk, pipe_cfg->src_rect, fmt);
+		if (ret)
+			return ret;
+	}
+
+	pstate->rotation = rotation;
+	pstate->needs_qos_remap = drm_atomic_crtc_needs_modeset(crtc_state);
+
+	return 0;
+}
+
+static void dpu_plane_flush_csc(struct dpu_plane *pdpu, struct dpu_sw_pipe *pipe)
+{
+	const struct dpu_format *format =
+		to_dpu_format(msm_framebuffer_format(pdpu->base.state->fb));
+	const struct dpu_csc_cfg *csc_ptr;
+
+	if (!pipe->sspp || !pipe->sspp->ops.setup_csc)
+		return;
+
+	csc_ptr = _dpu_plane_get_csc(pipe, format);
+	if (!csc_ptr)
+		return;
+
+	DPU_DEBUG_PLANE(pdpu, "using 0x%X 0x%X 0x%X...\n",
+			csc_ptr->csc_mv[0],
+			csc_ptr->csc_mv[1],
+			csc_ptr->csc_mv[2]);
+
+	pipe->sspp->ops.setup_csc(pipe->sspp, csc_ptr);
+
+}
+
+void dpu_plane_flush(struct drm_plane *plane)
+{
+	struct dpu_plane *pdpu;
+	struct dpu_plane_state *pstate;
+
+	if (!plane || !plane->state) {
+		DPU_ERROR("invalid plane\n");
+		return;
+	}
+
+	pdpu = to_dpu_plane(plane);
+	pstate = to_dpu_plane_state(plane->state);
+
+	/*
+	 * These updates have to be done immediately before the plane flush
+	 * timing, and may not be moved to the atomic_update/mode_set functions.
+	 */
+	if (pdpu->is_error)
+		/* force white frame with 100% alpha pipe output on error */
+		_dpu_plane_color_fill(pdpu, 0xFFFFFF, 0xFF);
+	else if (pdpu->color_fill & DPU_PLANE_COLOR_FILL_FLAG)
+		/* force 100% alpha */
+		_dpu_plane_color_fill(pdpu, pdpu->color_fill, 0xFF);
+	else {
+		dpu_plane_flush_csc(pdpu, &pstate->pipe);
+		dpu_plane_flush_csc(pdpu, &pstate->r_pipe);
+	}
+
+	/* flag h/w flush complete */
+	if (plane->state)
+		pstate->pending = false;
+}
+
+/**
+ * dpu_plane_set_error: enable/disable error condition
+ * @plane: pointer to drm_plane structure
+ * @error: error value to set
+ */
+void dpu_plane_set_error(struct drm_plane *plane, bool error)
+{
+	struct dpu_plane *pdpu;
+
+	if (!plane)
+		return;
+
+	pdpu = to_dpu_plane(plane);
+	pdpu->is_error = error;
+}
+
+static void dpu_plane_sspp_update_pipe(struct drm_plane *plane,
+				       struct dpu_sw_pipe *pipe,
+				       struct dpu_sw_pipe_cfg *pipe_cfg,
+				       const struct dpu_format *fmt,
+				       int frame_rate,
+				       struct dpu_hw_fmt_layout *layout)
+{
+	uint32_t src_flags;
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct drm_plane_state *state = plane->state;
+	struct dpu_plane_state *pstate = to_dpu_plane_state(state);
+
+	if (layout && pipe->sspp->ops.setup_sourceaddress) {
+		trace_dpu_plane_set_scanout(pipe, layout);
+		pipe->sspp->ops.setup_sourceaddress(pipe, layout);
+	}
+
+	/* override for color fill */
+	if (pdpu->color_fill & DPU_PLANE_COLOR_FILL_FLAG) {
+		_dpu_plane_set_qos_ctrl(plane, pipe, false);
+
+		/* skip remaining processing on color fill */
+		return;
+	}
+
+	if (pipe->sspp->ops.setup_rects) {
+		pipe->sspp->ops.setup_rects(pipe,
+				pipe_cfg);
+	}
+
+	_dpu_plane_setup_scaler(pipe, fmt, false, pipe_cfg, pstate->rotation);
+
+	if (pipe->sspp->ops.setup_multirect)
+		pipe->sspp->ops.setup_multirect(
+				pipe);
+
+	if (pipe->sspp->ops.setup_format) {
+		unsigned int rotation = pstate->rotation;
+
+		src_flags = 0x0;
+
+		if (rotation & DRM_MODE_REFLECT_X)
+			src_flags |= DPU_SSPP_FLIP_LR;
+
+		if (rotation & DRM_MODE_REFLECT_Y)
+			src_flags |= DPU_SSPP_FLIP_UD;
+
+		if (rotation & DRM_MODE_ROTATE_90)
+			src_flags |= DPU_SSPP_ROT_90;
+
+		/* update format */
+		pipe->sspp->ops.setup_format(pipe, fmt, src_flags);
+
+		if (pipe->sspp->ops.setup_cdp) {
+			const struct dpu_perf_cfg *perf = pdpu->catalog->perf;
+
+			pipe->sspp->ops.setup_cdp(pipe, fmt,
+						  perf->cdp_cfg[DPU_PERF_CDP_USAGE_RT].rd_enable);
+		}
+	}
+
+	_dpu_plane_set_qos_lut(plane, pipe, fmt, pipe_cfg);
+
+	if (pipe->sspp->idx != SSPP_CURSOR0 &&
+	    pipe->sspp->idx != SSPP_CURSOR1)
+		_dpu_plane_set_ot_limit(plane, pipe, pipe_cfg, frame_rate);
+
+	if (pstate->needs_qos_remap)
+		_dpu_plane_set_qos_remap(plane, pipe);
+}
+
+static void dpu_plane_sspp_atomic_update(struct drm_plane *plane)
+{
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct drm_plane_state *state = plane->state;
+	struct dpu_plane_state *pstate = to_dpu_plane_state(state);
+	struct dpu_sw_pipe *pipe = &pstate->pipe;
+	struct dpu_sw_pipe *r_pipe = &pstate->r_pipe;
+	struct drm_crtc *crtc = state->crtc;
+	struct drm_framebuffer *fb = state->fb;
+	bool is_rt_pipe;
+	const struct dpu_format *fmt =
+		to_dpu_format(msm_framebuffer_format(fb));
+	struct dpu_sw_pipe_cfg *pipe_cfg = &pstate->pipe_cfg;
+	struct dpu_sw_pipe_cfg *r_pipe_cfg = &pstate->r_pipe_cfg;
+	struct dpu_kms *kms = _dpu_plane_get_kms(&pdpu->base);
+	struct msm_gem_address_space *aspace = kms->base.aspace;
+	struct dpu_hw_fmt_layout layout;
+	bool layout_valid = false;
+	int ret;
+
+	ret = dpu_format_populate_layout(aspace, fb, &layout);
+	if (ret)
+		DPU_ERROR_PLANE(pdpu, "failed to get format layout, %d\n", ret);
+	else
+		layout_valid = true;
+
+	pstate->pending = true;
+
+	is_rt_pipe = (dpu_crtc_get_client_type(crtc) != NRT_CLIENT);
+	pstate->needs_qos_remap |= (is_rt_pipe != pdpu->is_rt_pipe);
+	pdpu->is_rt_pipe = is_rt_pipe;
+
+	DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT
+			", %4.4s ubwc %d\n", fb->base.id, DRM_RECT_FP_ARG(&state->src),
+			crtc->base.id, DRM_RECT_ARG(&state->dst),
+			(char *)&fmt->base.pixel_format, DPU_FORMAT_IS_UBWC(fmt));
+
+	dpu_plane_sspp_update_pipe(plane, pipe, pipe_cfg, fmt,
+				   drm_mode_vrefresh(&crtc->mode),
+				   layout_valid ? &layout : NULL);
+
+	if (r_pipe->sspp) {
+		dpu_plane_sspp_update_pipe(plane, r_pipe, r_pipe_cfg, fmt,
+					   drm_mode_vrefresh(&crtc->mode),
+					   layout_valid ? &layout : NULL);
+	}
+
+	if (pstate->needs_qos_remap)
+		pstate->needs_qos_remap = false;
+
+	pstate->plane_fetch_bw = _dpu_plane_calc_bw(pdpu->catalog, fmt,
+						    &crtc->mode, pipe_cfg);
+
+	pstate->plane_clk = _dpu_plane_calc_clk(&crtc->mode, pipe_cfg);
+
+	if (r_pipe->sspp) {
+		pstate->plane_fetch_bw += _dpu_plane_calc_bw(pdpu->catalog, fmt, &crtc->mode, r_pipe_cfg);
+
+		pstate->plane_clk = max(pstate->plane_clk, _dpu_plane_calc_clk(&crtc->mode, r_pipe_cfg));
+	}
+}
+
+static void _dpu_plane_atomic_disable(struct drm_plane *plane)
+{
+	struct drm_plane_state *state = plane->state;
+	struct dpu_plane_state *pstate = to_dpu_plane_state(state);
+	struct dpu_sw_pipe *r_pipe = &pstate->r_pipe;
+
+	trace_dpu_plane_disable(DRMID(plane), false,
+				pstate->pipe.multirect_mode);
+
+	if (r_pipe->sspp) {
+		r_pipe->multirect_index = DPU_SSPP_RECT_SOLO;
+		r_pipe->multirect_mode = DPU_SSPP_MULTIRECT_NONE;
+
+		if (r_pipe->sspp->ops.setup_multirect)
+			r_pipe->sspp->ops.setup_multirect(r_pipe);
+	}
+
+	pstate->pending = true;
+}
+
+static void dpu_plane_atomic_update(struct drm_plane *plane,
+				struct drm_atomic_state *state)
+{
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct drm_plane_state *new_state = drm_atomic_get_new_plane_state(state,
+									   plane);
+
+	pdpu->is_error = false;
+
+	DPU_DEBUG_PLANE(pdpu, "\n");
+
+	if (!new_state->visible) {
+		_dpu_plane_atomic_disable(plane);
+	} else {
+		dpu_plane_sspp_atomic_update(plane);
+	}
+}
+
+static void dpu_plane_destroy_state(struct drm_plane *plane,
+		struct drm_plane_state *state)
+{
+	__drm_atomic_helper_plane_destroy_state(state);
+	kfree(to_dpu_plane_state(state));
+}
+
+static struct drm_plane_state *
+dpu_plane_duplicate_state(struct drm_plane *plane)
+{
+	struct dpu_plane *pdpu;
+	struct dpu_plane_state *pstate;
+	struct dpu_plane_state *old_state;
+
+	if (!plane) {
+		DPU_ERROR("invalid plane\n");
+		return NULL;
+	} else if (!plane->state) {
+		DPU_ERROR("invalid plane state\n");
+		return NULL;
+	}
+
+	old_state = to_dpu_plane_state(plane->state);
+	pdpu = to_dpu_plane(plane);
+	pstate = kmemdup(old_state, sizeof(*old_state), GFP_KERNEL);
+	if (!pstate) {
+		DPU_ERROR_PLANE(pdpu, "failed to allocate state\n");
+		return NULL;
+	}
+
+	DPU_DEBUG_PLANE(pdpu, "\n");
+
+	pstate->pending = false;
+
+	__drm_atomic_helper_plane_duplicate_state(plane, &pstate->base);
+
+	return &pstate->base;
+}
+
+static const char * const multirect_mode_name[] = {
+	[DPU_SSPP_MULTIRECT_NONE] = "none",
+	[DPU_SSPP_MULTIRECT_PARALLEL] = "parallel",
+	[DPU_SSPP_MULTIRECT_TIME_MX] = "time_mx",
+};
+
+static const char * const multirect_index_name[] = {
+	[DPU_SSPP_RECT_SOLO] = "solo",
+	[DPU_SSPP_RECT_0] = "rect_0",
+	[DPU_SSPP_RECT_1] = "rect_1",
+};
+
+static const char *dpu_get_multirect_mode(enum dpu_sspp_multirect_mode mode)
+{
+	if (WARN_ON(mode >= ARRAY_SIZE(multirect_mode_name)))
+		return "unknown";
+
+	return multirect_mode_name[mode];
+}
+
+static const char *dpu_get_multirect_index(enum dpu_sspp_multirect_index index)
+{
+	if (WARN_ON(index >= ARRAY_SIZE(multirect_index_name)))
+		return "unknown";
+
+	return multirect_index_name[index];
+}
+
+static void dpu_plane_atomic_print_state(struct drm_printer *p,
+		const struct drm_plane_state *state)
+{
+	const struct dpu_plane_state *pstate = to_dpu_plane_state(state);
+	const struct dpu_sw_pipe *pipe = &pstate->pipe;
+	const struct dpu_sw_pipe_cfg *pipe_cfg = &pstate->pipe_cfg;
+	const struct dpu_sw_pipe *r_pipe = &pstate->r_pipe;
+	const struct dpu_sw_pipe_cfg *r_pipe_cfg = &pstate->r_pipe_cfg;
+
+	drm_printf(p, "\tstage=%d\n", pstate->stage);
+
+	drm_printf(p, "\tsspp[0]=%s\n", pipe->sspp->cap->name);
+	drm_printf(p, "\tmultirect_mode[0]=%s\n", dpu_get_multirect_mode(pipe->multirect_mode));
+	drm_printf(p, "\tmultirect_index[0]=%s\n",
+		   dpu_get_multirect_index(pipe->multirect_index));
+	drm_printf(p, "\tsrc[0]=" DRM_RECT_FMT "\n", DRM_RECT_ARG(&pipe_cfg->src_rect));
+	drm_printf(p, "\tdst[0]=" DRM_RECT_FMT "\n", DRM_RECT_ARG(&pipe_cfg->dst_rect));
+
+	if (r_pipe->sspp) {
+		drm_printf(p, "\tsspp[1]=%s\n", r_pipe->sspp->cap->name);
+		drm_printf(p, "\tmultirect_mode[1]=%s\n",
+			   dpu_get_multirect_mode(r_pipe->multirect_mode));
+		drm_printf(p, "\tmultirect_index[1]=%s\n",
+			   dpu_get_multirect_index(r_pipe->multirect_index));
+		drm_printf(p, "\tsrc[1]=" DRM_RECT_FMT "\n", DRM_RECT_ARG(&r_pipe_cfg->src_rect));
+		drm_printf(p, "\tdst[1]=" DRM_RECT_FMT "\n", DRM_RECT_ARG(&r_pipe_cfg->dst_rect));
+	}
+}
+
+static void dpu_plane_reset(struct drm_plane *plane)
+{
+	struct dpu_plane *pdpu;
+	struct dpu_plane_state *pstate;
+	struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
+
+	if (!plane) {
+		DPU_ERROR("invalid plane\n");
+		return;
+	}
+
+	pdpu = to_dpu_plane(plane);
+	DPU_DEBUG_PLANE(pdpu, "\n");
+
+	/* remove previous state, if present */
+	if (plane->state) {
+		dpu_plane_destroy_state(plane, plane->state);
+		plane->state = NULL;
+	}
+
+	pstate = kzalloc(sizeof(*pstate), GFP_KERNEL);
+	if (!pstate) {
+		DPU_ERROR_PLANE(pdpu, "failed to allocate state\n");
+		return;
+	}
+
+	/*
+	 * Set the SSPP here until we have proper virtualized DPU planes.
+	 * This is the place where the state is allocated, so fill it fully.
+	 */
+	pstate->pipe.sspp = dpu_rm_get_sspp(&dpu_kms->rm, pdpu->pipe);
+	pstate->pipe.multirect_index = DPU_SSPP_RECT_SOLO;
+	pstate->pipe.multirect_mode = DPU_SSPP_MULTIRECT_NONE;
+
+	pstate->r_pipe.sspp = NULL;
+
+	__drm_atomic_helper_plane_reset(plane, &pstate->base);
+}
+
+#ifdef CONFIG_DEBUG_FS
+void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable)
+{
+	struct dpu_plane *pdpu = to_dpu_plane(plane);
+	struct dpu_plane_state *pstate = to_dpu_plane_state(plane->state);
+	struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
+
+	if (!pdpu->is_rt_pipe)
+		return;
+
+	pm_runtime_get_sync(&dpu_kms->pdev->dev);
+	_dpu_plane_set_qos_ctrl(plane, &pstate->pipe, enable);
+	if (pstate->r_pipe.sspp)
+		_dpu_plane_set_qos_ctrl(plane, &pstate->r_pipe, enable);
+	pm_runtime_put_sync(&dpu_kms->pdev->dev);
+}
+#endif
+
+static bool dpu_plane_format_mod_supported(struct drm_plane *plane,
+		uint32_t format, uint64_t modifier)
+{
+	if (modifier == DRM_FORMAT_MOD_LINEAR)
+		return true;
+
+	if (modifier == DRM_FORMAT_MOD_QCOM_COMPRESSED)
+		return dpu_find_format(format, qcom_compressed_supported_formats,
+				ARRAY_SIZE(qcom_compressed_supported_formats));
+
+	return false;
+}
+
+static const struct drm_plane_funcs dpu_plane_funcs = {
+		.update_plane = drm_atomic_helper_update_plane,
+		.disable_plane = drm_atomic_helper_disable_plane,
+		.reset = dpu_plane_reset,
+		.atomic_duplicate_state = dpu_plane_duplicate_state,
+		.atomic_destroy_state = dpu_plane_destroy_state,
+		.atomic_print_state = dpu_plane_atomic_print_state,
+		.format_mod_supported = dpu_plane_format_mod_supported,
+};
+
+static const struct drm_plane_helper_funcs dpu_plane_helper_funcs = {
+		.prepare_fb = dpu_plane_prepare_fb,
+		.cleanup_fb = dpu_plane_cleanup_fb,
+		.atomic_check = dpu_plane_atomic_check,
+		.atomic_update = dpu_plane_atomic_update,
+};
+
+/* initialize plane */
+struct drm_plane *dpu_plane_init(struct drm_device *dev,
+		uint32_t pipe, enum drm_plane_type type,
+		unsigned long possible_crtcs)
+{
+	struct drm_plane *plane = NULL;
+	const uint32_t *format_list;
+	struct dpu_plane *pdpu;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct dpu_kms *kms = to_dpu_kms(priv->kms);
+	struct dpu_hw_sspp *pipe_hw;
+	uint32_t num_formats;
+	uint32_t supported_rotations;
+	int ret;
+
+	/* initialize underlying h/w driver */
+	pipe_hw = dpu_rm_get_sspp(&kms->rm, pipe);
+	if (!pipe_hw || !pipe_hw->cap || !pipe_hw->cap->sblk) {
+		DPU_ERROR("[%u]SSPP is invalid\n", pipe);
+		return ERR_PTR(-EINVAL);
+	}
+
+	format_list = pipe_hw->cap->sblk->format_list;
+	num_formats = pipe_hw->cap->sblk->num_formats;
+
+	pdpu = drmm_universal_plane_alloc(dev, struct dpu_plane, base,
+				0xff, &dpu_plane_funcs,
+				format_list, num_formats,
+				supported_format_modifiers, type, NULL);
+	if (IS_ERR(pdpu))
+		return ERR_CAST(pdpu);
+
+	/* cache local stuff for later */
+	plane = &pdpu->base;
+	pdpu->pipe = pipe;
+
+	pdpu->catalog = kms->catalog;
+
+	ret = drm_plane_create_zpos_property(plane, 0, 0, DPU_ZPOS_MAX);
+	if (ret)
+		DPU_ERROR("failed to install zpos property, rc = %d\n", ret);
+
+	drm_plane_create_alpha_property(plane);
+	drm_plane_create_blend_mode_property(plane,
+			BIT(DRM_MODE_BLEND_PIXEL_NONE) |
+			BIT(DRM_MODE_BLEND_PREMULTI) |
+			BIT(DRM_MODE_BLEND_COVERAGE));
+
+	supported_rotations = DRM_MODE_REFLECT_MASK | DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_180;
+
+	if (pipe_hw->cap->features & BIT(DPU_SSPP_INLINE_ROTATION))
+		supported_rotations |= DRM_MODE_ROTATE_MASK;
+
+	drm_plane_create_rotation_property(plane,
+		    DRM_MODE_ROTATE_0, supported_rotations);
+
+	drm_plane_enable_fb_damage_clips(plane);
+
+	/* success! finalize initialization */
+	drm_plane_helper_add(plane, &dpu_plane_helper_funcs);
+
+	DPU_DEBUG("%s created for pipe:%u id:%u\n", plane->name,
+					pipe, plane->base.id);
+	return plane;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_plane.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_plane.h
@@ -0,0 +1,96 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef _DPU_PLANE_H_
+#define _DPU_PLANE_H_
+
+#include <drm/drm_crtc.h>
+
+#include "dpu_kms.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_sspp.h"
+
+/**
+ * struct dpu_plane_state: Define dpu extension of drm plane state object
+ * @base:	base drm plane state object
+ * @aspace:	pointer to address space for input/output buffers
+ * @pipe:	software pipe description
+ * @r_pipe:	software pipe description of the second pipe
+ * @pipe_cfg:	software pipe configuration
+ * @r_pipe_cfg:	software pipe configuration for the second pipe
+ * @stage:	assigned by crtc blender
+ * @needs_qos_remap: qos remap settings need to be updated
+ * @multirect_index: index of the rectangle of SSPP
+ * @multirect_mode: parallel or time multiplex multirect mode
+ * @pending:	whether the current update is still pending
+ * @plane_fetch_bw: calculated BW per plane
+ * @plane_clk: calculated clk per plane
+ * @needs_dirtyfb: whether attached CRTC needs pixel data explicitly flushed
+ * @rotation: simplified drm rotation hint
+ */
+struct dpu_plane_state {
+	struct drm_plane_state base;
+	struct msm_gem_address_space *aspace;
+	struct dpu_sw_pipe pipe;
+	struct dpu_sw_pipe r_pipe;
+	struct dpu_sw_pipe_cfg pipe_cfg;
+	struct dpu_sw_pipe_cfg r_pipe_cfg;
+	enum dpu_stage stage;
+	bool needs_qos_remap;
+	bool pending;
+
+	u64 plane_fetch_bw;
+	u64 plane_clk;
+
+	bool needs_dirtyfb;
+	unsigned int rotation;
+};
+
+#define to_dpu_plane_state(x) \
+	container_of(x, struct dpu_plane_state, base)
+
+/**
+ * dpu_plane_flush - final plane operations before commit flush
+ * @plane: Pointer to drm plane structure
+ */
+void dpu_plane_flush(struct drm_plane *plane);
+
+/**
+ * dpu_plane_set_error: enable/disable error condition
+ * @plane: pointer to drm_plane structure
+ */
+void dpu_plane_set_error(struct drm_plane *plane, bool error);
+
+/**
+ * dpu_plane_init - create new dpu plane for the given pipe
+ * @dev:   Pointer to DRM device
+ * @pipe:  dpu hardware pipe identifier
+ * @type:  Plane type - PRIMARY/OVERLAY/CURSOR
+ * @possible_crtcs: bitmask of crtc that can be attached to the given pipe
+ *
+ */
+struct drm_plane *dpu_plane_init(struct drm_device *dev,
+		uint32_t pipe, enum drm_plane_type type,
+		unsigned long possible_crtcs);
+
+/**
+ * dpu_plane_color_fill - enables color fill on plane
+ * @plane:  Pointer to DRM plane object
+ * @color:  RGB fill color value, [23..16] Blue, [15..8] Green, [7..0] Red
+ * @alpha:  8-bit fill alpha value, 255 selects 100% alpha
+ * Returns: 0 on success
+ */
+int dpu_plane_color_fill(struct drm_plane *plane,
+		uint32_t color, uint32_t alpha);
+
+#ifdef CONFIG_DEBUG_FS
+void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable);
+#else
+static inline void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable) {}
+#endif
+
+#endif /* _DPU_PLANE_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_rm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_rm.c
@@ -0,0 +1,636 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s] " fmt, __func__
+#include "dpu_kms.h"
+#include "dpu_hw_lm.h"
+#include "dpu_hw_ctl.h"
+#include "dpu_hw_cdm.h"
+#include "dpu_hw_pingpong.h"
+#include "dpu_hw_sspp.h"
+#include "dpu_hw_intf.h"
+#include "dpu_hw_wb.h"
+#include "dpu_hw_dspp.h"
+#include "dpu_hw_merge3d.h"
+#include "dpu_hw_dsc.h"
+#include "dpu_encoder.h"
+#include "dpu_trace.h"
+
+
+static inline bool reserved_by_other(uint32_t *res_map, int idx,
+				     uint32_t enc_id)
+{
+	return res_map[idx] && res_map[idx] != enc_id;
+}
+
+/**
+ * struct dpu_rm_requirements - Reservation requirements parameter bundle
+ * @topology:  selected topology for the display
+ */
+struct dpu_rm_requirements {
+	struct msm_display_topology topology;
+};
+
+int dpu_rm_init(struct drm_device *dev,
+		struct dpu_rm *rm,
+		const struct dpu_mdss_cfg *cat,
+		const struct msm_mdss_data *mdss_data,
+		void __iomem *mmio)
+{
+	int rc, i;
+
+	if (!rm || !cat || !mmio) {
+		DPU_ERROR("invalid kms\n");
+		return -EINVAL;
+	}
+
+	/* Clear, setup lists */
+	memset(rm, 0, sizeof(*rm));
+
+	/* Interrogate HW catalog and create tracking items for hw blocks */
+	for (i = 0; i < cat->mixer_count; i++) {
+		struct dpu_hw_mixer *hw;
+		const struct dpu_lm_cfg *lm = &cat->mixer[i];
+
+		hw = dpu_hw_lm_init(dev, lm, mmio);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed lm object creation: err %d\n", rc);
+			goto fail;
+		}
+		rm->mixer_blks[lm->id - LM_0] = &hw->base;
+	}
+
+	for (i = 0; i < cat->merge_3d_count; i++) {
+		struct dpu_hw_merge_3d *hw;
+		const struct dpu_merge_3d_cfg *merge_3d = &cat->merge_3d[i];
+
+		hw = dpu_hw_merge_3d_init(dev, merge_3d, mmio);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed merge_3d object creation: err %d\n",
+				rc);
+			goto fail;
+		}
+		rm->merge_3d_blks[merge_3d->id - MERGE_3D_0] = &hw->base;
+	}
+
+	for (i = 0; i < cat->pingpong_count; i++) {
+		struct dpu_hw_pingpong *hw;
+		const struct dpu_pingpong_cfg *pp = &cat->pingpong[i];
+
+		hw = dpu_hw_pingpong_init(dev, pp, mmio, cat->mdss_ver);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed pingpong object creation: err %d\n",
+				rc);
+			goto fail;
+		}
+		if (pp->merge_3d && pp->merge_3d < MERGE_3D_MAX)
+			hw->merge_3d = to_dpu_hw_merge_3d(rm->merge_3d_blks[pp->merge_3d - MERGE_3D_0]);
+		rm->pingpong_blks[pp->id - PINGPONG_0] = &hw->base;
+	}
+
+	for (i = 0; i < cat->intf_count; i++) {
+		struct dpu_hw_intf *hw;
+		const struct dpu_intf_cfg *intf = &cat->intf[i];
+
+		hw = dpu_hw_intf_init(dev, intf, mmio, cat->mdss_ver);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed intf object creation: err %d\n", rc);
+			goto fail;
+		}
+		rm->hw_intf[intf->id - INTF_0] = hw;
+	}
+
+	for (i = 0; i < cat->wb_count; i++) {
+		struct dpu_hw_wb *hw;
+		const struct dpu_wb_cfg *wb = &cat->wb[i];
+
+		hw = dpu_hw_wb_init(dev, wb, mmio, cat->mdss_ver);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed wb object creation: err %d\n", rc);
+			goto fail;
+		}
+		rm->hw_wb[wb->id - WB_0] = hw;
+	}
+
+	for (i = 0; i < cat->ctl_count; i++) {
+		struct dpu_hw_ctl *hw;
+		const struct dpu_ctl_cfg *ctl = &cat->ctl[i];
+
+		hw = dpu_hw_ctl_init(dev, ctl, mmio, cat->mixer_count, cat->mixer);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed ctl object creation: err %d\n", rc);
+			goto fail;
+		}
+		rm->ctl_blks[ctl->id - CTL_0] = &hw->base;
+	}
+
+	for (i = 0; i < cat->dspp_count; i++) {
+		struct dpu_hw_dspp *hw;
+		const struct dpu_dspp_cfg *dspp = &cat->dspp[i];
+
+		hw = dpu_hw_dspp_init(dev, dspp, mmio);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed dspp object creation: err %d\n", rc);
+			goto fail;
+		}
+		rm->dspp_blks[dspp->id - DSPP_0] = &hw->base;
+	}
+
+	for (i = 0; i < cat->dsc_count; i++) {
+		struct dpu_hw_dsc *hw;
+		const struct dpu_dsc_cfg *dsc = &cat->dsc[i];
+
+		if (test_bit(DPU_DSC_HW_REV_1_2, &dsc->features))
+			hw = dpu_hw_dsc_init_1_2(dev, dsc, mmio);
+		else
+			hw = dpu_hw_dsc_init(dev, dsc, mmio);
+
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed dsc object creation: err %d\n", rc);
+			goto fail;
+		}
+		rm->dsc_blks[dsc->id - DSC_0] = &hw->base;
+	}
+
+	for (i = 0; i < cat->sspp_count; i++) {
+		struct dpu_hw_sspp *hw;
+		const struct dpu_sspp_cfg *sspp = &cat->sspp[i];
+
+		hw = dpu_hw_sspp_init(dev, sspp, mmio, mdss_data, cat->mdss_ver);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed sspp object creation: err %d\n", rc);
+			goto fail;
+		}
+		rm->hw_sspp[sspp->id - SSPP_NONE] = hw;
+	}
+
+	if (cat->cdm) {
+		struct dpu_hw_cdm *hw;
+
+		hw = dpu_hw_cdm_init(dev, cat->cdm, mmio, cat->mdss_ver);
+		if (IS_ERR(hw)) {
+			rc = PTR_ERR(hw);
+			DPU_ERROR("failed cdm object creation: err %d\n", rc);
+			goto fail;
+		}
+		rm->cdm_blk = &hw->base;
+	}
+
+	return 0;
+
+fail:
+	return rc ? rc : -EFAULT;
+}
+
+static bool _dpu_rm_needs_split_display(const struct msm_display_topology *top)
+{
+	return top->num_intf > 1;
+}
+
+/**
+ * _dpu_rm_get_lm_peer - get the id of a mixer which is a peer of the primary
+ * @rm: dpu resource manager handle
+ * @primary_idx: index of primary mixer in rm->mixer_blks[]
+ *
+ * Returns: lm peer mixed id on success or %-EINVAL on error
+ */
+static int _dpu_rm_get_lm_peer(struct dpu_rm *rm, int primary_idx)
+{
+	const struct dpu_lm_cfg *prim_lm_cfg;
+
+	prim_lm_cfg = to_dpu_hw_mixer(rm->mixer_blks[primary_idx])->cap;
+
+	if (prim_lm_cfg->lm_pair >= LM_0 && prim_lm_cfg->lm_pair < LM_MAX)
+		return prim_lm_cfg->lm_pair - LM_0;
+	return -EINVAL;
+}
+
+/**
+ * _dpu_rm_check_lm_and_get_connected_blks - check if proposed layer mixer meets
+ *	proposed use case requirements, incl. hardwired dependent blocks like
+ *	pingpong
+ * @rm: dpu resource manager handle
+ * @global_state: resources shared across multiple kms objects
+ * @enc_id: encoder id requesting for allocation
+ * @lm_idx: index of proposed layer mixer in rm->mixer_blks[], function checks
+ *      if lm, and all other hardwired blocks connected to the lm (pp) is
+ *      available and appropriate
+ * @pp_idx: output parameter, index of pingpong block attached to the layer
+ *      mixer in rm->pingpong_blks[].
+ * @dspp_idx: output parameter, index of dspp block attached to the layer
+ *      mixer in rm->dspp_blks[].
+ * @reqs: input parameter, rm requirements for HW blocks needed in the
+ *      datapath.
+ * Return: true if lm matches all requirements, false otherwise
+ */
+static bool _dpu_rm_check_lm_and_get_connected_blks(struct dpu_rm *rm,
+		struct dpu_global_state *global_state,
+		uint32_t enc_id, int lm_idx, int *pp_idx, int *dspp_idx,
+		struct dpu_rm_requirements *reqs)
+{
+	const struct dpu_lm_cfg *lm_cfg;
+	int idx;
+
+	/* Already reserved? */
+	if (reserved_by_other(global_state->mixer_to_enc_id, lm_idx, enc_id)) {
+		DPU_DEBUG("lm %d already reserved\n", lm_idx + LM_0);
+		return false;
+	}
+
+	lm_cfg = to_dpu_hw_mixer(rm->mixer_blks[lm_idx])->cap;
+	idx = lm_cfg->pingpong - PINGPONG_0;
+	if (idx < 0 || idx >= ARRAY_SIZE(rm->pingpong_blks)) {
+		DPU_ERROR("failed to get pp on lm %d\n", lm_cfg->pingpong);
+		return false;
+	}
+
+	if (reserved_by_other(global_state->pingpong_to_enc_id, idx, enc_id)) {
+		DPU_DEBUG("lm %d pp %d already reserved\n", lm_cfg->id,
+				lm_cfg->pingpong);
+		return false;
+	}
+	*pp_idx = idx;
+
+	if (!reqs->topology.num_dspp)
+		return true;
+
+	idx = lm_cfg->dspp - DSPP_0;
+	if (idx < 0 || idx >= ARRAY_SIZE(rm->dspp_blks)) {
+		DPU_ERROR("failed to get dspp on lm %d\n", lm_cfg->dspp);
+		return false;
+	}
+
+	if (reserved_by_other(global_state->dspp_to_enc_id, idx, enc_id)) {
+		DPU_DEBUG("lm %d dspp %d already reserved\n", lm_cfg->id,
+				lm_cfg->dspp);
+		return false;
+	}
+	*dspp_idx = idx;
+
+	return true;
+}
+
+static int _dpu_rm_reserve_lms(struct dpu_rm *rm,
+			       struct dpu_global_state *global_state,
+			       uint32_t enc_id,
+			       struct dpu_rm_requirements *reqs)
+
+{
+	int lm_idx[MAX_BLOCKS];
+	int pp_idx[MAX_BLOCKS];
+	int dspp_idx[MAX_BLOCKS] = {0};
+	int i, lm_count = 0;
+
+	if (!reqs->topology.num_lm) {
+		DPU_ERROR("invalid number of lm: %d\n", reqs->topology.num_lm);
+		return -EINVAL;
+	}
+
+	/* Find a primary mixer */
+	for (i = 0; i < ARRAY_SIZE(rm->mixer_blks) &&
+			lm_count < reqs->topology.num_lm; i++) {
+		if (!rm->mixer_blks[i])
+			continue;
+
+		lm_count = 0;
+		lm_idx[lm_count] = i;
+
+		if (!_dpu_rm_check_lm_and_get_connected_blks(rm, global_state,
+				enc_id, i, &pp_idx[lm_count],
+				&dspp_idx[lm_count], reqs)) {
+			continue;
+		}
+
+		++lm_count;
+
+		/* Valid primary mixer found, find matching peers */
+		if (lm_count < reqs->topology.num_lm) {
+			int j = _dpu_rm_get_lm_peer(rm, i);
+
+			/* ignore the peer if there is an error or if the peer was already processed */
+			if (j < 0 || j < i)
+				continue;
+
+			if (!rm->mixer_blks[j])
+				continue;
+
+			if (!_dpu_rm_check_lm_and_get_connected_blks(rm,
+					global_state, enc_id, j,
+					&pp_idx[lm_count], &dspp_idx[lm_count],
+					reqs)) {
+				continue;
+			}
+
+			lm_idx[lm_count] = j;
+			++lm_count;
+		}
+	}
+
+	if (lm_count != reqs->topology.num_lm) {
+		DPU_DEBUG("unable to find appropriate mixers\n");
+		return -ENAVAIL;
+	}
+
+	for (i = 0; i < lm_count; i++) {
+		global_state->mixer_to_enc_id[lm_idx[i]] = enc_id;
+		global_state->pingpong_to_enc_id[pp_idx[i]] = enc_id;
+		global_state->dspp_to_enc_id[dspp_idx[i]] =
+			reqs->topology.num_dspp ? enc_id : 0;
+
+		trace_dpu_rm_reserve_lms(lm_idx[i] + LM_0, enc_id,
+					 pp_idx[i] + PINGPONG_0);
+	}
+
+	return 0;
+}
+
+static int _dpu_rm_reserve_ctls(
+		struct dpu_rm *rm,
+		struct dpu_global_state *global_state,
+		uint32_t enc_id,
+		const struct msm_display_topology *top)
+{
+	int ctl_idx[MAX_BLOCKS];
+	int i = 0, j, num_ctls;
+	bool needs_split_display;
+
+	/* each hw_intf needs its own hw_ctrl to program its control path */
+	num_ctls = top->num_intf;
+
+	needs_split_display = _dpu_rm_needs_split_display(top);
+
+	for (j = 0; j < ARRAY_SIZE(rm->ctl_blks); j++) {
+		const struct dpu_hw_ctl *ctl;
+		unsigned long features;
+		bool has_split_display;
+
+		if (!rm->ctl_blks[j])
+			continue;
+		if (reserved_by_other(global_state->ctl_to_enc_id, j, enc_id))
+			continue;
+
+		ctl = to_dpu_hw_ctl(rm->ctl_blks[j]);
+		features = ctl->caps->features;
+		has_split_display = BIT(DPU_CTL_SPLIT_DISPLAY) & features;
+
+		DPU_DEBUG("ctl %d caps 0x%lX\n", j + CTL_0, features);
+
+		if (needs_split_display != has_split_display)
+			continue;
+
+		ctl_idx[i] = j;
+		DPU_DEBUG("ctl %d match\n", j + CTL_0);
+
+		if (++i == num_ctls)
+			break;
+
+	}
+
+	if (i != num_ctls)
+		return -ENAVAIL;
+
+	for (i = 0; i < ARRAY_SIZE(ctl_idx) && i < num_ctls; i++) {
+		global_state->ctl_to_enc_id[ctl_idx[i]] = enc_id;
+		trace_dpu_rm_reserve_ctls(i + CTL_0, enc_id);
+	}
+
+	return 0;
+}
+
+static int _dpu_rm_reserve_dsc(struct dpu_rm *rm,
+			       struct dpu_global_state *global_state,
+			       struct drm_encoder *enc,
+			       const struct msm_display_topology *top)
+{
+	int num_dsc = top->num_dsc;
+	int i;
+
+	/* check if DSC required are allocated or not */
+	for (i = 0; i < num_dsc; i++) {
+		if (!rm->dsc_blks[i]) {
+			DPU_ERROR("DSC %d does not exist\n", i);
+			return -EIO;
+		}
+
+		if (global_state->dsc_to_enc_id[i]) {
+			DPU_ERROR("DSC %d is already allocated\n", i);
+			return -EIO;
+		}
+	}
+
+	for (i = 0; i < num_dsc; i++)
+		global_state->dsc_to_enc_id[i] = enc->base.id;
+
+	return 0;
+}
+
+static int _dpu_rm_reserve_cdm(struct dpu_rm *rm,
+			       struct dpu_global_state *global_state,
+			       struct drm_encoder *enc)
+{
+	/* try allocating only one CDM block */
+	if (!rm->cdm_blk) {
+		DPU_ERROR("CDM block does not exist\n");
+		return -EIO;
+	}
+
+	if (global_state->cdm_to_enc_id) {
+		DPU_ERROR("CDM_0 is already allocated\n");
+		return -EIO;
+	}
+
+	global_state->cdm_to_enc_id = enc->base.id;
+
+	return 0;
+}
+
+static int _dpu_rm_make_reservation(
+		struct dpu_rm *rm,
+		struct dpu_global_state *global_state,
+		struct drm_encoder *enc,
+		struct dpu_rm_requirements *reqs)
+{
+	int ret;
+
+	ret = _dpu_rm_reserve_lms(rm, global_state, enc->base.id, reqs);
+	if (ret) {
+		DPU_ERROR("unable to find appropriate mixers\n");
+		return ret;
+	}
+
+	ret = _dpu_rm_reserve_ctls(rm, global_state, enc->base.id,
+				&reqs->topology);
+	if (ret) {
+		DPU_ERROR("unable to find appropriate CTL\n");
+		return ret;
+	}
+
+	ret  = _dpu_rm_reserve_dsc(rm, global_state, enc, &reqs->topology);
+	if (ret)
+		return ret;
+
+	if (reqs->topology.needs_cdm) {
+		ret = _dpu_rm_reserve_cdm(rm, global_state, enc);
+		if (ret) {
+			DPU_ERROR("unable to find CDM blk\n");
+			return ret;
+		}
+	}
+
+	return ret;
+}
+
+static int _dpu_rm_populate_requirements(
+		struct drm_encoder *enc,
+		struct dpu_rm_requirements *reqs,
+		struct msm_display_topology req_topology)
+{
+	reqs->topology = req_topology;
+
+	DRM_DEBUG_KMS("num_lm: %d num_dsc: %d num_intf: %d cdm: %d\n",
+		      reqs->topology.num_lm, reqs->topology.num_dsc,
+		      reqs->topology.num_intf, reqs->topology.needs_cdm);
+
+	return 0;
+}
+
+static void _dpu_rm_clear_mapping(uint32_t *res_mapping, int cnt,
+				  uint32_t enc_id)
+{
+	int i;
+
+	for (i = 0; i < cnt; i++) {
+		if (res_mapping[i] == enc_id)
+			res_mapping[i] = 0;
+	}
+}
+
+void dpu_rm_release(struct dpu_global_state *global_state,
+		    struct drm_encoder *enc)
+{
+	_dpu_rm_clear_mapping(global_state->pingpong_to_enc_id,
+		ARRAY_SIZE(global_state->pingpong_to_enc_id), enc->base.id);
+	_dpu_rm_clear_mapping(global_state->mixer_to_enc_id,
+		ARRAY_SIZE(global_state->mixer_to_enc_id), enc->base.id);
+	_dpu_rm_clear_mapping(global_state->ctl_to_enc_id,
+		ARRAY_SIZE(global_state->ctl_to_enc_id), enc->base.id);
+	_dpu_rm_clear_mapping(global_state->dsc_to_enc_id,
+		ARRAY_SIZE(global_state->dsc_to_enc_id), enc->base.id);
+	_dpu_rm_clear_mapping(global_state->dspp_to_enc_id,
+		ARRAY_SIZE(global_state->dspp_to_enc_id), enc->base.id);
+	_dpu_rm_clear_mapping(&global_state->cdm_to_enc_id, 1, enc->base.id);
+}
+
+int dpu_rm_reserve(
+		struct dpu_rm *rm,
+		struct dpu_global_state *global_state,
+		struct drm_encoder *enc,
+		struct drm_crtc_state *crtc_state,
+		struct msm_display_topology topology)
+{
+	struct dpu_rm_requirements reqs;
+	int ret;
+
+	/* Check if this is just a page-flip */
+	if (!drm_atomic_crtc_needs_modeset(crtc_state))
+		return 0;
+
+	if (IS_ERR(global_state)) {
+		DPU_ERROR("failed to global state\n");
+		return PTR_ERR(global_state);
+	}
+
+	DRM_DEBUG_KMS("reserving hw for enc %d crtc %d\n",
+		      enc->base.id, crtc_state->crtc->base.id);
+
+	ret = _dpu_rm_populate_requirements(enc, &reqs, topology);
+	if (ret) {
+		DPU_ERROR("failed to populate hw requirements\n");
+		return ret;
+	}
+
+	ret = _dpu_rm_make_reservation(rm, global_state, enc, &reqs);
+	if (ret)
+		DPU_ERROR("failed to reserve hw resources: %d\n", ret);
+
+
+
+	return ret;
+}
+
+int dpu_rm_get_assigned_resources(struct dpu_rm *rm,
+	struct dpu_global_state *global_state, uint32_t enc_id,
+	enum dpu_hw_blk_type type, struct dpu_hw_blk **blks, int blks_size)
+{
+	struct dpu_hw_blk **hw_blks;
+	uint32_t *hw_to_enc_id;
+	int i, num_blks, max_blks;
+
+	switch (type) {
+	case DPU_HW_BLK_PINGPONG:
+		hw_blks = rm->pingpong_blks;
+		hw_to_enc_id = global_state->pingpong_to_enc_id;
+		max_blks = ARRAY_SIZE(rm->pingpong_blks);
+		break;
+	case DPU_HW_BLK_LM:
+		hw_blks = rm->mixer_blks;
+		hw_to_enc_id = global_state->mixer_to_enc_id;
+		max_blks = ARRAY_SIZE(rm->mixer_blks);
+		break;
+	case DPU_HW_BLK_CTL:
+		hw_blks = rm->ctl_blks;
+		hw_to_enc_id = global_state->ctl_to_enc_id;
+		max_blks = ARRAY_SIZE(rm->ctl_blks);
+		break;
+	case DPU_HW_BLK_DSPP:
+		hw_blks = rm->dspp_blks;
+		hw_to_enc_id = global_state->dspp_to_enc_id;
+		max_blks = ARRAY_SIZE(rm->dspp_blks);
+		break;
+	case DPU_HW_BLK_DSC:
+		hw_blks = rm->dsc_blks;
+		hw_to_enc_id = global_state->dsc_to_enc_id;
+		max_blks = ARRAY_SIZE(rm->dsc_blks);
+		break;
+	case DPU_HW_BLK_CDM:
+		hw_blks = &rm->cdm_blk;
+		hw_to_enc_id = &global_state->cdm_to_enc_id;
+		max_blks = 1;
+		break;
+	default:
+		DPU_ERROR("blk type %d not managed by rm\n", type);
+		return 0;
+	}
+
+	num_blks = 0;
+	for (i = 0; i < max_blks; i++) {
+		if (hw_to_enc_id[i] != enc_id)
+			continue;
+
+		if (num_blks == blks_size) {
+			DPU_ERROR("More than %d resources assigned to enc %d\n",
+				  blks_size, enc_id);
+			break;
+		}
+		if (!hw_blks[i]) {
+			DPU_ERROR("Allocated resource %d unavailable to assign to enc %d\n",
+				  type, enc_id);
+			break;
+		}
+		blks[num_blks++] = hw_blks[i];
+	}
+
+	return num_blks;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_rm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_rm.h
@@ -0,0 +1,123 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __DPU_RM_H__
+#define __DPU_RM_H__
+
+#include <linux/list.h>
+
+#include "msm_kms.h"
+#include "dpu_hw_top.h"
+
+struct dpu_global_state;
+
+/**
+ * struct dpu_rm - DPU dynamic hardware resource manager
+ * @pingpong_blks: array of pingpong hardware resources
+ * @mixer_blks: array of layer mixer hardware resources
+ * @ctl_blks: array of ctl hardware resources
+ * @hw_intf: array of intf hardware resources
+ * @hw_wb: array of wb hardware resources
+ * @dspp_blks: array of dspp hardware resources
+ * @hw_sspp: array of sspp hardware resources
+ * @cdm_blk: cdm hardware resource
+ */
+struct dpu_rm {
+	struct dpu_hw_blk *pingpong_blks[PINGPONG_MAX - PINGPONG_0];
+	struct dpu_hw_blk *mixer_blks[LM_MAX - LM_0];
+	struct dpu_hw_blk *ctl_blks[CTL_MAX - CTL_0];
+	struct dpu_hw_intf *hw_intf[INTF_MAX - INTF_0];
+	struct dpu_hw_wb *hw_wb[WB_MAX - WB_0];
+	struct dpu_hw_blk *dspp_blks[DSPP_MAX - DSPP_0];
+	struct dpu_hw_blk *merge_3d_blks[MERGE_3D_MAX - MERGE_3D_0];
+	struct dpu_hw_blk *dsc_blks[DSC_MAX - DSC_0];
+	struct dpu_hw_sspp *hw_sspp[SSPP_MAX - SSPP_NONE];
+	struct dpu_hw_blk *cdm_blk;
+};
+
+/**
+ * dpu_rm_init - Read hardware catalog and create reservation tracking objects
+ *	for all HW blocks.
+ * @dev:  Corresponding device for devres management
+ * @rm: DPU Resource Manager handle
+ * @cat: Pointer to hardware catalog
+ * @mdss_data: Pointer to MDSS / UBWC configuration
+ * @mmio: mapped register io address of MDP
+ * @Return: 0 on Success otherwise -ERROR
+ */
+int dpu_rm_init(struct drm_device *dev,
+		struct dpu_rm *rm,
+		const struct dpu_mdss_cfg *cat,
+		const struct msm_mdss_data *mdss_data,
+		void __iomem *mmio);
+
+/**
+ * dpu_rm_reserve - Given a CRTC->Encoder->Connector display chain, analyze
+ *	the use connections and user requirements, specified through related
+ *	topology control properties, and reserve hardware blocks to that
+ *	display chain.
+ *	HW blocks can then be accessed through dpu_rm_get_* functions.
+ *	HW Reservations should be released via dpu_rm_release_hw.
+ * @rm: DPU Resource Manager handle
+ * @drm_enc: DRM Encoder handle
+ * @crtc_state: Proposed Atomic DRM CRTC State handle
+ * @topology: Pointer to topology info for the display
+ * @Return: 0 on Success otherwise -ERROR
+ */
+int dpu_rm_reserve(struct dpu_rm *rm,
+		struct dpu_global_state *global_state,
+		struct drm_encoder *drm_enc,
+		struct drm_crtc_state *crtc_state,
+		struct msm_display_topology topology);
+
+/**
+ * dpu_rm_reserve - Given the encoder for the display chain, release any
+ *	HW blocks previously reserved for that use case.
+ * @rm: DPU Resource Manager handle
+ * @enc: DRM Encoder handle
+ * @Return: 0 on Success otherwise -ERROR
+ */
+void dpu_rm_release(struct dpu_global_state *global_state,
+		struct drm_encoder *enc);
+
+/**
+ * Get hw resources of the given type that are assigned to this encoder.
+ */
+int dpu_rm_get_assigned_resources(struct dpu_rm *rm,
+	struct dpu_global_state *global_state, uint32_t enc_id,
+	enum dpu_hw_blk_type type, struct dpu_hw_blk **blks, int blks_size);
+
+/**
+ * dpu_rm_get_intf - Return a struct dpu_hw_intf instance given it's index.
+ * @rm: DPU Resource Manager handle
+ * @intf_idx: INTF's index
+ */
+static inline struct dpu_hw_intf *dpu_rm_get_intf(struct dpu_rm *rm, enum dpu_intf intf_idx)
+{
+	return rm->hw_intf[intf_idx - INTF_0];
+}
+
+/**
+ * dpu_rm_get_wb - Return a struct dpu_hw_wb instance given it's index.
+ * @rm: DPU Resource Manager handle
+ * @wb_idx: WB index
+ */
+static inline struct dpu_hw_wb *dpu_rm_get_wb(struct dpu_rm *rm, enum dpu_wb wb_idx)
+{
+	return rm->hw_wb[wb_idx - WB_0];
+}
+
+/**
+ * dpu_rm_get_sspp - Return a struct dpu_hw_sspp instance given it's index.
+ * @rm: DPU Resource Manager handle
+ * @sspp_idx: SSPP index
+ */
+static inline struct dpu_hw_sspp *dpu_rm_get_sspp(struct dpu_rm *rm, enum dpu_sspp sspp_idx)
+{
+	return rm->hw_sspp[sspp_idx - SSPP_NONE];
+}
+
+#endif /* __DPU_RM_H__ */
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_trace.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_trace.h
@@ -0,0 +1,974 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2014-2018, The Linux Foundation. All rights reserved.
+ */
+
+#if !defined(_DPU_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
+#define _DPU_TRACE_H_
+
+#include <linux/stringify.h>
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+
+#include <drm/drm_rect.h>
+#include "dpu_crtc.h"
+#include "dpu_encoder_phys.h"
+#include "dpu_hw_mdss.h"
+#include "dpu_hw_vbif.h"
+#include "dpu_plane.h"
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM dpu
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE dpu_trace
+
+TRACE_EVENT(dpu_perf_set_qos_luts,
+	TP_PROTO(u32 pnum, u32 fmt, bool rt, u32 fl,
+		u32 lut, u32 lut_usage),
+	TP_ARGS(pnum, fmt, rt, fl, lut, lut_usage),
+	TP_STRUCT__entry(
+			__field(u32, pnum)
+			__field(u32, fmt)
+			__field(bool, rt)
+			__field(u32, fl)
+			__field(u64, lut)
+			__field(u32, lut_usage)
+	),
+	TP_fast_assign(
+			__entry->pnum = pnum;
+			__entry->fmt = fmt;
+			__entry->rt = rt;
+			__entry->fl = fl;
+			__entry->lut = lut;
+			__entry->lut_usage = lut_usage;
+	),
+	TP_printk("pnum=%d fmt=%x rt=%d fl=%d lut=0x%llx lut_usage=%d",
+			__entry->pnum, __entry->fmt,
+			__entry->rt, __entry->fl,
+			__entry->lut, __entry->lut_usage)
+);
+
+TRACE_EVENT(dpu_perf_set_danger_luts,
+	TP_PROTO(u32 pnum, u32 fmt, u32 mode, u32 danger_lut,
+		u32 safe_lut),
+	TP_ARGS(pnum, fmt, mode, danger_lut, safe_lut),
+	TP_STRUCT__entry(
+			__field(u32, pnum)
+			__field(u32, fmt)
+			__field(u32, mode)
+			__field(u32, danger_lut)
+			__field(u32, safe_lut)
+	),
+	TP_fast_assign(
+			__entry->pnum = pnum;
+			__entry->fmt = fmt;
+			__entry->mode = mode;
+			__entry->danger_lut = danger_lut;
+			__entry->safe_lut = safe_lut;
+	),
+	TP_printk("pnum=%d fmt=%x mode=%d luts[0x%x, 0x%x]",
+			__entry->pnum, __entry->fmt,
+			__entry->mode, __entry->danger_lut,
+			__entry->safe_lut)
+);
+
+TRACE_EVENT(dpu_perf_set_ot,
+	TP_PROTO(u32 pnum, u32 xin_id, u32 rd_lim, u32 vbif_idx),
+	TP_ARGS(pnum, xin_id, rd_lim, vbif_idx),
+	TP_STRUCT__entry(
+			__field(u32, pnum)
+			__field(u32, xin_id)
+			__field(u32, rd_lim)
+			__field(u32, vbif_idx)
+	),
+	TP_fast_assign(
+			__entry->pnum = pnum;
+			__entry->xin_id = xin_id;
+			__entry->rd_lim = rd_lim;
+			__entry->vbif_idx = vbif_idx;
+	),
+	TP_printk("pnum:%d xin_id:%d ot:%d vbif:%d",
+			__entry->pnum, __entry->xin_id, __entry->rd_lim,
+			__entry->vbif_idx)
+)
+
+TRACE_EVENT(dpu_cmd_release_bw,
+	TP_PROTO(u32 crtc_id),
+	TP_ARGS(crtc_id),
+	TP_STRUCT__entry(
+			__field(u32, crtc_id)
+	),
+	TP_fast_assign(
+			__entry->crtc_id = crtc_id;
+	),
+	TP_printk("crtc:%d", __entry->crtc_id)
+);
+
+TRACE_EVENT(tracing_mark_write,
+	TP_PROTO(int pid, const char *name, bool trace_begin),
+	TP_ARGS(pid, name, trace_begin),
+	TP_STRUCT__entry(
+			__field(int, pid)
+			__string(trace_name, name)
+			__field(bool, trace_begin)
+	),
+	TP_fast_assign(
+			__entry->pid = pid;
+			__assign_str(trace_name, name);
+			__entry->trace_begin = trace_begin;
+	),
+	TP_printk("%s|%d|%s", __entry->trace_begin ? "B" : "E",
+		__entry->pid, __get_str(trace_name))
+)
+
+TRACE_EVENT(dpu_trace_counter,
+	TP_PROTO(int pid, char *name, int value),
+	TP_ARGS(pid, name, value),
+	TP_STRUCT__entry(
+			__field(int, pid)
+			__string(counter_name, name)
+			__field(int, value)
+	),
+	TP_fast_assign(
+			__entry->pid = current->tgid;
+			__assign_str(counter_name, name);
+			__entry->value = value;
+	),
+	TP_printk("%d|%s|%d", __entry->pid,
+			__get_str(counter_name), __entry->value)
+)
+
+TRACE_EVENT(dpu_perf_crtc_update,
+	TP_PROTO(u32 crtc, u64 bw_ctl, u32 core_clk_rate,
+			bool stop_req, bool update_bus, bool update_clk),
+	TP_ARGS(crtc, bw_ctl, core_clk_rate, stop_req, update_bus, update_clk),
+	TP_STRUCT__entry(
+			__field(u32, crtc)
+			__field(u64, bw_ctl)
+			__field(u32, core_clk_rate)
+			__field(bool, stop_req)
+			__field(u32, update_bus)
+			__field(u32, update_clk)
+	),
+	TP_fast_assign(
+			__entry->crtc = crtc;
+			__entry->bw_ctl = bw_ctl;
+			__entry->core_clk_rate = core_clk_rate;
+			__entry->stop_req = stop_req;
+			__entry->update_bus = update_bus;
+			__entry->update_clk = update_clk;
+	),
+	 TP_printk(
+		"crtc=%d bw_ctl=%llu clk_rate=%u stop_req=%d u_bus=%d u_clk=%d",
+			__entry->crtc,
+			__entry->bw_ctl,
+			__entry->core_clk_rate,
+			__entry->stop_req,
+			__entry->update_bus,
+			__entry->update_clk)
+);
+
+DECLARE_EVENT_CLASS(dpu_irq_template,
+	TP_PROTO(unsigned int irq_reg, unsigned int irq_bit),
+	TP_ARGS(irq_reg, irq_bit),
+	TP_STRUCT__entry(
+		__field(	unsigned int,		irq_reg		)
+		__field(	unsigned int,		irq_bit		)
+	),
+	TP_fast_assign(
+		__entry->irq_reg = irq_reg;
+		__entry->irq_bit = irq_bit;
+	),
+	TP_printk("IRQ=[%d, %d]", __entry->irq_reg, __entry->irq_bit)
+);
+DEFINE_EVENT(dpu_irq_template, dpu_irq_register_success,
+	TP_PROTO(unsigned int irq_reg, unsigned int irq_bit),
+	TP_ARGS(irq_reg, irq_bit)
+);
+DEFINE_EVENT(dpu_irq_template, dpu_irq_unregister_success,
+	TP_PROTO(unsigned int irq_reg, unsigned int irq_bit),
+	TP_ARGS(irq_reg, irq_bit)
+);
+
+TRACE_EVENT(dpu_enc_irq_wait_success,
+	TP_PROTO(uint32_t drm_id, void *func,
+		 unsigned int irq_reg, unsigned int irq_bit, enum dpu_pingpong pp_idx, int atomic_cnt),
+	TP_ARGS(drm_id, func, irq_reg, irq_bit, pp_idx, atomic_cnt),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+		__field(	void *,			func		)
+		__field(	unsigned int,		irq_reg		)
+		__field(	unsigned int,		irq_bit		)
+		__field(	enum dpu_pingpong,	pp_idx		)
+		__field(	int,			atomic_cnt	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->func = func;
+		__entry->irq_reg = irq_reg;
+		__entry->irq_bit = irq_bit;
+		__entry->pp_idx = pp_idx;
+		__entry->atomic_cnt = atomic_cnt;
+	),
+	TP_printk("id=%u, callback=%ps, IRQ=[%d, %d], pp=%d, atomic_cnt=%d",
+		  __entry->drm_id, __entry->func,
+		  __entry->irq_reg, __entry->irq_bit, __entry->pp_idx, __entry->atomic_cnt)
+);
+
+DECLARE_EVENT_CLASS(dpu_drm_obj_template,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+	),
+	TP_printk("id=%u", __entry->drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_enc_atomic_check,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_enc_mode_set,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_enc_disable,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_enc_kickoff,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_enc_prepare_kickoff,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_enc_prepare_kickoff_reset,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_crtc_complete_flip,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_crtc_vblank_cb,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_crtc_complete_commit,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_kms_commit,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_kms_wait_for_commit_done,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+DEFINE_EVENT(dpu_drm_obj_template, dpu_crtc_runtime_resume,
+	TP_PROTO(uint32_t drm_id),
+	TP_ARGS(drm_id)
+);
+
+TRACE_EVENT(dpu_enc_enable,
+	TP_PROTO(uint32_t drm_id, int hdisplay, int vdisplay),
+	TP_ARGS(drm_id, hdisplay, vdisplay),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+		__field(	int,			hdisplay	)
+		__field(	int,			vdisplay	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->hdisplay = hdisplay;
+		__entry->vdisplay = vdisplay;
+	),
+	TP_printk("id=%u, mode=%dx%d",
+		  __entry->drm_id, __entry->hdisplay, __entry->vdisplay)
+);
+
+DECLARE_EVENT_CLASS(dpu_enc_keyval_template,
+	TP_PROTO(uint32_t drm_id, int val),
+	TP_ARGS(drm_id, val),
+	TP_STRUCT__entry(
+		__field(	uint32_t,	drm_id	)
+		__field(	int,		val	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->val = val;
+	),
+	TP_printk("id=%u, val=%d", __entry->drm_id, __entry->val)
+);
+DEFINE_EVENT(dpu_enc_keyval_template, dpu_enc_underrun_cb,
+	TP_PROTO(uint32_t drm_id, int count),
+	TP_ARGS(drm_id, count)
+);
+DEFINE_EVENT(dpu_enc_keyval_template, dpu_enc_trigger_start,
+	TP_PROTO(uint32_t drm_id, int ctl_idx),
+	TP_ARGS(drm_id, ctl_idx)
+);
+
+TRACE_EVENT(dpu_enc_atomic_check_flags,
+	TP_PROTO(uint32_t drm_id, unsigned int flags),
+	TP_ARGS(drm_id, flags),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+		__field(	unsigned int,		flags		)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->flags = flags;
+	),
+	TP_printk("id=%u, flags=%u",
+		  __entry->drm_id, __entry->flags)
+);
+
+DECLARE_EVENT_CLASS(dpu_enc_id_enable_template,
+	TP_PROTO(uint32_t drm_id, bool enable),
+	TP_ARGS(drm_id, enable),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+		__field(	bool,			enable		)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->enable = enable;
+	),
+	TP_printk("id=%u, enable=%s",
+		  __entry->drm_id, __entry->enable ? "true" : "false")
+);
+DEFINE_EVENT(dpu_enc_id_enable_template, dpu_enc_rc_helper,
+	TP_PROTO(uint32_t drm_id, bool enable),
+	TP_ARGS(drm_id, enable)
+);
+DEFINE_EVENT(dpu_enc_id_enable_template, dpu_enc_vblank_cb,
+	TP_PROTO(uint32_t drm_id, bool enable),
+	TP_ARGS(drm_id, enable)
+);
+DEFINE_EVENT(dpu_enc_id_enable_template, dpu_enc_phys_cmd_connect_te,
+	TP_PROTO(uint32_t drm_id, bool enable),
+	TP_ARGS(drm_id, enable)
+);
+
+TRACE_EVENT(dpu_enc_rc,
+	TP_PROTO(uint32_t drm_id, u32 sw_event, bool idle_pc_supported,
+		 int rc_state, const char *stage),
+	TP_ARGS(drm_id, sw_event, idle_pc_supported, rc_state, stage),
+	TP_STRUCT__entry(
+		__field(	uint32_t,	drm_id			)
+		__field(	u32,		sw_event		)
+		__field(	bool,		idle_pc_supported	)
+		__field(	int,		rc_state		)
+		__string(	stage_str,	stage			)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->sw_event = sw_event;
+		__entry->idle_pc_supported = idle_pc_supported;
+		__entry->rc_state = rc_state;
+		__assign_str(stage_str, stage);
+	),
+	TP_printk("%s: id:%u, sw_event:%d, idle_pc_supported:%s, rc_state:%d",
+		  __get_str(stage_str), __entry->drm_id, __entry->sw_event,
+		  __entry->idle_pc_supported ? "true" : "false",
+		  __entry->rc_state)
+);
+
+TRACE_EVENT(dpu_enc_frame_done_cb_not_busy,
+	TP_PROTO(uint32_t drm_id, u32 event, char *intf_mode, enum dpu_intf intf_idx,
+			enum dpu_wb wb_idx),
+	TP_ARGS(drm_id, event, intf_mode, intf_idx, wb_idx),
+	TP_STRUCT__entry(
+		__field(	uint32_t,	drm_id		)
+		__field(	u32,		event		)
+		__string(	intf_mode_str,	intf_mode	)
+		__field(	enum dpu_intf,	intf_idx	)
+		__field(	enum dpu_wb,	wb_idx		)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->event = event;
+		__assign_str(intf_mode_str, intf_mode);
+		__entry->intf_idx = intf_idx;
+		__entry->wb_idx = wb_idx;
+	),
+	TP_printk("id=%u, event=%u, intf_mode=%s intf=%d wb=%d", __entry->drm_id,
+			__entry->event, __get_str(intf_mode_str),
+			__entry->intf_idx, __entry->wb_idx)
+);
+
+TRACE_EVENT(dpu_enc_frame_done_cb,
+	TP_PROTO(uint32_t drm_id, unsigned int idx,
+		 unsigned long frame_busy_mask),
+	TP_ARGS(drm_id, idx, frame_busy_mask),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+		__field(	unsigned int,		idx		)
+		__field(	unsigned long,		frame_busy_mask	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->idx = idx;
+		__entry->frame_busy_mask = frame_busy_mask;
+	),
+	TP_printk("id=%u, idx=%u, frame_busy_mask=%lx", __entry->drm_id,
+		  __entry->idx, __entry->frame_busy_mask)
+);
+
+TRACE_EVENT(dpu_enc_trigger_flush,
+	TP_PROTO(uint32_t drm_id, char *intf_mode, enum dpu_intf intf_idx, enum dpu_wb wb_idx,
+		 int pending_kickoff_cnt, int ctl_idx, u32 extra_flush_bits,
+		 u32 pending_flush_ret),
+	TP_ARGS(drm_id, intf_mode, intf_idx, wb_idx, pending_kickoff_cnt, ctl_idx,
+		extra_flush_bits, pending_flush_ret),
+	TP_STRUCT__entry(
+		__field(	uint32_t,	drm_id			)
+		__string(	intf_mode_str,	intf_mode		)
+		__field(	enum dpu_intf,	intf_idx		)
+		__field(	enum dpu_wb,	wb_idx			)
+		__field(	int,		pending_kickoff_cnt	)
+		__field(	int,		ctl_idx			)
+		__field(	u32,		extra_flush_bits	)
+		__field(	u32,		pending_flush_ret	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__assign_str(intf_mode_str, intf_mode);
+		__entry->intf_idx = intf_idx;
+		__entry->wb_idx = wb_idx;
+		__entry->pending_kickoff_cnt = pending_kickoff_cnt;
+		__entry->ctl_idx = ctl_idx;
+		__entry->extra_flush_bits = extra_flush_bits;
+		__entry->pending_flush_ret = pending_flush_ret;
+	),
+	TP_printk("id=%u, intf_mode=%s, intf_idx=%d, wb_idx=%d, pending_kickoff_cnt=%d ctl_idx=%d "
+		  "extra_flush_bits=0x%x pending_flush_ret=0x%x",
+		  __entry->drm_id, __get_str(intf_mode_str), __entry->intf_idx, __entry->wb_idx,
+		  __entry->pending_kickoff_cnt, __entry->ctl_idx,
+		  __entry->extra_flush_bits, __entry->pending_flush_ret)
+);
+
+DECLARE_EVENT_CLASS(dpu_id_event_template,
+	TP_PROTO(uint32_t drm_id, u32 event),
+	TP_ARGS(drm_id, event),
+	TP_STRUCT__entry(
+		__field(	uint32_t,	drm_id	)
+		__field(	u32,		event	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->event = event;
+	),
+	TP_printk("id=%u, event=%u", __entry->drm_id, __entry->event)
+);
+DEFINE_EVENT(dpu_id_event_template, dpu_enc_frame_done_timeout,
+	TP_PROTO(uint32_t drm_id, u32 event),
+	TP_ARGS(drm_id, event)
+);
+DEFINE_EVENT(dpu_id_event_template, dpu_crtc_frame_event_cb,
+	TP_PROTO(uint32_t drm_id, u32 event),
+	TP_ARGS(drm_id, event)
+);
+DEFINE_EVENT(dpu_id_event_template, dpu_crtc_frame_event_done,
+	TP_PROTO(uint32_t drm_id, u32 event),
+	TP_ARGS(drm_id, event)
+);
+DEFINE_EVENT(dpu_id_event_template, dpu_crtc_frame_event_more_pending,
+	TP_PROTO(uint32_t drm_id, u32 event),
+	TP_ARGS(drm_id, event)
+);
+
+TRACE_EVENT(dpu_enc_wait_event_timeout,
+	TP_PROTO(uint32_t drm_id, unsigned int irq_reg, unsigned int irq_bit, int rc, s64 time,
+		 s64 expected_time, int atomic_cnt),
+	TP_ARGS(drm_id, irq_reg, irq_bit, rc, time, expected_time, atomic_cnt),
+	TP_STRUCT__entry(
+		__field(	uint32_t,	drm_id		)
+		__field(	unsigned int,	irq_reg		)
+		__field(	unsigned int,	irq_bit		)
+		__field(	int,		rc		)
+		__field(	s64,		time		)
+		__field(	s64,		expected_time	)
+		__field(	int,		atomic_cnt	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->irq_reg = irq_reg;
+		__entry->irq_bit = irq_bit;
+		__entry->rc = rc;
+		__entry->time = time;
+		__entry->expected_time = expected_time;
+		__entry->atomic_cnt = atomic_cnt;
+	),
+	TP_printk("id=%u, IRQ=[%d, %d], rc=%d, time=%lld, expected=%lld cnt=%d",
+		  __entry->drm_id, __entry->irq_reg, __entry->irq_bit, __entry->rc, __entry->time,
+		  __entry->expected_time, __entry->atomic_cnt)
+);
+
+TRACE_EVENT(dpu_enc_phys_cmd_irq_ctrl,
+	TP_PROTO(uint32_t drm_id, enum dpu_pingpong pp, bool enable,
+		 int refcnt),
+	TP_ARGS(drm_id, pp, enable, refcnt),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id	)
+		__field(	enum dpu_pingpong,	pp	)
+		__field(	bool,			enable	)
+		__field(	int,			refcnt	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->pp = pp;
+		__entry->enable = enable;
+		__entry->refcnt = refcnt;
+	),
+	TP_printk("id=%u, pp=%d, enable=%s, refcnt=%d", __entry->drm_id,
+		  __entry->pp, __entry->enable ? "true" : "false",
+		  __entry->refcnt)
+);
+
+TRACE_EVENT(dpu_enc_phys_cmd_pp_tx_done,
+	TP_PROTO(uint32_t drm_id, enum dpu_pingpong pp, int new_count,
+		 u32 event),
+	TP_ARGS(drm_id, pp, new_count, event),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+		__field(	enum dpu_pingpong,	pp		)
+		__field(	int,			new_count	)
+		__field(	u32,			event		)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->pp = pp;
+		__entry->new_count = new_count;
+		__entry->event = event;
+	),
+	TP_printk("id=%u, pp=%d, new_count=%d, event=%u", __entry->drm_id,
+		  __entry->pp, __entry->new_count, __entry->event)
+);
+
+TRACE_EVENT(dpu_enc_phys_cmd_pdone_timeout,
+	TP_PROTO(uint32_t drm_id, enum dpu_pingpong pp, int timeout_count,
+		 int kickoff_count, u32 event),
+	TP_ARGS(drm_id, pp, timeout_count, kickoff_count, event),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+		__field(	enum dpu_pingpong,	pp		)
+		__field(	int,			timeout_count	)
+		__field(	int,			kickoff_count	)
+		__field(	u32,			event		)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->pp = pp;
+		__entry->timeout_count = timeout_count;
+		__entry->kickoff_count = kickoff_count;
+		__entry->event = event;
+	),
+	TP_printk("id=%u, pp=%d, timeout_count=%d, kickoff_count=%d, event=%u",
+		  __entry->drm_id, __entry->pp, __entry->timeout_count,
+		  __entry->kickoff_count, __entry->event)
+);
+
+TRACE_EVENT(dpu_enc_phys_vid_post_kickoff,
+	TP_PROTO(uint32_t drm_id, enum dpu_intf intf_idx),
+	TP_ARGS(drm_id, intf_idx),
+	TP_STRUCT__entry(
+		__field(	uint32_t,	drm_id			)
+		__field(	enum dpu_intf,	intf_idx		)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->intf_idx = intf_idx;
+	),
+	TP_printk("id=%u, intf_idx=%d", __entry->drm_id, __entry->intf_idx)
+);
+
+TRACE_EVENT(dpu_enc_phys_vid_irq_ctrl,
+	TP_PROTO(uint32_t drm_id, enum dpu_intf intf_idx, bool enable,
+		 int refcnt),
+	TP_ARGS(drm_id, intf_idx, enable, refcnt),
+	TP_STRUCT__entry(
+		__field(	uint32_t,	drm_id		)
+		__field(	enum dpu_intf,	intf_idx	)
+		__field(	bool,		enable		)
+		__field(	int,		refcnt		)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->intf_idx = intf_idx;
+		__entry->enable = enable;
+		__entry->refcnt = refcnt;
+	),
+	TP_printk("id=%u, intf_idx=%d enable=%s refcnt=%d", __entry->drm_id,
+		  __entry->intf_idx, __entry->enable ? "true" : "false",
+		  __entry->drm_id)
+);
+
+TRACE_EVENT(dpu_crtc_setup_mixer,
+	TP_PROTO(uint32_t crtc_id, uint32_t plane_id,
+		 struct drm_plane_state *state, struct dpu_plane_state *pstate,
+		 uint32_t stage_idx, uint32_t pixel_format,
+		 uint64_t modifier),
+	TP_ARGS(crtc_id, plane_id, state, pstate, stage_idx,
+		pixel_format, modifier),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		crtc_id		)
+		__field(	uint32_t,		plane_id	)
+		__field(	uint32_t,		fb_id		)
+		__field_struct(	struct drm_rect,	src_rect	)
+		__field_struct(	struct drm_rect,	dst_rect	)
+		__field(	uint32_t,		stage_idx	)
+		__field(	enum dpu_stage,		stage		)
+		__field(	enum dpu_sspp,		sspp		)
+		__field(	uint32_t,		multirect_idx	)
+		__field(	uint32_t,		multirect_mode	)
+		__field(	uint32_t,		pixel_format	)
+		__field(	uint64_t,		modifier	)
+	),
+	TP_fast_assign(
+		__entry->crtc_id = crtc_id;
+		__entry->plane_id = plane_id;
+		__entry->fb_id = state ? state->fb->base.id : 0;
+		__entry->src_rect = drm_plane_state_src(state);
+		__entry->dst_rect = drm_plane_state_dest(state);
+		__entry->stage_idx = stage_idx;
+		__entry->stage = pstate->stage;
+		__entry->sspp = pstate->pipe.sspp->idx;
+		__entry->multirect_idx = pstate->pipe.multirect_index;
+		__entry->multirect_mode = pstate->pipe.multirect_mode;
+		__entry->pixel_format = pixel_format;
+		__entry->modifier = modifier;
+	),
+	TP_printk("crtc_id:%u plane_id:%u fb_id:%u src:" DRM_RECT_FP_FMT
+		  " dst:" DRM_RECT_FMT " stage_idx:%u stage:%d, sspp:%d "
+		  "multirect_index:%d multirect_mode:%u pix_format:%u "
+		  "modifier:%llu",
+		  __entry->crtc_id, __entry->plane_id, __entry->fb_id,
+		  DRM_RECT_FP_ARG(&__entry->src_rect),
+		  DRM_RECT_ARG(&__entry->dst_rect),
+		  __entry->stage_idx, __entry->stage, __entry->sspp,
+		  __entry->multirect_idx, __entry->multirect_mode,
+		  __entry->pixel_format, __entry->modifier)
+);
+
+TRACE_EVENT(dpu_crtc_setup_lm_bounds,
+	TP_PROTO(uint32_t drm_id, int mixer, struct drm_rect *bounds),
+	TP_ARGS(drm_id, mixer, bounds),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id	)
+		__field(	int,			mixer	)
+		__field_struct(	struct drm_rect,	bounds	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->mixer = mixer;
+		__entry->bounds = *bounds;
+	),
+	TP_printk("id:%u mixer:%d bounds:" DRM_RECT_FMT, __entry->drm_id,
+		  __entry->mixer, DRM_RECT_ARG(&__entry->bounds))
+);
+
+TRACE_EVENT(dpu_crtc_vblank_enable,
+	TP_PROTO(uint32_t drm_id, uint32_t enc_id, bool enable,
+		 struct dpu_crtc *crtc),
+	TP_ARGS(drm_id, enc_id, enable, crtc),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id	)
+		__field(	uint32_t,		enc_id	)
+		__field(	bool,			enable	)
+		__field(	bool,			enabled )
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->enc_id = enc_id;
+		__entry->enable = enable;
+		__entry->enabled = crtc->enabled;
+	),
+	TP_printk("id:%u encoder:%u enable:%s state{enabled:%s}",
+		  __entry->drm_id, __entry->enc_id,
+		  __entry->enable ? "true" : "false",
+		  __entry->enabled ? "true" : "false")
+);
+
+DECLARE_EVENT_CLASS(dpu_crtc_enable_template,
+	TP_PROTO(uint32_t drm_id, bool enable, struct dpu_crtc *crtc),
+	TP_ARGS(drm_id, enable, crtc),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id	)
+		__field(	bool,			enable	)
+		__field(	bool,			enabled )
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->enable = enable;
+		__entry->enabled = crtc->enabled;
+	),
+	TP_printk("id:%u enable:%s state{enabled:%s}",
+		  __entry->drm_id, __entry->enable ? "true" : "false",
+		  __entry->enabled ? "true" : "false")
+);
+DEFINE_EVENT(dpu_crtc_enable_template, dpu_crtc_enable,
+	TP_PROTO(uint32_t drm_id, bool enable, struct dpu_crtc *crtc),
+	TP_ARGS(drm_id, enable, crtc)
+);
+DEFINE_EVENT(dpu_crtc_enable_template, dpu_crtc_disable,
+	TP_PROTO(uint32_t drm_id, bool enable, struct dpu_crtc *crtc),
+	TP_ARGS(drm_id, enable, crtc)
+);
+DEFINE_EVENT(dpu_crtc_enable_template, dpu_crtc_vblank,
+	TP_PROTO(uint32_t drm_id, bool enable, struct dpu_crtc *crtc),
+	TP_ARGS(drm_id, enable, crtc)
+);
+
+TRACE_EVENT(dpu_crtc_disable_frame_pending,
+	TP_PROTO(uint32_t drm_id, int frame_pending),
+	TP_ARGS(drm_id, frame_pending),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+		__field(	int,			frame_pending	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->frame_pending = frame_pending;
+	),
+	TP_printk("id:%u frame_pending:%d", __entry->drm_id,
+		  __entry->frame_pending)
+);
+
+TRACE_EVENT(dpu_plane_set_scanout,
+	TP_PROTO(struct dpu_sw_pipe *pipe, struct dpu_hw_fmt_layout *layout),
+	TP_ARGS(pipe, layout),
+	TP_STRUCT__entry(
+		__field(	enum dpu_sspp,			index	)
+		__field_struct(	struct dpu_hw_fmt_layout,	layout	)
+		__field(	enum dpu_sspp_multirect_index,	multirect_index)
+	),
+	TP_fast_assign(
+		__entry->index = pipe->sspp->idx;
+		__entry->layout = *layout;
+		__entry->multirect_index = pipe->multirect_index;
+	),
+	TP_printk("index:%d layout:{%ux%u @ [%u/%u, %u/%u, %u/%u, %u/%u]} "
+		  "multirect_index:%d", __entry->index, __entry->layout.width,
+		  __entry->layout.height, __entry->layout.plane_addr[0],
+		  __entry->layout.plane_size[0],
+		  __entry->layout.plane_addr[1],
+		  __entry->layout.plane_size[1],
+		  __entry->layout.plane_addr[2],
+		  __entry->layout.plane_size[2],
+		  __entry->layout.plane_addr[3],
+		  __entry->layout.plane_size[3], __entry->multirect_index)
+);
+
+TRACE_EVENT(dpu_plane_disable,
+	TP_PROTO(uint32_t drm_id, bool is_virtual, uint32_t multirect_mode),
+	TP_ARGS(drm_id, is_virtual, multirect_mode),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		drm_id		)
+		__field(	bool,			is_virtual	)
+		__field(	uint32_t,		multirect_mode	)
+	),
+	TP_fast_assign(
+		__entry->drm_id = drm_id;
+		__entry->is_virtual = is_virtual;
+		__entry->multirect_mode = multirect_mode;
+	),
+	TP_printk("id:%u is_virtual:%s multirect_mode:%u", __entry->drm_id,
+		  __entry->is_virtual ? "true" : "false",
+		  __entry->multirect_mode)
+);
+
+DECLARE_EVENT_CLASS(dpu_rm_iter_template,
+	TP_PROTO(uint32_t id, uint32_t enc_id),
+	TP_ARGS(id, enc_id),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		id	)
+		__field(	uint32_t,		enc_id	)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->enc_id = enc_id;
+	),
+	TP_printk("id:%d enc_id:%u", __entry->id, __entry->enc_id)
+);
+DEFINE_EVENT(dpu_rm_iter_template, dpu_rm_reserve_intf,
+	TP_PROTO(uint32_t id, uint32_t enc_id),
+	TP_ARGS(id, enc_id)
+);
+DEFINE_EVENT(dpu_rm_iter_template, dpu_rm_reserve_ctls,
+	TP_PROTO(uint32_t id, uint32_t enc_id),
+	TP_ARGS(id, enc_id)
+);
+
+TRACE_EVENT(dpu_rm_reserve_lms,
+	TP_PROTO(uint32_t id, uint32_t enc_id, uint32_t pp_id),
+	TP_ARGS(id, enc_id, pp_id),
+	TP_STRUCT__entry(
+		__field(	uint32_t,		id	)
+		__field(	uint32_t,		enc_id	)
+		__field(	uint32_t,		pp_id	)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->enc_id = enc_id;
+		__entry->pp_id = pp_id;
+	),
+	TP_printk("id:%d enc_id:%u pp_id:%u", __entry->id,
+		  __entry->enc_id, __entry->pp_id)
+);
+
+TRACE_EVENT(dpu_vbif_wait_xin_halt_fail,
+	TP_PROTO(enum dpu_vbif index, u32 xin_id),
+	TP_ARGS(index, xin_id),
+	TP_STRUCT__entry(
+		__field(	enum dpu_vbif,	index	)
+		__field(	u32,		xin_id	)
+	),
+	TP_fast_assign(
+		__entry->index = index;
+		__entry->xin_id = xin_id;
+	),
+	TP_printk("index:%d xin_id:%u", __entry->index, __entry->xin_id)
+);
+
+TRACE_EVENT(dpu_pp_connect_ext_te,
+	TP_PROTO(enum dpu_pingpong pp, u32 cfg),
+	TP_ARGS(pp, cfg),
+	TP_STRUCT__entry(
+		__field(	enum dpu_pingpong,	pp	)
+		__field(	u32,			cfg	)
+	),
+	TP_fast_assign(
+		__entry->pp = pp;
+		__entry->cfg = cfg;
+	),
+	TP_printk("pp:%d cfg:%u", __entry->pp, __entry->cfg)
+);
+
+TRACE_EVENT(dpu_intf_connect_ext_te,
+	TP_PROTO(enum dpu_intf intf, u32 cfg),
+	TP_ARGS(intf, cfg),
+	TP_STRUCT__entry(
+		__field(	enum dpu_intf,	intf	)
+		__field(	u32,			cfg	)
+	),
+	TP_fast_assign(
+		__entry->intf = intf;
+		__entry->cfg = cfg;
+	),
+	TP_printk("intf:%d cfg:%u", __entry->intf, __entry->cfg)
+);
+
+TRACE_EVENT(dpu_core_irq_register_callback,
+	TP_PROTO(unsigned int irq_reg, unsigned int irq_bit, void *callback),
+	TP_ARGS(irq_reg, irq_bit, callback),
+	TP_STRUCT__entry(
+		__field(	unsigned int,			irq_reg	)
+		__field(	unsigned int,			irq_bit	)
+		__field(	void *,				callback)
+	),
+	TP_fast_assign(
+		__entry->irq_reg = irq_reg;
+		__entry->irq_bit = irq_bit;
+		__entry->callback = callback;
+	),
+	TP_printk("IRQ=[%d, %d] callback:%ps", __entry->irq_reg, __entry->irq_bit,
+		  __entry->callback)
+);
+
+TRACE_EVENT(dpu_core_irq_unregister_callback,
+	TP_PROTO(unsigned int irq_reg, unsigned int irq_bit),
+	TP_ARGS(irq_reg, irq_bit),
+	TP_STRUCT__entry(
+		__field(	unsigned int,			irq_reg	)
+		__field(	unsigned int,			irq_bit	)
+	),
+	TP_fast_assign(
+		__entry->irq_reg = irq_reg;
+		__entry->irq_bit = irq_bit;
+	),
+	TP_printk("IRQ=[%d, %d]", __entry->irq_reg, __entry->irq_bit)
+);
+
+TRACE_EVENT(dpu_core_perf_update_clk,
+	TP_PROTO(struct drm_device *dev, bool stop_req, u64 clk_rate),
+	TP_ARGS(dev, stop_req, clk_rate),
+	TP_STRUCT__entry(
+		__string(	dev_name,		dev->unique	)
+		__field(	bool,			stop_req	)
+		__field(	u64,			clk_rate	)
+	),
+	TP_fast_assign(
+		__assign_str(dev_name, dev->unique);
+		__entry->stop_req = stop_req;
+		__entry->clk_rate = clk_rate;
+	),
+	TP_printk("dev:%s stop_req:%s clk_rate:%llu", __get_str(dev_name),
+		  __entry->stop_req ? "true" : "false", __entry->clk_rate)
+);
+
+TRACE_EVENT(dpu_hw_ctl_update_pending_flush,
+	TP_PROTO(u32 new_bits, u32 pending_mask),
+	TP_ARGS(new_bits, pending_mask),
+	TP_STRUCT__entry(
+		__field(	u32,			new_bits	)
+		__field(	u32,			pending_mask	)
+	),
+	TP_fast_assign(
+		__entry->new_bits = new_bits;
+		__entry->pending_mask = pending_mask;
+	),
+	TP_printk("new=%x existing=%x", __entry->new_bits,
+		  __entry->pending_mask)
+);
+
+DECLARE_EVENT_CLASS(dpu_hw_ctl_pending_flush_template,
+	TP_PROTO(u32 pending_mask, u32 ctl_flush),
+	TP_ARGS(pending_mask, ctl_flush),
+	TP_STRUCT__entry(
+		__field(	u32,			pending_mask	)
+		__field(	u32,			ctl_flush	)
+	),
+	TP_fast_assign(
+		__entry->pending_mask = pending_mask;
+		__entry->ctl_flush = ctl_flush;
+	),
+	TP_printk("pending_mask=%x CTL_FLUSH=%x", __entry->pending_mask,
+		  __entry->ctl_flush)
+);
+DEFINE_EVENT(dpu_hw_ctl_pending_flush_template, dpu_hw_ctl_clear_pending_flush,
+	TP_PROTO(u32 pending_mask, u32 ctl_flush),
+	TP_ARGS(pending_mask, ctl_flush)
+);
+DEFINE_EVENT(dpu_hw_ctl_pending_flush_template,
+	     dpu_hw_ctl_trigger_pending_flush,
+	TP_PROTO(u32 pending_mask, u32 ctl_flush),
+	TP_ARGS(pending_mask, ctl_flush)
+);
+DEFINE_EVENT(dpu_hw_ctl_pending_flush_template, dpu_hw_ctl_trigger_prepare,
+	TP_PROTO(u32 pending_mask, u32 ctl_flush),
+	TP_ARGS(pending_mask, ctl_flush)
+);
+DEFINE_EVENT(dpu_hw_ctl_pending_flush_template, dpu_hw_ctl_trigger_start,
+	TP_PROTO(u32 pending_mask, u32 ctl_flush),
+	TP_ARGS(pending_mask, ctl_flush)
+);
+
+#define DPU_ATRACE_END(name) trace_tracing_mark_write(current->tgid, name, 0)
+#define DPU_ATRACE_BEGIN(name) trace_tracing_mark_write(current->tgid, name, 1)
+#define DPU_ATRACE_FUNC() DPU_ATRACE_BEGIN(__func__)
+
+#define DPU_ATRACE_INT(name, value) \
+	trace_dpu_trace_counter(current->tgid, name, value)
+
+#endif /* _DPU_TRACE_H_ */
+
+/* This part must be outside protection */
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_vbif.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_vbif.c
@@ -0,0 +1,338 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+
+#include <linux/debugfs.h>
+#include <linux/delay.h>
+
+#include "dpu_vbif.h"
+#include "dpu_hw_vbif.h"
+#include "dpu_trace.h"
+
+static struct dpu_hw_vbif *dpu_get_vbif(struct dpu_kms *dpu_kms, enum dpu_vbif vbif_idx)
+{
+	if (vbif_idx < ARRAY_SIZE(dpu_kms->hw_vbif))
+		return dpu_kms->hw_vbif[vbif_idx];
+
+	return NULL;
+}
+
+static const char *dpu_vbif_name(enum dpu_vbif idx)
+{
+	switch (idx) {
+	case VBIF_RT:
+		return "VBIF_RT";
+	case VBIF_NRT:
+		return "VBIF_NRT";
+	default:
+		return "??";
+	}
+}
+
+/**
+ * _dpu_vbif_wait_for_xin_halt - wait for the xin to halt
+ * @vbif:	Pointer to hardware vbif driver
+ * @xin_id:	Client interface identifier
+ * @return:	0 if success; error code otherwise
+ */
+static int _dpu_vbif_wait_for_xin_halt(struct dpu_hw_vbif *vbif, u32 xin_id)
+{
+	ktime_t timeout;
+	bool status;
+	int rc;
+
+	if (!vbif || !vbif->cap || !vbif->ops.get_halt_ctrl) {
+		DPU_ERROR("invalid arguments vbif %d\n", vbif != NULL);
+		return -EINVAL;
+	}
+
+	timeout = ktime_add_us(ktime_get(), vbif->cap->xin_halt_timeout);
+	for (;;) {
+		status = vbif->ops.get_halt_ctrl(vbif, xin_id);
+		if (status)
+			break;
+		if (ktime_compare_safe(ktime_get(), timeout) > 0) {
+			status = vbif->ops.get_halt_ctrl(vbif, xin_id);
+			break;
+		}
+		usleep_range(501, 1000);
+	}
+
+	if (!status) {
+		rc = -ETIMEDOUT;
+		DPU_ERROR("%s client %d not halting. TIMEDOUT.\n",
+				dpu_vbif_name(vbif->idx), xin_id);
+	} else {
+		rc = 0;
+		DRM_DEBUG_ATOMIC("%s client %d is halted\n",
+				dpu_vbif_name(vbif->idx), xin_id);
+	}
+
+	return rc;
+}
+
+/**
+ * _dpu_vbif_apply_dynamic_ot_limit - determine OT based on usecase parameters
+ * @vbif:	Pointer to hardware vbif driver
+ * @ot_lim:	Pointer to OT limit to be modified
+ * @params:	Pointer to usecase parameters
+ */
+static void _dpu_vbif_apply_dynamic_ot_limit(struct dpu_hw_vbif *vbif,
+		u32 *ot_lim, struct dpu_vbif_set_ot_params *params)
+{
+	u64 pps;
+	const struct dpu_vbif_dynamic_ot_tbl *tbl;
+	u32 i;
+
+	if (!vbif || !(vbif->cap->features & BIT(DPU_VBIF_QOS_OTLIM)))
+		return;
+
+	/* Dynamic OT setting done only for WFD */
+	if (!params->is_wfd)
+		return;
+
+	pps = params->frame_rate;
+	pps *= params->width;
+	pps *= params->height;
+
+	tbl = params->rd ? &vbif->cap->dynamic_ot_rd_tbl :
+			&vbif->cap->dynamic_ot_wr_tbl;
+
+	for (i = 0; i < tbl->count; i++) {
+		if (pps <= tbl->cfg[i].pps) {
+			*ot_lim = tbl->cfg[i].ot_limit;
+			break;
+		}
+	}
+
+	DRM_DEBUG_ATOMIC("%s xin:%d w:%d h:%d fps:%d pps:%llu ot:%u\n",
+			dpu_vbif_name(vbif->idx), params->xin_id,
+			params->width, params->height, params->frame_rate,
+			pps, *ot_lim);
+}
+
+/**
+ * _dpu_vbif_get_ot_limit - get OT based on usecase & configuration parameters
+ * @vbif:	Pointer to hardware vbif driver
+ * @params:	Pointer to usecase parameters
+ * @return:	OT limit
+ */
+static u32 _dpu_vbif_get_ot_limit(struct dpu_hw_vbif *vbif,
+	struct dpu_vbif_set_ot_params *params)
+{
+	u32 ot_lim = 0;
+	u32 val;
+
+	if (!vbif || !vbif->cap) {
+		DPU_ERROR("invalid arguments vbif %d\n", vbif != NULL);
+		return -EINVAL;
+	}
+
+	if (vbif->cap->default_ot_wr_limit && !params->rd)
+		ot_lim = vbif->cap->default_ot_wr_limit;
+	else if (vbif->cap->default_ot_rd_limit && params->rd)
+		ot_lim = vbif->cap->default_ot_rd_limit;
+
+	/*
+	 * If default ot is not set from dt/catalog,
+	 * then do not configure it.
+	 */
+	if (ot_lim == 0)
+		goto exit;
+
+	/* Modify the limits if the target and the use case requires it */
+	_dpu_vbif_apply_dynamic_ot_limit(vbif, &ot_lim, params);
+
+	if (vbif && vbif->ops.get_limit_conf) {
+		val = vbif->ops.get_limit_conf(vbif,
+				params->xin_id, params->rd);
+		if (val == ot_lim)
+			ot_lim = 0;
+	}
+
+exit:
+	DRM_DEBUG_ATOMIC("%s xin:%d ot_lim:%d\n",
+			dpu_vbif_name(vbif->idx), params->xin_id, ot_lim);
+	return ot_lim;
+}
+
+/**
+ * dpu_vbif_set_ot_limit - set OT based on usecase & configuration parameters
+ * @dpu_kms:	DPU handler
+ * @params:	Pointer to usecase parameters
+ *
+ * Note this function would block waiting for bus halt.
+ */
+void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms,
+		struct dpu_vbif_set_ot_params *params)
+{
+	struct dpu_hw_vbif *vbif;
+	u32 ot_lim;
+	int ret;
+
+	vbif = dpu_get_vbif(dpu_kms, params->vbif_idx);
+	if (!vbif) {
+		DRM_DEBUG_ATOMIC("invalid arguments vbif %d\n", vbif != NULL);
+		return;
+	}
+
+	if (!vbif->ops.set_limit_conf || !vbif->ops.set_halt_ctrl)
+		return;
+
+	/* set write_gather_en for all write clients */
+	if (vbif->ops.set_write_gather_en && !params->rd)
+		vbif->ops.set_write_gather_en(vbif, params->xin_id);
+
+	ot_lim = _dpu_vbif_get_ot_limit(vbif, params) & 0xFF;
+
+	if (ot_lim == 0)
+		return;
+
+	trace_dpu_perf_set_ot(params->num, params->xin_id, ot_lim,
+		params->vbif_idx);
+
+	vbif->ops.set_limit_conf(vbif, params->xin_id, params->rd, ot_lim);
+
+	vbif->ops.set_halt_ctrl(vbif, params->xin_id, true);
+
+	ret = _dpu_vbif_wait_for_xin_halt(vbif, params->xin_id);
+	if (ret)
+		trace_dpu_vbif_wait_xin_halt_fail(vbif->idx, params->xin_id);
+
+	vbif->ops.set_halt_ctrl(vbif, params->xin_id, false);
+}
+
+void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms,
+		struct dpu_vbif_set_qos_params *params)
+{
+	struct dpu_hw_vbif *vbif;
+	const struct dpu_vbif_qos_tbl *qos_tbl;
+	int i;
+
+	if (!params) {
+		DPU_ERROR("invalid arguments\n");
+		return;
+	}
+
+	vbif = dpu_get_vbif(dpu_kms, params->vbif_idx);
+
+	if (!vbif || !vbif->cap) {
+		DPU_ERROR("invalid vbif %d\n", params->vbif_idx);
+		return;
+	}
+
+	if (!vbif->ops.set_qos_remap) {
+		DRM_DEBUG_ATOMIC("qos remap not supported\n");
+		return;
+	}
+
+	qos_tbl = params->is_rt ? &vbif->cap->qos_rt_tbl :
+			&vbif->cap->qos_nrt_tbl;
+
+	if (!qos_tbl->npriority_lvl || !qos_tbl->priority_lvl) {
+		DRM_DEBUG_ATOMIC("qos tbl not defined\n");
+		return;
+	}
+
+	for (i = 0; i < qos_tbl->npriority_lvl; i++) {
+		DRM_DEBUG_ATOMIC("%s xin:%d lvl:%d/%d\n",
+				dpu_vbif_name(params->vbif_idx), params->xin_id, i,
+				qos_tbl->priority_lvl[i]);
+		vbif->ops.set_qos_remap(vbif, params->xin_id, i,
+				qos_tbl->priority_lvl[i]);
+	}
+}
+
+void dpu_vbif_clear_errors(struct dpu_kms *dpu_kms)
+{
+	struct dpu_hw_vbif *vbif;
+	u32 i, pnd, src;
+
+	for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) {
+		vbif = dpu_kms->hw_vbif[i];
+		if (vbif && vbif->ops.clear_errors) {
+			vbif->ops.clear_errors(vbif, &pnd, &src);
+			if (pnd || src) {
+				DRM_DEBUG_KMS("%s: pnd 0x%X, src 0x%X\n",
+					      dpu_vbif_name(vbif->idx), pnd, src);
+			}
+		}
+	}
+}
+
+void dpu_vbif_init_memtypes(struct dpu_kms *dpu_kms)
+{
+	struct dpu_hw_vbif *vbif;
+	int i, j;
+
+	for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) {
+		vbif = dpu_kms->hw_vbif[i];
+		if (vbif && vbif->cap && vbif->ops.set_mem_type) {
+			for (j = 0; j < vbif->cap->memtype_count; j++)
+				vbif->ops.set_mem_type(
+						vbif, j, vbif->cap->memtype[j]);
+		}
+	}
+}
+
+#ifdef CONFIG_DEBUG_FS
+
+void dpu_debugfs_vbif_init(struct dpu_kms *dpu_kms, struct dentry *debugfs_root)
+{
+	char vbif_name[32];
+	struct dentry *entry, *debugfs_vbif;
+	int i, j;
+
+	entry = debugfs_create_dir("vbif", debugfs_root);
+
+	for (i = 0; i < dpu_kms->catalog->vbif_count; i++) {
+		const struct dpu_vbif_cfg *vbif = &dpu_kms->catalog->vbif[i];
+
+		snprintf(vbif_name, sizeof(vbif_name), "%d", vbif->id);
+
+		debugfs_vbif = debugfs_create_dir(vbif_name, entry);
+
+		debugfs_create_u32("features", 0600, debugfs_vbif,
+			(u32 *)&vbif->features);
+
+		debugfs_create_u32("xin_halt_timeout", 0400, debugfs_vbif,
+			(u32 *)&vbif->xin_halt_timeout);
+
+		debugfs_create_u32("default_rd_ot_limit", 0400, debugfs_vbif,
+			(u32 *)&vbif->default_ot_rd_limit);
+
+		debugfs_create_u32("default_wr_ot_limit", 0400, debugfs_vbif,
+			(u32 *)&vbif->default_ot_wr_limit);
+
+		for (j = 0; j < vbif->dynamic_ot_rd_tbl.count; j++) {
+			const struct dpu_vbif_dynamic_ot_cfg *cfg =
+					&vbif->dynamic_ot_rd_tbl.cfg[j];
+
+			snprintf(vbif_name, sizeof(vbif_name),
+					"dynamic_ot_rd_%d_pps", j);
+			debugfs_create_u64(vbif_name, 0400, debugfs_vbif,
+					(u64 *)&cfg->pps);
+			snprintf(vbif_name, sizeof(vbif_name),
+					"dynamic_ot_rd_%d_ot_limit", j);
+			debugfs_create_u32(vbif_name, 0400, debugfs_vbif,
+					(u32 *)&cfg->ot_limit);
+		}
+
+		for (j = 0; j < vbif->dynamic_ot_wr_tbl.count; j++) {
+			const struct dpu_vbif_dynamic_ot_cfg *cfg =
+					&vbif->dynamic_ot_wr_tbl.cfg[j];
+
+			snprintf(vbif_name, sizeof(vbif_name),
+					"dynamic_ot_wr_%d_pps", j);
+			debugfs_create_u64(vbif_name, 0400, debugfs_vbif,
+					(u64 *)&cfg->pps);
+			snprintf(vbif_name, sizeof(vbif_name),
+					"dynamic_ot_wr_%d_ot_limit", j);
+			debugfs_create_u32(vbif_name, 0400, debugfs_vbif,
+					(u32 *)&cfg->ot_limit);
+		}
+	}
+}
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_vbif.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_vbif.h
@@ -0,0 +1,71 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __DPU_VBIF_H__
+#define __DPU_VBIF_H__
+
+#include "dpu_kms.h"
+
+struct dpu_vbif_set_ot_params {
+	u32 xin_id;
+	u32 num;
+	u32 width;
+	u32 height;
+	u32 frame_rate;
+	bool rd;
+	bool is_wfd;
+	u32 vbif_idx;
+};
+
+struct dpu_vbif_set_memtype_params {
+	u32 xin_id;
+	u32 vbif_idx;
+	bool is_cacheable;
+};
+
+/**
+ * struct dpu_vbif_set_qos_params - QoS remapper parameter
+ * @vbif_idx: vbif identifier
+ * @xin_id: client interface identifier
+ * @num: pipe identifier (debug only)
+ * @is_rt: true if pipe is used in real-time use case
+ */
+struct dpu_vbif_set_qos_params {
+	u32 vbif_idx;
+	u32 xin_id;
+	u32 num;
+	bool is_rt;
+};
+
+/**
+ * dpu_vbif_set_ot_limit - set OT limit for vbif client
+ * @dpu_kms:	DPU handler
+ * @params:	Pointer to OT configuration parameters
+ */
+void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms,
+		struct dpu_vbif_set_ot_params *params);
+
+/**
+ * dpu_vbif_set_qos_remap - set QoS priority level remap
+ * @dpu_kms:	DPU handler
+ * @params:	Pointer to QoS configuration parameters
+ */
+void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms,
+		struct dpu_vbif_set_qos_params *params);
+
+/**
+ * dpu_vbif_clear_errors - clear any vbif errors
+ * @dpu_kms:	DPU handler
+ */
+void dpu_vbif_clear_errors(struct dpu_kms *dpu_kms);
+
+/**
+ * dpu_vbif_init_memtypes - initialize xin memory types for vbif
+ * @dpu_kms:	DPU handler
+ */
+void dpu_vbif_init_memtypes(struct dpu_kms *dpu_kms);
+
+void dpu_debugfs_vbif_init(struct dpu_kms *dpu_kms, struct dentry *debugfs_root);
+
+#endif /* __DPU_VBIF_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_writeback.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_writeback.c
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <drm/drm_edid.h>
+#include <drm/drm_framebuffer.h>
+
+#include "dpu_writeback.h"
+
+static int dpu_wb_conn_get_modes(struct drm_connector *connector)
+{
+	struct drm_device *dev = connector->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms);
+
+	/*
+	 * We should ideally be limiting the modes only to the maxlinewidth but
+	 * on some chipsets this will allow even 4k modes to be added which will
+	 * fail the per SSPP bandwidth checks. So, till we have dual-SSPP support
+	 * and source split support added lets limit the modes based on max_mixer_width
+	 * as 4K modes can then be supported.
+	 */
+	return drm_add_modes_noedid(connector, dpu_kms->catalog->caps->max_mixer_width,
+			dev->mode_config.max_height);
+}
+
+static int dpu_wb_conn_atomic_check(struct drm_connector *connector,
+				    struct drm_atomic_state *state)
+{
+	struct drm_writeback_connector *wb_conn = drm_connector_to_writeback(connector);
+	struct dpu_wb_connector *dpu_wb_conn = to_dpu_wb_conn(wb_conn);
+	struct drm_connector_state *conn_state =
+		drm_atomic_get_new_connector_state(state, connector);
+	struct drm_crtc *crtc;
+	struct drm_crtc_state *crtc_state;
+	const struct drm_display_mode *mode;
+	struct drm_framebuffer *fb;
+
+	DPU_DEBUG("[atomic_check:%d]\n", connector->base.id);
+
+	if (!conn_state || !conn_state->connector) {
+		DPU_ERROR("invalid connector state\n");
+		return -EINVAL;
+	} else if (conn_state->connector->status != connector_status_connected) {
+		DPU_ERROR("connector not connected %d\n", conn_state->connector->status);
+		return -EINVAL;
+	}
+
+	crtc = conn_state->crtc;
+	if (!crtc)
+		return 0;
+
+	if (!conn_state->writeback_job || !conn_state->writeback_job->fb)
+		return 0;
+
+	crtc_state = drm_atomic_get_crtc_state(state, crtc);
+	if (IS_ERR(crtc_state))
+		return PTR_ERR(crtc_state);
+
+	mode = &crtc_state->mode;
+
+	fb = conn_state->writeback_job->fb;
+
+	DPU_DEBUG("[fb_id:%u][fb:%u,%u][mode:\"%s\":%ux%u]\n", fb->base.id, fb->width, fb->height,
+		  mode->name, mode->hdisplay, mode->vdisplay);
+
+	if (fb->width != mode->hdisplay) {
+		DPU_ERROR("invalid fb w=%d, mode w=%d\n", fb->width, mode->hdisplay);
+		return -EINVAL;
+	} else if (fb->height != mode->vdisplay) {
+		DPU_ERROR("invalid fb h=%d, mode h=%d\n", fb->height, mode->vdisplay);
+		return -EINVAL;
+	} else if (fb->width > dpu_wb_conn->maxlinewidth) {
+		DPU_ERROR("invalid fb w=%d, maxlinewidth=%u\n",
+			  fb->width, dpu_wb_conn->maxlinewidth);
+		return -EINVAL;
+	}
+
+	return drm_atomic_helper_check_wb_connector_state(conn_state->connector, conn_state->state);
+}
+
+static const struct drm_connector_funcs dpu_wb_conn_funcs = {
+	.reset = drm_atomic_helper_connector_reset,
+	.fill_modes = drm_helper_probe_single_connector_modes,
+	.destroy = drm_connector_cleanup,
+	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+};
+
+static int dpu_wb_conn_prepare_job(struct drm_writeback_connector *connector,
+		struct drm_writeback_job *job)
+{
+
+	struct dpu_wb_connector *dpu_wb_conn = to_dpu_wb_conn(connector);
+
+	if (!job->fb)
+		return 0;
+
+	dpu_encoder_prepare_wb_job(dpu_wb_conn->wb_enc, job);
+
+	return 0;
+}
+
+static void dpu_wb_conn_cleanup_job(struct drm_writeback_connector *connector,
+		struct drm_writeback_job *job)
+{
+	struct dpu_wb_connector *dpu_wb_conn = to_dpu_wb_conn(connector);
+
+	if (!job->fb)
+		return;
+
+	dpu_encoder_cleanup_wb_job(dpu_wb_conn->wb_enc, job);
+}
+
+static const struct drm_connector_helper_funcs dpu_wb_conn_helper_funcs = {
+	.get_modes = dpu_wb_conn_get_modes,
+	.atomic_check = dpu_wb_conn_atomic_check,
+	.prepare_writeback_job = dpu_wb_conn_prepare_job,
+	.cleanup_writeback_job = dpu_wb_conn_cleanup_job,
+};
+
+int dpu_writeback_init(struct drm_device *dev, struct drm_encoder *enc,
+		const u32 *format_list, u32 num_formats, u32 maxlinewidth)
+{
+	struct dpu_wb_connector *dpu_wb_conn;
+	int rc = 0;
+
+	dpu_wb_conn = devm_kzalloc(dev->dev, sizeof(*dpu_wb_conn), GFP_KERNEL);
+	if (!dpu_wb_conn)
+		return -ENOMEM;
+
+	dpu_wb_conn->maxlinewidth = maxlinewidth;
+
+	drm_connector_helper_add(&dpu_wb_conn->base.base, &dpu_wb_conn_helper_funcs);
+
+	/* DPU initializes the encoder and sets it up completely for writeback
+	 * cases and hence should use the new API drm_writeback_connector_init_with_encoder
+	 * to initialize the writeback connector
+	 */
+	rc = drm_writeback_connector_init_with_encoder(dev, &dpu_wb_conn->base, enc,
+			&dpu_wb_conn_funcs, format_list, num_formats);
+
+	if (!rc)
+		dpu_wb_conn->wb_enc = enc;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/dpu_writeback.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/dpu_writeback.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DPU_WRITEBACK_H
+#define _DPU_WRITEBACK_H
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_file.h>
+#include <drm/drm_probe_helper.h>
+#include <drm/drm_writeback.h>
+
+#include "msm_drv.h"
+#include "dpu_kms.h"
+#include "dpu_encoder_phys.h"
+
+struct dpu_wb_connector {
+	struct drm_writeback_connector base;
+	struct drm_encoder *wb_enc;
+	u32 maxlinewidth;
+};
+
+static inline struct dpu_wb_connector *to_dpu_wb_conn(struct drm_writeback_connector *conn)
+{
+	return container_of(conn, struct dpu_wb_connector, base);
+}
+
+int dpu_writeback_init(struct drm_device *dev, struct drm_encoder *enc,
+		const u32 *format_list, u32 num_formats, u32 maxlinewidth);
+
+#endif /*_DPU_WRITEBACK_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/dpu1/msm_media_info.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/dpu1/msm_media_info.h
@@ -0,0 +1,1155 @@
+#ifndef __MEDIA_INFO_H__
+#define __MEDIA_INFO_H__
+
+#ifndef MSM_MEDIA_ALIGN
+#define MSM_MEDIA_ALIGN(__sz, __align) (((__align) & ((__align) - 1)) ?\
+	((((__sz) + (__align) - 1) / (__align)) * (__align)) :\
+	(((__sz) + (__align) - 1) & (~((__align) - 1))))
+#endif
+
+#ifndef MSM_MEDIA_ROUNDUP
+#define MSM_MEDIA_ROUNDUP(__sz, __r) (((__sz) + ((__r) - 1)) / (__r))
+#endif
+
+#ifndef MSM_MEDIA_MAX
+#define MSM_MEDIA_MAX(__a, __b) ((__a) > (__b)?(__a):(__b))
+#endif
+
+enum color_fmts {
+	/* Venus NV12:
+	 * YUV 4:2:0 image with a plane of 8 bit Y samples followed
+	 * by an interleaved U/V plane containing 8 bit 2x2 subsampled
+	 * colour difference samples.
+	 *
+	 * <-------- Y/UV_Stride -------->
+	 * <------- Width ------->
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  ^           ^
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  Height      |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |          Y_Scanlines
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              V
+	 * U V U V U V U V U V U V . . . .  ^
+	 * U V U V U V U V U V U V . . . .  |
+	 * U V U V U V U V U V U V . . . .  |
+	 * U V U V U V U V U V U V . . . .  UV_Scanlines
+	 * . . . . . . . . . . . . . . . .  |
+	 * . . . . . . . . . . . . . . . .  V
+	 * . . . . . . . . . . . . . . . .  --> Buffer size alignment
+	 *
+	 * Y_Stride : Width aligned to 128
+	 * UV_Stride : Width aligned to 128
+	 * Y_Scanlines: Height aligned to 32
+	 * UV_Scanlines: Height/2 aligned to 16
+	 * Extradata: Arbitrary (software-imposed) padding
+	 * Total size = align((Y_Stride * Y_Scanlines
+	 *          + UV_Stride * UV_Scanlines
+	 *          + max(Extradata, Y_Stride * 8), 4096)
+	 */
+	COLOR_FMT_NV12,
+
+	/* Venus NV21:
+	 * YUV 4:2:0 image with a plane of 8 bit Y samples followed
+	 * by an interleaved V/U plane containing 8 bit 2x2 subsampled
+	 * colour difference samples.
+	 *
+	 * <-------- Y/UV_Stride -------->
+	 * <------- Width ------->
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  ^           ^
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  Height      |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |          Y_Scanlines
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              V
+	 * V U V U V U V U V U V U . . . .  ^
+	 * V U V U V U V U V U V U . . . .  |
+	 * V U V U V U V U V U V U . . . .  |
+	 * V U V U V U V U V U V U . . . .  UV_Scanlines
+	 * . . . . . . . . . . . . . . . .  |
+	 * . . . . . . . . . . . . . . . .  V
+	 * . . . . . . . . . . . . . . . .  --> Padding & Buffer size alignment
+	 *
+	 * Y_Stride : Width aligned to 128
+	 * UV_Stride : Width aligned to 128
+	 * Y_Scanlines: Height aligned to 32
+	 * UV_Scanlines: Height/2 aligned to 16
+	 * Extradata: Arbitrary (software-imposed) padding
+	 * Total size = align((Y_Stride * Y_Scanlines
+	 *          + UV_Stride * UV_Scanlines
+	 *          + max(Extradata, Y_Stride * 8), 4096)
+	 */
+	COLOR_FMT_NV21,
+	/* Venus NV12_MVTB:
+	 * Two YUV 4:2:0 images/views one after the other
+	 * in a top-bottom layout, same as NV12
+	 * with a plane of 8 bit Y samples followed
+	 * by an interleaved U/V plane containing 8 bit 2x2 subsampled
+	 * colour difference samples.
+	 *
+	 *
+	 * <-------- Y/UV_Stride -------->
+	 * <------- Width ------->
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  ^           ^               ^
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  Height      |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |          Y_Scanlines      |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  V           |               |
+	 * . . . . . . . . . . . . . . . .              |             View_1
+	 * . . . . . . . . . . . . . . . .              |               |
+	 * . . . . . . . . . . . . . . . .              |               |
+	 * . . . . . . . . . . . . . . . .              V               |
+	 * U V U V U V U V U V U V . . . .  ^                           |
+	 * U V U V U V U V U V U V . . . .  |                           |
+	 * U V U V U V U V U V U V . . . .  |                           |
+	 * U V U V U V U V U V U V . . . .  UV_Scanlines                |
+	 * . . . . . . . . . . . . . . . .  |                           |
+	 * . . . . . . . . . . . . . . . .  V                           V
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  ^           ^               ^
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  Height      |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |          Y_Scanlines      |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |               |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  V           |               |
+	 * . . . . . . . . . . . . . . . .              |             View_2
+	 * . . . . . . . . . . . . . . . .              |               |
+	 * . . . . . . . . . . . . . . . .              |               |
+	 * . . . . . . . . . . . . . . . .              V               |
+	 * U V U V U V U V U V U V . . . .  ^                           |
+	 * U V U V U V U V U V U V . . . .  |                           |
+	 * U V U V U V U V U V U V . . . .  |                           |
+	 * U V U V U V U V U V U V . . . .  UV_Scanlines                |
+	 * . . . . . . . . . . . . . . . .  |                           |
+	 * . . . . . . . . . . . . . . . .  V                           V
+	 * . . . . . . . . . . . . . . . .  --> Buffer size alignment
+	 *
+	 * Y_Stride : Width aligned to 128
+	 * UV_Stride : Width aligned to 128
+	 * Y_Scanlines: Height aligned to 32
+	 * UV_Scanlines: Height/2 aligned to 16
+	 * View_1 begin at: 0 (zero)
+	 * View_2 begin at: Y_Stride * Y_Scanlines + UV_Stride * UV_Scanlines
+	 * Extradata: Arbitrary (software-imposed) padding
+	 * Total size = align((2*(Y_Stride * Y_Scanlines)
+	 *          + 2*(UV_Stride * UV_Scanlines) + Extradata), 4096)
+	 */
+	COLOR_FMT_NV12_MVTB,
+	/*
+	 * The buffer can be of 2 types:
+	 * (1) Venus NV12 UBWC Progressive
+	 * (2) Venus NV12 UBWC Interlaced
+	 *
+	 * (1) Venus NV12 UBWC Progressive Buffer Format:
+	 * Compressed Macro-tile format for NV12.
+	 * Contains 4 planes in the following order -
+	 * (A) Y_Meta_Plane
+	 * (B) Y_UBWC_Plane
+	 * (C) UV_Meta_Plane
+	 * (D) UV_UBWC_Plane
+	 *
+	 * Y_Meta_Plane consists of meta information to decode compressed
+	 * tile data in Y_UBWC_Plane.
+	 * Y_UBWC_Plane consists of Y data in compressed macro-tile format.
+	 * UBWC decoder block will use the Y_Meta_Plane data together with
+	 * Y_UBWC_Plane data to produce loss-less uncompressed 8 bit Y samples.
+	 *
+	 * UV_Meta_Plane consists of meta information to decode compressed
+	 * tile data in UV_UBWC_Plane.
+	 * UV_UBWC_Plane consists of UV data in compressed macro-tile format.
+	 * UBWC decoder block will use UV_Meta_Plane data together with
+	 * UV_UBWC_Plane data to produce loss-less uncompressed 8 bit 2x2
+	 * subsampled color difference samples.
+	 *
+	 * Each tile in Y_UBWC_Plane/UV_UBWC_Plane is independently decodable
+	 * and randomly accessible. There is no dependency between tiles.
+	 *
+	 * <----- Y_Meta_Stride ---->
+	 * <-------- Width ------>
+	 * M M M M M M M M M M M M . .      ^           ^
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      Height      |
+	 * M M M M M M M M M M M M . .      |         Meta_Y_Scanlines
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      V           |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . .                  V
+	 * <--Compressed tile Y Stride--->
+	 * <------- Width ------->
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  ^           ^
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  Height      |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |        Macro_tile_Y_Scanlines
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . . . .              V
+	 * <----- UV_Meta_Stride ---->
+	 * M M M M M M M M M M M M . .      ^
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      M_UV_Scanlines
+	 * . . . . . . . . . . . . . .      |
+	 * . . . . . . . . . . . . . .      V
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * <--Compressed tile UV Stride--->
+	 * U* V* U* V* U* V* U* V* . . . .  ^
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  UV_Scanlines
+	 * . . . . . . . . . . . . . . . .  |
+	 * . . . . . . . . . . . . . . . .  V
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 *
+	 * Y_Stride = align(Width, 128)
+	 * UV_Stride = align(Width, 128)
+	 * Y_Scanlines = align(Height, 32)
+	 * UV_Scanlines = align(Height/2, 16)
+	 * Y_UBWC_Plane_size = align(Y_Stride * Y_Scanlines, 4096)
+	 * UV_UBWC_Plane_size = align(UV_Stride * UV_Scanlines, 4096)
+	 * Y_Meta_Stride = align(roundup(Width, Y_TileWidth), 64)
+	 * Y_Meta_Scanlines = align(roundup(Height, Y_TileHeight), 16)
+	 * Y_Meta_Plane_size = align(Y_Meta_Stride * Y_Meta_Scanlines, 4096)
+	 * UV_Meta_Stride = align(roundup(Width, UV_TileWidth), 64)
+	 * UV_Meta_Scanlines = align(roundup(Height, UV_TileHeight), 16)
+	 * UV_Meta_Plane_size = align(UV_Meta_Stride * UV_Meta_Scanlines, 4096)
+	 * Extradata = 8k
+	 *
+	 * Total size = align( Y_UBWC_Plane_size + UV_UBWC_Plane_size +
+	 *           Y_Meta_Plane_size + UV_Meta_Plane_size
+	 *           + max(Extradata, Y_Stride * 48), 4096)
+	 *
+	 *
+	 * (2) Venus NV12 UBWC Interlaced Buffer Format:
+	 * Compressed Macro-tile format for NV12 interlaced.
+	 * Contains 8 planes in the following order -
+	 * (A) Y_Meta_Top_Field_Plane
+	 * (B) Y_UBWC_Top_Field_Plane
+	 * (C) UV_Meta_Top_Field_Plane
+	 * (D) UV_UBWC_Top_Field_Plane
+	 * (E) Y_Meta_Bottom_Field_Plane
+	 * (F) Y_UBWC_Bottom_Field_Plane
+	 * (G) UV_Meta_Bottom_Field_Plane
+	 * (H) UV_UBWC_Bottom_Field_Plane
+	 * Y_Meta_Top_Field_Plane consists of meta information to decode
+	 * compressed tile data for Y_UBWC_Top_Field_Plane.
+	 * Y_UBWC_Top_Field_Plane consists of Y data in compressed macro-tile
+	 * format for top field of an interlaced frame.
+	 * UBWC decoder block will use the Y_Meta_Top_Field_Plane data together
+	 * with Y_UBWC_Top_Field_Plane data to produce loss-less uncompressed
+	 * 8 bit Y samples for top field of an interlaced frame.
+	 *
+	 * UV_Meta_Top_Field_Plane consists of meta information to decode
+	 * compressed tile data in UV_UBWC_Top_Field_Plane.
+	 * UV_UBWC_Top_Field_Plane consists of UV data in compressed macro-tile
+	 * format for top field of an interlaced frame.
+	 * UBWC decoder block will use UV_Meta_Top_Field_Plane data together
+	 * with UV_UBWC_Top_Field_Plane data to produce loss-less uncompressed
+	 * 8 bit subsampled color difference samples for top field of an
+	 * interlaced frame.
+	 *
+	 * Each tile in Y_UBWC_Top_Field_Plane/UV_UBWC_Top_Field_Plane is
+	 * independently decodable and randomly accessible. There is no
+	 * dependency between tiles.
+	 *
+	 * Y_Meta_Bottom_Field_Plane consists of meta information to decode
+	 * compressed tile data for Y_UBWC_Bottom_Field_Plane.
+	 * Y_UBWC_Bottom_Field_Plane consists of Y data in compressed macro-tile
+	 * format for bottom field of an interlaced frame.
+	 * UBWC decoder block will use the Y_Meta_Bottom_Field_Plane data
+	 * together with Y_UBWC_Bottom_Field_Plane data to produce loss-less
+	 * uncompressed 8 bit Y samples for bottom field of an interlaced frame.
+	 *
+	 * UV_Meta_Bottom_Field_Plane consists of meta information to decode
+	 * compressed tile data in UV_UBWC_Bottom_Field_Plane.
+	 * UV_UBWC_Bottom_Field_Plane consists of UV data in compressed
+	 * macro-tile format for bottom field of an interlaced frame.
+	 * UBWC decoder block will use UV_Meta_Bottom_Field_Plane data together
+	 * with UV_UBWC_Bottom_Field_Plane data to produce loss-less
+	 * uncompressed 8 bit subsampled color difference samples for bottom
+	 * field of an interlaced frame.
+	 *
+	 * Each tile in Y_UBWC_Bottom_Field_Plane/UV_UBWC_Bottom_Field_Plane is
+	 * independently decodable and randomly accessible. There is no
+	 * dependency between tiles.
+	 *
+	 * <-----Y_TF_Meta_Stride---->
+	 * <-------- Width ------>
+	 * M M M M M M M M M M M M . .      ^           ^
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . . Half_height      |
+	 * M M M M M M M M M M M M . .      |         Meta_Y_TF_Scanlines
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      V           |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . .                  V
+	 * <-Compressed tile Y_TF Stride->
+	 * <------- Width ------->
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  ^           ^
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . . Half_height  |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |        Macro_tile_Y_TF_Scanlines
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . . . .              V
+	 * <----UV_TF_Meta_Stride---->
+	 * M M M M M M M M M M M M . .      ^
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      M_UV_TF_Scanlines
+	 * . . . . . . . . . . . . . .      |
+	 * . . . . . . . . . . . . . .      V
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * <-Compressed tile UV_TF Stride->
+	 * U* V* U* V* U* V* U* V* . . . .  ^
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  UV_TF_Scanlines
+	 * . . . . . . . . . . . . . . . .  |
+	 * . . . . . . . . . . . . . . . .  V
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 * <-----Y_BF_Meta_Stride---->
+	 * <-------- Width ------>
+	 * M M M M M M M M M M M M . .      ^           ^
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . . Half_height      |
+	 * M M M M M M M M M M M M . .      |         Meta_Y_BF_Scanlines
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      V           |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . .                  V
+	 * <-Compressed tile Y_BF Stride->
+	 * <------- Width ------->
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  ^           ^
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . . Half_height  |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |        Macro_tile_Y_BF_Scanlines
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . . . .              V
+	 * <----UV_BF_Meta_Stride---->
+	 * M M M M M M M M M M M M . .      ^
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      M_UV_BF_Scanlines
+	 * . . . . . . . . . . . . . .      |
+	 * . . . . . . . . . . . . . .      V
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * <-Compressed tile UV_BF Stride->
+	 * U* V* U* V* U* V* U* V* . . . .  ^
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  UV_BF_Scanlines
+	 * . . . . . . . . . . . . . . . .  |
+	 * . . . . . . . . . . . . . . . .  V
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 *
+	 * Half_height = (Height+1)>>1
+	 * Y_TF_Stride = align(Width, 128)
+	 * UV_TF_Stride = align(Width, 128)
+	 * Y_TF_Scanlines = align(Half_height, 32)
+	 * UV_TF_Scanlines = align((Half_height+1)/2, 32)
+	 * Y_UBWC_TF_Plane_size = align(Y_TF_Stride * Y_TF_Scanlines, 4096)
+	 * UV_UBWC_TF_Plane_size = align(UV_TF_Stride * UV_TF_Scanlines, 4096)
+	 * Y_TF_Meta_Stride = align(roundup(Width, Y_TileWidth), 64)
+	 * Y_TF_Meta_Scanlines = align(roundup(Half_height, Y_TileHeight), 16)
+	 * Y_TF_Meta_Plane_size =
+	 *     align(Y_TF_Meta_Stride * Y_TF_Meta_Scanlines, 4096)
+	 * UV_TF_Meta_Stride = align(roundup(Width, UV_TileWidth), 64)
+	 * UV_TF_Meta_Scanlines = align(roundup(Half_height, UV_TileHeight), 16)
+	 * UV_TF_Meta_Plane_size =
+	 *     align(UV_TF_Meta_Stride * UV_TF_Meta_Scanlines, 4096)
+	 * Y_BF_Stride = align(Width, 128)
+	 * UV_BF_Stride = align(Width, 128)
+	 * Y_BF_Scanlines = align(Half_height, 32)
+	 * UV_BF_Scanlines = align((Half_height+1)/2, 32)
+	 * Y_UBWC_BF_Plane_size = align(Y_BF_Stride * Y_BF_Scanlines, 4096)
+	 * UV_UBWC_BF_Plane_size = align(UV_BF_Stride * UV_BF_Scanlines, 4096)
+	 * Y_BF_Meta_Stride = align(roundup(Width, Y_TileWidth), 64)
+	 * Y_BF_Meta_Scanlines = align(roundup(Half_height, Y_TileHeight), 16)
+	 * Y_BF_Meta_Plane_size =
+	 *     align(Y_BF_Meta_Stride * Y_BF_Meta_Scanlines, 4096)
+	 * UV_BF_Meta_Stride = align(roundup(Width, UV_TileWidth), 64)
+	 * UV_BF_Meta_Scanlines = align(roundup(Half_height, UV_TileHeight), 16)
+	 * UV_BF_Meta_Plane_size =
+	 *     align(UV_BF_Meta_Stride * UV_BF_Meta_Scanlines, 4096)
+	 * Extradata = 8k
+	 *
+	 * Total size = align( Y_UBWC_TF_Plane_size + UV_UBWC_TF_Plane_size +
+	 *           Y_TF_Meta_Plane_size + UV_TF_Meta_Plane_size +
+	 *			 Y_UBWC_BF_Plane_size + UV_UBWC_BF_Plane_size +
+	 *           Y_BF_Meta_Plane_size + UV_BF_Meta_Plane_size +
+	 *           + max(Extradata, Y_TF_Stride * 48), 4096)
+	 */
+	COLOR_FMT_NV12_UBWC,
+	/* Venus NV12 10-bit UBWC:
+	 * Compressed Macro-tile format for NV12.
+	 * Contains 4 planes in the following order -
+	 * (A) Y_Meta_Plane
+	 * (B) Y_UBWC_Plane
+	 * (C) UV_Meta_Plane
+	 * (D) UV_UBWC_Plane
+	 *
+	 * Y_Meta_Plane consists of meta information to decode compressed
+	 * tile data in Y_UBWC_Plane.
+	 * Y_UBWC_Plane consists of Y data in compressed macro-tile format.
+	 * UBWC decoder block will use the Y_Meta_Plane data together with
+	 * Y_UBWC_Plane data to produce loss-less uncompressed 10 bit Y samples.
+	 *
+	 * UV_Meta_Plane consists of meta information to decode compressed
+	 * tile data in UV_UBWC_Plane.
+	 * UV_UBWC_Plane consists of UV data in compressed macro-tile format.
+	 * UBWC decoder block will use UV_Meta_Plane data together with
+	 * UV_UBWC_Plane data to produce loss-less uncompressed 10 bit 2x2
+	 * subsampled color difference samples.
+	 *
+	 * Each tile in Y_UBWC_Plane/UV_UBWC_Plane is independently decodable
+	 * and randomly accessible. There is no dependency between tiles.
+	 *
+	 * <----- Y_Meta_Stride ----->
+	 * <-------- Width ------>
+	 * M M M M M M M M M M M M . .      ^           ^
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      Height      |
+	 * M M M M M M M M M M M M . .      |         Meta_Y_Scanlines
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      V           |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . .                  V
+	 * <--Compressed tile Y Stride--->
+	 * <------- Width ------->
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  ^           ^
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  Height      |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |        Macro_tile_Y_Scanlines
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . . . .              V
+	 * <----- UV_Meta_Stride ---->
+	 * M M M M M M M M M M M M . .      ^
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      M_UV_Scanlines
+	 * . . . . . . . . . . . . . .      |
+	 * . . . . . . . . . . . . . .      V
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * <--Compressed tile UV Stride--->
+	 * U* V* U* V* U* V* U* V* . . . .  ^
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  UV_Scanlines
+	 * . . . . . . . . . . . . . . . .  |
+	 * . . . . . . . . . . . . . . . .  V
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 *
+	 *
+	 * Y_Stride = align(Width * 4/3, 128)
+	 * UV_Stride = align(Width * 4/3, 128)
+	 * Y_Scanlines = align(Height, 32)
+	 * UV_Scanlines = align(Height/2, 16)
+	 * Y_UBWC_Plane_Size = align(Y_Stride * Y_Scanlines, 4096)
+	 * UV_UBWC_Plane_Size = align(UV_Stride * UV_Scanlines, 4096)
+	 * Y_Meta_Stride = align(roundup(Width, Y_TileWidth), 64)
+	 * Y_Meta_Scanlines = align(roundup(Height, Y_TileHeight), 16)
+	 * Y_Meta_Plane_size = align(Y_Meta_Stride * Y_Meta_Scanlines, 4096)
+	 * UV_Meta_Stride = align(roundup(Width, UV_TileWidth), 64)
+	 * UV_Meta_Scanlines = align(roundup(Height, UV_TileHeight), 16)
+	 * UV_Meta_Plane_size = align(UV_Meta_Stride * UV_Meta_Scanlines, 4096)
+	 * Extradata = 8k
+	 *
+	 * Total size = align(Y_UBWC_Plane_size + UV_UBWC_Plane_size +
+	 *           Y_Meta_Plane_size + UV_Meta_Plane_size
+	 *           + max(Extradata, Y_Stride * 48), 4096)
+	 */
+	COLOR_FMT_NV12_BPP10_UBWC,
+	/* Venus RGBA8888 format:
+	 * Contains 1 plane in the following order -
+	 * (A) RGBA plane
+	 *
+	 * <-------- RGB_Stride -------->
+	 * <------- Width ------->
+	 * R R R R R R R R R R R R . . . .  ^           ^
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  Height      |
+	 * R R R R R R R R R R R R . . . .  |       RGB_Scanlines
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              V
+	 *
+	 * RGB_Stride = align(Width * 4, 128)
+	 * RGB_Scanlines = align(Height, 32)
+	 * RGB_Plane_size = align(RGB_Stride * RGB_Scanlines, 4096)
+	 * Extradata = 8k
+	 *
+	 * Total size = align(RGB_Plane_size + Extradata, 4096)
+	 */
+	COLOR_FMT_RGBA8888,
+	/* Venus RGBA8888 UBWC format:
+	 * Contains 2 planes in the following order -
+	 * (A) Meta plane
+	 * (B) RGBA plane
+	 *
+	 * <--- RGB_Meta_Stride ---->
+	 * <-------- Width ------>
+	 * M M M M M M M M M M M M . .      ^           ^
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      Height      |
+	 * M M M M M M M M M M M M . .      |       Meta_RGB_Scanlines
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      V           |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . .                  V
+	 * <-------- RGB_Stride -------->
+	 * <------- Width ------->
+	 * R R R R R R R R R R R R . . . .  ^           ^
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  Height      |
+	 * R R R R R R R R R R R R . . . .  |       RGB_Scanlines
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .    -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . . . .              V
+	 *
+	 * RGB_Stride = align(Width * 4, 128)
+	 * RGB_Scanlines = align(Height, 32)
+	 * RGB_Plane_size = align(RGB_Stride * RGB_Scanlines, 4096)
+	 * RGB_Meta_Stride = align(roundup(Width, RGB_TileWidth), 64)
+	 * RGB_Meta_Scanline = align(roundup(Height, RGB_TileHeight), 16)
+	 * RGB_Meta_Plane_size = align(RGB_Meta_Stride *
+	 *		RGB_Meta_Scanlines, 4096)
+	 * Extradata = 8k
+	 *
+	 * Total size = align(RGB_Meta_Plane_size + RGB_Plane_size +
+	 *		Extradata, 4096)
+	 */
+	COLOR_FMT_RGBA8888_UBWC,
+	/* Venus RGBA1010102 UBWC format:
+	 * Contains 2 planes in the following order -
+	 * (A) Meta plane
+	 * (B) RGBA plane
+	 *
+	 * <--- RGB_Meta_Stride ---->
+	 * <-------- Width ------>
+	 * M M M M M M M M M M M M . .      ^           ^
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      Height      |
+	 * M M M M M M M M M M M M . .      |       Meta_RGB_Scanlines
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      V           |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . .                  V
+	 * <-------- RGB_Stride -------->
+	 * <------- Width ------->
+	 * R R R R R R R R R R R R . . . .  ^           ^
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  Height      |
+	 * R R R R R R R R R R R R . . . .  |       RGB_Scanlines
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .    -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . . . .              V
+	 *
+	 * RGB_Stride = align(Width * 4, 256)
+	 * RGB_Scanlines = align(Height, 16)
+	 * RGB_Plane_size = align(RGB_Stride * RGB_Scanlines, 4096)
+	 * RGB_Meta_Stride = align(roundup(Width, RGB_TileWidth), 64)
+	 * RGB_Meta_Scanline = align(roundup(Height, RGB_TileHeight), 16)
+	 * RGB_Meta_Plane_size = align(RGB_Meta_Stride *
+	 *		RGB_Meta_Scanlines, 4096)
+	 * Extradata = 8k
+	 *
+	 * Total size = align(RGB_Meta_Plane_size + RGB_Plane_size +
+	 *		Extradata, 4096)
+	 */
+	COLOR_FMT_RGBA1010102_UBWC,
+	/* Venus RGB565 UBWC format:
+	 * Contains 2 planes in the following order -
+	 * (A) Meta plane
+	 * (B) RGB plane
+	 *
+	 * <--- RGB_Meta_Stride ---->
+	 * <-------- Width ------>
+	 * M M M M M M M M M M M M . .      ^           ^
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      Height      |
+	 * M M M M M M M M M M M M . .      |       Meta_RGB_Scanlines
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      V           |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . .                  V
+	 * <-------- RGB_Stride -------->
+	 * <------- Width ------->
+	 * R R R R R R R R R R R R . . . .  ^           ^
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  Height      |
+	 * R R R R R R R R R R R R . . . .  |       RGB_Scanlines
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  |           |
+	 * R R R R R R R R R R R R . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .    -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . . . .              V
+	 *
+	 * RGB_Stride = align(Width * 2, 128)
+	 * RGB_Scanlines = align(Height, 16)
+	 * RGB_Plane_size = align(RGB_Stride * RGB_Scanlines, 4096)
+	 * RGB_Meta_Stride = align(roundup(Width, RGB_TileWidth), 64)
+	 * RGB_Meta_Scanline = align(roundup(Height, RGB_TileHeight), 16)
+	 * RGB_Meta_Plane_size = align(RGB_Meta_Stride *
+	 *		RGB_Meta_Scanlines, 4096)
+	 * Extradata = 8k
+	 *
+	 * Total size = align(RGB_Meta_Plane_size + RGB_Plane_size +
+	 *		Extradata, 4096)
+	 */
+	COLOR_FMT_RGB565_UBWC,
+	/* P010 UBWC:
+	 * Compressed Macro-tile format for NV12.
+	 * Contains 4 planes in the following order -
+	 * (A) Y_Meta_Plane
+	 * (B) Y_UBWC_Plane
+	 * (C) UV_Meta_Plane
+	 * (D) UV_UBWC_Plane
+	 *
+	 * Y_Meta_Plane consists of meta information to decode compressed
+	 * tile data in Y_UBWC_Plane.
+	 * Y_UBWC_Plane consists of Y data in compressed macro-tile format.
+	 * UBWC decoder block will use the Y_Meta_Plane data together with
+	 * Y_UBWC_Plane data to produce loss-less uncompressed 10 bit Y samples.
+	 *
+	 * UV_Meta_Plane consists of meta information to decode compressed
+	 * tile data in UV_UBWC_Plane.
+	 * UV_UBWC_Plane consists of UV data in compressed macro-tile format.
+	 * UBWC decoder block will use UV_Meta_Plane data together with
+	 * UV_UBWC_Plane data to produce loss-less uncompressed 10 bit 2x2
+	 * subsampled color difference samples.
+	 *
+	 * Each tile in Y_UBWC_Plane/UV_UBWC_Plane is independently decodable
+	 * and randomly accessible. There is no dependency between tiles.
+	 *
+	 * <----- Y_Meta_Stride ----->
+	 * <-------- Width ------>
+	 * M M M M M M M M M M M M . .      ^           ^
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      Height      |
+	 * M M M M M M M M M M M M . .      |         Meta_Y_Scanlines
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      |           |
+	 * M M M M M M M M M M M M . .      V           |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .                  |
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . .                  V
+	 * <--Compressed tile Y Stride--->
+	 * <------- Width ------->
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  ^           ^
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  Height      |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |        Macro_tile_Y_Scanlines
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  |           |
+	 * Y* Y* Y* Y* Y* Y* Y* Y* . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 * . . . . . . . . . . . . . . . .              V
+	 * <----- UV_Meta_Stride ---->
+	 * M M M M M M M M M M M M . .      ^
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      |
+	 * M M M M M M M M M M M M . .      M_UV_Scanlines
+	 * . . . . . . . . . . . . . .      |
+	 * . . . . . . . . . . . . . .      V
+	 * . . . . . . . . . . . . . .      -------> Buffer size aligned to 4k
+	 * <--Compressed tile UV Stride--->
+	 * U* V* U* V* U* V* U* V* . . . .  ^
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  |
+	 * U* V* U* V* U* V* U* V* . . . .  UV_Scanlines
+	 * . . . . . . . . . . . . . . . .  |
+	 * . . . . . . . . . . . . . . . .  V
+	 * . . . . . . . . . . . . . . . .  -------> Buffer size aligned to 4k
+	 *
+	 *
+	 * Y_Stride = align(Width * 2, 256)
+	 * UV_Stride = align(Width * 2, 256)
+	 * Y_Scanlines = align(Height, 16)
+	 * UV_Scanlines = align(Height/2, 16)
+	 * Y_UBWC_Plane_Size = align(Y_Stride * Y_Scanlines, 4096)
+	 * UV_UBWC_Plane_Size = align(UV_Stride * UV_Scanlines, 4096)
+	 * Y_Meta_Stride = align(roundup(Width, Y_TileWidth), 64)
+	 * Y_Meta_Scanlines = align(roundup(Height, Y_TileHeight), 16)
+	 * Y_Meta_Plane_size = align(Y_Meta_Stride * Y_Meta_Scanlines, 4096)
+	 * UV_Meta_Stride = align(roundup(Width, UV_TileWidth), 64)
+	 * UV_Meta_Scanlines = align(roundup(Height, UV_TileHeight), 16)
+	 * UV_Meta_Plane_size = align(UV_Meta_Stride * UV_Meta_Scanlines, 4096)
+	 * Extradata = 8k
+	 *
+	 * Total size = align(Y_UBWC_Plane_size + UV_UBWC_Plane_size +
+	 *           Y_Meta_Plane_size + UV_Meta_Plane_size
+	 *           + max(Extradata, Y_Stride * 48), 4096)
+	 */
+	COLOR_FMT_P010_UBWC,
+	/* Venus P010:
+	 * YUV 4:2:0 image with a plane of 10 bit Y samples followed
+	 * by an interleaved U/V plane containing 10 bit 2x2 subsampled
+	 * colour difference samples.
+	 *
+	 * <-------- Y/UV_Stride -------->
+	 * <------- Width ------->
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  ^           ^
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  Height      |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |          Y_Scanlines
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  |           |
+	 * Y Y Y Y Y Y Y Y Y Y Y Y . . . .  V           |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              |
+	 * . . . . . . . . . . . . . . . .              V
+	 * U V U V U V U V U V U V . . . .  ^
+	 * U V U V U V U V U V U V . . . .  |
+	 * U V U V U V U V U V U V . . . .  |
+	 * U V U V U V U V U V U V . . . .  UV_Scanlines
+	 * . . . . . . . . . . . . . . . .  |
+	 * . . . . . . . . . . . . . . . .  V
+	 * . . . . . . . . . . . . . . . .  --> Buffer size alignment
+	 *
+	 * Y_Stride : Width * 2 aligned to 128
+	 * UV_Stride : Width * 2 aligned to 128
+	 * Y_Scanlines: Height aligned to 32
+	 * UV_Scanlines: Height/2 aligned to 16
+	 * Extradata: Arbitrary (software-imposed) padding
+	 * Total size = align((Y_Stride * Y_Scanlines
+	 *          + UV_Stride * UV_Scanlines
+	 *          + max(Extradata, Y_Stride * 8), 4096)
+	 */
+	COLOR_FMT_P010,
+};
+
+#define COLOR_FMT_RGBA1010102_UBWC	COLOR_FMT_RGBA1010102_UBWC
+#define COLOR_FMT_RGB565_UBWC		COLOR_FMT_RGB565_UBWC
+#define COLOR_FMT_P010_UBWC		COLOR_FMT_P010_UBWC
+#define COLOR_FMT_P010		COLOR_FMT_P010
+
+/*
+ * Function arguments:
+ * @color_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static unsigned int VENUS_Y_STRIDE(int color_fmt, int width)
+{
+	unsigned int stride = 0;
+
+	if (!width)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_NV21:
+	case COLOR_FMT_NV12:
+	case COLOR_FMT_NV12_MVTB:
+	case COLOR_FMT_NV12_UBWC:
+		stride = MSM_MEDIA_ALIGN(width, 128);
+		break;
+	case COLOR_FMT_NV12_BPP10_UBWC:
+		stride = MSM_MEDIA_ALIGN(width, 192);
+		stride = MSM_MEDIA_ALIGN(stride * 4 / 3, 256);
+		break;
+	case COLOR_FMT_P010_UBWC:
+		stride = MSM_MEDIA_ALIGN(width * 2, 256);
+		break;
+	case COLOR_FMT_P010:
+		stride = MSM_MEDIA_ALIGN(width * 2, 128);
+		break;
+	}
+
+	return stride;
+}
+
+/*
+ * Function arguments:
+ * @color_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static unsigned int VENUS_UV_STRIDE(int color_fmt, int width)
+{
+	unsigned int stride = 0;
+
+	if (!width)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_NV21:
+	case COLOR_FMT_NV12:
+	case COLOR_FMT_NV12_MVTB:
+	case COLOR_FMT_NV12_UBWC:
+		stride = MSM_MEDIA_ALIGN(width, 128);
+		break;
+	case COLOR_FMT_NV12_BPP10_UBWC:
+		stride = MSM_MEDIA_ALIGN(width, 192);
+		stride = MSM_MEDIA_ALIGN(stride * 4 / 3, 256);
+		break;
+	case COLOR_FMT_P010_UBWC:
+		stride = MSM_MEDIA_ALIGN(width * 2, 256);
+		break;
+	case COLOR_FMT_P010:
+		stride = MSM_MEDIA_ALIGN(width * 2, 128);
+		break;
+	}
+
+	return stride;
+}
+
+/*
+ * Function arguments:
+ * @color_fmt
+ * @height
+ * Progressive: height
+ * Interlaced: (height+1)>>1
+ */
+static unsigned int VENUS_Y_SCANLINES(int color_fmt, int height)
+{
+	unsigned int sclines = 0;
+
+	if (!height)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_NV21:
+	case COLOR_FMT_NV12:
+	case COLOR_FMT_NV12_MVTB:
+	case COLOR_FMT_NV12_UBWC:
+	case COLOR_FMT_P010:
+		sclines = MSM_MEDIA_ALIGN(height, 32);
+		break;
+	case COLOR_FMT_NV12_BPP10_UBWC:
+	case COLOR_FMT_P010_UBWC:
+		sclines = MSM_MEDIA_ALIGN(height, 16);
+		break;
+	}
+
+	return sclines;
+}
+
+/*
+ * Function arguments:
+ * @color_fmt
+ * @height
+ * Progressive: height
+ * Interlaced: (height+1)>>1
+ */
+static unsigned int VENUS_UV_SCANLINES(int color_fmt, int height)
+{
+	unsigned int sclines = 0;
+
+	if (!height)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_NV21:
+	case COLOR_FMT_NV12:
+	case COLOR_FMT_NV12_MVTB:
+	case COLOR_FMT_NV12_BPP10_UBWC:
+	case COLOR_FMT_P010_UBWC:
+	case COLOR_FMT_P010:
+		sclines = MSM_MEDIA_ALIGN((height + 1) >> 1, 16);
+		break;
+	case COLOR_FMT_NV12_UBWC:
+		sclines = MSM_MEDIA_ALIGN((height + 1) >> 1, 32);
+		break;
+	}
+
+	return sclines;
+}
+
+/*
+ * Function arguments:
+ * @color_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static unsigned int VENUS_Y_META_STRIDE(int color_fmt, int width)
+{
+	int y_tile_width = 0, y_meta_stride;
+
+	if (!width)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_NV12_UBWC:
+	case COLOR_FMT_P010_UBWC:
+		y_tile_width = 32;
+		break;
+	case COLOR_FMT_NV12_BPP10_UBWC:
+		y_tile_width = 48;
+		break;
+	default:
+		return 0;
+	}
+
+	y_meta_stride = MSM_MEDIA_ROUNDUP(width, y_tile_width);
+	return MSM_MEDIA_ALIGN(y_meta_stride, 64);
+}
+
+/*
+ * Function arguments:
+ * @color_fmt
+ * @height
+ * Progressive: height
+ * Interlaced: (height+1)>>1
+ */
+static unsigned int VENUS_Y_META_SCANLINES(int color_fmt, int height)
+{
+	int y_tile_height = 0, y_meta_scanlines;
+
+	if (!height)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_NV12_UBWC:
+		y_tile_height = 8;
+		break;
+	case COLOR_FMT_NV12_BPP10_UBWC:
+	case COLOR_FMT_P010_UBWC:
+		y_tile_height = 4;
+		break;
+	default:
+		return 0;
+	}
+
+	y_meta_scanlines = MSM_MEDIA_ROUNDUP(height, y_tile_height);
+	return MSM_MEDIA_ALIGN(y_meta_scanlines, 16);
+}
+
+/*
+ * Function arguments:
+ * @color_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static unsigned int VENUS_UV_META_STRIDE(int color_fmt, int width)
+{
+	int uv_tile_width = 0, uv_meta_stride;
+
+	if (!width)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_NV12_UBWC:
+	case COLOR_FMT_P010_UBWC:
+		uv_tile_width = 16;
+		break;
+	case COLOR_FMT_NV12_BPP10_UBWC:
+		uv_tile_width = 24;
+		break;
+	default:
+		return 0;
+	}
+
+	uv_meta_stride = MSM_MEDIA_ROUNDUP((width+1)>>1, uv_tile_width);
+	return MSM_MEDIA_ALIGN(uv_meta_stride, 64);
+}
+
+/*
+ * Function arguments:
+ * @color_fmt
+ * @height
+ * Progressive: height
+ * Interlaced: (height+1)>>1
+ */
+static unsigned int VENUS_UV_META_SCANLINES(int color_fmt, int height)
+{
+	int uv_tile_height = 0, uv_meta_scanlines;
+
+	if (!height)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_NV12_UBWC:
+		uv_tile_height = 8;
+		break;
+	case COLOR_FMT_NV12_BPP10_UBWC:
+	case COLOR_FMT_P010_UBWC:
+		uv_tile_height = 4;
+		break;
+	default:
+		return 0;
+	}
+
+	uv_meta_scanlines = MSM_MEDIA_ROUNDUP((height+1)>>1, uv_tile_height);
+	return MSM_MEDIA_ALIGN(uv_meta_scanlines, 16);
+}
+
+static unsigned int VENUS_RGB_STRIDE(int color_fmt, int width)
+{
+	unsigned int alignment = 0, bpp = 4;
+
+	if (!width)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_RGBA8888:
+		alignment = 128;
+		break;
+	case COLOR_FMT_RGB565_UBWC:
+		alignment = 256;
+		bpp = 2;
+		break;
+	case COLOR_FMT_RGBA8888_UBWC:
+	case COLOR_FMT_RGBA1010102_UBWC:
+		alignment = 256;
+		break;
+	default:
+		return 0;
+	}
+
+	return MSM_MEDIA_ALIGN(width * bpp, alignment);
+}
+
+static unsigned int VENUS_RGB_SCANLINES(int color_fmt, int height)
+{
+	unsigned int alignment = 0;
+
+	if (!height)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_RGBA8888:
+		alignment = 32;
+		break;
+	case COLOR_FMT_RGBA8888_UBWC:
+	case COLOR_FMT_RGBA1010102_UBWC:
+	case COLOR_FMT_RGB565_UBWC:
+		alignment = 16;
+		break;
+	default:
+		return 0;
+	}
+
+	return MSM_MEDIA_ALIGN(height, alignment);
+}
+
+static unsigned int VENUS_RGB_META_STRIDE(int color_fmt, int width)
+{
+	int rgb_meta_stride;
+
+	if (!width)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_RGBA8888_UBWC:
+	case COLOR_FMT_RGBA1010102_UBWC:
+	case COLOR_FMT_RGB565_UBWC:
+		rgb_meta_stride = MSM_MEDIA_ROUNDUP(width, 16);
+		return MSM_MEDIA_ALIGN(rgb_meta_stride, 64);
+	}
+
+	return 0;
+}
+
+static unsigned int VENUS_RGB_META_SCANLINES(int color_fmt, int height)
+{
+	int rgb_meta_scanlines;
+
+	if (!height)
+		return 0;
+
+	switch (color_fmt) {
+	case COLOR_FMT_RGBA8888_UBWC:
+	case COLOR_FMT_RGBA1010102_UBWC:
+	case COLOR_FMT_RGB565_UBWC:
+		rgb_meta_scanlines = MSM_MEDIA_ROUNDUP(height, 4);
+		return MSM_MEDIA_ALIGN(rgb_meta_scanlines, 16);
+	}
+
+	return 0;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_crtc.c
@@ -0,0 +1,667 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_flip_work.h>
+#include <drm/drm_managed.h>
+#include <drm/drm_mode.h>
+#include <drm/drm_probe_helper.h>
+#include <drm/drm_vblank.h>
+
+#include "mdp4_kms.h"
+#include "msm_gem.h"
+
+struct mdp4_crtc {
+	struct drm_crtc base;
+	char name[8];
+	int id;
+	int ovlp;
+	enum mdp4_dma dma;
+	bool enabled;
+
+	/* which mixer/encoder we route output to: */
+	int mixer;
+
+	struct {
+		spinlock_t lock;
+		bool stale;
+		uint32_t width, height;
+		uint32_t x, y;
+
+		/* next cursor to scan-out: */
+		uint32_t next_iova;
+		struct drm_gem_object *next_bo;
+
+		/* current cursor being scanned out: */
+		struct drm_gem_object *scanout_bo;
+	} cursor;
+
+
+	/* if there is a pending flip, these will be non-null: */
+	struct drm_pending_vblank_event *event;
+
+	/* Bits have been flushed at the last commit,
+	 * used to decide if a vsync has happened since last commit.
+	 */
+	u32 flushed_mask;
+
+#define PENDING_CURSOR 0x1
+#define PENDING_FLIP   0x2
+	atomic_t pending;
+
+	/* for unref'ing cursor bo's after scanout completes: */
+	struct drm_flip_work unref_cursor_work;
+
+	struct mdp_irq vblank;
+	struct mdp_irq err;
+};
+#define to_mdp4_crtc(x) container_of(x, struct mdp4_crtc, base)
+
+static struct mdp4_kms *get_kms(struct drm_crtc *crtc)
+{
+	struct msm_drm_private *priv = crtc->dev->dev_private;
+	return to_mdp4_kms(to_mdp_kms(priv->kms));
+}
+
+static void request_pending(struct drm_crtc *crtc, uint32_t pending)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+
+	atomic_or(pending, &mdp4_crtc->pending);
+	mdp_irq_register(&get_kms(crtc)->base, &mdp4_crtc->vblank);
+}
+
+static void crtc_flush(struct drm_crtc *crtc)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+	struct drm_plane *plane;
+	uint32_t flush = 0;
+
+	drm_atomic_crtc_for_each_plane(plane, crtc) {
+		enum mdp4_pipe pipe_id = mdp4_plane_pipe(plane);
+		flush |= pipe2flush(pipe_id);
+	}
+
+	flush |= ovlp2flush(mdp4_crtc->ovlp);
+
+	DBG("%s: flush=%08x", mdp4_crtc->name, flush);
+
+	mdp4_crtc->flushed_mask = flush;
+
+	mdp4_write(mdp4_kms, REG_MDP4_OVERLAY_FLUSH, flush);
+}
+
+/* if file!=NULL, this is preclose potential cancel-flip path */
+static void complete_flip(struct drm_crtc *crtc, struct drm_file *file)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	struct drm_pending_vblank_event *event;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	event = mdp4_crtc->event;
+	if (event) {
+		mdp4_crtc->event = NULL;
+		DBG("%s: send event: %p", mdp4_crtc->name, event);
+		drm_crtc_send_vblank_event(crtc, event);
+	}
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
+static void unref_cursor_worker(struct drm_flip_work *work, void *val)
+{
+	struct mdp4_crtc *mdp4_crtc =
+		container_of(work, struct mdp4_crtc, unref_cursor_work);
+	struct mdp4_kms *mdp4_kms = get_kms(&mdp4_crtc->base);
+	struct msm_kms *kms = &mdp4_kms->base.base;
+
+	msm_gem_unpin_iova(val, kms->aspace);
+	drm_gem_object_put(val);
+}
+
+/* statically (for now) map planes to mixer stage (z-order): */
+static const int idxs[] = {
+		[VG1]  = 1,
+		[VG2]  = 2,
+		[RGB1] = 0,
+		[RGB2] = 0,
+		[RGB3] = 0,
+		[VG3]  = 3,
+		[VG4]  = 4,
+
+};
+
+/* setup mixer config, for which we need to consider all crtc's and
+ * the planes attached to them
+ *
+ * TODO may possibly need some extra locking here
+ */
+static void setup_mixer(struct mdp4_kms *mdp4_kms)
+{
+	struct drm_mode_config *config = &mdp4_kms->dev->mode_config;
+	struct drm_crtc *crtc;
+	uint32_t mixer_cfg = 0;
+	static const enum mdp_mixer_stage_id stages[] = {
+			STAGE_BASE, STAGE0, STAGE1, STAGE2, STAGE3,
+	};
+
+	list_for_each_entry(crtc, &config->crtc_list, head) {
+		struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+		struct drm_plane *plane;
+
+		drm_atomic_crtc_for_each_plane(plane, crtc) {
+			enum mdp4_pipe pipe_id = mdp4_plane_pipe(plane);
+			int idx = idxs[pipe_id];
+			mixer_cfg = mixercfg(mixer_cfg, mdp4_crtc->mixer,
+					pipe_id, stages[idx]);
+		}
+	}
+
+	mdp4_write(mdp4_kms, REG_MDP4_LAYERMIXER_IN_CFG, mixer_cfg);
+}
+
+static void blend_setup(struct drm_crtc *crtc)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+	struct drm_plane *plane;
+	int i, ovlp = mdp4_crtc->ovlp;
+	bool alpha[4]= { false, false, false, false };
+
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_TRANSP_LOW0(ovlp), 0);
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_TRANSP_LOW1(ovlp), 0);
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_TRANSP_HIGH0(ovlp), 0);
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_TRANSP_HIGH1(ovlp), 0);
+
+	drm_atomic_crtc_for_each_plane(plane, crtc) {
+		enum mdp4_pipe pipe_id = mdp4_plane_pipe(plane);
+		int idx = idxs[pipe_id];
+		if (idx > 0) {
+			const struct mdp_format *format =
+					to_mdp_format(msm_framebuffer_format(plane->state->fb));
+			alpha[idx-1] = format->alpha_enable;
+		}
+	}
+
+	for (i = 0; i < 4; i++) {
+		uint32_t op;
+
+		if (alpha[i]) {
+			op = MDP4_OVLP_STAGE_OP_FG_ALPHA(FG_PIXEL) |
+					MDP4_OVLP_STAGE_OP_BG_ALPHA(FG_PIXEL) |
+					MDP4_OVLP_STAGE_OP_BG_INV_ALPHA;
+		} else {
+			op = MDP4_OVLP_STAGE_OP_FG_ALPHA(FG_CONST) |
+					MDP4_OVLP_STAGE_OP_BG_ALPHA(BG_CONST);
+		}
+
+		mdp4_write(mdp4_kms, REG_MDP4_OVLP_STAGE_FG_ALPHA(ovlp, i), 0xff);
+		mdp4_write(mdp4_kms, REG_MDP4_OVLP_STAGE_BG_ALPHA(ovlp, i), 0x00);
+		mdp4_write(mdp4_kms, REG_MDP4_OVLP_STAGE_OP(ovlp, i), op);
+		mdp4_write(mdp4_kms, REG_MDP4_OVLP_STAGE_CO3(ovlp, i), 1);
+		mdp4_write(mdp4_kms, REG_MDP4_OVLP_STAGE_TRANSP_LOW0(ovlp, i), 0);
+		mdp4_write(mdp4_kms, REG_MDP4_OVLP_STAGE_TRANSP_LOW1(ovlp, i), 0);
+		mdp4_write(mdp4_kms, REG_MDP4_OVLP_STAGE_TRANSP_HIGH0(ovlp, i), 0);
+		mdp4_write(mdp4_kms, REG_MDP4_OVLP_STAGE_TRANSP_HIGH1(ovlp, i), 0);
+	}
+
+	setup_mixer(mdp4_kms);
+}
+
+static void mdp4_crtc_mode_set_nofb(struct drm_crtc *crtc)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+	enum mdp4_dma dma = mdp4_crtc->dma;
+	int ovlp = mdp4_crtc->ovlp;
+	struct drm_display_mode *mode;
+
+	if (WARN_ON(!crtc->state))
+		return;
+
+	mode = &crtc->state->adjusted_mode;
+
+	DBG("%s: set mode: " DRM_MODE_FMT,
+			mdp4_crtc->name, DRM_MODE_ARG(mode));
+
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_SRC_SIZE(dma),
+			MDP4_DMA_SRC_SIZE_WIDTH(mode->hdisplay) |
+			MDP4_DMA_SRC_SIZE_HEIGHT(mode->vdisplay));
+
+	/* take data from pipe: */
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_SRC_BASE(dma), 0);
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_SRC_STRIDE(dma), 0);
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_DST_SIZE(dma),
+			MDP4_DMA_DST_SIZE_WIDTH(0) |
+			MDP4_DMA_DST_SIZE_HEIGHT(0));
+
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_BASE(ovlp), 0);
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_SIZE(ovlp),
+			MDP4_OVLP_SIZE_WIDTH(mode->hdisplay) |
+			MDP4_OVLP_SIZE_HEIGHT(mode->vdisplay));
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_STRIDE(ovlp), 0);
+
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_CFG(ovlp), 1);
+
+	if (dma == DMA_E) {
+		mdp4_write(mdp4_kms, REG_MDP4_DMA_E_QUANT(0), 0x00ff0000);
+		mdp4_write(mdp4_kms, REG_MDP4_DMA_E_QUANT(1), 0x00ff0000);
+		mdp4_write(mdp4_kms, REG_MDP4_DMA_E_QUANT(2), 0x00ff0000);
+	}
+}
+
+static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
+				     struct drm_atomic_state *state)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+	unsigned long flags;
+
+	DBG("%s", mdp4_crtc->name);
+
+	if (WARN_ON(!mdp4_crtc->enabled))
+		return;
+
+	/* Disable/save vblank irq handling before power is disabled */
+	drm_crtc_vblank_off(crtc);
+
+	mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err);
+	mdp4_disable(mdp4_kms);
+
+	if (crtc->state->event && !crtc->state->active) {
+		WARN_ON(mdp4_crtc->event);
+		spin_lock_irqsave(&mdp4_kms->dev->event_lock, flags);
+		drm_crtc_send_vblank_event(crtc, crtc->state->event);
+		crtc->state->event = NULL;
+		spin_unlock_irqrestore(&mdp4_kms->dev->event_lock, flags);
+	}
+
+	mdp4_crtc->enabled = false;
+}
+
+static void mdp4_crtc_atomic_enable(struct drm_crtc *crtc,
+				    struct drm_atomic_state *state)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+
+	DBG("%s", mdp4_crtc->name);
+
+	if (WARN_ON(mdp4_crtc->enabled))
+		return;
+
+	mdp4_enable(mdp4_kms);
+
+	/* Restore vblank irq handling after power is enabled */
+	drm_crtc_vblank_on(crtc);
+
+	mdp_irq_register(&mdp4_kms->base, &mdp4_crtc->err);
+
+	crtc_flush(crtc);
+
+	mdp4_crtc->enabled = true;
+}
+
+static int mdp4_crtc_atomic_check(struct drm_crtc *crtc,
+		struct drm_atomic_state *state)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	DBG("%s: check", mdp4_crtc->name);
+	// TODO anything else to check?
+	return 0;
+}
+
+static void mdp4_crtc_atomic_begin(struct drm_crtc *crtc,
+				   struct drm_atomic_state *state)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	DBG("%s: begin", mdp4_crtc->name);
+}
+
+static void mdp4_crtc_atomic_flush(struct drm_crtc *crtc,
+				   struct drm_atomic_state *state)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	unsigned long flags;
+
+	DBG("%s: event: %p", mdp4_crtc->name, crtc->state->event);
+
+	WARN_ON(mdp4_crtc->event);
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	mdp4_crtc->event = crtc->state->event;
+	crtc->state->event = NULL;
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+
+	blend_setup(crtc);
+	crtc_flush(crtc);
+	request_pending(crtc, PENDING_FLIP);
+}
+
+#define CURSOR_WIDTH 64
+#define CURSOR_HEIGHT 64
+
+/* called from IRQ to update cursor related registers (if needed).  The
+ * cursor registers, other than x/y position, appear not to be double
+ * buffered, and changing them other than from vblank seems to trigger
+ * underflow.
+ */
+static void update_cursor(struct drm_crtc *crtc)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+	struct msm_kms *kms = &mdp4_kms->base.base;
+	enum mdp4_dma dma = mdp4_crtc->dma;
+	unsigned long flags;
+
+	spin_lock_irqsave(&mdp4_crtc->cursor.lock, flags);
+	if (mdp4_crtc->cursor.stale) {
+		struct drm_gem_object *next_bo = mdp4_crtc->cursor.next_bo;
+		struct drm_gem_object *prev_bo = mdp4_crtc->cursor.scanout_bo;
+		uint64_t iova = mdp4_crtc->cursor.next_iova;
+
+		if (next_bo) {
+			/* take a obj ref + iova ref when we start scanning out: */
+			drm_gem_object_get(next_bo);
+			msm_gem_get_and_pin_iova(next_bo, kms->aspace, &iova);
+
+			/* enable cursor: */
+			mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_SIZE(dma),
+					MDP4_DMA_CURSOR_SIZE_WIDTH(mdp4_crtc->cursor.width) |
+					MDP4_DMA_CURSOR_SIZE_HEIGHT(mdp4_crtc->cursor.height));
+			mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BASE(dma), iova);
+			mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BLEND_CONFIG(dma),
+					MDP4_DMA_CURSOR_BLEND_CONFIG_FORMAT(CURSOR_ARGB) |
+					MDP4_DMA_CURSOR_BLEND_CONFIG_CURSOR_EN);
+		} else {
+			/* disable cursor: */
+			mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BASE(dma),
+					mdp4_kms->blank_cursor_iova);
+		}
+
+		/* and drop the iova ref + obj rev when done scanning out: */
+		if (prev_bo)
+			drm_flip_work_queue(&mdp4_crtc->unref_cursor_work, prev_bo);
+
+		mdp4_crtc->cursor.scanout_bo = next_bo;
+		mdp4_crtc->cursor.stale = false;
+	}
+
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_POS(dma),
+			MDP4_DMA_CURSOR_POS_X(mdp4_crtc->cursor.x) |
+			MDP4_DMA_CURSOR_POS_Y(mdp4_crtc->cursor.y));
+
+	spin_unlock_irqrestore(&mdp4_crtc->cursor.lock, flags);
+}
+
+static int mdp4_crtc_cursor_set(struct drm_crtc *crtc,
+		struct drm_file *file_priv, uint32_t handle,
+		uint32_t width, uint32_t height)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+	struct msm_kms *kms = &mdp4_kms->base.base;
+	struct drm_device *dev = crtc->dev;
+	struct drm_gem_object *cursor_bo, *old_bo;
+	unsigned long flags;
+	uint64_t iova;
+	int ret;
+
+	if ((width > CURSOR_WIDTH) || (height > CURSOR_HEIGHT)) {
+		DRM_DEV_ERROR(dev->dev, "bad cursor size: %dx%d\n", width, height);
+		return -EINVAL;
+	}
+
+	if (handle) {
+		cursor_bo = drm_gem_object_lookup(file_priv, handle);
+		if (!cursor_bo)
+			return -ENOENT;
+	} else {
+		cursor_bo = NULL;
+	}
+
+	if (cursor_bo) {
+		ret = msm_gem_get_and_pin_iova(cursor_bo, kms->aspace, &iova);
+		if (ret)
+			goto fail;
+	} else {
+		iova = 0;
+	}
+
+	spin_lock_irqsave(&mdp4_crtc->cursor.lock, flags);
+	old_bo = mdp4_crtc->cursor.next_bo;
+	mdp4_crtc->cursor.next_bo   = cursor_bo;
+	mdp4_crtc->cursor.next_iova = iova;
+	mdp4_crtc->cursor.width     = width;
+	mdp4_crtc->cursor.height    = height;
+	mdp4_crtc->cursor.stale     = true;
+	spin_unlock_irqrestore(&mdp4_crtc->cursor.lock, flags);
+
+	if (old_bo) {
+		/* drop our previous reference: */
+		drm_flip_work_queue(&mdp4_crtc->unref_cursor_work, old_bo);
+	}
+
+	request_pending(crtc, PENDING_CURSOR);
+
+	return 0;
+
+fail:
+	drm_gem_object_put(cursor_bo);
+	return ret;
+}
+
+static int mdp4_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	unsigned long flags;
+
+	spin_lock_irqsave(&mdp4_crtc->cursor.lock, flags);
+	mdp4_crtc->cursor.x = x;
+	mdp4_crtc->cursor.y = y;
+	spin_unlock_irqrestore(&mdp4_crtc->cursor.lock, flags);
+
+	crtc_flush(crtc);
+	request_pending(crtc, PENDING_CURSOR);
+
+	return 0;
+}
+
+static const struct drm_crtc_funcs mdp4_crtc_funcs = {
+	.set_config = drm_atomic_helper_set_config,
+	.page_flip = drm_atomic_helper_page_flip,
+	.cursor_set = mdp4_crtc_cursor_set,
+	.cursor_move = mdp4_crtc_cursor_move,
+	.reset = drm_atomic_helper_crtc_reset,
+	.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
+	.enable_vblank  = msm_crtc_enable_vblank,
+	.disable_vblank = msm_crtc_disable_vblank,
+};
+
+static const struct drm_crtc_helper_funcs mdp4_crtc_helper_funcs = {
+	.mode_set_nofb = mdp4_crtc_mode_set_nofb,
+	.atomic_check = mdp4_crtc_atomic_check,
+	.atomic_begin = mdp4_crtc_atomic_begin,
+	.atomic_flush = mdp4_crtc_atomic_flush,
+	.atomic_enable = mdp4_crtc_atomic_enable,
+	.atomic_disable = mdp4_crtc_atomic_disable,
+};
+
+static void mdp4_crtc_vblank_irq(struct mdp_irq *irq, uint32_t irqstatus)
+{
+	struct mdp4_crtc *mdp4_crtc = container_of(irq, struct mdp4_crtc, vblank);
+	struct drm_crtc *crtc = &mdp4_crtc->base;
+	struct msm_drm_private *priv = crtc->dev->dev_private;
+	unsigned pending;
+
+	mdp_irq_unregister(&get_kms(crtc)->base, &mdp4_crtc->vblank);
+
+	pending = atomic_xchg(&mdp4_crtc->pending, 0);
+
+	if (pending & PENDING_FLIP) {
+		complete_flip(crtc, NULL);
+	}
+
+	if (pending & PENDING_CURSOR) {
+		update_cursor(crtc);
+		drm_flip_work_commit(&mdp4_crtc->unref_cursor_work, priv->wq);
+	}
+}
+
+static void mdp4_crtc_err_irq(struct mdp_irq *irq, uint32_t irqstatus)
+{
+	struct mdp4_crtc *mdp4_crtc = container_of(irq, struct mdp4_crtc, err);
+	struct drm_crtc *crtc = &mdp4_crtc->base;
+	DBG("%s: error: %08x", mdp4_crtc->name, irqstatus);
+	crtc_flush(crtc);
+}
+
+static void mdp4_crtc_wait_for_flush_done(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+	int ret;
+
+	ret = drm_crtc_vblank_get(crtc);
+	if (ret)
+		return;
+
+	ret = wait_event_timeout(dev->vblank[drm_crtc_index(crtc)].queue,
+		!(mdp4_read(mdp4_kms, REG_MDP4_OVERLAY_FLUSH) &
+			mdp4_crtc->flushed_mask),
+		msecs_to_jiffies(50));
+	if (ret <= 0)
+		dev_warn(dev->dev, "vblank time out, crtc=%d\n", mdp4_crtc->id);
+
+	mdp4_crtc->flushed_mask = 0;
+
+	drm_crtc_vblank_put(crtc);
+}
+
+uint32_t mdp4_crtc_vblank(struct drm_crtc *crtc)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	return mdp4_crtc->vblank.irqmask;
+}
+
+/* set dma config, ie. the format the encoder wants. */
+void mdp4_crtc_set_config(struct drm_crtc *crtc, uint32_t config)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_CONFIG(mdp4_crtc->dma), config);
+}
+
+/* set interface for routing crtc->encoder: */
+void mdp4_crtc_set_intf(struct drm_crtc *crtc, enum mdp4_intf intf, int mixer)
+{
+	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+	uint32_t intf_sel;
+
+	intf_sel = mdp4_read(mdp4_kms, REG_MDP4_DISP_INTF_SEL);
+
+	switch (mdp4_crtc->dma) {
+	case DMA_P:
+		intf_sel &= ~MDP4_DISP_INTF_SEL_PRIM__MASK;
+		intf_sel |= MDP4_DISP_INTF_SEL_PRIM(intf);
+		break;
+	case DMA_S:
+		intf_sel &= ~MDP4_DISP_INTF_SEL_SEC__MASK;
+		intf_sel |= MDP4_DISP_INTF_SEL_SEC(intf);
+		break;
+	case DMA_E:
+		intf_sel &= ~MDP4_DISP_INTF_SEL_EXT__MASK;
+		intf_sel |= MDP4_DISP_INTF_SEL_EXT(intf);
+		break;
+	}
+
+	if (intf == INTF_DSI_VIDEO) {
+		intf_sel &= ~MDP4_DISP_INTF_SEL_DSI_CMD;
+		intf_sel |= MDP4_DISP_INTF_SEL_DSI_VIDEO;
+	} else if (intf == INTF_DSI_CMD) {
+		intf_sel &= ~MDP4_DISP_INTF_SEL_DSI_VIDEO;
+		intf_sel |= MDP4_DISP_INTF_SEL_DSI_CMD;
+	}
+
+	mdp4_crtc->mixer = mixer;
+
+	blend_setup(crtc);
+
+	DBG("%s: intf_sel=%08x", mdp4_crtc->name, intf_sel);
+
+	mdp4_write(mdp4_kms, REG_MDP4_DISP_INTF_SEL, intf_sel);
+}
+
+void mdp4_crtc_wait_for_commit_done(struct drm_crtc *crtc)
+{
+	/* wait_for_flush_done is the only case for now.
+	 * Later we will have command mode CRTC to wait for
+	 * other event.
+	 */
+	mdp4_crtc_wait_for_flush_done(crtc);
+}
+
+static const char *dma_names[] = {
+		"DMA_P", "DMA_S", "DMA_E",
+};
+
+static void mdp4_crtc_flip_cleanup(struct drm_device *dev, void *ptr)
+{
+	struct mdp4_crtc *mdp4_crtc = ptr;
+
+	drm_flip_work_cleanup(&mdp4_crtc->unref_cursor_work);
+}
+
+/* initialize crtc */
+struct drm_crtc *mdp4_crtc_init(struct drm_device *dev,
+		struct drm_plane *plane, int id, int ovlp_id,
+		enum mdp4_dma dma_id)
+{
+	struct drm_crtc *crtc = NULL;
+	struct mdp4_crtc *mdp4_crtc;
+	int ret;
+
+	mdp4_crtc = drmm_crtc_alloc_with_planes(dev, struct mdp4_crtc, base,
+						plane, NULL,
+						&mdp4_crtc_funcs, NULL);
+	if (IS_ERR(mdp4_crtc))
+		return ERR_CAST(mdp4_crtc);
+
+	crtc = &mdp4_crtc->base;
+
+	mdp4_crtc->id = id;
+
+	mdp4_crtc->ovlp = ovlp_id;
+	mdp4_crtc->dma = dma_id;
+
+	mdp4_crtc->vblank.irqmask = dma2irq(mdp4_crtc->dma);
+	mdp4_crtc->vblank.irq = mdp4_crtc_vblank_irq;
+
+	mdp4_crtc->err.irqmask = dma2err(mdp4_crtc->dma);
+	mdp4_crtc->err.irq = mdp4_crtc_err_irq;
+
+	snprintf(mdp4_crtc->name, sizeof(mdp4_crtc->name), "%s:%d",
+			dma_names[dma_id], ovlp_id);
+
+	spin_lock_init(&mdp4_crtc->cursor.lock);
+
+	drm_flip_work_init(&mdp4_crtc->unref_cursor_work,
+			"unref cursor", unref_cursor_worker);
+	ret = drmm_add_action_or_reset(dev, mdp4_crtc_flip_cleanup, mdp4_crtc);
+	if (ret)
+		return ERR_PTR(ret);
+
+	drm_crtc_helper_add(crtc, &mdp4_crtc_helper_funcs);
+
+	return crtc;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_dsi_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_dsi_encoder.c
@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, Inforce Computing. All rights reserved.
+ *
+ * Author: Vinay Simha <vinaysimha@inforcecomputing.com>
+ */
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_probe_helper.h>
+
+#include "mdp4_kms.h"
+
+#ifdef CONFIG_DRM_MSM_DSI
+
+struct mdp4_dsi_encoder {
+	struct drm_encoder base;
+	struct drm_panel *panel;
+	bool enabled;
+};
+#define to_mdp4_dsi_encoder(x) container_of(x, struct mdp4_dsi_encoder, base)
+
+static struct mdp4_kms *get_kms(struct drm_encoder *encoder)
+{
+	struct msm_drm_private *priv = encoder->dev->dev_private;
+	return to_mdp4_kms(to_mdp_kms(priv->kms));
+}
+
+static void mdp4_dsi_encoder_mode_set(struct drm_encoder *encoder,
+				      struct drm_display_mode *mode,
+				      struct drm_display_mode *adjusted_mode)
+{
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+	uint32_t dsi_hsync_skew, vsync_period, vsync_len, ctrl_pol;
+	uint32_t display_v_start, display_v_end;
+	uint32_t hsync_start_x, hsync_end_x;
+
+	mode = adjusted_mode;
+
+	DBG("set mode: " DRM_MODE_FMT, DRM_MODE_ARG(mode));
+
+	ctrl_pol = 0;
+	if (mode->flags & DRM_MODE_FLAG_NHSYNC)
+		ctrl_pol |= MDP4_DSI_CTRL_POLARITY_HSYNC_LOW;
+	if (mode->flags & DRM_MODE_FLAG_NVSYNC)
+		ctrl_pol |= MDP4_DSI_CTRL_POLARITY_VSYNC_LOW;
+	/* probably need to get DATA_EN polarity from panel.. */
+
+	dsi_hsync_skew = 0;  /* get this from panel? */
+
+	hsync_start_x = (mode->htotal - mode->hsync_start);
+	hsync_end_x = mode->htotal - (mode->hsync_start - mode->hdisplay) - 1;
+
+	vsync_period = mode->vtotal * mode->htotal;
+	vsync_len = (mode->vsync_end - mode->vsync_start) * mode->htotal;
+	display_v_start = (mode->vtotal - mode->vsync_start) * mode->htotal + dsi_hsync_skew;
+	display_v_end = vsync_period - ((mode->vsync_start - mode->vdisplay) * mode->htotal) + dsi_hsync_skew - 1;
+
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_HSYNC_CTRL,
+			MDP4_DSI_HSYNC_CTRL_PULSEW(mode->hsync_end - mode->hsync_start) |
+			MDP4_DSI_HSYNC_CTRL_PERIOD(mode->htotal));
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_VSYNC_PERIOD, vsync_period);
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_VSYNC_LEN, vsync_len);
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_DISPLAY_HCTRL,
+			MDP4_DSI_DISPLAY_HCTRL_START(hsync_start_x) |
+			MDP4_DSI_DISPLAY_HCTRL_END(hsync_end_x));
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_DISPLAY_VSTART, display_v_start);
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_DISPLAY_VEND, display_v_end);
+
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_CTRL_POLARITY, ctrl_pol);
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_UNDERFLOW_CLR,
+			MDP4_DSI_UNDERFLOW_CLR_ENABLE_RECOVERY |
+			MDP4_DSI_UNDERFLOW_CLR_COLOR(0xff));
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_ACTIVE_HCTL,
+			MDP4_DSI_ACTIVE_HCTL_START(0) |
+			MDP4_DSI_ACTIVE_HCTL_END(0));
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_HSYNC_SKEW, dsi_hsync_skew);
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_BORDER_CLR, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_ACTIVE_VSTART, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_ACTIVE_VEND, 0);
+}
+
+static void mdp4_dsi_encoder_disable(struct drm_encoder *encoder)
+{
+	struct mdp4_dsi_encoder *mdp4_dsi_encoder = to_mdp4_dsi_encoder(encoder);
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+
+	if (!mdp4_dsi_encoder->enabled)
+		return;
+
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_ENABLE, 0);
+
+	/*
+	 * Wait for a vsync so we know the ENABLE=0 latched before
+	 * the (connector) source of the vsync's gets disabled,
+	 * otherwise we end up in a funny state if we re-enable
+	 * before the disable latches, which results that some of
+	 * the settings changes for the new modeset (like new
+	 * scanout buffer) don't latch properly..
+	 */
+	mdp_irq_wait(&mdp4_kms->base, MDP4_IRQ_PRIMARY_VSYNC);
+
+	mdp4_dsi_encoder->enabled = false;
+}
+
+static void mdp4_dsi_encoder_enable(struct drm_encoder *encoder)
+{
+	struct mdp4_dsi_encoder *mdp4_dsi_encoder = to_mdp4_dsi_encoder(encoder);
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+
+	if (mdp4_dsi_encoder->enabled)
+		return;
+
+	mdp4_crtc_set_config(encoder->crtc,
+			MDP4_DMA_CONFIG_PACK_ALIGN_MSB |
+			MDP4_DMA_CONFIG_DEFLKR_EN |
+			MDP4_DMA_CONFIG_DITHER_EN |
+			MDP4_DMA_CONFIG_R_BPC(BPC8) |
+			MDP4_DMA_CONFIG_G_BPC(BPC8) |
+			MDP4_DMA_CONFIG_B_BPC(BPC8) |
+			MDP4_DMA_CONFIG_PACK(0x21));
+
+	mdp4_crtc_set_intf(encoder->crtc, INTF_DSI_VIDEO, 0);
+
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_ENABLE, 1);
+
+	mdp4_dsi_encoder->enabled = true;
+}
+
+static const struct drm_encoder_helper_funcs mdp4_dsi_encoder_helper_funcs = {
+	.mode_set = mdp4_dsi_encoder_mode_set,
+	.disable = mdp4_dsi_encoder_disable,
+	.enable = mdp4_dsi_encoder_enable,
+};
+
+/* initialize encoder */
+struct drm_encoder *mdp4_dsi_encoder_init(struct drm_device *dev)
+{
+	struct drm_encoder *encoder;
+	struct mdp4_dsi_encoder *mdp4_dsi_encoder;
+
+	mdp4_dsi_encoder = drmm_encoder_alloc(dev, struct mdp4_dsi_encoder, base,
+					      NULL, DRM_MODE_ENCODER_DSI, NULL);
+	if (IS_ERR(mdp4_dsi_encoder))
+		return ERR_CAST(mdp4_dsi_encoder);
+
+	encoder = &mdp4_dsi_encoder->base;
+
+	drm_encoder_helper_add(encoder, &mdp4_dsi_encoder_helper_funcs);
+
+	return encoder;
+}
+#endif /* CONFIG_DRM_MSM_DSI */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_dtv_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_dtv_encoder.c
@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_probe_helper.h>
+
+#include "mdp4_kms.h"
+
+struct mdp4_dtv_encoder {
+	struct drm_encoder base;
+	struct clk *hdmi_clk;
+	struct clk *mdp_clk;
+	unsigned long int pixclock;
+	bool enabled;
+	uint32_t bsc;
+};
+#define to_mdp4_dtv_encoder(x) container_of(x, struct mdp4_dtv_encoder, base)
+
+static struct mdp4_kms *get_kms(struct drm_encoder *encoder)
+{
+	struct msm_drm_private *priv = encoder->dev->dev_private;
+	return to_mdp4_kms(to_mdp_kms(priv->kms));
+}
+
+static void mdp4_dtv_encoder_mode_set(struct drm_encoder *encoder,
+		struct drm_display_mode *mode,
+		struct drm_display_mode *adjusted_mode)
+{
+	struct mdp4_dtv_encoder *mdp4_dtv_encoder = to_mdp4_dtv_encoder(encoder);
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+	uint32_t dtv_hsync_skew, vsync_period, vsync_len, ctrl_pol;
+	uint32_t display_v_start, display_v_end;
+	uint32_t hsync_start_x, hsync_end_x;
+
+	mode = adjusted_mode;
+
+	DBG("set mode: " DRM_MODE_FMT, DRM_MODE_ARG(mode));
+
+	mdp4_dtv_encoder->pixclock = mode->clock * 1000;
+
+	DBG("pixclock=%lu", mdp4_dtv_encoder->pixclock);
+
+	ctrl_pol = 0;
+	if (mode->flags & DRM_MODE_FLAG_NHSYNC)
+		ctrl_pol |= MDP4_DTV_CTRL_POLARITY_HSYNC_LOW;
+	if (mode->flags & DRM_MODE_FLAG_NVSYNC)
+		ctrl_pol |= MDP4_DTV_CTRL_POLARITY_VSYNC_LOW;
+	/* probably need to get DATA_EN polarity from panel.. */
+
+	dtv_hsync_skew = 0;  /* get this from panel? */
+
+	hsync_start_x = (mode->htotal - mode->hsync_start);
+	hsync_end_x = mode->htotal - (mode->hsync_start - mode->hdisplay) - 1;
+
+	vsync_period = mode->vtotal * mode->htotal;
+	vsync_len = (mode->vsync_end - mode->vsync_start) * mode->htotal;
+	display_v_start = (mode->vtotal - mode->vsync_start) * mode->htotal + dtv_hsync_skew;
+	display_v_end = vsync_period - ((mode->vsync_start - mode->vdisplay) * mode->htotal) + dtv_hsync_skew - 1;
+
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_HSYNC_CTRL,
+			MDP4_DTV_HSYNC_CTRL_PULSEW(mode->hsync_end - mode->hsync_start) |
+			MDP4_DTV_HSYNC_CTRL_PERIOD(mode->htotal));
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_VSYNC_PERIOD, vsync_period);
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_VSYNC_LEN, vsync_len);
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_DISPLAY_HCTRL,
+			MDP4_DTV_DISPLAY_HCTRL_START(hsync_start_x) |
+			MDP4_DTV_DISPLAY_HCTRL_END(hsync_end_x));
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_DISPLAY_VSTART, display_v_start);
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_DISPLAY_VEND, display_v_end);
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_BORDER_CLR, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_UNDERFLOW_CLR,
+			MDP4_DTV_UNDERFLOW_CLR_ENABLE_RECOVERY |
+			MDP4_DTV_UNDERFLOW_CLR_COLOR(0xff));
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_HSYNC_SKEW, dtv_hsync_skew);
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_CTRL_POLARITY, ctrl_pol);
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_ACTIVE_HCTL,
+			MDP4_DTV_ACTIVE_HCTL_START(0) |
+			MDP4_DTV_ACTIVE_HCTL_END(0));
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_ACTIVE_VSTART, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_ACTIVE_VEND, 0);
+}
+
+static void mdp4_dtv_encoder_disable(struct drm_encoder *encoder)
+{
+	struct mdp4_dtv_encoder *mdp4_dtv_encoder = to_mdp4_dtv_encoder(encoder);
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+
+	if (WARN_ON(!mdp4_dtv_encoder->enabled))
+		return;
+
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_ENABLE, 0);
+
+	/*
+	 * Wait for a vsync so we know the ENABLE=0 latched before
+	 * the (connector) source of the vsync's gets disabled,
+	 * otherwise we end up in a funny state if we re-enable
+	 * before the disable latches, which results that some of
+	 * the settings changes for the new modeset (like new
+	 * scanout buffer) don't latch properly..
+	 */
+	mdp_irq_wait(&mdp4_kms->base, MDP4_IRQ_EXTERNAL_VSYNC);
+
+	clk_disable_unprepare(mdp4_dtv_encoder->hdmi_clk);
+	clk_disable_unprepare(mdp4_dtv_encoder->mdp_clk);
+
+	mdp4_dtv_encoder->enabled = false;
+}
+
+static void mdp4_dtv_encoder_enable(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct mdp4_dtv_encoder *mdp4_dtv_encoder = to_mdp4_dtv_encoder(encoder);
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+	unsigned long pc = mdp4_dtv_encoder->pixclock;
+	int ret;
+
+	if (WARN_ON(mdp4_dtv_encoder->enabled))
+		return;
+
+	mdp4_crtc_set_config(encoder->crtc,
+			MDP4_DMA_CONFIG_R_BPC(BPC8) |
+			MDP4_DMA_CONFIG_G_BPC(BPC8) |
+			MDP4_DMA_CONFIG_B_BPC(BPC8) |
+			MDP4_DMA_CONFIG_PACK(0x21));
+	mdp4_crtc_set_intf(encoder->crtc, INTF_LCDC_DTV, 1);
+
+	DBG("setting mdp_clk=%lu", pc);
+
+	ret = clk_set_rate(mdp4_dtv_encoder->mdp_clk, pc);
+	if (ret)
+		DRM_DEV_ERROR(dev->dev, "failed to set mdp_clk to %lu: %d\n",
+			pc, ret);
+
+	ret = clk_prepare_enable(mdp4_dtv_encoder->mdp_clk);
+	if (ret)
+		DRM_DEV_ERROR(dev->dev, "failed to enabled mdp_clk: %d\n", ret);
+
+	ret = clk_prepare_enable(mdp4_dtv_encoder->hdmi_clk);
+	if (ret)
+		DRM_DEV_ERROR(dev->dev, "failed to enable hdmi_clk: %d\n", ret);
+
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_ENABLE, 1);
+
+	mdp4_dtv_encoder->enabled = true;
+}
+
+static const struct drm_encoder_helper_funcs mdp4_dtv_encoder_helper_funcs = {
+	.mode_set = mdp4_dtv_encoder_mode_set,
+	.enable = mdp4_dtv_encoder_enable,
+	.disable = mdp4_dtv_encoder_disable,
+};
+
+long mdp4_dtv_round_pixclk(struct drm_encoder *encoder, unsigned long rate)
+{
+	struct mdp4_dtv_encoder *mdp4_dtv_encoder = to_mdp4_dtv_encoder(encoder);
+	return clk_round_rate(mdp4_dtv_encoder->mdp_clk, rate);
+}
+
+/* initialize encoder */
+struct drm_encoder *mdp4_dtv_encoder_init(struct drm_device *dev)
+{
+	struct drm_encoder *encoder;
+	struct mdp4_dtv_encoder *mdp4_dtv_encoder;
+
+	mdp4_dtv_encoder = drmm_encoder_alloc(dev, struct mdp4_dtv_encoder, base,
+					      NULL, DRM_MODE_ENCODER_TMDS, NULL);
+	if (IS_ERR(mdp4_dtv_encoder))
+		return ERR_CAST(mdp4_dtv_encoder);
+
+	encoder = &mdp4_dtv_encoder->base;
+
+	drm_encoder_helper_add(encoder, &mdp4_dtv_encoder_helper_funcs);
+
+	mdp4_dtv_encoder->hdmi_clk = devm_clk_get(dev->dev, "hdmi_clk");
+	if (IS_ERR(mdp4_dtv_encoder->hdmi_clk)) {
+		DRM_DEV_ERROR(dev->dev, "failed to get hdmi_clk\n");
+		return ERR_CAST(mdp4_dtv_encoder->hdmi_clk);
+	}
+
+	mdp4_dtv_encoder->mdp_clk = devm_clk_get(dev->dev, "tv_clk");
+	if (IS_ERR(mdp4_dtv_encoder->mdp_clk)) {
+		DRM_DEV_ERROR(dev->dev, "failed to get tv_clk\n");
+		return ERR_CAST(mdp4_dtv_encoder->mdp_clk);
+	}
+
+	return encoder;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_irq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_irq.c
@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_print.h>
+#include <drm/drm_vblank.h>
+
+#include "msm_drv.h"
+#include "mdp4_kms.h"
+
+void mdp4_set_irqmask(struct mdp_kms *mdp_kms, uint32_t irqmask,
+		uint32_t old_irqmask)
+{
+	mdp4_write(to_mdp4_kms(mdp_kms), REG_MDP4_INTR_CLEAR,
+		irqmask ^ (irqmask & old_irqmask));
+	mdp4_write(to_mdp4_kms(mdp_kms), REG_MDP4_INTR_ENABLE, irqmask);
+}
+
+static void mdp4_irq_error_handler(struct mdp_irq *irq, uint32_t irqstatus)
+{
+	struct mdp4_kms *mdp4_kms = container_of(irq, struct mdp4_kms, error_handler);
+	static DEFINE_RATELIMIT_STATE(rs, 5*HZ, 1);
+	extern bool dumpstate;
+
+	DRM_ERROR_RATELIMITED("errors: %08x\n", irqstatus);
+
+	if (dumpstate && __ratelimit(&rs)) {
+		struct drm_printer p = drm_info_printer(mdp4_kms->dev->dev);
+		drm_state_dump(mdp4_kms->dev, &p);
+	}
+}
+
+void mdp4_irq_preinstall(struct msm_kms *kms)
+{
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+	mdp4_enable(mdp4_kms);
+	mdp4_write(mdp4_kms, REG_MDP4_INTR_CLEAR, 0xffffffff);
+	mdp4_write(mdp4_kms, REG_MDP4_INTR_ENABLE, 0x00000000);
+	mdp4_disable(mdp4_kms);
+}
+
+int mdp4_irq_postinstall(struct msm_kms *kms)
+{
+	struct mdp_kms *mdp_kms = to_mdp_kms(kms);
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(mdp_kms);
+	struct mdp_irq *error_handler = &mdp4_kms->error_handler;
+
+	error_handler->irq = mdp4_irq_error_handler;
+	error_handler->irqmask = MDP4_IRQ_PRIMARY_INTF_UDERRUN |
+			MDP4_IRQ_EXTERNAL_INTF_UDERRUN;
+
+	mdp_irq_register(mdp_kms, error_handler);
+
+	return 0;
+}
+
+void mdp4_irq_uninstall(struct msm_kms *kms)
+{
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+	mdp4_enable(mdp4_kms);
+	mdp4_write(mdp4_kms, REG_MDP4_INTR_ENABLE, 0x00000000);
+	mdp4_disable(mdp4_kms);
+}
+
+irqreturn_t mdp4_irq(struct msm_kms *kms)
+{
+	struct mdp_kms *mdp_kms = to_mdp_kms(kms);
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(mdp_kms);
+	struct drm_device *dev = mdp4_kms->dev;
+	struct drm_crtc *crtc;
+	uint32_t status, enable;
+
+	enable = mdp4_read(mdp4_kms, REG_MDP4_INTR_ENABLE);
+	status = mdp4_read(mdp4_kms, REG_MDP4_INTR_STATUS) & enable;
+	mdp4_write(mdp4_kms, REG_MDP4_INTR_CLEAR, status);
+
+	VERB("status=%08x", status);
+
+	mdp_dispatch_irqs(mdp_kms, status);
+
+	drm_for_each_crtc(crtc, dev)
+		if (status & mdp4_crtc_vblank(crtc))
+			drm_crtc_handle_vblank(crtc);
+
+	return IRQ_HANDLED;
+}
+
+int mdp4_enable_vblank(struct msm_kms *kms, struct drm_crtc *crtc)
+{
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+
+	mdp4_enable(mdp4_kms);
+	mdp_update_vblank_mask(to_mdp_kms(kms),
+			mdp4_crtc_vblank(crtc), true);
+	mdp4_disable(mdp4_kms);
+
+	return 0;
+}
+
+void mdp4_disable_vblank(struct msm_kms *kms, struct drm_crtc *crtc)
+{
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+
+	mdp4_enable(mdp4_kms);
+	mdp_update_vblank_mask(to_mdp_kms(kms),
+			mdp4_crtc_vblank(crtc), false);
+	mdp4_disable(mdp4_kms);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_kms.c
@@ -0,0 +1,589 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/delay.h>
+
+#include <drm/drm_vblank.h>
+
+#include "msm_drv.h"
+#include "msm_gem.h"
+#include "msm_mmu.h"
+#include "mdp4_kms.h"
+
+static int mdp4_hw_init(struct msm_kms *kms)
+{
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+	struct drm_device *dev = mdp4_kms->dev;
+	u32 dmap_cfg, vg_cfg;
+	unsigned long clk;
+
+	pm_runtime_get_sync(dev->dev);
+
+	if (mdp4_kms->rev > 1) {
+		mdp4_write(mdp4_kms, REG_MDP4_CS_CONTROLLER0, 0x0707ffff);
+		mdp4_write(mdp4_kms, REG_MDP4_CS_CONTROLLER1, 0x03073f3f);
+	}
+
+	mdp4_write(mdp4_kms, REG_MDP4_PORTMAP_MODE, 0x3);
+
+	/* max read pending cmd config, 3 pending requests: */
+	mdp4_write(mdp4_kms, REG_MDP4_READ_CNFG, 0x02222);
+
+	clk = clk_get_rate(mdp4_kms->clk);
+
+	if ((mdp4_kms->rev >= 1) || (clk >= 90000000)) {
+		dmap_cfg = 0x47;     /* 16 bytes-burst x 8 req */
+		vg_cfg = 0x47;       /* 16 bytes-burs x 8 req */
+	} else {
+		dmap_cfg = 0x27;     /* 8 bytes-burst x 8 req */
+		vg_cfg = 0x43;       /* 16 bytes-burst x 4 req */
+	}
+
+	DBG("fetch config: dmap=%02x, vg=%02x", dmap_cfg, vg_cfg);
+
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_FETCH_CONFIG(DMA_P), dmap_cfg);
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_FETCH_CONFIG(DMA_E), dmap_cfg);
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_FETCH_CONFIG(VG1), vg_cfg);
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_FETCH_CONFIG(VG2), vg_cfg);
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_FETCH_CONFIG(RGB1), vg_cfg);
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_FETCH_CONFIG(RGB2), vg_cfg);
+
+	if (mdp4_kms->rev >= 2)
+		mdp4_write(mdp4_kms, REG_MDP4_LAYERMIXER_IN_CFG_UPDATE_METHOD, 1);
+	mdp4_write(mdp4_kms, REG_MDP4_LAYERMIXER_IN_CFG, 0);
+
+	/* disable CSC matrix / YUV by default: */
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_OP_MODE(VG1), 0);
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_OP_MODE(VG2), 0);
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_P_OP_MODE, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_DMA_S_OP_MODE, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_CSC_CONFIG(1), 0);
+	mdp4_write(mdp4_kms, REG_MDP4_OVLP_CSC_CONFIG(2), 0);
+
+	if (mdp4_kms->rev > 1)
+		mdp4_write(mdp4_kms, REG_MDP4_RESET_STATUS, 1);
+
+	pm_runtime_put_sync(dev->dev);
+
+	return 0;
+}
+
+static void mdp4_enable_commit(struct msm_kms *kms)
+{
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+	mdp4_enable(mdp4_kms);
+}
+
+static void mdp4_disable_commit(struct msm_kms *kms)
+{
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+	mdp4_disable(mdp4_kms);
+}
+
+static void mdp4_flush_commit(struct msm_kms *kms, unsigned crtc_mask)
+{
+	/* TODO */
+}
+
+static void mdp4_wait_flush(struct msm_kms *kms, unsigned crtc_mask)
+{
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+	struct drm_crtc *crtc;
+
+	for_each_crtc_mask(mdp4_kms->dev, crtc, crtc_mask)
+		mdp4_crtc_wait_for_commit_done(crtc);
+}
+
+static void mdp4_complete_commit(struct msm_kms *kms, unsigned crtc_mask)
+{
+}
+
+static long mdp4_round_pixclk(struct msm_kms *kms, unsigned long rate,
+		struct drm_encoder *encoder)
+{
+	/* if we had >1 encoder, we'd need something more clever: */
+	switch (encoder->encoder_type) {
+	case DRM_MODE_ENCODER_TMDS:
+		return mdp4_dtv_round_pixclk(encoder, rate);
+	case DRM_MODE_ENCODER_LVDS:
+	case DRM_MODE_ENCODER_DSI:
+	default:
+		return rate;
+	}
+}
+
+static void mdp4_destroy(struct msm_kms *kms)
+{
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+	struct device *dev = mdp4_kms->dev->dev;
+	struct msm_gem_address_space *aspace = kms->aspace;
+
+	if (mdp4_kms->blank_cursor_iova)
+		msm_gem_unpin_iova(mdp4_kms->blank_cursor_bo, kms->aspace);
+	drm_gem_object_put(mdp4_kms->blank_cursor_bo);
+
+	if (aspace) {
+		aspace->mmu->funcs->detach(aspace->mmu);
+		msm_gem_address_space_put(aspace);
+	}
+
+	if (mdp4_kms->rpm_enabled)
+		pm_runtime_disable(dev);
+
+	mdp_kms_destroy(&mdp4_kms->base);
+}
+
+static const struct mdp_kms_funcs kms_funcs = {
+	.base = {
+		.hw_init         = mdp4_hw_init,
+		.irq_preinstall  = mdp4_irq_preinstall,
+		.irq_postinstall = mdp4_irq_postinstall,
+		.irq_uninstall   = mdp4_irq_uninstall,
+		.irq             = mdp4_irq,
+		.enable_vblank   = mdp4_enable_vblank,
+		.disable_vblank  = mdp4_disable_vblank,
+		.enable_commit   = mdp4_enable_commit,
+		.disable_commit  = mdp4_disable_commit,
+		.flush_commit    = mdp4_flush_commit,
+		.wait_flush      = mdp4_wait_flush,
+		.complete_commit = mdp4_complete_commit,
+		.get_format      = mdp_get_format,
+		.round_pixclk    = mdp4_round_pixclk,
+		.destroy         = mdp4_destroy,
+	},
+	.set_irqmask         = mdp4_set_irqmask,
+};
+
+int mdp4_disable(struct mdp4_kms *mdp4_kms)
+{
+	DBG("");
+
+	clk_disable_unprepare(mdp4_kms->clk);
+	clk_disable_unprepare(mdp4_kms->pclk);
+	clk_disable_unprepare(mdp4_kms->lut_clk);
+	clk_disable_unprepare(mdp4_kms->axi_clk);
+
+	return 0;
+}
+
+int mdp4_enable(struct mdp4_kms *mdp4_kms)
+{
+	DBG("");
+
+	clk_prepare_enable(mdp4_kms->clk);
+	clk_prepare_enable(mdp4_kms->pclk);
+	clk_prepare_enable(mdp4_kms->lut_clk);
+	clk_prepare_enable(mdp4_kms->axi_clk);
+
+	return 0;
+}
+
+
+static int mdp4_modeset_init_intf(struct mdp4_kms *mdp4_kms,
+				  int intf_type)
+{
+	struct drm_device *dev = mdp4_kms->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct drm_encoder *encoder;
+	struct drm_connector *connector;
+	struct device_node *panel_node;
+	int dsi_id;
+	int ret;
+
+	switch (intf_type) {
+	case DRM_MODE_ENCODER_LVDS:
+		/*
+		 * bail out early if there is no panel node (no need to
+		 * initialize LCDC encoder and LVDS connector)
+		 */
+		panel_node = of_graph_get_remote_node(dev->dev->of_node, 0, 0);
+		if (!panel_node)
+			return 0;
+
+		encoder = mdp4_lcdc_encoder_init(dev, panel_node);
+		if (IS_ERR(encoder)) {
+			DRM_DEV_ERROR(dev->dev, "failed to construct LCDC encoder\n");
+			of_node_put(panel_node);
+			return PTR_ERR(encoder);
+		}
+
+		/* LCDC can be hooked to DMA_P (TODO: Add DMA_S later?) */
+		encoder->possible_crtcs = 1 << DMA_P;
+
+		connector = mdp4_lvds_connector_init(dev, panel_node, encoder);
+		if (IS_ERR(connector)) {
+			DRM_DEV_ERROR(dev->dev, "failed to initialize LVDS connector\n");
+			of_node_put(panel_node);
+			return PTR_ERR(connector);
+		}
+
+		break;
+	case DRM_MODE_ENCODER_TMDS:
+		encoder = mdp4_dtv_encoder_init(dev);
+		if (IS_ERR(encoder)) {
+			DRM_DEV_ERROR(dev->dev, "failed to construct DTV encoder\n");
+			return PTR_ERR(encoder);
+		}
+
+		/* DTV can be hooked to DMA_E: */
+		encoder->possible_crtcs = 1 << 1;
+
+		if (priv->hdmi) {
+			/* Construct bridge/connector for HDMI: */
+			ret = msm_hdmi_modeset_init(priv->hdmi, dev, encoder);
+			if (ret) {
+				DRM_DEV_ERROR(dev->dev, "failed to initialize HDMI: %d\n", ret);
+				return ret;
+			}
+		}
+
+		break;
+	case DRM_MODE_ENCODER_DSI:
+		/* only DSI1 supported for now */
+		dsi_id = 0;
+
+		if (!priv->dsi[dsi_id])
+			break;
+
+		encoder = mdp4_dsi_encoder_init(dev);
+		if (IS_ERR(encoder)) {
+			ret = PTR_ERR(encoder);
+			DRM_DEV_ERROR(dev->dev,
+				"failed to construct DSI encoder: %d\n", ret);
+			return ret;
+		}
+
+		/* TODO: Add DMA_S later? */
+		encoder->possible_crtcs = 1 << DMA_P;
+
+		ret = msm_dsi_modeset_init(priv->dsi[dsi_id], dev, encoder);
+		if (ret) {
+			DRM_DEV_ERROR(dev->dev, "failed to initialize DSI: %d\n",
+				ret);
+			return ret;
+		}
+
+		break;
+	default:
+		DRM_DEV_ERROR(dev->dev, "Invalid or unsupported interface\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int modeset_init(struct mdp4_kms *mdp4_kms)
+{
+	struct drm_device *dev = mdp4_kms->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct drm_plane *plane;
+	struct drm_crtc *crtc;
+	int i, ret;
+	static const enum mdp4_pipe rgb_planes[] = {
+		RGB1, RGB2,
+	};
+	static const enum mdp4_pipe vg_planes[] = {
+		VG1, VG2,
+	};
+	static const enum mdp4_dma mdp4_crtcs[] = {
+		DMA_P, DMA_E,
+	};
+	static const char * const mdp4_crtc_names[] = {
+		"DMA_P", "DMA_E",
+	};
+	static const int mdp4_intfs[] = {
+		DRM_MODE_ENCODER_LVDS,
+		DRM_MODE_ENCODER_DSI,
+		DRM_MODE_ENCODER_TMDS,
+	};
+
+	/* construct non-private planes: */
+	for (i = 0; i < ARRAY_SIZE(vg_planes); i++) {
+		plane = mdp4_plane_init(dev, vg_planes[i], false);
+		if (IS_ERR(plane)) {
+			DRM_DEV_ERROR(dev->dev,
+				"failed to construct plane for VG%d\n", i + 1);
+			ret = PTR_ERR(plane);
+			goto fail;
+		}
+	}
+
+	for (i = 0; i < ARRAY_SIZE(mdp4_crtcs); i++) {
+		plane = mdp4_plane_init(dev, rgb_planes[i], true);
+		if (IS_ERR(plane)) {
+			DRM_DEV_ERROR(dev->dev,
+				"failed to construct plane for RGB%d\n", i + 1);
+			ret = PTR_ERR(plane);
+			goto fail;
+		}
+
+		crtc  = mdp4_crtc_init(dev, plane, priv->num_crtcs, i,
+				mdp4_crtcs[i]);
+		if (IS_ERR(crtc)) {
+			DRM_DEV_ERROR(dev->dev, "failed to construct crtc for %s\n",
+				mdp4_crtc_names[i]);
+			ret = PTR_ERR(crtc);
+			goto fail;
+		}
+
+		priv->num_crtcs++;
+	}
+
+	/*
+	 * we currently set up two relatively fixed paths:
+	 *
+	 * LCDC/LVDS path: RGB1 -> DMA_P -> LCDC -> LVDS
+	 *			or
+	 * DSI path: RGB1 -> DMA_P -> DSI1 -> DSI Panel
+	 *
+	 * DTV/HDMI path: RGB2 -> DMA_E -> DTV -> HDMI
+	 */
+
+	for (i = 0; i < ARRAY_SIZE(mdp4_intfs); i++) {
+		ret = mdp4_modeset_init_intf(mdp4_kms, mdp4_intfs[i]);
+		if (ret) {
+			DRM_DEV_ERROR(dev->dev, "failed to initialize intf: %d, %d\n",
+				i, ret);
+			goto fail;
+		}
+	}
+
+	return 0;
+
+fail:
+	return ret;
+}
+
+static void read_mdp_hw_revision(struct mdp4_kms *mdp4_kms,
+				 u32 *major, u32 *minor)
+{
+	struct drm_device *dev = mdp4_kms->dev;
+	u32 version;
+
+	mdp4_enable(mdp4_kms);
+	version = mdp4_read(mdp4_kms, REG_MDP4_VERSION);
+	mdp4_disable(mdp4_kms);
+
+	*major = FIELD(version, MDP4_VERSION_MAJOR);
+	*minor = FIELD(version, MDP4_VERSION_MINOR);
+
+	DRM_DEV_INFO(dev->dev, "MDP4 version v%d.%d", *major, *minor);
+}
+
+static int mdp4_kms_init(struct drm_device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev->dev);
+	struct msm_drm_private *priv = dev->dev_private;
+	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(priv->kms));
+	struct msm_kms *kms = NULL;
+	struct msm_mmu *mmu;
+	struct msm_gem_address_space *aspace;
+	int ret;
+	u32 major, minor;
+	unsigned long max_clk;
+
+	/* TODO: Chips that aren't apq8064 have a 200 Mhz max_clk */
+	max_clk = 266667000;
+
+	ret = mdp_kms_init(&mdp4_kms->base, &kms_funcs);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "failed to init kms\n");
+		goto fail;
+	}
+
+	kms = priv->kms;
+
+	mdp4_kms->dev = dev;
+
+	if (mdp4_kms->vdd) {
+		ret = regulator_enable(mdp4_kms->vdd);
+		if (ret) {
+			DRM_DEV_ERROR(dev->dev, "failed to enable regulator vdd: %d\n", ret);
+			goto fail;
+		}
+	}
+
+	clk_set_rate(mdp4_kms->clk, max_clk);
+
+	read_mdp_hw_revision(mdp4_kms, &major, &minor);
+
+	if (major != 4) {
+		DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n",
+			      major, minor);
+		ret = -ENXIO;
+		goto fail;
+	}
+
+	mdp4_kms->rev = minor;
+
+	if (mdp4_kms->rev >= 2) {
+		if (!mdp4_kms->lut_clk) {
+			DRM_DEV_ERROR(dev->dev, "failed to get lut_clk\n");
+			ret = -ENODEV;
+			goto fail;
+		}
+		clk_set_rate(mdp4_kms->lut_clk, max_clk);
+	}
+
+	pm_runtime_enable(dev->dev);
+	mdp4_kms->rpm_enabled = true;
+
+	/* make sure things are off before attaching iommu (bootloader could
+	 * have left things on, in which case we'll start getting faults if
+	 * we don't disable):
+	 */
+	mdp4_enable(mdp4_kms);
+	mdp4_write(mdp4_kms, REG_MDP4_DTV_ENABLE, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_ENABLE, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_DSI_ENABLE, 0);
+	mdp4_disable(mdp4_kms);
+	mdelay(16);
+
+	mmu = msm_iommu_new(&pdev->dev, 0);
+	if (IS_ERR(mmu)) {
+		ret = PTR_ERR(mmu);
+		goto fail;
+	} else if (!mmu) {
+		DRM_DEV_INFO(dev->dev, "no iommu, fallback to phys "
+				"contig buffers for scanout\n");
+		aspace = NULL;
+	} else {
+		aspace  = msm_gem_address_space_create(mmu,
+			"mdp4", 0x1000, 0x100000000 - 0x1000);
+
+		if (IS_ERR(aspace)) {
+			if (!IS_ERR(mmu))
+				mmu->funcs->destroy(mmu);
+			ret = PTR_ERR(aspace);
+			goto fail;
+		}
+
+		kms->aspace = aspace;
+	}
+
+	ret = modeset_init(mdp4_kms);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "modeset_init failed: %d\n", ret);
+		goto fail;
+	}
+
+	mdp4_kms->blank_cursor_bo = msm_gem_new(dev, SZ_16K, MSM_BO_WC | MSM_BO_SCANOUT);
+	if (IS_ERR(mdp4_kms->blank_cursor_bo)) {
+		ret = PTR_ERR(mdp4_kms->blank_cursor_bo);
+		DRM_DEV_ERROR(dev->dev, "could not allocate blank-cursor bo: %d\n", ret);
+		mdp4_kms->blank_cursor_bo = NULL;
+		goto fail;
+	}
+
+	ret = msm_gem_get_and_pin_iova(mdp4_kms->blank_cursor_bo, kms->aspace,
+			&mdp4_kms->blank_cursor_iova);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "could not pin blank-cursor bo: %d\n", ret);
+		goto fail;
+	}
+
+	dev->mode_config.min_width = 0;
+	dev->mode_config.min_height = 0;
+	dev->mode_config.max_width = 2048;
+	dev->mode_config.max_height = 2048;
+
+	return 0;
+
+fail:
+	if (kms)
+		mdp4_destroy(kms);
+
+	return ret;
+}
+
+static const struct dev_pm_ops mdp4_pm_ops = {
+	.prepare = msm_kms_pm_prepare,
+	.complete = msm_kms_pm_complete,
+};
+
+static int mdp4_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct mdp4_kms *mdp4_kms;
+	int irq;
+
+	mdp4_kms = devm_kzalloc(dev, sizeof(*mdp4_kms), GFP_KERNEL);
+	if (!mdp4_kms)
+		return dev_err_probe(dev, -ENOMEM, "failed to allocate kms\n");
+
+	mdp4_kms->mmio = msm_ioremap(pdev, NULL);
+	if (IS_ERR(mdp4_kms->mmio))
+		return PTR_ERR(mdp4_kms->mmio);
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return dev_err_probe(dev, irq, "failed to get irq\n");
+
+	mdp4_kms->base.base.irq = irq;
+
+	/* NOTE: driver for this regulator still missing upstream.. use
+	 * _get_exclusive() and ignore the error if it does not exist
+	 * (and hope that the bootloader left it on for us)
+	 */
+	mdp4_kms->vdd = devm_regulator_get_exclusive(&pdev->dev, "vdd");
+	if (IS_ERR(mdp4_kms->vdd))
+		mdp4_kms->vdd = NULL;
+
+	mdp4_kms->clk = devm_clk_get(&pdev->dev, "core_clk");
+	if (IS_ERR(mdp4_kms->clk))
+		return dev_err_probe(dev, PTR_ERR(mdp4_kms->clk), "failed to get core_clk\n");
+
+	mdp4_kms->pclk = devm_clk_get(&pdev->dev, "iface_clk");
+	if (IS_ERR(mdp4_kms->pclk))
+		mdp4_kms->pclk = NULL;
+
+	mdp4_kms->axi_clk = devm_clk_get(&pdev->dev, "bus_clk");
+	if (IS_ERR(mdp4_kms->axi_clk))
+		return dev_err_probe(dev, PTR_ERR(mdp4_kms->axi_clk), "failed to get axi_clk\n");
+
+	/*
+	 * This is required for revn >= 2. Handle errors here and let the kms
+	 * init bail out if the clock is not provided.
+	 */
+	mdp4_kms->lut_clk = devm_clk_get_optional(&pdev->dev, "lut_clk");
+	if (IS_ERR(mdp4_kms->lut_clk))
+		return dev_err_probe(dev, PTR_ERR(mdp4_kms->lut_clk), "failed to get lut_clk\n");
+
+	return msm_drv_probe(&pdev->dev, mdp4_kms_init, &mdp4_kms->base.base);
+}
+
+static void mdp4_remove(struct platform_device *pdev)
+{
+	component_master_del(&pdev->dev, &msm_drm_ops);
+}
+
+static const struct of_device_id mdp4_dt_match[] = {
+	{ .compatible = "qcom,mdp4" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, mdp4_dt_match);
+
+static struct platform_driver mdp4_platform_driver = {
+	.probe      = mdp4_probe,
+	.remove_new = mdp4_remove,
+	.shutdown   = msm_kms_shutdown,
+	.driver     = {
+		.name   = "mdp4",
+		.of_match_table = mdp4_dt_match,
+		.pm     = &mdp4_pm_ops,
+	},
+};
+
+void __init msm_mdp4_register(void)
+{
+	platform_driver_register(&mdp4_platform_driver);
+}
+
+void __exit msm_mdp4_unregister(void)
+{
+	platform_driver_unregister(&mdp4_platform_driver);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_kms.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_kms.h
@@ -0,0 +1,219 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MDP4_KMS_H__
+#define __MDP4_KMS_H__
+
+#include <drm/drm_panel.h>
+
+#include "msm_drv.h"
+#include "msm_kms.h"
+#include "disp/mdp_kms.h"
+#include "mdp4.xml.h"
+
+struct device_node;
+
+struct mdp4_kms {
+	struct mdp_kms base;
+
+	struct drm_device *dev;
+
+	int rev;
+
+	void __iomem *mmio;
+
+	struct regulator *vdd;
+
+	struct clk *clk;
+	struct clk *pclk;
+	struct clk *lut_clk;
+	struct clk *axi_clk;
+
+	struct mdp_irq error_handler;
+
+	bool rpm_enabled;
+
+	/* empty/blank cursor bo to use when cursor is "disabled" */
+	struct drm_gem_object *blank_cursor_bo;
+	uint64_t blank_cursor_iova;
+};
+#define to_mdp4_kms(x) container_of(x, struct mdp4_kms, base)
+
+static inline void mdp4_write(struct mdp4_kms *mdp4_kms, u32 reg, u32 data)
+{
+	msm_writel(data, mdp4_kms->mmio + reg);
+}
+
+static inline u32 mdp4_read(struct mdp4_kms *mdp4_kms, u32 reg)
+{
+	return msm_readl(mdp4_kms->mmio + reg);
+}
+
+static inline uint32_t pipe2flush(enum mdp4_pipe pipe)
+{
+	switch (pipe) {
+	case VG1:      return MDP4_OVERLAY_FLUSH_VG1;
+	case VG2:      return MDP4_OVERLAY_FLUSH_VG2;
+	case RGB1:     return MDP4_OVERLAY_FLUSH_RGB1;
+	case RGB2:     return MDP4_OVERLAY_FLUSH_RGB2;
+	default:       return 0;
+	}
+}
+
+static inline uint32_t ovlp2flush(int ovlp)
+{
+	switch (ovlp) {
+	case 0:        return MDP4_OVERLAY_FLUSH_OVLP0;
+	case 1:        return MDP4_OVERLAY_FLUSH_OVLP1;
+	default:       return 0;
+	}
+}
+
+static inline uint32_t dma2irq(enum mdp4_dma dma)
+{
+	switch (dma) {
+	case DMA_P:    return MDP4_IRQ_DMA_P_DONE;
+	case DMA_S:    return MDP4_IRQ_DMA_S_DONE;
+	case DMA_E:    return MDP4_IRQ_DMA_E_DONE;
+	default:       return 0;
+	}
+}
+
+static inline uint32_t dma2err(enum mdp4_dma dma)
+{
+	switch (dma) {
+	case DMA_P:    return MDP4_IRQ_PRIMARY_INTF_UDERRUN;
+	case DMA_S:    return 0;  // ???
+	case DMA_E:    return MDP4_IRQ_EXTERNAL_INTF_UDERRUN;
+	default:       return 0;
+	}
+}
+
+static inline uint32_t mixercfg(uint32_t mixer_cfg, int mixer,
+		enum mdp4_pipe pipe, enum mdp_mixer_stage_id stage)
+{
+	switch (pipe) {
+	case VG1:
+		mixer_cfg &= ~(MDP4_LAYERMIXER_IN_CFG_PIPE0__MASK |
+				MDP4_LAYERMIXER_IN_CFG_PIPE0_MIXER1);
+		mixer_cfg |= MDP4_LAYERMIXER_IN_CFG_PIPE0(stage) |
+			COND(mixer == 1, MDP4_LAYERMIXER_IN_CFG_PIPE0_MIXER1);
+		break;
+	case VG2:
+		mixer_cfg &= ~(MDP4_LAYERMIXER_IN_CFG_PIPE1__MASK |
+				MDP4_LAYERMIXER_IN_CFG_PIPE1_MIXER1);
+		mixer_cfg |= MDP4_LAYERMIXER_IN_CFG_PIPE1(stage) |
+			COND(mixer == 1, MDP4_LAYERMIXER_IN_CFG_PIPE1_MIXER1);
+		break;
+	case RGB1:
+		mixer_cfg &= ~(MDP4_LAYERMIXER_IN_CFG_PIPE2__MASK |
+				MDP4_LAYERMIXER_IN_CFG_PIPE2_MIXER1);
+		mixer_cfg |= MDP4_LAYERMIXER_IN_CFG_PIPE2(stage) |
+			COND(mixer == 1, MDP4_LAYERMIXER_IN_CFG_PIPE2_MIXER1);
+		break;
+	case RGB2:
+		mixer_cfg &= ~(MDP4_LAYERMIXER_IN_CFG_PIPE3__MASK |
+				MDP4_LAYERMIXER_IN_CFG_PIPE3_MIXER1);
+		mixer_cfg |= MDP4_LAYERMIXER_IN_CFG_PIPE3(stage) |
+			COND(mixer == 1, MDP4_LAYERMIXER_IN_CFG_PIPE3_MIXER1);
+		break;
+	case RGB3:
+		mixer_cfg &= ~(MDP4_LAYERMIXER_IN_CFG_PIPE4__MASK |
+				MDP4_LAYERMIXER_IN_CFG_PIPE4_MIXER1);
+		mixer_cfg |= MDP4_LAYERMIXER_IN_CFG_PIPE4(stage) |
+			COND(mixer == 1, MDP4_LAYERMIXER_IN_CFG_PIPE4_MIXER1);
+		break;
+	case VG3:
+		mixer_cfg &= ~(MDP4_LAYERMIXER_IN_CFG_PIPE5__MASK |
+				MDP4_LAYERMIXER_IN_CFG_PIPE5_MIXER1);
+		mixer_cfg |= MDP4_LAYERMIXER_IN_CFG_PIPE5(stage) |
+			COND(mixer == 1, MDP4_LAYERMIXER_IN_CFG_PIPE5_MIXER1);
+		break;
+	case VG4:
+		mixer_cfg &= ~(MDP4_LAYERMIXER_IN_CFG_PIPE6__MASK |
+				MDP4_LAYERMIXER_IN_CFG_PIPE6_MIXER1);
+		mixer_cfg |= MDP4_LAYERMIXER_IN_CFG_PIPE6(stage) |
+			COND(mixer == 1, MDP4_LAYERMIXER_IN_CFG_PIPE6_MIXER1);
+		break;
+	default:
+		WARN(1, "invalid pipe");
+		break;
+	}
+
+	return mixer_cfg;
+}
+
+int mdp4_disable(struct mdp4_kms *mdp4_kms);
+int mdp4_enable(struct mdp4_kms *mdp4_kms);
+
+void mdp4_set_irqmask(struct mdp_kms *mdp_kms, uint32_t irqmask,
+		uint32_t old_irqmask);
+void mdp4_irq_preinstall(struct msm_kms *kms);
+int mdp4_irq_postinstall(struct msm_kms *kms);
+void mdp4_irq_uninstall(struct msm_kms *kms);
+irqreturn_t mdp4_irq(struct msm_kms *kms);
+int mdp4_enable_vblank(struct msm_kms *kms, struct drm_crtc *crtc);
+void mdp4_disable_vblank(struct msm_kms *kms, struct drm_crtc *crtc);
+
+static inline uint32_t mdp4_pipe_caps(enum mdp4_pipe pipe)
+{
+	switch (pipe) {
+	case VG1:
+	case VG2:
+	case VG3:
+	case VG4:
+		return MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_CSC;
+	case RGB1:
+	case RGB2:
+	case RGB3:
+		return MDP_PIPE_CAP_SCALE;
+	default:
+		return 0;
+	}
+}
+
+enum mdp4_pipe mdp4_plane_pipe(struct drm_plane *plane);
+struct drm_plane *mdp4_plane_init(struct drm_device *dev,
+		enum mdp4_pipe pipe_id, bool private_plane);
+
+uint32_t mdp4_crtc_vblank(struct drm_crtc *crtc);
+void mdp4_crtc_set_config(struct drm_crtc *crtc, uint32_t config);
+void mdp4_crtc_set_intf(struct drm_crtc *crtc, enum mdp4_intf intf, int mixer);
+void mdp4_crtc_wait_for_commit_done(struct drm_crtc *crtc);
+struct drm_crtc *mdp4_crtc_init(struct drm_device *dev,
+		struct drm_plane *plane, int id, int ovlp_id,
+		enum mdp4_dma dma_id);
+
+long mdp4_dtv_round_pixclk(struct drm_encoder *encoder, unsigned long rate);
+struct drm_encoder *mdp4_dtv_encoder_init(struct drm_device *dev);
+
+long mdp4_lcdc_round_pixclk(struct drm_encoder *encoder, unsigned long rate);
+struct drm_encoder *mdp4_lcdc_encoder_init(struct drm_device *dev,
+		struct device_node *panel_node);
+
+struct drm_connector *mdp4_lvds_connector_init(struct drm_device *dev,
+		struct device_node *panel_node, struct drm_encoder *encoder);
+
+#ifdef CONFIG_DRM_MSM_DSI
+struct drm_encoder *mdp4_dsi_encoder_init(struct drm_device *dev);
+#else
+static inline struct drm_encoder *mdp4_dsi_encoder_init(struct drm_device *dev)
+{
+	return ERR_PTR(-ENODEV);
+}
+#endif
+
+#ifdef CONFIG_COMMON_CLK
+struct clk *mpd4_lvds_pll_init(struct drm_device *dev);
+#else
+static inline struct clk *mpd4_lvds_pll_init(struct drm_device *dev)
+{
+	return ERR_PTR(-ENODEV);
+}
+#endif
+
+#endif /* __MDP4_KMS_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_lcdc_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_lcdc_encoder.c
@@ -0,0 +1,402 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ * Author: Vinay Simha <vinaysimha@inforcecomputing.com>
+ */
+
+#include <linux/delay.h>
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_probe_helper.h>
+
+#include "mdp4_kms.h"
+
+struct mdp4_lcdc_encoder {
+	struct drm_encoder base;
+	struct device_node *panel_node;
+	struct drm_panel *panel;
+	struct clk *lcdc_clk;
+	unsigned long int pixclock;
+	struct regulator_bulk_data regs[3];
+	bool enabled;
+	uint32_t bsc;
+};
+#define to_mdp4_lcdc_encoder(x) container_of(x, struct mdp4_lcdc_encoder, base)
+
+static struct mdp4_kms *get_kms(struct drm_encoder *encoder)
+{
+	struct msm_drm_private *priv = encoder->dev->dev_private;
+	return to_mdp4_kms(to_mdp_kms(priv->kms));
+}
+
+/* this should probably be a helper: */
+static struct drm_connector *get_connector(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_connector *connector;
+
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
+		if (connector->encoder == encoder)
+			return connector;
+
+	return NULL;
+}
+
+static void setup_phy(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_connector *connector = get_connector(encoder);
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+	uint32_t lvds_intf = 0, lvds_phy_cfg0 = 0;
+	int bpp, nchan, swap;
+
+	if (!connector)
+		return;
+
+	bpp = 3 * connector->display_info.bpc;
+
+	if (!bpp)
+		bpp = 18;
+
+	/* TODO, these should come from panel somehow: */
+	nchan = 1;
+	swap = 0;
+
+	switch (bpp) {
+	case 24:
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_3_TO_0(0),
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT0(0x08) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT1(0x05) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT2(0x04) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT3(0x03));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_6_TO_4(0),
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT4(0x02) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT5(0x01) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT6(0x00));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_3_TO_0(1),
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT0(0x11) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT1(0x10) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT2(0x0d) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT3(0x0c));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_6_TO_4(1),
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT4(0x0b) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT5(0x0a) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT6(0x09));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_3_TO_0(2),
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT0(0x1a) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT1(0x19) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT2(0x18) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT3(0x15));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_6_TO_4(2),
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT4(0x14) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT5(0x13) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT6(0x12));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_3_TO_0(3),
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT0(0x1b) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT1(0x17) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT2(0x16) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT3(0x0f));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_6_TO_4(3),
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT4(0x0e) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT5(0x07) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT6(0x06));
+		if (nchan == 2) {
+			lvds_intf |= MDP4_LCDC_LVDS_INTF_CTL_CH2_DATA_LANE3_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH2_DATA_LANE2_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH2_DATA_LANE1_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH2_DATA_LANE0_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE3_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE2_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE1_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE0_EN;
+		} else {
+			lvds_intf |= MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE3_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE2_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE1_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE0_EN;
+		}
+		break;
+
+	case 18:
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_3_TO_0(0),
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT0(0x0a) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT1(0x07) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT2(0x06) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT3(0x05));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_6_TO_4(0),
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT4(0x04) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT5(0x03) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT6(0x02));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_3_TO_0(1),
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT0(0x13) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT1(0x12) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT2(0x0f) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT3(0x0e));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_6_TO_4(1),
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT4(0x0d) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT5(0x0c) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT6(0x0b));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_3_TO_0(2),
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT0(0x1a) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT1(0x19) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT2(0x18) |
+				MDP4_LCDC_LVDS_MUX_CTL_3_TO_0_BIT3(0x17));
+		mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_MUX_CTL_6_TO_4(2),
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT4(0x16) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT5(0x15) |
+				MDP4_LCDC_LVDS_MUX_CTL_6_TO_4_BIT6(0x14));
+		if (nchan == 2) {
+			lvds_intf |= MDP4_LCDC_LVDS_INTF_CTL_CH2_DATA_LANE2_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH2_DATA_LANE1_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH2_DATA_LANE0_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE2_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE1_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE0_EN;
+		} else {
+			lvds_intf |= MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE2_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE1_EN |
+					MDP4_LCDC_LVDS_INTF_CTL_CH1_DATA_LANE0_EN;
+		}
+		lvds_intf |= MDP4_LCDC_LVDS_INTF_CTL_RGB_OUT;
+		break;
+
+	default:
+		DRM_DEV_ERROR(dev->dev, "unknown bpp: %d\n", bpp);
+		return;
+	}
+
+	switch (nchan) {
+	case 1:
+		lvds_phy_cfg0 = MDP4_LVDS_PHY_CFG0_CHANNEL0;
+		lvds_intf |= MDP4_LCDC_LVDS_INTF_CTL_CH1_CLK_LANE_EN |
+				MDP4_LCDC_LVDS_INTF_CTL_MODE_SEL;
+		break;
+	case 2:
+		lvds_phy_cfg0 = MDP4_LVDS_PHY_CFG0_CHANNEL0 |
+				MDP4_LVDS_PHY_CFG0_CHANNEL1;
+		lvds_intf |= MDP4_LCDC_LVDS_INTF_CTL_CH2_CLK_LANE_EN |
+				MDP4_LCDC_LVDS_INTF_CTL_CH1_CLK_LANE_EN;
+		break;
+	default:
+		DRM_DEV_ERROR(dev->dev, "unknown # of channels: %d\n", nchan);
+		return;
+	}
+
+	if (swap)
+		lvds_intf |= MDP4_LCDC_LVDS_INTF_CTL_CH_SWAP;
+
+	lvds_intf |= MDP4_LCDC_LVDS_INTF_CTL_ENABLE;
+
+	mdp4_write(mdp4_kms, REG_MDP4_LVDS_PHY_CFG0, lvds_phy_cfg0);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_INTF_CTL, lvds_intf);
+	mdp4_write(mdp4_kms, REG_MDP4_LVDS_PHY_CFG2, 0x30);
+
+	mb();
+	udelay(1);
+	lvds_phy_cfg0 |= MDP4_LVDS_PHY_CFG0_SERIALIZATION_ENBLE;
+	mdp4_write(mdp4_kms, REG_MDP4_LVDS_PHY_CFG0, lvds_phy_cfg0);
+}
+
+static void mdp4_lcdc_encoder_mode_set(struct drm_encoder *encoder,
+		struct drm_display_mode *mode,
+		struct drm_display_mode *adjusted_mode)
+{
+	struct mdp4_lcdc_encoder *mdp4_lcdc_encoder =
+			to_mdp4_lcdc_encoder(encoder);
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+	uint32_t lcdc_hsync_skew, vsync_period, vsync_len, ctrl_pol;
+	uint32_t display_v_start, display_v_end;
+	uint32_t hsync_start_x, hsync_end_x;
+
+	mode = adjusted_mode;
+
+	DBG("set mode: " DRM_MODE_FMT, DRM_MODE_ARG(mode));
+
+	mdp4_lcdc_encoder->pixclock = mode->clock * 1000;
+
+	DBG("pixclock=%lu", mdp4_lcdc_encoder->pixclock);
+
+	ctrl_pol = 0;
+	if (mode->flags & DRM_MODE_FLAG_NHSYNC)
+		ctrl_pol |= MDP4_LCDC_CTRL_POLARITY_HSYNC_LOW;
+	if (mode->flags & DRM_MODE_FLAG_NVSYNC)
+		ctrl_pol |= MDP4_LCDC_CTRL_POLARITY_VSYNC_LOW;
+	/* probably need to get DATA_EN polarity from panel.. */
+
+	lcdc_hsync_skew = 0;  /* get this from panel? */
+
+	hsync_start_x = (mode->htotal - mode->hsync_start);
+	hsync_end_x = mode->htotal - (mode->hsync_start - mode->hdisplay) - 1;
+
+	vsync_period = mode->vtotal * mode->htotal;
+	vsync_len = (mode->vsync_end - mode->vsync_start) * mode->htotal;
+	display_v_start = (mode->vtotal - mode->vsync_start) * mode->htotal + lcdc_hsync_skew;
+	display_v_end = vsync_period - ((mode->vsync_start - mode->vdisplay) * mode->htotal) + lcdc_hsync_skew - 1;
+
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_HSYNC_CTRL,
+			MDP4_LCDC_HSYNC_CTRL_PULSEW(mode->hsync_end - mode->hsync_start) |
+			MDP4_LCDC_HSYNC_CTRL_PERIOD(mode->htotal));
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_VSYNC_PERIOD, vsync_period);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_VSYNC_LEN, vsync_len);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_DISPLAY_HCTRL,
+			MDP4_LCDC_DISPLAY_HCTRL_START(hsync_start_x) |
+			MDP4_LCDC_DISPLAY_HCTRL_END(hsync_end_x));
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_DISPLAY_VSTART, display_v_start);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_DISPLAY_VEND, display_v_end);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_BORDER_CLR, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_UNDERFLOW_CLR,
+			MDP4_LCDC_UNDERFLOW_CLR_ENABLE_RECOVERY |
+			MDP4_LCDC_UNDERFLOW_CLR_COLOR(0xff));
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_HSYNC_SKEW, lcdc_hsync_skew);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_CTRL_POLARITY, ctrl_pol);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_ACTIVE_HCTL,
+			MDP4_LCDC_ACTIVE_HCTL_START(0) |
+			MDP4_LCDC_ACTIVE_HCTL_END(0));
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_ACTIVE_VSTART, 0);
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_ACTIVE_VEND, 0);
+}
+
+static void mdp4_lcdc_encoder_disable(struct drm_encoder *encoder)
+{
+	struct mdp4_lcdc_encoder *mdp4_lcdc_encoder =
+			to_mdp4_lcdc_encoder(encoder);
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+	struct drm_panel *panel;
+
+	if (WARN_ON(!mdp4_lcdc_encoder->enabled))
+		return;
+
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_ENABLE, 0);
+
+	panel = of_drm_find_panel(mdp4_lcdc_encoder->panel_node);
+	if (!IS_ERR(panel)) {
+		drm_panel_disable(panel);
+		drm_panel_unprepare(panel);
+	}
+
+	/*
+	 * Wait for a vsync so we know the ENABLE=0 latched before
+	 * the (connector) source of the vsync's gets disabled,
+	 * otherwise we end up in a funny state if we re-enable
+	 * before the disable latches, which results that some of
+	 * the settings changes for the new modeset (like new
+	 * scanout buffer) don't latch properly..
+	 */
+	mdp_irq_wait(&mdp4_kms->base, MDP4_IRQ_PRIMARY_VSYNC);
+
+	clk_disable_unprepare(mdp4_lcdc_encoder->lcdc_clk);
+
+	regulator_bulk_disable(ARRAY_SIZE(mdp4_lcdc_encoder->regs),
+			       mdp4_lcdc_encoder->regs);
+
+	mdp4_lcdc_encoder->enabled = false;
+}
+
+static void mdp4_lcdc_encoder_enable(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct mdp4_lcdc_encoder *mdp4_lcdc_encoder =
+			to_mdp4_lcdc_encoder(encoder);
+	unsigned long pc = mdp4_lcdc_encoder->pixclock;
+	struct mdp4_kms *mdp4_kms = get_kms(encoder);
+	struct drm_panel *panel;
+	uint32_t config;
+	int ret;
+
+	if (WARN_ON(mdp4_lcdc_encoder->enabled))
+		return;
+
+	/* TODO: hard-coded for 18bpp: */
+	config =
+		MDP4_DMA_CONFIG_R_BPC(BPC6) |
+		MDP4_DMA_CONFIG_G_BPC(BPC6) |
+		MDP4_DMA_CONFIG_B_BPC(BPC6) |
+		MDP4_DMA_CONFIG_PACK(0x21) |
+		MDP4_DMA_CONFIG_DEFLKR_EN |
+		MDP4_DMA_CONFIG_DITHER_EN;
+
+	if (!of_property_read_bool(dev->dev->of_node, "qcom,lcdc-align-lsb"))
+		config |= MDP4_DMA_CONFIG_PACK_ALIGN_MSB;
+
+	mdp4_crtc_set_config(encoder->crtc, config);
+	mdp4_crtc_set_intf(encoder->crtc, INTF_LCDC_DTV, 0);
+
+	ret = regulator_bulk_enable(ARRAY_SIZE(mdp4_lcdc_encoder->regs),
+				    mdp4_lcdc_encoder->regs);
+	if (ret)
+		DRM_DEV_ERROR(dev->dev, "failed to enable regulators: %d\n", ret);
+
+	DBG("setting lcdc_clk=%lu", pc);
+	ret = clk_set_rate(mdp4_lcdc_encoder->lcdc_clk, pc);
+	if (ret)
+		DRM_DEV_ERROR(dev->dev, "failed to configure lcdc_clk: %d\n", ret);
+	ret = clk_prepare_enable(mdp4_lcdc_encoder->lcdc_clk);
+	if (ret)
+		DRM_DEV_ERROR(dev->dev, "failed to enable lcdc_clk: %d\n", ret);
+
+	panel = of_drm_find_panel(mdp4_lcdc_encoder->panel_node);
+	if (!IS_ERR(panel)) {
+		drm_panel_prepare(panel);
+		drm_panel_enable(panel);
+	}
+
+	setup_phy(encoder);
+
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_ENABLE, 1);
+
+	mdp4_lcdc_encoder->enabled = true;
+}
+
+static const struct drm_encoder_helper_funcs mdp4_lcdc_encoder_helper_funcs = {
+	.mode_set = mdp4_lcdc_encoder_mode_set,
+	.disable = mdp4_lcdc_encoder_disable,
+	.enable = mdp4_lcdc_encoder_enable,
+};
+
+long mdp4_lcdc_round_pixclk(struct drm_encoder *encoder, unsigned long rate)
+{
+	struct mdp4_lcdc_encoder *mdp4_lcdc_encoder =
+			to_mdp4_lcdc_encoder(encoder);
+	return clk_round_rate(mdp4_lcdc_encoder->lcdc_clk, rate);
+}
+
+/* initialize encoder */
+struct drm_encoder *mdp4_lcdc_encoder_init(struct drm_device *dev,
+		struct device_node *panel_node)
+{
+	struct drm_encoder *encoder;
+	struct mdp4_lcdc_encoder *mdp4_lcdc_encoder;
+	int ret;
+
+	mdp4_lcdc_encoder = drmm_encoder_alloc(dev, struct mdp4_lcdc_encoder, base,
+					       NULL, DRM_MODE_ENCODER_LVDS, NULL);
+	if (IS_ERR(mdp4_lcdc_encoder))
+		return ERR_CAST(mdp4_lcdc_encoder);
+
+	mdp4_lcdc_encoder->panel_node = panel_node;
+
+	encoder = &mdp4_lcdc_encoder->base;
+
+	drm_encoder_helper_add(encoder, &mdp4_lcdc_encoder_helper_funcs);
+
+	/* TODO: do we need different pll in other cases? */
+	mdp4_lcdc_encoder->lcdc_clk = mpd4_lvds_pll_init(dev);
+	if (IS_ERR(mdp4_lcdc_encoder->lcdc_clk)) {
+		DRM_DEV_ERROR(dev->dev, "failed to get lvds_clk\n");
+		return ERR_CAST(mdp4_lcdc_encoder->lcdc_clk);
+	}
+
+	/* TODO: different regulators in other cases? */
+	mdp4_lcdc_encoder->regs[0].supply = "lvds-vccs-3p3v";
+	mdp4_lcdc_encoder->regs[1].supply = "lvds-vccs-3p3v";
+	mdp4_lcdc_encoder->regs[2].supply = "lvds-vdda";
+
+	ret = devm_regulator_bulk_get(dev->dev,
+				      ARRAY_SIZE(mdp4_lcdc_encoder->regs),
+				      mdp4_lcdc_encoder->regs);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return encoder;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_lvds_connector.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_lvds_connector.c
@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ * Author: Vinay Simha <vinaysimha@inforcecomputing.com>
+ */
+
+#include "mdp4_kms.h"
+
+struct mdp4_lvds_connector {
+	struct drm_connector base;
+	struct drm_encoder *encoder;
+	struct device_node *panel_node;
+	struct drm_panel *panel;
+};
+#define to_mdp4_lvds_connector(x) container_of(x, struct mdp4_lvds_connector, base)
+
+static enum drm_connector_status mdp4_lvds_connector_detect(
+		struct drm_connector *connector, bool force)
+{
+	struct mdp4_lvds_connector *mdp4_lvds_connector =
+			to_mdp4_lvds_connector(connector);
+
+	if (!mdp4_lvds_connector->panel) {
+		mdp4_lvds_connector->panel =
+			of_drm_find_panel(mdp4_lvds_connector->panel_node);
+		if (IS_ERR(mdp4_lvds_connector->panel))
+			mdp4_lvds_connector->panel = NULL;
+	}
+
+	return mdp4_lvds_connector->panel ?
+			connector_status_connected :
+			connector_status_disconnected;
+}
+
+static void mdp4_lvds_connector_destroy(struct drm_connector *connector)
+{
+	struct mdp4_lvds_connector *mdp4_lvds_connector =
+			to_mdp4_lvds_connector(connector);
+
+	drm_connector_cleanup(connector);
+
+	kfree(mdp4_lvds_connector);
+}
+
+static int mdp4_lvds_connector_get_modes(struct drm_connector *connector)
+{
+	struct mdp4_lvds_connector *mdp4_lvds_connector =
+			to_mdp4_lvds_connector(connector);
+	struct drm_panel *panel = mdp4_lvds_connector->panel;
+	int ret = 0;
+
+	if (panel)
+		ret = drm_panel_get_modes(panel, connector);
+
+	return ret;
+}
+
+static enum drm_mode_status
+mdp4_lvds_connector_mode_valid(struct drm_connector *connector,
+			       struct drm_display_mode *mode)
+{
+	struct mdp4_lvds_connector *mdp4_lvds_connector =
+			to_mdp4_lvds_connector(connector);
+	struct drm_encoder *encoder = mdp4_lvds_connector->encoder;
+	long actual, requested;
+
+	requested = 1000 * mode->clock;
+	actual = mdp4_lcdc_round_pixclk(encoder, requested);
+
+	DBG("requested=%ld, actual=%ld", requested, actual);
+
+	if (actual != requested)
+		return MODE_CLOCK_RANGE;
+
+	return MODE_OK;
+}
+
+static const struct drm_connector_funcs mdp4_lvds_connector_funcs = {
+	.detect = mdp4_lvds_connector_detect,
+	.fill_modes = drm_helper_probe_single_connector_modes,
+	.destroy = mdp4_lvds_connector_destroy,
+	.reset = drm_atomic_helper_connector_reset,
+	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+};
+
+static const struct drm_connector_helper_funcs mdp4_lvds_connector_helper_funcs = {
+	.get_modes = mdp4_lvds_connector_get_modes,
+	.mode_valid = mdp4_lvds_connector_mode_valid,
+};
+
+/* initialize connector */
+struct drm_connector *mdp4_lvds_connector_init(struct drm_device *dev,
+		struct device_node *panel_node, struct drm_encoder *encoder)
+{
+	struct drm_connector *connector = NULL;
+	struct mdp4_lvds_connector *mdp4_lvds_connector;
+
+	mdp4_lvds_connector = kzalloc(sizeof(*mdp4_lvds_connector), GFP_KERNEL);
+	if (!mdp4_lvds_connector)
+		return ERR_PTR(-ENOMEM);
+
+	mdp4_lvds_connector->encoder = encoder;
+	mdp4_lvds_connector->panel_node = panel_node;
+
+	connector = &mdp4_lvds_connector->base;
+
+	drm_connector_init(dev, connector, &mdp4_lvds_connector_funcs,
+			DRM_MODE_CONNECTOR_LVDS);
+	drm_connector_helper_add(connector, &mdp4_lvds_connector_helper_funcs);
+
+	connector->polled = 0;
+
+	connector->interlace_allowed = 0;
+	connector->doublescan_allowed = 0;
+
+	drm_connector_attach_encoder(connector, encoder);
+
+	return connector;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_lvds_pll.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_lvds_pll.c
@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+
+#include "mdp4_kms.h"
+
+struct mdp4_lvds_pll {
+	struct clk_hw pll_hw;
+	struct drm_device *dev;
+	unsigned long pixclk;
+};
+#define to_mdp4_lvds_pll(x) container_of(x, struct mdp4_lvds_pll, pll_hw)
+
+static struct mdp4_kms *get_kms(struct mdp4_lvds_pll *lvds_pll)
+{
+	struct msm_drm_private *priv = lvds_pll->dev->dev_private;
+	return to_mdp4_kms(to_mdp_kms(priv->kms));
+}
+
+struct pll_rate {
+	unsigned long rate;
+	struct {
+		uint32_t val;
+		uint32_t reg;
+	} conf[32];
+};
+
+/* NOTE: keep sorted highest freq to lowest: */
+static const struct pll_rate freqtbl[] = {
+	{ 72000000, {
+		{ 0x8f, REG_MDP4_LVDS_PHY_PLL_CTRL_1 },
+		{ 0x30, REG_MDP4_LVDS_PHY_PLL_CTRL_2 },
+		{ 0xc6, REG_MDP4_LVDS_PHY_PLL_CTRL_3 },
+		{ 0x10, REG_MDP4_LVDS_PHY_PLL_CTRL_5 },
+		{ 0x07, REG_MDP4_LVDS_PHY_PLL_CTRL_6 },
+		{ 0x62, REG_MDP4_LVDS_PHY_PLL_CTRL_7 },
+		{ 0x41, REG_MDP4_LVDS_PHY_PLL_CTRL_8 },
+		{ 0x0d, REG_MDP4_LVDS_PHY_PLL_CTRL_9 },
+		{ 0, 0 } }
+	},
+};
+
+static const struct pll_rate *find_rate(unsigned long rate)
+{
+	int i;
+	for (i = 1; i < ARRAY_SIZE(freqtbl); i++)
+		if (rate > freqtbl[i].rate)
+			return &freqtbl[i-1];
+	return &freqtbl[i-1];
+}
+
+static int mpd4_lvds_pll_enable(struct clk_hw *hw)
+{
+	struct mdp4_lvds_pll *lvds_pll = to_mdp4_lvds_pll(hw);
+	struct mdp4_kms *mdp4_kms = get_kms(lvds_pll);
+	const struct pll_rate *pll_rate = find_rate(lvds_pll->pixclk);
+	int i;
+
+	DBG("pixclk=%lu (%lu)", lvds_pll->pixclk, pll_rate->rate);
+
+	if (WARN_ON(!pll_rate))
+		return -EINVAL;
+
+	mdp4_write(mdp4_kms, REG_MDP4_LCDC_LVDS_PHY_RESET, 0x33);
+
+	for (i = 0; pll_rate->conf[i].reg; i++)
+		mdp4_write(mdp4_kms, pll_rate->conf[i].reg, pll_rate->conf[i].val);
+
+	mdp4_write(mdp4_kms, REG_MDP4_LVDS_PHY_PLL_CTRL_0, 0x01);
+
+	/* Wait until LVDS PLL is locked and ready */
+	while (!mdp4_read(mdp4_kms, REG_MDP4_LVDS_PHY_PLL_LOCKED))
+		cpu_relax();
+
+	return 0;
+}
+
+static void mpd4_lvds_pll_disable(struct clk_hw *hw)
+{
+	struct mdp4_lvds_pll *lvds_pll = to_mdp4_lvds_pll(hw);
+	struct mdp4_kms *mdp4_kms = get_kms(lvds_pll);
+
+	DBG("");
+
+	mdp4_write(mdp4_kms, REG_MDP4_LVDS_PHY_CFG0, 0x0);
+	mdp4_write(mdp4_kms, REG_MDP4_LVDS_PHY_PLL_CTRL_0, 0x0);
+}
+
+static unsigned long mpd4_lvds_pll_recalc_rate(struct clk_hw *hw,
+				unsigned long parent_rate)
+{
+	struct mdp4_lvds_pll *lvds_pll = to_mdp4_lvds_pll(hw);
+	return lvds_pll->pixclk;
+}
+
+static long mpd4_lvds_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+		unsigned long *parent_rate)
+{
+	const struct pll_rate *pll_rate = find_rate(rate);
+	return pll_rate->rate;
+}
+
+static int mpd4_lvds_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+		unsigned long parent_rate)
+{
+	struct mdp4_lvds_pll *lvds_pll = to_mdp4_lvds_pll(hw);
+	lvds_pll->pixclk = rate;
+	return 0;
+}
+
+
+static const struct clk_ops mpd4_lvds_pll_ops = {
+	.enable = mpd4_lvds_pll_enable,
+	.disable = mpd4_lvds_pll_disable,
+	.recalc_rate = mpd4_lvds_pll_recalc_rate,
+	.round_rate = mpd4_lvds_pll_round_rate,
+	.set_rate = mpd4_lvds_pll_set_rate,
+};
+
+static const char *mpd4_lvds_pll_parents[] = {
+	"pxo",
+};
+
+static struct clk_init_data pll_init = {
+	.name = "mpd4_lvds_pll",
+	.ops = &mpd4_lvds_pll_ops,
+	.parent_names = mpd4_lvds_pll_parents,
+	.num_parents = ARRAY_SIZE(mpd4_lvds_pll_parents),
+};
+
+struct clk *mpd4_lvds_pll_init(struct drm_device *dev)
+{
+	struct mdp4_lvds_pll *lvds_pll;
+	struct clk *clk;
+	int ret;
+
+	lvds_pll = devm_kzalloc(dev->dev, sizeof(*lvds_pll), GFP_KERNEL);
+	if (!lvds_pll) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	lvds_pll->dev = dev;
+
+	lvds_pll->pll_hw.init = &pll_init;
+	clk = devm_clk_register(dev->dev, &lvds_pll->pll_hw);
+	if (IS_ERR(clk)) {
+		ret = PTR_ERR(clk);
+		goto fail;
+	}
+
+	return clk;
+
+fail:
+	return ERR_PTR(ret);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp4/mdp4_plane.c
@@ -0,0 +1,419 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_damage_helper.h>
+#include <drm/drm_fourcc.h>
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_gem_atomic_helper.h>
+
+#include "mdp4_kms.h"
+
+#define DOWN_SCALE_MAX	8
+#define UP_SCALE_MAX	8
+
+struct mdp4_plane {
+	struct drm_plane base;
+	const char *name;
+
+	enum mdp4_pipe pipe;
+
+	uint32_t caps;
+	uint32_t nformats;
+	uint32_t formats[32];
+
+	bool enabled;
+};
+#define to_mdp4_plane(x) container_of(x, struct mdp4_plane, base)
+
+/* MDP format helper functions */
+static inline
+enum mdp4_frame_format mdp4_get_frame_format(struct drm_framebuffer *fb)
+{
+	bool is_tile = false;
+
+	if (fb->modifier == DRM_FORMAT_MOD_SAMSUNG_64_32_TILE)
+		is_tile = true;
+
+	if (fb->format->format == DRM_FORMAT_NV12 && is_tile)
+		return FRAME_TILE_YCBCR_420;
+
+	return FRAME_LINEAR;
+}
+
+static void mdp4_plane_set_scanout(struct drm_plane *plane,
+		struct drm_framebuffer *fb);
+static int mdp4_plane_mode_set(struct drm_plane *plane,
+		struct drm_crtc *crtc, struct drm_framebuffer *fb,
+		int crtc_x, int crtc_y,
+		unsigned int crtc_w, unsigned int crtc_h,
+		uint32_t src_x, uint32_t src_y,
+		uint32_t src_w, uint32_t src_h);
+
+static struct mdp4_kms *get_kms(struct drm_plane *plane)
+{
+	struct msm_drm_private *priv = plane->dev->dev_private;
+	return to_mdp4_kms(to_mdp_kms(priv->kms));
+}
+
+static void mdp4_plane_destroy(struct drm_plane *plane)
+{
+	struct mdp4_plane *mdp4_plane = to_mdp4_plane(plane);
+
+	drm_plane_cleanup(plane);
+
+	kfree(mdp4_plane);
+}
+
+/* helper to install properties which are common to planes and crtcs */
+static void mdp4_plane_install_properties(struct drm_plane *plane,
+		struct drm_mode_object *obj)
+{
+	// XXX
+}
+
+static int mdp4_plane_set_property(struct drm_plane *plane,
+		struct drm_property *property, uint64_t val)
+{
+	// XXX
+	return -EINVAL;
+}
+
+static const struct drm_plane_funcs mdp4_plane_funcs = {
+		.update_plane = drm_atomic_helper_update_plane,
+		.disable_plane = drm_atomic_helper_disable_plane,
+		.destroy = mdp4_plane_destroy,
+		.set_property = mdp4_plane_set_property,
+		.reset = drm_atomic_helper_plane_reset,
+		.atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state,
+		.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
+};
+
+static int mdp4_plane_prepare_fb(struct drm_plane *plane,
+				 struct drm_plane_state *new_state)
+{
+	struct msm_drm_private *priv = plane->dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+
+	if (!new_state->fb)
+		return 0;
+
+	drm_gem_plane_helper_prepare_fb(plane, new_state);
+
+	return msm_framebuffer_prepare(new_state->fb, kms->aspace, false);
+}
+
+static void mdp4_plane_cleanup_fb(struct drm_plane *plane,
+				  struct drm_plane_state *old_state)
+{
+	struct mdp4_plane *mdp4_plane = to_mdp4_plane(plane);
+	struct mdp4_kms *mdp4_kms = get_kms(plane);
+	struct msm_kms *kms = &mdp4_kms->base.base;
+	struct drm_framebuffer *fb = old_state->fb;
+
+	if (!fb)
+		return;
+
+	DBG("%s: cleanup: FB[%u]", mdp4_plane->name, fb->base.id);
+	msm_framebuffer_cleanup(fb, kms->aspace, false);
+}
+
+
+static int mdp4_plane_atomic_check(struct drm_plane *plane,
+		struct drm_atomic_state *state)
+{
+	return 0;
+}
+
+static void mdp4_plane_atomic_update(struct drm_plane *plane,
+				     struct drm_atomic_state *state)
+{
+	struct drm_plane_state *new_state = drm_atomic_get_new_plane_state(state,
+									   plane);
+	int ret;
+
+	ret = mdp4_plane_mode_set(plane,
+			new_state->crtc, new_state->fb,
+			new_state->crtc_x, new_state->crtc_y,
+			new_state->crtc_w, new_state->crtc_h,
+			new_state->src_x,  new_state->src_y,
+			new_state->src_w, new_state->src_h);
+	/* atomic_check should have ensured that this doesn't fail */
+	WARN_ON(ret < 0);
+}
+
+static const struct drm_plane_helper_funcs mdp4_plane_helper_funcs = {
+		.prepare_fb = mdp4_plane_prepare_fb,
+		.cleanup_fb = mdp4_plane_cleanup_fb,
+		.atomic_check = mdp4_plane_atomic_check,
+		.atomic_update = mdp4_plane_atomic_update,
+};
+
+static void mdp4_plane_set_scanout(struct drm_plane *plane,
+		struct drm_framebuffer *fb)
+{
+	struct mdp4_plane *mdp4_plane = to_mdp4_plane(plane);
+	struct mdp4_kms *mdp4_kms = get_kms(plane);
+	struct msm_kms *kms = &mdp4_kms->base.base;
+	enum mdp4_pipe pipe = mdp4_plane->pipe;
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRC_STRIDE_A(pipe),
+			MDP4_PIPE_SRC_STRIDE_A_P0(fb->pitches[0]) |
+			MDP4_PIPE_SRC_STRIDE_A_P1(fb->pitches[1]));
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRC_STRIDE_B(pipe),
+			MDP4_PIPE_SRC_STRIDE_B_P2(fb->pitches[2]) |
+			MDP4_PIPE_SRC_STRIDE_B_P3(fb->pitches[3]));
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRCP0_BASE(pipe),
+			msm_framebuffer_iova(fb, kms->aspace, 0));
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRCP1_BASE(pipe),
+			msm_framebuffer_iova(fb, kms->aspace, 1));
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRCP2_BASE(pipe),
+			msm_framebuffer_iova(fb, kms->aspace, 2));
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRCP3_BASE(pipe),
+			msm_framebuffer_iova(fb, kms->aspace, 3));
+}
+
+static void mdp4_write_csc_config(struct mdp4_kms *mdp4_kms,
+		enum mdp4_pipe pipe, struct csc_cfg *csc)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(csc->matrix); i++) {
+		mdp4_write(mdp4_kms, REG_MDP4_PIPE_CSC_MV(pipe, i),
+				csc->matrix[i]);
+	}
+
+	for (i = 0; i < ARRAY_SIZE(csc->post_bias) ; i++) {
+		mdp4_write(mdp4_kms, REG_MDP4_PIPE_CSC_PRE_BV(pipe, i),
+				csc->pre_bias[i]);
+
+		mdp4_write(mdp4_kms, REG_MDP4_PIPE_CSC_POST_BV(pipe, i),
+				csc->post_bias[i]);
+	}
+
+	for (i = 0; i < ARRAY_SIZE(csc->post_clamp) ; i++) {
+		mdp4_write(mdp4_kms, REG_MDP4_PIPE_CSC_PRE_LV(pipe, i),
+				csc->pre_clamp[i]);
+
+		mdp4_write(mdp4_kms, REG_MDP4_PIPE_CSC_POST_LV(pipe, i),
+				csc->post_clamp[i]);
+	}
+}
+
+#define MDP4_VG_PHASE_STEP_DEFAULT	0x20000000
+
+static int mdp4_plane_mode_set(struct drm_plane *plane,
+		struct drm_crtc *crtc, struct drm_framebuffer *fb,
+		int crtc_x, int crtc_y,
+		unsigned int crtc_w, unsigned int crtc_h,
+		uint32_t src_x, uint32_t src_y,
+		uint32_t src_w, uint32_t src_h)
+{
+	struct drm_device *dev = plane->dev;
+	struct mdp4_plane *mdp4_plane = to_mdp4_plane(plane);
+	struct mdp4_kms *mdp4_kms = get_kms(plane);
+	enum mdp4_pipe pipe = mdp4_plane->pipe;
+	const struct mdp_format *format;
+	uint32_t op_mode = 0;
+	uint32_t phasex_step = MDP4_VG_PHASE_STEP_DEFAULT;
+	uint32_t phasey_step = MDP4_VG_PHASE_STEP_DEFAULT;
+	enum mdp4_frame_format frame_type;
+
+	if (!(crtc && fb)) {
+		DBG("%s: disabled!", mdp4_plane->name);
+		return 0;
+	}
+
+	frame_type = mdp4_get_frame_format(fb);
+
+	/* src values are in Q16 fixed point, convert to integer: */
+	src_x = src_x >> 16;
+	src_y = src_y >> 16;
+	src_w = src_w >> 16;
+	src_h = src_h >> 16;
+
+	DBG("%s: FB[%u] %u,%u,%u,%u -> CRTC[%u] %d,%d,%u,%u", mdp4_plane->name,
+			fb->base.id, src_x, src_y, src_w, src_h,
+			crtc->base.id, crtc_x, crtc_y, crtc_w, crtc_h);
+
+	format = to_mdp_format(msm_framebuffer_format(fb));
+
+	if (src_w > (crtc_w * DOWN_SCALE_MAX)) {
+		DRM_DEV_ERROR(dev->dev, "Width down scaling exceeds limits!\n");
+		return -ERANGE;
+	}
+
+	if (src_h > (crtc_h * DOWN_SCALE_MAX)) {
+		DRM_DEV_ERROR(dev->dev, "Height down scaling exceeds limits!\n");
+		return -ERANGE;
+	}
+
+	if (crtc_w > (src_w * UP_SCALE_MAX)) {
+		DRM_DEV_ERROR(dev->dev, "Width up scaling exceeds limits!\n");
+		return -ERANGE;
+	}
+
+	if (crtc_h > (src_h * UP_SCALE_MAX)) {
+		DRM_DEV_ERROR(dev->dev, "Height up scaling exceeds limits!\n");
+		return -ERANGE;
+	}
+
+	if (src_w != crtc_w) {
+		uint32_t sel_unit = SCALE_FIR;
+		op_mode |= MDP4_PIPE_OP_MODE_SCALEX_EN;
+
+		if (MDP_FORMAT_IS_YUV(format)) {
+			if (crtc_w > src_w)
+				sel_unit = SCALE_PIXEL_RPT;
+			else if (crtc_w <= (src_w / 4))
+				sel_unit = SCALE_MN_PHASE;
+
+			op_mode |= MDP4_PIPE_OP_MODE_SCALEX_UNIT_SEL(sel_unit);
+			phasex_step = mult_frac(MDP4_VG_PHASE_STEP_DEFAULT,
+					src_w, crtc_w);
+		}
+	}
+
+	if (src_h != crtc_h) {
+		uint32_t sel_unit = SCALE_FIR;
+		op_mode |= MDP4_PIPE_OP_MODE_SCALEY_EN;
+
+		if (MDP_FORMAT_IS_YUV(format)) {
+
+			if (crtc_h > src_h)
+				sel_unit = SCALE_PIXEL_RPT;
+			else if (crtc_h <= (src_h / 4))
+				sel_unit = SCALE_MN_PHASE;
+
+			op_mode |= MDP4_PIPE_OP_MODE_SCALEY_UNIT_SEL(sel_unit);
+			phasey_step = mult_frac(MDP4_VG_PHASE_STEP_DEFAULT,
+					src_h, crtc_h);
+		}
+	}
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRC_SIZE(pipe),
+			MDP4_PIPE_SRC_SIZE_WIDTH(src_w) |
+			MDP4_PIPE_SRC_SIZE_HEIGHT(src_h));
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRC_XY(pipe),
+			MDP4_PIPE_SRC_XY_X(src_x) |
+			MDP4_PIPE_SRC_XY_Y(src_y));
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_DST_SIZE(pipe),
+			MDP4_PIPE_DST_SIZE_WIDTH(crtc_w) |
+			MDP4_PIPE_DST_SIZE_HEIGHT(crtc_h));
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_DST_XY(pipe),
+			MDP4_PIPE_DST_XY_X(crtc_x) |
+			MDP4_PIPE_DST_XY_Y(crtc_y));
+
+	mdp4_plane_set_scanout(plane, fb);
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRC_FORMAT(pipe),
+			MDP4_PIPE_SRC_FORMAT_A_BPC(format->bpc_a) |
+			MDP4_PIPE_SRC_FORMAT_R_BPC(format->bpc_r) |
+			MDP4_PIPE_SRC_FORMAT_G_BPC(format->bpc_g) |
+			MDP4_PIPE_SRC_FORMAT_B_BPC(format->bpc_b) |
+			COND(format->alpha_enable, MDP4_PIPE_SRC_FORMAT_ALPHA_ENABLE) |
+			MDP4_PIPE_SRC_FORMAT_CPP(format->cpp - 1) |
+			MDP4_PIPE_SRC_FORMAT_UNPACK_COUNT(format->unpack_count - 1) |
+			MDP4_PIPE_SRC_FORMAT_FETCH_PLANES(format->fetch_type) |
+			MDP4_PIPE_SRC_FORMAT_CHROMA_SAMP(format->chroma_sample) |
+			MDP4_PIPE_SRC_FORMAT_FRAME_FORMAT(frame_type) |
+			COND(format->unpack_tight, MDP4_PIPE_SRC_FORMAT_UNPACK_TIGHT));
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_SRC_UNPACK(pipe),
+			MDP4_PIPE_SRC_UNPACK_ELEM0(format->unpack[0]) |
+			MDP4_PIPE_SRC_UNPACK_ELEM1(format->unpack[1]) |
+			MDP4_PIPE_SRC_UNPACK_ELEM2(format->unpack[2]) |
+			MDP4_PIPE_SRC_UNPACK_ELEM3(format->unpack[3]));
+
+	if (MDP_FORMAT_IS_YUV(format)) {
+		struct csc_cfg *csc = mdp_get_default_csc_cfg(CSC_YUV2RGB);
+
+		op_mode |= MDP4_PIPE_OP_MODE_SRC_YCBCR;
+		op_mode |= MDP4_PIPE_OP_MODE_CSC_EN;
+		mdp4_write_csc_config(mdp4_kms, pipe, csc);
+	}
+
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_OP_MODE(pipe), op_mode);
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_PHASEX_STEP(pipe), phasex_step);
+	mdp4_write(mdp4_kms, REG_MDP4_PIPE_PHASEY_STEP(pipe), phasey_step);
+
+	if (frame_type != FRAME_LINEAR)
+		mdp4_write(mdp4_kms, REG_MDP4_PIPE_SSTILE_FRAME_SIZE(pipe),
+				MDP4_PIPE_SSTILE_FRAME_SIZE_WIDTH(src_w) |
+				MDP4_PIPE_SSTILE_FRAME_SIZE_HEIGHT(src_h));
+
+	return 0;
+}
+
+static const char *pipe_names[] = {
+		"VG1", "VG2",
+		"RGB1", "RGB2", "RGB3",
+		"VG3", "VG4",
+};
+
+enum mdp4_pipe mdp4_plane_pipe(struct drm_plane *plane)
+{
+	struct mdp4_plane *mdp4_plane = to_mdp4_plane(plane);
+	return mdp4_plane->pipe;
+}
+
+static const uint64_t supported_format_modifiers[] = {
+	DRM_FORMAT_MOD_SAMSUNG_64_32_TILE,
+	DRM_FORMAT_MOD_LINEAR,
+	DRM_FORMAT_MOD_INVALID
+};
+
+/* initialize plane */
+struct drm_plane *mdp4_plane_init(struct drm_device *dev,
+		enum mdp4_pipe pipe_id, bool private_plane)
+{
+	struct drm_plane *plane = NULL;
+	struct mdp4_plane *mdp4_plane;
+	int ret;
+	enum drm_plane_type type;
+
+	mdp4_plane = kzalloc(sizeof(*mdp4_plane), GFP_KERNEL);
+	if (!mdp4_plane) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	plane = &mdp4_plane->base;
+
+	mdp4_plane->pipe = pipe_id;
+	mdp4_plane->name = pipe_names[pipe_id];
+	mdp4_plane->caps = mdp4_pipe_caps(pipe_id);
+
+	mdp4_plane->nformats = mdp_get_formats(mdp4_plane->formats,
+			ARRAY_SIZE(mdp4_plane->formats),
+			!pipe_supports_yuv(mdp4_plane->caps));
+
+	type = private_plane ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
+	ret = drm_universal_plane_init(dev, plane, 0xff, &mdp4_plane_funcs,
+				 mdp4_plane->formats, mdp4_plane->nformats,
+				 supported_format_modifiers, type, NULL);
+	if (ret)
+		goto fail;
+
+	drm_plane_helper_add(plane, &mdp4_plane_helper_funcs);
+
+	mdp4_plane_install_properties(plane, &plane->base);
+
+	drm_plane_enable_fb_damage_clips(plane);
+
+	return plane;
+
+fail:
+	if (plane)
+		mdp4_plane_destroy(plane);
+
+	return ERR_PTR(ret);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_cfg.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_cfg.c
@@ -0,0 +1,1401 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ */
+
+#include "mdp5_kms.h"
+#include "mdp5_cfg.h"
+
+struct mdp5_cfg_handler {
+	int revision;
+	struct mdp5_cfg config;
+};
+
+/* mdp5_cfg must be exposed (used in mdp5.xml.h) */
+const struct mdp5_cfg_hw *mdp5_cfg = NULL;
+
+static const struct mdp5_cfg_hw msm8x74v1_config = {
+	.name = "msm8x74v1",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_SMP |
+			0,
+	},
+	.smp = {
+		.mmb_count = 22,
+		.mmb_size = 4096,
+		.clients = {
+			[SSPP_VIG0] =  1, [SSPP_VIG1] =  4, [SSPP_VIG2] =  7,
+			[SSPP_DMA0] = 10, [SSPP_DMA1] = 13,
+			[SSPP_RGB0] = 16, [SSPP_RGB1] = 17, [SSPP_RGB2] = 18,
+		},
+	},
+	.ctl = {
+		.count = 5,
+		.base = { 0x00500, 0x00600, 0x00700, 0x00800, 0x00900 },
+		.flush_hw_mask = 0x0003ffff,
+	},
+	.pipe_vig = {
+		.count = 3,
+		.base = { 0x01100, 0x01500, 0x01900 },
+		.caps = MDP_PIPE_CAP_HFLIP |
+			MDP_PIPE_CAP_VFLIP |
+			MDP_PIPE_CAP_SCALE |
+			MDP_PIPE_CAP_CSC   |
+			0,
+	},
+	.pipe_rgb = {
+		.count = 3,
+		.base = { 0x01d00, 0x02100, 0x02500 },
+		.caps = MDP_PIPE_CAP_HFLIP |
+			MDP_PIPE_CAP_VFLIP |
+			MDP_PIPE_CAP_SCALE |
+			0,
+	},
+	.pipe_dma = {
+		.count = 2,
+		.base = { 0x02900, 0x02d00 },
+		.caps = MDP_PIPE_CAP_HFLIP |
+			MDP_PIPE_CAP_VFLIP |
+			0,
+	},
+	.lm = {
+		.count = 5,
+		.base = { 0x03100, 0x03500, 0x03900, 0x03d00, 0x04100 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 1, .pp = 1, .dspp = 1,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 2, .pp = 2, .dspp = 2,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 3, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB },
+				{ .id = 4, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB },
+			     },
+		.nb_stages = 5,
+		.max_width = 2048,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 3,
+		.base = { 0x04500, 0x04900, 0x04d00 },
+	},
+	.pp = {
+		.count = 3,
+		.base = { 0x21a00, 0x21b00, 0x21c00 },
+	},
+	.intf = {
+		.base = { 0x21000, 0x21200, 0x21400, 0x21600 },
+		.connect = {
+			[0] = INTF_eDP,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+			[3] = INTF_HDMI,
+		},
+	},
+	.perf = {
+		.ab_inefficiency = 200,
+		.ib_inefficiency = 120,
+		.clk_inefficiency = 125
+	},
+	.max_clk = 200000000,
+};
+
+static const struct mdp5_cfg_hw msm8x26_config = {
+	.name = "msm8x26",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_SMP |
+			0,
+	},
+	.smp = {
+		.mmb_count = 7,
+		.mmb_size = 4096,
+		.clients = {
+			[SSPP_VIG0] =  1,
+			[SSPP_DMA0] = 4,
+			[SSPP_RGB0] = 7,
+		},
+	},
+	.ctl = {
+		.count = 2,
+		.base = { 0x00500, 0x00600 },
+		.flush_hw_mask = 0x0003ffff,
+	},
+	.pipe_vig = {
+		.count = 1,
+		.base = { 0x01100 },
+		.caps = MDP_PIPE_CAP_HFLIP |
+			MDP_PIPE_CAP_VFLIP |
+			MDP_PIPE_CAP_SCALE |
+			MDP_PIPE_CAP_CSC   |
+			0,
+	},
+	.pipe_rgb = {
+		.count = 1,
+		.base = { 0x01d00 },
+		.caps = MDP_PIPE_CAP_HFLIP |
+			MDP_PIPE_CAP_VFLIP |
+			MDP_PIPE_CAP_SCALE |
+			0,
+	},
+	.pipe_dma = {
+		.count = 1,
+		.base = { 0x02900 },
+		.caps = MDP_PIPE_CAP_HFLIP |
+			MDP_PIPE_CAP_VFLIP |
+			0,
+	},
+	.lm = {
+		.count = 2,
+		.base = { 0x03100, 0x03d00 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 1, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB },
+			     },
+		.nb_stages = 2,
+		.max_width = 2048,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 1,
+		.base = { 0x04500 },
+	},
+	.pp = {
+		.count = 1,
+		.base = { 0x21a00 },
+	},
+	.intf = {
+		.base = { 0x00000, 0x21200 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+		},
+	},
+	.perf = {
+		.ab_inefficiency = 100,
+		.ib_inefficiency = 200,
+		.clk_inefficiency = 125
+	},
+	.max_clk = 200000000,
+};
+
+static const struct mdp5_cfg_hw msm8x74v2_config = {
+	.name = "msm8x74",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_SMP |
+			0,
+	},
+	.smp = {
+		.mmb_count = 22,
+		.mmb_size = 4096,
+		.clients = {
+			[SSPP_VIG0] =  1, [SSPP_VIG1] =  4, [SSPP_VIG2] =  7,
+			[SSPP_DMA0] = 10, [SSPP_DMA1] = 13,
+			[SSPP_RGB0] = 16, [SSPP_RGB1] = 17, [SSPP_RGB2] = 18,
+		},
+	},
+	.ctl = {
+		.count = 5,
+		.base = { 0x00500, 0x00600, 0x00700, 0x00800, 0x00900 },
+		.flush_hw_mask = 0x0003ffff,
+	},
+	.pipe_vig = {
+		.count = 3,
+		.base = { 0x01100, 0x01500, 0x01900 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_CSC |
+				MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_rgb = {
+		.count = 3,
+		.base = { 0x01d00, 0x02100, 0x02500 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_dma = {
+		.count = 2,
+		.base = { 0x02900, 0x02d00 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP,
+	},
+	.lm = {
+		.count = 5,
+		.base = { 0x03100, 0x03500, 0x03900, 0x03d00, 0x04100 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 1, .pp = 1, .dspp = 1,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 2, .pp = 2, .dspp = 2,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 3, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				{ .id = 4, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+			     },
+		.nb_stages = 5,
+		.max_width = 2048,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 3,
+		.base = { 0x04500, 0x04900, 0x04d00 },
+	},
+	.ad = {
+		.count = 2,
+		.base = { 0x13000, 0x13200 },
+	},
+	.pp = {
+		.count = 3,
+		.base = { 0x12c00, 0x12d00, 0x12e00 },
+	},
+	.intf = {
+		.base = { 0x12400, 0x12600, 0x12800, 0x12a00 },
+		.connect = {
+			[0] = INTF_eDP,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+			[3] = INTF_HDMI,
+		},
+	},
+	.perf = {
+		.ab_inefficiency = 200,
+		.ib_inefficiency = 120,
+		.clk_inefficiency = 125
+	},
+	.max_clk = 320000000,
+};
+
+static const struct mdp5_cfg_hw apq8084_config = {
+	.name = "apq8084",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_SMP |
+			MDP_CAP_SRC_SPLIT |
+			0,
+	},
+	.smp = {
+		.mmb_count = 44,
+		.mmb_size = 8192,
+		.clients = {
+			[SSPP_VIG0] =  1, [SSPP_VIG1] =  4,
+			[SSPP_VIG2] =  7, [SSPP_VIG3] = 19,
+			[SSPP_DMA0] = 10, [SSPP_DMA1] = 13,
+			[SSPP_RGB0] = 16, [SSPP_RGB1] = 17,
+			[SSPP_RGB2] = 18, [SSPP_RGB3] = 22,
+		},
+		.reserved_state[0] = GENMASK(7, 0),	/* first 8 MMBs */
+		.reserved = {
+			/* Two SMP blocks are statically tied to RGB pipes: */
+			[16] = 2, [17] = 2, [18] = 2, [22] = 2,
+		},
+	},
+	.ctl = {
+		.count = 5,
+		.base = { 0x00500, 0x00600, 0x00700, 0x00800, 0x00900 },
+		.flush_hw_mask = 0x003fffff,
+	},
+	.pipe_vig = {
+		.count = 4,
+		.base = { 0x01100, 0x01500, 0x01900, 0x01d00 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_CSC |
+				MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_rgb = {
+		.count = 4,
+		.base = { 0x02100, 0x02500, 0x02900, 0x02d00 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_dma = {
+		.count = 2,
+		.base = { 0x03100, 0x03500 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP,
+	},
+	.lm = {
+		.count = 6,
+		.base = { 0x03900, 0x03d00, 0x04100, 0x04500, 0x04900, 0x04d00 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 1, .pp = 1, .dspp = 1,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 2, .pp = 2, .dspp = 2,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 3, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				{ .id = 4, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				{ .id = 5, .pp = 3, .dspp = 3,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+			     },
+		.nb_stages = 5,
+		.max_width = 2048,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 4,
+		.base = { 0x05100, 0x05500, 0x05900, 0x05d00 },
+
+	},
+	.ad = {
+		.count = 3,
+		.base = { 0x13400, 0x13600, 0x13800 },
+	},
+	.pp = {
+		.count = 4,
+		.base = { 0x12e00, 0x12f00, 0x13000, 0x13100 },
+	},
+	.intf = {
+		.base = { 0x12400, 0x12600, 0x12800, 0x12a00, 0x12c00 },
+		.connect = {
+			[0] = INTF_eDP,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+			[3] = INTF_HDMI,
+		},
+	},
+	.perf = {
+		.ab_inefficiency = 200,
+		.ib_inefficiency = 120,
+		.clk_inefficiency = 105
+	},
+	.max_clk = 320000000,
+};
+
+static const struct mdp5_cfg_hw msm8x16_config = {
+	.name = "msm8x16",
+	.mdp = {
+		.count = 1,
+		.base = { 0x0 },
+		.caps = MDP_CAP_SMP |
+			0,
+	},
+	.smp = {
+		.mmb_count = 8,
+		.mmb_size = 8192,
+		.clients = {
+			[SSPP_VIG0] = 1, [SSPP_DMA0] = 4,
+			[SSPP_RGB0] = 7, [SSPP_RGB1] = 8,
+		},
+	},
+	.ctl = {
+		.count = 5,
+		.base = { 0x01000, 0x01200, 0x01400, 0x01600, 0x01800 },
+		.flush_hw_mask = 0x4003ffff,
+	},
+	.pipe_vig = {
+		.count = 1,
+		.base = { 0x04000 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_CSC |
+				MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_rgb = {
+		.count = 2,
+		.base = { 0x14000, 0x16000 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_dma = {
+		.count = 1,
+		.base = { 0x24000 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP,
+	},
+	.lm = {
+		.count = 2, /* LM0 and LM3 */
+		.base = { 0x44000, 0x47000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 3, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB },
+			     },
+		.nb_stages = 8,
+		.max_width = 2048,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 1,
+		.base = { 0x54000 },
+
+	},
+	.intf = {
+		.base = { 0x00000, 0x6a800 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+		},
+	},
+	.perf = {
+		.ab_inefficiency = 100,
+		.ib_inefficiency = 200,
+		.clk_inefficiency = 105
+	},
+	.max_clk = 320000000,
+};
+
+static const struct mdp5_cfg_hw msm8x36_config = {
+	.name = "msm8x36",
+	.mdp = {
+		.count = 1,
+		.base = { 0x0 },
+		.caps = MDP_CAP_SMP |
+			0,
+	},
+	.smp = {
+		.mmb_count = 8,
+		.mmb_size = 10240,
+		.clients = {
+			[SSPP_VIG0] = 1, [SSPP_DMA0] = 4,
+			[SSPP_RGB0] = 7, [SSPP_RGB1] = 8,
+		},
+	},
+	.ctl = {
+		.count = 3,
+		.base = { 0x01000, 0x01200, 0x01400 },
+		.flush_hw_mask = 0x4003ffff,
+	},
+	.pipe_vig = {
+		.count = 1,
+		.base = { 0x04000 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_CSC |
+				MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_rgb = {
+		.count = 2,
+		.base = { 0x14000, 0x16000 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_dma = {
+		.count = 1,
+		.base = { 0x24000 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP,
+	},
+	.lm = {
+		.count = 2,
+		.base = { 0x44000, 0x47000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 1, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				},
+		.nb_stages = 8,
+		.max_width = 2560,
+		.max_height = 0xFFFF,
+	},
+	.pp = {
+		.count = 1,
+		.base = { 0x70000 },
+	},
+	.ad = {
+		.count = 1,
+		.base = { 0x78000 },
+	},
+	.dspp = {
+		.count = 1,
+		.base = { 0x54000 },
+	},
+	.intf = {
+		.base = { 0x00000, 0x6a800, 0x6b000 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+		},
+	},
+	.perf = {
+		.ab_inefficiency = 100,
+		.ib_inefficiency = 200,
+		.clk_inefficiency = 105
+	},
+	.max_clk = 366670000,
+};
+
+static const struct mdp5_cfg_hw msm8x94_config = {
+	.name = "msm8x94",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_SMP |
+			MDP_CAP_SRC_SPLIT |
+			0,
+	},
+	.smp = {
+		.mmb_count = 44,
+		.mmb_size = 8192,
+		.clients = {
+			[SSPP_VIG0] =  1, [SSPP_VIG1] =  4,
+			[SSPP_VIG2] =  7, [SSPP_VIG3] = 19,
+			[SSPP_DMA0] = 10, [SSPP_DMA1] = 13,
+			[SSPP_RGB0] = 16, [SSPP_RGB1] = 17,
+			[SSPP_RGB2] = 18, [SSPP_RGB3] = 22,
+		},
+		.reserved_state[0] = GENMASK(23, 0),	/* first 24 MMBs */
+		.reserved = {
+			 [1] = 1,  [4] = 1,  [7] = 1, [19] = 1,
+			[16] = 5, [17] = 5, [18] = 5, [22] = 5,
+		},
+	},
+	.ctl = {
+		.count = 5,
+		.base = { 0x01000, 0x01200, 0x01400, 0x01600, 0x01800 },
+		.flush_hw_mask = 0xf0ffffff,
+	},
+	.pipe_vig = {
+		.count = 4,
+		.base = { 0x04000, 0x06000, 0x08000, 0x0a000 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_CSC |
+				MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_rgb = {
+		.count = 4,
+		.base = { 0x14000, 0x16000, 0x18000, 0x1a000 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
+				MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_DECIMATION,
+	},
+	.pipe_dma = {
+		.count = 2,
+		.base = { 0x24000, 0x26000 },
+		.caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP,
+	},
+	.lm = {
+		.count = 6,
+		.base = { 0x44000, 0x45000, 0x46000, 0x47000, 0x48000, 0x49000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 1, .pp = 1, .dspp = 1,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 2, .pp = 2, .dspp = 2,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 3, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				{ .id = 4, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				{ .id = 5, .pp = 3, .dspp = 3,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+			     },
+		.nb_stages = 8,
+		.max_width = 2048,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 4,
+		.base = { 0x54000, 0x56000, 0x58000, 0x5a000 },
+
+	},
+	.ad = {
+		.count = 3,
+		.base = { 0x78000, 0x78800, 0x79000 },
+	},
+	.pp = {
+		.count = 4,
+		.base = { 0x70000, 0x70800, 0x71000, 0x71800 },
+	},
+	.intf = {
+		.base = { 0x6a000, 0x6a800, 0x6b000, 0x6b800, 0x6c000 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+			[3] = INTF_HDMI,
+		},
+	},
+	.perf = {
+		.ab_inefficiency = 100,
+		.ib_inefficiency = 100,
+		.clk_inefficiency = 105
+	},
+	.max_clk = 400000000,
+};
+
+static const struct mdp5_cfg_hw msm8x96_config = {
+	.name = "msm8x96",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_DSC |
+			MDP_CAP_CDM |
+			MDP_CAP_SRC_SPLIT |
+			0,
+	},
+	.ctl = {
+		.count = 5,
+		.base = { 0x01000, 0x01200, 0x01400, 0x01600, 0x01800 },
+		.flush_hw_mask = 0xf4ffffff,
+	},
+	.pipe_vig = {
+		.count = 4,
+		.base = { 0x04000, 0x06000, 0x08000, 0x0a000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_CSC	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_rgb = {
+		.count = 4,
+		.base = { 0x14000, 0x16000, 0x18000, 0x1a000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_dma = {
+		.count = 2,
+		.base = { 0x24000, 0x26000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_cursor = {
+		.count = 2,
+		.base = { 0x34000, 0x36000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			MDP_PIPE_CAP_CURSOR	|
+			0,
+	},
+
+	.lm = {
+		.count = 6,
+		.base = { 0x44000, 0x45000, 0x46000, 0x47000, 0x48000, 0x49000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 1, .pp = 1, .dspp = 1,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 2, .pp = 2, .dspp = -1,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 3, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				{ .id = 4, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				{ .id = 5, .pp = 3, .dspp = -1,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+			     },
+		.nb_stages = 8,
+		.max_width = 2560,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 2,
+		.base = { 0x54000, 0x56000 },
+	},
+	.ad = {
+		.count = 3,
+		.base = { 0x78000, 0x78800, 0x79000 },
+	},
+	.pp = {
+		.count = 4,
+		.base = { 0x70000, 0x70800, 0x71000, 0x71800 },
+	},
+	.cdm = {
+		.count = 1,
+		.base = { 0x79200 },
+	},
+	.dsc = {
+		.count = 2,
+		.base = { 0x80000, 0x80400 },
+	},
+	.intf = {
+		.base = { 0x6a000, 0x6a800, 0x6b000, 0x6b800, 0x6c000 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+			[3] = INTF_HDMI,
+		},
+	},
+	.perf = {
+		.ab_inefficiency = 100,
+		.ib_inefficiency = 200,
+		.clk_inefficiency = 105
+	},
+	.max_clk = 412500000,
+};
+
+static const struct mdp5_cfg_hw msm8x76_config = {
+	.name = "msm8x76",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_SMP |
+			MDP_CAP_DSC |
+			MDP_CAP_SRC_SPLIT |
+			0,
+	},
+	.ctl = {
+		.count = 3,
+		.base = { 0x01000, 0x01200, 0x01400 },
+		.flush_hw_mask = 0xffffffff,
+	},
+	.smp = {
+		.mmb_count = 10,
+		.mmb_size = 10240,
+		.clients = {
+			[SSPP_VIG0] = 1, [SSPP_VIG1] = 9,
+			[SSPP_DMA0] = 4,
+			[SSPP_RGB0] = 7, [SSPP_RGB1] = 8,
+		},
+	},
+	.pipe_vig = {
+		.count = 2,
+		.base = { 0x04000, 0x06000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_CSC	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_rgb = {
+		.count = 2,
+		.base = { 0x14000, 0x16000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_dma = {
+		.count = 1,
+		.base = { 0x24000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_cursor = {
+		.count = 1,
+		.base = { 0x440DC },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			MDP_PIPE_CAP_CURSOR	|
+			0,
+	},
+	.lm = {
+		.count = 2,
+		.base = { 0x44000, 0x45000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 1, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB },
+			     },
+		.nb_stages = 8,
+		.max_width = 2560,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 1,
+		.base = { 0x54000 },
+
+	},
+	.pp = {
+		.count = 3,
+		.base = { 0x70000, 0x70800, 0x72000 },
+	},
+	.dsc = {
+		.count = 2,
+		.base = { 0x80000, 0x80400 },
+	},
+	.intf = {
+		.base = { 0x6a000, 0x6a800, 0x6b000 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+		},
+	},
+	.max_clk = 360000000,
+};
+
+static const struct mdp5_cfg_hw msm8x53_config = {
+	.name = "msm8x53",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_CDM |
+			MDP_CAP_SRC_SPLIT,
+	},
+	.ctl = {
+		.count = 3,
+		.base = { 0x01000, 0x01200, 0x01400 },
+		.flush_hw_mask = 0xffffffff,
+	},
+	.pipe_vig = {
+		.count = 1,
+		.base = { 0x04000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_CSC	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_rgb = {
+		.count = 2,
+		.base = { 0x14000, 0x16000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_dma = {
+		.count = 1,
+		.base = { 0x24000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_cursor = {
+		.count = 1,
+		.base = { 0x34000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			MDP_PIPE_CAP_CURSOR	|
+			0,
+	},
+
+	.lm = {
+		.count = 3,
+		.base = { 0x44000, 0x45000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR },
+				{ .id = 1, .pp = 1, .dspp = -1,
+				  .caps = MDP_LM_CAP_DISPLAY },
+			     },
+		.nb_stages = 5,
+		.max_width = 2048,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 1,
+		.base = { 0x54000 },
+
+	},
+	.pp = {
+		.count = 2,
+		.base = { 0x70000, 0x70800 },
+	},
+	.cdm = {
+		.count = 1,
+		.base = { 0x79200 },
+	},
+	.intf = {
+		.base = { 0x6a000, 0x6a800, 0x6b000 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+		},
+	},
+	.perf = {
+		.ab_inefficiency = 100,
+		.ib_inefficiency = 200,
+		.clk_inefficiency = 105
+	},
+	.max_clk = 400000000,
+};
+
+static const struct mdp5_cfg_hw msm8917_config = {
+	.name = "msm8917",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_CDM,
+	},
+	.ctl = {
+		.count = 3,
+		.base = { 0x01000, 0x01200, 0x01400 },
+		.flush_hw_mask = 0xffffffff,
+	},
+	.pipe_vig = {
+		.count = 1,
+		.base = { 0x04000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_CSC	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_rgb = {
+		.count = 2,
+		.base = { 0x14000, 0x16000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_dma = {
+		.count = 1,
+		.base = { 0x24000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_cursor = {
+		.count = 1,
+		.base = { 0x34000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			MDP_PIPE_CAP_CURSOR	|
+			0,
+	},
+
+	.lm = {
+		.count = 2,
+		.base = { 0x44000, 0x45000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 1, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB },
+			     },
+		.nb_stages = 8,
+		.max_width = 2048,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 1,
+		.base = { 0x54000 },
+
+	},
+	.pp = {
+		.count = 1,
+		.base = { 0x70000 },
+	},
+	.cdm = {
+		.count = 1,
+		.base = { 0x79200 },
+	},
+	.intf = {
+		.base = { 0x6a000, 0x6a800 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+		},
+	},
+	.max_clk = 320000000,
+};
+
+static const struct mdp5_cfg_hw msm8998_config = {
+	.name = "msm8998",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_DSC |
+			MDP_CAP_CDM |
+			MDP_CAP_SRC_SPLIT |
+			0,
+	},
+	.ctl = {
+		.count = 5,
+		.base = { 0x01000, 0x01200, 0x01400, 0x01600, 0x01800 },
+		.flush_hw_mask = 0xf7ffffff,
+	},
+	.pipe_vig = {
+		.count = 4,
+		.base = { 0x04000, 0x06000, 0x08000, 0x0a000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_CSC	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_rgb = {
+		.count = 4,
+		.base = { 0x14000, 0x16000, 0x18000, 0x1a000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_dma = {
+		.count = 2, /* driver supports max of 2 currently */
+		.base = { 0x24000, 0x26000, 0x28000, 0x2a000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_cursor = {
+		.count = 2,
+		.base = { 0x34000, 0x36000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			MDP_PIPE_CAP_CURSOR	|
+			0,
+	},
+
+	.lm = {
+		.count = 6,
+		.base = { 0x44000, 0x45000, 0x46000, 0x47000, 0x48000, 0x49000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 1, .pp = 1, .dspp = 1,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 2, .pp = 2, .dspp = -1,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 3, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				{ .id = 4, .pp = -1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				{ .id = 5, .pp = 3, .dspp = -1,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+			     },
+		.nb_stages = 8,
+		.max_width = 2560,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 2,
+		.base = { 0x54000, 0x56000 },
+	},
+	.ad = {
+		.count = 3,
+		.base = { 0x78000, 0x78800, 0x79000 },
+	},
+	.pp = {
+		.count = 4,
+		.base = { 0x70000, 0x70800, 0x71000, 0x71800 },
+	},
+	.cdm = {
+		.count = 1,
+		.base = { 0x79200 },
+	},
+	.dsc = {
+		.count = 2,
+		.base = { 0x80000, 0x80400 },
+	},
+	.intf = {
+		.base = { 0x6a000, 0x6a800, 0x6b000, 0x6b800, 0x6c000 },
+		.connect = {
+			[0] = INTF_eDP,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+			[3] = INTF_HDMI,
+		},
+	},
+	.max_clk = 412500000,
+};
+
+static const struct mdp5_cfg_hw sdm630_config = {
+	.name = "sdm630",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_CDM |
+			MDP_CAP_SRC_SPLIT |
+			0,
+	},
+	.ctl = {
+		.count = 5,
+		.base = { 0x01000, 0x01200, 0x01400, 0x01600, 0x01800 },
+		.flush_hw_mask = 0xf4ffffff,
+	},
+	.pipe_vig = {
+		.count = 1,
+		.base = { 0x04000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_CSC	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_rgb = {
+		.count = 4,
+		.base = { 0x14000, 0x16000, 0x18000, 0x1a000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_dma = {
+		.count = 2, /* driver supports max of 2 currently */
+		.base = { 0x24000, 0x26000, 0x28000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_cursor = {
+		.count = 1,
+		.base = { 0x34000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			MDP_PIPE_CAP_CURSOR	|
+			0,
+	},
+
+	.lm = {
+		.count = 2,
+		.base = { 0x44000, 0x46000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 1, .pp = 1, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				},
+		.nb_stages = 8,
+		.max_width = 2048,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 1,
+		.base = { 0x54000 },
+	},
+	.ad = {
+		.count = 2,
+		.base = { 0x78000, 0x78800 },
+	},
+	.pp = {
+		.count = 3,
+		.base = { 0x70000, 0x71000, 0x72000 },
+	},
+	.cdm = {
+		.count = 1,
+		.base = { 0x79200 },
+	},
+	.intf = {
+		.base = { 0x6a000, 0x6a800 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+		},
+	},
+	.max_clk = 412500000,
+};
+
+static const struct mdp5_cfg_hw sdm660_config = {
+	.name = "sdm660",
+	.mdp = {
+		.count = 1,
+		.caps = MDP_CAP_DSC |
+			MDP_CAP_CDM |
+			MDP_CAP_SRC_SPLIT |
+			0,
+	},
+	.ctl = {
+		.count = 5,
+		.base = { 0x01000, 0x01200, 0x01400, 0x01600, 0x01800 },
+		.flush_hw_mask = 0xf4ffffff,
+	},
+	.pipe_vig = {
+		.count = 2,
+		.base = { 0x04000, 0x6000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_CSC	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_rgb = {
+		.count = 4,
+		.base = { 0x14000, 0x16000, 0x18000, 0x1a000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SCALE	|
+			MDP_PIPE_CAP_DECIMATION	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_dma = {
+		.count = 2, /* driver supports max of 2 currently */
+		.base = { 0x24000, 0x26000, 0x28000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			0,
+	},
+	.pipe_cursor = {
+		.count = 1,
+		.base = { 0x34000 },
+		.caps = MDP_PIPE_CAP_HFLIP	|
+			MDP_PIPE_CAP_VFLIP	|
+			MDP_PIPE_CAP_SW_PIX_EXT	|
+			MDP_PIPE_CAP_CURSOR	|
+			0,
+	},
+
+	.lm = {
+		.count = 4,
+		.base = { 0x44000, 0x45000, 0x46000, 0x49000 },
+		.instances = {
+				{ .id = 0, .pp = 0, .dspp = 0,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 1, .pp = 1, .dspp = 1,
+				  .caps = MDP_LM_CAP_DISPLAY, },
+				{ .id = 2, .pp = 2, .dspp = -1,
+				  .caps = MDP_LM_CAP_DISPLAY |
+					  MDP_LM_CAP_PAIR, },
+				{ .id = 3, .pp = 3, .dspp = -1,
+				  .caps = MDP_LM_CAP_WB, },
+				},
+		.nb_stages = 8,
+		.max_width = 2560,
+		.max_height = 0xFFFF,
+	},
+	.dspp = {
+		.count = 2,
+		.base = { 0x54000, 0x56000 },
+	},
+	.ad = {
+		.count = 2,
+		.base = { 0x78000, 0x78800 },
+	},
+	.pp = {
+		.count = 5,
+		.base = { 0x70000, 0x70800, 0x71000, 0x71800, 0x72000 },
+	},
+	.cdm = {
+		.count = 1,
+		.base = { 0x79200 },
+	},
+	.dsc = {
+		.count = 2,
+		.base = { 0x80000, 0x80400 },
+	},
+	.intf = {
+		.base = { 0x6a000, 0x6a800, 0x6b000, 0x6b800 },
+		.connect = {
+			[0] = INTF_DISABLED,
+			[1] = INTF_DSI,
+			[2] = INTF_DSI,
+			[3] = INTF_HDMI,
+		},
+	},
+	.max_clk = 412500000,
+};
+
+static const struct mdp5_cfg_handler cfg_handlers_v1[] = {
+	{ .revision = 0, .config = { .hw = &msm8x74v1_config } },
+	{ .revision = 1, .config = { .hw = &msm8x26_config } },
+	{ .revision = 2, .config = { .hw = &msm8x74v2_config } },
+	{ .revision = 3, .config = { .hw = &apq8084_config } },
+	{ .revision = 6, .config = { .hw = &msm8x16_config } },
+	{ .revision = 8, .config = { .hw = &msm8x36_config } },
+	{ .revision = 9, .config = { .hw = &msm8x94_config } },
+	{ .revision = 7, .config = { .hw = &msm8x96_config } },
+	{ .revision = 11, .config = { .hw = &msm8x76_config } },
+	{ .revision = 15, .config = { .hw = &msm8917_config } },
+	{ .revision = 16, .config = { .hw = &msm8x53_config } },
+};
+
+static const struct mdp5_cfg_handler cfg_handlers_v3[] = {
+	{ .revision = 0, .config = { .hw = &msm8998_config } },
+	{ .revision = 2, .config = { .hw = &sdm660_config } },
+	{ .revision = 3, .config = { .hw = &sdm630_config } },
+};
+
+const struct mdp5_cfg_hw *mdp5_cfg_get_hw_config(struct mdp5_cfg_handler *cfg_handler)
+{
+	return cfg_handler->config.hw;
+}
+
+struct mdp5_cfg *mdp5_cfg_get_config(struct mdp5_cfg_handler *cfg_handler)
+{
+	return &cfg_handler->config;
+}
+
+int mdp5_cfg_get_hw_rev(struct mdp5_cfg_handler *cfg_handler)
+{
+	return cfg_handler->revision;
+}
+
+struct mdp5_cfg_handler *mdp5_cfg_init(struct mdp5_kms *mdp5_kms,
+		uint32_t major, uint32_t minor)
+{
+	struct drm_device *dev = mdp5_kms->dev;
+	struct mdp5_cfg_handler *cfg_handler;
+	const struct mdp5_cfg_handler *cfg_handlers;
+	int i, num_handlers;
+
+	cfg_handler = devm_kzalloc(dev->dev, sizeof(*cfg_handler), GFP_KERNEL);
+	if (unlikely(!cfg_handler)) {
+		return ERR_PTR(-ENOMEM);
+	}
+
+	switch (major) {
+	case 1:
+		cfg_handlers = cfg_handlers_v1;
+		num_handlers = ARRAY_SIZE(cfg_handlers_v1);
+		break;
+	case 3:
+		cfg_handlers = cfg_handlers_v3;
+		num_handlers = ARRAY_SIZE(cfg_handlers_v3);
+		break;
+	default:
+		DRM_DEV_ERROR(dev->dev, "unexpected MDP major version: v%d.%d\n",
+				major, minor);
+		return ERR_PTR(-ENXIO);
+	}
+
+	/* only after mdp5_cfg global pointer's init can we access the hw */
+	for (i = 0; i < num_handlers; i++) {
+		if (cfg_handlers[i].revision != minor)
+			continue;
+		mdp5_cfg = cfg_handlers[i].config.hw;
+
+		break;
+	}
+	if (unlikely(!mdp5_cfg)) {
+		DRM_DEV_ERROR(dev->dev, "unexpected MDP minor revision: v%d.%d\n",
+				major, minor);
+		return ERR_PTR(-ENXIO);
+	}
+
+	cfg_handler->revision = minor;
+	cfg_handler->config.hw = mdp5_cfg;
+
+	DBG("MDP5: %s hw config selected", mdp5_cfg->name);
+
+	return cfg_handler;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_cfg.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_cfg.h
@@ -0,0 +1,136 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __MDP5_CFG_H__
+#define __MDP5_CFG_H__
+
+#include "msm_drv.h"
+
+/*
+ * mdp5_cfg
+ *
+ * This module configures the dynamic offsets used by mdp5.xml.h
+ * (initialized in mdp5_cfg.c)
+ */
+extern const struct mdp5_cfg_hw *mdp5_cfg;
+
+#define MAX_CTL			8
+#define MAX_BASES		8
+#define MAX_SMP_BLOCKS		44
+#define MAX_CLIENTS		32
+
+typedef DECLARE_BITMAP(mdp5_smp_state_t, MAX_SMP_BLOCKS);
+
+#define MDP5_SUB_BLOCK_DEFINITION \
+	unsigned int count; \
+	uint32_t base[MAX_BASES]
+
+struct mdp5_sub_block {
+	MDP5_SUB_BLOCK_DEFINITION;
+};
+
+struct mdp5_lm_instance {
+	int id;
+	int pp;
+	int dspp;
+	uint32_t caps;
+};
+
+struct mdp5_lm_block {
+	MDP5_SUB_BLOCK_DEFINITION;
+	struct mdp5_lm_instance instances[MAX_BASES];
+	uint32_t nb_stages;		/* number of stages per blender */
+	uint32_t max_width;		/* Maximum output resolution */
+	uint32_t max_height;
+};
+
+struct mdp5_pipe_block {
+	MDP5_SUB_BLOCK_DEFINITION;
+	uint32_t caps;			/* pipe capabilities */
+};
+
+struct mdp5_ctl_block {
+	MDP5_SUB_BLOCK_DEFINITION;
+	uint32_t flush_hw_mask;		/* FLUSH register's hardware mask */
+};
+
+struct mdp5_smp_block {
+	int mmb_count;			/* number of SMP MMBs */
+	int mmb_size;			/* MMB: size in bytes */
+	uint32_t clients[MAX_CLIENTS];	/* SMP port allocation /pipe */
+	mdp5_smp_state_t reserved_state;/* SMP MMBs statically allocated */
+	uint8_t reserved[MAX_CLIENTS];	/* # of MMBs allocated per client */
+};
+
+struct mdp5_mdp_block {
+	MDP5_SUB_BLOCK_DEFINITION;
+	uint32_t caps;			/* MDP capabilities: MDP_CAP_xxx bits */
+};
+
+struct mdp5_wb_instance {
+	int id;
+	int lm;
+};
+
+struct mdp5_wb_block {
+	MDP5_SUB_BLOCK_DEFINITION;
+	struct mdp5_wb_instance instances[MAX_BASES];
+};
+
+#define MDP5_INTF_NUM_MAX	5
+
+struct mdp5_intf_block {
+	uint32_t base[MAX_BASES];
+	u32 connect[MDP5_INTF_NUM_MAX]; /* array of enum mdp5_intf_type */
+};
+
+struct mdp5_perf_block {
+	u32 ab_inefficiency;
+	u32 ib_inefficiency;
+	u32 clk_inefficiency;
+};
+
+struct mdp5_cfg_hw {
+	char  *name;
+
+	struct mdp5_mdp_block mdp;
+	struct mdp5_smp_block smp;
+	struct mdp5_ctl_block ctl;
+	struct mdp5_pipe_block pipe_vig;
+	struct mdp5_pipe_block pipe_rgb;
+	struct mdp5_pipe_block pipe_dma;
+	struct mdp5_pipe_block pipe_cursor;
+	struct mdp5_lm_block  lm;
+	struct mdp5_sub_block dspp;
+	struct mdp5_sub_block ad;
+	struct mdp5_sub_block pp;
+	struct mdp5_sub_block dsc;
+	struct mdp5_sub_block cdm;
+	struct mdp5_wb_block wb;
+	struct mdp5_intf_block intf;
+	struct mdp5_perf_block perf;
+
+	uint32_t max_clk;
+};
+
+struct mdp5_cfg {
+	const struct mdp5_cfg_hw *hw;
+};
+
+struct mdp5_kms;
+struct mdp5_cfg_handler;
+
+const struct mdp5_cfg_hw *mdp5_cfg_get_hw_config(struct mdp5_cfg_handler *cfg_hnd);
+struct mdp5_cfg *mdp5_cfg_get_config(struct mdp5_cfg_handler *cfg_hnd);
+int mdp5_cfg_get_hw_rev(struct mdp5_cfg_handler *cfg_hnd);
+
+#define mdp5_cfg_intf_is_virtual(intf_type) ({	\
+	typeof(intf_type) __val = (intf_type);	\
+	(__val) >= INTF_VIRTUAL ? true : false; })
+
+struct mdp5_cfg_handler *mdp5_cfg_init(struct mdp5_kms *mdp5_kms,
+		uint32_t major, uint32_t minor);
+
+#endif /* __MDP5_CFG_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_cmd_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_cmd_encoder.c
@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_probe_helper.h>
+
+#include "mdp5_kms.h"
+
+#ifdef CONFIG_DRM_MSM_DSI
+
+static struct mdp5_kms *get_kms(struct drm_encoder *encoder)
+{
+	struct msm_drm_private *priv = encoder->dev->dev_private;
+	return to_mdp5_kms(to_mdp_kms(priv->kms));
+}
+
+#define VSYNC_CLK_RATE 19200000
+static int pingpong_tearcheck_setup(struct drm_encoder *encoder,
+				    struct drm_display_mode *mode)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(encoder);
+	struct device *dev = encoder->dev->dev;
+	u32 total_lines, vclks_line, cfg;
+	long vsync_clk_speed;
+	struct mdp5_hw_mixer *mixer = mdp5_crtc_get_mixer(encoder->crtc);
+	int pp_id = mixer->pp;
+
+	if (IS_ERR_OR_NULL(mdp5_kms->vsync_clk)) {
+		DRM_DEV_ERROR(dev, "vsync_clk is not initialized\n");
+		return -EINVAL;
+	}
+
+	total_lines = mode->vtotal * drm_mode_vrefresh(mode);
+	if (!total_lines) {
+		DRM_DEV_ERROR(dev, "%s: vtotal(%d) or vrefresh(%d) is 0\n",
+			      __func__, mode->vtotal, drm_mode_vrefresh(mode));
+		return -EINVAL;
+	}
+
+	vsync_clk_speed = clk_round_rate(mdp5_kms->vsync_clk, VSYNC_CLK_RATE);
+	if (vsync_clk_speed <= 0) {
+		DRM_DEV_ERROR(dev, "vsync_clk round rate failed %ld\n",
+							vsync_clk_speed);
+		return -EINVAL;
+	}
+	vclks_line = vsync_clk_speed / total_lines;
+
+	cfg = MDP5_PP_SYNC_CONFIG_VSYNC_COUNTER_EN
+		| MDP5_PP_SYNC_CONFIG_VSYNC_IN_EN;
+	cfg |= MDP5_PP_SYNC_CONFIG_VSYNC_COUNT(vclks_line);
+
+	/*
+	 * Tearcheck emits a blanking signal every vclks_line * vtotal * 2 ticks on
+	 * the vsync_clk equating to roughly half the desired panel refresh rate.
+	 * This is only necessary as stability fallback if interrupts from the
+	 * panel arrive too late or not at all, but is currently used by default
+	 * because these panel interrupts are not wired up yet.
+	 */
+	mdp5_write(mdp5_kms, REG_MDP5_PP_SYNC_CONFIG_VSYNC(pp_id), cfg);
+	mdp5_write(mdp5_kms,
+		REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), (2 * mode->vtotal));
+
+	mdp5_write(mdp5_kms,
+		REG_MDP5_PP_VSYNC_INIT_VAL(pp_id), mode->vdisplay);
+	mdp5_write(mdp5_kms, REG_MDP5_PP_RD_PTR_IRQ(pp_id), mode->vdisplay + 1);
+	mdp5_write(mdp5_kms, REG_MDP5_PP_START_POS(pp_id), mode->vdisplay);
+	mdp5_write(mdp5_kms, REG_MDP5_PP_SYNC_THRESH(pp_id),
+			MDP5_PP_SYNC_THRESH_START(4) |
+			MDP5_PP_SYNC_THRESH_CONTINUE(4));
+	mdp5_write(mdp5_kms, REG_MDP5_PP_AUTOREFRESH_CONFIG(pp_id), 0x0);
+
+	return 0;
+}
+
+static int pingpong_tearcheck_enable(struct drm_encoder *encoder)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(encoder);
+	struct mdp5_hw_mixer *mixer = mdp5_crtc_get_mixer(encoder->crtc);
+	int pp_id = mixer->pp;
+	int ret;
+
+	ret = clk_set_rate(mdp5_kms->vsync_clk,
+		clk_round_rate(mdp5_kms->vsync_clk, VSYNC_CLK_RATE));
+	if (ret) {
+		DRM_DEV_ERROR(encoder->dev->dev,
+			"vsync_clk clk_set_rate failed, %d\n", ret);
+		return ret;
+	}
+	ret = clk_prepare_enable(mdp5_kms->vsync_clk);
+	if (ret) {
+		DRM_DEV_ERROR(encoder->dev->dev,
+			"vsync_clk clk_prepare_enable failed, %d\n", ret);
+		return ret;
+	}
+
+	mdp5_write(mdp5_kms, REG_MDP5_PP_TEAR_CHECK_EN(pp_id), 1);
+
+	return 0;
+}
+
+static void pingpong_tearcheck_disable(struct drm_encoder *encoder)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(encoder);
+	struct mdp5_hw_mixer *mixer = mdp5_crtc_get_mixer(encoder->crtc);
+	int pp_id = mixer->pp;
+
+	mdp5_write(mdp5_kms, REG_MDP5_PP_TEAR_CHECK_EN(pp_id), 0);
+	clk_disable_unprepare(mdp5_kms->vsync_clk);
+}
+
+void mdp5_cmd_encoder_mode_set(struct drm_encoder *encoder,
+			       struct drm_display_mode *mode,
+			       struct drm_display_mode *adjusted_mode)
+{
+	mode = adjusted_mode;
+
+	DBG("set mode: " DRM_MODE_FMT, DRM_MODE_ARG(mode));
+	pingpong_tearcheck_setup(encoder, mode);
+	mdp5_crtc_set_pipeline(encoder->crtc);
+}
+
+void mdp5_cmd_encoder_disable(struct drm_encoder *encoder)
+{
+	struct mdp5_encoder *mdp5_cmd_enc = to_mdp5_encoder(encoder);
+	struct mdp5_ctl *ctl = mdp5_cmd_enc->ctl;
+	struct mdp5_interface *intf = mdp5_cmd_enc->intf;
+	struct mdp5_pipeline *pipeline = mdp5_crtc_get_pipeline(encoder->crtc);
+
+	if (WARN_ON(!mdp5_cmd_enc->enabled))
+		return;
+
+	pingpong_tearcheck_disable(encoder);
+
+	mdp5_ctl_set_encoder_state(ctl, pipeline, false);
+	mdp5_ctl_commit(ctl, pipeline, mdp_ctl_flush_mask_encoder(intf), true);
+
+	mdp5_cmd_enc->enabled = false;
+}
+
+void mdp5_cmd_encoder_enable(struct drm_encoder *encoder)
+{
+	struct mdp5_encoder *mdp5_cmd_enc = to_mdp5_encoder(encoder);
+	struct mdp5_ctl *ctl = mdp5_cmd_enc->ctl;
+	struct mdp5_interface *intf = mdp5_cmd_enc->intf;
+	struct mdp5_pipeline *pipeline = mdp5_crtc_get_pipeline(encoder->crtc);
+
+	if (WARN_ON(mdp5_cmd_enc->enabled))
+		return;
+
+	if (pingpong_tearcheck_enable(encoder))
+		return;
+
+	mdp5_ctl_commit(ctl, pipeline, mdp_ctl_flush_mask_encoder(intf), true);
+
+	mdp5_ctl_set_encoder_state(ctl, pipeline, true);
+
+	mdp5_cmd_enc->enabled = true;
+}
+
+int mdp5_cmd_encoder_set_split_display(struct drm_encoder *encoder,
+				       struct drm_encoder *slave_encoder)
+{
+	struct mdp5_encoder *mdp5_cmd_enc = to_mdp5_encoder(encoder);
+	struct mdp5_kms *mdp5_kms;
+	struct device *dev;
+	int intf_num;
+	u32 data = 0;
+
+	if (!encoder || !slave_encoder)
+		return -EINVAL;
+
+	mdp5_kms = get_kms(encoder);
+	intf_num = mdp5_cmd_enc->intf->num;
+
+	/* Switch slave encoder's trigger MUX, to use the master's
+	 * start signal for the slave encoder
+	 */
+	if (intf_num == 1)
+		data |= MDP5_SPLIT_DPL_UPPER_INTF2_SW_TRG_MUX;
+	else if (intf_num == 2)
+		data |= MDP5_SPLIT_DPL_UPPER_INTF1_SW_TRG_MUX;
+	else
+		return -EINVAL;
+
+	/* Smart Panel, Sync mode */
+	data |= MDP5_SPLIT_DPL_UPPER_SMART_PANEL;
+
+	dev = &mdp5_kms->pdev->dev;
+
+	/* Make sure clocks are on when connectors calling this function. */
+	pm_runtime_get_sync(dev);
+	mdp5_write(mdp5_kms, REG_MDP5_SPLIT_DPL_UPPER, data);
+
+	mdp5_write(mdp5_kms, REG_MDP5_SPLIT_DPL_LOWER,
+		   MDP5_SPLIT_DPL_LOWER_SMART_PANEL);
+	mdp5_write(mdp5_kms, REG_MDP5_SPLIT_DPL_EN, 1);
+	pm_runtime_put_sync(dev);
+
+	return 0;
+}
+#endif /* CONFIG_DRM_MSM_DSI */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_crtc.c
@@ -0,0 +1,1360 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/sort.h>
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_blend.h>
+#include <drm/drm_mode.h>
+#include <drm/drm_crtc.h>
+#include <drm/drm_flip_work.h>
+#include <drm/drm_fourcc.h>
+#include <drm/drm_managed.h>
+#include <drm/drm_probe_helper.h>
+#include <drm/drm_vblank.h>
+
+#include "mdp5_kms.h"
+#include "msm_gem.h"
+
+#define CURSOR_WIDTH	64
+#define CURSOR_HEIGHT	64
+
+struct mdp5_crtc {
+	struct drm_crtc base;
+	int id;
+	bool enabled;
+
+	spinlock_t lm_lock;     /* protect REG_MDP5_LM_* registers */
+
+	/* if there is a pending flip, these will be non-null: */
+	struct drm_pending_vblank_event *event;
+
+	/* Bits have been flushed at the last commit,
+	 * used to decide if a vsync has happened since last commit.
+	 */
+	u32 flushed_mask;
+
+#define PENDING_CURSOR 0x1
+#define PENDING_FLIP   0x2
+	atomic_t pending;
+
+	/* for unref'ing cursor bo's after scanout completes: */
+	struct drm_flip_work unref_cursor_work;
+
+	struct mdp_irq vblank;
+	struct mdp_irq err;
+	struct mdp_irq pp_done;
+
+	struct completion pp_completion;
+
+	bool lm_cursor_enabled;
+
+	struct {
+		/* protect REG_MDP5_LM_CURSOR* registers and cursor scanout_bo*/
+		spinlock_t lock;
+
+		/* current cursor being scanned out: */
+		struct drm_gem_object *scanout_bo;
+		uint64_t iova;
+		uint32_t width, height;
+		int x, y;
+	} cursor;
+};
+#define to_mdp5_crtc(x) container_of(x, struct mdp5_crtc, base)
+
+static void mdp5_crtc_restore_cursor(struct drm_crtc *crtc);
+
+static struct mdp5_kms *get_kms(struct drm_crtc *crtc)
+{
+	struct msm_drm_private *priv = crtc->dev->dev_private;
+	return to_mdp5_kms(to_mdp_kms(priv->kms));
+}
+
+static void request_pending(struct drm_crtc *crtc, uint32_t pending)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+
+	atomic_or(pending, &mdp5_crtc->pending);
+	mdp_irq_register(&get_kms(crtc)->base, &mdp5_crtc->vblank);
+}
+
+static void request_pp_done_pending(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	reinit_completion(&mdp5_crtc->pp_completion);
+}
+
+static u32 crtc_flush(struct drm_crtc *crtc, u32 flush_mask)
+{
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_ctl *ctl = mdp5_cstate->ctl;
+	struct mdp5_pipeline *pipeline = &mdp5_cstate->pipeline;
+	bool start = !mdp5_cstate->defer_start;
+
+	mdp5_cstate->defer_start = false;
+
+	DBG("%s: flush=%08x", crtc->name, flush_mask);
+
+	return mdp5_ctl_commit(ctl, pipeline, flush_mask, start);
+}
+
+/*
+ * flush updates, to make sure hw is updated to new scanout fb,
+ * so that we can safely queue unref to current fb (ie. next
+ * vblank we know hw is done w/ previous scanout_fb).
+ */
+static u32 crtc_flush_all(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_hw_mixer *mixer, *r_mixer;
+	struct drm_plane *plane;
+	uint32_t flush_mask = 0;
+
+	/* this should not happen: */
+	if (WARN_ON(!mdp5_cstate->ctl))
+		return 0;
+
+	drm_atomic_crtc_for_each_plane(plane, crtc) {
+		if (!plane->state->visible)
+			continue;
+		flush_mask |= mdp5_plane_get_flush(plane);
+	}
+
+	mixer = mdp5_cstate->pipeline.mixer;
+	flush_mask |= mdp_ctl_flush_mask_lm(mixer->lm);
+
+	r_mixer = mdp5_cstate->pipeline.r_mixer;
+	if (r_mixer)
+		flush_mask |= mdp_ctl_flush_mask_lm(r_mixer->lm);
+
+	return crtc_flush(crtc, flush_mask);
+}
+
+/* if file!=NULL, this is preclose potential cancel-flip path */
+static void complete_flip(struct drm_crtc *crtc, struct drm_file *file)
+{
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_pipeline *pipeline = &mdp5_cstate->pipeline;
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_ctl *ctl = mdp5_cstate->ctl;
+	struct drm_device *dev = crtc->dev;
+	struct drm_pending_vblank_event *event;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	event = mdp5_crtc->event;
+	if (event) {
+		mdp5_crtc->event = NULL;
+		DBG("%s: send event: %p", crtc->name, event);
+		drm_crtc_send_vblank_event(crtc, event);
+	}
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+
+	if (ctl && !crtc->state->enable) {
+		/* set STAGE_UNUSED for all layers */
+		mdp5_ctl_blend(ctl, pipeline, NULL, NULL, 0, 0);
+		/* XXX: What to do here? */
+		/* mdp5_crtc->ctl = NULL; */
+	}
+}
+
+static void unref_cursor_worker(struct drm_flip_work *work, void *val)
+{
+	struct mdp5_crtc *mdp5_crtc =
+		container_of(work, struct mdp5_crtc, unref_cursor_work);
+	struct mdp5_kms *mdp5_kms = get_kms(&mdp5_crtc->base);
+	struct msm_kms *kms = &mdp5_kms->base.base;
+
+	msm_gem_unpin_iova(val, kms->aspace);
+	drm_gem_object_put(val);
+}
+
+static void mdp5_crtc_flip_cleanup(struct drm_device *dev, void *ptr)
+{
+	struct mdp5_crtc *mdp5_crtc = ptr;
+
+	drm_flip_work_cleanup(&mdp5_crtc->unref_cursor_work);
+}
+
+static inline u32 mdp5_lm_use_fg_alpha_mask(enum mdp_mixer_stage_id stage)
+{
+	switch (stage) {
+	case STAGE0: return MDP5_LM_BLEND_COLOR_OUT_STAGE0_FG_ALPHA;
+	case STAGE1: return MDP5_LM_BLEND_COLOR_OUT_STAGE1_FG_ALPHA;
+	case STAGE2: return MDP5_LM_BLEND_COLOR_OUT_STAGE2_FG_ALPHA;
+	case STAGE3: return MDP5_LM_BLEND_COLOR_OUT_STAGE3_FG_ALPHA;
+	case STAGE4: return MDP5_LM_BLEND_COLOR_OUT_STAGE4_FG_ALPHA;
+	case STAGE5: return MDP5_LM_BLEND_COLOR_OUT_STAGE5_FG_ALPHA;
+	case STAGE6: return MDP5_LM_BLEND_COLOR_OUT_STAGE6_FG_ALPHA;
+	default:
+		return 0;
+	}
+}
+
+/*
+ * left/right pipe offsets for the stage array used in blend_setup()
+ */
+#define PIPE_LEFT	0
+#define PIPE_RIGHT	1
+
+/*
+ * blend_setup() - blend all the planes of a CRTC
+ *
+ * If no base layer is available, border will be enabled as the base layer.
+ * Otherwise all layers will be blended based on their stage calculated
+ * in mdp5_crtc_atomic_check.
+ */
+static void blend_setup(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_pipeline *pipeline = &mdp5_cstate->pipeline;
+	struct mdp5_kms *mdp5_kms = get_kms(crtc);
+	struct drm_plane *plane;
+	struct mdp5_plane_state *pstate, *pstates[STAGE_MAX + 1] = {NULL};
+	const struct mdp_format *format;
+	struct mdp5_hw_mixer *mixer = pipeline->mixer;
+	uint32_t lm = mixer->lm;
+	struct mdp5_hw_mixer *r_mixer = pipeline->r_mixer;
+	uint32_t r_lm = r_mixer ? r_mixer->lm : 0;
+	struct mdp5_ctl *ctl = mdp5_cstate->ctl;
+	uint32_t blend_op, fg_alpha, bg_alpha, ctl_blend_flags = 0;
+	unsigned long flags;
+	enum mdp5_pipe stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { { SSPP_NONE } };
+	enum mdp5_pipe r_stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { { SSPP_NONE } };
+	int i, plane_cnt = 0;
+	bool bg_alpha_enabled = false;
+	u32 mixer_op_mode = 0;
+	u32 val;
+#define blender(stage)	((stage) - STAGE0)
+
+	spin_lock_irqsave(&mdp5_crtc->lm_lock, flags);
+
+	/* ctl could be released already when we are shutting down: */
+	/* XXX: Can this happen now? */
+	if (!ctl)
+		goto out;
+
+	/* Collect all plane information */
+	drm_atomic_crtc_for_each_plane(plane, crtc) {
+		enum mdp5_pipe right_pipe;
+
+		if (!plane->state->visible)
+			continue;
+
+		pstate = to_mdp5_plane_state(plane->state);
+		pstates[pstate->stage] = pstate;
+		stage[pstate->stage][PIPE_LEFT] = mdp5_plane_pipe(plane);
+		/*
+		 * if we have a right mixer, stage the same pipe as we
+		 * have on the left mixer
+		 */
+		if (r_mixer)
+			r_stage[pstate->stage][PIPE_LEFT] =
+						mdp5_plane_pipe(plane);
+		/*
+		 * if we have a right pipe (i.e, the plane comprises of 2
+		 * hwpipes, then stage the right pipe on the right side of both
+		 * the layer mixers
+		 */
+		right_pipe = mdp5_plane_right_pipe(plane);
+		if (right_pipe) {
+			stage[pstate->stage][PIPE_RIGHT] = right_pipe;
+			r_stage[pstate->stage][PIPE_RIGHT] = right_pipe;
+		}
+
+		plane_cnt++;
+	}
+
+	if (!pstates[STAGE_BASE]) {
+		ctl_blend_flags |= MDP5_CTL_BLEND_OP_FLAG_BORDER_OUT;
+		DBG("Border Color is enabled");
+	} else if (plane_cnt) {
+		format = to_mdp_format(msm_framebuffer_format(pstates[STAGE_BASE]->base.fb));
+
+		if (format->alpha_enable)
+			bg_alpha_enabled = true;
+	}
+
+	/* The reset for blending */
+	for (i = STAGE0; i <= STAGE_MAX; i++) {
+		if (!pstates[i])
+			continue;
+
+		format = to_mdp_format(
+			msm_framebuffer_format(pstates[i]->base.fb));
+		plane = pstates[i]->base.plane;
+		blend_op = MDP5_LM_BLEND_OP_MODE_FG_ALPHA(FG_CONST) |
+			MDP5_LM_BLEND_OP_MODE_BG_ALPHA(BG_CONST);
+		fg_alpha = pstates[i]->base.alpha >> 8;
+		bg_alpha = 0xFF - fg_alpha;
+
+		if (!format->alpha_enable && bg_alpha_enabled)
+			mixer_op_mode = 0;
+		else
+			mixer_op_mode |= mdp5_lm_use_fg_alpha_mask(i);
+
+		DBG("Stage %d fg_alpha %x bg_alpha %x", i, fg_alpha, bg_alpha);
+
+		if (format->alpha_enable &&
+		    pstates[i]->base.pixel_blend_mode == DRM_MODE_BLEND_PREMULTI) {
+			blend_op = MDP5_LM_BLEND_OP_MODE_FG_ALPHA(FG_CONST) |
+				MDP5_LM_BLEND_OP_MODE_BG_ALPHA(FG_PIXEL);
+			if (fg_alpha != 0xff) {
+				bg_alpha = fg_alpha;
+				blend_op |=
+					MDP5_LM_BLEND_OP_MODE_BG_MOD_ALPHA |
+					MDP5_LM_BLEND_OP_MODE_BG_INV_MOD_ALPHA;
+			} else {
+				blend_op |= MDP5_LM_BLEND_OP_MODE_BG_INV_ALPHA;
+			}
+		} else if (format->alpha_enable &&
+			   pstates[i]->base.pixel_blend_mode == DRM_MODE_BLEND_COVERAGE) {
+			blend_op = MDP5_LM_BLEND_OP_MODE_FG_ALPHA(FG_PIXEL) |
+				MDP5_LM_BLEND_OP_MODE_BG_ALPHA(FG_PIXEL);
+			if (fg_alpha != 0xff) {
+				bg_alpha = fg_alpha;
+				blend_op |=
+				       MDP5_LM_BLEND_OP_MODE_FG_MOD_ALPHA |
+				       MDP5_LM_BLEND_OP_MODE_FG_INV_MOD_ALPHA |
+				       MDP5_LM_BLEND_OP_MODE_BG_MOD_ALPHA |
+				       MDP5_LM_BLEND_OP_MODE_BG_INV_MOD_ALPHA;
+			} else {
+				blend_op |= MDP5_LM_BLEND_OP_MODE_BG_INV_ALPHA;
+			}
+		}
+
+		mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_OP_MODE(lm,
+				blender(i)), blend_op);
+		mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_FG_ALPHA(lm,
+				blender(i)), fg_alpha);
+		mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_BG_ALPHA(lm,
+				blender(i)), bg_alpha);
+		if (r_mixer) {
+			mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_OP_MODE(r_lm,
+					blender(i)), blend_op);
+			mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_FG_ALPHA(r_lm,
+					blender(i)), fg_alpha);
+			mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_BG_ALPHA(r_lm,
+					blender(i)), bg_alpha);
+		}
+	}
+
+	val = mdp5_read(mdp5_kms, REG_MDP5_LM_BLEND_COLOR_OUT(lm));
+	mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_COLOR_OUT(lm),
+		   val | mixer_op_mode);
+	if (r_mixer) {
+		val = mdp5_read(mdp5_kms, REG_MDP5_LM_BLEND_COLOR_OUT(r_lm));
+		mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_COLOR_OUT(r_lm),
+			   val | mixer_op_mode);
+	}
+
+	mdp5_ctl_blend(ctl, pipeline, stage, r_stage, plane_cnt,
+		       ctl_blend_flags);
+out:
+	spin_unlock_irqrestore(&mdp5_crtc->lm_lock, flags);
+}
+
+static void mdp5_crtc_mode_set_nofb(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_kms *mdp5_kms = get_kms(crtc);
+	struct mdp5_hw_mixer *mixer = mdp5_cstate->pipeline.mixer;
+	struct mdp5_hw_mixer *r_mixer = mdp5_cstate->pipeline.r_mixer;
+	uint32_t lm = mixer->lm;
+	u32 mixer_width, val;
+	unsigned long flags;
+	struct drm_display_mode *mode;
+
+	if (WARN_ON(!crtc->state))
+		return;
+
+	mode = &crtc->state->adjusted_mode;
+
+	DBG("%s: set mode: " DRM_MODE_FMT, crtc->name, DRM_MODE_ARG(mode));
+
+	mixer_width = mode->hdisplay;
+	if (r_mixer)
+		mixer_width /= 2;
+
+	spin_lock_irqsave(&mdp5_crtc->lm_lock, flags);
+	mdp5_write(mdp5_kms, REG_MDP5_LM_OUT_SIZE(lm),
+			MDP5_LM_OUT_SIZE_WIDTH(mixer_width) |
+			MDP5_LM_OUT_SIZE_HEIGHT(mode->vdisplay));
+
+	/* Assign mixer to LEFT side in source split mode */
+	val = mdp5_read(mdp5_kms, REG_MDP5_LM_BLEND_COLOR_OUT(lm));
+	val &= ~MDP5_LM_BLEND_COLOR_OUT_SPLIT_LEFT_RIGHT;
+	mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_COLOR_OUT(lm), val);
+
+	if (r_mixer) {
+		u32 r_lm = r_mixer->lm;
+
+		mdp5_write(mdp5_kms, REG_MDP5_LM_OUT_SIZE(r_lm),
+			   MDP5_LM_OUT_SIZE_WIDTH(mixer_width) |
+			   MDP5_LM_OUT_SIZE_HEIGHT(mode->vdisplay));
+
+		/* Assign mixer to RIGHT side in source split mode */
+		val = mdp5_read(mdp5_kms, REG_MDP5_LM_BLEND_COLOR_OUT(r_lm));
+		val |= MDP5_LM_BLEND_COLOR_OUT_SPLIT_LEFT_RIGHT;
+		mdp5_write(mdp5_kms, REG_MDP5_LM_BLEND_COLOR_OUT(r_lm), val);
+	}
+
+	spin_unlock_irqrestore(&mdp5_crtc->lm_lock, flags);
+}
+
+static struct drm_encoder *get_encoder_from_crtc(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_encoder *encoder;
+
+	drm_for_each_encoder(encoder, dev)
+		if (encoder->crtc == crtc)
+			return encoder;
+
+	return NULL;
+}
+
+static bool mdp5_crtc_get_scanout_position(struct drm_crtc *crtc,
+					   bool in_vblank_irq,
+					   int *vpos, int *hpos,
+					   ktime_t *stime, ktime_t *etime,
+					   const struct drm_display_mode *mode)
+{
+	unsigned int pipe = crtc->index;
+	struct drm_encoder *encoder;
+	int line, vsw, vbp, vactive_start, vactive_end, vfp_end;
+
+
+	encoder = get_encoder_from_crtc(crtc);
+	if (!encoder) {
+		DRM_ERROR("no encoder found for crtc %d\n", pipe);
+		return false;
+	}
+
+	vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
+	vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
+
+	/*
+	 * the line counter is 1 at the start of the VSYNC pulse and VTOTAL at
+	 * the end of VFP. Translate the porch values relative to the line
+	 * counter positions.
+	 */
+
+	vactive_start = vsw + vbp + 1;
+
+	vactive_end = vactive_start + mode->crtc_vdisplay;
+
+	/* last scan line before VSYNC */
+	vfp_end = mode->crtc_vtotal;
+
+	if (stime)
+		*stime = ktime_get();
+
+	line = mdp5_encoder_get_linecount(encoder);
+
+	if (line < vactive_start)
+		line -= vactive_start;
+	else if (line > vactive_end)
+		line = line - vfp_end - vactive_start;
+	else
+		line -= vactive_start;
+
+	*vpos = line;
+	*hpos = 0;
+
+	if (etime)
+		*etime = ktime_get();
+
+	return true;
+}
+
+static u32 mdp5_crtc_get_vblank_counter(struct drm_crtc *crtc)
+{
+	struct drm_encoder *encoder;
+
+	encoder = get_encoder_from_crtc(crtc);
+	if (!encoder)
+		return 0;
+
+	return mdp5_encoder_get_framecount(encoder);
+}
+
+static void mdp5_crtc_atomic_disable(struct drm_crtc *crtc,
+				     struct drm_atomic_state *state)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_kms *mdp5_kms = get_kms(crtc);
+	struct device *dev = &mdp5_kms->pdev->dev;
+	unsigned long flags;
+
+	DBG("%s", crtc->name);
+
+	if (WARN_ON(!mdp5_crtc->enabled))
+		return;
+
+	/* Disable/save vblank irq handling before power is disabled */
+	drm_crtc_vblank_off(crtc);
+
+	if (mdp5_cstate->cmd_mode)
+		mdp_irq_unregister(&mdp5_kms->base, &mdp5_crtc->pp_done);
+
+	mdp_irq_unregister(&mdp5_kms->base, &mdp5_crtc->err);
+	pm_runtime_put_sync(dev);
+
+	if (crtc->state->event && !crtc->state->active) {
+		WARN_ON(mdp5_crtc->event);
+		spin_lock_irqsave(&mdp5_kms->dev->event_lock, flags);
+		drm_crtc_send_vblank_event(crtc, crtc->state->event);
+		crtc->state->event = NULL;
+		spin_unlock_irqrestore(&mdp5_kms->dev->event_lock, flags);
+	}
+
+	mdp5_crtc->enabled = false;
+}
+
+static void mdp5_crtc_vblank_on(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_interface *intf = mdp5_cstate->pipeline.intf;
+	u32 count;
+
+	count = intf->mode == MDP5_INTF_DSI_MODE_COMMAND ? 0 : 0xffffffff;
+	drm_crtc_set_max_vblank_count(crtc, count);
+
+	drm_crtc_vblank_on(crtc);
+}
+
+static void mdp5_crtc_atomic_enable(struct drm_crtc *crtc,
+				    struct drm_atomic_state *state)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_kms *mdp5_kms = get_kms(crtc);
+	struct device *dev = &mdp5_kms->pdev->dev;
+
+	DBG("%s", crtc->name);
+
+	if (WARN_ON(mdp5_crtc->enabled))
+		return;
+
+	pm_runtime_get_sync(dev);
+
+	if (mdp5_crtc->lm_cursor_enabled) {
+		/*
+		 * Restore LM cursor state, as it might have been lost
+		 * with suspend:
+		 */
+		if (mdp5_crtc->cursor.iova) {
+			unsigned long flags;
+
+			spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
+			mdp5_crtc_restore_cursor(crtc);
+			spin_unlock_irqrestore(&mdp5_crtc->cursor.lock, flags);
+
+			mdp5_ctl_set_cursor(mdp5_cstate->ctl,
+					    &mdp5_cstate->pipeline, 0, true);
+		} else {
+			mdp5_ctl_set_cursor(mdp5_cstate->ctl,
+					    &mdp5_cstate->pipeline, 0, false);
+		}
+	}
+
+	/* Restore vblank irq handling after power is enabled */
+	mdp5_crtc_vblank_on(crtc);
+
+	mdp5_crtc_mode_set_nofb(crtc);
+
+	mdp_irq_register(&mdp5_kms->base, &mdp5_crtc->err);
+
+	if (mdp5_cstate->cmd_mode)
+		mdp_irq_register(&mdp5_kms->base, &mdp5_crtc->pp_done);
+
+	mdp5_crtc->enabled = true;
+}
+
+static int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc,
+				    struct drm_crtc_state *new_crtc_state,
+				    bool need_right_mixer)
+{
+	struct mdp5_crtc_state *mdp5_cstate =
+			to_mdp5_crtc_state(new_crtc_state);
+	struct mdp5_pipeline *pipeline = &mdp5_cstate->pipeline;
+	struct mdp5_interface *intf;
+	bool new_mixer = false;
+
+	new_mixer = !pipeline->mixer;
+
+	if ((need_right_mixer && !pipeline->r_mixer) ||
+	    (!need_right_mixer && pipeline->r_mixer))
+		new_mixer = true;
+
+	if (new_mixer) {
+		struct mdp5_hw_mixer *old_mixer = pipeline->mixer;
+		struct mdp5_hw_mixer *old_r_mixer = pipeline->r_mixer;
+		u32 caps;
+		int ret;
+
+		caps = MDP_LM_CAP_DISPLAY;
+		if (need_right_mixer)
+			caps |= MDP_LM_CAP_PAIR;
+
+		ret = mdp5_mixer_assign(new_crtc_state->state, crtc, caps,
+					&pipeline->mixer, need_right_mixer ?
+					&pipeline->r_mixer : NULL);
+		if (ret)
+			return ret;
+
+		ret = mdp5_mixer_release(new_crtc_state->state, old_mixer);
+		if (ret)
+			return ret;
+
+		if (old_r_mixer) {
+			ret = mdp5_mixer_release(new_crtc_state->state, old_r_mixer);
+			if (ret)
+				return ret;
+
+			if (!need_right_mixer)
+				pipeline->r_mixer = NULL;
+		}
+	}
+
+	/*
+	 * these should have been already set up in the encoder's atomic
+	 * check (called by drm_atomic_helper_check_modeset)
+	 */
+	intf = pipeline->intf;
+
+	mdp5_cstate->err_irqmask = intf2err(intf->num);
+	mdp5_cstate->vblank_irqmask = intf2vblank(pipeline->mixer, intf);
+
+	if ((intf->type == INTF_DSI) &&
+	    (intf->mode == MDP5_INTF_DSI_MODE_COMMAND)) {
+		mdp5_cstate->pp_done_irqmask = lm2ppdone(pipeline->mixer);
+		mdp5_cstate->cmd_mode = true;
+	} else {
+		mdp5_cstate->pp_done_irqmask = 0;
+		mdp5_cstate->cmd_mode = false;
+	}
+
+	return 0;
+}
+
+struct plane_state {
+	struct drm_plane *plane;
+	struct mdp5_plane_state *state;
+};
+
+static int pstate_cmp(const void *a, const void *b)
+{
+	struct plane_state *pa = (struct plane_state *)a;
+	struct plane_state *pb = (struct plane_state *)b;
+	return pa->state->base.normalized_zpos - pb->state->base.normalized_zpos;
+}
+
+/* is there a helper for this? */
+static bool is_fullscreen(struct drm_crtc_state *cstate,
+		struct drm_plane_state *pstate)
+{
+	return (pstate->crtc_x <= 0) && (pstate->crtc_y <= 0) &&
+		((pstate->crtc_x + pstate->crtc_w) >= cstate->mode.hdisplay) &&
+		((pstate->crtc_y + pstate->crtc_h) >= cstate->mode.vdisplay);
+}
+
+static enum mdp_mixer_stage_id get_start_stage(struct drm_crtc *crtc,
+					struct drm_crtc_state *new_crtc_state,
+					struct drm_plane_state *bpstate)
+{
+	struct mdp5_crtc_state *mdp5_cstate =
+			to_mdp5_crtc_state(new_crtc_state);
+
+	/*
+	 * if we're in source split mode, it's mandatory to have
+	 * border out on the base stage
+	 */
+	if (mdp5_cstate->pipeline.r_mixer)
+		return STAGE0;
+
+	/* if the bottom-most layer is not fullscreen, we need to use
+	 * it for solid-color:
+	 */
+	if (!is_fullscreen(new_crtc_state, bpstate))
+		return STAGE0;
+
+	return STAGE_BASE;
+}
+
+static int mdp5_crtc_atomic_check(struct drm_crtc *crtc,
+		struct drm_atomic_state *state)
+{
+	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state,
+									  crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc_state);
+	struct mdp5_interface *intf = mdp5_cstate->pipeline.intf;
+	struct mdp5_kms *mdp5_kms = get_kms(crtc);
+	struct drm_plane *plane;
+	struct drm_device *dev = crtc->dev;
+	struct plane_state pstates[STAGE_MAX + 1];
+	const struct mdp5_cfg_hw *hw_cfg;
+	const struct drm_plane_state *pstate;
+	const struct drm_display_mode *mode = &crtc_state->adjusted_mode;
+	bool cursor_plane = false;
+	bool need_right_mixer = false;
+	int cnt = 0, i;
+	int ret;
+	enum mdp_mixer_stage_id start;
+
+	DBG("%s: check", crtc->name);
+
+	drm_atomic_crtc_state_for_each_plane_state(plane, pstate, crtc_state) {
+		struct mdp5_plane_state *mdp5_pstate =
+				to_mdp5_plane_state(pstate);
+
+		if (!pstate->visible)
+			continue;
+
+		pstates[cnt].plane = plane;
+		pstates[cnt].state = to_mdp5_plane_state(pstate);
+
+		mdp5_pstate->needs_dirtyfb =
+			intf->mode == MDP5_INTF_DSI_MODE_COMMAND;
+
+		/*
+		 * if any plane on this crtc uses 2 hwpipes, then we need
+		 * the crtc to have a right hwmixer.
+		 */
+		if (pstates[cnt].state->r_hwpipe)
+			need_right_mixer = true;
+		cnt++;
+
+		if (plane->type == DRM_PLANE_TYPE_CURSOR)
+			cursor_plane = true;
+	}
+
+	/* bail out early if there aren't any planes */
+	if (!cnt)
+		return 0;
+
+	hw_cfg = mdp5_cfg_get_hw_config(mdp5_kms->cfg);
+
+	/*
+	 * we need a right hwmixer if the mode's width is greater than a single
+	 * LM's max width
+	 */
+	if (mode->hdisplay > hw_cfg->lm.max_width)
+		need_right_mixer = true;
+
+	ret = mdp5_crtc_setup_pipeline(crtc, crtc_state, need_right_mixer);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "couldn't assign mixers %d\n", ret);
+		return ret;
+	}
+
+	/* assign a stage based on sorted zpos property */
+	sort(pstates, cnt, sizeof(pstates[0]), pstate_cmp, NULL);
+
+	/* trigger a warning if cursor isn't the highest zorder */
+	WARN_ON(cursor_plane &&
+		(pstates[cnt - 1].plane->type != DRM_PLANE_TYPE_CURSOR));
+
+	start = get_start_stage(crtc, crtc_state, &pstates[0].state->base);
+
+	/* verify that there are not too many planes attached to crtc
+	 * and that we don't have conflicting mixer stages:
+	 */
+	if ((cnt + start - 1) >= hw_cfg->lm.nb_stages) {
+		DRM_DEV_ERROR(dev->dev, "too many planes! cnt=%d, start stage=%d\n",
+			cnt, start);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < cnt; i++) {
+		if (cursor_plane && (i == (cnt - 1)))
+			pstates[i].state->stage = hw_cfg->lm.nb_stages;
+		else
+			pstates[i].state->stage = start + i;
+		DBG("%s: assign pipe %s on stage=%d", crtc->name,
+				pstates[i].plane->name,
+				pstates[i].state->stage);
+	}
+
+	return 0;
+}
+
+static void mdp5_crtc_atomic_begin(struct drm_crtc *crtc,
+				   struct drm_atomic_state *state)
+{
+	DBG("%s: begin", crtc->name);
+}
+
+static void mdp5_crtc_atomic_flush(struct drm_crtc *crtc,
+				   struct drm_atomic_state *state)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct drm_device *dev = crtc->dev;
+	unsigned long flags;
+
+	DBG("%s: event: %p", crtc->name, crtc->state->event);
+
+	WARN_ON(mdp5_crtc->event);
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	mdp5_crtc->event = crtc->state->event;
+	crtc->state->event = NULL;
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+
+	/*
+	 * If no CTL has been allocated in mdp5_crtc_atomic_check(),
+	 * it means we are trying to flush a CRTC whose state is disabled:
+	 * nothing else needs to be done.
+	 */
+	/* XXX: Can this happen now ? */
+	if (unlikely(!mdp5_cstate->ctl))
+		return;
+
+	blend_setup(crtc);
+
+	/* PP_DONE irq is only used by command mode for now.
+	 * It is better to request pending before FLUSH and START trigger
+	 * to make sure no pp_done irq missed.
+	 * This is safe because no pp_done will happen before SW trigger
+	 * in command mode.
+	 */
+	if (mdp5_cstate->cmd_mode)
+		request_pp_done_pending(crtc);
+
+	mdp5_crtc->flushed_mask = crtc_flush_all(crtc);
+
+	/* XXX are we leaking out state here? */
+	mdp5_crtc->vblank.irqmask = mdp5_cstate->vblank_irqmask;
+	mdp5_crtc->err.irqmask = mdp5_cstate->err_irqmask;
+	mdp5_crtc->pp_done.irqmask = mdp5_cstate->pp_done_irqmask;
+
+	request_pending(crtc, PENDING_FLIP);
+}
+
+static void get_roi(struct drm_crtc *crtc, uint32_t *roi_w, uint32_t *roi_h)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	uint32_t xres = crtc->mode.hdisplay;
+	uint32_t yres = crtc->mode.vdisplay;
+
+	/*
+	 * Cursor Region Of Interest (ROI) is a plane read from cursor
+	 * buffer to render. The ROI region is determined by the visibility of
+	 * the cursor point. In the default Cursor image the cursor point will
+	 * be at the top left of the cursor image.
+	 *
+	 * Without rotation:
+	 * If the cursor point reaches the right (xres - x < cursor.width) or
+	 * bottom (yres - y < cursor.height) boundary of the screen, then ROI
+	 * width and ROI height need to be evaluated to crop the cursor image
+	 * accordingly.
+	 * (xres-x) will be new cursor width when x > (xres - cursor.width)
+	 * (yres-y) will be new cursor height when y > (yres - cursor.height)
+	 *
+	 * With rotation:
+	 * We get negative x and/or y coordinates.
+	 * (cursor.width - abs(x)) will be new cursor width when x < 0
+	 * (cursor.height - abs(y)) will be new cursor width when y < 0
+	 */
+	if (mdp5_crtc->cursor.x >= 0)
+		*roi_w = min(mdp5_crtc->cursor.width, xres -
+			mdp5_crtc->cursor.x);
+	else
+		*roi_w = mdp5_crtc->cursor.width - abs(mdp5_crtc->cursor.x);
+	if (mdp5_crtc->cursor.y >= 0)
+		*roi_h = min(mdp5_crtc->cursor.height, yres -
+			mdp5_crtc->cursor.y);
+	else
+		*roi_h = mdp5_crtc->cursor.height - abs(mdp5_crtc->cursor.y);
+}
+
+static void mdp5_crtc_restore_cursor(struct drm_crtc *crtc)
+{
+	const struct drm_format_info *info = drm_format_info(DRM_FORMAT_ARGB8888);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_kms *mdp5_kms = get_kms(crtc);
+	const enum mdp5_cursor_alpha cur_alpha = CURSOR_ALPHA_PER_PIXEL;
+	uint32_t blendcfg, stride;
+	uint32_t x, y, src_x, src_y, width, height;
+	uint32_t roi_w, roi_h;
+	int lm;
+
+	assert_spin_locked(&mdp5_crtc->cursor.lock);
+
+	lm = mdp5_cstate->pipeline.mixer->lm;
+
+	x = mdp5_crtc->cursor.x;
+	y = mdp5_crtc->cursor.y;
+	width = mdp5_crtc->cursor.width;
+	height = mdp5_crtc->cursor.height;
+
+	stride = width * info->cpp[0];
+
+	get_roi(crtc, &roi_w, &roi_h);
+
+	/* If cusror buffer overlaps due to rotation on the
+	 * upper or left screen border the pixel offset inside
+	 * the cursor buffer of the ROI is the positive overlap
+	 * distance.
+	 */
+	if (mdp5_crtc->cursor.x < 0) {
+		src_x = abs(mdp5_crtc->cursor.x);
+		x = 0;
+	} else {
+		src_x = 0;
+	}
+	if (mdp5_crtc->cursor.y < 0) {
+		src_y = abs(mdp5_crtc->cursor.y);
+		y = 0;
+	} else {
+		src_y = 0;
+	}
+	DBG("%s: x=%d, y=%d roi_w=%d roi_h=%d src_x=%d src_y=%d",
+		crtc->name, x, y, roi_w, roi_h, src_x, src_y);
+
+	mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_STRIDE(lm), stride);
+	mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_FORMAT(lm),
+			MDP5_LM_CURSOR_FORMAT_FORMAT(CURSOR_FMT_ARGB8888));
+	mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_IMG_SIZE(lm),
+			MDP5_LM_CURSOR_IMG_SIZE_SRC_H(height) |
+			MDP5_LM_CURSOR_IMG_SIZE_SRC_W(width));
+	mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_SIZE(lm),
+			MDP5_LM_CURSOR_SIZE_ROI_H(roi_h) |
+			MDP5_LM_CURSOR_SIZE_ROI_W(roi_w));
+	mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_START_XY(lm),
+			MDP5_LM_CURSOR_START_XY_Y_START(y) |
+			MDP5_LM_CURSOR_START_XY_X_START(x));
+	mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_XY(lm),
+			MDP5_LM_CURSOR_XY_SRC_Y(src_y) |
+			MDP5_LM_CURSOR_XY_SRC_X(src_x));
+	mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_BASE_ADDR(lm),
+			mdp5_crtc->cursor.iova);
+
+	blendcfg = MDP5_LM_CURSOR_BLEND_CONFIG_BLEND_EN;
+	blendcfg |= MDP5_LM_CURSOR_BLEND_CONFIG_BLEND_ALPHA_SEL(cur_alpha);
+	mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_BLEND_CONFIG(lm), blendcfg);
+}
+
+static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
+		struct drm_file *file, uint32_t handle,
+		uint32_t width, uint32_t height)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_pipeline *pipeline = &mdp5_cstate->pipeline;
+	struct drm_device *dev = crtc->dev;
+	struct mdp5_kms *mdp5_kms = get_kms(crtc);
+	struct platform_device *pdev = mdp5_kms->pdev;
+	struct msm_kms *kms = &mdp5_kms->base.base;
+	struct drm_gem_object *cursor_bo, *old_bo = NULL;
+	struct mdp5_ctl *ctl;
+	int ret;
+	uint32_t flush_mask = mdp_ctl_flush_mask_cursor(0);
+	bool cursor_enable = true;
+	unsigned long flags;
+
+	if (!mdp5_crtc->lm_cursor_enabled) {
+		dev_warn(dev->dev,
+			 "cursor_set is deprecated with cursor planes\n");
+		return -EINVAL;
+	}
+
+	if ((width > CURSOR_WIDTH) || (height > CURSOR_HEIGHT)) {
+		DRM_DEV_ERROR(dev->dev, "bad cursor size: %dx%d\n", width, height);
+		return -EINVAL;
+	}
+
+	ctl = mdp5_cstate->ctl;
+	if (!ctl)
+		return -EINVAL;
+
+	/* don't support LM cursors when we have source split enabled */
+	if (mdp5_cstate->pipeline.r_mixer)
+		return -EINVAL;
+
+	if (!handle) {
+		DBG("Cursor off");
+		cursor_enable = false;
+		mdp5_crtc->cursor.iova = 0;
+		pm_runtime_get_sync(&pdev->dev);
+		goto set_cursor;
+	}
+
+	cursor_bo = drm_gem_object_lookup(file, handle);
+	if (!cursor_bo)
+		return -ENOENT;
+
+	ret = msm_gem_get_and_pin_iova(cursor_bo, kms->aspace,
+			&mdp5_crtc->cursor.iova);
+	if (ret) {
+		drm_gem_object_put(cursor_bo);
+		return -EINVAL;
+	}
+
+	pm_runtime_get_sync(&pdev->dev);
+
+	spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
+	old_bo = mdp5_crtc->cursor.scanout_bo;
+
+	mdp5_crtc->cursor.scanout_bo = cursor_bo;
+	mdp5_crtc->cursor.width = width;
+	mdp5_crtc->cursor.height = height;
+
+	mdp5_crtc_restore_cursor(crtc);
+
+	spin_unlock_irqrestore(&mdp5_crtc->cursor.lock, flags);
+
+set_cursor:
+	ret = mdp5_ctl_set_cursor(ctl, pipeline, 0, cursor_enable);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "failed to %sable cursor: %d\n",
+				cursor_enable ? "en" : "dis", ret);
+		goto end;
+	}
+
+	crtc_flush(crtc, flush_mask);
+
+end:
+	pm_runtime_put_sync(&pdev->dev);
+	if (old_bo) {
+		drm_flip_work_queue(&mdp5_crtc->unref_cursor_work, old_bo);
+		/* enable vblank to complete cursor work: */
+		request_pending(crtc, PENDING_CURSOR);
+	}
+	return ret;
+}
+
+static int mdp5_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(crtc);
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	uint32_t flush_mask = mdp_ctl_flush_mask_cursor(0);
+	struct drm_device *dev = crtc->dev;
+	uint32_t roi_w;
+	uint32_t roi_h;
+	unsigned long flags;
+
+	if (!mdp5_crtc->lm_cursor_enabled) {
+		dev_warn(dev->dev,
+			 "cursor_move is deprecated with cursor planes\n");
+		return -EINVAL;
+	}
+
+	/* don't support LM cursors when we have source split enabled */
+	if (mdp5_cstate->pipeline.r_mixer)
+		return -EINVAL;
+
+	/* In case the CRTC is disabled, just drop the cursor update */
+	if (unlikely(!crtc->state->enable))
+		return 0;
+
+	/* accept negative x/y coordinates up to maximum cursor overlap */
+	mdp5_crtc->cursor.x = x = max(x, -(int)mdp5_crtc->cursor.width);
+	mdp5_crtc->cursor.y = y = max(y, -(int)mdp5_crtc->cursor.height);
+
+	get_roi(crtc, &roi_w, &roi_h);
+
+	pm_runtime_get_sync(&mdp5_kms->pdev->dev);
+
+	spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
+	mdp5_crtc_restore_cursor(crtc);
+	spin_unlock_irqrestore(&mdp5_crtc->cursor.lock, flags);
+
+	crtc_flush(crtc, flush_mask);
+
+	pm_runtime_put_sync(&mdp5_kms->pdev->dev);
+
+	return 0;
+}
+
+static void
+mdp5_crtc_atomic_print_state(struct drm_printer *p,
+			     const struct drm_crtc_state *state)
+{
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(state);
+	struct mdp5_pipeline *pipeline = &mdp5_cstate->pipeline;
+	struct mdp5_kms *mdp5_kms = get_kms(state->crtc);
+
+	if (WARN_ON(!pipeline))
+		return;
+
+	if (mdp5_cstate->ctl)
+		drm_printf(p, "\tctl=%d\n", mdp5_ctl_get_ctl_id(mdp5_cstate->ctl));
+
+	drm_printf(p, "\thwmixer=%s\n", pipeline->mixer ?
+			pipeline->mixer->name : "(null)");
+
+	if (mdp5_kms->caps & MDP_CAP_SRC_SPLIT)
+		drm_printf(p, "\tright hwmixer=%s\n", pipeline->r_mixer ?
+			   pipeline->r_mixer->name : "(null)");
+
+	drm_printf(p, "\tcmd_mode=%d\n", mdp5_cstate->cmd_mode);
+}
+
+static struct drm_crtc_state *
+mdp5_crtc_duplicate_state(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc_state *mdp5_cstate;
+
+	if (WARN_ON(!crtc->state))
+		return NULL;
+
+	mdp5_cstate = kmemdup(to_mdp5_crtc_state(crtc->state),
+			      sizeof(*mdp5_cstate), GFP_KERNEL);
+	if (!mdp5_cstate)
+		return NULL;
+
+	__drm_atomic_helper_crtc_duplicate_state(crtc, &mdp5_cstate->base);
+
+	return &mdp5_cstate->base;
+}
+
+static void mdp5_crtc_destroy_state(struct drm_crtc *crtc, struct drm_crtc_state *state)
+{
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(state);
+
+	__drm_atomic_helper_crtc_destroy_state(state);
+
+	kfree(mdp5_cstate);
+}
+
+static void mdp5_crtc_reset(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc_state *mdp5_cstate =
+		kzalloc(sizeof(*mdp5_cstate), GFP_KERNEL);
+
+	if (crtc->state)
+		mdp5_crtc_destroy_state(crtc, crtc->state);
+
+	if (mdp5_cstate)
+		__drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base);
+	else
+		__drm_atomic_helper_crtc_reset(crtc, NULL);
+}
+
+static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = {
+	.set_config = drm_atomic_helper_set_config,
+	.page_flip = drm_atomic_helper_page_flip,
+	.reset = mdp5_crtc_reset,
+	.atomic_duplicate_state = mdp5_crtc_duplicate_state,
+	.atomic_destroy_state = mdp5_crtc_destroy_state,
+	.atomic_print_state = mdp5_crtc_atomic_print_state,
+	.get_vblank_counter = mdp5_crtc_get_vblank_counter,
+	.enable_vblank  = msm_crtc_enable_vblank,
+	.disable_vblank = msm_crtc_disable_vblank,
+	.get_vblank_timestamp = drm_crtc_vblank_helper_get_vblank_timestamp,
+};
+
+static const struct drm_crtc_funcs mdp5_crtc_funcs = {
+	.set_config = drm_atomic_helper_set_config,
+	.page_flip = drm_atomic_helper_page_flip,
+	.reset = mdp5_crtc_reset,
+	.atomic_duplicate_state = mdp5_crtc_duplicate_state,
+	.atomic_destroy_state = mdp5_crtc_destroy_state,
+	.cursor_set = mdp5_crtc_cursor_set,
+	.cursor_move = mdp5_crtc_cursor_move,
+	.atomic_print_state = mdp5_crtc_atomic_print_state,
+	.get_vblank_counter = mdp5_crtc_get_vblank_counter,
+	.enable_vblank  = msm_crtc_enable_vblank,
+	.disable_vblank = msm_crtc_disable_vblank,
+	.get_vblank_timestamp = drm_crtc_vblank_helper_get_vblank_timestamp,
+};
+
+static const struct drm_crtc_helper_funcs mdp5_crtc_helper_funcs = {
+	.mode_set_nofb = mdp5_crtc_mode_set_nofb,
+	.atomic_check = mdp5_crtc_atomic_check,
+	.atomic_begin = mdp5_crtc_atomic_begin,
+	.atomic_flush = mdp5_crtc_atomic_flush,
+	.atomic_enable = mdp5_crtc_atomic_enable,
+	.atomic_disable = mdp5_crtc_atomic_disable,
+	.get_scanout_position = mdp5_crtc_get_scanout_position,
+};
+
+static void mdp5_crtc_vblank_irq(struct mdp_irq *irq, uint32_t irqstatus)
+{
+	struct mdp5_crtc *mdp5_crtc = container_of(irq, struct mdp5_crtc, vblank);
+	struct drm_crtc *crtc = &mdp5_crtc->base;
+	struct msm_drm_private *priv = crtc->dev->dev_private;
+	unsigned pending;
+
+	mdp_irq_unregister(&get_kms(crtc)->base, &mdp5_crtc->vblank);
+
+	pending = atomic_xchg(&mdp5_crtc->pending, 0);
+
+	if (pending & PENDING_FLIP) {
+		complete_flip(crtc, NULL);
+	}
+
+	if (pending & PENDING_CURSOR)
+		drm_flip_work_commit(&mdp5_crtc->unref_cursor_work, priv->wq);
+}
+
+static void mdp5_crtc_err_irq(struct mdp_irq *irq, uint32_t irqstatus)
+{
+	struct mdp5_crtc *mdp5_crtc = container_of(irq, struct mdp5_crtc, err);
+
+	DBG("%s: error: %08x", mdp5_crtc->base.name, irqstatus);
+}
+
+static void mdp5_crtc_pp_done_irq(struct mdp_irq *irq, uint32_t irqstatus)
+{
+	struct mdp5_crtc *mdp5_crtc = container_of(irq, struct mdp5_crtc,
+								pp_done);
+
+	complete_all(&mdp5_crtc->pp_completion);
+}
+
+static void mdp5_crtc_wait_for_pp_done(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	int ret;
+
+	ret = wait_for_completion_timeout(&mdp5_crtc->pp_completion,
+						msecs_to_jiffies(50));
+	if (ret == 0)
+		dev_warn_ratelimited(dev->dev, "pp done time out, lm=%d\n",
+				     mdp5_cstate->pipeline.mixer->lm);
+}
+
+static void mdp5_crtc_wait_for_flush_done(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_ctl *ctl = mdp5_cstate->ctl;
+	int ret;
+
+	/* Should not call this function if crtc is disabled. */
+	if (!ctl)
+		return;
+
+	ret = drm_crtc_vblank_get(crtc);
+	if (ret)
+		return;
+
+	ret = wait_event_timeout(dev->vblank[drm_crtc_index(crtc)].queue,
+		((mdp5_ctl_get_commit_status(ctl) &
+		mdp5_crtc->flushed_mask) == 0),
+		msecs_to_jiffies(50));
+	if (ret <= 0)
+		dev_warn(dev->dev, "vblank time out, crtc=%d\n", mdp5_crtc->id);
+
+	mdp5_crtc->flushed_mask = 0;
+
+	drm_crtc_vblank_put(crtc);
+}
+
+uint32_t mdp5_crtc_vblank(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+	return mdp5_crtc->vblank.irqmask;
+}
+
+void mdp5_crtc_set_pipeline(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+	struct mdp5_kms *mdp5_kms = get_kms(crtc);
+
+	/* should this be done elsewhere ? */
+	mdp_irq_update(&mdp5_kms->base);
+
+	mdp5_ctl_set_pipeline(mdp5_cstate->ctl, &mdp5_cstate->pipeline);
+}
+
+struct mdp5_ctl *mdp5_crtc_get_ctl(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+
+	return mdp5_cstate->ctl;
+}
+
+struct mdp5_hw_mixer *mdp5_crtc_get_mixer(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc_state *mdp5_cstate;
+
+	if (WARN_ON(!crtc))
+		return ERR_PTR(-EINVAL);
+
+	mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+
+	return WARN_ON(!mdp5_cstate->pipeline.mixer) ?
+		ERR_PTR(-EINVAL) : mdp5_cstate->pipeline.mixer;
+}
+
+struct mdp5_pipeline *mdp5_crtc_get_pipeline(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc_state *mdp5_cstate;
+
+	if (WARN_ON(!crtc))
+		return ERR_PTR(-EINVAL);
+
+	mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+
+	return &mdp5_cstate->pipeline;
+}
+
+void mdp5_crtc_wait_for_commit_done(struct drm_crtc *crtc)
+{
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc->state);
+
+	if (mdp5_cstate->cmd_mode)
+		mdp5_crtc_wait_for_pp_done(crtc);
+	else
+		mdp5_crtc_wait_for_flush_done(crtc);
+}
+
+/* initialize crtc */
+struct drm_crtc *mdp5_crtc_init(struct drm_device *dev,
+				struct drm_plane *plane,
+				struct drm_plane *cursor_plane, int id)
+{
+	struct drm_crtc *crtc = NULL;
+	struct mdp5_crtc *mdp5_crtc;
+	int ret;
+
+	mdp5_crtc = drmm_crtc_alloc_with_planes(dev, struct mdp5_crtc, base,
+						plane, cursor_plane,
+						cursor_plane ?
+						&mdp5_crtc_no_lm_cursor_funcs :
+						&mdp5_crtc_funcs,
+						NULL);
+	if (IS_ERR(mdp5_crtc))
+		return ERR_CAST(mdp5_crtc);
+
+	crtc = &mdp5_crtc->base;
+
+	mdp5_crtc->id = id;
+
+	spin_lock_init(&mdp5_crtc->lm_lock);
+	spin_lock_init(&mdp5_crtc->cursor.lock);
+	init_completion(&mdp5_crtc->pp_completion);
+
+	mdp5_crtc->vblank.irq = mdp5_crtc_vblank_irq;
+	mdp5_crtc->err.irq = mdp5_crtc_err_irq;
+	mdp5_crtc->pp_done.irq = mdp5_crtc_pp_done_irq;
+
+	mdp5_crtc->lm_cursor_enabled = cursor_plane ? false : true;
+
+	drm_flip_work_init(&mdp5_crtc->unref_cursor_work,
+			"unref cursor", unref_cursor_worker);
+	ret = drmm_add_action_or_reset(dev, mdp5_crtc_flip_cleanup, mdp5_crtc);
+	if (ret)
+		return ERR_PTR(ret);
+
+	drm_crtc_helper_add(crtc, &mdp5_crtc_helper_funcs);
+
+	return crtc;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_ctl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_ctl.c
@@ -0,0 +1,751 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ */
+
+#include "mdp5_kms.h"
+#include "mdp5_ctl.h"
+
+/*
+ * CTL - MDP Control Pool Manager
+ *
+ * Controls are shared between all display interfaces.
+ *
+ * They are intended to be used for data path configuration.
+ * The top level register programming describes the complete data path for
+ * a specific data path ID - REG_MDP5_CTL_*(<id>, ...)
+ *
+ * Hardware capabilities determine the number of concurrent data paths
+ *
+ * In certain use cases (high-resolution dual pipe), one single CTL can be
+ * shared across multiple CRTCs.
+ */
+
+#define CTL_STAT_BUSY		0x1
+#define CTL_STAT_BOOKED	0x2
+
+struct mdp5_ctl {
+	struct mdp5_ctl_manager *ctlm;
+
+	u32 id;
+
+	/* CTL status bitmask */
+	u32 status;
+
+	bool encoder_enabled;
+
+	/* pending flush_mask bits */
+	u32 flush_mask;
+
+	/* REG_MDP5_CTL_*(<id>) registers access info + lock: */
+	spinlock_t hw_lock;
+	u32 reg_offset;
+
+	/* when do CTL registers need to be flushed? (mask of trigger bits) */
+	u32 pending_ctl_trigger;
+
+	bool cursor_on;
+
+	/* True if the current CTL has FLUSH bits pending for single FLUSH. */
+	bool flush_pending;
+
+	struct mdp5_ctl *pair; /* Paired CTL to be flushed together */
+};
+
+struct mdp5_ctl_manager {
+	struct drm_device *dev;
+
+	/* number of CTL / Layer Mixers in this hw config: */
+	u32 nlm;
+	u32 nctl;
+
+	/* to filter out non-present bits in the current hardware config */
+	u32 flush_hw_mask;
+
+	/* status for single FLUSH */
+	bool single_flush_supported;
+	u32 single_flush_pending_mask;
+
+	/* pool of CTLs + lock to protect resource allocation (ctls[i].busy) */
+	spinlock_t pool_lock;
+	struct mdp5_ctl ctls[MAX_CTL];
+};
+
+static inline
+struct mdp5_kms *get_kms(struct mdp5_ctl_manager *ctl_mgr)
+{
+	struct msm_drm_private *priv = ctl_mgr->dev->dev_private;
+
+	return to_mdp5_kms(to_mdp_kms(priv->kms));
+}
+
+static inline
+void ctl_write(struct mdp5_ctl *ctl, u32 reg, u32 data)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(ctl->ctlm);
+
+	(void)ctl->reg_offset; /* TODO use this instead of mdp5_write */
+	mdp5_write(mdp5_kms, reg, data);
+}
+
+static inline
+u32 ctl_read(struct mdp5_ctl *ctl, u32 reg)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(ctl->ctlm);
+
+	(void)ctl->reg_offset; /* TODO use this instead of mdp5_write */
+	return mdp5_read(mdp5_kms, reg);
+}
+
+static void set_display_intf(struct mdp5_kms *mdp5_kms,
+		struct mdp5_interface *intf)
+{
+	unsigned long flags;
+	u32 intf_sel;
+
+	spin_lock_irqsave(&mdp5_kms->resource_lock, flags);
+	intf_sel = mdp5_read(mdp5_kms, REG_MDP5_DISP_INTF_SEL);
+
+	switch (intf->num) {
+	case 0:
+		intf_sel &= ~MDP5_DISP_INTF_SEL_INTF0__MASK;
+		intf_sel |= MDP5_DISP_INTF_SEL_INTF0(intf->type);
+		break;
+	case 1:
+		intf_sel &= ~MDP5_DISP_INTF_SEL_INTF1__MASK;
+		intf_sel |= MDP5_DISP_INTF_SEL_INTF1(intf->type);
+		break;
+	case 2:
+		intf_sel &= ~MDP5_DISP_INTF_SEL_INTF2__MASK;
+		intf_sel |= MDP5_DISP_INTF_SEL_INTF2(intf->type);
+		break;
+	case 3:
+		intf_sel &= ~MDP5_DISP_INTF_SEL_INTF3__MASK;
+		intf_sel |= MDP5_DISP_INTF_SEL_INTF3(intf->type);
+		break;
+	default:
+		BUG();
+		break;
+	}
+
+	mdp5_write(mdp5_kms, REG_MDP5_DISP_INTF_SEL, intf_sel);
+	spin_unlock_irqrestore(&mdp5_kms->resource_lock, flags);
+}
+
+static void set_ctl_op(struct mdp5_ctl *ctl, struct mdp5_pipeline *pipeline)
+{
+	unsigned long flags;
+	struct mdp5_interface *intf = pipeline->intf;
+	u32 ctl_op = 0;
+
+	if (!mdp5_cfg_intf_is_virtual(intf->type))
+		ctl_op |= MDP5_CTL_OP_INTF_NUM(INTF0 + intf->num);
+
+	switch (intf->type) {
+	case INTF_DSI:
+		if (intf->mode == MDP5_INTF_DSI_MODE_COMMAND)
+			ctl_op |= MDP5_CTL_OP_CMD_MODE;
+		break;
+
+	case INTF_WB:
+		if (intf->mode == MDP5_INTF_WB_MODE_LINE)
+			ctl_op |= MDP5_CTL_OP_MODE(MODE_WB_2_LINE);
+		break;
+
+	default:
+		break;
+	}
+
+	if (pipeline->r_mixer)
+		ctl_op |= MDP5_CTL_OP_PACK_3D_ENABLE |
+			  MDP5_CTL_OP_PACK_3D(1);
+
+	spin_lock_irqsave(&ctl->hw_lock, flags);
+	ctl_write(ctl, REG_MDP5_CTL_OP(ctl->id), ctl_op);
+	spin_unlock_irqrestore(&ctl->hw_lock, flags);
+}
+
+int mdp5_ctl_set_pipeline(struct mdp5_ctl *ctl, struct mdp5_pipeline *pipeline)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(ctl->ctlm);
+	struct mdp5_interface *intf = pipeline->intf;
+
+	/* Virtual interfaces need not set a display intf (e.g.: Writeback) */
+	if (!mdp5_cfg_intf_is_virtual(intf->type))
+		set_display_intf(mdp5_kms, intf);
+
+	set_ctl_op(ctl, pipeline);
+
+	return 0;
+}
+
+static bool start_signal_needed(struct mdp5_ctl *ctl,
+				struct mdp5_pipeline *pipeline)
+{
+	struct mdp5_interface *intf = pipeline->intf;
+
+	if (!ctl->encoder_enabled)
+		return false;
+
+	switch (intf->type) {
+	case INTF_WB:
+		return true;
+	case INTF_DSI:
+		return intf->mode == MDP5_INTF_DSI_MODE_COMMAND;
+	default:
+		return false;
+	}
+}
+
+/*
+ * send_start_signal() - Overlay Processor Start Signal
+ *
+ * For a given control operation (display pipeline), a START signal needs to be
+ * executed in order to kick off operation and activate all layers.
+ * e.g.: DSI command mode, Writeback
+ */
+static void send_start_signal(struct mdp5_ctl *ctl)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&ctl->hw_lock, flags);
+	ctl_write(ctl, REG_MDP5_CTL_START(ctl->id), 1);
+	spin_unlock_irqrestore(&ctl->hw_lock, flags);
+}
+
+/**
+ * mdp5_ctl_set_encoder_state() - set the encoder state
+ *
+ * @ctl:      the CTL instance
+ * @pipeline: the encoder's INTF + MIXER configuration
+ * @enabled:  true, when encoder is ready for data streaming; false, otherwise.
+ *
+ * Note:
+ * This encoder state is needed to trigger START signal (data path kickoff).
+ */
+int mdp5_ctl_set_encoder_state(struct mdp5_ctl *ctl,
+			       struct mdp5_pipeline *pipeline,
+			       bool enabled)
+{
+	struct mdp5_interface *intf = pipeline->intf;
+
+	if (WARN_ON(!ctl))
+		return -EINVAL;
+
+	ctl->encoder_enabled = enabled;
+	DBG("intf_%d: %s", intf->num, enabled ? "on" : "off");
+
+	if (start_signal_needed(ctl, pipeline)) {
+		send_start_signal(ctl);
+	}
+
+	return 0;
+}
+
+/*
+ * Note:
+ * CTL registers need to be flushed after calling this function
+ * (call mdp5_ctl_commit() with mdp_ctl_flush_mask_ctl() mask)
+ */
+int mdp5_ctl_set_cursor(struct mdp5_ctl *ctl, struct mdp5_pipeline *pipeline,
+			int cursor_id, bool enable)
+{
+	struct mdp5_ctl_manager *ctl_mgr = ctl->ctlm;
+	unsigned long flags;
+	u32 blend_cfg;
+	struct mdp5_hw_mixer *mixer = pipeline->mixer;
+
+	if (WARN_ON(!mixer)) {
+		DRM_DEV_ERROR(ctl_mgr->dev->dev, "CTL %d cannot find LM",
+			ctl->id);
+		return -EINVAL;
+	}
+
+	if (pipeline->r_mixer) {
+		DRM_DEV_ERROR(ctl_mgr->dev->dev, "unsupported configuration");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&ctl->hw_lock, flags);
+
+	blend_cfg = ctl_read(ctl, REG_MDP5_CTL_LAYER_REG(ctl->id, mixer->lm));
+
+	if (enable)
+		blend_cfg |=  MDP5_CTL_LAYER_REG_CURSOR_OUT;
+	else
+		blend_cfg &= ~MDP5_CTL_LAYER_REG_CURSOR_OUT;
+
+	ctl_write(ctl, REG_MDP5_CTL_LAYER_REG(ctl->id, mixer->lm), blend_cfg);
+	ctl->cursor_on = enable;
+
+	spin_unlock_irqrestore(&ctl->hw_lock, flags);
+
+	ctl->pending_ctl_trigger = mdp_ctl_flush_mask_cursor(cursor_id);
+
+	return 0;
+}
+
+static u32 mdp_ctl_blend_mask(enum mdp5_pipe pipe,
+		enum mdp_mixer_stage_id stage)
+{
+	switch (pipe) {
+	case SSPP_VIG0: return MDP5_CTL_LAYER_REG_VIG0(stage);
+	case SSPP_VIG1: return MDP5_CTL_LAYER_REG_VIG1(stage);
+	case SSPP_VIG2: return MDP5_CTL_LAYER_REG_VIG2(stage);
+	case SSPP_RGB0: return MDP5_CTL_LAYER_REG_RGB0(stage);
+	case SSPP_RGB1: return MDP5_CTL_LAYER_REG_RGB1(stage);
+	case SSPP_RGB2: return MDP5_CTL_LAYER_REG_RGB2(stage);
+	case SSPP_DMA0: return MDP5_CTL_LAYER_REG_DMA0(stage);
+	case SSPP_DMA1: return MDP5_CTL_LAYER_REG_DMA1(stage);
+	case SSPP_VIG3: return MDP5_CTL_LAYER_REG_VIG3(stage);
+	case SSPP_RGB3: return MDP5_CTL_LAYER_REG_RGB3(stage);
+	case SSPP_CURSOR0:
+	case SSPP_CURSOR1:
+	default:	return 0;
+	}
+}
+
+static u32 mdp_ctl_blend_ext_mask(enum mdp5_pipe pipe,
+		enum mdp_mixer_stage_id stage)
+{
+	if (stage < STAGE6 && (pipe != SSPP_CURSOR0 && pipe != SSPP_CURSOR1))
+		return 0;
+
+	switch (pipe) {
+	case SSPP_VIG0: return MDP5_CTL_LAYER_EXT_REG_VIG0_BIT3;
+	case SSPP_VIG1: return MDP5_CTL_LAYER_EXT_REG_VIG1_BIT3;
+	case SSPP_VIG2: return MDP5_CTL_LAYER_EXT_REG_VIG2_BIT3;
+	case SSPP_RGB0: return MDP5_CTL_LAYER_EXT_REG_RGB0_BIT3;
+	case SSPP_RGB1: return MDP5_CTL_LAYER_EXT_REG_RGB1_BIT3;
+	case SSPP_RGB2: return MDP5_CTL_LAYER_EXT_REG_RGB2_BIT3;
+	case SSPP_DMA0: return MDP5_CTL_LAYER_EXT_REG_DMA0_BIT3;
+	case SSPP_DMA1: return MDP5_CTL_LAYER_EXT_REG_DMA1_BIT3;
+	case SSPP_VIG3: return MDP5_CTL_LAYER_EXT_REG_VIG3_BIT3;
+	case SSPP_RGB3: return MDP5_CTL_LAYER_EXT_REG_RGB3_BIT3;
+	case SSPP_CURSOR0: return MDP5_CTL_LAYER_EXT_REG_CURSOR0(stage);
+	case SSPP_CURSOR1: return MDP5_CTL_LAYER_EXT_REG_CURSOR1(stage);
+	default:	return 0;
+	}
+}
+
+static void mdp5_ctl_reset_blend_regs(struct mdp5_ctl *ctl)
+{
+	unsigned long flags;
+	struct mdp5_ctl_manager *ctl_mgr = ctl->ctlm;
+	int i;
+
+	spin_lock_irqsave(&ctl->hw_lock, flags);
+
+	for (i = 0; i < ctl_mgr->nlm; i++) {
+		ctl_write(ctl, REG_MDP5_CTL_LAYER_REG(ctl->id, i), 0x0);
+		ctl_write(ctl, REG_MDP5_CTL_LAYER_EXT_REG(ctl->id, i), 0x0);
+	}
+
+	spin_unlock_irqrestore(&ctl->hw_lock, flags);
+}
+
+#define PIPE_LEFT	0
+#define PIPE_RIGHT	1
+int mdp5_ctl_blend(struct mdp5_ctl *ctl, struct mdp5_pipeline *pipeline,
+		   enum mdp5_pipe stage[][MAX_PIPE_STAGE],
+		   enum mdp5_pipe r_stage[][MAX_PIPE_STAGE],
+		   u32 stage_cnt, u32 ctl_blend_op_flags)
+{
+	struct mdp5_hw_mixer *mixer = pipeline->mixer;
+	struct mdp5_hw_mixer *r_mixer = pipeline->r_mixer;
+	unsigned long flags;
+	u32 blend_cfg = 0, blend_ext_cfg = 0;
+	u32 r_blend_cfg = 0, r_blend_ext_cfg = 0;
+	int i, start_stage;
+
+	mdp5_ctl_reset_blend_regs(ctl);
+
+	if (ctl_blend_op_flags & MDP5_CTL_BLEND_OP_FLAG_BORDER_OUT) {
+		start_stage = STAGE0;
+		blend_cfg |= MDP5_CTL_LAYER_REG_BORDER_COLOR;
+		if (r_mixer)
+			r_blend_cfg |= MDP5_CTL_LAYER_REG_BORDER_COLOR;
+	} else {
+		start_stage = STAGE_BASE;
+	}
+
+	for (i = start_stage; stage_cnt && i <= STAGE_MAX; i++) {
+		blend_cfg |=
+			mdp_ctl_blend_mask(stage[i][PIPE_LEFT], i) |
+			mdp_ctl_blend_mask(stage[i][PIPE_RIGHT], i);
+		blend_ext_cfg |=
+			mdp_ctl_blend_ext_mask(stage[i][PIPE_LEFT], i) |
+			mdp_ctl_blend_ext_mask(stage[i][PIPE_RIGHT], i);
+		if (r_mixer) {
+			r_blend_cfg |=
+				mdp_ctl_blend_mask(r_stage[i][PIPE_LEFT], i) |
+				mdp_ctl_blend_mask(r_stage[i][PIPE_RIGHT], i);
+			r_blend_ext_cfg |=
+			     mdp_ctl_blend_ext_mask(r_stage[i][PIPE_LEFT], i) |
+			     mdp_ctl_blend_ext_mask(r_stage[i][PIPE_RIGHT], i);
+		}
+	}
+
+	spin_lock_irqsave(&ctl->hw_lock, flags);
+	if (ctl->cursor_on)
+		blend_cfg |=  MDP5_CTL_LAYER_REG_CURSOR_OUT;
+
+	ctl_write(ctl, REG_MDP5_CTL_LAYER_REG(ctl->id, mixer->lm), blend_cfg);
+	ctl_write(ctl, REG_MDP5_CTL_LAYER_EXT_REG(ctl->id, mixer->lm),
+		  blend_ext_cfg);
+	if (r_mixer) {
+		ctl_write(ctl, REG_MDP5_CTL_LAYER_REG(ctl->id, r_mixer->lm),
+			  r_blend_cfg);
+		ctl_write(ctl, REG_MDP5_CTL_LAYER_EXT_REG(ctl->id, r_mixer->lm),
+			  r_blend_ext_cfg);
+	}
+	spin_unlock_irqrestore(&ctl->hw_lock, flags);
+
+	ctl->pending_ctl_trigger = mdp_ctl_flush_mask_lm(mixer->lm);
+	if (r_mixer)
+		ctl->pending_ctl_trigger |= mdp_ctl_flush_mask_lm(r_mixer->lm);
+
+	DBG("lm%d: blend config = 0x%08x. ext_cfg = 0x%08x", mixer->lm,
+		blend_cfg, blend_ext_cfg);
+	if (r_mixer)
+		DBG("lm%d: blend config = 0x%08x. ext_cfg = 0x%08x",
+		    r_mixer->lm, r_blend_cfg, r_blend_ext_cfg);
+
+	return 0;
+}
+
+u32 mdp_ctl_flush_mask_encoder(struct mdp5_interface *intf)
+{
+	if (intf->type == INTF_WB)
+		return MDP5_CTL_FLUSH_WB;
+
+	switch (intf->num) {
+	case 0: return MDP5_CTL_FLUSH_TIMING_0;
+	case 1: return MDP5_CTL_FLUSH_TIMING_1;
+	case 2: return MDP5_CTL_FLUSH_TIMING_2;
+	case 3: return MDP5_CTL_FLUSH_TIMING_3;
+	default: return 0;
+	}
+}
+
+u32 mdp_ctl_flush_mask_cursor(int cursor_id)
+{
+	switch (cursor_id) {
+	case 0: return MDP5_CTL_FLUSH_CURSOR_0;
+	case 1: return MDP5_CTL_FLUSH_CURSOR_1;
+	default: return 0;
+	}
+}
+
+u32 mdp_ctl_flush_mask_pipe(enum mdp5_pipe pipe)
+{
+	switch (pipe) {
+	case SSPP_VIG0: return MDP5_CTL_FLUSH_VIG0;
+	case SSPP_VIG1: return MDP5_CTL_FLUSH_VIG1;
+	case SSPP_VIG2: return MDP5_CTL_FLUSH_VIG2;
+	case SSPP_RGB0: return MDP5_CTL_FLUSH_RGB0;
+	case SSPP_RGB1: return MDP5_CTL_FLUSH_RGB1;
+	case SSPP_RGB2: return MDP5_CTL_FLUSH_RGB2;
+	case SSPP_DMA0: return MDP5_CTL_FLUSH_DMA0;
+	case SSPP_DMA1: return MDP5_CTL_FLUSH_DMA1;
+	case SSPP_VIG3: return MDP5_CTL_FLUSH_VIG3;
+	case SSPP_RGB3: return MDP5_CTL_FLUSH_RGB3;
+	case SSPP_CURSOR0: return MDP5_CTL_FLUSH_CURSOR_0;
+	case SSPP_CURSOR1: return MDP5_CTL_FLUSH_CURSOR_1;
+	default:        return 0;
+	}
+}
+
+u32 mdp_ctl_flush_mask_lm(int lm)
+{
+	switch (lm) {
+	case 0:  return MDP5_CTL_FLUSH_LM0;
+	case 1:  return MDP5_CTL_FLUSH_LM1;
+	case 2:  return MDP5_CTL_FLUSH_LM2;
+	case 3:  return MDP5_CTL_FLUSH_LM3;
+	case 4:  return MDP5_CTL_FLUSH_LM4;
+	case 5:  return MDP5_CTL_FLUSH_LM5;
+	default: return 0;
+	}
+}
+
+static u32 fix_sw_flush(struct mdp5_ctl *ctl, struct mdp5_pipeline *pipeline,
+			u32 flush_mask)
+{
+	struct mdp5_ctl_manager *ctl_mgr = ctl->ctlm;
+	u32 sw_mask = 0;
+#define BIT_NEEDS_SW_FIX(bit) \
+	(!(ctl_mgr->flush_hw_mask & bit) && (flush_mask & bit))
+
+	/* for some targets, cursor bit is the same as LM bit */
+	if (BIT_NEEDS_SW_FIX(MDP5_CTL_FLUSH_CURSOR_0))
+		sw_mask |= mdp_ctl_flush_mask_lm(pipeline->mixer->lm);
+
+	return sw_mask;
+}
+
+static void fix_for_single_flush(struct mdp5_ctl *ctl, u32 *flush_mask,
+		u32 *flush_id)
+{
+	struct mdp5_ctl_manager *ctl_mgr = ctl->ctlm;
+
+	if (ctl->pair) {
+		DBG("CTL %d FLUSH pending mask %x", ctl->id, *flush_mask);
+		ctl->flush_pending = true;
+		ctl_mgr->single_flush_pending_mask |= (*flush_mask);
+		*flush_mask = 0;
+
+		if (ctl->pair->flush_pending) {
+			*flush_id = min_t(u32, ctl->id, ctl->pair->id);
+			*flush_mask = ctl_mgr->single_flush_pending_mask;
+
+			ctl->flush_pending = false;
+			ctl->pair->flush_pending = false;
+			ctl_mgr->single_flush_pending_mask = 0;
+
+			DBG("Single FLUSH mask %x,ID %d", *flush_mask,
+				*flush_id);
+		}
+	}
+}
+
+/**
+ * mdp5_ctl_commit() - Register Flush
+ *
+ * @ctl:        the CTL instance
+ * @pipeline:   the encoder's INTF + MIXER configuration
+ * @flush_mask: bitmask of display controller hw blocks to flush
+ * @start:      if true, immediately update flush registers and set START
+ *              bit, otherwise accumulate flush_mask bits until we are
+ *              ready to START
+ *
+ * The flush register is used to indicate several registers are all
+ * programmed, and are safe to update to the back copy of the double
+ * buffered registers.
+ *
+ * Some registers FLUSH bits are shared when the hardware does not have
+ * dedicated bits for them; handling these is the job of fix_sw_flush().
+ *
+ * CTL registers need to be flushed in some circumstances; if that is the
+ * case, some trigger bits will be present in both flush mask and
+ * ctl->pending_ctl_trigger.
+ *
+ * Return H/W flushed bit mask.
+ */
+u32 mdp5_ctl_commit(struct mdp5_ctl *ctl,
+		    struct mdp5_pipeline *pipeline,
+		    u32 flush_mask, bool start)
+{
+	struct mdp5_ctl_manager *ctl_mgr = ctl->ctlm;
+	unsigned long flags;
+	u32 flush_id = ctl->id;
+	u32 curr_ctl_flush_mask;
+
+	VERB("flush_mask=%x, trigger=%x", flush_mask, ctl->pending_ctl_trigger);
+
+	if (ctl->pending_ctl_trigger & flush_mask) {
+		flush_mask |= MDP5_CTL_FLUSH_CTL;
+		ctl->pending_ctl_trigger = 0;
+	}
+
+	flush_mask |= fix_sw_flush(ctl, pipeline, flush_mask);
+
+	flush_mask &= ctl_mgr->flush_hw_mask;
+
+	curr_ctl_flush_mask = flush_mask;
+
+	fix_for_single_flush(ctl, &flush_mask, &flush_id);
+
+	if (!start) {
+		ctl->flush_mask |= flush_mask;
+		return curr_ctl_flush_mask;
+	} else {
+		flush_mask |= ctl->flush_mask;
+		ctl->flush_mask = 0;
+	}
+
+	if (flush_mask) {
+		spin_lock_irqsave(&ctl->hw_lock, flags);
+		ctl_write(ctl, REG_MDP5_CTL_FLUSH(flush_id), flush_mask);
+		spin_unlock_irqrestore(&ctl->hw_lock, flags);
+	}
+
+	if (start_signal_needed(ctl, pipeline)) {
+		send_start_signal(ctl);
+	}
+
+	return curr_ctl_flush_mask;
+}
+
+u32 mdp5_ctl_get_commit_status(struct mdp5_ctl *ctl)
+{
+	return ctl_read(ctl, REG_MDP5_CTL_FLUSH(ctl->id));
+}
+
+int mdp5_ctl_get_ctl_id(struct mdp5_ctl *ctl)
+{
+	return WARN_ON(!ctl) ? -EINVAL : ctl->id;
+}
+
+/*
+ * mdp5_ctl_pair() - Associate 2 booked CTLs for single FLUSH
+ */
+int mdp5_ctl_pair(struct mdp5_ctl *ctlx, struct mdp5_ctl *ctly, bool enable)
+{
+	struct mdp5_ctl_manager *ctl_mgr = ctlx->ctlm;
+	struct mdp5_kms *mdp5_kms = get_kms(ctl_mgr);
+
+	/* do nothing silently if hw doesn't support */
+	if (!ctl_mgr->single_flush_supported)
+		return 0;
+
+	if (!enable) {
+		ctlx->pair = NULL;
+		ctly->pair = NULL;
+		mdp5_write(mdp5_kms, REG_MDP5_SPARE_0, 0);
+		return 0;
+	} else if ((ctlx->pair != NULL) || (ctly->pair != NULL)) {
+		DRM_DEV_ERROR(ctl_mgr->dev->dev, "CTLs already paired\n");
+		return -EINVAL;
+	} else if (!(ctlx->status & ctly->status & CTL_STAT_BOOKED)) {
+		DRM_DEV_ERROR(ctl_mgr->dev->dev, "Only pair booked CTLs\n");
+		return -EINVAL;
+	}
+
+	ctlx->pair = ctly;
+	ctly->pair = ctlx;
+
+	mdp5_write(mdp5_kms, REG_MDP5_SPARE_0,
+		   MDP5_SPARE_0_SPLIT_DPL_SINGLE_FLUSH_EN);
+
+	return 0;
+}
+
+/*
+ * mdp5_ctl_request() - CTL allocation
+ *
+ * Try to return booked CTL for @intf_num is 1 or 2, unbooked for other INTFs.
+ * If no CTL is available in preferred category, allocate from the other one.
+ *
+ * @return fail if no CTL is available.
+ */
+struct mdp5_ctl *mdp5_ctlm_request(struct mdp5_ctl_manager *ctl_mgr,
+		int intf_num)
+{
+	struct mdp5_ctl *ctl = NULL;
+	const u32 checkm = CTL_STAT_BUSY | CTL_STAT_BOOKED;
+	u32 match = ((intf_num == 1) || (intf_num == 2)) ? CTL_STAT_BOOKED : 0;
+	unsigned long flags;
+	int c;
+
+	spin_lock_irqsave(&ctl_mgr->pool_lock, flags);
+
+	/* search the preferred */
+	for (c = 0; c < ctl_mgr->nctl; c++)
+		if ((ctl_mgr->ctls[c].status & checkm) == match)
+			goto found;
+
+	dev_warn(ctl_mgr->dev->dev,
+		"fall back to the other CTL category for INTF %d!\n", intf_num);
+
+	match ^= CTL_STAT_BOOKED;
+	for (c = 0; c < ctl_mgr->nctl; c++)
+		if ((ctl_mgr->ctls[c].status & checkm) == match)
+			goto found;
+
+	DRM_DEV_ERROR(ctl_mgr->dev->dev, "No more CTL available!");
+	goto unlock;
+
+found:
+	ctl = &ctl_mgr->ctls[c];
+	ctl->status |= CTL_STAT_BUSY;
+	ctl->pending_ctl_trigger = 0;
+	DBG("CTL %d allocated", ctl->id);
+
+unlock:
+	spin_unlock_irqrestore(&ctl_mgr->pool_lock, flags);
+	return ctl;
+}
+
+void mdp5_ctlm_hw_reset(struct mdp5_ctl_manager *ctl_mgr)
+{
+	unsigned long flags;
+	int c;
+
+	for (c = 0; c < ctl_mgr->nctl; c++) {
+		struct mdp5_ctl *ctl = &ctl_mgr->ctls[c];
+
+		spin_lock_irqsave(&ctl->hw_lock, flags);
+		ctl_write(ctl, REG_MDP5_CTL_OP(ctl->id), 0);
+		spin_unlock_irqrestore(&ctl->hw_lock, flags);
+	}
+}
+
+struct mdp5_ctl_manager *mdp5_ctlm_init(struct drm_device *dev,
+		void __iomem *mmio_base, struct mdp5_cfg_handler *cfg_hnd)
+{
+	struct mdp5_ctl_manager *ctl_mgr;
+	const struct mdp5_cfg_hw *hw_cfg = mdp5_cfg_get_hw_config(cfg_hnd);
+	int rev = mdp5_cfg_get_hw_rev(cfg_hnd);
+	unsigned dsi_cnt = 0;
+	const struct mdp5_ctl_block *ctl_cfg = &hw_cfg->ctl;
+	unsigned long flags;
+	int c, ret;
+
+	ctl_mgr = devm_kzalloc(dev->dev, sizeof(*ctl_mgr), GFP_KERNEL);
+	if (!ctl_mgr) {
+		DRM_DEV_ERROR(dev->dev, "failed to allocate CTL manager\n");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	if (WARN_ON(ctl_cfg->count > MAX_CTL)) {
+		DRM_DEV_ERROR(dev->dev, "Increase static pool size to at least %d\n",
+				ctl_cfg->count);
+		return ERR_PTR(-ENOSPC);
+	}
+
+	/* initialize the CTL manager: */
+	ctl_mgr->dev = dev;
+	ctl_mgr->nlm = hw_cfg->lm.count;
+	ctl_mgr->nctl = ctl_cfg->count;
+	ctl_mgr->flush_hw_mask = ctl_cfg->flush_hw_mask;
+	spin_lock_init(&ctl_mgr->pool_lock);
+
+	/* initialize each CTL of the pool: */
+	spin_lock_irqsave(&ctl_mgr->pool_lock, flags);
+	for (c = 0; c < ctl_mgr->nctl; c++) {
+		struct mdp5_ctl *ctl = &ctl_mgr->ctls[c];
+
+		if (WARN_ON(!ctl_cfg->base[c])) {
+			DRM_DEV_ERROR(dev->dev, "CTL_%d: base is null!\n", c);
+			ret = -EINVAL;
+			spin_unlock_irqrestore(&ctl_mgr->pool_lock, flags);
+			return ERR_PTR(ret);
+		}
+		ctl->ctlm = ctl_mgr;
+		ctl->id = c;
+		ctl->reg_offset = ctl_cfg->base[c];
+		ctl->status = 0;
+		spin_lock_init(&ctl->hw_lock);
+	}
+
+	/*
+	 * In bonded DSI case, CTL0 and CTL1 are always assigned to two DSI
+	 * interfaces to support single FLUSH feature (Flush CTL0 and CTL1 when
+	 * only write into CTL0's FLUSH register) to keep two DSI pipes in sync.
+	 * Single FLUSH is supported from hw rev v3.0.
+	 */
+	for (c = 0; c < ARRAY_SIZE(hw_cfg->intf.connect); c++)
+		if (hw_cfg->intf.connect[c] == INTF_DSI)
+			dsi_cnt++;
+	if ((rev >= 3) && (dsi_cnt > 1)) {
+		ctl_mgr->single_flush_supported = true;
+		/* Reserve CTL0/1 for INTF1/2 */
+		ctl_mgr->ctls[0].status |= CTL_STAT_BOOKED;
+		ctl_mgr->ctls[1].status |= CTL_STAT_BOOKED;
+	}
+	spin_unlock_irqrestore(&ctl_mgr->pool_lock, flags);
+	DBG("Pool of %d CTLs created.", ctl_mgr->nctl);
+
+	return ctl_mgr;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_ctl.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_ctl.h
@@ -0,0 +1,77 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __MDP5_CTL_H__
+#define __MDP5_CTL_H__
+
+#include "msm_drv.h"
+
+/*
+ * CTL Manager prototypes:
+ * mdp5_ctlm_init() returns a ctlm (CTL Manager) handler,
+ * which is then used to call the other mdp5_ctlm_*(ctlm, ...) functions.
+ */
+struct mdp5_ctl_manager;
+struct mdp5_ctl_manager *mdp5_ctlm_init(struct drm_device *dev,
+		void __iomem *mmio_base, struct mdp5_cfg_handler *cfg_hnd);
+void mdp5_ctlm_hw_reset(struct mdp5_ctl_manager *ctlm);
+
+/*
+ * CTL prototypes:
+ * mdp5_ctl_request(ctlm, ...) returns a ctl (CTL resource) handler,
+ * which is then used to call the other mdp5_ctl_*(ctl, ...) functions.
+ */
+struct mdp5_ctl *mdp5_ctlm_request(struct mdp5_ctl_manager *ctlm, int intf_num);
+
+int mdp5_ctl_get_ctl_id(struct mdp5_ctl *ctl);
+
+struct mdp5_interface;
+struct mdp5_pipeline;
+int mdp5_ctl_set_pipeline(struct mdp5_ctl *ctl, struct mdp5_pipeline *p);
+int mdp5_ctl_set_encoder_state(struct mdp5_ctl *ctl, struct mdp5_pipeline *p,
+			       bool enabled);
+
+int mdp5_ctl_set_cursor(struct mdp5_ctl *ctl, struct mdp5_pipeline *pipeline,
+			int cursor_id, bool enable);
+int mdp5_ctl_pair(struct mdp5_ctl *ctlx, struct mdp5_ctl *ctly, bool enable);
+
+#define MAX_PIPE_STAGE		2
+
+/*
+ * mdp5_ctl_blend() - Blend multiple layers on a Layer Mixer (LM)
+ *
+ * @stage: array to contain the pipe num for each stage
+ * @stage_cnt: valid stage number in stage array
+ * @ctl_blend_op_flags: blender operation mode flags
+ *
+ * Note:
+ * CTL registers need to be flushed after calling this function
+ * (call mdp5_ctl_commit() with mdp_ctl_flush_mask_ctl() mask)
+ */
+#define MDP5_CTL_BLEND_OP_FLAG_BORDER_OUT	BIT(0)
+int mdp5_ctl_blend(struct mdp5_ctl *ctl, struct mdp5_pipeline *pipeline,
+		   enum mdp5_pipe stage[][MAX_PIPE_STAGE],
+		   enum mdp5_pipe r_stage[][MAX_PIPE_STAGE],
+		   u32 stage_cnt, u32 ctl_blend_op_flags);
+
+/**
+ * mdp_ctl_flush_mask...() - Register FLUSH masks
+ *
+ * These masks are used to specify which block(s) need to be flushed
+ * through @flush_mask parameter in mdp5_ctl_commit(.., flush_mask).
+ */
+u32 mdp_ctl_flush_mask_lm(int lm);
+u32 mdp_ctl_flush_mask_pipe(enum mdp5_pipe pipe);
+u32 mdp_ctl_flush_mask_cursor(int cursor_id);
+u32 mdp_ctl_flush_mask_encoder(struct mdp5_interface *intf);
+
+/* @flush_mask: see CTL flush masks definitions below */
+u32 mdp5_ctl_commit(struct mdp5_ctl *ctl, struct mdp5_pipeline *pipeline,
+		    u32 flush_mask, bool start);
+u32 mdp5_ctl_get_commit_status(struct mdp5_ctl *ctl);
+
+
+
+#endif /* __MDP5_CTL_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_encoder.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_encoder.c
@@ -0,0 +1,349 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_probe_helper.h>
+
+#include "mdp5_kms.h"
+
+static struct mdp5_kms *get_kms(struct drm_encoder *encoder)
+{
+	struct msm_drm_private *priv = encoder->dev->dev_private;
+	return to_mdp5_kms(to_mdp_kms(priv->kms));
+}
+
+static void mdp5_vid_encoder_mode_set(struct drm_encoder *encoder,
+				      struct drm_display_mode *mode,
+				      struct drm_display_mode *adjusted_mode)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_kms *mdp5_kms = get_kms(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct drm_connector *connector;
+	int intf = mdp5_encoder->intf->num;
+	uint32_t dtv_hsync_skew, vsync_period, vsync_len, ctrl_pol;
+	uint32_t display_v_start, display_v_end;
+	uint32_t hsync_start_x, hsync_end_x;
+	uint32_t format = 0x2100;
+	unsigned long flags;
+
+	mode = adjusted_mode;
+
+	DBG("set mode: " DRM_MODE_FMT, DRM_MODE_ARG(mode));
+
+	ctrl_pol = 0;
+
+	/* DSI controller cannot handle active-low sync signals. */
+	if (mdp5_encoder->intf->type != INTF_DSI) {
+		if (mode->flags & DRM_MODE_FLAG_NHSYNC)
+			ctrl_pol |= MDP5_INTF_POLARITY_CTL_HSYNC_LOW;
+		if (mode->flags & DRM_MODE_FLAG_NVSYNC)
+			ctrl_pol |= MDP5_INTF_POLARITY_CTL_VSYNC_LOW;
+	}
+	/* probably need to get DATA_EN polarity from panel.. */
+
+	dtv_hsync_skew = 0;  /* get this from panel? */
+
+	/* Get color format from panel, default is 8bpc */
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		if (connector->encoder == encoder) {
+			switch (connector->display_info.bpc) {
+			case 4:
+				format |= 0;
+				break;
+			case 5:
+				format |= 0x15;
+				break;
+			case 6:
+				format |= 0x2A;
+				break;
+			case 8:
+			default:
+				format |= 0x3F;
+				break;
+			}
+			break;
+		}
+	}
+
+	hsync_start_x = (mode->htotal - mode->hsync_start);
+	hsync_end_x = mode->htotal - (mode->hsync_start - mode->hdisplay) - 1;
+
+	vsync_period = mode->vtotal * mode->htotal;
+	vsync_len = (mode->vsync_end - mode->vsync_start) * mode->htotal;
+	display_v_start = (mode->vtotal - mode->vsync_start) * mode->htotal + dtv_hsync_skew;
+	display_v_end = vsync_period - ((mode->vsync_start - mode->vdisplay) * mode->htotal) + dtv_hsync_skew - 1;
+
+	/*
+	 * For edp only:
+	 * DISPLAY_V_START = (VBP * HCYCLE) + HBP
+	 * DISPLAY_V_END = (VBP + VACTIVE) * HCYCLE - 1 - HFP
+	 */
+	if (mdp5_encoder->intf->type == INTF_eDP) {
+		display_v_start += mode->htotal - mode->hsync_start;
+		display_v_end -= mode->hsync_start - mode->hdisplay;
+	}
+
+	spin_lock_irqsave(&mdp5_encoder->intf_lock, flags);
+
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_HSYNC_CTL(intf),
+			MDP5_INTF_HSYNC_CTL_PULSEW(mode->hsync_end - mode->hsync_start) |
+			MDP5_INTF_HSYNC_CTL_PERIOD(mode->htotal));
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_VSYNC_PERIOD_F0(intf), vsync_period);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_VSYNC_LEN_F0(intf), vsync_len);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_DISPLAY_HCTL(intf),
+			MDP5_INTF_DISPLAY_HCTL_START(hsync_start_x) |
+			MDP5_INTF_DISPLAY_HCTL_END(hsync_end_x));
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_DISPLAY_VSTART_F0(intf), display_v_start);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_DISPLAY_VEND_F0(intf), display_v_end);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_BORDER_COLOR(intf), 0);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_UNDERFLOW_COLOR(intf), 0xff);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_HSYNC_SKEW(intf), dtv_hsync_skew);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_POLARITY_CTL(intf), ctrl_pol);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_ACTIVE_HCTL(intf),
+			MDP5_INTF_ACTIVE_HCTL_START(0) |
+			MDP5_INTF_ACTIVE_HCTL_END(0));
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_ACTIVE_VSTART_F0(intf), 0);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_ACTIVE_VEND_F0(intf), 0);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_PANEL_FORMAT(intf), format);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_FRAME_LINE_COUNT_EN(intf), 0x3);  /* frame+line? */
+
+	spin_unlock_irqrestore(&mdp5_encoder->intf_lock, flags);
+
+	mdp5_crtc_set_pipeline(encoder->crtc);
+}
+
+static void mdp5_vid_encoder_disable(struct drm_encoder *encoder)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_kms *mdp5_kms = get_kms(encoder);
+	struct mdp5_ctl *ctl = mdp5_encoder->ctl;
+	struct mdp5_pipeline *pipeline = mdp5_crtc_get_pipeline(encoder->crtc);
+	struct mdp5_hw_mixer *mixer = mdp5_crtc_get_mixer(encoder->crtc);
+	struct mdp5_interface *intf = mdp5_encoder->intf;
+	int intfn = mdp5_encoder->intf->num;
+	unsigned long flags;
+
+	if (WARN_ON(!mdp5_encoder->enabled))
+		return;
+
+	mdp5_ctl_set_encoder_state(ctl, pipeline, false);
+
+	spin_lock_irqsave(&mdp5_encoder->intf_lock, flags);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_TIMING_ENGINE_EN(intfn), 0);
+	spin_unlock_irqrestore(&mdp5_encoder->intf_lock, flags);
+	mdp5_ctl_commit(ctl, pipeline, mdp_ctl_flush_mask_encoder(intf), true);
+
+	/*
+	 * Wait for a vsync so we know the ENABLE=0 latched before
+	 * the (connector) source of the vsync's gets disabled,
+	 * otherwise we end up in a funny state if we re-enable
+	 * before the disable latches, which results that some of
+	 * the settings changes for the new modeset (like new
+	 * scanout buffer) don't latch properly..
+	 */
+	mdp_irq_wait(&mdp5_kms->base, intf2vblank(mixer, intf));
+
+	mdp5_encoder->enabled = false;
+}
+
+static void mdp5_vid_encoder_enable(struct drm_encoder *encoder)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_kms *mdp5_kms = get_kms(encoder);
+	struct mdp5_ctl *ctl = mdp5_encoder->ctl;
+	struct mdp5_interface *intf = mdp5_encoder->intf;
+	struct mdp5_pipeline *pipeline = mdp5_crtc_get_pipeline(encoder->crtc);
+	int intfn = intf->num;
+	unsigned long flags;
+
+	if (WARN_ON(mdp5_encoder->enabled))
+		return;
+
+	spin_lock_irqsave(&mdp5_encoder->intf_lock, flags);
+	mdp5_write(mdp5_kms, REG_MDP5_INTF_TIMING_ENGINE_EN(intfn), 1);
+	spin_unlock_irqrestore(&mdp5_encoder->intf_lock, flags);
+	mdp5_ctl_commit(ctl, pipeline, mdp_ctl_flush_mask_encoder(intf), true);
+
+	mdp5_ctl_set_encoder_state(ctl, pipeline, true);
+
+	mdp5_encoder->enabled = true;
+}
+
+static void mdp5_encoder_mode_set(struct drm_encoder *encoder,
+				  struct drm_display_mode *mode,
+				  struct drm_display_mode *adjusted_mode)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_interface *intf = mdp5_encoder->intf;
+
+	if (intf->mode == MDP5_INTF_DSI_MODE_COMMAND)
+		mdp5_cmd_encoder_mode_set(encoder, mode, adjusted_mode);
+	else
+		mdp5_vid_encoder_mode_set(encoder, mode, adjusted_mode);
+}
+
+static void mdp5_encoder_disable(struct drm_encoder *encoder)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_interface *intf = mdp5_encoder->intf;
+
+	if (intf->mode == MDP5_INTF_DSI_MODE_COMMAND)
+		mdp5_cmd_encoder_disable(encoder);
+	else
+		mdp5_vid_encoder_disable(encoder);
+}
+
+static void mdp5_encoder_enable(struct drm_encoder *encoder)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_interface *intf = mdp5_encoder->intf;
+	/* this isn't right I think */
+	struct drm_crtc_state *cstate = encoder->crtc->state;
+
+	mdp5_encoder_mode_set(encoder, &cstate->mode, &cstate->adjusted_mode);
+
+	if (intf->mode == MDP5_INTF_DSI_MODE_COMMAND)
+		mdp5_cmd_encoder_enable(encoder);
+	else
+		mdp5_vid_encoder_enable(encoder);
+}
+
+static int mdp5_encoder_atomic_check(struct drm_encoder *encoder,
+				     struct drm_crtc_state *crtc_state,
+				     struct drm_connector_state *conn_state)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_crtc_state *mdp5_cstate = to_mdp5_crtc_state(crtc_state);
+	struct mdp5_interface *intf = mdp5_encoder->intf;
+	struct mdp5_ctl *ctl = mdp5_encoder->ctl;
+
+	mdp5_cstate->ctl = ctl;
+	mdp5_cstate->pipeline.intf = intf;
+
+	/*
+	 * This is a bit awkward, but we want to flush the CTL and hit the
+	 * START bit at most once for an atomic update.  In the non-full-
+	 * modeset case, this is done from crtc->atomic_flush(), but that
+	 * is too early in the case of full modeset, in which case we
+	 * defer to encoder->enable().  But we need to *know* whether
+	 * encoder->enable() will be called to do this:
+	 */
+	if (drm_atomic_crtc_needs_modeset(crtc_state))
+		mdp5_cstate->defer_start = true;
+
+	return 0;
+}
+
+static const struct drm_encoder_helper_funcs mdp5_encoder_helper_funcs = {
+	.disable = mdp5_encoder_disable,
+	.enable = mdp5_encoder_enable,
+	.atomic_check = mdp5_encoder_atomic_check,
+};
+
+int mdp5_encoder_get_linecount(struct drm_encoder *encoder)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_kms *mdp5_kms = get_kms(encoder);
+	int intf = mdp5_encoder->intf->num;
+
+	return mdp5_read(mdp5_kms, REG_MDP5_INTF_LINE_COUNT(intf));
+}
+
+u32 mdp5_encoder_get_framecount(struct drm_encoder *encoder)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_kms *mdp5_kms = get_kms(encoder);
+	int intf = mdp5_encoder->intf->num;
+
+	return mdp5_read(mdp5_kms, REG_MDP5_INTF_FRAME_COUNT(intf));
+}
+
+int mdp5_vid_encoder_set_split_display(struct drm_encoder *encoder,
+				       struct drm_encoder *slave_encoder)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_encoder *mdp5_slave_enc = to_mdp5_encoder(slave_encoder);
+	struct mdp5_kms *mdp5_kms;
+	struct device *dev;
+	int intf_num;
+	u32 data = 0;
+
+	if (!encoder || !slave_encoder)
+		return -EINVAL;
+
+	mdp5_kms = get_kms(encoder);
+	intf_num = mdp5_encoder->intf->num;
+
+	/* Switch slave encoder's TimingGen Sync mode,
+	 * to use the master's enable signal for the slave encoder.
+	 */
+	if (intf_num == 1)
+		data |= MDP5_SPLIT_DPL_LOWER_INTF2_TG_SYNC;
+	else if (intf_num == 2)
+		data |= MDP5_SPLIT_DPL_LOWER_INTF1_TG_SYNC;
+	else
+		return -EINVAL;
+
+	dev = &mdp5_kms->pdev->dev;
+	/* Make sure clocks are on when connectors calling this function. */
+	pm_runtime_get_sync(dev);
+
+	/* Dumb Panel, Sync mode */
+	mdp5_write(mdp5_kms, REG_MDP5_SPLIT_DPL_UPPER, 0);
+	mdp5_write(mdp5_kms, REG_MDP5_SPLIT_DPL_LOWER, data);
+	mdp5_write(mdp5_kms, REG_MDP5_SPLIT_DPL_EN, 1);
+
+	mdp5_ctl_pair(mdp5_encoder->ctl, mdp5_slave_enc->ctl, true);
+
+	pm_runtime_put_sync(dev);
+
+	return 0;
+}
+
+void mdp5_encoder_set_intf_mode(struct drm_encoder *encoder, bool cmd_mode)
+{
+	struct mdp5_encoder *mdp5_encoder = to_mdp5_encoder(encoder);
+	struct mdp5_interface *intf = mdp5_encoder->intf;
+
+	/* TODO: Expand this to set writeback modes too */
+	if (cmd_mode) {
+		WARN_ON(intf->type != INTF_DSI);
+		intf->mode = MDP5_INTF_DSI_MODE_COMMAND;
+	} else {
+		if (intf->type == INTF_DSI)
+			intf->mode = MDP5_INTF_DSI_MODE_VIDEO;
+		else
+			intf->mode = MDP5_INTF_MODE_NONE;
+	}
+}
+
+/* initialize encoder */
+struct drm_encoder *mdp5_encoder_init(struct drm_device *dev,
+				      struct mdp5_interface *intf,
+				      struct mdp5_ctl *ctl)
+{
+	struct drm_encoder *encoder = NULL;
+	struct mdp5_encoder *mdp5_encoder;
+	int enc_type = (intf->type == INTF_DSI) ?
+		DRM_MODE_ENCODER_DSI : DRM_MODE_ENCODER_TMDS;
+
+	mdp5_encoder = drmm_encoder_alloc(dev, struct mdp5_encoder, base,
+					  NULL, enc_type, NULL);
+	if (IS_ERR(mdp5_encoder))
+		return ERR_CAST(mdp5_encoder);
+
+	encoder = &mdp5_encoder->base;
+	mdp5_encoder->ctl = ctl;
+	mdp5_encoder->intf = intf;
+
+	spin_lock_init(&mdp5_encoder->intf_lock);
+
+	drm_encoder_helper_add(encoder, &mdp5_encoder_helper_funcs);
+
+	return encoder;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_irq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_irq.c
@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/irq.h>
+
+#include <drm/drm_print.h>
+#include <drm/drm_vblank.h>
+
+#include "msm_drv.h"
+#include "mdp5_kms.h"
+
+void mdp5_set_irqmask(struct mdp_kms *mdp_kms, uint32_t irqmask,
+		uint32_t old_irqmask)
+{
+	mdp5_write(to_mdp5_kms(mdp_kms), REG_MDP5_INTR_CLEAR,
+		   irqmask ^ (irqmask & old_irqmask));
+	mdp5_write(to_mdp5_kms(mdp_kms), REG_MDP5_INTR_EN, irqmask);
+}
+
+static void mdp5_irq_error_handler(struct mdp_irq *irq, uint32_t irqstatus)
+{
+	struct mdp5_kms *mdp5_kms = container_of(irq, struct mdp5_kms, error_handler);
+	static DEFINE_RATELIMIT_STATE(rs, 5*HZ, 1);
+	extern bool dumpstate;
+
+	DRM_ERROR_RATELIMITED("errors: %08x\n", irqstatus);
+
+	if (dumpstate && __ratelimit(&rs)) {
+		struct drm_printer p = drm_info_printer(mdp5_kms->dev->dev);
+		drm_state_dump(mdp5_kms->dev, &p);
+		if (mdp5_kms->smp)
+			mdp5_smp_dump(mdp5_kms->smp, &p);
+	}
+}
+
+void mdp5_irq_preinstall(struct msm_kms *kms)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	struct device *dev = &mdp5_kms->pdev->dev;
+
+	pm_runtime_get_sync(dev);
+	mdp5_write(mdp5_kms, REG_MDP5_INTR_CLEAR, 0xffffffff);
+	mdp5_write(mdp5_kms, REG_MDP5_INTR_EN, 0x00000000);
+	pm_runtime_put_sync(dev);
+}
+
+int mdp5_irq_postinstall(struct msm_kms *kms)
+{
+	struct mdp_kms *mdp_kms = to_mdp_kms(kms);
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(mdp_kms);
+	struct device *dev = &mdp5_kms->pdev->dev;
+	struct mdp_irq *error_handler = &mdp5_kms->error_handler;
+
+	error_handler->irq = mdp5_irq_error_handler;
+	error_handler->irqmask = MDP5_IRQ_INTF0_UNDER_RUN |
+			MDP5_IRQ_INTF1_UNDER_RUN |
+			MDP5_IRQ_INTF2_UNDER_RUN |
+			MDP5_IRQ_INTF3_UNDER_RUN;
+
+	pm_runtime_get_sync(dev);
+	mdp_irq_register(mdp_kms, error_handler);
+	pm_runtime_put_sync(dev);
+
+	return 0;
+}
+
+void mdp5_irq_uninstall(struct msm_kms *kms)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	struct device *dev = &mdp5_kms->pdev->dev;
+
+	pm_runtime_get_sync(dev);
+	mdp5_write(mdp5_kms, REG_MDP5_INTR_EN, 0x00000000);
+	pm_runtime_put_sync(dev);
+}
+
+irqreturn_t mdp5_irq(struct msm_kms *kms)
+{
+	struct mdp_kms *mdp_kms = to_mdp_kms(kms);
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(mdp_kms);
+	struct drm_device *dev = mdp5_kms->dev;
+	struct drm_crtc *crtc;
+	uint32_t status, enable;
+
+	enable = mdp5_read(mdp5_kms, REG_MDP5_INTR_EN);
+	status = mdp5_read(mdp5_kms, REG_MDP5_INTR_STATUS) & enable;
+	mdp5_write(mdp5_kms, REG_MDP5_INTR_CLEAR, status);
+
+	VERB("status=%08x", status);
+
+	mdp_dispatch_irqs(mdp_kms, status);
+
+	drm_for_each_crtc(crtc, dev)
+		if (status & mdp5_crtc_vblank(crtc))
+			drm_crtc_handle_vblank(crtc);
+
+	return IRQ_HANDLED;
+}
+
+int mdp5_enable_vblank(struct msm_kms *kms, struct drm_crtc *crtc)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	struct device *dev = &mdp5_kms->pdev->dev;
+
+	pm_runtime_get_sync(dev);
+	mdp_update_vblank_mask(to_mdp_kms(kms),
+			mdp5_crtc_vblank(crtc), true);
+	pm_runtime_put_sync(dev);
+
+	return 0;
+}
+
+void mdp5_disable_vblank(struct msm_kms *kms, struct drm_crtc *crtc)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	struct device *dev = &mdp5_kms->pdev->dev;
+
+	pm_runtime_get_sync(dev);
+	mdp_update_vblank_mask(to_mdp_kms(kms),
+			mdp5_crtc_vblank(crtc), false);
+	pm_runtime_put_sync(dev);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_kms.c
@@ -0,0 +1,976 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/delay.h>
+#include <linux/interconnect.h>
+#include <linux/of_irq.h>
+
+#include <drm/drm_debugfs.h>
+#include <drm/drm_drv.h>
+#include <drm/drm_file.h>
+#include <drm/drm_vblank.h>
+
+#include "msm_drv.h"
+#include "msm_gem.h"
+#include "msm_mmu.h"
+#include "mdp5_kms.h"
+
+static int mdp5_hw_init(struct msm_kms *kms)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	struct device *dev = &mdp5_kms->pdev->dev;
+	unsigned long flags;
+
+	pm_runtime_get_sync(dev);
+
+	/* Magic unknown register writes:
+	 *
+	 *    W VBIF:0x004 00000001      (mdss_mdp.c:839)
+	 *    W MDP5:0x2e0 0xe9          (mdss_mdp.c:839)
+	 *    W MDP5:0x2e4 0x55          (mdss_mdp.c:839)
+	 *    W MDP5:0x3ac 0xc0000ccc    (mdss_mdp.c:839)
+	 *    W MDP5:0x3b4 0xc0000ccc    (mdss_mdp.c:839)
+	 *    W MDP5:0x3bc 0xcccccc      (mdss_mdp.c:839)
+	 *    W MDP5:0x4a8 0xcccc0c0     (mdss_mdp.c:839)
+	 *    W MDP5:0x4b0 0xccccc0c0    (mdss_mdp.c:839)
+	 *    W MDP5:0x4b8 0xccccc000    (mdss_mdp.c:839)
+	 *
+	 * Downstream fbdev driver gets these register offsets/values
+	 * from DT.. not really sure what these registers are or if
+	 * different values for different boards/SoC's, etc.  I guess
+	 * they are the golden registers.
+	 *
+	 * Not setting these does not seem to cause any problem.  But
+	 * we may be getting lucky with the bootloader initializing
+	 * them for us.  OTOH, if we can always count on the bootloader
+	 * setting the golden registers, then perhaps we don't need to
+	 * care.
+	 */
+
+	spin_lock_irqsave(&mdp5_kms->resource_lock, flags);
+	mdp5_write(mdp5_kms, REG_MDP5_DISP_INTF_SEL, 0);
+	spin_unlock_irqrestore(&mdp5_kms->resource_lock, flags);
+
+	mdp5_ctlm_hw_reset(mdp5_kms->ctlm);
+
+	pm_runtime_put_sync(dev);
+
+	return 0;
+}
+
+/* Global/shared object state funcs */
+
+/*
+ * This is a helper that returns the private state currently in operation.
+ * Note that this would return the "old_state" if called in the atomic check
+ * path, and the "new_state" after the atomic swap has been done.
+ */
+struct mdp5_global_state *
+mdp5_get_existing_global_state(struct mdp5_kms *mdp5_kms)
+{
+	return to_mdp5_global_state(mdp5_kms->glob_state.state);
+}
+
+/*
+ * This acquires the modeset lock set aside for global state, creates
+ * a new duplicated private object state.
+ */
+struct mdp5_global_state *mdp5_get_global_state(struct drm_atomic_state *s)
+{
+	struct msm_drm_private *priv = s->dev->dev_private;
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+	struct drm_private_state *priv_state;
+	int ret;
+
+	ret = drm_modeset_lock(&mdp5_kms->glob_state_lock, s->acquire_ctx);
+	if (ret)
+		return ERR_PTR(ret);
+
+	priv_state = drm_atomic_get_private_obj_state(s, &mdp5_kms->glob_state);
+	if (IS_ERR(priv_state))
+		return ERR_CAST(priv_state);
+
+	return to_mdp5_global_state(priv_state);
+}
+
+static struct drm_private_state *
+mdp5_global_duplicate_state(struct drm_private_obj *obj)
+{
+	struct mdp5_global_state *state;
+
+	state = kmemdup(obj->state, sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return NULL;
+
+	__drm_atomic_helper_private_obj_duplicate_state(obj, &state->base);
+
+	return &state->base;
+}
+
+static void mdp5_global_destroy_state(struct drm_private_obj *obj,
+				      struct drm_private_state *state)
+{
+	struct mdp5_global_state *mdp5_state = to_mdp5_global_state(state);
+
+	kfree(mdp5_state);
+}
+
+static const struct drm_private_state_funcs mdp5_global_state_funcs = {
+	.atomic_duplicate_state = mdp5_global_duplicate_state,
+	.atomic_destroy_state = mdp5_global_destroy_state,
+};
+
+static int mdp5_global_obj_init(struct mdp5_kms *mdp5_kms)
+{
+	struct mdp5_global_state *state;
+
+	drm_modeset_lock_init(&mdp5_kms->glob_state_lock);
+
+	state = kzalloc(sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return -ENOMEM;
+
+	state->mdp5_kms = mdp5_kms;
+
+	drm_atomic_private_obj_init(mdp5_kms->dev, &mdp5_kms->glob_state,
+				    &state->base,
+				    &mdp5_global_state_funcs);
+	return 0;
+}
+
+static void mdp5_enable_commit(struct msm_kms *kms)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	pm_runtime_get_sync(&mdp5_kms->pdev->dev);
+}
+
+static void mdp5_disable_commit(struct msm_kms *kms)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	pm_runtime_put_sync(&mdp5_kms->pdev->dev);
+}
+
+static void mdp5_prepare_commit(struct msm_kms *kms, struct drm_atomic_state *state)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	struct mdp5_global_state *global_state;
+
+	global_state = mdp5_get_existing_global_state(mdp5_kms);
+
+	if (mdp5_kms->smp)
+		mdp5_smp_prepare_commit(mdp5_kms->smp, &global_state->smp);
+}
+
+static void mdp5_flush_commit(struct msm_kms *kms, unsigned crtc_mask)
+{
+	/* TODO */
+}
+
+static void mdp5_wait_flush(struct msm_kms *kms, unsigned crtc_mask)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	struct drm_crtc *crtc;
+
+	for_each_crtc_mask(mdp5_kms->dev, crtc, crtc_mask)
+		mdp5_crtc_wait_for_commit_done(crtc);
+}
+
+static void mdp5_complete_commit(struct msm_kms *kms, unsigned crtc_mask)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	struct mdp5_global_state *global_state;
+
+	global_state = mdp5_get_existing_global_state(mdp5_kms);
+
+	if (mdp5_kms->smp)
+		mdp5_smp_complete_commit(mdp5_kms->smp, &global_state->smp);
+}
+
+static int mdp5_set_split_display(struct msm_kms *kms,
+		struct drm_encoder *encoder,
+		struct drm_encoder *slave_encoder,
+		bool is_cmd_mode)
+{
+	if (is_cmd_mode)
+		return mdp5_cmd_encoder_set_split_display(encoder,
+							slave_encoder);
+	else
+		return mdp5_vid_encoder_set_split_display(encoder,
+							  slave_encoder);
+}
+
+static void mdp5_destroy(struct mdp5_kms *mdp5_kms);
+
+static void mdp5_kms_destroy(struct msm_kms *kms)
+{
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+	struct msm_gem_address_space *aspace = kms->aspace;
+
+	if (aspace) {
+		aspace->mmu->funcs->detach(aspace->mmu);
+		msm_gem_address_space_put(aspace);
+	}
+
+	mdp_kms_destroy(&mdp5_kms->base);
+	mdp5_destroy(mdp5_kms);
+}
+
+#ifdef CONFIG_DEBUG_FS
+static int smp_show(struct seq_file *m, void *arg)
+{
+	struct drm_info_node *node = m->private;
+	struct drm_device *dev = node->minor->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+	struct drm_printer p = drm_seq_file_printer(m);
+
+	if (!mdp5_kms->smp) {
+		drm_printf(&p, "no SMP pool\n");
+		return 0;
+	}
+
+	mdp5_smp_dump(mdp5_kms->smp, &p);
+
+	return 0;
+}
+
+static struct drm_info_list mdp5_debugfs_list[] = {
+		{"smp", smp_show },
+};
+
+static int mdp5_kms_debugfs_init(struct msm_kms *kms, struct drm_minor *minor)
+{
+	drm_debugfs_create_files(mdp5_debugfs_list,
+				 ARRAY_SIZE(mdp5_debugfs_list),
+				 minor->debugfs_root, minor);
+
+	return 0;
+}
+#endif
+
+static const struct mdp_kms_funcs kms_funcs = {
+	.base = {
+		.hw_init         = mdp5_hw_init,
+		.irq_preinstall  = mdp5_irq_preinstall,
+		.irq_postinstall = mdp5_irq_postinstall,
+		.irq_uninstall   = mdp5_irq_uninstall,
+		.irq             = mdp5_irq,
+		.enable_vblank   = mdp5_enable_vblank,
+		.disable_vblank  = mdp5_disable_vblank,
+		.flush_commit    = mdp5_flush_commit,
+		.enable_commit   = mdp5_enable_commit,
+		.disable_commit  = mdp5_disable_commit,
+		.prepare_commit  = mdp5_prepare_commit,
+		.wait_flush      = mdp5_wait_flush,
+		.complete_commit = mdp5_complete_commit,
+		.get_format      = mdp_get_format,
+		.set_split_display = mdp5_set_split_display,
+		.destroy         = mdp5_kms_destroy,
+#ifdef CONFIG_DEBUG_FS
+		.debugfs_init    = mdp5_kms_debugfs_init,
+#endif
+	},
+	.set_irqmask         = mdp5_set_irqmask,
+};
+
+static int mdp5_disable(struct mdp5_kms *mdp5_kms)
+{
+	DBG("");
+
+	mdp5_kms->enable_count--;
+	WARN_ON(mdp5_kms->enable_count < 0);
+
+	clk_disable_unprepare(mdp5_kms->tbu_rt_clk);
+	clk_disable_unprepare(mdp5_kms->tbu_clk);
+	clk_disable_unprepare(mdp5_kms->ahb_clk);
+	clk_disable_unprepare(mdp5_kms->axi_clk);
+	clk_disable_unprepare(mdp5_kms->core_clk);
+	clk_disable_unprepare(mdp5_kms->lut_clk);
+
+	return 0;
+}
+
+static int mdp5_enable(struct mdp5_kms *mdp5_kms)
+{
+	DBG("");
+
+	mdp5_kms->enable_count++;
+
+	clk_prepare_enable(mdp5_kms->ahb_clk);
+	clk_prepare_enable(mdp5_kms->axi_clk);
+	clk_prepare_enable(mdp5_kms->core_clk);
+	clk_prepare_enable(mdp5_kms->lut_clk);
+	clk_prepare_enable(mdp5_kms->tbu_clk);
+	clk_prepare_enable(mdp5_kms->tbu_rt_clk);
+
+	return 0;
+}
+
+static struct drm_encoder *construct_encoder(struct mdp5_kms *mdp5_kms,
+					     struct mdp5_interface *intf,
+					     struct mdp5_ctl *ctl)
+{
+	struct drm_device *dev = mdp5_kms->dev;
+	struct drm_encoder *encoder;
+
+	encoder = mdp5_encoder_init(dev, intf, ctl);
+	if (IS_ERR(encoder)) {
+		DRM_DEV_ERROR(dev->dev, "failed to construct encoder\n");
+		return encoder;
+	}
+
+	return encoder;
+}
+
+static int get_dsi_id_from_intf(const struct mdp5_cfg_hw *hw_cfg, int intf_num)
+{
+	const enum mdp5_intf_type *intfs = hw_cfg->intf.connect;
+	const int intf_cnt = ARRAY_SIZE(hw_cfg->intf.connect);
+	int id = 0, i;
+
+	for (i = 0; i < intf_cnt; i++) {
+		if (intfs[i] == INTF_DSI) {
+			if (intf_num == i)
+				return id;
+
+			id++;
+		}
+	}
+
+	return -EINVAL;
+}
+
+static int modeset_init_intf(struct mdp5_kms *mdp5_kms,
+			     struct mdp5_interface *intf)
+{
+	struct drm_device *dev = mdp5_kms->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct mdp5_ctl_manager *ctlm = mdp5_kms->ctlm;
+	struct mdp5_ctl *ctl;
+	struct drm_encoder *encoder;
+	int ret = 0;
+
+	switch (intf->type) {
+	case INTF_eDP:
+		DRM_DEV_INFO(dev->dev, "Skipping eDP interface %d\n", intf->num);
+		break;
+	case INTF_HDMI:
+		if (!priv->hdmi)
+			break;
+
+		ctl = mdp5_ctlm_request(ctlm, intf->num);
+		if (!ctl) {
+			ret = -EINVAL;
+			break;
+		}
+
+		encoder = construct_encoder(mdp5_kms, intf, ctl);
+		if (IS_ERR(encoder)) {
+			ret = PTR_ERR(encoder);
+			break;
+		}
+
+		ret = msm_hdmi_modeset_init(priv->hdmi, dev, encoder);
+		break;
+	case INTF_DSI:
+	{
+		const struct mdp5_cfg_hw *hw_cfg =
+					mdp5_cfg_get_hw_config(mdp5_kms->cfg);
+		int dsi_id = get_dsi_id_from_intf(hw_cfg, intf->num);
+
+		if ((dsi_id >= ARRAY_SIZE(priv->dsi)) || (dsi_id < 0)) {
+			DRM_DEV_ERROR(dev->dev, "failed to find dsi from intf %d\n",
+				intf->num);
+			ret = -EINVAL;
+			break;
+		}
+
+		if (!priv->dsi[dsi_id])
+			break;
+
+		ctl = mdp5_ctlm_request(ctlm, intf->num);
+		if (!ctl) {
+			ret = -EINVAL;
+			break;
+		}
+
+		encoder = construct_encoder(mdp5_kms, intf, ctl);
+		if (IS_ERR(encoder)) {
+			ret = PTR_ERR(encoder);
+			break;
+		}
+
+		ret = msm_dsi_modeset_init(priv->dsi[dsi_id], dev, encoder);
+		if (!ret)
+			mdp5_encoder_set_intf_mode(encoder, msm_dsi_is_cmd_mode(priv->dsi[dsi_id]));
+
+		break;
+	}
+	default:
+		DRM_DEV_ERROR(dev->dev, "unknown intf: %d\n", intf->type);
+		ret = -EINVAL;
+		break;
+	}
+
+	return ret;
+}
+
+static int modeset_init(struct mdp5_kms *mdp5_kms)
+{
+	struct drm_device *dev = mdp5_kms->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	unsigned int num_crtcs;
+	int i, ret, pi = 0, ci = 0;
+	struct drm_plane *primary[MAX_BASES] = { NULL };
+	struct drm_plane *cursor[MAX_BASES] = { NULL };
+	struct drm_encoder *encoder;
+	unsigned int num_encoders;
+
+	/*
+	 * Construct encoders and modeset initialize connector devices
+	 * for each external display interface.
+	 */
+	for (i = 0; i < mdp5_kms->num_intfs; i++) {
+		ret = modeset_init_intf(mdp5_kms, mdp5_kms->intfs[i]);
+		if (ret)
+			goto fail;
+	}
+
+	num_encoders = 0;
+	drm_for_each_encoder(encoder, dev)
+		num_encoders++;
+
+	/*
+	 * We should ideally have less number of encoders (set up by parsing
+	 * the MDP5 interfaces) than the number of layer mixers present in HW,
+	 * but let's be safe here anyway
+	 */
+	num_crtcs = min(num_encoders, mdp5_kms->num_hwmixers);
+
+	/*
+	 * Construct planes equaling the number of hw pipes, and CRTCs for the
+	 * N encoders set up by the driver. The first N planes become primary
+	 * planes for the CRTCs, with the remainder as overlay planes:
+	 */
+	for (i = 0; i < mdp5_kms->num_hwpipes; i++) {
+		struct mdp5_hw_pipe *hwpipe = mdp5_kms->hwpipes[i];
+		struct drm_plane *plane;
+		enum drm_plane_type type;
+
+		if (i < num_crtcs)
+			type = DRM_PLANE_TYPE_PRIMARY;
+		else if (hwpipe->caps & MDP_PIPE_CAP_CURSOR)
+			type = DRM_PLANE_TYPE_CURSOR;
+		else
+			type = DRM_PLANE_TYPE_OVERLAY;
+
+		plane = mdp5_plane_init(dev, type);
+		if (IS_ERR(plane)) {
+			ret = PTR_ERR(plane);
+			DRM_DEV_ERROR(dev->dev, "failed to construct plane %d (%d)\n", i, ret);
+			goto fail;
+		}
+
+		if (type == DRM_PLANE_TYPE_PRIMARY)
+			primary[pi++] = plane;
+		if (type == DRM_PLANE_TYPE_CURSOR)
+			cursor[ci++] = plane;
+	}
+
+	for (i = 0; i < num_crtcs; i++) {
+		struct drm_crtc *crtc;
+
+		crtc  = mdp5_crtc_init(dev, primary[i], cursor[i], i);
+		if (IS_ERR(crtc)) {
+			ret = PTR_ERR(crtc);
+			DRM_DEV_ERROR(dev->dev, "failed to construct crtc %d (%d)\n", i, ret);
+			goto fail;
+		}
+		priv->num_crtcs++;
+	}
+
+	/*
+	 * Now that we know the number of crtcs we've created, set the possible
+	 * crtcs for the encoders
+	 */
+	drm_for_each_encoder(encoder, dev)
+		encoder->possible_crtcs = (1 << priv->num_crtcs) - 1;
+
+	return 0;
+
+fail:
+	return ret;
+}
+
+static void read_mdp_hw_revision(struct mdp5_kms *mdp5_kms,
+				 u32 *major, u32 *minor)
+{
+	struct device *dev = &mdp5_kms->pdev->dev;
+	u32 version;
+
+	pm_runtime_get_sync(dev);
+	version = mdp5_read(mdp5_kms, REG_MDP5_HW_VERSION);
+	pm_runtime_put_sync(dev);
+
+	*major = FIELD(version, MDP5_HW_VERSION_MAJOR);
+	*minor = FIELD(version, MDP5_HW_VERSION_MINOR);
+
+	DRM_DEV_INFO(dev, "MDP5 version v%d.%d", *major, *minor);
+}
+
+static int get_clk(struct platform_device *pdev, struct clk **clkp,
+		const char *name, bool mandatory)
+{
+	struct device *dev = &pdev->dev;
+	struct clk *clk = msm_clk_get(pdev, name);
+	if (IS_ERR(clk) && mandatory) {
+		DRM_DEV_ERROR(dev, "failed to get %s (%ld)\n", name, PTR_ERR(clk));
+		return PTR_ERR(clk);
+	}
+	if (IS_ERR(clk))
+		DBG("skipping %s", name);
+	else
+		*clkp = clk;
+
+	return 0;
+}
+
+static int mdp5_init(struct platform_device *pdev, struct drm_device *dev);
+
+static int mdp5_kms_init(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct platform_device *pdev;
+	struct mdp5_kms *mdp5_kms;
+	struct mdp5_cfg *config;
+	struct msm_kms *kms = priv->kms;
+	struct msm_gem_address_space *aspace;
+	int i, ret;
+
+	ret = mdp5_init(to_platform_device(dev->dev), dev);
+	if (ret)
+		return ret;
+
+	mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+
+	pdev = mdp5_kms->pdev;
+
+	ret = mdp_kms_init(&mdp5_kms->base, &kms_funcs);
+	if (ret) {
+		DRM_DEV_ERROR(&pdev->dev, "failed to init kms\n");
+		goto fail;
+	}
+
+	config = mdp5_cfg_get_config(mdp5_kms->cfg);
+
+	/* make sure things are off before attaching iommu (bootloader could
+	 * have left things on, in which case we'll start getting faults if
+	 * we don't disable):
+	 */
+	pm_runtime_get_sync(&pdev->dev);
+	for (i = 0; i < MDP5_INTF_NUM_MAX; i++) {
+		if (mdp5_cfg_intf_is_virtual(config->hw->intf.connect[i]) ||
+		    !config->hw->intf.base[i])
+			continue;
+		mdp5_write(mdp5_kms, REG_MDP5_INTF_TIMING_ENGINE_EN(i), 0);
+
+		mdp5_write(mdp5_kms, REG_MDP5_INTF_FRAME_LINE_COUNT_EN(i), 0x3);
+	}
+	mdelay(16);
+
+	aspace = msm_kms_init_aspace(mdp5_kms->dev);
+	if (IS_ERR(aspace)) {
+		ret = PTR_ERR(aspace);
+		goto fail;
+	}
+
+	kms->aspace = aspace;
+
+	pm_runtime_put_sync(&pdev->dev);
+
+	ret = modeset_init(mdp5_kms);
+	if (ret) {
+		DRM_DEV_ERROR(&pdev->dev, "modeset_init failed: %d\n", ret);
+		goto fail;
+	}
+
+	dev->mode_config.min_width = 0;
+	dev->mode_config.min_height = 0;
+	dev->mode_config.max_width = 0xffff;
+	dev->mode_config.max_height = 0xffff;
+
+	dev->max_vblank_count = 0; /* max_vblank_count is set on each CRTC */
+	dev->vblank_disable_immediate = true;
+
+	return 0;
+fail:
+	if (kms)
+		mdp5_kms_destroy(kms);
+
+	return ret;
+}
+
+static void mdp5_destroy(struct mdp5_kms *mdp5_kms)
+{
+	if (mdp5_kms->rpm_enabled)
+		pm_runtime_disable(&mdp5_kms->pdev->dev);
+
+	drm_atomic_private_obj_fini(&mdp5_kms->glob_state);
+	drm_modeset_lock_fini(&mdp5_kms->glob_state_lock);
+}
+
+static int construct_pipes(struct mdp5_kms *mdp5_kms, int cnt,
+		const enum mdp5_pipe *pipes, const uint32_t *offsets,
+		uint32_t caps)
+{
+	struct drm_device *dev = mdp5_kms->dev;
+	int i, ret;
+
+	for (i = 0; i < cnt; i++) {
+		struct mdp5_hw_pipe *hwpipe;
+
+		hwpipe = mdp5_pipe_init(dev, pipes[i], offsets[i], caps);
+		if (IS_ERR(hwpipe)) {
+			ret = PTR_ERR(hwpipe);
+			DRM_DEV_ERROR(dev->dev, "failed to construct pipe for %s (%d)\n",
+					pipe2name(pipes[i]), ret);
+			return ret;
+		}
+		hwpipe->idx = mdp5_kms->num_hwpipes;
+		mdp5_kms->hwpipes[mdp5_kms->num_hwpipes++] = hwpipe;
+	}
+
+	return 0;
+}
+
+static int hwpipe_init(struct mdp5_kms *mdp5_kms)
+{
+	static const enum mdp5_pipe rgb_planes[] = {
+			SSPP_RGB0, SSPP_RGB1, SSPP_RGB2, SSPP_RGB3,
+	};
+	static const enum mdp5_pipe vig_planes[] = {
+			SSPP_VIG0, SSPP_VIG1, SSPP_VIG2, SSPP_VIG3,
+	};
+	static const enum mdp5_pipe dma_planes[] = {
+			SSPP_DMA0, SSPP_DMA1,
+	};
+	static const enum mdp5_pipe cursor_planes[] = {
+			SSPP_CURSOR0, SSPP_CURSOR1,
+	};
+	const struct mdp5_cfg_hw *hw_cfg;
+	int ret;
+
+	hw_cfg = mdp5_cfg_get_hw_config(mdp5_kms->cfg);
+
+	/* Construct RGB pipes: */
+	ret = construct_pipes(mdp5_kms, hw_cfg->pipe_rgb.count, rgb_planes,
+			hw_cfg->pipe_rgb.base, hw_cfg->pipe_rgb.caps);
+	if (ret)
+		return ret;
+
+	/* Construct video (VIG) pipes: */
+	ret = construct_pipes(mdp5_kms, hw_cfg->pipe_vig.count, vig_planes,
+			hw_cfg->pipe_vig.base, hw_cfg->pipe_vig.caps);
+	if (ret)
+		return ret;
+
+	/* Construct DMA pipes: */
+	ret = construct_pipes(mdp5_kms, hw_cfg->pipe_dma.count, dma_planes,
+			hw_cfg->pipe_dma.base, hw_cfg->pipe_dma.caps);
+	if (ret)
+		return ret;
+
+	/* Construct cursor pipes: */
+	ret = construct_pipes(mdp5_kms, hw_cfg->pipe_cursor.count,
+			cursor_planes, hw_cfg->pipe_cursor.base,
+			hw_cfg->pipe_cursor.caps);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int hwmixer_init(struct mdp5_kms *mdp5_kms)
+{
+	struct drm_device *dev = mdp5_kms->dev;
+	const struct mdp5_cfg_hw *hw_cfg;
+	int i, ret;
+
+	hw_cfg = mdp5_cfg_get_hw_config(mdp5_kms->cfg);
+
+	for (i = 0; i < hw_cfg->lm.count; i++) {
+		struct mdp5_hw_mixer *mixer;
+
+		mixer = mdp5_mixer_init(dev, &hw_cfg->lm.instances[i]);
+		if (IS_ERR(mixer)) {
+			ret = PTR_ERR(mixer);
+			DRM_DEV_ERROR(dev->dev, "failed to construct LM%d (%d)\n",
+				i, ret);
+			return ret;
+		}
+
+		mixer->idx = mdp5_kms->num_hwmixers;
+		mdp5_kms->hwmixers[mdp5_kms->num_hwmixers++] = mixer;
+	}
+
+	return 0;
+}
+
+static int interface_init(struct mdp5_kms *mdp5_kms)
+{
+	struct drm_device *dev = mdp5_kms->dev;
+	const struct mdp5_cfg_hw *hw_cfg;
+	const enum mdp5_intf_type *intf_types;
+	int i;
+
+	hw_cfg = mdp5_cfg_get_hw_config(mdp5_kms->cfg);
+	intf_types = hw_cfg->intf.connect;
+
+	for (i = 0; i < ARRAY_SIZE(hw_cfg->intf.connect); i++) {
+		struct mdp5_interface *intf;
+
+		if (intf_types[i] == INTF_DISABLED)
+			continue;
+
+		intf = devm_kzalloc(dev->dev, sizeof(*intf), GFP_KERNEL);
+		if (!intf) {
+			DRM_DEV_ERROR(dev->dev, "failed to construct INTF%d\n", i);
+			return -ENOMEM;
+		}
+
+		intf->num = i;
+		intf->type = intf_types[i];
+		intf->mode = MDP5_INTF_MODE_NONE;
+		intf->idx = mdp5_kms->num_intfs;
+		mdp5_kms->intfs[mdp5_kms->num_intfs++] = intf;
+	}
+
+	return 0;
+}
+
+static int mdp5_init(struct platform_device *pdev, struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+	struct mdp5_cfg *config;
+	u32 major, minor;
+	int ret;
+
+	mdp5_kms->dev = dev;
+
+	ret = mdp5_global_obj_init(mdp5_kms);
+	if (ret)
+		goto fail;
+
+	/* we need to set a default rate before enabling.  Set a safe
+	 * rate first, then figure out hw revision, and then set a
+	 * more optimal rate:
+	 */
+	clk_set_rate(mdp5_kms->core_clk, 200000000);
+
+	pm_runtime_enable(&pdev->dev);
+	mdp5_kms->rpm_enabled = true;
+
+	read_mdp_hw_revision(mdp5_kms, &major, &minor);
+
+	mdp5_kms->cfg = mdp5_cfg_init(mdp5_kms, major, minor);
+	if (IS_ERR(mdp5_kms->cfg)) {
+		ret = PTR_ERR(mdp5_kms->cfg);
+		mdp5_kms->cfg = NULL;
+		goto fail;
+	}
+
+	config = mdp5_cfg_get_config(mdp5_kms->cfg);
+	mdp5_kms->caps = config->hw->mdp.caps;
+
+	/* TODO: compute core clock rate at runtime */
+	clk_set_rate(mdp5_kms->core_clk, config->hw->max_clk);
+
+	/*
+	 * Some chipsets have a Shared Memory Pool (SMP), while others
+	 * have dedicated latency buffering per source pipe instead;
+	 * this section initializes the SMP:
+	 */
+	if (mdp5_kms->caps & MDP_CAP_SMP) {
+		mdp5_kms->smp = mdp5_smp_init(mdp5_kms, &config->hw->smp);
+		if (IS_ERR(mdp5_kms->smp)) {
+			ret = PTR_ERR(mdp5_kms->smp);
+			mdp5_kms->smp = NULL;
+			goto fail;
+		}
+	}
+
+	mdp5_kms->ctlm = mdp5_ctlm_init(dev, mdp5_kms->mmio, mdp5_kms->cfg);
+	if (IS_ERR(mdp5_kms->ctlm)) {
+		ret = PTR_ERR(mdp5_kms->ctlm);
+		mdp5_kms->ctlm = NULL;
+		goto fail;
+	}
+
+	ret = hwpipe_init(mdp5_kms);
+	if (ret)
+		goto fail;
+
+	ret = hwmixer_init(mdp5_kms);
+	if (ret)
+		goto fail;
+
+	ret = interface_init(mdp5_kms);
+	if (ret)
+		goto fail;
+
+	return 0;
+fail:
+	mdp5_destroy(mdp5_kms);
+	return ret;
+}
+
+static int mdp5_setup_interconnect(struct platform_device *pdev)
+{
+	struct icc_path *path0 = msm_icc_get(&pdev->dev, "mdp0-mem");
+	struct icc_path *path1 = msm_icc_get(&pdev->dev, "mdp1-mem");
+	struct icc_path *path_rot = msm_icc_get(&pdev->dev, "rotator-mem");
+
+	if (IS_ERR(path0))
+		return PTR_ERR(path0);
+
+	if (!path0) {
+		/* no interconnect support is not necessarily a fatal
+		 * condition, the platform may simply not have an
+		 * interconnect driver yet.  But warn about it in case
+		 * bootloader didn't setup bus clocks high enough for
+		 * scanout.
+		 */
+		dev_warn(&pdev->dev, "No interconnect support may cause display underflows!\n");
+		return 0;
+	}
+
+	icc_set_bw(path0, 0, MBps_to_icc(6400));
+
+	if (!IS_ERR_OR_NULL(path1))
+		icc_set_bw(path1, 0, MBps_to_icc(6400));
+	if (!IS_ERR_OR_NULL(path_rot))
+		icc_set_bw(path_rot, 0, MBps_to_icc(6400));
+
+	return 0;
+}
+
+static int mdp5_dev_probe(struct platform_device *pdev)
+{
+	struct mdp5_kms *mdp5_kms;
+	int ret, irq;
+
+	DBG("");
+
+	mdp5_kms = devm_kzalloc(&pdev->dev, sizeof(*mdp5_kms), GFP_KERNEL);
+	if (!mdp5_kms)
+		return -ENOMEM;
+
+	ret = mdp5_setup_interconnect(pdev);
+	if (ret)
+		return ret;
+
+	mdp5_kms->pdev = pdev;
+
+	spin_lock_init(&mdp5_kms->resource_lock);
+
+	mdp5_kms->mmio = msm_ioremap(pdev, "mdp_phys");
+	if (IS_ERR(mdp5_kms->mmio))
+		return PTR_ERR(mdp5_kms->mmio);
+
+	/* mandatory clocks: */
+	ret = get_clk(pdev, &mdp5_kms->axi_clk, "bus", true);
+	if (ret)
+		return ret;
+	ret = get_clk(pdev, &mdp5_kms->ahb_clk, "iface", true);
+	if (ret)
+		return ret;
+	ret = get_clk(pdev, &mdp5_kms->core_clk, "core", true);
+	if (ret)
+		return ret;
+	ret = get_clk(pdev, &mdp5_kms->vsync_clk, "vsync", true);
+	if (ret)
+		return ret;
+
+	/* optional clocks: */
+	get_clk(pdev, &mdp5_kms->lut_clk, "lut", false);
+	get_clk(pdev, &mdp5_kms->tbu_clk, "tbu", false);
+	get_clk(pdev, &mdp5_kms->tbu_rt_clk, "tbu_rt", false);
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return dev_err_probe(&pdev->dev, irq, "failed to get irq\n");
+
+	mdp5_kms->base.base.irq = irq;
+
+	return msm_drv_probe(&pdev->dev, mdp5_kms_init, &mdp5_kms->base.base);
+}
+
+static void mdp5_dev_remove(struct platform_device *pdev)
+{
+	DBG("");
+	component_master_del(&pdev->dev, &msm_drm_ops);
+}
+
+static __maybe_unused int mdp5_runtime_suspend(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct msm_drm_private *priv = platform_get_drvdata(pdev);
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+
+	DBG("");
+
+	return mdp5_disable(mdp5_kms);
+}
+
+static __maybe_unused int mdp5_runtime_resume(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct msm_drm_private *priv = platform_get_drvdata(pdev);
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+
+	DBG("");
+
+	return mdp5_enable(mdp5_kms);
+}
+
+static const struct dev_pm_ops mdp5_pm_ops = {
+	SET_RUNTIME_PM_OPS(mdp5_runtime_suspend, mdp5_runtime_resume, NULL)
+	.prepare = msm_kms_pm_prepare,
+	.complete = msm_kms_pm_complete,
+};
+
+static const struct of_device_id mdp5_dt_match[] = {
+	{ .compatible = "qcom,mdp5", },
+	/* to support downstream DT files */
+	{ .compatible = "qcom,mdss_mdp", },
+	{}
+};
+MODULE_DEVICE_TABLE(of, mdp5_dt_match);
+
+static struct platform_driver mdp5_driver = {
+	.probe = mdp5_dev_probe,
+	.remove_new = mdp5_dev_remove,
+	.shutdown = msm_kms_shutdown,
+	.driver = {
+		.name = "msm_mdp",
+		.of_match_table = mdp5_dt_match,
+		.pm = &mdp5_pm_ops,
+	},
+};
+
+void __init msm_mdp_register(void)
+{
+	DBG("");
+	platform_driver_register(&mdp5_driver);
+}
+
+void __exit msm_mdp_unregister(void)
+{
+	DBG("");
+	platform_driver_unregister(&mdp5_driver);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_kms.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_kms.h
@@ -0,0 +1,327 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MDP5_KMS_H__
+#define __MDP5_KMS_H__
+
+#include "msm_drv.h"
+#include "msm_kms.h"
+#include "disp/mdp_kms.h"
+#include "mdp5_cfg.h"	/* must be included before mdp5.xml.h */
+#include "mdp5.xml.h"
+#include "mdp5_pipe.h"
+#include "mdp5_mixer.h"
+#include "mdp5_ctl.h"
+#include "mdp5_smp.h"
+
+struct mdp5_kms {
+	struct mdp_kms base;
+
+	struct drm_device *dev;
+
+	struct platform_device *pdev;
+
+	unsigned num_hwpipes;
+	struct mdp5_hw_pipe *hwpipes[SSPP_MAX];
+
+	unsigned num_hwmixers;
+	struct mdp5_hw_mixer *hwmixers[8];
+
+	unsigned num_intfs;
+	struct mdp5_interface *intfs[5];
+
+	struct mdp5_cfg_handler *cfg;
+	uint32_t caps;	/* MDP capabilities (MDP_CAP_XXX bits) */
+
+	/*
+	 * Global private object state, Do not access directly, use
+	 * mdp5_global_get_state()
+	 */
+	struct drm_modeset_lock glob_state_lock;
+	struct drm_private_obj glob_state;
+
+	struct mdp5_smp *smp;
+	struct mdp5_ctl_manager *ctlm;
+
+	/* io/register spaces: */
+	void __iomem *mmio;
+
+	struct clk *axi_clk;
+	struct clk *ahb_clk;
+	struct clk *core_clk;
+	struct clk *lut_clk;
+	struct clk *tbu_clk;
+	struct clk *tbu_rt_clk;
+	struct clk *vsync_clk;
+
+	/*
+	 * lock to protect access to global resources: ie., following register:
+	 *	- REG_MDP5_DISP_INTF_SEL
+	 */
+	spinlock_t resource_lock;
+
+	bool rpm_enabled;
+
+	struct mdp_irq error_handler;
+
+	int enable_count;
+};
+#define to_mdp5_kms(x) container_of(x, struct mdp5_kms, base)
+
+/* Global private object state for tracking resources that are shared across
+ * multiple kms objects (planes/crtcs/etc).
+ */
+#define to_mdp5_global_state(x) container_of(x, struct mdp5_global_state, base)
+struct mdp5_global_state {
+	struct drm_private_state base;
+
+	struct drm_atomic_state *state;
+	struct mdp5_kms *mdp5_kms;
+
+	struct mdp5_hw_pipe_state hwpipe;
+	struct mdp5_hw_mixer_state hwmixer;
+	struct mdp5_smp_state smp;
+};
+
+struct mdp5_global_state * mdp5_get_existing_global_state(struct mdp5_kms *mdp5_kms);
+struct mdp5_global_state *__must_check mdp5_get_global_state(struct drm_atomic_state *s);
+
+/* Atomic plane state.  Subclasses the base drm_plane_state in order to
+ * track assigned hwpipe and hw specific state.
+ */
+struct mdp5_plane_state {
+	struct drm_plane_state base;
+
+	struct mdp5_hw_pipe *hwpipe;
+	struct mdp5_hw_pipe *r_hwpipe;	/* right hwpipe */
+
+	/* assigned by crtc blender */
+	enum mdp_mixer_stage_id stage;
+
+	/* whether attached CRTC needs pixel data explicitly flushed to
+	 * display (ex. DSI command mode display)
+	 */
+	bool needs_dirtyfb;
+};
+#define to_mdp5_plane_state(x) \
+		container_of(x, struct mdp5_plane_state, base)
+
+struct mdp5_pipeline {
+	struct mdp5_interface *intf;
+	struct mdp5_hw_mixer *mixer;
+	struct mdp5_hw_mixer *r_mixer;	/* right mixer */
+};
+
+struct mdp5_crtc_state {
+	struct drm_crtc_state base;
+
+	struct mdp5_ctl *ctl;
+	struct mdp5_pipeline pipeline;
+
+	/* these are derivatives of intf/mixer state in mdp5_pipeline */
+	u32 vblank_irqmask;
+	u32 err_irqmask;
+	u32 pp_done_irqmask;
+
+	bool cmd_mode;
+
+	/* should we not write CTL[n].START register on flush?  If the
+	 * encoder has changed this is set to true, since encoder->enable()
+	 * is called after crtc state is committed, but we only want to
+	 * write the CTL[n].START register once.  This lets us defer
+	 * writing CTL[n].START until encoder->enable()
+	 */
+	bool defer_start;
+};
+#define to_mdp5_crtc_state(x) \
+		container_of(x, struct mdp5_crtc_state, base)
+
+enum mdp5_intf_mode {
+	MDP5_INTF_MODE_NONE = 0,
+
+	/* Modes used for DSI interface (INTF_DSI type): */
+	MDP5_INTF_DSI_MODE_VIDEO,
+	MDP5_INTF_DSI_MODE_COMMAND,
+
+	/* Modes used for WB interface (INTF_WB type):  */
+	MDP5_INTF_WB_MODE_BLOCK,
+	MDP5_INTF_WB_MODE_LINE,
+};
+
+struct mdp5_interface {
+	int idx;
+	int num; /* display interface number */
+	enum mdp5_intf_type type;
+	enum mdp5_intf_mode mode;
+};
+
+struct mdp5_encoder {
+	struct drm_encoder base;
+	spinlock_t intf_lock;	/* protect REG_MDP5_INTF_* registers */
+	bool enabled;
+	uint32_t bsc;
+
+	struct mdp5_interface *intf;
+	struct mdp5_ctl *ctl;
+};
+#define to_mdp5_encoder(x) container_of(x, struct mdp5_encoder, base)
+
+static inline void mdp5_write(struct mdp5_kms *mdp5_kms, u32 reg, u32 data)
+{
+	WARN_ON(mdp5_kms->enable_count <= 0);
+	msm_writel(data, mdp5_kms->mmio + reg);
+}
+
+static inline u32 mdp5_read(struct mdp5_kms *mdp5_kms, u32 reg)
+{
+	WARN_ON(mdp5_kms->enable_count <= 0);
+	return msm_readl(mdp5_kms->mmio + reg);
+}
+
+static inline const char *stage2name(enum mdp_mixer_stage_id stage)
+{
+	static const char *names[] = {
+#define NAME(n) [n] = #n
+		NAME(STAGE_UNUSED), NAME(STAGE_BASE),
+		NAME(STAGE0), NAME(STAGE1), NAME(STAGE2),
+		NAME(STAGE3), NAME(STAGE4), NAME(STAGE6),
+#undef NAME
+	};
+	return names[stage];
+}
+
+static inline const char *pipe2name(enum mdp5_pipe pipe)
+{
+	static const char *names[] = {
+#define NAME(n) [SSPP_ ## n] = #n
+		NAME(VIG0), NAME(VIG1), NAME(VIG2),
+		NAME(RGB0), NAME(RGB1), NAME(RGB2),
+		NAME(DMA0), NAME(DMA1),
+		NAME(VIG3), NAME(RGB3),
+		NAME(CURSOR0), NAME(CURSOR1),
+#undef NAME
+	};
+	return names[pipe];
+}
+
+static inline int pipe2nclients(enum mdp5_pipe pipe)
+{
+	switch (pipe) {
+	case SSPP_RGB0:
+	case SSPP_RGB1:
+	case SSPP_RGB2:
+	case SSPP_RGB3:
+		return 1;
+	default:
+		return 3;
+	}
+}
+
+static inline uint32_t intf2err(int intf_num)
+{
+	switch (intf_num) {
+	case 0:  return MDP5_IRQ_INTF0_UNDER_RUN;
+	case 1:  return MDP5_IRQ_INTF1_UNDER_RUN;
+	case 2:  return MDP5_IRQ_INTF2_UNDER_RUN;
+	case 3:  return MDP5_IRQ_INTF3_UNDER_RUN;
+	default: return 0;
+	}
+}
+
+static inline uint32_t intf2vblank(struct mdp5_hw_mixer *mixer,
+				   struct mdp5_interface *intf)
+{
+	/*
+	 * In case of DSI Command Mode, the Ping Pong's read pointer IRQ
+	 * acts as a Vblank signal. The Ping Pong buffer used is bound to
+	 * layer mixer.
+	 */
+
+	if ((intf->type == INTF_DSI) &&
+			(intf->mode == MDP5_INTF_DSI_MODE_COMMAND))
+		return MDP5_IRQ_PING_PONG_0_RD_PTR << mixer->pp;
+
+	if (intf->type == INTF_WB)
+		return MDP5_IRQ_WB_2_DONE;
+
+	switch (intf->num) {
+	case 0:  return MDP5_IRQ_INTF0_VSYNC;
+	case 1:  return MDP5_IRQ_INTF1_VSYNC;
+	case 2:  return MDP5_IRQ_INTF2_VSYNC;
+	case 3:  return MDP5_IRQ_INTF3_VSYNC;
+	default: return 0;
+	}
+}
+
+static inline uint32_t lm2ppdone(struct mdp5_hw_mixer *mixer)
+{
+	return MDP5_IRQ_PING_PONG_0_DONE << mixer->pp;
+}
+
+void mdp5_set_irqmask(struct mdp_kms *mdp_kms, uint32_t irqmask,
+		uint32_t old_irqmask);
+void mdp5_irq_preinstall(struct msm_kms *kms);
+int mdp5_irq_postinstall(struct msm_kms *kms);
+void mdp5_irq_uninstall(struct msm_kms *kms);
+irqreturn_t mdp5_irq(struct msm_kms *kms);
+int mdp5_enable_vblank(struct msm_kms *kms, struct drm_crtc *crtc);
+void mdp5_disable_vblank(struct msm_kms *kms, struct drm_crtc *crtc);
+int mdp5_irq_domain_init(struct mdp5_kms *mdp5_kms);
+void mdp5_irq_domain_fini(struct mdp5_kms *mdp5_kms);
+
+uint32_t mdp5_plane_get_flush(struct drm_plane *plane);
+enum mdp5_pipe mdp5_plane_pipe(struct drm_plane *plane);
+enum mdp5_pipe mdp5_plane_right_pipe(struct drm_plane *plane);
+struct drm_plane *mdp5_plane_init(struct drm_device *dev,
+				  enum drm_plane_type type);
+
+struct mdp5_ctl *mdp5_crtc_get_ctl(struct drm_crtc *crtc);
+uint32_t mdp5_crtc_vblank(struct drm_crtc *crtc);
+
+struct mdp5_hw_mixer *mdp5_crtc_get_mixer(struct drm_crtc *crtc);
+struct mdp5_pipeline *mdp5_crtc_get_pipeline(struct drm_crtc *crtc);
+void mdp5_crtc_set_pipeline(struct drm_crtc *crtc);
+void mdp5_crtc_wait_for_commit_done(struct drm_crtc *crtc);
+struct drm_crtc *mdp5_crtc_init(struct drm_device *dev,
+				struct drm_plane *plane,
+				struct drm_plane *cursor_plane, int id);
+
+struct drm_encoder *mdp5_encoder_init(struct drm_device *dev,
+		struct mdp5_interface *intf, struct mdp5_ctl *ctl);
+int mdp5_vid_encoder_set_split_display(struct drm_encoder *encoder,
+				       struct drm_encoder *slave_encoder);
+void mdp5_encoder_set_intf_mode(struct drm_encoder *encoder, bool cmd_mode);
+int mdp5_encoder_get_linecount(struct drm_encoder *encoder);
+u32 mdp5_encoder_get_framecount(struct drm_encoder *encoder);
+
+#ifdef CONFIG_DRM_MSM_DSI
+void mdp5_cmd_encoder_mode_set(struct drm_encoder *encoder,
+			       struct drm_display_mode *mode,
+			       struct drm_display_mode *adjusted_mode);
+void mdp5_cmd_encoder_disable(struct drm_encoder *encoder);
+void mdp5_cmd_encoder_enable(struct drm_encoder *encoder);
+int mdp5_cmd_encoder_set_split_display(struct drm_encoder *encoder,
+				       struct drm_encoder *slave_encoder);
+#else
+static inline void mdp5_cmd_encoder_mode_set(struct drm_encoder *encoder,
+					     struct drm_display_mode *mode,
+					     struct drm_display_mode *adjusted_mode)
+{
+}
+static inline void mdp5_cmd_encoder_disable(struct drm_encoder *encoder)
+{
+}
+static inline void mdp5_cmd_encoder_enable(struct drm_encoder *encoder)
+{
+}
+static inline int mdp5_cmd_encoder_set_split_display(
+	struct drm_encoder *encoder, struct drm_encoder *slave_encoder)
+{
+	return -EINVAL;
+}
+#endif
+
+#endif /* __MDP5_KMS_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_mixer.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_mixer.c
@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2017 The Linux Foundation. All rights reserved.
+ */
+
+#include "mdp5_kms.h"
+
+/*
+ * As of now, there are only 2 combinations possible for source split:
+ *
+ * Left | Right
+ * -----|------
+ *  LM0 | LM1
+ *  LM2 | LM5
+ *
+ */
+static int lm_right_pair[] = { 1, -1, 5, -1, -1, -1 };
+
+static int get_right_pair_idx(struct mdp5_kms *mdp5_kms, int lm)
+{
+	int i;
+	int pair_lm;
+
+	pair_lm = lm_right_pair[lm];
+	if (pair_lm < 0)
+		return -EINVAL;
+
+	for (i = 0; i < mdp5_kms->num_hwmixers; i++) {
+		struct mdp5_hw_mixer *mixer = mdp5_kms->hwmixers[i];
+
+		if (mixer->lm == pair_lm)
+			return mixer->idx;
+	}
+
+	return -1;
+}
+
+int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc,
+		      uint32_t caps, struct mdp5_hw_mixer **mixer,
+		      struct mdp5_hw_mixer **r_mixer)
+{
+	struct msm_drm_private *priv = s->dev->dev_private;
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+	struct mdp5_global_state *global_state = mdp5_get_global_state(s);
+	struct mdp5_hw_mixer_state *new_state;
+	int i;
+
+	if (IS_ERR(global_state))
+		return PTR_ERR(global_state);
+
+	new_state = &global_state->hwmixer;
+
+	for (i = 0; i < mdp5_kms->num_hwmixers; i++) {
+		struct mdp5_hw_mixer *cur = mdp5_kms->hwmixers[i];
+
+		/*
+		 * skip if already in-use by a different CRTC. If there is a
+		 * mixer already assigned to this CRTC, it means this call is
+		 * a request to get an additional right mixer. Assume that the
+		 * existing mixer is the 'left' one, and try to see if we can
+		 * get its corresponding 'right' pair.
+		 */
+		if (new_state->hwmixer_to_crtc[cur->idx] &&
+		    new_state->hwmixer_to_crtc[cur->idx] != crtc)
+			continue;
+
+		/* skip if doesn't support some required caps: */
+		if (caps & ~cur->caps)
+			continue;
+
+		if (r_mixer) {
+			int pair_idx;
+
+			pair_idx = get_right_pair_idx(mdp5_kms, cur->lm);
+			if (pair_idx < 0)
+				return -EINVAL;
+
+			if (new_state->hwmixer_to_crtc[pair_idx])
+				continue;
+
+			*r_mixer = mdp5_kms->hwmixers[pair_idx];
+		}
+
+		/*
+		 * prefer a pair-able LM over an unpairable one. We can
+		 * switch the CRTC from Normal mode to Source Split mode
+		 * without requiring a full modeset if we had already
+		 * assigned this CRTC a pair-able LM.
+		 *
+		 * TODO: There will be assignment sequences which would
+		 * result in the CRTC requiring a full modeset, even
+		 * if we have the LM resources to prevent it. For a platform
+		 * with a few displays, we don't run out of pair-able LMs
+		 * so easily. For now, ignore the possibility of requiring
+		 * a full modeset.
+		 */
+		if (!(*mixer) || cur->caps & MDP_LM_CAP_PAIR)
+			*mixer = cur;
+	}
+
+	if (!(*mixer))
+		return -ENOMEM;
+
+	if (r_mixer && !(*r_mixer))
+		return -ENOMEM;
+
+	DBG("assigning Layer Mixer %d to crtc %s", (*mixer)->lm, crtc->name);
+
+	new_state->hwmixer_to_crtc[(*mixer)->idx] = crtc;
+	if (r_mixer) {
+		DBG("assigning Right Layer Mixer %d to crtc %s", (*r_mixer)->lm,
+		    crtc->name);
+		new_state->hwmixer_to_crtc[(*r_mixer)->idx] = crtc;
+	}
+
+	return 0;
+}
+
+int mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer)
+{
+	struct mdp5_global_state *global_state = mdp5_get_global_state(s);
+	struct mdp5_hw_mixer_state *new_state;
+
+	if (!mixer)
+		return 0;
+
+	if (IS_ERR(global_state))
+		return PTR_ERR(global_state);
+
+	new_state = &global_state->hwmixer;
+
+	if (WARN_ON(!new_state->hwmixer_to_crtc[mixer->idx]))
+		return -EINVAL;
+
+	DBG("%s: release from crtc %s", mixer->name,
+	    new_state->hwmixer_to_crtc[mixer->idx]->name);
+
+	new_state->hwmixer_to_crtc[mixer->idx] = NULL;
+
+	return 0;
+}
+
+static const char * const mixer_names[] = {
+	"LM0", "LM1", "LM2", "LM3", "LM4", "LM5",
+};
+
+struct mdp5_hw_mixer *mdp5_mixer_init(struct drm_device *dev,
+				      const struct mdp5_lm_instance *lm)
+{
+	struct mdp5_hw_mixer *mixer;
+
+	mixer = devm_kzalloc(dev->dev, sizeof(*mixer), GFP_KERNEL);
+	if (!mixer)
+		return ERR_PTR(-ENOMEM);
+
+	mixer->name = mixer_names[lm->id];
+	mixer->lm = lm->id;
+	mixer->caps = lm->caps;
+	mixer->pp = lm->pp;
+	mixer->dspp = lm->dspp;
+	mixer->flush_mask = mdp_ctl_flush_mask_lm(lm->id);
+
+	return mixer;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_mixer.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_mixer.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2017 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __MDP5_LM_H__
+#define __MDP5_LM_H__
+
+/* represents a hw Layer Mixer, one (or more) is dynamically assigned to a crtc */
+struct mdp5_hw_mixer {
+	int idx;
+
+	const char *name;
+
+	int lm;			/* the LM instance # */
+	uint32_t caps;
+	int pp;
+	int dspp;
+
+	uint32_t flush_mask;      /* used to commit LM registers */
+};
+
+/* global atomic state of assignment between CRTCs and Layer Mixers: */
+struct mdp5_hw_mixer_state {
+	struct drm_crtc *hwmixer_to_crtc[8];
+};
+
+struct mdp5_hw_mixer *mdp5_mixer_init(struct drm_device *dev,
+				      const struct mdp5_lm_instance *lm);
+int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc,
+		      uint32_t caps, struct mdp5_hw_mixer **mixer,
+		      struct mdp5_hw_mixer **r_mixer);
+int mdp5_mixer_release(struct drm_atomic_state *s,
+		       struct mdp5_hw_mixer *mixer);
+
+#endif /* __MDP5_LM_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_pipe.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_pipe.c
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2016 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include "mdp5_kms.h"
+
+int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane,
+		     uint32_t caps, uint32_t blkcfg,
+		     struct mdp5_hw_pipe **hwpipe,
+		     struct mdp5_hw_pipe **r_hwpipe)
+{
+	struct msm_drm_private *priv = s->dev->dev_private;
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+	struct mdp5_global_state *new_global_state, *old_global_state;
+	struct mdp5_hw_pipe_state *old_state, *new_state;
+	int i, j;
+
+	new_global_state = mdp5_get_global_state(s);
+	if (IS_ERR(new_global_state))
+		return PTR_ERR(new_global_state);
+
+	/* grab old_state after mdp5_get_global_state(), since now we hold lock: */
+	old_global_state = mdp5_get_existing_global_state(mdp5_kms);
+
+	old_state = &old_global_state->hwpipe;
+	new_state = &new_global_state->hwpipe;
+
+	for (i = 0; i < mdp5_kms->num_hwpipes; i++) {
+		struct mdp5_hw_pipe *cur = mdp5_kms->hwpipes[i];
+
+		/* skip if already in-use.. check both new and old state,
+		 * since we cannot immediately re-use a pipe that is
+		 * released in the current update in some cases:
+		 *  (1) mdp5 can have SMP (non-double-buffered)
+		 *  (2) hw pipe previously assigned to different CRTC
+		 *      (vblanks might not be aligned)
+		 */
+		if (new_state->hwpipe_to_plane[cur->idx] ||
+				old_state->hwpipe_to_plane[cur->idx])
+			continue;
+
+		/* skip if doesn't support some required caps: */
+		if (caps & ~cur->caps)
+			continue;
+
+		/*
+		 * don't assign a cursor pipe to a plane that isn't going to
+		 * be used as a cursor
+		 */
+		if (cur->caps & MDP_PIPE_CAP_CURSOR &&
+				plane->type != DRM_PLANE_TYPE_CURSOR)
+			continue;
+
+		/* possible candidate, take the one with the
+		 * fewest unneeded caps bits set:
+		 */
+		if (!(*hwpipe) || (hweight_long(cur->caps & ~caps) <
+				   hweight_long((*hwpipe)->caps & ~caps))) {
+			bool r_found = false;
+
+			if (r_hwpipe) {
+				for (j = i + 1; j < mdp5_kms->num_hwpipes;
+				     j++) {
+					struct mdp5_hw_pipe *r_cur =
+							mdp5_kms->hwpipes[j];
+
+					/* reject different types of hwpipes */
+					if (r_cur->caps != cur->caps)
+						continue;
+
+					/* respect priority, eg. VIG0 > VIG1 */
+					if (cur->pipe > r_cur->pipe)
+						continue;
+
+					*r_hwpipe = r_cur;
+					r_found = true;
+					break;
+				}
+			}
+
+			if (!r_hwpipe || r_found)
+				*hwpipe = cur;
+		}
+	}
+
+	if (!(*hwpipe))
+		return -ENOMEM;
+
+	if (r_hwpipe && !(*r_hwpipe))
+		return -ENOMEM;
+
+	if (mdp5_kms->smp) {
+		int ret;
+
+		/* We don't support SMP and 2 hwpipes/plane together */
+		WARN_ON(r_hwpipe);
+
+		DBG("%s: alloc SMP blocks", (*hwpipe)->name);
+		ret = mdp5_smp_assign(mdp5_kms->smp, &new_global_state->smp,
+				(*hwpipe)->pipe, blkcfg);
+		if (ret)
+			return -ENOMEM;
+
+		(*hwpipe)->blkcfg = blkcfg;
+	}
+
+	DBG("%s: assign to plane %s for caps %x",
+			(*hwpipe)->name, plane->name, caps);
+	new_state->hwpipe_to_plane[(*hwpipe)->idx] = plane;
+
+	if (r_hwpipe) {
+		DBG("%s: assign to right of plane %s for caps %x",
+		    (*r_hwpipe)->name, plane->name, caps);
+		new_state->hwpipe_to_plane[(*r_hwpipe)->idx] = plane;
+	}
+
+	return 0;
+}
+
+int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe)
+{
+	struct msm_drm_private *priv = s->dev->dev_private;
+	struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+	struct mdp5_global_state *state;
+	struct mdp5_hw_pipe_state *new_state;
+
+	if (!hwpipe)
+		return 0;
+
+	state = mdp5_get_global_state(s);
+	if (IS_ERR(state))
+		return PTR_ERR(state);
+
+	new_state = &state->hwpipe;
+
+	if (WARN_ON(!new_state->hwpipe_to_plane[hwpipe->idx]))
+		return -EINVAL;
+
+	DBG("%s: release from plane %s", hwpipe->name,
+		new_state->hwpipe_to_plane[hwpipe->idx]->name);
+
+	if (mdp5_kms->smp) {
+		DBG("%s: free SMP blocks", hwpipe->name);
+		mdp5_smp_release(mdp5_kms->smp, &state->smp, hwpipe->pipe);
+	}
+
+	new_state->hwpipe_to_plane[hwpipe->idx] = NULL;
+
+	return 0;
+}
+
+struct mdp5_hw_pipe *mdp5_pipe_init(struct drm_device *dev,
+		enum mdp5_pipe pipe,
+		uint32_t reg_offset, uint32_t caps)
+{
+	struct mdp5_hw_pipe *hwpipe;
+
+	hwpipe = devm_kzalloc(dev->dev, sizeof(*hwpipe), GFP_KERNEL);
+	if (!hwpipe)
+		return ERR_PTR(-ENOMEM);
+
+	hwpipe->name = pipe2name(pipe);
+	hwpipe->pipe = pipe;
+	hwpipe->reg_offset = reg_offset;
+	hwpipe->caps = caps;
+	hwpipe->flush_mask = mdp_ctl_flush_mask_pipe(pipe);
+
+	return hwpipe;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_pipe.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_pipe.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2016 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MDP5_PIPE_H__
+#define __MDP5_PIPE_H__
+
+/* TODO: Add SSPP_MAX in mdp5.xml.h */
+#define SSPP_MAX	(SSPP_CURSOR1 + 1)
+
+/* represents a hw pipe, which is dynamically assigned to a plane */
+struct mdp5_hw_pipe {
+	int idx;
+
+	const char *name;
+	enum mdp5_pipe pipe;
+
+	uint32_t reg_offset;
+	uint32_t caps;
+
+	uint32_t flush_mask;      /* used to commit pipe registers */
+
+	/* number of smp blocks per plane, ie:
+	 *   nblks_y | (nblks_u << 8) | (nblks_v << 16)
+	 */
+	uint32_t blkcfg;
+};
+
+/* global atomic state of assignment between pipes and planes: */
+struct mdp5_hw_pipe_state {
+	struct drm_plane *hwpipe_to_plane[SSPP_MAX];
+};
+
+int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane,
+		     uint32_t caps, uint32_t blkcfg,
+		     struct mdp5_hw_pipe **hwpipe,
+		     struct mdp5_hw_pipe **r_hwpipe);
+int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe);
+
+struct mdp5_hw_pipe *mdp5_pipe_init(struct drm_device *dev,
+		enum mdp5_pipe pipe,
+		uint32_t reg_offset, uint32_t caps);
+
+#endif /* __MDP5_PIPE_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_plane.c
@@ -0,0 +1,1048 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_blend.h>
+#include <drm/drm_damage_helper.h>
+#include <drm/drm_fourcc.h>
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_gem_atomic_helper.h>
+#include <drm/drm_print.h>
+
+#include "mdp5_kms.h"
+
+struct mdp5_plane {
+	struct drm_plane base;
+
+	uint32_t nformats;
+	uint32_t formats[32];
+};
+#define to_mdp5_plane(x) container_of(x, struct mdp5_plane, base)
+
+static int mdp5_plane_mode_set(struct drm_plane *plane,
+		struct drm_crtc *crtc, struct drm_framebuffer *fb,
+		struct drm_rect *src, struct drm_rect *dest);
+
+static struct mdp5_kms *get_kms(struct drm_plane *plane)
+{
+	struct msm_drm_private *priv = plane->dev->dev_private;
+	return to_mdp5_kms(to_mdp_kms(priv->kms));
+}
+
+static bool plane_enabled(struct drm_plane_state *state)
+{
+	return state->visible;
+}
+
+static void mdp5_plane_destroy(struct drm_plane *plane)
+{
+	struct mdp5_plane *mdp5_plane = to_mdp5_plane(plane);
+
+	drm_plane_cleanup(plane);
+
+	kfree(mdp5_plane);
+}
+
+/* helper to install properties which are common to planes and crtcs */
+static void mdp5_plane_install_properties(struct drm_plane *plane,
+		struct drm_mode_object *obj)
+{
+	unsigned int zpos;
+
+	drm_plane_create_rotation_property(plane,
+					   DRM_MODE_ROTATE_0,
+					   DRM_MODE_ROTATE_0 |
+					   DRM_MODE_ROTATE_180 |
+					   DRM_MODE_REFLECT_X |
+					   DRM_MODE_REFLECT_Y);
+	drm_plane_create_alpha_property(plane);
+	drm_plane_create_blend_mode_property(plane,
+			BIT(DRM_MODE_BLEND_PIXEL_NONE) |
+			BIT(DRM_MODE_BLEND_PREMULTI) |
+			BIT(DRM_MODE_BLEND_COVERAGE));
+
+	if (plane->type == DRM_PLANE_TYPE_PRIMARY)
+		zpos = STAGE_BASE;
+	else
+		zpos = STAGE0 + drm_plane_index(plane);
+	drm_plane_create_zpos_property(plane, zpos, 1, 255);
+}
+
+static void
+mdp5_plane_atomic_print_state(struct drm_printer *p,
+		const struct drm_plane_state *state)
+{
+	struct mdp5_plane_state *pstate = to_mdp5_plane_state(state);
+	struct mdp5_kms *mdp5_kms = get_kms(state->plane);
+
+	drm_printf(p, "\thwpipe=%s\n", pstate->hwpipe ?
+			pstate->hwpipe->name : "(null)");
+	if (mdp5_kms->caps & MDP_CAP_SRC_SPLIT)
+		drm_printf(p, "\tright-hwpipe=%s\n",
+			   pstate->r_hwpipe ? pstate->r_hwpipe->name :
+					      "(null)");
+	drm_printf(p, "\tblend_mode=%u\n", pstate->base.pixel_blend_mode);
+	drm_printf(p, "\tzpos=%u\n", pstate->base.zpos);
+	drm_printf(p, "\tnormalized_zpos=%u\n", pstate->base.normalized_zpos);
+	drm_printf(p, "\talpha=%u\n", pstate->base.alpha);
+	drm_printf(p, "\tstage=%s\n", stage2name(pstate->stage));
+}
+
+static void mdp5_plane_reset(struct drm_plane *plane)
+{
+	struct mdp5_plane_state *mdp5_state;
+
+	if (plane->state)
+		__drm_atomic_helper_plane_destroy_state(plane->state);
+
+	kfree(to_mdp5_plane_state(plane->state));
+	plane->state = NULL;
+	mdp5_state = kzalloc(sizeof(*mdp5_state), GFP_KERNEL);
+	if (!mdp5_state)
+		return;
+	__drm_atomic_helper_plane_reset(plane, &mdp5_state->base);
+}
+
+static struct drm_plane_state *
+mdp5_plane_duplicate_state(struct drm_plane *plane)
+{
+	struct mdp5_plane_state *mdp5_state;
+
+	if (WARN_ON(!plane->state))
+		return NULL;
+
+	mdp5_state = kmemdup(to_mdp5_plane_state(plane->state),
+			sizeof(*mdp5_state), GFP_KERNEL);
+	if (!mdp5_state)
+		return NULL;
+
+	__drm_atomic_helper_plane_duplicate_state(plane, &mdp5_state->base);
+
+	return &mdp5_state->base;
+}
+
+static void mdp5_plane_destroy_state(struct drm_plane *plane,
+		struct drm_plane_state *state)
+{
+	struct mdp5_plane_state *pstate = to_mdp5_plane_state(state);
+
+	__drm_atomic_helper_plane_destroy_state(state);
+
+	kfree(pstate);
+}
+
+static const struct drm_plane_funcs mdp5_plane_funcs = {
+		.update_plane = drm_atomic_helper_update_plane,
+		.disable_plane = drm_atomic_helper_disable_plane,
+		.destroy = mdp5_plane_destroy,
+		.reset = mdp5_plane_reset,
+		.atomic_duplicate_state = mdp5_plane_duplicate_state,
+		.atomic_destroy_state = mdp5_plane_destroy_state,
+		.atomic_print_state = mdp5_plane_atomic_print_state,
+};
+
+static int mdp5_plane_prepare_fb(struct drm_plane *plane,
+				 struct drm_plane_state *new_state)
+{
+	struct msm_drm_private *priv = plane->dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+	bool needs_dirtyfb = to_mdp5_plane_state(new_state)->needs_dirtyfb;
+
+	if (!new_state->fb)
+		return 0;
+
+	drm_gem_plane_helper_prepare_fb(plane, new_state);
+
+	return msm_framebuffer_prepare(new_state->fb, kms->aspace, needs_dirtyfb);
+}
+
+static void mdp5_plane_cleanup_fb(struct drm_plane *plane,
+				  struct drm_plane_state *old_state)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(plane);
+	struct msm_kms *kms = &mdp5_kms->base.base;
+	struct drm_framebuffer *fb = old_state->fb;
+	bool needed_dirtyfb = to_mdp5_plane_state(old_state)->needs_dirtyfb;
+
+	if (!fb)
+		return;
+
+	DBG("%s: cleanup: FB[%u]", plane->name, fb->base.id);
+	msm_framebuffer_cleanup(fb, kms->aspace, needed_dirtyfb);
+}
+
+static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state,
+					      struct drm_plane_state *state)
+{
+	struct mdp5_plane_state *mdp5_state = to_mdp5_plane_state(state);
+	struct drm_plane *plane = state->plane;
+	struct drm_plane_state *old_state = plane->state;
+	struct mdp5_cfg *config = mdp5_cfg_get_config(get_kms(plane)->cfg);
+	bool new_hwpipe = false;
+	bool need_right_hwpipe = false;
+	uint32_t max_width, max_height;
+	bool out_of_bounds = false;
+	uint32_t caps = 0;
+	int min_scale, max_scale;
+	int ret;
+
+	DBG("%s: check (%d -> %d)", plane->name,
+			plane_enabled(old_state), plane_enabled(state));
+
+	max_width = config->hw->lm.max_width << 16;
+	max_height = config->hw->lm.max_height << 16;
+
+	/* Make sure source dimensions are within bounds. */
+	if (state->src_h > max_height)
+		out_of_bounds = true;
+
+	if (state->src_w > max_width) {
+		/* If source split is supported, we can go up to 2x
+		 * the max LM width, but we'd need to stage another
+		 * hwpipe to the right LM. So, the drm_plane would
+		 * consist of 2 hwpipes.
+		 */
+		if (config->hw->mdp.caps & MDP_CAP_SRC_SPLIT &&
+		    (state->src_w <= 2 * max_width))
+			need_right_hwpipe = true;
+		else
+			out_of_bounds = true;
+	}
+
+	if (out_of_bounds) {
+		struct drm_rect src = drm_plane_state_src(state);
+		DBG("Invalid source size "DRM_RECT_FP_FMT,
+				DRM_RECT_FP_ARG(&src));
+		return -ERANGE;
+	}
+
+	min_scale = FRAC_16_16(1, 8);
+	max_scale = FRAC_16_16(8, 1);
+
+	ret = drm_atomic_helper_check_plane_state(state, crtc_state,
+						  min_scale, max_scale,
+						  true, true);
+	if (ret)
+		return ret;
+
+	if (plane_enabled(state)) {
+		unsigned int rotation;
+		const struct mdp_format *format;
+		struct mdp5_kms *mdp5_kms = get_kms(plane);
+		uint32_t blkcfg = 0;
+
+		format = to_mdp_format(msm_framebuffer_format(state->fb));
+		if (MDP_FORMAT_IS_YUV(format))
+			caps |= MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_CSC;
+
+		if (((state->src_w >> 16) != state->crtc_w) ||
+				((state->src_h >> 16) != state->crtc_h))
+			caps |= MDP_PIPE_CAP_SCALE;
+
+		rotation = drm_rotation_simplify(state->rotation,
+						 DRM_MODE_ROTATE_0 |
+						 DRM_MODE_REFLECT_X |
+						 DRM_MODE_REFLECT_Y);
+
+		if (rotation & DRM_MODE_REFLECT_X)
+			caps |= MDP_PIPE_CAP_HFLIP;
+
+		if (rotation & DRM_MODE_REFLECT_Y)
+			caps |= MDP_PIPE_CAP_VFLIP;
+
+		if (plane->type == DRM_PLANE_TYPE_CURSOR)
+			caps |= MDP_PIPE_CAP_CURSOR;
+
+		/* (re)allocate hw pipe if we don't have one or caps-mismatch: */
+		if (!mdp5_state->hwpipe || (caps & ~mdp5_state->hwpipe->caps))
+			new_hwpipe = true;
+
+		/*
+		 * (re)allocte hw pipe if we're either requesting for 2 hw pipes
+		 * or we're switching from 2 hw pipes to 1 hw pipe because the
+		 * new src_w can be supported by 1 hw pipe itself.
+		 */
+		if ((need_right_hwpipe && !mdp5_state->r_hwpipe) ||
+		    (!need_right_hwpipe && mdp5_state->r_hwpipe))
+			new_hwpipe = true;
+
+		if (mdp5_kms->smp) {
+			const struct mdp_format *format =
+				to_mdp_format(msm_framebuffer_format(state->fb));
+
+			blkcfg = mdp5_smp_calculate(mdp5_kms->smp, format,
+					state->src_w >> 16, false);
+
+			if (mdp5_state->hwpipe && (mdp5_state->hwpipe->blkcfg != blkcfg))
+				new_hwpipe = true;
+		}
+
+		/* (re)assign hwpipe if needed, otherwise keep old one: */
+		if (new_hwpipe) {
+			/* TODO maybe we want to re-assign hwpipe sometimes
+			 * in cases when we no-longer need some caps to make
+			 * it available for other planes?
+			 */
+			struct mdp5_hw_pipe *old_hwpipe = mdp5_state->hwpipe;
+			struct mdp5_hw_pipe *old_right_hwpipe =
+							  mdp5_state->r_hwpipe;
+			struct mdp5_hw_pipe *new_hwpipe = NULL;
+			struct mdp5_hw_pipe *new_right_hwpipe = NULL;
+
+			ret = mdp5_pipe_assign(state->state, plane, caps,
+					       blkcfg, &new_hwpipe,
+					       need_right_hwpipe ?
+					       &new_right_hwpipe : NULL);
+			if (ret) {
+				DBG("%s: failed to assign hwpipe(s)!",
+				    plane->name);
+				return ret;
+			}
+
+			mdp5_state->hwpipe = new_hwpipe;
+			if (need_right_hwpipe)
+				mdp5_state->r_hwpipe = new_right_hwpipe;
+			else
+				/*
+				 * set it to NULL so that the driver knows we
+				 * don't have a right hwpipe when committing a
+				 * new state
+				 */
+				mdp5_state->r_hwpipe = NULL;
+
+
+			ret = mdp5_pipe_release(state->state, old_hwpipe);
+			if (ret)
+				return ret;
+
+			ret = mdp5_pipe_release(state->state, old_right_hwpipe);
+			if (ret)
+				return ret;
+
+		}
+	} else {
+		ret = mdp5_pipe_release(state->state, mdp5_state->hwpipe);
+		if (ret)
+			return ret;
+
+		ret = mdp5_pipe_release(state->state, mdp5_state->r_hwpipe);
+		if (ret)
+			return ret;
+
+		mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL;
+	}
+
+	return 0;
+}
+
+static int mdp5_plane_atomic_check(struct drm_plane *plane,
+				   struct drm_atomic_state *state)
+{
+	struct drm_plane_state *old_plane_state = drm_atomic_get_old_plane_state(state,
+										 plane);
+	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
+										 plane);
+	struct drm_crtc *crtc;
+	struct drm_crtc_state *crtc_state;
+
+	crtc = new_plane_state->crtc ? new_plane_state->crtc : old_plane_state->crtc;
+	if (!crtc)
+		return 0;
+
+	crtc_state = drm_atomic_get_existing_crtc_state(state,
+							crtc);
+	if (WARN_ON(!crtc_state))
+		return -EINVAL;
+
+	return mdp5_plane_atomic_check_with_state(crtc_state, new_plane_state);
+}
+
+static void mdp5_plane_atomic_update(struct drm_plane *plane,
+				     struct drm_atomic_state *state)
+{
+	struct drm_plane_state *new_state = drm_atomic_get_new_plane_state(state,
+									   plane);
+
+	DBG("%s: update", plane->name);
+
+	if (plane_enabled(new_state)) {
+		int ret;
+
+		ret = mdp5_plane_mode_set(plane,
+				new_state->crtc, new_state->fb,
+				&new_state->src, &new_state->dst);
+		/* atomic_check should have ensured that this doesn't fail */
+		WARN_ON(ret < 0);
+	}
+}
+
+static int mdp5_plane_atomic_async_check(struct drm_plane *plane,
+					 struct drm_atomic_state *state)
+{
+	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
+										 plane);
+	struct mdp5_plane_state *mdp5_state = to_mdp5_plane_state(new_plane_state);
+	struct drm_crtc_state *crtc_state;
+	int min_scale, max_scale;
+	int ret;
+
+	crtc_state = drm_atomic_get_existing_crtc_state(state,
+							new_plane_state->crtc);
+	if (WARN_ON(!crtc_state))
+		return -EINVAL;
+
+	if (!crtc_state->active)
+		return -EINVAL;
+
+	/* don't use fast path if we don't have a hwpipe allocated yet */
+	if (!mdp5_state->hwpipe)
+		return -EINVAL;
+
+	/* only allow changing of position(crtc x/y or src x/y) in fast path */
+	if (plane->state->crtc != new_plane_state->crtc ||
+	    plane->state->src_w != new_plane_state->src_w ||
+	    plane->state->src_h != new_plane_state->src_h ||
+	    plane->state->crtc_w != new_plane_state->crtc_w ||
+	    plane->state->crtc_h != new_plane_state->crtc_h ||
+	    !plane->state->fb ||
+	    plane->state->fb != new_plane_state->fb)
+		return -EINVAL;
+
+	min_scale = FRAC_16_16(1, 8);
+	max_scale = FRAC_16_16(8, 1);
+
+	ret = drm_atomic_helper_check_plane_state(new_plane_state, crtc_state,
+						  min_scale, max_scale,
+						  true, true);
+	if (ret)
+		return ret;
+
+	/*
+	 * if the visibility of the plane changes (i.e, if the cursor is
+	 * clipped out completely, we can't take the async path because
+	 * we need to stage/unstage the plane from the Layer Mixer(s). We
+	 * also assign/unassign the hwpipe(s) tied to the plane. We avoid
+	 * taking the fast path for both these reasons.
+	 */
+	if (new_plane_state->visible != plane->state->visible)
+		return -EINVAL;
+
+	return 0;
+}
+
+static void mdp5_plane_atomic_async_update(struct drm_plane *plane,
+					   struct drm_atomic_state *state)
+{
+	struct drm_plane_state *new_state = drm_atomic_get_new_plane_state(state,
+									   plane);
+	struct drm_framebuffer *old_fb = plane->state->fb;
+
+	plane->state->src_x = new_state->src_x;
+	plane->state->src_y = new_state->src_y;
+	plane->state->crtc_x = new_state->crtc_x;
+	plane->state->crtc_y = new_state->crtc_y;
+
+	if (plane_enabled(new_state)) {
+		struct mdp5_ctl *ctl;
+		struct mdp5_pipeline *pipeline =
+					mdp5_crtc_get_pipeline(new_state->crtc);
+		int ret;
+
+		ret = mdp5_plane_mode_set(plane, new_state->crtc, new_state->fb,
+				&new_state->src, &new_state->dst);
+		WARN_ON(ret < 0);
+
+		ctl = mdp5_crtc_get_ctl(new_state->crtc);
+
+		mdp5_ctl_commit(ctl, pipeline, mdp5_plane_get_flush(plane), true);
+	}
+
+	*to_mdp5_plane_state(plane->state) =
+		*to_mdp5_plane_state(new_state);
+
+	new_state->fb = old_fb;
+}
+
+static const struct drm_plane_helper_funcs mdp5_plane_helper_funcs = {
+		.prepare_fb = mdp5_plane_prepare_fb,
+		.cleanup_fb = mdp5_plane_cleanup_fb,
+		.atomic_check = mdp5_plane_atomic_check,
+		.atomic_update = mdp5_plane_atomic_update,
+		.atomic_async_check = mdp5_plane_atomic_async_check,
+		.atomic_async_update = mdp5_plane_atomic_async_update,
+};
+
+static void set_scanout_locked(struct mdp5_kms *mdp5_kms,
+			       enum mdp5_pipe pipe,
+			       struct drm_framebuffer *fb)
+{
+	struct msm_kms *kms = &mdp5_kms->base.base;
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC_STRIDE_A(pipe),
+			MDP5_PIPE_SRC_STRIDE_A_P0(fb->pitches[0]) |
+			MDP5_PIPE_SRC_STRIDE_A_P1(fb->pitches[1]));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC_STRIDE_B(pipe),
+			MDP5_PIPE_SRC_STRIDE_B_P2(fb->pitches[2]) |
+			MDP5_PIPE_SRC_STRIDE_B_P3(fb->pitches[3]));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC0_ADDR(pipe),
+			msm_framebuffer_iova(fb, kms->aspace, 0));
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC1_ADDR(pipe),
+			msm_framebuffer_iova(fb, kms->aspace, 1));
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC2_ADDR(pipe),
+			msm_framebuffer_iova(fb, kms->aspace, 2));
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC3_ADDR(pipe),
+			msm_framebuffer_iova(fb, kms->aspace, 3));
+}
+
+/* Note: mdp5_plane->pipe_lock must be locked */
+static void csc_disable(struct mdp5_kms *mdp5_kms, enum mdp5_pipe pipe)
+{
+	uint32_t value = mdp5_read(mdp5_kms, REG_MDP5_PIPE_OP_MODE(pipe)) &
+			 ~MDP5_PIPE_OP_MODE_CSC_1_EN;
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_OP_MODE(pipe), value);
+}
+
+/* Note: mdp5_plane->pipe_lock must be locked */
+static void csc_enable(struct mdp5_kms *mdp5_kms, enum mdp5_pipe pipe,
+		struct csc_cfg *csc)
+{
+	uint32_t  i, mode = 0; /* RGB, no CSC */
+	uint32_t *matrix;
+
+	if (unlikely(!csc))
+		return;
+
+	if ((csc->type == CSC_YUV2RGB) || (CSC_YUV2YUV == csc->type))
+		mode |= MDP5_PIPE_OP_MODE_CSC_SRC_DATA_FORMAT(DATA_FORMAT_YUV);
+	if ((csc->type == CSC_RGB2YUV) || (CSC_YUV2YUV == csc->type))
+		mode |= MDP5_PIPE_OP_MODE_CSC_DST_DATA_FORMAT(DATA_FORMAT_YUV);
+	mode |= MDP5_PIPE_OP_MODE_CSC_1_EN;
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_OP_MODE(pipe), mode);
+
+	matrix = csc->matrix;
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_CSC_1_MATRIX_COEFF_0(pipe),
+			MDP5_PIPE_CSC_1_MATRIX_COEFF_0_COEFF_11(matrix[0]) |
+			MDP5_PIPE_CSC_1_MATRIX_COEFF_0_COEFF_12(matrix[1]));
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_CSC_1_MATRIX_COEFF_1(pipe),
+			MDP5_PIPE_CSC_1_MATRIX_COEFF_1_COEFF_13(matrix[2]) |
+			MDP5_PIPE_CSC_1_MATRIX_COEFF_1_COEFF_21(matrix[3]));
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_CSC_1_MATRIX_COEFF_2(pipe),
+			MDP5_PIPE_CSC_1_MATRIX_COEFF_2_COEFF_22(matrix[4]) |
+			MDP5_PIPE_CSC_1_MATRIX_COEFF_2_COEFF_23(matrix[5]));
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_CSC_1_MATRIX_COEFF_3(pipe),
+			MDP5_PIPE_CSC_1_MATRIX_COEFF_3_COEFF_31(matrix[6]) |
+			MDP5_PIPE_CSC_1_MATRIX_COEFF_3_COEFF_32(matrix[7]));
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_CSC_1_MATRIX_COEFF_4(pipe),
+			MDP5_PIPE_CSC_1_MATRIX_COEFF_4_COEFF_33(matrix[8]));
+
+	for (i = 0; i < ARRAY_SIZE(csc->pre_bias); i++) {
+		uint32_t *pre_clamp = csc->pre_clamp;
+		uint32_t *post_clamp = csc->post_clamp;
+
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_CSC_1_PRE_CLAMP(pipe, i),
+			MDP5_PIPE_CSC_1_PRE_CLAMP_REG_HIGH(pre_clamp[2*i+1]) |
+			MDP5_PIPE_CSC_1_PRE_CLAMP_REG_LOW(pre_clamp[2*i]));
+
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_CSC_1_POST_CLAMP(pipe, i),
+			MDP5_PIPE_CSC_1_POST_CLAMP_REG_HIGH(post_clamp[2*i+1]) |
+			MDP5_PIPE_CSC_1_POST_CLAMP_REG_LOW(post_clamp[2*i]));
+
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_CSC_1_PRE_BIAS(pipe, i),
+			MDP5_PIPE_CSC_1_PRE_BIAS_REG_VALUE(csc->pre_bias[i]));
+
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_CSC_1_POST_BIAS(pipe, i),
+			MDP5_PIPE_CSC_1_POST_BIAS_REG_VALUE(csc->post_bias[i]));
+	}
+}
+
+#define PHASE_STEP_SHIFT	21
+#define DOWN_SCALE_RATIO_MAX	32	/* 2^(26-21) */
+
+static int calc_phase_step(uint32_t src, uint32_t dst, uint32_t *out_phase)
+{
+	uint32_t unit;
+
+	if (src == 0 || dst == 0)
+		return -EINVAL;
+
+	/*
+	 * PHASE_STEP_X/Y is coded on 26 bits (25:0),
+	 * where 2^21 represents the unity "1" in fixed-point hardware design.
+	 * This leaves 5 bits for the integer part (downscale case):
+	 *	-> maximum downscale ratio = 0b1_1111 = 31
+	 */
+	if (src > (dst * DOWN_SCALE_RATIO_MAX))
+		return -EOVERFLOW;
+
+	unit = 1 << PHASE_STEP_SHIFT;
+	*out_phase = mult_frac(unit, src, dst);
+
+	return 0;
+}
+
+static int calc_scalex_steps(struct drm_plane *plane,
+		uint32_t pixel_format, uint32_t src, uint32_t dest,
+		uint32_t phasex_steps[COMP_MAX])
+{
+	const struct drm_format_info *info = drm_format_info(pixel_format);
+	struct mdp5_kms *mdp5_kms = get_kms(plane);
+	struct device *dev = mdp5_kms->dev->dev;
+	uint32_t phasex_step;
+	int ret;
+
+	ret = calc_phase_step(src, dest, &phasex_step);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "X scaling (%d->%d) failed: %d\n", src, dest, ret);
+		return ret;
+	}
+
+	phasex_steps[COMP_0]   = phasex_step;
+	phasex_steps[COMP_3]   = phasex_step;
+	phasex_steps[COMP_1_2] = phasex_step / info->hsub;
+
+	return 0;
+}
+
+static int calc_scaley_steps(struct drm_plane *plane,
+		uint32_t pixel_format, uint32_t src, uint32_t dest,
+		uint32_t phasey_steps[COMP_MAX])
+{
+	const struct drm_format_info *info = drm_format_info(pixel_format);
+	struct mdp5_kms *mdp5_kms = get_kms(plane);
+	struct device *dev = mdp5_kms->dev->dev;
+	uint32_t phasey_step;
+	int ret;
+
+	ret = calc_phase_step(src, dest, &phasey_step);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "Y scaling (%d->%d) failed: %d\n", src, dest, ret);
+		return ret;
+	}
+
+	phasey_steps[COMP_0]   = phasey_step;
+	phasey_steps[COMP_3]   = phasey_step;
+	phasey_steps[COMP_1_2] = phasey_step / info->vsub;
+
+	return 0;
+}
+
+static uint32_t get_scale_config(const struct mdp_format *format,
+		uint32_t src, uint32_t dst, bool horz)
+{
+	const struct drm_format_info *info = drm_format_info(format->base.pixel_format);
+	bool scaling = format->is_yuv ? true : (src != dst);
+	uint32_t sub;
+	uint32_t ya_filter, uv_filter;
+	bool yuv = format->is_yuv;
+
+	if (!scaling)
+		return 0;
+
+	if (yuv) {
+		sub = horz ? info->hsub : info->vsub;
+		uv_filter = ((src / sub) <= dst) ?
+				   SCALE_FILTER_BIL : SCALE_FILTER_PCMN;
+	}
+	ya_filter = (src <= dst) ? SCALE_FILTER_BIL : SCALE_FILTER_PCMN;
+
+	if (horz)
+		return  MDP5_PIPE_SCALE_CONFIG_SCALEX_EN |
+			MDP5_PIPE_SCALE_CONFIG_SCALEX_FILTER_COMP_0(ya_filter) |
+			MDP5_PIPE_SCALE_CONFIG_SCALEX_FILTER_COMP_3(ya_filter) |
+			COND(yuv, MDP5_PIPE_SCALE_CONFIG_SCALEX_FILTER_COMP_1_2(uv_filter));
+	else
+		return  MDP5_PIPE_SCALE_CONFIG_SCALEY_EN |
+			MDP5_PIPE_SCALE_CONFIG_SCALEY_FILTER_COMP_0(ya_filter) |
+			MDP5_PIPE_SCALE_CONFIG_SCALEY_FILTER_COMP_3(ya_filter) |
+			COND(yuv, MDP5_PIPE_SCALE_CONFIG_SCALEY_FILTER_COMP_1_2(uv_filter));
+}
+
+static void calc_pixel_ext(const struct mdp_format *format,
+		uint32_t src, uint32_t dst, uint32_t phase_step[2],
+		int pix_ext_edge1[COMP_MAX], int pix_ext_edge2[COMP_MAX],
+		bool horz)
+{
+	bool scaling = format->is_yuv ? true : (src != dst);
+	int i;
+
+	/*
+	 * Note:
+	 * We assume here that:
+	 *     1. PCMN filter is used for downscale
+	 *     2. bilinear filter is used for upscale
+	 *     3. we are in a single pipe configuration
+	 */
+
+	for (i = 0; i < COMP_MAX; i++) {
+		pix_ext_edge1[i] = 0;
+		pix_ext_edge2[i] = scaling ? 1 : 0;
+	}
+}
+
+static void mdp5_write_pixel_ext(struct mdp5_kms *mdp5_kms, enum mdp5_pipe pipe,
+	const struct mdp_format *format,
+	uint32_t src_w, int pe_left[COMP_MAX], int pe_right[COMP_MAX],
+	uint32_t src_h, int pe_top[COMP_MAX], int pe_bottom[COMP_MAX])
+{
+	const struct drm_format_info *info = drm_format_info(format->base.pixel_format);
+	uint32_t lr, tb, req;
+	int i;
+
+	for (i = 0; i < COMP_MAX; i++) {
+		uint32_t roi_w = src_w;
+		uint32_t roi_h = src_h;
+
+		if (format->is_yuv && i == COMP_1_2) {
+			roi_w /= info->hsub;
+			roi_h /= info->vsub;
+		}
+
+		lr  = (pe_left[i] >= 0) ?
+			MDP5_PIPE_SW_PIX_EXT_LR_LEFT_RPT(pe_left[i]) :
+			MDP5_PIPE_SW_PIX_EXT_LR_LEFT_OVF(pe_left[i]);
+
+		lr |= (pe_right[i] >= 0) ?
+			MDP5_PIPE_SW_PIX_EXT_LR_RIGHT_RPT(pe_right[i]) :
+			MDP5_PIPE_SW_PIX_EXT_LR_RIGHT_OVF(pe_right[i]);
+
+		tb  = (pe_top[i] >= 0) ?
+			MDP5_PIPE_SW_PIX_EXT_TB_TOP_RPT(pe_top[i]) :
+			MDP5_PIPE_SW_PIX_EXT_TB_TOP_OVF(pe_top[i]);
+
+		tb |= (pe_bottom[i] >= 0) ?
+			MDP5_PIPE_SW_PIX_EXT_TB_BOTTOM_RPT(pe_bottom[i]) :
+			MDP5_PIPE_SW_PIX_EXT_TB_BOTTOM_OVF(pe_bottom[i]);
+
+		req  = MDP5_PIPE_SW_PIX_EXT_REQ_PIXELS_LEFT_RIGHT(roi_w +
+				pe_left[i] + pe_right[i]);
+
+		req |= MDP5_PIPE_SW_PIX_EXT_REQ_PIXELS_TOP_BOTTOM(roi_h +
+				pe_top[i] + pe_bottom[i]);
+
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_SW_PIX_EXT_LR(pipe, i), lr);
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_SW_PIX_EXT_TB(pipe, i), tb);
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_SW_PIX_EXT_REQ_PIXELS(pipe, i), req);
+
+		DBG("comp-%d (L/R): rpt=%d/%d, ovf=%d/%d, req=%d", i,
+			FIELD(lr,  MDP5_PIPE_SW_PIX_EXT_LR_LEFT_RPT),
+			FIELD(lr,  MDP5_PIPE_SW_PIX_EXT_LR_RIGHT_RPT),
+			FIELD(lr,  MDP5_PIPE_SW_PIX_EXT_LR_LEFT_OVF),
+			FIELD(lr,  MDP5_PIPE_SW_PIX_EXT_LR_RIGHT_OVF),
+			FIELD(req, MDP5_PIPE_SW_PIX_EXT_REQ_PIXELS_LEFT_RIGHT));
+
+		DBG("comp-%d (T/B): rpt=%d/%d, ovf=%d/%d, req=%d", i,
+			FIELD(tb,  MDP5_PIPE_SW_PIX_EXT_TB_TOP_RPT),
+			FIELD(tb,  MDP5_PIPE_SW_PIX_EXT_TB_BOTTOM_RPT),
+			FIELD(tb,  MDP5_PIPE_SW_PIX_EXT_TB_TOP_OVF),
+			FIELD(tb,  MDP5_PIPE_SW_PIX_EXT_TB_BOTTOM_OVF),
+			FIELD(req, MDP5_PIPE_SW_PIX_EXT_REQ_PIXELS_TOP_BOTTOM));
+	}
+}
+
+struct pixel_ext {
+	int left[COMP_MAX];
+	int right[COMP_MAX];
+	int top[COMP_MAX];
+	int bottom[COMP_MAX];
+};
+
+struct phase_step {
+	u32 x[COMP_MAX];
+	u32 y[COMP_MAX];
+};
+
+static void mdp5_hwpipe_mode_set(struct mdp5_kms *mdp5_kms,
+				 struct mdp5_hw_pipe *hwpipe,
+				 struct drm_framebuffer *fb,
+				 struct phase_step *step,
+				 struct pixel_ext *pe,
+				 u32 scale_config, u32 hdecm, u32 vdecm,
+				 bool hflip, bool vflip,
+				 int crtc_x, int crtc_y,
+				 unsigned int crtc_w, unsigned int crtc_h,
+				 u32 src_img_w, u32 src_img_h,
+				 u32 src_x, u32 src_y,
+				 u32 src_w, u32 src_h)
+{
+	enum mdp5_pipe pipe = hwpipe->pipe;
+	bool has_pe = hwpipe->caps & MDP_PIPE_CAP_SW_PIX_EXT;
+	const struct mdp_format *format =
+			to_mdp_format(msm_framebuffer_format(fb));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC_IMG_SIZE(pipe),
+			MDP5_PIPE_SRC_IMG_SIZE_WIDTH(src_img_w) |
+			MDP5_PIPE_SRC_IMG_SIZE_HEIGHT(src_img_h));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC_SIZE(pipe),
+			MDP5_PIPE_SRC_SIZE_WIDTH(src_w) |
+			MDP5_PIPE_SRC_SIZE_HEIGHT(src_h));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC_XY(pipe),
+			MDP5_PIPE_SRC_XY_X(src_x) |
+			MDP5_PIPE_SRC_XY_Y(src_y));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_OUT_SIZE(pipe),
+			MDP5_PIPE_OUT_SIZE_WIDTH(crtc_w) |
+			MDP5_PIPE_OUT_SIZE_HEIGHT(crtc_h));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_OUT_XY(pipe),
+			MDP5_PIPE_OUT_XY_X(crtc_x) |
+			MDP5_PIPE_OUT_XY_Y(crtc_y));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC_FORMAT(pipe),
+			MDP5_PIPE_SRC_FORMAT_A_BPC(format->bpc_a) |
+			MDP5_PIPE_SRC_FORMAT_R_BPC(format->bpc_r) |
+			MDP5_PIPE_SRC_FORMAT_G_BPC(format->bpc_g) |
+			MDP5_PIPE_SRC_FORMAT_B_BPC(format->bpc_b) |
+			COND(format->alpha_enable, MDP5_PIPE_SRC_FORMAT_ALPHA_ENABLE) |
+			MDP5_PIPE_SRC_FORMAT_CPP(format->cpp - 1) |
+			MDP5_PIPE_SRC_FORMAT_UNPACK_COUNT(format->unpack_count - 1) |
+			COND(format->unpack_tight, MDP5_PIPE_SRC_FORMAT_UNPACK_TIGHT) |
+			MDP5_PIPE_SRC_FORMAT_FETCH_TYPE(format->fetch_type) |
+			MDP5_PIPE_SRC_FORMAT_CHROMA_SAMP(format->chroma_sample));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC_UNPACK(pipe),
+			MDP5_PIPE_SRC_UNPACK_ELEM0(format->unpack[0]) |
+			MDP5_PIPE_SRC_UNPACK_ELEM1(format->unpack[1]) |
+			MDP5_PIPE_SRC_UNPACK_ELEM2(format->unpack[2]) |
+			MDP5_PIPE_SRC_UNPACK_ELEM3(format->unpack[3]));
+
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC_OP_MODE(pipe),
+			(hflip ? MDP5_PIPE_SRC_OP_MODE_FLIP_LR : 0) |
+			(vflip ? MDP5_PIPE_SRC_OP_MODE_FLIP_UD : 0) |
+			COND(has_pe, MDP5_PIPE_SRC_OP_MODE_SW_PIX_EXT_OVERRIDE) |
+			MDP5_PIPE_SRC_OP_MODE_BWC(BWC_LOSSLESS));
+
+	/* not using secure mode: */
+	mdp5_write(mdp5_kms, REG_MDP5_PIPE_SRC_ADDR_SW_STATUS(pipe), 0);
+
+	if (hwpipe->caps & MDP_PIPE_CAP_SW_PIX_EXT)
+		mdp5_write_pixel_ext(mdp5_kms, pipe, format,
+				src_w, pe->left, pe->right,
+				src_h, pe->top, pe->bottom);
+
+	if (hwpipe->caps & MDP_PIPE_CAP_SCALE) {
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_SCALE_PHASE_STEP_X(pipe),
+				step->x[COMP_0]);
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_SCALE_PHASE_STEP_Y(pipe),
+				step->y[COMP_0]);
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_SCALE_CR_PHASE_STEP_X(pipe),
+				step->x[COMP_1_2]);
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_SCALE_CR_PHASE_STEP_Y(pipe),
+				step->y[COMP_1_2]);
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_DECIMATION(pipe),
+				MDP5_PIPE_DECIMATION_VERT(vdecm) |
+				MDP5_PIPE_DECIMATION_HORZ(hdecm));
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_SCALE_CONFIG(pipe),
+			   scale_config);
+	}
+
+	if (hwpipe->caps & MDP_PIPE_CAP_CSC) {
+		if (MDP_FORMAT_IS_YUV(format))
+			csc_enable(mdp5_kms, pipe,
+					mdp_get_default_csc_cfg(CSC_YUV2RGB));
+		else
+			csc_disable(mdp5_kms, pipe);
+	}
+
+	set_scanout_locked(mdp5_kms, pipe, fb);
+}
+
+static int mdp5_plane_mode_set(struct drm_plane *plane,
+		struct drm_crtc *crtc, struct drm_framebuffer *fb,
+		struct drm_rect *src, struct drm_rect *dest)
+{
+	struct drm_plane_state *pstate = plane->state;
+	struct mdp5_hw_pipe *hwpipe = to_mdp5_plane_state(pstate)->hwpipe;
+	struct mdp5_kms *mdp5_kms = get_kms(plane);
+	enum mdp5_pipe pipe = hwpipe->pipe;
+	struct mdp5_hw_pipe *right_hwpipe;
+	const struct mdp_format *format;
+	uint32_t nplanes, config = 0;
+	struct phase_step step = { { 0 } };
+	struct pixel_ext pe = { { 0 } };
+	uint32_t hdecm = 0, vdecm = 0;
+	uint32_t pix_format;
+	unsigned int rotation;
+	bool vflip, hflip;
+	int crtc_x, crtc_y;
+	unsigned int crtc_w, crtc_h;
+	uint32_t src_x, src_y;
+	uint32_t src_w, src_h;
+	uint32_t src_img_w, src_img_h;
+	int ret;
+
+	nplanes = fb->format->num_planes;
+
+	/* bad formats should already be rejected: */
+	if (WARN_ON(nplanes > pipe2nclients(pipe)))
+		return -EINVAL;
+
+	format = to_mdp_format(msm_framebuffer_format(fb));
+	pix_format = format->base.pixel_format;
+
+	src_x = src->x1;
+	src_y = src->y1;
+	src_w = drm_rect_width(src);
+	src_h = drm_rect_height(src);
+
+	crtc_x = dest->x1;
+	crtc_y = dest->y1;
+	crtc_w = drm_rect_width(dest);
+	crtc_h = drm_rect_height(dest);
+
+	/* src values are in Q16 fixed point, convert to integer: */
+	src_x = src_x >> 16;
+	src_y = src_y >> 16;
+	src_w = src_w >> 16;
+	src_h = src_h >> 16;
+
+	src_img_w = min(fb->width, src_w);
+	src_img_h = min(fb->height, src_h);
+
+	DBG("%s: FB[%u] %u,%u,%u,%u -> CRTC[%u] %d,%d,%u,%u", plane->name,
+			fb->base.id, src_x, src_y, src_w, src_h,
+			crtc->base.id, crtc_x, crtc_y, crtc_w, crtc_h);
+
+	right_hwpipe = to_mdp5_plane_state(pstate)->r_hwpipe;
+	if (right_hwpipe) {
+		/*
+		 * if the plane comprises of 2 hw pipes, assume that the width
+		 * is split equally across them. The only parameters that varies
+		 * between the 2 pipes are src_x and crtc_x
+		 */
+		crtc_w /= 2;
+		src_w /= 2;
+		src_img_w /= 2;
+	}
+
+	ret = calc_scalex_steps(plane, pix_format, src_w, crtc_w, step.x);
+	if (ret)
+		return ret;
+
+	ret = calc_scaley_steps(plane, pix_format, src_h, crtc_h, step.y);
+	if (ret)
+		return ret;
+
+	if (hwpipe->caps & MDP_PIPE_CAP_SW_PIX_EXT) {
+		calc_pixel_ext(format, src_w, crtc_w, step.x,
+			       pe.left, pe.right, true);
+		calc_pixel_ext(format, src_h, crtc_h, step.y,
+			       pe.top, pe.bottom, false);
+	}
+
+	/* TODO calc hdecm, vdecm */
+
+	/* SCALE is used to both scale and up-sample chroma components */
+	config |= get_scale_config(format, src_w, crtc_w, true);
+	config |= get_scale_config(format, src_h, crtc_h, false);
+	DBG("scale config = %x", config);
+
+	rotation = drm_rotation_simplify(pstate->rotation,
+					 DRM_MODE_ROTATE_0 |
+					 DRM_MODE_REFLECT_X |
+					 DRM_MODE_REFLECT_Y);
+	hflip = !!(rotation & DRM_MODE_REFLECT_X);
+	vflip = !!(rotation & DRM_MODE_REFLECT_Y);
+
+	mdp5_hwpipe_mode_set(mdp5_kms, hwpipe, fb, &step, &pe,
+			     config, hdecm, vdecm, hflip, vflip,
+			     crtc_x, crtc_y, crtc_w, crtc_h,
+			     src_img_w, src_img_h,
+			     src_x, src_y, src_w, src_h);
+	if (right_hwpipe)
+		mdp5_hwpipe_mode_set(mdp5_kms, right_hwpipe, fb, &step, &pe,
+				     config, hdecm, vdecm, hflip, vflip,
+				     crtc_x + crtc_w, crtc_y, crtc_w, crtc_h,
+				     src_img_w, src_img_h,
+				     src_x + src_w, src_y, src_w, src_h);
+
+	return ret;
+}
+
+/*
+ * Use this func and the one below only after the atomic state has been
+ * successfully swapped
+ */
+enum mdp5_pipe mdp5_plane_pipe(struct drm_plane *plane)
+{
+	struct mdp5_plane_state *pstate = to_mdp5_plane_state(plane->state);
+
+	if (WARN_ON(!pstate->hwpipe))
+		return SSPP_NONE;
+
+	return pstate->hwpipe->pipe;
+}
+
+enum mdp5_pipe mdp5_plane_right_pipe(struct drm_plane *plane)
+{
+	struct mdp5_plane_state *pstate = to_mdp5_plane_state(plane->state);
+
+	if (!pstate->r_hwpipe)
+		return SSPP_NONE;
+
+	return pstate->r_hwpipe->pipe;
+}
+
+uint32_t mdp5_plane_get_flush(struct drm_plane *plane)
+{
+	struct mdp5_plane_state *pstate = to_mdp5_plane_state(plane->state);
+	u32 mask;
+
+	if (WARN_ON(!pstate->hwpipe))
+		return 0;
+
+	mask = pstate->hwpipe->flush_mask;
+
+	if (pstate->r_hwpipe)
+		mask |= pstate->r_hwpipe->flush_mask;
+
+	return mask;
+}
+
+/* initialize plane */
+struct drm_plane *mdp5_plane_init(struct drm_device *dev,
+				  enum drm_plane_type type)
+{
+	struct drm_plane *plane = NULL;
+	struct mdp5_plane *mdp5_plane;
+	int ret;
+
+	mdp5_plane = kzalloc(sizeof(*mdp5_plane), GFP_KERNEL);
+	if (!mdp5_plane) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	plane = &mdp5_plane->base;
+
+	mdp5_plane->nformats = mdp_get_formats(mdp5_plane->formats,
+		ARRAY_SIZE(mdp5_plane->formats), false);
+
+	ret = drm_universal_plane_init(dev, plane, 0xff, &mdp5_plane_funcs,
+			mdp5_plane->formats, mdp5_plane->nformats,
+			NULL, type, NULL);
+	if (ret)
+		goto fail;
+
+	drm_plane_helper_add(plane, &mdp5_plane_helper_funcs);
+
+	mdp5_plane_install_properties(plane, &plane->base);
+
+	drm_plane_enable_fb_damage_clips(plane);
+
+	return plane;
+
+fail:
+	if (plane)
+		mdp5_plane_destroy(plane);
+
+	return ERR_PTR(ret);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_smp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_smp.c
@@ -0,0 +1,397 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_fourcc.h>
+#include <drm/drm_util.h>
+
+#include "mdp5_kms.h"
+#include "mdp5_smp.h"
+
+
+struct mdp5_smp {
+	struct drm_device *dev;
+
+	uint8_t reserved[MAX_CLIENTS]; /* fixed MMBs allocation per client */
+
+	int blk_cnt;
+	int blk_size;
+
+	/* register cache */
+	u32 alloc_w[22];
+	u32 alloc_r[22];
+	u32 pipe_reqprio_fifo_wm0[SSPP_MAX];
+	u32 pipe_reqprio_fifo_wm1[SSPP_MAX];
+	u32 pipe_reqprio_fifo_wm2[SSPP_MAX];
+};
+
+static inline
+struct mdp5_kms *get_kms(struct mdp5_smp *smp)
+{
+	struct msm_drm_private *priv = smp->dev->dev_private;
+
+	return to_mdp5_kms(to_mdp_kms(priv->kms));
+}
+
+static inline u32 pipe2client(enum mdp5_pipe pipe, int plane)
+{
+#define CID_UNUSED	0
+
+	if (WARN_ON(plane >= pipe2nclients(pipe)))
+		return CID_UNUSED;
+
+	/*
+	 * Note on SMP clients:
+	 * For ViG pipes, fetch Y/Cr/Cb-components clients are always
+	 * consecutive, and in that order.
+	 *
+	 * e.g.:
+	 * if mdp5_cfg->smp.clients[SSPP_VIG0] = N,
+	 *	Y  plane's client ID is N
+	 *	Cr plane's client ID is N + 1
+	 *	Cb plane's client ID is N + 2
+	 */
+
+	return mdp5_cfg->smp.clients[pipe] + plane;
+}
+
+/* allocate blocks for the specified request: */
+static int smp_request_block(struct mdp5_smp *smp,
+		struct mdp5_smp_state *state,
+		u32 cid, int nblks)
+{
+	void *cs = state->client_state[cid];
+	int i, avail, cnt = smp->blk_cnt;
+	uint8_t reserved;
+
+	/* we shouldn't be requesting blocks for an in-use client: */
+	WARN_ON(!bitmap_empty(cs, cnt));
+
+	reserved = smp->reserved[cid];
+
+	if (reserved) {
+		nblks = max(0, nblks - reserved);
+		DBG("%d MMBs allocated (%d reserved)", nblks, reserved);
+	}
+
+	avail = cnt - bitmap_weight(state->state, cnt);
+	if (nblks > avail) {
+		DRM_DEV_ERROR(smp->dev->dev, "out of blks (req=%d > avail=%d)\n",
+				nblks, avail);
+		return -ENOSPC;
+	}
+
+	for (i = 0; i < nblks; i++) {
+		int blk = find_first_zero_bit(state->state, cnt);
+		set_bit(blk, cs);
+		set_bit(blk, state->state);
+	}
+
+	return 0;
+}
+
+static void set_fifo_thresholds(struct mdp5_smp *smp,
+		enum mdp5_pipe pipe, int nblks)
+{
+	u32 smp_entries_per_blk = smp->blk_size / (128 / BITS_PER_BYTE);
+	u32 val;
+
+	/* 1/4 of SMP pool that is being fetched */
+	val = (nblks * smp_entries_per_blk) / 4;
+
+	smp->pipe_reqprio_fifo_wm0[pipe] = val * 1;
+	smp->pipe_reqprio_fifo_wm1[pipe] = val * 2;
+	smp->pipe_reqprio_fifo_wm2[pipe] = val * 3;
+}
+
+/*
+ * NOTE: looks like if horizontal decimation is used (if we supported that)
+ * then the width used to calculate SMP block requirements is the post-
+ * decimated width.  Ie. SMP buffering sits downstream of decimation (which
+ * presumably happens during the dma from scanout buffer).
+ */
+uint32_t mdp5_smp_calculate(struct mdp5_smp *smp,
+		const struct mdp_format *format,
+		u32 width, bool hdecim)
+{
+	const struct drm_format_info *info = drm_format_info(format->base.pixel_format);
+	struct mdp5_kms *mdp5_kms = get_kms(smp);
+	int rev = mdp5_cfg_get_hw_rev(mdp5_kms->cfg);
+	int i, hsub, nplanes, nlines;
+	uint32_t blkcfg = 0;
+
+	nplanes = info->num_planes;
+	hsub = info->hsub;
+
+	/* different if BWC (compressed framebuffer?) enabled: */
+	nlines = 2;
+
+	/* Newer MDPs have split/packing logic, which fetches sub-sampled
+	 * U and V components (splits them from Y if necessary) and packs
+	 * them together, writes to SMP using a single client.
+	 */
+	if ((rev > 0) && (format->chroma_sample > CHROMA_FULL)) {
+		nplanes = 2;
+
+		/* if decimation is enabled, HW decimates less on the
+		 * sub sampled chroma components
+		 */
+		if (hdecim && (hsub > 1))
+			hsub = 1;
+	}
+
+	for (i = 0; i < nplanes; i++) {
+		int n, fetch_stride, cpp;
+
+		cpp = info->cpp[i];
+		fetch_stride = width * cpp / (i ? hsub : 1);
+
+		n = DIV_ROUND_UP(fetch_stride * nlines, smp->blk_size);
+
+		/* for hw rev v1.00 */
+		if (rev == 0)
+			n = roundup_pow_of_two(n);
+
+		blkcfg |= (n << (8 * i));
+	}
+
+	return blkcfg;
+}
+
+int mdp5_smp_assign(struct mdp5_smp *smp, struct mdp5_smp_state *state,
+		enum mdp5_pipe pipe, uint32_t blkcfg)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(smp);
+	struct drm_device *dev = mdp5_kms->dev;
+	int i, ret;
+
+	for (i = 0; i < pipe2nclients(pipe); i++) {
+		u32 cid = pipe2client(pipe, i);
+		int n = blkcfg & 0xff;
+
+		if (!n)
+			continue;
+
+		DBG("%s[%d]: request %d SMP blocks", pipe2name(pipe), i, n);
+		ret = smp_request_block(smp, state, cid, n);
+		if (ret) {
+			DRM_DEV_ERROR(dev->dev, "Cannot allocate %d SMP blocks: %d\n",
+					n, ret);
+			return ret;
+		}
+
+		blkcfg >>= 8;
+	}
+
+	state->assigned |= (1 << pipe);
+
+	return 0;
+}
+
+/* Release SMP blocks for all clients of the pipe */
+void mdp5_smp_release(struct mdp5_smp *smp, struct mdp5_smp_state *state,
+		enum mdp5_pipe pipe)
+{
+	int i;
+	int cnt = smp->blk_cnt;
+
+	for (i = 0; i < pipe2nclients(pipe); i++) {
+		u32 cid = pipe2client(pipe, i);
+		void *cs = state->client_state[cid];
+
+		/* update global state: */
+		bitmap_andnot(state->state, state->state, cs, cnt);
+
+		/* clear client's state */
+		bitmap_zero(cs, cnt);
+	}
+
+	state->released |= (1 << pipe);
+}
+
+/* NOTE: SMP_ALLOC_* regs are *not* double buffered, so release has to
+ * happen after scanout completes.
+ */
+static unsigned update_smp_state(struct mdp5_smp *smp,
+		u32 cid, mdp5_smp_state_t *assigned)
+{
+	int cnt = smp->blk_cnt;
+	unsigned nblks = 0;
+	u32 blk, val;
+
+	for_each_set_bit(blk, *assigned, cnt) {
+		int idx = blk / 3;
+		int fld = blk % 3;
+
+		val = smp->alloc_w[idx];
+
+		switch (fld) {
+		case 0:
+			val &= ~MDP5_SMP_ALLOC_W_REG_CLIENT0__MASK;
+			val |= MDP5_SMP_ALLOC_W_REG_CLIENT0(cid);
+			break;
+		case 1:
+			val &= ~MDP5_SMP_ALLOC_W_REG_CLIENT1__MASK;
+			val |= MDP5_SMP_ALLOC_W_REG_CLIENT1(cid);
+			break;
+		case 2:
+			val &= ~MDP5_SMP_ALLOC_W_REG_CLIENT2__MASK;
+			val |= MDP5_SMP_ALLOC_W_REG_CLIENT2(cid);
+			break;
+		}
+
+		smp->alloc_w[idx] = val;
+		smp->alloc_r[idx] = val;
+
+		nblks++;
+	}
+
+	return nblks;
+}
+
+static void write_smp_alloc_regs(struct mdp5_smp *smp)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(smp);
+	int i, num_regs;
+
+	num_regs = smp->blk_cnt / 3 + 1;
+
+	for (i = 0; i < num_regs; i++) {
+		mdp5_write(mdp5_kms, REG_MDP5_SMP_ALLOC_W_REG(i),
+			   smp->alloc_w[i]);
+		mdp5_write(mdp5_kms, REG_MDP5_SMP_ALLOC_R_REG(i),
+			   smp->alloc_r[i]);
+	}
+}
+
+static void write_smp_fifo_regs(struct mdp5_smp *smp)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(smp);
+	int i;
+
+	for (i = 0; i < mdp5_kms->num_hwpipes; i++) {
+		struct mdp5_hw_pipe *hwpipe = mdp5_kms->hwpipes[i];
+		enum mdp5_pipe pipe = hwpipe->pipe;
+
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_REQPRIO_FIFO_WM_0(pipe),
+			   smp->pipe_reqprio_fifo_wm0[pipe]);
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_REQPRIO_FIFO_WM_1(pipe),
+			   smp->pipe_reqprio_fifo_wm1[pipe]);
+		mdp5_write(mdp5_kms, REG_MDP5_PIPE_REQPRIO_FIFO_WM_2(pipe),
+			   smp->pipe_reqprio_fifo_wm2[pipe]);
+	}
+}
+
+void mdp5_smp_prepare_commit(struct mdp5_smp *smp, struct mdp5_smp_state *state)
+{
+	enum mdp5_pipe pipe;
+
+	for_each_set_bit(pipe, &state->assigned, sizeof(state->assigned) * 8) {
+		unsigned i, nblks = 0;
+
+		for (i = 0; i < pipe2nclients(pipe); i++) {
+			u32 cid = pipe2client(pipe, i);
+			void *cs = state->client_state[cid];
+
+			nblks += update_smp_state(smp, cid, cs);
+
+			DBG("assign %s:%u, %u blks",
+				pipe2name(pipe), i, nblks);
+		}
+
+		set_fifo_thresholds(smp, pipe, nblks);
+	}
+
+	write_smp_alloc_regs(smp);
+	write_smp_fifo_regs(smp);
+
+	state->assigned = 0;
+}
+
+void mdp5_smp_complete_commit(struct mdp5_smp *smp, struct mdp5_smp_state *state)
+{
+	enum mdp5_pipe pipe;
+
+	for_each_set_bit(pipe, &state->released, sizeof(state->released) * 8) {
+		DBG("release %s", pipe2name(pipe));
+		set_fifo_thresholds(smp, pipe, 0);
+	}
+
+	write_smp_fifo_regs(smp);
+
+	state->released = 0;
+}
+
+void mdp5_smp_dump(struct mdp5_smp *smp, struct drm_printer *p)
+{
+	struct mdp5_kms *mdp5_kms = get_kms(smp);
+	struct mdp5_hw_pipe_state *hwpstate;
+	struct mdp5_smp_state *state;
+	struct mdp5_global_state *global_state;
+	int total = 0, i, j;
+
+	drm_printf(p, "name\tinuse\tplane\n");
+	drm_printf(p, "----\t-----\t-----\n");
+
+	if (drm_can_sleep())
+		drm_modeset_lock(&mdp5_kms->glob_state_lock, NULL);
+
+	global_state = mdp5_get_existing_global_state(mdp5_kms);
+
+	/* grab these *after* we hold the state_lock */
+	hwpstate = &global_state->hwpipe;
+	state = &global_state->smp;
+
+	for (i = 0; i < mdp5_kms->num_hwpipes; i++) {
+		struct mdp5_hw_pipe *hwpipe = mdp5_kms->hwpipes[i];
+		struct drm_plane *plane = hwpstate->hwpipe_to_plane[hwpipe->idx];
+		enum mdp5_pipe pipe = hwpipe->pipe;
+		for (j = 0; j < pipe2nclients(pipe); j++) {
+			u32 cid = pipe2client(pipe, j);
+			void *cs = state->client_state[cid];
+			int inuse = bitmap_weight(cs, smp->blk_cnt);
+
+			drm_printf(p, "%s:%d\t%d\t%s\n",
+				pipe2name(pipe), j, inuse,
+				plane ? plane->name : "(null)");
+
+			total += inuse;
+		}
+	}
+
+	drm_printf(p, "TOTAL:\t%d\t(of %d)\n", total, smp->blk_cnt);
+	drm_printf(p, "AVAIL:\t%d\n", smp->blk_cnt -
+			bitmap_weight(state->state, smp->blk_cnt));
+
+	if (drm_can_sleep())
+		drm_modeset_unlock(&mdp5_kms->glob_state_lock);
+}
+
+
+struct mdp5_smp *mdp5_smp_init(struct mdp5_kms *mdp5_kms, const struct mdp5_smp_block *cfg)
+{
+	struct drm_device *dev = mdp5_kms->dev;
+	struct mdp5_smp_state *state;
+	struct mdp5_global_state *global_state;
+	struct mdp5_smp *smp;
+
+	smp = devm_kzalloc(dev->dev, sizeof(*smp), GFP_KERNEL);
+	if (unlikely(!smp))
+		return ERR_PTR(-ENOMEM);
+
+	smp->dev = mdp5_kms->dev;
+	smp->blk_cnt = cfg->mmb_count;
+	smp->blk_size = cfg->mmb_size;
+
+	global_state = mdp5_get_existing_global_state(mdp5_kms);
+	state = &global_state->smp;
+
+	/* statically tied MMBs cannot be re-allocated: */
+	bitmap_copy(state->state, cfg->reserved_state, smp->blk_cnt);
+	memcpy(smp->reserved, cfg->reserved, sizeof(smp->reserved));
+
+	return smp;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_smp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp5/mdp5_smp.h
@@ -0,0 +1,86 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MDP5_SMP_H__
+#define __MDP5_SMP_H__
+
+#include <drm/drm_print.h>
+
+#include "msm_drv.h"
+
+/*
+ * SMP - Shared Memory Pool:
+ *
+ * SMP blocks are shared between all the clients, where each plane in
+ * a scanout buffer is a SMP client.  Ie. scanout of 3 plane I420 on
+ * pipe VIG0 => 3 clients: VIG0_Y, VIG0_CB, VIG0_CR.
+ *
+ * Based on the size of the attached scanout buffer, a certain # of
+ * blocks must be allocated to that client out of the shared pool.
+ *
+ * In some hw, some blocks are statically allocated for certain pipes
+ * and CANNOT be re-allocated (eg: MMB0 and MMB1 both tied to RGB0).
+ *
+ *
+ * Atomic SMP State:
+ *
+ * On atomic updates that modify SMP configuration, the state is cloned
+ * (copied) and modified.  For test-only, or in cases where atomic
+ * update fails (or if we hit ww_mutex deadlock/backoff condition) the
+ * new state is simply thrown away.
+ *
+ * Because the SMP registers are not double buffered, updates are a
+ * two step process:
+ *
+ * 1) in _prepare_commit() we configure things (via read-modify-write)
+ *    for the newly assigned pipes, so we don't take away blocks
+ *    assigned to pipes that are still scanning out
+ * 2) in _complete_commit(), after vblank/etc, we clear things for the
+ *    released clients, since at that point old pipes are no longer
+ *    scanning out.
+ */
+struct mdp5_smp_state {
+	/* global state of what blocks are in use: */
+	mdp5_smp_state_t state;
+
+	/* per client state of what blocks they are using: */
+	mdp5_smp_state_t client_state[MAX_CLIENTS];
+
+	/* assigned pipes (hw updated at _prepare_commit()): */
+	unsigned long assigned;
+
+	/* released pipes (hw updated at _complete_commit()): */
+	unsigned long released;
+};
+
+struct mdp5_kms;
+struct mdp5_smp;
+
+/*
+ * SMP module prototypes:
+ * mdp5_smp_init() returns a SMP @handler,
+ * which is then used to call the other mdp5_smp_*(handler, ...) functions.
+ */
+
+struct mdp5_smp *mdp5_smp_init(struct mdp5_kms *mdp5_kms,
+		const struct mdp5_smp_block *cfg);
+
+void mdp5_smp_dump(struct mdp5_smp *smp, struct drm_printer *p);
+
+uint32_t mdp5_smp_calculate(struct mdp5_smp *smp,
+		const struct mdp_format *format,
+		u32 width, bool hdecim);
+
+int mdp5_smp_assign(struct mdp5_smp *smp, struct mdp5_smp_state *state,
+		enum mdp5_pipe pipe, uint32_t blkcfg);
+void mdp5_smp_release(struct mdp5_smp *smp, struct mdp5_smp_state *state,
+		enum mdp5_pipe pipe);
+
+void mdp5_smp_prepare_commit(struct mdp5_smp *smp, struct mdp5_smp_state *state);
+void mdp5_smp_complete_commit(struct mdp5_smp *smp, struct mdp5_smp_state *state);
+
+#endif /* __MDP5_SMP_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp_format.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp_format.c
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_fourcc.h>
+#include <drm/drm_framebuffer.h>
+
+#include "msm_drv.h"
+#include "mdp_kms.h"
+
+static struct csc_cfg csc_convert[CSC_MAX] = {
+	[CSC_RGB2RGB] = {
+		.type = CSC_RGB2RGB,
+		.matrix = {
+			0x0200, 0x0000, 0x0000,
+			0x0000, 0x0200, 0x0000,
+			0x0000, 0x0000, 0x0200
+		},
+		.pre_bias =	{ 0x0, 0x0, 0x0 },
+		.post_bias =	{ 0x0, 0x0, 0x0 },
+		.pre_clamp =	{ 0x0, 0xff, 0x0, 0xff, 0x0, 0xff },
+		.post_clamp =	{ 0x0, 0xff, 0x0, 0xff, 0x0, 0xff },
+	},
+	[CSC_YUV2RGB] = {
+		.type = CSC_YUV2RGB,
+		.matrix = {
+			0x0254, 0x0000, 0x0331,
+			0x0254, 0xff37, 0xfe60,
+			0x0254, 0x0409, 0x0000
+		},
+		.pre_bias =	{ 0xfff0, 0xff80, 0xff80 },
+		.post_bias =	{ 0x00, 0x00, 0x00 },
+		.pre_clamp =	{ 0x00, 0xff, 0x00, 0xff, 0x00, 0xff },
+		.post_clamp =	{ 0x00, 0xff, 0x00, 0xff, 0x00, 0xff },
+	},
+	[CSC_RGB2YUV] = {
+		.type = CSC_RGB2YUV,
+		.matrix = {
+			0x0083, 0x0102, 0x0032,
+			0x1fb5, 0x1f6c, 0x00e1,
+			0x00e1, 0x1f45, 0x1fdc
+		},
+		.pre_bias =	{ 0x00, 0x00, 0x00 },
+		.post_bias =	{ 0x10, 0x80, 0x80 },
+		.pre_clamp =	{ 0x00, 0xff, 0x00, 0xff, 0x00, 0xff },
+		.post_clamp =	{ 0x10, 0xeb, 0x10, 0xf0, 0x10, 0xf0 },
+	},
+	[CSC_YUV2YUV] = {
+		.type = CSC_YUV2YUV,
+		.matrix = {
+			0x0200, 0x0000, 0x0000,
+			0x0000, 0x0200, 0x0000,
+			0x0000, 0x0000, 0x0200
+		},
+		.pre_bias =	{ 0x00, 0x00, 0x00 },
+		.post_bias =	{ 0x00, 0x00, 0x00 },
+		.pre_clamp =	{ 0x00, 0xff, 0x00, 0xff, 0x00, 0xff },
+		.post_clamp =	{ 0x00, 0xff, 0x00, 0xff, 0x00, 0xff },
+	},
+};
+
+#define FMT(name, a, r, g, b, e0, e1, e2, e3, alpha, tight, c, cnt, fp, cs, yuv) { \
+		.base = { .pixel_format = DRM_FORMAT_ ## name }, \
+		.bpc_a = BPC ## a ## A,                          \
+		.bpc_r = BPC ## r,                               \
+		.bpc_g = BPC ## g,                               \
+		.bpc_b = BPC ## b,                               \
+		.unpack = { e0, e1, e2, e3 },                    \
+		.alpha_enable = alpha,                           \
+		.unpack_tight = tight,                           \
+		.cpp = c,                                        \
+		.unpack_count = cnt,                             \
+		.fetch_type = fp,                                \
+		.chroma_sample = cs,                             \
+		.is_yuv = yuv,                                   \
+}
+
+#define BPC0A 0
+
+/*
+ * Note: Keep RGB formats 1st, followed by YUV formats to avoid breaking
+ * mdp_get_rgb_formats()'s implementation.
+ */
+static const struct mdp_format formats[] = {
+	/*  name      a  r  g  b   e0 e1 e2 e3  alpha   tight  cpp cnt ... */
+	FMT(ARGB8888, 8, 8, 8, 8,  1, 0, 2, 3,  true,   true,  4,  4,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(ABGR8888, 8, 8, 8, 8,  2, 0, 1, 3,  true,   true,  4,  4,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(RGBA8888, 8, 8, 8, 8,  3, 1, 0, 2,  true,   true,  4,  4,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(BGRA8888, 8, 8, 8, 8,  3, 2, 0, 1,  true,   true,  4,  4,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(XRGB8888, 8, 8, 8, 8,  1, 0, 2, 3,  false,  true,  4,  4,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(XBGR8888, 8, 8, 8, 8,  2, 0, 1, 3,  false,   true,  4,  4,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(RGBX8888, 8, 8, 8, 8,  3, 1, 0, 2,  false,   true,  4,  4,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(BGRX8888, 8, 8, 8, 8,  3, 2, 0, 1,  false,   true,  4,  4,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(RGB888,   0, 8, 8, 8,  1, 0, 2, 0,  false,  true,  3,  3,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(BGR888,   0, 8, 8, 8,  2, 0, 1, 0,  false,  true,  3,  3,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(RGB565,   0, 5, 6, 5,  1, 0, 2, 0,  false,  true,  2,  3,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+	FMT(BGR565,   0, 5, 6, 5,  2, 0, 1, 0,  false,  true,  2,  3,
+			MDP_PLANE_INTERLEAVED, CHROMA_FULL, false),
+
+	/* --- RGB formats above / YUV formats below this line --- */
+
+	/* 2 plane YUV */
+	FMT(NV12,     0, 8, 8, 8,  1, 2, 0, 0,  false,  true,  2, 2,
+			MDP_PLANE_PSEUDO_PLANAR, CHROMA_420, true),
+	FMT(NV21,     0, 8, 8, 8,  2, 1, 0, 0,  false,  true,  2, 2,
+			MDP_PLANE_PSEUDO_PLANAR, CHROMA_420, true),
+	FMT(NV16,     0, 8, 8, 8,  1, 2, 0, 0,  false,  true,  2, 2,
+			MDP_PLANE_PSEUDO_PLANAR, CHROMA_H2V1, true),
+	FMT(NV61,     0, 8, 8, 8,  2, 1, 0, 0,  false,  true,  2, 2,
+			MDP_PLANE_PSEUDO_PLANAR, CHROMA_H2V1, true),
+	/* 1 plane YUV */
+	FMT(VYUY,     0, 8, 8, 8,  2, 0, 1, 0,  false,  true,  2, 4,
+			MDP_PLANE_INTERLEAVED, CHROMA_H2V1, true),
+	FMT(UYVY,     0, 8, 8, 8,  1, 0, 2, 0,  false,  true,  2, 4,
+			MDP_PLANE_INTERLEAVED, CHROMA_H2V1, true),
+	FMT(YUYV,     0, 8, 8, 8,  0, 1, 0, 2,  false,  true,  2, 4,
+			MDP_PLANE_INTERLEAVED, CHROMA_H2V1, true),
+	FMT(YVYU,     0, 8, 8, 8,  0, 2, 0, 1,  false,  true,  2, 4,
+			MDP_PLANE_INTERLEAVED, CHROMA_H2V1, true),
+	/* 3 plane YUV */
+	FMT(YUV420,   0, 8, 8, 8,  2, 1, 0, 0,  false,  true,  1, 1,
+			MDP_PLANE_PLANAR, CHROMA_420, true),
+	FMT(YVU420,   0, 8, 8, 8,  1, 2, 0, 0,  false,  true,  1, 1,
+			MDP_PLANE_PLANAR, CHROMA_420, true),
+};
+
+/*
+ * Note:
+ * @rgb_only must be set to true, when requesting
+ * supported formats for RGB pipes.
+ */
+uint32_t mdp_get_formats(uint32_t *pixel_formats, uint32_t max_formats,
+		bool rgb_only)
+{
+	uint32_t i;
+	for (i = 0; i < ARRAY_SIZE(formats); i++) {
+		const struct mdp_format *f = &formats[i];
+
+		if (i == max_formats)
+			break;
+
+		if (rgb_only && MDP_FORMAT_IS_YUV(f))
+			break;
+
+		pixel_formats[i] = f->base.pixel_format;
+	}
+
+	return i;
+}
+
+const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format,
+		uint64_t modifier)
+{
+	int i;
+	for (i = 0; i < ARRAY_SIZE(formats); i++) {
+		const struct mdp_format *f = &formats[i];
+		if (f->base.pixel_format == format)
+			return &f->base;
+	}
+	return NULL;
+}
+
+struct csc_cfg *mdp_get_default_csc_cfg(enum csc_type type)
+{
+	if (WARN_ON(type >= CSC_MAX))
+		return NULL;
+
+	return &csc_convert[type];
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp_kms.c
@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+
+#include "msm_drv.h"
+#include "mdp_kms.h"
+
+
+struct mdp_irq_wait {
+	struct mdp_irq irq;
+	int count;
+};
+
+static DECLARE_WAIT_QUEUE_HEAD(wait_event);
+
+static DEFINE_SPINLOCK(list_lock);
+
+static void update_irq(struct mdp_kms *mdp_kms)
+{
+	struct mdp_irq *irq;
+	uint32_t irqmask = mdp_kms->vblank_mask;
+
+	assert_spin_locked(&list_lock);
+
+	list_for_each_entry(irq, &mdp_kms->irq_list, node)
+		irqmask |= irq->irqmask;
+
+	mdp_kms->funcs->set_irqmask(mdp_kms, irqmask, mdp_kms->cur_irq_mask);
+	mdp_kms->cur_irq_mask = irqmask;
+}
+
+/* if an mdp_irq's irqmask has changed, such as when mdp5 crtc<->encoder
+ * link changes, this must be called to figure out the new global irqmask
+ */
+void mdp_irq_update(struct mdp_kms *mdp_kms)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&list_lock, flags);
+	update_irq(mdp_kms);
+	spin_unlock_irqrestore(&list_lock, flags);
+}
+
+void mdp_dispatch_irqs(struct mdp_kms *mdp_kms, uint32_t status)
+{
+	struct mdp_irq *handler, *n;
+	unsigned long flags;
+
+	spin_lock_irqsave(&list_lock, flags);
+	mdp_kms->in_irq = true;
+	list_for_each_entry_safe(handler, n, &mdp_kms->irq_list, node) {
+		if (handler->irqmask & status) {
+			spin_unlock_irqrestore(&list_lock, flags);
+			handler->irq(handler, handler->irqmask & status);
+			spin_lock_irqsave(&list_lock, flags);
+		}
+	}
+	mdp_kms->in_irq = false;
+	update_irq(mdp_kms);
+	spin_unlock_irqrestore(&list_lock, flags);
+
+}
+
+void mdp_update_vblank_mask(struct mdp_kms *mdp_kms, uint32_t mask, bool enable)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&list_lock, flags);
+	if (enable)
+		mdp_kms->vblank_mask |= mask;
+	else
+		mdp_kms->vblank_mask &= ~mask;
+	update_irq(mdp_kms);
+	spin_unlock_irqrestore(&list_lock, flags);
+}
+
+static void wait_irq(struct mdp_irq *irq, uint32_t irqstatus)
+{
+	struct mdp_irq_wait *wait =
+			container_of(irq, struct mdp_irq_wait, irq);
+	wait->count--;
+	wake_up_all(&wait_event);
+}
+
+void mdp_irq_wait(struct mdp_kms *mdp_kms, uint32_t irqmask)
+{
+	struct mdp_irq_wait wait = {
+		.irq = {
+			.irq = wait_irq,
+			.irqmask = irqmask,
+		},
+		.count = 1,
+	};
+	mdp_irq_register(mdp_kms, &wait.irq);
+	wait_event_timeout(wait_event, (wait.count <= 0),
+			msecs_to_jiffies(100));
+	mdp_irq_unregister(mdp_kms, &wait.irq);
+}
+
+void mdp_irq_register(struct mdp_kms *mdp_kms, struct mdp_irq *irq)
+{
+	unsigned long flags;
+	bool needs_update = false;
+
+	spin_lock_irqsave(&list_lock, flags);
+
+	if (!irq->registered) {
+		irq->registered = true;
+		list_add(&irq->node, &mdp_kms->irq_list);
+		needs_update = !mdp_kms->in_irq;
+	}
+
+	spin_unlock_irqrestore(&list_lock, flags);
+
+	if (needs_update)
+		mdp_irq_update(mdp_kms);
+}
+
+void mdp_irq_unregister(struct mdp_kms *mdp_kms, struct mdp_irq *irq)
+{
+	unsigned long flags;
+	bool needs_update = false;
+
+	spin_lock_irqsave(&list_lock, flags);
+
+	if (irq->registered) {
+		irq->registered = false;
+		list_del(&irq->node);
+		needs_update = !mdp_kms->in_irq;
+	}
+
+	spin_unlock_irqrestore(&list_lock, flags);
+
+	if (needs_update)
+		mdp_irq_update(mdp_kms);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/mdp_kms.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/mdp_kms.h
@@ -0,0 +1,142 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MDP_KMS_H__
+#define __MDP_KMS_H__
+
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+
+#include "msm_drv.h"
+#include "msm_kms.h"
+#include "mdp_common.xml.h"
+
+struct mdp_kms;
+
+struct mdp_kms_funcs {
+	struct msm_kms_funcs base;
+	void (*set_irqmask)(struct mdp_kms *mdp_kms, uint32_t irqmask,
+		uint32_t old_irqmask);
+};
+
+struct mdp_kms {
+	struct msm_kms base;
+
+	const struct mdp_kms_funcs *funcs;
+
+	/* irq handling: */
+	bool in_irq;
+	struct list_head irq_list;    /* list of mdp4_irq */
+	uint32_t vblank_mask;         /* irq bits set for userspace vblank */
+	uint32_t cur_irq_mask;        /* current irq mask */
+};
+#define to_mdp_kms(x) container_of(x, struct mdp_kms, base)
+
+static inline int mdp_kms_init(struct mdp_kms *mdp_kms,
+		const struct mdp_kms_funcs *funcs)
+{
+	mdp_kms->funcs = funcs;
+	INIT_LIST_HEAD(&mdp_kms->irq_list);
+	return msm_kms_init(&mdp_kms->base, &funcs->base);
+}
+
+static inline void mdp_kms_destroy(struct mdp_kms *mdp_kms)
+{
+	msm_kms_destroy(&mdp_kms->base);
+}
+
+/*
+ * irq helpers:
+ */
+
+/* For transiently registering for different MDP irqs that various parts
+ * of the KMS code need during setup/configuration.  These are not
+ * necessarily the same as what drm_vblank_get/put() are requesting, and
+ * the hysteresis in drm_vblank_put() is not necessarily desirable for
+ * internal housekeeping related irq usage.
+ */
+struct mdp_irq {
+	struct list_head node;
+	uint32_t irqmask;
+	bool registered;
+	void (*irq)(struct mdp_irq *irq, uint32_t irqstatus);
+};
+
+void mdp_dispatch_irqs(struct mdp_kms *mdp_kms, uint32_t status);
+void mdp_update_vblank_mask(struct mdp_kms *mdp_kms, uint32_t mask, bool enable);
+void mdp_irq_wait(struct mdp_kms *mdp_kms, uint32_t irqmask);
+void mdp_irq_register(struct mdp_kms *mdp_kms, struct mdp_irq *irq);
+void mdp_irq_unregister(struct mdp_kms *mdp_kms, struct mdp_irq *irq);
+void mdp_irq_update(struct mdp_kms *mdp_kms);
+
+/*
+ * pixel format helpers:
+ */
+
+struct mdp_format {
+	struct msm_format base;
+	enum mdp_bpc bpc_r, bpc_g, bpc_b;
+	enum mdp_bpc_alpha bpc_a;
+	uint8_t unpack[4];
+	bool alpha_enable, unpack_tight;
+	uint8_t cpp, unpack_count;
+	enum mdp_fetch_type fetch_type;
+	enum mdp_chroma_samp_type chroma_sample;
+	bool is_yuv;
+};
+#define to_mdp_format(x) container_of(x, struct mdp_format, base)
+#define MDP_FORMAT_IS_YUV(mdp_format) ((mdp_format)->is_yuv)
+
+uint32_t mdp_get_formats(uint32_t *formats, uint32_t max_formats, bool rgb_only);
+const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format, uint64_t modifier);
+
+/* MDP capabilities */
+#define MDP_CAP_SMP		BIT(0)	/* Shared Memory Pool                 */
+#define MDP_CAP_DSC		BIT(1)	/* VESA Display Stream Compression    */
+#define MDP_CAP_CDM		BIT(2)	/* Chroma Down Module (HDMI 2.0 YUV)  */
+#define MDP_CAP_SRC_SPLIT	BIT(3)	/* Source Split of SSPPs */
+
+/* MDP pipe capabilities */
+#define MDP_PIPE_CAP_HFLIP			BIT(0)
+#define MDP_PIPE_CAP_VFLIP			BIT(1)
+#define MDP_PIPE_CAP_SCALE			BIT(2)
+#define MDP_PIPE_CAP_CSC			BIT(3)
+#define MDP_PIPE_CAP_DECIMATION			BIT(4)
+#define MDP_PIPE_CAP_SW_PIX_EXT			BIT(5)
+#define MDP_PIPE_CAP_CURSOR			BIT(6)
+
+/* MDP layer mixer caps */
+#define MDP_LM_CAP_DISPLAY			BIT(0)
+#define MDP_LM_CAP_WB				BIT(1)
+#define MDP_LM_CAP_PAIR				BIT(2)
+
+static inline bool pipe_supports_yuv(uint32_t pipe_caps)
+{
+	return (pipe_caps & MDP_PIPE_CAP_SCALE) &&
+		(pipe_caps & MDP_PIPE_CAP_CSC);
+}
+
+enum csc_type {
+	CSC_RGB2RGB = 0,
+	CSC_YUV2RGB,
+	CSC_RGB2YUV,
+	CSC_YUV2YUV,
+	CSC_MAX
+};
+
+struct csc_cfg {
+	enum csc_type type;
+	uint32_t matrix[9];
+	uint32_t pre_bias[3];
+	uint32_t post_bias[3];
+	uint32_t pre_clamp[6];
+	uint32_t post_clamp[6];
+};
+
+struct csc_cfg *mdp_get_default_csc_cfg(enum csc_type);
+
+#endif /* __MDP_KMS_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/msm_disp_snapshot.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/msm_disp_snapshot.c
@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+
+#include "msm_disp_snapshot.h"
+
+static ssize_t __maybe_unused disp_devcoredump_read(char *buffer, loff_t offset,
+		size_t count, void *data, size_t datalen)
+{
+	struct drm_print_iterator iter;
+	struct drm_printer p;
+	struct msm_disp_state *disp_state;
+
+	disp_state = data;
+
+	iter.data = buffer;
+	iter.offset = 0;
+	iter.start = offset;
+	iter.remain = count;
+
+	p = drm_coredump_printer(&iter);
+
+	msm_disp_state_print(disp_state, &p);
+
+	return count - iter.remain;
+}
+
+struct msm_disp_state *
+msm_disp_snapshot_state_sync(struct msm_kms *kms)
+{
+	struct drm_device *drm_dev = kms->dev;
+	struct msm_disp_state *disp_state;
+
+	WARN_ON(!mutex_is_locked(&kms->dump_mutex));
+
+	disp_state = kzalloc(sizeof(struct msm_disp_state), GFP_KERNEL);
+	if (!disp_state)
+		return ERR_PTR(-ENOMEM);
+
+	disp_state->dev = drm_dev->dev;
+	disp_state->drm_dev = drm_dev;
+
+	INIT_LIST_HEAD(&disp_state->blocks);
+
+	msm_disp_snapshot_capture_state(disp_state);
+
+	return disp_state;
+}
+
+static void _msm_disp_snapshot_work(struct kthread_work *work)
+{
+	struct msm_kms *kms = container_of(work, struct msm_kms, dump_work);
+	struct msm_disp_state *disp_state;
+	struct drm_printer p;
+
+	/* Serialize dumping here */
+	mutex_lock(&kms->dump_mutex);
+	disp_state = msm_disp_snapshot_state_sync(kms);
+	mutex_unlock(&kms->dump_mutex);
+
+	if (IS_ERR(disp_state))
+		return;
+
+	if (MSM_DISP_SNAPSHOT_DUMP_IN_CONSOLE) {
+		p = drm_info_printer(disp_state->drm_dev->dev);
+		msm_disp_state_print(disp_state, &p);
+	}
+
+	/*
+	 * If COREDUMP is disabled, the stub will call the free function.
+	 * If there is a codedump pending for the device, the dev_coredumpm()
+	 * will also free new coredump state.
+	 */
+	dev_coredumpm(disp_state->dev, THIS_MODULE, disp_state, 0, GFP_KERNEL,
+			disp_devcoredump_read, msm_disp_state_free);
+}
+
+void msm_disp_snapshot_state(struct drm_device *drm_dev)
+{
+	struct msm_drm_private *priv;
+	struct msm_kms *kms;
+
+	if (!drm_dev) {
+		DRM_ERROR("invalid params\n");
+		return;
+	}
+
+	priv = drm_dev->dev_private;
+	kms = priv->kms;
+
+	kthread_queue_work(kms->dump_worker, &kms->dump_work);
+}
+
+int msm_disp_snapshot_init(struct drm_device *drm_dev)
+{
+	struct msm_drm_private *priv;
+	struct msm_kms *kms;
+
+	if (!drm_dev) {
+		DRM_ERROR("invalid params\n");
+		return -EINVAL;
+	}
+
+	priv = drm_dev->dev_private;
+	kms = priv->kms;
+
+	mutex_init(&kms->dump_mutex);
+
+	kms->dump_worker = kthread_create_worker(0, "%s", "disp_snapshot");
+	if (IS_ERR(kms->dump_worker))
+		DRM_ERROR("failed to create disp state task\n");
+
+	kthread_init_work(&kms->dump_work, _msm_disp_snapshot_work);
+
+	return 0;
+}
+
+void msm_disp_snapshot_destroy(struct drm_device *drm_dev)
+{
+	struct msm_kms *kms;
+	struct msm_drm_private *priv;
+
+	if (!drm_dev) {
+		DRM_ERROR("invalid params\n");
+		return;
+	}
+
+	priv = drm_dev->dev_private;
+	kms = priv->kms;
+
+	if (kms->dump_worker)
+		kthread_destroy_worker(kms->dump_worker);
+
+	mutex_destroy(&kms->dump_mutex);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/msm_disp_snapshot.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/msm_disp_snapshot.h
@@ -0,0 +1,144 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef MSM_DISP_SNAPSHOT_H_
+#define MSM_DISP_SNAPSHOT_H_
+
+#include <drm/drm_atomic_helper.h>
+#include <drm/drm_device.h>
+#include "../../../drm_crtc_internal.h"
+#include <drm/drm_print.h>
+#include <drm/drm_atomic.h>
+#include <linux/debugfs.h>
+#include <linux/list.h>
+#include <linux/delay.h>
+#include <linux/spinlock.h>
+#include <linux/ktime.h>
+#include <linux/uaccess.h>
+#include <linux/dma-buf.h>
+#include <linux/slab.h>
+#include <linux/list_sort.h>
+#include <linux/pm.h>
+#include <linux/pm_runtime.h>
+#include <linux/kthread.h>
+#include <linux/devcoredump.h>
+#include "msm_kms.h"
+
+#define MSM_DISP_SNAPSHOT_MAX_BLKS		10
+
+/* debug option to print the registers in logs */
+#define MSM_DISP_SNAPSHOT_DUMP_IN_CONSOLE 0
+
+/* print debug ranges in groups of 4 u32s */
+#define REG_DUMP_ALIGN		16
+
+/**
+ * struct msm_disp_state - structure to store current dpu state
+ * @dev: device pointer
+ * @drm_dev: drm device pointer
+ * @atomic_state: atomic state duplicated at the time of the error
+ * @time: timestamp at which the coredump was captured
+ */
+struct msm_disp_state {
+	struct device *dev;
+	struct drm_device *drm_dev;
+
+	struct list_head blocks;
+
+	struct drm_atomic_state *atomic_state;
+
+	struct timespec64 time;
+};
+
+/**
+ * struct msm_disp_state_block - structure to store each hardware block state
+ * @name: name of the block
+ * @drm_dev: handle to the linked list head
+ * @size: size of the register space of this hardware block
+ * @state: array holding the register dump of this hardware block
+ * @base_addr: starting address of this hardware block's register space
+ */
+struct msm_disp_state_block {
+	char name[SZ_128];
+	struct list_head node;
+	unsigned int size;
+	u32 *state;
+	void __iomem *base_addr;
+};
+
+/**
+ * msm_disp_snapshot_init - initialize display snapshot
+ * @drm_dev:	drm device handle
+ *
+ * Returns:		0 or -ERROR
+ */
+int msm_disp_snapshot_init(struct drm_device *drm_dev);
+
+/**
+ * msm_disp_snapshot_destroy - destroy the display snapshot
+ * @drm_dev:    drm device handle
+ *
+ * Returns:	none
+ */
+void msm_disp_snapshot_destroy(struct drm_device *drm_dev);
+
+/**
+ * msm_disp_snapshot_state_sync - synchronously snapshot display state
+ * @kms:  the kms object
+ *
+ * Returns state or error
+ *
+ * Must be called with &kms->dump_mutex held
+ */
+struct msm_disp_state *msm_disp_snapshot_state_sync(struct msm_kms *kms);
+
+/**
+ * msm_disp_snapshot_state - trigger to dump the display snapshot
+ * @drm_dev:	handle to drm device
+
+ * Returns:	none
+ */
+void msm_disp_snapshot_state(struct drm_device *drm_dev);
+
+/**
+ * msm_disp_state_print - print out the current dpu state
+ * @disp_state:	    handle to drm device
+ * @p:	    handle to drm printer
+ *
+ * Returns:	none
+ */
+void msm_disp_state_print(struct msm_disp_state *disp_state, struct drm_printer *p);
+
+/**
+ * msm_disp_snapshot_capture_state - utility to capture atomic state and hw registers
+ * @disp_state:	    handle to msm_disp_state struct
+
+ * Returns:	none
+ */
+void msm_disp_snapshot_capture_state(struct msm_disp_state *disp_state);
+
+/**
+ * msm_disp_state_free - free the memory after the coredump has been read
+ * @data:	    handle to struct msm_disp_state
+
+ * Returns: none
+ */
+void msm_disp_state_free(void *data);
+
+/**
+ * msm_disp_snapshot_add_block - add a hardware block with its register dump
+ * @disp_state:	    handle to struct msm_disp_state
+ * @name:           name of the hardware block
+ * @len:            size of the register space of the hardware block
+ * @base_addr:      starting address of the register space of the hardware block
+ * @fmt:            format in which the block names need to be printed
+ *
+ * Returns: none
+ */
+__printf(4, 5)
+void msm_disp_snapshot_add_block(struct msm_disp_state *disp_state, u32 len,
+		void __iomem *base_addr, const char *fmt, ...);
+
+#endif /* MSM_DISP_SNAPSHOT_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/disp/msm_disp_snapshot_util.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/disp/msm_disp_snapshot_util.c
@@ -0,0 +1,196 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+
+#include <generated/utsrelease.h>
+
+#include "msm_disp_snapshot.h"
+
+static void msm_disp_state_dump_regs(u32 **reg, u32 aligned_len, void __iomem *base_addr)
+{
+	u32 len_padded;
+	u32 num_rows;
+	u32 x0, x4, x8, xc;
+	void __iomem *addr;
+	u32 *dump_addr = NULL;
+	void __iomem *end_addr;
+	int i;
+
+	len_padded = aligned_len * REG_DUMP_ALIGN;
+	num_rows = aligned_len / REG_DUMP_ALIGN;
+
+	addr = base_addr;
+	end_addr = base_addr + aligned_len;
+
+	if (!(*reg))
+		*reg = kzalloc(len_padded, GFP_KERNEL);
+
+	if (*reg)
+		dump_addr = *reg;
+
+	for (i = 0; i < num_rows; i++) {
+		x0 = (addr < end_addr) ? readl_relaxed(addr + 0x0) : 0;
+		x4 = (addr + 0x4 < end_addr) ? readl_relaxed(addr + 0x4) : 0;
+		x8 = (addr + 0x8 < end_addr) ? readl_relaxed(addr + 0x8) : 0;
+		xc = (addr + 0xc < end_addr) ? readl_relaxed(addr + 0xc) : 0;
+
+		if (dump_addr) {
+			dump_addr[i * 4] = x0;
+			dump_addr[i * 4 + 1] = x4;
+			dump_addr[i * 4 + 2] = x8;
+			dump_addr[i * 4 + 3] = xc;
+		}
+
+		addr += REG_DUMP_ALIGN;
+	}
+}
+
+static void msm_disp_state_print_regs(u32 **reg, u32 len, void __iomem *base_addr,
+		struct drm_printer *p)
+{
+	int i;
+	u32 *dump_addr = NULL;
+	void __iomem *addr;
+	u32 num_rows;
+
+	addr = base_addr;
+	num_rows = len / REG_DUMP_ALIGN;
+
+	if (*reg)
+		dump_addr = *reg;
+
+	for (i = 0; i < num_rows; i++) {
+		drm_printf(p, "0x%lx : %08x %08x %08x %08x\n",
+				(unsigned long)(addr - base_addr),
+				dump_addr[i * 4], dump_addr[i * 4 + 1],
+				dump_addr[i * 4 + 2], dump_addr[i * 4 + 3]);
+		addr += REG_DUMP_ALIGN;
+	}
+}
+
+void msm_disp_state_print(struct msm_disp_state *state, struct drm_printer *p)
+{
+	struct msm_disp_state_block *block, *tmp;
+
+	if (!p) {
+		DRM_ERROR("invalid drm printer\n");
+		return;
+	}
+
+	drm_printf(p, "---\n");
+	drm_printf(p, "kernel: " UTS_RELEASE "\n");
+	drm_printf(p, "module: " KBUILD_MODNAME "\n");
+	drm_printf(p, "dpu devcoredump\n");
+	drm_printf(p, "time: %lld.%09ld\n",
+		state->time.tv_sec, state->time.tv_nsec);
+
+	list_for_each_entry_safe(block, tmp, &state->blocks, node) {
+		drm_printf(p, "====================%s================\n", block->name);
+		msm_disp_state_print_regs(&block->state, block->size, block->base_addr, p);
+	}
+
+	drm_printf(p, "===================dpu drm state================\n");
+
+	if (state->atomic_state)
+		drm_atomic_print_new_state(state->atomic_state, p);
+}
+
+static void msm_disp_capture_atomic_state(struct msm_disp_state *disp_state)
+{
+	struct drm_device *ddev;
+	struct drm_modeset_acquire_ctx ctx;
+
+	ktime_get_real_ts64(&disp_state->time);
+
+	ddev = disp_state->drm_dev;
+
+	drm_modeset_acquire_init(&ctx, 0);
+
+	while (drm_modeset_lock_all_ctx(ddev, &ctx) != 0)
+		drm_modeset_backoff(&ctx);
+
+	disp_state->atomic_state = drm_atomic_helper_duplicate_state(ddev,
+			&ctx);
+	drm_modeset_drop_locks(&ctx);
+	drm_modeset_acquire_fini(&ctx);
+}
+
+void msm_disp_snapshot_capture_state(struct msm_disp_state *disp_state)
+{
+	struct msm_drm_private *priv;
+	struct drm_device *drm_dev;
+	struct msm_kms *kms;
+	int i;
+
+	drm_dev = disp_state->drm_dev;
+	priv = drm_dev->dev_private;
+	kms = priv->kms;
+
+	for (i = 0; i < ARRAY_SIZE(priv->dp); i++) {
+		if (!priv->dp[i])
+			continue;
+
+		msm_dp_snapshot(disp_state, priv->dp[i]);
+	}
+
+	for (i = 0; i < ARRAY_SIZE(priv->dsi); i++) {
+		if (!priv->dsi[i])
+			continue;
+
+		msm_dsi_snapshot(disp_state, priv->dsi[i]);
+	}
+
+	if (kms->funcs->snapshot)
+		kms->funcs->snapshot(disp_state, kms);
+
+	msm_disp_capture_atomic_state(disp_state);
+}
+
+void msm_disp_state_free(void *data)
+{
+	struct msm_disp_state *disp_state = data;
+	struct msm_disp_state_block *block, *tmp;
+
+	if (disp_state->atomic_state) {
+		drm_atomic_state_put(disp_state->atomic_state);
+		disp_state->atomic_state = NULL;
+	}
+
+	list_for_each_entry_safe(block, tmp, &disp_state->blocks, node) {
+		list_del(&block->node);
+		kfree(block->state);
+		kfree(block);
+	}
+
+	kfree(disp_state);
+}
+
+void msm_disp_snapshot_add_block(struct msm_disp_state *disp_state, u32 len,
+		void __iomem *base_addr, const char *fmt, ...)
+{
+	struct msm_disp_state_block *new_blk;
+	struct va_format vaf;
+	va_list va;
+
+	new_blk = kzalloc(sizeof(struct msm_disp_state_block), GFP_KERNEL);
+	if (!new_blk)
+		return;
+
+	va_start(va, fmt);
+
+	vaf.fmt = fmt;
+	vaf.va = &va;
+	snprintf(new_blk->name, sizeof(new_blk->name), "%pV", &vaf);
+
+	va_end(va);
+
+	INIT_LIST_HEAD(&new_blk->node);
+	new_blk->size = ALIGN(len, REG_DUMP_ALIGN);
+	new_blk->base_addr = base_addr;
+
+	msm_disp_state_dump_regs(&new_blk->state, new_blk->size, base_addr);
+	list_add_tail(&new_blk->node, &disp_state->blocks);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_audio.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_audio.c
@@ -0,0 +1,581 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#define pr_fmt(fmt)	"[drm-dp] %s: " fmt, __func__
+
+#include <linux/platform_device.h>
+
+#include <drm/display/drm_dp_helper.h>
+#include <drm/drm_edid.h>
+
+#include "dp_catalog.h"
+#include "dp_audio.h"
+#include "dp_panel.h"
+#include "dp_display.h"
+#include "dp_utils.h"
+
+struct msm_dp_audio_private {
+	struct platform_device *audio_pdev;
+	struct platform_device *pdev;
+	struct drm_device *drm_dev;
+	struct msm_dp_catalog *catalog;
+
+	u32 channels;
+
+	struct msm_dp_audio msm_dp_audio;
+};
+
+static u32 msm_dp_audio_get_header(struct msm_dp_catalog *catalog,
+		enum msm_dp_catalog_audio_sdp_type sdp,
+		enum msm_dp_catalog_audio_header_type header)
+{
+	return msm_dp_catalog_audio_get_header(catalog, sdp, header);
+}
+
+static void msm_dp_audio_set_header(struct msm_dp_catalog *catalog,
+		u32 data,
+		enum msm_dp_catalog_audio_sdp_type sdp,
+		enum msm_dp_catalog_audio_header_type header)
+{
+	msm_dp_catalog_audio_set_header(catalog, sdp, header, data);
+}
+
+static void msm_dp_audio_stream_sdp(struct msm_dp_audio_private *audio)
+{
+	struct msm_dp_catalog *catalog = audio->catalog;
+	u32 value, new_value;
+	u8 parity_byte;
+
+	/* Config header and parity byte 1 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_1);
+
+	new_value = 0x02;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_1_BIT)
+			| (parity_byte << PARITY_BYTE_1_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_1);
+
+	/* Config header and parity byte 2 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_2);
+	new_value = value;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_2_BIT)
+			| (parity_byte << PARITY_BYTE_2_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_2);
+
+	/* Config header and parity byte 3 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_3);
+
+	new_value = audio->channels - 1;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_3_BIT)
+			| (parity_byte << PARITY_BYTE_3_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 3: value = 0x%x, parity_byte = 0x%x\n",
+		value, parity_byte);
+
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_STREAM, DP_AUDIO_SDP_HEADER_3);
+}
+
+static void msm_dp_audio_timestamp_sdp(struct msm_dp_audio_private *audio)
+{
+	struct msm_dp_catalog *catalog = audio->catalog;
+	u32 value, new_value;
+	u8 parity_byte;
+
+	/* Config header and parity byte 1 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_1);
+
+	new_value = 0x1;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_1_BIT)
+			| (parity_byte << PARITY_BYTE_1_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_1);
+
+	/* Config header and parity byte 2 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_2);
+
+	new_value = 0x17;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_2_BIT)
+			| (parity_byte << PARITY_BYTE_2_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_2);
+
+	/* Config header and parity byte 3 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_3);
+
+	new_value = (0x0 | (0x11 << 2));
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_3_BIT)
+			| (parity_byte << PARITY_BYTE_3_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 3: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_TIMESTAMP, DP_AUDIO_SDP_HEADER_3);
+}
+
+static void msm_dp_audio_infoframe_sdp(struct msm_dp_audio_private *audio)
+{
+	struct msm_dp_catalog *catalog = audio->catalog;
+	u32 value, new_value;
+	u8 parity_byte;
+
+	/* Config header and parity byte 1 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_1);
+
+	new_value = 0x84;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_1_BIT)
+			| (parity_byte << PARITY_BYTE_1_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_1);
+
+	/* Config header and parity byte 2 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_2);
+
+	new_value = 0x1b;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_2_BIT)
+			| (parity_byte << PARITY_BYTE_2_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_2);
+
+	/* Config header and parity byte 3 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_3);
+
+	new_value = (0x0 | (0x11 << 2));
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_3_BIT)
+			| (parity_byte << PARITY_BYTE_3_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 3: value = 0x%x, parity_byte = 0x%x\n",
+			new_value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_INFOFRAME, DP_AUDIO_SDP_HEADER_3);
+}
+
+static void msm_dp_audio_copy_management_sdp(struct msm_dp_audio_private *audio)
+{
+	struct msm_dp_catalog *catalog = audio->catalog;
+	u32 value, new_value;
+	u8 parity_byte;
+
+	/* Config header and parity byte 1 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_1);
+
+	new_value = 0x05;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_1_BIT)
+			| (parity_byte << PARITY_BYTE_1_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_1);
+
+	/* Config header and parity byte 2 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_2);
+
+	new_value = 0x0F;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_2_BIT)
+			| (parity_byte << PARITY_BYTE_2_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_2);
+
+	/* Config header and parity byte 3 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_3);
+
+	new_value = 0x0;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_3_BIT)
+			| (parity_byte << PARITY_BYTE_3_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 3: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_COPYMANAGEMENT, DP_AUDIO_SDP_HEADER_3);
+}
+
+static void msm_dp_audio_isrc_sdp(struct msm_dp_audio_private *audio)
+{
+	struct msm_dp_catalog *catalog = audio->catalog;
+	u32 value, new_value;
+	u8 parity_byte;
+
+	/* Config header and parity byte 1 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_ISRC, DP_AUDIO_SDP_HEADER_1);
+
+	new_value = 0x06;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_1_BIT)
+			| (parity_byte << PARITY_BYTE_1_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 1: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_ISRC, DP_AUDIO_SDP_HEADER_1);
+
+	/* Config header and parity byte 2 */
+	value = msm_dp_audio_get_header(catalog,
+			DP_AUDIO_SDP_ISRC, DP_AUDIO_SDP_HEADER_2);
+
+	new_value = 0x0F;
+	parity_byte = msm_dp_utils_calculate_parity(new_value);
+	value |= ((new_value << HEADER_BYTE_2_BIT)
+			| (parity_byte << PARITY_BYTE_2_BIT));
+	drm_dbg_dp(audio->drm_dev,
+			"Header Byte 2: value = 0x%x, parity_byte = 0x%x\n",
+			value, parity_byte);
+	msm_dp_audio_set_header(catalog, value,
+		DP_AUDIO_SDP_ISRC, DP_AUDIO_SDP_HEADER_2);
+}
+
+static void msm_dp_audio_setup_sdp(struct msm_dp_audio_private *audio)
+{
+	msm_dp_catalog_audio_config_sdp(audio->catalog);
+
+	msm_dp_audio_stream_sdp(audio);
+	msm_dp_audio_timestamp_sdp(audio);
+	msm_dp_audio_infoframe_sdp(audio);
+	msm_dp_audio_copy_management_sdp(audio);
+	msm_dp_audio_isrc_sdp(audio);
+}
+
+static void msm_dp_audio_setup_acr(struct msm_dp_audio_private *audio)
+{
+	u32 select = 0;
+	struct msm_dp_catalog *catalog = audio->catalog;
+
+	switch (audio->msm_dp_audio.bw_code) {
+	case DP_LINK_BW_1_62:
+		select = 0;
+		break;
+	case DP_LINK_BW_2_7:
+		select = 1;
+		break;
+	case DP_LINK_BW_5_4:
+		select = 2;
+		break;
+	case DP_LINK_BW_8_1:
+		select = 3;
+		break;
+	default:
+		drm_dbg_dp(audio->drm_dev, "Unknown link rate\n");
+		select = 0;
+		break;
+	}
+
+	msm_dp_catalog_audio_config_acr(catalog, select);
+}
+
+static void msm_dp_audio_safe_to_exit_level(struct msm_dp_audio_private *audio)
+{
+	struct msm_dp_catalog *catalog = audio->catalog;
+	u32 safe_to_exit_level = 0;
+
+	switch (audio->msm_dp_audio.lane_count) {
+	case 1:
+		safe_to_exit_level = 14;
+		break;
+	case 2:
+		safe_to_exit_level = 8;
+		break;
+	case 4:
+		safe_to_exit_level = 5;
+		break;
+	default:
+		drm_dbg_dp(audio->drm_dev,
+				"setting the default safe_to_exit_level = %u\n",
+				safe_to_exit_level);
+		safe_to_exit_level = 14;
+		break;
+	}
+
+	msm_dp_catalog_audio_sfe_level(catalog, safe_to_exit_level);
+}
+
+static void msm_dp_audio_enable(struct msm_dp_audio_private *audio, bool enable)
+{
+	struct msm_dp_catalog *catalog = audio->catalog;
+
+	msm_dp_catalog_audio_enable(catalog, enable);
+}
+
+static struct msm_dp_audio_private *msm_dp_audio_get_data(struct platform_device *pdev)
+{
+	struct msm_dp_audio *msm_dp_audio;
+	struct msm_dp *msm_dp_display;
+
+	if (!pdev) {
+		DRM_ERROR("invalid input\n");
+		return ERR_PTR(-ENODEV);
+	}
+
+	msm_dp_display = platform_get_drvdata(pdev);
+	if (!msm_dp_display) {
+		DRM_ERROR("invalid input\n");
+		return ERR_PTR(-ENODEV);
+	}
+
+	msm_dp_audio = msm_dp_display->msm_dp_audio;
+
+	if (!msm_dp_audio) {
+		DRM_ERROR("invalid msm_dp_audio data\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	return container_of(msm_dp_audio, struct msm_dp_audio_private, msm_dp_audio);
+}
+
+static int msm_dp_audio_hook_plugged_cb(struct device *dev, void *data,
+		hdmi_codec_plugged_cb fn,
+		struct device *codec_dev)
+{
+
+	struct platform_device *pdev;
+	struct msm_dp *msm_dp_display;
+
+	pdev = to_platform_device(dev);
+	if (!pdev) {
+		pr_err("invalid input\n");
+		return -ENODEV;
+	}
+
+	msm_dp_display = platform_get_drvdata(pdev);
+	if (!msm_dp_display) {
+		pr_err("invalid input\n");
+		return -ENODEV;
+	}
+
+	return msm_dp_display_set_plugged_cb(msm_dp_display, fn, codec_dev);
+}
+
+static int msm_dp_audio_get_eld(struct device *dev,
+	void *data, uint8_t *buf, size_t len)
+{
+	struct platform_device *pdev;
+	struct msm_dp *msm_dp_display;
+
+	pdev = to_platform_device(dev);
+
+	if (!pdev) {
+		DRM_ERROR("invalid input\n");
+		return -ENODEV;
+	}
+
+	msm_dp_display = platform_get_drvdata(pdev);
+	if (!msm_dp_display) {
+		DRM_ERROR("invalid input\n");
+		return -ENODEV;
+	}
+
+	memcpy(buf, msm_dp_display->connector->eld,
+		min(sizeof(msm_dp_display->connector->eld), len));
+
+	return 0;
+}
+
+int msm_dp_audio_hw_params(struct device *dev,
+	void *data,
+	struct hdmi_codec_daifmt *daifmt,
+	struct hdmi_codec_params *params)
+{
+	int rc = 0;
+	struct msm_dp_audio_private *audio;
+	struct platform_device *pdev;
+	struct msm_dp *msm_dp_display;
+
+	pdev = to_platform_device(dev);
+	msm_dp_display = platform_get_drvdata(pdev);
+
+	/*
+	 * there could be cases where sound card can be opened even
+	 * before OR even when DP is not connected . This can cause
+	 * unclocked access as the audio subsystem relies on the DP
+	 * driver to maintain the correct state of clocks. To protect
+	 * such cases check for connection status and bail out if not
+	 * connected.
+	 */
+	if (!msm_dp_display_get_active_stream_cnt(msm_dp_display)) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	audio = msm_dp_audio_get_data(pdev);
+	if (IS_ERR(audio)) {
+		rc = PTR_ERR(audio);
+		goto end;
+	}
+
+	audio->channels = params->channels;
+
+	msm_dp_audio_setup_sdp(audio);
+	msm_dp_audio_setup_acr(audio);
+	msm_dp_audio_safe_to_exit_level(audio);
+	msm_dp_audio_enable(audio, true);
+	msm_dp_display_signal_audio_start(msm_dp_display);
+	msm_dp_display->audio_enabled = true;
+
+end:
+	return rc;
+}
+
+static void msm_dp_audio_shutdown(struct device *dev, void *data)
+{
+	struct msm_dp_audio_private *audio;
+	struct platform_device *pdev;
+	struct msm_dp *msm_dp_display;
+
+	pdev = to_platform_device(dev);
+	msm_dp_display = platform_get_drvdata(pdev);
+	audio = msm_dp_audio_get_data(pdev);
+	if (IS_ERR(audio)) {
+		DRM_ERROR("failed to get audio data\n");
+		return;
+	}
+
+	/*
+	 * if audio was not enabled there is no need
+	 * to execute the shutdown and we can bail out early.
+	 * This also makes sure that we dont cause an unclocked
+	 * access when audio subsystem calls this without DP being
+	 * connected. is_connected cannot be used here as its set
+	 * to false earlier than this call
+	 */
+	if (!msm_dp_display->audio_enabled)
+		return;
+
+	msm_dp_audio_enable(audio, false);
+	/* signal the dp display to safely shutdown clocks */
+	msm_dp_display_signal_audio_complete(msm_dp_display);
+}
+
+static const struct hdmi_codec_ops msm_dp_audio_codec_ops = {
+	.hw_params = msm_dp_audio_hw_params,
+	.audio_shutdown = msm_dp_audio_shutdown,
+	.get_eld = msm_dp_audio_get_eld,
+	.hook_plugged_cb = msm_dp_audio_hook_plugged_cb,
+};
+
+static struct hdmi_codec_pdata codec_data = {
+	.ops = &msm_dp_audio_codec_ops,
+	.max_i2s_channels = 8,
+	.i2s = 1,
+};
+
+void msm_dp_unregister_audio_driver(struct device *dev, struct msm_dp_audio *msm_dp_audio)
+{
+	struct msm_dp_audio_private *audio_priv;
+
+	audio_priv = container_of(msm_dp_audio, struct msm_dp_audio_private, msm_dp_audio);
+
+	if (audio_priv->audio_pdev) {
+		platform_device_unregister(audio_priv->audio_pdev);
+		audio_priv->audio_pdev = NULL;
+	}
+}
+
+int msm_dp_register_audio_driver(struct device *dev,
+		struct msm_dp_audio *msm_dp_audio)
+{
+	struct msm_dp_audio_private *audio_priv;
+
+	audio_priv = container_of(msm_dp_audio,
+			struct msm_dp_audio_private, msm_dp_audio);
+
+	audio_priv->audio_pdev = platform_device_register_data(dev,
+						HDMI_CODEC_DRV_NAME,
+						PLATFORM_DEVID_AUTO,
+						&codec_data,
+						sizeof(codec_data));
+	return PTR_ERR_OR_ZERO(audio_priv->audio_pdev);
+}
+
+struct msm_dp_audio *msm_dp_audio_get(struct platform_device *pdev,
+			struct msm_dp_panel *panel,
+			struct msm_dp_catalog *catalog)
+{
+	int rc = 0;
+	struct msm_dp_audio_private *audio;
+	struct msm_dp_audio *msm_dp_audio;
+
+	if (!pdev || !panel || !catalog) {
+		DRM_ERROR("invalid input\n");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	audio = devm_kzalloc(&pdev->dev, sizeof(*audio), GFP_KERNEL);
+	if (!audio) {
+		rc = -ENOMEM;
+		goto error;
+	}
+
+	audio->pdev = pdev;
+	audio->catalog = catalog;
+
+	msm_dp_audio = &audio->msm_dp_audio;
+
+	msm_dp_catalog_audio_init(catalog);
+
+	return msm_dp_audio;
+error:
+	return ERR_PTR(rc);
+}
+
+void msm_dp_audio_put(struct msm_dp_audio *msm_dp_audio)
+{
+	struct msm_dp_audio_private *audio;
+
+	if (!msm_dp_audio)
+		return;
+
+	audio = container_of(msm_dp_audio, struct msm_dp_audio_private, msm_dp_audio);
+
+	devm_kfree(&audio->pdev->dev, audio);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_audio.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_audio.h
@@ -0,0 +1,74 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_AUDIO_H_
+#define _DP_AUDIO_H_
+
+#include <linux/platform_device.h>
+
+#include "dp_panel.h"
+#include "dp_catalog.h"
+#include <sound/hdmi-codec.h>
+
+/**
+ * struct msm_dp_audio
+ * @lane_count: number of lanes configured in current session
+ * @bw_code: link rate's bandwidth code for current session
+ */
+struct msm_dp_audio {
+	u32 lane_count;
+	u32 bw_code;
+};
+
+/**
+ * msm_dp_audio_get()
+ *
+ * Creates and instance of dp audio.
+ *
+ * @pdev: caller's platform device instance.
+ * @panel: an instance of msm_dp_panel module.
+ * @catalog: an instance of msm_dp_catalog module.
+ *
+ * Returns the error code in case of failure, otherwize
+ * an instance of newly created msm_dp_module.
+ */
+struct msm_dp_audio *msm_dp_audio_get(struct platform_device *pdev,
+			struct msm_dp_panel *panel,
+			struct msm_dp_catalog *catalog);
+
+/**
+ * msm_dp_register_audio_driver()
+ *
+ * Registers DP device with hdmi_codec interface.
+ *
+ * @dev: DP device instance.
+ * @msm_dp_audio: an instance of msm_dp_audio module.
+ *
+ *
+ * Returns the error code in case of failure, otherwise
+ * zero on success.
+ */
+int msm_dp_register_audio_driver(struct device *dev,
+		struct msm_dp_audio *msm_dp_audio);
+
+void msm_dp_unregister_audio_driver(struct device *dev, struct msm_dp_audio *msm_dp_audio);
+
+/**
+ * msm_dp_audio_put()
+ *
+ * Cleans the msm_dp_audio instance.
+ *
+ * @msm_dp_audio: an instance of msm_dp_audio.
+ */
+void msm_dp_audio_put(struct msm_dp_audio *msm_dp_audio);
+
+int msm_dp_audio_hw_params(struct device *dev,
+	void *data,
+	struct hdmi_codec_daifmt *daifmt,
+	struct hdmi_codec_params *params);
+
+#endif /* _DP_AUDIO_H_ */
+
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_aux.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_aux.c
@@ -0,0 +1,578 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/phy/phy.h>
+#include <drm/drm_print.h>
+
+#include "dp_reg.h"
+#include "dp_aux.h"
+
+enum msm_dp_aux_err {
+	DP_AUX_ERR_NONE,
+	DP_AUX_ERR_ADDR,
+	DP_AUX_ERR_TOUT,
+	DP_AUX_ERR_NACK,
+	DP_AUX_ERR_DEFER,
+	DP_AUX_ERR_NACK_DEFER,
+	DP_AUX_ERR_PHY,
+};
+
+struct msm_dp_aux_private {
+	struct device *dev;
+	struct msm_dp_catalog *catalog;
+
+	struct phy *phy;
+
+	struct mutex mutex;
+	struct completion comp;
+
+	enum msm_dp_aux_err aux_error_num;
+	u32 retry_cnt;
+	bool cmd_busy;
+	bool native;
+	bool read;
+	bool no_send_addr;
+	bool no_send_stop;
+	bool initted;
+	bool is_edp;
+	bool enable_xfers;
+	u32 offset;
+	u32 segment;
+
+	struct drm_dp_aux msm_dp_aux;
+};
+
+#define MAX_AUX_RETRIES			5
+
+static ssize_t msm_dp_aux_write(struct msm_dp_aux_private *aux,
+			struct drm_dp_aux_msg *msg)
+{
+	u8 data[4];
+	u32 reg;
+	ssize_t len;
+	u8 *msgdata = msg->buffer;
+	int const AUX_CMD_FIFO_LEN = 128;
+	int i = 0;
+
+	if (aux->read)
+		len = 0;
+	else
+		len = msg->size;
+
+	/*
+	 * cmd fifo only has depth of 144 bytes
+	 * limit buf length to 128 bytes here
+	 */
+	if (len > AUX_CMD_FIFO_LEN - 4) {
+		DRM_ERROR("buf size greater than allowed size of 128 bytes\n");
+		return -EINVAL;
+	}
+
+	/* Pack cmd and write to HW */
+	data[0] = (msg->address >> 16) & 0xf;	/* addr[19:16] */
+	if (aux->read)
+		data[0] |=  BIT(4);		/* R/W */
+
+	data[1] = msg->address >> 8;		/* addr[15:8] */
+	data[2] = msg->address;			/* addr[7:0] */
+	data[3] = msg->size - 1;		/* len[7:0] */
+
+	for (i = 0; i < len + 4; i++) {
+		reg = (i < 4) ? data[i] : msgdata[i - 4];
+		reg <<= DP_AUX_DATA_OFFSET;
+		reg &= DP_AUX_DATA_MASK;
+		reg |= DP_AUX_DATA_WRITE;
+		/* index = 0, write */
+		if (i == 0)
+			reg |= DP_AUX_DATA_INDEX_WRITE;
+		msm_dp_catalog_aux_write_data(aux->catalog, reg);
+	}
+
+	msm_dp_catalog_aux_clear_trans(aux->catalog, false);
+	msm_dp_catalog_aux_clear_hw_interrupts(aux->catalog);
+
+	reg = 0; /* Transaction number == 1 */
+	if (!aux->native) { /* i2c */
+		reg |= DP_AUX_TRANS_CTRL_I2C;
+
+		if (aux->no_send_addr)
+			reg |= DP_AUX_TRANS_CTRL_NO_SEND_ADDR;
+
+		if (aux->no_send_stop)
+			reg |= DP_AUX_TRANS_CTRL_NO_SEND_STOP;
+	}
+
+	reg |= DP_AUX_TRANS_CTRL_GO;
+	msm_dp_catalog_aux_write_trans(aux->catalog, reg);
+
+	return len;
+}
+
+static ssize_t msm_dp_aux_cmd_fifo_tx(struct msm_dp_aux_private *aux,
+			      struct drm_dp_aux_msg *msg)
+{
+	ssize_t ret;
+	unsigned long time_left;
+
+	reinit_completion(&aux->comp);
+
+	ret = msm_dp_aux_write(aux, msg);
+	if (ret < 0)
+		return ret;
+
+	time_left = wait_for_completion_timeout(&aux->comp,
+						msecs_to_jiffies(250));
+	if (!time_left)
+		return -ETIMEDOUT;
+
+	return ret;
+}
+
+static ssize_t msm_dp_aux_cmd_fifo_rx(struct msm_dp_aux_private *aux,
+		struct drm_dp_aux_msg *msg)
+{
+	u32 data;
+	u8 *dp;
+	u32 i, actual_i;
+	u32 len = msg->size;
+
+	msm_dp_catalog_aux_clear_trans(aux->catalog, true);
+
+	data = DP_AUX_DATA_INDEX_WRITE; /* INDEX_WRITE */
+	data |= DP_AUX_DATA_READ;  /* read */
+
+	msm_dp_catalog_aux_write_data(aux->catalog, data);
+
+	dp = msg->buffer;
+
+	/* discard first byte */
+	data = msm_dp_catalog_aux_read_data(aux->catalog);
+
+	for (i = 0; i < len; i++) {
+		data = msm_dp_catalog_aux_read_data(aux->catalog);
+		*dp++ = (u8)((data >> DP_AUX_DATA_OFFSET) & 0xff);
+
+		actual_i = (data >> DP_AUX_DATA_INDEX_OFFSET) & 0xFF;
+		if (i != actual_i)
+			break;
+	}
+
+	return i;
+}
+
+static void msm_dp_aux_update_offset_and_segment(struct msm_dp_aux_private *aux,
+					     struct drm_dp_aux_msg *input_msg)
+{
+	u32 edid_address = 0x50;
+	u32 segment_address = 0x30;
+	bool i2c_read = input_msg->request &
+		(DP_AUX_I2C_READ & DP_AUX_NATIVE_READ);
+	u8 *data;
+
+	if (aux->native || i2c_read || ((input_msg->address != edid_address) &&
+		(input_msg->address != segment_address)))
+		return;
+
+
+	data = input_msg->buffer;
+	if (input_msg->address == segment_address)
+		aux->segment = *data;
+	else
+		aux->offset = *data;
+}
+
+/**
+ * msm_dp_aux_transfer_helper() - helper function for EDID read transactions
+ *
+ * @aux: DP AUX private structure
+ * @input_msg: input message from DRM upstream APIs
+ * @send_seg: send the segment to sink
+ *
+ * return: void
+ *
+ * This helper function is used to fix EDID reads for non-compliant
+ * sinks that do not handle the i2c middle-of-transaction flag correctly.
+ */
+static void msm_dp_aux_transfer_helper(struct msm_dp_aux_private *aux,
+				   struct drm_dp_aux_msg *input_msg,
+				   bool send_seg)
+{
+	struct drm_dp_aux_msg helper_msg;
+	u32 message_size = 0x10;
+	u32 segment_address = 0x30;
+	u32 const edid_block_length = 0x80;
+	bool i2c_mot = input_msg->request & DP_AUX_I2C_MOT;
+	bool i2c_read = input_msg->request &
+		(DP_AUX_I2C_READ & DP_AUX_NATIVE_READ);
+
+	if (!i2c_mot || !i2c_read || (input_msg->size == 0))
+		return;
+
+	/*
+	 * Sending the segment value and EDID offset will be performed
+	 * from the DRM upstream EDID driver for each block. Avoid
+	 * duplicate AUX transactions related to this while reading the
+	 * first 16 bytes of each block.
+	 */
+	if (!(aux->offset % edid_block_length) || !send_seg)
+		goto end;
+
+	aux->read = false;
+	aux->cmd_busy = true;
+	aux->no_send_addr = true;
+	aux->no_send_stop = true;
+
+	/*
+	 * Send the segment address for every i2c read in which the
+	 * middle-of-tranaction flag is set. This is required to support EDID
+	 * reads of more than 2 blocks as the segment address is reset to 0
+	 * since we are overriding the middle-of-transaction flag for read
+	 * transactions.
+	 */
+
+	if (aux->segment) {
+		memset(&helper_msg, 0, sizeof(helper_msg));
+		helper_msg.address = segment_address;
+		helper_msg.buffer = &aux->segment;
+		helper_msg.size = 1;
+		msm_dp_aux_cmd_fifo_tx(aux, &helper_msg);
+	}
+
+	/*
+	 * Send the offset address for every i2c read in which the
+	 * middle-of-transaction flag is set. This will ensure that the sink
+	 * will update its read pointer and return the correct portion of the
+	 * EDID buffer in the subsequent i2c read trasntion triggered in the
+	 * native AUX transfer function.
+	 */
+	memset(&helper_msg, 0, sizeof(helper_msg));
+	helper_msg.address = input_msg->address;
+	helper_msg.buffer = &aux->offset;
+	helper_msg.size = 1;
+	msm_dp_aux_cmd_fifo_tx(aux, &helper_msg);
+
+end:
+	aux->offset += message_size;
+	if (aux->offset == 0x80 || aux->offset == 0x100)
+		aux->segment = 0x0; /* reset segment at end of block */
+}
+
+/*
+ * This function does the real job to process an AUX transaction.
+ * It will call aux_reset() function to reset the AUX channel,
+ * if the waiting is timeout.
+ */
+static ssize_t msm_dp_aux_transfer(struct drm_dp_aux *msm_dp_aux,
+			       struct drm_dp_aux_msg *msg)
+{
+	ssize_t ret;
+	int const aux_cmd_native_max = 16;
+	int const aux_cmd_i2c_max = 128;
+	struct msm_dp_aux_private *aux;
+
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
+
+	aux->native = msg->request & (DP_AUX_NATIVE_WRITE & DP_AUX_NATIVE_READ);
+
+	/* Ignore address only message */
+	if (msg->size == 0 || !msg->buffer) {
+		msg->reply = aux->native ?
+			DP_AUX_NATIVE_REPLY_ACK : DP_AUX_I2C_REPLY_ACK;
+		return msg->size;
+	}
+
+	/* msg sanity check */
+	if ((aux->native && msg->size > aux_cmd_native_max) ||
+	    msg->size > aux_cmd_i2c_max) {
+		DRM_ERROR("%s: invalid msg: size(%zu), request(%x)\n",
+			__func__, msg->size, msg->request);
+		return -EINVAL;
+	}
+
+	ret = pm_runtime_resume_and_get(msm_dp_aux->dev);
+	if (ret)
+		return  ret;
+
+	mutex_lock(&aux->mutex);
+	if (!aux->initted) {
+		ret = -EIO;
+		goto exit;
+	}
+
+	/*
+	 * If we're using DP and an external display isn't connected then the
+	 * transfer won't succeed. Return right away. If we don't do this we
+	 * can end up with long timeouts if someone tries to access the DP AUX
+	 * character device when no DP device is connected.
+	 */
+	if (!aux->is_edp && !aux->enable_xfers) {
+		ret = -ENXIO;
+		goto exit;
+	}
+
+	msm_dp_aux_update_offset_and_segment(aux, msg);
+	msm_dp_aux_transfer_helper(aux, msg, true);
+
+	aux->read = msg->request & (DP_AUX_I2C_READ & DP_AUX_NATIVE_READ);
+	aux->cmd_busy = true;
+
+	if (aux->read) {
+		aux->no_send_addr = true;
+		aux->no_send_stop = false;
+	} else {
+		aux->no_send_addr = true;
+		aux->no_send_stop = true;
+	}
+
+	ret = msm_dp_aux_cmd_fifo_tx(aux, msg);
+	if (ret < 0) {
+		if (aux->native) {
+			aux->retry_cnt++;
+			if (!(aux->retry_cnt % MAX_AUX_RETRIES))
+				phy_calibrate(aux->phy);
+		}
+		/* reset aux if link is in connected state */
+		if (msm_dp_catalog_link_is_connected(aux->catalog))
+			msm_dp_catalog_aux_reset(aux->catalog);
+	} else {
+		aux->retry_cnt = 0;
+		switch (aux->aux_error_num) {
+		case DP_AUX_ERR_NONE:
+			if (aux->read)
+				ret = msm_dp_aux_cmd_fifo_rx(aux, msg);
+			msg->reply = aux->native ? DP_AUX_NATIVE_REPLY_ACK : DP_AUX_I2C_REPLY_ACK;
+			break;
+		case DP_AUX_ERR_DEFER:
+			msg->reply = aux->native ? DP_AUX_NATIVE_REPLY_DEFER : DP_AUX_I2C_REPLY_DEFER;
+			break;
+		case DP_AUX_ERR_PHY:
+		case DP_AUX_ERR_ADDR:
+		case DP_AUX_ERR_NACK:
+		case DP_AUX_ERR_NACK_DEFER:
+			msg->reply = aux->native ? DP_AUX_NATIVE_REPLY_NACK : DP_AUX_I2C_REPLY_NACK;
+			break;
+		case DP_AUX_ERR_TOUT:
+			ret = -ETIMEDOUT;
+			break;
+		}
+	}
+
+	aux->cmd_busy = false;
+
+exit:
+	mutex_unlock(&aux->mutex);
+	pm_runtime_put_sync(msm_dp_aux->dev);
+
+	return ret;
+}
+
+irqreturn_t msm_dp_aux_isr(struct drm_dp_aux *msm_dp_aux)
+{
+	u32 isr;
+	struct msm_dp_aux_private *aux;
+
+	if (!msm_dp_aux) {
+		DRM_ERROR("invalid input\n");
+		return IRQ_NONE;
+	}
+
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
+
+	isr = msm_dp_catalog_aux_get_irq(aux->catalog);
+
+	/* no interrupts pending, return immediately */
+	if (!isr)
+		return IRQ_NONE;
+
+	if (!aux->cmd_busy) {
+		DRM_ERROR("Unexpected DP AUX IRQ %#010x when not busy\n", isr);
+		return IRQ_NONE;
+	}
+
+	/*
+	 * The logic below assumes only one error bit is set (other than "done"
+	 * which can apparently be set at the same time as some of the other
+	 * bits). Warn if more than one get set so we know we need to improve
+	 * the logic.
+	 */
+	if (hweight32(isr & ~DP_INTR_AUX_XFER_DONE) > 1)
+		DRM_WARN("Some DP AUX interrupts unhandled: %#010x\n", isr);
+
+	if (isr & DP_INTR_AUX_ERROR) {
+		aux->aux_error_num = DP_AUX_ERR_PHY;
+		msm_dp_catalog_aux_clear_hw_interrupts(aux->catalog);
+	} else if (isr & DP_INTR_NACK_DEFER) {
+		aux->aux_error_num = DP_AUX_ERR_NACK_DEFER;
+	} else if (isr & DP_INTR_WRONG_ADDR) {
+		aux->aux_error_num = DP_AUX_ERR_ADDR;
+	} else if (isr & DP_INTR_TIMEOUT) {
+		aux->aux_error_num = DP_AUX_ERR_TOUT;
+	} else if (!aux->native && (isr & DP_INTR_I2C_NACK)) {
+		aux->aux_error_num = DP_AUX_ERR_NACK;
+	} else if (!aux->native && (isr & DP_INTR_I2C_DEFER)) {
+		if (isr & DP_INTR_AUX_XFER_DONE)
+			aux->aux_error_num = DP_AUX_ERR_NACK;
+		else
+			aux->aux_error_num = DP_AUX_ERR_DEFER;
+	} else if (isr & DP_INTR_AUX_XFER_DONE) {
+		aux->aux_error_num = DP_AUX_ERR_NONE;
+	} else {
+		DRM_WARN("Unexpected interrupt: %#010x\n", isr);
+		return IRQ_NONE;
+	}
+
+	complete(&aux->comp);
+
+	return IRQ_HANDLED;
+}
+
+void msm_dp_aux_enable_xfers(struct drm_dp_aux *msm_dp_aux, bool enabled)
+{
+	struct msm_dp_aux_private *aux;
+
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
+	aux->enable_xfers = enabled;
+}
+
+void msm_dp_aux_reconfig(struct drm_dp_aux *msm_dp_aux)
+{
+	struct msm_dp_aux_private *aux;
+
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
+
+	phy_calibrate(aux->phy);
+	msm_dp_catalog_aux_reset(aux->catalog);
+}
+
+void msm_dp_aux_init(struct drm_dp_aux *msm_dp_aux)
+{
+	struct msm_dp_aux_private *aux;
+
+	if (!msm_dp_aux) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
+
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
+
+	mutex_lock(&aux->mutex);
+
+	msm_dp_catalog_aux_enable(aux->catalog, true);
+	aux->retry_cnt = 0;
+	aux->initted = true;
+
+	mutex_unlock(&aux->mutex);
+}
+
+void msm_dp_aux_deinit(struct drm_dp_aux *msm_dp_aux)
+{
+	struct msm_dp_aux_private *aux;
+
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
+
+	mutex_lock(&aux->mutex);
+
+	aux->initted = false;
+	msm_dp_catalog_aux_enable(aux->catalog, false);
+
+	mutex_unlock(&aux->mutex);
+}
+
+int msm_dp_aux_register(struct drm_dp_aux *msm_dp_aux)
+{
+	int ret;
+
+	if (!msm_dp_aux) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	ret = drm_dp_aux_register(msm_dp_aux);
+	if (ret) {
+		DRM_ERROR("%s: failed to register drm aux: %d\n", __func__,
+				ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+void msm_dp_aux_unregister(struct drm_dp_aux *msm_dp_aux)
+{
+	drm_dp_aux_unregister(msm_dp_aux);
+}
+
+static int msm_dp_wait_hpd_asserted(struct drm_dp_aux *msm_dp_aux,
+				 unsigned long wait_us)
+{
+	int ret;
+	struct msm_dp_aux_private *aux;
+
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
+
+	pm_runtime_get_sync(aux->dev);
+	ret = pm_runtime_resume_and_get(aux->dev);
+	if (ret)
+		return ret;
+
+	ret = msm_dp_catalog_aux_wait_for_hpd_connect_state(aux->catalog, wait_us);
+	pm_runtime_put_sync(aux->dev);
+
+	return ret;
+}
+
+struct drm_dp_aux *msm_dp_aux_get(struct device *dev, struct msm_dp_catalog *catalog,
+			      struct phy *phy,
+			      bool is_edp)
+{
+	struct msm_dp_aux_private *aux;
+
+	if (!catalog) {
+		DRM_ERROR("invalid input\n");
+		return ERR_PTR(-ENODEV);
+	}
+
+	aux = devm_kzalloc(dev, sizeof(*aux), GFP_KERNEL);
+	if (!aux)
+		return ERR_PTR(-ENOMEM);
+
+	init_completion(&aux->comp);
+	aux->cmd_busy = false;
+	aux->is_edp = is_edp;
+	mutex_init(&aux->mutex);
+
+	aux->dev = dev;
+	aux->catalog = catalog;
+	aux->phy = phy;
+	aux->retry_cnt = 0;
+
+	/*
+	 * Use the drm_dp_aux_init() to use the aux adapter
+	 * before registering AUX with the DRM device so that
+	 * msm eDP panel can be detected by generic_dep_panel_probe().
+	 */
+	aux->msm_dp_aux.name = "dpu_dp_aux";
+	aux->msm_dp_aux.dev = dev;
+	aux->msm_dp_aux.transfer = msm_dp_aux_transfer;
+	aux->msm_dp_aux.wait_hpd_asserted = msm_dp_wait_hpd_asserted;
+	drm_dp_aux_init(&aux->msm_dp_aux);
+
+	return &aux->msm_dp_aux;
+}
+
+void msm_dp_aux_put(struct drm_dp_aux *msm_dp_aux)
+{
+	struct msm_dp_aux_private *aux;
+
+	if (!msm_dp_aux)
+		return;
+
+	aux = container_of(msm_dp_aux, struct msm_dp_aux_private, msm_dp_aux);
+
+	mutex_destroy(&aux->mutex);
+
+	devm_kfree(aux->dev, aux);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_aux.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_aux.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_AUX_H_
+#define _DP_AUX_H_
+
+#include "dp_catalog.h"
+#include <drm/display/drm_dp_helper.h>
+#include <drm/display/drm_dp_mst_helper.h>
+
+int msm_dp_aux_register(struct drm_dp_aux *msm_dp_aux);
+void msm_dp_aux_unregister(struct drm_dp_aux *msm_dp_aux);
+irqreturn_t msm_dp_aux_isr(struct drm_dp_aux *msm_dp_aux);
+void msm_dp_aux_enable_xfers(struct drm_dp_aux *msm_dp_aux, bool enabled);
+void msm_dp_aux_init(struct drm_dp_aux *msm_dp_aux);
+void msm_dp_aux_deinit(struct drm_dp_aux *msm_dp_aux);
+void msm_dp_aux_reconfig(struct drm_dp_aux *msm_dp_aux);
+
+struct phy;
+struct drm_dp_aux *msm_dp_aux_get(struct device *dev, struct msm_dp_catalog *catalog,
+			      struct phy *phy,
+			      bool is_edp);
+void msm_dp_aux_put(struct drm_dp_aux *aux);
+
+#endif /*__DP_AUX_H_*/
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_catalog.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_catalog.c
@@ -0,0 +1,1588 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm-dp] %s: " fmt, __func__
+
+#include <linux/delay.h>
+#include <linux/iopoll.h>
+#include <linux/platform_device.h>
+#include <linux/rational.h>
+#include <drm/display/drm_dp_helper.h>
+#include <drm/drm_print.h>
+
+#include "dp_catalog.h"
+#include "dp_reg.h"
+
+#define POLLING_SLEEP_US			1000
+#define POLLING_TIMEOUT_US			10000
+
+#define SCRAMBLER_RESET_COUNT_VALUE		0xFC
+
+#define DP_INTERRUPT_STATUS_ACK_SHIFT	1
+#define DP_INTERRUPT_STATUS_MASK_SHIFT	2
+
+#define DP_INTF_CONFIG_DATABUS_WIDEN     BIT(4)
+
+#define DP_INTERRUPT_STATUS1 \
+	(DP_INTR_AUX_XFER_DONE| \
+	DP_INTR_WRONG_ADDR | DP_INTR_TIMEOUT | \
+	DP_INTR_NACK_DEFER | DP_INTR_WRONG_DATA_CNT | \
+	DP_INTR_I2C_NACK | DP_INTR_I2C_DEFER | \
+	DP_INTR_PLL_UNLOCKED | DP_INTR_AUX_ERROR)
+
+#define DP_INTERRUPT_STATUS1_ACK \
+	(DP_INTERRUPT_STATUS1 << DP_INTERRUPT_STATUS_ACK_SHIFT)
+#define DP_INTERRUPT_STATUS1_MASK \
+	(DP_INTERRUPT_STATUS1 << DP_INTERRUPT_STATUS_MASK_SHIFT)
+
+#define DP_INTERRUPT_STATUS2 \
+	(DP_INTR_READY_FOR_VIDEO | DP_INTR_IDLE_PATTERN_SENT | \
+	DP_INTR_FRAME_END | DP_INTR_CRC_UPDATED)
+
+#define DP_INTERRUPT_STATUS2_ACK \
+	(DP_INTERRUPT_STATUS2 << DP_INTERRUPT_STATUS_ACK_SHIFT)
+#define DP_INTERRUPT_STATUS2_MASK \
+	(DP_INTERRUPT_STATUS2 << DP_INTERRUPT_STATUS_MASK_SHIFT)
+
+#define DP_INTERRUPT_STATUS4 \
+	(PSR_UPDATE_INT | PSR_CAPTURE_INT | PSR_EXIT_INT | \
+	PSR_UPDATE_ERROR_INT | PSR_WAKE_ERROR_INT)
+
+#define DP_INTERRUPT_STATUS5 \
+	(DP_INTR_DP0_VCPF_SENT | DP_INTR_DP1_VCPF_SENT)
+#define DP_INTERRUPT_STATUS5_MASK \
+	(DP_INTERRUPT_STATUS5 << DP_INTERRUPT_STATUS_MASK_SHIFT)
+
+#define DP_INTERRUPT_MASK4 \
+	(PSR_UPDATE_MASK | PSR_CAPTURE_MASK | PSR_EXIT_MASK | \
+	PSR_UPDATE_ERROR_MASK | PSR_WAKE_ERROR_MASK)
+
+#define DP_DEFAULT_AHB_OFFSET	0x0000
+#define DP_DEFAULT_AHB_SIZE	0x0200
+#define DP_DEFAULT_AUX_OFFSET	0x0200
+#define DP_DEFAULT_AUX_SIZE	0x0200
+#define DP_DEFAULT_LINK_OFFSET	0x0400
+#define DP_DEFAULT_LINK_SIZE	0x0C00
+#define DP_DEFAULT_P0_OFFSET	0x1000
+#define DP_DEFAULT_P0_SIZE	0x0400
+
+struct dss_io_region {
+	size_t len;
+	void __iomem *base;
+};
+
+struct dss_io_data {
+	struct dss_io_region ahb;
+	struct dss_io_region aux;
+	struct dss_io_region link;
+	struct dss_io_region p0;
+	struct dss_io_region p1;
+};
+
+struct msm_dp_catalog_private {
+	struct device *dev;
+	struct drm_device *drm_dev;
+	struct dss_io_data io;
+	u32 (*audio_map)[DP_AUDIO_SDP_HEADER_MAX];
+	struct msm_dp_catalog msm_dp_catalog;
+};
+
+void msm_dp_catalog_snapshot(struct msm_dp_catalog *msm_dp_catalog, struct msm_disp_state *disp_state)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+			struct msm_dp_catalog_private, msm_dp_catalog);
+	struct dss_io_data *dss = &catalog->io;
+
+	msm_disp_snapshot_add_block(disp_state, dss->ahb.len, dss->ahb.base, "dp_ahb");
+	msm_disp_snapshot_add_block(disp_state, dss->aux.len, dss->aux.base, "dp_aux");
+	msm_disp_snapshot_add_block(disp_state, dss->link.len, dss->link.base, "dp_link");
+	msm_disp_snapshot_add_block(disp_state, dss->p0.len, dss->p0.base, "dp_p0");
+	msm_disp_snapshot_add_block(disp_state, dss->p1.len, dss->p0.base, "dp_p1");
+}
+
+static inline u32 msm_dp_read_aux(struct msm_dp_catalog_private *catalog, u32 offset)
+{
+	return readl_relaxed(catalog->io.aux.base + offset);
+}
+
+static inline void msm_dp_write_aux(struct msm_dp_catalog_private *catalog,
+			       u32 offset, u32 data)
+{
+	/*
+	 * To make sure aux reg writes happens before any other operation,
+	 * this function uses writel() instread of writel_relaxed()
+	 */
+	writel(data, catalog->io.aux.base + offset);
+}
+
+static inline u32 msm_dp_read_ahb(const struct msm_dp_catalog_private *catalog, u32 offset)
+{
+	return readl_relaxed(catalog->io.ahb.base + offset);
+}
+
+static inline void msm_dp_write_ahb(struct msm_dp_catalog_private *catalog,
+			       u32 offset, u32 data)
+{
+	/*
+	 * To make sure phy reg writes happens before any other operation,
+	 * this function uses writel() instread of writel_relaxed()
+	 */
+	writel(data, catalog->io.ahb.base + offset);
+}
+
+static inline void msm_dp_write_p0(struct msm_dp_catalog_private *catalog,
+			       u32 offset, u32 data)
+{
+	/*
+	 * To make sure interface reg writes happens before any other operation,
+	 * this function uses writel() instread of writel_relaxed()
+	 */
+	writel(data, catalog->io.p0.base + offset);
+}
+
+static inline u32 msm_dp_read_p0(struct msm_dp_catalog_private *catalog,
+			       u32 offset)
+{
+	/*
+	 * To make sure interface reg writes happens before any other operation,
+	 * this function uses writel() instread of writel_relaxed()
+	 */
+	return readl_relaxed(catalog->io.p0.base + offset);
+}
+
+static inline void msm_dp_write_p1(struct msm_dp_catalog_private *catalog,
+				   u32 offset, u32 data)
+{
+	/*
+	 * To make sure interface reg writes happens before any other operation,
+	 * this function uses writel() instread of writel_relaxed()
+	 */
+	writel(data, catalog->io.p1.base + offset);
+}
+
+static inline u32 msm_dp_read_p1(struct msm_dp_catalog_private *catalog,
+				 u32 offset)
+{
+	/*
+	 * To make sure interface reg writes happens before any other operation,
+	 * this function uses writel() instread of writel_relaxed()
+	 */
+	return readl_relaxed(catalog->io.p1.base + offset);
+}
+
+static inline u32 msm_dp_read_link(struct msm_dp_catalog_private *catalog, u32 offset)
+{
+	return readl_relaxed(catalog->io.link.base + offset);
+}
+
+static inline void msm_dp_write_link(struct msm_dp_catalog_private *catalog,
+			       u32 offset, u32 data)
+{
+	/*
+	 * To make sure link reg writes happens before any other operation,
+	 * this function uses writel() instread of writel_relaxed()
+	 */
+	writel(data, catalog->io.link.base + offset);
+}
+
+/* aux related catalog functions */
+u32 msm_dp_catalog_aux_read_data(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	return msm_dp_read_aux(catalog, REG_DP_AUX_DATA);
+}
+
+int msm_dp_catalog_aux_write_data(struct msm_dp_catalog *msm_dp_catalog, u32 data)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	msm_dp_write_aux(catalog, REG_DP_AUX_DATA, data);
+	return 0;
+}
+
+int msm_dp_catalog_aux_write_trans(struct msm_dp_catalog *msm_dp_catalog, u32 data)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	msm_dp_write_aux(catalog, REG_DP_AUX_TRANS_CTRL, data);
+	return 0;
+}
+
+int msm_dp_catalog_aux_clear_trans(struct msm_dp_catalog *msm_dp_catalog, bool read)
+{
+	u32 data;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (read) {
+		data = msm_dp_read_aux(catalog, REG_DP_AUX_TRANS_CTRL);
+		data &= ~DP_AUX_TRANS_CTRL_GO;
+		msm_dp_write_aux(catalog, REG_DP_AUX_TRANS_CTRL, data);
+	} else {
+		msm_dp_write_aux(catalog, REG_DP_AUX_TRANS_CTRL, 0);
+	}
+	return 0;
+}
+
+int msm_dp_catalog_aux_clear_hw_interrupts(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	msm_dp_read_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_STATUS);
+	msm_dp_write_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_CLEAR, 0x1f);
+	msm_dp_write_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_CLEAR, 0x9f);
+	msm_dp_write_aux(catalog, REG_DP_PHY_AUX_INTERRUPT_CLEAR, 0);
+	return 0;
+}
+
+/**
+ * msm_dp_catalog_aux_reset() - reset AUX controller
+ *
+ * @msm_dp_catalog: DP catalog structure
+ *
+ * return: void
+ *
+ * This function reset AUX controller
+ *
+ * NOTE: reset AUX controller will also clear any pending HPD related interrupts
+ * 
+ */
+void msm_dp_catalog_aux_reset(struct msm_dp_catalog *msm_dp_catalog)
+{
+	u32 aux_ctrl;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	aux_ctrl = msm_dp_read_aux(catalog, REG_DP_AUX_CTRL);
+
+	aux_ctrl |= DP_AUX_CTRL_RESET;
+	msm_dp_write_aux(catalog, REG_DP_AUX_CTRL, aux_ctrl);
+	usleep_range(1000, 1100); /* h/w recommended delay */
+
+	aux_ctrl &= ~DP_AUX_CTRL_RESET;
+	msm_dp_write_aux(catalog, REG_DP_AUX_CTRL, aux_ctrl);
+}
+
+void msm_dp_catalog_aux_enable(struct msm_dp_catalog *msm_dp_catalog, bool enable)
+{
+	u32 aux_ctrl;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	aux_ctrl = msm_dp_read_aux(catalog, REG_DP_AUX_CTRL);
+
+	if (enable) {
+		msm_dp_write_aux(catalog, REG_DP_TIMEOUT_COUNT, 0xffff);
+		msm_dp_write_aux(catalog, REG_DP_AUX_LIMITS, 0xffff);
+		aux_ctrl |= DP_AUX_CTRL_ENABLE;
+	} else {
+		aux_ctrl &= ~DP_AUX_CTRL_ENABLE;
+	}
+
+	msm_dp_write_aux(catalog, REG_DP_AUX_CTRL, aux_ctrl);
+}
+
+int msm_dp_catalog_aux_wait_for_hpd_connect_state(struct msm_dp_catalog *msm_dp_catalog,
+					      unsigned long wait_us)
+{
+	u32 state;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	/* poll for hpd connected status every 2ms and timeout after wait_us */
+	return readl_poll_timeout(catalog->io.aux.base +
+				REG_DP_DP_HPD_INT_STATUS,
+				state, state & DP_DP_HPD_STATE_STATUS_CONNECTED,
+				min(wait_us, 2000), wait_us);
+}
+
+static void dump_regs(void __iomem *base, int len)
+{
+	int i;
+	u32 x0, x4, x8, xc;
+	u32 addr_off = 0;
+
+	len = DIV_ROUND_UP(len, 16);
+	for (i = 0; i < len; i++) {
+		x0 = readl_relaxed(base + addr_off);
+		x4 = readl_relaxed(base + addr_off + 0x04);
+		x8 = readl_relaxed(base + addr_off + 0x08);
+		xc = readl_relaxed(base + addr_off + 0x0c);
+
+		pr_info("%08x: %08x %08x %08x %08x", addr_off, x0, x4, x8, xc);
+		addr_off += 16;
+	}
+}
+
+void msm_dp_catalog_dump_regs(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
+	struct dss_io_data *io = &catalog->io;
+
+	pr_info("AHB regs\n");
+	dump_regs(io->ahb.base, io->ahb.len);
+
+	pr_info("AUXCLK regs\n");
+	dump_regs(io->aux.base, io->aux.len);
+
+	pr_info("LCLK regs\n");
+	dump_regs(io->link.base, io->link.len);
+
+	pr_info("P0CLK regs\n");
+	dump_regs(io->p0.base, io->p0.len);
+}
+
+u32 msm_dp_catalog_aux_get_irq(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 intr, intr_ack;
+
+	intr = msm_dp_read_ahb(catalog, REG_DP_INTR_STATUS);
+	intr &= ~DP_INTERRUPT_STATUS1_MASK;
+	intr_ack = (intr & DP_INTERRUPT_STATUS1)
+			<< DP_INTERRUPT_STATUS_ACK_SHIFT;
+	msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS, intr_ack |
+			DP_INTERRUPT_STATUS1_MASK);
+
+	return intr;
+
+}
+
+/* controller related catalog functions */
+void msm_dp_catalog_ctrl_update_transfer_unit(struct msm_dp_catalog *msm_dp_catalog,
+				u32 msm_dp_tu, u32 valid_boundary,
+				u32 valid_boundary2)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	msm_dp_write_link(catalog, REG_DP_VALID_BOUNDARY, valid_boundary);
+	msm_dp_write_link(catalog, REG_DP_TU, msm_dp_tu);
+	msm_dp_write_link(catalog, REG_DP_VALID_BOUNDARY_2, valid_boundary2);
+}
+
+void msm_dp_catalog_ctrl_state_ctrl(struct msm_dp_catalog *msm_dp_catalog, u32 state)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	msm_dp_write_link(catalog, REG_DP_STATE_CTRL, state);
+}
+
+void msm_dp_catalog_ctrl_config_ctrl(struct msm_dp_catalog *msm_dp_catalog, u32 cfg)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	drm_dbg_dp(catalog->drm_dev, "DP_CONFIGURATION_CTRL=0x%x\n", cfg);
+
+	msm_dp_write_link(catalog, REG_DP_CONFIGURATION_CTRL, cfg);
+}
+
+void msm_dp_catalog_ctrl_lane_mapping(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 ln_0 = 0, ln_1 = 1, ln_2 = 2, ln_3 = 3; /* One-to-One mapping */
+	u32 ln_mapping;
+
+	ln_mapping = ln_0 << LANE0_MAPPING_SHIFT;
+	ln_mapping |= ln_1 << LANE1_MAPPING_SHIFT;
+	ln_mapping |= ln_2 << LANE2_MAPPING_SHIFT;
+	ln_mapping |= ln_3 << LANE3_MAPPING_SHIFT;
+
+	msm_dp_write_link(catalog, REG_DP_LOGICAL2PHYSICAL_LANE_MAPPING,
+			ln_mapping);
+}
+
+void msm_dp_catalog_ctrl_psr_mainlink_enable(struct msm_dp_catalog *msm_dp_catalog,
+						bool enable)
+{
+	u32 val;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	val = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+
+	if (enable)
+		val |= DP_MAINLINK_CTRL_ENABLE;
+	else
+		val &= ~DP_MAINLINK_CTRL_ENABLE;
+
+	msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, val);
+}
+
+void msm_dp_catalog_mst_config(struct msm_dp_catalog *msm_dp_catalog, bool enable)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+							      struct msm_dp_catalog_private,
+							      msm_dp_catalog);
+
+	u32 mainlink_ctrl;
+
+	mainlink_ctrl = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+	if (enable)
+		mainlink_ctrl |= (0x04000100);
+	else
+		mainlink_ctrl &= ~(0x04000100);
+
+	msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+}
+
+void msm_dp_catalog_ctrl_mainlink_ctrl(struct msm_dp_catalog *msm_dp_catalog,
+				       bool enable)
+{
+	u32 mainlink_ctrl;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	drm_dbg_dp(catalog->drm_dev, "enable=%d\n", enable);
+	if (enable) {
+		/*
+		 * To make sure link reg writes happens before other operation,
+		 * msm_dp_write_link() function uses writel()
+		 */
+		mainlink_ctrl = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+
+		mainlink_ctrl &= ~(DP_MAINLINK_CTRL_RESET |
+						DP_MAINLINK_CTRL_ENABLE);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+
+		mainlink_ctrl |= DP_MAINLINK_CTRL_RESET;
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+
+		mainlink_ctrl &= ~DP_MAINLINK_CTRL_RESET;
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+
+		mainlink_ctrl |= (DP_MAINLINK_CTRL_ENABLE |
+					DP_MAINLINK_FB_BOUNDARY_SEL);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+	} else {
+		mainlink_ctrl = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+		mainlink_ctrl &= ~DP_MAINLINK_CTRL_ENABLE;
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+	}
+}
+
+void msm_dp_catalog_ctrl_config_misc(struct msm_dp_catalog *msm_dp_catalog,
+					u32 colorimetry_cfg,
+					u32 test_bits_depth)
+{
+	u32 misc_val;
+	u32 reg_offset = 0;
+
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (msm_dp_catalog->stream_id >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid stream_id:%d\n", msm_dp_catalog->stream_id);
+		return;
+	}
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1)
+		reg_offset = REG_DP1_MISC1_MISC0 - REG_DP_MISC1_MISC0;
+
+	misc_val = msm_dp_read_link(catalog, REG_DP_MISC1_MISC0 + reg_offset);
+
+	/* clear bpp bits */
+	misc_val &= ~(0x07 << DP_MISC0_TEST_BITS_DEPTH_SHIFT);
+	misc_val |= colorimetry_cfg << DP_MISC0_COLORIMETRY_CFG_SHIFT;
+	misc_val |= test_bits_depth << DP_MISC0_TEST_BITS_DEPTH_SHIFT;
+	/* Configure clock to synchronous mode */
+	misc_val |= DP_MISC0_SYNCHRONOUS_CLK;
+
+	drm_dbg_dp(catalog->drm_dev, "misc settings = 0x%x\n", misc_val);
+	msm_dp_write_link(catalog, REG_DP_MISC1_MISC0 + reg_offset, misc_val);
+}
+
+void msm_dp_catalog_setup_peripheral_flush(struct msm_dp_catalog *msm_dp_catalog)
+{
+	u32 mainlink_ctrl, hw_revision;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	mainlink_ctrl = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+
+	hw_revision = msm_dp_catalog_hw_revision(msm_dp_catalog);
+	if (hw_revision >= DP_HW_VERSION_1_2)
+		mainlink_ctrl |= DP_MAINLINK_FLUSH_MODE_SDE_PERIPH_UPDATE;
+	else
+		mainlink_ctrl |= DP_MAINLINK_FLUSH_MODE_UPDATE_SDP;
+
+	msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+}
+
+void msm_dp_catalog_ctrl_config_msa(struct msm_dp_catalog *msm_dp_catalog,
+					u32 rate, u32 stream_rate_khz,
+					bool is_ycbcr_420)
+{
+	u32 pixel_m, pixel_n;
+	u32 mvid, nvid, pixel_div = 0, dispcc_input_rate;
+	u32 const nvid_fixed = DP_LINK_CONSTANT_N_VALUE;
+	u32 const link_rate_hbr2 = 540000;
+	u32 const link_rate_hbr3 = 810000;
+	unsigned long den, num;
+	u32 mvid_reg_off = 0, nvid_reg_off = 0;
+
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (msm_dp_catalog->stream_id >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid stream_id:%d\n", msm_dp_catalog->stream_id);
+		return;
+	}
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1) {
+		mvid_reg_off = REG_DP1_SOFTWARE_MVID - REG_DP_SOFTWARE_MVID;
+		nvid_reg_off = REG_DP1_SOFTWARE_NVID - REG_DP_SOFTWARE_NVID;
+	}
+
+	if (rate == link_rate_hbr3)
+		pixel_div = 6;
+	else if (rate == 162000 || rate == 270000)
+		pixel_div = 2;
+	else if (rate == link_rate_hbr2)
+		pixel_div = 4;
+	else
+		DRM_ERROR("Invalid pixel mux divider\n");
+
+	dispcc_input_rate = (rate * 10) / pixel_div;
+
+	rational_best_approximation(dispcc_input_rate, stream_rate_khz,
+			(unsigned long)(1 << 16) - 1,
+			(unsigned long)(1 << 16) - 1, &den, &num);
+
+	den = ~(den - num);
+	den = den & 0xFFFF;
+	pixel_m = num;
+	pixel_n = den;
+
+	mvid = (pixel_m & 0xFFFF) * 5;
+	nvid = (0xFFFF & (~pixel_n)) + (pixel_m & 0xFFFF);
+
+	if (nvid < nvid_fixed) {
+		u32 temp;
+
+		temp = (nvid_fixed / nvid) * nvid;
+		mvid = (nvid_fixed / nvid) * mvid;
+		nvid = temp;
+	}
+
+	if (is_ycbcr_420)
+		mvid /= 2;
+
+	if (link_rate_hbr2 == rate)
+		nvid *= 2;
+
+	if (link_rate_hbr3 == rate)
+		nvid *= 3;
+
+	drm_dbg_dp(catalog->drm_dev, "mvid=0x%x, nvid=0x%x\n", mvid, nvid);
+
+	msm_dp_write_link(catalog, REG_DP_SOFTWARE_MVID + mvid_reg_off, mvid);
+	msm_dp_write_link(catalog, REG_DP_SOFTWARE_NVID + nvid_reg_off, nvid);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		msm_dp_write_p0(catalog, MMSS_DP_DSC_DTO, 0x0);
+	else
+		msm_dp_write_p1(catalog, MMSS_DP_DSC_DTO, 0x0);
+}
+
+int msm_dp_catalog_ctrl_set_pattern_state_bit(struct msm_dp_catalog *msm_dp_catalog,
+					u32 state_bit)
+{
+	int bit, ret;
+	u32 data;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	bit = BIT(state_bit - 1);
+	drm_dbg_dp(catalog->drm_dev, "hw: bit=%d train=%d\n", bit, state_bit);
+	msm_dp_catalog_ctrl_state_ctrl(msm_dp_catalog, bit);
+
+	bit = BIT(state_bit - 1) << DP_MAINLINK_READY_LINK_TRAINING_SHIFT;
+
+	/* Poll for mainlink ready status */
+	ret = readx_poll_timeout(readl, catalog->io.link.base +
+					REG_DP_MAINLINK_READY,
+					data, data & bit,
+					POLLING_SLEEP_US, POLLING_TIMEOUT_US);
+	if (ret < 0) {
+		DRM_ERROR("set state_bit for link_train=%d failed\n", state_bit);
+		return ret;
+	}
+	return 0;
+}
+
+/**
+ * msm_dp_catalog_hw_revision() - retrieve DP hw revision
+ *
+ * @msm_dp_catalog: DP catalog structure
+ *
+ * Return: DP controller hw revision
+ *
+ */
+u32 msm_dp_catalog_hw_revision(const struct msm_dp_catalog *msm_dp_catalog)
+{
+	const struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	return msm_dp_read_ahb(catalog, REG_DP_HW_VERSION);
+}
+
+/**
+ * msm_dp_catalog_ctrl_reset() - reset DP controller
+ *
+ * @msm_dp_catalog: DP catalog structure
+ *
+ * return: void
+ *
+ * This function reset the DP controller
+ *
+ * NOTE: reset DP controller will also clear any pending HPD related interrupts
+ * 
+ */
+void msm_dp_catalog_ctrl_reset(struct msm_dp_catalog *msm_dp_catalog)
+{
+	u32 sw_reset;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	sw_reset = msm_dp_read_ahb(catalog, REG_DP_SW_RESET);
+
+	sw_reset |= DP_SW_RESET;
+	msm_dp_write_ahb(catalog, REG_DP_SW_RESET, sw_reset);
+	usleep_range(1000, 1100); /* h/w recommended delay */
+
+	sw_reset &= ~DP_SW_RESET;
+	msm_dp_write_ahb(catalog, REG_DP_SW_RESET, sw_reset);
+}
+
+bool msm_dp_catalog_ctrl_mainlink_ready(struct msm_dp_catalog *msm_dp_catalog)
+{
+	u32 data;
+	int ret;
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	/* Poll for mainlink ready status */
+	ret = readl_poll_timeout(catalog->io.link.base +
+				REG_DP_MAINLINK_READY,
+				data, data & DP_MAINLINK_READY_FOR_VIDEO,
+				POLLING_SLEEP_US, POLLING_TIMEOUT_US);
+	if (ret < 0) {
+		DRM_ERROR("mainlink not ready\n");
+		return false;
+	}
+
+	return true;
+}
+
+void msm_dp_catalog_ctrl_enable_irq(struct msm_dp_catalog *msm_dp_catalog,
+						bool enable)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (enable) {
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS,
+				DP_INTERRUPT_STATUS1_MASK);
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS2,
+				DP_INTERRUPT_STATUS2_MASK);
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS5,
+				 DP_INTERRUPT_STATUS5_MASK);
+	} else {
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS, 0x00);
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS2, 0x00);
+		msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS5, 0x00);
+	}
+}
+
+void msm_dp_catalog_hpd_config_intr(struct msm_dp_catalog *msm_dp_catalog,
+			u32 intr_mask, bool en)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	u32 config = msm_dp_read_aux(catalog, REG_DP_DP_HPD_INT_MASK);
+
+	config = (en ? config | intr_mask : config & ~intr_mask);
+
+	drm_dbg_dp(catalog->drm_dev, "intr_mask=%#x config=%#x\n",
+					intr_mask, config);
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_INT_MASK,
+				config & DP_DP_HPD_INT_MASK);
+}
+
+void msm_dp_catalog_ctrl_hpd_enable(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	u32 reftimer = msm_dp_read_aux(catalog, REG_DP_DP_HPD_REFTIMER);
+
+	/* Configure REFTIMER and enable it */
+	reftimer |= DP_DP_HPD_REFTIMER_ENABLE;
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_REFTIMER, reftimer);
+
+	/* Enable HPD */
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_CTRL, DP_DP_HPD_CTRL_HPD_EN);
+}
+
+void msm_dp_catalog_ctrl_hpd_disable(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	u32 reftimer = msm_dp_read_aux(catalog, REG_DP_DP_HPD_REFTIMER);
+
+	reftimer &= ~DP_DP_HPD_REFTIMER_ENABLE;
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_REFTIMER, reftimer);
+
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_CTRL, 0);
+}
+
+static void msm_dp_catalog_enable_sdp(struct msm_dp_catalog_private *catalog)
+{
+	/* trigger sdp */
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG3, UPDATE_SDP);
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG3, 0x0);
+}
+
+void msm_dp_catalog_ctrl_config_psr(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 config;
+
+	/* enable PSR1 function */
+	config = msm_dp_read_link(catalog, REG_PSR_CONFIG);
+	config |= PSR1_SUPPORTED;
+	msm_dp_write_link(catalog, REG_PSR_CONFIG, config);
+
+	msm_dp_write_ahb(catalog, REG_DP_INTR_MASK4, DP_INTERRUPT_MASK4);
+	msm_dp_catalog_enable_sdp(catalog);
+}
+
+void msm_dp_catalog_ctrl_set_psr(struct msm_dp_catalog *msm_dp_catalog, bool enter)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+			struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 cmd;
+
+	cmd = msm_dp_read_link(catalog, REG_PSR_CMD);
+
+	cmd &= ~(PSR_ENTER | PSR_EXIT);
+
+	if (enter)
+		cmd |= PSR_ENTER;
+	else
+		cmd |= PSR_EXIT;
+
+	msm_dp_catalog_enable_sdp(catalog);
+	msm_dp_write_link(catalog, REG_PSR_CMD, cmd);
+}
+
+u32 msm_dp_catalog_link_is_connected(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 status;
+
+	status = msm_dp_read_aux(catalog, REG_DP_DP_HPD_INT_STATUS);
+	drm_dbg_dp(catalog->drm_dev, "aux status: %#x\n", status);
+	status >>= DP_DP_HPD_STATE_STATUS_BITS_SHIFT;
+	status &= DP_DP_HPD_STATE_STATUS_BITS_MASK;
+
+	return status;
+}
+
+u32 msm_dp_catalog_hpd_get_intr_status(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	int isr, mask;
+
+	isr = msm_dp_read_aux(catalog, REG_DP_DP_HPD_INT_STATUS);
+	msm_dp_write_aux(catalog, REG_DP_DP_HPD_INT_ACK,
+				 (isr & DP_DP_HPD_INT_MASK));
+	mask = msm_dp_read_aux(catalog, REG_DP_DP_HPD_INT_MASK);
+
+	/*
+	 * We only want to return interrupts that are unmasked to the caller.
+	 * However, the interrupt status field also contains other
+	 * informational bits about the HPD state status, so we only mask
+	 * out the part of the register that tells us about which interrupts
+	 * are pending.
+	 */
+	return isr & (mask | ~DP_DP_HPD_INT_MASK);
+}
+
+u32 msm_dp_catalog_ctrl_read_psr_interrupt_status(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 intr, intr_ack;
+
+	intr = msm_dp_read_ahb(catalog, REG_DP_INTR_STATUS4);
+	intr_ack = (intr & DP_INTERRUPT_STATUS4)
+			<< DP_INTERRUPT_STATUS_ACK_SHIFT;
+	msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS4, intr_ack);
+
+	return intr;
+}
+
+int msm_dp_catalog_ctrl_get_interrupt(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 intr, intr_ack;
+
+	intr = msm_dp_read_ahb(catalog, REG_DP_INTR_STATUS2);
+	intr &= ~DP_INTERRUPT_STATUS2_MASK;
+	intr_ack = (intr & DP_INTERRUPT_STATUS2)
+			<< DP_INTERRUPT_STATUS_ACK_SHIFT;
+	msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS2,
+			intr_ack | DP_INTERRUPT_STATUS2_MASK);
+
+	return intr;
+}
+
+int msm_dp_catalog_ctrl_get_interrupt_5(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+							      struct msm_dp_catalog_private,
+							      msm_dp_catalog);
+	u32 intr, intr_ack;
+
+	intr = msm_dp_read_ahb(catalog, REG_DP_INTR_STATUS5);
+	intr &= ~DP_INTERRUPT_STATUS5_MASK;
+	intr_ack = (intr & DP_INTERRUPT_STATUS5)
+			<< DP_INTERRUPT_STATUS_ACK_SHIFT;
+	msm_dp_write_ahb(catalog, REG_DP_INTR_STATUS5,
+			 intr_ack | DP_INTERRUPT_STATUS5_MASK);
+
+	return intr;
+}
+
+void msm_dp_catalog_ctrl_phy_reset(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	msm_dp_write_ahb(catalog, REG_DP_PHY_CTRL,
+			DP_PHY_CTRL_SW_RESET | DP_PHY_CTRL_SW_RESET_PLL);
+	usleep_range(1000, 1100); /* h/w recommended delay */
+	msm_dp_write_ahb(catalog, REG_DP_PHY_CTRL, 0x0);
+}
+
+void msm_dp_catalog_ctrl_send_phy_pattern(struct msm_dp_catalog *msm_dp_catalog,
+			u32 pattern)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 value = 0x0;
+
+	/* Make sure to clear the current pattern before starting a new one */
+	msm_dp_write_link(catalog, REG_DP_STATE_CTRL, 0x0);
+
+	drm_dbg_dp(catalog->drm_dev, "pattern: %#x\n", pattern);
+	switch (pattern) {
+	case DP_PHY_TEST_PATTERN_D10_2:
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
+				DP_STATE_CTRL_LINK_TRAINING_PATTERN1);
+		break;
+	case DP_PHY_TEST_PATTERN_ERROR_COUNT:
+		value &= ~(1 << 16);
+		msm_dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
+					value);
+		value |= SCRAMBLER_RESET_COUNT_VALUE;
+		msm_dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
+					value);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_LEVELS,
+					DP_MAINLINK_SAFE_TO_EXIT_LEVEL_2);
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
+					DP_STATE_CTRL_LINK_SYMBOL_ERR_MEASURE);
+		break;
+	case DP_PHY_TEST_PATTERN_PRBS7:
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
+				DP_STATE_CTRL_LINK_PRBS7);
+		break;
+	case DP_PHY_TEST_PATTERN_80BIT_CUSTOM:
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
+				DP_STATE_CTRL_LINK_TEST_CUSTOM_PATTERN);
+		/* 00111110000011111000001111100000 */
+		msm_dp_write_link(catalog, REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG0,
+				0x3E0F83E0);
+		/* 00001111100000111110000011111000 */
+		msm_dp_write_link(catalog, REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG1,
+				0x0F83E0F8);
+		/* 1111100000111110 */
+		msm_dp_write_link(catalog, REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG2,
+				0x0000F83E);
+		break;
+	case DP_PHY_TEST_PATTERN_CP2520:
+		value = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+		value &= ~DP_MAINLINK_CTRL_SW_BYPASS_SCRAMBLER;
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, value);
+
+		value = DP_HBR2_ERM_PATTERN;
+		msm_dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
+				value);
+		value |= SCRAMBLER_RESET_COUNT_VALUE;
+		msm_dp_write_link(catalog, REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET,
+					value);
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_LEVELS,
+					DP_MAINLINK_SAFE_TO_EXIT_LEVEL_2);
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
+					DP_STATE_CTRL_LINK_SYMBOL_ERR_MEASURE);
+		value = msm_dp_read_link(catalog, REG_DP_MAINLINK_CTRL);
+		value |= DP_MAINLINK_CTRL_ENABLE;
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL, value);
+		break;
+	case DP_PHY_TEST_PATTERN_SEL_MASK:
+		msm_dp_write_link(catalog, REG_DP_MAINLINK_CTRL,
+				DP_MAINLINK_CTRL_ENABLE);
+		msm_dp_write_link(catalog, REG_DP_STATE_CTRL,
+				DP_STATE_CTRL_LINK_TRAINING_PATTERN4);
+		break;
+	default:
+		drm_dbg_dp(catalog->drm_dev,
+				"No valid test pattern requested: %#x\n", pattern);
+		break;
+	}
+}
+
+u32 msm_dp_catalog_ctrl_read_phy_pattern(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	return msm_dp_read_link(catalog, REG_DP_MAINLINK_READY);
+}
+
+/* panel related catalog functions */
+int msm_dp_catalog_panel_timing_cfg(struct msm_dp_catalog *msm_dp_catalog, u32 total,
+				u32 sync_start, u32 width_blanking, u32 msm_dp_active)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 reg;
+	u32 offset = 0;
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1)
+		offset = REG_DP1_TOTAL_HOR_VER - REG_DP_TOTAL_HOR_VER;
+
+	msm_dp_write_link(catalog, REG_DP_TOTAL_HOR_VER + offset, total);
+	msm_dp_write_link(catalog, REG_DP_START_HOR_VER_FROM_SYNC + offset, sync_start);
+	msm_dp_write_link(catalog, REG_DP_HSYNC_VSYNC_WIDTH_POLARITY + offset, width_blanking);
+	msm_dp_write_link(catalog, REG_DP_ACTIVE_HOR_VER + offset, msm_dp_active);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		reg = msm_dp_read_p0(catalog, MMSS_DP_INTF_CONFIG);
+	else
+		reg = msm_dp_read_p1(catalog, MMSS_DP_INTF_CONFIG);
+
+	if (msm_dp_catalog->wide_bus_en)
+		reg |= DP_INTF_CONFIG_DATABUS_WIDEN;
+	else
+		reg &= ~DP_INTF_CONFIG_DATABUS_WIDEN;
+
+
+	DRM_DEBUG_DP("wide_bus_en=%d reg=%#x\n", msm_dp_catalog->wide_bus_en, reg);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		msm_dp_write_p0(catalog, MMSS_DP_INTF_CONFIG, reg);
+	else
+		msm_dp_write_p1(catalog, MMSS_DP_INTF_CONFIG, reg);
+
+	return 0;
+}
+
+int msm_dp_catalog_mst_async_fifo(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+							      struct msm_dp_catalog_private,
+							      msm_dp_catalog);
+
+	u32 reg;
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		reg = msm_dp_read_p0(catalog, MMSS_DP_ASYNC_FIFO_CONFIG);
+	else
+		reg = msm_dp_read_p1(catalog, MMSS_DP_ASYNC_FIFO_CONFIG);
+
+	/* enable MST_FIFO_CONSTANT_FILL */
+	reg |= BIT(0);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_0)
+		msm_dp_write_p0(catalog, MMSS_DP_ASYNC_FIFO_CONFIG, reg);
+	else
+		msm_dp_write_p1(catalog, MMSS_DP_ASYNC_FIFO_CONFIG, reg);
+
+	return 0;
+}
+
+static void msm_dp_catalog_panel_send_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog, struct dp_sdp *vsc_sdp)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 header[2];
+	u32 val;
+	int i;
+	u32 msm_dp_generic_offset = 0;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1)
+		msm_dp_generic_offset = MMSS_DP1_GENERIC0_0 - MMSS_DP_GENERIC0_0;
+
+	msm_dp_utils_pack_sdp_header(&vsc_sdp->sdp_header, header);
+
+	msm_dp_write_link(catalog, MMSS_DP_GENERIC0_0 + msm_dp_generic_offset, header[0]);
+	msm_dp_write_link(catalog, MMSS_DP_GENERIC0_1 + msm_dp_generic_offset, header[1]);
+
+	for (i = 0; i < sizeof(vsc_sdp->db); i += 4) {
+		val = ((vsc_sdp->db[i]) | (vsc_sdp->db[i + 1] << 8) | (vsc_sdp->db[i + 2] << 16) |
+		       (vsc_sdp->db[i + 3] << 24));
+		msm_dp_write_link(catalog, MMSS_DP_GENERIC0_2 + i + msm_dp_generic_offset, val);
+	}
+}
+
+static void msm_dp_catalog_panel_update_sdp(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 hw_revision;
+	u32 sdp_cfg3_offset = 0;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1)
+		sdp_cfg3_offset = MMSS_DP1_SDP_CFG3 - MMSS_DP_SDP_CFG3;
+
+	hw_revision = msm_dp_catalog_hw_revision(msm_dp_catalog);
+	if (hw_revision < DP_HW_VERSION_1_2 && hw_revision >= DP_HW_VERSION_1_0) {
+		msm_dp_write_link(catalog, MMSS_DP_SDP_CFG3 + sdp_cfg3_offset, 0x01);
+		msm_dp_write_link(catalog, MMSS_DP_SDP_CFG3 + sdp_cfg3_offset, 0x00);
+	}
+}
+
+void msm_dp_catalog_panel_enable_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog, struct dp_sdp *vsc_sdp)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 cfg, cfg2, misc;
+	u32 misc_reg_offset = 0;
+	u32 sdp_cfg_offset = 0;
+	u32 sdp_cfg2_offset = 0;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	if (msm_dp_catalog->stream_id == DP_STREAM_1) {
+		misc_reg_offset = REG_DP1_MISC1_MISC0 - REG_DP_MISC1_MISC0;
+		sdp_cfg_offset = MMSS_DP1_SDP_CFG - MMSS_DP_SDP_CFG;
+		sdp_cfg2_offset = MMSS_DP1_SDP_CFG2 - MMSS_DP_SDP_CFG2;
+	}
+
+	cfg = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG + sdp_cfg_offset);
+	cfg2 = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG2 + sdp_cfg2_offset);
+	misc = msm_dp_read_link(catalog, REG_DP_MISC1_MISC0 + misc_reg_offset);
+
+	cfg |= GEN0_SDP_EN;
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG + sdp_cfg_offset, cfg);
+
+	cfg2 |= GENERIC0_SDPSIZE_VALID;
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG2 + sdp_cfg2_offset, cfg2);
+
+	msm_dp_catalog_panel_send_vsc_sdp(msm_dp_catalog, vsc_sdp);
+
+	/* indicates presence of VSC (BIT(6) of MISC1) */
+	misc |= DP_MISC1_VSC_SDP;
+
+	drm_dbg_dp(catalog->drm_dev, "vsc sdp enable=1\n");
+
+	pr_debug("misc settings = 0x%x\n", misc);
+
+	msm_dp_write_link(catalog, REG_DP_MISC1_MISC0 + misc_reg_offset, misc);
+
+	msm_dp_catalog_panel_update_sdp(msm_dp_catalog);
+}
+
+void msm_dp_catalog_panel_disable_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 cfg, cfg2, misc;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	cfg = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG);
+	cfg2 = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG2);
+	misc = msm_dp_read_link(catalog, REG_DP_MISC1_MISC0);
+
+	cfg &= ~GEN0_SDP_EN;
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG, cfg);
+
+	cfg2 &= ~GENERIC0_SDPSIZE_VALID;
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG2, cfg2);
+
+	/* switch back to MSA */
+	misc &= ~DP_MISC1_VSC_SDP;
+
+	drm_dbg_dp(catalog->drm_dev, "vsc sdp enable=0\n");
+
+	pr_debug("misc settings = 0x%x\n", misc);
+	msm_dp_write_link(catalog, REG_DP_MISC1_MISC0, misc);
+
+	msm_dp_catalog_panel_update_sdp(msm_dp_catalog);
+}
+
+void msm_dp_catalog_trigger_act(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	msm_dp_write_link(catalog, REG_DP_MST_ACT, 0x1);
+
+	/* make sure ACT signal is performed */
+	wmb();
+}
+
+bool msm_dp_catalog_read_act_complete_sts(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	return msm_dp_read_link(catalog, REG_DP_MST_ACT);
+}
+
+void msm_dp_catalog_mst_channel_alloc(struct msm_dp_catalog *msm_dp_catalog,
+				      u32 ch, u32 ch_start_slot, u32 tot_slot_cnt)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 i, slot_reg_1, slot_reg_2, slot;
+	u32 reg_off = 0;
+	int const num_slots_per_reg = 32;
+
+	if (!msm_dp_catalog || ch >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid input. ch %d\n", ch);
+		return;
+	}
+
+	if (ch_start_slot > DP_MAX_TIME_SLOTS ||
+	    (ch_start_slot + tot_slot_cnt > DP_MAX_TIME_SLOTS)) {
+		DRM_ERROR("invalid slots start %d, tot %d\n",
+			  ch_start_slot, tot_slot_cnt);
+		return;
+	}
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	drm_dbg_dp(catalog->drm_dev, "ch %d, start_slot %d, tot_slot %d\n",
+		   ch, ch_start_slot, tot_slot_cnt);
+
+	if (ch == DP_STREAM_1)
+		reg_off = REG_DP_DP1_TIMESLOT_1_32 - REG_DP_DP0_TIMESLOT_1_32;
+
+	slot_reg_1 = 0;
+	slot_reg_2 = 0;
+
+	if (ch_start_slot && tot_slot_cnt) {
+		ch_start_slot--;
+		for (i = 0; i < tot_slot_cnt; i++) {
+			if (ch_start_slot < num_slots_per_reg) {
+				slot_reg_1 |= BIT(ch_start_slot);
+			} else {
+				slot = ch_start_slot - num_slots_per_reg;
+				slot_reg_2 |= BIT(slot);
+			}
+			ch_start_slot++;
+		}
+	}
+
+	drm_dbg_dp(catalog->drm_dev, "ch:%d slot_reg_1:%d, slot_reg_2:%d\n", ch,
+		   slot_reg_1, slot_reg_2);
+
+	msm_dp_write_link(catalog, REG_DP_DP0_TIMESLOT_1_32 + reg_off, slot_reg_1);
+	msm_dp_write_link(catalog, REG_DP_DP0_TIMESLOT_33_63 + reg_off, slot_reg_2);
+}
+
+void msm_dp_catalog_ctrl_update_rg(struct msm_dp_catalog *msm_dp_catalog, u32 stream,
+				   u32 x_int, u32 y_frac_enum)
+{
+	struct msm_dp_catalog_private *catalog;
+
+	u32 rg, reg_off = 0;
+
+	if (!msm_dp_catalog || stream >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid input. stream %d\n", stream);
+		return;
+	}
+
+	catalog = container_of(msm_dp_catalog, struct msm_dp_catalog_private, msm_dp_catalog);
+
+	rg = y_frac_enum;
+	rg |= (x_int << 16);
+
+	drm_dbg_dp(catalog->drm_dev, "stream: %d x_int:%d y_frac_enum:%d rg:%d\n",
+		   stream, x_int, y_frac_enum, rg);
+
+	if (stream == DP_STREAM_1)
+		reg_off = REG_DP_DP1_RG - REG_DP_DP0_RG;
+
+	msm_dp_write_link(catalog, REG_DP_DP0_RG + reg_off, rg);
+}
+
+void msm_dp_catalog_panel_tpg_enable(struct msm_dp_catalog *msm_dp_catalog,
+				struct drm_display_mode *drm_mode)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+	u32 hsync_period, vsync_period;
+	u32 display_v_start, display_v_end;
+	u32 hsync_start_x, hsync_end_x;
+	u32 v_sync_width;
+	u32 hsync_ctl;
+	u32 display_hctl;
+
+	/* TPG config parameters*/
+	hsync_period = drm_mode->htotal;
+	vsync_period = drm_mode->vtotal;
+
+	display_v_start = ((drm_mode->vtotal - drm_mode->vsync_start) *
+					hsync_period);
+	display_v_end = ((vsync_period - (drm_mode->vsync_start -
+					drm_mode->vdisplay))
+					* hsync_period) - 1;
+
+	display_v_start += drm_mode->htotal - drm_mode->hsync_start;
+	display_v_end -= (drm_mode->hsync_start - drm_mode->hdisplay);
+
+	hsync_start_x = drm_mode->htotal - drm_mode->hsync_start;
+	hsync_end_x = hsync_period - (drm_mode->hsync_start -
+					drm_mode->hdisplay) - 1;
+
+	v_sync_width = drm_mode->vsync_end - drm_mode->vsync_start;
+
+	hsync_ctl = (hsync_period << 16) |
+			(drm_mode->hsync_end - drm_mode->hsync_start);
+	display_hctl = (hsync_end_x << 16) | hsync_start_x;
+
+
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_CONFIG, 0x0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_HSYNC_CTL, hsync_ctl);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PERIOD_F0, vsync_period *
+			hsync_period);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F0, v_sync_width *
+			hsync_period);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PERIOD_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_DISPLAY_HCTL, display_hctl);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_HCTL, 0);
+	msm_dp_write_p0(catalog, MMSS_INTF_DISPLAY_V_START_F0, display_v_start);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_DISPLAY_V_END_F0, display_v_end);
+	msm_dp_write_p0(catalog, MMSS_INTF_DISPLAY_V_START_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_DISPLAY_V_END_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_START_F0, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_END_F0, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_START_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_ACTIVE_V_END_F1, 0);
+	msm_dp_write_p0(catalog, MMSS_DP_INTF_POLARITY_CTL, 0);
+
+	msm_dp_write_p0(catalog, MMSS_DP_TPG_MAIN_CONTROL,
+				DP_TPG_CHECKERED_RECT_PATTERN);
+	msm_dp_write_p0(catalog, MMSS_DP_TPG_VIDEO_CONFIG,
+				DP_TPG_VIDEO_CONFIG_BPP_8BIT |
+				DP_TPG_VIDEO_CONFIG_RGB);
+	msm_dp_write_p0(catalog, MMSS_DP_BIST_ENABLE,
+				DP_BIST_ENABLE_DPBIST_EN);
+	msm_dp_write_p0(catalog, MMSS_DP_TIMING_ENGINE_EN,
+				DP_TIMING_ENGINE_EN_EN);
+	drm_dbg_dp(catalog->drm_dev, "%s: enabled tpg\n", __func__);
+}
+
+void msm_dp_catalog_panel_tpg_disable(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog = container_of(msm_dp_catalog,
+				struct msm_dp_catalog_private, msm_dp_catalog);
+
+	msm_dp_write_p0(catalog, MMSS_DP_TPG_MAIN_CONTROL, 0x0);
+	msm_dp_write_p0(catalog, MMSS_DP_BIST_ENABLE, 0x0);
+	msm_dp_write_p0(catalog, MMSS_DP_TIMING_ENGINE_EN, 0x0);
+}
+
+static void __iomem *msm_dp_ioremap(struct platform_device *pdev, int idx, size_t *len)
+{
+	struct resource *res;
+	void __iomem *base;
+
+	base = devm_platform_get_and_ioremap_resource(pdev, idx, &res);
+	if (!IS_ERR(base))
+		*len = resource_size(res);
+
+	return base;
+}
+
+static int msm_dp_catalog_get_io(struct msm_dp_catalog_private *catalog)
+{
+	struct platform_device *pdev = to_platform_device(catalog->dev);
+	struct dss_io_data *dss = &catalog->io;
+
+	dss->ahb.base = msm_dp_ioremap(pdev, 0, &dss->ahb.len);
+	if (IS_ERR(dss->ahb.base))
+		return PTR_ERR(dss->ahb.base);
+
+	dss->aux.base = msm_dp_ioremap(pdev, 1, &dss->aux.len);
+	if (IS_ERR(dss->aux.base)) {
+		/*
+		 * The initial binding had a single reg, but in order to
+		 * support variation in the sub-region sizes this was split.
+		 * msm_dp_ioremap() will fail with -EINVAL here if only a single
+		 * reg is specified, so fill in the sub-region offsets and
+		 * lengths based on this single region.
+		 */
+		if (PTR_ERR(dss->aux.base) == -EINVAL) {
+			if (dss->ahb.len < DP_DEFAULT_P0_OFFSET + DP_DEFAULT_P0_SIZE) {
+				DRM_ERROR("legacy memory region not large enough\n");
+				return -EINVAL;
+			}
+
+			dss->ahb.len = DP_DEFAULT_AHB_SIZE;
+			dss->aux.base = dss->ahb.base + DP_DEFAULT_AUX_OFFSET;
+			dss->aux.len = DP_DEFAULT_AUX_SIZE;
+			dss->link.base = dss->ahb.base + DP_DEFAULT_LINK_OFFSET;
+			dss->link.len = DP_DEFAULT_LINK_SIZE;
+			dss->p0.base = dss->ahb.base + DP_DEFAULT_P0_OFFSET;
+			dss->p0.len = DP_DEFAULT_P0_SIZE;
+		} else {
+			DRM_ERROR("unable to remap aux region: %pe\n", dss->aux.base);
+			return PTR_ERR(dss->aux.base);
+		}
+	} else {
+		dss->link.base = msm_dp_ioremap(pdev, 2, &dss->link.len);
+		if (IS_ERR(dss->link.base)) {
+			DRM_ERROR("unable to remap link region: %pe\n", dss->link.base);
+			return PTR_ERR(dss->link.base);
+		}
+
+		dss->p0.base = msm_dp_ioremap(pdev, 3, &dss->p0.len);
+		if (IS_ERR(dss->p0.base)) {
+			DRM_ERROR("unable to remap p0 region: %pe\n", dss->p0.base);
+			return PTR_ERR(dss->p0.base);
+		}
+
+		dss->p1.base = msm_dp_ioremap(pdev, 4, &dss->p1.len);
+		if (IS_ERR(dss->p1.base)) {
+			DRM_ERROR("unable to remap p1 region: %pe\n", dss->p1.base);
+			return PTR_ERR(dss->p1.base);
+		}
+	}
+
+	return 0;
+}
+
+struct msm_dp_catalog *msm_dp_catalog_get(struct device *dev)
+{
+	struct msm_dp_catalog_private *catalog;
+	int ret;
+
+	catalog  = devm_kzalloc(dev, sizeof(*catalog), GFP_KERNEL);
+	if (!catalog)
+		return ERR_PTR(-ENOMEM);
+
+	catalog->dev = dev;
+
+	ret = msm_dp_catalog_get_io(catalog);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return &catalog->msm_dp_catalog;
+}
+
+u32 msm_dp_catalog_audio_get_header(struct msm_dp_catalog *msm_dp_catalog,
+				enum msm_dp_catalog_audio_sdp_type sdp,
+				enum msm_dp_catalog_audio_header_type header)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 (*sdp_map)[DP_AUDIO_SDP_HEADER_MAX];
+
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
+
+	sdp_map = catalog->audio_map;
+
+	return msm_dp_read_link(catalog, sdp_map[sdp][header]);
+}
+
+void msm_dp_catalog_audio_set_header(struct msm_dp_catalog *msm_dp_catalog,
+				 enum msm_dp_catalog_audio_sdp_type sdp,
+				 enum msm_dp_catalog_audio_header_type header,
+				 u32 data)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 (*sdp_map)[DP_AUDIO_SDP_HEADER_MAX];
+
+	if (!msm_dp_catalog)
+		return;
+
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
+
+	sdp_map = catalog->audio_map;
+
+	msm_dp_write_link(catalog, sdp_map[sdp][header], data);
+}
+
+void msm_dp_catalog_audio_config_acr(struct msm_dp_catalog *msm_dp_catalog, u32 select)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 acr_ctrl;
+
+	if (!msm_dp_catalog)
+		return;
+
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
+
+	acr_ctrl = select << 4 | BIT(31) | BIT(8) | BIT(14);
+
+	drm_dbg_dp(catalog->drm_dev, "select: %#x, acr_ctrl: %#x\n",
+					select, acr_ctrl);
+
+	msm_dp_write_link(catalog, MMSS_DP_AUDIO_ACR_CTRL, acr_ctrl);
+}
+
+void msm_dp_catalog_audio_enable(struct msm_dp_catalog *msm_dp_catalog, bool enable)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 audio_ctrl;
+
+	if (!msm_dp_catalog)
+		return;
+
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
+
+	audio_ctrl = msm_dp_read_link(catalog, MMSS_DP_AUDIO_CFG);
+
+	if (enable)
+		audio_ctrl |= BIT(0);
+	else
+		audio_ctrl &= ~BIT(0);
+
+	drm_dbg_dp(catalog->drm_dev, "dp_audio_cfg = 0x%x\n", audio_ctrl);
+
+	msm_dp_write_link(catalog, MMSS_DP_AUDIO_CFG, audio_ctrl);
+	/* make sure audio engine is disabled */
+	wmb();
+}
+
+void msm_dp_catalog_audio_config_sdp(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 sdp_cfg = 0;
+	u32 sdp_cfg2 = 0;
+
+	if (!msm_dp_catalog)
+		return;
+
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
+
+	sdp_cfg = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG);
+	/* AUDIO_TIMESTAMP_SDP_EN */
+	sdp_cfg |= BIT(1);
+	/* AUDIO_STREAM_SDP_EN */
+	sdp_cfg |= BIT(2);
+	/* AUDIO_COPY_MANAGEMENT_SDP_EN */
+	sdp_cfg |= BIT(5);
+	/* AUDIO_ISRC_SDP_EN  */
+	sdp_cfg |= BIT(6);
+	/* AUDIO_INFOFRAME_SDP_EN  */
+	sdp_cfg |= BIT(20);
+
+	drm_dbg_dp(catalog->drm_dev, "sdp_cfg = 0x%x\n", sdp_cfg);
+
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG, sdp_cfg);
+
+	sdp_cfg2 = msm_dp_read_link(catalog, MMSS_DP_SDP_CFG2);
+	/* IFRM_REGSRC -> Do not use reg values */
+	sdp_cfg2 &= ~BIT(0);
+	/* AUDIO_STREAM_HB3_REGSRC-> Do not use reg values */
+	sdp_cfg2 &= ~BIT(1);
+
+	drm_dbg_dp(catalog->drm_dev, "sdp_cfg2 = 0x%x\n", sdp_cfg2);
+
+	msm_dp_write_link(catalog, MMSS_DP_SDP_CFG2, sdp_cfg2);
+}
+
+void msm_dp_catalog_audio_init(struct msm_dp_catalog *msm_dp_catalog)
+{
+	struct msm_dp_catalog_private *catalog;
+
+	static u32 sdp_map[][DP_AUDIO_SDP_HEADER_MAX] = {
+		{
+			MMSS_DP_AUDIO_STREAM_0,
+			MMSS_DP_AUDIO_STREAM_1,
+			MMSS_DP_AUDIO_STREAM_1,
+		},
+		{
+			MMSS_DP_AUDIO_TIMESTAMP_0,
+			MMSS_DP_AUDIO_TIMESTAMP_1,
+			MMSS_DP_AUDIO_TIMESTAMP_1,
+		},
+		{
+			MMSS_DP_AUDIO_INFOFRAME_0,
+			MMSS_DP_AUDIO_INFOFRAME_1,
+			MMSS_DP_AUDIO_INFOFRAME_1,
+		},
+		{
+			MMSS_DP_AUDIO_COPYMANAGEMENT_0,
+			MMSS_DP_AUDIO_COPYMANAGEMENT_1,
+			MMSS_DP_AUDIO_COPYMANAGEMENT_1,
+		},
+		{
+			MMSS_DP_AUDIO_ISRC_0,
+			MMSS_DP_AUDIO_ISRC_1,
+			MMSS_DP_AUDIO_ISRC_1,
+		},
+	};
+
+	if (!msm_dp_catalog)
+		return;
+
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
+
+	catalog->audio_map = sdp_map;
+}
+
+void msm_dp_catalog_audio_sfe_level(struct msm_dp_catalog *msm_dp_catalog, u32 safe_to_exit_level)
+{
+	struct msm_dp_catalog_private *catalog;
+	u32 mainlink_levels;
+
+	if (!msm_dp_catalog)
+		return;
+
+	catalog = container_of(msm_dp_catalog,
+		struct msm_dp_catalog_private, msm_dp_catalog);
+
+	mainlink_levels = msm_dp_read_link(catalog, REG_DP_MAINLINK_LEVELS);
+	mainlink_levels &= 0xFE0;
+	mainlink_levels |= safe_to_exit_level;
+
+	drm_dbg_dp(catalog->drm_dev,
+			"mainlink_level = 0x%x, safe_to_exit_level = 0x%x\n",
+			 mainlink_levels, safe_to_exit_level);
+
+	msm_dp_write_link(catalog, REG_DP_MAINLINK_LEVELS, mainlink_levels);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_catalog.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_catalog.h
@@ -0,0 +1,154 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_CATALOG_H_
+#define _DP_CATALOG_H_
+
+#include <drm/drm_modes.h>
+
+#include "dp_utils.h"
+#include "disp/msm_disp_snapshot.h"
+
+/* interrupts */
+#define DP_INTR_HPD		BIT(0)
+#define DP_INTR_AUX_XFER_DONE	BIT(3)
+#define DP_INTR_WRONG_ADDR	BIT(6)
+#define DP_INTR_TIMEOUT		BIT(9)
+#define DP_INTR_NACK_DEFER	BIT(12)
+#define DP_INTR_WRONG_DATA_CNT	BIT(15)
+#define DP_INTR_I2C_NACK	BIT(18)
+#define DP_INTR_I2C_DEFER	BIT(21)
+#define DP_INTR_PLL_UNLOCKED	BIT(24)
+#define DP_INTR_AUX_ERROR	BIT(27)
+
+#define DP_INTR_READY_FOR_VIDEO		BIT(0)
+#define DP_INTR_IDLE_PATTERN_SENT	BIT(3)
+#define DP_INTR_FRAME_END		BIT(6)
+#define DP_INTR_CRC_UPDATED		BIT(9)
+
+#define DP_INTR_DP0_VCPF_SENT		BIT(0)
+#define DP_INTR_DP1_VCPF_SENT		BIT(3)
+
+#define DP_HW_VERSION_1_0	0x10000000
+#define DP_HW_VERSION_1_2	0x10020000
+
+#define DP_MAX_TIME_SLOTS 64
+
+enum msm_dp_catalog_audio_sdp_type {
+	DP_AUDIO_SDP_STREAM,
+	DP_AUDIO_SDP_TIMESTAMP,
+	DP_AUDIO_SDP_INFOFRAME,
+	DP_AUDIO_SDP_COPYMANAGEMENT,
+	DP_AUDIO_SDP_ISRC,
+	DP_AUDIO_SDP_MAX,
+};
+
+enum msm_dp_catalog_audio_header_type {
+	DP_AUDIO_SDP_HEADER_1,
+	DP_AUDIO_SDP_HEADER_2,
+	DP_AUDIO_SDP_HEADER_3,
+	DP_AUDIO_SDP_HEADER_MAX,
+};
+
+/* stream id */
+enum msm_dp_stream_id {
+	DP_STREAM_0,
+	DP_STREAM_1,
+	DP_STREAM_2,
+	DP_STREAM_3,
+	DP_STREAM_MAX,
+};
+
+struct msm_dp_catalog {
+	bool wide_bus_en;
+	enum msm_dp_stream_id stream_id;
+};
+
+/* Debug module */
+void msm_dp_catalog_snapshot(struct msm_dp_catalog *msm_dp_catalog, struct msm_disp_state *disp_state);
+
+/* AUX APIs */
+u32 msm_dp_catalog_aux_read_data(struct msm_dp_catalog *msm_dp_catalog);
+int msm_dp_catalog_aux_write_data(struct msm_dp_catalog *msm_dp_catalog, u32 data);
+int msm_dp_catalog_aux_write_trans(struct msm_dp_catalog *msm_dp_catalog, u32 data);
+int msm_dp_catalog_aux_clear_trans(struct msm_dp_catalog *msm_dp_catalog, bool read);
+int msm_dp_catalog_aux_clear_hw_interrupts(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_aux_reset(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_aux_enable(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+int msm_dp_catalog_aux_wait_for_hpd_connect_state(struct msm_dp_catalog *msm_dp_catalog,
+					      unsigned long wait_us);
+u32 msm_dp_catalog_aux_get_irq(struct msm_dp_catalog *msm_dp_catalog);
+
+/* DP Controller APIs */
+void msm_dp_catalog_ctrl_state_ctrl(struct msm_dp_catalog *msm_dp_catalog, u32 state);
+void msm_dp_catalog_ctrl_config_ctrl(struct msm_dp_catalog *msm_dp_catalog, u32 config);
+void msm_dp_catalog_ctrl_lane_mapping(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_mainlink_ctrl(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+void msm_dp_catalog_ctrl_psr_mainlink_enable(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+void msm_dp_catalog_setup_peripheral_flush(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_config_misc(struct msm_dp_catalog *msm_dp_catalog, u32 cc, u32 tb);
+void msm_dp_catalog_ctrl_config_msa(struct msm_dp_catalog *msm_dp_catalog, u32 rate,
+				u32 stream_rate_khz, bool is_ycbcr_420);
+int msm_dp_catalog_ctrl_set_pattern_state_bit(struct msm_dp_catalog *msm_dp_catalog, u32 pattern);
+u32 msm_dp_catalog_hw_revision(const struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_reset(struct msm_dp_catalog *msm_dp_catalog);
+bool msm_dp_catalog_ctrl_mainlink_ready(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_enable_irq(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+void msm_dp_catalog_hpd_config_intr(struct msm_dp_catalog *msm_dp_catalog,
+			u32 intr_mask, bool en);
+void msm_dp_catalog_ctrl_hpd_enable(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_hpd_disable(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_config_psr(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_set_psr(struct msm_dp_catalog *msm_dp_catalog, bool enter);
+u32 msm_dp_catalog_link_is_connected(struct msm_dp_catalog *msm_dp_catalog);
+u32 msm_dp_catalog_hpd_get_intr_status(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_phy_reset(struct msm_dp_catalog *msm_dp_catalog);
+int msm_dp_catalog_ctrl_get_interrupt(struct msm_dp_catalog *msm_dp_catalog);
+int msm_dp_catalog_ctrl_get_interrupt_5(struct msm_dp_catalog *msm_dp_catalog);
+u32 msm_dp_catalog_ctrl_read_psr_interrupt_status(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_ctrl_update_transfer_unit(struct msm_dp_catalog *msm_dp_catalog,
+				u32 msm_dp_tu, u32 valid_boundary,
+				u32 valid_boundary2);
+void msm_dp_catalog_ctrl_send_phy_pattern(struct msm_dp_catalog *msm_dp_catalog,
+				u32 pattern);
+u32 msm_dp_catalog_ctrl_read_phy_pattern(struct msm_dp_catalog *msm_dp_catalog);
+
+/* DP Panel APIs */
+int msm_dp_catalog_panel_timing_cfg(struct msm_dp_catalog *msm_dp_catalog, u32 total,
+				u32 sync_start, u32 width_blanking, u32 msm_dp_active);
+void msm_dp_catalog_panel_enable_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog, struct dp_sdp *vsc_sdp);
+void msm_dp_catalog_panel_disable_vsc_sdp(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_dump_regs(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_panel_tpg_enable(struct msm_dp_catalog *msm_dp_catalog,
+				struct drm_display_mode *drm_mode);
+void msm_dp_catalog_panel_tpg_disable(struct msm_dp_catalog *msm_dp_catalog);
+
+struct msm_dp_catalog *msm_dp_catalog_get(struct device *dev);
+
+/* DP Audio APIs */
+u32 msm_dp_catalog_audio_get_header(struct msm_dp_catalog *msm_dp_catalog,
+				enum msm_dp_catalog_audio_sdp_type sdp,
+				enum msm_dp_catalog_audio_header_type header);
+void msm_dp_catalog_audio_set_header(struct msm_dp_catalog *msm_dp_catalog,
+				 enum msm_dp_catalog_audio_sdp_type sdp,
+				 enum msm_dp_catalog_audio_header_type header,
+				 u32 data);
+void msm_dp_catalog_audio_config_acr(struct msm_dp_catalog *catalog, u32 select);
+void msm_dp_catalog_audio_enable(struct msm_dp_catalog *catalog, bool enable);
+void msm_dp_catalog_audio_config_sdp(struct msm_dp_catalog *catalog);
+void msm_dp_catalog_audio_init(struct msm_dp_catalog *catalog);
+void msm_dp_catalog_audio_sfe_level(struct msm_dp_catalog *catalog, u32 safe_to_exit_level);
+
+/* DP MST APIs */
+void msm_dp_catalog_trigger_act(struct msm_dp_catalog *msm_dp_catalog);
+bool msm_dp_catalog_read_act_complete_sts(struct msm_dp_catalog *msm_dp_catalog);
+void msm_dp_catalog_mst_config(struct msm_dp_catalog *msm_dp_catalog, bool enable);
+void msm_dp_catalog_mst_channel_alloc(struct msm_dp_catalog *msm_dp_catalog,
+				      u32 ch, u32 ch_start_slot, u32 tot_slot_cnt);
+void msm_dp_catalog_ctrl_update_rg(struct msm_dp_catalog *msm_dp_catalog, u32 stream,
+				   u32 x_int, u32 y_frac_enum);
+int msm_dp_catalog_mst_async_fifo(struct msm_dp_catalog *msm_dp_catalog);
+
+#endif /* _DP_CATALOG_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_ctrl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_ctrl.c
@@ -0,0 +1,2484 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm-dp] %s: " fmt, __func__
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/phy/phy.h>
+#include <linux/phy/phy-dp.h>
+#include <linux/pm_opp.h>
+
+#include <drm/display/drm_dp_helper.h>
+#include <drm/drm_fixed.h>
+#include <drm/drm_print.h>
+
+#include "dp_reg.h"
+#include "dp_ctrl.h"
+#include "dp_link.h"
+
+#define DP_KHZ_TO_HZ 1000
+#define IDLE_PATTERN_COMPLETION_TIMEOUT_JIFFIES	(30 * HZ / 1000) /* 30 ms */
+#define PSR_OPERATION_COMPLETION_TIMEOUT_JIFFIES       (300 * HZ / 1000) /* 300 ms */
+#define WAIT_FOR_VIDEO_READY_TIMEOUT_JIFFIES (HZ / 2)
+
+#define DP_CTRL_INTR_READY_FOR_VIDEO     BIT(0)
+#define DP_CTRL_INTR_IDLE_PATTERN_SENT  BIT(3)
+#define DP_CTRL_INTR_DP0_VCPF_SENT       BIT(0)
+#define DP_CTRL_INTR_DP1_VCPF_SENT       BIT(3)
+
+#define MST_DP0_PUSH_VCPF		BIT(12)
+#define MST_DP1_PUSH_VCPF		BIT(14)
+
+#define MR_LINK_TRAINING1  0x8
+#define MR_LINK_SYMBOL_ERM 0x80
+#define MR_LINK_PRBS7 0x100
+#define MR_LINK_CUSTOM80 0x200
+#define MR_LINK_TRAINING4  0x40
+
+enum {
+	DP_TRAINING_NONE,
+	DP_TRAINING_1,
+	DP_TRAINING_2,
+};
+
+struct msm_dp_tu_calc_input {
+	u64 lclk;        /* 162, 270, 540 and 810 */
+	u64 pclk_khz;    /* in KHz */
+	u64 hactive;     /* active h-width */
+	u64 hporch;      /* bp + fp + pulse */
+	int nlanes;      /* no.of.lanes */
+	int bpp;         /* bits */
+	int pixel_enc;   /* 444, 420, 422 */
+	int dsc_en;     /* dsc on/off */
+	int async_en;   /* async mode */
+	int fec_en;     /* fec */
+	int compress_ratio; /* 2:1 = 200, 3:1 = 300, 3.75:1 = 375 */
+	int num_of_dsc_slices; /* number of slices per line */
+};
+
+struct msm_dp_vc_tu_mapping_table {
+	u32 vic;
+	u8 lanes;
+	u8 lrate; /* DP_LINK_RATE -> 162(6), 270(10), 540(20), 810 (30) */
+	u8 bpp;
+	u8 valid_boundary_link;
+	u16 delay_start_link;
+	bool boundary_moderation_en;
+	u8 valid_lower_boundary_link;
+	u8 upper_boundary_count;
+	u8 lower_boundary_count;
+	u8 tu_size_minus1;
+};
+
+struct msm_dp_mst_ch_slot_info {
+	u32 start_slot;
+	u32 tot_slots;
+};
+
+struct msm_dp_ctrl_private {
+	struct msm_dp_ctrl msm_dp_ctrl;
+	struct drm_device *drm_dev;
+	struct device *dev;
+	struct drm_dp_aux *aux;
+	struct msm_dp_panel *panel;
+	struct msm_dp_link *link;
+	struct msm_dp_catalog *catalog;
+
+	struct phy *phy;
+
+	unsigned int num_core_clks;
+	struct clk_bulk_data *core_clks;
+
+	unsigned int num_link_clks;
+	struct clk_bulk_data *link_clks;
+
+	struct clk *pixel_clk[DP_STREAM_MAX];
+
+	union phy_configure_opts phy_opts;
+
+	struct completion idle_comp;
+	struct completion psr_op_comp;
+	struct completion video_comp;
+
+	bool core_clks_on;
+	bool link_clks_on;
+	bool mst_active;
+	bool stream_clks_on[DP_STREAM_MAX];
+
+	struct msm_dp_mst_ch_slot_info mst_ch_info[DP_STREAM_MAX];
+};
+
+static int msm_dp_aux_link_configure(struct drm_dp_aux *aux,
+					struct msm_dp_link_info *link)
+{
+	u8 values[2];
+	int err;
+
+	values[0] = drm_dp_link_rate_to_bw_code(link->rate);
+	values[1] = link->num_lanes;
+
+	if (link->capabilities & DP_LINK_CAP_ENHANCED_FRAMING)
+		values[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
+
+	err = drm_dp_dpcd_write(aux, DP_LINK_BW_SET, values, sizeof(values));
+	if (err < 0)
+		return err;
+
+	return 0;
+}
+
+void msm_dp_ctrl_push_idle(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	reinit_completion(&ctrl->idle_comp);
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_PUSH_IDLE);
+
+	if (!wait_for_completion_timeout(&ctrl->idle_comp,
+			IDLE_PATTERN_COMPLETION_TIMEOUT_JIFFIES))
+		pr_warn("PUSH_IDLE pattern timedout\n");
+
+	drm_dbg_dp(ctrl->drm_dev, "mainlink off\n");
+}
+
+void msm_dp_ctrl_push_vcpf(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel)
+{
+	u32 state = 0x0;
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (msm_dp_panel->stream_id >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
+
+	if (msm_dp_panel->stream_id == DP_STREAM_0)
+		state |= MST_DP0_PUSH_VCPF;
+	else
+		state |= MST_DP1_PUSH_VCPF;
+
+	reinit_completion(&ctrl->idle_comp);
+
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, state);
+
+	if (!wait_for_completion_timeout(&ctrl->idle_comp,
+					 IDLE_PATTERN_COMPLETION_TIMEOUT_JIFFIES))
+		pr_warn("PUSH_VCPF pattern timedout\n");
+
+	drm_dbg_dp(ctrl->drm_dev, "mainlink off\n");
+}
+
+static void msm_dp_ctrl_config_ctrl(struct msm_dp_ctrl_private *ctrl,
+		struct msm_dp_panel *msm_dp_panel)
+{
+	u32 config = 0, tbd;
+	const u8 *dpcd = ctrl->panel->dpcd;
+
+	/* Default-> LSCLK DIV: 1/4 LCLK  */
+	config |= (2 << DP_CONFIGURATION_CTRL_LSCLK_DIV_SHIFT);
+
+	if (msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420)
+		config |= DP_CONFIGURATION_CTRL_RGB_YUV; /* YUV420 */
+
+	/* Scrambler reset enable */
+	if (drm_dp_alternate_scrambler_reset_cap(dpcd))
+		config |= DP_CONFIGURATION_CTRL_ASSR;
+
+	tbd = msm_dp_link_get_test_bits_depth(ctrl->link,
+		msm_dp_panel->msm_dp_mode.bpp);
+
+	config |= tbd << DP_CONFIGURATION_CTRL_BPC_SHIFT;
+
+	/* Num of Lanes */
+	config |= ((ctrl->link->link_params.num_lanes - 1)
+			<< DP_CONFIGURATION_CTRL_NUM_OF_LANES_SHIFT);
+
+	if (drm_dp_enhanced_frame_cap(dpcd))
+		config |= DP_CONFIGURATION_CTRL_ENHANCED_FRAMING;
+
+	config |= DP_CONFIGURATION_CTRL_P_INTERLACED; /* progressive video */
+
+	/* sync clock & static Mvid */
+	config |= DP_CONFIGURATION_CTRL_STATIC_DYNAMIC_CN;
+	config |= DP_CONFIGURATION_CTRL_SYNC_ASYNC_CLK;
+
+	if (ctrl->panel->psr_cap.version)
+		config |= DP_CONFIGURATION_CTRL_SEND_VSC;
+
+	msm_dp_catalog_ctrl_config_ctrl(ctrl->catalog, config);
+}
+
+static void msm_dp_ctrl_configure_source_params(struct msm_dp_ctrl_private *ctrl,
+		struct msm_dp_panel *msm_dp_panel)
+{
+	u32 cc, tb;
+	ctrl->catalog->stream_id = msm_dp_panel->stream_id;
+
+	msm_dp_catalog_ctrl_lane_mapping(ctrl->catalog);
+	msm_dp_catalog_setup_peripheral_flush(ctrl->catalog);
+
+	if (ctrl->mst_active)
+		msm_dp_catalog_mst_config(ctrl->catalog, true);
+
+	msm_dp_ctrl_config_ctrl(ctrl, msm_dp_panel);
+
+	tb = msm_dp_link_get_test_bits_depth(ctrl->link,
+		msm_dp_panel->msm_dp_mode.bpp);
+	cc = msm_dp_link_get_colorimetry_config(ctrl->link);
+	msm_dp_catalog_ctrl_config_misc(ctrl->catalog, cc, tb);
+	msm_dp_panel_timing_cfg(msm_dp_panel);
+
+	if (ctrl->mst_active)
+		msm_dp_catalog_mst_async_fifo(ctrl->catalog);
+}
+
+/*
+ * The structure and few functions present below are IP/Hardware
+ * specific implementation. Most of the implementation will not
+ * have coding comments
+ */
+struct tu_algo_data {
+	s64 lclk_fp;
+	s64 pclk_fp;
+	s64 lwidth;
+	s64 lwidth_fp;
+	s64 hbp_relative_to_pclk;
+	s64 hbp_relative_to_pclk_fp;
+	int nlanes;
+	int bpp;
+	int pixelEnc;
+	int dsc_en;
+	int async_en;
+	int bpc;
+
+	uint delay_start_link_extra_pixclk;
+	int extra_buffer_margin;
+	s64 ratio_fp;
+	s64 original_ratio_fp;
+
+	s64 err_fp;
+	s64 n_err_fp;
+	s64 n_n_err_fp;
+	int tu_size;
+	int tu_size_desired;
+	int tu_size_minus1;
+
+	int valid_boundary_link;
+	s64 resulting_valid_fp;
+	s64 total_valid_fp;
+	s64 effective_valid_fp;
+	s64 effective_valid_recorded_fp;
+	int n_tus;
+	int n_tus_per_lane;
+	int paired_tus;
+	int remainder_tus;
+	int remainder_tus_upper;
+	int remainder_tus_lower;
+	int extra_bytes;
+	int filler_size;
+	int delay_start_link;
+
+	int extra_pclk_cycles;
+	int extra_pclk_cycles_in_link_clk;
+	s64 ratio_by_tu_fp;
+	s64 average_valid2_fp;
+	int new_valid_boundary_link;
+	int remainder_symbols_exist;
+	int n_symbols;
+	s64 n_remainder_symbols_per_lane_fp;
+	s64 last_partial_tu_fp;
+	s64 TU_ratio_err_fp;
+
+	int n_tus_incl_last_incomplete_tu;
+	int extra_pclk_cycles_tmp;
+	int extra_pclk_cycles_in_link_clk_tmp;
+	int extra_required_bytes_new_tmp;
+	int filler_size_tmp;
+	int lower_filler_size_tmp;
+	int delay_start_link_tmp;
+
+	bool boundary_moderation_en;
+	int boundary_mod_lower_err;
+	int upper_boundary_count;
+	int lower_boundary_count;
+	int i_upper_boundary_count;
+	int i_lower_boundary_count;
+	int valid_lower_boundary_link;
+	int even_distribution_BF;
+	int even_distribution_legacy;
+	int even_distribution;
+	int min_hblank_violated;
+	s64 delay_start_time_fp;
+	s64 hbp_time_fp;
+	s64 hactive_time_fp;
+	s64 diff_abs_fp;
+
+	s64 ratio;
+};
+
+static int _tu_param_compare(s64 a, s64 b)
+{
+	u32 a_sign;
+	u32 b_sign;
+	s64 a_temp, b_temp, minus_1;
+
+	if (a == b)
+		return 0;
+
+	minus_1 = drm_fixp_from_fraction(-1, 1);
+
+	a_sign = (a >> 32) & 0x80000000 ? 1 : 0;
+
+	b_sign = (b >> 32) & 0x80000000 ? 1 : 0;
+
+	if (a_sign > b_sign)
+		return 2;
+	else if (b_sign > a_sign)
+		return 1;
+
+	if (!a_sign && !b_sign) { /* positive */
+		if (a > b)
+			return 1;
+		else
+			return 2;
+	} else { /* negative */
+		a_temp = drm_fixp_mul(a, minus_1);
+		b_temp = drm_fixp_mul(b, minus_1);
+
+		if (a_temp > b_temp)
+			return 2;
+		else
+			return 1;
+	}
+}
+
+static void msm_dp_panel_update_tu_timings(struct msm_dp_tu_calc_input *in,
+					struct tu_algo_data *tu)
+{
+	int nlanes = in->nlanes;
+	int dsc_num_slices = in->num_of_dsc_slices;
+	int dsc_num_bytes  = 0;
+	int numerator;
+	s64 pclk_dsc_fp;
+	s64 dwidth_dsc_fp;
+	s64 hbp_dsc_fp;
+
+	int tot_num_eoc_symbols = 0;
+	int tot_num_hor_bytes   = 0;
+	int tot_num_dummy_bytes = 0;
+	int dwidth_dsc_bytes    = 0;
+	int  eoc_bytes           = 0;
+
+	s64 temp1_fp, temp2_fp, temp3_fp;
+
+	tu->lclk_fp              = drm_fixp_from_fraction(in->lclk, 1);
+	tu->pclk_fp              = drm_fixp_from_fraction(in->pclk_khz, 1000);
+	tu->lwidth               = in->hactive;
+	tu->hbp_relative_to_pclk = in->hporch;
+	tu->nlanes               = in->nlanes;
+	tu->bpp                  = in->bpp;
+	tu->pixelEnc             = in->pixel_enc;
+	tu->dsc_en               = in->dsc_en;
+	tu->async_en             = in->async_en;
+	tu->lwidth_fp            = drm_fixp_from_fraction(in->hactive, 1);
+	tu->hbp_relative_to_pclk_fp = drm_fixp_from_fraction(in->hporch, 1);
+
+	if (tu->pixelEnc == 420) {
+		temp1_fp = drm_fixp_from_fraction(2, 1);
+		tu->pclk_fp = drm_fixp_div(tu->pclk_fp, temp1_fp);
+		tu->lwidth_fp = drm_fixp_div(tu->lwidth_fp, temp1_fp);
+		tu->hbp_relative_to_pclk_fp =
+				drm_fixp_div(tu->hbp_relative_to_pclk_fp, 2);
+	}
+
+	if (tu->pixelEnc == 422) {
+		switch (tu->bpp) {
+		case 24:
+			tu->bpp = 16;
+			tu->bpc = 8;
+			break;
+		case 30:
+			tu->bpp = 20;
+			tu->bpc = 10;
+			break;
+		default:
+			tu->bpp = 16;
+			tu->bpc = 8;
+			break;
+		}
+	} else {
+		tu->bpc = tu->bpp/3;
+	}
+
+	if (!in->dsc_en)
+		goto fec_check;
+
+	temp1_fp = drm_fixp_from_fraction(in->compress_ratio, 100);
+	temp2_fp = drm_fixp_from_fraction(in->bpp, 1);
+	temp3_fp = drm_fixp_div(temp2_fp, temp1_fp);
+	temp2_fp = drm_fixp_mul(tu->lwidth_fp, temp3_fp);
+
+	temp1_fp = drm_fixp_from_fraction(8, 1);
+	temp3_fp = drm_fixp_div(temp2_fp, temp1_fp);
+
+	numerator = drm_fixp2int(temp3_fp);
+
+	dsc_num_bytes  = numerator / dsc_num_slices;
+	eoc_bytes           = dsc_num_bytes % nlanes;
+	tot_num_eoc_symbols = nlanes * dsc_num_slices;
+	tot_num_hor_bytes   = dsc_num_bytes * dsc_num_slices;
+	tot_num_dummy_bytes = (nlanes - eoc_bytes) * dsc_num_slices;
+
+	if (dsc_num_bytes == 0)
+		pr_info("incorrect no of bytes per slice=%d\n", dsc_num_bytes);
+
+	dwidth_dsc_bytes = (tot_num_hor_bytes +
+				tot_num_eoc_symbols +
+				(eoc_bytes == 0 ? 0 : tot_num_dummy_bytes));
+
+	dwidth_dsc_fp = drm_fixp_from_fraction(dwidth_dsc_bytes, 3);
+
+	temp2_fp = drm_fixp_mul(tu->pclk_fp, dwidth_dsc_fp);
+	temp1_fp = drm_fixp_div(temp2_fp, tu->lwidth_fp);
+	pclk_dsc_fp = temp1_fp;
+
+	temp1_fp = drm_fixp_div(pclk_dsc_fp, tu->pclk_fp);
+	temp2_fp = drm_fixp_mul(tu->hbp_relative_to_pclk_fp, temp1_fp);
+	hbp_dsc_fp = temp2_fp;
+
+	/* output */
+	tu->pclk_fp = pclk_dsc_fp;
+	tu->lwidth_fp = dwidth_dsc_fp;
+	tu->hbp_relative_to_pclk_fp = hbp_dsc_fp;
+
+fec_check:
+	if (in->fec_en) {
+		temp1_fp = drm_fixp_from_fraction(976, 1000); /* 0.976 */
+		tu->lclk_fp = drm_fixp_mul(tu->lclk_fp, temp1_fp);
+	}
+}
+
+static void _tu_valid_boundary_calc(struct tu_algo_data *tu)
+{
+	s64 temp1_fp, temp2_fp, temp, temp1, temp2;
+	int compare_result_1, compare_result_2, compare_result_3;
+
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size, 1);
+	temp2_fp = drm_fixp_mul(tu->ratio_fp, temp1_fp);
+
+	tu->new_valid_boundary_link = drm_fixp2int_ceil(temp2_fp);
+
+	temp = (tu->i_upper_boundary_count *
+				tu->new_valid_boundary_link +
+				tu->i_lower_boundary_count *
+				(tu->new_valid_boundary_link-1));
+	tu->average_valid2_fp = drm_fixp_from_fraction(temp,
+					(tu->i_upper_boundary_count +
+					tu->i_lower_boundary_count));
+
+	temp1_fp = drm_fixp_from_fraction(tu->bpp, 8);
+	temp2_fp = tu->lwidth_fp;
+	temp1_fp = drm_fixp_mul(temp2_fp, temp1_fp);
+	temp2_fp = drm_fixp_div(temp1_fp, tu->average_valid2_fp);
+	tu->n_tus = drm_fixp2int(temp2_fp);
+	if ((temp2_fp & 0xFFFFFFFF) > 0xFFFFF000)
+		tu->n_tus += 1;
+
+	temp1_fp = drm_fixp_from_fraction(tu->n_tus, 1);
+	temp2_fp = drm_fixp_mul(temp1_fp, tu->average_valid2_fp);
+	temp1_fp = drm_fixp_from_fraction(tu->n_symbols, 1);
+	temp2_fp = temp1_fp - temp2_fp;
+	temp1_fp = drm_fixp_from_fraction(tu->nlanes, 1);
+	temp2_fp = drm_fixp_div(temp2_fp, temp1_fp);
+	tu->n_remainder_symbols_per_lane_fp = temp2_fp;
+
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size, 1);
+	tu->last_partial_tu_fp =
+			drm_fixp_div(tu->n_remainder_symbols_per_lane_fp,
+					temp1_fp);
+
+	if (tu->n_remainder_symbols_per_lane_fp != 0)
+		tu->remainder_symbols_exist = 1;
+	else
+		tu->remainder_symbols_exist = 0;
+
+	temp1_fp = drm_fixp_from_fraction(tu->n_tus, tu->nlanes);
+	tu->n_tus_per_lane = drm_fixp2int(temp1_fp);
+
+	tu->paired_tus = (int)((tu->n_tus_per_lane) /
+					(tu->i_upper_boundary_count +
+					 tu->i_lower_boundary_count));
+
+	tu->remainder_tus = tu->n_tus_per_lane - tu->paired_tus *
+						(tu->i_upper_boundary_count +
+						tu->i_lower_boundary_count);
+
+	if ((tu->remainder_tus - tu->i_upper_boundary_count) > 0) {
+		tu->remainder_tus_upper = tu->i_upper_boundary_count;
+		tu->remainder_tus_lower = tu->remainder_tus -
+						tu->i_upper_boundary_count;
+	} else {
+		tu->remainder_tus_upper = tu->remainder_tus;
+		tu->remainder_tus_lower = 0;
+	}
+
+	temp = tu->paired_tus * (tu->i_upper_boundary_count *
+				tu->new_valid_boundary_link +
+				tu->i_lower_boundary_count *
+				(tu->new_valid_boundary_link - 1)) +
+				(tu->remainder_tus_upper *
+				 tu->new_valid_boundary_link) +
+				(tu->remainder_tus_lower *
+				(tu->new_valid_boundary_link - 1));
+	tu->total_valid_fp = drm_fixp_from_fraction(temp, 1);
+
+	if (tu->remainder_symbols_exist) {
+		temp1_fp = tu->total_valid_fp +
+				tu->n_remainder_symbols_per_lane_fp;
+		temp2_fp = drm_fixp_from_fraction(tu->n_tus_per_lane, 1);
+		temp2_fp = temp2_fp + tu->last_partial_tu_fp;
+		temp1_fp = drm_fixp_div(temp1_fp, temp2_fp);
+	} else {
+		temp2_fp = drm_fixp_from_fraction(tu->n_tus_per_lane, 1);
+		temp1_fp = drm_fixp_div(tu->total_valid_fp, temp2_fp);
+	}
+	tu->effective_valid_fp = temp1_fp;
+
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size, 1);
+	temp2_fp = drm_fixp_mul(tu->ratio_fp, temp1_fp);
+	tu->n_n_err_fp = tu->effective_valid_fp - temp2_fp;
+
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size, 1);
+	temp2_fp = drm_fixp_mul(tu->ratio_fp, temp1_fp);
+	tu->n_err_fp = tu->average_valid2_fp - temp2_fp;
+
+	tu->even_distribution = tu->n_tus % tu->nlanes == 0 ? 1 : 0;
+
+	temp1_fp = drm_fixp_from_fraction(tu->bpp, 8);
+	temp2_fp = tu->lwidth_fp;
+	temp1_fp = drm_fixp_mul(temp2_fp, temp1_fp);
+	temp2_fp = drm_fixp_div(temp1_fp, tu->average_valid2_fp);
+
+	if (temp2_fp)
+		tu->n_tus_incl_last_incomplete_tu = drm_fixp2int_ceil(temp2_fp);
+	else
+		tu->n_tus_incl_last_incomplete_tu = 0;
+
+	temp1 = 0;
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size, 1);
+	temp2_fp = drm_fixp_mul(tu->original_ratio_fp, temp1_fp);
+	temp1_fp = tu->average_valid2_fp - temp2_fp;
+	temp2_fp = drm_fixp_from_fraction(tu->n_tus_incl_last_incomplete_tu, 1);
+	temp1_fp = drm_fixp_mul(temp2_fp, temp1_fp);
+
+	if (temp1_fp)
+		temp1 = drm_fixp2int_ceil(temp1_fp);
+
+	temp = tu->i_upper_boundary_count * tu->nlanes;
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size, 1);
+	temp2_fp = drm_fixp_mul(tu->original_ratio_fp, temp1_fp);
+	temp1_fp = drm_fixp_from_fraction(tu->new_valid_boundary_link, 1);
+	temp2_fp = temp1_fp - temp2_fp;
+	temp1_fp = drm_fixp_from_fraction(temp, 1);
+	temp2_fp = drm_fixp_mul(temp1_fp, temp2_fp);
+
+	if (temp2_fp)
+		temp2 = drm_fixp2int_ceil(temp2_fp);
+	else
+		temp2 = 0;
+	tu->extra_required_bytes_new_tmp = (int)(temp1 + temp2);
+
+	temp1_fp = drm_fixp_from_fraction(8, tu->bpp);
+	temp2_fp = drm_fixp_from_fraction(
+	tu->extra_required_bytes_new_tmp, 1);
+	temp1_fp = drm_fixp_mul(temp2_fp, temp1_fp);
+
+	if (temp1_fp)
+		tu->extra_pclk_cycles_tmp = drm_fixp2int_ceil(temp1_fp);
+	else
+		tu->extra_pclk_cycles_tmp = 0;
+
+	temp1_fp = drm_fixp_from_fraction(tu->extra_pclk_cycles_tmp, 1);
+	temp2_fp = drm_fixp_div(tu->lclk_fp, tu->pclk_fp);
+	temp1_fp = drm_fixp_mul(temp1_fp, temp2_fp);
+
+	if (temp1_fp)
+		tu->extra_pclk_cycles_in_link_clk_tmp =
+						drm_fixp2int_ceil(temp1_fp);
+	else
+		tu->extra_pclk_cycles_in_link_clk_tmp = 0;
+
+	tu->filler_size_tmp = tu->tu_size - tu->new_valid_boundary_link;
+
+	tu->lower_filler_size_tmp = tu->filler_size_tmp + 1;
+
+	tu->delay_start_link_tmp = tu->extra_pclk_cycles_in_link_clk_tmp +
+					tu->lower_filler_size_tmp +
+					tu->extra_buffer_margin;
+
+	temp1_fp = drm_fixp_from_fraction(tu->delay_start_link_tmp, 1);
+	tu->delay_start_time_fp = drm_fixp_div(temp1_fp, tu->lclk_fp);
+
+	compare_result_1 = _tu_param_compare(tu->n_n_err_fp, tu->diff_abs_fp);
+	if (compare_result_1 == 2)
+		compare_result_1 = 1;
+	else
+		compare_result_1 = 0;
+
+	compare_result_2 = _tu_param_compare(tu->n_n_err_fp, tu->err_fp);
+	if (compare_result_2 == 2)
+		compare_result_2 = 1;
+	else
+		compare_result_2 = 0;
+
+	compare_result_3 = _tu_param_compare(tu->hbp_time_fp,
+					tu->delay_start_time_fp);
+	if (compare_result_3 == 2)
+		compare_result_3 = 0;
+	else
+		compare_result_3 = 1;
+
+	if (((tu->even_distribution == 1) ||
+			((tu->even_distribution_BF == 0) &&
+			(tu->even_distribution_legacy == 0))) &&
+			tu->n_err_fp >= 0 && tu->n_n_err_fp >= 0 &&
+			compare_result_2 &&
+			(compare_result_1 || (tu->min_hblank_violated == 1)) &&
+			(tu->new_valid_boundary_link - 1) > 0 &&
+			compare_result_3 &&
+			(tu->delay_start_link_tmp <= 1023)) {
+		tu->upper_boundary_count = tu->i_upper_boundary_count;
+		tu->lower_boundary_count = tu->i_lower_boundary_count;
+		tu->err_fp = tu->n_n_err_fp;
+		tu->boundary_moderation_en = true;
+		tu->tu_size_desired = tu->tu_size;
+		tu->valid_boundary_link = tu->new_valid_boundary_link;
+		tu->effective_valid_recorded_fp = tu->effective_valid_fp;
+		tu->even_distribution_BF = 1;
+		tu->delay_start_link = tu->delay_start_link_tmp;
+	} else if (tu->boundary_mod_lower_err == 0) {
+		compare_result_1 = _tu_param_compare(tu->n_n_err_fp,
+							tu->diff_abs_fp);
+		if (compare_result_1 == 2)
+			tu->boundary_mod_lower_err = 1;
+	}
+}
+
+static void _dp_ctrl_calc_tu(struct msm_dp_ctrl_private *ctrl,
+				struct msm_dp_tu_calc_input *in,
+				struct msm_dp_vc_tu_mapping_table *tu_table)
+{
+	struct tu_algo_data *tu;
+	int compare_result_1, compare_result_2;
+	u64 temp = 0;
+	s64 temp_fp = 0, temp1_fp = 0, temp2_fp = 0;
+
+	s64 LCLK_FAST_SKEW_fp = drm_fixp_from_fraction(6, 10000); /* 0.0006 */
+	s64 const_p49_fp = drm_fixp_from_fraction(49, 100); /* 0.49 */
+	s64 const_p56_fp = drm_fixp_from_fraction(56, 100); /* 0.56 */
+	s64 RATIO_SCALE_fp = drm_fixp_from_fraction(1001, 1000);
+
+	u8 DP_BRUTE_FORCE = 1;
+	s64 BRUTE_FORCE_THRESHOLD_fp = drm_fixp_from_fraction(1, 10); /* 0.1 */
+	uint EXTRA_PIXCLK_CYCLE_DELAY = 4;
+	uint HBLANK_MARGIN = 4;
+
+	tu = kzalloc(sizeof(*tu), GFP_KERNEL);
+	if (!tu)
+		return;
+
+	msm_dp_panel_update_tu_timings(in, tu);
+
+	tu->err_fp = drm_fixp_from_fraction(1000, 1); /* 1000 */
+
+	temp1_fp = drm_fixp_from_fraction(4, 1);
+	temp2_fp = drm_fixp_mul(temp1_fp, tu->lclk_fp);
+	temp_fp = drm_fixp_div(temp2_fp, tu->pclk_fp);
+	tu->extra_buffer_margin = drm_fixp2int_ceil(temp_fp);
+
+	temp1_fp = drm_fixp_from_fraction(tu->bpp, 8);
+	temp2_fp = drm_fixp_mul(tu->pclk_fp, temp1_fp);
+	temp1_fp = drm_fixp_from_fraction(tu->nlanes, 1);
+	temp2_fp = drm_fixp_div(temp2_fp, temp1_fp);
+	tu->ratio_fp = drm_fixp_div(temp2_fp, tu->lclk_fp);
+
+	tu->original_ratio_fp = tu->ratio_fp;
+	tu->boundary_moderation_en = false;
+	tu->upper_boundary_count = 0;
+	tu->lower_boundary_count = 0;
+	tu->i_upper_boundary_count = 0;
+	tu->i_lower_boundary_count = 0;
+	tu->valid_lower_boundary_link = 0;
+	tu->even_distribution_BF = 0;
+	tu->even_distribution_legacy = 0;
+	tu->even_distribution = 0;
+	tu->delay_start_time_fp = 0;
+
+	tu->err_fp = drm_fixp_from_fraction(1000, 1);
+	tu->n_err_fp = 0;
+	tu->n_n_err_fp = 0;
+
+	tu->ratio = drm_fixp2int(tu->ratio_fp);
+	temp1_fp = drm_fixp_from_fraction(tu->nlanes, 1);
+	div64_u64_rem(tu->lwidth_fp, temp1_fp, &temp2_fp);
+	if (temp2_fp != 0 &&
+			!tu->ratio && tu->dsc_en == 0) {
+		tu->ratio_fp = drm_fixp_mul(tu->ratio_fp, RATIO_SCALE_fp);
+		tu->ratio = drm_fixp2int(tu->ratio_fp);
+		if (tu->ratio)
+			tu->ratio_fp = drm_fixp_from_fraction(1, 1);
+	}
+
+	if (tu->ratio > 1)
+		tu->ratio = 1;
+
+	if (tu->ratio == 1)
+		goto tu_size_calc;
+
+	compare_result_1 = _tu_param_compare(tu->ratio_fp, const_p49_fp);
+	if (!compare_result_1 || compare_result_1 == 1)
+		compare_result_1 = 1;
+	else
+		compare_result_1 = 0;
+
+	compare_result_2 = _tu_param_compare(tu->ratio_fp, const_p56_fp);
+	if (!compare_result_2 || compare_result_2 == 2)
+		compare_result_2 = 1;
+	else
+		compare_result_2 = 0;
+
+	if (tu->dsc_en && compare_result_1 && compare_result_2) {
+		HBLANK_MARGIN += 4;
+		drm_dbg_dp(ctrl->drm_dev,
+			"increase HBLANK_MARGIN to %d\n", HBLANK_MARGIN);
+	}
+
+tu_size_calc:
+	for (tu->tu_size = 32; tu->tu_size <= 64; tu->tu_size++) {
+		temp1_fp = drm_fixp_from_fraction(tu->tu_size, 1);
+		temp2_fp = drm_fixp_mul(tu->ratio_fp, temp1_fp);
+		temp = drm_fixp2int_ceil(temp2_fp);
+		temp1_fp = drm_fixp_from_fraction(temp, 1);
+		tu->n_err_fp = temp1_fp - temp2_fp;
+
+		if (tu->n_err_fp < tu->err_fp) {
+			tu->err_fp = tu->n_err_fp;
+			tu->tu_size_desired = tu->tu_size;
+		}
+	}
+
+	tu->tu_size_minus1 = tu->tu_size_desired - 1;
+
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size_desired, 1);
+	temp2_fp = drm_fixp_mul(tu->ratio_fp, temp1_fp);
+	tu->valid_boundary_link = drm_fixp2int_ceil(temp2_fp);
+
+	temp1_fp = drm_fixp_from_fraction(tu->bpp, 8);
+	temp2_fp = tu->lwidth_fp;
+	temp2_fp = drm_fixp_mul(temp2_fp, temp1_fp);
+
+	temp1_fp = drm_fixp_from_fraction(tu->valid_boundary_link, 1);
+	temp2_fp = drm_fixp_div(temp2_fp, temp1_fp);
+	tu->n_tus = drm_fixp2int(temp2_fp);
+	if ((temp2_fp & 0xFFFFFFFF) > 0xFFFFF000)
+		tu->n_tus += 1;
+
+	tu->even_distribution_legacy = tu->n_tus % tu->nlanes == 0 ? 1 : 0;
+
+	drm_dbg_dp(ctrl->drm_dev,
+			"n_sym = %d, num_of_tus = %d\n",
+			tu->valid_boundary_link, tu->n_tus);
+
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size_desired, 1);
+	temp2_fp = drm_fixp_mul(tu->original_ratio_fp, temp1_fp);
+	temp1_fp = drm_fixp_from_fraction(tu->valid_boundary_link, 1);
+	temp2_fp = temp1_fp - temp2_fp;
+	temp1_fp = drm_fixp_from_fraction(tu->n_tus + 1, 1);
+	temp2_fp = drm_fixp_mul(temp1_fp, temp2_fp);
+
+	temp = drm_fixp2int(temp2_fp);
+	if (temp && temp2_fp)
+		tu->extra_bytes = drm_fixp2int_ceil(temp2_fp);
+	else
+		tu->extra_bytes = 0;
+
+	temp1_fp = drm_fixp_from_fraction(tu->extra_bytes, 1);
+	temp2_fp = drm_fixp_from_fraction(8, tu->bpp);
+	temp1_fp = drm_fixp_mul(temp1_fp, temp2_fp);
+
+	if (temp && temp1_fp)
+		tu->extra_pclk_cycles = drm_fixp2int_ceil(temp1_fp);
+	else
+		tu->extra_pclk_cycles = drm_fixp2int(temp1_fp);
+
+	temp1_fp = drm_fixp_div(tu->lclk_fp, tu->pclk_fp);
+	temp2_fp = drm_fixp_from_fraction(tu->extra_pclk_cycles, 1);
+	temp1_fp = drm_fixp_mul(temp2_fp, temp1_fp);
+
+	if (temp1_fp)
+		tu->extra_pclk_cycles_in_link_clk = drm_fixp2int_ceil(temp1_fp);
+	else
+		tu->extra_pclk_cycles_in_link_clk = drm_fixp2int(temp1_fp);
+
+	tu->filler_size = tu->tu_size_desired - tu->valid_boundary_link;
+
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size_desired, 1);
+	tu->ratio_by_tu_fp = drm_fixp_mul(tu->ratio_fp, temp1_fp);
+
+	tu->delay_start_link = tu->extra_pclk_cycles_in_link_clk +
+				tu->filler_size + tu->extra_buffer_margin;
+
+	tu->resulting_valid_fp =
+			drm_fixp_from_fraction(tu->valid_boundary_link, 1);
+
+	temp1_fp = drm_fixp_from_fraction(tu->tu_size_desired, 1);
+	temp2_fp = drm_fixp_div(tu->resulting_valid_fp, temp1_fp);
+	tu->TU_ratio_err_fp = temp2_fp - tu->original_ratio_fp;
+
+	temp1_fp = drm_fixp_from_fraction(HBLANK_MARGIN, 1);
+	temp1_fp = tu->hbp_relative_to_pclk_fp - temp1_fp;
+	tu->hbp_time_fp = drm_fixp_div(temp1_fp, tu->pclk_fp);
+
+	temp1_fp = drm_fixp_from_fraction(tu->delay_start_link, 1);
+	tu->delay_start_time_fp = drm_fixp_div(temp1_fp, tu->lclk_fp);
+
+	compare_result_1 = _tu_param_compare(tu->hbp_time_fp,
+					tu->delay_start_time_fp);
+	if (compare_result_1 == 2) /* if (hbp_time_fp < delay_start_time_fp) */
+		tu->min_hblank_violated = 1;
+
+	tu->hactive_time_fp = drm_fixp_div(tu->lwidth_fp, tu->pclk_fp);
+
+	compare_result_2 = _tu_param_compare(tu->hactive_time_fp,
+						tu->delay_start_time_fp);
+	if (compare_result_2 == 2)
+		tu->min_hblank_violated = 1;
+
+	tu->delay_start_time_fp = 0;
+
+	/* brute force */
+
+	tu->delay_start_link_extra_pixclk = EXTRA_PIXCLK_CYCLE_DELAY;
+	tu->diff_abs_fp = tu->resulting_valid_fp - tu->ratio_by_tu_fp;
+
+	temp = drm_fixp2int(tu->diff_abs_fp);
+	if (!temp && tu->diff_abs_fp <= 0xffff)
+		tu->diff_abs_fp = 0;
+
+	/* if(diff_abs < 0) diff_abs *= -1 */
+	if (tu->diff_abs_fp < 0)
+		tu->diff_abs_fp = drm_fixp_mul(tu->diff_abs_fp, -1);
+
+	tu->boundary_mod_lower_err = 0;
+	if ((tu->diff_abs_fp != 0 &&
+			((tu->diff_abs_fp > BRUTE_FORCE_THRESHOLD_fp) ||
+			 (tu->even_distribution_legacy == 0) ||
+			 (DP_BRUTE_FORCE == 1))) ||
+			(tu->min_hblank_violated == 1)) {
+		do {
+			tu->err_fp = drm_fixp_from_fraction(1000, 1);
+
+			temp1_fp = drm_fixp_div(tu->lclk_fp, tu->pclk_fp);
+			temp2_fp = drm_fixp_from_fraction(
+					tu->delay_start_link_extra_pixclk, 1);
+			temp1_fp = drm_fixp_mul(temp2_fp, temp1_fp);
+
+			if (temp1_fp)
+				tu->extra_buffer_margin =
+					drm_fixp2int_ceil(temp1_fp);
+			else
+				tu->extra_buffer_margin = 0;
+
+			temp1_fp = drm_fixp_from_fraction(tu->bpp, 8);
+			temp1_fp = drm_fixp_mul(tu->lwidth_fp, temp1_fp);
+
+			if (temp1_fp)
+				tu->n_symbols = drm_fixp2int_ceil(temp1_fp);
+			else
+				tu->n_symbols = 0;
+
+			for (tu->tu_size = 32; tu->tu_size <= 64; tu->tu_size++) {
+				for (tu->i_upper_boundary_count = 1;
+					tu->i_upper_boundary_count <= 15;
+					tu->i_upper_boundary_count++) {
+					for (tu->i_lower_boundary_count = 1;
+						tu->i_lower_boundary_count <= 15;
+						tu->i_lower_boundary_count++) {
+						_tu_valid_boundary_calc(tu);
+					}
+				}
+			}
+			tu->delay_start_link_extra_pixclk--;
+		} while (tu->boundary_moderation_en != true &&
+			tu->boundary_mod_lower_err == 1 &&
+			tu->delay_start_link_extra_pixclk != 0);
+
+		if (tu->boundary_moderation_en == true) {
+			temp1_fp = drm_fixp_from_fraction(
+					(tu->upper_boundary_count *
+					tu->valid_boundary_link +
+					tu->lower_boundary_count *
+					(tu->valid_boundary_link - 1)), 1);
+			temp2_fp = drm_fixp_from_fraction(
+					(tu->upper_boundary_count +
+					tu->lower_boundary_count), 1);
+			tu->resulting_valid_fp =
+					drm_fixp_div(temp1_fp, temp2_fp);
+
+			temp1_fp = drm_fixp_from_fraction(
+					tu->tu_size_desired, 1);
+			tu->ratio_by_tu_fp =
+				drm_fixp_mul(tu->original_ratio_fp, temp1_fp);
+
+			tu->valid_lower_boundary_link =
+				tu->valid_boundary_link - 1;
+
+			temp1_fp = drm_fixp_from_fraction(tu->bpp, 8);
+			temp1_fp = drm_fixp_mul(tu->lwidth_fp, temp1_fp);
+			temp2_fp = drm_fixp_div(temp1_fp,
+						tu->resulting_valid_fp);
+			tu->n_tus = drm_fixp2int(temp2_fp);
+
+			tu->tu_size_minus1 = tu->tu_size_desired - 1;
+			tu->even_distribution_BF = 1;
+
+			temp1_fp =
+				drm_fixp_from_fraction(tu->tu_size_desired, 1);
+			temp2_fp =
+				drm_fixp_div(tu->resulting_valid_fp, temp1_fp);
+			tu->TU_ratio_err_fp = temp2_fp - tu->original_ratio_fp;
+		}
+	}
+
+	temp2_fp = drm_fixp_mul(LCLK_FAST_SKEW_fp, tu->lwidth_fp);
+
+	if (temp2_fp)
+		temp = drm_fixp2int_ceil(temp2_fp);
+	else
+		temp = 0;
+
+	temp1_fp = drm_fixp_from_fraction(tu->nlanes, 1);
+	temp2_fp = drm_fixp_mul(tu->original_ratio_fp, temp1_fp);
+	temp1_fp = drm_fixp_from_fraction(tu->bpp, 8);
+	temp2_fp = drm_fixp_div(temp1_fp, temp2_fp);
+	temp1_fp = drm_fixp_from_fraction(temp, 1);
+	temp2_fp = drm_fixp_mul(temp1_fp, temp2_fp);
+	temp = drm_fixp2int(temp2_fp);
+
+	if (tu->async_en)
+		tu->delay_start_link += (int)temp;
+
+	temp1_fp = drm_fixp_from_fraction(tu->delay_start_link, 1);
+	tu->delay_start_time_fp = drm_fixp_div(temp1_fp, tu->lclk_fp);
+
+	/* OUTPUTS */
+	tu_table->valid_boundary_link       = tu->valid_boundary_link;
+	tu_table->delay_start_link          = tu->delay_start_link;
+	tu_table->boundary_moderation_en    = tu->boundary_moderation_en;
+	tu_table->valid_lower_boundary_link = tu->valid_lower_boundary_link;
+	tu_table->upper_boundary_count      = tu->upper_boundary_count;
+	tu_table->lower_boundary_count      = tu->lower_boundary_count;
+	tu_table->tu_size_minus1            = tu->tu_size_minus1;
+
+	drm_dbg_dp(ctrl->drm_dev, "TU: valid_boundary_link: %d\n",
+				tu_table->valid_boundary_link);
+	drm_dbg_dp(ctrl->drm_dev, "TU: delay_start_link: %d\n",
+				tu_table->delay_start_link);
+	drm_dbg_dp(ctrl->drm_dev, "TU: boundary_moderation_en: %d\n",
+			tu_table->boundary_moderation_en);
+	drm_dbg_dp(ctrl->drm_dev, "TU: valid_lower_boundary_link: %d\n",
+			tu_table->valid_lower_boundary_link);
+	drm_dbg_dp(ctrl->drm_dev, "TU: upper_boundary_count: %d\n",
+			tu_table->upper_boundary_count);
+	drm_dbg_dp(ctrl->drm_dev, "TU: lower_boundary_count: %d\n",
+			tu_table->lower_boundary_count);
+	drm_dbg_dp(ctrl->drm_dev, "TU: tu_size_minus1: %d\n",
+			tu_table->tu_size_minus1);
+
+	kfree(tu);
+}
+
+static void msm_dp_ctrl_calc_tu_parameters(struct msm_dp_ctrl_private *ctrl,
+		struct msm_dp_vc_tu_mapping_table *tu_table)
+{
+	struct msm_dp_tu_calc_input in;
+	struct drm_display_mode *drm_mode;
+
+	drm_mode = &ctrl->panel->msm_dp_mode.drm_mode;
+
+	in.lclk = ctrl->link->link_params.rate / 1000;
+	in.pclk_khz = drm_mode->clock;
+	in.hactive = drm_mode->hdisplay;
+	in.hporch = drm_mode->htotal - drm_mode->hdisplay;
+	in.nlanes = ctrl->link->link_params.num_lanes;
+	in.bpp = ctrl->panel->msm_dp_mode.bpp;
+	in.pixel_enc = ctrl->panel->msm_dp_mode.out_fmt_is_yuv_420 ? 420 : 444;
+	in.dsc_en = 0;
+	in.async_en = 0;
+	in.fec_en = 0;
+	in.num_of_dsc_slices = 0;
+	in.compress_ratio = 100;
+
+	_dp_ctrl_calc_tu(ctrl, &in, tu_table);
+}
+
+static void msm_dp_ctrl_setup_tr_unit(struct msm_dp_ctrl_private *ctrl)
+{
+	u32 msm_dp_tu = 0x0;
+	u32 valid_boundary = 0x0;
+	u32 valid_boundary2 = 0x0;
+	struct msm_dp_vc_tu_mapping_table tu_calc_table;
+
+	msm_dp_ctrl_calc_tu_parameters(ctrl, &tu_calc_table);
+
+	msm_dp_tu |= tu_calc_table.tu_size_minus1;
+	valid_boundary |= tu_calc_table.valid_boundary_link;
+	valid_boundary |= (tu_calc_table.delay_start_link << 16);
+
+	valid_boundary2 |= (tu_calc_table.valid_lower_boundary_link << 1);
+	valid_boundary2 |= (tu_calc_table.upper_boundary_count << 16);
+	valid_boundary2 |= (tu_calc_table.lower_boundary_count << 20);
+
+	if (tu_calc_table.boundary_moderation_en)
+		valid_boundary2 |= BIT(0);
+
+	pr_debug("dp_tu=0x%x, valid_boundary=0x%x, valid_boundary2=0x%x\n",
+			msm_dp_tu, valid_boundary, valid_boundary2);
+
+	msm_dp_catalog_ctrl_update_transfer_unit(ctrl->catalog,
+				msm_dp_tu, valid_boundary, valid_boundary2);
+}
+
+static int msm_dp_ctrl_wait4video_ready(struct msm_dp_ctrl_private *ctrl)
+{
+	int ret = 0;
+
+	if (!wait_for_completion_timeout(&ctrl->video_comp,
+				WAIT_FOR_VIDEO_READY_TIMEOUT_JIFFIES)) {
+		DRM_ERROR("wait4video timedout\n");
+		ret = -ETIMEDOUT;
+	}
+	return ret;
+}
+
+static int msm_dp_ctrl_set_vx_px(struct msm_dp_ctrl_private *ctrl,
+			     u8 v_level, u8 p_level)
+{
+	union phy_configure_opts *phy_opts = &ctrl->phy_opts;
+
+	/* TODO: Update for all lanes instead of just first one */
+	phy_opts->dp.voltage[0] = v_level;
+	phy_opts->dp.pre[0] = p_level;
+	phy_opts->dp.set_voltages = 1;
+	phy_configure(ctrl->phy, phy_opts);
+	phy_opts->dp.set_voltages = 0;
+
+	return 0;
+}
+
+static int msm_dp_ctrl_update_vx_px(struct msm_dp_ctrl_private *ctrl)
+{
+	struct msm_dp_link *link = ctrl->link;
+	int ret = 0, lane, lane_cnt;
+	u8 buf[4];
+	u32 max_level_reached = 0;
+	u32 voltage_swing_level = link->phy_params.v_level;
+	u32 pre_emphasis_level = link->phy_params.p_level;
+
+	drm_dbg_dp(ctrl->drm_dev,
+		"voltage level: %d emphasis level: %d\n",
+			voltage_swing_level, pre_emphasis_level);
+	ret = msm_dp_ctrl_set_vx_px(ctrl,
+		voltage_swing_level, pre_emphasis_level);
+
+	if (ret)
+		return ret;
+
+	if (voltage_swing_level >= DP_TRAIN_LEVEL_MAX) {
+		drm_dbg_dp(ctrl->drm_dev,
+				"max. voltage swing level reached %d\n",
+				voltage_swing_level);
+		max_level_reached |= DP_TRAIN_MAX_SWING_REACHED;
+	}
+
+	if (pre_emphasis_level >= DP_TRAIN_LEVEL_MAX) {
+		drm_dbg_dp(ctrl->drm_dev,
+				"max. pre-emphasis level reached %d\n",
+				pre_emphasis_level);
+		max_level_reached  |= DP_TRAIN_MAX_PRE_EMPHASIS_REACHED;
+	}
+
+	pre_emphasis_level <<= DP_TRAIN_PRE_EMPHASIS_SHIFT;
+
+	lane_cnt = ctrl->link->link_params.num_lanes;
+	for (lane = 0; lane < lane_cnt; lane++)
+		buf[lane] = voltage_swing_level | pre_emphasis_level
+				| max_level_reached;
+
+	drm_dbg_dp(ctrl->drm_dev, "sink: p|v=0x%x\n",
+			voltage_swing_level | pre_emphasis_level);
+	ret = drm_dp_dpcd_write(ctrl->aux, DP_TRAINING_LANE0_SET,
+					buf, lane_cnt);
+	if (ret == lane_cnt)
+		ret = 0;
+
+	return ret;
+}
+
+static bool msm_dp_ctrl_train_pattern_set(struct msm_dp_ctrl_private *ctrl,
+		u8 pattern)
+{
+	u8 buf;
+	int ret = 0;
+
+	drm_dbg_dp(ctrl->drm_dev, "sink: pattern=%x\n", pattern);
+
+	buf = pattern;
+
+	if (pattern && pattern != DP_TRAINING_PATTERN_4)
+		buf |= DP_LINK_SCRAMBLING_DISABLE;
+
+	ret = drm_dp_dpcd_writeb(ctrl->aux, DP_TRAINING_PATTERN_SET, buf);
+	return ret == 1;
+}
+
+static int msm_dp_ctrl_read_link_status(struct msm_dp_ctrl_private *ctrl,
+				    u8 *link_status)
+{
+	int ret = 0, len;
+
+	len = drm_dp_dpcd_read_link_status(ctrl->aux, link_status);
+	if (len != DP_LINK_STATUS_SIZE) {
+		DRM_ERROR("DP link status read failed, err: %d\n", len);
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+static int msm_dp_ctrl_link_train_1(struct msm_dp_ctrl_private *ctrl,
+			int *training_step)
+{
+	int tries, old_v_level, ret = 0;
+	u8 link_status[DP_LINK_STATUS_SIZE];
+	int const maximum_retries = 4;
+
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+
+	*training_step = DP_TRAINING_1;
+
+	ret = msm_dp_catalog_ctrl_set_pattern_state_bit(ctrl->catalog, 1);
+	if (ret)
+		return ret;
+	msm_dp_ctrl_train_pattern_set(ctrl, DP_TRAINING_PATTERN_1 |
+		DP_LINK_SCRAMBLING_DISABLE);
+
+	ret = msm_dp_ctrl_update_vx_px(ctrl);
+	if (ret)
+		return ret;
+
+	tries = 0;
+	old_v_level = ctrl->link->phy_params.v_level;
+	for (tries = 0; tries < maximum_retries; tries++) {
+		drm_dp_link_train_clock_recovery_delay(ctrl->aux, ctrl->panel->dpcd);
+
+		ret = msm_dp_ctrl_read_link_status(ctrl, link_status);
+		if (ret)
+			return ret;
+
+		if (drm_dp_clock_recovery_ok(link_status,
+			ctrl->link->link_params.num_lanes)) {
+			return 0;
+		}
+
+		if (ctrl->link->phy_params.v_level >=
+			DP_TRAIN_LEVEL_MAX) {
+			DRM_ERROR_RATELIMITED("max v_level reached\n");
+			return -EAGAIN;
+		}
+
+		if (old_v_level != ctrl->link->phy_params.v_level) {
+			tries = 0;
+			old_v_level = ctrl->link->phy_params.v_level;
+		}
+
+		msm_dp_link_adjust_levels(ctrl->link, link_status);
+		ret = msm_dp_ctrl_update_vx_px(ctrl);
+		if (ret)
+			return ret;
+	}
+
+	DRM_ERROR("max tries reached\n");
+	return -ETIMEDOUT;
+}
+
+static int msm_dp_ctrl_link_rate_down_shift(struct msm_dp_ctrl_private *ctrl)
+{
+	int ret = 0;
+
+	switch (ctrl->link->link_params.rate) {
+	case 810000:
+		ctrl->link->link_params.rate = 540000;
+		break;
+	case 540000:
+		ctrl->link->link_params.rate = 270000;
+		break;
+	case 270000:
+		ctrl->link->link_params.rate = 162000;
+		break;
+	case 162000:
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	if (!ret) {
+		drm_dbg_dp(ctrl->drm_dev, "new rate=0x%x\n",
+				ctrl->link->link_params.rate);
+	}
+
+	return ret;
+}
+
+static int msm_dp_ctrl_link_lane_down_shift(struct msm_dp_ctrl_private *ctrl)
+{
+
+	if (ctrl->link->link_params.num_lanes == 1)
+		return -1;
+
+	ctrl->link->link_params.num_lanes /= 2;
+	ctrl->link->link_params.rate = ctrl->panel->link_info.rate;
+
+	ctrl->link->phy_params.p_level = 0;
+	ctrl->link->phy_params.v_level = 0;
+
+	return 0;
+}
+
+static void msm_dp_ctrl_clear_training_pattern(struct msm_dp_ctrl_private *ctrl)
+{
+	msm_dp_ctrl_train_pattern_set(ctrl, DP_TRAINING_PATTERN_DISABLE);
+	drm_dp_link_train_channel_eq_delay(ctrl->aux, ctrl->panel->dpcd);
+}
+
+static int msm_dp_ctrl_link_train_2(struct msm_dp_ctrl_private *ctrl,
+			int *training_step)
+{
+	int tries = 0, ret = 0;
+	u8 pattern;
+	u32 state_ctrl_bit;
+	int const maximum_retries = 5;
+	u8 link_status[DP_LINK_STATUS_SIZE];
+
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+
+	*training_step = DP_TRAINING_2;
+
+	if (drm_dp_tps4_supported(ctrl->panel->dpcd)) {
+		pattern = DP_TRAINING_PATTERN_4;
+		state_ctrl_bit = 4;
+	} else if (drm_dp_tps3_supported(ctrl->panel->dpcd)) {
+		pattern = DP_TRAINING_PATTERN_3;
+		state_ctrl_bit = 3;
+	} else {
+		pattern = DP_TRAINING_PATTERN_2;
+		state_ctrl_bit = 2;
+	}
+
+	ret = msm_dp_catalog_ctrl_set_pattern_state_bit(ctrl->catalog, state_ctrl_bit);
+	if (ret)
+		return ret;
+
+	msm_dp_ctrl_train_pattern_set(ctrl, pattern);
+
+	for (tries = 0; tries <= maximum_retries; tries++) {
+		drm_dp_link_train_channel_eq_delay(ctrl->aux, ctrl->panel->dpcd);
+
+		ret = msm_dp_ctrl_read_link_status(ctrl, link_status);
+		if (ret)
+			return ret;
+
+		if (drm_dp_channel_eq_ok(link_status,
+			ctrl->link->link_params.num_lanes)) {
+			return 0;
+		}
+
+		msm_dp_link_adjust_levels(ctrl->link, link_status);
+		ret = msm_dp_ctrl_update_vx_px(ctrl);
+		if (ret)
+			return ret;
+
+	}
+
+	return -ETIMEDOUT;
+}
+
+static int msm_dp_ctrl_link_train(struct msm_dp_ctrl_private *ctrl,
+			int *training_step)
+{
+	int ret = 0;
+	const u8 *dpcd = ctrl->panel->dpcd;
+	u8 encoding[] = { 0, DP_SET_ANSI_8B10B };
+	u8 assr;
+	struct msm_dp_link_info link_info = {0};
+
+	msm_dp_ctrl_config_ctrl(ctrl, ctrl->panel);
+
+	link_info.num_lanes = ctrl->link->link_params.num_lanes;
+	link_info.rate = ctrl->link->link_params.rate;
+	link_info.capabilities = DP_LINK_CAP_ENHANCED_FRAMING;
+
+	msm_dp_link_reset_phy_params_vx_px(ctrl->link);
+
+	msm_dp_aux_link_configure(ctrl->aux, &link_info);
+
+	if (drm_dp_max_downspread(dpcd))
+		encoding[0] |= DP_SPREAD_AMP_0_5;
+
+	/* config DOWNSPREAD_CTRL and MAIN_LINK_CHANNEL_CODING_SET */
+	drm_dp_dpcd_write(ctrl->aux, DP_DOWNSPREAD_CTRL, encoding, 2);
+
+	if (drm_dp_alternate_scrambler_reset_cap(dpcd)) {
+		assr = DP_ALTERNATE_SCRAMBLER_RESET_ENABLE;
+		drm_dp_dpcd_write(ctrl->aux, DP_EDP_CONFIGURATION_SET,
+				&assr, 1);
+	}
+
+	ret = msm_dp_ctrl_link_train_1(ctrl, training_step);
+	if (ret) {
+		DRM_ERROR("link training #1 failed. ret=%d\n", ret);
+		goto end;
+	}
+
+	/* print success info as this is a result of user initiated action */
+	drm_dbg_dp(ctrl->drm_dev, "link training #1 successful\n");
+
+	ret = msm_dp_ctrl_link_train_2(ctrl, training_step);
+	if (ret) {
+		DRM_ERROR("link training #2 failed. ret=%d\n", ret);
+		goto end;
+	}
+
+	/* print success info as this is a result of user initiated action */
+	drm_dbg_dp(ctrl->drm_dev, "link training #2 successful\n");
+
+end:
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+
+	return ret;
+}
+
+static int msm_dp_ctrl_setup_main_link(struct msm_dp_ctrl_private *ctrl,
+			int *training_step)
+{
+	int ret = 0;
+
+	msm_dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, true);
+
+	if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN)
+		return ret;
+
+	/*
+	 * As part of previous calls, DP controller state might have
+	 * transitioned to PUSH_IDLE. In order to start transmitting
+	 * a link training pattern, we have to first do soft reset.
+	 */
+
+	ret = msm_dp_ctrl_link_train(ctrl, training_step);
+
+	return ret;
+}
+
+int msm_dp_ctrl_core_clk_enable(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	int ret = 0;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (ctrl->core_clks_on) {
+		drm_dbg_dp(ctrl->drm_dev, "core clks already enabled\n");
+		return 0;
+	}
+
+	ret = clk_bulk_prepare_enable(ctrl->num_core_clks, ctrl->core_clks);
+	if (ret)
+		return ret;
+
+	ctrl->core_clks_on = true;
+
+	drm_dbg_dp(ctrl->drm_dev, "enable core clocks \n");
+	drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
+		   ctrl->stream_clks_on ? "on" : "off",
+		   ctrl->link_clks_on ? "on" : "off",
+		   ctrl->core_clks_on ? "on" : "off");
+
+	return 0;
+}
+
+void msm_dp_ctrl_core_clk_disable(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	clk_bulk_disable_unprepare(ctrl->num_core_clks, ctrl->core_clks);
+
+	ctrl->core_clks_on = false;
+
+	drm_dbg_dp(ctrl->drm_dev, "disable core clocks \n");
+	drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
+		   ctrl->stream_clks_on ? "on" : "off",
+		   ctrl->link_clks_on ? "on" : "off",
+		   ctrl->core_clks_on ? "on" : "off");
+}
+
+static int msm_dp_ctrl_link_clk_enable(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	int ret = 0;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (ctrl->link_clks_on) {
+		drm_dbg_dp(ctrl->drm_dev, "links clks already enabled\n");
+		return 0;
+	}
+
+	if (!ctrl->core_clks_on) {
+		drm_dbg_dp(ctrl->drm_dev, "Enable core clks before link clks\n");
+
+		msm_dp_ctrl_core_clk_enable(msm_dp_ctrl);
+	}
+
+	ret = clk_bulk_prepare_enable(ctrl->num_link_clks, ctrl->link_clks);
+	if (ret)
+		return ret;
+
+	ctrl->link_clks_on = true;
+
+	drm_dbg_dp(ctrl->drm_dev, "enable link clocks\n");
+	drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
+		   ctrl->stream_clks_on ? "on" : "off",
+		   ctrl->link_clks_on ? "on" : "off",
+		   ctrl->core_clks_on ? "on" : "off");
+
+	return 0;
+}
+
+static void msm_dp_ctrl_link_clk_disable(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	clk_bulk_disable_unprepare(ctrl->num_link_clks, ctrl->link_clks);
+
+	ctrl->link_clks_on = false;
+
+	drm_dbg_dp(ctrl->drm_dev, "disabled link clocks\n");
+	drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
+		   ctrl->stream_clks_on ? "on" : "off",
+		   ctrl->link_clks_on ? "on" : "off",
+		   ctrl->core_clks_on ? "on" : "off");
+}
+
+static int msm_dp_ctrl_enable_mainlink_clocks(struct msm_dp_ctrl_private *ctrl)
+{
+	int ret = 0;
+	struct phy *phy = ctrl->phy;
+	const u8 *dpcd = ctrl->panel->dpcd;
+
+	ctrl->phy_opts.dp.lanes = ctrl->link->link_params.num_lanes;
+	ctrl->phy_opts.dp.link_rate = ctrl->link->link_params.rate / 100;
+	ctrl->phy_opts.dp.ssc = drm_dp_max_downspread(dpcd);
+
+	phy_configure(phy, &ctrl->phy_opts);
+	phy_power_on(phy);
+
+	dev_pm_opp_set_rate(ctrl->dev, ctrl->link->link_params.rate * 1000);
+	ret = msm_dp_ctrl_link_clk_enable(&ctrl->msm_dp_ctrl);
+	if (ret)
+		DRM_ERROR("Unable to start link clocks. ret=%d\n", ret);
+
+	drm_dbg_dp(ctrl->drm_dev, "link rate=%d\n", ctrl->link->link_params.rate);
+
+	return ret;
+}
+
+void msm_dp_ctrl_reset_irq_ctrl(struct msm_dp_ctrl *msm_dp_ctrl, bool enable)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	msm_dp_catalog_ctrl_reset(ctrl->catalog);
+
+	/*
+	 * all dp controller programmable registers will not
+	 * be reset to default value after DP_SW_RESET
+	 * therefore interrupt mask bits have to be updated
+	 * to enable/disable interrupts
+	 */
+	msm_dp_catalog_ctrl_enable_irq(ctrl->catalog, enable);
+}
+
+void msm_dp_ctrl_config_psr(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	u8 cfg;
+	struct msm_dp_ctrl_private *ctrl = container_of(msm_dp_ctrl,
+			struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (!ctrl->panel->psr_cap.version)
+		return;
+
+	msm_dp_catalog_ctrl_config_psr(ctrl->catalog);
+
+	cfg = DP_PSR_ENABLE;
+	drm_dp_dpcd_write(ctrl->aux, DP_PSR_EN_CFG, &cfg, 1);
+}
+
+void msm_dp_ctrl_set_psr(struct msm_dp_ctrl *msm_dp_ctrl, bool enter)
+{
+	struct msm_dp_ctrl_private *ctrl = container_of(msm_dp_ctrl,
+			struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (!ctrl->panel->psr_cap.version)
+		return;
+
+	/*
+	 * When entering PSR,
+	 * 1. Send PSR enter SDP and wait for the PSR_UPDATE_INT
+	 * 2. Turn off video
+	 * 3. Disable the mainlink
+	 *
+	 * When exiting PSR,
+	 * 1. Enable the mainlink
+	 * 2. Send the PSR exit SDP
+	 */
+	if (enter) {
+		reinit_completion(&ctrl->psr_op_comp);
+		msm_dp_catalog_ctrl_set_psr(ctrl->catalog, true);
+
+		if (!wait_for_completion_timeout(&ctrl->psr_op_comp,
+			PSR_OPERATION_COMPLETION_TIMEOUT_JIFFIES)) {
+			DRM_ERROR("PSR_ENTRY timedout\n");
+			msm_dp_catalog_ctrl_set_psr(ctrl->catalog, false);
+			return;
+		}
+
+		msm_dp_ctrl_push_idle(msm_dp_ctrl);
+		msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+
+		msm_dp_catalog_ctrl_psr_mainlink_enable(ctrl->catalog, false);
+	} else {
+		msm_dp_catalog_ctrl_psr_mainlink_enable(ctrl->catalog, true);
+
+		msm_dp_catalog_ctrl_set_psr(ctrl->catalog, false);
+		msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_SEND_VIDEO);
+		msm_dp_ctrl_wait4video_ready(ctrl);
+		msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, 0);
+	}
+}
+
+void msm_dp_ctrl_phy_init(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	struct phy *phy;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	phy = ctrl->phy;
+
+	msm_dp_catalog_ctrl_phy_reset(ctrl->catalog);
+	phy_init(phy);
+
+	drm_dbg_dp(ctrl->drm_dev, "phy=%p init=%d power_on=%d\n",
+			phy, phy->init_count, phy->power_count);
+}
+
+void msm_dp_ctrl_phy_exit(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	struct phy *phy;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	phy = ctrl->phy;
+
+	msm_dp_catalog_ctrl_phy_reset(ctrl->catalog);
+	phy_exit(phy);
+	drm_dbg_dp(ctrl->drm_dev, "phy=%p init=%d power_on=%d\n",
+			phy, phy->init_count, phy->power_count);
+}
+
+static int msm_dp_ctrl_reinitialize_mainlink(struct msm_dp_ctrl_private *ctrl)
+{
+	struct phy *phy = ctrl->phy;
+	int ret = 0;
+
+	msm_dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
+	ctrl->phy_opts.dp.lanes = ctrl->link->link_params.num_lanes;
+	phy_configure(phy, &ctrl->phy_opts);
+	/*
+	 * Disable and re-enable the mainlink clock since the
+	 * link clock might have been adjusted as part of the
+	 * link maintenance.
+	 */
+	dev_pm_opp_set_rate(ctrl->dev, 0);
+
+	msm_dp_ctrl_link_clk_disable(&ctrl->msm_dp_ctrl);
+
+	phy_power_off(phy);
+	/* hw recommended delay before re-enabling clocks */
+	msleep(20);
+
+	ret = msm_dp_ctrl_enable_mainlink_clocks(ctrl);
+	if (ret) {
+		DRM_ERROR("Failed to enable mainlink clks. ret=%d\n", ret);
+		return ret;
+	}
+
+	return ret;
+}
+
+static int msm_dp_ctrl_deinitialize_mainlink(struct msm_dp_ctrl_private *ctrl)
+{
+	struct phy *phy;
+
+	phy = ctrl->phy;
+
+	msm_dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
+
+	msm_dp_catalog_ctrl_reset(ctrl->catalog);
+
+	dev_pm_opp_set_rate(ctrl->dev, 0);
+	msm_dp_ctrl_link_clk_disable(&ctrl->msm_dp_ctrl);
+
+	phy_power_off(phy);
+
+	/* aux channel down, reinit phy */
+	phy_exit(phy);
+	phy_init(phy);
+
+	drm_dbg_dp(ctrl->drm_dev, "phy=%p init=%d power_on=%d\n",
+			phy, phy->init_count, phy->power_count);
+	return 0;
+}
+
+int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	bool act_complete;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	msm_dp_catalog_trigger_act(ctrl->catalog);
+	msleep(20); /* needs 1 frame time */
+
+	act_complete = msm_dp_catalog_read_act_complete_sts(ctrl->catalog);
+
+	if (!act_complete)
+		drm_dbg_dp(ctrl->drm_dev, "mst ACT trigger complete SUCCESS\n");
+	else
+		DRM_ERROR("mst ACT trigger complete failed\n");
+
+	return 0;
+}
+
+static int msm_dp_ctrl_link_maintenance(struct msm_dp_ctrl_private *ctrl)
+{
+	int ret = 0;
+	int training_step = DP_TRAINING_NONE;
+
+	msm_dp_ctrl_push_idle(&ctrl->msm_dp_ctrl);
+
+	ctrl->link->phy_params.p_level = 0;
+	ctrl->link->phy_params.v_level = 0;
+
+	ret = msm_dp_ctrl_setup_main_link(ctrl, &training_step);
+	if (ret)
+		goto end;
+
+	msm_dp_ctrl_clear_training_pattern(ctrl);
+
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_SEND_VIDEO);
+
+	if (ctrl->mst_active)
+		msm_dp_ctrl_mst_send_act(&ctrl->msm_dp_ctrl);
+
+	ret = msm_dp_ctrl_wait4video_ready(ctrl);
+end:
+	return ret;
+}
+
+static bool msm_dp_ctrl_send_phy_test_pattern(struct msm_dp_ctrl_private *ctrl)
+{
+	bool success = false;
+	u32 pattern_sent = 0x0;
+	u32 pattern_requested = ctrl->link->phy_params.phy_test_pattern_sel;
+
+	drm_dbg_dp(ctrl->drm_dev, "request: 0x%x\n", pattern_requested);
+
+	if (msm_dp_ctrl_set_vx_px(ctrl,
+			ctrl->link->phy_params.v_level,
+			ctrl->link->phy_params.p_level)) {
+		DRM_ERROR("Failed to set v/p levels\n");
+		return false;
+	}
+	msm_dp_catalog_ctrl_send_phy_pattern(ctrl->catalog, pattern_requested);
+	msm_dp_ctrl_update_vx_px(ctrl);
+	msm_dp_link_send_test_response(ctrl->link);
+
+	pattern_sent = msm_dp_catalog_ctrl_read_phy_pattern(ctrl->catalog);
+
+	switch (pattern_sent) {
+	case MR_LINK_TRAINING1:
+		success = (pattern_requested ==
+				DP_PHY_TEST_PATTERN_D10_2);
+		break;
+	case MR_LINK_SYMBOL_ERM:
+		success = ((pattern_requested ==
+			DP_PHY_TEST_PATTERN_ERROR_COUNT) ||
+				(pattern_requested ==
+				DP_PHY_TEST_PATTERN_CP2520));
+		break;
+	case MR_LINK_PRBS7:
+		success = (pattern_requested ==
+				DP_PHY_TEST_PATTERN_PRBS7);
+		break;
+	case MR_LINK_CUSTOM80:
+		success = (pattern_requested ==
+				DP_PHY_TEST_PATTERN_80BIT_CUSTOM);
+		break;
+	case MR_LINK_TRAINING4:
+		success = (pattern_requested ==
+				DP_PHY_TEST_PATTERN_SEL_MASK);
+		break;
+	default:
+		success = false;
+	}
+
+	drm_dbg_dp(ctrl->drm_dev, "%s: test->0x%x\n",
+		success ? "success" : "failed", pattern_requested);
+	return success;
+}
+
+static int msm_dp_ctrl_stream_clk_on(struct msm_dp_ctrl_private *ctrl, unsigned long pixel_rate,
+				     enum msm_dp_stream_id stream_id)
+{
+	int ret;
+
+	ret = clk_set_rate(ctrl->pixel_clk[stream_id], pixel_rate * 1000);
+	if (ret) {
+		DRM_ERROR("Failed to set stream clk rate. ret=%d\n", ret);
+		return ret;
+	}
+
+	if (ctrl->stream_clks_on[stream_id]) {
+		drm_dbg_dp(ctrl->drm_dev, "stream clks already enabled\n");
+	} else {
+		ret = clk_prepare_enable(ctrl->pixel_clk[stream_id]);
+		if (ret) {
+			DRM_ERROR("Failed to start stream clks. ret=%d\n", ret);
+			return ret;
+		}
+		ctrl->stream_clks_on[stream_id] = true;
+	}
+
+	return ret;
+}
+
+static int msm_dp_ctrl_process_phy_test_request(struct msm_dp_ctrl_private *ctrl,
+		struct msm_dp_panel *msm_dp_panel)
+{
+	int ret;
+	unsigned long pixel_rate;
+
+	if (!ctrl->link->phy_params.phy_test_pattern_sel) {
+		drm_dbg_dp(ctrl->drm_dev,
+			"no test pattern selected by sink\n");
+		return 0;
+	}
+
+	/*
+	 * The global reset will need DP link related clocks to be
+	 * running. Add the global reset just before disabling the
+	 * link clocks and core clocks.
+	 */
+	msm_dp_ctrl_stream_clk_off(&ctrl->msm_dp_ctrl, msm_dp_panel);
+	msm_dp_ctrl_off_link(&ctrl->msm_dp_ctrl);
+
+	ret = msm_dp_ctrl_on_link(&ctrl->msm_dp_ctrl, ctrl->mst_active);
+	if (ret) {
+		DRM_ERROR("failed to enable DP link controller\n");
+		return ret;
+	}
+
+	pixel_rate = msm_dp_panel->msm_dp_mode.drm_mode.clock;
+	ret = msm_dp_ctrl_stream_clk_on(ctrl, pixel_rate, msm_dp_panel->stream_id);
+
+	msm_dp_ctrl_send_phy_test_pattern(ctrl);
+
+	return 0;
+}
+
+void msm_dp_ctrl_handle_sink_request(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	u32 sink_request = 0x0;
+
+	if (!msm_dp_ctrl) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	sink_request = ctrl->link->sink_request;
+
+	if (sink_request & DP_TEST_LINK_PHY_TEST_PATTERN) {
+		drm_dbg_dp(ctrl->drm_dev, "PHY_TEST_PATTERN request\n");
+		if (msm_dp_ctrl_process_phy_test_request(ctrl, ctrl->panel)) {
+			DRM_ERROR("process phy_test_req failed\n");
+			return;
+		}
+	}
+
+	if (sink_request & DP_LINK_STATUS_UPDATED) {
+		if (msm_dp_ctrl_link_maintenance(ctrl)) {
+			DRM_ERROR("LM failed: TEST_LINK_TRAINING\n");
+			return;
+		}
+	}
+
+	if (sink_request & DP_TEST_LINK_TRAINING) {
+		msm_dp_link_send_test_response(ctrl->link);
+		if (msm_dp_ctrl_link_maintenance(ctrl)) {
+			DRM_ERROR("LM failed: TEST_LINK_TRAINING\n");
+			return;
+		}
+	}
+}
+
+static bool msm_dp_ctrl_clock_recovery_any_ok(
+			const u8 link_status[DP_LINK_STATUS_SIZE],
+			int lane_count)
+{
+	int reduced_cnt;
+
+	if (lane_count <= 1)
+		return false;
+
+	/*
+	 * only interested in the lane number after reduced
+	 * lane_count = 4, then only interested in 2 lanes
+	 * lane_count = 2, then only interested in 1 lane
+	 */
+	reduced_cnt = lane_count >> 1;
+
+	return drm_dp_clock_recovery_ok(link_status, reduced_cnt);
+}
+
+static bool msm_dp_ctrl_channel_eq_ok(struct msm_dp_ctrl_private *ctrl)
+{
+	u8 link_status[DP_LINK_STATUS_SIZE];
+	int num_lanes = ctrl->link->link_params.num_lanes;
+
+	msm_dp_ctrl_read_link_status(ctrl, link_status);
+
+	return drm_dp_channel_eq_ok(link_status, num_lanes);
+}
+
+int msm_dp_ctrl_on_link(struct msm_dp_ctrl *msm_dp_ctrl, bool mst_active)
+{
+	int rc = 0;
+	struct msm_dp_ctrl_private *ctrl;
+	u32 rate;
+	int link_train_max_retries = 5;
+	u32 const phy_cts_pixel_clk_khz = 148500;
+	u8 link_status[DP_LINK_STATUS_SIZE];
+	unsigned int training_step;
+	unsigned long pixel_rate;
+
+	if (!msm_dp_ctrl)
+		return -EINVAL;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	rate = ctrl->panel->link_info.rate;
+	pixel_rate = ctrl->panel->msm_dp_mode.drm_mode.clock;
+
+	ctrl->mst_active = mst_active;
+	msm_dp_ctrl_core_clk_enable(&ctrl->msm_dp_ctrl);
+
+	if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN) {
+		drm_dbg_dp(ctrl->drm_dev,
+				"using phy test link parameters\n");
+		if (!pixel_rate)
+			pixel_rate = phy_cts_pixel_clk_khz;
+	} else {
+		ctrl->link->link_params.rate = rate;
+		ctrl->link->link_params.num_lanes =
+			ctrl->panel->link_info.num_lanes;
+		if (ctrl->panel->msm_dp_mode.out_fmt_is_yuv_420)
+			pixel_rate >>= 1;
+	}
+
+	drm_dbg_dp(ctrl->drm_dev, "rate=%d, num_lanes=%d, pixel_rate=%lu\n",
+		ctrl->link->link_params.rate, ctrl->link->link_params.num_lanes,
+		pixel_rate);
+
+	rc = msm_dp_ctrl_enable_mainlink_clocks(ctrl);
+	if (rc)
+		return rc;
+
+	while (--link_train_max_retries) {
+		training_step = DP_TRAINING_NONE;
+		rc = msm_dp_ctrl_setup_main_link(ctrl, &training_step);
+		if (rc == 0) {
+			/* training completed successfully */
+			break;
+		} else if (training_step == DP_TRAINING_1) {
+			/* link train_1 failed */
+			if (!msm_dp_catalog_link_is_connected(ctrl->catalog))
+				break;
+
+			msm_dp_ctrl_read_link_status(ctrl, link_status);
+
+			rc = msm_dp_ctrl_link_rate_down_shift(ctrl);
+			if (rc < 0) { /* already in RBR = 1.6G */
+				if (msm_dp_ctrl_clock_recovery_any_ok(link_status,
+					ctrl->link->link_params.num_lanes)) {
+					/*
+					 * some lanes are ready,
+					 * reduce lane number
+					 */
+					rc = msm_dp_ctrl_link_lane_down_shift(ctrl);
+					if (rc < 0) { /* lane == 1 already */
+						/* end with failure */
+						break;
+					}
+				} else {
+					/* end with failure */
+					break; /* lane == 1 already */
+				}
+			}
+		} else if (training_step == DP_TRAINING_2) {
+			/* link train_2 failed */
+			if (!msm_dp_catalog_link_is_connected(ctrl->catalog))
+				break;
+
+			msm_dp_ctrl_read_link_status(ctrl, link_status);
+
+			if (!drm_dp_clock_recovery_ok(link_status,
+					ctrl->link->link_params.num_lanes))
+				rc = msm_dp_ctrl_link_rate_down_shift(ctrl);
+			else
+				rc = msm_dp_ctrl_link_lane_down_shift(ctrl);
+
+			if (rc < 0) {
+				/* end with failure */
+				break; /* lane == 1 already */
+			}
+
+			/* stop link training before start re training  */
+			msm_dp_ctrl_clear_training_pattern(ctrl);
+		}
+
+		rc = msm_dp_ctrl_reinitialize_mainlink(ctrl);
+		if (rc) {
+			DRM_ERROR("Failed to reinitialize mainlink. rc=%d\n", rc);
+			break;
+		}
+	}
+
+	if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN)
+		return rc;
+
+	if (rc == 0) {  /* link train successfully */
+		/*
+		 * do not stop train pattern here
+		 * stop link training at on_stream
+		 * to pass compliance test
+		 */
+	} else  {
+		/*
+		 * link training failed
+		 * end txing train pattern here
+		 */
+		msm_dp_ctrl_clear_training_pattern(ctrl);
+
+		msm_dp_ctrl_deinitialize_mainlink(ctrl);
+		rc = -ECONNRESET;
+	}
+
+	return rc;
+}
+
+static int msm_dp_ctrl_link_retrain(struct msm_dp_ctrl_private *ctrl)
+{
+	int training_step = DP_TRAINING_NONE;
+
+	return msm_dp_ctrl_setup_main_link(ctrl, &training_step);
+}
+
+int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl, bool force_link_train)
+{
+	int ret = 0;
+	struct msm_dp_ctrl_private *ctrl;
+
+	if (!msm_dp_ctrl)
+		return -EINVAL;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	drm_dbg_dp(ctrl->drm_dev, "rate=%d, num_lanes=%d\n",
+		ctrl->link->link_params.rate,
+		ctrl->link->link_params.num_lanes);
+
+	drm_dbg_dp(ctrl->drm_dev,
+		"core_clk_on=%d link_clk_on=%d\n",
+		ctrl->core_clks_on, ctrl->link_clks_on);
+
+	if (!ctrl->link_clks_on) { /* link clk is off */
+		ret = msm_dp_ctrl_enable_mainlink_clocks(ctrl);
+		if (ret) {
+			DRM_ERROR("Failed to start link clocks. ret=%d\n", ret);
+			return ret;
+		}
+	}
+
+	if (force_link_train || !msm_dp_ctrl_channel_eq_ok(ctrl))
+		msm_dp_ctrl_link_retrain(ctrl);
+
+	/* stop txing train pattern to end link training */
+	msm_dp_ctrl_clear_training_pattern(ctrl);
+
+	return ret;
+}
+
+static void msm_dp_ctrl_mst_calculate_rg(struct msm_dp_ctrl_private *ctrl,
+					 struct msm_dp_panel *panel,
+					 u32 *p_x_int, u32 *p_y_frac_enum)
+{
+	u64 min_slot_cnt, max_slot_cnt;
+	u64 raw_target_sc, target_sc_fixp;
+	u64 ts_denom, ts_enum, ts_int;
+	u64 pclk = panel->msm_dp_mode.drm_mode.clock;
+	u64 lclk = 0;
+	u64 lanes = ctrl->link->link_params.num_lanes;
+	u64 bpp = panel->msm_dp_mode.bpp;
+	u64 pbn = panel->mst_caps.pbn;
+	u64 numerator, denominator, temp, temp1, temp2;
+	u32 x_int = 0, y_frac_enum = 0;
+	u64 target_strm_sym, ts_int_fixp, ts_frac_fixp, y_frac_enum_fixp;
+
+	lclk = ctrl->link->link_params.rate;
+
+	/* min_slot_cnt */
+	numerator = pclk * bpp * 64 * 1000;
+	denominator = lclk * lanes * 8 * 1000;
+	min_slot_cnt = drm_fixp_from_fraction(numerator, denominator);
+
+	/* max_slot_cnt */
+	numerator = pbn * 54 * 1000;
+	denominator = lclk * lanes;
+	max_slot_cnt = drm_fixp_from_fraction(numerator, denominator);
+
+	/* raw_target_sc */
+	numerator = max_slot_cnt + min_slot_cnt;
+	denominator = drm_fixp_from_fraction(2, 1);
+	raw_target_sc = drm_fixp_div(numerator, denominator);
+
+	/* target_sc */
+	temp = drm_fixp_from_fraction(256 * lanes, 1);
+	numerator = drm_fixp_mul(raw_target_sc, temp);
+	denominator = drm_fixp_from_fraction(256 * lanes, 1);
+	target_sc_fixp = drm_fixp_div(numerator, denominator);
+
+	ts_enum = 256 * lanes;
+	ts_denom = drm_fixp_from_fraction(256 * lanes, 1);
+	ts_int = drm_fixp2int(target_sc_fixp);
+
+	temp = drm_fixp2int_ceil(raw_target_sc);
+	if (temp != ts_int) {
+		temp = drm_fixp_from_fraction(ts_int, 1);
+		temp1 = raw_target_sc - temp;
+		temp2 = drm_fixp_mul(temp1, ts_denom);
+		ts_enum = drm_fixp2int(temp2);
+	}
+
+	/* target_strm_sym */
+	ts_int_fixp = drm_fixp_from_fraction(ts_int, 1);
+	ts_frac_fixp = drm_fixp_from_fraction(ts_enum, drm_fixp2int(ts_denom));
+	temp = ts_int_fixp + ts_frac_fixp;
+	temp1 = drm_fixp_from_fraction(lanes, 1);
+	target_strm_sym = drm_fixp_mul(temp, temp1);
+
+	/* x_int */
+	x_int = drm_fixp2int(target_strm_sym);
+
+	/* y_enum_frac */
+	temp = drm_fixp_from_fraction(x_int, 1);
+	temp1 = target_strm_sym - temp;
+	temp2 = drm_fixp_from_fraction(256, 1);
+	y_frac_enum_fixp = drm_fixp_mul(temp1, temp2);
+
+	temp1 = drm_fixp2int(y_frac_enum_fixp);
+	temp2 = drm_fixp2int_ceil(y_frac_enum_fixp);
+
+	y_frac_enum = (u32)((temp1 == temp2) ? temp1 : temp1 + 1);
+
+	*p_x_int = x_int;
+	*p_y_frac_enum = y_frac_enum;
+
+	drm_dbg_dp(ctrl->drm_dev, "mst lane_cnt:%llu, rate:%llu x_int:%d, y_frac:%d\n",
+		   lanes, lclk, x_int, y_frac_enum);
+}
+
+static void msm_dp_ctrl_mst_stream_setup(struct msm_dp_ctrl_private *ctrl,
+					 struct msm_dp_panel *panel,
+					 u32 max_streams)
+{
+	u32 x_int, y_frac_enum;
+
+	drm_dbg_dp(ctrl->drm_dev, "mst stream channel allocation\n");
+
+	msm_dp_ctrl_mst_stream_channel_slot_setup(&ctrl->msm_dp_ctrl, max_streams);
+
+	msm_dp_ctrl_mst_calculate_rg(ctrl, panel, &x_int, &y_frac_enum);
+
+	msm_dp_catalog_ctrl_update_rg(ctrl->catalog, panel->stream_id,
+				      x_int, y_frac_enum);
+}
+
+int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl,
+			  struct msm_dp_panel *msm_dp_panel, u32 max_streams)
+{
+	int ret = 0;
+	bool mainlink_ready = false;
+	struct msm_dp_ctrl_private *ctrl;
+	unsigned long pixel_rate;
+	unsigned long pixel_rate_orig;
+
+	if (!msm_dp_ctrl)
+		return -EINVAL;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	pixel_rate = pixel_rate_orig = msm_dp_panel->msm_dp_mode.drm_mode.clock;
+
+	if (msm_dp_ctrl->wide_bus_en || msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420)
+		pixel_rate >>= 1;
+
+	drm_dbg_dp(ctrl->drm_dev, "pixel_rate=%lu\n", pixel_rate);
+
+	ret = msm_dp_ctrl_stream_clk_on(ctrl, pixel_rate, msm_dp_panel->stream_id);
+	if (ret) {
+		DRM_ERROR("failed to enable stream pixel clk\n");
+		return ret;
+	}
+
+	/*
+	 * Set up transfer unit values and set controller state to send
+	 * video.
+	 */
+	reinit_completion(&ctrl->video_comp);
+
+	msm_dp_ctrl_configure_source_params(ctrl, msm_dp_panel);
+
+	msm_dp_catalog_ctrl_config_msa(ctrl->catalog,
+		ctrl->link->link_params.rate,
+		pixel_rate_orig,
+		msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420);
+
+	if (!ctrl->mst_active)
+		msm_dp_ctrl_setup_tr_unit(ctrl);
+
+	if (ctrl->mst_active)
+		msm_dp_ctrl_mst_stream_setup(ctrl, msm_dp_panel, max_streams);
+
+	msm_dp_catalog_ctrl_state_ctrl(ctrl->catalog, DP_STATE_CTRL_SEND_VIDEO);
+
+	if (ctrl->mst_active)
+		msm_dp_ctrl_mst_send_act(msm_dp_ctrl);
+
+	ret = msm_dp_ctrl_wait4video_ready(ctrl);
+	if (ret)
+		return ret;
+
+	mainlink_ready = msm_dp_catalog_ctrl_mainlink_ready(ctrl->catalog);
+	drm_dbg_dp(ctrl->drm_dev,
+		"mainlink %s\n", mainlink_ready ? "READY" : "NOT READY");
+
+	return ret;
+}
+
+void msm_dp_ctrl_stream_clk_off(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (ctrl->stream_clks_on[msm_dp_panel->stream_id]) {
+		clk_disable_unprepare(ctrl->pixel_clk[msm_dp_panel->stream_id]);
+		ctrl->stream_clks_on[msm_dp_panel->stream_id] = false;
+	}
+}
+
+void msm_dp_ctrl_clear_vsc_sdp_pkt(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *dp_panel)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	ctrl->catalog->stream_id = dp_panel->stream_id;
+	msm_dp_catalog_panel_disable_vsc_sdp(ctrl->catalog);
+}
+
+void msm_dp_ctrl_psm_config(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	/* set dongle to D3 (power off) mode */
+	msm_dp_link_psm_config(ctrl->link, &ctrl->panel->link_info, true);
+}
+
+void msm_dp_ctrl_reinit_phy(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	struct phy *phy;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	phy = ctrl->phy;
+
+	/* aux channel down, reinit phy */
+	phy_exit(phy);
+	phy_init(phy);
+
+	drm_dbg_dp(ctrl->drm_dev, "phy=%p init=%d power_on=%d\n",
+			phy, phy->init_count, phy->power_count);
+}
+
+void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	struct phy *phy;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	phy = ctrl->phy;
+
+	msm_dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false);
+	msm_dp_catalog_mst_config(ctrl->catalog, false);
+
+	ctrl->mst_active = false;
+
+	dev_pm_opp_set_rate(ctrl->dev, 0);
+	msm_dp_ctrl_link_clk_disable(&ctrl->msm_dp_ctrl);
+
+	drm_dbg_dp(ctrl->drm_dev, "Before, phy=%p init_count=%d power_on=%d\n",
+		   phy, phy->init_count, phy->power_count);
+
+	phy_power_off(phy);
+
+	drm_dbg_dp(ctrl->drm_dev, "After, phy=%p init_count=%d power_on=%d\n",
+		   phy, phy->init_count, phy->power_count);
+}
+
+void msm_dp_ctrl_set_mst_channel_info(struct msm_dp_ctrl *msm_dp_ctrl,
+				      enum msm_dp_stream_id strm,
+				      u32 start_slot, u32 tot_slots)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	if (!msm_dp_ctrl || strm >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	ctrl->mst_ch_info[strm].start_slot = start_slot;
+	ctrl->mst_ch_info[strm].tot_slots = tot_slots;
+}
+
+// TO-DO : Check if we can do a dealloc instead of this one during teardown
+void msm_dp_ctrl_mst_stream_channel_slot_setup(struct msm_dp_ctrl *msm_dp_ctrl, u32 max_streams)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	int i;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	for (i = DP_STREAM_0; i < max_streams; i++) {
+		msm_dp_catalog_mst_channel_alloc(ctrl->catalog,
+						 i, ctrl->mst_ch_info[i].start_slot,
+						 ctrl->mst_ch_info[i].tot_slots);
+	}
+}
+
+irqreturn_t msm_dp_ctrl_isr(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	u32 isr;
+	irqreturn_t ret = IRQ_NONE;
+
+	if (!msm_dp_ctrl)
+		return IRQ_NONE;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	if (ctrl->panel->psr_cap.version) {
+		isr = msm_dp_catalog_ctrl_read_psr_interrupt_status(ctrl->catalog);
+
+		if (isr)
+			complete(&ctrl->psr_op_comp);
+
+		if (isr & PSR_EXIT_INT)
+			drm_dbg_dp(ctrl->drm_dev, "PSR exit done\n");
+
+		if (isr & PSR_UPDATE_INT)
+			drm_dbg_dp(ctrl->drm_dev, "PSR frame update done\n");
+
+		if (isr & PSR_CAPTURE_INT)
+			drm_dbg_dp(ctrl->drm_dev, "PSR frame capture done\n");
+	}
+
+	isr = msm_dp_catalog_ctrl_get_interrupt(ctrl->catalog);
+
+
+	if (isr & DP_CTRL_INTR_READY_FOR_VIDEO) {
+		drm_dbg_dp(ctrl->drm_dev, "dp_video_ready\n");
+		complete(&ctrl->video_comp);
+		ret = IRQ_HANDLED;
+	}
+
+	if (isr & DP_CTRL_INTR_IDLE_PATTERN_SENT) {
+		drm_dbg_dp(ctrl->drm_dev, "idle_patterns_sent\n");
+		complete(&ctrl->idle_comp);
+		ret = IRQ_HANDLED;
+	}
+
+	isr = msm_dp_catalog_ctrl_get_interrupt_5(ctrl->catalog);
+	if (isr & (DP_INTR_DP0_VCPF_SENT | DP_INTR_DP1_VCPF_SENT)) {
+		drm_dbg_dp(ctrl->drm_dev, "vcpf sent\n");
+		complete(&ctrl->idle_comp);
+		ret = IRQ_HANDLED;
+	}
+
+	return ret;
+}
+
+static const char *core_clks[] = {
+	"core_iface",
+	"core_aux",
+};
+
+static const char *ctrl_clks[] = {
+	"ctrl_link",
+	"ctrl_link_iface",
+};
+
+static int msm_dp_ctrl_clk_init(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	struct device *dev;
+	int i, rc;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+	dev = ctrl->dev;
+
+	ctrl->num_core_clks = ARRAY_SIZE(core_clks);
+	ctrl->core_clks = devm_kcalloc(dev, ctrl->num_core_clks, sizeof(*ctrl->core_clks), GFP_KERNEL);
+	if (!ctrl->core_clks)
+		return -ENOMEM;
+
+	for (i = 0; i < ctrl->num_core_clks; i++)
+		ctrl->core_clks[i].id = core_clks[i];
+
+	rc = devm_clk_bulk_get(dev, ctrl->num_core_clks, ctrl->core_clks);
+	if (rc)
+		return rc;
+
+	ctrl->num_link_clks = ARRAY_SIZE(ctrl_clks);
+	ctrl->link_clks = devm_kcalloc(dev, ctrl->num_link_clks, sizeof(*ctrl->link_clks), GFP_KERNEL);
+	if (!ctrl->link_clks)
+		return -ENOMEM;
+
+	for (i = 0; i < ctrl->num_link_clks; i++)
+		ctrl->link_clks[i].id = ctrl_clks[i];
+
+	rc = devm_clk_bulk_get(dev, ctrl->num_link_clks, ctrl->link_clks);
+	if (rc)
+		return rc;
+
+	ctrl->pixel_clk[DP_STREAM_0] = devm_clk_get(dev, "stream_pixel");
+	if (IS_ERR(ctrl->pixel_clk[DP_STREAM_0]))
+		return PTR_ERR(ctrl->pixel_clk[DP_STREAM_0]);
+
+	ctrl->pixel_clk[DP_STREAM_1] = devm_clk_get(dev, "stream_1_pixel");
+	if (IS_ERR(ctrl->pixel_clk[DP_STREAM_1]))
+		DRM_ERROR("failed to get stream_pixel_2");
+
+	return 0;
+}
+
+struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link,
+			struct msm_dp_panel *panel,	struct drm_dp_aux *aux,
+			struct msm_dp_catalog *catalog,
+			struct phy *phy)
+{
+	struct msm_dp_ctrl_private *ctrl;
+	int ret;
+
+	if (!dev || !panel || !aux ||
+	    !link || !catalog) {
+		DRM_ERROR("invalid input\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
+	if (!ctrl) {
+		DRM_ERROR("Mem allocation failure\n");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	ret = devm_pm_opp_set_clkname(dev, "ctrl_link");
+	if (ret) {
+		dev_err(dev, "invalid DP OPP table in device tree\n");
+		/* caller do PTR_ERR(opp_table) */
+		return (struct msm_dp_ctrl *)ERR_PTR(ret);
+	}
+
+	/* OPP table is optional */
+	ret = devm_pm_opp_of_add_table(dev);
+	if (ret)
+		dev_err(dev, "failed to add DP OPP table\n");
+
+	init_completion(&ctrl->idle_comp);
+	init_completion(&ctrl->psr_op_comp);
+	init_completion(&ctrl->video_comp);
+
+	/* in parameters */
+	ctrl->panel    = panel;
+	ctrl->aux      = aux;
+	ctrl->link     = link;
+	ctrl->catalog  = catalog;
+	ctrl->dev      = dev;
+	ctrl->phy      = phy;
+	ctrl->mst_active = false;
+
+	ret = msm_dp_ctrl_clk_init(&ctrl->msm_dp_ctrl);
+	if (ret) {
+		dev_err(dev, "failed to init clocks\n");
+		return ERR_PTR(ret);
+	}
+
+	return &ctrl->msm_dp_ctrl;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_ctrl.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_ctrl.h
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_CTRL_H_
+#define _DP_CTRL_H_
+
+#include "dp_aux.h"
+#include "dp_panel.h"
+#include "dp_link.h"
+#include "dp_catalog.h"
+
+struct msm_dp_ctrl {
+	bool wide_bus_en;
+};
+
+struct phy;
+
+int msm_dp_ctrl_on_link(struct msm_dp_ctrl *msm_dp_ctrl, bool mst_active);
+int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl,
+			  struct msm_dp_panel *msm_dp_panel, u32 max_streams);
+int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl, bool force_link_train);
+void msm_dp_ctrl_off_link_stream(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_stream_clk_off(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel);
+void msm_dp_ctrl_push_idle(struct msm_dp_ctrl *msm_dp_ctrl);
+irqreturn_t msm_dp_ctrl_isr(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_handle_sink_request(struct msm_dp_ctrl *msm_dp_ctrl);
+struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link,
+			struct msm_dp_panel *panel,	struct drm_dp_aux *aux,
+			struct msm_dp_catalog *catalog,
+			struct phy *phy);
+
+void msm_dp_ctrl_reset_irq_ctrl(struct msm_dp_ctrl *msm_dp_ctrl, bool enable);
+void msm_dp_ctrl_phy_init(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_phy_exit(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_irq_phy_exit(struct msm_dp_ctrl *msm_dp_ctrl);
+
+void msm_dp_ctrl_set_psr(struct msm_dp_ctrl *msm_dp_ctrl, bool enable);
+void msm_dp_ctrl_config_psr(struct msm_dp_ctrl *msm_dp_ctrl);
+
+int msm_dp_ctrl_core_clk_enable(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_core_clk_disable(struct msm_dp_ctrl *msm_dp_ctrl);
+
+void msm_dp_ctrl_clear_vsc_sdp_pkt(struct msm_dp_ctrl *msm_dp_ctrl,
+		struct msm_dp_panel *msm_dp_panel);
+void msm_dp_ctrl_psm_config(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_reinit_phy(struct msm_dp_ctrl *msm_dp_ctrl);
+int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_mst_stream_channel_slot_setup(struct msm_dp_ctrl *msm_dp_ctrl, u32 max_streams);
+void msm_dp_ctrl_set_mst_channel_info(struct msm_dp_ctrl *msm_dp_ctrl,
+				      enum msm_dp_stream_id strm,
+				      u32 start_slot, u32 tot_slots);
+void msm_dp_ctrl_push_vcpf(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel);
+#endif /* _DP_CTRL_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_debug.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_debug.c
@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)"[drm-dp] %s: " fmt, __func__
+
+#include <linux/debugfs.h>
+#include <drm/drm_connector.h>
+#include <drm/drm_file.h>
+
+#include "dp_catalog.h"
+#include "dp_aux.h"
+#include "dp_ctrl.h"
+#include "dp_debug.h"
+#include "dp_display.h"
+
+#define DEBUG_NAME "msm_dp"
+
+struct msm_dp_debug_private {
+	struct msm_dp_link *link;
+	struct msm_dp_panel *panel;
+	struct drm_connector *connector;
+};
+
+static int msm_dp_debug_show(struct seq_file *seq, void *p)
+{
+	struct msm_dp_debug_private *debug = seq->private;
+	u64 lclk = 0;
+	u32 link_params_rate;
+	const struct drm_display_mode *drm_mode;
+
+	if (!debug)
+		return -ENODEV;
+
+	drm_mode = &debug->panel->msm_dp_mode.drm_mode;
+
+	seq_printf(seq, "\tname = %s\n", DEBUG_NAME);
+	seq_printf(seq, "\tdrm_dp_link\n\t\trate = %u\n",
+			debug->panel->link_info.rate);
+	seq_printf(seq, "\t\tnum_lanes = %u\n",
+			debug->panel->link_info.num_lanes);
+	seq_printf(seq, "\t\tcapabilities = %lu\n",
+			debug->panel->link_info.capabilities);
+	seq_printf(seq, "\tdp_panel_info:\n\t\tactive = %dx%d\n",
+			drm_mode->hdisplay,
+			drm_mode->vdisplay);
+	seq_printf(seq, "\t\tback_porch = %dx%d\n",
+			drm_mode->htotal - drm_mode->hsync_end,
+			drm_mode->vtotal - drm_mode->vsync_end);
+	seq_printf(seq, "\t\tfront_porch = %dx%d\n",
+			drm_mode->hsync_start - drm_mode->hdisplay,
+			drm_mode->vsync_start - drm_mode->vdisplay);
+	seq_printf(seq, "\t\tsync_width = %dx%d\n",
+			drm_mode->hsync_end - drm_mode->hsync_start,
+			drm_mode->vsync_end - drm_mode->vsync_start);
+	seq_printf(seq, "\t\tactive_low = %dx%d\n",
+			debug->panel->msm_dp_mode.h_active_low,
+			debug->panel->msm_dp_mode.v_active_low);
+	seq_printf(seq, "\t\th_skew = %d\n",
+			drm_mode->hskew);
+	seq_printf(seq, "\t\trefresh rate = %d\n",
+			drm_mode_vrefresh(drm_mode));
+	seq_printf(seq, "\t\tpixel clock khz = %d\n",
+			drm_mode->clock);
+	seq_printf(seq, "\t\tbpp = %d\n",
+			debug->panel->msm_dp_mode.bpp);
+
+	/* Link Information */
+	seq_printf(seq, "\tdp_link:\n\t\ttest_requested = %d\n",
+			debug->link->sink_request);
+	seq_printf(seq, "\t\tnum_lanes = %d\n",
+			debug->link->link_params.num_lanes);
+	link_params_rate = debug->link->link_params.rate;
+	seq_printf(seq, "\t\tbw_code = %d\n",
+			drm_dp_link_rate_to_bw_code(link_params_rate));
+	lclk = debug->link->link_params.rate * 1000;
+	seq_printf(seq, "\t\tlclk = %lld\n", lclk);
+	seq_printf(seq, "\t\tv_level = %d\n",
+			debug->link->phy_params.v_level);
+	seq_printf(seq, "\t\tp_level = %d\n",
+			debug->link->phy_params.p_level);
+
+	return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(msm_dp_debug);
+
+static int msm_dp_test_data_show(struct seq_file *m, void *data)
+{
+	const struct msm_dp_debug_private *debug = m->private;
+	const struct drm_connector *connector = debug->connector;
+	u32 bpc;
+
+	if (connector->status == connector_status_connected) {
+		bpc = debug->link->test_video.test_bit_depth;
+		seq_printf(m, "hdisplay: %d\n",
+				debug->link->test_video.test_h_width);
+		seq_printf(m, "vdisplay: %d\n",
+				debug->link->test_video.test_v_height);
+		seq_printf(m, "bpc: %u\n",
+				msm_dp_link_bit_depth_to_bpp(bpc) / 3);
+	} else {
+		seq_puts(m, "0");
+	}
+
+	return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(msm_dp_test_data);
+
+static int msm_dp_test_type_show(struct seq_file *m, void *data)
+{
+	const struct msm_dp_debug_private *debug = m->private;
+	const struct drm_connector *connector = debug->connector;
+
+	if (connector->status == connector_status_connected)
+		seq_printf(m, "%02x", DP_TEST_LINK_VIDEO_PATTERN);
+	else
+		seq_puts(m, "0");
+
+	return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(msm_dp_test_type);
+
+static ssize_t msm_dp_test_active_write(struct file *file,
+		const char __user *ubuf,
+		size_t len, loff_t *offp)
+{
+	char *input_buffer;
+	int status = 0;
+	const struct msm_dp_debug_private *debug;
+	const struct drm_connector *connector;
+	int val = 0;
+
+	debug = ((struct seq_file *)file->private_data)->private;
+	connector = debug->connector;
+
+	if (len == 0)
+		return 0;
+
+	input_buffer = memdup_user_nul(ubuf, len);
+	if (IS_ERR(input_buffer))
+		return PTR_ERR(input_buffer);
+
+	DRM_DEBUG_DRIVER("Copied %d bytes from user\n", (unsigned int)len);
+
+	if (connector->status == connector_status_connected) {
+		status = kstrtoint(input_buffer, 10, &val);
+		if (status < 0) {
+			kfree(input_buffer);
+			return status;
+		}
+		DRM_DEBUG_DRIVER("Got %d for test active\n", val);
+		/* To prevent erroneous activation of the compliance
+		 * testing code, only accept an actual value of 1 here
+		 */
+		if (val == 1)
+			debug->panel->video_test = true;
+		else
+			debug->panel->video_test = false;
+	}
+	kfree(input_buffer);
+
+	*offp += len;
+	return len;
+}
+
+static int msm_dp_test_active_show(struct seq_file *m, void *data)
+{
+	struct msm_dp_debug_private *debug = m->private;
+	struct drm_connector *connector = debug->connector;
+
+	if (connector->status == connector_status_connected) {
+		if (debug->panel->video_test)
+			seq_puts(m, "1");
+		else
+			seq_puts(m, "0");
+	} else {
+		seq_puts(m, "0");
+	}
+
+	return 0;
+}
+
+static int msm_dp_test_active_open(struct inode *inode,
+		struct file *file)
+{
+	return single_open(file, msm_dp_test_active_show,
+			inode->i_private);
+}
+
+static const struct file_operations test_active_fops = {
+	.owner = THIS_MODULE,
+	.open = msm_dp_test_active_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = single_release,
+	.write = msm_dp_test_active_write
+};
+
+int msm_dp_debug_init(struct device *dev, struct msm_dp_panel *panel,
+		  struct msm_dp_link *link,
+		  struct drm_connector *connector,
+		  struct dentry *root, bool is_edp)
+{
+	struct msm_dp_debug_private *debug;
+
+	if (!dev || !panel || !link) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	debug = devm_kzalloc(dev, sizeof(*debug), GFP_KERNEL);
+	if (!debug)
+		return -ENOMEM;
+
+	debug->link = link;
+	debug->panel = panel;
+
+	debugfs_create_file("dp_debug", 0444, root,
+			debug, &msm_dp_debug_fops);
+
+	if (!is_edp) {
+		debugfs_create_file("dp_test_active", 0444,
+				    root,
+				    debug, &test_active_fops);
+
+		debugfs_create_file("dp_test_data", 0444,
+				    root,
+				    debug, &msm_dp_test_data_fops);
+
+		debugfs_create_file("dp_test_type", 0444,
+				    root,
+				    debug, &msm_dp_test_type_fops);
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_debug.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_debug.h
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_DEBUG_H_
+#define _DP_DEBUG_H_
+
+#include "dp_panel.h"
+#include "dp_link.h"
+
+#if defined(CONFIG_DEBUG_FS)
+
+/**
+ * msm_dp_debug_get() - configure and get the DisplayPlot debug module data
+ *
+ * @dev: device instance of the caller
+ * @panel: instance of panel module
+ * @link: instance of link module
+ * @connector: double pointer to display connector
+ * @root: connector's debugfs root
+ * @is_edp: set for eDP connectors / panels
+ * return: pointer to allocated debug module data
+ *
+ * This function sets up the debug module and provides a way
+ * for debugfs input to be communicated with existing modules
+ */
+int msm_dp_debug_init(struct device *dev, struct msm_dp_panel *panel,
+		  struct msm_dp_link *link,
+		  struct drm_connector *connector,
+		  struct dentry *root,
+		  bool is_edp);
+
+#else
+
+static inline
+int msm_dp_debug_init(struct device *dev, struct msm_dp_panel *panel,
+		  struct msm_dp_link *link,
+		  struct drm_connector *connector,
+		  struct dentry *root,
+		  bool is_edp)
+{
+	return -EINVAL;
+}
+
+#endif /* defined(CONFIG_DEBUG_FS) */
+
+#endif /* _DP_DEBUG_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_display.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_display.c
@@ -0,0 +1,2022 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+#include <linux/component.h>
+#include <linux/of_irq.h>
+#include <linux/phy/phy.h>
+#include <linux/delay.h>
+#include <drm/display/drm_dp_aux_bus.h>
+
+#include "msm_drv.h"
+#include "msm_kms.h"
+#include "dp_ctrl.h"
+#include "dp_catalog.h"
+#include "dp_aux.h"
+#include "dp_reg.h"
+#include "dp_link.h"
+#include "dp_panel.h"
+#include "dp_display.h"
+#include "dp_drm.h"
+#include "dp_audio.h"
+#include "dp_debug.h"
+#include "dp_mst_drm.h"
+
+static bool psr_enabled = false;
+module_param(psr_enabled, bool, 0);
+MODULE_PARM_DESC(psr_enabled, "enable PSR for eDP and DP displays");
+
+#define HPD_STRING_SIZE 30
+
+#define DEFAULT_STREAM_COUNT 1
+
+enum {
+	ISR_DISCONNECTED,
+	ISR_CONNECT_PENDING,
+	ISR_CONNECTED,
+	ISR_HPD_REPLUG_COUNT,
+	ISR_IRQ_HPD_PULSE_COUNT,
+	ISR_HPD_LO_GLITH_COUNT,
+};
+
+/* event thread connection state */
+enum {
+	ST_DISCONNECTED,
+	ST_MAINLINK_READY,
+	ST_CONNECTED,
+	ST_DISCONNECT_PENDING,
+	ST_DISPLAY_OFF,
+};
+
+enum {
+	EV_NO_EVENT,
+	/* hpd events */
+	EV_HPD_PLUG_INT,
+	EV_IRQ_HPD_INT,
+	EV_HPD_UNPLUG_INT,
+	EV_USER_NOTIFICATION,
+};
+
+#define EVENT_TIMEOUT	(HZ/10)	/* 100ms */
+#define DP_EVENT_Q_MAX	8
+
+#define DP_TIMEOUT_NONE		0
+
+#define WAIT_FOR_RESUME_TIMEOUT_JIFFIES (HZ / 2)
+
+#define MAX_DPCD_TRANSACTION_BYTES 16
+
+struct msm_dp_event {
+	u32 event_id;
+	u32 data;
+	u32 delay;
+};
+
+struct msm_dp_display_private {
+	int irq;
+
+	unsigned int id;
+
+	/* state variables */
+	bool core_initialized;
+	bool phy_initialized;
+	bool audio_supported;
+
+	struct drm_device *drm_dev;
+
+	struct msm_dp_catalog *catalog;
+	struct drm_dp_aux *aux;
+	struct msm_dp_link    *link;
+	struct msm_dp_panel   *panel;
+	struct msm_dp_ctrl    *ctrl;
+
+	struct msm_dp msm_dp_display;
+
+	/* wait for audio signaling */
+	struct completion audio_comp;
+
+	unsigned int max_stream;
+
+	/* event related only access by event thread */
+	struct mutex event_mutex;
+	wait_queue_head_t event_q;
+	u32 hpd_state;
+	u32 event_pndx;
+	u32 event_gndx;
+	struct task_struct *ev_tsk;
+	struct msm_dp_event event_list[DP_EVENT_Q_MAX];
+	spinlock_t event_lock;
+
+	bool wide_bus_supported;
+
+	u32 active_stream_cnt;
+
+	const unsigned int *intf_map;
+
+	struct msm_dp_audio *audio;
+};
+
+struct msm_dp_desc {
+	phys_addr_t io_start;
+	unsigned int id;
+	bool wide_bus_supported;
+	const unsigned int *intf_map;
+	unsigned int max_streams;
+};
+
+/* to be kept in sync with enum dpu_intf of dpu_hw_mdss.h */
+enum dp_mst_intf {
+	INTF_0 = 1,
+	INTF_1,
+	INTF_2,
+	INTF_3,
+	INTF_4,
+	INTF_5,
+	INTF_6,
+	INTF_7,
+	INTF_8,
+	INTF_MAX
+};
+
+static const unsigned int stream_intf_map_sa_8775p[][DP_STREAM_MAX] = {
+	{INTF_0, INTF_3},
+	{INTF_4, INTF_8},
+	{}
+};
+
+static const struct msm_dp_desc msm_dp_desc_qcs8300[] = {
+	{ .io_start = 0x0af54000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true,
+	  .max_streams = 2, .intf_map = stream_intf_map_sa_8775p[MSM_DP_CONTROLLER_0],
+	},
+	{}
+};
+
+static const struct msm_dp_desc msm_dp_desc_sa8775p[] = {
+	{ .io_start = 0x0af54000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true,
+	  .max_streams = 2, .intf_map = stream_intf_map_sa_8775p[MSM_DP_CONTROLLER_0],
+	},
+	{ .io_start = 0x0af5c000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true,
+	  .max_streams = 2, .intf_map = stream_intf_map_sa_8775p[MSM_DP_CONTROLLER_1],
+	},
+	{ .io_start = 0x22154000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
+	{ .io_start = 0x2215c000, .id = MSM_DP_CONTROLLER_3, .wide_bus_supported = true },
+	{}
+};
+
+static const struct msm_dp_desc msm_dp_desc_sc7180[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{}
+};
+
+static const struct msm_dp_desc msm_dp_desc_sc7280[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x0aea0000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
+	{}
+};
+
+static const struct msm_dp_desc msm_dp_desc_sc8180x[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x0ae98000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
+	{ .io_start = 0x0ae9a000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
+	{}
+};
+
+static const struct msm_dp_desc msm_dp_desc_sc8280xp[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x0ae98000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
+	{ .io_start = 0x0ae9a000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
+	{ .io_start = 0x0aea0000, .id = MSM_DP_CONTROLLER_3, .wide_bus_supported = true },
+	{ .io_start = 0x22090000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x22098000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
+	{ .io_start = 0x2209a000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
+	{ .io_start = 0x220a0000, .id = MSM_DP_CONTROLLER_3, .wide_bus_supported = true },
+	{}
+};
+
+static const struct msm_dp_desc msm_dp_desc_sm8650[] = {
+	{ .io_start = 0x0af54000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{}
+};
+
+static const struct msm_dp_desc msm_dp_desc_x1e80100[] = {
+	{ .io_start = 0x0ae90000, .id = MSM_DP_CONTROLLER_0, .wide_bus_supported = true },
+	{ .io_start = 0x0ae98000, .id = MSM_DP_CONTROLLER_1, .wide_bus_supported = true },
+	{ .io_start = 0x0ae9a000, .id = MSM_DP_CONTROLLER_2, .wide_bus_supported = true },
+	{ .io_start = 0x0aea0000, .id = MSM_DP_CONTROLLER_3, .wide_bus_supported = true },
+	{}
+};
+
+static const struct of_device_id msm_dp_dt_match[] = {
+	{ .compatible = "qcom,qcs8300-dp", .data = &msm_dp_desc_qcs8300 },
+	{ .compatible = "qcom,sa8775p-dp", .data = &msm_dp_desc_sa8775p },
+	{ .compatible = "qcom,sc7180-dp", .data = &msm_dp_desc_sc7180 },
+	{ .compatible = "qcom,sc7280-dp", .data = &msm_dp_desc_sc7280 },
+	{ .compatible = "qcom,sc7280-edp", .data = &msm_dp_desc_sc7280 },
+	{ .compatible = "qcom,sc8180x-dp", .data = &msm_dp_desc_sc8180x },
+	{ .compatible = "qcom,sc8180x-edp", .data = &msm_dp_desc_sc8180x },
+	{ .compatible = "qcom,sc8280xp-dp", .data = &msm_dp_desc_sc8280xp },
+	{ .compatible = "qcom,sc8280xp-edp", .data = &msm_dp_desc_sc8280xp },
+	{ .compatible = "qcom,sdm845-dp", .data = &msm_dp_desc_sc7180 },
+	{ .compatible = "qcom,sm8350-dp", .data = &msm_dp_desc_sc7180 },
+	{ .compatible = "qcom,sm8650-dp", .data = &msm_dp_desc_sm8650 },
+	{ .compatible = "qcom,x1e80100-dp", .data = &msm_dp_desc_x1e80100 },
+	{}
+};
+
+int msm_dp_display_get_active_stream_cnt(struct msm_dp *msm_dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+
+	return msm_dp_display->active_stream_cnt;
+}
+
+static struct msm_dp_display_private *dev_get_dp_display_private(struct device *dev)
+{
+	struct msm_dp *dp = dev_get_drvdata(dev);
+
+	return container_of(dp, struct msm_dp_display_private, msm_dp_display);
+}
+
+static int msm_dp_add_event(struct msm_dp_display_private *msm_dp_priv, u32 event,
+						u32 data, u32 delay)
+{
+	unsigned long flag;
+	struct msm_dp_event *todo;
+	int pndx;
+
+	spin_lock_irqsave(&msm_dp_priv->event_lock, flag);
+	pndx = msm_dp_priv->event_pndx + 1;
+	pndx %= DP_EVENT_Q_MAX;
+	if (pndx == msm_dp_priv->event_gndx) {
+		pr_err("event_q is full: pndx=%d gndx=%d\n",
+			msm_dp_priv->event_pndx, msm_dp_priv->event_gndx);
+		spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
+		return -EPERM;
+	}
+	todo = &msm_dp_priv->event_list[msm_dp_priv->event_pndx++];
+	msm_dp_priv->event_pndx %= DP_EVENT_Q_MAX;
+	todo->event_id = event;
+	todo->data = data;
+	todo->delay = delay;
+	wake_up(&msm_dp_priv->event_q);
+	spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
+
+	return 0;
+}
+
+static int msm_dp_del_event(struct msm_dp_display_private *msm_dp_priv, u32 event)
+{
+	unsigned long flag;
+	struct msm_dp_event *todo;
+	u32	gndx;
+
+	spin_lock_irqsave(&msm_dp_priv->event_lock, flag);
+	if (msm_dp_priv->event_pndx == msm_dp_priv->event_gndx) {
+		spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
+		return -ENOENT;
+	}
+
+	gndx = msm_dp_priv->event_gndx;
+	while (msm_dp_priv->event_pndx != gndx) {
+		todo = &msm_dp_priv->event_list[gndx];
+		if (todo->event_id == event) {
+			todo->event_id = EV_NO_EVENT;	/* deleted */
+			todo->delay = 0;
+		}
+		gndx++;
+		gndx %= DP_EVENT_Q_MAX;
+	}
+	spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
+
+	return 0;
+}
+
+void msm_dp_display_signal_audio_start(struct msm_dp *msm_dp_display)
+{
+	struct msm_dp_display_private *dp;
+
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	reinit_completion(&dp->audio_comp);
+}
+
+void msm_dp_display_signal_audio_complete(struct msm_dp *msm_dp_display)
+{
+	struct msm_dp_display_private *dp;
+
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	complete_all(&dp->audio_comp);
+}
+
+static int msm_dp_hpd_event_thread_start(struct msm_dp_display_private *msm_dp_priv);
+
+static int msm_dp_display_bind(struct device *dev, struct device *master,
+			   void *data)
+{
+	int rc = 0;
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_drm_private *priv = dev_get_drvdata(master);
+	struct drm_device *drm = priv->dev;
+
+	dp->msm_dp_display.drm_dev = drm;
+	priv->dp[dp->id] = &dp->msm_dp_display;
+
+
+
+	dp->drm_dev = drm;
+	dp->aux->drm_dev = drm;
+	rc = msm_dp_aux_register(dp->aux);
+	if (rc) {
+		DRM_ERROR("DRM DP AUX register failed\n");
+		goto end;
+	}
+
+
+	rc = msm_dp_register_audio_driver(dev, dp->audio);
+	if (rc) {
+		DRM_ERROR("Audio registration Dp failed\n");
+		goto end;
+	}
+
+	rc = msm_dp_hpd_event_thread_start(dp);
+	if (rc) {
+		DRM_ERROR("Event thread create failed\n");
+		goto end;
+	}
+
+	return 0;
+end:
+	return rc;
+}
+
+static void msm_dp_display_unbind(struct device *dev, struct device *master,
+			      void *data)
+{
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_drm_private *priv = dev_get_drvdata(master);
+
+	kthread_stop(dp->ev_tsk);
+
+	of_dp_aux_depopulate_bus(dp->aux);
+
+	msm_dp_unregister_audio_driver(dev, dp->audio);
+	msm_dp_aux_unregister(dp->aux);
+	dp->drm_dev = NULL;
+	dp->aux->drm_dev = NULL;
+	priv->dp[dp->id] = NULL;
+}
+
+static const struct component_ops msm_dp_display_comp_ops = {
+	.bind = msm_dp_display_bind,
+	.unbind = msm_dp_display_unbind,
+};
+
+static void msm_dp_display_send_hpd_event(struct msm_dp *msm_dp_display)
+{
+	struct msm_dp_display_private *dp;
+	struct drm_connector *connector;
+
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	connector = dp->msm_dp_display.connector;
+	drm_helper_hpd_irq_event(connector->dev);
+}
+
+static int msm_dp_display_send_hpd_notification(struct msm_dp_display_private *dp,
+					    bool hpd)
+{
+	if ((hpd && dp->msm_dp_display.link_ready) ||
+			(!hpd && !dp->msm_dp_display.link_ready)) {
+		drm_dbg_dp(dp->drm_dev, "HPD already %s\n",
+				(hpd ? "on" : "off"));
+		return 0;
+	}
+
+	/* reset video pattern flag on disconnect */
+	if (!hpd) {
+		dp->panel->video_test = false;
+		if (!dp->msm_dp_display.is_edp)
+			drm_dp_set_subconnector_property(dp->msm_dp_display.connector,
+							 connector_status_disconnected,
+							 dp->panel->dpcd,
+							 dp->panel->downstream_ports);
+	}
+
+	dp->msm_dp_display.link_ready = hpd;
+
+	drm_dbg_dp(dp->drm_dev, "type=%d hpd=%d\n",
+			dp->msm_dp_display.connector_type, hpd);
+	msm_dp_display_send_hpd_event(&dp->msm_dp_display);
+
+	return 0;
+}
+
+static void msm_dp_display_mst_init(struct msm_dp_display_private *dp)
+{
+	const unsigned long clear_mstm_ctrl_timeout_us = 100000;
+	u8 old_mstm_ctrl;
+	struct msm_dp *msm_dp = &dp->msm_dp_display;
+	int ret;
+
+	/* clear sink mst state */
+	drm_dp_dpcd_readb(dp->aux, DP_MSTM_CTRL, &old_mstm_ctrl);
+	drm_dp_dpcd_writeb(dp->aux, DP_MSTM_CTRL, 0);
+
+	/* add extra delay if MST state is not cleared */
+	if (old_mstm_ctrl) {
+		drm_dbg_dp(dp->drm_dev, "MSTM_CTRL is not cleared, wait %luus\n",
+			   clear_mstm_ctrl_timeout_us);
+		usleep_range(clear_mstm_ctrl_timeout_us,
+			     clear_mstm_ctrl_timeout_us + 1000);
+	}
+
+	ret = drm_dp_dpcd_writeb(dp->aux, DP_MSTM_CTRL,
+				 DP_MST_EN | DP_UP_REQ_EN | DP_UPSTREAM_IS_SRC);
+	if (ret < 0) {
+		DRM_ERROR("sink mst enablement failed\n");
+		return;
+	}
+
+	msm_dp->mst_active = true;
+}
+
+static void msm_dp_display_set_mst_mgr_state(struct msm_dp_display_private *dp,
+					     bool state)
+{
+	if (!dp->msm_dp_display.mst_active)
+		return;
+
+	msm_dp_mst_display_set_mgr_state(&dp->msm_dp_display, state);
+
+	drm_dbg_dp(dp->drm_dev, "mst_mgr_state: %d\n", state);
+}
+
+static int msm_dp_display_process_hpd_high(struct msm_dp_display_private *dp)
+{
+	struct drm_connector *connector = dp->msm_dp_display.connector;
+	const struct drm_display_info *info = &connector->display_info;
+	int rc = 0;
+	struct msm_dp *dp_display = &dp->msm_dp_display;
+
+	rc = msm_dp_panel_read_link_caps(dp->panel, connector);
+	if (rc)
+		goto end;
+
+	if (dp->max_stream <= DEFAULT_STREAM_COUNT || !msm_dp_panel_read_mst_cap(dp->panel)) {
+		rc = msm_dp_panel_read_edid(dp->panel, connector);
+		if (rc)
+			goto end;
+	}
+
+	msm_dp_link_process_request(dp->link);
+
+	if (!dp->msm_dp_display.is_edp)
+		drm_dp_set_subconnector_property(connector,
+						 connector_status_connected,
+						 dp->panel->dpcd,
+						 dp->panel->downstream_ports);
+
+	dp->msm_dp_display.psr_supported = dp->panel->psr_cap.version && psr_enabled;
+
+	dp->audio_supported = info->has_audio;
+	msm_dp_panel_handle_sink_request(dp->panel);
+
+	/*
+	 * set sink to normal operation mode -- D0
+	 * before dpcd read
+	 */
+	msm_dp_link_psm_config(dp->link, &dp->panel->link_info, false);
+
+	if (dp->max_stream > DEFAULT_STREAM_COUNT && msm_dp_panel_read_mst_cap(dp->panel))
+		msm_dp_display_mst_init(dp);
+
+	msm_dp_link_reset_phy_params_vx_px(dp->link);
+	rc = msm_dp_ctrl_on_link(dp->ctrl, dp_display->mst_active);
+	if (rc) {
+		DRM_ERROR("failed to complete DP link training\n");
+		goto end;
+	}
+
+	msm_dp_display_set_mst_mgr_state(dp, true);
+
+	msm_dp_add_event(dp, EV_USER_NOTIFICATION, true, 0);
+
+end:
+	return rc;
+}
+
+static void msm_dp_display_host_phy_init(struct msm_dp_display_private *dp)
+{
+	drm_dbg_dp(dp->drm_dev, "type=%d core_init=%d phy_init=%d\n",
+		dp->msm_dp_display.connector_type, dp->core_initialized,
+		dp->phy_initialized);
+
+	if (!dp->phy_initialized) {
+		msm_dp_ctrl_phy_init(dp->ctrl);
+		dp->phy_initialized = true;
+	}
+}
+
+static void msm_dp_display_host_phy_exit(struct msm_dp_display_private *dp)
+{
+	drm_dbg_dp(dp->drm_dev, "type=%d core_init=%d phy_init=%d\n",
+		dp->msm_dp_display.connector_type, dp->core_initialized,
+		dp->phy_initialized);
+
+	if (dp->phy_initialized) {
+		msm_dp_ctrl_phy_exit(dp->ctrl);
+		dp->phy_initialized = false;
+	}
+}
+
+static void msm_dp_display_host_init(struct msm_dp_display_private *dp)
+{
+	drm_dbg_dp(dp->drm_dev, "type=%d core_init=%d phy_init=%d\n",
+		dp->msm_dp_display.connector_type, dp->core_initialized,
+		dp->phy_initialized);
+
+	msm_dp_ctrl_core_clk_enable(dp->ctrl);
+	msm_dp_ctrl_reset_irq_ctrl(dp->ctrl, true);
+	msm_dp_aux_init(dp->aux);
+	dp->core_initialized = true;
+}
+
+static void msm_dp_display_host_deinit(struct msm_dp_display_private *dp)
+{
+	drm_dbg_dp(dp->drm_dev, "type=%d core_init=%d phy_init=%d\n",
+		dp->msm_dp_display.connector_type, dp->core_initialized,
+		dp->phy_initialized);
+
+	msm_dp_ctrl_reset_irq_ctrl(dp->ctrl, false);
+	msm_dp_aux_deinit(dp->aux);
+	msm_dp_ctrl_core_clk_disable(dp->ctrl);
+	dp->core_initialized = false;
+}
+
+static int msm_dp_display_usbpd_configure_cb(struct device *dev)
+{
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
+
+	msm_dp_display_host_phy_init(dp);
+
+	return msm_dp_display_process_hpd_high(dp);
+}
+
+static int msm_dp_display_notify_disconnect(struct device *dev)
+{
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp *dp_display = &dp->msm_dp_display;
+
+	if (dp_display->mst_active) {
+		msm_dp_mst_display_set_mgr_state(&dp->msm_dp_display, false);
+		dp_display->mst_active = false;
+	}
+
+	msm_dp_add_event(dp, EV_USER_NOTIFICATION, false, 0);
+
+	return 0;
+}
+
+static void msm_dp_display_handle_video_request(struct msm_dp_display_private *dp)
+{
+	if (dp->link->sink_request & DP_TEST_LINK_VIDEO_PATTERN) {
+		dp->panel->video_test = true;
+		msm_dp_link_send_test_response(dp->link);
+	}
+}
+
+static int msm_dp_display_handle_port_status_changed(struct msm_dp_display_private *dp)
+{
+	int rc = 0;
+
+	if (drm_dp_is_branch(dp->panel->dpcd) && dp->link->sink_count == 0) {
+		drm_dbg_dp(dp->drm_dev, "sink count is zero, nothing to do\n");
+		if (dp->hpd_state != ST_DISCONNECTED) {
+			dp->hpd_state = ST_DISCONNECT_PENDING;
+			msm_dp_add_event(dp, EV_USER_NOTIFICATION, false, 0);
+		}
+	} else {
+		if (dp->hpd_state == ST_DISCONNECTED) {
+			dp->hpd_state = ST_MAINLINK_READY;
+			rc = msm_dp_display_process_hpd_high(dp);
+			if (rc)
+				dp->hpd_state = ST_DISCONNECTED;
+		}
+	}
+
+	return rc;
+}
+
+static int msm_dp_display_handle_irq_hpd(struct msm_dp_display_private *dp)
+{
+	u32 sink_request = dp->link->sink_request;
+
+	drm_dbg_dp(dp->drm_dev, "%d\n", sink_request);
+	if (dp->hpd_state == ST_DISCONNECTED) {
+		if (sink_request & DP_LINK_STATUS_UPDATED) {
+			drm_dbg_dp(dp->drm_dev, "Disconnected sink_request: %d\n",
+							sink_request);
+			DRM_ERROR("Disconnected, no DP_LINK_STATUS_UPDATED\n");
+			return -EINVAL;
+		}
+	}
+
+	msm_dp_ctrl_handle_sink_request(dp->ctrl);
+
+	if (sink_request & DP_TEST_LINK_VIDEO_PATTERN)
+		msm_dp_display_handle_video_request(dp);
+
+	return 0;
+}
+
+static int msm_dp_display_usbpd_attention_cb(struct device *dev)
+{
+	int rc = 0;
+	u32 sink_request;
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
+	struct msm_dp *msm_dp_display = &dp->msm_dp_display;
+
+	/* check for any test request issued by sink */
+	rc = msm_dp_link_process_request(dp->link);
+	if (!rc) {
+		sink_request = dp->link->sink_request;
+		drm_dbg_dp(dp->drm_dev, "hpd_state=%d sink_request=%d\n",
+					dp->hpd_state, sink_request);
+		if (sink_request & DS_PORT_STATUS_CHANGED) {
+			if (!msm_dp_display->mst_active)
+				rc = msm_dp_display_handle_port_status_changed(dp);
+		} else {
+			rc = msm_dp_display_handle_irq_hpd(dp);
+		}
+	}
+
+	msm_dp_mst_display_hpd_irq(&dp->msm_dp_display);
+	return rc;
+}
+
+static int msm_dp_hpd_plug_handle(struct msm_dp_display_private *dp, u32 data)
+{
+	u32 state;
+	int ret;
+	struct platform_device *pdev = dp->msm_dp_display.pdev;
+
+	msm_dp_aux_enable_xfers(dp->aux, true);
+
+	mutex_lock(&dp->event_mutex);
+
+	state =  dp->hpd_state;
+	drm_dbg_dp(dp->drm_dev, "Before, type=%d hpd_state=%d\n",
+			dp->msm_dp_display.connector_type, state);
+
+	if (state == ST_DISPLAY_OFF) {
+		mutex_unlock(&dp->event_mutex);
+		return 0;
+	}
+
+	if (state == ST_MAINLINK_READY || state == ST_CONNECTED) {
+		mutex_unlock(&dp->event_mutex);
+		return 0;
+	}
+
+	if (state == ST_DISCONNECT_PENDING) {
+		/* wait until ST_DISCONNECTED */
+		msm_dp_add_event(dp, EV_HPD_PLUG_INT, 0, 1); /* delay = 1 */
+		mutex_unlock(&dp->event_mutex);
+		return 0;
+	}
+
+	ret = pm_runtime_resume_and_get(&pdev->dev);
+	if (ret) {
+		DRM_ERROR("failed to pm_runtime_resume\n");
+		mutex_unlock(&dp->event_mutex);
+		return ret;
+	}
+
+	ret = msm_dp_display_usbpd_configure_cb(&pdev->dev);
+	if (ret) {	/* link train failed */
+		dp->hpd_state = ST_DISCONNECTED;
+		pm_runtime_put_sync(&pdev->dev);
+	} else {
+		dp->hpd_state = ST_MAINLINK_READY;
+	}
+
+	drm_dbg_dp(dp->drm_dev, "After, type=%d hpd_state=%d\n",
+			dp->msm_dp_display.connector_type, state);
+	mutex_unlock(&dp->event_mutex);
+
+	/* uevent will complete connection part */
+	return 0;
+};
+
+static void msm_dp_display_handle_plugged_change(struct msm_dp *msm_dp_display,
+		bool plugged)
+{
+	struct msm_dp_display_private *dp;
+
+	dp = container_of(msm_dp_display,
+			struct msm_dp_display_private, msm_dp_display);
+
+	/* notify audio subsystem only if sink supports audio */
+	if (msm_dp_display->plugged_cb && msm_dp_display->codec_dev &&
+			dp->audio_supported)
+		msm_dp_display->plugged_cb(msm_dp_display->codec_dev, plugged);
+}
+
+static int msm_dp_hpd_unplug_handle(struct msm_dp_display_private *dp, u32 data)
+{
+	u32 state;
+	struct platform_device *pdev = dp->msm_dp_display.pdev;
+
+	msm_dp_aux_enable_xfers(dp->aux, false);
+
+	mutex_lock(&dp->event_mutex);
+
+	state = dp->hpd_state;
+
+	drm_dbg_dp(dp->drm_dev, "Before, type=%d hpd_state=%d\n",
+			dp->msm_dp_display.connector_type, state);
+
+	/* unplugged, no more irq_hpd handle */
+	msm_dp_del_event(dp, EV_IRQ_HPD_INT);
+
+	if (state == ST_DISCONNECTED) {
+		/* triggered by irq_hdp with sink_count = 0 */
+		if (dp->link->sink_count == 0) {
+			msm_dp_display_host_phy_exit(dp);
+		}
+		msm_dp_display_notify_disconnect(&dp->msm_dp_display.pdev->dev);
+		mutex_unlock(&dp->event_mutex);
+		return 0;
+	} else if (state == ST_DISCONNECT_PENDING) {
+		mutex_unlock(&dp->event_mutex);
+		return 0;
+	} else if (state == ST_MAINLINK_READY) {
+		msm_dp_ctrl_off_link(dp->ctrl);
+		msm_dp_display_host_phy_exit(dp);
+		dp->hpd_state = ST_DISCONNECTED;
+		msm_dp_display_notify_disconnect(&dp->msm_dp_display.pdev->dev);
+		pm_runtime_put_sync(&pdev->dev);
+		mutex_unlock(&dp->event_mutex);
+		return 0;
+	}
+
+	/*
+	 * We don't need separate work for disconnect as
+	 * connect/attention interrupts are disabled
+	 */
+	msm_dp_display_notify_disconnect(&dp->msm_dp_display.pdev->dev);
+
+	if (state == ST_DISPLAY_OFF) {
+		dp->hpd_state = ST_DISCONNECTED;
+	} else {
+		dp->hpd_state = ST_DISCONNECT_PENDING;
+	}
+
+	/* signal the disconnect event early to ensure proper teardown */
+	msm_dp_display_handle_plugged_change(&dp->msm_dp_display, false);
+
+	drm_dbg_dp(dp->drm_dev, "After, type=%d hpd_state=%d\n",
+			dp->msm_dp_display.connector_type, state);
+
+	/* uevent will complete disconnection part */
+	pm_runtime_put_sync(&pdev->dev);
+	mutex_unlock(&dp->event_mutex);
+	return 0;
+}
+
+static int msm_dp_irq_hpd_handle(struct msm_dp_display_private *dp, u32 data)
+{
+	u32 state;
+
+	mutex_lock(&dp->event_mutex);
+
+	/* irq_hpd can happen at either connected or disconnected state */
+	state =  dp->hpd_state;
+	drm_dbg_dp(dp->drm_dev, "Before, type=%d hpd_state=%d\n",
+			dp->msm_dp_display.connector_type, state);
+
+	/* irq hpd to indicate monitor disconnect/connect can happen even
+	 * after stream is disabled not necessarily due to hotplug disconnect
+	 */
+	if (state == ST_DISPLAY_OFF && !dp->msm_dp_display.mst_active) {
+		mutex_unlock(&dp->event_mutex);
+		return 0;
+	}
+
+	if ((state == ST_MAINLINK_READY || state == ST_DISCONNECT_PENDING) &&
+			!dp->msm_dp_display.mst_active) {
+		/* wait until ST_CONNECTED */
+		msm_dp_add_event(dp, EV_IRQ_HPD_INT, 0, 1); /* delay = 1 */
+		mutex_unlock(&dp->event_mutex);
+		return 0;
+	}
+
+	msm_dp_display_usbpd_attention_cb(&dp->msm_dp_display.pdev->dev);
+
+	drm_dbg_dp(dp->drm_dev, "After, type=%d hpd_state=%d\n",
+			dp->msm_dp_display.connector_type, state);
+
+	mutex_unlock(&dp->event_mutex);
+
+	return 0;
+}
+
+struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *dp_display)
+{
+	struct msm_dp_display_private *dp;
+	struct msm_dp_panel *dp_panel;
+
+	struct msm_dp_panel_in panel_in;
+
+	dp = container_of(dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	panel_in.dev = &dp_display->pdev->dev;
+	panel_in.aux = dp->aux;
+	panel_in.catalog = dp->catalog;
+	panel_in.link = dp->link;
+
+	dp_panel = msm_dp_panel_get(&panel_in);
+
+	if (IS_ERR(dp->panel)) {
+		DRM_ERROR("failed to initialize panel\n");
+		return NULL;
+	}
+
+	memcpy(dp_panel->dpcd, dp->panel->dpcd, DP_RECEIVER_CAP_SIZE + 1);
+	memcpy(&dp_panel->link_info, &dp->panel->link_info,
+	       sizeof(dp->panel->link_info));
+
+	return dp_panel;
+}
+
+static void msm_dp_display_deinit_sub_modules(struct msm_dp_display_private *dp)
+{
+	msm_dp_audio_put(dp->audio);
+	msm_dp_panel_put(dp->panel);
+	msm_dp_aux_put(dp->aux);
+}
+
+static int msm_dp_init_sub_modules(struct msm_dp_display_private *dp)
+{
+	int rc = 0;
+	struct device *dev = &dp->msm_dp_display.pdev->dev;
+	struct msm_dp_panel_in panel_in = {
+		.dev = dev,
+	};
+	struct phy *phy;
+
+	phy = devm_phy_get(dev, "dp");
+	if (IS_ERR(phy))
+		return PTR_ERR(phy);
+
+	rc = phy_set_mode_ext(phy, PHY_MODE_DP,
+			      dp->msm_dp_display.is_edp ? PHY_SUBMODE_EDP : PHY_SUBMODE_DP);
+	if (rc) {
+		DRM_ERROR("failed to set phy submode, rc = %d\n", rc);
+		dp->catalog = NULL;
+		goto error;
+	}
+
+	dp->catalog = msm_dp_catalog_get(dev);
+	if (IS_ERR(dp->catalog)) {
+		rc = PTR_ERR(dp->catalog);
+		DRM_ERROR("failed to initialize catalog, rc = %d\n", rc);
+		dp->catalog = NULL;
+		goto error;
+	}
+
+	dp->aux = msm_dp_aux_get(dev, dp->catalog,
+			     phy,
+			     dp->msm_dp_display.is_edp);
+	if (IS_ERR(dp->aux)) {
+		rc = PTR_ERR(dp->aux);
+		DRM_ERROR("failed to initialize aux, rc = %d\n", rc);
+		dp->aux = NULL;
+		goto error;
+	}
+
+	dp->link = msm_dp_link_get(dev, dp->aux);
+	if (IS_ERR(dp->link)) {
+		rc = PTR_ERR(dp->link);
+		DRM_ERROR("failed to initialize link, rc = %d\n", rc);
+		dp->link = NULL;
+		goto error_link;
+	}
+
+	panel_in.aux = dp->aux;
+	panel_in.catalog = dp->catalog;
+	panel_in.link = dp->link;
+
+	dp->panel = msm_dp_panel_get(&panel_in);
+	if (IS_ERR(dp->panel)) {
+		rc = PTR_ERR(dp->panel);
+		DRM_ERROR("failed to initialize panel, rc = %d\n", rc);
+		dp->panel = NULL;
+		goto error_link;
+	}
+
+	dp->ctrl = msm_dp_ctrl_get(dev, dp->link, dp->panel, dp->aux,
+			       dp->catalog,
+			       phy);
+	if (IS_ERR(dp->ctrl)) {
+		rc = PTR_ERR(dp->ctrl);
+		DRM_ERROR("failed to initialize ctrl, rc = %d\n", rc);
+		dp->ctrl = NULL;
+		goto error_ctrl;
+	}
+
+	dp->audio = msm_dp_audio_get(dp->msm_dp_display.pdev, dp->panel, dp->catalog);
+	if (IS_ERR(dp->audio)) {
+		rc = PTR_ERR(dp->audio);
+		pr_err("failed to initialize audio, rc = %d\n", rc);
+		dp->audio = NULL;
+		goto error_ctrl;
+	}
+
+	return rc;
+
+error_ctrl:
+	msm_dp_panel_put(dp->panel);
+error_link:
+	msm_dp_aux_put(dp->aux);
+error:
+	return rc;
+}
+
+static int msm_dp_display_set_mode(struct msm_dp *msm_dp_display,
+				   const struct drm_display_mode *adjusted_mode,
+				   struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_display_mode msm_dp_mode;
+
+	memset(&msm_dp_mode, 0x0, sizeof(struct msm_dp_display_mode));
+
+	if (msm_dp_display_check_video_test(msm_dp_display))
+		msm_dp_mode.bpp = msm_dp_display_get_test_bpp(msm_dp_display);
+	else /* Default num_components per px = 3 */
+		msm_dp_mode.bpp = msm_dp_panel->connector->display_info.bpc * 3;
+
+	if (!msm_dp_mode.bpp)
+		msm_dp_mode.bpp = 24; /* Default bpp */
+
+	drm_mode_copy(&msm_dp_mode.drm_mode, adjusted_mode);
+
+	msm_dp_mode.v_active_low =
+		!!(msm_dp_mode.drm_mode.flags & DRM_MODE_FLAG_NVSYNC);
+
+	msm_dp_mode.h_active_low =
+		!!(msm_dp_mode.drm_mode.flags & DRM_MODE_FLAG_NHSYNC);
+
+	msm_dp_mode.out_fmt_is_yuv_420 =
+		drm_mode_is_420_only(&msm_dp_display->connector->display_info, adjusted_mode) &&
+		msm_dp_panel->vsc_sdp_supported;
+
+	drm_mode_copy(&msm_dp_panel->msm_dp_mode.drm_mode, &msm_dp_mode.drm_mode);
+	msm_dp_panel->msm_dp_mode.bpp = msm_dp_mode.bpp;
+	msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420 = msm_dp_mode.out_fmt_is_yuv_420;
+	msm_dp_panel->msm_dp_mode.v_active_low = msm_dp_mode.v_active_low;
+	msm_dp_panel->msm_dp_mode.h_active_low = msm_dp_mode.h_active_low;
+	msm_dp_panel_init_panel_info(msm_dp_panel);
+
+	return 0;
+}
+
+static int msm_dp_display_prepare(struct msm_dp_display_private *dp)
+{
+	int rc = 0;
+	struct msm_dp *msm_dp_display = &dp->msm_dp_display;
+	bool force_link_train = false;
+	u32 state;
+
+	drm_dbg_dp(dp->drm_dev, "sink_count=%d\n", dp->link->sink_count);
+	if (msm_dp_display->prepared) {
+		drm_dbg_dp(dp->drm_dev, "Link already setup, return\n");
+		return 0;
+	}
+
+	state = dp->hpd_state;
+	if (state != ST_DISPLAY_OFF && state != ST_MAINLINK_READY)
+		return -EINVAL;
+
+	rc = pm_runtime_resume_and_get(&msm_dp_display->pdev->dev);
+	if (rc) {
+		DRM_ERROR("failed to pm_runtime_resume\n");
+		return rc;
+	}
+
+	if (dp->hpd_state == ST_DISPLAY_OFF) {
+		msm_dp_display_host_phy_init(dp);
+		force_link_train = true;
+	}
+
+	rc = msm_dp_ctrl_prepare_stream_on(dp->ctrl, force_link_train);
+	if (!rc)
+		msm_dp_display->prepared = true;
+
+	return rc;
+}
+
+static int msm_dp_display_enable(struct msm_dp_display_private *dp,
+				 struct msm_dp_panel *msm_dp_panel)
+{
+	int rc = 0;
+
+	drm_dbg_dp(dp->drm_dev, "sink_count=%d\n", dp->link->sink_count);
+
+	rc = msm_dp_ctrl_on_stream(dp->ctrl, msm_dp_panel, dp->max_stream);
+
+	return rc;
+}
+
+static int msm_dp_display_post_enable(struct msm_dp *msm_dp_display)
+{
+	struct msm_dp_display_private *dp;
+	u32 rate;
+
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	rate = dp->link->link_params.rate;
+
+	if (dp->audio_supported) {
+		dp->audio->bw_code = drm_dp_link_rate_to_bw_code(rate);
+		dp->audio->lane_count = dp->link->link_params.num_lanes;
+	}
+
+	/* signal the connect event late to synchronize video and display */
+	msm_dp_display_handle_plugged_change(msm_dp_display, true);
+
+	if (msm_dp_display->psr_supported)
+		msm_dp_ctrl_config_psr(dp->ctrl);
+
+	return 0;
+}
+
+static void msm_dp_display_audio_notify_disable(struct msm_dp_display_private *dp)
+{
+	struct msm_dp *msm_dp_display = &dp->msm_dp_display;
+
+	/* wait only if audio was enabled */
+	if (msm_dp_display->audio_enabled) {
+		/* signal the disconnect event */
+		msm_dp_display_handle_plugged_change(msm_dp_display, false);
+		if (!wait_for_completion_timeout(&dp->audio_comp,
+				HZ * 5))
+			DRM_ERROR("audio comp timeout\n");
+	}
+
+	msm_dp_display->audio_enabled = false;
+}
+
+static int msm_dp_display_disable(struct msm_dp_display_private *dp,
+				  struct msm_dp_panel *msm_dp_panel)
+{
+	if (!dp->active_stream_cnt)
+		return 0;
+
+	msm_dp_ctrl_clear_vsc_sdp_pkt(dp->ctrl, msm_dp_panel);
+
+	msm_dp_ctrl_stream_clk_off(dp->ctrl, msm_dp_panel);
+
+	dp->active_stream_cnt--;
+
+	drm_dbg_dp(dp->drm_dev, "sink count: %d\n", dp->link->sink_count);
+	return 0;
+}
+
+int msm_dp_display_set_plugged_cb(struct msm_dp *msm_dp_display,
+		hdmi_codec_plugged_cb fn, struct device *codec_dev)
+{
+	bool plugged;
+
+	msm_dp_display->plugged_cb = fn;
+	msm_dp_display->codec_dev = codec_dev;
+	plugged = msm_dp_display->link_ready;
+	msm_dp_display_handle_plugged_change(msm_dp_display, plugged);
+
+	return 0;
+}
+
+int msm_dp_display_set_stream_info(struct msm_dp *dp,
+				   struct msm_dp_panel *panel, u32 strm_id, u32 start_slot,
+				   u32 num_slots, u32 pbn, int vcpi)
+{
+	struct msm_dp_display_private *msm_dp_display;
+	const int max_slots = 64;
+
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	if (!msm_dp_display) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	if (strm_id >= DP_STREAM_MAX) {
+		DRM_ERROR("invalid stream id:%d\n", strm_id);
+		return -EINVAL;
+	}
+
+	if (start_slot + num_slots > max_slots) {
+		DRM_ERROR("invalid channel info received. start:%d, slots:%d\n",
+			  start_slot, num_slots);
+		return -EINVAL;
+	}
+
+	msm_dp_ctrl_set_mst_channel_info(msm_dp_display->ctrl, strm_id, start_slot, num_slots);
+
+	if (panel) {
+		panel->stream_id = strm_id;
+		panel->mst_caps.pbn = pbn;
+	}
+
+	return 0;
+}
+
+/**
+ * msm_dp_bridge_mode_valid - callback to determine if specified mode is valid
+ * @dp: Pointer to dp display structure
+ * @info: display info
+ * @mode: Pointer to drm mode structure
+ * Returns: Validity status for specified mode
+ */
+enum drm_mode_status msm_dp_display_mode_valid(struct msm_dp *dp,
+					       const struct drm_display_info *info,
+					       const struct drm_display_mode *mode)
+{
+	const u32 num_components = 3, default_bpp = 24;
+	struct msm_dp_display_private *msm_dp_display;
+	struct msm_dp_link_info *link_info;
+	u32 mode_rate_khz = 0, supported_rate_khz = 0, mode_bpp = 0;
+	int mode_pclk_khz = mode->clock;
+
+	if (!dp || !mode_pclk_khz || !dp->connector) {
+		DRM_ERROR("invalid params\n");
+		return -EINVAL;
+	}
+
+	if (mode->clock > DP_MAX_PIXEL_CLK_KHZ)
+		return MODE_CLOCK_HIGH;
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+	link_info = &msm_dp_display->panel->link_info;
+
+	if (drm_mode_is_420_only(&dp->connector->display_info, mode) &&
+	    msm_dp_display->panel->vsc_sdp_supported)
+		mode_pclk_khz /= 2;
+
+	mode_bpp = dp->connector->display_info.bpc * num_components;
+	if (!mode_bpp)
+		mode_bpp = default_bpp;
+
+	mode_bpp = msm_dp_panel_get_mode_bpp(msm_dp_display->panel,
+			mode_bpp, mode_pclk_khz);
+
+	mode_rate_khz = mode_pclk_khz * mode_bpp;
+	supported_rate_khz = link_info->num_lanes * link_info->rate * 8;
+
+	if (mode_rate_khz > supported_rate_khz)
+		return MODE_BAD;
+
+	return MODE_OK;
+}
+
+int msm_dp_display_get_modes(struct msm_dp *dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	if (!dp) {
+		DRM_ERROR("invalid params\n");
+		return 0;
+	}
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	return msm_dp_panel_get_modes(msm_dp_display->panel,
+		dp->connector);
+}
+
+bool msm_dp_display_check_video_test(struct msm_dp *dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	return msm_dp_display->panel->video_test;
+}
+
+int msm_dp_display_get_test_bpp(struct msm_dp *dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	if (!dp) {
+		DRM_ERROR("invalid params\n");
+		return 0;
+	}
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	return msm_dp_link_bit_depth_to_bpp(
+		msm_dp_display->link->test_video.test_bit_depth);
+}
+
+void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	/*
+	 * if we are reading registers we need the link clocks to be on
+	 * however till DP cable is connected this will not happen as we
+	 * do not know the resolution to power up with. Hence check the
+	 * power_on status before dumping DP registers to avoid crash due
+	 * to unclocked access
+	 */
+	mutex_lock(&msm_dp_display->event_mutex);
+
+	if (!msm_dp_display->active_stream_cnt) {
+		mutex_unlock(&msm_dp_display->event_mutex);
+		return;
+	}
+
+	msm_dp_catalog_snapshot(msm_dp_display->catalog, disp_state);
+
+	mutex_unlock(&msm_dp_display->event_mutex);
+}
+
+void msm_dp_display_set_psr(struct msm_dp *msm_dp_display, bool enter)
+{
+	struct msm_dp_display_private *dp;
+
+	if (!msm_dp_display) {
+		DRM_ERROR("invalid params\n");
+		return;
+	}
+
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+	msm_dp_ctrl_set_psr(dp->ctrl, enter);
+}
+
+static int hpd_event_thread(void *data)
+{
+	struct msm_dp_display_private *msm_dp_priv;
+	unsigned long flag;
+	struct msm_dp_event *todo;
+	int timeout_mode = 0;
+
+	msm_dp_priv = (struct msm_dp_display_private *)data;
+
+	while (1) {
+		if (timeout_mode) {
+			wait_event_timeout(msm_dp_priv->event_q,
+				(msm_dp_priv->event_pndx == msm_dp_priv->event_gndx) ||
+					kthread_should_stop(), EVENT_TIMEOUT);
+		} else {
+			wait_event_interruptible(msm_dp_priv->event_q,
+				(msm_dp_priv->event_pndx != msm_dp_priv->event_gndx) ||
+					kthread_should_stop());
+		}
+
+		if (kthread_should_stop())
+			break;
+
+		spin_lock_irqsave(&msm_dp_priv->event_lock, flag);
+		todo = &msm_dp_priv->event_list[msm_dp_priv->event_gndx];
+		if (todo->delay) {
+			struct msm_dp_event *todo_next;
+
+			msm_dp_priv->event_gndx++;
+			msm_dp_priv->event_gndx %= DP_EVENT_Q_MAX;
+
+			/* re enter delay event into q */
+			todo_next = &msm_dp_priv->event_list[msm_dp_priv->event_pndx++];
+			msm_dp_priv->event_pndx %= DP_EVENT_Q_MAX;
+			todo_next->event_id = todo->event_id;
+			todo_next->data = todo->data;
+			todo_next->delay = todo->delay - 1;
+
+			/* clean up older event */
+			todo->event_id = EV_NO_EVENT;
+			todo->delay = 0;
+
+			/* switch to timeout mode */
+			timeout_mode = 1;
+			spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
+			continue;
+		}
+
+		/* timeout with no events in q */
+		if (msm_dp_priv->event_pndx == msm_dp_priv->event_gndx) {
+			spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
+			continue;
+		}
+
+		msm_dp_priv->event_gndx++;
+		msm_dp_priv->event_gndx %= DP_EVENT_Q_MAX;
+		timeout_mode = 0;
+		spin_unlock_irqrestore(&msm_dp_priv->event_lock, flag);
+
+		switch (todo->event_id) {
+		case EV_HPD_PLUG_INT:
+			msm_dp_hpd_plug_handle(msm_dp_priv, todo->data);
+			break;
+		case EV_HPD_UNPLUG_INT:
+			msm_dp_hpd_unplug_handle(msm_dp_priv, todo->data);
+			break;
+		case EV_IRQ_HPD_INT:
+			msm_dp_irq_hpd_handle(msm_dp_priv, todo->data);
+			break;
+		case EV_USER_NOTIFICATION:
+			msm_dp_display_send_hpd_notification(msm_dp_priv,
+						todo->data);
+			break;
+		default:
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int msm_dp_hpd_event_thread_start(struct msm_dp_display_private *msm_dp_priv)
+{
+	/* set event q to empty */
+	msm_dp_priv->event_gndx = 0;
+	msm_dp_priv->event_pndx = 0;
+
+	msm_dp_priv->ev_tsk = kthread_run(hpd_event_thread, msm_dp_priv, "dp_hpd_handler");
+	if (IS_ERR(msm_dp_priv->ev_tsk))
+		return PTR_ERR(msm_dp_priv->ev_tsk);
+
+	return 0;
+}
+
+static irqreturn_t msm_dp_display_irq_handler(int irq, void *dev_id)
+{
+	struct msm_dp_display_private *dp = dev_id;
+	irqreturn_t ret = IRQ_NONE;
+	u32 hpd_isr_status;
+
+	if (!dp) {
+		DRM_ERROR("invalid data\n");
+		return IRQ_NONE;
+	}
+
+	hpd_isr_status = msm_dp_catalog_hpd_get_intr_status(dp->catalog);
+
+	if (hpd_isr_status & 0x0F) {
+		drm_dbg_dp(dp->drm_dev, "type=%d isr=0x%x\n",
+			dp->msm_dp_display.connector_type, hpd_isr_status);
+		/* hpd related interrupts */
+		if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK)
+			msm_dp_add_event(dp, EV_HPD_PLUG_INT, 0, 0);
+
+		if (hpd_isr_status & DP_DP_IRQ_HPD_INT_MASK) {
+			msm_dp_add_event(dp, EV_IRQ_HPD_INT, 0, 0);
+		}
+
+		if (hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK) {
+			msm_dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
+			msm_dp_add_event(dp, EV_HPD_PLUG_INT, 0, 3);
+		}
+
+		if (hpd_isr_status & DP_DP_HPD_UNPLUG_INT_MASK)
+			msm_dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
+
+		ret = IRQ_HANDLED;
+	}
+
+	/* DP controller isr */
+	ret |= msm_dp_ctrl_isr(dp->ctrl);
+
+	/* DP aux isr */
+	ret |= msm_dp_aux_isr(dp->aux);
+
+	return ret;
+}
+
+static int msm_dp_display_request_irq(struct msm_dp_display_private *dp)
+{
+	int rc = 0;
+	struct platform_device *pdev = dp->msm_dp_display.pdev;
+
+	dp->irq = platform_get_irq(pdev, 0);
+	if (dp->irq < 0) {
+		DRM_ERROR("failed to get irq\n");
+		return dp->irq;
+	}
+
+	rc = devm_request_irq(&pdev->dev, dp->irq, msm_dp_display_irq_handler,
+			      IRQF_TRIGGER_HIGH|IRQF_NO_AUTOEN,
+			      "dp_display_isr", dp);
+
+	if (rc < 0) {
+		DRM_ERROR("failed to request IRQ%u: %d\n",
+				dp->irq, rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+static const struct msm_dp_desc *msm_dp_display_get_desc(struct platform_device *pdev)
+{
+	const struct msm_dp_desc *descs = of_device_get_match_data(&pdev->dev);
+	struct resource *res;
+	int i;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res)
+		return NULL;
+
+	for (i = 0; i < descs[i].io_start; i++) {
+		if (descs[i].io_start == res->start)
+			return &descs[i];
+	}
+
+	dev_err(&pdev->dev, "unknown displayport instance\n");
+	return NULL;
+}
+
+static int msm_dp_display_probe_tail(struct device *dev)
+{
+	struct msm_dp *dp = dev_get_drvdata(dev);
+	int ret;
+
+	/*
+	 * External bridges are mandatory for eDP interfaces: one has to
+	 * provide at least an eDP panel (which gets wrapped into panel-bridge).
+	 *
+	 * For DisplayPort interfaces external bridges are optional, so
+	 * silently ignore an error if one is not present (-ENODEV).
+	 */
+	dp->next_bridge = devm_drm_of_get_bridge(&dp->pdev->dev, dp->pdev->dev.of_node, 1, 0);
+	if (IS_ERR(dp->next_bridge)) {
+		ret = PTR_ERR(dp->next_bridge);
+		dp->next_bridge = NULL;
+		if (dp->is_edp || ret != -ENODEV)
+			return ret;
+	}
+
+	ret = component_add(dev, &msm_dp_display_comp_ops);
+	if (ret)
+		DRM_ERROR("component add failed, rc=%d\n", ret);
+
+	return ret;
+}
+
+static int msm_dp_auxbus_done_probe(struct drm_dp_aux *aux)
+{
+	return msm_dp_display_probe_tail(aux->dev);
+}
+
+static int msm_dp_display_get_connector_type(struct platform_device *pdev,
+					 const struct msm_dp_desc *desc)
+{
+	struct device_node *node = pdev->dev.of_node;
+	struct device_node *aux_bus = of_get_child_by_name(node, "aux-bus");
+	struct device_node *panel = of_get_child_by_name(aux_bus, "panel");
+	int connector_type;
+
+	if (panel)
+		connector_type = DRM_MODE_CONNECTOR_eDP;
+	else
+		connector_type = DRM_MODE_SUBCONNECTOR_DisplayPort;
+
+	of_node_put(panel);
+	of_node_put(aux_bus);
+
+	return connector_type;
+}
+
+int msm_dp_get_mst_max_stream(const struct msm_dp *dp_display)
+{
+	struct msm_dp_display_private *dp_priv;
+
+	dp_priv = container_of(dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	return dp_priv->max_stream;
+}
+
+int msm_dp_mst_bridge_init(struct msm_dp *dp_display, struct drm_encoder *encoder)
+{
+	return msm_dp_mst_drm_bridge_init(dp_display, encoder);
+}
+
+static int msm_dp_display_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+	struct msm_dp_display_private *dp;
+	const struct msm_dp_desc *desc;
+
+	if (!pdev || !pdev->dev.of_node) {
+		DRM_ERROR("pdev not found\n");
+		return -ENODEV;
+	}
+
+	dp = devm_kzalloc(&pdev->dev, sizeof(*dp), GFP_KERNEL);
+	if (!dp)
+		return -ENOMEM;
+
+	desc = msm_dp_display_get_desc(pdev);
+	if (!desc)
+		return -EINVAL;
+
+	dp->msm_dp_display.pdev = pdev;
+	dp->id = desc->id;
+	dp->msm_dp_display.connector_type = msm_dp_display_get_connector_type(pdev, desc);
+	dp->wide_bus_supported = desc->wide_bus_supported;
+	dp->msm_dp_display.is_edp =
+		(dp->msm_dp_display.connector_type == DRM_MODE_CONNECTOR_eDP);
+
+	dp->max_stream = (desc->max_streams > DEFAULT_STREAM_COUNT) ?
+			  desc->max_streams : DEFAULT_STREAM_COUNT;
+
+	dp->intf_map = desc->intf_map;
+
+	rc = msm_dp_init_sub_modules(dp);
+	if (rc) {
+		DRM_ERROR("init sub module failed\n");
+		return -EPROBE_DEFER;
+	}
+
+	/* setup event q */
+	mutex_init(&dp->event_mutex);
+	init_waitqueue_head(&dp->event_q);
+	spin_lock_init(&dp->event_lock);
+
+	/* Store DP audio handle inside DP display */
+	dp->msm_dp_display.msm_dp_audio = dp->audio;
+
+	init_completion(&dp->audio_comp);
+
+	platform_set_drvdata(pdev, &dp->msm_dp_display);
+
+	rc = devm_pm_runtime_enable(&pdev->dev);
+	if (rc)
+		goto err;
+
+	rc = msm_dp_display_request_irq(dp);
+	if (rc)
+		goto err;
+
+	if (dp->msm_dp_display.is_edp) {
+		rc = devm_of_dp_aux_populate_bus(dp->aux, msm_dp_auxbus_done_probe);
+		if (rc) {
+			DRM_ERROR("eDP auxbus population failed, rc=%d\n", rc);
+			goto err;
+		}
+	} else {
+		rc = msm_dp_display_probe_tail(&pdev->dev);
+		if (rc)
+			goto err;
+	}
+
+	return rc;
+
+err:
+	msm_dp_display_deinit_sub_modules(dp);
+	return rc;
+}
+
+static void msm_dp_display_remove(struct platform_device *pdev)
+{
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(&pdev->dev);
+
+	component_del(&pdev->dev, &msm_dp_display_comp_ops);
+	msm_dp_display_deinit_sub_modules(dp);
+	platform_set_drvdata(pdev, NULL);
+}
+
+static int msm_dp_pm_runtime_suspend(struct device *dev)
+{
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
+
+	disable_irq(dp->irq);
+
+	if (dp->msm_dp_display.is_edp) {
+		msm_dp_display_host_phy_exit(dp);
+		msm_dp_catalog_ctrl_hpd_disable(dp->catalog);
+	}
+	msm_dp_display_host_deinit(dp);
+
+	return 0;
+}
+
+static int msm_dp_pm_runtime_resume(struct device *dev)
+{
+	struct msm_dp_display_private *dp = dev_get_dp_display_private(dev);
+
+	/*
+	 * for eDP, host cotroller, HPD block and PHY are enabled here
+	 * but with HPD irq disabled
+	 *
+	 * for DP, only host controller is enabled here.
+	 * HPD block is enabled at msm_dp_bridge_hpd_enable()
+	 * PHY will be enabled at plugin handler later
+	 */
+	msm_dp_display_host_init(dp);
+	if (dp->msm_dp_display.is_edp) {
+		msm_dp_catalog_ctrl_hpd_enable(dp->catalog);
+		msm_dp_display_host_phy_init(dp);
+	}
+
+	enable_irq(dp->irq);
+	return 0;
+}
+
+static const struct dev_pm_ops msm_dp_pm_ops = {
+	SET_RUNTIME_PM_OPS(msm_dp_pm_runtime_suspend, msm_dp_pm_runtime_resume, NULL)
+	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+				pm_runtime_force_resume)
+};
+
+static struct platform_driver msm_dp_display_driver = {
+	.probe  = msm_dp_display_probe,
+	.remove_new = msm_dp_display_remove,
+	.driver = {
+		.name = "msm-dp-display",
+		.of_match_table = msm_dp_dt_match,
+		.suppress_bind_attrs = true,
+		.pm = &msm_dp_pm_ops,
+	},
+};
+
+int __init msm_dp_register(void)
+{
+	int ret;
+
+	ret = platform_driver_register(&msm_dp_display_driver);
+	if (ret)
+		DRM_ERROR("Dp display driver register failed");
+
+	return ret;
+}
+
+void __exit msm_dp_unregister(void)
+{
+	platform_driver_unregister(&msm_dp_display_driver);
+}
+
+bool msm_dp_is_yuv_420_enabled(const struct msm_dp *msm_dp_display,
+			       const struct drm_display_mode *mode)
+{
+	struct msm_dp_display_private *dp;
+	const struct drm_display_info *info;
+
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+	info = &msm_dp_display->connector->display_info;
+
+	return dp->panel->vsc_sdp_supported && drm_mode_is_420_only(info, mode);
+}
+
+bool msm_dp_needs_periph_flush(const struct msm_dp *msm_dp_display,
+			       const struct drm_display_mode *mode)
+{
+	return msm_dp_is_yuv_420_enabled(msm_dp_display, mode);
+}
+
+bool msm_dp_wide_bus_available(const struct msm_dp *msm_dp_display)
+{
+	struct msm_dp_display_private *dp;
+
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	if (dp->panel->msm_dp_mode.out_fmt_is_yuv_420)
+		return false;
+
+	return dp->wide_bus_supported;
+}
+
+int msm_dp_get_mst_intf_id(struct msm_dp *dp_display, int stream_id)
+{
+	struct msm_dp_display_private *dp;
+
+	dp = container_of(dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	if (dp->intf_map)
+		return dp->intf_map[stream_id];
+
+	return 0;
+}
+
+void msm_dp_display_debugfs_init(struct msm_dp *msm_dp_display, struct dentry *root, bool is_edp)
+{
+	struct msm_dp_display_private *dp;
+	struct device *dev;
+	int rc;
+
+	dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+	dev = &dp->msm_dp_display.pdev->dev;
+
+	rc = msm_dp_debug_init(dev, dp->panel, dp->link, dp->msm_dp_display.connector, root, is_edp);
+	if (rc)
+		DRM_ERROR("failed to initialize debug, rc = %d\n", rc);
+}
+
+int msm_dp_modeset_init(struct msm_dp *msm_dp_display, struct drm_device *dev,
+			struct drm_encoder *encoder, bool yuv_supported)
+{
+	struct msm_dp_display_private *msm_dp_priv;
+	int ret;
+
+	msm_dp_display->drm_dev = dev;
+
+	msm_dp_priv = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	ret = msm_dp_bridge_init(msm_dp_display, dev, encoder, yuv_supported);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev,
+			"failed to create dp bridge: %d\n", ret);
+		return ret;
+	}
+
+	msm_dp_display->connector = msm_dp_drm_connector_init(msm_dp_display, encoder);
+	if (IS_ERR(msm_dp_display->connector)) {
+		ret = PTR_ERR(msm_dp_display->connector);
+		DRM_DEV_ERROR(dev->dev,
+			"failed to create dp connector: %d\n", ret);
+		msm_dp_display->connector = NULL;
+		return ret;
+	}
+
+	msm_dp_priv->panel->connector = msm_dp_display->connector;
+
+	return 0;
+}
+
+int msm_dp_mst_register(struct msm_dp *dp)
+{
+	struct msm_dp_display_private *dp_display;
+
+	dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	return msm_dp_mst_init(dp, dp_display->max_stream,
+			   MAX_DPCD_TRANSACTION_BYTES, dp_display->aux);
+}
+
+void msm_dp_display_atomic_prepare(struct msm_dp *dp)
+{
+	int rc = 0;
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	mutex_lock(&msm_dp_display->event_mutex);
+
+	rc = msm_dp_display_prepare(msm_dp_display);
+	if (rc) {
+		DRM_ERROR("DP display prepare failed, rc=%d\n", rc);
+	}
+
+	mutex_unlock(&msm_dp_display->event_mutex);
+}
+
+void msm_dp_display_enable_helper(struct msm_dp *dp, struct msm_dp_panel *msm_dp_panel)
+{
+	int rc = 0;
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	if (dp->is_edp)
+		msm_dp_hpd_plug_handle(msm_dp_display, 0);
+
+	mutex_lock(&msm_dp_display->event_mutex);
+
+	rc = msm_dp_display_enable(msm_dp_display, msm_dp_panel);
+	if (rc)
+		DRM_ERROR("DP display enable failed, rc=%d\n", rc);
+
+	rc = msm_dp_display_post_enable(dp);
+	if (rc) {
+		DRM_ERROR("DP display post enable failed, rc=%d\n", rc);
+		msm_dp_display_disable(msm_dp_display, msm_dp_panel);
+	}
+
+	msm_dp_display->active_stream_cnt++;
+
+	/* completed connection */
+	msm_dp_display->hpd_state = ST_CONNECTED;
+
+	drm_dbg_dp(dp->drm_dev, "type=%d Done\n", dp->connector_type);
+	mutex_unlock(&msm_dp_display->event_mutex);
+}
+
+void msm_dp_display_atomic_enable(struct msm_dp *msm_dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+
+	// move this to a different commit
+	msm_dp_display_set_stream_info(msm_dp, msm_dp_display->panel, 0, 0, 0, 0, 0);
+
+	msm_dp_display_enable_helper(msm_dp, msm_dp_display->panel);
+}
+
+void msm_dp_display_disable_helper(struct msm_dp *dp, struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	if (!msm_dp_display->active_stream_cnt) {
+		drm_dbg_dp(dp->drm_dev, "no active streams\n");
+		return;
+	}
+
+	msm_dp_ctrl_push_vcpf(msm_dp_display->ctrl, msm_dp_panel);
+	msm_dp_ctrl_mst_stream_channel_slot_setup(msm_dp_display->ctrl, msm_dp_display->max_stream);
+	msm_dp_ctrl_mst_send_act(msm_dp_display->ctrl);
+}
+
+void msm_dp_display_atomic_disable(struct msm_dp *msm_dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+
+	msm_dp_ctrl_push_idle(msm_dp_display->ctrl);
+}
+
+void msm_dp_display_unprepare(struct msm_dp *msm_dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+	if (!msm_dp->prepared) {
+		drm_dbg_dp(msm_dp->drm_dev, "Link already unprepare, return\n");
+		return;
+	}
+
+	if (msm_dp_display->active_stream_cnt) {
+		drm_dbg_dp(msm_dp->drm_dev, "stream still active, return\n");
+		return;
+	}
+
+	/* dongle is still connected but sinks are disconnected */
+	if (msm_dp_display->link->sink_count == 0)
+		msm_dp_ctrl_psm_config(msm_dp_display->ctrl);
+
+	msm_dp_ctrl_off_link(msm_dp_display->ctrl);
+
+	/* re-init the PHY so that we can listen to Dongle disconnect */
+	if (msm_dp_display->link->sink_count == 0)
+		msm_dp_ctrl_reinit_phy(msm_dp_display->ctrl);
+	else
+		msm_dp_display_host_phy_exit(msm_dp_display);
+
+	pm_runtime_put_sync(&msm_dp->pdev->dev);
+
+	msm_dp->prepared = false;
+}
+
+void msm_dp_display_atomic_post_disable_helper(struct msm_dp *dp, struct msm_dp_panel *msm_dp_panel)
+{
+	u32 state;
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
+
+	if (dp->is_edp)
+		msm_dp_hpd_unplug_handle(msm_dp_display, 0);
+
+	mutex_lock(&msm_dp_display->event_mutex);
+
+	state = msm_dp_display->hpd_state;
+	if (state != ST_DISCONNECT_PENDING && state != ST_CONNECTED)
+		drm_dbg_dp(dp->drm_dev, "type=%d wrong hpd_state=%d\n",
+			   dp->connector_type, state);
+
+	msm_dp_display_audio_notify_disable(msm_dp_display);
+
+	msm_dp_display_disable(msm_dp_display, msm_dp_panel);
+
+	state =  msm_dp_display->hpd_state;
+	if (state == ST_DISCONNECT_PENDING && !msm_dp_display->active_stream_cnt) {
+		/* completed disconnection */
+		msm_dp_display->hpd_state = ST_DISCONNECTED;
+	} else if (state != ST_DISCONNECT_PENDING && state != ST_DISCONNECTED) {
+		/* stay at pending till both streams are disabled, otherwise OFF */
+		msm_dp_display->hpd_state = ST_DISPLAY_OFF;
+	}
+
+	drm_dbg_dp(dp->drm_dev, "type=%d Done\n", dp->connector_type);
+
+	mutex_unlock(&msm_dp_display->event_mutex);
+}
+
+void msm_dp_display_atomic_post_disable(struct msm_dp *msm_dp)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+
+	msm_dp_display_atomic_post_disable_helper(msm_dp, msm_dp_display->panel);
+
+	msm_dp_display_unprepare(msm_dp);
+}
+
+void msm_dp_display_mode_set_helper(struct msm_dp *msm_dp,
+				    const struct drm_display_mode *mode,
+				    const struct drm_display_mode *adjusted_mode,
+				    struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+
+	msm_dp_display_set_mode(msm_dp, adjusted_mode, msm_dp_panel);
+
+	/* populate wide_bus_support to different layers */
+	msm_dp_display->ctrl->wide_bus_en =
+		msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420 ?
+		false : msm_dp_display->wide_bus_supported;
+	msm_dp_display->catalog->wide_bus_en =
+		msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420 ?
+		false : msm_dp_display->wide_bus_supported;
+}
+
+void msm_dp_display_mode_set(struct msm_dp *msm_dp,
+			     const struct drm_display_mode *mode,
+			     const struct drm_display_mode *adjusted_mode)
+{
+	struct msm_dp_display_private *msm_dp_display;
+
+	msm_dp_display = container_of(msm_dp, struct msm_dp_display_private, msm_dp_display);
+
+	msm_dp_display_mode_set_helper(msm_dp, mode, adjusted_mode, msm_dp_display->panel);
+}
+
+void msm_dp_bridge_hpd_enable(struct drm_bridge *bridge)
+{
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(bridge);
+	struct msm_dp *msm_dp_display = msm_dp_bridge->msm_dp_display;
+	struct msm_dp_display_private *dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	/*
+	 * this is for external DP with hpd irq enabled case,
+	 * step-1: msm_dp_pm_runtime_resume() enable dp host only
+	 * step-2: enable hdp block and have hpd irq enabled here
+	 * step-3: waiting for plugin irq while phy is not initialized
+	 * step-4: DP PHY is initialized at plugin handler before link training
+	 *
+	 */
+	mutex_lock(&dp->event_mutex);
+	if (pm_runtime_resume_and_get(&msm_dp_display->pdev->dev)) {
+		DRM_ERROR("failed to resume power\n");
+		mutex_unlock(&dp->event_mutex);
+		return;
+	}
+
+	msm_dp_catalog_ctrl_hpd_enable(dp->catalog);
+
+	/* enable HDP interrupts */
+	msm_dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_INT_MASK, true);
+
+	msm_dp_display->internal_hpd = true;
+	mutex_unlock(&dp->event_mutex);
+}
+
+void msm_dp_bridge_hpd_disable(struct drm_bridge *bridge)
+{
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(bridge);
+	struct msm_dp *msm_dp_display = msm_dp_bridge->msm_dp_display;
+	struct msm_dp_display_private *dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	mutex_lock(&dp->event_mutex);
+	/* disable HDP interrupts */
+	msm_dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_INT_MASK, false);
+	msm_dp_catalog_ctrl_hpd_disable(dp->catalog);
+
+	msm_dp_display->internal_hpd = false;
+
+	pm_runtime_put_sync(&msm_dp_display->pdev->dev);
+	mutex_unlock(&dp->event_mutex);
+}
+
+void msm_dp_bridge_hpd_notify(struct drm_bridge *bridge,
+			  enum drm_connector_status status)
+{
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(bridge);
+	struct msm_dp *msm_dp_display = msm_dp_bridge->msm_dp_display;
+	struct msm_dp_display_private *dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+	/* Without next_bridge interrupts are handled by the DP core directly */
+	if (msm_dp_display->internal_hpd)
+		return;
+
+	if (!msm_dp_display->link_ready && status == connector_status_connected)
+		msm_dp_add_event(dp, EV_HPD_PLUG_INT, 0, 0);
+	else if (msm_dp_display->link_ready && status == connector_status_disconnected)
+		msm_dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_display.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_display.h
@@ -0,0 +1,74 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_DISPLAY_H_
+#define _DP_DISPLAY_H_
+
+#include "dp_panel.h"
+#include "dp_mst_drm.h"
+#include <sound/hdmi-codec.h>
+#include "disp/msm_disp_snapshot.h"
+
+#define DP_MAX_PIXEL_CLK_KHZ	675000
+
+struct msm_dp {
+	struct drm_device *drm_dev;
+	struct platform_device *pdev;
+	struct device *codec_dev;
+	struct drm_connector *connector;
+	struct drm_bridge *next_bridge;
+	bool link_ready;
+	bool audio_enabled;
+	bool prepared;
+	bool mst_active;
+	unsigned int connector_type;
+	bool is_edp;
+	bool internal_hpd;
+
+	struct msm_dp_mst *msm_dp_mst;
+	hdmi_codec_plugged_cb plugged_cb;
+
+	struct msm_dp_audio *msm_dp_audio;
+	bool psr_supported;
+};
+
+int msm_dp_display_set_plugged_cb(struct msm_dp *msm_dp_display,
+		hdmi_codec_plugged_cb fn, struct device *codec_dev);
+int msm_dp_display_get_modes(struct msm_dp *msm_dp_display);
+bool msm_dp_display_check_video_test(struct msm_dp *msm_dp_display);
+int msm_dp_display_get_test_bpp(struct msm_dp *msm_dp_display);
+void msm_dp_display_signal_audio_start(struct msm_dp *msm_dp_display);
+void msm_dp_display_signal_audio_complete(struct msm_dp *msm_dp_display);
+void msm_dp_display_set_psr(struct msm_dp *dp, bool enter);
+void msm_dp_display_debugfs_init(struct msm_dp *msm_dp_display, struct dentry *dentry, bool is_edp);
+void msm_dp_display_atomic_post_disable(struct msm_dp *dp_display);
+void msm_dp_display_atomic_disable(struct msm_dp *dp_display);
+void msm_dp_display_atomic_enable(struct msm_dp *dp_display);
+void msm_dp_display_atomic_prepare(struct msm_dp *dp);
+void msm_dp_display_mode_set(struct msm_dp *dp,
+			     const struct drm_display_mode *mode,
+			     const struct drm_display_mode *adjusted_mode);
+enum drm_mode_status msm_dp_display_mode_valid(struct msm_dp *dp,
+					       const struct drm_display_info *info,
+					       const struct drm_display_mode *mode);
+int msm_dp_display_set_stream_info(struct msm_dp *dp,
+				   struct msm_dp_panel *panel, u32 strm_id,
+				   u32 start_slot, u32 num_slots, u32 pbn, int vcpi);
+void msm_dp_display_enable_helper(struct msm_dp *msm_dp, struct msm_dp_panel *msm_dp_panel);
+void msm_dp_display_disable_helper(struct msm_dp *msm_dp, struct msm_dp_panel *msm_dp_panel);
+void msm_dp_display_mode_set_helper(struct msm_dp *msm_dp,
+				    const struct drm_display_mode *mode,
+				    const struct drm_display_mode *adjusted_mode,
+				    struct msm_dp_panel *msm_dp_panel);
+void msm_dp_display_atomic_post_disable_helper(struct msm_dp *msm_dp,
+					       struct msm_dp_panel *msm_dp_panel);
+
+void msm_dp_display_unprepare(struct msm_dp *dp);
+
+int msm_dp_display_get_active_stream_cnt(struct msm_dp *msm_dp);
+
+struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *dp_display);
+
+#endif /* _DP_DISPLAY_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_drm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_drm.c
@@ -0,0 +1,419 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <drm/drm_atomic_helper.h>
+#include <drm/drm_atomic.h>
+#include <drm/drm_bridge.h>
+#include <drm/drm_bridge_connector.h>
+#include <drm/drm_crtc.h>
+
+#include "msm_drv.h"
+#include "msm_kms.h"
+#include "dp_drm.h"
+
+/**
+ * msm_dp_bridge_detect - callback to determine if connector is connected
+ * @bridge: Pointer to drm bridge structure
+ * Returns: Bridge's 'is connected' status
+ */
+static enum drm_connector_status msm_dp_bridge_detect(struct drm_bridge *bridge)
+{
+	struct msm_dp *dp;
+
+	dp = to_dp_bridge(bridge)->msm_dp_display;
+
+	drm_dbg_dp(dp->drm_dev, "link_ready = %s\n",
+		(dp->link_ready) ? "true" : "false");
+
+	return (dp->link_ready && !dp->mst_active) ? connector_status_connected :
+					connector_status_disconnected;
+}
+
+static int msm_dp_bridge_atomic_check(struct drm_bridge *bridge,
+			    struct drm_bridge_state *bridge_state,
+			    struct drm_crtc_state *crtc_state,
+			    struct drm_connector_state *conn_state)
+{
+	struct msm_dp *dp;
+
+	dp = to_dp_bridge(bridge)->msm_dp_display;
+
+	drm_dbg_dp(dp->drm_dev, "link_ready = %s\n",
+		(dp->link_ready) ? "true" : "false");
+
+	/*
+	 * There is no protection in the DRM framework to check if the display
+	 * pipeline has been already disabled before trying to disable it again.
+	 * Hence if the sink is unplugged, the pipeline gets disabled, but the
+	 * crtc->active is still true. Any attempt to set the mode or manually
+	 * disable this encoder will result in the crash.
+	 *
+	 * TODO: add support for telling the DRM subsystem that the pipeline is
+	 * disabled by the hardware and thus all access to it should be forbidden.
+	 * After that this piece of code can be removed.
+	 */
+	if (bridge->ops & DRM_BRIDGE_OP_HPD)
+		return (dp->link_ready) ? 0 : -ENOTCONN;
+
+	return 0;
+}
+
+
+/**
+ * msm_dp_bridge_get_modes - callback to add drm modes via drm_mode_probed_add()
+ * @bridge: Poiner to drm bridge
+ * @connector: Pointer to drm connector structure
+ * Returns: Number of modes added
+ */
+static int msm_dp_bridge_get_modes(struct drm_bridge *bridge, struct drm_connector *connector)
+{
+	int rc = 0;
+	struct msm_dp *dp;
+
+	if (!connector)
+		return 0;
+
+	dp = to_dp_bridge(bridge)->msm_dp_display;
+
+	/* pluggable case assumes EDID is read when HPD */
+	if (dp->link_ready) {
+		rc = msm_dp_display_get_modes(dp);
+		if (rc <= 0) {
+			DRM_ERROR("failed to get DP sink modes, rc=%d\n", rc);
+			return rc;
+		}
+	} else {
+		drm_dbg_dp(connector->dev, "No sink connected\n");
+	}
+	return rc;
+}
+
+static void msm_dp_bridge_debugfs_init(struct drm_bridge *bridge, struct dentry *root)
+{
+	struct msm_dp *dp = to_dp_bridge(bridge)->msm_dp_display;
+
+	msm_dp_display_debugfs_init(dp, root, false);
+}
+
+static void msm_dp_bridge_atomic_enable(struct drm_bridge *drm_bridge,
+					struct drm_bridge_state *old_bridge_state)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	msm_dp_display_atomic_prepare(dp);
+	msm_dp_display_atomic_enable(dp);
+}
+
+static void msm_dp_bridge_atomic_disable(struct drm_bridge *drm_bridge,
+					 struct drm_bridge_state *old_bridge_state)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	msm_dp_display_atomic_disable(dp);
+}
+
+static void msm_dp_bridge_atomic_post_disable(struct drm_bridge *drm_bridge,
+					      struct drm_bridge_state *old_bridge_state)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	msm_dp_display_atomic_post_disable(dp);
+}
+
+static void msm_dp_bridge_mode_set(struct drm_bridge *drm_bridge,
+				   const struct drm_display_mode *mode,
+				   const struct drm_display_mode *adjusted_mode)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	msm_dp_display_mode_set(dp, mode, adjusted_mode);
+}
+
+static enum drm_mode_status msm_dp_bridge_mode_valid(struct drm_bridge *drm_bridge,
+						     const struct drm_display_info *info,
+						     const struct drm_display_mode *mode)
+{
+	struct msm_dp_bridge *dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = dp_bridge->msm_dp_display;
+
+	return msm_dp_display_mode_valid(dp, info, mode);
+}
+
+static const struct drm_bridge_funcs msm_dp_bridge_ops = {
+	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
+	.atomic_destroy_state   = drm_atomic_helper_bridge_destroy_state,
+	.atomic_reset           = drm_atomic_helper_bridge_reset,
+	.atomic_enable          = msm_dp_bridge_atomic_enable,
+	.atomic_disable         = msm_dp_bridge_atomic_disable,
+	.atomic_post_disable    = msm_dp_bridge_atomic_post_disable,
+	.mode_set     = msm_dp_bridge_mode_set,
+	.mode_valid   = msm_dp_bridge_mode_valid,
+	.get_modes    = msm_dp_bridge_get_modes,
+	.detect       = msm_dp_bridge_detect,
+	.atomic_check = msm_dp_bridge_atomic_check,
+	.hpd_enable   = msm_dp_bridge_hpd_enable,
+	.hpd_disable  = msm_dp_bridge_hpd_disable,
+	.hpd_notify   = msm_dp_bridge_hpd_notify,
+	.debugfs_init = msm_dp_bridge_debugfs_init,
+};
+
+static int msm_edp_bridge_atomic_check(struct drm_bridge *drm_bridge,
+				   struct drm_bridge_state *bridge_state,
+				   struct drm_crtc_state *crtc_state,
+				   struct drm_connector_state *conn_state)
+{
+	struct msm_dp *dp = to_dp_bridge(drm_bridge)->msm_dp_display;
+
+	if (WARN_ON(!conn_state))
+		return -ENODEV;
+
+	conn_state->self_refresh_aware = dp->psr_supported;
+
+	if (!conn_state->crtc || !crtc_state)
+		return 0;
+
+	if (crtc_state->self_refresh_active && !dp->psr_supported)
+		return -EINVAL;
+
+	return 0;
+}
+
+static void msm_edp_bridge_atomic_enable(struct drm_bridge *drm_bridge,
+				     struct drm_bridge_state *old_bridge_state)
+{
+	struct drm_atomic_state *atomic_state = old_bridge_state->base.state;
+	struct drm_crtc *crtc;
+	struct drm_crtc_state *old_crtc_state;
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = msm_dp_bridge->msm_dp_display;
+
+	/*
+	 * Check the old state of the crtc to determine if the panel
+	 * was put into psr state previously by the msm_edp_bridge_atomic_disable.
+	 * If the panel is in psr, just exit psr state and skip the full
+	 * bridge enable sequence.
+	 */
+	crtc = drm_atomic_get_new_crtc_for_encoder(atomic_state,
+						   drm_bridge->encoder);
+	if (!crtc)
+		return;
+
+	old_crtc_state = drm_atomic_get_old_crtc_state(atomic_state, crtc);
+
+	if (old_crtc_state && old_crtc_state->self_refresh_active) {
+		msm_dp_display_set_psr(dp, false);
+		return;
+	}
+
+	msm_dp_display_atomic_prepare(dp);
+	msm_dp_display_atomic_enable(dp);
+}
+
+static void msm_edp_bridge_atomic_disable(struct drm_bridge *drm_bridge,
+				      struct drm_bridge_state *old_bridge_state)
+{
+	struct drm_atomic_state *atomic_state = old_bridge_state->base.state;
+	struct drm_crtc *crtc;
+	struct drm_crtc_state *new_crtc_state = NULL, *old_crtc_state = NULL;
+	struct msm_dp_bridge *msm_dp_bridge = to_dp_bridge(drm_bridge);
+	struct msm_dp *dp = msm_dp_bridge->msm_dp_display;
+
+	crtc = drm_atomic_get_old_crtc_for_encoder(atomic_state,
+						   drm_bridge->encoder);
+	if (!crtc)
+		goto out;
+
+	new_crtc_state = drm_atomic_get_new_crtc_state(atomic_state, crtc);
+	if (!new_crtc_state)
+		goto out;
+
+	old_crtc_state = drm_atomic_get_old_crtc_state(atomic_state, crtc);
+	if (!old_crtc_state)
+		goto out;
+
+	/*
+	 * Set self refresh mode if current crtc state is active.
+	 *
+	 * If old crtc state is active, then this is a display disable
+	 * call while the sink is in psr state. So, exit psr here.
+	 * The eDP controller will be disabled in the
+	 * msm_edp_bridge_atomic_post_disable function.
+	 *
+	 * We observed sink is stuck in self refresh if psr exit is skipped
+	 * when display disable occurs while the sink is in psr state.
+	 */
+	if (new_crtc_state->self_refresh_active) {
+		msm_dp_display_set_psr(dp, true);
+		return;
+	} else if (old_crtc_state->self_refresh_active) {
+		msm_dp_display_set_psr(dp, false);
+		return;
+	}
+
+out:
+	msm_dp_bridge_atomic_disable(drm_bridge, old_bridge_state);
+}
+
+static void msm_edp_bridge_atomic_post_disable(struct drm_bridge *drm_bridge,
+				struct drm_bridge_state *old_bridge_state)
+{
+	struct drm_atomic_state *atomic_state = old_bridge_state->base.state;
+	struct drm_crtc *crtc;
+	struct drm_crtc_state *new_crtc_state = NULL;
+
+	crtc = drm_atomic_get_old_crtc_for_encoder(atomic_state,
+						   drm_bridge->encoder);
+	if (!crtc)
+		return;
+
+	new_crtc_state = drm_atomic_get_new_crtc_state(atomic_state, crtc);
+	if (!new_crtc_state)
+		return;
+
+	/*
+	 * Self refresh mode is already set in msm_edp_bridge_atomic_disable.
+	 */
+	if (new_crtc_state->self_refresh_active)
+		return;
+
+	msm_dp_bridge_atomic_post_disable(drm_bridge, old_bridge_state);
+}
+
+/**
+ * msm_edp_bridge_mode_valid - callback to determine if specified mode is valid
+ * @bridge: Pointer to drm bridge structure
+ * @info: display info
+ * @mode: Pointer to drm mode structure
+ * Returns: Validity status for specified mode
+ */
+static enum drm_mode_status msm_edp_bridge_mode_valid(struct drm_bridge *bridge,
+					  const struct drm_display_info *info,
+					  const struct drm_display_mode *mode)
+{
+	struct msm_dp *dp;
+	int mode_pclk_khz = mode->clock;
+
+	dp = to_dp_bridge(bridge)->msm_dp_display;
+
+	if (!dp || !mode_pclk_khz || !dp->connector) {
+		DRM_ERROR("invalid params\n");
+		return -EINVAL;
+	}
+
+	if (mode->clock > DP_MAX_PIXEL_CLK_KHZ)
+		return MODE_CLOCK_HIGH;
+
+	/*
+	 * The eDP controller currently does not have a reliable way of
+	 * enabling panel power to read sink capabilities. So, we rely
+	 * on the panel driver to populate only supported modes for now.
+	 */
+	return MODE_OK;
+}
+
+static void msm_edp_bridge_debugfs_init(struct drm_bridge *bridge, struct dentry *root)
+{
+	struct msm_dp *dp = to_dp_bridge(bridge)->msm_dp_display;
+
+	msm_dp_display_debugfs_init(dp, root, true);
+}
+
+static const struct drm_bridge_funcs msm_edp_bridge_ops = {
+	.atomic_enable = msm_edp_bridge_atomic_enable,
+	.atomic_disable = msm_edp_bridge_atomic_disable,
+	.atomic_post_disable = msm_edp_bridge_atomic_post_disable,
+	.mode_set = msm_dp_bridge_mode_set,
+	.mode_valid = msm_edp_bridge_mode_valid,
+	.atomic_reset = drm_atomic_helper_bridge_reset,
+	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+	.atomic_check = msm_edp_bridge_atomic_check,
+	.debugfs_init = msm_edp_bridge_debugfs_init,
+};
+
+int msm_dp_bridge_init(struct msm_dp *msm_dp_display, struct drm_device *dev,
+		   struct drm_encoder *encoder, bool yuv_supported)
+{
+	int rc;
+	struct msm_dp_bridge *msm_dp_bridge;
+	struct drm_bridge *bridge;
+
+	msm_dp_bridge = devm_kzalloc(dev->dev, sizeof(*msm_dp_bridge), GFP_KERNEL);
+	if (!msm_dp_bridge)
+		return -ENOMEM;
+
+	msm_dp_bridge->msm_dp_display = msm_dp_display;
+
+	bridge = &msm_dp_bridge->bridge;
+	bridge->funcs = msm_dp_display->is_edp ? &msm_edp_bridge_ops : &msm_dp_bridge_ops;
+	bridge->type = msm_dp_display->connector_type;
+	bridge->ycbcr_420_allowed = yuv_supported;
+
+	/*
+	 * Many ops only make sense for DP. Why?
+	 * - Detect/HPD are used by DRM to know if a display is _physically_
+	 *   there, not whether the display is powered on / finished initting.
+	 *   On eDP we assume the display is always there because you can't
+	 *   know until power is applied. If we don't implement the ops DRM will
+	 *   assume our display is always there.
+	 * - Currently eDP mode reading is driven by the panel driver. This
+	 *   allows the panel driver to properly power itself on to read the
+	 *   modes.
+	 */
+	if (!msm_dp_display->is_edp) {
+		bridge->ops =
+			DRM_BRIDGE_OP_DETECT |
+			DRM_BRIDGE_OP_HPD |
+			DRM_BRIDGE_OP_MODES;
+	}
+
+	rc = devm_drm_bridge_add(dev->dev, bridge);
+	if (rc) {
+		DRM_ERROR("failed to add bridge, rc=%d\n", rc);
+
+		return rc;
+	}
+
+	rc = drm_bridge_attach(encoder, bridge, NULL, DRM_BRIDGE_ATTACH_NO_CONNECTOR);
+	if (rc) {
+		DRM_ERROR("failed to attach bridge, rc=%d\n", rc);
+
+		return rc;
+	}
+
+	if (msm_dp_display->next_bridge) {
+		rc = drm_bridge_attach(encoder,
+					msm_dp_display->next_bridge, bridge,
+					DRM_BRIDGE_ATTACH_NO_CONNECTOR);
+		if (rc < 0) {
+			DRM_ERROR("failed to attach panel bridge: %d\n", rc);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+/* connector initialization */
+struct drm_connector *msm_dp_drm_connector_init(struct msm_dp *msm_dp_display,
+					    struct drm_encoder *encoder)
+{
+	struct drm_connector *connector = NULL;
+
+	connector = drm_bridge_connector_init(msm_dp_display->drm_dev, encoder);
+	if (IS_ERR(connector))
+		return connector;
+
+	if (!msm_dp_display->is_edp)
+		drm_connector_attach_dp_subconnector_property(connector);
+
+	drm_connector_attach_encoder(connector, encoder);
+
+	return connector;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_drm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_drm.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_DRM_H_
+#define _DP_DRM_H_
+
+#include <linux/types.h>
+#include <drm/drm_bridge.h>
+
+#include "msm_drv.h"
+#include "dp_display.h"
+
+struct msm_dp_bridge {
+	struct drm_bridge bridge;
+	struct msm_dp *msm_dp_display;
+};
+
+#define to_dp_bridge(x)     container_of((x), struct msm_dp_bridge, bridge)
+
+struct drm_connector *msm_dp_drm_connector_init(struct msm_dp *msm_dp_display,
+					    struct drm_encoder *encoder);
+int msm_dp_bridge_init(struct msm_dp *msm_dp_display, struct drm_device *dev,
+		   struct drm_encoder *encoder,
+		   bool yuv_supported);
+
+void msm_dp_bridge_hpd_enable(struct drm_bridge *bridge);
+void msm_dp_bridge_hpd_disable(struct drm_bridge *bridge);
+void msm_dp_bridge_hpd_notify(struct drm_bridge *bridge,
+			  enum drm_connector_status status);
+
+#endif /* _DP_DRM_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_link.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_link.c
@@ -0,0 +1,1232 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"[drm-dp] %s: " fmt, __func__
+
+#include <drm/drm_print.h>
+
+#include "dp_reg.h"
+#include "dp_link.h"
+#include "dp_panel.h"
+
+#define DP_TEST_REQUEST_MASK		0x7F
+
+enum audio_sample_rate {
+	AUDIO_SAMPLE_RATE_32_KHZ	= 0x00,
+	AUDIO_SAMPLE_RATE_44_1_KHZ	= 0x01,
+	AUDIO_SAMPLE_RATE_48_KHZ	= 0x02,
+	AUDIO_SAMPLE_RATE_88_2_KHZ	= 0x03,
+	AUDIO_SAMPLE_RATE_96_KHZ	= 0x04,
+	AUDIO_SAMPLE_RATE_176_4_KHZ	= 0x05,
+	AUDIO_SAMPLE_RATE_192_KHZ	= 0x06,
+};
+
+enum audio_pattern_type {
+	AUDIO_TEST_PATTERN_OPERATOR_DEFINED	= 0x00,
+	AUDIO_TEST_PATTERN_SAWTOOTH		= 0x01,
+};
+
+struct msm_dp_link_request {
+	u32 test_requested;
+	u32 test_link_rate;
+	u32 test_lane_count;
+};
+
+struct msm_dp_link_private {
+	u32 prev_sink_count;
+	struct drm_device *drm_dev;
+	struct drm_dp_aux *aux;
+	struct msm_dp_link msm_dp_link;
+
+	struct msm_dp_link_request request;
+	struct mutex psm_mutex;
+	u8 link_status[DP_LINK_STATUS_SIZE];
+};
+
+static int msm_dp_aux_link_power_up(struct drm_dp_aux *aux,
+					struct msm_dp_link_info *link)
+{
+	u8 value;
+	ssize_t len;
+	int i;
+
+	if (link->revision < 0x11)
+		return 0;
+
+	len = drm_dp_dpcd_readb(aux, DP_SET_POWER, &value);
+	if (len < 0)
+		return len;
+
+	value &= ~DP_SET_POWER_MASK;
+	value |= DP_SET_POWER_D0;
+
+	/* retry for 1ms to give the sink time to wake up */
+	for (i = 0; i < 3; i++) {
+		len = drm_dp_dpcd_writeb(aux, DP_SET_POWER, value);
+		usleep_range(1000, 2000);
+		if (len == 1)
+			break;
+	}
+
+	return 0;
+}
+
+static int msm_dp_aux_link_power_down(struct drm_dp_aux *aux,
+					struct msm_dp_link_info *link)
+{
+	u8 value;
+	int err;
+
+	if (link->revision < 0x11)
+		return 0;
+
+	err = drm_dp_dpcd_readb(aux, DP_SET_POWER, &value);
+	if (err < 0)
+		return err;
+
+	value &= ~DP_SET_POWER_MASK;
+	value |= DP_SET_POWER_D3;
+
+	err = drm_dp_dpcd_writeb(aux, DP_SET_POWER, value);
+	if (err < 0)
+		return err;
+
+	return 0;
+}
+
+static int msm_dp_link_get_period(struct msm_dp_link_private *link, int const addr)
+{
+	int ret = 0;
+	u8 data;
+	u32 const max_audio_period = 0xA;
+
+	/* TEST_AUDIO_PERIOD_CH_XX */
+	if (drm_dp_dpcd_readb(link->aux, addr, &data) < 0) {
+		DRM_ERROR("failed to read test_audio_period (0x%x)\n", addr);
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	/* Period - Bits 3:0 */
+	data = data & 0xF;
+	if ((int)data > max_audio_period) {
+		DRM_ERROR("invalid test_audio_period_ch_1 = 0x%x\n", data);
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	ret = data;
+exit:
+	return ret;
+}
+
+static int msm_dp_link_parse_audio_channel_period(struct msm_dp_link_private *link)
+{
+	int ret = 0;
+	struct msm_dp_link_test_audio *req = &link->msm_dp_link.test_audio;
+
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH1);
+	if (ret == -EINVAL)
+		goto exit;
+
+	req->test_audio_period_ch_1 = ret;
+	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_1 = 0x%x\n", ret);
+
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH2);
+	if (ret == -EINVAL)
+		goto exit;
+
+	req->test_audio_period_ch_2 = ret;
+	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_2 = 0x%x\n", ret);
+
+	/* TEST_AUDIO_PERIOD_CH_3 (Byte 0x275) */
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH3);
+	if (ret == -EINVAL)
+		goto exit;
+
+	req->test_audio_period_ch_3 = ret;
+	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_3 = 0x%x\n", ret);
+
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH4);
+	if (ret == -EINVAL)
+		goto exit;
+
+	req->test_audio_period_ch_4 = ret;
+	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_4 = 0x%x\n", ret);
+
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH5);
+	if (ret == -EINVAL)
+		goto exit;
+
+	req->test_audio_period_ch_5 = ret;
+	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_5 = 0x%x\n", ret);
+
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH6);
+	if (ret == -EINVAL)
+		goto exit;
+
+	req->test_audio_period_ch_6 = ret;
+	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_6 = 0x%x\n", ret);
+
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH7);
+	if (ret == -EINVAL)
+		goto exit;
+
+	req->test_audio_period_ch_7 = ret;
+	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_7 = 0x%x\n", ret);
+
+	ret = msm_dp_link_get_period(link, DP_TEST_AUDIO_PERIOD_CH8);
+	if (ret == -EINVAL)
+		goto exit;
+
+	req->test_audio_period_ch_8 = ret;
+	drm_dbg_dp(link->drm_dev, "test_audio_period_ch_8 = 0x%x\n", ret);
+exit:
+	return ret;
+}
+
+static int msm_dp_link_parse_audio_pattern_type(struct msm_dp_link_private *link)
+{
+	int ret = 0;
+	u8 data;
+	ssize_t rlen;
+	int const max_audio_pattern_type = 0x1;
+
+	rlen = drm_dp_dpcd_readb(link->aux,
+				DP_TEST_AUDIO_PATTERN_TYPE, &data);
+	if (rlen < 0) {
+		DRM_ERROR("failed to read link audio mode. rlen=%zd\n", rlen);
+		return rlen;
+	}
+
+	/* Audio Pattern Type - Bits 7:0 */
+	if ((int)data > max_audio_pattern_type) {
+		DRM_ERROR("invalid audio pattern type = 0x%x\n", data);
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	link->msm_dp_link.test_audio.test_audio_pattern_type = data;
+	drm_dbg_dp(link->drm_dev, "audio pattern type = 0x%x\n", data);
+exit:
+	return ret;
+}
+
+static int msm_dp_link_parse_audio_mode(struct msm_dp_link_private *link)
+{
+	int ret = 0;
+	u8 data;
+	ssize_t rlen;
+	int const max_audio_sampling_rate = 0x6;
+	int const max_audio_channel_count = 0x8;
+	int sampling_rate = 0x0;
+	int channel_count = 0x0;
+
+	rlen = drm_dp_dpcd_readb(link->aux, DP_TEST_AUDIO_MODE, &data);
+	if (rlen < 0) {
+		DRM_ERROR("failed to read link audio mode. rlen=%zd\n", rlen);
+		return rlen;
+	}
+
+	/* Sampling Rate - Bits 3:0 */
+	sampling_rate = data & 0xF;
+	if (sampling_rate > max_audio_sampling_rate) {
+		DRM_ERROR("sampling rate (0x%x) greater than max (0x%x)\n",
+				sampling_rate, max_audio_sampling_rate);
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	/* Channel Count - Bits 7:4 */
+	channel_count = ((data & 0xF0) >> 4) + 1;
+	if (channel_count > max_audio_channel_count) {
+		DRM_ERROR("channel_count (0x%x) greater than max (0x%x)\n",
+				channel_count, max_audio_channel_count);
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	link->msm_dp_link.test_audio.test_audio_sampling_rate = sampling_rate;
+	link->msm_dp_link.test_audio.test_audio_channel_count = channel_count;
+	drm_dbg_dp(link->drm_dev,
+			"sampling_rate = 0x%x, channel_count = 0x%x\n",
+			sampling_rate, channel_count);
+exit:
+	return ret;
+}
+
+static int msm_dp_link_parse_audio_pattern_params(struct msm_dp_link_private *link)
+{
+	int ret = 0;
+
+	ret = msm_dp_link_parse_audio_mode(link);
+	if (ret)
+		goto exit;
+
+	ret = msm_dp_link_parse_audio_pattern_type(link);
+	if (ret)
+		goto exit;
+
+	ret = msm_dp_link_parse_audio_channel_period(link);
+
+exit:
+	return ret;
+}
+
+static bool msm_dp_link_is_video_pattern_valid(u32 pattern)
+{
+	switch (pattern) {
+	case DP_NO_TEST_PATTERN:
+	case DP_COLOR_RAMP:
+	case DP_BLACK_AND_WHITE_VERTICAL_LINES:
+	case DP_COLOR_SQUARE:
+		return true;
+	default:
+		return false;
+	}
+}
+
+/**
+ * msm_dp_link_is_bit_depth_valid() - validates the bit depth requested
+ * @tbd: bit depth requested by the sink
+ *
+ * Returns true if the requested bit depth is supported.
+ */
+static bool msm_dp_link_is_bit_depth_valid(u32 tbd)
+{
+	/* DP_TEST_VIDEO_PATTERN_NONE is treated as invalid */
+	switch (tbd) {
+	case DP_TEST_BIT_DEPTH_6:
+	case DP_TEST_BIT_DEPTH_8:
+	case DP_TEST_BIT_DEPTH_10:
+		return true;
+	default:
+		return false;
+	}
+}
+
+static int msm_dp_link_parse_timing_params1(struct msm_dp_link_private *link,
+					int addr, int len, u32 *val)
+{
+	u8 bp[2];
+	int rlen;
+
+	if (len != 2)
+		return -EINVAL;
+
+	/* Read the requested video link pattern (Byte 0x221). */
+	rlen = drm_dp_dpcd_read(link->aux, addr, bp, len);
+	if (rlen < len) {
+		DRM_ERROR("failed to read 0x%x\n", addr);
+		return -EINVAL;
+	}
+
+	*val = bp[1] | (bp[0] << 8);
+
+	return 0;
+}
+
+static int msm_dp_link_parse_timing_params2(struct msm_dp_link_private *link,
+					int addr, int len,
+					u32 *val1, u32 *val2)
+{
+	u8 bp[2];
+	int rlen;
+
+	if (len != 2)
+		return -EINVAL;
+
+	/* Read the requested video link pattern (Byte 0x221). */
+	rlen = drm_dp_dpcd_read(link->aux, addr, bp, len);
+	if (rlen < len) {
+		DRM_ERROR("failed to read 0x%x\n", addr);
+		return -EINVAL;
+	}
+
+	*val1 = (bp[0] & BIT(7)) >> 7;
+	*val2 = bp[1] | ((bp[0] & 0x7F) << 8);
+
+	return 0;
+}
+
+static int msm_dp_link_parse_timing_params3(struct msm_dp_link_private *link,
+					int addr, u32 *val)
+{
+	u8 bp;
+	u32 len = 1;
+	int rlen;
+
+	rlen = drm_dp_dpcd_read(link->aux, addr, &bp, len);
+	if (rlen < 1) {
+		DRM_ERROR("failed to read 0x%x\n", addr);
+		return -EINVAL;
+	}
+	*val = bp;
+
+	return 0;
+}
+
+/**
+ * msm_dp_link_parse_video_pattern_params() - parses video pattern parameters from DPCD
+ * @link: Display Port Driver data
+ *
+ * Returns 0 if it successfully parses the video link pattern and the link
+ * bit depth requested by the sink and, and if the values parsed are valid.
+ */
+static int msm_dp_link_parse_video_pattern_params(struct msm_dp_link_private *link)
+{
+	int ret = 0;
+	ssize_t rlen;
+	u8 bp;
+
+	rlen = drm_dp_dpcd_readb(link->aux, DP_TEST_PATTERN, &bp);
+	if (rlen < 0) {
+		DRM_ERROR("failed to read link video pattern. rlen=%zd\n",
+			rlen);
+		return rlen;
+	}
+
+	if (!msm_dp_link_is_video_pattern_valid(bp)) {
+		DRM_ERROR("invalid link video pattern = 0x%x\n", bp);
+		ret = -EINVAL;
+		return ret;
+	}
+
+	link->msm_dp_link.test_video.test_video_pattern = bp;
+
+	/* Read the requested color bit depth and dynamic range (Byte 0x232) */
+	rlen = drm_dp_dpcd_readb(link->aux, DP_TEST_MISC0, &bp);
+	if (rlen < 0) {
+		DRM_ERROR("failed to read link bit depth. rlen=%zd\n", rlen);
+		return rlen;
+	}
+
+	/* Dynamic Range */
+	link->msm_dp_link.test_video.test_dyn_range =
+			(bp & DP_TEST_DYNAMIC_RANGE_CEA);
+
+	/* Color bit depth */
+	bp &= DP_TEST_BIT_DEPTH_MASK;
+	if (!msm_dp_link_is_bit_depth_valid(bp)) {
+		DRM_ERROR("invalid link bit depth = 0x%x\n", bp);
+		ret = -EINVAL;
+		return ret;
+	}
+
+	link->msm_dp_link.test_video.test_bit_depth = bp;
+
+	/* resolution timing params */
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_H_TOTAL_HI, 2,
+			&link->msm_dp_link.test_video.test_h_total);
+	if (ret) {
+		DRM_ERROR("failed to parse test_htotal(DP_TEST_H_TOTAL_HI)\n");
+		return ret;
+	}
+
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_V_TOTAL_HI, 2,
+			&link->msm_dp_link.test_video.test_v_total);
+	if (ret) {
+		DRM_ERROR("failed to parse test_v_total(DP_TEST_V_TOTAL_HI)\n");
+		return ret;
+	}
+
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_H_START_HI, 2,
+			&link->msm_dp_link.test_video.test_h_start);
+	if (ret) {
+		DRM_ERROR("failed to parse test_h_start(DP_TEST_H_START_HI)\n");
+		return ret;
+	}
+
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_V_START_HI, 2,
+			&link->msm_dp_link.test_video.test_v_start);
+	if (ret) {
+		DRM_ERROR("failed to parse test_v_start(DP_TEST_V_START_HI)\n");
+		return ret;
+	}
+
+	ret = msm_dp_link_parse_timing_params2(link, DP_TEST_HSYNC_HI, 2,
+			&link->msm_dp_link.test_video.test_hsync_pol,
+			&link->msm_dp_link.test_video.test_hsync_width);
+	if (ret) {
+		DRM_ERROR("failed to parse (DP_TEST_HSYNC_HI)\n");
+		return ret;
+	}
+
+	ret = msm_dp_link_parse_timing_params2(link, DP_TEST_VSYNC_HI, 2,
+			&link->msm_dp_link.test_video.test_vsync_pol,
+			&link->msm_dp_link.test_video.test_vsync_width);
+	if (ret) {
+		DRM_ERROR("failed to parse (DP_TEST_VSYNC_HI)\n");
+		return ret;
+	}
+
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_H_WIDTH_HI, 2,
+			&link->msm_dp_link.test_video.test_h_width);
+	if (ret) {
+		DRM_ERROR("failed to parse test_h_width(DP_TEST_H_WIDTH_HI)\n");
+		return ret;
+	}
+
+	ret = msm_dp_link_parse_timing_params1(link, DP_TEST_V_HEIGHT_HI, 2,
+			&link->msm_dp_link.test_video.test_v_height);
+	if (ret) {
+		DRM_ERROR("failed to parse test_v_height\n");
+		return ret;
+	}
+
+	ret = msm_dp_link_parse_timing_params3(link, DP_TEST_MISC1,
+		&link->msm_dp_link.test_video.test_rr_d);
+	link->msm_dp_link.test_video.test_rr_d &= DP_TEST_REFRESH_DENOMINATOR;
+	if (ret) {
+		DRM_ERROR("failed to parse test_rr_d (DP_TEST_MISC1)\n");
+		return ret;
+	}
+
+	ret = msm_dp_link_parse_timing_params3(link, DP_TEST_REFRESH_RATE_NUMERATOR,
+		&link->msm_dp_link.test_video.test_rr_n);
+	if (ret) {
+		DRM_ERROR("failed to parse test_rr_n\n");
+		return ret;
+	}
+
+	drm_dbg_dp(link->drm_dev,
+		"link video pattern = 0x%x\n"
+		"link dynamic range = 0x%x\n"
+		"link bit depth = 0x%x\n"
+		"TEST_H_TOTAL = %d, TEST_V_TOTAL = %d\n"
+		"TEST_H_START = %d, TEST_V_START = %d\n"
+		"TEST_HSYNC_POL = %d\n"
+		"TEST_HSYNC_WIDTH = %d\n"
+		"TEST_VSYNC_POL = %d\n"
+		"TEST_VSYNC_WIDTH = %d\n"
+		"TEST_H_WIDTH = %d\n"
+		"TEST_V_HEIGHT = %d\n"
+		"TEST_REFRESH_DENOMINATOR = %d\n"
+		 "TEST_REFRESH_NUMERATOR = %d\n",
+		link->msm_dp_link.test_video.test_video_pattern,
+		link->msm_dp_link.test_video.test_dyn_range,
+		link->msm_dp_link.test_video.test_bit_depth,
+		link->msm_dp_link.test_video.test_h_total,
+		link->msm_dp_link.test_video.test_v_total,
+		link->msm_dp_link.test_video.test_h_start,
+		link->msm_dp_link.test_video.test_v_start,
+		link->msm_dp_link.test_video.test_hsync_pol,
+		link->msm_dp_link.test_video.test_hsync_width,
+		link->msm_dp_link.test_video.test_vsync_pol,
+		link->msm_dp_link.test_video.test_vsync_width,
+		link->msm_dp_link.test_video.test_h_width,
+		link->msm_dp_link.test_video.test_v_height,
+		link->msm_dp_link.test_video.test_rr_d,
+		link->msm_dp_link.test_video.test_rr_n);
+
+	return ret;
+}
+
+/**
+ * msm_dp_link_parse_link_training_params() - parses link training parameters from
+ * DPCD
+ * @link: Display Port Driver data
+ *
+ * Returns 0 if it successfully parses the link rate (Byte 0x219) and lane
+ * count (Byte 0x220), and if these values parse are valid.
+ */
+static int msm_dp_link_parse_link_training_params(struct msm_dp_link_private *link)
+{
+	u8 bp;
+	ssize_t rlen;
+
+	rlen = drm_dp_dpcd_readb(link->aux, DP_TEST_LINK_RATE,	&bp);
+	if (rlen < 0) {
+		DRM_ERROR("failed to read link rate. rlen=%zd\n", rlen);
+		return rlen;
+	}
+
+	if (!is_link_rate_valid(bp)) {
+		DRM_ERROR("invalid link rate = 0x%x\n", bp);
+		return -EINVAL;
+	}
+
+	link->request.test_link_rate = bp;
+	drm_dbg_dp(link->drm_dev, "link rate = 0x%x\n",
+				link->request.test_link_rate);
+
+	rlen = drm_dp_dpcd_readb(link->aux, DP_TEST_LANE_COUNT, &bp);
+	if (rlen < 0) {
+		DRM_ERROR("failed to read lane count. rlen=%zd\n", rlen);
+		return rlen;
+	}
+	bp &= DP_MAX_LANE_COUNT_MASK;
+
+	if (!is_lane_count_valid(bp)) {
+		DRM_ERROR("invalid lane count = 0x%x\n", bp);
+		return -EINVAL;
+	}
+
+	link->request.test_lane_count = bp;
+	drm_dbg_dp(link->drm_dev, "lane count = 0x%x\n",
+				link->request.test_lane_count);
+	return 0;
+}
+
+/**
+ * msm_dp_link_parse_phy_test_params() - parses the phy link parameters
+ * @link: Display Port Driver data
+ *
+ * Parses the DPCD (Byte 0x248) for the DP PHY link pattern that is being
+ * requested.
+ */
+static int msm_dp_link_parse_phy_test_params(struct msm_dp_link_private *link)
+{
+	u8 data;
+	ssize_t rlen;
+
+	rlen = drm_dp_dpcd_readb(link->aux, DP_PHY_TEST_PATTERN,
+					&data);
+	if (rlen < 0) {
+		DRM_ERROR("failed to read phy link pattern. rlen=%zd\n", rlen);
+		return rlen;
+	}
+
+	link->msm_dp_link.phy_params.phy_test_pattern_sel = data & 0x07;
+
+	drm_dbg_dp(link->drm_dev, "phy_test_pattern_sel = 0x%x\n", data);
+
+	switch (data) {
+	case DP_PHY_TEST_PATTERN_SEL_MASK:
+	case DP_PHY_TEST_PATTERN_NONE:
+	case DP_PHY_TEST_PATTERN_D10_2:
+	case DP_PHY_TEST_PATTERN_ERROR_COUNT:
+	case DP_PHY_TEST_PATTERN_PRBS7:
+	case DP_PHY_TEST_PATTERN_80BIT_CUSTOM:
+	case DP_PHY_TEST_PATTERN_CP2520:
+		return 0;
+	default:
+		return -EINVAL;
+	}
+}
+
+/**
+ * msm_dp_link_is_video_audio_test_requested() - checks for audio/video link request
+ * @link: link requested by the sink
+ *
+ * Returns true if the requested link is a permitted audio/video link.
+ */
+static bool msm_dp_link_is_video_audio_test_requested(u32 link)
+{
+	u8 video_audio_test = (DP_TEST_LINK_VIDEO_PATTERN |
+				DP_TEST_LINK_AUDIO_PATTERN |
+				DP_TEST_LINK_AUDIO_DISABLED_VIDEO);
+
+	return ((link & video_audio_test) &&
+		!(link & ~video_audio_test));
+}
+
+/**
+ * msm_dp_link_parse_request() - parses link request parameters from sink
+ * @link: Display Port Driver data
+ *
+ * Parses the DPCD to check if an automated link is requested (Byte 0x201),
+ * and what type of link automation is being requested (Byte 0x218).
+ */
+static int msm_dp_link_parse_request(struct msm_dp_link_private *link)
+{
+	int ret = 0;
+	u8 data;
+	ssize_t rlen;
+
+	/**
+	 * Read the device service IRQ vector (Byte 0x201) to determine
+	 * whether an automated link has been requested by the sink.
+	 */
+	rlen = drm_dp_dpcd_readb(link->aux,
+				DP_DEVICE_SERVICE_IRQ_VECTOR, &data);
+	if (rlen < 0) {
+		DRM_ERROR("aux read failed. rlen=%zd\n", rlen);
+		return rlen;
+	}
+
+	drm_dbg_dp(link->drm_dev, "device service irq vector = 0x%x\n", data);
+
+	if (!(data & DP_AUTOMATED_TEST_REQUEST)) {
+		drm_dbg_dp(link->drm_dev, "no test requested\n");
+		return 0;
+	}
+
+	/**
+	 * Read the link request byte (Byte 0x218) to determine what type
+	 * of automated link has been requested by the sink.
+	 */
+	rlen = drm_dp_dpcd_readb(link->aux, DP_TEST_REQUEST, &data);
+	if (rlen < 0) {
+		DRM_ERROR("aux read failed. rlen=%zd\n", rlen);
+		return rlen;
+	}
+
+	if (!data || (data == DP_TEST_LINK_FAUX_PATTERN)) {
+		drm_dbg_dp(link->drm_dev, "link 0x%x not supported\n", data);
+		goto end;
+	}
+
+	drm_dbg_dp(link->drm_dev, "Test:(0x%x) requested\n", data);
+	link->request.test_requested = data;
+	if (link->request.test_requested == DP_TEST_LINK_PHY_TEST_PATTERN) {
+		ret = msm_dp_link_parse_phy_test_params(link);
+		if (ret)
+			goto end;
+		ret = msm_dp_link_parse_link_training_params(link);
+		if (ret)
+			goto end;
+	}
+
+	if (link->request.test_requested == DP_TEST_LINK_TRAINING) {
+		ret = msm_dp_link_parse_link_training_params(link);
+		if (ret)
+			goto end;
+	}
+
+	if (msm_dp_link_is_video_audio_test_requested(
+			link->request.test_requested)) {
+		ret = msm_dp_link_parse_video_pattern_params(link);
+		if (ret)
+			goto end;
+
+		ret = msm_dp_link_parse_audio_pattern_params(link);
+	}
+end:
+	/*
+	 * Send a DP_TEST_ACK if all link parameters are valid, otherwise send
+	 * a DP_TEST_NAK.
+	 */
+	if (ret) {
+		link->msm_dp_link.test_response = DP_TEST_NAK;
+	} else {
+		if (link->request.test_requested != DP_TEST_LINK_EDID_READ)
+			link->msm_dp_link.test_response = DP_TEST_ACK;
+		else
+			link->msm_dp_link.test_response =
+				DP_TEST_EDID_CHECKSUM_WRITE;
+	}
+
+	return ret;
+}
+
+static int msm_dp_link_parse_sink_status_field(struct msm_dp_link_private *link)
+{
+	int len;
+
+	link->prev_sink_count = link->msm_dp_link.sink_count;
+	len = drm_dp_read_sink_count(link->aux);
+	if (len < 0) {
+		DRM_ERROR("DP parse sink count failed\n");
+		return len;
+	}
+	link->msm_dp_link.sink_count = len;
+
+	len = drm_dp_dpcd_read_link_status(link->aux,
+		link->link_status);
+	if (len < DP_LINK_STATUS_SIZE) {
+		DRM_ERROR("DP link status read failed\n");
+		return len;
+	}
+
+	return msm_dp_link_parse_request(link);
+}
+
+/**
+ * msm_dp_link_process_link_training_request() - processes new training requests
+ * @link: Display Port link data
+ *
+ * This function will handle new link training requests that are initiated by
+ * the sink. In particular, it will update the requested lane count and link
+ * rate, and then trigger the link retraining procedure.
+ *
+ * The function will return 0 if a link training request has been processed,
+ * otherwise it will return -EINVAL.
+ */
+static int msm_dp_link_process_link_training_request(struct msm_dp_link_private *link)
+{
+	if (link->request.test_requested != DP_TEST_LINK_TRAINING)
+		return -EINVAL;
+
+	drm_dbg_dp(link->drm_dev,
+			"Test:0x%x link rate = 0x%x, lane count = 0x%x\n",
+			DP_TEST_LINK_TRAINING,
+			link->request.test_link_rate,
+			link->request.test_lane_count);
+
+	link->msm_dp_link.link_params.num_lanes = link->request.test_lane_count;
+	link->msm_dp_link.link_params.rate =
+		drm_dp_bw_code_to_link_rate(link->request.test_link_rate);
+
+	return 0;
+}
+
+bool msm_dp_link_send_test_response(struct msm_dp_link *msm_dp_link)
+{
+	struct msm_dp_link_private *link = NULL;
+	int ret = 0;
+
+	if (!msm_dp_link) {
+		DRM_ERROR("invalid input\n");
+		return false;
+	}
+
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
+
+	ret = drm_dp_dpcd_writeb(link->aux, DP_TEST_RESPONSE,
+			msm_dp_link->test_response);
+
+	return ret == 1;
+}
+
+int msm_dp_link_psm_config(struct msm_dp_link *msm_dp_link,
+			      struct msm_dp_link_info *link_info, bool enable)
+{
+	struct msm_dp_link_private *link = NULL;
+	int ret = 0;
+
+	if (!msm_dp_link) {
+		DRM_ERROR("invalid params\n");
+		return -EINVAL;
+	}
+
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
+
+	mutex_lock(&link->psm_mutex);
+	if (enable)
+		ret = msm_dp_aux_link_power_down(link->aux, link_info);
+	else
+		ret = msm_dp_aux_link_power_up(link->aux, link_info);
+
+	if (ret)
+		DRM_ERROR("Failed to %s low power mode\n", enable ?
+							"enter" : "exit");
+
+	mutex_unlock(&link->psm_mutex);
+	return ret;
+}
+
+bool msm_dp_link_send_edid_checksum(struct msm_dp_link *msm_dp_link, u8 checksum)
+{
+	struct msm_dp_link_private *link = NULL;
+	int ret = 0;
+
+	if (!msm_dp_link) {
+		DRM_ERROR("invalid input\n");
+		return false;
+	}
+
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
+
+	ret = drm_dp_dpcd_writeb(link->aux, DP_TEST_EDID_CHECKSUM,
+						checksum);
+	return ret == 1;
+}
+
+static void msm_dp_link_parse_vx_px(struct msm_dp_link_private *link)
+{
+	drm_dbg_dp(link->drm_dev, "vx: 0=%d, 1=%d, 2=%d, 3=%d\n",
+		drm_dp_get_adjust_request_voltage(link->link_status, 0),
+		drm_dp_get_adjust_request_voltage(link->link_status, 1),
+		drm_dp_get_adjust_request_voltage(link->link_status, 2),
+		drm_dp_get_adjust_request_voltage(link->link_status, 3));
+
+	drm_dbg_dp(link->drm_dev, "px: 0=%d, 1=%d, 2=%d, 3=%d\n",
+		drm_dp_get_adjust_request_pre_emphasis(link->link_status, 0),
+		drm_dp_get_adjust_request_pre_emphasis(link->link_status, 1),
+		drm_dp_get_adjust_request_pre_emphasis(link->link_status, 2),
+		drm_dp_get_adjust_request_pre_emphasis(link->link_status, 3));
+
+	/**
+	 * Update the voltage and pre-emphasis levels as per DPCD request
+	 * vector.
+	 */
+	drm_dbg_dp(link->drm_dev,
+			 "Current: v_level = 0x%x, p_level = 0x%x\n",
+			link->msm_dp_link.phy_params.v_level,
+			link->msm_dp_link.phy_params.p_level);
+	link->msm_dp_link.phy_params.v_level =
+		drm_dp_get_adjust_request_voltage(link->link_status, 0);
+	link->msm_dp_link.phy_params.p_level =
+		drm_dp_get_adjust_request_pre_emphasis(link->link_status, 0);
+
+	link->msm_dp_link.phy_params.p_level >>= DP_TRAIN_PRE_EMPHASIS_SHIFT;
+
+	drm_dbg_dp(link->drm_dev,
+			"Requested: v_level = 0x%x, p_level = 0x%x\n",
+			link->msm_dp_link.phy_params.v_level,
+			link->msm_dp_link.phy_params.p_level);
+}
+
+/**
+ * msm_dp_link_process_phy_test_pattern_request() - process new phy link requests
+ * @link: Display Port Driver data
+ *
+ * This function will handle new phy link pattern requests that are initiated
+ * by the sink. The function will return 0 if a phy link pattern has been
+ * processed, otherwise it will return -EINVAL.
+ */
+static int msm_dp_link_process_phy_test_pattern_request(
+		struct msm_dp_link_private *link)
+{
+	if (!(link->request.test_requested & DP_TEST_LINK_PHY_TEST_PATTERN)) {
+		drm_dbg_dp(link->drm_dev, "no phy test\n");
+		return -EINVAL;
+	}
+
+	if (!is_link_rate_valid(link->request.test_link_rate) ||
+		!is_lane_count_valid(link->request.test_lane_count)) {
+		DRM_ERROR("Invalid: link rate = 0x%x,lane count = 0x%x\n",
+				link->request.test_link_rate,
+				link->request.test_lane_count);
+		return -EINVAL;
+	}
+
+	drm_dbg_dp(link->drm_dev,
+			"Current: rate = 0x%x, lane count = 0x%x\n",
+			link->msm_dp_link.link_params.rate,
+			link->msm_dp_link.link_params.num_lanes);
+
+	drm_dbg_dp(link->drm_dev,
+			"Requested: rate = 0x%x, lane count = 0x%x\n",
+			link->request.test_link_rate,
+			link->request.test_lane_count);
+
+	link->msm_dp_link.link_params.num_lanes = link->request.test_lane_count;
+	link->msm_dp_link.link_params.rate =
+		drm_dp_bw_code_to_link_rate(link->request.test_link_rate);
+
+	msm_dp_link_parse_vx_px(link);
+
+	return 0;
+}
+
+static bool msm_dp_link_read_psr_error_status(struct msm_dp_link_private *link)
+{
+	u8 status;
+
+	drm_dp_dpcd_read(link->aux, DP_PSR_ERROR_STATUS, &status, 1);
+
+	if (status & DP_PSR_LINK_CRC_ERROR)
+		DRM_ERROR("PSR LINK CRC ERROR\n");
+	else if (status & DP_PSR_RFB_STORAGE_ERROR)
+		DRM_ERROR("PSR RFB STORAGE ERROR\n");
+	else if (status & DP_PSR_VSC_SDP_UNCORRECTABLE_ERROR)
+		DRM_ERROR("PSR VSC SDP UNCORRECTABLE ERROR\n");
+	else
+		return false;
+
+	return true;
+}
+
+static bool msm_dp_link_psr_capability_changed(struct msm_dp_link_private *link)
+{
+	u8 status;
+
+	drm_dp_dpcd_read(link->aux, DP_PSR_ESI, &status, 1);
+
+	if (status & DP_PSR_CAPS_CHANGE) {
+		drm_dbg_dp(link->drm_dev, "PSR Capability Change\n");
+		return true;
+	}
+
+	return false;
+}
+
+static u8 get_link_status(const u8 link_status[DP_LINK_STATUS_SIZE], int r)
+{
+	return link_status[r - DP_LANE0_1_STATUS];
+}
+
+/**
+ * msm_dp_link_process_link_status_update() - processes link status updates
+ * @link: Display Port link module data
+ *
+ * This function will check for changes in the link status, e.g. clock
+ * recovery done on all lanes, and trigger link training if there is a
+ * failure/error on the link.
+ *
+ * The function will return 0 if the a link status update has been processed,
+ * otherwise it will return -EINVAL.
+ */
+static int msm_dp_link_process_link_status_update(struct msm_dp_link_private *link)
+{
+	bool channel_eq_done = drm_dp_channel_eq_ok(link->link_status,
+			link->msm_dp_link.link_params.num_lanes);
+
+	bool clock_recovery_done = drm_dp_clock_recovery_ok(link->link_status,
+			link->msm_dp_link.link_params.num_lanes);
+
+	drm_dbg_dp(link->drm_dev,
+		       "channel_eq_done = %d, clock_recovery_done = %d\n",
+                        channel_eq_done, clock_recovery_done);
+
+	if (channel_eq_done && clock_recovery_done)
+		return -EINVAL;
+
+	return 0;
+}
+
+/**
+ * msm_dp_link_process_ds_port_status_change() - process port status changes
+ * @link: Display Port Driver data
+ *
+ * This function will handle downstream port updates that are initiated by
+ * the sink. If the downstream port status has changed, the EDID is read via
+ * AUX.
+ *
+ * The function will return 0 if a downstream port update has been
+ * processed, otherwise it will return -EINVAL.
+ */
+static int msm_dp_link_process_ds_port_status_change(struct msm_dp_link_private *link)
+{
+	if (get_link_status(link->link_status, DP_LANE_ALIGN_STATUS_UPDATED) &
+					DP_DOWNSTREAM_PORT_STATUS_CHANGED)
+		goto reset;
+
+	if (link->prev_sink_count == link->msm_dp_link.sink_count)
+		return -EINVAL;
+
+reset:
+	/* reset prev_sink_count */
+	link->prev_sink_count = link->msm_dp_link.sink_count;
+
+	return 0;
+}
+
+static bool msm_dp_link_is_video_pattern_requested(struct msm_dp_link_private *link)
+{
+	return (link->request.test_requested & DP_TEST_LINK_VIDEO_PATTERN)
+		&& !(link->request.test_requested &
+		DP_TEST_LINK_AUDIO_DISABLED_VIDEO);
+}
+
+static bool msm_dp_link_is_audio_pattern_requested(struct msm_dp_link_private *link)
+{
+	return (link->request.test_requested & DP_TEST_LINK_AUDIO_PATTERN);
+}
+
+static void msm_dp_link_reset_data(struct msm_dp_link_private *link)
+{
+	link->request = (const struct msm_dp_link_request){ 0 };
+	link->msm_dp_link.test_video = (const struct msm_dp_link_test_video){ 0 };
+	link->msm_dp_link.test_video.test_bit_depth = DP_TEST_BIT_DEPTH_UNKNOWN;
+	link->msm_dp_link.test_audio = (const struct msm_dp_link_test_audio){ 0 };
+	link->msm_dp_link.phy_params.phy_test_pattern_sel = 0;
+	link->msm_dp_link.sink_request = 0;
+	link->msm_dp_link.test_response = 0;
+}
+
+/**
+ * msm_dp_link_process_request() - handle HPD IRQ transition to HIGH
+ * @msm_dp_link: pointer to link module data
+ *
+ * This function will handle the HPD IRQ state transitions from LOW to HIGH
+ * (including cases when there are back to back HPD IRQ HIGH) indicating
+ * the start of a new link training request or sink status update.
+ */
+int msm_dp_link_process_request(struct msm_dp_link *msm_dp_link)
+{
+	int ret = 0;
+	struct msm_dp_link_private *link;
+
+	if (!msm_dp_link) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
+
+	msm_dp_link_reset_data(link);
+
+	ret = msm_dp_link_parse_sink_status_field(link);
+	if (ret)
+		return ret;
+
+	if (link->request.test_requested == DP_TEST_LINK_EDID_READ) {
+		msm_dp_link->sink_request |= DP_TEST_LINK_EDID_READ;
+	} else if (!msm_dp_link_process_ds_port_status_change(link)) {
+		msm_dp_link->sink_request |= DS_PORT_STATUS_CHANGED;
+	} else if (!msm_dp_link_process_link_training_request(link)) {
+		msm_dp_link->sink_request |= DP_TEST_LINK_TRAINING;
+	} else if (!msm_dp_link_process_phy_test_pattern_request(link)) {
+		msm_dp_link->sink_request |= DP_TEST_LINK_PHY_TEST_PATTERN;
+	} else if (msm_dp_link_read_psr_error_status(link)) {
+		DRM_ERROR("PSR IRQ_HPD received\n");
+	} else if (msm_dp_link_psr_capability_changed(link)) {
+		drm_dbg_dp(link->drm_dev, "PSR Capability changed\n");
+	} else {
+		ret = msm_dp_link_process_link_status_update(link);
+		if (!ret) {
+			msm_dp_link->sink_request |= DP_LINK_STATUS_UPDATED;
+		} else {
+			if (msm_dp_link_is_video_pattern_requested(link)) {
+				ret = 0;
+				msm_dp_link->sink_request |= DP_TEST_LINK_VIDEO_PATTERN;
+			}
+			if (msm_dp_link_is_audio_pattern_requested(link)) {
+				msm_dp_link->sink_request |= DP_TEST_LINK_AUDIO_PATTERN;
+				ret = -EINVAL;
+			}
+		}
+	}
+
+	drm_dbg_dp(link->drm_dev, "sink request=%#x\n",
+				msm_dp_link->sink_request);
+	return ret;
+}
+
+int msm_dp_link_get_colorimetry_config(struct msm_dp_link *msm_dp_link)
+{
+	u32 cc = DP_MISC0_COLORIMERY_CFG_LEGACY_RGB;
+	struct msm_dp_link_private *link;
+
+	if (!msm_dp_link) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
+
+	/*
+	 * Unless a video pattern CTS test is ongoing, use RGB_VESA
+	 * Only RGB_VESA and RGB_CEA supported for now
+	 */
+	if (msm_dp_link_is_video_pattern_requested(link)) {
+		if (link->msm_dp_link.test_video.test_dyn_range &
+					DP_TEST_DYNAMIC_RANGE_CEA)
+			cc = DP_MISC0_COLORIMERY_CFG_CEA_RGB;
+	}
+
+	return cc;
+}
+
+int msm_dp_link_adjust_levels(struct msm_dp_link *msm_dp_link, u8 *link_status)
+{
+	int i;
+	u8 max_p_level;
+	int v_max = 0, p_max = 0;
+	struct msm_dp_link_private *link;
+
+	if (!msm_dp_link) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
+
+	/* use the max level across lanes */
+	for (i = 0; i < msm_dp_link->link_params.num_lanes; i++) {
+		u8 data_v = drm_dp_get_adjust_request_voltage(link_status, i);
+		u8 data_p = drm_dp_get_adjust_request_pre_emphasis(link_status,
+									 i);
+		drm_dbg_dp(link->drm_dev,
+				"lane=%d req_vol_swing=%d req_pre_emphasis=%d\n",
+				i, data_v, data_p);
+		if (v_max < data_v)
+			v_max = data_v;
+		if (p_max < data_p)
+			p_max = data_p;
+	}
+
+	msm_dp_link->phy_params.v_level = v_max >> DP_TRAIN_VOLTAGE_SWING_SHIFT;
+	msm_dp_link->phy_params.p_level = p_max >> DP_TRAIN_PRE_EMPHASIS_SHIFT;
+
+	/**
+	 * Adjust the voltage swing and pre-emphasis level combination to within
+	 * the allowable range.
+	 */
+	if (msm_dp_link->phy_params.v_level > DP_TRAIN_LEVEL_MAX) {
+		drm_dbg_dp(link->drm_dev,
+			"Requested vSwingLevel=%d, change to %d\n",
+			msm_dp_link->phy_params.v_level,
+			DP_TRAIN_LEVEL_MAX);
+		msm_dp_link->phy_params.v_level = DP_TRAIN_LEVEL_MAX;
+	}
+
+	if (msm_dp_link->phy_params.p_level > DP_TRAIN_LEVEL_MAX) {
+		drm_dbg_dp(link->drm_dev,
+			"Requested preEmphasisLevel=%d, change to %d\n",
+			msm_dp_link->phy_params.p_level,
+			DP_TRAIN_LEVEL_MAX);
+		msm_dp_link->phy_params.p_level = DP_TRAIN_LEVEL_MAX;
+	}
+
+	max_p_level = DP_TRAIN_LEVEL_MAX - msm_dp_link->phy_params.v_level;
+	if (msm_dp_link->phy_params.p_level > max_p_level) {
+		drm_dbg_dp(link->drm_dev,
+			"Requested preEmphasisLevel=%d, change to %d\n",
+			msm_dp_link->phy_params.p_level,
+			max_p_level);
+		msm_dp_link->phy_params.p_level = max_p_level;
+	}
+
+	drm_dbg_dp(link->drm_dev, "adjusted: v_level=%d, p_level=%d\n",
+		msm_dp_link->phy_params.v_level, msm_dp_link->phy_params.p_level);
+
+	return 0;
+}
+
+void msm_dp_link_reset_phy_params_vx_px(struct msm_dp_link *msm_dp_link)
+{
+	msm_dp_link->phy_params.v_level = 0;
+	msm_dp_link->phy_params.p_level = 0;
+}
+
+u32 msm_dp_link_get_test_bits_depth(struct msm_dp_link *msm_dp_link, u32 bpp)
+{
+	u32 tbd;
+	struct msm_dp_link_private *link;
+
+	link = container_of(msm_dp_link, struct msm_dp_link_private, msm_dp_link);
+
+	/*
+	 * Few simplistic rules and assumptions made here:
+	 *    1. Test bit depth is bit depth per color component
+	 *    2. Assume 3 color components
+	 */
+	switch (bpp) {
+	case 18:
+		tbd = DP_TEST_BIT_DEPTH_6;
+		break;
+	case 24:
+		tbd = DP_TEST_BIT_DEPTH_8;
+		break;
+	case 30:
+		tbd = DP_TEST_BIT_DEPTH_10;
+		break;
+	default:
+		drm_dbg_dp(link->drm_dev, "bpp=%d not supported, use bpc=8\n",
+			   bpp);
+		tbd = DP_TEST_BIT_DEPTH_8;
+		break;
+	}
+
+	tbd = (tbd >> DP_TEST_BIT_DEPTH_SHIFT);
+
+	return tbd;
+}
+
+struct msm_dp_link *msm_dp_link_get(struct device *dev, struct drm_dp_aux *aux)
+{
+	struct msm_dp_link_private *link;
+	struct msm_dp_link *msm_dp_link;
+
+	if (!dev || !aux) {
+		DRM_ERROR("invalid input\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	link = devm_kzalloc(dev, sizeof(*link), GFP_KERNEL);
+	if (!link)
+		return ERR_PTR(-ENOMEM);
+
+	link->aux   = aux;
+
+	mutex_init(&link->psm_mutex);
+	msm_dp_link = &link->msm_dp_link;
+
+	return msm_dp_link;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_link.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_link.h
@@ -0,0 +1,120 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_LINK_H_
+#define _DP_LINK_H_
+
+#include "dp_aux.h"
+
+#define DS_PORT_STATUS_CHANGED 0x200
+#define DP_TEST_BIT_DEPTH_UNKNOWN 0xFFFFFFFF
+#define DP_LINK_CAP_ENHANCED_FRAMING (1 << 0)
+
+struct msm_dp_link_info {
+	unsigned char revision;
+	unsigned int rate;
+	unsigned int num_lanes;
+	unsigned long capabilities;
+};
+
+#define DP_TRAIN_LEVEL_MAX	3
+
+struct msm_dp_link_test_video {
+	u32 test_video_pattern;
+	u32 test_bit_depth;
+	u32 test_dyn_range;
+	u32 test_h_total;
+	u32 test_v_total;
+	u32 test_h_start;
+	u32 test_v_start;
+	u32 test_hsync_pol;
+	u32 test_hsync_width;
+	u32 test_vsync_pol;
+	u32 test_vsync_width;
+	u32 test_h_width;
+	u32 test_v_height;
+	u32 test_rr_d;
+	u32 test_rr_n;
+};
+
+struct msm_dp_link_test_audio {
+	u32 test_audio_sampling_rate;
+	u32 test_audio_channel_count;
+	u32 test_audio_pattern_type;
+	u32 test_audio_period_ch_1;
+	u32 test_audio_period_ch_2;
+	u32 test_audio_period_ch_3;
+	u32 test_audio_period_ch_4;
+	u32 test_audio_period_ch_5;
+	u32 test_audio_period_ch_6;
+	u32 test_audio_period_ch_7;
+	u32 test_audio_period_ch_8;
+};
+
+struct msm_dp_link_phy_params {
+	u32 phy_test_pattern_sel;
+	u8 v_level;
+	u8 p_level;
+};
+
+struct msm_dp_link {
+	u32 sink_request;
+	u32 test_response;
+
+	u8 sink_count;
+	struct msm_dp_link_test_video test_video;
+	struct msm_dp_link_test_audio test_audio;
+	struct msm_dp_link_phy_params phy_params;
+	struct msm_dp_link_info link_params;
+};
+
+/**
+ * mdss_dp_test_bit_depth_to_bpp() - convert test bit depth to bpp
+ * @tbd: test bit depth
+ *
+ * Returns the bits per pixel (bpp) to be used corresponding to the
+ * git bit depth value. This function assumes that bit depth has
+ * already been validated.
+ */
+static inline u32 msm_dp_link_bit_depth_to_bpp(u32 tbd)
+{
+	/*
+	 * Few simplistic rules and assumptions made here:
+	 *    1. Bit depth is per color component
+	 *    2. If bit depth is unknown return 0
+	 *    3. Assume 3 color components
+	 */
+	switch (tbd) {
+	case DP_TEST_BIT_DEPTH_6:
+		return 18;
+	case DP_TEST_BIT_DEPTH_8:
+		return 24;
+	case DP_TEST_BIT_DEPTH_10:
+		return 30;
+	case DP_TEST_BIT_DEPTH_UNKNOWN:
+	default:
+		return 0;
+	}
+}
+
+void msm_dp_link_reset_phy_params_vx_px(struct msm_dp_link *msm_dp_link);
+u32 msm_dp_link_get_test_bits_depth(struct msm_dp_link *msm_dp_link, u32 bpp);
+int msm_dp_link_process_request(struct msm_dp_link *msm_dp_link);
+int msm_dp_link_get_colorimetry_config(struct msm_dp_link *msm_dp_link);
+int msm_dp_link_adjust_levels(struct msm_dp_link *msm_dp_link, u8 *link_status);
+bool msm_dp_link_send_test_response(struct msm_dp_link *msm_dp_link);
+int msm_dp_link_psm_config(struct msm_dp_link *msm_dp_link,
+		struct msm_dp_link_info *link_info, bool enable);
+bool msm_dp_link_send_edid_checksum(struct msm_dp_link *msm_dp_link, u8 checksum);
+
+/**
+ * msm_dp_link_get() - get the functionalities of dp test module
+ *
+ *
+ * return: a pointer to msm_dp_link struct
+ */
+struct msm_dp_link *msm_dp_link_get(struct device *dev, struct drm_dp_aux *aux);
+
+#endif /* _DP_LINK_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_mst_drm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_mst_drm.c
@@ -0,0 +1,1097 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <drm/drm_edid.h>
+#include "dp_mst_drm.h"
+
+static struct drm_private_state *msm_dp_mst_duplicate_bridge_state(struct drm_private_obj *obj)
+{
+	struct msm_dp_mst_bridge_state *state;
+
+	state = kmemdup(obj->state, sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return NULL;
+
+	__drm_atomic_helper_private_obj_duplicate_state(obj, &state->base);
+
+	return &state->base;
+}
+
+static void msm_dp_mst_destroy_bridge_state(struct drm_private_obj *obj,
+					    struct drm_private_state *state)
+{
+	struct msm_dp_mst_bridge_state *priv_state =
+		to_msm_dp_mst_bridge_priv_state(state);
+
+	kfree(priv_state);
+}
+
+static const struct drm_private_state_funcs msm_dp_mst_bridge_state_funcs = {
+	.atomic_duplicate_state = msm_dp_mst_duplicate_bridge_state,
+	.atomic_destroy_state = msm_dp_mst_destroy_bridge_state,
+};
+
+/**
+ * dp_mst_find_vcpi_slots() - Find VCPI slots for this PBN value
+ * @mgr: manager to use
+ * @pbn: payload bandwidth to convert into slots.
+ *
+ * Calculate the number of VCPI slots that will be required for the given PBN
+ * value.
+ *
+ * RETURNS:
+ * The total slots required for this port, or error.
+ */
+static int msm_dp_mst_find_vcpi_slots(struct drm_dp_mst_topology_mgr *mgr, int pbn)
+{
+	int num_slots;
+	struct drm_dp_mst_topology_state *state;
+
+	state = to_drm_dp_mst_topology_state(mgr->base.state);
+	num_slots = DIV_ROUND_UP(pbn, state->pbn_div.full);
+
+	/* max. time slots - one slot for MTP header */
+	if (num_slots > 63)
+		return -ENOSPC;
+	return num_slots;
+}
+
+static int msm_dp_mst_calc_pbn_mode(struct drm_display_mode *mode, u32 bpp)
+{
+	int pbn;
+
+	// note : we can even drop dp_mst_calc_pbn_mode and just use this
+	// directly
+	pbn = drm_dp_calc_pbn_mode(mode->clock, bpp << 4);
+
+	return pbn;
+}
+
+static int msm_dp_mst_get_mst_pbn_div(struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_link_info *link_info;
+
+	link_info = &msm_dp_panel->link_info;
+
+	return link_info->rate * link_info->num_lanes / 54000;
+}
+
+static int _msm_dp_mst_compute_config(struct drm_atomic_state *state,
+				      struct msm_dp_mst *mst, struct drm_connector *connector,
+				      struct drm_display_mode *mode)
+{
+	int slots = 0, pbn;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	int rc = 0;
+	struct drm_dp_mst_topology_state *mst_state;
+
+	struct msm_dp *dp_display = mst->msm_dp;
+	u32 bpp;
+
+	bpp = connector->display_info.bpc * 3;
+	//default to 24
+	if (!bpp)
+		bpp = 24;
+
+	pbn = msm_dp_mst_calc_pbn_mode(mode, bpp);
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+
+	if (!mst_state->pbn_div.full)
+		mst_state->pbn_div.full = msm_dp_mst_get_mst_pbn_div(mst_conn->dp_panel);
+
+	rc = drm_dp_atomic_find_time_slots(state, &mst->mst_mgr, mst_conn->mst_port, pbn);
+	if (rc < 0) {
+		DRM_ERROR("conn:%d failed to find vcpi slots. pbn:%d, rc:%d\n",
+			  connector->base.id, pbn, rc);
+		goto end;
+	}
+
+	slots = rc;
+
+	rc = drm_dp_mst_atomic_check(state);
+	if (rc) {
+		DRM_ERROR("conn:%d mst atomic check failed: rc=%d\n", connector->base.id, rc);
+		slots = 0;
+		goto end;
+	}
+
+	drm_dbg_dp(dp_display->drm_dev, "conn:%d pbn:%d slots:%d rc:%d\n",
+		   connector->base.id, pbn, slots, rc);
+
+end:
+	return (rc < 0 ? rc : slots);
+}
+
+static void _msm_dp_mst_update_timeslots(struct msm_dp_mst *mst,
+					 struct msm_dp_mst_bridge *mst_bridge,
+					 struct drm_dp_mst_port *port)
+{
+	int i;
+	struct msm_dp_mst_bridge *msm_dp_bridge;
+	struct drm_dp_mst_topology_state *mst_state;
+	struct drm_dp_mst_atomic_payload *payload;
+	int prev_start = 0;
+	int prev_slots = 0;
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+	payload = drm_atomic_get_mst_payload_state(mst_state, port);
+
+	if (!payload) {
+		DRM_ERROR("mst bridge [%d] update_timeslots failed, null payload\n",
+			  mst_bridge->id);
+		return;
+	}
+
+	for (i = 0; i < mst->max_streams; i++) {
+		msm_dp_bridge = &mst->mst_bridge[i];
+		if (mst_bridge == msm_dp_bridge) {
+			/*
+			 * When a payload was removed make sure to move any payloads after it
+			 * to the left so all payloads are aligned to the left.
+			 */
+			if (payload->vc_start_slot < 0) {
+				// cache the payload
+				prev_start = msm_dp_bridge->start_slot;
+				prev_slots = msm_dp_bridge->num_slots;
+				msm_dp_bridge->pbn = 0;
+				msm_dp_bridge->start_slot = 1;
+				msm_dp_bridge->num_slots = 0;
+				msm_dp_bridge->vcpi = 0;
+			} else { //add payload
+				msm_dp_bridge->pbn = payload->pbn;
+				msm_dp_bridge->start_slot = payload->vc_start_slot;
+				msm_dp_bridge->num_slots = payload->time_slots;
+				msm_dp_bridge->vcpi = payload->vcpi;
+			}
+		}
+	}
+
+	// Now commit all the updated payloads
+	for (i = 0; i < mst->max_streams; i++) {
+		msm_dp_bridge = &mst->mst_bridge[i];
+
+		//Shift payloads to the left if there was a removed payload.
+		if (payload->vc_start_slot < 0 && msm_dp_bridge->start_slot > prev_start)
+			msm_dp_bridge->start_slot -= prev_slots;
+
+		msm_dp_display_set_stream_info(mst->msm_dp, msm_dp_bridge->msm_dp_panel,
+					       msm_dp_bridge->id, msm_dp_bridge->start_slot,
+					       msm_dp_bridge->num_slots,
+					       msm_dp_bridge->pbn, msm_dp_bridge->vcpi);
+		drm_dbg_dp(mst->msm_dp->drm_dev,
+			   "conn:%d vcpi:%d start_slot:%d num_slots:%d, pbn:%d\n",
+			   DP_MST_CONN_ID(msm_dp_bridge), msm_dp_bridge->vcpi,
+			   msm_dp_bridge->start_slot,
+			   msm_dp_bridge->num_slots, msm_dp_bridge->pbn);
+	}
+}
+
+static int _msm_dp_mst_bridge_pre_enable_part1(struct msm_dp_mst_bridge *dp_bridge)
+{
+	struct msm_dp *msm_dp = dp_bridge->display;
+	struct msm_dp_mst *mst = msm_dp->msm_dp_mst;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(dp_bridge->connector);
+	struct drm_dp_mst_port *port = mst_conn->mst_port;
+	struct drm_dp_mst_topology_state *mst_state;
+	struct drm_dp_mst_atomic_payload *payload;
+	struct msm_dp_panel *dp_panel = mst_conn->dp_panel;
+	int pbn, slots;
+	int rc = 0;
+
+	pbn = msm_dp_mst_calc_pbn_mode(&dp_panel->msm_dp_mode.drm_mode,
+				       msm_dp->connector->display_info.bpc * 3);
+
+	slots = msm_dp_mst_find_vcpi_slots(&mst->mst_mgr, pbn);
+
+	drm_dbg_dp(msm_dp->drm_dev, "conn:%d pbn:%d, slots:%d\n", DP_MST_CONN_ID(dp_bridge),
+		   pbn, slots);
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+	payload = drm_atomic_get_mst_payload_state(mst_state, port);
+	if (!payload || payload->time_slots <= 0) {
+		DRM_ERROR("time slots not allocated for conn:%d\n", DP_MST_CONN_ID(dp_bridge));
+		rc = -EINVAL;
+		return rc;
+	}
+
+	drm_dp_mst_update_slots(mst_state, DP_CAP_ANSI_8B10B);
+
+	rc = drm_dp_add_payload_part1(&mst->mst_mgr, mst_state, payload);
+	if (rc) {
+		DRM_ERROR("payload allocation failure for conn:%d\n", DP_MST_CONN_ID(dp_bridge));
+		return rc;
+	}
+
+	_msm_dp_mst_update_timeslots(mst, dp_bridge, port);
+
+	return rc;
+}
+
+static void _msm_dp_mst_bridge_pre_enable_part2(struct msm_dp_mst_bridge *dp_bridge)
+{
+	struct msm_dp *msm_dp = dp_bridge->display;
+	struct msm_dp_mst *mst = msm_dp->msm_dp_mst;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(dp_bridge->connector);
+	struct drm_dp_mst_port *port = mst_conn->mst_port;
+	struct drm_dp_mst_topology_state *mst_state;
+	struct drm_dp_mst_atomic_payload *payload;
+
+	drm_dp_check_act_status(&mst->mst_mgr);
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+	payload = drm_atomic_get_mst_payload_state(mst_state, port);
+
+	if (!payload) {
+		DRM_ERROR("mst bridge [%d] null payload\n", dp_bridge->id);
+		return;
+	}
+
+	if (!payload->port) {
+		DRM_ERROR("mst bridge [%d] null port\n", dp_bridge->id);
+		return;
+	}
+
+	if (!payload->port->connector) {
+		DRM_ERROR("mst bridge [%d] part-2 failed, null connector\n",
+			  dp_bridge->id);
+		return;
+	}
+
+	if (payload->vc_start_slot == -1) {
+		DRM_ERROR("mst bridge [%d] part-2 failed, payload alloc part 1 failed\n",
+			  dp_bridge->id);
+		return;
+	}
+
+	drm_dp_add_payload_part2(&mst->mst_mgr, payload);
+	drm_dbg_dp(msm_dp->drm_dev, "mst bridge [%d] _pre enable part-2 complete\n",
+		   dp_bridge->id);
+}
+
+static void _msm_dp_mst_bridge_pre_disable_part1(struct msm_dp_mst_bridge *dp_bridge)
+{
+	struct msm_dp *msm_dp = dp_bridge->display;
+	struct msm_dp_mst *mst = msm_dp->msm_dp_mst;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(dp_bridge->connector);
+	struct drm_dp_mst_port *port = mst_conn->mst_port;
+	struct drm_dp_mst_topology_state *mst_state;
+	struct drm_dp_mst_atomic_payload *payload;
+
+	mst_state = to_drm_dp_mst_topology_state(mst->mst_mgr.base.state);
+	payload = drm_atomic_get_mst_payload_state(mst_state, port);
+
+	if (!payload) {
+		DRM_ERROR("mst bridge [%d] _pre disable part-1 failed, null payload\n",
+			  dp_bridge->id);
+		return;
+	}
+
+	drm_dp_remove_payload_part1(&mst->mst_mgr, mst_state, payload);
+	_msm_dp_mst_update_timeslots(mst, dp_bridge, port);
+
+	drm_dbg_dp(msm_dp->drm_dev, "mst bridge [%d] _pre disable part-1 complete\n",
+		   dp_bridge->id);
+}
+
+static void _msm_dp_mst_bridge_pre_disable_part2(struct msm_dp_mst_bridge *dp_bridge)
+{
+	struct msm_dp *msm_dp = dp_bridge->display;
+	struct msm_dp_mst *mst = msm_dp->msm_dp_mst;
+
+	drm_dp_check_act_status(&mst->mst_mgr);
+
+	drm_dbg_dp(msm_dp->drm_dev, "mst bridge [%d] _pre disable part-2 complete\n",
+		   dp_bridge->id);
+}
+
+static void msm_dp_mst_bridge_atomic_pre_enable(struct drm_bridge *drm_bridge,
+						struct drm_bridge_state *old_bridge_state)
+{
+	int rc = 0;
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp *dp;
+	struct msm_dp_mst_bridge_state *msm_dp_bridge_state;
+	struct msm_dp_mst *dp_mst;
+
+	if (!drm_bridge) {
+		DRM_ERROR("Invalid params\n");
+		return;
+	}
+
+	bridge = to_msm_dp_mst_bridge(drm_bridge);
+	msm_dp_bridge_state = to_msm_dp_mst_bridge_state(bridge);
+	dp = bridge->display;
+	dp_mst = dp->msm_dp_mst;
+
+	/* to cover cases of bridge_disable/bridge_enable without modeset */
+	bridge->connector = msm_dp_bridge_state->connector;
+	bridge->msm_dp_panel = msm_dp_bridge_state->msm_dp_panel;
+
+	if (!bridge->connector) {
+		DRM_ERROR("Invalid connector\n");
+		return;
+	}
+
+	mutex_lock(&dp_mst->mst_lock);
+	msm_dp_display_atomic_prepare(dp);
+
+	rc = _msm_dp_mst_bridge_pre_enable_part1(bridge);
+	if (rc) {
+		DRM_ERROR("[%d] DP display pre-enable failed, rc=%d\n", bridge->id, rc);
+		msm_dp_display_unprepare(dp);
+		mutex_unlock(&dp_mst->mst_lock);
+		return;
+	}
+
+	msm_dp_display_enable_helper(dp, bridge->msm_dp_panel);
+
+	_msm_dp_mst_bridge_pre_enable_part2(bridge);
+
+	drm_dbg_dp(dp->drm_dev, "conn:%d mode:%s fps:%d vcpi:%d slots:%d to %d\n",
+		   DP_MST_CONN_ID(bridge), bridge->drm_mode.name,
+		   drm_mode_vrefresh(&bridge->drm_mode),
+		   bridge->vcpi, bridge->start_slot,
+		   bridge->start_slot + bridge->num_slots);
+
+	mutex_unlock(&dp_mst->mst_lock);
+}
+
+static void msm_dp_mst_bridge_atomic_disable(struct drm_bridge *drm_bridge,
+					     struct drm_bridge_state *old_bridge_state)
+{
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp *dp;
+	struct msm_dp_mst *mst;
+
+	if (!drm_bridge) {
+		DRM_ERROR("Invalid params\n");
+		return;
+	}
+
+	bridge = to_msm_dp_mst_bridge(drm_bridge);
+	if (!bridge->connector) {
+		DRM_ERROR("Invalid connector\n");
+		return;
+	}
+
+	dp = bridge->display;
+	mst = dp->msm_dp_mst;
+
+	mutex_lock(&mst->mst_lock);
+
+	_msm_dp_mst_bridge_pre_disable_part1(bridge);
+
+	msm_dp_display_disable_helper(dp, bridge->msm_dp_panel);
+
+	_msm_dp_mst_bridge_pre_disable_part2(bridge);
+
+	drm_dbg_dp(dp->drm_dev, "mst bridge:%d conn:%d disable complete\n", bridge->id,
+		   DP_MST_CONN_ID(bridge));
+
+	mutex_unlock(&mst->mst_lock);
+}
+
+static void msm_dp_mst_bridge_atomic_post_disable(struct drm_bridge *drm_bridge,
+						  struct drm_bridge_state *old_bridge_state)
+{
+	int conn = 0;
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp *dp;
+	struct msm_dp_mst *mst;
+
+	if (!drm_bridge) {
+		DRM_ERROR("Invalid params\n");
+		return;
+	}
+
+	bridge = to_msm_dp_mst_bridge(drm_bridge);
+	if (!bridge->connector) {
+		DRM_ERROR("Invalid connector\n");
+		return;
+	}
+
+	conn = DP_MST_CONN_ID(bridge);
+
+	dp = bridge->display;
+	mst = dp->msm_dp_mst;
+
+	mutex_lock(&mst->mst_lock);
+
+	msm_dp_display_atomic_post_disable_helper(dp, bridge->msm_dp_panel);
+
+	if (!dp->mst_active)
+		msm_dp_display_unprepare(dp);
+
+	bridge->connector = NULL;
+	bridge->msm_dp_panel =  NULL;
+
+	drm_dbg_dp(dp->drm_dev, "mst bridge:%d conn:%d post disable complete\n",
+		   bridge->id, conn);
+
+	mutex_unlock(&mst->mst_lock);
+}
+
+static void msm_dp_mst_bridge_mode_set(struct drm_bridge *drm_bridge,
+				       const struct drm_display_mode *mode,
+				       const struct drm_display_mode *adjusted_mode)
+{
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp_mst_bridge_state *dp_bridge_state;
+	struct msm_dp *dp;
+	struct msm_dp_panel *msm_dp_panel;
+
+	if (!drm_bridge || !mode || !adjusted_mode) {
+		DRM_ERROR("Invalid params\n");
+		return;
+	}
+
+	bridge = to_msm_dp_mst_bridge(drm_bridge);
+
+	dp_bridge_state = to_msm_dp_mst_bridge_state(bridge);
+	bridge->connector = dp_bridge_state->connector;
+	bridge->msm_dp_panel = dp_bridge_state->msm_dp_panel;
+
+	msm_dp_panel = bridge->msm_dp_panel;
+
+	dp = bridge->display;
+
+	memset(&bridge->msm_dp_mode, 0x0, sizeof(struct msm_dp_display_mode));
+	memcpy(&bridge->drm_mode, adjusted_mode, sizeof(bridge->drm_mode));
+
+	msm_dp_display_mode_set_helper(dp, mode, adjusted_mode, bridge->msm_dp_panel);
+	msm_dp_panel->mst_caps.pbn = msm_dp_mst_calc_pbn_mode(&msm_dp_panel->msm_dp_mode.drm_mode,
+							      msm_dp_panel->msm_dp_mode.bpp);
+	memcpy(&bridge->msm_dp_mode, &bridge->msm_dp_panel->msm_dp_mode,
+	       sizeof(struct msm_dp_display_mode));
+
+	drm_dbg_dp(dp->drm_dev, "mst bridge:%d conn:%d mode set complete %s\n", bridge->id,
+		   DP_MST_CONN_ID(bridge), mode->name);
+}
+
+/* DP MST Bridge APIs */
+static const struct drm_bridge_funcs msm_dp_mst_bridge_ops = {
+	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
+	.atomic_destroy_state   = drm_atomic_helper_bridge_destroy_state,
+	.atomic_reset           = drm_atomic_helper_bridge_reset,
+	.atomic_pre_enable   = msm_dp_mst_bridge_atomic_pre_enable,
+	.atomic_disable      = msm_dp_mst_bridge_atomic_disable,
+	.atomic_post_disable = msm_dp_mst_bridge_atomic_post_disable,
+	.mode_set     = msm_dp_mst_bridge_mode_set,
+};
+
+int msm_dp_mst_drm_bridge_init(struct msm_dp *dp, struct drm_encoder *encoder)
+{
+	int rc = 0;
+	struct msm_dp_mst_bridge *bridge = NULL;
+	struct msm_dp_mst_bridge_state *state;
+	struct drm_device *dev;
+	struct msm_dp_mst *mst = dp->msm_dp_mst;
+	int i;
+
+	for (i = 0; i < mst->max_streams; i++) {
+		if (!mst->mst_bridge[i].in_use) {
+			bridge = &mst->mst_bridge[i];
+			bridge->encoder = encoder;
+			bridge->in_use = true;
+			bridge->id = i;
+			break;
+		}
+	}
+
+	if (i == mst->max_streams) {
+		DRM_ERROR("mst supports only %d bridges\n", i);
+		rc = -EACCES;
+		goto end;
+	}
+
+	dev = dp->drm_dev;
+	bridge->display = dp;
+	bridge->base.funcs = &msm_dp_mst_bridge_ops;
+	bridge->base.encoder = encoder;
+	bridge->base.type = dp->connector_type;
+	bridge->base.ops = DRM_BRIDGE_OP_MODES;
+	drm_bridge_add(&bridge->base);
+
+	rc = drm_bridge_attach(encoder, &bridge->base, NULL, 0);
+	if (rc) {
+		DRM_ERROR("failed to attach bridge, rc=%d\n", rc);
+		goto end;
+	}
+
+	state = kzalloc(sizeof(*state), GFP_KERNEL);
+	if (!state) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	drm_atomic_private_obj_init(dev, &bridge->obj,
+				    &state->base,
+				    &msm_dp_mst_bridge_state_funcs);
+
+	drm_dbg_dp(dp->drm_dev, "mst drm bridge init. bridge id:%d\n", i);
+
+	return 0;
+
+end:
+	return rc;
+}
+
+static struct msm_dp_mst_bridge_state *msm_dp_mst_br_priv_state(struct drm_atomic_state *st,
+								struct msm_dp_mst_bridge *bridge)
+{
+	struct drm_device *dev = bridge->base.dev;
+
+	WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex));
+
+	return to_msm_dp_mst_bridge_priv_state(drm_atomic_get_private_obj_state(st,
+										&bridge->obj));
+}
+
+static void msm_dp_mst_clear_panel_edid(struct msm_dp *dp_display)
+{
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	struct msm_dp_mst_connector *mst_conn;
+	struct msm_dp_panel *dp_panel;
+	struct msm_dp_mst_bridge *dp_bridge;
+	int i;
+
+	if (!dp_display) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
+
+	for (i = 0; i < mst->max_streams; i++) {
+		dp_bridge = &mst->mst_bridge[i];
+		mst_conn = to_msm_dp_mst_connector(dp_bridge->connector);
+		dp_panel = dp_bridge->msm_dp_panel;
+
+		if (!dp_panel || !mst_conn || !mst_conn->mst_port)
+			continue;
+
+		if (dp_panel->drm_edid) {
+			drm_edid_free(dp_panel->drm_edid);
+			dp_panel->drm_edid = NULL;
+		}
+	}
+}
+
+/* DP MST HPD IRQ callback */
+void msm_dp_mst_display_hpd_irq(struct msm_dp *dp_display)
+{
+	int rc;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	u8 ack[8] = {};
+	u8 esi[14];
+	unsigned int esi_res = DP_SINK_COUNT_ESI + 1;
+	bool handled;
+
+	rc = drm_dp_dpcd_read(mst->dp_aux, DP_SINK_COUNT_ESI, esi, 14);
+	if (rc != 14) {
+		DRM_ERROR("dpcd sink status read failed, rlen=%d\n", rc);
+		return;
+	}
+
+	drm_dbg_dp(dp_display->drm_dev, "mst irq: esi1[0x%x] esi2[0x%x] esi3[0x%x]\n",
+		   esi[1], esi[2], esi[3]);
+
+	rc = drm_dp_mst_hpd_irq_handle_event(&mst->mst_mgr, esi, ack, &handled);
+
+	/* ack the request */
+	if (handled) {
+		rc = drm_dp_dpcd_writeb(mst->dp_aux, esi_res, ack[1]);
+
+		if (ack[1] & DP_UP_REQ_MSG_RDY)
+			msm_dp_mst_clear_panel_edid(dp_display);
+
+		if (rc != 1)
+			DRM_ERROR("dpcd esi_res failed. rc=%d\n", rc);
+
+		drm_dp_mst_hpd_irq_send_new_request(&mst->mst_mgr);
+	}
+	drm_dbg_dp(dp_display->drm_dev, "mst display hpd_irq handled:%d rc:%d\n", handled, rc);
+}
+
+/* DP MST Connector OPs */
+static int
+msm_dp_mst_connector_detect(struct drm_connector *connector,
+			    struct drm_modeset_acquire_ctx *ctx,
+			    bool force)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	enum drm_connector_status status = connector_status_disconnected;
+
+	if (dp_display->link_ready && dp_display->mst_active)
+		status = drm_dp_mst_detect_port(connector,
+						ctx, &mst->mst_mgr, mst_conn->mst_port);
+
+	drm_dbg_dp(dp_display->drm_dev, "conn:%d status:%d\n", connector->base.id, status);
+
+	return (int)status;
+}
+
+static int msm_dp_mst_connector_get_modes(struct drm_connector *connector)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	struct msm_dp_panel *dp_panel = mst_conn->dp_panel;
+
+	if (dp_panel->drm_edid)
+		goto duplicate_edid;
+
+	drm_edid_free(dp_panel->drm_edid);
+
+	dp_panel->drm_edid = drm_dp_mst_edid_read(connector, &mst->mst_mgr, mst_conn->mst_port);
+	if (!dp_panel->drm_edid) {
+		DRM_ERROR("get edid failed. id: %d\n", connector->base.id);
+		return -EINVAL;
+	}
+
+duplicate_edid:
+	drm_edid_connector_update(connector, dp_panel->drm_edid);
+
+	return drm_edid_connector_add_modes(connector);
+}
+
+static enum drm_mode_status msm_dp_mst_connector_mode_valid(struct drm_connector *connector,
+							    struct drm_display_mode *mode)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct drm_dp_mst_port *mst_port;
+	struct msm_dp_panel *dp_panel;
+	struct msm_dp_mst *mst;
+	u16 full_pbn, required_pbn;
+	int available_slots, required_slots;
+	struct msm_dp_mst_bridge_state *dp_bridge_state;
+	int i, slots_in_use = 0, active_enc_cnt = 0;
+	const u32 tot_slots = 63;
+
+	if (!connector || !mode || !dp_display) {
+		DRM_ERROR("invalid input\n");
+		return 0;
+	}
+
+	mst = dp_display->msm_dp_mst;
+	mst_conn = to_msm_dp_mst_connector(connector);
+	mst_port = mst_conn->mst_port;
+	dp_panel = mst_conn->dp_panel;
+
+	if (!dp_panel || !mst_port)
+		return MODE_ERROR;
+
+	/* dp bridge state is protected by drm_mode_config.connection_mutex */
+	for (i = 0; i < mst->max_streams; i++) {
+		dp_bridge_state = to_msm_dp_mst_bridge_state(&mst->mst_bridge[i]);
+		if (dp_bridge_state->connector &&
+		    dp_bridge_state->connector != connector) {
+			active_enc_cnt++;
+			slots_in_use += dp_bridge_state->num_slots;
+		}
+	}
+
+	if (active_enc_cnt < DP_STREAM_MAX) {
+		full_pbn = mst_port->full_pbn;
+		available_slots = tot_slots - slots_in_use;
+	} else {
+		DRM_ERROR("all mst streams are active\n");
+		return MODE_BAD;
+	}
+
+	required_pbn = msm_dp_mst_calc_pbn_mode(mode, connector->display_info.bpc * 3);
+
+	required_slots = msm_dp_mst_find_vcpi_slots(&mst->mst_mgr, required_pbn);
+
+	if (required_pbn > full_pbn || required_slots > available_slots) {
+		drm_dbg_dp(dp_display->drm_dev,
+			   "mode:%s not supported. pbn %d vs %d slots %d vs %d\n",
+			   mode->name, required_pbn, full_pbn,
+			   required_slots, available_slots);
+		return MODE_BAD;
+	}
+
+	return msm_dp_display_mode_valid(dp_display, &dp_display->connector->display_info, mode);
+}
+
+static struct drm_encoder *
+msm_dp_mst_atomic_best_encoder(struct drm_connector *connector, struct drm_atomic_state *state)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+	struct drm_encoder *enc = NULL;
+	struct msm_dp_mst_bridge_state *bridge_state;
+	u32 i;
+	struct drm_connector_state *conn_state = drm_atomic_get_new_connector_state(state,
+										    connector);
+
+	if (conn_state && conn_state->best_encoder)
+		return conn_state->best_encoder;
+
+	for (i = 0; i < mst->max_streams; i++) {
+		bridge_state = msm_dp_mst_br_priv_state(state, &mst->mst_bridge[i]);
+		if (IS_ERR(bridge_state))
+			goto end;
+
+		if (bridge_state->connector == connector) {
+			enc = mst->mst_bridge[i].encoder;
+			goto end;
+		}
+	}
+
+	for (i = 0; i < mst->max_streams; i++) {
+		bridge_state = msm_dp_mst_br_priv_state(state, &mst->mst_bridge[i]);
+
+		if (!bridge_state->connector) {
+			bridge_state->connector = connector;
+			bridge_state->msm_dp_panel = mst_conn->dp_panel;
+			enc = mst->mst_bridge[i].encoder;
+			break;
+		}
+	}
+
+end:
+	if (enc)
+		drm_dbg_dp(dp_display->drm_dev, "mst connector:%d atomic best encoder:%d\n",
+			   connector->base.id, i);
+	else
+		drm_dbg_dp(dp_display->drm_dev, "mst connector:%d atomic best encoder failed\n",
+			   connector->base.id);
+
+	return enc;
+}
+
+static int msm_dp_mst_connector_atomic_check(struct drm_connector *connector,
+					     struct drm_atomic_state *state)
+{
+	int rc = 0, slots, i;
+	bool vcpi_released = false;
+	struct drm_connector_state *old_conn_state;
+	struct drm_connector_state *new_conn_state;
+	struct drm_crtc *old_crtc;
+	struct drm_crtc_state *crtc_state;
+	struct msm_dp_mst_bridge *bridge;
+	struct msm_dp_mst_bridge_state *bridge_state;
+	struct drm_bridge *drm_bridge;
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp *dp_display = mst_conn->msm_dp;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+
+	if (!state)
+		return rc;
+
+	new_conn_state = drm_atomic_get_new_connector_state(state, connector);
+	if (!new_conn_state)
+		return rc;
+
+	old_conn_state = drm_atomic_get_old_connector_state(state, connector);
+	if (!old_conn_state)
+		goto mode_set;
+
+	old_crtc = old_conn_state->crtc;
+	if (!old_crtc)
+		goto mode_set;
+
+	crtc_state = drm_atomic_get_new_crtc_state(state, old_crtc);
+
+	for (i = 0; i < mst->max_streams; i++) {
+		bridge = &mst->mst_bridge[i];
+		drm_dbg_dp(dp_display->drm_dev, "bridge id:%d, vcpi:%d, pbn:%d, slots:%d\n",
+			   bridge->id, bridge->vcpi, bridge->pbn,
+			   bridge->num_slots);
+	}
+
+	/*attempt to release vcpi slots on a modeset change for crtc state*/
+	if (drm_atomic_crtc_needs_modeset(crtc_state)) {
+		if (WARN_ON(!old_conn_state->best_encoder)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		drm_bridge = drm_bridge_chain_get_first_bridge(old_conn_state->best_encoder);
+		if (WARN_ON(!drm_bridge)) {
+			rc = -EINVAL;
+			goto end;
+		}
+		bridge = to_msm_dp_mst_bridge(drm_bridge);
+
+		bridge_state = msm_dp_mst_br_priv_state(state, bridge);
+		if (IS_ERR(bridge_state)) {
+			rc = PTR_ERR(bridge_state);
+			goto end;
+		}
+
+		if (WARN_ON(bridge_state->connector != connector)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		slots = bridge_state->num_slots;
+		if (slots > 0) {
+			rc = drm_dp_atomic_release_time_slots(state,
+							      &mst->mst_mgr,
+							      mst_conn->mst_port);
+			if (rc) {
+				DRM_ERROR("failed releasing %d vcpi slots %d\n", slots, rc);
+				goto end;
+			}
+			vcpi_released = true;
+		}
+
+		if (!new_conn_state->crtc) {
+			/* for cases where crtc is not disabled the slots are not
+			 * freed by drm_dp_atomic_release_time_slots. this results
+			 * in subsequent atomic_check failing since internal slots
+			 * were freed but not the dp mst mgr's
+			 */
+			bridge_state->num_slots = 0;
+			bridge_state->connector = NULL;
+			bridge_state->msm_dp_panel = NULL;
+
+			drm_dbg_dp(dp_display->drm_dev, "clear best encoder: %d\n", bridge->id);
+		}
+	}
+
+mode_set:
+	if (!new_conn_state->crtc)
+		goto end;
+
+	crtc_state = drm_atomic_get_new_crtc_state(state, new_conn_state->crtc);
+
+	if (drm_atomic_crtc_needs_modeset(crtc_state) && crtc_state->active) {
+		if (WARN_ON(!new_conn_state->best_encoder)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		drm_bridge = drm_bridge_chain_get_first_bridge(new_conn_state->best_encoder);
+		if (WARN_ON(!drm_bridge)) {
+			rc = -EINVAL;
+			goto end;
+		}
+		bridge = to_msm_dp_mst_bridge(drm_bridge);
+
+		bridge_state = msm_dp_mst_br_priv_state(state, bridge);
+		if (IS_ERR(bridge_state)) {
+			rc = PTR_ERR(bridge_state);
+			goto end;
+		}
+
+		if (WARN_ON(bridge_state->connector != connector)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/*
+		 * check if vcpi slots are trying to get allocated in same phase
+		 * as deallocation. If so, go to end to avoid allocation.
+		 */
+		if (vcpi_released) {
+			drm_dbg_dp(dp_display->drm_dev,
+				   "skipping allocation since vcpi was released in the same state\n");
+			goto end;
+		}
+
+		if (WARN_ON(bridge_state->num_slots)) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		slots = _msm_dp_mst_compute_config(state, mst, connector, &crtc_state->mode);
+		if (slots < 0) {
+			rc = slots;
+			goto end;
+		}
+
+		bridge_state->num_slots = slots;
+	}
+
+end:
+	drm_dbg_dp(dp_display->drm_dev, "mst connector:%d atomic check ret %d\n",
+		   connector->base.id, rc);
+	return rc;
+}
+
+static void dp_mst_connector_destroy(struct drm_connector *connector)
+{
+	struct msm_dp_mst_connector *mst_conn = to_msm_dp_mst_connector(connector);
+	struct msm_dp_panel *dp_panel = mst_conn->dp_panel;
+
+	drm_connector_cleanup(connector);
+	drm_edid_free(dp_panel->drm_edid);
+	dp_panel->drm_edid = NULL;
+	drm_dp_mst_put_port_malloc(mst_conn->mst_port);
+	msm_dp_panel_put(mst_conn->dp_panel);
+}
+
+/* DRM MST callbacks */
+static const struct drm_connector_helper_funcs dp_drm_mst_connector_helper_funcs = {
+	.get_modes =    msm_dp_mst_connector_get_modes,
+	.detect_ctx =   msm_dp_mst_connector_detect,
+	.mode_valid =   msm_dp_mst_connector_mode_valid,
+	.atomic_best_encoder = msm_dp_mst_atomic_best_encoder,
+	.atomic_check = msm_dp_mst_connector_atomic_check,
+};
+
+static const struct drm_connector_funcs dp_drm_mst_connector_funcs = {
+	.reset = drm_atomic_helper_connector_reset,
+	.destroy = dp_mst_connector_destroy,
+	.fill_modes = drm_helper_probe_single_connector_modes,
+	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+};
+
+static struct drm_connector *
+msm_dp_mst_add_connector(struct drm_dp_mst_topology_mgr *mgr,
+			 struct drm_dp_mst_port *port, const char *pathprop)
+{
+	struct msm_dp_mst *dp_mst;
+	struct drm_device *dev;
+	struct msm_dp *dp_display;
+	struct msm_dp_mst_connector *mst_connector;
+	struct drm_connector *connector;
+	int rc, i;
+
+	dp_mst = container_of(mgr, struct msm_dp_mst, mst_mgr);
+
+	dp_display = dp_mst->msm_dp;
+	dev = dp_display->drm_dev;
+
+	mst_connector = devm_kzalloc(dev->dev, sizeof(*mst_connector), GFP_KERNEL);
+
+	/* make sure connector is not accessed before reset */
+	drm_modeset_lock_all(dev);
+
+	rc = drm_connector_init(dev, &mst_connector->connector, &dp_drm_mst_connector_funcs,
+				DRM_MODE_CONNECTOR_DisplayPort);
+	if (rc) {
+		drm_modeset_unlock_all(dev);
+		return NULL;
+	}
+
+	mst_connector->dp_panel = msm_dp_display_get_panel(dp_display);
+	if (!mst_connector->dp_panel) {
+		DRM_ERROR("failed to get dp_panel for connector\n");
+		drm_modeset_unlock_all(dev);
+		return NULL;
+	}
+
+	mst_connector->dp_panel->connector = &mst_connector->connector;
+	mst_connector->msm_dp = dp_display;
+	connector = &mst_connector->connector;
+	drm_connector_helper_add(&mst_connector->connector, &dp_drm_mst_connector_helper_funcs);
+
+	if (connector->funcs->reset)
+		connector->funcs->reset(connector);
+
+	/* add all encoders as possible encoders */
+	for (i = 0; i < dp_mst->max_streams; i++) {
+		rc = drm_connector_attach_encoder(&mst_connector->connector,
+						  dp_mst->mst_bridge[i].encoder);
+		if (rc) {
+			DRM_ERROR("failed to attach encoder to connector, %d\n", rc);
+			drm_modeset_unlock_all(dev);
+			return NULL;
+		}
+	}
+
+	mst_connector->mst_port = port;
+	drm_dp_mst_get_port_malloc(mst_connector->mst_port);
+
+	/* check if we need to call connector_reset here */
+
+	drm_object_attach_property(&mst_connector->connector.base,
+				   dev->mode_config.path_property, 0);
+	drm_object_attach_property(&mst_connector->connector.base,
+				   dev->mode_config.tile_property, 0);
+
+	/* unlock connector and make it accessible */
+	drm_modeset_unlock_all(dev);
+
+	drm_dbg_dp(dp_display->drm_dev, "add mst connector id:%d\n",
+		   mst_connector->connector.base.id);
+
+	return &mst_connector->connector;
+}
+
+int msm_dp_mst_display_set_mgr_state(struct msm_dp *dp_display, bool state)
+{
+	int rc;
+	struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+
+	/*
+	 * on hpd high, set_mgr_state is called before hotplug event is sent
+	 * to usermode and mst_session_state should be updated here.
+	 * on hpd_low, set_mgr_state is called after hotplug event is sent and
+	 * the session_state was already updated prior to that.
+	 */
+	if (state)
+		mst->mst_session_hpd_state = state;
+
+	rc = drm_dp_mst_topology_mgr_set_mst(&mst->mst_mgr, state);
+	if (rc < 0) {
+		DRM_ERROR("failed to set topology mgr state to %d. rc %d\n",
+			  state, rc);
+	}
+
+	drm_dbg_dp(dp_display->drm_dev, "dp_mst_display_set_mgr_state state:%d\n", state);
+	return rc;
+}
+
+static const struct drm_dp_mst_topology_cbs msm_dp_mst_drm_cbs = {
+	.add_connector = msm_dp_mst_add_connector,
+};
+
+int msm_dp_mst_init(struct msm_dp *dp_display, u32 max_streams, u32 max_dpcd_transaction_bytes,
+		    struct drm_dp_aux *drm_aux)
+{
+	struct drm_device *dev;
+	int conn_base_id = 0;
+	int ret;
+	struct msm_dp_mst *msm_dp_mst;
+
+	if (!dp_display) {
+		DRM_ERROR("invalid params\n");
+		return 0;
+	}
+
+	dev = dp_display->drm_dev;
+
+	msm_dp_mst = devm_kzalloc(dev->dev, sizeof(*msm_dp_mst), GFP_KERNEL);
+	if (!msm_dp_mst)
+		return -ENOMEM;
+
+	// will expost the callbacks as direct APIs for hotplug
+	// lets drop install_info for now
+	memset(&msm_dp_mst->mst_mgr, 0, sizeof(msm_dp_mst->mst_mgr));
+	msm_dp_mst->mst_mgr.cbs = &msm_dp_mst_drm_cbs;
+	conn_base_id = dp_display->connector->base.id;
+	msm_dp_mst->msm_dp = dp_display;
+	msm_dp_mst->dp_aux = drm_aux;
+	msm_dp_mst->max_streams = max_streams;
+
+	ret = drm_dp_mst_topology_mgr_init(&msm_dp_mst->mst_mgr, dev,
+					   drm_aux,
+					   max_dpcd_transaction_bytes,
+					   max_streams,
+					   conn_base_id);
+	if (ret) {
+		DRM_ERROR("dp drm mst topology manager init failed\n");
+		return ret;
+	}
+
+	dp_display->msm_dp_mst = msm_dp_mst;
+
+	mutex_init(&msm_dp_mst->mst_lock);
+
+	msm_dp_mst->mst_initialized = true;
+
+	drm_dbg_dp(dp_display->drm_dev, "dp drm mst topology manager init completed\n");
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_mst_drm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_mst_drm.h
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DP_MST_DRM_H_
+#define _DP_MST_DRM_H_
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/version.h>
+
+#include <drm/drm_atomic_helper.h>
+#include <drm/drm_atomic.h>
+#include <drm/drm_bridge.h>
+#include <drm/drm_crtc.h>
+#include <drm/drm_fixed.h>
+#include <drm/drm_connector.h>
+#include <drm/display/drm_dp_helper.h>
+#include <drm/display/drm_dp_mst_helper.h>
+
+#include "dp_panel.h"
+#include "dp_display.h"
+
+#define MAX_DP_MST_DRM_BRIDGES         4
+
+#define DP_MST_CONN_ID(bridge) ((bridge)->connector ? \
+		(bridge)->connector->base.id : 0)
+
+struct msm_dp_mst_bridge {
+	struct drm_bridge base;
+	struct drm_private_obj obj;
+	u32 id;
+
+	bool in_use;
+
+	struct msm_dp *display;
+	struct drm_encoder *encoder;
+
+	struct drm_display_mode drm_mode;
+	struct msm_dp_display_mode msm_dp_mode;
+	struct drm_connector *connector;
+	struct msm_dp_panel *msm_dp_panel;
+
+	int vcpi;
+	int pbn;
+	int num_slots;
+	int start_slot;
+};
+
+struct msm_dp_mst_bridge_state {
+	struct drm_private_state base;
+	struct drm_connector *connector;
+	struct msm_dp_panel *msm_dp_panel;
+	int num_slots;
+};
+
+struct msm_dp_mst {
+	bool mst_initialized;
+	struct drm_dp_mst_topology_mgr mst_mgr;
+	struct msm_dp_mst_bridge mst_bridge[MAX_DP_MST_DRM_BRIDGES];
+	struct msm_dp *msm_dp;
+	struct drm_dp_aux *dp_aux;
+	bool mst_session_hpd_state;
+	u32 max_streams;
+	struct mutex mst_lock;
+};
+
+struct msm_dp_mst_connector {
+	struct drm_connector connector;
+	struct drm_dp_mst_port *mst_port;
+	struct msm_dp *msm_dp;
+	struct msm_dp_panel *dp_panel;
+};
+
+#define to_msm_dp_mst_bridge(x)     container_of((x), struct msm_dp_mst_bridge, base)
+#define to_msm_dp_mst_bridge_priv(x) \
+		container_of((x), struct msm_dp_mst_bridge, obj)
+#define to_msm_dp_mst_bridge_priv_state(x) \
+		container_of((x), struct msm_dp_mst_bridge_state, base)
+#define to_msm_dp_mst_bridge_state(x) \
+		to_msm_dp_mst_bridge_priv_state((x)->obj.state)
+#define to_msm_dp_mst_connector(x) \
+		container_of((x), struct msm_dp_mst_connector, connector)
+int msm_dp_mst_drm_bridge_init(struct msm_dp *dp, struct drm_encoder *encoder);
+
+int msm_dp_mst_init(struct msm_dp *dp_display, u32 max_streams,
+		    u32 max_dpcd_transaction_bytes, struct drm_dp_aux *drm_aux);
+
+void msm_dp_mst_display_hpd_irq(struct msm_dp *dp_display);
+int msm_dp_mst_display_set_mgr_state(struct msm_dp *dp_display, bool state);
+
+#endif /* _DP_MST_DRM_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_panel.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_panel.c
@@ -0,0 +1,548 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include "dp_panel.h"
+#include "dp_utils.h"
+
+#include <drm/drm_connector.h>
+#include <drm/drm_edid.h>
+#include <drm/drm_of.h>
+#include <drm/drm_print.h>
+
+#define DP_MAX_NUM_DP_LANES	4
+#define DP_LINK_RATE_HBR2	540000 /* kbytes */
+
+struct msm_dp_panel_private {
+	struct device *dev;
+	struct drm_device *drm_dev;
+	struct msm_dp_panel msm_dp_panel;
+	struct drm_dp_aux *aux;
+	struct msm_dp_link *link;
+	struct msm_dp_catalog *catalog;
+	bool panel_on;
+};
+
+static void msm_dp_panel_read_psr_cap(struct msm_dp_panel_private *panel)
+{
+	ssize_t rlen;
+	struct msm_dp_panel *msm_dp_panel;
+
+	msm_dp_panel = &panel->msm_dp_panel;
+
+	/* edp sink */
+	if (msm_dp_panel->dpcd[DP_EDP_CONFIGURATION_CAP]) {
+		rlen = drm_dp_dpcd_read(panel->aux, DP_PSR_SUPPORT,
+				&msm_dp_panel->psr_cap, sizeof(msm_dp_panel->psr_cap));
+		if (rlen == sizeof(msm_dp_panel->psr_cap)) {
+			drm_dbg_dp(panel->drm_dev,
+				"psr version: 0x%x, psr_cap: 0x%x\n",
+				msm_dp_panel->psr_cap.version,
+				msm_dp_panel->psr_cap.capabilities);
+		} else
+			DRM_ERROR("failed to read psr info, rlen=%zd\n", rlen);
+	}
+}
+
+static int msm_dp_panel_read_dpcd(struct msm_dp_panel *msm_dp_panel)
+{
+	int rc;
+	struct msm_dp_panel_private *panel;
+	struct msm_dp_link_info *link_info;
+	u8 *dpcd, major, minor;
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+	dpcd = msm_dp_panel->dpcd;
+	rc = drm_dp_read_dpcd_caps(panel->aux, dpcd);
+	if (rc)
+		return rc;
+
+	msm_dp_panel->vsc_sdp_supported = drm_dp_vsc_sdp_supported(panel->aux, dpcd);
+	link_info = &msm_dp_panel->link_info;
+	link_info->revision = dpcd[DP_DPCD_REV];
+	major = (link_info->revision >> 4) & 0x0f;
+	minor = link_info->revision & 0x0f;
+
+	link_info->rate = drm_dp_max_link_rate(dpcd);
+	link_info->num_lanes = drm_dp_max_lane_count(dpcd);
+
+	/* Limit data lanes from data-lanes of endpoint property of dtsi */
+	if (link_info->num_lanes > msm_dp_panel->max_dp_lanes)
+		link_info->num_lanes = msm_dp_panel->max_dp_lanes;
+
+	/* Limit link rate from link-frequencies of endpoint property of dtsi */
+	if (link_info->rate > msm_dp_panel->max_dp_link_rate)
+		link_info->rate = msm_dp_panel->max_dp_link_rate;
+
+	drm_dbg_dp(panel->drm_dev, "version: %d.%d\n", major, minor);
+	drm_dbg_dp(panel->drm_dev, "link_rate=%d\n", link_info->rate);
+	drm_dbg_dp(panel->drm_dev, "lane_count=%d\n", link_info->num_lanes);
+
+	if (drm_dp_enhanced_frame_cap(dpcd))
+		link_info->capabilities |= DP_LINK_CAP_ENHANCED_FRAMING;
+
+	msm_dp_panel_read_psr_cap(panel);
+
+	return rc;
+}
+
+static u32 msm_dp_panel_get_supported_bpp(struct msm_dp_panel *msm_dp_panel,
+		u32 mode_edid_bpp, u32 mode_pclk_khz)
+{
+	const struct msm_dp_link_info *link_info;
+	const u32 max_supported_bpp = 30, min_supported_bpp = 18;
+	u32 bpp, data_rate_khz;
+
+	bpp = min(mode_edid_bpp, max_supported_bpp);
+
+	link_info = &msm_dp_panel->link_info;
+	data_rate_khz = link_info->num_lanes * link_info->rate * 8;
+
+	do {
+		if (mode_pclk_khz * bpp <= data_rate_khz)
+			return bpp;
+		bpp -= 6;
+	} while (bpp > min_supported_bpp);
+
+	return min_supported_bpp;
+}
+
+bool msm_dp_panel_read_mst_cap(struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_panel_private *panel;
+
+	if (!msm_dp_panel) {
+		DRM_ERROR("invalid input\n");
+		return false;
+	}
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+
+	return drm_dp_read_mst_cap(panel->aux, msm_dp_panel->dpcd);
+}
+
+int msm_dp_panel_read_link_caps(struct msm_dp_panel *msm_dp_panel,
+		struct drm_connector *connector)
+{
+	int rc, bw_code;
+	int count;
+	struct msm_dp_panel_private *panel;
+
+	if (!msm_dp_panel || !connector) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+
+	drm_dbg_dp(panel->drm_dev, "max_lanes=%d max_link_rate=%d\n",
+		msm_dp_panel->max_dp_lanes, msm_dp_panel->max_dp_link_rate);
+
+	rc = msm_dp_panel_read_dpcd(msm_dp_panel);
+	if (rc) {
+		DRM_ERROR("read dpcd failed %d\n", rc);
+		return rc;
+	}
+
+	bw_code = drm_dp_link_rate_to_bw_code(msm_dp_panel->link_info.rate);
+	if (!is_link_rate_valid(bw_code) ||
+			!is_lane_count_valid(msm_dp_panel->link_info.num_lanes) ||
+			(bw_code > msm_dp_panel->max_bw_code)) {
+		DRM_ERROR("Illegal link rate=%d lane=%d\n", msm_dp_panel->link_info.rate,
+				msm_dp_panel->link_info.num_lanes);
+		return -EINVAL;
+	}
+
+	if (drm_dp_is_branch(msm_dp_panel->dpcd)) {
+		count = drm_dp_read_sink_count(panel->aux);
+		if (!count) {
+			panel->link->sink_count = 0;
+			return -ENOTCONN;
+		}
+	}
+
+	return drm_dp_read_downstream_info(panel->aux, msm_dp_panel->dpcd,
+			 msm_dp_panel->downstream_ports);
+}
+
+int msm_dp_panel_read_edid(struct msm_dp_panel *msm_dp_panel, struct drm_connector *connector)
+{
+	struct msm_dp_panel_private *panel;
+
+	if (!msm_dp_panel || !connector) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+
+	drm_edid_free(msm_dp_panel->drm_edid);
+
+	msm_dp_panel->drm_edid = drm_edid_read_ddc(connector, &panel->aux->ddc);
+
+	drm_edid_connector_update(connector, msm_dp_panel->drm_edid);
+
+	if (!msm_dp_panel->drm_edid) {
+		DRM_ERROR("panel edid read failed\n");
+		/* check edid read fail is due to unplug */
+		if (!msm_dp_catalog_link_is_connected(panel->catalog)) {
+			return -ETIMEDOUT;
+		}
+	}
+
+	return 0;
+}
+
+u32 msm_dp_panel_get_mode_bpp(struct msm_dp_panel *msm_dp_panel,
+		u32 mode_edid_bpp, u32 mode_pclk_khz)
+{
+	struct msm_dp_panel_private *panel;
+	u32 bpp;
+
+	if (!msm_dp_panel || !mode_edid_bpp || !mode_pclk_khz) {
+		DRM_ERROR("invalid input\n");
+		return 0;
+	}
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+
+	if (msm_dp_panel->video_test)
+		bpp = msm_dp_link_bit_depth_to_bpp(
+				panel->link->test_video.test_bit_depth);
+	else
+		bpp = msm_dp_panel_get_supported_bpp(msm_dp_panel, mode_edid_bpp,
+				mode_pclk_khz);
+
+	return bpp;
+}
+
+int msm_dp_panel_get_modes(struct msm_dp_panel *msm_dp_panel,
+	struct drm_connector *connector)
+{
+	if (!msm_dp_panel) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	if (msm_dp_panel->drm_edid)
+		return drm_edid_connector_add_modes(connector);
+
+	return 0;
+}
+
+static u8 msm_dp_panel_get_edid_checksum(const struct edid *edid)
+{
+	edid += edid->extensions;
+
+	return edid->checksum;
+}
+
+void msm_dp_panel_handle_sink_request(struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_panel_private *panel;
+
+	if (!msm_dp_panel) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+
+	if (panel->link->sink_request & DP_TEST_LINK_EDID_READ) {
+		/* FIXME: get rid of drm_edid_raw() */
+		const struct edid *edid = drm_edid_raw(msm_dp_panel->drm_edid);
+		u8 checksum;
+
+		if (edid)
+			checksum = msm_dp_panel_get_edid_checksum(edid);
+		else
+			checksum = msm_dp_panel->connector->real_edid_checksum;
+
+		msm_dp_link_send_edid_checksum(panel->link, checksum);
+		msm_dp_link_send_test_response(panel->link);
+	}
+}
+
+void msm_dp_panel_tpg_config(struct msm_dp_panel *msm_dp_panel, bool enable)
+{
+	struct msm_dp_catalog *catalog;
+	struct msm_dp_panel_private *panel;
+
+	if (!msm_dp_panel) {
+		DRM_ERROR("invalid input\n");
+		return;
+	}
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+	catalog = panel->catalog;
+
+	if (!panel->panel_on) {
+		drm_dbg_dp(panel->drm_dev,
+				"DP panel not enabled, handle TPG on next on\n");
+		return;
+	}
+
+	if (!enable) {
+		msm_dp_catalog_panel_tpg_disable(catalog);
+		return;
+	}
+
+	drm_dbg_dp(panel->drm_dev, "calling catalog tpg_enable\n");
+	msm_dp_catalog_panel_tpg_enable(catalog, &panel->msm_dp_panel.msm_dp_mode.drm_mode);
+}
+
+static int msm_dp_panel_setup_vsc_sdp_yuv_420(struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_catalog *catalog;
+	struct msm_dp_panel_private *panel;
+	struct msm_dp_display_mode *msm_dp_mode;
+	struct drm_dp_vsc_sdp vsc_sdp_data;
+	struct dp_sdp vsc_sdp;
+	ssize_t len;
+
+	if (!msm_dp_panel) {
+		DRM_ERROR("invalid input\n");
+		return -EINVAL;
+	}
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+	catalog = panel->catalog;
+	msm_dp_mode = &msm_dp_panel->msm_dp_mode;
+	catalog->stream_id = msm_dp_panel->stream_id;
+
+	memset(&vsc_sdp_data, 0, sizeof(vsc_sdp_data));
+
+	/* VSC SDP header as per table 2-118 of DP 1.4 specification */
+	vsc_sdp_data.sdp_type = DP_SDP_VSC;
+	vsc_sdp_data.revision = 0x05;
+	vsc_sdp_data.length = 0x13;
+
+	/* VSC SDP Payload for DB16 */
+	vsc_sdp_data.pixelformat = DP_PIXELFORMAT_YUV420;
+	vsc_sdp_data.colorimetry = DP_COLORIMETRY_DEFAULT;
+
+	/* VSC SDP Payload for DB17 */
+	vsc_sdp_data.bpc = msm_dp_mode->bpp / 3;
+	vsc_sdp_data.dynamic_range = DP_DYNAMIC_RANGE_CTA;
+
+	/* VSC SDP Payload for DB18 */
+	vsc_sdp_data.content_type = DP_CONTENT_TYPE_GRAPHICS;
+
+	len = drm_dp_vsc_sdp_pack(&vsc_sdp_data, &vsc_sdp);
+	if (len < 0) {
+		DRM_ERROR("unable to pack vsc sdp\n");
+		return len;
+	}
+
+	msm_dp_catalog_panel_enable_vsc_sdp(catalog, &vsc_sdp);
+
+	return 0;
+}
+
+void msm_dp_panel_dump_regs(struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_catalog *catalog;
+	struct msm_dp_panel_private *panel;
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+	catalog = panel->catalog;
+
+	msm_dp_catalog_dump_regs(catalog);
+}
+
+int msm_dp_panel_timing_cfg(struct msm_dp_panel *msm_dp_panel)
+{
+	u32 data, total_ver, total_hor;
+	struct msm_dp_catalog *catalog;
+	struct msm_dp_panel_private *panel;
+	struct drm_display_mode *drm_mode;
+	u32 width_blanking;
+	u32 sync_start;
+	u32 msm_dp_active;
+	u32 total;
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+	catalog = panel->catalog;
+	drm_mode = &panel->msm_dp_panel.msm_dp_mode.drm_mode;
+
+	drm_dbg_dp(panel->drm_dev, "width=%d hporch= %d %d %d\n",
+		drm_mode->hdisplay, drm_mode->htotal - drm_mode->hsync_end,
+		drm_mode->hsync_start - drm_mode->hdisplay,
+		drm_mode->hsync_end - drm_mode->hsync_start);
+
+	drm_dbg_dp(panel->drm_dev, "height=%d vporch= %d %d %d\n",
+		drm_mode->vdisplay, drm_mode->vtotal - drm_mode->vsync_end,
+		drm_mode->vsync_start - drm_mode->vdisplay,
+		drm_mode->vsync_end - drm_mode->vsync_start);
+
+	total_hor = drm_mode->htotal;
+
+	total_ver = drm_mode->vtotal;
+
+	data = total_ver;
+	data <<= 16;
+	data |= total_hor;
+
+	total = data;
+
+	data = (drm_mode->vtotal - drm_mode->vsync_start);
+	data <<= 16;
+	data |= (drm_mode->htotal - drm_mode->hsync_start);
+
+	sync_start = data;
+
+	data = drm_mode->vsync_end - drm_mode->vsync_start;
+	data <<= 16;
+	data |= (panel->msm_dp_panel.msm_dp_mode.v_active_low << 31);
+	data |= drm_mode->hsync_end - drm_mode->hsync_start;
+	data |= (panel->msm_dp_panel.msm_dp_mode.h_active_low << 15);
+
+	width_blanking = data;
+
+	data = drm_mode->vdisplay;
+	data <<= 16;
+	data |= drm_mode->hdisplay;
+
+	msm_dp_active = data;
+
+	msm_dp_catalog_panel_timing_cfg(catalog, total, sync_start, width_blanking, msm_dp_active);
+
+	if (msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420)
+		msm_dp_panel_setup_vsc_sdp_yuv_420(msm_dp_panel);
+
+	panel->panel_on = true;
+
+	return 0;
+}
+
+int msm_dp_panel_init_panel_info(struct msm_dp_panel *msm_dp_panel)
+{
+	struct drm_display_mode *drm_mode;
+	struct msm_dp_panel_private *panel;
+
+	drm_mode = &msm_dp_panel->msm_dp_mode.drm_mode;
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+
+	/*
+	 * print resolution info as this is a result
+	 * of user initiated action of cable connection
+	 */
+	drm_dbg_dp(panel->drm_dev, "SET NEW RESOLUTION:\n");
+	drm_dbg_dp(panel->drm_dev, "%dx%d@%dfps\n",
+		drm_mode->hdisplay, drm_mode->vdisplay, drm_mode_vrefresh(drm_mode));
+	drm_dbg_dp(panel->drm_dev,
+			"h_porches(back|front|width) = (%d|%d|%d)\n",
+			drm_mode->htotal - drm_mode->hsync_end,
+			drm_mode->hsync_start - drm_mode->hdisplay,
+			drm_mode->hsync_end - drm_mode->hsync_start);
+	drm_dbg_dp(panel->drm_dev,
+			"v_porches(back|front|width) = (%d|%d|%d)\n",
+			drm_mode->vtotal - drm_mode->vsync_end,
+			drm_mode->vsync_start - drm_mode->vdisplay,
+			drm_mode->vsync_end - drm_mode->vsync_start);
+	drm_dbg_dp(panel->drm_dev, "pixel clock (KHz)=(%d)\n",
+				drm_mode->clock);
+	drm_dbg_dp(panel->drm_dev, "bpp = %d\n", msm_dp_panel->msm_dp_mode.bpp);
+
+	msm_dp_panel->msm_dp_mode.bpp = msm_dp_panel_get_mode_bpp(msm_dp_panel, msm_dp_panel->msm_dp_mode.bpp,
+						      msm_dp_panel->msm_dp_mode.drm_mode.clock);
+
+	drm_dbg_dp(panel->drm_dev, "updated bpp = %d\n",
+				msm_dp_panel->msm_dp_mode.bpp);
+
+	return 0;
+}
+
+static u32 msm_dp_panel_link_frequencies(struct device_node *of_node)
+{
+	struct device_node *endpoint;
+	u64 frequency = 0;
+	int cnt;
+
+	endpoint = of_graph_get_endpoint_by_regs(of_node, 1, 0); /* port@1 */
+	if (!endpoint)
+		return 0;
+
+	cnt = of_property_count_u64_elems(endpoint, "link-frequencies");
+
+	if (cnt > 0)
+		of_property_read_u64_index(endpoint, "link-frequencies",
+						cnt - 1, &frequency);
+	of_node_put(endpoint);
+
+	do_div(frequency,
+		10 * /* from symbol rate to link rate */
+		1000); /* kbytes */
+
+	return frequency;
+}
+
+static int msm_dp_panel_parse_dt(struct msm_dp_panel *msm_dp_panel)
+{
+	struct msm_dp_panel_private *panel;
+	struct device_node *of_node;
+	int cnt;
+
+	panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+	of_node = panel->dev->of_node;
+
+	/*
+	 * data-lanes is the property of msm_dp_out endpoint
+	 */
+	cnt = drm_of_get_data_lanes_count_ep(of_node, 1, 0, 1, DP_MAX_NUM_DP_LANES);
+	if (cnt < 0) {
+		/* legacy code, data-lanes is the property of mdss_dp node */
+		cnt = drm_of_get_data_lanes_count(of_node, 1, DP_MAX_NUM_DP_LANES);
+	}
+
+	if (cnt > 0)
+		msm_dp_panel->max_dp_lanes = cnt;
+	else
+		msm_dp_panel->max_dp_lanes = DP_MAX_NUM_DP_LANES; /* 4 lanes */
+
+	msm_dp_panel->max_dp_link_rate = msm_dp_panel_link_frequencies(of_node);
+	if (!msm_dp_panel->max_dp_link_rate)
+		msm_dp_panel->max_dp_link_rate = DP_LINK_RATE_HBR2;
+
+	return 0;
+}
+
+struct msm_dp_panel *msm_dp_panel_get(struct msm_dp_panel_in *in)
+{
+	struct msm_dp_panel_private *panel;
+	struct msm_dp_panel *msm_dp_panel;
+	int ret;
+
+	if (!in->dev || !in->catalog || !in->aux || !in->link) {
+		DRM_ERROR("invalid input\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	panel = devm_kzalloc(in->dev, sizeof(*panel), GFP_KERNEL);
+	if (!panel)
+		return ERR_PTR(-ENOMEM);
+
+	panel->dev = in->dev;
+	panel->aux = in->aux;
+	panel->catalog = in->catalog;
+	panel->link = in->link;
+
+	msm_dp_panel = &panel->msm_dp_panel;
+	msm_dp_panel->max_bw_code = DP_LINK_BW_8_1;
+
+	ret = msm_dp_panel_parse_dt(msm_dp_panel);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return msm_dp_panel;
+}
+
+void msm_dp_panel_put(struct msm_dp_panel *msm_dp_panel)
+{
+	if (!msm_dp_panel)
+		return;
+
+	drm_edid_free(msm_dp_panel->drm_edid);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_panel.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_panel.h
@@ -0,0 +1,108 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_PANEL_H_
+#define _DP_PANEL_H_
+
+#include <drm/msm_drm.h>
+
+#include "dp_aux.h"
+#include "dp_link.h"
+
+struct edid;
+
+struct msm_dp_display_mode {
+	struct drm_display_mode drm_mode;
+	u32 bpp;
+	u32 h_active_low;
+	u32 v_active_low;
+	bool out_fmt_is_yuv_420;
+};
+
+struct msm_dp_panel_in {
+	struct device *dev;
+	struct drm_dp_aux *aux;
+	struct msm_dp_link *link;
+	struct msm_dp_catalog *catalog;
+};
+
+struct msm_dp_panel_psr {
+	u8 version;
+	u8 capabilities;
+};
+
+struct mst_caps {
+	u32 pbn_no_overhead;
+	u32 pbn;
+};
+
+struct msm_dp_panel {
+	/* dpcd raw data */
+	u8 dpcd[DP_RECEIVER_CAP_SIZE];
+	u8 downstream_ports[DP_MAX_DOWNSTREAM_PORTS];
+
+	struct msm_dp_link_info link_info;
+	const struct drm_edid *drm_edid;
+	struct drm_connector *connector;
+	struct msm_dp_display_mode msm_dp_mode;
+	struct msm_dp_panel_psr psr_cap;
+	bool video_test;
+	bool vsc_sdp_supported;
+
+	enum msm_dp_stream_id stream_id;
+
+	u32 max_dp_lanes;
+	u32 max_dp_link_rate;
+
+	u32 max_bw_code;
+
+	struct mst_caps mst_caps;
+};
+
+int msm_dp_panel_init_panel_info(struct msm_dp_panel *msm_dp_panel);
+int msm_dp_panel_deinit(struct msm_dp_panel *msm_dp_panel);
+int msm_dp_panel_timing_cfg(struct msm_dp_panel *msm_dp_panel);
+void msm_dp_panel_dump_regs(struct msm_dp_panel *msm_dp_panel);
+u32 msm_dp_panel_get_mode_bpp(struct msm_dp_panel *msm_dp_panel, u32 mode_max_bpp,
+	u32 mode_pclk_khz);
+int msm_dp_panel_read_link_caps(struct msm_dp_panel *msm_dp_panel,
+		struct drm_connector *connector);
+int msm_dp_panel_read_edid(struct msm_dp_panel *msm_dp_panel, struct drm_connector *connector);
+int msm_dp_panel_get_modes(struct msm_dp_panel *msm_dp_panel,
+		struct drm_connector *connector);
+void msm_dp_panel_handle_sink_request(struct msm_dp_panel *msm_dp_panel);
+void msm_dp_panel_tpg_config(struct msm_dp_panel *msm_dp_panel, bool enable);
+bool msm_dp_panel_read_mst_cap(struct msm_dp_panel *msm_dp_panel);
+
+/**
+ * is_link_rate_valid() - validates the link rate
+ * @lane_rate: link rate requested by the sink
+ *
+ * Returns true if the requested link rate is supported.
+ */
+static inline bool is_link_rate_valid(u32 bw_code)
+{
+	return (bw_code == DP_LINK_BW_1_62 ||
+		bw_code == DP_LINK_BW_2_7 ||
+		bw_code == DP_LINK_BW_5_4 ||
+		bw_code == DP_LINK_BW_8_1);
+}
+
+/**
+ * msm_dp_link_is_lane_count_valid() - validates the lane count
+ * @lane_count: lane count requested by the sink
+ *
+ * Returns true if the requested lane count is supported.
+ */
+static inline bool is_lane_count_valid(u32 lane_count)
+{
+	return (lane_count == 1 ||
+		lane_count == 2 ||
+		lane_count == 4);
+}
+
+struct msm_dp_panel *msm_dp_panel_get(struct msm_dp_panel_in *in);
+void msm_dp_panel_put(struct msm_dp_panel *msm_dp_panel);
+#endif /* _DP_PANEL_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_reg.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_reg.h
@@ -0,0 +1,368 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_REG_H_
+#define _DP_REG_H_
+
+#include <linux/bitfield.h>
+#include <linux/bits.h>
+
+/* DP_TX Registers */
+#define REG_DP_HW_VERSION			(0x00000000)
+
+#define REG_DP_SW_RESET				(0x00000010)
+#define DP_SW_RESET				(0x00000001)
+
+#define REG_DP_PHY_CTRL				(0x00000014)
+#define DP_PHY_CTRL_SW_RESET_PLL		(0x00000001)
+#define DP_PHY_CTRL_SW_RESET			(0x00000004)
+
+#define REG_DP_CLK_CTRL				(0x00000018)
+#define REG_DP_CLK_ACTIVE			(0x0000001C)
+#define REG_DP_INTR_STATUS			(0x00000020)
+#define REG_DP_INTR_STATUS2			(0x00000024)
+#define REG_DP_INTR_STATUS3			(0x00000028)
+#define REG_DP_INTR_STATUS4			(0x0000002C)
+#define REG_DP_INTR_STATUS5			(0x00000034)
+
+#define PSR_UPDATE_INT				(0x00000001)
+#define PSR_CAPTURE_INT				(0x00000004)
+#define PSR_EXIT_INT				(0x00000010)
+#define PSR_UPDATE_ERROR_INT			(0x00000040)
+#define PSR_WAKE_ERROR_INT			(0x00000100)
+
+#define REG_DP_INTR_MASK4			(0x00000030)
+#define PSR_UPDATE_MASK				(0x00000001)
+#define PSR_CAPTURE_MASK			(0x00000002)
+#define PSR_EXIT_MASK				(0x00000004)
+#define PSR_UPDATE_ERROR_MASK			(0x00000008)
+#define PSR_WAKE_ERROR_MASK			(0x00000010)
+
+#define REG_DP_DP_HPD_CTRL			(0x00000000)
+#define DP_DP_HPD_CTRL_HPD_EN			(0x00000001)
+
+#define REG_DP_DP_HPD_INT_STATUS		(0x00000004)
+
+#define REG_DP_DP_HPD_INT_ACK			(0x00000008)
+#define DP_DP_HPD_PLUG_INT_ACK			(0x00000001)
+#define DP_DP_IRQ_HPD_INT_ACK			(0x00000002)
+#define DP_DP_HPD_REPLUG_INT_ACK		(0x00000004)
+#define DP_DP_HPD_UNPLUG_INT_ACK		(0x00000008)
+#define DP_DP_HPD_STATE_STATUS_BITS_MASK	(0x0000000F)
+#define DP_DP_HPD_STATE_STATUS_BITS_SHIFT	(0x1C)
+
+#define REG_DP_DP_HPD_INT_MASK			(0x0000000C)
+#define DP_DP_HPD_PLUG_INT_MASK			(0x00000001)
+#define DP_DP_IRQ_HPD_INT_MASK			(0x00000002)
+#define DP_DP_HPD_REPLUG_INT_MASK		(0x00000004)
+#define DP_DP_HPD_UNPLUG_INT_MASK		(0x00000008)
+#define DP_DP_HPD_INT_MASK			(DP_DP_HPD_PLUG_INT_MASK | \
+						DP_DP_IRQ_HPD_INT_MASK | \
+						DP_DP_HPD_REPLUG_INT_MASK | \
+						DP_DP_HPD_UNPLUG_INT_MASK)
+#define DP_DP_HPD_STATE_STATUS_CONNECTED	(0x40000000)
+#define DP_DP_HPD_STATE_STATUS_PENDING		(0x20000000)
+#define DP_DP_HPD_STATE_STATUS_DISCONNECTED	(0x00000000)
+#define DP_DP_HPD_STATE_STATUS_MASK		(0xE0000000)
+
+#define REG_DP_DP_HPD_REFTIMER			(0x00000018)
+#define DP_DP_HPD_REFTIMER_ENABLE		(1 << 16)
+
+#define REG_DP_DP_HPD_EVENT_TIME_0		(0x0000001C)
+#define REG_DP_DP_HPD_EVENT_TIME_1		(0x00000020)
+#define DP_DP_HPD_EVENT_TIME_0_VAL		(0x3E800FA)
+#define DP_DP_HPD_EVENT_TIME_1_VAL		(0x1F407D0)
+
+#define REG_DP_AUX_CTRL				(0x00000030)
+#define DP_AUX_CTRL_ENABLE			(0x00000001)
+#define DP_AUX_CTRL_RESET			(0x00000002)
+
+#define REG_DP_AUX_DATA				(0x00000034)
+#define DP_AUX_DATA_READ			(0x00000001)
+#define DP_AUX_DATA_WRITE			(0x00000000)
+#define DP_AUX_DATA_OFFSET			(0x00000008)
+#define DP_AUX_DATA_INDEX_OFFSET		(0x00000010)
+#define DP_AUX_DATA_MASK			(0x0000ff00)
+#define DP_AUX_DATA_INDEX_WRITE			(0x80000000)
+
+#define REG_DP_AUX_TRANS_CTRL			(0x00000038)
+#define DP_AUX_TRANS_CTRL_I2C			(0x00000100)
+#define DP_AUX_TRANS_CTRL_GO			(0x00000200)
+#define DP_AUX_TRANS_CTRL_NO_SEND_ADDR		(0x00000400)
+#define DP_AUX_TRANS_CTRL_NO_SEND_STOP		(0x00000800)
+
+#define REG_DP_TIMEOUT_COUNT			(0x0000003C)
+#define REG_DP_AUX_LIMITS			(0x00000040)
+#define REG_DP_AUX_STATUS			(0x00000044)
+
+#define DP_DPCD_CP_IRQ				(0x201)
+#define DP_DPCD_RXSTATUS			(0x69493)
+
+#define DP_INTERRUPT_TRANS_NUM			(0x000000A0)
+
+#define REG_DP_MAINLINK_CTRL			(0x00000000)
+#define DP_MAINLINK_CTRL_ENABLE			(0x00000001)
+#define DP_MAINLINK_CTRL_RESET			(0x00000002)
+#define DP_MAINLINK_CTRL_SW_BYPASS_SCRAMBLER	(0x00000010)
+#define DP_MAINLINK_CTRL_FLUSH_MODE_MASK	GENMASK(24, 23)
+#define DP_MAINLINK_FLUSH_MODE_UPDATE_SDP	FIELD_PREP(DP_MAINLINK_CTRL_FLUSH_MODE_MASK, 1)
+#define DP_MAINLINK_FLUSH_MODE_SDE_PERIPH_UPDATE	FIELD_PREP(DP_MAINLINK_CTRL_FLUSH_MODE_MASK, 3)
+#define DP_MAINLINK_FB_BOUNDARY_SEL		(0x02000000)
+
+#define REG_DP_STATE_CTRL			(0x00000004)
+#define DP_STATE_CTRL_LINK_TRAINING_PATTERN1	(0x00000001)
+#define DP_STATE_CTRL_LINK_TRAINING_PATTERN2	(0x00000002)
+#define DP_STATE_CTRL_LINK_TRAINING_PATTERN3	(0x00000004)
+#define DP_STATE_CTRL_LINK_TRAINING_PATTERN4	(0x00000008)
+#define DP_STATE_CTRL_LINK_SYMBOL_ERR_MEASURE	(0x00000010)
+#define DP_STATE_CTRL_LINK_PRBS7		(0x00000020)
+#define DP_STATE_CTRL_LINK_TEST_CUSTOM_PATTERN	(0x00000040)
+#define DP_STATE_CTRL_SEND_VIDEO		(0x00000080)
+#define DP_STATE_CTRL_PUSH_IDLE			(0x00000100)
+
+#define REG_DP_CONFIGURATION_CTRL		(0x00000008)
+#define DP_CONFIGURATION_CTRL_SYNC_ASYNC_CLK	(0x00000001)
+#define DP_CONFIGURATION_CTRL_STATIC_DYNAMIC_CN (0x00000002)
+#define DP_CONFIGURATION_CTRL_P_INTERLACED	(0x00000004)
+#define DP_CONFIGURATION_CTRL_INTERLACED_BTF	(0x00000008)
+#define DP_CONFIGURATION_CTRL_NUM_OF_LANES	(0x00000010)
+#define DP_CONFIGURATION_CTRL_ENHANCED_FRAMING	(0x00000040)
+#define DP_CONFIGURATION_CTRL_SEND_VSC		(0x00000080)
+#define DP_CONFIGURATION_CTRL_BPC		(0x00000100)
+#define DP_CONFIGURATION_CTRL_ASSR		(0x00000400)
+#define DP_CONFIGURATION_CTRL_RGB_YUV		(0x00000800)
+#define DP_CONFIGURATION_CTRL_LSCLK_DIV		(0x00002000)
+#define DP_CONFIGURATION_CTRL_NUM_OF_LANES_SHIFT	(0x04)
+#define DP_CONFIGURATION_CTRL_BPC_SHIFT		(0x08)
+#define DP_CONFIGURATION_CTRL_LSCLK_DIV_SHIFT	(0x0D)
+
+#define REG_DP_SOFTWARE_MVID			(0x00000010)
+#define REG_DP1_SOFTWARE_MVID			(0x00000414)
+#define REG_DP_SOFTWARE_NVID			(0x00000018)
+#define REG_DP1_SOFTWARE_NVID			(0x00000418)
+#define REG_DP_TOTAL_HOR_VER			(0x0000001C)
+#define REG_DP1_TOTAL_HOR_VER			(0x0000041C)
+#define REG_DP_START_HOR_VER_FROM_SYNC		(0x00000020)
+#define REG_DP_HSYNC_VSYNC_WIDTH_POLARITY	(0x00000024)
+#define REG_DP_ACTIVE_HOR_VER			(0x00000028)
+#define REG_DP_MISC1_MISC0			(0x0000002C)
+#define REG_DP1_MISC1_MISC0			(0x0000042C)
+
+#define DP_MISC0_SYNCHRONOUS_CLK		(0x00000001)
+#define DP_MISC0_COLORIMETRY_CFG_SHIFT		(0x00000001)
+#define DP_MISC0_TEST_BITS_DEPTH_SHIFT		(0x00000005)
+#define DP_MISC1_VSC_SDP			(0x00004000)
+
+#define DP_MISC0_COLORIMERY_CFG_LEGACY_RGB	(0)
+#define DP_MISC0_COLORIMERY_CFG_CEA_RGB		(0x04)
+
+#define REG_DP_VALID_BOUNDARY			(0x00000030)
+#define REG_DP_VALID_BOUNDARY_2			(0x00000034)
+
+#define REG_DP_LOGICAL2PHYSICAL_LANE_MAPPING	(0x00000038)
+#define LANE0_MAPPING_SHIFT			(0x00000000)
+#define LANE1_MAPPING_SHIFT			(0x00000002)
+#define LANE2_MAPPING_SHIFT			(0x00000004)
+#define LANE3_MAPPING_SHIFT			(0x00000006)
+
+#define REG_DP_MAINLINK_READY			(0x00000040)
+#define DP_MAINLINK_READY_FOR_VIDEO		(0x00000001)
+#define DP_MAINLINK_READY_LINK_TRAINING_SHIFT	(0x00000003)
+
+#define REG_DP_MAINLINK_LEVELS			(0x00000044)
+#define DP_MAINLINK_SAFE_TO_EXIT_LEVEL_2	(0x00000002)
+
+
+#define REG_DP_TU				(0x0000004C)
+
+#define REG_DP_HBR2_COMPLIANCE_SCRAMBLER_RESET	(0x00000054)
+#define DP_HBR2_ERM_PATTERN			(0x00010000)
+
+#define REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG0	(0x000000C0)
+#define REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG1	(0x000000C4)
+#define REG_DP_TEST_80BIT_CUSTOM_PATTERN_REG2	(0x000000C8)
+
+#define MMSS_DP_MISC1_MISC0			(0x0000002C)
+#define MMSS_DP_AUDIO_TIMING_GEN		(0x00000080)
+#define MMSS_DP_AUDIO_TIMING_RBR_32		(0x00000084)
+#define MMSS_DP_AUDIO_TIMING_HBR_32		(0x00000088)
+#define MMSS_DP_AUDIO_TIMING_RBR_44		(0x0000008C)
+#define MMSS_DP_AUDIO_TIMING_HBR_44		(0x00000090)
+#define MMSS_DP_AUDIO_TIMING_RBR_48		(0x00000094)
+#define MMSS_DP_AUDIO_TIMING_HBR_48		(0x00000098)
+
+#define REG_PSR_CONFIG				(0x00000100)
+#define DISABLE_PSR				(0x00000000)
+#define PSR1_SUPPORTED				(0x00000001)
+#define PSR2_WITHOUT_FRAMESYNC			(0x00000002)
+#define PSR2_WITH_FRAMESYNC			(0x00000003)
+
+#define REG_PSR_CMD				(0x00000110)
+#define PSR_ENTER				(0x00000001)
+#define PSR_EXIT				(0x00000002)
+
+#define MMSS_DP_PSR_CRC_RG			(0x00000154)
+#define MMSS_DP_PSR_CRC_B			(0x00000158)
+
+#define REG_DP_COMPRESSION_MODE_CTRL		(0x00000180)
+
+#define MMSS_DP_AUDIO_CFG			(0x00000200)
+#define MMSS_DP_AUDIO_STATUS			(0x00000204)
+#define MMSS_DP_AUDIO_PKT_CTRL			(0x00000208)
+#define MMSS_DP_AUDIO_PKT_CTRL2			(0x0000020C)
+#define MMSS_DP_AUDIO_ACR_CTRL			(0x00000210)
+#define MMSS_DP_AUDIO_CTRL_RESET		(0x00000214)
+
+#define MMSS_DP_SDP_CFG				(0x00000228)
+#define MMSS_DP1_SDP_CFG			(0x000004E0)
+#define GEN0_SDP_EN				(0x00020000)
+#define MMSS_DP_SDP_CFG2			(0x0000022C)
+#define MMSS_DP1_SDP_CFG2			(0x000004E4)
+
+#define MMSS_DP_AUDIO_TIMESTAMP_0		(0x00000230)
+#define MMSS_DP_AUDIO_TIMESTAMP_1		(0x00000234)
+#define GENERIC0_SDPSIZE_VALID			(0x00010000)
+
+#define MMSS_DP_AUDIO_STREAM_0			(0x00000240)
+#define MMSS_DP_AUDIO_STREAM_1			(0x00000244)
+
+#define MMSS_DP_SDP_CFG3			(0x0000024c)
+#define MMSS_DP1_SDP_CFG3			(0x000004E8)
+
+#define UPDATE_SDP				(0x00000001)
+
+#define MMSS_DP_EXTENSION_0			(0x00000250)
+#define MMSS_DP_EXTENSION_1			(0x00000254)
+#define MMSS_DP_EXTENSION_2			(0x00000258)
+#define MMSS_DP_EXTENSION_3			(0x0000025C)
+#define MMSS_DP_EXTENSION_4			(0x00000260)
+#define MMSS_DP_EXTENSION_5			(0x00000264)
+#define MMSS_DP_EXTENSION_6			(0x00000268)
+#define MMSS_DP_EXTENSION_7			(0x0000026C)
+#define MMSS_DP_EXTENSION_8			(0x00000270)
+#define MMSS_DP_EXTENSION_9			(0x00000274)
+#define MMSS_DP_AUDIO_COPYMANAGEMENT_0		(0x00000278)
+#define MMSS_DP_AUDIO_COPYMANAGEMENT_1		(0x0000027C)
+#define MMSS_DP_AUDIO_COPYMANAGEMENT_2		(0x00000280)
+#define MMSS_DP_AUDIO_COPYMANAGEMENT_3		(0x00000284)
+#define MMSS_DP_AUDIO_COPYMANAGEMENT_4		(0x00000288)
+#define MMSS_DP_AUDIO_COPYMANAGEMENT_5		(0x0000028C)
+#define MMSS_DP_AUDIO_ISRC_0			(0x00000290)
+#define MMSS_DP_AUDIO_ISRC_1			(0x00000294)
+#define MMSS_DP_AUDIO_ISRC_2			(0x00000298)
+#define MMSS_DP_AUDIO_ISRC_3			(0x0000029C)
+#define MMSS_DP_AUDIO_ISRC_4			(0x000002A0)
+#define MMSS_DP_AUDIO_ISRC_5			(0x000002A4)
+#define MMSS_DP_AUDIO_INFOFRAME_0		(0x000002A8)
+#define MMSS_DP_AUDIO_INFOFRAME_1		(0x000002AC)
+#define MMSS_DP_AUDIO_INFOFRAME_2		(0x000002B0)
+
+#define MMSS_DP_GENERIC0_0			(0x00000300)
+#define MMSS_DP_GENERIC0_1			(0x00000304)
+#define MMSS_DP_GENERIC0_2			(0x00000308)
+#define MMSS_DP_GENERIC0_3			(0x0000030C)
+#define MMSS_DP_GENERIC0_4			(0x00000310)
+#define MMSS_DP_GENERIC0_5			(0x00000314)
+#define MMSS_DP_GENERIC0_6			(0x00000318)
+#define MMSS_DP_GENERIC0_7			(0x0000031C)
+#define MMSS_DP_GENERIC0_8			(0x00000320)
+#define MMSS_DP_GENERIC0_9			(0x00000324)
+#define MMSS_DP_GENERIC1_0			(0x00000328)
+#define MMSS_DP_GENERIC1_1			(0x0000032C)
+#define MMSS_DP_GENERIC1_2			(0x00000330)
+#define MMSS_DP_GENERIC1_3			(0x00000334)
+#define MMSS_DP_GENERIC1_4			(0x00000338)
+#define MMSS_DP_GENERIC1_5			(0x0000033C)
+#define MMSS_DP_GENERIC1_6			(0x00000340)
+#define MMSS_DP_GENERIC1_7			(0x00000344)
+#define MMSS_DP_GENERIC1_8			(0x00000348)
+#define MMSS_DP_GENERIC1_9			(0x0000034C)
+
+#define MMSS_DP1_GENERIC0_0			(0x00000490)
+
+#define MMSS_DP_VSCEXT_0			(0x000002D0)
+#define MMSS_DP_VSCEXT_1			(0x000002D4)
+#define MMSS_DP_VSCEXT_2			(0x000002D8)
+#define MMSS_DP_VSCEXT_3			(0x000002DC)
+#define MMSS_DP_VSCEXT_4			(0x000002E0)
+#define MMSS_DP_VSCEXT_5			(0x000002E4)
+#define MMSS_DP_VSCEXT_6			(0x000002E8)
+#define MMSS_DP_VSCEXT_7			(0x000002EC)
+#define MMSS_DP_VSCEXT_8			(0x000002F0)
+#define MMSS_DP_VSCEXT_9			(0x000002F4)
+
+#define MMSS_DP_BIST_ENABLE			(0x00000000)
+#define DP_BIST_ENABLE_DPBIST_EN		(0x00000001)
+
+#define MMSS_DP_TIMING_ENGINE_EN		(0x00000010)
+#define DP_TIMING_ENGINE_EN_EN			(0x00000001)
+
+#define MMSS_DP_INTF_CONFIG			(0x00000014)
+#define MMSS_DP_INTF_HSYNC_CTL			(0x00000018)
+#define MMSS_DP_INTF_VSYNC_PERIOD_F0		(0x0000001C)
+#define MMSS_DP_INTF_VSYNC_PERIOD_F1		(0x00000020)
+#define MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F0	(0x00000024)
+#define MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F1	(0x00000028)
+#define MMSS_INTF_DISPLAY_V_START_F0		(0x0000002C)
+#define MMSS_INTF_DISPLAY_V_START_F1		(0x00000030)
+#define MMSS_DP_INTF_DISPLAY_V_END_F0		(0x00000034)
+#define MMSS_DP_INTF_DISPLAY_V_END_F1		(0x00000038)
+#define MMSS_DP_INTF_ACTIVE_V_START_F0		(0x0000003C)
+#define MMSS_DP_INTF_ACTIVE_V_START_F1		(0x00000040)
+#define MMSS_DP_INTF_ACTIVE_V_END_F0		(0x00000044)
+#define MMSS_DP_INTF_ACTIVE_V_END_F1		(0x00000048)
+#define MMSS_DP_INTF_DISPLAY_HCTL		(0x0000004C)
+#define MMSS_DP_INTF_ACTIVE_HCTL		(0x00000050)
+#define MMSS_DP_INTF_POLARITY_CTL		(0x00000058)
+
+#define MMSS_DP_TPG_MAIN_CONTROL		(0x00000060)
+#define MMSS_DP_DSC_DTO				(0x0000007C)
+#define DP_TPG_CHECKERED_RECT_PATTERN		(0x00000100)
+
+#define MMSS_DP_TPG_VIDEO_CONFIG		(0x00000064)
+#define DP_TPG_VIDEO_CONFIG_BPP_8BIT		(0x00000001)
+#define DP_TPG_VIDEO_CONFIG_RGB			(0x00000004)
+
+#define MMSS_DP_ASYNC_FIFO_CONFIG		(0x00000088)
+
+#define REG_DP_PHY_AUX_INTERRUPT_CLEAR          (0x0000004C)
+#define REG_DP_PHY_AUX_BIST_CFG			(0x00000050)
+#define REG_DP_PHY_AUX_INTERRUPT_STATUS         (0x000000BC)
+
+/* DP MST related registers */
+#define REG_DP_MST_ACT                          (0x00000500)
+#define REG_DP_DP0_RG				(0x000004F8)
+#define REG_DP_DP1_RG				(0x000004FC)
+#define REG_DP_DP0_TIMESLOT_1_32		(0x00000404)
+#define REG_DP_DP0_TIMESLOT_33_63		(0x00000408)
+#define REG_DP_DP1_TIMESLOT_1_32		(0x0000040C)
+#define REG_DP_DP1_TIMESLOT_33_63		(0x00000410)
+
+/* DP HDCP 1.3 registers */
+#define DP_HDCP_CTRL                                   (0x0A0)
+#define DP_HDCP_STATUS                                 (0x0A4)
+#define DP_HDCP_SW_UPPER_AKSV                          (0x098)
+#define DP_HDCP_SW_LOWER_AKSV                          (0x09C)
+#define DP_HDCP_ENTROPY_CTRL0                          (0x350)
+#define DP_HDCP_ENTROPY_CTRL1                          (0x35C)
+#define DP_HDCP_SHA_STATUS                             (0x0C8)
+#define DP_HDCP_RCVPORT_DATA2_0                        (0x0B0)
+#define DP_HDCP_RCVPORT_DATA3                          (0x0A4)
+#define DP_HDCP_RCVPORT_DATA4                          (0x0A8)
+#define DP_HDCP_RCVPORT_DATA5                          (0x0C0)
+#define DP_HDCP_RCVPORT_DATA6                          (0x0C4)
+
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_SHA_CTRL           (0x024)
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_SHA_DATA           (0x028)
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_RCVPORT_DATA0      (0x004)
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_RCVPORT_DATA1      (0x008)
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_RCVPORT_DATA7      (0x00C)
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_RCVPORT_DATA8      (0x010)
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_RCVPORT_DATA9      (0x014)
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_RCVPORT_DATA10     (0x018)
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_RCVPORT_DATA11     (0x01C)
+#define HDCP_SEC_DP_TZ_HV_HLOS_HDCP_RCVPORT_DATA12     (0x020)
+
+#endif /* _DP_REG_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_utils.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_utils.c
@@ -0,0 +1,96 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/types.h>
+
+#include "dp_utils.h"
+
+#define DP_SDP_HEADER_SIZE		8
+
+u8 msm_dp_utils_get_g0_value(u8 data)
+{
+	u8 c[4];
+	u8 g[4];
+	u8 ret_data = 0;
+	u8 i;
+
+	for (i = 0; i < 4; i++)
+		c[i] = (data >> i) & 0x01;
+
+	g[0] = c[3];
+	g[1] = c[0] ^ c[3];
+	g[2] = c[1];
+	g[3] = c[2];
+
+	for (i = 0; i < 4; i++)
+		ret_data = ((g[i] & 0x01) << i) | ret_data;
+
+	return ret_data;
+}
+
+u8 msm_dp_utils_get_g1_value(u8 data)
+{
+	u8 c[4];
+	u8 g[4];
+	u8 ret_data = 0;
+	u8 i;
+
+	for (i = 0; i < 4; i++)
+		c[i] = (data >> i) & 0x01;
+
+	g[0] = c[0] ^ c[3];
+	g[1] = c[0] ^ c[1] ^ c[3];
+	g[2] = c[1] ^ c[2];
+	g[3] = c[2] ^ c[3];
+
+	for (i = 0; i < 4; i++)
+		ret_data = ((g[i] & 0x01) << i) | ret_data;
+
+	return ret_data;
+}
+
+u8 msm_dp_utils_calculate_parity(u32 data)
+{
+	u8 x0 = 0;
+	u8 x1 = 0;
+	u8 ci = 0;
+	u8 iData = 0;
+	u8 i = 0;
+	u8 parity_byte;
+	u8 num_byte = (data & 0xFF00) > 0 ? 8 : 2;
+
+	for (i = 0; i < num_byte; i++) {
+		iData = (data >> i * 4) & 0xF;
+
+		ci = iData ^ x1;
+		x1 = x0 ^ msm_dp_utils_get_g1_value(ci);
+		x0 = msm_dp_utils_get_g0_value(ci);
+	}
+
+	parity_byte = x1 | (x0 << 4);
+
+	return parity_byte;
+}
+
+ssize_t msm_dp_utils_pack_sdp_header(struct dp_sdp_header *sdp_header, u32 *header_buff)
+{
+	size_t length;
+
+	length = sizeof(header_buff);
+	if (length < DP_SDP_HEADER_SIZE)
+		return -ENOSPC;
+
+	header_buff[0] = FIELD_PREP(HEADER_0_MASK, sdp_header->HB0) |
+		FIELD_PREP(PARITY_0_MASK, msm_dp_utils_calculate_parity(sdp_header->HB0)) |
+		FIELD_PREP(HEADER_1_MASK, sdp_header->HB1) |
+		FIELD_PREP(PARITY_1_MASK, msm_dp_utils_calculate_parity(sdp_header->HB1));
+
+	header_buff[1] = FIELD_PREP(HEADER_2_MASK, sdp_header->HB2) |
+		FIELD_PREP(PARITY_2_MASK, msm_dp_utils_calculate_parity(sdp_header->HB2)) |
+		FIELD_PREP(HEADER_3_MASK, sdp_header->HB3) |
+		FIELD_PREP(PARITY_3_MASK, msm_dp_utils_calculate_parity(sdp_header->HB3));
+
+	return length;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dp/dp_utils.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dp/dp_utils.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _DP_UTILS_H_
+#define _DP_UTILS_H_
+
+#include <linux/bitfield.h>
+#include <linux/bits.h>
+#include <drm/display/drm_dp_helper.h>
+
+#define HEADER_BYTE_0_BIT	 0
+#define PARITY_BYTE_0_BIT	 8
+#define HEADER_BYTE_1_BIT	16
+#define PARITY_BYTE_1_BIT	24
+#define HEADER_BYTE_2_BIT	 0
+#define PARITY_BYTE_2_BIT	 8
+#define HEADER_BYTE_3_BIT	16
+#define PARITY_BYTE_3_BIT	24
+
+#define HEADER_0_MASK	    GENMASK(7, 0)
+#define PARITY_0_MASK	    GENMASK(15, 8)
+#define HEADER_1_MASK	    GENMASK(23, 16)
+#define PARITY_1_MASK	    GENMASK(31, 24)
+#define HEADER_2_MASK	    GENMASK(7, 0)
+#define PARITY_2_MASK	    GENMASK(15, 8)
+#define HEADER_3_MASK	    GENMASK(23, 16)
+#define PARITY_3_MASK	    GENMASK(31, 24)
+
+u8 msm_dp_utils_get_g0_value(u8 data);
+u8 msm_dp_utils_get_g1_value(u8 data);
+u8 msm_dp_utils_calculate_parity(u32 data);
+ssize_t msm_dp_utils_pack_sdp_header(struct dp_sdp_header *sdp_header, u32 *header_buff);
+
+#endif /* _DP_UTILS_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/dsi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/dsi.c
@@ -0,0 +1,261 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#include "dsi.h"
+
+bool msm_dsi_is_cmd_mode(struct msm_dsi *msm_dsi)
+{
+	unsigned long host_flags = msm_dsi_host_get_mode_flags(msm_dsi->host);
+
+	return !(host_flags & MIPI_DSI_MODE_VIDEO);
+}
+
+struct drm_dsc_config *msm_dsi_get_dsc_config(struct msm_dsi *msm_dsi)
+{
+	return msm_dsi_host_get_dsc_config(msm_dsi->host);
+}
+
+bool msm_dsi_wide_bus_enabled(struct msm_dsi *msm_dsi)
+{
+	return msm_dsi_host_is_wide_bus_enabled(msm_dsi->host);
+}
+
+static int dsi_get_phy(struct msm_dsi *msm_dsi)
+{
+	struct platform_device *pdev = msm_dsi->pdev;
+	struct platform_device *phy_pdev;
+	struct device_node *phy_node;
+
+	phy_node = of_parse_phandle(pdev->dev.of_node, "phys", 0);
+	if (!phy_node) {
+		DRM_DEV_ERROR(&pdev->dev, "cannot find phy device\n");
+		return -ENXIO;
+	}
+
+	phy_pdev = of_find_device_by_node(phy_node);
+	if (phy_pdev) {
+		msm_dsi->phy = platform_get_drvdata(phy_pdev);
+		msm_dsi->phy_dev = &phy_pdev->dev;
+	}
+
+	of_node_put(phy_node);
+
+	if (!phy_pdev) {
+		DRM_DEV_ERROR(&pdev->dev, "%s: phy driver is not ready\n", __func__);
+		return -EPROBE_DEFER;
+	}
+	if (!msm_dsi->phy) {
+		put_device(&phy_pdev->dev);
+		DRM_DEV_ERROR(&pdev->dev, "%s: phy driver is not ready\n", __func__);
+		return -EPROBE_DEFER;
+	}
+
+	return 0;
+}
+
+static void dsi_destroy(struct msm_dsi *msm_dsi)
+{
+	if (!msm_dsi)
+		return;
+
+	msm_dsi_manager_unregister(msm_dsi);
+
+	if (msm_dsi->phy_dev) {
+		put_device(msm_dsi->phy_dev);
+		msm_dsi->phy = NULL;
+		msm_dsi->phy_dev = NULL;
+	}
+
+	if (msm_dsi->host) {
+		msm_dsi_host_destroy(msm_dsi->host);
+		msm_dsi->host = NULL;
+	}
+
+	platform_set_drvdata(msm_dsi->pdev, NULL);
+}
+
+static struct msm_dsi *dsi_init(struct platform_device *pdev)
+{
+	struct msm_dsi *msm_dsi;
+	int ret;
+
+	if (!pdev)
+		return ERR_PTR(-ENXIO);
+
+	msm_dsi = devm_kzalloc(&pdev->dev, sizeof(*msm_dsi), GFP_KERNEL);
+	if (!msm_dsi)
+		return ERR_PTR(-ENOMEM);
+	DBG("dsi probed=%p", msm_dsi);
+
+	msm_dsi->id = -1;
+	msm_dsi->pdev = pdev;
+	platform_set_drvdata(pdev, msm_dsi);
+
+	/* Init dsi host */
+	ret = msm_dsi_host_init(msm_dsi);
+	if (ret)
+		goto destroy_dsi;
+
+	/* GET dsi PHY */
+	ret = dsi_get_phy(msm_dsi);
+	if (ret)
+		goto destroy_dsi;
+
+	/* Register to dsi manager */
+	ret = msm_dsi_manager_register(msm_dsi);
+	if (ret)
+		goto destroy_dsi;
+
+	return msm_dsi;
+
+destroy_dsi:
+	dsi_destroy(msm_dsi);
+	return ERR_PTR(ret);
+}
+
+static int dsi_bind(struct device *dev, struct device *master, void *data)
+{
+	struct msm_drm_private *priv = dev_get_drvdata(master);
+	struct msm_dsi *msm_dsi = dev_get_drvdata(dev);
+
+	priv->dsi[msm_dsi->id] = msm_dsi;
+
+	return 0;
+}
+
+static void dsi_unbind(struct device *dev, struct device *master,
+		void *data)
+{
+	struct msm_drm_private *priv = dev_get_drvdata(master);
+	struct msm_dsi *msm_dsi = dev_get_drvdata(dev);
+
+	msm_dsi_tx_buf_free(msm_dsi->host);
+	priv->dsi[msm_dsi->id] = NULL;
+}
+
+static const struct component_ops dsi_ops = {
+	.bind   = dsi_bind,
+	.unbind = dsi_unbind,
+};
+
+int dsi_dev_attach(struct platform_device *pdev)
+{
+	return component_add(&pdev->dev, &dsi_ops);
+}
+
+void dsi_dev_detach(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &dsi_ops);
+}
+
+static int dsi_dev_probe(struct platform_device *pdev)
+{
+	struct msm_dsi *msm_dsi;
+
+	DBG("");
+	msm_dsi = dsi_init(pdev);
+	if (IS_ERR(msm_dsi)) {
+		/* Don't fail the bind if the dsi port is not connected */
+		if (PTR_ERR(msm_dsi) == -ENODEV)
+			return 0;
+		else
+			return PTR_ERR(msm_dsi);
+	}
+
+	return 0;
+}
+
+static void dsi_dev_remove(struct platform_device *pdev)
+{
+	struct msm_dsi *msm_dsi = platform_get_drvdata(pdev);
+
+	DBG("");
+	dsi_destroy(msm_dsi);
+}
+
+static const struct of_device_id dt_match[] = {
+	{ .compatible = "qcom,mdss-dsi-ctrl" },
+
+	/* Deprecated, don't use */
+	{ .compatible = "qcom,dsi-ctrl-6g-qcm2290" },
+	{}
+};
+
+static const struct dev_pm_ops dsi_pm_ops = {
+	SET_RUNTIME_PM_OPS(msm_dsi_runtime_suspend, msm_dsi_runtime_resume, NULL)
+	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+				pm_runtime_force_resume)
+};
+
+static struct platform_driver dsi_driver = {
+	.probe = dsi_dev_probe,
+	.remove_new = dsi_dev_remove,
+	.driver = {
+		.name = "msm_dsi",
+		.of_match_table = dt_match,
+		.pm = &dsi_pm_ops,
+	},
+};
+
+void __init msm_dsi_register(void)
+{
+	DBG("");
+	msm_dsi_phy_driver_register();
+	platform_driver_register(&dsi_driver);
+}
+
+void __exit msm_dsi_unregister(void)
+{
+	DBG("");
+	msm_dsi_phy_driver_unregister();
+	platform_driver_unregister(&dsi_driver);
+}
+
+int msm_dsi_modeset_init(struct msm_dsi *msm_dsi, struct drm_device *dev,
+			 struct drm_encoder *encoder)
+{
+	int ret;
+
+	msm_dsi->dev = dev;
+
+	ret = msm_dsi_host_modeset_init(msm_dsi->host, dev);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "failed to modeset init host: %d\n", ret);
+		return ret;
+	}
+
+	if (msm_dsi_is_bonded_dsi(msm_dsi) &&
+	    !msm_dsi_is_master_dsi(msm_dsi)) {
+		/*
+		 * Do not return an eror here,
+		 * Just skip creating encoder/connector for the slave-DSI.
+		 */
+		return 0;
+	}
+
+	msm_dsi->encoder = encoder;
+
+	ret = msm_dsi_manager_bridge_init(msm_dsi);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "failed to create dsi bridge: %d\n", ret);
+		return ret;
+	}
+
+	ret = msm_dsi_manager_ext_bridge_init(msm_dsi->id);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev,
+			"failed to create dsi connector: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+void msm_dsi_snapshot(struct msm_disp_state *disp_state, struct msm_dsi *msm_dsi)
+{
+	msm_dsi_host_snapshot(disp_state, msm_dsi->host);
+	msm_dsi_phy_snapshot(disp_state, msm_dsi->phy);
+}
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/dsi.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/dsi.h
@@ -0,0 +1,167 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __DSI_CONNECTOR_H__
+#define __DSI_CONNECTOR_H__
+
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+
+#include <drm/drm_bridge.h>
+#include <drm/drm_crtc.h>
+#include <drm/drm_mipi_dsi.h>
+
+#include "msm_drv.h"
+#include "disp/msm_disp_snapshot.h"
+
+#define DSI_0	0
+#define DSI_1	1
+#define DSI_MAX	2
+
+struct msm_dsi_phy_shared_timings;
+struct msm_dsi_phy_clk_request;
+
+enum msm_dsi_phy_usecase {
+	MSM_DSI_PHY_STANDALONE,
+	MSM_DSI_PHY_MASTER,
+	MSM_DSI_PHY_SLAVE,
+};
+
+#define DSI_BUS_CLK_MAX		4
+
+struct msm_dsi {
+	struct drm_device *dev;
+	struct platform_device *pdev;
+
+	/* internal dsi bridge attached to MDP interface */
+	struct drm_bridge *bridge;
+
+	struct mipi_dsi_host *host;
+	struct msm_dsi_phy *phy;
+
+	/*
+	 * external_bridge connected to dsi bridge output
+	 */
+	struct drm_bridge *external_bridge;
+
+	struct device *phy_dev;
+	bool phy_enabled;
+
+	/* the encoder we are hooked to (outside of dsi block) */
+	struct drm_encoder *encoder;
+
+	int id;
+};
+
+/* dsi manager */
+int msm_dsi_manager_bridge_init(struct msm_dsi *msm_dsi);
+int msm_dsi_manager_ext_bridge_init(u8 id);
+int msm_dsi_manager_cmd_xfer(int id, const struct mipi_dsi_msg *msg);
+bool msm_dsi_manager_cmd_xfer_trigger(int id, u32 dma_base, u32 len);
+int msm_dsi_manager_register(struct msm_dsi *msm_dsi);
+void msm_dsi_manager_unregister(struct msm_dsi *msm_dsi);
+void msm_dsi_manager_tpg_enable(void);
+
+/* msm dsi */
+static inline bool msm_dsi_device_connected(struct msm_dsi *msm_dsi)
+{
+	return msm_dsi->external_bridge;
+}
+
+/* dsi host */
+struct msm_dsi_host;
+int msm_dsi_host_xfer_prepare(struct mipi_dsi_host *host,
+					const struct mipi_dsi_msg *msg);
+void msm_dsi_host_xfer_restore(struct mipi_dsi_host *host,
+					const struct mipi_dsi_msg *msg);
+int msm_dsi_host_cmd_tx(struct mipi_dsi_host *host,
+					const struct mipi_dsi_msg *msg);
+int msm_dsi_host_cmd_rx(struct mipi_dsi_host *host,
+					const struct mipi_dsi_msg *msg);
+void msm_dsi_host_cmd_xfer_commit(struct mipi_dsi_host *host,
+					u32 dma_base, u32 len);
+int msm_dsi_host_enable(struct mipi_dsi_host *host);
+int msm_dsi_host_disable(struct mipi_dsi_host *host);
+void msm_dsi_host_enable_irq(struct mipi_dsi_host *host);
+void msm_dsi_host_disable_irq(struct mipi_dsi_host *host);
+int msm_dsi_host_power_on(struct mipi_dsi_host *host,
+			struct msm_dsi_phy_shared_timings *phy_shared_timings,
+			bool is_bonded_dsi, struct msm_dsi_phy *phy);
+int msm_dsi_host_power_off(struct mipi_dsi_host *host);
+int msm_dsi_host_set_display_mode(struct mipi_dsi_host *host,
+				  const struct drm_display_mode *mode);
+enum drm_mode_status msm_dsi_host_check_dsc(struct mipi_dsi_host *host,
+					    const struct drm_display_mode *mode);
+unsigned long msm_dsi_host_get_mode_flags(struct mipi_dsi_host *host);
+int msm_dsi_host_register(struct mipi_dsi_host *host);
+void msm_dsi_host_unregister(struct mipi_dsi_host *host);
+void msm_dsi_host_set_phy_mode(struct mipi_dsi_host *host,
+			struct msm_dsi_phy *src_phy);
+int msm_dsi_host_set_src_pll(struct mipi_dsi_host *host,
+			struct msm_dsi_phy *src_phy);
+void msm_dsi_host_reset_phy(struct mipi_dsi_host *host);
+void msm_dsi_host_get_phy_clk_req(struct mipi_dsi_host *host,
+	struct msm_dsi_phy_clk_request *clk_req,
+	bool is_bonded_dsi);
+void msm_dsi_host_destroy(struct mipi_dsi_host *host);
+int msm_dsi_host_modeset_init(struct mipi_dsi_host *host,
+					struct drm_device *dev);
+int msm_dsi_host_init(struct msm_dsi *msm_dsi);
+int msm_dsi_runtime_suspend(struct device *dev);
+int msm_dsi_runtime_resume(struct device *dev);
+int dsi_link_clk_set_rate_6g(struct msm_dsi_host *msm_host);
+int dsi_link_clk_set_rate_v2(struct msm_dsi_host *msm_host);
+int dsi_link_clk_enable_6g(struct msm_dsi_host *msm_host);
+int dsi_link_clk_enable_v2(struct msm_dsi_host *msm_host);
+void dsi_link_clk_disable_6g(struct msm_dsi_host *msm_host);
+void dsi_link_clk_disable_v2(struct msm_dsi_host *msm_host);
+unsigned long dsi_byte_clk_get_rate(struct mipi_dsi_host *host, bool is_bonded_dsi,
+				    const struct drm_display_mode *mode);
+int dsi_tx_buf_alloc_6g(struct msm_dsi_host *msm_host, int size);
+int dsi_tx_buf_alloc_v2(struct msm_dsi_host *msm_host, int size);
+void *dsi_tx_buf_get_6g(struct msm_dsi_host *msm_host);
+void *dsi_tx_buf_get_v2(struct msm_dsi_host *msm_host);
+void dsi_tx_buf_put_6g(struct msm_dsi_host *msm_host);
+void msm_dsi_tx_buf_free(struct mipi_dsi_host *mipi_host);
+int dsi_dma_base_get_6g(struct msm_dsi_host *msm_host, uint64_t *iova);
+int dsi_dma_base_get_v2(struct msm_dsi_host *msm_host, uint64_t *iova);
+int dsi_clk_init_v2(struct msm_dsi_host *msm_host);
+int dsi_clk_init_6g_v2(struct msm_dsi_host *msm_host);
+int dsi_calc_clk_rate_v2(struct msm_dsi_host *msm_host, bool is_bonded_dsi);
+int dsi_calc_clk_rate_6g(struct msm_dsi_host *msm_host, bool is_bonded_dsi);
+void msm_dsi_host_snapshot(struct msm_disp_state *disp_state, struct mipi_dsi_host *host);
+void msm_dsi_host_test_pattern_en(struct mipi_dsi_host *host);
+struct drm_dsc_config *msm_dsi_host_get_dsc_config(struct mipi_dsi_host *host);
+bool msm_dsi_host_is_wide_bus_enabled(struct mipi_dsi_host *host);
+
+/* dsi phy */
+struct msm_dsi_phy;
+struct msm_dsi_phy_shared_timings {
+	u32 clk_post;
+	u32 clk_pre;
+	bool clk_pre_inc_by_2;
+	bool byte_intf_clk_div_2;
+};
+
+struct msm_dsi_phy_clk_request {
+	unsigned long bitclk_rate;
+	unsigned long escclk_rate;
+};
+
+void msm_dsi_phy_driver_register(void);
+void msm_dsi_phy_driver_unregister(void);
+int msm_dsi_phy_enable(struct msm_dsi_phy *phy,
+			struct msm_dsi_phy_clk_request *clk_req,
+			struct msm_dsi_phy_shared_timings *shared_timings);
+void msm_dsi_phy_disable(struct msm_dsi_phy *phy);
+void msm_dsi_phy_set_usecase(struct msm_dsi_phy *phy,
+			     enum msm_dsi_phy_usecase uc);
+void msm_dsi_phy_pll_save_state(struct msm_dsi_phy *phy);
+int msm_dsi_phy_pll_restore_state(struct msm_dsi_phy *phy);
+void msm_dsi_phy_snapshot(struct msm_disp_state *disp_state, struct msm_dsi_phy *phy);
+bool msm_dsi_phy_set_continuous_clock(struct msm_dsi_phy *phy, bool enable);
+
+#endif /* __DSI_CONNECTOR_H__ */
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/dsi_cfg.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/dsi_cfg.c
@@ -0,0 +1,335 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#include "dsi_cfg.h"
+
+static const char * const dsi_v2_bus_clk_names[] = {
+	"core_mmss", "iface", "bus",
+};
+
+static const struct regulator_bulk_data apq8064_dsi_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 100000 },	/* 1.2 V */
+	{ .supply = "avdd", .init_load_uA = 10000 },	/* 3.0 V */
+	{ .supply = "vddio", .init_load_uA = 100000 },	/* 1.8 V */
+};
+
+static const struct msm_dsi_config apq8064_dsi_cfg = {
+	.io_offset = 0,
+	.regulator_data = apq8064_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(apq8064_dsi_regulators),
+	.bus_clk_names = dsi_v2_bus_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_v2_bus_clk_names),
+	.io_start = {
+		{ 0x4700000, 0x5800000 },
+	},
+};
+
+static const char * const dsi_6g_bus_clk_names[] = {
+	"mdp_core", "iface", "bus", "core_mmss",
+};
+
+static const struct regulator_bulk_data msm8974_apq8084_regulators[] = {
+	{ .supply = "vdd", .init_load_uA = 150000 },	/* 3.0 V */
+	{ .supply = "vdda", .init_load_uA = 100000 },	/* 1.2 V */
+	{ .supply = "vddio", .init_load_uA = 100000 },	/* 1.8 V */
+};
+
+static const struct msm_dsi_config msm8974_apq8084_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = msm8974_apq8084_regulators,
+	.num_regulators = ARRAY_SIZE(msm8974_apq8084_regulators),
+	.bus_clk_names = dsi_6g_bus_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_6g_bus_clk_names),
+	.io_start = {
+		{ 0xfd922800, 0xfd922b00 },
+	},
+};
+
+static const char * const dsi_v1_3_1_clk_names[] = {
+	"mdp_core", "iface", "bus",
+};
+
+static const struct regulator_bulk_data dsi_v1_3_1_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 100000 },	/* 1.2 V */
+	{ .supply = "vddio", .init_load_uA = 100000 },	/* 1.8 V */
+};
+
+static const struct msm_dsi_config msm8916_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = dsi_v1_3_1_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_v1_3_1_regulators),
+	.bus_clk_names = dsi_v1_3_1_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_v1_3_1_clk_names),
+	.io_start = {
+		{ 0x1a98000 },
+	},
+};
+
+static const struct msm_dsi_config msm8976_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = dsi_v1_3_1_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_v1_3_1_regulators),
+	.bus_clk_names = dsi_v1_3_1_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_v1_3_1_clk_names),
+	.io_start = {
+		{ 0x1a94000, 0x1a96000 },
+	},
+};
+
+static const struct regulator_bulk_data msm8994_dsi_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 100000 },	/* 1.25 V */
+	{ .supply = "vddio", .init_load_uA = 100000 },	/* 1.8 V */
+	{ .supply = "vcca", .init_load_uA = 10000 },	/* 1.0 V */
+	{ .supply = "vdd", .init_load_uA = 100000 },	/* 1.8 V */
+	{ .supply = "lab_reg", .init_load_uA = -1 },
+	{ .supply = "ibb_reg", .init_load_uA = -1 },
+};
+
+static const struct msm_dsi_config msm8994_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = msm8994_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(msm8994_dsi_regulators),
+	.bus_clk_names = dsi_6g_bus_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_6g_bus_clk_names),
+	.io_start = {
+		{ 0xfd998000, 0xfd9a0000 },
+	},
+};
+
+static const struct regulator_bulk_data msm8996_dsi_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 18160 },	/* 1.25 V */
+	{ .supply = "vcca", .init_load_uA = 17000 },	/* 0.925 V */
+	{ .supply = "vddio", .init_load_uA = 100000 },	/* 1.8 V */
+};
+
+static const struct msm_dsi_config msm8996_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = msm8996_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(msm8996_dsi_regulators),
+	.bus_clk_names = dsi_6g_bus_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_6g_bus_clk_names),
+	.io_start = {
+		{ 0x994000, 0x996000 },
+	},
+};
+
+static const char * const dsi_msm8998_bus_clk_names[] = {
+	"iface", "bus", "core",
+};
+
+static const struct regulator_bulk_data msm8998_dsi_regulators[] = {
+	{ .supply = "vdd", .init_load_uA = 367000 },	/* 0.9 V */
+	{ .supply = "vdda", .init_load_uA = 62800 },	/* 1.2 V */
+};
+
+static const struct msm_dsi_config msm8998_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = msm8998_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(msm8998_dsi_regulators),
+	.bus_clk_names = dsi_msm8998_bus_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_msm8998_bus_clk_names),
+	.io_start = {
+		{ 0xc994000, 0xc996000 },
+	},
+};
+
+static const char * const dsi_sdm660_bus_clk_names[] = {
+	"iface", "bus", "core", "core_mmss",
+};
+
+static const struct regulator_bulk_data sdm660_dsi_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 12560 },	/* 1.2 V */
+};
+
+static const struct msm_dsi_config sdm660_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = sdm660_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(sdm660_dsi_regulators),
+	.bus_clk_names = dsi_sdm660_bus_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_sdm660_bus_clk_names),
+	.io_start = {
+		{ 0xc994000, 0xc996000 },
+	},
+};
+
+static const char * const dsi_v2_4_clk_names[] = {
+	"iface", "bus",
+};
+
+static const struct regulator_bulk_data dsi_v2_4_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 21800 },	/* 1.2 V */
+	{ .supply = "refgen" },
+};
+
+static const struct msm_dsi_config sdm845_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = dsi_v2_4_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_v2_4_regulators),
+	.bus_clk_names = dsi_v2_4_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_v2_4_clk_names),
+	.io_start = {
+		{ 0xae94000, 0xae96000 }, /* SDM845 / SDM670 */
+		{ 0x5e94000 }, /* QCM2290 / SM6115 / SM6125 / SM6375 */
+	},
+};
+
+static const struct regulator_bulk_data sm8550_dsi_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 16800 },	/* 1.2 V */
+};
+
+static const struct msm_dsi_config sm8550_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = sm8550_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(sm8550_dsi_regulators),
+	.bus_clk_names = dsi_v2_4_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_v2_4_clk_names),
+	.io_start = {
+		{ 0xae94000, 0xae96000 },
+	},
+};
+
+static const struct regulator_bulk_data sm8650_dsi_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 16600 },	/* 1.2 V */
+};
+
+static const struct msm_dsi_config sm8650_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = sm8650_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(sm8650_dsi_regulators),
+	.bus_clk_names = dsi_v2_4_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_v2_4_clk_names),
+	.io_start = {
+		{ 0xae94000, 0xae96000 },
+	},
+};
+
+static const struct regulator_bulk_data sc7280_dsi_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 8350 },	/* 1.2 V */
+	{ .supply = "refgen" },
+};
+
+static const struct msm_dsi_config sc7280_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = sc7280_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(sc7280_dsi_regulators),
+	.bus_clk_names = dsi_v2_4_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_v2_4_clk_names),
+	.io_start = {
+		{ 0xae94000, 0xae96000 },
+	},
+};
+
+static const struct regulator_bulk_data sa8775_dsi_regulators[] = {
+	{ .supply = "vdda", .init_load_uA = 30100 },    /* 1.2 V */
+	{ .supply = "refgen" },
+};
+
+static const struct msm_dsi_config sa8775_dsi_cfg = {
+	.io_offset = DSI_6G_REG_SHIFT,
+	.regulator_data = sa8775_dsi_regulators,
+	.num_regulators = ARRAY_SIZE(sa8775_dsi_regulators),
+	.bus_clk_names = dsi_v2_4_clk_names,
+	.num_bus_clks = ARRAY_SIZE(dsi_v2_4_clk_names),
+	.io_start = {
+		{ 0xae94000, 0xae96000 },
+	},
+};
+
+static const struct msm_dsi_host_cfg_ops msm_dsi_v2_host_ops = {
+	.link_clk_set_rate = dsi_link_clk_set_rate_v2,
+	.link_clk_enable = dsi_link_clk_enable_v2,
+	.link_clk_disable = dsi_link_clk_disable_v2,
+	.clk_init_ver = dsi_clk_init_v2,
+	.tx_buf_alloc = dsi_tx_buf_alloc_v2,
+	.tx_buf_get = dsi_tx_buf_get_v2,
+	.tx_buf_put = NULL,
+	.dma_base_get = dsi_dma_base_get_v2,
+	.calc_clk_rate = dsi_calc_clk_rate_v2,
+};
+
+static const struct msm_dsi_host_cfg_ops msm_dsi_6g_host_ops = {
+	.link_clk_set_rate = dsi_link_clk_set_rate_6g,
+	.link_clk_enable = dsi_link_clk_enable_6g,
+	.link_clk_disable = dsi_link_clk_disable_6g,
+	.clk_init_ver = NULL,
+	.tx_buf_alloc = dsi_tx_buf_alloc_6g,
+	.tx_buf_get = dsi_tx_buf_get_6g,
+	.tx_buf_put = dsi_tx_buf_put_6g,
+	.dma_base_get = dsi_dma_base_get_6g,
+	.calc_clk_rate = dsi_calc_clk_rate_6g,
+};
+
+static const struct msm_dsi_host_cfg_ops msm_dsi_6g_v2_host_ops = {
+	.link_clk_set_rate = dsi_link_clk_set_rate_6g,
+	.link_clk_enable = dsi_link_clk_enable_6g,
+	.link_clk_disable = dsi_link_clk_disable_6g,
+	.clk_init_ver = dsi_clk_init_6g_v2,
+	.tx_buf_alloc = dsi_tx_buf_alloc_6g,
+	.tx_buf_get = dsi_tx_buf_get_6g,
+	.tx_buf_put = dsi_tx_buf_put_6g,
+	.dma_base_get = dsi_dma_base_get_6g,
+	.calc_clk_rate = dsi_calc_clk_rate_6g,
+};
+
+static const struct msm_dsi_cfg_handler dsi_cfg_handlers[] = {
+	{MSM_DSI_VER_MAJOR_V2, MSM_DSI_V2_VER_MINOR_8064,
+		&apq8064_dsi_cfg, &msm_dsi_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V1_0,
+		&msm8974_apq8084_dsi_cfg, &msm_dsi_6g_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V1_0_2,
+		&msm8974_apq8084_dsi_cfg, &msm_dsi_6g_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V1_1,
+		&msm8974_apq8084_dsi_cfg, &msm_dsi_6g_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V1_1_1,
+		&msm8974_apq8084_dsi_cfg, &msm_dsi_6g_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V1_2,
+		&msm8974_apq8084_dsi_cfg, &msm_dsi_6g_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V1_3,
+		&msm8994_dsi_cfg, &msm_dsi_6g_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V1_3_1,
+		&msm8916_dsi_cfg, &msm_dsi_6g_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V1_4_1,
+		&msm8996_dsi_cfg, &msm_dsi_6g_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V1_4_2,
+		&msm8976_dsi_cfg, &msm_dsi_6g_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_1_0,
+		&sdm660_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_2_0,
+		&msm8998_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_2_1,
+		&sdm845_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_3_0,
+		&sdm845_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_4_0,
+		&sdm845_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_4_1,
+		&sdm845_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_5_0,
+		&sc7280_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_6_0,
+		&sdm845_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_5_1,
+		&sa8775_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_7_0,
+		&sm8550_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+	{MSM_DSI_VER_MAJOR_6G, MSM_DSI_6G_VER_MINOR_V2_8_0,
+		&sm8650_dsi_cfg, &msm_dsi_6g_v2_host_ops},
+};
+
+const struct msm_dsi_cfg_handler *msm_dsi_cfg_get(u32 major, u32 minor)
+{
+	const struct msm_dsi_cfg_handler *cfg_hnd = NULL;
+	int i;
+
+	for (i = ARRAY_SIZE(dsi_cfg_handlers) - 1; i >= 0; i--) {
+		if ((dsi_cfg_handlers[i].major == major) &&
+			(dsi_cfg_handlers[i].minor == minor)) {
+			cfg_hnd = &dsi_cfg_handlers[i];
+			break;
+		}
+	}
+
+	return cfg_hnd;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/dsi_cfg.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/dsi_cfg.h
@@ -0,0 +1,72 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __MSM_DSI_CFG_H__
+#define __MSM_DSI_CFG_H__
+
+#include "dsi.h"
+
+#define MSM_DSI_VER_MAJOR_V2	0x02
+#define MSM_DSI_VER_MAJOR_6G	0x03
+#define MSM_DSI_6G_VER_MINOR_V1_0	0x10000000
+#define MSM_DSI_6G_VER_MINOR_V1_0_2	0x10000002
+#define MSM_DSI_6G_VER_MINOR_V1_1	0x10010000
+#define MSM_DSI_6G_VER_MINOR_V1_1_1	0x10010001
+#define MSM_DSI_6G_VER_MINOR_V1_2	0x10020000
+#define MSM_DSI_6G_VER_MINOR_V1_3	0x10030000
+#define MSM_DSI_6G_VER_MINOR_V1_3_1	0x10030001
+#define MSM_DSI_6G_VER_MINOR_V1_4_1	0x10040001
+#define MSM_DSI_6G_VER_MINOR_V1_4_2	0x10040002
+#define MSM_DSI_6G_VER_MINOR_V2_1_0	0x20010000
+#define MSM_DSI_6G_VER_MINOR_V2_2_0	0x20000000
+#define MSM_DSI_6G_VER_MINOR_V2_2_1	0x20020001
+#define MSM_DSI_6G_VER_MINOR_V2_3_0	0x20030000
+#define MSM_DSI_6G_VER_MINOR_V2_4_0	0x20040000
+#define MSM_DSI_6G_VER_MINOR_V2_4_1	0x20040001
+#define MSM_DSI_6G_VER_MINOR_V2_5_0	0x20050000
+#define MSM_DSI_6G_VER_MINOR_V2_5_1	0x20050001
+#define MSM_DSI_6G_VER_MINOR_V2_6_0	0x20060000
+#define MSM_DSI_6G_VER_MINOR_V2_7_0	0x20070000
+#define MSM_DSI_6G_VER_MINOR_V2_8_0	0x20080000
+
+#define MSM_DSI_V2_VER_MINOR_8064	0x0
+
+#define DSI_6G_REG_SHIFT	4
+
+/* Maximum number of configurations matched against the same hw revision */
+#define VARIANTS_MAX			2
+
+struct msm_dsi_config {
+	u32 io_offset;
+	const struct regulator_bulk_data *regulator_data;
+	int num_regulators;
+	const char * const *bus_clk_names;
+	const int num_bus_clks;
+	const resource_size_t io_start[VARIANTS_MAX][DSI_MAX];
+};
+
+struct msm_dsi_host_cfg_ops {
+	int (*link_clk_set_rate)(struct msm_dsi_host *msm_host);
+	int (*link_clk_enable)(struct msm_dsi_host *msm_host);
+	void (*link_clk_disable)(struct msm_dsi_host *msm_host);
+	int (*clk_init_ver)(struct msm_dsi_host *msm_host);
+	int (*tx_buf_alloc)(struct msm_dsi_host *msm_host, int size);
+	void* (*tx_buf_get)(struct msm_dsi_host *msm_host);
+	void (*tx_buf_put)(struct msm_dsi_host *msm_host);
+	int (*dma_base_get)(struct msm_dsi_host *msm_host, uint64_t *iova);
+	int (*calc_clk_rate)(struct msm_dsi_host *msm_host, bool is_bonded_dsi);
+};
+
+struct msm_dsi_cfg_handler {
+	u32 major;
+	u32 minor;
+	const struct msm_dsi_config *cfg;
+	const struct msm_dsi_host_cfg_ops *ops;
+};
+
+const struct msm_dsi_cfg_handler *msm_dsi_cfg_get(u32 major, u32 minor);
+
+#endif /* __MSM_DSI_CFG_H__ */
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/dsi_host.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/dsi_host.c
@@ -0,0 +1,2592 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/gpio/consumer.h>
+#include <linux/interrupt.h>
+#include <linux/mfd/syscon.h>
+#include <linux/of.h>
+#include <linux/of_graph.h>
+#include <linux/of_irq.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/pm_opp.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+#include <linux/spinlock.h>
+
+#include <video/mipi_display.h>
+
+#include <drm/display/drm_dsc_helper.h>
+#include <drm/drm_of.h>
+
+#include "dsi.h"
+#include "dsi.xml.h"
+#include "sfpb.xml.h"
+#include "dsi_cfg.h"
+#include "msm_dsc_helper.h"
+#include "msm_kms.h"
+#include "msm_gem.h"
+#include "phy/dsi_phy.h"
+
+#define DSI_RESET_TOGGLE_DELAY_MS 20
+
+static int dsi_populate_dsc_params(struct msm_dsi_host *msm_host, struct drm_dsc_config *dsc);
+
+static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor)
+{
+	u32 ver;
+
+	if (!major || !minor)
+		return -EINVAL;
+
+	/*
+	 * From DSI6G(v3), addition of a 6G_HW_VERSION register at offset 0
+	 * makes all other registers 4-byte shifted down.
+	 *
+	 * In order to identify between DSI6G(v3) and beyond, and DSIv2 and
+	 * older, we read the DSI_VERSION register without any shift(offset
+	 * 0x1f0). In the case of DSIv2, this hast to be a non-zero value. In
+	 * the case of DSI6G, this has to be zero (the offset points to a
+	 * scratch register which we never touch)
+	 */
+
+	ver = msm_readl(base + REG_DSI_VERSION);
+	if (ver) {
+		/* older dsi host, there is no register shift */
+		ver = FIELD(ver, DSI_VERSION_MAJOR);
+		if (ver <= MSM_DSI_VER_MAJOR_V2) {
+			/* old versions */
+			*major = ver;
+			*minor = 0;
+			return 0;
+		} else {
+			return -EINVAL;
+		}
+	} else {
+		/*
+		 * newer host, offset 0 has 6G_HW_VERSION, the rest of the
+		 * registers are shifted down, read DSI_VERSION again with
+		 * the shifted offset
+		 */
+		ver = msm_readl(base + DSI_6G_REG_SHIFT + REG_DSI_VERSION);
+		ver = FIELD(ver, DSI_VERSION_MAJOR);
+		if (ver == MSM_DSI_VER_MAJOR_6G) {
+			/* 6G version */
+			*major = ver;
+			*minor = msm_readl(base + REG_DSI_6G_HW_VERSION);
+			return 0;
+		} else {
+			return -EINVAL;
+		}
+	}
+}
+
+#define DSI_ERR_STATE_ACK			0x0000
+#define DSI_ERR_STATE_TIMEOUT			0x0001
+#define DSI_ERR_STATE_DLN0_PHY			0x0002
+#define DSI_ERR_STATE_FIFO			0x0004
+#define DSI_ERR_STATE_MDP_FIFO_UNDERFLOW	0x0008
+#define DSI_ERR_STATE_INTERLEAVE_OP_CONTENTION	0x0010
+#define DSI_ERR_STATE_PLL_UNLOCKED		0x0020
+
+#define DSI_CLK_CTRL_ENABLE_CLKS	\
+		(DSI_CLK_CTRL_AHBS_HCLK_ON | DSI_CLK_CTRL_AHBM_SCLK_ON | \
+		DSI_CLK_CTRL_PCLK_ON | DSI_CLK_CTRL_DSICLK_ON | \
+		DSI_CLK_CTRL_BYTECLK_ON | DSI_CLK_CTRL_ESCCLK_ON | \
+		DSI_CLK_CTRL_FORCE_ON_DYN_AHBM_HCLK)
+
+struct msm_dsi_host {
+	struct mipi_dsi_host base;
+
+	struct platform_device *pdev;
+	struct drm_device *dev;
+
+	int id;
+
+	void __iomem *ctrl_base;
+	phys_addr_t ctrl_size;
+	struct regulator_bulk_data *supplies;
+
+	int num_bus_clks;
+	struct clk_bulk_data bus_clks[DSI_BUS_CLK_MAX];
+
+	struct clk *byte_clk;
+	struct clk *esc_clk;
+	struct clk *pixel_clk;
+	struct clk *byte_intf_clk;
+
+	unsigned long byte_clk_rate;
+	unsigned long byte_intf_clk_rate;
+	unsigned long pixel_clk_rate;
+	unsigned long esc_clk_rate;
+
+	/* DSI v2 specific clocks */
+	struct clk *src_clk;
+
+	unsigned long src_clk_rate;
+
+	struct gpio_desc *disp_en_gpio;
+	struct gpio_desc *te_gpio;
+
+	const struct msm_dsi_cfg_handler *cfg_hnd;
+
+	struct completion dma_comp;
+	struct completion video_comp;
+	struct mutex dev_mutex;
+	struct mutex cmd_mutex;
+	spinlock_t intr_lock; /* Protect interrupt ctrl register */
+
+	u32 err_work_state;
+	struct work_struct err_work;
+	struct workqueue_struct *workqueue;
+
+	/* DSI 6G TX buffer*/
+	struct drm_gem_object *tx_gem_obj;
+	struct msm_gem_address_space *aspace;
+
+	/* DSI v2 TX buffer */
+	void *tx_buf;
+	dma_addr_t tx_buf_paddr;
+
+	int tx_size;
+
+	u8 *rx_buf;
+
+	struct regmap *sfpb;
+
+	struct drm_display_mode *mode;
+	struct drm_dsc_config *dsc;
+
+	/* connected device info */
+	unsigned int channel;
+	unsigned int lanes;
+	enum mipi_dsi_pixel_format format;
+	unsigned long mode_flags;
+
+	/* lane data parsed via DT */
+	int dlane_swap;
+	int num_data_lanes;
+
+	/* from phy DT */
+	bool cphy_mode;
+
+	u32 dma_cmd_ctrl_restore;
+
+	bool registered;
+	bool power_on;
+	bool enabled;
+	int irq;
+};
+
+static u32 dsi_get_bpp(const enum mipi_dsi_pixel_format fmt)
+{
+	switch (fmt) {
+	case MIPI_DSI_FMT_RGB565:		return 16;
+	case MIPI_DSI_FMT_RGB666_PACKED:	return 18;
+	case MIPI_DSI_FMT_RGB666:
+	case MIPI_DSI_FMT_RGB888:
+	default:				return 24;
+	}
+}
+
+static inline u32 dsi_read(struct msm_dsi_host *msm_host, u32 reg)
+{
+	return msm_readl(msm_host->ctrl_base + reg);
+}
+static inline void dsi_write(struct msm_dsi_host *msm_host, u32 reg, u32 data)
+{
+	msm_writel(data, msm_host->ctrl_base + reg);
+}
+
+static const struct msm_dsi_cfg_handler *dsi_get_config(
+						struct msm_dsi_host *msm_host)
+{
+	const struct msm_dsi_cfg_handler *cfg_hnd = NULL;
+	struct device *dev = &msm_host->pdev->dev;
+	struct clk *ahb_clk;
+	int ret;
+	u32 major = 0, minor = 0;
+
+	ahb_clk = msm_clk_get(msm_host->pdev, "iface");
+	if (IS_ERR(ahb_clk)) {
+		pr_err("%s: cannot get interface clock\n", __func__);
+		goto exit;
+	}
+
+	pm_runtime_get_sync(dev);
+
+	ret = clk_prepare_enable(ahb_clk);
+	if (ret) {
+		pr_err("%s: unable to enable ahb_clk\n", __func__);
+		goto runtime_put;
+	}
+
+	ret = dsi_get_version(msm_host->ctrl_base, &major, &minor);
+	if (ret) {
+		pr_err("%s: Invalid version\n", __func__);
+		goto disable_clks;
+	}
+
+	cfg_hnd = msm_dsi_cfg_get(major, minor);
+
+	DBG("%s: Version %x:%x\n", __func__, major, minor);
+
+disable_clks:
+	clk_disable_unprepare(ahb_clk);
+runtime_put:
+	pm_runtime_put_sync(dev);
+exit:
+	return cfg_hnd;
+}
+
+static inline struct msm_dsi_host *to_msm_dsi_host(struct mipi_dsi_host *host)
+{
+	return container_of(host, struct msm_dsi_host, base);
+}
+
+int dsi_clk_init_v2(struct msm_dsi_host *msm_host)
+{
+	struct platform_device *pdev = msm_host->pdev;
+	int ret = 0;
+
+	msm_host->src_clk = msm_clk_get(pdev, "src");
+
+	if (IS_ERR(msm_host->src_clk)) {
+		ret = PTR_ERR(msm_host->src_clk);
+		pr_err("%s: can't find src clock. ret=%d\n",
+			__func__, ret);
+		msm_host->src_clk = NULL;
+		return ret;
+	}
+
+	return ret;
+}
+
+int dsi_clk_init_6g_v2(struct msm_dsi_host *msm_host)
+{
+	struct platform_device *pdev = msm_host->pdev;
+	int ret = 0;
+
+	msm_host->byte_intf_clk = msm_clk_get(pdev, "byte_intf");
+	if (IS_ERR(msm_host->byte_intf_clk)) {
+		ret = PTR_ERR(msm_host->byte_intf_clk);
+		pr_err("%s: can't find byte_intf clock. ret=%d\n",
+			__func__, ret);
+	}
+
+	return ret;
+}
+
+static int dsi_clk_init(struct msm_dsi_host *msm_host)
+{
+	struct platform_device *pdev = msm_host->pdev;
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+	const struct msm_dsi_config *cfg = cfg_hnd->cfg;
+	int i, ret = 0;
+
+	/* get bus clocks */
+	for (i = 0; i < cfg->num_bus_clks; i++)
+		msm_host->bus_clks[i].id = cfg->bus_clk_names[i];
+	msm_host->num_bus_clks = cfg->num_bus_clks;
+
+	ret = devm_clk_bulk_get(&pdev->dev, msm_host->num_bus_clks, msm_host->bus_clks);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "Unable to get clocks, ret = %d\n", ret);
+		goto exit;
+	}
+
+	/* get link and source clocks */
+	msm_host->byte_clk = msm_clk_get(pdev, "byte");
+	if (IS_ERR(msm_host->byte_clk)) {
+		ret = PTR_ERR(msm_host->byte_clk);
+		pr_err("%s: can't find dsi_byte clock. ret=%d\n",
+			__func__, ret);
+		msm_host->byte_clk = NULL;
+		goto exit;
+	}
+
+	msm_host->pixel_clk = msm_clk_get(pdev, "pixel");
+	if (IS_ERR(msm_host->pixel_clk)) {
+		ret = PTR_ERR(msm_host->pixel_clk);
+		pr_err("%s: can't find dsi_pixel clock. ret=%d\n",
+			__func__, ret);
+		msm_host->pixel_clk = NULL;
+		goto exit;
+	}
+
+	msm_host->esc_clk = msm_clk_get(pdev, "core");
+	if (IS_ERR(msm_host->esc_clk)) {
+		ret = PTR_ERR(msm_host->esc_clk);
+		pr_err("%s: can't find dsi_esc clock. ret=%d\n",
+			__func__, ret);
+		msm_host->esc_clk = NULL;
+		goto exit;
+	}
+
+	if (cfg_hnd->ops->clk_init_ver)
+		ret = cfg_hnd->ops->clk_init_ver(msm_host);
+exit:
+	return ret;
+}
+
+int msm_dsi_runtime_suspend(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct msm_dsi *msm_dsi = platform_get_drvdata(pdev);
+	struct mipi_dsi_host *host = msm_dsi->host;
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	if (!msm_host->cfg_hnd)
+		return 0;
+
+	clk_bulk_disable_unprepare(msm_host->num_bus_clks, msm_host->bus_clks);
+
+	return 0;
+}
+
+int msm_dsi_runtime_resume(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct msm_dsi *msm_dsi = platform_get_drvdata(pdev);
+	struct mipi_dsi_host *host = msm_dsi->host;
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	if (!msm_host->cfg_hnd)
+		return 0;
+
+	return clk_bulk_prepare_enable(msm_host->num_bus_clks, msm_host->bus_clks);
+}
+
+int dsi_link_clk_set_rate_6g(struct msm_dsi_host *msm_host)
+{
+	int ret;
+
+	DBG("Set clk rates: pclk=%lu, byteclk=%lu",
+	    msm_host->pixel_clk_rate, msm_host->byte_clk_rate);
+
+	ret = dev_pm_opp_set_rate(&msm_host->pdev->dev,
+				  msm_host->byte_clk_rate);
+	if (ret) {
+		pr_err("%s: dev_pm_opp_set_rate failed %d\n", __func__, ret);
+		return ret;
+	}
+
+	ret = clk_set_rate(msm_host->pixel_clk, msm_host->pixel_clk_rate);
+	if (ret) {
+		pr_err("%s: Failed to set rate pixel clk, %d\n", __func__, ret);
+		return ret;
+	}
+
+	if (msm_host->byte_intf_clk) {
+		ret = clk_set_rate(msm_host->byte_intf_clk, msm_host->byte_intf_clk_rate);
+		if (ret) {
+			pr_err("%s: Failed to set rate byte intf clk, %d\n",
+			       __func__, ret);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+
+int dsi_link_clk_enable_6g(struct msm_dsi_host *msm_host)
+{
+	int ret;
+
+	ret = clk_prepare_enable(msm_host->esc_clk);
+	if (ret) {
+		pr_err("%s: Failed to enable dsi esc clk\n", __func__);
+		goto error;
+	}
+
+	ret = clk_prepare_enable(msm_host->byte_clk);
+	if (ret) {
+		pr_err("%s: Failed to enable dsi byte clk\n", __func__);
+		goto byte_clk_err;
+	}
+
+	ret = clk_prepare_enable(msm_host->pixel_clk);
+	if (ret) {
+		pr_err("%s: Failed to enable dsi pixel clk\n", __func__);
+		goto pixel_clk_err;
+	}
+
+	ret = clk_prepare_enable(msm_host->byte_intf_clk);
+	if (ret) {
+		pr_err("%s: Failed to enable byte intf clk\n",
+			   __func__);
+		goto byte_intf_clk_err;
+	}
+
+	return 0;
+
+byte_intf_clk_err:
+	clk_disable_unprepare(msm_host->pixel_clk);
+pixel_clk_err:
+	clk_disable_unprepare(msm_host->byte_clk);
+byte_clk_err:
+	clk_disable_unprepare(msm_host->esc_clk);
+error:
+	return ret;
+}
+
+int dsi_link_clk_set_rate_v2(struct msm_dsi_host *msm_host)
+{
+	int ret;
+
+	DBG("Set clk rates: pclk=%lu, byteclk=%lu, esc_clk=%lu, dsi_src_clk=%lu",
+	    msm_host->pixel_clk_rate, msm_host->byte_clk_rate,
+	    msm_host->esc_clk_rate, msm_host->src_clk_rate);
+
+	ret = clk_set_rate(msm_host->byte_clk, msm_host->byte_clk_rate);
+	if (ret) {
+		pr_err("%s: Failed to set rate byte clk, %d\n", __func__, ret);
+		return ret;
+	}
+
+	ret = clk_set_rate(msm_host->esc_clk, msm_host->esc_clk_rate);
+	if (ret) {
+		pr_err("%s: Failed to set rate esc clk, %d\n", __func__, ret);
+		return ret;
+	}
+
+	ret = clk_set_rate(msm_host->src_clk, msm_host->src_clk_rate);
+	if (ret) {
+		pr_err("%s: Failed to set rate src clk, %d\n", __func__, ret);
+		return ret;
+	}
+
+	ret = clk_set_rate(msm_host->pixel_clk, msm_host->pixel_clk_rate);
+	if (ret) {
+		pr_err("%s: Failed to set rate pixel clk, %d\n", __func__, ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+int dsi_link_clk_enable_v2(struct msm_dsi_host *msm_host)
+{
+	int ret;
+
+	ret = clk_prepare_enable(msm_host->byte_clk);
+	if (ret) {
+		pr_err("%s: Failed to enable dsi byte clk\n", __func__);
+		goto error;
+	}
+
+	ret = clk_prepare_enable(msm_host->esc_clk);
+	if (ret) {
+		pr_err("%s: Failed to enable dsi esc clk\n", __func__);
+		goto esc_clk_err;
+	}
+
+	ret = clk_prepare_enable(msm_host->src_clk);
+	if (ret) {
+		pr_err("%s: Failed to enable dsi src clk\n", __func__);
+		goto src_clk_err;
+	}
+
+	ret = clk_prepare_enable(msm_host->pixel_clk);
+	if (ret) {
+		pr_err("%s: Failed to enable dsi pixel clk\n", __func__);
+		goto pixel_clk_err;
+	}
+
+	return 0;
+
+pixel_clk_err:
+	clk_disable_unprepare(msm_host->src_clk);
+src_clk_err:
+	clk_disable_unprepare(msm_host->esc_clk);
+esc_clk_err:
+	clk_disable_unprepare(msm_host->byte_clk);
+error:
+	return ret;
+}
+
+void dsi_link_clk_disable_6g(struct msm_dsi_host *msm_host)
+{
+	/* Drop the performance state vote */
+	dev_pm_opp_set_rate(&msm_host->pdev->dev, 0);
+	clk_disable_unprepare(msm_host->esc_clk);
+	clk_disable_unprepare(msm_host->pixel_clk);
+	clk_disable_unprepare(msm_host->byte_intf_clk);
+	clk_disable_unprepare(msm_host->byte_clk);
+}
+
+void dsi_link_clk_disable_v2(struct msm_dsi_host *msm_host)
+{
+	clk_disable_unprepare(msm_host->pixel_clk);
+	clk_disable_unprepare(msm_host->src_clk);
+	clk_disable_unprepare(msm_host->esc_clk);
+	clk_disable_unprepare(msm_host->byte_clk);
+}
+
+static unsigned long dsi_adjust_pclk_for_compression(const struct drm_display_mode *mode,
+		const struct drm_dsc_config *dsc)
+{
+	int new_hdisplay = DIV_ROUND_UP(mode->hdisplay * drm_dsc_get_bpp_int(dsc),
+			dsc->bits_per_component * 3);
+
+	int new_htotal = mode->htotal - mode->hdisplay + new_hdisplay;
+
+	return new_htotal * mode->vtotal * drm_mode_vrefresh(mode);
+}
+
+static unsigned long dsi_get_pclk_rate(const struct drm_display_mode *mode,
+		const struct drm_dsc_config *dsc, bool is_bonded_dsi)
+{
+	unsigned long pclk_rate;
+
+	pclk_rate = mode->clock * 1000;
+
+	if (dsc)
+		pclk_rate = dsi_adjust_pclk_for_compression(mode, dsc);
+
+	/*
+	 * For bonded DSI mode, the current DRM mode has the complete width of the
+	 * panel. Since, the complete panel is driven by two DSI controllers,
+	 * the clock rates have to be split between the two dsi controllers.
+	 * Adjust the byte and pixel clock rates for each dsi host accordingly.
+	 */
+	if (is_bonded_dsi)
+		pclk_rate /= 2;
+
+	return pclk_rate;
+}
+
+unsigned long dsi_byte_clk_get_rate(struct mipi_dsi_host *host, bool is_bonded_dsi,
+				    const struct drm_display_mode *mode)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	u8 lanes = msm_host->lanes;
+	u32 bpp = dsi_get_bpp(msm_host->format);
+	unsigned long pclk_rate = dsi_get_pclk_rate(mode, msm_host->dsc, is_bonded_dsi);
+	unsigned long pclk_bpp;
+
+	if (lanes == 0) {
+		pr_err("%s: forcing mdss_dsi lanes to 1\n", __func__);
+		lanes = 1;
+	}
+
+	/* CPHY "byte_clk" is in units of 16 bits */
+	if (msm_host->cphy_mode)
+		pclk_bpp = mult_frac(pclk_rate, bpp, 16 * lanes);
+	else
+		pclk_bpp = mult_frac(pclk_rate, bpp, 8 * lanes);
+
+	return pclk_bpp;
+}
+
+static void dsi_calc_pclk(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
+{
+	msm_host->pixel_clk_rate = dsi_get_pclk_rate(msm_host->mode, msm_host->dsc, is_bonded_dsi);
+	msm_host->byte_clk_rate = dsi_byte_clk_get_rate(&msm_host->base, is_bonded_dsi,
+							msm_host->mode);
+
+	DBG("pclk=%lu, bclk=%lu", msm_host->pixel_clk_rate,
+				msm_host->byte_clk_rate);
+
+}
+
+int dsi_calc_clk_rate_6g(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
+{
+	if (!msm_host->mode) {
+		pr_err("%s: mode not set\n", __func__);
+		return -EINVAL;
+	}
+
+	dsi_calc_pclk(msm_host, is_bonded_dsi);
+	msm_host->esc_clk_rate = clk_get_rate(msm_host->esc_clk);
+	return 0;
+}
+
+int dsi_calc_clk_rate_v2(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
+{
+	u32 bpp = dsi_get_bpp(msm_host->format);
+	unsigned int esc_mhz, esc_div;
+	unsigned long byte_mhz;
+
+	dsi_calc_pclk(msm_host, is_bonded_dsi);
+
+	msm_host->src_clk_rate = mult_frac(msm_host->pixel_clk_rate, bpp, 8);
+
+	/*
+	 * esc clock is byte clock followed by a 4 bit divider,
+	 * we need to find an escape clock frequency within the
+	 * mipi DSI spec range within the maximum divider limit
+	 * We iterate here between an escape clock frequencey
+	 * between 20 Mhz to 5 Mhz and pick up the first one
+	 * that can be supported by our divider
+	 */
+
+	byte_mhz = msm_host->byte_clk_rate / 1000000;
+
+	for (esc_mhz = 20; esc_mhz >= 5; esc_mhz--) {
+		esc_div = DIV_ROUND_UP(byte_mhz, esc_mhz);
+
+		/*
+		 * TODO: Ideally, we shouldn't know what sort of divider
+		 * is available in mmss_cc, we're just assuming that
+		 * it'll always be a 4 bit divider. Need to come up with
+		 * a better way here.
+		 */
+		if (esc_div >= 1 && esc_div <= 16)
+			break;
+	}
+
+	if (esc_mhz < 5)
+		return -EINVAL;
+
+	msm_host->esc_clk_rate = msm_host->byte_clk_rate / esc_div;
+
+	DBG("esc=%lu, src=%lu", msm_host->esc_clk_rate,
+		msm_host->src_clk_rate);
+
+	return 0;
+}
+
+static void dsi_intr_ctrl(struct msm_dsi_host *msm_host, u32 mask, int enable)
+{
+	u32 intr;
+	unsigned long flags;
+
+	spin_lock_irqsave(&msm_host->intr_lock, flags);
+	intr = dsi_read(msm_host, REG_DSI_INTR_CTRL);
+
+	if (enable)
+		intr |= mask;
+	else
+		intr &= ~mask;
+
+	DBG("intr=%x enable=%d", intr, enable);
+
+	dsi_write(msm_host, REG_DSI_INTR_CTRL, intr);
+	spin_unlock_irqrestore(&msm_host->intr_lock, flags);
+}
+
+static inline enum dsi_traffic_mode dsi_get_traffic_mode(const u32 mode_flags)
+{
+	if (mode_flags & MIPI_DSI_MODE_VIDEO_BURST)
+		return BURST_MODE;
+	else if (mode_flags & MIPI_DSI_MODE_VIDEO_SYNC_PULSE)
+		return NON_BURST_SYNCH_PULSE;
+
+	return NON_BURST_SYNCH_EVENT;
+}
+
+static inline enum dsi_vid_dst_format dsi_get_vid_fmt(
+				const enum mipi_dsi_pixel_format mipi_fmt)
+{
+	switch (mipi_fmt) {
+	case MIPI_DSI_FMT_RGB888:	return VID_DST_FORMAT_RGB888;
+	case MIPI_DSI_FMT_RGB666:	return VID_DST_FORMAT_RGB666_LOOSE;
+	case MIPI_DSI_FMT_RGB666_PACKED:	return VID_DST_FORMAT_RGB666;
+	case MIPI_DSI_FMT_RGB565:	return VID_DST_FORMAT_RGB565;
+	default:			return VID_DST_FORMAT_RGB888;
+	}
+}
+
+static inline enum dsi_cmd_dst_format dsi_get_cmd_fmt(
+				const enum mipi_dsi_pixel_format mipi_fmt)
+{
+	switch (mipi_fmt) {
+	case MIPI_DSI_FMT_RGB888:	return CMD_DST_FORMAT_RGB888;
+	case MIPI_DSI_FMT_RGB666_PACKED:
+	case MIPI_DSI_FMT_RGB666:	return CMD_DST_FORMAT_RGB666;
+	case MIPI_DSI_FMT_RGB565:	return CMD_DST_FORMAT_RGB565;
+	default:			return CMD_DST_FORMAT_RGB888;
+	}
+}
+
+static void dsi_ctrl_disable(struct msm_dsi_host *msm_host)
+{
+	dsi_write(msm_host, REG_DSI_CTRL, 0);
+}
+
+bool msm_dsi_host_is_wide_bus_enabled(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	return msm_host->dsc &&
+		(msm_host->cfg_hnd->major == MSM_DSI_VER_MAJOR_6G &&
+		 msm_host->cfg_hnd->minor >= MSM_DSI_6G_VER_MINOR_V2_5_0);
+}
+
+static void dsi_ctrl_enable(struct msm_dsi_host *msm_host,
+			struct msm_dsi_phy_shared_timings *phy_shared_timings, struct msm_dsi_phy *phy)
+{
+	u32 flags = msm_host->mode_flags;
+	enum mipi_dsi_pixel_format mipi_fmt = msm_host->format;
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+	u32 data = 0, lane_ctrl = 0;
+
+	if (flags & MIPI_DSI_MODE_VIDEO) {
+		if (flags & MIPI_DSI_MODE_VIDEO_HSE)
+			data |= DSI_VID_CFG0_PULSE_MODE_HSA_HE;
+		if (flags & MIPI_DSI_MODE_VIDEO_NO_HFP)
+			data |= DSI_VID_CFG0_HFP_POWER_STOP;
+		if (flags & MIPI_DSI_MODE_VIDEO_NO_HBP)
+			data |= DSI_VID_CFG0_HBP_POWER_STOP;
+		if (flags & MIPI_DSI_MODE_VIDEO_NO_HSA)
+			data |= DSI_VID_CFG0_HSA_POWER_STOP;
+		/* Always set low power stop mode for BLLP
+		 * to let command engine send packets
+		 */
+		data |= DSI_VID_CFG0_EOF_BLLP_POWER_STOP |
+			DSI_VID_CFG0_BLLP_POWER_STOP;
+		data |= DSI_VID_CFG0_TRAFFIC_MODE(dsi_get_traffic_mode(flags));
+		data |= DSI_VID_CFG0_DST_FORMAT(dsi_get_vid_fmt(mipi_fmt));
+		data |= DSI_VID_CFG0_VIRT_CHANNEL(msm_host->channel);
+		if (msm_dsi_host_is_wide_bus_enabled(&msm_host->base))
+			data |= DSI_VID_CFG0_DATABUS_WIDEN;
+		dsi_write(msm_host, REG_DSI_VID_CFG0, data);
+
+		/* Do not swap RGB colors */
+		data = DSI_VID_CFG1_RGB_SWAP(SWAP_RGB);
+		dsi_write(msm_host, REG_DSI_VID_CFG1, 0);
+	} else {
+		/* Do not swap RGB colors */
+		data = DSI_CMD_CFG0_RGB_SWAP(SWAP_RGB);
+		data |= DSI_CMD_CFG0_DST_FORMAT(dsi_get_cmd_fmt(mipi_fmt));
+		dsi_write(msm_host, REG_DSI_CMD_CFG0, data);
+
+		data = DSI_CMD_CFG1_WR_MEM_START(MIPI_DCS_WRITE_MEMORY_START) |
+			DSI_CMD_CFG1_WR_MEM_CONTINUE(
+					MIPI_DCS_WRITE_MEMORY_CONTINUE);
+		/* Always insert DCS command */
+		data |= DSI_CMD_CFG1_INSERT_DCS_COMMAND;
+		dsi_write(msm_host, REG_DSI_CMD_CFG1, data);
+
+		if (cfg_hnd->major == MSM_DSI_VER_MAJOR_6G) {
+			data = dsi_read(msm_host, REG_DSI_CMD_MODE_MDP_CTRL2);
+
+			if (cfg_hnd->minor >= MSM_DSI_6G_VER_MINOR_V1_3)
+				data |= DSI_CMD_MODE_MDP_CTRL2_BURST_MODE;
+
+			if (msm_dsi_host_is_wide_bus_enabled(&msm_host->base))
+				data |= DSI_CMD_MODE_MDP_CTRL2_DATABUS_WIDEN;
+
+			dsi_write(msm_host, REG_DSI_CMD_MODE_MDP_CTRL2, data);
+		}
+	}
+
+	dsi_write(msm_host, REG_DSI_CMD_DMA_CTRL,
+			DSI_CMD_DMA_CTRL_FROM_FRAME_BUFFER |
+			DSI_CMD_DMA_CTRL_LOW_POWER);
+
+	data = 0;
+	/* Always assume dedicated TE pin */
+	data |= DSI_TRIG_CTRL_TE;
+	data |= DSI_TRIG_CTRL_MDP_TRIGGER(TRIGGER_NONE);
+	data |= DSI_TRIG_CTRL_DMA_TRIGGER(TRIGGER_SW);
+	data |= DSI_TRIG_CTRL_STREAM(msm_host->channel);
+	if ((cfg_hnd->major == MSM_DSI_VER_MAJOR_6G) &&
+		(cfg_hnd->minor >= MSM_DSI_6G_VER_MINOR_V1_2))
+		data |= DSI_TRIG_CTRL_BLOCK_DMA_WITHIN_FRAME;
+	dsi_write(msm_host, REG_DSI_TRIG_CTRL, data);
+
+	data = DSI_CLKOUT_TIMING_CTRL_T_CLK_POST(phy_shared_timings->clk_post) |
+		DSI_CLKOUT_TIMING_CTRL_T_CLK_PRE(phy_shared_timings->clk_pre);
+	dsi_write(msm_host, REG_DSI_CLKOUT_TIMING_CTRL, data);
+
+	if ((cfg_hnd->major == MSM_DSI_VER_MAJOR_6G) &&
+	    (cfg_hnd->minor > MSM_DSI_6G_VER_MINOR_V1_0) &&
+	    phy_shared_timings->clk_pre_inc_by_2)
+		dsi_write(msm_host, REG_DSI_T_CLK_PRE_EXTEND,
+			  DSI_T_CLK_PRE_EXTEND_INC_BY_2_BYTECLK);
+
+	data = 0;
+	if (!(flags & MIPI_DSI_MODE_NO_EOT_PACKET))
+		data |= DSI_EOT_PACKET_CTRL_TX_EOT_APPEND;
+	dsi_write(msm_host, REG_DSI_EOT_PACKET_CTRL, data);
+
+	/* allow only ack-err-status to generate interrupt */
+	dsi_write(msm_host, REG_DSI_ERR_INT_MASK0, 0x13ff3fe0);
+
+	dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_ERROR, 1);
+
+	dsi_write(msm_host, REG_DSI_CLK_CTRL, DSI_CLK_CTRL_ENABLE_CLKS);
+
+	data = DSI_CTRL_CLK_EN;
+
+	DBG("lane number=%d", msm_host->lanes);
+	data |= ((DSI_CTRL_LANE0 << msm_host->lanes) - DSI_CTRL_LANE0);
+
+	dsi_write(msm_host, REG_DSI_LANE_SWAP_CTRL,
+		  DSI_LANE_SWAP_CTRL_DLN_SWAP_SEL(msm_host->dlane_swap));
+
+	if (!(flags & MIPI_DSI_CLOCK_NON_CONTINUOUS)) {
+		lane_ctrl = dsi_read(msm_host, REG_DSI_LANE_CTRL);
+
+		if (msm_dsi_phy_set_continuous_clock(phy, true))
+			lane_ctrl &= ~DSI_LANE_CTRL_HS_REQ_SEL_PHY;
+
+		dsi_write(msm_host, REG_DSI_LANE_CTRL,
+			lane_ctrl | DSI_LANE_CTRL_CLKLN_HS_FORCE_REQUEST);
+	}
+
+	data |= DSI_CTRL_ENABLE;
+
+	dsi_write(msm_host, REG_DSI_CTRL, data);
+
+	if (msm_host->cphy_mode)
+		dsi_write(msm_host, REG_DSI_CPHY_MODE_CTRL, BIT(0));
+}
+
+static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mode, u32 hdisplay)
+{
+	struct drm_dsc_config *dsc = msm_host->dsc;
+	u32 reg, reg_ctrl, reg_ctrl2;
+	u32 slice_per_intf, total_bytes_per_intf;
+	u32 pkt_per_line;
+	u32 eol_byte_num;
+	u32 bytes_per_pkt;
+
+	/* first calculate dsc parameters and then program
+	 * compress mode registers
+	 */
+	slice_per_intf = msm_dsc_get_slices_per_intf(dsc, hdisplay);
+
+	total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf;
+	bytes_per_pkt = dsc->slice_chunk_size; /* * slice_per_pkt; */
+
+	eol_byte_num = total_bytes_per_intf % 3;
+
+	/*
+	 * Typically, pkt_per_line = slice_per_intf * slice_per_pkt.
+	 *
+	 * Since the current driver only supports slice_per_pkt = 1,
+	 * pkt_per_line will be equal to slice per intf for now.
+	 */
+	pkt_per_line = slice_per_intf;
+
+	if (is_cmd_mode) /* packet data type */
+		reg = DSI_COMMAND_COMPRESSION_MODE_CTRL_STREAM0_DATATYPE(MIPI_DSI_DCS_LONG_WRITE);
+	else
+		reg = DSI_VIDEO_COMPRESSION_MODE_CTRL_DATATYPE(MIPI_DSI_COMPRESSED_PIXEL_STREAM);
+
+	/* DSI_VIDEO_COMPRESSION_MODE & DSI_COMMAND_COMPRESSION_MODE
+	 * registers have similar offsets, so for below common code use
+	 * DSI_VIDEO_COMPRESSION_MODE_XXXX for setting bits
+	 */
+	reg |= DSI_VIDEO_COMPRESSION_MODE_CTRL_PKT_PER_LINE(pkt_per_line >> 1);
+	reg |= DSI_VIDEO_COMPRESSION_MODE_CTRL_EOL_BYTE_NUM(eol_byte_num);
+	reg |= DSI_VIDEO_COMPRESSION_MODE_CTRL_EN;
+
+	if (is_cmd_mode) {
+		reg_ctrl = dsi_read(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL);
+		reg_ctrl2 = dsi_read(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL2);
+
+		reg_ctrl &= ~0xffff;
+		reg_ctrl |= reg;
+
+		reg_ctrl2 &= ~DSI_COMMAND_COMPRESSION_MODE_CTRL2_STREAM0_SLICE_WIDTH__MASK;
+		reg_ctrl2 |= DSI_COMMAND_COMPRESSION_MODE_CTRL2_STREAM0_SLICE_WIDTH(dsc->slice_chunk_size);
+
+		dsi_write(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL, reg_ctrl);
+		dsi_write(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL2, reg_ctrl2);
+	} else {
+		reg |= DSI_VIDEO_COMPRESSION_MODE_CTRL_WC(bytes_per_pkt);
+		dsi_write(msm_host, REG_DSI_VIDEO_COMPRESSION_MODE_CTRL, reg);
+	}
+}
+
+static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
+{
+	struct drm_display_mode *mode = msm_host->mode;
+	u32 hs_start = 0, vs_start = 0; /* take sync start as 0 */
+	u32 h_total = mode->htotal;
+	u32 v_total = mode->vtotal;
+	u32 hs_end = mode->hsync_end - mode->hsync_start;
+	u32 vs_end = mode->vsync_end - mode->vsync_start;
+	u32 ha_start = h_total - mode->hsync_start;
+	u32 ha_end = ha_start + mode->hdisplay;
+	u32 va_start = v_total - mode->vsync_start;
+	u32 va_end = va_start + mode->vdisplay;
+	u32 hdisplay = mode->hdisplay;
+	u32 wc;
+	int ret;
+	bool wide_bus_enabled = msm_dsi_host_is_wide_bus_enabled(&msm_host->base);
+
+	DBG("");
+
+	/*
+	 * For bonded DSI mode, the current DRM mode has
+	 * the complete width of the panel. Since, the complete
+	 * panel is driven by two DSI controllers, the horizontal
+	 * timings have to be split between the two dsi controllers.
+	 * Adjust the DSI host timing values accordingly.
+	 */
+	if (is_bonded_dsi) {
+		h_total /= 2;
+		hs_end /= 2;
+		ha_start /= 2;
+		ha_end /= 2;
+		hdisplay /= 2;
+	}
+
+	if (msm_host->dsc) {
+		struct drm_dsc_config *dsc = msm_host->dsc;
+		u32 bytes_per_pclk;
+
+		/* update dsc params with timing params */
+		if (!dsc || !mode->hdisplay || !mode->vdisplay) {
+			pr_err("DSI: invalid input: pic_width: %d pic_height: %d\n",
+			       mode->hdisplay, mode->vdisplay);
+			return;
+		}
+
+		dsc->pic_width = mode->hdisplay;
+		dsc->pic_height = mode->vdisplay;
+		DBG("Mode %dx%d\n", dsc->pic_width, dsc->pic_height);
+
+		/* we do the calculations for dsc parameters here so that
+		 * panel can use these parameters
+		 */
+		ret = dsi_populate_dsc_params(msm_host, dsc);
+		if (ret)
+			return;
+
+		/* Divide the display by 3 but keep back/font porch and
+		 * pulse width same
+		 */
+		h_total -= hdisplay;
+		if (wide_bus_enabled && !(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO))
+			bytes_per_pclk = 6;
+		else
+			bytes_per_pclk = 3;
+
+		hdisplay = DIV_ROUND_UP(msm_dsc_get_bytes_per_line(msm_host->dsc), bytes_per_pclk);
+
+		h_total += hdisplay;
+		ha_end = ha_start + hdisplay;
+	}
+
+	if (msm_host->mode_flags & MIPI_DSI_MODE_VIDEO) {
+		if (msm_host->dsc)
+			dsi_update_dsc_timing(msm_host, false, mode->hdisplay);
+
+		dsi_write(msm_host, REG_DSI_ACTIVE_H,
+			DSI_ACTIVE_H_START(ha_start) |
+			DSI_ACTIVE_H_END(ha_end));
+		dsi_write(msm_host, REG_DSI_ACTIVE_V,
+			DSI_ACTIVE_V_START(va_start) |
+			DSI_ACTIVE_V_END(va_end));
+		dsi_write(msm_host, REG_DSI_TOTAL,
+			DSI_TOTAL_H_TOTAL(h_total - 1) |
+			DSI_TOTAL_V_TOTAL(v_total - 1));
+
+		dsi_write(msm_host, REG_DSI_ACTIVE_HSYNC,
+			DSI_ACTIVE_HSYNC_START(hs_start) |
+			DSI_ACTIVE_HSYNC_END(hs_end));
+		dsi_write(msm_host, REG_DSI_ACTIVE_VSYNC_HPOS, 0);
+		dsi_write(msm_host, REG_DSI_ACTIVE_VSYNC_VPOS,
+			DSI_ACTIVE_VSYNC_VPOS_START(vs_start) |
+			DSI_ACTIVE_VSYNC_VPOS_END(vs_end));
+	} else {		/* command mode */
+		if (msm_host->dsc)
+			dsi_update_dsc_timing(msm_host, true, mode->hdisplay);
+
+		/* image data and 1 byte write_memory_start cmd */
+		if (!msm_host->dsc)
+			wc = hdisplay * dsi_get_bpp(msm_host->format) / 8 + 1;
+		else
+			/*
+			 * When DSC is enabled, WC = slice_chunk_size * slice_per_pkt + 1.
+			 * Currently, the driver only supports default value of slice_per_pkt = 1
+			 *
+			 * TODO: Expand mipi_dsi_device struct to hold slice_per_pkt info
+			 *       and adjust DSC math to account for slice_per_pkt.
+			 */
+			wc = msm_host->dsc->slice_chunk_size + 1;
+
+		dsi_write(msm_host, REG_DSI_CMD_MDP_STREAM0_CTRL,
+			DSI_CMD_MDP_STREAM0_CTRL_WORD_COUNT(wc) |
+			DSI_CMD_MDP_STREAM0_CTRL_VIRTUAL_CHANNEL(
+					msm_host->channel) |
+			DSI_CMD_MDP_STREAM0_CTRL_DATA_TYPE(
+					MIPI_DSI_DCS_LONG_WRITE));
+
+		dsi_write(msm_host, REG_DSI_CMD_MDP_STREAM0_TOTAL,
+			DSI_CMD_MDP_STREAM0_TOTAL_H_TOTAL(hdisplay) |
+			DSI_CMD_MDP_STREAM0_TOTAL_V_TOTAL(mode->vdisplay));
+	}
+}
+
+static void dsi_sw_reset(struct msm_dsi_host *msm_host)
+{
+	u32 ctrl;
+
+	ctrl = dsi_read(msm_host, REG_DSI_CTRL);
+
+	if (ctrl & DSI_CTRL_ENABLE) {
+		dsi_write(msm_host, REG_DSI_CTRL, ctrl & ~DSI_CTRL_ENABLE);
+		/*
+		 * dsi controller need to be disabled before
+		 * clocks turned on
+		 */
+		wmb();
+	}
+
+	dsi_write(msm_host, REG_DSI_CLK_CTRL, DSI_CLK_CTRL_ENABLE_CLKS);
+	wmb(); /* clocks need to be enabled before reset */
+
+	/* dsi controller can only be reset while clocks are running */
+	dsi_write(msm_host, REG_DSI_RESET, 1);
+	msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+	dsi_write(msm_host, REG_DSI_RESET, 0);
+	wmb(); /* controller out of reset */
+
+	if (ctrl & DSI_CTRL_ENABLE) {
+		dsi_write(msm_host, REG_DSI_CTRL, ctrl);
+		wmb();	/* make sure dsi controller enabled again */
+	}
+}
+
+static void dsi_op_mode_config(struct msm_dsi_host *msm_host,
+					bool video_mode, bool enable)
+{
+	u32 dsi_ctrl;
+
+	dsi_ctrl = dsi_read(msm_host, REG_DSI_CTRL);
+
+	if (!enable) {
+		dsi_ctrl &= ~(DSI_CTRL_ENABLE | DSI_CTRL_VID_MODE_EN |
+				DSI_CTRL_CMD_MODE_EN);
+		dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_CMD_MDP_DONE |
+					DSI_IRQ_MASK_VIDEO_DONE, 0);
+	} else {
+		if (video_mode) {
+			dsi_ctrl |= DSI_CTRL_VID_MODE_EN;
+		} else {		/* command mode */
+			dsi_ctrl |= DSI_CTRL_CMD_MODE_EN;
+			dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_CMD_MDP_DONE, 1);
+		}
+		dsi_ctrl |= DSI_CTRL_ENABLE;
+	}
+
+	dsi_write(msm_host, REG_DSI_CTRL, dsi_ctrl);
+}
+
+static void dsi_set_tx_power_mode(int mode, struct msm_dsi_host *msm_host)
+{
+	u32 data;
+
+	data = dsi_read(msm_host, REG_DSI_CMD_DMA_CTRL);
+
+	if (mode == 0)
+		data &= ~DSI_CMD_DMA_CTRL_LOW_POWER;
+	else
+		data |= DSI_CMD_DMA_CTRL_LOW_POWER;
+
+	dsi_write(msm_host, REG_DSI_CMD_DMA_CTRL, data);
+}
+
+static void dsi_wait4video_done(struct msm_dsi_host *msm_host)
+{
+	u32 ret = 0;
+	struct device *dev = &msm_host->pdev->dev;
+
+	dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_VIDEO_DONE, 1);
+
+	reinit_completion(&msm_host->video_comp);
+
+	ret = wait_for_completion_timeout(&msm_host->video_comp,
+			msecs_to_jiffies(70));
+
+	if (ret == 0)
+		DRM_DEV_ERROR(dev, "wait for video done timed out\n");
+
+	dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_VIDEO_DONE, 0);
+}
+
+static void dsi_wait4video_eng_busy(struct msm_dsi_host *msm_host)
+{
+	u32 data;
+
+	if (!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO))
+		return;
+
+	data = dsi_read(msm_host, REG_DSI_STATUS0);
+
+	/* if video mode engine is not busy, its because
+	 * either timing engine was not turned on or the
+	 * DSI controller has finished transmitting the video
+	 * data already, so no need to wait in those cases
+	 */
+	if (!(data & DSI_STATUS0_VIDEO_MODE_ENGINE_BUSY))
+		return;
+
+	if (msm_host->power_on && msm_host->enabled) {
+		dsi_wait4video_done(msm_host);
+		/* delay 4 ms to skip BLLP */
+		usleep_range(2000, 4000);
+	}
+}
+
+int dsi_tx_buf_alloc_6g(struct msm_dsi_host *msm_host, int size)
+{
+	struct drm_device *dev = msm_host->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	uint64_t iova;
+	u8 *data;
+
+	msm_host->aspace = msm_gem_address_space_get(priv->kms->aspace);
+
+	data = msm_gem_kernel_new(dev, size, MSM_BO_WC,
+					msm_host->aspace,
+					&msm_host->tx_gem_obj, &iova);
+
+	if (IS_ERR(data)) {
+		msm_host->tx_gem_obj = NULL;
+		return PTR_ERR(data);
+	}
+
+	msm_gem_object_set_name(msm_host->tx_gem_obj, "tx_gem");
+
+	msm_host->tx_size = msm_host->tx_gem_obj->size;
+
+	return 0;
+}
+
+int dsi_tx_buf_alloc_v2(struct msm_dsi_host *msm_host, int size)
+{
+	struct drm_device *dev = msm_host->dev;
+
+	msm_host->tx_buf = dma_alloc_coherent(dev->dev, size,
+					&msm_host->tx_buf_paddr, GFP_KERNEL);
+	if (!msm_host->tx_buf)
+		return -ENOMEM;
+
+	msm_host->tx_size = size;
+
+	return 0;
+}
+
+void msm_dsi_tx_buf_free(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	struct drm_device *dev = msm_host->dev;
+
+	/*
+	 * This is possible if we're tearing down before we've had a chance to
+	 * fully initialize. A very real possibility if our probe is deferred,
+	 * in which case we'll hit msm_dsi_host_destroy() without having run
+	 * through the dsi_tx_buf_alloc().
+	 */
+	if (!dev)
+		return;
+
+	if (msm_host->tx_gem_obj) {
+		msm_gem_kernel_put(msm_host->tx_gem_obj, msm_host->aspace);
+		msm_gem_address_space_put(msm_host->aspace);
+		msm_host->tx_gem_obj = NULL;
+		msm_host->aspace = NULL;
+	}
+
+	if (msm_host->tx_buf)
+		dma_free_coherent(dev->dev, msm_host->tx_size, msm_host->tx_buf,
+			msm_host->tx_buf_paddr);
+}
+
+void *dsi_tx_buf_get_6g(struct msm_dsi_host *msm_host)
+{
+	return msm_gem_get_vaddr(msm_host->tx_gem_obj);
+}
+
+void *dsi_tx_buf_get_v2(struct msm_dsi_host *msm_host)
+{
+	return msm_host->tx_buf;
+}
+
+void dsi_tx_buf_put_6g(struct msm_dsi_host *msm_host)
+{
+	msm_gem_put_vaddr(msm_host->tx_gem_obj);
+}
+
+/*
+ * prepare cmd buffer to be txed
+ */
+static int dsi_cmd_dma_add(struct msm_dsi_host *msm_host,
+			   const struct mipi_dsi_msg *msg)
+{
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+	struct mipi_dsi_packet packet;
+	int len;
+	int ret;
+	u8 *data;
+
+	ret = mipi_dsi_create_packet(&packet, msg);
+	if (ret) {
+		pr_err("%s: create packet failed, %d\n", __func__, ret);
+		return ret;
+	}
+	len = (packet.size + 3) & (~0x3);
+
+	if (len > msm_host->tx_size) {
+		pr_err("%s: packet size is too big\n", __func__);
+		return -EINVAL;
+	}
+
+	data = cfg_hnd->ops->tx_buf_get(msm_host);
+	if (IS_ERR(data)) {
+		ret = PTR_ERR(data);
+		pr_err("%s: get vaddr failed, %d\n", __func__, ret);
+		return ret;
+	}
+
+	/* MSM specific command format in memory */
+	data[0] = packet.header[1];
+	data[1] = packet.header[2];
+	data[2] = packet.header[0];
+	data[3] = BIT(7); /* Last packet */
+	if (mipi_dsi_packet_format_is_long(msg->type))
+		data[3] |= BIT(6);
+	if (msg->rx_buf && msg->rx_len)
+		data[3] |= BIT(5);
+
+	/* Long packet */
+	if (packet.payload && packet.payload_length)
+		memcpy(data + 4, packet.payload, packet.payload_length);
+
+	/* Append 0xff to the end */
+	if (packet.size < len)
+		memset(data + packet.size, 0xff, len - packet.size);
+
+	if (cfg_hnd->ops->tx_buf_put)
+		cfg_hnd->ops->tx_buf_put(msm_host);
+
+	return len;
+}
+
+/*
+ * dsi_short_read1_resp: 1 parameter
+ */
+static int dsi_short_read1_resp(u8 *buf, const struct mipi_dsi_msg *msg)
+{
+	u8 *data = msg->rx_buf;
+	if (data && (msg->rx_len >= 1)) {
+		*data = buf[1]; /* strip out dcs type */
+		return 1;
+	} else {
+		pr_err("%s: read data does not match with rx_buf len %zu\n",
+			__func__, msg->rx_len);
+		return -EINVAL;
+	}
+}
+
+/*
+ * dsi_short_read2_resp: 2 parameter
+ */
+static int dsi_short_read2_resp(u8 *buf, const struct mipi_dsi_msg *msg)
+{
+	u8 *data = msg->rx_buf;
+	if (data && (msg->rx_len >= 2)) {
+		data[0] = buf[1]; /* strip out dcs type */
+		data[1] = buf[2];
+		return 2;
+	} else {
+		pr_err("%s: read data does not match with rx_buf len %zu\n",
+			__func__, msg->rx_len);
+		return -EINVAL;
+	}
+}
+
+static int dsi_long_read_resp(u8 *buf, const struct mipi_dsi_msg *msg)
+{
+	/* strip out 4 byte dcs header */
+	if (msg->rx_buf && msg->rx_len)
+		memcpy(msg->rx_buf, buf + 4, msg->rx_len);
+
+	return msg->rx_len;
+}
+
+int dsi_dma_base_get_6g(struct msm_dsi_host *msm_host, uint64_t *dma_base)
+{
+	struct drm_device *dev = msm_host->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+
+	if (!dma_base)
+		return -EINVAL;
+
+	return msm_gem_get_and_pin_iova(msm_host->tx_gem_obj,
+				priv->kms->aspace, dma_base);
+}
+
+int dsi_dma_base_get_v2(struct msm_dsi_host *msm_host, uint64_t *dma_base)
+{
+	if (!dma_base)
+		return -EINVAL;
+
+	*dma_base = msm_host->tx_buf_paddr;
+	return 0;
+}
+
+static int dsi_cmd_dma_tx(struct msm_dsi_host *msm_host, int len)
+{
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+	int ret;
+	uint64_t dma_base;
+	bool triggered;
+
+	ret = cfg_hnd->ops->dma_base_get(msm_host, &dma_base);
+	if (ret) {
+		pr_err("%s: failed to get iova: %d\n", __func__, ret);
+		return ret;
+	}
+
+	reinit_completion(&msm_host->dma_comp);
+
+	dsi_wait4video_eng_busy(msm_host);
+
+	triggered = msm_dsi_manager_cmd_xfer_trigger(
+						msm_host->id, dma_base, len);
+	if (triggered) {
+		ret = wait_for_completion_timeout(&msm_host->dma_comp,
+					msecs_to_jiffies(200));
+		DBG("ret=%d", ret);
+		if (ret == 0)
+			ret = -ETIMEDOUT;
+		else
+			ret = len;
+	} else
+		ret = len;
+
+	return ret;
+}
+
+static int dsi_cmd_dma_rx(struct msm_dsi_host *msm_host,
+			u8 *buf, int rx_byte, int pkt_size)
+{
+	u32 *temp, data;
+	int i, j = 0, cnt;
+	u32 read_cnt;
+	u8 reg[16];
+	int repeated_bytes = 0;
+	int buf_offset = buf - msm_host->rx_buf;
+
+	temp = (u32 *)reg;
+	cnt = (rx_byte + 3) >> 2;
+	if (cnt > 4)
+		cnt = 4; /* 4 x 32 bits registers only */
+
+	if (rx_byte == 4)
+		read_cnt = 4;
+	else
+		read_cnt = pkt_size + 6;
+
+	/*
+	 * In case of multiple reads from the panel, after the first read, there
+	 * is possibility that there are some bytes in the payload repeating in
+	 * the RDBK_DATA registers. Since we read all the parameters from the
+	 * panel right from the first byte for every pass. We need to skip the
+	 * repeating bytes and then append the new parameters to the rx buffer.
+	 */
+	if (read_cnt > 16) {
+		int bytes_shifted;
+		/* Any data more than 16 bytes will be shifted out.
+		 * The temp read buffer should already contain these bytes.
+		 * The remaining bytes in read buffer are the repeated bytes.
+		 */
+		bytes_shifted = read_cnt - 16;
+		repeated_bytes = buf_offset - bytes_shifted;
+	}
+
+	for (i = cnt - 1; i >= 0; i--) {
+		data = dsi_read(msm_host, REG_DSI_RDBK_DATA(i));
+		*temp++ = ntohl(data); /* to host byte order */
+		DBG("data = 0x%x and ntohl(data) = 0x%x", data, ntohl(data));
+	}
+
+	for (i = repeated_bytes; i < 16; i++)
+		buf[j++] = reg[i];
+
+	return j;
+}
+
+static int dsi_cmds2buf_tx(struct msm_dsi_host *msm_host,
+				const struct mipi_dsi_msg *msg)
+{
+	int len, ret;
+	int bllp_len = msm_host->mode->hdisplay *
+			dsi_get_bpp(msm_host->format) / 8;
+
+	len = dsi_cmd_dma_add(msm_host, msg);
+	if (len < 0) {
+		pr_err("%s: failed to add cmd type = 0x%x\n",
+			__func__,  msg->type);
+		return len;
+	}
+
+	/* for video mode, do not send cmds more than
+	* one pixel line, since it only transmit it
+	* during BLLP.
+	*/
+	/* TODO: if the command is sent in LP mode, the bit rate is only
+	 * half of esc clk rate. In this case, if the video is already
+	 * actively streaming, we need to check more carefully if the
+	 * command can be fit into one BLLP.
+	 */
+	if ((msm_host->mode_flags & MIPI_DSI_MODE_VIDEO) && (len > bllp_len)) {
+		pr_err("%s: cmd cannot fit into BLLP period, len=%d\n",
+			__func__, len);
+		return -EINVAL;
+	}
+
+	ret = dsi_cmd_dma_tx(msm_host, len);
+	if (ret < 0) {
+		pr_err("%s: cmd dma tx failed, type=0x%x, data0=0x%x, len=%d, ret=%d\n",
+			__func__, msg->type, (*(u8 *)(msg->tx_buf)), len, ret);
+		return ret;
+	} else if (ret < len) {
+		pr_err("%s: cmd dma tx failed, type=0x%x, data0=0x%x, ret=%d len=%d\n",
+			__func__, msg->type, (*(u8 *)(msg->tx_buf)), ret, len);
+		return -EIO;
+	}
+
+	return len;
+}
+
+static void dsi_err_worker(struct work_struct *work)
+{
+	struct msm_dsi_host *msm_host =
+		container_of(work, struct msm_dsi_host, err_work);
+	u32 status = msm_host->err_work_state;
+
+	pr_err_ratelimited("%s: status=%x\n", __func__, status);
+	if (status & DSI_ERR_STATE_MDP_FIFO_UNDERFLOW)
+		dsi_sw_reset(msm_host);
+
+	/* It is safe to clear here because error irq is disabled. */
+	msm_host->err_work_state = 0;
+
+	/* enable dsi error interrupt */
+	dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_ERROR, 1);
+}
+
+static void dsi_ack_err_status(struct msm_dsi_host *msm_host)
+{
+	u32 status;
+
+	status = dsi_read(msm_host, REG_DSI_ACK_ERR_STATUS);
+
+	if (status) {
+		dsi_write(msm_host, REG_DSI_ACK_ERR_STATUS, status);
+		/* Writing of an extra 0 needed to clear error bits */
+		dsi_write(msm_host, REG_DSI_ACK_ERR_STATUS, 0);
+		msm_host->err_work_state |= DSI_ERR_STATE_ACK;
+	}
+}
+
+static void dsi_timeout_status(struct msm_dsi_host *msm_host)
+{
+	u32 status;
+
+	status = dsi_read(msm_host, REG_DSI_TIMEOUT_STATUS);
+
+	if (status) {
+		dsi_write(msm_host, REG_DSI_TIMEOUT_STATUS, status);
+		msm_host->err_work_state |= DSI_ERR_STATE_TIMEOUT;
+	}
+}
+
+static void dsi_dln0_phy_err(struct msm_dsi_host *msm_host)
+{
+	u32 status;
+
+	status = dsi_read(msm_host, REG_DSI_DLN0_PHY_ERR);
+
+	if (status & (DSI_DLN0_PHY_ERR_DLN0_ERR_ESC |
+			DSI_DLN0_PHY_ERR_DLN0_ERR_SYNC_ESC |
+			DSI_DLN0_PHY_ERR_DLN0_ERR_CONTROL |
+			DSI_DLN0_PHY_ERR_DLN0_ERR_CONTENTION_LP0 |
+			DSI_DLN0_PHY_ERR_DLN0_ERR_CONTENTION_LP1)) {
+		dsi_write(msm_host, REG_DSI_DLN0_PHY_ERR, status);
+		msm_host->err_work_state |= DSI_ERR_STATE_DLN0_PHY;
+	}
+}
+
+static void dsi_fifo_status(struct msm_dsi_host *msm_host)
+{
+	u32 status;
+
+	status = dsi_read(msm_host, REG_DSI_FIFO_STATUS);
+
+	/* fifo underflow, overflow */
+	if (status) {
+		dsi_write(msm_host, REG_DSI_FIFO_STATUS, status);
+		msm_host->err_work_state |= DSI_ERR_STATE_FIFO;
+		if (status & DSI_FIFO_STATUS_CMD_MDP_FIFO_UNDERFLOW)
+			msm_host->err_work_state |=
+					DSI_ERR_STATE_MDP_FIFO_UNDERFLOW;
+	}
+}
+
+static void dsi_status(struct msm_dsi_host *msm_host)
+{
+	u32 status;
+
+	status = dsi_read(msm_host, REG_DSI_STATUS0);
+
+	if (status & DSI_STATUS0_INTERLEAVE_OP_CONTENTION) {
+		dsi_write(msm_host, REG_DSI_STATUS0, status);
+		msm_host->err_work_state |=
+			DSI_ERR_STATE_INTERLEAVE_OP_CONTENTION;
+	}
+}
+
+static void dsi_clk_status(struct msm_dsi_host *msm_host)
+{
+	u32 status;
+
+	status = dsi_read(msm_host, REG_DSI_CLK_STATUS);
+
+	if (status & DSI_CLK_STATUS_PLL_UNLOCKED) {
+		dsi_write(msm_host, REG_DSI_CLK_STATUS, status);
+		msm_host->err_work_state |= DSI_ERR_STATE_PLL_UNLOCKED;
+	}
+}
+
+static void dsi_error(struct msm_dsi_host *msm_host)
+{
+	/* disable dsi error interrupt */
+	dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_ERROR, 0);
+
+	dsi_clk_status(msm_host);
+	dsi_fifo_status(msm_host);
+	dsi_ack_err_status(msm_host);
+	dsi_timeout_status(msm_host);
+	dsi_status(msm_host);
+	dsi_dln0_phy_err(msm_host);
+
+	queue_work(msm_host->workqueue, &msm_host->err_work);
+}
+
+static irqreturn_t dsi_host_irq(int irq, void *ptr)
+{
+	struct msm_dsi_host *msm_host = ptr;
+	u32 isr;
+	unsigned long flags;
+
+	if (!msm_host->ctrl_base)
+		return IRQ_HANDLED;
+
+	spin_lock_irqsave(&msm_host->intr_lock, flags);
+	isr = dsi_read(msm_host, REG_DSI_INTR_CTRL);
+	dsi_write(msm_host, REG_DSI_INTR_CTRL, isr);
+	spin_unlock_irqrestore(&msm_host->intr_lock, flags);
+
+	DBG("isr=0x%x, id=%d", isr, msm_host->id);
+
+	if (isr & DSI_IRQ_ERROR)
+		dsi_error(msm_host);
+
+	if (isr & DSI_IRQ_VIDEO_DONE)
+		complete(&msm_host->video_comp);
+
+	if (isr & DSI_IRQ_CMD_DMA_DONE)
+		complete(&msm_host->dma_comp);
+
+	return IRQ_HANDLED;
+}
+
+static int dsi_host_init_panel_gpios(struct msm_dsi_host *msm_host,
+			struct device *panel_device)
+{
+	msm_host->disp_en_gpio = devm_gpiod_get_optional(panel_device,
+							 "disp-enable",
+							 GPIOD_OUT_LOW);
+	if (IS_ERR(msm_host->disp_en_gpio)) {
+		DBG("cannot get disp-enable-gpios %ld",
+				PTR_ERR(msm_host->disp_en_gpio));
+		return PTR_ERR(msm_host->disp_en_gpio);
+	}
+
+	msm_host->te_gpio = devm_gpiod_get_optional(panel_device, "disp-te",
+								GPIOD_IN);
+	if (IS_ERR(msm_host->te_gpio)) {
+		DBG("cannot get disp-te-gpios %ld", PTR_ERR(msm_host->te_gpio));
+		return PTR_ERR(msm_host->te_gpio);
+	}
+
+	return 0;
+}
+
+static int dsi_host_attach(struct mipi_dsi_host *host,
+					struct mipi_dsi_device *dsi)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	int ret;
+
+	if (dsi->lanes > msm_host->num_data_lanes)
+		return -EINVAL;
+
+	msm_host->channel = dsi->channel;
+	msm_host->lanes = dsi->lanes;
+	msm_host->format = dsi->format;
+	msm_host->mode_flags = dsi->mode_flags;
+	if (dsi->dsc)
+		msm_host->dsc = dsi->dsc;
+
+	/* Some gpios defined in panel DT need to be controlled by host */
+	ret = dsi_host_init_panel_gpios(msm_host, &dsi->dev);
+	if (ret)
+		return ret;
+
+	ret = dsi_dev_attach(msm_host->pdev);
+	if (ret)
+		return ret;
+
+	DBG("id=%d", msm_host->id);
+
+	return 0;
+}
+
+static int dsi_host_detach(struct mipi_dsi_host *host,
+					struct mipi_dsi_device *dsi)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	dsi_dev_detach(msm_host->pdev);
+
+	DBG("id=%d", msm_host->id);
+
+	return 0;
+}
+
+static ssize_t dsi_host_transfer(struct mipi_dsi_host *host,
+					const struct mipi_dsi_msg *msg)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	int ret;
+
+	if (!msg || !msm_host->power_on)
+		return -EINVAL;
+
+	mutex_lock(&msm_host->cmd_mutex);
+	ret = msm_dsi_manager_cmd_xfer(msm_host->id, msg);
+	mutex_unlock(&msm_host->cmd_mutex);
+
+	return ret;
+}
+
+static const struct mipi_dsi_host_ops dsi_host_ops = {
+	.attach = dsi_host_attach,
+	.detach = dsi_host_detach,
+	.transfer = dsi_host_transfer,
+};
+
+/*
+ * List of supported physical to logical lane mappings.
+ * For example, the 2nd entry represents the following mapping:
+ *
+ * "3012": Logic 3->Phys 0; Logic 0->Phys 1; Logic 1->Phys 2; Logic 2->Phys 3;
+ */
+static const int supported_data_lane_swaps[][4] = {
+	{ 0, 1, 2, 3 },
+	{ 3, 0, 1, 2 },
+	{ 2, 3, 0, 1 },
+	{ 1, 2, 3, 0 },
+	{ 0, 3, 2, 1 },
+	{ 1, 0, 3, 2 },
+	{ 2, 1, 0, 3 },
+	{ 3, 2, 1, 0 },
+};
+
+static int dsi_host_parse_lane_data(struct msm_dsi_host *msm_host,
+				    struct device_node *ep)
+{
+	struct device *dev = &msm_host->pdev->dev;
+	struct property *prop;
+	u32 lane_map[4];
+	int ret, i, len, num_lanes;
+
+	prop = of_find_property(ep, "data-lanes", &len);
+	if (!prop) {
+		DRM_DEV_DEBUG(dev,
+			"failed to find data lane mapping, using default\n");
+		/* Set the number of date lanes to 4 by default. */
+		msm_host->num_data_lanes = 4;
+		return 0;
+	}
+
+	num_lanes = drm_of_get_data_lanes_count(ep, 1, 4);
+	if (num_lanes < 0) {
+		DRM_DEV_ERROR(dev, "bad number of data lanes\n");
+		return num_lanes;
+	}
+
+	msm_host->num_data_lanes = num_lanes;
+
+	ret = of_property_read_u32_array(ep, "data-lanes", lane_map,
+					 num_lanes);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to read lane data\n");
+		return ret;
+	}
+
+	/*
+	 * compare DT specified physical-logical lane mappings with the ones
+	 * supported by hardware
+	 */
+	for (i = 0; i < ARRAY_SIZE(supported_data_lane_swaps); i++) {
+		const int *swap = supported_data_lane_swaps[i];
+		int j;
+
+		/*
+		 * the data-lanes array we get from DT has a logical->physical
+		 * mapping. The "data lane swap" register field represents
+		 * supported configurations in a physical->logical mapping.
+		 * Translate the DT mapping to what we understand and find a
+		 * configuration that works.
+		 */
+		for (j = 0; j < num_lanes; j++) {
+			if (lane_map[j] < 0 || lane_map[j] > 3)
+				DRM_DEV_ERROR(dev, "bad physical lane entry %u\n",
+					lane_map[j]);
+
+			if (swap[lane_map[j]] != j)
+				break;
+		}
+
+		if (j == num_lanes) {
+			msm_host->dlane_swap = i;
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+static int dsi_populate_dsc_params(struct msm_dsi_host *msm_host, struct drm_dsc_config *dsc)
+{
+	int ret;
+
+	if (dsc->bits_per_pixel & 0xf) {
+		DRM_DEV_ERROR(&msm_host->pdev->dev, "DSI does not support fractional bits_per_pixel\n");
+		return -EINVAL;
+	}
+
+	if (dsc->bits_per_component != 8) {
+		DRM_DEV_ERROR(&msm_host->pdev->dev, "DSI does not support bits_per_component != 8 yet\n");
+		return -EOPNOTSUPP;
+	}
+
+	dsc->simple_422 = 0;
+	dsc->convert_rgb = 1;
+	dsc->vbr_enable = 0;
+
+	drm_dsc_set_const_params(dsc);
+	drm_dsc_set_rc_buf_thresh(dsc);
+
+	/* handle only bpp = bpc = 8, pre-SCR panels */
+	ret = drm_dsc_setup_rc_params(dsc, DRM_DSC_1_1_PRE_SCR);
+	if (ret) {
+		DRM_DEV_ERROR(&msm_host->pdev->dev, "could not find DSC RC parameters\n");
+		return ret;
+	}
+
+	dsc->initial_scale_value = drm_dsc_initial_scale_value(dsc);
+	dsc->line_buf_depth = dsc->bits_per_component + 1;
+
+	return drm_dsc_compute_rc_parameters(dsc);
+}
+
+static int dsi_host_parse_dt(struct msm_dsi_host *msm_host)
+{
+	struct device *dev = &msm_host->pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct device_node *endpoint;
+	int ret = 0;
+
+	/*
+	 * Get the endpoint of the output port of the DSI host. In our case,
+	 * this is mapped to port number with reg = 1. Don't return an error if
+	 * the remote endpoint isn't defined. It's possible that there is
+	 * nothing connected to the dsi output.
+	 */
+	endpoint = of_graph_get_endpoint_by_regs(np, 1, -1);
+	if (!endpoint) {
+		DRM_DEV_DEBUG(dev, "%s: no endpoint\n", __func__);
+		return 0;
+	}
+
+	ret = dsi_host_parse_lane_data(msm_host, endpoint);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "%s: invalid lane configuration %d\n",
+			__func__, ret);
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (of_property_read_bool(np, "syscon-sfpb")) {
+		msm_host->sfpb = syscon_regmap_lookup_by_phandle(np,
+					"syscon-sfpb");
+		if (IS_ERR(msm_host->sfpb)) {
+			DRM_DEV_ERROR(dev, "%s: failed to get sfpb regmap\n",
+				__func__);
+			ret = PTR_ERR(msm_host->sfpb);
+		}
+	}
+
+err:
+	of_node_put(endpoint);
+
+	return ret;
+}
+
+static int dsi_host_get_id(struct msm_dsi_host *msm_host)
+{
+	struct platform_device *pdev = msm_host->pdev;
+	const struct msm_dsi_config *cfg = msm_host->cfg_hnd->cfg;
+	struct resource *res;
+	int i, j;
+
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dsi_ctrl");
+	if (!res)
+		return -EINVAL;
+
+	for (i = 0; i < VARIANTS_MAX; i++)
+		for (j = 0; j < DSI_MAX; j++)
+			if (cfg->io_start[i][j] == res->start)
+				return j;
+
+	return -EINVAL;
+}
+
+int msm_dsi_host_init(struct msm_dsi *msm_dsi)
+{
+	struct msm_dsi_host *msm_host = NULL;
+	struct platform_device *pdev = msm_dsi->pdev;
+	const struct msm_dsi_config *cfg;
+	int ret;
+
+	msm_host = devm_kzalloc(&pdev->dev, sizeof(*msm_host), GFP_KERNEL);
+	if (!msm_host) {
+		return -ENOMEM;
+	}
+
+	msm_host->pdev = pdev;
+	msm_dsi->host = &msm_host->base;
+
+	ret = dsi_host_parse_dt(msm_host);
+	if (ret) {
+		pr_err("%s: failed to parse dt\n", __func__);
+		return ret;
+	}
+
+	msm_host->ctrl_base = msm_ioremap_size(pdev, "dsi_ctrl", &msm_host->ctrl_size);
+	if (IS_ERR(msm_host->ctrl_base)) {
+		pr_err("%s: unable to map Dsi ctrl base\n", __func__);
+		return PTR_ERR(msm_host->ctrl_base);
+	}
+
+	pm_runtime_enable(&pdev->dev);
+
+	msm_host->cfg_hnd = dsi_get_config(msm_host);
+	if (!msm_host->cfg_hnd) {
+		pr_err("%s: get config failed\n", __func__);
+		return -EINVAL;
+	}
+	cfg = msm_host->cfg_hnd->cfg;
+
+	msm_host->id = dsi_host_get_id(msm_host);
+	if (msm_host->id < 0) {
+		pr_err("%s: unable to identify DSI host index\n", __func__);
+		return msm_host->id;
+	}
+
+	/* fixup base address by io offset */
+	msm_host->ctrl_base += cfg->io_offset;
+
+	ret = devm_regulator_bulk_get_const(&pdev->dev, cfg->num_regulators,
+					    cfg->regulator_data,
+					    &msm_host->supplies);
+	if (ret)
+		return ret;
+
+	ret = dsi_clk_init(msm_host);
+	if (ret) {
+		pr_err("%s: unable to initialize dsi clks\n", __func__);
+		return ret;
+	}
+
+	msm_host->rx_buf = devm_kzalloc(&pdev->dev, SZ_4K, GFP_KERNEL);
+	if (!msm_host->rx_buf) {
+		pr_err("%s: alloc rx temp buf failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	ret = devm_pm_opp_set_clkname(&pdev->dev, "byte");
+	if (ret)
+		return ret;
+	/* OPP table is optional */
+	ret = devm_pm_opp_of_add_table(&pdev->dev);
+	if (ret && ret != -ENODEV) {
+		dev_err(&pdev->dev, "invalid OPP table in device tree\n");
+		return ret;
+	}
+
+	msm_host->irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
+	if (!msm_host->irq) {
+		dev_err(&pdev->dev, "failed to get irq\n");
+		return -EINVAL;
+	}
+
+	/* do not autoenable, will be enabled later */
+	ret = devm_request_irq(&pdev->dev, msm_host->irq, dsi_host_irq,
+			IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN,
+			"dsi_isr", msm_host);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "failed to request IRQ%u: %d\n",
+				msm_host->irq, ret);
+		return ret;
+	}
+
+	init_completion(&msm_host->dma_comp);
+	init_completion(&msm_host->video_comp);
+	mutex_init(&msm_host->dev_mutex);
+	mutex_init(&msm_host->cmd_mutex);
+	spin_lock_init(&msm_host->intr_lock);
+
+	/* setup workqueue */
+	msm_host->workqueue = alloc_ordered_workqueue("dsi_drm_work", 0);
+	if (!msm_host->workqueue)
+		return -ENOMEM;
+
+	INIT_WORK(&msm_host->err_work, dsi_err_worker);
+
+	msm_dsi->id = msm_host->id;
+
+	DBG("Dsi Host %d initialized", msm_host->id);
+	return 0;
+}
+
+void msm_dsi_host_destroy(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	DBG("");
+	if (msm_host->workqueue) {
+		destroy_workqueue(msm_host->workqueue);
+		msm_host->workqueue = NULL;
+	}
+
+	mutex_destroy(&msm_host->cmd_mutex);
+	mutex_destroy(&msm_host->dev_mutex);
+
+	pm_runtime_disable(&msm_host->pdev->dev);
+}
+
+int msm_dsi_host_modeset_init(struct mipi_dsi_host *host,
+					struct drm_device *dev)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+	int ret;
+
+	msm_host->dev = dev;
+
+	ret = cfg_hnd->ops->tx_buf_alloc(msm_host, SZ_4K);
+	if (ret) {
+		pr_err("%s: alloc tx gem obj failed, %d\n", __func__, ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+int msm_dsi_host_register(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	int ret;
+
+	/* Register mipi dsi host */
+	if (!msm_host->registered) {
+		host->dev = &msm_host->pdev->dev;
+		host->ops = &dsi_host_ops;
+		ret = mipi_dsi_host_register(host);
+		if (ret)
+			return ret;
+
+		msm_host->registered = true;
+	}
+
+	return 0;
+}
+
+void msm_dsi_host_unregister(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	if (msm_host->registered) {
+		mipi_dsi_host_unregister(host);
+		host->dev = NULL;
+		host->ops = NULL;
+		msm_host->registered = false;
+	}
+}
+
+int msm_dsi_host_xfer_prepare(struct mipi_dsi_host *host,
+				const struct mipi_dsi_msg *msg)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+
+	/* TODO: make sure dsi_cmd_mdp is idle.
+	 * Since DSI6G v1.2.0, we can set DSI_TRIG_CTRL.BLOCK_DMA_WITHIN_FRAME
+	 * to ask H/W to wait until cmd mdp is idle. S/W wait is not needed.
+	 * How to handle the old versions? Wait for mdp cmd done?
+	 */
+
+	/*
+	 * mdss interrupt is generated in mdp core clock domain
+	 * mdp clock need to be enabled to receive dsi interrupt
+	 */
+	pm_runtime_get_sync(&msm_host->pdev->dev);
+	cfg_hnd->ops->link_clk_set_rate(msm_host);
+	cfg_hnd->ops->link_clk_enable(msm_host);
+
+	/* TODO: vote for bus bandwidth */
+
+	if (!(msg->flags & MIPI_DSI_MSG_USE_LPM))
+		dsi_set_tx_power_mode(0, msm_host);
+
+	msm_host->dma_cmd_ctrl_restore = dsi_read(msm_host, REG_DSI_CTRL);
+	dsi_write(msm_host, REG_DSI_CTRL,
+		msm_host->dma_cmd_ctrl_restore |
+		DSI_CTRL_CMD_MODE_EN |
+		DSI_CTRL_ENABLE);
+	dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_CMD_DMA_DONE, 1);
+
+	return 0;
+}
+
+void msm_dsi_host_xfer_restore(struct mipi_dsi_host *host,
+				const struct mipi_dsi_msg *msg)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+
+	dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_CMD_DMA_DONE, 0);
+	dsi_write(msm_host, REG_DSI_CTRL, msm_host->dma_cmd_ctrl_restore);
+
+	if (!(msg->flags & MIPI_DSI_MSG_USE_LPM))
+		dsi_set_tx_power_mode(1, msm_host);
+
+	/* TODO: unvote for bus bandwidth */
+
+	cfg_hnd->ops->link_clk_disable(msm_host);
+	pm_runtime_put(&msm_host->pdev->dev);
+}
+
+int msm_dsi_host_cmd_tx(struct mipi_dsi_host *host,
+				const struct mipi_dsi_msg *msg)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	return dsi_cmds2buf_tx(msm_host, msg);
+}
+
+int msm_dsi_host_cmd_rx(struct mipi_dsi_host *host,
+				const struct mipi_dsi_msg *msg)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+	int data_byte, rx_byte, dlen, end;
+	int short_response, diff, pkt_size, ret = 0;
+	char cmd;
+	int rlen = msg->rx_len;
+	u8 *buf;
+
+	if (rlen <= 2) {
+		short_response = 1;
+		pkt_size = rlen;
+		rx_byte = 4;
+	} else {
+		short_response = 0;
+		data_byte = 10;	/* first read */
+		if (rlen < data_byte)
+			pkt_size = rlen;
+		else
+			pkt_size = data_byte;
+		rx_byte = data_byte + 6; /* 4 header + 2 crc */
+	}
+
+	buf = msm_host->rx_buf;
+	end = 0;
+	while (!end) {
+		u8 tx[2] = {pkt_size & 0xff, pkt_size >> 8};
+		struct mipi_dsi_msg max_pkt_size_msg = {
+			.channel = msg->channel,
+			.type = MIPI_DSI_SET_MAXIMUM_RETURN_PACKET_SIZE,
+			.tx_len = 2,
+			.tx_buf = tx,
+		};
+
+		DBG("rlen=%d pkt_size=%d rx_byte=%d",
+			rlen, pkt_size, rx_byte);
+
+		ret = dsi_cmds2buf_tx(msm_host, &max_pkt_size_msg);
+		if (ret < 2) {
+			pr_err("%s: Set max pkt size failed, %d\n",
+				__func__, ret);
+			return -EINVAL;
+		}
+
+		if ((cfg_hnd->major == MSM_DSI_VER_MAJOR_6G) &&
+			(cfg_hnd->minor >= MSM_DSI_6G_VER_MINOR_V1_1)) {
+			/* Clear the RDBK_DATA registers */
+			dsi_write(msm_host, REG_DSI_RDBK_DATA_CTRL,
+					DSI_RDBK_DATA_CTRL_CLR);
+			wmb(); /* make sure the RDBK registers are cleared */
+			dsi_write(msm_host, REG_DSI_RDBK_DATA_CTRL, 0);
+			wmb(); /* release cleared status before transfer */
+		}
+
+		ret = dsi_cmds2buf_tx(msm_host, msg);
+		if (ret < 0) {
+			pr_err("%s: Read cmd Tx failed, %d\n", __func__, ret);
+			return ret;
+		} else if (ret < msg->tx_len) {
+			pr_err("%s: Read cmd Tx failed, too short: %d\n", __func__, ret);
+			return -ECOMM;
+		}
+
+		/*
+		 * once cmd_dma_done interrupt received,
+		 * return data from client is ready and stored
+		 * at RDBK_DATA register already
+		 * since rx fifo is 16 bytes, dcs header is kept at first loop,
+		 * after that dcs header lost during shift into registers
+		 */
+		dlen = dsi_cmd_dma_rx(msm_host, buf, rx_byte, pkt_size);
+
+		if (dlen <= 0)
+			return 0;
+
+		if (short_response)
+			break;
+
+		if (rlen <= data_byte) {
+			diff = data_byte - rlen;
+			end = 1;
+		} else {
+			diff = 0;
+			rlen -= data_byte;
+		}
+
+		if (!end) {
+			dlen -= 2; /* 2 crc */
+			dlen -= diff;
+			buf += dlen;	/* next start position */
+			data_byte = 14;	/* NOT first read */
+			if (rlen < data_byte)
+				pkt_size += rlen;
+			else
+				pkt_size += data_byte;
+			DBG("buf=%p dlen=%d diff=%d", buf, dlen, diff);
+		}
+	}
+
+	/*
+	 * For single Long read, if the requested rlen < 10,
+	 * we need to shift the start position of rx
+	 * data buffer to skip the bytes which are not
+	 * updated.
+	 */
+	if (pkt_size < 10 && !short_response)
+		buf = msm_host->rx_buf + (10 - rlen);
+	else
+		buf = msm_host->rx_buf;
+
+	cmd = buf[0];
+	switch (cmd) {
+	case MIPI_DSI_RX_ACKNOWLEDGE_AND_ERROR_REPORT:
+		pr_err("%s: rx ACK_ERR_PACLAGE\n", __func__);
+		ret = 0;
+		break;
+	case MIPI_DSI_RX_GENERIC_SHORT_READ_RESPONSE_1BYTE:
+	case MIPI_DSI_RX_DCS_SHORT_READ_RESPONSE_1BYTE:
+		ret = dsi_short_read1_resp(buf, msg);
+		break;
+	case MIPI_DSI_RX_GENERIC_SHORT_READ_RESPONSE_2BYTE:
+	case MIPI_DSI_RX_DCS_SHORT_READ_RESPONSE_2BYTE:
+		ret = dsi_short_read2_resp(buf, msg);
+		break;
+	case MIPI_DSI_RX_GENERIC_LONG_READ_RESPONSE:
+	case MIPI_DSI_RX_DCS_LONG_READ_RESPONSE:
+		ret = dsi_long_read_resp(buf, msg);
+		break;
+	default:
+		pr_warn("%s:Invalid response cmd\n", __func__);
+		ret = 0;
+	}
+
+	return ret;
+}
+
+void msm_dsi_host_cmd_xfer_commit(struct mipi_dsi_host *host, u32 dma_base,
+				  u32 len)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	dsi_write(msm_host, REG_DSI_DMA_BASE, dma_base);
+	dsi_write(msm_host, REG_DSI_DMA_LEN, len);
+	dsi_write(msm_host, REG_DSI_TRIG_DMA, 1);
+
+	/* Make sure trigger happens */
+	wmb();
+}
+
+void msm_dsi_host_set_phy_mode(struct mipi_dsi_host *host,
+	struct msm_dsi_phy *src_phy)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	msm_host->cphy_mode = src_phy->cphy_mode;
+}
+
+void msm_dsi_host_reset_phy(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	DBG("");
+	dsi_write(msm_host, REG_DSI_PHY_RESET, DSI_PHY_RESET_RESET);
+	/* Make sure fully reset */
+	wmb();
+	udelay(1000);
+	dsi_write(msm_host, REG_DSI_PHY_RESET, 0);
+	udelay(100);
+}
+
+void msm_dsi_host_get_phy_clk_req(struct mipi_dsi_host *host,
+			struct msm_dsi_phy_clk_request *clk_req,
+			bool is_bonded_dsi)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+	int ret;
+
+	ret = cfg_hnd->ops->calc_clk_rate(msm_host, is_bonded_dsi);
+	if (ret) {
+		pr_err("%s: unable to calc clk rate, %d\n", __func__, ret);
+		return;
+	}
+
+	/* CPHY transmits 16 bits over 7 clock cycles
+	 * "byte_clk" is in units of 16-bits (see dsi_calc_pclk),
+	 * so multiply by 7 to get the "bitclk rate"
+	 */
+	if (msm_host->cphy_mode)
+		clk_req->bitclk_rate = msm_host->byte_clk_rate * 7;
+	else
+		clk_req->bitclk_rate = msm_host->byte_clk_rate * 8;
+	clk_req->escclk_rate = msm_host->esc_clk_rate;
+}
+
+void msm_dsi_host_enable_irq(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	enable_irq(msm_host->irq);
+}
+
+void msm_dsi_host_disable_irq(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	disable_irq(msm_host->irq);
+}
+
+int msm_dsi_host_enable(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	dsi_op_mode_config(msm_host,
+		!!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO), true);
+
+	/* TODO: clock should be turned off for command mode,
+	 * and only turned on before MDP START.
+	 * This part of code should be enabled once mdp driver support it.
+	 */
+	/* if (msm_panel->mode == MSM_DSI_CMD_MODE) {
+	 *	dsi_link_clk_disable(msm_host);
+	 *	pm_runtime_put(&msm_host->pdev->dev);
+	 * }
+	 */
+	msm_host->enabled = true;
+	return 0;
+}
+
+int msm_dsi_host_disable(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	msm_host->enabled = false;
+	dsi_op_mode_config(msm_host,
+		!!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO), false);
+
+	/* Since we have disabled INTF, the video engine won't stop so that
+	 * the cmd engine will be blocked.
+	 * Reset to disable video engine so that we can send off cmd.
+	 */
+	dsi_sw_reset(msm_host);
+
+	return 0;
+}
+
+static void msm_dsi_sfpb_config(struct msm_dsi_host *msm_host, bool enable)
+{
+	enum sfpb_ahb_arb_master_port_en en;
+
+	if (!msm_host->sfpb)
+		return;
+
+	en = enable ? SFPB_MASTER_PORT_ENABLE : SFPB_MASTER_PORT_DISABLE;
+
+	regmap_update_bits(msm_host->sfpb, REG_SFPB_GPREG,
+			SFPB_GPREG_MASTER_PORT_EN__MASK,
+			SFPB_GPREG_MASTER_PORT_EN(en));
+}
+
+int msm_dsi_host_power_on(struct mipi_dsi_host *host,
+			struct msm_dsi_phy_shared_timings *phy_shared_timings,
+			bool is_bonded_dsi, struct msm_dsi_phy *phy)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+	int ret = 0;
+
+	mutex_lock(&msm_host->dev_mutex);
+	if (msm_host->power_on) {
+		DBG("dsi host already on");
+		goto unlock_ret;
+	}
+
+	msm_host->byte_intf_clk_rate = msm_host->byte_clk_rate;
+	if (phy_shared_timings->byte_intf_clk_div_2)
+		msm_host->byte_intf_clk_rate /= 2;
+
+	msm_dsi_sfpb_config(msm_host, true);
+
+	ret = regulator_bulk_enable(msm_host->cfg_hnd->cfg->num_regulators,
+				    msm_host->supplies);
+	if (ret) {
+		pr_err("%s:Failed to enable vregs.ret=%d\n",
+			__func__, ret);
+		goto unlock_ret;
+	}
+
+	pm_runtime_get_sync(&msm_host->pdev->dev);
+	ret = cfg_hnd->ops->link_clk_set_rate(msm_host);
+	if (!ret)
+		ret = cfg_hnd->ops->link_clk_enable(msm_host);
+	if (ret) {
+		pr_err("%s: failed to enable link clocks. ret=%d\n",
+		       __func__, ret);
+		goto fail_disable_reg;
+	}
+
+	ret = pinctrl_pm_select_default_state(&msm_host->pdev->dev);
+	if (ret) {
+		pr_err("%s: failed to set pinctrl default state, %d\n",
+			__func__, ret);
+		goto fail_disable_clk;
+	}
+
+	dsi_timing_setup(msm_host, is_bonded_dsi);
+	dsi_sw_reset(msm_host);
+	dsi_ctrl_enable(msm_host, phy_shared_timings, phy);
+
+	if (msm_host->disp_en_gpio)
+		gpiod_set_value(msm_host->disp_en_gpio, 1);
+
+	msm_host->power_on = true;
+	mutex_unlock(&msm_host->dev_mutex);
+
+	return 0;
+
+fail_disable_clk:
+	cfg_hnd->ops->link_clk_disable(msm_host);
+	pm_runtime_put(&msm_host->pdev->dev);
+fail_disable_reg:
+	regulator_bulk_disable(msm_host->cfg_hnd->cfg->num_regulators,
+			       msm_host->supplies);
+unlock_ret:
+	mutex_unlock(&msm_host->dev_mutex);
+	return ret;
+}
+
+int msm_dsi_host_power_off(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	const struct msm_dsi_cfg_handler *cfg_hnd = msm_host->cfg_hnd;
+
+	mutex_lock(&msm_host->dev_mutex);
+	if (!msm_host->power_on) {
+		DBG("dsi host already off");
+		goto unlock_ret;
+	}
+
+	dsi_ctrl_disable(msm_host);
+
+	if (msm_host->disp_en_gpio)
+		gpiod_set_value(msm_host->disp_en_gpio, 0);
+
+	pinctrl_pm_select_sleep_state(&msm_host->pdev->dev);
+
+	cfg_hnd->ops->link_clk_disable(msm_host);
+	pm_runtime_put(&msm_host->pdev->dev);
+
+	regulator_bulk_disable(msm_host->cfg_hnd->cfg->num_regulators,
+			       msm_host->supplies);
+
+	msm_dsi_sfpb_config(msm_host, false);
+
+	DBG("-");
+
+	msm_host->power_on = false;
+
+unlock_ret:
+	mutex_unlock(&msm_host->dev_mutex);
+	return 0;
+}
+
+int msm_dsi_host_set_display_mode(struct mipi_dsi_host *host,
+				  const struct drm_display_mode *mode)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	if (msm_host->mode) {
+		drm_mode_destroy(msm_host->dev, msm_host->mode);
+		msm_host->mode = NULL;
+	}
+
+	msm_host->mode = drm_mode_duplicate(msm_host->dev, mode);
+	if (!msm_host->mode) {
+		pr_err("%s: cannot duplicate mode\n", __func__);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+enum drm_mode_status msm_dsi_host_check_dsc(struct mipi_dsi_host *host,
+					    const struct drm_display_mode *mode)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	struct drm_dsc_config *dsc = msm_host->dsc;
+	int pic_width = mode->hdisplay;
+	int pic_height = mode->vdisplay;
+
+	if (!msm_host->dsc)
+		return MODE_OK;
+
+	if (pic_width % dsc->slice_width) {
+		pr_err("DSI: pic_width %d has to be multiple of slice %d\n",
+		       pic_width, dsc->slice_width);
+		return MODE_H_ILLEGAL;
+	}
+
+	if (pic_height % dsc->slice_height) {
+		pr_err("DSI: pic_height %d has to be multiple of slice %d\n",
+		       pic_height, dsc->slice_height);
+		return MODE_V_ILLEGAL;
+	}
+
+	return MODE_OK;
+}
+
+unsigned long msm_dsi_host_get_mode_flags(struct mipi_dsi_host *host)
+{
+	return to_msm_dsi_host(host)->mode_flags;
+}
+
+void msm_dsi_host_snapshot(struct msm_disp_state *disp_state, struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	pm_runtime_get_sync(&msm_host->pdev->dev);
+
+	msm_disp_snapshot_add_block(disp_state, msm_host->ctrl_size,
+			msm_host->ctrl_base, "dsi%d_ctrl", msm_host->id);
+
+	pm_runtime_put_sync(&msm_host->pdev->dev);
+}
+
+static void msm_dsi_host_video_test_pattern_setup(struct msm_dsi_host *msm_host)
+{
+	u32 reg;
+
+	reg = dsi_read(msm_host, REG_DSI_TEST_PATTERN_GEN_CTRL);
+
+	dsi_write(msm_host, REG_DSI_TEST_PATTERN_GEN_VIDEO_INIT_VAL, 0xff);
+	/* draw checkered rectangle pattern */
+	dsi_write(msm_host, REG_DSI_TPG_MAIN_CONTROL,
+			DSI_TPG_MAIN_CONTROL_CHECKERED_RECTANGLE_PATTERN);
+	/* use 24-bit RGB test pttern */
+	dsi_write(msm_host, REG_DSI_TPG_VIDEO_CONFIG,
+			DSI_TPG_VIDEO_CONFIG_BPP(VIDEO_CONFIG_24BPP) |
+			DSI_TPG_VIDEO_CONFIG_RGB);
+
+	reg |= DSI_TEST_PATTERN_GEN_CTRL_VIDEO_PATTERN_SEL(VID_MDSS_GENERAL_PATTERN);
+	dsi_write(msm_host, REG_DSI_TEST_PATTERN_GEN_CTRL, reg);
+
+	DBG("Video test pattern setup done\n");
+}
+
+static void msm_dsi_host_cmd_test_pattern_setup(struct msm_dsi_host *msm_host)
+{
+	u32 reg;
+
+	reg = dsi_read(msm_host, REG_DSI_TEST_PATTERN_GEN_CTRL);
+
+	/* initial value for test pattern */
+	dsi_write(msm_host, REG_DSI_TEST_PATTERN_GEN_CMD_MDP_INIT_VAL0, 0xff);
+
+	reg |= DSI_TEST_PATTERN_GEN_CTRL_CMD_MDP_STREAM0_PATTERN_SEL(CMD_MDP_MDSS_GENERAL_PATTERN);
+
+	dsi_write(msm_host, REG_DSI_TEST_PATTERN_GEN_CTRL, reg);
+	/* draw checkered rectangle pattern */
+	dsi_write(msm_host, REG_DSI_TPG_MAIN_CONTROL2,
+			DSI_TPG_MAIN_CONTROL2_CMD_MDP0_CHECKERED_RECTANGLE_PATTERN);
+
+	DBG("Cmd test pattern setup done\n");
+}
+
+void msm_dsi_host_test_pattern_en(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+	bool is_video_mode = !!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO);
+	u32 reg;
+
+	if (is_video_mode)
+		msm_dsi_host_video_test_pattern_setup(msm_host);
+	else
+		msm_dsi_host_cmd_test_pattern_setup(msm_host);
+
+	reg = dsi_read(msm_host, REG_DSI_TEST_PATTERN_GEN_CTRL);
+	/* enable the test pattern generator */
+	dsi_write(msm_host, REG_DSI_TEST_PATTERN_GEN_CTRL, (reg | DSI_TEST_PATTERN_GEN_CTRL_EN));
+
+	/* for command mode need to trigger one frame from tpg */
+	if (!is_video_mode)
+		dsi_write(msm_host, REG_DSI_TEST_PATTERN_GEN_CMD_STREAM0_TRIGGER,
+				DSI_TEST_PATTERN_GEN_CMD_STREAM0_TRIGGER_SW_TRIGGER);
+}
+
+struct drm_dsc_config *msm_dsi_host_get_dsc_config(struct mipi_dsi_host *host)
+{
+	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+
+	return msm_host->dsc;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/dsi_manager.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/dsi_manager.c
@@ -0,0 +1,675 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#include "drm/drm_bridge_connector.h"
+
+#include "msm_kms.h"
+#include "dsi.h"
+
+#define DSI_CLOCK_MASTER	DSI_0
+#define DSI_CLOCK_SLAVE		DSI_1
+
+#define DSI_LEFT		DSI_0
+#define DSI_RIGHT		DSI_1
+
+/* According to the current drm framework sequence, take the encoder of
+ * DSI_1 as master encoder
+ */
+#define DSI_ENCODER_MASTER	DSI_1
+#define DSI_ENCODER_SLAVE	DSI_0
+
+struct msm_dsi_manager {
+	struct msm_dsi *dsi[DSI_MAX];
+
+	bool is_bonded_dsi;
+	bool is_sync_needed;
+	int master_dsi_link_id;
+};
+
+static struct msm_dsi_manager msm_dsim_glb;
+
+#define IS_BONDED_DSI()		(msm_dsim_glb.is_bonded_dsi)
+#define IS_SYNC_NEEDED()	(msm_dsim_glb.is_sync_needed)
+#define IS_MASTER_DSI_LINK(id)	(msm_dsim_glb.master_dsi_link_id == id)
+
+static inline struct msm_dsi *dsi_mgr_get_dsi(int id)
+{
+	return msm_dsim_glb.dsi[id];
+}
+
+static inline struct msm_dsi *dsi_mgr_get_other_dsi(int id)
+{
+	return msm_dsim_glb.dsi[(id + 1) % DSI_MAX];
+}
+
+static int dsi_mgr_parse_of(struct device_node *np, int id)
+{
+	struct msm_dsi_manager *msm_dsim = &msm_dsim_glb;
+
+	/* We assume 2 dsi nodes have the same information of bonded dsi and
+	 * sync-mode, and only one node specifies master in case of bonded mode.
+	 */
+	if (!msm_dsim->is_bonded_dsi)
+		msm_dsim->is_bonded_dsi = of_property_read_bool(np, "qcom,dual-dsi-mode");
+
+	if (msm_dsim->is_bonded_dsi) {
+		if (of_property_read_bool(np, "qcom,master-dsi"))
+			msm_dsim->master_dsi_link_id = id;
+		if (!msm_dsim->is_sync_needed)
+			msm_dsim->is_sync_needed = of_property_read_bool(
+					np, "qcom,sync-dual-dsi");
+	}
+
+	return 0;
+}
+
+static int dsi_mgr_setup_components(int id)
+{
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *other_dsi = dsi_mgr_get_other_dsi(id);
+	struct msm_dsi *clk_master_dsi = dsi_mgr_get_dsi(DSI_CLOCK_MASTER);
+	struct msm_dsi *clk_slave_dsi = dsi_mgr_get_dsi(DSI_CLOCK_SLAVE);
+	int ret;
+
+	if (!IS_BONDED_DSI()) {
+		ret = msm_dsi_host_register(msm_dsi->host);
+		if (ret)
+			return ret;
+
+		msm_dsi_phy_set_usecase(msm_dsi->phy, MSM_DSI_PHY_STANDALONE);
+		msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy);
+	} else if (other_dsi) {
+		struct msm_dsi *master_link_dsi = IS_MASTER_DSI_LINK(id) ?
+							msm_dsi : other_dsi;
+		struct msm_dsi *slave_link_dsi = IS_MASTER_DSI_LINK(id) ?
+							other_dsi : msm_dsi;
+		/* Register slave host first, so that slave DSI device
+		 * has a chance to probe, and do not block the master
+		 * DSI device's probe.
+		 * Also, do not check defer for the slave host,
+		 * because only master DSI device adds the panel to global
+		 * panel list. The panel's device is the master DSI device.
+		 */
+		ret = msm_dsi_host_register(slave_link_dsi->host);
+		if (ret)
+			return ret;
+		ret = msm_dsi_host_register(master_link_dsi->host);
+		if (ret)
+			return ret;
+
+		/* PLL0 is to drive both 2 DSI link clocks in bonded DSI mode. */
+		msm_dsi_phy_set_usecase(clk_master_dsi->phy,
+					MSM_DSI_PHY_MASTER);
+		msm_dsi_phy_set_usecase(clk_slave_dsi->phy,
+					MSM_DSI_PHY_SLAVE);
+		msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy);
+		msm_dsi_host_set_phy_mode(other_dsi->host, other_dsi->phy);
+	}
+
+	return 0;
+}
+
+static int enable_phy(struct msm_dsi *msm_dsi,
+		      struct msm_dsi_phy_shared_timings *shared_timings)
+{
+	struct msm_dsi_phy_clk_request clk_req;
+	bool is_bonded_dsi = IS_BONDED_DSI();
+
+	msm_dsi_host_get_phy_clk_req(msm_dsi->host, &clk_req, is_bonded_dsi);
+
+	return msm_dsi_phy_enable(msm_dsi->phy, &clk_req, shared_timings);
+}
+
+static int
+dsi_mgr_phy_enable(int id,
+		   struct msm_dsi_phy_shared_timings shared_timings[DSI_MAX])
+{
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *mdsi = dsi_mgr_get_dsi(DSI_CLOCK_MASTER);
+	struct msm_dsi *sdsi = dsi_mgr_get_dsi(DSI_CLOCK_SLAVE);
+	int ret;
+
+	/* In case of bonded DSI, some registers in PHY1 have been programmed
+	 * during PLL0 clock's set_rate. The PHY1 reset called by host1 here
+	 * will silently reset those PHY1 registers. Therefore we need to reset
+	 * and enable both PHYs before any PLL clock operation.
+	 */
+	if (IS_BONDED_DSI() && mdsi && sdsi) {
+		if (!mdsi->phy_enabled && !sdsi->phy_enabled) {
+			msm_dsi_host_reset_phy(mdsi->host);
+			msm_dsi_host_reset_phy(sdsi->host);
+
+			ret = enable_phy(mdsi,
+					 &shared_timings[DSI_CLOCK_MASTER]);
+			if (ret)
+				return ret;
+			ret = enable_phy(sdsi,
+					 &shared_timings[DSI_CLOCK_SLAVE]);
+			if (ret) {
+				msm_dsi_phy_disable(mdsi->phy);
+				return ret;
+			}
+		}
+	} else {
+		msm_dsi_host_reset_phy(msm_dsi->host);
+		ret = enable_phy(msm_dsi, &shared_timings[id]);
+		if (ret)
+			return ret;
+	}
+
+	msm_dsi->phy_enabled = true;
+
+	return 0;
+}
+
+static void dsi_mgr_phy_disable(int id)
+{
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *mdsi = dsi_mgr_get_dsi(DSI_CLOCK_MASTER);
+	struct msm_dsi *sdsi = dsi_mgr_get_dsi(DSI_CLOCK_SLAVE);
+
+	/* disable DSI phy
+	 * In bonded dsi configuration, the phy should be disabled for the
+	 * first controller only when the second controller is disabled.
+	 */
+	msm_dsi->phy_enabled = false;
+	if (IS_BONDED_DSI() && mdsi && sdsi) {
+		if (!mdsi->phy_enabled && !sdsi->phy_enabled) {
+			msm_dsi_phy_disable(sdsi->phy);
+			msm_dsi_phy_disable(mdsi->phy);
+		}
+	} else {
+		msm_dsi_phy_disable(msm_dsi->phy);
+	}
+}
+
+struct dsi_bridge {
+	struct drm_bridge base;
+	int id;
+};
+
+#define to_dsi_bridge(x) container_of(x, struct dsi_bridge, base)
+
+static int dsi_mgr_bridge_get_id(struct drm_bridge *bridge)
+{
+	struct dsi_bridge *dsi_bridge = to_dsi_bridge(bridge);
+	return dsi_bridge->id;
+}
+
+static void msm_dsi_manager_set_split_display(u8 id)
+{
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *other_dsi = dsi_mgr_get_other_dsi(id);
+	struct msm_drm_private *priv = msm_dsi->dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+	struct msm_dsi *master_dsi, *slave_dsi;
+
+	if (IS_BONDED_DSI() && !IS_MASTER_DSI_LINK(id)) {
+		master_dsi = other_dsi;
+		slave_dsi = msm_dsi;
+	} else {
+		master_dsi = msm_dsi;
+		slave_dsi = other_dsi;
+	}
+
+	if (!msm_dsi->external_bridge || !IS_BONDED_DSI())
+		return;
+
+	/*
+	 * Set split display info to kms once bonded DSI panel is connected to
+	 * both hosts.
+	 */
+	if (other_dsi && other_dsi->external_bridge && kms->funcs->set_split_display) {
+		kms->funcs->set_split_display(kms, master_dsi->encoder,
+					      slave_dsi->encoder,
+					      msm_dsi_is_cmd_mode(msm_dsi));
+	}
+}
+
+static int dsi_mgr_bridge_power_on(struct drm_bridge *bridge)
+{
+	int id = dsi_mgr_bridge_get_id(bridge);
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *msm_dsi1 = dsi_mgr_get_dsi(DSI_1);
+	struct mipi_dsi_host *host = msm_dsi->host;
+	struct msm_dsi_phy_shared_timings phy_shared_timings[DSI_MAX];
+	bool is_bonded_dsi = IS_BONDED_DSI();
+	int ret;
+
+	DBG("id=%d", id);
+
+	ret = dsi_mgr_phy_enable(id, phy_shared_timings);
+	if (ret)
+		goto phy_en_fail;
+
+	ret = msm_dsi_host_power_on(host, &phy_shared_timings[id], is_bonded_dsi, msm_dsi->phy);
+	if (ret) {
+		pr_err("%s: power on host %d failed, %d\n", __func__, id, ret);
+		goto host_on_fail;
+	}
+
+	if (is_bonded_dsi && msm_dsi1) {
+		ret = msm_dsi_host_power_on(msm_dsi1->host,
+				&phy_shared_timings[DSI_1], is_bonded_dsi, msm_dsi1->phy);
+		if (ret) {
+			pr_err("%s: power on host1 failed, %d\n",
+							__func__, ret);
+			goto host1_on_fail;
+		}
+	}
+
+	/*
+	 * Enable before preparing the panel, disable after unpreparing, so
+	 * that the panel can communicate over the DSI link.
+	 */
+	msm_dsi_host_enable_irq(host);
+	if (is_bonded_dsi && msm_dsi1)
+		msm_dsi_host_enable_irq(msm_dsi1->host);
+
+	return 0;
+
+host1_on_fail:
+	msm_dsi_host_power_off(host);
+host_on_fail:
+	dsi_mgr_phy_disable(id);
+phy_en_fail:
+	return ret;
+}
+
+static void dsi_mgr_bridge_power_off(struct drm_bridge *bridge)
+{
+	int id = dsi_mgr_bridge_get_id(bridge);
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *msm_dsi1 = dsi_mgr_get_dsi(DSI_1);
+	struct mipi_dsi_host *host = msm_dsi->host;
+	bool is_bonded_dsi = IS_BONDED_DSI();
+
+	msm_dsi_host_disable_irq(host);
+	if (is_bonded_dsi && msm_dsi1) {
+		msm_dsi_host_disable_irq(msm_dsi1->host);
+		msm_dsi_host_power_off(msm_dsi1->host);
+	}
+	msm_dsi_host_power_off(host);
+	dsi_mgr_phy_disable(id);
+}
+
+static void dsi_mgr_bridge_pre_enable(struct drm_bridge *bridge)
+{
+	int id = dsi_mgr_bridge_get_id(bridge);
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *msm_dsi1 = dsi_mgr_get_dsi(DSI_1);
+	struct mipi_dsi_host *host = msm_dsi->host;
+	bool is_bonded_dsi = IS_BONDED_DSI();
+	int ret;
+
+	DBG("id=%d", id);
+	if (!msm_dsi_device_connected(msm_dsi))
+		return;
+
+	/* Do nothing with the host if it is slave-DSI in case of bonded DSI */
+	if (is_bonded_dsi && !IS_MASTER_DSI_LINK(id))
+		return;
+
+	ret = dsi_mgr_bridge_power_on(bridge);
+	if (ret) {
+		dev_err(&msm_dsi->pdev->dev, "Power on failed: %d\n", ret);
+		return;
+	}
+
+	ret = msm_dsi_host_enable(host);
+	if (ret) {
+		pr_err("%s: enable host %d failed, %d\n", __func__, id, ret);
+		goto host_en_fail;
+	}
+
+	if (is_bonded_dsi && msm_dsi1) {
+		ret = msm_dsi_host_enable(msm_dsi1->host);
+		if (ret) {
+			pr_err("%s: enable host1 failed, %d\n", __func__, ret);
+			goto host1_en_fail;
+		}
+	}
+
+	return;
+
+host1_en_fail:
+	msm_dsi_host_disable(host);
+host_en_fail:
+	dsi_mgr_bridge_power_off(bridge);
+}
+
+void msm_dsi_manager_tpg_enable(void)
+{
+	struct msm_dsi *m_dsi = dsi_mgr_get_dsi(DSI_0);
+	struct msm_dsi *s_dsi = dsi_mgr_get_dsi(DSI_1);
+
+	/* if dual dsi, trigger tpg on master first then slave */
+	if (m_dsi) {
+		msm_dsi_host_test_pattern_en(m_dsi->host);
+		if (IS_BONDED_DSI() && s_dsi)
+			msm_dsi_host_test_pattern_en(s_dsi->host);
+	}
+}
+
+static void dsi_mgr_bridge_post_disable(struct drm_bridge *bridge)
+{
+	int id = dsi_mgr_bridge_get_id(bridge);
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *msm_dsi1 = dsi_mgr_get_dsi(DSI_1);
+	struct mipi_dsi_host *host = msm_dsi->host;
+	bool is_bonded_dsi = IS_BONDED_DSI();
+	int ret;
+
+	DBG("id=%d", id);
+
+	if (!msm_dsi_device_connected(msm_dsi))
+		return;
+
+	/*
+	 * Do nothing with the host if it is slave-DSI in case of bonded DSI.
+	 * It is safe to call dsi_mgr_phy_disable() here because a single PHY
+	 * won't be diabled until both PHYs request disable.
+	 */
+	if (is_bonded_dsi && !IS_MASTER_DSI_LINK(id))
+		goto disable_phy;
+
+	ret = msm_dsi_host_disable(host);
+	if (ret)
+		pr_err("%s: host %d disable failed, %d\n", __func__, id, ret);
+
+	if (is_bonded_dsi && msm_dsi1) {
+		ret = msm_dsi_host_disable(msm_dsi1->host);
+		if (ret)
+			pr_err("%s: host1 disable failed, %d\n", __func__, ret);
+	}
+
+	msm_dsi_host_disable_irq(host);
+	if (is_bonded_dsi && msm_dsi1)
+		msm_dsi_host_disable_irq(msm_dsi1->host);
+
+	/* Save PHY status if it is a clock source */
+	msm_dsi_phy_pll_save_state(msm_dsi->phy);
+
+	ret = msm_dsi_host_power_off(host);
+	if (ret)
+		pr_err("%s: host %d power off failed,%d\n", __func__, id, ret);
+
+	if (is_bonded_dsi && msm_dsi1) {
+		ret = msm_dsi_host_power_off(msm_dsi1->host);
+		if (ret)
+			pr_err("%s: host1 power off failed, %d\n",
+								__func__, ret);
+	}
+
+disable_phy:
+	dsi_mgr_phy_disable(id);
+}
+
+static void dsi_mgr_bridge_mode_set(struct drm_bridge *bridge,
+		const struct drm_display_mode *mode,
+		const struct drm_display_mode *adjusted_mode)
+{
+	int id = dsi_mgr_bridge_get_id(bridge);
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *other_dsi = dsi_mgr_get_other_dsi(id);
+	struct mipi_dsi_host *host = msm_dsi->host;
+	bool is_bonded_dsi = IS_BONDED_DSI();
+
+	DBG("set mode: " DRM_MODE_FMT, DRM_MODE_ARG(mode));
+
+	if (is_bonded_dsi && !IS_MASTER_DSI_LINK(id))
+		return;
+
+	msm_dsi_host_set_display_mode(host, adjusted_mode);
+	if (is_bonded_dsi && other_dsi)
+		msm_dsi_host_set_display_mode(other_dsi->host, adjusted_mode);
+}
+
+static enum drm_mode_status dsi_mgr_bridge_mode_valid(struct drm_bridge *bridge,
+						      const struct drm_display_info *info,
+						      const struct drm_display_mode *mode)
+{
+	int id = dsi_mgr_bridge_get_id(bridge);
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct mipi_dsi_host *host = msm_dsi->host;
+	struct platform_device *pdev = msm_dsi->pdev;
+	struct dev_pm_opp *opp;
+	unsigned long byte_clk_rate;
+
+	byte_clk_rate = dsi_byte_clk_get_rate(host, IS_BONDED_DSI(), mode);
+
+	opp = dev_pm_opp_find_freq_ceil(&pdev->dev, &byte_clk_rate);
+	if (!IS_ERR(opp)) {
+		dev_pm_opp_put(opp);
+	} else if (PTR_ERR(opp) == -ERANGE) {
+		/*
+		 * An empty table is created by devm_pm_opp_set_clkname() even
+		 * if there is none. Thus find_freq_ceil will still return
+		 * -ERANGE in such case.
+		 */
+		if (dev_pm_opp_get_opp_count(&pdev->dev) != 0)
+			return MODE_CLOCK_RANGE;
+	} else {
+			return MODE_ERROR;
+	}
+
+	return msm_dsi_host_check_dsc(host, mode);
+}
+
+static const struct drm_bridge_funcs dsi_mgr_bridge_funcs = {
+	.pre_enable = dsi_mgr_bridge_pre_enable,
+	.post_disable = dsi_mgr_bridge_post_disable,
+	.mode_set = dsi_mgr_bridge_mode_set,
+	.mode_valid = dsi_mgr_bridge_mode_valid,
+};
+
+/* initialize bridge */
+int msm_dsi_manager_bridge_init(struct msm_dsi *msm_dsi)
+{
+	struct drm_bridge *bridge = NULL;
+	struct dsi_bridge *dsi_bridge;
+	struct drm_encoder *encoder;
+	int ret;
+
+	dsi_bridge = devm_kzalloc(msm_dsi->dev->dev,
+				sizeof(*dsi_bridge), GFP_KERNEL);
+	if (!dsi_bridge)
+		return -ENOMEM;
+
+	dsi_bridge->id = msm_dsi->id;
+
+	encoder = msm_dsi->encoder;
+
+	bridge = &dsi_bridge->base;
+	bridge->funcs = &dsi_mgr_bridge_funcs;
+
+	ret = devm_drm_bridge_add(msm_dsi->dev->dev, bridge);
+	if (ret)
+		return ret;
+
+	ret = drm_bridge_attach(encoder, bridge, NULL, 0);
+	if (ret)
+		return ret;
+
+	msm_dsi->bridge = bridge;
+
+	return 0;
+}
+
+int msm_dsi_manager_ext_bridge_init(u8 id)
+{
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct drm_device *dev = msm_dsi->dev;
+	struct drm_encoder *encoder;
+	struct drm_bridge *int_bridge, *ext_bridge;
+	int ret;
+
+	int_bridge = msm_dsi->bridge;
+	ext_bridge = devm_drm_of_get_bridge(&msm_dsi->pdev->dev,
+					    msm_dsi->pdev->dev.of_node, 1, 0);
+	if (IS_ERR(ext_bridge))
+		return PTR_ERR(ext_bridge);
+
+	msm_dsi->external_bridge = ext_bridge;
+
+	encoder = msm_dsi->encoder;
+
+	/*
+	 * Try first to create the bridge without it creating its own
+	 * connector.. currently some bridges support this, and others
+	 * do not (and some support both modes)
+	 */
+	ret = drm_bridge_attach(encoder, ext_bridge, int_bridge,
+			DRM_BRIDGE_ATTACH_NO_CONNECTOR);
+	if (ret == -EINVAL) {
+		/*
+		 * link the internal dsi bridge to the external bridge,
+		 * connector is created by the next bridge.
+		 */
+		ret = drm_bridge_attach(encoder, ext_bridge, int_bridge, 0);
+		if (ret < 0)
+			return ret;
+	} else {
+		struct drm_connector *connector;
+
+		/* We are in charge of the connector, create one now. */
+		connector = drm_bridge_connector_init(dev, encoder);
+		if (IS_ERR(connector)) {
+			DRM_ERROR("Unable to create bridge connector\n");
+			return PTR_ERR(connector);
+		}
+
+		ret = drm_connector_attach_encoder(connector, encoder);
+		if (ret < 0)
+			return ret;
+	}
+
+	/* The pipeline is ready, ping encoders if necessary */
+	msm_dsi_manager_set_split_display(id);
+
+	return 0;
+}
+
+int msm_dsi_manager_cmd_xfer(int id, const struct mipi_dsi_msg *msg)
+{
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *msm_dsi0 = dsi_mgr_get_dsi(DSI_0);
+	struct mipi_dsi_host *host = msm_dsi->host;
+	bool is_read = (msg->rx_buf && msg->rx_len);
+	bool need_sync = (IS_SYNC_NEEDED() && !is_read);
+	int ret;
+
+	if (!msg->tx_buf || !msg->tx_len)
+		return 0;
+
+	/* In bonded master case, panel requires the same commands sent to
+	 * both DSI links. Host issues the command trigger to both links
+	 * when DSI_1 calls the cmd transfer function, no matter it happens
+	 * before or after DSI_0 cmd transfer.
+	 */
+	if (need_sync && (id == DSI_0))
+		return is_read ? msg->rx_len : msg->tx_len;
+
+	if (need_sync && msm_dsi0) {
+		ret = msm_dsi_host_xfer_prepare(msm_dsi0->host, msg);
+		if (ret) {
+			pr_err("%s: failed to prepare non-trigger host, %d\n",
+				__func__, ret);
+			return ret;
+		}
+	}
+	ret = msm_dsi_host_xfer_prepare(host, msg);
+	if (ret) {
+		pr_err("%s: failed to prepare host, %d\n", __func__, ret);
+		goto restore_host0;
+	}
+
+	ret = is_read ? msm_dsi_host_cmd_rx(host, msg) :
+			msm_dsi_host_cmd_tx(host, msg);
+
+	msm_dsi_host_xfer_restore(host, msg);
+
+restore_host0:
+	if (need_sync && msm_dsi0)
+		msm_dsi_host_xfer_restore(msm_dsi0->host, msg);
+
+	return ret;
+}
+
+bool msm_dsi_manager_cmd_xfer_trigger(int id, u32 dma_base, u32 len)
+{
+	struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id);
+	struct msm_dsi *msm_dsi0 = dsi_mgr_get_dsi(DSI_0);
+	struct mipi_dsi_host *host = msm_dsi->host;
+
+	if (IS_SYNC_NEEDED() && (id == DSI_0))
+		return false;
+
+	if (IS_SYNC_NEEDED() && msm_dsi0)
+		msm_dsi_host_cmd_xfer_commit(msm_dsi0->host, dma_base, len);
+
+	msm_dsi_host_cmd_xfer_commit(host, dma_base, len);
+
+	return true;
+}
+
+int msm_dsi_manager_register(struct msm_dsi *msm_dsi)
+{
+	struct msm_dsi_manager *msm_dsim = &msm_dsim_glb;
+	int id = msm_dsi->id;
+	int ret;
+
+	if (id >= DSI_MAX) {
+		pr_err("%s: invalid id %d\n", __func__, id);
+		return -EINVAL;
+	}
+
+	if (msm_dsim->dsi[id]) {
+		pr_err("%s: dsi%d already registered\n", __func__, id);
+		return -EBUSY;
+	}
+
+	msm_dsim->dsi[id] = msm_dsi;
+
+	ret = dsi_mgr_parse_of(msm_dsi->pdev->dev.of_node, id);
+	if (ret) {
+		pr_err("%s: failed to parse OF DSI info\n", __func__);
+		goto fail;
+	}
+
+	ret = dsi_mgr_setup_components(id);
+	if (ret) {
+		pr_err("%s: failed to register mipi dsi host for DSI %d: %d\n",
+			__func__, id, ret);
+		goto fail;
+	}
+
+	return 0;
+
+fail:
+	msm_dsim->dsi[id] = NULL;
+	return ret;
+}
+
+void msm_dsi_manager_unregister(struct msm_dsi *msm_dsi)
+{
+	struct msm_dsi_manager *msm_dsim = &msm_dsim_glb;
+
+	if (msm_dsi->host)
+		msm_dsi_host_unregister(msm_dsi->host);
+
+	if (msm_dsi->id >= 0)
+		msm_dsim->dsi[msm_dsi->id] = NULL;
+}
+
+bool msm_dsi_is_bonded_dsi(struct msm_dsi *msm_dsi)
+{
+	return IS_BONDED_DSI();
+}
+
+bool msm_dsi_is_master_dsi(struct msm_dsi *msm_dsi)
+{
+	return IS_MASTER_DSI_LINK(msm_dsi->id);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/mmss_cc.xml.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/mmss_cc.xml.h
@@ -0,0 +1,131 @@
+#ifndef MMSS_CC_XML
+#define MMSS_CC_XML
+
+/* Autogenerated file, DO NOT EDIT manually!
+
+This file was generated by the rules-ng-ng headergen tool in this git repository:
+http://github.com/freedreno/envytools/
+git clone https://github.com/freedreno/envytools.git
+
+The rules-ng-ng source files this header was generated from are:
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/msm.xml                   (    944 bytes, from 2022-07-23 20:21:46)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/freedreno_copyright.xml   (   1572 bytes, from 2022-07-23 20:21:46)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/mdp/mdp4.xml              (  20912 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/mdp/mdp_common.xml        (   2849 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/mdp/mdp5.xml              (  37461 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi.xml               (  18746 bytes, from 2022-04-28 17:29:36)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_v2.xml        (   3236 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_28nm_8960.xml (   4935 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_28nm.xml      (   7004 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_20nm.xml      (   3712 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_14nm.xml      (   5381 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_10nm.xml      (   4499 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_7nm.xml       (  11007 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/sfpb.xml              (    602 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/mmss_cc.xml           (   1686 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/hdmi/qfprom.xml           (    600 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/hdmi/hdmi.xml             (  42350 bytes, from 2022-09-20 17:45:56)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/edp/edp.xml               (  10416 bytes, from 2022-03-08 17:40:42)
+
+Copyright (C) 2013-2022 by the following authors:
+- Rob Clark <robdclark@gmail.com> (robclark)
+- Ilia Mirkin <imirkin@alum.mit.edu> (imirkin)
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice (including the
+next paragraph) shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+
+enum mmss_cc_clk {
+	CLK = 0,
+	PCLK = 1,
+};
+
+#define REG_MMSS_CC_AHB						0x00000008
+
+static inline uint32_t __offset_CLK(enum mmss_cc_clk idx)
+{
+	switch (idx) {
+		case CLK: return 0x0000004c;
+		case PCLK: return 0x00000130;
+		default: return INVALID_IDX(idx);
+	}
+}
+static inline uint32_t REG_MMSS_CC_CLK(enum mmss_cc_clk i0) { return 0x00000000 + __offset_CLK(i0); }
+
+static inline uint32_t REG_MMSS_CC_CLK_CC(enum mmss_cc_clk i0) { return 0x00000000 + __offset_CLK(i0); }
+#define MMSS_CC_CLK_CC_CLK_EN					0x00000001
+#define MMSS_CC_CLK_CC_ROOT_EN					0x00000004
+#define MMSS_CC_CLK_CC_MND_EN					0x00000020
+#define MMSS_CC_CLK_CC_MND_MODE__MASK				0x000000c0
+#define MMSS_CC_CLK_CC_MND_MODE__SHIFT				6
+static inline uint32_t MMSS_CC_CLK_CC_MND_MODE(uint32_t val)
+{
+	return ((val) << MMSS_CC_CLK_CC_MND_MODE__SHIFT) & MMSS_CC_CLK_CC_MND_MODE__MASK;
+}
+#define MMSS_CC_CLK_CC_PMXO_SEL__MASK				0x00000300
+#define MMSS_CC_CLK_CC_PMXO_SEL__SHIFT				8
+static inline uint32_t MMSS_CC_CLK_CC_PMXO_SEL(uint32_t val)
+{
+	return ((val) << MMSS_CC_CLK_CC_PMXO_SEL__SHIFT) & MMSS_CC_CLK_CC_PMXO_SEL__MASK;
+}
+
+static inline uint32_t REG_MMSS_CC_CLK_MD(enum mmss_cc_clk i0) { return 0x00000004 + __offset_CLK(i0); }
+#define MMSS_CC_CLK_MD_D__MASK					0x000000ff
+#define MMSS_CC_CLK_MD_D__SHIFT					0
+static inline uint32_t MMSS_CC_CLK_MD_D(uint32_t val)
+{
+	return ((val) << MMSS_CC_CLK_MD_D__SHIFT) & MMSS_CC_CLK_MD_D__MASK;
+}
+#define MMSS_CC_CLK_MD_M__MASK					0x0000ff00
+#define MMSS_CC_CLK_MD_M__SHIFT					8
+static inline uint32_t MMSS_CC_CLK_MD_M(uint32_t val)
+{
+	return ((val) << MMSS_CC_CLK_MD_M__SHIFT) & MMSS_CC_CLK_MD_M__MASK;
+}
+
+static inline uint32_t REG_MMSS_CC_CLK_NS(enum mmss_cc_clk i0) { return 0x00000008 + __offset_CLK(i0); }
+#define MMSS_CC_CLK_NS_SRC__MASK				0x0000000f
+#define MMSS_CC_CLK_NS_SRC__SHIFT				0
+static inline uint32_t MMSS_CC_CLK_NS_SRC(uint32_t val)
+{
+	return ((val) << MMSS_CC_CLK_NS_SRC__SHIFT) & MMSS_CC_CLK_NS_SRC__MASK;
+}
+#define MMSS_CC_CLK_NS_PRE_DIV_FUNC__MASK			0x00fff000
+#define MMSS_CC_CLK_NS_PRE_DIV_FUNC__SHIFT			12
+static inline uint32_t MMSS_CC_CLK_NS_PRE_DIV_FUNC(uint32_t val)
+{
+	return ((val) << MMSS_CC_CLK_NS_PRE_DIV_FUNC__SHIFT) & MMSS_CC_CLK_NS_PRE_DIV_FUNC__MASK;
+}
+#define MMSS_CC_CLK_NS_VAL__MASK				0xff000000
+#define MMSS_CC_CLK_NS_VAL__SHIFT				24
+static inline uint32_t MMSS_CC_CLK_NS_VAL(uint32_t val)
+{
+	return ((val) << MMSS_CC_CLK_NS_VAL__SHIFT) & MMSS_CC_CLK_NS_VAL__MASK;
+}
+
+#define REG_MMSS_CC_DSI2_PIXEL_CC				0x00000094
+
+#define REG_MMSS_CC_DSI2_PIXEL_NS				0x000000e4
+
+#define REG_MMSS_CC_DSI2_PIXEL_CC2				0x00000264
+
+
+#endif /* MMSS_CC_XML */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy.c
@@ -0,0 +1,881 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/platform_device.h>
+#include <dt-bindings/phy/phy.h>
+
+#include "dsi_phy.h"
+
+#define S_DIV_ROUND_UP(n, d)	\
+	(((n) >= 0) ? (((n) + (d) - 1) / (d)) : (((n) - (d) + 1) / (d)))
+
+static inline s32 linear_inter(s32 tmax, s32 tmin, s32 percent,
+				s32 min_result, bool even)
+{
+	s32 v;
+
+	v = (tmax - tmin) * percent;
+	v = S_DIV_ROUND_UP(v, 100) + tmin;
+	if (even && (v & 0x1))
+		return max_t(s32, min_result, v - 1);
+	else
+		return max_t(s32, min_result, v);
+}
+
+static void dsi_dphy_timing_calc_clk_zero(struct msm_dsi_dphy_timing *timing,
+					s32 ui, s32 coeff, s32 pcnt)
+{
+	s32 tmax, tmin, clk_z;
+	s32 temp;
+
+	/* reset */
+	temp = 300 * coeff - ((timing->clk_prepare >> 1) + 1) * 2 * ui;
+	tmin = S_DIV_ROUND_UP(temp, ui) - 2;
+	if (tmin > 255) {
+		tmax = 511;
+		clk_z = linear_inter(2 * tmin, tmin, pcnt, 0, true);
+	} else {
+		tmax = 255;
+		clk_z = linear_inter(tmax, tmin, pcnt, 0, true);
+	}
+
+	/* adjust */
+	temp = (timing->hs_rqst + timing->clk_prepare + clk_z) & 0x7;
+	timing->clk_zero = clk_z + 8 - temp;
+}
+
+int msm_dsi_dphy_timing_calc(struct msm_dsi_dphy_timing *timing,
+			     struct msm_dsi_phy_clk_request *clk_req)
+{
+	const unsigned long bit_rate = clk_req->bitclk_rate;
+	const unsigned long esc_rate = clk_req->escclk_rate;
+	s32 ui, lpx;
+	s32 tmax, tmin;
+	s32 pcnt0 = 10;
+	s32 pcnt1 = (bit_rate > 1200000000) ? 15 : 10;
+	s32 pcnt2 = 10;
+	s32 pcnt3 = (bit_rate > 180000000) ? 10 : 40;
+	s32 coeff = 1000; /* Precision, should avoid overflow */
+	s32 temp;
+
+	if (!bit_rate || !esc_rate)
+		return -EINVAL;
+
+	ui = mult_frac(NSEC_PER_MSEC, coeff, bit_rate / 1000);
+	lpx = mult_frac(NSEC_PER_MSEC, coeff, esc_rate / 1000);
+
+	tmax = S_DIV_ROUND_UP(95 * coeff, ui) - 2;
+	tmin = S_DIV_ROUND_UP(38 * coeff, ui) - 2;
+	timing->clk_prepare = linear_inter(tmax, tmin, pcnt0, 0, true);
+
+	temp = lpx / ui;
+	if (temp & 0x1)
+		timing->hs_rqst = temp;
+	else
+		timing->hs_rqst = max_t(s32, 0, temp - 2);
+
+	/* Calculate clk_zero after clk_prepare and hs_rqst */
+	dsi_dphy_timing_calc_clk_zero(timing, ui, coeff, pcnt2);
+
+	temp = 105 * coeff + 12 * ui - 20 * coeff;
+	tmax = S_DIV_ROUND_UP(temp, ui) - 2;
+	tmin = S_DIV_ROUND_UP(60 * coeff, ui) - 2;
+	timing->clk_trail = linear_inter(tmax, tmin, pcnt3, 0, true);
+
+	temp = 85 * coeff + 6 * ui;
+	tmax = S_DIV_ROUND_UP(temp, ui) - 2;
+	temp = 40 * coeff + 4 * ui;
+	tmin = S_DIV_ROUND_UP(temp, ui) - 2;
+	timing->hs_prepare = linear_inter(tmax, tmin, pcnt1, 0, true);
+
+	tmax = 255;
+	temp = ((timing->hs_prepare >> 1) + 1) * 2 * ui + 2 * ui;
+	temp = 145 * coeff + 10 * ui - temp;
+	tmin = S_DIV_ROUND_UP(temp, ui) - 2;
+	timing->hs_zero = linear_inter(tmax, tmin, pcnt2, 24, true);
+
+	temp = 105 * coeff + 12 * ui - 20 * coeff;
+	tmax = S_DIV_ROUND_UP(temp, ui) - 2;
+	temp = 60 * coeff + 4 * ui;
+	tmin = DIV_ROUND_UP(temp, ui) - 2;
+	timing->hs_trail = linear_inter(tmax, tmin, pcnt3, 0, true);
+
+	tmax = 255;
+	tmin = S_DIV_ROUND_UP(100 * coeff, ui) - 2;
+	timing->hs_exit = linear_inter(tmax, tmin, pcnt2, 0, true);
+
+	tmax = 63;
+	temp = ((timing->hs_exit >> 1) + 1) * 2 * ui;
+	temp = 60 * coeff + 52 * ui - 24 * ui - temp;
+	tmin = S_DIV_ROUND_UP(temp, 8 * ui) - 1;
+	timing->shared_timings.clk_post = linear_inter(tmax, tmin, pcnt2, 0,
+						       false);
+	tmax = 63;
+	temp = ((timing->clk_prepare >> 1) + 1) * 2 * ui;
+	temp += ((timing->clk_zero >> 1) + 1) * 2 * ui;
+	temp += 8 * ui + lpx;
+	tmin = S_DIV_ROUND_UP(temp, 8 * ui) - 1;
+	if (tmin > tmax) {
+		temp = linear_inter(2 * tmax, tmin, pcnt2, 0, false);
+		timing->shared_timings.clk_pre = temp >> 1;
+		timing->shared_timings.clk_pre_inc_by_2 = true;
+	} else {
+		timing->shared_timings.clk_pre =
+				linear_inter(tmax, tmin, pcnt2, 0, false);
+		timing->shared_timings.clk_pre_inc_by_2 = false;
+	}
+
+	timing->ta_go = 3;
+	timing->ta_sure = 0;
+	timing->ta_get = 4;
+
+	DBG("PHY timings: %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d",
+		timing->shared_timings.clk_pre, timing->shared_timings.clk_post,
+		timing->shared_timings.clk_pre_inc_by_2, timing->clk_zero,
+		timing->clk_trail, timing->clk_prepare, timing->hs_exit,
+		timing->hs_zero, timing->hs_prepare, timing->hs_trail,
+		timing->hs_rqst);
+
+	return 0;
+}
+
+int msm_dsi_dphy_timing_calc_v2(struct msm_dsi_dphy_timing *timing,
+				struct msm_dsi_phy_clk_request *clk_req)
+{
+	const unsigned long bit_rate = clk_req->bitclk_rate;
+	const unsigned long esc_rate = clk_req->escclk_rate;
+	s32 ui, ui_x8;
+	s32 tmax, tmin;
+	s32 pcnt0 = 50;
+	s32 pcnt1 = 50;
+	s32 pcnt2 = 10;
+	s32 pcnt3 = 30;
+	s32 pcnt4 = 10;
+	s32 pcnt5 = 2;
+	s32 coeff = 1000; /* Precision, should avoid overflow */
+	s32 hb_en, hb_en_ckln, pd_ckln, pd;
+	s32 val, val_ckln;
+	s32 temp;
+
+	if (!bit_rate || !esc_rate)
+		return -EINVAL;
+
+	timing->hs_halfbyte_en = 0;
+	hb_en = 0;
+	timing->hs_halfbyte_en_ckln = 0;
+	hb_en_ckln = 0;
+	timing->hs_prep_dly_ckln = (bit_rate > 100000000) ? 0 : 3;
+	pd_ckln = timing->hs_prep_dly_ckln;
+	timing->hs_prep_dly = (bit_rate > 120000000) ? 0 : 1;
+	pd = timing->hs_prep_dly;
+
+	val = (hb_en << 2) + (pd << 1);
+	val_ckln = (hb_en_ckln << 2) + (pd_ckln << 1);
+
+	ui = mult_frac(NSEC_PER_MSEC, coeff, bit_rate / 1000);
+	ui_x8 = ui << 3;
+
+	temp = S_DIV_ROUND_UP(38 * coeff - val_ckln * ui, ui_x8);
+	tmin = max_t(s32, temp, 0);
+	temp = (95 * coeff - val_ckln * ui) / ui_x8;
+	tmax = max_t(s32, temp, 0);
+	timing->clk_prepare = linear_inter(tmax, tmin, pcnt0, 0, false);
+
+	temp = 300 * coeff - ((timing->clk_prepare << 3) + val_ckln) * ui;
+	tmin = S_DIV_ROUND_UP(temp - 11 * ui, ui_x8) - 3;
+	tmax = (tmin > 255) ? 511 : 255;
+	timing->clk_zero = linear_inter(tmax, tmin, pcnt5, 0, false);
+
+	tmin = DIV_ROUND_UP(60 * coeff + 3 * ui, ui_x8);
+	temp = 105 * coeff + 12 * ui - 20 * coeff;
+	tmax = (temp + 3 * ui) / ui_x8;
+	timing->clk_trail = linear_inter(tmax, tmin, pcnt3, 0, false);
+
+	temp = S_DIV_ROUND_UP(40 * coeff + 4 * ui - val * ui, ui_x8);
+	tmin = max_t(s32, temp, 0);
+	temp = (85 * coeff + 6 * ui - val * ui) / ui_x8;
+	tmax = max_t(s32, temp, 0);
+	timing->hs_prepare = linear_inter(tmax, tmin, pcnt1, 0, false);
+
+	temp = 145 * coeff + 10 * ui - ((timing->hs_prepare << 3) + val) * ui;
+	tmin = S_DIV_ROUND_UP(temp - 11 * ui, ui_x8) - 3;
+	tmax = 255;
+	timing->hs_zero = linear_inter(tmax, tmin, pcnt4, 0, false);
+
+	tmin = DIV_ROUND_UP(60 * coeff + 4 * ui + 3 * ui, ui_x8);
+	temp = 105 * coeff + 12 * ui - 20 * coeff;
+	tmax = (temp + 3 * ui) / ui_x8;
+	timing->hs_trail = linear_inter(tmax, tmin, pcnt3, 0, false);
+
+	temp = 50 * coeff + ((hb_en << 2) - 8) * ui;
+	timing->hs_rqst = S_DIV_ROUND_UP(temp, ui_x8);
+
+	tmin = DIV_ROUND_UP(100 * coeff, ui_x8) - 1;
+	tmax = 255;
+	timing->hs_exit = linear_inter(tmax, tmin, pcnt2, 0, false);
+
+	temp = 50 * coeff + ((hb_en_ckln << 2) - 8) * ui;
+	timing->hs_rqst_ckln = S_DIV_ROUND_UP(temp, ui_x8);
+
+	temp = 60 * coeff + 52 * ui - 43 * ui;
+	tmin = DIV_ROUND_UP(temp, ui_x8) - 1;
+	tmax = 63;
+	timing->shared_timings.clk_post =
+				linear_inter(tmax, tmin, pcnt2, 0, false);
+
+	temp = 8 * ui + ((timing->clk_prepare << 3) + val_ckln) * ui;
+	temp += (((timing->clk_zero + 3) << 3) + 11 - (pd_ckln << 1)) * ui;
+	temp += hb_en_ckln ? (((timing->hs_rqst_ckln << 3) + 4) * ui) :
+				(((timing->hs_rqst_ckln << 3) + 8) * ui);
+	tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+	tmax = 63;
+	if (tmin > tmax) {
+		temp = linear_inter(tmax << 1, tmin, pcnt2, 0, false);
+		timing->shared_timings.clk_pre = temp >> 1;
+		timing->shared_timings.clk_pre_inc_by_2 = 1;
+	} else {
+		timing->shared_timings.clk_pre =
+				linear_inter(tmax, tmin, pcnt2, 0, false);
+		timing->shared_timings.clk_pre_inc_by_2 = 0;
+	}
+
+	timing->ta_go = 3;
+	timing->ta_sure = 0;
+	timing->ta_get = 4;
+
+	DBG("%d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d",
+	    timing->shared_timings.clk_pre, timing->shared_timings.clk_post,
+	    timing->shared_timings.clk_pre_inc_by_2, timing->clk_zero,
+	    timing->clk_trail, timing->clk_prepare, timing->hs_exit,
+	    timing->hs_zero, timing->hs_prepare, timing->hs_trail,
+	    timing->hs_rqst, timing->hs_rqst_ckln, timing->hs_halfbyte_en,
+	    timing->hs_halfbyte_en_ckln, timing->hs_prep_dly,
+	    timing->hs_prep_dly_ckln);
+
+	return 0;
+}
+
+int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
+	struct msm_dsi_phy_clk_request *clk_req)
+{
+	const unsigned long bit_rate = clk_req->bitclk_rate;
+	const unsigned long esc_rate = clk_req->escclk_rate;
+	s32 ui, ui_x8;
+	s32 tmax, tmin;
+	s32 pcnt0 = 50;
+	s32 pcnt1 = 50;
+	s32 pcnt2 = 10;
+	s32 pcnt3 = 30;
+	s32 pcnt4 = 10;
+	s32 pcnt5 = 2;
+	s32 coeff = 1000; /* Precision, should avoid overflow */
+	s32 hb_en, hb_en_ckln;
+	s32 temp;
+
+	if (!bit_rate || !esc_rate)
+		return -EINVAL;
+
+	timing->hs_halfbyte_en = 0;
+	hb_en = 0;
+	timing->hs_halfbyte_en_ckln = 0;
+	hb_en_ckln = 0;
+
+	ui = mult_frac(NSEC_PER_MSEC, coeff, bit_rate / 1000);
+	ui_x8 = ui << 3;
+
+	temp = S_DIV_ROUND_UP(38 * coeff, ui_x8);
+	tmin = max_t(s32, temp, 0);
+	temp = (95 * coeff) / ui_x8;
+	tmax = max_t(s32, temp, 0);
+	timing->clk_prepare = linear_inter(tmax, tmin, pcnt0, 0, false);
+
+	temp = 300 * coeff - (timing->clk_prepare << 3) * ui;
+	tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+	tmax = (tmin > 255) ? 511 : 255;
+	timing->clk_zero = linear_inter(tmax, tmin, pcnt5, 0, false);
+
+	tmin = DIV_ROUND_UP(60 * coeff + 3 * ui, ui_x8);
+	temp = 105 * coeff + 12 * ui - 20 * coeff;
+	tmax = (temp + 3 * ui) / ui_x8;
+	timing->clk_trail = linear_inter(tmax, tmin, pcnt3, 0, false);
+
+	temp = S_DIV_ROUND_UP(40 * coeff + 4 * ui, ui_x8);
+	tmin = max_t(s32, temp, 0);
+	temp = (85 * coeff + 6 * ui) / ui_x8;
+	tmax = max_t(s32, temp, 0);
+	timing->hs_prepare = linear_inter(tmax, tmin, pcnt1, 0, false);
+
+	temp = 145 * coeff + 10 * ui - (timing->hs_prepare << 3) * ui;
+	tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+	tmax = 255;
+	timing->hs_zero = linear_inter(tmax, tmin, pcnt4, 0, false);
+
+	tmin = DIV_ROUND_UP(60 * coeff + 4 * ui, ui_x8) - 1;
+	temp = 105 * coeff + 12 * ui - 20 * coeff;
+	tmax = (temp / ui_x8) - 1;
+	timing->hs_trail = linear_inter(tmax, tmin, pcnt3, 0, false);
+
+	temp = 50 * coeff + ((hb_en << 2) - 8) * ui;
+	timing->hs_rqst = S_DIV_ROUND_UP(temp, ui_x8);
+
+	tmin = DIV_ROUND_UP(100 * coeff, ui_x8) - 1;
+	tmax = 255;
+	timing->hs_exit = linear_inter(tmax, tmin, pcnt2, 0, false);
+
+	temp = 50 * coeff + ((hb_en_ckln << 2) - 8) * ui;
+	timing->hs_rqst_ckln = S_DIV_ROUND_UP(temp, ui_x8);
+
+	temp = 60 * coeff + 52 * ui - 43 * ui;
+	tmin = DIV_ROUND_UP(temp, ui_x8) - 1;
+	tmax = 63;
+	timing->shared_timings.clk_post =
+		linear_inter(tmax, tmin, pcnt2, 0, false);
+
+	temp = 8 * ui + (timing->clk_prepare << 3) * ui;
+	temp += (((timing->clk_zero + 3) << 3) + 11) * ui;
+	temp += hb_en_ckln ? (((timing->hs_rqst_ckln << 3) + 4) * ui) :
+		(((timing->hs_rqst_ckln << 3) + 8) * ui);
+	tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+	tmax = 63;
+	if (tmin > tmax) {
+		temp = linear_inter(tmax << 1, tmin, pcnt2, 0, false);
+		timing->shared_timings.clk_pre = temp >> 1;
+		timing->shared_timings.clk_pre_inc_by_2 = 1;
+	} else {
+		timing->shared_timings.clk_pre =
+			linear_inter(tmax, tmin, pcnt2, 0, false);
+		timing->shared_timings.clk_pre_inc_by_2 = 0;
+	}
+
+	timing->shared_timings.byte_intf_clk_div_2 = true;
+
+	timing->ta_go = 3;
+	timing->ta_sure = 0;
+	timing->ta_get = 4;
+
+	DBG("%d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d",
+		timing->shared_timings.clk_pre, timing->shared_timings.clk_post,
+		timing->shared_timings.clk_pre_inc_by_2, timing->clk_zero,
+		timing->clk_trail, timing->clk_prepare, timing->hs_exit,
+		timing->hs_zero, timing->hs_prepare, timing->hs_trail,
+		timing->hs_rqst, timing->hs_rqst_ckln, timing->hs_halfbyte_en,
+		timing->hs_halfbyte_en_ckln, timing->hs_prep_dly,
+		timing->hs_prep_dly_ckln);
+
+	return 0;
+}
+
+int msm_dsi_dphy_timing_calc_v4(struct msm_dsi_dphy_timing *timing,
+	struct msm_dsi_phy_clk_request *clk_req)
+{
+	const unsigned long bit_rate = clk_req->bitclk_rate;
+	const unsigned long esc_rate = clk_req->escclk_rate;
+	s32 ui, ui_x8;
+	s32 tmax, tmin;
+	s32 pcnt_clk_prep = 50;
+	s32 pcnt_clk_zero = 2;
+	s32 pcnt_clk_trail = 30;
+	s32 pcnt_hs_prep = 50;
+	s32 pcnt_hs_zero = 10;
+	s32 pcnt_hs_trail = 30;
+	s32 pcnt_hs_exit = 10;
+	s32 coeff = 1000; /* Precision, should avoid overflow */
+	s32 hb_en;
+	s32 temp;
+
+	if (!bit_rate || !esc_rate)
+		return -EINVAL;
+
+	hb_en = 0;
+
+	ui = mult_frac(NSEC_PER_MSEC, coeff, bit_rate / 1000);
+	ui_x8 = ui << 3;
+
+	/* TODO: verify these calculations against latest downstream driver
+	 * everything except clk_post/clk_pre uses calculations from v3 based
+	 * on the downstream driver having the same calculations for v3 and v4
+	 */
+
+	temp = S_DIV_ROUND_UP(38 * coeff, ui_x8);
+	tmin = max_t(s32, temp, 0);
+	temp = (95 * coeff) / ui_x8;
+	tmax = max_t(s32, temp, 0);
+	timing->clk_prepare = linear_inter(tmax, tmin, pcnt_clk_prep, 0, false);
+
+	temp = 300 * coeff - (timing->clk_prepare << 3) * ui;
+	tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+	tmax = (tmin > 255) ? 511 : 255;
+	timing->clk_zero = linear_inter(tmax, tmin, pcnt_clk_zero, 0, false);
+
+	tmin = DIV_ROUND_UP(60 * coeff + 3 * ui, ui_x8);
+	temp = 105 * coeff + 12 * ui - 20 * coeff;
+	tmax = (temp + 3 * ui) / ui_x8;
+	timing->clk_trail = linear_inter(tmax, tmin, pcnt_clk_trail, 0, false);
+
+	temp = S_DIV_ROUND_UP(40 * coeff + 4 * ui, ui_x8);
+	tmin = max_t(s32, temp, 0);
+	temp = (85 * coeff + 6 * ui) / ui_x8;
+	tmax = max_t(s32, temp, 0);
+	timing->hs_prepare = linear_inter(tmax, tmin, pcnt_hs_prep, 0, false);
+
+	temp = 145 * coeff + 10 * ui - (timing->hs_prepare << 3) * ui;
+	tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+	tmax = 255;
+	timing->hs_zero = linear_inter(tmax, tmin, pcnt_hs_zero, 0, false);
+
+	tmin = DIV_ROUND_UP(60 * coeff + 4 * ui, ui_x8) - 1;
+	temp = 105 * coeff + 12 * ui - 20 * coeff;
+	tmax = (temp / ui_x8) - 1;
+	timing->hs_trail = linear_inter(tmax, tmin, pcnt_hs_trail, 0, false);
+
+	temp = 50 * coeff + ((hb_en << 2) - 8) * ui;
+	timing->hs_rqst = S_DIV_ROUND_UP(temp, ui_x8);
+
+	tmin = DIV_ROUND_UP(100 * coeff, ui_x8) - 1;
+	tmax = 255;
+	timing->hs_exit = linear_inter(tmax, tmin, pcnt_hs_exit, 0, false);
+
+	/* recommended min
+	 * = roundup((mipi_min_ns + t_hs_trail_ns)/(16*bit_clk_ns), 0) - 1
+	 */
+	temp = 60 * coeff + 52 * ui + + (timing->hs_trail + 1) * ui_x8;
+	tmin = DIV_ROUND_UP(temp, 16 * ui) - 1;
+	tmax = 255;
+	timing->shared_timings.clk_post = linear_inter(tmax, tmin, 5, 0, false);
+
+	/* recommended min
+	 * val1 = (tlpx_ns + clk_prepare_ns + clk_zero_ns + hs_rqst_ns)
+	 * val2 = (16 * bit_clk_ns)
+	 * final = roundup(val1/val2, 0) - 1
+	 */
+	temp = 52 * coeff + (timing->clk_prepare + timing->clk_zero + 1) * ui_x8 + 54 * coeff;
+	tmin = DIV_ROUND_UP(temp, 16 * ui) - 1;
+	tmax = 255;
+	timing->shared_timings.clk_pre = DIV_ROUND_UP((tmax - tmin) * 125, 10000) + tmin;
+
+	timing->shared_timings.byte_intf_clk_div_2 = true;
+
+	DBG("%d, %d, %d, %d, %d, %d, %d, %d, %d, %d",
+		timing->shared_timings.clk_pre, timing->shared_timings.clk_post,
+		timing->clk_zero, timing->clk_trail, timing->clk_prepare, timing->hs_exit,
+		timing->hs_zero, timing->hs_prepare, timing->hs_trail, timing->hs_rqst);
+
+	return 0;
+}
+
+int msm_dsi_cphy_timing_calc_v4(struct msm_dsi_dphy_timing *timing,
+	struct msm_dsi_phy_clk_request *clk_req)
+{
+	const unsigned long bit_rate = clk_req->bitclk_rate;
+	const unsigned long esc_rate = clk_req->escclk_rate;
+	s32 ui, ui_x7;
+	s32 tmax, tmin;
+	s32 coeff = 1000; /* Precision, should avoid overflow */
+	s32 temp;
+
+	if (!bit_rate || !esc_rate)
+		return -EINVAL;
+
+	ui = mult_frac(NSEC_PER_MSEC, coeff, bit_rate / 1000);
+	ui_x7 = ui * 7;
+
+	temp = S_DIV_ROUND_UP(38 * coeff, ui_x7);
+	tmin = max_t(s32, temp, 0);
+	temp = (95 * coeff) / ui_x7;
+	tmax = max_t(s32, temp, 0);
+	timing->clk_prepare = linear_inter(tmax, tmin, 50, 0, false);
+
+	tmin = DIV_ROUND_UP(50 * coeff, ui_x7);
+	tmax = 255;
+	timing->hs_rqst = linear_inter(tmax, tmin, 1, 0, false);
+
+	tmin = DIV_ROUND_UP(100 * coeff, ui_x7) - 1;
+	tmax = 255;
+	timing->hs_exit = linear_inter(tmax, tmin, 10, 0, false);
+
+	tmin = 1;
+	tmax = 32;
+	timing->shared_timings.clk_post = linear_inter(tmax, tmin, 80, 0, false);
+
+	tmin = min_t(s32, 64, S_DIV_ROUND_UP(262 * coeff, ui_x7) - 1);
+	tmax = 64;
+	timing->shared_timings.clk_pre = linear_inter(tmax, tmin, 20, 0, false);
+
+	DBG("%d, %d, %d, %d, %d",
+		timing->shared_timings.clk_pre, timing->shared_timings.clk_post,
+		timing->clk_prepare, timing->hs_exit, timing->hs_rqst);
+
+	return 0;
+}
+
+static int dsi_phy_enable_resource(struct msm_dsi_phy *phy)
+{
+	struct device *dev = &phy->pdev->dev;
+	int ret;
+
+	ret = pm_runtime_resume_and_get(dev);
+	if (ret)
+		return ret;
+
+	ret = clk_prepare_enable(phy->ahb_clk);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "%s: can't enable ahb clk, %d\n", __func__, ret);
+		pm_runtime_put_sync(dev);
+	}
+
+	return ret;
+}
+
+static void dsi_phy_disable_resource(struct msm_dsi_phy *phy)
+{
+	clk_disable_unprepare(phy->ahb_clk);
+	pm_runtime_put(&phy->pdev->dev);
+}
+
+static const struct of_device_id dsi_phy_dt_match[] = {
+#ifdef CONFIG_DRM_MSM_DSI_28NM_PHY
+	{ .compatible = "qcom,dsi-phy-28nm-hpm",
+	  .data = &dsi_phy_28nm_hpm_cfgs },
+	{ .compatible = "qcom,dsi-phy-28nm-hpm-fam-b",
+	  .data = &dsi_phy_28nm_hpm_famb_cfgs },
+	{ .compatible = "qcom,dsi-phy-28nm-lp",
+	  .data = &dsi_phy_28nm_lp_cfgs },
+	{ .compatible = "qcom,dsi-phy-28nm-8226",
+	  .data = &dsi_phy_28nm_8226_cfgs },
+#endif
+#ifdef CONFIG_DRM_MSM_DSI_20NM_PHY
+	{ .compatible = "qcom,dsi-phy-20nm",
+	  .data = &dsi_phy_20nm_cfgs },
+#endif
+#ifdef CONFIG_DRM_MSM_DSI_28NM_8960_PHY
+	{ .compatible = "qcom,dsi-phy-28nm-8960",
+	  .data = &dsi_phy_28nm_8960_cfgs },
+#endif
+#ifdef CONFIG_DRM_MSM_DSI_14NM_PHY
+	{ .compatible = "qcom,dsi-phy-14nm",
+	  .data = &dsi_phy_14nm_cfgs },
+	{ .compatible = "qcom,dsi-phy-14nm-2290",
+	  .data = &dsi_phy_14nm_2290_cfgs },
+	{ .compatible = "qcom,dsi-phy-14nm-660",
+	  .data = &dsi_phy_14nm_660_cfgs },
+	{ .compatible = "qcom,dsi-phy-14nm-8953",
+	  .data = &dsi_phy_14nm_8953_cfgs },
+	{ .compatible = "qcom,sm6125-dsi-phy-14nm",
+	  .data = &dsi_phy_14nm_2290_cfgs },
+#endif
+#ifdef CONFIG_DRM_MSM_DSI_10NM_PHY
+	{ .compatible = "qcom,dsi-phy-10nm",
+	  .data = &dsi_phy_10nm_cfgs },
+	{ .compatible = "qcom,dsi-phy-10nm-8998",
+	  .data = &dsi_phy_10nm_8998_cfgs },
+#endif
+#ifdef CONFIG_DRM_MSM_DSI_7NM_PHY
+	{ .compatible = "qcom,dsi-phy-7nm",
+	  .data = &dsi_phy_7nm_cfgs },
+	{ .compatible = "qcom,dsi-phy-7nm-8150",
+	  .data = &dsi_phy_7nm_8150_cfgs },
+	{ .compatible = "qcom,sc7280-dsi-phy-7nm",
+	  .data = &dsi_phy_7nm_7280_cfgs },
+	{ .compatible = "qcom,sm6375-dsi-phy-7nm",
+	  .data = &dsi_phy_7nm_6375_cfgs },
+	{ .compatible = "qcom,sm8350-dsi-phy-5nm",
+	  .data = &dsi_phy_5nm_8350_cfgs },
+	{ .compatible = "qcom,sa8775p-dsi-phy-5nm",
+	  .data = &dsi_phy_5nm_8775_cfgs },
+	{ .compatible = "qcom,sm8450-dsi-phy-5nm",
+	  .data = &dsi_phy_5nm_8450_cfgs },
+	{ .compatible = "qcom,sm8550-dsi-phy-4nm",
+	  .data = &dsi_phy_4nm_8550_cfgs },
+	{ .compatible = "qcom,sm8650-dsi-phy-4nm",
+	  .data = &dsi_phy_4nm_8650_cfgs },
+#endif
+	{}
+};
+
+/*
+ * Currently, we only support one SoC for each PHY type. When we have multiple
+ * SoCs for the same PHY, we can try to make the index searching a bit more
+ * clever.
+ */
+static int dsi_phy_get_id(struct msm_dsi_phy *phy)
+{
+	struct platform_device *pdev = phy->pdev;
+	const struct msm_dsi_phy_cfg *cfg = phy->cfg;
+	struct resource *res;
+	int i;
+
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dsi_phy");
+	if (!res)
+		return -EINVAL;
+
+	for (i = 0; i < cfg->num_dsi_phy; i++) {
+		if (cfg->io_start[i] == res->start)
+			return i;
+	}
+
+	return -EINVAL;
+}
+
+static int dsi_phy_driver_probe(struct platform_device *pdev)
+{
+	struct msm_dsi_phy *phy;
+	struct device *dev = &pdev->dev;
+	u32 phy_type;
+	int ret;
+
+	phy = devm_kzalloc(dev, sizeof(*phy), GFP_KERNEL);
+	if (!phy)
+		return -ENOMEM;
+
+	phy->provided_clocks = devm_kzalloc(dev,
+			struct_size(phy->provided_clocks, hws, NUM_PROVIDED_CLKS),
+			GFP_KERNEL);
+	if (!phy->provided_clocks)
+		return -ENOMEM;
+
+	phy->provided_clocks->num = NUM_PROVIDED_CLKS;
+
+	phy->cfg = of_device_get_match_data(&pdev->dev);
+	if (!phy->cfg)
+		return -ENODEV;
+
+	phy->pdev = pdev;
+
+	phy->id = dsi_phy_get_id(phy);
+	if (phy->id < 0)
+		return dev_err_probe(dev, phy->id,
+				     "Couldn't identify PHY index\n");
+
+	phy->regulator_ldo_mode = of_property_read_bool(dev->of_node,
+				"qcom,dsi-phy-regulator-ldo-mode");
+	if (!of_property_read_u32(dev->of_node, "phy-type", &phy_type))
+		phy->cphy_mode = (phy_type == PHY_TYPE_CPHY);
+
+	phy->base = msm_ioremap_size(pdev, "dsi_phy", &phy->base_size);
+	if (IS_ERR(phy->base))
+		return dev_err_probe(dev, PTR_ERR(phy->base),
+				     "Failed to map phy base\n");
+
+	phy->pll_base = msm_ioremap_size(pdev, "dsi_pll", &phy->pll_size);
+	if (IS_ERR(phy->pll_base))
+		return dev_err_probe(dev, PTR_ERR(phy->pll_base),
+				     "Failed to map pll base\n");
+
+	if (phy->cfg->has_phy_lane) {
+		phy->lane_base = msm_ioremap_size(pdev, "dsi_phy_lane", &phy->lane_size);
+		if (IS_ERR(phy->lane_base))
+			return dev_err_probe(dev, PTR_ERR(phy->lane_base),
+					     "Failed to map phy lane base\n");
+	}
+
+	if (phy->cfg->has_phy_regulator) {
+		phy->reg_base = msm_ioremap_size(pdev, "dsi_phy_regulator", &phy->reg_size);
+		if (IS_ERR(phy->reg_base))
+			return dev_err_probe(dev, PTR_ERR(phy->reg_base),
+					     "Failed to map phy regulator base\n");
+	}
+
+	if (phy->cfg->ops.parse_dt_properties) {
+		ret = phy->cfg->ops.parse_dt_properties(phy);
+		if (ret)
+			return ret;
+	}
+
+	ret = devm_regulator_bulk_get_const(dev, phy->cfg->num_regulators,
+					    phy->cfg->regulator_data,
+					    &phy->supplies);
+	if (ret)
+		return ret;
+
+	phy->ahb_clk = msm_clk_get(pdev, "iface");
+	if (IS_ERR(phy->ahb_clk))
+		return dev_err_probe(dev, PTR_ERR(phy->ahb_clk),
+				     "Unable to get ahb clk\n");
+
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		return ret;
+
+	/* PLL init will call into clk_register which requires
+	 * register access, so we need to enable power and ahb clock.
+	 */
+	ret = dsi_phy_enable_resource(phy);
+	if (ret)
+		return ret;
+
+	if (phy->cfg->ops.pll_init) {
+		ret = phy->cfg->ops.pll_init(phy);
+		if (ret)
+			return dev_err_probe(dev, ret,
+					     "PLL init failed; need separate clk driver\n");
+	}
+
+	ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get,
+				     phy->provided_clocks);
+	if (ret)
+		return dev_err_probe(dev, ret,
+				     "Failed to register clk provider\n");
+
+	dsi_phy_disable_resource(phy);
+
+	platform_set_drvdata(pdev, phy);
+
+	return 0;
+}
+
+static struct platform_driver dsi_phy_platform_driver = {
+	.probe      = dsi_phy_driver_probe,
+	.driver     = {
+		.name   = "msm_dsi_phy",
+		.of_match_table = dsi_phy_dt_match,
+	},
+};
+
+void __init msm_dsi_phy_driver_register(void)
+{
+	platform_driver_register(&dsi_phy_platform_driver);
+}
+
+void __exit msm_dsi_phy_driver_unregister(void)
+{
+	platform_driver_unregister(&dsi_phy_platform_driver);
+}
+
+int msm_dsi_phy_enable(struct msm_dsi_phy *phy,
+			struct msm_dsi_phy_clk_request *clk_req,
+			struct msm_dsi_phy_shared_timings *shared_timings)
+{
+	struct device *dev;
+	int ret;
+
+	if (!phy || !phy->cfg->ops.enable)
+		return -EINVAL;
+
+	dev = &phy->pdev->dev;
+
+	ret = dsi_phy_enable_resource(phy);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "%s: resource enable failed, %d\n",
+			__func__, ret);
+		goto res_en_fail;
+	}
+
+	ret = regulator_bulk_enable(phy->cfg->num_regulators, phy->supplies);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "%s: regulator enable failed, %d\n",
+			__func__, ret);
+		goto reg_en_fail;
+	}
+
+	ret = phy->cfg->ops.enable(phy, clk_req);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "%s: phy enable failed, %d\n", __func__, ret);
+		goto phy_en_fail;
+	}
+
+	memcpy(shared_timings, &phy->timing.shared_timings,
+	       sizeof(*shared_timings));
+
+	/*
+	 * Resetting DSI PHY silently changes its PLL registers to reset status,
+	 * which will confuse clock driver and result in wrong output rate of
+	 * link clocks. Restore PLL status if its PLL is being used as clock
+	 * source.
+	 */
+	if (phy->usecase != MSM_DSI_PHY_SLAVE) {
+		ret = msm_dsi_phy_pll_restore_state(phy);
+		if (ret) {
+			DRM_DEV_ERROR(dev, "%s: failed to restore phy state, %d\n",
+				__func__, ret);
+			goto pll_restor_fail;
+		}
+	}
+
+	return 0;
+
+pll_restor_fail:
+	if (phy->cfg->ops.disable)
+		phy->cfg->ops.disable(phy);
+phy_en_fail:
+	regulator_bulk_disable(phy->cfg->num_regulators, phy->supplies);
+reg_en_fail:
+	dsi_phy_disable_resource(phy);
+res_en_fail:
+	return ret;
+}
+
+void msm_dsi_phy_disable(struct msm_dsi_phy *phy)
+{
+	if (!phy || !phy->cfg->ops.disable)
+		return;
+
+	phy->cfg->ops.disable(phy);
+
+	regulator_bulk_disable(phy->cfg->num_regulators, phy->supplies);
+	dsi_phy_disable_resource(phy);
+}
+
+void msm_dsi_phy_set_usecase(struct msm_dsi_phy *phy,
+			     enum msm_dsi_phy_usecase uc)
+{
+	if (phy)
+		phy->usecase = uc;
+}
+
+/* Returns true if we have to clear DSI_LANE_CTRL.HS_REQ_SEL_PHY */
+bool msm_dsi_phy_set_continuous_clock(struct msm_dsi_phy *phy, bool enable)
+{
+	if (!phy || !phy->cfg->ops.set_continuous_clock)
+		return false;
+
+	return phy->cfg->ops.set_continuous_clock(phy, enable);
+}
+
+void msm_dsi_phy_pll_save_state(struct msm_dsi_phy *phy)
+{
+	if (phy->cfg->ops.save_pll_state) {
+		phy->cfg->ops.save_pll_state(phy);
+		phy->state_saved = true;
+	}
+}
+
+int msm_dsi_phy_pll_restore_state(struct msm_dsi_phy *phy)
+{
+	int ret;
+
+	if (phy->cfg->ops.restore_pll_state && phy->state_saved) {
+		ret = phy->cfg->ops.restore_pll_state(phy);
+		if (ret)
+			return ret;
+
+		phy->state_saved = false;
+	}
+
+	return 0;
+}
+
+void msm_dsi_phy_snapshot(struct msm_disp_state *disp_state, struct msm_dsi_phy *phy)
+{
+	msm_disp_snapshot_add_block(disp_state,
+			phy->base_size, phy->base,
+			"dsi%d_phy", phy->id);
+
+	/* Do not try accessing PLL registers if it is switched off */
+	if (phy->pll_on)
+		msm_disp_snapshot_add_block(disp_state,
+			phy->pll_size, phy->pll_base,
+			"dsi%d_pll", phy->id);
+
+	if (phy->lane_base)
+		msm_disp_snapshot_add_block(disp_state,
+			phy->lane_size, phy->lane_base,
+			"dsi%d_lane", phy->id);
+
+	if (phy->reg_base)
+		msm_disp_snapshot_add_block(disp_state,
+			phy->reg_size, phy->reg_base,
+			"dsi%d_reg", phy->id);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy.h
@@ -0,0 +1,142 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __DSI_PHY_H__
+#define __DSI_PHY_H__
+
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+#include <linux/regulator/consumer.h>
+
+#include "dsi.h"
+
+#define dsi_phy_read(offset) msm_readl((offset))
+#define dsi_phy_write(offset, data) msm_writel((data), (offset))
+#define dsi_phy_write_udelay(offset, data, delay_us) { msm_writel((data), (offset)); udelay(delay_us); }
+#define dsi_phy_write_ndelay(offset, data, delay_ns) { msm_writel((data), (offset)); ndelay(delay_ns); }
+
+struct msm_dsi_phy_ops {
+	int (*pll_init)(struct msm_dsi_phy *phy);
+	int (*enable)(struct msm_dsi_phy *phy,
+			struct msm_dsi_phy_clk_request *clk_req);
+	void (*disable)(struct msm_dsi_phy *phy);
+	void (*save_pll_state)(struct msm_dsi_phy *phy);
+	int (*restore_pll_state)(struct msm_dsi_phy *phy);
+	bool (*set_continuous_clock)(struct msm_dsi_phy *phy, bool enable);
+	int (*parse_dt_properties)(struct msm_dsi_phy *phy);
+};
+
+struct msm_dsi_phy_cfg {
+	const struct regulator_bulk_data *regulator_data;
+	int num_regulators;
+	struct msm_dsi_phy_ops ops;
+
+	unsigned long	min_pll_rate;
+	unsigned long	max_pll_rate;
+
+	const resource_size_t io_start[DSI_MAX];
+	const int num_dsi_phy;
+	const int quirks;
+	bool has_phy_regulator;
+	bool has_phy_lane;
+};
+
+extern const struct msm_dsi_phy_cfg dsi_phy_28nm_hpm_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_28nm_hpm_famb_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_28nm_lp_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_28nm_8226_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_28nm_8960_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_20nm_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_14nm_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_14nm_660_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_14nm_2290_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_14nm_8953_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_10nm_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_10nm_8998_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_7nm_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_7nm_6375_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_7nm_8150_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_7nm_7280_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_5nm_8350_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_5nm_8775_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_5nm_8450_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_4nm_8550_cfgs;
+extern const struct msm_dsi_phy_cfg dsi_phy_4nm_8650_cfgs;
+
+struct msm_dsi_dphy_timing {
+	u32 clk_zero;
+	u32 clk_trail;
+	u32 clk_prepare;
+	u32 hs_exit;
+	u32 hs_zero;
+	u32 hs_prepare;
+	u32 hs_trail;
+	u32 hs_rqst;
+	u32 ta_go;
+	u32 ta_sure;
+	u32 ta_get;
+
+	struct msm_dsi_phy_shared_timings shared_timings;
+
+	/* For PHY v2 only */
+	u32 hs_rqst_ckln;
+	u32 hs_prep_dly;
+	u32 hs_prep_dly_ckln;
+	u8 hs_halfbyte_en;
+	u8 hs_halfbyte_en_ckln;
+};
+
+#define DSI_BYTE_PLL_CLK		0
+#define DSI_PIXEL_PLL_CLK		1
+#define NUM_PROVIDED_CLKS		2
+
+#define DSI_LANE_MAX			5
+
+struct msm_dsi_phy {
+	struct platform_device *pdev;
+	void __iomem *base;
+	void __iomem *pll_base;
+	void __iomem *reg_base;
+	void __iomem *lane_base;
+	phys_addr_t base_size;
+	phys_addr_t pll_size;
+	phys_addr_t reg_size;
+	phys_addr_t lane_size;
+	int id;
+
+	struct clk *ahb_clk;
+	struct regulator_bulk_data *supplies;
+
+	struct msm_dsi_dphy_timing timing;
+	const struct msm_dsi_phy_cfg *cfg;
+	void *tuning_cfg;
+
+	enum msm_dsi_phy_usecase usecase;
+	bool regulator_ldo_mode;
+	bool cphy_mode;
+
+	struct clk_hw *vco_hw;
+	bool pll_on;
+
+	struct clk_hw_onecell_data *provided_clocks;
+
+	bool state_saved;
+};
+
+/*
+ * PHY internal functions
+ */
+int msm_dsi_dphy_timing_calc(struct msm_dsi_dphy_timing *timing,
+			     struct msm_dsi_phy_clk_request *clk_req);
+int msm_dsi_dphy_timing_calc_v2(struct msm_dsi_dphy_timing *timing,
+				struct msm_dsi_phy_clk_request *clk_req);
+int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
+				struct msm_dsi_phy_clk_request *clk_req);
+int msm_dsi_dphy_timing_calc_v4(struct msm_dsi_dphy_timing *timing,
+				struct msm_dsi_phy_clk_request *clk_req);
+int msm_dsi_cphy_timing_calc_v4(struct msm_dsi_dphy_timing *timing,
+				struct msm_dsi_phy_clk_request *clk_req);
+
+#endif /* __DSI_PHY_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_10nm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_10nm.c
@@ -0,0 +1,1061 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0
+ * Copyright (c) 2018, The Linux Foundation
+ */
+
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <linux/iopoll.h>
+
+#include "dsi_phy.h"
+#include "dsi.xml.h"
+#include "dsi_phy_10nm.xml.h"
+
+/*
+ * DSI PLL 10nm - clock diagram (eg: DSI0):
+ *
+ *           dsi0_pll_out_div_clk  dsi0_pll_bit_clk
+ *                              |                |
+ *                              |                |
+ *                 +---------+  |  +----------+  |  +----+
+ *  dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0_phy_pll_out_byteclk
+ *                 +---------+  |  +----------+  |  +----+
+ *                              |                |
+ *                              |                |         dsi0_pll_by_2_bit_clk
+ *                              |                |          |
+ *                              |                |  +----+  |  |\  dsi0_pclk_mux
+ *                              |                |--| /2 |--o--| \   |
+ *                              |                |  +----+     |  \  |  +---------+
+ *                              |                --------------|  |--o--| div_7_4 |-- dsi0_phy_pll_out_dsiclk
+ *                              |------------------------------|  /     +---------+
+ *                              |          +-----+             | /
+ *                              -----------| /4? |--o----------|/
+ *                                         +-----+  |           |
+ *                                                  |           |dsiclk_sel
+ *                                                  |
+ *                                                  dsi0_pll_post_out_div_clk
+ */
+
+#define VCO_REF_CLK_RATE		19200000
+#define FRAC_BITS 18
+
+/* v3.0.0 10nm implementation that requires the old timings settings */
+#define DSI_PHY_10NM_QUIRK_OLD_TIMINGS	BIT(0)
+
+struct dsi_pll_config {
+	bool enable_ssc;
+	bool ssc_center;
+	u32 ssc_freq;
+	u32 ssc_offset;
+	u32 ssc_adj_per;
+
+	/* out */
+	u32 pll_prop_gain_rate;
+	u32 decimal_div_start;
+	u32 frac_div_start;
+	u32 pll_clock_inverters;
+	u32 ssc_stepsize;
+	u32 ssc_div_per;
+};
+
+struct pll_10nm_cached_state {
+	unsigned long vco_rate;
+	u8 bit_clk_div;
+	u8 pix_clk_div;
+	u8 pll_out_div;
+	u8 pll_mux;
+};
+
+struct dsi_pll_10nm {
+	struct clk_hw clk_hw;
+
+	struct msm_dsi_phy *phy;
+
+	u64 vco_current_rate;
+
+	/* protects REG_DSI_10nm_PHY_CMN_CLK_CFG0 register */
+	spinlock_t postdiv_lock;
+
+	struct pll_10nm_cached_state cached_state;
+
+	struct dsi_pll_10nm *slave;
+};
+
+#define to_pll_10nm(x)	container_of(x, struct dsi_pll_10nm, clk_hw)
+
+/**
+ * struct dsi_phy_10nm_tuning_cfg - Holds 10nm PHY tuning config parameters.
+ * @rescode_offset_top: Offset for pull-up legs rescode.
+ * @rescode_offset_bot: Offset for pull-down legs rescode.
+ * @vreg_ctrl: vreg ctrl to drive LDO level
+ */
+struct dsi_phy_10nm_tuning_cfg {
+	u8 rescode_offset_top[DSI_LANE_MAX];
+	u8 rescode_offset_bot[DSI_LANE_MAX];
+	u8 vreg_ctrl;
+};
+
+/*
+ * Global list of private DSI PLL struct pointers. We need this for bonded DSI
+ * mode, where the master PLL's clk_ops needs access the slave's private data
+ */
+static struct dsi_pll_10nm *pll_10nm_list[DSI_MAX];
+
+static void dsi_pll_setup_config(struct dsi_pll_config *config)
+{
+	config->ssc_freq = 31500;
+	config->ssc_offset = 5000;
+	config->ssc_adj_per = 2;
+
+	config->enable_ssc = false;
+	config->ssc_center = false;
+}
+
+static void dsi_pll_calc_dec_frac(struct dsi_pll_10nm *pll, struct dsi_pll_config *config)
+{
+	u64 fref = VCO_REF_CLK_RATE;
+	u64 pll_freq;
+	u64 divider;
+	u64 dec, dec_multiple;
+	u32 frac;
+	u64 multiplier;
+
+	pll_freq = pll->vco_current_rate;
+
+	divider = fref * 2;
+
+	multiplier = 1 << FRAC_BITS;
+	dec_multiple = div_u64(pll_freq * multiplier, divider);
+	dec = div_u64_rem(dec_multiple, multiplier, &frac);
+
+	if (pll_freq <= 1900000000UL)
+		config->pll_prop_gain_rate = 8;
+	else if (pll_freq <= 3000000000UL)
+		config->pll_prop_gain_rate = 10;
+	else
+		config->pll_prop_gain_rate = 12;
+	if (pll_freq < 1100000000UL)
+		config->pll_clock_inverters = 8;
+	else
+		config->pll_clock_inverters = 0;
+
+	config->decimal_div_start = dec;
+	config->frac_div_start = frac;
+}
+
+#define SSC_CENTER		BIT(0)
+#define SSC_EN			BIT(1)
+
+static void dsi_pll_calc_ssc(struct dsi_pll_10nm *pll, struct dsi_pll_config *config)
+{
+	u32 ssc_per;
+	u32 ssc_mod;
+	u64 ssc_step_size;
+	u64 frac;
+
+	if (!config->enable_ssc) {
+		DBG("SSC not enabled\n");
+		return;
+	}
+
+	ssc_per = DIV_ROUND_CLOSEST(VCO_REF_CLK_RATE, config->ssc_freq) / 2 - 1;
+	ssc_mod = (ssc_per + 1) % (config->ssc_adj_per + 1);
+	ssc_per -= ssc_mod;
+
+	frac = config->frac_div_start;
+	ssc_step_size = config->decimal_div_start;
+	ssc_step_size *= (1 << FRAC_BITS);
+	ssc_step_size += frac;
+	ssc_step_size *= config->ssc_offset;
+	ssc_step_size *= (config->ssc_adj_per + 1);
+	ssc_step_size = div_u64(ssc_step_size, (ssc_per + 1));
+	ssc_step_size = DIV_ROUND_CLOSEST_ULL(ssc_step_size, 1000000);
+
+	config->ssc_div_per = ssc_per;
+	config->ssc_stepsize = ssc_step_size;
+
+	pr_debug("SCC: Dec:%d, frac:%llu, frac_bits:%d\n",
+		 config->decimal_div_start, frac, FRAC_BITS);
+	pr_debug("SSC: div_per:0x%X, stepsize:0x%X, adjper:0x%X\n",
+		 ssc_per, (u32)ssc_step_size, config->ssc_adj_per);
+}
+
+static void dsi_pll_ssc_commit(struct dsi_pll_10nm *pll, struct dsi_pll_config *config)
+{
+	void __iomem *base = pll->phy->pll_base;
+
+	if (config->enable_ssc) {
+		pr_debug("SSC is enabled\n");
+
+		dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_SSC_STEPSIZE_LOW_1,
+			      config->ssc_stepsize & 0xff);
+		dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_SSC_STEPSIZE_HIGH_1,
+			      config->ssc_stepsize >> 8);
+		dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_SSC_DIV_PER_LOW_1,
+			      config->ssc_div_per & 0xff);
+		dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_SSC_DIV_PER_HIGH_1,
+			      config->ssc_div_per >> 8);
+		dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_SSC_DIV_ADJPER_LOW_1,
+			      config->ssc_adj_per & 0xff);
+		dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_SSC_DIV_ADJPER_HIGH_1,
+			      config->ssc_adj_per >> 8);
+		dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_SSC_CONTROL,
+			      SSC_EN | (config->ssc_center ? SSC_CENTER : 0));
+	}
+}
+
+static void dsi_pll_config_hzindep_reg(struct dsi_pll_10nm *pll)
+{
+	void __iomem *base = pll->phy->pll_base;
+
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_ANALOG_CONTROLS_ONE, 0x80);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_ANALOG_CONTROLS_TWO, 0x03);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_ANALOG_CONTROLS_THREE, 0x00);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_DSM_DIVIDER, 0x00);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_FEEDBACK_DIVIDER, 0x4e);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_CALIBRATION_SETTINGS, 0x40);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_BAND_SEL_CAL_SETTINGS_THREE,
+		      0xba);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_FREQ_DETECT_SETTINGS_ONE,
+		      0x0c);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_OUTDIV, 0x00);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_CORE_OVERRIDE, 0x00);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_PLL_DIGITAL_TIMERS_TWO,
+		      0x08);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_PLL_PROP_GAIN_RATE_1, 0x08);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_PLL_BAND_SET_RATE_1, 0xc0);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_PLL_INT_GAIN_IFILT_BAND_1,
+		      0xfa);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_PLL_FL_INT_GAIN_PFILT_BAND_1,
+		      0x4c);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_PLL_LOCK_OVERRIDE, 0x80);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_PFILT, 0x29);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_IFILT, 0x3f);
+}
+
+static void dsi_pll_commit(struct dsi_pll_10nm *pll, struct dsi_pll_config *config)
+{
+	void __iomem *base = pll->phy->pll_base;
+
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_CORE_INPUT_OVERRIDE, 0x12);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_DECIMAL_DIV_START_1,
+		      config->decimal_div_start);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_FRAC_DIV_START_LOW_1,
+		      config->frac_div_start & 0xff);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_FRAC_DIV_START_MID_1,
+		      (config->frac_div_start & 0xff00) >> 8);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_FRAC_DIV_START_HIGH_1,
+		      (config->frac_div_start & 0x30000) >> 16);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_PLL_LOCKDET_RATE_1, 64);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_PLL_LOCK_DELAY, 0x06);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_CMODE, 0x10);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_PLL_CLOCK_INVERTERS,
+		      config->pll_clock_inverters);
+}
+
+static int dsi_pll_10nm_vco_set_rate(struct clk_hw *hw, unsigned long rate,
+				     unsigned long parent_rate)
+{
+	struct dsi_pll_10nm *pll_10nm = to_pll_10nm(hw);
+	struct dsi_pll_config config;
+
+	DBG("DSI PLL%d rate=%lu, parent's=%lu", pll_10nm->phy->id, rate,
+	    parent_rate);
+
+	pll_10nm->vco_current_rate = rate;
+
+	dsi_pll_setup_config(&config);
+
+	dsi_pll_calc_dec_frac(pll_10nm, &config);
+
+	dsi_pll_calc_ssc(pll_10nm, &config);
+
+	dsi_pll_commit(pll_10nm, &config);
+
+	dsi_pll_config_hzindep_reg(pll_10nm);
+
+	dsi_pll_ssc_commit(pll_10nm, &config);
+
+	/* flush, ensure all register writes are done*/
+	wmb();
+
+	return 0;
+}
+
+static int dsi_pll_10nm_lock_status(struct dsi_pll_10nm *pll)
+{
+	struct device *dev = &pll->phy->pdev->dev;
+	int rc;
+	u32 status = 0;
+	u32 const delay_us = 100;
+	u32 const timeout_us = 5000;
+
+	rc = readl_poll_timeout_atomic(pll->phy->pll_base +
+				       REG_DSI_10nm_PHY_PLL_COMMON_STATUS_ONE,
+				       status,
+				       ((status & BIT(0)) > 0),
+				       delay_us,
+				       timeout_us);
+	if (rc)
+		DRM_DEV_ERROR(dev, "DSI PLL(%d) lock failed, status=0x%08x\n",
+			      pll->phy->id, status);
+
+	return rc;
+}
+
+static void dsi_pll_disable_pll_bias(struct dsi_pll_10nm *pll)
+{
+	u32 data = dsi_phy_read(pll->phy->base + REG_DSI_10nm_PHY_CMN_CTRL_0);
+
+	dsi_phy_write(pll->phy->pll_base + REG_DSI_10nm_PHY_PLL_SYSTEM_MUXES, 0);
+	dsi_phy_write(pll->phy->base + REG_DSI_10nm_PHY_CMN_CTRL_0,
+		      data & ~BIT(5));
+	ndelay(250);
+}
+
+static void dsi_pll_enable_pll_bias(struct dsi_pll_10nm *pll)
+{
+	u32 data = dsi_phy_read(pll->phy->base + REG_DSI_10nm_PHY_CMN_CTRL_0);
+
+	dsi_phy_write(pll->phy->base + REG_DSI_10nm_PHY_CMN_CTRL_0,
+		      data | BIT(5));
+	dsi_phy_write(pll->phy->pll_base + REG_DSI_10nm_PHY_PLL_SYSTEM_MUXES, 0xc0);
+	ndelay(250);
+}
+
+static void dsi_pll_disable_global_clk(struct dsi_pll_10nm *pll)
+{
+	u32 data;
+
+	data = dsi_phy_read(pll->phy->base + REG_DSI_10nm_PHY_CMN_CLK_CFG1);
+	dsi_phy_write(pll->phy->base + REG_DSI_10nm_PHY_CMN_CLK_CFG1,
+		      data & ~BIT(5));
+}
+
+static void dsi_pll_enable_global_clk(struct dsi_pll_10nm *pll)
+{
+	u32 data;
+
+	data = dsi_phy_read(pll->phy->base + REG_DSI_10nm_PHY_CMN_CLK_CFG1);
+	dsi_phy_write(pll->phy->base + REG_DSI_10nm_PHY_CMN_CLK_CFG1,
+		      data | BIT(5));
+}
+
+static int dsi_pll_10nm_vco_prepare(struct clk_hw *hw)
+{
+	struct dsi_pll_10nm *pll_10nm = to_pll_10nm(hw);
+	struct device *dev = &pll_10nm->phy->pdev->dev;
+	int rc;
+
+	dsi_pll_enable_pll_bias(pll_10nm);
+	if (pll_10nm->slave)
+		dsi_pll_enable_pll_bias(pll_10nm->slave);
+
+	rc = dsi_pll_10nm_vco_set_rate(hw,pll_10nm->vco_current_rate, 0);
+	if (rc) {
+		DRM_DEV_ERROR(dev, "vco_set_rate failed, rc=%d\n", rc);
+		return rc;
+	}
+
+	/* Start PLL */
+	dsi_phy_write(pll_10nm->phy->base + REG_DSI_10nm_PHY_CMN_PLL_CNTRL,
+		      0x01);
+
+	/*
+	 * ensure all PLL configurations are written prior to checking
+	 * for PLL lock.
+	 */
+	wmb();
+
+	/* Check for PLL lock */
+	rc = dsi_pll_10nm_lock_status(pll_10nm);
+	if (rc) {
+		DRM_DEV_ERROR(dev, "PLL(%d) lock failed\n", pll_10nm->phy->id);
+		goto error;
+	}
+
+	pll_10nm->phy->pll_on = true;
+
+	dsi_pll_enable_global_clk(pll_10nm);
+	if (pll_10nm->slave)
+		dsi_pll_enable_global_clk(pll_10nm->slave);
+
+	dsi_phy_write(pll_10nm->phy->base + REG_DSI_10nm_PHY_CMN_RBUF_CTRL,
+		      0x01);
+	if (pll_10nm->slave)
+		dsi_phy_write(pll_10nm->slave->phy->base +
+			      REG_DSI_10nm_PHY_CMN_RBUF_CTRL, 0x01);
+
+error:
+	return rc;
+}
+
+static void dsi_pll_disable_sub(struct dsi_pll_10nm *pll)
+{
+	dsi_phy_write(pll->phy->base + REG_DSI_10nm_PHY_CMN_RBUF_CTRL, 0);
+	dsi_pll_disable_pll_bias(pll);
+}
+
+static void dsi_pll_10nm_vco_unprepare(struct clk_hw *hw)
+{
+	struct dsi_pll_10nm *pll_10nm = to_pll_10nm(hw);
+
+	/*
+	 * To avoid any stray glitches while abruptly powering down the PLL
+	 * make sure to gate the clock using the clock enable bit before
+	 * powering down the PLL
+	 */
+	dsi_pll_disable_global_clk(pll_10nm);
+	dsi_phy_write(pll_10nm->phy->base + REG_DSI_10nm_PHY_CMN_PLL_CNTRL, 0);
+	dsi_pll_disable_sub(pll_10nm);
+	if (pll_10nm->slave) {
+		dsi_pll_disable_global_clk(pll_10nm->slave);
+		dsi_pll_disable_sub(pll_10nm->slave);
+	}
+	/* flush, ensure all register writes are done */
+	wmb();
+	pll_10nm->phy->pll_on = false;
+}
+
+static unsigned long dsi_pll_10nm_vco_recalc_rate(struct clk_hw *hw,
+						  unsigned long parent_rate)
+{
+	struct dsi_pll_10nm *pll_10nm = to_pll_10nm(hw);
+	void __iomem *base = pll_10nm->phy->pll_base;
+	u64 ref_clk = VCO_REF_CLK_RATE;
+	u64 vco_rate = 0x0;
+	u64 multiplier;
+	u32 frac;
+	u32 dec;
+	u64 pll_freq, tmp64;
+
+	dec = dsi_phy_read(base + REG_DSI_10nm_PHY_PLL_DECIMAL_DIV_START_1);
+	dec &= 0xff;
+
+	frac = dsi_phy_read(base + REG_DSI_10nm_PHY_PLL_FRAC_DIV_START_LOW_1);
+	frac |= ((dsi_phy_read(base + REG_DSI_10nm_PHY_PLL_FRAC_DIV_START_MID_1) &
+		  0xff) << 8);
+	frac |= ((dsi_phy_read(base + REG_DSI_10nm_PHY_PLL_FRAC_DIV_START_HIGH_1) &
+		  0x3) << 16);
+
+	/*
+	 * TODO:
+	 *	1. Assumes prescaler is disabled
+	 */
+	multiplier = 1 << FRAC_BITS;
+	pll_freq = dec * (ref_clk * 2);
+	tmp64 = (ref_clk * 2 * frac);
+	pll_freq += div_u64(tmp64, multiplier);
+
+	vco_rate = pll_freq;
+	pll_10nm->vco_current_rate = vco_rate;
+
+	DBG("DSI PLL%d returning vco rate = %lu, dec = %x, frac = %x",
+	    pll_10nm->phy->id, (unsigned long)vco_rate, dec, frac);
+
+	return (unsigned long)vco_rate;
+}
+
+static long dsi_pll_10nm_clk_round_rate(struct clk_hw *hw,
+		unsigned long rate, unsigned long *parent_rate)
+{
+	struct dsi_pll_10nm *pll_10nm = to_pll_10nm(hw);
+
+	if      (rate < pll_10nm->phy->cfg->min_pll_rate)
+		return  pll_10nm->phy->cfg->min_pll_rate;
+	else if (rate > pll_10nm->phy->cfg->max_pll_rate)
+		return  pll_10nm->phy->cfg->max_pll_rate;
+	else
+		return rate;
+}
+
+static const struct clk_ops clk_ops_dsi_pll_10nm_vco = {
+	.round_rate = dsi_pll_10nm_clk_round_rate,
+	.set_rate = dsi_pll_10nm_vco_set_rate,
+	.recalc_rate = dsi_pll_10nm_vco_recalc_rate,
+	.prepare = dsi_pll_10nm_vco_prepare,
+	.unprepare = dsi_pll_10nm_vco_unprepare,
+};
+
+/*
+ * PLL Callbacks
+ */
+
+static void dsi_10nm_pll_save_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_10nm *pll_10nm = to_pll_10nm(phy->vco_hw);
+	struct pll_10nm_cached_state *cached = &pll_10nm->cached_state;
+	void __iomem *phy_base = pll_10nm->phy->base;
+	u32 cmn_clk_cfg0, cmn_clk_cfg1;
+
+	cached->pll_out_div = dsi_phy_read(pll_10nm->phy->pll_base +
+			REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE);
+	cached->pll_out_div &= 0x3;
+
+	cmn_clk_cfg0 = dsi_phy_read(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG0);
+	cached->bit_clk_div = cmn_clk_cfg0 & 0xf;
+	cached->pix_clk_div = (cmn_clk_cfg0 & 0xf0) >> 4;
+
+	cmn_clk_cfg1 = dsi_phy_read(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1);
+	cached->pll_mux = cmn_clk_cfg1 & 0x3;
+
+	DBG("DSI PLL%d outdiv %x bit_clk_div %x pix_clk_div %x pll_mux %x",
+	    pll_10nm->phy->id, cached->pll_out_div, cached->bit_clk_div,
+	    cached->pix_clk_div, cached->pll_mux);
+}
+
+static int dsi_10nm_pll_restore_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_10nm *pll_10nm = to_pll_10nm(phy->vco_hw);
+	struct pll_10nm_cached_state *cached = &pll_10nm->cached_state;
+	void __iomem *phy_base = pll_10nm->phy->base;
+	u32 val;
+	int ret;
+
+	val = dsi_phy_read(pll_10nm->phy->pll_base + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE);
+	val &= ~0x3;
+	val |= cached->pll_out_div;
+	dsi_phy_write(pll_10nm->phy->pll_base + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE, val);
+
+	dsi_phy_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG0,
+		      cached->bit_clk_div | (cached->pix_clk_div << 4));
+
+	val = dsi_phy_read(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1);
+	val &= ~0x3;
+	val |= cached->pll_mux;
+	dsi_phy_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, val);
+
+	ret = dsi_pll_10nm_vco_set_rate(phy->vco_hw,
+			pll_10nm->vco_current_rate,
+			VCO_REF_CLK_RATE);
+	if (ret) {
+		DRM_DEV_ERROR(&pll_10nm->phy->pdev->dev,
+			"restore vco rate failed. ret=%d\n", ret);
+		return ret;
+	}
+
+	DBG("DSI PLL%d", pll_10nm->phy->id);
+
+	return 0;
+}
+
+static int dsi_10nm_set_usecase(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_10nm *pll_10nm = to_pll_10nm(phy->vco_hw);
+	void __iomem *base = phy->base;
+	u32 data = 0x0;	/* internal PLL */
+
+	DBG("DSI PLL%d", pll_10nm->phy->id);
+
+	switch (phy->usecase) {
+	case MSM_DSI_PHY_STANDALONE:
+		break;
+	case MSM_DSI_PHY_MASTER:
+		pll_10nm->slave = pll_10nm_list[(pll_10nm->phy->id + 1) % DSI_MAX];
+		break;
+	case MSM_DSI_PHY_SLAVE:
+		data = 0x1; /* external PLL */
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* set PLL src */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, (data << 2));
+
+	return 0;
+}
+
+/*
+ * The post dividers and mux clocks are created using the standard divider and
+ * mux API. Unlike the 14nm PHY, the slave PLL doesn't need its dividers/mux
+ * state to follow the master PLL's divider/mux state. Therefore, we don't
+ * require special clock ops that also configure the slave PLL registers
+ */
+static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm, struct clk_hw **provided_clocks)
+{
+	char clk_name[32];
+	struct clk_init_data vco_init = {
+		.parent_data = &(const struct clk_parent_data) {
+			.fw_name = "ref",
+		},
+		.num_parents = 1,
+		.name = clk_name,
+		.flags = CLK_IGNORE_UNUSED,
+		.ops = &clk_ops_dsi_pll_10nm_vco,
+	};
+	struct device *dev = &pll_10nm->phy->pdev->dev;
+	struct clk_hw *hw, *pll_out_div, *pll_bit, *pll_by_2_bit;
+	struct clk_hw *pll_post_out_div, *pclk_mux;
+	int ret;
+
+	DBG("DSI%d", pll_10nm->phy->id);
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dvco_clk", pll_10nm->phy->id);
+	pll_10nm->clk_hw.init = &vco_init;
+
+	ret = devm_clk_hw_register(dev, &pll_10nm->clk_hw);
+	if (ret)
+		return ret;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_pll_out_div_clk", pll_10nm->phy->id);
+
+	pll_out_div = devm_clk_hw_register_divider_parent_hw(dev, clk_name,
+			&pll_10nm->clk_hw, CLK_SET_RATE_PARENT,
+			pll_10nm->phy->pll_base +
+				REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE,
+			0, 2, CLK_DIVIDER_POWER_OF_TWO, NULL);
+	if (IS_ERR(pll_out_div)) {
+		ret = PTR_ERR(pll_out_div);
+		goto fail;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_pll_bit_clk", pll_10nm->phy->id);
+
+	/* BIT CLK: DIV_CTRL_3_0 */
+	pll_bit = devm_clk_hw_register_divider_parent_hw(dev, clk_name,
+			pll_out_div, CLK_SET_RATE_PARENT,
+			pll_10nm->phy->base + REG_DSI_10nm_PHY_CMN_CLK_CFG0,
+			0, 4, CLK_DIVIDER_ONE_BASED, &pll_10nm->postdiv_lock);
+	if (IS_ERR(pll_bit)) {
+		ret = PTR_ERR(pll_bit);
+		goto fail;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_phy_pll_out_byteclk", pll_10nm->phy->id);
+
+	/* DSI Byte clock = VCO_CLK / OUT_DIV / BIT_DIV / 8 */
+	hw = devm_clk_hw_register_fixed_factor_parent_hw(dev, clk_name,
+			pll_bit, CLK_SET_RATE_PARENT, 1, 8);
+	if (IS_ERR(hw)) {
+		ret = PTR_ERR(hw);
+		goto fail;
+	}
+
+	provided_clocks[DSI_BYTE_PLL_CLK] = hw;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_pll_by_2_bit_clk", pll_10nm->phy->id);
+
+	pll_by_2_bit = devm_clk_hw_register_fixed_factor_parent_hw(dev,
+			clk_name, pll_bit, 0, 1, 2);
+	if (IS_ERR(pll_by_2_bit)) {
+		ret = PTR_ERR(pll_by_2_bit);
+		goto fail;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_pll_post_out_div_clk", pll_10nm->phy->id);
+
+	pll_post_out_div = devm_clk_hw_register_fixed_factor_parent_hw(dev,
+			clk_name, pll_out_div, 0, 1, 4);
+	if (IS_ERR(pll_post_out_div)) {
+		ret = PTR_ERR(pll_post_out_div);
+		goto fail;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_pclk_mux", pll_10nm->phy->id);
+
+	pclk_mux = devm_clk_hw_register_mux_parent_hws(dev, clk_name,
+			((const struct clk_hw *[]){
+				pll_bit,
+				pll_by_2_bit,
+				pll_out_div,
+				pll_post_out_div,
+			}), 4, 0, pll_10nm->phy->base +
+				REG_DSI_10nm_PHY_CMN_CLK_CFG1, 0, 2, 0, NULL);
+	if (IS_ERR(pclk_mux)) {
+		ret = PTR_ERR(pclk_mux);
+		goto fail;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_phy_pll_out_dsiclk", pll_10nm->phy->id);
+
+	/* PIX CLK DIV : DIV_CTRL_7_4*/
+	hw = devm_clk_hw_register_divider_parent_hw(dev, clk_name, pclk_mux,
+			0, pll_10nm->phy->base + REG_DSI_10nm_PHY_CMN_CLK_CFG0,
+			4, 4, CLK_DIVIDER_ONE_BASED, &pll_10nm->postdiv_lock);
+	if (IS_ERR(hw)) {
+		ret = PTR_ERR(hw);
+		goto fail;
+	}
+
+	provided_clocks[DSI_PIXEL_PLL_CLK] = hw;
+
+	return 0;
+
+fail:
+
+	return ret;
+}
+
+static int dsi_pll_10nm_init(struct msm_dsi_phy *phy)
+{
+	struct platform_device *pdev = phy->pdev;
+	struct dsi_pll_10nm *pll_10nm;
+	int ret;
+
+	pll_10nm = devm_kzalloc(&pdev->dev, sizeof(*pll_10nm), GFP_KERNEL);
+	if (!pll_10nm)
+		return -ENOMEM;
+
+	DBG("DSI PLL%d", phy->id);
+
+	pll_10nm_list[phy->id] = pll_10nm;
+
+	spin_lock_init(&pll_10nm->postdiv_lock);
+
+	pll_10nm->phy = phy;
+
+	ret = pll_10nm_register(pll_10nm, phy->provided_clocks->hws);
+	if (ret) {
+		DRM_DEV_ERROR(&pdev->dev, "failed to register PLL: %d\n", ret);
+		return ret;
+	}
+
+	phy->vco_hw = &pll_10nm->clk_hw;
+
+	/* TODO: Remove this when we have proper display handover support */
+	msm_dsi_phy_pll_save_state(phy);
+
+	return 0;
+}
+
+static int dsi_phy_hw_v3_0_is_pll_on(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->base;
+	u32 data = 0;
+
+	data = dsi_phy_read(base + REG_DSI_10nm_PHY_CMN_PLL_CNTRL);
+	mb(); /* make sure read happened */
+
+	return (data & BIT(0));
+}
+
+static void dsi_phy_hw_v3_0_config_lpcdrx(struct msm_dsi_phy *phy, bool enable)
+{
+	void __iomem *lane_base = phy->lane_base;
+	int phy_lane_0 = 0;	/* TODO: Support all lane swap configs */
+
+	/*
+	 * LPRX and CDRX need to enabled only for physical data lane
+	 * corresponding to the logical data lane 0
+	 */
+	if (enable)
+		dsi_phy_write(lane_base +
+			      REG_DSI_10nm_PHY_LN_LPRX_CTRL(phy_lane_0), 0x3);
+	else
+		dsi_phy_write(lane_base +
+			      REG_DSI_10nm_PHY_LN_LPRX_CTRL(phy_lane_0), 0);
+}
+
+static void dsi_phy_hw_v3_0_lane_settings(struct msm_dsi_phy *phy)
+{
+	int i;
+	u8 tx_dctrl[] = { 0x00, 0x00, 0x00, 0x04, 0x01 };
+	void __iomem *lane_base = phy->lane_base;
+	struct dsi_phy_10nm_tuning_cfg *tuning_cfg = phy->tuning_cfg;
+
+	if (phy->cfg->quirks & DSI_PHY_10NM_QUIRK_OLD_TIMINGS)
+		tx_dctrl[3] = 0x02;
+
+	/* Strength ctrl settings */
+	for (i = 0; i < 5; i++) {
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_LPTX_STR_CTRL(i),
+			      0x55);
+		/*
+		 * Disable LPRX and CDRX for all lanes. And later on, it will
+		 * be only enabled for the physical data lane corresponding
+		 * to the logical data lane 0
+		 */
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_LPRX_CTRL(i), 0);
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_PIN_SWAP(i), 0x0);
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_HSTX_STR_CTRL(i),
+			      0x88);
+	}
+
+	dsi_phy_hw_v3_0_config_lpcdrx(phy, true);
+
+	/* other settings */
+	for (i = 0; i < 5; i++) {
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_CFG0(i), 0x0);
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_CFG1(i), 0x0);
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_CFG2(i), 0x0);
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_CFG3(i),
+			      i == 4 ? 0x80 : 0x0);
+
+		/* platform specific dsi phy drive strength adjustment */
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_OFFSET_TOP_CTRL(i),
+				tuning_cfg->rescode_offset_top[i]);
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_OFFSET_BOT_CTRL(i),
+				tuning_cfg->rescode_offset_bot[i]);
+
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_TX_DCTRL(i),
+			      tx_dctrl[i]);
+	}
+
+	if (!(phy->cfg->quirks & DSI_PHY_10NM_QUIRK_OLD_TIMINGS)) {
+		/* Toggle BIT 0 to release freeze I/0 */
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_TX_DCTRL(3), 0x05);
+		dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_TX_DCTRL(3), 0x04);
+	}
+}
+
+static int dsi_10nm_phy_enable(struct msm_dsi_phy *phy,
+			       struct msm_dsi_phy_clk_request *clk_req)
+{
+	int ret;
+	u32 status;
+	u32 const delay_us = 5;
+	u32 const timeout_us = 1000;
+	struct msm_dsi_dphy_timing *timing = &phy->timing;
+	void __iomem *base = phy->base;
+	struct dsi_phy_10nm_tuning_cfg *tuning_cfg = phy->tuning_cfg;
+	u32 data;
+
+	DBG("");
+
+	if (msm_dsi_dphy_timing_calc_v3(timing, clk_req)) {
+		DRM_DEV_ERROR(&phy->pdev->dev,
+			"%s: D-PHY timing calculation failed\n", __func__);
+		return -EINVAL;
+	}
+
+	if (dsi_phy_hw_v3_0_is_pll_on(phy))
+		pr_warn("PLL turned on before configuring PHY\n");
+
+	/* wait for REFGEN READY */
+	ret = readl_poll_timeout_atomic(base + REG_DSI_10nm_PHY_CMN_PHY_STATUS,
+					status, (status & BIT(0)),
+					delay_us, timeout_us);
+	if (ret) {
+		pr_err("Ref gen not ready. Aborting\n");
+		return -EINVAL;
+	}
+
+	/* de-assert digital and pll power down */
+	data = BIT(6) | BIT(5);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_CTRL_0, data);
+
+	/* Assert PLL core reset */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_PLL_CNTRL, 0x00);
+
+	/* turn off resync FIFO */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_RBUF_CTRL, 0x00);
+
+	/* Select MS1 byte-clk */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_GLBL_CTRL, 0x10);
+
+	/* Enable LDO with platform specific drive level/amplitude adjustment */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_VREG_CTRL,
+		      tuning_cfg->vreg_ctrl);
+
+	/* Configure PHY lane swap (TODO: we need to calculate this) */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_LANE_CFG0, 0x21);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_LANE_CFG1, 0x84);
+
+	/* DSI PHY timings */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_0,
+		      timing->hs_halfbyte_en);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_1,
+		      timing->clk_zero);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_2,
+		      timing->clk_prepare);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_3,
+		      timing->clk_trail);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_4,
+		      timing->hs_exit);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_5,
+		      timing->hs_zero);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_6,
+		      timing->hs_prepare);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_7,
+		      timing->hs_trail);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_8,
+		      timing->hs_rqst);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_9,
+		      timing->ta_go | (timing->ta_sure << 3));
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_10,
+		      timing->ta_get);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_TIMING_CTRL_11,
+		      0x00);
+
+	/* Remove power down from all blocks */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_CTRL_0, 0x7f);
+
+	/* power up lanes */
+	data = dsi_phy_read(base + REG_DSI_10nm_PHY_CMN_CTRL_0);
+
+	/* TODO: only power up lanes that are used */
+	data |= 0x1F;
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_CTRL_0, data);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_LANE_CTRL0, 0x1F);
+
+	/* Select full-rate mode */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_CTRL_2, 0x40);
+
+	ret = dsi_10nm_set_usecase(phy);
+	if (ret) {
+		DRM_DEV_ERROR(&phy->pdev->dev, "%s: set pll usecase failed, %d\n",
+			__func__, ret);
+		return ret;
+	}
+
+	/* DSI lane settings */
+	dsi_phy_hw_v3_0_lane_settings(phy);
+
+	DBG("DSI%d PHY enabled", phy->id);
+
+	return 0;
+}
+
+static void dsi_10nm_phy_disable(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->base;
+	u32 data;
+
+	DBG("");
+
+	if (dsi_phy_hw_v3_0_is_pll_on(phy))
+		pr_warn("Turning OFF PHY while PLL is on\n");
+
+	dsi_phy_hw_v3_0_config_lpcdrx(phy, false);
+	data = dsi_phy_read(base + REG_DSI_10nm_PHY_CMN_CTRL_0);
+
+	/* disable all lanes */
+	data &= ~0x1F;
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_CTRL_0, data);
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_LANE_CTRL0, 0);
+
+	/* Turn off all PHY blocks */
+	dsi_phy_write(base + REG_DSI_10nm_PHY_CMN_CTRL_0, 0x00);
+	/* make sure phy is turned off */
+	wmb();
+
+	DBG("DSI%d PHY disabled", phy->id);
+}
+
+static int dsi_10nm_phy_parse_dt(struct msm_dsi_phy *phy)
+{
+	struct device *dev = &phy->pdev->dev;
+	struct dsi_phy_10nm_tuning_cfg *tuning_cfg;
+	s8 offset_top[DSI_LANE_MAX] = { 0 }; /* No offset */
+	s8 offset_bot[DSI_LANE_MAX] = { 0 }; /* No offset */
+	u32 ldo_level = 400; /* 400mV */
+	u8 level;
+	int ret, i;
+
+	tuning_cfg = devm_kzalloc(dev, sizeof(*tuning_cfg), GFP_KERNEL);
+	if (!tuning_cfg)
+		return -ENOMEM;
+
+	/* Drive strength adjustment parameters */
+	ret = of_property_read_u8_array(dev->of_node, "qcom,phy-rescode-offset-top",
+					offset_top, DSI_LANE_MAX);
+	if (ret && ret != -EINVAL) {
+		DRM_DEV_ERROR(dev, "failed to parse qcom,phy-rescode-offset-top, %d\n", ret);
+		return ret;
+	}
+
+	for (i = 0; i < DSI_LANE_MAX; i++) {
+		if (offset_top[i] < -32 || offset_top[i] > 31) {
+			DRM_DEV_ERROR(dev,
+				"qcom,phy-rescode-offset-top value %d is not in range [-32..31]\n",
+				offset_top[i]);
+			return -EINVAL;
+		}
+		tuning_cfg->rescode_offset_top[i] = 0x3f & offset_top[i];
+	}
+
+	ret = of_property_read_u8_array(dev->of_node, "qcom,phy-rescode-offset-bot",
+					offset_bot, DSI_LANE_MAX);
+	if (ret && ret != -EINVAL) {
+		DRM_DEV_ERROR(dev, "failed to parse qcom,phy-rescode-offset-bot, %d\n", ret);
+		return ret;
+	}
+
+	for (i = 0; i < DSI_LANE_MAX; i++) {
+		if (offset_bot[i] < -32 || offset_bot[i] > 31) {
+			DRM_DEV_ERROR(dev,
+				"qcom,phy-rescode-offset-bot value %d is not in range [-32..31]\n",
+				offset_bot[i]);
+			return -EINVAL;
+		}
+		tuning_cfg->rescode_offset_bot[i] = 0x3f & offset_bot[i];
+	}
+
+	/* Drive level/amplitude adjustment parameters */
+	ret = of_property_read_u32(dev->of_node, "qcom,phy-drive-ldo-level", &ldo_level);
+	if (ret && ret != -EINVAL) {
+		DRM_DEV_ERROR(dev, "failed to parse qcom,phy-drive-ldo-level, %d\n", ret);
+		return ret;
+	}
+
+	switch (ldo_level) {
+	case 375:
+		level = 0;
+		break;
+	case 400:
+		level = 1;
+		break;
+	case 425:
+		level = 2;
+		break;
+	case 450:
+		level = 3;
+		break;
+	case 475:
+		level = 4;
+		break;
+	case 500:
+		level = 5;
+		break;
+	default:
+		DRM_DEV_ERROR(dev, "qcom,phy-drive-ldo-level %d is not supported\n", ldo_level);
+		return -EINVAL;
+	}
+	tuning_cfg->vreg_ctrl = 0x58 | (0x7 & level);
+
+	phy->tuning_cfg = tuning_cfg;
+
+	return 0;
+}
+
+static const struct regulator_bulk_data dsi_phy_10nm_regulators[] = {
+	{ .supply = "vdds", .init_load_uA = 36000 },
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_10nm_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_10nm_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_10nm_regulators),
+	.ops = {
+		.enable = dsi_10nm_phy_enable,
+		.disable = dsi_10nm_phy_disable,
+		.pll_init = dsi_pll_10nm_init,
+		.save_pll_state = dsi_10nm_pll_save_state,
+		.restore_pll_state = dsi_10nm_pll_restore_state,
+		.parse_dt_properties = dsi_10nm_phy_parse_dt,
+	},
+	.min_pll_rate = 1000000000UL,
+	.max_pll_rate = 3500000000UL,
+	.io_start = { 0xae94400, 0xae96400 },
+	.num_dsi_phy = 2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_10nm_8998_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_10nm_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_10nm_regulators),
+	.ops = {
+		.enable = dsi_10nm_phy_enable,
+		.disable = dsi_10nm_phy_disable,
+		.pll_init = dsi_pll_10nm_init,
+		.save_pll_state = dsi_10nm_pll_save_state,
+		.restore_pll_state = dsi_10nm_pll_restore_state,
+		.parse_dt_properties = dsi_10nm_phy_parse_dt,
+	},
+	.min_pll_rate = 1000000000UL,
+	.max_pll_rate = 3500000000UL,
+	.io_start = { 0xc994400, 0xc996400 },
+	.num_dsi_phy = 2,
+	.quirks = DSI_PHY_10NM_QUIRK_OLD_TIMINGS,
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_14nm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_14nm.c
@@ -0,0 +1,1101 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+
+#include "dsi_phy.h"
+#include "dsi.xml.h"
+#include "dsi_phy_14nm.xml.h"
+
+#define PHY_14NM_CKLN_IDX	4
+
+/*
+ * DSI PLL 14nm - clock diagram (eg: DSI0):
+ *
+ *         dsi0n1_postdiv_clk
+ *                         |
+ *                         |
+ *                 +----+  |  +----+
+ *  dsi0vco_clk ---| n1 |--o--| /8 |-- dsi0pllbyte
+ *                 +----+  |  +----+
+ *                         |           dsi0n1_postdivby2_clk
+ *                         |   +----+  |
+ *                         o---| /2 |--o--|\
+ *                         |   +----+     | \   +----+
+ *                         |              |  |--| n2 |-- dsi0pll
+ *                         o--------------| /   +----+
+ *                                        |/
+ */
+
+#define POLL_MAX_READS			15
+#define POLL_TIMEOUT_US			1000
+
+#define VCO_REF_CLK_RATE		19200000
+#define VCO_MIN_RATE			1300000000UL
+#define VCO_MAX_RATE			2600000000UL
+
+struct dsi_pll_config {
+	u64 vco_current_rate;
+
+	u32 ssc_en;	/* SSC enable/disable */
+
+	/* fixed params */
+	u32 plllock_cnt;
+	u32 ssc_center;
+	u32 ssc_adj_period;
+	u32 ssc_spread;
+	u32 ssc_freq;
+
+	/* calculated */
+	u32 dec_start;
+	u32 div_frac_start;
+	u32 ssc_period;
+	u32 ssc_step_size;
+	u32 plllock_cmp;
+	u32 pll_vco_div_ref;
+	u32 pll_vco_count;
+	u32 pll_kvco_div_ref;
+	u32 pll_kvco_count;
+};
+
+struct pll_14nm_cached_state {
+	unsigned long vco_rate;
+	u8 n2postdiv;
+	u8 n1postdiv;
+};
+
+struct dsi_pll_14nm {
+	struct clk_hw clk_hw;
+
+	struct msm_dsi_phy *phy;
+
+	/* protects REG_DSI_14nm_PHY_CMN_CLK_CFG0 register */
+	spinlock_t postdiv_lock;
+
+	struct pll_14nm_cached_state cached_state;
+
+	struct dsi_pll_14nm *slave;
+};
+
+#define to_pll_14nm(x)	container_of(x, struct dsi_pll_14nm, clk_hw)
+
+/*
+ * Private struct for N1/N2 post-divider clocks. These clocks are similar to
+ * the generic clk_divider class of clocks. The only difference is that it
+ * also sets the slave DSI PLL's post-dividers if in bonded DSI mode
+ */
+struct dsi_pll_14nm_postdiv {
+	struct clk_hw hw;
+
+	/* divider params */
+	u8 shift;
+	u8 width;
+	u8 flags; /* same flags as used by clk_divider struct */
+
+	struct dsi_pll_14nm *pll;
+};
+
+#define to_pll_14nm_postdiv(_hw) container_of(_hw, struct dsi_pll_14nm_postdiv, hw)
+
+/*
+ * Global list of private DSI PLL struct pointers. We need this for bonded DSI
+ * mode, where the master PLL's clk_ops needs access the slave's private data
+ */
+static struct dsi_pll_14nm *pll_14nm_list[DSI_MAX];
+
+static bool pll_14nm_poll_for_ready(struct dsi_pll_14nm *pll_14nm,
+				    u32 nb_tries, u32 timeout_us)
+{
+	bool pll_locked = false, pll_ready = false;
+	void __iomem *base = pll_14nm->phy->pll_base;
+	u32 tries, val;
+
+	tries = nb_tries;
+	while (tries--) {
+		val = dsi_phy_read(base + REG_DSI_14nm_PHY_PLL_RESET_SM_READY_STATUS);
+		pll_locked = !!(val & BIT(5));
+
+		if (pll_locked)
+			break;
+
+		udelay(timeout_us);
+	}
+
+	if (!pll_locked)
+		goto out;
+
+	tries = nb_tries;
+	while (tries--) {
+		val = dsi_phy_read(base + REG_DSI_14nm_PHY_PLL_RESET_SM_READY_STATUS);
+		pll_ready = !!(val & BIT(0));
+
+		if (pll_ready)
+			break;
+
+		udelay(timeout_us);
+	}
+
+out:
+	DBG("DSI PLL is %slocked, %sready", pll_locked ? "" : "*not* ", pll_ready ? "" : "*not* ");
+
+	return pll_locked && pll_ready;
+}
+
+static void dsi_pll_14nm_config_init(struct dsi_pll_config *pconf)
+{
+	/* fixed input */
+	pconf->plllock_cnt = 1;
+
+	/*
+	 * SSC is enabled by default. We might need DT props for configuring
+	 * some SSC params like PPM and center/down spread etc.
+	 */
+	pconf->ssc_en = 1;
+	pconf->ssc_center = 0;		/* down spread by default */
+	pconf->ssc_spread = 5;		/* PPM / 1000 */
+	pconf->ssc_freq = 31500;	/* default recommended */
+	pconf->ssc_adj_period = 37;
+}
+
+#define CEIL(x, y)		(((x) + ((y) - 1)) / (y))
+
+static void pll_14nm_ssc_calc(struct dsi_pll_14nm *pll, struct dsi_pll_config *pconf)
+{
+	u32 period, ssc_period;
+	u32 ref, rem;
+	u64 step_size;
+
+	DBG("vco=%lld ref=%d", pconf->vco_current_rate, VCO_REF_CLK_RATE);
+
+	ssc_period = pconf->ssc_freq / 500;
+	period = (u32)VCO_REF_CLK_RATE / 1000;
+	ssc_period  = CEIL(period, ssc_period);
+	ssc_period -= 1;
+	pconf->ssc_period = ssc_period;
+
+	DBG("ssc freq=%d spread=%d period=%d", pconf->ssc_freq,
+	    pconf->ssc_spread, pconf->ssc_period);
+
+	step_size = (u32)pconf->vco_current_rate;
+	ref = VCO_REF_CLK_RATE;
+	ref /= 1000;
+	step_size = div_u64(step_size, ref);
+	step_size <<= 20;
+	step_size = div_u64(step_size, 1000);
+	step_size *= pconf->ssc_spread;
+	step_size = div_u64(step_size, 1000);
+	step_size *= (pconf->ssc_adj_period + 1);
+
+	rem = 0;
+	step_size = div_u64_rem(step_size, ssc_period + 1, &rem);
+	if (rem)
+		step_size++;
+
+	DBG("step_size=%lld", step_size);
+
+	step_size &= 0x0ffff;	/* take lower 16 bits */
+
+	pconf->ssc_step_size = step_size;
+}
+
+static void pll_14nm_dec_frac_calc(struct dsi_pll_14nm *pll, struct dsi_pll_config *pconf)
+{
+	u64 multiplier = BIT(20);
+	u64 dec_start_multiple, dec_start, pll_comp_val;
+	u32 duration, div_frac_start;
+	u64 vco_clk_rate = pconf->vco_current_rate;
+	u64 fref = VCO_REF_CLK_RATE;
+
+	DBG("vco_clk_rate=%lld ref_clk_rate=%lld", vco_clk_rate, fref);
+
+	dec_start_multiple = div_u64(vco_clk_rate * multiplier, fref);
+	dec_start = div_u64_rem(dec_start_multiple, multiplier, &div_frac_start);
+
+	pconf->dec_start = (u32)dec_start;
+	pconf->div_frac_start = div_frac_start;
+
+	if (pconf->plllock_cnt == 0)
+		duration = 1024;
+	else if (pconf->plllock_cnt == 1)
+		duration = 256;
+	else if (pconf->plllock_cnt == 2)
+		duration = 128;
+	else
+		duration = 32;
+
+	pll_comp_val = duration * dec_start_multiple;
+	pll_comp_val = div_u64(pll_comp_val, multiplier);
+	do_div(pll_comp_val, 10);
+
+	pconf->plllock_cmp = (u32)pll_comp_val;
+}
+
+static u32 pll_14nm_kvco_slop(u32 vrate)
+{
+	u32 slop = 0;
+
+	if (vrate > VCO_MIN_RATE && vrate <= 1800000000UL)
+		slop =  600;
+	else if (vrate > 1800000000UL && vrate < 2300000000UL)
+		slop = 400;
+	else if (vrate > 2300000000UL && vrate < VCO_MAX_RATE)
+		slop = 280;
+
+	return slop;
+}
+
+static void pll_14nm_calc_vco_count(struct dsi_pll_14nm *pll, struct dsi_pll_config *pconf)
+{
+	u64 vco_clk_rate = pconf->vco_current_rate;
+	u64 fref = VCO_REF_CLK_RATE;
+	u32 vco_measure_time = 5;
+	u32 kvco_measure_time = 5;
+	u64 data;
+	u32 cnt;
+
+	data = fref * vco_measure_time;
+	do_div(data, 1000000);
+	data &= 0x03ff;	/* 10 bits */
+	data -= 2;
+	pconf->pll_vco_div_ref = data;
+
+	data = div_u64(vco_clk_rate, 1000000);	/* unit is Mhz */
+	data *= vco_measure_time;
+	do_div(data, 10);
+	pconf->pll_vco_count = data;
+
+	data = fref * kvco_measure_time;
+	do_div(data, 1000000);
+	data &= 0x03ff;	/* 10 bits */
+	data -= 1;
+	pconf->pll_kvco_div_ref = data;
+
+	cnt = pll_14nm_kvco_slop(vco_clk_rate);
+	cnt *= 2;
+	cnt /= 100;
+	cnt *= kvco_measure_time;
+	pconf->pll_kvco_count = cnt;
+}
+
+static void pll_db_commit_ssc(struct dsi_pll_14nm *pll, struct dsi_pll_config *pconf)
+{
+	void __iomem *base = pll->phy->pll_base;
+	u8 data;
+
+	data = pconf->ssc_adj_period;
+	data &= 0x0ff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_SSC_ADJ_PER1, data);
+	data = (pconf->ssc_adj_period >> 8);
+	data &= 0x03;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_SSC_ADJ_PER2, data);
+
+	data = pconf->ssc_period;
+	data &= 0x0ff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_SSC_PER1, data);
+	data = (pconf->ssc_period >> 8);
+	data &= 0x0ff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_SSC_PER2, data);
+
+	data = pconf->ssc_step_size;
+	data &= 0x0ff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_SSC_STEP_SIZE1, data);
+	data = (pconf->ssc_step_size >> 8);
+	data &= 0x0ff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_SSC_STEP_SIZE2, data);
+
+	data = (pconf->ssc_center & 0x01);
+	data <<= 1;
+	data |= 0x01; /* enable */
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_SSC_EN_CENTER, data);
+
+	wmb();	/* make sure register committed */
+}
+
+static void pll_db_commit_common(struct dsi_pll_14nm *pll,
+				 struct dsi_pll_config *pconf)
+{
+	void __iomem *base = pll->phy->pll_base;
+	u8 data;
+
+	/* confgiure the non frequency dependent pll registers */
+	data = 0;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_SYSCLK_EN_RESET, data);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_TXCLK_EN, 1);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_RESETSM_CNTRL, 48);
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_RESETSM_CNTRL2, 4 << 3); /* bandgap_timer */
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_RESETSM_CNTRL5, 5); /* pll_wakeup_timer */
+
+	data = pconf->pll_vco_div_ref & 0xff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_VCO_DIV_REF1, data);
+	data = (pconf->pll_vco_div_ref >> 8) & 0x3;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_VCO_DIV_REF2, data);
+
+	data = pconf->pll_kvco_div_ref & 0xff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_KVCO_DIV_REF1, data);
+	data = (pconf->pll_kvco_div_ref >> 8) & 0x3;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_KVCO_DIV_REF2, data);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLL_MISC1, 16);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_IE_TRIM, 4);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_IP_TRIM, 4);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_CP_SET_CUR, 1 << 3 | 1);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLL_ICPCSET, 0 << 3 | 0);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLL_ICPMSET, 0 << 3 | 0);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLL_ICP_SET, 4 << 3 | 4);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLL_LPF1, 1 << 4 | 11);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_IPTAT_TRIM, 7);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLL_CRCTRL, 1 << 4 | 2);
+}
+
+static void pll_14nm_software_reset(struct dsi_pll_14nm *pll_14nm)
+{
+	void __iomem *cmn_base = pll_14nm->phy->base;
+
+	/* de assert pll start and apply pll sw reset */
+
+	/* stop pll */
+	dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_PLL_CNTRL, 0);
+
+	/* pll sw reset */
+	dsi_phy_write_udelay(cmn_base + REG_DSI_14nm_PHY_CMN_CTRL_1, 0x20, 10);
+	wmb();	/* make sure register committed */
+
+	dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_CTRL_1, 0);
+	wmb();	/* make sure register committed */
+}
+
+static void pll_db_commit_14nm(struct dsi_pll_14nm *pll,
+			       struct dsi_pll_config *pconf)
+{
+	void __iomem *base = pll->phy->pll_base;
+	void __iomem *cmn_base = pll->phy->base;
+	u8 data;
+
+	DBG("DSI%d PLL", pll->phy->id);
+
+	dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_LDO_CNTRL, 0x3c);
+
+	pll_db_commit_common(pll, pconf);
+
+	pll_14nm_software_reset(pll);
+
+	/* Use the /2 path in Mux */
+	dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_CLK_CFG1, 1);
+
+	data = 0xff; /* data, clk, pll normal operation */
+	dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_CTRL_0, data);
+
+	/* configure the frequency dependent pll registers */
+	data = pconf->dec_start;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_DEC_START, data);
+
+	data = pconf->div_frac_start & 0xff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_DIV_FRAC_START1, data);
+	data = (pconf->div_frac_start >> 8) & 0xff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_DIV_FRAC_START2, data);
+	data = (pconf->div_frac_start >> 16) & 0xf;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_DIV_FRAC_START3, data);
+
+	data = pconf->plllock_cmp & 0xff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLLLOCK_CMP1, data);
+
+	data = (pconf->plllock_cmp >> 8) & 0xff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLLLOCK_CMP2, data);
+
+	data = (pconf->plllock_cmp >> 16) & 0x3;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLLLOCK_CMP3, data);
+
+	data = pconf->plllock_cnt << 1 | 0 << 3; /* plllock_rng */
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLLLOCK_CMP_EN, data);
+
+	data = pconf->pll_vco_count & 0xff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_VCO_COUNT1, data);
+	data = (pconf->pll_vco_count >> 8) & 0xff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_VCO_COUNT2, data);
+
+	data = pconf->pll_kvco_count & 0xff;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_KVCO_COUNT1, data);
+	data = (pconf->pll_kvco_count >> 8) & 0x3;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_KVCO_COUNT2, data);
+
+	/*
+	 * High nibble configures the post divider internal to the VCO. It's
+	 * fixed to divide by 1 for now.
+	 *
+	 * 0: divided by 1
+	 * 1: divided by 2
+	 * 2: divided by 4
+	 * 3: divided by 8
+	 */
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLL_LPF2_POSTDIV, 0 << 4 | 3);
+
+	if (pconf->ssc_en)
+		pll_db_commit_ssc(pll, pconf);
+
+	wmb();	/* make sure register committed */
+}
+
+/*
+ * VCO clock Callbacks
+ */
+static int dsi_pll_14nm_vco_set_rate(struct clk_hw *hw, unsigned long rate,
+				     unsigned long parent_rate)
+{
+	struct dsi_pll_14nm *pll_14nm = to_pll_14nm(hw);
+	struct dsi_pll_config conf;
+
+	DBG("DSI PLL%d rate=%lu, parent's=%lu", pll_14nm->phy->id, rate,
+	    parent_rate);
+
+	dsi_pll_14nm_config_init(&conf);
+	conf.vco_current_rate = rate;
+
+	pll_14nm_dec_frac_calc(pll_14nm, &conf);
+
+	if (conf.ssc_en)
+		pll_14nm_ssc_calc(pll_14nm, &conf);
+
+	pll_14nm_calc_vco_count(pll_14nm, &conf);
+
+	/* commit the slave DSI PLL registers if we're master. Note that we
+	 * don't lock the slave PLL. We just ensure that the PLL/PHY registers
+	 * of the master and slave are identical
+	 */
+	if (pll_14nm->phy->usecase == MSM_DSI_PHY_MASTER) {
+		struct dsi_pll_14nm *pll_14nm_slave = pll_14nm->slave;
+
+		pll_db_commit_14nm(pll_14nm_slave, &conf);
+	}
+
+	pll_db_commit_14nm(pll_14nm, &conf);
+
+	return 0;
+}
+
+static unsigned long dsi_pll_14nm_vco_recalc_rate(struct clk_hw *hw,
+						  unsigned long parent_rate)
+{
+	struct dsi_pll_14nm *pll_14nm = to_pll_14nm(hw);
+	void __iomem *base = pll_14nm->phy->pll_base;
+	u64 vco_rate, multiplier = BIT(20);
+	u32 div_frac_start;
+	u32 dec_start;
+	u64 ref_clk = parent_rate;
+
+	dec_start = dsi_phy_read(base + REG_DSI_14nm_PHY_PLL_DEC_START);
+	dec_start &= 0x0ff;
+
+	DBG("dec_start = %x", dec_start);
+
+	div_frac_start = (dsi_phy_read(base + REG_DSI_14nm_PHY_PLL_DIV_FRAC_START3)
+				& 0xf) << 16;
+	div_frac_start |= (dsi_phy_read(base + REG_DSI_14nm_PHY_PLL_DIV_FRAC_START2)
+				& 0xff) << 8;
+	div_frac_start |= dsi_phy_read(base + REG_DSI_14nm_PHY_PLL_DIV_FRAC_START1)
+				& 0xff;
+
+	DBG("div_frac_start = %x", div_frac_start);
+
+	vco_rate = ref_clk * dec_start;
+
+	vco_rate += ((ref_clk * div_frac_start) / multiplier);
+
+	/*
+	 * Recalculating the rate from dec_start and frac_start doesn't end up
+	 * the rate we originally set. Convert the freq to KHz, round it up and
+	 * convert it back to MHz.
+	 */
+	vco_rate = DIV_ROUND_UP_ULL(vco_rate, 1000) * 1000;
+
+	DBG("returning vco rate = %lu", (unsigned long)vco_rate);
+
+	return (unsigned long)vco_rate;
+}
+
+static int dsi_pll_14nm_vco_prepare(struct clk_hw *hw)
+{
+	struct dsi_pll_14nm *pll_14nm = to_pll_14nm(hw);
+	void __iomem *base = pll_14nm->phy->pll_base;
+	void __iomem *cmn_base = pll_14nm->phy->base;
+	bool locked;
+
+	DBG("");
+
+	if (unlikely(pll_14nm->phy->pll_on))
+		return 0;
+
+	if (dsi_pll_14nm_vco_recalc_rate(hw, VCO_REF_CLK_RATE) == 0)
+		dsi_pll_14nm_vco_set_rate(hw, pll_14nm->phy->cfg->min_pll_rate, VCO_REF_CLK_RATE);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_VREF_CFG1, 0x10);
+	dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_PLL_CNTRL, 1);
+
+	locked = pll_14nm_poll_for_ready(pll_14nm, POLL_MAX_READS,
+					 POLL_TIMEOUT_US);
+
+	if (unlikely(!locked)) {
+		DRM_DEV_ERROR(&pll_14nm->phy->pdev->dev, "DSI PLL lock failed\n");
+		return -EINVAL;
+	}
+
+	DBG("DSI PLL lock success");
+	pll_14nm->phy->pll_on = true;
+
+	return 0;
+}
+
+static void dsi_pll_14nm_vco_unprepare(struct clk_hw *hw)
+{
+	struct dsi_pll_14nm *pll_14nm = to_pll_14nm(hw);
+	void __iomem *cmn_base = pll_14nm->phy->base;
+
+	DBG("");
+
+	if (unlikely(!pll_14nm->phy->pll_on))
+		return;
+
+	dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_PLL_CNTRL, 0);
+
+	pll_14nm->phy->pll_on = false;
+}
+
+static long dsi_pll_14nm_clk_round_rate(struct clk_hw *hw,
+		unsigned long rate, unsigned long *parent_rate)
+{
+	struct dsi_pll_14nm *pll_14nm = to_pll_14nm(hw);
+
+	if      (rate < pll_14nm->phy->cfg->min_pll_rate)
+		return  pll_14nm->phy->cfg->min_pll_rate;
+	else if (rate > pll_14nm->phy->cfg->max_pll_rate)
+		return  pll_14nm->phy->cfg->max_pll_rate;
+	else
+		return rate;
+}
+
+static const struct clk_ops clk_ops_dsi_pll_14nm_vco = {
+	.round_rate = dsi_pll_14nm_clk_round_rate,
+	.set_rate = dsi_pll_14nm_vco_set_rate,
+	.recalc_rate = dsi_pll_14nm_vco_recalc_rate,
+	.prepare = dsi_pll_14nm_vco_prepare,
+	.unprepare = dsi_pll_14nm_vco_unprepare,
+};
+
+/*
+ * N1 and N2 post-divider clock callbacks
+ */
+#define div_mask(width)	((1 << (width)) - 1)
+static unsigned long dsi_pll_14nm_postdiv_recalc_rate(struct clk_hw *hw,
+						      unsigned long parent_rate)
+{
+	struct dsi_pll_14nm_postdiv *postdiv = to_pll_14nm_postdiv(hw);
+	struct dsi_pll_14nm *pll_14nm = postdiv->pll;
+	void __iomem *base = pll_14nm->phy->base;
+	u8 shift = postdiv->shift;
+	u8 width = postdiv->width;
+	u32 val;
+
+	DBG("DSI%d PLL parent rate=%lu", pll_14nm->phy->id, parent_rate);
+
+	val = dsi_phy_read(base + REG_DSI_14nm_PHY_CMN_CLK_CFG0) >> shift;
+	val &= div_mask(width);
+
+	return divider_recalc_rate(hw, parent_rate, val, NULL,
+				   postdiv->flags, width);
+}
+
+static long dsi_pll_14nm_postdiv_round_rate(struct clk_hw *hw,
+					    unsigned long rate,
+					    unsigned long *prate)
+{
+	struct dsi_pll_14nm_postdiv *postdiv = to_pll_14nm_postdiv(hw);
+	struct dsi_pll_14nm *pll_14nm = postdiv->pll;
+
+	DBG("DSI%d PLL parent rate=%lu", pll_14nm->phy->id, rate);
+
+	return divider_round_rate(hw, rate, prate, NULL,
+				  postdiv->width,
+				  postdiv->flags);
+}
+
+static int dsi_pll_14nm_postdiv_set_rate(struct clk_hw *hw, unsigned long rate,
+					 unsigned long parent_rate)
+{
+	struct dsi_pll_14nm_postdiv *postdiv = to_pll_14nm_postdiv(hw);
+	struct dsi_pll_14nm *pll_14nm = postdiv->pll;
+	void __iomem *base = pll_14nm->phy->base;
+	spinlock_t *lock = &pll_14nm->postdiv_lock;
+	u8 shift = postdiv->shift;
+	u8 width = postdiv->width;
+	unsigned int value;
+	unsigned long flags = 0;
+	u32 val;
+
+	DBG("DSI%d PLL parent rate=%lu parent rate %lu", pll_14nm->phy->id, rate,
+	    parent_rate);
+
+	value = divider_get_val(rate, parent_rate, NULL, postdiv->width,
+				postdiv->flags);
+
+	spin_lock_irqsave(lock, flags);
+
+	val = dsi_phy_read(base + REG_DSI_14nm_PHY_CMN_CLK_CFG0);
+	val &= ~(div_mask(width) << shift);
+
+	val |= value << shift;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_CMN_CLK_CFG0, val);
+
+	/* If we're master in bonded DSI mode, then the slave PLL's post-dividers
+	 * follow the master's post dividers
+	 */
+	if (pll_14nm->phy->usecase == MSM_DSI_PHY_MASTER) {
+		struct dsi_pll_14nm *pll_14nm_slave = pll_14nm->slave;
+		void __iomem *slave_base = pll_14nm_slave->phy->base;
+
+		dsi_phy_write(slave_base + REG_DSI_14nm_PHY_CMN_CLK_CFG0, val);
+	}
+
+	spin_unlock_irqrestore(lock, flags);
+
+	return 0;
+}
+
+static const struct clk_ops clk_ops_dsi_pll_14nm_postdiv = {
+	.recalc_rate = dsi_pll_14nm_postdiv_recalc_rate,
+	.round_rate = dsi_pll_14nm_postdiv_round_rate,
+	.set_rate = dsi_pll_14nm_postdiv_set_rate,
+};
+
+/*
+ * PLL Callbacks
+ */
+
+static void dsi_14nm_pll_save_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_14nm *pll_14nm = to_pll_14nm(phy->vco_hw);
+	struct pll_14nm_cached_state *cached_state = &pll_14nm->cached_state;
+	void __iomem *cmn_base = pll_14nm->phy->base;
+	u32 data;
+
+	data = dsi_phy_read(cmn_base + REG_DSI_14nm_PHY_CMN_CLK_CFG0);
+
+	cached_state->n1postdiv = data & 0xf;
+	cached_state->n2postdiv = (data >> 4) & 0xf;
+
+	DBG("DSI%d PLL save state %x %x", pll_14nm->phy->id,
+	    cached_state->n1postdiv, cached_state->n2postdiv);
+
+	cached_state->vco_rate = clk_hw_get_rate(phy->vco_hw);
+}
+
+static int dsi_14nm_pll_restore_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_14nm *pll_14nm = to_pll_14nm(phy->vco_hw);
+	struct pll_14nm_cached_state *cached_state = &pll_14nm->cached_state;
+	void __iomem *cmn_base = pll_14nm->phy->base;
+	u32 data;
+	int ret;
+
+	ret = dsi_pll_14nm_vco_set_rate(phy->vco_hw,
+					cached_state->vco_rate, 0);
+	if (ret) {
+		DRM_DEV_ERROR(&pll_14nm->phy->pdev->dev,
+			      "restore vco rate failed. ret=%d\n", ret);
+		return ret;
+	}
+
+	data = cached_state->n1postdiv | (cached_state->n2postdiv << 4);
+
+	DBG("DSI%d PLL restore state %x %x", pll_14nm->phy->id,
+	    cached_state->n1postdiv, cached_state->n2postdiv);
+
+	dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_CLK_CFG0, data);
+
+	/* also restore post-dividers for slave DSI PLL */
+	if (phy->usecase == MSM_DSI_PHY_MASTER) {
+		struct dsi_pll_14nm *pll_14nm_slave = pll_14nm->slave;
+		void __iomem *slave_base = pll_14nm_slave->phy->base;
+
+		dsi_phy_write(slave_base + REG_DSI_14nm_PHY_CMN_CLK_CFG0, data);
+	}
+
+	return 0;
+}
+
+static int dsi_14nm_set_usecase(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_14nm *pll_14nm = to_pll_14nm(phy->vco_hw);
+	void __iomem *base = phy->pll_base;
+	u32 clkbuflr_en, bandgap = 0;
+
+	switch (phy->usecase) {
+	case MSM_DSI_PHY_STANDALONE:
+		clkbuflr_en = 0x1;
+		break;
+	case MSM_DSI_PHY_MASTER:
+		clkbuflr_en = 0x3;
+		pll_14nm->slave = pll_14nm_list[(pll_14nm->phy->id + 1) % DSI_MAX];
+		break;
+	case MSM_DSI_PHY_SLAVE:
+		clkbuflr_en = 0x0;
+		bandgap = 0x3;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_CLKBUFLR_EN, clkbuflr_en);
+	if (bandgap)
+		dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_PLL_BANDGAP, bandgap);
+
+	return 0;
+}
+
+static struct clk_hw *pll_14nm_postdiv_register(struct dsi_pll_14nm *pll_14nm,
+						const char *name,
+						const struct clk_hw *parent_hw,
+						unsigned long flags,
+						u8 shift)
+{
+	struct dsi_pll_14nm_postdiv *pll_postdiv;
+	struct device *dev = &pll_14nm->phy->pdev->dev;
+	struct clk_init_data postdiv_init = {
+		.parent_hws = (const struct clk_hw *[]) { parent_hw },
+		.num_parents = 1,
+		.name = name,
+		.flags = flags,
+		.ops = &clk_ops_dsi_pll_14nm_postdiv,
+	};
+	int ret;
+
+	pll_postdiv = devm_kzalloc(dev, sizeof(*pll_postdiv), GFP_KERNEL);
+	if (!pll_postdiv)
+		return ERR_PTR(-ENOMEM);
+
+	pll_postdiv->pll = pll_14nm;
+	pll_postdiv->shift = shift;
+	/* both N1 and N2 postdividers are 4 bits wide */
+	pll_postdiv->width = 4;
+	/* range of each divider is from 1 to 15 */
+	pll_postdiv->flags = CLK_DIVIDER_ONE_BASED;
+	pll_postdiv->hw.init = &postdiv_init;
+
+	ret = devm_clk_hw_register(dev, &pll_postdiv->hw);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return &pll_postdiv->hw;
+}
+
+static int pll_14nm_register(struct dsi_pll_14nm *pll_14nm, struct clk_hw **provided_clocks)
+{
+	char clk_name[32];
+	struct clk_init_data vco_init = {
+		.parent_data = &(const struct clk_parent_data) {
+			.fw_name = "ref",
+		},
+		.num_parents = 1,
+		.name = clk_name,
+		.flags = CLK_IGNORE_UNUSED,
+		.ops = &clk_ops_dsi_pll_14nm_vco,
+	};
+	struct device *dev = &pll_14nm->phy->pdev->dev;
+	struct clk_hw *hw, *n1_postdiv, *n1_postdivby2;
+	int ret;
+
+	DBG("DSI%d", pll_14nm->phy->id);
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dvco_clk", pll_14nm->phy->id);
+	pll_14nm->clk_hw.init = &vco_init;
+
+	ret = devm_clk_hw_register(dev, &pll_14nm->clk_hw);
+	if (ret)
+		return ret;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dn1_postdiv_clk", pll_14nm->phy->id);
+
+	/* N1 postdiv, bits 0-3 in REG_DSI_14nm_PHY_CMN_CLK_CFG0 */
+	n1_postdiv = pll_14nm_postdiv_register(pll_14nm, clk_name,
+			&pll_14nm->clk_hw, CLK_SET_RATE_PARENT, 0);
+	if (IS_ERR(n1_postdiv))
+		return PTR_ERR(n1_postdiv);
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dpllbyte", pll_14nm->phy->id);
+
+	/* DSI Byte clock = VCO_CLK / N1 / 8 */
+	hw = devm_clk_hw_register_fixed_factor_parent_hw(dev, clk_name,
+			n1_postdiv, CLK_SET_RATE_PARENT, 1, 8);
+	if (IS_ERR(hw))
+		return PTR_ERR(hw);
+
+	provided_clocks[DSI_BYTE_PLL_CLK] = hw;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dn1_postdivby2_clk", pll_14nm->phy->id);
+
+	/*
+	 * Skip the mux for now, force DSICLK_SEL to 1, Add a /2 divider
+	 * on the way. Don't let it set parent.
+	 */
+	n1_postdivby2 = devm_clk_hw_register_fixed_factor_parent_hw(dev,
+			clk_name, n1_postdiv, 0, 1, 2);
+	if (IS_ERR(n1_postdivby2))
+		return PTR_ERR(n1_postdivby2);
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dpll", pll_14nm->phy->id);
+
+	/* DSI pixel clock = VCO_CLK / N1 / 2 / N2
+	 * This is the output of N2 post-divider, bits 4-7 in
+	 * REG_DSI_14nm_PHY_CMN_CLK_CFG0. Don't let it set parent.
+	 */
+	hw = pll_14nm_postdiv_register(pll_14nm, clk_name, n1_postdivby2,
+			0, 4);
+	if (IS_ERR(hw))
+		return PTR_ERR(hw);
+
+	provided_clocks[DSI_PIXEL_PLL_CLK] = hw;
+
+	return 0;
+}
+
+static int dsi_pll_14nm_init(struct msm_dsi_phy *phy)
+{
+	struct platform_device *pdev = phy->pdev;
+	struct dsi_pll_14nm *pll_14nm;
+	int ret;
+
+	if (!pdev)
+		return -ENODEV;
+
+	pll_14nm = devm_kzalloc(&pdev->dev, sizeof(*pll_14nm), GFP_KERNEL);
+	if (!pll_14nm)
+		return -ENOMEM;
+
+	DBG("PLL%d", phy->id);
+
+	pll_14nm_list[phy->id] = pll_14nm;
+
+	spin_lock_init(&pll_14nm->postdiv_lock);
+
+	pll_14nm->phy = phy;
+
+	ret = pll_14nm_register(pll_14nm, phy->provided_clocks->hws);
+	if (ret) {
+		DRM_DEV_ERROR(&pdev->dev, "failed to register PLL: %d\n", ret);
+		return ret;
+	}
+
+	phy->vco_hw = &pll_14nm->clk_hw;
+
+	return 0;
+}
+
+static void dsi_14nm_dphy_set_timing(struct msm_dsi_phy *phy,
+				     struct msm_dsi_dphy_timing *timing,
+				     int lane_idx)
+{
+	void __iomem *base = phy->lane_base;
+	bool clk_ln = (lane_idx == PHY_14NM_CKLN_IDX);
+	u32 zero = clk_ln ? timing->clk_zero : timing->hs_zero;
+	u32 prepare = clk_ln ? timing->clk_prepare : timing->hs_prepare;
+	u32 trail = clk_ln ? timing->clk_trail : timing->hs_trail;
+	u32 rqst = clk_ln ? timing->hs_rqst_ckln : timing->hs_rqst;
+	u32 prep_dly = clk_ln ? timing->hs_prep_dly_ckln : timing->hs_prep_dly;
+	u32 halfbyte_en = clk_ln ? timing->hs_halfbyte_en_ckln :
+				   timing->hs_halfbyte_en;
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_TIMING_CTRL_4(lane_idx),
+		      DSI_14nm_PHY_LN_TIMING_CTRL_4_HS_EXIT(timing->hs_exit));
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_TIMING_CTRL_5(lane_idx),
+		      DSI_14nm_PHY_LN_TIMING_CTRL_5_HS_ZERO(zero));
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_TIMING_CTRL_6(lane_idx),
+		      DSI_14nm_PHY_LN_TIMING_CTRL_6_HS_PREPARE(prepare));
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_TIMING_CTRL_7(lane_idx),
+		      DSI_14nm_PHY_LN_TIMING_CTRL_7_HS_TRAIL(trail));
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_TIMING_CTRL_8(lane_idx),
+		      DSI_14nm_PHY_LN_TIMING_CTRL_8_HS_RQST(rqst));
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_CFG0(lane_idx),
+		      DSI_14nm_PHY_LN_CFG0_PREPARE_DLY(prep_dly));
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_CFG1(lane_idx),
+		      halfbyte_en ? DSI_14nm_PHY_LN_CFG1_HALFBYTECLK_EN : 0);
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_TIMING_CTRL_9(lane_idx),
+		      DSI_14nm_PHY_LN_TIMING_CTRL_9_TA_GO(timing->ta_go) |
+		      DSI_14nm_PHY_LN_TIMING_CTRL_9_TA_SURE(timing->ta_sure));
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_TIMING_CTRL_10(lane_idx),
+		      DSI_14nm_PHY_LN_TIMING_CTRL_10_TA_GET(timing->ta_get));
+	dsi_phy_write(base + REG_DSI_14nm_PHY_LN_TIMING_CTRL_11(lane_idx),
+		      DSI_14nm_PHY_LN_TIMING_CTRL_11_TRIG3_CMD(0xa0));
+}
+
+static int dsi_14nm_phy_enable(struct msm_dsi_phy *phy,
+			       struct msm_dsi_phy_clk_request *clk_req)
+{
+	struct msm_dsi_dphy_timing *timing = &phy->timing;
+	u32 data;
+	int i;
+	int ret;
+	void __iomem *base = phy->base;
+	void __iomem *lane_base = phy->lane_base;
+	u32 glbl_test_ctrl;
+
+	if (msm_dsi_dphy_timing_calc_v2(timing, clk_req)) {
+		DRM_DEV_ERROR(&phy->pdev->dev,
+			      "%s: D-PHY timing calculation failed\n",
+			      __func__);
+		return -EINVAL;
+	}
+
+	data = 0x1c;
+	if (phy->usecase != MSM_DSI_PHY_STANDALONE)
+		data |= DSI_14nm_PHY_CMN_LDO_CNTRL_VREG_CTRL(32);
+	dsi_phy_write(base + REG_DSI_14nm_PHY_CMN_LDO_CNTRL, data);
+
+	dsi_phy_write(base + REG_DSI_14nm_PHY_CMN_GLBL_TEST_CTRL, 0x1);
+
+	/* 4 data lanes + 1 clk lane configuration */
+	for (i = 0; i < 5; i++) {
+		dsi_phy_write(lane_base + REG_DSI_14nm_PHY_LN_VREG_CNTRL(i),
+			      0x1d);
+
+		dsi_phy_write(lane_base +
+			      REG_DSI_14nm_PHY_LN_STRENGTH_CTRL_0(i), 0xff);
+		dsi_phy_write(lane_base +
+			      REG_DSI_14nm_PHY_LN_STRENGTH_CTRL_1(i),
+			      (i == PHY_14NM_CKLN_IDX) ? 0x00 : 0x06);
+
+		dsi_phy_write(lane_base + REG_DSI_14nm_PHY_LN_CFG3(i),
+			      (i == PHY_14NM_CKLN_IDX) ? 0x8f : 0x0f);
+		dsi_phy_write(lane_base + REG_DSI_14nm_PHY_LN_CFG2(i), 0x10);
+		dsi_phy_write(lane_base + REG_DSI_14nm_PHY_LN_TEST_DATAPATH(i),
+			      0);
+		dsi_phy_write(lane_base + REG_DSI_14nm_PHY_LN_TEST_STR(i),
+			      0x88);
+
+		dsi_14nm_dphy_set_timing(phy, timing, i);
+	}
+
+	/* Make sure PLL is not start */
+	dsi_phy_write(base + REG_DSI_14nm_PHY_CMN_PLL_CNTRL, 0x00);
+
+	wmb(); /* make sure everything is written before reset and enable */
+
+	/* reset digital block */
+	dsi_phy_write(base + REG_DSI_14nm_PHY_CMN_CTRL_1, 0x80);
+	wmb(); /* ensure reset is asserted */
+	udelay(100);
+	dsi_phy_write(base + REG_DSI_14nm_PHY_CMN_CTRL_1, 0x00);
+
+	glbl_test_ctrl = dsi_phy_read(base + REG_DSI_14nm_PHY_CMN_GLBL_TEST_CTRL);
+	if (phy->id == DSI_1 && phy->usecase == MSM_DSI_PHY_SLAVE)
+		glbl_test_ctrl |= DSI_14nm_PHY_CMN_GLBL_TEST_CTRL_BITCLK_HS_SEL;
+	else
+		glbl_test_ctrl &= ~DSI_14nm_PHY_CMN_GLBL_TEST_CTRL_BITCLK_HS_SEL;
+	dsi_phy_write(base + REG_DSI_14nm_PHY_CMN_GLBL_TEST_CTRL, glbl_test_ctrl);
+	ret = dsi_14nm_set_usecase(phy);
+	if (ret) {
+		DRM_DEV_ERROR(&phy->pdev->dev, "%s: set pll usecase failed, %d\n",
+			      __func__, ret);
+		return ret;
+	}
+
+	/* Remove power down from PLL and all lanes */
+	dsi_phy_write(base + REG_DSI_14nm_PHY_CMN_CTRL_0, 0xff);
+
+	return 0;
+}
+
+static void dsi_14nm_phy_disable(struct msm_dsi_phy *phy)
+{
+	dsi_phy_write(phy->base + REG_DSI_14nm_PHY_CMN_GLBL_TEST_CTRL, 0);
+	dsi_phy_write(phy->base + REG_DSI_14nm_PHY_CMN_CTRL_0, 0);
+
+	/* ensure that the phy is completely disabled */
+	wmb();
+}
+
+static const struct regulator_bulk_data dsi_phy_14nm_17mA_regulators[] = {
+	{ .supply = "vcca", .init_load_uA = 17000 },
+};
+
+static const struct regulator_bulk_data dsi_phy_14nm_73p4mA_regulators[] = {
+	{ .supply = "vcca", .init_load_uA = 73400 },
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_14nm_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_14nm_17mA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_14nm_17mA_regulators),
+	.ops = {
+		.enable = dsi_14nm_phy_enable,
+		.disable = dsi_14nm_phy_disable,
+		.pll_init = dsi_pll_14nm_init,
+		.save_pll_state = dsi_14nm_pll_save_state,
+		.restore_pll_state = dsi_14nm_pll_restore_state,
+	},
+	.min_pll_rate = VCO_MIN_RATE,
+	.max_pll_rate = VCO_MAX_RATE,
+	.io_start = { 0x994400, 0x996400 },
+	.num_dsi_phy = 2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_14nm_660_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_14nm_73p4mA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_14nm_73p4mA_regulators),
+	.ops = {
+		.enable = dsi_14nm_phy_enable,
+		.disable = dsi_14nm_phy_disable,
+		.pll_init = dsi_pll_14nm_init,
+		.save_pll_state = dsi_14nm_pll_save_state,
+		.restore_pll_state = dsi_14nm_pll_restore_state,
+	},
+	.min_pll_rate = VCO_MIN_RATE,
+	.max_pll_rate = VCO_MAX_RATE,
+	.io_start = { 0xc994400, 0xc996400 },
+	.num_dsi_phy = 2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_14nm_8953_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_14nm_17mA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_14nm_17mA_regulators),
+	.ops = {
+		.enable = dsi_14nm_phy_enable,
+		.disable = dsi_14nm_phy_disable,
+		.pll_init = dsi_pll_14nm_init,
+		.save_pll_state = dsi_14nm_pll_save_state,
+		.restore_pll_state = dsi_14nm_pll_restore_state,
+	},
+	.min_pll_rate = VCO_MIN_RATE,
+	.max_pll_rate = VCO_MAX_RATE,
+	.io_start = { 0x1a94400, 0x1a96400 },
+	.num_dsi_phy = 2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_14nm_2290_cfgs = {
+	.has_phy_lane = true,
+	.ops = {
+		.enable = dsi_14nm_phy_enable,
+		.disable = dsi_14nm_phy_disable,
+		.pll_init = dsi_pll_14nm_init,
+		.save_pll_state = dsi_14nm_pll_save_state,
+		.restore_pll_state = dsi_14nm_pll_restore_state,
+	},
+	.min_pll_rate = VCO_MIN_RATE,
+	.max_pll_rate = VCO_MAX_RATE,
+	.io_start = { 0x5e94400 },
+	.num_dsi_phy = 1,
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_20nm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_20nm.c
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#include "dsi_phy.h"
+#include "dsi.xml.h"
+#include "dsi_phy_20nm.xml.h"
+
+static void dsi_20nm_dphy_set_timing(struct msm_dsi_phy *phy,
+		struct msm_dsi_dphy_timing *timing)
+{
+	void __iomem *base = phy->base;
+
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_0,
+		DSI_20nm_PHY_TIMING_CTRL_0_CLK_ZERO(timing->clk_zero));
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_1,
+		DSI_20nm_PHY_TIMING_CTRL_1_CLK_TRAIL(timing->clk_trail));
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_2,
+		DSI_20nm_PHY_TIMING_CTRL_2_CLK_PREPARE(timing->clk_prepare));
+	if (timing->clk_zero & BIT(8))
+		dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_3,
+			DSI_20nm_PHY_TIMING_CTRL_3_CLK_ZERO_8);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_4,
+		DSI_20nm_PHY_TIMING_CTRL_4_HS_EXIT(timing->hs_exit));
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_5,
+		DSI_20nm_PHY_TIMING_CTRL_5_HS_ZERO(timing->hs_zero));
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_6,
+		DSI_20nm_PHY_TIMING_CTRL_6_HS_PREPARE(timing->hs_prepare));
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_7,
+		DSI_20nm_PHY_TIMING_CTRL_7_HS_TRAIL(timing->hs_trail));
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_8,
+		DSI_20nm_PHY_TIMING_CTRL_8_HS_RQST(timing->hs_rqst));
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_9,
+		DSI_20nm_PHY_TIMING_CTRL_9_TA_GO(timing->ta_go) |
+		DSI_20nm_PHY_TIMING_CTRL_9_TA_SURE(timing->ta_sure));
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_10,
+		DSI_20nm_PHY_TIMING_CTRL_10_TA_GET(timing->ta_get));
+	dsi_phy_write(base + REG_DSI_20nm_PHY_TIMING_CTRL_11,
+		DSI_20nm_PHY_TIMING_CTRL_11_TRIG3_CMD(0));
+}
+
+static void dsi_20nm_phy_regulator_ctrl(struct msm_dsi_phy *phy, bool enable)
+{
+	void __iomem *base = phy->reg_base;
+
+	if (!enable) {
+		dsi_phy_write(base + REG_DSI_20nm_PHY_REGULATOR_CAL_PWR_CFG, 0);
+		return;
+	}
+
+	if (phy->regulator_ldo_mode) {
+		dsi_phy_write(phy->base + REG_DSI_20nm_PHY_LDO_CNTRL, 0x1d);
+		return;
+	}
+
+	/* non LDO mode */
+	dsi_phy_write(base + REG_DSI_20nm_PHY_REGULATOR_CTRL_1, 0x03);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_REGULATOR_CTRL_2, 0x03);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_REGULATOR_CTRL_3, 0x00);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_REGULATOR_CTRL_4, 0x20);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_REGULATOR_CAL_PWR_CFG, 0x01);
+	dsi_phy_write(phy->base + REG_DSI_20nm_PHY_LDO_CNTRL, 0x00);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_REGULATOR_CTRL_0, 0x03);
+}
+
+static int dsi_20nm_phy_enable(struct msm_dsi_phy *phy,
+				struct msm_dsi_phy_clk_request *clk_req)
+{
+	struct msm_dsi_dphy_timing *timing = &phy->timing;
+	int i;
+	void __iomem *base = phy->base;
+	u32 cfg_4[4] = {0x20, 0x40, 0x20, 0x00};
+	u32 val;
+
+	DBG("");
+
+	if (msm_dsi_dphy_timing_calc(timing, clk_req)) {
+		DRM_DEV_ERROR(&phy->pdev->dev,
+			"%s: D-PHY timing calculation failed\n", __func__);
+		return -EINVAL;
+	}
+
+	dsi_20nm_phy_regulator_ctrl(phy, true);
+
+	dsi_phy_write(base + REG_DSI_20nm_PHY_STRENGTH_0, 0xff);
+
+	val = dsi_phy_read(base + REG_DSI_20nm_PHY_GLBL_TEST_CTRL);
+	if (phy->id == DSI_1 && phy->usecase == MSM_DSI_PHY_STANDALONE)
+		val |= DSI_20nm_PHY_GLBL_TEST_CTRL_BITCLK_HS_SEL;
+	else
+		val &= ~DSI_20nm_PHY_GLBL_TEST_CTRL_BITCLK_HS_SEL;
+	dsi_phy_write(base + REG_DSI_20nm_PHY_GLBL_TEST_CTRL, val);
+
+	for (i = 0; i < 4; i++) {
+		dsi_phy_write(base + REG_DSI_20nm_PHY_LN_CFG_3(i),
+							(i >> 1) * 0x40);
+		dsi_phy_write(base + REG_DSI_20nm_PHY_LN_TEST_STR_0(i), 0x01);
+		dsi_phy_write(base + REG_DSI_20nm_PHY_LN_TEST_STR_1(i), 0x46);
+		dsi_phy_write(base + REG_DSI_20nm_PHY_LN_CFG_0(i), 0x02);
+		dsi_phy_write(base + REG_DSI_20nm_PHY_LN_CFG_1(i), 0xa0);
+		dsi_phy_write(base + REG_DSI_20nm_PHY_LN_CFG_4(i), cfg_4[i]);
+	}
+
+	dsi_phy_write(base + REG_DSI_20nm_PHY_LNCK_CFG_3, 0x80);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_LNCK_TEST_STR0, 0x01);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_LNCK_TEST_STR1, 0x46);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_LNCK_CFG_0, 0x00);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_LNCK_CFG_1, 0xa0);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_LNCK_CFG_2, 0x00);
+	dsi_phy_write(base + REG_DSI_20nm_PHY_LNCK_CFG_4, 0x00);
+
+	dsi_20nm_dphy_set_timing(phy, timing);
+
+	dsi_phy_write(base + REG_DSI_20nm_PHY_CTRL_1, 0x00);
+
+	dsi_phy_write(base + REG_DSI_20nm_PHY_STRENGTH_1, 0x06);
+
+	/* make sure everything is written before enable */
+	wmb();
+	dsi_phy_write(base + REG_DSI_20nm_PHY_CTRL_0, 0x7f);
+
+	return 0;
+}
+
+static void dsi_20nm_phy_disable(struct msm_dsi_phy *phy)
+{
+	dsi_phy_write(phy->base + REG_DSI_20nm_PHY_CTRL_0, 0);
+	dsi_20nm_phy_regulator_ctrl(phy, false);
+}
+
+static const struct regulator_bulk_data dsi_phy_20nm_regulators[] = {
+	{ .supply = "vddio", .init_load_uA = 100000 },	/* 1.8 V */
+	{ .supply = "vcca", .init_load_uA = 10000 },	/* 1.0 V */
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_20nm_cfgs = {
+	.has_phy_regulator = true,
+	.regulator_data = dsi_phy_20nm_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_20nm_regulators),
+	.ops = {
+		.enable = dsi_20nm_phy_enable,
+		.disable = dsi_20nm_phy_disable,
+	},
+	.io_start = { 0xfd998500, 0xfd9a0500 },
+	.num_dsi_phy = 2,
+};
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_28nm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_28nm.c
@@ -0,0 +1,919 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+
+#include "dsi_phy.h"
+#include "dsi.xml.h"
+#include "dsi_phy_28nm.xml.h"
+
+/*
+ * DSI PLL 28nm - clock diagram (eg: DSI0):
+ *
+ *         dsi0analog_postdiv_clk
+ *                             |         dsi0indirect_path_div2_clk
+ *                             |          |
+ *                   +------+  |  +----+  |  |\   dsi0byte_mux
+ *  dsi0vco_clk --o--| DIV1 |--o--| /2 |--o--| \   |
+ *                |  +------+     +----+     | m|  |  +----+
+ *                |                          | u|--o--| /4 |-- dsi0pllbyte
+ *                |                          | x|     +----+
+ *                o--------------------------| /
+ *                |                          |/
+ *                |          +------+
+ *                o----------| DIV3 |------------------------- dsi0pll
+ *                           +------+
+ */
+
+#define POLL_MAX_READS			10
+#define POLL_TIMEOUT_US		50
+
+#define VCO_REF_CLK_RATE		19200000
+#define VCO_MIN_RATE			350000000
+#define VCO_MAX_RATE			750000000
+
+/* v2.0.0 28nm LP implementation */
+#define DSI_PHY_28NM_QUIRK_PHY_LP	BIT(0)
+#define DSI_PHY_28NM_QUIRK_PHY_8226	BIT(1)
+
+#define LPFR_LUT_SIZE			10
+struct lpfr_cfg {
+	unsigned long vco_rate;
+	u32 resistance;
+};
+
+/* Loop filter resistance: */
+static const struct lpfr_cfg lpfr_lut[LPFR_LUT_SIZE] = {
+	{ 479500000,  8 },
+	{ 480000000, 11 },
+	{ 575500000,  8 },
+	{ 576000000, 12 },
+	{ 610500000,  8 },
+	{ 659500000,  9 },
+	{ 671500000, 10 },
+	{ 672000000, 14 },
+	{ 708500000, 10 },
+	{ 750000000, 11 },
+};
+
+struct pll_28nm_cached_state {
+	unsigned long vco_rate;
+	u8 postdiv3;
+	u8 postdiv1;
+	u8 byte_mux;
+};
+
+struct dsi_pll_28nm {
+	struct clk_hw clk_hw;
+
+	struct msm_dsi_phy *phy;
+
+	struct pll_28nm_cached_state cached_state;
+};
+
+#define to_pll_28nm(x)	container_of(x, struct dsi_pll_28nm, clk_hw)
+
+static bool pll_28nm_poll_for_ready(struct dsi_pll_28nm *pll_28nm,
+				u32 nb_tries, u32 timeout_us)
+{
+	bool pll_locked = false;
+	u32 val;
+
+	while (nb_tries--) {
+		val = dsi_phy_read(pll_28nm->phy->pll_base + REG_DSI_28nm_PHY_PLL_STATUS);
+		pll_locked = !!(val & DSI_28nm_PHY_PLL_STATUS_PLL_RDY);
+
+		if (pll_locked)
+			break;
+
+		udelay(timeout_us);
+	}
+	DBG("DSI PLL is %slocked", pll_locked ? "" : "*not* ");
+
+	return pll_locked;
+}
+
+static void pll_28nm_software_reset(struct dsi_pll_28nm *pll_28nm)
+{
+	void __iomem *base = pll_28nm->phy->pll_base;
+
+	/*
+	 * Add HW recommended delays after toggling the software
+	 * reset bit off and back on.
+	 */
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_TEST_CFG,
+			     DSI_28nm_PHY_PLL_TEST_CFG_PLL_SW_RESET, 1);
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_TEST_CFG, 0x00, 1);
+}
+
+/*
+ * Clock Callbacks
+ */
+static int dsi_pll_28nm_clk_set_rate(struct clk_hw *hw, unsigned long rate,
+		unsigned long parent_rate)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+	struct device *dev = &pll_28nm->phy->pdev->dev;
+	void __iomem *base = pll_28nm->phy->pll_base;
+	unsigned long div_fbx1000, gen_vco_clk;
+	u32 refclk_cfg, frac_n_mode, frac_n_value;
+	u32 sdm_cfg0, sdm_cfg1, sdm_cfg2, sdm_cfg3;
+	u32 cal_cfg10, cal_cfg11;
+	u32 rem;
+	int i;
+
+	VERB("rate=%lu, parent's=%lu", rate, parent_rate);
+
+	/* Force postdiv2 to be div-4 */
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_POSTDIV2_CFG, 3);
+
+	/* Configure the Loop filter resistance */
+	for (i = 0; i < LPFR_LUT_SIZE; i++)
+		if (rate <= lpfr_lut[i].vco_rate)
+			break;
+	if (i == LPFR_LUT_SIZE) {
+		DRM_DEV_ERROR(dev, "unable to get loop filter resistance. vco=%lu\n",
+				rate);
+		return -EINVAL;
+	}
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_LPFR_CFG, lpfr_lut[i].resistance);
+
+	/* Loop filter capacitance values : c1 and c2 */
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_LPFC1_CFG, 0x70);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_LPFC2_CFG, 0x15);
+
+	rem = rate % VCO_REF_CLK_RATE;
+	if (rem) {
+		refclk_cfg = DSI_28nm_PHY_PLL_REFCLK_CFG_DBLR;
+		frac_n_mode = 1;
+		div_fbx1000 = rate / (VCO_REF_CLK_RATE / 500);
+		gen_vco_clk = div_fbx1000 * (VCO_REF_CLK_RATE / 500);
+	} else {
+		refclk_cfg = 0x0;
+		frac_n_mode = 0;
+		div_fbx1000 = rate / (VCO_REF_CLK_RATE / 1000);
+		gen_vco_clk = div_fbx1000 * (VCO_REF_CLK_RATE / 1000);
+	}
+
+	DBG("refclk_cfg = %d", refclk_cfg);
+
+	rem = div_fbx1000 % 1000;
+	frac_n_value = (rem << 16) / 1000;
+
+	DBG("div_fb = %lu", div_fbx1000);
+	DBG("frac_n_value = %d", frac_n_value);
+
+	DBG("Generated VCO Clock: %lu", gen_vco_clk);
+	rem = 0;
+	sdm_cfg1 = dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_SDM_CFG1);
+	sdm_cfg1 &= ~DSI_28nm_PHY_PLL_SDM_CFG1_DC_OFFSET__MASK;
+	if (frac_n_mode) {
+		sdm_cfg0 = 0x0;
+		sdm_cfg0 |= DSI_28nm_PHY_PLL_SDM_CFG0_BYP_DIV(0);
+		sdm_cfg1 |= DSI_28nm_PHY_PLL_SDM_CFG1_DC_OFFSET(
+				(u32)(((div_fbx1000 / 1000) & 0x3f) - 1));
+		sdm_cfg3 = frac_n_value >> 8;
+		sdm_cfg2 = frac_n_value & 0xff;
+	} else {
+		sdm_cfg0 = DSI_28nm_PHY_PLL_SDM_CFG0_BYP;
+		sdm_cfg0 |= DSI_28nm_PHY_PLL_SDM_CFG0_BYP_DIV(
+				(u32)(((div_fbx1000 / 1000) & 0x3f) - 1));
+		sdm_cfg1 |= DSI_28nm_PHY_PLL_SDM_CFG1_DC_OFFSET(0);
+		sdm_cfg2 = 0;
+		sdm_cfg3 = 0;
+	}
+
+	DBG("sdm_cfg0=%d", sdm_cfg0);
+	DBG("sdm_cfg1=%d", sdm_cfg1);
+	DBG("sdm_cfg2=%d", sdm_cfg2);
+	DBG("sdm_cfg3=%d", sdm_cfg3);
+
+	cal_cfg11 = (u32)(gen_vco_clk / (256 * 1000000));
+	cal_cfg10 = (u32)((gen_vco_clk % (256 * 1000000)) / 1000000);
+	DBG("cal_cfg10=%d, cal_cfg11=%d", cal_cfg10, cal_cfg11);
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CHGPUMP_CFG, 0x02);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG3,    0x2b);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG4,    0x06);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_LKDET_CFG2,  0x0d);
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_SDM_CFG1, sdm_cfg1);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_SDM_CFG2,
+		      DSI_28nm_PHY_PLL_SDM_CFG2_FREQ_SEED_7_0(sdm_cfg2));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_SDM_CFG3,
+		      DSI_28nm_PHY_PLL_SDM_CFG3_FREQ_SEED_15_8(sdm_cfg3));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_SDM_CFG4, 0x00);
+
+	/* Add hardware recommended delay for correct PLL configuration */
+	if (pll_28nm->phy->cfg->quirks & DSI_PHY_28NM_QUIRK_PHY_LP)
+		udelay(1000);
+	else
+		udelay(1);
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_REFCLK_CFG, refclk_cfg);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_PWRGEN_CFG, 0x00);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_VCOLPF_CFG, 0x31);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_SDM_CFG0,   sdm_cfg0);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG0,   0x12);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG6,   0x30);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG7,   0x00);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG8,   0x60);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG9,   0x00);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG10,  cal_cfg10 & 0xff);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG11,  cal_cfg11 & 0xff);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_EFUSE_CFG,  0x20);
+
+	return 0;
+}
+
+static int dsi_pll_28nm_clk_is_enabled(struct clk_hw *hw)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+
+	return pll_28nm_poll_for_ready(pll_28nm, POLL_MAX_READS,
+					POLL_TIMEOUT_US);
+}
+
+static unsigned long dsi_pll_28nm_clk_recalc_rate(struct clk_hw *hw,
+		unsigned long parent_rate)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+	void __iomem *base = pll_28nm->phy->pll_base;
+	u32 sdm0, doubler, sdm_byp_div;
+	u32 sdm_dc_off, sdm_freq_seed, sdm2, sdm3;
+	u32 ref_clk = VCO_REF_CLK_RATE;
+	unsigned long vco_rate;
+
+	VERB("parent_rate=%lu", parent_rate);
+
+	/* Check to see if the ref clk doubler is enabled */
+	doubler = dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_REFCLK_CFG) &
+			DSI_28nm_PHY_PLL_REFCLK_CFG_DBLR;
+	ref_clk += (doubler * VCO_REF_CLK_RATE);
+
+	/* see if it is integer mode or sdm mode */
+	sdm0 = dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_SDM_CFG0);
+	if (sdm0 & DSI_28nm_PHY_PLL_SDM_CFG0_BYP) {
+		/* integer mode */
+		sdm_byp_div = FIELD(
+				dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_SDM_CFG0),
+				DSI_28nm_PHY_PLL_SDM_CFG0_BYP_DIV) + 1;
+		vco_rate = ref_clk * sdm_byp_div;
+	} else {
+		/* sdm mode */
+		sdm_dc_off = FIELD(
+				dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_SDM_CFG1),
+				DSI_28nm_PHY_PLL_SDM_CFG1_DC_OFFSET);
+		DBG("sdm_dc_off = %d", sdm_dc_off);
+		sdm2 = FIELD(dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_SDM_CFG2),
+				DSI_28nm_PHY_PLL_SDM_CFG2_FREQ_SEED_7_0);
+		sdm3 = FIELD(dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_SDM_CFG3),
+				DSI_28nm_PHY_PLL_SDM_CFG3_FREQ_SEED_15_8);
+		sdm_freq_seed = (sdm3 << 8) | sdm2;
+		DBG("sdm_freq_seed = %d", sdm_freq_seed);
+
+		vco_rate = (ref_clk * (sdm_dc_off + 1)) +
+			mult_frac(ref_clk, sdm_freq_seed, BIT(16));
+		DBG("vco rate = %lu", vco_rate);
+	}
+
+	DBG("returning vco rate = %lu", vco_rate);
+
+	return vco_rate;
+}
+
+static int _dsi_pll_28nm_vco_prepare_hpm(struct dsi_pll_28nm *pll_28nm)
+{
+	struct device *dev = &pll_28nm->phy->pdev->dev;
+	void __iomem *base = pll_28nm->phy->pll_base;
+	u32 max_reads = 5, timeout_us = 100;
+	bool locked;
+	u32 val;
+	int i;
+
+	DBG("id=%d", pll_28nm->phy->id);
+
+	pll_28nm_software_reset(pll_28nm);
+
+	/*
+	 * PLL power up sequence.
+	 * Add necessary delays recommended by hardware.
+	 */
+	val = DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRDN_B;
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 1);
+
+	val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRGEN_PWRDN_B;
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 200);
+
+	val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_LDO_PWRDN_B;
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 500);
+
+	val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_ENABLE;
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 600);
+
+	for (i = 0; i < 2; i++) {
+		/* DSI Uniphy lock detect setting */
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_LKDET_CFG2,
+				     0x0c, 100);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_LKDET_CFG2, 0x0d);
+
+		/* poll for PLL ready status */
+		locked = pll_28nm_poll_for_ready(pll_28nm, max_reads,
+						 timeout_us);
+		if (locked)
+			break;
+
+		pll_28nm_software_reset(pll_28nm);
+
+		/*
+		 * PLL power up sequence.
+		 * Add necessary delays recommended by hardware.
+		 */
+		val = DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRDN_B;
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 1);
+
+		val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRGEN_PWRDN_B;
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 200);
+
+		val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_LDO_PWRDN_B;
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 250);
+
+		val &= ~DSI_28nm_PHY_PLL_GLB_CFG_PLL_LDO_PWRDN_B;
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 200);
+
+		val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_LDO_PWRDN_B;
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 500);
+
+		val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_ENABLE;
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 600);
+	}
+
+	if (unlikely(!locked))
+		DRM_DEV_ERROR(dev, "DSI PLL lock failed\n");
+	else
+		DBG("DSI PLL Lock success");
+
+	return locked ? 0 : -EINVAL;
+}
+
+static int dsi_pll_28nm_vco_prepare_hpm(struct clk_hw *hw)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+	int i, ret;
+
+	if (unlikely(pll_28nm->phy->pll_on))
+		return 0;
+
+	for (i = 0; i < 3; i++) {
+		ret = _dsi_pll_28nm_vco_prepare_hpm(pll_28nm);
+		if (!ret) {
+			pll_28nm->phy->pll_on = true;
+			return 0;
+		}
+	}
+
+	return ret;
+}
+
+static int dsi_pll_28nm_vco_prepare_8226(struct clk_hw *hw)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+	struct device *dev = &pll_28nm->phy->pdev->dev;
+	void __iomem *base = pll_28nm->phy->pll_base;
+	u32 max_reads = 5, timeout_us = 100;
+	bool locked;
+	u32 val;
+	int i;
+
+	DBG("id=%d", pll_28nm->phy->id);
+
+	pll_28nm_software_reset(pll_28nm);
+
+	/*
+	 * PLL power up sequence.
+	 * Add necessary delays recommended by hardware.
+	 */
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_CAL_CFG1, 0x34);
+
+	val = DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRDN_B;
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 200);
+
+	val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRGEN_PWRDN_B;
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 200);
+
+	val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_LDO_PWRDN_B;
+	val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_ENABLE;
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 600);
+
+	for (i = 0; i < 7; i++) {
+		/* DSI Uniphy lock detect setting */
+		dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_LKDET_CFG2, 0x0d);
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_LKDET_CFG2,
+				0x0c, 100);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_LKDET_CFG2, 0x0d);
+
+		/* poll for PLL ready status */
+		locked = pll_28nm_poll_for_ready(pll_28nm,
+						max_reads, timeout_us);
+		if (locked)
+			break;
+
+		pll_28nm_software_reset(pll_28nm);
+
+		/*
+		 * PLL power up sequence.
+		 * Add necessary delays recommended by hardware.
+		 */
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_PWRGEN_CFG, 0x00, 50);
+
+		val = DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRDN_B;
+		val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRGEN_PWRDN_B;
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 100);
+
+		val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_LDO_PWRDN_B;
+		val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_ENABLE;
+		dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 600);
+	}
+
+	if (unlikely(!locked))
+		DRM_DEV_ERROR(dev, "DSI PLL lock failed\n");
+	else
+		DBG("DSI PLL Lock success");
+
+	return locked ? 0 : -EINVAL;
+}
+
+static int dsi_pll_28nm_vco_prepare_lp(struct clk_hw *hw)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+	struct device *dev = &pll_28nm->phy->pdev->dev;
+	void __iomem *base = pll_28nm->phy->pll_base;
+	bool locked;
+	u32 max_reads = 10, timeout_us = 50;
+	u32 val;
+
+	DBG("id=%d", pll_28nm->phy->id);
+
+	if (unlikely(pll_28nm->phy->pll_on))
+		return 0;
+
+	pll_28nm_software_reset(pll_28nm);
+
+	/*
+	 * PLL power up sequence.
+	 * Add necessary delays recommended by hardware.
+	 */
+	dsi_phy_write_ndelay(base + REG_DSI_28nm_PHY_PLL_CAL_CFG1, 0x34, 500);
+
+	val = DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRDN_B;
+	dsi_phy_write_ndelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 500);
+
+	val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_PWRGEN_PWRDN_B;
+	dsi_phy_write_ndelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 500);
+
+	val |= DSI_28nm_PHY_PLL_GLB_CFG_PLL_LDO_PWRDN_B |
+		DSI_28nm_PHY_PLL_GLB_CFG_PLL_ENABLE;
+	dsi_phy_write_ndelay(base + REG_DSI_28nm_PHY_PLL_GLB_CFG, val, 500);
+
+	/* DSI PLL toggle lock detect setting */
+	dsi_phy_write_ndelay(base + REG_DSI_28nm_PHY_PLL_LKDET_CFG2, 0x04, 500);
+	dsi_phy_write_udelay(base + REG_DSI_28nm_PHY_PLL_LKDET_CFG2, 0x05, 512);
+
+	locked = pll_28nm_poll_for_ready(pll_28nm, max_reads, timeout_us);
+
+	if (unlikely(!locked)) {
+		DRM_DEV_ERROR(dev, "DSI PLL lock failed\n");
+		return -EINVAL;
+	}
+
+	DBG("DSI PLL lock success");
+	pll_28nm->phy->pll_on = true;
+
+	return 0;
+}
+
+static void dsi_pll_28nm_vco_unprepare(struct clk_hw *hw)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+
+	DBG("id=%d", pll_28nm->phy->id);
+
+	if (unlikely(!pll_28nm->phy->pll_on))
+		return;
+
+	dsi_phy_write(pll_28nm->phy->pll_base + REG_DSI_28nm_PHY_PLL_GLB_CFG, 0x00);
+
+	pll_28nm->phy->pll_on = false;
+}
+
+static long dsi_pll_28nm_clk_round_rate(struct clk_hw *hw,
+		unsigned long rate, unsigned long *parent_rate)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+
+	if      (rate < pll_28nm->phy->cfg->min_pll_rate)
+		return  pll_28nm->phy->cfg->min_pll_rate;
+	else if (rate > pll_28nm->phy->cfg->max_pll_rate)
+		return  pll_28nm->phy->cfg->max_pll_rate;
+	else
+		return rate;
+}
+
+static const struct clk_ops clk_ops_dsi_pll_28nm_vco_hpm = {
+	.round_rate = dsi_pll_28nm_clk_round_rate,
+	.set_rate = dsi_pll_28nm_clk_set_rate,
+	.recalc_rate = dsi_pll_28nm_clk_recalc_rate,
+	.prepare = dsi_pll_28nm_vco_prepare_hpm,
+	.unprepare = dsi_pll_28nm_vco_unprepare,
+	.is_enabled = dsi_pll_28nm_clk_is_enabled,
+};
+
+static const struct clk_ops clk_ops_dsi_pll_28nm_vco_lp = {
+	.round_rate = dsi_pll_28nm_clk_round_rate,
+	.set_rate = dsi_pll_28nm_clk_set_rate,
+	.recalc_rate = dsi_pll_28nm_clk_recalc_rate,
+	.prepare = dsi_pll_28nm_vco_prepare_lp,
+	.unprepare = dsi_pll_28nm_vco_unprepare,
+	.is_enabled = dsi_pll_28nm_clk_is_enabled,
+};
+
+static const struct clk_ops clk_ops_dsi_pll_28nm_vco_8226 = {
+	.round_rate = dsi_pll_28nm_clk_round_rate,
+	.set_rate = dsi_pll_28nm_clk_set_rate,
+	.recalc_rate = dsi_pll_28nm_clk_recalc_rate,
+	.prepare = dsi_pll_28nm_vco_prepare_8226,
+	.unprepare = dsi_pll_28nm_vco_unprepare,
+	.is_enabled = dsi_pll_28nm_clk_is_enabled,
+};
+
+/*
+ * PLL Callbacks
+ */
+
+static void dsi_28nm_pll_save_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(phy->vco_hw);
+	struct pll_28nm_cached_state *cached_state = &pll_28nm->cached_state;
+	void __iomem *base = pll_28nm->phy->pll_base;
+
+	cached_state->postdiv3 =
+			dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_POSTDIV3_CFG);
+	cached_state->postdiv1 =
+			dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_POSTDIV1_CFG);
+	cached_state->byte_mux = dsi_phy_read(base + REG_DSI_28nm_PHY_PLL_VREG_CFG);
+	if (dsi_pll_28nm_clk_is_enabled(phy->vco_hw))
+		cached_state->vco_rate = clk_hw_get_rate(phy->vco_hw);
+	else
+		cached_state->vco_rate = 0;
+}
+
+static int dsi_28nm_pll_restore_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(phy->vco_hw);
+	struct pll_28nm_cached_state *cached_state = &pll_28nm->cached_state;
+	void __iomem *base = pll_28nm->phy->pll_base;
+	int ret;
+
+	ret = dsi_pll_28nm_clk_set_rate(phy->vco_hw,
+					cached_state->vco_rate, 0);
+	if (ret) {
+		DRM_DEV_ERROR(&pll_28nm->phy->pdev->dev,
+			"restore vco rate failed. ret=%d\n", ret);
+		return ret;
+	}
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_POSTDIV3_CFG,
+		      cached_state->postdiv3);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_POSTDIV1_CFG,
+		      cached_state->postdiv1);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_PLL_VREG_CFG,
+		      cached_state->byte_mux);
+
+	return 0;
+}
+
+static int pll_28nm_register(struct dsi_pll_28nm *pll_28nm, struct clk_hw **provided_clocks)
+{
+	char clk_name[32];
+	struct clk_init_data vco_init = {
+		.parent_data = &(const struct clk_parent_data) {
+			.fw_name = "ref", .name = "xo",
+		},
+		.num_parents = 1,
+		.name = clk_name,
+		.flags = CLK_IGNORE_UNUSED,
+	};
+	struct device *dev = &pll_28nm->phy->pdev->dev;
+	struct clk_hw *hw, *analog_postdiv, *indirect_path_div2, *byte_mux;
+	int ret;
+
+	DBG("%d", pll_28nm->phy->id);
+
+	if (pll_28nm->phy->cfg->quirks & DSI_PHY_28NM_QUIRK_PHY_LP)
+		vco_init.ops = &clk_ops_dsi_pll_28nm_vco_lp;
+	else if (pll_28nm->phy->cfg->quirks & DSI_PHY_28NM_QUIRK_PHY_8226)
+		vco_init.ops = &clk_ops_dsi_pll_28nm_vco_8226;
+	else
+		vco_init.ops = &clk_ops_dsi_pll_28nm_vco_hpm;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dvco_clk", pll_28nm->phy->id);
+	pll_28nm->clk_hw.init = &vco_init;
+	ret = devm_clk_hw_register(dev, &pll_28nm->clk_hw);
+	if (ret)
+		return ret;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%danalog_postdiv_clk", pll_28nm->phy->id);
+	analog_postdiv = devm_clk_hw_register_divider_parent_hw(dev, clk_name,
+			&pll_28nm->clk_hw, CLK_SET_RATE_PARENT,
+			pll_28nm->phy->pll_base +
+				REG_DSI_28nm_PHY_PLL_POSTDIV1_CFG,
+			0, 4, 0, NULL);
+	if (IS_ERR(analog_postdiv))
+		return PTR_ERR(analog_postdiv);
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dindirect_path_div2_clk", pll_28nm->phy->id);
+	indirect_path_div2 = devm_clk_hw_register_fixed_factor_parent_hw(dev,
+			clk_name, analog_postdiv, CLK_SET_RATE_PARENT, 1, 2);
+	if (IS_ERR(indirect_path_div2))
+		return PTR_ERR(indirect_path_div2);
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dpll", pll_28nm->phy->id);
+	hw = devm_clk_hw_register_divider_parent_hw(dev, clk_name,
+			&pll_28nm->clk_hw, 0, pll_28nm->phy->pll_base +
+				REG_DSI_28nm_PHY_PLL_POSTDIV3_CFG,
+			0, 8, 0, NULL);
+	if (IS_ERR(hw))
+		return PTR_ERR(hw);
+	provided_clocks[DSI_PIXEL_PLL_CLK] = hw;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dbyte_mux", pll_28nm->phy->id);
+	byte_mux = devm_clk_hw_register_mux_parent_hws(dev, clk_name,
+			((const struct clk_hw *[]){
+				&pll_28nm->clk_hw,
+				indirect_path_div2,
+			}), 2, CLK_SET_RATE_PARENT, pll_28nm->phy->pll_base +
+				REG_DSI_28nm_PHY_PLL_VREG_CFG, 1, 1, 0, NULL);
+	if (IS_ERR(byte_mux))
+		return PTR_ERR(byte_mux);
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dpllbyte", pll_28nm->phy->id);
+	hw = devm_clk_hw_register_fixed_factor_parent_hw(dev, clk_name,
+			byte_mux, CLK_SET_RATE_PARENT, 1, 4);
+	if (IS_ERR(hw))
+		return PTR_ERR(hw);
+	provided_clocks[DSI_BYTE_PLL_CLK] = hw;
+
+	return 0;
+}
+
+static int dsi_pll_28nm_init(struct msm_dsi_phy *phy)
+{
+	struct platform_device *pdev = phy->pdev;
+	struct dsi_pll_28nm *pll_28nm;
+	int ret;
+
+	if (!pdev)
+		return -ENODEV;
+
+	pll_28nm = devm_kzalloc(&pdev->dev, sizeof(*pll_28nm), GFP_KERNEL);
+	if (!pll_28nm)
+		return -ENOMEM;
+
+	pll_28nm->phy = phy;
+
+	ret = pll_28nm_register(pll_28nm, phy->provided_clocks->hws);
+	if (ret) {
+		DRM_DEV_ERROR(&pdev->dev, "failed to register PLL: %d\n", ret);
+		return ret;
+	}
+
+	phy->vco_hw = &pll_28nm->clk_hw;
+
+	return 0;
+}
+
+static void dsi_28nm_dphy_set_timing(struct msm_dsi_phy *phy,
+		struct msm_dsi_dphy_timing *timing)
+{
+	void __iomem *base = phy->base;
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_0,
+		      DSI_28nm_PHY_TIMING_CTRL_0_CLK_ZERO(timing->clk_zero));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_1,
+		      DSI_28nm_PHY_TIMING_CTRL_1_CLK_TRAIL(timing->clk_trail));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_2,
+		      DSI_28nm_PHY_TIMING_CTRL_2_CLK_PREPARE(timing->clk_prepare));
+	if (timing->clk_zero & BIT(8))
+		dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_3,
+			      DSI_28nm_PHY_TIMING_CTRL_3_CLK_ZERO_8);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_4,
+		      DSI_28nm_PHY_TIMING_CTRL_4_HS_EXIT(timing->hs_exit));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_5,
+		      DSI_28nm_PHY_TIMING_CTRL_5_HS_ZERO(timing->hs_zero));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_6,
+		      DSI_28nm_PHY_TIMING_CTRL_6_HS_PREPARE(timing->hs_prepare));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_7,
+		      DSI_28nm_PHY_TIMING_CTRL_7_HS_TRAIL(timing->hs_trail));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_8,
+		      DSI_28nm_PHY_TIMING_CTRL_8_HS_RQST(timing->hs_rqst));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_9,
+		      DSI_28nm_PHY_TIMING_CTRL_9_TA_GO(timing->ta_go) |
+		      DSI_28nm_PHY_TIMING_CTRL_9_TA_SURE(timing->ta_sure));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_10,
+		      DSI_28nm_PHY_TIMING_CTRL_10_TA_GET(timing->ta_get));
+	dsi_phy_write(base + REG_DSI_28nm_PHY_TIMING_CTRL_11,
+		      DSI_28nm_PHY_TIMING_CTRL_11_TRIG3_CMD(0));
+}
+
+static void dsi_28nm_phy_regulator_enable_dcdc(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->reg_base;
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_0, 0x0);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CAL_PWR_CFG, 1);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_5, 0);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_3, 0);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_2, 0x3);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_1, 0x9);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_0, 0x7);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_4, 0x20);
+	dsi_phy_write(phy->base + REG_DSI_28nm_PHY_LDO_CNTRL, 0x00);
+}
+
+static void dsi_28nm_phy_regulator_enable_ldo(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->reg_base;
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_0, 0x0);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CAL_PWR_CFG, 0);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_5, 0x7);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_3, 0);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_2, 0x1);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_1, 0x1);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_REGULATOR_CTRL_4, 0x20);
+
+	if (phy->cfg->quirks & DSI_PHY_28NM_QUIRK_PHY_LP)
+		dsi_phy_write(phy->base + REG_DSI_28nm_PHY_LDO_CNTRL, 0x05);
+	else
+		dsi_phy_write(phy->base + REG_DSI_28nm_PHY_LDO_CNTRL, 0x0d);
+}
+
+static void dsi_28nm_phy_regulator_ctrl(struct msm_dsi_phy *phy, bool enable)
+{
+	if (!enable) {
+		dsi_phy_write(phy->reg_base +
+			      REG_DSI_28nm_PHY_REGULATOR_CAL_PWR_CFG, 0);
+		return;
+	}
+
+	if (phy->regulator_ldo_mode)
+		dsi_28nm_phy_regulator_enable_ldo(phy);
+	else
+		dsi_28nm_phy_regulator_enable_dcdc(phy);
+}
+
+static int dsi_28nm_phy_enable(struct msm_dsi_phy *phy,
+				struct msm_dsi_phy_clk_request *clk_req)
+{
+	struct msm_dsi_dphy_timing *timing = &phy->timing;
+	int i;
+	void __iomem *base = phy->base;
+	u32 val;
+
+	DBG("");
+
+	if (msm_dsi_dphy_timing_calc(timing, clk_req)) {
+		DRM_DEV_ERROR(&phy->pdev->dev,
+			      "%s: D-PHY timing calculation failed\n",
+			      __func__);
+		return -EINVAL;
+	}
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_STRENGTH_0, 0xff);
+
+	dsi_28nm_phy_regulator_ctrl(phy, true);
+
+	dsi_28nm_dphy_set_timing(phy, timing);
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_CTRL_1, 0x00);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_CTRL_0, 0x5f);
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_STRENGTH_1, 0x6);
+
+	for (i = 0; i < 4; i++) {
+		dsi_phy_write(base + REG_DSI_28nm_PHY_LN_CFG_0(i), 0);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_LN_CFG_1(i), 0);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_LN_CFG_2(i), 0);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_LN_CFG_3(i), 0);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_LN_CFG_4(i), 0);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_LN_TEST_DATAPATH(i), 0);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_LN_DEBUG_SEL(i), 0);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_LN_TEST_STR_0(i), 0x1);
+		dsi_phy_write(base + REG_DSI_28nm_PHY_LN_TEST_STR_1(i), 0x97);
+	}
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_LNCK_CFG_4, 0);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_LNCK_CFG_1, 0xc0);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_LNCK_TEST_STR0, 0x1);
+	dsi_phy_write(base + REG_DSI_28nm_PHY_LNCK_TEST_STR1, 0xbb);
+
+	dsi_phy_write(base + REG_DSI_28nm_PHY_CTRL_0, 0x5f);
+
+	val = dsi_phy_read(base + REG_DSI_28nm_PHY_GLBL_TEST_CTRL);
+	if (phy->id == DSI_1 && phy->usecase == MSM_DSI_PHY_SLAVE)
+		val &= ~DSI_28nm_PHY_GLBL_TEST_CTRL_BITCLK_HS_SEL;
+	else
+		val |= DSI_28nm_PHY_GLBL_TEST_CTRL_BITCLK_HS_SEL;
+	dsi_phy_write(base + REG_DSI_28nm_PHY_GLBL_TEST_CTRL, val);
+
+	return 0;
+}
+
+static void dsi_28nm_phy_disable(struct msm_dsi_phy *phy)
+{
+	dsi_phy_write(phy->base + REG_DSI_28nm_PHY_CTRL_0, 0);
+	dsi_28nm_phy_regulator_ctrl(phy, false);
+
+	/*
+	 * Wait for the registers writes to complete in order to
+	 * ensure that the phy is completely disabled
+	 */
+	wmb();
+}
+
+static const struct regulator_bulk_data dsi_phy_28nm_regulators[] = {
+	{ .supply = "vddio", .init_load_uA = 100000 },
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_28nm_hpm_cfgs = {
+	.has_phy_regulator = true,
+	.regulator_data = dsi_phy_28nm_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_28nm_regulators),
+	.ops = {
+		.enable = dsi_28nm_phy_enable,
+		.disable = dsi_28nm_phy_disable,
+		.pll_init = dsi_pll_28nm_init,
+		.save_pll_state = dsi_28nm_pll_save_state,
+		.restore_pll_state = dsi_28nm_pll_restore_state,
+	},
+	.min_pll_rate = VCO_MIN_RATE,
+	.max_pll_rate = VCO_MAX_RATE,
+	.io_start = { 0xfd922b00, 0xfd923100 },
+	.num_dsi_phy = 2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_28nm_hpm_famb_cfgs = {
+	.has_phy_regulator = true,
+	.regulator_data = dsi_phy_28nm_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_28nm_regulators),
+	.ops = {
+		.enable = dsi_28nm_phy_enable,
+		.disable = dsi_28nm_phy_disable,
+		.pll_init = dsi_pll_28nm_init,
+		.save_pll_state = dsi_28nm_pll_save_state,
+		.restore_pll_state = dsi_28nm_pll_restore_state,
+	},
+	.min_pll_rate = VCO_MIN_RATE,
+	.max_pll_rate = VCO_MAX_RATE,
+	.io_start = { 0x1a94400, 0x1a96400 },
+	.num_dsi_phy = 2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_28nm_lp_cfgs = {
+	.has_phy_regulator = true,
+	.regulator_data = dsi_phy_28nm_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_28nm_regulators),
+	.ops = {
+		.enable = dsi_28nm_phy_enable,
+		.disable = dsi_28nm_phy_disable,
+		.pll_init = dsi_pll_28nm_init,
+		.save_pll_state = dsi_28nm_pll_save_state,
+		.restore_pll_state = dsi_28nm_pll_restore_state,
+	},
+	.min_pll_rate = VCO_MIN_RATE,
+	.max_pll_rate = VCO_MAX_RATE,
+	.io_start = { 0x1a98500 },
+	.num_dsi_phy = 1,
+	.quirks = DSI_PHY_28NM_QUIRK_PHY_LP,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_28nm_8226_cfgs = {
+	.has_phy_regulator = true,
+	.regulator_data = dsi_phy_28nm_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_28nm_regulators),
+	.ops = {
+		.enable = dsi_28nm_phy_enable,
+		.disable = dsi_28nm_phy_disable,
+		.pll_init = dsi_pll_28nm_init,
+		.save_pll_state = dsi_28nm_pll_save_state,
+		.restore_pll_state = dsi_28nm_pll_restore_state,
+	},
+	.min_pll_rate = VCO_MIN_RATE,
+	.max_pll_rate = VCO_MAX_RATE,
+	.io_start = { 0xfd922b00 },
+	.num_dsi_phy = 1,
+	.quirks = DSI_PHY_28NM_QUIRK_PHY_8226,
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_28nm_8960.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_28nm_8960.c
@@ -0,0 +1,660 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+
+#include "dsi_phy.h"
+#include "dsi.xml.h"
+#include "dsi_phy_28nm_8960.xml.h"
+
+/*
+ * DSI PLL 28nm (8960/A family) - clock diagram (eg: DSI1):
+ *
+ *
+ *                        +------+
+ *  dsi1vco_clk ----o-----| DIV1 |---dsi1pllbit (not exposed as clock)
+ *  F * byte_clk    |     +------+
+ *                  | bit clock divider (F / 8)
+ *                  |
+ *                  |     +------+
+ *                  o-----| DIV2 |---dsi0pllbyte---o---> To byte RCG
+ *                  |     +------+                 | (sets parent rate)
+ *                  | byte clock divider (F)       |
+ *                  |                              |
+ *                  |                              o---> To esc RCG
+ *                  |                                (doesn't set parent rate)
+ *                  |
+ *                  |     +------+
+ *                  o-----| DIV3 |----dsi0pll------o---> To dsi RCG
+ *                        +------+                 | (sets parent rate)
+ *                  dsi clock divider (F * magic)  |
+ *                                                 |
+ *                                                 o---> To pixel rcg
+ *                                                  (doesn't set parent rate)
+ */
+
+#define POLL_MAX_READS		8000
+#define POLL_TIMEOUT_US		1
+
+#define VCO_REF_CLK_RATE	27000000
+#define VCO_MIN_RATE		600000000
+#define VCO_MAX_RATE		1200000000
+
+#define VCO_PREF_DIV_RATIO	27
+
+struct pll_28nm_cached_state {
+	unsigned long vco_rate;
+	u8 postdiv3;
+	u8 postdiv2;
+	u8 postdiv1;
+};
+
+struct clk_bytediv {
+	struct clk_hw hw;
+	void __iomem *reg;
+};
+
+struct dsi_pll_28nm {
+	struct clk_hw clk_hw;
+
+	struct msm_dsi_phy *phy;
+
+	struct pll_28nm_cached_state cached_state;
+};
+
+#define to_pll_28nm(x)	container_of(x, struct dsi_pll_28nm, clk_hw)
+
+static bool pll_28nm_poll_for_ready(struct dsi_pll_28nm *pll_28nm,
+				    int nb_tries, int timeout_us)
+{
+	bool pll_locked = false;
+	u32 val;
+
+	while (nb_tries--) {
+		val = dsi_phy_read(pll_28nm->phy->pll_base + REG_DSI_28nm_8960_PHY_PLL_RDY);
+		pll_locked = !!(val & DSI_28nm_8960_PHY_PLL_RDY_PLL_RDY);
+
+		if (pll_locked)
+			break;
+
+		udelay(timeout_us);
+	}
+	DBG("DSI PLL is %slocked", pll_locked ? "" : "*not* ");
+
+	return pll_locked;
+}
+
+/*
+ * Clock Callbacks
+ */
+static int dsi_pll_28nm_clk_set_rate(struct clk_hw *hw, unsigned long rate,
+				     unsigned long parent_rate)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+	void __iomem *base = pll_28nm->phy->pll_base;
+	u32 val, temp, fb_divider;
+
+	DBG("rate=%lu, parent's=%lu", rate, parent_rate);
+
+	temp = rate / 10;
+	val = VCO_REF_CLK_RATE / 10;
+	fb_divider = (temp * VCO_PREF_DIV_RATIO) / val;
+	fb_divider = fb_divider / 2 - 1;
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_1,
+		      fb_divider & 0xff);
+
+	val = dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_2);
+
+	val |= (fb_divider >> 8) & 0x07;
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_2,
+		      val);
+
+	val = dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_3);
+
+	val |= (VCO_PREF_DIV_RATIO - 1) & 0x3f;
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_3,
+		      val);
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_6,
+		      0xf);
+
+	val = dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_8);
+	val |= 0x7 << 4;
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_8,
+		      val);
+
+	return 0;
+}
+
+static int dsi_pll_28nm_clk_is_enabled(struct clk_hw *hw)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+
+	return pll_28nm_poll_for_ready(pll_28nm, POLL_MAX_READS,
+					POLL_TIMEOUT_US);
+}
+
+static unsigned long dsi_pll_28nm_clk_recalc_rate(struct clk_hw *hw,
+						  unsigned long parent_rate)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+	void __iomem *base = pll_28nm->phy->pll_base;
+	unsigned long vco_rate;
+	u32 status, fb_divider, temp, ref_divider;
+
+	VERB("parent_rate=%lu", parent_rate);
+
+	status = dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_0);
+
+	if (status & DSI_28nm_8960_PHY_PLL_CTRL_0_ENABLE) {
+		fb_divider = dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_1);
+		fb_divider &= 0xff;
+		temp = dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_2) & 0x07;
+		fb_divider = (temp << 8) | fb_divider;
+		fb_divider += 1;
+
+		ref_divider = dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_3);
+		ref_divider &= 0x3f;
+		ref_divider += 1;
+
+		/* multiply by 2 */
+		vco_rate = (parent_rate / ref_divider) * fb_divider * 2;
+	} else {
+		vco_rate = 0;
+	}
+
+	DBG("returning vco rate = %lu", vco_rate);
+
+	return vco_rate;
+}
+
+static int dsi_pll_28nm_vco_prepare(struct clk_hw *hw)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+	struct device *dev = &pll_28nm->phy->pdev->dev;
+	void __iomem *base = pll_28nm->phy->pll_base;
+	bool locked;
+	unsigned int bit_div, byte_div;
+	int max_reads = 1000, timeout_us = 100;
+	u32 val;
+
+	DBG("id=%d", pll_28nm->phy->id);
+
+	if (unlikely(pll_28nm->phy->pll_on))
+		return 0;
+
+	/*
+	 * before enabling the PLL, configure the bit clock divider since we
+	 * don't expose it as a clock to the outside world
+	 * 1: read back the byte clock divider that should already be set
+	 * 2: divide by 8 to get bit clock divider
+	 * 3: write it to POSTDIV1
+	 */
+	val = dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_9);
+	byte_div = val + 1;
+	bit_div = byte_div / 8;
+
+	val = dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_8);
+	val &= ~0xf;
+	val |= (bit_div - 1);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_8, val);
+
+	/* enable the PLL */
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_0,
+		      DSI_28nm_8960_PHY_PLL_CTRL_0_ENABLE);
+
+	locked = pll_28nm_poll_for_ready(pll_28nm, max_reads, timeout_us);
+
+	if (unlikely(!locked)) {
+		DRM_DEV_ERROR(dev, "DSI PLL lock failed\n");
+		return -EINVAL;
+	}
+
+	DBG("DSI PLL lock success");
+	pll_28nm->phy->pll_on = true;
+
+	return 0;
+}
+
+static void dsi_pll_28nm_vco_unprepare(struct clk_hw *hw)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+
+	DBG("id=%d", pll_28nm->phy->id);
+
+	if (unlikely(!pll_28nm->phy->pll_on))
+		return;
+
+	dsi_phy_write(pll_28nm->phy->pll_base + REG_DSI_28nm_8960_PHY_PLL_CTRL_0, 0x00);
+
+	pll_28nm->phy->pll_on = false;
+}
+
+static long dsi_pll_28nm_clk_round_rate(struct clk_hw *hw,
+		unsigned long rate, unsigned long *parent_rate)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(hw);
+
+	if      (rate < pll_28nm->phy->cfg->min_pll_rate)
+		return  pll_28nm->phy->cfg->min_pll_rate;
+	else if (rate > pll_28nm->phy->cfg->max_pll_rate)
+		return  pll_28nm->phy->cfg->max_pll_rate;
+	else
+		return rate;
+}
+
+static const struct clk_ops clk_ops_dsi_pll_28nm_vco = {
+	.round_rate = dsi_pll_28nm_clk_round_rate,
+	.set_rate = dsi_pll_28nm_clk_set_rate,
+	.recalc_rate = dsi_pll_28nm_clk_recalc_rate,
+	.prepare = dsi_pll_28nm_vco_prepare,
+	.unprepare = dsi_pll_28nm_vco_unprepare,
+	.is_enabled = dsi_pll_28nm_clk_is_enabled,
+};
+
+/*
+ * Custom byte clock divier clk_ops
+ *
+ * This clock is the entry point to configuring the PLL. The user (dsi host)
+ * will set this clock's rate to the desired byte clock rate. The VCO lock
+ * frequency is a multiple of the byte clock rate. The multiplication factor
+ * (shown as F in the diagram above) is a function of the byte clock rate.
+ *
+ * This custom divider clock ensures that its parent (VCO) is set to the
+ * desired rate, and that the byte clock postdivider (POSTDIV2) is configured
+ * accordingly
+ */
+#define to_clk_bytediv(_hw) container_of(_hw, struct clk_bytediv, hw)
+
+static unsigned long clk_bytediv_recalc_rate(struct clk_hw *hw,
+		unsigned long parent_rate)
+{
+	struct clk_bytediv *bytediv = to_clk_bytediv(hw);
+	unsigned int div;
+
+	div = dsi_phy_read(bytediv->reg) & 0xff;
+
+	return parent_rate / (div + 1);
+}
+
+/* find multiplication factor(wrt byte clock) at which the VCO should be set */
+static unsigned int get_vco_mul_factor(unsigned long byte_clk_rate)
+{
+	unsigned long bit_mhz;
+
+	/* convert to bit clock in Mhz */
+	bit_mhz = (byte_clk_rate * 8) / 1000000;
+
+	if (bit_mhz < 125)
+		return 64;
+	else if (bit_mhz < 250)
+		return 32;
+	else if (bit_mhz < 600)
+		return 16;
+	else
+		return 8;
+}
+
+static long clk_bytediv_round_rate(struct clk_hw *hw, unsigned long rate,
+				   unsigned long *prate)
+{
+	unsigned long best_parent;
+	unsigned int factor;
+
+	factor = get_vco_mul_factor(rate);
+
+	best_parent = rate * factor;
+	*prate = clk_hw_round_rate(clk_hw_get_parent(hw), best_parent);
+
+	return *prate / factor;
+}
+
+static int clk_bytediv_set_rate(struct clk_hw *hw, unsigned long rate,
+				unsigned long parent_rate)
+{
+	struct clk_bytediv *bytediv = to_clk_bytediv(hw);
+	u32 val;
+	unsigned int factor;
+
+	factor = get_vco_mul_factor(rate);
+
+	val = dsi_phy_read(bytediv->reg);
+	val |= (factor - 1) & 0xff;
+	dsi_phy_write(bytediv->reg, val);
+
+	return 0;
+}
+
+/* Our special byte clock divider ops */
+static const struct clk_ops clk_bytediv_ops = {
+	.round_rate = clk_bytediv_round_rate,
+	.set_rate = clk_bytediv_set_rate,
+	.recalc_rate = clk_bytediv_recalc_rate,
+};
+
+/*
+ * PLL Callbacks
+ */
+static void dsi_28nm_pll_save_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(phy->vco_hw);
+	struct pll_28nm_cached_state *cached_state = &pll_28nm->cached_state;
+	void __iomem *base = pll_28nm->phy->pll_base;
+
+	cached_state->postdiv3 =
+			dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_10);
+	cached_state->postdiv2 =
+			dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_9);
+	cached_state->postdiv1 =
+			dsi_phy_read(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_8);
+
+	cached_state->vco_rate = clk_hw_get_rate(phy->vco_hw);
+}
+
+static int dsi_28nm_pll_restore_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_28nm *pll_28nm = to_pll_28nm(phy->vco_hw);
+	struct pll_28nm_cached_state *cached_state = &pll_28nm->cached_state;
+	void __iomem *base = pll_28nm->phy->pll_base;
+	int ret;
+
+	ret = dsi_pll_28nm_clk_set_rate(phy->vco_hw,
+					cached_state->vco_rate, 0);
+	if (ret) {
+		DRM_DEV_ERROR(&pll_28nm->phy->pdev->dev,
+			      "restore vco rate failed. ret=%d\n", ret);
+		return ret;
+	}
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_10,
+		      cached_state->postdiv3);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_9,
+		      cached_state->postdiv2);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_PLL_CTRL_8,
+		      cached_state->postdiv1);
+
+	return 0;
+}
+
+static int pll_28nm_register(struct dsi_pll_28nm *pll_28nm, struct clk_hw **provided_clocks)
+{
+	char clk_name[32];
+	struct clk_init_data vco_init = {
+		.parent_data = &(const struct clk_parent_data) {
+			.fw_name = "ref",
+		},
+		.num_parents = 1,
+		.flags = CLK_IGNORE_UNUSED,
+		.ops = &clk_ops_dsi_pll_28nm_vco,
+	};
+	struct device *dev = &pll_28nm->phy->pdev->dev;
+	struct clk_hw *hw;
+	struct clk_bytediv *bytediv;
+	struct clk_init_data bytediv_init = { };
+	int ret;
+
+	DBG("%d", pll_28nm->phy->id);
+
+	bytediv = devm_kzalloc(dev, sizeof(*bytediv), GFP_KERNEL);
+	if (!bytediv)
+		return -ENOMEM;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dvco_clk", pll_28nm->phy->id);
+	vco_init.name = clk_name;
+
+	pll_28nm->clk_hw.init = &vco_init;
+
+	ret = devm_clk_hw_register(dev, &pll_28nm->clk_hw);
+	if (ret)
+		return ret;
+
+	/* prepare and register bytediv */
+	bytediv->hw.init = &bytediv_init;
+	bytediv->reg = pll_28nm->phy->pll_base + REG_DSI_28nm_8960_PHY_PLL_CTRL_9;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dpllbyte", pll_28nm->phy->id + 1);
+
+	bytediv_init.name = clk_name;
+	bytediv_init.ops = &clk_bytediv_ops;
+	bytediv_init.flags = CLK_SET_RATE_PARENT;
+	bytediv_init.parent_hws = (const struct clk_hw*[]){
+		&pll_28nm->clk_hw,
+	};
+	bytediv_init.num_parents = 1;
+
+	/* DIV2 */
+	ret = devm_clk_hw_register(dev, &bytediv->hw);
+	if (ret)
+		return ret;
+	provided_clocks[DSI_BYTE_PLL_CLK] = &bytediv->hw;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dpll", pll_28nm->phy->id + 1);
+	/* DIV3 */
+	hw = devm_clk_hw_register_divider_parent_hw(dev, clk_name,
+			&pll_28nm->clk_hw, 0, pll_28nm->phy->pll_base +
+				REG_DSI_28nm_8960_PHY_PLL_CTRL_10,
+			0, 8, 0, NULL);
+	if (IS_ERR(hw))
+		return PTR_ERR(hw);
+	provided_clocks[DSI_PIXEL_PLL_CLK] = hw;
+
+	return 0;
+}
+
+static int dsi_pll_28nm_8960_init(struct msm_dsi_phy *phy)
+{
+	struct platform_device *pdev = phy->pdev;
+	struct dsi_pll_28nm *pll_28nm;
+	int ret;
+
+	if (!pdev)
+		return -ENODEV;
+
+	pll_28nm = devm_kzalloc(&pdev->dev, sizeof(*pll_28nm), GFP_KERNEL);
+	if (!pll_28nm)
+		return -ENOMEM;
+
+	pll_28nm->phy = phy;
+
+	ret = pll_28nm_register(pll_28nm, phy->provided_clocks->hws);
+	if (ret) {
+		DRM_DEV_ERROR(&pdev->dev, "failed to register PLL: %d\n", ret);
+		return ret;
+	}
+
+	phy->vco_hw = &pll_28nm->clk_hw;
+
+	return 0;
+}
+
+static void dsi_28nm_dphy_set_timing(struct msm_dsi_phy *phy,
+		struct msm_dsi_dphy_timing *timing)
+{
+	void __iomem *base = phy->base;
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_0,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_0_CLK_ZERO(timing->clk_zero));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_1,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_1_CLK_TRAIL(timing->clk_trail));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_2,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_2_CLK_PREPARE(timing->clk_prepare));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_3, 0x0);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_4,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_4_HS_EXIT(timing->hs_exit));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_5,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_5_HS_ZERO(timing->hs_zero));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_6,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_6_HS_PREPARE(timing->hs_prepare));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_7,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_7_HS_TRAIL(timing->hs_trail));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_8,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_8_HS_RQST(timing->hs_rqst));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_9,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_9_TA_GO(timing->ta_go) |
+		      DSI_28nm_8960_PHY_TIMING_CTRL_9_TA_SURE(timing->ta_sure));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_10,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_10_TA_GET(timing->ta_get));
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_TIMING_CTRL_11,
+		      DSI_28nm_8960_PHY_TIMING_CTRL_11_TRIG3_CMD(0));
+}
+
+static void dsi_28nm_phy_regulator_init(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->reg_base;
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_0, 0x3);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_1, 1);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_2, 1);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_3, 0);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_4,
+		      0x100);
+}
+
+static void dsi_28nm_phy_regulator_ctrl(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->reg_base;
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_0, 0x3);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_1, 0xa);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_2, 0x4);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_3, 0x0);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CTRL_4, 0x20);
+}
+
+static void dsi_28nm_phy_calibration(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->reg_base;
+	u32 status;
+	int i = 5000;
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_REGULATOR_CAL_PWR_CFG,
+		      0x3);
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_CAL_SW_CFG_2, 0x0);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_CAL_HW_CFG_1, 0x5a);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_CAL_HW_CFG_3, 0x10);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_CAL_HW_CFG_4, 0x1);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_CAL_HW_CFG_0, 0x1);
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_CAL_HW_TRIGGER, 0x1);
+	usleep_range(5000, 6000);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_MISC_CAL_HW_TRIGGER, 0x0);
+
+	do {
+		status = dsi_phy_read(base +
+				REG_DSI_28nm_8960_PHY_MISC_CAL_STATUS);
+
+		if (!(status & DSI_28nm_8960_PHY_MISC_CAL_STATUS_CAL_BUSY))
+			break;
+
+		udelay(1);
+	} while (--i > 0);
+}
+
+static void dsi_28nm_phy_lane_config(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->base;
+	int i;
+
+	for (i = 0; i < 4; i++) {
+		dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LN_CFG_0(i), 0x80);
+		dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LN_CFG_1(i), 0x45);
+		dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LN_CFG_2(i), 0x00);
+		dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LN_TEST_DATAPATH(i),
+			      0x00);
+		dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LN_TEST_STR_0(i),
+			      0x01);
+		dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LN_TEST_STR_1(i),
+			      0x66);
+	}
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LNCK_CFG_0, 0x40);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LNCK_CFG_1, 0x67);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LNCK_CFG_2, 0x0);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LNCK_TEST_DATAPATH, 0x0);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LNCK_TEST_STR0, 0x1);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LNCK_TEST_STR1, 0x88);
+}
+
+static int dsi_28nm_phy_enable(struct msm_dsi_phy *phy,
+				struct msm_dsi_phy_clk_request *clk_req)
+{
+	struct msm_dsi_dphy_timing *timing = &phy->timing;
+	void __iomem *base = phy->base;
+
+	DBG("");
+
+	if (msm_dsi_dphy_timing_calc(timing, clk_req)) {
+		DRM_DEV_ERROR(&phy->pdev->dev,
+			      "%s: D-PHY timing calculation failed\n",
+			      __func__);
+		return -EINVAL;
+	}
+
+	dsi_28nm_phy_regulator_init(phy);
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_LDO_CTRL, 0x04);
+
+	/* strength control */
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_STRENGTH_0, 0xff);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_STRENGTH_1, 0x00);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_STRENGTH_2, 0x06);
+
+	/* phy ctrl */
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_CTRL_0, 0x5f);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_CTRL_1, 0x00);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_CTRL_2, 0x00);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_CTRL_3, 0x10);
+
+	dsi_28nm_phy_regulator_ctrl(phy);
+
+	dsi_28nm_phy_calibration(phy);
+
+	dsi_28nm_phy_lane_config(phy);
+
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_BIST_CTRL_4, 0x0f);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_BIST_CTRL_1, 0x03);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_BIST_CTRL_0, 0x03);
+	dsi_phy_write(base + REG_DSI_28nm_8960_PHY_BIST_CTRL_4, 0x0);
+
+	dsi_28nm_dphy_set_timing(phy, timing);
+
+	return 0;
+}
+
+static void dsi_28nm_phy_disable(struct msm_dsi_phy *phy)
+{
+	dsi_phy_write(phy->base + REG_DSI_28nm_8960_PHY_CTRL_0, 0x0);
+
+	/*
+	 * Wait for the registers writes to complete in order to
+	 * ensure that the phy is completely disabled
+	 */
+	wmb();
+}
+
+static const struct regulator_bulk_data dsi_phy_28nm_8960_regulators[] = {
+	{ .supply = "vddio", .init_load_uA = 100000 },	/* 1.8 V */
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_28nm_8960_cfgs = {
+	.has_phy_regulator = true,
+	.regulator_data = dsi_phy_28nm_8960_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_28nm_8960_regulators),
+	.ops = {
+		.enable = dsi_28nm_phy_enable,
+		.disable = dsi_28nm_phy_disable,
+		.pll_init = dsi_pll_28nm_8960_init,
+		.save_pll_state = dsi_28nm_pll_save_state,
+		.restore_pll_state = dsi_28nm_pll_restore_state,
+	},
+	.min_pll_rate = VCO_MIN_RATE,
+	.max_pll_rate = VCO_MAX_RATE,
+	.io_start = { 0x4700300, 0x5800300 },
+	.num_dsi_phy = 2,
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_7nm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/dsi/phy/dsi_phy_7nm.c
@@ -0,0 +1,1347 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0
+ * Copyright (c) 2018, The Linux Foundation
+ */
+
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <linux/iopoll.h>
+
+#include "dsi_phy.h"
+#include "dsi.xml.h"
+#include "dsi_phy_7nm.xml.h"
+
+/*
+ * DSI PLL 7nm - clock diagram (eg: DSI0): TODO: updated CPHY diagram
+ *
+ *           dsi0_pll_out_div_clk  dsi0_pll_bit_clk
+ *                              |                |
+ *                              |                |
+ *                 +---------+  |  +----------+  |  +----+
+ *  dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0_phy_pll_out_byteclk
+ *                 +---------+  |  +----------+  |  +----+
+ *                              |                |
+ *                              |                |         dsi0_pll_by_2_bit_clk
+ *                              |                |          |
+ *                              |                |  +----+  |  |\  dsi0_pclk_mux
+ *                              |                |--| /2 |--o--| \   |
+ *                              |                |  +----+     |  \  |  +---------+
+ *                              |                --------------|  |--o--| div_7_4 |-- dsi0_phy_pll_out_dsiclk
+ *                              |------------------------------|  /     +---------+
+ *                              |          +-----+             | /
+ *                              -----------| /4? |--o----------|/
+ *                                         +-----+  |           |
+ *                                                  |           |dsiclk_sel
+ *                                                  |
+ *                                                  dsi0_pll_post_out_div_clk
+ */
+
+#define VCO_REF_CLK_RATE		19200000
+#define FRAC_BITS 18
+
+/* Hardware is pre V4.1 */
+#define DSI_PHY_7NM_QUIRK_PRE_V4_1	BIT(0)
+/* Hardware is V4.1 */
+#define DSI_PHY_7NM_QUIRK_V4_1		BIT(1)
+/* Hardware is V4.2 */
+#define DSI_PHY_7NM_QUIRK_V4_2		BIT(2)
+/* Hardware is V4.3 */
+#define DSI_PHY_7NM_QUIRK_V4_3		BIT(3)
+/* Hardware is V5.2 */
+#define DSI_PHY_7NM_QUIRK_V5_2		BIT(4)
+
+struct dsi_pll_config {
+	bool enable_ssc;
+	bool ssc_center;
+	u32 ssc_freq;
+	u32 ssc_offset;
+	u32 ssc_adj_per;
+
+	/* out */
+	u32 decimal_div_start;
+	u32 frac_div_start;
+	u32 pll_clock_inverters;
+	u32 ssc_stepsize;
+	u32 ssc_div_per;
+};
+
+struct pll_7nm_cached_state {
+	unsigned long vco_rate;
+	u8 bit_clk_div;
+	u8 pix_clk_div;
+	u8 pll_out_div;
+	u8 pll_mux;
+};
+
+struct dsi_pll_7nm {
+	struct clk_hw clk_hw;
+
+	struct msm_dsi_phy *phy;
+
+	u64 vco_current_rate;
+
+	/* protects REG_DSI_7nm_PHY_CMN_CLK_CFG0 register */
+	spinlock_t postdiv_lock;
+
+	struct pll_7nm_cached_state cached_state;
+
+	struct dsi_pll_7nm *slave;
+};
+
+#define to_pll_7nm(x)	container_of(x, struct dsi_pll_7nm, clk_hw)
+
+/*
+ * Global list of private DSI PLL struct pointers. We need this for bonded DSI
+ * mode, where the master PLL's clk_ops needs access the slave's private data
+ */
+static struct dsi_pll_7nm *pll_7nm_list[DSI_MAX];
+
+static void dsi_pll_setup_config(struct dsi_pll_config *config)
+{
+	config->ssc_freq = 31500;
+	config->ssc_offset = 4800;
+	config->ssc_adj_per = 2;
+
+	/* TODO: ssc enable */
+	config->enable_ssc = false;
+	config->ssc_center = 0;
+}
+
+static void dsi_pll_calc_dec_frac(struct dsi_pll_7nm *pll, struct dsi_pll_config *config)
+{
+	u64 fref = VCO_REF_CLK_RATE;
+	u64 pll_freq;
+	u64 divider;
+	u64 dec, dec_multiple;
+	u32 frac;
+	u64 multiplier;
+
+	pll_freq = pll->vco_current_rate;
+
+	divider = fref * 2;
+
+	multiplier = 1 << FRAC_BITS;
+	dec_multiple = div_u64(pll_freq * multiplier, divider);
+	dec = div_u64_rem(dec_multiple, multiplier, &frac);
+
+	if (pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_PRE_V4_1)
+		config->pll_clock_inverters = 0x28;
+	else if ((pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2)) {
+		if (pll_freq <= 1300000000ULL)
+			config->pll_clock_inverters = 0xa0;
+		else if (pll_freq <= 2500000000ULL)
+			config->pll_clock_inverters = 0x20;
+		else if (pll_freq <= 4000000000ULL)
+			config->pll_clock_inverters = 0x00;
+		else
+			config->pll_clock_inverters = 0x40;
+	} else if (pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_1) {
+		if (pll_freq <= 1000000000ULL)
+			config->pll_clock_inverters = 0xa0;
+		else if (pll_freq <= 2500000000ULL)
+			config->pll_clock_inverters = 0x20;
+		else if (pll_freq <= 3020000000ULL)
+			config->pll_clock_inverters = 0x00;
+		else
+			config->pll_clock_inverters = 0x40;
+	} else {
+		/* 4.2, 4.3 */
+		if (pll_freq <= 1000000000ULL)
+			config->pll_clock_inverters = 0xa0;
+		else if (pll_freq <= 2500000000ULL)
+			config->pll_clock_inverters = 0x20;
+		else if (pll_freq <= 3500000000ULL)
+			config->pll_clock_inverters = 0x00;
+		else
+			config->pll_clock_inverters = 0x40;
+	}
+
+	config->decimal_div_start = dec;
+	config->frac_div_start = frac;
+}
+
+#define SSC_CENTER		BIT(0)
+#define SSC_EN			BIT(1)
+
+static void dsi_pll_calc_ssc(struct dsi_pll_7nm *pll, struct dsi_pll_config *config)
+{
+	u32 ssc_per;
+	u32 ssc_mod;
+	u64 ssc_step_size;
+	u64 frac;
+
+	if (!config->enable_ssc) {
+		DBG("SSC not enabled\n");
+		return;
+	}
+
+	ssc_per = DIV_ROUND_CLOSEST(VCO_REF_CLK_RATE, config->ssc_freq) / 2 - 1;
+	ssc_mod = (ssc_per + 1) % (config->ssc_adj_per + 1);
+	ssc_per -= ssc_mod;
+
+	frac = config->frac_div_start;
+	ssc_step_size = config->decimal_div_start;
+	ssc_step_size *= (1 << FRAC_BITS);
+	ssc_step_size += frac;
+	ssc_step_size *= config->ssc_offset;
+	ssc_step_size *= (config->ssc_adj_per + 1);
+	ssc_step_size = div_u64(ssc_step_size, (ssc_per + 1));
+	ssc_step_size = DIV_ROUND_CLOSEST_ULL(ssc_step_size, 1000000);
+
+	config->ssc_div_per = ssc_per;
+	config->ssc_stepsize = ssc_step_size;
+
+	pr_debug("SCC: Dec:%d, frac:%llu, frac_bits:%d\n",
+		 config->decimal_div_start, frac, FRAC_BITS);
+	pr_debug("SSC: div_per:0x%X, stepsize:0x%X, adjper:0x%X\n",
+		 ssc_per, (u32)ssc_step_size, config->ssc_adj_per);
+}
+
+static void dsi_pll_ssc_commit(struct dsi_pll_7nm *pll, struct dsi_pll_config *config)
+{
+	void __iomem *base = pll->phy->pll_base;
+
+	if (config->enable_ssc) {
+		pr_debug("SSC is enabled\n");
+
+		dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_SSC_STEPSIZE_LOW_1,
+			      config->ssc_stepsize & 0xff);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_SSC_STEPSIZE_HIGH_1,
+			      config->ssc_stepsize >> 8);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_SSC_DIV_PER_LOW_1,
+			      config->ssc_div_per & 0xff);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_SSC_DIV_PER_HIGH_1,
+			      config->ssc_div_per >> 8);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_SSC_ADJPER_LOW_1,
+			      config->ssc_adj_per & 0xff);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_SSC_ADJPER_HIGH_1,
+			      config->ssc_adj_per >> 8);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_SSC_CONTROL,
+			      SSC_EN | (config->ssc_center ? SSC_CENTER : 0));
+	}
+}
+
+static void dsi_pll_config_hzindep_reg(struct dsi_pll_7nm *pll)
+{
+	void __iomem *base = pll->phy->pll_base;
+	u8 analog_controls_five_1 = 0x01, vco_config_1 = 0x00;
+
+	if (!(pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_PRE_V4_1))
+		if (pll->vco_current_rate >= 3100000000ULL)
+			analog_controls_five_1 = 0x03;
+
+	if (pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_1) {
+		if (pll->vco_current_rate < 1520000000ULL)
+			vco_config_1 = 0x08;
+		else if (pll->vco_current_rate < 2990000000ULL)
+			vco_config_1 = 0x01;
+	}
+
+	if ((pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_2) ||
+	    (pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_3)) {
+		if (pll->vco_current_rate < 1520000000ULL)
+			vco_config_1 = 0x08;
+		else if (pll->vco_current_rate >= 2990000000ULL)
+			vco_config_1 = 0x01;
+	}
+
+	if ((pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2)) {
+		if (pll->vco_current_rate < 1557000000ULL)
+			vco_config_1 = 0x08;
+		else
+			vco_config_1 = 0x01;
+	}
+
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_ANALOG_CONTROLS_FIVE_1,
+		      analog_controls_five_1);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_VCO_CONFIG_1, vco_config_1);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_ANALOG_CONTROLS_FIVE, 0x01);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_ANALOG_CONTROLS_TWO, 0x03);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_ANALOG_CONTROLS_THREE, 0x00);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_DSM_DIVIDER, 0x00);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_FEEDBACK_DIVIDER, 0x4e);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_CALIBRATION_SETTINGS, 0x40);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_BAND_SEL_CAL_SETTINGS_THREE, 0xba);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_FREQ_DETECT_SETTINGS_ONE, 0x0c);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_OUTDIV, 0x00);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_CORE_OVERRIDE, 0x00);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PLL_DIGITAL_TIMERS_TWO, 0x08);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PLL_PROP_GAIN_RATE_1, 0x0a);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PLL_BAND_SEL_RATE_1, 0xc0);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PLL_INT_GAIN_IFILT_BAND_1, 0x84);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PLL_INT_GAIN_IFILT_BAND_1, 0x82);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PLL_FL_INT_GAIN_PFILT_BAND_1, 0x4c);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PLL_LOCK_OVERRIDE, 0x80);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PFILT, 0x29);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PFILT, 0x2f);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_IFILT, 0x2a);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_IFILT,
+		  !(pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_PRE_V4_1) ? 0x3f : 0x22);
+
+	if (!(pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_PRE_V4_1)) {
+		dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PERF_OPTIMIZE, 0x22);
+		if (pll->slave)
+			dsi_phy_write(pll->slave->phy->pll_base + REG_DSI_7nm_PHY_PLL_PERF_OPTIMIZE, 0x22);
+	}
+}
+
+static void dsi_pll_commit(struct dsi_pll_7nm *pll, struct dsi_pll_config *config)
+{
+	void __iomem *base = pll->phy->pll_base;
+
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_CORE_INPUT_OVERRIDE, 0x12);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_DECIMAL_DIV_START_1,
+		      config->decimal_div_start);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_FRAC_DIV_START_LOW_1,
+		      config->frac_div_start & 0xff);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_FRAC_DIV_START_MID_1,
+		      (config->frac_div_start & 0xff00) >> 8);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_FRAC_DIV_START_HIGH_1,
+		      (config->frac_div_start & 0x30000) >> 16);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PLL_LOCKDET_RATE_1, 0x40);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_PLL_LOCK_DELAY, 0x06);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_CMODE_1,
+		      pll->phy->cphy_mode ? 0x00 : 0x10);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_PLL_CLOCK_INVERTERS,
+		      config->pll_clock_inverters);
+}
+
+static int dsi_pll_7nm_vco_set_rate(struct clk_hw *hw, unsigned long rate,
+				     unsigned long parent_rate)
+{
+	struct dsi_pll_7nm *pll_7nm = to_pll_7nm(hw);
+	struct dsi_pll_config config;
+
+	DBG("DSI PLL%d rate=%lu, parent's=%lu", pll_7nm->phy->id, rate,
+	    parent_rate);
+
+	pll_7nm->vco_current_rate = rate;
+
+	dsi_pll_setup_config(&config);
+
+	dsi_pll_calc_dec_frac(pll_7nm, &config);
+
+	dsi_pll_calc_ssc(pll_7nm, &config);
+
+	dsi_pll_commit(pll_7nm, &config);
+
+	dsi_pll_config_hzindep_reg(pll_7nm);
+
+	dsi_pll_ssc_commit(pll_7nm, &config);
+
+	/* flush, ensure all register writes are done*/
+	wmb();
+
+	return 0;
+}
+
+static int dsi_pll_7nm_lock_status(struct dsi_pll_7nm *pll)
+{
+	int rc;
+	u32 status = 0;
+	u32 const delay_us = 100;
+	u32 const timeout_us = 5000;
+
+	rc = readl_poll_timeout_atomic(pll->phy->pll_base +
+				       REG_DSI_7nm_PHY_PLL_COMMON_STATUS_ONE,
+				       status,
+				       ((status & BIT(0)) > 0),
+				       delay_us,
+				       timeout_us);
+	if (rc)
+		pr_err("DSI PLL(%d) lock failed, status=0x%08x\n",
+		       pll->phy->id, status);
+
+	return rc;
+}
+
+static void dsi_pll_disable_pll_bias(struct dsi_pll_7nm *pll)
+{
+	u32 data = dsi_phy_read(pll->phy->base + REG_DSI_7nm_PHY_CMN_CTRL_0);
+
+	dsi_phy_write(pll->phy->pll_base + REG_DSI_7nm_PHY_PLL_SYSTEM_MUXES, 0);
+	dsi_phy_write(pll->phy->base + REG_DSI_7nm_PHY_CMN_CTRL_0, data & ~BIT(5));
+	ndelay(250);
+}
+
+static void dsi_pll_enable_pll_bias(struct dsi_pll_7nm *pll)
+{
+	u32 data = dsi_phy_read(pll->phy->base + REG_DSI_7nm_PHY_CMN_CTRL_0);
+
+	dsi_phy_write(pll->phy->base + REG_DSI_7nm_PHY_CMN_CTRL_0, data | BIT(5));
+	dsi_phy_write(pll->phy->pll_base + REG_DSI_7nm_PHY_PLL_SYSTEM_MUXES, 0xc0);
+	ndelay(250);
+}
+
+static void dsi_pll_disable_global_clk(struct dsi_pll_7nm *pll)
+{
+	u32 data;
+
+	data = dsi_phy_read(pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1);
+	dsi_phy_write(pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1, data & ~BIT(5));
+}
+
+static void dsi_pll_enable_global_clk(struct dsi_pll_7nm *pll)
+{
+	u32 data;
+
+	dsi_phy_write(pll->phy->base + REG_DSI_7nm_PHY_CMN_CTRL_3, 0x04);
+
+	data = dsi_phy_read(pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1);
+	dsi_phy_write(pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1,
+		      data | BIT(5) | BIT(4));
+}
+
+static void dsi_pll_phy_dig_reset(struct dsi_pll_7nm *pll)
+{
+	/*
+	 * Reset the PHY digital domain. This would be needed when
+	 * coming out of a CX or analog rail power collapse while
+	 * ensuring that the pads maintain LP00 or LP11 state
+	 */
+	dsi_phy_write(pll->phy->base + REG_DSI_7nm_PHY_CMN_GLBL_DIGTOP_SPARE4, BIT(0));
+	wmb(); /* Ensure that the reset is deasserted */
+	dsi_phy_write(pll->phy->base + REG_DSI_7nm_PHY_CMN_GLBL_DIGTOP_SPARE4, 0x0);
+	wmb(); /* Ensure that the reset is deasserted */
+}
+
+static int dsi_pll_7nm_vco_prepare(struct clk_hw *hw)
+{
+	struct dsi_pll_7nm *pll_7nm = to_pll_7nm(hw);
+	int rc;
+
+	dsi_pll_enable_pll_bias(pll_7nm);
+	if (pll_7nm->slave)
+		dsi_pll_enable_pll_bias(pll_7nm->slave);
+
+	/* Start PLL */
+	dsi_phy_write(pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_PLL_CNTRL, 0x01);
+
+	/*
+	 * ensure all PLL configurations are written prior to checking
+	 * for PLL lock.
+	 */
+	wmb();
+
+	/* Check for PLL lock */
+	rc = dsi_pll_7nm_lock_status(pll_7nm);
+	if (rc) {
+		pr_err("PLL(%d) lock failed\n", pll_7nm->phy->id);
+		goto error;
+	}
+
+	pll_7nm->phy->pll_on = true;
+
+	/*
+	 * assert power on reset for PHY digital in case the PLL is
+	 * enabled after CX of analog domain power collapse. This needs
+	 * to be done before enabling the global clk.
+	 */
+	dsi_pll_phy_dig_reset(pll_7nm);
+	if (pll_7nm->slave)
+		dsi_pll_phy_dig_reset(pll_7nm->slave);
+
+	dsi_pll_enable_global_clk(pll_7nm);
+	if (pll_7nm->slave)
+		dsi_pll_enable_global_clk(pll_7nm->slave);
+
+error:
+	return rc;
+}
+
+static void dsi_pll_disable_sub(struct dsi_pll_7nm *pll)
+{
+	dsi_phy_write(pll->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL, 0);
+	dsi_pll_disable_pll_bias(pll);
+}
+
+static void dsi_pll_7nm_vco_unprepare(struct clk_hw *hw)
+{
+	struct dsi_pll_7nm *pll_7nm = to_pll_7nm(hw);
+
+	/*
+	 * To avoid any stray glitches while abruptly powering down the PLL
+	 * make sure to gate the clock using the clock enable bit before
+	 * powering down the PLL
+	 */
+	dsi_pll_disable_global_clk(pll_7nm);
+	dsi_phy_write(pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_PLL_CNTRL, 0);
+	dsi_pll_disable_sub(pll_7nm);
+	if (pll_7nm->slave) {
+		dsi_pll_disable_global_clk(pll_7nm->slave);
+		dsi_pll_disable_sub(pll_7nm->slave);
+	}
+	/* flush, ensure all register writes are done */
+	wmb();
+	pll_7nm->phy->pll_on = false;
+}
+
+static unsigned long dsi_pll_7nm_vco_recalc_rate(struct clk_hw *hw,
+						  unsigned long parent_rate)
+{
+	struct dsi_pll_7nm *pll_7nm = to_pll_7nm(hw);
+	void __iomem *base = pll_7nm->phy->pll_base;
+	u64 ref_clk = VCO_REF_CLK_RATE;
+	u64 vco_rate = 0x0;
+	u64 multiplier;
+	u32 frac;
+	u32 dec;
+	u64 pll_freq, tmp64;
+
+	dec = dsi_phy_read(base + REG_DSI_7nm_PHY_PLL_DECIMAL_DIV_START_1);
+	dec &= 0xff;
+
+	frac = dsi_phy_read(base + REG_DSI_7nm_PHY_PLL_FRAC_DIV_START_LOW_1);
+	frac |= ((dsi_phy_read(base + REG_DSI_7nm_PHY_PLL_FRAC_DIV_START_MID_1) &
+		  0xff) << 8);
+	frac |= ((dsi_phy_read(base + REG_DSI_7nm_PHY_PLL_FRAC_DIV_START_HIGH_1) &
+		  0x3) << 16);
+
+	/*
+	 * TODO:
+	 *	1. Assumes prescaler is disabled
+	 */
+	multiplier = 1 << FRAC_BITS;
+	pll_freq = dec * (ref_clk * 2);
+	tmp64 = (ref_clk * 2 * frac);
+	pll_freq += div_u64(tmp64, multiplier);
+
+	vco_rate = pll_freq;
+	pll_7nm->vco_current_rate = vco_rate;
+
+	DBG("DSI PLL%d returning vco rate = %lu, dec = %x, frac = %x",
+	    pll_7nm->phy->id, (unsigned long)vco_rate, dec, frac);
+
+	return (unsigned long)vco_rate;
+}
+
+static long dsi_pll_7nm_clk_round_rate(struct clk_hw *hw,
+		unsigned long rate, unsigned long *parent_rate)
+{
+	struct dsi_pll_7nm *pll_7nm = to_pll_7nm(hw);
+
+	if      (rate < pll_7nm->phy->cfg->min_pll_rate)
+		return  pll_7nm->phy->cfg->min_pll_rate;
+	else if (rate > pll_7nm->phy->cfg->max_pll_rate)
+		return  pll_7nm->phy->cfg->max_pll_rate;
+	else
+		return rate;
+}
+
+static const struct clk_ops clk_ops_dsi_pll_7nm_vco = {
+	.round_rate = dsi_pll_7nm_clk_round_rate,
+	.set_rate = dsi_pll_7nm_vco_set_rate,
+	.recalc_rate = dsi_pll_7nm_vco_recalc_rate,
+	.prepare = dsi_pll_7nm_vco_prepare,
+	.unprepare = dsi_pll_7nm_vco_unprepare,
+};
+
+/*
+ * PLL Callbacks
+ */
+
+static void dsi_7nm_pll_save_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_7nm *pll_7nm = to_pll_7nm(phy->vco_hw);
+	struct pll_7nm_cached_state *cached = &pll_7nm->cached_state;
+	void __iomem *phy_base = pll_7nm->phy->base;
+	u32 cmn_clk_cfg0, cmn_clk_cfg1;
+
+	cached->pll_out_div = dsi_phy_read(pll_7nm->phy->pll_base +
+			REG_DSI_7nm_PHY_PLL_PLL_OUTDIV_RATE);
+	cached->pll_out_div &= 0x3;
+
+	cmn_clk_cfg0 = dsi_phy_read(phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG0);
+	cached->bit_clk_div = cmn_clk_cfg0 & 0xf;
+	cached->pix_clk_div = (cmn_clk_cfg0 & 0xf0) >> 4;
+
+	cmn_clk_cfg1 = dsi_phy_read(phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG1);
+	cached->pll_mux = cmn_clk_cfg1 & 0x3;
+
+	DBG("DSI PLL%d outdiv %x bit_clk_div %x pix_clk_div %x pll_mux %x",
+	    pll_7nm->phy->id, cached->pll_out_div, cached->bit_clk_div,
+	    cached->pix_clk_div, cached->pll_mux);
+}
+
+static int dsi_7nm_pll_restore_state(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_7nm *pll_7nm = to_pll_7nm(phy->vco_hw);
+	struct pll_7nm_cached_state *cached = &pll_7nm->cached_state;
+	void __iomem *phy_base = pll_7nm->phy->base;
+	u32 val;
+	int ret;
+
+	val = dsi_phy_read(pll_7nm->phy->pll_base + REG_DSI_7nm_PHY_PLL_PLL_OUTDIV_RATE);
+	val &= ~0x3;
+	val |= cached->pll_out_div;
+	dsi_phy_write(pll_7nm->phy->pll_base + REG_DSI_7nm_PHY_PLL_PLL_OUTDIV_RATE, val);
+
+	dsi_phy_write(phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG0,
+		      cached->bit_clk_div | (cached->pix_clk_div << 4));
+
+	val = dsi_phy_read(phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG1);
+	val &= ~0x3;
+	val |= cached->pll_mux;
+	dsi_phy_write(phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG1, val);
+
+	ret = dsi_pll_7nm_vco_set_rate(phy->vco_hw,
+			pll_7nm->vco_current_rate,
+			VCO_REF_CLK_RATE);
+	if (ret) {
+		DRM_DEV_ERROR(&pll_7nm->phy->pdev->dev,
+			"restore vco rate failed. ret=%d\n", ret);
+		return ret;
+	}
+
+	DBG("DSI PLL%d", pll_7nm->phy->id);
+
+	return 0;
+}
+
+static int dsi_7nm_set_usecase(struct msm_dsi_phy *phy)
+{
+	struct dsi_pll_7nm *pll_7nm = to_pll_7nm(phy->vco_hw);
+	void __iomem *base = phy->base;
+	u32 data = 0x0;	/* internal PLL */
+
+	DBG("DSI PLL%d", pll_7nm->phy->id);
+
+	switch (phy->usecase) {
+	case MSM_DSI_PHY_STANDALONE:
+		break;
+	case MSM_DSI_PHY_MASTER:
+		pll_7nm->slave = pll_7nm_list[(pll_7nm->phy->id + 1) % DSI_MAX];
+		break;
+	case MSM_DSI_PHY_SLAVE:
+		data = 0x1; /* external PLL */
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* set PLL src */
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_CLK_CFG1, (data << 2));
+
+	return 0;
+}
+
+/*
+ * The post dividers and mux clocks are created using the standard divider and
+ * mux API. Unlike the 14nm PHY, the slave PLL doesn't need its dividers/mux
+ * state to follow the master PLL's divider/mux state. Therefore, we don't
+ * require special clock ops that also configure the slave PLL registers
+ */
+static int pll_7nm_register(struct dsi_pll_7nm *pll_7nm, struct clk_hw **provided_clocks)
+{
+	char clk_name[32];
+	struct clk_init_data vco_init = {
+		.parent_data = &(const struct clk_parent_data) {
+			.fw_name = "ref",
+		},
+		.num_parents = 1,
+		.name = clk_name,
+		.flags = CLK_IGNORE_UNUSED,
+		.ops = &clk_ops_dsi_pll_7nm_vco,
+	};
+	struct device *dev = &pll_7nm->phy->pdev->dev;
+	struct clk_hw *hw, *pll_out_div, *pll_bit, *pll_by_2_bit;
+	struct clk_hw *pll_post_out_div, *phy_pll_out_dsi_parent;
+	int ret;
+
+	DBG("DSI%d", pll_7nm->phy->id);
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%dvco_clk", pll_7nm->phy->id);
+	pll_7nm->clk_hw.init = &vco_init;
+
+	ret = devm_clk_hw_register(dev, &pll_7nm->clk_hw);
+	if (ret)
+		return ret;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_pll_out_div_clk", pll_7nm->phy->id);
+
+	pll_out_div = devm_clk_hw_register_divider_parent_hw(dev, clk_name,
+			&pll_7nm->clk_hw, CLK_SET_RATE_PARENT,
+			pll_7nm->phy->pll_base +
+				REG_DSI_7nm_PHY_PLL_PLL_OUTDIV_RATE,
+			0, 2, CLK_DIVIDER_POWER_OF_TWO, NULL);
+	if (IS_ERR(pll_out_div)) {
+		ret = PTR_ERR(pll_out_div);
+		goto fail;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_pll_bit_clk", pll_7nm->phy->id);
+
+	/* BIT CLK: DIV_CTRL_3_0 */
+	pll_bit = devm_clk_hw_register_divider_parent_hw(dev, clk_name,
+			pll_out_div, CLK_SET_RATE_PARENT,
+			pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG0,
+			0, 4, CLK_DIVIDER_ONE_BASED, &pll_7nm->postdiv_lock);
+	if (IS_ERR(pll_bit)) {
+		ret = PTR_ERR(pll_bit);
+		goto fail;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_phy_pll_out_byteclk", pll_7nm->phy->id);
+
+	/* DSI Byte clock = VCO_CLK / OUT_DIV / BIT_DIV / 8 */
+	hw = devm_clk_hw_register_fixed_factor_parent_hw(dev, clk_name,
+			pll_bit, CLK_SET_RATE_PARENT, 1,
+			pll_7nm->phy->cphy_mode ? 7 : 8);
+	if (IS_ERR(hw)) {
+		ret = PTR_ERR(hw);
+		goto fail;
+	}
+
+	provided_clocks[DSI_BYTE_PLL_CLK] = hw;
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_pll_by_2_bit_clk", pll_7nm->phy->id);
+
+	pll_by_2_bit = devm_clk_hw_register_fixed_factor_parent_hw(dev,
+			clk_name, pll_bit, 0, 1, 2);
+	if (IS_ERR(pll_by_2_bit)) {
+		ret = PTR_ERR(pll_by_2_bit);
+		goto fail;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_pll_post_out_div_clk", pll_7nm->phy->id);
+
+	if (pll_7nm->phy->cphy_mode)
+		pll_post_out_div = devm_clk_hw_register_fixed_factor_parent_hw(
+				dev, clk_name, pll_out_div, 0, 2, 7);
+	else
+		pll_post_out_div = devm_clk_hw_register_fixed_factor_parent_hw(
+				dev, clk_name, pll_out_div, 0, 1, 4);
+	if (IS_ERR(pll_post_out_div)) {
+		ret = PTR_ERR(pll_post_out_div);
+		goto fail;
+	}
+
+	/* in CPHY mode, pclk_mux will always have post_out_div as parent
+	 * don't register a pclk_mux clock and just use post_out_div instead
+	 */
+	if (pll_7nm->phy->cphy_mode) {
+		u32 data;
+
+		data = dsi_phy_read(pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1);
+		dsi_phy_write(pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1, data | 3);
+
+		phy_pll_out_dsi_parent = pll_post_out_div;
+	} else {
+		snprintf(clk_name, sizeof(clk_name), "dsi%d_pclk_mux", pll_7nm->phy->id);
+
+		hw = devm_clk_hw_register_mux_parent_hws(dev, clk_name,
+				((const struct clk_hw *[]){
+					pll_bit,
+					pll_by_2_bit,
+				}), 2, 0, pll_7nm->phy->base +
+					REG_DSI_7nm_PHY_CMN_CLK_CFG1,
+				0, 1, 0, NULL);
+		if (IS_ERR(hw)) {
+			ret = PTR_ERR(hw);
+			goto fail;
+		}
+
+		phy_pll_out_dsi_parent = hw;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "dsi%d_phy_pll_out_dsiclk", pll_7nm->phy->id);
+
+	/* PIX CLK DIV : DIV_CTRL_7_4*/
+	hw = devm_clk_hw_register_divider_parent_hw(dev, clk_name,
+			phy_pll_out_dsi_parent, 0,
+			pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG0,
+			4, 4, CLK_DIVIDER_ONE_BASED, &pll_7nm->postdiv_lock);
+	if (IS_ERR(hw)) {
+		ret = PTR_ERR(hw);
+		goto fail;
+	}
+
+	provided_clocks[DSI_PIXEL_PLL_CLK] = hw;
+
+	return 0;
+
+fail:
+
+	return ret;
+}
+
+static int dsi_pll_7nm_init(struct msm_dsi_phy *phy)
+{
+	struct platform_device *pdev = phy->pdev;
+	struct dsi_pll_7nm *pll_7nm;
+	int ret;
+
+	pll_7nm = devm_kzalloc(&pdev->dev, sizeof(*pll_7nm), GFP_KERNEL);
+	if (!pll_7nm)
+		return -ENOMEM;
+
+	DBG("DSI PLL%d", phy->id);
+
+	pll_7nm_list[phy->id] = pll_7nm;
+
+	spin_lock_init(&pll_7nm->postdiv_lock);
+
+	pll_7nm->phy = phy;
+
+	ret = pll_7nm_register(pll_7nm, phy->provided_clocks->hws);
+	if (ret) {
+		DRM_DEV_ERROR(&pdev->dev, "failed to register PLL: %d\n", ret);
+		return ret;
+	}
+
+	phy->vco_hw = &pll_7nm->clk_hw;
+
+	/* TODO: Remove this when we have proper display handover support */
+	msm_dsi_phy_pll_save_state(phy);
+
+	return 0;
+}
+
+static int dsi_phy_hw_v4_0_is_pll_on(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->base;
+	u32 data = 0;
+
+	data = dsi_phy_read(base + REG_DSI_7nm_PHY_CMN_PLL_CNTRL);
+	mb(); /* make sure read happened */
+
+	return (data & BIT(0));
+}
+
+static void dsi_phy_hw_v4_0_config_lpcdrx(struct msm_dsi_phy *phy, bool enable)
+{
+	void __iomem *lane_base = phy->lane_base;
+	int phy_lane_0 = 0;	/* TODO: Support all lane swap configs */
+
+	/*
+	 * LPRX and CDRX need to enabled only for physical data lane
+	 * corresponding to the logical data lane 0
+	 */
+	if (enable)
+		dsi_phy_write(lane_base +
+			      REG_DSI_7nm_PHY_LN_LPRX_CTRL(phy_lane_0), 0x3);
+	else
+		dsi_phy_write(lane_base +
+			      REG_DSI_7nm_PHY_LN_LPRX_CTRL(phy_lane_0), 0);
+}
+
+static void dsi_phy_hw_v4_0_lane_settings(struct msm_dsi_phy *phy)
+{
+	int i;
+	const u8 tx_dctrl_0[] = { 0x00, 0x00, 0x00, 0x04, 0x01 };
+	const u8 tx_dctrl_1[] = { 0x40, 0x40, 0x40, 0x46, 0x41 };
+	const u8 *tx_dctrl = tx_dctrl_0;
+	void __iomem *lane_base = phy->lane_base;
+
+	if (!(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_PRE_V4_1))
+		tx_dctrl = tx_dctrl_1;
+
+	/* Strength ctrl settings */
+	for (i = 0; i < 5; i++) {
+		/*
+		 * Disable LPRX and CDRX for all lanes. And later on, it will
+		 * be only enabled for the physical data lane corresponding
+		 * to the logical data lane 0
+		 */
+		dsi_phy_write(lane_base + REG_DSI_7nm_PHY_LN_LPRX_CTRL(i), 0);
+		dsi_phy_write(lane_base + REG_DSI_7nm_PHY_LN_PIN_SWAP(i), 0x0);
+	}
+
+	dsi_phy_hw_v4_0_config_lpcdrx(phy, true);
+
+	/* other settings */
+	for (i = 0; i < 5; i++) {
+		dsi_phy_write(lane_base + REG_DSI_7nm_PHY_LN_CFG0(i), 0x0);
+		dsi_phy_write(lane_base + REG_DSI_7nm_PHY_LN_CFG1(i), 0x0);
+		dsi_phy_write(lane_base + REG_DSI_7nm_PHY_LN_CFG2(i), i == 4 ? 0x8a : 0xa);
+		dsi_phy_write(lane_base + REG_DSI_7nm_PHY_LN_TX_DCTRL(i), tx_dctrl[i]);
+	}
+}
+
+static int dsi_7nm_phy_enable(struct msm_dsi_phy *phy,
+			      struct msm_dsi_phy_clk_request *clk_req)
+{
+	int ret;
+	u32 status;
+	u32 const delay_us = 5;
+	u32 const timeout_us = 1000;
+	struct msm_dsi_dphy_timing *timing = &phy->timing;
+	void __iomem *base = phy->base;
+	bool less_than_1500_mhz;
+	u32 vreg_ctrl_0, vreg_ctrl_1, lane_ctrl0;
+	u32 glbl_pemph_ctrl_0;
+	u32 glbl_str_swi_cal_sel_ctrl, glbl_hstx_str_ctrl_0;
+	u32 glbl_rescode_top_ctrl, glbl_rescode_bot_ctrl;
+	u32 data;
+
+	DBG("");
+
+	if (phy->cphy_mode)
+		ret = msm_dsi_cphy_timing_calc_v4(timing, clk_req);
+	else
+		ret = msm_dsi_dphy_timing_calc_v4(timing, clk_req);
+	if (ret) {
+		DRM_DEV_ERROR(&phy->pdev->dev,
+			      "%s: PHY timing calculation failed\n", __func__);
+		return -EINVAL;
+	}
+
+	if (dsi_phy_hw_v4_0_is_pll_on(phy))
+		pr_warn("PLL turned on before configuring PHY\n");
+
+	/* Request for REFGEN READY */
+	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_3) ||
+	    (phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2)) {
+		dsi_phy_write(phy->base + REG_DSI_7nm_PHY_CMN_GLBL_DIGTOP_SPARE10, 0x1);
+		udelay(500);
+	}
+
+	/* wait for REFGEN READY */
+	ret = readl_poll_timeout_atomic(base + REG_DSI_7nm_PHY_CMN_PHY_STATUS,
+					status, (status & BIT(0)),
+					delay_us, timeout_us);
+	if (ret) {
+		pr_err("Ref gen not ready. Aborting\n");
+		return -EINVAL;
+	}
+
+	/* TODO: CPHY enable path (this is for DPHY only) */
+
+	/* Alter PHY configurations if data rate less than 1.5GHZ*/
+	less_than_1500_mhz = (clk_req->bitclk_rate <= 1500000000);
+
+	glbl_str_swi_cal_sel_ctrl = 0x00;
+	if (phy->cphy_mode) {
+		vreg_ctrl_0 = 0x51;
+		vreg_ctrl_1 = 0x55;
+		glbl_hstx_str_ctrl_0 = 0x00;
+		glbl_pemph_ctrl_0 = 0x11;
+		lane_ctrl0 = 0x17;
+	} else {
+		vreg_ctrl_0 = less_than_1500_mhz ? 0x53 : 0x52;
+		vreg_ctrl_1 = 0x5c;
+		glbl_hstx_str_ctrl_0 = 0x88;
+		glbl_pemph_ctrl_0 = 0x00;
+		lane_ctrl0 = 0x1f;
+	}
+
+	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2)) {
+		if (phy->cphy_mode) {
+			vreg_ctrl_0 = 0x45;
+			vreg_ctrl_1 = 0x41;
+			glbl_rescode_top_ctrl = 0x00;
+			glbl_rescode_bot_ctrl = 0x00;
+		} else {
+			vreg_ctrl_0 = 0x44;
+			vreg_ctrl_1 = 0x19;
+			glbl_rescode_top_ctrl = less_than_1500_mhz ? 0x3c :  0x03;
+			glbl_rescode_bot_ctrl = less_than_1500_mhz ? 0x38 :  0x3c;
+		}
+	} else if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_3)) {
+		if (phy->cphy_mode) {
+			glbl_rescode_top_ctrl = less_than_1500_mhz ? 0x3d :  0x01;
+			glbl_rescode_bot_ctrl = less_than_1500_mhz ? 0x38 :  0x3b;
+		} else {
+			glbl_rescode_top_ctrl = less_than_1500_mhz ? 0x3d :  0x01;
+			glbl_rescode_bot_ctrl = less_than_1500_mhz ? 0x38 :  0x39;
+		}
+	} else if (phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_2) {
+		if (phy->cphy_mode) {
+			glbl_rescode_top_ctrl = less_than_1500_mhz ? 0x3d :  0x01;
+			glbl_rescode_bot_ctrl = less_than_1500_mhz ? 0x38 :  0x3b;
+		} else {
+			glbl_rescode_top_ctrl = less_than_1500_mhz ? 0x3c :  0x00;
+			glbl_rescode_bot_ctrl = less_than_1500_mhz ? 0x38 :  0x39;
+		}
+	} else if (phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_1) {
+		if (phy->cphy_mode) {
+			glbl_hstx_str_ctrl_0 = 0x88;
+			glbl_rescode_top_ctrl = 0x00;
+			glbl_rescode_bot_ctrl = 0x3c;
+		} else {
+			glbl_rescode_top_ctrl = less_than_1500_mhz ? 0x3d :  0x00;
+			glbl_rescode_bot_ctrl = less_than_1500_mhz ? 0x39 :  0x3c;
+		}
+	} else {
+		if (phy->cphy_mode) {
+			glbl_str_swi_cal_sel_ctrl = 0x03;
+			glbl_hstx_str_ctrl_0 = 0x66;
+		} else {
+			vreg_ctrl_0 = less_than_1500_mhz ? 0x5B : 0x59;
+			glbl_str_swi_cal_sel_ctrl = less_than_1500_mhz ? 0x03 : 0x00;
+			glbl_hstx_str_ctrl_0 = less_than_1500_mhz ? 0x66 : 0x88;
+		}
+		glbl_rescode_top_ctrl = 0x03;
+		glbl_rescode_bot_ctrl = 0x3c;
+	}
+
+	/* de-assert digital and pll power down */
+	data = BIT(6) | BIT(5);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_CTRL_0, data);
+
+	/* Assert PLL core reset */
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_PLL_CNTRL, 0x00);
+
+	/* turn off resync FIFO */
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL, 0x00);
+
+	/* program CMN_CTRL_4 for minor_ver 2 chipsets*/
+	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2) ||
+	    (dsi_phy_read(base + REG_DSI_7nm_PHY_CMN_REVISION_ID0) & (0xf0)) == 0x20)
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_CTRL_4, 0x04);
+
+	/* Configure PHY lane swap (TODO: we need to calculate this) */
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_LANE_CFG0, 0x21);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_LANE_CFG1, 0x84);
+
+	if (phy->cphy_mode)
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_GLBL_CTRL, BIT(6));
+
+	/* Enable LDO */
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_VREG_CTRL_0, vreg_ctrl_0);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_VREG_CTRL_1, vreg_ctrl_1);
+
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_CTRL_3, 0x00);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_GLBL_STR_SWI_CAL_SEL_CTRL,
+		      glbl_str_swi_cal_sel_ctrl);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_GLBL_HSTX_STR_CTRL_0,
+		      glbl_hstx_str_ctrl_0);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_GLBL_PEMPH_CTRL_0,
+		      glbl_pemph_ctrl_0);
+	if (phy->cphy_mode)
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_GLBL_PEMPH_CTRL_1, 0x01);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_GLBL_RESCODE_OFFSET_TOP_CTRL,
+		      glbl_rescode_top_ctrl);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_GLBL_RESCODE_OFFSET_BOT_CTRL,
+		      glbl_rescode_bot_ctrl);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_GLBL_LPTX_STR_CTRL, 0x55);
+
+	/* Remove power down from all blocks */
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_CTRL_0, 0x7f);
+
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_LANE_CTRL0, lane_ctrl0);
+
+	/* Select full-rate mode */
+	if (!phy->cphy_mode)
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_CTRL_2, 0x40);
+
+	ret = dsi_7nm_set_usecase(phy);
+	if (ret) {
+		DRM_DEV_ERROR(&phy->pdev->dev, "%s: set pll usecase failed, %d\n",
+			__func__, ret);
+		return ret;
+	}
+
+	/* DSI PHY timings */
+	if (phy->cphy_mode) {
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_0, 0x00);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_4, timing->hs_exit);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_5,
+			      timing->shared_timings.clk_pre);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_6, timing->clk_prepare);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_7,
+			      timing->shared_timings.clk_post);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_8, timing->hs_rqst);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_9, 0x02);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_10, 0x04);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_11, 0x00);
+	} else {
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_0, 0x00);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_1, timing->clk_zero);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_2, timing->clk_prepare);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_3, timing->clk_trail);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_4, timing->hs_exit);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_5, timing->hs_zero);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_6, timing->hs_prepare);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_7, timing->hs_trail);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_8, timing->hs_rqst);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_9, 0x02);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_10, 0x04);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_11, 0x00);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_12,
+			      timing->shared_timings.clk_pre);
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_TIMING_CTRL_13,
+			      timing->shared_timings.clk_post);
+	}
+
+	/* DSI lane settings */
+	dsi_phy_hw_v4_0_lane_settings(phy);
+
+	DBG("DSI%d PHY enabled", phy->id);
+
+	return 0;
+}
+
+static bool dsi_7nm_set_continuous_clock(struct msm_dsi_phy *phy, bool enable)
+{
+	void __iomem *base = phy->base;
+	u32 data;
+
+	data = dsi_phy_read(base + REG_DSI_7nm_PHY_CMN_LANE_CTRL1);
+	if (enable)
+		data |= BIT(5) | BIT(6);
+	else
+		data &= ~(BIT(5) | BIT(6));
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_LANE_CTRL1, data);
+
+	return enable;
+}
+
+static void dsi_7nm_phy_disable(struct msm_dsi_phy *phy)
+{
+	void __iomem *base = phy->base;
+	u32 data;
+
+	DBG("");
+
+	if (dsi_phy_hw_v4_0_is_pll_on(phy))
+		pr_warn("Turning OFF PHY while PLL is on\n");
+
+	dsi_phy_hw_v4_0_config_lpcdrx(phy, false);
+
+	/* Turn off REFGEN Vote */
+	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_3) ||
+	    (phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2)) {
+		dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_GLBL_DIGTOP_SPARE10, 0x0);
+		wmb();
+		/* Delay to ensure HW removes vote before PHY shut down */
+		udelay(2);
+	}
+
+	data = dsi_phy_read(base + REG_DSI_7nm_PHY_CMN_CTRL_0);
+
+	/* disable all lanes */
+	data &= ~0x1F;
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_CTRL_0, data);
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_LANE_CTRL0, 0);
+
+	/* Turn off all PHY blocks */
+	dsi_phy_write(base + REG_DSI_7nm_PHY_CMN_CTRL_0, 0x00);
+	/* make sure phy is turned off */
+	wmb();
+
+	DBG("DSI%d PHY disabled", phy->id);
+}
+
+static const struct regulator_bulk_data dsi_phy_7nm_36mA_regulators[] = {
+	{ .supply = "vdds", .init_load_uA = 36000 },
+};
+
+static const struct regulator_bulk_data dsi_phy_7nm_37750uA_regulators[] = {
+	{ .supply = "vdds", .init_load_uA = 37550 },
+};
+
+static const struct regulator_bulk_data dsi_phy_7nm_115000uA_regulators[] = {
+	{ .supply = "vdds", .init_load_uA = 115000 },
+};
+
+static const struct regulator_bulk_data dsi_phy_7nm_98000uA_regulators[] = {
+	{ .supply = "vdds", .init_load_uA = 98000 },
+};
+
+static const struct regulator_bulk_data dsi_phy_7nm_97800uA_regulators[] = {
+	{ .supply = "vdds", .init_load_uA = 97800 },
+};
+
+static const struct regulator_bulk_data dsi_phy_7nm_98400uA_regulators[] = {
+	{ .supply = "vdds", .init_load_uA = 98400 },
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_7nm_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_7nm_36mA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_7nm_36mA_regulators),
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+		.set_continuous_clock = dsi_7nm_set_continuous_clock,
+	},
+	.min_pll_rate = 600000000UL,
+#ifdef CONFIG_64BIT
+	.max_pll_rate = 5000000000UL,
+#else
+	.max_pll_rate = ULONG_MAX,
+#endif
+	.io_start = { 0xae94400, 0xae96400 },
+	.num_dsi_phy = 2,
+	.quirks = DSI_PHY_7NM_QUIRK_V4_1,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_7nm_6375_cfgs = {
+	.has_phy_lane = true,
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+	},
+	.min_pll_rate = 600000000UL,
+#ifdef CONFIG_64BIT
+	.max_pll_rate = 5000000000ULL,
+#else
+	.max_pll_rate = ULONG_MAX,
+#endif
+	.io_start = { 0x5e94400 },
+	.num_dsi_phy = 1,
+	.quirks = DSI_PHY_7NM_QUIRK_V4_1,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_7nm_8150_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_7nm_36mA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_7nm_36mA_regulators),
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+		.set_continuous_clock = dsi_7nm_set_continuous_clock,
+	},
+	.min_pll_rate = 1000000000UL,
+	.max_pll_rate = 3500000000UL,
+	.io_start = { 0xae94400, 0xae96400 },
+	.num_dsi_phy = 2,
+	.quirks = DSI_PHY_7NM_QUIRK_PRE_V4_1,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_7nm_7280_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_7nm_37750uA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_7nm_37750uA_regulators),
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+	},
+	.min_pll_rate = 600000000UL,
+#ifdef CONFIG_64BIT
+	.max_pll_rate = 5000000000ULL,
+#else
+	.max_pll_rate = ULONG_MAX,
+#endif
+	.io_start = { 0xae94400 },
+	.num_dsi_phy = 1,
+	.quirks = DSI_PHY_7NM_QUIRK_V4_1,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_5nm_8350_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_7nm_37750uA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_7nm_37750uA_regulators),
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+		.set_continuous_clock = dsi_7nm_set_continuous_clock,
+	},
+	.min_pll_rate = 600000000UL,
+#ifdef CONFIG_64BIT
+	.max_pll_rate = 5000000000UL,
+#else
+	.max_pll_rate = ULONG_MAX,
+#endif
+	.io_start = { 0xae94400, 0xae96400 },
+	.num_dsi_phy = 2,
+	.quirks = DSI_PHY_7NM_QUIRK_V4_2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_5nm_8775_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_7nm_115000uA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_7nm_115000uA_regulators),
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+		.set_continuous_clock = dsi_7nm_set_continuous_clock,
+	},
+	.min_pll_rate = 600000000UL,
+#ifdef CONFIG_64BIT
+	.max_pll_rate = 5000000000UL,
+#else
+	.max_pll_rate = ULONG_MAX,
+#endif
+	.io_start = { 0xae94400, 0xae96400 },
+	.num_dsi_phy = 2,
+	.quirks = DSI_PHY_7NM_QUIRK_V4_2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_5nm_8450_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_7nm_97800uA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_7nm_97800uA_regulators),
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+		.set_continuous_clock = dsi_7nm_set_continuous_clock,
+	},
+	.min_pll_rate = 600000000UL,
+#ifdef CONFIG_64BIT
+	.max_pll_rate = 5000000000UL,
+#else
+	.max_pll_rate = ULONG_MAX,
+#endif
+	.io_start = { 0xae94400, 0xae96400 },
+	.num_dsi_phy = 2,
+	.quirks = DSI_PHY_7NM_QUIRK_V4_3,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_4nm_8550_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_7nm_98400uA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_7nm_98400uA_regulators),
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+		.set_continuous_clock = dsi_7nm_set_continuous_clock,
+	},
+	.min_pll_rate = 600000000UL,
+#ifdef CONFIG_64BIT
+	.max_pll_rate = 5000000000UL,
+#else
+	.max_pll_rate = ULONG_MAX,
+#endif
+	.io_start = { 0xae95000, 0xae97000 },
+	.num_dsi_phy = 2,
+	.quirks = DSI_PHY_7NM_QUIRK_V5_2,
+};
+
+const struct msm_dsi_phy_cfg dsi_phy_4nm_8650_cfgs = {
+	.has_phy_lane = true,
+	.regulator_data = dsi_phy_7nm_98000uA_regulators,
+	.num_regulators = ARRAY_SIZE(dsi_phy_7nm_98000uA_regulators),
+	.ops = {
+		.enable = dsi_7nm_phy_enable,
+		.disable = dsi_7nm_phy_disable,
+		.pll_init = dsi_pll_7nm_init,
+		.save_pll_state = dsi_7nm_pll_save_state,
+		.restore_pll_state = dsi_7nm_pll_restore_state,
+		.set_continuous_clock = dsi_7nm_set_continuous_clock,
+	},
+	.min_pll_rate = 600000000UL,
+#ifdef CONFIG_64BIT
+	.max_pll_rate = 5000000000UL,
+#else
+	.max_pll_rate = ULONG_MAX,
+#endif
+	.io_start = { 0xae95000, 0xae97000 },
+	.num_dsi_phy = 2,
+	.quirks = DSI_PHY_7NM_QUIRK_V5_2,
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi.c
@@ -0,0 +1,580 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/of_irq.h>
+#include <linux/of_gpio.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+
+#include <drm/drm_bridge_connector.h>
+#include <drm/drm_of.h>
+
+#include <sound/hdmi-codec.h>
+#include "hdmi.h"
+
+void msm_hdmi_set_mode(struct hdmi *hdmi, bool power_on)
+{
+	uint32_t ctrl = 0;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	if (power_on) {
+		ctrl |= HDMI_CTRL_ENABLE;
+		if (!hdmi->hdmi_mode) {
+			ctrl |= HDMI_CTRL_HDMI;
+			hdmi_write(hdmi, REG_HDMI_CTRL, ctrl);
+			ctrl &= ~HDMI_CTRL_HDMI;
+		} else {
+			ctrl |= HDMI_CTRL_HDMI;
+		}
+	} else {
+		ctrl = HDMI_CTRL_HDMI;
+	}
+
+	hdmi_write(hdmi, REG_HDMI_CTRL, ctrl);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+	DBG("HDMI Core: %s, HDMI_CTRL=0x%08x",
+			power_on ? "Enable" : "Disable", ctrl);
+}
+
+static irqreturn_t msm_hdmi_irq(int irq, void *dev_id)
+{
+	struct hdmi *hdmi = dev_id;
+
+	/* Process HPD: */
+	msm_hdmi_hpd_irq(hdmi->bridge);
+
+	/* Process DDC: */
+	msm_hdmi_i2c_irq(hdmi->i2c);
+
+	/* Process HDCP: */
+	if (hdmi->hdcp_ctrl)
+		msm_hdmi_hdcp_irq(hdmi->hdcp_ctrl);
+
+	/* TODO audio.. */
+
+	return IRQ_HANDLED;
+}
+
+static void msm_hdmi_destroy(struct hdmi *hdmi)
+{
+	/*
+	 * at this point, hpd has been disabled,
+	 * after flush workq, it's safe to deinit hdcp
+	 */
+	if (hdmi->workq)
+		destroy_workqueue(hdmi->workq);
+	msm_hdmi_hdcp_destroy(hdmi);
+
+	if (hdmi->i2c)
+		msm_hdmi_i2c_destroy(hdmi->i2c);
+}
+
+static void msm_hdmi_put_phy(struct hdmi *hdmi)
+{
+	if (hdmi->phy_dev) {
+		put_device(hdmi->phy_dev);
+		hdmi->phy = NULL;
+		hdmi->phy_dev = NULL;
+	}
+}
+
+static int msm_hdmi_get_phy(struct hdmi *hdmi)
+{
+	struct platform_device *pdev = hdmi->pdev;
+	struct platform_device *phy_pdev;
+	struct device_node *phy_node;
+
+	phy_node = of_parse_phandle(pdev->dev.of_node, "phys", 0);
+	if (!phy_node) {
+		DRM_DEV_ERROR(&pdev->dev, "cannot find phy device\n");
+		return -ENXIO;
+	}
+
+	phy_pdev = of_find_device_by_node(phy_node);
+	of_node_put(phy_node);
+
+	if (!phy_pdev)
+		return dev_err_probe(&pdev->dev, -EPROBE_DEFER, "phy driver is not ready\n");
+
+	hdmi->phy = platform_get_drvdata(phy_pdev);
+	if (!hdmi->phy) {
+		put_device(&phy_pdev->dev);
+		return dev_err_probe(&pdev->dev, -EPROBE_DEFER, "phy driver is not ready\n");
+	}
+
+	hdmi->phy_dev = &phy_pdev->dev;
+
+	return 0;
+}
+
+/* construct hdmi at bind/probe time, grab all the resources.  If
+ * we are to EPROBE_DEFER we want to do it here, rather than later
+ * at modeset_init() time
+ */
+static int msm_hdmi_init(struct hdmi *hdmi)
+{
+	struct platform_device *pdev = hdmi->pdev;
+	int ret;
+
+	hdmi->workq = alloc_ordered_workqueue("msm_hdmi", 0);
+	if (!hdmi->workq) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	hdmi->i2c = msm_hdmi_i2c_init(hdmi);
+	if (IS_ERR(hdmi->i2c)) {
+		ret = PTR_ERR(hdmi->i2c);
+		DRM_DEV_ERROR(&pdev->dev, "failed to get i2c: %d\n", ret);
+		hdmi->i2c = NULL;
+		goto fail;
+	}
+
+	hdmi->hdcp_ctrl = msm_hdmi_hdcp_init(hdmi);
+	if (IS_ERR(hdmi->hdcp_ctrl)) {
+		dev_warn(&pdev->dev, "failed to init hdcp: disabled\n");
+		hdmi->hdcp_ctrl = NULL;
+	}
+
+	return 0;
+
+fail:
+	msm_hdmi_destroy(hdmi);
+
+	return ret;
+}
+
+/* Second part of initialization, the drm/kms level modeset_init,
+ * constructs/initializes mode objects, etc, is called from master
+ * driver (not hdmi sub-device's probe/bind!)
+ *
+ * Any resource (regulator/clk/etc) which could be missing at boot
+ * should be handled in msm_hdmi_init() so that failure happens from
+ * hdmi sub-device's probe.
+ */
+int msm_hdmi_modeset_init(struct hdmi *hdmi,
+		struct drm_device *dev, struct drm_encoder *encoder)
+{
+	int ret;
+
+	hdmi->dev = dev;
+	hdmi->encoder = encoder;
+
+	hdmi_audio_infoframe_init(&hdmi->audio.infoframe);
+
+	ret = msm_hdmi_bridge_init(hdmi);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "failed to create HDMI bridge: %d\n", ret);
+		goto fail;
+	}
+
+	if (hdmi->next_bridge) {
+		ret = drm_bridge_attach(hdmi->encoder, hdmi->next_bridge, hdmi->bridge,
+					DRM_BRIDGE_ATTACH_NO_CONNECTOR);
+		if (ret) {
+			DRM_DEV_ERROR(dev->dev, "failed to attach next HDMI bridge: %d\n", ret);
+			goto fail;
+		}
+	}
+
+	hdmi->connector = drm_bridge_connector_init(hdmi->dev, encoder);
+	if (IS_ERR(hdmi->connector)) {
+		ret = PTR_ERR(hdmi->connector);
+		DRM_DEV_ERROR(dev->dev, "failed to create HDMI connector: %d\n", ret);
+		hdmi->connector = NULL;
+		goto fail;
+	}
+
+	drm_connector_attach_encoder(hdmi->connector, hdmi->encoder);
+
+	ret = devm_request_irq(dev->dev, hdmi->irq,
+			msm_hdmi_irq, IRQF_TRIGGER_HIGH,
+			"hdmi_isr", hdmi);
+	if (ret < 0) {
+		DRM_DEV_ERROR(dev->dev, "failed to request IRQ%u: %d\n",
+				hdmi->irq, ret);
+		goto fail;
+	}
+
+	ret = msm_hdmi_hpd_enable(hdmi->bridge);
+	if (ret < 0) {
+		DRM_DEV_ERROR(&hdmi->pdev->dev, "failed to enable HPD: %d\n", ret);
+		goto fail;
+	}
+
+	return 0;
+
+fail:
+	if (hdmi->connector) {
+		hdmi->connector->funcs->destroy(hdmi->connector);
+		hdmi->connector = NULL;
+	}
+
+	return ret;
+}
+
+/*
+ * The hdmi device:
+ */
+
+#define HDMI_CFG(item, entry) \
+	.item ## _names = item ##_names_ ## entry, \
+	.item ## _cnt   = ARRAY_SIZE(item ## _names_ ## entry)
+
+static const char *hpd_reg_names_8960[] = {"core-vdda"};
+static const char *hpd_clk_names_8960[] = {"core", "master_iface", "slave_iface"};
+
+static const struct hdmi_platform_config hdmi_tx_8960_config = {
+		HDMI_CFG(hpd_reg, 8960),
+		HDMI_CFG(hpd_clk, 8960),
+};
+
+static const char *pwr_reg_names_8x74[] = {"core-vdda", "core-vcc"};
+static const char *pwr_clk_names_8x74[] = {"extp", "alt_iface"};
+static const char *hpd_clk_names_8x74[] = {"iface", "core", "mdp_core"};
+static unsigned long hpd_clk_freq_8x74[] = {0, 19200000, 0};
+
+static const struct hdmi_platform_config hdmi_tx_8974_config = {
+		HDMI_CFG(pwr_reg, 8x74),
+		HDMI_CFG(pwr_clk, 8x74),
+		HDMI_CFG(hpd_clk, 8x74),
+		.hpd_freq      = hpd_clk_freq_8x74,
+};
+
+/*
+ * HDMI audio codec callbacks
+ */
+static int msm_hdmi_audio_hw_params(struct device *dev, void *data,
+				    struct hdmi_codec_daifmt *daifmt,
+				    struct hdmi_codec_params *params)
+{
+	struct hdmi *hdmi = dev_get_drvdata(dev);
+	unsigned int chan;
+	unsigned int channel_allocation = 0;
+	unsigned int rate;
+	unsigned int level_shift  = 0; /* 0dB */
+	bool down_mix = false;
+
+	DRM_DEV_DEBUG(dev, "%u Hz, %d bit, %d channels\n", params->sample_rate,
+		 params->sample_width, params->cea.channels);
+
+	switch (params->cea.channels) {
+	case 2:
+		/* FR and FL speakers */
+		channel_allocation  = 0;
+		chan = MSM_HDMI_AUDIO_CHANNEL_2;
+		break;
+	case 4:
+		/* FC, LFE, FR and FL speakers */
+		channel_allocation  = 0x3;
+		chan = MSM_HDMI_AUDIO_CHANNEL_4;
+		break;
+	case 6:
+		/* RR, RL, FC, LFE, FR and FL speakers */
+		channel_allocation  = 0x0B;
+		chan = MSM_HDMI_AUDIO_CHANNEL_6;
+		break;
+	case 8:
+		/* FRC, FLC, RR, RL, FC, LFE, FR and FL speakers */
+		channel_allocation  = 0x1F;
+		chan = MSM_HDMI_AUDIO_CHANNEL_8;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	switch (params->sample_rate) {
+	case 32000:
+		rate = HDMI_SAMPLE_RATE_32KHZ;
+		break;
+	case 44100:
+		rate = HDMI_SAMPLE_RATE_44_1KHZ;
+		break;
+	case 48000:
+		rate = HDMI_SAMPLE_RATE_48KHZ;
+		break;
+	case 88200:
+		rate = HDMI_SAMPLE_RATE_88_2KHZ;
+		break;
+	case 96000:
+		rate = HDMI_SAMPLE_RATE_96KHZ;
+		break;
+	case 176400:
+		rate = HDMI_SAMPLE_RATE_176_4KHZ;
+		break;
+	case 192000:
+		rate = HDMI_SAMPLE_RATE_192KHZ;
+		break;
+	default:
+		DRM_DEV_ERROR(dev, "rate[%d] not supported!\n",
+			params->sample_rate);
+		return -EINVAL;
+	}
+
+	msm_hdmi_audio_set_sample_rate(hdmi, rate);
+	msm_hdmi_audio_info_setup(hdmi, 1, chan, channel_allocation,
+			      level_shift, down_mix);
+
+	return 0;
+}
+
+static void msm_hdmi_audio_shutdown(struct device *dev, void *data)
+{
+	struct hdmi *hdmi = dev_get_drvdata(dev);
+
+	msm_hdmi_audio_info_setup(hdmi, 0, 0, 0, 0, 0);
+}
+
+static const struct hdmi_codec_ops msm_hdmi_audio_codec_ops = {
+	.hw_params = msm_hdmi_audio_hw_params,
+	.audio_shutdown = msm_hdmi_audio_shutdown,
+};
+
+static struct hdmi_codec_pdata codec_data = {
+	.ops = &msm_hdmi_audio_codec_ops,
+	.max_i2s_channels = 8,
+	.i2s = 1,
+};
+
+static int msm_hdmi_register_audio_driver(struct hdmi *hdmi, struct device *dev)
+{
+	hdmi->audio_pdev = platform_device_register_data(dev,
+							 HDMI_CODEC_DRV_NAME,
+							 PLATFORM_DEVID_AUTO,
+							 &codec_data,
+							 sizeof(codec_data));
+	return PTR_ERR_OR_ZERO(hdmi->audio_pdev);
+}
+
+static int msm_hdmi_bind(struct device *dev, struct device *master, void *data)
+{
+	struct msm_drm_private *priv = dev_get_drvdata(master);
+	struct hdmi *hdmi = dev_get_drvdata(dev);
+	int err;
+
+	err = msm_hdmi_init(hdmi);
+	if (err)
+		return err;
+	priv->hdmi = hdmi;
+
+	err = msm_hdmi_register_audio_driver(hdmi, dev);
+	if (err) {
+		DRM_ERROR("Failed to attach an audio codec %d\n", err);
+		hdmi->audio_pdev = NULL;
+	}
+
+	return 0;
+}
+
+static void msm_hdmi_unbind(struct device *dev, struct device *master,
+		void *data)
+{
+	struct msm_drm_private *priv = dev_get_drvdata(master);
+
+	if (priv->hdmi) {
+		if (priv->hdmi->audio_pdev)
+			platform_device_unregister(priv->hdmi->audio_pdev);
+
+		if (priv->hdmi->bridge)
+			msm_hdmi_hpd_disable(priv->hdmi);
+
+		msm_hdmi_destroy(priv->hdmi);
+		priv->hdmi = NULL;
+	}
+}
+
+static const struct component_ops msm_hdmi_ops = {
+		.bind   = msm_hdmi_bind,
+		.unbind = msm_hdmi_unbind,
+};
+
+static int msm_hdmi_dev_probe(struct platform_device *pdev)
+{
+	const struct hdmi_platform_config *config;
+	struct device *dev = &pdev->dev;
+	struct hdmi *hdmi;
+	struct resource *res;
+	int i, ret;
+
+	config = of_device_get_match_data(dev);
+	if (!config)
+		return -EINVAL;
+
+	hdmi = devm_kzalloc(&pdev->dev, sizeof(*hdmi), GFP_KERNEL);
+	if (!hdmi)
+		return -ENOMEM;
+
+	hdmi->pdev = pdev;
+	hdmi->config = config;
+	spin_lock_init(&hdmi->reg_lock);
+
+	ret = drm_of_find_panel_or_bridge(pdev->dev.of_node, 1, 0, NULL, &hdmi->next_bridge);
+	if (ret && ret != -ENODEV)
+		return ret;
+
+	hdmi->mmio = msm_ioremap(pdev, "core_physical");
+	if (IS_ERR(hdmi->mmio))
+		return PTR_ERR(hdmi->mmio);
+
+	/* HDCP needs physical address of hdmi register */
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+		"core_physical");
+	if (!res)
+		return -EINVAL;
+	hdmi->mmio_phy_addr = res->start;
+
+	hdmi->qfprom_mmio = msm_ioremap(pdev, "qfprom_physical");
+	if (IS_ERR(hdmi->qfprom_mmio)) {
+		DRM_DEV_INFO(&pdev->dev, "can't find qfprom resource\n");
+		hdmi->qfprom_mmio = NULL;
+	}
+
+	hdmi->irq = platform_get_irq(pdev, 0);
+	if (hdmi->irq < 0)
+		return hdmi->irq;
+
+	hdmi->hpd_regs = devm_kcalloc(&pdev->dev,
+				      config->hpd_reg_cnt,
+				      sizeof(hdmi->hpd_regs[0]),
+				      GFP_KERNEL);
+	if (!hdmi->hpd_regs)
+		return -ENOMEM;
+
+	for (i = 0; i < config->hpd_reg_cnt; i++)
+		hdmi->hpd_regs[i].supply = config->hpd_reg_names[i];
+
+	ret = devm_regulator_bulk_get(&pdev->dev, config->hpd_reg_cnt, hdmi->hpd_regs);
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to get hpd regulators\n");
+
+	hdmi->pwr_regs = devm_kcalloc(&pdev->dev,
+				      config->pwr_reg_cnt,
+				      sizeof(hdmi->pwr_regs[0]),
+				      GFP_KERNEL);
+	if (!hdmi->pwr_regs)
+		return -ENOMEM;
+
+	for (i = 0; i < config->pwr_reg_cnt; i++)
+		hdmi->pwr_regs[i].supply = config->pwr_reg_names[i];
+
+	ret = devm_regulator_bulk_get(&pdev->dev, config->pwr_reg_cnt, hdmi->pwr_regs);
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to get pwr regulators\n");
+
+	hdmi->hpd_clks = devm_kcalloc(&pdev->dev,
+				      config->hpd_clk_cnt,
+				      sizeof(hdmi->hpd_clks[0]),
+				      GFP_KERNEL);
+	if (!hdmi->hpd_clks)
+		return -ENOMEM;
+
+	for (i = 0; i < config->hpd_clk_cnt; i++) {
+		struct clk *clk;
+
+		clk = msm_clk_get(pdev, config->hpd_clk_names[i]);
+		if (IS_ERR(clk))
+			return dev_err_probe(dev, PTR_ERR(clk),
+					     "failed to get hpd clk: %s\n",
+					     config->hpd_clk_names[i]);
+
+		hdmi->hpd_clks[i] = clk;
+	}
+
+	hdmi->pwr_clks = devm_kcalloc(&pdev->dev,
+				      config->pwr_clk_cnt,
+				      sizeof(hdmi->pwr_clks[0]),
+				      GFP_KERNEL);
+	if (!hdmi->pwr_clks)
+		return -ENOMEM;
+
+	for (i = 0; i < config->pwr_clk_cnt; i++) {
+		struct clk *clk;
+
+		clk = msm_clk_get(pdev, config->pwr_clk_names[i]);
+		if (IS_ERR(clk))
+			return dev_err_probe(dev, PTR_ERR(clk),
+					     "failed to get pwr clk: %s\n",
+					     config->pwr_clk_names[i]);
+
+		hdmi->pwr_clks[i] = clk;
+	}
+
+	hdmi->hpd_gpiod = devm_gpiod_get_optional(&pdev->dev, "hpd", GPIOD_IN);
+	/* This will catch e.g. -EPROBE_DEFER */
+	if (IS_ERR(hdmi->hpd_gpiod))
+		return dev_err_probe(dev, PTR_ERR(hdmi->hpd_gpiod),
+				     "failed to get hpd gpio\n");
+
+	if (!hdmi->hpd_gpiod)
+		DBG("failed to get HPD gpio");
+
+	if (hdmi->hpd_gpiod)
+		gpiod_set_consumer_name(hdmi->hpd_gpiod, "HDMI_HPD");
+
+	ret = msm_hdmi_get_phy(hdmi);
+	if (ret) {
+		DRM_DEV_ERROR(&pdev->dev, "failed to get phy\n");
+		return ret;
+	}
+
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		goto err_put_phy;
+
+	platform_set_drvdata(pdev, hdmi);
+
+	ret = component_add(&pdev->dev, &msm_hdmi_ops);
+	if (ret)
+		goto err_put_phy;
+
+	return 0;
+
+err_put_phy:
+	msm_hdmi_put_phy(hdmi);
+	return ret;
+}
+
+static void msm_hdmi_dev_remove(struct platform_device *pdev)
+{
+	struct hdmi *hdmi = dev_get_drvdata(&pdev->dev);
+
+	component_del(&pdev->dev, &msm_hdmi_ops);
+
+	msm_hdmi_put_phy(hdmi);
+}
+
+static const struct of_device_id msm_hdmi_dt_match[] = {
+	{ .compatible = "qcom,hdmi-tx-8996", .data = &hdmi_tx_8974_config },
+	{ .compatible = "qcom,hdmi-tx-8994", .data = &hdmi_tx_8974_config },
+	{ .compatible = "qcom,hdmi-tx-8084", .data = &hdmi_tx_8974_config },
+	{ .compatible = "qcom,hdmi-tx-8974", .data = &hdmi_tx_8974_config },
+	{ .compatible = "qcom,hdmi-tx-8960", .data = &hdmi_tx_8960_config },
+	{ .compatible = "qcom,hdmi-tx-8660", .data = &hdmi_tx_8960_config },
+	{}
+};
+
+static struct platform_driver msm_hdmi_driver = {
+	.probe = msm_hdmi_dev_probe,
+	.remove_new = msm_hdmi_dev_remove,
+	.driver = {
+		.name = "hdmi_msm",
+		.of_match_table = msm_hdmi_dt_match,
+	},
+};
+
+void __init msm_hdmi_register(void)
+{
+	msm_hdmi_phy_driver_register();
+	platform_driver_register(&msm_hdmi_driver);
+}
+
+void __exit msm_hdmi_unregister(void)
+{
+	platform_driver_unregister(&msm_hdmi_driver);
+	msm_hdmi_phy_driver_unregister();
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi.h
@@ -0,0 +1,271 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __HDMI_CONNECTOR_H__
+#define __HDMI_CONNECTOR_H__
+
+#include <linux/i2c.h>
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/gpio/consumer.h>
+#include <linux/hdmi.h>
+
+#include <drm/drm_bridge.h>
+
+#include "msm_drv.h"
+#include "hdmi.xml.h"
+
+struct hdmi_phy;
+struct hdmi_platform_config;
+
+struct hdmi_audio {
+	bool enabled;
+	struct hdmi_audio_infoframe infoframe;
+	int rate;
+};
+
+struct hdmi_hdcp_ctrl;
+
+struct hdmi {
+	struct drm_device *dev;
+	struct platform_device *pdev;
+	struct platform_device *audio_pdev;
+
+	const struct hdmi_platform_config *config;
+
+	/* audio state: */
+	struct hdmi_audio audio;
+
+	/* video state: */
+	bool power_on;
+	unsigned long int pixclock;
+
+	void __iomem *mmio;
+	void __iomem *qfprom_mmio;
+	phys_addr_t mmio_phy_addr;
+
+	struct regulator_bulk_data *hpd_regs;
+	struct regulator_bulk_data *pwr_regs;
+	struct clk **hpd_clks;
+	struct clk **pwr_clks;
+
+	struct gpio_desc *hpd_gpiod;
+
+	struct hdmi_phy *phy;
+	struct device *phy_dev;
+
+	struct i2c_adapter *i2c;
+	struct drm_connector *connector;
+	struct drm_bridge *bridge;
+
+	struct drm_bridge *next_bridge;
+
+	/* the encoder we are hooked to (outside of hdmi block) */
+	struct drm_encoder *encoder;
+
+	bool hdmi_mode;               /* are we in hdmi mode? */
+
+	int irq;
+	struct workqueue_struct *workq;
+
+	struct hdmi_hdcp_ctrl *hdcp_ctrl;
+
+	/*
+	* spinlock to protect registers shared by different execution
+	* REG_HDMI_CTRL
+	* REG_HDMI_DDC_ARBITRATION
+	* REG_HDMI_HDCP_INT_CTRL
+	* REG_HDMI_HPD_CTRL
+	*/
+	spinlock_t reg_lock;
+};
+
+/* platform config data (ie. from DT, or pdata) */
+struct hdmi_platform_config {
+	/* regulators that need to be on for hpd: */
+	const char **hpd_reg_names;
+	int hpd_reg_cnt;
+
+	/* regulators that need to be on for screen pwr: */
+	const char **pwr_reg_names;
+	int pwr_reg_cnt;
+
+	/* clks that need to be on for hpd: */
+	const char **hpd_clk_names;
+	const long unsigned *hpd_freq;
+	int hpd_clk_cnt;
+
+	/* clks that need to be on for screen pwr (ie pixel clk): */
+	const char **pwr_clk_names;
+	int pwr_clk_cnt;
+};
+
+struct hdmi_bridge {
+	struct drm_bridge base;
+	struct hdmi *hdmi;
+	struct work_struct hpd_work;
+};
+#define to_hdmi_bridge(x) container_of(x, struct hdmi_bridge, base)
+
+void msm_hdmi_set_mode(struct hdmi *hdmi, bool power_on);
+
+static inline void hdmi_write(struct hdmi *hdmi, u32 reg, u32 data)
+{
+	msm_writel(data, hdmi->mmio + reg);
+}
+
+static inline u32 hdmi_read(struct hdmi *hdmi, u32 reg)
+{
+	return msm_readl(hdmi->mmio + reg);
+}
+
+static inline u32 hdmi_qfprom_read(struct hdmi *hdmi, u32 reg)
+{
+	return msm_readl(hdmi->qfprom_mmio + reg);
+}
+
+/*
+ * hdmi phy:
+ */
+
+enum hdmi_phy_type {
+	MSM_HDMI_PHY_8x60,
+	MSM_HDMI_PHY_8960,
+	MSM_HDMI_PHY_8x74,
+	MSM_HDMI_PHY_8996,
+	MSM_HDMI_PHY_8998,
+	MSM_HDMI_PHY_MAX,
+};
+
+struct hdmi_phy_cfg {
+	enum hdmi_phy_type type;
+	void (*powerup)(struct hdmi_phy *phy, unsigned long int pixclock);
+	void (*powerdown)(struct hdmi_phy *phy);
+	const char * const *reg_names;
+	int num_regs;
+	const char * const *clk_names;
+	int num_clks;
+};
+
+extern const struct hdmi_phy_cfg msm_hdmi_phy_8x60_cfg;
+extern const struct hdmi_phy_cfg msm_hdmi_phy_8960_cfg;
+extern const struct hdmi_phy_cfg msm_hdmi_phy_8x74_cfg;
+extern const struct hdmi_phy_cfg msm_hdmi_phy_8996_cfg;
+extern const struct hdmi_phy_cfg msm_hdmi_phy_8998_cfg;
+
+struct hdmi_phy {
+	struct platform_device *pdev;
+	void __iomem *mmio;
+	struct hdmi_phy_cfg *cfg;
+	const struct hdmi_phy_funcs *funcs;
+	struct regulator_bulk_data *regs;
+	struct clk **clks;
+};
+
+static inline void hdmi_phy_write(struct hdmi_phy *phy, u32 reg, u32 data)
+{
+	msm_writel(data, phy->mmio + reg);
+}
+
+static inline u32 hdmi_phy_read(struct hdmi_phy *phy, u32 reg)
+{
+	return msm_readl(phy->mmio + reg);
+}
+
+int msm_hdmi_phy_resource_enable(struct hdmi_phy *phy);
+void msm_hdmi_phy_resource_disable(struct hdmi_phy *phy);
+void msm_hdmi_phy_powerup(struct hdmi_phy *phy, unsigned long int pixclock);
+void msm_hdmi_phy_powerdown(struct hdmi_phy *phy);
+void __init msm_hdmi_phy_driver_register(void);
+void __exit msm_hdmi_phy_driver_unregister(void);
+
+#ifdef CONFIG_COMMON_CLK
+int msm_hdmi_pll_8960_init(struct platform_device *pdev);
+int msm_hdmi_pll_8996_init(struct platform_device *pdev);
+int msm_hdmi_pll_8998_init(struct platform_device *pdev);
+#else
+static inline int msm_hdmi_pll_8960_init(struct platform_device *pdev)
+{
+	return -ENODEV;
+}
+
+static inline int msm_hdmi_pll_8996_init(struct platform_device *pdev)
+{
+	return -ENODEV;
+}
+
+static inline int msm_hdmi_pll_8998_init(struct platform_device *pdev)
+{
+	return -ENODEV;
+}
+#endif
+
+/*
+ * audio:
+ */
+/* Supported HDMI Audio channels and rates */
+#define	MSM_HDMI_AUDIO_CHANNEL_2	0
+#define	MSM_HDMI_AUDIO_CHANNEL_4	1
+#define	MSM_HDMI_AUDIO_CHANNEL_6	2
+#define	MSM_HDMI_AUDIO_CHANNEL_8	3
+
+#define	HDMI_SAMPLE_RATE_32KHZ		0
+#define	HDMI_SAMPLE_RATE_44_1KHZ	1
+#define	HDMI_SAMPLE_RATE_48KHZ		2
+#define	HDMI_SAMPLE_RATE_88_2KHZ	3
+#define	HDMI_SAMPLE_RATE_96KHZ		4
+#define	HDMI_SAMPLE_RATE_176_4KHZ	5
+#define	HDMI_SAMPLE_RATE_192KHZ		6
+
+int msm_hdmi_audio_update(struct hdmi *hdmi);
+int msm_hdmi_audio_info_setup(struct hdmi *hdmi, bool enabled,
+	uint32_t num_of_channels, uint32_t channel_allocation,
+	uint32_t level_shift, bool down_mix);
+void msm_hdmi_audio_set_sample_rate(struct hdmi *hdmi, int rate);
+
+
+/*
+ * hdmi bridge:
+ */
+
+int msm_hdmi_bridge_init(struct hdmi *hdmi);
+
+void msm_hdmi_hpd_irq(struct drm_bridge *bridge);
+enum drm_connector_status msm_hdmi_bridge_detect(
+		struct drm_bridge *bridge);
+int msm_hdmi_hpd_enable(struct drm_bridge *bridge);
+void msm_hdmi_hpd_disable(struct hdmi *hdmi);
+
+/*
+ * i2c adapter for ddc:
+ */
+
+void msm_hdmi_i2c_irq(struct i2c_adapter *i2c);
+void msm_hdmi_i2c_destroy(struct i2c_adapter *i2c);
+struct i2c_adapter *msm_hdmi_i2c_init(struct hdmi *hdmi);
+
+/*
+ * hdcp
+ */
+#ifdef CONFIG_DRM_MSM_HDMI_HDCP
+struct hdmi_hdcp_ctrl *msm_hdmi_hdcp_init(struct hdmi *hdmi);
+void msm_hdmi_hdcp_destroy(struct hdmi *hdmi);
+void msm_hdmi_hdcp_on(struct hdmi_hdcp_ctrl *hdcp_ctrl);
+void msm_hdmi_hdcp_off(struct hdmi_hdcp_ctrl *hdcp_ctrl);
+void msm_hdmi_hdcp_irq(struct hdmi_hdcp_ctrl *hdcp_ctrl);
+#else
+static inline struct hdmi_hdcp_ctrl *msm_hdmi_hdcp_init(struct hdmi *hdmi)
+{
+	return ERR_PTR(-ENXIO);
+}
+static inline void msm_hdmi_hdcp_destroy(struct hdmi *hdmi) {}
+static inline void msm_hdmi_hdcp_on(struct hdmi_hdcp_ctrl *hdcp_ctrl) {}
+static inline void msm_hdmi_hdcp_off(struct hdmi_hdcp_ctrl *hdcp_ctrl) {}
+static inline void msm_hdmi_hdcp_irq(struct hdmi_hdcp_ctrl *hdcp_ctrl) {}
+#endif
+
+#endif /* __HDMI_CONNECTOR_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_audio.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_audio.c
@@ -0,0 +1,254 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/hdmi.h>
+#include "hdmi.h"
+
+/* maps MSM_HDMI_AUDIO_CHANNEL_n consts used by audio driver to # of channels: */
+static int nchannels[] = { 2, 4, 6, 8 };
+
+/* Supported HDMI Audio sample rates */
+#define MSM_HDMI_SAMPLE_RATE_32KHZ		0
+#define MSM_HDMI_SAMPLE_RATE_44_1KHZ		1
+#define MSM_HDMI_SAMPLE_RATE_48KHZ		2
+#define MSM_HDMI_SAMPLE_RATE_88_2KHZ		3
+#define MSM_HDMI_SAMPLE_RATE_96KHZ		4
+#define MSM_HDMI_SAMPLE_RATE_176_4KHZ		5
+#define MSM_HDMI_SAMPLE_RATE_192KHZ		6
+#define MSM_HDMI_SAMPLE_RATE_MAX		7
+
+
+struct hdmi_msm_audio_acr {
+	uint32_t n;	/* N parameter for clock regeneration */
+	uint32_t cts;	/* CTS parameter for clock regeneration */
+};
+
+struct hdmi_msm_audio_arcs {
+	unsigned long int pixclock;
+	struct hdmi_msm_audio_acr lut[MSM_HDMI_SAMPLE_RATE_MAX];
+};
+
+#define HDMI_MSM_AUDIO_ARCS(pclk, ...) { (1000 * (pclk)), __VA_ARGS__ }
+
+/* Audio constants lookup table for hdmi_msm_audio_acr_setup */
+/* Valid Pixel-Clock rates: 25.2MHz, 27MHz, 27.03MHz, 74.25MHz, 148.5MHz */
+static const struct hdmi_msm_audio_arcs acr_lut[] = {
+	/*  25.200MHz  */
+	HDMI_MSM_AUDIO_ARCS(25200, {
+		{4096, 25200}, {6272, 28000}, {6144, 25200}, {12544, 28000},
+		{12288, 25200}, {25088, 28000}, {24576, 25200} }),
+	/*  27.000MHz  */
+	HDMI_MSM_AUDIO_ARCS(27000, {
+		{4096, 27000}, {6272, 30000}, {6144, 27000}, {12544, 30000},
+		{12288, 27000}, {25088, 30000}, {24576, 27000} }),
+	/*  27.027MHz */
+	HDMI_MSM_AUDIO_ARCS(27030, {
+		{4096, 27027}, {6272, 30030}, {6144, 27027}, {12544, 30030},
+		{12288, 27027}, {25088, 30030}, {24576, 27027} }),
+	/*  74.250MHz */
+	HDMI_MSM_AUDIO_ARCS(74250, {
+		{4096, 74250}, {6272, 82500}, {6144, 74250}, {12544, 82500},
+		{12288, 74250}, {25088, 82500}, {24576, 74250} }),
+	/* 148.500MHz */
+	HDMI_MSM_AUDIO_ARCS(148500, {
+		{4096, 148500}, {6272, 165000}, {6144, 148500}, {12544, 165000},
+		{12288, 148500}, {25088, 165000}, {24576, 148500} }),
+};
+
+static const struct hdmi_msm_audio_arcs *get_arcs(unsigned long int pixclock)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(acr_lut); i++) {
+		const struct hdmi_msm_audio_arcs *arcs = &acr_lut[i];
+		if (arcs->pixclock == pixclock)
+			return arcs;
+	}
+
+	return NULL;
+}
+
+int msm_hdmi_audio_update(struct hdmi *hdmi)
+{
+	struct hdmi_audio *audio = &hdmi->audio;
+	struct hdmi_audio_infoframe *info = &audio->infoframe;
+	const struct hdmi_msm_audio_arcs *arcs = NULL;
+	bool enabled = audio->enabled;
+	uint32_t acr_pkt_ctrl, vbi_pkt_ctrl, aud_pkt_ctrl;
+	uint32_t infofrm_ctrl, audio_config;
+
+	DBG("audio: enabled=%d, channels=%d, channel_allocation=0x%x, "
+		"level_shift_value=%d, downmix_inhibit=%d, rate=%d",
+		audio->enabled, info->channels,  info->channel_allocation,
+		info->level_shift_value, info->downmix_inhibit, audio->rate);
+	DBG("video: power_on=%d, pixclock=%lu", hdmi->power_on, hdmi->pixclock);
+
+	if (enabled && !(hdmi->power_on && hdmi->pixclock)) {
+		DBG("disabling audio: no video");
+		enabled = false;
+	}
+
+	if (enabled) {
+		arcs = get_arcs(hdmi->pixclock);
+		if (!arcs) {
+			DBG("disabling audio: unsupported pixclock: %lu",
+					hdmi->pixclock);
+			enabled = false;
+		}
+	}
+
+	/* Read first before writing */
+	acr_pkt_ctrl = hdmi_read(hdmi, REG_HDMI_ACR_PKT_CTRL);
+	vbi_pkt_ctrl = hdmi_read(hdmi, REG_HDMI_VBI_PKT_CTRL);
+	aud_pkt_ctrl = hdmi_read(hdmi, REG_HDMI_AUDIO_PKT_CTRL1);
+	infofrm_ctrl = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL0);
+	audio_config = hdmi_read(hdmi, REG_HDMI_AUDIO_CFG);
+
+	/* Clear N/CTS selection bits */
+	acr_pkt_ctrl &= ~HDMI_ACR_PKT_CTRL_SELECT__MASK;
+
+	if (enabled) {
+		uint32_t n, cts, multiplier;
+		enum hdmi_acr_cts select;
+		uint8_t buf[14];
+
+		n   = arcs->lut[audio->rate].n;
+		cts = arcs->lut[audio->rate].cts;
+
+		if ((MSM_HDMI_SAMPLE_RATE_192KHZ == audio->rate) ||
+				(MSM_HDMI_SAMPLE_RATE_176_4KHZ == audio->rate)) {
+			multiplier = 4;
+			n >>= 2; /* divide N by 4 and use multiplier */
+		} else if ((MSM_HDMI_SAMPLE_RATE_96KHZ == audio->rate) ||
+				(MSM_HDMI_SAMPLE_RATE_88_2KHZ == audio->rate)) {
+			multiplier = 2;
+			n >>= 1; /* divide N by 2 and use multiplier */
+		} else {
+			multiplier = 1;
+		}
+
+		DBG("n=%u, cts=%u, multiplier=%u", n, cts, multiplier);
+
+		acr_pkt_ctrl |= HDMI_ACR_PKT_CTRL_SOURCE;
+		acr_pkt_ctrl |= HDMI_ACR_PKT_CTRL_AUDIO_PRIORITY;
+		acr_pkt_ctrl |= HDMI_ACR_PKT_CTRL_N_MULTIPLIER(multiplier);
+
+		if ((MSM_HDMI_SAMPLE_RATE_48KHZ == audio->rate) ||
+				(MSM_HDMI_SAMPLE_RATE_96KHZ == audio->rate) ||
+				(MSM_HDMI_SAMPLE_RATE_192KHZ == audio->rate))
+			select = ACR_48;
+		else if ((MSM_HDMI_SAMPLE_RATE_44_1KHZ == audio->rate) ||
+				(MSM_HDMI_SAMPLE_RATE_88_2KHZ == audio->rate) ||
+				(MSM_HDMI_SAMPLE_RATE_176_4KHZ == audio->rate))
+			select = ACR_44;
+		else /* default to 32k */
+			select = ACR_32;
+
+		acr_pkt_ctrl |= HDMI_ACR_PKT_CTRL_SELECT(select);
+
+		hdmi_write(hdmi, REG_HDMI_ACR_0(select - 1),
+				HDMI_ACR_0_CTS(cts));
+		hdmi_write(hdmi, REG_HDMI_ACR_1(select - 1),
+				HDMI_ACR_1_N(n));
+
+		hdmi_write(hdmi, REG_HDMI_AUDIO_PKT_CTRL2,
+				COND(info->channels != 2, HDMI_AUDIO_PKT_CTRL2_LAYOUT) |
+				HDMI_AUDIO_PKT_CTRL2_OVERRIDE);
+
+		acr_pkt_ctrl |= HDMI_ACR_PKT_CTRL_CONT;
+		acr_pkt_ctrl |= HDMI_ACR_PKT_CTRL_SEND;
+
+		/* configure infoframe: */
+		hdmi_audio_infoframe_pack(info, buf, sizeof(buf));
+		hdmi_write(hdmi, REG_HDMI_AUDIO_INFO0,
+				(buf[3] <<  0) | (buf[4] <<  8) |
+				(buf[5] << 16) | (buf[6] << 24));
+		hdmi_write(hdmi, REG_HDMI_AUDIO_INFO1,
+				(buf[7] <<  0) | (buf[8] << 8));
+
+		hdmi_write(hdmi, REG_HDMI_GC, 0);
+
+		vbi_pkt_ctrl |= HDMI_VBI_PKT_CTRL_GC_ENABLE;
+		vbi_pkt_ctrl |= HDMI_VBI_PKT_CTRL_GC_EVERY_FRAME;
+
+		aud_pkt_ctrl |= HDMI_AUDIO_PKT_CTRL1_AUDIO_SAMPLE_SEND;
+
+		infofrm_ctrl |= HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SEND;
+		infofrm_ctrl |= HDMI_INFOFRAME_CTRL0_AUDIO_INFO_CONT;
+		infofrm_ctrl |= HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SOURCE;
+		infofrm_ctrl |= HDMI_INFOFRAME_CTRL0_AUDIO_INFO_UPDATE;
+
+		audio_config &= ~HDMI_AUDIO_CFG_FIFO_WATERMARK__MASK;
+		audio_config |= HDMI_AUDIO_CFG_FIFO_WATERMARK(4);
+		audio_config |= HDMI_AUDIO_CFG_ENGINE_ENABLE;
+	} else {
+		acr_pkt_ctrl &= ~HDMI_ACR_PKT_CTRL_CONT;
+		acr_pkt_ctrl &= ~HDMI_ACR_PKT_CTRL_SEND;
+		vbi_pkt_ctrl &= ~HDMI_VBI_PKT_CTRL_GC_ENABLE;
+		vbi_pkt_ctrl &= ~HDMI_VBI_PKT_CTRL_GC_EVERY_FRAME;
+		aud_pkt_ctrl &= ~HDMI_AUDIO_PKT_CTRL1_AUDIO_SAMPLE_SEND;
+		infofrm_ctrl &= ~HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SEND;
+		infofrm_ctrl &= ~HDMI_INFOFRAME_CTRL0_AUDIO_INFO_CONT;
+		infofrm_ctrl &= ~HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SOURCE;
+		infofrm_ctrl &= ~HDMI_INFOFRAME_CTRL0_AUDIO_INFO_UPDATE;
+		audio_config &= ~HDMI_AUDIO_CFG_ENGINE_ENABLE;
+	}
+
+	hdmi_write(hdmi, REG_HDMI_ACR_PKT_CTRL, acr_pkt_ctrl);
+	hdmi_write(hdmi, REG_HDMI_VBI_PKT_CTRL, vbi_pkt_ctrl);
+	hdmi_write(hdmi, REG_HDMI_AUDIO_PKT_CTRL1, aud_pkt_ctrl);
+	hdmi_write(hdmi, REG_HDMI_INFOFRAME_CTRL0, infofrm_ctrl);
+
+	hdmi_write(hdmi, REG_HDMI_AUD_INT,
+			COND(enabled, HDMI_AUD_INT_AUD_FIFO_URUN_INT) |
+			COND(enabled, HDMI_AUD_INT_AUD_SAM_DROP_INT));
+
+	hdmi_write(hdmi, REG_HDMI_AUDIO_CFG, audio_config);
+
+
+	DBG("audio %sabled", enabled ? "en" : "dis");
+
+	return 0;
+}
+
+int msm_hdmi_audio_info_setup(struct hdmi *hdmi, bool enabled,
+	uint32_t num_of_channels, uint32_t channel_allocation,
+	uint32_t level_shift, bool down_mix)
+{
+	struct hdmi_audio *audio;
+
+	if (!hdmi)
+		return -ENXIO;
+
+	audio = &hdmi->audio;
+
+	if (num_of_channels >= ARRAY_SIZE(nchannels))
+		return -EINVAL;
+
+	audio->enabled = enabled;
+	audio->infoframe.channels = nchannels[num_of_channels];
+	audio->infoframe.channel_allocation = channel_allocation;
+	audio->infoframe.level_shift_value = level_shift;
+	audio->infoframe.downmix_inhibit = down_mix;
+
+	return msm_hdmi_audio_update(hdmi);
+}
+
+void msm_hdmi_audio_set_sample_rate(struct hdmi *hdmi, int rate)
+{
+	struct hdmi_audio *audio;
+
+	if (!hdmi)
+		return;
+
+	audio = &hdmi->audio;
+
+	if ((rate < 0) || (rate >= MSM_HDMI_SAMPLE_RATE_MAX))
+		return;
+
+	audio->rate = rate;
+	msm_hdmi_audio_update(hdmi);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_bridge.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_bridge.c
@@ -0,0 +1,345 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/delay.h>
+#include <drm/drm_bridge_connector.h>
+#include <drm/drm_edid.h>
+
+#include "msm_kms.h"
+#include "hdmi.h"
+
+static void msm_hdmi_power_on(struct drm_bridge *bridge)
+{
+	struct drm_device *dev = bridge->dev;
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	const struct hdmi_platform_config *config = hdmi->config;
+	int i, ret;
+
+	pm_runtime_get_sync(&hdmi->pdev->dev);
+
+	ret = regulator_bulk_enable(config->pwr_reg_cnt, hdmi->pwr_regs);
+	if (ret)
+		DRM_DEV_ERROR(dev->dev, "failed to enable pwr regulator: %d\n", ret);
+
+	if (config->pwr_clk_cnt > 0) {
+		DBG("pixclock: %lu", hdmi->pixclock);
+		ret = clk_set_rate(hdmi->pwr_clks[0], hdmi->pixclock);
+		if (ret) {
+			DRM_DEV_ERROR(dev->dev, "failed to set pixel clk: %s (%d)\n",
+					config->pwr_clk_names[0], ret);
+		}
+	}
+
+	for (i = 0; i < config->pwr_clk_cnt; i++) {
+		ret = clk_prepare_enable(hdmi->pwr_clks[i]);
+		if (ret) {
+			DRM_DEV_ERROR(dev->dev, "failed to enable pwr clk: %s (%d)\n",
+					config->pwr_clk_names[i], ret);
+		}
+	}
+}
+
+static void power_off(struct drm_bridge *bridge)
+{
+	struct drm_device *dev = bridge->dev;
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	const struct hdmi_platform_config *config = hdmi->config;
+	int i, ret;
+
+	/* TODO do we need to wait for final vblank somewhere before
+	 * cutting the clocks?
+	 */
+	mdelay(16 + 4);
+
+	for (i = 0; i < config->pwr_clk_cnt; i++)
+		clk_disable_unprepare(hdmi->pwr_clks[i]);
+
+	ret = regulator_bulk_disable(config->pwr_reg_cnt, hdmi->pwr_regs);
+	if (ret)
+		DRM_DEV_ERROR(dev->dev, "failed to disable pwr regulator: %d\n", ret);
+
+	pm_runtime_put(&hdmi->pdev->dev);
+}
+
+#define AVI_IFRAME_LINE_NUMBER 1
+
+static void msm_hdmi_config_avi_infoframe(struct hdmi *hdmi)
+{
+	struct drm_crtc *crtc = hdmi->encoder->crtc;
+	const struct drm_display_mode *mode = &crtc->state->adjusted_mode;
+	union hdmi_infoframe frame;
+	u8 buffer[HDMI_INFOFRAME_SIZE(AVI)];
+	u32 val;
+	int len;
+
+	drm_hdmi_avi_infoframe_from_display_mode(&frame.avi,
+						 hdmi->connector, mode);
+
+	len = hdmi_infoframe_pack(&frame, buffer, sizeof(buffer));
+	if (len < 0) {
+		DRM_DEV_ERROR(&hdmi->pdev->dev,
+			"failed to configure avi infoframe\n");
+		return;
+	}
+
+	/*
+	 * the AVI_INFOx registers don't map exactly to how the AVI infoframes
+	 * are packed according to the spec. The checksum from the header is
+	 * written to the LSB byte of AVI_INFO0 and the version is written to
+	 * the third byte from the LSB of AVI_INFO3
+	 */
+	hdmi_write(hdmi, REG_HDMI_AVI_INFO(0),
+		   buffer[3] |
+		   buffer[4] << 8 |
+		   buffer[5] << 16 |
+		   buffer[6] << 24);
+
+	hdmi_write(hdmi, REG_HDMI_AVI_INFO(1),
+		   buffer[7] |
+		   buffer[8] << 8 |
+		   buffer[9] << 16 |
+		   buffer[10] << 24);
+
+	hdmi_write(hdmi, REG_HDMI_AVI_INFO(2),
+		   buffer[11] |
+		   buffer[12] << 8 |
+		   buffer[13] << 16 |
+		   buffer[14] << 24);
+
+	hdmi_write(hdmi, REG_HDMI_AVI_INFO(3),
+		   buffer[15] |
+		   buffer[16] << 8 |
+		   buffer[1] << 24);
+
+	hdmi_write(hdmi, REG_HDMI_INFOFRAME_CTRL0,
+		   HDMI_INFOFRAME_CTRL0_AVI_SEND |
+		   HDMI_INFOFRAME_CTRL0_AVI_CONT);
+
+	val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL1);
+	val &= ~HDMI_INFOFRAME_CTRL1_AVI_INFO_LINE__MASK;
+	val |= HDMI_INFOFRAME_CTRL1_AVI_INFO_LINE(AVI_IFRAME_LINE_NUMBER);
+	hdmi_write(hdmi, REG_HDMI_INFOFRAME_CTRL1, val);
+}
+
+static void msm_hdmi_bridge_pre_enable(struct drm_bridge *bridge)
+{
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	struct hdmi_phy *phy = hdmi->phy;
+
+	DBG("power up");
+
+	if (!hdmi->power_on) {
+		msm_hdmi_phy_resource_enable(phy);
+		msm_hdmi_power_on(bridge);
+		hdmi->power_on = true;
+		if (hdmi->hdmi_mode) {
+			msm_hdmi_config_avi_infoframe(hdmi);
+			msm_hdmi_audio_update(hdmi);
+		}
+	}
+
+	msm_hdmi_phy_powerup(phy, hdmi->pixclock);
+
+	msm_hdmi_set_mode(hdmi, true);
+
+	if (hdmi->hdcp_ctrl)
+		msm_hdmi_hdcp_on(hdmi->hdcp_ctrl);
+}
+
+static void msm_hdmi_bridge_post_disable(struct drm_bridge *bridge)
+{
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	struct hdmi_phy *phy = hdmi->phy;
+
+	if (hdmi->hdcp_ctrl)
+		msm_hdmi_hdcp_off(hdmi->hdcp_ctrl);
+
+	DBG("power down");
+	msm_hdmi_set_mode(hdmi, false);
+
+	msm_hdmi_phy_powerdown(phy);
+
+	if (hdmi->power_on) {
+		power_off(bridge);
+		hdmi->power_on = false;
+		if (hdmi->hdmi_mode)
+			msm_hdmi_audio_update(hdmi);
+		msm_hdmi_phy_resource_disable(phy);
+	}
+}
+
+static void msm_hdmi_bridge_mode_set(struct drm_bridge *bridge,
+		 const struct drm_display_mode *mode,
+		 const struct drm_display_mode *adjusted_mode)
+{
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	int hstart, hend, vstart, vend;
+	uint32_t frame_ctrl;
+
+	mode = adjusted_mode;
+
+	hdmi->pixclock = mode->clock * 1000;
+
+	hstart = mode->htotal - mode->hsync_start;
+	hend   = mode->htotal - mode->hsync_start + mode->hdisplay;
+
+	vstart = mode->vtotal - mode->vsync_start - 1;
+	vend   = mode->vtotal - mode->vsync_start + mode->vdisplay - 1;
+
+	DBG("htotal=%d, vtotal=%d, hstart=%d, hend=%d, vstart=%d, vend=%d",
+			mode->htotal, mode->vtotal, hstart, hend, vstart, vend);
+
+	hdmi_write(hdmi, REG_HDMI_TOTAL,
+			HDMI_TOTAL_H_TOTAL(mode->htotal - 1) |
+			HDMI_TOTAL_V_TOTAL(mode->vtotal - 1));
+
+	hdmi_write(hdmi, REG_HDMI_ACTIVE_HSYNC,
+			HDMI_ACTIVE_HSYNC_START(hstart) |
+			HDMI_ACTIVE_HSYNC_END(hend));
+	hdmi_write(hdmi, REG_HDMI_ACTIVE_VSYNC,
+			HDMI_ACTIVE_VSYNC_START(vstart) |
+			HDMI_ACTIVE_VSYNC_END(vend));
+
+	if (mode->flags & DRM_MODE_FLAG_INTERLACE) {
+		hdmi_write(hdmi, REG_HDMI_VSYNC_TOTAL_F2,
+				HDMI_VSYNC_TOTAL_F2_V_TOTAL(mode->vtotal));
+		hdmi_write(hdmi, REG_HDMI_VSYNC_ACTIVE_F2,
+				HDMI_VSYNC_ACTIVE_F2_START(vstart + 1) |
+				HDMI_VSYNC_ACTIVE_F2_END(vend + 1));
+	} else {
+		hdmi_write(hdmi, REG_HDMI_VSYNC_TOTAL_F2,
+				HDMI_VSYNC_TOTAL_F2_V_TOTAL(0));
+		hdmi_write(hdmi, REG_HDMI_VSYNC_ACTIVE_F2,
+				HDMI_VSYNC_ACTIVE_F2_START(0) |
+				HDMI_VSYNC_ACTIVE_F2_END(0));
+	}
+
+	frame_ctrl = 0;
+	if (mode->flags & DRM_MODE_FLAG_NHSYNC)
+		frame_ctrl |= HDMI_FRAME_CTRL_HSYNC_LOW;
+	if (mode->flags & DRM_MODE_FLAG_NVSYNC)
+		frame_ctrl |= HDMI_FRAME_CTRL_VSYNC_LOW;
+	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+		frame_ctrl |= HDMI_FRAME_CTRL_INTERLACED_EN;
+	DBG("frame_ctrl=%08x", frame_ctrl);
+	hdmi_write(hdmi, REG_HDMI_FRAME_CTRL, frame_ctrl);
+
+	if (hdmi->hdmi_mode)
+		msm_hdmi_audio_update(hdmi);
+}
+
+static struct edid *msm_hdmi_bridge_get_edid(struct drm_bridge *bridge,
+		struct drm_connector *connector)
+{
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	struct edid *edid;
+	uint32_t hdmi_ctrl;
+
+	hdmi_ctrl = hdmi_read(hdmi, REG_HDMI_CTRL);
+	hdmi_write(hdmi, REG_HDMI_CTRL, hdmi_ctrl | HDMI_CTRL_ENABLE);
+
+	edid = drm_get_edid(connector, hdmi->i2c);
+
+	hdmi_write(hdmi, REG_HDMI_CTRL, hdmi_ctrl);
+
+	hdmi->hdmi_mode = drm_detect_hdmi_monitor(edid);
+
+	return edid;
+}
+
+static enum drm_mode_status msm_hdmi_bridge_mode_valid(struct drm_bridge *bridge,
+		const struct drm_display_info *info,
+		const struct drm_display_mode *mode)
+{
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	const struct hdmi_platform_config *config = hdmi->config;
+	struct msm_drm_private *priv = bridge->dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+	long actual, requested;
+
+	requested = 1000 * mode->clock;
+
+	/* for mdp5/apq8074, we manage our own pixel clk (as opposed to
+	 * mdp4/dtv stuff where pixel clk is assigned to mdp/encoder
+	 * instead):
+	 */
+	if (kms->funcs->round_pixclk)
+		actual = kms->funcs->round_pixclk(kms,
+			requested, hdmi_bridge->hdmi->encoder);
+	else if (config->pwr_clk_cnt > 0)
+		actual = clk_round_rate(hdmi->pwr_clks[0], requested);
+	else
+		actual = requested;
+
+	DBG("requested=%ld, actual=%ld", requested, actual);
+
+	if (actual != requested)
+		return MODE_CLOCK_RANGE;
+
+	return 0;
+}
+
+static const struct drm_bridge_funcs msm_hdmi_bridge_funcs = {
+		.pre_enable = msm_hdmi_bridge_pre_enable,
+		.post_disable = msm_hdmi_bridge_post_disable,
+		.mode_set = msm_hdmi_bridge_mode_set,
+		.mode_valid = msm_hdmi_bridge_mode_valid,
+		.get_edid = msm_hdmi_bridge_get_edid,
+		.detect = msm_hdmi_bridge_detect,
+};
+
+static void
+msm_hdmi_hotplug_work(struct work_struct *work)
+{
+	struct hdmi_bridge *hdmi_bridge =
+		container_of(work, struct hdmi_bridge, hpd_work);
+	struct drm_bridge *bridge = &hdmi_bridge->base;
+
+	drm_bridge_hpd_notify(bridge, drm_bridge_detect(bridge));
+}
+
+/* initialize bridge */
+int msm_hdmi_bridge_init(struct hdmi *hdmi)
+{
+	struct drm_bridge *bridge = NULL;
+	struct hdmi_bridge *hdmi_bridge;
+	int ret;
+
+	hdmi_bridge = devm_kzalloc(hdmi->dev->dev,
+			sizeof(*hdmi_bridge), GFP_KERNEL);
+	if (!hdmi_bridge)
+		return -ENOMEM;
+
+	hdmi_bridge->hdmi = hdmi;
+	INIT_WORK(&hdmi_bridge->hpd_work, msm_hdmi_hotplug_work);
+
+	bridge = &hdmi_bridge->base;
+	bridge->funcs = &msm_hdmi_bridge_funcs;
+	bridge->ddc = hdmi->i2c;
+	bridge->type = DRM_MODE_CONNECTOR_HDMIA;
+	bridge->ops = DRM_BRIDGE_OP_HPD |
+		DRM_BRIDGE_OP_DETECT |
+		DRM_BRIDGE_OP_EDID;
+
+	ret = devm_drm_bridge_add(hdmi->dev->dev, bridge);
+	if (ret)
+		return ret;
+
+	ret = drm_bridge_attach(hdmi->encoder, bridge, NULL, DRM_BRIDGE_ATTACH_NO_CONNECTOR);
+	if (ret)
+		return ret;
+
+	hdmi->bridge = bridge;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_hdcp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_hdcp.c
@@ -0,0 +1,1428 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2010-2015, The Linux Foundation. All rights reserved.
+ */
+
+#include "hdmi.h"
+#include <linux/firmware/qcom/qcom_scm.h>
+
+#define HDCP_REG_ENABLE 0x01
+#define HDCP_REG_DISABLE 0x00
+#define HDCP_PORT_ADDR 0x74
+
+#define HDCP_INT_STATUS_MASK ( \
+		HDMI_HDCP_INT_CTRL_AUTH_SUCCESS_INT | \
+		HDMI_HDCP_INT_CTRL_AUTH_FAIL_INT | \
+		HDMI_HDCP_INT_CTRL_AUTH_XFER_REQ_INT | \
+		HDMI_HDCP_INT_CTRL_AUTH_XFER_DONE_INT)
+
+#define AUTH_WORK_RETRIES_TIME 100
+#define AUTH_RETRIES_TIME 30
+
+/* QFPROM Registers for HDMI/HDCP */
+#define QFPROM_RAW_FEAT_CONFIG_ROW0_LSB  0x000000F8
+#define QFPROM_RAW_FEAT_CONFIG_ROW0_MSB  0x000000FC
+#define HDCP_KSV_LSB                     0x000060D8
+#define HDCP_KSV_MSB                     0x000060DC
+
+enum DS_TYPE {  /* type of downstream device */
+	DS_UNKNOWN,
+	DS_RECEIVER,
+	DS_REPEATER,
+};
+
+enum hdmi_hdcp_state {
+	HDCP_STATE_NO_AKSV,
+	HDCP_STATE_INACTIVE,
+	HDCP_STATE_AUTHENTICATING,
+	HDCP_STATE_AUTHENTICATED,
+	HDCP_STATE_AUTH_FAILED
+};
+
+struct hdmi_hdcp_reg_data {
+	u32 reg_id;
+	u32 off;
+	char *name;
+	u32 reg_val;
+};
+
+struct hdmi_hdcp_ctrl {
+	struct hdmi *hdmi;
+	u32 auth_retries;
+	bool tz_hdcp;
+	enum hdmi_hdcp_state hdcp_state;
+	struct work_struct hdcp_auth_work;
+	struct work_struct hdcp_reauth_work;
+
+#define AUTH_ABORT_EV 1
+#define AUTH_RESULT_RDY_EV 2
+	unsigned long auth_event;
+	wait_queue_head_t auth_event_queue;
+
+	u32 ksv_fifo_w_index;
+	/*
+	 * store aksv from qfprom
+	 */
+	u32 aksv_lsb;
+	u32 aksv_msb;
+	bool aksv_valid;
+	u32 ds_type;
+	u32 bksv_lsb;
+	u32 bksv_msb;
+	u8 dev_count;
+	u8 depth;
+	u8 ksv_list[5 * 127];
+	bool max_cascade_exceeded;
+	bool max_dev_exceeded;
+};
+
+static int msm_hdmi_ddc_read(struct hdmi *hdmi, u16 addr, u8 offset,
+	u8 *data, u16 data_len)
+{
+	int rc;
+	int retry = 5;
+	struct i2c_msg msgs[] = {
+		{
+			.addr	= addr >> 1,
+			.flags	= 0,
+			.len	= 1,
+			.buf	= &offset,
+		}, {
+			.addr	= addr >> 1,
+			.flags	= I2C_M_RD,
+			.len	= data_len,
+			.buf	= data,
+		}
+	};
+
+	DBG("Start DDC read");
+retry:
+	rc = i2c_transfer(hdmi->i2c, msgs, 2);
+
+	retry--;
+	if (rc == 2)
+		rc = 0;
+	else if (retry > 0)
+		goto retry;
+	else
+		rc = -EIO;
+
+	DBG("End DDC read %d", rc);
+
+	return rc;
+}
+
+#define HDCP_DDC_WRITE_MAX_BYTE_NUM 32
+
+static int msm_hdmi_ddc_write(struct hdmi *hdmi, u16 addr, u8 offset,
+	u8 *data, u16 data_len)
+{
+	int rc;
+	int retry = 10;
+	u8 buf[HDCP_DDC_WRITE_MAX_BYTE_NUM];
+	struct i2c_msg msgs[] = {
+		{
+			.addr	= addr >> 1,
+			.flags	= 0,
+			.len	= 1,
+		}
+	};
+
+	DBG("Start DDC write");
+	if (data_len > (HDCP_DDC_WRITE_MAX_BYTE_NUM - 1)) {
+		pr_err("%s: write size too big\n", __func__);
+		return -ERANGE;
+	}
+
+	buf[0] = offset;
+	memcpy(&buf[1], data, data_len);
+	msgs[0].buf = buf;
+	msgs[0].len = data_len + 1;
+retry:
+	rc = i2c_transfer(hdmi->i2c, msgs, 1);
+
+	retry--;
+	if (rc == 1)
+		rc = 0;
+	else if (retry > 0)
+		goto retry;
+	else
+		rc = -EIO;
+
+	DBG("End DDC write %d", rc);
+
+	return rc;
+}
+
+static int msm_hdmi_hdcp_scm_wr(struct hdmi_hdcp_ctrl *hdcp_ctrl, u32 *preg,
+	u32 *pdata, u32 count)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	struct qcom_scm_hdcp_req scm_buf[QCOM_SCM_HDCP_MAX_REQ_CNT];
+	u32 resp, phy_addr, idx = 0;
+	int i, ret = 0;
+
+	WARN_ON(!pdata || !preg || (count == 0));
+
+	if (hdcp_ctrl->tz_hdcp) {
+		phy_addr = (u32)hdmi->mmio_phy_addr;
+
+		while (count) {
+			memset(scm_buf, 0, sizeof(scm_buf));
+			for (i = 0; i < count && i < QCOM_SCM_HDCP_MAX_REQ_CNT;
+				i++) {
+				scm_buf[i].addr = phy_addr + preg[idx];
+				scm_buf[i].val  = pdata[idx];
+				idx++;
+			}
+			ret = qcom_scm_hdcp_req(scm_buf, i, &resp);
+
+			if (ret || resp) {
+				pr_err("%s: error: scm_call ret=%d resp=%u\n",
+					__func__, ret, resp);
+				ret = -EINVAL;
+				break;
+			}
+
+			count -= i;
+		}
+	} else {
+		for (i = 0; i < count; i++)
+			hdmi_write(hdmi, preg[i], pdata[i]);
+	}
+
+	return ret;
+}
+
+void msm_hdmi_hdcp_irq(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 reg_val, hdcp_int_status;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	reg_val = hdmi_read(hdmi, REG_HDMI_HDCP_INT_CTRL);
+	hdcp_int_status = reg_val & HDCP_INT_STATUS_MASK;
+	if (!hdcp_int_status) {
+		spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+		return;
+	}
+	/* Clear Interrupts */
+	reg_val |= hdcp_int_status << 1;
+	/* Clear AUTH_FAIL_INFO as well */
+	if (hdcp_int_status & HDMI_HDCP_INT_CTRL_AUTH_FAIL_INT)
+		reg_val |= HDMI_HDCP_INT_CTRL_AUTH_FAIL_INFO_ACK;
+	hdmi_write(hdmi, REG_HDMI_HDCP_INT_CTRL, reg_val);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	DBG("hdcp irq %x", hdcp_int_status);
+
+	if (hdcp_int_status & HDMI_HDCP_INT_CTRL_AUTH_SUCCESS_INT) {
+		pr_info("%s:AUTH_SUCCESS_INT received\n", __func__);
+		if (HDCP_STATE_AUTHENTICATING == hdcp_ctrl->hdcp_state) {
+			set_bit(AUTH_RESULT_RDY_EV, &hdcp_ctrl->auth_event);
+			wake_up_all(&hdcp_ctrl->auth_event_queue);
+		}
+	}
+
+	if (hdcp_int_status & HDMI_HDCP_INT_CTRL_AUTH_FAIL_INT) {
+		reg_val = hdmi_read(hdmi, REG_HDMI_HDCP_LINK0_STATUS);
+		pr_info("%s: AUTH_FAIL_INT rcvd, LINK0_STATUS=0x%08x\n",
+			__func__, reg_val);
+		if (HDCP_STATE_AUTHENTICATED == hdcp_ctrl->hdcp_state)
+			queue_work(hdmi->workq, &hdcp_ctrl->hdcp_reauth_work);
+		else if (HDCP_STATE_AUTHENTICATING ==
+				hdcp_ctrl->hdcp_state) {
+			set_bit(AUTH_RESULT_RDY_EV, &hdcp_ctrl->auth_event);
+			wake_up_all(&hdcp_ctrl->auth_event_queue);
+		}
+	}
+}
+
+static int msm_hdmi_hdcp_msleep(struct hdmi_hdcp_ctrl *hdcp_ctrl, u32 ms, u32 ev)
+{
+	int rc;
+
+	rc = wait_event_timeout(hdcp_ctrl->auth_event_queue,
+		!!test_bit(ev, &hdcp_ctrl->auth_event),
+		msecs_to_jiffies(ms));
+	if (rc) {
+		pr_info("%s: msleep is canceled by event %d\n",
+				__func__, ev);
+		clear_bit(ev, &hdcp_ctrl->auth_event);
+		return -ECANCELED;
+	}
+
+	return 0;
+}
+
+static int msm_hdmi_hdcp_read_validate_aksv(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+
+	/* Fetch aksv from QFPROM, this info should be public. */
+	hdcp_ctrl->aksv_lsb = hdmi_qfprom_read(hdmi, HDCP_KSV_LSB);
+	hdcp_ctrl->aksv_msb = hdmi_qfprom_read(hdmi, HDCP_KSV_MSB);
+
+	/* check there are 20 ones in AKSV */
+	if ((hweight32(hdcp_ctrl->aksv_lsb) + hweight32(hdcp_ctrl->aksv_msb))
+			!= 20) {
+		pr_err("%s: AKSV QFPROM doesn't have 20 1's, 20 0's\n",
+			__func__);
+		pr_err("%s: QFPROM AKSV chk failed (AKSV=%02x%08x)\n",
+			__func__, hdcp_ctrl->aksv_msb,
+			hdcp_ctrl->aksv_lsb);
+		return -EINVAL;
+	}
+	DBG("AKSV=%02x%08x", hdcp_ctrl->aksv_msb, hdcp_ctrl->aksv_lsb);
+
+	return 0;
+}
+
+static int msm_reset_hdcp_ddc_failures(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 reg_val, failure, nack0;
+	int rc = 0;
+
+	/* Check for any DDC transfer failures */
+	reg_val = hdmi_read(hdmi, REG_HDMI_HDCP_DDC_STATUS);
+	failure = reg_val & HDMI_HDCP_DDC_STATUS_FAILED;
+	nack0 = reg_val & HDMI_HDCP_DDC_STATUS_NACK0;
+	DBG("HDCP_DDC_STATUS=0x%x, FAIL=%d, NACK0=%d",
+		reg_val, failure, nack0);
+
+	if (failure) {
+		/*
+		 * Indicates that the last HDCP HW DDC transfer failed.
+		 * This occurs when a transfer is attempted with HDCP DDC
+		 * disabled (HDCP_DDC_DISABLE=1) or the number of retries
+		 * matches HDCP_DDC_RETRY_CNT.
+		 * Failure occurred,  let's clear it.
+		 */
+		DBG("DDC failure detected");
+
+		/* First, Disable DDC */
+		hdmi_write(hdmi, REG_HDMI_HDCP_DDC_CTRL_0,
+			HDMI_HDCP_DDC_CTRL_0_DISABLE);
+
+		/* ACK the Failure to Clear it */
+		reg_val = hdmi_read(hdmi, REG_HDMI_HDCP_DDC_CTRL_1);
+		reg_val |= HDMI_HDCP_DDC_CTRL_1_FAILED_ACK;
+		hdmi_write(hdmi, REG_HDMI_HDCP_DDC_CTRL_1, reg_val);
+
+		/* Check if the FAILURE got Cleared */
+		reg_val = hdmi_read(hdmi, REG_HDMI_HDCP_DDC_STATUS);
+		if (reg_val & HDMI_HDCP_DDC_STATUS_FAILED)
+			pr_info("%s: Unable to clear HDCP DDC Failure\n",
+				__func__);
+
+		/* Re-Enable HDCP DDC */
+		hdmi_write(hdmi, REG_HDMI_HDCP_DDC_CTRL_0, 0);
+	}
+
+	if (nack0) {
+		DBG("Before: HDMI_DDC_SW_STATUS=0x%08x",
+			hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS));
+		/* Reset HDMI DDC software status */
+		reg_val = hdmi_read(hdmi, REG_HDMI_DDC_CTRL);
+		reg_val |= HDMI_DDC_CTRL_SW_STATUS_RESET;
+		hdmi_write(hdmi, REG_HDMI_DDC_CTRL, reg_val);
+
+		rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 20, AUTH_ABORT_EV);
+
+		reg_val = hdmi_read(hdmi, REG_HDMI_DDC_CTRL);
+		reg_val &= ~HDMI_DDC_CTRL_SW_STATUS_RESET;
+		hdmi_write(hdmi, REG_HDMI_DDC_CTRL, reg_val);
+
+		/* Reset HDMI DDC Controller */
+		reg_val = hdmi_read(hdmi, REG_HDMI_DDC_CTRL);
+		reg_val |= HDMI_DDC_CTRL_SOFT_RESET;
+		hdmi_write(hdmi, REG_HDMI_DDC_CTRL, reg_val);
+
+		/* If previous msleep is aborted, skip this msleep */
+		if (!rc)
+			rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 20, AUTH_ABORT_EV);
+
+		reg_val = hdmi_read(hdmi, REG_HDMI_DDC_CTRL);
+		reg_val &= ~HDMI_DDC_CTRL_SOFT_RESET;
+		hdmi_write(hdmi, REG_HDMI_DDC_CTRL, reg_val);
+		DBG("After: HDMI_DDC_SW_STATUS=0x%08x",
+			hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS));
+	}
+
+	return rc;
+}
+
+static int msm_hdmi_hdcp_hw_ddc_clean(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc;
+	u32 hdcp_ddc_status, ddc_hw_status;
+	u32 xfer_done, xfer_req, hw_done;
+	bool hw_not_ready;
+	u32 timeout_count;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+
+	if (hdmi_read(hdmi, REG_HDMI_DDC_HW_STATUS) == 0)
+		return 0;
+
+	/* Wait to be clean on DDC HW engine */
+	timeout_count = 100;
+	do {
+		hdcp_ddc_status = hdmi_read(hdmi, REG_HDMI_HDCP_DDC_STATUS);
+		ddc_hw_status = hdmi_read(hdmi, REG_HDMI_DDC_HW_STATUS);
+
+		xfer_done = hdcp_ddc_status & HDMI_HDCP_DDC_STATUS_XFER_DONE;
+		xfer_req = hdcp_ddc_status & HDMI_HDCP_DDC_STATUS_XFER_REQ;
+		hw_done = ddc_hw_status & HDMI_DDC_HW_STATUS_DONE;
+		hw_not_ready = !xfer_done || xfer_req || !hw_done;
+
+		if (hw_not_ready)
+			break;
+
+		timeout_count--;
+		if (!timeout_count) {
+			pr_warn("%s: hw_ddc_clean failed\n", __func__);
+			return -ETIMEDOUT;
+		}
+
+		rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 20, AUTH_ABORT_EV);
+		if (rc)
+			return rc;
+	} while (1);
+
+	return 0;
+}
+
+static void msm_hdmi_hdcp_reauth_work(struct work_struct *work)
+{
+	struct hdmi_hdcp_ctrl *hdcp_ctrl = container_of(work,
+		struct hdmi_hdcp_ctrl, hdcp_reauth_work);
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	unsigned long flags;
+	u32 reg_val;
+
+	DBG("HDCP REAUTH WORK");
+	/*
+	 * Disable HPD circuitry.
+	 * This is needed to reset the HDCP cipher engine so that when we
+	 * attempt a re-authentication, HW would clear the AN0_READY and
+	 * AN1_READY bits in HDMI_HDCP_LINK0_STATUS register
+	 */
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	reg_val = hdmi_read(hdmi, REG_HDMI_HPD_CTRL);
+	reg_val &= ~HDMI_HPD_CTRL_ENABLE;
+	hdmi_write(hdmi, REG_HDMI_HPD_CTRL, reg_val);
+
+	/* Disable HDCP interrupts */
+	hdmi_write(hdmi, REG_HDMI_HDCP_INT_CTRL, 0);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	hdmi_write(hdmi, REG_HDMI_HDCP_RESET,
+		HDMI_HDCP_RESET_LINK0_DEAUTHENTICATE);
+
+	/* Wait to be clean on DDC HW engine */
+	if (msm_hdmi_hdcp_hw_ddc_clean(hdcp_ctrl)) {
+		pr_info("%s: reauth work aborted\n", __func__);
+		return;
+	}
+
+	/* Disable encryption and disable the HDCP block */
+	hdmi_write(hdmi, REG_HDMI_HDCP_CTRL, 0);
+
+	/* Enable HPD circuitry */
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	reg_val = hdmi_read(hdmi, REG_HDMI_HPD_CTRL);
+	reg_val |= HDMI_HPD_CTRL_ENABLE;
+	hdmi_write(hdmi, REG_HDMI_HPD_CTRL, reg_val);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	/*
+	 * Only retry defined times then abort current authenticating process
+	 */
+	if (++hdcp_ctrl->auth_retries == AUTH_RETRIES_TIME) {
+		hdcp_ctrl->hdcp_state = HDCP_STATE_INACTIVE;
+		hdcp_ctrl->auth_retries = 0;
+		pr_info("%s: abort reauthentication!\n", __func__);
+
+		return;
+	}
+
+	DBG("Queue AUTH WORK");
+	hdcp_ctrl->hdcp_state = HDCP_STATE_AUTHENTICATING;
+	queue_work(hdmi->workq, &hdcp_ctrl->hdcp_auth_work);
+}
+
+static int msm_hdmi_hdcp_auth_prepare(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 link0_status;
+	u32 reg_val;
+	unsigned long flags;
+	int rc;
+
+	if (!hdcp_ctrl->aksv_valid) {
+		rc = msm_hdmi_hdcp_read_validate_aksv(hdcp_ctrl);
+		if (rc) {
+			pr_err("%s: ASKV validation failed\n", __func__);
+			hdcp_ctrl->hdcp_state = HDCP_STATE_NO_AKSV;
+			return -ENOTSUPP;
+		}
+		hdcp_ctrl->aksv_valid = true;
+	}
+
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	/* disable HDMI Encrypt */
+	reg_val = hdmi_read(hdmi, REG_HDMI_CTRL);
+	reg_val &= ~HDMI_CTRL_ENCRYPTED;
+	hdmi_write(hdmi, REG_HDMI_CTRL, reg_val);
+
+	/* Enabling Software DDC */
+	reg_val = hdmi_read(hdmi, REG_HDMI_DDC_ARBITRATION);
+	reg_val &= ~HDMI_DDC_ARBITRATION_HW_ARBITRATION;
+	hdmi_write(hdmi, REG_HDMI_DDC_ARBITRATION, reg_val);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	/*
+	 * Write AKSV read from QFPROM to the HDCP registers.
+	 * This step is needed for HDCP authentication and must be
+	 * written before enabling HDCP.
+	 */
+	hdmi_write(hdmi, REG_HDMI_HDCP_SW_LOWER_AKSV, hdcp_ctrl->aksv_lsb);
+	hdmi_write(hdmi, REG_HDMI_HDCP_SW_UPPER_AKSV, hdcp_ctrl->aksv_msb);
+
+	/*
+	 * HDCP setup prior to enabling HDCP_CTRL.
+	 * Setup seed values for random number An.
+	 */
+	hdmi_write(hdmi, REG_HDMI_HDCP_ENTROPY_CTRL0, 0xB1FFB0FF);
+	hdmi_write(hdmi, REG_HDMI_HDCP_ENTROPY_CTRL1, 0xF00DFACE);
+
+	/* Disable the RngCipher state */
+	reg_val = hdmi_read(hdmi, REG_HDMI_HDCP_DEBUG_CTRL);
+	reg_val &= ~HDMI_HDCP_DEBUG_CTRL_RNG_CIPHER;
+	hdmi_write(hdmi, REG_HDMI_HDCP_DEBUG_CTRL, reg_val);
+	DBG("HDCP_DEBUG_CTRL=0x%08x",
+		hdmi_read(hdmi, REG_HDMI_HDCP_DEBUG_CTRL));
+
+	/*
+	 * Ensure that all register writes are completed before
+	 * enabling HDCP cipher
+	 */
+	wmb();
+
+	/*
+	 * Enable HDCP
+	 * This needs to be done as early as possible in order for the
+	 * hardware to make An available to read
+	 */
+	hdmi_write(hdmi, REG_HDMI_HDCP_CTRL, HDMI_HDCP_CTRL_ENABLE);
+
+	/*
+	 * If we had stale values for the An ready bit, it should most
+	 * likely be cleared now after enabling HDCP cipher
+	 */
+	link0_status = hdmi_read(hdmi, REG_HDMI_HDCP_LINK0_STATUS);
+	DBG("After enabling HDCP Link0_Status=0x%08x", link0_status);
+	if (!(link0_status &
+		(HDMI_HDCP_LINK0_STATUS_AN_0_READY |
+		HDMI_HDCP_LINK0_STATUS_AN_1_READY)))
+		DBG("An not ready after enabling HDCP");
+
+	/* Clear any DDC failures from previous tries before enable HDCP*/
+	rc = msm_reset_hdcp_ddc_failures(hdcp_ctrl);
+
+	return rc;
+}
+
+static void msm_hdmi_hdcp_auth_fail(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 reg_val;
+	unsigned long flags;
+
+	DBG("hdcp auth failed, queue reauth work");
+	/* clear HDMI Encrypt */
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	reg_val = hdmi_read(hdmi, REG_HDMI_CTRL);
+	reg_val &= ~HDMI_CTRL_ENCRYPTED;
+	hdmi_write(hdmi, REG_HDMI_CTRL, reg_val);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	hdcp_ctrl->hdcp_state = HDCP_STATE_AUTH_FAILED;
+	queue_work(hdmi->workq, &hdcp_ctrl->hdcp_reauth_work);
+}
+
+static void msm_hdmi_hdcp_auth_done(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 reg_val;
+	unsigned long flags;
+
+	/*
+	 * Disable software DDC before going into part3 to make sure
+	 * there is no Arbitration between software and hardware for DDC
+	 */
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	reg_val = hdmi_read(hdmi, REG_HDMI_DDC_ARBITRATION);
+	reg_val |= HDMI_DDC_ARBITRATION_HW_ARBITRATION;
+	hdmi_write(hdmi, REG_HDMI_DDC_ARBITRATION, reg_val);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	/* enable HDMI Encrypt */
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	reg_val = hdmi_read(hdmi, REG_HDMI_CTRL);
+	reg_val |= HDMI_CTRL_ENCRYPTED;
+	hdmi_write(hdmi, REG_HDMI_CTRL, reg_val);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	hdcp_ctrl->hdcp_state = HDCP_STATE_AUTHENTICATED;
+	hdcp_ctrl->auth_retries = 0;
+}
+
+/*
+ * hdcp authenticating part 1
+ * Wait Key/An ready
+ * Read BCAPS from sink
+ * Write BCAPS and AKSV into HDCP engine
+ * Write An and AKSV to sink
+ * Read BKSV from sink and write into HDCP engine
+ */
+static int msm_hdmi_hdcp_wait_key_an_ready(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 link0_status, keys_state;
+	u32 timeout_count;
+	bool an_ready;
+
+	/* Wait for HDCP keys to be checked and validated */
+	timeout_count = 100;
+	do {
+		link0_status = hdmi_read(hdmi, REG_HDMI_HDCP_LINK0_STATUS);
+		keys_state = (link0_status >> 28) & 0x7;
+		if (keys_state == HDCP_KEYS_STATE_VALID)
+			break;
+
+		DBG("Keys not ready(%d). s=%d, l0=%0x08x",
+			timeout_count, keys_state, link0_status);
+
+		timeout_count--;
+		if (!timeout_count) {
+			pr_err("%s: Wait key state timedout", __func__);
+			return -ETIMEDOUT;
+		}
+
+		rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 20, AUTH_ABORT_EV);
+		if (rc)
+			return rc;
+	} while (1);
+
+	timeout_count = 100;
+	do {
+		link0_status = hdmi_read(hdmi, REG_HDMI_HDCP_LINK0_STATUS);
+		an_ready = (link0_status & HDMI_HDCP_LINK0_STATUS_AN_0_READY)
+			&& (link0_status & HDMI_HDCP_LINK0_STATUS_AN_1_READY);
+		if (an_ready)
+			break;
+
+		DBG("An not ready(%d). l0_status=0x%08x",
+			timeout_count, link0_status);
+
+		timeout_count--;
+		if (!timeout_count) {
+			pr_err("%s: Wait An timedout", __func__);
+			return -ETIMEDOUT;
+		}
+
+		rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 20, AUTH_ABORT_EV);
+		if (rc)
+			return rc;
+	} while (1);
+
+	return 0;
+}
+
+static int msm_hdmi_hdcp_send_aksv_an(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc = 0;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 link0_aksv_0, link0_aksv_1;
+	u32 link0_an[2];
+	u8 aksv[5];
+
+	/* Read An0 and An1 */
+	link0_an[0] = hdmi_read(hdmi, REG_HDMI_HDCP_RCVPORT_DATA5);
+	link0_an[1] = hdmi_read(hdmi, REG_HDMI_HDCP_RCVPORT_DATA6);
+
+	/* Read AKSV */
+	link0_aksv_0 = hdmi_read(hdmi, REG_HDMI_HDCP_RCVPORT_DATA3);
+	link0_aksv_1 = hdmi_read(hdmi, REG_HDMI_HDCP_RCVPORT_DATA4);
+
+	DBG("Link ASKV=%08x%08x", link0_aksv_0, link0_aksv_1);
+	/* Copy An and AKSV to byte arrays for transmission */
+	aksv[0] =  link0_aksv_0        & 0xFF;
+	aksv[1] = (link0_aksv_0 >> 8)  & 0xFF;
+	aksv[2] = (link0_aksv_0 >> 16) & 0xFF;
+	aksv[3] = (link0_aksv_0 >> 24) & 0xFF;
+	aksv[4] =  link0_aksv_1        & 0xFF;
+
+	/* Write An to offset 0x18 */
+	rc = msm_hdmi_ddc_write(hdmi, HDCP_PORT_ADDR, 0x18, (u8 *)link0_an,
+		(u16)sizeof(link0_an));
+	if (rc) {
+		pr_err("%s:An write failed\n", __func__);
+		return rc;
+	}
+	DBG("Link0-An=%08x%08x", link0_an[0], link0_an[1]);
+
+	/* Write AKSV to offset 0x10 */
+	rc = msm_hdmi_ddc_write(hdmi, HDCP_PORT_ADDR, 0x10, aksv, 5);
+	if (rc) {
+		pr_err("%s:AKSV write failed\n", __func__);
+		return rc;
+	}
+	DBG("Link0-AKSV=%02x%08x", link0_aksv_1 & 0xFF, link0_aksv_0);
+
+	return 0;
+}
+
+static int msm_hdmi_hdcp_recv_bksv(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc = 0;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u8 bksv[5];
+	u32 reg[2], data[2];
+
+	/* Read BKSV at offset 0x00 */
+	rc = msm_hdmi_ddc_read(hdmi, HDCP_PORT_ADDR, 0x00, bksv, 5);
+	if (rc) {
+		pr_err("%s:BKSV read failed\n", __func__);
+		return rc;
+	}
+
+	hdcp_ctrl->bksv_lsb = bksv[0] | (bksv[1] << 8) |
+		(bksv[2] << 16) | (bksv[3] << 24);
+	hdcp_ctrl->bksv_msb = bksv[4];
+	DBG(":BKSV=%02x%08x", hdcp_ctrl->bksv_msb, hdcp_ctrl->bksv_lsb);
+
+	/* check there are 20 ones in BKSV */
+	if ((hweight32(hdcp_ctrl->bksv_lsb) + hweight32(hdcp_ctrl->bksv_msb))
+			!= 20) {
+		pr_err(": BKSV doesn't have 20 1's and 20 0's\n");
+		pr_err(": BKSV chk fail. BKSV=%02x%02x%02x%02x%02x\n",
+			bksv[4], bksv[3], bksv[2], bksv[1], bksv[0]);
+		return -EINVAL;
+	}
+
+	/* Write BKSV read from sink to HDCP registers */
+	reg[0] = REG_HDMI_HDCP_RCVPORT_DATA0;
+	data[0] = hdcp_ctrl->bksv_lsb;
+	reg[1] = REG_HDMI_HDCP_RCVPORT_DATA1;
+	data[1] = hdcp_ctrl->bksv_msb;
+	rc = msm_hdmi_hdcp_scm_wr(hdcp_ctrl, reg, data, 2);
+
+	return rc;
+}
+
+static int msm_hdmi_hdcp_recv_bcaps(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc = 0;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 reg, data;
+	u8 bcaps;
+
+	rc = msm_hdmi_ddc_read(hdmi, HDCP_PORT_ADDR, 0x40, &bcaps, 1);
+	if (rc) {
+		pr_err("%s:BCAPS read failed\n", __func__);
+		return rc;
+	}
+	DBG("BCAPS=%02x", bcaps);
+
+	/* receiver (0), repeater (1) */
+	hdcp_ctrl->ds_type = (bcaps & BIT(6)) ? DS_REPEATER : DS_RECEIVER;
+
+	/* Write BCAPS to the hardware */
+	reg = REG_HDMI_HDCP_RCVPORT_DATA12;
+	data = (u32)bcaps;
+	rc = msm_hdmi_hdcp_scm_wr(hdcp_ctrl, &reg, &data, 1);
+
+	return rc;
+}
+
+static int msm_hdmi_hdcp_auth_part1_key_exchange(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	unsigned long flags;
+	int rc;
+
+	/* Wait for AKSV key and An ready */
+	rc = msm_hdmi_hdcp_wait_key_an_ready(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: wait key and an ready failed\n", __func__);
+		return rc;
+	}
+
+	/* Read BCAPS and send to HDCP engine */
+	rc = msm_hdmi_hdcp_recv_bcaps(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: read bcaps error, abort\n", __func__);
+		return rc;
+	}
+
+	/*
+	 * 1.1_Features turned off by default.
+	 * No need to write AInfo since 1.1_Features is disabled.
+	 */
+	hdmi_write(hdmi, REG_HDMI_HDCP_RCVPORT_DATA4, 0);
+
+	/* Send AKSV and An to sink */
+	rc = msm_hdmi_hdcp_send_aksv_an(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s:An/Aksv write failed\n", __func__);
+		return rc;
+	}
+
+	/* Read BKSV and send to HDCP engine*/
+	rc = msm_hdmi_hdcp_recv_bksv(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s:BKSV Process failed\n", __func__);
+		return rc;
+	}
+
+	/* Enable HDCP interrupts and ack/clear any stale interrupts */
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	hdmi_write(hdmi, REG_HDMI_HDCP_INT_CTRL,
+		HDMI_HDCP_INT_CTRL_AUTH_SUCCESS_ACK |
+		HDMI_HDCP_INT_CTRL_AUTH_SUCCESS_MASK |
+		HDMI_HDCP_INT_CTRL_AUTH_FAIL_ACK |
+		HDMI_HDCP_INT_CTRL_AUTH_FAIL_MASK |
+		HDMI_HDCP_INT_CTRL_AUTH_FAIL_INFO_ACK);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	return 0;
+}
+
+/* read R0' from sink and pass it to HDCP engine */
+static int msm_hdmi_hdcp_auth_part1_recv_r0(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	int rc = 0;
+	u8 buf[2];
+
+	/*
+	 * HDCP Compliance Test case 1A-01:
+	 * Wait here at least 100ms before reading R0'
+	 */
+	rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 125, AUTH_ABORT_EV);
+	if (rc)
+		return rc;
+
+	/* Read R0' at offset 0x08 */
+	rc = msm_hdmi_ddc_read(hdmi, HDCP_PORT_ADDR, 0x08, buf, 2);
+	if (rc) {
+		pr_err("%s:R0' read failed\n", __func__);
+		return rc;
+	}
+	DBG("R0'=%02x%02x", buf[1], buf[0]);
+
+	/* Write R0' to HDCP registers and check to see if it is a match */
+	hdmi_write(hdmi, REG_HDMI_HDCP_RCVPORT_DATA2_0,
+		(((u32)buf[1]) << 8) | buf[0]);
+
+	return 0;
+}
+
+/* Wait for authenticating result: R0/R0' are matched or not */
+static int msm_hdmi_hdcp_auth_part1_verify_r0(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 link0_status;
+	int rc;
+
+	/* wait for hdcp irq, 10 sec should be long enough */
+	rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 10000, AUTH_RESULT_RDY_EV);
+	if (!rc) {
+		pr_err("%s: Wait Auth IRQ timeout\n", __func__);
+		return -ETIMEDOUT;
+	}
+
+	link0_status = hdmi_read(hdmi, REG_HDMI_HDCP_LINK0_STATUS);
+	if (!(link0_status & HDMI_HDCP_LINK0_STATUS_RI_MATCHES)) {
+		pr_err("%s: Authentication Part I failed\n", __func__);
+		return -EINVAL;
+	}
+
+	/* Enable HDCP Encryption */
+	hdmi_write(hdmi, REG_HDMI_HDCP_CTRL,
+		HDMI_HDCP_CTRL_ENABLE |
+		HDMI_HDCP_CTRL_ENCRYPTION_ENABLE);
+
+	return 0;
+}
+
+static int msm_hdmi_hdcp_recv_check_bstatus(struct hdmi_hdcp_ctrl *hdcp_ctrl,
+	u16 *pbstatus)
+{
+	int rc;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	bool max_devs_exceeded = false, max_cascade_exceeded = false;
+	u32 repeater_cascade_depth = 0, down_stream_devices = 0;
+	u16 bstatus;
+	u8 buf[2];
+
+	/* Read BSTATUS at offset 0x41 */
+	rc = msm_hdmi_ddc_read(hdmi, HDCP_PORT_ADDR, 0x41, buf, 2);
+	if (rc) {
+		pr_err("%s: BSTATUS read failed\n", __func__);
+		goto error;
+	}
+	*pbstatus = bstatus = (buf[1] << 8) | buf[0];
+
+
+	down_stream_devices = bstatus & 0x7F;
+	repeater_cascade_depth = (bstatus >> 8) & 0x7;
+	max_devs_exceeded = (bstatus & BIT(7)) ? true : false;
+	max_cascade_exceeded = (bstatus & BIT(11)) ? true : false;
+
+	if (down_stream_devices == 0) {
+		/*
+		 * If no downstream devices are attached to the repeater
+		 * then part II fails.
+		 * todo: The other approach would be to continue PART II.
+		 */
+		pr_err("%s: No downstream devices\n", __func__);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	/*
+	 * HDCP Compliance 1B-05:
+	 * Check if no. of devices connected to repeater
+	 * exceed max_devices_connected from bit 7 of Bstatus.
+	 */
+	if (max_devs_exceeded) {
+		pr_err("%s: no. of devs connected exceeds max allowed",
+			__func__);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	/*
+	 * HDCP Compliance 1B-06:
+	 * Check if no. of cascade connected to repeater
+	 * exceed max_cascade_connected from bit 11 of Bstatus.
+	 */
+	if (max_cascade_exceeded) {
+		pr_err("%s: no. of cascade conn exceeds max allowed",
+			__func__);
+		rc = -EINVAL;
+		goto error;
+	}
+
+error:
+	hdcp_ctrl->dev_count = down_stream_devices;
+	hdcp_ctrl->max_cascade_exceeded = max_cascade_exceeded;
+	hdcp_ctrl->max_dev_exceeded = max_devs_exceeded;
+	hdcp_ctrl->depth = repeater_cascade_depth;
+	return rc;
+}
+
+static int msm_hdmi_hdcp_auth_part2_wait_ksv_fifo_ready(
+	struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 reg, data;
+	u32 timeout_count;
+	u16 bstatus;
+	u8 bcaps;
+
+	/*
+	 * Wait until READY bit is set in BCAPS, as per HDCP specifications
+	 * maximum permitted time to check for READY bit is five seconds.
+	 */
+	timeout_count = 100;
+	do {
+		/* Read BCAPS at offset 0x40 */
+		rc = msm_hdmi_ddc_read(hdmi, HDCP_PORT_ADDR, 0x40, &bcaps, 1);
+		if (rc) {
+			pr_err("%s: BCAPS read failed\n", __func__);
+			return rc;
+		}
+
+		if (bcaps & BIT(5))
+			break;
+
+		timeout_count--;
+		if (!timeout_count) {
+			pr_err("%s: Wait KSV fifo ready timedout", __func__);
+			return -ETIMEDOUT;
+		}
+
+		rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 20, AUTH_ABORT_EV);
+		if (rc)
+			return rc;
+	} while (1);
+
+	rc = msm_hdmi_hdcp_recv_check_bstatus(hdcp_ctrl, &bstatus);
+	if (rc) {
+		pr_err("%s: bstatus error\n", __func__);
+		return rc;
+	}
+
+	/* Write BSTATUS and BCAPS to HDCP registers */
+	reg = REG_HDMI_HDCP_RCVPORT_DATA12;
+	data = bcaps | (bstatus << 8);
+	rc = msm_hdmi_hdcp_scm_wr(hdcp_ctrl, &reg, &data, 1);
+	if (rc) {
+		pr_err("%s: BSTATUS write failed\n", __func__);
+		return rc;
+	}
+
+	return 0;
+}
+
+/*
+ * hdcp authenticating part 2: 2nd
+ * read ksv fifo from sink
+ * transfer V' from sink to HDCP engine
+ * reset SHA engine
+ */
+static int msm_hdmi_hdcp_transfer_v_h(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	int rc = 0;
+	struct hdmi_hdcp_reg_data reg_data[]  = {
+		{REG_HDMI_HDCP_RCVPORT_DATA7,  0x20, "V' H0"},
+		{REG_HDMI_HDCP_RCVPORT_DATA8,  0x24, "V' H1"},
+		{REG_HDMI_HDCP_RCVPORT_DATA9,  0x28, "V' H2"},
+		{REG_HDMI_HDCP_RCVPORT_DATA10, 0x2C, "V' H3"},
+		{REG_HDMI_HDCP_RCVPORT_DATA11, 0x30, "V' H4"},
+	};
+	struct hdmi_hdcp_reg_data *rd;
+	u32 size = ARRAY_SIZE(reg_data);
+	u32 reg[ARRAY_SIZE(reg_data)];
+	u32 data[ARRAY_SIZE(reg_data)];
+	int i;
+
+	for (i = 0; i < size; i++) {
+		rd = &reg_data[i];
+		rc = msm_hdmi_ddc_read(hdmi, HDCP_PORT_ADDR,
+			rd->off, (u8 *)&data[i], (u16)sizeof(data[i]));
+		if (rc) {
+			pr_err("%s: Read %s failed\n", __func__, rd->name);
+			goto error;
+		}
+
+		DBG("%s =%x", rd->name, data[i]);
+		reg[i] = reg_data[i].reg_id;
+	}
+
+	rc = msm_hdmi_hdcp_scm_wr(hdcp_ctrl, reg, data, size);
+
+error:
+	return rc;
+}
+
+static int msm_hdmi_hdcp_recv_ksv_fifo(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 ksv_bytes;
+
+	ksv_bytes = 5 * hdcp_ctrl->dev_count;
+
+	rc = msm_hdmi_ddc_read(hdmi, HDCP_PORT_ADDR, 0x43,
+		hdcp_ctrl->ksv_list, ksv_bytes);
+	if (rc)
+		pr_err("%s: KSV FIFO read failed\n", __func__);
+
+	return rc;
+}
+
+static int msm_hdmi_hdcp_reset_sha_engine(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	u32 reg[2], data[2];
+	u32 rc  = 0;
+
+	reg[0] = REG_HDMI_HDCP_SHA_CTRL;
+	data[0] = HDCP_REG_ENABLE;
+	reg[1] = REG_HDMI_HDCP_SHA_CTRL;
+	data[1] = HDCP_REG_DISABLE;
+
+	rc = msm_hdmi_hdcp_scm_wr(hdcp_ctrl, reg, data, 2);
+
+	return rc;
+}
+
+static int msm_hdmi_hdcp_auth_part2_recv_ksv_fifo(
+	struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc;
+	u32 timeout_count;
+
+	/*
+	 * Read KSV FIFO over DDC
+	 * Key Selection vector FIFO Used to pull downstream KSVs
+	 * from HDCP Repeaters.
+	 * All bytes (DEVICE_COUNT * 5) must be read in a single,
+	 * auto incrementing access.
+	 * All bytes read as 0x00 for HDCP Receivers that are not
+	 * HDCP Repeaters (REPEATER == 0).
+	 */
+	timeout_count = 100;
+	do {
+		rc = msm_hdmi_hdcp_recv_ksv_fifo(hdcp_ctrl);
+		if (!rc)
+			break;
+
+		timeout_count--;
+		if (!timeout_count) {
+			pr_err("%s: Recv ksv fifo timedout", __func__);
+			return -ETIMEDOUT;
+		}
+
+		rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 25, AUTH_ABORT_EV);
+		if (rc)
+			return rc;
+	} while (1);
+
+	rc = msm_hdmi_hdcp_transfer_v_h(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: transfer V failed\n", __func__);
+		return rc;
+	}
+
+	/* reset SHA engine before write ksv fifo */
+	rc = msm_hdmi_hdcp_reset_sha_engine(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: fail to reset sha engine\n", __func__);
+		return rc;
+	}
+
+	return 0;
+}
+
+/*
+ * Write KSV FIFO to HDCP_SHA_DATA.
+ * This is done 1 byte at time starting with the LSB.
+ * Once 64 bytes have been written, we need to poll for
+ * HDCP_SHA_BLOCK_DONE before writing any further
+ * If the last byte is written, we need to poll for
+ * HDCP_SHA_COMP_DONE to wait until HW finish
+ */
+static int msm_hdmi_hdcp_write_ksv_fifo(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int i;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 ksv_bytes, last_byte = 0;
+	u8 *ksv_fifo = NULL;
+	u32 reg_val, data, reg;
+	u32 rc  = 0;
+
+	ksv_bytes  = 5 * hdcp_ctrl->dev_count;
+
+	/* Check if need to wait for HW completion */
+	if (hdcp_ctrl->ksv_fifo_w_index) {
+		reg_val = hdmi_read(hdmi, REG_HDMI_HDCP_SHA_STATUS);
+		DBG("HDCP_SHA_STATUS=%08x", reg_val);
+		if (hdcp_ctrl->ksv_fifo_w_index == ksv_bytes) {
+			/* check COMP_DONE if last write */
+			if (reg_val & HDMI_HDCP_SHA_STATUS_COMP_DONE) {
+				DBG("COMP_DONE");
+				return 0;
+			} else {
+				return -EAGAIN;
+			}
+		} else {
+			/* check BLOCK_DONE if not last write */
+			if (!(reg_val & HDMI_HDCP_SHA_STATUS_BLOCK_DONE))
+				return -EAGAIN;
+
+			DBG("BLOCK_DONE");
+		}
+	}
+
+	ksv_bytes  -= hdcp_ctrl->ksv_fifo_w_index;
+	if (ksv_bytes <= 64)
+		last_byte = 1;
+	else
+		ksv_bytes = 64;
+
+	ksv_fifo = hdcp_ctrl->ksv_list;
+	ksv_fifo += hdcp_ctrl->ksv_fifo_w_index;
+
+	for (i = 0; i < ksv_bytes; i++) {
+		/* Write KSV byte and set DONE bit[0] for last byte*/
+		reg_val = ksv_fifo[i] << 16;
+		if ((i == (ksv_bytes - 1)) && last_byte)
+			reg_val |= HDMI_HDCP_SHA_DATA_DONE;
+
+		reg = REG_HDMI_HDCP_SHA_DATA;
+		data = reg_val;
+		rc = msm_hdmi_hdcp_scm_wr(hdcp_ctrl, &reg, &data, 1);
+
+		if (rc)
+			return rc;
+	}
+
+	hdcp_ctrl->ksv_fifo_w_index += ksv_bytes;
+
+	/*
+	 *return -EAGAIN to notify caller to wait for COMP_DONE or BLOCK_DONE
+	 */
+	return -EAGAIN;
+}
+
+/* write ksv fifo into HDCP engine */
+static int msm_hdmi_hdcp_auth_part2_write_ksv_fifo(
+	struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc;
+	u32 timeout_count;
+
+	hdcp_ctrl->ksv_fifo_w_index = 0;
+	timeout_count = 100;
+	do {
+		rc = msm_hdmi_hdcp_write_ksv_fifo(hdcp_ctrl);
+		if (!rc)
+			break;
+
+		if (rc != -EAGAIN)
+			return rc;
+
+		timeout_count--;
+		if (!timeout_count) {
+			pr_err("%s: Write KSV fifo timedout", __func__);
+			return -ETIMEDOUT;
+		}
+
+		rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 20, AUTH_ABORT_EV);
+		if (rc)
+			return rc;
+	} while (1);
+
+	return 0;
+}
+
+static int msm_hdmi_hdcp_auth_part2_check_v_match(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	int rc = 0;
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 link0_status;
+	u32 timeout_count = 100;
+
+	do {
+		link0_status = hdmi_read(hdmi, REG_HDMI_HDCP_LINK0_STATUS);
+		if (link0_status & HDMI_HDCP_LINK0_STATUS_V_MATCHES)
+			break;
+
+		timeout_count--;
+		if (!timeout_count) {
+				pr_err("%s: HDCP V Match timedout", __func__);
+				return -ETIMEDOUT;
+		}
+
+		rc = msm_hdmi_hdcp_msleep(hdcp_ctrl, 20, AUTH_ABORT_EV);
+		if (rc)
+			return rc;
+	} while (1);
+
+	return 0;
+}
+
+static void msm_hdmi_hdcp_auth_work(struct work_struct *work)
+{
+	struct hdmi_hdcp_ctrl *hdcp_ctrl = container_of(work,
+		struct hdmi_hdcp_ctrl, hdcp_auth_work);
+	int rc;
+
+	rc = msm_hdmi_hdcp_auth_prepare(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: auth prepare failed %d\n", __func__, rc);
+		goto end;
+	}
+
+	/* HDCP PartI */
+	rc = msm_hdmi_hdcp_auth_part1_key_exchange(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: key exchange failed %d\n", __func__, rc);
+		goto end;
+	}
+
+	rc = msm_hdmi_hdcp_auth_part1_recv_r0(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: receive r0 failed %d\n", __func__, rc);
+		goto end;
+	}
+
+	rc = msm_hdmi_hdcp_auth_part1_verify_r0(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: verify r0 failed %d\n", __func__, rc);
+		goto end;
+	}
+	pr_info("%s: Authentication Part I successful\n", __func__);
+	if (hdcp_ctrl->ds_type == DS_RECEIVER)
+		goto end;
+
+	/* HDCP PartII */
+	rc = msm_hdmi_hdcp_auth_part2_wait_ksv_fifo_ready(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: wait ksv fifo ready failed %d\n", __func__, rc);
+		goto end;
+	}
+
+	rc = msm_hdmi_hdcp_auth_part2_recv_ksv_fifo(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: recv ksv fifo failed %d\n", __func__, rc);
+		goto end;
+	}
+
+	rc = msm_hdmi_hdcp_auth_part2_write_ksv_fifo(hdcp_ctrl);
+	if (rc) {
+		pr_err("%s: write ksv fifo failed %d\n", __func__, rc);
+		goto end;
+	}
+
+	rc = msm_hdmi_hdcp_auth_part2_check_v_match(hdcp_ctrl);
+	if (rc)
+		pr_err("%s: check v match failed %d\n", __func__, rc);
+
+end:
+	if (rc == -ECANCELED) {
+		pr_info("%s: hdcp authentication canceled\n", __func__);
+	} else if (rc == -ENOTSUPP) {
+		pr_info("%s: hdcp is not supported\n", __func__);
+	} else if (rc) {
+		pr_err("%s: hdcp authentication failed\n", __func__);
+		msm_hdmi_hdcp_auth_fail(hdcp_ctrl);
+	} else {
+		msm_hdmi_hdcp_auth_done(hdcp_ctrl);
+	}
+}
+
+void msm_hdmi_hdcp_on(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	u32 reg_val;
+	unsigned long flags;
+
+	if ((HDCP_STATE_INACTIVE != hdcp_ctrl->hdcp_state) ||
+		(HDCP_STATE_NO_AKSV == hdcp_ctrl->hdcp_state)) {
+		DBG("still active or activating or no askv. returning");
+		return;
+	}
+
+	/* clear HDMI Encrypt */
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	reg_val = hdmi_read(hdmi, REG_HDMI_CTRL);
+	reg_val &= ~HDMI_CTRL_ENCRYPTED;
+	hdmi_write(hdmi, REG_HDMI_CTRL, reg_val);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	hdcp_ctrl->auth_event = 0;
+	hdcp_ctrl->hdcp_state = HDCP_STATE_AUTHENTICATING;
+	hdcp_ctrl->auth_retries = 0;
+	queue_work(hdmi->workq, &hdcp_ctrl->hdcp_auth_work);
+}
+
+void msm_hdmi_hdcp_off(struct hdmi_hdcp_ctrl *hdcp_ctrl)
+{
+	struct hdmi *hdmi = hdcp_ctrl->hdmi;
+	unsigned long flags;
+	u32 reg_val;
+
+	if ((HDCP_STATE_INACTIVE == hdcp_ctrl->hdcp_state) ||
+		(HDCP_STATE_NO_AKSV == hdcp_ctrl->hdcp_state)) {
+		DBG("hdcp inactive or no aksv. returning");
+		return;
+	}
+
+	/*
+	 * Disable HPD circuitry.
+	 * This is needed to reset the HDCP cipher engine so that when we
+	 * attempt a re-authentication, HW would clear the AN0_READY and
+	 * AN1_READY bits in HDMI_HDCP_LINK0_STATUS register
+	 */
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	reg_val = hdmi_read(hdmi, REG_HDMI_HPD_CTRL);
+	reg_val &= ~HDMI_HPD_CTRL_ENABLE;
+	hdmi_write(hdmi, REG_HDMI_HPD_CTRL, reg_val);
+
+	/*
+	 * Disable HDCP interrupts.
+	 * Also, need to set the state to inactive here so that any ongoing
+	 * reauth works will know that the HDCP session has been turned off.
+	 */
+	hdmi_write(hdmi, REG_HDMI_HDCP_INT_CTRL, 0);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	/*
+	 * Cancel any pending auth/reauth attempts.
+	 * If one is ongoing, this will wait for it to finish.
+	 * No more reauthentication attempts will be scheduled since we
+	 * set the current state to inactive.
+	 */
+	set_bit(AUTH_ABORT_EV, &hdcp_ctrl->auth_event);
+	wake_up_all(&hdcp_ctrl->auth_event_queue);
+	cancel_work_sync(&hdcp_ctrl->hdcp_auth_work);
+	cancel_work_sync(&hdcp_ctrl->hdcp_reauth_work);
+
+	hdmi_write(hdmi, REG_HDMI_HDCP_RESET,
+		HDMI_HDCP_RESET_LINK0_DEAUTHENTICATE);
+
+	/* Disable encryption and disable the HDCP block */
+	hdmi_write(hdmi, REG_HDMI_HDCP_CTRL, 0);
+
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	reg_val = hdmi_read(hdmi, REG_HDMI_CTRL);
+	reg_val &= ~HDMI_CTRL_ENCRYPTED;
+	hdmi_write(hdmi, REG_HDMI_CTRL, reg_val);
+
+	/* Enable HPD circuitry */
+	reg_val = hdmi_read(hdmi, REG_HDMI_HPD_CTRL);
+	reg_val |= HDMI_HPD_CTRL_ENABLE;
+	hdmi_write(hdmi, REG_HDMI_HPD_CTRL, reg_val);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	hdcp_ctrl->hdcp_state = HDCP_STATE_INACTIVE;
+
+	DBG("HDCP: Off");
+}
+
+struct hdmi_hdcp_ctrl *msm_hdmi_hdcp_init(struct hdmi *hdmi)
+{
+	struct hdmi_hdcp_ctrl *hdcp_ctrl = NULL;
+
+	if (!hdmi->qfprom_mmio) {
+		pr_err("%s: HDCP is not supported without qfprom\n",
+			__func__);
+		return ERR_PTR(-EINVAL);
+	}
+
+	hdcp_ctrl = kzalloc(sizeof(*hdcp_ctrl), GFP_KERNEL);
+	if (!hdcp_ctrl)
+		return ERR_PTR(-ENOMEM);
+
+	INIT_WORK(&hdcp_ctrl->hdcp_auth_work, msm_hdmi_hdcp_auth_work);
+	INIT_WORK(&hdcp_ctrl->hdcp_reauth_work, msm_hdmi_hdcp_reauth_work);
+	init_waitqueue_head(&hdcp_ctrl->auth_event_queue);
+	hdcp_ctrl->hdmi = hdmi;
+	hdcp_ctrl->hdcp_state = HDCP_STATE_INACTIVE;
+	hdcp_ctrl->aksv_valid = false;
+
+	if (qcom_scm_hdcp_available())
+		hdcp_ctrl->tz_hdcp = true;
+	else
+		hdcp_ctrl->tz_hdcp = false;
+
+	return hdcp_ctrl;
+}
+
+void msm_hdmi_hdcp_destroy(struct hdmi *hdmi)
+{
+	if (hdmi) {
+		kfree(hdmi->hdcp_ctrl);
+		hdmi->hdcp_ctrl = NULL;
+	}
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_hpd.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_hpd.c
@@ -0,0 +1,262 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/delay.h>
+#include <linux/gpio/consumer.h>
+#include <linux/pinctrl/consumer.h>
+
+#include "msm_kms.h"
+#include "hdmi.h"
+
+static void msm_hdmi_phy_reset(struct hdmi *hdmi)
+{
+	unsigned int val;
+
+	val = hdmi_read(hdmi, REG_HDMI_PHY_CTRL);
+
+	if (val & HDMI_PHY_CTRL_SW_RESET_LOW) {
+		/* pull low */
+		hdmi_write(hdmi, REG_HDMI_PHY_CTRL,
+				val & ~HDMI_PHY_CTRL_SW_RESET);
+	} else {
+		/* pull high */
+		hdmi_write(hdmi, REG_HDMI_PHY_CTRL,
+				val | HDMI_PHY_CTRL_SW_RESET);
+	}
+
+	if (val & HDMI_PHY_CTRL_SW_RESET_PLL_LOW) {
+		/* pull low */
+		hdmi_write(hdmi, REG_HDMI_PHY_CTRL,
+				val & ~HDMI_PHY_CTRL_SW_RESET_PLL);
+	} else {
+		/* pull high */
+		hdmi_write(hdmi, REG_HDMI_PHY_CTRL,
+				val | HDMI_PHY_CTRL_SW_RESET_PLL);
+	}
+
+	msleep(100);
+
+	if (val & HDMI_PHY_CTRL_SW_RESET_LOW) {
+		/* pull high */
+		hdmi_write(hdmi, REG_HDMI_PHY_CTRL,
+				val | HDMI_PHY_CTRL_SW_RESET);
+	} else {
+		/* pull low */
+		hdmi_write(hdmi, REG_HDMI_PHY_CTRL,
+				val & ~HDMI_PHY_CTRL_SW_RESET);
+	}
+
+	if (val & HDMI_PHY_CTRL_SW_RESET_PLL_LOW) {
+		/* pull high */
+		hdmi_write(hdmi, REG_HDMI_PHY_CTRL,
+				val | HDMI_PHY_CTRL_SW_RESET_PLL);
+	} else {
+		/* pull low */
+		hdmi_write(hdmi, REG_HDMI_PHY_CTRL,
+				val & ~HDMI_PHY_CTRL_SW_RESET_PLL);
+	}
+}
+
+static void enable_hpd_clocks(struct hdmi *hdmi, bool enable)
+{
+	const struct hdmi_platform_config *config = hdmi->config;
+	struct device *dev = &hdmi->pdev->dev;
+	int i, ret;
+
+	if (enable) {
+		for (i = 0; i < config->hpd_clk_cnt; i++) {
+			if (config->hpd_freq && config->hpd_freq[i]) {
+				ret = clk_set_rate(hdmi->hpd_clks[i],
+						   config->hpd_freq[i]);
+				if (ret)
+					dev_warn(dev,
+						 "failed to set clk %s (%d)\n",
+						 config->hpd_clk_names[i], ret);
+			}
+
+			ret = clk_prepare_enable(hdmi->hpd_clks[i]);
+			if (ret) {
+				DRM_DEV_ERROR(dev,
+					"failed to enable hpd clk: %s (%d)\n",
+					config->hpd_clk_names[i], ret);
+			}
+		}
+	} else {
+		for (i = config->hpd_clk_cnt - 1; i >= 0; i--)
+			clk_disable_unprepare(hdmi->hpd_clks[i]);
+	}
+}
+
+int msm_hdmi_hpd_enable(struct drm_bridge *bridge)
+{
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	const struct hdmi_platform_config *config = hdmi->config;
+	struct device *dev = &hdmi->pdev->dev;
+	uint32_t hpd_ctrl;
+	int ret;
+	unsigned long flags;
+
+	ret = regulator_bulk_enable(config->hpd_reg_cnt, hdmi->hpd_regs);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to enable hpd regulators: %d\n", ret);
+		goto fail;
+	}
+
+	ret = pinctrl_pm_select_default_state(dev);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "pinctrl state chg failed: %d\n", ret);
+		goto fail;
+	}
+
+	if (hdmi->hpd_gpiod)
+		gpiod_set_value_cansleep(hdmi->hpd_gpiod, 1);
+
+	pm_runtime_get_sync(dev);
+	enable_hpd_clocks(hdmi, true);
+
+	msm_hdmi_set_mode(hdmi, false);
+	msm_hdmi_phy_reset(hdmi);
+	msm_hdmi_set_mode(hdmi, true);
+
+	hdmi_write(hdmi, REG_HDMI_USEC_REFTIMER, 0x0001001b);
+
+	/* enable HPD events: */
+	hdmi_write(hdmi, REG_HDMI_HPD_INT_CTRL,
+			HDMI_HPD_INT_CTRL_INT_CONNECT |
+			HDMI_HPD_INT_CTRL_INT_EN);
+
+	/* set timeout to 4.1ms (max) for hardware debounce */
+	spin_lock_irqsave(&hdmi->reg_lock, flags);
+	hpd_ctrl = hdmi_read(hdmi, REG_HDMI_HPD_CTRL);
+	hpd_ctrl |= HDMI_HPD_CTRL_TIMEOUT(0x1fff);
+
+	/* Toggle HPD circuit to trigger HPD sense */
+	hdmi_write(hdmi, REG_HDMI_HPD_CTRL,
+			~HDMI_HPD_CTRL_ENABLE & hpd_ctrl);
+	hdmi_write(hdmi, REG_HDMI_HPD_CTRL,
+			HDMI_HPD_CTRL_ENABLE | hpd_ctrl);
+	spin_unlock_irqrestore(&hdmi->reg_lock, flags);
+
+	return 0;
+
+fail:
+	return ret;
+}
+
+void msm_hdmi_hpd_disable(struct hdmi *hdmi)
+{
+	const struct hdmi_platform_config *config = hdmi->config;
+	struct device *dev = &hdmi->pdev->dev;
+	int ret;
+
+	/* Disable HPD interrupt */
+	hdmi_write(hdmi, REG_HDMI_HPD_INT_CTRL, 0);
+
+	msm_hdmi_set_mode(hdmi, false);
+
+	enable_hpd_clocks(hdmi, false);
+	pm_runtime_put(dev);
+
+	ret = pinctrl_pm_select_sleep_state(dev);
+	if (ret)
+		dev_warn(dev, "pinctrl state chg failed: %d\n", ret);
+
+	ret = regulator_bulk_disable(config->hpd_reg_cnt, hdmi->hpd_regs);
+	if (ret)
+		dev_warn(dev, "failed to disable hpd regulator: %d\n", ret);
+}
+
+void msm_hdmi_hpd_irq(struct drm_bridge *bridge)
+{
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	uint32_t hpd_int_status, hpd_int_ctrl;
+
+	/* Process HPD: */
+	hpd_int_status = hdmi_read(hdmi, REG_HDMI_HPD_INT_STATUS);
+	hpd_int_ctrl   = hdmi_read(hdmi, REG_HDMI_HPD_INT_CTRL);
+
+	if ((hpd_int_ctrl & HDMI_HPD_INT_CTRL_INT_EN) &&
+			(hpd_int_status & HDMI_HPD_INT_STATUS_INT)) {
+		bool detected = !!(hpd_int_status & HDMI_HPD_INT_STATUS_CABLE_DETECTED);
+
+		/* ack & disable (temporarily) HPD events: */
+		hdmi_write(hdmi, REG_HDMI_HPD_INT_CTRL,
+			HDMI_HPD_INT_CTRL_INT_ACK);
+
+		DBG("status=%04x, ctrl=%04x", hpd_int_status, hpd_int_ctrl);
+
+		/* detect disconnect if we are connected or visa versa: */
+		hpd_int_ctrl = HDMI_HPD_INT_CTRL_INT_EN;
+		if (!detected)
+			hpd_int_ctrl |= HDMI_HPD_INT_CTRL_INT_CONNECT;
+		hdmi_write(hdmi, REG_HDMI_HPD_INT_CTRL, hpd_int_ctrl);
+
+		queue_work(hdmi->workq, &hdmi_bridge->hpd_work);
+	}
+}
+
+static enum drm_connector_status detect_reg(struct hdmi *hdmi)
+{
+	uint32_t hpd_int_status;
+
+	pm_runtime_get_sync(&hdmi->pdev->dev);
+	enable_hpd_clocks(hdmi, true);
+
+	hpd_int_status = hdmi_read(hdmi, REG_HDMI_HPD_INT_STATUS);
+
+	enable_hpd_clocks(hdmi, false);
+	pm_runtime_put(&hdmi->pdev->dev);
+
+	return (hpd_int_status & HDMI_HPD_INT_STATUS_CABLE_DETECTED) ?
+			connector_status_connected : connector_status_disconnected;
+}
+
+#define HPD_GPIO_INDEX	2
+static enum drm_connector_status detect_gpio(struct hdmi *hdmi)
+{
+	return gpiod_get_value(hdmi->hpd_gpiod) ?
+			connector_status_connected :
+			connector_status_disconnected;
+}
+
+enum drm_connector_status msm_hdmi_bridge_detect(
+		struct drm_bridge *bridge)
+{
+	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
+	struct hdmi *hdmi = hdmi_bridge->hdmi;
+	enum drm_connector_status stat_gpio, stat_reg;
+	int retry = 20;
+
+	/*
+	 * some platforms may not have hpd gpio. Rely only on the status
+	 * provided by REG_HDMI_HPD_INT_STATUS in this case.
+	 */
+	if (!hdmi->hpd_gpiod)
+		return detect_reg(hdmi);
+
+	do {
+		stat_gpio = detect_gpio(hdmi);
+		stat_reg  = detect_reg(hdmi);
+
+		if (stat_gpio == stat_reg)
+			break;
+
+		mdelay(10);
+	} while (--retry);
+
+	/* the status we get from reading gpio seems to be more reliable,
+	 * so trust that one the most if we didn't manage to get hdmi and
+	 * gpio status to agree:
+	 */
+	if (stat_gpio != stat_reg) {
+		DBG("HDMI_HPD_INT_STATUS tells us: %d", stat_reg);
+		DBG("hpd gpio tells us: %d", stat_gpio);
+	}
+
+	return stat_gpio;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_i2c.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_i2c.c
@@ -0,0 +1,266 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include "hdmi.h"
+
+struct hdmi_i2c_adapter {
+	struct i2c_adapter base;
+	struct hdmi *hdmi;
+	bool sw_done;
+	wait_queue_head_t ddc_event;
+};
+#define to_hdmi_i2c_adapter(x) container_of(x, struct hdmi_i2c_adapter, base)
+
+static void init_ddc(struct hdmi_i2c_adapter *hdmi_i2c)
+{
+	struct hdmi *hdmi = hdmi_i2c->hdmi;
+
+	hdmi_write(hdmi, REG_HDMI_DDC_CTRL,
+			HDMI_DDC_CTRL_SW_STATUS_RESET);
+	hdmi_write(hdmi, REG_HDMI_DDC_CTRL,
+			HDMI_DDC_CTRL_SOFT_RESET);
+
+	hdmi_write(hdmi, REG_HDMI_DDC_SPEED,
+			HDMI_DDC_SPEED_THRESHOLD(2) |
+			HDMI_DDC_SPEED_PRESCALE(10));
+
+	hdmi_write(hdmi, REG_HDMI_DDC_SETUP,
+			HDMI_DDC_SETUP_TIMEOUT(0xff));
+
+	/* enable reference timer for 27us */
+	hdmi_write(hdmi, REG_HDMI_DDC_REF,
+			HDMI_DDC_REF_REFTIMER_ENABLE |
+			HDMI_DDC_REF_REFTIMER(27));
+}
+
+static int ddc_clear_irq(struct hdmi_i2c_adapter *hdmi_i2c)
+{
+	struct hdmi *hdmi = hdmi_i2c->hdmi;
+	struct drm_device *dev = hdmi->dev;
+	uint32_t retry = 0xffff;
+	uint32_t ddc_int_ctrl;
+
+	do {
+		--retry;
+
+		hdmi_write(hdmi, REG_HDMI_DDC_INT_CTRL,
+				HDMI_DDC_INT_CTRL_SW_DONE_ACK |
+				HDMI_DDC_INT_CTRL_SW_DONE_MASK);
+
+		ddc_int_ctrl = hdmi_read(hdmi, REG_HDMI_DDC_INT_CTRL);
+
+	} while ((ddc_int_ctrl & HDMI_DDC_INT_CTRL_SW_DONE_INT) && retry);
+
+	if (!retry) {
+		DRM_DEV_ERROR(dev->dev, "timeout waiting for DDC\n");
+		return -ETIMEDOUT;
+	}
+
+	hdmi_i2c->sw_done = false;
+
+	return 0;
+}
+
+#define MAX_TRANSACTIONS 4
+
+static bool sw_done(struct hdmi_i2c_adapter *hdmi_i2c)
+{
+	struct hdmi *hdmi = hdmi_i2c->hdmi;
+
+	if (!hdmi_i2c->sw_done) {
+		uint32_t ddc_int_ctrl;
+
+		ddc_int_ctrl = hdmi_read(hdmi, REG_HDMI_DDC_INT_CTRL);
+
+		if ((ddc_int_ctrl & HDMI_DDC_INT_CTRL_SW_DONE_MASK) &&
+				(ddc_int_ctrl & HDMI_DDC_INT_CTRL_SW_DONE_INT)) {
+			hdmi_i2c->sw_done = true;
+			hdmi_write(hdmi, REG_HDMI_DDC_INT_CTRL,
+					HDMI_DDC_INT_CTRL_SW_DONE_ACK);
+		}
+	}
+
+	return hdmi_i2c->sw_done;
+}
+
+static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c,
+		struct i2c_msg *msgs, int num)
+{
+	struct hdmi_i2c_adapter *hdmi_i2c = to_hdmi_i2c_adapter(i2c);
+	struct hdmi *hdmi = hdmi_i2c->hdmi;
+	struct drm_device *dev = hdmi->dev;
+	static const uint32_t nack[] = {
+			HDMI_DDC_SW_STATUS_NACK0, HDMI_DDC_SW_STATUS_NACK1,
+			HDMI_DDC_SW_STATUS_NACK2, HDMI_DDC_SW_STATUS_NACK3,
+	};
+	int indices[MAX_TRANSACTIONS];
+	int ret, i, j, index = 0;
+	uint32_t ddc_status, ddc_data, i2c_trans;
+
+	num = min(num, MAX_TRANSACTIONS);
+
+	WARN_ON(!(hdmi_read(hdmi, REG_HDMI_CTRL) & HDMI_CTRL_ENABLE));
+
+	if (num == 0)
+		return num;
+
+	init_ddc(hdmi_i2c);
+
+	ret = ddc_clear_irq(hdmi_i2c);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < num; i++) {
+		struct i2c_msg *p = &msgs[i];
+		uint32_t raw_addr = p->addr << 1;
+
+		if (p->flags & I2C_M_RD)
+			raw_addr |= 1;
+
+		ddc_data = HDMI_DDC_DATA_DATA(raw_addr) |
+				HDMI_DDC_DATA_DATA_RW(DDC_WRITE);
+
+		if (i == 0) {
+			ddc_data |= HDMI_DDC_DATA_INDEX(0) |
+					HDMI_DDC_DATA_INDEX_WRITE;
+		}
+
+		hdmi_write(hdmi, REG_HDMI_DDC_DATA, ddc_data);
+		index++;
+
+		indices[i] = index;
+
+		if (p->flags & I2C_M_RD) {
+			index += p->len;
+		} else {
+			for (j = 0; j < p->len; j++) {
+				ddc_data = HDMI_DDC_DATA_DATA(p->buf[j]) |
+						HDMI_DDC_DATA_DATA_RW(DDC_WRITE);
+				hdmi_write(hdmi, REG_HDMI_DDC_DATA, ddc_data);
+				index++;
+			}
+		}
+
+		i2c_trans = HDMI_I2C_TRANSACTION_REG_CNT(p->len) |
+				HDMI_I2C_TRANSACTION_REG_RW(
+						(p->flags & I2C_M_RD) ? DDC_READ : DDC_WRITE) |
+				HDMI_I2C_TRANSACTION_REG_START;
+
+		if (i == (num - 1))
+			i2c_trans |= HDMI_I2C_TRANSACTION_REG_STOP;
+
+		hdmi_write(hdmi, REG_HDMI_I2C_TRANSACTION(i), i2c_trans);
+	}
+
+	/* trigger the transfer: */
+	hdmi_write(hdmi, REG_HDMI_DDC_CTRL,
+			HDMI_DDC_CTRL_TRANSACTION_CNT(num - 1) |
+			HDMI_DDC_CTRL_GO);
+
+	ret = wait_event_timeout(hdmi_i2c->ddc_event, sw_done(hdmi_i2c), HZ/4);
+	if (ret <= 0) {
+		if (ret == 0)
+			ret = -ETIMEDOUT;
+		dev_warn(dev->dev, "DDC timeout: %d\n", ret);
+		DBG("sw_status=%08x, hw_status=%08x, int_ctrl=%08x",
+				hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS),
+				hdmi_read(hdmi, REG_HDMI_DDC_HW_STATUS),
+				hdmi_read(hdmi, REG_HDMI_DDC_INT_CTRL));
+		return ret;
+	}
+
+	ddc_status = hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS);
+
+	/* read back results of any read transactions: */
+	for (i = 0; i < num; i++) {
+		struct i2c_msg *p = &msgs[i];
+
+		if (!(p->flags & I2C_M_RD))
+			continue;
+
+		/* check for NACK: */
+		if (ddc_status & nack[i]) {
+			DBG("ddc_status=%08x", ddc_status);
+			break;
+		}
+
+		ddc_data = HDMI_DDC_DATA_DATA_RW(DDC_READ) |
+				HDMI_DDC_DATA_INDEX(indices[i]) |
+				HDMI_DDC_DATA_INDEX_WRITE;
+
+		hdmi_write(hdmi, REG_HDMI_DDC_DATA, ddc_data);
+
+		/* discard first byte: */
+		hdmi_read(hdmi, REG_HDMI_DDC_DATA);
+
+		for (j = 0; j < p->len; j++) {
+			ddc_data = hdmi_read(hdmi, REG_HDMI_DDC_DATA);
+			p->buf[j] = FIELD(ddc_data, HDMI_DDC_DATA_DATA);
+		}
+	}
+
+	return i;
+}
+
+static u32 msm_hdmi_i2c_func(struct i2c_adapter *adapter)
+{
+	return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
+}
+
+static const struct i2c_algorithm msm_hdmi_i2c_algorithm = {
+	.master_xfer	= msm_hdmi_i2c_xfer,
+	.functionality	= msm_hdmi_i2c_func,
+};
+
+void msm_hdmi_i2c_irq(struct i2c_adapter *i2c)
+{
+	struct hdmi_i2c_adapter *hdmi_i2c = to_hdmi_i2c_adapter(i2c);
+
+	if (sw_done(hdmi_i2c))
+		wake_up_all(&hdmi_i2c->ddc_event);
+}
+
+void msm_hdmi_i2c_destroy(struct i2c_adapter *i2c)
+{
+	struct hdmi_i2c_adapter *hdmi_i2c = to_hdmi_i2c_adapter(i2c);
+	i2c_del_adapter(i2c);
+	kfree(hdmi_i2c);
+}
+
+struct i2c_adapter *msm_hdmi_i2c_init(struct hdmi *hdmi)
+{
+	struct hdmi_i2c_adapter *hdmi_i2c;
+	struct i2c_adapter *i2c = NULL;
+	int ret;
+
+	hdmi_i2c = kzalloc(sizeof(*hdmi_i2c), GFP_KERNEL);
+	if (!hdmi_i2c) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	i2c = &hdmi_i2c->base;
+
+	hdmi_i2c->hdmi = hdmi;
+	init_waitqueue_head(&hdmi_i2c->ddc_event);
+
+
+	i2c->owner = THIS_MODULE;
+	snprintf(i2c->name, sizeof(i2c->name), "msm hdmi i2c");
+	i2c->dev.parent = &hdmi->pdev->dev;
+	i2c->algo = &msm_hdmi_i2c_algorithm;
+
+	ret = i2c_add_adapter(i2c);
+	if (ret)
+		goto fail;
+
+	return i2c;
+
+fail:
+	if (i2c)
+		msm_hdmi_i2c_destroy(i2c);
+	return ERR_PTR(ret);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_phy.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_phy.c
@@ -0,0 +1,221 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include "hdmi.h"
+
+static int msm_hdmi_phy_resource_init(struct hdmi_phy *phy)
+{
+	struct hdmi_phy_cfg *cfg = phy->cfg;
+	struct device *dev = &phy->pdev->dev;
+	int i, ret;
+
+	phy->regs = devm_kcalloc(dev, cfg->num_regs, sizeof(phy->regs[0]),
+				 GFP_KERNEL);
+	if (!phy->regs)
+		return -ENOMEM;
+
+	phy->clks = devm_kcalloc(dev, cfg->num_clks, sizeof(phy->clks[0]),
+				 GFP_KERNEL);
+	if (!phy->clks)
+		return -ENOMEM;
+
+	for (i = 0; i < cfg->num_regs; i++)
+		phy->regs[i].supply = cfg->reg_names[i];
+
+	ret = devm_regulator_bulk_get(dev, cfg->num_regs, phy->regs);
+	if (ret) {
+		if (ret != -EPROBE_DEFER)
+			DRM_DEV_ERROR(dev, "failed to get phy regulators: %d\n", ret);
+
+		return ret;
+	}
+
+	for (i = 0; i < cfg->num_clks; i++) {
+		struct clk *clk;
+
+		clk = msm_clk_get(phy->pdev, cfg->clk_names[i]);
+		if (IS_ERR(clk)) {
+			ret = PTR_ERR(clk);
+			DRM_DEV_ERROR(dev, "failed to get phy clock: %s (%d)\n",
+				cfg->clk_names[i], ret);
+			return ret;
+		}
+
+		phy->clks[i] = clk;
+	}
+
+	return 0;
+}
+
+int msm_hdmi_phy_resource_enable(struct hdmi_phy *phy)
+{
+	struct hdmi_phy_cfg *cfg = phy->cfg;
+	struct device *dev = &phy->pdev->dev;
+	int i, ret = 0;
+
+	pm_runtime_get_sync(dev);
+
+	ret = regulator_bulk_enable(cfg->num_regs, phy->regs);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to enable regulators: (%d)\n", ret);
+		return ret;
+	}
+
+	for (i = 0; i < cfg->num_clks; i++) {
+		ret = clk_prepare_enable(phy->clks[i]);
+		if (ret)
+			DRM_DEV_ERROR(dev, "failed to enable clock: %s (%d)\n",
+				cfg->clk_names[i], ret);
+	}
+
+	return ret;
+}
+
+void msm_hdmi_phy_resource_disable(struct hdmi_phy *phy)
+{
+	struct hdmi_phy_cfg *cfg = phy->cfg;
+	struct device *dev = &phy->pdev->dev;
+	int i;
+
+	for (i = cfg->num_clks - 1; i >= 0; i--)
+		clk_disable_unprepare(phy->clks[i]);
+
+	regulator_bulk_disable(cfg->num_regs, phy->regs);
+
+	pm_runtime_put_sync(dev);
+}
+
+void msm_hdmi_phy_powerup(struct hdmi_phy *phy, unsigned long int pixclock)
+{
+	if (!phy || !phy->cfg->powerup)
+		return;
+
+	phy->cfg->powerup(phy, pixclock);
+}
+
+void msm_hdmi_phy_powerdown(struct hdmi_phy *phy)
+{
+	if (!phy || !phy->cfg->powerdown)
+		return;
+
+	phy->cfg->powerdown(phy);
+}
+
+static int msm_hdmi_phy_pll_init(struct platform_device *pdev,
+			     enum hdmi_phy_type type)
+{
+	int ret;
+
+	switch (type) {
+	case MSM_HDMI_PHY_8960:
+		ret = msm_hdmi_pll_8960_init(pdev);
+		break;
+	case MSM_HDMI_PHY_8996:
+		ret = msm_hdmi_pll_8996_init(pdev);
+		break;
+	case MSM_HDMI_PHY_8998:
+		ret = msm_hdmi_pll_8998_init(pdev);
+		break;
+	/*
+	 * we don't have PLL support for these, don't report an error for now
+	 */
+	case MSM_HDMI_PHY_8x60:
+	case MSM_HDMI_PHY_8x74:
+	default:
+		ret = 0;
+		break;
+	}
+
+	return ret;
+}
+
+static int msm_hdmi_phy_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct hdmi_phy *phy;
+	int ret;
+
+	phy = devm_kzalloc(dev, sizeof(*phy), GFP_KERNEL);
+	if (!phy)
+		return -ENODEV;
+
+	phy->cfg = (struct hdmi_phy_cfg *)of_device_get_match_data(dev);
+	if (!phy->cfg)
+		return -ENODEV;
+
+	phy->mmio = msm_ioremap(pdev, "hdmi_phy");
+	if (IS_ERR(phy->mmio)) {
+		DRM_DEV_ERROR(dev, "%s: failed to map phy base\n", __func__);
+		return -ENOMEM;
+	}
+
+	phy->pdev = pdev;
+
+	ret = msm_hdmi_phy_resource_init(phy);
+	if (ret)
+		return ret;
+
+	pm_runtime_enable(&pdev->dev);
+
+	ret = msm_hdmi_phy_resource_enable(phy);
+	if (ret)
+		return ret;
+
+	ret = msm_hdmi_phy_pll_init(pdev, phy->cfg->type);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "couldn't init PLL\n");
+		msm_hdmi_phy_resource_disable(phy);
+		return ret;
+	}
+
+	msm_hdmi_phy_resource_disable(phy);
+
+	platform_set_drvdata(pdev, phy);
+
+	return 0;
+}
+
+static void msm_hdmi_phy_remove(struct platform_device *pdev)
+{
+	pm_runtime_disable(&pdev->dev);
+}
+
+static const struct of_device_id msm_hdmi_phy_dt_match[] = {
+	{ .compatible = "qcom,hdmi-phy-8660",
+	  .data = &msm_hdmi_phy_8x60_cfg },
+	{ .compatible = "qcom,hdmi-phy-8960",
+	  .data = &msm_hdmi_phy_8960_cfg },
+	{ .compatible = "qcom,hdmi-phy-8974",
+	  .data = &msm_hdmi_phy_8x74_cfg },
+	{ .compatible = "qcom,hdmi-phy-8084",
+	  .data = &msm_hdmi_phy_8x74_cfg },
+	{ .compatible = "qcom,hdmi-phy-8996",
+	  .data = &msm_hdmi_phy_8996_cfg },
+	{ .compatible = "qcom,hdmi-phy-8998",
+	  .data = &msm_hdmi_phy_8998_cfg },
+	{}
+};
+
+static struct platform_driver msm_hdmi_phy_platform_driver = {
+	.probe      = msm_hdmi_phy_probe,
+	.remove_new = msm_hdmi_phy_remove,
+	.driver     = {
+		.name   = "msm_hdmi_phy",
+		.of_match_table = msm_hdmi_phy_dt_match,
+	},
+};
+
+void __init msm_hdmi_phy_driver_register(void)
+{
+	platform_driver_register(&msm_hdmi_phy_platform_driver);
+}
+
+void __exit msm_hdmi_phy_driver_unregister(void)
+{
+	platform_driver_unregister(&msm_hdmi_phy_platform_driver);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8960.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8960.c
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include "hdmi.h"
+
+static void hdmi_phy_8960_powerup(struct hdmi_phy *phy,
+				  unsigned long int pixclock)
+{
+	DBG("pixclock: %lu", pixclock);
+
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG2, 0x00);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG0, 0x1b);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG1, 0xf2);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG4, 0x00);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG5, 0x00);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG6, 0x00);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG7, 0x00);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG8, 0x00);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG9, 0x00);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG10, 0x00);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG11, 0x00);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG3, 0x20);
+}
+
+static void hdmi_phy_8960_powerdown(struct hdmi_phy *phy)
+{
+	DBG("");
+
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG2, 0x7f);
+}
+
+static const char * const hdmi_phy_8960_reg_names[] = {
+	"core-vdda",
+};
+
+static const char * const hdmi_phy_8960_clk_names[] = {
+	"slave_iface",
+};
+
+const struct hdmi_phy_cfg msm_hdmi_phy_8960_cfg = {
+	.type = MSM_HDMI_PHY_8960,
+	.powerup = hdmi_phy_8960_powerup,
+	.powerdown = hdmi_phy_8960_powerdown,
+	.reg_names = hdmi_phy_8960_reg_names,
+	.num_regs = ARRAY_SIZE(hdmi_phy_8960_reg_names),
+	.clk_names = hdmi_phy_8960_clk_names,
+	.num_clks = ARRAY_SIZE(hdmi_phy_8960_clk_names),
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8996.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8996.c
@@ -0,0 +1,765 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+
+#include "hdmi.h"
+
+#define HDMI_VCO_MAX_FREQ			12000000000UL
+#define HDMI_VCO_MIN_FREQ			8000000000UL
+
+#define HDMI_PCLK_MAX_FREQ			600000000
+#define HDMI_PCLK_MIN_FREQ			25000000
+
+#define HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD	3400000000UL
+#define HDMI_DIG_FREQ_BIT_CLK_THRESHOLD		1500000000UL
+#define HDMI_MID_FREQ_BIT_CLK_THRESHOLD		750000000UL
+#define HDMI_CORECLK_DIV			5
+#define HDMI_DEFAULT_REF_CLOCK			19200000
+#define HDMI_PLL_CMP_CNT			1024
+
+#define HDMI_PLL_POLL_MAX_READS			100
+#define HDMI_PLL_POLL_TIMEOUT_US		150
+
+#define HDMI_NUM_TX_CHANNEL			4
+
+struct hdmi_pll_8996 {
+	struct platform_device *pdev;
+	struct clk_hw clk_hw;
+
+	/* pll mmio base */
+	void __iomem *mmio_qserdes_com;
+	/* tx channel base */
+	void __iomem *mmio_qserdes_tx[HDMI_NUM_TX_CHANNEL];
+};
+
+#define hw_clk_to_pll(x) container_of(x, struct hdmi_pll_8996, clk_hw)
+
+struct hdmi_8996_phy_pll_reg_cfg {
+	u32 tx_lx_lane_mode[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_tx_band[HDMI_NUM_TX_CHANNEL];
+	u32 com_svs_mode_clk_sel;
+	u32 com_hsclk_sel;
+	u32 com_pll_cctrl_mode0;
+	u32 com_pll_rctrl_mode0;
+	u32 com_cp_ctrl_mode0;
+	u32 com_dec_start_mode0;
+	u32 com_div_frac_start1_mode0;
+	u32 com_div_frac_start2_mode0;
+	u32 com_div_frac_start3_mode0;
+	u32 com_integloop_gain0_mode0;
+	u32 com_integloop_gain1_mode0;
+	u32 com_lock_cmp_en;
+	u32 com_lock_cmp1_mode0;
+	u32 com_lock_cmp2_mode0;
+	u32 com_lock_cmp3_mode0;
+	u32 com_core_clk_en;
+	u32 com_coreclk_div;
+	u32 com_vco_tune_ctrl;
+
+	u32 tx_lx_tx_drv_lvl[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_tx_emp_post1_lvl[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_vmode_ctrl1[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_vmode_ctrl2[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_res_code_lane_tx[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_hp_pd_enables[HDMI_NUM_TX_CHANNEL];
+
+	u32 phy_mode;
+};
+
+struct hdmi_8996_post_divider {
+	u64 vco_freq;
+	int hsclk_divsel;
+	int vco_ratio;
+	int tx_band_sel;
+	int half_rate_mode;
+};
+
+static inline struct hdmi_phy *pll_get_phy(struct hdmi_pll_8996 *pll)
+{
+	return platform_get_drvdata(pll->pdev);
+}
+
+static inline void hdmi_pll_write(struct hdmi_pll_8996 *pll, int offset,
+				  u32 data)
+{
+	msm_writel(data, pll->mmio_qserdes_com + offset);
+}
+
+static inline u32 hdmi_pll_read(struct hdmi_pll_8996 *pll, int offset)
+{
+	return msm_readl(pll->mmio_qserdes_com + offset);
+}
+
+static inline void hdmi_tx_chan_write(struct hdmi_pll_8996 *pll, int channel,
+				      int offset, int data)
+{
+	 msm_writel(data, pll->mmio_qserdes_tx[channel] + offset);
+}
+
+static inline u32 pll_get_cpctrl(u64 frac_start, unsigned long ref_clk,
+				 bool gen_ssc)
+{
+	if ((frac_start != 0) || gen_ssc)
+		return (11000000 / (ref_clk / 20));
+
+	return 0x23;
+}
+
+static inline u32 pll_get_rctrl(u64 frac_start, bool gen_ssc)
+{
+	if ((frac_start != 0) || gen_ssc)
+		return 0x16;
+
+	return 0x10;
+}
+
+static inline u32 pll_get_cctrl(u64 frac_start, bool gen_ssc)
+{
+	if ((frac_start != 0) || gen_ssc)
+		return 0x28;
+
+	return 0x1;
+}
+
+static inline u32 pll_get_integloop_gain(u64 frac_start, u64 bclk, u32 ref_clk,
+					 bool gen_ssc)
+{
+	int digclk_divsel = bclk >= HDMI_DIG_FREQ_BIT_CLK_THRESHOLD ? 1 : 2;
+	u64 base;
+
+	if ((frac_start != 0) || gen_ssc)
+		base = (64 * ref_clk) / HDMI_DEFAULT_REF_CLOCK;
+	else
+		base = (1022 * ref_clk) / 100;
+
+	base <<= digclk_divsel;
+
+	return (base <= 2046 ? base : 2046);
+}
+
+static inline u32 pll_get_pll_cmp(u64 fdata, unsigned long ref_clk)
+{
+	u64 dividend = HDMI_PLL_CMP_CNT * fdata;
+	u32 divisor = ref_clk * 10;
+	u32 rem;
+
+	rem = do_div(dividend, divisor);
+	if (rem > (divisor >> 1))
+		dividend++;
+
+	return dividend - 1;
+}
+
+static inline u64 pll_cmp_to_fdata(u32 pll_cmp, unsigned long ref_clk)
+{
+	u64 fdata = ((u64)pll_cmp) * ref_clk * 10;
+
+	do_div(fdata, HDMI_PLL_CMP_CNT);
+
+	return fdata;
+}
+
+static int pll_get_post_div(struct hdmi_8996_post_divider *pd, u64 bclk)
+{
+	int ratio[] = { 2, 3, 4, 5, 6, 9, 10, 12, 14, 15, 20, 21, 25, 28, 35 };
+	int hs_divsel[] = { 0, 4, 8, 12, 1, 5, 2, 9, 3, 13, 10, 7, 14, 11, 15 };
+	int tx_band_sel[] = { 0, 1, 2, 3 };
+	u64 vco_freq[60];
+	u64 vco, vco_optimal;
+	int half_rate_mode = 0;
+	int vco_optimal_index, vco_freq_index;
+	int i, j;
+
+retry:
+	vco_optimal = HDMI_VCO_MAX_FREQ;
+	vco_optimal_index = -1;
+	vco_freq_index = 0;
+	for (i = 0; i < 15; i++) {
+		for (j = 0; j < 4; j++) {
+			u32 ratio_mult = ratio[i] << tx_band_sel[j];
+
+			vco = bclk >> half_rate_mode;
+			vco *= ratio_mult;
+			vco_freq[vco_freq_index++] = vco;
+		}
+	}
+
+	for (i = 0; i < 60; i++) {
+		u64 vco_tmp = vco_freq[i];
+
+		if ((vco_tmp >= HDMI_VCO_MIN_FREQ) &&
+		    (vco_tmp <= vco_optimal)) {
+			vco_optimal = vco_tmp;
+			vco_optimal_index = i;
+		}
+	}
+
+	if (vco_optimal_index == -1) {
+		if (!half_rate_mode) {
+			half_rate_mode = 1;
+			goto retry;
+		}
+	} else {
+		pd->vco_freq = vco_optimal;
+		pd->tx_band_sel = tx_band_sel[vco_optimal_index % 4];
+		pd->vco_ratio = ratio[vco_optimal_index / 4];
+		pd->hsclk_divsel = hs_divsel[vco_optimal_index / 4];
+
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static int pll_calculate(unsigned long pix_clk, unsigned long ref_clk,
+			 struct hdmi_8996_phy_pll_reg_cfg *cfg)
+{
+	struct hdmi_8996_post_divider pd;
+	u64 bclk;
+	u64 tmds_clk;
+	u64 dec_start;
+	u64 frac_start;
+	u64 fdata;
+	u32 pll_divisor;
+	u32 rem;
+	u32 cpctrl;
+	u32 rctrl;
+	u32 cctrl;
+	u32 integloop_gain;
+	u32 pll_cmp;
+	int i, ret;
+
+	/* bit clk = 10 * pix_clk */
+	bclk = ((u64)pix_clk) * 10;
+
+	if (bclk > HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD)
+		tmds_clk = pix_clk >> 2;
+	else
+		tmds_clk = pix_clk;
+
+	ret = pll_get_post_div(&pd, bclk);
+	if (ret)
+		return ret;
+
+	dec_start = pd.vco_freq;
+	pll_divisor = 4 * ref_clk;
+	do_div(dec_start, pll_divisor);
+
+	frac_start = pd.vco_freq * (1 << 20);
+
+	rem = do_div(frac_start, pll_divisor);
+	frac_start -= dec_start * (1 << 20);
+	if (rem > (pll_divisor >> 1))
+		frac_start++;
+
+	cpctrl = pll_get_cpctrl(frac_start, ref_clk, false);
+	rctrl = pll_get_rctrl(frac_start, false);
+	cctrl = pll_get_cctrl(frac_start, false);
+	integloop_gain = pll_get_integloop_gain(frac_start, bclk,
+						ref_clk, false);
+
+	fdata = pd.vco_freq;
+	do_div(fdata, pd.vco_ratio);
+
+	pll_cmp = pll_get_pll_cmp(fdata, ref_clk);
+
+	DBG("VCO freq: %llu", pd.vco_freq);
+	DBG("fdata: %llu", fdata);
+	DBG("pix_clk: %lu", pix_clk);
+	DBG("tmds clk: %llu", tmds_clk);
+	DBG("HSCLK_SEL: %d", pd.hsclk_divsel);
+	DBG("DEC_START: %llu", dec_start);
+	DBG("DIV_FRAC_START: %llu", frac_start);
+	DBG("PLL_CPCTRL: %u", cpctrl);
+	DBG("PLL_RCTRL: %u", rctrl);
+	DBG("PLL_CCTRL: %u", cctrl);
+	DBG("INTEGLOOP_GAIN: %u", integloop_gain);
+	DBG("TX_BAND: %d", pd.tx_band_sel);
+	DBG("PLL_CMP: %u", pll_cmp);
+
+	/* Convert these values to register specific values */
+	if (bclk > HDMI_DIG_FREQ_BIT_CLK_THRESHOLD)
+		cfg->com_svs_mode_clk_sel = 1;
+	else
+		cfg->com_svs_mode_clk_sel = 2;
+
+	cfg->com_hsclk_sel = (0x20 | pd.hsclk_divsel);
+	cfg->com_pll_cctrl_mode0 = cctrl;
+	cfg->com_pll_rctrl_mode0 = rctrl;
+	cfg->com_cp_ctrl_mode0 = cpctrl;
+	cfg->com_dec_start_mode0 = dec_start;
+	cfg->com_div_frac_start1_mode0 = (frac_start & 0xff);
+	cfg->com_div_frac_start2_mode0 = ((frac_start & 0xff00) >> 8);
+	cfg->com_div_frac_start3_mode0 = ((frac_start & 0xf0000) >> 16);
+	cfg->com_integloop_gain0_mode0 = (integloop_gain & 0xff);
+	cfg->com_integloop_gain1_mode0 = ((integloop_gain & 0xf00) >> 8);
+	cfg->com_lock_cmp1_mode0 = (pll_cmp & 0xff);
+	cfg->com_lock_cmp2_mode0 = ((pll_cmp & 0xff00) >> 8);
+	cfg->com_lock_cmp3_mode0 = ((pll_cmp & 0x30000) >> 16);
+	cfg->com_lock_cmp_en = 0x0;
+	cfg->com_core_clk_en = 0x2c;
+	cfg->com_coreclk_div = HDMI_CORECLK_DIV;
+	cfg->phy_mode = (bclk > HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD) ? 0x10 : 0x0;
+	cfg->com_vco_tune_ctrl = 0x0;
+
+	cfg->tx_lx_lane_mode[0] =
+		cfg->tx_lx_lane_mode[2] = 0x43;
+
+	cfg->tx_lx_hp_pd_enables[0] =
+		cfg->tx_lx_hp_pd_enables[1] =
+		cfg->tx_lx_hp_pd_enables[2] = 0x0c;
+	cfg->tx_lx_hp_pd_enables[3] = 0x3;
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++)
+		cfg->tx_lx_tx_band[i] = pd.tx_band_sel + 4;
+
+	if (bclk > HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD) {
+		cfg->tx_lx_tx_drv_lvl[0] =
+			cfg->tx_lx_tx_drv_lvl[1] =
+			cfg->tx_lx_tx_drv_lvl[2] = 0x25;
+		cfg->tx_lx_tx_drv_lvl[3] = 0x22;
+
+		cfg->tx_lx_tx_emp_post1_lvl[0] =
+			cfg->tx_lx_tx_emp_post1_lvl[1] =
+			cfg->tx_lx_tx_emp_post1_lvl[2] = 0x23;
+		cfg->tx_lx_tx_emp_post1_lvl[3] = 0x27;
+
+		cfg->tx_lx_vmode_ctrl1[0] =
+			cfg->tx_lx_vmode_ctrl1[1] =
+			cfg->tx_lx_vmode_ctrl1[2] =
+			cfg->tx_lx_vmode_ctrl1[3] = 0x00;
+
+		cfg->tx_lx_vmode_ctrl2[0] =
+			cfg->tx_lx_vmode_ctrl2[1] =
+			cfg->tx_lx_vmode_ctrl2[2] = 0x0D;
+
+		cfg->tx_lx_vmode_ctrl2[3] = 0x00;
+	} else if (bclk > HDMI_MID_FREQ_BIT_CLK_THRESHOLD) {
+		for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+			cfg->tx_lx_tx_drv_lvl[i] = 0x25;
+			cfg->tx_lx_tx_emp_post1_lvl[i] = 0x23;
+			cfg->tx_lx_vmode_ctrl1[i] = 0x00;
+		}
+
+		cfg->tx_lx_vmode_ctrl2[0] =
+			cfg->tx_lx_vmode_ctrl2[1] =
+			cfg->tx_lx_vmode_ctrl2[2] = 0x0D;
+		cfg->tx_lx_vmode_ctrl2[3] = 0x00;
+	} else {
+		for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+			cfg->tx_lx_tx_drv_lvl[i] = 0x20;
+			cfg->tx_lx_tx_emp_post1_lvl[i] = 0x20;
+			cfg->tx_lx_vmode_ctrl1[i] = 0x00;
+			cfg->tx_lx_vmode_ctrl2[i] = 0x0E;
+		}
+	}
+
+	DBG("com_svs_mode_clk_sel = 0x%x", cfg->com_svs_mode_clk_sel);
+	DBG("com_hsclk_sel = 0x%x", cfg->com_hsclk_sel);
+	DBG("com_lock_cmp_en = 0x%x", cfg->com_lock_cmp_en);
+	DBG("com_pll_cctrl_mode0 = 0x%x", cfg->com_pll_cctrl_mode0);
+	DBG("com_pll_rctrl_mode0 = 0x%x", cfg->com_pll_rctrl_mode0);
+	DBG("com_cp_ctrl_mode0 = 0x%x", cfg->com_cp_ctrl_mode0);
+	DBG("com_dec_start_mode0 = 0x%x", cfg->com_dec_start_mode0);
+	DBG("com_div_frac_start1_mode0 = 0x%x", cfg->com_div_frac_start1_mode0);
+	DBG("com_div_frac_start2_mode0 = 0x%x", cfg->com_div_frac_start2_mode0);
+	DBG("com_div_frac_start3_mode0 = 0x%x", cfg->com_div_frac_start3_mode0);
+	DBG("com_integloop_gain0_mode0 = 0x%x", cfg->com_integloop_gain0_mode0);
+	DBG("com_integloop_gain1_mode0 = 0x%x", cfg->com_integloop_gain1_mode0);
+	DBG("com_lock_cmp1_mode0 = 0x%x", cfg->com_lock_cmp1_mode0);
+	DBG("com_lock_cmp2_mode0 = 0x%x", cfg->com_lock_cmp2_mode0);
+	DBG("com_lock_cmp3_mode0 = 0x%x", cfg->com_lock_cmp3_mode0);
+	DBG("com_core_clk_en = 0x%x", cfg->com_core_clk_en);
+	DBG("com_coreclk_div = 0x%x", cfg->com_coreclk_div);
+	DBG("phy_mode = 0x%x", cfg->phy_mode);
+
+	DBG("tx_l0_lane_mode = 0x%x", cfg->tx_lx_lane_mode[0]);
+	DBG("tx_l2_lane_mode = 0x%x", cfg->tx_lx_lane_mode[2]);
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		DBG("tx_l%d_tx_band = 0x%x", i, cfg->tx_lx_tx_band[i]);
+		DBG("tx_l%d_tx_drv_lvl = 0x%x", i, cfg->tx_lx_tx_drv_lvl[i]);
+		DBG("tx_l%d_tx_emp_post1_lvl = 0x%x", i,
+		    cfg->tx_lx_tx_emp_post1_lvl[i]);
+		DBG("tx_l%d_vmode_ctrl1 = 0x%x", i, cfg->tx_lx_vmode_ctrl1[i]);
+		DBG("tx_l%d_vmode_ctrl2 = 0x%x", i, cfg->tx_lx_vmode_ctrl2[i]);
+	}
+
+	return 0;
+}
+
+static int hdmi_8996_pll_set_clk_rate(struct clk_hw *hw, unsigned long rate,
+				      unsigned long parent_rate)
+{
+	struct hdmi_pll_8996 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+	struct hdmi_8996_phy_pll_reg_cfg cfg;
+	int i, ret;
+
+	memset(&cfg, 0x00, sizeof(cfg));
+
+	ret = pll_calculate(rate, parent_rate, &cfg);
+	if (ret) {
+		DRM_ERROR("PLL calculation failed\n");
+		return ret;
+	}
+
+	/* Initially shut down PHY */
+	DBG("Disabling PHY");
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_PD_CTL, 0x0);
+	udelay(500);
+
+	/* Power up sequence */
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_BG_CTRL, 0x04);
+
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_PD_CTL, 0x1);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_RESETSM_CNTRL, 0x20);
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_TX0_TX1_LANE_CTL, 0x0F);
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_TX2_TX3_LANE_CTL, 0x0F);
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_PHY_QSERDES_TX_LX_CLKBUF_ENABLE,
+				   0x03);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_PHY_QSERDES_TX_LX_TX_BAND,
+				   cfg.tx_lx_tx_band[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_PHY_QSERDES_TX_LX_RESET_TSYNC_EN,
+				   0x03);
+	}
+
+	hdmi_tx_chan_write(pll, 0, REG_HDMI_PHY_QSERDES_TX_LX_LANE_MODE,
+			   cfg.tx_lx_lane_mode[0]);
+	hdmi_tx_chan_write(pll, 2, REG_HDMI_PHY_QSERDES_TX_LX_LANE_MODE,
+			   cfg.tx_lx_lane_mode[2]);
+
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_SYSCLK_BUF_ENABLE, 0x1E);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_BIAS_EN_CLKBUFLR_EN, 0x07);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_SYSCLK_EN_SEL, 0x37);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_SYS_CLK_CTRL, 0x02);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_CLK_ENABLE1, 0x0E);
+
+	/* Bypass VCO calibration */
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_SVS_MODE_CLK_SEL,
+		       cfg.com_svs_mode_clk_sel);
+
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_BG_TRIM, 0x0F);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_PLL_IVCO, 0x0F);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_VCO_TUNE_CTRL,
+		       cfg.com_vco_tune_ctrl);
+
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_BG_CTRL, 0x06);
+
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_CLK_SELECT, 0x30);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_HSCLK_SEL,
+		       cfg.com_hsclk_sel);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_LOCK_CMP_EN,
+		       cfg.com_lock_cmp_en);
+
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_PLL_CCTRL_MODE0,
+		       cfg.com_pll_cctrl_mode0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_PLL_RCTRL_MODE0,
+		       cfg.com_pll_rctrl_mode0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_CP_CTRL_MODE0,
+		       cfg.com_cp_ctrl_mode0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_DEC_START_MODE0,
+		       cfg.com_dec_start_mode0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_DIV_FRAC_START1_MODE0,
+		       cfg.com_div_frac_start1_mode0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_DIV_FRAC_START2_MODE0,
+		       cfg.com_div_frac_start2_mode0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_DIV_FRAC_START3_MODE0,
+		       cfg.com_div_frac_start3_mode0);
+
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_INTEGLOOP_GAIN0_MODE0,
+		       cfg.com_integloop_gain0_mode0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_INTEGLOOP_GAIN1_MODE0,
+		       cfg.com_integloop_gain1_mode0);
+
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_LOCK_CMP1_MODE0,
+		       cfg.com_lock_cmp1_mode0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_LOCK_CMP2_MODE0,
+		       cfg.com_lock_cmp2_mode0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_LOCK_CMP3_MODE0,
+		       cfg.com_lock_cmp3_mode0);
+
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_VCO_TUNE_MAP, 0x00);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_CORE_CLK_EN,
+		       cfg.com_core_clk_en);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_CORECLK_DIV,
+		       cfg.com_coreclk_div);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_CMN_CONFIG, 0x02);
+
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_RESCODE_DIV_NUM, 0x15);
+
+	/* TX lanes setup (TX 0/1/2/3) */
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_PHY_QSERDES_TX_LX_TX_DRV_LVL,
+				   cfg.tx_lx_tx_drv_lvl[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_PHY_QSERDES_TX_LX_TX_EMP_POST1_LVL,
+				   cfg.tx_lx_tx_emp_post1_lvl[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_PHY_QSERDES_TX_LX_VMODE_CTRL1,
+				   cfg.tx_lx_vmode_ctrl1[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_PHY_QSERDES_TX_LX_VMODE_CTRL2,
+				   cfg.tx_lx_vmode_ctrl2[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_PHY_QSERDES_TX_LX_TX_DRV_LVL_OFFSET,
+				   0x00);
+		hdmi_tx_chan_write(pll, i,
+			REG_HDMI_PHY_QSERDES_TX_LX_RES_CODE_LANE_OFFSET,
+			0x00);
+		hdmi_tx_chan_write(pll, i,
+			REG_HDMI_PHY_QSERDES_TX_LX_TRAN_DRVR_EMP_EN,
+			0x03);
+		hdmi_tx_chan_write(pll, i,
+			REG_HDMI_PHY_QSERDES_TX_LX_PARRATE_REC_DETECT_IDLE_EN,
+			0x40);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_PHY_QSERDES_TX_LX_HP_PD_ENABLES,
+				   cfg.tx_lx_hp_pd_enables[i]);
+	}
+
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_MODE, cfg.phy_mode);
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_PD_CTL, 0x1F);
+
+	/*
+	 * Ensure that vco configuration gets flushed to hardware before
+	 * enabling the PLL
+	 */
+	wmb();
+
+	return 0;
+}
+
+static int hdmi_8996_phy_ready_status(struct hdmi_phy *phy)
+{
+	u32 nb_tries = HDMI_PLL_POLL_MAX_READS;
+	unsigned long timeout = HDMI_PLL_POLL_TIMEOUT_US;
+	u32 status;
+	int phy_ready = 0;
+
+	DBG("Waiting for PHY ready");
+
+	while (nb_tries--) {
+		status = hdmi_phy_read(phy, REG_HDMI_8996_PHY_STATUS);
+		phy_ready = status & BIT(0);
+
+		if (phy_ready)
+			break;
+
+		udelay(timeout);
+	}
+
+	DBG("PHY is %sready", phy_ready ? "" : "*not* ");
+
+	return phy_ready;
+}
+
+static int hdmi_8996_pll_lock_status(struct hdmi_pll_8996 *pll)
+{
+	u32 status;
+	int nb_tries = HDMI_PLL_POLL_MAX_READS;
+	unsigned long timeout = HDMI_PLL_POLL_TIMEOUT_US;
+	int pll_locked = 0;
+
+	DBG("Waiting for PLL lock");
+
+	while (nb_tries--) {
+		status = hdmi_pll_read(pll,
+				       REG_HDMI_PHY_QSERDES_COM_C_READY_STATUS);
+		pll_locked = status & BIT(0);
+
+		if (pll_locked)
+			break;
+
+		udelay(timeout);
+	}
+
+	DBG("HDMI PLL is %slocked", pll_locked ? "" : "*not* ");
+
+	return pll_locked;
+}
+
+static int hdmi_8996_pll_prepare(struct clk_hw *hw)
+{
+	struct hdmi_pll_8996 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+	int i, ret = 0;
+
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_CFG, 0x1);
+	udelay(100);
+
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_CFG, 0x19);
+	udelay(100);
+
+	ret = hdmi_8996_pll_lock_status(pll);
+	if (!ret)
+		return ret;
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++)
+		hdmi_tx_chan_write(pll, i,
+			REG_HDMI_PHY_QSERDES_TX_LX_HIGHZ_TRANSCEIVEREN_BIAS_DRVR_EN,
+			0x6F);
+
+	/* Disable SSC */
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_SSC_PER1, 0x0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_SSC_PER2, 0x0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_SSC_STEP_SIZE1, 0x0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_SSC_STEP_SIZE2, 0x0);
+	hdmi_pll_write(pll, REG_HDMI_PHY_QSERDES_COM_SSC_EN_CENTER, 0x2);
+
+	ret = hdmi_8996_phy_ready_status(phy);
+	if (!ret)
+		return ret;
+
+	/* Restart the retiming buffer */
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_CFG, 0x18);
+	udelay(1);
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_CFG, 0x19);
+
+	return 0;
+}
+
+static long hdmi_8996_pll_round_rate(struct clk_hw *hw,
+				     unsigned long rate,
+				     unsigned long *parent_rate)
+{
+	if (rate < HDMI_PCLK_MIN_FREQ)
+		return HDMI_PCLK_MIN_FREQ;
+	else if (rate > HDMI_PCLK_MAX_FREQ)
+		return HDMI_PCLK_MAX_FREQ;
+	else
+		return rate;
+}
+
+static unsigned long hdmi_8996_pll_recalc_rate(struct clk_hw *hw,
+					       unsigned long parent_rate)
+{
+	struct hdmi_pll_8996 *pll = hw_clk_to_pll(hw);
+	u64 fdata;
+	u32 cmp1, cmp2, cmp3, pll_cmp;
+
+	cmp1 = hdmi_pll_read(pll, REG_HDMI_PHY_QSERDES_COM_LOCK_CMP1_MODE0);
+	cmp2 = hdmi_pll_read(pll, REG_HDMI_PHY_QSERDES_COM_LOCK_CMP2_MODE0);
+	cmp3 = hdmi_pll_read(pll, REG_HDMI_PHY_QSERDES_COM_LOCK_CMP3_MODE0);
+
+	pll_cmp = cmp1 | (cmp2 << 8) | (cmp3 << 16);
+
+	fdata = pll_cmp_to_fdata(pll_cmp + 1, parent_rate);
+
+	do_div(fdata, 10);
+
+	return fdata;
+}
+
+static void hdmi_8996_pll_unprepare(struct clk_hw *hw)
+{
+	struct hdmi_pll_8996 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+
+	hdmi_phy_write(phy, REG_HDMI_8996_PHY_CFG, 0x6);
+	usleep_range(100, 150);
+}
+
+static int hdmi_8996_pll_is_enabled(struct clk_hw *hw)
+{
+	struct hdmi_pll_8996 *pll = hw_clk_to_pll(hw);
+	u32 status;
+	int pll_locked;
+
+	status = hdmi_pll_read(pll, REG_HDMI_PHY_QSERDES_COM_C_READY_STATUS);
+	pll_locked = status & BIT(0);
+
+	return pll_locked;
+}
+
+static const struct clk_ops hdmi_8996_pll_ops = {
+	.set_rate = hdmi_8996_pll_set_clk_rate,
+	.round_rate = hdmi_8996_pll_round_rate,
+	.recalc_rate = hdmi_8996_pll_recalc_rate,
+	.prepare = hdmi_8996_pll_prepare,
+	.unprepare = hdmi_8996_pll_unprepare,
+	.is_enabled = hdmi_8996_pll_is_enabled,
+};
+
+static const struct clk_init_data pll_init = {
+	.name = "hdmipll",
+	.ops = &hdmi_8996_pll_ops,
+	.parent_data = (const struct clk_parent_data[]){
+		{ .fw_name = "xo", .name = "xo_board" },
+	},
+	.num_parents = 1,
+	.flags = CLK_IGNORE_UNUSED,
+};
+
+int msm_hdmi_pll_8996_init(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct hdmi_pll_8996 *pll;
+	int i, ret;
+
+	pll = devm_kzalloc(dev, sizeof(*pll), GFP_KERNEL);
+	if (!pll)
+		return -ENOMEM;
+
+	pll->pdev = pdev;
+
+	pll->mmio_qserdes_com = msm_ioremap(pdev, "hdmi_pll");
+	if (IS_ERR(pll->mmio_qserdes_com)) {
+		DRM_DEV_ERROR(dev, "failed to map pll base\n");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		char name[32];
+
+		snprintf(name, sizeof(name), "hdmi_tx_l%d", i);
+
+		pll->mmio_qserdes_tx[i] = msm_ioremap(pdev, name);
+		if (IS_ERR(pll->mmio_qserdes_tx[i])) {
+			DRM_DEV_ERROR(dev, "failed to map pll base\n");
+			return -ENOMEM;
+		}
+	}
+	pll->clk_hw.init = &pll_init;
+
+	ret = devm_clk_hw_register(dev, &pll->clk_hw);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to register pll clock\n");
+		return ret;
+	}
+
+	ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, &pll->clk_hw);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "%s: failed to register clk provider: %d\n", __func__, ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static const char * const hdmi_phy_8996_reg_names[] = {
+	"vddio",
+	"vcca",
+};
+
+static const char * const hdmi_phy_8996_clk_names[] = {
+	"iface", "ref",
+};
+
+const struct hdmi_phy_cfg msm_hdmi_phy_8996_cfg = {
+	.type = MSM_HDMI_PHY_8996,
+	.reg_names = hdmi_phy_8996_reg_names,
+	.num_regs = ARRAY_SIZE(hdmi_phy_8996_reg_names),
+	.clk_names = hdmi_phy_8996_clk_names,
+	.num_clks = ARRAY_SIZE(hdmi_phy_8996_clk_names),
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8998.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8998.c
@@ -0,0 +1,779 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Freebox SAS
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+
+#include "hdmi.h"
+
+#define HDMI_VCO_MAX_FREQ			12000000000UL
+#define HDMI_VCO_MIN_FREQ			8000000000UL
+
+#define HDMI_PCLK_MAX_FREQ			600000000
+#define HDMI_PCLK_MIN_FREQ			25000000
+
+#define HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD	3400000000UL
+#define HDMI_DIG_FREQ_BIT_CLK_THRESHOLD		1500000000UL
+#define HDMI_MID_FREQ_BIT_CLK_THRESHOLD		750000000UL
+#define HDMI_CORECLK_DIV			5
+#define HDMI_DEFAULT_REF_CLOCK			19200000
+#define HDMI_PLL_CMP_CNT			1024
+
+#define HDMI_PLL_POLL_MAX_READS			100
+#define HDMI_PLL_POLL_TIMEOUT_US		150
+
+#define HDMI_NUM_TX_CHANNEL			4
+
+struct hdmi_pll_8998 {
+	struct platform_device *pdev;
+	struct clk_hw clk_hw;
+	unsigned long rate;
+
+	/* pll mmio base */
+	void __iomem *mmio_qserdes_com;
+	/* tx channel base */
+	void __iomem *mmio_qserdes_tx[HDMI_NUM_TX_CHANNEL];
+};
+
+#define hw_clk_to_pll(x) container_of(x, struct hdmi_pll_8998, clk_hw)
+
+struct hdmi_8998_phy_pll_reg_cfg {
+	u32 com_svs_mode_clk_sel;
+	u32 com_hsclk_sel;
+	u32 com_pll_cctrl_mode0;
+	u32 com_pll_rctrl_mode0;
+	u32 com_cp_ctrl_mode0;
+	u32 com_dec_start_mode0;
+	u32 com_div_frac_start1_mode0;
+	u32 com_div_frac_start2_mode0;
+	u32 com_div_frac_start3_mode0;
+	u32 com_integloop_gain0_mode0;
+	u32 com_integloop_gain1_mode0;
+	u32 com_lock_cmp_en;
+	u32 com_lock_cmp1_mode0;
+	u32 com_lock_cmp2_mode0;
+	u32 com_lock_cmp3_mode0;
+	u32 com_core_clk_en;
+	u32 com_coreclk_div_mode0;
+
+	u32 tx_lx_tx_band[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_tx_drv_lvl[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_tx_emp_post1_lvl[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_pre_driver_1[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_pre_driver_2[HDMI_NUM_TX_CHANNEL];
+	u32 tx_lx_res_code_offset[HDMI_NUM_TX_CHANNEL];
+
+	u32 phy_mode;
+};
+
+struct hdmi_8998_post_divider {
+	u64 vco_freq;
+	int hsclk_divsel;
+	int vco_ratio;
+	int tx_band_sel;
+	int half_rate_mode;
+};
+
+static inline struct hdmi_phy *pll_get_phy(struct hdmi_pll_8998 *pll)
+{
+	return platform_get_drvdata(pll->pdev);
+}
+
+static inline void hdmi_pll_write(struct hdmi_pll_8998 *pll, int offset,
+				  u32 data)
+{
+	writel(data, pll->mmio_qserdes_com + offset);
+}
+
+static inline u32 hdmi_pll_read(struct hdmi_pll_8998 *pll, int offset)
+{
+	return readl(pll->mmio_qserdes_com + offset);
+}
+
+static inline void hdmi_tx_chan_write(struct hdmi_pll_8998 *pll, int channel,
+				      int offset, int data)
+{
+	 writel(data, pll->mmio_qserdes_tx[channel] + offset);
+}
+
+static inline u32 pll_get_cpctrl(u64 frac_start, unsigned long ref_clk,
+				 bool gen_ssc)
+{
+	if ((frac_start != 0) || gen_ssc)
+		return 0x8;
+
+	return 0x30;
+}
+
+static inline u32 pll_get_rctrl(u64 frac_start, bool gen_ssc)
+{
+	if ((frac_start != 0) || gen_ssc)
+		return 0x16;
+
+	return 0x18;
+}
+
+static inline u32 pll_get_cctrl(u64 frac_start, bool gen_ssc)
+{
+	if ((frac_start != 0) || gen_ssc)
+		return 0x34;
+
+	return 0x2;
+}
+
+static inline u32 pll_get_integloop_gain(u64 frac_start, u64 bclk, u32 ref_clk,
+					 bool gen_ssc)
+{
+	int digclk_divsel = bclk > HDMI_DIG_FREQ_BIT_CLK_THRESHOLD ? 1 : 2;
+	u64 base;
+
+	if ((frac_start != 0) || gen_ssc)
+		base = 0x3F;
+	else
+		base = 0xC4;
+
+	base <<= (digclk_divsel == 2 ? 1 : 0);
+
+	return (base <= 2046 ? base : 2046);
+}
+
+static inline u32 pll_get_pll_cmp(u64 fdata, unsigned long ref_clk)
+{
+	u64 dividend = HDMI_PLL_CMP_CNT * fdata;
+	u32 divisor = ref_clk * 10;
+	u32 rem;
+
+	rem = do_div(dividend, divisor);
+	if (rem > (divisor >> 1))
+		dividend++;
+
+	return dividend - 1;
+}
+
+static inline u64 pll_cmp_to_fdata(u32 pll_cmp, unsigned long ref_clk)
+{
+	u64 fdata = ((u64)pll_cmp) * ref_clk * 10;
+
+	do_div(fdata, HDMI_PLL_CMP_CNT);
+
+	return fdata;
+}
+
+#define HDMI_REF_CLOCK_HZ ((u64)19200000)
+#define HDMI_MHZ_TO_HZ ((u64)1000000)
+static int pll_get_post_div(struct hdmi_8998_post_divider *pd, u64 bclk)
+{
+	u32 const ratio_list[] = {1, 2, 3, 4, 5, 6,
+				     9, 10, 12, 15, 25};
+	u32 const band_list[] = {0, 1, 2, 3};
+	u32 const sz_ratio = ARRAY_SIZE(ratio_list);
+	u32 const sz_band = ARRAY_SIZE(band_list);
+	u32 const cmp_cnt = 1024;
+	u32 const th_min = 500, th_max = 1000;
+	u32 half_rate_mode = 0;
+	u32 list_elements;
+	int optimal_index;
+	u32 i, j, k;
+	u32 found_hsclk_divsel = 0, found_vco_ratio;
+	u32 found_tx_band_sel;
+	u64 const min_freq = HDMI_VCO_MIN_FREQ, max_freq = HDMI_VCO_MAX_FREQ;
+	u64 freq_list[ARRAY_SIZE(ratio_list) * ARRAY_SIZE(band_list)];
+	u64 found_vco_freq;
+	u64 freq_optimal;
+
+find_optimal_index:
+	freq_optimal = max_freq;
+	optimal_index = -1;
+	list_elements = 0;
+
+	for (i = 0; i < sz_ratio; i++) {
+		for (j = 0; j < sz_band; j++) {
+			u64 freq = div_u64(bclk, (1 << half_rate_mode));
+
+			freq *= (ratio_list[i] * (1 << band_list[j]));
+			freq_list[list_elements++] = freq;
+		}
+	}
+
+	for (k = 0; k < ARRAY_SIZE(freq_list); k++) {
+		u32 const clks_pll_div = 2, core_clk_div = 5;
+		u32 const rng1 = 16, rng2 = 8;
+		u32 th1, th2;
+		u64 core_clk, rvar1, rem;
+
+		core_clk = div_u64(freq_list[k],
+				   ratio_list[k / sz_band] * clks_pll_div *
+				   core_clk_div);
+
+		rvar1 = HDMI_REF_CLOCK_HZ * rng1 * HDMI_MHZ_TO_HZ;
+		rvar1 = div64_u64_rem(rvar1, (cmp_cnt * core_clk), &rem);
+		if (rem > ((cmp_cnt * core_clk) >> 1))
+			rvar1++;
+		th1 = rvar1;
+
+		rvar1 = HDMI_REF_CLOCK_HZ * rng2 * HDMI_MHZ_TO_HZ;
+		rvar1 = div64_u64_rem(rvar1, (cmp_cnt * core_clk), &rem);
+		if (rem > ((cmp_cnt * core_clk) >> 1))
+			rvar1++;
+		th2 = rvar1;
+
+		if (freq_list[k] >= min_freq &&
+				freq_list[k] <= max_freq) {
+			if ((th1 >= th_min && th1 <= th_max) ||
+					(th2 >= th_min && th2 <= th_max)) {
+				if (freq_list[k] <= freq_optimal) {
+					freq_optimal = freq_list[k];
+					optimal_index = k;
+				}
+			}
+		}
+	}
+
+	if (optimal_index == -1) {
+		if (!half_rate_mode) {
+			half_rate_mode = 1;
+			goto find_optimal_index;
+		} else {
+			return -EINVAL;
+		}
+	} else {
+		found_vco_ratio = ratio_list[optimal_index / sz_band];
+		found_tx_band_sel = band_list[optimal_index % sz_band];
+		found_vco_freq = freq_optimal;
+	}
+
+	switch (found_vco_ratio) {
+	case 1:
+		found_hsclk_divsel = 15;
+		break;
+	case 2:
+		found_hsclk_divsel = 0;
+		break;
+	case 3:
+		found_hsclk_divsel = 4;
+		break;
+	case 4:
+		found_hsclk_divsel = 8;
+		break;
+	case 5:
+		found_hsclk_divsel = 12;
+		break;
+	case 6:
+		found_hsclk_divsel = 1;
+		break;
+	case 9:
+		found_hsclk_divsel = 5;
+		break;
+	case 10:
+		found_hsclk_divsel = 2;
+		break;
+	case 12:
+		found_hsclk_divsel = 9;
+		break;
+	case 15:
+		found_hsclk_divsel = 13;
+		break;
+	case 25:
+		found_hsclk_divsel = 14;
+		break;
+	};
+
+	pd->vco_freq = found_vco_freq;
+	pd->tx_band_sel = found_tx_band_sel;
+	pd->vco_ratio = found_vco_ratio;
+	pd->hsclk_divsel = found_hsclk_divsel;
+
+	return 0;
+}
+
+static int pll_calculate(unsigned long pix_clk, unsigned long ref_clk,
+			 struct hdmi_8998_phy_pll_reg_cfg *cfg)
+{
+	struct hdmi_8998_post_divider pd;
+	u64 bclk;
+	u64 dec_start;
+	u64 frac_start;
+	u64 fdata;
+	u32 pll_divisor;
+	u32 rem;
+	u32 cpctrl;
+	u32 rctrl;
+	u32 cctrl;
+	u32 integloop_gain;
+	u32 pll_cmp;
+	int i, ret;
+
+	/* bit clk = 10 * pix_clk */
+	bclk = ((u64)pix_clk) * 10;
+
+	ret = pll_get_post_div(&pd, bclk);
+	if (ret)
+		return ret;
+
+	dec_start = pd.vco_freq;
+	pll_divisor = 4 * ref_clk;
+	do_div(dec_start, pll_divisor);
+
+	frac_start = pd.vco_freq * (1 << 20);
+
+	rem = do_div(frac_start, pll_divisor);
+	frac_start -= dec_start * (1 << 20);
+	if (rem > (pll_divisor >> 1))
+		frac_start++;
+
+	cpctrl = pll_get_cpctrl(frac_start, ref_clk, false);
+	rctrl = pll_get_rctrl(frac_start, false);
+	cctrl = pll_get_cctrl(frac_start, false);
+	integloop_gain = pll_get_integloop_gain(frac_start, bclk,
+						ref_clk, false);
+
+	fdata = pd.vco_freq;
+	do_div(fdata, pd.vco_ratio);
+
+	pll_cmp = pll_get_pll_cmp(fdata, ref_clk);
+
+	/* Convert these values to register specific values */
+	if (bclk > HDMI_DIG_FREQ_BIT_CLK_THRESHOLD)
+		cfg->com_svs_mode_clk_sel = 1;
+	else
+		cfg->com_svs_mode_clk_sel = 2;
+
+	cfg->com_hsclk_sel = (0x20 | pd.hsclk_divsel);
+	cfg->com_pll_cctrl_mode0 = cctrl;
+	cfg->com_pll_rctrl_mode0 = rctrl;
+	cfg->com_cp_ctrl_mode0 = cpctrl;
+	cfg->com_dec_start_mode0 = dec_start;
+	cfg->com_div_frac_start1_mode0 = (frac_start & 0xff);
+	cfg->com_div_frac_start2_mode0 = ((frac_start & 0xff00) >> 8);
+	cfg->com_div_frac_start3_mode0 = ((frac_start & 0xf0000) >> 16);
+	cfg->com_integloop_gain0_mode0 = (integloop_gain & 0xff);
+	cfg->com_integloop_gain1_mode0 = ((integloop_gain & 0xf00) >> 8);
+	cfg->com_lock_cmp1_mode0 = (pll_cmp & 0xff);
+	cfg->com_lock_cmp2_mode0 = ((pll_cmp & 0xff00) >> 8);
+	cfg->com_lock_cmp3_mode0 = ((pll_cmp & 0x30000) >> 16);
+	cfg->com_lock_cmp_en = 0x0;
+	cfg->com_core_clk_en = 0x2c;
+	cfg->com_coreclk_div_mode0 = HDMI_CORECLK_DIV;
+	cfg->phy_mode = (bclk > HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD) ? 0x5 : 0x4;
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++)
+		cfg->tx_lx_tx_band[i] = pd.tx_band_sel;
+
+	if (bclk > HDMI_HIGH_FREQ_BIT_CLK_THRESHOLD) {
+		cfg->tx_lx_tx_drv_lvl[0] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[1] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[2] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[3] = 0x0f;
+		cfg->tx_lx_tx_emp_post1_lvl[0] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[1] = 0x02;
+		cfg->tx_lx_tx_emp_post1_lvl[2] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[3] = 0x00;
+		cfg->tx_lx_pre_driver_1[0] = 0x00;
+		cfg->tx_lx_pre_driver_1[1] = 0x00;
+		cfg->tx_lx_pre_driver_1[2] = 0x00;
+		cfg->tx_lx_pre_driver_1[3] = 0x00;
+		cfg->tx_lx_pre_driver_2[0] = 0x1C;
+		cfg->tx_lx_pre_driver_2[1] = 0x1C;
+		cfg->tx_lx_pre_driver_2[2] = 0x1C;
+		cfg->tx_lx_pre_driver_2[3] = 0x00;
+		cfg->tx_lx_res_code_offset[0] = 0x03;
+		cfg->tx_lx_res_code_offset[1] = 0x00;
+		cfg->tx_lx_res_code_offset[2] = 0x00;
+		cfg->tx_lx_res_code_offset[3] = 0x03;
+	} else if (bclk > HDMI_DIG_FREQ_BIT_CLK_THRESHOLD) {
+		cfg->tx_lx_tx_drv_lvl[0] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[1] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[2] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[3] = 0x0f;
+		cfg->tx_lx_tx_emp_post1_lvl[0] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[1] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[2] = 0x03;
+		cfg->tx_lx_tx_emp_post1_lvl[3] = 0x00;
+		cfg->tx_lx_pre_driver_1[0] = 0x00;
+		cfg->tx_lx_pre_driver_1[1] = 0x00;
+		cfg->tx_lx_pre_driver_1[2] = 0x00;
+		cfg->tx_lx_pre_driver_1[3] = 0x00;
+		cfg->tx_lx_pre_driver_2[0] = 0x16;
+		cfg->tx_lx_pre_driver_2[1] = 0x16;
+		cfg->tx_lx_pre_driver_2[2] = 0x16;
+		cfg->tx_lx_pre_driver_2[3] = 0x18;
+		cfg->tx_lx_res_code_offset[0] = 0x03;
+		cfg->tx_lx_res_code_offset[1] = 0x00;
+		cfg->tx_lx_res_code_offset[2] = 0x00;
+		cfg->tx_lx_res_code_offset[3] = 0x00;
+	} else if (bclk > HDMI_MID_FREQ_BIT_CLK_THRESHOLD) {
+		cfg->tx_lx_tx_drv_lvl[0] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[1] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[2] = 0x0f;
+		cfg->tx_lx_tx_drv_lvl[3] = 0x0f;
+		cfg->tx_lx_tx_emp_post1_lvl[0] = 0x05;
+		cfg->tx_lx_tx_emp_post1_lvl[1] = 0x05;
+		cfg->tx_lx_tx_emp_post1_lvl[2] = 0x05;
+		cfg->tx_lx_tx_emp_post1_lvl[3] = 0x00;
+		cfg->tx_lx_pre_driver_1[0] = 0x00;
+		cfg->tx_lx_pre_driver_1[1] = 0x00;
+		cfg->tx_lx_pre_driver_1[2] = 0x00;
+		cfg->tx_lx_pre_driver_1[3] = 0x00;
+		cfg->tx_lx_pre_driver_2[0] = 0x0E;
+		cfg->tx_lx_pre_driver_2[1] = 0x0E;
+		cfg->tx_lx_pre_driver_2[2] = 0x0E;
+		cfg->tx_lx_pre_driver_2[3] = 0x0E;
+		cfg->tx_lx_res_code_offset[0] = 0x00;
+		cfg->tx_lx_res_code_offset[1] = 0x00;
+		cfg->tx_lx_res_code_offset[2] = 0x00;
+		cfg->tx_lx_res_code_offset[3] = 0x00;
+	} else {
+		cfg->tx_lx_tx_drv_lvl[0] = 0x01;
+		cfg->tx_lx_tx_drv_lvl[1] = 0x01;
+		cfg->tx_lx_tx_drv_lvl[2] = 0x01;
+		cfg->tx_lx_tx_drv_lvl[3] = 0x00;
+		cfg->tx_lx_tx_emp_post1_lvl[0] = 0x00;
+		cfg->tx_lx_tx_emp_post1_lvl[1] = 0x00;
+		cfg->tx_lx_tx_emp_post1_lvl[2] = 0x00;
+		cfg->tx_lx_tx_emp_post1_lvl[3] = 0x00;
+		cfg->tx_lx_pre_driver_1[0] = 0x00;
+		cfg->tx_lx_pre_driver_1[1] = 0x00;
+		cfg->tx_lx_pre_driver_1[2] = 0x00;
+		cfg->tx_lx_pre_driver_1[3] = 0x00;
+		cfg->tx_lx_pre_driver_2[0] = 0x16;
+		cfg->tx_lx_pre_driver_2[1] = 0x16;
+		cfg->tx_lx_pre_driver_2[2] = 0x16;
+		cfg->tx_lx_pre_driver_2[3] = 0x18;
+		cfg->tx_lx_res_code_offset[0] = 0x00;
+		cfg->tx_lx_res_code_offset[1] = 0x00;
+		cfg->tx_lx_res_code_offset[2] = 0x00;
+		cfg->tx_lx_res_code_offset[3] = 0x00;
+	}
+
+	return 0;
+}
+
+static int hdmi_8998_pll_set_clk_rate(struct clk_hw *hw, unsigned long rate,
+				      unsigned long parent_rate)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+	struct hdmi_8998_phy_pll_reg_cfg cfg = {};
+	int i, ret;
+
+	ret = pll_calculate(rate, parent_rate, &cfg);
+	if (ret) {
+		DRM_ERROR("PLL calculation failed\n");
+		return ret;
+	}
+
+	/* Initially shut down PHY */
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_PD_CTL, 0x0);
+	udelay(500);
+
+	/* Power up sequence */
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_PD_CTL, 0x1);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_RESETSM_CNTRL, 0x20);
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CMN_CTRL, 0x6);
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_INTERFACE_SELECT_TX_BAND,
+				   cfg.tx_lx_tx_band[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_CLKBUF_TERM_ENABLE,
+				   0x1);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_LANE_MODE,
+				   0x20);
+	}
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_SYSCLK_BUF_ENABLE, 0x02);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_BIAS_EN_CLKBUFLR_EN, 0x0B);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_SYSCLK_EN_SEL, 0x37);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_SYS_CLK_CTRL, 0x02);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CLK_ENABLE1, 0x0E);
+
+	/* Bypass VCO calibration */
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_SVS_MODE_CLK_SEL,
+		       cfg.com_svs_mode_clk_sel);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_PLL_IVCO, 0x07);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_VCO_TUNE_CTRL, 0x00);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CLK_SEL, 0x30);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_HSCLK_SEL,
+		       cfg.com_hsclk_sel);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_LOCK_CMP_EN,
+		       cfg.com_lock_cmp_en);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_PLL_CCTRL_MODE0,
+		       cfg.com_pll_cctrl_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_PLL_RCTRL_MODE0,
+		       cfg.com_pll_rctrl_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CP_CTRL_MODE0,
+		       cfg.com_cp_ctrl_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_DEC_START_MODE0,
+		       cfg.com_dec_start_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_DIV_FRAC_START1_MODE0,
+		       cfg.com_div_frac_start1_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_DIV_FRAC_START2_MODE0,
+		       cfg.com_div_frac_start2_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_DIV_FRAC_START3_MODE0,
+		       cfg.com_div_frac_start3_mode0);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_INTEGLOOP_GAIN0_MODE0,
+		       cfg.com_integloop_gain0_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_INTEGLOOP_GAIN1_MODE0,
+		       cfg.com_integloop_gain1_mode0);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_LOCK_CMP1_MODE0,
+		       cfg.com_lock_cmp1_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_LOCK_CMP2_MODE0,
+		       cfg.com_lock_cmp2_mode0);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_LOCK_CMP3_MODE0,
+		       cfg.com_lock_cmp3_mode0);
+
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_VCO_TUNE_MAP, 0x00);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CORE_CLK_EN,
+		       cfg.com_core_clk_en);
+	hdmi_pll_write(pll, REG_HDMI_8998_PHY_QSERDES_COM_CORECLK_DIV_MODE0,
+		       cfg.com_coreclk_div_mode0);
+
+	/* TX lanes setup (TX 0/1/2/3) */
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_DRV_LVL,
+				   cfg.tx_lx_tx_drv_lvl[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_EMP_POST1_LVL,
+				   cfg.tx_lx_tx_emp_post1_lvl[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_PRE_DRIVER_1,
+				   cfg.tx_lx_pre_driver_1[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_PRE_DRIVER_2,
+				   cfg.tx_lx_pre_driver_2[i]);
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_DRV_LVL_RES_CODE_OFFSET,
+				   cfg.tx_lx_res_code_offset[i]);
+	}
+
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_MODE, cfg.phy_mode);
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_LANE_CONFIG,
+				   0x10);
+	}
+
+	/*
+	 * Ensure that vco configuration gets flushed to hardware before
+	 * enabling the PLL
+	 */
+	wmb();
+
+	pll->rate = rate;
+
+	return 0;
+}
+
+static int hdmi_8998_phy_ready_status(struct hdmi_phy *phy)
+{
+	u32 nb_tries = HDMI_PLL_POLL_MAX_READS;
+	unsigned long timeout = HDMI_PLL_POLL_TIMEOUT_US;
+	u32 status;
+	int phy_ready = 0;
+
+	while (nb_tries--) {
+		status = hdmi_phy_read(phy, REG_HDMI_8998_PHY_STATUS);
+		phy_ready = status & BIT(0);
+
+		if (phy_ready)
+			break;
+
+		udelay(timeout);
+	}
+
+	return phy_ready;
+}
+
+static int hdmi_8998_pll_lock_status(struct hdmi_pll_8998 *pll)
+{
+	u32 status;
+	int nb_tries = HDMI_PLL_POLL_MAX_READS;
+	unsigned long timeout = HDMI_PLL_POLL_TIMEOUT_US;
+	int pll_locked = 0;
+
+	while (nb_tries--) {
+		status = hdmi_pll_read(pll,
+				       REG_HDMI_8998_PHY_QSERDES_COM_C_READY_STATUS);
+		pll_locked = status & BIT(0);
+
+		if (pll_locked)
+			break;
+
+		udelay(timeout);
+	}
+
+	return pll_locked;
+}
+
+static int hdmi_8998_pll_prepare(struct clk_hw *hw)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+	int i, ret = 0;
+
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CFG, 0x1);
+	udelay(100);
+
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CFG, 0x59);
+	udelay(100);
+
+	ret = hdmi_8998_pll_lock_status(pll);
+	if (!ret)
+		return ret;
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		hdmi_tx_chan_write(pll, i,
+				   REG_HDMI_8998_PHY_TXn_LANE_CONFIG, 0x1F);
+	}
+
+	/* Ensure all registers are flushed to hardware */
+	wmb();
+
+	ret = hdmi_8998_phy_ready_status(phy);
+	if (!ret)
+		return ret;
+
+	/* Restart the retiming buffer */
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CFG, 0x58);
+	udelay(1);
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_CFG, 0x59);
+
+	/* Ensure all registers are flushed to hardware */
+	wmb();
+
+	return 0;
+}
+
+static long hdmi_8998_pll_round_rate(struct clk_hw *hw,
+				     unsigned long rate,
+				     unsigned long *parent_rate)
+{
+	if (rate < HDMI_PCLK_MIN_FREQ)
+		return HDMI_PCLK_MIN_FREQ;
+	else if (rate > HDMI_PCLK_MAX_FREQ)
+		return HDMI_PCLK_MAX_FREQ;
+	else
+		return rate;
+}
+
+static unsigned long hdmi_8998_pll_recalc_rate(struct clk_hw *hw,
+					       unsigned long parent_rate)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	return pll->rate;
+}
+
+static void hdmi_8998_pll_unprepare(struct clk_hw *hw)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+
+	hdmi_phy_write(phy, REG_HDMI_8998_PHY_PD_CTL, 0);
+	usleep_range(100, 150);
+}
+
+static int hdmi_8998_pll_is_enabled(struct clk_hw *hw)
+{
+	struct hdmi_pll_8998 *pll = hw_clk_to_pll(hw);
+	u32 status;
+	int pll_locked;
+
+	status = hdmi_pll_read(pll, REG_HDMI_8998_PHY_QSERDES_COM_C_READY_STATUS);
+	pll_locked = status & BIT(0);
+
+	return pll_locked;
+}
+
+static const struct clk_ops hdmi_8998_pll_ops = {
+	.set_rate = hdmi_8998_pll_set_clk_rate,
+	.round_rate = hdmi_8998_pll_round_rate,
+	.recalc_rate = hdmi_8998_pll_recalc_rate,
+	.prepare = hdmi_8998_pll_prepare,
+	.unprepare = hdmi_8998_pll_unprepare,
+	.is_enabled = hdmi_8998_pll_is_enabled,
+};
+
+static const struct clk_init_data pll_init = {
+	.name = "hdmipll",
+	.ops = &hdmi_8998_pll_ops,
+	.parent_data = (const struct clk_parent_data[]){
+		{ .fw_name = "xo", .name = "xo_board" },
+	},
+	.num_parents = 1,
+	.flags = CLK_IGNORE_UNUSED,
+};
+
+int msm_hdmi_pll_8998_init(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct hdmi_pll_8998 *pll;
+	int ret, i;
+
+	pll = devm_kzalloc(dev, sizeof(*pll), GFP_KERNEL);
+	if (!pll)
+		return -ENOMEM;
+
+	pll->pdev = pdev;
+
+	pll->mmio_qserdes_com = msm_ioremap(pdev, "hdmi_pll");
+	if (IS_ERR(pll->mmio_qserdes_com)) {
+		DRM_DEV_ERROR(dev, "failed to map pll base\n");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < HDMI_NUM_TX_CHANNEL; i++) {
+		char name[32];
+
+		snprintf(name, sizeof(name), "hdmi_tx_l%d", i);
+
+		pll->mmio_qserdes_tx[i] = msm_ioremap(pdev, name);
+		if (IS_ERR(pll->mmio_qserdes_tx[i])) {
+			DRM_DEV_ERROR(dev, "failed to map pll base\n");
+			return -ENOMEM;
+		}
+	}
+	pll->clk_hw.init = &pll_init;
+
+	ret = devm_clk_hw_register(dev, &pll->clk_hw);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to register pll clock\n");
+		return ret;
+	}
+
+	ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, &pll->clk_hw);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to register clk provider: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static const char * const hdmi_phy_8998_reg_names[] = {
+	"vddio",
+	"vcca",
+};
+
+static const char * const hdmi_phy_8998_clk_names[] = {
+	"iface", "ref", "xo",
+};
+
+const struct hdmi_phy_cfg msm_hdmi_phy_8998_cfg = {
+	.type = MSM_HDMI_PHY_8998,
+	.reg_names = hdmi_phy_8998_reg_names,
+	.num_regs = ARRAY_SIZE(hdmi_phy_8998_reg_names),
+	.clk_names = hdmi_phy_8998_clk_names,
+	.num_clks = ARRAY_SIZE(hdmi_phy_8998_clk_names),
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8x60.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8x60.c
@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/delay.h>
+
+#include "hdmi.h"
+
+static void hdmi_phy_8x60_powerup(struct hdmi_phy *phy,
+		unsigned long int pixclock)
+{
+	/* De-serializer delay D/C for non-lbk mode: */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG0,
+		       HDMI_8x60_PHY_REG0_DESER_DEL_CTRL(3));
+
+	if (pixclock == 27000000) {
+		/* video_format == HDMI_VFRMT_720x480p60_16_9 */
+		hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG1,
+			       HDMI_8x60_PHY_REG1_DTEST_MUX_SEL(5) |
+			       HDMI_8x60_PHY_REG1_OUTVOL_SWING_CTRL(3));
+	} else {
+		hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG1,
+			       HDMI_8x60_PHY_REG1_DTEST_MUX_SEL(5) |
+			       HDMI_8x60_PHY_REG1_OUTVOL_SWING_CTRL(4));
+	}
+
+	/* No matter what, start from the power down mode: */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG2,
+		       HDMI_8x60_PHY_REG2_PD_PWRGEN |
+		       HDMI_8x60_PHY_REG2_PD_PLL |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_4 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_3 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_2 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_1 |
+		       HDMI_8x60_PHY_REG2_PD_DESER);
+
+	/* Turn PowerGen on: */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG2,
+		       HDMI_8x60_PHY_REG2_PD_PLL |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_4 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_3 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_2 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_1 |
+		       HDMI_8x60_PHY_REG2_PD_DESER);
+
+	/* Turn PLL power on: */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG2,
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_4 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_3 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_2 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_1 |
+		       HDMI_8x60_PHY_REG2_PD_DESER);
+
+	/* Write to HIGH after PLL power down de-assert: */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG3,
+		       HDMI_8x60_PHY_REG3_PLL_ENABLE);
+
+	/* ASIC power on; PHY REG9 = 0 */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG9, 0);
+
+	/* Enable PLL lock detect, PLL lock det will go high after lock
+	 * Enable the re-time logic
+	 */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG12,
+		       HDMI_8x60_PHY_REG12_RETIMING_EN |
+		       HDMI_8x60_PHY_REG12_PLL_LOCK_DETECT_EN);
+
+	/* Drivers are on: */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG2,
+		       HDMI_8x60_PHY_REG2_PD_DESER);
+
+	/* If the RX detector is needed: */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG2,
+		       HDMI_8x60_PHY_REG2_RCV_SENSE_EN |
+		       HDMI_8x60_PHY_REG2_PD_DESER);
+
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG4, 0);
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG5, 0);
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG6, 0);
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG7, 0);
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG8, 0);
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG9, 0);
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG10, 0);
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG11, 0);
+
+	/* If we want to use lock enable based on counting: */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG12,
+		       HDMI_8x60_PHY_REG12_RETIMING_EN |
+		       HDMI_8x60_PHY_REG12_PLL_LOCK_DETECT_EN |
+		       HDMI_8x60_PHY_REG12_FORCE_LOCK);
+}
+
+static void hdmi_phy_8x60_powerdown(struct hdmi_phy *phy)
+{
+	/* Assert RESET PHY from controller */
+	hdmi_phy_write(phy, REG_HDMI_PHY_CTRL,
+		       HDMI_PHY_CTRL_SW_RESET);
+	udelay(10);
+	/* De-assert RESET PHY from controller */
+	hdmi_phy_write(phy, REG_HDMI_PHY_CTRL, 0);
+	/* Turn off Driver */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG2,
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_4 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_3 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_2 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_1 |
+		       HDMI_8x60_PHY_REG2_PD_DESER);
+	udelay(10);
+	/* Disable PLL */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG3, 0);
+	/* Power down PHY, but keep RX-sense: */
+	hdmi_phy_write(phy, REG_HDMI_8x60_PHY_REG2,
+		       HDMI_8x60_PHY_REG2_RCV_SENSE_EN |
+		       HDMI_8x60_PHY_REG2_PD_PWRGEN |
+		       HDMI_8x60_PHY_REG2_PD_PLL |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_4 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_3 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_2 |
+		       HDMI_8x60_PHY_REG2_PD_DRIVE_1 |
+		       HDMI_8x60_PHY_REG2_PD_DESER);
+}
+
+static const char * const hdmi_phy_8x60_reg_names[] = {
+	"core-vdda",
+};
+
+static const char * const hdmi_phy_8x60_clk_names[] = {
+	"slave_iface",
+};
+
+const struct hdmi_phy_cfg msm_hdmi_phy_8x60_cfg = {
+	.type = MSM_HDMI_PHY_8x60,
+	.powerup = hdmi_phy_8x60_powerup,
+	.powerdown = hdmi_phy_8x60_powerdown,
+	.reg_names = hdmi_phy_8x60_reg_names,
+	.num_regs = ARRAY_SIZE(hdmi_phy_8x60_reg_names),
+	.clk_names = hdmi_phy_8x60_clk_names,
+	.num_clks = ARRAY_SIZE(hdmi_phy_8x60_clk_names),
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8x74.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_phy_8x74.c
@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include "hdmi.h"
+
+static void hdmi_phy_8x74_powerup(struct hdmi_phy *phy,
+		unsigned long int pixclock)
+{
+	hdmi_phy_write(phy, REG_HDMI_8x74_ANA_CFG0,   0x1b);
+	hdmi_phy_write(phy, REG_HDMI_8x74_ANA_CFG1,   0xf2);
+	hdmi_phy_write(phy, REG_HDMI_8x74_BIST_CFG0,  0x0);
+	hdmi_phy_write(phy, REG_HDMI_8x74_BIST_PATN0, 0x0);
+	hdmi_phy_write(phy, REG_HDMI_8x74_BIST_PATN1, 0x0);
+	hdmi_phy_write(phy, REG_HDMI_8x74_BIST_PATN2, 0x0);
+	hdmi_phy_write(phy, REG_HDMI_8x74_BIST_PATN3, 0x0);
+	hdmi_phy_write(phy, REG_HDMI_8x74_PD_CTRL1,   0x20);
+}
+
+static void hdmi_phy_8x74_powerdown(struct hdmi_phy *phy)
+{
+	hdmi_phy_write(phy, REG_HDMI_8x74_PD_CTRL0, 0x7f);
+}
+
+static const char * const hdmi_phy_8x74_reg_names[] = {
+	"core-vdda",
+	"vddio",
+};
+
+static const char * const hdmi_phy_8x74_clk_names[] = {
+	"iface", "alt_iface"
+};
+
+const struct hdmi_phy_cfg msm_hdmi_phy_8x74_cfg = {
+	.type = MSM_HDMI_PHY_8x74,
+	.powerup = hdmi_phy_8x74_powerup,
+	.powerdown = hdmi_phy_8x74_powerdown,
+	.reg_names = hdmi_phy_8x74_reg_names,
+	.num_regs = ARRAY_SIZE(hdmi_phy_8x74_reg_names),
+	.clk_names = hdmi_phy_8x74_clk_names,
+	.num_clks = ARRAY_SIZE(hdmi_phy_8x74_clk_names),
+};
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/hdmi_pll_8960.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/hdmi_pll_8960.c
@@ -0,0 +1,458 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+
+#include "hdmi.h"
+
+struct hdmi_pll_8960 {
+	struct platform_device *pdev;
+	struct clk_hw clk_hw;
+	void __iomem *mmio;
+
+	unsigned long pixclk;
+};
+
+#define hw_clk_to_pll(x) container_of(x, struct hdmi_pll_8960, clk_hw)
+
+/*
+ * HDMI PLL:
+ *
+ * To get the parent clock setup properly, we need to plug in hdmi pll
+ * configuration into common-clock-framework.
+ */
+
+struct pll_rate {
+	unsigned long rate;
+	int num_reg;
+	struct {
+		u32 val;
+		u32 reg;
+	} conf[32];
+};
+
+/* NOTE: keep sorted highest freq to lowest: */
+static const struct pll_rate freqtbl[] = {
+	{ 154000000, 14, {
+		{ 0x08, REG_HDMI_8960_PHY_PLL_REFCLK_CFG    },
+		{ 0x20, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG0 },
+		{ 0xf9, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG1 },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG0   },
+		{ 0x03, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG1   },
+		{ 0x3b, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG2   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG3   },
+		{ 0x86, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG4   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG5   },
+		{ 0x0d, REG_HDMI_8960_PHY_PLL_SDM_CFG0      },
+		{ 0x4d, REG_HDMI_8960_PHY_PLL_SDM_CFG1      },
+		{ 0x5e, REG_HDMI_8960_PHY_PLL_SDM_CFG2      },
+		{ 0x42, REG_HDMI_8960_PHY_PLL_SDM_CFG3      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG4      },
+			}
+	},
+	/* 1080p60/1080p50 case */
+	{ 148500000, 27, {
+		{ 0x02, REG_HDMI_8960_PHY_PLL_REFCLK_CFG    },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_CHRG_PUMP_CFG },
+		{ 0x01, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG0 },
+		{ 0x33, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG1 },
+		{ 0x2c, REG_HDMI_8960_PHY_PLL_IDAC_ADJ_CFG  },
+		{ 0x06, REG_HDMI_8960_PHY_PLL_I_VI_KVCO_CFG },
+		{ 0x0a, REG_HDMI_8960_PHY_PLL_PWRDN_B       },
+		{ 0x76, REG_HDMI_8960_PHY_PLL_SDM_CFG0      },
+		{ 0x01, REG_HDMI_8960_PHY_PLL_SDM_CFG1      },
+		{ 0x4c, REG_HDMI_8960_PHY_PLL_SDM_CFG2      },
+		{ 0xc0, REG_HDMI_8960_PHY_PLL_SDM_CFG3      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG4      },
+		{ 0x9a, REG_HDMI_8960_PHY_PLL_SSC_CFG0      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SSC_CFG1      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SSC_CFG2      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SSC_CFG3      },
+		{ 0x10, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG0  },
+		{ 0x1a, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG1  },
+		{ 0x0d, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG2  },
+		{ 0xe6, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG0   },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG1   },
+		{ 0x3b, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG2   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG3   },
+		{ 0x86, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG4   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG5   },
+		{ 0x33, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG6   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG7   },
+			}
+	},
+	{ 108000000, 13, {
+		{ 0x08, REG_HDMI_8960_PHY_PLL_REFCLK_CFG    },
+		{ 0x21, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG0 },
+		{ 0xf9, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG1 },
+		{ 0x1c, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG0   },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG1   },
+		{ 0x3b, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG2   },
+		{ 0x86, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG4   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG5   },
+		{ 0x49, REG_HDMI_8960_PHY_PLL_SDM_CFG0      },
+		{ 0x49, REG_HDMI_8960_PHY_PLL_SDM_CFG1      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG2      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG3      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG4      },
+			}
+	},
+	/* 720p60/720p50/1080i60/1080i50/1080p24/1080p30/1080p25 */
+	{ 74250000, 8, {
+		{ 0x0a, REG_HDMI_8960_PHY_PLL_PWRDN_B       },
+		{ 0x12, REG_HDMI_8960_PHY_PLL_REFCLK_CFG    },
+		{ 0x01, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG0 },
+		{ 0x33, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG1 },
+		{ 0x76, REG_HDMI_8960_PHY_PLL_SDM_CFG0      },
+		{ 0xe6, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG0   },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG1   },
+		{ 0x3b, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG2   },
+			}
+	},
+	{ 74176000, 14, {
+		{ 0x18, REG_HDMI_8960_PHY_PLL_REFCLK_CFG    },
+		{ 0x20, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG0 },
+		{ 0xf9, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG1 },
+		{ 0xe5, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG0   },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG1   },
+		{ 0x3b, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG2   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG3   },
+		{ 0x86, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG4   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG5   },
+		{ 0x0c, REG_HDMI_8960_PHY_PLL_SDM_CFG0      },
+		{ 0x4c, REG_HDMI_8960_PHY_PLL_SDM_CFG1      },
+		{ 0x7d, REG_HDMI_8960_PHY_PLL_SDM_CFG2      },
+		{ 0xbc, REG_HDMI_8960_PHY_PLL_SDM_CFG3      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG4      },
+			}
+	},
+	{ 65000000, 14, {
+		{ 0x18, REG_HDMI_8960_PHY_PLL_REFCLK_CFG    },
+		{ 0x20, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG0 },
+		{ 0xf9, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG1 },
+		{ 0x8a, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG0   },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG1   },
+		{ 0x3b, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG2   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG3   },
+		{ 0x86, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG4   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG5   },
+		{ 0x0b, REG_HDMI_8960_PHY_PLL_SDM_CFG0      },
+		{ 0x4b, REG_HDMI_8960_PHY_PLL_SDM_CFG1      },
+		{ 0x7b, REG_HDMI_8960_PHY_PLL_SDM_CFG2      },
+		{ 0x09, REG_HDMI_8960_PHY_PLL_SDM_CFG3      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG4      },
+			}
+	},
+	/* 480p60/480i60 */
+	{ 27030000, 18, {
+		{ 0x0a, REG_HDMI_8960_PHY_PLL_PWRDN_B       },
+		{ 0x38, REG_HDMI_8960_PHY_PLL_REFCLK_CFG    },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_CHRG_PUMP_CFG },
+		{ 0x20, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG0 },
+		{ 0xff, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG1 },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG0      },
+		{ 0x4e, REG_HDMI_8960_PHY_PLL_SDM_CFG1      },
+		{ 0xd7, REG_HDMI_8960_PHY_PLL_SDM_CFG2      },
+		{ 0x03, REG_HDMI_8960_PHY_PLL_SDM_CFG3      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG4      },
+		{ 0x2a, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG0   },
+		{ 0x03, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG1   },
+		{ 0x3b, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG2   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG3   },
+		{ 0x86, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG4   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG5   },
+		{ 0x33, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG6   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG7   },
+			}
+	},
+	/* 576p50/576i50 */
+	{ 27000000, 27, {
+		{ 0x32, REG_HDMI_8960_PHY_PLL_REFCLK_CFG    },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_CHRG_PUMP_CFG },
+		{ 0x01, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG0 },
+		{ 0x33, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG1 },
+		{ 0x2c, REG_HDMI_8960_PHY_PLL_IDAC_ADJ_CFG  },
+		{ 0x06, REG_HDMI_8960_PHY_PLL_I_VI_KVCO_CFG },
+		{ 0x0a, REG_HDMI_8960_PHY_PLL_PWRDN_B       },
+		{ 0x7b, REG_HDMI_8960_PHY_PLL_SDM_CFG0      },
+		{ 0x01, REG_HDMI_8960_PHY_PLL_SDM_CFG1      },
+		{ 0x4c, REG_HDMI_8960_PHY_PLL_SDM_CFG2      },
+		{ 0xc0, REG_HDMI_8960_PHY_PLL_SDM_CFG3      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG4      },
+		{ 0x9a, REG_HDMI_8960_PHY_PLL_SSC_CFG0      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SSC_CFG1      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SSC_CFG2      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SSC_CFG3      },
+		{ 0x10, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG0  },
+		{ 0x1a, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG1  },
+		{ 0x0d, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG2  },
+		{ 0x2a, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG0   },
+		{ 0x03, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG1   },
+		{ 0x3b, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG2   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG3   },
+		{ 0x86, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG4   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG5   },
+		{ 0x33, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG6   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG7   },
+			}
+	},
+	/* 640x480p60 */
+	{ 25200000, 27, {
+		{ 0x32, REG_HDMI_8960_PHY_PLL_REFCLK_CFG    },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_CHRG_PUMP_CFG },
+		{ 0x01, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG0 },
+		{ 0x33, REG_HDMI_8960_PHY_PLL_LOOP_FLT_CFG1 },
+		{ 0x2c, REG_HDMI_8960_PHY_PLL_IDAC_ADJ_CFG  },
+		{ 0x06, REG_HDMI_8960_PHY_PLL_I_VI_KVCO_CFG },
+		{ 0x0a, REG_HDMI_8960_PHY_PLL_PWRDN_B       },
+		{ 0x77, REG_HDMI_8960_PHY_PLL_SDM_CFG0      },
+		{ 0x4c, REG_HDMI_8960_PHY_PLL_SDM_CFG1      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG2      },
+		{ 0xc0, REG_HDMI_8960_PHY_PLL_SDM_CFG3      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SDM_CFG4      },
+		{ 0x9a, REG_HDMI_8960_PHY_PLL_SSC_CFG0      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SSC_CFG1      },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_SSC_CFG2      },
+		{ 0x20, REG_HDMI_8960_PHY_PLL_SSC_CFG3      },
+		{ 0x10, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG0  },
+		{ 0x1a, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG1  },
+		{ 0x0d, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG2  },
+		{ 0xf4, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG0   },
+		{ 0x02, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG1   },
+		{ 0x3b, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG2   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG3   },
+		{ 0x86, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG4   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG5   },
+		{ 0x33, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG6   },
+		{ 0x00, REG_HDMI_8960_PHY_PLL_VCOCAL_CFG7   },
+			}
+	},
+};
+
+static inline void pll_write(struct hdmi_pll_8960 *pll, u32 reg, u32 data)
+{
+	msm_writel(data, pll->mmio + reg);
+}
+
+static inline u32 pll_read(struct hdmi_pll_8960 *pll, u32 reg)
+{
+	return msm_readl(pll->mmio + reg);
+}
+
+static inline struct hdmi_phy *pll_get_phy(struct hdmi_pll_8960 *pll)
+{
+	return platform_get_drvdata(pll->pdev);
+}
+
+static int hdmi_pll_enable(struct clk_hw *hw)
+{
+	struct hdmi_pll_8960 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+	int timeout_count, pll_lock_retry = 10;
+	unsigned int val;
+
+	DBG("");
+
+	/* Assert PLL S/W reset */
+	pll_write(pll, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG2, 0x8d);
+	pll_write(pll, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG0, 0x10);
+	pll_write(pll, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG1, 0x1a);
+
+	/* Wait for a short time before de-asserting
+	 * to allow the hardware to complete its job.
+	 * This much of delay should be fine for hardware
+	 * to assert and de-assert.
+	 */
+	udelay(10);
+
+	/* De-assert PLL S/W reset */
+	pll_write(pll, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG2, 0x0d);
+
+	val = hdmi_phy_read(phy, REG_HDMI_8960_PHY_REG12);
+	val |= HDMI_8960_PHY_REG12_SW_RESET;
+	/* Assert PHY S/W reset */
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG12, val);
+	val &= ~HDMI_8960_PHY_REG12_SW_RESET;
+	/*
+	 * Wait for a short time before de-asserting to allow the hardware to
+	 * complete its job. This much of delay should be fine for hardware to
+	 * assert and de-assert.
+	 */
+	udelay(10);
+	/* De-assert PHY S/W reset */
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG12, val);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG2,  0x3f);
+
+	val = hdmi_phy_read(phy, REG_HDMI_8960_PHY_REG12);
+	val |= HDMI_8960_PHY_REG12_PWRDN_B;
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG12, val);
+	/* Wait 10 us for enabling global power for PHY */
+	mb();
+	udelay(10);
+
+	val = pll_read(pll, REG_HDMI_8960_PHY_PLL_PWRDN_B);
+	val |= HDMI_8960_PHY_PLL_PWRDN_B_PLL_PWRDN_B;
+	val &= ~HDMI_8960_PHY_PLL_PWRDN_B_PD_PLL;
+	pll_write(pll, REG_HDMI_8960_PHY_PLL_PWRDN_B, val);
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG2, 0x80);
+
+	timeout_count = 1000;
+	while (--pll_lock_retry > 0) {
+		/* are we there yet? */
+		val = pll_read(pll, REG_HDMI_8960_PHY_PLL_STATUS0);
+		if (val & HDMI_8960_PHY_PLL_STATUS0_PLL_LOCK)
+			break;
+
+		udelay(1);
+
+		if (--timeout_count > 0)
+			continue;
+
+		/*
+		 * PLL has still not locked.
+		 * Do a software reset and try again
+		 * Assert PLL S/W reset first
+		 */
+		pll_write(pll, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG2, 0x8d);
+		udelay(10);
+		pll_write(pll, REG_HDMI_8960_PHY_PLL_LOCKDET_CFG2, 0x0d);
+
+		/*
+		 * Wait for a short duration for the PLL calibration
+		 * before checking if the PLL gets locked
+		 */
+		udelay(350);
+
+		timeout_count = 1000;
+	}
+
+	return 0;
+}
+
+static void hdmi_pll_disable(struct clk_hw *hw)
+{
+	struct hdmi_pll_8960 *pll = hw_clk_to_pll(hw);
+	struct hdmi_phy *phy = pll_get_phy(pll);
+	unsigned int val;
+
+	DBG("");
+
+	val = hdmi_phy_read(phy, REG_HDMI_8960_PHY_REG12);
+	val &= ~HDMI_8960_PHY_REG12_PWRDN_B;
+	hdmi_phy_write(phy, REG_HDMI_8960_PHY_REG12, val);
+
+	val = pll_read(pll, REG_HDMI_8960_PHY_PLL_PWRDN_B);
+	val |= HDMI_8960_PHY_REG12_SW_RESET;
+	val &= ~HDMI_8960_PHY_REG12_PWRDN_B;
+	pll_write(pll, REG_HDMI_8960_PHY_PLL_PWRDN_B, val);
+	/* Make sure HDMI PHY/PLL are powered down */
+	mb();
+}
+
+static const struct pll_rate *find_rate(unsigned long rate)
+{
+	int i;
+
+	for (i = 1; i < ARRAY_SIZE(freqtbl); i++)
+		if (rate > freqtbl[i].rate)
+			return &freqtbl[i - 1];
+
+	return &freqtbl[i - 1];
+}
+
+static unsigned long hdmi_pll_recalc_rate(struct clk_hw *hw,
+					  unsigned long parent_rate)
+{
+	struct hdmi_pll_8960 *pll = hw_clk_to_pll(hw);
+
+	return pll->pixclk;
+}
+
+static long hdmi_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+				unsigned long *parent_rate)
+{
+	const struct pll_rate *pll_rate = find_rate(rate);
+
+	return pll_rate->rate;
+}
+
+static int hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+			     unsigned long parent_rate)
+{
+	struct hdmi_pll_8960 *pll = hw_clk_to_pll(hw);
+	const struct pll_rate *pll_rate = find_rate(rate);
+	int i;
+
+	DBG("rate=%lu", rate);
+
+	for (i = 0; i < pll_rate->num_reg; i++)
+		pll_write(pll, pll_rate->conf[i].reg, pll_rate->conf[i].val);
+
+	pll->pixclk = rate;
+
+	return 0;
+}
+
+static const struct clk_ops hdmi_pll_ops = {
+	.enable = hdmi_pll_enable,
+	.disable = hdmi_pll_disable,
+	.recalc_rate = hdmi_pll_recalc_rate,
+	.round_rate = hdmi_pll_round_rate,
+	.set_rate = hdmi_pll_set_rate,
+};
+
+static const struct clk_parent_data hdmi_pll_parents[] = {
+	{ .fw_name = "pxo", .name = "pxo_board" },
+};
+
+static struct clk_init_data pll_init = {
+	.name = "hdmi_pll",
+	.ops = &hdmi_pll_ops,
+	.parent_data = hdmi_pll_parents,
+	.num_parents = ARRAY_SIZE(hdmi_pll_parents),
+	.flags = CLK_IGNORE_UNUSED,
+};
+
+int msm_hdmi_pll_8960_init(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct hdmi_pll_8960 *pll;
+	int i, ret;
+
+	/* sanity check: */
+	for (i = 0; i < (ARRAY_SIZE(freqtbl) - 1); i++)
+		if (WARN_ON(freqtbl[i].rate < freqtbl[i + 1].rate))
+			return -EINVAL;
+
+	pll = devm_kzalloc(dev, sizeof(*pll), GFP_KERNEL);
+	if (!pll)
+		return -ENOMEM;
+
+	pll->mmio = msm_ioremap(pdev, "hdmi_pll");
+	if (IS_ERR(pll->mmio)) {
+		DRM_DEV_ERROR(dev, "failed to map pll base\n");
+		return -ENOMEM;
+	}
+
+	pll->pdev = pdev;
+	pll->clk_hw.init = &pll_init;
+
+	ret = devm_clk_hw_register(dev, &pll->clk_hw);
+	if (ret < 0) {
+		DRM_DEV_ERROR(dev, "failed to register pll clock\n");
+		return ret;
+	}
+
+	ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, &pll->clk_hw);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "%s: failed to register clk provider: %d\n", __func__, ret);
+		return ret;
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/hdmi/qfprom.xml.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/hdmi/qfprom.xml.h
@@ -0,0 +1,61 @@
+#ifndef QFPROM_XML
+#define QFPROM_XML
+
+/* Autogenerated file, DO NOT EDIT manually!
+
+This file was generated by the rules-ng-ng headergen tool in this git repository:
+http://github.com/freedreno/envytools/
+git clone https://github.com/freedreno/envytools.git
+
+The rules-ng-ng source files this header was generated from are:
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/msm.xml                   (    944 bytes, from 2022-07-23 20:21:46)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/freedreno_copyright.xml   (   1572 bytes, from 2022-07-23 20:21:46)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/mdp/mdp4.xml              (  20912 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/mdp/mdp_common.xml        (   2849 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/mdp/mdp5.xml              (  37461 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi.xml               (  18746 bytes, from 2022-04-28 17:29:36)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_v2.xml        (   3236 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_28nm_8960.xml (   4935 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_28nm.xml      (   7004 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_20nm.xml      (   3712 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_14nm.xml      (   5381 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_10nm.xml      (   4499 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/dsi_phy_7nm.xml       (  11007 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/sfpb.xml              (    602 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/dsi/mmss_cc.xml           (   1686 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/hdmi/qfprom.xml           (    600 bytes, from 2022-03-08 17:40:42)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/hdmi/hdmi.xml             (  42350 bytes, from 2022-09-20 17:45:56)
+- /home/robclark/src/mesa/mesa/src/freedreno/registers/edp/edp.xml               (  10416 bytes, from 2022-03-08 17:40:42)
+
+Copyright (C) 2013-2022 by the following authors:
+- Rob Clark <robdclark@gmail.com> (robclark)
+- Ilia Mirkin <imirkin@alum.mit.edu> (imirkin)
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice (including the
+next paragraph) shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+
+#define REG_QFPROM_CONFIG_ROW0_LSB				0x00000238
+#define QFPROM_CONFIG_ROW0_LSB_HDMI_DISABLE			0x00200000
+#define QFPROM_CONFIG_ROW0_LSB_HDCP_DISABLE			0x00400000
+
+
+#endif /* QFPROM_XML */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_atomic.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_atomic.c
@@ -0,0 +1,313 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2014 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_atomic_uapi.h>
+#include <drm/drm_vblank.h>
+
+#include "msm_atomic_trace.h"
+#include "msm_drv.h"
+#include "msm_gem.h"
+#include "msm_kms.h"
+
+/*
+ * Helpers to control vblanks while we flush.. basically just to ensure
+ * that vblank accounting is switched on, so we get valid seqn/timestamp
+ * on pageflip events (if requested)
+ */
+
+static void vblank_get(struct msm_kms *kms, unsigned crtc_mask)
+{
+	struct drm_crtc *crtc;
+
+	for_each_crtc_mask(kms->dev, crtc, crtc_mask) {
+		if (!crtc->state->active)
+			continue;
+		drm_crtc_vblank_get(crtc);
+	}
+}
+
+static void vblank_put(struct msm_kms *kms, unsigned crtc_mask)
+{
+	struct drm_crtc *crtc;
+
+	for_each_crtc_mask(kms->dev, crtc, crtc_mask) {
+		if (!crtc->state->active)
+			continue;
+		drm_crtc_vblank_put(crtc);
+	}
+}
+
+static void lock_crtcs(struct msm_kms *kms, unsigned int crtc_mask)
+{
+	int crtc_index;
+	struct drm_crtc *crtc;
+
+	for_each_crtc_mask(kms->dev, crtc, crtc_mask) {
+		crtc_index = drm_crtc_index(crtc);
+		mutex_lock_nested(&kms->commit_lock[crtc_index], crtc_index);
+	}
+}
+
+static void unlock_crtcs(struct msm_kms *kms, unsigned int crtc_mask)
+{
+	struct drm_crtc *crtc;
+
+	for_each_crtc_mask_reverse(kms->dev, crtc, crtc_mask)
+		mutex_unlock(&kms->commit_lock[drm_crtc_index(crtc)]);
+}
+
+static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx)
+{
+	unsigned crtc_mask = BIT(crtc_idx);
+
+	trace_msm_atomic_async_commit_start(crtc_mask);
+
+	lock_crtcs(kms, crtc_mask);
+
+	if (!(kms->pending_crtc_mask & crtc_mask)) {
+		unlock_crtcs(kms, crtc_mask);
+		goto out;
+	}
+
+	kms->pending_crtc_mask &= ~crtc_mask;
+
+	kms->funcs->enable_commit(kms);
+
+	vblank_get(kms, crtc_mask);
+
+	/*
+	 * Flush hardware updates:
+	 */
+	trace_msm_atomic_flush_commit(crtc_mask);
+	kms->funcs->flush_commit(kms, crtc_mask);
+
+	/*
+	 * Wait for flush to complete:
+	 */
+	trace_msm_atomic_wait_flush_start(crtc_mask);
+	kms->funcs->wait_flush(kms, crtc_mask);
+	trace_msm_atomic_wait_flush_finish(crtc_mask);
+
+	vblank_put(kms, crtc_mask);
+
+	kms->funcs->complete_commit(kms, crtc_mask);
+	unlock_crtcs(kms, crtc_mask);
+	kms->funcs->disable_commit(kms);
+
+out:
+	trace_msm_atomic_async_commit_finish(crtc_mask);
+}
+
+static void msm_atomic_pending_work(struct kthread_work *work)
+{
+	struct msm_pending_timer *timer = container_of(work,
+			struct msm_pending_timer, work.work);
+
+	msm_atomic_async_commit(timer->kms, timer->crtc_idx);
+}
+
+int msm_atomic_init_pending_timer(struct msm_pending_timer *timer,
+		struct msm_kms *kms, int crtc_idx)
+{
+	timer->kms = kms;
+	timer->crtc_idx = crtc_idx;
+
+	timer->worker = kthread_create_worker(0, "atomic-worker-%d", crtc_idx);
+	if (IS_ERR(timer->worker)) {
+		int ret = PTR_ERR(timer->worker);
+		timer->worker = NULL;
+		return ret;
+	}
+	sched_set_fifo(timer->worker->task);
+
+	msm_hrtimer_work_init(&timer->work, timer->worker,
+			      msm_atomic_pending_work,
+			      CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+
+	return 0;
+}
+
+void msm_atomic_destroy_pending_timer(struct msm_pending_timer *timer)
+{
+	if (timer->worker)
+		kthread_destroy_worker(timer->worker);
+}
+
+static bool can_do_async(struct drm_atomic_state *state,
+		struct drm_crtc **async_crtc)
+{
+	struct drm_connector_state *connector_state;
+	struct drm_connector *connector;
+	struct drm_crtc_state *crtc_state;
+	struct drm_crtc *crtc;
+	int i, num_crtcs = 0;
+
+	if (!(state->legacy_cursor_update || state->async_update))
+		return false;
+
+	/* any connector change, means slow path: */
+	for_each_new_connector_in_state(state, connector, connector_state, i)
+		return false;
+
+	for_each_new_crtc_in_state(state, crtc, crtc_state, i) {
+		if (drm_atomic_crtc_needs_modeset(crtc_state))
+			return false;
+		if (!crtc_state->active)
+			return false;
+		if (++num_crtcs > 1)
+			return false;
+		*async_crtc = crtc;
+	}
+
+	return true;
+}
+
+/* Get bitmask of crtcs that will need to be flushed.  The bitmask
+ * can be used with for_each_crtc_mask() iterator, to iterate
+ * effected crtcs without needing to preserve the atomic state.
+ */
+static unsigned get_crtc_mask(struct drm_atomic_state *state)
+{
+	struct drm_crtc_state *crtc_state;
+	struct drm_crtc *crtc;
+	unsigned i, mask = 0;
+
+	for_each_new_crtc_in_state(state, crtc, crtc_state, i)
+		mask |= drm_crtc_mask(crtc);
+
+	return mask;
+}
+
+int msm_atomic_check(struct drm_device *dev, struct drm_atomic_state *state)
+{
+	struct drm_crtc_state *old_crtc_state, *new_crtc_state;
+	struct drm_crtc *crtc;
+	int i;
+
+	for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state,
+				      new_crtc_state, i) {
+		if ((old_crtc_state->ctm && !new_crtc_state->ctm) ||
+		    (!old_crtc_state->ctm && new_crtc_state->ctm)) {
+			new_crtc_state->mode_changed = true;
+			state->allow_modeset = true;
+		}
+	}
+
+	return drm_atomic_helper_check(dev, state);
+}
+
+void msm_atomic_commit_tail(struct drm_atomic_state *state)
+{
+	struct drm_device *dev = state->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+	struct drm_crtc *async_crtc = NULL;
+	unsigned crtc_mask = get_crtc_mask(state);
+	bool async = can_do_async(state, &async_crtc);
+
+	trace_msm_atomic_commit_tail_start(async, crtc_mask);
+
+	drm_dp_mst_atomic_wait_for_dependencies(state);
+
+	kms->funcs->enable_commit(kms);
+
+	/*
+	 * Ensure any previous (potentially async) commit has
+	 * completed:
+	 */
+	lock_crtcs(kms, crtc_mask);
+	trace_msm_atomic_wait_flush_start(crtc_mask);
+	kms->funcs->wait_flush(kms, crtc_mask);
+	trace_msm_atomic_wait_flush_finish(crtc_mask);
+
+	/*
+	 * Now that there is no in-progress flush, prepare the
+	 * current update:
+	 */
+	if (kms->funcs->prepare_commit)
+		kms->funcs->prepare_commit(kms, state);
+
+	/*
+	 * Push atomic updates down to hardware:
+	 */
+	drm_atomic_helper_commit_modeset_disables(dev, state);
+	drm_atomic_helper_commit_planes(dev, state, 0);
+	drm_atomic_helper_commit_modeset_enables(dev, state);
+
+	if (async) {
+		struct msm_pending_timer *timer =
+			&kms->pending_timers[drm_crtc_index(async_crtc)];
+
+		/* async updates are limited to single-crtc updates: */
+		WARN_ON(crtc_mask != drm_crtc_mask(async_crtc));
+
+		/*
+		 * Start timer if we don't already have an update pending
+		 * on this crtc:
+		 */
+		if (!(kms->pending_crtc_mask & crtc_mask)) {
+			ktime_t vsync_time, wakeup_time;
+
+			kms->pending_crtc_mask |= crtc_mask;
+
+			if (drm_crtc_next_vblank_start(async_crtc, &vsync_time))
+				goto fallback;
+
+			wakeup_time = ktime_sub(vsync_time, ms_to_ktime(1));
+
+			msm_hrtimer_queue_work(&timer->work, wakeup_time,
+					HRTIMER_MODE_ABS);
+		}
+
+		kms->funcs->disable_commit(kms);
+		unlock_crtcs(kms, crtc_mask);
+		/*
+		 * At this point, from drm core's perspective, we
+		 * are done with the atomic update, so we can just
+		 * go ahead and signal that it is done:
+		 */
+		drm_atomic_helper_commit_hw_done(state);
+		drm_atomic_helper_cleanup_planes(dev, state);
+
+		trace_msm_atomic_commit_tail_finish(async, crtc_mask);
+
+		return;
+	}
+
+fallback:
+	/*
+	 * If there is any async flush pending on updated crtcs, fold
+	 * them into the current flush.
+	 */
+	kms->pending_crtc_mask &= ~crtc_mask;
+
+	vblank_get(kms, crtc_mask);
+
+	/*
+	 * Flush hardware updates:
+	 */
+	trace_msm_atomic_flush_commit(crtc_mask);
+	kms->funcs->flush_commit(kms, crtc_mask);
+	unlock_crtcs(kms, crtc_mask);
+	/*
+	 * Wait for flush to complete:
+	 */
+	trace_msm_atomic_wait_flush_start(crtc_mask);
+	kms->funcs->wait_flush(kms, crtc_mask);
+	trace_msm_atomic_wait_flush_finish(crtc_mask);
+
+	vblank_put(kms, crtc_mask);
+
+	lock_crtcs(kms, crtc_mask);
+	kms->funcs->complete_commit(kms, crtc_mask);
+	unlock_crtcs(kms, crtc_mask);
+	kms->funcs->disable_commit(kms);
+
+	drm_atomic_helper_commit_hw_done(state);
+	drm_atomic_helper_cleanup_planes(dev, state);
+
+	trace_msm_atomic_commit_tail_finish(async, crtc_mask);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_atomic_trace.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_atomic_trace.h
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#if !defined(_MSM_GPU_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
+#define _MSM_GPU_TRACE_H_
+
+#include <linux/tracepoint.h>
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM drm_msm_atomic
+#define TRACE_INCLUDE_FILE msm_atomic_trace
+
+TRACE_EVENT(msm_atomic_commit_tail_start,
+	    TP_PROTO(bool async, unsigned crtc_mask),
+	    TP_ARGS(async, crtc_mask),
+	    TP_STRUCT__entry(
+		    __field(bool, async)
+		    __field(u32, crtc_mask)
+		    ),
+	    TP_fast_assign(
+		    __entry->async = async;
+		    __entry->crtc_mask = crtc_mask;
+		    ),
+	    TP_printk("async=%d crtc_mask=%x",
+		    __entry->async, __entry->crtc_mask)
+);
+
+TRACE_EVENT(msm_atomic_commit_tail_finish,
+	    TP_PROTO(bool async, unsigned crtc_mask),
+	    TP_ARGS(async, crtc_mask),
+	    TP_STRUCT__entry(
+		    __field(bool, async)
+		    __field(u32, crtc_mask)
+		    ),
+	    TP_fast_assign(
+		    __entry->async = async;
+		    __entry->crtc_mask = crtc_mask;
+		    ),
+	    TP_printk("async=%d crtc_mask=%x",
+		    __entry->async, __entry->crtc_mask)
+);
+
+TRACE_EVENT(msm_atomic_async_commit_start,
+	    TP_PROTO(unsigned crtc_mask),
+	    TP_ARGS(crtc_mask),
+	    TP_STRUCT__entry(
+		    __field(u32, crtc_mask)
+		    ),
+	    TP_fast_assign(
+		    __entry->crtc_mask = crtc_mask;
+		    ),
+	    TP_printk("crtc_mask=%x",
+		    __entry->crtc_mask)
+);
+
+TRACE_EVENT(msm_atomic_async_commit_finish,
+	    TP_PROTO(unsigned crtc_mask),
+	    TP_ARGS(crtc_mask),
+	    TP_STRUCT__entry(
+		    __field(u32, crtc_mask)
+		    ),
+	    TP_fast_assign(
+		    __entry->crtc_mask = crtc_mask;
+		    ),
+	    TP_printk("crtc_mask=%x",
+		    __entry->crtc_mask)
+);
+
+TRACE_EVENT(msm_atomic_wait_flush_start,
+	    TP_PROTO(unsigned crtc_mask),
+	    TP_ARGS(crtc_mask),
+	    TP_STRUCT__entry(
+		    __field(u32, crtc_mask)
+		    ),
+	    TP_fast_assign(
+		    __entry->crtc_mask = crtc_mask;
+		    ),
+	    TP_printk("crtc_mask=%x",
+		    __entry->crtc_mask)
+);
+
+TRACE_EVENT(msm_atomic_wait_flush_finish,
+	    TP_PROTO(unsigned crtc_mask),
+	    TP_ARGS(crtc_mask),
+	    TP_STRUCT__entry(
+		    __field(u32, crtc_mask)
+		    ),
+	    TP_fast_assign(
+		    __entry->crtc_mask = crtc_mask;
+		    ),
+	    TP_printk("crtc_mask=%x",
+		    __entry->crtc_mask)
+);
+
+TRACE_EVENT(msm_atomic_flush_commit,
+	    TP_PROTO(unsigned crtc_mask),
+	    TP_ARGS(crtc_mask),
+	    TP_STRUCT__entry(
+		    __field(u32, crtc_mask)
+		    ),
+	    TP_fast_assign(
+		    __entry->crtc_mask = crtc_mask;
+		    ),
+	    TP_printk("crtc_mask=%x",
+		    __entry->crtc_mask)
+);
+
+#endif
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH ../../drivers/gpu/drm/msm
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_atomic_tracepoints.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_atomic_tracepoints.c
@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: GPL-2.0
+#define CREATE_TRACE_POINTS
+#include "msm_atomic_trace.h"
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_debugfs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_debugfs.c
@@ -0,0 +1,368 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2016 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifdef CONFIG_DEBUG_FS
+
+#include <linux/debugfs.h>
+#include <linux/fault-inject.h>
+
+#include <drm/drm_debugfs.h>
+#include <drm/drm_fb_helper.h>
+#include <drm/drm_file.h>
+#include <drm/drm_framebuffer.h>
+
+#include "msm_drv.h"
+#include "msm_gpu.h"
+#include "msm_kms.h"
+#include "msm_debugfs.h"
+#include "disp/msm_disp_snapshot.h"
+
+/*
+ * GPU Snapshot:
+ */
+
+struct msm_gpu_show_priv {
+	struct msm_gpu_state *state;
+	struct drm_device *dev;
+};
+
+static int msm_gpu_show(struct seq_file *m, void *arg)
+{
+	struct drm_printer p = drm_seq_file_printer(m);
+	struct msm_gpu_show_priv *show_priv = m->private;
+	struct msm_drm_private *priv = show_priv->dev->dev_private;
+	struct msm_gpu *gpu = priv->gpu;
+	int ret;
+
+	ret = mutex_lock_interruptible(&gpu->lock);
+	if (ret)
+		return ret;
+
+	drm_printf(&p, "%s Status:\n", gpu->name);
+	gpu->funcs->show(gpu, show_priv->state, &p);
+
+	mutex_unlock(&gpu->lock);
+
+	return 0;
+}
+
+static int msm_gpu_release(struct inode *inode, struct file *file)
+{
+	struct seq_file *m = file->private_data;
+	struct msm_gpu_show_priv *show_priv = m->private;
+	struct msm_drm_private *priv = show_priv->dev->dev_private;
+	struct msm_gpu *gpu = priv->gpu;
+
+	mutex_lock(&gpu->lock);
+	gpu->funcs->gpu_state_put(show_priv->state);
+	mutex_unlock(&gpu->lock);
+
+	kfree(show_priv);
+
+	return single_release(inode, file);
+}
+
+static int msm_gpu_open(struct inode *inode, struct file *file)
+{
+	struct drm_device *dev = inode->i_private;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_gpu *gpu = priv->gpu;
+	struct msm_gpu_show_priv *show_priv;
+	int ret;
+
+	if (!gpu || !gpu->funcs->gpu_state_get)
+		return -ENODEV;
+
+	show_priv = kmalloc(sizeof(*show_priv), GFP_KERNEL);
+	if (!show_priv)
+		return -ENOMEM;
+
+	ret = mutex_lock_interruptible(&gpu->lock);
+	if (ret)
+		goto free_priv;
+
+	pm_runtime_get_sync(&gpu->pdev->dev);
+	msm_gpu_hw_init(gpu);
+	show_priv->state = gpu->funcs->gpu_state_get(gpu);
+	pm_runtime_put_sync(&gpu->pdev->dev);
+
+	mutex_unlock(&gpu->lock);
+
+	if (IS_ERR(show_priv->state)) {
+		ret = PTR_ERR(show_priv->state);
+		goto free_priv;
+	}
+
+	show_priv->dev = dev;
+
+	ret = single_open(file, msm_gpu_show, show_priv);
+	if (ret)
+		goto free_priv;
+
+	return 0;
+
+free_priv:
+	kfree(show_priv);
+	return ret;
+}
+
+static const struct file_operations msm_gpu_fops = {
+	.owner = THIS_MODULE,
+	.open = msm_gpu_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = msm_gpu_release,
+};
+
+/*
+ * Display Snapshot:
+ */
+
+static int msm_kms_show(struct seq_file *m, void *arg)
+{
+	struct drm_printer p = drm_seq_file_printer(m);
+	struct msm_disp_state *state = m->private;
+
+	msm_disp_state_print(state, &p);
+
+	return 0;
+}
+
+static int msm_kms_release(struct inode *inode, struct file *file)
+{
+	struct seq_file *m = file->private_data;
+	struct msm_disp_state *state = m->private;
+
+	msm_disp_state_free(state);
+
+	return single_release(inode, file);
+}
+
+static int msm_kms_open(struct inode *inode, struct file *file)
+{
+	struct drm_device *dev = inode->i_private;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_disp_state *state;
+	int ret;
+
+	if (!priv->kms)
+		return -ENODEV;
+
+	ret = mutex_lock_interruptible(&priv->kms->dump_mutex);
+	if (ret)
+		return ret;
+
+	state = msm_disp_snapshot_state_sync(priv->kms);
+
+	mutex_unlock(&priv->kms->dump_mutex);
+
+	if (IS_ERR(state)) {
+		return PTR_ERR(state);
+	}
+
+	ret = single_open(file, msm_kms_show, state);
+	if (ret) {
+		msm_disp_state_free(state);
+		return ret;
+	}
+
+	return 0;
+}
+
+static const struct file_operations msm_kms_fops = {
+	.owner = THIS_MODULE,
+	.open = msm_kms_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = msm_kms_release,
+};
+
+/*
+ * Other debugfs:
+ */
+
+static unsigned long last_shrink_freed;
+
+static int
+shrink_get(void *data, u64 *val)
+{
+	*val = last_shrink_freed;
+
+	return 0;
+}
+
+static int
+shrink_set(void *data, u64 val)
+{
+	struct drm_device *dev = data;
+
+	last_shrink_freed = msm_gem_shrinker_shrink(dev, val);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(shrink_fops,
+			 shrink_get, shrink_set,
+			 "0x%08llx\n");
+
+
+static int msm_gem_show(struct seq_file *m, void *arg)
+{
+	struct drm_info_node *node = m->private;
+	struct drm_device *dev = node->minor->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	int ret;
+
+	ret = mutex_lock_interruptible(&priv->obj_lock);
+	if (ret)
+		return ret;
+
+	msm_gem_describe_objects(&priv->objects, m);
+
+	mutex_unlock(&priv->obj_lock);
+
+	return 0;
+}
+
+static int msm_mm_show(struct seq_file *m, void *arg)
+{
+	struct drm_info_node *node = m->private;
+	struct drm_device *dev = node->minor->dev;
+	struct drm_printer p = drm_seq_file_printer(m);
+
+	drm_mm_print(&dev->vma_offset_manager->vm_addr_space_mm, &p);
+
+	return 0;
+}
+
+static int msm_fb_show(struct seq_file *m, void *arg)
+{
+	struct drm_info_node *node = m->private;
+	struct drm_device *dev = node->minor->dev;
+	struct drm_framebuffer *fb, *fbdev_fb = NULL;
+
+	if (dev->fb_helper && dev->fb_helper->fb) {
+		seq_printf(m, "fbcon ");
+		fbdev_fb = dev->fb_helper->fb;
+		msm_framebuffer_describe(fbdev_fb, m);
+	}
+
+	mutex_lock(&dev->mode_config.fb_lock);
+	list_for_each_entry(fb, &dev->mode_config.fb_list, head) {
+		if (fb == fbdev_fb)
+			continue;
+
+		seq_printf(m, "user ");
+		msm_framebuffer_describe(fb, m);
+	}
+	mutex_unlock(&dev->mode_config.fb_lock);
+
+	return 0;
+}
+
+static struct drm_info_list msm_debugfs_list[] = {
+		{"gem", msm_gem_show},
+		{ "mm", msm_mm_show },
+};
+
+static struct drm_info_list msm_kms_debugfs_list[] = {
+		{ "fb", msm_fb_show },
+};
+
+static int late_init_minor(struct drm_minor *minor)
+{
+	int ret;
+
+	if (!minor)
+		return 0;
+
+	ret = msm_rd_debugfs_init(minor);
+	if (ret) {
+		DRM_DEV_ERROR(minor->dev->dev, "could not install rd debugfs\n");
+		return ret;
+	}
+
+	ret = msm_perf_debugfs_init(minor);
+	if (ret) {
+		DRM_DEV_ERROR(minor->dev->dev, "could not install perf debugfs\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+int msm_debugfs_late_init(struct drm_device *dev)
+{
+	int ret;
+	ret = late_init_minor(dev->primary);
+	if (ret)
+		return ret;
+	ret = late_init_minor(dev->render);
+	return ret;
+}
+
+static void msm_debugfs_gpu_init(struct drm_minor *minor)
+{
+	struct drm_device *dev = minor->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct dentry *gpu_devfreq;
+
+	debugfs_create_file("gpu", S_IRUSR, minor->debugfs_root,
+		dev, &msm_gpu_fops);
+
+	debugfs_create_u32("hangcheck_period_ms", 0600, minor->debugfs_root,
+		&priv->hangcheck_period);
+
+	debugfs_create_bool("disable_err_irq", 0600, minor->debugfs_root,
+		&priv->disable_err_irq);
+
+	gpu_devfreq = debugfs_create_dir("devfreq", minor->debugfs_root);
+
+	debugfs_create_bool("idle_clamp",0600, gpu_devfreq,
+			    &priv->gpu_clamp_to_idle);
+
+	debugfs_create_u32("upthreshold",0600, gpu_devfreq,
+			   &priv->gpu_devfreq_config.upthreshold);
+
+	debugfs_create_u32("downdifferential",0600, gpu_devfreq,
+			   &priv->gpu_devfreq_config.downdifferential);
+}
+
+void msm_debugfs_init(struct drm_minor *minor)
+{
+	struct drm_device *dev = minor->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+
+	drm_debugfs_create_files(msm_debugfs_list,
+				 ARRAY_SIZE(msm_debugfs_list),
+				 minor->debugfs_root, minor);
+
+	if (priv->gpu_pdev)
+		msm_debugfs_gpu_init(minor);
+
+	if (priv->kms) {
+		drm_debugfs_create_files(msm_kms_debugfs_list,
+					 ARRAY_SIZE(msm_kms_debugfs_list),
+					 minor->debugfs_root, minor);
+		debugfs_create_file("kms", S_IRUSR, minor->debugfs_root,
+				    dev, &msm_kms_fops);
+	}
+
+	debugfs_create_file("shrink", S_IRWXU, minor->debugfs_root,
+		dev, &shrink_fops);
+
+	if (priv->kms && priv->kms->funcs->debugfs_init)
+		priv->kms->funcs->debugfs_init(priv->kms, minor);
+
+#ifdef CONFIG_FAULT_INJECTION
+	fault_create_debugfs_attr("fail_gem_alloc", minor->debugfs_root,
+				  &fail_gem_alloc);
+	fault_create_debugfs_attr("fail_gem_iova", minor->debugfs_root,
+				  &fail_gem_iova);
+#endif
+}
+#endif
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_debugfs.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_debugfs.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2016 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MSM_DEBUGFS_H__
+#define __MSM_DEBUGFS_H__
+
+#ifdef CONFIG_DEBUG_FS
+void msm_debugfs_init(struct drm_minor *minor);
+#endif
+
+#endif /* __MSM_DEBUGFS_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_drv.c
@@ -0,0 +1,1118 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2018, 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/fault-inject.h>
+#include <linux/of_address.h>
+#include <linux/uaccess.h>
+
+#include <drm/drm_drv.h>
+#include <drm/drm_file.h>
+#include <drm/drm_ioctl.h>
+#include <drm/drm_of.h>
+
+#include "msm_drv.h"
+#include "msm_debugfs.h"
+#include "msm_gem.h"
+#include "msm_gpu.h"
+#include "msm_kms.h"
+
+/*
+ * MSM driver version:
+ * - 1.0.0 - initial interface
+ * - 1.1.0 - adds madvise, and support for submits with > 4 cmd buffers
+ * - 1.2.0 - adds explicit fence support for submit ioctl
+ * - 1.3.0 - adds GMEM_BASE + NR_RINGS params, SUBMITQUEUE_NEW +
+ *           SUBMITQUEUE_CLOSE ioctls, and MSM_INFO_IOVA flag for
+ *           MSM_GEM_INFO ioctl.
+ * - 1.4.0 - softpin, MSM_RELOC_BO_DUMP, and GEM_INFO support to set/get
+ *           GEM object's debug name
+ * - 1.5.0 - Add SUBMITQUERY_QUERY ioctl
+ * - 1.6.0 - Syncobj support
+ * - 1.7.0 - Add MSM_PARAM_SUSPENDS to access suspend count
+ * - 1.8.0 - Add MSM_BO_CACHED_COHERENT for supported GPUs (a6xx)
+ * - 1.9.0 - Add MSM_SUBMIT_FENCE_SN_IN
+ * - 1.10.0 - Add MSM_SUBMIT_BO_NO_IMPLICIT
+ * - 1.11.0 - Add wait boost (MSM_WAIT_FENCE_BOOST, MSM_PREP_BOOST)
+ * - 1.12.0 - Add MSM_INFO_SET_METADATA and MSM_INFO_GET_METADATA
+ */
+#define MSM_VERSION_MAJOR	1
+#define MSM_VERSION_MINOR	12
+#define MSM_VERSION_PATCHLEVEL	0
+
+static void msm_deinit_vram(struct drm_device *ddev);
+
+static char *vram = "16m";
+MODULE_PARM_DESC(vram, "Configure VRAM size (for devices without IOMMU/GPUMMU)");
+module_param(vram, charp, 0);
+
+bool dumpstate;
+MODULE_PARM_DESC(dumpstate, "Dump KMS state on errors");
+module_param(dumpstate, bool, 0600);
+
+static bool modeset = true;
+MODULE_PARM_DESC(modeset, "Use kernel modesetting [KMS] (1=on (default), 0=disable)");
+module_param(modeset, bool, 0600);
+
+#ifdef CONFIG_FAULT_INJECTION
+DECLARE_FAULT_ATTR(fail_gem_alloc);
+DECLARE_FAULT_ATTR(fail_gem_iova);
+#endif
+
+static int msm_drm_uninit(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct msm_drm_private *priv = platform_get_drvdata(pdev);
+	struct drm_device *ddev = priv->dev;
+
+	/*
+	 * Shutdown the hw if we're far enough along where things might be on.
+	 * If we run this too early, we'll end up panicking in any variety of
+	 * places. Since we don't register the drm device until late in
+	 * msm_drm_init, drm_dev->registered is used as an indicator that the
+	 * shutdown will be successful.
+	 */
+	if (ddev->registered) {
+		drm_dev_unregister(ddev);
+		if (priv->kms)
+			drm_atomic_helper_shutdown(ddev);
+	}
+
+	/* We must cancel and cleanup any pending vblank enable/disable
+	 * work before msm_irq_uninstall() to avoid work re-enabling an
+	 * irq after uninstall has disabled it.
+	 */
+
+	flush_workqueue(priv->wq);
+
+	msm_gem_shrinker_cleanup(ddev);
+
+	msm_perf_debugfs_cleanup(priv);
+	msm_rd_debugfs_cleanup(priv);
+
+	if (priv->kms)
+		msm_drm_kms_uninit(dev);
+
+	msm_deinit_vram(ddev);
+
+	component_unbind_all(dev, ddev);
+
+	ddev->dev_private = NULL;
+	drm_dev_put(ddev);
+
+	destroy_workqueue(priv->wq);
+
+	return 0;
+}
+
+bool msm_use_mmu(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+
+	/*
+	 * a2xx comes with its own MMU
+	 * On other platforms IOMMU can be declared specified either for the
+	 * MDP/DPU device or for its parent, MDSS device.
+	 */
+	return priv->is_a2xx ||
+		device_iommu_mapped(dev->dev) ||
+		device_iommu_mapped(dev->dev->parent);
+}
+
+static int msm_init_vram(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct device_node *node;
+	unsigned long size = 0;
+	int ret = 0;
+
+	/* In the device-tree world, we could have a 'memory-region'
+	 * phandle, which gives us a link to our "vram".  Allocating
+	 * is all nicely abstracted behind the dma api, but we need
+	 * to know the entire size to allocate it all in one go. There
+	 * are two cases:
+	 *  1) device with no IOMMU, in which case we need exclusive
+	 *     access to a VRAM carveout big enough for all gpu
+	 *     buffers
+	 *  2) device with IOMMU, but where the bootloader puts up
+	 *     a splash screen.  In this case, the VRAM carveout
+	 *     need only be large enough for fbdev fb.  But we need
+	 *     exclusive access to the buffer to avoid the kernel
+	 *     using those pages for other purposes (which appears
+	 *     as corruption on screen before we have a chance to
+	 *     load and do initial modeset)
+	 */
+
+	node = of_parse_phandle(dev->dev->of_node, "memory-region", 0);
+	if (node) {
+		struct resource r;
+		ret = of_address_to_resource(node, 0, &r);
+		of_node_put(node);
+		if (ret)
+			return ret;
+		size = r.end - r.start + 1;
+		DRM_INFO("using VRAM carveout: %lx@%pa\n", size, &r.start);
+
+		/* if we have no IOMMU, then we need to use carveout allocator.
+		 * Grab the entire DMA chunk carved out in early startup in
+		 * mach-msm:
+		 */
+	} else if (!msm_use_mmu(dev)) {
+		DRM_INFO("using %s VRAM carveout\n", vram);
+		size = memparse(vram, NULL);
+	}
+
+	if (size) {
+		unsigned long attrs = 0;
+		void *p;
+
+		priv->vram.size = size;
+
+		drm_mm_init(&priv->vram.mm, 0, (size >> PAGE_SHIFT) - 1);
+		spin_lock_init(&priv->vram.lock);
+
+		attrs |= DMA_ATTR_NO_KERNEL_MAPPING;
+		attrs |= DMA_ATTR_WRITE_COMBINE;
+
+		/* note that for no-kernel-mapping, the vaddr returned
+		 * is bogus, but non-null if allocation succeeded:
+		 */
+		p = dma_alloc_attrs(dev->dev, size,
+				&priv->vram.paddr, GFP_KERNEL, attrs);
+		if (!p) {
+			DRM_DEV_ERROR(dev->dev, "failed to allocate VRAM\n");
+			priv->vram.paddr = 0;
+			return -ENOMEM;
+		}
+
+		DRM_DEV_INFO(dev->dev, "VRAM: %08x->%08x\n",
+				(uint32_t)priv->vram.paddr,
+				(uint32_t)(priv->vram.paddr + size));
+	}
+
+	return ret;
+}
+
+static void msm_deinit_vram(struct drm_device *ddev)
+{
+	struct msm_drm_private *priv = ddev->dev_private;
+	unsigned long attrs = DMA_ATTR_NO_KERNEL_MAPPING;
+
+	if (!priv->vram.paddr)
+		return;
+
+	drm_mm_takedown(&priv->vram.mm);
+	dma_free_attrs(ddev->dev, priv->vram.size, NULL, priv->vram.paddr,
+			attrs);
+}
+
+static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
+{
+	struct msm_drm_private *priv = dev_get_drvdata(dev);
+	struct drm_device *ddev;
+	int ret;
+
+	if (drm_firmware_drivers_only())
+		return -ENODEV;
+
+	ddev = drm_dev_alloc(drv, dev);
+	if (IS_ERR(ddev)) {
+		DRM_DEV_ERROR(dev, "failed to allocate drm_device\n");
+		return PTR_ERR(ddev);
+	}
+	ddev->dev_private = priv;
+	priv->dev = ddev;
+
+	priv->wq = alloc_ordered_workqueue("msm", 0);
+	if (!priv->wq) {
+		ret = -ENOMEM;
+		goto err_put_dev;
+	}
+
+	INIT_LIST_HEAD(&priv->objects);
+	mutex_init(&priv->obj_lock);
+
+	/*
+	 * Initialize the LRUs:
+	 */
+	mutex_init(&priv->lru.lock);
+	drm_gem_lru_init(&priv->lru.unbacked, &priv->lru.lock);
+	drm_gem_lru_init(&priv->lru.pinned,   &priv->lru.lock);
+	drm_gem_lru_init(&priv->lru.willneed, &priv->lru.lock);
+	drm_gem_lru_init(&priv->lru.dontneed, &priv->lru.lock);
+
+	/* Teach lockdep about lock ordering wrt. shrinker: */
+	fs_reclaim_acquire(GFP_KERNEL);
+	might_lock(&priv->lru.lock);
+	fs_reclaim_release(GFP_KERNEL);
+
+	if (priv->kms_init) {
+		ret = drmm_mode_config_init(ddev);
+		if (ret)
+			goto err_destroy_wq;
+	}
+
+	ret = msm_init_vram(ddev);
+	if (ret)
+		goto err_destroy_wq;
+
+	dma_set_max_seg_size(dev, UINT_MAX);
+
+	/* Bind all our sub-components: */
+	ret = component_bind_all(dev, ddev);
+	if (ret)
+		goto err_deinit_vram;
+
+	ret = msm_gem_shrinker_init(ddev);
+	if (ret)
+		goto err_msm_uninit;
+
+	if (priv->kms_init) {
+		ret = msm_drm_kms_init(dev, drv);
+		if (ret)
+			goto err_msm_uninit;
+	} else {
+		/* valid only for the dummy headless case, where of_node=NULL */
+		WARN_ON(dev->of_node);
+		ddev->driver_features &= ~DRIVER_MODESET;
+		ddev->driver_features &= ~DRIVER_ATOMIC;
+	}
+
+	ret = drm_dev_register(ddev, 0);
+	if (ret)
+		goto err_msm_uninit;
+
+	ret = msm_debugfs_late_init(ddev);
+	if (ret)
+		goto err_msm_uninit;
+
+	if (priv->kms_init) {
+		drm_kms_helper_poll_init(ddev);
+		msm_fbdev_setup(ddev);
+	}
+
+	return 0;
+
+err_msm_uninit:
+	msm_drm_uninit(dev);
+
+	return ret;
+
+err_deinit_vram:
+	msm_deinit_vram(ddev);
+err_destroy_wq:
+	destroy_workqueue(priv->wq);
+err_put_dev:
+	drm_dev_put(ddev);
+
+	return ret;
+}
+
+/*
+ * DRM operations:
+ */
+
+static void load_gpu(struct drm_device *dev)
+{
+	static DEFINE_MUTEX(init_lock);
+	struct msm_drm_private *priv = dev->dev_private;
+
+	mutex_lock(&init_lock);
+
+	if (!priv->gpu)
+		priv->gpu = adreno_load_gpu(dev);
+
+	mutex_unlock(&init_lock);
+}
+
+static int context_init(struct drm_device *dev, struct drm_file *file)
+{
+	static atomic_t ident = ATOMIC_INIT(0);
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_file_private *ctx;
+
+	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+	if (!ctx)
+		return -ENOMEM;
+
+	INIT_LIST_HEAD(&ctx->submitqueues);
+	rwlock_init(&ctx->queuelock);
+
+	kref_init(&ctx->ref);
+	msm_submitqueue_init(dev, ctx);
+
+	ctx->aspace = msm_gpu_create_private_address_space(priv->gpu, current);
+	file->driver_priv = ctx;
+
+	ctx->seqno = atomic_inc_return(&ident);
+
+	return 0;
+}
+
+static int msm_open(struct drm_device *dev, struct drm_file *file)
+{
+	/* For now, load gpu on open.. to avoid the requirement of having
+	 * firmware in the initrd.
+	 */
+	load_gpu(dev);
+
+	return context_init(dev, file);
+}
+
+static void context_close(struct msm_file_private *ctx)
+{
+	msm_submitqueue_close(ctx);
+	msm_file_private_put(ctx);
+}
+
+static void msm_postclose(struct drm_device *dev, struct drm_file *file)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_file_private *ctx = file->driver_priv;
+
+	/*
+	 * It is not possible to set sysprof param to non-zero if gpu
+	 * is not initialized:
+	 */
+	if (priv->gpu)
+		msm_file_private_set_sysprof(ctx, priv->gpu, 0);
+
+	context_close(ctx);
+}
+
+/*
+ * DRM ioctls:
+ */
+
+static int msm_ioctl_get_param(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct drm_msm_param *args = data;
+	struct msm_gpu *gpu;
+
+	/* for now, we just have 3d pipe.. eventually this would need to
+	 * be more clever to dispatch to appropriate gpu module:
+	 */
+	if ((args->pipe != MSM_PIPE_3D0) || (args->pad != 0))
+		return -EINVAL;
+
+	gpu = priv->gpu;
+
+	if (!gpu)
+		return -ENXIO;
+
+	return gpu->funcs->get_param(gpu, file->driver_priv,
+				     args->param, &args->value, &args->len);
+}
+
+static int msm_ioctl_set_param(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct drm_msm_param *args = data;
+	struct msm_gpu *gpu;
+
+	if ((args->pipe != MSM_PIPE_3D0) || (args->pad != 0))
+		return -EINVAL;
+
+	gpu = priv->gpu;
+
+	if (!gpu)
+		return -ENXIO;
+
+	return gpu->funcs->set_param(gpu, file->driver_priv,
+				     args->param, args->value, args->len);
+}
+
+static int msm_ioctl_gem_new(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct drm_msm_gem_new *args = data;
+	uint32_t flags = args->flags;
+
+	if (args->flags & ~MSM_BO_FLAGS) {
+		DRM_ERROR("invalid flags: %08x\n", args->flags);
+		return -EINVAL;
+	}
+
+	/*
+	 * Uncached CPU mappings are deprecated, as of:
+	 *
+	 * 9ef364432db4 ("drm/msm: deprecate MSM_BO_UNCACHED (map as writecombine instead)")
+	 *
+	 * So promote them to WC.
+	 */
+	if (flags & MSM_BO_UNCACHED) {
+		flags &= ~MSM_BO_CACHED;
+		flags |= MSM_BO_WC;
+	}
+
+	if (should_fail(&fail_gem_alloc, args->size))
+		return -ENOMEM;
+
+	return msm_gem_new_handle(dev, file, args->size,
+			args->flags, &args->handle, NULL);
+}
+
+static inline ktime_t to_ktime(struct drm_msm_timespec timeout)
+{
+	return ktime_set(timeout.tv_sec, timeout.tv_nsec);
+}
+
+static int msm_ioctl_gem_cpu_prep(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct drm_msm_gem_cpu_prep *args = data;
+	struct drm_gem_object *obj;
+	ktime_t timeout = to_ktime(args->timeout);
+	int ret;
+
+	if (args->op & ~MSM_PREP_FLAGS) {
+		DRM_ERROR("invalid op: %08x\n", args->op);
+		return -EINVAL;
+	}
+
+	obj = drm_gem_object_lookup(file, args->handle);
+	if (!obj)
+		return -ENOENT;
+
+	ret = msm_gem_cpu_prep(obj, args->op, &timeout);
+
+	drm_gem_object_put(obj);
+
+	return ret;
+}
+
+static int msm_ioctl_gem_cpu_fini(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct drm_msm_gem_cpu_fini *args = data;
+	struct drm_gem_object *obj;
+	int ret;
+
+	obj = drm_gem_object_lookup(file, args->handle);
+	if (!obj)
+		return -ENOENT;
+
+	ret = msm_gem_cpu_fini(obj);
+
+	drm_gem_object_put(obj);
+
+	return ret;
+}
+
+static int msm_ioctl_gem_info_iova(struct drm_device *dev,
+		struct drm_file *file, struct drm_gem_object *obj,
+		uint64_t *iova)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_file_private *ctx = file->driver_priv;
+
+	if (!priv->gpu)
+		return -EINVAL;
+
+	if (should_fail(&fail_gem_iova, obj->size))
+		return -ENOMEM;
+
+	/*
+	 * Don't pin the memory here - just get an address so that userspace can
+	 * be productive
+	 */
+	return msm_gem_get_iova(obj, ctx->aspace, iova);
+}
+
+static int msm_ioctl_gem_info_set_iova(struct drm_device *dev,
+		struct drm_file *file, struct drm_gem_object *obj,
+		uint64_t iova)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_file_private *ctx = file->driver_priv;
+
+	if (!priv->gpu)
+		return -EINVAL;
+
+	/* Only supported if per-process address space is supported: */
+	if (priv->gpu->aspace == ctx->aspace)
+		return -EOPNOTSUPP;
+
+	if (should_fail(&fail_gem_iova, obj->size))
+		return -ENOMEM;
+
+	return msm_gem_set_iova(obj, ctx->aspace, iova);
+}
+
+static int msm_ioctl_gem_info_set_metadata(struct drm_gem_object *obj,
+					   __user void *metadata,
+					   u32 metadata_size)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	void *buf;
+	int ret;
+
+	/* Impose a moderate upper bound on metadata size: */
+	if (metadata_size > 128) {
+		return -EOVERFLOW;
+	}
+
+	/* Use a temporary buf to keep copy_from_user() outside of gem obj lock: */
+	buf = memdup_user(metadata, metadata_size);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
+
+	ret = msm_gem_lock_interruptible(obj);
+	if (ret)
+		goto out;
+
+	msm_obj->metadata =
+		krealloc(msm_obj->metadata, metadata_size, GFP_KERNEL);
+	msm_obj->metadata_size = metadata_size;
+	memcpy(msm_obj->metadata, buf, metadata_size);
+
+	msm_gem_unlock(obj);
+
+out:
+	kfree(buf);
+
+	return ret;
+}
+
+static int msm_ioctl_gem_info_get_metadata(struct drm_gem_object *obj,
+					   __user void *metadata,
+					   u32 *metadata_size)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	void *buf;
+	int ret, len;
+
+	if (!metadata) {
+		/*
+		 * Querying the size is inherently racey, but
+		 * EXT_external_objects expects the app to confirm
+		 * via device and driver UUIDs that the exporter and
+		 * importer versions match.  All we can do from the
+		 * kernel side is check the length under obj lock
+		 * when userspace tries to retrieve the metadata
+		 */
+		*metadata_size = msm_obj->metadata_size;
+		return 0;
+	}
+
+	ret = msm_gem_lock_interruptible(obj);
+	if (ret)
+		return ret;
+
+	/* Avoid copy_to_user() under gem obj lock: */
+	len = msm_obj->metadata_size;
+	buf = kmemdup(msm_obj->metadata, len, GFP_KERNEL);
+
+	msm_gem_unlock(obj);
+
+	if (*metadata_size < len) {
+		ret = -ETOOSMALL;
+	} else if (copy_to_user(metadata, buf, len)) {
+		ret = -EFAULT;
+	} else {
+		*metadata_size = len;
+	}
+
+	kfree(buf);
+
+	return 0;
+}
+
+static int msm_ioctl_gem_info(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct drm_msm_gem_info *args = data;
+	struct drm_gem_object *obj;
+	struct msm_gem_object *msm_obj;
+	int i, ret = 0;
+
+	if (args->pad)
+		return -EINVAL;
+
+	switch (args->info) {
+	case MSM_INFO_GET_OFFSET:
+	case MSM_INFO_GET_IOVA:
+	case MSM_INFO_SET_IOVA:
+	case MSM_INFO_GET_FLAGS:
+		/* value returned as immediate, not pointer, so len==0: */
+		if (args->len)
+			return -EINVAL;
+		break;
+	case MSM_INFO_SET_NAME:
+	case MSM_INFO_GET_NAME:
+	case MSM_INFO_SET_METADATA:
+	case MSM_INFO_GET_METADATA:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	obj = drm_gem_object_lookup(file, args->handle);
+	if (!obj)
+		return -ENOENT;
+
+	msm_obj = to_msm_bo(obj);
+
+	switch (args->info) {
+	case MSM_INFO_GET_OFFSET:
+		args->value = msm_gem_mmap_offset(obj);
+		break;
+	case MSM_INFO_GET_IOVA:
+		ret = msm_ioctl_gem_info_iova(dev, file, obj, &args->value);
+		break;
+	case MSM_INFO_SET_IOVA:
+		ret = msm_ioctl_gem_info_set_iova(dev, file, obj, args->value);
+		break;
+	case MSM_INFO_GET_FLAGS:
+		if (obj->import_attach) {
+			ret = -EINVAL;
+			break;
+		}
+		/* Hide internal kernel-only flags: */
+		args->value = to_msm_bo(obj)->flags & MSM_BO_FLAGS;
+		ret = 0;
+		break;
+	case MSM_INFO_SET_NAME:
+		/* length check should leave room for terminating null: */
+		if (args->len >= sizeof(msm_obj->name)) {
+			ret = -EINVAL;
+			break;
+		}
+		if (copy_from_user(msm_obj->name, u64_to_user_ptr(args->value),
+				   args->len)) {
+			msm_obj->name[0] = '\0';
+			ret = -EFAULT;
+			break;
+		}
+		msm_obj->name[args->len] = '\0';
+		for (i = 0; i < args->len; i++) {
+			if (!isprint(msm_obj->name[i])) {
+				msm_obj->name[i] = '\0';
+				break;
+			}
+		}
+		break;
+	case MSM_INFO_GET_NAME:
+		if (args->value && (args->len < strlen(msm_obj->name))) {
+			ret = -ETOOSMALL;
+			break;
+		}
+		args->len = strlen(msm_obj->name);
+		if (args->value) {
+			if (copy_to_user(u64_to_user_ptr(args->value),
+					 msm_obj->name, args->len))
+				ret = -EFAULT;
+		}
+		break;
+	case MSM_INFO_SET_METADATA:
+		ret = msm_ioctl_gem_info_set_metadata(
+			obj, u64_to_user_ptr(args->value), args->len);
+		break;
+	case MSM_INFO_GET_METADATA:
+		ret = msm_ioctl_gem_info_get_metadata(
+			obj, u64_to_user_ptr(args->value), &args->len);
+		break;
+	}
+
+	drm_gem_object_put(obj);
+
+	return ret;
+}
+
+static int wait_fence(struct msm_gpu_submitqueue *queue, uint32_t fence_id,
+		      ktime_t timeout, uint32_t flags)
+{
+	struct dma_fence *fence;
+	int ret;
+
+	if (fence_after(fence_id, queue->last_fence)) {
+		DRM_ERROR_RATELIMITED("waiting on invalid fence: %u (of %u)\n",
+				      fence_id, queue->last_fence);
+		return -EINVAL;
+	}
+
+	/*
+	 * Map submitqueue scoped "seqno" (which is actually an idr key)
+	 * back to underlying dma-fence
+	 *
+	 * The fence is removed from the fence_idr when the submit is
+	 * retired, so if the fence is not found it means there is nothing
+	 * to wait for
+	 */
+	spin_lock(&queue->idr_lock);
+	fence = idr_find(&queue->fence_idr, fence_id);
+	if (fence)
+		fence = dma_fence_get_rcu(fence);
+	spin_unlock(&queue->idr_lock);
+
+	if (!fence)
+		return 0;
+
+	if (flags & MSM_WAIT_FENCE_BOOST)
+		dma_fence_set_deadline(fence, ktime_get());
+
+	ret = dma_fence_wait_timeout(fence, true, timeout_to_jiffies(&timeout));
+	if (ret == 0) {
+		ret = -ETIMEDOUT;
+	} else if (ret != -ERESTARTSYS) {
+		ret = 0;
+	}
+
+	dma_fence_put(fence);
+
+	return ret;
+}
+
+static int msm_ioctl_wait_fence(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct drm_msm_wait_fence *args = data;
+	struct msm_gpu_submitqueue *queue;
+	int ret;
+
+	if (args->flags & ~MSM_WAIT_FENCE_FLAGS) {
+		DRM_ERROR("invalid flags: %08x\n", args->flags);
+		return -EINVAL;
+	}
+
+	if (!priv->gpu)
+		return 0;
+
+	queue = msm_submitqueue_get(file->driver_priv, args->queueid);
+	if (!queue)
+		return -ENOENT;
+
+	ret = wait_fence(queue, args->fence, to_ktime(args->timeout), args->flags);
+
+	msm_submitqueue_put(queue);
+
+	return ret;
+}
+
+static int msm_ioctl_gem_madvise(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct drm_msm_gem_madvise *args = data;
+	struct drm_gem_object *obj;
+	int ret;
+
+	switch (args->madv) {
+	case MSM_MADV_DONTNEED:
+	case MSM_MADV_WILLNEED:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	obj = drm_gem_object_lookup(file, args->handle);
+	if (!obj) {
+		return -ENOENT;
+	}
+
+	ret = msm_gem_madvise(obj, args->madv);
+	if (ret >= 0) {
+		args->retained = ret;
+		ret = 0;
+	}
+
+	drm_gem_object_put(obj);
+
+	return ret;
+}
+
+
+static int msm_ioctl_submitqueue_new(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct drm_msm_submitqueue *args = data;
+
+	if (args->flags & ~MSM_SUBMITQUEUE_FLAGS)
+		return -EINVAL;
+
+	return msm_submitqueue_create(dev, file->driver_priv, args->prio,
+		args->flags, &args->id);
+}
+
+static int msm_ioctl_submitqueue_query(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	return msm_submitqueue_query(dev, file->driver_priv, data);
+}
+
+static int msm_ioctl_submitqueue_close(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	u32 id = *(u32 *) data;
+
+	return msm_submitqueue_remove(file->driver_priv, id);
+}
+
+static const struct drm_ioctl_desc msm_ioctls[] = {
+	DRM_IOCTL_DEF_DRV(MSM_GET_PARAM,    msm_ioctl_get_param,    DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_SET_PARAM,    msm_ioctl_set_param,    DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_GEM_NEW,      msm_ioctl_gem_new,      DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_GEM_INFO,     msm_ioctl_gem_info,     DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_GEM_CPU_PREP, msm_ioctl_gem_cpu_prep, DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_GEM_CPU_FINI, msm_ioctl_gem_cpu_fini, DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_GEM_SUBMIT,   msm_ioctl_gem_submit,   DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_WAIT_FENCE,   msm_ioctl_wait_fence,   DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_GEM_MADVISE,  msm_ioctl_gem_madvise,  DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_SUBMITQUEUE_NEW,   msm_ioctl_submitqueue_new,   DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_SUBMITQUEUE_CLOSE, msm_ioctl_submitqueue_close, DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(MSM_SUBMITQUEUE_QUERY, msm_ioctl_submitqueue_query, DRM_RENDER_ALLOW),
+};
+
+static void msm_show_fdinfo(struct drm_printer *p, struct drm_file *file)
+{
+	struct drm_device *dev = file->minor->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+
+	if (!priv->gpu)
+		return;
+
+	msm_gpu_show_fdinfo(priv->gpu, file->driver_priv, p);
+
+	drm_show_memory_stats(p, file);
+}
+
+static const struct file_operations fops = {
+	.owner = THIS_MODULE,
+	DRM_GEM_FOPS,
+	.show_fdinfo = drm_show_fdinfo,
+};
+
+static const struct drm_driver msm_driver = {
+	.driver_features    = DRIVER_GEM |
+				DRIVER_RENDER |
+				DRIVER_ATOMIC |
+				DRIVER_MODESET |
+				DRIVER_SYNCOBJ,
+	.open               = msm_open,
+	.postclose          = msm_postclose,
+	.dumb_create        = msm_gem_dumb_create,
+	.dumb_map_offset    = msm_gem_dumb_map_offset,
+	.gem_prime_import_sg_table = msm_gem_prime_import_sg_table,
+#ifdef CONFIG_DEBUG_FS
+	.debugfs_init       = msm_debugfs_init,
+#endif
+	.show_fdinfo        = msm_show_fdinfo,
+	.ioctls             = msm_ioctls,
+	.num_ioctls         = ARRAY_SIZE(msm_ioctls),
+	.fops               = &fops,
+	.name               = "msm",
+	.desc               = "MSM Snapdragon DRM",
+	.date               = "20130625",
+	.major              = MSM_VERSION_MAJOR,
+	.minor              = MSM_VERSION_MINOR,
+	.patchlevel         = MSM_VERSION_PATCHLEVEL,
+};
+
+/*
+ * Componentized driver support:
+ */
+
+/*
+ * Identify what components need to be added by parsing what remote-endpoints
+ * our MDP output ports are connected to. In the case of LVDS on MDP4, there
+ * is no external component that we need to add since LVDS is within MDP4
+ * itself.
+ */
+static int add_components_mdp(struct device *master_dev,
+			      struct component_match **matchptr)
+{
+	struct device_node *np = master_dev->of_node;
+	struct device_node *ep_node;
+
+	for_each_endpoint_of_node(np, ep_node) {
+		struct device_node *intf;
+		struct of_endpoint ep;
+		int ret;
+
+		ret = of_graph_parse_endpoint(ep_node, &ep);
+		if (ret) {
+			DRM_DEV_ERROR(master_dev, "unable to parse port endpoint\n");
+			of_node_put(ep_node);
+			return ret;
+		}
+
+		/*
+		 * The LCDC/LVDS port on MDP4 is a speacial case where the
+		 * remote-endpoint isn't a component that we need to add
+		 */
+		if (of_device_is_compatible(np, "qcom,mdp4") &&
+		    ep.port == 0)
+			continue;
+
+		/*
+		 * It's okay if some of the ports don't have a remote endpoint
+		 * specified. It just means that the port isn't connected to
+		 * any external interface.
+		 */
+		intf = of_graph_get_remote_port_parent(ep_node);
+		if (!intf)
+			continue;
+
+		if (of_device_is_available(intf))
+			drm_of_component_match_add(master_dev, matchptr,
+						   component_compare_of, intf);
+
+		of_node_put(intf);
+	}
+
+	return 0;
+}
+
+/*
+ * We don't know what's the best binding to link the gpu with the drm device.
+ * Fow now, we just hunt for all the possible gpus that we support, and add them
+ * as components.
+ */
+static const struct of_device_id msm_gpu_match[] = {
+	{ .compatible = "qcom,adreno" },
+	{ .compatible = "qcom,adreno-3xx" },
+	{ .compatible = "amd,imageon" },
+	{ .compatible = "qcom,kgsl-3d0" },
+	{ },
+};
+
+static int add_gpu_components(struct device *dev,
+			      struct component_match **matchptr)
+{
+	struct device_node *np;
+
+	np = of_find_matching_node(NULL, msm_gpu_match);
+	if (!np)
+		return 0;
+
+	if (of_device_is_available(np))
+		drm_of_component_match_add(dev, matchptr, component_compare_of, np);
+
+	of_node_put(np);
+
+	return 0;
+}
+
+static int msm_drm_bind(struct device *dev)
+{
+	return msm_drm_init(dev, &msm_driver);
+}
+
+static void msm_drm_unbind(struct device *dev)
+{
+	msm_drm_uninit(dev);
+}
+
+const struct component_master_ops msm_drm_ops = {
+	.bind = msm_drm_bind,
+	.unbind = msm_drm_unbind,
+};
+
+int msm_drv_probe(struct device *master_dev,
+	int (*kms_init)(struct drm_device *dev),
+	struct msm_kms *kms)
+{
+	struct msm_drm_private *priv;
+	struct component_match *match = NULL;
+	int ret;
+
+	priv = devm_kzalloc(master_dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->kms = kms;
+	priv->kms_init = kms_init;
+	dev_set_drvdata(master_dev, priv);
+
+	/* Add mdp components if we have KMS. */
+	if (kms_init) {
+		ret = add_components_mdp(master_dev, &match);
+		if (ret)
+			return ret;
+	}
+
+	ret = add_gpu_components(master_dev, &match);
+	if (ret)
+		return ret;
+
+	/* on all devices that I am aware of, iommu's which can map
+	 * any address the cpu can see are used:
+	 */
+	ret = dma_set_mask_and_coherent(master_dev, ~0);
+	if (ret)
+		return ret;
+
+	ret = component_master_add_with_match(master_dev, &msm_drm_ops, match);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ * Platform driver:
+ * Used only for headlesss GPU instances
+ */
+
+static int msm_pdev_probe(struct platform_device *pdev)
+{
+	return msm_drv_probe(&pdev->dev, NULL, NULL);
+}
+
+static void msm_pdev_remove(struct platform_device *pdev)
+{
+	component_master_del(&pdev->dev, &msm_drm_ops);
+}
+
+static struct platform_driver msm_platform_driver = {
+	.probe      = msm_pdev_probe,
+	.remove_new = msm_pdev_remove,
+	.driver     = {
+		.name   = "msm",
+	},
+};
+
+static int __init msm_drm_register(void)
+{
+	if (!modeset)
+		return -EINVAL;
+
+	DBG("init");
+	msm_mdp_register();
+	msm_dpu_register();
+	msm_dsi_register();
+	msm_hdmi_register();
+	msm_dp_register();
+	adreno_register();
+	msm_mdp4_register();
+	msm_mdss_register();
+	return platform_driver_register(&msm_platform_driver);
+}
+
+static void __exit msm_drm_unregister(void)
+{
+	DBG("fini");
+	platform_driver_unregister(&msm_platform_driver);
+	msm_mdss_unregister();
+	msm_mdp4_unregister();
+	msm_dp_unregister();
+	msm_hdmi_unregister();
+	adreno_unregister();
+	msm_dsi_unregister();
+	msm_mdp_unregister();
+	msm_dpu_unregister();
+}
+
+module_init(msm_drm_register);
+module_exit(msm_drm_unregister);
+
+MODULE_AUTHOR("Rob Clark <robdclark@gmail.com");
+MODULE_DESCRIPTION("MSM DRM Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_drv.h
@@ -0,0 +1,599 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MSM_DRV_H__
+#define __MSM_DRV_H__
+
+#include <linux/kernel.h>
+#include <linux/clk.h>
+#include <linux/cpufreq.h>
+#include <linux/devfreq.h>
+#include <linux/module.h>
+#include <linux/component.h>
+#include <linux/platform_device.h>
+#include <linux/pm.h>
+#include <linux/pm_runtime.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/iommu.h>
+#include <linux/types.h>
+#include <linux/of_graph.h>
+#include <linux/of_device.h>
+#include <linux/sizes.h>
+#include <linux/kthread.h>
+
+#include <drm/drm_atomic.h>
+#include <drm/drm_atomic_helper.h>
+#include <drm/drm_probe_helper.h>
+#include <drm/display/drm_dsc.h>
+#include <drm/display/drm_dp_mst_helper.h>
+#include <drm/msm_drm.h>
+#include <drm/drm_gem.h>
+
+#ifdef CONFIG_FAULT_INJECTION
+extern struct fault_attr fail_gem_alloc;
+extern struct fault_attr fail_gem_iova;
+#else
+#  define should_fail(attr, size) 0
+#endif
+
+struct msm_kms;
+struct msm_gpu;
+struct msm_mmu;
+struct msm_mdss;
+struct msm_rd_state;
+struct msm_perf_state;
+struct msm_gem_submit;
+struct msm_fence_context;
+struct msm_gem_address_space;
+struct msm_gem_vma;
+struct msm_disp_state;
+
+#define MAX_CRTCS      8
+#define MAX_BRIDGES    8
+
+#define FRAC_16_16(mult, div)    (((mult) << 16) / (div))
+
+enum msm_dp_controller {
+	MSM_DP_CONTROLLER_0,
+	MSM_DP_CONTROLLER_1,
+	MSM_DP_CONTROLLER_2,
+	MSM_DP_CONTROLLER_3,
+	MSM_DP_CONTROLLER_COUNT,
+};
+
+enum msm_dsi_controller {
+	MSM_DSI_CONTROLLER_0,
+	MSM_DSI_CONTROLLER_1,
+	MSM_DSI_CONTROLLER_COUNT,
+};
+
+#define MSM_GPU_MAX_RINGS 4
+#define MAX_H_TILES_PER_DISPLAY 2
+
+/**
+ * struct msm_display_topology - defines a display topology pipeline
+ * @num_lm:       number of layer mixers used
+ * @num_intf:     number of interfaces the panel is mounted on
+ * @num_dspp:     number of dspp blocks used
+ * @num_dsc:      number of Display Stream Compression (DSC) blocks used
+ * @needs_cdm:    indicates whether cdm block is needed for this display topology
+ */
+struct msm_display_topology {
+	u32 num_lm;
+	u32 num_intf;
+	u32 num_dspp;
+	u32 num_dsc;
+	bool needs_cdm;
+};
+
+/* Commit/Event thread specific structure */
+struct msm_drm_thread {
+	struct drm_device *dev;
+	struct kthread_worker *worker;
+};
+
+struct msm_drm_private {
+
+	struct drm_device *dev;
+
+	struct msm_kms *kms;
+	int (*kms_init)(struct drm_device *dev);
+
+	/* subordinate devices, if present: */
+	struct platform_device *gpu_pdev;
+
+	/* possibly this should be in the kms component, but it is
+	 * shared by both mdp4 and mdp5..
+	 */
+	struct hdmi *hdmi;
+
+	/* DSI is shared by mdp4 and mdp5 */
+	struct msm_dsi *dsi[MSM_DSI_CONTROLLER_COUNT];
+
+	struct msm_dp *dp[MSM_DP_CONTROLLER_COUNT];
+
+	/* when we have more than one 'msm_gpu' these need to be an array: */
+	struct msm_gpu *gpu;
+
+	/* gpu is only set on open(), but we need this info earlier */
+	bool is_a2xx;
+	bool has_cached_coherent;
+
+	struct msm_rd_state *rd;       /* debugfs to dump all submits */
+	struct msm_rd_state *hangrd;   /* debugfs to dump hanging submits */
+	struct msm_perf_state *perf;
+
+	/**
+	 * List of all GEM objects (mainly for debugfs, protected by obj_lock
+	 * (acquire before per GEM object lock)
+	 */
+	struct list_head objects;
+	struct mutex obj_lock;
+
+	/**
+	 * lru:
+	 *
+	 * The various LRU's that a GEM object is in at various stages of
+	 * it's lifetime.  Objects start out in the unbacked LRU.  When
+	 * pinned (for scannout or permanently mapped GPU buffers, like
+	 * ringbuffer, memptr, fw, etc) it moves to the pinned LRU.  When
+	 * unpinned, it moves into willneed or dontneed LRU depending on
+	 * madvise state.  When backing pages are evicted (willneed) or
+	 * purged (dontneed) it moves back into the unbacked LRU.
+	 *
+	 * The dontneed LRU is considered by the shrinker for objects
+	 * that are candidate for purging, and the willneed LRU is
+	 * considered for objects that could be evicted.
+	 */
+	struct {
+		/**
+		 * unbacked:
+		 *
+		 * The LRU for GEM objects without backing pages allocated.
+		 * This mostly exists so that objects are always is one
+		 * LRU.
+		 */
+		struct drm_gem_lru unbacked;
+
+		/**
+		 * pinned:
+		 *
+		 * The LRU for pinned GEM objects
+		 */
+		struct drm_gem_lru pinned;
+
+		/**
+		 * willneed:
+		 *
+		 * The LRU for unpinned GEM objects which are in madvise
+		 * WILLNEED state (ie. can be evicted)
+		 */
+		struct drm_gem_lru willneed;
+
+		/**
+		 * dontneed:
+		 *
+		 * The LRU for unpinned GEM objects which are in madvise
+		 * DONTNEED state (ie. can be purged)
+		 */
+		struct drm_gem_lru dontneed;
+
+		/**
+		 * lock:
+		 *
+		 * Protects manipulation of all of the LRUs.
+		 */
+		struct mutex lock;
+	} lru;
+
+	struct workqueue_struct *wq;
+
+	unsigned int num_crtcs;
+
+	struct msm_drm_thread event_thread[MAX_CRTCS];
+
+	/* VRAM carveout, used when no IOMMU: */
+	struct {
+		unsigned long size;
+		dma_addr_t paddr;
+		/* NOTE: mm managed at the page level, size is in # of pages
+		 * and position mm_node->start is in # of pages:
+		 */
+		struct drm_mm mm;
+		spinlock_t lock; /* Protects drm_mm node allocation/removal */
+	} vram;
+
+	struct notifier_block vmap_notifier;
+	struct shrinker *shrinker;
+
+	struct drm_atomic_state *pm_state;
+
+	/**
+	 * hangcheck_period: For hang detection, in ms
+	 *
+	 * Note that in practice, a submit/job will get at least two hangcheck
+	 * periods, due to checking for progress being implemented as simply
+	 * "have the CP position registers changed since last time?"
+	 */
+	unsigned int hangcheck_period;
+
+	/** gpu_devfreq_config: Devfreq tuning config for the GPU. */
+	struct devfreq_simple_ondemand_data gpu_devfreq_config;
+
+	/**
+	 * gpu_clamp_to_idle: Enable clamping to idle freq when inactive
+	 */
+	bool gpu_clamp_to_idle;
+
+	/**
+	 * disable_err_irq:
+	 *
+	 * Disable handling of GPU hw error interrupts, to force fallback to
+	 * sw hangcheck timer.  Written (via debugfs) by igt tests to test
+	 * the sw hangcheck mechanism.
+	 */
+	bool disable_err_irq;
+};
+
+struct msm_format {
+	uint32_t pixel_format;
+};
+
+struct msm_pending_timer;
+
+int msm_atomic_init_pending_timer(struct msm_pending_timer *timer,
+		struct msm_kms *kms, int crtc_idx);
+void msm_atomic_destroy_pending_timer(struct msm_pending_timer *timer);
+void msm_atomic_commit_tail(struct drm_atomic_state *state);
+int msm_atomic_check(struct drm_device *dev, struct drm_atomic_state *state);
+struct drm_atomic_state *msm_atomic_state_alloc(struct drm_device *dev);
+void msm_atomic_state_clear(struct drm_atomic_state *state);
+void msm_atomic_state_free(struct drm_atomic_state *state);
+
+int msm_crtc_enable_vblank(struct drm_crtc *crtc);
+void msm_crtc_disable_vblank(struct drm_crtc *crtc);
+
+int msm_register_mmu(struct drm_device *dev, struct msm_mmu *mmu);
+void msm_unregister_mmu(struct drm_device *dev, struct msm_mmu *mmu);
+
+struct msm_gem_address_space *msm_kms_init_aspace(struct drm_device *dev);
+bool msm_use_mmu(struct drm_device *dev);
+
+int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
+		struct drm_file *file);
+
+#ifdef CONFIG_DEBUG_FS
+unsigned long msm_gem_shrinker_shrink(struct drm_device *dev, unsigned long nr_to_scan);
+#endif
+
+int msm_gem_shrinker_init(struct drm_device *dev);
+void msm_gem_shrinker_cleanup(struct drm_device *dev);
+
+struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj);
+int msm_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map);
+void msm_gem_prime_vunmap(struct drm_gem_object *obj, struct iosys_map *map);
+struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev,
+		struct dma_buf_attachment *attach, struct sg_table *sg);
+int msm_gem_prime_pin(struct drm_gem_object *obj);
+void msm_gem_prime_unpin(struct drm_gem_object *obj);
+
+int msm_framebuffer_prepare(struct drm_framebuffer *fb,
+		struct msm_gem_address_space *aspace, bool needs_dirtyfb);
+void msm_framebuffer_cleanup(struct drm_framebuffer *fb,
+		struct msm_gem_address_space *aspace, bool needed_dirtyfb);
+uint32_t msm_framebuffer_iova(struct drm_framebuffer *fb,
+		struct msm_gem_address_space *aspace, int plane);
+struct drm_gem_object *msm_framebuffer_bo(struct drm_framebuffer *fb, int plane);
+const struct msm_format *msm_framebuffer_format(struct drm_framebuffer *fb);
+struct drm_framebuffer *msm_framebuffer_create(struct drm_device *dev,
+		struct drm_file *file, const struct drm_mode_fb_cmd2 *mode_cmd);
+struct drm_framebuffer * msm_alloc_stolen_fb(struct drm_device *dev,
+		int w, int h, int p, uint32_t format);
+
+#ifdef CONFIG_DRM_FBDEV_EMULATION
+void msm_fbdev_setup(struct drm_device *dev);
+#else
+static inline void msm_fbdev_setup(struct drm_device *dev)
+{
+}
+#endif
+
+struct hdmi;
+#ifdef CONFIG_DRM_MSM_HDMI
+int msm_hdmi_modeset_init(struct hdmi *hdmi, struct drm_device *dev,
+		struct drm_encoder *encoder);
+void __init msm_hdmi_register(void);
+void __exit msm_hdmi_unregister(void);
+#else
+static inline int msm_hdmi_modeset_init(struct hdmi *hdmi, struct drm_device *dev,
+		struct drm_encoder *encoder)
+{
+	return -EINVAL;
+}
+static inline void __init msm_hdmi_register(void) {}
+static inline void __exit msm_hdmi_unregister(void) {}
+#endif
+
+struct msm_dsi;
+#ifdef CONFIG_DRM_MSM_DSI
+int dsi_dev_attach(struct platform_device *pdev);
+void dsi_dev_detach(struct platform_device *pdev);
+void __init msm_dsi_register(void);
+void __exit msm_dsi_unregister(void);
+int msm_dsi_modeset_init(struct msm_dsi *msm_dsi, struct drm_device *dev,
+			 struct drm_encoder *encoder);
+void msm_dsi_snapshot(struct msm_disp_state *disp_state, struct msm_dsi *msm_dsi);
+bool msm_dsi_is_cmd_mode(struct msm_dsi *msm_dsi);
+bool msm_dsi_is_bonded_dsi(struct msm_dsi *msm_dsi);
+bool msm_dsi_is_master_dsi(struct msm_dsi *msm_dsi);
+bool msm_dsi_wide_bus_enabled(struct msm_dsi *msm_dsi);
+struct drm_dsc_config *msm_dsi_get_dsc_config(struct msm_dsi *msm_dsi);
+#else
+static inline void __init msm_dsi_register(void)
+{
+}
+static inline void __exit msm_dsi_unregister(void)
+{
+}
+static inline int msm_dsi_modeset_init(struct msm_dsi *msm_dsi,
+				       struct drm_device *dev,
+				       struct drm_encoder *encoder)
+{
+	return -EINVAL;
+}
+static inline void msm_dsi_snapshot(struct msm_disp_state *disp_state, struct msm_dsi *msm_dsi)
+{
+}
+static inline bool msm_dsi_is_cmd_mode(struct msm_dsi *msm_dsi)
+{
+	return false;
+}
+static inline bool msm_dsi_is_bonded_dsi(struct msm_dsi *msm_dsi)
+{
+	return false;
+}
+static inline bool msm_dsi_is_master_dsi(struct msm_dsi *msm_dsi)
+{
+	return false;
+}
+static inline bool msm_dsi_wide_bus_enabled(struct msm_dsi *msm_dsi)
+{
+	return false;
+}
+
+static inline struct drm_dsc_config *msm_dsi_get_dsc_config(struct msm_dsi *msm_dsi)
+{
+	return NULL;
+}
+#endif
+
+#ifdef CONFIG_DRM_MSM_DP
+int __init msm_dp_register(void);
+void __exit msm_dp_unregister(void);
+int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev,
+			 struct drm_encoder *encoder, bool yuv_supported);
+void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp_display);
+bool msm_dp_is_yuv_420_enabled(const struct msm_dp *dp_display,
+			       const struct drm_display_mode *mode);
+bool msm_dp_needs_periph_flush(const struct msm_dp *dp_display,
+			       const struct drm_display_mode *mode);
+bool msm_dp_wide_bus_available(const struct msm_dp *dp_display);
+
+int msm_dp_get_mst_max_stream(const struct msm_dp *dp_display);
+
+int msm_dp_mst_bridge_init(struct msm_dp *dp_display, struct drm_encoder *encoder);
+
+int msm_dp_mst_register(struct msm_dp *dp_display);
+
+int msm_dp_get_mst_intf_id(struct msm_dp *dp_display, int stream_id);
+
+#else
+static inline int __init msm_dp_register(void)
+{
+	return -EINVAL;
+}
+static inline void __exit msm_dp_unregister(void)
+{
+}
+static inline int msm_dp_modeset_init(struct msm_dp *dp_display,
+				       struct drm_device *dev,
+				       struct drm_encoder *encoder,
+				       bool yuv_supported)
+{
+	return -EINVAL;
+}
+
+static inline int msm_dp_get_mst_max_stream(struct msm_dp *dp_display)
+{
+	return -EINVAL;
+}
+
+static inline int msm_dp_mst_register(struct msm_dp *dp_display)
+{
+	return -EINVAL;
+}
+
+static inline int msm_dp_mst_bridge_init(struct msm_dp *dp_display, struct drm_encoder *encoder)
+{
+	return -EINVAL;
+}
+
+static inline void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp_display)
+{
+}
+
+static inline bool msm_dp_is_yuv_420_enabled(const struct msm_dp *dp_display,
+					     const struct drm_display_mode *mode)
+{
+	return false;
+}
+
+static inline bool msm_dp_needs_periph_flush(const struct msm_dp *dp_display,
+					     const struct drm_display_mode *mode)
+{
+	return false;
+}
+
+static inline bool msm_dp_wide_bus_available(const struct msm_dp *dp_display)
+{
+	return false;
+}
+
+static inline int msm_dp_get_mst_intf_id(struct msm_dp *dp_display, int stream_id)
+{
+	return -EINVAL;
+}
+
+#endif
+
+#ifdef CONFIG_DRM_MSM_MDP4
+void msm_mdp4_register(void);
+void msm_mdp4_unregister(void);
+#else
+static inline void msm_mdp4_register(void) {}
+static inline void msm_mdp4_unregister(void) {}
+#endif
+
+#ifdef CONFIG_DRM_MSM_MDP5
+void msm_mdp_register(void);
+void msm_mdp_unregister(void);
+#else
+static inline void msm_mdp_register(void) {}
+static inline void msm_mdp_unregister(void) {}
+#endif
+
+#ifdef CONFIG_DRM_MSM_DPU
+void msm_dpu_register(void);
+void msm_dpu_unregister(void);
+#else
+static inline void msm_dpu_register(void) {}
+static inline void msm_dpu_unregister(void) {}
+#endif
+
+#ifdef CONFIG_DRM_MSM_MDSS
+void msm_mdss_register(void);
+void msm_mdss_unregister(void);
+#else
+static inline void msm_mdss_register(void) {}
+static inline void msm_mdss_unregister(void) {}
+#endif
+
+#ifdef CONFIG_DEBUG_FS
+void msm_framebuffer_describe(struct drm_framebuffer *fb, struct seq_file *m);
+int msm_debugfs_late_init(struct drm_device *dev);
+int msm_rd_debugfs_init(struct drm_minor *minor);
+void msm_rd_debugfs_cleanup(struct msm_drm_private *priv);
+__printf(3, 4)
+void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
+		const char *fmt, ...);
+int msm_perf_debugfs_init(struct drm_minor *minor);
+void msm_perf_debugfs_cleanup(struct msm_drm_private *priv);
+#else
+static inline int msm_debugfs_late_init(struct drm_device *dev) { return 0; }
+__printf(3, 4)
+static inline void msm_rd_dump_submit(struct msm_rd_state *rd,
+			struct msm_gem_submit *submit,
+			const char *fmt, ...) {}
+static inline void msm_rd_debugfs_cleanup(struct msm_drm_private *priv) {}
+static inline void msm_perf_debugfs_cleanup(struct msm_drm_private *priv) {}
+#endif
+
+struct clk *msm_clk_get(struct platform_device *pdev, const char *name);
+
+struct clk *msm_clk_bulk_get_clock(struct clk_bulk_data *bulk, int count,
+	const char *name);
+void __iomem *msm_ioremap(struct platform_device *pdev, const char *name);
+void __iomem *msm_ioremap_size(struct platform_device *pdev, const char *name,
+		phys_addr_t *size);
+void __iomem *msm_ioremap_quiet(struct platform_device *pdev, const char *name);
+
+struct icc_path *msm_icc_get(struct device *dev, const char *name);
+
+#define msm_writel(data, addr) writel((data), (addr))
+#define msm_readl(addr) readl((addr))
+
+static inline void msm_rmw(void __iomem *addr, u32 mask, u32 or)
+{
+	u32 val = msm_readl(addr);
+
+	val &= ~mask;
+	msm_writel(val | or, addr);
+}
+
+/**
+ * struct msm_hrtimer_work - a helper to combine an hrtimer with kthread_work
+ *
+ * @timer: hrtimer to control when the kthread work is triggered
+ * @work:  the kthread work
+ * @worker: the kthread worker the work will be scheduled on
+ */
+struct msm_hrtimer_work {
+	struct hrtimer timer;
+	struct kthread_work work;
+	struct kthread_worker *worker;
+};
+
+void msm_hrtimer_queue_work(struct msm_hrtimer_work *work,
+			    ktime_t wakeup_time,
+			    enum hrtimer_mode mode);
+void msm_hrtimer_work_init(struct msm_hrtimer_work *work,
+			   struct kthread_worker *worker,
+			   kthread_work_func_t fn,
+			   clockid_t clock_id,
+			   enum hrtimer_mode mode);
+
+#define DBG(fmt, ...) DRM_DEBUG_DRIVER(fmt"\n", ##__VA_ARGS__)
+#define VERB(fmt, ...) if (0) DRM_DEBUG_DRIVER(fmt"\n", ##__VA_ARGS__)
+
+static inline int align_pitch(int width, int bpp)
+{
+	int bytespp = (bpp + 7) / 8;
+	/* adreno needs pitch aligned to 32 pixels: */
+	return bytespp * ALIGN(width, 32);
+}
+
+/* for the generated headers: */
+#define INVALID_IDX(idx) ({BUG(); 0;})
+#define fui(x)                ({BUG(); 0;})
+#define _mesa_float_to_half(x) ({BUG(); 0;})
+
+
+#define FIELD(val, name) (((val) & name ## __MASK) >> name ## __SHIFT)
+
+/* for conditionally setting boolean flag(s): */
+#define COND(bool, val) ((bool) ? (val) : 0)
+
+static inline unsigned long timeout_to_jiffies(const ktime_t *timeout)
+{
+	ktime_t now = ktime_get();
+	s64 remaining_jiffies;
+
+	if (ktime_compare(*timeout, now) < 0) {
+		remaining_jiffies = 0;
+	} else {
+		ktime_t rem = ktime_sub(*timeout, now);
+		remaining_jiffies = ktime_divns(rem, NSEC_PER_SEC / HZ);
+	}
+
+	return clamp(remaining_jiffies, 1LL, (s64)INT_MAX);
+}
+
+/* Driver helpers */
+
+extern const struct component_master_ops msm_drm_ops;
+
+int msm_kms_pm_prepare(struct device *dev);
+void msm_kms_pm_complete(struct device *dev);
+
+int msm_drv_probe(struct device *dev,
+	int (*kms_init)(struct drm_device *dev),
+	struct msm_kms *kms);
+void msm_kms_shutdown(struct platform_device *pdev);
+
+
+#endif /* __MSM_DRV_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_dsc_helper.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_dsc_helper.h
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved
+ *
+ * Helper methods for MSM-specific DSC calculations that are common between timing engine,
+ * DSI, and DP.
+ */
+
+#ifndef MSM_DSC_HELPER_H_
+#define MSM_DSC_HELPER_H_
+
+#include <linux/math.h>
+#include <drm/display/drm_dsc_helper.h>
+
+/**
+ * msm_dsc_get_slices_per_intf() - calculate number of slices per interface
+ * @dsc: Pointer to drm dsc config struct
+ * @intf_width: interface width in pixels
+ * Returns: Integer representing the number of slices for the given interface
+ */
+static inline u32 msm_dsc_get_slices_per_intf(const struct drm_dsc_config *dsc, u32 intf_width)
+{
+	return DIV_ROUND_UP(intf_width, dsc->slice_width);
+}
+
+/**
+ * msm_dsc_get_bytes_per_line() - calculate bytes per line
+ * @dsc: Pointer to drm dsc config struct
+ * Returns: Integer value representing bytes per line. DSI and DP need
+ *          to perform further calculations to turn this into pclk_per_intf,
+ *          such as dividing by different values depending on if widebus is enabled.
+ */
+static inline u32 msm_dsc_get_bytes_per_line(const struct drm_dsc_config *dsc)
+{
+	return dsc->slice_count * dsc->slice_chunk_size;
+}
+
+#endif /* MSM_DSC_HELPER_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_fb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_fb.c
@@ -0,0 +1,285 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <drm/drm_crtc.h>
+#include <drm/drm_damage_helper.h>
+#include <drm/drm_file.h>
+#include <drm/drm_fourcc.h>
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_gem_framebuffer_helper.h>
+#include <drm/drm_probe_helper.h>
+
+#include "msm_drv.h"
+#include "msm_kms.h"
+#include "msm_gem.h"
+
+struct msm_framebuffer {
+	struct drm_framebuffer base;
+	const struct msm_format *format;
+
+	/* Count of # of attached planes which need dirtyfb: */
+	refcount_t dirtyfb;
+
+	/* Framebuffer per-plane address, if pinned, else zero: */
+	uint64_t iova[DRM_FORMAT_MAX_PLANES];
+	atomic_t prepare_count;
+};
+#define to_msm_framebuffer(x) container_of(x, struct msm_framebuffer, base)
+
+static struct drm_framebuffer *msm_framebuffer_init(struct drm_device *dev,
+		const struct drm_mode_fb_cmd2 *mode_cmd, struct drm_gem_object **bos);
+
+static int msm_framebuffer_dirtyfb(struct drm_framebuffer *fb,
+				   struct drm_file *file_priv, unsigned int flags,
+				   unsigned int color, struct drm_clip_rect *clips,
+				   unsigned int num_clips)
+{
+	struct msm_framebuffer *msm_fb = to_msm_framebuffer(fb);
+
+	/* If this fb is not used on any display requiring pixel data to be
+	 * flushed, then skip dirtyfb
+	 */
+	if (refcount_read(&msm_fb->dirtyfb) == 1)
+		return 0;
+
+	return drm_atomic_helper_dirtyfb(fb, file_priv, flags, color,
+					 clips, num_clips);
+}
+
+static const struct drm_framebuffer_funcs msm_framebuffer_funcs = {
+	.create_handle = drm_gem_fb_create_handle,
+	.destroy = drm_gem_fb_destroy,
+	.dirty = msm_framebuffer_dirtyfb,
+};
+
+#ifdef CONFIG_DEBUG_FS
+void msm_framebuffer_describe(struct drm_framebuffer *fb, struct seq_file *m)
+{
+	struct msm_gem_stats stats = {};
+	int i, n = fb->format->num_planes;
+
+	seq_printf(m, "fb: %dx%d@%4.4s (%2d, ID:%d)\n",
+			fb->width, fb->height, (char *)&fb->format->format,
+			drm_framebuffer_read_refcount(fb), fb->base.id);
+
+	for (i = 0; i < n; i++) {
+		seq_printf(m, "   %d: offset=%d pitch=%d, obj: ",
+				i, fb->offsets[i], fb->pitches[i]);
+		msm_gem_describe(fb->obj[i], m, &stats);
+	}
+}
+#endif
+
+/* prepare/pin all the fb's bo's for scanout.
+ */
+int msm_framebuffer_prepare(struct drm_framebuffer *fb,
+		struct msm_gem_address_space *aspace,
+		bool needs_dirtyfb)
+{
+	struct msm_framebuffer *msm_fb = to_msm_framebuffer(fb);
+	int ret, i, n = fb->format->num_planes;
+
+	if (needs_dirtyfb)
+		refcount_inc(&msm_fb->dirtyfb);
+
+	atomic_inc(&msm_fb->prepare_count);
+
+	for (i = 0; i < n; i++) {
+		ret = msm_gem_get_and_pin_iova(fb->obj[i], aspace, &msm_fb->iova[i]);
+		drm_dbg_state(fb->dev, "FB[%u]: iova[%d]: %08llx (%d)\n",
+			      fb->base.id, i, msm_fb->iova[i], ret);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+void msm_framebuffer_cleanup(struct drm_framebuffer *fb,
+		struct msm_gem_address_space *aspace,
+		bool needed_dirtyfb)
+{
+	struct msm_framebuffer *msm_fb = to_msm_framebuffer(fb);
+	int i, n = fb->format->num_planes;
+
+	if (needed_dirtyfb)
+		refcount_dec(&msm_fb->dirtyfb);
+
+	for (i = 0; i < n; i++)
+		msm_gem_unpin_iova(fb->obj[i], aspace);
+
+	if (!atomic_dec_return(&msm_fb->prepare_count))
+		memset(msm_fb->iova, 0, sizeof(msm_fb->iova));
+}
+
+uint32_t msm_framebuffer_iova(struct drm_framebuffer *fb,
+		struct msm_gem_address_space *aspace, int plane)
+{
+	struct msm_framebuffer *msm_fb = to_msm_framebuffer(fb);
+	return msm_fb->iova[plane] + fb->offsets[plane];
+}
+
+struct drm_gem_object *msm_framebuffer_bo(struct drm_framebuffer *fb, int plane)
+{
+	return drm_gem_fb_get_obj(fb, plane);
+}
+
+const struct msm_format *msm_framebuffer_format(struct drm_framebuffer *fb)
+{
+	struct msm_framebuffer *msm_fb = to_msm_framebuffer(fb);
+	return msm_fb->format;
+}
+
+struct drm_framebuffer *msm_framebuffer_create(struct drm_device *dev,
+		struct drm_file *file, const struct drm_mode_fb_cmd2 *mode_cmd)
+{
+	const struct drm_format_info *info = drm_get_format_info(dev,
+								 mode_cmd);
+	struct drm_gem_object *bos[4] = {0};
+	struct drm_framebuffer *fb;
+	int ret, i, n = info->num_planes;
+
+	for (i = 0; i < n; i++) {
+		bos[i] = drm_gem_object_lookup(file, mode_cmd->handles[i]);
+		if (!bos[i]) {
+			ret = -ENXIO;
+			goto out_unref;
+		}
+	}
+
+	fb = msm_framebuffer_init(dev, mode_cmd, bos);
+	if (IS_ERR(fb)) {
+		ret = PTR_ERR(fb);
+		goto out_unref;
+	}
+
+	return fb;
+
+out_unref:
+	for (i = 0; i < n; i++)
+		drm_gem_object_put(bos[i]);
+	return ERR_PTR(ret);
+}
+
+static struct drm_framebuffer *msm_framebuffer_init(struct drm_device *dev,
+		const struct drm_mode_fb_cmd2 *mode_cmd, struct drm_gem_object **bos)
+{
+	const struct drm_format_info *info = drm_get_format_info(dev,
+								 mode_cmd);
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+	struct msm_framebuffer *msm_fb = NULL;
+	struct drm_framebuffer *fb;
+	const struct msm_format *format;
+	int ret, i, n;
+
+	drm_dbg_state(dev, "create framebuffer: mode_cmd=%p (%dx%d@%4.4s)\n",
+			mode_cmd, mode_cmd->width, mode_cmd->height,
+			(char *)&mode_cmd->pixel_format);
+
+	n = info->num_planes;
+	format = kms->funcs->get_format(kms, mode_cmd->pixel_format,
+			mode_cmd->modifier[0]);
+	if (!format) {
+		DRM_DEV_ERROR(dev->dev, "unsupported pixel format: %4.4s\n",
+				(char *)&mode_cmd->pixel_format);
+		ret = -EINVAL;
+		goto fail;
+	}
+
+	msm_fb = kzalloc(sizeof(*msm_fb), GFP_KERNEL);
+	if (!msm_fb) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	fb = &msm_fb->base;
+
+	msm_fb->format = format;
+
+	if (n > ARRAY_SIZE(fb->obj)) {
+		ret = -EINVAL;
+		goto fail;
+	}
+
+	for (i = 0; i < n; i++) {
+		unsigned int width = mode_cmd->width / (i ? info->hsub : 1);
+		unsigned int height = mode_cmd->height / (i ? info->vsub : 1);
+		unsigned int min_size;
+
+		min_size = (height - 1) * mode_cmd->pitches[i]
+			 + width * info->cpp[i]
+			 + mode_cmd->offsets[i];
+
+		if (bos[i]->size < min_size) {
+			ret = -EINVAL;
+			goto fail;
+		}
+
+		msm_fb->base.obj[i] = bos[i];
+	}
+
+	drm_helper_mode_fill_fb_struct(dev, fb, mode_cmd);
+
+	ret = drm_framebuffer_init(dev, fb, &msm_framebuffer_funcs);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "framebuffer init failed: %d\n", ret);
+		goto fail;
+	}
+
+	refcount_set(&msm_fb->dirtyfb, 1);
+
+	drm_dbg_state(dev, "create: FB ID: %d (%p)\n", fb->base.id, fb);
+
+	return fb;
+
+fail:
+	kfree(msm_fb);
+
+	return ERR_PTR(ret);
+}
+
+struct drm_framebuffer *
+msm_alloc_stolen_fb(struct drm_device *dev, int w, int h, int p, uint32_t format)
+{
+	struct drm_mode_fb_cmd2 mode_cmd = {
+		.pixel_format = format,
+		.width = w,
+		.height = h,
+		.pitches = { p },
+	};
+	struct drm_gem_object *bo;
+	struct drm_framebuffer *fb;
+	int size;
+
+	/* allocate backing bo */
+	size = mode_cmd.pitches[0] * mode_cmd.height;
+	DBG("allocating %d bytes for fb %d", size, dev->primary->index);
+	bo = msm_gem_new(dev, size, MSM_BO_SCANOUT | MSM_BO_WC | MSM_BO_STOLEN);
+	if (IS_ERR(bo)) {
+		dev_warn(dev->dev, "could not allocate stolen bo\n");
+		/* try regular bo: */
+		bo = msm_gem_new(dev, size, MSM_BO_SCANOUT | MSM_BO_WC);
+	}
+	if (IS_ERR(bo)) {
+		DRM_DEV_ERROR(dev->dev, "failed to allocate buffer object\n");
+		return ERR_CAST(bo);
+	}
+
+	msm_gem_object_set_name(bo, "stolenfb");
+
+	fb = msm_framebuffer_init(dev, &mode_cmd, &bo);
+	if (IS_ERR(fb)) {
+		DRM_DEV_ERROR(dev->dev, "failed to allocate fb\n");
+		/* note: if fb creation failed, we can't rely on fb destroy
+		 * to unref the bo:
+		 */
+		drm_gem_object_put(bo);
+		return ERR_CAST(fb);
+	}
+
+	return fb;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_fbdev.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_fbdev.c
@@ -0,0 +1,256 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/fb.h>
+
+#include <drm/drm_drv.h>
+#include <drm/drm_crtc_helper.h>
+#include <drm/drm_fb_helper.h>
+#include <drm/drm_fourcc.h>
+#include <drm/drm_framebuffer.h>
+#include <drm/drm_prime.h>
+
+#include "msm_drv.h"
+#include "msm_gem.h"
+#include "msm_kms.h"
+
+static bool fbdev = true;
+MODULE_PARM_DESC(fbdev, "Enable fbdev compat layer");
+module_param(fbdev, bool, 0600);
+
+/*
+ * fbdev funcs, to implement legacy fbdev interface on top of drm driver
+ */
+
+FB_GEN_DEFAULT_DEFERRED_SYSMEM_OPS(msm_fbdev,
+				   drm_fb_helper_damage_range,
+				   drm_fb_helper_damage_area)
+
+static int msm_fbdev_mmap(struct fb_info *info, struct vm_area_struct *vma)
+{
+	struct drm_fb_helper *helper = (struct drm_fb_helper *)info->par;
+	struct drm_gem_object *bo = msm_framebuffer_bo(helper->fb, 0);
+
+	return drm_gem_prime_mmap(bo, vma);
+}
+
+static void msm_fbdev_fb_destroy(struct fb_info *info)
+{
+	struct drm_fb_helper *helper = (struct drm_fb_helper *)info->par;
+	struct drm_framebuffer *fb = helper->fb;
+	struct drm_gem_object *bo = msm_framebuffer_bo(fb, 0);
+
+	DBG();
+
+	drm_fb_helper_fini(helper);
+
+	/* this will free the backing object */
+	msm_gem_put_vaddr(bo);
+	drm_framebuffer_remove(fb);
+
+	drm_client_release(&helper->client);
+	drm_fb_helper_unprepare(helper);
+	kfree(helper);
+}
+
+static const struct fb_ops msm_fb_ops = {
+	.owner = THIS_MODULE,
+	__FB_DEFAULT_DEFERRED_OPS_RDWR(msm_fbdev),
+	DRM_FB_HELPER_DEFAULT_OPS,
+	__FB_DEFAULT_DEFERRED_OPS_DRAW(msm_fbdev),
+	.fb_mmap = msm_fbdev_mmap,
+	.fb_destroy = msm_fbdev_fb_destroy,
+};
+
+static int msm_fbdev_create(struct drm_fb_helper *helper,
+		struct drm_fb_helper_surface_size *sizes)
+{
+	struct drm_device *dev = helper->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct drm_framebuffer *fb = NULL;
+	struct drm_gem_object *bo;
+	struct fb_info *fbi = NULL;
+	uint64_t paddr;
+	uint32_t format;
+	int ret, pitch;
+
+	format = drm_mode_legacy_fb_format(sizes->surface_bpp, sizes->surface_depth);
+
+	DBG("create fbdev: %dx%d@%d (%dx%d)", sizes->surface_width,
+			sizes->surface_height, sizes->surface_bpp,
+			sizes->fb_width, sizes->fb_height);
+
+	pitch = align_pitch(sizes->surface_width, sizes->surface_bpp);
+	fb = msm_alloc_stolen_fb(dev, sizes->surface_width,
+			sizes->surface_height, pitch, format);
+
+	if (IS_ERR(fb)) {
+		DRM_DEV_ERROR(dev->dev, "failed to allocate fb\n");
+		return PTR_ERR(fb);
+	}
+
+	bo = msm_framebuffer_bo(fb, 0);
+
+	/*
+	 * NOTE: if we can be guaranteed to be able to map buffer
+	 * in panic (ie. lock-safe, etc) we could avoid pinning the
+	 * buffer now:
+	 */
+	ret = msm_gem_get_and_pin_iova(bo, priv->kms->aspace, &paddr);
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "failed to get buffer obj iova: %d\n", ret);
+		goto fail;
+	}
+
+	fbi = drm_fb_helper_alloc_info(helper);
+	if (IS_ERR(fbi)) {
+		DRM_DEV_ERROR(dev->dev, "failed to allocate fb info\n");
+		ret = PTR_ERR(fbi);
+		goto fail;
+	}
+
+	DBG("fbi=%p, dev=%p", fbi, dev);
+
+	helper->fb = fb;
+
+	fbi->fbops = &msm_fb_ops;
+
+	drm_fb_helper_fill_info(fbi, helper, sizes);
+
+	fbi->screen_buffer = msm_gem_get_vaddr(bo);
+	if (IS_ERR(fbi->screen_buffer)) {
+		ret = PTR_ERR(fbi->screen_buffer);
+		goto fail;
+	}
+	fbi->screen_size = bo->size;
+	fbi->fix.smem_start = paddr;
+	fbi->fix.smem_len = bo->size;
+
+	DBG("par=%p, %dx%d", fbi->par, fbi->var.xres, fbi->var.yres);
+	DBG("allocated %dx%d fb", fb->width, fb->height);
+
+	return 0;
+
+fail:
+	drm_framebuffer_remove(fb);
+	return ret;
+}
+
+static int msm_fbdev_fb_dirty(struct drm_fb_helper *helper,
+			      struct drm_clip_rect *clip)
+{
+	struct drm_device *dev = helper->dev;
+	int ret;
+
+	/* Call damage handlers only if necessary */
+	if (!(clip->x1 < clip->x2 && clip->y1 < clip->y2))
+		return 0;
+
+	if (helper->fb->funcs->dirty) {
+		ret = helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, clip, 1);
+		if (drm_WARN_ONCE(dev, ret, "Dirty helper failed: ret=%d\n", ret))
+			return ret;
+	}
+
+	return 0;
+}
+
+static const struct drm_fb_helper_funcs msm_fb_helper_funcs = {
+	.fb_probe = msm_fbdev_create,
+	.fb_dirty = msm_fbdev_fb_dirty,
+};
+
+/*
+ * struct drm_client
+ */
+
+static void msm_fbdev_client_unregister(struct drm_client_dev *client)
+{
+	struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
+
+	if (fb_helper->info) {
+		drm_fb_helper_unregister_info(fb_helper);
+	} else {
+		drm_client_release(&fb_helper->client);
+		drm_fb_helper_unprepare(fb_helper);
+		kfree(fb_helper);
+	}
+}
+
+static int msm_fbdev_client_restore(struct drm_client_dev *client)
+{
+	drm_fb_helper_lastclose(client->dev);
+
+	return 0;
+}
+
+static int msm_fbdev_client_hotplug(struct drm_client_dev *client)
+{
+	struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
+	struct drm_device *dev = client->dev;
+	int ret;
+
+	if (dev->fb_helper)
+		return drm_fb_helper_hotplug_event(dev->fb_helper);
+
+	ret = drm_fb_helper_init(dev, fb_helper);
+	if (ret)
+		goto err_drm_err;
+
+	if (!drm_drv_uses_atomic_modeset(dev))
+		drm_helper_disable_unused_functions(dev);
+
+	ret = drm_fb_helper_initial_config(fb_helper);
+	if (ret)
+		goto err_drm_fb_helper_fini;
+
+	return 0;
+
+err_drm_fb_helper_fini:
+	drm_fb_helper_fini(fb_helper);
+err_drm_err:
+	drm_err(dev, "Failed to setup fbdev emulation (ret=%d)\n", ret);
+	return ret;
+}
+
+static const struct drm_client_funcs msm_fbdev_client_funcs = {
+	.owner		= THIS_MODULE,
+	.unregister	= msm_fbdev_client_unregister,
+	.restore	= msm_fbdev_client_restore,
+	.hotplug	= msm_fbdev_client_hotplug,
+};
+
+/* initialize fbdev helper */
+void msm_fbdev_setup(struct drm_device *dev)
+{
+	struct drm_fb_helper *helper;
+	int ret;
+
+	if (!fbdev)
+		return;
+
+	drm_WARN(dev, !dev->registered, "Device has not been registered.\n");
+	drm_WARN(dev, dev->fb_helper, "fb_helper is already set!\n");
+
+	helper = kzalloc(sizeof(*helper), GFP_KERNEL);
+	if (!helper)
+		return;
+	drm_fb_helper_prepare(dev, helper, 32, &msm_fb_helper_funcs);
+
+	ret = drm_client_init(dev, &helper->client, "fbdev", &msm_fbdev_client_funcs);
+	if (ret) {
+		drm_err(dev, "Failed to register client: %d\n", ret);
+		goto err_drm_fb_helper_unprepare;
+	}
+
+	drm_client_register(&helper->client);
+
+	return;
+
+err_drm_fb_helper_unprepare:
+	drm_fb_helper_unprepare(helper);
+	kfree(helper);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_fence.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_fence.c
@@ -0,0 +1,202 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013-2016 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/dma-fence.h>
+
+#include "msm_drv.h"
+#include "msm_fence.h"
+#include "msm_gpu.h"
+
+static struct msm_gpu *fctx2gpu(struct msm_fence_context *fctx)
+{
+	struct msm_drm_private *priv = fctx->dev->dev_private;
+	return priv->gpu;
+}
+
+static enum hrtimer_restart deadline_timer(struct hrtimer *t)
+{
+	struct msm_fence_context *fctx = container_of(t,
+			struct msm_fence_context, deadline_timer);
+
+	kthread_queue_work(fctx2gpu(fctx)->worker, &fctx->deadline_work);
+
+	return HRTIMER_NORESTART;
+}
+
+static void deadline_work(struct kthread_work *work)
+{
+	struct msm_fence_context *fctx = container_of(work,
+			struct msm_fence_context, deadline_work);
+
+	/* If deadline fence has already passed, nothing to do: */
+	if (msm_fence_completed(fctx, fctx->next_deadline_fence))
+		return;
+
+	msm_devfreq_boost(fctx2gpu(fctx), 2);
+}
+
+
+struct msm_fence_context *
+msm_fence_context_alloc(struct drm_device *dev, volatile uint32_t *fenceptr,
+		const char *name)
+{
+	struct msm_fence_context *fctx;
+	static int index = 0;
+
+	fctx = kzalloc(sizeof(*fctx), GFP_KERNEL);
+	if (!fctx)
+		return ERR_PTR(-ENOMEM);
+
+	fctx->dev = dev;
+	strscpy(fctx->name, name, sizeof(fctx->name));
+	fctx->context = dma_fence_context_alloc(1);
+	fctx->index = index++;
+	fctx->fenceptr = fenceptr;
+	spin_lock_init(&fctx->spinlock);
+
+	/*
+	 * Start out close to the 32b fence rollover point, so we can
+	 * catch bugs with fence comparisons.
+	 */
+	fctx->last_fence = 0xffffff00;
+	fctx->completed_fence = fctx->last_fence;
+	*fctx->fenceptr = fctx->last_fence;
+
+	hrtimer_init(&fctx->deadline_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+	fctx->deadline_timer.function = deadline_timer;
+
+	kthread_init_work(&fctx->deadline_work, deadline_work);
+
+	fctx->next_deadline = ktime_get();
+
+	return fctx;
+}
+
+void msm_fence_context_free(struct msm_fence_context *fctx)
+{
+	kfree(fctx);
+}
+
+bool msm_fence_completed(struct msm_fence_context *fctx, uint32_t fence)
+{
+	/*
+	 * Note: Check completed_fence first, as fenceptr is in a write-combine
+	 * mapping, so it will be more expensive to read.
+	 */
+	return (int32_t)(fctx->completed_fence - fence) >= 0 ||
+		(int32_t)(*fctx->fenceptr - fence) >= 0;
+}
+
+/* called from irq handler and workqueue (in recover path) */
+void msm_update_fence(struct msm_fence_context *fctx, uint32_t fence)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&fctx->spinlock, flags);
+	if (fence_after(fence, fctx->completed_fence))
+		fctx->completed_fence = fence;
+	if (msm_fence_completed(fctx, fctx->next_deadline_fence))
+		hrtimer_cancel(&fctx->deadline_timer);
+	spin_unlock_irqrestore(&fctx->spinlock, flags);
+}
+
+struct msm_fence {
+	struct dma_fence base;
+	struct msm_fence_context *fctx;
+};
+
+static inline struct msm_fence *to_msm_fence(struct dma_fence *fence)
+{
+	return container_of(fence, struct msm_fence, base);
+}
+
+static const char *msm_fence_get_driver_name(struct dma_fence *fence)
+{
+	return "msm";
+}
+
+static const char *msm_fence_get_timeline_name(struct dma_fence *fence)
+{
+	struct msm_fence *f = to_msm_fence(fence);
+	return f->fctx->name;
+}
+
+static bool msm_fence_signaled(struct dma_fence *fence)
+{
+	struct msm_fence *f = to_msm_fence(fence);
+	return msm_fence_completed(f->fctx, f->base.seqno);
+}
+
+static void msm_fence_set_deadline(struct dma_fence *fence, ktime_t deadline)
+{
+	struct msm_fence *f = to_msm_fence(fence);
+	struct msm_fence_context *fctx = f->fctx;
+	unsigned long flags;
+	ktime_t now;
+
+	spin_lock_irqsave(&fctx->spinlock, flags);
+	now = ktime_get();
+
+	if (ktime_after(now, fctx->next_deadline) ||
+			ktime_before(deadline, fctx->next_deadline)) {
+		fctx->next_deadline = deadline;
+		fctx->next_deadline_fence =
+			max(fctx->next_deadline_fence, (uint32_t)fence->seqno);
+
+		/*
+		 * Set timer to trigger boost 3ms before deadline, or
+		 * if we are already less than 3ms before the deadline
+		 * schedule boost work immediately.
+		 */
+		deadline = ktime_sub(deadline, ms_to_ktime(3));
+
+		if (ktime_after(now, deadline)) {
+			kthread_queue_work(fctx2gpu(fctx)->worker,
+					&fctx->deadline_work);
+		} else {
+			hrtimer_start(&fctx->deadline_timer, deadline,
+					HRTIMER_MODE_ABS);
+		}
+	}
+
+	spin_unlock_irqrestore(&fctx->spinlock, flags);
+}
+
+static const struct dma_fence_ops msm_fence_ops = {
+	.get_driver_name = msm_fence_get_driver_name,
+	.get_timeline_name = msm_fence_get_timeline_name,
+	.signaled = msm_fence_signaled,
+	.set_deadline = msm_fence_set_deadline,
+};
+
+struct dma_fence *
+msm_fence_alloc(void)
+{
+	struct msm_fence *f;
+
+	f = kzalloc(sizeof(*f), GFP_KERNEL);
+	if (!f)
+		return ERR_PTR(-ENOMEM);
+
+	return &f->base;
+}
+
+void
+msm_fence_init(struct dma_fence *fence, struct msm_fence_context *fctx)
+{
+	struct msm_fence *f = to_msm_fence(fence);
+
+	f->fctx = fctx;
+
+	/*
+	 * Until this point, the fence was just some pre-allocated memory,
+	 * no-one should have taken a reference to it yet.
+	 */
+	WARN_ON(kref_read(&fence->refcount));
+
+	dma_fence_init(&f->base, &msm_fence_ops, &fctx->spinlock,
+		       fctx->context, ++fctx->last_fence);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_fence.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_fence.h
@@ -0,0 +1,99 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013-2016 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MSM_FENCE_H__
+#define __MSM_FENCE_H__
+
+#include "msm_drv.h"
+
+/**
+ * struct msm_fence_context - fence context for gpu
+ *
+ * Each ringbuffer has a single fence context, with the GPU writing an
+ * incrementing fence seqno at the end of each submit
+ */
+struct msm_fence_context {
+	struct drm_device *dev;
+	/** name: human readable name for fence timeline */
+	char name[32];
+	/** context: see dma_fence_context_alloc() */
+	unsigned context;
+	/** index: similar to context, but local to msm_fence_context's */
+	unsigned index;
+
+	/**
+	 * last_fence:
+	 *
+	 * Last assigned fence, incremented each time a fence is created
+	 * on this fence context.  If last_fence == completed_fence,
+	 * there is no remaining pending work
+	 */
+	uint32_t last_fence;
+
+	/**
+	 * completed_fence:
+	 *
+	 * The last completed fence, updated from the CPU after interrupt
+	 * from GPU
+	 */
+	uint32_t completed_fence;
+
+	/**
+	 * fenceptr:
+	 *
+	 * The address that the GPU directly writes with completed fence
+	 * seqno.  This can be ahead of completed_fence.  We can peek at
+	 * this to see if a fence has already signaled but the CPU hasn't
+	 * gotten around to handling the irq and updating completed_fence
+	 */
+	volatile uint32_t *fenceptr;
+
+	spinlock_t spinlock;
+
+	/*
+	 * TODO this doesn't really deal with multiple deadlines, like
+	 * if userspace got multiple frames ahead.. OTOH atomic updates
+	 * don't queue, so maybe that is ok
+	 */
+
+	/** next_deadline: Time of next deadline */
+	ktime_t next_deadline;
+
+	/**
+	 * next_deadline_fence:
+	 *
+	 * Fence value for next pending deadline.  The deadline timer is
+	 * canceled when this fence is signaled.
+	 */
+	uint32_t next_deadline_fence;
+
+	struct hrtimer deadline_timer;
+	struct kthread_work deadline_work;
+};
+
+struct msm_fence_context * msm_fence_context_alloc(struct drm_device *dev,
+		volatile uint32_t *fenceptr, const char *name);
+void msm_fence_context_free(struct msm_fence_context *fctx);
+
+bool msm_fence_completed(struct msm_fence_context *fctx, uint32_t fence);
+void msm_update_fence(struct msm_fence_context *fctx, uint32_t fence);
+
+struct dma_fence * msm_fence_alloc(void);
+void msm_fence_init(struct dma_fence *fence, struct msm_fence_context *fctx);
+
+static inline bool
+fence_before(uint32_t a, uint32_t b)
+{
+   return (int32_t)(a - b) < 0;
+}
+
+static inline bool
+fence_after(uint32_t a, uint32_t b)
+{
+   return (int32_t)(a - b) > 0;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gem.c
@@ -0,0 +1,1371 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/dma-map-ops.h>
+#include <linux/vmalloc.h>
+#include <linux/spinlock.h>
+#include <linux/shmem_fs.h>
+#include <linux/dma-buf.h>
+#include <linux/pfn_t.h>
+
+#include <drm/drm_prime.h>
+
+#include "msm_drv.h"
+#include "msm_fence.h"
+#include "msm_gem.h"
+#include "msm_gpu.h"
+#include "msm_mmu.h"
+
+static dma_addr_t physaddr(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct msm_drm_private *priv = obj->dev->dev_private;
+	return (((dma_addr_t)msm_obj->vram_node->start) << PAGE_SHIFT) +
+			priv->vram.paddr;
+}
+
+static bool use_pages(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	return !msm_obj->vram_node;
+}
+
+/*
+ * Cache sync.. this is a bit over-complicated, to fit dma-mapping
+ * API.  Really GPU cache is out of scope here (handled on cmdstream)
+ * and all we need to do is invalidate newly allocated pages before
+ * mapping to CPU as uncached/writecombine.
+ *
+ * On top of this, we have the added headache, that depending on
+ * display generation, the display's iommu may be wired up to either
+ * the toplevel drm device (mdss), or to the mdp sub-node, meaning
+ * that here we either have dma-direct or iommu ops.
+ *
+ * Let this be a cautionary tail of abstraction gone wrong.
+ */
+
+static void sync_for_device(struct msm_gem_object *msm_obj)
+{
+	struct device *dev = msm_obj->base.dev->dev;
+
+	dma_map_sgtable(dev, msm_obj->sgt, DMA_BIDIRECTIONAL, 0);
+}
+
+static void sync_for_cpu(struct msm_gem_object *msm_obj)
+{
+	struct device *dev = msm_obj->base.dev->dev;
+
+	dma_unmap_sgtable(dev, msm_obj->sgt, DMA_BIDIRECTIONAL, 0);
+}
+
+static void update_lru_active(struct drm_gem_object *obj)
+{
+	struct msm_drm_private *priv = obj->dev->dev_private;
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	GEM_WARN_ON(!msm_obj->pages);
+
+	if (msm_obj->pin_count) {
+		drm_gem_lru_move_tail_locked(&priv->lru.pinned, obj);
+	} else if (msm_obj->madv == MSM_MADV_WILLNEED) {
+		drm_gem_lru_move_tail_locked(&priv->lru.willneed, obj);
+	} else {
+		GEM_WARN_ON(msm_obj->madv != MSM_MADV_DONTNEED);
+
+		drm_gem_lru_move_tail_locked(&priv->lru.dontneed, obj);
+	}
+}
+
+static void update_lru_locked(struct drm_gem_object *obj)
+{
+	struct msm_drm_private *priv = obj->dev->dev_private;
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_gem_assert_locked(&msm_obj->base);
+
+	if (!msm_obj->pages) {
+		GEM_WARN_ON(msm_obj->pin_count);
+
+		drm_gem_lru_move_tail_locked(&priv->lru.unbacked, obj);
+	} else {
+		update_lru_active(obj);
+	}
+}
+
+static void update_lru(struct drm_gem_object *obj)
+{
+	struct msm_drm_private *priv = obj->dev->dev_private;
+
+	mutex_lock(&priv->lru.lock);
+	update_lru_locked(obj);
+	mutex_unlock(&priv->lru.lock);
+}
+
+/* allocate pages from VRAM carveout, used when no IOMMU: */
+static struct page **get_pages_vram(struct drm_gem_object *obj, int npages)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct msm_drm_private *priv = obj->dev->dev_private;
+	dma_addr_t paddr;
+	struct page **p;
+	int ret, i;
+
+	p = kvmalloc_array(npages, sizeof(struct page *), GFP_KERNEL);
+	if (!p)
+		return ERR_PTR(-ENOMEM);
+
+	spin_lock(&priv->vram.lock);
+	ret = drm_mm_insert_node(&priv->vram.mm, msm_obj->vram_node, npages);
+	spin_unlock(&priv->vram.lock);
+	if (ret) {
+		kvfree(p);
+		return ERR_PTR(ret);
+	}
+
+	paddr = physaddr(obj);
+	for (i = 0; i < npages; i++) {
+		p[i] = pfn_to_page(__phys_to_pfn(paddr));
+		paddr += PAGE_SIZE;
+	}
+
+	return p;
+}
+
+static struct page **get_pages(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_gem_assert_locked(obj);
+
+	if (!msm_obj->pages) {
+		struct drm_device *dev = obj->dev;
+		struct page **p;
+		int npages = obj->size >> PAGE_SHIFT;
+
+		if (use_pages(obj))
+			p = drm_gem_get_pages(obj);
+		else
+			p = get_pages_vram(obj, npages);
+
+		if (IS_ERR(p)) {
+			DRM_DEV_ERROR(dev->dev, "could not get pages: %ld\n",
+					PTR_ERR(p));
+			return p;
+		}
+
+		msm_obj->pages = p;
+
+		msm_obj->sgt = drm_prime_pages_to_sg(obj->dev, p, npages);
+		if (IS_ERR(msm_obj->sgt)) {
+			void *ptr = ERR_CAST(msm_obj->sgt);
+
+			DRM_DEV_ERROR(dev->dev, "failed to allocate sgt\n");
+			msm_obj->sgt = NULL;
+			return ptr;
+		}
+
+		/* For non-cached buffers, ensure the new pages are clean
+		 * because display controller, GPU, etc. are not coherent:
+		 */
+		if (msm_obj->flags & MSM_BO_WC)
+			sync_for_device(msm_obj);
+
+		update_lru(obj);
+	}
+
+	return msm_obj->pages;
+}
+
+static void put_pages_vram(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct msm_drm_private *priv = obj->dev->dev_private;
+
+	spin_lock(&priv->vram.lock);
+	drm_mm_remove_node(msm_obj->vram_node);
+	spin_unlock(&priv->vram.lock);
+
+	kvfree(msm_obj->pages);
+}
+
+static void put_pages(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	if (msm_obj->pages) {
+		if (msm_obj->sgt) {
+			/* For non-cached buffers, ensure the new
+			 * pages are clean because display controller,
+			 * GPU, etc. are not coherent:
+			 */
+			if (msm_obj->flags & MSM_BO_WC)
+				sync_for_cpu(msm_obj);
+
+			sg_free_table(msm_obj->sgt);
+			kfree(msm_obj->sgt);
+			msm_obj->sgt = NULL;
+		}
+
+		if (use_pages(obj))
+			drm_gem_put_pages(obj, msm_obj->pages, true, false);
+		else
+			put_pages_vram(obj);
+
+		msm_obj->pages = NULL;
+		update_lru(obj);
+	}
+}
+
+static struct page **msm_gem_pin_pages_locked(struct drm_gem_object *obj,
+					      unsigned madv)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_gem_assert_locked(obj);
+
+	if (msm_obj->madv > madv) {
+		DRM_DEV_DEBUG_DRIVER(obj->dev->dev, "Invalid madv state: %u vs %u\n",
+				     msm_obj->madv, madv);
+		return ERR_PTR(-EBUSY);
+	}
+
+	return get_pages(obj);
+}
+
+/*
+ * Update the pin count of the object, call under lru.lock
+ */
+void msm_gem_pin_obj_locked(struct drm_gem_object *obj)
+{
+	struct msm_drm_private *priv = obj->dev->dev_private;
+
+	msm_gem_assert_locked(obj);
+
+	to_msm_bo(obj)->pin_count++;
+	drm_gem_lru_move_tail_locked(&priv->lru.pinned, obj);
+}
+
+static void pin_obj_locked(struct drm_gem_object *obj)
+{
+	struct msm_drm_private *priv = obj->dev->dev_private;
+
+	mutex_lock(&priv->lru.lock);
+	msm_gem_pin_obj_locked(obj);
+	mutex_unlock(&priv->lru.lock);
+}
+
+struct page **msm_gem_pin_pages(struct drm_gem_object *obj)
+{
+	struct page **p;
+
+	msm_gem_lock(obj);
+	p = msm_gem_pin_pages_locked(obj, MSM_MADV_WILLNEED);
+	if (!IS_ERR(p))
+		pin_obj_locked(obj);
+	msm_gem_unlock(obj);
+
+	return p;
+}
+
+void msm_gem_unpin_pages(struct drm_gem_object *obj)
+{
+	msm_gem_lock(obj);
+	msm_gem_unpin_locked(obj);
+	msm_gem_unlock(obj);
+}
+
+static pgprot_t msm_gem_pgprot(struct msm_gem_object *msm_obj, pgprot_t prot)
+{
+	if (msm_obj->flags & MSM_BO_WC)
+		return pgprot_writecombine(prot);
+	return prot;
+}
+
+static vm_fault_t msm_gem_fault(struct vm_fault *vmf)
+{
+	struct vm_area_struct *vma = vmf->vma;
+	struct drm_gem_object *obj = vma->vm_private_data;
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct page **pages;
+	unsigned long pfn;
+	pgoff_t pgoff;
+	int err;
+	vm_fault_t ret;
+
+	/*
+	 * vm_ops.open/drm_gem_mmap_obj and close get and put
+	 * a reference on obj. So, we dont need to hold one here.
+	 */
+	err = msm_gem_lock_interruptible(obj);
+	if (err) {
+		ret = VM_FAULT_NOPAGE;
+		goto out;
+	}
+
+	if (GEM_WARN_ON(msm_obj->madv != MSM_MADV_WILLNEED)) {
+		msm_gem_unlock(obj);
+		return VM_FAULT_SIGBUS;
+	}
+
+	/* make sure we have pages attached now */
+	pages = get_pages(obj);
+	if (IS_ERR(pages)) {
+		ret = vmf_error(PTR_ERR(pages));
+		goto out_unlock;
+	}
+
+	/* We don't use vmf->pgoff since that has the fake offset: */
+	pgoff = (vmf->address - vma->vm_start) >> PAGE_SHIFT;
+
+	pfn = page_to_pfn(pages[pgoff]);
+
+	VERB("Inserting %p pfn %lx, pa %lx", (void *)vmf->address,
+			pfn, pfn << PAGE_SHIFT);
+
+	ret = vmf_insert_pfn(vma, vmf->address, pfn);
+
+out_unlock:
+	msm_gem_unlock(obj);
+out:
+	return ret;
+}
+
+/** get mmap offset */
+static uint64_t mmap_offset(struct drm_gem_object *obj)
+{
+	struct drm_device *dev = obj->dev;
+	int ret;
+
+	msm_gem_assert_locked(obj);
+
+	/* Make it mmapable */
+	ret = drm_gem_create_mmap_offset(obj);
+
+	if (ret) {
+		DRM_DEV_ERROR(dev->dev, "could not allocate mmap offset\n");
+		return 0;
+	}
+
+	return drm_vma_node_offset_addr(&obj->vma_node);
+}
+
+uint64_t msm_gem_mmap_offset(struct drm_gem_object *obj)
+{
+	uint64_t offset;
+
+	msm_gem_lock(obj);
+	offset = mmap_offset(obj);
+	msm_gem_unlock(obj);
+	return offset;
+}
+
+static struct msm_gem_vma *add_vma(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct msm_gem_vma *vma;
+
+	msm_gem_assert_locked(obj);
+
+	vma = msm_gem_vma_new(aspace);
+	if (!vma)
+		return ERR_PTR(-ENOMEM);
+
+	list_add_tail(&vma->list, &msm_obj->vmas);
+
+	return vma;
+}
+
+static struct msm_gem_vma *lookup_vma(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct msm_gem_vma *vma;
+
+	msm_gem_assert_locked(obj);
+
+	list_for_each_entry(vma, &msm_obj->vmas, list) {
+		if (vma->aspace == aspace)
+			return vma;
+	}
+
+	return NULL;
+}
+
+static void del_vma(struct msm_gem_vma *vma)
+{
+	if (!vma)
+		return;
+
+	list_del(&vma->list);
+	kfree(vma);
+}
+
+/*
+ * If close is true, this also closes the VMA (releasing the allocated
+ * iova range) in addition to removing the iommu mapping.  In the eviction
+ * case (!close), we keep the iova allocated, but only remove the iommu
+ * mapping.
+ */
+static void
+put_iova_spaces(struct drm_gem_object *obj, bool close)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct msm_gem_vma *vma;
+
+	msm_gem_assert_locked(obj);
+
+	list_for_each_entry(vma, &msm_obj->vmas, list) {
+		if (vma->aspace) {
+			msm_gem_vma_purge(vma);
+			if (close)
+				msm_gem_vma_close(vma);
+		}
+	}
+}
+
+/* Called with msm_obj locked */
+static void
+put_iova_vmas(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct msm_gem_vma *vma, *tmp;
+
+	msm_gem_assert_locked(obj);
+
+	list_for_each_entry_safe(vma, tmp, &msm_obj->vmas, list) {
+		del_vma(vma);
+	}
+}
+
+static struct msm_gem_vma *get_vma_locked(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace,
+		u64 range_start, u64 range_end)
+{
+	struct msm_gem_vma *vma;
+
+	msm_gem_assert_locked(obj);
+
+	vma = lookup_vma(obj, aspace);
+
+	if (!vma) {
+		int ret;
+
+		vma = add_vma(obj, aspace);
+		if (IS_ERR(vma))
+			return vma;
+
+		ret = msm_gem_vma_init(vma, obj->size,
+			range_start, range_end);
+		if (ret) {
+			del_vma(vma);
+			return ERR_PTR(ret);
+		}
+	} else {
+		GEM_WARN_ON(vma->iova < range_start);
+		GEM_WARN_ON((vma->iova + obj->size) > range_end);
+	}
+
+	return vma;
+}
+
+int msm_gem_pin_vma_locked(struct drm_gem_object *obj, struct msm_gem_vma *vma)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct page **pages;
+	int prot = IOMMU_READ;
+
+	if (!(msm_obj->flags & MSM_BO_GPU_READONLY))
+		prot |= IOMMU_WRITE;
+
+	if (msm_obj->flags & MSM_BO_MAP_PRIV)
+		prot |= IOMMU_PRIV;
+
+	if (msm_obj->flags & MSM_BO_CACHED_COHERENT)
+		prot |= IOMMU_CACHE;
+
+	msm_gem_assert_locked(obj);
+
+	pages = msm_gem_pin_pages_locked(obj, MSM_MADV_WILLNEED);
+	if (IS_ERR(pages))
+		return PTR_ERR(pages);
+
+	return msm_gem_vma_map(vma, prot, msm_obj->sgt, obj->size);
+}
+
+void msm_gem_unpin_locked(struct drm_gem_object *obj)
+{
+	struct msm_drm_private *priv = obj->dev->dev_private;
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_gem_assert_locked(obj);
+
+	mutex_lock(&priv->lru.lock);
+	msm_obj->pin_count--;
+	GEM_WARN_ON(msm_obj->pin_count < 0);
+	update_lru_locked(obj);
+	mutex_unlock(&priv->lru.lock);
+}
+
+/* Special unpin path for use in fence-signaling path, avoiding the need
+ * to hold the obj lock by only depending on things that a protected by
+ * the LRU lock.  In particular we know that that we already have backing
+ * and and that the object's dma_resv has the fence for the current
+ * submit/job which will prevent us racing against page eviction.
+ */
+void msm_gem_unpin_active(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_obj->pin_count--;
+	GEM_WARN_ON(msm_obj->pin_count < 0);
+	update_lru_active(obj);
+}
+
+struct msm_gem_vma *msm_gem_get_vma_locked(struct drm_gem_object *obj,
+					   struct msm_gem_address_space *aspace)
+{
+	return get_vma_locked(obj, aspace, 0, U64_MAX);
+}
+
+static int get_and_pin_iova_range_locked(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace, uint64_t *iova,
+		u64 range_start, u64 range_end)
+{
+	struct msm_gem_vma *vma;
+	int ret;
+
+	msm_gem_assert_locked(obj);
+
+	vma = get_vma_locked(obj, aspace, range_start, range_end);
+	if (IS_ERR(vma))
+		return PTR_ERR(vma);
+
+	ret = msm_gem_pin_vma_locked(obj, vma);
+	if (!ret) {
+		*iova = vma->iova;
+		pin_obj_locked(obj);
+	}
+
+	return ret;
+}
+
+/*
+ * get iova and pin it. Should have a matching put
+ * limits iova to specified range (in pages)
+ */
+int msm_gem_get_and_pin_iova_range(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace, uint64_t *iova,
+		u64 range_start, u64 range_end)
+{
+	int ret;
+
+	msm_gem_lock(obj);
+	ret = get_and_pin_iova_range_locked(obj, aspace, iova, range_start, range_end);
+	msm_gem_unlock(obj);
+
+	return ret;
+}
+
+/* get iova and pin it. Should have a matching put */
+int msm_gem_get_and_pin_iova(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace, uint64_t *iova)
+{
+	return msm_gem_get_and_pin_iova_range(obj, aspace, iova, 0, U64_MAX);
+}
+
+/*
+ * Get an iova but don't pin it. Doesn't need a put because iovas are currently
+ * valid for the life of the object
+ */
+int msm_gem_get_iova(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace, uint64_t *iova)
+{
+	struct msm_gem_vma *vma;
+	int ret = 0;
+
+	msm_gem_lock(obj);
+	vma = get_vma_locked(obj, aspace, 0, U64_MAX);
+	if (IS_ERR(vma)) {
+		ret = PTR_ERR(vma);
+	} else {
+		*iova = vma->iova;
+	}
+	msm_gem_unlock(obj);
+
+	return ret;
+}
+
+static int clear_iova(struct drm_gem_object *obj,
+		      struct msm_gem_address_space *aspace)
+{
+	struct msm_gem_vma *vma = lookup_vma(obj, aspace);
+
+	if (!vma)
+		return 0;
+
+	msm_gem_vma_purge(vma);
+	msm_gem_vma_close(vma);
+	del_vma(vma);
+
+	return 0;
+}
+
+/*
+ * Get the requested iova but don't pin it.  Fails if the requested iova is
+ * not available.  Doesn't need a put because iovas are currently valid for
+ * the life of the object.
+ *
+ * Setting an iova of zero will clear the vma.
+ */
+int msm_gem_set_iova(struct drm_gem_object *obj,
+		     struct msm_gem_address_space *aspace, uint64_t iova)
+{
+	int ret = 0;
+
+	msm_gem_lock(obj);
+	if (!iova) {
+		ret = clear_iova(obj, aspace);
+	} else {
+		struct msm_gem_vma *vma;
+		vma = get_vma_locked(obj, aspace, iova, iova + obj->size);
+		if (IS_ERR(vma)) {
+			ret = PTR_ERR(vma);
+		} else if (GEM_WARN_ON(vma->iova != iova)) {
+			clear_iova(obj, aspace);
+			ret = -EBUSY;
+		}
+	}
+	msm_gem_unlock(obj);
+
+	return ret;
+}
+
+/*
+ * Unpin a iova by updating the reference counts. The memory isn't actually
+ * purged until something else (shrinker, mm_notifier, destroy, etc) decides
+ * to get rid of it
+ */
+void msm_gem_unpin_iova(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace)
+{
+	struct msm_gem_vma *vma;
+
+	msm_gem_lock(obj);
+	vma = lookup_vma(obj, aspace);
+	if (!GEM_WARN_ON(!vma)) {
+		msm_gem_unpin_locked(obj);
+	}
+	msm_gem_unlock(obj);
+}
+
+int msm_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
+		struct drm_mode_create_dumb *args)
+{
+	args->pitch = align_pitch(args->width, args->bpp);
+	args->size  = PAGE_ALIGN(args->pitch * args->height);
+	return msm_gem_new_handle(dev, file, args->size,
+			MSM_BO_SCANOUT | MSM_BO_WC, &args->handle, "dumb");
+}
+
+int msm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev,
+		uint32_t handle, uint64_t *offset)
+{
+	struct drm_gem_object *obj;
+	int ret = 0;
+
+	/* GEM does all our handle to object mapping */
+	obj = drm_gem_object_lookup(file, handle);
+	if (obj == NULL) {
+		ret = -ENOENT;
+		goto fail;
+	}
+
+	*offset = msm_gem_mmap_offset(obj);
+
+	drm_gem_object_put(obj);
+
+fail:
+	return ret;
+}
+
+static void *get_vaddr(struct drm_gem_object *obj, unsigned madv)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct page **pages;
+	int ret = 0;
+
+	msm_gem_assert_locked(obj);
+
+	if (obj->import_attach)
+		return ERR_PTR(-ENODEV);
+
+	pages = msm_gem_pin_pages_locked(obj, madv);
+	if (IS_ERR(pages))
+		return ERR_CAST(pages);
+
+	pin_obj_locked(obj);
+
+	/* increment vmap_count *before* vmap() call, so shrinker can
+	 * check vmap_count (is_vunmapable()) outside of msm_obj lock.
+	 * This guarantees that we won't try to msm_gem_vunmap() this
+	 * same object from within the vmap() call (while we already
+	 * hold msm_obj lock)
+	 */
+	msm_obj->vmap_count++;
+
+	if (!msm_obj->vaddr) {
+		msm_obj->vaddr = vmap(pages, obj->size >> PAGE_SHIFT,
+				VM_MAP, msm_gem_pgprot(msm_obj, PAGE_KERNEL));
+		if (msm_obj->vaddr == NULL) {
+			ret = -ENOMEM;
+			goto fail;
+		}
+	}
+
+	return msm_obj->vaddr;
+
+fail:
+	msm_obj->vmap_count--;
+	msm_gem_unpin_locked(obj);
+	return ERR_PTR(ret);
+}
+
+void *msm_gem_get_vaddr_locked(struct drm_gem_object *obj)
+{
+	return get_vaddr(obj, MSM_MADV_WILLNEED);
+}
+
+void *msm_gem_get_vaddr(struct drm_gem_object *obj)
+{
+	void *ret;
+
+	msm_gem_lock(obj);
+	ret = msm_gem_get_vaddr_locked(obj);
+	msm_gem_unlock(obj);
+
+	return ret;
+}
+
+/*
+ * Don't use this!  It is for the very special case of dumping
+ * submits from GPU hangs or faults, were the bo may already
+ * be MSM_MADV_DONTNEED, but we know the buffer is still on the
+ * active list.
+ */
+void *msm_gem_get_vaddr_active(struct drm_gem_object *obj)
+{
+	return get_vaddr(obj, __MSM_MADV_PURGED);
+}
+
+void msm_gem_put_vaddr_locked(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_gem_assert_locked(obj);
+	GEM_WARN_ON(msm_obj->vmap_count < 1);
+
+	msm_obj->vmap_count--;
+	msm_gem_unpin_locked(obj);
+}
+
+void msm_gem_put_vaddr(struct drm_gem_object *obj)
+{
+	msm_gem_lock(obj);
+	msm_gem_put_vaddr_locked(obj);
+	msm_gem_unlock(obj);
+}
+
+/* Update madvise status, returns true if not purged, else
+ * false or -errno.
+ */
+int msm_gem_madvise(struct drm_gem_object *obj, unsigned madv)
+{
+	struct msm_drm_private *priv = obj->dev->dev_private;
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_gem_lock(obj);
+
+	mutex_lock(&priv->lru.lock);
+
+	if (msm_obj->madv != __MSM_MADV_PURGED)
+		msm_obj->madv = madv;
+
+	madv = msm_obj->madv;
+
+	/* If the obj is inactive, we might need to move it
+	 * between inactive lists
+	 */
+	update_lru_locked(obj);
+
+	mutex_unlock(&priv->lru.lock);
+
+	msm_gem_unlock(obj);
+
+	return (madv != __MSM_MADV_PURGED);
+}
+
+void msm_gem_purge(struct drm_gem_object *obj)
+{
+	struct drm_device *dev = obj->dev;
+	struct msm_drm_private *priv = obj->dev->dev_private;
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_gem_assert_locked(obj);
+	GEM_WARN_ON(!is_purgeable(msm_obj));
+
+	/* Get rid of any iommu mapping(s): */
+	put_iova_spaces(obj, true);
+
+	msm_gem_vunmap(obj);
+
+	drm_vma_node_unmap(&obj->vma_node, dev->anon_inode->i_mapping);
+
+	put_pages(obj);
+
+	put_iova_vmas(obj);
+
+	mutex_lock(&priv->lru.lock);
+	/* A one-way transition: */
+	msm_obj->madv = __MSM_MADV_PURGED;
+	mutex_unlock(&priv->lru.lock);
+
+	drm_gem_free_mmap_offset(obj);
+
+	/* Our goal here is to return as much of the memory as
+	 * is possible back to the system as we are called from OOM.
+	 * To do this we must instruct the shmfs to drop all of its
+	 * backing pages, *now*.
+	 */
+	shmem_truncate_range(file_inode(obj->filp), 0, (loff_t)-1);
+
+	invalidate_mapping_pages(file_inode(obj->filp)->i_mapping,
+			0, (loff_t)-1);
+}
+
+/*
+ * Unpin the backing pages and make them available to be swapped out.
+ */
+void msm_gem_evict(struct drm_gem_object *obj)
+{
+	struct drm_device *dev = obj->dev;
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_gem_assert_locked(obj);
+	GEM_WARN_ON(is_unevictable(msm_obj));
+
+	/* Get rid of any iommu mapping(s): */
+	put_iova_spaces(obj, false);
+
+	drm_vma_node_unmap(&obj->vma_node, dev->anon_inode->i_mapping);
+
+	put_pages(obj);
+}
+
+void msm_gem_vunmap(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	msm_gem_assert_locked(obj);
+
+	if (!msm_obj->vaddr || GEM_WARN_ON(!is_vunmapable(msm_obj)))
+		return;
+
+	vunmap(msm_obj->vaddr);
+	msm_obj->vaddr = NULL;
+}
+
+bool msm_gem_active(struct drm_gem_object *obj)
+{
+	msm_gem_assert_locked(obj);
+
+	if (to_msm_bo(obj)->pin_count)
+		return true;
+
+	return !dma_resv_test_signaled(obj->resv, dma_resv_usage_rw(true));
+}
+
+int msm_gem_cpu_prep(struct drm_gem_object *obj, uint32_t op, ktime_t *timeout)
+{
+	bool write = !!(op & MSM_PREP_WRITE);
+	unsigned long remain =
+		op & MSM_PREP_NOSYNC ? 0 : timeout_to_jiffies(timeout);
+	long ret;
+
+	if (op & MSM_PREP_BOOST) {
+		dma_resv_set_deadline(obj->resv, dma_resv_usage_rw(write),
+				      ktime_get());
+	}
+
+	ret = dma_resv_wait_timeout(obj->resv, dma_resv_usage_rw(write),
+				    true,  remain);
+	if (ret == 0)
+		return remain == 0 ? -EBUSY : -ETIMEDOUT;
+	else if (ret < 0)
+		return ret;
+
+	/* TODO cache maintenance */
+
+	return 0;
+}
+
+int msm_gem_cpu_fini(struct drm_gem_object *obj)
+{
+	/* TODO cache maintenance */
+	return 0;
+}
+
+#ifdef CONFIG_DEBUG_FS
+void msm_gem_describe(struct drm_gem_object *obj, struct seq_file *m,
+		struct msm_gem_stats *stats)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct dma_resv *robj = obj->resv;
+	struct msm_gem_vma *vma;
+	uint64_t off = drm_vma_node_start(&obj->vma_node);
+	const char *madv;
+
+	msm_gem_lock(obj);
+
+	stats->all.count++;
+	stats->all.size += obj->size;
+
+	if (msm_gem_active(obj)) {
+		stats->active.count++;
+		stats->active.size += obj->size;
+	}
+
+	if (msm_obj->pages) {
+		stats->resident.count++;
+		stats->resident.size += obj->size;
+	}
+
+	switch (msm_obj->madv) {
+	case __MSM_MADV_PURGED:
+		stats->purged.count++;
+		stats->purged.size += obj->size;
+		madv = " purged";
+		break;
+	case MSM_MADV_DONTNEED:
+		stats->purgeable.count++;
+		stats->purgeable.size += obj->size;
+		madv = " purgeable";
+		break;
+	case MSM_MADV_WILLNEED:
+	default:
+		madv = "";
+		break;
+	}
+
+	seq_printf(m, "%08x: %c %2d (%2d) %08llx %p",
+			msm_obj->flags, msm_gem_active(obj) ? 'A' : 'I',
+			obj->name, kref_read(&obj->refcount),
+			off, msm_obj->vaddr);
+
+	seq_printf(m, " %08zu %9s %-32s\n", obj->size, madv, msm_obj->name);
+
+	if (!list_empty(&msm_obj->vmas)) {
+
+		seq_puts(m, "      vmas:");
+
+		list_for_each_entry(vma, &msm_obj->vmas, list) {
+			const char *name, *comm;
+			if (vma->aspace) {
+				struct msm_gem_address_space *aspace = vma->aspace;
+				struct task_struct *task =
+					get_pid_task(aspace->pid, PIDTYPE_PID);
+				if (task) {
+					comm = kstrdup(task->comm, GFP_KERNEL);
+					put_task_struct(task);
+				} else {
+					comm = NULL;
+				}
+				name = aspace->name;
+			} else {
+				name = comm = NULL;
+			}
+			seq_printf(m, " [%s%s%s: aspace=%p, %08llx,%s]",
+				name, comm ? ":" : "", comm ? comm : "",
+				vma->aspace, vma->iova,
+				vma->mapped ? "mapped" : "unmapped");
+			kfree(comm);
+		}
+
+		seq_puts(m, "\n");
+	}
+
+	dma_resv_describe(robj, m);
+	msm_gem_unlock(obj);
+}
+
+void msm_gem_describe_objects(struct list_head *list, struct seq_file *m)
+{
+	struct msm_gem_stats stats = {};
+	struct msm_gem_object *msm_obj;
+
+	seq_puts(m, "   flags       id ref  offset   kaddr            size     madv      name\n");
+	list_for_each_entry(msm_obj, list, node) {
+		struct drm_gem_object *obj = &msm_obj->base;
+		seq_puts(m, "   ");
+		msm_gem_describe(obj, m, &stats);
+	}
+
+	seq_printf(m, "Total:     %4d objects, %9zu bytes\n",
+			stats.all.count, stats.all.size);
+	seq_printf(m, "Active:    %4d objects, %9zu bytes\n",
+			stats.active.count, stats.active.size);
+	seq_printf(m, "Resident:  %4d objects, %9zu bytes\n",
+			stats.resident.count, stats.resident.size);
+	seq_printf(m, "Purgeable: %4d objects, %9zu bytes\n",
+			stats.purgeable.count, stats.purgeable.size);
+	seq_printf(m, "Purged:    %4d objects, %9zu bytes\n",
+			stats.purged.count, stats.purged.size);
+}
+#endif
+
+/* don't call directly!  Use drm_gem_object_put() */
+static void msm_gem_free_object(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	struct drm_device *dev = obj->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+
+	mutex_lock(&priv->obj_lock);
+	list_del(&msm_obj->node);
+	mutex_unlock(&priv->obj_lock);
+
+	put_iova_spaces(obj, true);
+
+	if (obj->import_attach) {
+		GEM_WARN_ON(msm_obj->vaddr);
+
+		/* Don't drop the pages for imported dmabuf, as they are not
+		 * ours, just free the array we allocated:
+		 */
+		kvfree(msm_obj->pages);
+
+		put_iova_vmas(obj);
+
+		drm_prime_gem_destroy(obj, msm_obj->sgt);
+	} else {
+		msm_gem_vunmap(obj);
+		put_pages(obj);
+		put_iova_vmas(obj);
+	}
+
+	drm_gem_object_release(obj);
+
+	kfree(msm_obj->metadata);
+	kfree(msm_obj);
+}
+
+static int msm_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+	vm_flags_set(vma, VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);
+	vma->vm_page_prot = msm_gem_pgprot(msm_obj, vm_get_page_prot(vma->vm_flags));
+
+	return 0;
+}
+
+/* convenience method to construct a GEM buffer object, and userspace handle */
+int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
+		uint32_t size, uint32_t flags, uint32_t *handle,
+		char *name)
+{
+	struct drm_gem_object *obj;
+	int ret;
+
+	obj = msm_gem_new(dev, size, flags);
+
+	if (IS_ERR(obj))
+		return PTR_ERR(obj);
+
+	if (name)
+		msm_gem_object_set_name(obj, "%s", name);
+
+	ret = drm_gem_handle_create(file, obj, handle);
+
+	/* drop reference from allocate - handle holds it now */
+	drm_gem_object_put(obj);
+
+	return ret;
+}
+
+static enum drm_gem_object_status msm_gem_status(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	enum drm_gem_object_status status = 0;
+
+	if (msm_obj->pages)
+		status |= DRM_GEM_OBJECT_RESIDENT;
+
+	if (msm_obj->madv == MSM_MADV_DONTNEED)
+		status |= DRM_GEM_OBJECT_PURGEABLE;
+
+	return status;
+}
+
+static const struct vm_operations_struct vm_ops = {
+	.fault = msm_gem_fault,
+	.open = drm_gem_vm_open,
+	.close = drm_gem_vm_close,
+};
+
+static const struct drm_gem_object_funcs msm_gem_object_funcs = {
+	.free = msm_gem_free_object,
+	.pin = msm_gem_prime_pin,
+	.unpin = msm_gem_prime_unpin,
+	.get_sg_table = msm_gem_prime_get_sg_table,
+	.vmap = msm_gem_prime_vmap,
+	.vunmap = msm_gem_prime_vunmap,
+	.mmap = msm_gem_object_mmap,
+	.status = msm_gem_status,
+	.vm_ops = &vm_ops,
+};
+
+static int msm_gem_new_impl(struct drm_device *dev,
+		uint32_t size, uint32_t flags,
+		struct drm_gem_object **obj)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_gem_object *msm_obj;
+
+	switch (flags & MSM_BO_CACHE_MASK) {
+	case MSM_BO_CACHED:
+	case MSM_BO_WC:
+		break;
+	case MSM_BO_CACHED_COHERENT:
+		if (priv->has_cached_coherent)
+			break;
+		fallthrough;
+	default:
+		DRM_DEV_DEBUG(dev->dev, "invalid cache flag: %x\n",
+				(flags & MSM_BO_CACHE_MASK));
+		return -EINVAL;
+	}
+
+	msm_obj = kzalloc(sizeof(*msm_obj), GFP_KERNEL);
+	if (!msm_obj)
+		return -ENOMEM;
+
+	msm_obj->flags = flags;
+	msm_obj->madv = MSM_MADV_WILLNEED;
+
+	INIT_LIST_HEAD(&msm_obj->node);
+	INIT_LIST_HEAD(&msm_obj->vmas);
+
+	*obj = &msm_obj->base;
+	(*obj)->funcs = &msm_gem_object_funcs;
+
+	return 0;
+}
+
+struct drm_gem_object *msm_gem_new(struct drm_device *dev, uint32_t size, uint32_t flags)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_gem_object *msm_obj;
+	struct drm_gem_object *obj = NULL;
+	bool use_vram = false;
+	int ret;
+
+	size = PAGE_ALIGN(size);
+
+	if (!msm_use_mmu(dev))
+		use_vram = true;
+	else if ((flags & (MSM_BO_STOLEN | MSM_BO_SCANOUT)) && priv->vram.size)
+		use_vram = true;
+
+	if (GEM_WARN_ON(use_vram && !priv->vram.size))
+		return ERR_PTR(-EINVAL);
+
+	/* Disallow zero sized objects as they make the underlying
+	 * infrastructure grumpy
+	 */
+	if (size == 0)
+		return ERR_PTR(-EINVAL);
+
+	ret = msm_gem_new_impl(dev, size, flags, &obj);
+	if (ret)
+		return ERR_PTR(ret);
+
+	msm_obj = to_msm_bo(obj);
+
+	if (use_vram) {
+		struct msm_gem_vma *vma;
+		struct page **pages;
+
+		drm_gem_private_object_init(dev, obj, size);
+
+		msm_gem_lock(obj);
+
+		vma = add_vma(obj, NULL);
+		msm_gem_unlock(obj);
+		if (IS_ERR(vma)) {
+			ret = PTR_ERR(vma);
+			goto fail;
+		}
+
+		to_msm_bo(obj)->vram_node = &vma->node;
+
+		msm_gem_lock(obj);
+		pages = get_pages(obj);
+		msm_gem_unlock(obj);
+		if (IS_ERR(pages)) {
+			ret = PTR_ERR(pages);
+			goto fail;
+		}
+
+		vma->iova = physaddr(obj);
+	} else {
+		ret = drm_gem_object_init(dev, obj, size);
+		if (ret)
+			goto fail;
+		/*
+		 * Our buffers are kept pinned, so allocating them from the
+		 * MOVABLE zone is a really bad idea, and conflicts with CMA.
+		 * See comments above new_inode() why this is required _and_
+		 * expected if you're going to pin these pages.
+		 */
+		mapping_set_gfp_mask(obj->filp->f_mapping, GFP_HIGHUSER);
+	}
+
+	drm_gem_lru_move_tail(&priv->lru.unbacked, obj);
+
+	mutex_lock(&priv->obj_lock);
+	list_add_tail(&msm_obj->node, &priv->objects);
+	mutex_unlock(&priv->obj_lock);
+
+	ret = drm_gem_create_mmap_offset(obj);
+	if (ret)
+		goto fail;
+
+	return obj;
+
+fail:
+	drm_gem_object_put(obj);
+	return ERR_PTR(ret);
+}
+
+struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+		struct dma_buf *dmabuf, struct sg_table *sgt)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_gem_object *msm_obj;
+	struct drm_gem_object *obj;
+	uint32_t size;
+	int ret, npages;
+
+	/* if we don't have IOMMU, don't bother pretending we can import: */
+	if (!msm_use_mmu(dev)) {
+		DRM_DEV_ERROR(dev->dev, "cannot import without IOMMU\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	size = PAGE_ALIGN(dmabuf->size);
+
+	ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj);
+	if (ret)
+		return ERR_PTR(ret);
+
+	drm_gem_private_object_init(dev, obj, size);
+
+	npages = size / PAGE_SIZE;
+
+	msm_obj = to_msm_bo(obj);
+	msm_gem_lock(obj);
+	msm_obj->sgt = sgt;
+	msm_obj->pages = kvmalloc_array(npages, sizeof(struct page *), GFP_KERNEL);
+	if (!msm_obj->pages) {
+		msm_gem_unlock(obj);
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	ret = drm_prime_sg_to_page_array(sgt, msm_obj->pages, npages);
+	if (ret) {
+		msm_gem_unlock(obj);
+		goto fail;
+	}
+
+	msm_gem_unlock(obj);
+
+	drm_gem_lru_move_tail(&priv->lru.pinned, obj);
+
+	mutex_lock(&priv->obj_lock);
+	list_add_tail(&msm_obj->node, &priv->objects);
+	mutex_unlock(&priv->obj_lock);
+
+	ret = drm_gem_create_mmap_offset(obj);
+	if (ret)
+		goto fail;
+
+	return obj;
+
+fail:
+	drm_gem_object_put(obj);
+	return ERR_PTR(ret);
+}
+
+void *msm_gem_kernel_new(struct drm_device *dev, uint32_t size,
+		uint32_t flags, struct msm_gem_address_space *aspace,
+		struct drm_gem_object **bo, uint64_t *iova)
+{
+	void *vaddr;
+	struct drm_gem_object *obj = msm_gem_new(dev, size, flags);
+	int ret;
+
+	if (IS_ERR(obj))
+		return ERR_CAST(obj);
+
+	if (iova) {
+		ret = msm_gem_get_and_pin_iova(obj, aspace, iova);
+		if (ret)
+			goto err;
+	}
+
+	vaddr = msm_gem_get_vaddr(obj);
+	if (IS_ERR(vaddr)) {
+		msm_gem_unpin_iova(obj, aspace);
+		ret = PTR_ERR(vaddr);
+		goto err;
+	}
+
+	if (bo)
+		*bo = obj;
+
+	return vaddr;
+err:
+	drm_gem_object_put(obj);
+
+	return ERR_PTR(ret);
+
+}
+
+void msm_gem_kernel_put(struct drm_gem_object *bo,
+		struct msm_gem_address_space *aspace)
+{
+	if (IS_ERR_OR_NULL(bo))
+		return;
+
+	msm_gem_put_vaddr(bo);
+	msm_gem_unpin_iova(bo, aspace);
+	drm_gem_object_put(bo);
+}
+
+void msm_gem_object_set_name(struct drm_gem_object *bo, const char *fmt, ...)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(bo);
+	va_list ap;
+
+	if (!fmt)
+		return;
+
+	va_start(ap, fmt);
+	vsnprintf(msm_obj->name, sizeof(msm_obj->name), fmt, ap);
+	va_end(ap);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gem.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gem.h
@@ -0,0 +1,333 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MSM_GEM_H__
+#define __MSM_GEM_H__
+
+#include <linux/kref.h>
+#include <linux/dma-resv.h>
+#include "drm/drm_exec.h"
+#include "drm/gpu_scheduler.h"
+#include "msm_drv.h"
+
+/* Make all GEM related WARN_ON()s ratelimited.. when things go wrong they
+ * tend to go wrong 1000s of times in a short timespan.
+ */
+#define GEM_WARN_ON(x)  WARN_RATELIMIT(x, "%s", __stringify(x))
+
+/* Additional internal-use only BO flags: */
+#define MSM_BO_STOLEN        0x10000000    /* try to use stolen/splash memory */
+#define MSM_BO_MAP_PRIV      0x20000000    /* use IOMMU_PRIV when mapping */
+
+struct msm_gem_address_space {
+	const char *name;
+	/* NOTE: mm managed at the page level, size is in # of pages
+	 * and position mm_node->start is in # of pages:
+	 */
+	struct drm_mm mm;
+	spinlock_t lock; /* Protects drm_mm node allocation/removal */
+	struct msm_mmu *mmu;
+	struct kref kref;
+
+	/* For address spaces associated with a specific process, this
+	 * will be non-NULL:
+	 */
+	struct pid *pid;
+
+	/* @faults: the number of GPU hangs associated with this address space */
+	int faults;
+
+	/** @va_start: lowest possible address to allocate */
+	uint64_t va_start;
+
+	/** @va_size: the size of the address space (in bytes) */
+	uint64_t va_size;
+};
+
+struct msm_gem_address_space *
+msm_gem_address_space_get(struct msm_gem_address_space *aspace);
+
+void msm_gem_address_space_put(struct msm_gem_address_space *aspace);
+
+struct msm_gem_address_space *
+msm_gem_address_space_create(struct msm_mmu *mmu, const char *name,
+		u64 va_start, u64 size);
+
+struct msm_fence_context;
+
+struct msm_gem_vma {
+	struct drm_mm_node node;
+	uint64_t iova;
+	struct msm_gem_address_space *aspace;
+	struct list_head list;    /* node in msm_gem_object::vmas */
+	bool mapped;
+};
+
+struct msm_gem_vma *msm_gem_vma_new(struct msm_gem_address_space *aspace);
+int msm_gem_vma_init(struct msm_gem_vma *vma, int size,
+		u64 range_start, u64 range_end);
+void msm_gem_vma_purge(struct msm_gem_vma *vma);
+int msm_gem_vma_map(struct msm_gem_vma *vma, int prot, struct sg_table *sgt, int size);
+void msm_gem_vma_close(struct msm_gem_vma *vma);
+
+struct msm_gem_object {
+	struct drm_gem_object base;
+
+	uint32_t flags;
+
+	/**
+	 * madv: are the backing pages purgeable?
+	 *
+	 * Protected by obj lock and LRU lock
+	 */
+	uint8_t madv;
+
+	/**
+	 * count of active vmap'ing
+	 */
+	uint8_t vmap_count;
+
+	/**
+	 * Node in list of all objects (mainly for debugfs, protected by
+	 * priv->obj_lock
+	 */
+	struct list_head node;
+
+	struct page **pages;
+	struct sg_table *sgt;
+	void *vaddr;
+
+	struct list_head vmas;    /* list of msm_gem_vma */
+
+	/* For physically contiguous buffers.  Used when we don't have
+	 * an IOMMU.  Also used for stolen/splashscreen buffer.
+	 */
+	struct drm_mm_node *vram_node;
+
+	char name[32]; /* Identifier to print for the debugfs files */
+
+	/* userspace metadata backchannel */
+	void *metadata;
+	u32 metadata_size;
+
+	/**
+	 * pin_count: Number of times the pages are pinned
+	 *
+	 * Protected by LRU lock.
+	 */
+	int pin_count;
+};
+#define to_msm_bo(x) container_of(x, struct msm_gem_object, base)
+
+uint64_t msm_gem_mmap_offset(struct drm_gem_object *obj);
+int msm_gem_pin_vma_locked(struct drm_gem_object *obj, struct msm_gem_vma *vma);
+void msm_gem_unpin_locked(struct drm_gem_object *obj);
+void msm_gem_unpin_active(struct drm_gem_object *obj);
+struct msm_gem_vma *msm_gem_get_vma_locked(struct drm_gem_object *obj,
+					   struct msm_gem_address_space *aspace);
+int msm_gem_get_iova(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace, uint64_t *iova);
+int msm_gem_set_iova(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace, uint64_t iova);
+int msm_gem_get_and_pin_iova_range(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace, uint64_t *iova,
+		u64 range_start, u64 range_end);
+int msm_gem_get_and_pin_iova(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace, uint64_t *iova);
+void msm_gem_unpin_iova(struct drm_gem_object *obj,
+		struct msm_gem_address_space *aspace);
+void msm_gem_pin_obj_locked(struct drm_gem_object *obj);
+struct page **msm_gem_pin_pages(struct drm_gem_object *obj);
+void msm_gem_unpin_pages(struct drm_gem_object *obj);
+int msm_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
+		struct drm_mode_create_dumb *args);
+int msm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev,
+		uint32_t handle, uint64_t *offset);
+void *msm_gem_get_vaddr_locked(struct drm_gem_object *obj);
+void *msm_gem_get_vaddr(struct drm_gem_object *obj);
+void *msm_gem_get_vaddr_active(struct drm_gem_object *obj);
+void msm_gem_put_vaddr_locked(struct drm_gem_object *obj);
+void msm_gem_put_vaddr(struct drm_gem_object *obj);
+int msm_gem_madvise(struct drm_gem_object *obj, unsigned madv);
+bool msm_gem_active(struct drm_gem_object *obj);
+int msm_gem_cpu_prep(struct drm_gem_object *obj, uint32_t op, ktime_t *timeout);
+int msm_gem_cpu_fini(struct drm_gem_object *obj);
+int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
+		uint32_t size, uint32_t flags, uint32_t *handle, char *name);
+struct drm_gem_object *msm_gem_new(struct drm_device *dev,
+		uint32_t size, uint32_t flags);
+void *msm_gem_kernel_new(struct drm_device *dev, uint32_t size,
+		uint32_t flags, struct msm_gem_address_space *aspace,
+		struct drm_gem_object **bo, uint64_t *iova);
+void msm_gem_kernel_put(struct drm_gem_object *bo,
+		struct msm_gem_address_space *aspace);
+struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+		struct dma_buf *dmabuf, struct sg_table *sgt);
+__printf(2, 3)
+void msm_gem_object_set_name(struct drm_gem_object *bo, const char *fmt, ...);
+
+#ifdef CONFIG_DEBUG_FS
+struct msm_gem_stats {
+	struct {
+		unsigned count;
+		size_t size;
+	} all, active, resident, purgeable, purged;
+};
+
+void msm_gem_describe(struct drm_gem_object *obj, struct seq_file *m,
+		struct msm_gem_stats *stats);
+void msm_gem_describe_objects(struct list_head *list, struct seq_file *m);
+#endif
+
+static inline void
+msm_gem_lock(struct drm_gem_object *obj)
+{
+	dma_resv_lock(obj->resv, NULL);
+}
+
+static inline int
+msm_gem_lock_interruptible(struct drm_gem_object *obj)
+{
+	return dma_resv_lock_interruptible(obj->resv, NULL);
+}
+
+static inline void
+msm_gem_unlock(struct drm_gem_object *obj)
+{
+	dma_resv_unlock(obj->resv);
+}
+
+static inline void
+msm_gem_assert_locked(struct drm_gem_object *obj)
+{
+	/*
+	 * Destroying the object is a special case.. msm_gem_free_object()
+	 * calls many things that WARN_ON if the obj lock is not held.  But
+	 * acquiring the obj lock in msm_gem_free_object() can cause a
+	 * locking order inversion between reservation_ww_class_mutex and
+	 * fs_reclaim.
+	 *
+	 * This deadlock is not actually possible, because no one should
+	 * be already holding the lock when msm_gem_free_object() is called.
+	 * Unfortunately lockdep is not aware of this detail.  So when the
+	 * refcount drops to zero, we pretend it is already locked.
+	 */
+	lockdep_assert_once(
+		(kref_read(&obj->refcount) == 0) ||
+		(lockdep_is_held(&obj->resv->lock.base) != LOCK_STATE_NOT_HELD)
+	);
+}
+
+/* imported/exported objects are not purgeable: */
+static inline bool is_unpurgeable(struct msm_gem_object *msm_obj)
+{
+	return msm_obj->base.import_attach || msm_obj->pin_count;
+}
+
+static inline bool is_purgeable(struct msm_gem_object *msm_obj)
+{
+	return (msm_obj->madv == MSM_MADV_DONTNEED) && msm_obj->sgt &&
+			!is_unpurgeable(msm_obj);
+}
+
+static inline bool is_vunmapable(struct msm_gem_object *msm_obj)
+{
+	msm_gem_assert_locked(&msm_obj->base);
+	return (msm_obj->vmap_count == 0) && msm_obj->vaddr;
+}
+
+static inline bool is_unevictable(struct msm_gem_object *msm_obj)
+{
+	return is_unpurgeable(msm_obj) || msm_obj->vaddr;
+}
+
+void msm_gem_purge(struct drm_gem_object *obj);
+void msm_gem_evict(struct drm_gem_object *obj);
+void msm_gem_vunmap(struct drm_gem_object *obj);
+
+/* Created per submit-ioctl, to track bo's and cmdstream bufs, etc,
+ * associated with the cmdstream submission for synchronization (and
+ * make it easier to unwind when things go wrong, etc).
+ */
+struct msm_gem_submit {
+	struct drm_sched_job base;
+	struct kref ref;
+	struct drm_device *dev;
+	struct msm_gpu *gpu;
+	struct msm_gem_address_space *aspace;
+	struct list_head node;   /* node in ring submit list */
+	struct drm_exec exec;
+	uint32_t seqno;		/* Sequence number of the submit on the ring */
+
+	/* Hw fence, which is created when the scheduler executes the job, and
+	 * is signaled when the hw finishes (via seqno write from cmdstream)
+	 */
+	struct dma_fence *hw_fence;
+
+	/* Userspace visible fence, which is signaled by the scheduler after
+	 * the hw_fence is signaled.
+	 */
+	struct dma_fence *user_fence;
+
+	int fence_id;       /* key into queue->fence_idr */
+	struct msm_gpu_submitqueue *queue;
+	struct pid *pid;    /* submitting process */
+	bool bos_pinned : 1;
+	bool fault_dumped:1;/* Limit devcoredump dumping to one per submit */
+	bool in_rb : 1;     /* "sudo" mode, copy cmds into RB */
+	struct msm_ringbuffer *ring;
+	unsigned int nr_cmds;
+	unsigned int nr_bos;
+	u32 ident;	   /* A "identifier" for the submit for logging */
+	struct {
+		uint32_t type;
+		uint32_t size;  /* in dwords */
+		uint64_t iova;
+		uint32_t offset;/* in dwords */
+		uint32_t idx;   /* cmdstream buffer idx in bos[] */
+		uint32_t nr_relocs;
+		struct drm_msm_gem_submit_reloc *relocs;
+	} *cmd;  /* array of size nr_cmds */
+	struct {
+		uint32_t flags;
+		union {
+			struct drm_gem_object *obj;
+			uint32_t handle;
+		};
+		uint64_t iova;
+	} bos[];
+};
+
+static inline struct msm_gem_submit *to_msm_submit(struct drm_sched_job *job)
+{
+	return container_of(job, struct msm_gem_submit, base);
+}
+
+void __msm_gem_submit_destroy(struct kref *kref);
+
+static inline void msm_gem_submit_get(struct msm_gem_submit *submit)
+{
+	kref_get(&submit->ref);
+}
+
+static inline void msm_gem_submit_put(struct msm_gem_submit *submit)
+{
+	kref_put(&submit->ref, __msm_gem_submit_destroy);
+}
+
+void msm_submit_retire(struct msm_gem_submit *submit);
+
+/* helper to determine of a buffer in submit should be dumped, used for both
+ * devcoredump and debugfs cmdstream dumping:
+ */
+static inline bool
+should_dump(struct msm_gem_submit *submit, int idx)
+{
+	extern bool rd_full;
+	return rd_full || (submit->bos[idx].flags & MSM_SUBMIT_BO_DUMP);
+}
+
+#endif /* __MSM_GEM_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gem_prime.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gem_prime.c
@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/dma-buf.h>
+
+#include <drm/drm_prime.h>
+
+#include "msm_drv.h"
+#include "msm_gem.h"
+
+struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj)
+{
+	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+	int npages = obj->size >> PAGE_SHIFT;
+
+	if (WARN_ON(!msm_obj->pages))  /* should have already pinned! */
+		return ERR_PTR(-ENOMEM);
+
+	return drm_prime_pages_to_sg(obj->dev, msm_obj->pages, npages);
+}
+
+int msm_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map)
+{
+	void *vaddr;
+
+	vaddr = msm_gem_get_vaddr_locked(obj);
+	if (IS_ERR(vaddr))
+		return PTR_ERR(vaddr);
+	iosys_map_set_vaddr(map, vaddr);
+
+	return 0;
+}
+
+void msm_gem_prime_vunmap(struct drm_gem_object *obj, struct iosys_map *map)
+{
+	msm_gem_put_vaddr_locked(obj);
+}
+
+struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev,
+		struct dma_buf_attachment *attach, struct sg_table *sg)
+{
+	return msm_gem_import(dev, attach->dmabuf, sg);
+}
+
+int msm_gem_prime_pin(struct drm_gem_object *obj)
+{
+	if (!obj->import_attach)
+		msm_gem_pin_pages(obj);
+	return 0;
+}
+
+void msm_gem_prime_unpin(struct drm_gem_object *obj)
+{
+	if (!obj->import_attach)
+		msm_gem_unpin_pages(obj);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gem_shrinker.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gem_shrinker.c
@@ -0,0 +1,246 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2016 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/vmalloc.h>
+#include <linux/sched/mm.h>
+
+#include "msm_drv.h"
+#include "msm_gem.h"
+#include "msm_gpu.h"
+#include "msm_gpu_trace.h"
+
+/* Default disabled for now until it has some more testing on the different
+ * iommu combinations that can be paired with the driver:
+ */
+static bool enable_eviction = true;
+MODULE_PARM_DESC(enable_eviction, "Enable swappable GEM buffers");
+module_param(enable_eviction, bool, 0600);
+
+static bool can_swap(void)
+{
+	return enable_eviction && get_nr_swap_pages() > 0;
+}
+
+static bool can_block(struct shrink_control *sc)
+{
+	if (!(sc->gfp_mask & __GFP_DIRECT_RECLAIM))
+		return false;
+	return current_is_kswapd() || (sc->gfp_mask & __GFP_RECLAIM);
+}
+
+static unsigned long
+msm_gem_shrinker_count(struct shrinker *shrinker, struct shrink_control *sc)
+{
+	struct msm_drm_private *priv = shrinker->private_data;
+	unsigned count = priv->lru.dontneed.count;
+
+	if (can_swap())
+		count += priv->lru.willneed.count;
+
+	return count;
+}
+
+static bool
+purge(struct drm_gem_object *obj)
+{
+	if (!is_purgeable(to_msm_bo(obj)))
+		return false;
+
+	if (msm_gem_active(obj))
+		return false;
+
+	msm_gem_purge(obj);
+
+	return true;
+}
+
+static bool
+evict(struct drm_gem_object *obj)
+{
+	if (is_unevictable(to_msm_bo(obj)))
+		return false;
+
+	if (msm_gem_active(obj))
+		return false;
+
+	msm_gem_evict(obj);
+
+	return true;
+}
+
+static bool
+wait_for_idle(struct drm_gem_object *obj)
+{
+	enum dma_resv_usage usage = dma_resv_usage_rw(true);
+	return dma_resv_wait_timeout(obj->resv, usage, false, 10) > 0;
+}
+
+static bool
+active_purge(struct drm_gem_object *obj)
+{
+	if (!wait_for_idle(obj))
+		return false;
+
+	return purge(obj);
+}
+
+static bool
+active_evict(struct drm_gem_object *obj)
+{
+	if (!wait_for_idle(obj))
+		return false;
+
+	return evict(obj);
+}
+
+static unsigned long
+msm_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc)
+{
+	struct msm_drm_private *priv = shrinker->private_data;
+	struct {
+		struct drm_gem_lru *lru;
+		bool (*shrink)(struct drm_gem_object *obj);
+		bool cond;
+		unsigned long freed;
+		unsigned long remaining;
+	} stages[] = {
+		/* Stages of progressively more aggressive/expensive reclaim: */
+		{ &priv->lru.dontneed, purge,        true },
+		{ &priv->lru.willneed, evict,        can_swap() },
+		{ &priv->lru.dontneed, active_purge, can_block(sc) },
+		{ &priv->lru.willneed, active_evict, can_swap() && can_block(sc) },
+	};
+	long nr = sc->nr_to_scan;
+	unsigned long freed = 0;
+	unsigned long remaining = 0;
+
+	for (unsigned i = 0; (nr > 0) && (i < ARRAY_SIZE(stages)); i++) {
+		if (!stages[i].cond)
+			continue;
+		stages[i].freed =
+			drm_gem_lru_scan(stages[i].lru, nr,
+					&stages[i].remaining,
+					 stages[i].shrink);
+		nr -= stages[i].freed;
+		freed += stages[i].freed;
+		remaining += stages[i].remaining;
+	}
+
+	if (freed) {
+		trace_msm_gem_shrink(sc->nr_to_scan, stages[0].freed,
+				     stages[1].freed, stages[2].freed,
+				     stages[3].freed);
+	}
+
+	return (freed > 0 && remaining > 0) ? freed : SHRINK_STOP;
+}
+
+#ifdef CONFIG_DEBUG_FS
+unsigned long
+msm_gem_shrinker_shrink(struct drm_device *dev, unsigned long nr_to_scan)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct shrink_control sc = {
+		.nr_to_scan = nr_to_scan,
+	};
+	unsigned long ret = SHRINK_STOP;
+
+	fs_reclaim_acquire(GFP_KERNEL);
+	if (priv->shrinker)
+		ret = msm_gem_shrinker_scan(priv->shrinker, &sc);
+	fs_reclaim_release(GFP_KERNEL);
+
+	return ret;
+}
+#endif
+
+/* since we don't know any better, lets bail after a few
+ * and if necessary the shrinker will be invoked again.
+ * Seems better than unmapping *everything*
+ */
+static const int vmap_shrink_limit = 15;
+
+static bool
+vmap_shrink(struct drm_gem_object *obj)
+{
+	if (!is_vunmapable(to_msm_bo(obj)))
+		return false;
+
+	msm_gem_vunmap(obj);
+
+	return true;
+}
+
+static int
+msm_gem_shrinker_vmap(struct notifier_block *nb, unsigned long event, void *ptr)
+{
+	struct msm_drm_private *priv =
+		container_of(nb, struct msm_drm_private, vmap_notifier);
+	struct drm_gem_lru *lrus[] = {
+		&priv->lru.dontneed,
+		&priv->lru.willneed,
+		&priv->lru.pinned,
+		NULL,
+	};
+	unsigned idx, unmapped = 0;
+	unsigned long remaining = 0;
+
+	for (idx = 0; lrus[idx] && unmapped < vmap_shrink_limit; idx++) {
+		unmapped += drm_gem_lru_scan(lrus[idx],
+					     vmap_shrink_limit - unmapped,
+					     &remaining,
+					     vmap_shrink);
+	}
+
+	*(unsigned long *)ptr += unmapped;
+
+	if (unmapped > 0)
+		trace_msm_gem_purge_vmaps(unmapped);
+
+	return NOTIFY_DONE;
+}
+
+/**
+ * msm_gem_shrinker_init - Initialize msm shrinker
+ * @dev: drm device
+ *
+ * This function registers and sets up the msm shrinker.
+ */
+int msm_gem_shrinker_init(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+
+	priv->shrinker = shrinker_alloc(0, "drm-msm_gem");
+	if (!priv->shrinker)
+		return -ENOMEM;
+
+	priv->shrinker->count_objects = msm_gem_shrinker_count;
+	priv->shrinker->scan_objects = msm_gem_shrinker_scan;
+	priv->shrinker->private_data = priv;
+
+	shrinker_register(priv->shrinker);
+
+	priv->vmap_notifier.notifier_call = msm_gem_shrinker_vmap;
+	WARN_ON(register_vmap_purge_notifier(&priv->vmap_notifier));
+
+	return 0;
+}
+
+/**
+ * msm_gem_shrinker_cleanup - Clean up msm shrinker
+ * @dev: drm device
+ *
+ * This function unregisters the msm shrinker.
+ */
+void msm_gem_shrinker_cleanup(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+
+	if (priv->shrinker) {
+		WARN_ON(unregister_vmap_purge_notifier(&priv->vmap_notifier));
+		shrinker_free(priv->shrinker);
+	}
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gem_submit.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gem_submit.c
@@ -0,0 +1,935 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/file.h>
+#include <linux/sync_file.h>
+#include <linux/uaccess.h>
+
+#include <drm/drm_drv.h>
+#include <drm/drm_file.h>
+#include <drm/drm_syncobj.h>
+
+#include "msm_drv.h"
+#include "msm_gpu.h"
+#include "msm_gem.h"
+#include "msm_gpu_trace.h"
+
+/* For userspace errors, use DRM_UT_DRIVER.. so that userspace can enable
+ * error msgs for debugging, but we don't spam dmesg by default
+ */
+#define SUBMIT_ERROR(submit, fmt, ...) \
+	DRM_DEV_DEBUG_DRIVER((submit)->dev->dev, fmt, ##__VA_ARGS__)
+
+/*
+ * Cmdstream submission:
+ */
+
+static struct msm_gem_submit *submit_create(struct drm_device *dev,
+		struct msm_gpu *gpu,
+		struct msm_gpu_submitqueue *queue, uint32_t nr_bos,
+		uint32_t nr_cmds)
+{
+	static atomic_t ident = ATOMIC_INIT(0);
+	struct msm_gem_submit *submit;
+	uint64_t sz;
+	int ret;
+
+	sz = struct_size(submit, bos, nr_bos) +
+			((u64)nr_cmds * sizeof(submit->cmd[0]));
+
+	if (sz > SIZE_MAX)
+		return ERR_PTR(-ENOMEM);
+
+	submit = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN);
+	if (!submit)
+		return ERR_PTR(-ENOMEM);
+
+	submit->hw_fence = msm_fence_alloc();
+	if (IS_ERR(submit->hw_fence)) {
+		ret = PTR_ERR(submit->hw_fence);
+		kfree(submit);
+		return ERR_PTR(ret);
+	}
+
+	ret = drm_sched_job_init(&submit->base, queue->entity, 1, queue);
+	if (ret) {
+		kfree(submit->hw_fence);
+		kfree(submit);
+		return ERR_PTR(ret);
+	}
+
+	kref_init(&submit->ref);
+	submit->dev = dev;
+	submit->aspace = queue->ctx->aspace;
+	submit->gpu = gpu;
+	submit->cmd = (void *)&submit->bos[nr_bos];
+	submit->queue = queue;
+	submit->pid = get_pid(task_pid(current));
+	submit->ring = gpu->rb[queue->ring_nr];
+	submit->fault_dumped = false;
+
+	/* Get a unique identifier for the submission for logging purposes */
+	submit->ident = atomic_inc_return(&ident) - 1;
+
+	INIT_LIST_HEAD(&submit->node);
+
+	return submit;
+}
+
+void __msm_gem_submit_destroy(struct kref *kref)
+{
+	struct msm_gem_submit *submit =
+			container_of(kref, struct msm_gem_submit, ref);
+	unsigned i;
+
+	if (submit->fence_id) {
+		spin_lock(&submit->queue->idr_lock);
+		idr_remove(&submit->queue->fence_idr, submit->fence_id);
+		spin_unlock(&submit->queue->idr_lock);
+	}
+
+	dma_fence_put(submit->user_fence);
+
+	/*
+	 * If the submit is freed before msm_job_run(), then hw_fence is
+	 * just some pre-allocated memory, not a reference counted fence.
+	 * Once the job runs and the hw_fence is initialized, it will
+	 * have a refcount of at least one, since the submit holds a ref
+	 * to the hw_fence.
+	 */
+	if (kref_read(&submit->hw_fence->refcount) == 0) {
+		kfree(submit->hw_fence);
+	} else {
+		dma_fence_put(submit->hw_fence);
+	}
+
+	put_pid(submit->pid);
+	msm_submitqueue_put(submit->queue);
+
+	for (i = 0; i < submit->nr_cmds; i++)
+		kfree(submit->cmd[i].relocs);
+
+	kfree(submit);
+}
+
+static int submit_lookup_objects(struct msm_gem_submit *submit,
+		struct drm_msm_gem_submit *args, struct drm_file *file)
+{
+	unsigned i;
+	int ret = 0;
+
+	for (i = 0; i < args->nr_bos; i++) {
+		struct drm_msm_gem_submit_bo submit_bo;
+		void __user *userptr =
+			u64_to_user_ptr(args->bos + (i * sizeof(submit_bo)));
+
+		/* make sure we don't have garbage flags, in case we hit
+		 * error path before flags is initialized:
+		 */
+		submit->bos[i].flags = 0;
+
+		if (copy_from_user(&submit_bo, userptr, sizeof(submit_bo))) {
+			ret = -EFAULT;
+			i = 0;
+			goto out;
+		}
+
+/* at least one of READ and/or WRITE flags should be set: */
+#define MANDATORY_FLAGS (MSM_SUBMIT_BO_READ | MSM_SUBMIT_BO_WRITE)
+
+		if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) ||
+			!(submit_bo.flags & MANDATORY_FLAGS)) {
+			SUBMIT_ERROR(submit, "invalid flags: %x\n", submit_bo.flags);
+			ret = -EINVAL;
+			i = 0;
+			goto out;
+		}
+
+		submit->bos[i].handle = submit_bo.handle;
+		submit->bos[i].flags = submit_bo.flags;
+	}
+
+	spin_lock(&file->table_lock);
+
+	for (i = 0; i < args->nr_bos; i++) {
+		struct drm_gem_object *obj;
+
+		/* normally use drm_gem_object_lookup(), but for bulk lookup
+		 * all under single table_lock just hit object_idr directly:
+		 */
+		obj = idr_find(&file->object_idr, submit->bos[i].handle);
+		if (!obj) {
+			SUBMIT_ERROR(submit, "invalid handle %u at index %u\n", submit->bos[i].handle, i);
+			ret = -EINVAL;
+			goto out_unlock;
+		}
+
+		drm_gem_object_get(obj);
+
+		submit->bos[i].obj = obj;
+	}
+
+out_unlock:
+	spin_unlock(&file->table_lock);
+
+out:
+	submit->nr_bos = i;
+
+	return ret;
+}
+
+static int submit_lookup_cmds(struct msm_gem_submit *submit,
+		struct drm_msm_gem_submit *args, struct drm_file *file)
+{
+	unsigned i;
+	size_t sz;
+	int ret = 0;
+
+	for (i = 0; i < args->nr_cmds; i++) {
+		struct drm_msm_gem_submit_cmd submit_cmd;
+		void __user *userptr =
+			u64_to_user_ptr(args->cmds + (i * sizeof(submit_cmd)));
+
+		ret = copy_from_user(&submit_cmd, userptr, sizeof(submit_cmd));
+		if (ret) {
+			ret = -EFAULT;
+			goto out;
+		}
+
+		/* validate input from userspace: */
+		switch (submit_cmd.type) {
+		case MSM_SUBMIT_CMD_BUF:
+		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
+		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
+			break;
+		default:
+			SUBMIT_ERROR(submit, "invalid type: %08x\n", submit_cmd.type);
+			return -EINVAL;
+		}
+
+		if (submit_cmd.size % 4) {
+			SUBMIT_ERROR(submit, "non-aligned cmdstream buffer size: %u\n",
+				     submit_cmd.size);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		submit->cmd[i].type = submit_cmd.type;
+		submit->cmd[i].size = submit_cmd.size / 4;
+		submit->cmd[i].offset = submit_cmd.submit_offset / 4;
+		submit->cmd[i].idx  = submit_cmd.submit_idx;
+		submit->cmd[i].nr_relocs = submit_cmd.nr_relocs;
+
+		userptr = u64_to_user_ptr(submit_cmd.relocs);
+
+		sz = array_size(submit_cmd.nr_relocs,
+				sizeof(struct drm_msm_gem_submit_reloc));
+		/* check for overflow: */
+		if (sz == SIZE_MAX) {
+			ret = -ENOMEM;
+			goto out;
+		}
+		submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN);
+		if (!submit->cmd[i].relocs) {
+			ret = -ENOMEM;
+			goto out;
+		}
+		ret = copy_from_user(submit->cmd[i].relocs, userptr, sz);
+		if (ret) {
+			ret = -EFAULT;
+			goto out;
+		}
+	}
+
+out:
+	return ret;
+}
+
+/* This is where we make sure all the bo's are reserved and pin'd: */
+static int submit_lock_objects(struct msm_gem_submit *submit)
+{
+	int ret;
+
+	drm_exec_init(&submit->exec, DRM_EXEC_INTERRUPTIBLE_WAIT, submit->nr_bos);
+
+	drm_exec_until_all_locked (&submit->exec) {
+		for (unsigned i = 0; i < submit->nr_bos; i++) {
+			struct drm_gem_object *obj = submit->bos[i].obj;
+			ret = drm_exec_prepare_obj(&submit->exec, obj, 1);
+			drm_exec_retry_on_contention(&submit->exec);
+			if (ret)
+				goto error;
+		}
+	}
+
+	return 0;
+
+error:
+	return ret;
+}
+
+static int submit_fence_sync(struct msm_gem_submit *submit)
+{
+	int i, ret = 0;
+
+	for (i = 0; i < submit->nr_bos; i++) {
+		struct drm_gem_object *obj = submit->bos[i].obj;
+		bool write = submit->bos[i].flags & MSM_SUBMIT_BO_WRITE;
+
+		/* Otherwise userspace can ask for implicit sync to be
+		 * disabled on specific buffers.  This is useful for internal
+		 * usermode driver managed buffers, suballocation, etc.
+		 */
+		if (submit->bos[i].flags & MSM_SUBMIT_BO_NO_IMPLICIT)
+			continue;
+
+		ret = drm_sched_job_add_implicit_dependencies(&submit->base,
+							      obj,
+							      write);
+		if (ret)
+			break;
+	}
+
+	return ret;
+}
+
+static int submit_pin_objects(struct msm_gem_submit *submit)
+{
+	struct msm_drm_private *priv = submit->dev->dev_private;
+	int i, ret = 0;
+
+	for (i = 0; i < submit->nr_bos; i++) {
+		struct drm_gem_object *obj = submit->bos[i].obj;
+		struct msm_gem_vma *vma;
+
+		/* if locking succeeded, pin bo: */
+		vma = msm_gem_get_vma_locked(obj, submit->aspace);
+		if (IS_ERR(vma)) {
+			ret = PTR_ERR(vma);
+			break;
+		}
+
+		ret = msm_gem_pin_vma_locked(obj, vma);
+		if (ret)
+			break;
+
+		submit->bos[i].iova = vma->iova;
+	}
+
+	/*
+	 * A second loop while holding the LRU lock (a) avoids acquiring/dropping
+	 * the LRU lock for each individual bo, while (b) avoiding holding the
+	 * LRU lock while calling msm_gem_pin_vma_locked() (which could trigger
+	 * get_pages() which could trigger reclaim.. and if we held the LRU lock
+	 * could trigger deadlock with the shrinker).
+	 */
+	mutex_lock(&priv->lru.lock);
+	for (i = 0; i < submit->nr_bos; i++) {
+		msm_gem_pin_obj_locked(submit->bos[i].obj);
+	}
+	mutex_unlock(&priv->lru.lock);
+
+	submit->bos_pinned = true;
+
+	return ret;
+}
+
+static void submit_unpin_objects(struct msm_gem_submit *submit)
+{
+	if (!submit->bos_pinned)
+		return;
+
+	for (int i = 0; i < submit->nr_bos; i++) {
+		struct drm_gem_object *obj = submit->bos[i].obj;
+
+		msm_gem_unpin_locked(obj);
+	}
+
+	submit->bos_pinned = false;
+}
+
+static void submit_attach_object_fences(struct msm_gem_submit *submit)
+{
+	int i;
+
+	for (i = 0; i < submit->nr_bos; i++) {
+		struct drm_gem_object *obj = submit->bos[i].obj;
+
+		if (submit->bos[i].flags & MSM_SUBMIT_BO_WRITE)
+			dma_resv_add_fence(obj->resv, submit->user_fence,
+					   DMA_RESV_USAGE_WRITE);
+		else if (submit->bos[i].flags & MSM_SUBMIT_BO_READ)
+			dma_resv_add_fence(obj->resv, submit->user_fence,
+					   DMA_RESV_USAGE_READ);
+	}
+}
+
+static int submit_bo(struct msm_gem_submit *submit, uint32_t idx,
+		struct drm_gem_object **obj, uint64_t *iova)
+{
+	if (idx >= submit->nr_bos) {
+		SUBMIT_ERROR(submit, "invalid buffer index: %u (out of %u)\n",
+			     idx, submit->nr_bos);
+		return -EINVAL;
+	}
+
+	if (obj)
+		*obj = submit->bos[idx].obj;
+	if (iova)
+		*iova = submit->bos[idx].iova;
+
+	return 0;
+}
+
+/* process the reloc's and patch up the cmdstream as needed: */
+static int submit_reloc(struct msm_gem_submit *submit, struct drm_gem_object *obj,
+		uint32_t offset, uint32_t nr_relocs, struct drm_msm_gem_submit_reloc *relocs)
+{
+	uint32_t i, last_offset = 0;
+	uint32_t *ptr;
+	int ret = 0;
+
+	if (offset % 4) {
+		SUBMIT_ERROR(submit, "non-aligned cmdstream buffer: %u\n", offset);
+		return -EINVAL;
+	}
+
+	/* For now, just map the entire thing.  Eventually we probably
+	 * to do it page-by-page, w/ kmap() if not vmap()d..
+	 */
+	ptr = msm_gem_get_vaddr_locked(obj);
+
+	if (IS_ERR(ptr)) {
+		ret = PTR_ERR(ptr);
+		DBG("failed to map: %d", ret);
+		return ret;
+	}
+
+	for (i = 0; i < nr_relocs; i++) {
+		struct drm_msm_gem_submit_reloc submit_reloc = relocs[i];
+		uint32_t off;
+		uint64_t iova;
+
+		if (submit_reloc.submit_offset % 4) {
+			SUBMIT_ERROR(submit, "non-aligned reloc offset: %u\n",
+				     submit_reloc.submit_offset);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		/* offset in dwords: */
+		off = submit_reloc.submit_offset / 4;
+
+		if ((off >= (obj->size / 4)) ||
+				(off < last_offset)) {
+			SUBMIT_ERROR(submit, "invalid offset %u at reloc %u\n", off, i);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		ret = submit_bo(submit, submit_reloc.reloc_idx, NULL, &iova);
+		if (ret)
+			goto out;
+
+		iova += submit_reloc.reloc_offset;
+
+		if (submit_reloc.shift < 0)
+			iova >>= -submit_reloc.shift;
+		else
+			iova <<= submit_reloc.shift;
+
+		ptr[off] = iova | submit_reloc.or;
+
+		last_offset = off;
+	}
+
+out:
+	msm_gem_put_vaddr_locked(obj);
+
+	return ret;
+}
+
+/* Cleanup submit at end of ioctl.  In the error case, this also drops
+ * references, unpins, and drops active refcnt.  In the non-error case,
+ * this is done when the submit is retired.
+ */
+static void submit_cleanup(struct msm_gem_submit *submit, bool error)
+{
+	if (error) {
+		submit_unpin_objects(submit);
+		/* job wasn't enqueued to scheduler, so early retirement: */
+		msm_submit_retire(submit);
+	}
+
+	if (submit->exec.objects)
+		drm_exec_fini(&submit->exec);
+}
+
+void msm_submit_retire(struct msm_gem_submit *submit)
+{
+	int i;
+
+	for (i = 0; i < submit->nr_bos; i++) {
+		struct drm_gem_object *obj = submit->bos[i].obj;
+
+		drm_gem_object_put(obj);
+	}
+}
+
+struct msm_submit_post_dep {
+	struct drm_syncobj *syncobj;
+	uint64_t point;
+	struct dma_fence_chain *chain;
+};
+
+static struct drm_syncobj **msm_parse_deps(struct msm_gem_submit *submit,
+                                           struct drm_file *file,
+                                           uint64_t in_syncobjs_addr,
+                                           uint32_t nr_in_syncobjs,
+                                           size_t syncobj_stride)
+{
+	struct drm_syncobj **syncobjs = NULL;
+	struct drm_msm_gem_submit_syncobj syncobj_desc = {0};
+	int ret = 0;
+	uint32_t i, j;
+
+	syncobjs = kcalloc(nr_in_syncobjs, sizeof(*syncobjs),
+	                   GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
+	if (!syncobjs)
+		return ERR_PTR(-ENOMEM);
+
+	for (i = 0; i < nr_in_syncobjs; ++i) {
+		uint64_t address = in_syncobjs_addr + i * syncobj_stride;
+
+		if (copy_from_user(&syncobj_desc,
+			           u64_to_user_ptr(address),
+			           min(syncobj_stride, sizeof(syncobj_desc)))) {
+			ret = -EFAULT;
+			break;
+		}
+
+		if (syncobj_desc.point &&
+		    !drm_core_check_feature(submit->dev, DRIVER_SYNCOBJ_TIMELINE)) {
+			ret = -EOPNOTSUPP;
+			break;
+		}
+
+		if (syncobj_desc.flags & ~MSM_SUBMIT_SYNCOBJ_FLAGS) {
+			ret = -EINVAL;
+			break;
+		}
+
+		ret = drm_sched_job_add_syncobj_dependency(&submit->base, file,
+							   syncobj_desc.handle, syncobj_desc.point);
+		if (ret)
+			break;
+
+		if (syncobj_desc.flags & MSM_SUBMIT_SYNCOBJ_RESET) {
+			syncobjs[i] =
+				drm_syncobj_find(file, syncobj_desc.handle);
+			if (!syncobjs[i]) {
+				ret = -EINVAL;
+				break;
+			}
+		}
+	}
+
+	if (ret) {
+		for (j = 0; j <= i; ++j) {
+			if (syncobjs[j])
+				drm_syncobj_put(syncobjs[j]);
+		}
+		kfree(syncobjs);
+		return ERR_PTR(ret);
+	}
+	return syncobjs;
+}
+
+static void msm_reset_syncobjs(struct drm_syncobj **syncobjs,
+                               uint32_t nr_syncobjs)
+{
+	uint32_t i;
+
+	for (i = 0; syncobjs && i < nr_syncobjs; ++i) {
+		if (syncobjs[i])
+			drm_syncobj_replace_fence(syncobjs[i], NULL);
+	}
+}
+
+static struct msm_submit_post_dep *msm_parse_post_deps(struct drm_device *dev,
+                                                       struct drm_file *file,
+                                                       uint64_t syncobjs_addr,
+                                                       uint32_t nr_syncobjs,
+                                                       size_t syncobj_stride)
+{
+	struct msm_submit_post_dep *post_deps;
+	struct drm_msm_gem_submit_syncobj syncobj_desc = {0};
+	int ret = 0;
+	uint32_t i, j;
+
+	post_deps = kcalloc(nr_syncobjs, sizeof(*post_deps),
+			    GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
+	if (!post_deps)
+		return ERR_PTR(-ENOMEM);
+
+	for (i = 0; i < nr_syncobjs; ++i) {
+		uint64_t address = syncobjs_addr + i * syncobj_stride;
+
+		if (copy_from_user(&syncobj_desc,
+			           u64_to_user_ptr(address),
+			           min(syncobj_stride, sizeof(syncobj_desc)))) {
+			ret = -EFAULT;
+			break;
+		}
+
+		post_deps[i].point = syncobj_desc.point;
+
+		if (syncobj_desc.flags) {
+			ret = -EINVAL;
+			break;
+		}
+
+		if (syncobj_desc.point) {
+			if (!drm_core_check_feature(dev,
+			                            DRIVER_SYNCOBJ_TIMELINE)) {
+				ret = -EOPNOTSUPP;
+				break;
+			}
+
+			post_deps[i].chain = dma_fence_chain_alloc();
+			if (!post_deps[i].chain) {
+				ret = -ENOMEM;
+				break;
+			}
+		}
+
+		post_deps[i].syncobj =
+			drm_syncobj_find(file, syncobj_desc.handle);
+		if (!post_deps[i].syncobj) {
+			ret = -EINVAL;
+			break;
+		}
+	}
+
+	if (ret) {
+		for (j = 0; j <= i; ++j) {
+			dma_fence_chain_free(post_deps[j].chain);
+			if (post_deps[j].syncobj)
+				drm_syncobj_put(post_deps[j].syncobj);
+		}
+
+		kfree(post_deps);
+		return ERR_PTR(ret);
+	}
+
+	return post_deps;
+}
+
+static void msm_process_post_deps(struct msm_submit_post_dep *post_deps,
+                                  uint32_t count, struct dma_fence *fence)
+{
+	uint32_t i;
+
+	for (i = 0; post_deps && i < count; ++i) {
+		if (post_deps[i].chain) {
+			drm_syncobj_add_point(post_deps[i].syncobj,
+			                      post_deps[i].chain,
+			                      fence, post_deps[i].point);
+			post_deps[i].chain = NULL;
+		} else {
+			drm_syncobj_replace_fence(post_deps[i].syncobj,
+			                          fence);
+		}
+	}
+}
+
+int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
+		struct drm_file *file)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct drm_msm_gem_submit *args = data;
+	struct msm_file_private *ctx = file->driver_priv;
+	struct msm_gem_submit *submit = NULL;
+	struct msm_gpu *gpu = priv->gpu;
+	struct msm_gpu_submitqueue *queue;
+	struct msm_ringbuffer *ring;
+	struct msm_submit_post_dep *post_deps = NULL;
+	struct drm_syncobj **syncobjs_to_reset = NULL;
+	int out_fence_fd = -1;
+	unsigned i;
+	int ret;
+
+	if (!gpu)
+		return -ENXIO;
+
+	if (args->pad)
+		return -EINVAL;
+
+	if (unlikely(!ctx->aspace) && !capable(CAP_SYS_RAWIO)) {
+		DRM_ERROR_RATELIMITED("IOMMU support or CAP_SYS_RAWIO required!\n");
+		return -EPERM;
+	}
+
+	/* for now, we just have 3d pipe.. eventually this would need to
+	 * be more clever to dispatch to appropriate gpu module:
+	 */
+	if (MSM_PIPE_ID(args->flags) != MSM_PIPE_3D0)
+		return -EINVAL;
+
+	if (MSM_PIPE_FLAGS(args->flags) & ~MSM_SUBMIT_FLAGS)
+		return -EINVAL;
+
+	if (args->flags & MSM_SUBMIT_SUDO) {
+		if (!IS_ENABLED(CONFIG_DRM_MSM_GPU_SUDO) ||
+		    !capable(CAP_SYS_RAWIO))
+			return -EINVAL;
+	}
+
+	queue = msm_submitqueue_get(ctx, args->queueid);
+	if (!queue)
+		return -ENOENT;
+
+	ring = gpu->rb[queue->ring_nr];
+
+	if (args->flags & MSM_SUBMIT_FENCE_FD_OUT) {
+		out_fence_fd = get_unused_fd_flags(O_CLOEXEC);
+		if (out_fence_fd < 0) {
+			ret = out_fence_fd;
+			goto out_post_unlock;
+		}
+	}
+
+	submit = submit_create(dev, gpu, queue, args->nr_bos, args->nr_cmds);
+	if (IS_ERR(submit)) {
+		ret = PTR_ERR(submit);
+		goto out_post_unlock;
+	}
+
+	trace_msm_gpu_submit(pid_nr(submit->pid), ring->id, submit->ident,
+		args->nr_bos, args->nr_cmds);
+
+	ret = mutex_lock_interruptible(&queue->lock);
+	if (ret)
+		goto out_post_unlock;
+
+	if (args->flags & MSM_SUBMIT_SUDO)
+		submit->in_rb = true;
+
+	if (args->flags & MSM_SUBMIT_FENCE_FD_IN) {
+		struct dma_fence *in_fence;
+
+		in_fence = sync_file_get_fence(args->fence_fd);
+
+		if (!in_fence) {
+			ret = -EINVAL;
+			goto out_unlock;
+		}
+
+		ret = drm_sched_job_add_dependency(&submit->base, in_fence);
+		if (ret)
+			goto out_unlock;
+	}
+
+	if (args->flags & MSM_SUBMIT_SYNCOBJ_IN) {
+		syncobjs_to_reset = msm_parse_deps(submit, file,
+		                                   args->in_syncobjs,
+		                                   args->nr_in_syncobjs,
+		                                   args->syncobj_stride);
+		if (IS_ERR(syncobjs_to_reset)) {
+			ret = PTR_ERR(syncobjs_to_reset);
+			goto out_unlock;
+		}
+	}
+
+	if (args->flags & MSM_SUBMIT_SYNCOBJ_OUT) {
+		post_deps = msm_parse_post_deps(dev, file,
+		                                args->out_syncobjs,
+		                                args->nr_out_syncobjs,
+		                                args->syncobj_stride);
+		if (IS_ERR(post_deps)) {
+			ret = PTR_ERR(post_deps);
+			goto out_unlock;
+		}
+	}
+
+	ret = submit_lookup_objects(submit, args, file);
+	if (ret)
+		goto out;
+
+	ret = submit_lookup_cmds(submit, args, file);
+	if (ret)
+		goto out;
+
+	/* copy_*_user while holding a ww ticket upsets lockdep */
+	ret = submit_lock_objects(submit);
+	if (ret)
+		goto out;
+
+	if (!(args->flags & MSM_SUBMIT_NO_IMPLICIT)) {
+		ret = submit_fence_sync(submit);
+		if (ret)
+			goto out;
+	}
+
+	ret = submit_pin_objects(submit);
+	if (ret)
+		goto out;
+
+	for (i = 0; i < args->nr_cmds; i++) {
+		struct drm_gem_object *obj;
+		uint64_t iova;
+
+		ret = submit_bo(submit, submit->cmd[i].idx, &obj, &iova);
+		if (ret)
+			goto out;
+
+		if (!submit->cmd[i].size ||
+			((submit->cmd[i].size + submit->cmd[i].offset) >
+				obj->size / 4)) {
+			SUBMIT_ERROR(submit, "invalid cmdstream size: %u\n", submit->cmd[i].size * 4);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		submit->cmd[i].iova = iova + (submit->cmd[i].offset * 4);
+
+		if (likely(!submit->cmd[i].nr_relocs))
+			continue;
+
+		if (!gpu->allow_relocs) {
+			SUBMIT_ERROR(submit, "relocs not allowed\n");
+			ret = -EINVAL;
+			goto out;
+		}
+
+		ret = submit_reloc(submit, obj, submit->cmd[i].offset * 4,
+				submit->cmd[i].nr_relocs, submit->cmd[i].relocs);
+		if (ret)
+			goto out;
+	}
+
+	submit->nr_cmds = i;
+
+	idr_preload(GFP_KERNEL);
+
+	spin_lock(&queue->idr_lock);
+
+	/*
+	 * If using userspace provided seqno fence, validate that the id
+	 * is available before arming sched job.  Since access to fence_idr
+	 * is serialized on the queue lock, the slot should be still avail
+	 * after the job is armed
+	 */
+	if ((args->flags & MSM_SUBMIT_FENCE_SN_IN) &&
+			(!args->fence || idr_find(&queue->fence_idr, args->fence))) {
+		spin_unlock(&queue->idr_lock);
+		idr_preload_end();
+		ret = -EINVAL;
+		goto out;
+	}
+
+	drm_sched_job_arm(&submit->base);
+
+	submit->user_fence = dma_fence_get(&submit->base.s_fence->finished);
+
+	if (args->flags & MSM_SUBMIT_FENCE_SN_IN) {
+		/*
+		 * Userspace has assigned the seqno fence that it wants
+		 * us to use.  It is an error to pick a fence sequence
+		 * number that is not available.
+		 */
+		submit->fence_id = args->fence;
+		ret = idr_alloc_u32(&queue->fence_idr, submit->user_fence,
+				    &submit->fence_id, submit->fence_id,
+				    GFP_NOWAIT);
+		/*
+		 * We've already validated that the fence_id slot is valid,
+		 * so if idr_alloc_u32 failed, it is a kernel bug
+		 */
+		WARN_ON(ret);
+	} else {
+		/*
+		 * Allocate an id which can be used by WAIT_FENCE ioctl to map
+		 * back to the underlying fence.
+		 */
+		submit->fence_id = idr_alloc_cyclic(&queue->fence_idr,
+						    submit->user_fence, 1,
+						    INT_MAX, GFP_NOWAIT);
+	}
+
+	spin_unlock(&queue->idr_lock);
+	idr_preload_end();
+
+	if (submit->fence_id < 0) {
+		ret = submit->fence_id;
+		submit->fence_id = 0;
+	}
+
+	if (ret == 0 && args->flags & MSM_SUBMIT_FENCE_FD_OUT) {
+		struct sync_file *sync_file = sync_file_create(submit->user_fence);
+		if (!sync_file) {
+			ret = -ENOMEM;
+		} else {
+			fd_install(out_fence_fd, sync_file->file);
+			args->fence_fd = out_fence_fd;
+		}
+	}
+
+	if (ret)
+		goto out;
+
+	submit_attach_object_fences(submit);
+
+	/* The scheduler owns a ref now: */
+	msm_gem_submit_get(submit);
+
+	msm_rd_dump_submit(priv->rd, submit, NULL);
+
+	drm_sched_entity_push_job(&submit->base);
+
+	args->fence = submit->fence_id;
+	queue->last_fence = submit->fence_id;
+
+	msm_reset_syncobjs(syncobjs_to_reset, args->nr_in_syncobjs);
+	msm_process_post_deps(post_deps, args->nr_out_syncobjs,
+	                      submit->user_fence);
+
+
+out:
+	submit_cleanup(submit, !!ret);
+out_unlock:
+	mutex_unlock(&queue->lock);
+out_post_unlock:
+	if (ret && (out_fence_fd >= 0))
+		put_unused_fd(out_fence_fd);
+
+	if (!IS_ERR_OR_NULL(submit)) {
+		msm_gem_submit_put(submit);
+	} else {
+		/*
+		 * If the submit hasn't yet taken ownership of the queue
+		 * then we need to drop the reference ourself:
+		 */
+		msm_submitqueue_put(queue);
+	}
+	if (!IS_ERR_OR_NULL(post_deps)) {
+		for (i = 0; i < args->nr_out_syncobjs; ++i) {
+			kfree(post_deps[i].chain);
+			drm_syncobj_put(post_deps[i].syncobj);
+		}
+		kfree(post_deps);
+	}
+
+	if (!IS_ERR_OR_NULL(syncobjs_to_reset)) {
+		for (i = 0; i < args->nr_in_syncobjs; ++i) {
+			if (syncobjs_to_reset[i])
+				drm_syncobj_put(syncobjs_to_reset[i]);
+		}
+		kfree(syncobjs_to_reset);
+	}
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gem_vma.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gem_vma.c
@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2016 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include "msm_drv.h"
+#include "msm_fence.h"
+#include "msm_gem.h"
+#include "msm_mmu.h"
+
+static void
+msm_gem_address_space_destroy(struct kref *kref)
+{
+	struct msm_gem_address_space *aspace = container_of(kref,
+			struct msm_gem_address_space, kref);
+
+	drm_mm_takedown(&aspace->mm);
+	if (aspace->mmu)
+		aspace->mmu->funcs->destroy(aspace->mmu);
+	put_pid(aspace->pid);
+	kfree(aspace);
+}
+
+
+void msm_gem_address_space_put(struct msm_gem_address_space *aspace)
+{
+	if (aspace)
+		kref_put(&aspace->kref, msm_gem_address_space_destroy);
+}
+
+struct msm_gem_address_space *
+msm_gem_address_space_get(struct msm_gem_address_space *aspace)
+{
+	if (!IS_ERR_OR_NULL(aspace))
+		kref_get(&aspace->kref);
+
+	return aspace;
+}
+
+/* Actually unmap memory for the vma */
+void msm_gem_vma_purge(struct msm_gem_vma *vma)
+{
+	struct msm_gem_address_space *aspace = vma->aspace;
+	unsigned size = vma->node.size;
+
+	/* Don't do anything if the memory isn't mapped */
+	if (!vma->mapped)
+		return;
+
+	aspace->mmu->funcs->unmap(aspace->mmu, vma->iova, size);
+
+	vma->mapped = false;
+}
+
+/* Map and pin vma: */
+int
+msm_gem_vma_map(struct msm_gem_vma *vma, int prot,
+		struct sg_table *sgt, int size)
+{
+	struct msm_gem_address_space *aspace = vma->aspace;
+	int ret;
+
+	if (GEM_WARN_ON(!vma->iova))
+		return -EINVAL;
+
+	if (vma->mapped)
+		return 0;
+
+	vma->mapped = true;
+
+	if (!aspace)
+		return 0;
+
+	/*
+	 * NOTE: iommu/io-pgtable can allocate pages, so we cannot hold
+	 * a lock across map/unmap which is also used in the job_run()
+	 * path, as this can cause deadlock in job_run() vs shrinker/
+	 * reclaim.
+	 *
+	 * Revisit this if we can come up with a scheme to pre-alloc pages
+	 * for the pgtable in map/unmap ops.
+	 */
+	ret = aspace->mmu->funcs->map(aspace->mmu, vma->iova, sgt, size, prot);
+
+	if (ret) {
+		vma->mapped = false;
+	}
+
+	return ret;
+}
+
+/* Close an iova.  Warn if it is still in use */
+void msm_gem_vma_close(struct msm_gem_vma *vma)
+{
+	struct msm_gem_address_space *aspace = vma->aspace;
+
+	GEM_WARN_ON(vma->mapped);
+
+	spin_lock(&aspace->lock);
+	if (vma->iova)
+		drm_mm_remove_node(&vma->node);
+	spin_unlock(&aspace->lock);
+
+	vma->iova = 0;
+
+	msm_gem_address_space_put(aspace);
+}
+
+struct msm_gem_vma *msm_gem_vma_new(struct msm_gem_address_space *aspace)
+{
+	struct msm_gem_vma *vma;
+
+	vma = kzalloc(sizeof(*vma), GFP_KERNEL);
+	if (!vma)
+		return NULL;
+
+	vma->aspace = aspace;
+
+	return vma;
+}
+
+/* Initialize a new vma and allocate an iova for it */
+int msm_gem_vma_init(struct msm_gem_vma *vma, int size,
+		u64 range_start, u64 range_end)
+{
+	struct msm_gem_address_space *aspace = vma->aspace;
+	int ret;
+
+	if (GEM_WARN_ON(!aspace))
+		return -EINVAL;
+
+	if (GEM_WARN_ON(vma->iova))
+		return -EBUSY;
+
+	spin_lock(&aspace->lock);
+	ret = drm_mm_insert_node_in_range(&aspace->mm, &vma->node,
+					  size, PAGE_SIZE, 0,
+					  range_start, range_end, 0);
+	spin_unlock(&aspace->lock);
+
+	if (ret)
+		return ret;
+
+	vma->iova = vma->node.start;
+	vma->mapped = false;
+
+	kref_get(&aspace->kref);
+
+	return 0;
+}
+
+struct msm_gem_address_space *
+msm_gem_address_space_create(struct msm_mmu *mmu, const char *name,
+		u64 va_start, u64 size)
+{
+	struct msm_gem_address_space *aspace;
+
+	if (IS_ERR(mmu))
+		return ERR_CAST(mmu);
+
+	aspace = kzalloc(sizeof(*aspace), GFP_KERNEL);
+	if (!aspace)
+		return ERR_PTR(-ENOMEM);
+
+	spin_lock_init(&aspace->lock);
+	aspace->name = name;
+	aspace->mmu = mmu;
+	aspace->va_start = va_start;
+	aspace->va_size  = size;
+
+	drm_mm_init(&aspace->mm, va_start, size);
+
+	kref_init(&aspace->kref);
+
+	return aspace;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gpu.c
@@ -0,0 +1,1023 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include "drm/drm_drv.h"
+
+#include "msm_gpu.h"
+#include "msm_gem.h"
+#include "msm_mmu.h"
+#include "msm_fence.h"
+#include "msm_gpu_trace.h"
+//#include "adreno/adreno_gpu.h"
+
+#include <generated/utsrelease.h>
+#include <linux/string_helpers.h>
+#include <linux/devcoredump.h>
+#include <linux/sched/task.h>
+
+/*
+ * Power Management:
+ */
+
+static int enable_pwrrail(struct msm_gpu *gpu)
+{
+	struct drm_device *dev = gpu->dev;
+	int ret = 0;
+
+	if (gpu->gpu_reg) {
+		ret = regulator_enable(gpu->gpu_reg);
+		if (ret) {
+			DRM_DEV_ERROR(dev->dev, "failed to enable 'gpu_reg': %d\n", ret);
+			return ret;
+		}
+	}
+
+	if (gpu->gpu_cx) {
+		ret = regulator_enable(gpu->gpu_cx);
+		if (ret) {
+			DRM_DEV_ERROR(dev->dev, "failed to enable 'gpu_cx': %d\n", ret);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+static int disable_pwrrail(struct msm_gpu *gpu)
+{
+	if (gpu->gpu_cx)
+		regulator_disable(gpu->gpu_cx);
+	if (gpu->gpu_reg)
+		regulator_disable(gpu->gpu_reg);
+	return 0;
+}
+
+static int enable_clk(struct msm_gpu *gpu)
+{
+	if (gpu->core_clk && gpu->fast_rate)
+		dev_pm_opp_set_rate(&gpu->pdev->dev, gpu->fast_rate);
+
+	/* Set the RBBM timer rate to 19.2Mhz */
+	if (gpu->rbbmtimer_clk)
+		clk_set_rate(gpu->rbbmtimer_clk, 19200000);
+
+	return clk_bulk_prepare_enable(gpu->nr_clocks, gpu->grp_clks);
+}
+
+static int disable_clk(struct msm_gpu *gpu)
+{
+	clk_bulk_disable_unprepare(gpu->nr_clocks, gpu->grp_clks);
+
+	/*
+	 * Set the clock to a deliberately low rate. On older targets the clock
+	 * speed had to be non zero to avoid problems. On newer targets this
+	 * will be rounded down to zero anyway so it all works out.
+	 */
+	if (gpu->core_clk)
+		dev_pm_opp_set_rate(&gpu->pdev->dev, 27000000);
+
+	if (gpu->rbbmtimer_clk)
+		clk_set_rate(gpu->rbbmtimer_clk, 0);
+
+	return 0;
+}
+
+static int enable_axi(struct msm_gpu *gpu)
+{
+	return clk_prepare_enable(gpu->ebi1_clk);
+}
+
+static int disable_axi(struct msm_gpu *gpu)
+{
+	clk_disable_unprepare(gpu->ebi1_clk);
+	return 0;
+}
+
+int msm_gpu_pm_resume(struct msm_gpu *gpu)
+{
+	int ret;
+
+	DBG("%s", gpu->name);
+	trace_msm_gpu_resume(0);
+
+	ret = enable_pwrrail(gpu);
+	if (ret)
+		return ret;
+
+	ret = enable_clk(gpu);
+	if (ret)
+		return ret;
+
+	ret = enable_axi(gpu);
+	if (ret)
+		return ret;
+
+	msm_devfreq_resume(gpu);
+
+	gpu->needs_hw_init = true;
+
+	return 0;
+}
+
+int msm_gpu_pm_suspend(struct msm_gpu *gpu)
+{
+	int ret;
+
+	DBG("%s", gpu->name);
+	trace_msm_gpu_suspend(0);
+
+	msm_devfreq_suspend(gpu);
+
+	ret = disable_axi(gpu);
+	if (ret)
+		return ret;
+
+	ret = disable_clk(gpu);
+	if (ret)
+		return ret;
+
+	ret = disable_pwrrail(gpu);
+	if (ret)
+		return ret;
+
+	gpu->suspend_count++;
+
+	return 0;
+}
+
+void msm_gpu_show_fdinfo(struct msm_gpu *gpu, struct msm_file_private *ctx,
+			 struct drm_printer *p)
+{
+	drm_printf(p, "drm-engine-gpu:\t%llu ns\n", ctx->elapsed_ns);
+	drm_printf(p, "drm-cycles-gpu:\t%llu\n", ctx->cycles);
+	drm_printf(p, "drm-maxfreq-gpu:\t%u Hz\n", gpu->fast_rate);
+}
+
+int msm_gpu_hw_init(struct msm_gpu *gpu)
+{
+	int ret;
+
+	WARN_ON(!mutex_is_locked(&gpu->lock));
+
+	if (!gpu->needs_hw_init)
+		return 0;
+
+	disable_irq(gpu->irq);
+	ret = gpu->funcs->hw_init(gpu);
+	if (!ret)
+		gpu->needs_hw_init = false;
+	enable_irq(gpu->irq);
+
+	return ret;
+}
+
+#ifdef CONFIG_DEV_COREDUMP
+static ssize_t msm_gpu_devcoredump_read(char *buffer, loff_t offset,
+		size_t count, void *data, size_t datalen)
+{
+	struct msm_gpu *gpu = data;
+	struct drm_print_iterator iter;
+	struct drm_printer p;
+	struct msm_gpu_state *state;
+
+	state = msm_gpu_crashstate_get(gpu);
+	if (!state)
+		return 0;
+
+	iter.data = buffer;
+	iter.offset = 0;
+	iter.start = offset;
+	iter.remain = count;
+
+	p = drm_coredump_printer(&iter);
+
+	drm_printf(&p, "---\n");
+	drm_printf(&p, "kernel: " UTS_RELEASE "\n");
+	drm_printf(&p, "module: " KBUILD_MODNAME "\n");
+	drm_printf(&p, "time: %lld.%09ld\n",
+		state->time.tv_sec, state->time.tv_nsec);
+	if (state->comm)
+		drm_printf(&p, "comm: %s\n", state->comm);
+	if (state->cmd)
+		drm_printf(&p, "cmdline: %s\n", state->cmd);
+
+	gpu->funcs->show(gpu, state, &p);
+
+	msm_gpu_crashstate_put(gpu);
+
+	return count - iter.remain;
+}
+
+static void msm_gpu_devcoredump_free(void *data)
+{
+	struct msm_gpu *gpu = data;
+
+	msm_gpu_crashstate_put(gpu);
+}
+
+static void msm_gpu_crashstate_get_bo(struct msm_gpu_state *state,
+		struct drm_gem_object *obj, u64 iova, bool full)
+{
+	struct msm_gpu_state_bo *state_bo = &state->bos[state->nr_bos];
+
+	/* Don't record write only objects */
+	state_bo->size = obj->size;
+	state_bo->iova = iova;
+
+	BUILD_BUG_ON(sizeof(state_bo->name) != sizeof(to_msm_bo(obj)->name));
+
+	memcpy(state_bo->name, to_msm_bo(obj)->name, sizeof(state_bo->name));
+
+	if (full) {
+		void *ptr;
+
+		state_bo->data = kvmalloc(obj->size, GFP_KERNEL);
+		if (!state_bo->data)
+			goto out;
+
+		msm_gem_lock(obj);
+		ptr = msm_gem_get_vaddr_active(obj);
+		msm_gem_unlock(obj);
+		if (IS_ERR(ptr)) {
+			kvfree(state_bo->data);
+			state_bo->data = NULL;
+			goto out;
+		}
+
+		memcpy(state_bo->data, ptr, obj->size);
+		msm_gem_put_vaddr(obj);
+	}
+out:
+	state->nr_bos++;
+}
+
+static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
+		struct msm_gem_submit *submit, char *comm, char *cmd)
+{
+	struct msm_gpu_state *state;
+
+	/* Check if the target supports capturing crash state */
+	if (!gpu->funcs->gpu_state_get)
+		return;
+
+	/* Only save one crash state at a time */
+	if (gpu->crashstate)
+		return;
+
+	state = gpu->funcs->gpu_state_get(gpu);
+	if (IS_ERR_OR_NULL(state))
+		return;
+
+	/* Fill in the additional crash state information */
+	state->comm = kstrdup(comm, GFP_KERNEL);
+	state->cmd = kstrdup(cmd, GFP_KERNEL);
+	state->fault_info = gpu->fault_info;
+
+	if (submit) {
+		int i;
+
+		state->bos = kcalloc(submit->nr_bos,
+			sizeof(struct msm_gpu_state_bo), GFP_KERNEL);
+
+		for (i = 0; state->bos && i < submit->nr_bos; i++) {
+			msm_gpu_crashstate_get_bo(state, submit->bos[i].obj,
+						  submit->bos[i].iova,
+						  should_dump(submit, i));
+		}
+	}
+
+	/* Set the active crash state to be dumped on failure */
+	gpu->crashstate = state;
+
+	dev_coredumpm(&gpu->pdev->dev, THIS_MODULE, gpu, 0, GFP_KERNEL,
+		msm_gpu_devcoredump_read, msm_gpu_devcoredump_free);
+}
+#else
+static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
+		struct msm_gem_submit *submit, char *comm, char *cmd)
+{
+}
+#endif
+
+/*
+ * Hangcheck detection for locked gpu:
+ */
+
+static struct msm_gem_submit *
+find_submit(struct msm_ringbuffer *ring, uint32_t fence)
+{
+	struct msm_gem_submit *submit;
+	unsigned long flags;
+
+	spin_lock_irqsave(&ring->submit_lock, flags);
+	list_for_each_entry(submit, &ring->submits, node) {
+		if (submit->seqno == fence) {
+			spin_unlock_irqrestore(&ring->submit_lock, flags);
+			return submit;
+		}
+	}
+	spin_unlock_irqrestore(&ring->submit_lock, flags);
+
+	return NULL;
+}
+
+static void retire_submits(struct msm_gpu *gpu);
+
+static void get_comm_cmdline(struct msm_gem_submit *submit, char **comm, char **cmd)
+{
+	struct msm_file_private *ctx = submit->queue->ctx;
+	struct task_struct *task;
+
+	WARN_ON(!mutex_is_locked(&submit->gpu->lock));
+
+	/* Note that kstrdup will return NULL if argument is NULL: */
+	*comm = kstrdup(ctx->comm, GFP_KERNEL);
+	*cmd  = kstrdup(ctx->cmdline, GFP_KERNEL);
+
+	task = get_pid_task(submit->pid, PIDTYPE_PID);
+	if (!task)
+		return;
+
+	if (!*comm)
+		*comm = kstrdup(task->comm, GFP_KERNEL);
+
+	if (!*cmd)
+		*cmd = kstrdup_quotable_cmdline(task, GFP_KERNEL);
+
+	put_task_struct(task);
+}
+
+static void recover_worker(struct kthread_work *work)
+{
+	struct msm_gpu *gpu = container_of(work, struct msm_gpu, recover_work);
+	struct drm_device *dev = gpu->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_gem_submit *submit;
+	struct msm_ringbuffer *cur_ring = gpu->funcs->active_ring(gpu);
+	char *comm = NULL, *cmd = NULL;
+	int i;
+
+	mutex_lock(&gpu->lock);
+
+	DRM_DEV_ERROR(dev->dev, "%s: hangcheck recover!\n", gpu->name);
+
+	submit = find_submit(cur_ring, cur_ring->memptrs->fence + 1);
+
+	/*
+	 * If the submit retired while we were waiting for the worker to run,
+	 * or waiting to acquire the gpu lock, then nothing more to do.
+	 */
+	if (!submit)
+		goto out_unlock;
+
+	/* Increment the fault counts */
+	submit->queue->faults++;
+	if (submit->aspace)
+		submit->aspace->faults++;
+
+	get_comm_cmdline(submit, &comm, &cmd);
+
+	if (comm && cmd) {
+		DRM_DEV_ERROR(dev->dev, "%s: offending task: %s (%s)\n",
+			      gpu->name, comm, cmd);
+
+		msm_rd_dump_submit(priv->hangrd, submit,
+				   "offending task: %s (%s)", comm, cmd);
+	} else {
+		DRM_DEV_ERROR(dev->dev, "%s: offending task: unknown\n", gpu->name);
+
+		msm_rd_dump_submit(priv->hangrd, submit, NULL);
+	}
+
+	/* Record the crash state */
+	pm_runtime_get_sync(&gpu->pdev->dev);
+	msm_gpu_crashstate_capture(gpu, submit, comm, cmd);
+
+	kfree(cmd);
+	kfree(comm);
+
+	/*
+	 * Update all the rings with the latest and greatest fence.. this
+	 * needs to happen after msm_rd_dump_submit() to ensure that the
+	 * bo's referenced by the offending submit are still around.
+	 */
+	for (i = 0; i < gpu->nr_rings; i++) {
+		struct msm_ringbuffer *ring = gpu->rb[i];
+
+		uint32_t fence = ring->memptrs->fence;
+
+		/*
+		 * For the current (faulting?) ring/submit advance the fence by
+		 * one more to clear the faulting submit
+		 */
+		if (ring == cur_ring)
+			ring->memptrs->fence = ++fence;
+
+		msm_update_fence(ring->fctx, fence);
+	}
+
+	if (msm_gpu_active(gpu)) {
+		/* retire completed submits, plus the one that hung: */
+		retire_submits(gpu);
+
+		gpu->funcs->recover(gpu);
+
+		/*
+		 * Replay all remaining submits starting with highest priority
+		 * ring
+		 */
+		for (i = 0; i < gpu->nr_rings; i++) {
+			struct msm_ringbuffer *ring = gpu->rb[i];
+			unsigned long flags;
+
+			spin_lock_irqsave(&ring->submit_lock, flags);
+			list_for_each_entry(submit, &ring->submits, node)
+				gpu->funcs->submit(gpu, submit);
+			spin_unlock_irqrestore(&ring->submit_lock, flags);
+		}
+	}
+
+	pm_runtime_put(&gpu->pdev->dev);
+
+out_unlock:
+	mutex_unlock(&gpu->lock);
+
+	msm_gpu_retire(gpu);
+}
+
+static void fault_worker(struct kthread_work *work)
+{
+	struct msm_gpu *gpu = container_of(work, struct msm_gpu, fault_work);
+	struct msm_gem_submit *submit;
+	struct msm_ringbuffer *cur_ring = gpu->funcs->active_ring(gpu);
+	char *comm = NULL, *cmd = NULL;
+
+	mutex_lock(&gpu->lock);
+
+	submit = find_submit(cur_ring, cur_ring->memptrs->fence + 1);
+	if (submit && submit->fault_dumped)
+		goto resume_smmu;
+
+	if (submit) {
+		get_comm_cmdline(submit, &comm, &cmd);
+
+		/*
+		 * When we get GPU iova faults, we can get 1000s of them,
+		 * but we really only want to log the first one.
+		 */
+		submit->fault_dumped = true;
+	}
+
+	/* Record the crash state */
+	pm_runtime_get_sync(&gpu->pdev->dev);
+	msm_gpu_crashstate_capture(gpu, submit, comm, cmd);
+	pm_runtime_put_sync(&gpu->pdev->dev);
+
+	kfree(cmd);
+	kfree(comm);
+
+resume_smmu:
+	memset(&gpu->fault_info, 0, sizeof(gpu->fault_info));
+	gpu->aspace->mmu->funcs->resume_translation(gpu->aspace->mmu);
+
+	mutex_unlock(&gpu->lock);
+}
+
+static void hangcheck_timer_reset(struct msm_gpu *gpu)
+{
+	struct msm_drm_private *priv = gpu->dev->dev_private;
+	mod_timer(&gpu->hangcheck_timer,
+			round_jiffies_up(jiffies + msecs_to_jiffies(priv->hangcheck_period)));
+}
+
+static bool made_progress(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+{
+	if (ring->hangcheck_progress_retries >= DRM_MSM_HANGCHECK_PROGRESS_RETRIES)
+		return false;
+
+	if (!gpu->funcs->progress)
+		return false;
+
+	if (!gpu->funcs->progress(gpu, ring))
+		return false;
+
+	ring->hangcheck_progress_retries++;
+	return true;
+}
+
+static void hangcheck_handler(struct timer_list *t)
+{
+	struct msm_gpu *gpu = from_timer(gpu, t, hangcheck_timer);
+	struct drm_device *dev = gpu->dev;
+	struct msm_ringbuffer *ring = gpu->funcs->active_ring(gpu);
+	uint32_t fence = ring->memptrs->fence;
+
+	if (fence != ring->hangcheck_fence) {
+		/* some progress has been made.. ya! */
+		ring->hangcheck_fence = fence;
+		ring->hangcheck_progress_retries = 0;
+	} else if (fence_before(fence, ring->fctx->last_fence) &&
+			!made_progress(gpu, ring)) {
+		/* no progress and not done.. hung! */
+		ring->hangcheck_fence = fence;
+		ring->hangcheck_progress_retries = 0;
+		DRM_DEV_ERROR(dev->dev, "%s: hangcheck detected gpu lockup rb %d!\n",
+				gpu->name, ring->id);
+		DRM_DEV_ERROR(dev->dev, "%s:     completed fence: %u\n",
+				gpu->name, fence);
+		DRM_DEV_ERROR(dev->dev, "%s:     submitted fence: %u\n",
+				gpu->name, ring->fctx->last_fence);
+
+		kthread_queue_work(gpu->worker, &gpu->recover_work);
+	}
+
+	/* if still more pending work, reset the hangcheck timer: */
+	if (fence_after(ring->fctx->last_fence, ring->hangcheck_fence))
+		hangcheck_timer_reset(gpu);
+
+	/* workaround for missing irq: */
+	msm_gpu_retire(gpu);
+}
+
+/*
+ * Performance Counters:
+ */
+
+/* called under perf_lock */
+static int update_hw_cntrs(struct msm_gpu *gpu, uint32_t ncntrs, uint32_t *cntrs)
+{
+	uint32_t current_cntrs[ARRAY_SIZE(gpu->last_cntrs)];
+	int i, n = min(ncntrs, gpu->num_perfcntrs);
+
+	/* read current values: */
+	for (i = 0; i < gpu->num_perfcntrs; i++)
+		current_cntrs[i] = gpu_read(gpu, gpu->perfcntrs[i].sample_reg);
+
+	/* update cntrs: */
+	for (i = 0; i < n; i++)
+		cntrs[i] = current_cntrs[i] - gpu->last_cntrs[i];
+
+	/* save current values: */
+	for (i = 0; i < gpu->num_perfcntrs; i++)
+		gpu->last_cntrs[i] = current_cntrs[i];
+
+	return n;
+}
+
+static void update_sw_cntrs(struct msm_gpu *gpu)
+{
+	ktime_t time;
+	uint32_t elapsed;
+	unsigned long flags;
+
+	spin_lock_irqsave(&gpu->perf_lock, flags);
+	if (!gpu->perfcntr_active)
+		goto out;
+
+	time = ktime_get();
+	elapsed = ktime_to_us(ktime_sub(time, gpu->last_sample.time));
+
+	gpu->totaltime += elapsed;
+	if (gpu->last_sample.active)
+		gpu->activetime += elapsed;
+
+	gpu->last_sample.active = msm_gpu_active(gpu);
+	gpu->last_sample.time = time;
+
+out:
+	spin_unlock_irqrestore(&gpu->perf_lock, flags);
+}
+
+void msm_gpu_perfcntr_start(struct msm_gpu *gpu)
+{
+	unsigned long flags;
+
+	pm_runtime_get_sync(&gpu->pdev->dev);
+
+	spin_lock_irqsave(&gpu->perf_lock, flags);
+	/* we could dynamically enable/disable perfcntr registers too.. */
+	gpu->last_sample.active = msm_gpu_active(gpu);
+	gpu->last_sample.time = ktime_get();
+	gpu->activetime = gpu->totaltime = 0;
+	gpu->perfcntr_active = true;
+	update_hw_cntrs(gpu, 0, NULL);
+	spin_unlock_irqrestore(&gpu->perf_lock, flags);
+}
+
+void msm_gpu_perfcntr_stop(struct msm_gpu *gpu)
+{
+	gpu->perfcntr_active = false;
+	pm_runtime_put_sync(&gpu->pdev->dev);
+}
+
+/* returns -errno or # of cntrs sampled */
+int msm_gpu_perfcntr_sample(struct msm_gpu *gpu, uint32_t *activetime,
+		uint32_t *totaltime, uint32_t ncntrs, uint32_t *cntrs)
+{
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&gpu->perf_lock, flags);
+
+	if (!gpu->perfcntr_active) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	*activetime = gpu->activetime;
+	*totaltime = gpu->totaltime;
+
+	gpu->activetime = gpu->totaltime = 0;
+
+	ret = update_hw_cntrs(gpu, ncntrs, cntrs);
+
+out:
+	spin_unlock_irqrestore(&gpu->perf_lock, flags);
+
+	return ret;
+}
+
+/*
+ * Cmdstream submission/retirement:
+ */
+
+static void retire_submit(struct msm_gpu *gpu, struct msm_ringbuffer *ring,
+		struct msm_gem_submit *submit)
+{
+	int index = submit->seqno % MSM_GPU_SUBMIT_STATS_COUNT;
+	volatile struct msm_gpu_submit_stats *stats;
+	u64 elapsed, clock = 0, cycles;
+	unsigned long flags;
+
+	stats = &ring->memptrs->stats[index];
+	/* Convert 19.2Mhz alwayson ticks to nanoseconds for elapsed time */
+	elapsed = (stats->alwayson_end - stats->alwayson_start) * 10000;
+	do_div(elapsed, 192);
+
+	cycles = stats->cpcycles_end - stats->cpcycles_start;
+
+	/* Calculate the clock frequency from the number of CP cycles */
+	if (elapsed) {
+		clock = cycles * 1000;
+		do_div(clock, elapsed);
+	}
+
+	submit->queue->ctx->elapsed_ns += elapsed;
+	submit->queue->ctx->cycles     += cycles;
+
+	trace_msm_gpu_submit_retired(submit, elapsed, clock,
+		stats->alwayson_start, stats->alwayson_end);
+
+	msm_submit_retire(submit);
+
+	pm_runtime_mark_last_busy(&gpu->pdev->dev);
+
+	spin_lock_irqsave(&ring->submit_lock, flags);
+	list_del(&submit->node);
+	spin_unlock_irqrestore(&ring->submit_lock, flags);
+
+	/* Update devfreq on transition from active->idle: */
+	mutex_lock(&gpu->active_lock);
+	gpu->active_submits--;
+	WARN_ON(gpu->active_submits < 0);
+	if (!gpu->active_submits) {
+		msm_devfreq_idle(gpu);
+		pm_runtime_put_autosuspend(&gpu->pdev->dev);
+	}
+
+	mutex_unlock(&gpu->active_lock);
+
+	msm_gem_submit_put(submit);
+}
+
+static void retire_submits(struct msm_gpu *gpu)
+{
+	int i;
+
+	/* Retire the commits starting with highest priority */
+	for (i = 0; i < gpu->nr_rings; i++) {
+		struct msm_ringbuffer *ring = gpu->rb[i];
+
+		while (true) {
+			struct msm_gem_submit *submit = NULL;
+			unsigned long flags;
+
+			spin_lock_irqsave(&ring->submit_lock, flags);
+			submit = list_first_entry_or_null(&ring->submits,
+					struct msm_gem_submit, node);
+			spin_unlock_irqrestore(&ring->submit_lock, flags);
+
+			/*
+			 * If no submit, we are done.  If submit->fence hasn't
+			 * been signalled, then later submits are not signalled
+			 * either, so we are also done.
+			 */
+			if (submit && dma_fence_is_signaled(submit->hw_fence)) {
+				retire_submit(gpu, ring, submit);
+			} else {
+				break;
+			}
+		}
+	}
+
+	wake_up_all(&gpu->retire_event);
+}
+
+static void retire_worker(struct kthread_work *work)
+{
+	struct msm_gpu *gpu = container_of(work, struct msm_gpu, retire_work);
+
+	retire_submits(gpu);
+}
+
+/* call from irq handler to schedule work to retire bo's */
+void msm_gpu_retire(struct msm_gpu *gpu)
+{
+	int i;
+
+	for (i = 0; i < gpu->nr_rings; i++)
+		msm_update_fence(gpu->rb[i]->fctx, gpu->rb[i]->memptrs->fence);
+
+	kthread_queue_work(gpu->worker, &gpu->retire_work);
+	update_sw_cntrs(gpu);
+}
+
+/* add bo's to gpu's ring, and kick gpu: */
+void msm_gpu_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+{
+	struct msm_ringbuffer *ring = submit->ring;
+	unsigned long flags;
+
+	WARN_ON(!mutex_is_locked(&gpu->lock));
+
+	pm_runtime_get_sync(&gpu->pdev->dev);
+
+	msm_gpu_hw_init(gpu);
+
+	submit->seqno = submit->hw_fence->seqno;
+
+	update_sw_cntrs(gpu);
+
+	/*
+	 * ring->submits holds a ref to the submit, to deal with the case
+	 * that a submit completes before msm_ioctl_gem_submit() returns.
+	 */
+	msm_gem_submit_get(submit);
+
+	spin_lock_irqsave(&ring->submit_lock, flags);
+	list_add_tail(&submit->node, &ring->submits);
+	spin_unlock_irqrestore(&ring->submit_lock, flags);
+
+	/* Update devfreq on transition from idle->active: */
+	mutex_lock(&gpu->active_lock);
+	if (!gpu->active_submits) {
+		pm_runtime_get(&gpu->pdev->dev);
+		msm_devfreq_active(gpu);
+	}
+	gpu->active_submits++;
+	mutex_unlock(&gpu->active_lock);
+
+	gpu->funcs->submit(gpu, submit);
+	gpu->cur_ctx_seqno = submit->queue->ctx->seqno;
+
+	pm_runtime_put(&gpu->pdev->dev);
+	hangcheck_timer_reset(gpu);
+}
+
+/*
+ * Init/Cleanup:
+ */
+
+static irqreturn_t irq_handler(int irq, void *data)
+{
+	struct msm_gpu *gpu = data;
+	return gpu->funcs->irq(gpu);
+}
+
+static int get_clocks(struct platform_device *pdev, struct msm_gpu *gpu)
+{
+	int ret = devm_clk_bulk_get_all(&pdev->dev, &gpu->grp_clks);
+
+	if (ret < 1) {
+		gpu->nr_clocks = 0;
+		return ret;
+	}
+
+	gpu->nr_clocks = ret;
+
+	gpu->core_clk = msm_clk_bulk_get_clock(gpu->grp_clks,
+		gpu->nr_clocks, "core");
+
+	gpu->rbbmtimer_clk = msm_clk_bulk_get_clock(gpu->grp_clks,
+		gpu->nr_clocks, "rbbmtimer");
+
+	return 0;
+}
+
+/* Return a new address space for a msm_drm_private instance */
+struct msm_gem_address_space *
+msm_gpu_create_private_address_space(struct msm_gpu *gpu, struct task_struct *task)
+{
+	struct msm_gem_address_space *aspace = NULL;
+	if (!gpu)
+		return NULL;
+
+	/*
+	 * If the target doesn't support private address spaces then return
+	 * the global one
+	 */
+	if (gpu->funcs->create_private_address_space) {
+		aspace = gpu->funcs->create_private_address_space(gpu);
+		if (!IS_ERR(aspace))
+			aspace->pid = get_pid(task_pid(task));
+	}
+
+	if (IS_ERR_OR_NULL(aspace))
+		aspace = msm_gem_address_space_get(gpu->aspace);
+
+	return aspace;
+}
+
+int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+		struct msm_gpu *gpu, const struct msm_gpu_funcs *funcs,
+		const char *name, struct msm_gpu_config *config)
+{
+	struct msm_drm_private *priv = drm->dev_private;
+	int i, ret, nr_rings = config->nr_rings;
+	void *memptrs;
+	uint64_t memptrs_iova;
+
+	if (WARN_ON(gpu->num_perfcntrs > ARRAY_SIZE(gpu->last_cntrs)))
+		gpu->num_perfcntrs = ARRAY_SIZE(gpu->last_cntrs);
+
+	gpu->dev = drm;
+	gpu->funcs = funcs;
+	gpu->name = name;
+
+	gpu->worker = kthread_create_worker(0, "gpu-worker");
+	if (IS_ERR(gpu->worker)) {
+		ret = PTR_ERR(gpu->worker);
+		gpu->worker = NULL;
+		goto fail;
+	}
+
+	sched_set_fifo_low(gpu->worker->task);
+
+	mutex_init(&gpu->active_lock);
+	mutex_init(&gpu->lock);
+	init_waitqueue_head(&gpu->retire_event);
+	kthread_init_work(&gpu->retire_work, retire_worker);
+	kthread_init_work(&gpu->recover_work, recover_worker);
+	kthread_init_work(&gpu->fault_work, fault_worker);
+
+	priv->hangcheck_period = DRM_MSM_HANGCHECK_DEFAULT_PERIOD;
+
+	/*
+	 * If progress detection is supported, halve the hangcheck timer
+	 * duration, as it takes two iterations of the hangcheck handler
+	 * to detect a hang.
+	 */
+	if (funcs->progress)
+		priv->hangcheck_period /= 2;
+
+	timer_setup(&gpu->hangcheck_timer, hangcheck_handler, 0);
+
+	spin_lock_init(&gpu->perf_lock);
+
+
+	/* Map registers: */
+	gpu->mmio = msm_ioremap(pdev, config->ioname);
+	if (IS_ERR(gpu->mmio)) {
+		ret = PTR_ERR(gpu->mmio);
+		goto fail;
+	}
+
+	/* Get Interrupt: */
+	gpu->irq = platform_get_irq(pdev, 0);
+	if (gpu->irq < 0) {
+		ret = gpu->irq;
+		goto fail;
+	}
+
+	ret = devm_request_irq(&pdev->dev, gpu->irq, irq_handler,
+			IRQF_TRIGGER_HIGH, "gpu-irq", gpu);
+	if (ret) {
+		DRM_DEV_ERROR(drm->dev, "failed to request IRQ%u: %d\n", gpu->irq, ret);
+		goto fail;
+	}
+
+	ret = get_clocks(pdev, gpu);
+	if (ret)
+		goto fail;
+
+	gpu->ebi1_clk = msm_clk_get(pdev, "bus");
+	DBG("ebi1_clk: %p", gpu->ebi1_clk);
+	if (IS_ERR(gpu->ebi1_clk))
+		gpu->ebi1_clk = NULL;
+
+	/* Acquire regulators: */
+	gpu->gpu_reg = devm_regulator_get(&pdev->dev, "vdd");
+	DBG("gpu_reg: %p", gpu->gpu_reg);
+	if (IS_ERR(gpu->gpu_reg))
+		gpu->gpu_reg = NULL;
+
+	gpu->gpu_cx = devm_regulator_get(&pdev->dev, "vddcx");
+	DBG("gpu_cx: %p", gpu->gpu_cx);
+	if (IS_ERR(gpu->gpu_cx))
+		gpu->gpu_cx = NULL;
+
+	platform_set_drvdata(pdev, &gpu->adreno_smmu);
+
+	msm_devfreq_init(gpu);
+
+
+	gpu->aspace = gpu->funcs->create_address_space(gpu, pdev);
+
+	if (gpu->aspace == NULL)
+		DRM_DEV_INFO(drm->dev, "%s: no IOMMU, fallback to VRAM carveout!\n", name);
+	else if (IS_ERR(gpu->aspace)) {
+		ret = PTR_ERR(gpu->aspace);
+		goto fail;
+	}
+
+	memptrs = msm_gem_kernel_new(drm,
+		sizeof(struct msm_rbmemptrs) * nr_rings,
+		check_apriv(gpu, MSM_BO_WC), gpu->aspace, &gpu->memptrs_bo,
+		&memptrs_iova);
+
+	if (IS_ERR(memptrs)) {
+		ret = PTR_ERR(memptrs);
+		DRM_DEV_ERROR(drm->dev, "could not allocate memptrs: %d\n", ret);
+		goto fail;
+	}
+
+	msm_gem_object_set_name(gpu->memptrs_bo, "memptrs");
+
+	if (nr_rings > ARRAY_SIZE(gpu->rb)) {
+		DRM_DEV_INFO_ONCE(drm->dev, "Only creating %zu ringbuffers\n",
+			ARRAY_SIZE(gpu->rb));
+		nr_rings = ARRAY_SIZE(gpu->rb);
+	}
+
+	/* Create ringbuffer(s): */
+	for (i = 0; i < nr_rings; i++) {
+		gpu->rb[i] = msm_ringbuffer_new(gpu, i, memptrs, memptrs_iova);
+
+		if (IS_ERR(gpu->rb[i])) {
+			ret = PTR_ERR(gpu->rb[i]);
+			DRM_DEV_ERROR(drm->dev,
+				"could not create ringbuffer %d: %d\n", i, ret);
+			goto fail;
+		}
+
+		memptrs += sizeof(struct msm_rbmemptrs);
+		memptrs_iova += sizeof(struct msm_rbmemptrs);
+	}
+
+	gpu->nr_rings = nr_rings;
+
+	refcount_set(&gpu->sysprof_active, 1);
+
+	return 0;
+
+fail:
+	for (i = 0; i < ARRAY_SIZE(gpu->rb); i++)  {
+		msm_ringbuffer_destroy(gpu->rb[i]);
+		gpu->rb[i] = NULL;
+	}
+
+	msm_gem_kernel_put(gpu->memptrs_bo, gpu->aspace);
+
+	platform_set_drvdata(pdev, NULL);
+	return ret;
+}
+
+void msm_gpu_cleanup(struct msm_gpu *gpu)
+{
+	int i;
+
+	DBG("%s", gpu->name);
+
+	for (i = 0; i < ARRAY_SIZE(gpu->rb); i++) {
+		msm_ringbuffer_destroy(gpu->rb[i]);
+		gpu->rb[i] = NULL;
+	}
+
+	msm_gem_kernel_put(gpu->memptrs_bo, gpu->aspace);
+
+	if (!IS_ERR_OR_NULL(gpu->aspace)) {
+		gpu->aspace->mmu->funcs->detach(gpu->aspace->mmu);
+		msm_gem_address_space_put(gpu->aspace);
+	}
+
+	if (gpu->worker) {
+		kthread_destroy_worker(gpu->worker);
+	}
+
+	msm_devfreq_cleanup(gpu);
+
+	platform_set_drvdata(gpu->pdev, NULL);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gpu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gpu.h
@@ -0,0 +1,710 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MSM_GPU_H__
+#define __MSM_GPU_H__
+
+#include <linux/adreno-smmu-priv.h>
+#include <linux/clk.h>
+#include <linux/devfreq.h>
+#include <linux/interconnect.h>
+#include <linux/pm_opp.h>
+#include <linux/regulator/consumer.h>
+
+#include "msm_drv.h"
+#include "msm_fence.h"
+#include "msm_ringbuffer.h"
+#include "msm_gem.h"
+
+struct msm_gem_submit;
+struct msm_gpu_perfcntr;
+struct msm_gpu_state;
+struct msm_file_private;
+
+struct msm_gpu_config {
+	const char *ioname;
+	unsigned int nr_rings;
+};
+
+/* So far, with hardware that I've seen to date, we can have:
+ *  + zero, one, or two z180 2d cores
+ *  + a3xx or a2xx 3d core, which share a common CP (the firmware
+ *    for the CP seems to implement some different PM4 packet types
+ *    but the basics of cmdstream submission are the same)
+ *
+ * Which means that the eventual complete "class" hierarchy, once
+ * support for all past and present hw is in place, becomes:
+ *  + msm_gpu
+ *    + adreno_gpu
+ *      + a3xx_gpu
+ *      + a2xx_gpu
+ *    + z180_gpu
+ */
+struct msm_gpu_funcs {
+	int (*get_param)(struct msm_gpu *gpu, struct msm_file_private *ctx,
+			 uint32_t param, uint64_t *value, uint32_t *len);
+	int (*set_param)(struct msm_gpu *gpu, struct msm_file_private *ctx,
+			 uint32_t param, uint64_t value, uint32_t len);
+	int (*hw_init)(struct msm_gpu *gpu);
+
+	/**
+	 * @ucode_load: Optional hook to upload fw to GEM objs
+	 */
+	int (*ucode_load)(struct msm_gpu *gpu);
+
+	int (*pm_suspend)(struct msm_gpu *gpu);
+	int (*pm_resume)(struct msm_gpu *gpu);
+	void (*submit)(struct msm_gpu *gpu, struct msm_gem_submit *submit);
+	void (*flush)(struct msm_gpu *gpu, struct msm_ringbuffer *ring);
+	irqreturn_t (*irq)(struct msm_gpu *irq);
+	struct msm_ringbuffer *(*active_ring)(struct msm_gpu *gpu);
+	void (*recover)(struct msm_gpu *gpu);
+	void (*destroy)(struct msm_gpu *gpu);
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
+	/* show GPU status in debugfs: */
+	void (*show)(struct msm_gpu *gpu, struct msm_gpu_state *state,
+			struct drm_printer *p);
+	/* for generation specific debugfs: */
+	void (*debugfs_init)(struct msm_gpu *gpu, struct drm_minor *minor);
+#endif
+	/* note: gpu_busy() can assume that we have been pm_resumed */
+	u64 (*gpu_busy)(struct msm_gpu *gpu, unsigned long *out_sample_rate);
+	struct msm_gpu_state *(*gpu_state_get)(struct msm_gpu *gpu);
+	int (*gpu_state_put)(struct msm_gpu_state *state);
+	unsigned long (*gpu_get_freq)(struct msm_gpu *gpu);
+	/* note: gpu_set_freq() can assume that we have been pm_resumed */
+	void (*gpu_set_freq)(struct msm_gpu *gpu, struct dev_pm_opp *opp,
+			     bool suspended);
+	struct msm_gem_address_space *(*create_address_space)
+		(struct msm_gpu *gpu, struct platform_device *pdev);
+	struct msm_gem_address_space *(*create_private_address_space)
+		(struct msm_gpu *gpu);
+	uint32_t (*get_rptr)(struct msm_gpu *gpu, struct msm_ringbuffer *ring);
+
+	/**
+	 * progress: Has the GPU made progress?
+	 *
+	 * Return true if GPU position in cmdstream has advanced (or changed)
+	 * since the last call.  To avoid false negatives, this should account
+	 * for cmdstream that is buffered in this FIFO upstream of the CP fw.
+	 */
+	bool (*progress)(struct msm_gpu *gpu, struct msm_ringbuffer *ring);
+};
+
+/* Additional state for iommu faults: */
+struct msm_gpu_fault_info {
+	u64 ttbr0;
+	unsigned long iova;
+	int flags;
+	const char *type;
+	const char *block;
+};
+
+/**
+ * struct msm_gpu_devfreq - devfreq related state
+ */
+struct msm_gpu_devfreq {
+	/** devfreq: devfreq instance */
+	struct devfreq *devfreq;
+
+	/** lock: lock for "suspended", "busy_cycles", and "time" */
+	struct mutex lock;
+
+	/**
+	 * idle_freq:
+	 *
+	 * Shadow frequency used while the GPU is idle.  From the PoV of
+	 * the devfreq governor, we are continuing to sample busyness and
+	 * adjust frequency while the GPU is idle, but we use this shadow
+	 * value as the GPU is actually clamped to minimum frequency while
+	 * it is inactive.
+	 */
+	unsigned long idle_freq;
+
+	/**
+	 * boost_constraint:
+	 *
+	 * A PM QoS constraint to boost min freq for a period of time
+	 * until the boost expires.
+	 */
+	struct dev_pm_qos_request boost_freq;
+
+	/**
+	 * busy_cycles: Last busy counter value, for calculating elapsed busy
+	 * cycles since last sampling period.
+	 */
+	u64 busy_cycles;
+
+	/** time: Time of last sampling period. */
+	ktime_t time;
+
+	/** idle_time: Time of last transition to idle: */
+	ktime_t idle_time;
+
+	/**
+	 * idle_work:
+	 *
+	 * Used to delay clamping to idle freq on active->idle transition.
+	 */
+	struct msm_hrtimer_work idle_work;
+
+	/**
+	 * boost_work:
+	 *
+	 * Used to reset the boost_constraint after the boost period has
+	 * elapsed
+	 */
+	struct msm_hrtimer_work boost_work;
+
+	/** suspended: tracks if we're suspended */
+	bool suspended;
+};
+
+struct msm_gpu {
+	const char *name;
+	struct drm_device *dev;
+	struct platform_device *pdev;
+	const struct msm_gpu_funcs *funcs;
+
+	struct adreno_smmu_priv adreno_smmu;
+
+	/* performance counters (hw & sw): */
+	spinlock_t perf_lock;
+	bool perfcntr_active;
+	struct {
+		bool active;
+		ktime_t time;
+	} last_sample;
+	uint32_t totaltime, activetime;    /* sw counters */
+	uint32_t last_cntrs[5];            /* hw counters */
+	const struct msm_gpu_perfcntr *perfcntrs;
+	uint32_t num_perfcntrs;
+
+	struct msm_ringbuffer *rb[MSM_GPU_MAX_RINGS];
+	int nr_rings;
+
+	/**
+	 * sysprof_active:
+	 *
+	 * The count of contexts that have enabled system profiling.
+	 */
+	refcount_t sysprof_active;
+
+	/**
+	 * cur_ctx_seqno:
+	 *
+	 * The ctx->seqno value of the last context to submit rendering,
+	 * and the one with current pgtables installed (for generations
+	 * that support per-context pgtables).  Tracked by seqno rather
+	 * than pointer value to avoid dangling pointers, and cases where
+	 * a ctx can be freed and a new one created with the same address.
+	 */
+	int cur_ctx_seqno;
+
+	/**
+	 * lock:
+	 *
+	 * General lock for serializing all the gpu things.
+	 *
+	 * TODO move to per-ring locking where feasible (ie. submit/retire
+	 * path, etc)
+	 */
+	struct mutex lock;
+
+	/**
+	 * active_submits:
+	 *
+	 * The number of submitted but not yet retired submits, used to
+	 * determine transitions between active and idle.
+	 *
+	 * Protected by active_lock
+	 */
+	int active_submits;
+
+	/** lock: protects active_submits and idle/active transitions */
+	struct mutex active_lock;
+
+	/* does gpu need hw_init? */
+	bool needs_hw_init;
+
+	/**
+	 * global_faults: number of GPU hangs not attributed to a particular
+	 * address space
+	 */
+	int global_faults;
+
+	void __iomem *mmio;
+	int irq;
+
+	struct msm_gem_address_space *aspace;
+
+	/* Power Control: */
+	struct regulator *gpu_reg, *gpu_cx;
+	struct clk_bulk_data *grp_clks;
+	int nr_clocks;
+	struct clk *ebi1_clk, *core_clk, *rbbmtimer_clk;
+	uint32_t fast_rate;
+
+	/* Hang and Inactivity Detection:
+	 */
+#define DRM_MSM_INACTIVE_PERIOD   66 /* in ms (roughly four frames) */
+
+#define DRM_MSM_HANGCHECK_DEFAULT_PERIOD 500 /* in ms */
+#define DRM_MSM_HANGCHECK_PROGRESS_RETRIES 3
+	struct timer_list hangcheck_timer;
+
+	/* Fault info for most recent iova fault: */
+	struct msm_gpu_fault_info fault_info;
+
+	/* work for handling GPU ioval faults: */
+	struct kthread_work fault_work;
+
+	/* work for handling GPU recovery: */
+	struct kthread_work recover_work;
+
+	/** retire_event: notified when submits are retired: */
+	wait_queue_head_t retire_event;
+
+	/* work for handling active-list retiring: */
+	struct kthread_work retire_work;
+
+	/* worker for retire/recover: */
+	struct kthread_worker *worker;
+
+	struct drm_gem_object *memptrs_bo;
+
+	struct msm_gpu_devfreq devfreq;
+
+	uint32_t suspend_count;
+
+	struct msm_gpu_state *crashstate;
+
+	/* True if the hardware supports expanded apriv (a650 and newer) */
+	bool hw_apriv;
+
+	/**
+	 * @allow_relocs: allow relocs in SUBMIT ioctl
+	 *
+	 * Mesa won't use relocs for driver version 1.4.0 and later.  This
+	 * switch-over happened early enough in mesa a6xx bringup that we
+	 * can disallow relocs for a6xx and newer.
+	 */
+	bool allow_relocs;
+
+	struct thermal_cooling_device *cooling;
+};
+
+static inline struct msm_gpu *dev_to_gpu(struct device *dev)
+{
+	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(dev);
+
+	if (!adreno_smmu)
+		return NULL;
+
+	return container_of(adreno_smmu, struct msm_gpu, adreno_smmu);
+}
+
+/* It turns out that all targets use the same ringbuffer size */
+#define MSM_GPU_RINGBUFFER_SZ SZ_32K
+#define MSM_GPU_RINGBUFFER_BLKSIZE 32
+
+#define MSM_GPU_RB_CNTL_DEFAULT \
+		(AXXX_CP_RB_CNTL_BUFSZ(ilog2(MSM_GPU_RINGBUFFER_SZ / 8)) | \
+		AXXX_CP_RB_CNTL_BLKSZ(ilog2(MSM_GPU_RINGBUFFER_BLKSIZE / 8)))
+
+static inline bool msm_gpu_active(struct msm_gpu *gpu)
+{
+	int i;
+
+	for (i = 0; i < gpu->nr_rings; i++) {
+		struct msm_ringbuffer *ring = gpu->rb[i];
+
+		if (fence_after(ring->fctx->last_fence, ring->memptrs->fence))
+			return true;
+	}
+
+	return false;
+}
+
+/* Perf-Counters:
+ * The select_reg and select_val are just there for the benefit of the child
+ * class that actually enables the perf counter..  but msm_gpu base class
+ * will handle sampling/displaying the counters.
+ */
+
+struct msm_gpu_perfcntr {
+	uint32_t select_reg;
+	uint32_t sample_reg;
+	uint32_t select_val;
+	const char *name;
+};
+
+/*
+ * The number of priority levels provided by drm gpu scheduler.  The
+ * DRM_SCHED_PRIORITY_KERNEL priority level is treated specially in some
+ * cases, so we don't use it (no need for kernel generated jobs).
+ */
+#define NR_SCHED_PRIORITIES (1 + DRM_SCHED_PRIORITY_LOW - DRM_SCHED_PRIORITY_HIGH)
+
+/**
+ * struct msm_file_private - per-drm_file context
+ *
+ * @queuelock:    synchronizes access to submitqueues list
+ * @submitqueues: list of &msm_gpu_submitqueue created by userspace
+ * @queueid:      counter incremented each time a submitqueue is created,
+ *                used to assign &msm_gpu_submitqueue.id
+ * @aspace:       the per-process GPU address-space
+ * @ref:          reference count
+ * @seqno:        unique per process seqno
+ */
+struct msm_file_private {
+	rwlock_t queuelock;
+	struct list_head submitqueues;
+	int queueid;
+	struct msm_gem_address_space *aspace;
+	struct kref ref;
+	int seqno;
+
+	/**
+	 * sysprof:
+	 *
+	 * The value of MSM_PARAM_SYSPROF set by userspace.  This is
+	 * intended to be used by system profiling tools like Mesa's
+	 * pps-producer (perfetto), and restricted to CAP_SYS_ADMIN.
+	 *
+	 * Setting a value of 1 will preserve performance counters across
+	 * context switches.  Setting a value of 2 will in addition
+	 * suppress suspend.  (Performance counters lose state across
+	 * power collapse, which is undesirable for profiling in some
+	 * cases.)
+	 *
+	 * The value automatically reverts to zero when the drm device
+	 * file is closed.
+	 */
+	int sysprof;
+
+	/**
+	 * comm: Overridden task comm, see MSM_PARAM_COMM
+	 *
+	 * Accessed under msm_gpu::lock
+	 */
+	char *comm;
+
+	/**
+	 * cmdline: Overridden task cmdline, see MSM_PARAM_CMDLINE
+	 *
+	 * Accessed under msm_gpu::lock
+	 */
+	char *cmdline;
+
+	/**
+	 * elapsed:
+	 *
+	 * The total (cumulative) elapsed time GPU was busy with rendering
+	 * from this context in ns.
+	 */
+	uint64_t elapsed_ns;
+
+	/**
+	 * cycles:
+	 *
+	 * The total (cumulative) GPU cycles elapsed attributed to this
+	 * context.
+	 */
+	uint64_t cycles;
+
+	/**
+	 * entities:
+	 *
+	 * Table of per-priority-level sched entities used by submitqueues
+	 * associated with this &drm_file.  Because some userspace apps
+	 * make assumptions about rendering from multiple gl contexts
+	 * (of the same priority) within the process happening in FIFO
+	 * order without requiring any fencing beyond MakeCurrent(), we
+	 * create at most one &drm_sched_entity per-process per-priority-
+	 * level.
+	 */
+	struct drm_sched_entity *entities[NR_SCHED_PRIORITIES * MSM_GPU_MAX_RINGS];
+};
+
+/**
+ * msm_gpu_convert_priority - Map userspace priority to ring # and sched priority
+ *
+ * @gpu:        the gpu instance
+ * @prio:       the userspace priority level
+ * @ring_nr:    [out] the ringbuffer the userspace priority maps to
+ * @sched_prio: [out] the gpu scheduler priority level which the userspace
+ *              priority maps to
+ *
+ * With drm/scheduler providing it's own level of prioritization, our total
+ * number of available priority levels is (nr_rings * NR_SCHED_PRIORITIES).
+ * Each ring is associated with it's own scheduler instance.  However, our
+ * UABI is that lower numerical values are higher priority.  So mapping the
+ * single userspace priority level into ring_nr and sched_prio takes some
+ * care.  The userspace provided priority (when a submitqueue is created)
+ * is mapped to ring nr and scheduler priority as such:
+ *
+ *   ring_nr    = userspace_prio / NR_SCHED_PRIORITIES
+ *   sched_prio = NR_SCHED_PRIORITIES -
+ *                (userspace_prio % NR_SCHED_PRIORITIES) - 1
+ *
+ * This allows generations without preemption (nr_rings==1) to have some
+ * amount of prioritization, and provides more priority levels for gens
+ * that do have preemption.
+ */
+static inline int msm_gpu_convert_priority(struct msm_gpu *gpu, int prio,
+		unsigned *ring_nr, enum drm_sched_priority *sched_prio)
+{
+	unsigned rn, sp;
+
+	rn = div_u64_rem(prio, NR_SCHED_PRIORITIES, &sp);
+
+	/* invert sched priority to map to higher-numeric-is-higher-
+	 * priority convention
+	 */
+	sp = NR_SCHED_PRIORITIES - sp - 1;
+
+	if (rn >= gpu->nr_rings)
+		return -EINVAL;
+
+	*ring_nr = rn;
+	*sched_prio = sp;
+
+	return 0;
+}
+
+/**
+ * struct msm_gpu_submitqueues - Userspace created context.
+ *
+ * A submitqueue is associated with a gl context or vk queue (or equiv)
+ * in userspace.
+ *
+ * @id:        userspace id for the submitqueue, unique within the drm_file
+ * @flags:     userspace flags for the submitqueue, specified at creation
+ *             (currently unusued)
+ * @ring_nr:   the ringbuffer used by this submitqueue, which is determined
+ *             by the submitqueue's priority
+ * @faults:    the number of GPU hangs associated with this submitqueue
+ * @last_fence: the sequence number of the last allocated fence (for error
+ *             checking)
+ * @ctx:       the per-drm_file context associated with the submitqueue (ie.
+ *             which set of pgtables do submits jobs associated with the
+ *             submitqueue use)
+ * @node:      node in the context's list of submitqueues
+ * @fence_idr: maps fence-id to dma_fence for userspace visible fence
+ *             seqno, protected by submitqueue lock
+ * @idr_lock:  for serializing access to fence_idr
+ * @lock:      submitqueue lock for serializing submits on a queue
+ * @ref:       reference count
+ * @entity:    the submit job-queue
+ */
+struct msm_gpu_submitqueue {
+	int id;
+	u32 flags;
+	u32 ring_nr;
+	int faults;
+	uint32_t last_fence;
+	struct msm_file_private *ctx;
+	struct list_head node;
+	struct idr fence_idr;
+	struct spinlock idr_lock;
+	struct mutex lock;
+	struct kref ref;
+	struct drm_sched_entity *entity;
+};
+
+struct msm_gpu_state_bo {
+	u64 iova;
+	size_t size;
+	void *data;
+	bool encoded;
+	char name[32];
+};
+
+struct msm_gpu_state {
+	struct kref ref;
+	struct timespec64 time;
+
+	struct {
+		u64 iova;
+		u32 fence;
+		u32 seqno;
+		u32 rptr;
+		u32 wptr;
+		void *data;
+		int data_size;
+		bool encoded;
+	} ring[MSM_GPU_MAX_RINGS];
+
+	int nr_registers;
+	u32 *registers;
+
+	u32 rbbm_status;
+
+	char *comm;
+	char *cmd;
+
+	struct msm_gpu_fault_info fault_info;
+
+	int nr_bos;
+	struct msm_gpu_state_bo *bos;
+};
+
+static inline void gpu_write(struct msm_gpu *gpu, u32 reg, u32 data)
+{
+	msm_writel(data, gpu->mmio + (reg << 2));
+}
+
+static inline u32 gpu_read(struct msm_gpu *gpu, u32 reg)
+{
+	return msm_readl(gpu->mmio + (reg << 2));
+}
+
+static inline void gpu_rmw(struct msm_gpu *gpu, u32 reg, u32 mask, u32 or)
+{
+	msm_rmw(gpu->mmio + (reg << 2), mask, or);
+}
+
+static inline u64 gpu_read64(struct msm_gpu *gpu, u32 reg)
+{
+	u64 val;
+
+	/*
+	 * Why not a readq here? Two reasons: 1) many of the LO registers are
+	 * not quad word aligned and 2) the GPU hardware designers have a bit
+	 * of a history of putting registers where they fit, especially in
+	 * spins. The longer a GPU family goes the higher the chance that
+	 * we'll get burned.  We could do a series of validity checks if we
+	 * wanted to, but really is a readq() that much better? Nah.
+	 */
+
+	/*
+	 * For some lo/hi registers (like perfcounters), the hi value is latched
+	 * when the lo is read, so make sure to read the lo first to trigger
+	 * that
+	 */
+	val = (u64) msm_readl(gpu->mmio + (reg << 2));
+	val |= ((u64) msm_readl(gpu->mmio + ((reg + 1) << 2)) << 32);
+
+	return val;
+}
+
+static inline void gpu_write64(struct msm_gpu *gpu, u32 reg, u64 val)
+{
+	/* Why not a writeq here? Read the screed above */
+	msm_writel(lower_32_bits(val), gpu->mmio + (reg << 2));
+	msm_writel(upper_32_bits(val), gpu->mmio + ((reg + 1) << 2));
+}
+
+int msm_gpu_pm_suspend(struct msm_gpu *gpu);
+int msm_gpu_pm_resume(struct msm_gpu *gpu);
+
+void msm_gpu_show_fdinfo(struct msm_gpu *gpu, struct msm_file_private *ctx,
+			 struct drm_printer *p);
+
+int msm_submitqueue_init(struct drm_device *drm, struct msm_file_private *ctx);
+struct msm_gpu_submitqueue *msm_submitqueue_get(struct msm_file_private *ctx,
+		u32 id);
+int msm_submitqueue_create(struct drm_device *drm,
+		struct msm_file_private *ctx,
+		u32 prio, u32 flags, u32 *id);
+int msm_submitqueue_query(struct drm_device *drm, struct msm_file_private *ctx,
+		struct drm_msm_submitqueue_query *args);
+int msm_submitqueue_remove(struct msm_file_private *ctx, u32 id);
+void msm_submitqueue_close(struct msm_file_private *ctx);
+
+void msm_submitqueue_destroy(struct kref *kref);
+
+int msm_file_private_set_sysprof(struct msm_file_private *ctx,
+				 struct msm_gpu *gpu, int sysprof);
+void __msm_file_private_destroy(struct kref *kref);
+
+static inline void msm_file_private_put(struct msm_file_private *ctx)
+{
+	kref_put(&ctx->ref, __msm_file_private_destroy);
+}
+
+static inline struct msm_file_private *msm_file_private_get(
+	struct msm_file_private *ctx)
+{
+	kref_get(&ctx->ref);
+	return ctx;
+}
+
+void msm_devfreq_init(struct msm_gpu *gpu);
+void msm_devfreq_cleanup(struct msm_gpu *gpu);
+void msm_devfreq_resume(struct msm_gpu *gpu);
+void msm_devfreq_suspend(struct msm_gpu *gpu);
+void msm_devfreq_boost(struct msm_gpu *gpu, unsigned factor);
+void msm_devfreq_active(struct msm_gpu *gpu);
+void msm_devfreq_idle(struct msm_gpu *gpu);
+
+int msm_gpu_hw_init(struct msm_gpu *gpu);
+
+void msm_gpu_perfcntr_start(struct msm_gpu *gpu);
+void msm_gpu_perfcntr_stop(struct msm_gpu *gpu);
+int msm_gpu_perfcntr_sample(struct msm_gpu *gpu, uint32_t *activetime,
+		uint32_t *totaltime, uint32_t ncntrs, uint32_t *cntrs);
+
+void msm_gpu_retire(struct msm_gpu *gpu);
+void msm_gpu_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit);
+
+int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+		struct msm_gpu *gpu, const struct msm_gpu_funcs *funcs,
+		const char *name, struct msm_gpu_config *config);
+
+struct msm_gem_address_space *
+msm_gpu_create_private_address_space(struct msm_gpu *gpu, struct task_struct *task);
+
+void msm_gpu_cleanup(struct msm_gpu *gpu);
+
+struct msm_gpu *adreno_load_gpu(struct drm_device *dev);
+void __init adreno_register(void);
+void __exit adreno_unregister(void);
+
+static inline void msm_submitqueue_put(struct msm_gpu_submitqueue *queue)
+{
+	if (queue)
+		kref_put(&queue->ref, msm_submitqueue_destroy);
+}
+
+static inline struct msm_gpu_state *msm_gpu_crashstate_get(struct msm_gpu *gpu)
+{
+	struct msm_gpu_state *state = NULL;
+
+	mutex_lock(&gpu->lock);
+
+	if (gpu->crashstate) {
+		kref_get(&gpu->crashstate->ref);
+		state = gpu->crashstate;
+	}
+
+	mutex_unlock(&gpu->lock);
+
+	return state;
+}
+
+static inline void msm_gpu_crashstate_put(struct msm_gpu *gpu)
+{
+	mutex_lock(&gpu->lock);
+
+	if (gpu->crashstate) {
+		if (gpu->funcs->gpu_state_put(gpu->crashstate))
+			gpu->crashstate = NULL;
+	}
+
+	mutex_unlock(&gpu->lock);
+}
+
+/*
+ * Simple macro to semi-cleanly add the MAP_PRIV flag for targets that can
+ * support expanded privileges
+ */
+#define check_apriv(gpu, flags) \
+	(((gpu)->hw_apriv ? MSM_BO_MAP_PRIV : 0) | (flags))
+
+
+#endif /* __MSM_GPU_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gpu_devfreq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gpu_devfreq.c
@@ -0,0 +1,369 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include "msm_gpu.h"
+#include "msm_gpu_trace.h"
+
+#include <linux/devfreq.h>
+#include <linux/devfreq_cooling.h>
+#include <linux/math64.h>
+#include <linux/units.h>
+
+/*
+ * Power Management:
+ */
+
+static int msm_devfreq_target(struct device *dev, unsigned long *freq,
+		u32 flags)
+{
+	struct msm_gpu *gpu = dev_to_gpu(dev);
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+	struct dev_pm_opp *opp;
+
+	/*
+	 * Note that devfreq_recommended_opp() can modify the freq
+	 * to something that actually is in the opp table:
+	 */
+	opp = devfreq_recommended_opp(dev, freq, flags);
+	if (IS_ERR(opp))
+		return PTR_ERR(opp);
+
+	trace_msm_gpu_freq_change(dev_pm_opp_get_freq(opp));
+
+	/*
+	 * If the GPU is idle, devfreq is not aware, so just stash
+	 * the new target freq (to use when we return to active)
+	 */
+	if (df->idle_freq) {
+		df->idle_freq = *freq;
+		dev_pm_opp_put(opp);
+		return 0;
+	}
+
+	if (gpu->funcs->gpu_set_freq) {
+		mutex_lock(&df->lock);
+		gpu->funcs->gpu_set_freq(gpu, opp, df->suspended);
+		mutex_unlock(&df->lock);
+	} else {
+		dev_pm_opp_set_rate(dev, *freq);
+	}
+
+	dev_pm_opp_put(opp);
+
+	return 0;
+}
+
+static unsigned long get_freq(struct msm_gpu *gpu)
+{
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+
+	/*
+	 * If the GPU is idle, use the shadow/saved freq to avoid
+	 * confusing devfreq (which is unaware that we are switching
+	 * to lowest freq until the device is active again)
+	 */
+	if (df->idle_freq)
+		return df->idle_freq;
+
+	if (gpu->funcs->gpu_get_freq)
+		return gpu->funcs->gpu_get_freq(gpu);
+
+	return clk_get_rate(gpu->core_clk);
+}
+
+static int msm_devfreq_get_dev_status(struct device *dev,
+		struct devfreq_dev_status *status)
+{
+	struct msm_gpu *gpu = dev_to_gpu(dev);
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+	u64 busy_cycles, busy_time;
+	unsigned long sample_rate;
+	ktime_t time;
+
+	mutex_lock(&df->lock);
+
+	status->current_frequency = get_freq(gpu);
+	time = ktime_get();
+	status->total_time = ktime_us_delta(time, df->time);
+	df->time = time;
+
+	if (df->suspended) {
+		mutex_unlock(&df->lock);
+		status->busy_time = 0;
+		return 0;
+	}
+
+	busy_cycles = gpu->funcs->gpu_busy(gpu, &sample_rate);
+	busy_time = busy_cycles - df->busy_cycles;
+	df->busy_cycles = busy_cycles;
+
+	mutex_unlock(&df->lock);
+
+	busy_time *= USEC_PER_SEC;
+	busy_time = div64_ul(busy_time, sample_rate);
+	if (WARN_ON(busy_time > ~0LU))
+		busy_time = ~0LU;
+
+	status->busy_time = busy_time;
+
+	return 0;
+}
+
+static int msm_devfreq_get_cur_freq(struct device *dev, unsigned long *freq)
+{
+	*freq = get_freq(dev_to_gpu(dev));
+
+	return 0;
+}
+
+static struct devfreq_dev_profile msm_devfreq_profile = {
+	.timer = DEVFREQ_TIMER_DELAYED,
+	.polling_ms = 50,
+	.target = msm_devfreq_target,
+	.get_dev_status = msm_devfreq_get_dev_status,
+	.get_cur_freq = msm_devfreq_get_cur_freq,
+};
+
+static void msm_devfreq_boost_work(struct kthread_work *work);
+static void msm_devfreq_idle_work(struct kthread_work *work);
+
+static bool has_devfreq(struct msm_gpu *gpu)
+{
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+	return !!df->devfreq;
+}
+
+void msm_devfreq_init(struct msm_gpu *gpu)
+{
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+	struct msm_drm_private *priv = gpu->dev->dev_private;
+
+	/* We need target support to do devfreq */
+	if (!gpu->funcs->gpu_busy)
+		return;
+
+	/*
+	 * Setup default values for simple_ondemand governor tuning.  We
+	 * want to throttle up at 50% load for the double-buffer case,
+	 * where due to stalling waiting for vblank we could get stuck
+	 * at (for ex) 30fps at 50% utilization.
+	 */
+	priv->gpu_devfreq_config.upthreshold = 50;
+	priv->gpu_devfreq_config.downdifferential = 10;
+
+	mutex_init(&df->lock);
+
+	dev_pm_qos_add_request(&gpu->pdev->dev, &df->boost_freq,
+			       DEV_PM_QOS_MIN_FREQUENCY, 0);
+
+	msm_devfreq_profile.initial_freq = gpu->fast_rate;
+
+	/*
+	 * Don't set the freq_table or max_state and let devfreq build the table
+	 * from OPP
+	 * After a deferred probe, these may have be left to non-zero values,
+	 * so set them back to zero before creating the devfreq device
+	 */
+	msm_devfreq_profile.freq_table = NULL;
+	msm_devfreq_profile.max_state = 0;
+
+	df->devfreq = devm_devfreq_add_device(&gpu->pdev->dev,
+			&msm_devfreq_profile, DEVFREQ_GOV_SIMPLE_ONDEMAND,
+			&priv->gpu_devfreq_config);
+
+	if (IS_ERR(df->devfreq)) {
+		DRM_DEV_ERROR(&gpu->pdev->dev, "Couldn't initialize GPU devfreq\n");
+		dev_pm_qos_remove_request(&df->boost_freq);
+		df->devfreq = NULL;
+		return;
+	}
+
+	devfreq_suspend_device(df->devfreq);
+
+	gpu->cooling = of_devfreq_cooling_register(gpu->pdev->dev.of_node, df->devfreq);
+	if (IS_ERR(gpu->cooling)) {
+		DRM_DEV_ERROR(&gpu->pdev->dev,
+				"Couldn't register GPU cooling device\n");
+		gpu->cooling = NULL;
+	}
+
+	msm_hrtimer_work_init(&df->boost_work, gpu->worker, msm_devfreq_boost_work,
+			      CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+	msm_hrtimer_work_init(&df->idle_work, gpu->worker, msm_devfreq_idle_work,
+			      CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+}
+
+static void cancel_idle_work(struct msm_gpu_devfreq *df)
+{
+	hrtimer_cancel(&df->idle_work.timer);
+	kthread_cancel_work_sync(&df->idle_work.work);
+}
+
+static void cancel_boost_work(struct msm_gpu_devfreq *df)
+{
+	hrtimer_cancel(&df->boost_work.timer);
+	kthread_cancel_work_sync(&df->boost_work.work);
+}
+
+void msm_devfreq_cleanup(struct msm_gpu *gpu)
+{
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+
+	if (!has_devfreq(gpu))
+		return;
+
+	devfreq_cooling_unregister(gpu->cooling);
+	dev_pm_qos_remove_request(&df->boost_freq);
+}
+
+void msm_devfreq_resume(struct msm_gpu *gpu)
+{
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+	unsigned long sample_rate;
+
+	if (!has_devfreq(gpu))
+		return;
+
+	mutex_lock(&df->lock);
+	df->busy_cycles = gpu->funcs->gpu_busy(gpu, &sample_rate);
+	df->time = ktime_get();
+	df->suspended = false;
+	mutex_unlock(&df->lock);
+
+	devfreq_resume_device(df->devfreq);
+}
+
+void msm_devfreq_suspend(struct msm_gpu *gpu)
+{
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+
+	if (!has_devfreq(gpu))
+		return;
+
+	mutex_lock(&df->lock);
+	df->suspended = true;
+	mutex_unlock(&df->lock);
+
+	devfreq_suspend_device(df->devfreq);
+
+	cancel_idle_work(df);
+	cancel_boost_work(df);
+}
+
+static void msm_devfreq_boost_work(struct kthread_work *work)
+{
+	struct msm_gpu_devfreq *df = container_of(work,
+			struct msm_gpu_devfreq, boost_work.work);
+
+	dev_pm_qos_update_request(&df->boost_freq, 0);
+}
+
+void msm_devfreq_boost(struct msm_gpu *gpu, unsigned factor)
+{
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+	uint64_t freq;
+
+	if (!has_devfreq(gpu))
+		return;
+
+	freq = get_freq(gpu);
+	freq *= factor;
+
+	/*
+	 * A nice little trap is that PM QoS operates in terms of KHz,
+	 * while devfreq operates in terms of Hz:
+	 */
+	do_div(freq, HZ_PER_KHZ);
+
+	dev_pm_qos_update_request(&df->boost_freq, freq);
+
+	msm_hrtimer_queue_work(&df->boost_work,
+			       ms_to_ktime(msm_devfreq_profile.polling_ms),
+			       HRTIMER_MODE_REL);
+}
+
+void msm_devfreq_active(struct msm_gpu *gpu)
+{
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+	unsigned int idle_time;
+	unsigned long target_freq;
+
+	if (!has_devfreq(gpu))
+		return;
+
+	/*
+	 * Cancel any pending transition to idle frequency:
+	 */
+	cancel_idle_work(df);
+
+	/*
+	 * Hold devfreq lock to synchronize with get_dev_status()/
+	 * target() callbacks
+	 */
+	mutex_lock(&df->devfreq->lock);
+
+	target_freq = df->idle_freq;
+
+	idle_time = ktime_to_ms(ktime_sub(ktime_get(), df->idle_time));
+
+	df->idle_freq = 0;
+
+	/*
+	 * We could have become active again before the idle work had a
+	 * chance to run, in which case the df->idle_freq would have
+	 * still been zero.  In this case, no need to change freq.
+	 */
+	if (target_freq)
+		msm_devfreq_target(&gpu->pdev->dev, &target_freq, 0);
+
+	mutex_unlock(&df->devfreq->lock);
+
+	/*
+	 * If we've been idle for a significant fraction of a polling
+	 * interval, then we won't meet the threshold of busyness for
+	 * the governor to ramp up the freq.. so give some boost
+	 */
+	if (idle_time > msm_devfreq_profile.polling_ms) {
+		msm_devfreq_boost(gpu, 2);
+	}
+}
+
+
+static void msm_devfreq_idle_work(struct kthread_work *work)
+{
+	struct msm_gpu_devfreq *df = container_of(work,
+			struct msm_gpu_devfreq, idle_work.work);
+	struct msm_gpu *gpu = container_of(df, struct msm_gpu, devfreq);
+	struct msm_drm_private *priv = gpu->dev->dev_private;
+	unsigned long idle_freq, target_freq = 0;
+
+	/*
+	 * Hold devfreq lock to synchronize with get_dev_status()/
+	 * target() callbacks
+	 */
+	mutex_lock(&df->devfreq->lock);
+
+	idle_freq = get_freq(gpu);
+
+	if (priv->gpu_clamp_to_idle)
+		msm_devfreq_target(&gpu->pdev->dev, &target_freq, 0);
+
+	df->idle_time = ktime_get();
+	df->idle_freq = idle_freq;
+
+	mutex_unlock(&df->devfreq->lock);
+}
+
+void msm_devfreq_idle(struct msm_gpu *gpu)
+{
+	struct msm_gpu_devfreq *df = &gpu->devfreq;
+
+	if (!has_devfreq(gpu))
+		return;
+
+	msm_hrtimer_queue_work(&df->idle_work, ms_to_ktime(1),
+			       HRTIMER_MODE_REL);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gpu_trace.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gpu_trace.h
@@ -0,0 +1,184 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#if !defined(_MSM_GPU_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
+#define _MSM_GPU_TRACE_H_
+
+#include <linux/tracepoint.h>
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM drm_msm_gpu
+#define TRACE_INCLUDE_FILE msm_gpu_trace
+
+TRACE_EVENT(msm_gpu_submit,
+	    TP_PROTO(pid_t pid, u32 ringid, u32 id, u32 nr_bos, u32 nr_cmds),
+	    TP_ARGS(pid, ringid, id, nr_bos, nr_cmds),
+	    TP_STRUCT__entry(
+		    __field(pid_t, pid)
+		    __field(u32, id)
+		    __field(u32, ringid)
+		    __field(u32, nr_cmds)
+		    __field(u32, nr_bos)
+		    ),
+	    TP_fast_assign(
+		    __entry->pid = pid;
+		    __entry->id = id;
+		    __entry->ringid = ringid;
+		    __entry->nr_bos = nr_bos;
+		    __entry->nr_cmds = nr_cmds
+		    ),
+	    TP_printk("id=%d pid=%d ring=%d bos=%d cmds=%d",
+		    __entry->id, __entry->pid, __entry->ringid,
+		    __entry->nr_bos, __entry->nr_cmds)
+);
+
+TRACE_EVENT(msm_gpu_submit_flush,
+	    TP_PROTO(struct msm_gem_submit *submit, u64 ticks),
+	    TP_ARGS(submit, ticks),
+	    TP_STRUCT__entry(
+		    __field(pid_t, pid)
+		    __field(u32, id)
+		    __field(u32, ringid)
+		    __field(u32, seqno)
+		    __field(u64, ticks)
+		    ),
+	    TP_fast_assign(
+		    __entry->pid = pid_nr(submit->pid);
+		    __entry->id = submit->ident;
+		    __entry->ringid = submit->ring->id;
+		    __entry->seqno = submit->seqno;
+		    __entry->ticks = ticks;
+		    ),
+	    TP_printk("id=%d pid=%d ring=%d:%d ticks=%lld",
+		    __entry->id, __entry->pid, __entry->ringid, __entry->seqno,
+		    __entry->ticks)
+);
+
+
+TRACE_EVENT(msm_gpu_submit_retired,
+	    TP_PROTO(struct msm_gem_submit *submit, u64 elapsed, u64 clock,
+		    u64 start, u64 end),
+	    TP_ARGS(submit, elapsed, clock, start, end),
+	    TP_STRUCT__entry(
+		    __field(pid_t, pid)
+		    __field(u32, id)
+		    __field(u32, ringid)
+		    __field(u32, seqno)
+		    __field(u64, elapsed)
+		    __field(u64, clock)
+		    __field(u64, start_ticks)
+		    __field(u64, end_ticks)
+		    ),
+	    TP_fast_assign(
+		    __entry->pid = pid_nr(submit->pid);
+		    __entry->id = submit->ident;
+		    __entry->ringid = submit->ring->id;
+		    __entry->seqno = submit->seqno;
+		    __entry->elapsed = elapsed;
+		    __entry->clock = clock;
+		    __entry->start_ticks = start;
+		    __entry->end_ticks = end;
+		    ),
+	    TP_printk("id=%d pid=%d ring=%d:%d elapsed=%lld ns mhz=%lld start=%lld end=%lld",
+		    __entry->id, __entry->pid, __entry->ringid, __entry->seqno,
+		    __entry->elapsed, __entry->clock,
+		    __entry->start_ticks, __entry->end_ticks)
+);
+
+
+TRACE_EVENT(msm_gpu_freq_change,
+		TP_PROTO(u32 freq),
+		TP_ARGS(freq),
+		TP_STRUCT__entry(
+			__field(u32, freq)
+			),
+		TP_fast_assign(
+			/* trace freq in MHz to match intel_gpu_freq_change, to make life easier
+			 * for userspace
+			 */
+			__entry->freq = DIV_ROUND_UP(freq, 1000000);
+			),
+		TP_printk("new_freq=%u", __entry->freq)
+);
+
+
+TRACE_EVENT(msm_gmu_freq_change,
+		TP_PROTO(u32 freq, u32 perf_index),
+		TP_ARGS(freq, perf_index),
+		TP_STRUCT__entry(
+			__field(u32, freq)
+			__field(u32, perf_index)
+			),
+		TP_fast_assign(
+			__entry->freq = freq;
+			__entry->perf_index = perf_index;
+			),
+		TP_printk("freq=%u, perf_index=%u", __entry->freq, __entry->perf_index)
+);
+
+
+TRACE_EVENT(msm_gem_shrink,
+		TP_PROTO(u32 nr_to_scan, u32 purged, u32 evicted,
+			 u32 active_purged, u32 active_evicted),
+		TP_ARGS(nr_to_scan, purged, evicted, active_purged, active_evicted),
+		TP_STRUCT__entry(
+			__field(u32, nr_to_scan)
+			__field(u32, purged)
+			__field(u32, evicted)
+			__field(u32, active_purged)
+			__field(u32, active_evicted)
+			),
+		TP_fast_assign(
+			__entry->nr_to_scan = nr_to_scan;
+			__entry->purged = purged;
+			__entry->evicted = evicted;
+			__entry->active_purged = active_purged;
+			__entry->active_evicted = active_evicted;
+			),
+		TP_printk("nr_to_scan=%u pg, purged=%u pg, evicted=%u pg, active_purged=%u pg, active_evicted=%u pg",
+			  __entry->nr_to_scan, __entry->purged, __entry->evicted,
+			  __entry->active_purged, __entry->active_evicted)
+);
+
+
+TRACE_EVENT(msm_gem_purge_vmaps,
+		TP_PROTO(u32 unmapped),
+		TP_ARGS(unmapped),
+		TP_STRUCT__entry(
+			__field(u32, unmapped)
+			),
+		TP_fast_assign(
+			__entry->unmapped = unmapped;
+			),
+		TP_printk("Purging %u vmaps", __entry->unmapped)
+);
+
+
+TRACE_EVENT(msm_gpu_suspend,
+		TP_PROTO(int dummy),
+		TP_ARGS(dummy),
+		TP_STRUCT__entry(
+			__field(u32, dummy)
+			),
+		TP_fast_assign(
+			__entry->dummy = dummy;
+			),
+		TP_printk("%u", __entry->dummy)
+);
+
+
+TRACE_EVENT(msm_gpu_resume,
+		TP_PROTO(int dummy),
+		TP_ARGS(dummy),
+		TP_STRUCT__entry(
+			__field(u32, dummy)
+			),
+		TP_fast_assign(
+			__entry->dummy = dummy;
+			),
+		TP_printk("%u", __entry->dummy)
+);
+
+#endif
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH ../../drivers/gpu/drm/msm
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_gpu_tracepoints.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_gpu_tracepoints.c
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "msm_gem.h"
+#include "msm_ringbuffer.h"
+
+#define CREATE_TRACE_POINTS
+#include "msm_gpu_trace.h"
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_io_utils.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_io_utils.c
@@ -0,0 +1,149 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2018, 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/interconnect.h>
+#include <linux/io.h>
+
+#include "msm_drv.h"
+
+/*
+ * Util/helpers:
+ */
+
+struct clk *msm_clk_bulk_get_clock(struct clk_bulk_data *bulk, int count,
+		const char *name)
+{
+	int i;
+	char n[32];
+
+	snprintf(n, sizeof(n), "%s_clk", name);
+
+	for (i = 0; bulk && i < count; i++) {
+		if (!strcmp(bulk[i].id, name) || !strcmp(bulk[i].id, n))
+			return bulk[i].clk;
+	}
+
+
+	return NULL;
+}
+
+struct clk *msm_clk_get(struct platform_device *pdev, const char *name)
+{
+	struct clk *clk;
+	char name2[32];
+
+	clk = devm_clk_get(&pdev->dev, name);
+	if (!IS_ERR(clk) || PTR_ERR(clk) == -EPROBE_DEFER)
+		return clk;
+
+	snprintf(name2, sizeof(name2), "%s_clk", name);
+
+	clk = devm_clk_get(&pdev->dev, name2);
+	if (!IS_ERR(clk))
+		dev_warn(&pdev->dev, "Using legacy clk name binding.  Use "
+				"\"%s\" instead of \"%s\"\n", name, name2);
+
+	return clk;
+}
+
+static void __iomem *_msm_ioremap(struct platform_device *pdev, const char *name,
+				  bool quiet, phys_addr_t *psize)
+{
+	struct resource *res;
+	unsigned long size;
+	void __iomem *ptr;
+
+	if (name)
+		res = platform_get_resource_byname(pdev, IORESOURCE_MEM, name);
+	else
+		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+	if (!res) {
+		if (!quiet)
+			DRM_DEV_ERROR(&pdev->dev, "failed to get memory resource: %s\n", name);
+		return ERR_PTR(-EINVAL);
+	}
+
+	size = resource_size(res);
+
+	ptr = devm_ioremap(&pdev->dev, res->start, size);
+	if (!ptr) {
+		if (!quiet)
+			DRM_DEV_ERROR(&pdev->dev, "failed to ioremap: %s\n", name);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	if (psize)
+		*psize = size;
+
+	return ptr;
+}
+
+void __iomem *msm_ioremap(struct platform_device *pdev, const char *name)
+{
+	return _msm_ioremap(pdev, name, false, NULL);
+}
+
+void __iomem *msm_ioremap_quiet(struct platform_device *pdev, const char *name)
+{
+	return _msm_ioremap(pdev, name, true, NULL);
+}
+
+void __iomem *msm_ioremap_size(struct platform_device *pdev, const char *name,
+			  phys_addr_t *psize)
+{
+	return _msm_ioremap(pdev, name, false, psize);
+}
+
+static enum hrtimer_restart msm_hrtimer_worktimer(struct hrtimer *t)
+{
+	struct msm_hrtimer_work *work = container_of(t,
+			struct msm_hrtimer_work, timer);
+
+	kthread_queue_work(work->worker, &work->work);
+
+	return HRTIMER_NORESTART;
+}
+
+void msm_hrtimer_queue_work(struct msm_hrtimer_work *work,
+			    ktime_t wakeup_time,
+			    enum hrtimer_mode mode)
+{
+	hrtimer_start(&work->timer, wakeup_time, mode);
+}
+
+void msm_hrtimer_work_init(struct msm_hrtimer_work *work,
+			   struct kthread_worker *worker,
+			   kthread_work_func_t fn,
+			   clockid_t clock_id,
+			   enum hrtimer_mode mode)
+{
+	hrtimer_init(&work->timer, clock_id, mode);
+	work->timer.function = msm_hrtimer_worktimer;
+	work->worker = worker;
+	kthread_init_work(&work->work, fn);
+}
+
+struct icc_path *msm_icc_get(struct device *dev, const char *name)
+{
+	struct device *mdss_dev = dev->parent;
+	struct icc_path *path;
+
+	path = of_icc_get(dev, name);
+	if (path)
+		return path;
+
+	/*
+	 * If there are no interconnects attached to the corresponding device
+	 * node, of_icc_get() will return NULL.
+	 *
+	 * If the MDP5/DPU device node doesn't have interconnects, lookup the
+	 * path in the parent (MDSS) device.
+	 */
+	return of_icc_get(mdss_dev, name);
+
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_iommu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_iommu.c
@@ -0,0 +1,455 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/adreno-smmu-priv.h>
+#include <linux/io-pgtable.h>
+#include "msm_drv.h"
+#include "msm_mmu.h"
+
+struct msm_iommu {
+	struct msm_mmu base;
+	struct iommu_domain *domain;
+	atomic_t pagetables;
+};
+
+#define to_msm_iommu(x) container_of(x, struct msm_iommu, base)
+
+struct msm_iommu_pagetable {
+	struct msm_mmu base;
+	struct msm_mmu *parent;
+	struct io_pgtable_ops *pgtbl_ops;
+	const struct iommu_flush_ops *tlb;
+	struct device *iommu_dev;
+	unsigned long pgsize_bitmap;	/* Bitmap of page sizes in use */
+	phys_addr_t ttbr;
+	u32 asid;
+};
+static struct msm_iommu_pagetable *to_pagetable(struct msm_mmu *mmu)
+{
+	return container_of(mmu, struct msm_iommu_pagetable, base);
+}
+
+/* based on iommu_pgsize() in iommu.c: */
+static size_t calc_pgsize(struct msm_iommu_pagetable *pagetable,
+			   unsigned long iova, phys_addr_t paddr,
+			   size_t size, size_t *count)
+{
+	unsigned int pgsize_idx, pgsize_idx_next;
+	unsigned long pgsizes;
+	size_t offset, pgsize, pgsize_next;
+	unsigned long addr_merge = paddr | iova;
+
+	/* Page sizes supported by the hardware and small enough for @size */
+	pgsizes = pagetable->pgsize_bitmap & GENMASK(__fls(size), 0);
+
+	/* Constrain the page sizes further based on the maximum alignment */
+	if (likely(addr_merge))
+		pgsizes &= GENMASK(__ffs(addr_merge), 0);
+
+	/* Make sure we have at least one suitable page size */
+	BUG_ON(!pgsizes);
+
+	/* Pick the biggest page size remaining */
+	pgsize_idx = __fls(pgsizes);
+	pgsize = BIT(pgsize_idx);
+	if (!count)
+		return pgsize;
+
+	/* Find the next biggest support page size, if it exists */
+	pgsizes = pagetable->pgsize_bitmap & ~GENMASK(pgsize_idx, 0);
+	if (!pgsizes)
+		goto out_set_count;
+
+	pgsize_idx_next = __ffs(pgsizes);
+	pgsize_next = BIT(pgsize_idx_next);
+
+	/*
+	 * There's no point trying a bigger page size unless the virtual
+	 * and physical addresses are similarly offset within the larger page.
+	 */
+	if ((iova ^ paddr) & (pgsize_next - 1))
+		goto out_set_count;
+
+	/* Calculate the offset to the next page size alignment boundary */
+	offset = pgsize_next - (addr_merge & (pgsize_next - 1));
+
+	/*
+	 * If size is big enough to accommodate the larger page, reduce
+	 * the number of smaller pages.
+	 */
+	if (offset + pgsize_next <= size)
+		size = offset;
+
+out_set_count:
+	*count = size >> pgsize_idx;
+	return pgsize;
+}
+
+static int msm_iommu_pagetable_unmap(struct msm_mmu *mmu, u64 iova,
+		size_t size)
+{
+	struct msm_iommu_pagetable *pagetable = to_pagetable(mmu);
+	struct io_pgtable_ops *ops = pagetable->pgtbl_ops;
+
+	while (size) {
+		size_t unmapped, pgsize, count;
+
+		pgsize = calc_pgsize(pagetable, iova, iova, size, &count);
+
+		unmapped = ops->unmap_pages(ops, iova, pgsize, count, NULL);
+		if (!unmapped)
+			break;
+
+		iova += unmapped;
+		size -= unmapped;
+	}
+
+	iommu_flush_iotlb_all(to_msm_iommu(pagetable->parent)->domain);
+
+	return (size == 0) ? 0 : -EINVAL;
+}
+
+static int msm_iommu_pagetable_map(struct msm_mmu *mmu, u64 iova,
+		struct sg_table *sgt, size_t len, int prot)
+{
+	struct msm_iommu_pagetable *pagetable = to_pagetable(mmu);
+	struct io_pgtable_ops *ops = pagetable->pgtbl_ops;
+	struct scatterlist *sg;
+	u64 addr = iova;
+	unsigned int i;
+
+	for_each_sgtable_sg(sgt, sg, i) {
+		size_t size = sg->length;
+		phys_addr_t phys = sg_phys(sg);
+
+		while (size) {
+			size_t pgsize, count, mapped = 0;
+			int ret;
+
+			pgsize = calc_pgsize(pagetable, addr, phys, size, &count);
+
+			ret = ops->map_pages(ops, addr, phys, pgsize, count,
+					     prot, GFP_KERNEL, &mapped);
+
+			/* map_pages could fail after mapping some of the pages,
+			 * so update the counters before error handling.
+			 */
+			phys += mapped;
+			addr += mapped;
+			size -= mapped;
+
+			if (ret) {
+				msm_iommu_pagetable_unmap(mmu, iova, addr - iova);
+				return -EINVAL;
+			}
+		}
+	}
+
+	return 0;
+}
+
+static void msm_iommu_pagetable_destroy(struct msm_mmu *mmu)
+{
+	struct msm_iommu_pagetable *pagetable = to_pagetable(mmu);
+	struct msm_iommu *iommu = to_msm_iommu(pagetable->parent);
+	struct adreno_smmu_priv *adreno_smmu =
+		dev_get_drvdata(pagetable->parent->dev);
+
+	/*
+	 * If this is the last attached pagetable for the parent,
+	 * disable TTBR0 in the arm-smmu driver
+	 */
+	if (atomic_dec_return(&iommu->pagetables) == 0)
+		adreno_smmu->set_ttbr0_cfg(adreno_smmu->cookie, NULL);
+
+	free_io_pgtable_ops(pagetable->pgtbl_ops);
+	kfree(pagetable);
+}
+
+int msm_iommu_pagetable_params(struct msm_mmu *mmu,
+		phys_addr_t *ttbr, int *asid)
+{
+	struct msm_iommu_pagetable *pagetable;
+
+	if (mmu->type != MSM_MMU_IOMMU_PAGETABLE)
+		return -EINVAL;
+
+	pagetable = to_pagetable(mmu);
+
+	if (ttbr)
+		*ttbr = pagetable->ttbr;
+
+	if (asid)
+		*asid = pagetable->asid;
+
+	return 0;
+}
+
+struct iommu_domain_geometry *msm_iommu_get_geometry(struct msm_mmu *mmu)
+{
+	struct msm_iommu *iommu = to_msm_iommu(mmu);
+
+	return &iommu->domain->geometry;
+}
+
+static const struct msm_mmu_funcs pagetable_funcs = {
+		.map = msm_iommu_pagetable_map,
+		.unmap = msm_iommu_pagetable_unmap,
+		.destroy = msm_iommu_pagetable_destroy,
+};
+
+static void msm_iommu_tlb_flush_all(void *cookie)
+{
+	struct msm_iommu_pagetable *pagetable = cookie;
+	struct adreno_smmu_priv *adreno_smmu;
+
+	if (!pm_runtime_get_if_in_use(pagetable->iommu_dev))
+		return;
+
+	adreno_smmu = dev_get_drvdata(pagetable->parent->dev);
+
+	pagetable->tlb->tlb_flush_all((void *)adreno_smmu->cookie);
+
+	pm_runtime_put_autosuspend(pagetable->iommu_dev);
+}
+
+static void msm_iommu_tlb_flush_walk(unsigned long iova, size_t size,
+		size_t granule, void *cookie)
+{
+	struct msm_iommu_pagetable *pagetable = cookie;
+	struct adreno_smmu_priv *adreno_smmu;
+
+	if (!pm_runtime_get_if_in_use(pagetable->iommu_dev))
+		return;
+
+	adreno_smmu = dev_get_drvdata(pagetable->parent->dev);
+
+	pagetable->tlb->tlb_flush_walk(iova, size, granule, (void *)adreno_smmu->cookie);
+
+	pm_runtime_put_autosuspend(pagetable->iommu_dev);
+}
+
+static void msm_iommu_tlb_add_page(struct iommu_iotlb_gather *gather,
+		unsigned long iova, size_t granule, void *cookie)
+{
+}
+
+static const struct iommu_flush_ops tlb_ops = {
+	.tlb_flush_all = msm_iommu_tlb_flush_all,
+	.tlb_flush_walk = msm_iommu_tlb_flush_walk,
+	.tlb_add_page = msm_iommu_tlb_add_page,
+};
+
+static int msm_fault_handler(struct iommu_domain *domain, struct device *dev,
+		unsigned long iova, int flags, void *arg);
+
+struct msm_mmu *msm_iommu_pagetable_create(struct msm_mmu *parent)
+{
+	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(parent->dev);
+	struct msm_iommu *iommu = to_msm_iommu(parent);
+	struct msm_iommu_pagetable *pagetable;
+	const struct io_pgtable_cfg *ttbr1_cfg = NULL;
+	struct io_pgtable_cfg ttbr0_cfg;
+	int ret;
+
+	/* Get the pagetable configuration from the domain */
+	if (adreno_smmu->cookie)
+		ttbr1_cfg = adreno_smmu->get_ttbr1_cfg(adreno_smmu->cookie);
+
+	/*
+	 * If you hit this WARN_ONCE() you are probably missing an entry in
+	 * qcom_smmu_impl_of_match[] in arm-smmu-qcom.c
+	 */
+	if (WARN_ONCE(!ttbr1_cfg, "No per-process page tables"))
+		return ERR_PTR(-ENODEV);
+
+	pagetable = kzalloc(sizeof(*pagetable), GFP_KERNEL);
+	if (!pagetable)
+		return ERR_PTR(-ENOMEM);
+
+	msm_mmu_init(&pagetable->base, parent->dev, &pagetable_funcs,
+		MSM_MMU_IOMMU_PAGETABLE);
+
+	/* Clone the TTBR1 cfg as starting point for TTBR0 cfg: */
+	ttbr0_cfg = *ttbr1_cfg;
+
+	/* The incoming cfg will have the TTBR1 quirk enabled */
+	ttbr0_cfg.quirks &= ~IO_PGTABLE_QUIRK_ARM_TTBR1;
+	ttbr0_cfg.tlb = &tlb_ops;
+
+	pagetable->pgtbl_ops = alloc_io_pgtable_ops(ARM_64_LPAE_S1,
+		&ttbr0_cfg, pagetable);
+
+	if (!pagetable->pgtbl_ops) {
+		kfree(pagetable);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	/*
+	 * If this is the first pagetable that we've allocated, send it back to
+	 * the arm-smmu driver as a trigger to set up TTBR0
+	 */
+	if (atomic_inc_return(&iommu->pagetables) == 1) {
+		ret = adreno_smmu->set_ttbr0_cfg(adreno_smmu->cookie, &ttbr0_cfg);
+		if (ret) {
+			free_io_pgtable_ops(pagetable->pgtbl_ops);
+			kfree(pagetable);
+			return ERR_PTR(ret);
+		}
+	}
+
+	/* Needed later for TLB flush */
+	pagetable->parent = parent;
+	pagetable->tlb = ttbr1_cfg->tlb;
+	pagetable->iommu_dev = ttbr1_cfg->iommu_dev;
+	pagetable->pgsize_bitmap = ttbr0_cfg.pgsize_bitmap;
+	pagetable->ttbr = ttbr0_cfg.arm_lpae_s1_cfg.ttbr;
+
+	/*
+	 * TODO we would like each set of page tables to have a unique ASID
+	 * to optimize TLB invalidation.  But iommu_flush_iotlb_all() will
+	 * end up flushing the ASID used for TTBR1 pagetables, which is not
+	 * what we want.  So for now just use the same ASID as TTBR1.
+	 */
+	pagetable->asid = 0;
+
+	return &pagetable->base;
+}
+
+static int msm_fault_handler(struct iommu_domain *domain, struct device *dev,
+		unsigned long iova, int flags, void *arg)
+{
+	struct msm_iommu *iommu = arg;
+	struct msm_mmu *mmu = &iommu->base;
+	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(iommu->base.dev);
+	struct adreno_smmu_fault_info info, *ptr = NULL;
+
+	if (adreno_smmu->get_fault_info) {
+		adreno_smmu->get_fault_info(adreno_smmu->cookie, &info);
+		ptr = &info;
+	}
+
+	if (iommu->base.handler)
+		return iommu->base.handler(iommu->base.arg, iova, flags, ptr);
+
+	pr_warn_ratelimited("*** fault: iova=%16lx, flags=%d\n", iova, flags);
+
+	if (mmu->funcs->resume_translation)
+		mmu->funcs->resume_translation(mmu);
+
+	return 0;
+}
+
+static void msm_iommu_resume_translation(struct msm_mmu *mmu)
+{
+	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(mmu->dev);
+
+	if (adreno_smmu->resume_translation)
+		adreno_smmu->resume_translation(adreno_smmu->cookie, true);
+}
+
+static void msm_iommu_detach(struct msm_mmu *mmu)
+{
+	struct msm_iommu *iommu = to_msm_iommu(mmu);
+
+	iommu_detach_device(iommu->domain, mmu->dev);
+}
+
+static int msm_iommu_map(struct msm_mmu *mmu, uint64_t iova,
+		struct sg_table *sgt, size_t len, int prot)
+{
+	struct msm_iommu *iommu = to_msm_iommu(mmu);
+	size_t ret;
+
+	/* The arm-smmu driver expects the addresses to be sign extended */
+	if (iova & BIT_ULL(48))
+		iova |= GENMASK_ULL(63, 49);
+
+	ret = iommu_map_sgtable(iommu->domain, iova, sgt, prot);
+	WARN_ON(!ret);
+
+	return (ret == len) ? 0 : -EINVAL;
+}
+
+static int msm_iommu_unmap(struct msm_mmu *mmu, uint64_t iova, size_t len)
+{
+	struct msm_iommu *iommu = to_msm_iommu(mmu);
+
+	if (iova & BIT_ULL(48))
+		iova |= GENMASK_ULL(63, 49);
+
+	iommu_unmap(iommu->domain, iova, len);
+
+	return 0;
+}
+
+static void msm_iommu_destroy(struct msm_mmu *mmu)
+{
+	struct msm_iommu *iommu = to_msm_iommu(mmu);
+	iommu_domain_free(iommu->domain);
+	kfree(iommu);
+}
+
+static const struct msm_mmu_funcs funcs = {
+		.detach = msm_iommu_detach,
+		.map = msm_iommu_map,
+		.unmap = msm_iommu_unmap,
+		.destroy = msm_iommu_destroy,
+		.resume_translation = msm_iommu_resume_translation,
+};
+
+struct msm_mmu *msm_iommu_new(struct device *dev, unsigned long quirks)
+{
+	struct iommu_domain *domain;
+	struct msm_iommu *iommu;
+	int ret;
+
+	domain = iommu_domain_alloc(dev->bus);
+	if (!domain)
+		return NULL;
+
+	iommu_set_pgtable_quirks(domain, quirks);
+
+	iommu = kzalloc(sizeof(*iommu), GFP_KERNEL);
+	if (!iommu) {
+		iommu_domain_free(domain);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	iommu->domain = domain;
+	msm_mmu_init(&iommu->base, dev, &funcs, MSM_MMU_IOMMU);
+
+	atomic_set(&iommu->pagetables, 0);
+
+	ret = iommu_attach_device(iommu->domain, dev);
+	if (ret) {
+		iommu_domain_free(domain);
+		kfree(iommu);
+		return ERR_PTR(ret);
+	}
+
+	return &iommu->base;
+}
+
+struct msm_mmu *msm_iommu_gpu_new(struct device *dev, struct msm_gpu *gpu, unsigned long quirks)
+{
+	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(dev);
+	struct msm_iommu *iommu;
+	struct msm_mmu *mmu;
+
+	mmu = msm_iommu_new(dev, quirks);
+	if (IS_ERR_OR_NULL(mmu))
+		return mmu;
+
+	iommu = to_msm_iommu(mmu);
+	iommu_set_fault_handler(iommu->domain, msm_fault_handler, iommu);
+
+	/* Enable stall on iommu fault: */
+	if (adreno_smmu->set_stall)
+		adreno_smmu->set_stall(adreno_smmu->cookie, true);
+
+	return mmu;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_kms.c
@@ -0,0 +1,346 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2018, 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include <linux/kthread.h>
+#include <linux/sched/mm.h>
+#include <uapi/linux/sched/types.h>
+
+#include <drm/drm_aperture.h>
+#include <drm/drm_drv.h>
+#include <drm/drm_mode_config.h>
+#include <drm/drm_vblank.h>
+
+#include "disp/msm_disp_snapshot.h"
+#include "msm_drv.h"
+#include "msm_gem.h"
+#include "msm_kms.h"
+#include "msm_mmu.h"
+
+static const struct drm_mode_config_funcs mode_config_funcs = {
+	.fb_create = msm_framebuffer_create,
+	.atomic_check = msm_atomic_check,
+	.atomic_commit = drm_atomic_helper_commit,
+};
+
+static const struct drm_mode_config_helper_funcs mode_config_helper_funcs = {
+	.atomic_commit_tail = msm_atomic_commit_tail,
+	.atomic_commit_setup = drm_dp_mst_atomic_setup_commit,
+};
+
+static irqreturn_t msm_irq(int irq, void *arg)
+{
+	struct drm_device *dev = arg;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+
+	BUG_ON(!kms);
+
+	return kms->funcs->irq(kms);
+}
+
+static void msm_irq_preinstall(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+
+	BUG_ON(!kms);
+
+	kms->funcs->irq_preinstall(kms);
+}
+
+static int msm_irq_postinstall(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+
+	BUG_ON(!kms);
+
+	if (kms->funcs->irq_postinstall)
+		return kms->funcs->irq_postinstall(kms);
+
+	return 0;
+}
+
+static int msm_irq_install(struct drm_device *dev, unsigned int irq)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+	int ret;
+
+	if (irq == IRQ_NOTCONNECTED)
+		return -ENOTCONN;
+
+	msm_irq_preinstall(dev);
+
+	ret = request_irq(irq, msm_irq, 0, dev->driver->name, dev);
+	if (ret)
+		return ret;
+
+	kms->irq_requested = true;
+
+	ret = msm_irq_postinstall(dev);
+	if (ret) {
+		free_irq(irq, dev);
+		return ret;
+	}
+
+	return 0;
+}
+
+static void msm_irq_uninstall(struct drm_device *dev)
+{
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+
+	kms->funcs->irq_uninstall(kms);
+	if (kms->irq_requested)
+		free_irq(kms->irq, dev);
+}
+
+struct msm_vblank_work {
+	struct work_struct work;
+	struct drm_crtc *crtc;
+	bool enable;
+	struct msm_drm_private *priv;
+};
+
+static void vblank_ctrl_worker(struct work_struct *work)
+{
+	struct msm_vblank_work *vbl_work = container_of(work,
+						struct msm_vblank_work, work);
+	struct msm_drm_private *priv = vbl_work->priv;
+	struct msm_kms *kms = priv->kms;
+
+	if (vbl_work->enable)
+		kms->funcs->enable_vblank(kms, vbl_work->crtc);
+	else
+		kms->funcs->disable_vblank(kms,	vbl_work->crtc);
+
+	kfree(vbl_work);
+}
+
+static int vblank_ctrl_queue_work(struct msm_drm_private *priv,
+				  struct drm_crtc *crtc, bool enable)
+{
+	struct msm_vblank_work *vbl_work;
+
+	vbl_work = kzalloc(sizeof(*vbl_work), GFP_ATOMIC);
+	if (!vbl_work)
+		return -ENOMEM;
+
+	INIT_WORK(&vbl_work->work, vblank_ctrl_worker);
+
+	vbl_work->crtc = crtc;
+	vbl_work->enable = enable;
+	vbl_work->priv = priv;
+
+	queue_work(priv->wq, &vbl_work->work);
+
+	return 0;
+}
+
+int msm_crtc_enable_vblank(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+	if (!kms)
+		return -ENXIO;
+	drm_dbg_vbl(dev, "crtc=%u\n", crtc->base.id);
+	return vblank_ctrl_queue_work(priv, crtc, true);
+}
+
+void msm_crtc_disable_vblank(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
+	if (!kms)
+		return;
+	drm_dbg_vbl(dev, "crtc=%u\n", crtc->base.id);
+	vblank_ctrl_queue_work(priv, crtc, false);
+}
+
+struct msm_gem_address_space *msm_kms_init_aspace(struct drm_device *dev)
+{
+	struct msm_gem_address_space *aspace;
+	struct msm_mmu *mmu;
+	struct device *mdp_dev = dev->dev;
+	struct device *mdss_dev = mdp_dev->parent;
+	struct device *iommu_dev;
+
+	/*
+	 * IOMMUs can be a part of MDSS device tree binding, or the
+	 * MDP/DPU device.
+	 */
+	if (device_iommu_mapped(mdp_dev))
+		iommu_dev = mdp_dev;
+	else
+		iommu_dev = mdss_dev;
+
+	mmu = msm_iommu_new(iommu_dev, 0);
+	if (IS_ERR(mmu))
+		return ERR_CAST(mmu);
+
+	if (!mmu) {
+		drm_info(dev, "no IOMMU, fallback to phys contig buffers for scanout\n");
+		return NULL;
+	}
+
+	aspace = msm_gem_address_space_create(mmu, "mdp_kms",
+		0x1000, 0x100000000 - 0x1000);
+	if (IS_ERR(aspace)) {
+		dev_err(mdp_dev, "aspace create, error %pe\n", aspace);
+		mmu->funcs->destroy(mmu);
+	}
+
+	return aspace;
+}
+
+void msm_drm_kms_uninit(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct msm_drm_private *priv = platform_get_drvdata(pdev);
+	struct drm_device *ddev = priv->dev;
+	struct msm_kms *kms = priv->kms;
+	int i;
+
+	BUG_ON(!kms);
+
+	/* clean up event worker threads */
+	for (i = 0; i < priv->num_crtcs; i++) {
+		if (priv->event_thread[i].worker)
+			kthread_destroy_worker(priv->event_thread[i].worker);
+	}
+
+	drm_kms_helper_poll_fini(ddev);
+
+	msm_disp_snapshot_destroy(ddev);
+
+	pm_runtime_get_sync(dev);
+	msm_irq_uninstall(ddev);
+	pm_runtime_put_sync(dev);
+
+	if (kms && kms->funcs)
+		kms->funcs->destroy(kms);
+}
+
+int msm_drm_kms_init(struct device *dev, const struct drm_driver *drv)
+{
+	struct msm_drm_private *priv = dev_get_drvdata(dev);
+	struct drm_device *ddev = priv->dev;
+	struct msm_kms *kms = priv->kms;
+	struct drm_crtc *crtc;
+	int ret;
+
+	/* the fw fb could be anywhere in memory */
+	ret = drm_aperture_remove_framebuffers(drv);
+	if (ret)
+		return ret;
+
+	ret = priv->kms_init(ddev);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to load kms\n");
+		priv->kms = NULL;
+		return ret;
+	}
+
+	/* Enable normalization of plane zpos */
+	ddev->mode_config.normalize_zpos = true;
+
+	ddev->mode_config.funcs = &mode_config_funcs;
+	ddev->mode_config.helper_private = &mode_config_helper_funcs;
+
+	kms->dev = ddev;
+	ret = kms->funcs->hw_init(kms);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "kms hw init failed: %d\n", ret);
+		goto err_msm_uninit;
+	}
+
+	drm_helper_move_panel_connectors_to_head(ddev);
+
+	drm_for_each_crtc(crtc, ddev) {
+		struct msm_drm_thread *ev_thread;
+
+		/* initialize event thread */
+		ev_thread = &priv->event_thread[drm_crtc_index(crtc)];
+		ev_thread->dev = ddev;
+		ev_thread->worker = kthread_create_worker(0, "crtc_event:%d", crtc->base.id);
+		if (IS_ERR(ev_thread->worker)) {
+			ret = PTR_ERR(ev_thread->worker);
+			DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n");
+			ev_thread->worker = NULL;
+			goto err_msm_uninit;
+		}
+
+		sched_set_fifo(ev_thread->worker->task);
+	}
+
+	ret = drm_vblank_init(ddev, priv->num_crtcs);
+	if (ret < 0) {
+		DRM_DEV_ERROR(dev, "failed to initialize vblank\n");
+		goto err_msm_uninit;
+	}
+
+	pm_runtime_get_sync(dev);
+	ret = msm_irq_install(ddev, kms->irq);
+	pm_runtime_put_sync(dev);
+	if (ret < 0) {
+		DRM_DEV_ERROR(dev, "failed to install IRQ handler\n");
+		goto err_msm_uninit;
+	}
+
+	ret = msm_disp_snapshot_init(ddev);
+	if (ret)
+		DRM_DEV_ERROR(dev, "msm_disp_snapshot_init failed ret = %d\n", ret);
+
+	drm_mode_config_reset(ddev);
+
+	return 0;
+
+err_msm_uninit:
+	return ret;
+}
+
+int msm_kms_pm_prepare(struct device *dev)
+{
+	struct msm_drm_private *priv = dev_get_drvdata(dev);
+	struct drm_device *ddev = priv ? priv->dev : NULL;
+
+	if (!priv || !priv->kms)
+		return 0;
+
+	return drm_mode_config_helper_suspend(ddev);
+}
+
+void msm_kms_pm_complete(struct device *dev)
+{
+	struct msm_drm_private *priv = dev_get_drvdata(dev);
+	struct drm_device *ddev = priv ? priv->dev : NULL;
+
+	if (!priv || !priv->kms)
+		return;
+
+	drm_mode_config_helper_resume(ddev);
+}
+
+void msm_kms_shutdown(struct platform_device *pdev)
+{
+	struct msm_drm_private *priv = platform_get_drvdata(pdev);
+	struct drm_device *drm = priv ? priv->dev : NULL;
+
+	/*
+	 * Shutdown the hw if we're far enough along where things might be on.
+	 * If we run this too early, we'll end up panicking in any variety of
+	 * places. Since we don't register the drm device until late in
+	 * msm_drm_init, drm_dev->registered is used as an indicator that the
+	 * shutdown will be successful.
+	 */
+	if (drm && drm->registered && priv->kms)
+		drm_atomic_helper_shutdown(drm);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_kms.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_kms.h
@@ -0,0 +1,201 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MSM_KMS_H__
+#define __MSM_KMS_H__
+
+#include <linux/clk.h>
+#include <linux/regulator/consumer.h>
+
+#include "msm_drv.h"
+
+#define MAX_PLANE	4
+
+/* As there are different display controller blocks depending on the
+ * snapdragon version, the kms support is split out and the appropriate
+ * implementation is loaded at runtime.  The kms module is responsible
+ * for constructing the appropriate planes/crtcs/encoders/connectors.
+ */
+struct msm_kms_funcs {
+	/* hw initialization: */
+	int (*hw_init)(struct msm_kms *kms);
+	/* irq handling: */
+	void (*irq_preinstall)(struct msm_kms *kms);
+	int (*irq_postinstall)(struct msm_kms *kms);
+	void (*irq_uninstall)(struct msm_kms *kms);
+	irqreturn_t (*irq)(struct msm_kms *kms);
+	int (*enable_vblank)(struct msm_kms *kms, struct drm_crtc *crtc);
+	void (*disable_vblank)(struct msm_kms *kms, struct drm_crtc *crtc);
+
+	/*
+	 * Atomic commit handling:
+	 *
+	 * Note that in the case of async commits, the funcs which take
+	 * a crtc_mask (ie. ->flush_commit(), and ->complete_commit())
+	 * might not be evenly balanced with ->prepare_commit(), however
+	 * each crtc that effected by a ->prepare_commit() (potentially
+	 * multiple times) will eventually (at end of vsync period) be
+	 * flushed and completed.
+	 *
+	 * This has some implications about tracking of cleanup state,
+	 * for example SMP blocks to release after commit completes.  Ie.
+	 * cleanup state should be also duplicated in the various
+	 * duplicate_state() methods, as the current cleanup state at
+	 * ->complete_commit() time may have accumulated cleanup work
+	 * from multiple commits.
+	 */
+
+	/**
+	 * Enable/disable power/clks needed for hw access done in other
+	 * commit related methods.
+	 *
+	 * If mdp4 is migrated to runpm, we could probably drop these
+	 * and use runpm directly.
+	 */
+	void (*enable_commit)(struct msm_kms *kms);
+	void (*disable_commit)(struct msm_kms *kms);
+
+	/**
+	 * Prepare for atomic commit.  This is called after any previous
+	 * (async or otherwise) commit has completed.
+	 */
+	void (*prepare_commit)(struct msm_kms *kms, struct drm_atomic_state *state);
+
+	/**
+	 * Flush an atomic commit.  This is called after the hardware
+	 * updates have already been pushed down to effected planes/
+	 * crtcs/encoders/connectors.
+	 */
+	void (*flush_commit)(struct msm_kms *kms, unsigned crtc_mask);
+
+	/**
+	 * Wait for any in-progress flush to complete on the specified
+	 * crtcs.  This should not block if there is no in-progress
+	 * commit (ie. don't just wait for a vblank), as it will also
+	 * be called before ->prepare_commit() to ensure any potential
+	 * "async" commit has completed.
+	 */
+	void (*wait_flush)(struct msm_kms *kms, unsigned crtc_mask);
+
+	/**
+	 * Clean up after commit is completed.  This is called after
+	 * ->wait_flush(), to give the backend a chance to do any
+	 * post-commit cleanup.
+	 */
+	void (*complete_commit)(struct msm_kms *kms, unsigned crtc_mask);
+
+	/*
+	 * Format handling:
+	 */
+
+	/* get msm_format w/ optional format modifiers from drm_mode_fb_cmd2 */
+	const struct msm_format *(*get_format)(struct msm_kms *kms,
+					const uint32_t format,
+					const uint64_t modifiers);
+	/* do format checking on format modified through fb_cmd2 modifiers */
+	int (*check_modified_format)(const struct msm_kms *kms,
+			const struct msm_format *msm_fmt,
+			const struct drm_mode_fb_cmd2 *cmd,
+			struct drm_gem_object **bos);
+
+	/* misc: */
+	long (*round_pixclk)(struct msm_kms *kms, unsigned long rate,
+			struct drm_encoder *encoder);
+	int (*set_split_display)(struct msm_kms *kms,
+			struct drm_encoder *encoder,
+			struct drm_encoder *slave_encoder,
+			bool is_cmd_mode);
+	/* cleanup: */
+	void (*destroy)(struct msm_kms *kms);
+
+	/* snapshot: */
+	void (*snapshot)(struct msm_disp_state *disp_state, struct msm_kms *kms);
+
+#ifdef CONFIG_DEBUG_FS
+	/* debugfs: */
+	int (*debugfs_init)(struct msm_kms *kms, struct drm_minor *minor);
+#endif
+};
+
+struct msm_kms;
+
+/*
+ * A per-crtc timer for pending async atomic flushes.  Scheduled to expire
+ * shortly before vblank to flush pending async updates.
+ */
+struct msm_pending_timer {
+	struct msm_hrtimer_work work;
+	struct kthread_worker *worker;
+	struct msm_kms *kms;
+	unsigned crtc_idx;
+};
+
+struct msm_kms {
+	const struct msm_kms_funcs *funcs;
+	struct drm_device *dev;
+
+	/* irq number to be passed on to msm_irq_install */
+	int irq;
+	bool irq_requested;
+
+	/* mapper-id used to request GEM buffer mapped for scanout: */
+	struct msm_gem_address_space *aspace;
+
+	/* disp snapshot support */
+	struct kthread_worker *dump_worker;
+	struct kthread_work dump_work;
+	struct mutex dump_mutex;
+
+	/*
+	 * For async commit, where ->flush_commit() and later happens
+	 * from the crtc's pending_timer close to end of the frame:
+	 */
+	struct mutex commit_lock[MAX_CRTCS];
+	unsigned pending_crtc_mask;
+	struct msm_pending_timer pending_timers[MAX_CRTCS];
+};
+
+static inline int msm_kms_init(struct msm_kms *kms,
+		const struct msm_kms_funcs *funcs)
+{
+	unsigned i, ret;
+
+	for (i = 0; i < ARRAY_SIZE(kms->commit_lock); i++)
+		mutex_init(&kms->commit_lock[i]);
+
+	kms->funcs = funcs;
+
+	for (i = 0; i < ARRAY_SIZE(kms->pending_timers); i++) {
+		ret = msm_atomic_init_pending_timer(&kms->pending_timers[i], kms, i);
+		if (ret) {
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+static inline void msm_kms_destroy(struct msm_kms *kms)
+{
+	unsigned i;
+
+	for (i = 0; i < ARRAY_SIZE(kms->pending_timers); i++)
+		msm_atomic_destroy_pending_timer(&kms->pending_timers[i]);
+}
+
+#define for_each_crtc_mask(dev, crtc, crtc_mask) \
+	drm_for_each_crtc(crtc, dev) \
+		for_each_if (drm_crtc_mask(crtc) & (crtc_mask))
+
+#define for_each_crtc_mask_reverse(dev, crtc, crtc_mask) \
+	drm_for_each_crtc_reverse(crtc, dev) \
+		for_each_if (drm_crtc_mask(crtc) & (crtc_mask))
+
+int msm_drm_kms_init(struct device *dev, const struct drm_driver *drv);
+void msm_drm_kms_uninit(struct device *dev);
+
+#endif /* __MSM_KMS_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_mdss.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_mdss.c
@@ -0,0 +1,702 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0
+ * Copyright (c) 2018, The Linux Foundation
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/interconnect.h>
+#include <linux/irq.h>
+#include <linux/irqchip.h>
+#include <linux/irqdesc.h>
+#include <linux/irqchip/chained_irq.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/reset.h>
+
+#include "msm_mdss.h"
+#include "msm_kms.h"
+
+#define HW_REV				0x0
+#define HW_INTR_STATUS			0x0010
+
+#define UBWC_DEC_HW_VERSION		0x58
+#define UBWC_STATIC			0x144
+#define UBWC_CTRL_2			0x150
+#define UBWC_PREDICTION_MODE		0x154
+
+#define MIN_IB_BW	400000000UL /* Min ib vote 400MB */
+
+#define DEFAULT_REG_BW	153600 /* Used in mdss fbdev driver */
+
+struct msm_mdss {
+	struct device *dev;
+
+	void __iomem *mmio;
+	struct clk_bulk_data *clocks;
+	size_t num_clocks;
+	bool is_mdp5;
+	struct {
+		unsigned long enabled_mask;
+		struct irq_domain *domain;
+	} irq_controller;
+	const struct msm_mdss_data *mdss_data;
+	struct icc_path *mdp_path[2];
+	u32 num_mdp_paths;
+	struct icc_path *reg_bus_path;
+};
+
+static int msm_mdss_parse_data_bus_icc_path(struct device *dev,
+					    struct msm_mdss *msm_mdss)
+{
+	struct icc_path *path0;
+	struct icc_path *path1;
+	struct icc_path *reg_bus_path;
+
+	path0 = devm_of_icc_get(dev, "mdp0-mem");
+	if (IS_ERR_OR_NULL(path0))
+		return PTR_ERR_OR_ZERO(path0);
+
+	msm_mdss->mdp_path[0] = path0;
+	msm_mdss->num_mdp_paths = 1;
+
+	path1 = devm_of_icc_get(dev, "mdp1-mem");
+	if (!IS_ERR_OR_NULL(path1)) {
+		msm_mdss->mdp_path[1] = path1;
+		msm_mdss->num_mdp_paths++;
+	}
+
+	reg_bus_path = of_icc_get(dev, "cpu-cfg");
+	if (!IS_ERR_OR_NULL(reg_bus_path))
+		msm_mdss->reg_bus_path = reg_bus_path;
+
+	return 0;
+}
+
+static void msm_mdss_irq(struct irq_desc *desc)
+{
+	struct msm_mdss *msm_mdss = irq_desc_get_handler_data(desc);
+	struct irq_chip *chip = irq_desc_get_chip(desc);
+	u32 interrupts;
+
+	chained_irq_enter(chip, desc);
+
+	interrupts = readl_relaxed(msm_mdss->mmio + HW_INTR_STATUS);
+
+	while (interrupts) {
+		irq_hw_number_t hwirq = fls(interrupts) - 1;
+		int rc;
+
+		rc = generic_handle_domain_irq(msm_mdss->irq_controller.domain,
+					       hwirq);
+		if (rc < 0) {
+			dev_err(msm_mdss->dev, "handle irq fail: irq=%lu rc=%d\n",
+				  hwirq, rc);
+			break;
+		}
+
+		interrupts &= ~(1 << hwirq);
+	}
+
+	chained_irq_exit(chip, desc);
+}
+
+static void msm_mdss_irq_mask(struct irq_data *irqd)
+{
+	struct msm_mdss *msm_mdss = irq_data_get_irq_chip_data(irqd);
+
+	/* memory barrier */
+	smp_mb__before_atomic();
+	clear_bit(irqd->hwirq, &msm_mdss->irq_controller.enabled_mask);
+	/* memory barrier */
+	smp_mb__after_atomic();
+}
+
+static void msm_mdss_irq_unmask(struct irq_data *irqd)
+{
+	struct msm_mdss *msm_mdss = irq_data_get_irq_chip_data(irqd);
+
+	/* memory barrier */
+	smp_mb__before_atomic();
+	set_bit(irqd->hwirq, &msm_mdss->irq_controller.enabled_mask);
+	/* memory barrier */
+	smp_mb__after_atomic();
+}
+
+static struct irq_chip msm_mdss_irq_chip = {
+	.name = "msm_mdss",
+	.irq_mask = msm_mdss_irq_mask,
+	.irq_unmask = msm_mdss_irq_unmask,
+};
+
+static struct lock_class_key msm_mdss_lock_key, msm_mdss_request_key;
+
+static int msm_mdss_irqdomain_map(struct irq_domain *domain,
+		unsigned int irq, irq_hw_number_t hwirq)
+{
+	struct msm_mdss *msm_mdss = domain->host_data;
+
+	irq_set_lockdep_class(irq, &msm_mdss_lock_key, &msm_mdss_request_key);
+	irq_set_chip_and_handler(irq, &msm_mdss_irq_chip, handle_level_irq);
+
+	return irq_set_chip_data(irq, msm_mdss);
+}
+
+static const struct irq_domain_ops msm_mdss_irqdomain_ops = {
+	.map = msm_mdss_irqdomain_map,
+	.xlate = irq_domain_xlate_onecell,
+};
+
+static int _msm_mdss_irq_domain_add(struct msm_mdss *msm_mdss)
+{
+	struct device *dev;
+	struct irq_domain *domain;
+
+	dev = msm_mdss->dev;
+
+	domain = irq_domain_add_linear(dev->of_node, 32,
+			&msm_mdss_irqdomain_ops, msm_mdss);
+	if (!domain) {
+		dev_err(dev, "failed to add irq_domain\n");
+		return -EINVAL;
+	}
+
+	msm_mdss->irq_controller.enabled_mask = 0;
+	msm_mdss->irq_controller.domain = domain;
+
+	return 0;
+}
+
+static void msm_mdss_setup_ubwc_dec_20(struct msm_mdss *msm_mdss)
+{
+	const struct msm_mdss_data *data = msm_mdss->mdss_data;
+
+	writel_relaxed(data->ubwc_static, msm_mdss->mmio + UBWC_STATIC);
+}
+
+static void msm_mdss_setup_ubwc_dec_30(struct msm_mdss *msm_mdss)
+{
+	const struct msm_mdss_data *data = msm_mdss->mdss_data;
+	u32 value = (data->ubwc_swizzle & 0x1) |
+		    (data->highest_bank_bit & 0x3) << 4 |
+		    (data->macrotile_mode & 0x1) << 12;
+
+	if (data->ubwc_enc_version == UBWC_3_0)
+		value |= BIT(10);
+
+	if (data->ubwc_enc_version == UBWC_1_0)
+		value |= BIT(8);
+
+	writel_relaxed(value, msm_mdss->mmio + UBWC_STATIC);
+}
+
+static void msm_mdss_setup_ubwc_dec_40(struct msm_mdss *msm_mdss)
+{
+	const struct msm_mdss_data *data = msm_mdss->mdss_data;
+	u32 value = (data->ubwc_swizzle & 0x7) |
+		    (data->ubwc_static & 0x1) << 3 |
+		    (data->highest_bank_bit & 0x7) << 4 |
+		    (data->macrotile_mode & 0x1) << 12;
+
+	writel_relaxed(value, msm_mdss->mmio + UBWC_STATIC);
+
+	if (data->ubwc_enc_version == UBWC_3_0) {
+		writel_relaxed(1, msm_mdss->mmio + UBWC_CTRL_2);
+		writel_relaxed(0, msm_mdss->mmio + UBWC_PREDICTION_MODE);
+	} else {
+		if (data->ubwc_dec_version == UBWC_4_3)
+			writel_relaxed(3, msm_mdss->mmio + UBWC_CTRL_2);
+		else
+			writel_relaxed(2, msm_mdss->mmio + UBWC_CTRL_2);
+		writel_relaxed(1, msm_mdss->mmio + UBWC_PREDICTION_MODE);
+	}
+}
+
+const struct msm_mdss_data *msm_mdss_get_mdss_data(struct device *dev)
+{
+	struct msm_mdss *mdss;
+
+	if (!dev)
+		return ERR_PTR(-EINVAL);
+
+	mdss = dev_get_drvdata(dev);
+
+	return mdss->mdss_data;
+}
+
+static int msm_mdss_enable(struct msm_mdss *msm_mdss)
+{
+	int ret, i;
+
+	/*
+	 * Several components have AXI clocks that can only be turned on if
+	 * the interconnect is enabled (non-zero bandwidth). Let's make sure
+	 * that the interconnects are at least at a minimum amount.
+	 */
+	for (i = 0; i < msm_mdss->num_mdp_paths; i++)
+		icc_set_bw(msm_mdss->mdp_path[i], 0, Bps_to_icc(MIN_IB_BW));
+
+	if (msm_mdss->mdss_data && msm_mdss->mdss_data->reg_bus_bw)
+		icc_set_bw(msm_mdss->reg_bus_path, 0,
+			   msm_mdss->mdss_data->reg_bus_bw);
+	else
+		icc_set_bw(msm_mdss->reg_bus_path, 0,
+			   DEFAULT_REG_BW);
+
+	ret = clk_bulk_prepare_enable(msm_mdss->num_clocks, msm_mdss->clocks);
+	if (ret) {
+		dev_err(msm_mdss->dev, "clock enable failed, ret:%d\n", ret);
+		return ret;
+	}
+
+	/*
+	 * Register access requires MDSS_MDP_CLK, which is not enabled by the
+	 * mdss on mdp5 hardware. Skip it for now.
+	 */
+	if (msm_mdss->is_mdp5 || !msm_mdss->mdss_data)
+		return 0;
+
+	/*
+	 * ubwc config is part of the "mdss" region which is not accessible
+	 * from the rest of the driver. hardcode known configurations here
+	 *
+	 * Decoder version can be read from the UBWC_DEC_HW_VERSION reg,
+	 * UBWC_n and the rest of params comes from hw data.
+	 */
+	switch (msm_mdss->mdss_data->ubwc_dec_version) {
+	case 0: /* no UBWC */
+	case UBWC_1_0:
+		/* do nothing */
+		break;
+	case UBWC_2_0:
+		msm_mdss_setup_ubwc_dec_20(msm_mdss);
+		break;
+	case UBWC_3_0:
+		msm_mdss_setup_ubwc_dec_30(msm_mdss);
+		break;
+	case UBWC_4_0:
+	case UBWC_4_3:
+		msm_mdss_setup_ubwc_dec_40(msm_mdss);
+		break;
+	default:
+		dev_err(msm_mdss->dev, "Unsupported UBWC decoder version %x\n",
+			msm_mdss->mdss_data->ubwc_dec_version);
+		dev_err(msm_mdss->dev, "HW_REV: 0x%x\n",
+			readl_relaxed(msm_mdss->mmio + HW_REV));
+		dev_err(msm_mdss->dev, "UBWC_DEC_HW_VERSION: 0x%x\n",
+			readl_relaxed(msm_mdss->mmio + UBWC_DEC_HW_VERSION));
+		break;
+	}
+
+	return ret;
+}
+
+static int msm_mdss_disable(struct msm_mdss *msm_mdss)
+{
+	int i;
+
+	clk_bulk_disable_unprepare(msm_mdss->num_clocks, msm_mdss->clocks);
+
+	for (i = 0; i < msm_mdss->num_mdp_paths; i++)
+		icc_set_bw(msm_mdss->mdp_path[i], 0, 0);
+
+	if (msm_mdss->reg_bus_path)
+		icc_set_bw(msm_mdss->reg_bus_path, 0, 0);
+
+	return 0;
+}
+
+static void msm_mdss_destroy(struct msm_mdss *msm_mdss)
+{
+	struct platform_device *pdev = to_platform_device(msm_mdss->dev);
+	int irq;
+
+	pm_runtime_suspend(msm_mdss->dev);
+	pm_runtime_disable(msm_mdss->dev);
+	irq_domain_remove(msm_mdss->irq_controller.domain);
+	msm_mdss->irq_controller.domain = NULL;
+	irq = platform_get_irq(pdev, 0);
+	irq_set_chained_handler_and_data(irq, NULL, NULL);
+}
+
+static int msm_mdss_reset(struct device *dev)
+{
+	struct reset_control *reset;
+
+	reset = reset_control_get_optional_exclusive(dev, NULL);
+	if (!reset) {
+		/* Optional reset not specified */
+		return 0;
+	} else if (IS_ERR(reset)) {
+		return dev_err_probe(dev, PTR_ERR(reset),
+				     "failed to acquire mdss reset\n");
+	}
+
+	reset_control_assert(reset);
+	/*
+	 * Tests indicate that reset has to be held for some period of time,
+	 * make it one frame in a typical system
+	 */
+	msleep(20);
+	reset_control_deassert(reset);
+
+	reset_control_put(reset);
+
+	return 0;
+}
+
+/*
+ * MDP5 MDSS uses at most three specified clocks.
+ */
+#define MDP5_MDSS_NUM_CLOCKS 3
+static int mdp5_mdss_parse_clock(struct platform_device *pdev, struct clk_bulk_data **clocks)
+{
+	struct clk_bulk_data *bulk;
+	int num_clocks = 0;
+	int ret;
+
+	if (!pdev)
+		return -EINVAL;
+
+	bulk = devm_kcalloc(&pdev->dev, MDP5_MDSS_NUM_CLOCKS, sizeof(struct clk_bulk_data), GFP_KERNEL);
+	if (!bulk)
+		return -ENOMEM;
+
+	bulk[num_clocks++].id = "iface";
+	bulk[num_clocks++].id = "bus";
+	bulk[num_clocks++].id = "vsync";
+
+	ret = devm_clk_bulk_get_optional(&pdev->dev, num_clocks, bulk);
+	if (ret)
+		return ret;
+
+	*clocks = bulk;
+
+	return num_clocks;
+}
+
+static struct msm_mdss *msm_mdss_init(struct platform_device *pdev, bool is_mdp5)
+{
+	struct msm_mdss *msm_mdss;
+	int ret;
+	int irq;
+
+	ret = msm_mdss_reset(&pdev->dev);
+	if (ret)
+		return ERR_PTR(ret);
+
+	msm_mdss = devm_kzalloc(&pdev->dev, sizeof(*msm_mdss), GFP_KERNEL);
+	if (!msm_mdss)
+		return ERR_PTR(-ENOMEM);
+
+	msm_mdss->mdss_data = of_device_get_match_data(&pdev->dev);
+
+	msm_mdss->mmio = devm_platform_ioremap_resource_byname(pdev, is_mdp5 ? "mdss_phys" : "mdss");
+	if (IS_ERR(msm_mdss->mmio))
+		return ERR_CAST(msm_mdss->mmio);
+
+	dev_dbg(&pdev->dev, "mapped mdss address space @%pK\n", msm_mdss->mmio);
+
+	ret = msm_mdss_parse_data_bus_icc_path(&pdev->dev, msm_mdss);
+	if (ret)
+		return ERR_PTR(ret);
+
+	if (is_mdp5)
+		ret = mdp5_mdss_parse_clock(pdev, &msm_mdss->clocks);
+	else
+		ret = devm_clk_bulk_get_all(&pdev->dev, &msm_mdss->clocks);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "failed to parse clocks, ret=%d\n", ret);
+		return ERR_PTR(ret);
+	}
+	msm_mdss->num_clocks = ret;
+	msm_mdss->is_mdp5 = is_mdp5;
+
+	msm_mdss->dev = &pdev->dev;
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return ERR_PTR(irq);
+
+	ret = _msm_mdss_irq_domain_add(msm_mdss);
+	if (ret)
+		return ERR_PTR(ret);
+
+	irq_set_chained_handler_and_data(irq, msm_mdss_irq,
+					 msm_mdss);
+
+	pm_runtime_enable(&pdev->dev);
+
+	return msm_mdss;
+}
+
+static int __maybe_unused mdss_runtime_suspend(struct device *dev)
+{
+	struct msm_mdss *mdss = dev_get_drvdata(dev);
+
+	DBG("");
+
+	return msm_mdss_disable(mdss);
+}
+
+static int __maybe_unused mdss_runtime_resume(struct device *dev)
+{
+	struct msm_mdss *mdss = dev_get_drvdata(dev);
+
+	DBG("");
+
+	return msm_mdss_enable(mdss);
+}
+
+static int __maybe_unused mdss_pm_suspend(struct device *dev)
+{
+
+	if (pm_runtime_suspended(dev))
+		return 0;
+
+	return mdss_runtime_suspend(dev);
+}
+
+static int __maybe_unused mdss_pm_resume(struct device *dev)
+{
+	if (pm_runtime_suspended(dev))
+		return 0;
+
+	return mdss_runtime_resume(dev);
+}
+
+static const struct dev_pm_ops mdss_pm_ops = {
+	SET_SYSTEM_SLEEP_PM_OPS(mdss_pm_suspend, mdss_pm_resume)
+	SET_RUNTIME_PM_OPS(mdss_runtime_suspend, mdss_runtime_resume, NULL)
+};
+
+static int mdss_probe(struct platform_device *pdev)
+{
+	struct msm_mdss *mdss;
+	bool is_mdp5 = of_device_is_compatible(pdev->dev.of_node, "qcom,mdss");
+	struct device *dev = &pdev->dev;
+	int ret;
+
+	mdss = msm_mdss_init(pdev, is_mdp5);
+	if (IS_ERR(mdss))
+		return PTR_ERR(mdss);
+
+	platform_set_drvdata(pdev, mdss);
+
+	/*
+	 * MDP5/DPU based devices don't have a flat hierarchy. There is a top
+	 * level parent: MDSS, and children: MDP5/DPU, DSI, HDMI, eDP etc.
+	 * Populate the children devices, find the MDP5/DPU node, and then add
+	 * the interfaces to our components list.
+	 */
+	ret = of_platform_populate(dev->of_node, NULL, NULL, dev);
+	if (ret) {
+		DRM_DEV_ERROR(dev, "failed to populate children devices\n");
+		msm_mdss_destroy(mdss);
+		return ret;
+	}
+
+	return 0;
+}
+
+static void mdss_remove(struct platform_device *pdev)
+{
+	struct msm_mdss *mdss = platform_get_drvdata(pdev);
+
+	of_platform_depopulate(&pdev->dev);
+
+	msm_mdss_destroy(mdss);
+}
+
+static const struct msm_mdss_data msm8998_data = {
+	.ubwc_enc_version = UBWC_1_0,
+	.ubwc_dec_version = UBWC_1_0,
+	.highest_bank_bit = 2,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data qcm2290_data = {
+	/* no UBWC */
+	.highest_bank_bit = 0x2,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sc7180_data = {
+	.ubwc_enc_version = UBWC_2_0,
+	.ubwc_dec_version = UBWC_2_0,
+	.ubwc_static = 0x1e,
+	.highest_bank_bit = 0x1,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sc7280_data = {
+	.ubwc_enc_version = UBWC_3_0,
+	.ubwc_dec_version = UBWC_4_0,
+	.ubwc_swizzle = 6,
+	.ubwc_static = 1,
+	.highest_bank_bit = 1,
+	.macrotile_mode = 1,
+	.reg_bus_bw = 74000,
+};
+
+static const struct msm_mdss_data sc8180x_data = {
+	.ubwc_enc_version = UBWC_3_0,
+	.ubwc_dec_version = UBWC_3_0,
+	.highest_bank_bit = 3,
+	.macrotile_mode = 1,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sc8280xp_data = {
+	.ubwc_enc_version = UBWC_4_0,
+	.ubwc_dec_version = UBWC_4_0,
+	.ubwc_swizzle = 6,
+	.ubwc_static = 1,
+	.highest_bank_bit = 3,
+	.macrotile_mode = 1,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sdm670_data = {
+	.ubwc_enc_version = UBWC_2_0,
+	.ubwc_dec_version = UBWC_2_0,
+	.highest_bank_bit = 1,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sdm845_data = {
+	.ubwc_enc_version = UBWC_2_0,
+	.ubwc_dec_version = UBWC_2_0,
+	.highest_bank_bit = 2,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sm6350_data = {
+	.ubwc_enc_version = UBWC_2_0,
+	.ubwc_dec_version = UBWC_2_0,
+	.ubwc_swizzle = 6,
+	.ubwc_static = 0x1e,
+	.highest_bank_bit = 1,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sm8150_data = {
+	.ubwc_enc_version = UBWC_3_0,
+	.ubwc_dec_version = UBWC_3_0,
+	.highest_bank_bit = 2,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sm6115_data = {
+	.ubwc_enc_version = UBWC_1_0,
+	.ubwc_dec_version = UBWC_2_0,
+	.ubwc_swizzle = 7,
+	.ubwc_static = 0x11f,
+	.highest_bank_bit = 0x1,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sm6125_data = {
+	.ubwc_enc_version = UBWC_1_0,
+	.ubwc_dec_version = UBWC_3_0,
+	.ubwc_swizzle = 1,
+	.highest_bank_bit = 1,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sm8250_data = {
+	.ubwc_enc_version = UBWC_4_0,
+	.ubwc_dec_version = UBWC_4_0,
+	.ubwc_swizzle = 6,
+	.ubwc_static = 1,
+	/* TODO: highest_bank_bit = 2 for LP_DDR4 */
+	.highest_bank_bit = 3,
+	.macrotile_mode = 1,
+	.reg_bus_bw = 76800,
+};
+
+static const struct msm_mdss_data sm8350_data = {
+	.ubwc_enc_version = UBWC_4_0,
+	.ubwc_dec_version = UBWC_4_0,
+	.ubwc_swizzle = 6,
+	.ubwc_static = 1,
+	/* TODO: highest_bank_bit = 2 for LP_DDR4 */
+	.highest_bank_bit = 3,
+	.macrotile_mode = 1,
+	.reg_bus_bw = 74000,
+};
+
+static const struct msm_mdss_data qcs8300_data = {
+	.ubwc_enc_version = UBWC_4_0,
+	.ubwc_dec_version = UBWC_4_0,
+	.ubwc_swizzle = 6,
+	.ubwc_static = 1,
+	.highest_bank_bit = 3,
+	.macrotile_mode = 1,
+};
+
+static const struct msm_mdss_data sa8775p_data = {
+	.ubwc_enc_version = UBWC_4_0,
+	.ubwc_dec_version = UBWC_4_0,
+	.ubwc_swizzle = 4,
+	.ubwc_static = 1,
+	.highest_bank_bit = 0,
+	.macrotile_mode = 1,
+};
+
+static const struct msm_mdss_data sm8550_data = {
+	.ubwc_enc_version = UBWC_4_0,
+	.ubwc_dec_version = UBWC_4_3,
+	.ubwc_swizzle = 6,
+	.ubwc_static = 1,
+	/* TODO: highest_bank_bit = 2 for LP_DDR4 */
+	.highest_bank_bit = 3,
+	.macrotile_mode = 1,
+	.reg_bus_bw = 57000,
+};
+static const struct of_device_id mdss_dt_match[] = {
+	{ .compatible = "qcom,mdss" },
+	{ .compatible = "qcom,msm8998-mdss", .data = &msm8998_data },
+	{ .compatible = "qcom,qcm2290-mdss", .data = &qcm2290_data },
+	{ .compatible = "qcom,sdm670-mdss", .data = &sdm670_data },
+	{ .compatible = "qcom,sdm845-mdss", .data = &sdm845_data },
+	{ .compatible = "qcom,sc7180-mdss", .data = &sc7180_data },
+	{ .compatible = "qcom,sc7280-mdss", .data = &sc7280_data },
+	{ .compatible = "qcom,sc8180x-mdss", .data = &sc8180x_data },
+	{ .compatible = "qcom,sc8280xp-mdss", .data = &sc8280xp_data },
+	{ .compatible = "qcom,sm6115-mdss", .data = &sm6115_data },
+	{ .compatible = "qcom,sm6125-mdss", .data = &sm6125_data },
+	{ .compatible = "qcom,sm6350-mdss", .data = &sm6350_data },
+	{ .compatible = "qcom,sm6375-mdss", .data = &sm6350_data },
+	{ .compatible = "qcom,sm8150-mdss", .data = &sm8150_data },
+	{ .compatible = "qcom,sm8250-mdss", .data = &sm8250_data },
+	{ .compatible = "qcom,sm8350-mdss", .data = &sm8350_data },
+	{ .compatible = "qcom,sm8450-mdss", .data = &sm8350_data },
+	{ .compatible = "qcom,qcs8300-mdss", .data = &qcs8300_data },
+	{ .compatible = "qcom,sa8775p-mdss", .data = &sa8775p_data },
+	{ .compatible = "qcom,sm8550-mdss", .data = &sm8550_data },
+	{ .compatible = "qcom,sm8650-mdss", .data = &sm8550_data},
+	{}
+};
+MODULE_DEVICE_TABLE(of, mdss_dt_match);
+
+static struct platform_driver mdss_platform_driver = {
+	.probe      = mdss_probe,
+	.remove_new = mdss_remove,
+	.driver     = {
+		.name   = "msm-mdss",
+		.of_match_table = mdss_dt_match,
+		.pm     = &mdss_pm_ops,
+	},
+};
+
+void __init msm_mdss_register(void)
+{
+	platform_driver_register(&mdss_platform_driver);
+}
+
+void __exit msm_mdss_unregister(void)
+{
+	platform_driver_unregister(&mdss_platform_driver);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_mdss.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_mdss.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018, The Linux Foundation
+ */
+
+#ifndef __MSM_MDSS_H__
+#define __MSM_MDSS_H__
+
+struct msm_mdss_data {
+	u32 ubwc_enc_version;
+	/* can be read from register 0x58 */
+	u32 ubwc_dec_version;
+	u32 ubwc_swizzle;
+	u32 ubwc_static;
+	u32 highest_bank_bit;
+	u32 macrotile_mode;
+	u32 reg_bus_bw;
+};
+
+#define UBWC_1_0 0x10000000
+#define UBWC_2_0 0x20000000
+#define UBWC_3_0 0x30000000
+#define UBWC_4_0 0x40000000
+#define UBWC_4_3 0x40030000
+
+const struct msm_mdss_data *msm_mdss_get_mdss_data(struct device *dev);
+
+#endif /* __MSM_MDSS_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_mmu.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_mmu.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MSM_MMU_H__
+#define __MSM_MMU_H__
+
+#include <linux/iommu.h>
+
+struct msm_mmu_funcs {
+	void (*detach)(struct msm_mmu *mmu);
+	int (*map)(struct msm_mmu *mmu, uint64_t iova, struct sg_table *sgt,
+			size_t len, int prot);
+	int (*unmap)(struct msm_mmu *mmu, uint64_t iova, size_t len);
+	void (*destroy)(struct msm_mmu *mmu);
+	void (*resume_translation)(struct msm_mmu *mmu);
+};
+
+enum msm_mmu_type {
+	MSM_MMU_GPUMMU,
+	MSM_MMU_IOMMU,
+	MSM_MMU_IOMMU_PAGETABLE,
+};
+
+struct msm_mmu {
+	const struct msm_mmu_funcs *funcs;
+	struct device *dev;
+	int (*handler)(void *arg, unsigned long iova, int flags, void *data);
+	void *arg;
+	enum msm_mmu_type type;
+};
+
+static inline void msm_mmu_init(struct msm_mmu *mmu, struct device *dev,
+		const struct msm_mmu_funcs *funcs, enum msm_mmu_type type)
+{
+	mmu->dev = dev;
+	mmu->funcs = funcs;
+	mmu->type = type;
+}
+
+struct msm_mmu *msm_iommu_new(struct device *dev, unsigned long quirks);
+struct msm_mmu *msm_iommu_gpu_new(struct device *dev, struct msm_gpu *gpu, unsigned long quirks);
+
+static inline void msm_mmu_set_fault_handler(struct msm_mmu *mmu, void *arg,
+		int (*handler)(void *arg, unsigned long iova, int flags, void *data))
+{
+	mmu->arg = arg;
+	mmu->handler = handler;
+}
+
+struct msm_mmu *msm_iommu_pagetable_create(struct msm_mmu *parent);
+
+int msm_iommu_pagetable_params(struct msm_mmu *mmu, phys_addr_t *ttbr,
+		int *asid);
+struct iommu_domain_geometry *msm_iommu_get_geometry(struct msm_mmu *mmu);
+
+#endif /* __MSM_MMU_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_perf.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_perf.c
@@ -0,0 +1,236 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+/* For profiling, userspace can:
+ *
+ *   tail -f /sys/kernel/debug/dri/<minor>/gpu
+ *
+ * This will enable performance counters/profiling to track the busy time
+ * and any gpu specific performance counters that are supported.
+ */
+
+#ifdef CONFIG_DEBUG_FS
+
+#include <linux/debugfs.h>
+#include <linux/uaccess.h>
+
+#include <drm/drm_file.h>
+
+#include "msm_drv.h"
+#include "msm_gpu.h"
+
+struct msm_perf_state {
+	struct drm_device *dev;
+
+	bool open;
+	int cnt;
+	struct mutex read_lock;
+
+	char buf[256];
+	int buftot, bufpos;
+
+	unsigned long next_jiffies;
+};
+
+#define SAMPLE_TIME (HZ/4)
+
+/* wait for next sample time: */
+static int wait_sample(struct msm_perf_state *perf)
+{
+	unsigned long start_jiffies = jiffies;
+
+	if (time_after(perf->next_jiffies, start_jiffies)) {
+		unsigned long remaining_jiffies =
+			perf->next_jiffies - start_jiffies;
+		int ret = schedule_timeout_interruptible(remaining_jiffies);
+		if (ret > 0) {
+			/* interrupted */
+			return -ERESTARTSYS;
+		}
+	}
+	perf->next_jiffies += SAMPLE_TIME;
+	return 0;
+}
+
+static int refill_buf(struct msm_perf_state *perf)
+{
+	struct msm_drm_private *priv = perf->dev->dev_private;
+	struct msm_gpu *gpu = priv->gpu;
+	char *ptr = perf->buf;
+	int rem = sizeof(perf->buf);
+	int i, n;
+
+	if ((perf->cnt++ % 32) == 0) {
+		/* Header line: */
+		n = snprintf(ptr, rem, "%%BUSY");
+		ptr += n;
+		rem -= n;
+
+		for (i = 0; i < gpu->num_perfcntrs; i++) {
+			const struct msm_gpu_perfcntr *perfcntr = &gpu->perfcntrs[i];
+			n = snprintf(ptr, rem, "\t%s", perfcntr->name);
+			ptr += n;
+			rem -= n;
+		}
+	} else {
+		/* Sample line: */
+		uint32_t activetime = 0, totaltime = 0;
+		uint32_t cntrs[5];
+		uint32_t val;
+		int ret;
+
+		/* sleep until next sample time: */
+		ret = wait_sample(perf);
+		if (ret)
+			return ret;
+
+		ret = msm_gpu_perfcntr_sample(gpu, &activetime, &totaltime,
+				ARRAY_SIZE(cntrs), cntrs);
+		if (ret < 0)
+			return ret;
+
+		val = totaltime ? 1000 * activetime / totaltime : 0;
+		n = snprintf(ptr, rem, "%3d.%d%%", val / 10, val % 10);
+		ptr += n;
+		rem -= n;
+
+		for (i = 0; i < ret; i++) {
+			/* cycle counters (I think).. convert to MHz.. */
+			val = cntrs[i] / 10000;
+			n = snprintf(ptr, rem, "\t%5d.%02d",
+					val / 100, val % 100);
+			ptr += n;
+			rem -= n;
+		}
+	}
+
+	n = snprintf(ptr, rem, "\n");
+	ptr += n;
+	rem -= n;
+
+	perf->bufpos = 0;
+	perf->buftot = ptr - perf->buf;
+
+	return 0;
+}
+
+static ssize_t perf_read(struct file *file, char __user *buf,
+		size_t sz, loff_t *ppos)
+{
+	struct msm_perf_state *perf = file->private_data;
+	int n = 0, ret = 0;
+
+	mutex_lock(&perf->read_lock);
+
+	if (perf->bufpos >= perf->buftot) {
+		ret = refill_buf(perf);
+		if (ret)
+			goto out;
+	}
+
+	n = min((int)sz, perf->buftot - perf->bufpos);
+	if (copy_to_user(buf, &perf->buf[perf->bufpos], n)) {
+		ret = -EFAULT;
+		goto out;
+	}
+
+	perf->bufpos += n;
+	*ppos += n;
+
+out:
+	mutex_unlock(&perf->read_lock);
+	if (ret)
+		return ret;
+	return n;
+}
+
+static int perf_open(struct inode *inode, struct file *file)
+{
+	struct msm_perf_state *perf = inode->i_private;
+	struct drm_device *dev = perf->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_gpu *gpu = priv->gpu;
+	int ret = 0;
+
+	if (!gpu)
+		return -ENODEV;
+
+	mutex_lock(&gpu->lock);
+
+	if (perf->open) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	file->private_data = perf;
+	perf->open = true;
+	perf->cnt = 0;
+	perf->buftot = 0;
+	perf->bufpos = 0;
+	msm_gpu_perfcntr_start(gpu);
+	perf->next_jiffies = jiffies + SAMPLE_TIME;
+
+out:
+	mutex_unlock(&gpu->lock);
+	return ret;
+}
+
+static int perf_release(struct inode *inode, struct file *file)
+{
+	struct msm_perf_state *perf = inode->i_private;
+	struct msm_drm_private *priv = perf->dev->dev_private;
+	msm_gpu_perfcntr_stop(priv->gpu);
+	perf->open = false;
+	return 0;
+}
+
+
+static const struct file_operations perf_debugfs_fops = {
+	.owner = THIS_MODULE,
+	.open = perf_open,
+	.read = perf_read,
+	.llseek = no_llseek,
+	.release = perf_release,
+};
+
+int msm_perf_debugfs_init(struct drm_minor *minor)
+{
+	struct msm_drm_private *priv = minor->dev->dev_private;
+	struct msm_perf_state *perf;
+
+	/* only create on first minor: */
+	if (priv->perf)
+		return 0;
+
+	perf = kzalloc(sizeof(*perf), GFP_KERNEL);
+	if (!perf)
+		return -ENOMEM;
+
+	perf->dev = minor->dev;
+
+	mutex_init(&perf->read_lock);
+	priv->perf = perf;
+
+	debugfs_create_file("perf", S_IFREG | S_IRUGO, minor->debugfs_root,
+			    perf, &perf_debugfs_fops);
+	return 0;
+}
+
+void msm_perf_debugfs_cleanup(struct msm_drm_private *priv)
+{
+	struct msm_perf_state *perf = priv->perf;
+
+	if (!perf)
+		return;
+
+	priv->perf = NULL;
+
+	mutex_destroy(&perf->read_lock);
+
+	kfree(perf);
+}
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_rd.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_rd.c
@@ -0,0 +1,423 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+/* For debugging crashes, userspace can:
+ *
+ *   tail -f /sys/kernel/debug/dri/<minor>/rd > logfile.rd
+ *
+ * to log the cmdstream in a format that is understood by freedreno/cffdump
+ * utility.  By comparing the last successfully completed fence #, to the
+ * cmdstream for the next fence, you can narrow down which process and submit
+ * caused the gpu crash/lockup.
+ *
+ * Additionally:
+ *
+ *   tail -f /sys/kernel/debug/dri/<minor>/hangrd > logfile.rd
+ *
+ * will capture just the cmdstream from submits which triggered a GPU hang.
+ *
+ * This bypasses drm_debugfs_create_files() mainly because we need to use
+ * our own fops for a bit more control.  In particular, we don't want to
+ * do anything if userspace doesn't have the debugfs file open.
+ *
+ * The module-param "rd_full", which defaults to false, enables snapshotting
+ * all (non-written) buffers in the submit, rather than just cmdstream bo's.
+ * This is useful to capture the contents of (for example) vbo's or textures,
+ * or shader programs (if not emitted inline in cmdstream).
+ */
+
+#include <linux/circ_buf.h>
+#include <linux/debugfs.h>
+#include <linux/kfifo.h>
+#include <linux/uaccess.h>
+#include <linux/wait.h>
+
+#include <drm/drm_file.h>
+
+#include "msm_drv.h"
+#include "msm_gpu.h"
+#include "msm_gem.h"
+
+bool rd_full = false;
+MODULE_PARM_DESC(rd_full, "If true, $debugfs/.../rd will snapshot all buffer contents");
+module_param_named(rd_full, rd_full, bool, 0600);
+
+#ifdef CONFIG_DEBUG_FS
+
+enum rd_sect_type {
+	RD_NONE,
+	RD_TEST,       /* ascii text */
+	RD_CMD,        /* ascii text */
+	RD_GPUADDR,    /* u32 gpuaddr, u32 size */
+	RD_CONTEXT,    /* raw dump */
+	RD_CMDSTREAM,  /* raw dump */
+	RD_CMDSTREAM_ADDR, /* gpu addr of cmdstream */
+	RD_PARAM,      /* u32 param_type, u32 param_val, u32 bitlen */
+	RD_FLUSH,      /* empty, clear previous params */
+	RD_PROGRAM,    /* shader program, raw dump */
+	RD_VERT_SHADER,
+	RD_FRAG_SHADER,
+	RD_BUFFER_CONTENTS,
+	RD_GPU_ID,
+	RD_CHIP_ID,
+};
+
+#define BUF_SZ 512  /* should be power of 2 */
+
+/* space used: */
+#define circ_count(circ) \
+	(CIRC_CNT((circ)->head, (circ)->tail, BUF_SZ))
+#define circ_count_to_end(circ) \
+	(CIRC_CNT_TO_END((circ)->head, (circ)->tail, BUF_SZ))
+/* space available: */
+#define circ_space(circ) \
+	(CIRC_SPACE((circ)->head, (circ)->tail, BUF_SZ))
+#define circ_space_to_end(circ) \
+	(CIRC_SPACE_TO_END((circ)->head, (circ)->tail, BUF_SZ))
+
+struct msm_rd_state {
+	struct drm_device *dev;
+
+	bool open;
+
+	/* fifo access is synchronized on the producer side by
+	 * write_lock.  And read_lock synchronizes the reads
+	 */
+	struct mutex read_lock, write_lock;
+
+	wait_queue_head_t fifo_event;
+	struct circ_buf fifo;
+
+	char buf[BUF_SZ];
+};
+
+static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
+{
+	struct circ_buf *fifo = &rd->fifo;
+	const char *ptr = buf;
+
+	while (sz > 0) {
+		char *fptr = &fifo->buf[fifo->head];
+		int n;
+
+		wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open);
+		if (!rd->open)
+			return;
+
+		/* Note that smp_load_acquire() is not strictly required
+		 * as CIRC_SPACE_TO_END() does not access the tail more
+		 * than once.
+		 */
+		n = min(sz, circ_space_to_end(&rd->fifo));
+		memcpy(fptr, ptr, n);
+
+		smp_store_release(&fifo->head, (fifo->head + n) & (BUF_SZ - 1));
+		sz  -= n;
+		ptr += n;
+
+		wake_up_all(&rd->fifo_event);
+	}
+}
+
+static void rd_write_section(struct msm_rd_state *rd,
+		enum rd_sect_type type, const void *buf, int sz)
+{
+	rd_write(rd, &type, 4);
+	rd_write(rd, &sz, 4);
+	rd_write(rd, buf, sz);
+}
+
+static ssize_t rd_read(struct file *file, char __user *buf,
+		size_t sz, loff_t *ppos)
+{
+	struct msm_rd_state *rd = file->private_data;
+	struct circ_buf *fifo = &rd->fifo;
+	const char *fptr = &fifo->buf[fifo->tail];
+	int n = 0, ret = 0;
+
+	mutex_lock(&rd->read_lock);
+
+	ret = wait_event_interruptible(rd->fifo_event,
+			circ_count(&rd->fifo) > 0);
+	if (ret)
+		goto out;
+
+	/* Note that smp_load_acquire() is not strictly required
+	 * as CIRC_CNT_TO_END() does not access the head more than
+	 * once.
+	 */
+	n = min_t(int, sz, circ_count_to_end(&rd->fifo));
+	if (copy_to_user(buf, fptr, n)) {
+		ret = -EFAULT;
+		goto out;
+	}
+
+	smp_store_release(&fifo->tail, (fifo->tail + n) & (BUF_SZ - 1));
+	*ppos += n;
+
+	wake_up_all(&rd->fifo_event);
+
+out:
+	mutex_unlock(&rd->read_lock);
+	if (ret)
+		return ret;
+	return n;
+}
+
+static int rd_open(struct inode *inode, struct file *file)
+{
+	struct msm_rd_state *rd = inode->i_private;
+	struct drm_device *dev = rd->dev;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_gpu *gpu = priv->gpu;
+	uint64_t val;
+	uint32_t gpu_id;
+	uint32_t zero = 0;
+	int ret = 0;
+
+	if (!gpu)
+		return -ENODEV;
+
+	mutex_lock(&gpu->lock);
+
+	if (rd->open) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	file->private_data = rd;
+	rd->open = true;
+
+	/* Reset fifo to clear any previously unread data: */
+	rd->fifo.head = rd->fifo.tail = 0;
+
+	/* the parsing tools need to know gpu-id to know which
+	 * register database to load.
+	 *
+	 * Note: These particular params do not require a context
+	 */
+	gpu->funcs->get_param(gpu, NULL, MSM_PARAM_GPU_ID, &val, &zero);
+	gpu_id = val;
+
+	rd_write_section(rd, RD_GPU_ID, &gpu_id, sizeof(gpu_id));
+
+	gpu->funcs->get_param(gpu, NULL, MSM_PARAM_CHIP_ID, &val, &zero);
+	rd_write_section(rd, RD_CHIP_ID, &val, sizeof(val));
+
+out:
+	mutex_unlock(&gpu->lock);
+	return ret;
+}
+
+static int rd_release(struct inode *inode, struct file *file)
+{
+	struct msm_rd_state *rd = inode->i_private;
+
+	rd->open = false;
+	wake_up_all(&rd->fifo_event);
+
+	return 0;
+}
+
+
+static const struct file_operations rd_debugfs_fops = {
+	.owner = THIS_MODULE,
+	.open = rd_open,
+	.read = rd_read,
+	.llseek = no_llseek,
+	.release = rd_release,
+};
+
+
+static void rd_cleanup(struct msm_rd_state *rd)
+{
+	if (!rd)
+		return;
+
+	mutex_destroy(&rd->read_lock);
+	mutex_destroy(&rd->write_lock);
+	kfree(rd);
+}
+
+static struct msm_rd_state *rd_init(struct drm_minor *minor, const char *name)
+{
+	struct msm_rd_state *rd;
+
+	rd = kzalloc(sizeof(*rd), GFP_KERNEL);
+	if (!rd)
+		return ERR_PTR(-ENOMEM);
+
+	rd->dev = minor->dev;
+	rd->fifo.buf = rd->buf;
+
+	mutex_init(&rd->read_lock);
+	mutex_init(&rd->write_lock);
+
+	init_waitqueue_head(&rd->fifo_event);
+
+	debugfs_create_file(name, S_IFREG | S_IRUGO, minor->debugfs_root, rd,
+			    &rd_debugfs_fops);
+
+	return rd;
+}
+
+int msm_rd_debugfs_init(struct drm_minor *minor)
+{
+	struct msm_drm_private *priv = minor->dev->dev_private;
+	struct msm_rd_state *rd;
+	int ret;
+
+	if (!priv->gpu_pdev)
+		return 0;
+
+	/* only create on first minor: */
+	if (priv->rd)
+		return 0;
+
+	rd = rd_init(minor, "rd");
+	if (IS_ERR(rd)) {
+		ret = PTR_ERR(rd);
+		goto fail;
+	}
+
+	priv->rd = rd;
+
+	rd = rd_init(minor, "hangrd");
+	if (IS_ERR(rd)) {
+		ret = PTR_ERR(rd);
+		goto fail;
+	}
+
+	priv->hangrd = rd;
+
+	return 0;
+
+fail:
+	msm_rd_debugfs_cleanup(priv);
+	return ret;
+}
+
+void msm_rd_debugfs_cleanup(struct msm_drm_private *priv)
+{
+	rd_cleanup(priv->rd);
+	priv->rd = NULL;
+
+	rd_cleanup(priv->hangrd);
+	priv->hangrd = NULL;
+}
+
+static void snapshot_buf(struct msm_rd_state *rd,
+		struct msm_gem_submit *submit, int idx,
+		uint64_t iova, uint32_t size, bool full)
+{
+	struct drm_gem_object *obj = submit->bos[idx].obj;
+	unsigned offset = 0;
+	const char *buf;
+
+	if (iova) {
+		offset = iova - submit->bos[idx].iova;
+	} else {
+		iova = submit->bos[idx].iova;
+		size = obj->size;
+	}
+
+	/*
+	 * Always write the GPUADDR header so can get a complete list of all the
+	 * buffers in the cmd
+	 */
+	rd_write_section(rd, RD_GPUADDR,
+			(uint32_t[3]){ iova, size, iova >> 32 }, 12);
+
+	if (!full)
+		return;
+
+	/* But only dump the contents of buffers marked READ */
+	if (!(submit->bos[idx].flags & MSM_SUBMIT_BO_READ))
+		return;
+
+	buf = msm_gem_get_vaddr_active(obj);
+	if (IS_ERR(buf))
+		return;
+
+	buf += offset;
+
+	rd_write_section(rd, RD_BUFFER_CONTENTS, buf, size);
+
+	msm_gem_put_vaddr_locked(obj);
+}
+
+/* called under gpu->lock */
+void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
+		const char *fmt, ...)
+{
+	struct task_struct *task;
+	char msg[256];
+	int i, n;
+
+	if (!rd->open)
+		return;
+
+	mutex_lock(&rd->write_lock);
+
+	if (fmt) {
+		va_list args;
+
+		va_start(args, fmt);
+		n = vscnprintf(msg, sizeof(msg), fmt, args);
+		va_end(args);
+
+		rd_write_section(rd, RD_CMD, msg, ALIGN(n, 4));
+	}
+
+	rcu_read_lock();
+	task = pid_task(submit->pid, PIDTYPE_PID);
+	if (task) {
+		n = scnprintf(msg, sizeof(msg), "%.*s/%d: fence=%u",
+				TASK_COMM_LEN, task->comm,
+				pid_nr(submit->pid), submit->seqno);
+	} else {
+		n = scnprintf(msg, sizeof(msg), "???/%d: fence=%u",
+				pid_nr(submit->pid), submit->seqno);
+	}
+	rcu_read_unlock();
+
+	rd_write_section(rd, RD_CMD, msg, ALIGN(n, 4));
+
+	for (i = 0; i < submit->nr_bos; i++)
+		snapshot_buf(rd, submit, i, 0, 0, should_dump(submit, i));
+
+	for (i = 0; i < submit->nr_cmds; i++) {
+		uint32_t szd  = submit->cmd[i].size; /* in dwords */
+
+		/* snapshot cmdstream bo's (if we haven't already): */
+		if (!should_dump(submit, i)) {
+			snapshot_buf(rd, submit, submit->cmd[i].idx,
+					submit->cmd[i].iova, szd * 4, true);
+		}
+	}
+
+	for (i = 0; i < submit->nr_cmds; i++) {
+		uint64_t iova = submit->cmd[i].iova;
+		uint32_t szd  = submit->cmd[i].size; /* in dwords */
+
+		switch (submit->cmd[i].type) {
+		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
+			/* ignore IB-targets, we've logged the buffer, the
+			 * parser tool will follow the IB based on the logged
+			 * buffer/gpuaddr, so nothing more to do.
+			 */
+			break;
+		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
+		case MSM_SUBMIT_CMD_BUF:
+			rd_write_section(rd, RD_CMDSTREAM_ADDR,
+				(uint32_t[3]){ iova, szd, iova >> 32 }, 12);
+			break;
+		}
+	}
+
+	mutex_unlock(&rd->write_lock);
+}
+#endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_ringbuffer.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_ringbuffer.c
@@ -0,0 +1,136 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#include "msm_ringbuffer.h"
+#include "msm_gpu.h"
+
+static uint num_hw_submissions = 8;
+MODULE_PARM_DESC(num_hw_submissions, "The max # of jobs to write into ringbuffer (default 8)");
+module_param(num_hw_submissions, uint, 0600);
+
+static struct dma_fence *msm_job_run(struct drm_sched_job *job)
+{
+	struct msm_gem_submit *submit = to_msm_submit(job);
+	struct msm_fence_context *fctx = submit->ring->fctx;
+	struct msm_gpu *gpu = submit->gpu;
+	struct msm_drm_private *priv = gpu->dev->dev_private;
+	int i;
+
+	msm_fence_init(submit->hw_fence, fctx);
+
+	mutex_lock(&priv->lru.lock);
+
+	for (i = 0; i < submit->nr_bos; i++) {
+		struct drm_gem_object *obj = submit->bos[i].obj;
+
+		msm_gem_unpin_active(obj);
+	}
+
+	submit->bos_pinned = false;
+
+	mutex_unlock(&priv->lru.lock);
+
+	/* TODO move submit path over to using a per-ring lock.. */
+	mutex_lock(&gpu->lock);
+
+	msm_gpu_submit(gpu, submit);
+
+	mutex_unlock(&gpu->lock);
+
+	return dma_fence_get(submit->hw_fence);
+}
+
+static void msm_job_free(struct drm_sched_job *job)
+{
+	struct msm_gem_submit *submit = to_msm_submit(job);
+
+	drm_sched_job_cleanup(job);
+	msm_gem_submit_put(submit);
+}
+
+static const struct drm_sched_backend_ops msm_sched_ops = {
+	.run_job = msm_job_run,
+	.free_job = msm_job_free
+};
+
+struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int id,
+		void *memptrs, uint64_t memptrs_iova)
+{
+	struct msm_ringbuffer *ring;
+	long sched_timeout;
+	char name[32];
+	int ret;
+
+	/* We assume everwhere that MSM_GPU_RINGBUFFER_SZ is a power of 2 */
+	BUILD_BUG_ON(!is_power_of_2(MSM_GPU_RINGBUFFER_SZ));
+
+	ring = kzalloc(sizeof(*ring), GFP_KERNEL);
+	if (!ring) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	ring->gpu = gpu;
+	ring->id = id;
+
+	ring->start = msm_gem_kernel_new(gpu->dev, MSM_GPU_RINGBUFFER_SZ,
+		check_apriv(gpu, MSM_BO_WC | MSM_BO_GPU_READONLY),
+		gpu->aspace, &ring->bo, &ring->iova);
+
+	if (IS_ERR(ring->start)) {
+		ret = PTR_ERR(ring->start);
+		ring->start = NULL;
+		goto fail;
+	}
+
+	msm_gem_object_set_name(ring->bo, "ring%d", id);
+
+	ring->end   = ring->start + (MSM_GPU_RINGBUFFER_SZ >> 2);
+	ring->next  = ring->start;
+	ring->cur   = ring->start;
+
+	ring->memptrs = memptrs;
+	ring->memptrs_iova = memptrs_iova;
+
+	 /* currently managing hangcheck ourselves: */
+	sched_timeout = MAX_SCHEDULE_TIMEOUT;
+
+	ret = drm_sched_init(&ring->sched, &msm_sched_ops, NULL,
+			     DRM_SCHED_PRIORITY_COUNT,
+			     num_hw_submissions, 0, sched_timeout,
+			     NULL, NULL, to_msm_bo(ring->bo)->name, gpu->dev->dev);
+	if (ret) {
+		goto fail;
+	}
+
+	INIT_LIST_HEAD(&ring->submits);
+	spin_lock_init(&ring->submit_lock);
+	spin_lock_init(&ring->preempt_lock);
+
+	snprintf(name, sizeof(name), "gpu-ring-%d", ring->id);
+
+	ring->fctx = msm_fence_context_alloc(gpu->dev, &ring->memptrs->fence, name);
+
+	return ring;
+
+fail:
+	msm_ringbuffer_destroy(ring);
+	return ERR_PTR(ret);
+}
+
+void msm_ringbuffer_destroy(struct msm_ringbuffer *ring)
+{
+	if (IS_ERR_OR_NULL(ring))
+		return;
+
+	drm_sched_fini(&ring->sched);
+
+	msm_fence_context_free(ring->fctx);
+
+	msm_gem_kernel_put(ring->bo, ring->gpu->aspace);
+
+	kfree(ring);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_ringbuffer.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_ringbuffer.h
@@ -0,0 +1,122 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2013 Red Hat
+ * Author: Rob Clark <robdclark@gmail.com>
+ */
+
+#ifndef __MSM_RINGBUFFER_H__
+#define __MSM_RINGBUFFER_H__
+
+#include "drm/gpu_scheduler.h"
+#include "msm_drv.h"
+
+#define rbmemptr(ring, member)  \
+	((ring)->memptrs_iova + offsetof(struct msm_rbmemptrs, member))
+
+#define rbmemptr_stats(ring, index, member) \
+	(rbmemptr((ring), stats) + \
+	 ((index) * sizeof(struct msm_gpu_submit_stats)) + \
+	 offsetof(struct msm_gpu_submit_stats, member))
+
+struct msm_gpu_submit_stats {
+	u64 cpcycles_start;
+	u64 cpcycles_end;
+	u64 alwayson_start;
+	u64 alwayson_end;
+};
+
+#define MSM_GPU_SUBMIT_STATS_COUNT 64
+
+struct msm_rbmemptrs {
+	volatile uint32_t rptr;
+	volatile uint32_t fence;
+	/* Introduced on A7xx */
+	volatile uint32_t bv_fence;
+
+	volatile struct msm_gpu_submit_stats stats[MSM_GPU_SUBMIT_STATS_COUNT];
+	volatile u64 ttbr0;
+};
+
+struct msm_cp_state {
+	uint64_t ib1_base, ib2_base;
+	uint32_t ib1_rem, ib2_rem;
+};
+
+struct msm_ringbuffer {
+	struct msm_gpu *gpu;
+	int id;
+	struct drm_gem_object *bo;
+	uint32_t *start, *end, *cur, *next;
+
+	/*
+	 * The job scheduler for this ring.
+	 */
+	struct drm_gpu_scheduler sched;
+
+	/*
+	 * List of in-flight submits on this ring.  Protected by submit_lock.
+	 *
+	 * Currently just submits that are already written into the ring, not
+	 * submits that are still in drm_gpu_scheduler's queues.  At a later
+	 * step we could probably move to letting drm_gpu_scheduler manage
+	 * hangcheck detection and keep track of submit jobs that are in-
+	 * flight.
+	 */
+	struct list_head submits;
+	spinlock_t submit_lock;
+
+	uint64_t iova;
+	uint32_t hangcheck_fence;
+	struct msm_rbmemptrs *memptrs;
+	uint64_t memptrs_iova;
+	struct msm_fence_context *fctx;
+
+	/**
+	 * hangcheck_progress_retries:
+	 *
+	 * The number of extra hangcheck duration cycles that we have given
+	 * due to it appearing that the GPU is making forward progress.
+	 *
+	 * For GPU generations which support progress detection (see.
+	 * msm_gpu_funcs::progress()), if the GPU appears to be making progress
+	 * (ie. the CP has advanced in the command stream, we'll allow up to
+	 * DRM_MSM_HANGCHECK_PROGRESS_RETRIES expirations of the hangcheck timer
+	 * before killing the job.  But to detect progress we need two sample
+	 * points, so the duration of the hangcheck timer is halved.  In other
+	 * words we'll let the submit run for up to:
+	 *
+	 * (DRM_MSM_HANGCHECK_DEFAULT_PERIOD / 2) * (DRM_MSM_HANGCHECK_PROGRESS_RETRIES + 1)
+	 */
+	int hangcheck_progress_retries;
+
+	/**
+	 * last_cp_state: The state of the CP at the last call to gpu->progress()
+	 */
+	struct msm_cp_state last_cp_state;
+
+	/*
+	 * preempt_lock protects preemption and serializes wptr updates against
+	 * preemption.  Can be aquired from irq context.
+	 */
+	spinlock_t preempt_lock;
+};
+
+struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int id,
+		void *memptrs, uint64_t memptrs_iova);
+void msm_ringbuffer_destroy(struct msm_ringbuffer *ring);
+
+/* ringbuffer helpers (the parts that are same for a3xx/a2xx/z180..) */
+
+static inline void
+OUT_RING(struct msm_ringbuffer *ring, uint32_t data)
+{
+	/*
+	 * ring->next points to the current command being written - it won't be
+	 * committed as ring->cur until the flush
+	 */
+	if (ring->next == ring->end)
+		ring->next = ring->start;
+	*(ring->next++) = data;
+}
+
+#endif /* __MSM_RINGBUFFER_H__ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/msm_submitqueue.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/msm_submitqueue.c
@@ -0,0 +1,307 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/kref.h>
+#include <linux/uaccess.h>
+
+#include "msm_gpu.h"
+
+int msm_file_private_set_sysprof(struct msm_file_private *ctx,
+				 struct msm_gpu *gpu, int sysprof)
+{
+	/*
+	 * Since pm_runtime and sysprof_active are both refcounts, we
+	 * call apply the new value first, and then unwind the previous
+	 * value
+	 */
+
+	switch (sysprof) {
+	default:
+		return -EINVAL;
+	case 2:
+		pm_runtime_get_sync(&gpu->pdev->dev);
+		fallthrough;
+	case 1:
+		refcount_inc(&gpu->sysprof_active);
+		fallthrough;
+	case 0:
+		break;
+	}
+
+	/* unwind old value: */
+	switch (ctx->sysprof) {
+	case 2:
+		pm_runtime_put_autosuspend(&gpu->pdev->dev);
+		fallthrough;
+	case 1:
+		refcount_dec(&gpu->sysprof_active);
+		fallthrough;
+	case 0:
+		break;
+	}
+
+	ctx->sysprof = sysprof;
+
+	return 0;
+}
+
+void __msm_file_private_destroy(struct kref *kref)
+{
+	struct msm_file_private *ctx = container_of(kref,
+		struct msm_file_private, ref);
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(ctx->entities); i++) {
+		if (!ctx->entities[i])
+			continue;
+
+		drm_sched_entity_destroy(ctx->entities[i]);
+		kfree(ctx->entities[i]);
+	}
+
+	msm_gem_address_space_put(ctx->aspace);
+	kfree(ctx->comm);
+	kfree(ctx->cmdline);
+	kfree(ctx);
+}
+
+void msm_submitqueue_destroy(struct kref *kref)
+{
+	struct msm_gpu_submitqueue *queue = container_of(kref,
+		struct msm_gpu_submitqueue, ref);
+
+	idr_destroy(&queue->fence_idr);
+
+	msm_file_private_put(queue->ctx);
+
+	kfree(queue);
+}
+
+struct msm_gpu_submitqueue *msm_submitqueue_get(struct msm_file_private *ctx,
+		u32 id)
+{
+	struct msm_gpu_submitqueue *entry;
+
+	if (!ctx)
+		return NULL;
+
+	read_lock(&ctx->queuelock);
+
+	list_for_each_entry(entry, &ctx->submitqueues, node) {
+		if (entry->id == id) {
+			kref_get(&entry->ref);
+			read_unlock(&ctx->queuelock);
+
+			return entry;
+		}
+	}
+
+	read_unlock(&ctx->queuelock);
+	return NULL;
+}
+
+void msm_submitqueue_close(struct msm_file_private *ctx)
+{
+	struct msm_gpu_submitqueue *entry, *tmp;
+
+	if (!ctx)
+		return;
+
+	/*
+	 * No lock needed in close and there won't
+	 * be any more user ioctls coming our way
+	 */
+	list_for_each_entry_safe(entry, tmp, &ctx->submitqueues, node) {
+		list_del(&entry->node);
+		msm_submitqueue_put(entry);
+	}
+}
+
+static struct drm_sched_entity *
+get_sched_entity(struct msm_file_private *ctx, struct msm_ringbuffer *ring,
+		 unsigned ring_nr, enum drm_sched_priority sched_prio)
+{
+	static DEFINE_MUTEX(entity_lock);
+	unsigned idx = (ring_nr * NR_SCHED_PRIORITIES) + sched_prio;
+
+	/* We should have already validated that the requested priority is
+	 * valid by the time we get here.
+	 */
+	if (WARN_ON(idx >= ARRAY_SIZE(ctx->entities)))
+		return ERR_PTR(-EINVAL);
+
+	mutex_lock(&entity_lock);
+
+	if (!ctx->entities[idx]) {
+		struct drm_sched_entity *entity;
+		struct drm_gpu_scheduler *sched = &ring->sched;
+		int ret;
+
+		entity = kzalloc(sizeof(*ctx->entities[idx]), GFP_KERNEL);
+
+		ret = drm_sched_entity_init(entity, sched_prio, &sched, 1, NULL);
+		if (ret) {
+			mutex_unlock(&entity_lock);
+			kfree(entity);
+			return ERR_PTR(ret);
+		}
+
+		ctx->entities[idx] = entity;
+	}
+
+	mutex_unlock(&entity_lock);
+
+	return ctx->entities[idx];
+}
+
+int msm_submitqueue_create(struct drm_device *drm, struct msm_file_private *ctx,
+		u32 prio, u32 flags, u32 *id)
+{
+	struct msm_drm_private *priv = drm->dev_private;
+	struct msm_gpu_submitqueue *queue;
+	enum drm_sched_priority sched_prio;
+	unsigned ring_nr;
+	int ret;
+
+	if (!ctx)
+		return -ENODEV;
+
+	if (!priv->gpu)
+		return -ENODEV;
+
+	ret = msm_gpu_convert_priority(priv->gpu, prio, &ring_nr, &sched_prio);
+	if (ret)
+		return ret;
+
+	queue = kzalloc(sizeof(*queue), GFP_KERNEL);
+
+	if (!queue)
+		return -ENOMEM;
+
+	kref_init(&queue->ref);
+	queue->flags = flags;
+	queue->ring_nr = ring_nr;
+
+	queue->entity = get_sched_entity(ctx, priv->gpu->rb[ring_nr],
+					 ring_nr, sched_prio);
+	if (IS_ERR(queue->entity)) {
+		ret = PTR_ERR(queue->entity);
+		kfree(queue);
+		return ret;
+	}
+
+	write_lock(&ctx->queuelock);
+
+	queue->ctx = msm_file_private_get(ctx);
+	queue->id = ctx->queueid++;
+
+	if (id)
+		*id = queue->id;
+
+	idr_init(&queue->fence_idr);
+	spin_lock_init(&queue->idr_lock);
+	mutex_init(&queue->lock);
+
+	list_add_tail(&queue->node, &ctx->submitqueues);
+
+	write_unlock(&ctx->queuelock);
+
+	return 0;
+}
+
+/*
+ * Create the default submit-queue (id==0), used for backwards compatibility
+ * for userspace that pre-dates the introduction of submitqueues.
+ */
+int msm_submitqueue_init(struct drm_device *drm, struct msm_file_private *ctx)
+{
+	struct msm_drm_private *priv = drm->dev_private;
+	int default_prio, max_priority;
+
+	if (!priv->gpu)
+		return -ENODEV;
+
+	max_priority = (priv->gpu->nr_rings * NR_SCHED_PRIORITIES) - 1;
+
+	/*
+	 * Pick a medium priority level as default.  Lower numeric value is
+	 * higher priority, so round-up to pick a priority that is not higher
+	 * than the middle priority level.
+	 */
+	default_prio = DIV_ROUND_UP(max_priority, 2);
+
+	return msm_submitqueue_create(drm, ctx, default_prio, 0, NULL);
+}
+
+static int msm_submitqueue_query_faults(struct msm_gpu_submitqueue *queue,
+		struct drm_msm_submitqueue_query *args)
+{
+	size_t size = min_t(size_t, args->len, sizeof(queue->faults));
+	int ret;
+
+	/* If a zero length was passed in, return the data size we expect */
+	if (!args->len) {
+		args->len = sizeof(queue->faults);
+		return 0;
+	}
+
+	/* Set the length to the actual size of the data */
+	args->len = size;
+
+	ret = copy_to_user(u64_to_user_ptr(args->data), &queue->faults, size);
+
+	return ret ? -EFAULT : 0;
+}
+
+int msm_submitqueue_query(struct drm_device *drm, struct msm_file_private *ctx,
+		struct drm_msm_submitqueue_query *args)
+{
+	struct msm_gpu_submitqueue *queue;
+	int ret = -EINVAL;
+
+	if (args->pad)
+		return -EINVAL;
+
+	queue = msm_submitqueue_get(ctx, args->id);
+	if (!queue)
+		return -ENOENT;
+
+	if (args->param == MSM_SUBMITQUEUE_PARAM_FAULTS)
+		ret = msm_submitqueue_query_faults(queue, args);
+
+	msm_submitqueue_put(queue);
+
+	return ret;
+}
+
+int msm_submitqueue_remove(struct msm_file_private *ctx, u32 id)
+{
+	struct msm_gpu_submitqueue *entry;
+
+	if (!ctx)
+		return 0;
+
+	/*
+	 * id 0 is the "default" queue and can't be destroyed
+	 * by the user
+	 */
+	if (!id)
+		return -ENOENT;
+
+	write_lock(&ctx->queuelock);
+
+	list_for_each_entry(entry, &ctx->submitqueues, node) {
+		if (entry->id == id) {
+			list_del(&entry->node);
+			write_unlock(&ctx->queuelock);
+
+			msm_submitqueue_put(entry);
+			return 0;
+		}
+	}
+
+	write_unlock(&ctx->queuelock);
+	return -ENOENT;
+}
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/adreno/a2xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/adreno/a2xx.xml
@@ -0,0 +1,1865 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+
+<enum name="a2xx_rb_dither_type">
+	<value name="DITHER_PIXEL" value="0"/>
+	<value name="DITHER_SUBPIXEL" value="1"/>
+</enum>
+
+<enum name="a2xx_colorformatx">
+	<value name="COLORX_4_4_4_4" value="0"/>
+	<value name="COLORX_1_5_5_5" value="1"/>
+	<value name="COLORX_5_6_5" value="2"/>
+	<value name="COLORX_8" value="3"/>
+	<value name="COLORX_8_8" value="4"/>
+	<value name="COLORX_8_8_8_8" value="5"/>
+	<value name="COLORX_S8_8_8_8" value="6"/>
+	<value name="COLORX_16_FLOAT" value="7"/>
+	<value name="COLORX_16_16_FLOAT" value="8"/>
+	<value name="COLORX_16_16_16_16_FLOAT" value="9"/>
+	<value name="COLORX_32_FLOAT" value="10"/>
+	<value name="COLORX_32_32_FLOAT" value="11"/>
+	<value name="COLORX_32_32_32_32_FLOAT" value="12"/>
+	<value name="COLORX_2_3_3" value="13"/>
+	<value name="COLORX_8_8_8" value="14"/>
+</enum>
+
+<enum name="a2xx_sq_surfaceformat">
+	<value name="FMT_1_REVERSE" value="0"/>
+	<value name="FMT_1" value="1"/>
+	<value name="FMT_8" value="2"/>
+	<value name="FMT_1_5_5_5" value="3"/>
+	<value name="FMT_5_6_5" value="4"/>
+	<value name="FMT_6_5_5" value="5"/>
+	<value name="FMT_8_8_8_8" value="6"/>
+	<value name="FMT_2_10_10_10" value="7"/>
+	<value name="FMT_8_A" value="8"/>
+	<value name="FMT_8_B" value="9"/>
+	<value name="FMT_8_8" value="10"/>
+	<value name="FMT_Cr_Y1_Cb_Y0" value="11"/>
+	<value name="FMT_Y1_Cr_Y0_Cb" value="12"/>
+	<value name="FMT_5_5_5_1" value="13"/>
+	<value name="FMT_8_8_8_8_A" value="14"/>
+	<value name="FMT_4_4_4_4" value="15"/>
+	<value name="FMT_8_8_8" value="16"/>
+	<value name="FMT_DXT1" value="18"/>
+	<value name="FMT_DXT2_3" value="19"/>
+	<value name="FMT_DXT4_5" value="20"/>
+	<value name="FMT_10_10_10_2" value="21"/>
+	<value name="FMT_24_8" value="22"/>
+	<value name="FMT_16" value="24"/>
+	<value name="FMT_16_16" value="25"/>
+	<value name="FMT_16_16_16_16" value="26"/>
+	<value name="FMT_16_EXPAND" value="27"/>
+	<value name="FMT_16_16_EXPAND" value="28"/>
+	<value name="FMT_16_16_16_16_EXPAND" value="29"/>
+	<value name="FMT_16_FLOAT" value="30"/>
+	<value name="FMT_16_16_FLOAT" value="31"/>
+	<value name="FMT_16_16_16_16_FLOAT" value="32"/>
+	<value name="FMT_32" value="33"/>
+	<value name="FMT_32_32" value="34"/>
+	<value name="FMT_32_32_32_32" value="35"/>
+	<value name="FMT_32_FLOAT" value="36"/>
+	<value name="FMT_32_32_FLOAT" value="37"/>
+	<value name="FMT_32_32_32_32_FLOAT" value="38"/>
+	<value name="FMT_ATI_TC_RGB" value="39"/>
+	<value name="FMT_ATI_TC_RGBA" value="40"/>
+	<value name="FMT_ATI_TC_555_565_RGB" value="41"/>
+	<value name="FMT_ATI_TC_555_565_RGBA" value="42"/>
+	<value name="FMT_ATI_TC_RGBA_INTERP" value="43"/>
+	<value name="FMT_ATI_TC_555_565_RGBA_INTERP" value="44"/>
+	<value name="FMT_ETC1_RGBA_INTERP" value="46"/>
+	<value name="FMT_ETC1_RGB" value="47"/>
+	<value name="FMT_ETC1_RGBA" value="48"/>
+	<value name="FMT_DXN" value="49"/>
+	<value name="FMT_2_3_3" value="51"/>
+	<value name="FMT_2_10_10_10_AS_16_16_16_16" value="54"/>
+	<value name="FMT_10_10_10_2_AS_16_16_16_16" value="55"/>
+	<value name="FMT_32_32_32_FLOAT" value="57"/>
+	<value name="FMT_DXT3A" value="58"/>
+	<value name="FMT_DXT5A" value="59"/>
+	<value name="FMT_CTX1" value="60"/>
+</enum>
+
+<enum name="a2xx_sq_ps_vtx_mode">
+	<value name="POSITION_1_VECTOR" value="0"/>
+	<value name="POSITION_2_VECTORS_UNUSED" value="1"/>
+	<value name="POSITION_2_VECTORS_SPRITE" value="2"/>
+	<value name="POSITION_2_VECTORS_EDGE" value="3"/>
+	<value name="POSITION_2_VECTORS_KILL" value="4"/>
+	<value name="POSITION_2_VECTORS_SPRITE_KILL" value="5"/>
+	<value name="POSITION_2_VECTORS_EDGE_KILL" value="6"/>
+	<value name="MULTIPASS" value="7"/>
+</enum>
+
+<enum name="a2xx_sq_sample_cntl">
+	<value name="CENTROIDS_ONLY" value="0"/>
+	<value name="CENTERS_ONLY" value="1"/>
+	<value name="CENTROIDS_AND_CENTERS" value="2"/>
+</enum>
+
+<enum name="a2xx_dx_clip_space">
+	<value name="DXCLIP_OPENGL" value="0"/>
+	<value name="DXCLIP_DIRECTX" value="1"/>
+</enum>
+
+<enum name="a2xx_pa_su_sc_polymode">
+	<value name="POLY_DISABLED" value="0"/>
+	<value name="POLY_DUALMODE" value="1"/>
+</enum>
+
+<enum name="a2xx_rb_edram_mode">
+	<value name="EDRAM_NOP" value="0"/>
+	<value name="COLOR_DEPTH" value="4"/>
+	<value name="DEPTH_ONLY" value="5"/>
+	<value name="EDRAM_COPY" value="6"/>
+</enum>
+
+<enum name="a2xx_pa_sc_pattern_bit_order">
+	<value name="LITTLE" value="0"/>
+	<value name="BIG" value="1"/>
+</enum>
+
+<enum name="a2xx_pa_sc_auto_reset_cntl">
+	<value name="NEVER" value="0"/>
+	<value name="EACH_PRIMITIVE" value="1"/>
+	<value name="EACH_PACKET" value="2"/>
+</enum>
+
+<enum name="a2xx_pa_pixcenter">
+	<value name="PIXCENTER_D3D" value="0"/>
+	<value name="PIXCENTER_OGL" value="1"/>
+</enum>
+
+<enum name="a2xx_pa_roundmode">
+	<value name="TRUNCATE" value="0"/>
+	<value name="ROUND" value="1"/>
+	<value name="ROUNDTOEVEN" value="2"/>
+	<value name="ROUNDTOODD" value="3"/>
+</enum>
+
+<enum name="a2xx_pa_quantmode">
+	<value name="ONE_SIXTEENTH" value="0"/>
+	<value name="ONE_EIGTH" value="1"/>
+	<value name="ONE_QUARTER" value="2"/>
+	<value name="ONE_HALF" value="3"/>
+	<value name="ONE" value="4"/>
+</enum>
+
+<enum name="a2xx_rb_copy_sample_select">
+	<value name="SAMPLE_0" value="0"/>
+	<value name="SAMPLE_1" value="1"/>
+	<value name="SAMPLE_2" value="2"/>
+	<value name="SAMPLE_3" value="3"/>
+	<value name="SAMPLE_01" value="4"/>
+	<value name="SAMPLE_23" value="5"/>
+	<value name="SAMPLE_0123" value="6"/>
+</enum>
+
+<enum name="a2xx_rb_blend_opcode">
+	<value name="BLEND2_DST_PLUS_SRC" value="0"/>
+	<value name="BLEND2_SRC_MINUS_DST" value="1"/>
+	<value name="BLEND2_MIN_DST_SRC" value="2"/>
+	<value name="BLEND2_MAX_DST_SRC" value="3"/>
+	<value name="BLEND2_DST_MINUS_SRC" value="4"/>
+	<value name="BLEND2_DST_PLUS_SRC_BIAS" value="5"/>
+</enum>
+
+<enum name="a2xx_su_perfcnt_select">
+	<value value="0" name="PERF_PAPC_PASX_REQ"/>
+	<value value="2" name="PERF_PAPC_PASX_FIRST_VECTOR"/>
+	<value value="3" name="PERF_PAPC_PASX_SECOND_VECTOR"/>
+	<value value="4" name="PERF_PAPC_PASX_FIRST_DEAD"/>
+	<value value="5" name="PERF_PAPC_PASX_SECOND_DEAD"/>
+	<value value="6" name="PERF_PAPC_PASX_VTX_KILL_DISCARD"/>
+	<value value="7" name="PERF_PAPC_PASX_VTX_NAN_DISCARD"/>
+	<value value="8" name="PERF_PAPC_PA_INPUT_PRIM"/>
+	<value value="9" name="PERF_PAPC_PA_INPUT_NULL_PRIM"/>
+	<value value="10" name="PERF_PAPC_PA_INPUT_EVENT_FLAG"/>
+	<value value="11" name="PERF_PAPC_PA_INPUT_FIRST_PRIM_SLOT"/>
+	<value value="12" name="PERF_PAPC_PA_INPUT_END_OF_PACKET"/>
+	<value value="13" name="PERF_PAPC_CLPR_CULL_PRIM"/>
+	<value value="15" name="PERF_PAPC_CLPR_VV_CULL_PRIM"/>
+	<value value="17" name="PERF_PAPC_CLPR_VTX_KILL_CULL_PRIM"/>
+	<value value="18" name="PERF_PAPC_CLPR_VTX_NAN_CULL_PRIM"/>
+	<value value="19" name="PERF_PAPC_CLPR_CULL_TO_NULL_PRIM"/>
+	<value value="21" name="PERF_PAPC_CLPR_VV_CLIP_PRIM"/>
+	<value value="23" name="PERF_PAPC_CLPR_POINT_CLIP_CANDIDATE"/>
+	<value value="24" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_1"/>
+	<value value="25" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_2"/>
+	<value value="26" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_3"/>
+	<value value="27" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_4"/>
+	<value value="28" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_5"/>
+	<value value="29" name="PERF_PAPC_CLPR_CLIP_PLANE_CNT_6"/>
+	<value value="30" name="PERF_PAPC_CLPR_CLIP_PLANE_NEAR"/>
+	<value value="31" name="PERF_PAPC_CLPR_CLIP_PLANE_FAR"/>
+	<value value="32" name="PERF_PAPC_CLPR_CLIP_PLANE_LEFT"/>
+	<value value="33" name="PERF_PAPC_CLPR_CLIP_PLANE_RIGHT"/>
+	<value value="34" name="PERF_PAPC_CLPR_CLIP_PLANE_TOP"/>
+	<value value="35" name="PERF_PAPC_CLPR_CLIP_PLANE_BOTTOM"/>
+	<value value="36" name="PERF_PAPC_CLSM_NULL_PRIM"/>
+	<value value="37" name="PERF_PAPC_CLSM_TOTALLY_VISIBLE_PRIM"/>
+	<value value="38" name="PERF_PAPC_CLSM_CLIP_PRIM"/>
+	<value value="39" name="PERF_PAPC_CLSM_CULL_TO_NULL_PRIM"/>
+	<value value="40" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_1"/>
+	<value value="41" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_2"/>
+	<value value="42" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_3"/>
+	<value value="43" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_4"/>
+	<value value="44" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_5"/>
+	<value value="45" name="PERF_PAPC_CLSM_OUT_PRIM_CNT_6_7"/>
+	<value value="46" name="PERF_PAPC_CLSM_NON_TRIVIAL_CULL"/>
+	<value value="47" name="PERF_PAPC_SU_INPUT_PRIM"/>
+	<value value="48" name="PERF_PAPC_SU_INPUT_CLIP_PRIM"/>
+	<value value="49" name="PERF_PAPC_SU_INPUT_NULL_PRIM"/>
+	<value value="50" name="PERF_PAPC_SU_ZERO_AREA_CULL_PRIM"/>
+	<value value="51" name="PERF_PAPC_SU_BACK_FACE_CULL_PRIM"/>
+	<value value="52" name="PERF_PAPC_SU_FRONT_FACE_CULL_PRIM"/>
+	<value value="53" name="PERF_PAPC_SU_POLYMODE_FACE_CULL"/>
+	<value value="54" name="PERF_PAPC_SU_POLYMODE_BACK_CULL"/>
+	<value value="55" name="PERF_PAPC_SU_POLYMODE_FRONT_CULL"/>
+	<value value="56" name="PERF_PAPC_SU_POLYMODE_INVALID_FILL"/>
+	<value value="57" name="PERF_PAPC_SU_OUTPUT_PRIM"/>
+	<value value="58" name="PERF_PAPC_SU_OUTPUT_CLIP_PRIM"/>
+	<value value="59" name="PERF_PAPC_SU_OUTPUT_NULL_PRIM"/>
+	<value value="60" name="PERF_PAPC_SU_OUTPUT_EVENT_FLAG"/>
+	<value value="61" name="PERF_PAPC_SU_OUTPUT_FIRST_PRIM_SLOT"/>
+	<value value="62" name="PERF_PAPC_SU_OUTPUT_END_OF_PACKET"/>
+	<value value="63" name="PERF_PAPC_SU_OUTPUT_POLYMODE_FACE"/>
+	<value value="64" name="PERF_PAPC_SU_OUTPUT_POLYMODE_BACK"/>
+	<value value="65" name="PERF_PAPC_SU_OUTPUT_POLYMODE_FRONT"/>
+	<value value="66" name="PERF_PAPC_SU_OUT_CLIP_POLYMODE_FACE"/>
+	<value value="67" name="PERF_PAPC_SU_OUT_CLIP_POLYMODE_BACK"/>
+	<value value="68" name="PERF_PAPC_SU_OUT_CLIP_POLYMODE_FRONT"/>
+	<value value="69" name="PERF_PAPC_PASX_REQ_IDLE"/>
+	<value value="70" name="PERF_PAPC_PASX_REQ_BUSY"/>
+	<value value="71" name="PERF_PAPC_PASX_REQ_STALLED"/>
+	<value value="72" name="PERF_PAPC_PASX_REC_IDLE"/>
+	<value value="73" name="PERF_PAPC_PASX_REC_BUSY"/>
+	<value value="74" name="PERF_PAPC_PASX_REC_STARVED_SX"/>
+	<value value="75" name="PERF_PAPC_PASX_REC_STALLED"/>
+	<value value="76" name="PERF_PAPC_PASX_REC_STALLED_POS_MEM"/>
+	<value value="77" name="PERF_PAPC_PASX_REC_STALLED_CCGSM_IN"/>
+	<value value="78" name="PERF_PAPC_CCGSM_IDLE"/>
+	<value value="79" name="PERF_PAPC_CCGSM_BUSY"/>
+	<value value="80" name="PERF_PAPC_CCGSM_STALLED"/>
+	<value value="81" name="PERF_PAPC_CLPRIM_IDLE"/>
+	<value value="82" name="PERF_PAPC_CLPRIM_BUSY"/>
+	<value value="83" name="PERF_PAPC_CLPRIM_STALLED"/>
+	<value value="84" name="PERF_PAPC_CLPRIM_STARVED_CCGSM"/>
+	<value value="85" name="PERF_PAPC_CLIPSM_IDLE"/>
+	<value value="86" name="PERF_PAPC_CLIPSM_BUSY"/>
+	<value value="87" name="PERF_PAPC_CLIPSM_WAIT_CLIP_VERT_ENGH"/>
+	<value value="88" name="PERF_PAPC_CLIPSM_WAIT_HIGH_PRI_SEQ"/>
+	<value value="89" name="PERF_PAPC_CLIPSM_WAIT_CLIPGA"/>
+	<value value="90" name="PERF_PAPC_CLIPSM_WAIT_AVAIL_VTE_CLIP"/>
+	<value value="91" name="PERF_PAPC_CLIPSM_WAIT_CLIP_OUTSM"/>
+	<value value="92" name="PERF_PAPC_CLIPGA_IDLE"/>
+	<value value="93" name="PERF_PAPC_CLIPGA_BUSY"/>
+	<value value="94" name="PERF_PAPC_CLIPGA_STARVED_VTE_CLIP"/>
+	<value value="95" name="PERF_PAPC_CLIPGA_STALLED"/>
+	<value value="96" name="PERF_PAPC_CLIP_IDLE"/>
+	<value value="97" name="PERF_PAPC_CLIP_BUSY"/>
+	<value value="98" name="PERF_PAPC_SU_IDLE"/>
+	<value value="99" name="PERF_PAPC_SU_BUSY"/>
+	<value value="100" name="PERF_PAPC_SU_STARVED_CLIP"/>
+	<value value="101" name="PERF_PAPC_SU_STALLED_SC"/>
+	<value value="102" name="PERF_PAPC_SU_FACENESS_CULL"/>
+</enum>
+
+<enum name="a2xx_sc_perfcnt_select">
+	<value value="0" name="SC_SR_WINDOW_VALID"/>
+	<value value="1" name="SC_CW_WINDOW_VALID"/>
+	<value value="2" name="SC_QM_WINDOW_VALID"/>
+	<value value="3" name="SC_FW_WINDOW_VALID"/>
+	<value value="4" name="SC_EZ_WINDOW_VALID"/>
+	<value value="5" name="SC_IT_WINDOW_VALID"/>
+	<value value="6" name="SC_STARVED_BY_PA"/>
+	<value value="7" name="SC_STALLED_BY_RB_TILE"/>
+	<value value="8" name="SC_STALLED_BY_RB_SAMP"/>
+	<value value="9" name="SC_STARVED_BY_RB_EZ"/>
+	<value value="10" name="SC_STALLED_BY_SAMPLE_FF"/>
+	<value value="11" name="SC_STALLED_BY_SQ"/>
+	<value value="12" name="SC_STALLED_BY_SP"/>
+	<value value="13" name="SC_TOTAL_NO_PRIMS"/>
+	<value value="14" name="SC_NON_EMPTY_PRIMS"/>
+	<value value="15" name="SC_NO_TILES_PASSING_QM"/>
+	<value value="16" name="SC_NO_PIXELS_PRE_EZ"/>
+	<value value="17" name="SC_NO_PIXELS_POST_EZ"/>
+</enum>
+
+<enum name="a2xx_vgt_perfcount_select">
+	<value value="0" name="VGT_SQ_EVENT_WINDOW_ACTIVE"/>
+	<value value="1" name="VGT_SQ_SEND"/>
+	<value value="2" name="VGT_SQ_STALLED"/>
+	<value value="3" name="VGT_SQ_STARVED_BUSY"/>
+	<value value="4" name="VGT_SQ_STARVED_IDLE"/>
+	<value value="5" name="VGT_SQ_STATIC"/>
+	<value value="6" name="VGT_PA_EVENT_WINDOW_ACTIVE"/>
+	<value value="7" name="VGT_PA_CLIP_V_SEND"/>
+	<value value="8" name="VGT_PA_CLIP_V_STALLED"/>
+	<value value="9" name="VGT_PA_CLIP_V_STARVED_BUSY"/>
+	<value value="10" name="VGT_PA_CLIP_V_STARVED_IDLE"/>
+	<value value="11" name="VGT_PA_CLIP_V_STATIC"/>
+	<value value="12" name="VGT_PA_CLIP_P_SEND"/>
+	<value value="13" name="VGT_PA_CLIP_P_STALLED"/>
+	<value value="14" name="VGT_PA_CLIP_P_STARVED_BUSY"/>
+	<value value="15" name="VGT_PA_CLIP_P_STARVED_IDLE"/>
+	<value value="16" name="VGT_PA_CLIP_P_STATIC"/>
+	<value value="17" name="VGT_PA_CLIP_S_SEND"/>
+	<value value="18" name="VGT_PA_CLIP_S_STALLED"/>
+	<value value="19" name="VGT_PA_CLIP_S_STARVED_BUSY"/>
+	<value value="20" name="VGT_PA_CLIP_S_STARVED_IDLE"/>
+	<value value="21" name="VGT_PA_CLIP_S_STATIC"/>
+	<value value="22" name="RBIU_FIFOS_EVENT_WINDOW_ACTIVE"/>
+	<value value="23" name="RBIU_IMMED_DATA_FIFO_STARVED"/>
+	<value value="24" name="RBIU_IMMED_DATA_FIFO_STALLED"/>
+	<value value="25" name="RBIU_DMA_REQUEST_FIFO_STARVED"/>
+	<value value="26" name="RBIU_DMA_REQUEST_FIFO_STALLED"/>
+	<value value="27" name="RBIU_DRAW_INITIATOR_FIFO_STARVED"/>
+	<value value="28" name="RBIU_DRAW_INITIATOR_FIFO_STALLED"/>
+	<value value="29" name="BIN_PRIM_NEAR_CULL"/>
+	<value value="30" name="BIN_PRIM_ZERO_CULL"/>
+	<value value="31" name="BIN_PRIM_FAR_CULL"/>
+	<value value="32" name="BIN_PRIM_BIN_CULL"/>
+	<value value="33" name="BIN_PRIM_FACE_CULL"/>
+	<value value="34" name="SPARE34"/>
+	<value value="35" name="SPARE35"/>
+	<value value="36" name="SPARE36"/>
+	<value value="37" name="SPARE37"/>
+	<value value="38" name="SPARE38"/>
+	<value value="39" name="SPARE39"/>
+	<value value="40" name="TE_SU_IN_VALID"/>
+	<value value="41" name="TE_SU_IN_READ"/>
+	<value value="42" name="TE_SU_IN_PRIM"/>
+	<value value="43" name="TE_SU_IN_EOP"/>
+	<value value="44" name="TE_SU_IN_NULL_PRIM"/>
+	<value value="45" name="TE_WK_IN_VALID"/>
+	<value value="46" name="TE_WK_IN_READ"/>
+	<value value="47" name="TE_OUT_PRIM_VALID"/>
+	<value value="48" name="TE_OUT_PRIM_READ"/>
+</enum>
+
+<enum name="a2xx_tcr_perfcount_select">
+	<value value="0" name="DGMMPD_IPMUX0_STALL"/>
+	<value value="4" name="DGMMPD_IPMUX_ALL_STALL"/>
+	<value value="5" name="OPMUX0_L2_WRITES"/>
+</enum>
+
+<enum name="a2xx_tp_perfcount_select">
+	<value value="0" name="POINT_QUADS"/>
+	<value value="1" name="BILIN_QUADS"/>
+	<value value="2" name="ANISO_QUADS"/>
+	<value value="3" name="MIP_QUADS"/>
+	<value value="4" name="VOL_QUADS"/>
+	<value value="5" name="MIP_VOL_QUADS"/>
+	<value value="6" name="MIP_ANISO_QUADS"/>
+	<value value="7" name="VOL_ANISO_QUADS"/>
+	<value value="8" name="ANISO_2_1_QUADS"/>
+	<value value="9" name="ANISO_4_1_QUADS"/>
+	<value value="10" name="ANISO_6_1_QUADS"/>
+	<value value="11" name="ANISO_8_1_QUADS"/>
+	<value value="12" name="ANISO_10_1_QUADS"/>
+	<value value="13" name="ANISO_12_1_QUADS"/>
+	<value value="14" name="ANISO_14_1_QUADS"/>
+	<value value="15" name="ANISO_16_1_QUADS"/>
+	<value value="16" name="MIP_VOL_ANISO_QUADS"/>
+	<value value="17" name="ALIGN_2_QUADS"/>
+	<value value="18" name="ALIGN_4_QUADS"/>
+	<value value="19" name="PIX_0_QUAD"/>
+	<value value="20" name="PIX_1_QUAD"/>
+	<value value="21" name="PIX_2_QUAD"/>
+	<value value="22" name="PIX_3_QUAD"/>
+	<value value="23" name="PIX_4_QUAD"/>
+	<value value="24" name="TP_MIPMAP_LOD0"/>
+	<value value="25" name="TP_MIPMAP_LOD1"/>
+	<value value="26" name="TP_MIPMAP_LOD2"/>
+	<value value="27" name="TP_MIPMAP_LOD3"/>
+	<value value="28" name="TP_MIPMAP_LOD4"/>
+	<value value="29" name="TP_MIPMAP_LOD5"/>
+	<value value="30" name="TP_MIPMAP_LOD6"/>
+	<value value="31" name="TP_MIPMAP_LOD7"/>
+	<value value="32" name="TP_MIPMAP_LOD8"/>
+	<value value="33" name="TP_MIPMAP_LOD9"/>
+	<value value="34" name="TP_MIPMAP_LOD10"/>
+	<value value="35" name="TP_MIPMAP_LOD11"/>
+	<value value="36" name="TP_MIPMAP_LOD12"/>
+	<value value="37" name="TP_MIPMAP_LOD13"/>
+	<value value="38" name="TP_MIPMAP_LOD14"/>
+</enum>
+
+<enum name="a2xx_tcm_perfcount_select">
+	<value value="0" name="QUAD0_RD_LAT_FIFO_EMPTY"/>
+	<value value="3" name="QUAD0_RD_LAT_FIFO_4TH_FULL"/>
+	<value value="4" name="QUAD0_RD_LAT_FIFO_HALF_FULL"/>
+	<value value="5" name="QUAD0_RD_LAT_FIFO_FULL"/>
+	<value value="6" name="QUAD0_RD_LAT_FIFO_LT_4TH_FULL"/>
+	<value value="28" name="READ_STARVED_QUAD0"/>
+	<value value="32" name="READ_STARVED"/>
+	<value value="33" name="READ_STALLED_QUAD0"/>
+	<value value="37" name="READ_STALLED"/>
+	<value value="38" name="VALID_READ_QUAD0"/>
+	<value value="42" name="TC_TP_STARVED_QUAD0"/>
+	<value value="46" name="TC_TP_STARVED"/>
+</enum>
+
+<enum name="a2xx_tcf_perfcount_select">
+	<value value="0" name="VALID_CYCLES"/>
+	<value value="1" name="SINGLE_PHASES"/>
+	<value value="2" name="ANISO_PHASES"/>
+	<value value="3" name="MIP_PHASES"/>
+	<value value="4" name="VOL_PHASES"/>
+	<value value="5" name="MIP_VOL_PHASES"/>
+	<value value="6" name="MIP_ANISO_PHASES"/>
+	<value value="7" name="VOL_ANISO_PHASES"/>
+	<value value="8" name="ANISO_2_1_PHASES"/>
+	<value value="9" name="ANISO_4_1_PHASES"/>
+	<value value="10" name="ANISO_6_1_PHASES"/>
+	<value value="11" name="ANISO_8_1_PHASES"/>
+	<value value="12" name="ANISO_10_1_PHASES"/>
+	<value value="13" name="ANISO_12_1_PHASES"/>
+	<value value="14" name="ANISO_14_1_PHASES"/>
+	<value value="15" name="ANISO_16_1_PHASES"/>
+	<value value="16" name="MIP_VOL_ANISO_PHASES"/>
+	<value value="17" name="ALIGN_2_PHASES"/>
+	<value value="18" name="ALIGN_4_PHASES"/>
+	<value value="19" name="TPC_BUSY"/>
+	<value value="20" name="TPC_STALLED"/>
+	<value value="21" name="TPC_STARVED"/>
+	<value value="22" name="TPC_WORKING"/>
+	<value value="23" name="TPC_WALKER_BUSY"/>
+	<value value="24" name="TPC_WALKER_STALLED"/>
+	<value value="25" name="TPC_WALKER_WORKING"/>
+	<value value="26" name="TPC_ALIGNER_BUSY"/>
+	<value value="27" name="TPC_ALIGNER_STALLED"/>
+	<value value="28" name="TPC_ALIGNER_STALLED_BY_BLEND"/>
+	<value value="29" name="TPC_ALIGNER_STALLED_BY_CACHE"/>
+	<value value="30" name="TPC_ALIGNER_WORKING"/>
+	<value value="31" name="TPC_BLEND_BUSY"/>
+	<value value="32" name="TPC_BLEND_SYNC"/>
+	<value value="33" name="TPC_BLEND_STARVED"/>
+	<value value="34" name="TPC_BLEND_WORKING"/>
+	<value value="35" name="OPCODE_0x00"/>
+	<value value="36" name="OPCODE_0x01"/>
+	<value value="37" name="OPCODE_0x04"/>
+	<value value="38" name="OPCODE_0x10"/>
+	<value value="39" name="OPCODE_0x11"/>
+	<value value="40" name="OPCODE_0x12"/>
+	<value value="41" name="OPCODE_0x13"/>
+	<value value="42" name="OPCODE_0x18"/>
+	<value value="43" name="OPCODE_0x19"/>
+	<value value="44" name="OPCODE_0x1A"/>
+	<value value="45" name="OPCODE_OTHER"/>
+	<value value="56" name="IN_FIFO_0_EMPTY"/>
+	<value value="57" name="IN_FIFO_0_LT_HALF_FULL"/>
+	<value value="58" name="IN_FIFO_0_HALF_FULL"/>
+	<value value="59" name="IN_FIFO_0_FULL"/>
+	<value value="72" name="IN_FIFO_TPC_EMPTY"/>
+	<value value="73" name="IN_FIFO_TPC_LT_HALF_FULL"/>
+	<value value="74" name="IN_FIFO_TPC_HALF_FULL"/>
+	<value value="75" name="IN_FIFO_TPC_FULL"/>
+	<value value="76" name="TPC_TC_XFC"/>
+	<value value="77" name="TPC_TC_STATE"/>
+	<value value="78" name="TC_STALL"/>
+	<value value="79" name="QUAD0_TAPS"/>
+	<value value="83" name="QUADS"/>
+	<value value="84" name="TCA_SYNC_STALL"/>
+	<value value="85" name="TAG_STALL"/>
+	<value value="88" name="TCB_SYNC_STALL"/>
+	<value value="89" name="TCA_VALID"/>
+	<value value="90" name="PROBES_VALID"/>
+	<value value="91" name="MISS_STALL"/>
+	<value value="92" name="FETCH_FIFO_STALL"/>
+	<value value="93" name="TCO_STALL"/>
+	<value value="94" name="ANY_STALL"/>
+	<value value="95" name="TAG_MISSES"/>
+	<value value="96" name="TAG_HITS"/>
+	<value value="97" name="SUB_TAG_MISSES"/>
+	<value value="98" name="SET0_INVALIDATES"/>
+	<value value="99" name="SET1_INVALIDATES"/>
+	<value value="100" name="SET2_INVALIDATES"/>
+	<value value="101" name="SET3_INVALIDATES"/>
+	<value value="102" name="SET0_TAG_MISSES"/>
+	<value value="103" name="SET1_TAG_MISSES"/>
+	<value value="104" name="SET2_TAG_MISSES"/>
+	<value value="105" name="SET3_TAG_MISSES"/>
+	<value value="106" name="SET0_TAG_HITS"/>
+	<value value="107" name="SET1_TAG_HITS"/>
+	<value value="108" name="SET2_TAG_HITS"/>
+	<value value="109" name="SET3_TAG_HITS"/>
+	<value value="110" name="SET0_SUB_TAG_MISSES"/>
+	<value value="111" name="SET1_SUB_TAG_MISSES"/>
+	<value value="112" name="SET2_SUB_TAG_MISSES"/>
+	<value value="113" name="SET3_SUB_TAG_MISSES"/>
+	<value value="114" name="SET0_EVICT1"/>
+	<value value="115" name="SET0_EVICT2"/>
+	<value value="116" name="SET0_EVICT3"/>
+	<value value="117" name="SET0_EVICT4"/>
+	<value value="118" name="SET0_EVICT5"/>
+	<value value="119" name="SET0_EVICT6"/>
+	<value value="120" name="SET0_EVICT7"/>
+	<value value="121" name="SET0_EVICT8"/>
+	<value value="130" name="SET1_EVICT1"/>
+	<value value="131" name="SET1_EVICT2"/>
+	<value value="132" name="SET1_EVICT3"/>
+	<value value="133" name="SET1_EVICT4"/>
+	<value value="134" name="SET1_EVICT5"/>
+	<value value="135" name="SET1_EVICT6"/>
+	<value value="136" name="SET1_EVICT7"/>
+	<value value="137" name="SET1_EVICT8"/>
+	<value value="146" name="SET2_EVICT1"/>
+	<value value="147" name="SET2_EVICT2"/>
+	<value value="148" name="SET2_EVICT3"/>
+	<value value="149" name="SET2_EVICT4"/>
+	<value value="150" name="SET2_EVICT5"/>
+	<value value="151" name="SET2_EVICT6"/>
+	<value value="152" name="SET2_EVICT7"/>
+	<value value="153" name="SET2_EVICT8"/>
+	<value value="162" name="SET3_EVICT1"/>
+	<value value="163" name="SET3_EVICT2"/>
+	<value value="164" name="SET3_EVICT3"/>
+	<value value="165" name="SET3_EVICT4"/>
+	<value value="166" name="SET3_EVICT5"/>
+	<value value="167" name="SET3_EVICT6"/>
+	<value value="168" name="SET3_EVICT7"/>
+	<value value="169" name="SET3_EVICT8"/>
+	<value value="178" name="FF_EMPTY"/>
+	<value value="179" name="FF_LT_HALF_FULL"/>
+	<value value="180" name="FF_HALF_FULL"/>
+	<value value="181" name="FF_FULL"/>
+	<value value="182" name="FF_XFC"/>
+	<value value="183" name="FF_STALLED"/>
+	<value value="184" name="FG_MASKS"/>
+	<value value="185" name="FG_LEFT_MASKS"/>
+	<value value="186" name="FG_LEFT_MASK_STALLED"/>
+	<value value="187" name="FG_LEFT_NOT_DONE_STALL"/>
+	<value value="188" name="FG_LEFT_FG_STALL"/>
+	<value value="189" name="FG_LEFT_SECTORS"/>
+	<value value="195" name="FG0_REQUESTS"/>
+	<value value="196" name="FG0_STALLED"/>
+	<value value="199" name="MEM_REQ512"/>
+	<value value="200" name="MEM_REQ_SENT"/>
+	<value value="202" name="MEM_LOCAL_READ_REQ"/>
+	<value value="203" name="TC0_MH_STALLED"/>
+</enum>
+
+<enum name="a2xx_sq_perfcnt_select">
+	<value value="0" name="SQ_PIXEL_VECTORS_SUB"/>
+	<value value="1" name="SQ_VERTEX_VECTORS_SUB"/>
+	<value value="2" name="SQ_ALU0_ACTIVE_VTX_SIMD0"/>
+	<value value="3" name="SQ_ALU1_ACTIVE_VTX_SIMD0"/>
+	<value value="4" name="SQ_ALU0_ACTIVE_PIX_SIMD0"/>
+	<value value="5" name="SQ_ALU1_ACTIVE_PIX_SIMD0"/>
+	<value value="6" name="SQ_ALU0_ACTIVE_VTX_SIMD1"/>
+	<value value="7" name="SQ_ALU1_ACTIVE_VTX_SIMD1"/>
+	<value value="8" name="SQ_ALU0_ACTIVE_PIX_SIMD1"/>
+	<value value="9" name="SQ_ALU1_ACTIVE_PIX_SIMD1"/>
+	<value value="10" name="SQ_EXPORT_CYCLES"/>
+	<value value="11" name="SQ_ALU_CST_WRITTEN"/>
+	<value value="12" name="SQ_TEX_CST_WRITTEN"/>
+	<value value="13" name="SQ_ALU_CST_STALL"/>
+	<value value="14" name="SQ_ALU_TEX_STALL"/>
+	<value value="15" name="SQ_INST_WRITTEN"/>
+	<value value="16" name="SQ_BOOLEAN_WRITTEN"/>
+	<value value="17" name="SQ_LOOPS_WRITTEN"/>
+	<value value="18" name="SQ_PIXEL_SWAP_IN"/>
+	<value value="19" name="SQ_PIXEL_SWAP_OUT"/>
+	<value value="20" name="SQ_VERTEX_SWAP_IN"/>
+	<value value="21" name="SQ_VERTEX_SWAP_OUT"/>
+	<value value="22" name="SQ_ALU_VTX_INST_ISSUED"/>
+	<value value="23" name="SQ_TEX_VTX_INST_ISSUED"/>
+	<value value="24" name="SQ_VC_VTX_INST_ISSUED"/>
+	<value value="25" name="SQ_CF_VTX_INST_ISSUED"/>
+	<value value="26" name="SQ_ALU_PIX_INST_ISSUED"/>
+	<value value="27" name="SQ_TEX_PIX_INST_ISSUED"/>
+	<value value="28" name="SQ_VC_PIX_INST_ISSUED"/>
+	<value value="29" name="SQ_CF_PIX_INST_ISSUED"/>
+	<value value="30" name="SQ_ALU0_FIFO_EMPTY_SIMD0"/>
+	<value value="31" name="SQ_ALU1_FIFO_EMPTY_SIMD0"/>
+	<value value="32" name="SQ_ALU0_FIFO_EMPTY_SIMD1"/>
+	<value value="33" name="SQ_ALU1_FIFO_EMPTY_SIMD1"/>
+	<value value="34" name="SQ_ALU_NOPS"/>
+	<value value="35" name="SQ_PRED_SKIP"/>
+	<value value="36" name="SQ_SYNC_ALU_STALL_SIMD0_VTX"/>
+	<value value="37" name="SQ_SYNC_ALU_STALL_SIMD1_VTX"/>
+	<value value="38" name="SQ_SYNC_TEX_STALL_VTX"/>
+	<value value="39" name="SQ_SYNC_VC_STALL_VTX"/>
+	<value value="40" name="SQ_CONSTANTS_USED_SIMD0"/>
+	<value value="41" name="SQ_CONSTANTS_SENT_SP_SIMD0"/>
+	<value value="42" name="SQ_GPR_STALL_VTX"/>
+	<value value="43" name="SQ_GPR_STALL_PIX"/>
+	<value value="44" name="SQ_VTX_RS_STALL"/>
+	<value value="45" name="SQ_PIX_RS_STALL"/>
+	<value value="46" name="SQ_SX_PC_FULL"/>
+	<value value="47" name="SQ_SX_EXP_BUFF_FULL"/>
+	<value value="48" name="SQ_SX_POS_BUFF_FULL"/>
+	<value value="49" name="SQ_INTERP_QUADS"/>
+	<value value="50" name="SQ_INTERP_ACTIVE"/>
+	<value value="51" name="SQ_IN_PIXEL_STALL"/>
+	<value value="52" name="SQ_IN_VTX_STALL"/>
+	<value value="53" name="SQ_VTX_CNT"/>
+	<value value="54" name="SQ_VTX_VECTOR2"/>
+	<value value="55" name="SQ_VTX_VECTOR3"/>
+	<value value="56" name="SQ_VTX_VECTOR4"/>
+	<value value="57" name="SQ_PIXEL_VECTOR1"/>
+	<value value="58" name="SQ_PIXEL_VECTOR23"/>
+	<value value="59" name="SQ_PIXEL_VECTOR4"/>
+	<value value="60" name="SQ_CONSTANTS_USED_SIMD1"/>
+	<value value="61" name="SQ_CONSTANTS_SENT_SP_SIMD1"/>
+	<value value="62" name="SQ_SX_MEM_EXP_FULL"/>
+	<value value="63" name="SQ_ALU0_ACTIVE_VTX_SIMD2"/>
+	<value value="64" name="SQ_ALU1_ACTIVE_VTX_SIMD2"/>
+	<value value="65" name="SQ_ALU0_ACTIVE_PIX_SIMD2"/>
+	<value value="66" name="SQ_ALU1_ACTIVE_PIX_SIMD2"/>
+	<value value="67" name="SQ_ALU0_ACTIVE_VTX_SIMD3"/>
+	<value value="68" name="SQ_PERFCOUNT_VTX_QUAL_TP_DONE"/>
+	<value value="69" name="SQ_ALU0_ACTIVE_PIX_SIMD3"/>
+	<value value="70" name="SQ_PERFCOUNT_PIX_QUAL_TP_DONE"/>
+	<value value="71" name="SQ_ALU0_FIFO_EMPTY_SIMD2"/>
+	<value value="72" name="SQ_ALU1_FIFO_EMPTY_SIMD2"/>
+	<value value="73" name="SQ_ALU0_FIFO_EMPTY_SIMD3"/>
+	<value value="74" name="SQ_ALU1_FIFO_EMPTY_SIMD3"/>
+	<value value="75" name="SQ_SYNC_ALU_STALL_SIMD2_VTX"/>
+	<value value="76" name="SQ_PERFCOUNT_VTX_POP_THREAD"/>
+	<value value="77" name="SQ_SYNC_ALU_STALL_SIMD0_PIX"/>
+	<value value="78" name="SQ_SYNC_ALU_STALL_SIMD1_PIX"/>
+	<value value="79" name="SQ_SYNC_ALU_STALL_SIMD2_PIX"/>
+	<value value="80" name="SQ_PERFCOUNT_PIX_POP_THREAD"/>
+	<value value="81" name="SQ_SYNC_TEX_STALL_PIX"/>
+	<value value="82" name="SQ_SYNC_VC_STALL_PIX"/>
+	<value value="83" name="SQ_CONSTANTS_USED_SIMD2"/>
+	<value value="84" name="SQ_CONSTANTS_SENT_SP_SIMD2"/>
+	<value value="85" name="SQ_PERFCOUNT_VTX_DEALLOC_ACK"/>
+	<value value="86" name="SQ_PERFCOUNT_PIX_DEALLOC_ACK"/>
+	<value value="87" name="SQ_ALU0_FIFO_FULL_SIMD0"/>
+	<value value="88" name="SQ_ALU1_FIFO_FULL_SIMD0"/>
+	<value value="89" name="SQ_ALU0_FIFO_FULL_SIMD1"/>
+	<value value="90" name="SQ_ALU1_FIFO_FULL_SIMD1"/>
+	<value value="91" name="SQ_ALU0_FIFO_FULL_SIMD2"/>
+	<value value="92" name="SQ_ALU1_FIFO_FULL_SIMD2"/>
+	<value value="93" name="SQ_ALU0_FIFO_FULL_SIMD3"/>
+	<value value="94" name="SQ_ALU1_FIFO_FULL_SIMD3"/>
+	<value value="95" name="VC_PERF_STATIC"/>
+	<value value="96" name="VC_PERF_STALLED"/>
+	<value value="97" name="VC_PERF_STARVED"/>
+	<value value="98" name="VC_PERF_SEND"/>
+	<value value="99" name="VC_PERF_ACTUAL_STARVED"/>
+	<value value="100" name="PIXEL_THREAD_0_ACTIVE"/>
+	<value value="101" name="VERTEX_THREAD_0_ACTIVE"/>
+	<value value="102" name="PIXEL_THREAD_0_NUMBER"/>
+	<value value="103" name="VERTEX_THREAD_0_NUMBER"/>
+	<value value="104" name="VERTEX_EVENT_NUMBER"/>
+	<value value="105" name="PIXEL_EVENT_NUMBER"/>
+	<value value="106" name="PTRBUFF_EF_PUSH"/>
+	<value value="107" name="PTRBUFF_EF_POP_EVENT"/>
+	<value value="108" name="PTRBUFF_EF_POP_NEW_VTX"/>
+	<value value="109" name="PTRBUFF_EF_POP_DEALLOC"/>
+	<value value="110" name="PTRBUFF_EF_POP_PVECTOR"/>
+	<value value="111" name="PTRBUFF_EF_POP_PVECTOR_X"/>
+	<value value="112" name="PTRBUFF_EF_POP_PVECTOR_VNZ"/>
+	<value value="113" name="PTRBUFF_PB_DEALLOC"/>
+	<value value="114" name="PTRBUFF_PI_STATE_PPB_POP"/>
+	<value value="115" name="PTRBUFF_PI_RTR"/>
+	<value value="116" name="PTRBUFF_PI_READ_EN"/>
+	<value value="117" name="PTRBUFF_PI_BUFF_SWAP"/>
+	<value value="118" name="PTRBUFF_SQ_FREE_BUFF"/>
+	<value value="119" name="PTRBUFF_SQ_DEC"/>
+	<value value="120" name="PTRBUFF_SC_VALID_CNTL_EVENT"/>
+	<value value="121" name="PTRBUFF_SC_VALID_IJ_XFER"/>
+	<value value="122" name="PTRBUFF_SC_NEW_VECTOR_1_Q"/>
+	<value value="123" name="PTRBUFF_QUAL_NEW_VECTOR"/>
+	<value value="124" name="PTRBUFF_QUAL_EVENT"/>
+	<value value="125" name="PTRBUFF_END_BUFFER"/>
+	<value value="126" name="PTRBUFF_FILL_QUAD"/>
+	<value value="127" name="VERTS_WRITTEN_SPI"/>
+	<value value="128" name="TP_FETCH_INSTR_EXEC"/>
+	<value value="129" name="TP_FETCH_INSTR_REQ"/>
+	<value value="130" name="TP_DATA_RETURN"/>
+	<value value="131" name="SPI_WRITE_CYCLES_SP"/>
+	<value value="132" name="SPI_WRITES_SP"/>
+	<value value="133" name="SP_ALU_INSTR_EXEC"/>
+	<value value="134" name="SP_CONST_ADDR_TO_SQ"/>
+	<value value="135" name="SP_PRED_KILLS_TO_SQ"/>
+	<value value="136" name="SP_EXPORT_CYCLES_TO_SX"/>
+	<value value="137" name="SP_EXPORTS_TO_SX"/>
+	<value value="138" name="SQ_CYCLES_ELAPSED"/>
+	<value value="139" name="SQ_TCFS_OPT_ALLOC_EXEC"/>
+	<value value="140" name="SQ_TCFS_NO_OPT_ALLOC"/>
+	<value value="141" name="SQ_ALU0_NO_OPT_ALLOC"/>
+	<value value="142" name="SQ_ALU1_NO_OPT_ALLOC"/>
+	<value value="143" name="SQ_TCFS_ARB_XFC_CNT"/>
+	<value value="144" name="SQ_ALU0_ARB_XFC_CNT"/>
+	<value value="145" name="SQ_ALU1_ARB_XFC_CNT"/>
+	<value value="146" name="SQ_TCFS_CFS_UPDATE_CNT"/>
+	<value value="147" name="SQ_ALU0_CFS_UPDATE_CNT"/>
+	<value value="148" name="SQ_ALU1_CFS_UPDATE_CNT"/>
+	<value value="149" name="SQ_VTX_PUSH_THREAD_CNT"/>
+	<value value="150" name="SQ_VTX_POP_THREAD_CNT"/>
+	<value value="151" name="SQ_PIX_PUSH_THREAD_CNT"/>
+	<value value="152" name="SQ_PIX_POP_THREAD_CNT"/>
+	<value value="153" name="SQ_PIX_TOTAL"/>
+	<value value="154" name="SQ_PIX_KILLED"/>
+</enum>
+
+<enum name="a2xx_sx_perfcnt_select">
+	<value value="0" name="SX_EXPORT_VECTORS"/>
+	<value value="1" name="SX_DUMMY_QUADS"/>
+	<value value="2" name="SX_ALPHA_FAIL"/>
+	<value value="3" name="SX_RB_QUAD_BUSY"/>
+	<value value="4" name="SX_RB_COLOR_BUSY"/>
+	<value value="5" name="SX_RB_QUAD_STALL"/>
+	<value value="6" name="SX_RB_COLOR_STALL"/>
+</enum>
+
+<enum name="a2xx_rbbm_perfcount1_sel">
+	<value value="0" name="RBBM1_COUNT"/>
+	<value value="1" name="RBBM1_NRT_BUSY"/>
+	<value value="2" name="RBBM1_RB_BUSY"/>
+	<value value="3" name="RBBM1_SQ_CNTX0_BUSY"/>
+	<value value="4" name="RBBM1_SQ_CNTX17_BUSY"/>
+	<value value="5" name="RBBM1_VGT_BUSY"/>
+	<value value="6" name="RBBM1_VGT_NODMA_BUSY"/>
+	<value value="7" name="RBBM1_PA_BUSY"/>
+	<value value="8" name="RBBM1_SC_CNTX_BUSY"/>
+	<value value="9" name="RBBM1_TPC_BUSY"/>
+	<value value="10" name="RBBM1_TC_BUSY"/>
+	<value value="11" name="RBBM1_SX_BUSY"/>
+	<value value="12" name="RBBM1_CP_COHER_BUSY"/>
+	<value value="13" name="RBBM1_CP_NRT_BUSY"/>
+	<value value="14" name="RBBM1_GFX_IDLE_STALL"/>
+	<value value="15" name="RBBM1_INTERRUPT"/>
+</enum>
+
+<enum name="a2xx_cp_perfcount_sel">
+	<value value="0" name="ALWAYS_COUNT"/>
+	<value value="1" name="TRANS_FIFO_FULL"/>
+	<value value="2" name="TRANS_FIFO_AF"/>
+	<value value="3" name="RCIU_PFPTRANS_WAIT"/>
+	<value value="6" name="RCIU_NRTTRANS_WAIT"/>
+	<value value="8" name="CSF_NRT_READ_WAIT"/>
+	<value value="9" name="CSF_I1_FIFO_FULL"/>
+	<value value="10" name="CSF_I2_FIFO_FULL"/>
+	<value value="11" name="CSF_ST_FIFO_FULL"/>
+	<value value="13" name="CSF_RING_ROQ_FULL"/>
+	<value value="14" name="CSF_I1_ROQ_FULL"/>
+	<value value="15" name="CSF_I2_ROQ_FULL"/>
+	<value value="16" name="CSF_ST_ROQ_FULL"/>
+	<value value="18" name="MIU_TAG_MEM_FULL"/>
+	<value value="19" name="MIU_WRITECLEAN"/>
+	<value value="22" name="MIU_NRT_WRITE_STALLED"/>
+	<value value="23" name="MIU_NRT_READ_STALLED"/>
+	<value value="24" name="ME_WRITE_CONFIRM_FIFO_FULL"/>
+	<value value="25" name="ME_VS_DEALLOC_FIFO_FULL"/>
+	<value value="26" name="ME_PS_DEALLOC_FIFO_FULL"/>
+	<value value="27" name="ME_REGS_VS_EVENT_FIFO_FULL"/>
+	<value value="28" name="ME_REGS_PS_EVENT_FIFO_FULL"/>
+	<value value="29" name="ME_REGS_CF_EVENT_FIFO_FULL"/>
+	<value value="30" name="ME_MICRO_RB_STARVED"/>
+	<value value="31" name="ME_MICRO_I1_STARVED"/>
+	<value value="32" name="ME_MICRO_I2_STARVED"/>
+	<value value="33" name="ME_MICRO_ST_STARVED"/>
+	<value value="40" name="RCIU_RBBM_DWORD_SENT"/>
+	<value value="41" name="ME_BUSY_CLOCKS"/>
+	<value value="42" name="ME_WAIT_CONTEXT_AVAIL"/>
+	<value value="43" name="PFP_TYPE0_PACKET"/>
+	<value value="44" name="PFP_TYPE3_PACKET"/>
+	<value value="45" name="CSF_RB_WPTR_NEQ_RPTR"/>
+	<value value="46" name="CSF_I1_SIZE_NEQ_ZERO"/>
+	<value value="47" name="CSF_I2_SIZE_NEQ_ZERO"/>
+	<value value="48" name="CSF_RBI1I2_FETCHING"/>
+</enum>
+
+<enum name="a2xx_rb_perfcnt_select">
+	<value value="0" name="RBPERF_CNTX_BUSY"/>
+	<value value="1" name="RBPERF_CNTX_BUSY_MAX"/>
+	<value value="2" name="RBPERF_SX_QUAD_STARVED"/>
+	<value value="3" name="RBPERF_SX_QUAD_STARVED_MAX"/>
+	<value value="4" name="RBPERF_GA_GC_CH0_SYS_REQ"/>
+	<value value="5" name="RBPERF_GA_GC_CH0_SYS_REQ_MAX"/>
+	<value value="6" name="RBPERF_GA_GC_CH1_SYS_REQ"/>
+	<value value="7" name="RBPERF_GA_GC_CH1_SYS_REQ_MAX"/>
+	<value value="8" name="RBPERF_MH_STARVED"/>
+	<value value="9" name="RBPERF_MH_STARVED_MAX"/>
+	<value value="10" name="RBPERF_AZ_BC_COLOR_BUSY"/>
+	<value value="11" name="RBPERF_AZ_BC_COLOR_BUSY_MAX"/>
+	<value value="12" name="RBPERF_AZ_BC_Z_BUSY"/>
+	<value value="13" name="RBPERF_AZ_BC_Z_BUSY_MAX"/>
+	<value value="14" name="RBPERF_RB_SC_TILE_RTR_N"/>
+	<value value="15" name="RBPERF_RB_SC_TILE_RTR_N_MAX"/>
+	<value value="16" name="RBPERF_RB_SC_SAMP_RTR_N"/>
+	<value value="17" name="RBPERF_RB_SC_SAMP_RTR_N_MAX"/>
+	<value value="18" name="RBPERF_RB_SX_QUAD_RTR_N"/>
+	<value value="19" name="RBPERF_RB_SX_QUAD_RTR_N_MAX"/>
+	<value value="20" name="RBPERF_RB_SX_COLOR_RTR_N"/>
+	<value value="21" name="RBPERF_RB_SX_COLOR_RTR_N_MAX"/>
+	<value value="22" name="RBPERF_RB_SC_SAMP_LZ_BUSY"/>
+	<value value="23" name="RBPERF_RB_SC_SAMP_LZ_BUSY_MAX"/>
+	<value value="24" name="RBPERF_ZXP_STALL"/>
+	<value value="25" name="RBPERF_ZXP_STALL_MAX"/>
+	<value value="26" name="RBPERF_EVENT_PENDING"/>
+	<value value="27" name="RBPERF_EVENT_PENDING_MAX"/>
+	<value value="28" name="RBPERF_RB_MH_VALID"/>
+	<value value="29" name="RBPERF_RB_MH_VALID_MAX"/>
+	<value value="30" name="RBPERF_SX_RB_QUAD_SEND"/>
+	<value value="31" name="RBPERF_SX_RB_COLOR_SEND"/>
+	<value value="32" name="RBPERF_SC_RB_TILE_SEND"/>
+	<value value="33" name="RBPERF_SC_RB_SAMPLE_SEND"/>
+	<value value="34" name="RBPERF_SX_RB_MEM_EXPORT"/>
+	<value value="35" name="RBPERF_SX_RB_QUAD_EVENT"/>
+	<value value="36" name="RBPERF_SC_RB_TILE_EVENT_FILTERED"/>
+	<value value="37" name="RBPERF_SC_RB_TILE_EVENT_ALL"/>
+	<value value="38" name="RBPERF_RB_SC_EZ_SEND"/>
+	<value value="39" name="RBPERF_RB_SX_INDEX_SEND"/>
+	<value value="40" name="RBPERF_GMEM_INTFO_RD"/>
+	<value value="41" name="RBPERF_GMEM_INTF1_RD"/>
+	<value value="42" name="RBPERF_GMEM_INTFO_WR"/>
+	<value value="43" name="RBPERF_GMEM_INTF1_WR"/>
+	<value value="44" name="RBPERF_RB_CP_CONTEXT_DONE"/>
+	<value value="45" name="RBPERF_RB_CP_CACHE_FLUSH"/>
+	<value value="46" name="RBPERF_ZPASS_DONE"/>
+	<value value="47" name="RBPERF_ZCMD_VALID"/>
+	<value value="48" name="RBPERF_CCMD_VALID"/>
+	<value value="49" name="RBPERF_ACCUM_GRANT"/>
+	<value value="50" name="RBPERF_ACCUM_C0_GRANT"/>
+	<value value="51" name="RBPERF_ACCUM_C1_GRANT"/>
+	<value value="52" name="RBPERF_ACCUM_FULL_BE_WR"/>
+	<value value="53" name="RBPERF_ACCUM_REQUEST_NO_GRANT"/>
+	<value value="54" name="RBPERF_ACCUM_TIMEOUT_PULSE"/>
+	<value value="55" name="RBPERF_ACCUM_LIN_TIMEOUT_PULSE"/>
+	<value value="56" name="RBPERF_ACCUM_CAM_HIT_FLUSHING"/>
+</enum>
+
+<enum name="a2xx_mh_perfcnt_select">
+	<value value="0" name="CP_R0_REQUESTS"/>
+	<value value="1" name="CP_R1_REQUESTS"/>
+	<value value="2" name="CP_R2_REQUESTS"/>
+	<value value="3" name="CP_R3_REQUESTS"/>
+	<value value="4" name="CP_R4_REQUESTS"/>
+	<value value="5" name="CP_TOTAL_READ_REQUESTS"/>
+	<value value="6" name="CP_TOTAL_WRITE_REQUESTS"/>
+	<value value="7" name="CP_TOTAL_REQUESTS"/>
+	<value value="8" name="CP_DATA_BYTES_WRITTEN"/>
+	<value value="9" name="CP_WRITE_CLEAN_RESPONSES"/>
+	<value value="10" name="CP_R0_READ_BURSTS_RECEIVED"/>
+	<value value="11" name="CP_R1_READ_BURSTS_RECEIVED"/>
+	<value value="12" name="CP_R2_READ_BURSTS_RECEIVED"/>
+	<value value="13" name="CP_R3_READ_BURSTS_RECEIVED"/>
+	<value value="14" name="CP_R4_READ_BURSTS_RECEIVED"/>
+	<value value="15" name="CP_TOTAL_READ_BURSTS_RECEIVED"/>
+	<value value="16" name="CP_R0_DATA_BEATS_READ"/>
+	<value value="17" name="CP_R1_DATA_BEATS_READ"/>
+	<value value="18" name="CP_R2_DATA_BEATS_READ"/>
+	<value value="19" name="CP_R3_DATA_BEATS_READ"/>
+	<value value="20" name="CP_R4_DATA_BEATS_READ"/>
+	<value value="21" name="CP_TOTAL_DATA_BEATS_READ"/>
+	<value value="22" name="VGT_R0_REQUESTS"/>
+	<value value="23" name="VGT_R1_REQUESTS"/>
+	<value value="24" name="VGT_TOTAL_REQUESTS"/>
+	<value value="25" name="VGT_R0_READ_BURSTS_RECEIVED"/>
+	<value value="26" name="VGT_R1_READ_BURSTS_RECEIVED"/>
+	<value value="27" name="VGT_TOTAL_READ_BURSTS_RECEIVED"/>
+	<value value="28" name="VGT_R0_DATA_BEATS_READ"/>
+	<value value="29" name="VGT_R1_DATA_BEATS_READ"/>
+	<value value="30" name="VGT_TOTAL_DATA_BEATS_READ"/>
+	<value value="31" name="TC_TOTAL_REQUESTS"/>
+	<value value="32" name="TC_ROQ_REQUESTS"/>
+	<value value="33" name="TC_INFO_SENT"/>
+	<value value="34" name="TC_READ_BURSTS_RECEIVED"/>
+	<value value="35" name="TC_DATA_BEATS_READ"/>
+	<value value="36" name="TCD_BURSTS_READ"/>
+	<value value="37" name="RB_REQUESTS"/>
+	<value value="38" name="RB_DATA_BYTES_WRITTEN"/>
+	<value value="39" name="RB_WRITE_CLEAN_RESPONSES"/>
+	<value value="40" name="AXI_READ_REQUESTS_ID_0"/>
+	<value value="41" name="AXI_READ_REQUESTS_ID_1"/>
+	<value value="42" name="AXI_READ_REQUESTS_ID_2"/>
+	<value value="43" name="AXI_READ_REQUESTS_ID_3"/>
+	<value value="44" name="AXI_READ_REQUESTS_ID_4"/>
+	<value value="45" name="AXI_READ_REQUESTS_ID_5"/>
+	<value value="46" name="AXI_READ_REQUESTS_ID_6"/>
+	<value value="47" name="AXI_READ_REQUESTS_ID_7"/>
+	<value value="48" name="AXI_TOTAL_READ_REQUESTS"/>
+	<value value="49" name="AXI_WRITE_REQUESTS_ID_0"/>
+	<value value="50" name="AXI_WRITE_REQUESTS_ID_1"/>
+	<value value="51" name="AXI_WRITE_REQUESTS_ID_2"/>
+	<value value="52" name="AXI_WRITE_REQUESTS_ID_3"/>
+	<value value="53" name="AXI_WRITE_REQUESTS_ID_4"/>
+	<value value="54" name="AXI_WRITE_REQUESTS_ID_5"/>
+	<value value="55" name="AXI_WRITE_REQUESTS_ID_6"/>
+	<value value="56" name="AXI_WRITE_REQUESTS_ID_7"/>
+	<value value="57" name="AXI_TOTAL_WRITE_REQUESTS"/>
+	<value value="58" name="AXI_TOTAL_REQUESTS_ID_0"/>
+	<value value="59" name="AXI_TOTAL_REQUESTS_ID_1"/>
+	<value value="60" name="AXI_TOTAL_REQUESTS_ID_2"/>
+	<value value="61" name="AXI_TOTAL_REQUESTS_ID_3"/>
+	<value value="62" name="AXI_TOTAL_REQUESTS_ID_4"/>
+	<value value="63" name="AXI_TOTAL_REQUESTS_ID_5"/>
+	<value value="64" name="AXI_TOTAL_REQUESTS_ID_6"/>
+	<value value="65" name="AXI_TOTAL_REQUESTS_ID_7"/>
+	<value value="66" name="AXI_TOTAL_REQUESTS"/>
+	<value value="67" name="AXI_READ_CHANNEL_BURSTS_ID_0"/>
+	<value value="68" name="AXI_READ_CHANNEL_BURSTS_ID_1"/>
+	<value value="69" name="AXI_READ_CHANNEL_BURSTS_ID_2"/>
+	<value value="70" name="AXI_READ_CHANNEL_BURSTS_ID_3"/>
+	<value value="71" name="AXI_READ_CHANNEL_BURSTS_ID_4"/>
+	<value value="72" name="AXI_READ_CHANNEL_BURSTS_ID_5"/>
+	<value value="73" name="AXI_READ_CHANNEL_BURSTS_ID_6"/>
+	<value value="74" name="AXI_READ_CHANNEL_BURSTS_ID_7"/>
+	<value value="75" name="AXI_READ_CHANNEL_TOTAL_BURSTS"/>
+	<value value="76" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_0"/>
+	<value value="77" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_1"/>
+	<value value="78" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_2"/>
+	<value value="79" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_3"/>
+	<value value="80" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_4"/>
+	<value value="81" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_5"/>
+	<value value="82" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_6"/>
+	<value value="83" name="AXI_READ_CHANNEL_DATA_BEATS_READ_ID_7"/>
+	<value value="84" name="AXI_READ_CHANNEL_TOTAL_DATA_BEATS_READ"/>
+	<value value="85" name="AXI_WRITE_CHANNEL_BURSTS_ID_0"/>
+	<value value="86" name="AXI_WRITE_CHANNEL_BURSTS_ID_1"/>
+	<value value="87" name="AXI_WRITE_CHANNEL_BURSTS_ID_2"/>
+	<value value="88" name="AXI_WRITE_CHANNEL_BURSTS_ID_3"/>
+	<value value="89" name="AXI_WRITE_CHANNEL_BURSTS_ID_4"/>
+	<value value="90" name="AXI_WRITE_CHANNEL_BURSTS_ID_5"/>
+	<value value="91" name="AXI_WRITE_CHANNEL_BURSTS_ID_6"/>
+	<value value="92" name="AXI_WRITE_CHANNEL_BURSTS_ID_7"/>
+	<value value="93" name="AXI_WRITE_CHANNEL_TOTAL_BURSTS"/>
+	<value value="94" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_0"/>
+	<value value="95" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_1"/>
+	<value value="96" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_2"/>
+	<value value="97" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_3"/>
+	<value value="98" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_4"/>
+	<value value="99" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_5"/>
+	<value value="100" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_6"/>
+	<value value="101" name="AXI_WRITE_CHANNEL_DATA_BYTES_WRITTEN_ID_7"/>
+	<value value="102" name="AXI_WRITE_CHANNEL_TOTAL_DATA_BYTES_WRITTEN"/>
+	<value value="103" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_0"/>
+	<value value="104" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_1"/>
+	<value value="105" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_2"/>
+	<value value="106" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_3"/>
+	<value value="107" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_4"/>
+	<value value="108" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_5"/>
+	<value value="109" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_6"/>
+	<value value="110" name="AXI_WRITE_RESPONSE_CHANNEL_RESPONSES_ID_7"/>
+	<value value="111" name="AXI_WRITE_RESPONSE_CHANNEL_TOTAL_RESPONSES"/>
+	<value value="112" name="TOTAL_MMU_MISSES"/>
+	<value value="113" name="MMU_READ_MISSES"/>
+	<value value="114" name="MMU_WRITE_MISSES"/>
+	<value value="115" name="TOTAL_MMU_HITS"/>
+	<value value="116" name="MMU_READ_HITS"/>
+	<value value="117" name="MMU_WRITE_HITS"/>
+	<value value="118" name="SPLIT_MODE_TC_HITS"/>
+	<value value="119" name="SPLIT_MODE_TC_MISSES"/>
+	<value value="120" name="SPLIT_MODE_NON_TC_HITS"/>
+	<value value="121" name="SPLIT_MODE_NON_TC_MISSES"/>
+	<value value="122" name="STALL_AWAITING_TLB_MISS_FETCH"/>
+	<value value="123" name="MMU_TLB_MISS_READ_BURSTS_RECEIVED"/>
+	<value value="124" name="MMU_TLB_MISS_DATA_BEATS_READ"/>
+	<value value="125" name="CP_CYCLES_HELD_OFF"/>
+	<value value="126" name="VGT_CYCLES_HELD_OFF"/>
+	<value value="127" name="TC_CYCLES_HELD_OFF"/>
+	<value value="128" name="TC_ROQ_CYCLES_HELD_OFF"/>
+	<value value="129" name="TC_CYCLES_HELD_OFF_TCD_FULL"/>
+	<value value="130" name="RB_CYCLES_HELD_OFF"/>
+	<value value="131" name="TOTAL_CYCLES_ANY_CLNT_HELD_OFF"/>
+	<value value="132" name="TLB_MISS_CYCLES_HELD_OFF"/>
+	<value value="133" name="AXI_READ_REQUEST_HELD_OFF"/>
+	<value value="134" name="AXI_WRITE_REQUEST_HELD_OFF"/>
+	<value value="135" name="AXI_REQUEST_HELD_OFF"/>
+	<value value="136" name="AXI_REQUEST_HELD_OFF_INFLIGHT_LIMIT"/>
+	<value value="137" name="AXI_WRITE_DATA_HELD_OFF"/>
+	<value value="138" name="CP_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="139" name="VGT_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="140" name="TC_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="141" name="TC_ARB_HOLD_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="142" name="RB_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="143" name="TOTAL_SAME_PAGE_BANK_REQUESTS"/>
+	<value value="144" name="CP_SAME_PAGE_BANK_REQUESTS_KILLED_FAIRNESS_LIMIT"/>
+	<value value="145" name="VGT_SAME_PAGE_BANK_REQUESTS_KILLED_FAIRNESS_LIMIT"/>
+	<value value="146" name="TC_SAME_PAGE_BANK_REQUESTS_KILLED_FAIRNESS_LIMIT"/>
+	<value value="147" name="RB_SAME_PAGE_BANK_REQUESTS_KILLED_FAIRNESS_LIMIT"/>
+	<value value="148" name="TOTAL_SAME_PAGE_BANK_KILLED_FAIRNESS_LIMIT"/>
+	<value value="149" name="TOTAL_MH_READ_REQUESTS"/>
+	<value value="150" name="TOTAL_MH_WRITE_REQUESTS"/>
+	<value value="151" name="TOTAL_MH_REQUESTS"/>
+	<value value="152" name="MH_BUSY"/>
+	<value value="153" name="CP_NTH_ACCESS_SAME_PAGE_BANK_SEQUENCE"/>
+	<value value="154" name="VGT_NTH_ACCESS_SAME_PAGE_BANK_SEQUENCE"/>
+	<value value="155" name="TC_NTH_ACCESS_SAME_PAGE_BANK_SEQUENCE"/>
+	<value value="156" name="RB_NTH_ACCESS_SAME_PAGE_BANK_SEQUENCE"/>
+	<value value="157" name="TC_ROQ_N_VALID_ENTRIES"/>
+	<value value="158" name="ARQ_N_ENTRIES"/>
+	<value value="159" name="WDB_N_ENTRIES"/>
+	<value value="160" name="MH_READ_LATENCY_OUTST_REQ_SUM"/>
+	<value value="161" name="MC_READ_LATENCY_OUTST_REQ_SUM"/>
+	<value value="162" name="MC_TOTAL_READ_REQUESTS"/>
+	<value value="163" name="ELAPSED_CYCLES_MH_GATED_CLK"/>
+	<value value="164" name="ELAPSED_CLK_CYCLES"/>
+	<value value="165" name="CP_W_16B_REQUESTS"/>
+	<value value="166" name="CP_W_32B_REQUESTS"/>
+	<value value="167" name="TC_16B_REQUESTS"/>
+	<value value="168" name="TC_32B_REQUESTS"/>
+	<value value="169" name="PA_REQUESTS"/>
+	<value value="170" name="PA_DATA_BYTES_WRITTEN"/>
+	<value value="171" name="PA_WRITE_CLEAN_RESPONSES"/>
+	<value value="172" name="PA_CYCLES_HELD_OFF"/>
+	<value value="173" name="AXI_READ_REQUEST_DATA_BEATS_ID_0"/>
+	<value value="174" name="AXI_READ_REQUEST_DATA_BEATS_ID_1"/>
+	<value value="175" name="AXI_READ_REQUEST_DATA_BEATS_ID_2"/>
+	<value value="176" name="AXI_READ_REQUEST_DATA_BEATS_ID_3"/>
+	<value value="177" name="AXI_READ_REQUEST_DATA_BEATS_ID_4"/>
+	<value value="178" name="AXI_READ_REQUEST_DATA_BEATS_ID_5"/>
+	<value value="179" name="AXI_READ_REQUEST_DATA_BEATS_ID_6"/>
+	<value value="180" name="AXI_READ_REQUEST_DATA_BEATS_ID_7"/>
+	<value value="181" name="AXI_TOTAL_READ_REQUEST_DATA_BEATS"/>
+</enum>
+
+<enum name="perf_mode_cnt">
+	<value name="PERF_STATE_RESET" value="0"/>
+	<value name="PERF_STATE_ENABLE" value="1"/>
+	<value name="PERF_STATE_FREEZE" value="2"/>
+</enum>
+
+<domain name="A2XX" width="32">
+
+	<bitset name="a2xx_vgt_current_bin_id_min_max" inline="yes">
+		<bitfield name="COLUMN" low="0" high="2" type="uint"/>
+		<bitfield name="ROW" low="3" high="5" type="uint"/>
+		<bitfield name="GUARD_BAND_MASK" low="6" high="8" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x0001" name="RBBM_PATCH_RELEASE"/>
+	<reg32 offset="0x003b" name="RBBM_CNTL"/>
+	<reg32 offset="0x003c" name="RBBM_SOFT_RESET"/>
+	<reg32 offset="0x00c0" name="CP_PFP_UCODE_ADDR"/>
+	<reg32 offset="0x00c1" name="CP_PFP_UCODE_DATA"/>
+
+	<enum name="adreno_mmu_clnt_beh">
+		<value name="BEH_NEVR" value="0"/>
+		<value name="BEH_TRAN_RNG" value="1"/>
+		<value name="BEH_TRAN_FLT" value="2"/>
+	</enum>
+
+	<!--
+		Note: these seem applicable only for a2xx devices with gpummu?  At
+		any rate, MH_MMU_CONFIG shows up in places in a3xx firmware where
+		it doesn't make sense, so I think offset 0x40 must be a different
+		register on a3xx.. so moving this back into A2XX domain:
+	 -->
+	<reg32 offset="0x0040" name="MH_MMU_CONFIG">
+		<bitfield name="MMU_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="SPLIT_MODE_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="RB_W_CLNT_BEHAVIOR" low="4" high="5" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_W_CLNT_BEHAVIOR" low="6" high="7" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R0_CLNT_BEHAVIOR" low="8" high="9" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R1_CLNT_BEHAVIOR" low="10" high="11" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R2_CLNT_BEHAVIOR" low="12" high="13" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R3_CLNT_BEHAVIOR" low="14" high="15" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="CP_R4_CLNT_BEHAVIOR" low="16" high="17" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="VGT_R0_CLNT_BEHAVIOR" low="18" high="19" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="VGT_R1_CLNT_BEHAVIOR" low="20" high="21" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="TC_R_CLNT_BEHAVIOR" low="22" high="23" type="adreno_mmu_clnt_beh"/>
+		<bitfield name="PA_W_CLNT_BEHAVIOR" low="24" high="25" type="adreno_mmu_clnt_beh"/>
+	</reg32>
+	<reg32 offset="0x0041" name="MH_MMU_VA_RANGE">
+		<bitfield name="NUM_64KB_REGIONS" low="0" high="11" type="uint"/>
+		<bitfield name="VA_BASE" low="12" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0042" name="MH_MMU_PT_BASE"/>
+	<reg32 offset="0x0043" name="MH_MMU_PAGE_FAULT"/>
+	<reg32 offset="0x0044" name="MH_MMU_TRAN_ERROR"/>
+	<reg32 offset="0x0045" name="MH_MMU_INVALIDATE">
+		<bitfield name="INVALIDATE_ALL" pos="0" type="boolean"/>
+		<bitfield name="INVALIDATE_TC" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0046" name="MH_MMU_MPU_BASE"/>
+	<reg32 offset="0x0047" name="MH_MMU_MPU_END"/>
+
+	<reg32 offset="0x0394" name="NQWAIT_UNTIL"/>
+	<reg32 offset="0x0395" name="RBBM_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0396" name="RBBM_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0397" name="RBBM_PERFCOUNTER0_LO"/>
+	<reg32 offset="0x0398" name="RBBM_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0399" name="RBBM_PERFCOUNTER1_LO"/>
+	<reg32 offset="0x039a" name="RBBM_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x039b" name="RBBM_DEBUG"/>
+	<reg32 offset="0x039c" name="RBBM_PM_OVERRIDE1">
+		<bitfield name="RBBM_AHBCLK_PM_OVERRIDE" pos="0" type="boolean"/>
+		<bitfield name="SC_REG_SCLK_PM_OVERRIDE" pos="1" type="boolean"/>
+		<bitfield name="SC_SCLK_PM_OVERRIDE" pos="2" type="boolean"/>
+		<bitfield name="SP_TOP_SCLK_PM_OVERRIDE" pos="3" type="boolean"/>
+		<bitfield name="SP_V0_SCLK_PM_OVERRIDE" pos="4" type="boolean"/>
+		<bitfield name="SQ_REG_SCLK_PM_OVERRIDE" pos="5" type="boolean"/>
+		<bitfield name="SQ_REG_FIFOS_SCLK_PM_OVERRIDE" pos="6" type="boolean"/>
+		<bitfield name="SQ_CONST_MEM_SCLK_PM_OVERRIDE" pos="7" type="boolean"/>
+		<bitfield name="SQ_SQ_SCLK_PM_OVERRIDE" pos="8" type="boolean"/>
+		<bitfield name="SX_SCLK_PM_OVERRIDE" pos="9" type="boolean"/>
+		<bitfield name="SX_REG_SCLK_PM_OVERRIDE" pos="10" type="boolean"/>
+		<bitfield name="TCM_TCO_SCLK_PM_OVERRIDE" pos="11" type="boolean"/>
+		<bitfield name="TCM_TCM_SCLK_PM_OVERRIDE" pos="12" type="boolean"/>
+		<bitfield name="TCM_TCD_SCLK_PM_OVERRIDE" pos="13" type="boolean"/>
+		<bitfield name="TCM_REG_SCLK_PM_OVERRIDE" pos="14" type="boolean"/>
+		<bitfield name="TPC_TPC_SCLK_PM_OVERRIDE" pos="15" type="boolean"/>
+		<bitfield name="TPC_REG_SCLK_PM_OVERRIDE" pos="16" type="boolean"/>
+		<bitfield name="TCF_TCA_SCLK_PM_OVERRIDE" pos="17" type="boolean"/>
+		<bitfield name="TCF_TCB_SCLK_PM_OVERRIDE" pos="18" type="boolean"/>
+		<bitfield name="TCF_TCB_READ_SCLK_PM_OVERRIDE" pos="19" type="boolean"/>
+		<bitfield name="TP_TP_SCLK_PM_OVERRIDE" pos="20" type="boolean"/>
+		<bitfield name="TP_REG_SCLK_PM_OVERRIDE" pos="21" type="boolean"/>
+		<bitfield name="CP_G_SCLK_PM_OVERRIDE" pos="22" type="boolean"/>
+		<bitfield name="CP_REG_SCLK_PM_OVERRIDE" pos="23" type="boolean"/>
+		<bitfield name="CP_G_REG_SCLK_PM_OVERRIDE" pos="24" type="boolean"/>
+		<bitfield name="SPI_SCLK_PM_OVERRIDE" pos="25" type="boolean"/>
+		<bitfield name="RB_REG_SCLK_PM_OVERRIDE" pos="26" type="boolean"/>
+		<bitfield name="RB_SCLK_PM_OVERRIDE" pos="27" type="boolean"/>
+		<bitfield name="MH_MH_SCLK_PM_OVERRIDE" pos="28" type="boolean"/>
+		<bitfield name="MH_REG_SCLK_PM_OVERRIDE" pos="29" type="boolean"/>
+		<bitfield name="MH_MMU_SCLK_PM_OVERRIDE" pos="30" type="boolean"/>
+		<bitfield name="MH_TCROQ_SCLK_PM_OVERRIDE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x039d" name="RBBM_PM_OVERRIDE2">
+		<bitfield name="PA_REG_SCLK_PM_OVERRIDE" pos="0" type="boolean"/>
+		<bitfield name="PA_PA_SCLK_PM_OVERRIDE" pos="1" type="boolean"/>
+		<bitfield name="PA_AG_SCLK_PM_OVERRIDE" pos="2" type="boolean"/>
+		<bitfield name="VGT_REG_SCLK_PM_OVERRIDE" pos="3" type="boolean"/>
+		<bitfield name="VGT_FIFOS_SCLK_PM_OVERRIDE" pos="4" type="boolean"/>
+		<bitfield name="VGT_VGT_SCLK_PM_OVERRIDE" pos="5" type="boolean"/>
+		<bitfield name="DEBUG_PERF_SCLK_PM_OVERRIDE" pos="6" type="boolean"/>
+		<bitfield name="PERM_SCLK_PM_OVERRIDE" pos="7" type="boolean"/>
+		<bitfield name="GC_GA_GMEM0_PM_OVERRIDE" pos="8" type="boolean"/>
+		<bitfield name="GC_GA_GMEM1_PM_OVERRIDE" pos="9" type="boolean"/>
+		<bitfield name="GC_GA_GMEM2_PM_OVERRIDE" pos="10" type="boolean"/>
+		<bitfield name="GC_GA_GMEM3_PM_OVERRIDE" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x03a0" name="RBBM_DEBUG_OUT"/>
+	<reg32 offset="0x03a1" name="RBBM_DEBUG_CNTL"/>
+	<reg32 offset="0x03b3" name="RBBM_READ_ERROR"/>
+	<reg32 offset="0x03b4" name="RBBM_INT_CNTL">
+		<bitfield name="RDERR_INT_MASK" pos="0" type="boolean"/>
+		<bitfield name="DISPLAY_UPDATE_INT_MASK" pos="1" type="boolean"/>
+		<bitfield name="GUI_IDLE_INT_MASK" pos="19" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x03b5" name="RBBM_INT_STATUS"/>
+	<reg32 offset="0x03b6" name="RBBM_INT_ACK"/>
+	<reg32 offset="0x03b7" name="MASTER_INT_SIGNAL">
+		<bitfield name="MH_INT_STAT" pos="5" type="boolean"/>
+		<bitfield name="SQ_INT_STAT" pos="26" type="boolean"/>
+		<bitfield name="CP_INT_STAT" pos="30" type="boolean"/>
+		<bitfield name="RBBM_INT_STAT" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x03f9" name="RBBM_PERIPHID1"/>
+	<reg32 offset="0x03fa" name="RBBM_PERIPHID2"/>
+	<reg32 offset="0x0444" name="CP_PERFMON_CNTL">
+		<!-- The width is uncertain -->
+		<bitfield name="PERF_MODE_CNT" low="0" high="2" type="perf_mode_cnt"/>
+	</reg32>
+	<reg32 offset="0x0445" name="CP_PERFCOUNTER_SELECT"/>
+	<reg32 offset="0x0446" name="CP_PERFCOUNTER_LO"/>
+	<reg32 offset="0x0447" name="CP_PERFCOUNTER_HI"/>
+	<reg32 offset="0x05d0" name="RBBM_STATUS">
+		<bitfield name="CMDFIFO_AVAIL" low="0" high="4" type="uint"/>
+		<bitfield name="TC_BUSY" pos="5" type="boolean"/>
+		<bitfield name="HIRQ_PENDING" pos="8" type="boolean"/>
+		<bitfield name="CPRQ_PENDING" pos="9" type="boolean"/>
+		<bitfield name="CFRQ_PENDING" pos="10" type="boolean"/>
+		<bitfield name="PFRQ_PENDING" pos="11" type="boolean"/>
+		<bitfield name="VGT_BUSY_NO_DMA" pos="12" type="boolean"/>
+		<bitfield name="RBBM_WU_BUSY" pos="14" type="boolean"/>
+		<bitfield name="CP_NRT_BUSY" pos="16" type="boolean"/>
+		<bitfield name="MH_BUSY" pos="18" type="boolean"/>
+		<bitfield name="MH_COHERENCY_BUSY" pos="19" type="boolean"/>
+		<bitfield name="SX_BUSY" pos="21" type="boolean"/>
+		<bitfield name="TPC_BUSY" pos="22" type="boolean"/>
+		<bitfield name="SC_CNTX_BUSY" pos="24" type="boolean"/>
+		<bitfield name="PA_BUSY" pos="25" type="boolean"/>
+		<bitfield name="VGT_BUSY" pos="26" type="boolean"/>
+		<bitfield name="SQ_CNTX17_BUSY" pos="27" type="boolean"/>
+		<bitfield name="SQ_CNTX0_BUSY" pos="28" type="boolean"/>
+		<bitfield name="RB_CNTX_BUSY" pos="30" type="boolean"/>
+		<bitfield name="GUI_ACTIVE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0a40" name="MH_ARBITER_CONFIG">
+		<bitfield name="SAME_PAGE_LIMIT" low="0" high="5" type="uint"/>
+		<bitfield name="SAME_PAGE_GRANULARITY" pos="6" type="boolean"/>
+		<bitfield name="L1_ARB_ENABLE" pos="7" type="boolean"/>
+		<bitfield name="L1_ARB_HOLD_ENABLE" pos="8" type="boolean"/>
+		<bitfield name="L2_ARB_CONTROL" pos="9" type="boolean"/>
+		<bitfield name="PAGE_SIZE" low="10" high="12" type="uint"/>
+		<bitfield name="TC_REORDER_ENABLE" pos="13" type="boolean"/>
+		<bitfield name="TC_ARB_HOLD_ENABLE" pos="14" type="boolean"/>
+		<bitfield name="IN_FLIGHT_LIMIT_ENABLE" pos="15" type="boolean"/>
+		<bitfield name="IN_FLIGHT_LIMIT" low="16" high="21" type="uint"/>
+		<bitfield name="CP_CLNT_ENABLE" pos="22" type="boolean"/>
+		<bitfield name="VGT_CLNT_ENABLE" pos="23" type="boolean"/>
+		<bitfield name="TC_CLNT_ENABLE" pos="24" type="boolean"/>
+		<bitfield name="RB_CLNT_ENABLE" pos="25" type="boolean"/>
+		<bitfield name="PA_CLNT_ENABLE" pos="26" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0a42" name="MH_INTERRUPT_MASK">
+		<bitfield name="AXI_READ_ERROR" pos="0" type="boolean"/>
+		<bitfield name="AXI_WRITE_ERROR" pos="1" type="boolean"/>
+		<bitfield name="MMU_PAGE_FAULT" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0a43" name="MH_INTERRUPT_STATUS"/>
+	<reg32 offset="0x0a44" name="MH_INTERRUPT_CLEAR"/>
+	<reg32 offset="0x0a54" name="MH_CLNT_INTF_CTRL_CONFIG1"/>
+	<reg32 offset="0x0a55" name="MH_CLNT_INTF_CTRL_CONFIG2"/>
+	<reg32 offset="0x0c01" name="A220_VSC_BIN_SIZE">
+		<bitfield name="WIDTH" low="0" high="4" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="5" high="9" shr="5" type="uint"/>
+	</reg32>
+	<array offset="0x0c06" name="VSC_PIPE" stride="3" length="8">
+		<reg32 offset="0x0" name="CONFIG"/>
+		<reg32 offset="0x1" name="DATA_ADDRESS"/>
+		<reg32 offset="0x2" name="DATA_LENGTH"/>
+	</array>
+	<reg32 offset="0x0c38" name="PC_DEBUG_CNTL"/>
+	<reg32 offset="0x0c39" name="PC_DEBUG_DATA"/>
+	<reg32 offset="0x0c44" name="PA_SC_VIZ_QUERY_STATUS"/>
+	<reg32 offset="0x0c80" name="GRAS_DEBUG_CNTL"/>
+	<reg32 offset="0x0c80" name="PA_SU_DEBUG_CNTL"/>
+	<reg32 offset="0x0c81" name="GRAS_DEBUG_DATA"/>
+	<reg32 offset="0x0c81" name="PA_SU_DEBUG_DATA"/>
+	<reg32 offset="0x0c86" name="PA_SU_FACE_DATA">
+		<bitfield name="BASE_ADDR" low="5" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0d00" name="SQ_GPR_MANAGEMENT">
+		<bitfield name="REG_DYNAMIC" pos="0" type="boolean"/>
+		<bitfield name="REG_SIZE_PIX" low="4" high="11" type="uint"/>
+		<bitfield name="REG_SIZE_VTX" low="12" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0d01" name="SQ_FLOW_CONTROL"/>
+	<reg32 offset="0x0d02" name="SQ_INST_STORE_MANAGMENT">
+		<bitfield name="INST_BASE_PIX" low="0" high="11" type="uint"/>
+		<bitfield name="INST_BASE_VTX" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0d05" name="SQ_DEBUG_MISC"/>
+	<reg32 offset="0x0d34" name="SQ_INT_CNTL"/>
+	<reg32 offset="0x0d35" name="SQ_INT_STATUS"/>
+	<reg32 offset="0x0d36" name="SQ_INT_ACK"/>
+	<reg32 offset="0x0dae" name="SQ_DEBUG_INPUT_FSM"/>
+	<reg32 offset="0x0daf" name="SQ_DEBUG_CONST_MGR_FSM"/>
+	<reg32 offset="0x0db0" name="SQ_DEBUG_TP_FSM"/>
+	<reg32 offset="0x0db1" name="SQ_DEBUG_FSM_ALU_0"/>
+	<reg32 offset="0x0db2" name="SQ_DEBUG_FSM_ALU_1"/>
+	<reg32 offset="0x0db3" name="SQ_DEBUG_EXP_ALLOC"/>
+	<reg32 offset="0x0db4" name="SQ_DEBUG_PTR_BUFF"/>
+	<reg32 offset="0x0db5" name="SQ_DEBUG_GPR_VTX"/>
+	<reg32 offset="0x0db6" name="SQ_DEBUG_GPR_PIX"/>
+	<reg32 offset="0x0db7" name="SQ_DEBUG_TB_STATUS_SEL"/>
+	<reg32 offset="0x0db8" name="SQ_DEBUG_VTX_TB_0"/>
+	<reg32 offset="0x0db9" name="SQ_DEBUG_VTX_TB_1"/>
+	<reg32 offset="0x0dba" name="SQ_DEBUG_VTX_TB_STATUS_REG"/>
+	<reg32 offset="0x0dbb" name="SQ_DEBUG_VTX_TB_STATE_MEM"/>
+	<reg32 offset="0x0dbc" name="SQ_DEBUG_PIX_TB_0"/>
+	<reg32 offset="0x0dbd" name="SQ_DEBUG_PIX_TB_STATUS_REG_0"/>
+	<reg32 offset="0x0dbe" name="SQ_DEBUG_PIX_TB_STATUS_REG_1"/>
+	<reg32 offset="0x0dbf" name="SQ_DEBUG_PIX_TB_STATUS_REG_2"/>
+	<reg32 offset="0x0dc0" name="SQ_DEBUG_PIX_TB_STATUS_REG_3"/>
+	<reg32 offset="0x0dc1" name="SQ_DEBUG_PIX_TB_STATE_MEM"/>
+	<reg32 offset="0x0e00" name="TC_CNTL_STATUS">
+		<bitfield name="L2_INVALIDATE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0e1e" name="TP0_CHICKEN"/>
+	<reg32 offset="0x0f01" name="RB_BC_CONTROL">
+		<bitfield name="ACCUM_LINEAR_MODE_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="ACCUM_TIMEOUT_SELECT" low="1" high="2" type="uint"/>
+		<bitfield name="DISABLE_EDRAM_CAM" pos="3" type="boolean"/>
+		<bitfield name="DISABLE_EZ_FAST_CONTEXT_SWITCH" pos="4" type="boolean"/>
+		<bitfield name="DISABLE_EZ_NULL_ZCMD_DROP" pos="5" type="boolean"/>
+		<bitfield name="DISABLE_LZ_NULL_ZCMD_DROP" pos="6" type="boolean"/>
+		<bitfield name="ENABLE_AZ_THROTTLE" pos="7" type="boolean"/>
+		<bitfield name="AZ_THROTTLE_COUNT" low="8" high="12" type="uint"/>
+		<bitfield name="ENABLE_CRC_UPDATE" pos="14" type="boolean"/>
+		<bitfield name="CRC_MODE" pos="15" type="boolean"/>
+		<bitfield name="DISABLE_SAMPLE_COUNTERS" pos="16" type="boolean"/>
+		<bitfield name="DISABLE_ACCUM" pos="17" type="boolean"/>
+		<bitfield name="ACCUM_ALLOC_MASK" low="18" high="21" type="uint"/>
+		<bitfield name="LINEAR_PERFORMANCE_ENABLE" pos="22" type="boolean"/>
+		<bitfield name="ACCUM_DATA_FIFO_LIMIT" low="23" high="26" type="uint"/>
+		<bitfield name="MEM_EXPORT_TIMEOUT_SELECT" low="27" high="28" type="uint"/>
+		<bitfield name="MEM_EXPORT_LINEAR_MODE_ENABLE" pos="29" type="boolean"/>
+		<bitfield name="CRC_SYSTEM" pos="30" type="boolean"/>
+		<bitfield name="RESERVED6" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0f02" name="RB_EDRAM_INFO"/>
+	<reg32 offset="0x0f26" name="RB_DEBUG_CNTL"/>
+	<reg32 offset="0x0f27" name="RB_DEBUG_DATA"/>
+	<reg32 offset="0x2000" name="RB_SURFACE_INFO">
+		<bitfield name="SURFACE_PITCH" low="0" high="13" type="uint"/>
+		<bitfield name="MSAA_SAMPLES" low="14" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2001" name="RB_COLOR_INFO">
+		<bitfield name="FORMAT" low="0" high="3" type="a2xx_colorformatx"/>
+		<bitfield name="ROUND_MODE" low="4" high="5" type="uint"/>
+		<bitfield name="LINEAR" pos="6" type="boolean"/>
+		<bitfield name="ENDIAN" low="7" high="8" type="uint"/>
+		<bitfield name="SWAP" low="9" high="10" type="uint"/>
+		<bitfield name="BASE" low="12" high="31" shr="12"/>
+	</reg32>
+	<reg32 offset="0x2002" name="RB_DEPTH_INFO">
+		<bitfield name="DEPTH_FORMAT" pos="0" type="adreno_rb_depth_format"/>
+		<bitfield name="DEPTH_BASE" low="12" high="31" type="uint" shr="12"/>
+	</reg32>
+	<reg32 offset="0x2005" name="A225_RB_COLOR_INFO3"/>
+	<reg32 offset="0x2006" name="COHER_DEST_BASE_0"/>
+	<reg32 offset="0x200e" name="PA_SC_SCREEN_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x200f" name="PA_SC_SCREEN_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x2080" name="PA_SC_WINDOW_OFFSET">
+		<bitfield name="X" low="0" high="14" type="int"/>
+		<bitfield name="Y" low="16" high="30" type="int"/>
+		<bitfield name="DISABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2081" name="PA_SC_WINDOW_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x2082" name="PA_SC_WINDOW_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x2010" name="UNKNOWN_2010"/>
+	<reg32 offset="0x2100" name="VGT_MAX_VTX_INDX"/>
+	<reg32 offset="0x2101" name="VGT_MIN_VTX_INDX"/>
+	<reg32 offset="0x2102" name="VGT_INDX_OFFSET"/>
+	<reg32 offset="0x2103" name="A225_PC_MULTI_PRIM_IB_RESET_INDX"/>
+	<reg32 offset="0x2104" name="RB_COLOR_MASK">
+		<bitfield name="WRITE_RED" pos="0" type="boolean"/>
+		<bitfield name="WRITE_GREEN" pos="1" type="boolean"/>
+		<bitfield name="WRITE_BLUE" pos="2" type="boolean"/>
+		<bitfield name="WRITE_ALPHA" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2105" name="RB_BLEND_RED"/>
+	<reg32 offset="0x2106" name="RB_BLEND_GREEN"/>
+	<reg32 offset="0x2107" name="RB_BLEND_BLUE"/>
+	<reg32 offset="0x2108" name="RB_BLEND_ALPHA"/>
+	<reg32 offset="0x2109" name="RB_FOG_COLOR">
+		<bitfield name="FOG_RED" low="0" high="7" type="uint"/>
+		<bitfield name="FOG_GREEN" low="8" high="15" type="uint"/>
+		<bitfield name="FOG_BLUE" low="16" high="23" type="uint"/>
+	</reg32>
+	<reg32 offset="0x210c" name="RB_STENCILREFMASK_BF" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x210d" name="RB_STENCILREFMASK" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x210e" name="RB_ALPHA_REF"/>
+	<reg32 offset="0x210f" name="PA_CL_VPORT_XSCALE" type="float"/>
+	<reg32 offset="0x2110" name="PA_CL_VPORT_XOFFSET" type="float"/>
+	<reg32 offset="0x2111" name="PA_CL_VPORT_YSCALE" type="float"/>
+	<reg32 offset="0x2112" name="PA_CL_VPORT_YOFFSET" type="float"/>
+	<reg32 offset="0x2113" name="PA_CL_VPORT_ZSCALE" type="float"/>
+	<reg32 offset="0x2114" name="PA_CL_VPORT_ZOFFSET" type="float"/>
+	<reg32 offset="0x2180" name="SQ_PROGRAM_CNTL">
+		<doc>
+			note: only 0x3f worth of valid register values for VS_REGS and
+			PS_REGS, but high bit is set to indicate '0 registers used':
+		</doc>
+		<bitfield name="VS_REGS" low="0" high="7" type="uint"/>
+		<bitfield name="PS_REGS" low="8" high="15" type="uint"/>
+		<bitfield name="VS_RESOURCE" pos="16" type="boolean"/>
+		<bitfield name="PS_RESOURCE" pos="17" type="boolean"/>
+		<bitfield name="PARAM_GEN" pos="18" type="boolean"/>
+		<bitfield name="GEN_INDEX_PIX" pos="19" type="boolean"/>
+		<bitfield name="VS_EXPORT_COUNT" low="20" high="23" type="uint"/>
+		<bitfield name="VS_EXPORT_MODE" low="24" high="26" type="a2xx_sq_ps_vtx_mode"/>
+		<bitfield name="PS_EXPORT_MODE" low="27" high="30" type="uint"/>
+		<bitfield name="GEN_INDEX_VTX" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2181" name="SQ_CONTEXT_MISC">
+		<bitfield name="INST_PRED_OPTIMIZE" pos="0" type="boolean"/>
+		<bitfield name="SC_OUTPUT_SCREEN_XY" pos="1" type="boolean"/>
+		<bitfield name="SC_SAMPLE_CNTL" low="2" high="3" type="a2xx_sq_sample_cntl"/>
+		<bitfield name="PARAM_GEN_POS" low="8" high="15" type="uint"/>
+		<bitfield name="PERFCOUNTER_REF" pos="16" type="boolean"/>
+		<bitfield name="YEILD_OPTIMIZE" pos="17" type="boolean"/>
+		<bitfield name="TX_CACHE_SEL" pos="18" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2182" name="SQ_INTERPOLATOR_CNTL">
+		<bitfield name="PARAM_SHADE" low="0" high="15" type="uint"/>
+		<bitfield name="SAMPLING_PATTERN" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2183" name="SQ_WRAPPING_0">
+		<bitfield name="PARAM_WRAP_0" low="0" high="3" type="uint"/>
+		<bitfield name="PARAM_WRAP_1" low="4" high="7" type="uint"/>
+		<bitfield name="PARAM_WRAP_2" low="8" high="11" type="uint"/>
+		<bitfield name="PARAM_WRAP_3" low="12" high="15" type="uint"/>
+		<bitfield name="PARAM_WRAP_4" low="16" high="19" type="uint"/>
+		<bitfield name="PARAM_WRAP_5" low="20" high="23" type="uint"/>
+		<bitfield name="PARAM_WRAP_6" low="24" high="27" type="uint"/>
+		<bitfield name="PARAM_WRAP_7" low="28" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2184" name="SQ_WRAPPING_1">
+		<bitfield name="PARAM_WRAP_8" low="0" high="3" type="uint"/>
+		<bitfield name="PARAM_WRAP_9" low="4" high="7" type="uint"/>
+		<bitfield name="PARAM_WRAP_10" low="8" high="11" type="uint"/>
+		<bitfield name="PARAM_WRAP_11" low="12" high="15" type="uint"/>
+		<bitfield name="PARAM_WRAP_12" low="16" high="19" type="uint"/>
+		<bitfield name="PARAM_WRAP_13" low="20" high="23" type="uint"/>
+		<bitfield name="PARAM_WRAP_14" low="24" high="27" type="uint"/>
+		<bitfield name="PARAM_WRAP_15" low="28" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21f6" name="SQ_PS_PROGRAM">
+		<bitfield name="BASE" low="0" high="11" type="uint"/>
+		<bitfield name="SIZE" low="12" high="23" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21f7" name="SQ_VS_PROGRAM">
+		<bitfield name="BASE" low="0" high="11" type="uint"/>
+		<bitfield name="SIZE" low="12" high="23" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21f9" name="VGT_EVENT_INITIATOR"/>
+	<reg32 offset="0x21fc" name="VGT_DRAW_INITIATOR" type="vgt_draw_initiator"/>
+	<reg32 offset="0x21fd" name="VGT_IMMED_DATA"/>
+	<reg32 offset="0x2200" name="RB_DEPTHCONTROL">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="Z_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="EARLY_Z_ENABLE" pos="3" type="boolean"/>
+		<bitfield name="ZFUNC" low="4" high="6" type="adreno_compare_func"/>
+		<bitfield name="BACKFACE_ENABLE" pos="7" type="boolean"/>
+		<bitfield name="STENCILFUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="STENCILFAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="STENCILZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="STENCILZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="STENCILFUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="STENCILFAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="STENCILZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="STENCILZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0x2201" name="RB_BLEND_CONTROL">
+		<bitfield name="COLOR_SRCBLEND" low="0" high="4" type="adreno_rb_blend_factor"/>
+		<bitfield name="COLOR_COMB_FCN" low="5" high="7" type="a2xx_rb_blend_opcode"/>
+		<bitfield name="COLOR_DESTBLEND" low="8" high="12" type="adreno_rb_blend_factor"/>
+		<bitfield name="ALPHA_SRCBLEND" low="16" high="20" type="adreno_rb_blend_factor"/>
+		<bitfield name="ALPHA_COMB_FCN" low="21" high="23" type="a2xx_rb_blend_opcode"/>
+		<bitfield name="ALPHA_DESTBLEND" low="24" high="28" type="adreno_rb_blend_factor"/>
+		<bitfield name="BLEND_FORCE_ENABLE" pos="29" type="boolean"/>
+		<bitfield name="BLEND_FORCE" pos="30" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2202" name="RB_COLORCONTROL">
+		<bitfield name="ALPHA_FUNC" low="0" high="2" type="adreno_compare_func"/>
+		<bitfield name="ALPHA_TEST_ENABLE" pos="3" type="boolean"/>
+		<bitfield name="ALPHA_TO_MASK_ENABLE" pos="4" type="boolean"/>
+		<bitfield name="BLEND_DISABLE" pos="5" type="boolean"/>
+		<bitfield name="VOB_ENABLE" pos="6" type="boolean"/>
+		<bitfield name="VS_EXPORTS_FOG" pos="7" type="boolean"/>
+		<bitfield name="ROP_CODE" low="8" high="11" type="uint"/>
+		<bitfield name="DITHER_MODE" low="12" high="13" type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_TYPE" low="14" high="15" type="a2xx_rb_dither_type"/>
+		<bitfield name="PIXEL_FOG" pos="16" type="boolean"/>
+		<bitfield name="ALPHA_TO_MASK_OFFSET0" low="24" high="25" type="uint"/>
+		<bitfield name="ALPHA_TO_MASK_OFFSET1" low="26" high="27" type="uint"/>
+		<bitfield name="ALPHA_TO_MASK_OFFSET2" low="28" high="29" type="uint"/>
+		<bitfield name="ALPHA_TO_MASK_OFFSET3" low="30" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2203" name="VGT_CURRENT_BIN_ID_MAX" type="a2xx_vgt_current_bin_id_min_max"/>
+	<reg32 offset="0x2204" name="PA_CL_CLIP_CNTL">
+		<bitfield name="CLIP_DISABLE" pos="16" type="boolean"/>
+		<bitfield name="BOUNDARY_EDGE_FLAG_ENA" pos="18" type="boolean"/>
+		<bitfield name="DX_CLIP_SPACE_DEF" pos="19" type="a2xx_dx_clip_space"/>
+		<bitfield name="DIS_CLIP_ERR_DETECT" pos="20" type="boolean"/>
+		<bitfield name="VTX_KILL_OR" pos="21" type="boolean"/>
+		<bitfield name="XY_NAN_RETAIN" pos="22" type="boolean"/>
+		<bitfield name="Z_NAN_RETAIN" pos="23" type="boolean"/>
+		<bitfield name="W_NAN_RETAIN" pos="24" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2205" name="PA_SU_SC_MODE_CNTL">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FACE" pos="2" type="boolean"/>
+		<bitfield name="POLYMODE" low="3" high="4" type="a2xx_pa_su_sc_polymode"/>
+		<bitfield name="FRONT_PTYPE" low="5" high="7" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="BACK_PTYPE" low="8" high="10" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLY_OFFSET_FRONT_ENABLE" pos="11" type="boolean"/>
+		<bitfield name="POLY_OFFSET_BACK_ENABLE" pos="12" type="boolean"/>
+		<bitfield name="POLY_OFFSET_PARA_ENABLE" pos="13" type="boolean"/>
+		<bitfield name="MSAA_ENABLE" pos="15" type="boolean"/>
+		<bitfield name="VTX_WINDOW_OFFSET_ENABLE" pos="16" type="boolean"/>
+		<bitfield name="LINE_STIPPLE_ENABLE" pos="18" type="boolean"/>
+		<bitfield name="PROVOKING_VTX_LAST" pos="19" type="boolean"/>
+		<bitfield name="PERSP_CORR_DIS" pos="20" type="boolean"/>
+		<bitfield name="MULTI_PRIM_IB_ENA" pos="21" type="boolean"/>
+		<bitfield name="QUAD_ORDER_ENABLE" pos="23" type="boolean"/>
+		<bitfield name="WAIT_RB_IDLE_ALL_TRI" pos="25" type="boolean"/>
+		<bitfield name="WAIT_RB_IDLE_FIRST_TRI_NEW_STATE" pos="26" type="boolean"/>
+		<bitfield name="CLAMPED_FACENESS" pos="28" type="boolean"/>
+		<bitfield name="ZERO_AREA_FACENESS" pos="29" type="boolean"/>
+		<bitfield name="FACE_KILL_ENABLE" pos="30" type="boolean"/>
+		<bitfield name="FACE_WRITE_ENABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2206" name="PA_CL_VTE_CNTL">
+		<bitfield name="VPORT_X_SCALE_ENA" pos="0" type="boolean"/>
+		<bitfield name="VPORT_X_OFFSET_ENA" pos="1" type="boolean"/>
+		<bitfield name="VPORT_Y_SCALE_ENA" pos="2" type="boolean"/>
+		<bitfield name="VPORT_Y_OFFSET_ENA" pos="3" type="boolean"/>
+		<bitfield name="VPORT_Z_SCALE_ENA" pos="4" type="boolean"/>
+		<bitfield name="VPORT_Z_OFFSET_ENA" pos="5" type="boolean"/>
+		<bitfield name="VTX_XY_FMT" pos="8" type="boolean"/>
+		<bitfield name="VTX_Z_FMT" pos="9" type="boolean"/>
+		<bitfield name="VTX_W0_FMT" pos="10" type="boolean"/>
+		<bitfield name="PERFCOUNTER_REF" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2207" name="VGT_CURRENT_BIN_ID_MIN" type="a2xx_vgt_current_bin_id_min_max"/>
+	<reg32 offset="0x2208" name="RB_MODECONTROL">
+		<bitfield name="EDRAM_MODE" low="0" high="2" type="a2xx_rb_edram_mode"/>
+	</reg32>
+	<reg32 offset="0x2209" name="A220_RB_LRZ_VSC_CONTROL"/>
+	<reg32 offset="0x220a" name="RB_SAMPLE_POS"/>
+	<reg32 offset="0x220b" name="CLEAR_COLOR">
+		<bitfield name="RED" low="0" high="7"/>
+		<bitfield name="GREEN" low="8" high="15"/>
+		<bitfield name="BLUE" low="16" high="23"/>
+		<bitfield name="ALPHA" low="24" high="31"/>
+	</reg32>
+	<reg32 offset="0x2210" name="A220_GRAS_CONTROL"/>
+	<reg32 offset="0x2280" name="PA_SU_POINT_SIZE">
+		<bitfield name="HEIGHT" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="WIDTH" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2281" name="PA_SU_POINT_MINMAX">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2282" name="PA_SU_LINE_CNTL">
+		<bitfield name="WIDTH" low="0" high="15" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2283" name="PA_SC_LINE_STIPPLE">
+		<bitfield name="LINE_PATTERN" low="0" high="15" type="hex"/>
+		<bitfield name="REPEAT_COUNT" low="16" high="23" type="uint"/>
+		<bitfield name="PATTERN_BIT_ORDER" pos="28" type="a2xx_pa_sc_pattern_bit_order"/>
+		<bitfield name="AUTO_RESET_CNTL" low="29" high="30" type="a2xx_pa_sc_auto_reset_cntl"/>
+	</reg32>
+	<reg32 offset="0x2293" name="PA_SC_VIZ_QUERY">
+		<bitfield name="VIZ_QUERY_ENA" pos="0" type="boolean"/>
+		<bitfield name="VIZ_QUERY_ID" low="1" high="6" type="uint"/>
+		<bitfield name="KILL_PIX_POST_EARLY_Z" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2294" name="VGT_ENHANCE"/>
+	<reg32 offset="0x2300" name="PA_SC_LINE_CNTL">
+		<bitfield name="BRES_CNTL" low="0" high="15" type="uint"/>
+		<bitfield name="USE_BRES_CNTL" pos="8" type="boolean"/>
+		<bitfield name="EXPAND_LINE_WIDTH" pos="9" type="boolean"/>
+		<bitfield name="LAST_PIXEL" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2301" name="PA_SC_AA_CONFIG">
+		<bitfield name="MSAA_NUM_SAMPLES" low="0" high="2" type="uint"/>
+		<bitfield name="MAX_SAMPLE_DIST" low="13" high="16" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2302" name="PA_SU_VTX_CNTL">
+		<bitfield name="PIX_CENTER" pos="0" type="a2xx_pa_pixcenter"/>
+		<bitfield name="ROUND_MODE" low="1" high="2" type="a2xx_pa_roundmode"/>
+		<bitfield name="QUANT_MODE" low="7" high="9" type="a2xx_pa_quantmode"/>
+	</reg32>
+	<reg32 offset="0x2303" name="PA_CL_GB_VERT_CLIP_ADJ" type="float"/>
+	<reg32 offset="0x2304" name="PA_CL_GB_VERT_DISC_ADJ" type="float"/>
+	<reg32 offset="0x2305" name="PA_CL_GB_HORZ_CLIP_ADJ" type="float"/>
+	<reg32 offset="0x2306" name="PA_CL_GB_HORZ_DISC_ADJ" type="float"/>
+	<reg32 offset="0x2307" name="SQ_VS_CONST">
+		<bitfield name="BASE" low="0" high="8" type="uint"/>
+		<bitfield name="SIZE" low="12" high="20" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2308" name="SQ_PS_CONST">
+		<bitfield name="BASE" low="0" high="8" type="uint"/>
+		<bitfield name="SIZE" low="12" high="20" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2309" name="SQ_DEBUG_MISC_0"/>
+	<reg32 offset="0x230a" name="SQ_DEBUG_MISC_1"/>
+	<reg32 offset="0x2312" name="PA_SC_AA_MASK"/>
+	<reg32 offset="0x2316" name="VGT_VERTEX_REUSE_BLOCK_CNTL">
+		<bitfield name="VTX_REUSE_DEPTH" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2317" name="VGT_OUT_DEALLOC_CNTL">
+		<bitfield name="DEALLOC_DIST" low="0" high="1" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2318" name="RB_COPY_CONTROL">
+		<bitfield name="COPY_SAMPLE_SELECT" low="0" high="2" type="a2xx_rb_copy_sample_select"/>
+		<bitfield name="DEPTH_CLEAR_ENABLE" pos="3" type="boolean"/>
+		<bitfield name="CLEAR_MASK" low="4" high="7" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2319" name="RB_COPY_DEST_BASE"/>
+	<reg32 offset="0x231a" name="RB_COPY_DEST_PITCH" shr="5" type="uint"/>
+	<reg32 offset="0x231b" name="RB_COPY_DEST_INFO">
+		<bitfield name="DEST_ENDIAN" low="0" high="2" type="adreno_rb_surface_endian"/>
+		<bitfield name="LINEAR" pos="3" type="boolean"/>
+		<bitfield name="FORMAT" low="4" high="7" type="a2xx_colorformatx"/>
+		<bitfield name="SWAP" low="8" high="9" type="uint"/>
+		<bitfield name="DITHER_MODE" low="10" high="11" type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_TYPE" low="12" high="13" type="a2xx_rb_dither_type"/>
+		<bitfield name="WRITE_RED" pos="14" type="boolean"/>
+		<bitfield name="WRITE_GREEN" pos="15" type="boolean"/>
+		<bitfield name="WRITE_BLUE" pos="16" type="boolean"/>
+		<bitfield name="WRITE_ALPHA" pos="17" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x231c" name="RB_COPY_DEST_OFFSET">
+		<bitfield name="X" low="0" high="12" type="uint"/>
+		<bitfield name="Y" low="13" high="25" type="uint"/>
+	</reg32>
+	<reg32 offset="0x231d" name="RB_DEPTH_CLEAR"/>
+	<reg32 offset="0x2324" name="RB_SAMPLE_COUNT_CTL"/>
+	<reg32 offset="0x2326" name="RB_COLOR_DEST_MASK"/>
+	<reg32 offset="0x2340" name="A225_GRAS_UCP0X"/>
+	<reg32 offset="0x2357" name="A225_GRAS_UCP5W"/>
+	<reg32 offset="0x2360" name="A225_GRAS_UCP_ENABLED"/>
+	<reg32 offset="0x2380" name="PA_SU_POLY_OFFSET_FRONT_SCALE"/>
+	<reg32 offset="0x2381" name="PA_SU_POLY_OFFSET_FRONT_OFFSET"/>
+	<reg32 offset="0x2382" name="PA_SU_POLY_OFFSET_BACK_SCALE"/>
+	<reg32 offset="0x2383" name="PA_SU_POLY_OFFSET_BACK_OFFSET"/>
+	<reg32 offset="0x4000" name="SQ_CONSTANT_0"/>
+	<reg32 offset="0x4800" name="SQ_FETCH_0"/>
+	<reg32 offset="0x4900" name="SQ_CF_BOOLEANS"/>
+	<reg32 offset="0x4908" name="SQ_CF_LOOP"/>
+	<reg32 offset="0xa29" name="COHER_SIZE_PM4"/>
+	<reg32 offset="0xa2a" name="COHER_BASE_PM4"/>
+	<reg32 offset="0xa2b" name="COHER_STATUS_PM4"/>
+
+	<reg32 offset="0x0c88" name="PA_SU_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0c89" name="PA_SU_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0c8a" name="PA_SU_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0c8b" name="PA_SU_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0c8c" name="PA_SU_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0c8d" name="PA_SU_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0c8e" name="PA_SU_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0c8f" name="PA_SU_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0c90" name="PA_SU_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0c91" name="PA_SU_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0c92" name="PA_SU_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0c93" name="PA_SU_PERFCOUNTER3_HI"/>
+	<reg32 offset="0x0c98" name="PA_SC_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0c99" name="PA_SC_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0c9a" name="PA_SC_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0c48" name="VGT_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0c49" name="VGT_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0c4a" name="VGT_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0c4b" name="VGT_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0c4c" name="VGT_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0c4e" name="VGT_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0c50" name="VGT_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0c52" name="VGT_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0c4d" name="VGT_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0c4f" name="VGT_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0c51" name="VGT_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0c53" name="VGT_PERFCOUNTER3_HI"/>
+	<reg32 offset="0x0e05" name="TCR_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0e08" name="TCR_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0e06" name="TCR_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0e09" name="TCR_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0e07" name="TCR_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0e0a" name="TCR_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0e1f" name="TP0_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0e20" name="TP0_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0e21" name="TP0_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0e22" name="TP0_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0e23" name="TP0_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0e24" name="TP0_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0e54" name="TCM_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0e57" name="TCM_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0e55" name="TCM_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0e58" name="TCM_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0e56" name="TCM_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0e59" name="TCM_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0e5a" name="TCF_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0e5d" name="TCF_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0e60" name="TCF_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0e63" name="TCF_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0e66" name="TCF_PERFCOUNTER4_SELECT"/>
+	<reg32 offset="0x0e69" name="TCF_PERFCOUNTER5_SELECT"/>
+	<reg32 offset="0x0e6c" name="TCF_PERFCOUNTER6_SELECT"/>
+	<reg32 offset="0x0e6f" name="TCF_PERFCOUNTER7_SELECT"/>
+	<reg32 offset="0x0e72" name="TCF_PERFCOUNTER8_SELECT"/>
+	<reg32 offset="0x0e75" name="TCF_PERFCOUNTER9_SELECT"/>
+	<reg32 offset="0x0e78" name="TCF_PERFCOUNTER10_SELECT"/>
+	<reg32 offset="0x0e7b" name="TCF_PERFCOUNTER11_SELECT"/>
+	<reg32 offset="0x0e5b" name="TCF_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0e5e" name="TCF_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0e61" name="TCF_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0e64" name="TCF_PERFCOUNTER3_HI"/>
+	<reg32 offset="0x0e67" name="TCF_PERFCOUNTER4_HI"/>
+	<reg32 offset="0x0e6a" name="TCF_PERFCOUNTER5_HI"/>
+	<reg32 offset="0x0e6d" name="TCF_PERFCOUNTER6_HI"/>
+	<reg32 offset="0x0e70" name="TCF_PERFCOUNTER7_HI"/>
+	<reg32 offset="0x0e73" name="TCF_PERFCOUNTER8_HI"/>
+	<reg32 offset="0x0e76" name="TCF_PERFCOUNTER9_HI"/>
+	<reg32 offset="0x0e79" name="TCF_PERFCOUNTER10_HI"/>
+	<reg32 offset="0x0e7c" name="TCF_PERFCOUNTER11_HI"/>
+	<reg32 offset="0x0e5c" name="TCF_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0e5f" name="TCF_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0e62" name="TCF_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0e65" name="TCF_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0e68" name="TCF_PERFCOUNTER4_LOW"/>
+	<reg32 offset="0x0e6b" name="TCF_PERFCOUNTER5_LOW"/>
+	<reg32 offset="0x0e6e" name="TCF_PERFCOUNTER6_LOW"/>
+	<reg32 offset="0x0e71" name="TCF_PERFCOUNTER7_LOW"/>
+	<reg32 offset="0x0e74" name="TCF_PERFCOUNTER8_LOW"/>
+	<reg32 offset="0x0e77" name="TCF_PERFCOUNTER9_LOW"/>
+	<reg32 offset="0x0e7a" name="TCF_PERFCOUNTER10_LOW"/>
+	<reg32 offset="0x0e7d" name="TCF_PERFCOUNTER11_LOW"/>
+	<reg32 offset="0x0dc8" name="SQ_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0dc9" name="SQ_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0dca" name="SQ_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0dcb" name="SQ_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0dcc" name="SQ_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0dcd" name="SQ_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0dce" name="SQ_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0dcf" name="SQ_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0dd0" name="SQ_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0dd1" name="SQ_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0dd2" name="SQ_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0dd3" name="SQ_PERFCOUNTER3_HI"/>
+	<reg32 offset="0x0dd4" name="SX_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0dd8" name="SX_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0dd9" name="SX_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0a46" name="MH_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0a4a" name="MH_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0a47" name="MH_PERFCOUNTER0_CONFIG"/>
+	<reg32 offset="0x0a4b" name="MH_PERFCOUNTER1_CONFIG"/>
+	<reg32 offset="0x0a48" name="MH_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0a4c" name="MH_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0a49" name="MH_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0a4d" name="MH_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0f04" name="RB_PERFCOUNTER0_SELECT"/>
+	<reg32 offset="0x0f05" name="RB_PERFCOUNTER1_SELECT"/>
+	<reg32 offset="0x0f06" name="RB_PERFCOUNTER2_SELECT"/>
+	<reg32 offset="0x0f07" name="RB_PERFCOUNTER3_SELECT"/>
+	<reg32 offset="0x0f08" name="RB_PERFCOUNTER0_LOW"/>
+	<reg32 offset="0x0f09" name="RB_PERFCOUNTER0_HI"/>
+	<reg32 offset="0x0f0a" name="RB_PERFCOUNTER1_LOW"/>
+	<reg32 offset="0x0f0b" name="RB_PERFCOUNTER1_HI"/>
+	<reg32 offset="0x0f0c" name="RB_PERFCOUNTER2_LOW"/>
+	<reg32 offset="0x0f0d" name="RB_PERFCOUNTER2_HI"/>
+	<reg32 offset="0x0f0e" name="RB_PERFCOUNTER3_LOW"/>
+	<reg32 offset="0x0f0f" name="RB_PERFCOUNTER3_HI"/>
+</domain>
+
+<domain name="A2XX_SQ_TEX" width="32">
+	<doc>Texture state dwords</doc>
+	<enum name="sq_tex_clamp">
+		<value name="SQ_TEX_WRAP" value="0"/>
+		<value name="SQ_TEX_MIRROR" value="1"/>
+		<value name="SQ_TEX_CLAMP_LAST_TEXEL" value="2"/>
+		<value name="SQ_TEX_MIRROR_ONCE_LAST_TEXEL" value="3"/>
+		<value name="SQ_TEX_CLAMP_HALF_BORDER" value="4"/>
+		<value name="SQ_TEX_MIRROR_ONCE_HALF_BORDER" value="5"/>
+		<value name="SQ_TEX_CLAMP_BORDER" value="6"/>
+		<value name="SQ_TEX_MIRROR_ONCE_BORDER" value="7"/>
+	</enum>
+	<enum name="sq_tex_swiz">
+		<value name="SQ_TEX_X" value="0"/>
+		<value name="SQ_TEX_Y" value="1"/>
+		<value name="SQ_TEX_Z" value="2"/>
+		<value name="SQ_TEX_W" value="3"/>
+		<value name="SQ_TEX_ZERO" value="4"/>
+		<value name="SQ_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="sq_tex_filter">
+		<value name="SQ_TEX_FILTER_POINT" value="0"/>
+		<value name="SQ_TEX_FILTER_BILINEAR" value="1"/>
+		<value name="SQ_TEX_FILTER_BASEMAP" value="2"/>
+		<value name="SQ_TEX_FILTER_USE_FETCH_CONST" value="3"/>
+	</enum>
+	<enum name="sq_tex_aniso_filter">
+		<value name="SQ_TEX_ANISO_FILTER_DISABLED" value="0"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_1_1" value="1"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_2_1" value="2"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_4_1" value="3"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_8_1" value="4"/>
+		<value name="SQ_TEX_ANISO_FILTER_MAX_16_1" value="5"/>
+		<value name="SQ_TEX_ANISO_FILTER_USE_FETCH_CONST" value="7"/>
+	</enum>
+	<enum name="sq_tex_dimension">
+		<value name="SQ_TEX_DIMENSION_1D" value="0"/>
+		<value name="SQ_TEX_DIMENSION_2D" value="1"/>
+		<value name="SQ_TEX_DIMENSION_3D" value="2"/>
+		<value name="SQ_TEX_DIMENSION_CUBE" value="3"/>
+	</enum>
+	<enum name="sq_tex_border_color">
+		<value name="SQ_TEX_BORDER_COLOR_BLACK" value="0"/>
+		<value name="SQ_TEX_BORDER_COLOR_WHITE" value="1"/>
+		<value name="SQ_TEX_BORDER_COLOR_ACBYCR_BLACK" value="2"/>
+		<value name="SQ_TEX_BORDER_COLOR_ACBCRY_BLACK" value="3"/>
+	</enum>
+	<enum name="sq_tex_sign">
+		<value name="SQ_TEX_SIGN_UNSIGNED" value="0"/>
+		<value name="SQ_TEX_SIGN_SIGNED" value="1"/>
+		<!-- biased: 2*color-1 (range -1,1 when sampling) -->
+		<value name="SQ_TEX_SIGN_UNSIGNED_BIASED" value="2"/>
+		<!-- gamma: sRGB to linear - doesn't seem to work on adreno? -->
+		<value name="SQ_TEX_SIGN_GAMMA" value="3"/>
+	</enum>
+	<enum name="sq_tex_endian">
+		<value name="SQ_TEX_ENDIAN_NONE" value="0"/>
+		<value name="SQ_TEX_ENDIAN_8IN16" value="1"/>
+		<value name="SQ_TEX_ENDIAN_8IN32" value="2"/>
+		<value name="SQ_TEX_ENDIAN_16IN32" value="3"/>
+	</enum>
+	<enum name="sq_tex_clamp_policy">
+		<value name="SQ_TEX_CLAMP_POLICY_D3D" value="0"/>
+		<value name="SQ_TEX_CLAMP_POLICY_OGL" value="1"/>
+	</enum>
+	<enum name="sq_tex_num_format">
+		<value name="SQ_TEX_NUM_FORMAT_FRAC" value="0"/>
+		<value name="SQ_TEX_NUM_FORMAT_INT" value="1"/>
+	</enum>
+	<enum name="sq_tex_type">
+		<value name="SQ_TEX_TYPE_0" value="0"/>
+		<value name="SQ_TEX_TYPE_1" value="1"/>
+		<value name="SQ_TEX_TYPE_2" value="2"/>
+		<value name="SQ_TEX_TYPE_3" value="3"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TYPE" low="0" high="1" type="sq_tex_type"/>
+		<bitfield name="SIGN_X" low="2" high="3" type="sq_tex_sign"/>
+		<bitfield name="SIGN_Y" low="4" high="5" type="sq_tex_sign"/>
+		<bitfield name="SIGN_Z" low="6" high="7" type="sq_tex_sign"/>
+		<bitfield name="SIGN_W" low="8" high="9" type="sq_tex_sign"/>
+		<bitfield name="CLAMP_X" low="10" high="12" type="sq_tex_clamp"/>
+		<bitfield name="CLAMP_Y" low="13" high="15" type="sq_tex_clamp"/>
+		<bitfield name="CLAMP_Z" low="16" high="18" type="sq_tex_clamp"/>
+		<bitfield name="PITCH" low="22" high="30" shr="5" type="uint"/>
+		<bitfield name="TILED" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="FORMAT" low="0" high="5" type="a2xx_sq_surfaceformat"/>
+		<bitfield name="ENDIANNESS" low="6" high="7" type="sq_tex_endian"/>
+		<bitfield name="REQUEST_SIZE" low="8" high="9" type="uint"/>
+		<bitfield name="STACKED" pos="10" type="boolean"/>
+		<bitfield name="CLAMP_POLICY" pos="11" type="sq_tex_clamp_policy"/>
+		<bitfield name="BASE_ADDRESS" low="12" high="31" type="uint" shr="12"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="WIDTH" low="0" high="12" type="uint"/>
+		<bitfield name="HEIGHT" low="13" high="25" type="uint"/>
+		<bitfield name="DEPTH" low="26" high="31" type="uint"/>
+		<!-- 1d/3d have different bit configurations -->
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="NUM_FORMAT" pos="0" type="sq_tex_num_format"/>
+		<bitfield name="SWIZ_X" low="1" high="3" type="sq_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="4" high="6" type="sq_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="7" high="9" type="sq_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="10" high="12" type="sq_tex_swiz"/>
+		<bitfield name="EXP_ADJUST" low="13" high="18" type="int"/>
+		<bitfield name="XY_MAG_FILTER" low="19" high="20" type="sq_tex_filter"/>
+		<bitfield name="XY_MIN_FILTER" low="21" high="22" type="sq_tex_filter"/>
+		<bitfield name="MIP_FILTER" low="23" high="24" type="sq_tex_filter"/>
+		<bitfield name="ANISO_FILTER" low="25" high="27" type="sq_tex_aniso_filter"/>
+		<bitfield name="BORDER_SIZE" pos="31" type="uint"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="VOL_MAG_FILTER" pos="0" type="sq_tex_filter"/>
+		<bitfield name="VOL_MIN_FILTER" pos="1" type="sq_tex_filter"/>
+		<bitfield name="MIP_MIN_LEVEL" low="2" high="5" type="uint"/>
+		<bitfield name="MIP_MAX_LEVEL" low="6" high="9" type="uint"/>
+		<bitfield name="MAX_ANISO_WALK" pos="10" type="boolean"/>
+		<bitfield name="MIN_ANISO_WALK" pos="11" type="boolean"/>
+		<bitfield name="LOD_BIAS" low="12" high="21" type="fixed" radix="5"/>
+		<bitfield name="GRAD_EXP_ADJUST_H" low="22" high="26" type="uint"/>
+		<bitfield name="GRAD_EXP_ADJUST_V" low="27" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="BORDER_COLOR" low="0" high="1" type="sq_tex_border_color"/>
+		<bitfield name="FORCE_BCW_MAX" pos="2" type="boolean"/>
+		<bitfield name="TRI_CLAMP" low="3" high="4" type="uint"/>
+		<bitfield name="ANISO_BIAS" low="5" high="8" type="fixed" radix="0"/> <!-- radix unknown -->
+		<bitfield name="DIMENSION" low="9" high="10" type="sq_tex_dimension"/>
+		<bitfield name="PACKED_MIPS" pos="11" type="boolean"/>
+		<bitfield name="MIP_ADDRESS" low="12" high="31" type="uint" shr="12"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/adreno/a3xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/adreno/a3xx.xml
@@ -0,0 +1,1751 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+<enum name="a3xx_tile_mode">
+	<value name="LINEAR" value="0"/>
+	<value name="TILE_4X4" value="1"/>    <!-- "normal" case for textures -->
+	<value name="TILE_32X32" value="2"/>  <!-- only used in GMEM -->
+	<value name="TILE_4X2" value="3"/>    <!-- only used for CrCb -->
+</enum>
+
+<enum name="a3xx_state_block_id">
+	<value name="HLSQ_BLOCK_ID_TP_TEX" value="2"/>
+	<value name="HLSQ_BLOCK_ID_TP_MIPMAP" value="3"/>
+	<value name="HLSQ_BLOCK_ID_SP_VS" value="4"/>
+	<value name="HLSQ_BLOCK_ID_SP_FS" value="6"/>
+</enum>
+
+<enum name="a3xx_cache_opcode">
+	<value name="INVALIDATE" value="1"/>
+</enum>
+
+<enum name="a3xx_vtx_fmt">
+	<value name="VFMT_32_FLOAT" value="0x0"/>
+	<value name="VFMT_32_32_FLOAT" value="0x1"/>
+	<value name="VFMT_32_32_32_FLOAT" value="0x2"/>
+	<value name="VFMT_32_32_32_32_FLOAT" value="0x3"/>
+
+	<value name="VFMT_16_FLOAT" value="0x4"/>
+	<value name="VFMT_16_16_FLOAT" value="0x5"/>
+	<value name="VFMT_16_16_16_FLOAT" value="0x6"/>
+	<value name="VFMT_16_16_16_16_FLOAT" value="0x7"/>
+
+	<value name="VFMT_32_FIXED" value="0x8"/>
+	<value name="VFMT_32_32_FIXED" value="0x9"/>
+	<value name="VFMT_32_32_32_FIXED" value="0xa"/>
+	<value name="VFMT_32_32_32_32_FIXED" value="0xb"/>
+
+	<value name="VFMT_16_SINT" value="0x10"/>
+	<value name="VFMT_16_16_SINT" value="0x11"/>
+	<value name="VFMT_16_16_16_SINT" value="0x12"/>
+	<value name="VFMT_16_16_16_16_SINT" value="0x13"/>
+	<value name="VFMT_16_UINT" value="0x14"/>
+	<value name="VFMT_16_16_UINT" value="0x15"/>
+	<value name="VFMT_16_16_16_UINT" value="0x16"/>
+	<value name="VFMT_16_16_16_16_UINT" value="0x17"/>
+	<value name="VFMT_16_SNORM" value="0x18"/>
+	<value name="VFMT_16_16_SNORM" value="0x19"/>
+	<value name="VFMT_16_16_16_SNORM" value="0x1a"/>
+	<value name="VFMT_16_16_16_16_SNORM" value="0x1b"/>
+	<value name="VFMT_16_UNORM" value="0x1c"/>
+	<value name="VFMT_16_16_UNORM" value="0x1d"/>
+	<value name="VFMT_16_16_16_UNORM" value="0x1e"/>
+	<value name="VFMT_16_16_16_16_UNORM" value="0x1f"/>
+
+	<!-- seems to be no NORM variants for 32bit.. -->
+	<value name="VFMT_32_UINT" value="0x20"/>
+	<value name="VFMT_32_32_UINT" value="0x21"/>
+	<value name="VFMT_32_32_32_UINT" value="0x22"/>
+	<value name="VFMT_32_32_32_32_UINT" value="0x23"/>
+	<value name="VFMT_32_SINT" value="0x24"/>
+	<value name="VFMT_32_32_SINT" value="0x25"/>
+	<value name="VFMT_32_32_32_SINT" value="0x26"/>
+	<value name="VFMT_32_32_32_32_SINT" value="0x27"/>
+
+	<value name="VFMT_8_UINT" value="0x28"/>
+	<value name="VFMT_8_8_UINT" value="0x29"/>
+	<value name="VFMT_8_8_8_UINT" value="0x2a"/>
+	<value name="VFMT_8_8_8_8_UINT" value="0x2b"/>
+	<value name="VFMT_8_UNORM" value="0x2c"/>
+	<value name="VFMT_8_8_UNORM" value="0x2d"/>
+	<value name="VFMT_8_8_8_UNORM" value="0x2e"/>
+	<value name="VFMT_8_8_8_8_UNORM" value="0x2f"/>
+	<value name="VFMT_8_SINT" value="0x30"/>
+	<value name="VFMT_8_8_SINT" value="0x31"/>
+	<value name="VFMT_8_8_8_SINT" value="0x32"/>
+	<value name="VFMT_8_8_8_8_SINT" value="0x33"/>
+	<value name="VFMT_8_SNORM" value="0x34"/>
+	<value name="VFMT_8_8_SNORM" value="0x35"/>
+	<value name="VFMT_8_8_8_SNORM" value="0x36"/>
+	<value name="VFMT_8_8_8_8_SNORM" value="0x37"/>
+	<value name="VFMT_10_10_10_2_UINT" value="0x38"/>
+	<value name="VFMT_10_10_10_2_UNORM" value="0x39"/>
+	<value name="VFMT_10_10_10_2_SINT" value="0x3a"/>
+	<value name="VFMT_10_10_10_2_SNORM" value="0x3b"/>
+	<value name="VFMT_2_10_10_10_UINT" value="0x3c"/>
+	<value name="VFMT_2_10_10_10_UNORM" value="0x3d"/>
+	<value name="VFMT_2_10_10_10_SINT" value="0x3e"/>
+	<value name="VFMT_2_10_10_10_SNORM" value="0x3f"/>
+
+	<value name="VFMT_NONE" value="0xff"/>
+</enum>
+
+<enum name="a3xx_tex_fmt">
+	<value name="TFMT_5_6_5_UNORM" value="0x4"/>
+	<value name="TFMT_5_5_5_1_UNORM" value="0x5"/>
+	<value name="TFMT_4_4_4_4_UNORM" value="0x7"/>
+	<value name="TFMT_Z16_UNORM" value="0x9"/>
+	<value name="TFMT_X8Z24_UNORM" value="0xa"/>
+	<value name="TFMT_Z32_FLOAT" value="0xb"/>
+
+	<!--
+		The NV12 tiled/linear formats seem to require gang'd sampler
+		slots (ie. sampler state N plus N+1) for Y and UV planes.
+		They fetch yuv in single sam instruction, but still require
+		colorspace conversion in the shader.
+	 -->
+	<value name="TFMT_UV_64X32" value="0x10"/>
+	<value name="TFMT_VU_64X32" value="0x11"/>
+	<value name="TFMT_Y_64X32" value="0x12"/>
+	<value name="TFMT_NV12_64X32" value="0x13"/>
+	<value name="TFMT_UV_LINEAR" value="0x14"/>
+	<value name="TFMT_VU_LINEAR" value="0x15"/>
+	<value name="TFMT_Y_LINEAR" value="0x16"/>
+	<value name="TFMT_NV12_LINEAR" value="0x17"/>
+	<value name="TFMT_I420_Y" value="0x18"/>
+	<value name="TFMT_I420_U" value="0x1a"/>
+	<value name="TFMT_I420_V" value="0x1b"/>
+
+	<value name="TFMT_ATC_RGB" value="0x20"/>
+	<value name="TFMT_ATC_RGBA_EXPLICIT" value="0x21"/>
+	<value name="TFMT_ETC1" value="0x22"/>
+	<value name="TFMT_ATC_RGBA_INTERPOLATED" value="0x23"/>
+
+	<value name="TFMT_DXT1" value="0x24"/>
+	<value name="TFMT_DXT3" value="0x25"/>
+	<value name="TFMT_DXT5" value="0x26"/>
+
+	<value name="TFMT_2_10_10_10_UNORM" value="0x28"/>
+	<value name="TFMT_10_10_10_2_UNORM" value="0x29"/>
+	<value name="TFMT_9_9_9_E5_FLOAT" value="0x2a"/>
+	<value name="TFMT_11_11_10_FLOAT" value="0x2b"/>
+	<value name="TFMT_A8_UNORM" value="0x2c"/>    <!-- GL_ALPHA -->
+	<value name="TFMT_L8_UNORM" value="0x2d"/>
+	<value name="TFMT_L8_A8_UNORM" value="0x2f"/> <!-- GL_LUMINANCE_ALPHA -->
+
+	<!--
+		NOTE: GL_ALPHA and GL_LUMINANCE_ALPHA aren't handled in a similar way
+		to float16, float32.. but they seem to use non-standard swizzle too..
+		perhaps we can ditch that if the pattern follows of 0xn0, 0xn1, 0xn2,
+		0xn3 for 1, 2, 3, 4 components respectively..
+
+		Only formats filled in below are the ones that have been observed by
+		the blob or tested.. you can guess what the missing ones are..
+	 -->
+
+	<value name="TFMT_8_UNORM" value="0x30"/>     <!-- GL_LUMINANCE -->
+	<value name="TFMT_8_8_UNORM" value="0x31"/>
+	<value name="TFMT_8_8_8_UNORM" value="0x32"/>
+	<value name="TFMT_8_8_8_8_UNORM" value="0x33"/>
+
+	<value name="TFMT_8_SNORM" value="0x34"/>
+	<value name="TFMT_8_8_SNORM" value="0x35"/>
+	<value name="TFMT_8_8_8_SNORM" value="0x36"/>
+	<value name="TFMT_8_8_8_8_SNORM" value="0x37"/>
+
+	<value name="TFMT_8_UINT" value="0x38"/>
+	<value name="TFMT_8_8_UINT" value="0x39"/>
+	<value name="TFMT_8_8_8_UINT" value="0x3a"/>
+	<value name="TFMT_8_8_8_8_UINT" value="0x3b"/>
+
+	<value name="TFMT_8_SINT" value="0x3c"/>
+	<value name="TFMT_8_8_SINT" value="0x3d"/>
+	<value name="TFMT_8_8_8_SINT" value="0x3e"/>
+	<value name="TFMT_8_8_8_8_SINT" value="0x3f"/>
+
+	<value name="TFMT_16_FLOAT" value="0x40"/>
+	<value name="TFMT_16_16_FLOAT" value="0x41"/>
+	<!-- TFMT_FLOAT_16_16_16 -->
+	<value name="TFMT_16_16_16_16_FLOAT" value="0x43"/>
+
+	<value name="TFMT_16_UINT" value="0x44"/>
+	<value name="TFMT_16_16_UINT" value="0x45"/>
+	<value name="TFMT_16_16_16_16_UINT" value="0x47"/>
+
+	<value name="TFMT_16_SINT" value="0x48"/>
+	<value name="TFMT_16_16_SINT" value="0x49"/>
+	<value name="TFMT_16_16_16_16_SINT" value="0x4b"/>
+
+	<value name="TFMT_16_UNORM" value="0x4c"/>
+	<value name="TFMT_16_16_UNORM" value="0x4d"/>
+	<value name="TFMT_16_16_16_16_UNORM" value="0x4f"/>
+
+	<value name="TFMT_16_SNORM" value="0x50"/>
+	<value name="TFMT_16_16_SNORM" value="0x51"/>
+	<value name="TFMT_16_16_16_16_SNORM" value="0x53"/>
+
+	<value name="TFMT_32_FLOAT" value="0x54"/>
+	<value name="TFMT_32_32_FLOAT" value="0x55"/>
+	<!-- TFMT_32_32_32_FLOAT -->
+	<value name="TFMT_32_32_32_32_FLOAT" value="0x57"/>
+
+	<value name="TFMT_32_UINT" value="0x58"/>
+	<value name="TFMT_32_32_UINT" value="0x59"/>
+	<value name="TFMT_32_32_32_32_UINT" value="0x5b"/>
+
+	<value name="TFMT_32_SINT" value="0x5c"/>
+	<value name="TFMT_32_32_SINT" value="0x5d"/>
+	<value name="TFMT_32_32_32_32_SINT" value="0x5f"/>
+
+	<value name="TFMT_2_10_10_10_UINT" value="0x60"/>
+	<value name="TFMT_10_10_10_2_UINT" value="0x61"/>
+
+	<value name="TFMT_ETC2_RG11_SNORM" value="0x70"/>
+	<value name="TFMT_ETC2_RG11_UNORM" value="0x71"/>
+	<value name="TFMT_ETC2_R11_SNORM" value="0x72"/>
+	<value name="TFMT_ETC2_R11_UNORM" value="0x73"/>
+	<value name="TFMT_ETC2_RGBA8" value="0x74"/>
+	<value name="TFMT_ETC2_RGB8A1" value="0x75"/>
+	<value name="TFMT_ETC2_RGB8" value="0x76"/>
+
+	<value name="TFMT_NONE" value="0xff"/>
+</enum>
+
+<enum name="a3xx_color_fmt">
+	<value name="RB_R5G6B5_UNORM"       value="0x00"/>
+	<value name="RB_R5G5B5A1_UNORM"     value="0x01"/>
+	<value name="RB_R4G4B4A4_UNORM"     value="0x03"/>
+	<value name="RB_R8G8B8_UNORM"	    value="0x04"/>
+	<value name="RB_R8G8B8A8_UNORM"	    value="0x08"/>
+	<value name="RB_R8G8B8A8_SNORM"	    value="0x09"/>
+	<value name="RB_R8G8B8A8_UINT"	    value="0x0a"/>
+	<value name="RB_R8G8B8A8_SINT"	    value="0x0b"/>
+	<value name="RB_R8G8_UNORM"	    value="0x0c"/>
+	<value name="RB_R8G8_SNORM"	    value="0x0d"/>
+	<value name="RB_R8G8_UINT"	    value="0x0e"/>
+	<value name="RB_R8G8_SINT"	    value="0x0f"/>
+	<value name="RB_R10G10B10A2_UNORM"  value="0x10"/>
+	<value name="RB_A2R10G10B10_UNORM"  value="0x11"/>
+	<value name="RB_R10G10B10A2_UINT"   value="0x12"/>
+	<value name="RB_A2R10G10B10_UINT"   value="0x13"/>
+
+	<value name="RB_A8_UNORM"	    value="0x14"/>
+	<value name="RB_R8_UNORM"	    value="0x15"/>
+
+	<value name="RB_R16_FLOAT"          value="0x18"/>
+	<value name="RB_R16G16_FLOAT"       value="0x19"/>
+	<value name="RB_R16G16B16A16_FLOAT" value="0x1b"/> <!-- GL_HALF_FLOAT_OES -->
+	<value name="RB_R11G11B10_FLOAT"    value="0x1c"/>
+
+	<value name="RB_R16_SNORM"          value="0x20"/>
+	<value name="RB_R16G16_SNORM"       value="0x21"/>
+	<value name="RB_R16G16B16A16_SNORM" value="0x23"/>
+
+	<value name="RB_R16_UNORM"          value="0x24"/>
+	<value name="RB_R16G16_UNORM"       value="0x25"/>
+	<value name="RB_R16G16B16A16_UNORM" value="0x27"/>
+
+	<value name="RB_R16_SINT"	    value="0x28"/>
+	<value name="RB_R16G16_SINT"	    value="0x29"/>
+	<value name="RB_R16G16B16A16_SINT"  value="0x2b"/>
+
+	<value name="RB_R16_UINT"	    value="0x2c"/>
+	<value name="RB_R16G16_UINT"	    value="0x2d"/>
+	<value name="RB_R16G16B16A16_UINT"  value="0x2f"/>
+
+	<value name="RB_R32_FLOAT"          value="0x30"/>
+	<value name="RB_R32G32_FLOAT"       value="0x31"/>
+	<value name="RB_R32G32B32A32_FLOAT" value="0x33"/> <!-- GL_FLOAT -->
+
+	<value name="RB_R32_SINT"	    value="0x34"/>
+	<value name="RB_R32G32_SINT"	    value="0x35"/>
+	<value name="RB_R32G32B32A32_SINT"  value="0x37"/>
+
+	<value name="RB_R32_UINT"	    value="0x38"/>
+	<value name="RB_R32G32_UINT"	    value="0x39"/>
+	<value name="RB_R32G32B32A32_UINT"  value="0x3b"/>
+
+	<value name="RB_NONE"               value="0xff"/>
+</enum>
+
+<enum name="a3xx_cp_perfcounter_select">
+	<value value="0x00" name="CP_ALWAYS_COUNT"/>
+	<value value="0x03" name="CP_AHB_PFPTRANS_WAIT"/>
+	<value value="0x06" name="CP_AHB_NRTTRANS_WAIT"/>
+	<value value="0x08" name="CP_CSF_NRT_READ_WAIT"/>
+	<value value="0x09" name="CP_CSF_I1_FIFO_FULL"/>
+	<value value="0x0a" name="CP_CSF_I2_FIFO_FULL"/>
+	<value value="0x0b" name="CP_CSF_ST_FIFO_FULL"/>
+	<value value="0x0c" name="CP_RESERVED_12"/>
+	<value value="0x0d" name="CP_CSF_RING_ROQ_FULL"/>
+	<value value="0x0e" name="CP_CSF_I1_ROQ_FULL"/>
+	<value value="0x0f" name="CP_CSF_I2_ROQ_FULL"/>
+	<value value="0x10" name="CP_CSF_ST_ROQ_FULL"/>
+	<value value="0x11" name="CP_RESERVED_17"/>
+	<value value="0x12" name="CP_MIU_TAG_MEM_FULL"/>
+	<value value="0x16" name="CP_MIU_NRT_WRITE_STALLED"/>
+	<value value="0x17" name="CP_MIU_NRT_READ_STALLED"/>
+	<value value="0x1a" name="CP_ME_REGS_RB_DONE_FIFO_FULL"/>
+	<value value="0x1b" name="CP_ME_REGS_VS_EVENT_FIFO_FULL"/>
+	<value value="0x1c" name="CP_ME_REGS_PS_EVENT_FIFO_FULL"/>
+	<value value="0x1d" name="CP_ME_REGS_CF_EVENT_FIFO_FULL"/>
+	<value value="0x1e" name="CP_ME_MICRO_RB_STARVED"/>
+	<value value="0x28" name="CP_AHB_RBBM_DWORD_SENT"/>
+	<value value="0x29" name="CP_ME_BUSY_CLOCKS"/>
+	<value value="0x2a" name="CP_ME_WAIT_CONTEXT_AVAIL"/>
+	<value value="0x2b" name="CP_PFP_TYPE0_PACKET"/>
+	<value value="0x2c" name="CP_PFP_TYPE3_PACKET"/>
+	<value value="0x2d" name="CP_CSF_RB_WPTR_NEQ_RPTR"/>
+	<value value="0x2e" name="CP_CSF_I1_SIZE_NEQ_ZERO"/>
+	<value value="0x2f" name="CP_CSF_I2_SIZE_NEQ_ZERO"/>
+	<value value="0x30" name="CP_CSF_RBI1I2_FETCHING"/>
+</enum>
+
+<enum name="a3xx_gras_tse_perfcounter_select">
+	<value value="0x00" name="GRAS_TSEPERF_INPUT_PRIM"/>
+	<value value="0x01" name="GRAS_TSEPERF_INPUT_NULL_PRIM"/>
+	<value value="0x02" name="GRAS_TSEPERF_TRIVAL_REJ_PRIM"/>
+	<value value="0x03" name="GRAS_TSEPERF_CLIPPED_PRIM"/>
+	<value value="0x04" name="GRAS_TSEPERF_NEW_PRIM"/>
+	<value value="0x05" name="GRAS_TSEPERF_ZERO_AREA_PRIM"/>
+	<value value="0x06" name="GRAS_TSEPERF_FACENESS_CULLED_PRIM"/>
+	<value value="0x07" name="GRAS_TSEPERF_ZERO_PIXEL_PRIM"/>
+	<value value="0x08" name="GRAS_TSEPERF_OUTPUT_NULL_PRIM"/>
+	<value value="0x09" name="GRAS_TSEPERF_OUTPUT_VISIBLE_PRIM"/>
+	<value value="0x0a" name="GRAS_TSEPERF_PRE_CLIP_PRIM"/>
+	<value value="0x0b" name="GRAS_TSEPERF_POST_CLIP_PRIM"/>
+	<value value="0x0c" name="GRAS_TSEPERF_WORKING_CYCLES"/>
+	<value value="0x0d" name="GRAS_TSEPERF_PC_STARVE"/>
+	<value value="0x0e" name="GRAS_TSERASPERF_STALL"/>
+</enum>
+
+<enum name="a3xx_gras_ras_perfcounter_select">
+	<value value="0x00" name="GRAS_RASPERF_16X16_TILES"/>
+	<value value="0x01" name="GRAS_RASPERF_8X8_TILES"/>
+	<value value="0x02" name="GRAS_RASPERF_4X4_TILES"/>
+	<value value="0x03" name="GRAS_RASPERF_WORKING_CYCLES"/>
+	<value value="0x04" name="GRAS_RASPERF_STALL_CYCLES_BY_RB"/>
+	<value value="0x05" name="GRAS_RASPERF_STALL_CYCLES_BY_VSC"/>
+	<value value="0x06" name="GRAS_RASPERF_STARVE_CYCLES_BY_TSE"/>
+</enum>
+
+<enum name="a3xx_hlsq_perfcounter_select">
+	<value value="0x00" name="HLSQ_PERF_SP_VS_CONSTANT"/>
+	<value value="0x01" name="HLSQ_PERF_SP_VS_INSTRUCTIONS"/>
+	<value value="0x02" name="HLSQ_PERF_SP_FS_CONSTANT"/>
+	<value value="0x03" name="HLSQ_PERF_SP_FS_INSTRUCTIONS"/>
+	<value value="0x04" name="HLSQ_PERF_TP_STATE"/>
+	<value value="0x05" name="HLSQ_PERF_QUADS"/>
+	<value value="0x06" name="HLSQ_PERF_PIXELS"/>
+	<value value="0x07" name="HLSQ_PERF_VERTICES"/>
+	<value value="0x08" name="HLSQ_PERF_FS8_THREADS"/>
+	<value value="0x09" name="HLSQ_PERF_FS16_THREADS"/>
+	<value value="0x0a" name="HLSQ_PERF_FS32_THREADS"/>
+	<value value="0x0b" name="HLSQ_PERF_VS8_THREADS"/>
+	<value value="0x0c" name="HLSQ_PERF_VS16_THREADS"/>
+	<value value="0x0d" name="HLSQ_PERF_SP_VS_DATA_BYTES"/>
+	<value value="0x0e" name="HLSQ_PERF_SP_FS_DATA_BYTES"/>
+	<value value="0x0f" name="HLSQ_PERF_ACTIVE_CYCLES"/>
+	<value value="0x10" name="HLSQ_PERF_STALL_CYCLES_SP_STATE"/>
+	<value value="0x11" name="HLSQ_PERF_STALL_CYCLES_SP_VS"/>
+	<value value="0x12" name="HLSQ_PERF_STALL_CYCLES_SP_FS"/>
+	<value value="0x13" name="HLSQ_PERF_STALL_CYCLES_UCHE"/>
+	<value value="0x14" name="HLSQ_PERF_RBBM_LOAD_CYCLES"/>
+	<value value="0x15" name="HLSQ_PERF_DI_TO_VS_START_SP0"/>
+	<value value="0x16" name="HLSQ_PERF_DI_TO_FS_START_SP0"/>
+	<value value="0x17" name="HLSQ_PERF_VS_START_TO_DONE_SP0"/>
+	<value value="0x18" name="HLSQ_PERF_FS_START_TO_DONE_SP0"/>
+	<value value="0x19" name="HLSQ_PERF_SP_STATE_COPY_CYCLES_VS"/>
+	<value value="0x1a" name="HLSQ_PERF_SP_STATE_COPY_CYCLES_FS"/>
+	<value value="0x1b" name="HLSQ_PERF_UCHE_LATENCY_CYCLES"/>
+	<value value="0x1c" name="HLSQ_PERF_UCHE_LATENCY_COUNT"/>
+</enum>
+
+<enum name="a3xx_pc_perfcounter_select">
+	<value value="0x00" name="PC_PCPERF_VISIBILITY_STREAMS"/>
+	<value value="0x01" name="PC_PCPERF_TOTAL_INSTANCES"/>
+	<value value="0x02" name="PC_PCPERF_PRIMITIVES_PC_VPC"/>
+	<value value="0x03" name="PC_PCPERF_PRIMITIVES_KILLED_BY_VS"/>
+	<value value="0x04" name="PC_PCPERF_PRIMITIVES_VISIBLE_BY_VS"/>
+	<value value="0x05" name="PC_PCPERF_DRAWCALLS_KILLED_BY_VS"/>
+	<value value="0x06" name="PC_PCPERF_DRAWCALLS_VISIBLE_BY_VS"/>
+	<value value="0x07" name="PC_PCPERF_VERTICES_TO_VFD"/>
+	<value value="0x08" name="PC_PCPERF_REUSED_VERTICES"/>
+	<value value="0x09" name="PC_PCPERF_CYCLES_STALLED_BY_VFD"/>
+	<value value="0x0a" name="PC_PCPERF_CYCLES_STALLED_BY_TSE"/>
+	<value value="0x0b" name="PC_PCPERF_CYCLES_STALLED_BY_VBIF"/>
+	<value value="0x0c" name="PC_PCPERF_CYCLES_IS_WORKING"/>
+</enum>
+
+<enum name="a3xx_rb_perfcounter_select">
+	<value value="0x00" name="RB_RBPERF_ACTIVE_CYCLES_ANY"/>
+	<value value="0x01" name="RB_RBPERF_ACTIVE_CYCLES_ALL"/>
+	<value value="0x02" name="RB_RBPERF_STARVE_CYCLES_BY_SP"/>
+	<value value="0x03" name="RB_RBPERF_STARVE_CYCLES_BY_RAS"/>
+	<value value="0x04" name="RB_RBPERF_STARVE_CYCLES_BY_MARB"/>
+	<value value="0x05" name="RB_RBPERF_STALL_CYCLES_BY_MARB"/>
+	<value value="0x06" name="RB_RBPERF_STALL_CYCLES_BY_HLSQ"/>
+	<value value="0x07" name="RB_RBPERF_RB_MARB_DATA"/>
+	<value value="0x08" name="RB_RBPERF_SP_RB_QUAD"/>
+	<value value="0x09" name="RB_RBPERF_RAS_EARLY_Z_QUADS"/>
+	<value value="0x0a" name="RB_RBPERF_GMEM_CH0_READ"/>
+	<value value="0x0b" name="RB_RBPERF_GMEM_CH1_READ"/>
+	<value value="0x0c" name="RB_RBPERF_GMEM_CH0_WRITE"/>
+	<value value="0x0d" name="RB_RBPERF_GMEM_CH1_WRITE"/>
+	<value value="0x0e" name="RB_RBPERF_CP_CONTEXT_DONE"/>
+	<value value="0x0f" name="RB_RBPERF_CP_CACHE_FLUSH"/>
+	<value value="0x10" name="RB_RBPERF_CP_ZPASS_DONE"/>
+</enum>
+
+<enum name="a3xx_rbbm_perfcounter_select">
+	<value value="0" name="RBBM_ALAWYS_ON"/>
+	<value value="1" name="RBBM_VBIF_BUSY"/>
+	<value value="2" name="RBBM_TSE_BUSY"/>
+	<value value="3" name="RBBM_RAS_BUSY"/>
+	<value value="4" name="RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="RBBM_VFD_BUSY"/>
+	<value value="7" name="RBBM_VPC_BUSY"/>
+	<value value="8" name="RBBM_UCHE_BUSY"/>
+	<value value="9" name="RBBM_VSC_BUSY"/>
+	<value value="10" name="RBBM_HLSQ_BUSY"/>
+	<value value="11" name="RBBM_ANY_RB_BUSY"/>
+	<value value="12" name="RBBM_ANY_TEX_BUSY"/>
+	<value value="13" name="RBBM_ANY_USP_BUSY"/>
+	<value value="14" name="RBBM_ANY_MARB_BUSY"/>
+	<value value="15" name="RBBM_ANY_ARB_BUSY"/>
+	<value value="16" name="RBBM_AHB_STATUS_BUSY"/>
+	<value value="17" name="RBBM_AHB_STATUS_STALLED"/>
+	<value value="18" name="RBBM_AHB_STATUS_TXFR"/>
+	<value value="19" name="RBBM_AHB_STATUS_TXFR_SPLIT"/>
+	<value value="20" name="RBBM_AHB_STATUS_TXFR_ERROR"/>
+	<value value="21" name="RBBM_AHB_STATUS_LONG_STALL"/>
+	<value value="22" name="RBBM_RBBM_STATUS_MASKED"/>
+</enum>
+
+<enum name="a3xx_sp_perfcounter_select">
+	<value value="0x00" name="SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="0x01" name="SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="0x02" name="SP_LM_ATOMICS"/>
+	<value value="0x03" name="SP_UCHE_LOAD_INSTRUCTIONS"/>
+	<value value="0x04" name="SP_UCHE_STORE_INSTRUCTIONS"/>
+	<value value="0x05" name="SP_UCHE_ATOMICS"/>
+	<value value="0x06" name="SP_VS_TEX_INSTRUCTIONS"/>
+	<value value="0x07" name="SP_VS_CFLOW_INSTRUCTIONS"/>
+	<value value="0x08" name="SP_VS_EFU_INSTRUCTIONS"/>
+	<value value="0x09" name="SP_VS_FULL_ALU_INSTRUCTIONS"/>
+	<value value="0x0a" name="SP_VS_HALF_ALU_INSTRUCTIONS"/>
+	<value value="0x0b" name="SP_FS_TEX_INSTRUCTIONS"/>
+	<value value="0x0c" name="SP_FS_CFLOW_INSTRUCTIONS"/>
+	<value value="0x0d" name="SP_FS_EFU_INSTRUCTIONS"/>
+	<value value="0x0e" name="SP_FS_FULL_ALU_INSTRUCTIONS"/>
+	<value value="0x0f" name="SP_FS_HALF_ALU_INSTRUCTIONS"/>
+	<value value="0x10" name="SP_FS_BARY_INSTRUCTIONS"/>
+	<value value="0x11" name="SP_VS_INSTRUCTIONS"/>
+	<value value="0x12" name="SP_FS_INSTRUCTIONS"/>
+	<value value="0x13" name="SP_ADDR_LOCK_COUNT"/>
+	<value value="0x14" name="SP_UCHE_READ_TRANS"/>
+	<value value="0x15" name="SP_UCHE_WRITE_TRANS"/>
+	<value value="0x16" name="SP_EXPORT_VPC_TRANS"/>
+	<value value="0x17" name="SP_EXPORT_RB_TRANS"/>
+	<value value="0x18" name="SP_PIXELS_KILLED"/>
+	<value value="0x19" name="SP_ICL1_REQUESTS"/>
+	<value value="0x1a" name="SP_ICL1_MISSES"/>
+	<value value="0x1b" name="SP_ICL0_REQUESTS"/>
+	<value value="0x1c" name="SP_ICL0_MISSES"/>
+	<value value="0x1d" name="SP_ALU_ACTIVE_CYCLES"/>
+	<value value="0x1e" name="SP_EFU_ACTIVE_CYCLES"/>
+	<value value="0x1f" name="SP_STALL_CYCLES_BY_VPC"/>
+	<value value="0x20" name="SP_STALL_CYCLES_BY_TP"/>
+	<value value="0x21" name="SP_STALL_CYCLES_BY_UCHE"/>
+	<value value="0x22" name="SP_STALL_CYCLES_BY_RB"/>
+	<value value="0x23" name="SP_ACTIVE_CYCLES_ANY"/>
+	<value value="0x24" name="SP_ACTIVE_CYCLES_ALL"/>
+</enum>
+
+<enum name="a3xx_tp_perfcounter_select">
+	<value value="0x00" name="TPL1_TPPERF_L1_REQUESTS"/>
+	<value value="0x01" name="TPL1_TPPERF_TP0_L1_REQUESTS"/>
+	<value value="0x02" name="TPL1_TPPERF_TP0_L1_MISSES"/>
+	<value value="0x03" name="TPL1_TPPERF_TP1_L1_REQUESTS"/>
+	<value value="0x04" name="TPL1_TPPERF_TP1_L1_MISSES"/>
+	<value value="0x05" name="TPL1_TPPERF_TP2_L1_REQUESTS"/>
+	<value value="0x06" name="TPL1_TPPERF_TP2_L1_MISSES"/>
+	<value value="0x07" name="TPL1_TPPERF_TP3_L1_REQUESTS"/>
+	<value value="0x08" name="TPL1_TPPERF_TP3_L1_MISSES"/>
+	<value value="0x09" name="TPL1_TPPERF_OUTPUT_TEXELS_POINT"/>
+	<value value="0x0a" name="TPL1_TPPERF_OUTPUT_TEXELS_BILINEAR"/>
+	<value value="0x0b" name="TPL1_TPPERF_OUTPUT_TEXELS_MIP"/>
+	<value value="0x0c" name="TPL1_TPPERF_OUTPUT_TEXELS_ANISO"/>
+	<value value="0x0d" name="TPL1_TPPERF_BILINEAR_OPS"/>
+	<value value="0x0e" name="TPL1_TPPERF_QUADSQUADS_OFFSET"/>
+	<value value="0x0f" name="TPL1_TPPERF_QUADQUADS_SHADOW"/>
+	<value value="0x10" name="TPL1_TPPERF_QUADS_ARRAY"/>
+	<value value="0x11" name="TPL1_TPPERF_QUADS_PROJECTION"/>
+	<value value="0x12" name="TPL1_TPPERF_QUADS_GRADIENT"/>
+	<value value="0x13" name="TPL1_TPPERF_QUADS_1D2D"/>
+	<value value="0x14" name="TPL1_TPPERF_QUADS_3DCUBE"/>
+	<value value="0x15" name="TPL1_TPPERF_ZERO_LOD"/>
+	<value value="0x16" name="TPL1_TPPERF_OUTPUT_TEXELS"/>
+	<value value="0x17" name="TPL1_TPPERF_ACTIVE_CYCLES_ANY"/>
+	<value value="0x18" name="TPL1_TPPERF_ACTIVE_CYCLES_ALL"/>
+	<value value="0x19" name="TPL1_TPPERF_STALL_CYCLES_BY_ARB"/>
+	<value value="0x1a" name="TPL1_TPPERF_LATENCY"/>
+	<value value="0x1b" name="TPL1_TPPERF_LATENCY_TRANS"/>
+</enum>
+
+<enum name="a3xx_vfd_perfcounter_select">
+	<value value="0" name="VFD_PERF_UCHE_BYTE_FETCHED"/>
+	<value value="1" name="VFD_PERF_UCHE_TRANS"/>
+	<value value="2" name="VFD_PERF_VPC_BYPASS_COMPONENTS"/>
+	<value value="3" name="VFD_PERF_FETCH_INSTRUCTIONS"/>
+	<value value="4" name="VFD_PERF_DECODE_INSTRUCTIONS"/>
+	<value value="5" name="VFD_PERF_ACTIVE_CYCLES"/>
+	<value value="6" name="VFD_PERF_STALL_CYCLES_UCHE"/>
+	<value value="7" name="VFD_PERF_STALL_CYCLES_HLSQ"/>
+	<value value="8" name="VFD_PERF_STALL_CYCLES_VPC_BYPASS"/>
+	<value value="9" name="VFD_PERF_STALL_CYCLES_VPC_ALLOC"/>
+</enum>
+
+<enum name="a3xx_vpc_perfcounter_select">
+	<value value="0" name="VPC_PERF_SP_LM_PRIMITIVES"/>
+	<value value="1" name="VPC_PERF_COMPONENTS_FROM_SP"/>
+	<value value="2" name="VPC_PERF_SP_LM_COMPONENTS"/>
+	<value value="3" name="VPC_PERF_ACTIVE_CYCLES"/>
+	<value value="4" name="VPC_PERF_STALL_CYCLES_LM"/>
+	<value value="5" name="VPC_PERF_STALL_CYCLES_RAS"/>
+</enum>
+
+<enum name="a3xx_uche_perfcounter_select">
+	<value value="0x00" name="UCHE_UCHEPERF_VBIF_READ_BEATS_TP"/>
+	<value value="0x01" name="UCHE_UCHEPERF_VBIF_READ_BEATS_VFD"/>
+	<value value="0x02" name="UCHE_UCHEPERF_VBIF_READ_BEATS_HLSQ"/>
+	<value value="0x03" name="UCHE_UCHEPERF_VBIF_READ_BEATS_MARB"/>
+	<value value="0x04" name="UCHE_UCHEPERF_VBIF_READ_BEATS_SP"/>
+	<value value="0x08" name="UCHE_UCHEPERF_READ_REQUESTS_TP"/>
+	<value value="0x09" name="UCHE_UCHEPERF_READ_REQUESTS_VFD"/>
+	<value value="0x0a" name="UCHE_UCHEPERF_READ_REQUESTS_HLSQ"/>
+	<value value="0x0b" name="UCHE_UCHEPERF_READ_REQUESTS_MARB"/>
+	<value value="0x0c" name="UCHE_UCHEPERF_READ_REQUESTS_SP"/>
+	<value value="0x0d" name="UCHE_UCHEPERF_WRITE_REQUESTS_MARB"/>
+	<value value="0x0e" name="UCHE_UCHEPERF_WRITE_REQUESTS_SP"/>
+	<value value="0x0f" name="UCHE_UCHEPERF_TAG_CHECK_FAILS"/>
+	<value value="0x10" name="UCHE_UCHEPERF_EVICTS"/>
+	<value value="0x11" name="UCHE_UCHEPERF_FLUSHES"/>
+	<value value="0x12" name="UCHE_UCHEPERF_VBIF_LATENCY_CYCLES"/>
+	<value value="0x13" name="UCHE_UCHEPERF_VBIF_LATENCY_SAMPLES"/>
+	<value value="0x14" name="UCHE_UCHEPERF_ACTIVE_CYCLES"/>
+</enum>
+
+<enum name="a3xx_intp_mode">
+	<value name="SMOOTH" value="0"/>
+	<value name="FLAT" value="1"/>
+	<value name="ZERO" value="2"/>
+	<value name="ONE" value="3"/>
+</enum>
+
+<enum name="a3xx_repl_mode">
+	<value name="S" value="1"/>
+	<value name="T" value="2"/>
+	<value name="ONE_T" value="3"/>
+</enum>
+
+<domain name="A3XX" width="32">
+	<!-- RBBM registers -->
+	<reg32 offset="0x0000" name="RBBM_HW_VERSION"/>
+	<reg32 offset="0x0001" name="RBBM_HW_RELEASE"/>
+	<reg32 offset="0x0002" name="RBBM_HW_CONFIGURATION"/>
+	<reg32 offset="0x0010" name="RBBM_CLOCK_CTL"/>
+	<reg32 offset="0x0012" name="RBBM_SP_HYST_CNT"/>
+	<reg32 offset="0x0018" name="RBBM_SW_RESET_CMD"/>
+	<reg32 offset="0x0020" name="RBBM_AHB_CTL0"/>
+	<reg32 offset="0x0021" name="RBBM_AHB_CTL1"/>
+	<reg32 offset="0x0022" name="RBBM_AHB_CMD"/>
+	<reg32 offset="0x0027" name="RBBM_AHB_ERROR_STATUS"/>
+	<reg32 offset="0x002e" name="RBBM_GPR0_CTL"/>
+	<reg32 offset="0x0030" name="RBBM_STATUS">
+		<bitfield name="HI_BUSY" pos="0" type="boolean"/>
+		<bitfield name="CP_ME_BUSY" pos="1" type="boolean"/>
+		<bitfield name="CP_PFP_BUSY" pos="2" type="boolean"/>
+		<bitfield name="CP_NRT_BUSY" pos="14" type="boolean"/>
+		<bitfield name="VBIF_BUSY" pos="15" type="boolean"/>
+		<bitfield name="TSE_BUSY" pos="16" type="boolean"/>
+		<bitfield name="RAS_BUSY" pos="17" type="boolean"/>
+		<bitfield name="RB_BUSY" pos="18" type="boolean"/>
+		<bitfield name="PC_DCALL_BUSY" pos="19" type="boolean"/>
+		<bitfield name="PC_VSD_BUSY" pos="20" type="boolean"/>
+		<bitfield name="VFD_BUSY" pos="21" type="boolean"/>
+		<bitfield name="VPC_BUSY" pos="22" type="boolean"/>
+		<bitfield name="UCHE_BUSY" pos="23" type="boolean"/>
+		<bitfield name="SP_BUSY" pos="24" type="boolean"/>
+		<bitfield name="TPL1_BUSY" pos="25" type="boolean"/>
+		<bitfield name="MARB_BUSY" pos="26" type="boolean"/>
+		<bitfield name="VSC_BUSY" pos="27" type="boolean"/>
+		<bitfield name="ARB_BUSY" pos="28" type="boolean"/>
+		<bitfield name="HLSQ_BUSY" pos="29" type="boolean"/>
+		<bitfield name="GPU_BUSY_NOHC" pos="30" type="boolean"/>
+		<bitfield name="GPU_BUSY" pos="31" type="boolean"/>
+	</reg32>
+	<!-- used in fw CP_WAIT_FOR_IDLE, similar to NQWAIT_UNTIL on a2xx: -->
+	<reg32 offset="0x0040" name="RBBM_NQWAIT_UNTIL"/>
+	<reg32 offset="0x0033" name="RBBM_WAIT_IDLE_CLOCKS_CTL"/>
+	<reg32 offset="0x0050" name="RBBM_INTERFACE_HANG_INT_CTL"/>
+	<reg32 offset="0x0051" name="RBBM_INTERFACE_HANG_MASK_CTL0"/>
+	<reg32 offset="0x0054" name="RBBM_INTERFACE_HANG_MASK_CTL1"/>
+	<reg32 offset="0x0057" name="RBBM_INTERFACE_HANG_MASK_CTL2"/>
+	<reg32 offset="0x005a" name="RBBM_INTERFACE_HANG_MASK_CTL3"/>
+
+	<bitset name="A3XX_INT0">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="RBBM_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="RBBM_REG_TIMEOUT" pos="2" type="boolean"/>
+		<bitfield name="RBBM_ME_MS_TIMEOUT" pos="3" type="boolean"/>
+		<bitfield name="RBBM_PFP_MS_TIMEOUT" pos="4" type="boolean"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="5" type="boolean"/>
+		<bitfield name="VFD_ERROR" pos="6" type="boolean"/>
+		<bitfield name="CP_SW_INT" pos="7" type="boolean"/>
+		<bitfield name="CP_T0_PACKET_IN_IB" pos="8" type="boolean"/>
+		<bitfield name="CP_OPCODE_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_RESERVED_BIT_ERROR" pos="10" type="boolean"/>
+		<bitfield name="CP_HW_FAULT" pos="11" type="boolean"/>
+		<bitfield name="CP_DMA" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2_INT" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1_INT" pos="14" type="boolean"/>
+		<bitfield name="CP_RB_INT" pos="15" type="boolean"/>
+		<bitfield name="CP_REG_PROTECT_FAULT" pos="16" type="boolean"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_VS_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="CP_PS_DONE_TS" pos="19" type="boolean"/>
+		<bitfield name="CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR_HALT" pos="21" type="boolean"/>
+		<bitfield name="MISC_HANG_DETECT" pos="24" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="25" type="boolean"/>
+	</bitset>
+
+
+	<!--
+		set in pm4 fw INVALID_JUMP_TABLE_ENTRY and CP_INTERRUPT (compare
+		to CP_INT_STATUS in a2xx firmware), so this seems to be the a3xx
+		way for fw to raise and irq:
+	 -->
+	<reg32 offset="0x0060" name="RBBM_INT_SET_CMD" type="A3XX_INT0"/>
+	<reg32 offset="0x0061" name="RBBM_INT_CLEAR_CMD" type="A3XX_INT0"/>
+	<reg32 offset="0x0063" name="RBBM_INT_0_MASK" type="A3XX_INT0"/>
+	<reg32 offset="0x0064" name="RBBM_INT_0_STATUS" type="A3XX_INT0"/>
+	<reg32 offset="0x0080" name="RBBM_PERFCTR_CTL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0081" name="RBBM_PERFCTR_LOAD_CMD0"/>
+	<reg32 offset="0x0082" name="RBBM_PERFCTR_LOAD_CMD1"/>
+	<reg32 offset="0x0084" name="RBBM_PERFCTR_LOAD_VALUE_LO"/>
+	<reg32 offset="0x0085" name="RBBM_PERFCTR_LOAD_VALUE_HI"/>
+	<reg32 offset="0x0086" name="RBBM_PERFCOUNTER0_SELECT" type="a3xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0087" name="RBBM_PERFCOUNTER1_SELECT" type="a3xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0088" name="RBBM_GPU_BUSY_MASKED"/>
+	<reg32 offset="0x0090" name="RBBM_PERFCTR_CP_0_LO"/>
+	<reg32 offset="0x0091" name="RBBM_PERFCTR_CP_0_HI"/>
+	<reg32 offset="0x0092" name="RBBM_PERFCTR_RBBM_0_LO"/>
+	<reg32 offset="0x0093" name="RBBM_PERFCTR_RBBM_0_HI"/>
+	<reg32 offset="0x0094" name="RBBM_PERFCTR_RBBM_1_LO"/>
+	<reg32 offset="0x0095" name="RBBM_PERFCTR_RBBM_1_HI"/>
+	<reg32 offset="0x0096" name="RBBM_PERFCTR_PC_0_LO"/>
+	<reg32 offset="0x0097" name="RBBM_PERFCTR_PC_0_HI"/>
+	<reg32 offset="0x0098" name="RBBM_PERFCTR_PC_1_LO"/>
+	<reg32 offset="0x0099" name="RBBM_PERFCTR_PC_1_HI"/>
+	<reg32 offset="0x009a" name="RBBM_PERFCTR_PC_2_LO"/>
+	<reg32 offset="0x009b" name="RBBM_PERFCTR_PC_2_HI"/>
+	<reg32 offset="0x009c" name="RBBM_PERFCTR_PC_3_LO"/>
+	<reg32 offset="0x009d" name="RBBM_PERFCTR_PC_3_HI"/>
+	<reg32 offset="0x009e" name="RBBM_PERFCTR_VFD_0_LO"/>
+	<reg32 offset="0x009f" name="RBBM_PERFCTR_VFD_0_HI"/>
+	<reg32 offset="0x00a0" name="RBBM_PERFCTR_VFD_1_LO"/>
+	<reg32 offset="0x00a1" name="RBBM_PERFCTR_VFD_1_HI"/>
+	<reg32 offset="0x00a2" name="RBBM_PERFCTR_HLSQ_0_LO"/>
+	<reg32 offset="0x00a3" name="RBBM_PERFCTR_HLSQ_0_HI"/>
+	<reg32 offset="0x00a4" name="RBBM_PERFCTR_HLSQ_1_LO"/>
+	<reg32 offset="0x00a5" name="RBBM_PERFCTR_HLSQ_1_HI"/>
+	<reg32 offset="0x00a6" name="RBBM_PERFCTR_HLSQ_2_LO"/>
+	<reg32 offset="0x00a7" name="RBBM_PERFCTR_HLSQ_2_HI"/>
+	<reg32 offset="0x00a8" name="RBBM_PERFCTR_HLSQ_3_LO"/>
+	<reg32 offset="0x00a9" name="RBBM_PERFCTR_HLSQ_3_HI"/>
+	<reg32 offset="0x00aa" name="RBBM_PERFCTR_HLSQ_4_LO"/>
+	<reg32 offset="0x00ab" name="RBBM_PERFCTR_HLSQ_4_HI"/>
+	<reg32 offset="0x00ac" name="RBBM_PERFCTR_HLSQ_5_LO"/>
+	<reg32 offset="0x00ad" name="RBBM_PERFCTR_HLSQ_5_HI"/>
+	<reg32 offset="0x00ae" name="RBBM_PERFCTR_VPC_0_LO"/>
+	<reg32 offset="0x00af" name="RBBM_PERFCTR_VPC_0_HI"/>
+	<reg32 offset="0x00b0" name="RBBM_PERFCTR_VPC_1_LO"/>
+	<reg32 offset="0x00b1" name="RBBM_PERFCTR_VPC_1_HI"/>
+	<reg32 offset="0x00b2" name="RBBM_PERFCTR_TSE_0_LO"/>
+	<reg32 offset="0x00b3" name="RBBM_PERFCTR_TSE_0_HI"/>
+	<reg32 offset="0x00b4" name="RBBM_PERFCTR_TSE_1_LO"/>
+	<reg32 offset="0x00b5" name="RBBM_PERFCTR_TSE_1_HI"/>
+	<reg32 offset="0x00b6" name="RBBM_PERFCTR_RAS_0_LO"/>
+	<reg32 offset="0x00b7" name="RBBM_PERFCTR_RAS_0_HI"/>
+	<reg32 offset="0x00b8" name="RBBM_PERFCTR_RAS_1_LO"/>
+	<reg32 offset="0x00b9" name="RBBM_PERFCTR_RAS_1_HI"/>
+	<reg32 offset="0x00ba" name="RBBM_PERFCTR_UCHE_0_LO"/>
+	<reg32 offset="0x00bb" name="RBBM_PERFCTR_UCHE_0_HI"/>
+	<reg32 offset="0x00bc" name="RBBM_PERFCTR_UCHE_1_LO"/>
+	<reg32 offset="0x00bd" name="RBBM_PERFCTR_UCHE_1_HI"/>
+	<reg32 offset="0x00be" name="RBBM_PERFCTR_UCHE_2_LO"/>
+	<reg32 offset="0x00bf" name="RBBM_PERFCTR_UCHE_2_HI"/>
+	<reg32 offset="0x00c0" name="RBBM_PERFCTR_UCHE_3_LO"/>
+	<reg32 offset="0x00c1" name="RBBM_PERFCTR_UCHE_3_HI"/>
+	<reg32 offset="0x00c2" name="RBBM_PERFCTR_UCHE_4_LO"/>
+	<reg32 offset="0x00c3" name="RBBM_PERFCTR_UCHE_4_HI"/>
+	<reg32 offset="0x00c4" name="RBBM_PERFCTR_UCHE_5_LO"/>
+	<reg32 offset="0x00c5" name="RBBM_PERFCTR_UCHE_5_HI"/>
+	<reg32 offset="0x00c6" name="RBBM_PERFCTR_TP_0_LO"/>
+	<reg32 offset="0x00c7" name="RBBM_PERFCTR_TP_0_HI"/>
+	<reg32 offset="0x00c8" name="RBBM_PERFCTR_TP_1_LO"/>
+	<reg32 offset="0x00c9" name="RBBM_PERFCTR_TP_1_HI"/>
+	<reg32 offset="0x00ca" name="RBBM_PERFCTR_TP_2_LO"/>
+	<reg32 offset="0x00cb" name="RBBM_PERFCTR_TP_2_HI"/>
+	<reg32 offset="0x00cc" name="RBBM_PERFCTR_TP_3_LO"/>
+	<reg32 offset="0x00cd" name="RBBM_PERFCTR_TP_3_HI"/>
+	<reg32 offset="0x00ce" name="RBBM_PERFCTR_TP_4_LO"/>
+	<reg32 offset="0x00cf" name="RBBM_PERFCTR_TP_4_HI"/>
+	<reg32 offset="0x00d0" name="RBBM_PERFCTR_TP_5_LO"/>
+	<reg32 offset="0x00d1" name="RBBM_PERFCTR_TP_5_HI"/>
+	<reg32 offset="0x00d2" name="RBBM_PERFCTR_SP_0_LO"/>
+	<reg32 offset="0x00d3" name="RBBM_PERFCTR_SP_0_HI"/>
+	<reg32 offset="0x00d4" name="RBBM_PERFCTR_SP_1_LO"/>
+	<reg32 offset="0x00d5" name="RBBM_PERFCTR_SP_1_HI"/>
+	<reg32 offset="0x00d6" name="RBBM_PERFCTR_SP_2_LO"/>
+	<reg32 offset="0x00d7" name="RBBM_PERFCTR_SP_2_HI"/>
+	<reg32 offset="0x00d8" name="RBBM_PERFCTR_SP_3_LO"/>
+	<reg32 offset="0x00d9" name="RBBM_PERFCTR_SP_3_HI"/>
+	<reg32 offset="0x00da" name="RBBM_PERFCTR_SP_4_LO"/>
+	<reg32 offset="0x00db" name="RBBM_PERFCTR_SP_4_HI"/>
+	<reg32 offset="0x00dc" name="RBBM_PERFCTR_SP_5_LO"/>
+	<reg32 offset="0x00dd" name="RBBM_PERFCTR_SP_5_HI"/>
+	<reg32 offset="0x00de" name="RBBM_PERFCTR_SP_6_LO"/>
+	<reg32 offset="0x00df" name="RBBM_PERFCTR_SP_6_HI"/>
+	<reg32 offset="0x00e0" name="RBBM_PERFCTR_SP_7_LO"/>
+	<reg32 offset="0x00e1" name="RBBM_PERFCTR_SP_7_HI"/>
+	<reg32 offset="0x00e2" name="RBBM_PERFCTR_RB_0_LO"/>
+	<reg32 offset="0x00e3" name="RBBM_PERFCTR_RB_0_HI"/>
+	<reg32 offset="0x00e4" name="RBBM_PERFCTR_RB_1_LO"/>
+	<reg32 offset="0x00e5" name="RBBM_PERFCTR_RB_1_HI"/>
+	<reg32 offset="0x00ea" name="RBBM_PERFCTR_PWR_0_LO"/>
+	<reg32 offset="0x00eb" name="RBBM_PERFCTR_PWR_0_HI"/>
+	<reg32 offset="0x00ec" name="RBBM_PERFCTR_PWR_1_LO"/>
+	<reg32 offset="0x00ed" name="RBBM_PERFCTR_PWR_1_HI"/>
+	<reg32 offset="0x0100" name="RBBM_RBBM_CTL"/>
+	<reg32 offset="0x0111" name="RBBM_DEBUG_BUS_CTL"/>
+	<reg32 offset="0x0112" name="RBBM_DEBUG_BUS_DATA_STATUS"/>
+
+	<!-- CP registers -->
+	<reg32 offset="0x01c9" name="CP_PFP_UCODE_ADDR"/>
+	<reg32 offset="0x01ca" name="CP_PFP_UCODE_DATA"/>
+	<reg32 offset="0x01cc" name="CP_ROQ_ADDR"/>
+	<reg32 offset="0x01cd" name="CP_ROQ_DATA"/>
+	<reg32 offset="0x01d1" name="CP_MERCIU_ADDR"/>
+	<reg32 offset="0x01d2" name="CP_MERCIU_DATA"/>
+	<reg32 offset="0x01d3" name="CP_MERCIU_DATA2"/>
+	<!-- see a3xx_snapshot_cp_meq().. looks like the way to dump queue between pfp and pm4 -->
+	<reg32 offset="0x01da" name="CP_MEQ_ADDR"/>
+	<reg32 offset="0x01db" name="CP_MEQ_DATA"/>
+	<reg32 offset="0x01f5" name="CP_WFI_PEND_CTR"/>
+	<reg32 offset="0x039d" name="RBBM_PM_OVERRIDE2"/>
+
+	<reg32 offset="0x0445" name="CP_PERFCOUNTER_SELECT" type="a3xx_cp_perfcounter_select"/>
+	<reg32 offset="0x045c" name="CP_HW_FAULT"/>
+	<reg32 offset="0x045e" name="CP_PROTECT_CTRL"/>
+	<reg32 offset="0x045f" name="CP_PROTECT_STATUS"/>
+	<array offset="0x0460" name="CP_PROTECT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x054d" name="CP_AHB_FAULT"/>
+
+	<reg32 offset="0x0d00" name="SQ_GPR_MANAGEMENT"/>
+	<reg32 offset="0x0d02" name="SQ_INST_STORE_MANAGMENT"/>
+	<reg32 offset="0x0e1e" name="TP0_CHICKEN"/>
+
+	<!-- these I guess or either SP or HLSQ since related to shader core setup: -->
+	<reg32 offset="0x0e22" name="SP_GLOBAL_MEM_SIZE" type="uint">
+		<doc>
+			The pair of MEM_SIZE/ADDR registers get programmed
+			in sequence with the size/addr of each buffer.
+		</doc>
+	</reg32>
+	<reg32 offset="0x0e23" name="SP_GLOBAL_MEM_ADDR"/>
+
+	<!-- GRAS registers -->
+	<reg32 offset="0x2040" name="GRAS_CL_CLIP_CNTL">
+		<bitfield name="IJ_PERSP_CENTER" pos="12" type="boolean"/>
+		<bitfield name="IJ_NON_PERSP_CENTER" pos="13" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="14" type="boolean"/>
+		<bitfield name="IJ_NON_PERSP_CENTROID" pos="15" type="boolean"/>
+		<bitfield name="CLIP_DISABLE" pos="16" type="boolean"/>
+		<bitfield name="ZFAR_CLIP_DISABLE" pos="17" type="boolean"/>
+		<bitfield name="VP_CLIP_CODE_IGNORE" pos="19" type="boolean"/>
+		<bitfield name="VP_XFORM_DISABLE" pos="20" type="boolean"/>
+		<bitfield name="PERSP_DIVISION_DISABLE" pos="21" type="boolean"/>
+		<bitfield name="ZERO_GB_SCALE_Z" pos="22" type="boolean">
+			<doc>aka clip_halfz</doc>
+		</bitfield>
+		<!-- set when gl_FragCoord.z is enabled in frag shader: -->
+		<bitfield name="ZCOORD" pos="23" type="boolean"/>
+		<bitfield name="WCOORD" pos="24" type="boolean"/>
+		<!-- set when frag shader writes z (so early z test disabled: -->
+		<bitfield name="ZCLIP_DISABLE" pos="25" type="boolean"/>
+		<bitfield name="NUM_USER_CLIP_PLANES" low="26" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2044" name="GRAS_CL_GB_CLIP_ADJ">
+		<bitfield name="HORZ" low="0" high="9" type="uint"/>
+		<bitfield name="VERT" low="10" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2048" name="GRAS_CL_VPORT_XOFFSET" type="float"/>
+	<reg32 offset="0x2049" name="GRAS_CL_VPORT_XSCALE" type="float"/>
+	<reg32 offset="0x204a" name="GRAS_CL_VPORT_YOFFSET" type="float"/>
+	<reg32 offset="0x204b" name="GRAS_CL_VPORT_YSCALE" type="float"/>
+	<reg32 offset="0x204c" name="GRAS_CL_VPORT_ZOFFSET" type="float"/>
+	<reg32 offset="0x204d" name="GRAS_CL_VPORT_ZSCALE" type="float"/>
+	<reg32 offset="0x2068" name="GRAS_SU_POINT_MINMAX">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2069" name="GRAS_SU_POINT_SIZE" type="fixed" radix="4"/>
+	<reg32 offset="0x206c" name="GRAS_SU_POLY_OFFSET_SCALE">
+		<bitfield name="VAL" low="0" high="23" type="fixed" radix="20"/>
+		<doc>range of -8.0 to 8.0</doc>
+	</reg32>
+	<reg32 offset="0x206d" name="GRAS_SU_POLY_OFFSET_OFFSET" radix="6" type="fixed">
+		<doc>range of -512.0 to 512.0</doc>
+	</reg32>
+	<reg32 offset="0x2070" name="GRAS_SU_MODE_CONTROL">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FRONT_CW" pos="2" type="boolean"/>
+		<bitfield name="LINEHALFWIDTH" low="3" high="10" radix="2" type="fixed"/>
+		<bitfield name="POLY_OFFSET" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2072" name="GRAS_SC_CONTROL">
+		<!-- complete wild-ass-guess for sizes of these bitfields.. -->
+		<bitfield name="RENDER_MODE" low="4" high="7" type="a3xx_render_mode"/>
+		<bitfield name="MSAA_SAMPLES" low="8" high="11" type="a3xx_msaa_samples"/>
+		<bitfield name="RASTER_MODE" low="12" high="15"/>
+	</reg32>
+
+	<reg32 offset="0x2074" name="GRAS_SC_SCREEN_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x2075" name="GRAS_SC_SCREEN_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x2079" name="GRAS_SC_WINDOW_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x207a" name="GRAS_SC_WINDOW_SCISSOR_BR" type="adreno_reg_xy"/>
+
+	<!-- RB registers -->
+	<reg32 offset="0x20c0" name="RB_MODE_CONTROL">
+		<!-- guess on the # of bits here.. -->
+		<bitfield name="GMEM_BYPASS" pos="7" type="boolean"/>
+		<doc>
+			RENDER_MODE is RB_RESOLVE_PASS for gmem->mem, otherwise RB_RENDER_PASS
+		</doc>
+		<bitfield name="RENDER_MODE" low="8" high="10" type="a3xx_render_mode"/>
+		<bitfield name="MRT" low="12" high="13" type="uint">
+			<doc>render targets - 1</doc>
+		</bitfield>
+		<bitfield name="MARB_CACHE_SPLIT_MODE" pos="15" type="boolean"/>
+		<bitfield name="PACKER_TIMER_ENABLE" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x20c1" name="RB_RENDER_CONTROL">
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="YUV_IN_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="COV_VALUE_INPUT_ENABLE" pos="2" type="boolean"/>
+		<!-- set when gl_FrontFacing is accessed in frag shader: -->
+		<bitfield name="FACENESS" pos="3" type="boolean"/>
+		<bitfield name="BIN_WIDTH" low="4" high="11" shr="5" type="uint"/>
+		<bitfield name="DISABLE_COLOR_PIPE" pos="12" type="boolean"/>
+		<!--
+			ENABLE_GMEM not set on mem2gmem..  so possibly it is actually
+			controlling blend or readback from GMEM??
+		 -->
+		<bitfield name="ENABLE_GMEM" pos="13" type="boolean"/>
+		<bitfield name="COORD_MASK" low="14" high="17" type="hex"/>
+		<bitfield name="I_CLAMP_ENABLE" pos="19" type="boolean"/>
+		<bitfield name="COV_VALUE_OUTPUT_ENABLE" pos="20" type="boolean"/>
+		<bitfield name="ALPHA_TEST" pos="22" type="boolean"/>
+		<bitfield name="ALPHA_TEST_FUNC" low="24" high="26" type="adreno_compare_func"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="30" type="boolean"/>
+		<bitfield name="ALPHA_TO_ONE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x20c2" name="RB_MSAA_CONTROL">
+		<bitfield name="DISABLE" pos="10" type="boolean"/>
+		<bitfield name="SAMPLES" low="12" high="15" type="a3xx_msaa_samples"/>
+		<bitfield name="SAMPLE_MASK" low="16" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20c3" name="RB_ALPHA_REF">
+		<bitfield name="UINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<array offset="0x20c4" name="RB_MRT" stride="4" length="4">
+		<reg32 offset="0x0" name="CONTROL">
+			<bitfield name="READ_DEST_ENABLE" pos="3" type="boolean"/>
+			<!-- both these bits seem to get set when enabling GL_BLEND.. -->
+			<bitfield name="BLEND" pos="4" type="boolean"/>
+			<bitfield name="BLEND2" pos="5" type="boolean"/>
+			<bitfield name="ROP_CODE" low="8" high="11" type="a3xx_rop_code"/>
+			<bitfield name="DITHER_MODE" low="12" high="13" type="adreno_rb_dither_mode"/>
+			<bitfield name="COMPONENT_ENABLE" low="24" high="27" type="hex"/>
+		</reg32>
+		<reg32 offset="0x1" name="BUF_INFO">
+			<bitfield name="COLOR_FORMAT" low="0" high="5" type="a3xx_color_fmt"/>
+			<bitfield name="COLOR_TILE_MODE" low="6" high="7" type="a3xx_tile_mode"/>
+			<bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+			<bitfield name="COLOR_SRGB" pos="14" type="boolean"/>
+			<doc>
+				Pitch (actually, appears to be pitch in bytes, so really is a stride)
+				in GMEM, so pitch of the current tile.
+			</doc>
+			<bitfield name="COLOR_BUF_PITCH" low="17" high="31" shr="5" type="uint"/>
+		</reg32>
+		<reg32 offset="0x2" name="BUF_BASE">
+			<doc>offset into GMEM (or system memory address in bypass mode)</doc>
+			<bitfield name="COLOR_BUF_BASE" low="4" high="31" shr="5" type="hex"/>
+		</reg32>
+		<reg32 offset="0x3" name="BLEND_CONTROL">
+			<bitfield name="RGB_SRC_FACTOR" low="0" high="4" type="adreno_rb_blend_factor"/>
+			<bitfield name="RGB_BLEND_OPCODE" low="5" high="7" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="RGB_DEST_FACTOR" low="8" high="12" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_SRC_FACTOR" low="16" high="20" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_BLEND_OPCODE" low="21" high="23" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="ALPHA_DEST_FACTOR" low="24" high="28" type="adreno_rb_blend_factor"/>
+			<bitfield name="CLAMP_ENABLE" pos="29" type="boolean"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0x20e4" name="RB_BLEND_RED">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20e5" name="RB_BLEND_GREEN">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20e6" name="RB_BLEND_BLUE">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20e7" name="RB_BLEND_ALPHA">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+
+	<reg32 offset="0x20e8" name="RB_CLEAR_COLOR_DW0"/>
+	<reg32 offset="0x20e9" name="RB_CLEAR_COLOR_DW1"/>
+	<reg32 offset="0x20ea" name="RB_CLEAR_COLOR_DW2"/>
+	<reg32 offset="0x20eb" name="RB_CLEAR_COLOR_DW3"/>
+	<reg32 offset="0x20ec" name="RB_COPY_CONTROL">
+		<!-- not sure # of bits -->
+		<bitfield name="MSAA_RESOLVE" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="DEPTHCLEAR" pos="3" type="boolean"/>
+		<bitfield name="MODE" low="4" high="6" type="adreno_rb_copy_control_mode"/>
+		<bitfield name="MSAA_SRGB_DOWNSAMPLE" pos="7" type="boolean"/>
+		<bitfield name="FASTCLEAR" low="8" high="11" type="hex"/>
+		<bitfield name="DEPTH32_RESOLVE" pos="12" type="boolean"/> <!-- enabled on a Z32F copy -->
+		<bitfield name="GMEM_BASE" low="14" high="31" shr="14" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20ed" name="RB_COPY_DEST_BASE">
+		<bitfield name="BASE" low="4" high="31" shr="5" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20ee" name="RB_COPY_DEST_PITCH">
+		<doc>actually, appears to be pitch in bytes, so really is a stride</doc>
+		<!-- not actually sure about max pitch... -->
+		<bitfield name="PITCH" low="0" high="31" shr="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0x20ef" name="RB_COPY_DEST_INFO">
+		<bitfield name="TILE" low="0" high="1" type="a3xx_tile_mode"/>
+		<bitfield name="FORMAT" low="2" high="7" type="a3xx_color_fmt"/>
+		<bitfield name="SWAP" low="8" high="9" type="a3xx_color_swap"/>
+		<bitfield name="DITHER_MODE" low="10" high="11" type="adreno_rb_dither_mode"/>
+		<bitfield name="COMPONENT_ENABLE" low="14" high="17" type="hex"/>
+		<bitfield name="ENDIAN" low="18" high="20" type="adreno_rb_surface_endian"/>
+	</reg32>
+	<reg32 offset="0x2100" name="RB_DEPTH_CONTROL">
+		<!--
+			guessing that this matches a2xx with the stencil fields
+			moved out into RB_STENCIL_CONTROL?
+		 -->
+		<bitfield name="FRAG_WRITES_Z" pos="0" type="boolean"/>
+		<bitfield name="Z_TEST_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="EARLY_Z_DISABLE" pos="3" type="boolean"/>
+		<bitfield name="ZFUNC" low="4" high="6" type="adreno_compare_func"/>
+		<bitfield name="Z_CLAMP_ENABLE" pos="7" type="boolean"/>
+		<doc>Z_READ_ENABLE bit is set for zfunc other than GL_ALWAYS or GL_NEVER</doc>
+		<bitfield name="Z_READ_ENABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2101" name="RB_DEPTH_CLEAR">
+		<doc>seems to be always set to 0x00000000</doc>
+	</reg32>
+	<reg32 offset="0x2102" name="RB_DEPTH_INFO">
+		<bitfield name="DEPTH_FORMAT" low="0" high="1" type="adreno_rb_depth_format"/>
+		<doc>
+			DEPTH_BASE is offset in GMEM to depth/stencil buffer, ie
+			bin_w * bin_h / 1024 (possible rounded up to multiple of
+			something??  ie. 39 becomes 40, 78 becomes 80.. 75 becomes
+			80.. so maybe it needs to be multiple of 8??
+		</doc>
+		<bitfield name="DEPTH_BASE" low="11" high="31" shr="12" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2103" name="RB_DEPTH_PITCH" shr="3" type="uint">
+		<doc>
+			Pitch of depth buffer or combined depth+stencil buffer
+			in z24s8 cases.
+		</doc>
+	</reg32>
+	<reg32 offset="0x2104" name="RB_STENCIL_CONTROL">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="STENCIL_ENABLE_BF" pos="1" type="boolean"/>
+		<!--
+			set for stencil operations that require read from stencil
+			buffer, but not for example for stencil clear (which does
+			not require read).. so guessing this is analogous to
+			READ_DEST_ENABLE for color buffer..
+		 -->
+		<bitfield name="STENCIL_READ" pos="2" type="boolean"/>
+		<bitfield name="FUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="FAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="FUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="FAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0x2105" name="RB_STENCIL_CLEAR">
+		<doc>seems to be always set to 0x00000000</doc>
+	</reg32>
+	<reg32 offset="0x2106" name="RB_STENCIL_INFO">
+		<doc>Base address for stencil when not using interleaved depth/stencil</doc>
+		<bitfield name="STENCIL_BASE" low="11" high="31" shr="12" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2107" name="RB_STENCIL_PITCH" shr="3" type="uint">
+		<doc>pitch of stencil buffer when not using interleaved depth/stencil</doc>
+	</reg32>
+	<reg32 offset="0x2108" name="RB_STENCILREFMASK" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x2109" name="RB_STENCILREFMASK_BF" type="adreno_rb_stencilrefmask"/>
+	<!-- VSC == visibility stream c?? -->
+	<reg32 offset="0x210c" name="RB_LRZ_VSC_CONTROL">
+		<doc>seems to be set to 0x00000002 during binning pass</doc>
+		<bitfield name="BINNING_ENABLE" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x210e" name="RB_WINDOW_OFFSET">
+		<doc>X/Y offset of current bin</doc>
+		<bitfield name="X" low="0" high="15" type="uint"/>
+		<bitfield name="Y" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2110" name="RB_SAMPLE_COUNT_CONTROL">
+		<bitfield name="RESET" pos="0" type="boolean"/>
+		<bitfield name="COPY" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2111" name="RB_SAMPLE_COUNT_ADDR"/>
+	<reg32 offset="0x2114" name="RB_Z_CLAMP_MIN"/>
+	<reg32 offset="0x2115" name="RB_Z_CLAMP_MAX"/>
+
+	<!-- PC registers -->
+	<reg32 offset="0x21e1" name="VGT_BIN_BASE">
+		<doc>
+			seems to be where firmware writes BIN_DATA_ADDR from
+			CP_SET_BIN_DATA packet..  probably should be called
+			PC_BIN_BASE (just using name from yamato for now)
+		</doc>
+	</reg32>
+	<reg32 offset="0x21e2" name="VGT_BIN_SIZE">
+		<doc>probably should be PC_BIN_SIZE</doc>
+	</reg32>
+	<reg32 offset="0x21e4" name="PC_VSTREAM_CONTROL">
+		<doc>SIZE is current pipe width * height (in tiles)</doc>
+		<bitfield name="SIZE" low="16" high="21" type="uint"/>
+		<doc>
+			N is some sort of slot # between 0..(SIZE-1).  In case
+			multiple tiles use same pipe, each tile gets unique slot #
+		</doc>
+		<bitfield name="N" low="22" high="26" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21ea" name="PC_VERTEX_REUSE_BLOCK_CNTL"/>
+	<reg32 offset="0x21ec" name="PC_PRIM_VTX_CNTL">
+		<doc>
+			STRIDE_IN_VPC: ALIGN(next_outloc - 8, 4) / 4
+			(but, in cases where you'd expect 1, the blob driver uses
+			2, so possibly 0 (no varying) or minimum of 2)
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="4" type="uint"/>
+		<bitfield name="POLYMODE_FRONT_PTYPE" low="5" high="7" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_BACK_PTYPE" low="8" high="10" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_ENABLE" pos="12" type="boolean"/>
+		<bitfield name="PRIMITIVE_RESTART" pos="20" type="boolean"/>
+		<bitfield name="PROVOKING_VTX_LAST" pos="25" type="boolean"/>
+		<!-- PSIZE bit set if gl_PointSize written: -->
+		<bitfield name="PSIZE" pos="26" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x21ed" name="PC_RESTART_INDEX"/>
+
+	<!-- HLSQ registers -->
+	<bitset name="a3xx_hlsq_vs_fs_control_reg" inline="yes">
+		<bitfield name="CONSTLENGTH" low="0" high="9" type="uint"/>
+		<bitfield name="CONSTSTARTOFFSET" low="12" high="20" type="uint"/>
+		<bitfield name="INSTRLENGTH" low="24" high="31" type="uint"/>
+	</bitset>
+	<bitset name="a3xx_hlsq_const_vs_fs_presv_range_reg" inline="yes">
+		<!-- are these a3xx_regid?? -->
+		<bitfield name="STARTENTRY" low="0" high="8"/>
+		<bitfield name="ENDENTRY" low="16" high="24"/>
+	</bitset>
+
+	<reg32 offset="0x2200" name="HLSQ_CONTROL_0_REG">
+		<bitfield name="FSTHREADSIZE" low="4" high="5" type="a3xx_threadsize"/>
+		<bitfield name="FSSUPERTHREADENABLE" pos="6" type="boolean"/>
+		<bitfield name="COMPUTEMODE" pos="8" type="boolean"/>
+		<bitfield name="SPSHADERRESTART" pos="9" type="boolean"/>
+		<bitfield name="RESERVED2" pos="10" type="boolean"/>
+		<bitfield name="CYCLETIMEOUTLIMITVPC" low="12" high="23" type="uint"/>
+		<bitfield name="FSONLYTEX" pos="25" type="boolean"/>
+		<bitfield name="CHUNKDISABLE" pos="26" type="boolean"/>
+		<bitfield name="CONSTMODE" pos="27" type="uint"/>
+		<bitfield name="LAZYUPDATEDISABLE" pos="28" type="boolean"/>
+		<bitfield name="SPCONSTFULLUPDATE" pos="29" type="boolean"/>
+		<bitfield name="TPFULLUPDATE" pos="30" type="boolean"/>
+		<bitfield name="SINGLECONTEXT" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2201" name="HLSQ_CONTROL_1_REG">
+		<bitfield name="VSTHREADSIZE" low="6" high="7" type="a3xx_threadsize"/>
+		<bitfield name="VSSUPERTHREADENABLE" pos="8" type="boolean"/>
+		<bitfield name="FRAGCOORDXYREGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="FRAGCOORDZWREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2202" name="HLSQ_CONTROL_2_REG">
+		<bitfield name="FACENESSREGID" low="2" high="9" type="a3xx_regid"/>
+		<bitfield name="COVVALUEREGID" low="18" high="25" type="a3xx_regid"/>
+		<bitfield name="PRIMALLOCTHRESHOLD" low="26" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2203" name="HLSQ_CONTROL_3_REG">
+		<bitfield name="IJPERSPCENTERREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJNONPERSPCENTERREGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="IJPERSPCENTROIDREGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="IJNONPERSPCENTROIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2204" name="HLSQ_VS_CONTROL_REG" type="a3xx_hlsq_vs_fs_control_reg"/>
+	<reg32 offset="0x2205" name="HLSQ_FS_CONTROL_REG" type="a3xx_hlsq_vs_fs_control_reg"/>
+	<reg32 offset="0x2206" name="HLSQ_CONST_VSPRESV_RANGE_REG" type="a3xx_hlsq_const_vs_fs_presv_range_reg"/>
+	<reg32 offset="0x2207" name="HLSQ_CONST_FSPRESV_RANGE_REG" type="a3xx_hlsq_const_vs_fs_presv_range_reg"/>
+	<reg32 offset="0x220a" name="HLSQ_CL_NDRANGE_0_REG">
+		<bitfield name="WORKDIM" low="0" high="1" type="uint"/>
+		<bitfield name="LOCALSIZE0" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZE1" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZE2" low="22" high="31" type="uint"/>
+	</reg32>
+	<array offset="0x220b" name="HLSQ_CL_GLOBAL_WORK" stride="2" length="3">
+		<doc>indexed by dimension</doc>
+		<reg32 offset="0" name="SIZE" type="uint"/>
+		<reg32 offset="1" name="OFFSET" type="uint"/>
+	</array>
+	<reg32 offset="0x2211" name="HLSQ_CL_CONTROL_0_REG"/>
+	<reg32 offset="0x2212" name="HLSQ_CL_CONTROL_1_REG"/>
+	<reg32 offset="0x2214" name="HLSQ_CL_KERNEL_CONST_REG"/>
+	<array offset="0x2215" name="HLSQ_CL_KERNEL_GROUP" stride="1" length="3">
+		<doc>indexed by dimension, global_size / local_size</doc>
+		<reg32 offset="0" name="RATIO" type="uint"/>
+	</array>
+	<reg32 offset="0x2216" name="HLSQ_CL_KERNEL_GROUP_Y_REG" type="uint"/>
+	<reg32 offset="0x2217" name="HLSQ_CL_KERNEL_GROUP_Z_REG" type="uint"/>
+	<reg32 offset="0x221a" name="HLSQ_CL_WG_OFFSET_REG"/>
+
+	<!-- VFD registers -->
+	<reg32 offset="0x2240" name="VFD_CONTROL_0">
+		<doc>
+			TOTALATTRTOVS is # of attributes to vertex shader, in register
+			slots (ie. vec4+vec3 -> 7)
+		</doc>
+		<bitfield name="TOTALATTRTOVS" low="0" high="17" type="uint"/>
+		<bitfield name="PACKETSIZE" low="18" high="21" type="uint"/>
+		<doc>STRMDECINSTRCNT is # of VFD_DECODE_INSTR registers valid</doc>
+		<bitfield name="STRMDECINSTRCNT" low="22" high="26" type="uint"/>
+		<doc>STRMFETCHINSTRCNT is # of VFD_FETCH_INSTR registers valid</doc>
+		<bitfield name="STRMFETCHINSTRCNT" low="27" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2241" name="VFD_CONTROL_1">
+		<doc>MAXSTORAGE could be # of attributes/vbo's</doc>
+		<bitfield name="MAXSTORAGE" low="0" high="3" type="uint"/>
+		<bitfield name="MAXTHRESHOLD" low="4" high="7" type="uint"/>
+		<bitfield name="MINTHRESHOLD" low="8" high="11" type="uint"/>
+		<bitfield name="REGID4VTX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID4INST" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2242" name="VFD_INDEX_MIN" type="uint"/>
+	<reg32 offset="0x2243" name="VFD_INDEX_MAX" type="uint"/>
+	<reg32 offset="0x2244" name="VFD_INSTANCEID_OFFSET" type="uint"/>
+	<reg32 offset="0x2245" name="VFD_INDEX_OFFSET" type="uint"/>
+	<array offset="0x2246" name="VFD_FETCH" stride="2" length="16">
+		<reg32 offset="0x0" name="INSTR_0">
+			<bitfield name="FETCHSIZE" low="0" high="6" type="uint"/>
+			<bitfield name="BUFSTRIDE" low="7" high="15" type="uint"/>
+			<bitfield name="INSTANCED" pos="16" type="boolean"/>
+			<bitfield name="SWITCHNEXT" pos="17" type="boolean"/>
+			<bitfield name="INDEXCODE" low="18" high="23" type="uint"/>
+			<bitfield name="STEPRATE" low="24" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x1" name="INSTR_1"/>
+	</array>
+	<array offset="0x2266" name="VFD_DECODE" stride="1" length="16">
+		<reg32 offset="0x0" name="INSTR">
+			<bitfield name="WRITEMASK" low="0" high="3" type="hex"/>
+			<!-- not sure if this is a bit flag and another flag above it, or?? -->
+			<bitfield name="CONSTFILL" pos="4" type="boolean"/>
+			<bitfield name="FORMAT" low="6" high="11" type="a3xx_vtx_fmt"/>
+			<bitfield name="REGID" low="12" high="19" type="a3xx_regid"/>
+			<bitfield name="INT" pos="20" type="boolean"/>
+			<doc>SHIFTCNT appears to be size, ie. FLOAT_32_32_32 is 12, and BYTE_8 is 1</doc>
+			<bitfield name="SWAP" low="22" high="23" type="a3xx_color_swap"/>
+			<bitfield name="SHIFTCNT" low="24" high="28" type="uint"/>
+			<bitfield name="LASTCOMPVALID" pos="29" type="boolean"/>
+			<bitfield name="SWITCHNEXT" pos="30" type="boolean"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x227e" name="VFD_VS_THREADING_THRESHOLD">
+		<bitfield name="REGID_THRESHOLD" low="0" high="3" type="uint"/>
+		<!-- <bitfield name="RESERVED6" low="4" high="7" type="uint"/> -->
+		<bitfield name="REGID_VTXCNT" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+
+	<!-- VPC registers -->
+	<reg32 offset="0x2280" name="VPC_ATTR">
+		<bitfield name="TOTALATTR" low="0" high="8" type="uint"/>
+		<!-- PSIZE bit set if gl_PointSize written: -->
+		<bitfield name="PSIZE" pos="9" type="boolean"/>
+		<bitfield name="THRDASSIGN" low="12" high="27" type="uint"/>
+		<bitfield name="LMSIZE" low="28" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2281" name="VPC_PACK">
+		<!-- these are always seem to be set to same as TOTALATTR -->
+		<bitfield name="NUMFPNONPOSVAR" low="8" high="15" type="uint"/>
+		<bitfield name="NUMNONPOSVSVAR" low="16" high="23" type="uint"/>
+	</reg32>
+	<!--
+		varying interpolate mode.  One field per scalar/component
+		(since varying slots are scalar, so things don't have to
+		be aligned to vec4).
+		4 regs * 16 scalar components each => 16 vec4
+	 -->
+	<array offset="0x2282" name="VPC_VARYING_INTERP" stride="1" length="4">
+		<reg32 offset="0x0" name="MODE">
+			<bitfield name="C0" low="0"  high="1"  type="a3xx_intp_mode"/>
+			<bitfield name="C1" low="2"  high="3"  type="a3xx_intp_mode"/>
+			<bitfield name="C2" low="4"  high="5"  type="a3xx_intp_mode"/>
+			<bitfield name="C3" low="6"  high="7"  type="a3xx_intp_mode"/>
+			<bitfield name="C4" low="8"  high="9"  type="a3xx_intp_mode"/>
+			<bitfield name="C5" low="10" high="11" type="a3xx_intp_mode"/>
+			<bitfield name="C6" low="12" high="13" type="a3xx_intp_mode"/>
+			<bitfield name="C7" low="14" high="15" type="a3xx_intp_mode"/>
+			<bitfield name="C8" low="16" high="17" type="a3xx_intp_mode"/>
+			<bitfield name="C9" low="18" high="19" type="a3xx_intp_mode"/>
+			<bitfield name="CA" low="20" high="21" type="a3xx_intp_mode"/>
+			<bitfield name="CB" low="22" high="23" type="a3xx_intp_mode"/>
+			<bitfield name="CC" low="24" high="25" type="a3xx_intp_mode"/>
+			<bitfield name="CD" low="26" high="27" type="a3xx_intp_mode"/>
+			<bitfield name="CE" low="28" high="29" type="a3xx_intp_mode"/>
+			<bitfield name="CF" low="30" high="31" type="a3xx_intp_mode"/>
+		</reg32>
+	</array>
+	<array offset="0x2286" name="VPC_VARYING_PS_REPL" stride="1" length="4">
+		<reg32 offset="0x0" name="MODE">
+			<bitfield name="C0" low="0"  high="1"  type="a3xx_repl_mode"/>
+			<bitfield name="C1" low="2"  high="3"  type="a3xx_repl_mode"/>
+			<bitfield name="C2" low="4"  high="5"  type="a3xx_repl_mode"/>
+			<bitfield name="C3" low="6"  high="7"  type="a3xx_repl_mode"/>
+			<bitfield name="C4" low="8"  high="9"  type="a3xx_repl_mode"/>
+			<bitfield name="C5" low="10" high="11" type="a3xx_repl_mode"/>
+			<bitfield name="C6" low="12" high="13" type="a3xx_repl_mode"/>
+			<bitfield name="C7" low="14" high="15" type="a3xx_repl_mode"/>
+			<bitfield name="C8" low="16" high="17" type="a3xx_repl_mode"/>
+			<bitfield name="C9" low="18" high="19" type="a3xx_repl_mode"/>
+			<bitfield name="CA" low="20" high="21" type="a3xx_repl_mode"/>
+			<bitfield name="CB" low="22" high="23" type="a3xx_repl_mode"/>
+			<bitfield name="CC" low="24" high="25" type="a3xx_repl_mode"/>
+			<bitfield name="CD" low="26" high="27" type="a3xx_repl_mode"/>
+			<bitfield name="CE" low="28" high="29" type="a3xx_repl_mode"/>
+			<bitfield name="CF" low="30" high="31" type="a3xx_repl_mode"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x228a" name="VPC_VARY_CYLWRAP_ENABLE_0"/>
+	<reg32 offset="0x228b" name="VPC_VARY_CYLWRAP_ENABLE_1"/>
+
+	<!-- SP registers -->
+	<bitset name="a3xx_vs_fs_length_reg" inline="yes">
+		<bitfield name="SHADERLENGTH" low="0" high="31" type="uint"/>
+	</bitset>
+
+	<bitset name="sp_vs_fs_obj_offset_reg" inline="yes">
+		<bitfield name="FIRSTEXECINSTROFFSET" low="0" high="15" type="uint"/>
+		<doc>
+			From register spec:
+			SP_FS_OBJ_OFFSET_REG.CONSTOBJECTSTARTOFFSET [16:24]: Constant object
+			start offset in on chip RAM,
+			128bit aligned
+		</doc>
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x22c0" name="SP_SP_CTRL_REG">
+		<!-- this bit is set during resolve pass: -->
+		<bitfield name="RESOLVE" pos="16" type="boolean"/>
+		<bitfield name="CONSTMODE" pos="18" type="uint"/>
+		<bitfield name="BINNING" pos="19" type="boolean"/>
+		<bitfield name="SLEEPMODE" low="20" high="21" type="uint"/>
+		<!-- L0MODE==1 when oxiliForceSpL0ModeBuffer=1 -->
+		<bitfield name="L0MODE" low="22" high="23" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22c4" name="SP_VS_CTRL_REG0">
+		<bitfield name="THREADMODE" pos="0" type="a3xx_threadmode"/>
+		<bitfield name="INSTRBUFFERMODE" pos="1" type="a3xx_instrbuffermode"/>
+		<!-- maybe CACHEINVALID is two bits?? -->
+		<bitfield name="CACHEINVALID" pos="2" type="boolean"/>
+		<bitfield name="ALUSCHMODE" pos="3" type="boolean"/>
+		<doc>
+			The full/half register footprint is in units of four components,
+			so if r0.x is used, that counts as all of r0.[xyzw] as used.
+			There are separate full/half register footprint values as the
+			full and half registers are independent (not overlapping).
+			Presumably the thread scheduler hardware allocates the full/half
+			register names from the actual physical register file and
+			handles the register renaming.
+		</doc>
+		<bitfield name="HALFREGFOOTPRINT" low="4" high="9" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="10" high="15" type="uint"/>
+		<bitfield name="THREADSIZE" pos="20" type="a3xx_threadsize"/>
+		<bitfield name="SUPERTHREADMODE" pos="21" type="boolean"/>
+		<doc>
+			From regspec:
+			SP_FS_CTRL_REG0.FS_LENGTH [31:24]: FS length, unit = 256bits.
+			If bit31 is 1, it means overflow
+			or any long shader.
+		</doc>
+		<bitfield name="LENGTH" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22c5" name="SP_VS_CTRL_REG1">
+		<bitfield name="CONSTLENGTH" low="0" high="9" type="uint"/>
+		<!--
+			not sure about full vs half const.. I can't get blob generate
+			something with a mediump/lowp uniform.
+		 -->
+		<bitfield name="CONSTFOOTPRINT" low="10" high="19" type="uint"/>
+		<bitfield name="INITIALOUTSTANDING" low="24" high="30" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22c6" name="SP_VS_PARAM_REG">
+		<bitfield name="POSREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="PSIZEREGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="POS2DMODE" pos="16" type="boolean"/>
+		<bitfield name="TOTALVSOUTVAR" low="20" high="24" type="uint"/>
+	</reg32>
+	<array offset="0x22c7" name="SP_VS_OUT" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_HALF" pos="8" type="boolean"/>
+			<bitfield name="A_COMPMASK" low="9" high="12" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_HALF" pos="24" type="boolean"/>
+			<bitfield name="B_COMPMASK" low="25" high="28" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0x22d0" name="SP_VS_VPC_DST" stride="1" length="4">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				These seem to be offsets for storage of the varyings.
+				Always seems to start from 8, possibly loc 0 and 4
+				are for gl_Position and gl_PointSize?
+			</doc>
+			<bitfield name="OUTLOC0" low="0" high="6" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="14" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="22" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="30" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x22d4" name="SP_VS_OBJ_OFFSET_REG" type="sp_vs_fs_obj_offset_reg"/>
+	<doc>
+		SP_VS_OBJ_START_REG contains pointer to the vertex shader program,
+		immediately followed by the binning shader program (although I
+		guess that is probably just re-using the same gpu buffer)
+	</doc>
+	<reg32 offset="0x22d5" name="SP_VS_OBJ_START_REG"/>
+	<reg32 offset="0x22d6" name="SP_VS_PVT_MEM_PARAM_REG">
+		<bitfield name="MEMSIZEPERITEM" low="0" high="7" shr="7">
+			<doc>The size of memory that ldp/stp can address, in 128 byte increments.</doc>
+		</bitfield>
+		<bitfield name="HWSTACKOFFSET" low="8" high="23" type="uint"/>
+		<bitfield name="HWSTACKSIZEPERTHREAD" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22d7" name="SP_VS_PVT_MEM_ADDR_REG">
+		<bitfield name="BURSTLEN" low="0" high="4"/>
+		<bitfield name="SHADERSTARTADDRESS" shr="5" low="5" high="31"/>
+	</reg32>
+	<reg32 offset="0x22d8" name="SP_VS_PVT_MEM_SIZE_REG"/>
+	<reg32 offset="0x22df" name="SP_VS_LENGTH_REG" type="a3xx_vs_fs_length_reg"/>
+	<reg32 offset="0x22e0" name="SP_FS_CTRL_REG0">
+		<bitfield name="THREADMODE" pos="0" type="a3xx_threadmode"/>
+		<bitfield name="INSTRBUFFERMODE" pos="1" type="a3xx_instrbuffermode"/>
+		<!-- maybe CACHEINVALID is two bits?? -->
+		<bitfield name="CACHEINVALID" pos="2" type="boolean"/>
+		<bitfield name="ALUSCHMODE" pos="3" type="boolean"/>
+		<doc>
+			The full/half register footprint is in units of four components,
+			so if r0.x is used, that counts as all of r0.[xyzw] as used.
+			There are separate full/half register footprint values as the
+			full and half registers are independent (not overlapping).
+			Presumably the thread scheduler hardware allocates the full/half
+			register names from the actual physical register file and
+			handles the register renaming.
+		</doc>
+		<bitfield name="HALFREGFOOTPRINT" low="4" high="9" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="10" high="15" type="uint"/>
+		<bitfield name="FSBYPASSENABLE" pos="17" type="boolean"/>
+		<bitfield name="INOUTREGOVERLAP" pos="18" type="boolean"/>
+		<bitfield name="OUTORDERED" pos="19" type="boolean"/>
+		<bitfield name="THREADSIZE" pos="20" type="a3xx_threadsize"/>
+		<bitfield name="SUPERTHREADMODE" pos="21" type="boolean"/>
+		<bitfield name="PIXLODENABLE" pos="22" type="boolean"/>
+		<bitfield name="COMPUTEMODE" pos="23" type="boolean"/>
+		<doc>
+			From regspec:
+			SP_FS_CTRL_REG0.FS_LENGTH [31:24]: FS length, unit = 256bits.
+			If bit31 is 1, it means overflow
+			or any long shader.
+		</doc>
+		<bitfield name="LENGTH" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22e1" name="SP_FS_CTRL_REG1">
+		<bitfield name="CONSTLENGTH" low="0" high="9" type="uint"/>
+		<bitfield name="CONSTFOOTPRINT" low="10" high="19" type="uint"/>
+		<bitfield name="INITIALOUTSTANDING" low="20" high="23" type="uint"/>
+		<bitfield name="HALFPRECVAROFFSET" low="24" high="30" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22e2" name="SP_FS_OBJ_OFFSET_REG" type="sp_vs_fs_obj_offset_reg"/>
+	<doc>SP_FS_OBJ_START_REG contains pointer to fragment shader program</doc>
+	<reg32 offset="0x22e3" name="SP_FS_OBJ_START_REG"/>
+	<reg32 offset="0x22e4" name="SP_FS_PVT_MEM_PARAM_REG">
+		<bitfield name="MEMSIZEPERITEM" low="0" high="7" type="uint"/>
+		<bitfield name="HWSTACKOFFSET" low="8" high="23" type="uint"/>
+		<bitfield name="HWSTACKSIZEPERTHREAD" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22e5" name="SP_FS_PVT_MEM_ADDR_REG">
+		<bitfield name="BURSTLEN" low="0" high="4"/>
+		<bitfield name="SHADERSTARTADDRESS" shr="5" low="5" high="31"/>
+	</reg32>
+	<reg32 offset="0x22e6" name="SP_FS_PVT_MEM_SIZE_REG"/>
+	<reg32 offset="0x22e8" name="SP_FS_FLAT_SHAD_MODE_REG_0">
+		<doc>seems to be one bit per scalar, '1' for flat, '0' for smooth</doc>
+	</reg32>
+	<reg32 offset="0x22e9" name="SP_FS_FLAT_SHAD_MODE_REG_1">
+		<doc>seems to be one bit per scalar, '1' for flat, '0' for smooth</doc>
+	</reg32>
+	<reg32 offset="0x22ec" name="SP_FS_OUTPUT_REG">
+		<bitfield name="MRT" low="0" high="1" type="uint">
+			<doc>render targets - 1</doc>
+		</bitfield>
+		<bitfield name="DEPTH_ENABLE" pos="7" type="boolean"/>
+		<bitfield name="DEPTH_REGID" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+	<array offset="0x22f0" name="SP_FS_MRT" stride="1" length="4">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="HALF_PRECISION" pos="8" type="boolean"/>
+			<bitfield name="SINT" pos="10" type="boolean"/>
+			<bitfield name="UINT" pos="11" type="boolean"/>
+		</reg32>
+	</array>
+	<array offset="0x22f4" name="SP_FS_IMAGE_OUTPUT" stride="1" length="4">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="MRTFORMAT" low="0" high="5" type="a3xx_color_fmt"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x22ff" name="SP_FS_LENGTH_REG" type="a3xx_vs_fs_length_reg"/>
+
+	<reg32 offset="0x2301" name="PA_SC_AA_CONFIG"/>
+	<!-- TPL1 registers -->
+	<!-- assume VS/FS_TEX_OFFSET is same -->
+	<bitset name="a3xx_tpl1_tp_vs_fs_tex_offset" inline="yes">
+		<bitfield name="SAMPLEROFFSET" low="0" high="7" type="uint"/>
+		<bitfield name="MEMOBJOFFSET" low="8" high="15" type="uint"/>
+		<!-- not sure the size of this: -->
+		<bitfield name="BASETABLEPTR" low="16" high="31" type="uint"/>
+	</bitset>
+	<reg32 offset="0x2340" name="TPL1_TP_VS_TEX_OFFSET" type="a3xx_tpl1_tp_vs_fs_tex_offset"/>
+	<reg32 offset="0x2341" name="TPL1_TP_VS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x2342" name="TPL1_TP_FS_TEX_OFFSET" type="a3xx_tpl1_tp_vs_fs_tex_offset"/>
+	<reg32 offset="0x2343" name="TPL1_TP_FS_BORDER_COLOR_BASE_ADDR"/>
+
+	<!-- VBIF registers -->
+	<reg32 offset="0x3001" name="VBIF_CLKON"/>
+	<reg32 offset="0x300c" name="VBIF_FIXED_SORT_EN"/>
+	<reg32 offset="0x300d" name="VBIF_FIXED_SORT_SEL0"/>
+	<reg32 offset="0x300e" name="VBIF_FIXED_SORT_SEL1"/>
+	<reg32 offset="0x301c" name="VBIF_ABIT_SORT"/>
+	<reg32 offset="0x301d" name="VBIF_ABIT_SORT_CONF"/>
+	<reg32 offset="0x302a" name="VBIF_GATE_OFF_WRREQ_EN"/>
+	<reg32 offset="0x302c" name="VBIF_IN_RD_LIM_CONF0"/>
+	<reg32 offset="0x302d" name="VBIF_IN_RD_LIM_CONF1"/>
+	<reg32 offset="0x3030" name="VBIF_IN_WR_LIM_CONF0"/>
+	<reg32 offset="0x3031" name="VBIF_IN_WR_LIM_CONF1"/>
+	<reg32 offset="0x3034" name="VBIF_OUT_RD_LIM_CONF0"/>
+	<reg32 offset="0x3035" name="VBIF_OUT_WR_LIM_CONF0"/>
+	<reg32 offset="0x3036" name="VBIF_DDR_OUT_MAX_BURST"/>
+	<reg32 offset="0x303c" name="VBIF_ARB_CTL"/>
+	<reg32 offset="0x3049" name="VBIF_ROUND_ROBIN_QOS_ARB"/>
+	<reg32 offset="0x3058" name="VBIF_OUT_AXI_AMEMTYPE_CONF0"/>
+	<reg32 offset="0x305e" name="VBIF_OUT_AXI_AOOO_EN"/>
+	<reg32 offset="0x305f" name="VBIF_OUT_AXI_AOOO"/>
+
+	<bitset name="a3xx_vbif_perf_cnt" inline="yes">
+		<bitfield name="CNT0" pos="0" type="boolean"/>
+		<bitfield name="CNT1" pos="1" type="boolean"/>
+		<bitfield name="PWRCNT0" pos="2" type="boolean"/>
+		<bitfield name="PWRCNT1" pos="3" type="boolean"/>
+		<bitfield name="PWRCNT2" pos="4" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x3070" name="VBIF_PERF_CNT_EN" type="a3xx_vbif_perf_cnt"/>
+	<reg32 offset="0x3071" name="VBIF_PERF_CNT_CLR" type="a3xx_vbif_perf_cnt"/>
+	<reg32 offset="0x3072" name="VBIF_PERF_CNT_SEL"/>
+	<reg32 offset="0x3073" name="VBIF_PERF_CNT0_LO"/>
+	<reg32 offset="0x3074" name="VBIF_PERF_CNT0_HI"/>
+	<reg32 offset="0x3075" name="VBIF_PERF_CNT1_LO"/>
+	<reg32 offset="0x3076" name="VBIF_PERF_CNT1_HI"/>
+	<reg32 offset="0x3077" name="VBIF_PERF_PWR_CNT0_LO"/>
+	<reg32 offset="0x3078" name="VBIF_PERF_PWR_CNT0_HI"/>
+	<reg32 offset="0x3079" name="VBIF_PERF_PWR_CNT1_LO"/>
+	<reg32 offset="0x307a" name="VBIF_PERF_PWR_CNT1_HI"/>
+	<reg32 offset="0x307b" name="VBIF_PERF_PWR_CNT2_LO"/>
+	<reg32 offset="0x307c" name="VBIF_PERF_PWR_CNT2_HI"/>
+
+
+	<reg32 offset="0x0c01" name="VSC_BIN_SIZE">
+		<bitfield name="WIDTH" low="0" high="4" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="5" high="9" shr="5" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0c02" name="VSC_SIZE_ADDRESS"/>
+	<array offset="0x0c06" name="VSC_PIPE" stride="3" length="8">
+		<reg32 offset="0x0" name="CONFIG">
+			<doc>
+				Configures the mapping between VSC_PIPE buffer and
+				bin, X/Y specify the bin index in the horiz/vert
+				direction (0,0 is upper left, 0,1 is leftmost bin
+				on second row, and so on).  W/H specify the number
+				of bins assigned to this VSC_PIPE in the horiz/vert
+				dimension.
+			</doc>
+			<bitfield name="X" low="0" high="9" type="uint"/>
+			<bitfield name="Y" low="10" high="19" type="uint"/>
+			<bitfield name="W" low="20" high="23" type="uint"/>
+			<bitfield name="H" low="24" high="27" type="uint"/>
+		</reg32>
+		<reg32 offset="0x1" name="DATA_ADDRESS"/>
+		<reg32 offset="0x2" name="DATA_LENGTH"/>
+	</array>
+	<reg32 offset="0x0c3c" name="VSC_BIN_CONTROL">
+		<doc>seems to be set to 0x00000001 during binning pass</doc>
+		<bitfield name="BINNING_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0c3d" name="UNKNOWN_0C3D">
+		<doc>seems to be always set to 0x00000001</doc>
+	</reg32>
+	<reg32 offset="0x0c48" name="PC_PERFCOUNTER0_SELECT" type="a3xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0c49" name="PC_PERFCOUNTER1_SELECT" type="a3xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0c4a" name="PC_PERFCOUNTER2_SELECT" type="a3xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0c4b" name="PC_PERFCOUNTER3_SELECT" type="a3xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0c81" name="GRAS_TSE_DEBUG_ECO">
+		<doc>seems to be always set to 0x00000001</doc>
+	</reg32>
+
+	<reg32 offset="0x0c88" name="GRAS_PERFCOUNTER0_SELECT" type="a3xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c89" name="GRAS_PERFCOUNTER1_SELECT" type="a3xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c8a" name="GRAS_PERFCOUNTER2_SELECT" type="a3xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x0c8b" name="GRAS_PERFCOUNTER3_SELECT" type="a3xx_gras_ras_perfcounter_select"/>
+	<array offset="0x0ca0" name="GRAS_CL_USER_PLANE" stride="4" length="6">
+		<reg32 offset="0x0" name="X"/>
+		<reg32 offset="0x1" name="Y"/>
+		<reg32 offset="0x2" name="Z"/>
+		<reg32 offset="0x3" name="W"/>
+	</array>
+	<reg32 offset="0x0cc0" name="RB_GMEM_BASE_ADDR"/>
+	<reg32 offset="0x0cc1" name="RB_DEBUG_ECO_CONTROLS_ADDR"/>
+	<reg32 offset="0x0cc6" name="RB_PERFCOUNTER0_SELECT" type="a3xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cc7" name="RB_PERFCOUNTER1_SELECT" type="a3xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ce0" name="RB_FRAME_BUFFER_DIMENSION">
+		<bitfield name="WIDTH" low="0" high="13" type="uint"/>
+		<bitfield name="HEIGHT" low="14" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0e00" name="HLSQ_PERFCOUNTER0_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e01" name="HLSQ_PERFCOUNTER1_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e02" name="HLSQ_PERFCOUNTER2_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e03" name="HLSQ_PERFCOUNTER3_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e04" name="HLSQ_PERFCOUNTER4_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e05" name="HLSQ_PERFCOUNTER5_SELECT" type="a3xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e43" name="UNKNOWN_0E43">
+		<doc>seems to be always set to 0x00000001</doc>
+	</reg32>
+	<reg32 offset="0x0e44" name="VFD_PERFCOUNTER0_SELECT" type="a3xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e45" name="VFD_PERFCOUNTER1_SELECT" type="a3xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e61" name="VPC_VPC_DEBUG_RAM_SEL"/>
+	<reg32 offset="0x0e62" name="VPC_VPC_DEBUG_RAM_READ"/>
+	<reg32 offset="0x0e64" name="VPC_PERFCOUNTER0_SELECT" type="a3xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e65" name="VPC_PERFCOUNTER1_SELECT" type="a3xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e82" name="UCHE_CACHE_MODE_CONTROL_REG"/>
+	<reg32 offset="0x0e84" name="UCHE_PERFCOUNTER0_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e85" name="UCHE_PERFCOUNTER1_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e86" name="UCHE_PERFCOUNTER2_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e87" name="UCHE_PERFCOUNTER3_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e88" name="UCHE_PERFCOUNTER4_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e89" name="UCHE_PERFCOUNTER5_SELECT" type="a3xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea0" name="UCHE_CACHE_INVALIDATE0_REG">
+		<!-- might be shifted right by 5, assuming 32byte cache line size.. -->
+		<bitfield name="ADDR" low="0" high="27" type="hex"/>
+	</reg32>
+	<reg32 offset="0x0ea1" name="UCHE_CACHE_INVALIDATE1_REG">
+		<!-- might be shifted right by 5, assuming 32byte cache line size.. -->
+		<bitfield name="ADDR" low="0" high="27" type="hex"/>
+		<!-- I'd assume 2 bits, for FLUSH/INVALIDATE/CLEAN? -->
+		<bitfield name="OPCODE" low="28" high="29" type="a3xx_cache_opcode"/>
+		<bitfield name="ENTIRE_CACHE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0ea6" name="UNKNOWN_0EA6"/>
+	<reg32 offset="0x0ec4" name="SP_PERFCOUNTER0_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec5" name="SP_PERFCOUNTER1_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec6" name="SP_PERFCOUNTER2_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec7" name="SP_PERFCOUNTER3_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec8" name="SP_PERFCOUNTER4_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec9" name="SP_PERFCOUNTER5_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0eca" name="SP_PERFCOUNTER6_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecb" name="SP_PERFCOUNTER7_SELECT" type="a3xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ee0" name="UNKNOWN_0EE0">
+		<doc>seems to be always set to 0x00000003</doc>
+	</reg32>
+	<reg32 offset="0x0f03" name="UNKNOWN_0F03">
+		<doc>seems to be always set to 0x00000001</doc>
+	</reg32>
+	<reg32 offset="0x0f04" name="TP_PERFCOUNTER0_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f05" name="TP_PERFCOUNTER1_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f06" name="TP_PERFCOUNTER2_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f07" name="TP_PERFCOUNTER3_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f08" name="TP_PERFCOUNTER4_SELECT" type="a3xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f09" name="TP_PERFCOUNTER5_SELECT" type="a3xx_tp_perfcounter_select"/>
+
+	<!-- this seems to be the register that CP_RUN_OPENCL writes: -->
+	<reg32 offset="0x21f0" name="VGT_CL_INITIATOR"/>
+
+	<!-- seems to be same as a2xx according to fwdump.. -->
+	<reg32 offset="0x21f9" name="VGT_EVENT_INITIATOR"/>
+	<reg32 offset="0x21fc" name="VGT_DRAW_INITIATOR" type="vgt_draw_initiator"/>
+	<reg32 offset="0x21fd" name="VGT_IMMED_DATA"/>
+</domain>
+
+<domain name="A3XX_TEX_SAMP" width="32">
+	<doc>Texture sampler dwords</doc>
+	<enum name="a3xx_tex_filter">
+		<value name="A3XX_TEX_NEAREST" value="0"/>
+		<value name="A3XX_TEX_LINEAR" value="1"/>
+		<value name="A3XX_TEX_ANISO" value="2"/>
+	</enum>
+	<enum name="a3xx_tex_clamp">
+		<value name="A3XX_TEX_REPEAT" value="0"/>
+		<value name="A3XX_TEX_CLAMP_TO_EDGE" value="1"/>
+		<value name="A3XX_TEX_MIRROR_REPEAT" value="2"/>
+		<value name="A3XX_TEX_CLAMP_TO_BORDER" value="3"/>
+		<value name="A3XX_TEX_MIRROR_CLAMP" value="4"/>
+	</enum>
+	<enum name="a3xx_tex_aniso">
+		<value name="A3XX_TEX_ANISO_1" value="0"/>
+		<value name="A3XX_TEX_ANISO_2" value="1"/>
+		<value name="A3XX_TEX_ANISO_4" value="2"/>
+		<value name="A3XX_TEX_ANISO_8" value="3"/>
+		<value name="A3XX_TEX_ANISO_16" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="CLAMPENABLE" pos="0" type="boolean"/>
+		<bitfield name="MIPFILTER_LINEAR" pos="1" type="boolean"/>
+		<bitfield name="XY_MAG" low="2" high="3" type="a3xx_tex_filter"/>
+		<bitfield name="XY_MIN" low="4" high="5" type="a3xx_tex_filter"/>
+		<bitfield name="WRAP_S" low="6" high="8" type="a3xx_tex_clamp"/>
+		<bitfield name="WRAP_T" low="9" high="11" type="a3xx_tex_clamp"/>
+		<bitfield name="WRAP_R" low="12" high="14" type="a3xx_tex_clamp"/>
+		<bitfield name="ANISO" low="15" high="17" type="a3xx_tex_aniso"/>
+		<bitfield name="COMPARE_FUNC" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="24" type="boolean"/>
+		<!-- UNNORM_COORDS == CLK_NORMALIZED_COORDS_FALSE -->
+		<bitfield name="UNNORM_COORDS" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="LOD_BIAS" low="0" high="10" type="fixed" radix="6"/>
+		<bitfield name="MAX_LOD" low="12" high="21" type="ufixed" radix="6"/>
+		<bitfield name="MIN_LOD" low="22" high="31" type="ufixed" radix="6"/>
+	</reg32>
+</domain>
+
+<domain name="A3XX_TEX_CONST" width="32">
+	<doc>Texture constant dwords</doc>
+	<enum name="a3xx_tex_swiz">
+		<!-- same as a2xx? -->
+		<value name="A3XX_TEX_X" value="0"/>
+		<value name="A3XX_TEX_Y" value="1"/>
+		<value name="A3XX_TEX_Z" value="2"/>
+		<value name="A3XX_TEX_W" value="3"/>
+		<value name="A3XX_TEX_ZERO" value="4"/>
+		<value name="A3XX_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="a3xx_tex_type">
+		<value name="A3XX_TEX_1D" value="0"/>
+		<value name="A3XX_TEX_2D" value="1"/>
+		<value name="A3XX_TEX_CUBE" value="2"/>
+		<value name="A3XX_TEX_3D" value="3"/>
+	</enum>
+	<enum name="a3xx_tex_msaa">
+		<value name="A3XX_TPL1_MSAA1X" value="0"/>
+		<value name="A3XX_TPL1_MSAA2X" value="1"/>
+		<value name="A3XX_TPL1_MSAA4X" value="2"/>
+		<value name="A3XX_TPL1_MSAA8X" value="3"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TILE_MODE" low="0" high="1" type="a3xx_tile_mode"/>
+		<bitfield name="SRGB" pos="2" type="boolean"/>
+		<bitfield name="SWIZ_X" low="4" high="6" type="a3xx_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="7" high="9" type="a3xx_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="10" high="12" type="a3xx_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="13" high="15" type="a3xx_tex_swiz"/>
+		<bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
+		<bitfield name="MSAATEX" low="20" high="21" type="a3xx_tex_msaa"/>
+		<bitfield name="FMT" low="22" high="28" type="a3xx_tex_fmt"/>
+		<bitfield name="NOCONVERT" pos="29" type="boolean"/>
+		<bitfield name="TYPE" low="30" high="31" type="a3xx_tex_type"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="HEIGHT" low="0" high="13" type="uint"/>
+		<bitfield name="WIDTH" low="14" high="27" type="uint"/>
+		<!-- minimum pitch (for mipmap levels): log2(pitchalign / 16) -->
+		<bitfield name="PITCHALIGN" low="28" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<doc>INDX is index of texture address(es) in MIPMAP state block</doc>
+		<bitfield name="INDX" low="0" high="8" type="uint"/>
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="12" high="29" type="uint"/>
+		<doc>SWAP bit is set for BGRA instead of RGBA</doc>
+		<bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!--
+		Update: the two LAYERSZn seem not to be the same thing.
+		According to Ilia's experimentation the first one goes up
+		to at *least* bit 14..
+		 -->
+		<bitfield name="LAYERSZ1" low="0" high="16" shr="12" type="uint"/>
+		<bitfield name="DEPTH" low="17" high="27" type="uint"/>
+		<bitfield name="LAYERSZ2" low="28" high="31" shr="12" type="uint"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/adreno/a4xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/adreno/a4xx.xml
@@ -0,0 +1,2409 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+<enum name="a4xx_color_fmt">
+	<value name="RB4_A8_UNORM" value="0x01"/>
+	<value name="RB4_R8_UNORM" value="0x02"/>
+	<value name="RB4_R8_SNORM" value="0x03"/>
+	<value name="RB4_R8_UINT" value="0x04"/>
+	<value name="RB4_R8_SINT" value="0x05"/>
+
+	<value name="RB4_R4G4B4A4_UNORM" value="0x08"/>
+	<value name="RB4_R5G5B5A1_UNORM" value="0x0a"/>
+	<value name="RB4_R5G6B5_UNORM" value="0x0e"/>
+	<value name="RB4_R8G8_UNORM" value="0x0f"/>
+	<value name="RB4_R8G8_SNORM" value="0x10"/>
+	<value name="RB4_R8G8_UINT" value="0x11"/>
+	<value name="RB4_R8G8_SINT" value="0x12"/>
+	<value name="RB4_R16_UNORM" value="0x13"/>
+	<value name="RB4_R16_SNORM" value="0x14"/>
+	<value name="RB4_R16_FLOAT" value="0x15"/>
+	<value name="RB4_R16_UINT" value="0x16"/>
+	<value name="RB4_R16_SINT" value="0x17"/>
+
+	<value name="RB4_R8G8B8_UNORM" value="0x19"/>
+
+	<value name="RB4_R8G8B8A8_UNORM" value="0x1a"/>
+	<value name="RB4_R8G8B8A8_SNORM" value="0x1c"/>
+	<value name="RB4_R8G8B8A8_UINT" value="0x1d"/>
+	<value name="RB4_R8G8B8A8_SINT" value="0x1e"/>
+	<value name="RB4_R10G10B10A2_UNORM" value="0x1f"/>
+	<value name="RB4_R10G10B10A2_UINT" value="0x22"/>
+	<value name="RB4_R11G11B10_FLOAT" value="0x27"/>
+	<value name="RB4_R16G16_UNORM" value="0x28"/>
+	<value name="RB4_R16G16_SNORM" value="0x29"/>
+	<value name="RB4_R16G16_FLOAT" value="0x2a"/>
+	<value name="RB4_R16G16_UINT" value="0x2b"/>
+	<value name="RB4_R16G16_SINT" value="0x2c"/>
+	<value name="RB4_R32_FLOAT" value="0x2d"/>
+	<value name="RB4_R32_UINT" value="0x2e"/>
+	<value name="RB4_R32_SINT" value="0x2f"/>
+
+	<value name="RB4_R16G16B16A16_UNORM" value="0x34"/>
+	<value name="RB4_R16G16B16A16_SNORM" value="0x35"/>
+	<value name="RB4_R16G16B16A16_FLOAT" value="0x36"/>
+	<value name="RB4_R16G16B16A16_UINT" value="0x37"/>
+	<value name="RB4_R16G16B16A16_SINT" value="0x38"/>
+	<value name="RB4_R32G32_FLOAT" value="0x39"/>
+	<value name="RB4_R32G32_UINT" value="0x3a"/>
+	<value name="RB4_R32G32_SINT" value="0x3b"/>
+
+	<value name="RB4_R32G32B32A32_FLOAT" value="0x3c"/>
+	<value name="RB4_R32G32B32A32_UINT" value="0x3d"/>
+	<value name="RB4_R32G32B32A32_SINT" value="0x3e"/>
+
+	<value name="RB4_NONE" value="0xff"/>
+</enum>
+
+<enum name="a4xx_tile_mode">
+	<value name="TILE4_LINEAR" value="0"/>
+	<value name="TILE4_2" value="2"/>
+	<value name="TILE4_3" value="3"/>
+</enum>
+
+<enum name="a4xx_vtx_fmt" prefix="chipset">
+	<!-- hmm, shifted one compared to a3xx?!?  -->
+	<value name="VFMT4_32_FLOAT" value="0x1"/>
+	<value name="VFMT4_32_32_FLOAT" value="0x2"/>
+	<value name="VFMT4_32_32_32_FLOAT" value="0x3"/>
+	<value name="VFMT4_32_32_32_32_FLOAT" value="0x4"/>
+
+	<value name="VFMT4_16_FLOAT" value="0x5"/>
+	<value name="VFMT4_16_16_FLOAT" value="0x6"/>
+	<value name="VFMT4_16_16_16_FLOAT" value="0x7"/>
+	<value name="VFMT4_16_16_16_16_FLOAT" value="0x8"/>
+
+	<value name="VFMT4_32_FIXED" value="0x9"/>
+	<value name="VFMT4_32_32_FIXED" value="0xa"/>
+	<value name="VFMT4_32_32_32_FIXED" value="0xb"/>
+	<value name="VFMT4_32_32_32_32_FIXED" value="0xc"/>
+
+	<value name="VFMT4_11_11_10_FLOAT" value="0xd"/>
+
+	<!-- beyond here it does not appear to be shifted -->
+	<value name="VFMT4_16_SINT" value="0x10"/>
+	<value name="VFMT4_16_16_SINT" value="0x11"/>
+	<value name="VFMT4_16_16_16_SINT" value="0x12"/>
+	<value name="VFMT4_16_16_16_16_SINT" value="0x13"/>
+	<value name="VFMT4_16_UINT" value="0x14"/>
+	<value name="VFMT4_16_16_UINT" value="0x15"/>
+	<value name="VFMT4_16_16_16_UINT" value="0x16"/>
+	<value name="VFMT4_16_16_16_16_UINT" value="0x17"/>
+	<value name="VFMT4_16_SNORM" value="0x18"/>
+	<value name="VFMT4_16_16_SNORM" value="0x19"/>
+	<value name="VFMT4_16_16_16_SNORM" value="0x1a"/>
+	<value name="VFMT4_16_16_16_16_SNORM" value="0x1b"/>
+	<value name="VFMT4_16_UNORM" value="0x1c"/>
+	<value name="VFMT4_16_16_UNORM" value="0x1d"/>
+	<value name="VFMT4_16_16_16_UNORM" value="0x1e"/>
+	<value name="VFMT4_16_16_16_16_UNORM" value="0x1f"/>
+
+	<value name="VFMT4_32_UINT" value="0x20"/>
+	<value name="VFMT4_32_32_UINT" value="0x21"/>
+	<value name="VFMT4_32_32_32_UINT" value="0x22"/>
+	<value name="VFMT4_32_32_32_32_UINT" value="0x23"/>
+	<value name="VFMT4_32_SINT" value="0x24"/>
+	<value name="VFMT4_32_32_SINT" value="0x25"/>
+	<value name="VFMT4_32_32_32_SINT" value="0x26"/>
+	<value name="VFMT4_32_32_32_32_SINT" value="0x27"/>
+
+	<value name="VFMT4_8_UINT" value="0x28"/>
+	<value name="VFMT4_8_8_UINT" value="0x29"/>
+	<value name="VFMT4_8_8_8_UINT" value="0x2a"/>
+	<value name="VFMT4_8_8_8_8_UINT" value="0x2b"/>
+	<value name="VFMT4_8_UNORM" value="0x2c"/>
+	<value name="VFMT4_8_8_UNORM" value="0x2d"/>
+	<value name="VFMT4_8_8_8_UNORM" value="0x2e"/>
+	<value name="VFMT4_8_8_8_8_UNORM" value="0x2f"/>
+	<value name="VFMT4_8_SINT" value="0x30"/>
+	<value name="VFMT4_8_8_SINT" value="0x31"/>
+	<value name="VFMT4_8_8_8_SINT" value="0x32"/>
+	<value name="VFMT4_8_8_8_8_SINT" value="0x33"/>
+	<value name="VFMT4_8_SNORM" value="0x34"/>
+	<value name="VFMT4_8_8_SNORM" value="0x35"/>
+	<value name="VFMT4_8_8_8_SNORM" value="0x36"/>
+	<value name="VFMT4_8_8_8_8_SNORM" value="0x37"/>
+
+	<value name="VFMT4_10_10_10_2_UINT" value="0x38"/>
+	<value name="VFMT4_10_10_10_2_UNORM" value="0x39"/>
+	<value name="VFMT4_10_10_10_2_SINT" value="0x3a"/>
+	<value name="VFMT4_10_10_10_2_SNORM" value="0x3b"/>
+	<value name="VFMT4_2_10_10_10_UINT" value="0x3c"/>
+	<value name="VFMT4_2_10_10_10_UNORM" value="0x3d"/>
+	<value name="VFMT4_2_10_10_10_SINT" value="0x3e"/>
+	<value name="VFMT4_2_10_10_10_SNORM" value="0x3f"/>
+
+	<value name="VFMT4_NONE" value="0xff"/>
+</enum>
+
+<enum name="a4xx_tex_fmt">
+	<!-- 0x00 .. 0x02 -->
+
+	<!-- 8-bit formats -->
+	<value name="TFMT4_A8_UNORM" value="0x03"/>
+	<value name="TFMT4_8_UNORM"  value="0x04"/>
+	<value name="TFMT4_8_SNORM"  value="0x05"/>
+	<value name="TFMT4_8_UINT"   value="0x06"/>
+	<value name="TFMT4_8_SINT"   value="0x07"/>
+
+	<!-- 16-bit formats -->
+	<value name="TFMT4_4_4_4_4_UNORM" value="0x08"/>
+	<value name="TFMT4_5_5_5_1_UNORM" value="0x09"/>
+	<!-- 0x0a -->
+	<value name="TFMT4_5_6_5_UNORM"   value="0x0b"/>
+
+	<!-- 0x0c -->
+
+	<value name="TFMT4_L8_A8_UNORM" value="0x0d"/>
+	<value name="TFMT4_8_8_UNORM"   value="0x0e"/>
+	<value name="TFMT4_8_8_SNORM"   value="0x0f"/>
+	<value name="TFMT4_8_8_UINT"    value="0x10"/>
+	<value name="TFMT4_8_8_SINT"    value="0x11"/>
+
+	<value name="TFMT4_16_UNORM" value="0x12"/>
+	<value name="TFMT4_16_SNORM" value="0x13"/>
+	<value name="TFMT4_16_FLOAT" value="0x14"/>
+	<value name="TFMT4_16_UINT"  value="0x15"/>
+	<value name="TFMT4_16_SINT"  value="0x16"/>
+
+	<!-- 0x17 .. 0x1b -->
+
+	<!-- 32-bit formats -->
+	<value name="TFMT4_8_8_8_8_UNORM" value="0x1c"/>
+	<value name="TFMT4_8_8_8_8_SNORM" value="0x1d"/>
+	<value name="TFMT4_8_8_8_8_UINT"  value="0x1e"/>
+	<value name="TFMT4_8_8_8_8_SINT"  value="0x1f"/>
+
+	<value name="TFMT4_9_9_9_E5_FLOAT"   value="0x20"/>
+	<value name="TFMT4_10_10_10_2_UNORM" value="0x21"/>
+	<value name="TFMT4_10_10_10_2_UINT"  value="0x22"/>
+	<!-- 0x23 .. 0x24 -->
+	<value name="TFMT4_11_11_10_FLOAT"   value="0x25"/>
+
+	<value name="TFMT4_16_16_UNORM" value="0x26"/>
+	<value name="TFMT4_16_16_SNORM" value="0x27"/>
+	<value name="TFMT4_16_16_FLOAT" value="0x28"/>
+	<value name="TFMT4_16_16_UINT"  value="0x29"/>
+	<value name="TFMT4_16_16_SINT"  value="0x2a"/>
+
+	<value name="TFMT4_32_FLOAT" value="0x2b"/>
+	<value name="TFMT4_32_UINT"  value="0x2c"/>
+	<value name="TFMT4_32_SINT"  value="0x2d"/>
+
+	<!-- 0x2e .. 0x32 -->
+
+	<!-- 64-bit formats -->
+	<value name="TFMT4_16_16_16_16_UNORM" value="0x33"/>
+	<value name="TFMT4_16_16_16_16_SNORM" value="0x34"/>
+	<value name="TFMT4_16_16_16_16_FLOAT" value="0x35"/>
+	<value name="TFMT4_16_16_16_16_UINT"  value="0x36"/>
+	<value name="TFMT4_16_16_16_16_SINT"  value="0x37"/>
+
+	<value name="TFMT4_32_32_FLOAT" value="0x38"/>
+	<value name="TFMT4_32_32_UINT"  value="0x39"/>
+	<value name="TFMT4_32_32_SINT"  value="0x3a"/>
+
+	<!-- 96-bit formats -->
+	<value name="TFMT4_32_32_32_FLOAT" value="0x3b"/>
+	<value name="TFMT4_32_32_32_UINT"  value="0x3c"/>
+	<value name="TFMT4_32_32_32_SINT"  value="0x3d"/>
+
+	<!-- 0x3e -->
+
+	<!-- 128-bit formats -->
+	<value name="TFMT4_32_32_32_32_FLOAT" value="0x3f"/>
+	<value name="TFMT4_32_32_32_32_UINT"  value="0x40"/>
+	<value name="TFMT4_32_32_32_32_SINT"  value="0x41"/>
+
+	<!-- 0x42 .. 0x46 -->
+	<value name="TFMT4_X8Z24_UNORM" value="0x47"/>
+	<!-- 0x48 .. 0x55 -->
+
+	<!-- compressed formats -->
+	<value name="TFMT4_DXT1"                  value="0x56"/>
+	<value name="TFMT4_DXT3"                  value="0x57"/>
+	<value name="TFMT4_DXT5"                  value="0x58"/>
+	<!-- 0x59 -->
+	<value name="TFMT4_RGTC1_UNORM"           value="0x5a"/>
+	<value name="TFMT4_RGTC1_SNORM"           value="0x5b"/>
+	<!-- 0x5c .. 0x5d -->
+	<value name="TFMT4_RGTC2_UNORM"           value="0x5e"/>
+	<value name="TFMT4_RGTC2_SNORM"           value="0x5f"/>
+	<!-- 0x60 -->
+	<value name="TFMT4_BPTC_UFLOAT"           value="0x61"/>
+	<value name="TFMT4_BPTC_FLOAT"            value="0x62"/>
+	<value name="TFMT4_BPTC"                  value="0x63"/>
+	<value name="TFMT4_ATC_RGB"               value="0x64"/>
+	<value name="TFMT4_ATC_RGBA_EXPLICIT"     value="0x65"/>
+	<value name="TFMT4_ATC_RGBA_INTERPOLATED" value="0x66"/>
+	<value name="TFMT4_ETC2_RG11_UNORM"       value="0x67"/>
+	<value name="TFMT4_ETC2_RG11_SNORM"       value="0x68"/>
+	<value name="TFMT4_ETC2_R11_UNORM"        value="0x69"/>
+	<value name="TFMT4_ETC2_R11_SNORM"        value="0x6a"/>
+	<value name="TFMT4_ETC1"                  value="0x6b"/>
+	<value name="TFMT4_ETC2_RGB8"             value="0x6c"/>
+	<value name="TFMT4_ETC2_RGBA8"            value="0x6d"/>
+	<value name="TFMT4_ETC2_RGB8A1"           value="0x6e"/>
+	<value name="TFMT4_ASTC_4x4"              value="0x6f"/>
+	<value name="TFMT4_ASTC_5x4"              value="0x70"/>
+	<value name="TFMT4_ASTC_5x5"              value="0x71"/>
+	<value name="TFMT4_ASTC_6x5"              value="0x72"/>
+	<value name="TFMT4_ASTC_6x6"              value="0x73"/>
+	<value name="TFMT4_ASTC_8x5"              value="0x74"/>
+	<value name="TFMT4_ASTC_8x6"              value="0x75"/>
+	<value name="TFMT4_ASTC_8x8"              value="0x76"/>
+	<value name="TFMT4_ASTC_10x5"             value="0x77"/>
+	<value name="TFMT4_ASTC_10x6"             value="0x78"/>
+	<value name="TFMT4_ASTC_10x8"             value="0x79"/>
+	<value name="TFMT4_ASTC_10x10"            value="0x7a"/>
+	<value name="TFMT4_ASTC_12x10"            value="0x7b"/>
+	<value name="TFMT4_ASTC_12x12"            value="0x7c"/>
+	<!-- 0x7d .. 0x7f -->
+
+	<value name="TFMT4_NONE"                  value="0xff"/>
+</enum>
+
+<enum name="a4xx_depth_format">
+	<value name="DEPTH4_NONE" value="0"/>
+	<value name="DEPTH4_16" value="1"/>
+	<value name="DEPTH4_24_8" value="2"/>
+	<value name="DEPTH4_32" value="3"/>
+</enum>
+
+<!--
+NOTE counters extracted from test-perf log with the following awful
+script:
+##################
+#!/bin/bash
+
+log=$1
+
+grep -F "counter
+countable
+group" $log | grep -v gl > shortlist.txt
+
+countable=""
+IFS=$'\n'; for line in $(cat shortlist.txt); do
+	# parse ######### group[$n]: $name
+	l=${line########### group}
+	if [ $l != $line ];  then
+		group=`echo $line | awk '{print $3}'`
+		echo "Group: $group"
+		continue
+	fi
+	# parse #########   counter[$n]: $name
+	l=${line###########   counter}
+	if [ $l != $line ]; then
+		countable=`echo $line | awk '{print $3}'`
+		#echo "  Countable: $countable"
+		continue
+	fi
+	# parse 		countable:
+	l=${line##		countable:}
+	if [ $l != $line ]; then
+		val=`echo $line | awk '{print $2}'`
+		echo "<value value=\"$val\" name=\"$countable\"/>"
+	fi
+
+done
+##################
+ -->
+<enum name="a4xx_ccu_perfcounter_select">
+	<value value="0" name="CCU_BUSY_CYCLES"/>
+	<value value="2" name="CCU_RB_DEPTH_RETURN_STALL"/>
+	<value value="3" name="CCU_RB_COLOR_RETURN_STALL"/>
+	<value value="6" name="CCU_DEPTH_BLOCKS"/>
+	<value value="7" name="CCU_COLOR_BLOCKS"/>
+	<value value="8" name="CCU_DEPTH_BLOCK_HIT"/>
+	<value value="9" name="CCU_COLOR_BLOCK_HIT"/>
+	<value value="10" name="CCU_DEPTH_FLAG1_COUNT"/>
+	<value value="11" name="CCU_DEPTH_FLAG2_COUNT"/>
+	<value value="12" name="CCU_DEPTH_FLAG3_COUNT"/>
+	<value value="13" name="CCU_DEPTH_FLAG4_COUNT"/>
+	<value value="14" name="CCU_COLOR_FLAG1_COUNT"/>
+	<value value="15" name="CCU_COLOR_FLAG2_COUNT"/>
+	<value value="16" name="CCU_COLOR_FLAG3_COUNT"/>
+	<value value="17" name="CCU_COLOR_FLAG4_COUNT"/>
+	<value value="18" name="CCU_PARTIAL_BLOCK_READ"/>
+</enum>
+
+<!--
+NOTE other than CP_ALWAYS_COUNT (which is the only one we use so far),
+on a3xx the countable #'s from AMD_performance_monitor disagreed with
+TRM.  All these #'s for a4xx come from AMD_performance_monitor, so
+perhaps they should be taken with a grain of salt
+-->
+<enum name="a4xx_cp_perfcounter_select">
+	<!-- first ctr at least seems same as a3xx, so we can measure freq -->
+	<value value="0" name="CP_ALWAYS_COUNT"/>
+	<value value="1" name="CP_BUSY"/>
+	<value value="2" name="CP_PFP_IDLE"/>
+	<value value="3" name="CP_PFP_BUSY_WORKING"/>
+	<value value="4" name="CP_PFP_STALL_CYCLES_ANY"/>
+	<value value="5" name="CP_PFP_STARVE_CYCLES_ANY"/>
+	<value value="6" name="CP_PFP_STARVED_PER_LOAD_ADDR"/>
+	<value value="7" name="CP_PFP_STALLED_PER_STORE_ADDR"/>
+	<value value="8" name="CP_PFP_PC_PROFILE"/>
+	<value value="9" name="CP_PFP_MATCH_PM4_PKT_PROFILE"/>
+	<value value="10" name="CP_PFP_COND_INDIRECT_DISCARDED"/>
+	<value value="11" name="CP_LONG_RESUMPTIONS"/>
+	<value value="12" name="CP_RESUME_CYCLES"/>
+	<value value="13" name="CP_RESUME_TO_BOUNDARY_CYCLES"/>
+	<value value="14" name="CP_LONG_PREEMPTIONS"/>
+	<value value="15" name="CP_PREEMPT_CYCLES"/>
+	<value value="16" name="CP_PREEMPT_TO_BOUNDARY_CYCLES"/>
+	<value value="17" name="CP_ME_FIFO_EMPTY_PFP_IDLE"/>
+	<value value="18" name="CP_ME_FIFO_EMPTY_PFP_BUSY"/>
+	<value value="19" name="CP_ME_FIFO_NOT_EMPTY_NOT_FULL"/>
+	<value value="20" name="CP_ME_FIFO_FULL_ME_BUSY"/>
+	<value value="21" name="CP_ME_FIFO_FULL_ME_NON_WORKING"/>
+	<value value="22" name="CP_ME_WAITING_FOR_PACKETS"/>
+	<value value="23" name="CP_ME_BUSY_WORKING"/>
+	<value value="24" name="CP_ME_STARVE_CYCLES_ANY"/>
+	<value value="25" name="CP_ME_STARVE_CYCLES_PER_PROFILE"/>
+	<value value="26" name="CP_ME_STALL_CYCLES_PER_PROFILE"/>
+	<value value="27" name="CP_ME_PC_PROFILE"/>
+	<value value="28" name="CP_RCIU_FIFO_EMPTY"/>
+	<value value="29" name="CP_RCIU_FIFO_NOT_EMPTY_NOT_FULL"/>
+	<value value="30" name="CP_RCIU_FIFO_FULL"/>
+	<value value="31" name="CP_RCIU_FIFO_FULL_NO_CONTEXT"/>
+	<value value="32" name="CP_RCIU_FIFO_FULL_AHB_MASTER"/>
+	<value value="33" name="CP_RCIU_FIFO_FULL_OTHER"/>
+	<value value="34" name="CP_AHB_IDLE"/>
+	<value value="35" name="CP_AHB_STALL_ON_GRANT_NO_SPLIT"/>
+	<value value="36" name="CP_AHB_STALL_ON_GRANT_SPLIT"/>
+	<value value="37" name="CP_AHB_STALL_ON_GRANT_SPLIT_PROFILE"/>
+	<value value="38" name="CP_AHB_BUSY_WORKING"/>
+	<value value="39" name="CP_AHB_BUSY_STALL_ON_HRDY"/>
+	<value value="40" name="CP_AHB_BUSY_STALL_ON_HRDY_PROFILE"/>
+</enum>
+
+<enum name="a4xx_gras_ras_perfcounter_select">
+	<value value="0" name="RAS_SUPER_TILES"/>
+	<value value="1" name="RAS_8X8_TILES"/>
+	<value value="2" name="RAS_4X4_TILES"/>
+	<value value="3" name="RAS_BUSY_CYCLES"/>
+	<value value="4" name="RAS_STALL_CYCLES_BY_RB"/>
+	<value value="5" name="RAS_STALL_CYCLES_BY_VSC"/>
+	<value value="6" name="RAS_STARVE_CYCLES_BY_TSE"/>
+	<value value="7" name="RAS_SUPERTILE_CYCLES"/>
+	<value value="8" name="RAS_TILE_CYCLES"/>
+	<value value="9" name="RAS_FULLY_COVERED_SUPER_TILES"/>
+	<value value="10" name="RAS_FULLY_COVERED_8X8_TILES"/>
+	<value value="11" name="RAS_4X4_PRIM"/>
+	<value value="12" name="RAS_8X4_4X8_PRIM"/>
+	<value value="13" name="RAS_8X8_PRIM"/>
+</enum>
+
+<enum name="a4xx_gras_tse_perfcounter_select">
+	<value value="0" name="TSE_INPUT_PRIM"/>
+	<value value="1" name="TSE_INPUT_NULL_PRIM"/>
+	<value value="2" name="TSE_TRIVAL_REJ_PRIM"/>
+	<value value="3" name="TSE_CLIPPED_PRIM"/>
+	<value value="4" name="TSE_NEW_PRIM"/>
+	<value value="5" name="TSE_ZERO_AREA_PRIM"/>
+	<value value="6" name="TSE_FACENESS_CULLED_PRIM"/>
+	<value value="7" name="TSE_ZERO_PIXEL_PRIM"/>
+	<value value="8" name="TSE_OUTPUT_NULL_PRIM"/>
+	<value value="9" name="TSE_OUTPUT_VISIBLE_PRIM"/>
+	<value value="10" name="TSE_PRE_CLIP_PRIM"/>
+	<value value="11" name="TSE_POST_CLIP_PRIM"/>
+	<value value="12" name="TSE_BUSY_CYCLES"/>
+	<value value="13" name="TSE_PC_STARVE"/>
+	<value value="14" name="TSE_RAS_STALL"/>
+	<value value="15" name="TSE_STALL_BARYPLANE_FIFO_FULL"/>
+	<value value="16" name="TSE_STALL_ZPLANE_FIFO_FULL"/>
+</enum>
+
+<enum name="a4xx_hlsq_perfcounter_select">
+	<value value="0" name="HLSQ_SP_VS_STAGE_CONSTANT"/>
+	<value value="1" name="HLSQ_SP_VS_STAGE_INSTRUCTIONS"/>
+	<value value="2" name="HLSQ_SP_FS_STAGE_CONSTANT"/>
+	<value value="3" name="HLSQ_SP_FS_STAGE_INSTRUCTIONS"/>
+	<value value="4" name="HLSQ_TP_STATE"/>
+	<value value="5" name="HLSQ_QUADS"/>
+	<value value="6" name="HLSQ_PIXELS"/>
+	<value value="7" name="HLSQ_VERTICES"/>
+	<value value="13" name="HLSQ_SP_VS_STAGE_DATA_BYTES"/>
+	<value value="14" name="HLSQ_SP_FS_STAGE_DATA_BYTES"/>
+	<value value="15" name="HLSQ_BUSY_CYCLES"/>
+	<value value="16" name="HLSQ_STALL_CYCLES_SP_STATE"/>
+	<value value="17" name="HLSQ_STALL_CYCLES_SP_VS_STAGE"/>
+	<value value="18" name="HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+	<value value="19" name="HLSQ_STALL_CYCLES_UCHE"/>
+	<value value="20" name="HLSQ_RBBM_LOAD_CYCLES"/>
+	<value value="21" name="HLSQ_DI_TO_VS_START_SP"/>
+	<value value="22" name="HLSQ_DI_TO_FS_START_SP"/>
+	<value value="23" name="HLSQ_VS_STAGE_START_TO_DONE_SP"/>
+	<value value="24" name="HLSQ_FS_STAGE_START_TO_DONE_SP"/>
+	<value value="25" name="HLSQ_SP_STATE_COPY_CYCLES_VS_STAGE"/>
+	<value value="26" name="HLSQ_SP_STATE_COPY_CYCLES_FS_STAGE"/>
+	<value value="27" name="HLSQ_UCHE_LATENCY_CYCLES"/>
+	<value value="28" name="HLSQ_UCHE_LATENCY_COUNT"/>
+	<value value="29" name="HLSQ_STARVE_CYCLES_VFD"/>
+</enum>
+
+<enum name="a4xx_pc_perfcounter_select">
+	<value value="0" name="PC_VIS_STREAMS_LOADED"/>
+	<value value="2" name="PC_VPC_PRIMITIVES"/>
+	<value value="3" name="PC_DEAD_PRIM"/>
+	<value value="4" name="PC_LIVE_PRIM"/>
+	<value value="5" name="PC_DEAD_DRAWCALLS"/>
+	<value value="6" name="PC_LIVE_DRAWCALLS"/>
+	<value value="7" name="PC_VERTEX_MISSES"/>
+	<value value="9" name="PC_STALL_CYCLES_VFD"/>
+	<value value="10" name="PC_STALL_CYCLES_TSE"/>
+	<value value="11" name="PC_STALL_CYCLES_UCHE"/>
+	<value value="12" name="PC_WORKING_CYCLES"/>
+	<value value="13" name="PC_IA_VERTICES"/>
+	<value value="14" name="PC_GS_PRIMITIVES"/>
+	<value value="15" name="PC_HS_INVOCATIONS"/>
+	<value value="16" name="PC_DS_INVOCATIONS"/>
+	<value value="17" name="PC_DS_PRIMITIVES"/>
+	<value value="20" name="PC_STARVE_CYCLES_FOR_INDEX"/>
+	<value value="21" name="PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+	<value value="22" name="PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+	<value value="23" name="PC_STALL_CYCLES_TESS"/>
+	<value value="24" name="PC_STARVE_CYCLES_FOR_POSITION"/>
+	<value value="25" name="PC_MODE0_DRAWCALL"/>
+	<value value="26" name="PC_MODE1_DRAWCALL"/>
+	<value value="27" name="PC_MODE2_DRAWCALL"/>
+	<value value="28" name="PC_MODE3_DRAWCALL"/>
+	<value value="29" name="PC_MODE4_DRAWCALL"/>
+	<value value="30" name="PC_PREDICATED_DEAD_DRAWCALL"/>
+	<value value="31" name="PC_STALL_CYCLES_BY_TSE_ONLY"/>
+	<value value="32" name="PC_STALL_CYCLES_BY_VPC_ONLY"/>
+	<value value="33" name="PC_VPC_POS_DATA_TRANSACTION"/>
+	<value value="34" name="PC_BUSY_CYCLES"/>
+	<value value="35" name="PC_STARVE_CYCLES_DI"/>
+	<value value="36" name="PC_STALL_CYCLES_VPC"/>
+	<value value="37" name="TESS_WORKING_CYCLES"/>
+	<value value="38" name="TESS_NUM_CYCLES_SETUP_WORKING"/>
+	<value value="39" name="TESS_NUM_CYCLES_PTGEN_WORKING"/>
+	<value value="40" name="TESS_NUM_CYCLES_CONNGEN_WORKING"/>
+	<value value="41" name="TESS_BUSY_CYCLES"/>
+	<value value="42" name="TESS_STARVE_CYCLES_PC"/>
+	<value value="43" name="TESS_STALL_CYCLES_PC"/>
+</enum>
+
+<enum name="a4xx_pwr_perfcounter_select">
+	<!-- NOTE not actually used.. see RBBM_RBBM_CTL.RESET_PWR_CTR0/1 -->
+	<value value="0" name="PWR_CORE_CLOCK_CYCLES"/>
+	<value value="1" name="PWR_BUSY_CLOCK_CYCLES"/>
+</enum>
+
+<enum name="a4xx_rb_perfcounter_select">
+	<value value="0" name="RB_BUSY_CYCLES"/>
+	<value value="1" name="RB_BUSY_CYCLES_BINNING"/>
+	<value value="2" name="RB_BUSY_CYCLES_RENDERING"/>
+	<value value="3" name="RB_BUSY_CYCLES_RESOLVE"/>
+	<value value="4" name="RB_STARVE_CYCLES_BY_SP"/>
+	<value value="5" name="RB_STARVE_CYCLES_BY_RAS"/>
+	<value value="6" name="RB_STARVE_CYCLES_BY_MARB"/>
+	<value value="7" name="RB_STALL_CYCLES_BY_MARB"/>
+	<value value="8" name="RB_STALL_CYCLES_BY_HLSQ"/>
+	<value value="9" name="RB_RB_RB_MARB_DATA"/>
+	<value value="10" name="RB_SP_RB_QUAD"/>
+	<value value="11" name="RB_RAS_RB_Z_QUADS"/>
+	<value value="12" name="RB_GMEM_CH0_READ"/>
+	<value value="13" name="RB_GMEM_CH1_READ"/>
+	<value value="14" name="RB_GMEM_CH0_WRITE"/>
+	<value value="15" name="RB_GMEM_CH1_WRITE"/>
+	<value value="16" name="RB_CP_CONTEXT_DONE"/>
+	<value value="17" name="RB_CP_CACHE_FLUSH"/>
+	<value value="18" name="RB_CP_ZPASS_DONE"/>
+	<value value="19" name="RB_STALL_FIFO0_FULL"/>
+	<value value="20" name="RB_STALL_FIFO1_FULL"/>
+	<value value="21" name="RB_STALL_FIFO2_FULL"/>
+	<value value="22" name="RB_STALL_FIFO3_FULL"/>
+	<value value="23" name="RB_RB_HLSQ_TRANSACTIONS"/>
+	<value value="24" name="RB_Z_READ"/>
+	<value value="25" name="RB_Z_WRITE"/>
+	<value value="26" name="RB_C_READ"/>
+	<value value="27" name="RB_C_WRITE"/>
+	<value value="28" name="RB_C_READ_LATENCY"/>
+	<value value="29" name="RB_Z_READ_LATENCY"/>
+	<value value="30" name="RB_STALL_BY_UCHE"/>
+	<value value="31" name="RB_MARB_UCHE_TRANSACTIONS"/>
+	<value value="32" name="RB_CACHE_STALL_MISS"/>
+	<value value="33" name="RB_CACHE_STALL_FIFO_FULL"/>
+	<value value="34" name="RB_8BIT_BLENDER_UNITS_ACTIVE"/>
+	<value value="35" name="RB_16BIT_BLENDER_UNITS_ACTIVE"/>
+	<value value="36" name="RB_SAMPLER_UNITS_ACTIVE"/>
+	<value value="38" name="RB_TOTAL_PASS"/>
+	<value value="39" name="RB_Z_PASS"/>
+	<value value="40" name="RB_Z_FAIL"/>
+	<value value="41" name="RB_S_FAIL"/>
+	<value value="42" name="RB_POWER0"/>
+	<value value="43" name="RB_POWER1"/>
+	<value value="44" name="RB_POWER2"/>
+	<value value="45" name="RB_POWER3"/>
+	<value value="46" name="RB_POWER4"/>
+	<value value="47" name="RB_POWER5"/>
+	<value value="48" name="RB_POWER6"/>
+	<value value="49" name="RB_POWER7"/>
+</enum>
+
+<enum name="a4xx_rbbm_perfcounter_select">
+	<value value="0" name="RBBM_ALWAYS_ON"/>
+	<value value="1" name="RBBM_VBIF_BUSY"/>
+	<value value="2" name="RBBM_TSE_BUSY"/>
+	<value value="3" name="RBBM_RAS_BUSY"/>
+	<value value="4" name="RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="RBBM_VFD_BUSY"/>
+	<value value="7" name="RBBM_VPC_BUSY"/>
+	<value value="8" name="RBBM_UCHE_BUSY"/>
+	<value value="9" name="RBBM_VSC_BUSY"/>
+	<value value="10" name="RBBM_HLSQ_BUSY"/>
+	<value value="11" name="RBBM_ANY_RB_BUSY"/>
+	<value value="12" name="RBBM_ANY_TPL1_BUSY"/>
+	<value value="13" name="RBBM_ANY_SP_BUSY"/>
+	<value value="14" name="RBBM_ANY_MARB_BUSY"/>
+	<value value="15" name="RBBM_ANY_ARB_BUSY"/>
+	<value value="16" name="RBBM_AHB_STATUS_BUSY"/>
+	<value value="17" name="RBBM_AHB_STATUS_STALLED"/>
+	<value value="18" name="RBBM_AHB_STATUS_TXFR"/>
+	<value value="19" name="RBBM_AHB_STATUS_TXFR_SPLIT"/>
+	<value value="20" name="RBBM_AHB_STATUS_TXFR_ERROR"/>
+	<value value="21" name="RBBM_AHB_STATUS_LONG_STALL"/>
+	<value value="22" name="RBBM_STATUS_MASKED"/>
+	<value value="23" name="RBBM_CP_BUSY_GFX_CORE_IDLE"/>
+	<value value="24" name="RBBM_TESS_BUSY"/>
+	<value value="25" name="RBBM_COM_BUSY"/>
+	<value value="32" name="RBBM_DCOM_BUSY"/>
+	<value value="33" name="RBBM_ANY_CCU_BUSY"/>
+	<value value="34" name="RBBM_DPM_BUSY"/>
+</enum>
+
+<enum name="a4xx_sp_perfcounter_select">
+	<value value="0" name="SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="1" name="SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="2" name="SP_LM_ATOMICS"/>
+	<value value="3" name="SP_GM_LOAD_INSTRUCTIONS"/>
+	<value value="4" name="SP_GM_STORE_INSTRUCTIONS"/>
+	<value value="5" name="SP_GM_ATOMICS"/>
+	<value value="6" name="SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="7" name="SP_VS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="8" name="SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="9" name="SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="10" name="SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="11" name="SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="12" name="SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="13" name="SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="14" name="SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="15" name="SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="17" name="SP_VS_INSTRUCTIONS"/>
+	<value value="18" name="SP_FS_INSTRUCTIONS"/>
+	<value value="19" name="SP_ADDR_LOCK_COUNT"/>
+	<value value="20" name="SP_UCHE_READ_TRANS"/>
+	<value value="21" name="SP_UCHE_WRITE_TRANS"/>
+	<value value="22" name="SP_EXPORT_VPC_TRANS"/>
+	<value value="23" name="SP_EXPORT_RB_TRANS"/>
+	<value value="24" name="SP_PIXELS_KILLED"/>
+	<value value="25" name="SP_ICL1_REQUESTS"/>
+	<value value="26" name="SP_ICL1_MISSES"/>
+	<value value="27" name="SP_ICL0_REQUESTS"/>
+	<value value="28" name="SP_ICL0_MISSES"/>
+	<value value="29" name="SP_ALU_WORKING_CYCLES"/>
+	<value value="30" name="SP_EFU_WORKING_CYCLES"/>
+	<value value="31" name="SP_STALL_CYCLES_BY_VPC"/>
+	<value value="32" name="SP_STALL_CYCLES_BY_TP"/>
+	<value value="33" name="SP_STALL_CYCLES_BY_UCHE"/>
+	<value value="34" name="SP_STALL_CYCLES_BY_RB"/>
+	<value value="35" name="SP_BUSY_CYCLES"/>
+	<value value="36" name="SP_HS_INSTRUCTIONS"/>
+	<value value="37" name="SP_DS_INSTRUCTIONS"/>
+	<value value="38" name="SP_GS_INSTRUCTIONS"/>
+	<value value="39" name="SP_CS_INSTRUCTIONS"/>
+	<value value="40" name="SP_SCHEDULER_NON_WORKING"/>
+	<value value="41" name="SP_WAVE_CONTEXTS"/>
+	<value value="42" name="SP_WAVE_CONTEXT_CYCLES"/>
+	<value value="43" name="SP_POWER0"/>
+	<value value="44" name="SP_POWER1"/>
+	<value value="45" name="SP_POWER2"/>
+	<value value="46" name="SP_POWER3"/>
+	<value value="47" name="SP_POWER4"/>
+	<value value="48" name="SP_POWER5"/>
+	<value value="49" name="SP_POWER6"/>
+	<value value="50" name="SP_POWER7"/>
+	<value value="51" name="SP_POWER8"/>
+	<value value="52" name="SP_POWER9"/>
+	<value value="53" name="SP_POWER10"/>
+	<value value="54" name="SP_POWER11"/>
+	<value value="55" name="SP_POWER12"/>
+	<value value="56" name="SP_POWER13"/>
+	<value value="57" name="SP_POWER14"/>
+	<value value="58" name="SP_POWER15"/>
+</enum>
+
+<enum name="a4xx_tp_perfcounter_select">
+	<value value="0" name="TP_L1_REQUESTS"/>
+	<value value="1" name="TP_L1_MISSES"/>
+	<value value="8" name="TP_QUADS_OFFSET"/>
+	<value value="9" name="TP_QUAD_SHADOW"/>
+	<value value="10" name="TP_QUADS_ARRAY"/>
+	<value value="11" name="TP_QUADS_GRADIENT"/>
+	<value value="12" name="TP_QUADS_1D2D"/>
+	<value value="13" name="TP_QUADS_3DCUBE"/>
+	<value value="16" name="TP_BUSY_CYCLES"/>
+	<value value="17" name="TP_STALL_CYCLES_BY_ARB"/>
+	<value value="20" name="TP_STATE_CACHE_REQUESTS"/>
+	<value value="21" name="TP_STATE_CACHE_MISSES"/>
+	<value value="22" name="TP_POWER0"/>
+	<value value="23" name="TP_POWER1"/>
+	<value value="24" name="TP_POWER2"/>
+	<value value="25" name="TP_POWER3"/>
+	<value value="26" name="TP_POWER4"/>
+	<value value="27" name="TP_POWER5"/>
+	<value value="28" name="TP_POWER6"/>
+	<value value="29" name="TP_POWER7"/>
+</enum>
+
+<enum name="a4xx_uche_perfcounter_select">
+	<value value="0" name="UCHE_VBIF_READ_BEATS_TP"/>
+	<value value="1" name="UCHE_VBIF_READ_BEATS_VFD"/>
+	<value value="2" name="UCHE_VBIF_READ_BEATS_HLSQ"/>
+	<value value="3" name="UCHE_VBIF_READ_BEATS_MARB"/>
+	<value value="4" name="UCHE_VBIF_READ_BEATS_SP"/>
+	<value value="5" name="UCHE_READ_REQUESTS_TP"/>
+	<value value="6" name="UCHE_READ_REQUESTS_VFD"/>
+	<value value="7" name="UCHE_READ_REQUESTS_HLSQ"/>
+	<value value="8" name="UCHE_READ_REQUESTS_MARB"/>
+	<value value="9" name="UCHE_READ_REQUESTS_SP"/>
+	<value value="10" name="UCHE_WRITE_REQUESTS_MARB"/>
+	<value value="11" name="UCHE_WRITE_REQUESTS_SP"/>
+	<value value="12" name="UCHE_TAG_CHECK_FAILS"/>
+	<value value="13" name="UCHE_EVICTS"/>
+	<value value="14" name="UCHE_FLUSHES"/>
+	<value value="15" name="UCHE_VBIF_LATENCY_CYCLES"/>
+	<value value="16" name="UCHE_VBIF_LATENCY_SAMPLES"/>
+	<value value="17" name="UCHE_BUSY_CYCLES"/>
+	<value value="18" name="UCHE_VBIF_READ_BEATS_PC"/>
+	<value value="19" name="UCHE_READ_REQUESTS_PC"/>
+	<value value="20" name="UCHE_WRITE_REQUESTS_VPC"/>
+	<value value="21" name="UCHE_STALL_BY_VBIF"/>
+	<value value="22" name="UCHE_WRITE_REQUESTS_VSC"/>
+	<value value="23" name="UCHE_POWER0"/>
+	<value value="24" name="UCHE_POWER1"/>
+	<value value="25" name="UCHE_POWER2"/>
+	<value value="26" name="UCHE_POWER3"/>
+	<value value="27" name="UCHE_POWER4"/>
+	<value value="28" name="UCHE_POWER5"/>
+	<value value="29" name="UCHE_POWER6"/>
+	<value value="30" name="UCHE_POWER7"/>
+</enum>
+
+<enum name="a4xx_vbif_perfcounter_select">
+	<value value="0" name="AXI_READ_REQUESTS_ID_0"/>
+	<value value="1" name="AXI_READ_REQUESTS_ID_1"/>
+	<value value="2" name="AXI_READ_REQUESTS_ID_2"/>
+	<value value="3" name="AXI_READ_REQUESTS_ID_3"/>
+	<value value="4" name="AXI_READ_REQUESTS_ID_4"/>
+	<value value="5" name="AXI_READ_REQUESTS_ID_5"/>
+	<value value="6" name="AXI_READ_REQUESTS_ID_6"/>
+	<value value="7" name="AXI_READ_REQUESTS_ID_7"/>
+	<value value="8" name="AXI_READ_REQUESTS_ID_8"/>
+	<value value="9" name="AXI_READ_REQUESTS_ID_9"/>
+	<value value="10" name="AXI_READ_REQUESTS_ID_10"/>
+	<value value="11" name="AXI_READ_REQUESTS_ID_11"/>
+	<value value="12" name="AXI_READ_REQUESTS_ID_12"/>
+	<value value="13" name="AXI_READ_REQUESTS_ID_13"/>
+	<value value="14" name="AXI_READ_REQUESTS_ID_14"/>
+	<value value="15" name="AXI_READ_REQUESTS_ID_15"/>
+	<value value="16" name="AXI0_READ_REQUESTS_TOTAL"/>
+	<value value="17" name="AXI1_READ_REQUESTS_TOTAL"/>
+	<value value="18" name="AXI2_READ_REQUESTS_TOTAL"/>
+	<value value="19" name="AXI3_READ_REQUESTS_TOTAL"/>
+	<value value="20" name="AXI_READ_REQUESTS_TOTAL"/>
+	<value value="21" name="AXI_WRITE_REQUESTS_ID_0"/>
+	<value value="22" name="AXI_WRITE_REQUESTS_ID_1"/>
+	<value value="23" name="AXI_WRITE_REQUESTS_ID_2"/>
+	<value value="24" name="AXI_WRITE_REQUESTS_ID_3"/>
+	<value value="25" name="AXI_WRITE_REQUESTS_ID_4"/>
+	<value value="26" name="AXI_WRITE_REQUESTS_ID_5"/>
+	<value value="27" name="AXI_WRITE_REQUESTS_ID_6"/>
+	<value value="28" name="AXI_WRITE_REQUESTS_ID_7"/>
+	<value value="29" name="AXI_WRITE_REQUESTS_ID_8"/>
+	<value value="30" name="AXI_WRITE_REQUESTS_ID_9"/>
+	<value value="31" name="AXI_WRITE_REQUESTS_ID_10"/>
+	<value value="32" name="AXI_WRITE_REQUESTS_ID_11"/>
+	<value value="33" name="AXI_WRITE_REQUESTS_ID_12"/>
+	<value value="34" name="AXI_WRITE_REQUESTS_ID_13"/>
+	<value value="35" name="AXI_WRITE_REQUESTS_ID_14"/>
+	<value value="36" name="AXI_WRITE_REQUESTS_ID_15"/>
+	<value value="37" name="AXI0_WRITE_REQUESTS_TOTAL"/>
+	<value value="38" name="AXI1_WRITE_REQUESTS_TOTAL"/>
+	<value value="39" name="AXI2_WRITE_REQUESTS_TOTAL"/>
+	<value value="40" name="AXI3_WRITE_REQUESTS_TOTAL"/>
+	<value value="41" name="AXI_WRITE_REQUESTS_TOTAL"/>
+	<value value="42" name="AXI_TOTAL_REQUESTS"/>
+	<value value="43" name="AXI_READ_DATA_BEATS_ID_0"/>
+	<value value="44" name="AXI_READ_DATA_BEATS_ID_1"/>
+	<value value="45" name="AXI_READ_DATA_BEATS_ID_2"/>
+	<value value="46" name="AXI_READ_DATA_BEATS_ID_3"/>
+	<value value="47" name="AXI_READ_DATA_BEATS_ID_4"/>
+	<value value="48" name="AXI_READ_DATA_BEATS_ID_5"/>
+	<value value="49" name="AXI_READ_DATA_BEATS_ID_6"/>
+	<value value="50" name="AXI_READ_DATA_BEATS_ID_7"/>
+	<value value="51" name="AXI_READ_DATA_BEATS_ID_8"/>
+	<value value="52" name="AXI_READ_DATA_BEATS_ID_9"/>
+	<value value="53" name="AXI_READ_DATA_BEATS_ID_10"/>
+	<value value="54" name="AXI_READ_DATA_BEATS_ID_11"/>
+	<value value="55" name="AXI_READ_DATA_BEATS_ID_12"/>
+	<value value="56" name="AXI_READ_DATA_BEATS_ID_13"/>
+	<value value="57" name="AXI_READ_DATA_BEATS_ID_14"/>
+	<value value="58" name="AXI_READ_DATA_BEATS_ID_15"/>
+	<value value="59" name="AXI0_READ_DATA_BEATS_TOTAL"/>
+	<value value="60" name="AXI1_READ_DATA_BEATS_TOTAL"/>
+	<value value="61" name="AXI2_READ_DATA_BEATS_TOTAL"/>
+	<value value="62" name="AXI3_READ_DATA_BEATS_TOTAL"/>
+	<value value="63" name="AXI_READ_DATA_BEATS_TOTAL"/>
+	<value value="64" name="AXI_WRITE_DATA_BEATS_ID_0"/>
+	<value value="65" name="AXI_WRITE_DATA_BEATS_ID_1"/>
+	<value value="66" name="AXI_WRITE_DATA_BEATS_ID_2"/>
+	<value value="67" name="AXI_WRITE_DATA_BEATS_ID_3"/>
+	<value value="68" name="AXI_WRITE_DATA_BEATS_ID_4"/>
+	<value value="69" name="AXI_WRITE_DATA_BEATS_ID_5"/>
+	<value value="70" name="AXI_WRITE_DATA_BEATS_ID_6"/>
+	<value value="71" name="AXI_WRITE_DATA_BEATS_ID_7"/>
+	<value value="72" name="AXI_WRITE_DATA_BEATS_ID_8"/>
+	<value value="73" name="AXI_WRITE_DATA_BEATS_ID_9"/>
+	<value value="74" name="AXI_WRITE_DATA_BEATS_ID_10"/>
+	<value value="75" name="AXI_WRITE_DATA_BEATS_ID_11"/>
+	<value value="76" name="AXI_WRITE_DATA_BEATS_ID_12"/>
+	<value value="77" name="AXI_WRITE_DATA_BEATS_ID_13"/>
+	<value value="78" name="AXI_WRITE_DATA_BEATS_ID_14"/>
+	<value value="79" name="AXI_WRITE_DATA_BEATS_ID_15"/>
+	<value value="80" name="AXI0_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="81" name="AXI1_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="82" name="AXI2_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="83" name="AXI3_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="84" name="AXI_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="85" name="AXI_DATA_BEATS_TOTAL"/>
+	<value value="86" name="CYCLES_HELD_OFF_ID_0"/>
+	<value value="87" name="CYCLES_HELD_OFF_ID_1"/>
+	<value value="88" name="CYCLES_HELD_OFF_ID_2"/>
+	<value value="89" name="CYCLES_HELD_OFF_ID_3"/>
+	<value value="90" name="CYCLES_HELD_OFF_ID_4"/>
+	<value value="91" name="CYCLES_HELD_OFF_ID_5"/>
+	<value value="92" name="CYCLES_HELD_OFF_ID_6"/>
+	<value value="93" name="CYCLES_HELD_OFF_ID_7"/>
+	<value value="94" name="CYCLES_HELD_OFF_ID_8"/>
+	<value value="95" name="CYCLES_HELD_OFF_ID_9"/>
+	<value value="96" name="CYCLES_HELD_OFF_ID_10"/>
+	<value value="97" name="CYCLES_HELD_OFF_ID_11"/>
+	<value value="98" name="CYCLES_HELD_OFF_ID_12"/>
+	<value value="99" name="CYCLES_HELD_OFF_ID_13"/>
+	<value value="100" name="CYCLES_HELD_OFF_ID_14"/>
+	<value value="101" name="CYCLES_HELD_OFF_ID_15"/>
+	<value value="102" name="AXI_READ_REQUEST_HELD_OFF"/>
+	<value value="103" name="AXI_WRITE_REQUEST_HELD_OFF"/>
+	<value value="104" name="AXI_REQUEST_HELD_OFF"/>
+	<value value="105" name="AXI_WRITE_DATA_HELD_OFF"/>
+	<value value="106" name="OCMEM_AXI_READ_REQUEST_HELD_OFF"/>
+	<value value="107" name="OCMEM_AXI_WRITE_REQUEST_HELD_OFF"/>
+	<value value="108" name="OCMEM_AXI_REQUEST_HELD_OFF"/>
+	<value value="109" name="OCMEM_AXI_WRITE_DATA_HELD_OFF"/>
+	<value value="110" name="ELAPSED_CYCLES_DDR"/>
+	<value value="111" name="ELAPSED_CYCLES_OCMEM"/>
+</enum>
+
+<enum name="a4xx_vfd_perfcounter_select">
+	<value value="0" name="VFD_UCHE_BYTE_FETCHED"/>
+	<value value="1" name="VFD_UCHE_TRANS"/>
+	<value value="3" name="VFD_FETCH_INSTRUCTIONS"/>
+	<value value="5" name="VFD_BUSY_CYCLES"/>
+	<value value="6" name="VFD_STALL_CYCLES_UCHE"/>
+	<value value="7" name="VFD_STALL_CYCLES_HLSQ"/>
+	<value value="8" name="VFD_STALL_CYCLES_VPC_BYPASS"/>
+	<value value="9" name="VFD_STALL_CYCLES_VPC_ALLOC"/>
+	<value value="13" name="VFD_MODE_0_FIBERS"/>
+	<value value="14" name="VFD_MODE_1_FIBERS"/>
+	<value value="15" name="VFD_MODE_2_FIBERS"/>
+	<value value="16" name="VFD_MODE_3_FIBERS"/>
+	<value value="17" name="VFD_MODE_4_FIBERS"/>
+	<value value="18" name="VFD_BFIFO_STALL"/>
+	<value value="19" name="VFD_NUM_VERTICES_TOTAL"/>
+	<value value="20" name="VFD_PACKER_FULL"/>
+	<value value="21" name="VFD_UCHE_REQUEST_FIFO_FULL"/>
+	<value value="22" name="VFD_STARVE_CYCLES_PC"/>
+	<value value="23" name="VFD_STARVE_CYCLES_UCHE"/>
+</enum>
+
+<enum name="a4xx_vpc_perfcounter_select">
+	<value value="2" name="VPC_SP_LM_COMPONENTS"/>
+	<value value="3" name="VPC_SP0_LM_BYTES"/>
+	<value value="4" name="VPC_SP1_LM_BYTES"/>
+	<value value="5" name="VPC_SP2_LM_BYTES"/>
+	<value value="6" name="VPC_SP3_LM_BYTES"/>
+	<value value="7" name="VPC_WORKING_CYCLES"/>
+	<value value="8" name="VPC_STALL_CYCLES_LM"/>
+	<value value="9" name="VPC_STARVE_CYCLES_RAS"/>
+	<value value="10" name="VPC_STREAMOUT_CYCLES"/>
+	<value value="12" name="VPC_UCHE_TRANSACTIONS"/>
+	<value value="13" name="VPC_STALL_CYCLES_UCHE"/>
+	<value value="14" name="VPC_BUSY_CYCLES"/>
+	<value value="15" name="VPC_STARVE_CYCLES_SP"/>
+</enum>
+
+<enum name="a4xx_vsc_perfcounter_select">
+	<value value="0" name="VSC_BUSY_CYCLES"/>
+	<value value="1" name="VSC_WORKING_CYCLES"/>
+	<value value="2" name="VSC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="VSC_STARVE_CYCLES_RAS"/>
+	<value value="4" name="VSC_EOT_NUM"/>
+</enum>
+
+<domain name="A4XX" width="32">
+	<!-- RB registers -->
+	<reg32 offset="0x0cc0" name="RB_GMEM_BASE_ADDR"/>
+	<reg32 offset="0x0cc7" name="RB_PERFCTR_RB_SEL_0" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cc8" name="RB_PERFCTR_RB_SEL_1" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cc9" name="RB_PERFCTR_RB_SEL_2" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cca" name="RB_PERFCTR_RB_SEL_3" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ccb" name="RB_PERFCTR_RB_SEL_4" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ccc" name="RB_PERFCTR_RB_SEL_5" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ccd" name="RB_PERFCTR_RB_SEL_6" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cce" name="RB_PERFCTR_RB_SEL_7" type="a4xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0ccf" name="RB_PERFCTR_CCU_SEL_0" type="a4xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cd0" name="RB_PERFCTR_CCU_SEL_1" type="a4xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cd1" name="RB_PERFCTR_CCU_SEL_2" type="a4xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cd2" name="RB_PERFCTR_CCU_SEL_3" type="a4xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0ce0" name="RB_FRAME_BUFFER_DIMENSION">
+		<bitfield name="WIDTH" low="0" high="13" type="uint"/>
+		<bitfield name="HEIGHT" low="16" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="0x20cc" name="RB_CLEAR_COLOR_DW0"/>
+	<reg32 offset="0x20cd" name="RB_CLEAR_COLOR_DW1"/>
+	<reg32 offset="0x20ce" name="RB_CLEAR_COLOR_DW2"/>
+	<reg32 offset="0x20cf" name="RB_CLEAR_COLOR_DW3"/>
+	<reg32 offset="0x20a0" name="RB_MODE_CONTROL">
+		<!--
+		for non-bypass mode, these are bin width/height..  although
+		possibly bigger bitfields to hold entire width/height for
+		gmem-bypass??  Either way, it appears to need to be multiple
+		of 32..
+		-->
+		<bitfield name="WIDTH" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="8" high="13" shr="5" type="uint"/>
+		<bitfield name="ENABLE_GMEM" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x20a1" name="RB_RENDER_CONTROL">
+		<bitfield name="BINNING_PASS" pos="0" type="boolean"/>
+		<!-- nearly everything has bit3 set.. -->
+		<!-- bit5 set on resolve and tiling pass -->
+		<bitfield name="DISABLE_COLOR_PIPE" pos="5" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x20a2" name="RB_MSAA_CONTROL">
+		<bitfield name="DISABLE" pos="12" type="boolean"/>
+		<bitfield name="SAMPLES" low="13" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x20a3" name="RB_RENDER_CONTROL2">
+		<bitfield name="COORD_MASK" low="0" high="3" type="hex"/>
+		<bitfield name="SAMPLEMASK" pos="4" type="boolean"/>
+		<bitfield name="FACENESS" pos="5" type="boolean"/>
+		<bitfield name="SAMPLEID" pos="6" type="boolean"/>
+		<bitfield name="MSAA_SAMPLES" low="7" high="9" type="uint"/>
+		<bitfield name="SAMPLEID_HR" pos="11" type="boolean"/>
+		<bitfield name="IJ_PERSP_PIXEL" pos="12" type="boolean"/>
+		<!-- the 2 below are just educated guesses -->
+		<bitfield name="IJ_PERSP_CENTROID" pos="13" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="14" type="boolean"/>
+		<!-- needs to be enabled to get nopersp values,
+		     perhaps other cases too? -->
+		<bitfield name="SIZE" pos="15" type="boolean"/>
+	</reg32>
+	<array offset="0x20a4" name="RB_MRT" stride="5" length="8">
+		<reg32 offset="0x0" name="CONTROL">
+			<bitfield name="READ_DEST_ENABLE" pos="3" type="boolean"/>
+			<!-- both these bits seem to get set when enabling GL_BLEND.. -->
+			<bitfield name="BLEND" pos="4" type="boolean"/>
+			<bitfield name="BLEND2" pos="5" type="boolean"/>
+			<bitfield name="ROP_ENABLE" pos="6" type="boolean"/>
+			<bitfield name="ROP_CODE" low="8" high="11" type="a3xx_rop_code"/>
+			<bitfield name="COMPONENT_ENABLE" low="24" high="27" type="hex"/>
+		</reg32>
+		<reg32 offset="0x1" name="BUF_INFO">
+			<bitfield name="COLOR_FORMAT" low="0" high="5" type="a4xx_color_fmt"/>
+			<!--
+			    guestimate position of COLOR_TILE_MODE..  this works out if
+			    common value is 2, like on a3xx..
+			 -->
+			<bitfield name="COLOR_TILE_MODE" low="6" high="7" type="a4xx_tile_mode"/>
+			<bitfield name="DITHER_MODE" low="9" high="10" type="adreno_rb_dither_mode"/>
+			<bitfield name="COLOR_SWAP" low="11" high="12" type="a3xx_color_swap"/>
+			<bitfield name="COLOR_SRGB" pos="13" type="boolean"/>
+			<!-- note: possibly some # of lsb's aren't there: -->
+			<doc>
+				Pitch (actually, appears to be pitch in bytes, so really is a stride)
+				in GMEM, so pitch of the current tile.
+			</doc>
+			<bitfield name="COLOR_BUF_PITCH" low="14" high="31" shr="4" type="uint"/>
+		</reg32>
+		<reg32 offset="0x2" name="BASE"/>
+		<reg32 offset="0x3" name="CONTROL3">
+			<!-- probably missing some lsb's.. and guessing upper size -->
+			<!-- pitch * cpp * msaa: -->
+			<bitfield name="STRIDE" low="3" high="25" type="uint"/>
+		</reg32>
+		<reg32 offset="0x4" name="BLEND_CONTROL">
+			<bitfield name="RGB_SRC_FACTOR" low="0" high="4" type="adreno_rb_blend_factor"/>
+			<bitfield name="RGB_BLEND_OPCODE" low="5" high="7" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="RGB_DEST_FACTOR" low="8" high="12" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_SRC_FACTOR" low="16" high="20" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_BLEND_OPCODE" low="21" high="23" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="ALPHA_DEST_FACTOR" low="24" high="28" type="adreno_rb_blend_factor"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0x20f0" name="RB_BLEND_RED">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20f1" name="RB_BLEND_RED_F32" type="float"/>
+
+	<reg32 offset="0x20f2" name="RB_BLEND_GREEN">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20f3" name="RB_BLEND_GREEN_F32" type="float"/>
+
+	<reg32 offset="0x20f4" name="RB_BLEND_BLUE">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20f5" name="RB_BLEND_BLUE_F32" type="float"/>
+
+	<reg32 offset="0x20f6" name="RB_BLEND_ALPHA">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0x20f7" name="RB_BLEND_ALPHA_F32" type="float"/>
+
+	<reg32 offset="0x20f8" name="RB_ALPHA_CONTROL">
+		<bitfield name="ALPHA_REF" low="0" high="7" type="hex"/>
+		<bitfield name="ALPHA_TEST" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TEST_FUNC" low="9" high="11" type="adreno_compare_func"/>
+	</reg32>
+	<reg32 offset="0x20f9" name="RB_FS_OUTPUT">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="INDEPENDENT_BLEND" pos="8" type="boolean"/>
+		<!-- a guess? -->
+		<bitfield name="SAMPLE_MASK" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x20fa" name="RB_SAMPLE_COUNT_CONTROL">
+		<bitfield name="COPY" pos="1" type="boolean"/>
+		<bitfield name="ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+	<!-- always 00000000 for binning pass, else 0000000f: -->
+	<reg32 offset="0x20fb" name="RB_RENDER_COMPONENTS">
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+
+	<reg32 offset="0x20fc" name="RB_COPY_CONTROL">
+		<!-- not sure # of bits -->
+		<bitfield name="MSAA_RESOLVE" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MODE" low="4" high="6" type="adreno_rb_copy_control_mode"/>
+		<bitfield name="FASTCLEAR" low="8" high="11" type="hex"/>
+		<bitfield name="GMEM_BASE" low="14" high="31" shr="14" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20fd" name="RB_COPY_DEST_BASE">
+		<bitfield name="BASE" low="5" high="31" shr="5" type="hex"/>
+	</reg32>
+	<reg32 offset="0x20fe" name="RB_COPY_DEST_PITCH">
+		<doc>actually, appears to be pitch in bytes, so really is a stride</doc>
+		<!-- not actually sure about max pitch... -->
+		<bitfield name="PITCH" low="0" high="31" shr="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0x20ff" name="RB_COPY_DEST_INFO">
+		<bitfield name="FORMAT" low="2" high="7" type="a4xx_color_fmt"/>
+		<bitfield name="SWAP" low="8" high="9" type="a3xx_color_swap"/>
+		<bitfield name="DITHER_MODE" low="10" high="11" type="adreno_rb_dither_mode"/>
+		<bitfield name="COMPONENT_ENABLE" low="14" high="17" type="hex"/>
+		<bitfield name="ENDIAN" low="18" high="20" type="adreno_rb_surface_endian"/>
+		<bitfield name="TILE" low="24" high="25" type="a4xx_tile_mode"/>
+	</reg32>
+	<reg32 offset="0x2100" name="RB_FS_OUTPUT_REG">
+		<!-- bit0 set except for binning pass.. -->
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+		<bitfield name="FRAG_WRITES_Z" pos="5" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2101" name="RB_DEPTH_CONTROL">
+		<!--
+			guessing that this matches a2xx with the stencil fields
+			moved out into RB_STENCIL_CONTROL?
+		 -->
+		<bitfield name="FRAG_WRITES_Z" pos="0" type="boolean"/>
+		<bitfield name="Z_TEST_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="ZFUNC" low="4" high="6" type="adreno_compare_func"/>
+		<bitfield name="Z_CLAMP_ENABLE" pos="7" type="boolean"/>
+		<bitfield name="EARLY_Z_DISABLE" pos="16" type="boolean"/>
+		<bitfield name="FORCE_FRAGZ_TO_FS" pos="17" type="boolean"/>
+		<doc>Z_READ_ENABLE bit is set for zfunc other than GL_ALWAYS or GL_NEVER</doc>
+		<bitfield name="Z_READ_ENABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2102" name="RB_DEPTH_CLEAR"/>
+	<reg32 offset="0x2103" name="RB_DEPTH_INFO">
+		<bitfield name="DEPTH_FORMAT" low="0" high="1" type="a4xx_depth_format"/>
+		<doc>
+			DEPTH_BASE is offset in GMEM to depth/stencil buffer, ie
+			bin_w * bin_h / 1024 (possible rounded up to multiple of
+			something??  ie. 39 becomes 40, 78 becomes 80.. 75 becomes
+			80.. so maybe it needs to be multiple of 8??
+		</doc>
+		<bitfield name="DEPTH_BASE" low="12" high="31" shr="12" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2104" name="RB_DEPTH_PITCH" shr="5" type="uint">
+		<doc>stride of depth/stencil buffer</doc>
+	</reg32>
+	<reg32 offset="0x2105" name="RB_DEPTH_PITCH2" shr="5" type="uint">
+		<doc>???</doc>
+	</reg32>
+	<reg32 offset="0x2106" name="RB_STENCIL_CONTROL">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="STENCIL_ENABLE_BF" pos="1" type="boolean"/>
+		<!--
+			set for stencil operations that require read from stencil
+			buffer, but not for example for stencil clear (which does
+			not require read).. so guessing this is analogous to
+			READ_DEST_ENABLE for color buffer..
+		 -->
+		<bitfield name="STENCIL_READ" pos="2" type="boolean"/>
+		<bitfield name="FUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="FAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="FUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="FAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0x2107" name="RB_STENCIL_CONTROL2">
+		<!--
+		This seems to be set by blob if there is a stencil buffer
+		at all in GMEM, regardless of whether it is enabled for
+		a particular draw (ie. RB_STENCIL_CONTROL).  Not really
+		sure if that is required or just a quirk of the blob
+		-->
+		<bitfield name="STENCIL_BUFFER" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2108" name="RB_STENCIL_INFO">
+		<bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+		<doc>Base address for stencil when not using interleaved depth/stencil</doc>
+		<bitfield name="STENCIL_BASE" low="12" high="31" shr="12" type="hex"/>
+	</reg32>
+	<reg32 offset="0x2109" name="RB_STENCIL_PITCH" shr="5" type="uint">
+		<doc>pitch of stencil buffer when not using interleaved depth/stencil</doc>
+	</reg32>
+
+	<reg32 offset="0x210b" name="RB_STENCILREFMASK" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x210c" name="RB_STENCILREFMASK_BF" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0x210d" name="RB_BIN_OFFSET" type="adreno_reg_xy"/>
+	<array offset="0x2120" name="RB_VPORT_Z_CLAMP" stride="2" length="16">
+		<reg32 offset="0x0" name="MIN"/>
+		<reg32 offset="0x1" name="MAX"/>
+	</array>
+
+	<!-- RBBM registers -->
+	<reg32 offset="0x0000" name="RBBM_HW_VERSION"/>
+	<reg32 offset="0x0002" name="RBBM_HW_CONFIGURATION"/>
+	<array offset="0x4" name="RBBM_CLOCK_CTL_TP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x8" name="RBBM_CLOCK_CTL2_TP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0xc" name="RBBM_CLOCK_HYST_TP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x10" name="RBBM_CLOCK_DELAY_TP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x0014" name="RBBM_CLOCK_CTL_UCHE "/>
+	<reg32 offset="0x0015" name="RBBM_CLOCK_CTL2_UCHE"/>
+	<reg32 offset="0x0016" name="RBBM_CLOCK_CTL3_UCHE"/>
+	<reg32 offset="0x0017" name="RBBM_CLOCK_CTL4_UCHE"/>
+	<reg32 offset="0x0018" name="RBBM_CLOCK_HYST_UCHE"/>
+	<reg32 offset="0x0019" name="RBBM_CLOCK_DELAY_UCHE"/>
+	<reg32 offset="0x001a" name="RBBM_CLOCK_MODE_GPC"/>
+	<reg32 offset="0x001b" name="RBBM_CLOCK_DELAY_GPC"/>
+	<reg32 offset="0x001c" name="RBBM_CLOCK_HYST_GPC"/>
+	<reg32 offset="0x001d" name="RBBM_CLOCK_CTL_TSE_RAS_RBBM"/>
+	<reg32 offset="0x001e" name="RBBM_CLOCK_HYST_TSE_RAS_RBBM"/>
+	<reg32 offset="0x001f" name="RBBM_CLOCK_DELAY_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0020" name="RBBM_CLOCK_CTL"/>
+	<reg32 offset="0x0021" name="RBBM_SP_HYST_CNT"/>
+	<reg32 offset="0x0022" name="RBBM_SW_RESET_CMD"/>
+	<reg32 offset="0x0023" name="RBBM_AHB_CTL0"/>
+	<reg32 offset="0x0024" name="RBBM_AHB_CTL1"/>
+	<reg32 offset="0x0025" name="RBBM_AHB_CMD"/>
+	<reg32 offset="0x0026" name="RBBM_RB_SUB_BLOCK_SEL_CTL"/>
+	<reg32 offset="0x0028" name="RBBM_RAM_ACC_63_32"/>
+	<reg32 offset="0x002b" name="RBBM_WAIT_IDLE_CLOCKS_CTL"/>
+	<reg32 offset="0x002f" name="RBBM_INTERFACE_HANG_INT_CTL"/>
+	<reg32 offset="0x0034" name="RBBM_INTERFACE_HANG_MASK_CTL4"/>
+	<reg32 offset="0x0036" name="RBBM_INT_CLEAR_CMD"/>
+	<reg32 offset="0x0037" name="RBBM_INT_0_MASK"/>
+	<reg32 offset="0x003e" name="RBBM_RBBM_CTL"/>
+	<reg32 offset="0x003f" name="RBBM_AHB_DEBUG_CTL"/>
+	<reg32 offset="0x0041" name="RBBM_VBIF_DEBUG_CTL"/>
+	<reg32 offset="0x0042" name="RBBM_CLOCK_CTL2"/>
+	<reg32 offset="0x0045" name="RBBM_BLOCK_SW_RESET_CMD"/>
+	<reg32 offset="0x0047" name="RBBM_RESET_CYCLES"/>
+	<reg32 offset="0x0049" name="RBBM_EXT_TRACE_BUS_CTL"/>
+	<reg32 offset="0x004a" name="RBBM_CFG_DEBBUS_SEL_A"/>
+	<reg32 offset="0x004b" name="RBBM_CFG_DEBBUS_SEL_B"/>
+	<reg32 offset="0x004c" name="RBBM_CFG_DEBBUS_SEL_C"/>
+	<reg32 offset="0x004d" name="RBBM_CFG_DEBBUS_SEL_D"/>
+	<reg32 offset="0x0098" name="RBBM_POWER_CNTL_IP">
+		<bitfield name="SW_COLLAPSE" pos="0" type="boolean"/>
+		<bitfield name="SP_TP_PWR_ON" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x009c" name="RBBM_PERFCTR_CP_0_LO"/>
+	<reg32 offset="0x009d" name="RBBM_PERFCTR_CP_0_HI"/>
+	<reg32 offset="0x009e" name="RBBM_PERFCTR_CP_1_LO"/>
+	<reg32 offset="0x009f" name="RBBM_PERFCTR_CP_1_HI"/>
+	<reg32 offset="0x00a0" name="RBBM_PERFCTR_CP_2_LO"/>
+	<reg32 offset="0x00a1" name="RBBM_PERFCTR_CP_2_HI"/>
+	<reg32 offset="0x00a2" name="RBBM_PERFCTR_CP_3_LO"/>
+	<reg32 offset="0x00a3" name="RBBM_PERFCTR_CP_3_HI"/>
+	<reg32 offset="0x00a4" name="RBBM_PERFCTR_CP_4_LO"/>
+	<reg32 offset="0x00a5" name="RBBM_PERFCTR_CP_4_HI"/>
+	<reg32 offset="0x00a6" name="RBBM_PERFCTR_CP_5_LO"/>
+	<reg32 offset="0x00a7" name="RBBM_PERFCTR_CP_5_HI"/>
+	<reg32 offset="0x00a8" name="RBBM_PERFCTR_CP_6_LO"/>
+	<reg32 offset="0x00a9" name="RBBM_PERFCTR_CP_6_HI"/>
+	<reg32 offset="0x00aa" name="RBBM_PERFCTR_CP_7_LO"/>
+	<reg32 offset="0x00ab" name="RBBM_PERFCTR_CP_7_HI"/>
+	<reg32 offset="0x00ac" name="RBBM_PERFCTR_RBBM_0_LO"/>
+	<reg32 offset="0x00ad" name="RBBM_PERFCTR_RBBM_0_HI"/>
+	<reg32 offset="0x00ae" name="RBBM_PERFCTR_RBBM_1_LO"/>
+	<reg32 offset="0x00af" name="RBBM_PERFCTR_RBBM_1_HI"/>
+	<reg32 offset="0x00b0" name="RBBM_PERFCTR_RBBM_2_LO"/>
+	<reg32 offset="0x00b1" name="RBBM_PERFCTR_RBBM_2_HI"/>
+	<reg32 offset="0x00b2" name="RBBM_PERFCTR_RBBM_3_LO"/>
+	<reg32 offset="0x00b3" name="RBBM_PERFCTR_RBBM_3_HI"/>
+	<reg32 offset="0x00b4" name="RBBM_PERFCTR_PC_0_LO"/>
+	<reg32 offset="0x00b5" name="RBBM_PERFCTR_PC_0_HI"/>
+	<reg32 offset="0x00b6" name="RBBM_PERFCTR_PC_1_LO"/>
+	<reg32 offset="0x00b7" name="RBBM_PERFCTR_PC_1_HI"/>
+	<reg32 offset="0x00b8" name="RBBM_PERFCTR_PC_2_LO"/>
+	<reg32 offset="0x00b9" name="RBBM_PERFCTR_PC_2_HI"/>
+	<reg32 offset="0x00ba" name="RBBM_PERFCTR_PC_3_LO"/>
+	<reg32 offset="0x00bb" name="RBBM_PERFCTR_PC_3_HI"/>
+	<reg32 offset="0x00bc" name="RBBM_PERFCTR_PC_4_LO"/>
+	<reg32 offset="0x00bd" name="RBBM_PERFCTR_PC_4_HI"/>
+	<reg32 offset="0x00be" name="RBBM_PERFCTR_PC_5_LO"/>
+	<reg32 offset="0x00bf" name="RBBM_PERFCTR_PC_5_HI"/>
+	<reg32 offset="0x00c0" name="RBBM_PERFCTR_PC_6_LO"/>
+	<reg32 offset="0x00c1" name="RBBM_PERFCTR_PC_6_HI"/>
+	<reg32 offset="0x00c2" name="RBBM_PERFCTR_PC_7_LO"/>
+	<reg32 offset="0x00c3" name="RBBM_PERFCTR_PC_7_HI"/>
+	<reg32 offset="0x00c4" name="RBBM_PERFCTR_VFD_0_LO"/>
+	<reg32 offset="0x00c5" name="RBBM_PERFCTR_VFD_0_HI"/>
+	<reg32 offset="0x00c6" name="RBBM_PERFCTR_VFD_1_LO"/>
+	<reg32 offset="0x00c7" name="RBBM_PERFCTR_VFD_1_HI"/>
+	<reg32 offset="0x00c8" name="RBBM_PERFCTR_VFD_2_LO"/>
+	<reg32 offset="0x00c9" name="RBBM_PERFCTR_VFD_2_HI"/>
+	<reg32 offset="0x00ca" name="RBBM_PERFCTR_VFD_3_LO"/>
+	<reg32 offset="0x00cb" name="RBBM_PERFCTR_VFD_3_HI"/>
+	<reg32 offset="0x00cc" name="RBBM_PERFCTR_VFD_4_LO"/>
+	<reg32 offset="0x00cd" name="RBBM_PERFCTR_VFD_4_HI"/>
+	<reg32 offset="0x00ce" name="RBBM_PERFCTR_VFD_5_LO"/>
+	<reg32 offset="0x00cf" name="RBBM_PERFCTR_VFD_5_HI"/>
+	<reg32 offset="0x00d0" name="RBBM_PERFCTR_VFD_6_LO"/>
+	<reg32 offset="0x00d1" name="RBBM_PERFCTR_VFD_6_HI"/>
+	<reg32 offset="0x00d2" name="RBBM_PERFCTR_VFD_7_LO"/>
+	<reg32 offset="0x00d3" name="RBBM_PERFCTR_VFD_7_HI"/>
+	<reg32 offset="0x00d4" name="RBBM_PERFCTR_HLSQ_0_LO"/>
+	<reg32 offset="0x00d5" name="RBBM_PERFCTR_HLSQ_0_HI"/>
+	<reg32 offset="0x00d6" name="RBBM_PERFCTR_HLSQ_1_LO"/>
+	<reg32 offset="0x00d7" name="RBBM_PERFCTR_HLSQ_1_HI"/>
+	<reg32 offset="0x00d8" name="RBBM_PERFCTR_HLSQ_2_LO"/>
+	<reg32 offset="0x00d9" name="RBBM_PERFCTR_HLSQ_2_HI"/>
+	<reg32 offset="0x00da" name="RBBM_PERFCTR_HLSQ_3_LO"/>
+	<reg32 offset="0x00db" name="RBBM_PERFCTR_HLSQ_3_HI"/>
+	<reg32 offset="0x00dc" name="RBBM_PERFCTR_HLSQ_4_LO"/>
+	<reg32 offset="0x00dd" name="RBBM_PERFCTR_HLSQ_4_HI"/>
+	<reg32 offset="0x00de" name="RBBM_PERFCTR_HLSQ_5_LO"/>
+	<reg32 offset="0x00df" name="RBBM_PERFCTR_HLSQ_5_HI"/>
+	<reg32 offset="0x00e0" name="RBBM_PERFCTR_HLSQ_6_LO"/>
+	<reg32 offset="0x00e1" name="RBBM_PERFCTR_HLSQ_6_HI"/>
+	<reg32 offset="0x00e2" name="RBBM_PERFCTR_HLSQ_7_LO"/>
+	<reg32 offset="0x00e3" name="RBBM_PERFCTR_HLSQ_7_HI"/>
+	<reg32 offset="0x00e4" name="RBBM_PERFCTR_VPC_0_LO"/>
+	<reg32 offset="0x00e5" name="RBBM_PERFCTR_VPC_0_HI"/>
+	<reg32 offset="0x00e6" name="RBBM_PERFCTR_VPC_1_LO"/>
+	<reg32 offset="0x00e7" name="RBBM_PERFCTR_VPC_1_HI"/>
+	<reg32 offset="0x00e8" name="RBBM_PERFCTR_VPC_2_LO"/>
+	<reg32 offset="0x00e9" name="RBBM_PERFCTR_VPC_2_HI"/>
+	<reg32 offset="0x00ea" name="RBBM_PERFCTR_VPC_3_LO"/>
+	<reg32 offset="0x00eb" name="RBBM_PERFCTR_VPC_3_HI"/>
+	<reg32 offset="0x00ec" name="RBBM_PERFCTR_CCU_0_LO"/>
+	<reg32 offset="0x00ed" name="RBBM_PERFCTR_CCU_0_HI"/>
+	<reg32 offset="0x00ee" name="RBBM_PERFCTR_CCU_1_LO"/>
+	<reg32 offset="0x00ef" name="RBBM_PERFCTR_CCU_1_HI"/>
+	<reg32 offset="0x00f0" name="RBBM_PERFCTR_CCU_2_LO"/>
+	<reg32 offset="0x00f1" name="RBBM_PERFCTR_CCU_2_HI"/>
+	<reg32 offset="0x00f2" name="RBBM_PERFCTR_CCU_3_LO"/>
+	<reg32 offset="0x00f3" name="RBBM_PERFCTR_CCU_3_HI"/>
+	<reg32 offset="0x00f4" name="RBBM_PERFCTR_TSE_0_LO"/>
+	<reg32 offset="0x00f5" name="RBBM_PERFCTR_TSE_0_HI"/>
+	<reg32 offset="0x00f6" name="RBBM_PERFCTR_TSE_1_LO"/>
+	<reg32 offset="0x00f7" name="RBBM_PERFCTR_TSE_1_HI"/>
+	<reg32 offset="0x00f8" name="RBBM_PERFCTR_TSE_2_LO"/>
+	<reg32 offset="0x00f9" name="RBBM_PERFCTR_TSE_2_HI"/>
+	<reg32 offset="0x00fa" name="RBBM_PERFCTR_TSE_3_LO"/>
+	<reg32 offset="0x00fb" name="RBBM_PERFCTR_TSE_3_HI"/>
+	<reg32 offset="0x00fc" name="RBBM_PERFCTR_RAS_0_LO"/>
+	<reg32 offset="0x00fd" name="RBBM_PERFCTR_RAS_0_HI"/>
+	<reg32 offset="0x00fe" name="RBBM_PERFCTR_RAS_1_LO"/>
+	<reg32 offset="0x00ff" name="RBBM_PERFCTR_RAS_1_HI"/>
+	<reg32 offset="0x0100" name="RBBM_PERFCTR_RAS_2_LO"/>
+	<reg32 offset="0x0101" name="RBBM_PERFCTR_RAS_2_HI"/>
+	<reg32 offset="0x0102" name="RBBM_PERFCTR_RAS_3_LO"/>
+	<reg32 offset="0x0103" name="RBBM_PERFCTR_RAS_3_HI"/>
+	<reg32 offset="0x0104" name="RBBM_PERFCTR_UCHE_0_LO"/>
+	<reg32 offset="0x0105" name="RBBM_PERFCTR_UCHE_0_HI"/>
+	<reg32 offset="0x0106" name="RBBM_PERFCTR_UCHE_1_LO"/>
+	<reg32 offset="0x0107" name="RBBM_PERFCTR_UCHE_1_HI"/>
+	<reg32 offset="0x0108" name="RBBM_PERFCTR_UCHE_2_LO"/>
+	<reg32 offset="0x0109" name="RBBM_PERFCTR_UCHE_2_HI"/>
+	<reg32 offset="0x010a" name="RBBM_PERFCTR_UCHE_3_LO"/>
+	<reg32 offset="0x010b" name="RBBM_PERFCTR_UCHE_3_HI"/>
+	<reg32 offset="0x010c" name="RBBM_PERFCTR_UCHE_4_LO"/>
+	<reg32 offset="0x010d" name="RBBM_PERFCTR_UCHE_4_HI"/>
+	<reg32 offset="0x010e" name="RBBM_PERFCTR_UCHE_5_LO"/>
+	<reg32 offset="0x010f" name="RBBM_PERFCTR_UCHE_5_HI"/>
+	<reg32 offset="0x0110" name="RBBM_PERFCTR_UCHE_6_LO"/>
+	<reg32 offset="0x0111" name="RBBM_PERFCTR_UCHE_6_HI"/>
+	<reg32 offset="0x0112" name="RBBM_PERFCTR_UCHE_7_LO"/>
+	<reg32 offset="0x0113" name="RBBM_PERFCTR_UCHE_7_HI"/>
+	<reg32 offset="0x0114" name="RBBM_PERFCTR_TP_0_LO"/>
+	<reg32 offset="0x0115" name="RBBM_PERFCTR_TP_0_HI"/>
+	<reg32 offset="0x0116" name="RBBM_PERFCTR_TP_1_LO"/>
+	<reg32 offset="0x0117" name="RBBM_PERFCTR_TP_1_HI"/>
+	<reg32 offset="0x0118" name="RBBM_PERFCTR_TP_2_LO"/>
+	<reg32 offset="0x0119" name="RBBM_PERFCTR_TP_2_HI"/>
+	<reg32 offset="0x011a" name="RBBM_PERFCTR_TP_3_LO"/>
+	<reg32 offset="0x011b" name="RBBM_PERFCTR_TP_3_HI"/>
+	<reg32 offset="0x011c" name="RBBM_PERFCTR_TP_4_LO"/>
+	<reg32 offset="0x011d" name="RBBM_PERFCTR_TP_4_HI"/>
+	<reg32 offset="0x011e" name="RBBM_PERFCTR_TP_5_LO"/>
+	<reg32 offset="0x011f" name="RBBM_PERFCTR_TP_5_HI"/>
+	<reg32 offset="0x0120" name="RBBM_PERFCTR_TP_6_LO"/>
+	<reg32 offset="0x0121" name="RBBM_PERFCTR_TP_6_HI"/>
+	<reg32 offset="0x0122" name="RBBM_PERFCTR_TP_7_LO"/>
+	<reg32 offset="0x0123" name="RBBM_PERFCTR_TP_7_HI"/>
+	<reg32 offset="0x0124" name="RBBM_PERFCTR_SP_0_LO"/>
+	<reg32 offset="0x0125" name="RBBM_PERFCTR_SP_0_HI"/>
+	<reg32 offset="0x0126" name="RBBM_PERFCTR_SP_1_LO"/>
+	<reg32 offset="0x0127" name="RBBM_PERFCTR_SP_1_HI"/>
+	<reg32 offset="0x0128" name="RBBM_PERFCTR_SP_2_LO"/>
+	<reg32 offset="0x0129" name="RBBM_PERFCTR_SP_2_HI"/>
+	<reg32 offset="0x012a" name="RBBM_PERFCTR_SP_3_LO"/>
+	<reg32 offset="0x012b" name="RBBM_PERFCTR_SP_3_HI"/>
+	<reg32 offset="0x012c" name="RBBM_PERFCTR_SP_4_LO"/>
+	<reg32 offset="0x012d" name="RBBM_PERFCTR_SP_4_HI"/>
+	<reg32 offset="0x012e" name="RBBM_PERFCTR_SP_5_LO"/>
+	<reg32 offset="0x012f" name="RBBM_PERFCTR_SP_5_HI"/>
+	<reg32 offset="0x0130" name="RBBM_PERFCTR_SP_6_LO"/>
+	<reg32 offset="0x0131" name="RBBM_PERFCTR_SP_6_HI"/>
+	<reg32 offset="0x0132" name="RBBM_PERFCTR_SP_7_LO"/>
+	<reg32 offset="0x0133" name="RBBM_PERFCTR_SP_7_HI"/>
+	<reg32 offset="0x0134" name="RBBM_PERFCTR_SP_8_LO"/>
+	<reg32 offset="0x0135" name="RBBM_PERFCTR_SP_8_HI"/>
+	<reg32 offset="0x0136" name="RBBM_PERFCTR_SP_9_LO"/>
+	<reg32 offset="0x0137" name="RBBM_PERFCTR_SP_9_HI"/>
+	<reg32 offset="0x0138" name="RBBM_PERFCTR_SP_10_LO"/>
+	<reg32 offset="0x0139" name="RBBM_PERFCTR_SP_10_HI"/>
+	<reg32 offset="0x013a" name="RBBM_PERFCTR_SP_11_LO"/>
+	<reg32 offset="0x013b" name="RBBM_PERFCTR_SP_11_HI"/>
+	<reg32 offset="0x013c" name="RBBM_PERFCTR_RB_0_LO"/>
+	<reg32 offset="0x013d" name="RBBM_PERFCTR_RB_0_HI"/>
+	<reg32 offset="0x013e" name="RBBM_PERFCTR_RB_1_LO"/>
+	<reg32 offset="0x013f" name="RBBM_PERFCTR_RB_1_HI"/>
+	<reg32 offset="0x0140" name="RBBM_PERFCTR_RB_2_LO"/>
+	<reg32 offset="0x0141" name="RBBM_PERFCTR_RB_2_HI"/>
+	<reg32 offset="0x0142" name="RBBM_PERFCTR_RB_3_LO"/>
+	<reg32 offset="0x0143" name="RBBM_PERFCTR_RB_3_HI"/>
+	<reg32 offset="0x0144" name="RBBM_PERFCTR_RB_4_LO"/>
+	<reg32 offset="0x0145" name="RBBM_PERFCTR_RB_4_HI"/>
+	<reg32 offset="0x0146" name="RBBM_PERFCTR_RB_5_LO"/>
+	<reg32 offset="0x0147" name="RBBM_PERFCTR_RB_5_HI"/>
+	<reg32 offset="0x0148" name="RBBM_PERFCTR_RB_6_LO"/>
+	<reg32 offset="0x0149" name="RBBM_PERFCTR_RB_6_HI"/>
+	<reg32 offset="0x014a" name="RBBM_PERFCTR_RB_7_LO"/>
+	<reg32 offset="0x014b" name="RBBM_PERFCTR_RB_7_HI"/>
+	<reg32 offset="0x014c" name="RBBM_PERFCTR_VSC_0_LO"/>
+	<reg32 offset="0x014d" name="RBBM_PERFCTR_VSC_0_HI"/>
+	<reg32 offset="0x014e" name="RBBM_PERFCTR_VSC_1_LO"/>
+	<reg32 offset="0x014f" name="RBBM_PERFCTR_VSC_1_HI"/>
+	<reg32 offset="0x0166" name="RBBM_PERFCTR_PWR_0_LO"/>
+	<reg32 offset="0x0167" name="RBBM_PERFCTR_PWR_0_HI"/>
+	<reg32 offset="0x0168" name="RBBM_PERFCTR_PWR_1_LO"/>
+	<reg32 offset="0x0169" name="RBBM_PERFCTR_PWR_1_HI"/>
+	<reg32 offset="0x016e" name="RBBM_ALWAYSON_COUNTER_LO"/>
+	<reg32 offset="0x016f" name="RBBM_ALWAYSON_COUNTER_HI"/>
+	<array offset="0x0068" name="RBBM_CLOCK_CTL_SP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x006c" name="RBBM_CLOCK_CTL2_SP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0070" name="RBBM_CLOCK_HYST_SP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0074" name="RBBM_CLOCK_DELAY_SP" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0078" name="RBBM_CLOCK_CTL_RB" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x007c" name="RBBM_CLOCK_CTL2_RB" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0082" name="RBBM_CLOCK_CTL_MARB_CCU" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0086" name="RBBM_CLOCK_HYST_RB_MARB_CCU" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x0080" name="RBBM_CLOCK_HYST_COM_DCOM"/>
+	<reg32 offset="0x0081" name="RBBM_CLOCK_CTL_COM_DCOM"/>
+	<reg32 offset="0x008a" name="RBBM_CLOCK_CTL_HLSQ"/>
+	<reg32 offset="0x008b" name="RBBM_CLOCK_HYST_HLSQ"/>
+	<reg32 offset="0x008c" name="RBBM_CLOCK_DELAY_HLSQ"/>
+	<bitset name="A4XX_CGC_HLSQ">
+		<bitfield name="EARLY_CYC" low="20" high="22" type="uint"/>
+	</bitset>
+	<reg32 offset="0x008d" name="RBBM_CLOCK_DELAY_COM_DCOM"/>
+	<array offset="0x008e" name="RBBM_CLOCK_DELAY_RB_MARB_CCU_L1" stride="1" length="4">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<bitset name="A4XX_INT0">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="RBBM_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="RBBM_REG_TIMEOUT" pos="2" type="boolean"/>
+		<bitfield name="RBBM_ME_MS_TIMEOUT" pos="3" type="boolean"/>
+		<bitfield name="RBBM_PFP_MS_TIMEOUT" pos="4" type="boolean"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="5" type="boolean"/>
+		<bitfield name="VFD_ERROR" pos="6" type="boolean"/>
+		<bitfield name="CP_SW_INT" pos="7" type="boolean"/>
+		<bitfield name="CP_T0_PACKET_IN_IB" pos="8" type="boolean"/>
+		<bitfield name="CP_OPCODE_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_RESERVED_BIT_ERROR" pos="10" type="boolean"/>
+		<bitfield name="CP_HW_FAULT" pos="11" type="boolean"/>
+		<bitfield name="CP_DMA" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2_INT" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1_INT" pos="14" type="boolean"/>
+		<bitfield name="CP_RB_INT" pos="15" type="boolean"/>
+		<bitfield name="CP_REG_PROTECT_FAULT" pos="16" type="boolean"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_VS_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="CP_PS_DONE_TS" pos="19" type="boolean"/>
+		<bitfield name="CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR_HALT" pos="21" type="boolean"/>
+		<bitfield name="MISC_HANG_DETECT" pos="24" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="25" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x0099" name="RBBM_SP_REGFILE_SLEEP_CNTL_0"/>
+	<reg32 offset="0x009a" name="RBBM_SP_REGFILE_SLEEP_CNTL_1"/>
+	<reg32 offset="0x0170" name="RBBM_PERFCTR_CTL"/>
+	<reg32 offset="0x0171" name="RBBM_PERFCTR_LOAD_CMD0"/>
+	<reg32 offset="0x0172" name="RBBM_PERFCTR_LOAD_CMD1"/>
+	<reg32 offset="0x0173" name="RBBM_PERFCTR_LOAD_CMD2"/>
+	<reg32 offset="0x0174" name="RBBM_PERFCTR_LOAD_VALUE_LO"/>
+	<reg32 offset="0x0175" name="RBBM_PERFCTR_LOAD_VALUE_HI"/>
+	<reg32 offset="0x0176" name="RBBM_PERFCTR_RBBM_SEL_0" type="a4xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0177" name="RBBM_PERFCTR_RBBM_SEL_1" type="a4xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0178" name="RBBM_PERFCTR_RBBM_SEL_2" type="a4xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x0179" name="RBBM_PERFCTR_RBBM_SEL_3" type="a4xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x017a" name="RBBM_GPU_BUSY_MASKED"/>
+	<reg32 offset="0x017d" name="RBBM_INT_0_STATUS"/>
+	<reg32 offset="0x0182" name="RBBM_CLOCK_STATUS"/>
+	<reg32 offset="0x0189" name="RBBM_AHB_STATUS"/>
+	<reg32 offset="0x018c" name="RBBM_AHB_ME_SPLIT_STATUS"/>
+	<reg32 offset="0x018d" name="RBBM_AHB_PFP_SPLIT_STATUS"/>
+	<reg32 offset="0x018f" name="RBBM_AHB_ERROR_STATUS"/>
+	<reg32 offset="0x0191" name="RBBM_STATUS">
+		<bitfield name="HI_BUSY" pos="0" type="boolean"/>
+		<bitfield name="CP_ME_BUSY" pos="1" type="boolean"/>
+		<bitfield name="CP_PFP_BUSY" pos="2" type="boolean"/>
+		<bitfield name="CP_NRT_BUSY" pos="14" type="boolean"/>
+		<bitfield name="VBIF_BUSY" pos="15" type="boolean"/>
+		<bitfield name="TSE_BUSY" pos="16" type="boolean"/>
+		<bitfield name="RAS_BUSY" pos="17" type="boolean"/>
+		<bitfield name="RB_BUSY" pos="18" type="boolean"/>
+		<bitfield name="PC_DCALL_BUSY" pos="19" type="boolean"/>
+		<bitfield name="PC_VSD_BUSY" pos="20" type="boolean"/>
+		<bitfield name="VFD_BUSY" pos="21" type="boolean"/>
+		<bitfield name="VPC_BUSY" pos="22" type="boolean"/>
+		<bitfield name="UCHE_BUSY" pos="23" type="boolean"/>
+		<bitfield name="SP_BUSY" pos="24" type="boolean"/>
+		<bitfield name="TPL1_BUSY" pos="25" type="boolean"/>
+		<bitfield name="MARB_BUSY" pos="26" type="boolean"/>
+		<bitfield name="VSC_BUSY" pos="27" type="boolean"/>
+		<bitfield name="ARB_BUSY" pos="28" type="boolean"/>
+		<bitfield name="HLSQ_BUSY" pos="29" type="boolean"/>
+		<bitfield name="GPU_BUSY_NOHC" pos="30" type="boolean"/>
+		<bitfield name="GPU_BUSY" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x019f" name="RBBM_INTERFACE_RRDY_STATUS5"/>
+	<reg32 offset="0x01b0" name="RBBM_POWER_STATUS">
+		<bitfield name="SP_TP_PWR_ON" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01b8" name="RBBM_WAIT_IDLE_CLOCKS_CTL2"/>
+
+	<!-- CP registers -->
+	<reg32 offset="0x0228" name="CP_SCRATCH_UMASK"/>
+	<reg32 offset="0x0229" name="CP_SCRATCH_ADDR"/>
+	<reg32 offset="0x0200" name="CP_RB_BASE"/>
+	<reg32 offset="0x0201" name="CP_RB_CNTL"/>
+	<reg32 offset="0x0205" name="CP_RB_WPTR"/>
+	<reg32 offset="0x0203" name="CP_RB_RPTR_ADDR"/>
+	<reg32 offset="0x0204" name="CP_RB_RPTR"/>
+	<reg32 offset="0x0206" name="CP_IB1_BASE"/>
+	<reg32 offset="0x0207" name="CP_IB1_BUFSZ"/>
+	<reg32 offset="0x0208" name="CP_IB2_BASE"/>
+	<reg32 offset="0x0209" name="CP_IB2_BUFSZ"/>
+	<reg32 offset="0x020c" name="CP_ME_NRT_ADDR"/>
+	<reg32 offset="0x020d" name="CP_ME_NRT_DATA"/>
+	<reg32 offset="0x0217" name="CP_ME_RB_DONE_DATA"/>
+	<reg32 offset="0x0219" name="CP_QUEUE_THRESH2"/>
+	<reg32 offset="0x021b" name="CP_MERCIU_SIZE"/>
+	<reg32 offset="0x021c" name="CP_ROQ_ADDR"/>
+	<reg32 offset="0x021d" name="CP_ROQ_DATA"/>
+	<reg32 offset="0x021e" name="CP_MEQ_ADDR"/>
+	<reg32 offset="0x021f" name="CP_MEQ_DATA"/>
+	<reg32 offset="0x0220" name="CP_MERCIU_ADDR"/>
+	<reg32 offset="0x0221" name="CP_MERCIU_DATA"/>
+	<reg32 offset="0x0222" name="CP_MERCIU_DATA2"/>
+	<reg32 offset="0x0223" name="CP_PFP_UCODE_ADDR"/>
+	<reg32 offset="0x0224" name="CP_PFP_UCODE_DATA"/>
+	<reg32 offset="0x0225" name="CP_ME_RAM_WADDR"/>
+	<reg32 offset="0x0226" name="CP_ME_RAM_RADDR"/>
+	<reg32 offset="0x0227" name="CP_ME_RAM_DATA"/>
+	<reg32 offset="0x022a" name="CP_PREEMPT"/>
+	<reg32 offset="0x022c" name="CP_CNTL"/>
+	<reg32 offset="0x022d" name="CP_ME_CNTL"/>
+	<reg32 offset="0x022e" name="CP_DEBUG"/>
+	<reg32 offset="0x0231" name="CP_DEBUG_ECO_CONTROL"/>
+	<reg32 offset="0x0232" name="CP_DRAW_STATE_ADDR"/>
+	<array offset="0x0240" name="CP_PROTECT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG" type="adreno_cp_protect"/>
+	</array>
+	<reg32 offset="0x0250" name="CP_PROTECT_CTRL"/>
+	<reg32 offset="0x04c0" name="CP_ST_BASE"/>
+	<reg32 offset="0x04ce" name="CP_STQ_AVAIL"/>
+	<reg32 offset="0x04d0" name="CP_MERCIU_STAT"/>
+	<reg32 offset="0x04d2" name="CP_WFI_PEND_CTR"/>
+	<reg32 offset="0x04d8" name="CP_HW_FAULT"/>
+	<reg32 offset="0x04da" name="CP_PROTECT_STATUS"/>
+	<reg32 offset="0x04dd" name="CP_EVENTS_IN_FLIGHT"/>
+	<reg32 offset="0x0500" name="CP_PERFCTR_CP_SEL_0" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0501" name="CP_PERFCTR_CP_SEL_1" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0502" name="CP_PERFCTR_CP_SEL_2" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0503" name="CP_PERFCTR_CP_SEL_3" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0504" name="CP_PERFCTR_CP_SEL_4" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0505" name="CP_PERFCTR_CP_SEL_5" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0506" name="CP_PERFCTR_CP_SEL_6" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0507" name="CP_PERFCTR_CP_SEL_7" type="a4xx_cp_perfcounter_select"/>
+	<reg32 offset="0x050b" name="CP_PERFCOMBINER_SELECT"/>
+	<array offset="0x0578" name="CP_SCRATCH" stride="1" length="23">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+
+
+	<!-- SP registers -->
+	<reg32 offset="0x0ec0" name="SP_VS_STATUS"/>
+	<reg32 offset="0x0ec3" name="SP_MODE_CONTROL"/>
+
+	<reg32 offset="0x0ec4" name="SP_PERFCTR_SP_SEL_0" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec5" name="SP_PERFCTR_SP_SEL_1" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec6" name="SP_PERFCTR_SP_SEL_2" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec7" name="SP_PERFCTR_SP_SEL_3" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec8" name="SP_PERFCTR_SP_SEL_4" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ec9" name="SP_PERFCTR_SP_SEL_5" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0eca" name="SP_PERFCTR_SP_SEL_6" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecb" name="SP_PERFCTR_SP_SEL_7" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecc" name="SP_PERFCTR_SP_SEL_8" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecd" name="SP_PERFCTR_SP_SEL_9" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ece" name="SP_PERFCTR_SP_SEL_10" type="a4xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ecf" name="SP_PERFCTR_SP_SEL_11" type="a4xx_sp_perfcounter_select"/>
+
+	<reg32 offset="0x22c0" name="SP_SP_CTRL_REG">
+		<bitfield name="BINNING_PASS" pos="19" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x22c1" name="SP_INSTR_CACHE_CTRL">
+		<!-- set when VS in buffer mode: -->
+		<bitfield name="VS_BUFFER" pos="7" type="boolean"/>
+		<!-- set when FS in buffer mode: -->
+		<bitfield name="FS_BUFFER" pos="8" type="boolean"/>
+		<!-- set when both VS or FS in buffer mode: -->
+		<bitfield name="INSTR_BUFFER" pos="10" type="boolean"/>
+		<!-- TODO other bits probably matter when other stages active? -->
+	</reg32>
+
+	<bitset name="a4xx_sp_vs_fs_ctrl_reg0" inline="yes">
+		<!--
+			NOTE that SP_{VS,FS}_CTRL_REG1 are different, but so far REG0
+			appears to be the same..
+		-->
+		<bitfield name="THREADMODE" pos="0" type="a3xx_threadmode"/>
+		<!-- VARYING bit only for FS.. think it controls emitting (ei) flag? -->
+		<bitfield name="VARYING" pos="1" type="boolean"/>
+		<!-- maybe CACHEINVALID is two bits?? -->
+		<bitfield name="CACHEINVALID" pos="2" type="boolean"/>
+		<doc>
+			The full/half register footprint is in units of four components,
+			so if r0.x is used, that counts as all of r0.[xyzw] as used.
+			There are separate full/half register footprint values as the
+			full and half registers are independent (not overlapping).
+			Presumably the thread scheduler hardware allocates the full/half
+			register names from the actual physical register file and
+			handles the register renaming.
+		</doc>
+		<bitfield name="HALFREGFOOTPRINT" low="4" high="9" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="10" high="15" type="uint"/>
+		<!-- maybe INOUTREGOVERLAP is a bitflag? -->
+		<bitfield name="INOUTREGOVERLAP" low="18" high="19" type="uint"/>
+		<bitfield name="THREADSIZE" pos="20" type="a3xx_threadsize"/>
+		<bitfield name="SUPERTHREADMODE" pos="21" type="boolean"/>
+		<bitfield name="PIXLODENABLE" pos="22" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x22c4" name="SP_VS_CTRL_REG0" type="a4xx_sp_vs_fs_ctrl_reg0"/>
+	<reg32 offset="0x22c5" name="SP_VS_CTRL_REG1">
+		<bitfield name="CONSTLENGTH" low="0" high="7" type="uint"/>
+		<bitfield name="INITIALOUTSTANDING" low="24" high="30" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22c6" name="SP_VS_PARAM_REG">
+		<bitfield name="POSREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="PSIZEREGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="TOTALVSOUTVAR" low="20" high="31" type="uint"/>
+	</reg32>
+	<array offset="0x22c7" name="SP_VS_OUT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="8" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="9" high="12" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="24" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="25" high="28" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0x22d8" name="SP_VS_VPC_DST" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				These seem to be offsets for storage of the varyings.
+				Always seems to start from 8, possibly loc 0 and 4
+				are for gl_Position and gl_PointSize?
+			</doc>
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0x22e0" name="SP_VS_OBJ_OFFSET_REG">
+		<!-- always 00000000: -->
+		<doc>
+			From register spec:
+			SP_FS_OBJ_OFFSET_REG.CONSTOBJECTSTARTOFFSET [16:24]: Constant object
+			start offset in on chip RAM,
+			128bit aligned
+		</doc>
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22e1" name="SP_VS_OBJ_START"/>
+	<reg32 offset="0x22e2" name="SP_VS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x22e3" name="SP_VS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x22e5" name="SP_VS_LENGTH_REG" type="uint"/>
+	<reg32 offset="0x22e8" name="SP_FS_CTRL_REG0" type="a4xx_sp_vs_fs_ctrl_reg0"/>
+	<reg32 offset="0x22e9" name="SP_FS_CTRL_REG1">
+		<bitfield name="CONSTLENGTH" low="0" high="7" type="uint"/>
+		<bitfield name="FACENESS" pos="19" type="boolean"/>
+		<bitfield name="VARYING" pos="20" type="boolean"/>
+		<bitfield name="FRAGCOORD" pos="21" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x22ea" name="SP_FS_OBJ_OFFSET_REG">
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x22eb" name="SP_FS_OBJ_START"/>
+	<reg32 offset="0x22ec" name="SP_FS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x22ed" name="SP_FS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x22ef" name="SP_FS_LENGTH_REG" type="uint"/>
+	<reg32 offset="0x22f0" name="SP_FS_OUTPUT_REG">
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+		<bitfield name="DEPTH_ENABLE" pos="7" type="boolean"/>
+		<!-- TODO double check.. for now assume same as a3xx -->
+		<bitfield name="DEPTH_REGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK_REGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<array offset="0x22f1" name="SP_FS_MRT" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="HALF_PRECISION" pos="8" type="boolean"/>
+			<bitfield name="COLOR_SINT" pos="10" type="boolean"/>
+			<bitfield name="COLOR_UINT" pos="11" type="boolean"/>
+			<bitfield name="MRTFORMAT" low="12" high="17" type="a4xx_color_fmt"/>
+			<bitfield name="COLOR_SRGB" pos="18" type="boolean"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x2300" name="SP_CS_CTRL_REG0" type="a4xx_sp_vs_fs_ctrl_reg0"/>
+	<reg32 offset="0x2301" name="SP_CS_OBJ_OFFSET_REG"/>
+	<reg32 offset="0x2302" name="SP_CS_OBJ_START"/>
+	<reg32 offset="0x2303" name="SP_CS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x2304" name="SP_CS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x2305" name="SP_CS_PVT_MEM_SIZE"/>
+	<reg32 offset="0x2306" name="SP_CS_LENGTH_REG" type="uint"/>
+	<reg32 offset="0x230d" name="SP_HS_OBJ_OFFSET_REG">
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x230e" name="SP_HS_OBJ_START"/>
+	<reg32 offset="0x230f" name="SP_HS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x2310" name="SP_HS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x2312" name="SP_HS_LENGTH_REG" type="uint"/>
+
+	<reg32 offset="0x231a" name="SP_DS_PARAM_REG">
+		<bitfield name="POSREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="TOTALGSOUTVAR" low="20" high="31" type="uint"/>
+	</reg32>
+	<array offset="0x231b" name="SP_DS_OUT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="8" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="9" high="12" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="24" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="25" high="28" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0x232c" name="SP_DS_VPC_DST" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				These seem to be offsets for storage of the varyings.
+				Always seems to start from 8, possibly loc 0 and 4
+				are for gl_Position and gl_PointSize?
+			</doc>
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x2334" name="SP_DS_OBJ_OFFSET_REG">
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2335" name="SP_DS_OBJ_START"/>
+	<reg32 offset="0x2336" name="SP_DS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x2337" name="SP_DS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x2339" name="SP_DS_LENGTH_REG" type="uint"/>
+
+	<reg32 offset="0x2341" name="SP_GS_PARAM_REG">
+		<bitfield name="POSREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="PRIMREGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="TOTALGSOUTVAR" low="20" high="31" type="uint"/>
+	</reg32>
+	<array offset="0x2342" name="SP_GS_OUT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="8" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="9" high="12" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="24" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="25" high="28" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0x2353" name="SP_GS_VPC_DST" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				These seem to be offsets for storage of the varyings.
+				Always seems to start from 8, possibly loc 0 and 4
+				are for gl_Position and gl_PointSize?
+			</doc>
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x235b" name="SP_GS_OBJ_OFFSET_REG">
+		<bitfield name="CONSTOBJECTOFFSET" low="16" high="24" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="25" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x235c" name="SP_GS_OBJ_START"/>
+	<reg32 offset="0x235d" name="SP_GS_PVT_MEM_PARAM"/>
+	<reg32 offset="0x235e" name="SP_GS_PVT_MEM_ADDR"/>
+	<reg32 offset="0x2360" name="SP_GS_LENGTH_REG" type="uint"/>
+
+	<!-- VPC registers -->
+	<reg32 offset="0x0e60" name="VPC_DEBUG_RAM_SEL"/>
+	<reg32 offset="0x0e61" name="VPC_DEBUG_RAM_READ"/>
+	<reg32 offset="0x0e64" name="VPC_DEBUG_ECO_CONTROL"/>
+	<reg32 offset="0x0e65" name="VPC_PERFCTR_VPC_SEL_0" type="a4xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e66" name="VPC_PERFCTR_VPC_SEL_1" type="a4xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e67" name="VPC_PERFCTR_VPC_SEL_2" type="a4xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e68" name="VPC_PERFCTR_VPC_SEL_3" type="a4xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x2140" name="VPC_ATTR">
+		<bitfield name="TOTALATTR" low="0" high="8" type="uint"/>
+		<!-- PSIZE bit set if gl_PointSize written: -->
+		<bitfield name="PSIZE" pos="9" type="boolean"/>
+		<bitfield name="THRDASSIGN" low="12" high="13" type="uint"/>
+		<bitfield name="ENABLE" pos="25" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2141" name="VPC_PACK">
+		<bitfield name="NUMBYPASSVAR" low="0" high="7" type="uint"/>
+		<bitfield name="NUMFPNONPOSVAR" low="8" high="15" type="uint"/>
+		<bitfield name="NUMNONPOSVSVAR" low="16" high="23" type="uint"/>
+	</reg32>
+	<array offset="0x2142" name="VPC_VARYING_INTERP" stride="1" length="8">
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+	<array offset="0x214a" name="VPC_VARYING_PS_REPL" stride="1" length="8">
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+
+	<reg32 offset="0x216e" name="VPC_SO_FLUSH_WADDR_3"/>
+
+	<!-- VSC registers -->
+	<reg32 offset="0x0c00" name="VSC_BIN_SIZE">
+		<bitfield name="WIDTH" low="0" high="4" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="5" high="9" shr="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0c01" name="VSC_SIZE_ADDRESS"/>
+	<reg32 offset="0x0c02" name="VSC_SIZE_ADDRESS2"/>
+	<reg32 offset="0x0c03" name="VSC_DEBUG_ECO_CONTROL"/>
+	<array offset="0x0c08" name="VSC_PIPE_CONFIG" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				Configures the mapping between VSC_PIPE buffer and
+				bin, X/Y specify the bin index in the horiz/vert
+				direction (0,0 is upper left, 0,1 is leftmost bin
+				on second row, and so on).  W/H specify the number
+				of bins assigned to this VSC_PIPE in the horiz/vert
+				dimension.
+			</doc>
+			<bitfield name="X" low="0" high="9" type="uint"/>
+			<bitfield name="Y" low="10" high="19" type="uint"/>
+			<bitfield name="W" low="20" high="23" type="uint"/>
+			<bitfield name="H" low="24" high="27" type="uint"/>
+		</reg32>
+	</array>
+	<array offset="0x0c10" name="VSC_PIPE_DATA_ADDRESS" stride="1" length="8">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<array offset="0x0c18" name="VSC_PIPE_DATA_LENGTH" stride="1" length="8">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x0c41" name="VSC_PIPE_PARTIAL_POSN_1"/>
+	<reg32 offset="0x0c50" name="VSC_PERFCTR_VSC_SEL_0" type="a4xx_vsc_perfcounter_select"/>
+	<reg32 offset="0x0c51" name="VSC_PERFCTR_VSC_SEL_1" type="a4xx_vsc_perfcounter_select"/>
+
+	<!-- VFD registers -->
+	<reg32 offset="0x0e40" name="VFD_DEBUG_CONTROL"/>
+	<reg32 offset="0x0e43" name="VFD_PERFCTR_VFD_SEL_0" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e44" name="VFD_PERFCTR_VFD_SEL_1" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e45" name="VFD_PERFCTR_VFD_SEL_2" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e46" name="VFD_PERFCTR_VFD_SEL_3" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e47" name="VFD_PERFCTR_VFD_SEL_4" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e48" name="VFD_PERFCTR_VFD_SEL_5" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e49" name="VFD_PERFCTR_VFD_SEL_6" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e4a" name="VFD_PERFCTR_VFD_SEL_7" type="a4xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x21d0" name="VGT_CL_INITIATOR"/>
+	<reg32 offset="0x21d9" name="VGT_EVENT_INITIATOR"/>
+	<reg32 offset="0x2200" name="VFD_CONTROL_0">
+		<doc>
+			TOTALATTRTOVS is # of attributes to vertex shader, in register
+			slots (ie. vec4+vec3 -> 7)
+		</doc>
+		<bitfield name="TOTALATTRTOVS" low="0" high="7" type="uint"/>
+		<doc>
+		BYPASSATTROVS seems to count varyings that are just directly
+		assigned from attributes (ie, "vFoo = aFoo;")
+		</doc>
+		<bitfield name="BYPASSATTROVS" low="9" high="16" type="uint"/>
+		<doc>STRMDECINSTRCNT is # of VFD_DECODE_INSTR registers valid</doc>
+		<bitfield name="STRMDECINSTRCNT" low="20" high="25" type="uint"/>
+		<doc>STRMFETCHINSTRCNT is # of VFD_FETCH_INSTR registers valid</doc>
+		<bitfield name="STRMFETCHINSTRCNT" low="26" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2201" name="VFD_CONTROL_1">
+		<doc>MAXSTORAGE could be # of attributes/vbo's</doc>
+		<bitfield name="MAXSTORAGE" low="0" high="15" type="uint"/>
+		<bitfield name="REGID4VTX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID4INST" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2202" name="VFD_CONTROL_2"/>
+	<reg32 offset="0x2203" name="VFD_CONTROL_3">
+		<bitfield name="REGID_VTXCNT" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSY" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x2204" name="VFD_CONTROL_4"/>
+	<reg32 offset="0x2208" name="VFD_INDEX_OFFSET"/>
+	<array offset="0x220a" name="VFD_FETCH" stride="4" length="32">
+		<reg32 offset="0x0" name="INSTR_0">
+			<bitfield name="FETCHSIZE" low="0" high="6" type="uint"/>
+			<bitfield name="BUFSTRIDE" low="7" high="16" type="uint"/>
+			<bitfield name="SWITCHNEXT" pos="19" type="boolean"/>
+			<bitfield name="INSTANCED" pos="20" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x1" name="INSTR_1"/>
+		<reg32 offset="0x2" name="INSTR_2">
+			<bitfield name="SIZE" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="0x3" name="INSTR_3">
+			<!-- might well be bigger.. -->
+			<bitfield name="STEPRATE" low="0" high="8" type="uint"/>
+		</reg32>
+	</array>
+	<array offset="0x228a" name="VFD_DECODE" stride="1" length="32">
+		<reg32 offset="0x0" name="INSTR">
+			<bitfield name="WRITEMASK" low="0" high="3" type="hex"/>
+			<!-- not sure if this is a bit flag and another flag above it, or?? -->
+			<bitfield name="CONSTFILL" pos="4" type="boolean"/>
+			<bitfield name="FORMAT" low="6" high="11" type="a4xx_vtx_fmt"/>
+			<bitfield name="REGID" low="12" high="19" type="a3xx_regid"/>
+			<bitfield name="INT" pos="20" type="boolean"/>
+			<doc>SHIFTCNT appears to be size, ie. FLOAT_32_32_32 is 12, and BYTE_8 is 1</doc>
+			<bitfield name="SWAP" low="22" high="23" type="a3xx_color_swap"/>
+			<bitfield name="SHIFTCNT" low="24" high="28" type="uint"/>
+			<bitfield name="LASTCOMPVALID" pos="29" type="boolean"/>
+			<bitfield name="SWITCHNEXT" pos="30" type="boolean"/>
+		</reg32>
+	</array>
+
+	<!-- TPL1 registers -->
+	<reg32 offset="0x0f00" name="TPL1_DEBUG_ECO_CONTROL"/>
+	<!-- always 0000003a: -->
+	<reg32 offset="0x0f03" name="TPL1_TP_MODE_CONTROL"/>
+	<reg32 offset="0x0f04" name="TPL1_PERFCTR_TP_SEL_0" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f05" name="TPL1_PERFCTR_TP_SEL_1" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f06" name="TPL1_PERFCTR_TP_SEL_2" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f07" name="TPL1_PERFCTR_TP_SEL_3" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f08" name="TPL1_PERFCTR_TP_SEL_4" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f09" name="TPL1_PERFCTR_TP_SEL_5" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f0a" name="TPL1_PERFCTR_TP_SEL_6" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f0b" name="TPL1_PERFCTR_TP_SEL_7" type="a4xx_tp_perfcounter_select"/>
+	<reg32 offset="0x2380" name="TPL1_TP_TEX_OFFSET"/>
+	<reg32 offset="0x2381" name="TPL1_TP_TEX_COUNT">
+		<bitfield name="VS" low="0" high="7" type="uint"/>
+		<bitfield name="HS" low="8" high="15" type="uint"/>
+		<bitfield name="DS" low="16" high="23" type="uint"/>
+		<bitfield name="GS" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2384" name="TPL1_TP_VS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x2387" name="TPL1_TP_HS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x238a" name="TPL1_TP_DS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x238d" name="TPL1_TP_GS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x23a0" name="TPL1_TP_FS_TEX_COUNT">
+		<bitfield name="FS" low="0" high="7" type="uint"/>
+		<bitfield name="CS" low="8" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23a1" name="TPL1_TP_FS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x23a4" name="TPL1_TP_CS_BORDER_COLOR_BASE_ADDR"/>
+	<reg32 offset="0x23a5" name="TPL1_TP_CS_SAMPLER_BASE_ADDR"/>
+	<reg32 offset="0x23a6" name="TPL1_TP_CS_TEXMEMOBJ_BASE_ADDR"/>
+
+	<!-- GRAS registers -->
+	<reg32 offset="0x0c80" name="GRAS_TSE_STATUS"/>
+	<reg32 offset="0x0c81" name="GRAS_DEBUG_ECO_CONTROL"/>
+	<reg32 offset="0x0c88" name="GRAS_PERFCTR_TSE_SEL_0" type="a4xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c89" name="GRAS_PERFCTR_TSE_SEL_1" type="a4xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c8a" name="GRAS_PERFCTR_TSE_SEL_2" type="a4xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c8b" name="GRAS_PERFCTR_TSE_SEL_3" type="a4xx_gras_tse_perfcounter_select"/>
+	<reg32 offset="0x0c8c" name="GRAS_PERFCTR_RAS_SEL_0" type="a4xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x0c8d" name="GRAS_PERFCTR_RAS_SEL_1" type="a4xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x0c8e" name="GRAS_PERFCTR_RAS_SEL_2" type="a4xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x0c8f" name="GRAS_PERFCTR_RAS_SEL_3" type="a4xx_gras_ras_perfcounter_select"/>
+	<reg32 offset="0x2000" name="GRAS_CL_CLIP_CNTL">
+		<bitfield name="CLIP_DISABLE" pos="15" type="boolean"/>
+		<bitfield name="ZNEAR_CLIP_DISABLE" pos="16" type="boolean"/>
+		<bitfield name="ZFAR_CLIP_DISABLE" pos="17" type="boolean"/>
+		<bitfield name="ZERO_GB_SCALE_Z" pos="22" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2003" name="GRAS_CNTL">
+		<bitfield name="IJ_PERSP" pos="0" type="boolean"/>
+		<bitfield name="IJ_LINEAR" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2004" name="GRAS_CL_GB_CLIP_ADJ">
+		<bitfield name="HORZ" low="0" high="9" type="uint"/>
+		<bitfield name="VERT" low="10" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2008" name="GRAS_CL_VPORT_XOFFSET_0" type="float"/>
+	<reg32 offset="0x2009" name="GRAS_CL_VPORT_XSCALE_0" type="float"/>
+	<reg32 offset="0x200a" name="GRAS_CL_VPORT_YOFFSET_0" type="float"/>
+	<reg32 offset="0x200b" name="GRAS_CL_VPORT_YSCALE_0" type="float"/>
+	<reg32 offset="0x200c" name="GRAS_CL_VPORT_ZOFFSET_0" type="float"/>
+	<reg32 offset="0x200d" name="GRAS_CL_VPORT_ZSCALE_0" type="float"/>
+	<reg32 offset="0x2070" name="GRAS_SU_POINT_MINMAX">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x2071" name="GRAS_SU_POINT_SIZE" type="fixed" radix="4"/>
+	<reg32 offset="0x2073" name="GRAS_ALPHA_CONTROL">
+		<bitfield name="ALPHA_TEST_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="FORCE_FRAGZ_TO_FS" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x2074" name="GRAS_SU_POLY_OFFSET_SCALE" type="float"/>
+	<reg32 offset="0x2075" name="GRAS_SU_POLY_OFFSET_OFFSET" type="float"/>
+	<reg32 offset="0x2076" name="GRAS_SU_POLY_OFFSET_CLAMP" type="float"/>
+	<reg32 offset="0x2077" name="GRAS_DEPTH_CONTROL">
+		<!-- guestimating that this is GRAS based on addr -->
+		<bitfield name="FORMAT" low="0" high="1" type="a4xx_depth_format"/>
+	</reg32>
+	<reg32 offset="0x2078" name="GRAS_SU_MODE_CONTROL">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FRONT_CW" pos="2" type="boolean"/>
+		<bitfield name="LINEHALFWIDTH" low="3" high="10" radix="2" type="fixed"/>
+		<bitfield name="POLY_OFFSET" pos="11" type="boolean"/>
+		<bitfield name="MSAA_ENABLE" pos="13" type="boolean"/>
+		<!-- bit20 set whenever RENDER_MODE = RB_RENDERING_PASS -->
+		<bitfield name="RENDERING_PASS" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x207b" name="GRAS_SC_CONTROL">
+		<!-- complete wild-ass-guess for sizes of these bitfields.. -->
+		<bitfield name="RENDER_MODE" low="2" high="3" type="a3xx_render_mode"/>
+		<bitfield name="MSAA_SAMPLES" low="7" high="9" type="uint"/>
+		<bitfield name="MSAA_DISABLE" pos="11" type="boolean"/>
+		<bitfield name="RASTER_MODE" low="12" high="15"/>
+	</reg32>
+	<reg32 offset="0x207c" name="GRAS_SC_SCREEN_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x207d" name="GRAS_SC_SCREEN_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x209c" name="GRAS_SC_WINDOW_SCISSOR_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x209d" name="GRAS_SC_WINDOW_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0x209e" name="GRAS_SC_EXTENT_WINDOW_BR" type="adreno_reg_xy"/>
+	<reg32 offset="0x209f" name="GRAS_SC_EXTENT_WINDOW_TL" type="adreno_reg_xy"/>
+
+	<!-- UCHE registers -->
+	<reg32 offset="0x0e80" name="UCHE_CACHE_MODE_CONTROL"/>
+	<reg32 offset="0x0e83" name="UCHE_TRAP_BASE_LO"/>
+	<reg32 offset="0x0e84" name="UCHE_TRAP_BASE_HI"/>
+	<reg32 offset="0x0e88" name="UCHE_CACHE_STATUS"/>
+	<reg32 offset="0x0e8a" name="UCHE_INVALIDATE0"/>
+	<reg32 offset="0x0e8b" name="UCHE_INVALIDATE1"/>
+	<reg32 offset="0x0e8c" name="UCHE_CACHE_WAYS_VFD"/>
+	<reg32 offset="0x0e8e" name="UCHE_PERFCTR_UCHE_SEL_0" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e8f" name="UCHE_PERFCTR_UCHE_SEL_1" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e90" name="UCHE_PERFCTR_UCHE_SEL_2" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e91" name="UCHE_PERFCTR_UCHE_SEL_3" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e92" name="UCHE_PERFCTR_UCHE_SEL_4" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e93" name="UCHE_PERFCTR_UCHE_SEL_5" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e94" name="UCHE_PERFCTR_UCHE_SEL_6" type="a4xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0e95" name="UCHE_PERFCTR_UCHE_SEL_7" type="a4xx_uche_perfcounter_select"/>
+
+	<!-- HLSQ registers -->
+	<reg32 offset="0x0e00" name="HLSQ_TIMEOUT_THRESHOLD"/>
+	<reg32 offset="0x0e04" name="HLSQ_DEBUG_ECO_CONTROL"/>
+	<!-- always 00000000: -->
+	<reg32 offset="0x0e05" name="HLSQ_MODE_CONTROL"/>
+	<reg32 offset="0x0e0e" name="HLSQ_PERF_PIPE_MASK"/>
+	<reg32 offset="0x0e06" name="HLSQ_PERFCTR_HLSQ_SEL_0" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e07" name="HLSQ_PERFCTR_HLSQ_SEL_1" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e08" name="HLSQ_PERFCTR_HLSQ_SEL_2" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e09" name="HLSQ_PERFCTR_HLSQ_SEL_3" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e0a" name="HLSQ_PERFCTR_HLSQ_SEL_4" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e0b" name="HLSQ_PERFCTR_HLSQ_SEL_5" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e0c" name="HLSQ_PERFCTR_HLSQ_SEL_6" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e0d" name="HLSQ_PERFCTR_HLSQ_SEL_7" type="a4xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x23c0" name="HLSQ_CONTROL_0_REG">
+		<!-- I guess same as a3xx, but so far only seen 08000050 -->
+		<bitfield name="FSTHREADSIZE" pos="4" type="a3xx_threadsize"/>
+		<bitfield name="FSSUPERTHREADENABLE" pos="6" type="boolean"/>
+		<bitfield name="SPSHADERRESTART" pos="9" type="boolean"/>
+		<bitfield name="RESERVED2" pos="10" type="boolean"/>
+		<bitfield name="CHUNKDISABLE" pos="26" type="boolean"/>
+		<bitfield name="CONSTMODE" pos="27" type="uint"/>
+		<bitfield name="LAZYUPDATEDISABLE" pos="28" type="boolean"/>
+		<bitfield name="SPCONSTFULLUPDATE" pos="29" type="boolean"/>
+		<bitfield name="TPFULLUPDATE" pos="30" type="boolean"/>
+		<bitfield name="SINGLECONTEXT" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x23c1" name="HLSQ_CONTROL_1_REG">
+		<bitfield name="VSTHREADSIZE" pos="6" type="a3xx_threadsize"/>
+		<bitfield name="VSSUPERTHREADENABLE" pos="8" type="boolean"/>
+		<bitfield name="RESERVED1" pos="9" type="boolean"/>
+		<bitfield name="COORDREGID" low="16" high="23" type="a3xx_regid"/>
+		<!-- set if gl_FragCoord.[zw] used in frag shader: -->
+		<bitfield name="ZWCOORDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23c2" name="HLSQ_CONTROL_2_REG">
+		<bitfield name="PRIMALLOCTHRESHOLD" low="26" high="31" type="uint"/>
+		<bitfield name="FACEREGID" low="2" high="9" type="a3xx_regid"/>
+		<bitfield name="SAMPLEID_REGID" low="10" high="17" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK_REGID" low="18" high="25" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23c3" name="HLSQ_CONTROL_3_REG">
+		<!-- register loaded with position (bary.f) -->
+		<bitfield name="IJ_PERSP_PIXEL" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_PIXEL" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="IJ_PERSP_CENTROID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_CENTROID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<!-- 0x23c4 3 regids, lowest one goes to 0 when *not* per-sample shading -->
+	<reg32 offset="0x23c4" name="HLSQ_CONTROL_4_REG">
+		<bitfield name="IJ_PERSP_SAMPLE" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+
+	<bitset name="a4xx_xs_control_reg" inline="yes">
+		<bitfield name="CONSTLENGTH" low="0" high="7" type="uint"/>
+		<bitfield name="CONSTOBJECTOFFSET" low="8" high="14" type="uint"/>
+		<bitfield name="SSBO_ENABLE" pos="15" type="boolean"/>
+		<bitfield name="ENABLED" pos="16" type="boolean"/>
+		<bitfield name="SHADEROBJOFFSET" low="17" high="23" type="uint"/>
+		<bitfield name="INSTRLENGTH" low="24" high="31" type="uint"/>
+	</bitset>
+	<reg32 offset="0x23c5" name="HLSQ_VS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23c6" name="HLSQ_FS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23c7" name="HLSQ_HS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23c8" name="HLSQ_DS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23c9" name="HLSQ_GS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23ca" name="HLSQ_CS_CONTROL_REG" type="a4xx_xs_control_reg"/>
+	<reg32 offset="0x23cd" name="HLSQ_CL_NDRANGE_0">
+		<bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23ce" name="HLSQ_CL_NDRANGE_1">
+		<bitfield name="SIZE_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23cf" name="HLSQ_CL_NDRANGE_2"/>
+	<reg32 offset="0x23d0" name="HLSQ_CL_NDRANGE_3">
+		<bitfield name="SIZE_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23d1" name="HLSQ_CL_NDRANGE_4"/>
+	<reg32 offset="0x23d2" name="HLSQ_CL_NDRANGE_5">
+		<bitfield name="SIZE_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x23d3" name="HLSQ_CL_NDRANGE_6"/>
+	<reg32 offset="0x23d4" name="HLSQ_CL_CONTROL_0">
+		<bitfield name="WGIDCONSTID" low="0" high="11" type="a3xx_regid"/>
+		<bitfield name="KERNELDIMCONSTID" low="12" high="23" type="a3xx_regid"/>
+		<bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23d5" name="HLSQ_CL_CONTROL_1">
+		<!-- GLOBALSIZECONSTID? "kernel size" -->
+		<bitfield name="UNK0CONSTID" low="0" high="11" type="a3xx_regid"/>
+		<bitfield name="WORKGROUPSIZECONSTID" low="12" high="23" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23d6" name="HLSQ_CL_KERNEL_CONST">
+		<!-- GLOBALOFFSETCONSTID -->
+		<bitfield name="UNK0CONSTID" low="0" high="11" type="a3xx_regid"/>
+		<bitfield name="NUMWGCONSTID" low="12" high="23" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23d7" name="HLSQ_CL_KERNEL_GROUP_X"/>
+	<reg32 offset="0x23d8" name="HLSQ_CL_KERNEL_GROUP_Y"/>
+	<reg32 offset="0x23d9" name="HLSQ_CL_KERNEL_GROUP_Z"/>
+	<reg32 offset="0x23da" name="HLSQ_CL_WG_OFFSET">
+		<!-- WGOFFSETCONSTID -->
+		<bitfield name="UNK0CONSTID" low="0" high="11" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0x23db" name="HLSQ_UPDATE_CONTROL"/>
+
+	<!-- PC registers -->
+	<reg32 offset="0x0d00" name="PC_BINNING_COMMAND">
+		<bitfield name="BINNING_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0d08" name="PC_TESSFACTOR_ADDR"/>
+	<reg32 offset="0x0d0c" name="PC_DRAWCALL_SETUP_OVERRIDE"/>
+	<reg32 offset="0x0d10" name="PC_PERFCTR_PC_SEL_0" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d11" name="PC_PERFCTR_PC_SEL_1" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d12" name="PC_PERFCTR_PC_SEL_2" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d13" name="PC_PERFCTR_PC_SEL_3" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d14" name="PC_PERFCTR_PC_SEL_4" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d15" name="PC_PERFCTR_PC_SEL_5" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d16" name="PC_PERFCTR_PC_SEL_6" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d17" name="PC_PERFCTR_PC_SEL_7" type="a4xx_pc_perfcounter_select"/>
+	<reg32 offset="0x21c0" name="PC_BIN_BASE"/>
+	<reg32 offset="0x21c2" name="PC_VSTREAM_CONTROL">
+		<doc>SIZE is current pipe width * height (in tiles)</doc>
+		<bitfield name="SIZE" low="16" high="21" type="uint"/>
+		<doc>
+			N is some sort of slot # between 0..(SIZE-1).  In case
+			multiple tiles use same pipe, each tile gets unique slot #
+		</doc>
+		<bitfield name="N" low="22" high="26" type="uint"/>
+	</reg32>
+	<reg32 offset="0x21c4" name="PC_PRIM_VTX_CNTL">
+		<!-- bit0 set if there is >= 1 varying (actually used by FS) -->
+		<bitfield name="VAROUT" low="0" high="3" type="uint">
+			<doc>in groups of 4x vec4, blob only uses values
+			0, 1, 2, 4, 6, 8</doc>
+		</bitfield>
+		<bitfield name="PRIMITIVE_RESTART" pos="20" type="boolean"/>
+		<bitfield name="PROVOKING_VTX_LAST" pos="25" type="boolean"/>
+		<!-- PSIZE bit set if gl_PointSize written: -->
+		<bitfield name="PSIZE" pos="26" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x21c5" name="PC_PRIM_VTX_CNTL2">
+		<bitfield name="POLYMODE_FRONT_PTYPE" low="0" high="2" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_BACK_PTYPE" low="3" high="5" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_ENABLE" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x21c6" name="PC_RESTART_INDEX"/>
+	<reg32 offset="0x21e5" name="PC_GS_PARAM">
+		<bitfield name="MAX_VERTICES" low="0" high="9" type="uint"/><!-- +1, i.e. max is 1024 -->
+		<bitfield name="INVOCATIONS" low="11" high="15" type="uint"/><!-- +1, i.e. max is 32 -->
+		<bitfield name="PRIMTYPE" low="23" high="24" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="LAYER" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x21e7" name="PC_HS_PARAM">
+		<bitfield name="VERTICES_OUT" low="0" high="5" type="uint"/>
+		<bitfield name="SPACING" low="21" high="22" type="a4xx_tess_spacing"/>
+		<bitfield name="CW" pos="23" type="boolean"/>
+		<bitfield name="CONNECTED" pos="24" type="boolean"/>
+	</reg32>
+
+	<!-- VBIF registers -->
+	<reg32 offset="0x3000" name="VBIF_VERSION"/>
+	<reg32 offset="0x3001" name="VBIF_CLKON">
+		<bitfield name="FORCE_ON_TESTBUS" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x301c" name="VBIF_ABIT_SORT"/>
+	<reg32 offset="0x301d" name="VBIF_ABIT_SORT_CONF"/>
+	<reg32 offset="0x302a" name="VBIF_GATE_OFF_WRREQ_EN"/>
+	<reg32 offset="0x302c" name="VBIF_IN_RD_LIM_CONF0"/>
+	<reg32 offset="0x302d" name="VBIF_IN_RD_LIM_CONF1"/>
+	<reg32 offset="0x3030" name="VBIF_IN_WR_LIM_CONF0"/>
+	<reg32 offset="0x3031" name="VBIF_IN_WR_LIM_CONF1"/>
+	<reg32 offset="0x3049" name="VBIF_ROUND_ROBIN_QOS_ARB"/>
+	<reg32 offset="0x30c0" name="VBIF_PERF_CNT_EN0"/>
+	<reg32 offset="0x30c1" name="VBIF_PERF_CNT_EN1"/>
+	<reg32 offset="0x30c2" name="VBIF_PERF_CNT_EN2"/>
+	<reg32 offset="0x30c3" name="VBIF_PERF_CNT_EN3"/>
+	<reg32 offset="0x30d0" name="VBIF_PERF_CNT_SEL0" type="a4xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d1" name="VBIF_PERF_CNT_SEL1" type="a4xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d2" name="VBIF_PERF_CNT_SEL2" type="a4xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d3" name="VBIF_PERF_CNT_SEL3" type="a4xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d8" name="VBIF_PERF_CNT_LOW0"/>
+	<reg32 offset="0x30d9" name="VBIF_PERF_CNT_LOW1"/>
+	<reg32 offset="0x30da" name="VBIF_PERF_CNT_LOW2"/>
+	<reg32 offset="0x30db" name="VBIF_PERF_CNT_LOW3"/>
+	<reg32 offset="0x30e0" name="VBIF_PERF_CNT_HIGH0"/>
+	<reg32 offset="0x30e1" name="VBIF_PERF_CNT_HIGH1"/>
+	<reg32 offset="0x30e2" name="VBIF_PERF_CNT_HIGH2"/>
+	<reg32 offset="0x30e3" name="VBIF_PERF_CNT_HIGH3"/>
+	<reg32 offset="0x3100" name="VBIF_PERF_PWR_CNT_EN0"/>
+	<reg32 offset="0x3101" name="VBIF_PERF_PWR_CNT_EN1"/>
+	<reg32 offset="0x3102" name="VBIF_PERF_PWR_CNT_EN2"/>
+
+	<!--
+	Unknown registers:
+	(mostly related to DX11 features not used yet, I guess?)
+	-->
+
+	<!-- always 00000006: -->
+	<reg32 offset="0x0cc5" name="UNKNOWN_0CC5"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x0cc6" name="UNKNOWN_0CC6"/>
+
+	<!-- always 00000001: -->
+	<reg32 offset="0x0d01" name="UNKNOWN_0D01"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x0e42" name="UNKNOWN_0E42"/>
+
+	<!-- always 00040000: -->
+	<reg32 offset="0x0ec2" name="UNKNOWN_0EC2"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2001" name="UNKNOWN_2001"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x209b" name="UNKNOWN_209B"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x20ef" name="UNKNOWN_20EF"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2152" name="UNKNOWN_2152"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2153" name="UNKNOWN_2153"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2154" name="UNKNOWN_2154"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2155" name="UNKNOWN_2155"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2156" name="UNKNOWN_2156"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2157" name="UNKNOWN_2157"/>
+
+	<!-- always 0000000b: -->
+	<reg32 offset="0x21c3" name="UNKNOWN_21C3"/>
+
+	<!-- always 00000001: -->
+	<reg32 offset="0x21e6" name="UNKNOWN_21E6"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x2209" name="UNKNOWN_2209"/>
+
+	<!-- always 00000000: -->
+	<reg32 offset="0x22d7" name="UNKNOWN_22D7"/>
+
+        <!-- always 00fcfc00: -->
+        <reg32 offset="0x2352" name="UNKNOWN_2352"/>
+
+</domain>
+
+
+<domain name="A4XX_TEX_SAMP" width="32">
+	<doc>Texture sampler dwords</doc>
+	<enum name="a4xx_tex_filter">
+		<value name="A4XX_TEX_NEAREST" value="0"/>
+		<value name="A4XX_TEX_LINEAR" value="1"/>
+		<value name="A4XX_TEX_ANISO" value="2"/>
+	</enum>
+	<enum name="a4xx_tex_clamp">
+		<value name="A4XX_TEX_REPEAT" value="0"/>
+		<value name="A4XX_TEX_CLAMP_TO_EDGE" value="1"/>
+		<value name="A4XX_TEX_MIRROR_REPEAT" value="2"/>
+		<value name="A4XX_TEX_CLAMP_TO_BORDER" value="3"/>
+		<value name="A4XX_TEX_MIRROR_CLAMP" value="4"/>
+	</enum>
+	<enum name="a4xx_tex_aniso">
+		<value name="A4XX_TEX_ANISO_1" value="0"/>
+		<value name="A4XX_TEX_ANISO_2" value="1"/>
+		<value name="A4XX_TEX_ANISO_4" value="2"/>
+		<value name="A4XX_TEX_ANISO_8" value="3"/>
+		<value name="A4XX_TEX_ANISO_16" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="MIPFILTER_LINEAR_NEAR" pos="0" type="boolean"/>
+		<bitfield name="XY_MAG" low="1" high="2" type="a4xx_tex_filter"/>
+		<bitfield name="XY_MIN" low="3" high="4" type="a4xx_tex_filter"/>
+		<bitfield name="WRAP_S" low="5" high="7" type="a4xx_tex_clamp"/>
+		<bitfield name="WRAP_T" low="8" high="10" type="a4xx_tex_clamp"/>
+		<bitfield name="WRAP_R" low="11" high="13" type="a4xx_tex_clamp"/>
+		<bitfield name="ANISO" low="14" high="16" type="a4xx_tex_aniso"/>
+		<bitfield name="LOD_BIAS" low="19" high="31" type="fixed" radix="8"/><!-- no idea how many bits for real -->
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="COMPARE_FUNC" low="1" high="3" type="adreno_compare_func"/>
+		<bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="4" type="boolean"/>
+		<bitfield name="UNNORM_COORDS" pos="5" type="boolean"/>
+		<bitfield name="MIPFILTER_LINEAR_FAR" pos="6" type="boolean"/>
+		<bitfield name="MAX_LOD" low="8" high="19" type="ufixed" radix="8"/>
+		<bitfield name="MIN_LOD" low="20" high="31" type="ufixed" radix="8"/>
+	</reg32>
+</domain>
+
+<domain name="A4XX_TEX_CONST" width="32">
+	<doc>Texture constant dwords</doc>
+	<enum name="a4xx_tex_swiz">
+		<!-- same as a2xx? -->
+		<value name="A4XX_TEX_X" value="0"/>
+		<value name="A4XX_TEX_Y" value="1"/>
+		<value name="A4XX_TEX_Z" value="2"/>
+		<value name="A4XX_TEX_W" value="3"/>
+		<value name="A4XX_TEX_ZERO" value="4"/>
+		<value name="A4XX_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="a4xx_tex_type">
+		<value name="A4XX_TEX_1D" value="0"/>
+		<value name="A4XX_TEX_2D" value="1"/>
+		<value name="A4XX_TEX_CUBE" value="2"/>
+		<value name="A4XX_TEX_3D" value="3"/>
+		<value name="A4XX_TEX_BUFFER" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TILED" pos="0" type="boolean"/>
+		<bitfield name="SRGB" pos="2" type="boolean"/>
+		<bitfield name="SWIZ_X" low="4" high="6" type="a4xx_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="7" high="9" type="a4xx_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="10" high="12" type="a4xx_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="13" high="15" type="a4xx_tex_swiz"/>
+		<bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
+		<bitfield name="FMT" low="22" high="28" type="a4xx_tex_fmt"/>
+		<bitfield name="TYPE" low="29" high="31" type="a4xx_tex_type"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="HEIGHT" low="0" high="14" type="uint"/>
+		<bitfield name="WIDTH" low="15" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<!-- minimum pitch (for mipmap levels): log2(pitchalign / 32) -->
+		<bitfield name="PITCHALIGN" low="0" high="3" type="uint"/>
+		<bitfield name="BUFFER" pos="6" type="boolean"/>
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="9" high="29" type="uint"/>
+		<bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="LAYERSZ" low="0" high="13" shr="12" type="uint"/>
+		<bitfield name="DEPTH" low="18" high="30" type="uint"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<!--
+		like a3xx we seem to have two LAYERSZ's.. although this one
+		seems too small to be useful, and when it overflows blob just
+		sets it to zero..
+		 -->
+		<bitfield name="LAYERSZ" low="0" high="3" shr="12" type="uint"/>
+		<bitfield name="BASE" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="5" name="5"/>
+	<reg32 offset="6" name="6"/>
+	<reg32 offset="7" name="7"/>
+</domain>
+
+<domain name="A4XX_SSBO_0" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="0" high="21" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ARRAY_PITCH" low="12" high="25" shr="12" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!-- bytes per pixel: -->
+		<bitfield name="CPP" low="0" high="5" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="A4XX_SSBO_1" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="CPP" low="0" high="4" type="uint"/>
+		<bitfield name="FMT" low="8" high="15" type="a4xx_color_fmt"/>
+		<bitfield name="WIDTH" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="HEIGHT" low="0" high="15" type="uint"/>
+		<bitfield name="DEPTH" low="16" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/adreno/a5xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/adreno/a5xx.xml
@@ -0,0 +1,3039 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+<enum name="a5xx_color_fmt">
+	<value value="0x02" name="RB5_A8_UNORM"/>
+	<value value="0x03" name="RB5_R8_UNORM"/>
+	<value value="0x04" name="RB5_R8_SNORM"/>
+	<value value="0x05" name="RB5_R8_UINT"/>
+	<value value="0x06" name="RB5_R8_SINT"/>
+	<value value="0x08" name="RB5_R4G4B4A4_UNORM"/>
+	<value value="0x0a" name="RB5_R5G5B5A1_UNORM"/>
+	<value value="0x0e" name="RB5_R5G6B5_UNORM"/>
+	<value value="0x0f" name="RB5_R8G8_UNORM"/>
+	<value value="0x10" name="RB5_R8G8_SNORM"/>
+	<value value="0x11" name="RB5_R8G8_UINT"/>
+	<value value="0x12" name="RB5_R8G8_SINT"/>
+	<value value="0x15" name="RB5_R16_UNORM"/>
+	<value value="0x16" name="RB5_R16_SNORM"/>
+	<value value="0x17" name="RB5_R16_FLOAT"/>
+	<value value="0x18" name="RB5_R16_UINT"/>
+	<value value="0x19" name="RB5_R16_SINT"/>
+	<value value="0x30" name="RB5_R8G8B8A8_UNORM"/>
+	<value value="0x31" name="RB5_R8G8B8_UNORM"/>
+	<value value="0x32" name="RB5_R8G8B8A8_SNORM"/>
+	<value value="0x33" name="RB5_R8G8B8A8_UINT"/>
+	<value value="0x34" name="RB5_R8G8B8A8_SINT"/>
+	<value value="0x37" name="RB5_R10G10B10A2_UNORM"/>  <!-- GL_RGB10_A2 -->
+	<value value="0x3a" name="RB5_R10G10B10A2_UINT"/>   <!-- GL_RGB10_A2UI -->
+	<value value="0x42" name="RB5_R11G11B10_FLOAT"/>    <!-- GL_R11F_G11F_B10F -->
+	<value value="0x43" name="RB5_R16G16_UNORM"/>
+	<value value="0x44" name="RB5_R16G16_SNORM"/>
+	<value value="0x45" name="RB5_R16G16_FLOAT"/>
+	<value value="0x46" name="RB5_R16G16_UINT"/>
+	<value value="0x47" name="RB5_R16G16_SINT"/>
+	<value value="0x4a" name="RB5_R32_FLOAT"/>
+	<value value="0x4b" name="RB5_R32_UINT"/>
+	<value value="0x4c" name="RB5_R32_SINT"/>
+	<value value="0x60" name="RB5_R16G16B16A16_UNORM"/>
+	<value value="0x61" name="RB5_R16G16B16A16_SNORM"/>
+	<value value="0x62" name="RB5_R16G16B16A16_FLOAT"/>
+	<value value="0x63" name="RB5_R16G16B16A16_UINT"/>
+	<value value="0x64" name="RB5_R16G16B16A16_SINT"/>
+	<value value="0x67" name="RB5_R32G32_FLOAT"/>
+	<value value="0x68" name="RB5_R32G32_UINT"/>
+	<value value="0x69" name="RB5_R32G32_SINT"/>
+	<value value="0x82" name="RB5_R32G32B32A32_FLOAT"/>
+	<value value="0x83" name="RB5_R32G32B32A32_UINT"/>
+	<value value="0x84" name="RB5_R32G32B32A32_SINT"/>
+
+	<value value="0xff" name="RB5_NONE"/>
+</enum>
+
+<enum name="a5xx_tile_mode">
+	<value name="TILE5_LINEAR" value="0"/>
+	<value name="TILE5_2" value="2"/>
+	<value name="TILE5_3" value="3"/>
+</enum>
+
+<enum name="a5xx_vtx_fmt" prefix="chipset">
+	<value value="0x03" name="VFMT5_8_UNORM"/>
+	<value value="0x04" name="VFMT5_8_SNORM"/>
+	<value value="0x05" name="VFMT5_8_UINT"/>
+	<value value="0x06" name="VFMT5_8_SINT"/>
+
+	<value value="0x0f" name="VFMT5_8_8_UNORM"/>
+	<value value="0x10" name="VFMT5_8_8_SNORM"/>
+	<value value="0x11" name="VFMT5_8_8_UINT"/>
+	<value value="0x12" name="VFMT5_8_8_SINT"/>
+
+	<value value="0x15" name="VFMT5_16_UNORM"/>
+	<value value="0x16" name="VFMT5_16_SNORM"/>
+	<value value="0x17" name="VFMT5_16_FLOAT"/>
+	<value value="0x18" name="VFMT5_16_UINT"/>
+	<value value="0x19" name="VFMT5_16_SINT"/>
+
+	<value value="0x21" name="VFMT5_8_8_8_UNORM"/>
+	<value value="0x22" name="VFMT5_8_8_8_SNORM"/>
+	<value value="0x23" name="VFMT5_8_8_8_UINT"/>
+	<value value="0x24" name="VFMT5_8_8_8_SINT"/>
+
+	<value value="0x30" name="VFMT5_8_8_8_8_UNORM"/>
+	<value value="0x32" name="VFMT5_8_8_8_8_SNORM"/>
+	<value value="0x33" name="VFMT5_8_8_8_8_UINT"/>
+	<value value="0x34" name="VFMT5_8_8_8_8_SINT"/>
+
+	<value value="0x36" name="VFMT5_10_10_10_2_UNORM"/>
+	<value value="0x39" name="VFMT5_10_10_10_2_SNORM"/>
+	<value value="0x3a" name="VFMT5_10_10_10_2_UINT"/>
+	<value value="0x3b" name="VFMT5_10_10_10_2_SINT"/>
+
+	<value value="0x42" name="VFMT5_11_11_10_FLOAT"/>
+
+	<value value="0x43" name="VFMT5_16_16_UNORM"/>
+	<value value="0x44" name="VFMT5_16_16_SNORM"/>
+	<value value="0x45" name="VFMT5_16_16_FLOAT"/>
+	<value value="0x46" name="VFMT5_16_16_UINT"/>
+	<value value="0x47" name="VFMT5_16_16_SINT"/>
+
+	<value value="0x48" name="VFMT5_32_UNORM"/>
+	<value value="0x49" name="VFMT5_32_SNORM"/>
+	<value value="0x4a" name="VFMT5_32_FLOAT"/>
+	<value value="0x4b" name="VFMT5_32_UINT"/>
+	<value value="0x4c" name="VFMT5_32_SINT"/>
+	<value value="0x4d" name="VFMT5_32_FIXED"/>
+
+	<value value="0x58" name="VFMT5_16_16_16_UNORM"/>
+	<value value="0x59" name="VFMT5_16_16_16_SNORM"/>
+	<value value="0x5a" name="VFMT5_16_16_16_FLOAT"/>
+	<value value="0x5b" name="VFMT5_16_16_16_UINT"/>
+	<value value="0x5c" name="VFMT5_16_16_16_SINT"/>
+
+	<value value="0x60" name="VFMT5_16_16_16_16_UNORM"/>
+	<value value="0x61" name="VFMT5_16_16_16_16_SNORM"/>
+	<value value="0x62" name="VFMT5_16_16_16_16_FLOAT"/>
+	<value value="0x63" name="VFMT5_16_16_16_16_UINT"/>
+	<value value="0x64" name="VFMT5_16_16_16_16_SINT"/>
+
+	<value value="0x65" name="VFMT5_32_32_UNORM"/>
+	<value value="0x66" name="VFMT5_32_32_SNORM"/>
+	<value value="0x67" name="VFMT5_32_32_FLOAT"/>
+	<value value="0x68" name="VFMT5_32_32_UINT"/>
+	<value value="0x69" name="VFMT5_32_32_SINT"/>
+	<value value="0x6a" name="VFMT5_32_32_FIXED"/>
+
+	<value value="0x70" name="VFMT5_32_32_32_UNORM"/>
+	<value value="0x71" name="VFMT5_32_32_32_SNORM"/>
+	<value value="0x72" name="VFMT5_32_32_32_UINT"/>
+	<value value="0x73" name="VFMT5_32_32_32_SINT"/>
+	<value value="0x74" name="VFMT5_32_32_32_FLOAT"/>
+	<value value="0x75" name="VFMT5_32_32_32_FIXED"/>
+
+	<value value="0x80" name="VFMT5_32_32_32_32_UNORM"/>
+	<value value="0x81" name="VFMT5_32_32_32_32_SNORM"/>
+	<value value="0x82" name="VFMT5_32_32_32_32_FLOAT"/>
+	<value value="0x83" name="VFMT5_32_32_32_32_UINT"/>
+	<value value="0x84" name="VFMT5_32_32_32_32_SINT"/>
+	<value value="0x85" name="VFMT5_32_32_32_32_FIXED"/>
+
+	<value value="0xff" name="VFMT5_NONE"/>
+</enum>
+
+<enum name="a5xx_tex_fmt">
+	<value value="0x02" name="TFMT5_A8_UNORM"/>
+	<value value="0x03" name="TFMT5_8_UNORM"/>
+	<value value="0x04" name="TFMT5_8_SNORM"/>
+	<value value="0x05" name="TFMT5_8_UINT"/>
+	<value value="0x06" name="TFMT5_8_SINT"/>
+	<value value="0x08" name="TFMT5_4_4_4_4_UNORM"/>
+	<value value="0x0a" name="TFMT5_5_5_5_1_UNORM"/>
+	<value value="0x0e" name="TFMT5_5_6_5_UNORM"/>
+	<value value="0x0f" name="TFMT5_8_8_UNORM"/>
+	<value value="0x10" name="TFMT5_8_8_SNORM"/>
+	<value value="0x11" name="TFMT5_8_8_UINT"/>
+	<value value="0x12" name="TFMT5_8_8_SINT"/>
+	<value value="0x13" name="TFMT5_L8_A8_UNORM"/>
+	<value value="0x15" name="TFMT5_16_UNORM"/>
+	<value value="0x16" name="TFMT5_16_SNORM"/>
+	<value value="0x17" name="TFMT5_16_FLOAT"/>
+	<value value="0x18" name="TFMT5_16_UINT"/>
+	<value value="0x19" name="TFMT5_16_SINT"/>
+	<value value="0x30" name="TFMT5_8_8_8_8_UNORM"/>
+	<value value="0x31" name="TFMT5_8_8_8_UNORM"/>
+	<value value="0x32" name="TFMT5_8_8_8_8_SNORM"/>
+	<value value="0x33" name="TFMT5_8_8_8_8_UINT"/>
+	<value value="0x34" name="TFMT5_8_8_8_8_SINT"/>
+	<value value="0x35" name="TFMT5_9_9_9_E5_FLOAT"/>
+	<value value="0x36" name="TFMT5_10_10_10_2_UNORM"/>
+	<value value="0x3a" name="TFMT5_10_10_10_2_UINT"/>
+	<value value="0x42" name="TFMT5_11_11_10_FLOAT"/>
+	<value value="0x43" name="TFMT5_16_16_UNORM"/>
+	<value value="0x44" name="TFMT5_16_16_SNORM"/>
+	<value value="0x45" name="TFMT5_16_16_FLOAT"/>
+	<value value="0x46" name="TFMT5_16_16_UINT"/>
+	<value value="0x47" name="TFMT5_16_16_SINT"/>
+	<value value="0x4a" name="TFMT5_32_FLOAT"/>
+	<value value="0x4b" name="TFMT5_32_UINT"/>
+	<value value="0x4c" name="TFMT5_32_SINT"/>
+	<value value="0x60" name="TFMT5_16_16_16_16_UNORM"/>
+	<value value="0x61" name="TFMT5_16_16_16_16_SNORM"/>
+	<value value="0x62" name="TFMT5_16_16_16_16_FLOAT"/>
+	<value value="0x63" name="TFMT5_16_16_16_16_UINT"/>
+	<value value="0x64" name="TFMT5_16_16_16_16_SINT"/>
+	<value value="0x67" name="TFMT5_32_32_FLOAT"/>
+	<value value="0x68" name="TFMT5_32_32_UINT"/>
+	<value value="0x69" name="TFMT5_32_32_SINT"/>
+	<value value="0x72" name="TFMT5_32_32_32_UINT"/>
+	<value value="0x73" name="TFMT5_32_32_32_SINT"/>
+	<value value="0x74" name="TFMT5_32_32_32_FLOAT"/>
+	<value value="0x82" name="TFMT5_32_32_32_32_FLOAT"/>
+	<value value="0x83" name="TFMT5_32_32_32_32_UINT"/>
+	<value value="0x84" name="TFMT5_32_32_32_32_SINT"/>
+	<value value="0xa0" name="TFMT5_X8Z24_UNORM"/>
+
+	<value value="0xab" name="TFMT5_ETC2_RG11_UNORM"/>
+	<value value="0xac" name="TFMT5_ETC2_RG11_SNORM"/>
+	<value value="0xad" name="TFMT5_ETC2_R11_UNORM"/>
+	<value value="0xae" name="TFMT5_ETC2_R11_SNORM"/>
+	<value value="0xaf" name="TFMT5_ETC1"/>
+	<value value="0xb0" name="TFMT5_ETC2_RGB8"/>
+	<value value="0xb1" name="TFMT5_ETC2_RGBA8"/>
+	<value value="0xb2" name="TFMT5_ETC2_RGB8A1"/>
+	<value value="0xb3" name="TFMT5_DXT1"/>
+	<value value="0xb4" name="TFMT5_DXT3"/>
+	<value value="0xb5" name="TFMT5_DXT5"/>
+	<value value="0xb7" name="TFMT5_RGTC1_UNORM"/>
+	<value value="0xb8" name="TFMT5_RGTC1_SNORM"/>
+	<value value="0xbb" name="TFMT5_RGTC2_UNORM"/>
+	<value value="0xbc" name="TFMT5_RGTC2_SNORM"/>
+	<value value="0xbe" name="TFMT5_BPTC_UFLOAT"/>
+	<value value="0xbf" name="TFMT5_BPTC_FLOAT"/>
+	<value value="0xc0" name="TFMT5_BPTC"/>
+	<value value="0xc1" name="TFMT5_ASTC_4x4"/>
+	<value value="0xc2" name="TFMT5_ASTC_5x4"/>
+	<value value="0xc3" name="TFMT5_ASTC_5x5"/>
+	<value value="0xc4" name="TFMT5_ASTC_6x5"/>
+	<value value="0xc5" name="TFMT5_ASTC_6x6"/>
+	<value value="0xc6" name="TFMT5_ASTC_8x5"/>
+	<value value="0xc7" name="TFMT5_ASTC_8x6"/>
+	<value value="0xc8" name="TFMT5_ASTC_8x8"/>
+	<value value="0xc9" name="TFMT5_ASTC_10x5"/>
+	<value value="0xca" name="TFMT5_ASTC_10x6"/>
+	<value value="0xcb" name="TFMT5_ASTC_10x8"/>
+	<value value="0xcc" name="TFMT5_ASTC_10x10"/>
+	<value value="0xcd" name="TFMT5_ASTC_12x10"/>
+	<value value="0xce" name="TFMT5_ASTC_12x12"/>
+
+	<value value="0xff" name="TFMT5_NONE"/>
+</enum>
+
+<enum name="a5xx_depth_format">
+	<value name="DEPTH5_NONE" value="0"/>
+	<value name="DEPTH5_16" value="1"/>
+	<value name="DEPTH5_24_8" value="2"/>
+	<value name="DEPTH5_32" value="4"/>
+</enum>
+
+<enum name="a5xx_blit_buf">
+	<value value="0" name="BLIT_MRT0"/>
+	<value value="1" name="BLIT_MRT1"/>
+	<value value="2" name="BLIT_MRT2"/>
+	<value value="3" name="BLIT_MRT3"/>
+	<value value="4" name="BLIT_MRT4"/>
+	<value value="5" name="BLIT_MRT5"/>
+	<value value="6" name="BLIT_MRT6"/>
+	<value value="7" name="BLIT_MRT7"/>
+	<value value="8" name="BLIT_ZS"/>       <!-- depth or combined depth+stencil -->
+	<value value="9" name="BLIT_S"/>        <!-- separate stencil -->
+</enum>
+
+<!-- see comment in a4xx.xml about script to extract countables from test-perf output -->
+<enum name="a5xx_cp_perfcounter_select">
+	<value value="0" name="PERF_CP_ALWAYS_COUNT"/>
+	<value value="1" name="PERF_CP_BUSY_GFX_CORE_IDLE"/>
+	<value value="2" name="PERF_CP_BUSY_CYCLES"/>
+	<value value="3" name="PERF_CP_PFP_IDLE"/>
+	<value value="4" name="PERF_CP_PFP_BUSY_WORKING"/>
+	<value value="5" name="PERF_CP_PFP_STALL_CYCLES_ANY"/>
+	<value value="6" name="PERF_CP_PFP_STARVE_CYCLES_ANY"/>
+	<value value="7" name="PERF_CP_PFP_ICACHE_MISS"/>
+	<value value="8" name="PERF_CP_PFP_ICACHE_HIT"/>
+	<value value="9" name="PERF_CP_PFP_MATCH_PM4_PKT_PROFILE"/>
+	<value value="10" name="PERF_CP_ME_BUSY_WORKING"/>
+	<value value="11" name="PERF_CP_ME_IDLE"/>
+	<value value="12" name="PERF_CP_ME_STARVE_CYCLES_ANY"/>
+	<value value="13" name="PERF_CP_ME_FIFO_EMPTY_PFP_IDLE"/>
+	<value value="14" name="PERF_CP_ME_FIFO_EMPTY_PFP_BUSY"/>
+	<value value="15" name="PERF_CP_ME_FIFO_FULL_ME_BUSY"/>
+	<value value="16" name="PERF_CP_ME_FIFO_FULL_ME_NON_WORKING"/>
+	<value value="17" name="PERF_CP_ME_STALL_CYCLES_ANY"/>
+	<value value="18" name="PERF_CP_ME_ICACHE_MISS"/>
+	<value value="19" name="PERF_CP_ME_ICACHE_HIT"/>
+	<value value="20" name="PERF_CP_NUM_PREEMPTIONS"/>
+	<value value="21" name="PERF_CP_PREEMPTION_REACTION_DELAY"/>
+	<value value="22" name="PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
+	<value value="23" name="PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
+	<value value="24" name="PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
+	<value value="25" name="PERF_CP_PREDICATED_DRAWS_KILLED"/>
+	<value value="26" name="PERF_CP_MODE_SWITCH"/>
+	<value value="27" name="PERF_CP_ZPASS_DONE"/>
+	<value value="28" name="PERF_CP_CONTEXT_DONE"/>
+	<value value="29" name="PERF_CP_CACHE_FLUSH"/>
+	<value value="30" name="PERF_CP_LONG_PREEMPTIONS"/>
+</enum>
+
+<enum name="a5xx_rbbm_perfcounter_select">
+	<value value="0" name="PERF_RBBM_ALWAYS_COUNT"/>
+	<value value="1" name="PERF_RBBM_ALWAYS_ON"/>
+	<value value="2" name="PERF_RBBM_TSE_BUSY"/>
+	<value value="3" name="PERF_RBBM_RAS_BUSY"/>
+	<value value="4" name="PERF_RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="PERF_RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="PERF_RBBM_STATUS_MASKED"/>
+	<value value="7" name="PERF_RBBM_COM_BUSY"/>
+	<value value="8" name="PERF_RBBM_DCOM_BUSY"/>
+	<value value="9" name="PERF_RBBM_VBIF_BUSY"/>
+	<value value="10" name="PERF_RBBM_VSC_BUSY"/>
+	<value value="11" name="PERF_RBBM_TESS_BUSY"/>
+	<value value="12" name="PERF_RBBM_UCHE_BUSY"/>
+	<value value="13" name="PERF_RBBM_HLSQ_BUSY"/>
+</enum>
+
+<enum name="a5xx_pc_perfcounter_select">
+	<value value="0" name="PERF_PC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_PC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_PC_STALL_CYCLES_VFD"/>
+	<value value="3" name="PERF_PC_STALL_CYCLES_TSE"/>
+	<value value="4" name="PERF_PC_STALL_CYCLES_VPC"/>
+	<value value="5" name="PERF_PC_STALL_CYCLES_UCHE"/>
+	<value value="6" name="PERF_PC_STALL_CYCLES_TESS"/>
+	<value value="7" name="PERF_PC_STALL_CYCLES_TSE_ONLY"/>
+	<value value="8" name="PERF_PC_STALL_CYCLES_VPC_ONLY"/>
+	<value value="9" name="PERF_PC_PASS1_TF_STALL_CYCLES"/>
+	<value value="10" name="PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
+	<value value="11" name="PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+	<value value="12" name="PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+	<value value="13" name="PERF_PC_STARVE_CYCLES_FOR_POSITION"/>
+	<value value="14" name="PERF_PC_STARVE_CYCLES_DI"/>
+	<value value="15" name="PERF_PC_VIS_STREAMS_LOADED"/>
+	<value value="16" name="PERF_PC_INSTANCES"/>
+	<value value="17" name="PERF_PC_VPC_PRIMITIVES"/>
+	<value value="18" name="PERF_PC_DEAD_PRIM"/>
+	<value value="19" name="PERF_PC_LIVE_PRIM"/>
+	<value value="20" name="PERF_PC_VERTEX_HITS"/>
+	<value value="21" name="PERF_PC_IA_VERTICES"/>
+	<value value="22" name="PERF_PC_IA_PRIMITIVES"/>
+	<value value="23" name="PERF_PC_GS_PRIMITIVES"/>
+	<value value="24" name="PERF_PC_HS_INVOCATIONS"/>
+	<value value="25" name="PERF_PC_DS_INVOCATIONS"/>
+	<value value="26" name="PERF_PC_VS_INVOCATIONS"/>
+	<value value="27" name="PERF_PC_GS_INVOCATIONS"/>
+	<value value="28" name="PERF_PC_DS_PRIMITIVES"/>
+	<value value="29" name="PERF_PC_VPC_POS_DATA_TRANSACTION"/>
+	<value value="30" name="PERF_PC_3D_DRAWCALLS"/>
+	<value value="31" name="PERF_PC_2D_DRAWCALLS"/>
+	<value value="32" name="PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
+	<value value="33" name="PERF_TESS_BUSY_CYCLES"/>
+	<value value="34" name="PERF_TESS_WORKING_CYCLES"/>
+	<value value="35" name="PERF_TESS_STALL_CYCLES_PC"/>
+	<value value="36" name="PERF_TESS_STARVE_CYCLES_PC"/>
+</enum>
+
+<enum name="a5xx_vfd_perfcounter_select">
+	<value value="0" name="PERF_VFD_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VFD_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
+	<value value="3" name="PERF_VFD_STALL_CYCLES_MISS_VB"/>
+	<value value="4" name="PERF_VFD_STALL_CYCLES_MISS_Q"/>
+	<value value="5" name="PERF_VFD_STALL_CYCLES_SP_INFO"/>
+	<value value="6" name="PERF_VFD_STALL_CYCLES_SP_ATTR"/>
+	<value value="7" name="PERF_VFD_STALL_CYCLES_VFDP_VB"/>
+	<value value="8" name="PERF_VFD_STALL_CYCLES_VFDP_Q"/>
+	<value value="9" name="PERF_VFD_DECODER_PACKER_STALL"/>
+	<value value="10" name="PERF_VFD_STARVE_CYCLES_UCHE"/>
+	<value value="11" name="PERF_VFD_RBUFFER_FULL"/>
+	<value value="12" name="PERF_VFD_ATTR_INFO_FIFO_FULL"/>
+	<value value="13" name="PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
+	<value value="14" name="PERF_VFD_NUM_ATTRIBUTES"/>
+	<value value="15" name="PERF_VFD_INSTRUCTIONS"/>
+	<value value="16" name="PERF_VFD_UPPER_SHADER_FIBERS"/>
+	<value value="17" name="PERF_VFD_LOWER_SHADER_FIBERS"/>
+	<value value="18" name="PERF_VFD_MODE_0_FIBERS"/>
+	<value value="19" name="PERF_VFD_MODE_1_FIBERS"/>
+	<value value="20" name="PERF_VFD_MODE_2_FIBERS"/>
+	<value value="21" name="PERF_VFD_MODE_3_FIBERS"/>
+	<value value="22" name="PERF_VFD_MODE_4_FIBERS"/>
+	<value value="23" name="PERF_VFD_TOTAL_VERTICES"/>
+	<value value="24" name="PERF_VFD_NUM_ATTR_MISS"/>
+	<value value="25" name="PERF_VFD_1_BURST_REQ"/>
+	<value value="26" name="PERF_VFDP_STALL_CYCLES_VFD"/>
+	<value value="27" name="PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
+	<value value="28" name="PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
+	<value value="29" name="PERF_VFDP_STARVE_CYCLES_PC"/>
+	<value value="30" name="PERF_VFDP_VS_STAGE_32_WAVES"/>
+</enum>
+
+<enum name="a5xx_hlsq_perfcounter_select">
+	<value value="0" name="PERF_HLSQ_BUSY_CYCLES"/>
+	<value value="1" name="PERF_HLSQ_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
+	<value value="3" name="PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+	<value value="4" name="PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
+	<value value="5" name="PERF_HLSQ_UCHE_LATENCY_COUNT"/>
+	<value value="6" name="PERF_HLSQ_FS_STAGE_32_WAVES"/>
+	<value value="7" name="PERF_HLSQ_FS_STAGE_64_WAVES"/>
+	<value value="8" name="PERF_HLSQ_QUADS"/>
+	<value value="9" name="PERF_HLSQ_SP_STATE_COPY_TRANS_FS_STAGE"/>
+	<value value="10" name="PERF_HLSQ_SP_STATE_COPY_TRANS_VS_STAGE"/>
+	<value value="11" name="PERF_HLSQ_TP_STATE_COPY_TRANS_FS_STAGE"/>
+	<value value="12" name="PERF_HLSQ_TP_STATE_COPY_TRANS_VS_STAGE"/>
+	<value value="13" name="PERF_HLSQ_CS_INVOCATIONS"/>
+	<value value="14" name="PERF_HLSQ_COMPUTE_DRAWCALLS"/>
+</enum>
+
+<enum name="a5xx_vpc_perfcounter_select">
+	<value value="0" name="PERF_VPC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VPC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_VPC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="PERF_VPC_STALL_CYCLES_VFD_WACK"/>
+	<value value="4" name="PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
+	<value value="5" name="PERF_VPC_STALL_CYCLES_PC"/>
+	<value value="6" name="PERF_VPC_STALL_CYCLES_SP_LM"/>
+	<value value="7" name="PERF_VPC_POS_EXPORT_STALL_CYCLES"/>
+	<value value="8" name="PERF_VPC_STARVE_CYCLES_SP"/>
+	<value value="9" name="PERF_VPC_STARVE_CYCLES_LRZ"/>
+	<value value="10" name="PERF_VPC_PC_PRIMITIVES"/>
+	<value value="11" name="PERF_VPC_SP_COMPONENTS"/>
+	<value value="12" name="PERF_VPC_SP_LM_PRIMITIVES"/>
+	<value value="13" name="PERF_VPC_SP_LM_COMPONENTS"/>
+	<value value="14" name="PERF_VPC_SP_LM_DWORDS"/>
+	<value value="15" name="PERF_VPC_STREAMOUT_COMPONENTS"/>
+	<value value="16" name="PERF_VPC_GRANT_PHASES"/>
+</enum>
+
+<enum name="a5xx_tse_perfcounter_select">
+	<value value="0" name="PERF_TSE_BUSY_CYCLES"/>
+	<value value="1" name="PERF_TSE_CLIPPING_CYCLES"/>
+	<value value="2" name="PERF_TSE_STALL_CYCLES_RAS"/>
+	<value value="3" name="PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
+	<value value="4" name="PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
+	<value value="5" name="PERF_TSE_STARVE_CYCLES_PC"/>
+	<value value="6" name="PERF_TSE_INPUT_PRIM"/>
+	<value value="7" name="PERF_TSE_INPUT_NULL_PRIM"/>
+	<value value="8" name="PERF_TSE_TRIVAL_REJ_PRIM"/>
+	<value value="9" name="PERF_TSE_CLIPPED_PRIM"/>
+	<value value="10" name="PERF_TSE_ZERO_AREA_PRIM"/>
+	<value value="11" name="PERF_TSE_FACENESS_CULLED_PRIM"/>
+	<value value="12" name="PERF_TSE_ZERO_PIXEL_PRIM"/>
+	<value value="13" name="PERF_TSE_OUTPUT_NULL_PRIM"/>
+	<value value="14" name="PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
+	<value value="15" name="PERF_TSE_CINVOCATION"/>
+	<value value="16" name="PERF_TSE_CPRIMITIVES"/>
+	<value value="17" name="PERF_TSE_2D_INPUT_PRIM"/>
+	<value value="18" name="PERF_TSE_2D_ALIVE_CLCLES"/>
+</enum>
+
+<enum name="a5xx_ras_perfcounter_select">
+	<value value="0" name="PERF_RAS_BUSY_CYCLES"/>
+	<value value="1" name="PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
+	<value value="2" name="PERF_RAS_STALL_CYCLES_LRZ"/>
+	<value value="3" name="PERF_RAS_STARVE_CYCLES_TSE"/>
+	<value value="4" name="PERF_RAS_SUPER_TILES"/>
+	<value value="5" name="PERF_RAS_8X4_TILES"/>
+	<value value="6" name="PERF_RAS_MASKGEN_ACTIVE"/>
+	<value value="7" name="PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
+	<value value="8" name="PERF_RAS_FULLY_COVERED_8X4_TILES"/>
+	<value value="9" name="PERF_RAS_PRIM_KILLED_INVISILBE"/>
+</enum>
+
+<enum name="a5xx_lrz_perfcounter_select">
+	<value value="0" name="PERF_LRZ_BUSY_CYCLES"/>
+	<value value="1" name="PERF_LRZ_STARVE_CYCLES_RAS"/>
+	<value value="2" name="PERF_LRZ_STALL_CYCLES_RB"/>
+	<value value="3" name="PERF_LRZ_STALL_CYCLES_VSC"/>
+	<value value="4" name="PERF_LRZ_STALL_CYCLES_VPC"/>
+	<value value="5" name="PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
+	<value value="6" name="PERF_LRZ_STALL_CYCLES_UCHE"/>
+	<value value="7" name="PERF_LRZ_LRZ_READ"/>
+	<value value="8" name="PERF_LRZ_LRZ_WRITE"/>
+	<value value="9" name="PERF_LRZ_READ_LATENCY"/>
+	<value value="10" name="PERF_LRZ_MERGE_CACHE_UPDATING"/>
+	<value value="11" name="PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
+	<value value="12" name="PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
+	<value value="13" name="PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
+	<value value="14" name="PERF_LRZ_FULL_8X8_TILES"/>
+	<value value="15" name="PERF_LRZ_PARTIAL_8X8_TILES"/>
+	<value value="16" name="PERF_LRZ_TILE_KILLED"/>
+	<value value="17" name="PERF_LRZ_TOTAL_PIXEL"/>
+	<value value="18" name="PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
+</enum>
+
+<enum name="a5xx_uche_perfcounter_select">
+	<value value="0" name="PERF_UCHE_BUSY_CYCLES"/>
+	<value value="1" name="PERF_UCHE_STALL_CYCLES_VBIF"/>
+	<value value="2" name="PERF_UCHE_VBIF_LATENCY_CYCLES"/>
+	<value value="3" name="PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
+	<value value="4" name="PERF_UCHE_VBIF_READ_BEATS_TP"/>
+	<value value="5" name="PERF_UCHE_VBIF_READ_BEATS_VFD"/>
+	<value value="6" name="PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
+	<value value="7" name="PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
+	<value value="8" name="PERF_UCHE_VBIF_READ_BEATS_SP"/>
+	<value value="9" name="PERF_UCHE_READ_REQUESTS_TP"/>
+	<value value="10" name="PERF_UCHE_READ_REQUESTS_VFD"/>
+	<value value="11" name="PERF_UCHE_READ_REQUESTS_HLSQ"/>
+	<value value="12" name="PERF_UCHE_READ_REQUESTS_LRZ"/>
+	<value value="13" name="PERF_UCHE_READ_REQUESTS_SP"/>
+	<value value="14" name="PERF_UCHE_WRITE_REQUESTS_LRZ"/>
+	<value value="15" name="PERF_UCHE_WRITE_REQUESTS_SP"/>
+	<value value="16" name="PERF_UCHE_WRITE_REQUESTS_VPC"/>
+	<value value="17" name="PERF_UCHE_WRITE_REQUESTS_VSC"/>
+	<value value="18" name="PERF_UCHE_EVICTS"/>
+	<value value="19" name="PERF_UCHE_BANK_REQ0"/>
+	<value value="20" name="PERF_UCHE_BANK_REQ1"/>
+	<value value="21" name="PERF_UCHE_BANK_REQ2"/>
+	<value value="22" name="PERF_UCHE_BANK_REQ3"/>
+	<value value="23" name="PERF_UCHE_BANK_REQ4"/>
+	<value value="24" name="PERF_UCHE_BANK_REQ5"/>
+	<value value="25" name="PERF_UCHE_BANK_REQ6"/>
+	<value value="26" name="PERF_UCHE_BANK_REQ7"/>
+	<value value="27" name="PERF_UCHE_VBIF_READ_BEATS_CH0"/>
+	<value value="28" name="PERF_UCHE_VBIF_READ_BEATS_CH1"/>
+	<value value="29" name="PERF_UCHE_GMEM_READ_BEATS"/>
+	<value value="30" name="PERF_UCHE_FLAG_COUNT"/>
+</enum>
+
+<enum name="a5xx_tp_perfcounter_select">
+	<value value="0" name="PERF_TP_BUSY_CYCLES"/>
+	<value value="1" name="PERF_TP_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_TP_LATENCY_CYCLES"/>
+	<value value="3" name="PERF_TP_LATENCY_TRANS"/>
+	<value value="4" name="PERF_TP_FLAG_CACHE_REQUEST_SAMPLES"/>
+	<value value="5" name="PERF_TP_FLAG_CACHE_REQUEST_LATENCY"/>
+	<value value="6" name="PERF_TP_L1_CACHELINE_REQUESTS"/>
+	<value value="7" name="PERF_TP_L1_CACHELINE_MISSES"/>
+	<value value="8" name="PERF_TP_SP_TP_TRANS"/>
+	<value value="9" name="PERF_TP_TP_SP_TRANS"/>
+	<value value="10" name="PERF_TP_OUTPUT_PIXELS"/>
+	<value value="11" name="PERF_TP_FILTER_WORKLOAD_16BIT"/>
+	<value value="12" name="PERF_TP_FILTER_WORKLOAD_32BIT"/>
+	<value value="13" name="PERF_TP_QUADS_RECEIVED"/>
+	<value value="14" name="PERF_TP_QUADS_OFFSET"/>
+	<value value="15" name="PERF_TP_QUADS_SHADOW"/>
+	<value value="16" name="PERF_TP_QUADS_ARRAY"/>
+	<value value="17" name="PERF_TP_QUADS_GRADIENT"/>
+	<value value="18" name="PERF_TP_QUADS_1D"/>
+	<value value="19" name="PERF_TP_QUADS_2D"/>
+	<value value="20" name="PERF_TP_QUADS_BUFFER"/>
+	<value value="21" name="PERF_TP_QUADS_3D"/>
+	<value value="22" name="PERF_TP_QUADS_CUBE"/>
+	<value value="23" name="PERF_TP_STATE_CACHE_REQUESTS"/>
+	<value value="24" name="PERF_TP_STATE_CACHE_MISSES"/>
+	<value value="25" name="PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
+	<value value="26" name="PERF_TP_BINDLESS_STATE_CACHE_REQUESTS"/>
+	<value value="27" name="PERF_TP_BINDLESS_STATE_CACHE_MISSES"/>
+	<value value="28" name="PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
+	<value value="29" name="PERF_TP_OUTPUT_PIXELS_POINT"/>
+	<value value="30" name="PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="31" name="PERF_TP_OUTPUT_PIXELS_MIP"/>
+	<value value="32" name="PERF_TP_OUTPUT_PIXELS_ANISO"/>
+	<value value="33" name="PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
+	<value value="34" name="PERF_TP_FLAG_CACHE_REQUESTS"/>
+	<value value="35" name="PERF_TP_FLAG_CACHE_MISSES"/>
+	<value value="36" name="PERF_TP_L1_5_L2_REQUESTS"/>
+	<value value="37" name="PERF_TP_2D_OUTPUT_PIXELS"/>
+	<value value="38" name="PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
+	<value value="39" name="PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="40" name="PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
+	<value value="41" name="PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
+</enum>
+
+<enum name="a5xx_sp_perfcounter_select">
+	<value value="0" name="PERF_SP_BUSY_CYCLES"/>
+	<value value="1" name="PERF_SP_ALU_WORKING_CYCLES"/>
+	<value value="2" name="PERF_SP_EFU_WORKING_CYCLES"/>
+	<value value="3" name="PERF_SP_STALL_CYCLES_VPC"/>
+	<value value="4" name="PERF_SP_STALL_CYCLES_TP"/>
+	<value value="5" name="PERF_SP_STALL_CYCLES_UCHE"/>
+	<value value="6" name="PERF_SP_STALL_CYCLES_RB"/>
+	<value value="7" name="PERF_SP_SCHEDULER_NON_WORKING"/>
+	<value value="8" name="PERF_SP_WAVE_CONTEXTS"/>
+	<value value="9" name="PERF_SP_WAVE_CONTEXT_CYCLES"/>
+	<value value="10" name="PERF_SP_FS_STAGE_WAVE_CYCLES"/>
+	<value value="11" name="PERF_SP_FS_STAGE_WAVE_SAMPLES"/>
+	<value value="12" name="PERF_SP_VS_STAGE_WAVE_CYCLES"/>
+	<value value="13" name="PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
+	<value value="14" name="PERF_SP_FS_STAGE_DURATION_CYCLES"/>
+	<value value="15" name="PERF_SP_VS_STAGE_DURATION_CYCLES"/>
+	<value value="16" name="PERF_SP_WAVE_CTRL_CYCLES"/>
+	<value value="17" name="PERF_SP_WAVE_LOAD_CYCLES"/>
+	<value value="18" name="PERF_SP_WAVE_EMIT_CYCLES"/>
+	<value value="19" name="PERF_SP_WAVE_NOP_CYCLES"/>
+	<value value="20" name="PERF_SP_WAVE_WAIT_CYCLES"/>
+	<value value="21" name="PERF_SP_WAVE_FETCH_CYCLES"/>
+	<value value="22" name="PERF_SP_WAVE_IDLE_CYCLES"/>
+	<value value="23" name="PERF_SP_WAVE_END_CYCLES"/>
+	<value value="24" name="PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
+	<value value="25" name="PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
+	<value value="26" name="PERF_SP_WAVE_JOIN_CYCLES"/>
+	<value value="27" name="PERF_SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="28" name="PERF_SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="29" name="PERF_SP_LM_ATOMICS"/>
+	<value value="30" name="PERF_SP_GM_LOAD_INSTRUCTIONS"/>
+	<value value="31" name="PERF_SP_GM_STORE_INSTRUCTIONS"/>
+	<value value="32" name="PERF_SP_GM_ATOMICS"/>
+	<value value="33" name="PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="34" name="PERF_SP_VS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="35" name="PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="36" name="PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="37" name="PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="38" name="PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="39" name="PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="40" name="PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="41" name="PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="42" name="PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="43" name="PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
+	<value value="44" name="PERF_SP_VS_INSTRUCTIONS"/>
+	<value value="45" name="PERF_SP_FS_INSTRUCTIONS"/>
+	<value value="46" name="PERF_SP_ADDR_LOCK_COUNT"/>
+	<value value="47" name="PERF_SP_UCHE_READ_TRANS"/>
+	<value value="48" name="PERF_SP_UCHE_WRITE_TRANS"/>
+	<value value="49" name="PERF_SP_EXPORT_VPC_TRANS"/>
+	<value value="50" name="PERF_SP_EXPORT_RB_TRANS"/>
+	<value value="51" name="PERF_SP_PIXELS_KILLED"/>
+	<value value="52" name="PERF_SP_ICL1_REQUESTS"/>
+	<value value="53" name="PERF_SP_ICL1_MISSES"/>
+	<value value="54" name="PERF_SP_ICL0_REQUESTS"/>
+	<value value="55" name="PERF_SP_ICL0_MISSES"/>
+	<value value="56" name="PERF_SP_HS_INSTRUCTIONS"/>
+	<value value="57" name="PERF_SP_DS_INSTRUCTIONS"/>
+	<value value="58" name="PERF_SP_GS_INSTRUCTIONS"/>
+	<value value="59" name="PERF_SP_CS_INSTRUCTIONS"/>
+	<value value="60" name="PERF_SP_GPR_READ"/>
+	<value value="61" name="PERF_SP_GPR_WRITE"/>
+	<value value="62" name="PERF_SP_LM_CH0_REQUESTS"/>
+	<value value="63" name="PERF_SP_LM_CH1_REQUESTS"/>
+	<value value="64" name="PERF_SP_LM_BANK_CONFLICTS"/>
+</enum>
+
+<enum name="a5xx_rb_perfcounter_select">
+	<value value="0" name="PERF_RB_BUSY_CYCLES"/>
+	<value value="1" name="PERF_RB_STALL_CYCLES_CCU"/>
+	<value value="2" name="PERF_RB_STALL_CYCLES_HLSQ"/>
+	<value value="3" name="PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
+	<value value="4" name="PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
+	<value value="5" name="PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
+	<value value="6" name="PERF_RB_STARVE_CYCLES_SP"/>
+	<value value="7" name="PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
+	<value value="8" name="PERF_RB_STARVE_CYCLES_CCU"/>
+	<value value="9" name="PERF_RB_STARVE_CYCLES_Z_PLANE"/>
+	<value value="10" name="PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
+	<value value="11" name="PERF_RB_Z_WORKLOAD"/>
+	<value value="12" name="PERF_RB_HLSQ_ACTIVE"/>
+	<value value="13" name="PERF_RB_Z_READ"/>
+	<value value="14" name="PERF_RB_Z_WRITE"/>
+	<value value="15" name="PERF_RB_C_READ"/>
+	<value value="16" name="PERF_RB_C_WRITE"/>
+	<value value="17" name="PERF_RB_TOTAL_PASS"/>
+	<value value="18" name="PERF_RB_Z_PASS"/>
+	<value value="19" name="PERF_RB_Z_FAIL"/>
+	<value value="20" name="PERF_RB_S_FAIL"/>
+	<value value="21" name="PERF_RB_BLENDED_FXP_COMPONENTS"/>
+	<value value="22" name="PERF_RB_BLENDED_FP16_COMPONENTS"/>
+	<value value="23" name="RB_RESERVED"/>
+	<value value="24" name="PERF_RB_2D_ALIVE_CYCLES"/>
+	<value value="25" name="PERF_RB_2D_STALL_CYCLES_A2D"/>
+	<value value="26" name="PERF_RB_2D_STARVE_CYCLES_SRC"/>
+	<value value="27" name="PERF_RB_2D_STARVE_CYCLES_SP"/>
+	<value value="28" name="PERF_RB_2D_STARVE_CYCLES_DST"/>
+	<value value="29" name="PERF_RB_2D_VALID_PIXELS"/>
+</enum>
+
+<enum name="a5xx_rb_samples_perfcounter_select">
+	<value value="0" name="TOTAL_SAMPLES"/>
+	<value value="1" name="ZPASS_SAMPLES"/>
+	<value value="2" name="ZFAIL_SAMPLES"/>
+	<value value="3" name="SFAIL_SAMPLES"/>
+</enum>
+
+<enum name="a5xx_vsc_perfcounter_select">
+	<value value="0" name="PERF_VSC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VSC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_VSC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="PERF_VSC_EOT_NUM"/>
+</enum>
+
+<enum name="a5xx_ccu_perfcounter_select">
+	<value value="0" name="PERF_CCU_BUSY_CYCLES"/>
+	<value value="1" name="PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
+	<value value="2" name="PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
+	<value value="3" name="PERF_CCU_STARVE_CYCLES_FLAG_RETURN"/>
+	<value value="4" name="PERF_CCU_DEPTH_BLOCKS"/>
+	<value value="5" name="PERF_CCU_COLOR_BLOCKS"/>
+	<value value="6" name="PERF_CCU_DEPTH_BLOCK_HIT"/>
+	<value value="7" name="PERF_CCU_COLOR_BLOCK_HIT"/>
+	<value value="8" name="PERF_CCU_PARTIAL_BLOCK_READ"/>
+	<value value="9" name="PERF_CCU_GMEM_READ"/>
+	<value value="10" name="PERF_CCU_GMEM_WRITE"/>
+	<value value="11" name="PERF_CCU_DEPTH_READ_FLAG0_COUNT"/>
+	<value value="12" name="PERF_CCU_DEPTH_READ_FLAG1_COUNT"/>
+	<value value="13" name="PERF_CCU_DEPTH_READ_FLAG2_COUNT"/>
+	<value value="14" name="PERF_CCU_DEPTH_READ_FLAG3_COUNT"/>
+	<value value="15" name="PERF_CCU_DEPTH_READ_FLAG4_COUNT"/>
+	<value value="16" name="PERF_CCU_COLOR_READ_FLAG0_COUNT"/>
+	<value value="17" name="PERF_CCU_COLOR_READ_FLAG1_COUNT"/>
+	<value value="18" name="PERF_CCU_COLOR_READ_FLAG2_COUNT"/>
+	<value value="19" name="PERF_CCU_COLOR_READ_FLAG3_COUNT"/>
+	<value value="20" name="PERF_CCU_COLOR_READ_FLAG4_COUNT"/>
+	<value value="21" name="PERF_CCU_2D_BUSY_CYCLES"/>
+	<value value="22" name="PERF_CCU_2D_RD_REQ"/>
+	<value value="23" name="PERF_CCU_2D_WR_REQ"/>
+	<value value="24" name="PERF_CCU_2D_REORDER_STARVE_CYCLES"/>
+	<value value="25" name="PERF_CCU_2D_PIXELS"/>
+</enum>
+
+<enum name="a5xx_cmp_perfcounter_select">
+	<value value="0" name="PERF_CMPDECMP_STALL_CYCLES_VBIF"/>
+	<value value="1" name="PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
+	<value value="2" name="PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
+	<value value="3" name="PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
+	<value value="4" name="PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
+	<value value="5" name="PERF_CMPDECMP_VBIF_READ_REQUEST"/>
+	<value value="6" name="PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
+	<value value="7" name="PERF_CMPDECMP_VBIF_READ_DATA"/>
+	<value value="8" name="PERF_CMPDECMP_VBIF_WRITE_DATA"/>
+	<value value="9" name="PERF_CMPDECMP_FLAG_FETCH_CYCLES"/>
+	<value value="10" name="PERF_CMPDECMP_FLAG_FETCH_SAMPLES"/>
+	<value value="11" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
+	<value value="12" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
+	<value value="13" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
+	<value value="14" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
+	<value value="15" name="PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
+	<value value="16" name="PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
+	<value value="17" name="PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
+	<value value="18" name="PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
+	<value value="19" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_REQ"/>
+	<value value="20" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_WR"/>
+	<value value="21" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_RETURN"/>
+	<value value="22" name="PERF_CMPDECMP_2D_RD_DATA"/>
+	<value value="23" name="PERF_CMPDECMP_2D_WR_DATA"/>
+</enum>
+
+<enum name="a5xx_vbif_perfcounter_select">
+	<value value="0" name="AXI_READ_REQUESTS_ID_0"/>
+	<value value="1" name="AXI_READ_REQUESTS_ID_1"/>
+	<value value="2" name="AXI_READ_REQUESTS_ID_2"/>
+	<value value="3" name="AXI_READ_REQUESTS_ID_3"/>
+	<value value="4" name="AXI_READ_REQUESTS_ID_4"/>
+	<value value="5" name="AXI_READ_REQUESTS_ID_5"/>
+	<value value="6" name="AXI_READ_REQUESTS_ID_6"/>
+	<value value="7" name="AXI_READ_REQUESTS_ID_7"/>
+	<value value="8" name="AXI_READ_REQUESTS_ID_8"/>
+	<value value="9" name="AXI_READ_REQUESTS_ID_9"/>
+	<value value="10" name="AXI_READ_REQUESTS_ID_10"/>
+	<value value="11" name="AXI_READ_REQUESTS_ID_11"/>
+	<value value="12" name="AXI_READ_REQUESTS_ID_12"/>
+	<value value="13" name="AXI_READ_REQUESTS_ID_13"/>
+	<value value="14" name="AXI_READ_REQUESTS_ID_14"/>
+	<value value="15" name="AXI_READ_REQUESTS_ID_15"/>
+	<value value="16" name="AXI0_READ_REQUESTS_TOTAL"/>
+	<value value="17" name="AXI1_READ_REQUESTS_TOTAL"/>
+	<value value="18" name="AXI2_READ_REQUESTS_TOTAL"/>
+	<value value="19" name="AXI3_READ_REQUESTS_TOTAL"/>
+	<value value="20" name="AXI_READ_REQUESTS_TOTAL"/>
+	<value value="21" name="AXI_WRITE_REQUESTS_ID_0"/>
+	<value value="22" name="AXI_WRITE_REQUESTS_ID_1"/>
+	<value value="23" name="AXI_WRITE_REQUESTS_ID_2"/>
+	<value value="24" name="AXI_WRITE_REQUESTS_ID_3"/>
+	<value value="25" name="AXI_WRITE_REQUESTS_ID_4"/>
+	<value value="26" name="AXI_WRITE_REQUESTS_ID_5"/>
+	<value value="27" name="AXI_WRITE_REQUESTS_ID_6"/>
+	<value value="28" name="AXI_WRITE_REQUESTS_ID_7"/>
+	<value value="29" name="AXI_WRITE_REQUESTS_ID_8"/>
+	<value value="30" name="AXI_WRITE_REQUESTS_ID_9"/>
+	<value value="31" name="AXI_WRITE_REQUESTS_ID_10"/>
+	<value value="32" name="AXI_WRITE_REQUESTS_ID_11"/>
+	<value value="33" name="AXI_WRITE_REQUESTS_ID_12"/>
+	<value value="34" name="AXI_WRITE_REQUESTS_ID_13"/>
+	<value value="35" name="AXI_WRITE_REQUESTS_ID_14"/>
+	<value value="36" name="AXI_WRITE_REQUESTS_ID_15"/>
+	<value value="37" name="AXI0_WRITE_REQUESTS_TOTAL"/>
+	<value value="38" name="AXI1_WRITE_REQUESTS_TOTAL"/>
+	<value value="39" name="AXI2_WRITE_REQUESTS_TOTAL"/>
+	<value value="40" name="AXI3_WRITE_REQUESTS_TOTAL"/>
+	<value value="41" name="AXI_WRITE_REQUESTS_TOTAL"/>
+	<value value="42" name="AXI_TOTAL_REQUESTS"/>
+	<value value="43" name="AXI_READ_DATA_BEATS_ID_0"/>
+	<value value="44" name="AXI_READ_DATA_BEATS_ID_1"/>
+	<value value="45" name="AXI_READ_DATA_BEATS_ID_2"/>
+	<value value="46" name="AXI_READ_DATA_BEATS_ID_3"/>
+	<value value="47" name="AXI_READ_DATA_BEATS_ID_4"/>
+	<value value="48" name="AXI_READ_DATA_BEATS_ID_5"/>
+	<value value="49" name="AXI_READ_DATA_BEATS_ID_6"/>
+	<value value="50" name="AXI_READ_DATA_BEATS_ID_7"/>
+	<value value="51" name="AXI_READ_DATA_BEATS_ID_8"/>
+	<value value="52" name="AXI_READ_DATA_BEATS_ID_9"/>
+	<value value="53" name="AXI_READ_DATA_BEATS_ID_10"/>
+	<value value="54" name="AXI_READ_DATA_BEATS_ID_11"/>
+	<value value="55" name="AXI_READ_DATA_BEATS_ID_12"/>
+	<value value="56" name="AXI_READ_DATA_BEATS_ID_13"/>
+	<value value="57" name="AXI_READ_DATA_BEATS_ID_14"/>
+	<value value="58" name="AXI_READ_DATA_BEATS_ID_15"/>
+	<value value="59" name="AXI0_READ_DATA_BEATS_TOTAL"/>
+	<value value="60" name="AXI1_READ_DATA_BEATS_TOTAL"/>
+	<value value="61" name="AXI2_READ_DATA_BEATS_TOTAL"/>
+	<value value="62" name="AXI3_READ_DATA_BEATS_TOTAL"/>
+	<value value="63" name="AXI_READ_DATA_BEATS_TOTAL"/>
+	<value value="64" name="AXI_WRITE_DATA_BEATS_ID_0"/>
+	<value value="65" name="AXI_WRITE_DATA_BEATS_ID_1"/>
+	<value value="66" name="AXI_WRITE_DATA_BEATS_ID_2"/>
+	<value value="67" name="AXI_WRITE_DATA_BEATS_ID_3"/>
+	<value value="68" name="AXI_WRITE_DATA_BEATS_ID_4"/>
+	<value value="69" name="AXI_WRITE_DATA_BEATS_ID_5"/>
+	<value value="70" name="AXI_WRITE_DATA_BEATS_ID_6"/>
+	<value value="71" name="AXI_WRITE_DATA_BEATS_ID_7"/>
+	<value value="72" name="AXI_WRITE_DATA_BEATS_ID_8"/>
+	<value value="73" name="AXI_WRITE_DATA_BEATS_ID_9"/>
+	<value value="74" name="AXI_WRITE_DATA_BEATS_ID_10"/>
+	<value value="75" name="AXI_WRITE_DATA_BEATS_ID_11"/>
+	<value value="76" name="AXI_WRITE_DATA_BEATS_ID_12"/>
+	<value value="77" name="AXI_WRITE_DATA_BEATS_ID_13"/>
+	<value value="78" name="AXI_WRITE_DATA_BEATS_ID_14"/>
+	<value value="79" name="AXI_WRITE_DATA_BEATS_ID_15"/>
+	<value value="80" name="AXI0_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="81" name="AXI1_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="82" name="AXI2_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="83" name="AXI3_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="84" name="AXI_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="85" name="AXI_DATA_BEATS_TOTAL"/>
+</enum>
+
+<domain name="A5XX" width="32">
+	<bitset name="A5XX_INT0">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="RBBM_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="RBBM_TRANSFER_TIMEOUT" pos="2" type="boolean"/>
+		<bitfield name="RBBM_ME_MS_TIMEOUT" pos="3" type="boolean"/>
+		<bitfield name="RBBM_PFP_MS_TIMEOUT" pos="4" type="boolean"/>
+		<bitfield name="RBBM_ETS_MS_TIMEOUT" pos="5" type="boolean"/>
+		<bitfield name="RBBM_ATB_ASYNC_OVERFLOW" pos="6" type="boolean"/>
+		<bitfield name="RBBM_GPC_ERROR" pos="7" type="boolean"/>
+		<bitfield name="CP_SW" pos="8" type="boolean"/>
+		<bitfield name="CP_HW_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_DEPTH_TS" pos="10" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_COLOR_TS" pos="11" type="boolean"/>
+		<bitfield name="CP_CCU_RESOLVE_TS" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1" pos="14" type="boolean"/>
+		<bitfield name="CP_RB" pos="15" type="boolean"/>
+		<bitfield name="CP_UNUSED_1" pos="16" type="boolean"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_WT_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="UNKNOWN_1" pos="19" type="boolean"/>
+		<bitfield name="CP_CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="UNUSED_2" pos="21" type="boolean"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="22" type="boolean"/>
+		<bitfield name="MISC_HANG_DETECT" pos="23" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="24" type="boolean"/>
+		<bitfield name="UCHE_TRAP_INTR" pos="25" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_0" pos="26" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_1" pos="27" type="boolean"/>
+		<bitfield name="GPMU_VOLTAGE_DROOP" pos="28" type="boolean"/>
+		<bitfield name="GPMU_FIRMWARE" pos="29" type="boolean"/>
+		<bitfield name="ISDB_CPU_IRQ" pos="30" type="boolean"/>
+		<bitfield name="ISDB_UNDER_DEBUG" pos="31" type="boolean"/>
+	</bitset>
+
+	<!-- CP Interrupt bits -->
+	<bitset name="A5XX_CP_INT">
+		<bitfield name="CP_OPCODE_ERROR" pos="0" type="boolean"/>
+		<bitfield name="CP_RESERVED_BIT_ERROR" pos="1" type="boolean"/>
+		<bitfield name="CP_HW_FAULT_ERROR" pos="2" type="boolean"/>
+		<bitfield name="CP_DMA_ERROR" pos="3" type="boolean"/>
+		<bitfield name="CP_REGISTER_PROTECTION_ERROR" pos="4" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR" pos="5" type="boolean"/>
+	</bitset>
+
+	<!-- CP registers -->
+	<reg32 offset="0x0800" name="CP_RB_BASE"/>
+	<reg32 offset="0x0801" name="CP_RB_BASE_HI"/>
+	<reg32 offset="0x0802" name="CP_RB_CNTL"/>
+	<reg32 offset="0x0804" name="CP_RB_RPTR_ADDR"/>
+	<reg32 offset="0x0805" name="CP_RB_RPTR_ADDR_HI"/>
+	<reg32 offset="0x0806" name="CP_RB_RPTR"/>
+	<reg32 offset="0x0807" name="CP_RB_WPTR"/>
+	<reg32 offset="0x0808" name="CP_PFP_STAT_ADDR"/>
+	<reg32 offset="0x0809" name="CP_PFP_STAT_DATA"/>
+	<reg32 offset="0x080b" name="CP_DRAW_STATE_ADDR"/>
+	<reg32 offset="0x080c" name="CP_DRAW_STATE_DATA"/>
+	<reg32 offset="0x080d" name="CP_ME_NRT_ADDR_LO"/>
+	<reg32 offset="0x080e" name="CP_ME_NRT_ADDR_HI"/>
+	<reg32 offset="0x0810" name="CP_ME_NRT_DATA"/>
+	<reg32 offset="0x0817" name="CP_CRASH_SCRIPT_BASE_LO"/>
+	<reg32 offset="0x0818" name="CP_CRASH_SCRIPT_BASE_HI"/>
+	<reg32 offset="0x0819" name="CP_CRASH_DUMP_CNTL"/>
+	<reg32 offset="0x081a" name="CP_ME_STAT_ADDR"/>
+	<reg32 offset="0x081f" name="CP_ROQ_THRESHOLDS_1"/>
+	<reg32 offset="0x0820" name="CP_ROQ_THRESHOLDS_2"/>
+	<reg32 offset="0x0821" name="CP_ROQ_DBG_ADDR"/>
+	<reg32 offset="0x0822" name="CP_ROQ_DBG_DATA"/>
+	<reg32 offset="0x0823" name="CP_MEQ_DBG_ADDR"/>
+	<reg32 offset="0x0824" name="CP_MEQ_DBG_DATA"/>
+	<reg32 offset="0x0825" name="CP_MEQ_THRESHOLDS"/>
+	<reg32 offset="0x0826" name="CP_MERCIU_SIZE"/>
+	<reg32 offset="0x0827" name="CP_MERCIU_DBG_ADDR"/>
+	<reg32 offset="0x0828" name="CP_MERCIU_DBG_DATA_1"/>
+	<reg32 offset="0x0829" name="CP_MERCIU_DBG_DATA_2"/>
+	<reg32 offset="0x082a" name="CP_PFP_UCODE_DBG_ADDR"/>
+	<reg32 offset="0x082b" name="CP_PFP_UCODE_DBG_DATA"/>
+	<reg32 offset="0x082f" name="CP_ME_UCODE_DBG_ADDR"/>
+	<reg32 offset="0x0830" name="CP_ME_UCODE_DBG_DATA"/>
+	<reg32 offset="0x0831" name="CP_CNTL"/>
+	<reg32 offset="0x0832" name="CP_PFP_ME_CNTL"/>
+	<reg32 offset="0x0833" name="CP_CHICKEN_DBG"/>
+	<reg32 offset="0x0835" name="CP_PFP_INSTR_BASE_LO"/>
+	<reg32 offset="0x0836" name="CP_PFP_INSTR_BASE_HI"/>
+	<reg32 offset="0x0838" name="CP_ME_INSTR_BASE_LO"/>
+	<reg32 offset="0x0839" name="CP_ME_INSTR_BASE_HI"/>
+	<reg32 offset="0x083b" name="CP_CONTEXT_SWITCH_CNTL"/>
+	<reg32 offset="0x083c" name="CP_CONTEXT_SWITCH_RESTORE_ADDR_LO"/>
+	<reg32 offset="0x083d" name="CP_CONTEXT_SWITCH_RESTORE_ADDR_HI"/>
+	<reg32 offset="0x083e" name="CP_CONTEXT_SWITCH_SAVE_ADDR_LO"/>
+	<reg32 offset="0x083f" name="CP_CONTEXT_SWITCH_SAVE_ADDR_HI"/>
+	<reg32 offset="0x0840" name="CP_CONTEXT_SWITCH_SMMU_INFO_LO"/>
+	<reg32 offset="0x0841" name="CP_CONTEXT_SWITCH_SMMU_INFO_HI"/>
+	<reg32 offset="0x0860" name="CP_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0b14" name="CP_ME_STAT_DATA"/>
+	<reg32 offset="0x0b15" name="CP_WFI_PEND_CTR"/>
+	<reg32 offset="0x0b18" name="CP_INTERRUPT_STATUS"/>
+	<reg32 offset="0x0b1a" name="CP_HW_FAULT"/>
+	<reg32 offset="0x0b1c" name="CP_PROTECT_STATUS"/>
+	<reg32 offset="0x0b1f" name="CP_IB1_BASE"/>
+	<reg32 offset="0x0b20" name="CP_IB1_BASE_HI"/>
+	<reg32 offset="0x0b21" name="CP_IB1_BUFSZ"/>
+	<reg32 offset="0x0b22" name="CP_IB2_BASE"/>
+	<reg32 offset="0x0b23" name="CP_IB2_BASE_HI"/>
+	<reg32 offset="0x0b24" name="CP_IB2_BUFSZ"/>
+	<array offset="0x0b78" name="CP_SCRATCH" stride="1" length="8">
+		<reg32 offset="0x0" name="REG" type="uint"/>
+	</array>
+	<array offset="0x0880" name="CP_PROTECT" stride="1" length="32">
+		<reg32 offset="0x0" name="REG" type="adreno_cp_protect"/>
+	</array>
+	<reg32 offset="0x08a0" name="CP_PROTECT_CNTL"/>
+	<reg32 offset="0x0b1b" name="CP_AHB_FAULT"/>
+	<reg32 offset="0x0bb0" name="CP_PERFCTR_CP_SEL_0" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb1" name="CP_PERFCTR_CP_SEL_1" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb2" name="CP_PERFCTR_CP_SEL_2" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb3" name="CP_PERFCTR_CP_SEL_3" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb4" name="CP_PERFCTR_CP_SEL_4" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb5" name="CP_PERFCTR_CP_SEL_5" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb6" name="CP_PERFCTR_CP_SEL_6" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bb7" name="CP_PERFCTR_CP_SEL_7" type="a5xx_cp_perfcounter_select"/>
+	<reg32 offset="0x0bc1" name="VSC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0bba" name="CP_POWERCTR_CP_SEL_0"/>
+	<reg32 offset="0x0bbb" name="CP_POWERCTR_CP_SEL_1"/>
+	<reg32 offset="0x0bbc" name="CP_POWERCTR_CP_SEL_2"/>
+	<reg32 offset="0x0bbd" name="CP_POWERCTR_CP_SEL_3"/>
+
+	<!-- RBBM registers -->
+	<reg32 offset="0x0004" name="RBBM_CFG_DBGBUS_SEL_A"/>
+	<reg32 offset="0x0005" name="RBBM_CFG_DBGBUS_SEL_B"/>
+	<reg32 offset="0x0006" name="RBBM_CFG_DBGBUS_SEL_C"/>
+	<reg32 offset="0x0007" name="RBBM_CFG_DBGBUS_SEL_D"/>
+<!--
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PING_INDEX_SHIFT    0x0
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PING_BLK_SEL_SHIFT  0x8
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PONG_INDEX_SHIFT    0x10
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PONG_BLK_SEL_SHIFT  0x18
+ -->
+	<reg32 offset="0x0008" name="RBBM_CFG_DBGBUS_CNTLT"/>
+	<reg32 offset="0x0009" name="RBBM_CFG_DBGBUS_CNTLM"/>
+	<reg32 offset="0x0018" name="RBBM_CFG_DEBBUS_CTLTM_ENABLE_SHIFT"/>
+	<reg32 offset="0x000a" name="RBBM_CFG_DBGBUS_OPL"/>
+	<reg32 offset="0x000b" name="RBBM_CFG_DBGBUS_OPE"/>
+	<reg32 offset="0x000c" name="RBBM_CFG_DBGBUS_IVTL_0"/>
+	<reg32 offset="0x000d" name="RBBM_CFG_DBGBUS_IVTL_1"/>
+	<reg32 offset="0x000e" name="RBBM_CFG_DBGBUS_IVTL_2"/>
+	<reg32 offset="0x000f" name="RBBM_CFG_DBGBUS_IVTL_3"/>
+	<reg32 offset="0x0010" name="RBBM_CFG_DBGBUS_MASKL_0"/>
+	<reg32 offset="0x0011" name="RBBM_CFG_DBGBUS_MASKL_1"/>
+	<reg32 offset="0x0012" name="RBBM_CFG_DBGBUS_MASKL_2"/>
+	<reg32 offset="0x0013" name="RBBM_CFG_DBGBUS_MASKL_3"/>
+	<reg32 offset="0x0014" name="RBBM_CFG_DBGBUS_BYTEL_0"/>
+	<reg32 offset="0x0015" name="RBBM_CFG_DBGBUS_BYTEL_1"/>
+	<reg32 offset="0x0016" name="RBBM_CFG_DBGBUS_IVTE_0"/>
+	<reg32 offset="0x0017" name="RBBM_CFG_DBGBUS_IVTE_1"/>
+	<reg32 offset="0x0018" name="RBBM_CFG_DBGBUS_IVTE_2"/>
+	<reg32 offset="0x0019" name="RBBM_CFG_DBGBUS_IVTE_3"/>
+	<reg32 offset="0x001a" name="RBBM_CFG_DBGBUS_MASKE_0"/>
+	<reg32 offset="0x001b" name="RBBM_CFG_DBGBUS_MASKE_1"/>
+	<reg32 offset="0x001c" name="RBBM_CFG_DBGBUS_MASKE_2"/>
+	<reg32 offset="0x001d" name="RBBM_CFG_DBGBUS_MASKE_3"/>
+	<reg32 offset="0x001e" name="RBBM_CFG_DBGBUS_NIBBLEE"/>
+	<reg32 offset="0x001f" name="RBBM_CFG_DBGBUS_PTRC0"/>
+	<reg32 offset="0x0020" name="RBBM_CFG_DBGBUS_PTRC1"/>
+	<reg32 offset="0x0021" name="RBBM_CFG_DBGBUS_LOADREG"/>
+	<reg32 offset="0x0022" name="RBBM_CFG_DBGBUS_IDX"/>
+	<reg32 offset="0x0023" name="RBBM_CFG_DBGBUS_CLRC"/>
+	<reg32 offset="0x0024" name="RBBM_CFG_DBGBUS_LOADIVT"/>
+	<reg32 offset="0x002f" name="RBBM_INTERFACE_HANG_INT_CNTL"/>
+	<reg32 offset="0x0037" name="RBBM_INT_CLEAR_CMD"/>
+	<reg32 offset="0x0038" name="RBBM_INT_0_MASK">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="RBBM_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="RBBM_TRANSFER_TIMEOUT" pos="2" type="boolean"/>
+		<bitfield name="RBBM_ME_MS_TIMEOUT" pos="3" type="boolean"/>
+		<bitfield name="RBBM_PFP_MS_TIMEOUT" pos="4" type="boolean"/>
+		<bitfield name="RBBM_ETS_MS_TIMEOUT" pos="5" type="boolean"/>
+		<bitfield name="RBBM_ATB_ASYNC_OVERFLOW" pos="6" type="boolean"/>
+		<bitfield name="RBBM_GPC_ERROR" pos="7" type="boolean"/>
+		<bitfield name="CP_SW" pos="8" type="boolean"/>
+		<bitfield name="CP_HW_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_DEPTH_TS" pos="10" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_COLOR_TS" pos="11" type="boolean"/>
+		<bitfield name="CP_CCU_RESOLVE_TS" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1" pos="14" type="boolean"/>
+		<bitfield name="CP_RB" pos="15" type="boolean"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_WT_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="CP_CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="22" type="boolean"/>
+		<bitfield name="MISC_HANG_DETECT" pos="23" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="24" type="boolean"/>
+		<bitfield name="UCHE_TRAP_INTR" pos="25" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_0" pos="26" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_1" pos="27" type="boolean"/>
+		<bitfield name="GPMU_VOLTAGE_DROOP" pos="28" type="boolean"/>
+		<bitfield name="GPMU_FIRMWARE" pos="29" type="boolean"/>
+		<bitfield name="ISDB_CPU_IRQ" pos="30" type="boolean"/>
+		<bitfield name="ISDB_UNDER_DEBUG" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x003f" name="RBBM_AHB_DBG_CNTL"/>
+	<reg32 offset="0x0041" name="RBBM_EXT_VBIF_DBG_CNTL"/>
+	<reg32 offset="0x0043" name="RBBM_SW_RESET_CMD"/>
+	<reg32 offset="0x0045" name="RBBM_BLOCK_SW_RESET_CMD"/>
+	<reg32 offset="0x0046" name="RBBM_BLOCK_SW_RESET_CMD2"/>
+	<reg32 offset="0x0048" name="RBBM_DBG_LO_HI_GPIO"/>
+	<reg32 offset="0x0049" name="RBBM_EXT_TRACE_BUS_CNTL"/>
+	<reg32 offset="0x004a" name="RBBM_CLOCK_CNTL_TP0"/>
+	<reg32 offset="0x004b" name="RBBM_CLOCK_CNTL_TP1"/>
+	<reg32 offset="0x004c" name="RBBM_CLOCK_CNTL_TP2"/>
+	<reg32 offset="0x004d" name="RBBM_CLOCK_CNTL_TP3"/>
+	<reg32 offset="0x004e" name="RBBM_CLOCK_CNTL2_TP0"/>
+	<reg32 offset="0x004f" name="RBBM_CLOCK_CNTL2_TP1"/>
+	<reg32 offset="0x0050" name="RBBM_CLOCK_CNTL2_TP2"/>
+	<reg32 offset="0x0051" name="RBBM_CLOCK_CNTL2_TP3"/>
+	<reg32 offset="0x0052" name="RBBM_CLOCK_CNTL3_TP0"/>
+	<reg32 offset="0x0053" name="RBBM_CLOCK_CNTL3_TP1"/>
+	<reg32 offset="0x0054" name="RBBM_CLOCK_CNTL3_TP2"/>
+	<reg32 offset="0x0055" name="RBBM_CLOCK_CNTL3_TP3"/>
+	<reg32 offset="0x0059" name="RBBM_READ_AHB_THROUGH_DBG"/>
+	<reg32 offset="0x005a" name="RBBM_CLOCK_CNTL_UCHE"/>
+	<reg32 offset="0x005b" name="RBBM_CLOCK_CNTL2_UCHE"/>
+	<reg32 offset="0x005c" name="RBBM_CLOCK_CNTL3_UCHE"/>
+	<reg32 offset="0x005d" name="RBBM_CLOCK_CNTL4_UCHE"/>
+	<reg32 offset="0x005e" name="RBBM_CLOCK_HYST_UCHE"/>
+	<reg32 offset="0x005f" name="RBBM_CLOCK_DELAY_UCHE"/>
+	<reg32 offset="0x0060" name="RBBM_CLOCK_MODE_GPC"/>
+	<reg32 offset="0x0061" name="RBBM_CLOCK_DELAY_GPC"/>
+	<reg32 offset="0x0062" name="RBBM_CLOCK_HYST_GPC"/>
+	<reg32 offset="0x0063" name="RBBM_CLOCK_CNTL_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0064" name="RBBM_CLOCK_HYST_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0065" name="RBBM_CLOCK_DELAY_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0066" name="RBBM_CLOCK_DELAY_HLSQ"/>
+	<reg32 offset="0x0067" name="RBBM_CLOCK_CNTL"/>
+	<reg32 offset="0x0068" name="RBBM_CLOCK_CNTL_SP0"/>
+	<reg32 offset="0x0069" name="RBBM_CLOCK_CNTL_SP1"/>
+	<reg32 offset="0x006a" name="RBBM_CLOCK_CNTL_SP2"/>
+	<reg32 offset="0x006b" name="RBBM_CLOCK_CNTL_SP3"/>
+	<reg32 offset="0x006c" name="RBBM_CLOCK_CNTL2_SP0"/>
+	<reg32 offset="0x006d" name="RBBM_CLOCK_CNTL2_SP1"/>
+	<reg32 offset="0x006e" name="RBBM_CLOCK_CNTL2_SP2"/>
+	<reg32 offset="0x006f" name="RBBM_CLOCK_CNTL2_SP3"/>
+	<reg32 offset="0x0070" name="RBBM_CLOCK_HYST_SP0"/>
+	<reg32 offset="0x0071" name="RBBM_CLOCK_HYST_SP1"/>
+	<reg32 offset="0x0072" name="RBBM_CLOCK_HYST_SP2"/>
+	<reg32 offset="0x0073" name="RBBM_CLOCK_HYST_SP3"/>
+	<reg32 offset="0x0074" name="RBBM_CLOCK_DELAY_SP0"/>
+	<reg32 offset="0x0075" name="RBBM_CLOCK_DELAY_SP1"/>
+	<reg32 offset="0x0076" name="RBBM_CLOCK_DELAY_SP2"/>
+	<reg32 offset="0x0077" name="RBBM_CLOCK_DELAY_SP3"/>
+	<reg32 offset="0x0078" name="RBBM_CLOCK_CNTL_RB0"/>
+	<reg32 offset="0x0079" name="RBBM_CLOCK_CNTL_RB1"/>
+	<reg32 offset="0x007a" name="RBBM_CLOCK_CNTL_RB2"/>
+	<reg32 offset="0x007b" name="RBBM_CLOCK_CNTL_RB3"/>
+	<reg32 offset="0x007c" name="RBBM_CLOCK_CNTL2_RB0"/>
+	<reg32 offset="0x007d" name="RBBM_CLOCK_CNTL2_RB1"/>
+	<reg32 offset="0x007e" name="RBBM_CLOCK_CNTL2_RB2"/>
+	<reg32 offset="0x007f" name="RBBM_CLOCK_CNTL2_RB3"/>
+	<reg32 offset="0x0080" name="RBBM_CLOCK_HYST_RAC"/>
+	<reg32 offset="0x0081" name="RBBM_CLOCK_DELAY_RAC"/>
+	<reg32 offset="0x0082" name="RBBM_CLOCK_CNTL_CCU0"/>
+	<reg32 offset="0x0083" name="RBBM_CLOCK_CNTL_CCU1"/>
+	<reg32 offset="0x0084" name="RBBM_CLOCK_CNTL_CCU2"/>
+	<reg32 offset="0x0085" name="RBBM_CLOCK_CNTL_CCU3"/>
+	<reg32 offset="0x0086" name="RBBM_CLOCK_HYST_RB_CCU0"/>
+	<reg32 offset="0x0087" name="RBBM_CLOCK_HYST_RB_CCU1"/>
+	<reg32 offset="0x0088" name="RBBM_CLOCK_HYST_RB_CCU2"/>
+	<reg32 offset="0x0089" name="RBBM_CLOCK_HYST_RB_CCU3"/>
+	<reg32 offset="0x008a" name="RBBM_CLOCK_CNTL_RAC"/>
+	<reg32 offset="0x008b" name="RBBM_CLOCK_CNTL2_RAC"/>
+	<reg32 offset="0x008c" name="RBBM_CLOCK_DELAY_RB_CCU_L1_0"/>
+	<reg32 offset="0x008d" name="RBBM_CLOCK_DELAY_RB_CCU_L1_1"/>
+	<reg32 offset="0x008e" name="RBBM_CLOCK_DELAY_RB_CCU_L1_2"/>
+	<reg32 offset="0x008f" name="RBBM_CLOCK_DELAY_RB_CCU_L1_3"/>
+	<reg32 offset="0x0090" name="RBBM_CLOCK_HYST_VFD"/>
+	<reg32 offset="0x0091" name="RBBM_CLOCK_MODE_VFD"/>
+	<reg32 offset="0x0092" name="RBBM_CLOCK_DELAY_VFD"/>
+	<reg32 offset="0x0093" name="RBBM_AHB_CNTL0"/>
+	<reg32 offset="0x0094" name="RBBM_AHB_CNTL1"/>
+	<reg32 offset="0x0095" name="RBBM_AHB_CNTL2"/>
+	<reg32 offset="0x0096" name="RBBM_AHB_CMD"/>
+	<reg32 offset="0x009c" name="RBBM_INTERFACE_HANG_MASK_CNTL11"/>
+	<reg32 offset="0x009d" name="RBBM_INTERFACE_HANG_MASK_CNTL12"/>
+	<reg32 offset="0x009e" name="RBBM_INTERFACE_HANG_MASK_CNTL13"/>
+	<reg32 offset="0x009f" name="RBBM_INTERFACE_HANG_MASK_CNTL14"/>
+	<reg32 offset="0x00a0" name="RBBM_INTERFACE_HANG_MASK_CNTL15"/>
+	<reg32 offset="0x00a1" name="RBBM_INTERFACE_HANG_MASK_CNTL16"/>
+	<reg32 offset="0x00a2" name="RBBM_INTERFACE_HANG_MASK_CNTL17"/>
+	<reg32 offset="0x00a3" name="RBBM_INTERFACE_HANG_MASK_CNTL18"/>
+	<reg32 offset="0x00a4" name="RBBM_CLOCK_DELAY_TP0"/>
+	<reg32 offset="0x00a5" name="RBBM_CLOCK_DELAY_TP1"/>
+	<reg32 offset="0x00a6" name="RBBM_CLOCK_DELAY_TP2"/>
+	<reg32 offset="0x00a7" name="RBBM_CLOCK_DELAY_TP3"/>
+	<reg32 offset="0x00a8" name="RBBM_CLOCK_DELAY2_TP0"/>
+	<reg32 offset="0x00a9" name="RBBM_CLOCK_DELAY2_TP1"/>
+	<reg32 offset="0x00aa" name="RBBM_CLOCK_DELAY2_TP2"/>
+	<reg32 offset="0x00ab" name="RBBM_CLOCK_DELAY2_TP3"/>
+	<reg32 offset="0x00ac" name="RBBM_CLOCK_DELAY3_TP0"/>
+	<reg32 offset="0x00ad" name="RBBM_CLOCK_DELAY3_TP1"/>
+	<reg32 offset="0x00ae" name="RBBM_CLOCK_DELAY3_TP2"/>
+	<reg32 offset="0x00af" name="RBBM_CLOCK_DELAY3_TP3"/>
+	<reg32 offset="0x00b0" name="RBBM_CLOCK_HYST_TP0"/>
+	<reg32 offset="0x00b1" name="RBBM_CLOCK_HYST_TP1"/>
+	<reg32 offset="0x00b2" name="RBBM_CLOCK_HYST_TP2"/>
+	<reg32 offset="0x00b3" name="RBBM_CLOCK_HYST_TP3"/>
+	<reg32 offset="0x00b4" name="RBBM_CLOCK_HYST2_TP0"/>
+	<reg32 offset="0x00b5" name="RBBM_CLOCK_HYST2_TP1"/>
+	<reg32 offset="0x00b6" name="RBBM_CLOCK_HYST2_TP2"/>
+	<reg32 offset="0x00b7" name="RBBM_CLOCK_HYST2_TP3"/>
+	<reg32 offset="0x00b8" name="RBBM_CLOCK_HYST3_TP0"/>
+	<reg32 offset="0x00b9" name="RBBM_CLOCK_HYST3_TP1"/>
+	<reg32 offset="0x00ba" name="RBBM_CLOCK_HYST3_TP2"/>
+	<reg32 offset="0x00bb" name="RBBM_CLOCK_HYST3_TP3"/>
+	<reg32 offset="0x00c8" name="RBBM_CLOCK_CNTL_GPMU"/>
+	<reg32 offset="0x00c9" name="RBBM_CLOCK_DELAY_GPMU"/>
+	<reg32 offset="0x00ca" name="RBBM_CLOCK_HYST_GPMU"/>
+	<reg32 offset="0x03a0" name="RBBM_PERFCTR_CP_0_LO"/>
+	<reg32 offset="0x03a1" name="RBBM_PERFCTR_CP_0_HI"/>
+	<reg32 offset="0x03a2" name="RBBM_PERFCTR_CP_1_LO"/>
+	<reg32 offset="0x03a3" name="RBBM_PERFCTR_CP_1_HI"/>
+	<reg32 offset="0x03a4" name="RBBM_PERFCTR_CP_2_LO"/>
+	<reg32 offset="0x03a5" name="RBBM_PERFCTR_CP_2_HI"/>
+	<reg32 offset="0x03a6" name="RBBM_PERFCTR_CP_3_LO"/>
+	<reg32 offset="0x03a7" name="RBBM_PERFCTR_CP_3_HI"/>
+	<reg32 offset="0x03a8" name="RBBM_PERFCTR_CP_4_LO"/>
+	<reg32 offset="0x03a9" name="RBBM_PERFCTR_CP_4_HI"/>
+	<reg32 offset="0x03aa" name="RBBM_PERFCTR_CP_5_LO"/>
+	<reg32 offset="0x03ab" name="RBBM_PERFCTR_CP_5_HI"/>
+	<reg32 offset="0x03ac" name="RBBM_PERFCTR_CP_6_LO"/>
+	<reg32 offset="0x03ad" name="RBBM_PERFCTR_CP_6_HI"/>
+	<reg32 offset="0x03ae" name="RBBM_PERFCTR_CP_7_LO"/>
+	<reg32 offset="0x03af" name="RBBM_PERFCTR_CP_7_HI"/>
+	<reg32 offset="0x03b0" name="RBBM_PERFCTR_RBBM_0_LO"/>
+	<reg32 offset="0x03b1" name="RBBM_PERFCTR_RBBM_0_HI"/>
+	<reg32 offset="0x03b2" name="RBBM_PERFCTR_RBBM_1_LO"/>
+	<reg32 offset="0x03b3" name="RBBM_PERFCTR_RBBM_1_HI"/>
+	<reg32 offset="0x03b4" name="RBBM_PERFCTR_RBBM_2_LO"/>
+	<reg32 offset="0x03b5" name="RBBM_PERFCTR_RBBM_2_HI"/>
+	<reg32 offset="0x03b6" name="RBBM_PERFCTR_RBBM_3_LO"/>
+	<reg32 offset="0x03b7" name="RBBM_PERFCTR_RBBM_3_HI"/>
+	<reg32 offset="0x03b8" name="RBBM_PERFCTR_PC_0_LO"/>
+	<reg32 offset="0x03b9" name="RBBM_PERFCTR_PC_0_HI"/>
+	<reg32 offset="0x03ba" name="RBBM_PERFCTR_PC_1_LO"/>
+	<reg32 offset="0x03bb" name="RBBM_PERFCTR_PC_1_HI"/>
+	<reg32 offset="0x03bc" name="RBBM_PERFCTR_PC_2_LO"/>
+	<reg32 offset="0x03bd" name="RBBM_PERFCTR_PC_2_HI"/>
+	<reg32 offset="0x03be" name="RBBM_PERFCTR_PC_3_LO"/>
+	<reg32 offset="0x03bf" name="RBBM_PERFCTR_PC_3_HI"/>
+	<reg32 offset="0x03c0" name="RBBM_PERFCTR_PC_4_LO"/>
+	<reg32 offset="0x03c1" name="RBBM_PERFCTR_PC_4_HI"/>
+	<reg32 offset="0x03c2" name="RBBM_PERFCTR_PC_5_LO"/>
+	<reg32 offset="0x03c3" name="RBBM_PERFCTR_PC_5_HI"/>
+	<reg32 offset="0x03c4" name="RBBM_PERFCTR_PC_6_LO"/>
+	<reg32 offset="0x03c5" name="RBBM_PERFCTR_PC_6_HI"/>
+	<reg32 offset="0x03c6" name="RBBM_PERFCTR_PC_7_LO"/>
+	<reg32 offset="0x03c7" name="RBBM_PERFCTR_PC_7_HI"/>
+	<reg32 offset="0x03c8" name="RBBM_PERFCTR_VFD_0_LO"/>
+	<reg32 offset="0x03c9" name="RBBM_PERFCTR_VFD_0_HI"/>
+	<reg32 offset="0x03ca" name="RBBM_PERFCTR_VFD_1_LO"/>
+	<reg32 offset="0x03cb" name="RBBM_PERFCTR_VFD_1_HI"/>
+	<reg32 offset="0x03cc" name="RBBM_PERFCTR_VFD_2_LO"/>
+	<reg32 offset="0x03cd" name="RBBM_PERFCTR_VFD_2_HI"/>
+	<reg32 offset="0x03ce" name="RBBM_PERFCTR_VFD_3_LO"/>
+	<reg32 offset="0x03cf" name="RBBM_PERFCTR_VFD_3_HI"/>
+	<reg32 offset="0x03d0" name="RBBM_PERFCTR_VFD_4_LO"/>
+	<reg32 offset="0x03d1" name="RBBM_PERFCTR_VFD_4_HI"/>
+	<reg32 offset="0x03d2" name="RBBM_PERFCTR_VFD_5_LO"/>
+	<reg32 offset="0x03d3" name="RBBM_PERFCTR_VFD_5_HI"/>
+	<reg32 offset="0x03d4" name="RBBM_PERFCTR_VFD_6_LO"/>
+	<reg32 offset="0x03d5" name="RBBM_PERFCTR_VFD_6_HI"/>
+	<reg32 offset="0x03d6" name="RBBM_PERFCTR_VFD_7_LO"/>
+	<reg32 offset="0x03d7" name="RBBM_PERFCTR_VFD_7_HI"/>
+	<reg32 offset="0x03d8" name="RBBM_PERFCTR_HLSQ_0_LO"/>
+	<reg32 offset="0x03d9" name="RBBM_PERFCTR_HLSQ_0_HI"/>
+	<reg32 offset="0x03da" name="RBBM_PERFCTR_HLSQ_1_LO"/>
+	<reg32 offset="0x03db" name="RBBM_PERFCTR_HLSQ_1_HI"/>
+	<reg32 offset="0x03dc" name="RBBM_PERFCTR_HLSQ_2_LO"/>
+	<reg32 offset="0x03dd" name="RBBM_PERFCTR_HLSQ_2_HI"/>
+	<reg32 offset="0x03de" name="RBBM_PERFCTR_HLSQ_3_LO"/>
+	<reg32 offset="0x03df" name="RBBM_PERFCTR_HLSQ_3_HI"/>
+	<reg32 offset="0x03e0" name="RBBM_PERFCTR_HLSQ_4_LO"/>
+	<reg32 offset="0x03e1" name="RBBM_PERFCTR_HLSQ_4_HI"/>
+	<reg32 offset="0x03e2" name="RBBM_PERFCTR_HLSQ_5_LO"/>
+	<reg32 offset="0x03e3" name="RBBM_PERFCTR_HLSQ_5_HI"/>
+	<reg32 offset="0x03e4" name="RBBM_PERFCTR_HLSQ_6_LO"/>
+	<reg32 offset="0x03e5" name="RBBM_PERFCTR_HLSQ_6_HI"/>
+	<reg32 offset="0x03e6" name="RBBM_PERFCTR_HLSQ_7_LO"/>
+	<reg32 offset="0x03e7" name="RBBM_PERFCTR_HLSQ_7_HI"/>
+	<reg32 offset="0x03e8" name="RBBM_PERFCTR_VPC_0_LO"/>
+	<reg32 offset="0x03e9" name="RBBM_PERFCTR_VPC_0_HI"/>
+	<reg32 offset="0x03ea" name="RBBM_PERFCTR_VPC_1_LO"/>
+	<reg32 offset="0x03eb" name="RBBM_PERFCTR_VPC_1_HI"/>
+	<reg32 offset="0x03ec" name="RBBM_PERFCTR_VPC_2_LO"/>
+	<reg32 offset="0x03ed" name="RBBM_PERFCTR_VPC_2_HI"/>
+	<reg32 offset="0x03ee" name="RBBM_PERFCTR_VPC_3_LO"/>
+	<reg32 offset="0x03ef" name="RBBM_PERFCTR_VPC_3_HI"/>
+	<reg32 offset="0x03f0" name="RBBM_PERFCTR_CCU_0_LO"/>
+	<reg32 offset="0x03f1" name="RBBM_PERFCTR_CCU_0_HI"/>
+	<reg32 offset="0x03f2" name="RBBM_PERFCTR_CCU_1_LO"/>
+	<reg32 offset="0x03f3" name="RBBM_PERFCTR_CCU_1_HI"/>
+	<reg32 offset="0x03f4" name="RBBM_PERFCTR_CCU_2_LO"/>
+	<reg32 offset="0x03f5" name="RBBM_PERFCTR_CCU_2_HI"/>
+	<reg32 offset="0x03f6" name="RBBM_PERFCTR_CCU_3_LO"/>
+	<reg32 offset="0x03f7" name="RBBM_PERFCTR_CCU_3_HI"/>
+	<reg32 offset="0x03f8" name="RBBM_PERFCTR_TSE_0_LO"/>
+	<reg32 offset="0x03f9" name="RBBM_PERFCTR_TSE_0_HI"/>
+	<reg32 offset="0x03fa" name="RBBM_PERFCTR_TSE_1_LO"/>
+	<reg32 offset="0x03fb" name="RBBM_PERFCTR_TSE_1_HI"/>
+	<reg32 offset="0x03fc" name="RBBM_PERFCTR_TSE_2_LO"/>
+	<reg32 offset="0x03fd" name="RBBM_PERFCTR_TSE_2_HI"/>
+	<reg32 offset="0x03fe" name="RBBM_PERFCTR_TSE_3_LO"/>
+	<reg32 offset="0x03ff" name="RBBM_PERFCTR_TSE_3_HI"/>
+	<reg32 offset="0x0400" name="RBBM_PERFCTR_RAS_0_LO"/>
+	<reg32 offset="0x0401" name="RBBM_PERFCTR_RAS_0_HI"/>
+	<reg32 offset="0x0402" name="RBBM_PERFCTR_RAS_1_LO"/>
+	<reg32 offset="0x0403" name="RBBM_PERFCTR_RAS_1_HI"/>
+	<reg32 offset="0x0404" name="RBBM_PERFCTR_RAS_2_LO"/>
+	<reg32 offset="0x0405" name="RBBM_PERFCTR_RAS_2_HI"/>
+	<reg32 offset="0x0406" name="RBBM_PERFCTR_RAS_3_LO"/>
+	<reg32 offset="0x0407" name="RBBM_PERFCTR_RAS_3_HI"/>
+	<reg32 offset="0x0408" name="RBBM_PERFCTR_UCHE_0_LO"/>
+	<reg32 offset="0x0409" name="RBBM_PERFCTR_UCHE_0_HI"/>
+	<reg32 offset="0x040a" name="RBBM_PERFCTR_UCHE_1_LO"/>
+	<reg32 offset="0x040b" name="RBBM_PERFCTR_UCHE_1_HI"/>
+	<reg32 offset="0x040c" name="RBBM_PERFCTR_UCHE_2_LO"/>
+	<reg32 offset="0x040d" name="RBBM_PERFCTR_UCHE_2_HI"/>
+	<reg32 offset="0x040e" name="RBBM_PERFCTR_UCHE_3_LO"/>
+	<reg32 offset="0x040f" name="RBBM_PERFCTR_UCHE_3_HI"/>
+	<reg32 offset="0x0410" name="RBBM_PERFCTR_UCHE_4_LO"/>
+	<reg32 offset="0x0411" name="RBBM_PERFCTR_UCHE_4_HI"/>
+	<reg32 offset="0x0412" name="RBBM_PERFCTR_UCHE_5_LO"/>
+	<reg32 offset="0x0413" name="RBBM_PERFCTR_UCHE_5_HI"/>
+	<reg32 offset="0x0414" name="RBBM_PERFCTR_UCHE_6_LO"/>
+	<reg32 offset="0x0415" name="RBBM_PERFCTR_UCHE_6_HI"/>
+	<reg32 offset="0x0416" name="RBBM_PERFCTR_UCHE_7_LO"/>
+	<reg32 offset="0x0417" name="RBBM_PERFCTR_UCHE_7_HI"/>
+	<reg32 offset="0x0418" name="RBBM_PERFCTR_TP_0_LO"/>
+	<reg32 offset="0x0419" name="RBBM_PERFCTR_TP_0_HI"/>
+	<reg32 offset="0x041a" name="RBBM_PERFCTR_TP_1_LO"/>
+	<reg32 offset="0x041b" name="RBBM_PERFCTR_TP_1_HI"/>
+	<reg32 offset="0x041c" name="RBBM_PERFCTR_TP_2_LO"/>
+	<reg32 offset="0x041d" name="RBBM_PERFCTR_TP_2_HI"/>
+	<reg32 offset="0x041e" name="RBBM_PERFCTR_TP_3_LO"/>
+	<reg32 offset="0x041f" name="RBBM_PERFCTR_TP_3_HI"/>
+	<reg32 offset="0x0420" name="RBBM_PERFCTR_TP_4_LO"/>
+	<reg32 offset="0x0421" name="RBBM_PERFCTR_TP_4_HI"/>
+	<reg32 offset="0x0422" name="RBBM_PERFCTR_TP_5_LO"/>
+	<reg32 offset="0x0423" name="RBBM_PERFCTR_TP_5_HI"/>
+	<reg32 offset="0x0424" name="RBBM_PERFCTR_TP_6_LO"/>
+	<reg32 offset="0x0425" name="RBBM_PERFCTR_TP_6_HI"/>
+	<reg32 offset="0x0426" name="RBBM_PERFCTR_TP_7_LO"/>
+	<reg32 offset="0x0427" name="RBBM_PERFCTR_TP_7_HI"/>
+	<reg32 offset="0x0428" name="RBBM_PERFCTR_SP_0_LO"/>
+	<reg32 offset="0x0429" name="RBBM_PERFCTR_SP_0_HI"/>
+	<reg32 offset="0x042a" name="RBBM_PERFCTR_SP_1_LO"/>
+	<reg32 offset="0x042b" name="RBBM_PERFCTR_SP_1_HI"/>
+	<reg32 offset="0x042c" name="RBBM_PERFCTR_SP_2_LO"/>
+	<reg32 offset="0x042d" name="RBBM_PERFCTR_SP_2_HI"/>
+	<reg32 offset="0x042e" name="RBBM_PERFCTR_SP_3_LO"/>
+	<reg32 offset="0x042f" name="RBBM_PERFCTR_SP_3_HI"/>
+	<reg32 offset="0x0430" name="RBBM_PERFCTR_SP_4_LO"/>
+	<reg32 offset="0x0431" name="RBBM_PERFCTR_SP_4_HI"/>
+	<reg32 offset="0x0432" name="RBBM_PERFCTR_SP_5_LO"/>
+	<reg32 offset="0x0433" name="RBBM_PERFCTR_SP_5_HI"/>
+	<reg32 offset="0x0434" name="RBBM_PERFCTR_SP_6_LO"/>
+	<reg32 offset="0x0435" name="RBBM_PERFCTR_SP_6_HI"/>
+	<reg32 offset="0x0436" name="RBBM_PERFCTR_SP_7_LO"/>
+	<reg32 offset="0x0437" name="RBBM_PERFCTR_SP_7_HI"/>
+	<reg32 offset="0x0438" name="RBBM_PERFCTR_SP_8_LO"/>
+	<reg32 offset="0x0439" name="RBBM_PERFCTR_SP_8_HI"/>
+	<reg32 offset="0x043a" name="RBBM_PERFCTR_SP_9_LO"/>
+	<reg32 offset="0x043b" name="RBBM_PERFCTR_SP_9_HI"/>
+	<reg32 offset="0x043c" name="RBBM_PERFCTR_SP_10_LO"/>
+	<reg32 offset="0x043d" name="RBBM_PERFCTR_SP_10_HI"/>
+	<reg32 offset="0x043e" name="RBBM_PERFCTR_SP_11_LO"/>
+	<reg32 offset="0x043f" name="RBBM_PERFCTR_SP_11_HI"/>
+	<reg32 offset="0x0440" name="RBBM_PERFCTR_RB_0_LO"/>
+	<reg32 offset="0x0441" name="RBBM_PERFCTR_RB_0_HI"/>
+	<reg32 offset="0x0442" name="RBBM_PERFCTR_RB_1_LO"/>
+	<reg32 offset="0x0443" name="RBBM_PERFCTR_RB_1_HI"/>
+	<reg32 offset="0x0444" name="RBBM_PERFCTR_RB_2_LO"/>
+	<reg32 offset="0x0445" name="RBBM_PERFCTR_RB_2_HI"/>
+	<reg32 offset="0x0446" name="RBBM_PERFCTR_RB_3_LO"/>
+	<reg32 offset="0x0447" name="RBBM_PERFCTR_RB_3_HI"/>
+	<reg32 offset="0x0448" name="RBBM_PERFCTR_RB_4_LO"/>
+	<reg32 offset="0x0449" name="RBBM_PERFCTR_RB_4_HI"/>
+	<reg32 offset="0x044a" name="RBBM_PERFCTR_RB_5_LO"/>
+	<reg32 offset="0x044b" name="RBBM_PERFCTR_RB_5_HI"/>
+	<reg32 offset="0x044c" name="RBBM_PERFCTR_RB_6_LO"/>
+	<reg32 offset="0x044d" name="RBBM_PERFCTR_RB_6_HI"/>
+	<reg32 offset="0x044e" name="RBBM_PERFCTR_RB_7_LO"/>
+	<reg32 offset="0x044f" name="RBBM_PERFCTR_RB_7_HI"/>
+	<reg32 offset="0x0450" name="RBBM_PERFCTR_VSC_0_LO"/>
+	<reg32 offset="0x0451" name="RBBM_PERFCTR_VSC_0_HI"/>
+	<reg32 offset="0x0452" name="RBBM_PERFCTR_VSC_1_LO"/>
+	<reg32 offset="0x0453" name="RBBM_PERFCTR_VSC_1_HI"/>
+	<reg32 offset="0x0454" name="RBBM_PERFCTR_LRZ_0_LO"/>
+	<reg32 offset="0x0455" name="RBBM_PERFCTR_LRZ_0_HI"/>
+	<reg32 offset="0x0456" name="RBBM_PERFCTR_LRZ_1_LO"/>
+	<reg32 offset="0x0457" name="RBBM_PERFCTR_LRZ_1_HI"/>
+	<reg32 offset="0x0458" name="RBBM_PERFCTR_LRZ_2_LO"/>
+	<reg32 offset="0x0459" name="RBBM_PERFCTR_LRZ_2_HI"/>
+	<reg32 offset="0x045a" name="RBBM_PERFCTR_LRZ_3_LO"/>
+	<reg32 offset="0x045b" name="RBBM_PERFCTR_LRZ_3_HI"/>
+	<reg32 offset="0x045c" name="RBBM_PERFCTR_CMP_0_LO"/>
+	<reg32 offset="0x045d" name="RBBM_PERFCTR_CMP_0_HI"/>
+	<reg32 offset="0x045e" name="RBBM_PERFCTR_CMP_1_LO"/>
+	<reg32 offset="0x045f" name="RBBM_PERFCTR_CMP_1_HI"/>
+	<reg32 offset="0x0460" name="RBBM_PERFCTR_CMP_2_LO"/>
+	<reg32 offset="0x0461" name="RBBM_PERFCTR_CMP_2_HI"/>
+	<reg32 offset="0x0462" name="RBBM_PERFCTR_CMP_3_LO"/>
+	<reg32 offset="0x0463" name="RBBM_PERFCTR_CMP_3_HI"/>
+	<reg32 offset="0x046b" name="RBBM_PERFCTR_RBBM_SEL_0" type="a5xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x046c" name="RBBM_PERFCTR_RBBM_SEL_1" type="a5xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x046d" name="RBBM_PERFCTR_RBBM_SEL_2" type="a5xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x046e" name="RBBM_PERFCTR_RBBM_SEL_3" type="a5xx_rbbm_perfcounter_select"/>
+	<reg32 offset="0x04d2" name="RBBM_ALWAYSON_COUNTER_LO"/>
+	<reg32 offset="0x04d3" name="RBBM_ALWAYSON_COUNTER_HI"/>
+	<reg32 offset="0x04f5" name="RBBM_STATUS">
+		<bitfield high="31" low="31" name="GPU_BUSY_IGN_AHB" />
+		<bitfield high="30" low="30" name="GPU_BUSY_IGN_AHB_CP" />
+		<bitfield high="29" low="29" name="HLSQ_BUSY" />
+		<bitfield high="28" low="28" name="VSC_BUSY" />
+		<bitfield high="27" low="27" name="TPL1_BUSY" />
+		<bitfield high="26" low="26" name="SP_BUSY" />
+		<bitfield high="25" low="25" name="UCHE_BUSY" />
+		<bitfield high="24" low="24" name="VPC_BUSY" />
+		<bitfield high="23" low="23" name="VFDP_BUSY" />
+		<bitfield high="22" low="22" name="VFD_BUSY" />
+		<bitfield high="21" low="21" name="TESS_BUSY" />
+		<bitfield high="20" low="20" name="PC_VSD_BUSY" />
+		<bitfield high="19" low="19" name="PC_DCALL_BUSY" />
+		<bitfield high="18" low="18" name="GPMU_SLAVE_BUSY" />
+		<bitfield high="17" low="17" name="DCOM_BUSY" />
+		<bitfield high="16" low="16" name="COM_BUSY" />
+		<bitfield high="15" low="15" name="LRZ_BUZY" />
+		<bitfield high="14" low="14" name="A2D_DSP_BUSY" />
+		<bitfield high="13" low="13" name="CCUFCHE_BUSY" />
+		<bitfield high="12" low="12" name="RB_BUSY" />
+		<bitfield high="11" low="11" name="RAS_BUSY" />
+		<bitfield high="10" low="10" name="TSE_BUSY" />
+		<bitfield high="9" low="9" name="VBIF_BUSY" />
+		<bitfield high="8" low="8" name="GPU_BUSY_IGN_AHB_HYST" />
+		<bitfield high="7" low="7" name="CP_BUSY_IGN_HYST" />
+		<bitfield high="6" low="6" name="CP_BUSY" />
+		<bitfield high="5" low="5" name="GPMU_MASTER_BUSY" />
+		<bitfield high="4" low="4" name="CP_CRASH_BUSY" />
+		<bitfield high="3" low="3" name="CP_ETS_BUSY" />
+		<bitfield high="2" low="2" name="CP_PFP_BUSY" />
+		<bitfield high="1" low="1" name="CP_ME_BUSY" />
+		<bitfield high="0" low="0" name="HI_BUSY" />
+	</reg32>
+	<reg32 offset="0x0530" name="RBBM_STATUS3">
+		<bitfield pos="24" name="SMMU_STALLED_ON_FAULT" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x04e1" name="RBBM_INT_0_STATUS"/>
+	<reg32 offset="0x04f0" name="RBBM_AHB_ME_SPLIT_STATUS"/>
+	<reg32 offset="0x04f1" name="RBBM_AHB_PFP_SPLIT_STATUS"/>
+	<reg32 offset="0x04f3" name="RBBM_AHB_ETS_SPLIT_STATUS"/>
+	<reg32 offset="0x04f4" name="RBBM_AHB_ERROR_STATUS"/>
+	<reg32 offset="0x0464" name="RBBM_PERFCTR_CNTL"/>
+	<reg32 offset="0x0465" name="RBBM_PERFCTR_LOAD_CMD0"/>
+	<reg32 offset="0x0466" name="RBBM_PERFCTR_LOAD_CMD1"/>
+	<reg32 offset="0x0467" name="RBBM_PERFCTR_LOAD_CMD2"/>
+	<reg32 offset="0x0468" name="RBBM_PERFCTR_LOAD_CMD3"/>
+	<reg32 offset="0x0469" name="RBBM_PERFCTR_LOAD_VALUE_LO"/>
+	<reg32 offset="0x046a" name="RBBM_PERFCTR_LOAD_VALUE_HI"/>
+	<reg32 offset="0x046f" name="RBBM_PERFCTR_GPU_BUSY_MASKED"/>
+	<reg32 offset="0x04ed" name="RBBM_AHB_ERROR"/>
+	<reg32 offset="0x0504" name="RBBM_CFG_DBGBUS_EVENT_LOGIC"/>
+	<reg32 offset="0x0505" name="RBBM_CFG_DBGBUS_OVER"/>
+	<reg32 offset="0x0506" name="RBBM_CFG_DBGBUS_COUNT0"/>
+	<reg32 offset="0x0507" name="RBBM_CFG_DBGBUS_COUNT1"/>
+	<reg32 offset="0x0508" name="RBBM_CFG_DBGBUS_COUNT2"/>
+	<reg32 offset="0x0509" name="RBBM_CFG_DBGBUS_COUNT3"/>
+	<reg32 offset="0x050a" name="RBBM_CFG_DBGBUS_COUNT4"/>
+	<reg32 offset="0x050b" name="RBBM_CFG_DBGBUS_COUNT5"/>
+	<reg32 offset="0x050c" name="RBBM_CFG_DBGBUS_TRACE_ADDR"/>
+	<reg32 offset="0x050d" name="RBBM_CFG_DBGBUS_TRACE_BUF0"/>
+	<reg32 offset="0x050e" name="RBBM_CFG_DBGBUS_TRACE_BUF1"/>
+	<reg32 offset="0x050f" name="RBBM_CFG_DBGBUS_TRACE_BUF2"/>
+	<reg32 offset="0x0510" name="RBBM_CFG_DBGBUS_TRACE_BUF3"/>
+	<reg32 offset="0x0511" name="RBBM_CFG_DBGBUS_TRACE_BUF4"/>
+	<reg32 offset="0x0512" name="RBBM_CFG_DBGBUS_MISR0"/>
+	<reg32 offset="0x0513" name="RBBM_CFG_DBGBUS_MISR1"/>
+	<reg32 offset="0x0533" name="RBBM_ISDB_CNT"/>
+	<reg32 offset="0xf000" name="RBBM_SECVID_TRUST_CONFIG"/>
+	<reg32 offset="0xf400" name="RBBM_SECVID_TRUST_CNTL"/>
+	<reg32 offset="0xf800" name="RBBM_SECVID_TSB_TRUSTED_BASE_LO"/>
+	<reg32 offset="0xf801" name="RBBM_SECVID_TSB_TRUSTED_BASE_HI"/>
+	<reg32 offset="0xf802" name="RBBM_SECVID_TSB_TRUSTED_SIZE"/>
+	<reg32 offset="0xf803" name="RBBM_SECVID_TSB_CNTL"/>
+	<reg32 offset="0xf804" name="RBBM_SECVID_TSB_COMP_STATUS_LO"/>
+	<reg32 offset="0xf805" name="RBBM_SECVID_TSB_COMP_STATUS_HI"/>
+	<reg32 offset="0xf806" name="RBBM_SECVID_TSB_UCHE_STATUS_LO"/>
+	<reg32 offset="0xf807" name="RBBM_SECVID_TSB_UCHE_STATUS_HI"/>
+	<reg32 offset="0xf810" name="RBBM_SECVID_TSB_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+
+	<!-- VSC registers -->
+	<reg32 offset="0x0bc2" name="VSC_BIN_SIZE">
+		<bitfield name="WIDTH" low="0" high="7" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="9" high="16" shr="5" type="uint"/>
+		<!-- b17 maybe BYPASS like RB_CNTL, but reg not written for bypass -->
+	</reg32>
+	<reg32 offset="0x0bc3" name="VSC_SIZE_ADDRESS_LO"/>
+	<reg32 offset="0x0bc4" name="VSC_SIZE_ADDRESS_HI"/>
+	<reg32 offset="0x0bc5" name="UNKNOWN_0BC5"/> <!-- always 00000000? -->
+	<reg32 offset="0x0bc6" name="UNKNOWN_0BC6"/> <!-- always 00000000? -->
+	<array offset="0x0bd0" name="VSC_PIPE_CONFIG" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				Configures the mapping between VSC_PIPE buffer and
+				bin, X/Y specify the bin index in the horiz/vert
+				direction (0,0 is upper left, 0,1 is leftmost bin
+				on second row, and so on).  W/H specify the number
+				of bins assigned to this VSC_PIPE in the horiz/vert
+				dimension.
+			</doc>
+			<bitfield name="X" low="0" high="9" type="uint"/>
+			<bitfield name="Y" low="10" high="19" type="uint"/>
+			<bitfield name="W" low="20" high="23" type="uint"/>
+			<bitfield name="H" low="24" high="27" type="uint"/>
+		</reg32>
+	</array>
+	<array offset="0x0be0" name="VSC_PIPE_DATA_ADDRESS" stride="2" length="16">
+		<reg32 offset="0x0" name="LO"/>
+		<reg32 offset="0x1" name="HI"/>
+	</array>
+	<array offset="0x0c00" name="VSC_PIPE_DATA_LENGTH" stride="1" length="16">
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+	<reg32 offset="0x0c60" name="VSC_PERFCTR_VSC_SEL_0" type="a5xx_vsc_perfcounter_select"/>
+	<reg32 offset="0x0c61" name="VSC_PERFCTR_VSC_SEL_1" type="a5xx_vsc_perfcounter_select"/>
+
+	<!-- used for some blits?? -->
+	<reg32 offset="0x0cdd" name="VSC_RESOLVE_CNTL" type="adreno_reg_xy"/>
+
+	<!-- GRAS registers -->
+	<reg32 offset="0x0c81" name="GRAS_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0c90" name="GRAS_PERFCTR_TSE_SEL_0" type="a5xx_tse_perfcounter_select"/>
+	<reg32 offset="0x0c91" name="GRAS_PERFCTR_TSE_SEL_1" type="a5xx_tse_perfcounter_select"/>
+	<reg32 offset="0x0c92" name="GRAS_PERFCTR_TSE_SEL_2" type="a5xx_tse_perfcounter_select"/>
+	<reg32 offset="0x0c93" name="GRAS_PERFCTR_TSE_SEL_3" type="a5xx_tse_perfcounter_select"/>
+	<reg32 offset="0x0c94" name="GRAS_PERFCTR_RAS_SEL_0" type="a5xx_ras_perfcounter_select"/>
+	<reg32 offset="0x0c95" name="GRAS_PERFCTR_RAS_SEL_1" type="a5xx_ras_perfcounter_select"/>
+	<reg32 offset="0x0c96" name="GRAS_PERFCTR_RAS_SEL_2" type="a5xx_ras_perfcounter_select"/>
+	<reg32 offset="0x0c97" name="GRAS_PERFCTR_RAS_SEL_3" type="a5xx_ras_perfcounter_select"/>
+	<reg32 offset="0x0c98" name="GRAS_PERFCTR_LRZ_SEL_0" type="a5xx_lrz_perfcounter_select"/>
+	<reg32 offset="0x0c99" name="GRAS_PERFCTR_LRZ_SEL_1" type="a5xx_lrz_perfcounter_select"/>
+	<reg32 offset="0x0c9a" name="GRAS_PERFCTR_LRZ_SEL_2" type="a5xx_lrz_perfcounter_select"/>
+	<reg32 offset="0x0c9b" name="GRAS_PERFCTR_LRZ_SEL_3" type="a5xx_lrz_perfcounter_select"/>
+
+	<reg32 offset="0x0cc4" name="RB_DBG_ECO_CNTL"/> <!-- always 00100000? -->
+	<reg32 offset="0x0cc5" name="RB_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0cc6" name="RB_MODE_CNTL"/> <!-- always 00000044? -->
+	<reg32 offset="0x0cc7" name="RB_CCU_CNTL"/> <!-- always b0056080 or 10000000? -->
+	<reg32 offset="0x0cd0" name="RB_PERFCTR_RB_SEL_0" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd1" name="RB_PERFCTR_RB_SEL_1" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd2" name="RB_PERFCTR_RB_SEL_2" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd3" name="RB_PERFCTR_RB_SEL_3" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd4" name="RB_PERFCTR_RB_SEL_4" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd5" name="RB_PERFCTR_RB_SEL_5" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd6" name="RB_PERFCTR_RB_SEL_6" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd7" name="RB_PERFCTR_RB_SEL_7" type="a5xx_rb_perfcounter_select"/>
+	<reg32 offset="0x0cd8" name="RB_PERFCTR_CCU_SEL_0" type="a5xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cd9" name="RB_PERFCTR_CCU_SEL_1" type="a5xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cda" name="RB_PERFCTR_CCU_SEL_2" type="a5xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0cdb" name="RB_PERFCTR_CCU_SEL_3" type="a5xx_ccu_perfcounter_select"/>
+	<reg32 offset="0x0ce0" name="RB_POWERCTR_RB_SEL_0"/>
+	<reg32 offset="0x0ce1" name="RB_POWERCTR_RB_SEL_1"/>
+	<reg32 offset="0x0ce2" name="RB_POWERCTR_RB_SEL_2"/>
+	<reg32 offset="0x0ce3" name="RB_POWERCTR_RB_SEL_3"/>
+	<reg32 offset="0x0ce4" name="RB_POWERCTR_CCU_SEL_0"/>
+	<reg32 offset="0x0ce5" name="RB_POWERCTR_CCU_SEL_1"/>
+	<reg32 offset="0x0cec" name="RB_PERFCTR_CMP_SEL_0" type="a5xx_cmp_perfcounter_select"/>
+	<reg32 offset="0x0ced" name="RB_PERFCTR_CMP_SEL_1" type="a5xx_cmp_perfcounter_select"/>
+	<reg32 offset="0x0cee" name="RB_PERFCTR_CMP_SEL_2" type="a5xx_cmp_perfcounter_select"/>
+	<reg32 offset="0x0cef" name="RB_PERFCTR_CMP_SEL_3" type="a5xx_cmp_perfcounter_select"/>
+
+	<reg32 offset="0x0d00" name="PC_DBG_ECO_CNTL">
+		<bitfield name="TWOPASSUSEWFI" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0d01" name="PC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0d02" name="PC_MODE_CNTL"/> <!-- always 0000001f? -->
+	<reg32 offset="0x0d04" name="PC_INDEX_BUF_LO"/>
+	<reg32 offset="0x0d05" name="PC_INDEX_BUF_HI"/>
+	<reg32 offset="0x0d06" name="PC_START_INDEX"/>
+	<reg32 offset="0x0d07" name="PC_MAX_INDEX"/>
+	<reg32 offset="0x0d08" name="PC_TESSFACTOR_ADDR_LO"/>
+	<reg32 offset="0x0d09" name="PC_TESSFACTOR_ADDR_HI"/>
+	<reg32 offset="0x0d10" name="PC_PERFCTR_PC_SEL_0" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d11" name="PC_PERFCTR_PC_SEL_1" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d12" name="PC_PERFCTR_PC_SEL_2" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d13" name="PC_PERFCTR_PC_SEL_3" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d14" name="PC_PERFCTR_PC_SEL_4" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d15" name="PC_PERFCTR_PC_SEL_5" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d16" name="PC_PERFCTR_PC_SEL_6" type="a5xx_pc_perfcounter_select"/>
+	<reg32 offset="0x0d17" name="PC_PERFCTR_PC_SEL_7" type="a5xx_pc_perfcounter_select"/>
+
+	<reg32 offset="0x0e00" name="HLSQ_TIMEOUT_THRESHOLD_0"/>
+	<reg32 offset="0x0e01" name="HLSQ_TIMEOUT_THRESHOLD_1"/>
+	<reg32 offset="0x0e04" name="HLSQ_DBG_ECO_CNTL"/>
+	<reg32 offset="0x0e05" name="HLSQ_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0e06" name="HLSQ_MODE_CNTL"/> <!-- always 00000001? -->
+	<reg32 offset="0x0e10" name="HLSQ_PERFCTR_HLSQ_SEL_0" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e11" name="HLSQ_PERFCTR_HLSQ_SEL_1" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e12" name="HLSQ_PERFCTR_HLSQ_SEL_2" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e13" name="HLSQ_PERFCTR_HLSQ_SEL_3" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e14" name="HLSQ_PERFCTR_HLSQ_SEL_4" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e15" name="HLSQ_PERFCTR_HLSQ_SEL_5" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e16" name="HLSQ_PERFCTR_HLSQ_SEL_6" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0e17" name="HLSQ_PERFCTR_HLSQ_SEL_7" type="a5xx_hlsq_perfcounter_select"/>
+	<reg32 offset="0x0f08" name="HLSQ_SPTP_RDSEL"/>
+	<reg32 offset="0xbc00" name="HLSQ_DBG_READ_SEL"/>
+	<reg32 offset="0xa000" name="HLSQ_DBG_AHB_READ_APERTURE"/>
+
+	<reg32 offset="0x0e41" name="VFD_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0e42" name="VFD_MODE_CNTL"/> <!-- always 00000000? -->
+	<reg32 offset="0x0e50" name="VFD_PERFCTR_VFD_SEL_0" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e51" name="VFD_PERFCTR_VFD_SEL_1" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e52" name="VFD_PERFCTR_VFD_SEL_2" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e53" name="VFD_PERFCTR_VFD_SEL_3" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e54" name="VFD_PERFCTR_VFD_SEL_4" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e55" name="VFD_PERFCTR_VFD_SEL_5" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e56" name="VFD_PERFCTR_VFD_SEL_6" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e57" name="VFD_PERFCTR_VFD_SEL_7" type="a5xx_vfd_perfcounter_select"/>
+	<reg32 offset="0x0e60" name="VPC_DBG_ECO_CNTL">
+		<bitfield name="ALLFLATOPTDIS" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0e61" name="VPC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0e62" name="VPC_MODE_CNTL">
+		<bitfield name="BINNING_PASS" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0e64" name="VPC_PERFCTR_VPC_SEL_0" type="a5xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e65" name="VPC_PERFCTR_VPC_SEL_1" type="a5xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e66" name="VPC_PERFCTR_VPC_SEL_2" type="a5xx_vpc_perfcounter_select"/>
+	<reg32 offset="0x0e67" name="VPC_PERFCTR_VPC_SEL_3" type="a5xx_vpc_perfcounter_select"/>
+
+	<reg32 offset="0x0e80" name="UCHE_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0e81" name="UCHE_MODE_CNTL"/>
+	<reg32 offset="0x0e82" name="UCHE_SVM_CNTL"/>
+	<reg32 offset="0x0e87" name="UCHE_WRITE_THRU_BASE_LO"/>
+	<reg32 offset="0x0e88" name="UCHE_WRITE_THRU_BASE_HI"/>
+	<reg32 offset="0x0e89" name="UCHE_TRAP_BASE_LO"/>
+	<reg32 offset="0x0e8a" name="UCHE_TRAP_BASE_HI"/>
+	<reg32 offset="0x0e8b" name="UCHE_GMEM_RANGE_MIN_LO"/>
+	<reg32 offset="0x0e8c" name="UCHE_GMEM_RANGE_MIN_HI"/>
+	<reg32 offset="0x0e8d" name="UCHE_GMEM_RANGE_MAX_LO"/>
+	<reg32 offset="0x0e8e" name="UCHE_GMEM_RANGE_MAX_HI"/>
+	<reg32 offset="0x0e8f" name="UCHE_DBG_ECO_CNTL_2"/>
+	<reg32 offset="0x0e90" name="UCHE_DBG_ECO_CNTL"/>
+	<reg32 offset="0x0e91" name="UCHE_CACHE_INVALIDATE_MIN_LO"/>
+	<reg32 offset="0x0e92" name="UCHE_CACHE_INVALIDATE_MIN_HI"/>
+	<reg32 offset="0x0e93" name="UCHE_CACHE_INVALIDATE_MAX_LO"/>
+	<reg32 offset="0x0e94" name="UCHE_CACHE_INVALIDATE_MAX_HI"/>
+	<reg32 offset="0x0e95" name="UCHE_CACHE_INVALIDATE"/>
+	<reg32 offset="0x0e96" name="UCHE_CACHE_WAYS"/>
+	<reg32 offset="0x0ea0" name="UCHE_PERFCTR_UCHE_SEL_0" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea1" name="UCHE_PERFCTR_UCHE_SEL_1" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea2" name="UCHE_PERFCTR_UCHE_SEL_2" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea3" name="UCHE_PERFCTR_UCHE_SEL_3" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea4" name="UCHE_PERFCTR_UCHE_SEL_4" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea5" name="UCHE_PERFCTR_UCHE_SEL_5" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea6" name="UCHE_PERFCTR_UCHE_SEL_6" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea7" name="UCHE_PERFCTR_UCHE_SEL_7" type="a5xx_uche_perfcounter_select"/>
+	<reg32 offset="0x0ea8" name="UCHE_POWERCTR_UCHE_SEL_0"/>
+	<reg32 offset="0x0ea9" name="UCHE_POWERCTR_UCHE_SEL_1"/>
+	<reg32 offset="0x0eaa" name="UCHE_POWERCTR_UCHE_SEL_2"/>
+	<reg32 offset="0x0eab" name="UCHE_POWERCTR_UCHE_SEL_3"/>
+	<reg32 offset="0x0eb1" name="UCHE_TRAP_LOG_LO"/>
+	<reg32 offset="0x0eb2" name="UCHE_TRAP_LOG_HI"/>
+
+	<reg32 offset="0x0ec0" name="SP_DBG_ECO_CNTL"/>
+	<reg32 offset="0x0ec1" name="SP_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0ec2" name="SP_MODE_CNTL"/> <!-- always 0000001e? -->
+	<reg32 offset="0x0ed0" name="SP_PERFCTR_SP_SEL_0"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed1" name="SP_PERFCTR_SP_SEL_1"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed2" name="SP_PERFCTR_SP_SEL_2"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed3" name="SP_PERFCTR_SP_SEL_3"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed4" name="SP_PERFCTR_SP_SEL_4"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed5" name="SP_PERFCTR_SP_SEL_5"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed6" name="SP_PERFCTR_SP_SEL_6"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed7" name="SP_PERFCTR_SP_SEL_7"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed8" name="SP_PERFCTR_SP_SEL_8"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0ed9" name="SP_PERFCTR_SP_SEL_9"  type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0eda" name="SP_PERFCTR_SP_SEL_10" type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0edb" name="SP_PERFCTR_SP_SEL_11" type="a5xx_sp_perfcounter_select"/>
+	<reg32 offset="0x0edc" name="SP_POWERCTR_SP_SEL_0"/>
+	<reg32 offset="0x0edd" name="SP_POWERCTR_SP_SEL_1"/>
+	<reg32 offset="0x0ede" name="SP_POWERCTR_SP_SEL_2"/>
+	<reg32 offset="0x0edf" name="SP_POWERCTR_SP_SEL_3"/>
+
+	<reg32 offset="0x0f01" name="TPL1_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0f02" name="TPL1_MODE_CNTL"/> <!-- always 00000544? -->
+	<reg32 offset="0x0f10" name="TPL1_PERFCTR_TP_SEL_0" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f11" name="TPL1_PERFCTR_TP_SEL_1" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f12" name="TPL1_PERFCTR_TP_SEL_2" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f13" name="TPL1_PERFCTR_TP_SEL_3" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f14" name="TPL1_PERFCTR_TP_SEL_4" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f15" name="TPL1_PERFCTR_TP_SEL_5" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f16" name="TPL1_PERFCTR_TP_SEL_6" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f17" name="TPL1_PERFCTR_TP_SEL_7" type="a5xx_tp_perfcounter_select"/>
+	<reg32 offset="0x0f18" name="TPL1_POWERCTR_TP_SEL_0"/>
+	<reg32 offset="0x0f19" name="TPL1_POWERCTR_TP_SEL_1"/>
+	<reg32 offset="0x0f1a" name="TPL1_POWERCTR_TP_SEL_2"/>
+	<reg32 offset="0x0f1b" name="TPL1_POWERCTR_TP_SEL_3"/>
+
+	<reg32 offset="0x3000" name="VBIF_VERSION"/>
+	<reg32 offset="0x3001" name="VBIF_CLKON"/>
+<!--
+#define A5XX_VBIF_CLKON_FORCE_ON_TESTBUS_MASK   0x1
+#define A5XX_VBIF_CLKON_FORCE_ON_TESTBUS_SHIFT  0x1
+ -->
+	<reg32 offset="0x3028" name="VBIF_ABIT_SORT"/>
+	<reg32 offset="0x3029" name="VBIF_ABIT_SORT_CONF"/>
+	<reg32 offset="0x3049" name="VBIF_ROUND_ROBIN_QOS_ARB"/>
+	<reg32 offset="0x302a" name="VBIF_GATE_OFF_WRREQ_EN"/>
+	<reg32 offset="0x302c" name="VBIF_IN_RD_LIM_CONF0"/>
+	<reg32 offset="0x302d" name="VBIF_IN_RD_LIM_CONF1"/>
+	<reg32 offset="0x3080" name="VBIF_XIN_HALT_CTRL0"/>
+<!--
+#define A5XX_VBIF_XIN_HALT_CTRL0_MASK	   0xF
+#define A510_VBIF_XIN_HALT_CTRL0_MASK	   0x7
+ -->
+	<reg32 offset="0x3081" name="VBIF_XIN_HALT_CTRL1"/>
+	<reg32 offset="0x3084" name="VBIF_TEST_BUS_OUT_CTRL"/>
+<!--
+#define A5XX_VBIF_TEST_BUS_OUT_CTRL_EN_MASK    0x1
+#define A5XX_VBIF_TEST_BUS_OUT_CTRL_EN_SHIFT   0x0
+ -->
+	<reg32 offset="0x3085" name="VBIF_TEST_BUS1_CTRL0"/>
+	<reg32 offset="0x3086" name="VBIF_TEST_BUS1_CTRL1"/>
+<!--
+#define A5XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_MASK  0xF
+#define A5XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_SHIFT 0x0
+ -->
+	<reg32 offset="0x3087" name="VBIF_TEST_BUS2_CTRL0"/>
+	<reg32 offset="0x3088" name="VBIF_TEST_BUS2_CTRL1"/>
+<!--
+#define A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_MASK     0xF
+#define A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_SHIFT    0x0
+ -->
+	<reg32 offset="0x308c" name="VBIF_TEST_BUS_OUT"/>
+	<reg32 offset="0x30c0" name="VBIF_PERF_CNT_EN0"/>
+	<reg32 offset="0x30c1" name="VBIF_PERF_CNT_EN1"/>
+	<reg32 offset="0x30c2" name="VBIF_PERF_CNT_EN2"/>
+	<reg32 offset="0x30c3" name="VBIF_PERF_CNT_EN3"/>
+	<reg32 offset="0x30c8" name="VBIF_PERF_CNT_CLR0"/>
+	<reg32 offset="0x30c9" name="VBIF_PERF_CNT_CLR1"/>
+	<reg32 offset="0x30ca" name="VBIF_PERF_CNT_CLR2"/>
+	<reg32 offset="0x30cb" name="VBIF_PERF_CNT_CLR3"/>
+	<reg32 offset="0x30d0" name="VBIF_PERF_CNT_SEL0" type="a5xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d1" name="VBIF_PERF_CNT_SEL1" type="a5xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d2" name="VBIF_PERF_CNT_SEL2" type="a5xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d3" name="VBIF_PERF_CNT_SEL3" type="a5xx_vbif_perfcounter_select"/>
+	<reg32 offset="0x30d8" name="VBIF_PERF_CNT_LOW0"/>
+	<reg32 offset="0x30d9" name="VBIF_PERF_CNT_LOW1"/>
+	<reg32 offset="0x30da" name="VBIF_PERF_CNT_LOW2"/>
+	<reg32 offset="0x30db" name="VBIF_PERF_CNT_LOW3"/>
+	<reg32 offset="0x30e0" name="VBIF_PERF_CNT_HIGH0"/>
+	<reg32 offset="0x30e1" name="VBIF_PERF_CNT_HIGH1"/>
+	<reg32 offset="0x30e2" name="VBIF_PERF_CNT_HIGH2"/>
+	<reg32 offset="0x30e3" name="VBIF_PERF_CNT_HIGH3"/>
+	<reg32 offset="0x3100" name="VBIF_PERF_PWR_CNT_EN0"/>
+	<reg32 offset="0x3101" name="VBIF_PERF_PWR_CNT_EN1"/>
+	<reg32 offset="0x3102" name="VBIF_PERF_PWR_CNT_EN2"/>
+	<reg32 offset="0x3110" name="VBIF_PERF_PWR_CNT_LOW0"/>
+	<reg32 offset="0x3111" name="VBIF_PERF_PWR_CNT_LOW1"/>
+	<reg32 offset="0x3112" name="VBIF_PERF_PWR_CNT_LOW2"/>
+	<reg32 offset="0x3118" name="VBIF_PERF_PWR_CNT_HIGH0"/>
+	<reg32 offset="0x3119" name="VBIF_PERF_PWR_CNT_HIGH1"/>
+	<reg32 offset="0x311a" name="VBIF_PERF_PWR_CNT_HIGH2"/>
+
+	<reg32 offset="0x8800" name="GPMU_INST_RAM_BASE"/>
+	<reg32 offset="0x9800" name="GPMU_DATA_RAM_BASE"/>
+
+<!--
+/* COUNTABLE FOR SP PERFCOUNTER */
+#define A5XX_SP_ALU_ACTIVE_CYCLES          0x1
+#define A5XX_SP0_ICL1_MISSES               0x35
+#define A5XX_SP_FS_CFLOW_INSTRUCTIONS      0x27
+
+/* COUNTABLE FOR TSE PERFCOUNTER */
+#define A5XX_TSE_INPUT_PRIM_NUM            0x6
+ -->
+	<reg32 offset="0xa840" name="SP_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa841" name="SP_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa842" name="SP_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa843" name="SP_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa844" name="SP_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa845" name="SP_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa846" name="SP_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa847" name="SP_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa848" name="TP_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa849" name="TP_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa84a" name="TP_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa84b" name="TP_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa84c" name="TP_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa84d" name="TP_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa84e" name="TP_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa84f" name="TP_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa850" name="RB_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa851" name="RB_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa852" name="RB_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa853" name="RB_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa854" name="RB_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa855" name="RB_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa856" name="RB_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa857" name="RB_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa858" name="CCU_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa859" name="CCU_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa85a" name="CCU_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa85b" name="CCU_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa85c" name="UCHE_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa85d" name="UCHE_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa85e" name="UCHE_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa85f" name="UCHE_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa860" name="UCHE_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa861" name="UCHE_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa862" name="UCHE_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa863" name="UCHE_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa864" name="CP_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa865" name="CP_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa866" name="CP_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa867" name="CP_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa868" name="CP_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa869" name="CP_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa86a" name="CP_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa86b" name="CP_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa86c" name="GPMU_POWER_COUNTER_0_LO"/>
+	<reg32 offset="0xa86d" name="GPMU_POWER_COUNTER_0_HI"/>
+	<reg32 offset="0xa86e" name="GPMU_POWER_COUNTER_1_LO"/>
+	<reg32 offset="0xa86f" name="GPMU_POWER_COUNTER_1_HI"/>
+	<reg32 offset="0xa870" name="GPMU_POWER_COUNTER_2_LO"/>
+	<reg32 offset="0xa871" name="GPMU_POWER_COUNTER_2_HI"/>
+	<reg32 offset="0xa872" name="GPMU_POWER_COUNTER_3_LO"/>
+	<reg32 offset="0xa873" name="GPMU_POWER_COUNTER_3_HI"/>
+	<reg32 offset="0xa874" name="GPMU_POWER_COUNTER_4_LO"/>
+	<reg32 offset="0xa875" name="GPMU_POWER_COUNTER_4_HI"/>
+	<reg32 offset="0xa876" name="GPMU_POWER_COUNTER_5_LO"/>
+	<reg32 offset="0xa877" name="GPMU_POWER_COUNTER_5_HI"/>
+	<reg32 offset="0xa878" name="GPMU_POWER_COUNTER_ENABLE"/>
+	<reg32 offset="0xa879" name="GPMU_ALWAYS_ON_COUNTER_LO"/>
+	<reg32 offset="0xa87a" name="GPMU_ALWAYS_ON_COUNTER_HI"/>
+	<reg32 offset="0xa87b" name="GPMU_ALWAYS_ON_COUNTER_RESET"/>
+	<reg32 offset="0xa87c" name="GPMU_POWER_COUNTER_SELECT_0"/>
+	<reg32 offset="0xa87d" name="GPMU_POWER_COUNTER_SELECT_1"/>
+
+	<reg32 offset="0xa880" name="GPMU_GPMU_SP_CLOCK_CONTROL"/>
+	<reg32 offset="0xa881" name="GPMU_SP_POWER_CNTL"/>
+	<reg32 offset="0xa886" name="GPMU_RBCCU_CLOCK_CNTL"/>
+	<reg32 offset="0xa887" name="GPMU_RBCCU_POWER_CNTL"/>
+	<reg32 offset="0xa88b" name="GPMU_SP_PWR_CLK_STATUS">
+		<bitfield name="PWR_ON" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa88d" name="GPMU_RBCCU_PWR_CLK_STATUS">
+		<bitfield name="PWR_ON" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa891" name="GPMU_PWR_COL_STAGGER_DELAY"/>
+	<reg32 offset="0xa892" name="GPMU_PWR_COL_INTER_FRAME_CTRL"/>
+	<reg32 offset="0xa893" name="GPMU_PWR_COL_INTER_FRAME_HYST"/>
+	<reg32 offset="0xa894" name="GPMU_PWR_COL_BINNING_CTRL"/>
+	<reg32 offset="0xa8a3" name="GPMU_CLOCK_THROTTLE_CTRL"/>
+	<reg32 offset="0xa8a8" name="GPMU_THROTTLE_UNMASK_FORCE_CTRL"/>
+	<reg32 offset="0xa8c1" name="GPMU_WFI_CONFIG"/>
+	<reg32 offset="0xa8d6" name="GPMU_RBBM_INTR_INFO"/>
+	<reg32 offset="0xa8d8" name="GPMU_CM3_SYSRESET"/>
+	<reg32 offset="0xa8e0" name="GPMU_GENERAL_0"/>
+	<reg32 offset="0xa8e1" name="GPMU_GENERAL_1"/>
+	<reg32 offset="0xac00" name="GPMU_TEMP_SENSOR_ID"/>
+	<reg32 offset="0xac01" name="GPMU_TEMP_SENSOR_CONFIG"/>
+	<reg32 offset="0xac02" name="GPMU_TEMP_VAL"/>
+	<reg32 offset="0xac03" name="GPMU_DELTA_TEMP_THRESHOLD"/>
+	<reg32 offset="0xac05" name="GPMU_TEMP_THRESHOLD_INTR_STATUS"/>
+	<reg32 offset="0xac06" name="GPMU_TEMP_THRESHOLD_INTR_EN_MASK"/>
+	<reg32 offset="0xac40" name="GPMU_LEAKAGE_TEMP_COEFF_0_1"/>
+	<reg32 offset="0xac41" name="GPMU_LEAKAGE_TEMP_COEFF_2_3"/>
+	<reg32 offset="0xac42" name="GPMU_LEAKAGE_VTG_COEFF_0_1"/>
+	<reg32 offset="0xac43" name="GPMU_LEAKAGE_VTG_COEFF_2_3"/>
+	<reg32 offset="0xac46" name="GPMU_BASE_LEAKAGE"/>
+	<reg32 offset="0xac60" name="GPMU_GPMU_VOLTAGE"/>
+	<reg32 offset="0xac61" name="GPMU_GPMU_VOLTAGE_INTR_STATUS"/>
+	<reg32 offset="0xac62" name="GPMU_GPMU_VOLTAGE_INTR_EN_MASK"/>
+	<reg32 offset="0xac80" name="GPMU_GPMU_PWR_THRESHOLD"/>
+	<reg32 offset="0xacc4" name="GPMU_GPMU_LLM_GLM_SLEEP_CTRL"/>
+	<reg32 offset="0xacc5" name="GPMU_GPMU_LLM_GLM_SLEEP_STATUS"/>
+	<reg32 offset="0xb80c" name="GDPM_CONFIG1"/>
+	<reg32 offset="0xb80d" name="GDPM_CONFIG2"/>
+	<reg32 offset="0xb80f" name="GDPM_INT_EN"/>
+	<reg32 offset="0xb811" name="GDPM_INT_MASK"/>
+	<reg32 offset="0xb9a0" name="GPMU_BEC_ENABLE"/>
+	<reg32 offset="0xc41a" name="GPU_CS_SENSOR_GENERAL_STATUS"/>
+	<reg32 offset="0xc41d" name="GPU_CS_AMP_CALIBRATION_STATUS1_0"/>
+	<reg32 offset="0xc41f" name="GPU_CS_AMP_CALIBRATION_STATUS1_2"/>
+	<reg32 offset="0xc421" name="GPU_CS_AMP_CALIBRATION_STATUS1_4"/>
+	<reg32 offset="0xc520" name="GPU_CS_ENABLE_REG"/>
+	<reg32 offset="0xc557" name="GPU_CS_AMP_CALIBRATION_CONTROL1"/>
+
+
+	<reg32 offset="0xe000" name="GRAS_CL_CNTL">
+		<bitfield name="ZERO_GB_SCALE_Z" pos="6" type="boolean"/>
+	</reg32>
+	<bitset name="a5xx_gras_xs_cl_cntl" inline="yes">
+		<bitfield name="CLIP_MASK" low="0" high="7"/>
+		<bitfield name="CULL_MASK" low="8" high="15"/>
+	</bitset>
+	<reg32 offset="0xe001" name="GRAS_VS_CL_CNTL" type="a5xx_gras_xs_cl_cntl"/>
+	<reg32 offset="0xe004" name="UNKNOWN_E004"/> <!-- always 00000000? -->
+	<reg32 offset="0xe005" name="GRAS_CNTL">
+		<!-- see also RB_RENDER_CONTROL0 -->
+		<bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+		<bitfield name="IJ_LINEAR_PIXEL" pos="3" type="boolean"/>
+		<bitfield name="IJ_LINEAR_CENTROID" pos="4" type="boolean"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" pos="5" type="boolean"/>
+		<bitfield name="COORD_MASK" low="6" high="9" type="hex"/>
+	</reg32>
+	<reg32 offset="0xe006" name="GRAS_CL_GUARDBAND_CLIP_ADJ">
+		<bitfield name="HORZ" low="0" high="9" type="uint"/>
+		<bitfield name="VERT" low="10" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe010" name="GRAS_CL_VPORT_XOFFSET_0" type="float"/>
+	<reg32 offset="0xe011" name="GRAS_CL_VPORT_XSCALE_0" type="float"/>
+	<reg32 offset="0xe012" name="GRAS_CL_VPORT_YOFFSET_0" type="float"/>
+	<reg32 offset="0xe013" name="GRAS_CL_VPORT_YSCALE_0" type="float"/>
+	<reg32 offset="0xe014" name="GRAS_CL_VPORT_ZOFFSET_0" type="float"/>
+	<reg32 offset="0xe015" name="GRAS_CL_VPORT_ZSCALE_0" type="float"/>
+	<reg32 offset="0xe090" name="GRAS_SU_CNTL">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FRONT_CW" pos="2" type="boolean"/>
+		<bitfield name="LINEHALFWIDTH" low="3" high="10" radix="2" type="fixed"/>
+		<bitfield name="POLY_OFFSET" pos="11" type="boolean"/>
+		<bitfield name="LINE_MODE" pos="13" type="a5xx_line_mode"/>
+		<!-- probably LINEHALFWIDTH is the same as a4xx.. -->
+	</reg32>
+	<reg32 offset="0xe091" name="GRAS_SU_POINT_MINMAX">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0xe092" name="GRAS_SU_POINT_SIZE" type="fixed" radix="4"/>
+	<reg32 offset="0xe093" name="GRAS_SU_LAYERED"/>
+	<reg32 offset="0xe094" name="GRAS_SU_DEPTH_PLANE_CNTL">
+		<bitfield name="FRAG_WRITES_Z" pos="0" type="boolean"/>
+		<bitfield name="UNK1" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe095" name="GRAS_SU_POLY_OFFSET_SCALE" type="float"/>
+	<reg32 offset="0xe096" name="GRAS_SU_POLY_OFFSET_OFFSET" type="float"/>
+	<reg32 offset="0xe097" name="GRAS_SU_POLY_OFFSET_OFFSET_CLAMP" type="float"/>
+	<!-- duplicates RB_DEPTH_INFO0: -->
+	<reg32 offset="0xe098" name="GRAS_SU_DEPTH_BUFFER_INFO">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a5xx_depth_format"/>
+	</reg32>
+	<reg32 offset="0xe099" name="GRAS_SU_CONSERVATIVE_RAS_CNTL"/> <!-- always 00000000? -->
+	<!--
+	guessing about window/screen/extent, I think they can in the end be
+	used interchangeably?
+	 -->
+	<reg32 offset="0xe0a0" name="GRAS_SC_CNTL">
+		<bitfield name="BINNING_PASS" pos="0" type="boolean"/>
+		<bitfield name="SAMPLES_PASSED" pos="15" type="boolean"/>
+	</reg32>
+	<!-- note, 0x4 for binning pass when frag writes z?? -->
+	<reg32 offset="0xe0a1" name="GRAS_SC_BIN_CNTL"/> <!-- always 00000000? -->
+	<reg32 offset="0xe0a2" name="GRAS_SC_RAS_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+	</reg32>
+	<reg32 offset="0xe0a3" name="GRAS_SC_DEST_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe0a4" name="GRAS_SC_SCREEN_SCISSOR_CNTL"/> <!-- always 00000000? -->
+	<reg32 offset="0xe0aa" name="GRAS_SC_SCREEN_SCISSOR_TL_0" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0ab" name="GRAS_SC_SCREEN_SCISSOR_BR_0" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0ca" name="GRAS_SC_VIEWPORT_SCISSOR_TL_0" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0cb" name="GRAS_SC_VIEWPORT_SCISSOR_BR_0" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0ea" name="GRAS_SC_WINDOW_SCISSOR_TL" type="adreno_reg_xy"/>
+	<reg32 offset="0xe0eb" name="GRAS_SC_WINDOW_SCISSOR_BR" type="adreno_reg_xy"/>
+
+	<doc>
+		LRZ:  (Low Resolution Z ??)
+		----
+
+		I think it serves two functions, early discard of primitives in binning
+		pass without needing full resolution depth buffer, and also functions as
+		a depth-prepass, used during the GMEM draws to discard primitives that
+		would not be visible due to later draws.
+
+		The LRZ buffer always seems to be z16 format, regardless of actual
+		depth buffer format.
+
+		Note that LRZ write should be disabled when blend/stencil/etc is enabled,
+		since the occluded primitive can still contribute to final color value
+		of a fragment.
+
+		Only enabled for GL_LESS/GL_LEQUAL/GL_GREATER/GL_GEQUAL?
+	</doc>
+	<reg32 offset="0xe100" name="GRAS_LRZ_CNTL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<doc>LRZ write also disabled for blend/etc.</doc>
+		<bitfield name="LRZ_WRITE" pos="1" type="boolean"/>
+		<doc>update MAX instead of MIN value, ie. GL_GREATER/GL_GEQUAL</doc>
+		<bitfield name="GREATER" pos="2" type="boolean"/>
+		<!--
+		b3 set sometimes, when depth buffer isn't cleared.. maybe it
+		invalidates the LRZ buffer?  (Or just the covered positions?
+		 -->
+	</reg32>
+	<reg32 offset="0xe101" name="GRAS_LRZ_BUFFER_BASE_LO"/>
+	<reg32 offset="0xe102" name="GRAS_LRZ_BUFFER_BASE_HI"/>
+	<!--
+	lzr pitch is depth pitch (in pixels) / 8 (aligned to 32)..
+	 -->
+	<doc>
+		Pitch is depth width (in pixels) / 8 (aligned to 32).  Height
+		is also divided by 8 (ie. covers 8x8 pixels)
+	</doc>
+	<reg32 offset="0xe103" name="GRAS_LRZ_BUFFER_PITCH" shr="5" type="uint"/>
+	<reg32 offset="0xe104" name="GRAS_LRZ_FAST_CLEAR_BUFFER_BASE_LO"/>
+	<reg32 offset="0xe105" name="GRAS_LRZ_FAST_CLEAR_BUFFER_BASE_HI"/>
+
+	<reg32 offset="0xe140" name="RB_CNTL">
+		<bitfield name="WIDTH" low="0" high="7" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="9" high="16" shr="5" type="uint"/>
+		<bitfield name="BYPASS" pos="17" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe141" name="RB_RENDER_CNTL">
+<!--
+bit 3 set for normal draws
+bit 7 for RECTLIST (clear) when z32s8 (used for clear of depth32?  not set
+	for z32 with no stencil, but maybe in that case separate z/s not used?
+	see mrt-fbo-* zs=2)
+ -->
+		<bitfield name="BINNING_PASS" pos="0" type="boolean"/>
+		<bitfield name="SAMPLES_PASSED" pos="6" type="boolean"/>
+		<bitfield name="DISABLE_COLOR_PIPE" pos="7" type="boolean"/>
+		<!-- why everything twice?? maybe read vs write? -->
+		<!-- UBWC flag buffer enabled for depth/stencil: -->
+		<bitfield name="FLAG_DEPTH" pos="14" type="boolean"/>
+		<bitfield name="FLAG_DEPTH2" pos="15" type="boolean"/>
+		<!-- bitmask of MRTs using UBWC flag buffer: -->
+		<bitfield name="FLAG_MRTS" low="16" high="23"/>
+		<bitfield name="FLAG_MRTS2" low="24" high="31"/>
+	</reg32>
+	<reg32 offset="0xe142" name="RB_RAS_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+	</reg32>
+	<reg32 offset="0xe143" name="RB_DEST_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+	<!--
+	note: maybe not actually called RB_RENDER_CONTROLn (since RB_RENDER_CNTL
+	name comes from kernel and is probably right)
+	 -->
+	<reg32 offset="0xe144" name="RB_RENDER_CONTROL0">
+		<!-- see also GRAS_CNTL -->
+		<bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+		<bitfield name="IJ_LINEAR_PIXEL" pos="3" type="boolean"/>
+		<bitfield name="IJ_LINEAR_CENTROID" pos="4" type="boolean"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" pos="5" type="boolean"/>
+		<bitfield name="COORD_MASK" low="6" high="9" type="hex"/>
+	</reg32>
+	<reg32 offset="0xe145" name="RB_RENDER_CONTROL1">
+		<bitfield name="SAMPLEMASK" pos="0" type="boolean"/>
+		<bitfield name="FACENESS" pos="1" type="boolean"/>
+		<bitfield name="SAMPLEID" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe146" name="RB_FS_OUTPUT_CNTL">
+		<!-- bit0 set except for binning pass.. -->
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+		<bitfield name="FRAG_WRITES_Z" pos="5" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe147" name="RB_RENDER_COMPONENTS">
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+	<array offset="0xe150" name="RB_MRT" stride="7" length="8">
+		<reg32 offset="0x0" name="CONTROL">
+			<bitfield name="BLEND" pos="0" type="boolean"/>
+			<bitfield name="BLEND2" pos="1" type="boolean"/>
+			<bitfield name="ROP_ENABLE" pos="2" type="boolean"/>
+			<bitfield name="ROP_CODE" low="3" high="6" type="a3xx_rop_code"/>
+			<bitfield name="COMPONENT_ENABLE" low="7" high="10" type="hex"/>
+		</reg32>
+		<reg32 offset="0x1" name="BLEND_CONTROL">
+			<bitfield name="RGB_SRC_FACTOR" low="0" high="4" type="adreno_rb_blend_factor"/>
+			<bitfield name="RGB_BLEND_OPCODE" low="5" high="7" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="RGB_DEST_FACTOR" low="8" high="12" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_SRC_FACTOR" low="16" high="20" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_BLEND_OPCODE" low="21" high="23" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="ALPHA_DEST_FACTOR" low="24" high="28" type="adreno_rb_blend_factor"/>
+		</reg32>
+		<reg32 offset="0x2" name="BUF_INFO">
+			<!--
+			not sure if there is a separate COLOR_SWAP field like on a3xx/a4xx,
+			or if it is inherent in the format.  Will have to play with bits
+			once we get things working and see what happens.  If it is a diff
+			field, it doesn't seem to have the same encoding as a3xx/a4xx.
+			 -->
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a5xx_color_fmt"/>
+			<bitfield name="COLOR_TILE_MODE" low="8" high="9" type="a5xx_tile_mode"/>
+			<bitfield name="DITHER_MODE" low="11" high="12" type="adreno_rb_dither_mode"/>
+			<bitfield name="COLOR_SWAP" low="13" high="14" type="a3xx_color_swap"/>
+			<bitfield name="COLOR_SRGB" pos="15" type="boolean"/>
+		</reg32>
+		<!--
+		at least in gmem, things seem to be aligned to pitch of 64..
+		maybe an artifact of tiled format used in gmem?
+		 -->
+		<reg32 offset="0x3" name="PITCH" shr="6" type="uint"/>
+		<reg32 offset="0x4" name="ARRAY_PITCH" shr="6" type="uint"/>
+		<reg32 offset="0x5" name="BASE_LO"/>
+		<reg32 offset="0x6" name="BASE_HI"/>
+	</array>
+	<reg32 offset="0xe1a0" name="RB_BLEND_RED">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0xe1a1" name="RB_BLEND_RED_F32" type="float"/>
+	<reg32 offset="0xe1a2" name="RB_BLEND_GREEN">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0xe1a3" name="RB_BLEND_GREEN_F32" type="float"/>
+	<reg32 offset="0xe1a4" name="RB_BLEND_BLUE">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0xe1a5" name="RB_BLEND_BLUE_F32" type="float"/>
+	<reg32 offset="0xe1a6" name="RB_BLEND_ALPHA">
+		<bitfield name="UINT" low="0" high="7" type="hex"/>
+		<bitfield name="SINT" low="8" high="15" type="hex"/>
+		<bitfield name="FLOAT" low="16" high="31" type="float"/>
+	</reg32>
+	<reg32 offset="0xe1a7" name="RB_BLEND_ALPHA_F32" type="float"/>
+	<reg32 offset="0xe1a8" name="RB_ALPHA_CONTROL">
+		<bitfield name="ALPHA_REF" low="0" high="7" type="hex"/>
+		<bitfield name="ALPHA_TEST" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TEST_FUNC" low="9" high="11" type="adreno_compare_func"/>
+	</reg32>
+	<reg32 offset="0xe1a9" name="RB_BLEND_CNTL">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="INDEPENDENT_BLEND" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="10" type="boolean"/>
+		<!-- a guess? -->
+		<bitfield name="SAMPLE_MASK" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0xe1b0" name="RB_DEPTH_PLANE_CNTL">
+		<bitfield name="FRAG_WRITES_Z" pos="0" type="boolean"/>
+		<bitfield name="UNK1" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe1b1" name="RB_DEPTH_CNTL">
+		<bitfield name="Z_TEST_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="ZFUNC" low="2" high="4" type="adreno_compare_func"/>
+		<doc>Z_READ_ENABLE bit is set for zfunc other than GL_ALWAYS or GL_NEVER</doc>
+		<bitfield name="Z_READ_ENABLE" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe1b2" name="RB_DEPTH_BUFFER_INFO">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a5xx_depth_format"/>
+	</reg32>
+	<reg32 offset="0xe1b3" name="RB_DEPTH_BUFFER_BASE_LO"/>
+	<reg32 offset="0xe1b4" name="RB_DEPTH_BUFFER_BASE_HI"/>
+	<reg32 offset="0xe1b5" name="RB_DEPTH_BUFFER_PITCH" shr="6" type="uint">
+		<doc>stride of depth/stencil buffer</doc>
+	</reg32>
+	<reg32 offset="0xe1b6" name="RB_DEPTH_BUFFER_ARRAY_PITCH" shr="6" type="uint">
+		<doc>size of layer</doc>
+	</reg32>
+	<reg32 offset="0xe1c0" name="RB_STENCIL_CONTROL">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="STENCIL_ENABLE_BF" pos="1" type="boolean"/>
+		<!--
+			set for stencil operations that require read from stencil
+			buffer, but not for example for stencil clear (which does
+			not require read).. so guessing this is analogous to
+			READ_DEST_ENABLE for color buffer..
+		 -->
+		<bitfield name="STENCIL_READ" pos="2" type="boolean"/>
+		<bitfield name="FUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="FAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="FUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="FAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0xe1c1" name="RB_STENCIL_INFO">
+		<bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe1c2" name="RB_STENCIL_BASE_LO"/>
+	<reg32 offset="0xe1c3" name="RB_STENCIL_BASE_HI"/>
+	<reg32 offset="0xe1c4" name="RB_STENCIL_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0xe1c5" name="RB_STENCIL_ARRAY_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0xe1c6" name="RB_STENCILREFMASK" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0xe1c7" name="RB_STENCILREFMASK_BF" type="adreno_rb_stencilrefmask"/>
+	<reg32 offset="0xe1d0" name="RB_WINDOW_OFFSET" type="adreno_reg_xy"/>
+	<reg32 offset="0xe1d1" name="RB_SAMPLE_COUNT_CONTROL">
+		<bitfield name="COPY" pos="1" type="boolean"/>
+	</reg32>
+
+	<doc>
+		Blits:
+		------
+
+		Blits are triggered by CP_EVENT_WRITE:BLIT, compared to previous
+		generations where they shared most of the gl pipeline and were
+		triggered by CP_DRAW_INDX*
+
+		For gmem->mem blob uses RB_BLIT_CNTL.BUF to specify src of
+		blit (ie MRTn, ZS, etc) and RB_BLIT_DST_LO/HI for destination
+		gpuaddr.  The gmem offset is taken from RB_MRT[n].BASE_LO/HI
+
+		For mem->gmem blob uses just MRT0 or ZS and RB_BLIT_DST_LO/HI
+		for the GMEM offset, and gpuaddr from RB_MRT[0].BASE_LO/HI
+		(I suppose this is just to avoid trashing RB_MRT[1..7]??)
+	</doc>
+	<reg32 offset="0xe210" name="RB_BLIT_CNTL">
+		<bitfield name="BUF" low="0" high="3" type="a5xx_blit_buf"/>
+	</reg32>
+	<reg32 offset="0xe211" name="RB_RESOLVE_CNTL_1" type="adreno_reg_xy"/>
+	<reg32 offset="0xe212" name="RB_RESOLVE_CNTL_2" type="adreno_reg_xy"/>
+	<reg32 offset="0xe213" name="RB_RESOLVE_CNTL_3">
+		<!-- if b0 set, output is in TILE5_3 format -->
+		<bitfield name="TILED" pos="0" type="boolean"/>
+	<!--
+		0xe213:
+		        0x0 mem->gmem
+		        0xf gmem->mem with flag buffer (color)
+		        0x4 gmem->mem without flag buffer (color)
+		        0x7 BYPASS mode flag buffer result (ie. on readpix)
+		            also for gmem->mem preserving tiling
+	-->
+	</reg32>
+	<reg32 offset="0xe214" name="RB_BLIT_DST_LO"/>
+	<reg32 offset="0xe215" name="RB_BLIT_DST_HI"/>
+	<reg32 offset="0xe216" name="RB_BLIT_DST_PITCH" shr="6" type="uint"/>
+	<!-- array-pitch is size of layer -->
+	<reg32 offset="0xe217" name="RB_BLIT_DST_ARRAY_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0xe218" name="RB_CLEAR_COLOR_DW0"/>
+	<reg32 offset="0xe219" name="RB_CLEAR_COLOR_DW1"/>
+	<reg32 offset="0xe21a" name="RB_CLEAR_COLOR_DW2"/>
+	<reg32 offset="0xe21b" name="RB_CLEAR_COLOR_DW3"/>
+	<reg32 offset="0xe21c" name="RB_CLEAR_CNTL">
+		<bitfield name="FAST_CLEAR" pos="1" type="boolean"/>
+		<bitfield name="MSAA_RESOLVE" pos="2" type="boolean"/>
+		<doc>
+			For MASK, if RB_BLIT_CNTL.BUF=BLIT_ZS:
+				1 - depth
+				2 - stencil
+				3 - depth+stencil
+			if RB_BLIT_CNTL.BUF=BLIT_MRTn
+				then probably a component mask, I always see 0xf
+		</doc>
+		<bitfield name="MASK" low="4" high="7"/>
+	</reg32>
+
+	<doc>
+		Buffer Metadata (flag buffers):
+		-------------------------------
+
+		Blob seems to stick some metadata at the front of the buffer,
+		both z/s and MRT.  I think this is same as UBWC (bandwidth
+		compression) metadata that mdp 1.7 and later supports.  See
+		1d3fae5698ce5358caab87a15383b690941697e8 in downstream kernel.
+		UBWC seems to stand for "universal bandwidth compression".
+
+		Before glReadPixels() it does a pair of BYPASS blits (at least
+		if metadata is used) presumably to resolve metadata.
+
+		NOTES: see: getUBwcBlockSize(), getUBwcMetaBufferSize() at
+		https://android.googlesource.com/platform/hardware/qcom/display/+/android-6.0.1_r40/msm8994/libgralloc/alloc_controller.cpp
+		(note that bpp in bytes, not bits, so really cpp)
+
+		Example Layout 2d w/ mipmap levels:
+
+			100x2000, ifmt=GL_RG, fmt=GL_RG16F, type=GL_FLOAT, meta=64x512@0x8000 (7x500)
+				base=c072e000, offset=16384, size=1703936
+
+				color		flags
+			0	c073a000	c0732000	- level 0 flags is address
+			1	c0838000	c0834000	  programmed in texture state
+			2	c0879000	c0877000
+			3	c089a000	c0899000
+			4	c08ab000	c08aa000
+			5	c08b4000	c08b3000
+			6	c08b9000	c08b8000
+			7	c08bc000	c08bb000
+			8	c08be000	c08bd000
+			9	c08c0000	c08bf000
+			10	c08c2000	c08c1000
+
+		ARRAY_PITCH is the combined size of all the levels plus flags,
+		so 0xc08c3000 - 0xc0732000 = 0x00191000 (1642496); each level
+		takes up a minimum of 2 pages (since color and flags parts are
+		each page aligned.
+
+			{ TILE_MODE = TILE5_3 | SWIZ_X = A5XX_TEX_X | SWIZ_Y = A5XX_TEX_Y | SWIZ_Z = A5XX_TEX_ZERO | SWIZ_W = A5XX_TEX_ONE | MIPLVLS = 0 | FMT = TFMT5_16_16_FLOAT | SWAP = WZYX }
+			{ WIDTH = 100 | HEIGHT = 2000 }
+			{ FETCHSIZE = TFETCH5_4_BYTE | PITCH = 512 | TYPE = A5XX_TEX_2D }
+			{ ARRAY_PITCH = 1642496 | 0x18800000 }  - NOTE c2dc always has 0x18800000 but
+			{ BASE_LO = 0xc0732000 }                  this varies for blob gles driver..
+			{ BASE_HI = 0 | DEPTH = 1 }               not sure what it is
+
+
+	</doc>
+	<reg32 offset="0xe240" name="RB_DEPTH_FLAG_BUFFER_BASE_LO"/>
+	<reg32 offset="0xe241" name="RB_DEPTH_FLAG_BUFFER_BASE_HI"/>
+	<reg32 offset="0xe242" name="RB_DEPTH_FLAG_BUFFER_PITCH">
+	</reg32>
+	<array offset="0xe243" name="RB_MRT_FLAG_BUFFER" stride="4" length="8">
+		<reg32 offset="0" name="ADDR_LO"/>
+		<reg32 offset="1" name="ADDR_HI"/>
+		<reg32 offset="2" name="PITCH" shr="6" type="uint"/>
+		<!-- array-pitch is size of layer -->
+		<reg32 offset="3" name="ARRAY_PITCH" shr="6" type="uint"/>
+	</array>
+	<reg32 offset="0xe263" name="RB_BLIT_FLAG_DST_LO"/>
+	<reg32 offset="0xe264" name="RB_BLIT_FLAG_DST_HI"/>
+	<reg32 offset="0xe265" name="RB_BLIT_FLAG_DST_PITCH" shr="6" type="uint"/>
+	<!-- array-pitch is size of layer -->
+	<reg32 offset="0xe266" name="RB_BLIT_FLAG_DST_ARRAY_PITCH" shr="6" type="uint"/>
+
+	<reg32 offset="0xe267" name="RB_SAMPLE_COUNT_ADDR_LO"/>
+	<reg32 offset="0xe268" name="RB_SAMPLE_COUNT_ADDR_HI"/>
+
+	<reg32 offset="0xe280" name="VPC_CNTL_0">
+		<doc>
+			num of varyings plus four for gl_Position (plus one if gl_PointSize)
+			plus # of transform-feedback (streamout) varyings if using the
+			hw streamout (rather than stg instructions in shader)
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="6" type="uint"/>
+		<bitfield name="VARYING" pos="11" type="boolean"/>
+	</reg32>
+	<array offset="0xe282" name="VPC_VARYING_INTERP" stride="1" length="8">
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+	<array offset="0xe28a" name="VPC_VARYING_PS_REPL" stride="1" length="8">
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+	<reg32 offset="0xe292" name="UNKNOWN_E292"/>
+	<reg32 offset="0xe293" name="UNKNOWN_E293"/>
+	<array offset="0xe294" name="VPC_VAR" stride="1" length="4">
+		<!-- one bit per varying component: -->
+		<reg32 offset="0" name="DISABLE"/>
+	</array>
+	<reg32 offset="0xe298" name="VPC_GS_SIV_CNTL"/>
+	<reg32 offset="0xe29a" name="VPC_CLIP_CNTL">
+		<bitfield name="CLIP_MASK" low="0" high="7" type="uint"/>
+		<!-- there can be up to 8 total clip/cull distance outputs,
+		     but apparenly VPC can only deal with vec4, so when there are
+		     more than 4 outputs a second location needs to be programmed
+		-->
+		<bitfield name="CLIP_DIST_03_LOC" low="8" high="15" type="uint"/>
+		<bitfield name="CLIP_DIST_47_LOC" low="16" high="23" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0xe29d" name="VPC_PACK">
+		<bitfield name="NUMNONPOSVAR" low="0" high="7" type="uint"/>
+		<!--
+		This seems to be the OUTLOC for the psize output.  It could possibly
+		be the max-OUTLOC position, but it is only set when VS writes psize
+		(and blob always puts psize at highest OUTLOC)
+		 -->
+		<bitfield name="PSIZELOC" low="8" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe2a0" name="VPC_FS_PRIMITIVEID_CNTL"/>
+
+	<doc>
+		Stream-Out:
+		-----------
+
+		VPC_SO[0..3] registers setup details about streamout buffers, and
+		number of components to write to each.
+
+		VPC_SO_PROG provides the mapping between output varyings and the SO
+		buffers.  It is written multiple times (via a CP_CONTEXT_REG_BUNCH
+		packet, not sure if that matters), each write can handle up to two
+		components of stream-out output.  Order matches up to OUTLOC,
+		including padding.  So, if outputting first 3 varyings:
+
+			SP_VS_OUT[0].REG: { A_REGID = r0.w | A_COMPMASK = 0xf | B_REGID = r0.x | B_COMPMASK = 0x7 }
+			SP_VS_OUT[0x1].REG: { A_REGID = r1.w | A_COMPMASK = 0x3 | B_REGID = r2.y | B_COMPMASK = 0xf }
+			SP_VS_VPC_DST[0].REG: { OUTLOC0 = 0 | OUTLOC1 = 4 | OUTLOC2 = 8 | OUTLOC3 = 12 }
+
+		Then:
+
+			VPC_SO_PROG: { A_BUF = 0 | A_OFF = 0 | A_EN | A_BUF = 0 | B_OFF = 4 | B_EN }
+			VPC_SO_PROG: { A_BUF = 0 | A_OFF = 8 | A_EN | A_BUF = 0 | B_OFF = 12 | B_EN }
+			VPC_SO_PROG: { A_BUF = 2 | A_OFF = 0 | A_EN | A_BUF = 2 | B_OFF = 4 | B_EN }
+			VPC_SO_PROG: { A_BUF = 2 | A_OFF = 8 | A_EN | A_BUF = 0 | B_OFF = 0 }
+			VPC_SO_PROG: { A_BUF = 1 | A_OFF = 0 | A_EN | A_BUF = 1 | B_OFF = 4 | B_EN }
+
+		Note that varying order is OUTLOC0, OUTLOC2, OUTLOC1, and note
+		the padding between OUTLOC1 and OUTLOC2.
+
+		The BUF bitfield indicates which of the four streamout buffers
+		to write into at the specified offset.
+
+		The VPC_SO[n].FLUSH_BASE_LO/HI is used for hw to write back next
+		offset which gets loaded back into VPC_SO[n].BUFFER_OFFSET via a
+		CP_MEM_TO_REG.  Probably can be ignored until we have GS/etc, at
+		which point we can't calculate the offset on the CPU.
+	</doc>
+	<reg32 offset="0xe2a1" name="VPC_SO_BUF_CNTL">
+		<bitfield name="BUF0" pos="0" type="boolean"/>
+		<bitfield name="BUF1" pos="3" type="boolean"/>
+		<bitfield name="BUF2" pos="6" type="boolean"/>
+		<bitfield name="BUF3" pos="9" type="boolean"/>
+		<bitfield name="ENABLE" pos="15" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe2a2" name="VPC_SO_OVERRIDE">
+		<bitfield name="SO_DISABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe2a3" name="VPC_SO_CNTL">
+		<!-- always 0x10000 when SO enabled.. -->
+		<bitfield name="ENABLE" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe2a4" name="VPC_SO_PROG">
+		<bitfield name="A_BUF" low="0" high="1" type="uint"/>
+		<bitfield name="A_OFF" low="2" high="10" shr="2" type="uint"/>
+		<bitfield name="A_EN" pos="11" type="boolean"/>
+		<bitfield name="B_BUF" low="12" high="13" type="uint"/>
+		<bitfield name="B_OFF" low="14" high="22" shr="2" type="uint"/>
+		<bitfield name="B_EN" pos="23" type="boolean"/>
+	</reg32>
+	<array offset="0xe2a7" name="VPC_SO" stride="7" length="4">
+		<reg32 offset="0" name="BUFFER_BASE_LO"/>
+		<reg32 offset="1" name="BUFFER_BASE_HI"/>
+		<reg32 offset="2" name="BUFFER_SIZE"/>
+		<reg32 offset="3" name="NCOMP"/>  <!-- component count -->
+		<reg32 offset="4" name="BUFFER_OFFSET"/>
+		<reg32 offset="5" name="FLUSH_BASE_LO"/>
+		<reg32 offset="6" name="FLUSH_BASE_HI"/>
+	</array>
+
+	<reg32 offset="0xe384" name="PC_PRIMITIVE_CNTL">
+		<!-- # of varyings plus four for gl_Position (plus one if gl_PointSize) -->
+		<bitfield name="STRIDE_IN_VPC" low="0" high="6" type="uint"/>
+		<bitfield name="PRIMITIVE_RESTART" pos="8" type="boolean"/>
+		<bitfield name="COUNT_PRIMITIVES" pos="9" type="boolean"/><!-- enabled when gl_PrimitiveIDIn is used -->
+		<bitfield name="PROVOKING_VTX_LAST" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe385" name="PC_PRIM_VTX_CNTL">
+		<bitfield name="PSIZE" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe388" name="PC_RASTER_CNTL">
+		<bitfield name="POLYMODE_FRONT_PTYPE" low="0" high="2" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_BACK_PTYPE" low="3" high="5" type="adreno_pa_su_sc_draw"/>
+		<bitfield name="POLYMODE_ENABLE" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe389" name="PC_CLIP_CNTL">
+		<bitfield name="CLIP_MASK" low="0" high="7"/>
+	</reg32>
+	<reg32 offset="0xe38c" name="PC_RESTART_INDEX"/>
+	<reg32 offset="0xe38d" name="PC_GS_LAYERED"/>
+	<reg32 offset="0xe38e" name="PC_GS_PARAM">
+		<bitfield name="MAX_VERTICES" low="0" high="9" type="uint"/><!-- vertices - 1 -->
+		<bitfield name="INVOCATIONS" low="11" high="15" type="uint"/><!-- invoc - 1 -->
+		<bitfield name="PRIMTYPE" low="23" high="24" type="adreno_pa_su_sc_draw"/>
+	</reg32>
+	<reg32 offset="0xe38f" name="PC_HS_PARAM">
+		<bitfield name="VERTICES_OUT" low="0" high="5" type="uint"/>
+		<bitfield name="SPACING" low="21" high="22" type="a4xx_tess_spacing"/>
+		<bitfield name="CW" pos="23" type="boolean"/>
+		<bitfield name="CONNECTED" pos="24" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe3b0" name="PC_POWER_CNTL"/>
+
+	<reg32 offset="0xe400" name="VFD_CONTROL_0">
+		<bitfield name="VTXCNT" low="0" high="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe401" name="VFD_CONTROL_1">
+		<bitfield name="REGID4VTX" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="REGID4INST" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID4PRIMID" low="16" high="23" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe402" name="VFD_CONTROL_2">
+		<bitfield name="REGID_PATCHID" low="0" high="7" type="a3xx_regid"/><!-- same as VFD_CONTROL_3.REGID_PATCHID? -->
+	</reg32>
+	<reg32 offset="0xe403" name="VFD_CONTROL_3">
+		<bitfield name="REGID_PATCHID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSY" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe404" name="VFD_CONTROL_4">
+	</reg32>
+	<reg32 offset="0xe405" name="VFD_CONTROL_5">
+		<!-- b0 set if gl_PrimitiveID used in fs ?? -->
+	</reg32>
+	<reg32 offset="0xe408" name="VFD_INDEX_OFFSET"/>
+	<reg32 offset="0xe409" name="VFD_INSTANCE_START_OFFSET"/>
+	<array offset="0xe40a" name="VFD_FETCH" stride="4" length="32">
+		<reg32 offset="0x0" name="BASE_LO"/>
+		<reg32 offset="0x1" name="BASE_HI"/>
+		<reg32 offset="0x2" name="SIZE" type="uint"/>
+		<reg32 offset="0x3" name="STRIDE" type="uint"/>
+	</array>
+	<array offset="0xe48a" name="VFD_DECODE" stride="2" length="32">
+		<reg32 offset="0x0" name="INSTR">
+			<!-- IDX appears to index into VFD_FETCH[] -->
+			<bitfield name="IDX" low="0" high="4" type="uint"/>
+			<bitfield name="INSTANCED" pos="17" type="boolean"/>
+			<bitfield name="FORMAT" low="20" high="27" type="a5xx_vtx_fmt"/>
+			<bitfield name="SWAP" low="28" high="29" type="a3xx_color_swap"/>
+			<bitfield name="UNK30" pos="30" type="boolean"/>
+			<bitfield name="FLOAT" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x1" name="STEP_RATE"/> <!-- ??? -->
+	</array>
+	<array offset="0xe4ca" name="VFD_DEST_CNTL" stride="1" length="32">
+		<reg32 offset="0x0" name="INSTR">
+			<bitfield name="WRITEMASK" low="0" high="3" type="hex"/>
+			<bitfield name="REGID" low="4" high="11" type="a3xx_regid"/>
+		</reg32>
+	</array>
+	<reg32 offset="0xe4f0" name="VFD_POWER_CNTL"/>
+
+	<!-- 0x0 for compute, 0x10 for 3d? -->
+	<reg32 offset="0xe580" name="SP_SP_CNTL"/>
+
+	<bitset name="a5xx_xs_config" inline="yes">
+		<bitfield name="ENABLED" pos="0" type="boolean"/>
+		<bitfield name="CONSTOBJECTOFFSET" low="1" high="7" type="uint"/>
+		<bitfield name="SHADEROBJOFFSET" low="8" high="14" type="uint"/>
+	</bitset>
+	<bitset name="a5xx_xs_cntl" inline="yes">
+		<bitfield name="SSBO_ENABLE" pos="0" type="boolean"/>
+		<!--
+		no idea high bit.. could be this is amount of on-chip memory used
+		rather than total size?
+		 -->
+		<bitfield name="INSTRLEN" low="1" high="31" type="uint"/>
+	</bitset>
+	<bitset name="a5xx_sp_xs_ctrl_reg0" inline="yes">
+		<!-- bit1 almost always set -->
+		<!-- set for "buffer mode" (ie. shader small enough to fit internally) -->
+		<bitfield name="BUFFER" pos="2" type="boolean"/>
+		<!-- 24 or more (full size) GPRS and blob uses TWO_QUADS instead of FOUR_QUADS -->
+		<bitfield name="THREADSIZE" pos="3" type="a3xx_threadsize"/>
+		<bitfield name="HALFREGFOOTPRINT" low="4" high="9" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="10" high="15" type="uint"/>
+		<bitfield name="VARYING" pos="16" type="boolean"/>
+		<bitfield name="PIXLODENABLE" pos="20" type="boolean"/>
+		<!-- seems to be nesting level for flow control:.. -->
+		<bitfield name="BRANCHSTACK" low="25" high="31" type="uint"/>
+	</bitset>
+	<!-- assuming things appear in same relative order as a4xx: -->
+	<!-- duplicated exactly w/ corresponding HLSQ_ regs starting at 0xe78b.. -->
+	<reg32 offset="0xe584" name="SP_VS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe585" name="SP_FS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe586" name="SP_HS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe587" name="SP_DS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe588" name="SP_GS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe589" name="SP_CS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe58a" name="SP_VS_CONFIG_MAX_CONST"/>
+	<reg32 offset="0xe58b" name="SP_FS_CONFIG_MAX_CONST"/>
+	<reg32 offset="0xe590" name="SP_VS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe592" name="SP_PRIMITIVE_CNTL">
+		<!-- # of VS outputs including pos/psize -->
+		<bitfield name="VSOUT" low="0" high="4" type="uint"/>
+	</reg32>
+	<array offset="0xe593" name="SP_VS_OUT" stride="1" length="16">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="24" high="27" type="hex"/>
+		</reg32>
+	</array>
+	<!--
+	Starting with a5xx, position/psize outputs from shader end up in the
+	SP_VS_OUT map, with highest OUTLOCn position.  (Generally they are
+	the last entries too, except when gl_PointCoord is used, blob inserts
+	an extra varying after, but with a lower OUTLOC position.  If present,
+	psize is last, preceded by position.
+	 -->
+	<array offset="0xe5a3" name="SP_VS_VPC_DST" stride="1" length="8">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0xe5ab" name="UNKNOWN_E5AB"/>
+	<reg32 offset="0xe5ac" name="SP_VS_OBJ_START_LO"/>
+	<reg32 offset="0xe5ad" name="SP_VS_OBJ_START_HI"/>
+
+	<bitset name="a5xx_sp_xs_pvt_mem_param" inline="yes">
+		<bitfield name="MEMSIZEPERITEM" low="0" high="7" shr="9">
+			<doc>The size of memory that ldp/stp can address.</doc>
+		</bitfield>
+		<bitfield name="HWSTACKOFFSET" low="8" high="23" shr="11" type="uint"/>
+		<bitfield name="HWSTACKSIZEPERTHREAD" low="24" high="31">
+                        <doc>Guessing that this is the same as a3xx/a6xx.</doc>
+		</bitfield>
+	</bitset>
+
+	<bitset name="a5xx_sp_xs_pvt_mem_size" inline="yes">
+		<bitfield name="TOTALPVTMEMSIZE" low="0" high="17" shr="12"/>
+	</bitset>
+
+	<reg32 offset="0xe5ae" name="SP_VS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe5af" name="SP_VS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe5b1" name="SP_VS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+	<reg32 offset="0xe5c0" name="SP_FS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe5c2" name="UNKNOWN_E5C2"/>
+	<reg32 offset="0xe5c3" name="SP_FS_OBJ_START_LO"/>
+	<reg32 offset="0xe5c4" name="SP_FS_OBJ_START_HI"/>
+	<reg32 offset="0xe5c5" name="SP_FS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe5c6" name="SP_FS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe5c8" name="SP_FS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+	<reg32 offset="0xe5c9" name="SP_BLEND_CNTL">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="UNK8" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xe5ca" name="SP_FS_OUTPUT_CNTL">
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+		<bitfield name="DEPTH_REGID" low="5" high="12" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK_REGID" low="13" high="20" type="a3xx_regid"/>
+	</reg32>
+	<array offset="0xe5cb" name="SP_FS_OUTPUT" stride="1" length="8">
+		<doc>per MRT</doc>
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="HALF_PRECISION" pos="8" type="boolean"/>
+		</reg32>
+	</array>
+	<array offset="0xe5d3" name="SP_FS_MRT" stride="1" length="8">
+		<reg32 offset="0" name="REG">
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a5xx_color_fmt"/>
+			<bitfield name="COLOR_SINT" pos="8" type="boolean"/>
+			<bitfield name="COLOR_UINT" pos="9" type="boolean"/>
+			<bitfield name="COLOR_SRGB" pos="10" type="boolean"/>
+		</reg32>
+	</array>
+	<!--
+	e5db/e5dc seems to look related to some optimization to do sample from
+	texture using varying value directly before shader thread starts?  I
+	guess that could optimize common simple frag shaders..
+	 -->
+	<reg32 offset="0xe5db" name="UNKNOWN_E5DB"/>
+	<reg32 offset="0xe5f0" name="SP_CS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe5f2" name="UNKNOWN_E5F2"/>
+	<reg32 offset="0xe5f3" name="SP_CS_OBJ_START_LO"/>
+	<reg32 offset="0xe5f4" name="SP_CS_OBJ_START_HI"/>
+	<reg32 offset="0xe5f5" name="SP_CS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe5f6" name="SP_CS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe5f8" name="SP_CS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+
+	<!-- e5f9 something compute related.. seems to change when HLSQ_CS_CNTL_1 changes -->
+
+	<reg32 offset="0xe600" name="SP_HS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe602" name="UNKNOWN_E602"/>
+	<reg32 offset="0xe603" name="SP_HS_OBJ_START_LO"/>
+	<reg32 offset="0xe604" name="SP_HS_OBJ_START_HI"/>
+	<reg32 offset="0xe605" name="SP_HS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe606" name="SP_HS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe608" name="SP_HS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+	<reg32 offset="0xe610" name="SP_DS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe62b" name="UNKNOWN_E62B"/>
+	<reg32 offset="0xe62c" name="SP_DS_OBJ_START_LO"/>
+	<reg32 offset="0xe62d" name="SP_DS_OBJ_START_HI"/>
+	<reg32 offset="0xe62e" name="SP_DS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe62f" name="SP_DS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe631" name="SP_DS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+	<reg32 offset="0xe640" name="SP_GS_CTRL_REG0" type="a5xx_sp_xs_ctrl_reg0"/>
+	<reg32 offset="0xe65b" name="UNKNOWN_E65B"/>
+	<reg32 offset="0xe65c" name="SP_GS_OBJ_START_LO"/>
+	<reg32 offset="0xe65d" name="SP_GS_OBJ_START_HI"/>
+	<reg32 offset="0xe65e" name="SP_GS_PVT_MEM_PARAM" type="a5xx_sp_xs_pvt_mem_param"/>
+	<reg64 offset="0xe65f" name="SP_GS_PVT_MEM_ADDR" type="waddress" align="32"/>
+	<reg32 offset="0xe661" name="SP_GS_PVT_MEM_SIZE" type="a5xx_sp_xs_pvt_mem_size"/>
+
+	<reg32 offset="0xe704" name="TPL1_TP_RAS_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+	</reg32>
+	<reg32 offset="0xe705" name="TPL1_TP_DEST_MSAA_CNTL">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+	<!-- either blob is doing it wrong, or this is not per-stage anymore: -->
+	<reg32 offset="0xe706" name="TPL1_TP_BORDER_COLOR_BASE_ADDR_LO"/>
+	<reg32 offset="0xe707" name="TPL1_TP_BORDER_COLOR_BASE_ADDR_HI"/>
+
+	<!--
+	so these have the same info that is normally in the CP_LOAD_STATE
+	packets.. not sure if they are normally written by pm4/me or if the
+	CP_LOAD_STATE mechanism is deprecated?
+	 -->
+	<reg32 offset="0xe700" name="TPL1_VS_TEX_COUNT" type="uint"/>
+	<reg32 offset="0xe701" name="TPL1_HS_TEX_COUNT" type="uint"/>
+	<reg32 offset="0xe702" name="TPL1_DS_TEX_COUNT" type="uint"/>
+	<reg32 offset="0xe703" name="TPL1_GS_TEX_COUNT" type="uint"/>
+
+	<reg32 offset="0xe722" name="TPL1_VS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe723" name="TPL1_VS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe724" name="TPL1_HS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe725" name="TPL1_HS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe726" name="TPL1_DS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe727" name="TPL1_DS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe728" name="TPL1_GS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe729" name="TPL1_GS_TEX_SAMP_HI"/>
+
+	<reg32 offset="0xe72a" name="TPL1_VS_TEX_CONST_LO"/>
+	<reg32 offset="0xe72b" name="TPL1_VS_TEX_CONST_HI"/>
+	<reg32 offset="0xe72c" name="TPL1_HS_TEX_CONST_LO"/>
+	<reg32 offset="0xe72d" name="TPL1_HS_TEX_CONST_HI"/>
+	<reg32 offset="0xe72e" name="TPL1_DS_TEX_CONST_LO"/>
+	<reg32 offset="0xe72f" name="TPL1_DS_TEX_CONST_HI"/>
+	<reg32 offset="0xe730" name="TPL1_GS_TEX_CONST_LO"/>
+	<reg32 offset="0xe731" name="TPL1_GS_TEX_CONST_HI"/>
+
+	<reg32 offset="0xe750" name="TPL1_FS_TEX_COUNT" type="uint"/>
+	<reg32 offset="0xe751" name="TPL1_CS_TEX_COUNT" type="uint"/>
+
+	<reg32 offset="0xe75a" name="TPL1_FS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe75b" name="TPL1_FS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe75c" name="TPL1_CS_TEX_SAMP_LO"/>
+	<reg32 offset="0xe75d" name="TPL1_CS_TEX_SAMP_HI"/>
+	<reg32 offset="0xe75e" name="TPL1_FS_TEX_CONST_LO"/>
+	<reg32 offset="0xe75f" name="TPL1_FS_TEX_CONST_HI"/>
+	<reg32 offset="0xe760" name="TPL1_CS_TEX_CONST_LO"/>
+	<reg32 offset="0xe761" name="TPL1_CS_TEX_CONST_HI"/>
+
+	<reg32 offset="0xe764" name="TPL1_TP_FS_ROTATION_CNTL"/>
+
+	<reg32 offset="0xe784" name="HLSQ_CONTROL_0_REG">
+		<!-- 24 or more (full size) GPRS and blob uses TWO_QUADS instead of FOUR_QUADS -->
+		<bitfield name="FSTHREADSIZE" pos="0" type="a3xx_threadsize"/>
+		<bitfield name="CSTHREADSIZE" pos="2" type="a3xx_threadsize"/>
+	</reg32>
+	<reg32 offset="0xe785" name="HLSQ_CONTROL_1_REG">
+		<!-- I guess.. not set exactly same as a4xx, but similar: -->
+		<bitfield name="PRIMALLOCTHRESHOLD" low="0" high="5" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe786" name="HLSQ_CONTROL_2_REG">
+		<bitfield name="FACEREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- SAMPLEID is loaded into a half-precision register: -->
+		<bitfield name="SAMPLEID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="CENTERRHW" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe787" name="HLSQ_CONTROL_3_REG">
+		<!-- register loaded with position (bary.f) -->
+		<bitfield name="IJ_PERSP_PIXEL" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_PIXEL" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="IJ_PERSP_CENTROID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_CENTROID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe788" name="HLSQ_CONTROL_4_REG">
+		<bitfield name="IJ_PERSP_SAMPLE" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="XYCOORDREGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="ZWCOORDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<!--
+	0x020fffff for normal draws, 0x1f00000 for compute.. maybe what state
+	is enabled?  We could probably try disabling different bits and see
+	what breaks to figure out which is what:
+	 -->
+	<reg32 offset="0xe78a" name="HLSQ_UPDATE_CNTL"/>
+	<reg32 offset="0xe78b" name="HLSQ_VS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe78c" name="HLSQ_FS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe78d" name="HLSQ_HS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe78e" name="HLSQ_DS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe78f" name="HLSQ_GS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe790" name="HLSQ_CS_CONFIG" type="a5xx_xs_config"/>
+	<reg32 offset="0xe791" name="HLSQ_VS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe792" name="HLSQ_FS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe793" name="HLSQ_HS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe794" name="HLSQ_DS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe795" name="HLSQ_GS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe796" name="HLSQ_CS_CNTL" type="a5xx_xs_cntl"/>
+	<reg32 offset="0xe7b9" name="HLSQ_CS_KERNEL_GROUP_X"/>
+	<reg32 offset="0xe7ba" name="HLSQ_CS_KERNEL_GROUP_Y"/>
+	<reg32 offset="0xe7bb" name="HLSQ_CS_KERNEL_GROUP_Z"/>
+	<reg32 offset="0xe7b0" name="HLSQ_CS_NDRANGE_0">
+		<bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b1" name="HLSQ_CS_NDRANGE_1">
+		<bitfield name="GLOBALSIZE_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b2" name="HLSQ_CS_NDRANGE_2">
+		<bitfield name="GLOBALOFF_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b3" name="HLSQ_CS_NDRANGE_3">
+		<bitfield name="GLOBALSIZE_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b4" name="HLSQ_CS_NDRANGE_4">
+		<bitfield name="GLOBALOFF_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b5" name="HLSQ_CS_NDRANGE_5">
+		<bitfield name="GLOBALSIZE_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b6" name="HLSQ_CS_NDRANGE_6">
+		<bitfield name="GLOBALOFF_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xe7b7" name="HLSQ_CS_CNTL_0">
+		<bitfield name="WGIDCONSTID" low="0" high="7" type="a3xx_regid"/>
+		<!-- possibly one of these is KERNELDIMCONSTID? -->
+		<!--
+		UNK0 appears to be NUMWGCONSTID.. but only works in certain
+		cases?  Blob doesn't appear to use it, but instead emits
+		these via const (uniform).  Which requires some shenanigans
+		for indirect draws when the offset is not strongly aligned
+		enough to use as EXT_SRC_ADDR in CP_LOAD_STATE
+		 -->
+		<bitfield name="UNK0" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="UNK1" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xe7b8" name="HLSQ_CS_CNTL_1"/>
+	<reg32 offset="0xe7c0" name="UNKNOWN_E7C0"/>
+	<reg32 offset="0xe7c3" name="HLSQ_VS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7c4" name="HLSQ_VS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7c5" name="UNKNOWN_E7C5"/>
+	<reg32 offset="0xe7c8" name="HLSQ_HS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7c9" name="HLSQ_HS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7ca" name="UNKNOWN_E7CA"/>
+	<reg32 offset="0xe7cd" name="HLSQ_DS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7ce" name="HLSQ_DS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7cf" name="UNKNOWN_E7CF"/>
+	<reg32 offset="0xe7d2" name="HLSQ_GS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7d3" name="HLSQ_GS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7d4" name="UNKNOWN_E7D4"/>
+	<reg32 offset="0xe7d7" name="HLSQ_FS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7d8" name="HLSQ_FS_INSTRLEN" type="uint"/>
+	<reg32 offset="0xe7d9" name="UNKNOWN_E7D9"/>
+	<reg32 offset="0xe7dc" name="HLSQ_CS_CONSTLEN" type="uint"/>
+	<reg32 offset="0xe7dd" name="HLSQ_CS_INSTRLEN" type="uint"/>
+
+	<!--
+		Separate blit/2d or dma engine?  Seems to get used sometimes for
+		texture uploads, where a4xx blob would use normal draws.  Used
+		in render-mode 0x5..
+
+		Note seems mostly to be used for small blits, large blits seem
+		to use the CP_EVENT_WRITE:BLIT style of doing things.  See
+		cubemap-0003 (40x40) vs cubemap-0004 (256x256).
+
+		see cube-0000, cubemap-(1..3 but not 4+), quad-textured-10..17
+
+		Other nearby registers are probably color formats, etc.  The
+		blit coords are in CP packet.  Play more w/ glTexSubImage2D()
+		to work it out.
+
+		Separate this into a different domain??  Would that help to
+		restrict which registers we dump based on mode?
+
+		regs 0x2000 to 0x2004 (plus all-zero regs 0x2005-0x2009) look
+		like 2nd source for blending?  Used in mipmap generation.. but
+		maybe layout is a bit different.  (Possibly used for reading
+		src via sampler, to enable scaling??)  0x2040 also used in this
+		case.
+	 -->
+	<reg32 offset="0x2100" name="RB_2D_BLIT_CNTL"/>  <!-- same as 0x2180 -->
+	<reg32 offset="0x2101" name="RB_2D_SRC_SOLID_DW0"/>
+	<reg32 offset="0x2102" name="RB_2D_SRC_SOLID_DW1"/>
+	<reg32 offset="0x2103" name="RB_2D_SRC_SOLID_DW2"/>
+	<reg32 offset="0x2104" name="RB_2D_SRC_SOLID_DW3"/>
+
+	<bitset name="a5xx_2d_surf_info" inline="yes">
+		<bitfield name="COLOR_FORMAT" low="0" high="7" type="a5xx_color_fmt"/>
+		<bitfield name="TILE_MODE" low="8" high="9" type="a5xx_tile_mode"/>
+		<bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+		<!-- b12 seems to be set when UBWC "FLAGS" buffer enabled -->
+		<bitfield name="FLAGS" pos="12" type="boolean"/>
+		<bitfield name="SRGB" pos="13" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x2107" name="RB_2D_SRC_INFO" type="a5xx_2d_surf_info"/>
+	<reg32 offset="0x2108" name="RB_2D_SRC_LO"/>
+	<reg32 offset="0x2109" name="RB_2D_SRC_HI"/>
+	<reg32 offset="0x210a" name="RB_2D_SRC_SIZE">
+		<bitfield name="PITCH" low="0" high="15" shr="6" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="16" high="31" shr="6" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x2110" name="RB_2D_DST_INFO" type="a5xx_2d_surf_info"/>
+	<reg32 offset="0x2111" name="RB_2D_DST_LO"/>
+	<reg32 offset="0x2112" name="RB_2D_DST_HI"/>
+	<reg32 offset="0x2113" name="RB_2D_DST_SIZE">
+		<bitfield name="PITCH" low="0" high="15" shr="6" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="16" high="31" shr="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x2140" name="RB_2D_SRC_FLAGS_LO"/>
+	<reg32 offset="0x2141" name="RB_2D_SRC_FLAGS_HI"/>
+        <reg32 offset="0x2142" name="RB_2D_SRC_FLAGS_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0x2143" name="RB_2D_DST_FLAGS_LO"/>
+	<reg32 offset="0x2144" name="RB_2D_DST_FLAGS_HI"/>
+        <reg32 offset="0x2145" name="RB_2D_DST_FLAGS_PITCH" shr="6" type="uint"/>
+	<reg32 offset="0x2180" name="GRAS_2D_BLIT_CNTL"/> <!-- same as 0x2100 -->
+	<!-- looks same as 0x2107: -->
+	<reg32 offset="0x2181" name="GRAS_2D_SRC_INFO" type="a5xx_2d_surf_info"/>
+	<!-- looks same as 0x2110: -->
+	<reg32 offset="0x2182" name="GRAS_2D_DST_INFO" type="a5xx_2d_surf_info"/>
+<!--
+0x2100 and 0x2180 look like same thing (RB and GRAS versions)..
+   0x86000000 for copy, 0x00000000 for fill?
+
+0x2184 0x9 for copy, 0x1 for blit (maybe bitmask of enabled src/dst???)
+ -->
+	<reg32 offset="0x2184" name="UNKNOWN_2184"/>
+</domain>
+
+<domain name="A5XX_TEX_SAMP" width="32">
+	<doc>Texture sampler dwords</doc>
+	<enum name="a5xx_tex_filter"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_NEAREST" value="0"/>
+		<value name="A5XX_TEX_LINEAR" value="1"/>
+		<value name="A5XX_TEX_ANISO" value="2"/>
+	</enum>
+	<enum name="a5xx_tex_clamp"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_REPEAT" value="0"/>
+		<value name="A5XX_TEX_CLAMP_TO_EDGE" value="1"/>
+		<value name="A5XX_TEX_MIRROR_REPEAT" value="2"/>
+		<value name="A5XX_TEX_CLAMP_TO_BORDER" value="3"/>
+		<value name="A5XX_TEX_MIRROR_CLAMP" value="4"/>
+	</enum>
+	<enum name="a5xx_tex_aniso"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_ANISO_1" value="0"/>
+		<value name="A5XX_TEX_ANISO_2" value="1"/>
+		<value name="A5XX_TEX_ANISO_4" value="2"/>
+		<value name="A5XX_TEX_ANISO_8" value="3"/>
+		<value name="A5XX_TEX_ANISO_16" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="MIPFILTER_LINEAR_NEAR" pos="0" type="boolean"/>
+		<bitfield name="XY_MAG" low="1" high="2" type="a5xx_tex_filter"/>
+		<bitfield name="XY_MIN" low="3" high="4" type="a5xx_tex_filter"/>
+		<bitfield name="WRAP_S" low="5" high="7" type="a5xx_tex_clamp"/>
+		<bitfield name="WRAP_T" low="8" high="10" type="a5xx_tex_clamp"/>
+		<bitfield name="WRAP_R" low="11" high="13" type="a5xx_tex_clamp"/>
+		<bitfield name="ANISO" low="14" high="16" type="a5xx_tex_aniso"/>
+		<bitfield name="LOD_BIAS" low="19" high="31" type="fixed" radix="8"/><!-- no idea how many bits for real -->
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="COMPARE_FUNC" low="1" high="3" type="adreno_compare_func"/>
+		<bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="4" type="boolean"/>
+		<bitfield name="UNNORM_COORDS" pos="5" type="boolean"/>
+		<bitfield name="MIPFILTER_LINEAR_FAR" pos="6" type="boolean"/>
+		<bitfield name="MAX_LOD" low="8" high="19" type="ufixed" radix="8"/>
+		<bitfield name="MIN_LOD" low="20" high="31" type="ufixed" radix="8"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<!--
+		offset into border-color buffer?  Blob always uses 0x80 for FS state
+		if both VS and FS have border-color.
+Seems like when both VS and FS have bcolor, one starts 0x300 after other..
+and 0x80 in TEX_SAMP.2 ..  blob doesn't seem to be able to cope w/ multiple
+different border-color states per texture..  Looks something like:
+0000: 3f000000 00000000 00000000 3f800000 00008000 ffff0000 00004000 7fff0000
+0020: 00003800 3c000000 80100010 0000f008 ff000080 7f000040 c0000200 00800000
+0040: 00003800 3c000000 00000000 00000000 00000000 00000000 00000000 00000000
+*
+0300: 3f800000 3f800000 3f800000 3f800000 ffffffff ffffffff 7fff7fff 7fff7fff
+0320: 3c003c00 3c003c00 ffffffff 0000ffff ffffffff 7f7f7f7f ffffffff 00ffffff
+0340: 3c003c00 3c003c00 00000000 00000000 00000000 00000000 00000000 00000000
+
+		 -->
+		<bitfield name="BCOLOR_OFFSET" low="7" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3"/>
+</domain>
+
+<domain name="A5XX_TEX_CONST" width="32">
+	<doc>Texture constant dwords</doc>
+	<enum name="a5xx_tex_swiz"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_X" value="0"/>
+		<value name="A5XX_TEX_Y" value="1"/>
+		<value name="A5XX_TEX_Z" value="2"/>
+		<value name="A5XX_TEX_W" value="3"/>
+		<value name="A5XX_TEX_ZERO" value="4"/>
+		<value name="A5XX_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="a5xx_tex_type"> <!-- same as a4xx? -->
+		<value name="A5XX_TEX_1D" value="0"/>
+		<value name="A5XX_TEX_2D" value="1"/>
+		<value name="A5XX_TEX_CUBE" value="2"/>
+		<value name="A5XX_TEX_3D" value="3"/>
+		<value name="A5XX_TEX_BUFFER" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TILE_MODE" low="0" high="1" type="a5xx_tile_mode"/>
+		<bitfield name="SRGB" pos="2" type="boolean"/>
+		<bitfield name="SWIZ_X" low="4" high="6" type="a5xx_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="7" high="9" type="a5xx_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="10" high="12" type="a5xx_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="13" high="15" type="a5xx_tex_swiz"/>
+		<bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
+		<bitfield name="SAMPLES" low="20" high="21" type="a3xx_msaa_samples"/>
+		<bitfield name="FMT" low="22" high="29" type="a5xx_tex_fmt"/>
+		<bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="WIDTH" low="0" high="14" type="uint"/>
+		<bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<!--
+		b4 and b31 set for buffer/ssbo case, in which case low 15 bits
+		of size encoded in WIDTH, and high 15 bits encoded in HEIGHT
+
+		b31 is probably the 'BUFFER' bit.. it is the one that changes
+		behavior of texture in dEQP-GLES31.functional.texture.texture_buffer.render.as_fragment_texture.buffer_size_131071
+		 -->
+		<bitfield name="BUFFER" pos="4" type="boolean"/>
+		<!-- minimum pitch (for mipmap levels): log2(pitchalign / 64) -->
+		<bitfield name="PITCHALIGN" low="0" high="3" type="uint"/>
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="7" high="28" type="uint"/>
+		<bitfield name="TYPE" low="29" high="31" type="a5xx_tex_type"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!--
+		ARRAY_PITCH is basically LAYERSZ for the first mipmap level, and
+		for 3d textures (laid out mipmap level first) MIN_LAYERSZ is the
+		layer size at the point that it stops being reduced moving to
+		higher (smaller) mipmap levels
+		 -->
+		<bitfield name="ARRAY_PITCH" low="0" high="13" shr="12" type="uint"/>
+		<bitfield name="MIN_LAYERSZ" low="23" high="26" shr="12"/>
+		<!--
+		by default levels with w < 16 are linear
+		TILE_ALL makes all levels have tiling
+		seems required when using UBWC, since all levels have UBWC (can possibly be disabled?)
+		 -->
+		<bitfield name="TILE_ALL" pos="27" type="boolean"/>
+		<bitfield name="FLAG" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="BASE_LO" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="BASE_HI" low="0" high="16"/>
+		<bitfield name="DEPTH" low="17" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="6" name="6"/>
+	<reg32 offset="7" name="7"/>
+	<reg32 offset="8" name="8"/>
+	<reg32 offset="9" name="9"/>
+	<reg32 offset="10" name="10"/>
+	<reg32 offset="11" name="11"/>
+</domain>
+
+<!--
+Note the "SSBO" state blocks are actually used for both images and SSBOs,
+naming is just because I r/e'd SSBOs first.  I should probably come up
+with a better name.
+-->
+<domain name="A5XX_SSBO_0" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE_LO" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<!-- no BASE_HI here?  Maybe this is only used for 32b mode? -->
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="0" high="21" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ARRAY_PITCH" low="12" high="25" shr="12" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!-- bytes per pixel: -->
+		<bitfield name="CPP" low="0" high="5" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="A5XX_SSBO_1" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="FMT" low="8" high="15" type="a5xx_tex_fmt"/>
+		<bitfield name="WIDTH" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="HEIGHT" low="0" high="15" type="uint"/>
+		<bitfield name="DEPTH" low="16" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="A5XX_SSBO_2" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="BASE_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="A5XX_UBO" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="BASE_HI" low="0" high="16"/>
+		<!-- size probably in high bits -->
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/adreno/a6xx.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/adreno/a6xx.xml
@@ -0,0 +1,6092 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+<import file="adreno/adreno_pm4.xml"/>
+
+<!--
+Each register that is actually being used by driver should have "usage" defined,
+currently there are following usages:
+- "cmd" - the register is used outside of renderpass and blits,
+		roughly corresponds to registers used in ib1 for Freedreno
+- "rp_blit" - the register is used inside renderpass or blits
+		(ib2 for Freedreno)
+
+It is expected that register with "cmd" usage may be written into only at
+the start of the command buffer (ib1), while "rp_blit" usage indicates that register
+is either overwritten by renderpass/blit (ib2) or not used if not overwritten
+by a particular renderpass/blit.
+-->
+
+<!-- these might be same as a5xx -->
+<enum name="a6xx_tile_mode">
+	<value name="TILE6_LINEAR" value="0"/>
+	<value name="TILE6_2" value="2"/>
+	<value name="TILE6_3" value="3"/>
+</enum>
+
+<enum name="a6xx_format">
+	<value value="0x02" name="FMT6_A8_UNORM"/>
+	<value value="0x03" name="FMT6_8_UNORM"/>
+	<value value="0x04" name="FMT6_8_SNORM"/>
+	<value value="0x05" name="FMT6_8_UINT"/>
+	<value value="0x06" name="FMT6_8_SINT"/>
+
+	<value value="0x08" name="FMT6_4_4_4_4_UNORM"/>
+	<value value="0x0a" name="FMT6_5_5_5_1_UNORM"/>
+	<value value="0x0c" name="FMT6_1_5_5_5_UNORM"/> <!-- read only -->
+	<value value="0x0e" name="FMT6_5_6_5_UNORM"/>
+
+	<value value="0x0f" name="FMT6_8_8_UNORM"/>
+	<value value="0x10" name="FMT6_8_8_SNORM"/>
+	<value value="0x11" name="FMT6_8_8_UINT"/>
+	<value value="0x12" name="FMT6_8_8_SINT"/>
+	<value value="0x13" name="FMT6_L8_A8_UNORM"/>
+
+	<value value="0x15" name="FMT6_16_UNORM"/>
+	<value value="0x16" name="FMT6_16_SNORM"/>
+	<value value="0x17" name="FMT6_16_FLOAT"/>
+	<value value="0x18" name="FMT6_16_UINT"/>
+	<value value="0x19" name="FMT6_16_SINT"/>
+
+	<value value="0x21" name="FMT6_8_8_8_UNORM"/>
+	<value value="0x22" name="FMT6_8_8_8_SNORM"/>
+	<value value="0x23" name="FMT6_8_8_8_UINT"/>
+	<value value="0x24" name="FMT6_8_8_8_SINT"/>
+
+	<value value="0x30" name="FMT6_8_8_8_8_UNORM"/>
+	<value value="0x31" name="FMT6_8_8_8_X8_UNORM"/> <!-- samples 1 for alpha -->
+	<value value="0x32" name="FMT6_8_8_8_8_SNORM"/>
+	<value value="0x33" name="FMT6_8_8_8_8_UINT"/>
+	<value value="0x34" name="FMT6_8_8_8_8_SINT"/>
+
+	<value value="0x35" name="FMT6_9_9_9_E5_FLOAT"/>
+
+	<value value="0x36" name="FMT6_10_10_10_2_UNORM"/>
+	<value value="0x37" name="FMT6_10_10_10_2_UNORM_DEST"/>
+	<value value="0x39" name="FMT6_10_10_10_2_SNORM"/>
+	<value value="0x3a" name="FMT6_10_10_10_2_UINT"/>
+	<value value="0x3b" name="FMT6_10_10_10_2_SINT"/>
+
+	<value value="0x42" name="FMT6_11_11_10_FLOAT"/>
+
+	<value value="0x43" name="FMT6_16_16_UNORM"/>
+	<value value="0x44" name="FMT6_16_16_SNORM"/>
+	<value value="0x45" name="FMT6_16_16_FLOAT"/>
+	<value value="0x46" name="FMT6_16_16_UINT"/>
+	<value value="0x47" name="FMT6_16_16_SINT"/>
+
+	<value value="0x48" name="FMT6_32_UNORM"/>
+	<value value="0x49" name="FMT6_32_SNORM"/>
+	<value value="0x4a" name="FMT6_32_FLOAT"/>
+	<value value="0x4b" name="FMT6_32_UINT"/>
+	<value value="0x4c" name="FMT6_32_SINT"/>
+	<value value="0x4d" name="FMT6_32_FIXED"/>
+
+	<value value="0x58" name="FMT6_16_16_16_UNORM"/>
+	<value value="0x59" name="FMT6_16_16_16_SNORM"/>
+	<value value="0x5a" name="FMT6_16_16_16_FLOAT"/>
+	<value value="0x5b" name="FMT6_16_16_16_UINT"/>
+	<value value="0x5c" name="FMT6_16_16_16_SINT"/>
+
+	<value value="0x60" name="FMT6_16_16_16_16_UNORM"/>
+	<value value="0x61" name="FMT6_16_16_16_16_SNORM"/>
+	<value value="0x62" name="FMT6_16_16_16_16_FLOAT"/>
+	<value value="0x63" name="FMT6_16_16_16_16_UINT"/>
+	<value value="0x64" name="FMT6_16_16_16_16_SINT"/>
+
+	<value value="0x65" name="FMT6_32_32_UNORM"/>
+	<value value="0x66" name="FMT6_32_32_SNORM"/>
+	<value value="0x67" name="FMT6_32_32_FLOAT"/>
+	<value value="0x68" name="FMT6_32_32_UINT"/>
+	<value value="0x69" name="FMT6_32_32_SINT"/>
+	<value value="0x6a" name="FMT6_32_32_FIXED"/>
+
+	<value value="0x70" name="FMT6_32_32_32_UNORM"/>
+	<value value="0x71" name="FMT6_32_32_32_SNORM"/>
+	<value value="0x72" name="FMT6_32_32_32_UINT"/>
+	<value value="0x73" name="FMT6_32_32_32_SINT"/>
+	<value value="0x74" name="FMT6_32_32_32_FLOAT"/>
+	<value value="0x75" name="FMT6_32_32_32_FIXED"/>
+
+	<value value="0x80" name="FMT6_32_32_32_32_UNORM"/>
+	<value value="0x81" name="FMT6_32_32_32_32_SNORM"/>
+	<value value="0x82" name="FMT6_32_32_32_32_FLOAT"/>
+	<value value="0x83" name="FMT6_32_32_32_32_UINT"/>
+	<value value="0x84" name="FMT6_32_32_32_32_SINT"/>
+	<value value="0x85" name="FMT6_32_32_32_32_FIXED"/>
+
+	<value value="0x8c" name="FMT6_G8R8B8R8_422_UNORM"/> <!-- UYVY -->
+	<value value="0x8d" name="FMT6_R8G8R8B8_422_UNORM"/> <!-- YUYV -->
+	<value value="0x8e" name="FMT6_R8_G8B8_2PLANE_420_UNORM"/> <!-- NV12 -->
+	<value value="0x8f" name="FMT6_NV21"/>
+	<value value="0x90" name="FMT6_R8_G8_B8_3PLANE_420_UNORM"/> <!-- YV12 -->
+
+	<value value="0x91" name="FMT6_Z24_UNORM_S8_UINT_AS_R8G8B8A8"/>
+
+	<!-- Note: tiling/UBWC for these may be different from equivalent formats
+	For example FMT6_NV12_Y is not compatible with FMT6_8_UNORM
+	-->
+	<value value="0x94" name="FMT6_NV12_Y"/>
+	<value value="0x95" name="FMT6_NV12_UV"/>
+	<value value="0x96" name="FMT6_NV12_VU"/>
+	<value value="0x97" name="FMT6_NV12_4R"/>
+	<value value="0x98" name="FMT6_NV12_4R_Y"/>
+	<value value="0x99" name="FMT6_NV12_4R_UV"/>
+	<value value="0x9a" name="FMT6_P010"/>
+	<value value="0x9b" name="FMT6_P010_Y"/>
+	<value value="0x9c" name="FMT6_P010_UV"/>
+	<value value="0x9d" name="FMT6_TP10"/>
+	<value value="0x9e" name="FMT6_TP10_Y"/>
+	<value value="0x9f" name="FMT6_TP10_UV"/>
+
+	<value value="0xa0" name="FMT6_Z24_UNORM_S8_UINT"/>
+
+	<value value="0xab" name="FMT6_ETC2_RG11_UNORM"/>
+	<value value="0xac" name="FMT6_ETC2_RG11_SNORM"/>
+	<value value="0xad" name="FMT6_ETC2_R11_UNORM"/>
+	<value value="0xae" name="FMT6_ETC2_R11_SNORM"/>
+	<value value="0xaf" name="FMT6_ETC1"/>
+	<value value="0xb0" name="FMT6_ETC2_RGB8"/>
+	<value value="0xb1" name="FMT6_ETC2_RGBA8"/>
+	<value value="0xb2" name="FMT6_ETC2_RGB8A1"/>
+	<value value="0xb3" name="FMT6_DXT1"/>
+	<value value="0xb4" name="FMT6_DXT3"/>
+	<value value="0xb5" name="FMT6_DXT5"/>
+	<value value="0xb7" name="FMT6_RGTC1_UNORM"/>
+	<value value="0xb8" name="FMT6_RGTC1_SNORM"/>
+	<value value="0xbb" name="FMT6_RGTC2_UNORM"/>
+	<value value="0xbc" name="FMT6_RGTC2_SNORM"/>
+	<value value="0xbe" name="FMT6_BPTC_UFLOAT"/>
+	<value value="0xbf" name="FMT6_BPTC_FLOAT"/>
+	<value value="0xc0" name="FMT6_BPTC"/>
+	<value value="0xc1" name="FMT6_ASTC_4x4"/>
+	<value value="0xc2" name="FMT6_ASTC_5x4"/>
+	<value value="0xc3" name="FMT6_ASTC_5x5"/>
+	<value value="0xc4" name="FMT6_ASTC_6x5"/>
+	<value value="0xc5" name="FMT6_ASTC_6x6"/>
+	<value value="0xc6" name="FMT6_ASTC_8x5"/>
+	<value value="0xc7" name="FMT6_ASTC_8x6"/>
+	<value value="0xc8" name="FMT6_ASTC_8x8"/>
+	<value value="0xc9" name="FMT6_ASTC_10x5"/>
+	<value value="0xca" name="FMT6_ASTC_10x6"/>
+	<value value="0xcb" name="FMT6_ASTC_10x8"/>
+	<value value="0xcc" name="FMT6_ASTC_10x10"/>
+	<value value="0xcd" name="FMT6_ASTC_12x10"/>
+	<value value="0xce" name="FMT6_ASTC_12x12"/>
+
+	<!-- for sampling stencil (integer, 2nd channel), not available on a630 -->
+	<value value="0xea" name="FMT6_Z24_UINT_S8_UINT"/>
+
+	<!-- Not a hw enum, used internally in driver -->
+	<value value="0xff" name="FMT6_NONE"/>
+
+</enum>
+
+<!-- probably same as a5xx -->
+<enum name="a6xx_polygon_mode">
+	<value name="POLYMODE6_POINTS" value="1"/>
+	<value name="POLYMODE6_LINES" value="2"/>
+	<value name="POLYMODE6_TRIANGLES" value="3"/>
+</enum>
+
+<enum name="a6xx_depth_format">
+	<value name="DEPTH6_NONE" value="0"/>
+	<value name="DEPTH6_16" value="1"/>
+	<value name="DEPTH6_24_8" value="2"/>
+	<value name="DEPTH6_32" value="4"/>
+</enum>
+
+<bitset name="a6x_cp_protect" inline="yes">
+	<bitfield name="BASE_ADDR" low="0" high="17"/>
+	<bitfield name="MASK_LEN" low="18" high="30"/>
+	<bitfield name="READ" pos="31" type="boolean"/>
+</bitset>
+
+<enum name="a6xx_shader_id">
+	<value value="0x9" name="A6XX_TP0_TMO_DATA"/>
+	<value value="0xa" name="A6XX_TP0_SMO_DATA"/>
+	<value value="0xb" name="A6XX_TP0_MIPMAP_BASE_DATA"/>
+	<value value="0x19" name="A6XX_TP1_TMO_DATA"/>
+	<value value="0x1a" name="A6XX_TP1_SMO_DATA"/>
+	<value value="0x1b" name="A6XX_TP1_MIPMAP_BASE_DATA"/>
+	<value value="0x29" name="A6XX_SP_INST_DATA"/>
+	<value value="0x2a" name="A6XX_SP_LB_0_DATA"/>
+	<value value="0x2b" name="A6XX_SP_LB_1_DATA"/>
+	<value value="0x2c" name="A6XX_SP_LB_2_DATA"/>
+	<value value="0x2d" name="A6XX_SP_LB_3_DATA"/>
+	<value value="0x2e" name="A6XX_SP_LB_4_DATA"/>
+	<value value="0x2f" name="A6XX_SP_LB_5_DATA"/>
+	<value value="0x30" name="A6XX_SP_CB_BINDLESS_DATA"/>
+	<value value="0x31" name="A6XX_SP_CB_LEGACY_DATA"/>
+	<value value="0x32" name="A6XX_SP_UAV_DATA"/>
+	<value value="0x33" name="A6XX_SP_INST_TAG"/>
+	<value value="0x34" name="A6XX_SP_CB_BINDLESS_TAG"/>
+	<value value="0x35" name="A6XX_SP_TMO_UMO_TAG"/>
+	<value value="0x36" name="A6XX_SP_SMO_TAG"/>
+	<value value="0x37" name="A6XX_SP_STATE_DATA"/>
+	<value value="0x49" name="A6XX_HLSQ_CHUNK_CVS_RAM"/>
+	<value value="0x4a" name="A6XX_HLSQ_CHUNK_CPS_RAM"/>
+	<value value="0x4b" name="A6XX_HLSQ_CHUNK_CVS_RAM_TAG"/>
+	<value value="0x4c" name="A6XX_HLSQ_CHUNK_CPS_RAM_TAG"/>
+	<value value="0x4d" name="A6XX_HLSQ_ICB_CVS_CB_BASE_TAG"/>
+	<value value="0x4e" name="A6XX_HLSQ_ICB_CPS_CB_BASE_TAG"/>
+	<value value="0x50" name="A6XX_HLSQ_CVS_MISC_RAM"/>
+	<value value="0x51" name="A6XX_HLSQ_CPS_MISC_RAM"/>
+	<value value="0x52" name="A6XX_HLSQ_INST_RAM"/>
+	<value value="0x53" name="A6XX_HLSQ_GFX_CVS_CONST_RAM"/>
+	<value value="0x54" name="A6XX_HLSQ_GFX_CPS_CONST_RAM"/>
+	<value value="0x55" name="A6XX_HLSQ_CVS_MISC_RAM_TAG"/>
+	<value value="0x56" name="A6XX_HLSQ_CPS_MISC_RAM_TAG"/>
+	<value value="0x57" name="A6XX_HLSQ_INST_RAM_TAG"/>
+	<value value="0x58" name="A6XX_HLSQ_GFX_CVS_CONST_RAM_TAG"/>
+	<value value="0x59" name="A6XX_HLSQ_GFX_CPS_CONST_RAM_TAG"/>
+	<value value="0x5a" name="A6XX_HLSQ_PWR_REST_RAM"/>
+	<value value="0x5b" name="A6XX_HLSQ_PWR_REST_TAG"/>
+	<value value="0x60" name="A6XX_HLSQ_DATAPATH_META"/>
+	<value value="0x61" name="A6XX_HLSQ_FRONTEND_META"/>
+	<value value="0x62" name="A6XX_HLSQ_INDIRECT_META"/>
+	<value value="0x63" name="A6XX_HLSQ_BACKEND_META"/>
+	<value value="0x70" name="A6XX_SP_LB_6_DATA"/>
+	<value value="0x71" name="A6XX_SP_LB_7_DATA"/>
+	<value value="0x73" name="A6XX_HLSQ_INST_RAM_1"/>
+</enum>
+
+<enum name="a7xx_statetype_id">
+	<value value="0" name="A7XX_TP0_NCTX_REG"/>
+	<value value="1" name="A7XX_TP0_CTX0_3D_CVS_REG"/>
+	<value value="2" name="A7XX_TP0_CTX0_3D_CPS_REG"/>
+	<value value="3" name="A7XX_TP0_CTX1_3D_CVS_REG"/>
+	<value value="4" name="A7XX_TP0_CTX1_3D_CPS_REG"/>
+	<value value="5" name="A7XX_TP0_CTX2_3D_CPS_REG"/>
+	<value value="6" name="A7XX_TP0_CTX3_3D_CPS_REG"/>
+	<value value="9" name="A7XX_TP0_TMO_DATA"/>
+	<value value="10" name="A7XX_TP0_SMO_DATA"/>
+	<value value="11" name="A7XX_TP0_MIPMAP_BASE_DATA"/>
+	<value value="32" name="A7XX_SP_NCTX_REG"/>
+	<value value="33" name="A7XX_SP_CTX0_3D_CVS_REG"/>
+	<value value="34" name="A7XX_SP_CTX0_3D_CPS_REG"/>
+	<value value="35" name="A7XX_SP_CTX1_3D_CVS_REG"/>
+	<value value="36" name="A7XX_SP_CTX1_3D_CPS_REG"/>
+	<value value="37" name="A7XX_SP_CTX2_3D_CPS_REG"/>
+	<value value="38" name="A7XX_SP_CTX3_3D_CPS_REG"/>
+	<value value="39" name="A7XX_SP_INST_DATA"/>
+	<value value="40" name="A7XX_SP_INST_DATA_1"/>
+	<value value="41" name="A7XX_SP_LB_0_DATA"/>
+	<value value="42" name="A7XX_SP_LB_1_DATA"/>
+	<value value="43" name="A7XX_SP_LB_2_DATA"/>
+	<value value="44" name="A7XX_SP_LB_3_DATA"/>
+	<value value="45" name="A7XX_SP_LB_4_DATA"/>
+	<value value="46" name="A7XX_SP_LB_5_DATA"/>
+	<value value="47" name="A7XX_SP_LB_6_DATA"/>
+	<value value="48" name="A7XX_SP_LB_7_DATA"/>
+	<value value="49" name="A7XX_SP_CB_RAM"/>
+	<value value="50" name="A7XX_SP_LB_13_DATA"/>
+	<value value="51" name="A7XX_SP_LB_14_DATA"/>
+	<value value="52" name="A7XX_SP_INST_TAG"/>
+	<value value="53" name="A7XX_SP_INST_DATA_2"/>
+	<value value="54" name="A7XX_SP_TMO_TAG"/>
+	<value value="55" name="A7XX_SP_SMO_TAG"/>
+	<value value="56" name="A7XX_SP_STATE_DATA"/>
+	<value value="57" name="A7XX_SP_HWAVE_RAM"/>
+	<value value="58" name="A7XX_SP_L0_INST_BUF"/>
+	<value value="59" name="A7XX_SP_LB_8_DATA"/>
+	<value value="60" name="A7XX_SP_LB_9_DATA"/>
+	<value value="61" name="A7XX_SP_LB_10_DATA"/>
+	<value value="62" name="A7XX_SP_LB_11_DATA"/>
+	<value value="63" name="A7XX_SP_LB_12_DATA"/>
+	<value value="64" name="A7XX_HLSQ_DATAPATH_DSTR_META"/>
+	<value value="67" name="A7XX_HLSQ_L2STC_TAG_RAM"/>
+	<value value="68" name="A7XX_HLSQ_L2STC_INFO_CMD"/>
+	<value value="69" name="A7XX_HLSQ_CVS_BE_CTXT_BUF_RAM_TAG"/>
+	<value value="70" name="A7XX_HLSQ_CPS_BE_CTXT_BUF_RAM_TAG"/>
+	<value value="71" name="A7XX_HLSQ_GFX_CVS_BE_CTXT_BUF_RAM"/>
+	<value value="72" name="A7XX_HLSQ_GFX_CPS_BE_CTXT_BUF_RAM"/>
+	<value value="73" name="A7XX_HLSQ_CHUNK_CVS_RAM"/>
+	<value value="74" name="A7XX_HLSQ_CHUNK_CPS_RAM"/>
+	<value value="75" name="A7XX_HLSQ_CHUNK_CVS_RAM_TAG"/>
+	<value value="76" name="A7XX_HLSQ_CHUNK_CPS_RAM_TAG"/>
+	<value value="77" name="A7XX_HLSQ_ICB_CVS_CB_BASE_TAG"/>
+	<value value="78" name="A7XX_HLSQ_ICB_CPS_CB_BASE_TAG"/>
+	<value value="79" name="A7XX_HLSQ_CVS_MISC_RAM"/>
+	<value value="80" name="A7XX_HLSQ_CPS_MISC_RAM"/>
+	<value value="81" name="A7XX_HLSQ_CPS_MISC_RAM_1"/>
+	<value value="82" name="A7XX_HLSQ_INST_RAM"/>
+	<value value="83" name="A7XX_HLSQ_GFX_CVS_CONST_RAM"/>
+	<value value="84" name="A7XX_HLSQ_GFX_CPS_CONST_RAM"/>
+	<value value="85" name="A7XX_HLSQ_CVS_MISC_RAM_TAG"/>
+	<value value="86" name="A7XX_HLSQ_CPS_MISC_RAM_TAG"/>
+	<value value="87" name="A7XX_HLSQ_INST_RAM_TAG"/>
+	<value value="88" name="A7XX_HLSQ_GFX_CVS_CONST_RAM_TAG"/>
+	<value value="89" name="A7XX_HLSQ_GFX_CPS_CONST_RAM_TAG"/>
+	<value value="90" name="A7XX_HLSQ_GFX_LOCAL_MISC_RAM"/>
+	<value value="91" name="A7XX_HLSQ_GFX_LOCAL_MISC_RAM_TAG"/>
+	<value value="92" name="A7XX_HLSQ_INST_RAM_1"/>
+	<value value="93" name="A7XX_HLSQ_STPROC_META"/>
+	<value value="94" name="A7XX_HLSQ_BV_BE_META"/>
+	<value value="95" name="A7XX_HLSQ_INST_RAM_2"/>
+	<value value="96" name="A7XX_HLSQ_DATAPATH_META"/>
+	<value value="97" name="A7XX_HLSQ_FRONTEND_META"/>
+	<value value="98" name="A7XX_HLSQ_INDIRECT_META"/>
+	<value value="99" name="A7XX_HLSQ_BACKEND_META"/>
+</enum>
+
+<enum name="a6xx_debugbus_id">
+	<value value="0x1" name="A6XX_DBGBUS_CP"/>
+	<value value="0x2" name="A6XX_DBGBUS_RBBM"/>
+	<value value="0x3" name="A6XX_DBGBUS_VBIF"/>
+	<value value="0x4" name="A6XX_DBGBUS_HLSQ"/>
+	<value value="0x5" name="A6XX_DBGBUS_UCHE"/>
+	<value value="0x6" name="A6XX_DBGBUS_DPM"/>
+	<value value="0x7" name="A6XX_DBGBUS_TESS"/>
+	<value value="0x8" name="A6XX_DBGBUS_PC"/>
+	<value value="0x9" name="A6XX_DBGBUS_VFDP"/>
+	<value value="0xa" name="A6XX_DBGBUS_VPC"/>
+	<value value="0xb" name="A6XX_DBGBUS_TSE"/>
+	<value value="0xc" name="A6XX_DBGBUS_RAS"/>
+	<value value="0xd" name="A6XX_DBGBUS_VSC"/>
+	<value value="0xe" name="A6XX_DBGBUS_COM"/>
+	<value value="0x10" name="A6XX_DBGBUS_LRZ"/>
+	<value value="0x11" name="A6XX_DBGBUS_A2D"/>
+	<value value="0x12" name="A6XX_DBGBUS_CCUFCHE"/>
+	<value value="0x13" name="A6XX_DBGBUS_GMU_CX"/>
+	<value value="0x14" name="A6XX_DBGBUS_RBP"/>
+	<value value="0x15" name="A6XX_DBGBUS_DCS"/>
+	<value value="0x16" name="A6XX_DBGBUS_DBGC"/>
+	<value value="0x17" name="A6XX_DBGBUS_CX"/>
+	<value value="0x18" name="A6XX_DBGBUS_GMU_GX"/>
+	<value value="0x19" name="A6XX_DBGBUS_TPFCHE"/>
+	<value value="0x1a" name="A6XX_DBGBUS_GBIF_GX"/>
+	<value value="0x1d" name="A6XX_DBGBUS_GPC"/>
+	<value value="0x1e" name="A6XX_DBGBUS_LARC"/>
+	<value value="0x1f" name="A6XX_DBGBUS_HLSQ_SPTP"/>
+	<value value="0x20" name="A6XX_DBGBUS_RB_0"/>
+	<value value="0x21" name="A6XX_DBGBUS_RB_1"/>
+	<value value="0x22" name="A6XX_DBGBUS_RB_2"/>
+	<value value="0x24" name="A6XX_DBGBUS_UCHE_WRAPPER"/>
+	<value value="0x28" name="A6XX_DBGBUS_CCU_0"/>
+	<value value="0x29" name="A6XX_DBGBUS_CCU_1"/>
+	<value value="0x2a" name="A6XX_DBGBUS_CCU_2"/>
+	<value value="0x38" name="A6XX_DBGBUS_VFD_0"/>
+	<value value="0x39" name="A6XX_DBGBUS_VFD_1"/>
+	<value value="0x3a" name="A6XX_DBGBUS_VFD_2"/>
+	<value value="0x3b" name="A6XX_DBGBUS_VFD_3"/>
+	<value value="0x3c" name="A6XX_DBGBUS_VFD_4"/>
+	<value value="0x3d" name="A6XX_DBGBUS_VFD_5"/>
+	<value value="0x40" name="A6XX_DBGBUS_SP_0"/>
+	<value value="0x41" name="A6XX_DBGBUS_SP_1"/>
+	<value value="0x42" name="A6XX_DBGBUS_SP_2"/>
+	<value value="0x48" name="A6XX_DBGBUS_TPL1_0"/>
+	<value value="0x49" name="A6XX_DBGBUS_TPL1_1"/>
+	<value value="0x4a" name="A6XX_DBGBUS_TPL1_2"/>
+	<value value="0x4b" name="A6XX_DBGBUS_TPL1_3"/>
+	<value value="0x4c" name="A6XX_DBGBUS_TPL1_4"/>
+	<value value="0x4d" name="A6XX_DBGBUS_TPL1_5"/>
+	<value value="0x58" name="A6XX_DBGBUS_SPTP_0"/>
+	<value value="0x59" name="A6XX_DBGBUS_SPTP_1"/>
+	<value value="0x5a" name="A6XX_DBGBUS_SPTP_2"/>
+	<value value="0x5b" name="A6XX_DBGBUS_SPTP_3"/>
+	<value value="0x5c" name="A6XX_DBGBUS_SPTP_4"/>
+	<value value="0x5d" name="A6XX_DBGBUS_SPTP_5"/>
+</enum>
+
+<enum name="a7xx_state_location">
+	<value value="0" name="A7XX_HLSQ_STATE"/>
+	<value value="1" name="A7XX_HLSQ_DP"/>
+	<value value="2" name="A7XX_SP_TOP"/>
+	<value value="3" name="A7XX_USPTP"/>
+	<value value="4" name="A7XX_HLSQ_DP_STR"/>
+</enum>
+
+<enum name="a7xx_pipe">
+	<value value="0" name="A7XX_PIPE_NONE"/>
+	<value value="1" name="A7XX_PIPE_BR"/>
+	<value value="2" name="A7XX_PIPE_BV"/>
+	<value value="3" name="A7XX_PIPE_LPAC"/>
+</enum>
+
+<enum name="a7xx_cluster">
+	<value value="0" name="A7XX_CLUSTER_NONE"/>
+	<value value="1" name="A7XX_CLUSTER_FE"/>
+	<value value="2" name="A7XX_CLUSTER_SP_VS"/>
+	<value value="3" name="A7XX_CLUSTER_PC_VS"/>
+	<value value="4" name="A7XX_CLUSTER_GRAS"/>
+	<value value="5" name="A7XX_CLUSTER_SP_PS"/>
+	<value value="6" name="A7XX_CLUSTER_VPC_PS"/>
+	<value value="7" name="A7XX_CLUSTER_PS"/>
+</enum>
+
+<enum name="a7xx_debugbus_id">
+	<value value="1" name="A7XX_DBGBUS_CP_0_0"/>
+	<value value="2" name="A7XX_DBGBUS_CP_0_1"/>
+	<value value="3" name="A7XX_DBGBUS_RBBM"/>
+	<value value="5" name="A7XX_DBGBUS_GBIF_GX"/>
+	<value value="6" name="A7XX_DBGBUS_GBIF_CX"/>
+	<value value="7" name="A7XX_DBGBUS_HLSQ"/>
+	<value value="9" name="A7XX_DBGBUS_UCHE_0"/>
+	<value value="10" name="A7XX_DBGBUS_UCHE_1"/>
+	<value value="13" name="A7XX_DBGBUS_TESS_BR"/>
+	<value value="14" name="A7XX_DBGBUS_TESS_BV"/>
+	<value value="17" name="A7XX_DBGBUS_PC_BR"/>
+	<value value="18" name="A7XX_DBGBUS_PC_BV"/>
+	<value value="21" name="A7XX_DBGBUS_VFDP_BR"/>
+	<value value="22" name="A7XX_DBGBUS_VFDP_BV"/>
+	<value value="25" name="A7XX_DBGBUS_VPC_BR"/>
+	<value value="26" name="A7XX_DBGBUS_VPC_BV"/>
+	<value value="29" name="A7XX_DBGBUS_TSE_BR"/>
+	<value value="30" name="A7XX_DBGBUS_TSE_BV"/>
+	<value value="33" name="A7XX_DBGBUS_RAS_BR"/>
+	<value value="34" name="A7XX_DBGBUS_RAS_BV"/>
+	<value value="37" name="A7XX_DBGBUS_VSC"/>
+	<value value="39" name="A7XX_DBGBUS_COM_0"/>
+	<value value="43" name="A7XX_DBGBUS_LRZ_BR"/>
+	<value value="44" name="A7XX_DBGBUS_LRZ_BV"/>
+	<value value="47" name="A7XX_DBGBUS_UFC_0"/>
+	<value value="48" name="A7XX_DBGBUS_UFC_1"/>
+	<value value="55" name="A7XX_DBGBUS_GMU_GX"/>
+	<value value="59" name="A7XX_DBGBUS_DBGC"/>
+	<value value="60" name="A7XX_DBGBUS_CX"/>
+	<value value="61" name="A7XX_DBGBUS_GMU_CX"/>
+	<value value="62" name="A7XX_DBGBUS_GPC_BR"/>
+	<value value="63" name="A7XX_DBGBUS_GPC_BV"/>
+	<value value="66" name="A7XX_DBGBUS_LARC"/>
+	<value value="68" name="A7XX_DBGBUS_HLSQ_SPTP"/>
+	<value value="70" name="A7XX_DBGBUS_RB_0"/>
+	<value value="71" name="A7XX_DBGBUS_RB_1"/>
+	<value value="72" name="A7XX_DBGBUS_RB_2"/>
+	<value value="73" name="A7XX_DBGBUS_RB_3"/>
+	<value value="74" name="A7XX_DBGBUS_RB_4"/>
+	<value value="75" name="A7XX_DBGBUS_RB_5"/>
+	<value value="102" name="A7XX_DBGBUS_UCHE_WRAPPER"/>
+	<value value="106" name="A7XX_DBGBUS_CCU_0"/>
+	<value value="107" name="A7XX_DBGBUS_CCU_1"/>
+	<value value="108" name="A7XX_DBGBUS_CCU_2"/>
+	<value value="109" name="A7XX_DBGBUS_CCU_3"/>
+	<value value="110" name="A7XX_DBGBUS_CCU_4"/>
+	<value value="111" name="A7XX_DBGBUS_CCU_5"/>
+	<value value="138" name="A7XX_DBGBUS_VFD_BR_0"/>
+	<value value="139" name="A7XX_DBGBUS_VFD_BR_1"/>
+	<value value="140" name="A7XX_DBGBUS_VFD_BR_2"/>
+	<value value="141" name="A7XX_DBGBUS_VFD_BR_3"/>
+	<value value="142" name="A7XX_DBGBUS_VFD_BR_4"/>
+	<value value="143" name="A7XX_DBGBUS_VFD_BR_5"/>
+	<value value="144" name="A7XX_DBGBUS_VFD_BR_6"/>
+	<value value="145" name="A7XX_DBGBUS_VFD_BR_7"/>
+	<value value="202" name="A7XX_DBGBUS_VFD_BV_0"/>
+	<value value="203" name="A7XX_DBGBUS_VFD_BV_1"/>
+	<value value="204" name="A7XX_DBGBUS_VFD_BV_2"/>
+	<value value="205" name="A7XX_DBGBUS_VFD_BV_3"/>
+	<value value="234" name="A7XX_DBGBUS_USP_0"/>
+	<value value="235" name="A7XX_DBGBUS_USP_1"/>
+	<value value="236" name="A7XX_DBGBUS_USP_2"/>
+	<value value="237" name="A7XX_DBGBUS_USP_3"/>
+	<value value="238" name="A7XX_DBGBUS_USP_4"/>
+	<value value="239" name="A7XX_DBGBUS_USP_5"/>
+	<value value="266" name="A7XX_DBGBUS_TP_0"/>
+	<value value="267" name="A7XX_DBGBUS_TP_1"/>
+	<value value="268" name="A7XX_DBGBUS_TP_2"/>
+	<value value="269" name="A7XX_DBGBUS_TP_3"/>
+	<value value="270" name="A7XX_DBGBUS_TP_4"/>
+	<value value="271" name="A7XX_DBGBUS_TP_5"/>
+	<value value="272" name="A7XX_DBGBUS_TP_6"/>
+	<value value="273" name="A7XX_DBGBUS_TP_7"/>
+	<value value="274" name="A7XX_DBGBUS_TP_8"/>
+	<value value="275" name="A7XX_DBGBUS_TP_9"/>
+	<value value="276" name="A7XX_DBGBUS_TP_10"/>
+	<value value="277" name="A7XX_DBGBUS_TP_11"/>
+	<value value="330" name="A7XX_DBGBUS_USPTP_0"/>
+	<value value="331" name="A7XX_DBGBUS_USPTP_1"/>
+	<value value="332" name="A7XX_DBGBUS_USPTP_2"/>
+	<value value="333" name="A7XX_DBGBUS_USPTP_3"/>
+	<value value="334" name="A7XX_DBGBUS_USPTP_4"/>
+	<value value="335" name="A7XX_DBGBUS_USPTP_5"/>
+	<value value="336" name="A7XX_DBGBUS_USPTP_6"/>
+	<value value="337" name="A7XX_DBGBUS_USPTP_7"/>
+	<value value="338" name="A7XX_DBGBUS_USPTP_8"/>
+	<value value="339" name="A7XX_DBGBUS_USPTP_9"/>
+	<value value="340" name="A7XX_DBGBUS_USPTP_10"/>
+	<value value="341" name="A7XX_DBGBUS_USPTP_11"/>
+	<value value="396" name="A7XX_DBGBUS_CCHE_0"/>
+	<value value="397" name="A7XX_DBGBUS_CCHE_1"/>
+	<value value="398" name="A7XX_DBGBUS_CCHE_2"/>
+	<value value="408" name="A7XX_DBGBUS_VPC_DSTR_0"/>
+	<value value="409" name="A7XX_DBGBUS_VPC_DSTR_1"/>
+	<value value="410" name="A7XX_DBGBUS_VPC_DSTR_2"/>
+	<value value="411" name="A7XX_DBGBUS_HLSQ_DP_STR_0"/>
+	<value value="412" name="A7XX_DBGBUS_HLSQ_DP_STR_1"/>
+	<value value="413" name="A7XX_DBGBUS_HLSQ_DP_STR_2"/>
+	<value value="414" name="A7XX_DBGBUS_HLSQ_DP_STR_3"/>
+	<value value="415" name="A7XX_DBGBUS_HLSQ_DP_STR_4"/>
+	<value value="416" name="A7XX_DBGBUS_HLSQ_DP_STR_5"/>
+	<value value="443" name="A7XX_DBGBUS_UFC_DSTR_0"/>
+	<value value="444" name="A7XX_DBGBUS_UFC_DSTR_1"/>
+	<value value="445" name="A7XX_DBGBUS_UFC_DSTR_2"/>
+	<value value="446" name="A7XX_DBGBUS_CGC_SUBCORE"/>
+	<value value="447" name="A7XX_DBGBUS_CGC_CORE"/>
+</enum>
+
+<enum name="a6xx_cp_perfcounter_select">
+	<value value="0" name="PERF_CP_ALWAYS_COUNT"/>
+	<value value="1" name="PERF_CP_BUSY_GFX_CORE_IDLE"/>
+	<value value="2" name="PERF_CP_BUSY_CYCLES"/>
+	<value value="3" name="PERF_CP_NUM_PREEMPTIONS"/>
+	<value value="4" name="PERF_CP_PREEMPTION_REACTION_DELAY"/>
+	<value value="5" name="PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
+	<value value="6" name="PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
+	<value value="7" name="PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
+	<value value="8" name="PERF_CP_PREDICATED_DRAWS_KILLED"/>
+	<value value="9" name="PERF_CP_MODE_SWITCH"/>
+	<value value="10" name="PERF_CP_ZPASS_DONE"/>
+	<value value="11" name="PERF_CP_CONTEXT_DONE"/>
+	<value value="12" name="PERF_CP_CACHE_FLUSH"/>
+	<value value="13" name="PERF_CP_LONG_PREEMPTIONS"/>
+	<value value="14" name="PERF_CP_SQE_I_CACHE_STARVE"/>
+	<value value="15" name="PERF_CP_SQE_IDLE"/>
+	<value value="16" name="PERF_CP_SQE_PM4_STARVE_RB_IB"/>
+	<value value="17" name="PERF_CP_SQE_PM4_STARVE_SDS"/>
+	<value value="18" name="PERF_CP_SQE_MRB_STARVE"/>
+	<value value="19" name="PERF_CP_SQE_RRB_STARVE"/>
+	<value value="20" name="PERF_CP_SQE_VSD_STARVE"/>
+	<value value="21" name="PERF_CP_VSD_DECODE_STARVE"/>
+	<value value="22" name="PERF_CP_SQE_PIPE_OUT_STALL"/>
+	<value value="23" name="PERF_CP_SQE_SYNC_STALL"/>
+	<value value="24" name="PERF_CP_SQE_PM4_WFI_STALL"/>
+	<value value="25" name="PERF_CP_SQE_SYS_WFI_STALL"/>
+	<value value="26" name="PERF_CP_SQE_T4_EXEC"/>
+	<value value="27" name="PERF_CP_SQE_LOAD_STATE_EXEC"/>
+	<value value="28" name="PERF_CP_SQE_SAVE_SDS_STATE"/>
+	<value value="29" name="PERF_CP_SQE_DRAW_EXEC"/>
+	<value value="30" name="PERF_CP_SQE_CTXT_REG_BUNCH_EXEC"/>
+	<value value="31" name="PERF_CP_SQE_EXEC_PROFILED"/>
+	<value value="32" name="PERF_CP_MEMORY_POOL_EMPTY"/>
+	<value value="33" name="PERF_CP_MEMORY_POOL_SYNC_STALL"/>
+	<value value="34" name="PERF_CP_MEMORY_POOL_ABOVE_THRESH"/>
+	<value value="35" name="PERF_CP_AHB_WR_STALL_PRE_DRAWS"/>
+	<value value="36" name="PERF_CP_AHB_STALL_SQE_GMU"/>
+	<value value="37" name="PERF_CP_AHB_STALL_SQE_WR_OTHER"/>
+	<value value="38" name="PERF_CP_AHB_STALL_SQE_RD_OTHER"/>
+	<value value="39" name="PERF_CP_CLUSTER0_EMPTY"/>
+	<value value="40" name="PERF_CP_CLUSTER1_EMPTY"/>
+	<value value="41" name="PERF_CP_CLUSTER2_EMPTY"/>
+	<value value="42" name="PERF_CP_CLUSTER3_EMPTY"/>
+	<value value="43" name="PERF_CP_CLUSTER4_EMPTY"/>
+	<value value="44" name="PERF_CP_CLUSTER5_EMPTY"/>
+	<value value="45" name="PERF_CP_PM4_DATA"/>
+	<value value="46" name="PERF_CP_PM4_HEADERS"/>
+	<value value="47" name="PERF_CP_VBIF_READ_BEATS"/>
+	<value value="48" name="PERF_CP_VBIF_WRITE_BEATS"/>
+	<value value="49" name="PERF_CP_SQE_INSTR_COUNTER"/>
+</enum>
+
+<enum name="a6xx_rbbm_perfcounter_select">
+	<value value="0" name="PERF_RBBM_ALWAYS_COUNT"/>
+	<value value="1" name="PERF_RBBM_ALWAYS_ON"/>
+	<value value="2" name="PERF_RBBM_TSE_BUSY"/>
+	<value value="3" name="PERF_RBBM_RAS_BUSY"/>
+	<value value="4" name="PERF_RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="PERF_RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="PERF_RBBM_STATUS_MASKED"/>
+	<value value="7" name="PERF_RBBM_COM_BUSY"/>
+	<value value="8" name="PERF_RBBM_DCOM_BUSY"/>
+	<value value="9" name="PERF_RBBM_VBIF_BUSY"/>
+	<value value="10" name="PERF_RBBM_VSC_BUSY"/>
+	<value value="11" name="PERF_RBBM_TESS_BUSY"/>
+	<value value="12" name="PERF_RBBM_UCHE_BUSY"/>
+	<value value="13" name="PERF_RBBM_HLSQ_BUSY"/>
+</enum>
+
+<enum name="a6xx_pc_perfcounter_select">
+	<value value="0" name="PERF_PC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_PC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_PC_STALL_CYCLES_VFD"/>
+	<value value="3" name="PERF_PC_STALL_CYCLES_TSE"/>
+	<value value="4" name="PERF_PC_STALL_CYCLES_VPC"/>
+	<value value="5" name="PERF_PC_STALL_CYCLES_UCHE"/>
+	<value value="6" name="PERF_PC_STALL_CYCLES_TESS"/>
+	<value value="7" name="PERF_PC_STALL_CYCLES_TSE_ONLY"/>
+	<value value="8" name="PERF_PC_STALL_CYCLES_VPC_ONLY"/>
+	<value value="9" name="PERF_PC_PASS1_TF_STALL_CYCLES"/>
+	<value value="10" name="PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
+	<value value="11" name="PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+	<value value="12" name="PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+	<value value="13" name="PERF_PC_STARVE_CYCLES_FOR_POSITION"/>
+	<value value="14" name="PERF_PC_STARVE_CYCLES_DI"/>
+	<value value="15" name="PERF_PC_VIS_STREAMS_LOADED"/>
+	<value value="16" name="PERF_PC_INSTANCES"/>
+	<value value="17" name="PERF_PC_VPC_PRIMITIVES"/>
+	<value value="18" name="PERF_PC_DEAD_PRIM"/>
+	<value value="19" name="PERF_PC_LIVE_PRIM"/>
+	<value value="20" name="PERF_PC_VERTEX_HITS"/>
+	<value value="21" name="PERF_PC_IA_VERTICES"/>
+	<value value="22" name="PERF_PC_IA_PRIMITIVES"/>
+	<value value="23" name="PERF_PC_GS_PRIMITIVES"/>
+	<value value="24" name="PERF_PC_HS_INVOCATIONS"/>
+	<value value="25" name="PERF_PC_DS_INVOCATIONS"/>
+	<value value="26" name="PERF_PC_VS_INVOCATIONS"/>
+	<value value="27" name="PERF_PC_GS_INVOCATIONS"/>
+	<value value="28" name="PERF_PC_DS_PRIMITIVES"/>
+	<value value="29" name="PERF_PC_VPC_POS_DATA_TRANSACTION"/>
+	<value value="30" name="PERF_PC_3D_DRAWCALLS"/>
+	<value value="31" name="PERF_PC_2D_DRAWCALLS"/>
+	<value value="32" name="PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
+	<value value="33" name="PERF_TESS_BUSY_CYCLES"/>
+	<value value="34" name="PERF_TESS_WORKING_CYCLES"/>
+	<value value="35" name="PERF_TESS_STALL_CYCLES_PC"/>
+	<value value="36" name="PERF_TESS_STARVE_CYCLES_PC"/>
+	<value value="37" name="PERF_PC_TSE_TRANSACTION"/>
+	<value value="38" name="PERF_PC_TSE_VERTEX"/>
+	<value value="39" name="PERF_PC_TESS_PC_UV_TRANS"/>
+	<value value="40" name="PERF_PC_TESS_PC_UV_PATCHES"/>
+	<value value="41" name="PERF_PC_TESS_FACTOR_TRANS"/>
+</enum>
+
+<enum name="a6xx_vfd_perfcounter_select">
+	<value value="0" name="PERF_VFD_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VFD_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
+	<value value="3" name="PERF_VFD_STALL_CYCLES_SP_INFO"/>
+	<value value="4" name="PERF_VFD_STALL_CYCLES_SP_ATTR"/>
+	<value value="5" name="PERF_VFD_STARVE_CYCLES_UCHE"/>
+	<value value="6" name="PERF_VFD_RBUFFER_FULL"/>
+	<value value="7" name="PERF_VFD_ATTR_INFO_FIFO_FULL"/>
+	<value value="8" name="PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
+	<value value="9" name="PERF_VFD_NUM_ATTRIBUTES"/>
+	<value value="10" name="PERF_VFD_UPPER_SHADER_FIBERS"/>
+	<value value="11" name="PERF_VFD_LOWER_SHADER_FIBERS"/>
+	<value value="12" name="PERF_VFD_MODE_0_FIBERS"/>
+	<value value="13" name="PERF_VFD_MODE_1_FIBERS"/>
+	<value value="14" name="PERF_VFD_MODE_2_FIBERS"/>
+	<value value="15" name="PERF_VFD_MODE_3_FIBERS"/>
+	<value value="16" name="PERF_VFD_MODE_4_FIBERS"/>
+	<value value="17" name="PERF_VFD_TOTAL_VERTICES"/>
+	<value value="18" name="PERF_VFDP_STALL_CYCLES_VFD"/>
+	<value value="19" name="PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
+	<value value="20" name="PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
+	<value value="21" name="PERF_VFDP_STARVE_CYCLES_PC"/>
+	<value value="22" name="PERF_VFDP_VS_STAGE_WAVES"/>
+</enum>
+
+<enum name="a6xx_hlsq_perfcounter_select">
+	<value value="0" name="PERF_HLSQ_BUSY_CYCLES"/>
+	<value value="1" name="PERF_HLSQ_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
+	<value value="3" name="PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+	<value value="4" name="PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
+	<value value="5" name="PERF_HLSQ_UCHE_LATENCY_COUNT"/>
+	<value value="6" name="PERF_HLSQ_FS_STAGE_1X_WAVES"/>
+	<value value="7" name="PERF_HLSQ_FS_STAGE_2X_WAVES"/>
+	<value value="8" name="PERF_HLSQ_QUADS"/>
+	<value value="9" name="PERF_HLSQ_CS_INVOCATIONS"/>
+	<value value="10" name="PERF_HLSQ_COMPUTE_DRAWCALLS"/>
+	<value value="11" name="PERF_HLSQ_FS_DATA_WAIT_PROGRAMMING"/>
+	<value value="12" name="PERF_HLSQ_DUAL_FS_PROG_ACTIVE"/>
+	<value value="13" name="PERF_HLSQ_DUAL_VS_PROG_ACTIVE"/>
+	<value value="14" name="PERF_HLSQ_FS_BATCH_COUNT_ZERO"/>
+	<value value="15" name="PERF_HLSQ_VS_BATCH_COUNT_ZERO"/>
+	<value value="16" name="PERF_HLSQ_WAVE_PENDING_NO_QUAD"/>
+	<value value="17" name="PERF_HLSQ_WAVE_PENDING_NO_PRIM_BASE"/>
+	<value value="18" name="PERF_HLSQ_STALL_CYCLES_VPC"/>
+	<value value="19" name="PERF_HLSQ_PIXELS"/>
+	<value value="20" name="PERF_HLSQ_DRAW_MODE_SWITCH_VSFS_SYNC"/>
+</enum>
+
+<enum name="a6xx_vpc_perfcounter_select">
+	<value value="0" name="PERF_VPC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VPC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_VPC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="PERF_VPC_STALL_CYCLES_VFD_WACK"/>
+	<value value="4" name="PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
+	<value value="5" name="PERF_VPC_STALL_CYCLES_PC"/>
+	<value value="6" name="PERF_VPC_STALL_CYCLES_SP_LM"/>
+	<value value="7" name="PERF_VPC_STARVE_CYCLES_SP"/>
+	<value value="8" name="PERF_VPC_STARVE_CYCLES_LRZ"/>
+	<value value="9" name="PERF_VPC_PC_PRIMITIVES"/>
+	<value value="10" name="PERF_VPC_SP_COMPONENTS"/>
+	<value value="11" name="PERF_VPC_STALL_CYCLES_VPCRAM_POS"/>
+	<value value="12" name="PERF_VPC_LRZ_ASSIGN_PRIMITIVES"/>
+	<value value="13" name="PERF_VPC_RB_VISIBLE_PRIMITIVES"/>
+	<value value="14" name="PERF_VPC_LM_TRANSACTION"/>
+	<value value="15" name="PERF_VPC_STREAMOUT_TRANSACTION"/>
+	<value value="16" name="PERF_VPC_VS_BUSY_CYCLES"/>
+	<value value="17" name="PERF_VPC_PS_BUSY_CYCLES"/>
+	<value value="18" name="PERF_VPC_VS_WORKING_CYCLES"/>
+	<value value="19" name="PERF_VPC_PS_WORKING_CYCLES"/>
+	<value value="20" name="PERF_VPC_STARVE_CYCLES_RB"/>
+	<value value="21" name="PERF_VPC_NUM_VPCRAM_READ_POS"/>
+	<value value="22" name="PERF_VPC_WIT_FULL_CYCLES"/>
+	<value value="23" name="PERF_VPC_VPCRAM_FULL_CYCLES"/>
+	<value value="24" name="PERF_VPC_LM_FULL_WAIT_FOR_INTP_END"/>
+	<value value="25" name="PERF_VPC_NUM_VPCRAM_WRITE"/>
+	<value value="26" name="PERF_VPC_NUM_VPCRAM_READ_SO"/>
+	<value value="27" name="PERF_VPC_NUM_ATTR_REQ_LM"/>
+</enum>
+
+<enum name="a6xx_tse_perfcounter_select">
+	<value value="0" name="PERF_TSE_BUSY_CYCLES"/>
+	<value value="1" name="PERF_TSE_CLIPPING_CYCLES"/>
+	<value value="2" name="PERF_TSE_STALL_CYCLES_RAS"/>
+	<value value="3" name="PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
+	<value value="4" name="PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
+	<value value="5" name="PERF_TSE_STARVE_CYCLES_PC"/>
+	<value value="6" name="PERF_TSE_INPUT_PRIM"/>
+	<value value="7" name="PERF_TSE_INPUT_NULL_PRIM"/>
+	<value value="8" name="PERF_TSE_TRIVAL_REJ_PRIM"/>
+	<value value="9" name="PERF_TSE_CLIPPED_PRIM"/>
+	<value value="10" name="PERF_TSE_ZERO_AREA_PRIM"/>
+	<value value="11" name="PERF_TSE_FACENESS_CULLED_PRIM"/>
+	<value value="12" name="PERF_TSE_ZERO_PIXEL_PRIM"/>
+	<value value="13" name="PERF_TSE_OUTPUT_NULL_PRIM"/>
+	<value value="14" name="PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
+	<value value="15" name="PERF_TSE_CINVOCATION"/>
+	<value value="16" name="PERF_TSE_CPRIMITIVES"/>
+	<value value="17" name="PERF_TSE_2D_INPUT_PRIM"/>
+	<value value="18" name="PERF_TSE_2D_ALIVE_CYCLES"/>
+	<value value="19" name="PERF_TSE_CLIP_PLANES"/>
+</enum>
+
+<enum name="a6xx_ras_perfcounter_select">
+	<value value="0" name="PERF_RAS_BUSY_CYCLES"/>
+	<value value="1" name="PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
+	<value value="2" name="PERF_RAS_STALL_CYCLES_LRZ"/>
+	<value value="3" name="PERF_RAS_STARVE_CYCLES_TSE"/>
+	<value value="4" name="PERF_RAS_SUPER_TILES"/>
+	<value value="5" name="PERF_RAS_8X4_TILES"/>
+	<value value="6" name="PERF_RAS_MASKGEN_ACTIVE"/>
+	<value value="7" name="PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
+	<value value="8" name="PERF_RAS_FULLY_COVERED_8X4_TILES"/>
+	<value value="9" name="PERF_RAS_PRIM_KILLED_INVISILBE"/>
+	<value value="10" name="PERF_RAS_SUPERTILE_GEN_ACTIVE_CYCLES"/>
+	<value value="11" name="PERF_RAS_LRZ_INTF_WORKING_CYCLES"/>
+	<value value="12" name="PERF_RAS_BLOCKS"/>
+</enum>
+
+<enum name="a6xx_uche_perfcounter_select">
+	<value value="0" name="PERF_UCHE_BUSY_CYCLES"/>
+	<value value="1" name="PERF_UCHE_STALL_CYCLES_ARBITER"/>
+	<value value="2" name="PERF_UCHE_VBIF_LATENCY_CYCLES"/>
+	<value value="3" name="PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
+	<value value="4" name="PERF_UCHE_VBIF_READ_BEATS_TP"/>
+	<value value="5" name="PERF_UCHE_VBIF_READ_BEATS_VFD"/>
+	<value value="6" name="PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
+	<value value="7" name="PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
+	<value value="8" name="PERF_UCHE_VBIF_READ_BEATS_SP"/>
+	<value value="9" name="PERF_UCHE_READ_REQUESTS_TP"/>
+	<value value="10" name="PERF_UCHE_READ_REQUESTS_VFD"/>
+	<value value="11" name="PERF_UCHE_READ_REQUESTS_HLSQ"/>
+	<value value="12" name="PERF_UCHE_READ_REQUESTS_LRZ"/>
+	<value value="13" name="PERF_UCHE_READ_REQUESTS_SP"/>
+	<value value="14" name="PERF_UCHE_WRITE_REQUESTS_LRZ"/>
+	<value value="15" name="PERF_UCHE_WRITE_REQUESTS_SP"/>
+	<value value="16" name="PERF_UCHE_WRITE_REQUESTS_VPC"/>
+	<value value="17" name="PERF_UCHE_WRITE_REQUESTS_VSC"/>
+	<value value="18" name="PERF_UCHE_EVICTS"/>
+	<value value="19" name="PERF_UCHE_BANK_REQ0"/>
+	<value value="20" name="PERF_UCHE_BANK_REQ1"/>
+	<value value="21" name="PERF_UCHE_BANK_REQ2"/>
+	<value value="22" name="PERF_UCHE_BANK_REQ3"/>
+	<value value="23" name="PERF_UCHE_BANK_REQ4"/>
+	<value value="24" name="PERF_UCHE_BANK_REQ5"/>
+	<value value="25" name="PERF_UCHE_BANK_REQ6"/>
+	<value value="26" name="PERF_UCHE_BANK_REQ7"/>
+	<value value="27" name="PERF_UCHE_VBIF_READ_BEATS_CH0"/>
+	<value value="28" name="PERF_UCHE_VBIF_READ_BEATS_CH1"/>
+	<value value="29" name="PERF_UCHE_GMEM_READ_BEATS"/>
+	<value value="30" name="PERF_UCHE_TPH_REF_FULL"/>
+	<value value="31" name="PERF_UCHE_TPH_VICTIM_FULL"/>
+	<value value="32" name="PERF_UCHE_TPH_EXT_FULL"/>
+	<value value="33" name="PERF_UCHE_VBIF_STALL_WRITE_DATA"/>
+	<value value="34" name="PERF_UCHE_DCMP_LATENCY_SAMPLES"/>
+	<value value="35" name="PERF_UCHE_DCMP_LATENCY_CYCLES"/>
+	<value value="36" name="PERF_UCHE_VBIF_READ_BEATS_PC"/>
+	<value value="37" name="PERF_UCHE_READ_REQUESTS_PC"/>
+	<value value="38" name="PERF_UCHE_RAM_READ_REQ"/>
+	<value value="39" name="PERF_UCHE_RAM_WRITE_REQ"/>
+</enum>
+
+<enum name="a6xx_tp_perfcounter_select">
+	<value value="0" name="PERF_TP_BUSY_CYCLES"/>
+	<value value="1" name="PERF_TP_STALL_CYCLES_UCHE"/>
+	<value value="2" name="PERF_TP_LATENCY_CYCLES"/>
+	<value value="3" name="PERF_TP_LATENCY_TRANS"/>
+	<value value="4" name="PERF_TP_FLAG_CACHE_REQUEST_SAMPLES"/>
+	<value value="5" name="PERF_TP_FLAG_CACHE_REQUEST_LATENCY"/>
+	<value value="6" name="PERF_TP_L1_CACHELINE_REQUESTS"/>
+	<value value="7" name="PERF_TP_L1_CACHELINE_MISSES"/>
+	<value value="8" name="PERF_TP_SP_TP_TRANS"/>
+	<value value="9" name="PERF_TP_TP_SP_TRANS"/>
+	<value value="10" name="PERF_TP_OUTPUT_PIXELS"/>
+	<value value="11" name="PERF_TP_FILTER_WORKLOAD_16BIT"/>
+	<value value="12" name="PERF_TP_FILTER_WORKLOAD_32BIT"/>
+	<value value="13" name="PERF_TP_QUADS_RECEIVED"/>
+	<value value="14" name="PERF_TP_QUADS_OFFSET"/>
+	<value value="15" name="PERF_TP_QUADS_SHADOW"/>
+	<value value="16" name="PERF_TP_QUADS_ARRAY"/>
+	<value value="17" name="PERF_TP_QUADS_GRADIENT"/>
+	<value value="18" name="PERF_TP_QUADS_1D"/>
+	<value value="19" name="PERF_TP_QUADS_2D"/>
+	<value value="20" name="PERF_TP_QUADS_BUFFER"/>
+	<value value="21" name="PERF_TP_QUADS_3D"/>
+	<value value="22" name="PERF_TP_QUADS_CUBE"/>
+	<value value="23" name="PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
+	<value value="24" name="PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
+	<value value="25" name="PERF_TP_OUTPUT_PIXELS_POINT"/>
+	<value value="26" name="PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="27" name="PERF_TP_OUTPUT_PIXELS_MIP"/>
+	<value value="28" name="PERF_TP_OUTPUT_PIXELS_ANISO"/>
+	<value value="29" name="PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
+	<value value="30" name="PERF_TP_FLAG_CACHE_REQUESTS"/>
+	<value value="31" name="PERF_TP_FLAG_CACHE_MISSES"/>
+	<value value="32" name="PERF_TP_L1_5_L2_REQUESTS"/>
+	<value value="33" name="PERF_TP_2D_OUTPUT_PIXELS"/>
+	<value value="34" name="PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
+	<value value="35" name="PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="36" name="PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
+	<value value="37" name="PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
+	<value value="38" name="PERF_TP_TPA2TPC_TRANS"/>
+	<value value="39" name="PERF_TP_L1_MISSES_ASTC_1TILE"/>
+	<value value="40" name="PERF_TP_L1_MISSES_ASTC_2TILE"/>
+	<value value="41" name="PERF_TP_L1_MISSES_ASTC_4TILE"/>
+	<value value="42" name="PERF_TP_L1_5_L2_COMPRESS_REQS"/>
+	<value value="43" name="PERF_TP_L1_5_L2_COMPRESS_MISS"/>
+	<value value="44" name="PERF_TP_L1_BANK_CONFLICT"/>
+	<value value="45" name="PERF_TP_L1_5_MISS_LATENCY_CYCLES"/>
+	<value value="46" name="PERF_TP_L1_5_MISS_LATENCY_TRANS"/>
+	<value value="47" name="PERF_TP_QUADS_CONSTANT_MULTIPLIED"/>
+	<value value="48" name="PERF_TP_FRONTEND_WORKING_CYCLES"/>
+	<value value="49" name="PERF_TP_L1_TAG_WORKING_CYCLES"/>
+	<value value="50" name="PERF_TP_L1_DATA_WRITE_WORKING_CYCLES"/>
+	<value value="51" name="PERF_TP_PRE_L1_DECOM_WORKING_CYCLES"/>
+	<value value="52" name="PERF_TP_BACKEND_WORKING_CYCLES"/>
+	<value value="53" name="PERF_TP_FLAG_CACHE_WORKING_CYCLES"/>
+	<value value="54" name="PERF_TP_L1_5_CACHE_WORKING_CYCLES"/>
+	<value value="55" name="PERF_TP_STARVE_CYCLES_SP"/>
+	<value value="56" name="PERF_TP_STARVE_CYCLES_UCHE"/>
+</enum>
+
+<enum name="a6xx_sp_perfcounter_select">
+	<value value="0" name="PERF_SP_BUSY_CYCLES"/>
+	<value value="1" name="PERF_SP_ALU_WORKING_CYCLES"/>
+	<value value="2" name="PERF_SP_EFU_WORKING_CYCLES"/>
+	<value value="3" name="PERF_SP_STALL_CYCLES_VPC"/>
+	<value value="4" name="PERF_SP_STALL_CYCLES_TP"/>
+	<value value="5" name="PERF_SP_STALL_CYCLES_UCHE"/>
+	<value value="6" name="PERF_SP_STALL_CYCLES_RB"/>
+	<value value="7" name="PERF_SP_NON_EXECUTION_CYCLES"/>
+	<value value="8" name="PERF_SP_WAVE_CONTEXTS"/>
+	<value value="9" name="PERF_SP_WAVE_CONTEXT_CYCLES"/>
+	<value value="10" name="PERF_SP_FS_STAGE_WAVE_CYCLES"/>
+	<value value="11" name="PERF_SP_FS_STAGE_WAVE_SAMPLES"/>
+	<value value="12" name="PERF_SP_VS_STAGE_WAVE_CYCLES"/>
+	<value value="13" name="PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
+	<value value="14" name="PERF_SP_FS_STAGE_DURATION_CYCLES"/>
+	<value value="15" name="PERF_SP_VS_STAGE_DURATION_CYCLES"/>
+	<value value="16" name="PERF_SP_WAVE_CTRL_CYCLES"/>
+	<value value="17" name="PERF_SP_WAVE_LOAD_CYCLES"/>
+	<value value="18" name="PERF_SP_WAVE_EMIT_CYCLES"/>
+	<value value="19" name="PERF_SP_WAVE_NOP_CYCLES"/>
+	<value value="20" name="PERF_SP_WAVE_WAIT_CYCLES"/>
+	<value value="21" name="PERF_SP_WAVE_FETCH_CYCLES"/>
+	<value value="22" name="PERF_SP_WAVE_IDLE_CYCLES"/>
+	<value value="23" name="PERF_SP_WAVE_END_CYCLES"/>
+	<value value="24" name="PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
+	<value value="25" name="PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
+	<value value="26" name="PERF_SP_WAVE_JOIN_CYCLES"/>
+	<value value="27" name="PERF_SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="28" name="PERF_SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="29" name="PERF_SP_LM_ATOMICS"/>
+	<value value="30" name="PERF_SP_GM_LOAD_INSTRUCTIONS"/>
+	<value value="31" name="PERF_SP_GM_STORE_INSTRUCTIONS"/>
+	<value value="32" name="PERF_SP_GM_ATOMICS"/>
+	<value value="33" name="PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="34" name="PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="35" name="PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="36" name="PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="37" name="PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="38" name="PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="39" name="PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="40" name="PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="41" name="PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="42" name="PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
+	<value value="43" name="PERF_SP_VS_INSTRUCTIONS"/>
+	<value value="44" name="PERF_SP_FS_INSTRUCTIONS"/>
+	<value value="45" name="PERF_SP_ADDR_LOCK_COUNT"/>
+	<value value="46" name="PERF_SP_UCHE_READ_TRANS"/>
+	<value value="47" name="PERF_SP_UCHE_WRITE_TRANS"/>
+	<value value="48" name="PERF_SP_EXPORT_VPC_TRANS"/>
+	<value value="49" name="PERF_SP_EXPORT_RB_TRANS"/>
+	<value value="50" name="PERF_SP_PIXELS_KILLED"/>
+	<value value="51" name="PERF_SP_ICL1_REQUESTS"/>
+	<value value="52" name="PERF_SP_ICL1_MISSES"/>
+	<value value="53" name="PERF_SP_HS_INSTRUCTIONS"/>
+	<value value="54" name="PERF_SP_DS_INSTRUCTIONS"/>
+	<value value="55" name="PERF_SP_GS_INSTRUCTIONS"/>
+	<value value="56" name="PERF_SP_CS_INSTRUCTIONS"/>
+	<value value="57" name="PERF_SP_GPR_READ"/>
+	<value value="58" name="PERF_SP_GPR_WRITE"/>
+	<value value="59" name="PERF_SP_FS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+	<value value="60" name="PERF_SP_VS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+	<value value="61" name="PERF_SP_LM_BANK_CONFLICTS"/>
+	<value value="62" name="PERF_SP_TEX_CONTROL_WORKING_CYCLES"/>
+	<value value="63" name="PERF_SP_LOAD_CONTROL_WORKING_CYCLES"/>
+	<value value="64" name="PERF_SP_FLOW_CONTROL_WORKING_CYCLES"/>
+	<value value="65" name="PERF_SP_LM_WORKING_CYCLES"/>
+	<value value="66" name="PERF_SP_DISPATCHER_WORKING_CYCLES"/>
+	<value value="67" name="PERF_SP_SEQUENCER_WORKING_CYCLES"/>
+	<value value="68" name="PERF_SP_LOW_EFFICIENCY_STARVED_BY_TP"/>
+	<value value="69" name="PERF_SP_STARVE_CYCLES_HLSQ"/>
+	<value value="70" name="PERF_SP_NON_EXECUTION_LS_CYCLES"/>
+	<value value="71" name="PERF_SP_WORKING_EU"/>
+	<value value="72" name="PERF_SP_ANY_EU_WORKING"/>
+	<value value="73" name="PERF_SP_WORKING_EU_FS_STAGE"/>
+	<value value="74" name="PERF_SP_ANY_EU_WORKING_FS_STAGE"/>
+	<value value="75" name="PERF_SP_WORKING_EU_VS_STAGE"/>
+	<value value="76" name="PERF_SP_ANY_EU_WORKING_VS_STAGE"/>
+	<value value="77" name="PERF_SP_WORKING_EU_CS_STAGE"/>
+	<value value="78" name="PERF_SP_ANY_EU_WORKING_CS_STAGE"/>
+	<value value="79" name="PERF_SP_GPR_READ_PREFETCH"/>
+	<value value="80" name="PERF_SP_GPR_READ_CONFLICT"/>
+	<value value="81" name="PERF_SP_GPR_WRITE_CONFLICT"/>
+	<value value="82" name="PERF_SP_GM_LOAD_LATENCY_CYCLES"/>
+	<value value="83" name="PERF_SP_GM_LOAD_LATENCY_SAMPLES"/>
+	<value value="84" name="PERF_SP_EXECUTABLE_WAVES"/>
+</enum>
+
+<enum name="a6xx_rb_perfcounter_select">
+	<value value="0" name="PERF_RB_BUSY_CYCLES"/>
+	<value value="1" name="PERF_RB_STALL_CYCLES_HLSQ"/>
+	<value value="2" name="PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
+	<value value="3" name="PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
+	<value value="4" name="PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
+	<value value="5" name="PERF_RB_STARVE_CYCLES_SP"/>
+	<value value="6" name="PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
+	<value value="7" name="PERF_RB_STARVE_CYCLES_CCU"/>
+	<value value="8" name="PERF_RB_STARVE_CYCLES_Z_PLANE"/>
+	<value value="9" name="PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
+	<value value="10" name="PERF_RB_Z_WORKLOAD"/>
+	<value value="11" name="PERF_RB_HLSQ_ACTIVE"/>
+	<value value="12" name="PERF_RB_Z_READ"/>
+	<value value="13" name="PERF_RB_Z_WRITE"/>
+	<value value="14" name="PERF_RB_C_READ"/>
+	<value value="15" name="PERF_RB_C_WRITE"/>
+	<value value="16" name="PERF_RB_TOTAL_PASS"/>
+	<value value="17" name="PERF_RB_Z_PASS"/>
+	<value value="18" name="PERF_RB_Z_FAIL"/>
+	<value value="19" name="PERF_RB_S_FAIL"/>
+	<value value="20" name="PERF_RB_BLENDED_FXP_COMPONENTS"/>
+	<value value="21" name="PERF_RB_BLENDED_FP16_COMPONENTS"/>
+	<value value="22" name="PERF_RB_PS_INVOCATIONS"/>
+	<value value="23" name="PERF_RB_2D_ALIVE_CYCLES"/>
+	<value value="24" name="PERF_RB_2D_STALL_CYCLES_A2D"/>
+	<value value="25" name="PERF_RB_2D_STARVE_CYCLES_SRC"/>
+	<value value="26" name="PERF_RB_2D_STARVE_CYCLES_SP"/>
+	<value value="27" name="PERF_RB_2D_STARVE_CYCLES_DST"/>
+	<value value="28" name="PERF_RB_2D_VALID_PIXELS"/>
+	<value value="29" name="PERF_RB_3D_PIXELS"/>
+	<value value="30" name="PERF_RB_BLENDER_WORKING_CYCLES"/>
+	<value value="31" name="PERF_RB_ZPROC_WORKING_CYCLES"/>
+	<value value="32" name="PERF_RB_CPROC_WORKING_CYCLES"/>
+	<value value="33" name="PERF_RB_SAMPLER_WORKING_CYCLES"/>
+	<value value="34" name="PERF_RB_STALL_CYCLES_CCU_COLOR_READ"/>
+	<value value="35" name="PERF_RB_STALL_CYCLES_CCU_COLOR_WRITE"/>
+	<value value="36" name="PERF_RB_STALL_CYCLES_CCU_DEPTH_READ"/>
+	<value value="37" name="PERF_RB_STALL_CYCLES_CCU_DEPTH_WRITE"/>
+	<value value="38" name="PERF_RB_STALL_CYCLES_VPC"/>
+	<value value="39" name="PERF_RB_2D_INPUT_TRANS"/>
+	<value value="40" name="PERF_RB_2D_OUTPUT_RB_DST_TRANS"/>
+	<value value="41" name="PERF_RB_2D_OUTPUT_RB_SRC_TRANS"/>
+	<value value="42" name="PERF_RB_BLENDED_FP32_COMPONENTS"/>
+	<value value="43" name="PERF_RB_COLOR_PIX_TILES"/>
+	<value value="44" name="PERF_RB_STALL_CYCLES_CCU"/>
+	<value value="45" name="PERF_RB_EARLY_Z_ARB3_GRANT"/>
+	<value value="46" name="PERF_RB_LATE_Z_ARB3_GRANT"/>
+	<value value="47" name="PERF_RB_EARLY_Z_SKIP_GRANT"/>
+</enum>
+
+<enum name="a6xx_vsc_perfcounter_select">
+	<value value="0" name="PERF_VSC_BUSY_CYCLES"/>
+	<value value="1" name="PERF_VSC_WORKING_CYCLES"/>
+	<value value="2" name="PERF_VSC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="PERF_VSC_EOT_NUM"/>
+	<value value="4" name="PERF_VSC_INPUT_TILES"/>
+</enum>
+
+<enum name="a6xx_ccu_perfcounter_select">
+	<value value="0" name="PERF_CCU_BUSY_CYCLES"/>
+	<value value="1" name="PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
+	<value value="2" name="PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
+	<value value="3" name="PERF_CCU_STARVE_CYCLES_FLAG_RETURN"/>
+	<value value="4" name="PERF_CCU_DEPTH_BLOCKS"/>
+	<value value="5" name="PERF_CCU_COLOR_BLOCKS"/>
+	<value value="6" name="PERF_CCU_DEPTH_BLOCK_HIT"/>
+	<value value="7" name="PERF_CCU_COLOR_BLOCK_HIT"/>
+	<value value="8" name="PERF_CCU_PARTIAL_BLOCK_READ"/>
+	<value value="9" name="PERF_CCU_GMEM_READ"/>
+	<value value="10" name="PERF_CCU_GMEM_WRITE"/>
+	<value value="11" name="PERF_CCU_DEPTH_READ_FLAG0_COUNT"/>
+	<value value="12" name="PERF_CCU_DEPTH_READ_FLAG1_COUNT"/>
+	<value value="13" name="PERF_CCU_DEPTH_READ_FLAG2_COUNT"/>
+	<value value="14" name="PERF_CCU_DEPTH_READ_FLAG3_COUNT"/>
+	<value value="15" name="PERF_CCU_DEPTH_READ_FLAG4_COUNT"/>
+	<value value="16" name="PERF_CCU_DEPTH_READ_FLAG5_COUNT"/>
+	<value value="17" name="PERF_CCU_DEPTH_READ_FLAG6_COUNT"/>
+	<value value="18" name="PERF_CCU_DEPTH_READ_FLAG8_COUNT"/>
+	<value value="19" name="PERF_CCU_COLOR_READ_FLAG0_COUNT"/>
+	<value value="20" name="PERF_CCU_COLOR_READ_FLAG1_COUNT"/>
+	<value value="21" name="PERF_CCU_COLOR_READ_FLAG2_COUNT"/>
+	<value value="22" name="PERF_CCU_COLOR_READ_FLAG3_COUNT"/>
+	<value value="23" name="PERF_CCU_COLOR_READ_FLAG4_COUNT"/>
+	<value value="24" name="PERF_CCU_COLOR_READ_FLAG5_COUNT"/>
+	<value value="25" name="PERF_CCU_COLOR_READ_FLAG6_COUNT"/>
+	<value value="26" name="PERF_CCU_COLOR_READ_FLAG8_COUNT"/>
+	<value value="27" name="PERF_CCU_2D_RD_REQ"/>
+	<value value="28" name="PERF_CCU_2D_WR_REQ"/>
+</enum>
+
+<enum name="a6xx_lrz_perfcounter_select">
+	<value value="0" name="PERF_LRZ_BUSY_CYCLES"/>
+	<value value="1" name="PERF_LRZ_STARVE_CYCLES_RAS"/>
+	<value value="2" name="PERF_LRZ_STALL_CYCLES_RB"/>
+	<value value="3" name="PERF_LRZ_STALL_CYCLES_VSC"/>
+	<value value="4" name="PERF_LRZ_STALL_CYCLES_VPC"/>
+	<value value="5" name="PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
+	<value value="6" name="PERF_LRZ_STALL_CYCLES_UCHE"/>
+	<value value="7" name="PERF_LRZ_LRZ_READ"/>
+	<value value="8" name="PERF_LRZ_LRZ_WRITE"/>
+	<value value="9" name="PERF_LRZ_READ_LATENCY"/>
+	<value value="10" name="PERF_LRZ_MERGE_CACHE_UPDATING"/>
+	<value value="11" name="PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
+	<value value="12" name="PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
+	<value value="13" name="PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
+	<value value="14" name="PERF_LRZ_FULL_8X8_TILES"/>
+	<value value="15" name="PERF_LRZ_PARTIAL_8X8_TILES"/>
+	<value value="16" name="PERF_LRZ_TILE_KILLED"/>
+	<value value="17" name="PERF_LRZ_TOTAL_PIXEL"/>
+	<value value="18" name="PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
+	<value value="19" name="PERF_LRZ_FULLY_COVERED_TILES"/>
+	<value value="20" name="PERF_LRZ_PARTIAL_COVERED_TILES"/>
+	<value value="21" name="PERF_LRZ_FEEDBACK_ACCEPT"/>
+	<value value="22" name="PERF_LRZ_FEEDBACK_DISCARD"/>
+	<value value="23" name="PERF_LRZ_FEEDBACK_STALL"/>
+	<value value="24" name="PERF_LRZ_STALL_CYCLES_RB_ZPLANE"/>
+	<value value="25" name="PERF_LRZ_STALL_CYCLES_RB_BPLANE"/>
+	<value value="26" name="PERF_LRZ_STALL_CYCLES_VC"/>
+	<value value="27" name="PERF_LRZ_RAS_MASK_TRANS"/>
+</enum>
+
+<enum name="a6xx_cmp_perfcounter_select">
+	<value value="0" name="PERF_CMPDECMP_STALL_CYCLES_ARB"/>
+	<value value="1" name="PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
+	<value value="2" name="PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
+	<value value="3" name="PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
+	<value value="4" name="PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
+	<value value="5" name="PERF_CMPDECMP_VBIF_READ_REQUEST"/>
+	<value value="6" name="PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
+	<value value="7" name="PERF_CMPDECMP_VBIF_READ_DATA"/>
+	<value value="8" name="PERF_CMPDECMP_VBIF_WRITE_DATA"/>
+	<value value="9" name="PERF_CMPDECMP_FLAG_FETCH_CYCLES"/>
+	<value value="10" name="PERF_CMPDECMP_FLAG_FETCH_SAMPLES"/>
+	<value value="11" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
+	<value value="12" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
+	<value value="13" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
+	<value value="14" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
+	<value value="15" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG5_COUNT"/>
+	<value value="16" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG6_COUNT"/>
+	<value value="17" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG8_COUNT"/>
+	<value value="18" name="PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
+	<value value="19" name="PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
+	<value value="20" name="PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
+	<value value="21" name="PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
+	<value value="22" name="PERF_CMPDECMP_COLOR_WRITE_FLAG5_COUNT"/>
+	<value value="23" name="PERF_CMPDECMP_COLOR_WRITE_FLAG6_COUNT"/>
+	<value value="24" name="PERF_CMPDECMP_COLOR_WRITE_FLAG8_COUNT"/>
+	<value value="25" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_REQ"/>
+	<value value="26" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_WR"/>
+	<value value="27" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_RETURN"/>
+	<value value="28" name="PERF_CMPDECMP_2D_RD_DATA"/>
+	<value value="29" name="PERF_CMPDECMP_2D_WR_DATA"/>
+	<value value="30" name="PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH0"/>
+	<value value="31" name="PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH1"/>
+	<value value="32" name="PERF_CMPDECMP_2D_OUTPUT_TRANS"/>
+	<value value="33" name="PERF_CMPDECMP_VBIF_WRITE_DATA_UCHE"/>
+	<value value="34" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG0_COUNT"/>
+	<value value="35" name="PERF_CMPDECMP_COLOR_WRITE_FLAG0_COUNT"/>
+	<value value="36" name="PERF_CMPDECMP_COLOR_WRITE_FLAGALPHA_COUNT"/>
+	<value value="37" name="PERF_CMPDECMP_2D_BUSY_CYCLES"/>
+	<value value="38" name="PERF_CMPDECMP_2D_REORDER_STARVE_CYCLES"/>
+	<value value="39" name="PERF_CMPDECMP_2D_PIXELS"/>
+</enum>
+
+<!--
+Used in a6xx_2d_blit_cntl.. the value mostly seems to correlate to the
+component type/size, so I think it relates to internal format used for
+blending?  The one exception is that 16b unorm and 32b float use the
+same value... maybe 16b unorm is uncommon enough that it was just easier
+to upconvert to 32b float internally?
+
+ 8b unorm:  10 (sometimes 0, is the high bit part of something else?)
+16b unorm:   4
+
+32b int:     7
+16b int:     6
+ 8b int:     5
+
+32b float:   4
+16b float:   3
+ -->
+<enum name="a6xx_2d_ifmt">
+	<value value="0x10" name="R2D_UNORM8"/>
+	<value value="0x7"  name="R2D_INT32"/>
+	<value value="0x6"  name="R2D_INT16"/>
+	<value value="0x5"  name="R2D_INT8"/>
+	<value value="0x4"  name="R2D_FLOAT32"/>
+	<value value="0x3"  name="R2D_FLOAT16"/>
+	<value value="0x1"  name="R2D_UNORM8_SRGB"/>
+	<value value="0x0"  name="R2D_RAW"/>
+</enum>
+
+<enum name="a6xx_ztest_mode">
+	<doc>Allow early z-test and early-lrz (if applicable)</doc>
+	<value value="0x0" name="A6XX_EARLY_Z"/>
+	<doc>Disable early z-test and early-lrz test (if applicable)</doc>
+	<value value="0x1" name="A6XX_LATE_Z"/>
+	<doc>
+		A special mode that allows early-lrz test but disables
+		early-z test.  Which might sound a bit funny, since
+		lrz-test happens before z-test.  But as long as a couple
+		conditions are maintained this allows using lrz-test in
+		cases where fragment shader has kill/discard:
+
+		1) Disable lrz-write in cases where it is uncertain during
+		   binning pass that a fragment will pass.  Ie.  if frag
+		   shader has-kill, writes-z, or alpha/stencil test is
+		   enabled.  (For correctness, lrz-write must be disabled
+		   when blend is enabled.)  This is analogous to how a
+		   z-prepass works.
+
+		2) Disable lrz-write and test if a depth-test direction
+		   reversal is detected.  Due to condition (1), the contents
+		   of the lrz buffer are a conservative estimation of the
+		   depth buffer during the draw pass.  Meaning that geometry
+		   that we know for certain will not be visible will not pass
+		   lrz-test.  But geometry which may be (or contributes to
+		   blend) will pass the lrz-test.
+
+		This allows us to keep early-lrz-test in cases where the frag
+		shader does not write-z (ie. we know the z-value before FS)
+		and does not have side-effects (image/ssbo writes, etc), but
+		does have kill/discard.  Which turns out to be a common
+		enough case that it is useful to keep early-lrz test against
+		the conservative lrz buffer to discard fragments that we
+		know will definitely not be visible.
+	</doc>
+	<value value="0x2" name="A6XX_EARLY_LRZ_LATE_Z"/>
+	<doc>Not a real hw value, used internally by mesa</doc>
+	<value value="0x3" name="A6XX_INVALID_ZTEST"/>
+</enum>
+
+<enum name="a6xx_tess_spacing">
+	<value value="0x0" name="TESS_EQUAL"/>
+	<value value="0x2" name="TESS_FRACTIONAL_ODD"/>
+	<value value="0x3" name="TESS_FRACTIONAL_EVEN"/>
+</enum>
+<enum name="a6xx_tess_output">
+	<value value="0x0" name="TESS_POINTS"/>
+	<value value="0x1" name="TESS_LINES"/>
+	<value value="0x2" name="TESS_CW_TRIS"/>
+	<value value="0x3" name="TESS_CCW_TRIS"/>
+</enum>
+
+<enum name="a7xx_cp_perfcounter_select">
+	<value value="0" name="A7XX_PERF_CP_ALWAYS_COUNT"/>
+	<value value="1" name="A7XX_PERF_CP_BUSY_GFX_CORE_IDLE"/>
+	<value value="2" name="A7XX_PERF_CP_BUSY_CYCLES"/>
+	<value value="3" name="A7XX_PERF_CP_NUM_PREEMPTIONS"/>
+	<value value="4" name="A7XX_PERF_CP_PREEMPTION_REACTION_DELAY"/>
+	<value value="5" name="A7XX_PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
+	<value value="6" name="A7XX_PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
+	<value value="7" name="A7XX_PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
+	<value value="8" name="A7XX_PERF_CP_PREDICATED_DRAWS_KILLED"/>
+	<value value="9" name="A7XX_PERF_CP_MODE_SWITCH"/>
+	<value value="10" name="A7XX_PERF_CP_ZPASS_DONE"/>
+	<value value="11" name="A7XX_PERF_CP_CONTEXT_DONE"/>
+	<value value="12" name="A7XX_PERF_CP_CACHE_FLUSH"/>
+	<value value="13" name="A7XX_PERF_CP_LONG_PREEMPTIONS"/>
+	<value value="14" name="A7XX_PERF_CP_SQE_I_CACHE_STARVE"/>
+	<value value="15" name="A7XX_PERF_CP_SQE_IDLE"/>
+	<value value="16" name="A7XX_PERF_CP_SQE_PM4_STARVE_RB_IB"/>
+	<value value="17" name="A7XX_PERF_CP_SQE_PM4_STARVE_SDS"/>
+	<value value="18" name="A7XX_PERF_CP_SQE_MRB_STARVE"/>
+	<value value="19" name="A7XX_PERF_CP_SQE_RRB_STARVE"/>
+	<value value="20" name="A7XX_PERF_CP_SQE_VSD_STARVE"/>
+	<value value="21" name="A7XX_PERF_CP_VSD_DECODE_STARVE"/>
+	<value value="22" name="A7XX_PERF_CP_SQE_PIPE_OUT_STALL"/>
+	<value value="23" name="A7XX_PERF_CP_SQE_SYNC_STALL"/>
+	<value value="24" name="A7XX_PERF_CP_SQE_PM4_WFI_STALL"/>
+	<value value="25" name="A7XX_PERF_CP_SQE_SYS_WFI_STALL"/>
+	<value value="26" name="A7XX_PERF_CP_SQE_T4_EXEC"/>
+	<value value="27" name="A7XX_PERF_CP_SQE_LOAD_STATE_EXEC"/>
+	<value value="28" name="A7XX_PERF_CP_SQE_SAVE_SDS_STATE"/>
+	<value value="29" name="A7XX_PERF_CP_SQE_DRAW_EXEC"/>
+	<value value="30" name="A7XX_PERF_CP_SQE_CTXT_REG_BUNCH_EXEC"/>
+	<value value="31" name="A7XX_PERF_CP_SQE_EXEC_PROFILED"/>
+	<value value="32" name="A7XX_PERF_CP_MEMORY_POOL_EMPTY"/>
+	<value value="33" name="A7XX_PERF_CP_MEMORY_POOL_SYNC_STALL"/>
+	<value value="34" name="A7XX_PERF_CP_MEMORY_POOL_ABOVE_THRESH"/>
+	<value value="35" name="A7XX_PERF_CP_AHB_WR_STALL_PRE_DRAWS"/>
+	<value value="36" name="A7XX_PERF_CP_AHB_STALL_SQE_GMU"/>
+	<value value="37" name="A7XX_PERF_CP_AHB_STALL_SQE_WR_OTHER"/>
+	<value value="38" name="A7XX_PERF_CP_AHB_STALL_SQE_RD_OTHER"/>
+	<value value="39" name="A7XX_PERF_CP_CLUSTER0_EMPTY"/>
+	<value value="40" name="A7XX_PERF_CP_CLUSTER1_EMPTY"/>
+	<value value="41" name="A7XX_PERF_CP_CLUSTER2_EMPTY"/>
+	<value value="42" name="A7XX_PERF_CP_CLUSTER3_EMPTY"/>
+	<value value="43" name="A7XX_PERF_CP_CLUSTER4_EMPTY"/>
+	<value value="44" name="A7XX_PERF_CP_CLUSTER5_EMPTY"/>
+	<value value="45" name="A7XX_PERF_CP_PM4_DATA"/>
+	<value value="46" name="A7XX_PERF_CP_PM4_HEADERS"/>
+	<value value="47" name="A7XX_PERF_CP_VBIF_READ_BEATS"/>
+	<value value="48" name="A7XX_PERF_CP_VBIF_WRITE_BEATS"/>
+	<value value="49" name="A7XX_PERF_CP_SQE_INSTR_COUNTER"/>
+	<value value="50" name="A7XX_PERF_CP_RESERVED_50"/>
+	<value value="51" name="A7XX_PERF_CP_RESERVED_51"/>
+	<value value="52" name="A7XX_PERF_CP_RESERVED_52"/>
+	<value value="53" name="A7XX_PERF_CP_RESERVED_53"/>
+	<value value="54" name="A7XX_PERF_CP_RESERVED_54"/>
+	<value value="55" name="A7XX_PERF_CP_RESERVED_55"/>
+	<value value="56" name="A7XX_PERF_CP_RESERVED_56"/>
+	<value value="57" name="A7XX_PERF_CP_RESERVED_57"/>
+	<value value="58" name="A7XX_PERF_CP_RESERVED_58"/>
+	<value value="59" name="A7XX_PERF_CP_RESERVED_59"/>
+	<value value="60" name="A7XX_PERF_CP_CLUSTER0_FULL"/>
+	<value value="61" name="A7XX_PERF_CP_CLUSTER1_FULL"/>
+	<value value="62" name="A7XX_PERF_CP_CLUSTER2_FULL"/>
+	<value value="63" name="A7XX_PERF_CP_CLUSTER3_FULL"/>
+	<value value="64" name="A7XX_PERF_CP_CLUSTER4_FULL"/>
+	<value value="65" name="A7XX_PERF_CP_CLUSTER5_FULL"/>
+	<value value="66" name="A7XX_PERF_CP_CLUSTER6_FULL"/>
+	<value value="67" name="A7XX_PERF_CP_CLUSTER6_EMPTY"/>
+	<value value="68" name="A7XX_PERF_CP_ICACHE_MISSES"/>
+	<value value="69" name="A7XX_PERF_CP_ICACHE_HITS"/>
+	<value value="70" name="A7XX_PERF_CP_ICACHE_STALL"/>
+	<value value="71" name="A7XX_PERF_CP_DCACHE_MISSES"/>
+	<value value="72" name="A7XX_PERF_CP_DCACHE_HITS"/>
+	<value value="73" name="A7XX_PERF_CP_DCACHE_STALLS"/>
+	<value value="74" name="A7XX_PERF_CP_AQE_SQE_STALL"/>
+	<value value="75" name="A7XX_PERF_CP_SQE_AQE_STARVE"/>
+	<value value="76" name="A7XX_PERF_CP_PREEMPT_LATENCY"/>
+	<value value="77" name="A7XX_PERF_CP_SQE_MD8_STALL_CYCLES"/>
+	<value value="78" name="A7XX_PERF_CP_SQE_MESH_EXEC_CYCLES"/>
+	<value value="79" name="A7XX_PERF_CP_AQE_NUM_AS_CHUNKS"/>
+	<value value="80" name="A7XX_PERF_CP_AQE_NUM_MS_CHUNKS"/>
+</enum>
+
+<enum name="a7xx_rbbm_perfcounter_select">
+	<value value="0" name="A7XX_PERF_RBBM_ALWAYS_COUNT"/>
+	<value value="1" name="A7XX_PERF_RBBM_ALWAYS_ON"/>
+	<value value="2" name="A7XX_PERF_RBBM_TSE_BUSY"/>
+	<value value="3" name="A7XX_PERF_RBBM_RAS_BUSY"/>
+	<value value="4" name="A7XX_PERF_RBBM_PC_DCALL_BUSY"/>
+	<value value="5" name="A7XX_PERF_RBBM_PC_VSD_BUSY"/>
+	<value value="6" name="A7XX_PERF_RBBM_STATUS_MASKED"/>
+	<value value="7" name="A7XX_PERF_RBBM_COM_BUSY"/>
+	<value value="8" name="A7XX_PERF_RBBM_DCOM_BUSY"/>
+	<value value="9" name="A7XX_PERF_RBBM_VBIF_BUSY"/>
+	<value value="10" name="A7XX_PERF_RBBM_VSC_BUSY"/>
+	<value value="11" name="A7XX_PERF_RBBM_TESS_BUSY"/>
+	<value value="12" name="A7XX_PERF_RBBM_UCHE_BUSY"/>
+	<value value="13" name="A7XX_PERF_RBBM_HLSQ_BUSY"/>
+</enum>
+
+<enum name="a7xx_pc_perfcounter_select">
+	<value value="0" name="A7XX_PERF_PC_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_PC_WORKING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_PC_STALL_CYCLES_VFD"/>
+	<value value="3" name="A7XX_PERF_PC_RESERVED"/>
+	<value value="4" name="A7XX_PERF_PC_STALL_CYCLES_VPC"/>
+	<value value="5" name="A7XX_PERF_PC_STALL_CYCLES_UCHE"/>
+	<value value="6" name="A7XX_PERF_PC_STALL_CYCLES_TESS"/>
+	<value value="7" name="A7XX_PERF_PC_STALL_CYCLES_VFD_ONLY"/>
+	<value value="8" name="A7XX_PERF_PC_STALL_CYCLES_VPC_ONLY"/>
+	<value value="9" name="A7XX_PERF_PC_PASS1_TF_STALL_CYCLES"/>
+	<value value="10" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
+	<value value="11" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+	<value value="12" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+	<value value="13" name="A7XX_PERF_PC_STARVE_CYCLES_DI"/>
+	<value value="14" name="A7XX_PERF_PC_VIS_STREAMS_LOADED"/>
+	<value value="15" name="A7XX_PERF_PC_INSTANCES"/>
+	<value value="16" name="A7XX_PERF_PC_VPC_PRIMITIVES"/>
+	<value value="17" name="A7XX_PERF_PC_DEAD_PRIM"/>
+	<value value="18" name="A7XX_PERF_PC_LIVE_PRIM"/>
+	<value value="19" name="A7XX_PERF_PC_VERTEX_HITS"/>
+	<value value="20" name="A7XX_PERF_PC_IA_VERTICES"/>
+	<value value="21" name="A7XX_PERF_PC_IA_PRIMITIVES"/>
+	<value value="22" name="A7XX_PERF_PC_RESERVED_22"/>
+	<value value="23" name="A7XX_PERF_PC_HS_INVOCATIONS"/>
+	<value value="24" name="A7XX_PERF_PC_DS_INVOCATIONS"/>
+	<value value="25" name="A7XX_PERF_PC_VS_INVOCATIONS"/>
+	<value value="26" name="A7XX_PERF_PC_GS_INVOCATIONS"/>
+	<value value="27" name="A7XX_PERF_PC_DS_PRIMITIVES"/>
+	<value value="28" name="A7XX_PERF_PC_3D_DRAWCALLS"/>
+	<value value="29" name="A7XX_PERF_PC_2D_DRAWCALLS"/>
+	<value value="30" name="A7XX_PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
+	<value value="31" name="A7XX_PERF_PC_TESS_BUSY_CYCLES"/>
+	<value value="32" name="A7XX_PERF_PC_TESS_WORKING_CYCLES"/>
+	<value value="33" name="A7XX_PERF_PC_TESS_STALL_CYCLES_PC"/>
+	<value value="34" name="A7XX_PERF_PC_TESS_STARVE_CYCLES_PC"/>
+	<value value="35" name="A7XX_PERF_PC_TESS_SINGLE_PRIM_CYCLES"/>
+	<value value="36" name="A7XX_PERF_PC_TESS_PC_UV_TRANS"/>
+	<value value="37" name="A7XX_PERF_PC_TESS_PC_UV_PATCHES"/>
+	<value value="38" name="A7XX_PERF_PC_TESS_FACTOR_TRANS"/>
+	<value value="39" name="A7XX_PERF_PC_TAG_CHECKED_VERTICES"/>
+	<value value="40" name="A7XX_PERF_PC_MESH_VS_WAVES"/>
+	<value value="41" name="A7XX_PERF_PC_MESH_DRAWS"/>
+	<value value="42" name="A7XX_PERF_PC_MESH_DEAD_DRAWS"/>
+	<value value="43" name="A7XX_PERF_PC_MESH_MVIS_EN_DRAWS"/>
+	<value value="44" name="A7XX_PERF_PC_MESH_DEAD_PRIM"/>
+	<value value="45" name="A7XX_PERF_PC_MESH_LIVE_PRIM"/>
+	<value value="46" name="A7XX_PERF_PC_MESH_PA_EN_PRIM"/>
+	<value value="47" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_MVIS_STREAM"/>
+	<value value="48" name="A7XX_PERF_PC_STARVE_CYCLES_PREDRAW"/>
+	<value value="49" name="A7XX_PERF_PC_STALL_CYCLES_COMPUTE_GFX"/>
+	<value value="50" name="A7XX_PERF_PC_STALL_CYCLES_GFX_COMPUTE"/>
+	<value value="51" name="A7XX_PERF_PC_TESS_PC_MULTI_PATCH_TRANS"/>
+</enum>
+
+<enum name="a7xx_vfd_perfcounter_select">
+	<value value="0" name="A7XX_PERF_VFD_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_VFD_STALL_CYCLES_UCHE"/>
+	<value value="2" name="A7XX_PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
+	<value value="3" name="A7XX_PERF_VFD_STALL_CYCLES_SP_INFO"/>
+	<value value="4" name="A7XX_PERF_VFD_STALL_CYCLES_SP_ATTR"/>
+	<value value="5" name="A7XX_PERF_VFD_STARVE_CYCLES_UCHE"/>
+	<value value="6" name="A7XX_PERF_VFD_RBUFFER_FULL"/>
+	<value value="7" name="A7XX_PERF_VFD_ATTR_INFO_FIFO_FULL"/>
+	<value value="8" name="A7XX_PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
+	<value value="9" name="A7XX_PERF_VFD_NUM_ATTRIBUTES"/>
+	<value value="10" name="A7XX_PERF_VFD_UPPER_SHADER_FIBERS"/>
+	<value value="11" name="A7XX_PERF_VFD_LOWER_SHADER_FIBERS"/>
+	<value value="12" name="A7XX_PERF_VFD_MODE_0_FIBERS"/>
+	<value value="13" name="A7XX_PERF_VFD_MODE_1_FIBERS"/>
+	<value value="14" name="A7XX_PERF_VFD_MODE_2_FIBERS"/>
+	<value value="15" name="A7XX_PERF_VFD_MODE_3_FIBERS"/>
+	<value value="16" name="A7XX_PERF_VFD_MODE_4_FIBERS"/>
+	<value value="17" name="A7XX_PERF_VFD_TOTAL_VERTICES"/>
+	<value value="18" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD"/>
+	<value value="19" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
+	<value value="20" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
+	<value value="21" name="A7XX_PERF_VFDP_STARVE_CYCLES_PC"/>
+	<value value="22" name="A7XX_PERF_VFDP_VS_STAGE_WAVES"/>
+	<value value="23" name="A7XX_PERF_VFD_STALL_CYCLES_PRG_END_FE"/>
+	<value value="24" name="A7XX_PERF_VFD_STALL_CYCLES_CBSYNC"/>
+</enum>
+
+<enum name="a7xx_hlsq_perfcounter_select">
+	<value value="0" name="A7XX_PERF_HLSQ_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_HLSQ_STALL_CYCLES_UCHE"/>
+	<value value="2" name="A7XX_PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
+	<value value="3" name="A7XX_PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+	<value value="4" name="A7XX_PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
+	<value value="5" name="A7XX_PERF_HLSQ_UCHE_LATENCY_COUNT"/>
+	<value value="6" name="A7XX_PERF_HLSQ_RESERVED_6"/>
+	<value value="7" name="A7XX_PERF_HLSQ_RESERVED_7"/>
+	<value value="8" name="A7XX_PERF_HLSQ_RESERVED_8"/>
+	<value value="9" name="A7XX_PERF_HLSQ_RESERVED_9"/>
+	<value value="10" name="A7XX_PERF_HLSQ_COMPUTE_DRAWCALLS"/>
+	<value value="11" name="A7XX_PERF_HLSQ_FS_DATA_WAIT_PROGRAMMING"/>
+	<value value="12" name="A7XX_PERF_HLSQ_DUAL_FS_PROG_ACTIVE"/>
+	<value value="13" name="A7XX_PERF_HLSQ_DUAL_VS_PROG_ACTIVE"/>
+	<value value="14" name="A7XX_PERF_HLSQ_FS_BATCH_COUNT_ZERO"/>
+	<value value="15" name="A7XX_PERF_HLSQ_VS_BATCH_COUNT_ZERO"/>
+	<value value="16" name="A7XX_PERF_HLSQ_WAVE_PENDING_NO_QUAD"/>
+	<value value="17" name="A7XX_PERF_HLSQ_WAVE_PENDING_NO_PRIM_BASE"/>
+	<value value="18" name="A7XX_PERF_HLSQ_STALL_CYCLES_VPC"/>
+	<value value="19" name="A7XX_PERF_HLSQ_RESERVED_19"/>
+	<value value="20" name="A7XX_PERF_HLSQ_DRAW_MODE_SWITCH_VSFS_SYNC"/>
+	<value value="21" name="A7XX_PERF_HLSQ_VSBR_STALL_CYCLES"/>
+	<value value="22" name="A7XX_PERF_HLSQ_FS_STALL_CYCLES"/>
+	<value value="23" name="A7XX_PERF_HLSQ_LPAC_STALL_CYCLES"/>
+	<value value="24" name="A7XX_PERF_HLSQ_BV_STALL_CYCLES"/>
+	<value value="25" name="A7XX_PERF_HLSQ_VSBR_DEREF_CYCLES"/>
+	<value value="26" name="A7XX_PERF_HLSQ_FS_DEREF_CYCLES"/>
+	<value value="27" name="A7XX_PERF_HLSQ_LPAC_DEREF_CYCLES"/>
+	<value value="28" name="A7XX_PERF_HLSQ_BV_DEREF_CYCLES"/>
+	<value value="29" name="A7XX_PERF_HLSQ_VSBR_S2W_CYCLES"/>
+	<value value="30" name="A7XX_PERF_HLSQ_FS_S2W_CYCLES"/>
+	<value value="31" name="A7XX_PERF_HLSQ_LPAC_S2W_CYCLES"/>
+	<value value="32" name="A7XX_PERF_HLSQ_BV_S2W_CYCLES"/>
+	<value value="33" name="A7XX_PERF_HLSQ_VSBR_WAIT_FS_S2W"/>
+	<value value="34" name="A7XX_PERF_HLSQ_FS_WAIT_VS_S2W"/>
+	<value value="35" name="A7XX_PERF_HLSQ_LPAC_WAIT_VS_S2W"/>
+	<value value="36" name="A7XX_PERF_HLSQ_BV_WAIT_FS_S2W"/>
+	<value value="37" name="A7XX_PERF_HLSQ_VS_WAIT_CONST_RESOURCE"/>
+	<value value="38" name="A7XX_PERF_HLSQ_FS_WAIT_SAME_VS_S2W"/>
+	<value value="39" name="A7XX_PERF_HLSQ_FS_STARVING_SP"/>
+	<value value="40" name="A7XX_PERF_HLSQ_VS_DATA_WAIT_PROGRAMMING"/>
+	<value value="41" name="A7XX_PERF_HLSQ_BV_DATA_WAIT_PROGRAMMING"/>
+	<value value="42" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_VS"/>
+	<value value="43" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_VS"/>
+	<value value="44" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_FS"/>
+	<value value="45" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_FS"/>
+	<value value="46" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_BV"/>
+	<value value="47" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_BV"/>
+	<value value="48" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_LPAC"/>
+	<value value="49" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_LPAC"/>
+	<value value="50" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_VS"/>
+	<value value="51" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_FS"/>
+	<value value="52" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_BV"/>
+	<value value="53" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_LPAC"/>
+	<value value="54" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_VS"/>
+	<value value="55" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_FS"/>
+	<value value="56" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_BV"/>
+	<value value="57" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_LPAC"/>
+</enum>
+
+<enum name="a7xx_vpc_perfcounter_select">
+	<value value="0" name="A7XX_PERF_VPC_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_VPC_WORKING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_VPC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="A7XX_PERF_VPC_STALL_CYCLES_VFD_WACK"/>
+	<value value="4" name="A7XX_PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
+	<value value="5" name="A7XX_PERF_VPC_RESERVED_5"/>
+	<value value="6" name="A7XX_PERF_VPC_STALL_CYCLES_SP_LM"/>
+	<value value="7" name="A7XX_PERF_VPC_STARVE_CYCLES_SP"/>
+	<value value="8" name="A7XX_PERF_VPC_STARVE_CYCLES_LRZ"/>
+	<value value="9" name="A7XX_PERF_VPC_PC_PRIMITIVES"/>
+	<value value="10" name="A7XX_PERF_VPC_SP_COMPONENTS"/>
+	<value value="11" name="A7XX_PERF_VPC_STALL_CYCLES_VPCRAM_POS"/>
+	<value value="12" name="A7XX_PERF_VPC_LRZ_ASSIGN_PRIMITIVES"/>
+	<value value="13" name="A7XX_PERF_VPC_RB_VISIBLE_PRIMITIVES"/>
+	<value value="14" name="A7XX_PERF_VPC_LM_TRANSACTION"/>
+	<value value="15" name="A7XX_PERF_VPC_STREAMOUT_TRANSACTION"/>
+	<value value="16" name="A7XX_PERF_VPC_VS_BUSY_CYCLES"/>
+	<value value="17" name="A7XX_PERF_VPC_PS_BUSY_CYCLES"/>
+	<value value="18" name="A7XX_PERF_VPC_VS_WORKING_CYCLES"/>
+	<value value="19" name="A7XX_PERF_VPC_PS_WORKING_CYCLES"/>
+	<value value="20" name="A7XX_PERF_VPC_STARVE_CYCLES_RB"/>
+	<value value="21" name="A7XX_PERF_VPC_NUM_VPCRAM_READ_POS"/>
+	<value value="22" name="A7XX_PERF_VPC_WIT_FULL_CYCLES"/>
+	<value value="23" name="A7XX_PERF_VPC_VPCRAM_FULL_CYCLES"/>
+	<value value="24" name="A7XX_PERF_VPC_LM_FULL_WAIT_FOR_INTP_END"/>
+	<value value="25" name="A7XX_PERF_VPC_NUM_VPCRAM_WRITE"/>
+	<value value="26" name="A7XX_PERF_VPC_NUM_VPCRAM_READ_SO"/>
+	<value value="27" name="A7XX_PERF_VPC_NUM_ATTR_REQ_LM"/>
+	<value value="28" name="A7XX_PERF_VPC_STALL_CYCLE_TSE"/>
+	<value value="29" name="A7XX_PERF_VPC_TSE_PRIMITIVES"/>
+	<value value="30" name="A7XX_PERF_VPC_GS_PRIMITIVES"/>
+	<value value="31" name="A7XX_PERF_VPC_TSE_TRANSACTIONS"/>
+	<value value="32" name="A7XX_PERF_VPC_STALL_CYCLES_CCU"/>
+	<value value="33" name="A7XX_PERF_VPC_NUM_WM_HIT"/>
+	<value value="34" name="A7XX_PERF_VPC_STALL_DQ_WACK"/>
+	<value value="35" name="A7XX_PERF_VPC_STALL_CYCLES_CCHE"/>
+	<value value="36" name="A7XX_PERF_VPC_STARVE_CYCLES_CCHE"/>
+	<value value="37" name="A7XX_PERF_VPC_NUM_PA_REQ"/>
+	<value value="38" name="A7XX_PERF_VPC_NUM_LM_REQ_HIT"/>
+	<value value="39" name="A7XX_PERF_VPC_CCHE_REQBUF_FULL"/>
+	<value value="40" name="A7XX_PERF_VPC_STALL_CYCLES_LM_ACK"/>
+	<value value="41" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_FE"/>
+	<value value="42" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_PCVS"/>
+	<value value="43" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_VPCPS"/>
+</enum>
+
+<enum name="a7xx_tse_perfcounter_select">
+	<value value="0" name="A7XX_PERF_TSE_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_TSE_CLIPPING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_TSE_STALL_CYCLES_RAS"/>
+	<value value="3" name="A7XX_PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
+	<value value="4" name="A7XX_PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
+	<value value="5" name="A7XX_PERF_TSE_STARVE_CYCLES_PC"/>
+	<value value="6" name="A7XX_PERF_TSE_INPUT_PRIM"/>
+	<value value="7" name="A7XX_PERF_TSE_INPUT_NULL_PRIM"/>
+	<value value="8" name="A7XX_PERF_TSE_TRIVAL_REJ_PRIM"/>
+	<value value="9" name="A7XX_PERF_TSE_CLIPPED_PRIM"/>
+	<value value="10" name="A7XX_PERF_TSE_ZERO_AREA_PRIM"/>
+	<value value="11" name="A7XX_PERF_TSE_FACENESS_CULLED_PRIM"/>
+	<value value="12" name="A7XX_PERF_TSE_ZERO_PIXEL_PRIM"/>
+	<value value="13" name="A7XX_PERF_TSE_OUTPUT_NULL_PRIM"/>
+	<value value="14" name="A7XX_PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
+	<value value="15" name="A7XX_PERF_TSE_CINVOCATION"/>
+	<value value="16" name="A7XX_PERF_TSE_CPRIMITIVES"/>
+	<value value="17" name="A7XX_PERF_TSE_2D_INPUT_PRIM"/>
+	<value value="18" name="A7XX_PERF_TSE_2D_ALIVE_CYCLES"/>
+	<value value="19" name="A7XX_PERF_TSE_CLIP_PLANES"/>
+</enum>
+
+<enum name="a7xx_ras_perfcounter_select">
+	<value value="0" name="A7XX_PERF_RAS_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
+	<value value="2" name="A7XX_PERF_RAS_STALL_CYCLES_LRZ"/>
+	<value value="3" name="A7XX_PERF_RAS_STARVE_CYCLES_TSE"/>
+	<value value="4" name="A7XX_PERF_RAS_SUPER_TILES"/>
+	<value value="5" name="A7XX_PERF_RAS_8X4_TILES"/>
+	<value value="6" name="A7XX_PERF_RAS_MASKGEN_ACTIVE"/>
+	<value value="7" name="A7XX_PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
+	<value value="8" name="A7XX_PERF_RAS_FULLY_COVERED_8X4_TILES"/>
+	<value value="9" name="A7XX_PERF_RAS_PRIM_KILLED_INVISILBE"/>
+	<value value="10" name="A7XX_PERF_RAS_SUPERTILE_GEN_ACTIVE_CYCLES"/>
+	<value value="11" name="A7XX_PERF_RAS_LRZ_INTF_WORKING_CYCLES"/>
+	<value value="12" name="A7XX_PERF_RAS_BLOCKS"/>
+	<value value="13" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_0_WORKING_CC_l2"/>
+	<value value="14" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_1_WORKING_CC_l2"/>
+	<value value="15" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_2_WORKING_CC_l2"/>
+	<value value="16" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_3_WORKING_CC_l2"/>
+	<value value="17" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_4_WORKING_CC_l2"/>
+	<value value="18" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_5_WORKING_CC_l2"/>
+	<value value="19" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_6_WORKING_CC_l2"/>
+	<value value="20" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_7_WORKING_CC_l2"/>
+	<value value="21" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_8_WORKING_CC_l2"/>
+	<value value="22" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_9_WORKING_CC_l2"/>
+	<value value="23" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_10_WORKING_CC_l2"/>
+	<value value="24" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_11_WORKING_CC_l2"/>
+	<value value="25" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_12_WORKING_CC_l2"/>
+	<value value="26" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_13_WORKING_CC_l2"/>
+	<value value="27" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_14_WORKING_CC_l2"/>
+	<value value="28" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_15_WORKING_CC_l2"/>
+	<value value="29" name="A7XX_PERF_RAS_FALSE_PARTIAL_STILE"/>
+
+</enum>
+
+<enum name="a7xx_uche_perfcounter_select">
+	<value value="0" name="A7XX_PERF_UCHE_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_UCHE_STALL_CYCLES_ARBITER"/>
+	<value value="2" name="A7XX_PERF_UCHE_VBIF_LATENCY_CYCLES"/>
+	<value value="3" name="A7XX_PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
+	<value value="4" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_TP"/>
+	<value value="5" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_VFD"/>
+	<value value="6" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
+	<value value="7" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
+	<value value="8" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_SP"/>
+	<value value="9" name="A7XX_PERF_UCHE_READ_REQUESTS_TP"/>
+	<value value="10" name="A7XX_PERF_UCHE_READ_REQUESTS_VFD"/>
+	<value value="11" name="A7XX_PERF_UCHE_READ_REQUESTS_HLSQ"/>
+	<value value="12" name="A7XX_PERF_UCHE_READ_REQUESTS_LRZ"/>
+	<value value="13" name="A7XX_PERF_UCHE_READ_REQUESTS_SP"/>
+	<value value="14" name="A7XX_PERF_UCHE_WRITE_REQUESTS_LRZ"/>
+	<value value="15" name="A7XX_PERF_UCHE_WRITE_REQUESTS_SP"/>
+	<value value="16" name="A7XX_PERF_UCHE_WRITE_REQUESTS_VPC"/>
+	<value value="17" name="A7XX_PERF_UCHE_WRITE_REQUESTS_VSC"/>
+	<value value="18" name="A7XX_PERF_UCHE_EVICTS"/>
+	<value value="19" name="A7XX_PERF_UCHE_BANK_REQ0"/>
+	<value value="20" name="A7XX_PERF_UCHE_BANK_REQ1"/>
+	<value value="21" name="A7XX_PERF_UCHE_BANK_REQ2"/>
+	<value value="22" name="A7XX_PERF_UCHE_BANK_REQ3"/>
+	<value value="23" name="A7XX_PERF_UCHE_BANK_REQ4"/>
+	<value value="24" name="A7XX_PERF_UCHE_BANK_REQ5"/>
+	<value value="25" name="A7XX_PERF_UCHE_BANK_REQ6"/>
+	<value value="26" name="A7XX_PERF_UCHE_BANK_REQ7"/>
+	<value value="27" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_CH0"/>
+	<value value="28" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_CH1"/>
+	<value value="29" name="A7XX_PERF_UCHE_GMEM_READ_BEATS"/>
+	<value value="30" name="A7XX_PERF_UCHE_TPH_REF_FULL"/>
+	<value value="31" name="A7XX_PERF_UCHE_TPH_VICTIM_FULL"/>
+	<value value="32" name="A7XX_PERF_UCHE_TPH_EXT_FULL"/>
+	<value value="33" name="A7XX_PERF_UCHE_VBIF_STALL_WRITE_DATA"/>
+	<value value="34" name="A7XX_PERF_UCHE_DCMP_LATENCY_SAMPLES"/>
+	<value value="35" name="A7XX_PERF_UCHE_DCMP_LATENCY_CYCLES"/>
+	<value value="36" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_PC"/>
+	<value value="37" name="A7XX_PERF_UCHE_READ_REQUESTS_PC"/>
+	<value value="38" name="A7XX_PERF_UCHE_RAM_READ_REQ"/>
+	<value value="39" name="A7XX_PERF_UCHE_RAM_WRITE_REQ"/>
+	<value value="40" name="A7XX_PERF_UCHE_STARVED_CYCLES_VBIF_DECMP"/>
+	<value value="41" name="A7XX_PERF_UCHE_STALL_CYCLES_DECMP"/>
+	<value value="42" name="A7XX_PERF_UCHE_ARBITER_STALL_CYCLES_VBIF"/>
+	<value value="43" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_UBWC"/>
+	<value value="44" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_NONUBWC"/>
+	<value value="45" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_GMEM"/>
+	<value value="46" name="A7XX_PERF_UCHE_LONG_LINE_ALL_EVICTS_KAILUA"/>
+	<value value="47" name="A7XX_PERF_UCHE_LONG_LINE_PARTIAL_EVICTS_KAILUA"/>
+	<value value="48" name="A7XX_PERF_UCHE_TPH_CONFLICT_CL_CCHE"/>
+	<value value="49" name="A7XX_PERF_UCHE_TPH_CONFLICT_CL_OTHER_KAILUA"/>
+	<value value="50" name="A7XX_PERF_UCHE_DBANK_CONFLICT_CL_CCHE"/>
+	<value value="51" name="A7XX_PERF_UCHE_DBANK_CONFLICT_CL_OTHER_CLIENTS"/>
+	<value value="52" name="A7XX_PERF_UCHE_VBIF_WRITE_BEATS_CH0"/>
+	<value value="53" name="A7XX_PERF_UCHE_VBIF_WRITE_BEATS_CH1"/>
+	<value value="54" name="A7XX_PERF_UCHE_CCHE_TPH_QUEUE_FULL"/>
+	<value value="55" name="A7XX_PERF_UCHE_CCHE_DPH_QUEUE_FULL"/>
+	<value value="56" name="A7XX_PERF_UCHE_GMEM_WRITE_BEATS"/>
+	<value value="57" name="A7XX_PERF_UCHE_UBWC_READ_BEATS"/>
+	<value value="58" name="A7XX_PERF_UCHE_UBWC_WRITE_BEATS"/>
+</enum>
+
+<enum name="a7xx_tp_perfcounter_select">
+	<value value="0" name="A7XX_PERF_TP_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_TP_STALL_CYCLES_UCHE"/>
+	<value value="2" name="A7XX_PERF_TP_LATENCY_CYCLES"/>
+	<value value="3" name="A7XX_PERF_TP_LATENCY_TRANS"/>
+	<value value="4" name="A7XX_PERF_TP_FLAG_FIFO_DELAY_SAMPLES"/>
+	<value value="5" name="A7XX_PERF_TP_FLAG_FIFO_DELAY_CYCLES"/>
+	<value value="6" name="A7XX_PERF_TP_L1_CACHELINE_REQUESTS"/>
+	<value value="7" name="A7XX_PERF_TP_L1_CACHELINE_MISSES"/>
+	<value value="8" name="A7XX_PERF_TP_SP_TP_TRANS"/>
+	<value value="9" name="A7XX_PERF_TP_TP_SP_TRANS"/>
+	<value value="10" name="A7XX_PERF_TP_OUTPUT_PIXELS"/>
+	<value value="11" name="A7XX_PERF_TP_FILTER_WORKLOAD_16BIT"/>
+	<value value="12" name="A7XX_PERF_TP_FILTER_WORKLOAD_32BIT"/>
+	<value value="13" name="A7XX_PERF_TP_QUADS_RECEIVED"/>
+	<value value="14" name="A7XX_PERF_TP_QUADS_OFFSET"/>
+	<value value="15" name="A7XX_PERF_TP_QUADS_SHADOW"/>
+	<value value="16" name="A7XX_PERF_TP_QUADS_ARRAY"/>
+	<value value="17" name="A7XX_PERF_TP_QUADS_GRADIENT"/>
+	<value value="18" name="A7XX_PERF_TP_QUADS_1D"/>
+	<value value="19" name="A7XX_PERF_TP_QUADS_2D"/>
+	<value value="20" name="A7XX_PERF_TP_QUADS_BUFFER"/>
+	<value value="21" name="A7XX_PERF_TP_QUADS_3D"/>
+	<value value="22" name="A7XX_PERF_TP_QUADS_CUBE"/>
+	<value value="23" name="A7XX_PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
+	<value value="24" name="A7XX_PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
+	<value value="25" name="A7XX_PERF_TP_OUTPUT_PIXELS_POINT"/>
+	<value value="26" name="A7XX_PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="27" name="A7XX_PERF_TP_OUTPUT_PIXELS_MIP"/>
+	<value value="28" name="A7XX_PERF_TP_OUTPUT_PIXELS_ANISO"/>
+	<value value="29" name="A7XX_PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
+	<value value="30" name="A7XX_PERF_TP_FLAG_CACHE_REQUESTS"/>
+	<value value="31" name="A7XX_PERF_TP_FLAG_CACHE_MISSES"/>
+	<value value="32" name="A7XX_PERF_TP_L1_5_L2_REQUESTS"/>
+	<value value="33" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS"/>
+	<value value="34" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
+	<value value="35" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
+	<value value="36" name="A7XX_PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
+	<value value="37" name="A7XX_PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
+	<value value="38" name="A7XX_PERF_TP_TPA2TPC_TRANS"/>
+	<value value="39" name="A7XX_PERF_TP_L1_MISSES_ASTC_1TILE"/>
+	<value value="40" name="A7XX_PERF_TP_L1_MISSES_ASTC_2TILE"/>
+	<value value="41" name="A7XX_PERF_TP_L1_MISSES_ASTC_4TILE"/>
+	<value value="42" name="A7XX_PERF_TP_L1_5_COMPRESS_REQS"/>
+	<value value="43" name="A7XX_PERF_TP_L1_5_L2_COMPRESS_MISS"/>
+	<value value="44" name="A7XX_PERF_TP_L1_BANK_CONFLICT"/>
+	<value value="45" name="A7XX_PERF_TP_L1_5_MISS_LATENCY_CYCLES"/>
+	<value value="46" name="A7XX_PERF_TP_L1_5_MISS_LATENCY_TRANS"/>
+	<value value="47" name="A7XX_PERF_TP_QUADS_CONSTANT_MULTIPLIED"/>
+	<value value="48" name="A7XX_PERF_TP_FRONTEND_WORKING_CYCLES"/>
+	<value value="49" name="A7XX_PERF_TP_L1_TAG_WORKING_CYCLES"/>
+	<value value="50" name="A7XX_PERF_TP_L1_DATA_WRITE_WORKING_CYCLES"/>
+	<value value="51" name="A7XX_PERF_TP_PRE_L1_DECOM_WORKING_CYCLES"/>
+	<value value="52" name="A7XX_PERF_TP_BACKEND_WORKING_CYCLES"/>
+	<value value="53" name="A7XX_PERF_TP_L1_5_CACHE_WORKING_CYCLES"/>
+	<value value="54" name="A7XX_PERF_TP_STARVE_CYCLES_SP"/>
+	<value value="55" name="A7XX_PERF_TP_STARVE_CYCLES_UCHE"/>
+	<value value="56" name="A7XX_PERF_TP_STALL_CYCLES_UFC"/>
+	<value value="57" name="A7XX_PERF_TP_FORMAT_DECOMP"/>
+	<value value="58" name="A7XX_PERF_TP_FILTER_POINT_FP16"/>
+	<value value="59" name="A7XX_PERF_TP_FILTER_POINT_FP32"/>
+	<value value="60" name="A7XX_PERF_TP_LATENCY_FIFO_FULL"/>
+	<value value="61" name="A7XX_PERF_TP_RESERVED_61"/>
+	<value value="62" name="A7XX_PERF_TP_RESERVED_62"/>
+	<value value="63" name="A7XX_PERF_TP_RESERVED_63"/>
+	<value value="64" name="A7XX_PERF_TP_RESERVED_64"/>
+	<value value="65" name="A7XX_PERF_TP_RESERVED_65"/>
+	<value value="66" name="A7XX_PERF_TP_RESERVED_66"/>
+	<value value="67" name="A7XX_PERF_TP_RESERVED_67"/>
+	<value value="68" name="A7XX_PERF_TP_RESERVED_68"/>
+	<value value="69" name="A7XX_PERF_TP_RESERVED_69"/>
+	<value value="70" name="A7XX_PERF_TP_RESERVED_70"/>
+	<value value="71" name="A7XX_PERF_TP_RESERVED_71"/>
+	<value value="72" name="A7XX_PERF_TP_RESERVED_72"/>
+	<value value="73" name="A7XX_PERF_TP_RESERVED_73"/>
+	<value value="74" name="A7XX_PERF_TP_RESERVED_74"/>
+	<value value="75" name="A7XX_PERF_TP_RESERVED_75"/>
+	<value value="76" name="A7XX_PERF_TP_RESERVED_76"/>
+	<value value="77" name="A7XX_PERF_TP_RESERVED_77"/>
+	<value value="78" name="A7XX_PERF_TP_RESERVED_78"/>
+	<value value="79" name="A7XX_PERF_TP_RESERVED_79"/>
+	<value value="80" name="A7XX_PERF_TP_RESERVED_80"/>
+	<value value="81" name="A7XX_PERF_TP_RESERVED_81"/>
+	<value value="82" name="A7XX_PERF_TP_RESERVED_82"/>
+	<value value="83" name="A7XX_PERF_TP_RESERVED_83"/>
+	<value value="84" name="A7XX_PERF_TP_RESERVED_84"/>
+	<value value="85" name="A7XX_PERF_TP_RESERVED_85"/>
+	<value value="86" name="A7XX_PERF_TP_RESERVED_86"/>
+	<value value="87" name="A7XX_PERF_TP_RESERVED_87"/>
+	<value value="88" name="A7XX_PERF_TP_RESERVED_88"/>
+	<value value="89" name="A7XX_PERF_TP_RESERVED_89"/>
+	<value value="90" name="A7XX_PERF_TP_RESERVED_90"/>
+	<value value="91" name="A7XX_PERF_TP_RESERVED_91"/>
+	<value value="92" name="A7XX_PERF_TP_RESERVED_92"/>
+	<value value="93" name="A7XX_PERF_TP_RESERVED_93"/>
+	<value value="94" name="A7XX_PERF_TP_RESERVED_94"/>
+	<value value="95" name="A7XX_PERF_TP_RESERVED_95"/>
+	<value value="96" name="A7XX_PERF_TP_RESERVED_96"/>
+	<value value="97" name="A7XX_PERF_TP_RESERVED_97"/>
+	<value value="98" name="A7XX_PERF_TP_RESERVED_98"/>
+	<value value="99" name="A7XX_PERF_TP_RESERVED_99"/>
+	<value value="100" name="A7XX_PERF_TP_RESERVED_100"/>
+	<value value="101" name="A7XX_PERF_TP_RESERVED_101"/>
+	<value value="102" name="A7XX_PERF_TP_RESERVED_102"/>
+	<value value="103" name="A7XX_PERF_TP_RESERVED_103"/>
+	<value value="104" name="A7XX_PERF_TP_RESERVED_104"/>
+	<value value="105" name="A7XX_PERF_TP_RESERVED_105"/>
+	<value value="106" name="A7XX_PERF_TP_RESERVED_106"/>
+	<value value="107" name="A7XX_PERF_TP_RESERVED_107"/>
+	<value value="108" name="A7XX_PERF_TP_RESERVED_108"/>
+	<value value="109" name="A7XX_PERF_TP_RESERVED_109"/>
+	<value value="110" name="A7XX_PERF_TP_RESERVED_110"/>
+	<value value="111" name="A7XX_PERF_TP_RESERVED_111"/>
+	<value value="112" name="A7XX_PERF_TP_RESERVED_112"/>
+	<value value="113" name="A7XX_PERF_TP_RESERVED_113"/>
+	<value value="114" name="A7XX_PERF_TP_RESERVED_114"/>
+	<value value="115" name="A7XX_PERF_TP_RESERVED_115"/>
+	<value value="116" name="A7XX_PERF_TP_RESERVED_116"/>
+	<value value="117" name="A7XX_PERF_TP_RESERVED_117"/>
+	<value value="118" name="A7XX_PERF_TP_RESERVED_118"/>
+	<value value="119" name="A7XX_PERF_TP_RESERVED_119"/>
+	<value value="120" name="A7XX_PERF_TP_RESERVED_120"/>
+	<value value="121" name="A7XX_PERF_TP_RESERVED_121"/>
+	<value value="122" name="A7XX_PERF_TP_RESERVED_122"/>
+	<value value="123" name="A7XX_PERF_TP_RESERVED_123"/>
+	<value value="124" name="A7XX_PERF_TP_RESERVED_124"/>
+	<value value="125" name="A7XX_PERF_TP_RESERVED_125"/>
+	<value value="126" name="A7XX_PERF_TP_RESERVED_126"/>
+	<value value="127" name="A7XX_PERF_TP_RESERVED_127"/>
+	<value value="128" name="A7XX_PERF_TP_FORMAT_DECOMP_BILINEAR"/>
+	<value value="129" name="A7XX_PERF_TP_PACKED_POINT_BOTH_VALID_FP16"/>
+	<value value="130" name="A7XX_PERF_TP_PACKED_POINT_SINGLE_VALID_FP16"/>
+	<value value="131" name="A7XX_PERF_TP_PACKED_POINT_BOTH_VALID_FP32"/>
+	<value value="132" name="A7XX_PERF_TP_PACKED_POINT_SINGLE_VALID_FP32"/>
+</enum>
+
+<enum name="a7xx_sp_perfcounter_select">
+	<value value="0" name="A7XX_PERF_SP_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_SP_ALU_WORKING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_SP_EFU_WORKING_CYCLES"/>
+	<value value="3" name="A7XX_PERF_SP_STALL_CYCLES_VPC"/>
+	<value value="4" name="A7XX_PERF_SP_STALL_CYCLES_TP"/>
+	<value value="5" name="A7XX_PERF_SP_STALL_CYCLES_UCHE"/>
+	<value value="6" name="A7XX_PERF_SP_STALL_CYCLES_RB"/>
+	<value value="7" name="A7XX_PERF_SP_NON_EXECUTION_CYCLES"/>
+	<value value="8" name="A7XX_PERF_SP_WAVE_CONTEXTS"/>
+	<value value="9" name="A7XX_PERF_SP_WAVE_CONTEXT_CYCLES"/>
+	<value value="10" name="A7XX_PERF_SP_STAGE_WAVE_CYCLES"/>
+	<value value="11" name="A7XX_PERF_SP_STAGE_WAVE_SAMPLES"/>
+	<value value="12" name="A7XX_PERF_SP_VS_STAGE_WAVE_CYCLES"/>
+	<value value="13" name="A7XX_PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
+	<value value="14" name="A7XX_PERF_SP_FS_STAGE_DURATION_CYCLES"/>
+	<value value="15" name="A7XX_PERF_SP_VS_STAGE_DURATION_CYCLES"/>
+	<value value="16" name="A7XX_PERF_SP_WAVE_CTRL_CYCLES"/>
+	<value value="17" name="A7XX_PERF_SP_WAVE_LOAD_CYCLES"/>
+	<value value="18" name="A7XX_PERF_SP_WAVE_EMIT_CYCLES"/>
+	<value value="19" name="A7XX_PERF_SP_WAVE_NOP_CYCLES"/>
+	<value value="20" name="A7XX_PERF_SP_WAVE_WAIT_CYCLES"/>
+	<value value="21" name="A7XX_PERF_SP_WAVE_FETCH_CYCLES"/>
+	<value value="22" name="A7XX_PERF_SP_WAVE_IDLE_CYCLES"/>
+	<value value="23" name="A7XX_PERF_SP_WAVE_END_CYCLES"/>
+	<value value="24" name="A7XX_PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
+	<value value="25" name="A7XX_PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
+	<value value="26" name="A7XX_PERF_SP_WAVE_JOIN_CYCLES"/>
+	<value value="27" name="A7XX_PERF_SP_LM_LOAD_INSTRUCTIONS"/>
+	<value value="28" name="A7XX_PERF_SP_LM_STORE_INSTRUCTIONS"/>
+	<value value="29" name="A7XX_PERF_SP_LM_ATOMICS"/>
+	<value value="30" name="A7XX_PERF_SP_GM_LOAD_INSTRUCTIONS"/>
+	<value value="31" name="A7XX_PERF_SP_GM_STORE_INSTRUCTIONS"/>
+	<value value="32" name="A7XX_PERF_SP_GM_ATOMICS"/>
+	<value value="33" name="A7XX_PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="34" name="A7XX_PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="35" name="A7XX_PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="36" name="A7XX_PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="37" name="A7XX_PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+	<value value="38" name="A7XX_PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+	<value value="39" name="A7XX_PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+	<value value="40" name="A7XX_PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+	<value value="41" name="A7XX_PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+	<value value="42" name="A7XX_PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
+	<value value="43" name="A7XX_PERF_SP_VS_INSTRUCTIONS"/>
+	<value value="44" name="A7XX_PERF_SP_FS_INSTRUCTIONS"/>
+	<value value="45" name="A7XX_PERF_SP_ADDR_LOCK_COUNT"/>
+	<value value="46" name="A7XX_PERF_SP_UCHE_READ_TRANS"/>
+	<value value="47" name="A7XX_PERF_SP_UCHE_WRITE_TRANS"/>
+	<value value="48" name="A7XX_PERF_SP_EXPORT_VPC_TRANS"/>
+	<value value="49" name="A7XX_PERF_SP_EXPORT_RB_TRANS"/>
+	<value value="50" name="A7XX_PERF_SP_PIXELS_KILLED"/>
+	<value value="51" name="A7XX_PERF_SP_ICL1_REQUESTS"/>
+	<value value="52" name="A7XX_PERF_SP_ICL1_MISSES"/>
+	<value value="53" name="A7XX_PERF_SP_HS_INSTRUCTIONS"/>
+	<value value="54" name="A7XX_PERF_SP_DS_INSTRUCTIONS"/>
+	<value value="55" name="A7XX_PERF_SP_GS_INSTRUCTIONS"/>
+	<value value="56" name="A7XX_PERF_SP_CS_INSTRUCTIONS"/>
+	<value value="57" name="A7XX_PERF_SP_GPR_READ"/>
+	<value value="58" name="A7XX_PERF_SP_GPR_WRITE"/>
+	<value value="59" name="A7XX_PERF_SP_FS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+	<value value="60" name="A7XX_PERF_SP_VS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+	<value value="61" name="A7XX_PERF_SP_LM_BANK_CONFLICTS"/>
+	<value value="62" name="A7XX_PERF_SP_TEX_CONTROL_WORKING_CYCLES"/>
+	<value value="63" name="A7XX_PERF_SP_LOAD_CONTROL_WORKING_CYCLES"/>
+	<value value="64" name="A7XX_PERF_SP_FLOW_CONTROL_WORKING_CYCLES"/>
+	<value value="65" name="A7XX_PERF_SP_LM_WORKING_CYCLES"/>
+	<value value="66" name="A7XX_PERF_SP_DISPATCHER_WORKING_CYCLES"/>
+	<value value="67" name="A7XX_PERF_SP_SEQUENCER_WORKING_CYCLES"/>
+	<value value="68" name="A7XX_PERF_SP_LOW_EFFICIENCY_STARVED_BY_TP"/>
+	<value value="69" name="A7XX_PERF_SP_STARVE_CYCLES_HLSQ"/>
+	<value value="70" name="A7XX_PERF_SP_NON_EXECUTION_LS_CYCLES"/>
+	<value value="71" name="A7XX_PERF_SP_WORKING_EU"/>
+	<value value="72" name="A7XX_PERF_SP_ANY_EU_WORKING"/>
+	<value value="73" name="A7XX_PERF_SP_WORKING_EU_FS_STAGE"/>
+	<value value="74" name="A7XX_PERF_SP_ANY_EU_WORKING_FS_STAGE"/>
+	<value value="75" name="A7XX_PERF_SP_WORKING_EU_VS_STAGE"/>
+	<value value="76" name="A7XX_PERF_SP_ANY_EU_WORKING_VS_STAGE"/>
+	<value value="77" name="A7XX_PERF_SP_WORKING_EU_CS_STAGE"/>
+	<value value="78" name="A7XX_PERF_SP_ANY_EU_WORKING_CS_STAGE"/>
+	<value value="79" name="A7XX_PERF_SP_GPR_READ_PREFETCH"/>
+	<value value="80" name="A7XX_PERF_SP_GPR_READ_CONFLICT"/>
+	<value value="81" name="A7XX_PERF_SP_GPR_WRITE_CONFLICT"/>
+	<value value="82" name="A7XX_PERF_SP_GM_LOAD_LATENCY_CYCLES"/>
+	<value value="83" name="A7XX_PERF_SP_GM_LOAD_LATENCY_SAMPLES"/>
+	<value value="84" name="A7XX_PERF_SP_EXECUTABLE_WAVES"/>
+	<value value="85" name="A7XX_PERF_SP_ICL1_MISS_FETCH_CYCLES"/>
+	<value value="86" name="A7XX_PERF_SP_WORKING_EU_LPAC"/>
+	<value value="87" name="A7XX_PERF_SP_BYPASS_BUSY_CYCLES"/>
+	<value value="88" name="A7XX_PERF_SP_ANY_EU_WORKING_LPAC"/>
+	<value value="89" name="A7XX_PERF_SP_WAVE_ALU_CYCLES"/>
+	<value value="90" name="A7XX_PERF_SP_WAVE_EFU_CYCLES"/>
+	<value value="91" name="A7XX_PERF_SP_WAVE_INT_CYCLES"/>
+	<value value="92" name="A7XX_PERF_SP_WAVE_CSP_CYCLES"/>
+	<value value="93" name="A7XX_PERF_SP_EWAVE_CONTEXTS"/>
+	<value value="94" name="A7XX_PERF_SP_EWAVE_CONTEXT_CYCLES"/>
+	<value value="95" name="A7XX_PERF_SP_LPAC_BUSY_CYCLES"/>
+	<value value="96" name="A7XX_PERF_SP_LPAC_INSTRUCTIONS"/>
+	<value value="97" name="A7XX_PERF_SP_FS_STAGE_1X_WAVES"/>
+	<value value="98" name="A7XX_PERF_SP_FS_STAGE_2X_WAVES"/>
+	<value value="99" name="A7XX_PERF_SP_QUADS"/>
+	<value value="100" name="A7XX_PERF_SP_CS_INVOCATIONS"/>
+	<value value="101" name="A7XX_PERF_SP_PIXELS"/>
+	<value value="102" name="A7XX_PERF_SP_LPAC_DRAWCALLS"/>
+	<value value="103" name="A7XX_PERF_SP_PI_WORKING_CYCLES"/>
+	<value value="104" name="A7XX_PERF_SP_WAVE_INPUT_CYCLES"/>
+	<value value="105" name="A7XX_PERF_SP_WAVE_OUTPUT_CYCLES"/>
+	<value value="106" name="A7XX_PERF_SP_WAVE_HWAVE_WAIT_CYCLES"/>
+	<value value="107" name="A7XX_PERF_SP_WAVE_HWAVE_SYNC"/>
+	<value value="108" name="A7XX_PERF_SP_OUTPUT_3D_PIXELS"/>
+	<value value="109" name="A7XX_PERF_SP_FULL_ALU_MAD_INSTRUCTIONS"/>
+	<value value="110" name="A7XX_PERF_SP_HALF_ALU_MAD_INSTRUCTIONS"/>
+	<value value="111" name="A7XX_PERF_SP_FULL_ALU_MUL_INSTRUCTIONS"/>
+	<value value="112" name="A7XX_PERF_SP_HALF_ALU_MUL_INSTRUCTIONS"/>
+	<value value="113" name="A7XX_PERF_SP_FULL_ALU_ADD_INSTRUCTIONS"/>
+	<value value="114" name="A7XX_PERF_SP_HALF_ALU_ADD_INSTRUCTIONS"/>
+	<value value="115" name="A7XX_PERF_SP_BARY_FP32_INSTRUCTIONS"/>
+	<value value="116" name="A7XX_PERF_SP_ALU_GPR_READ_CYCLES"/>
+	<value value="117" name="A7XX_PERF_SP_ALU_DATA_FORWARDING_CYCLES"/>
+	<value value="118" name="A7XX_PERF_SP_LM_FULL_CYCLES"/>
+	<value value="119" name="A7XX_PERF_SP_TEXTURE_FETCH_LATENCY_CYCLES"/>
+	<value value="120" name="A7XX_PERF_SP_TEXTURE_FETCH_LATENCY_SAMPLES"/>
+	<value value="121" name="A7XX_PERF_SP_FS_STAGE_PI_TEX_INSTRUCTION"/>
+	<value value="122" name="A7XX_PERF_SP_RAY_QUERY_INSTRUCTIONS"/>
+	<value value="123" name="A7XX_PERF_SP_RBRT_KICKOFF_FIBERS"/>
+	<value value="124" name="A7XX_PERF_SP_RBRT_KICKOFF_DQUADS"/>
+	<value value="125" name="A7XX_PERF_SP_RTU_BUSY_CYCLES"/>
+	<value value="126" name="A7XX_PERF_SP_RTU_L0_HITS"/>
+	<value value="127" name="A7XX_PERF_SP_RTU_L0_MISSES"/>
+	<value value="128" name="A7XX_PERF_SP_RTU_L0_HIT_ON_MISS"/>
+	<value value="129" name="A7XX_PERF_SP_RTU_STALL_CYCLES_WAVE_QUEUE"/>
+	<value value="130" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0_HIT_QUEUE"/>
+	<value value="131" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0_MISS_QUEUE"/>
+	<value value="132" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0D_IDX_QUEUE"/>
+	<value value="133" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0DATA"/>
+	<value value="134" name="A7XX_PERF_SP_RTU_STALL_CYCLES_REPLACE_CNT"/>
+	<value value="135" name="A7XX_PERF_SP_RTU_STALL_CYCLES_MRG_CNT"/>
+	<value value="136" name="A7XX_PERF_SP_RTU_STALL_CYCLES_UCHE"/>
+	<value value="137" name="A7XX_PERF_SP_RTU_OPERAND_FETCH_STALL_CYCLES_L0"/>
+	<value value="138" name="A7XX_PERF_SP_RTU_OPERAND_FETCH_STALL_CYCLES_INS_FIFO"/>
+	<value value="139" name="A7XX_PERF_SP_RTU_BVH_FETCH_LATENCY_CYCLES"/>
+	<value value="140" name="A7XX_PERF_SP_RTU_BVH_FETCH_LATENCY_SAMPLES"/>
+	<value value="141" name="A7XX_PERF_SP_STCHE_MISS_INC_VS"/>
+	<value value="142" name="A7XX_PERF_SP_STCHE_MISS_INC_FS"/>
+	<value value="143" name="A7XX_PERF_SP_STCHE_MISS_INC_BV"/>
+	<value value="144" name="A7XX_PERF_SP_STCHE_MISS_INC_LPAC"/>
+	<value value="145" name="A7XX_PERF_SP_VGPR_ACTIVE_CONTEXTS"/>
+	<value value="146" name="A7XX_PERF_SP_PGPR_ALLOC_CONTEXTS"/>
+	<value value="147" name="A7XX_PERF_SP_VGPR_ALLOC_CONTEXTS"/>
+	<value value="148" name="A7XX_PERF_SP_RTU_RAY_BOX_INTERSECTIONS"/>
+	<value value="149" name="A7XX_PERF_SP_RTU_RAY_TRIANGLE_INTERSECTIONS"/>
+	<value value="150" name="A7XX_PERF_SP_SCH_STALL_CYCLES_RTU"/>
+</enum>
+
+<enum name="a7xx_rb_perfcounter_select">
+	<value value="0" name="A7XX_PERF_RB_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_RB_STALL_CYCLES_HLSQ"/>
+	<value value="2" name="A7XX_PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
+	<value value="3" name="A7XX_PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
+	<value value="4" name="A7XX_PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
+	<value value="5" name="A7XX_PERF_RB_STARVE_CYCLES_SP"/>
+	<value value="6" name="A7XX_PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
+	<value value="7" name="A7XX_PERF_RB_STARVE_CYCLES_CCU"/>
+	<value value="8" name="A7XX_PERF_RB_STARVE_CYCLES_Z_PLANE"/>
+	<value value="9" name="A7XX_PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
+	<value value="10" name="A7XX_PERF_RB_Z_WORKLOAD"/>
+	<value value="11" name="A7XX_PERF_RB_HLSQ_ACTIVE"/>
+	<value value="12" name="A7XX_PERF_RB_Z_READ"/>
+	<value value="13" name="A7XX_PERF_RB_Z_WRITE"/>
+	<value value="14" name="A7XX_PERF_RB_C_READ"/>
+	<value value="15" name="A7XX_PERF_RB_C_WRITE"/>
+	<value value="16" name="A7XX_PERF_RB_TOTAL_PASS"/>
+	<value value="17" name="A7XX_PERF_RB_Z_PASS"/>
+	<value value="18" name="A7XX_PERF_RB_Z_FAIL"/>
+	<value value="19" name="A7XX_PERF_RB_S_FAIL"/>
+	<value value="20" name="A7XX_PERF_RB_BLENDED_FXP_COMPONENTS"/>
+	<value value="21" name="A7XX_PERF_RB_BLENDED_FP16_COMPONENTS"/>
+	<value value="22" name="A7XX_PERF_RB_PS_INVOCATIONS"/>
+	<value value="23" name="A7XX_PERF_RB_2D_ALIVE_CYCLES"/>
+	<value value="24" name="A7XX_PERF_RB_2D_STALL_CYCLES_A2D"/>
+	<value value="25" name="A7XX_PERF_RB_2D_STARVE_CYCLES_SRC"/>
+	<value value="26" name="A7XX_PERF_RB_2D_STARVE_CYCLES_SP"/>
+	<value value="27" name="A7XX_PERF_RB_2D_STARVE_CYCLES_DST"/>
+	<value value="28" name="A7XX_PERF_RB_2D_VALID_PIXELS"/>
+	<value value="29" name="A7XX_PERF_RB_3D_PIXELS"/>
+	<value value="30" name="A7XX_PERF_RB_BLENDER_WORKING_CYCLES"/>
+	<value value="31" name="A7XX_PERF_RB_ZPROC_WORKING_CYCLES"/>
+	<value value="32" name="A7XX_PERF_RB_CPROC_WORKING_CYCLES"/>
+	<value value="33" name="A7XX_PERF_RB_SAMPLER_WORKING_CYCLES"/>
+	<value value="34" name="A7XX_PERF_RB_STALL_CYCLES_CCU_COLOR_READ"/>
+	<value value="35" name="A7XX_PERF_RB_STALL_CYCLES_CCU_COLOR_WRITE"/>
+	<value value="36" name="A7XX_PERF_RB_STALL_CYCLES_CCU_DEPTH_READ"/>
+	<value value="37" name="A7XX_PERF_RB_STALL_CYCLES_CCU_DEPTH_WRITE"/>
+	<value value="38" name="A7XX_PERF_RB_STALL_CYCLES_VPC"/>
+	<value value="39" name="A7XX_PERF_RB_2D_INPUT_TRANS"/>
+	<value value="40" name="A7XX_PERF_RB_2D_OUTPUT_RB_DST_TRANS"/>
+	<value value="41" name="A7XX_PERF_RB_2D_OUTPUT_RB_SRC_TRANS"/>
+	<value value="42" name="A7XX_PERF_RB_BLENDED_FP32_COMPONENTS"/>
+	<value value="43" name="A7XX_PERF_RB_COLOR_PIX_TILES"/>
+	<value value="44" name="A7XX_PERF_RB_STALL_CYCLES_CCU"/>
+	<value value="45" name="A7XX_PERF_RB_EARLY_Z_ARB3_GRANT"/>
+	<value value="46" name="A7XX_PERF_RB_LATE_Z_ARB3_GRANT"/>
+	<value value="47" name="A7XX_PERF_RB_EARLY_Z_SKIP_GRANT"/>
+	<value value="48" name="A7XX_PERF_RB_VRS_1x1_QUADS"/>
+	<value value="49" name="A7XX_PERF_RB_VRS_2x1_QUADS"/>
+	<value value="50" name="A7XX_PERF_RB_VRS_1x2_QUADS"/>
+	<value value="51" name="A7XX_PERF_RB_VRS_2x2_QUADS"/>
+	<value value="52" name="A7XX_PERF_RB_VRS_4x2_QUADS"/>
+	<value value="53" name="A7XX_PERF_RB_VRS_4x4_QUADS"/>
+</enum>
+
+<enum name="a7xx_vsc_perfcounter_select">
+	<value value="0" name="A7XX_PERF_VSC_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_VSC_WORKING_CYCLES"/>
+	<value value="2" name="A7XX_PERF_VSC_STALL_CYCLES_UCHE"/>
+	<value value="3" name="A7XX_PERF_VSC_EOT_NUM"/>
+	<value value="4" name="A7XX_PERF_VSC_INPUT_TILES"/>
+</enum>
+
+<enum name="a7xx_ccu_perfcounter_select">
+	<value value="0" name="A7XX_PERF_CCU_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
+	<value value="2" name="A7XX_PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
+	<value value="3" name="A7XX_PERF_CCU_DEPTH_BLOCKS"/>
+	<value value="4" name="A7XX_PERF_CCU_COLOR_BLOCKS"/>
+	<value value="5" name="A7XX_PERF_CCU_DEPTH_BLOCK_HIT"/>
+	<value value="6" name="A7XX_PERF_CCU_COLOR_BLOCK_HIT"/>
+	<value value="7" name="A7XX_PERF_CCU_PARTIAL_BLOCK_READ"/>
+	<value value="8" name="A7XX_PERF_CCU_GMEM_READ"/>
+	<value value="9" name="A7XX_PERF_CCU_GMEM_WRITE"/>
+	<value value="10" name="A7XX_PERF_CCU_2D_RD_REQ"/>
+	<value value="11" name="A7XX_PERF_CCU_2D_WR_REQ"/>
+	<value value="12" name="A7XX_PERF_CCU_UBWC_COLOR_BLOCKS_CONCURRENT"/>
+	<value value="13" name="A7XX_PERF_CCU_UBWC_DEPTH_BLOCKS_CONCURRENT"/>
+	<value value="14" name="A7XX_PERF_CCU_COLOR_RESOLVE_DROPPED"/>
+	<value value="15" name="A7XX_PERF_CCU_DEPTH_RESOLVE_DROPPED"/>
+	<value value="16" name="A7XX_PERF_CCU_COLOR_RENDER_CONCURRENT"/>
+	<value value="17" name="A7XX_PERF_CCU_DEPTH_RENDER_CONCURRENT"/>
+	<value value="18" name="A7XX_PERF_CCU_COLOR_RESOLVE_AFTER_RENDER"/>
+	<value value="19" name="A7XX_PERF_CCU_DEPTH_RESOLVE_AFTER_RENDER"/>
+	<value value="20" name="A7XX_PERF_CCU_GMEM_EXTRA_DEPTH_READ"/>
+	<value value="21" name="A7XX_PERF_CCU_GMEM_COLOR_READ_4AA"/>
+	<value value="22" name="A7XX_PERF_CCU_GMEM_COLOR_READ_4AA_FULL"/>
+</enum>
+
+<enum name="a7xx_lrz_perfcounter_select">
+	<value value="0" name="A7XX_PERF_LRZ_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_LRZ_STARVE_CYCLES_RAS"/>
+	<value value="2" name="A7XX_PERF_LRZ_STALL_CYCLES_RB"/>
+	<value value="3" name="A7XX_PERF_LRZ_STALL_CYCLES_VSC"/>
+	<value value="4" name="A7XX_PERF_LRZ_STALL_CYCLES_VPC"/>
+	<value value="5" name="A7XX_PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
+	<value value="6" name="A7XX_PERF_LRZ_STALL_CYCLES_UCHE"/>
+	<value value="7" name="A7XX_PERF_LRZ_LRZ_READ"/>
+	<value value="8" name="A7XX_PERF_LRZ_LRZ_WRITE"/>
+	<value value="9" name="A7XX_PERF_LRZ_READ_LATENCY"/>
+	<value value="10" name="A7XX_PERF_LRZ_MERGE_CACHE_UPDATING"/>
+	<value value="11" name="A7XX_PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
+	<value value="12" name="A7XX_PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
+	<value value="13" name="A7XX_PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
+	<value value="14" name="A7XX_PERF_LRZ_FULL_8X8_TILES"/>
+	<value value="15" name="A7XX_PERF_LRZ_PARTIAL_8X8_TILES"/>
+	<value value="16" name="A7XX_PERF_LRZ_TILE_KILLED"/>
+	<value value="17" name="A7XX_PERF_LRZ_TOTAL_PIXEL"/>
+	<value value="18" name="A7XX_PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
+	<value value="19" name="A7XX_PERF_LRZ_FEEDBACK_ACCEPT"/>
+	<value value="20" name="A7XX_PERF_LRZ_FEEDBACK_DISCARD"/>
+	<value value="21" name="A7XX_PERF_LRZ_FEEDBACK_STALL"/>
+	<value value="22" name="A7XX_PERF_LRZ_STALL_CYCLES_RB_ZPLANE"/>
+	<value value="23" name="A7XX_PERF_LRZ_STALL_CYCLES_RB_BPLANE"/>
+	<value value="24" name="A7XX_PERF_LRZ_RAS_MASK_TRANS"/>
+	<value value="25" name="A7XX_PERF_LRZ_STALL_CYCLES_MVC"/>
+	<value value="26" name="A7XX_PERF_LRZ_TILE_KILLED_BY_IMAGE_VRS"/>
+	<value value="27" name="A7XX_PERF_LRZ_TILE_KILLED_BY_Z"/>
+</enum>
+
+<enum name="a7xx_cmp_perfcounter_select">
+	<value value="0" name="A7XX_PERF_CMPDECMP_STALL_CYCLES_ARB"/>
+	<value value="1" name="A7XX_PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
+	<value value="2" name="A7XX_PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
+	<value value="3" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
+	<value value="4" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
+	<value value="5" name="A7XX_PERF_CMPDECMP_VBIF_READ_REQUEST"/>
+	<value value="6" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
+	<value value="7" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA"/>
+	<value value="8" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA"/>
+	<value value="9" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
+	<value value="10" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
+	<value value="11" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
+	<value value="12" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
+	<value value="13" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG5_COUNT"/>
+	<value value="14" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG6_COUNT"/>
+	<value value="15" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG8_COUNT"/>
+	<value value="16" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
+	<value value="17" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
+	<value value="18" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
+	<value value="19" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
+	<value value="20" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG5_COUNT"/>
+	<value value="21" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG6_COUNT"/>
+	<value value="22" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG8_COUNT"/>
+	<value value="23" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH0"/>
+	<value value="24" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH1"/>
+	<value value="25" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA_UCHE"/>
+	<value value="26" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG0_COUNT"/>
+	<value value="27" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG0_COUNT"/>
+	<value value="28" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAGALPHA_COUNT"/>
+	<value value="29" name="A7XX_PERF_CMPDECMP_RESOLVE_EVENTS"/>
+	<value value="30" name="A7XX_PERF_CMPDECMP_CONCURRENT_RESOLVE_EVENTS"/>
+	<value value="31" name="A7XX_PERF_CMPDECMP_DROPPED_CLEAR_EVENTS"/>
+	<value value="32" name="A7XX_PERF_CMPDECMP_ST_BLOCKS_CONCURRENT"/>
+	<value value="33" name="A7XX_PERF_CMPDECMP_LRZ_ST_BLOCKS_CONCURRENT"/>
+	<value value="34" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG0_COUNT"/>
+	<value value="35" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG1_COUNT"/>
+	<value value="36" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG2_COUNT"/>
+	<value value="37" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG3_COUNT"/>
+	<value value="38" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG4_COUNT"/>
+	<value value="39" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG5_COUNT"/>
+	<value value="40" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG6_COUNT"/>
+	<value value="41" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG8_COUNT"/>
+	<value value="42" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG0_COUNT"/>
+	<value value="43" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG1_COUNT"/>
+	<value value="44" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG2_COUNT"/>
+	<value value="45" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG3_COUNT"/>
+	<value value="46" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG4_COUNT"/>
+	<value value="47" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG5_COUNT"/>
+	<value value="48" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG6_COUNT"/>
+	<value value="49" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG8_COUNT"/>
+</enum>
+
+<enum name="a7xx_gbif_perfcounter_select">
+	<value value="0" name="A7XX_PERF_GBIF_RESERVED_0"/>
+	<value value="1" name="A7XX_PERF_GBIF_RESERVED_1"/>
+	<value value="2" name="A7XX_PERF_GBIF_RESERVED_2"/>
+	<value value="3" name="A7XX_PERF_GBIF_RESERVED_3"/>
+	<value value="4" name="A7XX_PERF_GBIF_RESERVED_4"/>
+	<value value="5" name="A7XX_PERF_GBIF_RESERVED_5"/>
+	<value value="6" name="A7XX_PERF_GBIF_RESERVED_6"/>
+	<value value="7" name="A7XX_PERF_GBIF_RESERVED_7"/>
+	<value value="8" name="A7XX_PERF_GBIF_RESERVED_8"/>
+	<value value="9" name="A7XX_PERF_GBIF_RESERVED_9"/>
+	<value value="10" name="A7XX_PERF_GBIF_AXI0_READ_REQUESTS_TOTAL"/>
+	<value value="11" name="A7XX_PERF_GBIF_AXI1_READ_REQUESTS_TOTAL"/>
+	<value value="12" name="A7XX_PERF_GBIF_RESERVED_12"/>
+	<value value="13" name="A7XX_PERF_GBIF_RESERVED_13"/>
+	<value value="14" name="A7XX_PERF_GBIF_RESERVED_14"/>
+	<value value="15" name="A7XX_PERF_GBIF_RESERVED_15"/>
+	<value value="16" name="A7XX_PERF_GBIF_RESERVED_16"/>
+	<value value="17" name="A7XX_PERF_GBIF_RESERVED_17"/>
+	<value value="18" name="A7XX_PERF_GBIF_RESERVED_18"/>
+	<value value="19" name="A7XX_PERF_GBIF_RESERVED_19"/>
+	<value value="20" name="A7XX_PERF_GBIF_RESERVED_20"/>
+	<value value="21" name="A7XX_PERF_GBIF_RESERVED_21"/>
+	<value value="22" name="A7XX_PERF_GBIF_AXI0_WRITE_REQUESTS_TOTAL"/>
+	<value value="23" name="A7XX_PERF_GBIF_AXI1_WRITE_REQUESTS_TOTAL"/>
+	<value value="24" name="A7XX_PERF_GBIF_RESERVED_24"/>
+	<value value="25" name="A7XX_PERF_GBIF_RESERVED_25"/>
+	<value value="26" name="A7XX_PERF_GBIF_RESERVED_26"/>
+	<value value="27" name="A7XX_PERF_GBIF_RESERVED_27"/>
+	<value value="28" name="A7XX_PERF_GBIF_RESERVED_28"/>
+	<value value="29" name="A7XX_PERF_GBIF_RESERVED_29"/>
+	<value value="30" name="A7XX_PERF_GBIF_RESERVED_30"/>
+	<value value="31" name="A7XX_PERF_GBIF_RESERVED_31"/>
+	<value value="32" name="A7XX_PERF_GBIF_RESERVED_32"/>
+	<value value="33" name="A7XX_PERF_GBIF_RESERVED_33"/>
+	<value value="34" name="A7XX_PERF_GBIF_AXI0_READ_DATA_BEATS_TOTAL"/>
+	<value value="35" name="A7XX_PERF_GBIF_AXI1_READ_DATA_BEATS_TOTAL"/>
+	<value value="36" name="A7XX_PERF_GBIF_RESERVED_36"/>
+	<value value="37" name="A7XX_PERF_GBIF_RESERVED_37"/>
+	<value value="38" name="A7XX_PERF_GBIF_RESERVED_38"/>
+	<value value="39" name="A7XX_PERF_GBIF_RESERVED_39"/>
+	<value value="40" name="A7XX_PERF_GBIF_RESERVED_40"/>
+	<value value="41" name="A7XX_PERF_GBIF_RESERVED_41"/>
+	<value value="42" name="A7XX_PERF_GBIF_RESERVED_42"/>
+	<value value="43" name="A7XX_PERF_GBIF_RESERVED_43"/>
+	<value value="44" name="A7XX_PERF_GBIF_RESERVED_44"/>
+	<value value="45" name="A7XX_PERF_GBIF_RESERVED_45"/>
+	<value value="46" name="A7XX_PERF_GBIF_AXI0_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="47" name="A7XX_PERF_GBIF_AXI1_WRITE_DATA_BEATS_TOTAL"/>
+	<value value="48" name="A7XX_PERF_GBIF_RESERVED_48"/>
+	<value value="49" name="A7XX_PERF_GBIF_RESERVED_49"/>
+	<value value="50" name="A7XX_PERF_GBIF_RESERVED_50"/>
+	<value value="51" name="A7XX_PERF_GBIF_RESERVED_51"/>
+	<value value="52" name="A7XX_PERF_GBIF_RESERVED_52"/>
+	<value value="53" name="A7XX_PERF_GBIF_RESERVED_53"/>
+	<value value="54" name="A7XX_PERF_GBIF_RESERVED_54"/>
+	<value value="55" name="A7XX_PERF_GBIF_RESERVED_55"/>
+	<value value="56" name="A7XX_PERF_GBIF_RESERVED_56"/>
+	<value value="57" name="A7XX_PERF_GBIF_RESERVED_57"/>
+	<value value="58" name="A7XX_PERF_GBIF_RESERVED_58"/>
+	<value value="59" name="A7XX_PERF_GBIF_RESERVED_59"/>
+	<value value="60" name="A7XX_PERF_GBIF_RESERVED_60"/>
+	<value value="61" name="A7XX_PERF_GBIF_RESERVED_61"/>
+	<value value="62" name="A7XX_PERF_GBIF_RESERVED_62"/>
+	<value value="63" name="A7XX_PERF_GBIF_RESERVED_63"/>
+	<value value="64" name="A7XX_PERF_GBIF_RESERVED_64"/>
+	<value value="65" name="A7XX_PERF_GBIF_RESERVED_65"/>
+	<value value="66" name="A7XX_PERF_GBIF_RESERVED_66"/>
+	<value value="67" name="A7XX_PERF_GBIF_RESERVED_67"/>
+	<value value="68" name="A7XX_PERF_GBIF_CYCLES_CH0_HELD_OFF_RD_ALL"/>
+	<value value="69" name="A7XX_PERF_GBIF_CYCLES_CH1_HELD_OFF_RD_ALL"/>
+	<value value="70" name="A7XX_PERF_GBIF_CYCLES_CH0_HELD_OFF_WR_ALL"/>
+	<value value="71" name="A7XX_PERF_GBIF_CYCLES_CH1_HELD_OFF_WR_ALL"/>
+	<value value="72" name="A7XX_PERF_GBIF_AXI_CH0_REQUEST_HELD_OFF"/>
+	<value value="73" name="A7XX_PERF_GBIF_AXI_CH1_REQUEST_HELD_OFF"/>
+	<value value="74" name="A7XX_PERF_GBIF_AXI_REQUEST_HELD_OFF"/>
+	<value value="75" name="A7XX_PERF_GBIF_AXI_CH0_WRITE_DATA_HELD_OFF"/>
+	<value value="76" name="A7XX_PERF_GBIF_AXI_CH1_WRITE_DATA_HELD_OFF"/>
+	<value value="77" name="A7XX_PERF_GBIF_AXI_ALL_WRITE_DATA_HELD_OFF"/>
+	<value value="78" name="A7XX_PERF_GBIF_AXI_ALL_READ_BEATS"/>
+	<value value="79" name="A7XX_PERF_GBIF_AXI_ALL_WRITE_BEATS"/>
+	<value value="80" name="A7XX_PERF_GBIF_AXI_ALL_BEATS"/>
+</enum>
+
+<enum name="a7xx_ufc_perfcounter_select">
+	<value value="0" name="A7XX_PERF_UFC_BUSY_CYCLES"/>
+	<value value="1" name="A7XX_PERF_UFC_READ_DATA_VBIF"/>
+	<value value="2" name="A7XX_PERF_UFC_WRITE_DATA_VBIF"/>
+	<value value="3" name="A7XX_PERF_UFC_READ_REQUEST_VBIF"/>
+	<value value="4" name="A7XX_PERF_UFC_WRITE_REQUEST_VBIF"/>
+	<value value="5" name="A7XX_PERF_UFC_LRZ_FILTER_HIT"/>
+	<value value="6" name="A7XX_PERF_UFC_LRZ_FILTER_MISS"/>
+	<value value="7" name="A7XX_PERF_UFC_CRE_FILTER_HIT"/>
+	<value value="8" name="A7XX_PERF_UFC_CRE_FILTER_MISS"/>
+	<value value="9" name="A7XX_PERF_UFC_SP_FILTER_HIT"/>
+	<value value="10" name="A7XX_PERF_UFC_SP_FILTER_MISS"/>
+	<value value="11" name="A7XX_PERF_UFC_SP_REQUESTS"/>
+	<value value="12" name="A7XX_PERF_UFC_TP_FILTER_HIT"/>
+	<value value="13" name="A7XX_PERF_UFC_TP_FILTER_MISS"/>
+	<value value="14" name="A7XX_PERF_UFC_TP_REQUESTS"/>
+	<value value="15" name="A7XX_PERF_UFC_MAIN_HIT_LRZ_PREFETCH"/>
+	<value value="16" name="A7XX_PERF_UFC_MAIN_HIT_CRE_PREFETCH"/>
+	<value value="17" name="A7XX_PERF_UFC_MAIN_HIT_SP_PREFETCH"/>
+	<value value="18" name="A7XX_PERF_UFC_MAIN_HIT_TP_PREFETCH"/>
+	<value value="19" name="A7XX_PERF_UFC_MAIN_HIT_UBWC_READ"/>
+	<value value="20" name="A7XX_PERF_UFC_MAIN_HIT_UBWC_WRITE"/>
+	<value value="21" name="A7XX_PERF_UFC_MAIN_MISS_LRZ_PREFETCH"/>
+	<value value="22" name="A7XX_PERF_UFC_MAIN_MISS_CRE_PREFETCH"/>
+	<value value="23" name="A7XX_PERF_UFC_MAIN_MISS_SP_PREFETCH"/>
+	<value value="24" name="A7XX_PERF_UFC_MAIN_MISS_TP_PREFETCH"/>
+	<value value="25" name="A7XX_PERF_UFC_MAIN_MISS_UBWC_READ"/>
+	<value value="26" name="A7XX_PERF_UFC_MAIN_MISS_UBWC_WRITE"/>
+	<value value="27" name="A7XX_PERF_UFC_UBWC_READ_UFC_TRANS"/>
+	<value value="28" name="A7XX_PERF_UFC_UBWC_WRITE_UFC_TRANS"/>
+	<value value="29" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_CMD"/>
+	<value value="30" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_RDATA"/>
+	<value value="31" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_WDATA"/>
+	<value value="32" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_WR_FLAG"/>
+	<value value="33" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_FLAG_RTN"/>
+	<value value="34" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_EVENT"/>
+	<value value="35" name="A7XX_PERF_UFC_LRZ_PREFETCH_STALLED_CYCLES"/>
+	<value value="36" name="A7XX_PERF_UFC_CRE_PREFETCH_STALLED_CYCLES"/>
+	<value value="37" name="A7XX_PERF_UFC_SPTP_PREFETCH_STALLED_CYCLES"/>
+	<value value="38" name="A7XX_PERF_UFC_UBWC_RD_STALLED_CYCLES"/>
+	<value value="39" name="A7XX_PERF_UFC_UBWC_WR_STALLED_CYCLES"/>
+	<value value="40" name="A7XX_PERF_UFC_PREFETCH_STALLED_CYCLES"/>
+	<value value="41" name="A7XX_PERF_UFC_EVICTION_STALLED_CYCLES"/>
+	<value value="42" name="A7XX_PERF_UFC_LOCK_STALLED_CYCLES"/>
+	<value value="43" name="A7XX_PERF_UFC_MISS_LATENCY_CYCLES"/>
+	<value value="44" name="A7XX_PERF_UFC_MISS_LATENCY_SAMPLES"/>
+	<value value="45" name="A7XX_PERF_UFC_UBWC_REQ_STALLED_CYCLES"/>
+	<value value="46" name="A7XX_PERF_UFC_TP_HINT_TAG_MISS"/>
+	<value value="47" name="A7XX_PERF_UFC_TP_HINT_TAG_HIT_RDY"/>
+	<value value="48" name="A7XX_PERF_UFC_TP_HINT_TAG_HIT_NRDY"/>
+	<value value="49" name="A7XX_PERF_UFC_TP_HINT_IS_FCLEAR"/>
+	<value value="50" name="A7XX_PERF_UFC_TP_HINT_IS_ALPHA0"/>
+	<value value="51" name="A7XX_PERF_UFC_SP_L1_FILTER_HIT"/>
+	<value value="52" name="A7XX_PERF_UFC_SP_L1_FILTER_MISS"/>
+	<value value="53" name="A7XX_PERF_UFC_SP_L1_FILTER_REQUESTS"/>
+	<value value="54" name="A7XX_PERF_UFC_TP_L1_TAG_HIT_RDY"/>
+	<value value="55" name="A7XX_PERF_UFC_TP_L1_TAG_HIT_NRDY"/>
+	<value value="56" name="A7XX_PERF_UFC_TP_L1_TAG_MISS"/>
+	<value value="57" name="A7XX_PERF_UFC_TP_L1_FILTER_REQUESTS"/>
+</enum>
+
+<domain name="A6XX" width="32" prefix="variant" varset="chip">
+	<bitset name="A6XX_RBBM_INT_0_MASK" inline="no" varset="chip">
+		<bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR" pos="1" type="boolean"/>
+		<bitfield name="CP_IPC_INTR_0" pos="4" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_IPC_INTR_1" pos="5" type="boolean" variants="A7XX-"/>
+		<bitfield name="RBBM_ATB_ASYNCFIFO_OVERFLOW" pos="6" type="boolean"/>
+		<bitfield name="RBBM_GPC_ERROR" pos="7" type="boolean"/>
+		<bitfield name="CP_SW" pos="8" type="boolean"/>
+		<bitfield name="CP_HW_ERROR" pos="9" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_DEPTH_TS" pos="10" type="boolean"/>
+		<bitfield name="CP_CCU_FLUSH_COLOR_TS" pos="11" type="boolean"/>
+		<bitfield name="CP_CCU_RESOLVE_TS" pos="12" type="boolean"/>
+		<bitfield name="CP_IB2" pos="13" type="boolean"/>
+		<bitfield name="CP_IB1" pos="14" type="boolean"/>
+		<bitfield name="CP_RB" pos="15" type="boolean" variants="A6XX"/>
+		<!-- Same as above but different name??: -->
+		<bitfield name="PM4CPINTERRUPT" pos="15" type="boolean" variants="A7XX-"/>
+		<bitfield name="PM4CPINTERRUPTLPAC" pos="16" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_RB_DONE_TS" pos="17" type="boolean"/>
+		<bitfield name="CP_WT_DONE_TS" pos="18" type="boolean"/>
+		<bitfield name="CP_CACHE_FLUSH_TS" pos="20" type="boolean"/>
+		<bitfield name="CP_CACHE_FLUSH_TS_LPAC" pos="21" type="boolean" variants="A7XX-"/>
+		<bitfield name="RBBM_ATB_BUS_OVERFLOW" pos="22" type="boolean"/>
+		<bitfield name="RBBM_HANG_DETECT" pos="23" type="boolean"/>
+		<bitfield name="UCHE_OOB_ACCESS" pos="24" type="boolean"/>
+		<bitfield name="UCHE_TRAP_INTR" pos="25" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_0" pos="26" type="boolean"/>
+		<bitfield name="DEBBUS_INTR_1" pos="27" type="boolean"/>
+		<bitfield name="TSBWRITEERROR" pos="28" type="boolean" variants="A7XX-"/>
+		<bitfield name="SWFUSEVIOLATION" pos="29" type="boolean" variants="A7XX-"/>
+		<bitfield name="ISDB_CPU_IRQ" pos="30" type="boolean"/>
+		<bitfield name="ISDB_UNDER_DEBUG" pos="31" type="boolean"/>
+	</bitset>
+
+	<!--
+		Note the _LPAC bits probably *actually* first appeared in a660, but the
+		_BV bits are new in a7xx
+	 -->
+	<bitset name="A6XX_CP_INT" varset="chip">
+		<bitfield name="CP_OPCODE_ERROR" pos="0" type="boolean"/>
+		<bitfield name="CP_UCODE_ERROR" pos="1" type="boolean"/>
+		<bitfield name="CP_HW_FAULT_ERROR" pos="2" type="boolean"/>
+		<bitfield name="CP_REGISTER_PROTECTION_ERROR" pos="4" type="boolean"/>
+		<bitfield name="CP_AHB_ERROR" pos="5" type="boolean"/>
+		<bitfield name="CP_VSD_PARITY_ERROR" pos="6" type="boolean"/>
+		<bitfield name="CP_ILLEGAL_INSTR_ERROR" pos="7" type="boolean"/>
+		<bitfield name="CP_OPCODE_ERROR_LPAC" pos="8" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_UCODE_ERROR_LPAC" pos="9" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_HW_FAULT_ERROR_LPAC" pos="10" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_REGISTER_PROTECTION_ERROR_LPAC" pos="11" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_ILLEGAL_INSTR_ERROR_LPAC" pos="12" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_OPCODE_ERROR_BV" pos="13" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_UCODE_ERROR_BV" pos="14" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_HW_FAULT_ERROR_BV" pos="15" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_REGISTER_PROTECTION_ERROR_BV" pos="16" type="boolean" variants="A7XX-"/>
+		<bitfield name="CP_ILLEGAL_INSTR_ERROR_BV" pos="17" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<reg64 offset="0x0800" name="CP_RB_BASE"/>
+	<reg32 offset="0x0802" name="CP_RB_CNTL"/>
+	<reg64 offset="0x0804" name="CP_RB_RPTR_ADDR"/>
+	<reg32 offset="0x0806" name="CP_RB_RPTR"/>
+	<reg32 offset="0x0807" name="CP_RB_WPTR"/>
+	<reg32 offset="0x0808" name="CP_SQE_CNTL"/>
+	<reg32 offset="0x0812" name="CP_CP2GMU_STATUS">
+		<bitfield name="IFPC" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0821" name="CP_HW_FAULT"/>
+	<reg32 offset="0x0823" name="CP_INTERRUPT_STATUS" type="A6XX_CP_INT"/>
+	<reg32 offset="0x0824" name="CP_PROTECT_STATUS"/>
+	<reg32 offset="0x0825" name="CP_STATUS_1"/>
+	<reg64 offset="0x0830" name="CP_SQE_INSTR_BASE"/>
+	<reg32 offset="0x0840" name="CP_MISC_CNTL"/>
+	<reg32 offset="0x0844" name="CP_APRIV_CNTL">
+		<!-- Crashdumper writes -->
+		<bitfield pos="6" name="CDWRITE" type="boolean"/>
+		<!-- Crashdumper reads -->
+		<bitfield pos="5" name="CDREAD" type="boolean"/>
+
+		<!-- 4 is unknown -->
+
+		<!-- RPTR shadow writes -->
+		<bitfield pos="3" name="RBRPWB" type="boolean"/>
+		<!-- Memory accesses from PM4 packets in the ringbuffer -->
+		<bitfield pos="2" name="RBPRIVLEVEL" type="boolean"/>
+		<!-- Ringbuffer reads -->
+		<bitfield pos="1" name="RBFETCH" type="boolean"/>
+		<!-- Instruction cache fetches -->
+		<bitfield pos="0" name="ICACHE" type="boolean"/>
+	</reg32>
+	<!-- Preemptions taking longer than this threshold increment PERF_CP_LONG_PREEMPTIONS: -->
+	<reg32 offset="0x08C0" name="CP_PREEMPT_THRESHOLD"/>
+	<!-- all the threshold values seem to be in units of quad-dwords: -->
+	<reg32 offset="0x08C1" name="CP_ROQ_THRESHOLDS_1">
+		<doc>
+			b0..7 identifies where MRB data starts (and RB data ends)
+			b8.15 identifies where VSD data starts (and MRB data ends)
+			b16..23 identifies where IB1 data starts (and RB data ends)
+			b24..31 identifies where IB2 data starts (and IB1 data ends)
+		</doc>
+		<bitfield name="MRB_START" low="0" high="7" shr="2"/>
+		<bitfield name="VSD_START" low="8" high="15" shr="2"/>
+		<bitfield name="IB1_START" low="16" high="23" shr="2"/>
+		<bitfield name="IB2_START" low="24" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="0x08C2" name="CP_ROQ_THRESHOLDS_2">
+		<doc>
+			low bits identify where CP_SET_DRAW_STATE stateobj
+			processing starts (and IB2 data ends). I'm guessing
+			b8 is part of this since (from downstream kgsl):
+
+				/* ROQ sizes are twice as big on a640/a680 than on a630 */
+				if (adreno_is_a640(adreno_dev) || adreno_is_a680(adreno_dev)) {
+					kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_2, 0x02000140);
+					kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_1, 0x8040362C);
+				} ...
+		</doc>
+		<bitfield name="SDS_START" low="0" high="8" shr="2"/>
+		<!-- total ROQ size: -->
+		<bitfield name="ROQ_SIZE" low="16" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="0x08C3" name="CP_MEM_POOL_SIZE"/>
+	<reg32 offset="0x0841" name="CP_CHICKEN_DBG"/>
+	<reg32 offset="0x0842" name="CP_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0843" name="CP_DBG_ECO_CNTL"/>
+	<reg32 offset="0x084F" name="CP_PROTECT_CNTL">
+		<bitfield pos="3" name="LAST_SPAN_INF_RANGE" type="boolean"/>
+		<bitfield pos="1" name="ACCESS_FAULT_ON_VIOL_EN" type="boolean"/>
+		<bitfield pos="0" name="ACCESS_PROT_EN" type="boolean"/>
+	</reg32>
+
+	<array offset="0x0883" name="CP_SCRATCH" stride="1" length="8">
+		<reg32 offset="0x0" name="REG" type="uint"/>
+	</array>
+	<array offset="0x0850" name="CP_PROTECT" stride="1" length="32">
+		<reg32 offset="0x0" name="REG" type="a6x_cp_protect"/>
+	</array>
+
+	<reg32 offset="0x08A0" name="CP_CONTEXT_SWITCH_CNTL">
+		<bitfield name="STOP" pos="0" type="boolean"/>
+		<bitfield name="LEVEL" low="6" high="7"/>
+		<bitfield name="USES_GMEM" pos="8" type="boolean"/>
+		<bitfield name="SKIP_SAVE_RESTORE" pos="9" type="boolean"/>
+	</reg32>
+	<reg64 offset="0x08A1" name="CP_CONTEXT_SWITCH_SMMU_INFO"/>
+	<reg64 offset="0x08A3" name="CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR"/>
+	<reg64 offset="0x08A5" name="CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR"/>
+	<reg64 offset="0x08A7" name="CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR"/>
+	<reg32 offset="0x08ab" name="CP_CONTEXT_SWITCH_LEVEL_STATUS" variants="A7XX-"/>
+	<array offset="0x08D0" name="CP_PERFCTR_CP_SEL" stride="1" length="14"/>
+	<array offset="0x08e0" name="CP_BV_PERFCTR_CP_SEL" stride="1" length="7" variants="A7XX-"/>
+	<reg64 offset="0x0900" name="CP_CRASH_SCRIPT_BASE"/>
+	<reg32 offset="0x0902" name="CP_CRASH_DUMP_CNTL"/>
+	<reg32 offset="0x0903" name="CP_CRASH_DUMP_STATUS"/>
+	<reg32 offset="0x0908" name="CP_SQE_STAT_ADDR"/>
+	<reg32 offset="0x0909" name="CP_SQE_STAT_DATA"/>
+	<reg32 offset="0x090A" name="CP_DRAW_STATE_ADDR"/>
+	<reg32 offset="0x090B" name="CP_DRAW_STATE_DATA"/>
+	<reg32 offset="0x090C" name="CP_ROQ_DBG_ADDR"/>
+	<reg32 offset="0x090D" name="CP_ROQ_DBG_DATA"/>
+	<reg32 offset="0x090E" name="CP_MEM_POOL_DBG_ADDR"/>
+	<reg32 offset="0x090F" name="CP_MEM_POOL_DBG_DATA"/>
+	<reg32 offset="0x0910" name="CP_SQE_UCODE_DBG_ADDR"/>
+	<reg32 offset="0x0911" name="CP_SQE_UCODE_DBG_DATA"/>
+	<reg64 offset="0x0928" name="CP_IB1_BASE"/>
+	<reg32 offset="0x092A" name="CP_IB1_REM_SIZE"/>
+	<reg64 offset="0x092B" name="CP_IB2_BASE"/>
+	<reg32 offset="0x092D" name="CP_IB2_REM_SIZE"/>
+	<!-- SDS == CP_SET_DRAW_STATE: -->
+	<reg64 offset="0x092e" name="CP_SDS_BASE"/>
+	<reg32 offset="0x0930" name="CP_SDS_REM_SIZE"/>
+	<!-- MRB == MEM_READ_ADDR/$addr in SQE firmware -->
+	<reg64 offset="0x0931" name="CP_MRB_BASE"/>
+	<reg32 offset="0x0933" name="CP_MRB_REM_SIZE"/>
+	<!--
+	VSD == Visibility Stream Decode
+	This is used by CP to read the draw stream and skip empty draws
+	-->
+	<reg64 offset="0x0934" name="CP_VSD_BASE"/>
+
+	<bitset name="a6xx_roq_stat" inline="yes">
+		<bitfield name="RPTR" low="0" high="9"/>
+		<bitfield name="WPTR" low="16" high="25"/>
+	</bitset>
+	<reg32 offset="0x0939" name="CP_ROQ_RB_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093a" name="CP_ROQ_IB1_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093b" name="CP_ROQ_IB2_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093c" name="CP_ROQ_SDS_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093d" name="CP_ROQ_MRB_STAT" type="a6xx_roq_stat"/>
+	<reg32 offset="0x093e" name="CP_ROQ_VSD_STAT" type="a6xx_roq_stat"/>
+
+	<reg32 offset="0x0943" name="CP_IB1_DWORDS"/>
+	<reg32 offset="0x0944" name="CP_IB2_DWORDS"/>
+	<reg32 offset="0x0945" name="CP_SDS_DWORDS"/>
+	<reg32 offset="0x0946" name="CP_MRB_DWORDS"/>
+	<reg32 offset="0x0947" name="CP_VSD_DWORDS"/>
+
+	<reg32 offset="0x0948" name="CP_ROQ_AVAIL_RB">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x0949" name="CP_ROQ_AVAIL_IB1">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x094a" name="CP_ROQ_AVAIL_IB2">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x094b" name="CP_ROQ_AVAIL_SDS">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x094c" name="CP_ROQ_AVAIL_MRB">
+		<doc>number of dwords that have already been read but haven't been consumed by $addr</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="0x094d" name="CP_ROQ_AVAIL_VSD">
+		<doc>number of remaining dwords incl current dword being consumed?</doc>
+		<bitfield name="REM" low="16" high="31"/>
+	</reg32>
+
+	<bitset name="a7xx_aperture_cntl" inline="yes">
+		<bitfield name="PIPE" low="12" high="13" type="a7xx_pipe"/>
+		<bitfield name="CLUSTER" low="8" high="10" type="a7xx_cluster"/>
+		<bitfield name="CONTEXT" low="4" high="5"/>
+	</bitset>
+	<reg64 offset="0x0980" name="CP_ALWAYS_ON_COUNTER"/>
+	<reg32 offset="0x098D" name="CP_AHB_CNTL"/>
+	<reg32 offset="0x0A00" name="CP_APERTURE_CNTL_HOST" variants="A6XX"/>
+	<reg32 offset="0x0A00" name="CP_APERTURE_CNTL_HOST" type="a7xx_aperture_cntl" variants="A7XX-"/>
+	<reg32 offset="0x0A03" name="CP_APERTURE_CNTL_CD" variants="A6XX"/>
+	<reg32 offset="0x0A03" name="CP_APERTURE_CNTL_CD" type="a7xx_aperture_cntl" variants="A7XX-"/>
+
+	<reg32 offset="0x0a61" name="CP_BV_PROTECT_STATUS" variants="A7XX-"/>
+	<reg32 offset="0x0a64" name="CP_BV_HW_FAULT" variants="A7XX-"/>
+	<reg32 offset="0x0a81" name="CP_BV_DRAW_STATE_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a82" name="CP_BV_DRAW_STATE_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0a83" name="CP_BV_ROQ_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a84" name="CP_BV_ROQ_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0a85" name="CP_BV_SQE_UCODE_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a86" name="CP_BV_SQE_UCODE_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0a87" name="CP_BV_SQE_STAT_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a88" name="CP_BV_SQE_STAT_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0a96" name="CP_BV_MEM_POOL_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a97" name="CP_BV_MEM_POOL_DBG_DATA" variants="A7XX-"/>
+	<reg64 offset="0x0a98" name="CP_BV_RB_RPTR_ADDR" variants="A7XX-"/>
+
+	<reg32 offset="0x0a9a" name="CP_RESOURCE_TBL_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0a9b" name="CP_RESOURCE_TBL_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0ad0" name="CP_BV_APRIV_CNTL" variants="A7XX-"/>
+	<reg32 offset="0x0ada" name="CP_BV_CHICKEN_DBG" variants="A7XX-"/>
+
+	<reg32 offset="0x0b0a" name="CP_LPAC_DRAW_STATE_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b0b" name="CP_LPAC_DRAW_STATE_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0b0c" name="CP_LPAC_ROQ_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b27" name="CP_SQE_AC_UCODE_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b28" name="CP_SQE_AC_UCODE_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0b29" name="CP_SQE_AC_STAT_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b2a" name="CP_SQE_AC_STAT_DATA" variants="A7XX-"/>
+
+	<reg32 offset="0x0b31" name="CP_LPAC_APRIV_CNTL" variants="A7XX-"/>
+	<reg32 offset="0x0B34" name="CP_LPAC_PROG_FIFO_SIZE"/>
+	<reg32 offset="0x0b35" name="CP_LPAC_ROQ_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0b36" name="CP_LPAC_FIFO_DBG_DATA" variants="A7XX-"/>
+	<reg32 offset="0x0b40" name="CP_LPAC_FIFO_DBG_ADDR" variants="A7XX-"/>
+	<reg32 offset="0x0b81" name="CP_LPAC_SQE_CNTL"/>
+	<reg64 offset="0x0b82" name="CP_LPAC_SQE_INSTR_BASE"/>
+
+	<reg64 offset="0x0b70" name="CP_AQE_INSTR_BASE_0" variants="A7XX-"/>
+	<reg64 offset="0x0b72" name="CP_AQE_INSTR_BASE_1" variants="A7XX-"/>
+	<reg32 offset="0x0b78" name="CP_AQE_APRIV_CNTL" variants="A7XX-"/>
+
+	<reg32 offset="0x0ba8" name="CP_AQE_ROQ_DBG_ADDR_0" variants="A7XX-"/>
+	<reg32 offset="0x0ba9" name="CP_AQE_ROQ_DBG_ADDR_1" variants="A7XX-"/>
+	<reg32 offset="0x0bac" name="CP_AQE_ROQ_DBG_DATA_0" variants="A7XX-"/>
+	<reg32 offset="0x0bad" name="CP_AQE_ROQ_DBG_DATA_1" variants="A7XX-"/>
+	<reg32 offset="0x0bb0" name="CP_AQE_UCODE_DBG_ADDR_0" variants="A7XX-"/>
+	<reg32 offset="0x0bb1" name="CP_AQE_UCODE_DBG_ADDR_1" variants="A7XX-"/>
+	<reg32 offset="0x0bb4" name="CP_AQE_UCODE_DBG_DATA_0" variants="A7XX-"/>
+	<reg32 offset="0x0bb5" name="CP_AQE_UCODE_DBG_DATA_1" variants="A7XX-"/>
+	<reg32 offset="0x0bb8" name="CP_AQE_STAT_ADDR_0" variants="A7XX-"/>
+	<reg32 offset="0x0bb9" name="CP_AQE_STAT_ADDR_1" variants="A7XX-"/>
+	<reg32 offset="0x0bbc" name="CP_AQE_STAT_DATA_0" variants="A7XX-"/>
+	<reg32 offset="0x0bbd" name="CP_AQE_STAT_DATA_1" variants="A7XX-"/>
+
+	<reg32 offset="0x0C01" name="VSC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0018" name="RBBM_GPR0_CNTL"/>
+	<reg32 offset="0x0201" name="RBBM_INT_0_STATUS" type="A6XX_RBBM_INT_0_MASK"/>
+	<reg32 offset="0x0210" name="RBBM_STATUS">
+		<bitfield pos="23" name="GPU_BUSY_IGN_AHB" type="boolean"/>
+		<bitfield pos="22" name="GPU_BUSY_IGN_AHB_CP" type="boolean"/>
+		<bitfield pos="21" name="HLSQ_BUSY" type="boolean"/>
+		<bitfield pos="20" name="VSC_BUSY" type="boolean"/>
+		<bitfield pos="19" name="TPL1_BUSY" type="boolean"/>
+		<bitfield pos="18" name="SP_BUSY" type="boolean"/>
+		<bitfield pos="17" name="UCHE_BUSY" type="boolean"/>
+		<bitfield pos="16" name="VPC_BUSY" type="boolean"/>
+		<bitfield pos="15" name="VFD_BUSY" type="boolean"/>
+		<bitfield pos="14" name="TESS_BUSY" type="boolean"/>
+		<bitfield pos="13" name="PC_VSD_BUSY" type="boolean"/>
+		<bitfield pos="12" name="PC_DCALL_BUSY" type="boolean"/>
+		<bitfield pos="11" name="COM_DCOM_BUSY" type="boolean"/>
+		<bitfield pos="10" name="LRZ_BUSY" type="boolean"/>
+		<bitfield pos="9"  name="A2D_BUSY" type="boolean"/>
+		<bitfield pos="8"  name="CCU_BUSY" type="boolean"/>
+		<bitfield pos="7"  name="RB_BUSY" type="boolean"/>
+		<bitfield pos="6"  name="RAS_BUSY" type="boolean"/>
+		<bitfield pos="5"  name="TSE_BUSY" type="boolean"/>
+		<bitfield pos="4"  name="VBIF_BUSY" type="boolean"/>
+		<bitfield pos="3"  name="GFX_DBGC_BUSY" type="boolean"/>
+		<bitfield pos="2"  name="CP_BUSY" type="boolean"/>
+		<bitfield pos="1"  name="CP_AHB_BUSY_CP_MASTER" type="boolean"/>
+		<bitfield pos="0"  name="CP_AHB_BUSY_CX_MASTER" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0211" name="RBBM_STATUS1"/>
+	<reg32 offset="0x0212" name="RBBM_STATUS2"/>
+	<reg32 offset="0x0213" name="RBBM_STATUS3">
+		<bitfield pos="24" name="SMMU_STALLED_ON_FAULT" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0215" name="RBBM_VBIF_GX_RESET_STATUS"/>
+
+	<reg32 offset="0x0260" name="RBBM_CLOCK_MODE_CP" variants="A7XX-"/>
+	<reg32 offset="0x0284" name="RBBM_CLOCK_MODE_BV_LRZ" variants="A7XX-"/>
+	<reg32 offset="0x0285" name="RBBM_CLOCK_MODE_BV_GRAS" variants="A7XX-"/>
+	<reg32 offset="0x0286" name="RBBM_CLOCK_MODE2_GRAS" variants="A7XX-"/>
+	<reg32 offset="0x0287" name="RBBM_CLOCK_MODE_BV_VFD" variants="A7XX-"/>
+	<reg32 offset="0x0288" name="RBBM_CLOCK_MODE_BV_GPC" variants="A7XX-"/>
+
+	<reg32 offset="0x02c0" name="RBBM_SW_FUSE_INT_STATUS" variants="A7XX-"/>
+	<reg32 offset="0x02c1" name="RBBM_SW_FUSE_INT_MASK" variants="A7XX-"/>
+
+	<array offset="0x0400" name="RBBM_PERFCTR_CP" stride="2" length="14" variants="A6XX"/>
+	<array offset="0x041c" name="RBBM_PERFCTR_RBBM" stride="2" length="4" variants="A6XX"/>
+	<array offset="0x0424" name="RBBM_PERFCTR_PC" stride="2" length="8" variants="A6XX"/>
+	<array offset="0x0434" name="RBBM_PERFCTR_VFD" stride="2" length="8" variants="A6XX"/>
+	<array offset="0x0444" name="RBBM_PERFCTR_HLSQ" stride="2" length="6" variants="A6XX"/>
+	<array offset="0x0450" name="RBBM_PERFCTR_VPC" stride="2" length="6" variants="A6XX"/>
+	<array offset="0x045c" name="RBBM_PERFCTR_CCU" stride="2" length="5" variants="A6XX"/>
+	<array offset="0x0466" name="RBBM_PERFCTR_TSE" stride="2" length="4" variants="A6XX"/>
+	<array offset="0x046e" name="RBBM_PERFCTR_RAS" stride="2" length="4" variants="A6XX"/>
+	<array offset="0x0476" name="RBBM_PERFCTR_UCHE" stride="2" length="12" variants="A6XX"/>
+	<array offset="0x048e" name="RBBM_PERFCTR_TP" stride="2" length="12" variants="A6XX"/>
+	<array offset="0x04a6" name="RBBM_PERFCTR_SP" stride="2" length="24" variants="A6XX"/>
+	<array offset="0x04d6" name="RBBM_PERFCTR_RB" stride="2" length="8" variants="A6XX"/>
+	<array offset="0x04e6" name="RBBM_PERFCTR_VSC" stride="2" length="2" variants="A6XX"/>
+	<array offset="0x04ea" name="RBBM_PERFCTR_LRZ" stride="2" length="4" variants="A6XX"/>
+	<array offset="0x04f2" name="RBBM_PERFCTR_CMP" stride="2" length="4" variants="A6XX"/>
+
+	<array offset="0x0300" name="RBBM_PERFCTR_CP" stride="2" length="14" variants="A7XX-"/>
+	<array offset="0x031c" name="RBBM_PERFCTR_RBBM" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x0324" name="RBBM_PERFCTR_PC" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x0334" name="RBBM_PERFCTR_VFD" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x0344" name="RBBM_PERFCTR_HLSQ" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x0350" name="RBBM_PERFCTR_VPC" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x035c" name="RBBM_PERFCTR_CCU" stride="2" length="5" variants="A7XX-"/>
+	<array offset="0x0366" name="RBBM_PERFCTR_TSE" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x036e" name="RBBM_PERFCTR_RAS" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x0376" name="RBBM_PERFCTR_UCHE" stride="2" length="12" variants="A7XX-"/>
+	<array offset="0x038e" name="RBBM_PERFCTR_TP" stride="2" length="12" variants="A7XX-"/>
+	<array offset="0x03a6" name="RBBM_PERFCTR_SP" stride="2" length="24" variants="A7XX-"/>
+	<array offset="0x03d6" name="RBBM_PERFCTR_RB" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x03e6" name="RBBM_PERFCTR_VSC" stride="2" length="2" variants="A7XX-"/>
+	<array offset="0x03ea" name="RBBM_PERFCTR_LRZ" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x03f2" name="RBBM_PERFCTR_CMP" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x03fa" name="RBBM_PERFCTR_UFC" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x0410" name="RBBM_PERFCTR2_HLSQ" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x041c" name="RBBM_PERFCTR2_CP" stride="2" length="7" variants="A7XX-"/>
+	<array offset="0x042a" name="RBBM_PERFCTR2_SP" stride="2" length="12" variants="A7XX-"/>
+	<array offset="0x0442" name="RBBM_PERFCTR2_TP" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x044e" name="RBBM_PERFCTR2_UFC" stride="2" length="2" variants="A7XX-"/>
+	<array offset="0x0460" name="RBBM_PERFCTR_BV_PC" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x0470" name="RBBM_PERFCTR_BV_VFD" stride="2" length="8" variants="A7XX-"/>
+	<array offset="0x0480" name="RBBM_PERFCTR_BV_VPC" stride="2" length="6" variants="A7XX-"/>
+	<array offset="0x048c" name="RBBM_PERFCTR_BV_TSE" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x0494" name="RBBM_PERFCTR_BV_RAS" stride="2" length="4" variants="A7XX-"/>
+	<array offset="0x049c" name="RBBM_PERFCTR_BV_LRZ" stride="2" length="4" variants="A7XX-"/>
+
+	<reg32 offset="0x0500" name="RBBM_PERFCTR_CNTL"/>
+	<reg32 offset="0x0501" name="RBBM_PERFCTR_LOAD_CMD0"/>
+	<reg32 offset="0x0502" name="RBBM_PERFCTR_LOAD_CMD1"/>
+	<reg32 offset="0x0503" name="RBBM_PERFCTR_LOAD_CMD2"/>
+	<reg32 offset="0x0504" name="RBBM_PERFCTR_LOAD_CMD3"/>
+	<reg32 offset="0x0505" name="RBBM_PERFCTR_LOAD_VALUE_LO"/>
+	<reg32 offset="0x0506" name="RBBM_PERFCTR_LOAD_VALUE_HI"/>
+	<array offset="0x0507" name="RBBM_PERFCTR_RBBM_SEL" stride="1" length="4"/>
+	<reg32 offset="0x050B" name="RBBM_PERFCTR_GPU_BUSY_MASKED"/>
+	<reg32 offset="0x050e" name="RBBM_PERFCTR_SRAM_INIT_CMD"/>
+	<reg32 offset="0x050f" name="RBBM_PERFCTR_SRAM_INIT_STATUS"/>
+	<reg32 offset="0x0533" name="RBBM_ISDB_CNT"/>
+	<reg32 offset="0x0534" name="RBBM_NC_MODE_CNTL"/>
+	<reg32 offset="0x0535" name="RBBM_SNAPSHOT_STATUS" variants="A7XX-"/>
+
+	<!---
+	    This block of registers aren't tied to perf counters. They
+	    count various geometry stats, for example number of
+	    vertices in, number of primnitives assembled etc.
+	-->
+
+	<reg32 offset="0x0540" name="RBBM_PRIMCTR_0_LO"/>  <!-- vs vertices in -->
+	<reg32 offset="0x0541" name="RBBM_PRIMCTR_0_HI"/>
+	<reg32 offset="0x0542" name="RBBM_PRIMCTR_1_LO"/>  <!-- vs primitives out -->
+	<reg32 offset="0x0543" name="RBBM_PRIMCTR_1_HI"/>
+	<reg32 offset="0x0544" name="RBBM_PRIMCTR_2_LO"/>  <!-- hs vertices in -->
+	<reg32 offset="0x0545" name="RBBM_PRIMCTR_2_HI"/>
+	<reg32 offset="0x0546" name="RBBM_PRIMCTR_3_LO"/>  <!-- hs patches out -->
+	<reg32 offset="0x0547" name="RBBM_PRIMCTR_3_HI"/>
+	<reg32 offset="0x0548" name="RBBM_PRIMCTR_4_LO"/>  <!-- dss vertices in -->
+	<reg32 offset="0x0549" name="RBBM_PRIMCTR_4_HI"/>
+	<reg32 offset="0x054a" name="RBBM_PRIMCTR_5_LO"/>  <!-- ds primitives out -->
+	<reg32 offset="0x054b" name="RBBM_PRIMCTR_5_HI"/>
+	<reg32 offset="0x054c" name="RBBM_PRIMCTR_6_LO"/>  <!-- gs primitives in -->
+	<reg32 offset="0x054d" name="RBBM_PRIMCTR_6_HI"/>
+	<reg32 offset="0x054e" name="RBBM_PRIMCTR_7_LO"/>  <!-- gs primitives out -->
+	<reg32 offset="0x054f" name="RBBM_PRIMCTR_7_HI"/>
+	<reg32 offset="0x0550" name="RBBM_PRIMCTR_8_LO"/>  <!-- gs primitives out -->
+	<reg32 offset="0x0551" name="RBBM_PRIMCTR_8_HI"/>
+	<reg32 offset="0x0552" name="RBBM_PRIMCTR_9_LO"/>  <!-- raster primitives in -->
+	<reg32 offset="0x0553" name="RBBM_PRIMCTR_9_HI"/>
+	<reg32 offset="0x0554" name="RBBM_PRIMCTR_10_LO"/>
+	<reg32 offset="0x0555" name="RBBM_PRIMCTR_10_HI"/>
+
+	<reg32 offset="0xF400" name="RBBM_SECVID_TRUST_CNTL"/>
+	<reg64 offset="0xF800" name="RBBM_SECVID_TSB_TRUSTED_BASE"/>
+	<reg32 offset="0xF802" name="RBBM_SECVID_TSB_TRUSTED_SIZE"/>
+	<reg32 offset="0xF803" name="RBBM_SECVID_TSB_CNTL"/>
+	<reg32 offset="0xF810" name="RBBM_SECVID_TSB_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg64 offset="0xfc00" name="RBBM_SECVID_TSB_STATUS" variants="A7XX-"/>
+	<reg32 offset="0x00010" name="RBBM_VBIF_CLIENT_QOS_CNTL"/>
+	<reg32 offset="0x00011" name="RBBM_GBIF_CLIENT_QOS_CNTL"/>
+	<reg32 offset="0x00016" name="RBBM_GBIF_HALT"/>
+	<reg32 offset="0x00017" name="RBBM_GBIF_HALT_ACK"/>
+	<reg32 offset="0x0001c" name="RBBM_WAIT_FOR_GPU_IDLE_CMD">
+		<bitfield pos="0" name="WAIT_GPU_IDLE" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00016" name="RBBM_GBIF_HALT" variants="A7XX-"/>
+	<reg32 offset="0x00017" name="RBBM_GBIF_HALT_ACK" variants="A7XX-"/>
+	<reg32 offset="0x0001f" name="RBBM_INTERFACE_HANG_INT_CNTL"/>
+	<reg32 offset="0x00037" name="RBBM_INT_CLEAR_CMD" type="A6XX_RBBM_INT_0_MASK"/>
+	<reg32 offset="0x00038" name="RBBM_INT_0_MASK" type="A6XX_RBBM_INT_0_MASK"/>
+	<reg32 offset="0x0003a" name="RBBM_INT_2_MASK" variants="A7XX-"/>
+	<reg32 offset="0x00042" name="RBBM_SP_HYST_CNT"/>
+	<reg32 offset="0x00043" name="RBBM_SW_RESET_CMD"/>
+	<reg32 offset="0x00044" name="RBBM_RAC_THRESHOLD_CNT"/>
+	<reg32 offset="0x00045" name="RBBM_BLOCK_SW_RESET_CMD"/>
+	<reg32 offset="0x00046" name="RBBM_BLOCK_SW_RESET_CMD2"/>
+	<reg32 offset="0x000ad" name="RBBM_CLOCK_CNTL_GLOBAL" variants="A7XX-"/>
+	<reg32 offset="0x000ae" name="RBBM_CLOCK_CNTL"/>
+	<reg32 offset="0x000b0" name="RBBM_CLOCK_CNTL_SP0"/>
+	<reg32 offset="0x000b1" name="RBBM_CLOCK_CNTL_SP1"/>
+	<reg32 offset="0x000b2" name="RBBM_CLOCK_CNTL_SP2"/>
+	<reg32 offset="0x000b3" name="RBBM_CLOCK_CNTL_SP3"/>
+	<reg32 offset="0x000b4" name="RBBM_CLOCK_CNTL2_SP0"/>
+	<reg32 offset="0x000b5" name="RBBM_CLOCK_CNTL2_SP1"/>
+	<reg32 offset="0x000b6" name="RBBM_CLOCK_CNTL2_SP2"/>
+	<reg32 offset="0x000b7" name="RBBM_CLOCK_CNTL2_SP3"/>
+	<reg32 offset="0x000b8" name="RBBM_CLOCK_DELAY_SP0"/>
+	<reg32 offset="0x000b9" name="RBBM_CLOCK_DELAY_SP1"/>
+	<reg32 offset="0x000ba" name="RBBM_CLOCK_DELAY_SP2"/>
+	<reg32 offset="0x000bb" name="RBBM_CLOCK_DELAY_SP3"/>
+	<reg32 offset="0x000bc" name="RBBM_CLOCK_HYST_SP0"/>
+	<reg32 offset="0x000bd" name="RBBM_CLOCK_HYST_SP1"/>
+	<reg32 offset="0x000be" name="RBBM_CLOCK_HYST_SP2"/>
+	<reg32 offset="0x000bf" name="RBBM_CLOCK_HYST_SP3"/>
+	<reg32 offset="0x000c0" name="RBBM_CLOCK_CNTL_TP0"/>
+	<reg32 offset="0x000c1" name="RBBM_CLOCK_CNTL_TP1"/>
+	<reg32 offset="0x000c2" name="RBBM_CLOCK_CNTL_TP2"/>
+	<reg32 offset="0x000c3" name="RBBM_CLOCK_CNTL_TP3"/>
+	<reg32 offset="0x000c4" name="RBBM_CLOCK_CNTL2_TP0"/>
+	<reg32 offset="0x000c5" name="RBBM_CLOCK_CNTL2_TP1"/>
+	<reg32 offset="0x000c6" name="RBBM_CLOCK_CNTL2_TP2"/>
+	<reg32 offset="0x000c7" name="RBBM_CLOCK_CNTL2_TP3"/>
+	<reg32 offset="0x000c8" name="RBBM_CLOCK_CNTL3_TP0"/>
+	<reg32 offset="0x000c9" name="RBBM_CLOCK_CNTL3_TP1"/>
+	<reg32 offset="0x000ca" name="RBBM_CLOCK_CNTL3_TP2"/>
+	<reg32 offset="0x000cb" name="RBBM_CLOCK_CNTL3_TP3"/>
+	<reg32 offset="0x000cc" name="RBBM_CLOCK_CNTL4_TP0"/>
+	<reg32 offset="0x000cd" name="RBBM_CLOCK_CNTL4_TP1"/>
+	<reg32 offset="0x000ce" name="RBBM_CLOCK_CNTL4_TP2"/>
+	<reg32 offset="0x000cf" name="RBBM_CLOCK_CNTL4_TP3"/>
+	<reg32 offset="0x000d0" name="RBBM_CLOCK_DELAY_TP0"/>
+	<reg32 offset="0x000d1" name="RBBM_CLOCK_DELAY_TP1"/>
+	<reg32 offset="0x000d2" name="RBBM_CLOCK_DELAY_TP2"/>
+	<reg32 offset="0x000d3" name="RBBM_CLOCK_DELAY_TP3"/>
+	<reg32 offset="0x000d4" name="RBBM_CLOCK_DELAY2_TP0"/>
+	<reg32 offset="0x000d5" name="RBBM_CLOCK_DELAY2_TP1"/>
+	<reg32 offset="0x000d6" name="RBBM_CLOCK_DELAY2_TP2"/>
+	<reg32 offset="0x000d7" name="RBBM_CLOCK_DELAY2_TP3"/>
+	<reg32 offset="0x000d8" name="RBBM_CLOCK_DELAY3_TP0"/>
+	<reg32 offset="0x000d9" name="RBBM_CLOCK_DELAY3_TP1"/>
+	<reg32 offset="0x000da" name="RBBM_CLOCK_DELAY3_TP2"/>
+	<reg32 offset="0x000db" name="RBBM_CLOCK_DELAY3_TP3"/>
+	<reg32 offset="0x000dc" name="RBBM_CLOCK_DELAY4_TP0"/>
+	<reg32 offset="0x000dd" name="RBBM_CLOCK_DELAY4_TP1"/>
+	<reg32 offset="0x000de" name="RBBM_CLOCK_DELAY4_TP2"/>
+	<reg32 offset="0x000df" name="RBBM_CLOCK_DELAY4_TP3"/>
+	<reg32 offset="0x000e0" name="RBBM_CLOCK_HYST_TP0"/>
+	<reg32 offset="0x000e1" name="RBBM_CLOCK_HYST_TP1"/>
+	<reg32 offset="0x000e2" name="RBBM_CLOCK_HYST_TP2"/>
+	<reg32 offset="0x000e3" name="RBBM_CLOCK_HYST_TP3"/>
+	<reg32 offset="0x000e4" name="RBBM_CLOCK_HYST2_TP0"/>
+	<reg32 offset="0x000e5" name="RBBM_CLOCK_HYST2_TP1"/>
+	<reg32 offset="0x000e6" name="RBBM_CLOCK_HYST2_TP2"/>
+	<reg32 offset="0x000e7" name="RBBM_CLOCK_HYST2_TP3"/>
+	<reg32 offset="0x000e8" name="RBBM_CLOCK_HYST3_TP0"/>
+	<reg32 offset="0x000e9" name="RBBM_CLOCK_HYST3_TP1"/>
+	<reg32 offset="0x000ea" name="RBBM_CLOCK_HYST3_TP2"/>
+	<reg32 offset="0x000eb" name="RBBM_CLOCK_HYST3_TP3"/>
+	<reg32 offset="0x000ec" name="RBBM_CLOCK_HYST4_TP0"/>
+	<reg32 offset="0x000ed" name="RBBM_CLOCK_HYST4_TP1"/>
+	<reg32 offset="0x000ee" name="RBBM_CLOCK_HYST4_TP2"/>
+	<reg32 offset="0x000ef" name="RBBM_CLOCK_HYST4_TP3"/>
+	<reg32 offset="0x000f0" name="RBBM_CLOCK_CNTL_RB0"/>
+	<reg32 offset="0x000f1" name="RBBM_CLOCK_CNTL_RB1"/>
+	<reg32 offset="0x000f2" name="RBBM_CLOCK_CNTL_RB2"/>
+	<reg32 offset="0x000f3" name="RBBM_CLOCK_CNTL_RB3"/>
+	<reg32 offset="0x000f4" name="RBBM_CLOCK_CNTL2_RB0"/>
+	<reg32 offset="0x000f5" name="RBBM_CLOCK_CNTL2_RB1"/>
+	<reg32 offset="0x000f6" name="RBBM_CLOCK_CNTL2_RB2"/>
+	<reg32 offset="0x000f7" name="RBBM_CLOCK_CNTL2_RB3"/>
+	<reg32 offset="0x000f8" name="RBBM_CLOCK_CNTL_CCU0"/>
+	<reg32 offset="0x000f9" name="RBBM_CLOCK_CNTL_CCU1"/>
+	<reg32 offset="0x000fa" name="RBBM_CLOCK_CNTL_CCU2"/>
+	<reg32 offset="0x000fb" name="RBBM_CLOCK_CNTL_CCU3"/>
+	<reg32 offset="0x00100" name="RBBM_CLOCK_HYST_RB_CCU0"/>
+	<reg32 offset="0x00101" name="RBBM_CLOCK_HYST_RB_CCU1"/>
+	<reg32 offset="0x00102" name="RBBM_CLOCK_HYST_RB_CCU2"/>
+	<reg32 offset="0x00103" name="RBBM_CLOCK_HYST_RB_CCU3"/>
+	<reg32 offset="0x00104" name="RBBM_CLOCK_CNTL_RAC"/>
+	<reg32 offset="0x00105" name="RBBM_CLOCK_CNTL2_RAC"/>
+	<reg32 offset="0x00106" name="RBBM_CLOCK_DELAY_RAC"/>
+	<reg32 offset="0x00107" name="RBBM_CLOCK_HYST_RAC"/>
+	<reg32 offset="0x00108" name="RBBM_CLOCK_CNTL_TSE_RAS_RBBM"/>
+	<reg32 offset="0x00109" name="RBBM_CLOCK_DELAY_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0010a" name="RBBM_CLOCK_HYST_TSE_RAS_RBBM"/>
+	<reg32 offset="0x0010b" name="RBBM_CLOCK_CNTL_UCHE"/>
+	<reg32 offset="0x0010c" name="RBBM_CLOCK_CNTL2_UCHE"/>
+	<reg32 offset="0x0010d" name="RBBM_CLOCK_CNTL3_UCHE"/>
+	<reg32 offset="0x0010e" name="RBBM_CLOCK_CNTL4_UCHE"/>
+	<reg32 offset="0x0010f" name="RBBM_CLOCK_DELAY_UCHE"/>
+	<reg32 offset="0x00110" name="RBBM_CLOCK_HYST_UCHE"/>
+	<reg32 offset="0x00111" name="RBBM_CLOCK_MODE_VFD"/>
+	<reg32 offset="0x00112" name="RBBM_CLOCK_DELAY_VFD"/>
+	<reg32 offset="0x00113" name="RBBM_CLOCK_HYST_VFD"/>
+	<reg32 offset="0x00114" name="RBBM_CLOCK_MODE_GPC"/>
+	<reg32 offset="0x00115" name="RBBM_CLOCK_DELAY_GPC"/>
+	<reg32 offset="0x00116" name="RBBM_CLOCK_HYST_GPC"/>
+	<reg32 offset="0x00117" name="RBBM_CLOCK_DELAY_HLSQ_2"/>
+	<reg32 offset="0x00118" name="RBBM_CLOCK_CNTL_GMU_GX"/>
+	<reg32 offset="0x00119" name="RBBM_CLOCK_DELAY_GMU_GX"/>
+	<reg32 offset="0x0011a" name="RBBM_CLOCK_HYST_GMU_GX"/>
+	<reg32 offset="0x0011b" name="RBBM_CLOCK_MODE_HLSQ"/>
+	<reg32 offset="0x0011c" name="RBBM_CLOCK_DELAY_HLSQ"/>
+	<reg32 offset="0x0011d" name="RBBM_CLOCK_HYST_HLSQ"/>
+	<reg32 offset="0x0011e" name="RBBM_CGC_GLOBAL_LOAD_CMD" variants="A7XX-"/>
+	<reg32 offset="0x0011f" name="RBBM_CGC_P2S_TRIG_CMD" variants="A7XX-"/>
+	<reg32 offset="0x00120" name="RBBM_CLOCK_CNTL_TEX_FCHE"/>
+	<reg32 offset="0x00121" name="RBBM_CLOCK_DELAY_TEX_FCHE"/>
+	<reg32 offset="0x00122" name="RBBM_CLOCK_HYST_TEX_FCHE"/>
+	<reg32 offset="0x00122" name="RBBM_CGC_P2S_STATUS" variants="A7XX-">
+		<bitfield name="TXDONE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00123" name="RBBM_CLOCK_CNTL_FCHE"/>
+	<reg32 offset="0x00124" name="RBBM_CLOCK_DELAY_FCHE"/>
+	<reg32 offset="0x00125" name="RBBM_CLOCK_HYST_FCHE"/>
+	<reg32 offset="0x00126" name="RBBM_CLOCK_CNTL_MHUB"/>
+	<reg32 offset="0x00127" name="RBBM_CLOCK_DELAY_MHUB"/>
+	<reg32 offset="0x00128" name="RBBM_CLOCK_HYST_MHUB"/>
+	<reg32 offset="0x00129" name="RBBM_CLOCK_DELAY_GLC"/>
+	<reg32 offset="0x0012a" name="RBBM_CLOCK_HYST_GLC"/>
+	<reg32 offset="0x0012b" name="RBBM_CLOCK_CNTL_GLC"/>
+	<reg32 offset="0x0012f" name="RBBM_CLOCK_HYST2_VFD" variants="A7XX-"/>
+	<reg32 offset="0x005ff" name="RBBM_LPAC_GBIF_CLIENT_QOS_CNTL"/>
+
+	<reg32 offset="0x0600" name="DBGC_CFG_DBGBUS_SEL_A"/>
+	<reg32 offset="0x0601" name="DBGC_CFG_DBGBUS_SEL_B"/>
+	<reg32 offset="0x0602" name="DBGC_CFG_DBGBUS_SEL_C"/>
+	<reg32 offset="0x0603" name="DBGC_CFG_DBGBUS_SEL_D">
+		<bitfield high="7" low="0" name="PING_INDEX"/>
+		<bitfield high="15" low="8" name="PING_BLK_SEL"/>
+	</reg32>
+	<reg32 offset="0x0604" name="DBGC_CFG_DBGBUS_CNTLT">
+		<bitfield high="5" low="0" name="TRACEEN"/>
+		<bitfield high="14" low="12" name="GRANU"/>
+		<bitfield high="31" low="28" name="SEGT"/>
+	</reg32>
+	<reg32 offset="0x0605" name="DBGC_CFG_DBGBUS_CNTLM">
+		<bitfield high="27" low="24" name="ENABLE"/>
+	</reg32>
+	<reg32 offset="0x0608" name="DBGC_CFG_DBGBUS_IVTL_0"/>
+	<reg32 offset="0x0609" name="DBGC_CFG_DBGBUS_IVTL_1"/>
+	<reg32 offset="0x060a" name="DBGC_CFG_DBGBUS_IVTL_2"/>
+	<reg32 offset="0x060b" name="DBGC_CFG_DBGBUS_IVTL_3"/>
+	<reg32 offset="0x060c" name="DBGC_CFG_DBGBUS_MASKL_0"/>
+	<reg32 offset="0x060d" name="DBGC_CFG_DBGBUS_MASKL_1"/>
+	<reg32 offset="0x060e" name="DBGC_CFG_DBGBUS_MASKL_2"/>
+	<reg32 offset="0x060f" name="DBGC_CFG_DBGBUS_MASKL_3"/>
+	<reg32 offset="0x0610" name="DBGC_CFG_DBGBUS_BYTEL_0">
+		<bitfield high="3" low="0" name="BYTEL0"/>
+		<bitfield high="7" low="4" name="BYTEL1"/>
+		<bitfield high="11" low="8" name="BYTEL2"/>
+		<bitfield high="15" low="12" name="BYTEL3"/>
+		<bitfield high="19" low="16" name="BYTEL4"/>
+		<bitfield high="23" low="20" name="BYTEL5"/>
+		<bitfield high="27" low="24" name="BYTEL6"/>
+		<bitfield high="31" low="28" name="BYTEL7"/>
+	</reg32>
+	<reg32 offset="0x0611" name="DBGC_CFG_DBGBUS_BYTEL_1">
+		<bitfield high="3" low="0" name="BYTEL8"/>
+		<bitfield high="7" low="4" name="BYTEL9"/>
+		<bitfield high="11" low="8" name="BYTEL10"/>
+		<bitfield high="15" low="12" name="BYTEL11"/>
+		<bitfield high="19" low="16" name="BYTEL12"/>
+		<bitfield high="23" low="20" name="BYTEL13"/>
+		<bitfield high="27" low="24" name="BYTEL14"/>
+		<bitfield high="31" low="28" name="BYTEL15"/>
+	</reg32>
+	<reg32 offset="0x062f" name="DBGC_CFG_DBGBUS_TRACE_BUF1"/>
+	<reg32 offset="0x0630" name="DBGC_CFG_DBGBUS_TRACE_BUF2"/>
+	<array offset="0x0CD8" name="VSC_PERFCTR_VSC_SEL" stride="1" length="2"/>
+	<reg32 offset="0x0CD8" name="VSC_UNKNOWN_0CD8" variants="A7XX">
+		<doc>
+			Set to true when binning, isn't changed afterwards
+		</doc>
+		<bitfield name="BINNING" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xC800" name="HLSQ_DBG_AHB_READ_APERTURE"/>
+	<reg32 offset="0xD000" name="HLSQ_DBG_READ_SEL"/>
+	<reg32 offset="0x0E00" name="UCHE_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0x0E01" name="UCHE_MODE_CNTL"/>
+	<reg64 offset="0x0E05" name="UCHE_WRITE_RANGE_MAX"/>
+	<reg64 offset="0x0E07" name="UCHE_WRITE_THRU_BASE"/>
+	<reg64 offset="0x0E09" name="UCHE_TRAP_BASE"/>
+	<reg64 offset="0x0E0B" name="UCHE_GMEM_RANGE_MIN"/>
+	<reg64 offset="0x0E0D" name="UCHE_GMEM_RANGE_MAX"/>
+	<reg32 offset="0x0E17" name="UCHE_CACHE_WAYS" usage="cmd"/>
+	<reg32 offset="0x0E18" name="UCHE_FILTER_CNTL"/>
+	<reg32 offset="0x0E19" name="UCHE_CLIENT_PF" usage="cmd">
+		<bitfield high="7" low="0" name="PERFSEL"/>
+	</reg32>
+	<array offset="0x0E1C" name="UCHE_PERFCTR_UCHE_SEL" stride="1" length="12"/>
+	<reg32 offset="0x0e3a" name="UCHE_GBIF_GX_CONFIG"/>
+	<reg32 offset="0x0e3c" name="UCHE_CMDQ_CONFIG"/>
+
+	<reg32 offset="0x3000" name="VBIF_VERSION"/>
+	<reg32 offset="0x3001" name="VBIF_CLKON">
+		<bitfield pos="1" name="FORCE_ON_TESTBUS" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x302A" name="VBIF_GATE_OFF_WRREQ_EN"/>
+	<reg32 offset="0x3080" name="VBIF_XIN_HALT_CTRL0"/>
+	<reg32 offset="0x3081" name="VBIF_XIN_HALT_CTRL1"/>
+	<reg32 offset="0x3084" name="VBIF_TEST_BUS_OUT_CTRL"/>
+	<reg32 offset="0x3085" name="VBIF_TEST_BUS1_CTRL0"/>
+	<reg32 offset="0x3086" name="VBIF_TEST_BUS1_CTRL1">
+		<bitfield low="0" high="3" name="DATA_SEL"/>
+	</reg32>
+	<reg32 offset="0x3087" name="VBIF_TEST_BUS2_CTRL0"/>
+	<reg32 offset="0x3088" name="VBIF_TEST_BUS2_CTRL1">
+		<bitfield low="0" high="8" name="DATA_SEL"/>
+	</reg32>
+	<reg32 offset="0x308c" name="VBIF_TEST_BUS_OUT"/>
+	<reg32 offset="0x30d0" name="VBIF_PERF_CNT_SEL0"/>
+	<reg32 offset="0x30d1" name="VBIF_PERF_CNT_SEL1"/>
+	<reg32 offset="0x30d2" name="VBIF_PERF_CNT_SEL2"/>
+	<reg32 offset="0x30d3" name="VBIF_PERF_CNT_SEL3"/>
+	<reg32 offset="0x30d8" name="VBIF_PERF_CNT_LOW0"/>
+	<reg32 offset="0x30d9" name="VBIF_PERF_CNT_LOW1"/>
+	<reg32 offset="0x30da" name="VBIF_PERF_CNT_LOW2"/>
+	<reg32 offset="0x30db" name="VBIF_PERF_CNT_LOW3"/>
+	<reg32 offset="0x30e0" name="VBIF_PERF_CNT_HIGH0"/>
+	<reg32 offset="0x30e1" name="VBIF_PERF_CNT_HIGH1"/>
+	<reg32 offset="0x30e2" name="VBIF_PERF_CNT_HIGH2"/>
+	<reg32 offset="0x30e3" name="VBIF_PERF_CNT_HIGH3"/>
+	<reg32 offset="0x3100" name="VBIF_PERF_PWR_CNT_EN0"/>
+	<reg32 offset="0x3101" name="VBIF_PERF_PWR_CNT_EN1"/>
+	<reg32 offset="0x3102" name="VBIF_PERF_PWR_CNT_EN2"/>
+	<reg32 offset="0x3110" name="VBIF_PERF_PWR_CNT_LOW0"/>
+	<reg32 offset="0x3111" name="VBIF_PERF_PWR_CNT_LOW1"/>
+	<reg32 offset="0x3112" name="VBIF_PERF_PWR_CNT_LOW2"/>
+	<reg32 offset="0x3118" name="VBIF_PERF_PWR_CNT_HIGH0"/>
+	<reg32 offset="0x3119" name="VBIF_PERF_PWR_CNT_HIGH1"/>
+	<reg32 offset="0x311a" name="VBIF_PERF_PWR_CNT_HIGH2"/>
+
+	<reg32 offset="0x3c01" name="GBIF_SCACHE_CNTL0"/>
+	<reg32 offset="0x3c02" name="GBIF_SCACHE_CNTL1"/>
+	<reg32 offset="0x3c03" name="GBIF_QSB_SIDE0"/>
+	<reg32 offset="0x3c04" name="GBIF_QSB_SIDE1"/>
+	<reg32 offset="0x3c05" name="GBIF_QSB_SIDE2"/>
+	<reg32 offset="0x3c06" name="GBIF_QSB_SIDE3"/>
+	<reg32 offset="0x3c45" name="GBIF_HALT"/>
+	<reg32 offset="0x3c46" name="GBIF_HALT_ACK"/>
+	<reg32 offset="0x3cc0" name="GBIF_PERF_PWR_CNT_EN"/>
+	<reg32 offset="0x3cc1" name="GBIF_PERF_PWR_CNT_CLR"/>
+	<reg32 offset="0x3cc2" name="GBIF_PERF_CNT_SEL"/>
+	<reg32 offset="0x3cc3" name="GBIF_PERF_PWR_CNT_SEL"/>
+	<reg32 offset="0x3cc4" name="GBIF_PERF_CNT_LOW0"/>
+	<reg32 offset="0x3cc5" name="GBIF_PERF_CNT_LOW1"/>
+	<reg32 offset="0x3cc6" name="GBIF_PERF_CNT_LOW2"/>
+	<reg32 offset="0x3cc7" name="GBIF_PERF_CNT_LOW3"/>
+	<reg32 offset="0x3cc8" name="GBIF_PERF_CNT_HIGH0"/>
+	<reg32 offset="0x3cc9" name="GBIF_PERF_CNT_HIGH1"/>
+	<reg32 offset="0x3cca" name="GBIF_PERF_CNT_HIGH2"/>
+	<reg32 offset="0x3ccb" name="GBIF_PERF_CNT_HIGH3"/>
+	<reg32 offset="0x3ccc" name="GBIF_PWR_CNT_LOW0"/>
+	<reg32 offset="0x3ccd" name="GBIF_PWR_CNT_LOW1"/>
+	<reg32 offset="0x3cce" name="GBIF_PWR_CNT_LOW2"/>
+	<reg32 offset="0x3ccf" name="GBIF_PWR_CNT_HIGH0"/>
+	<reg32 offset="0x3cd0" name="GBIF_PWR_CNT_HIGH1"/>
+	<reg32 offset="0x3cd1" name="GBIF_PWR_CNT_HIGH2"/>
+
+	<reg32 offset="0x0c00" name="VSC_DBG_ECO_CNTL"/>
+	<reg32 offset="0x0c02" name="VSC_BIN_SIZE" usage="rp_blit">
+		<bitfield name="WIDTH" low="0" high="7" shr="5" type="uint"/>
+		<bitfield name="HEIGHT" low="8" high="16" shr="4" type="uint"/>
+	</reg32>
+	<reg64 offset="0x0c03" name="VSC_DRAW_STRM_SIZE_ADDRESS" type="waddress" usage="cmd"/>
+	<reg32 offset="0x0c06" name="VSC_BIN_COUNT" usage="rp_blit">
+		<bitfield name="NX" low="1" high="10" type="uint"/>
+		<bitfield name="NY" low="11" high="20" type="uint"/>
+	</reg32>
+	<array offset="0x0c10" name="VSC_PIPE_CONFIG" stride="1" length="32" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<doc>
+				Configures the mapping between VSC_PIPE buffer and
+				bin, X/Y specify the bin index in the horiz/vert
+				direction (0,0 is upper left, 0,1 is leftmost bin
+				on second row, and so on).  W/H specify the number
+				of bins assigned to this VSC_PIPE in the horiz/vert
+				dimension.
+			</doc>
+			<bitfield name="X" low="0" high="9" type="uint"/>
+			<bitfield name="Y" low="10" high="19" type="uint"/>
+			<bitfield name="W" low="20" high="25" type="uint"/>
+			<bitfield name="H" low="26" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<!--
+	HW binning primitive & draw streams, which enable draws and primitives
+	within a draw to be skipped in the main tile pass.  See:
+	https://github.com/freedreno/freedreno/wiki/Visibility-Stream-Format
+
+	Compared to a5xx and earlier, we just program the address of the first
+	stream and hw adds (pipe_num * VSC_*_STRM_PITCH)
+
+	LIMIT is set to PITCH - 64, to make room for a bit of overflow
+	 -->
+	<reg64 offset="0x0c30" name="VSC_PRIM_STRM_ADDRESS" type="waddress" usage="cmd"/>
+	<reg32 offset="0x0c32" name="VSC_PRIM_STRM_PITCH" usage="cmd"/>
+	<reg32 offset="0x0c33" name="VSC_PRIM_STRM_LIMIT" usage="cmd"/>
+	<reg64 offset="0x0c34" name="VSC_DRAW_STRM_ADDRESS" type="waddress" usage="cmd"/>
+	<reg32 offset="0x0c36" name="VSC_DRAW_STRM_PITCH" usage="cmd"/>
+	<reg32 offset="0x0c37" name="VSC_DRAW_STRM_LIMIT" usage="cmd"/>
+
+	<array offset="0x0c38" name="VSC_STATE" stride="1" length="32" usage="rp_blit">
+		<doc>
+			Seems to be a bitmap of which tiles mapped to the VSC
+			pipe contain geometry.
+
+			I suppose we can connect a maximum of 32 tiles to a
+			single VSC pipe.
+		</doc>
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+
+	<array offset="0x0c58" name="VSC_PRIM_STRM_SIZE" stride="1" length="32" variants="A6XX" usage="rp_blit">
+		<doc>
+			Has the size of data written to corresponding VSC_PRIM_STRM
+			buffer.
+		</doc>
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+
+	<array offset="0x0c78" name="VSC_DRAW_STRM_SIZE" stride="1" length="32" variants="A6XX" usage="rp_blit">
+		<doc>
+			Has the size of data written to corresponding VSC pipe, ie.
+			same thing that is written out to VSC_DRAW_STRM_SIZE_ADDRESS_LO/HI
+		</doc>
+		<reg32 offset="0x0" name="REG"/>
+	</array>
+
+	<reg32 offset="0x0d08" name="VSC_UNKNOWN_0D08" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0x0E10" name="UCHE_UNKNOWN_0E10" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x0E11" name="UCHE_UNKNOWN_0E11" variants="A7XX-" usage="cmd"/>
+	<!-- always 0x03200000 ? -->
+	<reg32 offset="0x0e12" name="UCHE_UNKNOWN_0E12"  usage="cmd"/>
+
+	<!-- adreno_reg_xy has 15 bits per coordinate, but a6xx registers only have 14 -->
+	<bitset name="a6xx_reg_xy" inline="yes">
+		<bitfield name="X" low="0" high="13" type="uint"/>
+		<bitfield name="Y" low="16" high="29" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x8000" name="GRAS_CL_CNTL" usage="rp_blit">
+		<bitfield name="CLIP_DISABLE" pos="0" type="boolean"/>
+		<bitfield name="ZNEAR_CLIP_DISABLE" pos="1" type="boolean"/>
+		<bitfield name="ZFAR_CLIP_DISABLE" pos="2" type="boolean"/>
+		<bitfield name="Z_CLAMP_ENABLE" pos="5" type="boolean"/>
+		<!-- controls near z clip behavior (set for vulkan) -->
+		<bitfield name="ZERO_GB_SCALE_Z" pos="6" type="boolean"/>
+		<!-- guess based on a3xx and meaning of bits 8 and 9
+		     if the guess is right then this is related to point sprite clipping -->
+		<bitfield name="VP_CLIP_CODE_IGNORE" pos="7" type="boolean"/>
+		<bitfield name="VP_XFORM_DISABLE" pos="8" type="boolean"/>
+		<bitfield name="PERSP_DIVISION_DISABLE" pos="9" type="boolean"/>
+	</reg32>
+
+	<bitset name="a6xx_gras_xs_cl_cntl" inline="yes">
+		<bitfield name="CLIP_MASK" low="0" high="7"/>
+		<bitfield name="CULL_MASK" low="8" high="15"/>
+	</bitset>
+	<reg32 offset="0x8001" name="GRAS_VS_CL_CNTL" type="a6xx_gras_xs_cl_cntl" usage="rp_blit"/>
+	<reg32 offset="0x8002" name="GRAS_DS_CL_CNTL" type="a6xx_gras_xs_cl_cntl" usage="rp_blit"/>
+	<reg32 offset="0x8003" name="GRAS_GS_CL_CNTL" type="a6xx_gras_xs_cl_cntl" usage="rp_blit"/>
+	<reg32 offset="0x8004" name="GRAS_MAX_LAYER_INDEX" low="0" high="10" type="uint" usage="rp_blit"/>
+
+	<reg32 offset="0x8005" name="GRAS_CNTL" usage="rp_blit">
+		<!-- see also RB_RENDER_CONTROL0 -->
+		<bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+		<bitfield name="IJ_LINEAR_PIXEL" pos="3" type="boolean"/>
+		<bitfield name="IJ_LINEAR_CENTROID" pos="4" type="boolean"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" pos="5" type="boolean"/>
+		<bitfield name="COORD_MASK" low="6" high="9" type="hex"/>
+		<bitfield name="UNK10" pos="10" type="boolean" variants="A7XX-"/>
+		<bitfield name="UNK11" pos="11" type="boolean" variants="A7XX-"/>
+	</reg32>
+	<reg32 offset="0x8006" name="GRAS_CL_GUARDBAND_CLIP_ADJ" usage="rp_blit">
+		<bitfield name="HORZ" low="0" high="8" type="uint"/>
+		<bitfield name="VERT" low="10" high="18" type="uint"/>
+	</reg32>
+
+	<!-- Something connected to depth-stencil attachment size -->
+	<reg32 offset="0x8007" name="GRAS_UNKNOWN_8007" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0x8008" name="GRAS_UNKNOWN_8008" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0x8009" name="GRAS_UNKNOWN_8009" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x800a" name="GRAS_UNKNOWN_800A" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x800b" name="GRAS_UNKNOWN_800B" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x800c" name="GRAS_UNKNOWN_800C" variants="A7XX-" usage="cmd"/>
+
+	<!-- <reg32 offset="0x80f0" name="GRAS_UNKNOWN_80F0" type="a6xx_reg_xy"/> -->
+
+	<!-- 0x8006-0x800f invalid -->
+	<array offset="0x8010" name="GRAS_CL_VPORT" stride="6" length="16" usage="rp_blit">
+		<reg32 offset="0" name="XOFFSET" type="float"/>
+		<reg32 offset="1" name="XSCALE" type="float"/>
+		<reg32 offset="2" name="YOFFSET" type="float"/>
+		<reg32 offset="3" name="YSCALE" type="float"/>
+		<reg32 offset="4" name="ZOFFSET" type="float"/>
+		<reg32 offset="5" name="ZSCALE" type="float"/>
+	</array>
+	<array offset="0x8070" name="GRAS_CL_Z_CLAMP" stride="2" length="16" usage="rp_blit">
+		<reg32 offset="0" name="MIN" type="float"/>
+		<reg32 offset="1" name="MAX" type="float"/>
+	</array>
+
+	<reg32 offset="0x8090" name="GRAS_SU_CNTL" usage="rp_blit">
+		<bitfield name="CULL_FRONT" pos="0" type="boolean"/>
+		<bitfield name="CULL_BACK" pos="1" type="boolean"/>
+		<bitfield name="FRONT_CW" pos="2" type="boolean"/>
+		<bitfield name="LINEHALFWIDTH" low="3" high="10" radix="2" type="fixed"/>
+		<bitfield name="POLY_OFFSET" pos="11" type="boolean"/>
+		<bitfield name="UNK12" pos="12"/>
+		<bitfield name="LINE_MODE" pos="13" type="a5xx_line_mode"/>
+		<bitfield name="UNK15" low="15" high="16"/>
+		<!--
+                        On gen1 only MULTIVIEW_ENABLE exists. On gen3 we have
+                        the ability to add the view index to either the RT array
+                        index or the viewport index, and it seems that
+                        MULTIVIEW_ENABLE doesn't do anything, instead we need to
+                        set at least one of RENDERTARGETINDEXINCR or
+                        VIEWPORTINDEXINCR to enable multiview. The blob still
+                        sets MULTIVIEW_ENABLE regardless.
+                        TODO: what about gen2 (a640)?
+		-->
+		<bitfield name="MULTIVIEW_ENABLE" pos="17" type="boolean"/>
+		<bitfield name="RENDERTARGETINDEXINCR" pos="18" type="boolean"/>
+		<bitfield name="VIEWPORTINDEXINCR" pos="19" type="boolean"/>
+		<bitfield name="UNK20" low="20" high="22"/>
+	</reg32>
+	<reg32 offset="0x8091" name="GRAS_SU_POINT_MINMAX" usage="rp_blit">
+		<bitfield name="MIN" low="0" high="15" type="ufixed" radix="4"/>
+		<bitfield name="MAX" low="16" high="31" type="ufixed" radix="4"/>
+	</reg32>
+	<reg32 offset="0x8092" name="GRAS_SU_POINT_SIZE" low="0" high="15" type="fixed" radix="4" usage="rp_blit"/>
+	<!-- 0x8093 invalid -->
+	<reg32 offset="0x8094" name="GRAS_SU_DEPTH_PLANE_CNTL" usage="rp_blit">
+		<bitfield name="Z_MODE" low="0" high="1" type="a6xx_ztest_mode"/>
+	</reg32>
+	<reg32 offset="0x8095" name="GRAS_SU_POLY_OFFSET_SCALE" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8096" name="GRAS_SU_POLY_OFFSET_OFFSET" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8097" name="GRAS_SU_POLY_OFFSET_OFFSET_CLAMP" type="float" usage="rp_blit"/>
+	<!-- duplicates RB_DEPTH_BUFFER_INFO: -->
+	<reg32 offset="0x8098" name="GRAS_SU_DEPTH_BUFFER_INFO" usage="rp_blit">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a6xx_depth_format"/>
+		<bitfield name="UNK3" pos="3"/>
+	</reg32>
+
+	<reg32 offset="0x8099" name="GRAS_SU_CONSERVATIVE_RAS_CNTL" usage="cmd">
+		<bitfield name="CONSERVATIVERASEN" pos="0" type="boolean"/>
+		<bitfield name="SHIFTAMOUNT" low="1" high="2"/>
+		<bitfield name="INNERCONSERVATIVERASEN" pos="3" type="boolean"/>
+		<bitfield name="UNK4" low="4" high="5"/>
+	</reg32>
+	<reg32 offset="0x809a" name="GRAS_SU_PATH_RENDERING_CNTL">
+		<bitfield name="UNK0" pos="0" type="boolean"/>
+		<bitfield name="LINELENGTHEN" pos="1" type="boolean"/>
+	</reg32>
+
+	<bitset name="a6xx_gras_layer_cntl" inline="yes">
+		<bitfield name="WRITES_LAYER" pos="0" type="boolean"/>
+		<bitfield name="WRITES_VIEW" pos="1" type="boolean"/>
+	</bitset>
+	<reg32 offset="0x809b" name="GRAS_VS_LAYER_CNTL" type="a6xx_gras_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x809c" name="GRAS_GS_LAYER_CNTL" type="a6xx_gras_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x809d" name="GRAS_DS_LAYER_CNTL" type="a6xx_gras_layer_cntl" usage="rp_blit"/>
+	<!-- 0x809e/0x809f invalid -->
+
+	<enum name="a6xx_sequenced_thread_dist">
+		<value value="0x0" name="DIST_SCREEN_COORD"/>
+		<value value="0x1" name="DIST_ALL_TO_RB0"/>
+	</enum>
+
+	<enum name="a6xx_single_prim_mode">
+		<value value="0x0" name="NO_FLUSH"/>
+		<doc>
+			In addition to FLUSH_PER_OVERLAP, guarantee that UCHE
+			and CCU don't get out of sync when fetching the previous
+			value for the current pixel. With NO_FLUSH, there's the
+			possibility that the flags for the current pixel are
+			flushed before the data or vice-versa, leading to
+			texture fetches via UCHE getting out of sync values.
+			This mode should eliminate that. It's used in bypass
+			mode for coherent blending
+			(GL_KHR_blend_equation_advanced_coherent) as well as
+			non-coherent blending.
+		</doc>
+		<value value="0x1" name="FLUSH_PER_OVERLAP_AND_OVERWRITE"/>
+		<doc>
+			Invalidate UCHE and wait for any pending work to finish
+			if there was possibly an overlapping primitive prior to
+			the current one. This is similar to a combination of
+			GRAS_SC_CONTROL::INJECT_L2_INVALIDATE_EVENT and
+			WAIT_RB_IDLE_ALL_TRI on a3xx. It's used in GMEM mode for
+			coherent blending
+			(GL_KHR_blend_equation_advanced_coherent).
+		</doc>
+		<value value="0x3" name="FLUSH_PER_OVERLAP"/>
+	</enum>
+
+	<!-- this probably has the same meaning as a3xx GRAS_SC_CONTROL::RASTER_MODE -->
+	<enum name="a6xx_raster_mode">
+		<value value="0x0" name="TYPE_TILED"/>
+		<value value="0x1" name="TYPE_WRITER"/>
+	</enum>
+
+	<!-- I'm guessing this is the same as a3xx -->
+	<enum name="a6xx_raster_direction">
+		<value value="0x0" name="LR_TB"/>
+		<value value="0x1" name="RL_TB"/>
+		<value value="0x2" name="LR_BT"/>
+		<value value="0x3" name="RB_BT"/>
+	</enum>
+
+	<reg32 offset="0x80a0" name="GRAS_SC_CNTL" usage="rp_blit">
+		<bitfield name="CCUSINGLECACHELINESIZE" low="0" high="2"/>
+		<bitfield name="SINGLE_PRIM_MODE" low="3" high="4" type="a6xx_single_prim_mode"/>
+		<bitfield name="RASTER_MODE" pos="5" type="a6xx_raster_mode"/>
+		<bitfield name="RASTER_DIRECTION" low="6" high="7" type="a6xx_raster_direction"/>
+		<bitfield name="SEQUENCED_THREAD_DISTRIBUTION" pos="8" type="a6xx_sequenced_thread_dist"/>
+		<!-- CCUSINGLECACHELINESIZE is ignored unless bit 9 is set -->
+		<bitfield name="UNK9" pos="9" type="boolean"/>
+		<bitfield name="ROTATION" low="10" high="11" type="uint"/>
+		<bitfield name="EARLYVIZOUTEN" pos="12" type="boolean"/>
+	</reg32>
+
+	<enum name="a6xx_render_mode">
+		<value value="0x0" name="RENDERING_PASS"/>
+		<value value="0x1" name="BINNING_PASS"/>
+	</enum>
+
+	<enum name="a6xx_buffers_location">
+		<value value="0" name="BUFFERS_IN_GMEM"/>
+		<value value="3" name="BUFFERS_IN_SYSMEM"/>
+	</enum>
+
+	<enum name="a6xx_lrz_feedback_mask">
+		<value value="0x0" name="LRZ_FEEDBACK_NONE"/>
+		<value value="0x1" name="LRZ_FEEDBACK_EARLY_Z"/>
+		<value value="0x2" name="LRZ_FEEDBACK_EARLY_LRZ_LATE_Z"/>
+		<!-- We don't have a flag type and this flags combination is often used -->
+		<value value="0x3" name="LRZ_FEEDBACK_EARLY_Z_OR_EARLY_LRZ_LATE_Z"/>
+		<value value="0x4" name="LRZ_FEEDBACK_LATE_Z"/>
+	</enum>
+
+	<reg32 offset="0x80a1" name="GRAS_BIN_CONTROL" usage="rp_blit">
+		<bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+		<bitfield name="RENDER_MODE" low="18" high="20" type="a6xx_render_mode"/>
+		<doc>Disable LRZ feedback writes</doc>
+		<bitfield name="FORCE_LRZ_WRITE_DIS" pos="21" type="boolean"/>
+		<bitfield name="BUFFERS_LOCATION" low="22" high="23" type="a6xx_buffers_location" variants="A6XX"/>
+		<doc>
+			Allows draws that don't have GRAS_LRZ_CNTL.LRZ_WRITE but have
+			GRAS_LRZ_CNTL.ENABLE to contribute to LRZ during RENDERING pass.
+			In sysmem mode GRAS_LRZ_CNTL.LRZ_WRITE is not considered.
+		</doc>
+		<bitfield name="LRZ_FEEDBACK_ZMODE_MASK" low="24" high="26" type="a6xx_lrz_feedback_mask"/>
+		<bitfield name="UNK27" pos="27"/>
+	</reg32>
+
+	<reg32 offset="0x80a2" name="GRAS_RAS_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="UNK2" pos="2"/>
+		<bitfield name="UNK3" pos="3"/>
+	</reg32>
+	<reg32 offset="0x80a3" name="GRAS_DEST_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+
+	<bitset name="a6xx_sample_config" inline="yes">
+		<bitfield name="UNK0" pos="0"/>
+		<bitfield name="LOCATION_ENABLE" pos="1" type="boolean"/>
+	</bitset>
+
+	<bitset name="a6xx_sample_locations" inline="yes">
+		<bitfield name="SAMPLE_0_X" low="0" high="3" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_0_Y" low="4" high="7" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_1_X" low="8" high="11" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_1_Y" low="12" high="15" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_2_X" low="16" high="19" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_2_Y" low="20" high="23" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_3_X" low="24" high="27" radix="4" type="fixed"/>
+		<bitfield name="SAMPLE_3_Y" low="28" high="31" radix="4" type="fixed"/>
+	</bitset>
+
+	<reg32 offset="0x80a4" name="GRAS_SAMPLE_CONFIG" type="a6xx_sample_config" usage="rp_blit"/>
+	<reg32 offset="0x80a5" name="GRAS_SAMPLE_LOCATION_0" type="a6xx_sample_locations" usage="rp_blit"/>
+	<reg32 offset="0x80a6" name="GRAS_SAMPLE_LOCATION_1" type="a6xx_sample_locations" usage="rp_blit"/>
+
+	<reg32 offset="0x80a7" name="GRAS_UNKNOWN_80A7" variants="A7XX-" usage="cmd"/>
+
+	<!-- 0x80a7-0x80ae invalid -->
+	<reg32 offset="0x80af" name="GRAS_UNKNOWN_80AF" pos="0" usage="cmd"/>
+
+	<bitset name="a6xx_scissor_xy" inline="yes">
+		<bitfield name="X" low="0" high="15" type="uint"/>
+		<bitfield name="Y" low="16" high="31" type="uint"/>
+	</bitset>
+	<array offset="0x80b0" name="GRAS_SC_SCREEN_SCISSOR" stride="2" length="16" usage="rp_blit">
+		<reg32 offset="0" name="TL" type="a6xx_scissor_xy"/>
+		<reg32 offset="1" name="BR" type="a6xx_scissor_xy"/>
+	</array>
+	<array offset="0x80d0" name="GRAS_SC_VIEWPORT_SCISSOR" stride="2" length="16" usage="rp_blit">
+		<reg32 offset="0" name="TL" type="a6xx_scissor_xy"/>
+		<reg32 offset="1" name="BR" type="a6xx_scissor_xy"/>
+	</array>
+
+	<reg32 offset="0x80f0" name="GRAS_SC_WINDOW_SCISSOR_TL" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x80f1" name="GRAS_SC_WINDOW_SCISSOR_BR" type="a6xx_reg_xy" usage="rp_blit"/>
+
+	<!-- 0x80f4 - 0x80fa are used for VK_KHR_fragment_shading_rate -->
+	<reg64 offset="0x80f4" name="GRAS_UNKNOWN_80F4" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80f5" name="GRAS_UNKNOWN_80F5" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80f6" name="GRAS_UNKNOWN_80F6" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80f8" name="GRAS_UNKNOWN_80F8" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80f9" name="GRAS_UNKNOWN_80F9" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x80fa" name="GRAS_UNKNOWN_80FA" variants="A7XX-" usage="cmd"/>
+
+	<enum name="a6xx_lrz_dir_status">
+		<value value="0x1" name="LRZ_DIR_LE"/>
+		<value value="0x2" name="LRZ_DIR_GE"/>
+		<value value="0x3" name="LRZ_DIR_INVALID"/>
+	</enum>
+
+	<reg32 offset="0x8100" name="GRAS_LRZ_CNTL" usage="rp_blit">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<doc>LRZ write also disabled for blend/etc.</doc>
+		<bitfield name="LRZ_WRITE" pos="1" type="boolean"/>
+		<doc>update MAX instead of MIN value, ie. GL_GREATER/GL_GEQUAL</doc>
+		<bitfield name="GREATER" pos="2" type="boolean"/>
+		<doc>
+			Clears the LRZ block being touched to:
+			- 0.0 if GREATER
+			- 1.0 if LESS
+		</doc>
+		<bitfield name="FC_ENABLE" pos="3" type="boolean" variants="A6XX"/>
+		<!-- set when depth-test + depth-write enabled -->
+		<bitfield name="Z_TEST_ENABLE" pos="4" type="boolean"/>
+		<bitfield name="Z_BOUNDS_ENABLE" pos="5" type="boolean"/>
+		<bitfield name="DIR" low="6" high="7" type="a6xx_lrz_dir_status"/>
+		<doc>
+			If DISABLE_ON_WRONG_DIR enabled - write new LRZ direction into
+			buffer, in case of mismatched direction writes 0 (disables LRZ).
+		</doc>
+		<bitfield name="DIR_WRITE" pos="8" type="boolean"/>
+		<doc>
+			Disable LRZ based on previous direction and the current one.
+			If DIR_WRITE is not enabled - there is no write to direction buffer.
+		</doc>
+		<bitfield name="DISABLE_ON_WRONG_DIR" pos="9" type="boolean" variants="A6XX"/>
+		<bitfield name="Z_FUNC" low="11" high="13" type="adreno_compare_func" variants="A7XX-"/>
+	</reg32>
+
+	<enum name="a6xx_fragcoord_sample_mode">
+		<value value="0" name="FRAGCOORD_CENTER"/>
+		<value value="3" name="FRAGCOORD_SAMPLE"/>
+	</enum>
+
+	<reg32 offset="0x8101" name="GRAS_LRZ_PS_INPUT_CNTL" low="0" high="2" usage="rp_blit">
+		<bitfield name="SAMPLEID" pos="0" type="boolean"/>
+		<bitfield name="FRAGCOORDSAMPLEMODE" low="1" high="2" type="a6xx_fragcoord_sample_mode"/>
+	</reg32>
+
+	<reg32 offset="0x8102" name="GRAS_LRZ_MRT_BUF_INFO_0" usage="rp_blit">
+		<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+	</reg32>
+	<reg64 offset="0x8103" name="GRAS_LRZ_BUFFER_BASE" align="256" type="waddress" usage="rp_blit"/>
+	<reg32 offset="0x8105" name="GRAS_LRZ_BUFFER_PITCH" usage="rp_blit">
+		<!-- TODO: fix the shr fields -->
+		<bitfield name="PITCH" low="0" high="7" shr="5" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="10" high="28" shr="4" type="uint"/>
+	</reg32>
+
+	<!--
+	The LRZ "fast clear" buffer is initialized to zero's by blob, and
+	read/written when GRAS_LRZ_CNTL.FC_ENABLE (b3) is set.  It appears
+	to store 1b/block.  It appears that '0' means block has original
+	depth clear value, and '1' means that the corresponding block in
+	LRZ has been modified.  Ignoring alignment/padding, the size is
+	given by the formula:
+
+		// calculate LRZ size from depth size:
+		if (nr_samples == 4) {
+			width *= 2;
+			height *= 2;
+		} else if (nr_samples == 2) {
+			height *= 2;
+		}
+
+		lrz_width = div_round_up(width, 8);
+		lrz_heigh = div_round_up(height, 8);
+
+		// calculate # of blocks:
+		nblocksx = div_round_up(lrz_width, 16);
+		nblocksy = div_round_up(lrz_height, 4);
+
+		// fast-clear buffer is 1bit/block:
+		fc_sz = div_round_up(nblocksx * nblocksy, 8);
+
+	In practice the blob seems to switch off FC_ENABLE once the size
+	increases beyond 1 page.  Not sure if that is an actual limit or
+	not.
+	 -->
+	<reg64 offset="0x8106" name="GRAS_LRZ_FAST_CLEAR_BUFFER_BASE" align="64" type="waddress" usage="rp_blit"/>
+	<!-- 0x8108 invalid -->
+	<reg32 offset="0x8109" name="GRAS_SAMPLE_CNTL" usage="rp_blit">
+		<bitfield name="PER_SAMP_MODE" pos="0" type="boolean"/>
+	</reg32>
+	<!--
+	LRZ buffer represents a single array layer + mip level, and there is
+	a single buffer per depth image. Thus to reuse LRZ between renderpasses
+	it is necessary to track the depth view used in the past renderpass, which
+	GRAS_LRZ_DEPTH_VIEW is for.
+	GRAS_LRZ_CNTL checks if current value of GRAS_LRZ_DEPTH_VIEW is equal to
+	the value stored in the LRZ buffer, if not - LRZ is disabled.
+	-->
+	<reg32 offset="0x810a" name="GRAS_LRZ_DEPTH_VIEW" usage="cmd">
+		<bitfield name="BASE_LAYER" low="0" high="10" type="uint"/>
+		<bitfield name="LAYER_COUNT" low="16" high="26" type="uint"/>
+		<bitfield name="BASE_MIP_LEVEL" low="28" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x810b" name="GRAS_LRZ_CNTL2" variants="A7XX-" usage="rp_blit">
+		<bitfield name="DISABLE_ON_WRONG_DIR" pos="0" type="boolean"/>
+		<bitfield name="FC_ENABLE" pos="1" type="boolean"/>
+	</reg32>
+
+	<!-- 0x810c-0x810f invalid -->
+
+	<reg32 offset="0x8110" name="GRAS_UNKNOWN_8110" low="0" high="1" usage="cmd"/>
+
+	<!-- A bit tentative but it's a color and it is followed by LRZ_CLEAR -->
+	<reg32 offset="0x8111" name="GRAS_LRZ_CLEAR_DEPTH_F32" type="float" variants="A7XX-"/>
+
+	<reg32 offset="0x8113" name="GRAS_LRZ_DEPTH_BUFFER_INFO" variants="A7XX-" usage="rp_blit">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a6xx_depth_format"/>
+		<bitfield name="UNK3" pos="3"/>
+	</reg32>
+
+	<!-- Always written together and always equal 09510840 00000a62 -->
+	<reg32 offset="0x8120" name="GRAS_UNKNOWN_8120" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0x8121" name="GRAS_UNKNOWN_8121" variants="A7XX-" usage="cmd"/>
+
+	<!-- 0x8112-0x83ff invalid -->
+
+	<enum name="a6xx_rotation">
+		<value value="0x0" name="ROTATE_0"/>
+		<value value="0x1" name="ROTATE_90"/>
+		<value value="0x2" name="ROTATE_180"/>
+		<value value="0x3" name="ROTATE_270"/>
+		<value value="0x4" name="ROTATE_HFLIP"/>
+		<value value="0x5" name="ROTATE_VFLIP"/>
+	</enum>
+
+	<bitset name="a6xx_2d_blit_cntl" inline="yes">
+		<bitfield name="ROTATE" low="0" high="2" type="a6xx_rotation"/>
+		<bitfield name="OVERWRITEEN" pos="3" type="boolean"/>
+		<bitfield name="UNK4" low="4" high="6"/>
+		<bitfield name="SOLID_COLOR" pos="7" type="boolean"/>
+		<bitfield name="COLOR_FORMAT" low="8" high="15" type="a6xx_format"/>
+		<bitfield name="SCISSOR" pos="16" type="boolean"/>
+		<bitfield name="UNK17" low="17" high="18"/>
+		<!-- required when blitting D24S8/D24X8 -->
+		<bitfield name="D24S8" pos="19" type="boolean"/>
+		<!-- some sort of channel mask, disabled channels are set to zero ? -->
+		<bitfield name="MASK" low="20" high="23"/>
+		<bitfield name="IFMT" low="24" high="28" type="a6xx_2d_ifmt"/>
+		<bitfield name="RASTER_MODE" pos="29" type="a6xx_raster_mode"/>
+		<bitfield name="UNK30" pos="30" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<reg32 offset="0x8400" name="GRAS_2D_BLIT_CNTL" type="a6xx_2d_blit_cntl" usage="rp_blit"/>
+	<!-- note: the low 8 bits for src coords are valid, probably fixed point
+	     it would be a bit weird though, since we subtract 1 from BR coords
+	     apparently signed, gallium driver uses negative coords and it works?
+	 -->
+	<reg32 offset="0x8401" name="GRAS_2D_SRC_TL_X" low="8" high="24" type="int" usage="rp_blit"/>
+	<reg32 offset="0x8402" name="GRAS_2D_SRC_BR_X" low="8" high="24" type="int" usage="rp_blit"/>
+	<reg32 offset="0x8403" name="GRAS_2D_SRC_TL_Y" low="8" high="24" type="int" usage="rp_blit"/>
+	<reg32 offset="0x8404" name="GRAS_2D_SRC_BR_Y" low="8" high="24" type="int" usage="rp_blit"/>
+	<reg32 offset="0x8405" name="GRAS_2D_DST_TL" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x8406" name="GRAS_2D_DST_BR" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x8407" name="GRAS_2D_UNKNOWN_8407" low="0" high="31"/>
+	<reg32 offset="0x8408" name="GRAS_2D_UNKNOWN_8408" low="0" high="31"/>
+	<reg32 offset="0x8409" name="GRAS_2D_UNKNOWN_8409" low="0" high="31"/>
+	<reg32 offset="0x840a" name="GRAS_2D_RESOLVE_CNTL_1" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x840b" name="GRAS_2D_RESOLVE_CNTL_2" type="a6xx_reg_xy" usage="rp_blit"/>
+	<!-- 0x840c-0x85ff invalid -->
+
+	<!-- always 0x880 ? (and 0 in a640/a650 traces?) -->
+	<reg32 offset="0x8600" name="GRAS_DBG_ECO_CNTL" usage="cmd">
+		<bitfield name="UNK7" pos="7" type="boolean"/>
+		<bitfield name="LRZCACHELOCKDIS" pos="11" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8601" name="GRAS_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode"/>
+	<reg32 offset="0x8602" name="GRAS_NC_MODE_CNTL" variants="A7XX-"/>
+	<array offset="0x8610" name="GRAS_PERFCTR_TSE_SEL" stride="1" length="4"/>
+	<array offset="0x8614" name="GRAS_PERFCTR_RAS_SEL" stride="1" length="4"/>
+	<array offset="0x8618" name="GRAS_PERFCTR_LRZ_SEL" stride="1" length="4"/>
+
+	<!-- note 0x8620-0x87ff are not all invalid
+	(in particular, 0x8631/0x8632 have 0x3fff3fff mask and would be xy coords)
+	-->
+
+	<!-- same as GRAS_BIN_CONTROL, but without bit 27: -->
+	<reg32 offset="0x8800" name="RB_BIN_CONTROL" variants="A6XX" usage="rp_blit">
+		<bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+		<bitfield name="RENDER_MODE" low="18" high="20" type="a6xx_render_mode"/>
+		<bitfield name="FORCE_LRZ_WRITE_DIS" pos="21" type="boolean"/>
+		<bitfield name="BUFFERS_LOCATION" low="22" high="23" type="a6xx_buffers_location"/>
+		<bitfield name="LRZ_FEEDBACK_ZMODE_MASK" low="24" high="26" type="a6xx_lrz_feedback_mask"/>
+	</reg32>
+
+	<reg32 offset="0x8800" name="RB_BIN_CONTROL" variants="A7XX-" usage="rp_blit">
+		<bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+		<bitfield name="RENDER_MODE" low="18" high="20" type="a6xx_render_mode"/>
+		<bitfield name="FORCE_LRZ_WRITE_DIS" pos="21" type="boolean"/>
+		<bitfield name="LRZ_FEEDBACK_ZMODE_MASK" low="24" high="26" type="a6xx_lrz_feedback_mask"/>
+	</reg32>
+
+	<reg32 offset="0x8801" name="RB_RENDER_CNTL" variants="A6XX" usage="rp_blit">
+		<bitfield name="CCUSINGLECACHELINESIZE" low="3" high="5"/>
+		<bitfield name="EARLYVIZOUTEN" pos="6" type="boolean"/>
+		<!-- set during binning pass: -->
+		<bitfield name="BINNING" pos="7" type="boolean"/>
+		<bitfield name="UNK8" low="8" high="10"/>
+		<bitfield name="RASTER_MODE" pos="8" type="a6xx_raster_mode"/>
+		<bitfield name="RASTER_DIRECTION" low="9" high="10" type="a6xx_raster_direction"/>
+		<bitfield name="CONSERVATIVERASEN" pos="11" type="boolean"/>
+		<bitfield name="INNERCONSERVATIVERASEN" pos="12" type="boolean"/>
+		<!-- bit seems to be set whenever depth buffer enabled: -->
+		<bitfield name="FLAG_DEPTH" pos="14" type="boolean"/>
+		<!-- bitmask of MRTs using UBWC flag buffer: -->
+		<bitfield name="FLAG_MRTS" low="16" high="23"/>
+	</reg32>
+	<reg32 offset="0x8801" name="RB_RENDER_CNTL" variants="A7XX-" usage="rp_blit">
+		<bitfield name="EARLYVIZOUTEN" pos="6" type="boolean"/>
+		<!-- set during binning pass: -->
+		<bitfield name="BINNING" pos="7" type="boolean"/>
+		<bitfield name="RASTER_MODE" pos="8" type="a6xx_raster_mode"/>
+		<bitfield name="RASTER_DIRECTION" low="9" high="10" type="a6xx_raster_direction"/>
+		<bitfield name="CONSERVATIVERASEN" pos="11" type="boolean"/>
+		<bitfield name="INNERCONSERVATIVERASEN" pos="12" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8116" name="GRAS_SU_RENDER_CNTL" variants="A7XX-" usage="rp_blit">
+		<bitfield name="BINNING" pos="7" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x8802" name="RB_RAS_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="UNK2" pos="2"/>
+		<bitfield name="UNK3" pos="3"/>
+	</reg32>
+	<reg32 offset="0x8803" name="RB_DEST_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x8804" name="RB_SAMPLE_CONFIG" type="a6xx_sample_config" usage="rp_blit"/>
+	<reg32 offset="0x8805" name="RB_SAMPLE_LOCATION_0" type="a6xx_sample_locations" usage="rp_blit"/>
+	<reg32 offset="0x8806" name="RB_SAMPLE_LOCATION_1" type="a6xx_sample_locations" usage="rp_blit"/>
+	<!-- 0x8807-0x8808 invalid -->
+	<!--
+	note: maybe not actually called RB_RENDER_CONTROLn (since RB_RENDER_CNTL
+	name comes from kernel and is probably right)
+	 -->
+	<reg32 offset="0x8809" name="RB_RENDER_CONTROL0" usage="rp_blit">
+		<!-- see also GRAS_CNTL -->
+		<bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+		<bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+		<bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+		<bitfield name="IJ_LINEAR_PIXEL" pos="3" type="boolean"/>
+		<bitfield name="IJ_LINEAR_CENTROID" pos="4" type="boolean"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" pos="5" type="boolean"/>
+		<bitfield name="COORD_MASK" low="6" high="9" type="hex"/>
+		<bitfield name="UNK10" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x880a" name="RB_RENDER_CONTROL1" usage="rp_blit">
+		<!-- enable bits for various FS sysvalue regs: -->
+		<bitfield name="SAMPLEMASK" pos="0" type="boolean"/>
+		<bitfield name="POSTDEPTHCOVERAGE" pos="1" type="boolean"/>
+		<bitfield name="FACENESS" pos="2" type="boolean"/>
+		<bitfield name="SAMPLEID" pos="3" type="boolean"/>
+		<bitfield name="FRAGCOORDSAMPLEMODE" low="4" high="5" type="a6xx_fragcoord_sample_mode"/>
+		<bitfield name="CENTERRHW" pos="6" type="boolean"/>
+		<bitfield name="LINELENGTHEN" pos="7" type="boolean"/>
+		<bitfield name="FOVEATION" pos="8" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x880b" name="RB_FS_OUTPUT_CNTL0" usage="rp_blit">
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="FRAG_WRITES_Z" pos="1" type="boolean"/>
+		<bitfield name="FRAG_WRITES_SAMPMASK" pos="2" type="boolean"/>
+		<bitfield name="FRAG_WRITES_STENCILREF" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x880c" name="RB_FS_OUTPUT_CNTL1" usage="rp_blit">
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+	</reg32>
+	<reg32 offset="0x880d" name="RB_RENDER_COMPONENTS" usage="rp_blit">
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+	<reg32 offset="0x880e" name="RB_DITHER_CNTL" usage="cmd">
+		<bitfield name="DITHER_MODE_MRT0" low="0"  high="1"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT1" low="2"  high="3"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT2" low="4"  high="5"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT3" low="6"  high="7"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT4" low="8"  high="9"  type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT5" low="10" high="11" type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT6" low="12" high="13" type="adreno_rb_dither_mode"/>
+		<bitfield name="DITHER_MODE_MRT7" low="14" high="15" type="adreno_rb_dither_mode"/>
+	</reg32>
+	<reg32 offset="0x880f" name="RB_SRGB_CNTL" usage="rp_blit">
+		<!-- Same as SP_SRGB_CNTL -->
+		<bitfield name="SRGB_MRT0" pos="0" type="boolean"/>
+		<bitfield name="SRGB_MRT1" pos="1" type="boolean"/>
+		<bitfield name="SRGB_MRT2" pos="2" type="boolean"/>
+		<bitfield name="SRGB_MRT3" pos="3" type="boolean"/>
+		<bitfield name="SRGB_MRT4" pos="4" type="boolean"/>
+		<bitfield name="SRGB_MRT5" pos="5" type="boolean"/>
+		<bitfield name="SRGB_MRT6" pos="6" type="boolean"/>
+		<bitfield name="SRGB_MRT7" pos="7" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x8810" name="RB_SAMPLE_CNTL" usage="rp_blit">
+		<bitfield name="PER_SAMP_MODE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8811" name="RB_UNKNOWN_8811" low="4" high="6" usage="cmd"/>
+	<reg32 offset="0x8812" name="RB_UNKNOWN_8812" variants="A7XX-" usage="rp_blit"/>
+	<!-- 0x8813-0x8817 invalid -->
+	<!-- always 0x0 ? -->
+	<reg32 offset="0x8818" name="RB_UNKNOWN_8818" low="0" high="6" usage="cmd"/>
+	<!-- 0x8819-0x881e all 32 bits -->
+	<reg32 offset="0x8819" name="RB_UNKNOWN_8819" usage="cmd"/>
+	<reg32 offset="0x881a" name="RB_UNKNOWN_881A" usage="cmd"/>
+	<reg32 offset="0x881b" name="RB_UNKNOWN_881B" usage="cmd"/>
+	<reg32 offset="0x881c" name="RB_UNKNOWN_881C" usage="cmd"/>
+	<reg32 offset="0x881d" name="RB_UNKNOWN_881D" usage="cmd"/>
+	<reg32 offset="0x881e" name="RB_UNKNOWN_881E" usage="cmd"/>
+	<!-- 0x881f invalid -->
+	<array offset="0x8820" name="RB_MRT" stride="8" length="8" usage="rp_blit">
+		<reg32 offset="0x0" name="CONTROL">
+			<bitfield name="BLEND" pos="0" type="boolean"/>
+			<bitfield name="BLEND2" pos="1" type="boolean"/>
+			<bitfield name="ROP_ENABLE" pos="2" type="boolean"/>
+			<bitfield name="ROP_CODE" low="3" high="6" type="a3xx_rop_code"/>
+			<bitfield name="COMPONENT_ENABLE" low="7" high="10" type="hex"/>
+		</reg32>
+		<reg32 offset="0x1" name="BLEND_CONTROL">
+			<bitfield name="RGB_SRC_FACTOR" low="0" high="4" type="adreno_rb_blend_factor"/>
+			<bitfield name="RGB_BLEND_OPCODE" low="5" high="7" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="RGB_DEST_FACTOR" low="8" high="12" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_SRC_FACTOR" low="16" high="20" type="adreno_rb_blend_factor"/>
+			<bitfield name="ALPHA_BLEND_OPCODE" low="21" high="23" type="a3xx_rb_blend_opcode"/>
+			<bitfield name="ALPHA_DEST_FACTOR" low="24" high="28" type="adreno_rb_blend_factor"/>
+		</reg32>
+		<reg32 offset="0x2" name="BUF_INFO" variants="A6XX">
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+			<bitfield name="COLOR_TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+			<bitfield name="UNK10" pos="10"/>
+			<bitfield name="COLOR_SWAP" low="13" high="14" type="a3xx_color_swap"/>
+		</reg32>
+		<reg32 offset="0x2" name="BUF_INFO" variants="A7XX-">
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+			<bitfield name="COLOR_TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+			<bitfield name="UNK10" pos="10"/>
+			<bitfield name="LOSSLESSCOMPEN" pos="11" type="boolean"/>
+			<bitfield name="COLOR_SWAP" low="13" high="14" type="a3xx_color_swap"/>
+			<bitfield name="MUTABLEEN" pos="16" type="boolean" variants="A7XX-"/>
+		</reg32>
+		<!--
+		at least in gmem, things seem to be aligned to pitch of 64..
+		maybe an artifact of tiled format used in gmem?
+		 -->
+		<reg32 offset="0x3" name="PITCH" shr="6" high="15" type="uint"/>
+		<reg32 offset="0x4" name="ARRAY_PITCH" shr="6" high="28" type="uint"/>
+		<!--
+		Compared to a5xx and before, we configure both a GMEM base and
+		external base.  Not sure if this is to facilitate GMEM save/
+		restore for context switch, or just to simplify state setup to
+		not have to care about GMEM vs BYPASS mode.
+		 -->
+		<!-- maybe something in low bits since alignment of 1 doesn't make sense? -->
+		<reg64 offset="0x5" name="BASE" type="waddress" align="1"/>
+
+		<reg32 offset="0x7" name="BASE_GMEM" low="12" high="31" shr="12"/>
+	</array>
+
+	<reg32 offset="0x8860" name="RB_BLEND_RED_F32" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8861" name="RB_BLEND_GREEN_F32" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8862" name="RB_BLEND_BLUE_F32" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8863" name="RB_BLEND_ALPHA_F32" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8864" name="RB_ALPHA_CONTROL" usage="cmd">
+		<bitfield name="ALPHA_REF" low="0" high="7" type="hex"/>
+		<bitfield name="ALPHA_TEST" pos="8" type="boolean"/>
+		<bitfield name="ALPHA_TEST_FUNC" low="9" high="11" type="adreno_compare_func"/>
+	</reg32>
+	<reg32 offset="0x8865" name="RB_BLEND_CNTL" usage="rp_blit">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="INDEPENDENT_BLEND" pos="8" type="boolean"/>
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="9" type="boolean"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="10" type="boolean"/>
+		<bitfield name="ALPHA_TO_ONE" pos="11" type="boolean"/>
+		<bitfield name="SAMPLE_MASK" low="16" high="31"/>
+	</reg32>
+	<!-- 0x8866-0x886f invalid -->
+	<reg32 offset="0x8870" name="RB_DEPTH_PLANE_CNTL" usage="rp_blit">
+		<bitfield name="Z_MODE" low="0" high="1" type="a6xx_ztest_mode"/>
+	</reg32>
+
+	<reg32 offset="0x8871" name="RB_DEPTH_CNTL" usage="rp_blit">
+		<bitfield name="Z_TEST_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="Z_WRITE_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="ZFUNC" low="2" high="4" type="adreno_compare_func"/>
+		<bitfield name="Z_CLAMP_ENABLE" pos="5" type="boolean"/>
+		<doc>
+		Z_READ_ENABLE bit is set for zfunc other than GL_ALWAYS or GL_NEVER
+		also set when Z_BOUNDS_ENABLE is set
+		</doc>
+		<bitfield name="Z_READ_ENABLE" pos="6" type="boolean"/>
+		<bitfield name="Z_BOUNDS_ENABLE" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8114" name="GRAS_SU_DEPTH_CNTL" usage="rp_blit">
+		<bitfield name="Z_TEST_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<!-- duplicates GRAS_SU_DEPTH_BUFFER_INFO: -->
+	<reg32 offset="0x8872" name="RB_DEPTH_BUFFER_INFO" variants="A6XX" usage="rp_blit">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a6xx_depth_format"/>
+		<bitfield name="UNK3" low="3" high="4"/>
+	</reg32>
+	<!-- first 4 bits duplicates GRAS_SU_DEPTH_BUFFER_INFO -->
+	<reg32 offset="0x8872" name="RB_DEPTH_BUFFER_INFO" variants="A7XX-" usage="rp_blit">
+		<bitfield name="DEPTH_FORMAT" low="0" high="2" type="a6xx_depth_format"/>
+		<bitfield name="UNK3" low="3" high="4"/>
+		<bitfield name="TILEMODE" low="5" high="6" type="a6xx_tile_mode"/>
+		<bitfield name="LOSSLESSCOMPEN" pos="7" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x8873" name="RB_DEPTH_BUFFER_PITCH" low="0" high="13" shr="6" type="uint" usage="rp_blit"/>
+	<reg32 offset="0x8874" name="RB_DEPTH_BUFFER_ARRAY_PITCH" low="0" high="27" shr="6" type="uint" usage="rp_blit"/>
+	<reg64 offset="0x8875" name="RB_DEPTH_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8877" name="RB_DEPTH_BUFFER_BASE_GMEM" low="12" high="31" shr="12" usage="rp_blit"/>
+
+	<reg32 offset="0x8878" name="RB_Z_BOUNDS_MIN" type="float" usage="rp_blit"/>
+	<reg32 offset="0x8879" name="RB_Z_BOUNDS_MAX" type="float" usage="rp_blit"/>
+	<!-- 0x887a-0x887f invalid -->
+	<reg32 offset="0x8880" name="RB_STENCIL_CONTROL" usage="rp_blit">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="STENCIL_ENABLE_BF" pos="1" type="boolean"/>
+		<!--
+			set for stencil operations that require read from stencil
+			buffer, but not for example for stencil clear (which does
+			not require read).. so guessing this is analogous to
+			READ_DEST_ENABLE for color buffer..
+		 -->
+		<bitfield name="STENCIL_READ" pos="2" type="boolean"/>
+		<bitfield name="FUNC" low="8" high="10" type="adreno_compare_func"/>
+		<bitfield name="FAIL" low="11" high="13" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS" low="14" high="16" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL" low="17" high="19" type="adreno_stencil_op"/>
+		<bitfield name="FUNC_BF" low="20" high="22" type="adreno_compare_func"/>
+		<bitfield name="FAIL_BF" low="23" high="25" type="adreno_stencil_op"/>
+		<bitfield name="ZPASS_BF" low="26" high="28" type="adreno_stencil_op"/>
+		<bitfield name="ZFAIL_BF" low="29" high="31" type="adreno_stencil_op"/>
+	</reg32>
+	<reg32 offset="0x8115" name="GRAS_SU_STENCIL_CNTL" usage="rp_blit">
+		<bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8881" name="RB_STENCIL_INFO" variants="A6XX" usage="rp_blit">
+		<bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+		<bitfield name="UNK1" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8881" name="RB_STENCIL_INFO" variants="A7XX-" usage="rp_blit">
+		<bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+		<bitfield name="UNK1" pos="1" type="boolean"/>
+		<bitfield name="TILEMODE" low="2" high="3" type="a6xx_tile_mode"/>
+	</reg32>
+	<reg32 offset="0x8882" name="RB_STENCIL_BUFFER_PITCH" low="0" high="11" shr="6" type="uint" usage="rp_blit"/>
+	<reg32 offset="0x8883" name="RB_STENCIL_BUFFER_ARRAY_PITCH" low="0" high="23" shr="6" type="uint" usage="rp_blit"/>
+	<reg64 offset="0x8884" name="RB_STENCIL_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8886" name="RB_STENCIL_BUFFER_BASE_GMEM" low="12" high="31" shr="12" usage="rp_blit"/>
+	<reg32 offset="0x8887" name="RB_STENCILREF" usage="rp_blit">
+		<bitfield name="REF" low="0" high="7"/>
+		<bitfield name="BFREF" low="8" high="15"/>
+	</reg32>
+	<reg32 offset="0x8888" name="RB_STENCILMASK" usage="rp_blit">
+		<bitfield name="MASK" low="0" high="7"/>
+		<bitfield name="BFMASK" low="8" high="15"/>
+	</reg32>
+	<reg32 offset="0x8889" name="RB_STENCILWRMASK" usage="rp_blit">
+		<bitfield name="WRMASK" low="0" high="7"/>
+		<bitfield name="BFWRMASK" low="8" high="15"/>
+	</reg32>
+	<!-- 0x888a-0x888f invalid -->
+	<reg32 offset="0x8890" name="RB_WINDOW_OFFSET" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x8891" name="RB_SAMPLE_COUNT_CONTROL" usage="cmd">
+		<bitfield name="DISABLE" pos="0" type="boolean"/>
+		<bitfield name="COPY" pos="1" type="boolean"/>
+	</reg32>
+	<!-- 0x8892-0x8897 invalid -->
+	<reg32 offset="0x8898" name="RB_LRZ_CNTL" usage="rp_blit">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x8899" name="RB_UNKNOWN_8899" variants="A7XX-" usage="cmd"/>
+	<!-- 0x8899-0x88bf invalid -->
+	<!-- clamps depth value for depth test/write -->
+	<reg32 offset="0x88c0" name="RB_Z_CLAMP_MIN" type="float" usage="rp_blit"/>
+	<reg32 offset="0x88c1" name="RB_Z_CLAMP_MAX" type="float" usage="rp_blit"/>
+	<!-- 0x88c2-0x88cf invalid-->
+	<reg32 offset="0x88d0" name="RB_UNKNOWN_88D0" usage="rp_blit">
+		<bitfield name="UNK0" low="0" high="12"/>
+		<bitfield name="UNK16" low="16" high="26"/>
+	</reg32>
+	<reg32 offset="0x88d1" name="RB_BLIT_SCISSOR_TL" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x88d2" name="RB_BLIT_SCISSOR_BR" type="a6xx_reg_xy" usage="rp_blit"/>
+	<!-- weird to duplicate other regs from same block?? -->
+	<reg32 offset="0x88d3" name="RB_BIN_CONTROL2" usage="rp_blit">
+		<bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+		<bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+	</reg32>
+	<reg32 offset="0x88d4" name="RB_WINDOW_OFFSET2" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0x88d5" name="RB_BLIT_GMEM_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="3" high="4" type="a3xx_msaa_samples"/>
+	</reg32>
+	<reg32 offset="0x88d6" name="RB_BLIT_BASE_GMEM" low="12" high="31" shr="12" usage="rp_blit"/>
+	<!-- s/DST_FORMAT/DST_INFO/ probably: -->
+	<reg32 offset="0x88d7" name="RB_BLIT_DST_INFO" usage="rp_blit">
+		<bitfield name="TILE_MODE" low="0" high="1" type="a6xx_tile_mode"/>
+		<bitfield name="FLAGS" pos="2" type="boolean"/>
+		<bitfield name="SAMPLES" low="3" high="4" type="a3xx_msaa_samples"/>
+		<bitfield name="COLOR_SWAP" low="5" high="6" type="a3xx_color_swap"/>
+		<bitfield name="COLOR_FORMAT" low="7" high="14" type="a6xx_format"/>
+		<bitfield name="UNK15" pos="15" type="boolean"/>
+		<bitfield name="MUTABLEEN" pos="16" type="boolean" variants="A7XX-"/>
+	</reg32>
+	<reg64 offset="0x88d8" name="RB_BLIT_DST" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x88da" name="RB_BLIT_DST_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
+	<!-- array-pitch is size of layer -->
+	<reg32 offset="0x88db" name="RB_BLIT_DST_ARRAY_PITCH" low="0" high="28" shr="6" type="uint" usage="rp_blit"/>
+	<reg64 offset="0x88dc" name="RB_BLIT_FLAG_DST" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x88de" name="RB_BLIT_FLAG_DST_PITCH" usage="rp_blit">
+		<bitfield name="PITCH" low="0" high="10" shr="6" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="11" high="27" shr="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x88df" name="RB_BLIT_CLEAR_COLOR_DW0" usage="rp_blit"/>
+	<reg32 offset="0x88e0" name="RB_BLIT_CLEAR_COLOR_DW1" usage="rp_blit"/>
+	<reg32 offset="0x88e1" name="RB_BLIT_CLEAR_COLOR_DW2" usage="rp_blit"/>
+	<reg32 offset="0x88e2" name="RB_BLIT_CLEAR_COLOR_DW3" usage="rp_blit"/>
+
+	<!-- seems somewhat similar to what we called RB_CLEAR_CNTL on a5xx: -->
+	<reg32 offset="0x88e3" name="RB_BLIT_INFO" usage="rp_blit">
+		<bitfield name="UNK0" pos="0" type="boolean"/> <!-- s8 stencil restore/clear?  But also color restore? -->
+		<bitfield name="GMEM" pos="1" type="boolean"/> <!-- set for restore and clear to gmem? -->
+		<bitfield name="SAMPLE_0" pos="2" type="boolean"/> <!-- takes sample 0 instead of averaging -->
+		<bitfield name="DEPTH" pos="3" type="boolean"/> <!-- z16/z32/z24s8/x24x8 clear or resolve? -->
+		<doc>
+			For clearing depth/stencil
+				1 - depth
+				2 - stencil
+				3 - depth+stencil
+			For clearing color buffer:
+				then probably a component mask, I always see 0xf
+		</doc>
+		<bitfield name="CLEAR_MASK" low="4" high="7"/>
+		<!-- set when this is the last resolve on a650+ -->
+		<bitfield name="LAST" low="8" high="9"/>
+		<!--
+			a618 GLES: color render target number being resolved for RM6_RESOLVE, 0x8 for depth, 0x9 for separate stencil.
+			a618 VK: 0x8 for depth RM6_RESOLVE, 0x9 for separate stencil, 0 otherwise.
+
+			We believe this is related to concurrent resolves
+		 -->
+		<bitfield name="BUFFER_ID" low="12" high="15"/>
+	</reg32>
+	<reg32 offset="0x88e4" name="RB_UNKNOWN_88E4" variants="A7XX-" usage="rp_blit">
+		<!-- Value conditioned based on predicate, changed before blits -->
+		<bitfield name="UNK0" pos="0" type="boolean"/>
+	</reg32>
+
+	<enum name="a6xx_ccu_cache_size">
+		<value value="0x0" name="CCU_CACHE_SIZE_FULL"/>
+		<value value="0x1" name="CCU_CACHE_SIZE_HALF"/>
+		<value value="0x2" name="CCU_CACHE_SIZE_QUARTER"/>
+		<value value="0x3" name="CCU_CACHE_SIZE_EIGHTH"/>
+	</enum>
+	<reg32 offset="0x88e5" name="RB_CCU_CNTL2" variants="A7XX-" usage="cmd">
+		<bitfield name="DEPTH_OFFSET_HI" pos="0" type="hex"/>
+		<bitfield name="COLOR_OFFSET_HI" pos="2" type="hex"/>
+		<bitfield name="DEPTH_CACHE_SIZE" low="10" high="11" type="a6xx_ccu_cache_size"/>
+		<!-- GMEM offset of CCU depth cache -->
+		<bitfield name="DEPTH_OFFSET" low="12" high="20" shr="12" type="hex"/>
+		<bitfield name="COLOR_CACHE_SIZE" low="21" high="22" type="a6xx_ccu_cache_size"/>
+		<!-- GMEM offset of CCU color cache
+			for GMEM rendering, we set it to GMEM size minus the minimum
+			CCU color cache size. CCU color cache will be needed in some
+			resolve cases, and in those cases we need to reserve the end
+			of GMEM for color cache.
+		-->
+		<bitfield name="COLOR_OFFSET" low="23" high="31" shr="12" type="hex"/>
+	</reg32>
+	<!-- 0x88e6-0x88ef invalid -->
+	<!-- always 0x0 ? -->
+	<reg32 offset="0x88f0" name="RB_UNKNOWN_88F0" low="0" high="11" usage="cmd"/>
+	<!-- could be for separate stencil? (or may not be a flag buffer at all) -->
+	<reg64 offset="0x88f1" name="RB_UNK_FLAG_BUFFER_BASE" type="waddress" align="64"/>
+	<reg32 offset="0x88f3" name="RB_UNK_FLAG_BUFFER_PITCH">
+		<bitfield name="PITCH" low="0" high="10" shr="6" type="uint"/>
+		<bitfield name="ARRAY_PITCH" low="11" high="23" shr="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x88f4" name="RB_UNKNOWN_88F4" low="0" high="2"/>
+	<!-- Connected to VK_EXT_fragment_density_map? -->
+	<reg32 offset="0x88f5" name="RB_UNKNOWN_88F5" variants="A7XX-"/>
+	<!-- 0x88f6-0x88ff invalid -->
+	<reg64 offset="0x8900" name="RB_DEPTH_FLAG_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8902" name="RB_DEPTH_FLAG_BUFFER_PITCH" usage="rp_blit">
+		<bitfield name="PITCH" low="0" high="6" shr="6" type="uint"/>
+		<!-- TODO: actually part of array pitch -->
+		<bitfield name="UNK8" low="8" high="10"/>
+		<bitfield name="ARRAY_PITCH" low="11" high="27" shr="7" type="uint"/>
+	</reg32>
+	<array offset="0x8903" name="RB_MRT_FLAG_BUFFER" stride="3" length="8" usage="rp_blit">
+		<reg64 offset="0" name="ADDR" type="waddress" align="64"/>
+		<reg32 offset="2" name="PITCH">
+			<bitfield name="PITCH" low="0" high="10" shr="6" type="uint"/>
+			<bitfield name="ARRAY_PITCH" low="11" high="28" shr="7" type="uint"/>
+		</reg32>
+	</array>
+	<!-- 0x891b-0x8926 invalid -->
+	<doc>
+		RB_SAMPLE_COUNT_ADDR register is used up to (and including) a730. After that
+		the address is specified through CP_EVENT_WRITE7::WRITE_SAMPLE_COUNT.
+	</doc>
+	<reg64 offset="0x8927" name="RB_SAMPLE_COUNT_ADDR" type="waddress" align="16" usage="cmd"/>
+	<!-- 0x8929-0x89ff invalid -->
+
+	<!-- TODO: there are some registers in the 0x8a00-0x8bff range -->
+
+	<!--
+		These show up in a6xx gen3+ but so far haven't found an example of
+		blob writing non-zero:
+	 -->
+	<reg32 offset="0x8a00" name="RB_UNKNOWN_8A00" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0x8a10" name="RB_UNKNOWN_8A10" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0x8a20" name="RB_UNKNOWN_8A20" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0x8a30" name="RB_UNKNOWN_8A30" variants="A6XX" usage="rp_blit"/>
+
+	<reg32 offset="0x8c00" name="RB_2D_BLIT_CNTL" type="a6xx_2d_blit_cntl" usage="rp_blit"/>
+	<reg32 offset="0x8c01" name="RB_2D_UNKNOWN_8C01" low="0" high="31" usage="rp_blit"/>
+
+	<bitset name="a6xx_2d_src_surf_info" inline="yes">
+		<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+		<bitfield name="TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+		<bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+		<bitfield name="FLAGS" pos="12" type="boolean"/>
+		<bitfield name="SRGB" pos="13" type="boolean"/>
+		<bitfield name="SAMPLES" low="14" high="15" type="a3xx_msaa_samples"/>
+		<bitfield name="FILTER" pos="16" type="boolean"/>
+		<bitfield name="UNK17" pos="17" type="boolean"/>
+		<bitfield name="SAMPLES_AVERAGE" pos="18" type="boolean"/>
+		<bitfield name="UNK19" pos="19" type="boolean"/>
+		<bitfield name="UNK20" pos="20" type="boolean"/>
+		<bitfield name="UNK21" pos="21" type="boolean"/>
+		<bitfield name="UNK22" pos="22" type="boolean"/>
+		<bitfield name="UNK23" low="23" high="26"/>
+		<bitfield name="UNK28" pos="28" type="boolean"/>
+		<bitfield name="MUTABLEEN" pos="29" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<bitset name="a6xx_2d_dst_surf_info" inline="yes">
+		<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+		<bitfield name="TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+		<bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+		<bitfield name="FLAGS" pos="12" type="boolean"/>
+		<bitfield name="SRGB" pos="13" type="boolean"/>
+		<bitfield name="SAMPLES" low="14" high="15" type="a3xx_msaa_samples"/>
+		<bitfield name="MUTABLEEN" pos="17" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<!-- 0x8c02-0x8c16 invalid -->
+	<reg32 offset="0x8c17" name="RB_2D_DST_INFO" type="a6xx_2d_dst_surf_info" usage="rp_blit"/>
+	<reg64 offset="0x8c18" name="RB_2D_DST" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8c1a" name="RB_2D_DST_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
+	<!-- this is a guess but seems likely (for NV12/IYUV): -->
+	<reg64 offset="0x8c1b" name="RB_2D_DST_PLANE1" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8c1d" name="RB_2D_DST_PLANE_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
+	<reg64 offset="0x8c1e" name="RB_2D_DST_PLANE2" type="waddress" align="64" usage="rp_blit"/>
+
+	<reg64 offset="0x8c20" name="RB_2D_DST_FLAGS" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8c22" name="RB_2D_DST_FLAGS_PITCH" low="0" high="7" shr="6" type="uint" usage="rp_blit"/>
+	<!-- this is a guess but seems likely (for NV12 with UBWC): -->
+	<reg64 offset="0x8c23" name="RB_2D_DST_FLAGS_PLANE" type="waddress" align="64" usage="rp_blit"/>
+	<reg32 offset="0x8c25" name="RB_2D_DST_FLAGS_PLANE_PITCH" low="0" high="7" shr="6" type="uint" usage="rp_blit"/>
+
+	<!-- TODO: 0x8c26-0x8c33 are all full 32-bit registers -->
+	<!-- unlike a5xx, these are per channel values rather than packed -->
+	<reg32 offset="0x8c2c" name="RB_2D_SRC_SOLID_C0" usage="rp_blit"/>
+	<reg32 offset="0x8c2d" name="RB_2D_SRC_SOLID_C1" usage="rp_blit"/>
+	<reg32 offset="0x8c2e" name="RB_2D_SRC_SOLID_C2" usage="rp_blit"/>
+	<reg32 offset="0x8c2f" name="RB_2D_SRC_SOLID_C3" usage="rp_blit"/>
+
+	<reg32 offset="0x8c34" name="RB_UNKNOWN_8C34" variants="A7XX-" usage="cmd"/>
+
+	<!-- 0x8c35-0x8dff invalid -->
+
+	<!-- always 0x1 ? either doesn't exist for a650 or write-only: -->
+	<reg32 offset="0x8e01" name="RB_UNKNOWN_8E01" usage="cmd"/>
+	<!-- 0x8e00-0x8e03 invalid -->
+	<reg32 offset="0x8e04" name="RB_DBG_ECO_CNTL" usage="cmd"/> <!-- TODO: valid mask 0xfffffeff -->
+	<reg32 offset="0x8e05" name="RB_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode"/>
+	<!-- 0x02080000 in GMEM, zero otherwise?  -->
+	<reg32 offset="0x8e06" name="RB_UNKNOWN_8E06" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0x8e07" name="RB_CCU_CNTL" usage="cmd" variants="A6XX">
+		<bitfield name="GMEM_FAST_CLEAR_DISABLE" pos="0" type="boolean"/>
+		<!-- concurrent resolves are apparently a 2-bit enum on a650+ -->
+		<bitfield name="CONCURRENT_RESOLVE" pos="2" type="boolean"/>
+		<bitfield name="DEPTH_OFFSET_HI" pos="7" type="hex"/>
+		<bitfield name="COLOR_OFFSET_HI" pos="9" type="hex"/>
+		<bitfield name="DEPTH_CACHE_SIZE" low="10" high="11" type="a6xx_ccu_cache_size"/>
+		<!-- GMEM offset of CCU depth cache -->
+		<bitfield name="DEPTH_OFFSET" low="12" high="20" shr="12" type="hex"/>
+		<bitfield name="COLOR_CACHE_SIZE" low="21" high="22" type="a6xx_ccu_cache_size"/>
+		<!-- GMEM offset of CCU color cache
+			for GMEM rendering, we set it to GMEM size minus the minimum
+			CCU color cache size. CCU color cache will be needed in some
+			resolve cases, and in those cases we need to reserve the end
+			of GMEM for color cache.
+		-->
+		<bitfield name="COLOR_OFFSET" low="23" high="31" shr="12" type="hex"/>
+		<!--TODO: valid mask 0xfffffc1f -->
+	</reg32>
+	<reg32 offset="0x8e07" name="RB_CCU_CNTL" usage="cmd" variants="A7XX-">
+		<bitfield name="GMEM_FAST_CLEAR_DISABLE" pos="0" type="boolean"/>
+		<bitfield name="CONCURRENT_RESOLVE" pos="2" type="boolean"/>
+		<!-- rest of the bits were moved to RB_CCU_CNTL2 -->
+	</reg32>
+	<reg32 offset="0x8e08" name="RB_NC_MODE_CNTL">
+		<bitfield name="MODE" pos="0" type="boolean"/>
+		<bitfield name="LOWER_BIT" low="1" high="2" type="uint"/>
+		<bitfield name="MIN_ACCESS_LENGTH" pos="3" type="boolean"/> <!-- true=64b false=32b -->
+		<bitfield name="AMSBC" pos="4" type="boolean"/>
+		<bitfield name="UPPER_BIT" pos="10" type="uint"/>
+		<bitfield name="RGB565_PREDICATOR" pos="11" type="boolean"/>
+		<bitfield name="UNK12" low="12" high="13"/>
+	</reg32>
+	<reg32 offset="0x8e09" name="RB_UNKNOWN_8E09" variants="A7XX-" usage="cmd"/>
+	<!-- 0x8e09-0x8e0f invalid -->
+	<array offset="0x8e10" name="RB_PERFCTR_RB_SEL" stride="1" length="8"/>
+	<array offset="0x8e18" name="RB_PERFCTR_CCU_SEL" stride="1" length="5"/>
+	<!-- 0x8e1d-0x8e1f invalid -->
+	<!-- 0x8e20-0x8e25 more perfcntr sel? -->
+	<!-- 0x8e26-0x8e27 invalid -->
+	<reg32 offset="0x8e28" name="RB_CMP_DBG_ECO_CNTL"/>
+	<!-- 0x8e29-0x8e2b invalid -->
+	<array offset="0x8e2c" name="RB_PERFCTR_CMP_SEL" stride="1" length="4"/>
+	<array offset="0x8e30" name="RB_PERFCTR_UFC_SEL" stride="1" length="6" variants="A7XX-"/>
+	<reg32 offset="0x8e3b" name="RB_RB_SUB_BLOCK_SEL_CNTL_HOST"/>
+	<reg32 offset="0x8e3d" name="RB_RB_SUB_BLOCK_SEL_CNTL_CD"/>
+	<!-- 0x8e3e-0x8e4f invalid -->
+	<!-- GMEM save/restore for preemption: -->
+	<reg32 offset="0x8e50" name="RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE" pos="0" type="boolean"/>
+	<!-- address for GMEM save/restore? -->
+	<reg32 offset="0x8e51" name="RB_UNKNOWN_8E51" type="waddress" align="1"/>
+	<!-- 0x8e53-0x8e7f invalid -->
+	<reg32 offset="0x8e79" name="RB_UNKNOWN_8E79" variants="A7XX-" usage="cmd"/>
+	<!-- 0x8e80-0x8e83 are valid -->
+	<!-- 0x8e84-0x90ff invalid -->
+
+	<!-- 0x9000-0x90ff invalid -->
+
+	<reg32 offset="0x9100" name="VPC_GS_PARAM" variants="A6XX" usage="rp_blit">
+		<bitfield name="LINELENGTHLOC" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<bitset name="a6xx_vpc_xs_clip_cntl" inline="yes">
+		<bitfield name="CLIP_MASK" low="0" high="7" type="uint"/>
+		<!-- there can be up to 8 total clip/cull distance outputs,
+		     but apparenly VPC can only deal with vec4, so when there are
+		     more than 4 outputs a second location needs to be programmed
+		-->
+		<bitfield name="CLIP_DIST_03_LOC" low="8" high="15" type="uint"/>
+		<bitfield name="CLIP_DIST_47_LOC" low="16" high="23" type="uint"/>
+	</bitset>
+	<reg32 offset="0x9101" name="VPC_VS_CLIP_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9102" name="VPC_GS_CLIP_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9103" name="VPC_DS_CLIP_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+
+	<reg32 offset="0x9311" name="VPC_VS_CLIP_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9312" name="VPC_GS_CLIP_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9313" name="VPC_DS_CLIP_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+
+	<bitset name="a6xx_vpc_xs_layer_cntl" inline="yes">
+		<bitfield name="LAYERLOC" low="0" high="7" type="uint"/>
+		<bitfield name="VIEWLOC" low="8" high="15" type="uint"/>
+		<bitfield name="SHADINGRATELOC" low="16" high="23" type="uint" variants="A7XX-"/>
+	</bitset>
+
+	<reg32 offset="0x9104" name="VPC_VS_LAYER_CNTL" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9105" name="VPC_GS_LAYER_CNTL" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9106" name="VPC_DS_LAYER_CNTL" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+
+	<reg32 offset="0x9314" name="VPC_VS_LAYER_CNTL_V2" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9315" name="VPC_GS_LAYER_CNTL_V2" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9316" name="VPC_DS_LAYER_CNTL_V2" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+
+	<reg32 offset="0x9107" name="VPC_UNKNOWN_9107" variants="A6XX" usage="rp_blit">
+		<!-- this mirrors PC_RASTER_CNTL::DISCARD, although it seems it's unused -->
+		<bitfield name="RASTER_DISCARD" pos="0" type="boolean"/>
+		<bitfield name="UNK2" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x9108" name="VPC_POLYGON_MODE" usage="rp_blit">
+		<bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+	</reg32>
+
+	<bitset name="a6xx_primitive_cntl_0" inline="yes">
+		<bitfield name="PRIMITIVE_RESTART" pos="0" type="boolean"/>
+		<bitfield name="PROVOKING_VTX_LAST" pos="1" type="boolean"/>
+		<bitfield name="D3D_VERTEX_ORDERING" pos="2" type="boolean">
+			<doc>
+				Swaps TESS_CW_TRIS/TESS_CCW_TRIS, and also makes
+				triangle fans and triangle strips use the D3D
+				order instead of the OpenGL order.
+			</doc>
+		</bitfield>
+		<bitfield name="UNK3" pos="3" type="boolean"/>
+	</bitset>
+
+	<bitset name="a6xx_primitive_cntl_5" inline="yes">
+		<doc>
+		  geometry shader
+		</doc>
+		<!-- TODO: first 16 bits are valid so something is wrong or missing here -->
+		<bitfield name="GS_VERTICES_OUT" low="0" high="7" type="uint"/>
+		<bitfield name="GS_INVOCATIONS" low="10" high="14" type="uint"/>
+		<bitfield name="LINELENGTHEN" pos="15" type="boolean"/>
+		<bitfield name="GS_OUTPUT" low="16" high="17" type="a6xx_tess_output"/>
+		<bitfield name="UNK18" pos="18"/>
+	</bitset>
+
+	<bitset name="a6xx_multiview_cntl" inline="yes">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="DISABLEMULTIPOS" pos="1" type="boolean">
+			<doc>
+				Multi-position output lets the last geometry
+				stage shader write multiple copies of
+				gl_Position. If disabled then the VS is run once
+				for each view, and ViewID is passed as a
+				register to the VS.
+			</doc>
+		</bitfield>
+		<bitfield name="VIEWS" low="2" high="6" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x9109" name="VPC_PRIMITIVE_CNTL_0" type="a6xx_primitive_cntl_0" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0x910a" name="VPC_PRIMITIVE_CNTL_5" type="a6xx_primitive_cntl_5" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0x910b" name="VPC_MULTIVIEW_MASK" type="hex" low="0" high="15" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0x910c" name="VPC_MULTIVIEW_CNTL" type="a6xx_multiview_cntl" variants="A7XX-" usage="rp_blit"/>
+
+	<enum name="a6xx_varying_interp_mode">
+		<value value="0" name="INTERP_SMOOTH"/>
+		<value value="1" name="INTERP_FLAT"/>
+		<value value="2" name="INTERP_ZERO"/>
+		<value value="3" name="INTERP_ONE"/>
+	</enum>
+
+	<enum name="a6xx_varying_ps_repl_mode">
+		<value value="0" name="PS_REPL_NONE"/>
+		<value value="1" name="PS_REPL_S"/>
+		<value value="2" name="PS_REPL_T"/>
+		<value value="3" name="PS_REPL_ONE_MINUS_T"/>
+	</enum>
+
+	<!-- 0x9109-0x91ff invalid -->
+	<array offset="0x9200" name="VPC_VARYING_INTERP" stride="1" length="8" usage="rp_blit">
+		<doc>Packed array of a6xx_varying_interp_mode</doc>
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+	<array offset="0x9208" name="VPC_VARYING_PS_REPL" stride="1" length="8" usage="rp_blit">
+		<doc>Packed array of a6xx_varying_ps_repl_mode</doc>
+		<reg32 offset="0x0" name="MODE"/>
+	</array>
+
+	<!-- always 0x0 -->
+	<reg32 offset="0x9210" name="VPC_UNKNOWN_9210" low="0" high="31" variants="A6XX" usage="cmd"/>
+	<reg32 offset="0x9211" name="VPC_UNKNOWN_9211" low="0" high="31" variants="A6XX" usage="cmd"/>
+
+	<array offset="0x9212" name="VPC_VAR" stride="1" length="4" usage="rp_blit">
+		<!-- one bit per varying component: -->
+		<reg32 offset="0" name="DISABLE"/>
+	</array>
+
+	<reg32 offset="0x9216" name="VPC_SO_CNTL" usage="rp_blit">
+		<!--
+			Choose which DWORD to write to. There is an array of
+			(4 * 64) DWORD's, dumped in the devcoredump at
+			HLSQ_INST_RAM dword 0x400. Each DWORD corresponds to a
+			(VPC location, stream) pair like so:
+
+			location 0, stream 0
+			location 2, stream 0
+			...
+			location 126, stream 0
+			location 0, stream 1
+			location 2, stream 1
+			...
+			location 126, stream 1
+			location 0, stream 2
+			...
+
+			When EmitStreamVertex(N) happens, the HW goes to DWORD
+			64 * N and then "executes" the next 64 DWORD's.
+
+			This field is auto-incremented when VPC_SO_PROG is
+			written to.
+		-->
+		<bitfield name="ADDR" low="0" high="7" type="hex"/>
+		<!-- clear all A_EN and B_EN bits for all DWORD's -->
+		<bitfield name="RESET" pos="16" type="boolean"/>
+	</reg32>
+	<!-- special register, write multiple times to load SO program (not readable) -->
+	<reg32 offset="0x9217" name="VPC_SO_PROG" usage="rp_blit">
+		<bitfield name="A_BUF" low="0" high="1" type="uint"/>
+		<bitfield name="A_OFF" low="2" high="10" shr="2" type="uint"/>
+		<bitfield name="A_EN" pos="11" type="boolean"/>
+		<bitfield name="B_BUF" low="12" high="13" type="uint"/>
+		<bitfield name="B_OFF" low="14" high="22" shr="2" type="uint"/>
+		<bitfield name="B_EN" pos="23" type="boolean"/>
+	</reg32>
+
+	<reg64 offset="0x9218" name="VPC_SO_STREAM_COUNTS" type="waddress" align="32" usage="cmd"/>
+
+	<array offset="0x921a" name="VPC_SO" stride="7" length="4" usage="cmd">
+		<reg64 offset="0" name="BUFFER_BASE" type="waddress" align="32"/>
+		<reg32 offset="2" name="BUFFER_SIZE" low="2" high="31" shr="2"/>
+		<reg32 offset="3" name="BUFFER_STRIDE" low="0" high="9" shr="2"/>
+		<reg32 offset="4" name="BUFFER_OFFSET" low="2" high="31" shr="2"/>
+		<reg64 offset="5" name="FLUSH_BASE" type="waddress" align="32"/>
+	</array>
+
+	<reg32 offset="0x9236" name="VPC_POINT_COORD_INVERT" usage="cmd">
+		<bitfield name="INVERT" pos="0" type="boolean"/>
+	</reg32>
+	<!-- 0x9237-0x92ff invalid -->
+	<!-- always 0x0 ? -->
+	<reg32 offset="0x9300" name="VPC_UNKNOWN_9300" low="0" high="2" usage="cmd"/>
+
+	<bitset name="a6xx_vpc_xs_pack" inline="yes">
+		<doc>
+			num of varyings plus four for gl_Position (plus one if gl_PointSize)
+			plus # of transform-feedback (streamout) varyings if using the
+			hw streamout (rather than stg instructions in shader)
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="7" type="uint"/>
+		<bitfield name="POSITIONLOC" low="8" high="15" type="uint"/>
+		<bitfield name="PSIZELOC" low="16" high="23" type="uint"/>
+		<bitfield name="EXTRAPOS" low="24" high="27" type="uint">
+			<doc>
+				The number of extra copies of POSITION, i.e.
+				number of views minus one when multi-position
+				output is enabled, otherwise 0.
+			</doc>
+		</bitfield>
+	</bitset>
+	<reg32 offset="0x9301" name="VPC_VS_PACK" type="a6xx_vpc_xs_pack" usage="rp_blit"/>
+	<reg32 offset="0x9302" name="VPC_GS_PACK" type="a6xx_vpc_xs_pack" usage="rp_blit"/>
+	<reg32 offset="0x9303" name="VPC_DS_PACK" type="a6xx_vpc_xs_pack" usage="rp_blit"/>
+
+	<reg32 offset="0x9304" name="VPC_CNTL_0" usage="rp_blit">
+		<bitfield name="NUMNONPOSVAR" low="0" high="7" type="uint"/>
+		<!-- for fixed-function (i.e. no GS) gl_PrimitiveID in FS -->
+		<bitfield name="PRIMIDLOC" low="8" high="15" type="uint"/>
+		<bitfield name="VARYING" pos="16" type="boolean"/>
+		<bitfield name="VIEWIDLOC" low="24" high="31" type="uint">
+			<doc>
+				This VPC location will be overwritten with
+				ViewID when multiview is enabled. It's used when
+				fragment shaders read ViewID. It's only
+				strictly required for multi-position output,
+				where the same VS invocation is used for all the
+				views at once, but it can be used when multi-pos
+				output is disabled too, to avoid having to pass
+				ViewID through the VS.
+			</doc>
+		</bitfield>
+	</reg32>
+
+	<reg32 offset="0x9305" name="VPC_SO_STREAM_CNTL" usage="rp_blit">
+		<!--
+		It's offset by 1, and 0 means "disabled"
+		-->
+		<bitfield name="BUF0_STREAM" low="0" high="2" type="uint"/>
+		<bitfield name="BUF1_STREAM" low="3" high="5" type="uint"/>
+		<bitfield name="BUF2_STREAM" low="6" high="8" type="uint"/>
+		<bitfield name="BUF3_STREAM" low="9" high="11" type="uint"/>
+		<bitfield name="STREAM_ENABLE" low="15" high="18" type="hex"/>
+	</reg32>
+	<reg32 offset="0x9306" name="VPC_SO_DISABLE" usage="rp_blit">
+		<bitfield name="DISABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x9307" name="VPC_POLYGON_MODE2" variants="A7XX-" usage="rp_blit">
+		<bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+	</reg32>
+	<reg32 offset="0x9308" name="VPC_ATTR_BUF_SIZE_GMEM" variants="A7XX-" usage="rp_blit">
+		<bitfield name="SIZE_GMEM" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="0x9309" name="VPC_ATTR_BUF_BASE_GMEM" variants="A7XX-" usage="rp_blit">
+		<bitfield name="BASE_GMEM" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="0x9b09" name="PC_ATTR_BUF_SIZE_GMEM" variants="A7XX-" usage="rp_blit">
+		<bitfield name="SIZE_GMEM" low="0" high="31"/>
+	</reg32>
+
+	<!-- 0x9307-0x95ff invalid -->
+
+	<!-- TODO: 0x9600-0x97ff range -->
+	<reg32 offset="0x9600" name="VPC_DBG_ECO_CNTL" usage="cmd"/> <!-- always 0x0 ? TODO: 0x1fbf37ff valid mask -->
+	<reg32 offset="0x9601" name="VPC_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode" usage="cmd"/>
+	<reg32 offset="0x9602" name="VPC_UNKNOWN_9602" pos="0" usage="cmd"/> <!-- always 0x0 ? -->
+	<reg32 offset="0x9603" name="VPC_UNKNOWN_9603" low="0" high="26"/>
+	<array offset="0x9604" name="VPC_PERFCTR_VPC_SEL" stride="1" length="6" variants="A6XX"/>
+	<array offset="0x960b" name="VPC_PERFCTR_VPC_SEL" stride="1" length="12" variants="A7XX-"/>
+	<!-- 0x960a-0x9623 invalid -->
+	<!-- TODO: regs from 0x9624-0x963a -->
+	<!-- 0x963b-0x97ff invalid -->
+
+	<reg32 offset="0x9800" name="PC_TESS_NUM_VERTEX" low="0" high="5" type="uint" usage="rp_blit"/>
+
+	<!-- always 0x0 ? -->
+	<reg32 offset="0x9801" name="PC_HS_INPUT_SIZE" usage="rp_blit">
+		<bitfield name="SIZE" low="0" high="10" type="uint"/>
+		<bitfield name="UNK13" pos="13"/>
+	</reg32>
+
+	<reg32 offset="0x9802" name="PC_TESS_CNTL" usage="rp_blit">
+		<bitfield name="SPACING" low="0" high="1" type="a6xx_tess_spacing"/>
+		<bitfield name="OUTPUT" low="2" high="3" type="a6xx_tess_output"/>
+	</reg32>
+
+	<reg32 offset="0x9803" name="PC_RESTART_INDEX" low="0" high="31" type="uint" usage="rp_blit"/>
+	<reg32 offset="0x9804" name="PC_MODE_CNTL" low="0" high="7" usage="rp_blit"/>
+
+	<reg32 offset="0x9805" name="PC_POWER_CNTL" low="0" high="2" usage="rp_blit"/>
+
+	<reg32 offset="0x9806" name="PC_PS_CNTL" usage="rp_blit">
+		<bitfield name="PRIMITIVEIDEN" pos="0" type="boolean"/>
+	</reg32>
+
+	<!-- New in a6xx gen3+ -->
+	<reg32 offset="0x9808" name="PC_SO_STREAM_CNTL" usage="rp_blit">
+		<bitfield name="STREAM_ENABLE" low="15" high="18" type="hex"/>
+	</reg32>
+
+	<reg32 offset="0x980a" name="PC_DGEN_SU_CONSERVATIVE_RAS_CNTL">
+		<bitfield name="CONSERVATIVERASEN" pos="0" type="boolean"/>
+	</reg32>
+	<!-- 0x980b-0x983f invalid -->
+
+	<!-- 0x9840 - 0x9842 are not readable -->
+	<reg32 offset="0x9840" name="PC_DRAW_CMD">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0x9841" name="PC_DISPATCH_CMD">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0x9842" name="PC_EVENT_CMD">
+		<!-- I think only the low bit is actually used? -->
+		<bitfield name="STATE_ID" low="16" high="23"/>
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+	</reg32>
+
+	<!--
+		0x9880 written in a lot of places by SQE, same value gets written
+		to control reg 0x12a.  Set by CP_SET_MARKER, so lets name it after
+		that
+	 -->
+	<reg32 offset="0x9880" name="PC_MARKER"/>
+
+	<!-- 0x9843-0x997f invalid -->
+
+	<reg32 offset="0x9981" name="PC_POLYGON_MODE" variants="A6XX" usage="rp_blit">
+		<bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+	</reg32>
+	<reg32 offset="0x9809" name="PC_POLYGON_MODE" variants="A7XX-" usage="rp_blit">
+		<bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+	</reg32>
+
+	<reg32 offset="0x9980" name="PC_RASTER_CNTL" variants="A6XX" usage="rp_blit">
+		<!-- which stream to send to GRAS -->
+		<bitfield name="STREAM" low="0" high="1" type="uint"/>
+		<!-- discard primitives before rasterization -->
+		<bitfield name="DISCARD" pos="2" type="boolean"/>
+	</reg32>
+	<!-- VPC_RASTER_CNTL -->
+	<reg32 offset="0x9107" name="PC_RASTER_CNTL" variants="A7XX-" usage="rp_blit">
+		<!-- which stream to send to GRAS -->
+		<bitfield name="STREAM" low="0" high="1" type="uint"/>
+		<!-- discard primitives before rasterization -->
+		<bitfield name="DISCARD" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x9317" name="PC_RASTER_CNTL_V2" variants="A7XX-" usage="rp_blit">
+		<!-- which stream to send to GRAS -->
+		<bitfield name="STREAM" low="0" high="1" type="uint"/>
+		<!-- discard primitives before rasterization -->
+		<bitfield name="DISCARD" pos="2" type="boolean"/>
+	</reg32>
+
+	<!-- Both are a750+.
+	     Probably needed to correctly overlap execution of several draws.
+	-->
+	<reg32 offset="0x9885" name="PC_TESS_PARAM_SIZE" variants="A7XX-" usage="cmd"/>
+	<!-- Blob adds a bit more space {0x10, 0x20, 0x30, 0x40} bytes, but the meaning of
+	     this additional space is not known.
+	-->
+	<reg32 offset="0x9886" name="PC_TESS_FACTOR_SIZE" variants="A7XX-" usage="cmd"/>
+
+	<!-- 0x9982-0x9aff invalid -->
+
+	<reg32 offset="0x9b00" name="PC_PRIMITIVE_CNTL_0" type="a6xx_primitive_cntl_0" usage="rp_blit"/>
+
+	<bitset name="a6xx_xs_out_cntl" inline="yes">
+		<doc>
+			num of varyings plus four for gl_Position (plus one if gl_PointSize)
+			plus # of transform-feedback (streamout) varyings if using the
+			hw streamout (rather than stg instructions in shader)
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="7" type="uint"/>
+		<bitfield name="PSIZE" pos="8" type="boolean"/>
+		<bitfield name="LAYER" pos="9" type="boolean"/>
+		<bitfield name="VIEW" pos="10" type="boolean"/>
+		<!-- note: PC_VS_OUT_CNTL doesn't have the PRIMITIVE_ID bit -->
+		<bitfield name="PRIMITIVE_ID" pos="11" type="boolean"/>
+		<bitfield name="CLIP_MASK" low="16" high="23" type="uint"/>
+		<bitfield name="SHADINGRATE" pos="24" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<reg32 offset="0x9b01" name="PC_VS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9b02" name="PC_GS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+	<!-- since HS can't output anything, only PRIMITIVE_ID is valid -->
+	<reg32 offset="0x9b03" name="PC_HS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+	<reg32 offset="0x9b04" name="PC_DS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+
+	<reg32 offset="0x9b05" name="PC_PRIMITIVE_CNTL_5" type="a6xx_primitive_cntl_5" usage="rp_blit"/>
+
+	<reg32 offset="0x9b06" name="PC_PRIMITIVE_CNTL_6" variants="A6XX" usage="rp_blit">
+		<doc>
+		  size in vec4s of per-primitive storage for gs. TODO: not actually in VPC
+		</doc>
+		<bitfield name="STRIDE_IN_VPC" low="0" high="10" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x9b07" name="PC_MULTIVIEW_CNTL" type="a6xx_multiview_cntl" usage="rp_blit"/>
+	<!-- mask of enabled views, doesn't exist on A630 -->
+	<reg32 offset="0x9b08" name="PC_MULTIVIEW_MASK" type="hex" low="0" high="15" usage="rp_blit"/>
+	<!-- 0x9b09-0x9bff invalid -->
+	<reg32 offset="0x9c00" name="PC_2D_EVENT_CMD">
+		<!-- special register (but note first 8 bits can be written/read) -->
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+		<bitfield name="STATE_ID" low="8" high="15"/>
+	</reg32>
+	<!-- 0x9c01-0x9dff invalid -->
+	<!-- TODO: 0x9e00-0xa000 range incomplete -->
+	<reg32 offset="0x9e00" name="PC_DBG_ECO_CNTL"/>
+	<reg32 offset="0x9e01" name="PC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg64 offset="0x9e04" name="PC_DRAW_INDX_BASE"/>
+	<reg32 offset="0x9e06" name="PC_DRAW_FIRST_INDX" type="uint"/>
+	<reg32 offset="0x9e07" name="PC_DRAW_MAX_INDICES" type="uint"/>
+	<reg64 offset="0x9e08" name="PC_TESSFACTOR_ADDR" variants="A6XX" type="waddress" align="32" usage="cmd"/>
+	<reg64 offset="0x9810" name="PC_TESSFACTOR_ADDR" variants="A7XX-" type="waddress" align="32" usage="cmd"/>
+
+	<reg32 offset="0x9e0b" name="PC_DRAW_INITIATOR" type="vgt_draw_initiator_a4xx">
+		<doc>
+			Possibly not really "initiating" the draw but the layout is similar
+			to VGT_DRAW_INITIATOR on older gens
+		</doc>
+	</reg32>
+	<reg32 offset="0x9e0c" name="PC_DRAW_NUM_INSTANCES" type="uint"/>
+	<reg32 offset="0x9e0d" name="PC_DRAW_NUM_INDICES" type="uint"/>
+
+	<!-- These match the contents of CP_SET_BIN_DATA (not written directly) -->
+	<reg32 offset="0x9e11" name="PC_VSTREAM_CONTROL">
+		<bitfield name="UNK0" low="0" high="15"/>
+		<bitfield name="VSC_SIZE" low="16" high="21" type="uint"/>
+		<bitfield name="VSC_N" low="22" high="26" type="uint"/>
+	</reg32>
+	<reg64 offset="0x9e12" name="PC_BIN_PRIM_STRM" type="waddress" align="32"/>
+	<reg64 offset="0x9e14" name="PC_BIN_DRAW_STRM" type="waddress" align="32"/>
+
+	<reg32 offset="0x9e1c" name="PC_VISIBILITY_OVERRIDE">
+		<doc>Written by CP_SET_VISIBILITY_OVERRIDE handler</doc>
+		<bitfield name="OVERRIDE" pos="0" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x9e24" name="PC_UNKNOWN_9E24" variants="A7XX-" usage="cmd"/>
+
+	<array offset="0x9e34" name="PC_PERFCTR_PC_SEL" stride="1" length="8" variants="A6XX"/>
+	<array offset="0x9e42" name="PC_PERFCTR_PC_SEL" stride="1" length="16" variants="A7XX-"/>
+
+	<!-- always 0x0 -->
+	<reg32 offset="0x9e72" name="PC_UNKNOWN_9E72" usage="cmd"/>
+
+	<reg32 offset="0xa000" name="VFD_CONTROL_0" usage="rp_blit">
+		<bitfield name="FETCH_CNT" low="0" high="5" type="uint"/>
+		<bitfield name="DECODE_CNT" low="8" high="13" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa001" name="VFD_CONTROL_1" usage="rp_blit">
+		<bitfield name="REGID4VTX" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="REGID4INST" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID4PRIMID" low="16" high="23" type="a3xx_regid"/>
+		<!-- only used for VS in non-multi-position-output case -->
+		<bitfield name="REGID4VIEWID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa002" name="VFD_CONTROL_2" usage="rp_blit">
+		<bitfield name="REGID_HSRELPATCHID" low="0" high="7" type="a3xx_regid">
+			<doc>
+				This is the ID of the current patch within the
+				subdraw, used to calculate the offset of the
+				patch within the HS->DS buffers. When a draw is
+				split into multiple subdraws then this differs
+				from gl_PrimitiveID on the second, third, etc.
+				subdraws.
+			</doc>
+		</bitfield>
+		<bitfield name="REGID_INVOCATIONID" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa003" name="VFD_CONTROL_3" usage="rp_blit">
+		<bitfield name="REGID_DSPRIMID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="REGID_DSRELPATCHID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSX" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="REGID_TESSY" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa004" name="VFD_CONTROL_4" usage="rp_blit">
+		<bitfield name="UNK0" low="0" high="7" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa005" name="VFD_CONTROL_5" usage="rp_blit">
+		<bitfield name="REGID_GSHEADER" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="UNK8" low="8" high="15" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa006" name="VFD_CONTROL_6" usage="rp_blit">
+		<!--
+			True if gl_PrimitiveID is read via the FS
+		-->
+		<bitfield name="PRIMID4PSEN" pos="0" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xa007" name="VFD_MODE_CNTL" usage="cmd">
+		<bitfield name="RENDER_MODE" low="0" high="2" type="a6xx_render_mode"/>
+	</reg32>
+
+	<reg32 offset="0xa008" name="VFD_MULTIVIEW_CNTL" type="a6xx_multiview_cntl" usage="rp_blit"/>
+	<reg32 offset="0xa009" name="VFD_ADD_OFFSET" usage="cmd">
+		<!-- add VFD_INDEX_OFFSET to REGID4VTX -->
+		<bitfield name="VERTEX" pos="0" type="boolean"/>
+		<!-- add VFD_INSTANCE_START_OFFSET to REGID4INST -->
+		<bitfield name="INSTANCE" pos="1" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xa00e" name="VFD_INDEX_OFFSET" usage="rp_blit"/>
+	<reg32 offset="0xa00f" name="VFD_INSTANCE_START_OFFSET" usage="rp_blit"/>
+	<array offset="0xa010" name="VFD_FETCH" stride="4" length="32" usage="rp_blit">
+		<reg64 offset="0x0" name="BASE" type="address" align="1"/>
+		<reg32 offset="0x2" name="SIZE" type="uint"/>
+		<reg32 offset="0x3" name="STRIDE" low="0" high="11" type="uint"/>
+	</array>
+	<array offset="0xa090" name="VFD_DECODE" stride="2" length="32" usage="rp_blit">
+		<reg32 offset="0x0" name="INSTR">
+			<!-- IDX and byte OFFSET into VFD_FETCH -->
+			<bitfield name="IDX" low="0" high="4" type="uint"/>
+			<bitfield name="OFFSET" low="5" high="16"/>
+			<bitfield name="INSTANCED" pos="17" type="boolean"/>
+			<bitfield name="FORMAT" low="20" high="27" type="a6xx_format"/>
+			<bitfield name="SWAP" low="28" high="29" type="a3xx_color_swap"/>
+			<bitfield name="UNK30" pos="30" type="boolean"/>
+			<bitfield name="FLOAT" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x1" name="STEP_RATE" type="uint"/>
+	</array>
+	<array offset="0xa0d0" name="VFD_DEST_CNTL" stride="1" length="32" usage="rp_blit">
+		<reg32 offset="0x0" name="INSTR">
+			<bitfield name="WRITEMASK" low="0" high="3" type="hex"/>
+			<bitfield name="REGID" low="4" high="11" type="a3xx_regid"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0xa0f8" name="VFD_POWER_CNTL" low="0" high="2" usage="rp_blit"/>
+
+	<reg32 offset="0xa600" name="VFD_UNKNOWN_A600" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa601" name="VFD_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<array offset="0xa610" name="VFD_PERFCTR_VFD_SEL" stride="1" length="8" variants="A6XX"/>
+	<array offset="0xa610" name="VFD_PERFCTR_VFD_SEL" stride="1" length="16" variants="A7XX-"/>
+
+	<!--
+	Note: this seems to always be paired with another bit in another
+	block.
+	-->
+	<enum name="a6xx_threadsize">
+		<value value="0" name="THREAD64"/>
+		<value value="1" name="THREAD128"/>
+	</enum>
+
+	<bitset name="a6xx_sp_xs_ctrl_reg0" inline="yes">
+		<!-- if set to SINGLE, only use 1 concurrent wave on each SP -->
+		<bitfield name="THREADMODE" pos="0" type="a3xx_threadmode"/>
+		<!--
+		When b31 set we just see FULLREGFOOTPRINT set.  The pattern of
+		used registers is a bit odd too:
+			- used (half): 0-15 68-179 (cnt=128, max=179)
+			- used (full): 0-33 50-69 71 73 75 77 79 81 83 85 87 89-105 107 109 111 113 115 117 119 121 123 125 127>
+		whereas we usually see a (mostly) contiguous range of regs used.  But if
+		I merge the full and half ranges (ie. rN counts as hr(N*2) and hr(N*2+1)),
+		then:
+			- used (merged): 0-191 (cnt=192, max=191)
+		So I think if b31 is set, then the half precision registers overlap
+		the full precision registers.  (Which seems like a pretty sensible
+		feature, actually I'm not sure when you *wouldn't* want to use that,
+		since it gives register allocation more flexibility)
+		 -->
+		<bitfield name="HALFREGFOOTPRINT" low="1" high="6" type="uint"/>
+		<bitfield name="FULLREGFOOTPRINT" low="7" high="12" type="uint"/>
+		<!-- could it be a low bit of branchstack? -->
+		<bitfield name="UNK13" pos="13" type="boolean"/>
+		<!-- seems to be nesting level for flow control:.. -->
+		<bitfield name="BRANCHSTACK" low="14" high="19" type="uint"/>
+	</bitset>
+
+	<bitset name="a6xx_sp_xs_config" inline="yes">
+		<!--
+		Each of these are set if the given resource type is used
+		with the Vulkan/bindless binding model.
+		-->
+		<bitfield name="BINDLESS_TEX" pos="0" type="boolean"/>
+		<bitfield name="BINDLESS_SAMP" pos="1" type="boolean"/>
+		<bitfield name="BINDLESS_IBO" pos="2" type="boolean"/>
+		<bitfield name="BINDLESS_UBO" pos="3" type="boolean"/>
+
+		<bitfield name="ENABLED" pos="8" type="boolean"/>
+		<!--
+		number of textures and samplers.. these might be swapped, with GL I
+		always see the same value for both.
+		 -->
+		<bitfield name="NTEX" low="9" high="16" type="uint"/>
+		<bitfield name="NSAMP" low="17" high="21" type="uint"/>
+		<bitfield name="NIBO" low="22" high="28" type="uint"/>
+	</bitset>
+
+	<bitset name="a6xx_sp_xs_prim_cntl" inline="yes">
+		<!-- # of VS outputs including pos/psize -->
+		<bitfield name="OUT" low="0" high="5" type="uint"/>
+		<!-- FLAGS_REGID only for GS -->
+		<bitfield name="FLAGS_REGID" low="6" high="13" type="a3xx_regid"/>
+	</bitset>
+
+	<reg32 offset="0xa800" name="SP_VS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<!--
+		This field actually controls all geometry stages. TCS, TES, and
+		GS must have the same mergedregs setting as VS.
+		-->
+		<bitfield name="MERGEDREGS" pos="20" type="boolean"/>
+		<!--
+		Creates a separate preamble-only thread?
+
+		Early preamble has the following limitations:
+		- Only shared, a1, and consts regs could be used
+		  (accessing other regs would result in GPU fault);
+		- No cat5/cat6, only stc/ldc variants are working;
+		- Values writen to shared regs are not accessible by the rest
+		  of the shader;
+		- Instructions before shps are also considered to be a part of
+		  early preamble;
+
+		Note, for all shaders from d3d11 games blob produced preambles
+		compatible with early preamble mode.
+		-->
+		<bitfield name="EARLYPREAMBLE" pos="21" type="boolean"/>
+	</reg32>
+	<!-- bitmask of true/false conditions for VS brac.N instructions,
+	     bit N corresponds to brac.N -->
+	<reg32 offset="0xa801" name="SP_VS_BRANCH_COND" type="hex"/>
+	<!-- # of VS outputs including pos/psize -->
+	<reg32 offset="0xa802" name="SP_VS_PRIMITIVE_CNTL" type="a6xx_sp_xs_prim_cntl" usage="rp_blit"/>
+	<array offset="0xa803" name="SP_VS_OUT" stride="1" length="16" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="24" high="27" type="hex"/>
+		</reg32>
+	</array>
+	<!--
+	Starting with a5xx, position/psize outputs from shader end up in the
+	SP_VS_OUT map, with highest OUTLOCn position.  (Generally they are
+	the last entries too, except when gl_PointCoord is used, blob inserts
+	an extra varying after, but with a lower OUTLOC position.  If present,
+	psize is last, preceded by position.
+	 -->
+	<array offset="0xa813" name="SP_VS_VPC_DST" stride="1" length="8" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<bitset name="a6xx_sp_xs_pvt_mem_param" inline="yes">
+		<bitfield name="MEMSIZEPERITEM" low="0" high="7" shr="9">
+			<doc>The size of memory that ldp/stp can address.</doc>
+		</bitfield>
+		<bitfield name="HWSTACKSIZEPERTHREAD" low="24" high="31">
+                        <doc>
+				Seems to be the same as a3xx. The maximum stack
+				size in units of 4 calls, so a call depth of 7
+				would result in a value of 2.
+				TODO: What's the actual size per call, i.e. the
+				size of the PC? a3xx docs say it's 16 bits
+				there, but the length register now takes 28 bits
+				so it's probably been bumped to 32 bits.
+                        </doc>
+		</bitfield>
+	</bitset>
+
+	<bitset name="a6xx_sp_xs_pvt_mem_size" inline="yes">
+		<bitfield name="TOTALPVTMEMSIZE" low="0" high="17" shr="12"/>
+		<bitfield name="PERWAVEMEMLAYOUT" pos="31" type="boolean">
+			<doc>
+				There are four indices used to compute the
+				private memory location for an access:
+
+				- stp/ldp offset
+				- fiber id
+				- wavefront id (a swizzled version of what "getwid" returns)
+				- SP ID (the same as what "getspid" returns)
+
+				The stride for the SP ID is always set by
+				TOTALPVTMEMSIZE. In the per-wave layout, the
+				indices are used in this order:
+
+				- offset % 4 (offset within dword)
+				- fiber id
+				- offset / 4
+				- wavefront id
+				- SP ID
+
+				and the stride for the wavefront ID is
+				MEMSIZEPERITEM, multiplied by 128 (fibers per
+				wavefront). In the per-fiber layout, the indices
+				are used in this order:
+
+				- offset
+				- fiber id % 4
+				- wavefront id
+				- fiber id / 4
+				- SP ID
+
+				and the stride for the fiber id/wavefront id
+				combo is MEMSIZEPERITEM.
+
+				Note: Accesses of more than 1 dword do not work
+				with per-fiber layout. The blob will fall back
+				to per-wave instead.
+			</doc>
+		</bitfield>
+	</bitset>
+
+	<bitset name="a6xx_sp_xs_pvt_mem_hw_stack_offset" inline="yes">
+		<doc>
+			This seems to be be the equivalent of HWSTACKOFFSET in
+			a3xx. The ldp/stp offset formula above isn't affected by
+			HWSTACKSIZEPERTHREAD at all, so the HW return address
+			stack seems to be after all the normal per-SP private
+			memory.
+		</doc>
+		<bitfield name="OFFSET" low="0" high="18" shr="11"/>
+	</bitset>
+
+	<reg32 offset="0xa81b" name="SP_VS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa81c" name="SP_VS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa81e" name="SP_VS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa81f" name="SP_VS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa821" name="SP_VS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+	<reg32 offset="0xa822" name="SP_VS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa823" name="SP_VS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xa824" name="SP_VS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa825" name="SP_VS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+	<reg32 offset="0xa82d" name="SP_VS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa830" name="SP_HS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<!-- There is no mergedregs bit, that comes from the VS. -->
+		<bitfield name="EARLYPREAMBLE" pos="20" type="boolean"/>
+	</reg32>
+	<!--
+	Total size of local storage in dwords divided by the wave size.
+	The maximum value is 64. With the wave size being always 64 for HS,
+	the maximum size of local storage should be:
+	 64 (wavesize) * 64 (SP_HS_WAVE_INPUT_SIZE) * 4 = 16k
+	-->
+	<reg32 offset="0xa831" name="SP_HS_WAVE_INPUT_SIZE" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa832" name="SP_HS_BRANCH_COND" type="hex" usage="rp_blit"/>
+
+	<!-- TODO: exact same layout as 0xa81b-0xa825 -->
+	<reg32 offset="0xa833" name="SP_HS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa834" name="SP_HS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa836" name="SP_HS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa837" name="SP_HS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa839" name="SP_HS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+	<reg32 offset="0xa83a" name="SP_HS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa83b" name="SP_HS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xa83c" name="SP_HS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa83d" name="SP_HS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+	<reg32 offset="0xa82f" name="SP_HS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa840" name="SP_DS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<!-- There is no mergedregs bit, that comes from the VS. -->
+		<bitfield name="EARLYPREAMBLE" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa841" name="SP_DS_BRANCH_COND" type="hex"/>
+
+	<!-- TODO: exact same layout as 0xa802-0xa81a -->
+	<reg32 offset="0xa842" name="SP_DS_PRIMITIVE_CNTL" type="a6xx_sp_xs_prim_cntl" usage="rp_blit"/>
+	<array offset="0xa843" name="SP_DS_OUT" stride="1" length="16" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="24" high="27" type="hex"/>
+		</reg32>
+	</array>
+	<array offset="0xa853" name="SP_DS_VPC_DST" stride="1" length="8" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<!-- TODO: exact same layout as 0xa81b-0xa825 -->
+	<reg32 offset="0xa85b" name="SP_DS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa85c" name="SP_DS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa85e" name="SP_DS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa85f" name="SP_DS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa861" name="SP_DS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+	<reg32 offset="0xa862" name="SP_DS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa863" name="SP_DS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xa864" name="SP_DS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa865" name="SP_DS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+	<reg32 offset="0xa868" name="SP_DS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa870" name="SP_GS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<!-- There is no mergedregs bit, that comes from the VS. -->
+		<bitfield name="EARLYPREAMBLE" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa871" name="SP_GS_PRIM_SIZE" low="0" high="7" type="uint" usage="rp_blit">
+		<doc>
+			Normally the size of the output of the last stage in
+			dwords. It should be programmed as follows:
+
+			size less than 63    - size
+			size of 63 (?) or 64 - 63
+			size greater than 64 - 64
+
+			What to program when the size is 61-63 is a guess, but
+			both the blob and ir3 align the size to 4 dword's so it
+			doesn't matter in practice.
+		</doc>
+	</reg32>
+	<reg32 offset="0xa872" name="SP_GS_BRANCH_COND" type="hex" usage="rp_blit"/>
+
+	<!-- TODO: exact same layout as 0xa802-0xa81a -->
+	<reg32 offset="0xa873" name="SP_GS_PRIMITIVE_CNTL" type="a6xx_sp_xs_prim_cntl" usage="rp_blit"/>
+	<array offset="0xa874" name="SP_GS_OUT" stride="1" length="16" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+			<bitfield name="B_REGID" low="16" high="23" type="a3xx_regid"/>
+			<bitfield name="B_COMPMASK" low="24" high="27" type="hex"/>
+		</reg32>
+	</array>
+
+	<array offset="0xa884" name="SP_GS_VPC_DST" stride="1" length="8" usage="rp_blit">
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+			<bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+			<bitfield name="OUTLOC2" low="16" high="23" type="uint"/>
+			<bitfield name="OUTLOC3" low="24" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<!-- TODO: exact same layout as 0xa81b-0xa825 -->
+	<reg32 offset="0xa88c" name="SP_GS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa88d" name="SP_GS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa88f" name="SP_GS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa890" name="SP_GS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa892" name="SP_GS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+	<reg32 offset="0xa893" name="SP_GS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa894" name="SP_GS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xa895" name="SP_GS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa896" name="SP_GS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+	<reg32 offset="0xa899" name="SP_GS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<reg64 offset="0xa8a0" name="SP_VS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa8a2" name="SP_HS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa8a4" name="SP_DS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa8a6" name="SP_GS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa8a8" name="SP_VS_TEX_CONST" type="address" align="64" usage="cmd"/>
+	<reg64 offset="0xa8aa" name="SP_HS_TEX_CONST" type="address" align="64" usage="cmd"/>
+	<reg64 offset="0xa8ac" name="SP_DS_TEX_CONST" type="address" align="64" usage="cmd"/>
+	<reg64 offset="0xa8ae" name="SP_GS_TEX_CONST" type="address" align="64" usage="cmd"/>
+
+	<!-- TODO: 4 unknown bool registers 0xa8c0-0xa8c3 -->
+
+	<reg32 offset="0xa980" name="SP_FS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
+		<bitfield name="THREADSIZE" pos="20" type="a6xx_threadsize"/>
+		<bitfield name="UNK21" pos="21" type="boolean"/>
+		<bitfield name="VARYING" pos="22" type="boolean"/>
+		<bitfield name="LODPIXMASK" pos="23" type="boolean">
+			<doc>
+				Enable ALL helper invocations in a quad. Necessary for
+				fine derivatives and quad subgroup ops.
+			</doc>
+		</bitfield>
+		<!-- note: vk blob uses bit24 -->
+		<bitfield name="UNK24" pos="24" type="boolean"/>
+		<bitfield name="UNK25" pos="25" type="boolean"/>
+		<bitfield name="PIXLODENABLE" pos="26" type="boolean">
+			<doc>
+				Enable helper invocations. Enables 3 out of 4 fragments,
+				because the coarse derivatives only use half of the quad
+				and so one pixel's value is always unused.
+			</doc>
+		</bitfield>
+		<bitfield name="UNK27" pos="27" type="boolean"/>
+		<bitfield name="EARLYPREAMBLE" pos="28" type="boolean"/>
+		<bitfield name="MERGEDREGS" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa981" name="SP_FS_BRANCH_COND" type="hex"/>
+	<reg32 offset="0xa982" name="SP_FS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+	<reg64 offset="0xa983" name="SP_FS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa985" name="SP_FS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+	<reg64 offset="0xa986" name="SP_FS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+	<reg32 offset="0xa988" name="SP_FS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+
+	<reg32 offset="0xa989" name="SP_BLEND_CNTL" usage="rp_blit">
+		<!-- per-mrt enable bit -->
+		<bitfield name="ENABLE_BLEND" low="0" high="7"/>
+		<bitfield name="UNK8" pos="8" type="boolean"/>
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="9" type="boolean"/>
+		<bitfield name="ALPHA_TO_COVERAGE" pos="10" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa98a" name="SP_SRGB_CNTL" usage="rp_blit">
+		<!-- Same as RB_SRGB_CNTL -->
+		<bitfield name="SRGB_MRT0" pos="0" type="boolean"/>
+		<bitfield name="SRGB_MRT1" pos="1" type="boolean"/>
+		<bitfield name="SRGB_MRT2" pos="2" type="boolean"/>
+		<bitfield name="SRGB_MRT3" pos="3" type="boolean"/>
+		<bitfield name="SRGB_MRT4" pos="4" type="boolean"/>
+		<bitfield name="SRGB_MRT5" pos="5" type="boolean"/>
+		<bitfield name="SRGB_MRT6" pos="6" type="boolean"/>
+		<bitfield name="SRGB_MRT7" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa98b" name="SP_FS_RENDER_COMPONENTS" usage="rp_blit">
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+	<reg32 offset="0xa98c" name="SP_FS_OUTPUT_CNTL0" usage="rp_blit">
+		<bitfield name="DUAL_COLOR_IN_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="DEPTH_REGID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPMASK_REGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="STENCILREF_REGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa98d" name="SP_FS_OUTPUT_CNTL1" usage="rp_blit">
+		<bitfield name="MRT" low="0" high="3" type="uint"/>
+	</reg32>
+
+	<array offset="0xa98e" name="SP_FS_OUTPUT" stride="1" length="8" usage="rp_blit">
+		<doc>per MRT</doc>
+		<reg32 offset="0x0" name="REG">
+			<bitfield name="REGID" low="0" high="7" type="a3xx_regid"/>
+			<bitfield name="HALF_PRECISION" pos="8" type="boolean"/>
+		</reg32>
+	</array>
+
+	<array offset="0xa996" name="SP_FS_MRT" stride="1" length="8" usage="rp_blit">
+		<reg32 offset="0" name="REG">
+			<bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+			<bitfield name="COLOR_SINT" pos="8" type="boolean"/>
+			<bitfield name="COLOR_UINT" pos="9" type="boolean"/>
+			<bitfield name="UNK10" pos="10" type="boolean"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0xa99e" name="SP_FS_PREFETCH_CNTL" usage="rp_blit">
+		<bitfield name="COUNT" low="0" high="2" type="uint"/>
+		<bitfield name="IJ_WRITE_DISABLE" pos="3" type="boolean"/>
+		<doc>
+			Similar to "(eq)" flag but disables helper invocations
+			after the texture prefetch.
+		</doc>
+		<bitfield name="ENDOFQUAD" pos="4" type="boolean" />
+		<doc>
+			Bypass writing to regs and overwrite output with color from
+			CONSTSLOTID const regs.
+		</doc>
+		<bitfield name="WRITE_COLOR_TO_OUTPUT" pos="5" type="boolean"/>
+		<bitfield name="CONSTSLOTID" low="6" high="14" type="uint"/>
+		<!-- Blob never uses it -->
+		<bitfield name="CONSTSLOTID4COORD" low="16" high="24" type="uint" variants="A7XX-"/>
+	</reg32>
+	<array offset="0xa99f" name="SP_FS_PREFETCH" stride="1" length="4" variants="A6XX" usage="rp_blit">
+		<reg32 offset="0" name="CMD" variants="A6XX">
+			<bitfield name="SRC" low="0" high="6" type="uint"/>
+			<bitfield name="SAMP_ID" low="7" high="10" type="uint"/>
+			<bitfield name="TEX_ID" low="11" high="15" type="uint"/>
+			<bitfield name="DST" low="16" high="21" type="a3xx_regid"/>
+			<bitfield name="WRMASK" low="22" high="25" type="hex"/>
+			<bitfield name="HALF" pos="26" type="boolean"/>
+			<doc>Results in color being zero</doc>
+			<bitfield name="UNK27" pos="27" type="boolean"/>
+			<bitfield name="BINDLESS" pos="28" type="boolean"/>
+			<bitfield name="CMD" low="29" high="31" type="a6xx_tex_prefetch_cmd"/>
+		</reg32>
+	</array>
+	<array offset="0xa99f" name="SP_FS_PREFETCH" stride="1" length="4" variants="A7XX-" usage="rp_blit">
+		<reg32 offset="0" name="CMD" variants="A7XX-">
+			<bitfield name="SRC" low="0" high="6" type="uint"/>
+			<bitfield name="SAMP_ID" low="7" high="9" type="uint"/>
+			<bitfield name="TEX_ID" low="10" high="12" type="uint"/>
+			<bitfield name="DST" low="13" high="18" type="a3xx_regid"/>
+			<bitfield name="WRMASK" low="19" high="22" type="hex"/>
+			<bitfield name="HALF" pos="23" type="boolean"/>
+			<bitfield name="BINDLESS" pos="25" type="boolean"/>
+			<bitfield name="CMD" low="26" high="29" type="a6xx_tex_prefetch_cmd"/>
+		</reg32>
+	</array>
+	<array offset="0xa9a3" name="SP_FS_BINDLESS_PREFETCH" stride="1" length="4" usage="rp_blit">
+		<reg32 offset="0" name="CMD">
+			<bitfield name="SAMP_ID" low="0" high="15" type="uint"/>
+			<bitfield name="TEX_ID" low="16" high="31" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0xa9a7" name="SP_FS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
+	<reg32 offset="0xa9a8" name="SP_UNKNOWN_A9A8" low="0" high="16" usage="cmd"/> <!-- always 0x0 ? -->
+	<reg32 offset="0xa9a9" name="SP_FS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+
+	<!-- TODO: unknown bool register at 0xa9aa, likely same as 0xa8c0-0xa8c3 but for FS -->
+
+
+
+
+	<reg32 offset="0xa9b0" name="SP_CS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="cmd">
+		<bitfield name="THREADSIZE" pos="20" type="a6xx_threadsize"/>
+		<!-- seems to make SP use less concurrent threads when possible? -->
+		<bitfield name="UNK21" pos="21" type="boolean"/>
+		<!-- has a small impact on performance, not clear what it does -->
+		<bitfield name="UNK22" pos="22" type="boolean"/>
+		<bitfield name="EARLYPREAMBLE" pos="23" type="boolean"/>
+		<bitfield name="MERGEDREGS" pos="31" type="boolean"/>
+	</reg32>
+
+	<!-- set for compute shaders -->
+	<reg32 offset="0xa9b1" name="SP_CS_UNKNOWN_A9B1" usage="cmd">
+		<bitfield name="SHARED_SIZE" low="0" high="4" type="uint">
+			<doc>
+				If 0 - all 32k of shared storage is enabled, otherwise
+				(SHARED_SIZE + 1) * 1k is enabled.
+				The ldl/stl offset seems to be rewritten to 0 when it is beyond
+				this limit. This is different from ldlw/stlw, which wraps at
+				64k (and has 36k of storage on A640 - reads between 36k-64k
+				always return 0)
+			</doc>
+		</bitfield>
+		<bitfield name="UNK5" pos="5" type="boolean"/>
+		<!-- always 1 ? -->
+		<bitfield name="UNK6" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xa9b2" name="SP_CS_BRANCH_COND" type="hex" usage="cmd"/>
+	<reg32 offset="0xa9b3" name="SP_CS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="cmd"/>
+	<reg64 offset="0xa9b4" name="SP_CS_OBJ_START" type="address" align="32" usage="cmd"/>
+	<reg32 offset="0xa9b6" name="SP_CS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="cmd"/>
+	<reg64 offset="0xa9b7" name="SP_CS_PVT_MEM_ADDR" align="32" usage="cmd"/>
+	<reg32 offset="0xa9b9" name="SP_CS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="cmd"/>
+	<reg32 offset="0xa9ba" name="SP_CS_TEX_COUNT" low="0" high="7" type="uint" usage="cmd"/>
+	<reg32 offset="0xa9bb" name="SP_CS_CONFIG" type="a6xx_sp_xs_config" usage="cmd"/>
+	<reg32 offset="0xa9bc" name="SP_CS_INSTRLEN" low="0" high="27" type="uint" usage="cmd"/>
+	<reg32 offset="0xa9bd" name="SP_CS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="cmd"/>
+	<reg32 offset="0xa9be" name="SP_CS_UNKNOWN_A9BE" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xa9c5" name="SP_CS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+
+	<!-- new in a6xx gen4, matches HLSQ_CS_CNTL_0 -->
+	<reg32 offset="0xa9c2" name="SP_CS_CNTL_0" usage="cmd">
+		<bitfield name="WGIDCONSTID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="WGSIZECONSTID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="WGOFFSETCONSTID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<!-- new in a6xx gen4, matches HLSQ_CS_CNTL_1 -->
+	<reg32 offset="0xa9c3" name="SP_CS_CNTL_1" variants="A6XX" usage="cmd">
+		<!-- gl_LocalInvocationIndex -->
+		<bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- a650 has 6 "SP cores" (but 3 "SP"). this makes it use only
+		     one of those 6 "SP cores" -->
+		<bitfield name="SINGLE_SP_CORE" pos="8" type="boolean"/>
+		<!-- Must match SP_CS_CTRL -->
+		<bitfield name="THREADSIZE" pos="9" type="a6xx_threadsize"/>
+		<!-- 1 thread per wave (ignored if bit9 set) -->
+		<bitfield name="THREADSIZE_SCALAR" pos="10" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xa9c3" name="SP_CS_CNTL_1" variants="A7XX-" usage="cmd">
+		<!-- gl_LocalInvocationIndex -->
+		<bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- Must match SP_CS_CTRL -->
+		<bitfield name="THREADSIZE" pos="8" type="a6xx_threadsize"/>
+		<!-- 1 thread per wave (would hang if THREAD128 is also set) -->
+		<bitfield name="THREADSIZE_SCALAR" pos="9" type="boolean"/>
+
+		<!-- Affects getone. If enabled, getone sometimes executed 1? less times
+		     than there are subgroups.
+		 -->
+		<bitfield name="UNK15" pos="15" type="boolean"/>
+	</reg32>
+
+	<!-- TODO: two 64kb aligned addresses at a9d0/a9d2 -->
+
+	<reg64 offset="0xa9e0" name="SP_FS_TEX_SAMP" type="address" align="16" usage="rp_blit"/>
+	<reg64 offset="0xa9e2" name="SP_CS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+	<reg64 offset="0xa9e4" name="SP_FS_TEX_CONST" type="address" align="64" usage="rp_blit"/>
+	<reg64 offset="0xa9e6" name="SP_CS_TEX_CONST" type="address" align="64" usage="cmd"/>
+
+	<enum name="a6xx_bindless_descriptor_size">
+		<doc>
+			This can alternatively be interpreted as a pitch shift, ie, the
+			descriptor size is 2 &lt;&lt; N dwords
+		</doc>
+		<value value="1" name="BINDLESS_DESCRIPTOR_16B"/>
+		<value value="3" name="BINDLESS_DESCRIPTOR_64B"/>
+	</enum>
+
+	<array offset="0xa9e8" name="SP_CS_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="cmd">
+		<reg64 offset="0" name="DESCRIPTOR" variants="A6XX">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+	<array offset="0xa9e8" name="SP_CS_BINDLESS_BASE" stride="2" length="8" variants="A7XX-" usage="cmd">
+		<reg64 offset="0" name="DESCRIPTOR" variants="A7XX-">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+
+	<!--
+	IBO state for compute shader:
+	 -->
+	<reg64 offset="0xa9f2" name="SP_CS_IBO" type="address" align="16"/>
+	<reg32 offset="0xaa00" name="SP_CS_IBO_COUNT" low="0" high="6" type="uint"/>
+
+	<!-- Correlated with avgs/uvgs usage in FS -->
+	<reg32 offset="0xaa01" name="SP_FS_VGPR_CONFIG" type="uint" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xaa02" name="SP_PS_ALIASED_COMPONENTS_CONTROL" variants="A7XX-" usage="cmd">
+		<bitfield name="ENABLED" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xaa03" name="SP_PS_ALIASED_COMPONENTS" variants="A7XX-" usage="cmd">
+		<doc>
+			Specify for which components the output color should be read
+			from alias, e.g. for:
+
+				alias.1.b32.0 r3.x, c8.x
+				alias.1.b32.0 r2.x, c4.x
+				alias.1.b32.0 r1.x, c4.x
+				alias.1.b32.0 r0.x, c0.x
+
+			the SP_PS_ALIASED_COMPONENTS would be 0x00001111
+		</doc>
+
+		<bitfield name="RT0" low="0" high="3"/>
+		<bitfield name="RT1" low="4" high="7"/>
+		<bitfield name="RT2" low="8" high="11"/>
+		<bitfield name="RT3" low="12" high="15"/>
+		<bitfield name="RT4" low="16" high="19"/>
+		<bitfield name="RT5" low="20" high="23"/>
+		<bitfield name="RT6" low="24" high="27"/>
+		<bitfield name="RT7" low="28" high="31"/>
+	</reg32>
+
+	<reg32 offset="0xaaf2" name="SP_UNKNOWN_AAF2" type="uint" usage="cmd"/>
+
+	<!--
+                This enum is probably similar in purpose to SNORMMODE on a3xx,
+                minus the snorm stuff, i.e. it controls what happens with an
+                out-of-bounds isam/isamm. GL and Vulkan robustness require us to
+                return 0 on out-of-bound textureFetch().
+	-->
+	<enum name="a6xx_isam_mode">
+		<value value="0x1" name="ISAMMODE_CL"/>
+		<value value="0x2" name="ISAMMODE_GL"/>
+	</enum>
+
+	<reg32 offset="0xab00" name="SP_MODE_CONTROL" usage="rp_blit">
+	  <!--
+	  When set, half register loads from the constant file will
+	  load a 32-bit value (so hc0.y loads the same value as c0.y)
+	  and implicitly convert it to 16b (f2f16, or u2u16, based on
+	  operand type).  When unset, half register loads from the
+	  constant file will load 16 bits from the packed constant
+	  file (so hc0.y loads the top 16 bits of the value of c0.x)
+	  -->
+		<bitfield name="CONSTANT_DEMOTION_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="ISAMMODE" low="1" high="2" type="a6xx_isam_mode"/>
+		<bitfield name="SHARED_CONSTS_ENABLE" pos="3" type="boolean"/> <!-- see HLSQ_SHARED_CONSTS -->
+	</reg32>
+
+	<reg32 offset="0xab01" name="SP_UNKNOWN_AB01" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xab02" name="SP_UNKNOWN_AB02" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xab04" name="SP_FS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+	<reg32 offset="0xab05" name="SP_FS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+
+	<array offset="0xab10" name="SP_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="rp_blit">
+		<reg64 offset="0" name="DESCRIPTOR" variants="A6XX">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+	<array offset="0xab0a" name="SP_BINDLESS_BASE" stride="2" length="8" variants="A7XX-" usage="rp_blit">
+		<reg64 offset="0" name="DESCRIPTOR" variants="A7XX-">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+
+	<!--
+	Combined IBO state for 3d pipe, used for Image and SSBO write/atomic
+	instructions VS/HS/DS/GS/FS.  See SP_CS_IBO_* for compute shaders.
+	 -->
+	<reg64 offset="0xab1a" name="SP_IBO" type="address" align="16" usage="cmd"/>
+	<reg32 offset="0xab20" name="SP_IBO_COUNT" low="0" high="6" type="uint" usage="cmd"/>
+
+	<reg32 offset="0xab22" name="SP_UNKNOWN_AB22" variants="A7XX-" usage="cmd"/>
+
+	<bitset name="a6xx_sp_2d_dst_format" inline="yes">
+		<bitfield name="NORM" pos="0" type="boolean"/>
+		<bitfield name="SINT" pos="1" type="boolean"/>
+		<bitfield name="UINT" pos="2" type="boolean"/>
+		<!-- looks like HW only cares about the base type of this format,
+		     which matches the ifmt? -->
+		<bitfield name="COLOR_FORMAT" low="3" high="10" type="a6xx_format"/>
+		<!-- set when ifmt is R2D_UNORM8_SRGB -->
+		<bitfield name="SRGB" pos="11" type="boolean"/>
+		<!-- some sort of channel mask, not sure what it is for -->
+		<bitfield name="MASK" low="12" high="15"/>
+	</bitset>
+
+	<reg32 offset="0xacc0" name="SP_2D_DST_FORMAT" type="a6xx_sp_2d_dst_format" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xa9bf" name="SP_2D_DST_FORMAT" type="a6xx_sp_2d_dst_format" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0xae00" name="SP_DBG_ECO_CNTL" usage="cmd"/>
+	<reg32 offset="0xae01" name="SP_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode"/>
+	<reg32 offset="0xae02" name="SP_NC_MODE_CNTL">
+		<!-- TODO: valid bits 0x3c3f, see kernel -->
+	</reg32>
+	<reg32 offset="0xae03" name="SP_CHICKEN_BITS" usage="cmd"/>
+	<reg32 offset="0xae04" name="SP_FLOAT_CNTL" usage="cmd">
+		<bitfield name="F16_NO_INF" pos="3" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xae06" name="SP_UNKNOWN_AE06" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae08" name="SP_UNKNOWN_AE08" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae09" name="SP_UNKNOWN_AE09" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae0a" name="SP_UNKNOWN_AE0A" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xae0f" name="SP_PERFCTR_ENABLE" usage="cmd">
+		<!-- some perfcntrs are affected by a per-stage enable bit
+		     (PERF_SP_ALU_WORKING_CYCLES for example)
+		     TODO: verify position of HS/DS/GS bits -->
+		<bitfield name="VS" pos="0" type="boolean"/>
+		<bitfield name="HS" pos="1" type="boolean"/>
+		<bitfield name="DS" pos="2" type="boolean"/>
+		<bitfield name="GS" pos="3" type="boolean"/>
+		<bitfield name="FS" pos="4" type="boolean"/>
+		<bitfield name="CS" pos="5" type="boolean"/>
+	</reg32>
+	<array offset="0xae10" name="SP_PERFCTR_SP_SEL" stride="1" length="24"/>
+	<array offset="0xae60" name="SP_PERFCTR_HLSQ_SEL" stride="1" length="6" variants="A7XX-"/>
+	<reg32 offset="0xae6a" name="SP_UNKNOWN_AE6A" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae6b" name="SP_UNKNOWN_AE6B" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae6c" name="SP_UNKNOWN_AE6C" variants="A7XX-" usage="cmd"/>
+	<reg32 offset="0xae6d" name="SP_READ_SEL" variants="A7XX-">
+		<bitfield name="LOCATION" low="18" high="19" type="a7xx_state_location"/>
+		<bitfield name="PIPE" low="16" high="17" type="a7xx_pipe"/>
+		<bitfield name="STATETYPE" low="8" high="15" type="a7xx_statetype_id"/>
+		<bitfield name="USPTP" low="4" high="7"/>
+		<bitfield name="SPTP" low="0" high="3"/>
+	</reg32>
+	<reg32 offset="0xae71" name="SP_DBG_CNTL" variants="A7XX-"/>
+	<reg32 offset="0xae73" name="SP_UNKNOWN_AE73" variants="A7XX-" usage="cmd"/>
+	<array offset="0xae80" name="SP_PERFCTR_SP_SEL" stride="1" length="36" variants="A7XX-"/>
+	<!-- TODO: there are 4 more percntr select registers (0xae28-0xae2b) -->
+	<!-- TODO: there are a few unknown registers in the 0xae30-0xae52 range -->
+	<reg32 offset="0xbe22" name="SP_CONTEXT_SWITCH_GFX_PREEMPTION_SAFE_MODE"/>
+
+	<!--
+	The downstream kernel calls the debug cluster of registers
+	"a6xx_sp_ps_tp_cluster" but this actually specifies the border
+	color base for compute shaders.
+	-->
+	<reg64 offset="0xb180" name="SP_PS_TP_BORDER_COLOR_BASE_ADDR" type="address" align="128" usage="cmd"/>
+	<reg32 offset="0xb182" name="SP_UNKNOWN_B182" low="0" high="2" usage="cmd"/>
+	<reg32 offset="0xb183" name="SP_UNKNOWN_B183" low="0" high="23" usage="cmd"/>
+
+	<reg32 offset="0xb190" name="SP_UNKNOWN_B190"/>
+	<reg32 offset="0xb191" name="SP_UNKNOWN_B191"/>
+
+	<!-- could be all the stuff below here is actually TPL1?? -->
+
+	<reg32 offset="0xb300" name="SP_TP_RAS_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="UNK2" low="2" high="3"/>
+	</reg32>
+	<reg32 offset="0xb301" name="SP_TP_DEST_MSAA_CNTL" usage="rp_blit">
+		<bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+		<bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+	</reg32>
+
+	<!-- looks to work in the same way as a5xx: -->
+	<reg64 offset="0xb302" name="SP_TP_BORDER_COLOR_BASE_ADDR" type="address" align="128" usage="cmd"/>
+	<reg32 offset="0xb304" name="SP_TP_SAMPLE_CONFIG" type="a6xx_sample_config" usage="rp_blit"/>
+	<reg32 offset="0xb305" name="SP_TP_SAMPLE_LOCATION_0" type="a6xx_sample_locations" usage="rp_blit"/>
+	<reg32 offset="0xb306" name="SP_TP_SAMPLE_LOCATION_1" type="a6xx_sample_locations" usage="rp_blit"/>
+	<reg32 offset="0xb307" name="SP_TP_WINDOW_OFFSET" type="a6xx_reg_xy" usage="rp_blit"/>
+	<reg32 offset="0xb309" name="SP_TP_MODE_CNTL" usage="cmd">
+		<bitfield name="ISAMMODE" low="0" high="1" type="a6xx_isam_mode"/>
+		<bitfield name="UNK3" low="2" high="7"/>
+	</reg32>
+	<reg32 offset="0xb310" name="SP_UNKNOWN_B310" variants="A7XX-" usage="cmd"/>
+
+	<!--
+	Equiv to corresponding RB_2D_SRC_* regs on a5xx.. which were either
+	badly named or the functionality moved in a6xx.  But downstream kernel
+	calls this "a6xx_sp_ps_tp_2d_cluster"
+	 -->
+	<reg32 offset="0xb4c0" name="SP_PS_2D_SRC_INFO" type="a6xx_2d_src_surf_info" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb4c1" name="SP_PS_2D_SRC_SIZE" variants="A6XX" usage="rp_blit">
+		<bitfield name="WIDTH" low="0" high="14" type="uint"/>
+		<bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+	</reg32>
+	<reg64 offset="0xb4c2" name="SP_PS_2D_SRC" type="address" align="16" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb4c4" name="SP_PS_2D_SRC_PITCH" variants="A6XX" usage="rp_blit">
+		<bitfield name="UNK0" low="0" high="8"/>
+		<bitfield name="PITCH" low="9" high="23" shr="6" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0xb2c0" name="SP_PS_2D_SRC_INFO" type="a6xx_2d_src_surf_info" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xb2c1" name="SP_PS_2D_SRC_SIZE" variants="A7XX">
+		<bitfield name="WIDTH" low="0" high="14" type="uint"/>
+		<bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+	</reg32>
+	<reg64 offset="0xb2c2" name="SP_PS_2D_SRC" type="address" align="16" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xb2c4" name="SP_PS_2D_SRC_PITCH" variants="A7XX">
+		<bitfield name="UNK0" low="0" high="8"/>
+		<bitfield name="PITCH" low="9" high="23" shr="6" type="uint"/>
+	</reg32>
+
+	<!-- planes for NV12, etc. (TODO: not tested) -->
+	<reg64 offset="0xb4c5" name="SP_PS_2D_SRC_PLANE1" type="address" align="16" variants="A6XX"/>
+	<reg32 offset="0xb4c7" name="SP_PS_2D_SRC_PLANE_PITCH" low="0" high="11" shr="6" type="uint" variants="A6XX"/>
+	<reg64 offset="0xb4c8" name="SP_PS_2D_SRC_PLANE2" type="address" align="16" variants="A6XX"/>
+
+	<reg64 offset="0xb2c5" name="SP_PS_2D_SRC_PLANE1" type="address" align="16" variants="A7XX-"/>
+	<reg32 offset="0xb2c7" name="SP_PS_2D_SRC_PLANE_PITCH" low="0" high="11" shr="6" type="uint" variants="A7XX-"/>
+	<reg64 offset="0xb2c8" name="SP_PS_2D_SRC_PLANE2" type="address" align="16" variants="A7XX-"/>
+
+	<reg64 offset="0xb4ca" name="SP_PS_2D_SRC_FLAGS" type="address" align="16" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb4cc" name="SP_PS_2D_SRC_FLAGS_PITCH" low="0" high="7" shr="6" type="uint" variants="A6XX" usage="rp_blit"/>
+
+	<reg64 offset="0xb2ca" name="SP_PS_2D_SRC_FLAGS" type="address" align="16" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xb2cc" name="SP_PS_2D_SRC_FLAGS_PITCH" low="0" high="7" shr="6" type="uint" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0xb4cd" name="SP_PS_UNKNOWN_B4CD" low="6" high="31" variants="A6XX"/>
+	<reg32 offset="0xb4ce" name="SP_PS_UNKNOWN_B4CE" low="0" high="31" variants="A6XX"/>
+	<reg32 offset="0xb4cf" name="SP_PS_UNKNOWN_B4CF" low="0" high="30" variants="A6XX"/>
+	<reg32 offset="0xb4d0" name="SP_PS_UNKNOWN_B4D0" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb4d1" name="SP_WINDOW_OFFSET" type="a6xx_reg_xy" variants="A6XX" usage="rp_blit"/>
+
+	<reg32 offset="0xb2cd" name="SP_PS_UNKNOWN_B4CD" low="6" high="31" variants="A7XX"/>
+	<reg32 offset="0xb2ce" name="SP_PS_UNKNOWN_B4CE" low="0" high="31" variants="A7XX"/>
+	<reg32 offset="0xb2cf" name="SP_PS_UNKNOWN_B4CF" low="0" high="30" variants="A7XX"/>
+	<reg32 offset="0xb2d0" name="SP_PS_UNKNOWN_B4D0" low="0" high="29" variants="A7XX"/>
+	<reg32 offset="0xb2d1" name="SP_PS_2D_WINDOW_OFFSET" type="a6xx_reg_xy" variants="A7XX"/>
+	<reg32 offset="0xb2d2" name="SP_PS_UNKNOWN_B2D2" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xab21" name="SP_WINDOW_OFFSET" type="a6xx_reg_xy" variants="A7XX-" usage="rp_blit"/>
+
+	<!-- always 0x100000 or 0x1000000? -->
+	<reg32 offset="0xb600" name="TPL1_DBG_ECO_CNTL" low="0" high="25" usage="cmd"/>
+	<reg32 offset="0xb601" name="TPL1_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0xb602" name="TPL1_DBG_ECO_CNTL1" usage="cmd">
+		<!-- Affects UBWC in some way, if BLIT_OP_SCALE is done with this bit set
+		     and if other blit is done without it - UBWC image may be copied incorrectly.
+		 -->
+		<bitfield name="TP_UBWC_FLAG_HINT" pos="18" type="boolean"/>
+	</reg32>
+	<reg32 offset="0xb604" name="TPL1_NC_MODE_CNTL">
+		<bitfield name="MODE" pos="0" type="boolean"/>
+		<bitfield name="LOWER_BIT" low="1" high="2" type="uint"/>
+		<bitfield name="MIN_ACCESS_LENGTH" pos="3" type="boolean"/> <!-- true=64b false=32b -->
+		<bitfield name="UPPER_BIT" pos="4" type="uint"/>
+		<bitfield name="UNK6" low="6" high="7"/>
+	</reg32>
+	<reg32 offset="0xb605" name="TPL1_UNKNOWN_B605" low="0" high="7" type="uint" variants="A6XX" usage="cmd"/> <!-- always 0x0 or 0x44 ? -->
+
+	<reg32 offset="0xb608" name="TPL1_BICUBIC_WEIGHTS_TABLE_0" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb609" name="TPL1_BICUBIC_WEIGHTS_TABLE_1" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb60a" name="TPL1_BICUBIC_WEIGHTS_TABLE_2" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb60b" name="TPL1_BICUBIC_WEIGHTS_TABLE_3" low="0" high="29" variants="A6XX"/>
+	<reg32 offset="0xb60c" name="TPL1_BICUBIC_WEIGHTS_TABLE_4" low="0" high="29" variants="A6XX"/>
+
+	<reg32 offset="0xb608" name="TPL1_BICUBIC_WEIGHTS_TABLE_0" low="0" high="29" variants="A7XX" usage="cmd"/>
+	<reg32 offset="0xb609" name="TPL1_BICUBIC_WEIGHTS_TABLE_1" low="0" high="29" variants="A7XX" usage="cmd"/>
+	<reg32 offset="0xb60a" name="TPL1_BICUBIC_WEIGHTS_TABLE_2" low="0" high="29" variants="A7XX" usage="cmd"/>
+	<reg32 offset="0xb60b" name="TPL1_BICUBIC_WEIGHTS_TABLE_3" low="0" high="29" variants="A7XX" usage="cmd"/>
+	<reg32 offset="0xb60c" name="TPL1_BICUBIC_WEIGHTS_TABLE_4" low="0" high="29" variants="A7XX" usage="cmd"/>
+
+	<array offset="0xb610" name="TPL1_PERFCTR_TP_SEL" stride="1" length="12" variants="A6XX"/>
+	<array offset="0xb610" name="TPL1_PERFCTR_TP_SEL" stride="1" length="18" variants="A7XX"/>
+
+	<!-- TODO: 4 more perfcntr sel at 0xb620 ? -->
+
+	<bitset name="a6xx_hlsq_xs_cntl" inline="yes">
+		<bitfield name="CONSTLEN" low="0" high="7" shr="2" type="uint"/>
+		<bitfield name="ENABLED" pos="8" type="boolean"/>
+		<bitfield name="READ_IMM_SHARED_CONSTS" pos="9" type="boolean" variants="A7XX-"/>
+	</bitset>
+
+	<reg32 offset="0xb800" name="HLSQ_VS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb801" name="HLSQ_HS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb802" name="HLSQ_DS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb803" name="HLSQ_GS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+
+	<reg32 offset="0xa827" name="HLSQ_VS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa83f" name="HLSQ_HS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa867" name="HLSQ_DS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa898" name="HLSQ_GS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+
+	<reg32 offset="0xa9aa" name="HLSQ_FS_UNKNOWN_A9AA" variants="A7XX-" usage="rp_blit">
+		<!-- Tentatively named, appears to disable consts being loaded via CP_LOAD_STATE6_FRAG -->
+		<bitfield name="CONSTS_LOAD_DISABLE" pos="0" type="boolean"/>
+	</reg32>
+
+	<!-- Always 0 -->
+	<reg32 offset="0xa9ac" name="HLSQ_UNKNOWN_A9AC" variants="A7XX-" usage="cmd"/>
+
+	<!-- Used in VK_KHR_fragment_shading_rate -->
+	<reg32 offset="0xa9ad" name="HLSQ_UNKNOWN_A9AD" variants="A7XX-" usage="cmd"/>
+
+	<reg32 offset="0xa9ae" name="HLSQ_UNKNOWN_A9AE" variants="A7XX-" usage="rp_blit">
+		<bitfield name="SYSVAL_REGS_COUNT" low="0" high="7" type="uint"/>
+		<!-- UNK8 is set on a730/a740 -->
+		<bitfield name="UNK8" pos="8" type="boolean"/>
+		<!-- UNK9 is set on a750 -->
+		<bitfield name="UNK9" pos="9" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xb820" name="HLSQ_LOAD_STATE_GEOM_CMD"/>
+	<reg64 offset="0xb821" name="HLSQ_LOAD_STATE_GEOM_EXT_SRC_ADDR" align="16" type="address"/>
+	<reg32 offset="0xb823" name="HLSQ_LOAD_STATE_GEOM_DATA"/>
+
+
+	<bitset name="a6xx_hlsq_fs_cntl_0" inline="yes">
+		<!-- must match SP_FS_CTRL -->
+		<bitfield name="THREADSIZE" pos="0" type="a6xx_threadsize"/>
+		<bitfield name="VARYINGS" pos="1" type="boolean"/>
+		<bitfield name="UNK2" low="2" high="11"/>
+	</bitset>
+	<bitset name="a6xx_hlsq_control_3_reg" inline="yes">
+		<!-- register loaded with position (bary.f) -->
+		<bitfield name="IJ_PERSP_PIXEL" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_PIXEL" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="IJ_PERSP_CENTROID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_CENTROID" low="24" high="31" type="a3xx_regid"/>
+	</bitset>
+	<bitset name="a6xx_hlsq_control_4_reg" inline="yes">
+		<bitfield name="IJ_PERSP_SAMPLE" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="IJ_LINEAR_SAMPLE" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="XYCOORDREGID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="ZWCOORDREGID" low="24" high="31" type="a3xx_regid"/>
+	</bitset>
+	<bitset name="a6xx_hlsq_control_5_reg" inline="yes">
+		<bitfield name="LINELENGTHREGID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="FOVEATIONQUALITYREGID" low="8" high="15" type="a3xx_regid"/>
+	</bitset>
+
+	<reg32 offset="0xb980" type="a6xx_hlsq_fs_cntl_0" name="HLSQ_FS_CNTL_0" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb981" name="HLSQ_UNKNOWN_B981" pos="0" type="boolean" variants="A6XX"/> <!-- never used by blob -->
+	<reg32 offset="0xb982" name="HLSQ_CONTROL_1_REG" low="0" high="2" variants="A6XX" usage="rp_blit">
+		<!-- Sets the maximum number of primitives allowed in one FS wave minus one, similarly to the
+				 A3xx field, except that it's not necessary to set it to anything but the maximum, since
+				 the hardware will simply emit smaller waves when it runs out of space.	-->
+		<bitfield name="PRIMALLOCTHRESHOLD" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb983" name="HLSQ_CONTROL_2_REG" variants="A6XX" usage="rp_blit">
+		<bitfield name="FACEREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- SAMPLEID is loaded into a half-precision register: -->
+		<bitfield name="SAMPLEID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="CENTERRHW" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xb984" type="a6xx_hlsq_control_3_reg" name="HLSQ_CONTROL_3_REG" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb985" type="a6xx_hlsq_control_4_reg" name="HLSQ_CONTROL_4_REG" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb986" type="a6xx_hlsq_control_5_reg" name="HLSQ_CONTROL_5_REG" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb987" name="HLSQ_CS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="cmd"/>
+	<reg32 offset="0xa9c6" type="a6xx_hlsq_fs_cntl_0" name="HLSQ_FS_CNTL_0" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9c7" name="HLSQ_CONTROL_1_REG" low="0" high="2" variants="A7XX-" usage="rp_blit">
+			<bitfield name="PRIMALLOCTHRESHOLD" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9c8" name="HLSQ_CONTROL_2_REG" variants="A7XX-" usage="rp_blit">
+		<bitfield name="FACEREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- SAMPLEID is loaded into a half-precision register: -->
+		<bitfield name="SAMPLEID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="SAMPLEMASK" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="CENTERRHW" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xa9c9" type="a6xx_hlsq_control_3_reg" name="HLSQ_CONTROL_3_REG" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9ca" type="a6xx_hlsq_control_4_reg" name="HLSQ_CONTROL_4_REG" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9cb" type="a6xx_hlsq_control_5_reg" name="HLSQ_CONTROL_5_REG" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9cd" name="HLSQ_CS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="cmd"/>
+
+	<!-- TODO: what does KERNELDIM do exactly (blob sets it differently from turnip) -->
+	<reg32 offset="0xb990" name="HLSQ_CS_NDRANGE_0" variants="A6XX" usage="rp_blit">
+		<bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb991" name="HLSQ_CS_NDRANGE_1" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb992" name="HLSQ_CS_NDRANGE_2" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALOFF_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb993" name="HLSQ_CS_NDRANGE_3" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb994" name="HLSQ_CS_NDRANGE_4" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALOFF_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb995" name="HLSQ_CS_NDRANGE_5" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb996" name="HLSQ_CS_NDRANGE_6" variants="A6XX" usage="rp_blit">
+		<bitfield name="GLOBALOFF_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xb997" name="HLSQ_CS_CNTL_0" variants="A6XX" usage="rp_blit">
+		<!-- these are all vec3. first 3 need to be high regs
+		     WGSIZECONSTID is the local size (from HLSQ_CS_NDRANGE_0)
+		     WGOFFSETCONSTID is WGIDCONSTID*WGSIZECONSTID
+		-->
+		<bitfield name="WGIDCONSTID" low="0" high="7" type="a3xx_regid"/>
+		<bitfield name="WGSIZECONSTID" low="8" high="15" type="a3xx_regid"/>
+		<bitfield name="WGOFFSETCONSTID" low="16" high="23" type="a3xx_regid"/>
+		<bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+	</reg32>
+	<reg32 offset="0xb998" name="HLSQ_CS_CNTL_1" variants="A6XX" usage="rp_blit">
+		<!-- gl_LocalInvocationIndex -->
+		<bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- a650 has 6 "SP cores" (but 3 "SP"). this makes it use only
+		     one of those 6 "SP cores" -->
+		<bitfield name="SINGLE_SP_CORE" pos="8" type="boolean"/>
+		<!-- Must match SP_CS_CTRL -->
+		<bitfield name="THREADSIZE" pos="9" type="a6xx_threadsize"/>
+		<!-- 1 thread per wave (ignored if bit9 set) -->
+		<bitfield name="THREADSIZE_SCALAR" pos="10" type="boolean"/>
+	</reg32>
+	<!--note: vulkan blob doesn't use these -->
+	<reg32 offset="0xb999" name="HLSQ_CS_KERNEL_GROUP_X" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb99a" name="HLSQ_CS_KERNEL_GROUP_Y" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xb99b" name="HLSQ_CS_KERNEL_GROUP_Z" variants="A6XX" usage="rp_blit"/>
+
+	<!-- TODO: what does KERNELDIM do exactly (blob sets it differently from turnip) -->
+	<reg32 offset="0xa9d4" name="HLSQ_CS_NDRANGE_0" variants="A7XX-" usage="rp_blit">
+		<bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d5" name="HLSQ_CS_NDRANGE_1" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d6" name="HLSQ_CS_NDRANGE_2" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALOFF_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d7" name="HLSQ_CS_NDRANGE_3" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d8" name="HLSQ_CS_NDRANGE_4" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALOFF_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9d9" name="HLSQ_CS_NDRANGE_5" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALSIZE_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0xa9da" name="HLSQ_CS_NDRANGE_6" variants="A7XX-" usage="rp_blit">
+		<bitfield name="GLOBALOFF_Z" low="0" high="31" type="uint"/>
+	</reg32>
+	<!--note: vulkan blob doesn't use these -->
+	<reg32 offset="0xa9dc" name="HLSQ_CS_KERNEL_GROUP_X" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9dd" name="HLSQ_CS_KERNEL_GROUP_Y" variants="A7XX-" usage="rp_blit"/>
+	<reg32 offset="0xa9de" name="HLSQ_CS_KERNEL_GROUP_Z" variants="A7XX-" usage="rp_blit"/>
+
+	<enum name="a7xx_cs_yalign">
+		<value name="CS_YALIGN_1" value="8"/>
+		<value name="CS_YALIGN_2" value="4"/>
+		<value name="CS_YALIGN_4" value="2"/>
+		<value name="CS_YALIGN_8" value="1"/>
+	</enum>
+
+	<reg32 offset="0xa9db" name="HLSQ_CS_CNTL_1" variants="A7XX-" usage="rp_blit">
+		<!-- gl_LocalInvocationIndex -->
+		<bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+		<!-- Must match SP_CS_CTRL -->
+		<bitfield name="THREADSIZE" pos="9" type="a6xx_threadsize"/>
+		<bitfield name="UNK11" pos="11" type="boolean"/>
+		<bitfield name="UNK22" pos="22" type="boolean"/>
+		<bitfield name="UNK26" pos="26" type="boolean"/>
+		<bitfield name="YALIGN" low="27" high="30" type="a7xx_cs_yalign"/>
+	</reg32>
+
+	<reg32 offset="0xa9df" name="HLSQ_CS_LOCAL_SIZE" variants="A7XX-" usage="cmd">
+		<!-- localsize is value minus one: -->
+		<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+		<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+		<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0xb9a0" name="HLSQ_LOAD_STATE_FRAG_CMD"/>
+	<reg64 offset="0xb9a1" name="HLSQ_LOAD_STATE_FRAG_EXT_SRC_ADDR" align="16" type="address"/>
+	<reg32 offset="0xb9a3" name="HLSQ_LOAD_STATE_FRAG_DATA"/>
+
+	<!-- mirror of SP_CS_BINDLESS_BASE -->
+	<array offset="0xb9c0" name="HLSQ_CS_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="rp_blit">
+		<reg64 offset="0" name="DESCRIPTOR">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+
+	<!-- new in a6xx gen4, mirror of SP_CS_UNKNOWN_A9B1? -->
+	<reg32 offset="0xb9d0" name="HLSQ_CS_UNKNOWN_B9D0" variants="A6XX" usage="cmd">
+		<bitfield name="SHARED_SIZE" low="0" high="4" type="uint"/>
+		<bitfield name="UNK5" pos="5" type="boolean"/>
+		<!-- always 1 ? -->
+		<bitfield name="UNK6" pos="6" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0xbb00" name="HLSQ_DRAW_CMD" variants="A6XX">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0xbb01" name="HLSQ_DISPATCH_CMD" variants="A6XX">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0xbb02" name="HLSQ_EVENT_CMD" variants="A6XX">
+		<!-- I think only the low bit is actually used? -->
+		<bitfield name="STATE_ID" low="16" high="23"/>
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+	</reg32>
+
+	<reg32 offset="0xbb08" name="HLSQ_INVALIDATE_CMD" variants="A6XX" usage="cmd">
+		<doc>
+			This register clears pending loads queued up by
+			CP_LOAD_STATE6. Each bit resets a particular kind(s) of
+			CP_LOAD_STATE6.
+		</doc>
+
+		<!-- per-stage state: shader, non-bindless UBO, textures, and samplers -->
+		<bitfield name="VS_STATE" pos="0" type="boolean"/>
+		<bitfield name="HS_STATE" pos="1" type="boolean"/>
+		<bitfield name="DS_STATE" pos="2" type="boolean"/>
+		<bitfield name="GS_STATE" pos="3" type="boolean"/>
+		<bitfield name="FS_STATE" pos="4" type="boolean"/>
+		<bitfield name="CS_STATE" pos="5" type="boolean"/>
+
+		<bitfield name="CS_IBO" pos="6" type="boolean"/>
+		<bitfield name="GFX_IBO" pos="7" type="boolean"/>
+
+		<!-- Note: these only do something when HLSQ_SHARED_CONSTS is set to 1 -->
+		<bitfield name="CS_SHARED_CONST" pos="19" type="boolean"/>
+		<bitfield name="GFX_SHARED_CONST" pos="8" type="boolean"/>
+
+		<!-- SS6_BINDLESS: one bit per bindless base -->
+		<bitfield name="CS_BINDLESS" low="9" high="13" type="hex"/>
+		<bitfield name="GFX_BINDLESS" low="14" high="18" type="hex"/>
+	</reg32>
+
+	<reg32 offset="0xab1c" name="HLSQ_DRAW_CMD" variants="A7XX-">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0xab1d" name="HLSQ_DISPATCH_CMD" variants="A7XX-">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+
+	<reg32 offset="0xab1e" name="HLSQ_EVENT_CMD" variants="A7XX-">
+		<bitfield name="STATE_ID" low="16" high="23"/>
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+	</reg32>
+
+	<reg32 offset="0xab1f" name="HLSQ_INVALIDATE_CMD" variants="A7XX-" usage="cmd">
+		<doc>
+			This register clears pending loads queued up by
+			CP_LOAD_STATE6. Each bit resets a particular kind(s) of
+			CP_LOAD_STATE6.
+		</doc>
+
+		<!-- per-stage state: shader, non-bindless UBO, textures, and samplers -->
+		<bitfield name="VS_STATE" pos="0" type="boolean"/>
+		<bitfield name="HS_STATE" pos="1" type="boolean"/>
+		<bitfield name="DS_STATE" pos="2" type="boolean"/>
+		<bitfield name="GS_STATE" pos="3" type="boolean"/>
+		<bitfield name="FS_STATE" pos="4" type="boolean"/>
+		<bitfield name="CS_STATE" pos="5" type="boolean"/>
+
+		<bitfield name="CS_IBO" pos="6" type="boolean"/>
+		<bitfield name="GFX_IBO" pos="7" type="boolean"/>
+
+		<!-- SS6_BINDLESS: one bit per bindless base -->
+		<bitfield name="CS_BINDLESS" low="9" high="16" type="hex"/>
+		<bitfield name="GFX_BINDLESS" low="17" high="24" type="hex"/>
+	</reg32>
+
+	<reg32 offset="0xbb10" name="HLSQ_FS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+	<reg32 offset="0xab03" name="HLSQ_FS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+
+	<array offset="0xab40" name="HLSQ_SHARED_CONSTS_IMM" stride="1" length="64" variants="A7XX-"/>
+
+	<reg32 offset="0xbb11" name="HLSQ_SHARED_CONSTS" variants="A6XX" usage="cmd">
+		<doc>
+			Shared constants are intended to be used for Vulkan push
+			constants. When enabled, 8 vec4's are reserved in the FS
+			const pool and 16 in the geometry const pool although
+			only 8 are actually used (why?) and they are mapped to
+			c504-c511 in each stage. Both VS and FS shared consts
+			are written using ST6_CONSTANTS/SB6_IBO, so that both
+			the geometry and FS shared consts can be written at once
+			by using CP_LOAD_STATE6 rather than
+			CP_LOAD_STATE6_FRAG/CP_LOAD_STATE6_GEOM. In addition
+			DST_OFF and NUM_UNIT are in units of dwords instead of
+			vec4's.
+
+			There is also a separate shared constant pool for CS,
+			which is loaded through CP_LOAD_STATE6_FRAG with
+			ST6_UBO/ST6_IBO. However the only real difference for CS
+			is the dword units.
+		</doc>
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+
+	<!-- mirror of SP_BINDLESS_BASE -->
+	<array offset="0xbb20" name="HLSQ_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="cmd">
+		<reg64 offset="0" name="DESCRIPTOR">
+			<bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+			<bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+		</reg64>
+	</array>
+
+	<reg32 offset="0xbd80" name="HLSQ_2D_EVENT_CMD">
+		<bitfield name="STATE_ID" low="8" high="15"/>
+		<bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+	</reg32>
+
+	<reg32 offset="0xbe00" name="HLSQ_UNKNOWN_BE00" variants="A6XX" usage="cmd"/> <!-- all bits valid except bit 29 -->
+	<reg32 offset="0xbe01" name="HLSQ_UNKNOWN_BE01" low="4" high="6" variants="A6XX" usage="cmd"/>
+	<reg32 offset="0xbe04" name="HLSQ_DBG_ECO_CNTL" variants="A6XX" usage="cmd"/>
+	<reg32 offset="0xbe05" name="HLSQ_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+	<reg32 offset="0xbe08" name="HLSQ_UNKNOWN_BE08" low="0" high="15"/>
+	<array offset="0xbe10" name="HLSQ_PERFCTR_HLSQ_SEL" stride="1" length="6"/>
+
+	<!-- TODO: some valid registers between 0xbe20 and 0xbe33 -->
+	<reg32 offset="0xbe22" name="HLSQ_CONTEXT_SWITCH_GFX_PREEMPTION_SAFE_MODE"/>
+
+	<reg32 offset="0xc000" name="SP_AHB_READ_APERTURE" variants="A7XX-"/>
+
+	<!-- Don't know if these are SP, always 0 -->
+	<reg64 offset="0x0ce2" name="SP_UNKNOWN_0CE2" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x0ce4" name="SP_UNKNOWN_0CE4" variants="A7XX-" usage="cmd"/>
+	<reg64 offset="0x0ce6" name="SP_UNKNOWN_0CE6" variants="A7XX-" usage="cmd"/>
+
+	<!--
+		These special registers signal the beginning/end of an event
+		sequence. The sequence used internally for an event looks like:
+		- write EVENT_CMD pipe register
+		- write CP_EVENT_START
+		- write HLSQ_EVENT_CMD with event or HLSQ_DRAW_CMD
+		- write PC_EVENT_CMD with event or PC_DRAW_CMD
+		- write HLSQ_EVENT_CMD(CONTEXT_DONE)
+		- write PC_EVENT_CMD(CONTEXT_DONE)
+		- write CP_EVENT_END
+		Writing to CP_EVENT_END seems to actually trigger the context roll
+	-->
+	<reg32 offset="0xd600" name="CP_EVENT_START">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+	<reg32 offset="0xd601" name="CP_EVENT_END">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+	<reg32 offset="0xd700" name="CP_2D_EVENT_START">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+	<reg32 offset="0xd701" name="CP_2D_EVENT_END">
+		<bitfield name="STATE_ID" low="0" high="7"/>
+	</reg32>
+</domain>
+
+<!-- Seems basically the same as a5xx, maybe move to common.xml.. -->
+<domain name="A6XX_TEX_SAMP" width="32">
+	<doc>Texture sampler dwords</doc>
+	<enum name="a6xx_tex_filter"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_NEAREST" value="0"/>
+		<value name="A6XX_TEX_LINEAR" value="1"/>
+		<value name="A6XX_TEX_ANISO" value="2"/>
+		<value name="A6XX_TEX_CUBIC" value="3"/> <!-- a650 only -->
+	</enum>
+	<enum name="a6xx_tex_clamp"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_REPEAT" value="0"/>
+		<value name="A6XX_TEX_CLAMP_TO_EDGE" value="1"/>
+		<value name="A6XX_TEX_MIRROR_REPEAT" value="2"/>
+		<value name="A6XX_TEX_CLAMP_TO_BORDER" value="3"/>
+		<value name="A6XX_TEX_MIRROR_CLAMP" value="4"/>
+	</enum>
+	<enum name="a6xx_tex_aniso"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_ANISO_1" value="0"/>
+		<value name="A6XX_TEX_ANISO_2" value="1"/>
+		<value name="A6XX_TEX_ANISO_4" value="2"/>
+		<value name="A6XX_TEX_ANISO_8" value="3"/>
+		<value name="A6XX_TEX_ANISO_16" value="4"/>
+	</enum>
+	<enum name="a6xx_reduction_mode">
+		<value name="A6XX_REDUCTION_MODE_AVERAGE" value="0"/>
+		<value name="A6XX_REDUCTION_MODE_MIN" value="1"/>
+		<value name="A6XX_REDUCTION_MODE_MAX" value="2"/>
+	</enum>
+
+	<reg32 offset="0" name="0">
+		<bitfield name="MIPFILTER_LINEAR_NEAR" pos="0" type="boolean"/>
+		<bitfield name="XY_MAG" low="1" high="2" type="a6xx_tex_filter"/>
+		<bitfield name="XY_MIN" low="3" high="4" type="a6xx_tex_filter"/>
+		<bitfield name="WRAP_S" low="5" high="7" type="a6xx_tex_clamp"/>
+		<bitfield name="WRAP_T" low="8" high="10" type="a6xx_tex_clamp"/>
+		<bitfield name="WRAP_R" low="11" high="13" type="a6xx_tex_clamp"/>
+		<bitfield name="ANISO" low="14" high="16" type="a6xx_tex_aniso"/>
+		<bitfield name="LOD_BIAS" low="19" high="31" type="fixed" radix="8"/><!-- no idea how many bits for real -->
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="CLAMPENABLE" pos="0" type="boolean">
+			<doc>
+				clamp result to [0, 1] if the format is unorm or
+				[-1, 1] if the format is snorm, *after*
+				filtering. Has no effect for other formats.
+			</doc>
+		</bitfield>
+		<bitfield name="COMPARE_FUNC" low="1" high="3" type="adreno_compare_func"/>
+		<bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="4" type="boolean"/>
+		<bitfield name="UNNORM_COORDS" pos="5" type="boolean"/>
+		<bitfield name="MIPFILTER_LINEAR_FAR" pos="6" type="boolean"/>
+		<bitfield name="MAX_LOD" low="8" high="19" type="ufixed" radix="8"/>
+		<bitfield name="MIN_LOD" low="20" high="31" type="ufixed" radix="8"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="REDUCTION_MODE" low="0" high="1" type="a6xx_reduction_mode"/>
+		<bitfield name="CHROMA_LINEAR" pos="5" type="boolean"/>
+		<bitfield name="BCOLOR" low="7" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3"/>
+</domain>
+
+<domain name="A6XX_TEX_CONST" width="32" varset="chip">
+	<doc>Texture constant dwords</doc>
+	<enum name="a6xx_tex_swiz"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_X" value="0"/>
+		<value name="A6XX_TEX_Y" value="1"/>
+		<value name="A6XX_TEX_Z" value="2"/>
+		<value name="A6XX_TEX_W" value="3"/>
+		<value name="A6XX_TEX_ZERO" value="4"/>
+		<value name="A6XX_TEX_ONE" value="5"/>
+	</enum>
+	<enum name="a6xx_tex_type"> <!-- same as a4xx? -->
+		<value name="A6XX_TEX_1D" value="0"/>
+		<value name="A6XX_TEX_2D" value="1"/>
+		<value name="A6XX_TEX_CUBE" value="2"/>
+		<value name="A6XX_TEX_3D" value="3"/>
+		<value name="A6XX_TEX_BUFFER" value="4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TILE_MODE" low="0" high="1" type="a6xx_tile_mode"/>
+		<bitfield name="SRGB" pos="2" type="boolean"/>
+		<bitfield name="SWIZ_X" low="4" high="6" type="a6xx_tex_swiz"/>
+		<bitfield name="SWIZ_Y" low="7" high="9" type="a6xx_tex_swiz"/>
+		<bitfield name="SWIZ_Z" low="10" high="12" type="a6xx_tex_swiz"/>
+		<bitfield name="SWIZ_W" low="13" high="15" type="a6xx_tex_swiz"/>
+		<bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
+		<!-- overlaps with MIPLVLS -->
+		<bitfield name="CHROMA_MIDPOINT_X" pos="16" type="boolean"/>
+		<bitfield name="CHROMA_MIDPOINT_Y" pos="18" type="boolean"/>
+		<bitfield name="SAMPLES" low="20" high="21" type="a3xx_msaa_samples"/>
+		<bitfield name="FMT" low="22" high="29" type="a6xx_format"/>
+		<!--
+			Why is the swap needed in addition to SWIZ_*? The swap
+			is performed before border color replacement, while the
+			swizzle is applied after after it.
+		-->
+		<bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="WIDTH" low="0" high="14" type="uint"/>
+		<bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+		<bitfield name="MUTABLEEN" pos="31" type="boolean" variants="A7XX-"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<!--
+			These fields overlap PITCH, and are used instead of
+			PITCH/PITCHALIGN when TYPE is A6XX_TEX_BUFFER.
+		 -->
+		<doc> probably for D3D structured UAVs, normally set to 1 </doc>
+		<bitfield name="STRUCTSIZETEXELS" low="4" high="15" type="uint"/>
+		<bitfield name="STARTOFFSETTEXELS" low="16" high="21" type="uint"/>
+
+		<!-- minimum pitch (for mipmap levels): log2(pitchalign / 64) -->
+		<bitfield name="PITCHALIGN" low="0" high="3" type="uint"/>
+		<doc>Pitch in bytes (so actually stride)</doc>
+		<bitfield name="PITCH" low="7" high="28" type="uint"/>
+		<bitfield name="TYPE" low="29" high="31" type="a6xx_tex_type"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!--
+		ARRAY_PITCH is basically LAYERSZ for the first mipmap level, and
+		for 3d textures (laid out mipmap level first) MIN_LAYERSZ is the
+		layer size at the point that it stops being reduced moving to
+		higher (smaller) mipmap levels
+		 -->
+		<bitfield name="ARRAY_PITCH" low="0" high="22" shr="12" type="uint"/>
+		<bitfield name="MIN_LAYERSZ" low="23" high="26" shr="12"/>
+		<!--
+		by default levels with w < 16 are linear
+		TILE_ALL makes all levels have tiling
+		seems required when using UBWC, since all levels have UBWC (can possibly be disabled?)
+		 -->
+		<bitfield name="TILE_ALL" pos="27" type="boolean"/>
+		<bitfield name="FLAG" pos="28" type="boolean"/>
+	</reg32>
+	<!-- for 2-3 plane format, BASE is flag buffer address (if enabled)
+	     the address of the non-flag base buffer is determined automatically,
+	     and must follow the flag buffer
+	 -->
+	<reg32 offset="4" name="4">
+		<bitfield name="BASE_LO" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="BASE_HI" low="0" high="16"/>
+		<bitfield name="DEPTH" low="17" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<!-- overlaps with PLANE_PITCH -->
+		<bitfield name="MIN_LOD_CLAMP" low="0" high="11" type="ufixed" radix="8"/>
+		<!-- pitch for plane 2 / plane 3 -->
+		<bitfield name="PLANE_PITCH" low="8" high="31" type="uint"/>
+	</reg32>
+	<!-- 7/8 is plane 2 address for planar formats -->
+	<reg32 offset="7" name="7">
+		<bitfield name="FLAG_LO" low="5" high="31" shr="5"/>
+	</reg32>
+	<reg32 offset="8" name="8">
+		<bitfield name="FLAG_HI" low="0" high="16"/>
+	</reg32>
+	<!-- 9/10 is plane 3 address for planar formats -->
+	<reg32 offset="9" name="9">
+		<bitfield name="FLAG_BUFFER_ARRAY_PITCH" low="0" high="16" shr="4" type="uint"/>
+	</reg32>
+	<reg32 offset="10" name="10">
+		<bitfield name="FLAG_BUFFER_PITCH" low="0" high="6" shr="6" type="uint"/>
+		<!-- log2 size of the first level, required for mipmapping -->
+		<bitfield name="FLAG_BUFFER_LOGW" low="8" high="11" type="uint"/>
+		<bitfield name="FLAG_BUFFER_LOGH" low="12" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="11" name="11"/>
+	<reg32 offset="12" name="12"/>
+	<reg32 offset="13" name="13"/>
+	<reg32 offset="14" name="14"/>
+	<reg32 offset="15" name="15"/>
+</domain>
+
+<domain name="A6XX_UBO" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="BASE_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="BASE_HI" low="0" high="16"/>
+		<bitfield name="SIZE" low="17" high="31"/> <!-- size in vec4 (4xDWORD) units -->
+	</reg32>
+</domain>
+
+<domain name="A6XX_PDC" width="32">
+	<reg32 offset="0x1140" name="GPU_ENABLE_PDC"/>
+	<reg32 offset="0x1148" name="GPU_SEQ_START_ADDR"/>
+	<reg32 offset="0x1540" name="GPU_TCS0_CONTROL"/>
+	<reg32 offset="0x1541" name="GPU_TCS0_CMD_ENABLE_BANK"/>
+	<reg32 offset="0x1542" name="GPU_TCS0_CMD_WAIT_FOR_CMPL_BANK"/>
+	<reg32 offset="0x1543" name="GPU_TCS0_CMD0_MSGID"/>
+	<reg32 offset="0x1544" name="GPU_TCS0_CMD0_ADDR"/>
+	<reg32 offset="0x1545" name="GPU_TCS0_CMD0_DATA"/>
+	<reg32 offset="0x1572" name="GPU_TCS1_CONTROL"/>
+	<reg32 offset="0x1573" name="GPU_TCS1_CMD_ENABLE_BANK"/>
+	<reg32 offset="0x1574" name="GPU_TCS1_CMD_WAIT_FOR_CMPL_BANK"/>
+	<reg32 offset="0x1575" name="GPU_TCS1_CMD0_MSGID"/>
+	<reg32 offset="0x1576" name="GPU_TCS1_CMD0_ADDR"/>
+	<reg32 offset="0x1577" name="GPU_TCS1_CMD0_DATA"/>
+	<reg32 offset="0x15A4" name="GPU_TCS2_CONTROL"/>
+	<reg32 offset="0x15A5" name="GPU_TCS2_CMD_ENABLE_BANK"/>
+	<reg32 offset="0x15A6" name="GPU_TCS2_CMD_WAIT_FOR_CMPL_BANK"/>
+	<reg32 offset="0x15A7" name="GPU_TCS2_CMD0_MSGID"/>
+	<reg32 offset="0x15A8" name="GPU_TCS2_CMD0_ADDR"/>
+	<reg32 offset="0x15A9" name="GPU_TCS2_CMD0_DATA"/>
+	<reg32 offset="0x15D6" name="GPU_TCS3_CONTROL"/>
+	<reg32 offset="0x15D7" name="GPU_TCS3_CMD_ENABLE_BANK"/>
+	<reg32 offset="0x15D8" name="GPU_TCS3_CMD_WAIT_FOR_CMPL_BANK"/>
+	<reg32 offset="0x15D9" name="GPU_TCS3_CMD0_MSGID"/>
+	<reg32 offset="0x15DA" name="GPU_TCS3_CMD0_ADDR"/>
+	<reg32 offset="0x15DB" name="GPU_TCS3_CMD0_DATA"/>
+</domain>
+
+<domain name="A6XX_PDC_GPU_SEQ" width="32">
+	<reg32 offset="0x0" name="MEM_0"/>
+</domain>
+
+<domain name="A6XX_CX_DBGC" width="32">
+	<reg32 offset="0x0000" name="CFG_DBGBUS_SEL_A">
+		<bitfield high="7" low="0" name="PING_INDEX"/>
+		<bitfield high="15" low="8" name="PING_BLK_SEL"/>
+	</reg32>
+	<reg32 offset="0x0001" name="CFG_DBGBUS_SEL_B"/>
+	<reg32 offset="0x0002" name="CFG_DBGBUS_SEL_C"/>
+	<reg32 offset="0x0003" name="CFG_DBGBUS_SEL_D"/>
+	<reg32 offset="0x0004" name="CFG_DBGBUS_CNTLT">
+		<bitfield high="5" low="0" name="TRACEEN"/>
+		<bitfield high="14" low="12" name="GRANU"/>
+		<bitfield high="31" low="28" name="SEGT"/>
+	</reg32>
+	<reg32 offset="0x0005" name="CFG_DBGBUS_CNTLM">
+		<bitfield high="27" low="24" name="ENABLE"/>
+	</reg32>
+	<reg32 offset="0x0008" name="CFG_DBGBUS_IVTL_0"/>
+	<reg32 offset="0x0009" name="CFG_DBGBUS_IVTL_1"/>
+	<reg32 offset="0x000a" name="CFG_DBGBUS_IVTL_2"/>
+	<reg32 offset="0x000b" name="CFG_DBGBUS_IVTL_3"/>
+	<reg32 offset="0x000c" name="CFG_DBGBUS_MASKL_0"/>
+	<reg32 offset="0x000d" name="CFG_DBGBUS_MASKL_1"/>
+	<reg32 offset="0x000e" name="CFG_DBGBUS_MASKL_2"/>
+	<reg32 offset="0x000f" name="CFG_DBGBUS_MASKL_3"/>
+	<reg32 offset="0x0010" name="CFG_DBGBUS_BYTEL_0">
+		<bitfield high="3" low="0" name="BYTEL0"/>
+		<bitfield high="7" low="4" name="BYTEL1"/>
+		<bitfield high="11" low="8" name="BYTEL2"/>
+		<bitfield high="15" low="12" name="BYTEL3"/>
+		<bitfield high="19" low="16" name="BYTEL4"/>
+		<bitfield high="23" low="20" name="BYTEL5"/>
+		<bitfield high="27" low="24" name="BYTEL6"/>
+		<bitfield high="31" low="28" name="BYTEL7"/>
+	</reg32>
+	<reg32 offset="0x0011" name="CFG_DBGBUS_BYTEL_1">
+		<bitfield high="3" low="0" name="BYTEL8"/>
+		<bitfield high="7" low="4" name="BYTEL9"/>
+		<bitfield high="11" low="8" name="BYTEL10"/>
+		<bitfield high="15" low="12" name="BYTEL11"/>
+		<bitfield high="19" low="16" name="BYTEL12"/>
+		<bitfield high="23" low="20" name="BYTEL13"/>
+		<bitfield high="27" low="24" name="BYTEL14"/>
+		<bitfield high="31" low="28" name="BYTEL15"/>
+	</reg32>
+
+	<reg32 offset="0x002f" name="CFG_DBGBUS_TRACE_BUF1"/>
+	<reg32 offset="0x0030" name="CFG_DBGBUS_TRACE_BUF2"/>
+</domain>
+
+<domain name="A6XX_CX_MISC" width="32" prefix="variant" varset="chip">
+	<reg32 offset="0x0001" name="SYSTEM_CACHE_CNTL_0"/>
+	<reg32 offset="0x0002" name="SYSTEM_CACHE_CNTL_1"/>
+	<reg32 offset="0x0039" name="CX_MISC_TCM_RET_CNTL" variants="A7XX-"/>
+	<reg32 offset="0x0400" name="CX_MISC_SW_FUSE_VALUE" variants="A7XX-">
+		<bitfield pos="0" name="FASTBLEND" type="boolean"/>
+		<bitfield pos="1" name="LPAC" type="boolean"/>
+		<bitfield pos="2" name="RAYTRACING" type="boolean"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/adreno/a6xx_gmu.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/adreno/a6xx_gmu.xml
@@ -0,0 +1,228 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+
+<domain name="A6XX" width="32" prefix="variant" varset="chip">
+
+	<bitset name="A6XX_GMU_GPU_IDLE_STATUS">
+		<bitfield name="BUSY_IGN_AHB" pos="23"/>
+		<bitfield name="CX_GX_CPU_BUSY_IGN_AHB" pos="30"/>
+	</bitset>
+
+	<bitset name="A6XX_GMU_OOB">
+		<bitfield name="BOOT_SLUMBER_SET_MASK" pos="22"/>
+		<bitfield name="BOOT_SLUMBER_CHECK_MASK" pos="30"/>
+		<bitfield name="BOOT_SLUMBER_CLEAR_MASK" pos="30"/>
+		<bitfield name="DCVS_SET_MASK" pos="23"/>
+		<bitfield name="DCVS_CHECK_MASK" pos="31"/>
+		<bitfield name="DCVS_CLEAR_MASK" pos="31"/>
+		<bitfield name="GPU_SET_MASK" pos="18"/>
+		<bitfield name="GPU_CHECK_MASK" pos="26"/>
+		<bitfield name="GPU_CLEAR_MASK" pos="26"/>
+		<bitfield name="PERFCNTR_SET_MASK" pos="17"/>
+		<bitfield name="PERFCNTR_CHECK_MASK" pos="25"/>
+		<bitfield name="PERFCNTR_CLEAR_MASK" pos="25"/>
+	</bitset>
+
+	<bitset name="A6XX_HFI_IRQ">
+		<bitfield name="MSGQ_MASK" pos="0" />
+		<bitfield name="DSGQ_MASK" pos="1"/>
+		<bitfield name="BLOCKED_MSG_MASK" pos="2"/>
+		<bitfield name="CM3_FAULT_MASK" pos="23"/>
+		<bitfield name="GMU_ERR_MASK" low="16" high="22"/>
+		<bitfield name="OOB_MASK" low="24" high="31"/>
+	</bitset>
+
+	<bitset name="A6XX_HFI_H2F">
+		<bitfield name="IRQ_MASK_BIT" pos="0" />
+	</bitset>
+
+	<reg32 offset="0x80" name="GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL"/>
+	<reg32 offset="0x81" name="GMU_GX_SPTPRAC_POWER_CONTROL"/>
+	<reg32 offset="0xc00" name="GMU_CM3_ITCM_START"/>
+	<reg32 offset="0x1c00" name="GMU_CM3_DTCM_START"/>
+	<reg32 offset="0x23f0" name="GMU_NMI_CONTROL_STATUS"/>
+	<reg32 offset="0x23f8" name="GMU_BOOT_SLUMBER_OPTION"/>
+	<reg32 offset="0x23f9" name="GMU_GX_VOTE_IDX"/>
+	<reg32 offset="0x23fa" name="GMU_MX_VOTE_IDX"/>
+	<reg32 offset="0x23fc" name="GMU_DCVS_ACK_OPTION"/>
+	<reg32 offset="0x23fd" name="GMU_DCVS_PERF_SETTING"/>
+	<reg32 offset="0x23fe" name="GMU_DCVS_BW_SETTING"/>
+	<reg32 offset="0x23ff" name="GMU_DCVS_RETURN"/>
+	<reg32 offset="0x4c00" name="GMU_ICACHE_CONFIG"/>
+	<reg32 offset="0x4c01" name="GMU_DCACHE_CONFIG"/>
+	<reg32 offset="0x4c0f" name="GMU_SYS_BUS_CONFIG"/>
+	<reg32 offset="0x5000" name="GMU_CM3_SYSRESET"/>
+	<reg32 offset="0x5001" name="GMU_CM3_BOOT_CONFIG"/>
+	<reg32 offset="0x501a" name="GMU_CM3_FW_BUSY"/>
+	<reg32 offset="0x501c" name="GMU_CM3_FW_INIT_RESULT"/>
+	<reg32 offset="0x502d" name="GMU_CM3_CFG"/>
+	<reg32 offset="0x5040" name="GMU_CX_GMU_POWER_COUNTER_ENABLE"/>
+	<reg32 offset="0x5041" name="GMU_CX_GMU_POWER_COUNTER_SELECT_0"/>
+	<reg32 offset="0x5042" name="GMU_CX_GMU_POWER_COUNTER_SELECT_1"/>
+	<reg32 offset="0x5044" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L"/>
+	<reg32 offset="0x5045" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_0_H"/>
+	<reg32 offset="0x5046" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_1_L"/>
+	<reg32 offset="0x5047" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_1_H"/>
+	<reg32 offset="0x5048" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_2_L"/>
+	<reg32 offset="0x5049" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_2_H"/>
+	<reg32 offset="0x504a" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_3_L"/>
+	<reg32 offset="0x504b" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_3_H"/>
+	<reg32 offset="0x504c" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_4_L"/>
+	<reg32 offset="0x504d" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_4_H"/>
+	<reg32 offset="0x504e" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_5_L"/>
+	<reg32 offset="0x504f" name="GMU_CX_GMU_POWER_COUNTER_XOCLK_5_H"/>
+	<reg32 offset="0x50c0" name="GMU_PWR_COL_INTER_FRAME_CTRL">
+		<bitfield name="IFPC_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="HM_POWER_COLLAPSE_ENABLE" pos="1" type="boolean"/>
+		<bitfield name="SPTPRAC_POWER_CONTROL_ENABLE" pos="2" type="boolean"/>
+		<bitfield name="NUM_PASS_SKIPS" low="10" high="13"/>
+		<bitfield name="MIN_PASS_LENGTH" low="14" high="31"/>
+	</reg32>
+	<reg32 offset="0x50c1" name="GMU_PWR_COL_INTER_FRAME_HYST"/>
+	<reg32 offset="0x50c2" name="GMU_PWR_COL_SPTPRAC_HYST"/>
+	<reg32 offset="0x50d0" name="GMU_SPTPRAC_PWR_CLK_STATUS">
+		<bitfield name="SPTPRAC_GDSC_POWERING_OFF" pos="0" type="boolean"/>
+		<bitfield name="SPTPRAC_GDSC_POWERING_ON" pos="1" type="boolean"/>
+		<bitfield name="SPTPRAC_GDSC_POWER_OFF" pos="2" type="boolean"/>
+		<bitfield name="SPTPRAC_GDSC_POWER_ON" pos="3" type="boolean"/>
+		<bitfield name="SP_CLOCK_OFF" pos="4" type="boolean"/>
+		<bitfield name="GMU_UP_POWER_STATE" pos="5" type="boolean"/>
+		<bitfield name="GX_HM_GDSC_POWER_OFF" pos="6" type="boolean"/>
+		<bitfield name="GX_HM_CLK_OFF" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x50e4" name="GMU_GPU_NAP_CTRL">
+		<bitfield name="HW_NAP_ENABLE" pos="0"/>
+		<bitfield name="SID" low="4" high="8"/>
+	</reg32>
+	<reg32 offset="0x50e8" name="GMU_RPMH_CTRL">
+		<bitfield name="RPMH_INTERFACE_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="LLC_VOTE_ENABLE" pos="4" type="boolean"/>
+		<bitfield name="DDR_VOTE_ENABLE" pos="8" type="boolean"/>
+		<bitfield name="MX_VOTE_ENABLE" pos="9" type="boolean"/>
+		<bitfield name="CX_VOTE_ENABLE" pos="10" type="boolean"/>
+		<bitfield name="GFX_VOTE_ENABLE" pos="11" type="boolean"/>
+		<bitfield name="DDR_MIN_VOTE_ENABLE" pos="12" type="boolean"/>
+		<bitfield name="MX_MIN_VOTE_ENABLE" pos="13" type="boolean"/>
+		<bitfield name="CX_MIN_VOTE_ENABLE" pos="14" type="boolean"/>
+		<bitfield name="GFX_MIN_VOTE_ENABLE" pos="15" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x50e9" name="GMU_RPMH_HYST_CTRL"/>
+	<reg32 offset="0x50ec" name="GPU_GMU_CX_GMU_RPMH_POWER_STATE"/>
+	<reg32 offset="0x50f0" name="GPU_GMU_CX_GMU_CX_FAL_INTF"/>
+	<reg32 offset="0x50f1" name="GPU_GMU_CX_GMU_CX_FALNEXT_INTF"/>
+	<reg32 offset="0x5100" name="GPU_GMU_CX_GMU_PWR_COL_CP_MSG"/>
+	<reg32 offset="0x5101" name="GPU_GMU_CX_GMU_PWR_COL_CP_RESP"/>
+	<reg32 offset="0x51f0" name="GMU_BOOT_KMD_LM_HANDSHAKE"/>
+	<reg32 offset="0x5157" name="GMU_LLM_GLM_SLEEP_CTRL"/>
+	<reg32 offset="0x5158" name="GMU_LLM_GLM_SLEEP_STATUS"/>
+	<reg32 offset="0x5088" name="GMU_ALWAYS_ON_COUNTER_L"/>
+	<reg32 offset="0x5089" name="GMU_ALWAYS_ON_COUNTER_H"/>
+	<reg32 offset="0x50c3" name="GMU_GMU_PWR_COL_KEEPALIVE"/>
+	<reg32 offset="0x5180" name="GMU_HFI_CTRL_STATUS"/>
+	<reg32 offset="0x5181" name="GMU_HFI_VERSION_INFO"/>
+	<reg32 offset="0x5182" name="GMU_HFI_SFR_ADDR"/>
+	<reg32 offset="0x5183" name="GMU_HFI_MMAP_ADDR"/>
+	<reg32 offset="0x5184" name="GMU_HFI_QTBL_INFO"/>
+	<reg32 offset="0x5185" name="GMU_HFI_QTBL_ADDR"/>
+	<reg32 offset="0x5186" name="GMU_HFI_CTRL_INIT"/>
+	<reg32 offset="0x5190" name="GMU_GMU2HOST_INTR_SET"/>
+	<reg32 offset="0x5191" name="GMU_GMU2HOST_INTR_CLR"/>
+	<reg32 offset="0x5192" name="GMU_GMU2HOST_INTR_INFO">
+		<bitfield name="MSGQ" pos="0" type="boolean"/>
+		<bitfield name="CM3_FAULT" pos="23" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x5193" name="GMU_GMU2HOST_INTR_MASK"/>
+	<reg32 offset="0x5194" name="GMU_HOST2GMU_INTR_SET"/>
+	<reg32 offset="0x5195" name="GMU_HOST2GMU_INTR_CLR"/>
+	<reg32 offset="0x5196" name="GMU_HOST2GMU_INTR_RAW_INFO"/>
+	<reg32 offset="0x5197" name="GMU_HOST2GMU_INTR_EN_0"/>
+	<reg32 offset="0x5198" name="GMU_HOST2GMU_INTR_EN_1"/>
+	<reg32 offset="0x5199" name="GMU_HOST2GMU_INTR_EN_2"/>
+	<reg32 offset="0x519a" name="GMU_HOST2GMU_INTR_EN_3"/>
+	<reg32 offset="0x519b" name="GMU_HOST2GMU_INTR_INFO_0"/>
+	<reg32 offset="0x519c" name="GMU_HOST2GMU_INTR_INFO_1"/>
+	<reg32 offset="0x519d" name="GMU_HOST2GMU_INTR_INFO_2"/>
+	<reg32 offset="0x519e" name="GMU_HOST2GMU_INTR_INFO_3"/>
+	<reg32 offset="0x51c5" name="GMU_GENERAL_0"/>
+	<reg32 offset="0x51c6" name="GMU_GENERAL_1"/>
+	<reg32 offset="0x51cb" name="GMU_GENERAL_6"/>
+	<reg32 offset="0x51cc" name="GMU_GENERAL_7"/>
+	<reg32 offset="0x51cd" name="GMU_GENERAL_8" variants="A7XX"/>
+	<reg32 offset="0x51ce" name="GMU_GENERAL_9" variants="A7XX"/>
+	<reg32 offset="0x51cf" name="GMU_GENERAL_10" variants="A7XX"/>
+	<reg32 offset="0x515d" name="GMU_ISENSE_CTRL"/>
+	<reg32 offset="0x8920" name="GPU_CS_ENABLE_REG"/>
+	<reg32 offset="0x515d" name="GPU_GMU_CX_GMU_ISENSE_CTRL"/>
+	<reg32 offset="0x8578" name="GPU_CS_AMP_CALIBRATION_CONTROL3"/>
+	<reg32 offset="0x8558" name="GPU_CS_AMP_CALIBRATION_CONTROL2"/>
+	<reg32 offset="0x8580" name="GPU_CS_A_SENSOR_CTRL_0"/>
+	<reg32 offset="0x27ada" name="GPU_CS_A_SENSOR_CTRL_2"/>
+	<reg32 offset="0x881a" name="GPU_CS_SENSOR_GENERAL_STATUS"/>
+	<reg32 offset="0x8957" name="GPU_CS_AMP_CALIBRATION_CONTROL1"/>
+	<reg32 offset="0x881a" name="GPU_CS_SENSOR_GENERAL_STATUS"/>
+	<reg32 offset="0x881d" name="GPU_CS_AMP_CALIBRATION_STATUS1_0"/>
+	<reg32 offset="0x881f" name="GPU_CS_AMP_CALIBRATION_STATUS1_2"/>
+	<reg32 offset="0x8821" name="GPU_CS_AMP_CALIBRATION_STATUS1_4"/>
+	<reg32 offset="0x8965" name="GPU_CS_AMP_CALIBRATION_DONE"/>
+	<reg32 offset="0x896d" name="GPU_CS_AMP_PERIOD_CTRL"/>
+	<reg32 offset="0x8965" name="GPU_CS_AMP_CALIBRATION_DONE"/>
+	<reg32 offset="0x514d" name="GPU_GMU_CX_GMU_PWR_THRESHOLD"/>
+	<reg32 offset="0x9303" name="GMU_AO_INTERRUPT_EN"/>
+	<reg32 offset="0x9304" name="GMU_AO_HOST_INTERRUPT_CLR"/>
+	<reg32 offset="0x9305" name="GMU_AO_HOST_INTERRUPT_STATUS">
+		<bitfield name="WDOG_BITE" pos="0" type="boolean"/>
+		<bitfield name="RSCC_COMP" pos="1" type="boolean"/>
+		<bitfield name="VDROOP" pos="2" type="boolean"/>
+		<bitfield name="FENCE_ERR" pos="3" type="boolean"/>
+		<bitfield name="DBD_WAKEUP" pos="4" type="boolean"/>
+		<bitfield name="HOST_AHB_BUS_ERROR" pos="5" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x9306" name="GMU_AO_HOST_INTERRUPT_MASK"/>
+	<reg32 offset="0x9309" name="GPU_GMU_AO_GMU_CGC_MODE_CNTL"/>
+	<reg32 offset="0x930a" name="GPU_GMU_AO_GMU_CGC_DELAY_CNTL"/>
+	<reg32 offset="0x930b" name="GPU_GMU_AO_GMU_CGC_HYST_CNTL"/>
+	<reg32 offset="0x930c" name="GPU_GMU_AO_GPU_CX_BUSY_STATUS">
+		<bitfield name = "GPUBUSYIGNAHB" pos="23" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x930d" name="GPU_GMU_AO_GPU_CX_BUSY_STATUS2"/>
+	<reg32 offset="0x930e" name="GPU_GMU_AO_GPU_CX_BUSY_MASK"/>
+	<reg32 offset="0x9310" name="GMU_AO_AHB_FENCE_CTRL"/>
+	<reg32 offset="0x9313" name="GMU_AHB_FENCE_STATUS"/>
+	<reg32 offset="0x9314" name="GMU_AHB_FENCE_STATUS_CLR"/>
+	<reg32 offset="0x9315" name="GMU_RBBM_INT_UNMASKED_STATUS"/>
+	<reg32 offset="0x9316" name="GMU_AO_SPARE_CNTL"/>
+	<reg32 offset="0x9307" name="GMU_RSCC_CONTROL_REQ"/>
+	<reg32 offset="0x9308" name="GMU_RSCC_CONTROL_ACK"/>
+	<reg32 offset="0x9311" name="GMU_AHB_FENCE_RANGE_0"/>
+	<reg32 offset="0x9312" name="GMU_AHB_FENCE_RANGE_1"/>
+	<reg32 offset="0x9c03" name="GPU_CC_GX_GDSCR"/>
+	<reg32 offset="0x9d42" name="GPU_CC_GX_DOMAIN_MISC"/>
+	<reg32 offset="0xc001" name="GPU_CPR_FSM_CTL"/>
+
+	<!-- starts at offset 0x8c00 on most gpus -->
+	<reg32 offset="0x0004" name="GPU_RSCC_RSC_STATUS0_DRV0"/>
+	<reg32 offset="0x0008" name="RSCC_PDC_SEQ_START_ADDR"/>
+	<reg32 offset="0x0009" name="RSCC_PDC_MATCH_VALUE_LO"/>
+	<reg32 offset="0x000a" name="RSCC_PDC_MATCH_VALUE_HI"/>
+	<reg32 offset="0x000b" name="RSCC_PDC_SLAVE_ID_DRV0"/>
+	<reg32 offset="0x000d" name="RSCC_HIDDEN_TCS_CMD0_ADDR"/>
+	<reg32 offset="0x000e" name="RSCC_HIDDEN_TCS_CMD0_DATA"/>
+	<reg32 offset="0x0082" name="RSCC_TIMESTAMP_UNIT0_TIMESTAMP_L_DRV0"/>
+	<reg32 offset="0x0083" name="RSCC_TIMESTAMP_UNIT0_TIMESTAMP_H_DRV0"/>
+	<reg32 offset="0x0089" name="RSCC_TIMESTAMP_UNIT1_EN_DRV0"/>
+	<reg32 offset="0x008c" name="RSCC_TIMESTAMP_UNIT1_OUTPUT_DRV0"/>
+	<reg32 offset="0x0100" name="RSCC_OVERRIDE_START_ADDR"/>
+	<reg32 offset="0x0101" name="RSCC_SEQ_BUSY_DRV0"/>
+	<reg32 offset="0x0154" name="RSCC_SEQ_MEM_0_DRV0_A740" variants="A7XX"/>
+	<reg32 offset="0x0180" name="RSCC_SEQ_MEM_0_DRV0"/>
+	<reg32 offset="0x0346" name="RSCC_TCS0_DRV0_STATUS"/>
+	<reg32 offset="0x03ee" name="RSCC_TCS1_DRV0_STATUS"/>
+	<reg32 offset="0x0496" name="RSCC_TCS2_DRV0_STATUS"/>
+	<reg32 offset="0x053e" name="RSCC_TCS3_DRV0_STATUS"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/adreno/adreno_common.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/adreno/adreno_common.xml
@@ -0,0 +1,400 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<enum name="chip" bare="yes">
+	<value name="A2XX" value="2"/>
+	<value name="A3XX" value="3"/>
+	<value name="A4XX" value="4"/>
+	<value name="A5XX" value="5"/>
+	<value name="A6XX" value="6"/>
+	<value name="A7XX" value="7"/>
+</enum>
+
+<enum name="adreno_pa_su_sc_draw">
+	<value name="PC_DRAW_POINTS" value="0"/>
+	<value name="PC_DRAW_LINES" value="1"/>
+	<value name="PC_DRAW_TRIANGLES" value="2"/>
+</enum>
+
+<enum name="adreno_compare_func">
+	<value name="FUNC_NEVER" value="0"/>
+	<value name="FUNC_LESS" value="1"/>
+	<value name="FUNC_EQUAL" value="2"/>
+	<value name="FUNC_LEQUAL" value="3"/>
+	<value name="FUNC_GREATER" value="4"/>
+	<value name="FUNC_NOTEQUAL" value="5"/>
+	<value name="FUNC_GEQUAL" value="6"/>
+	<value name="FUNC_ALWAYS" value="7"/>
+</enum>
+
+<enum name="adreno_stencil_op">
+	<value name="STENCIL_KEEP" value="0"/>
+	<value name="STENCIL_ZERO" value="1"/>
+	<value name="STENCIL_REPLACE" value="2"/>
+	<value name="STENCIL_INCR_CLAMP" value="3"/>
+	<value name="STENCIL_DECR_CLAMP" value="4"/>
+	<value name="STENCIL_INVERT" value="5"/>
+	<value name="STENCIL_INCR_WRAP" value="6"/>
+	<value name="STENCIL_DECR_WRAP" value="7"/>
+</enum>
+
+<enum name="adreno_rb_blend_factor">
+	<value name="FACTOR_ZERO" value="0"/>
+	<value name="FACTOR_ONE" value="1"/>
+	<value name="FACTOR_SRC_COLOR" value="4"/>
+	<value name="FACTOR_ONE_MINUS_SRC_COLOR" value="5"/>
+	<value name="FACTOR_SRC_ALPHA" value="6"/>
+	<value name="FACTOR_ONE_MINUS_SRC_ALPHA" value="7"/>
+	<value name="FACTOR_DST_COLOR" value="8"/>
+	<value name="FACTOR_ONE_MINUS_DST_COLOR" value="9"/>
+	<value name="FACTOR_DST_ALPHA" value="10"/>
+	<value name="FACTOR_ONE_MINUS_DST_ALPHA" value="11"/>
+	<value name="FACTOR_CONSTANT_COLOR" value="12"/>
+	<value name="FACTOR_ONE_MINUS_CONSTANT_COLOR" value="13"/>
+	<value name="FACTOR_CONSTANT_ALPHA" value="14"/>
+	<value name="FACTOR_ONE_MINUS_CONSTANT_ALPHA" value="15"/>
+	<value name="FACTOR_SRC_ALPHA_SATURATE" value="16"/>
+	<value name="FACTOR_SRC1_COLOR" value="20"/>
+	<value name="FACTOR_ONE_MINUS_SRC1_COLOR" value="21"/>
+	<value name="FACTOR_SRC1_ALPHA" value="22"/>
+	<value name="FACTOR_ONE_MINUS_SRC1_ALPHA" value="23"/>
+</enum>
+
+<bitset name="adreno_rb_stencilrefmask" inline="yes">
+	<bitfield name="STENCILREF" low="0" high="7" type="hex"/>
+	<bitfield name="STENCILMASK" low="8" high="15" type="hex"/>
+	<bitfield name="STENCILWRITEMASK" low="16" high="23" type="hex"/>
+</bitset>
+
+<enum name="adreno_rb_surface_endian">
+	<value name="ENDIAN_NONE" value="0"/>
+	<value name="ENDIAN_8IN16" value="1"/>
+	<value name="ENDIAN_8IN32" value="2"/>
+	<value name="ENDIAN_16IN32" value="3"/>
+	<value name="ENDIAN_8IN64" value="4"/>
+	<value name="ENDIAN_8IN128" value="5"/>
+</enum>
+
+<enum name="adreno_rb_dither_mode">
+	<value name="DITHER_DISABLE" value="0"/>
+	<value name="DITHER_ALWAYS" value="1"/>
+	<value name="DITHER_IF_ALPHA_OFF" value="2"/>
+</enum>
+
+<enum name="adreno_rb_depth_format">
+	<value name="DEPTHX_16" value="0"/>
+	<value name="DEPTHX_24_8" value="1"/>
+	<value name="DEPTHX_32" value="2"/>
+</enum>
+
+<enum name="adreno_rb_copy_control_mode">
+	<value name="RB_COPY_RESOLVE" value="1"/>
+	<value name="RB_COPY_CLEAR" value="2"/>
+	<value name="RB_COPY_DEPTH_STENCIL" value="5"/>  <!-- not sure if this is part of MODE or another bitfield?? -->
+</enum>
+
+<bitset name="adreno_reg_xy" inline="yes">
+	<bitfield name="WINDOW_OFFSET_DISABLE" pos="31" type="boolean"/>
+	<bitfield name="X" low="0" high="14" type="uint"/>
+	<bitfield name="Y" low="16" high="30" type="uint"/>
+</bitset>
+
+<bitset name="adreno_cp_protect" inline="yes">
+	<bitfield name="BASE_ADDR" low="0" high="16"/>
+	<bitfield name="MASK_LEN" low="24" high="28"/>
+	<bitfield name="TRAP_WRITE" pos="29"/>
+	<bitfield name="TRAP_READ" pos="30"/>
+</bitset>
+
+<domain name="AXXX" width="32">
+	<brief>Registers in common between a2xx and a3xx</brief>
+
+	<reg32 offset="0x01c0" name="CP_RB_BASE"/>
+	<reg32 offset="0x01c1" name="CP_RB_CNTL">
+		<bitfield name="BUFSZ" low="0" high="5"/>
+		<bitfield name="BLKSZ" low="8" high="13"/>
+		<bitfield name="BUF_SWAP" low="16" high="17"/>
+		<bitfield name="POLL_EN" pos="20" type="boolean"/>
+		<bitfield name="NO_UPDATE" pos="27" type="boolean"/>
+		<bitfield name="RPTR_WR_EN" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01c3" name="CP_RB_RPTR_ADDR">
+		<bitfield name="SWAP" low="0" high="1" type="uint"/>
+		<bitfield name="ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="0x01c4" name="CP_RB_RPTR" type="uint"/>
+	<reg32 offset="0x01c5" name="CP_RB_WPTR" type="uint"/>
+	<reg32 offset="0x01c6" name="CP_RB_WPTR_DELAY"/>
+	<reg32 offset="0x01c7" name="CP_RB_RPTR_WR"/>
+	<reg32 offset="0x01c8" name="CP_RB_WPTR_BASE"/>
+	<reg32 offset="0x01d5" name="CP_QUEUE_THRESHOLDS">
+		<bitfield name="CSQ_IB1_START" low="0" high="3" type="uint"/>
+		<bitfield name="CSQ_IB2_START" low="8" high="11" type="uint"/>
+		<bitfield name="CSQ_ST_START" low="16" high="19" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01d6" name="CP_MEQ_THRESHOLDS">
+		<bitfield name="MEQ_END" low="16" high="20" type="uint"/>
+		<bitfield name="ROQ_END" low="24" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01d7" name="CP_CSQ_AVAIL">
+		<bitfield name="RING" low="0" high="6" type="uint"/>
+		<bitfield name="IB1" low="8" high="14" type="uint"/>
+		<bitfield name="IB2" low="16" high="22" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01d8" name="CP_STQ_AVAIL">
+		<bitfield name="ST" low="0" high="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01d9" name="CP_MEQ_AVAIL">
+		<bitfield name="MEQ" low="0" high="4" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01dc" name="SCRATCH_UMSK">
+		<bitfield name="UMSK" low="0" high="7" type="uint"/>
+		<bitfield name="SWAP" low="16" high="17" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01dd" name="SCRATCH_ADDR"/>
+	<reg32 offset="0x01ea" name="CP_ME_RDADDR"/>
+
+	<reg32 offset="0x01ec" name="CP_STATE_DEBUG_INDEX"/>
+	<reg32 offset="0x01ed" name="CP_STATE_DEBUG_DATA"/>
+	<reg32 offset="0x01f2" name="CP_INT_CNTL">
+		<bitfield name="SW_INT_MASK" pos="19" type="boolean"/>
+		<bitfield name="T0_PACKET_IN_IB_MASK" pos="23" type="boolean"/>
+		<bitfield name="OPCODE_ERROR_MASK" pos="24" type="boolean"/>
+		<bitfield name="PROTECTED_MODE_ERROR_MASK" pos="25" type="boolean"/>
+		<bitfield name="RESERVED_BIT_ERROR_MASK" pos="26" type="boolean"/>
+		<bitfield name="IB_ERROR_MASK" pos="27" type="boolean"/>
+		<bitfield name="IB2_INT_MASK" pos="29" type="boolean"/>
+		<bitfield name="IB1_INT_MASK" pos="30" type="boolean"/>
+		<bitfield name="RB_INT_MASK" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01f3" name="CP_INT_STATUS"/>
+	<reg32 offset="0x01f4" name="CP_INT_ACK"/>
+	<reg32 offset="0x01f6" name="CP_ME_CNTL">
+		<bitfield name="BUSY" pos="29" type="boolean"/>
+		<bitfield name="HALT" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01f7" name="CP_ME_STATUS"/>
+	<reg32 offset="0x01f8" name="CP_ME_RAM_WADDR"/>
+	<reg32 offset="0x01f9" name="CP_ME_RAM_RADDR"/>
+	<reg32 offset="0x01fa" name="CP_ME_RAM_DATA"/>
+	<reg32 offset="0x01fc" name="CP_DEBUG">
+		<bitfield name="PREDICATE_DISABLE" pos="23" type="boolean"/>
+		<bitfield name="PROG_END_PTR_ENABLE" pos="24" type="boolean"/>
+		<bitfield name="MIU_128BIT_WRITE_ENABLE" pos="25" type="boolean"/>
+		<bitfield name="PREFETCH_PASS_NOPS" pos="26" type="boolean"/>
+		<bitfield name="DYNAMIC_CLK_DISABLE" pos="27" type="boolean"/>
+		<bitfield name="PREFETCH_MATCH_DISABLE" pos="28" type="boolean"/>
+		<bitfield name="SIMPLE_ME_FLOW_CONTROL" pos="30" type="boolean"/>
+		<bitfield name="MIU_WRITE_PACK_DISABLE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x01fd" name="CP_CSQ_RB_STAT">
+		<bitfield name="RPTR" low="0" high="6" type="uint"/>
+		<bitfield name="WPTR" low="16" high="22" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01fe" name="CP_CSQ_IB1_STAT">
+		<bitfield name="RPTR" low="0" high="6" type="uint"/>
+		<bitfield name="WPTR" low="16" high="22" type="uint"/>
+	</reg32>
+	<reg32 offset="0x01ff" name="CP_CSQ_IB2_STAT">
+		<bitfield name="RPTR" low="0" high="6" type="uint"/>
+		<bitfield name="WPTR" low="16" high="22" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0440" name="CP_NON_PREFETCH_CNTRS"/>
+	<reg32 offset="0x0443" name="CP_STQ_ST_STAT"/>
+	<reg32 offset="0x044d" name="CP_ST_BASE"/>
+	<reg32 offset="0x044e" name="CP_ST_BUFSZ"/>
+	<reg32 offset="0x044f" name="CP_MEQ_STAT"/>
+	<reg32 offset="0x0452" name="CP_MIU_TAG_STAT"/>
+	<reg32 offset="0x0454" name="CP_BIN_MASK_LO"/>
+	<reg32 offset="0x0455" name="CP_BIN_MASK_HI"/>
+	<reg32 offset="0x0456" name="CP_BIN_SELECT_LO"/>
+	<reg32 offset="0x0457" name="CP_BIN_SELECT_HI"/>
+	<reg32 offset="0x0458" name="CP_IB1_BASE"/>
+	<reg32 offset="0x0459" name="CP_IB1_BUFSZ"/>
+	<reg32 offset="0x045a" name="CP_IB2_BASE"/>
+	<reg32 offset="0x045b" name="CP_IB2_BUFSZ"/>
+	<reg32 offset="0x047f" name="CP_STAT">
+		<bitfield pos="31" name="CP_BUSY"/>
+		<bitfield pos="30" name="VS_EVENT_FIFO_BUSY"/>
+		<bitfield pos="29" name="PS_EVENT_FIFO_BUSY"/>
+		<bitfield pos="28" name="CF_EVENT_FIFO_BUSY"/>
+		<bitfield pos="27" name="RB_EVENT_FIFO_BUSY"/>
+		<bitfield pos="26" name="ME_BUSY"/>
+		<bitfield pos="25" name="MIU_WR_C_BUSY"/>
+		<bitfield pos="23" name="CP_3D_BUSY"/>
+		<bitfield pos="22" name="CP_NRT_BUSY"/>
+		<bitfield pos="21" name="RBIU_SCRATCH_BUSY"/>
+		<bitfield pos="20" name="RCIU_ME_BUSY"/>
+		<bitfield pos="19" name="RCIU_PFP_BUSY"/>
+		<bitfield pos="18" name="MEQ_RING_BUSY"/>
+		<bitfield pos="17" name="PFP_BUSY"/>
+		<bitfield pos="16" name="ST_QUEUE_BUSY"/>
+		<bitfield pos="13" name="INDIRECT2_QUEUE_BUSY"/>
+		<bitfield pos="12" name="INDIRECTS_QUEUE_BUSY"/>
+		<bitfield pos="11" name="RING_QUEUE_BUSY"/>
+		<bitfield pos="10" name="CSF_BUSY"/>
+		<bitfield pos="9"  name="CSF_ST_BUSY"/>
+		<bitfield pos="8"  name="EVENT_BUSY"/>
+		<bitfield pos="7"  name="CSF_INDIRECT2_BUSY"/>
+		<bitfield pos="6"  name="CSF_INDIRECTS_BUSY"/>
+		<bitfield pos="5"  name="CSF_RING_BUSY"/>
+		<bitfield pos="4"  name="RCIU_BUSY"/>
+		<bitfield pos="3"  name="RBIU_BUSY"/>
+		<bitfield pos="2"  name="MIU_RD_RETURN_BUSY"/>
+		<bitfield pos="1"  name="MIU_RD_REQ_BUSY"/>
+		<bitfield pos="0"  name="MIU_WR_BUSY"/>
+	</reg32>
+	<reg32 offset="0x0578" name="CP_SCRATCH_REG0" type="uint"/>
+	<reg32 offset="0x0579" name="CP_SCRATCH_REG1" type="uint"/>
+	<reg32 offset="0x057a" name="CP_SCRATCH_REG2" type="uint"/>
+	<reg32 offset="0x057b" name="CP_SCRATCH_REG3" type="uint"/>
+	<reg32 offset="0x057c" name="CP_SCRATCH_REG4" type="uint"/>
+	<reg32 offset="0x057d" name="CP_SCRATCH_REG5" type="uint"/>
+	<reg32 offset="0x057e" name="CP_SCRATCH_REG6" type="uint"/>
+	<reg32 offset="0x057f" name="CP_SCRATCH_REG7" type="uint"/>
+
+	<reg32 offset="0x0600" name="CP_ME_VS_EVENT_SRC"/>
+	<reg32 offset="0x0601" name="CP_ME_VS_EVENT_ADDR"/>
+	<reg32 offset="0x0602" name="CP_ME_VS_EVENT_DATA"/>
+	<reg32 offset="0x0603" name="CP_ME_VS_EVENT_ADDR_SWM"/>
+	<reg32 offset="0x0604" name="CP_ME_VS_EVENT_DATA_SWM"/>
+	<reg32 offset="0x0605" name="CP_ME_PS_EVENT_SRC"/>
+	<reg32 offset="0x0606" name="CP_ME_PS_EVENT_ADDR"/>
+	<reg32 offset="0x0607" name="CP_ME_PS_EVENT_DATA"/>
+	<reg32 offset="0x0608" name="CP_ME_PS_EVENT_ADDR_SWM"/>
+	<reg32 offset="0x0609" name="CP_ME_PS_EVENT_DATA_SWM"/>
+	<reg32 offset="0x060a" name="CP_ME_CF_EVENT_SRC"/>
+	<reg32 offset="0x060b" name="CP_ME_CF_EVENT_ADDR"/>
+	<reg32 offset="0x060c" name="CP_ME_CF_EVENT_DATA" type="uint"/>
+	<reg32 offset="0x060d" name="CP_ME_NRT_ADDR"/>
+	<reg32 offset="0x060e" name="CP_ME_NRT_DATA"/>
+	<reg32 offset="0x0612" name="CP_ME_VS_FETCH_DONE_SRC"/>
+	<reg32 offset="0x0613" name="CP_ME_VS_FETCH_DONE_ADDR"/>
+	<reg32 offset="0x0614" name="CP_ME_VS_FETCH_DONE_DATA"/>
+
+</domain>
+
+<!--
+	Common between A3xx and A4xx:
+ -->
+
+<enum name="a3xx_rop_code">
+	<value name="ROP_CLEAR"         value="0"/>
+	<value name="ROP_NOR"           value="1"/>
+	<value name="ROP_AND_INVERTED"  value="2"/>
+	<value name="ROP_COPY_INVERTED" value="3"/>
+	<value name="ROP_AND_REVERSE"   value="4"/>
+	<value name="ROP_INVERT"        value="5"/>
+	<value name="ROP_XOR"           value="6"/>
+	<value name="ROP_NAND"          value="7"/>
+	<value name="ROP_AND"           value="8"/>
+	<value name="ROP_EQUIV"         value="9"/>
+	<value name="ROP_NOOP"          value="10"/>
+	<value name="ROP_OR_INVERTED"   value="11"/>
+	<value name="ROP_COPY"          value="12"/>
+	<value name="ROP_OR_REVERSE"    value="13"/>
+	<value name="ROP_OR"            value="14"/>
+	<value name="ROP_SET"           value="15"/>
+</enum>
+
+<enum name="a3xx_render_mode">
+	<value name="RB_RENDERING_PASS" value="0"/>
+	<value name="RB_TILING_PASS" value="1"/>
+	<value name="RB_RESOLVE_PASS" value="2"/>
+	<value name="RB_COMPUTE_PASS" value="3"/>
+</enum>
+
+<enum name="a3xx_msaa_samples">
+	<value name="MSAA_ONE" value="0"/>
+	<value name="MSAA_TWO" value="1"/>
+	<value name="MSAA_FOUR" value="2"/>
+	<value name="MSAA_EIGHT" value="3"/>
+</enum>
+
+<enum name="a3xx_threadmode">
+	<value value="0" name="MULTI"/>
+	<value value="1" name="SINGLE"/>
+</enum>
+
+<enum name="a3xx_instrbuffermode">
+	<!--
+	When shader size goes above ~128 or so, blob switches to '0'
+	and doesn't emit shader in cmdstream.  When either is '0' it
+	doesn't get emitted via CP_LOAD_STATE.  When only one is
+	'0' the other gets size 256-others_size.  So I think that:
+		BUFFER => execute out of state memory
+		CACHE  => use available state memory as local cache
+	NOTE that when CACHE mode, also set CACHEINVALID flag!
+
+	TODO check if that 256 size is same for all a3xx
+	 -->
+	<value value="0" name="CACHE"/>
+	<value value="1" name="BUFFER"/>
+</enum>
+
+<enum name="a3xx_threadsize">
+	<value value="0" name="TWO_QUADS"/>
+	<value value="1" name="FOUR_QUADS"/>
+</enum>
+
+<enum name="a3xx_color_swap">
+	<value name="WZYX" value="0"/>
+	<value name="WXYZ" value="1"/>
+	<value name="ZYXW" value="2"/>
+	<value name="XYZW" value="3"/>
+</enum>
+
+<enum name="a3xx_rb_blend_opcode">
+	<value name="BLEND_DST_PLUS_SRC" value="0"/>
+	<value name="BLEND_SRC_MINUS_DST" value="1"/>
+	<value name="BLEND_DST_MINUS_SRC" value="2"/>
+	<value name="BLEND_MIN_DST_SRC" value="3"/>
+	<value name="BLEND_MAX_DST_SRC" value="4"/>
+</enum>
+
+<enum name="a4xx_tess_spacing">
+	<value name="EQUAL_SPACING" value="0"/>
+	<value name="ODD_SPACING" value="2"/>
+	<value name="EVEN_SPACING" value="3"/>
+</enum>
+
+<doc>Address mode for a5xx+</doc>
+<enum name="a5xx_address_mode">
+	<value name="ADDR_32B" value="0"/>
+	<value name="ADDR_64B" value="1"/>
+</enum>
+
+<doc>
+    Line mode for a5xx+
+	Note that Bresenham lines are only supported with MSAA disabled.
+</doc>
+<enum name="a5xx_line_mode">
+	<value value="0x0"  name="BRESENHAM"/>
+	<value value="0x1"  name="RECTANGULAR"/>
+</enum>
+
+<doc>
+	Blob (v615) seem to only use SAM and I wasn't able to coerce
+	it to produce any other command.
+	Probably valid for a4xx+ but not enabled or tested on anything
+	but a6xx.
+</doc>
+<enum name="a6xx_tex_prefetch_cmd">
+	<doc> Produces garbage </doc>
+	<value value="0x0" name="TEX_PREFETCH_UNK0"/>
+	<value value="0x1" name="TEX_PREFETCH_SAM"/>
+	<value value="0x2" name="TEX_PREFETCH_GATHER4R"/>
+	<value value="0x3" name="TEX_PREFETCH_GATHER4G"/>
+	<value value="0x4" name="TEX_PREFETCH_GATHER4B"/>
+	<value value="0x5" name="TEX_PREFETCH_GATHER4A"/>
+	<doc> Causes reads from an invalid address </doc>
+	<value value="0x6" name="TEX_PREFETCH_UNK6"/>
+	<doc> Results in color being zero </doc>
+	<value value="0x7" name="TEX_PREFETCH_UNK7"/>
+</enum>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/adreno/adreno_pm4.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/adreno/adreno_pm4.xml
@@ -0,0 +1,2263 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="adreno/adreno_common.xml"/>
+
+<enum name="vgt_event_type" varset="chip">
+	<value name="VS_DEALLOC" value="0"/>
+	<value name="PS_DEALLOC" value="1" variants="A2XX-A6XX"/>
+	<value name="VS_DONE_TS" value="2"/>
+	<value name="PS_DONE_TS" value="3"/>
+	<doc>
+		Flushes dirty data from UCHE, and also writes a GPU timestamp to
+		the address if one is provided.
+	</doc>
+	<value name="CACHE_FLUSH_TS" value="4"/>
+	<value name="CONTEXT_DONE" value="5"/>
+	<value name="CACHE_FLUSH" value="6" variants="A2XX-A4XX"/>
+	<value name="VIZQUERY_START" value="7" variants="A2XX"/>
+	<value name="HLSQ_FLUSH" value="7" variants="A3XX-A4XX"/>
+	<value name="VIZQUERY_END" value="8" variants="A2XX"/>
+	<value name="SC_WAIT_WC" value="9" variants="A2XX"/>
+	<value name="WRITE_PRIMITIVE_COUNTS" value="9" variants="A6XX"/>
+	<value name="START_PRIMITIVE_CTRS" value="11" variants="A6XX"/>
+	<value name="STOP_PRIMITIVE_CTRS" value="12" variants="A6XX"/>
+	<!-- Not sure that these 4 events don't have the same meaning as on A5XX+ -->
+	<value name="RST_PIX_CNT" value="13" variants="A2XX-A4XX"/>
+	<value name="RST_VTX_CNT" value="14" variants="A2XX-A4XX"/>
+	<value name="TILE_FLUSH" value="15" variants="A2XX-A4XX"/>
+	<value name="STAT_EVENT" value="16" variants="A2XX-A4XX"/>
+	<value name="CACHE_FLUSH_AND_INV_TS_EVENT" value="20" variants="A2XX-A4XX"/>
+	<doc>
+		If A6XX_RB_SAMPLE_COUNT_CONTROL.copy is true, writes OQ Z passed
+		sample counts to RB_SAMPLE_COUNT_ADDR.  This writes to main
+		memory, skipping UCHE.
+	</doc>
+	<value name="ZPASS_DONE" value="21"/>
+	<value name="CACHE_FLUSH_AND_INV_EVENT" value="22" variants="A2XX"/>
+
+	<doc>
+		Writes the GPU timestamp to the address that follows, once RB
+		access and flushes are complete.
+	</doc>
+	<value name="RB_DONE_TS" value="22" variants="A3XX-"/>
+
+	<value name="PERFCOUNTER_START" value="23" variants="A2XX-A4XX"/>
+	<value name="PERFCOUNTER_STOP" value="24" variants="A2XX-A4XX"/>
+	<value name="VS_FETCH_DONE" value="27"/>
+	<value name="FACENESS_FLUSH" value="28" variants="A2XX-A4XX"/>
+
+	<!-- a5xx events -->
+	<value name="WT_DONE_TS" value="8" variants="A5XX-"/>
+	<value name="START_FRAGMENT_CTRS" value="13" variants="A5XX-"/>
+	<value name="STOP_FRAGMENT_CTRS" value="14" variants="A5XX-"/>
+	<value name="START_COMPUTE_CTRS" value="15" variants="A5XX-"/>
+	<value name="STOP_COMPUTE_CTRS" value="16" variants="A5XX-"/>
+	<value name="FLUSH_SO_0" value="17" variants="A5XX-"/>
+	<value name="FLUSH_SO_1" value="18" variants="A5XX-"/>
+	<value name="FLUSH_SO_2" value="19" variants="A5XX-"/>
+	<value name="FLUSH_SO_3" value="20" variants="A5XX-"/>
+
+	<doc>
+		Invalidates depth attachment data from the CCU.  We assume this
+		happens in the last stage.
+	</doc>
+	<value name="PC_CCU_INVALIDATE_DEPTH" value="24" variants="A5XX-"/>
+
+	<doc>
+		Invalidates color attachment data from the CCU.  We assume this
+		happens in the last stage.
+	</doc>
+	<value name="PC_CCU_INVALIDATE_COLOR" value="25" variants="A5XX-"/>
+
+	<doc>
+		Flushes the small cache used by CP_EVENT_WRITE::BLIT (which,
+		along with its registers, would be better named RESOLVE).
+	</doc>
+	<value name="PC_CCU_RESOLVE_TS" value="26" variants="A6XX"/>
+
+	<doc>
+		Flushes depth attachment data from the CCU.  We assume this
+		happens in the last stage.
+	</doc>
+	<value name="PC_CCU_FLUSH_DEPTH_TS" value="28" variants="A5XX-"/>
+
+	<doc>
+		Flushes color attachment data from the CCU.  We assume this
+		happens in the last stage.
+	</doc>
+	<value name="PC_CCU_FLUSH_COLOR_TS" value="29" variants="A5XX-"/>
+
+	<doc>
+		2D blit to resolve GMEM to system memory (skipping CCU) at the
+		end of a render pass.  Compare to CP_BLIT's BLIT_OP_SCALE for
+		more general blitting.
+	</doc>
+	<value name="BLIT" value="30" variants="A5XX-"/>
+
+	<doc>
+		Clears based on GRAS_LRZ_CNTL configuration, could clear
+		fast-clear buffer or LRZ direction.
+		LRZ direction is stored at lrz_fc_offset + 0x200, has 1 byte which
+		could be expressed by enum:
+			CUR_DIR_DISABLED = 0x0
+			CUR_DIR_GE = 0x1
+			CUR_DIR_LE = 0x2
+			CUR_DIR_UNSET = 0x3
+		Clear of direction means setting the direction to CUR_DIR_UNSET.
+	</doc>
+	<value name="LRZ_CLEAR" value="37" variants="A5XX-"/>
+
+	<value name="LRZ_FLUSH" value="38" variants="A5XX-"/>
+	<value name="BLIT_OP_FILL_2D" value="39" variants="A5XX-"/>
+	<value name="BLIT_OP_COPY_2D" value="40" variants="A5XX-A6XX"/>
+	<value name="UNK_40" value="40" variants="A7XX"/>
+	<value name="BLIT_OP_SCALE_2D" value="42" variants="A5XX-"/>
+	<value name="CONTEXT_DONE_2D" value="43" variants="A5XX-"/>
+	<value name="UNK_2C" value="44" variants="A5XX-"/>
+	<value name="UNK_2D" value="45" variants="A5XX-"/>
+
+	<!-- a6xx events -->
+	<doc>
+		Invalidates UCHE.
+	</doc>
+	<value name="CACHE_INVALIDATE" value="49" variants="A6XX"/>
+
+	<value name="LABEL" value="63" variants="A6XX-"/>
+
+	<!-- note, some of these are the same as a6xx, just named differently -->
+
+	<doc> Doesn't seem to do anything </doc>
+	<value name="DUMMY_EVENT" value="1" variants="A7XX"/>
+	<value name="CCU_INVALIDATE_DEPTH" value="24" variants="A7XX"/>
+	<value name="CCU_INVALIDATE_COLOR" value="25" variants="A7XX"/>
+	<value name="CCU_RESOLVE_CLEAN" value="26" variants="A7XX"/>
+	<value name="CCU_FLUSH_DEPTH" value="28" variants="A7XX"/>
+	<value name="CCU_FLUSH_COLOR" value="29" variants="A7XX"/>
+	<value name="CCU_RESOLVE" value="30" variants="A7XX"/>
+	<value name="CCU_END_RESOLVE_GROUP" value="31" variants="A7XX"/>
+	<value name="CCU_CLEAN_DEPTH" value="32" variants="A7XX"/>
+	<value name="CCU_CLEAN_COLOR" value="33" variants="A7XX"/>
+	<value name="CACHE_RESET" value="48" variants="A7XX"/>
+	<value name="CACHE_CLEAN" value="49" variants="A7XX"/>
+	<!-- TODO: deal with name conflicts with other gens -->
+	<value name="CACHE_FLUSH7" value="50" variants="A7XX"/>
+	<value name="CACHE_INVALIDATE7" value="51" variants="A7XX"/>
+</enum>
+
+<enum name="pc_di_primtype">
+	<value name="DI_PT_NONE" value="0"/>
+	<!-- POINTLIST_PSIZE is used on a3xx/a4xx when gl_PointSize is written: -->
+	<value name="DI_PT_POINTLIST_PSIZE" value="1"/>
+	<value name="DI_PT_LINELIST" value="2"/>
+	<value name="DI_PT_LINESTRIP" value="3"/>
+	<value name="DI_PT_TRILIST" value="4"/>
+	<value name="DI_PT_TRIFAN" value="5"/>
+	<value name="DI_PT_TRISTRIP" value="6"/>
+	<value name="DI_PT_LINELOOP" value="7"/>  <!-- a22x, a3xx -->
+	<value name="DI_PT_RECTLIST" value="8"/>
+	<value name="DI_PT_POINTLIST" value="9"/>
+	<value name="DI_PT_LINE_ADJ" value="0xa"/>
+	<value name="DI_PT_LINESTRIP_ADJ" value="0xb"/>
+	<value name="DI_PT_TRI_ADJ" value="0xc"/>
+	<value name="DI_PT_TRISTRIP_ADJ" value="0xd"/>
+
+	<value name="DI_PT_PATCHES0" value="0x1f"/>
+	<value name="DI_PT_PATCHES1" value="0x20"/>
+	<value name="DI_PT_PATCHES2" value="0x21"/>
+	<value name="DI_PT_PATCHES3" value="0x22"/>
+	<value name="DI_PT_PATCHES4" value="0x23"/>
+	<value name="DI_PT_PATCHES5" value="0x24"/>
+	<value name="DI_PT_PATCHES6" value="0x25"/>
+	<value name="DI_PT_PATCHES7" value="0x26"/>
+	<value name="DI_PT_PATCHES8" value="0x27"/>
+	<value name="DI_PT_PATCHES9" value="0x28"/>
+	<value name="DI_PT_PATCHES10" value="0x29"/>
+	<value name="DI_PT_PATCHES11" value="0x2a"/>
+	<value name="DI_PT_PATCHES12" value="0x2b"/>
+	<value name="DI_PT_PATCHES13" value="0x2c"/>
+	<value name="DI_PT_PATCHES14" value="0x2d"/>
+	<value name="DI_PT_PATCHES15" value="0x2e"/>
+	<value name="DI_PT_PATCHES16" value="0x2f"/>
+	<value name="DI_PT_PATCHES17" value="0x30"/>
+	<value name="DI_PT_PATCHES18" value="0x31"/>
+	<value name="DI_PT_PATCHES19" value="0x32"/>
+	<value name="DI_PT_PATCHES20" value="0x33"/>
+	<value name="DI_PT_PATCHES21" value="0x34"/>
+	<value name="DI_PT_PATCHES22" value="0x35"/>
+	<value name="DI_PT_PATCHES23" value="0x36"/>
+	<value name="DI_PT_PATCHES24" value="0x37"/>
+	<value name="DI_PT_PATCHES25" value="0x38"/>
+	<value name="DI_PT_PATCHES26" value="0x39"/>
+	<value name="DI_PT_PATCHES27" value="0x3a"/>
+	<value name="DI_PT_PATCHES28" value="0x3b"/>
+	<value name="DI_PT_PATCHES29" value="0x3c"/>
+	<value name="DI_PT_PATCHES30" value="0x3d"/>
+	<value name="DI_PT_PATCHES31" value="0x3e"/>
+</enum>
+
+<enum name="pc_di_src_sel">
+	<value name="DI_SRC_SEL_DMA" value="0"/>
+	<value name="DI_SRC_SEL_IMMEDIATE" value="1"/>
+	<value name="DI_SRC_SEL_AUTO_INDEX" value="2"/>
+	<value name="DI_SRC_SEL_AUTO_XFB" value="3"/>
+</enum>
+
+<enum name="pc_di_face_cull_sel">
+	<value name="DI_FACE_CULL_NONE" value="0"/>
+	<value name="DI_FACE_CULL_FETCH" value="1"/>
+	<value name="DI_FACE_BACKFACE_CULL" value="2"/>
+	<value name="DI_FACE_FRONTFACE_CULL" value="3"/>
+</enum>
+
+<enum name="pc_di_index_size">
+	<value name="INDEX_SIZE_IGN" value="0"/>
+	<value name="INDEX_SIZE_16_BIT" value="0"/>
+	<value name="INDEX_SIZE_32_BIT" value="1"/>
+	<value name="INDEX_SIZE_8_BIT" value="2"/>
+	<value name="INDEX_SIZE_INVALID"/>
+</enum>
+
+<enum name="pc_di_vis_cull_mode">
+	<value name="IGNORE_VISIBILITY" value="0"/>
+	<value name="USE_VISIBILITY" value="1"/>
+</enum>
+
+<enum name="adreno_pm4_packet_type">
+	<value name="CP_TYPE0_PKT" value="0x00000000"/>
+	<value name="CP_TYPE1_PKT" value="0x40000000"/>
+	<value name="CP_TYPE2_PKT" value="0x80000000"/>
+	<value name="CP_TYPE3_PKT" value="0xc0000000"/>
+	<value name="CP_TYPE4_PKT" value="0x40000000"/>
+	<value name="CP_TYPE7_PKT" value="0x70000000"/>
+</enum>
+
+<!--
+   Note that in some cases, the same packet id is recycled on a later
+   generation, so variants attribute is used to distinguish.   They
+   may not be completely accurate, we would probably have to analyze
+   the pfp and me/pm4 firmware to verify the packet is actually
+   handled on a particular generation.  But it is at least enough to
+   disambiguate the packet-id's that were re-used for different
+   packets starting with a5xx.
+ -->
+<enum name="adreno_pm4_type3_packets" varset="chip">
+	<doc>initialize CP's micro-engine</doc>
+	<value name="CP_ME_INIT" value="0x48"/>
+	<doc>skip N 32-bit words to get to the next packet</doc>
+	<value name="CP_NOP" value="0x10"/>
+	<doc>
+		indirect buffer dispatch.  prefetch parser uses this packet
+		type to determine whether to pre-fetch the IB
+	</doc>
+	<value name="CP_PREEMPT_ENABLE" value="0x1c" variants="A5XX"/>
+	<value name="CP_PREEMPT_TOKEN" value="0x1e" variants="A5XX"/>
+	<value name="CP_INDIRECT_BUFFER" value="0x3f"/>
+	<doc>
+		Takes the same arguments as CP_INDIRECT_BUFFER, but jumps to
+		another buffer at the same level. Must be at the end of IB, and
+		doesn't work with draw state IB's.
+	</doc>
+	<value name="CP_INDIRECT_BUFFER_CHAIN" value="0x57" variants="A5XX-"/>
+	<doc>indirect buffer dispatch.  same as IB, but init is pipelined</doc>
+	<value name="CP_INDIRECT_BUFFER_PFD" value="0x37"/>
+	<doc>
+		Waits for the IDLE state of the engine before further drawing.
+		This is pipelined, so the CP may continue.
+	</doc>
+	<value name="CP_WAIT_FOR_IDLE" value="0x26"/>
+	<doc>wait until a register or memory location is a specific value</doc>
+	<value name="CP_WAIT_REG_MEM" value="0x3c"/>
+	<doc>wait until a register location is equal to a specific value</doc>
+	<value name="CP_WAIT_REG_EQ" value="0x52"/>
+	<doc>wait until a register location is >= a specific value</doc>
+	<value name="CP_WAIT_REG_GTE" value="0x53" variants="A2XX-A4XX"/>
+	<doc>wait until a read completes</doc>
+	<value name="CP_WAIT_UNTIL_READ" value="0x5c" variants="A2XX-A4XX"/>
+	<doc>wait until all base/size writes from an IB_PFD packet have completed</doc>
+	<!--
+		NOTE: CP_WAIT_IB_PFD_COMPLETE unimplemented at least since a5xx fw, and
+		recycled for something new on a7xx
+	 -->
+	<value name="CP_WAIT_IB_PFD_COMPLETE" value="0x5d" varset="chip" variants="A2XX-A4XX"/>
+	<doc>register read/modify/write</doc>
+	<value name="CP_REG_RMW" value="0x21"/>
+	<doc>Set binning configuration registers</doc>
+	<value name="CP_SET_BIN_DATA" value="0x2f" variants="A2XX-A4XX"/>
+	<value name="CP_SET_BIN_DATA5" value="0x2f" variants="A5XX-"/>
+	<doc>reads register in chip and writes to memory</doc>
+	<value name="CP_REG_TO_MEM" value="0x3e"/>
+	<doc>write N 32-bit words to memory</doc>
+	<value name="CP_MEM_WRITE" value="0x3d"/>
+	<doc>write CP_PROG_COUNTER value to memory</doc>
+	<value name="CP_MEM_WRITE_CNTR" value="0x4f"/>
+	<doc>conditional execution of a sequence of packets</doc>
+	<value name="CP_COND_EXEC" value="0x44"/>
+	<doc>conditional write to memory or register</doc>
+	<value name="CP_COND_WRITE" value="0x45" variants="A2XX-A4XX"/>
+	<value name="CP_COND_WRITE5" value="0x45" variants="A5XX-"/>
+	<doc>generate an event that creates a write to memory when completed</doc>
+	<value name="CP_EVENT_WRITE" value="0x46" variants="A2XX-A6XX"/>
+	<value name="CP_EVENT_WRITE7" value="0x46" variants="A7XX-"/>
+	<doc>generate a VS|PS_done event</doc>
+	<value name="CP_EVENT_WRITE_SHD" value="0x58"/>
+	<doc>generate a cache flush done event</doc>
+	<value name="CP_EVENT_WRITE_CFL" value="0x59"/>
+	<doc>generate a z_pass done event</doc>
+	<value name="CP_EVENT_WRITE_ZPD" value="0x5b"/>
+	<doc>
+		not sure the real name, but this seems to be what is used for
+		opencl, instead of CP_DRAW_INDX..
+	</doc>
+	<value name="CP_RUN_OPENCL" value="0x31"/>
+	<doc>initiate fetch of index buffer and draw</doc>
+	<value name="CP_DRAW_INDX" value="0x22"/>
+	<doc>draw using supplied indices in packet</doc>
+	<value name="CP_DRAW_INDX_2" value="0x36" variants="A2XX-A4XX"/>  <!-- this is something different on a6xx and unused on a5xx -->
+	<doc>initiate fetch of index buffer and binIDs and draw</doc>
+	<value name="CP_DRAW_INDX_BIN" value="0x34" variants="A2XX-A4XX"/>
+	<doc>initiate fetch of bin IDs and draw using supplied indices</doc>
+	<value name="CP_DRAW_INDX_2_BIN" value="0x35" variants="A2XX-A4XX"/>
+	<doc>begin/end initiator for viz query extent processing</doc>
+	<value name="CP_VIZ_QUERY" value="0x23" variants="A2XX-A4XX"/>
+	<doc>fetch state sub-blocks and initiate shader code DMAs</doc>
+	<value name="CP_SET_STATE" value="0x25"/>
+	<doc>load constant into chip and to memory</doc>
+	<value name="CP_SET_CONSTANT" value="0x2d" variants="A2XX"/>
+	<doc>load sequencer instruction memory (pointer-based)</doc>
+	<value name="CP_IM_LOAD" value="0x27"/>
+	<doc>load sequencer instruction memory (code embedded in packet)</doc>
+	<value name="CP_IM_LOAD_IMMEDIATE" value="0x2b"/>
+	<doc>load constants from a location in memory</doc>
+	<value name="CP_LOAD_CONSTANT_CONTEXT" value="0x2e" variants="A2XX"/>
+	<doc>selective invalidation of state pointers</doc>
+	<value name="CP_INVALIDATE_STATE" value="0x3b"/>
+	<doc>dynamically changes shader instruction memory partition</doc>
+	<value name="CP_SET_SHADER_BASES" value="0x4a" variants="A2XX-A4XX"/>
+	<doc>sets the 64-bit BIN_MASK register in the PFP</doc>
+	<value name="CP_SET_BIN_MASK" value="0x50" variants="A2XX-A4XX"/>
+	<doc>sets the 64-bit BIN_SELECT register in the PFP</doc>
+	<value name="CP_SET_BIN_SELECT" value="0x51" variants="A2XX-A4XX"/>
+	<doc>updates the current context, if needed</doc>
+	<value name="CP_CONTEXT_UPDATE" value="0x5e"/>
+	<doc>generate interrupt from the command stream</doc>
+	<value name="CP_INTERRUPT" value="0x40"/>
+	<doc>copy sequencer instruction memory to system memory</doc>
+	<value name="CP_IM_STORE" value="0x2c" variants="A2XX"/>
+
+	<!-- For a20x -->
+<!-- TODO handle variants..
+	<doc>
+		Program an offset that will added to the BIN_BASE value of
+		the 3D_DRAW_INDX_BIN packet
+	</doc>
+	<value name="CP_SET_BIN_BASE_OFFSET" value="0x4b"/>
+ -->
+
+	<!-- for a22x -->
+	<doc>
+		sets draw initiator flags register in PFP, gets bitwise-ORed into
+		every draw initiator
+	</doc>
+	<value name="CP_SET_DRAW_INIT_FLAGS" value="0x4b"/>
+	<doc>sets the register protection mode</doc>
+	<value name="CP_SET_PROTECTED_MODE" value="0x5f"/>
+
+	<value name="CP_BOOTSTRAP_UCODE" value="0x6f"/>
+
+	<!-- for a3xx -->
+	<doc>load high level sequencer command</doc>
+	<value name="CP_LOAD_STATE" value="0x30" variants="A3XX"/>
+	<value name="CP_LOAD_STATE4" value="0x30" variants="A4XX-A5XX"/>
+	<doc>Conditionally load a IB based on a flag, prefetch enabled</doc>
+	<value name="CP_COND_INDIRECT_BUFFER_PFE" value="0x3a"/>
+	<doc>Conditionally load a IB based on a flag, prefetch disabled</doc>
+	<value name="CP_COND_INDIRECT_BUFFER_PFD" value="0x32" variants="A3XX"/>
+	<doc>Load a buffer with pre-fetch enabled</doc>
+	<value name="CP_INDIRECT_BUFFER_PFE" value="0x3f" variants="A5XX"/>
+	<doc>Set bin (?)</doc>
+	<value name="CP_SET_BIN" value="0x4c" variants="A2XX"/>
+
+	<doc>test 2 memory locations to dword values specified</doc>
+	<value name="CP_TEST_TWO_MEMS" value="0x71"/>
+
+	<doc>Write register, ignoring context state for context sensitive registers</doc>
+	<value name="CP_REG_WR_NO_CTXT" value="0x78"/>
+
+	<doc>Record the real-time when this packet is processed by PFP</doc>
+	<value name="CP_RECORD_PFP_TIMESTAMP" value="0x11"/>
+
+	<!-- Used to switch GPU between secure and non-secure modes -->
+	<value name="CP_SET_SECURE_MODE" value="0x66"/>
+
+	<doc>PFP waits until the FIFO between the PFP and the ME is empty</doc>
+	<value name="CP_WAIT_FOR_ME" value="0x13"/>
+
+	<!-- for a4xx -->
+	<doc>
+		Used a bit like CP_SET_CONSTANT on a2xx, but can write multiple
+		groups of registers.  Looks like it can be used to create state
+		objects in GPU memory, and on state change only emit pointer
+		(via CP_SET_DRAW_STATE), which should be nice for reducing CPU
+		overhead:
+
+		(A4x) save PM4 stream pointers to execute upon a visible draw
+	</doc>
+	<value name="CP_SET_DRAW_STATE" value="0x43" variants="A4XX-"/>
+	<value name="CP_DRAW_INDX_OFFSET" value="0x38"/>
+	<value name="CP_DRAW_INDIRECT" value="0x28" variants="A4XX-"/>
+	<value name="CP_DRAW_INDX_INDIRECT" value="0x29" variants="A4XX-"/>
+	<value name="CP_DRAW_INDIRECT_MULTI" value="0x2a" variants="A6XX-"/>
+	<value name="CP_DRAW_AUTO" value="0x24"/>
+
+	<doc>
+		Enable or disable predication globally. Also resets the
+		predicate to "passing" and the local bit to enabled when
+		enabling global predication.
+	</doc>
+	<value name="CP_DRAW_PRED_ENABLE_GLOBAL" value="0x19"/>
+
+	<doc>
+		Enable or disable predication locally. Unlike globally enabling
+		predication, this packet doesn't touch any other state.
+		Predication only happens when enabled globally and locally and a
+		predicate has been set. This should be used for internal draws
+		which aren't supposed to use the predication state:
+
+		CP_DRAW_PRED_ENABLE_LOCAL(0)
+		... do draw...
+		CP_DRAW_PRED_ENABLE_LOCAL(1)
+	</doc>
+	<value name="CP_DRAW_PRED_ENABLE_LOCAL" value="0x1a"/>
+
+	<doc>
+		Latch a draw predicate into the internal register.
+	</doc>
+	<value name="CP_DRAW_PRED_SET" value="0x4e"/>
+
+	<doc>
+		for A4xx
+		Write to register with address that does not fit into type-0 pkt
+	</doc>
+	<value name="CP_WIDE_REG_WRITE" value="0x74" variants="A4XX"/>
+
+	<doc>copy from ME scratch RAM to a register</doc>
+	<value name="CP_SCRATCH_TO_REG" value="0x4d"/>
+
+	<doc>Copy from REG to ME scratch RAM</doc>
+	<value name="CP_REG_TO_SCRATCH" value="0x4a"/>
+
+	<doc>Wait for memory writes to complete</doc>
+	<value name="CP_WAIT_MEM_WRITES" value="0x12"/>
+
+	<doc>Conditional execution based on register comparison</doc>
+	<value name="CP_COND_REG_EXEC" value="0x47"/>
+
+	<doc>Memory to REG copy</doc>
+	<value name="CP_MEM_TO_REG" value="0x42"/>
+
+	<value name="CP_EXEC_CS_INDIRECT" value="0x41" variants="A4XX-"/>
+	<value name="CP_EXEC_CS" value="0x33"/>
+
+	<doc>
+		for a5xx
+	</doc>
+	<value name="CP_PERFCOUNTER_ACTION" value="0x50" variants="A5XX"/>
+	<!-- switches SMMU pagetable, used on a5xx+ only -->
+	<value name="CP_SMMU_TABLE_UPDATE" value="0x53" variants="A5XX-"/>
+	<!-- for a6xx -->
+	<doc>Tells CP the current mode of GPU operation</doc>
+	<value name="CP_SET_MARKER" value="0x65" variants="A6XX-"/>
+	<doc>Instruct CP to set a few internal CP registers</doc>
+	<value name="CP_SET_PSEUDO_REG" value="0x56" variants="A6XX-"/>
+	<!--
+	pairs of regid and value.. seems to be used to program some TF
+	related regs:
+	 -->
+	<value name="CP_CONTEXT_REG_BUNCH" value="0x5c" variants="A5XX-"/>
+	<!-- A5XX Enable yield in RB only -->
+	<value name="CP_YIELD_ENABLE" value="0x1c" variants="A5XX"/>
+	<doc>
+		Enables IB2 skipping.  If both GLOBAL and LOCAL are 1 and
+		nothing is left in the visibility stream, then
+		CP_INDIRECT_BUFFER will be skipped, and draws will early return
+		from their IB.
+	</doc>
+	<value name="CP_SKIP_IB2_ENABLE_GLOBAL" value="0x1d" variants="A5XX-"/>
+	<value name="CP_SKIP_IB2_ENABLE_LOCAL" value="0x23" variants="A5XX-"/>
+	<value name="CP_SET_SUBDRAW_SIZE" value="0x35" variants="A5XX-"/>
+	<value name="CP_WHERE_AM_I" value="0x62" variants="A5XX-"/>
+	<value name="CP_SET_VISIBILITY_OVERRIDE" value="0x64" variants="A5XX-"/>
+	<!-- Enable/Disable/Defer A5x global preemption model -->
+	<value name="CP_PREEMPT_ENABLE_GLOBAL" value="0x69" variants="A5XX"/>
+	<!-- Enable/Disable A5x local preemption model -->
+	<value name="CP_PREEMPT_ENABLE_LOCAL" value="0x6a" variants="A5XX"/>
+	<!-- Yield token on a5xx similar to CP_PREEMPT on a4xx -->
+	<value name="CP_CONTEXT_SWITCH_YIELD" value="0x6b" variants="A5XX-"/>
+	<!-- Inform CP about current render mode (needed for a5xx preemption) -->
+	<value name="CP_SET_RENDER_MODE" value="0x6c" variants="A5XX"/>
+	<value name="CP_COMPUTE_CHECKPOINT" value="0x6e" variants="A5XX"/>
+	<!-- check if this works on earlier.. -->
+	<value name="CP_MEM_TO_MEM" value="0x73" variants="A5XX-"/>
+
+	<doc>
+		General purpose 2D blit engine for image transfers and mipmap
+		generation.  Reads through UCHE, writes through the CCU cache in
+		the PS stage.
+	</doc>
+	<value name="CP_BLIT" value="0x2c" variants="A5XX-"/>
+
+	<!-- Test specified bit in specified register and set predicate -->
+	<value name="CP_REG_TEST" value="0x39" variants="A5XX-"/>
+
+	<!--
+	Seems to set the mode flags which control which CP_SET_DRAW_STATE
+	packets are executed, based on their ENABLE_MASK values
+	
+	CP_SET_MODE w/ payload of 0x1 seems to cause CP_SET_DRAW_STATE
+	packets w/ ENABLE_MASK & 0x6 to execute immediately
+	 -->
+	<value name="CP_SET_MODE" value="0x63" variants="A6XX-"/>
+
+	<!--
+	Seems like there are now separate blocks of state for VS vs FS/CS
+	(probably these amounts to geometry vs fragments so that geometry
+	stage of the pipeline for next draw can start while fragment stage
+	of current draw is still running.  The format of the payload of the
+	packets is the same, the only difference is the offsets of the regs
+	the firmware code that handles the packet writes.
+
+	Note that for CL, starting with a6xx, the preferred # of local
+	threads is no longer the same as the max, implying that the shader
+	core can now run warps from unrelated shaders (ie.
+	CL_KERNEL_PREFERRED_WORK_GROUP_SIZE_MULTIPLE vs
+	CL_KERNEL_WORK_GROUP_SIZE)
+	 -->
+	<value name="CP_LOAD_STATE6_GEOM" value="0x32" variants="A6XX-"/>
+	<value name="CP_LOAD_STATE6_FRAG" value="0x34" variants="A6XX-"/>
+	<!--
+	Note: For IBO state (Image/SSBOs) which have shared state across
+	shader stages, for 3d pipeline CP_LOAD_STATE6 is used.  But for
+	compute shaders, CP_LOAD_STATE6_FRAG is used.  Possibly they are
+	interchangable.
+	 -->
+	<value name="CP_LOAD_STATE6" value="0x36" variants="A6XX-"/>
+
+	<!-- internal packets: -->
+	<value name="IN_IB_PREFETCH_END" value="0x17" variants="A2XX"/>
+	<value name="IN_SUBBLK_PREFETCH" value="0x1f" variants="A2XX"/>
+	<value name="IN_INSTR_PREFETCH" value="0x20" variants="A2XX"/>
+	<value name="IN_INSTR_MATCH" value="0x47" variants="A2XX"/>
+	<value name="IN_CONST_PREFETCH" value="0x49" variants="A2XX"/>
+	<value name="IN_INCR_UPDT_STATE" value="0x55" variants="A2XX"/>
+	<value name="IN_INCR_UPDT_CONST" value="0x56" variants="A2XX"/>
+	<value name="IN_INCR_UPDT_INSTR" value="0x57" variants="A2XX"/>
+
+	<!-- internal jumptable entries on a6xx+, possibly a5xx: -->
+
+	<!-- jmptable entry used to handle type4 packet on a5xx+: -->
+	<value name="PKT4" value="0x04" variants="A5XX-"/>
+	<!-- called when ROQ is empty, "returns" from an IB or merged sequence of IBs -->
+	<value name="IN_IB_END" value="0x0a" variants="A6XX-"/>
+	<!-- handles IFPC save/restore -->
+	<value name="IN_GMU_INTERRUPT" value="0x0b" variants="A6XX-"/>
+	<!-- preemption/context-swtich routine -->
+	<value name="IN_PREEMPT" value="0x0f" variants="A6XX-"/>
+
+	<!-- TODO do these exist on A5xx? -->
+	<value name="CP_SCRATCH_WRITE" value="0x4c" variants="A6XX"/>
+	<value name="CP_REG_TO_MEM_OFFSET_MEM" value="0x74" variants="A6XX-"/>
+	<value name="CP_REG_TO_MEM_OFFSET_REG" value="0x72" variants="A6XX-"/>
+	<value name="CP_WAIT_MEM_GTE" value="0x14" variants="A6XX"/>
+	<value name="CP_WAIT_TWO_REGS" value="0x70" variants="A6XX"/>
+	<value name="CP_MEMCPY" value="0x75" variants="A6XX-"/>
+	<value name="CP_SET_BIN_DATA5_OFFSET" value="0x2e" variants="A6XX-"/>
+	<!-- A750+, set in place of CP_SET_BIN_DATA5_OFFSET but has different values -->
+	<value name="CP_SET_UNK_BIN_DATA" value="0x2d" variants="A7XX-"/>
+	<doc>
+                Write CP_CONTEXT_SWITCH_*_INFO from CP to the following dwords,
+                and forcibly switch to the indicated context.
+	</doc>
+	<value name="CP_CONTEXT_SWITCH" value="0x54" variants="A6XX"/>
+	<value name="CP_SET_AMBLE" value="0x55" variants="A6XX-"/>
+
+	<!--
+	Seems to always have the payload:
+	  00000002 00008801 00004010
+	or:
+	  00000002 00008801 00004090
+	or:
+	  00000002 00008801 00000010
+	  00000002 00008801 00010010
+	  00000002 00008801 00d64010
+	  ...
+	Note set for compute shaders..
+	Is 0x8801 a register offset?
+	This appears to be a special sort of register write packet
+	more or less, but the firmware has some special handling..
+	Seems like it intercepts/modifies certain register offsets,
+	but others are treated like a normal PKT4 reg write.  I
+	guess there are some registers that the fw controls certain
+	bits.
+	 -->
+	<value name="CP_REG_WRITE" value="0x6d" variants="A6XX"/>
+
+	<doc>
+		These first appear in a650_sqe.bin. They can in theory be used
+		to loop any sequence of IB1 commands, but in practice they are
+		used to loop over bins. There is a fixed-size per-iteration
+		prefix, used to set per-bin state, and then the following IB1
+		commands are executed until CP_END_BIN which are always the same
+		for each iteration and usually contain a list of
+		CP_INDIRECT_BUFFER calls to IB2 commands which setup state and
+		execute restore/draw/save commands. This replaces the previous
+		technique of just repeating the CP_INDIRECT_BUFFER calls and
+		"unrolling" the loop.
+	</doc>
+	<value name="CP_START_BIN" value="0x50" variants="A6XX-"/>
+	<value name="CP_END_BIN" value="0x51" variants="A6XX-"/>
+
+	<doc> Make next dword 1 to disable preemption, 0 to re-enable it. </doc>
+	<value name="CP_PREEMPT_DISABLE" value="0x6c" variants="A6XX"/>
+
+	<value name="CP_WAIT_TIMESTAMP" value="0x14" variants="A7XX-"/>
+	<value name="CP_GLOBAL_TIMESTAMP" value="0x15" variants="A7XX-"/>  <!-- payload 1 dword -->
+	<value name="CP_LOCAL_TIMESTAMP" value="0x16" variants="A7XX-"/>  <!-- payload 1 dword, follows 0x15 -->
+	<value name="CP_THREAD_CONTROL" value="0x17" variants="A7XX-"/>
+	<!-- payload 4 dwords, last two could be render target addr (one pkt per MRT), possibly used for GMEM save/restore?-->
+	<value name="CP_RESOURCE_LIST" value="0x18" variants="A7XX-"/>
+	<doc> Can clear BV/BR counters, or wait until one catches up to another </doc>
+	<value name="CP_BV_BR_COUNT_OPS" value="0x1b" variants="A7XX-"/>
+	<doc> Clears, adds to local, or adds to global timestamp </doc>
+	<value name="CP_MODIFY_TIMESTAMP" value="0x1c" variants="A7XX-"/>
+	<!-- similar to CP_CONTEXT_REG_BUNCH, but discards first two dwords?? -->
+	<value name="CP_CONTEXT_REG_BUNCH2" value="0x5d" variants="A7XX-"/>
+	<doc>
+		Write to a scratch memory that is read by CP_REG_TEST with
+		SOURCE_SCRATCH_MEM set. It's not the same scratch as scratch registers.
+		However it uses the same memory space.
+	</doc>
+	<value name="CP_MEM_TO_SCRATCH_MEM" value="0x49" variants="A7XX-"/>
+
+	<doc>
+		Executes an array of fixed-size command buffers where each
+		buffer is assumed to have one draw call, skipping buffers with
+		non-visible draw calls.
+	</doc>
+	<value name="CP_FIXED_STRIDE_DRAW_TABLE" value="0x7f" variants="A7XX-"/>
+
+	<doc>Reset various on-chip state used for synchronization</doc>
+	<value name="CP_RESET_CONTEXT_STATE" value="0x1f" variants="A7XX-"/>
+</enum>
+
+
+<domain name="CP_LOAD_STATE" width="32">
+	<doc>Load state, a3xx (and later?)</doc>
+	<enum name="adreno_state_block">
+		<value name="SB_VERT_TEX" value="0"/>
+		<value name="SB_VERT_MIPADDR" value="1"/>
+		<value name="SB_FRAG_TEX" value="2"/>
+		<value name="SB_FRAG_MIPADDR" value="3"/>
+		<value name="SB_VERT_SHADER" value="4"/>
+		<value name="SB_GEOM_SHADER" value="5"/>
+		<value name="SB_FRAG_SHADER" value="6"/>
+		<value name="SB_COMPUTE_SHADER" value="7"/>
+	</enum>
+	<enum name="adreno_state_type">
+		<value name="ST_SHADER" value="0"/>
+		<value name="ST_CONSTANTS" value="1"/>
+	</enum>
+	<enum name="adreno_state_src">
+		<value name="SS_DIRECT" value="0">
+			<doc>inline with the CP_LOAD_STATE packet</doc>
+		</value>
+		<value name="SS_INVALID_ALL_IC" value="2"/>
+		<value name="SS_INVALID_PART_IC" value="3"/>
+		<value name="SS_INDIRECT" value="4">
+			<doc>in buffer pointed to by EXT_SRC_ADDR</doc>
+		</value>
+		<value name="SS_INDIRECT_TCM" value="5"/>
+		<value name="SS_INDIRECT_STM" value="6"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="DST_OFF" low="0" high="15" type="uint"/>
+		<bitfield name="STATE_SRC" low="16" high="18" type="adreno_state_src"/>
+		<bitfield name="STATE_BLOCK" low="19" high="21" type="adreno_state_block"/>
+		<bitfield name="NUM_UNIT" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="STATE_TYPE" low="0" high="1" type="adreno_state_type"/>
+		<bitfield name="EXT_SRC_ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+</domain>
+
+<domain name="CP_LOAD_STATE4" width="32" varset="chip">
+	<doc>Load state, a4xx+</doc>
+	<enum name="a4xx_state_block">
+		<!--
+		unknown: 0x7 and 0xf <- seen in compute shader
+
+		STATE_BLOCK = 0x6, STATE_TYPE = 0x2 possibly used for preemption?
+		Seen in some GL shaders.  Payload is NUM_UNIT dwords, and it contains
+		the gpuaddr of the following shader constants block.  DST_OFF seems
+		to specify which shader stage:
+
+		    16 -> vert
+		    36 -> tcs
+		    56 -> tes
+		    76 -> geom
+		    96 -> frag
+
+		Example:
+
+opcode: CP_LOAD_STATE4 (30) (12 dwords)
+        { DST_OFF = 16 | STATE_SRC = SS4_DIRECT | STATE_BLOCK = 0x6 | NUM_UNIT = 4 }
+        { STATE_TYPE = 0x2 | EXT_SRC_ADDR = 0 }
+        { EXT_SRC_ADDR_HI = 0 }
+                        0000: c0264100 00000000 00000000 00000000
+                0000: 70b0000b 01180010 00000002 00000000 c0264100 00000000 00000000 00000000
+
+opcode: CP_LOAD_STATE4 (30) (4 dwords)
+        { DST_OFF = 16 | STATE_SRC = SS4_INDIRECT | STATE_BLOCK = SB4_VS_SHADER | NUM_UNIT = 4 }
+        { STATE_TYPE = ST4_CONSTANTS | EXT_SRC_ADDR = 0xc0264100 }
+        { EXT_SRC_ADDR_HI = 0 }
+                        0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000
+                        0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000
+                        0000: 00000040 0000000c 00000000 00000000 00000000 00000000 00000000 00000000
+
+		STATE_BLOCK = 0x6, STATE_TYPE = 0x1, seen in compute shader.  NUM_UNITS * 2 dwords.
+
+		 -->
+		<value name="SB4_VS_TEX"    value="0x0"/>
+		<value name="SB4_HS_TEX"    value="0x1"/>    <!-- aka. TCS -->
+		<value name="SB4_DS_TEX"    value="0x2"/>    <!-- aka. TES -->
+		<value name="SB4_GS_TEX"    value="0x3"/>
+		<value name="SB4_FS_TEX"    value="0x4"/>
+		<value name="SB4_CS_TEX"    value="0x5"/>
+		<value name="SB4_VS_SHADER" value="0x8"/>
+		<value name="SB4_HS_SHADER" value="0x9"/>
+		<value name="SB4_DS_SHADER" value="0xa"/>
+		<value name="SB4_GS_SHADER" value="0xb"/>
+		<value name="SB4_FS_SHADER" value="0xc"/>
+		<value name="SB4_CS_SHADER" value="0xd"/>
+		<!--
+		for SSBO, STATE_TYPE=0 appears to be addresses (four dwords each),
+		STATE_TYPE=1 sizes, STATE_TYPE=2 addresses again (two dwords each)
+
+		Compute has it's own dedicated SSBO state, it seems, but the rest
+		of the stages share state
+		 -->
+		<value name="SB4_SSBO"   value="0xe"/>
+		<value name="SB4_CS_SSBO"   value="0xf"/>
+	</enum>
+	<enum name="a4xx_state_type">
+		<value name="ST4_SHADER" value="0"/>
+		<value name="ST4_CONSTANTS" value="1"/>
+		<value name="ST4_UBO" value="2"/>
+	</enum>
+	<enum name="a4xx_state_src">
+		<value name="SS4_DIRECT" value="0"/>
+		<value name="SS4_INDIRECT" value="2"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="DST_OFF" low="0" high="13" type="uint"/>
+		<bitfield name="STATE_SRC" low="16" high="17" type="a4xx_state_src"/>
+		<bitfield name="STATE_BLOCK" low="18" high="21" type="a4xx_state_block"/>
+		<bitfield name="NUM_UNIT" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="STATE_TYPE" low="0" high="1" type="a4xx_state_type"/>
+		<bitfield name="EXT_SRC_ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="EXT_SRC_ADDR_HI" low="0" high="31" shr="0"/>
+	</reg32>
+</domain>
+
+<!-- looks basically same CP_LOAD_STATE4 -->
+<domain name="CP_LOAD_STATE6" width="32" varset="chip">
+	<doc>Load state, a6xx+</doc>
+	<enum name="a6xx_state_block">
+		<value name="SB6_VS_TEX"    value="0x0"/>
+		<value name="SB6_HS_TEX"    value="0x1"/>    <!-- aka. TCS -->
+		<value name="SB6_DS_TEX"    value="0x2"/>    <!-- aka. TES -->
+		<value name="SB6_GS_TEX"    value="0x3"/>
+		<value name="SB6_FS_TEX"    value="0x4"/>
+		<value name="SB6_CS_TEX"    value="0x5"/>
+		<value name="SB6_VS_SHADER" value="0x8"/>
+		<value name="SB6_HS_SHADER" value="0x9"/>
+		<value name="SB6_DS_SHADER" value="0xa"/>
+		<value name="SB6_GS_SHADER" value="0xb"/>
+		<value name="SB6_FS_SHADER" value="0xc"/>
+		<value name="SB6_CS_SHADER" value="0xd"/>
+		<value name="SB6_IBO"       value="0xe"/>
+		<value name="SB6_CS_IBO"    value="0xf"/>
+	</enum>
+	<enum name="a6xx_state_type">
+		<value name="ST6_SHADER" value="0"/>
+		<value name="ST6_CONSTANTS" value="1"/>
+		<value name="ST6_UBO" value="2"/>
+		<value name="ST6_IBO" value="3"/>
+	</enum>
+	<enum name="a6xx_state_src">
+		<value name="SS6_DIRECT" value="0"/>
+		<value name="SS6_BINDLESS" value="1"/> <!-- TODO does this exist on a4xx/a5xx? -->
+		<value name="SS6_INDIRECT" value="2"/>
+		<doc>
+		SS6_UBO used by the a6xx vulkan blob with tesselation constants
+		in this case, EXT_SRC_ADDR is (ubo_id shl 16 | offset)
+		to load constants from a UBO loaded with DST_OFF = 14 and offset 0,
+		EXT_SRC_ADDR = 0xe0000
+		(offset is a guess, should be in bytes given that maxUniformBufferRange=64k)
+		</doc>
+		<value name="SS6_UBO" value="3"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="DST_OFF" low="0" high="13" type="uint"/>
+		<bitfield name="STATE_TYPE" low="14" high="15" type="a6xx_state_type"/>
+		<bitfield name="STATE_SRC" low="16" high="17" type="a6xx_state_src"/>
+		<bitfield name="STATE_BLOCK" low="18" high="21" type="a6xx_state_block"/>
+		<bitfield name="NUM_UNIT" low="22" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="EXT_SRC_ADDR" low="2" high="31" shr="2"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="EXT_SRC_ADDR_HI" low="0" high="31" shr="0"/>
+	</reg32>
+	<reg64 offset="1" name="EXT_SRC_ADDR" type="address"/>
+</domain>
+
+<bitset name="vgt_draw_initiator" inline="yes">
+	<bitfield name="PRIM_TYPE" low="0" high="5" type="pc_di_primtype"/>
+	<bitfield name="SOURCE_SELECT" low="6" high="7" type="pc_di_src_sel"/>
+	<bitfield name="VIS_CULL" low="9" high="10" type="pc_di_vis_cull_mode"/>
+	<bitfield name="INDEX_SIZE" pos="11" type="pc_di_index_size"/>
+	<bitfield name="NOT_EOP" pos="12" type="boolean"/>
+	<bitfield name="SMALL_INDEX" pos="13" type="boolean"/>
+	<bitfield name="PRE_DRAW_INITIATOR_ENABLE" pos="14" type="boolean"/>
+	<bitfield name="NUM_INSTANCES" low="24" high="31" type="uint"/>
+</bitset>
+
+<!-- changed on a4xx: -->
+<enum name="a4xx_index_size">
+	<value name="INDEX4_SIZE_8_BIT" value="0"/>
+	<value name="INDEX4_SIZE_16_BIT" value="1"/>
+	<value name="INDEX4_SIZE_32_BIT" value="2"/>
+</enum>
+
+<enum name="a6xx_patch_type">
+  <value name="TESS_QUADS" value="0"/>
+  <value name="TESS_TRIANGLES" value="1"/>
+  <value name="TESS_ISOLINES" value="2"/>
+</enum>
+
+<bitset name="vgt_draw_initiator_a4xx" inline="yes">
+	<!-- When the 0x20 bit is set, it's the number of patch vertices - 1 -->
+	<bitfield name="PRIM_TYPE" low="0" high="5" type="pc_di_primtype"/>
+	<bitfield name="SOURCE_SELECT" low="6" high="7" type="pc_di_src_sel"/>
+	<bitfield name="VIS_CULL" low="8" high="9" type="pc_di_vis_cull_mode"/>
+	<bitfield name="INDEX_SIZE" low="10" high="11" type="a4xx_index_size"/>
+	<bitfield name="PATCH_TYPE" low="12" high="13" type="a6xx_patch_type"/>
+	<bitfield name="GS_ENABLE" pos="16" type="boolean"/>
+	<bitfield name="TESS_ENABLE" pos="17" type="boolean"/>
+</bitset>
+
+<domain name="CP_DRAW_INDX" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="VIZ_QUERY" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1" type="vgt_draw_initiator"/>
+	<reg32 offset="2" name="2">
+		<bitfield name="NUM_INDICES" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="INDX_BASE" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="INDX_SIZE" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_INDX_2" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="VIZ_QUERY" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1" type="vgt_draw_initiator"/>
+	<reg32 offset="2" name="2">
+		<bitfield name="NUM_INDICES" low="0" high="31" type="uint"/>
+	</reg32>
+	<!-- followed by NUM_INDICES indices.. -->
+</domain>
+
+<domain name="CP_DRAW_INDX_OFFSET" width="32">
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="NUM_INSTANCES" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="NUM_INDICES" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="FIRST_INDX" low="0" high="31"/>
+	</reg32>
+
+	<stripe varset="chip" variants="A5XX-">
+		<reg32 offset="4" name="4">
+			<bitfield name="INDX_BASE_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="5" name="5">
+			<bitfield name="INDX_BASE_HI" low="0" high="31"/>
+		</reg32>
+		<reg64 offset="4" name="INDX_BASE" type="address"/>
+		<reg32 offset="6" name="6">
+			<!-- max # of elements in index buffer -->
+			<bitfield name="MAX_INDICES" low="0" high="31"/>
+		</reg32>
+	</stripe>
+
+	<reg32 offset="4" name="4">
+		<bitfield name="INDX_BASE" low="0" high="31" type="address"/>
+	</reg32>
+
+	<reg32 offset="5" name="5">
+		<bitfield name="INDX_SIZE" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_INDIRECT" width="32" varset="chip" prefix="chip" variants="A4XX-">
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<stripe varset="chip" variants="A4XX">
+		<reg32 offset="1" name="1">
+			<bitfield name="INDIRECT" low="0" high="31"/>
+		</reg32>
+	</stripe>
+	<stripe varset="chip" variants="A5XX-">
+		<reg32 offset="1" name="1">
+			<bitfield name="INDIRECT_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="INDIRECT_HI" low="0" high="31"/>
+		</reg32>
+		<reg64 offset="1" name="INDIRECT" type="address"/>
+	</stripe>
+</domain>
+
+<domain name="CP_DRAW_INDX_INDIRECT" width="32" varset="chip" prefix="chip" variants="A4XX-">
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<stripe varset="chip" variants="A4XX">
+		<reg32 offset="1" name="1">
+			<bitfield name="INDX_BASE" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<!-- max # of bytes in index buffer -->
+			<bitfield name="INDX_SIZE" low="0" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="3" name="3">
+			<bitfield name="INDIRECT" low="0" high="31"/>
+		</reg32>
+	</stripe>
+	<stripe varset="chip" variants="A5XX-">
+		<reg32 offset="1" name="1">
+			<bitfield name="INDX_BASE_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="INDX_BASE_HI" low="0" high="31"/>
+		</reg32>
+		<reg64 offset="1" name="INDX_BASE" type="address"/>
+		<reg32 offset="3" name="3">
+			<!-- max # of elements in index buffer -->
+			<bitfield name="MAX_INDICES" low="0" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="4" name="4">
+			<bitfield name="INDIRECT_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="5" name="5">
+			<bitfield name="INDIRECT_HI" low="0" high="31"/>
+		</reg32>
+		<reg64 offset="4" name="INDIRECT" type="address"/>
+	</stripe>
+</domain>
+
+<domain name="CP_DRAW_INDIRECT_MULTI" width="32" varset="chip" prefix="chip" variants="A6XX-">
+	<enum name="a6xx_draw_indirect_opcode">
+		<value name="INDIRECT_OP_NORMAL"  value="0x2"/>
+		<value name="INDIRECT_OP_INDEXED" value="0x4"/>
+		<value name="INDIRECT_OP_INDIRECT_COUNT" value="0x6"/>
+		<value name="INDIRECT_OP_INDIRECT_COUNT_INDEXED" value="0x7"/>
+	</enum>
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="OPCODE" low="0" high="3" type="a6xx_draw_indirect_opcode" addvariant="yes"/>
+		<doc>
+		DST_OFF same as in CP_LOAD_STATE6 - vec4 VS const at this offset will
+		be updated for each draw to {draw_id, first_vertex, first_instance, 0}
+		value of 0 disables it
+		</doc>
+		<bitfield name="DST_OFF" low="8" high="21" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="DRAW_COUNT" type="uint"/>
+	<stripe varset="a6xx_draw_indirect_opcode" variants="INDIRECT_OP_NORMAL">
+		<reg64 offset="3" name="INDIRECT" type="address"/>
+		<reg32 offset="5" name="STRIDE" type="uint"/>
+	</stripe>
+	<stripe varset="a6xx_draw_indirect_opcode" variants="INDIRECT_OP_INDEXED" prefix="INDEXED">
+		<reg64 offset="3" name="INDEX" type="address"/>
+		<reg32 offset="5" name="MAX_INDICES" type="uint"/>
+		<reg64 offset="6" name="INDIRECT" type="address"/>
+		<reg32 offset="8" name="STRIDE" type="uint"/>
+	</stripe>
+	<stripe varset="a6xx_draw_indirect_opcode" variants="INDIRECT_OP_INDIRECT_COUNT" prefix="INDIRECT">
+		<reg64 offset="3" name="INDIRECT" type="address"/>
+		<reg64 offset="5" name="INDIRECT_COUNT" type="address"/>
+		<reg32 offset="7" name="STRIDE" type="uint"/>
+	</stripe>
+	<stripe varset="a6xx_draw_indirect_opcode" variants="INDIRECT_OP_INDIRECT_COUNT_INDEXED" prefix="INDIRECT_INDEXED">
+		<reg64 offset="3" name="INDEX" type="address"/>
+		<reg32 offset="5" name="MAX_INDICES" type="uint"/>
+		<reg64 offset="6" name="INDIRECT" type="address"/>
+		<reg64 offset="8" name="INDIRECT_COUNT" type="address"/>
+		<reg32 offset="10" name="STRIDE" type="uint"/>
+	</stripe>
+</domain>
+
+<domain name="CP_DRAW_AUTO" width="32">
+	<reg32 offset="0" name="0" type="vgt_draw_initiator_a4xx"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="NUM_INSTANCES" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg64 offset="2" name="NUM_VERTICES_BASE" type="address"/>
+	<reg32 offset="4" name="4">
+		<bitfield name="NUM_VERTICES_OFFSET" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="STRIDE" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_PRED_ENABLE_GLOBAL" width="32" varset="chip">
+	<reg32 offset="0" name="0">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_PRED_ENABLE_LOCAL" width="32" varset="chip">
+	<reg32 offset="0" name="0">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DRAW_PRED_SET" width="32" varset="chip">
+	<enum name="cp_draw_pred_src">
+		<!--
+			Sources 1-4 seem to be about combining reading
+			SO/primitive queries and setting the predicate, which is
+			a DX11-specific optimization (since in DX11 you can only
+			predicate on the result of queries).
+		-->
+		<value name="PRED_SRC_MEM" value="5">
+			<doc>
+				Read a 64-bit value at the given address and
+				test if it equals/doesn't equal 0.
+			</doc>
+		</value>
+	</enum>
+	<enum name="cp_draw_pred_test">
+		<value name="NE_0_PASS" value="0"/>
+		<value name="EQ_0_PASS" value="1"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="SRC" low="4" high="7" type="cp_draw_pred_src"/>
+		<bitfield name="TEST" pos="8" type="cp_draw_pred_test"/>
+	</reg32>
+	<reg64 offset="1" name="MEM_ADDR" type="address"/>
+</domain>
+
+<domain name="CP_SET_DRAW_STATE" width="32" varset="chip" variants="A4XX-">
+	<array offset="0" stride="3" length="100">
+		<reg32 offset="0" name="0">
+			<bitfield name="COUNT" low="0" high="15" type="uint"/>
+			<bitfield name="DIRTY" pos="16" type="boolean"/>
+			<bitfield name="DISABLE" pos="17" type="boolean"/>
+			<bitfield name="DISABLE_ALL_GROUPS" pos="18" type="boolean"/>
+			<bitfield name="LOAD_IMMED" pos="19" type="boolean"/>
+			<bitfield name="BINNING" pos="20" varset="chip" variants="A6XX-" type="boolean"/>
+			<bitfield name="GMEM" pos="21" varset="chip" variants="A6XX-" type="boolean"/>
+			<bitfield name="SYSMEM" pos="22" varset="chip" variants="A6XX-" type="boolean"/>
+			<bitfield name="GROUP_ID" low="24" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="1" name="1">
+			<bitfield name="ADDR_LO" low="0" high="31" type="hex"/>
+		</reg32>
+		<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+			<bitfield name="ADDR_HI" low="0" high="31" type="hex"/>
+		</reg32>
+	</array>
+</domain>
+
+<domain name="CP_SET_BIN" width="32">
+	<doc>value at offset 0 always seems to be 0x00000000..</doc>
+	<reg32 offset="0" name="0"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="X1" low="0" high="15" type="uint"/>
+		<bitfield name="Y1" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="X2" low="0" high="15" type="uint"/>
+		<bitfield name="Y2" low="16" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_BIN_DATA" width="32">
+	<reg32 offset="0" name="0">
+		<!-- corresponds to VSC_PIPE[n].DATA_ADDR -->
+		<bitfield name="BIN_DATA_ADDR" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<!-- seesm to correspond to VSC_SIZE_ADDRESS -->
+		<bitfield name="BIN_SIZE_ADDRESS" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_BIN_DATA5" width="32">
+	<reg32 offset="0" name="0">
+		<!-- equiv to PC_VSTREAM_CONTROL.SIZE on a3xx/a4xx: -->
+		<bitfield name="VSC_SIZE" low="16" high="21" type="uint"/>
+		<!-- equiv to PC_VSTREAM_CONTROL.N on a3xx/a4xx: -->
+		<bitfield name="VSC_N" low="22" high="26" type="uint"/>
+	</reg32>
+	<!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
+	<reg32 offset="1" name="1">
+		<bitfield name="BIN_DATA_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="BIN_DATA_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
+	<reg32 offset="3" name="3">
+		<bitfield name="BIN_SIZE_ADDRESS_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="BIN_SIZE_ADDRESS_HI" low="0" high="31"/>
+	</reg32>
+	<!-- new on a6xx, where BIN_DATA_ADDR is the DRAW_STRM: -->
+	<reg32 offset="5" name="5">
+		<bitfield name="BIN_PRIM_STRM_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<bitfield name="BIN_PRIM_STRM_HI" low="0" high="31"/>
+	</reg32>
+	<!--
+		a7xx adds a few more addresses to the end of the pkt
+	 -->
+	<reg64 offset="7" name="7"/>
+	<reg64 offset="9" name="9"/>
+</domain>
+
+<domain name="CP_SET_BIN_DATA5_OFFSET" width="32">
+	<doc>
+                Like CP_SET_BIN_DATA5, but set the pointers as offsets from the
+                pointers stored in VSC_PIPE_{DATA,DATA2,SIZE}_ADDRESS. Useful
+                for Vulkan where these values aren't known when the command
+                stream is recorded.
+	</doc>
+	<reg32 offset="0" name="0">
+		<!-- equiv to PC_VSTREAM_CONTROL.SIZE on a3xx/a4xx: -->
+		<bitfield name="VSC_SIZE" low="16" high="21" type="uint"/>
+		<!-- equiv to PC_VSTREAM_CONTROL.N on a3xx/a4xx: -->
+		<bitfield name="VSC_N" low="22" high="26" type="uint"/>
+	</reg32>
+	<!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
+	<reg32 offset="1" name="1">
+		<bitfield name="BIN_DATA_OFFSET" low="0" high="31" type="uint"/>
+	</reg32>
+	<!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
+	<reg32 offset="2" name="2">
+		<bitfield name="BIN_SIZE_OFFSET" low="0" high="31" type="uint"/>
+	</reg32>
+	<!-- BIN_DATA2_ADDR -> VSC_PIPE[p].DATA2_ADDRESS -->
+	<reg32 offset="3" name="3">
+		<bitfield name="BIN_DATA2_OFFSET" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_RMW" width="32">
+	<doc>
+                Modifies DST_REG using two sources that can either be registers
+                or immediates. If SRC1_ADD is set, then do the following:
+
+			$dst = (($dst &amp; $src0) rot $rotate) + $src1
+
+		Otherwise:
+
+			$dst = (($dst &amp; $src0) rot $rotate) | $src1
+
+		Here "rot" means rotate left.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="DST_REG" low="0" high="17" type="hex"/>
+		<bitfield name="ROTATE" low="24" high="28" type="uint"/>
+		<bitfield name="SRC1_ADD" pos="29" type="boolean"/>
+		<bitfield name="SRC1_IS_REG" pos="30" type="boolean"/>
+		<bitfield name="SRC0_IS_REG" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="SRC0" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="SRC1" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_TO_MEM" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- number of registers/dwords copied is max(CNT, 1). -->
+		<bitfield name="CNT" low="18" high="29" type="uint"/>
+		<bitfield name="64B" pos="30" type="boolean"/>
+		<bitfield name="ACCUMULATE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="DEST" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="DEST_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_TO_MEM_OFFSET_REG" width="32">
+	<doc>
+                Like CP_REG_TO_MEM, but the memory address to write to can be
+                offsetted using either one or two registers or scratch
+                registers.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- number of registers/dwords copied is max(CNT, 1). -->
+		<bitfield name="CNT" low="18" high="29" type="uint"/>
+		<bitfield name="64B" pos="30" type="boolean"/>
+		<bitfield name="ACCUMULATE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="DEST" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="DEST_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="OFFSET0" low="0" high="17" type="hex"/>
+		<bitfield name="OFFSET0_SCRATCH" pos="19" type="boolean"/>
+	</reg32>
+	<!-- followed by an optional identical OFFSET1 dword -->
+</domain>
+
+<domain name="CP_REG_TO_MEM_OFFSET_MEM" width="32">
+	<doc>
+                Like CP_REG_TO_MEM, but the memory address to write to can be
+                offsetted using a DWORD in memory.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- number of registers/dwords copied is max(CNT, 1). -->
+		<bitfield name="CNT" low="18" high="29" type="uint"/>
+		<bitfield name="64B" pos="30" type="boolean"/>
+		<bitfield name="ACCUMULATE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="DEST" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="DEST_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="OFFSET_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="OFFSET_HI" low="0" high="31" type="hex"/>
+	</reg32>
+</domain>
+
+<domain name="CP_MEM_TO_REG" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- number of registers/dwords copied is max(CNT, 1). -->
+		<bitfield name="CNT" low="19" high="29" type="uint"/>
+		<!-- shift each DWORD left by 2 while copying -->
+		<bitfield name="SHIFT_BY_2" pos="30" type="boolean"/>
+		<!-- does the same thing as CP_MEM_TO_MEM::UNK31 -->
+		<bitfield name="UNK31" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="SRC" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2" varset="chip" variants="A5XX-">
+		<bitfield name="SRC_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_MEM_TO_MEM" width="32">
+	<reg32 offset="0" name="0">
+		<!--
+		not sure how many src operands we have, but the low
+		bits negate the n'th src argument.
+		 -->
+		<bitfield name="NEG_A" pos="0" type="boolean"/>
+		<bitfield name="NEG_B" pos="1" type="boolean"/>
+		<bitfield name="NEG_C" pos="2" type="boolean"/>
+
+		<!-- if set treat src/dst as 64bit values -->
+		<bitfield name="DOUBLE" pos="29" type="boolean"/>
+		<!-- execute CP_WAIT_FOR_MEM_WRITES beforehand -->
+		<bitfield name="WAIT_FOR_MEM_WRITES" pos="30" type="boolean"/>
+		<!-- some other kind of wait -->
+		<bitfield name="UNK31" pos="31" type="boolean"/>
+	</reg32>
+	<!--
+	followed by sequence of addresses.. the first is the
+	destination and the rest are N src addresses which are
+	summed (after being negated if NEG_x bit set) allowing
+	to do things like 'result += end - start' (which turns
+	out to be useful for queries and accumulating results
+	across multiple tiles)
+	 -->
+</domain>
+
+<domain name="CP_MEMCPY" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="DWORDS" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="SRC_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="SRC_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="DST_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="DST_HI" low="0" high="31" type="hex"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_TO_SCRATCH" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<bitfield name="SCRATCH" low="20" high="22" type="uint"/>
+		<!-- number of registers/dwords copied is CNT + 1. -->
+		<bitfield name="CNT" low="24" high="26" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SCRATCH_TO_REG" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="REG" low="0" high="17" type="hex"/>
+		<!-- note: CP_MEM_TO_REG always sets this when writing to the register -->
+		<bitfield name="UNK18" pos="18" type="boolean"/>
+		<bitfield name="SCRATCH" low="20" high="22" type="uint"/>
+		<!-- number of registers/dwords copied is CNT + 1. -->
+		<bitfield name="CNT" low="24" high="26" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SCRATCH_WRITE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="SCRATCH" low="20" high="22" type="uint"/>
+	</reg32>
+	<!-- followed by one or more DWORDs to write to scratch registers -->
+</domain>
+
+<domain name="CP_MEM_WRITE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="ADDR_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_HI" low="0" high="31"/>
+	</reg32>
+	<!-- followed by the DWORDs to write -->
+</domain>
+
+<enum name="cp_cond_function">
+	<value value="0" name="WRITE_ALWAYS"/>
+	<value value="1" name="WRITE_LT"/>
+	<value value="2" name="WRITE_LE"/>
+	<value value="3" name="WRITE_EQ"/>
+	<value value="4" name="WRITE_NE"/>
+	<value value="5" name="WRITE_GE"/>
+	<value value="6" name="WRITE_GT"/>
+</enum>
+
+<domain name="CP_COND_WRITE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="FUNCTION" low="0" high="2" type="cp_cond_function"/>
+		<bitfield name="POLL_MEMORY" pos="4" type="boolean"/>
+		<bitfield name="WRITE_MEMORY" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="POLL_ADDR" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="MASK" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="WRITE_ADDR" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="WRITE_DATA" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<enum name="poll_memory_type">
+	<value value="0" name="POLL_REGISTER"/>
+	<value value="1" name="POLL_MEMORY"/>
+	<value value="2" name="POLL_SCRATCH"/>
+	<value value="3" name="POLL_ON_CHIP" varset="chip" variants="A7XX-"/>
+</enum>
+
+<domain name="CP_COND_WRITE5" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="FUNCTION" low="0" high="2" type="cp_cond_function"/>
+		<bitfield name="SIGNED_COMPARE" pos="3" type="boolean"/>
+		<!-- POLL_REGISTER polls a register at POLL_ADDR_LO. -->
+		<bitfield name="POLL" low="4" high="5" type="poll_memory_type"/>
+		<bitfield name="WRITE_MEMORY" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="POLL_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="POLL_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="MASK" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="WRITE_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<bitfield name="WRITE_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="7" name="7">
+		<bitfield name="WRITE_DATA" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_WAIT_MEM_GTE" width="32">
+        <doc>
+                Wait until a memory value is greater than or equal to the
+                reference, using signed comparison.
+	</doc>
+	<reg32 offset="0" name="0">
+		<!-- Reserved for flags, presumably? Unused in FW -->
+		<bitfield name="RESERVED" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="POLL_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="POLL_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_WAIT_REG_MEM" width="32">
+        <doc>
+                This uses the same internal comparison as CP_COND_WRITE,
+                but waits until the comparison is true instead. It busy-loops in
+                the CP for the given number of cycles before trying again.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="FUNCTION" low="0" high="2" type="cp_cond_function"/>
+		<bitfield name="SIGNED_COMPARE" pos="3" type="boolean"/>
+		<bitfield name="POLL" low="4" high="5" type="poll_memory_type"/>
+		<bitfield name="WRITE_MEMORY" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="POLL_ADDR_LO" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="POLL_ADDR_HI" low="0" high="31" type="hex"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="MASK" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="DELAY_LOOP_CYCLES" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_WAIT_TWO_REGS" width="32">
+	<doc>
+		Waits for REG0 to not be 0 or REG1 to not equal REF
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="REG0" low="0" high="17" type="hex"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="REG1" low="0" high="17" type="hex"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="REF" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_DISPATCH_COMPUTE" width="32">
+	<reg32 offset="0" name="0"/>
+	<reg32 offset="1" name="1">
+		<bitfield name="X" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="Y" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="Z" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_RENDER_MODE" width="32">
+	<enum name="render_mode_cmd">
+		<value value="1" name="BYPASS"/>
+		<value value="2" name="BINNING"/>
+		<value value="3" name="GMEM"/>
+		<value value="5" name="BLIT2D"/>
+		<!-- placeholder name.. used when CP_BLIT packets with BLIT_OP_SCALE?? -->
+		<value value="7" name="BLIT2DSCALE"/>
+		<!-- 8 set before going back to BYPASS exiting 2D -->
+		<value value="8" name="END2D"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="MODE" low="0" high="8" type="render_mode_cmd"/>
+		<!--
+		normally 0x1/0x3, sometimes see 0x5/0x8 with unknown registers in
+		0x21xx range.. possibly (at least some) a5xx variants have a
+		2d core?
+		 -->
+	</reg32>
+	<!-- I think first buffer is for GPU to save context in case of ctx switch? -->
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ADDR_0_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!--
+		set when in GMEM.. maybe indicates GMEM contents need to be
+		preserved on ctx switch?
+		 -->
+		<bitfield name="VSC_ENABLE" pos="3" type="boolean"/>
+		<bitfield name="GMEM_ENABLE" pos="4" type="boolean"/>
+	</reg32>
+	<reg32 offset="4" name="4"/>
+	<!-- second buffer looks like some cmdstream.. length in dwords: -->
+	<reg32 offset="5" name="5">
+		<bitfield name="ADDR_1_LEN" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<bitfield name="ADDR_1_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="7" name="7">
+		<bitfield name="ADDR_1_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<!-- this looks fairly similar to CP_SET_RENDER_MODE minus first dword -->
+<domain name="CP_COMPUTE_CHECKPOINT" width="32">
+	<!-- I think first buffer is for GPU to save context in case of ctx switch? -->
+	<reg32 offset="0" name="0">
+		<bitfield name="ADDR_0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_0_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+	</reg32>
+	<reg32 offset="3" name="3"/>
+	<!-- second buffer looks like some cmdstream.. length in dwords: -->
+	<reg32 offset="4" name="4">
+		<bitfield name="ADDR_1_LEN" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="ADDR_1_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="6" name="6">
+		<bitfield name="ADDR_1_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="7" name="7"/>
+</domain>
+
+<domain name="CP_PERFCOUNTER_ACTION" width="32">
+	<reg32 offset="0" name="0">
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ADDR_0_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain varset="chip" name="CP_EVENT_WRITE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="EVENT" low="0" high="7" type="vgt_event_type"/>
+		<!-- when set, write back timestamp instead of value from packet: -->
+		<bitfield name="TIMESTAMP" pos="30" type="boolean"/>
+		<bitfield name="IRQ" pos="31" type="boolean"/>
+	</reg32>
+	<!--
+	TODO what is gpuaddr for, seems to be all 0's.. maybe needed for
+	context switch?
+	 -->
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ADDR_0_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<!-- ??? -->
+	</reg32>
+</domain>
+
+<domain varset="chip" name="CP_EVENT_WRITE7" width="32">
+	<enum name="event_write_src">
+		<!-- Write payload[0] -->
+		<value value="0" name="EV_WRITE_USER_32B"/>
+		<!-- Write payload[0] payload[1] -->
+		<value value="1" name="EV_WRITE_USER_64B"/>
+		<!-- Write (TIMESTAMP_GLOBAL + TIMESTAMP_LOCAL) -->
+		<value value="2" name="EV_WRITE_TIMESTAMP_SUM"/>
+		<value value="3" name="EV_WRITE_ALWAYSON"/>
+		<!-- Write payload[1] regs starting at payload[0] offset -->
+		<value value="4" name="EV_WRITE_REGS_CONTENT"/>
+	</enum>
+
+	<enum name="event_write_dst">
+		<value value="0" name="EV_DST_RAM"/>
+		<value value="1" name="EV_DST_ONCHIP"/>
+	</enum>
+
+	<reg32 offset="0" name="0">
+		<bitfield name="EVENT" low="0" high="7" type="vgt_event_type"/>
+		<bitfield name="WRITE_SAMPLE_COUNT" pos="12" type="boolean"/>
+		<!-- Write sample count at (iova + 16) -->
+		<bitfield name="SAMPLE_COUNT_END_OFFSET" pos="13" type="boolean"/>
+		<!-- *(iova + 8) = *(iova + 16) - *iova -->
+		<bitfield name="WRITE_SAMPLE_COUNT_DIFF" pos="14" type="boolean"/>
+
+		<!-- Next 4 flags are valid to set only when concurrent binning is enabled -->
+		<!-- Increment 16b BV counter. Valid only in BV pipe -->
+		<bitfield name="INC_BV_COUNT" pos="16" type="boolean"/>
+		<!-- Increment 16b BR counter. Valid only in BR pipe -->
+		<bitfield name="INC_BR_COUNT" pos="17" type="boolean"/>
+		<bitfield name="CLEAR_RENDER_RESOURCE" pos="18" type="boolean"/>
+		<bitfield name="CLEAR_LRZ_RESOURCE" pos="19" type="boolean"/>
+
+		<bitfield name="WRITE_SRC" low="20" high="22" type="event_write_src"/>
+		<bitfield name="WRITE_DST" pos="24" type="event_write_dst" addvariant="yes"/>
+		<!-- Writes into WRITE_DST from WRITE_SRC. RB_DONE_TS requires WRITE_ENABLED. -->
+		<bitfield name="WRITE_ENABLED" pos="27" type="boolean"/>
+	</reg32>
+
+	<stripe varset="event_write_dst" variants="EV_DST_RAM">
+		<reg32 offset="1" name="1">
+			<bitfield name="ADDR_0_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="ADDR_0_HI" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="3" name="3">
+			<bitfield name="PAYLOAD_0" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="4" name="4">
+			<bitfield name="PAYLOAD_1" low="0" high="31"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="event_write_dst" variants="EV_DST_ONCHIP">
+		<reg32 offset="1" name="1">
+			<bitfield name="ONCHIP_ADDR_0" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="3" name="3">
+			<bitfield name="PAYLOAD_0" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="4" name="4">
+			<bitfield name="PAYLOAD_1" low="0" high="31"/>
+		</reg32>
+	</stripe>
+</domain>
+
+<domain name="CP_BLIT" width="32">
+	<enum name="cp_blit_cmd">
+		<value value="0" name="BLIT_OP_FILL"/>
+		<value value="1" name="BLIT_OP_COPY"/>
+		<value value="3" name="BLIT_OP_SCALE"/> <!-- used for mipmap generation -->
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="OP" low="0" high="3" type="cp_blit_cmd"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="SRC_X1" low="0" high="13" type="uint"/>
+		<bitfield name="SRC_Y1" low="16" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="SRC_X2" low="0" high="13" type="uint"/>
+		<bitfield name="SRC_Y2" low="16" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="DST_X1" low="0" high="13" type="uint"/>
+		<bitfield name="DST_Y1" low="16" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="DST_X2" low="0" high="13" type="uint"/>
+		<bitfield name="DST_Y2" low="16" high="29" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_EXEC_CS" width="32">
+	<reg32 offset="0" name="0">
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="NGROUPS_X" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="NGROUPS_Y" low="0" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="NGROUPS_Z" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_EXEC_CS_INDIRECT" width="32" varset="chip" prefix="chip" variants="A4XX-">
+	<reg32 offset="0" name="0">
+	</reg32>
+	<stripe varset="chip" variants="A4XX">
+		<reg32 offset="1" name="1">
+			<bitfield name="ADDR" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<!-- localsize is value minus one: -->
+			<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+			<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+			<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+		</reg32>
+	</stripe>
+	<stripe varset="chip" variants="A5XX-">
+		<reg32 offset="1" name="1">
+			<bitfield name="ADDR_LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="ADDR_HI" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="3" name="3">
+			<!-- localsize is value minus one: -->
+			<bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+			<bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+			<bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+		</reg32>
+	</stripe>
+</domain>
+
+<domain name="CP_SET_MARKER" width="32" varset="chip" prefix="chip" variants="A6XX-">
+	<doc>Tell CP the current operation mode, indicates save and restore procedure</doc>
+	<enum name="a6xx_marker">
+		<value value="1" name="RM6_BYPASS"/>
+		<value value="2" name="RM6_BINNING"/>
+		<value value="4" name="RM6_GMEM"/>
+		<value value="5" name="RM6_ENDVIS"/>
+		<value value="6" name="RM6_RESOLVE"/>
+		<value value="7" name="RM6_YIELD"/>
+		<value value="8" name="RM6_COMPUTE"/>
+		<value value="0xc" name="RM6_BLIT2DSCALE"/>  <!-- no-op (at least on current sqe fw) -->
+
+		<!--
+			These values come from a6xx_set_marker() in the
+			downstream kernel, and they can only be set by the kernel
+		-->
+		<value value="0xd" name="RM6_IB1LIST_START"/>
+		<value value="0xe" name="RM6_IB1LIST_END"/>
+		<!-- IFPC - inter-frame power collapse -->
+		<value value="0x100" name="RM6_IFPC_ENABLE"/>
+		<value value="0x101" name="RM6_IFPC_DISABLE"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<!--
+			NOTE: blob driver and some versions of freedreno/turnip set
+			b4, which is unused (at least by current sqe fw), but interferes
+			with parsing if we extend the size of the bitfield to include
+			b8 (only sent by kernel mode driver).  Really, the way the
+			parsing works in the firmware, only b0-b3 are considered, but
+			if b8 is set, the low bits are interpreted differently.  To
+			model this, without getting confused by spurious b4, this is
+			described as two overlapping bitfields:
+		 -->
+		<bitfield name="MODE" low="0" high="8" type="a6xx_marker"/>
+		<bitfield name="MARKER" low="0" high="3" type="a6xx_marker"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_PSEUDO_REG" width="32" varset="chip" prefix="chip" variants="A6XX-">
+	<doc>Set internal CP registers, used to indicate context save data addresses</doc>
+	<enum name="pseudo_reg">
+		<value value="0" name="SMMU_INFO"/>
+		<value value="1" name="NON_SECURE_SAVE_ADDR"/>
+		<value value="2" name="SECURE_SAVE_ADDR"/>
+		<value value="3" name="NON_PRIV_SAVE_ADDR"/>
+		<value value="4" name="COUNTER"/>
+
+		<!--
+			On a6xx the registers are set directly and CP_SET_BIN_DATA5_OFFSET reads them,
+			but that doesn't work with concurrent binning because BR will be reading from
+			a different set of streams than BV is writing, so on a7xx we have these
+			pseudo-regs instead, which do the right thing.
+
+			The corresponding VSC registers exist, and they're written by BV when it
+			encounters CP_SET_PSEUDO_REG. When BR later encounters the same CP_SET_PSEUDO_REG
+			it will only write some private scratch registers which are read by
+			CP_SET_BIN_DATA5_OFFSET.
+
+			If concurrent binning is disabled then BR also does binning so it will also
+			write the "real" registers in BR.
+		-->
+		<value value="8" name="DRAW_STRM_ADDRESS"/>
+		<value value="9" name="DRAW_STRM_SIZE_ADDRESS"/>
+		<value value="10" name="PRIM_STRM_ADDRESS"/>
+		<value value="11" name="UNK_STRM_ADDRESS"/>
+		<value value="12" name="UNK_STRM_SIZE_ADDRESS"/>
+
+		<value value="16" name="BINDLESS_BASE_0_ADDR"/>
+		<value value="17" name="BINDLESS_BASE_1_ADDR"/>
+		<value value="18" name="BINDLESS_BASE_2_ADDR"/>
+		<value value="19" name="BINDLESS_BASE_3_ADDR"/>
+		<value value="20" name="BINDLESS_BASE_4_ADDR"/>
+		<value value="21" name="BINDLESS_BASE_5_ADDR"/>
+		<value value="22" name="BINDLESS_BASE_6_ADDR"/>
+	</enum>
+	<array offset="0" stride="3" length="100">
+		<reg32 offset="0" name="0">
+			<bitfield name="PSEUDO_REG" low="0" high="10" type="pseudo_reg"/>
+		</reg32>
+		<reg32 offset="1" name="1">
+			<bitfield name="LO" low="0" high="31"/>
+		</reg32>
+		<reg32 offset="2" name="2">
+			<bitfield name="HI" low="0" high="31"/>
+		</reg32>
+	</array>
+</domain>
+
+<domain name="CP_REG_TEST" width="32" varset="chip" prefix="chip" variants="A6XX-">
+	<doc>
+		Tests bit in specified register and sets predicate for CP_COND_REG_EXEC.
+		So:
+
+			opcode: CP_REG_TEST (39) (2 dwords)
+			        { REG = 0xc10 | BIT = 0 }
+			               0000: 70b90001 00000c10
+			opcode: CP_COND_REG_EXEC (47) (3 dwords)
+			               0000: 70c70002 10000000 00000004
+			opcode: CP_INDIRECT_BUFFER (3f) (4 dwords)
+
+		Will execute the CP_INDIRECT_BUFFER only if b0 in the register at
+		offset 0x0c10 is 1
+	</doc>
+	<enum name="source_type">
+		<value value="0" name="SOURCE_REG"/>
+		<!-- Don't confuse with scratch registers, this is a separate memory
+			 written into by CP_MEM_TO_SCRATCH_MEM. -->
+		<value value="1" name="SOURCE_SCRATCH_MEM" varset="chip" variants="A7XX-"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<!-- the register to test -->
+		<bitfield name="REG" low="0" high="17" varset="source_type" variants="SOURCE_REG"/>
+		<bitfield name="SCRATCH_MEM_OFFSET" low="0" high="17" varset="source_type" variants="SOURCE_SCRATCH_MEM"/>
+		<bitfield name="SOURCE" pos="18" type="source_type" addvariant="yes"/>
+		<!-- the bit to test -->
+		<bitfield name="BIT" low="20" high="24" type="uint"/>
+		<!-- skip implied CP_WAIT_FOR_ME -->
+		<bitfield name="SKIP_WAIT_FOR_ME" pos="25" type="boolean"/>
+		<!-- the predicate bit to set (new in gen3+) -->
+		<bitfield name="PRED_BIT" low="26" high="30" type="uint"/>
+		<!-- update the predicate reg directly (new in gen3+) -->
+		<bitfield name="PRED_UPDATE" pos="31" type="boolean"/>
+	</reg32>
+
+        <!--
+		In PRED_UPDATE mode, the predicate reg is updated directly using two
+		more dwords, ignoring other bits:
+
+			PRED_REG = (PRED_REG & ~PRED_MASK) | (PRED_VAL & PRED_MASK);
+	-->
+	<reg32 offset="1" name="PRED_MASK" type="hex"/>
+	<reg32 offset="2" name="PRED_VAL" type="hex"/>
+</domain>
+
+<!-- I *think* this existed at least as far back as a4xx -->
+<domain name="CP_COND_REG_EXEC" width="32">
+	<enum name="compare_mode">
+		<!-- use the predicate bit set by CP_REG_TEST -->
+		<value value="1" name="PRED_TEST"/>
+		<!-- compare two registers directly for equality -->
+		<value value="2" name="REG_COMPARE"/>
+		<!-- test if certain render modes are set via CP_SET_MARKER -->
+		<value value="3" name="RENDER_MODE" varset="chip" variants="A6XX-"/>
+		<!-- compare REG0 for equality with immediate -->
+		<value value="4" name="REG_COMPARE_IMM" varset="chip" variants="A7XX-"/>
+		<!-- test which of BR/BV are enabled -->
+		<value value="5" name="THREAD_MODE" varset="chip" variants="A7XX-"/>
+	</enum>
+	<reg32 offset="0" name="0" varset="compare_mode">
+		<bitfield name="REG0" low="0" high="17" variants="REG_COMPARE" type="hex"/>
+
+		<!-- the predicate bit to test (new in gen3+) -->
+		<bitfield name="PRED_BIT" low="18" high="22" variants="PRED_TEST" type="uint"/>
+		<bitfield name="SKIP_WAIT_FOR_ME" pos="23" varset="chip" variants="A7XX-" type="boolean"/>
+		<!-- With REG_COMPARE instead of register read from ONCHIP memory -->
+		<bitfield name="ONCHIP_MEM" pos="24" varset="chip" variants="A7XX-" type="boolean"/>
+
+		<!--
+			Note: these bits have the same meaning, and use the same
+			internal mechanism as the bits in CP_SET_DRAW_STATE.
+			When RENDER_MODE is selected, they're used as
+			a bitmask of which modes pass the test.
+		-->
+
+		<!-- RM6_BINNING -->
+		<bitfield name="BINNING" pos="25" variants="RENDER_MODE" type="boolean"/>
+		<!-- all others -->
+		<bitfield name="GMEM" pos="26" variants="RENDER_MODE" type="boolean"/>
+		<!-- RM6_BYPASS -->
+		<bitfield name="SYSMEM" pos="27" variants="RENDER_MODE" type="boolean"/>
+
+		<bitfield name="BV" pos="25" variants="THREAD_MODE" type="boolean"/>
+		<bitfield name="BR" pos="26" variants="THREAD_MODE" type="boolean"/>
+		<bitfield name="LPAC" pos="27" variants="THREAD_MODE" type="boolean"/>
+
+		<bitfield name="MODE" low="28" high="31" type="compare_mode" addvariant="yes"/>
+	</reg32>
+
+	<stripe varset="compare_mode" variants="PRED_TEST">
+		<reg32 offset="1" name="1">
+			<bitfield name="DWORDS" low="0" high="23" type="uint"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="compare_mode" variants="REG_COMPARE">
+		<reg32 offset="1" name="1">
+			<bitfield name="REG1" low="0" high="17" type="hex"/>
+			<!-- Instead of register read from ONCHIP memory -->
+			<bitfield name="ONCHIP_MEM" pos="24" varset="chip" variants="A7XX-" type="boolean"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="compare_mode" variants="RENDER_MODE">
+		<reg32 offset="1" name="1">
+			<bitfield name="DWORDS" low="0" high="23" type="uint"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="compare_mode" variants="REG_COMPARE_IMM">
+		<reg32 offset="1" name="1">
+			<bitfield name="IMM" low="0" high="31"/>
+		</reg32>
+	</stripe>
+
+	<stripe varset="compare_mode" variants="THREAD_MODE">
+		<reg32 offset="1" name="1">
+			<bitfield name="DWORDS" low="0" high="23" type="uint"/>
+		</reg32>
+	</stripe>
+
+	<reg32 offset="2" name="2">
+		<bitfield name="DWORDS" low="0" high="23" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_COND_EXEC" width="32">
+	<doc>
+                Executes the following DWORDs of commands if the dword at ADDR0
+                is not equal to 0 and the dword at ADDR1 is less than REF
+                (signed comparison).
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="ADDR0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR0_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="ADDR1_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="ADDR1_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="4" name="4">
+		<bitfield name="REF" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="5" name="5">
+		<bitfield name="DWORDS" low="0" high="31" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_SET_AMBLE" width="32">
+	<doc>
+                Used by the userspace and kernel drivers to set various IB's
+                which are executed during context save/restore for handling
+                state that isn't restored by the context switch routine itself.
+  </doc>
+	<enum name="amble_type">
+		<value name="PREAMBLE_AMBLE_TYPE" value="0">
+			<doc>Executed unconditionally when switching back to the context.</doc>
+		</value>
+		<value name="BIN_PREAMBLE_AMBLE_TYPE" value="1">
+                        <doc>
+				Executed when switching back after switching
+				away during execution of
+				a CP_SET_MARKER packet with RM6_BIN_RENDER_END as the
+				payload *and* skipsaverestore is set. This is
+				expected to restore static register values not
+				saved when skipsaverestore is set.
+			</doc>
+		</value>
+		<value name="POSTAMBLE_AMBLE_TYPE" value="2">
+                        <doc>
+				Executed when switching away from the context,
+				except for context switches initiated via
+				CP_YIELD.
+                        </doc>
+		</value>
+		<value name="KMD_AMBLE_TYPE" value="3">
+			<doc>
+				This can only be set by the RB (i.e. the kernel)
+				and executes with protected mode off, but
+				is otherwise similar to POSTAMBLE_AMBLE_TYPE.
+			</doc>
+		</value>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="ADDR_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="ADDR_HI" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="DWORDS" low="0" high="19" type="uint"/>
+		<bitfield name="TYPE" low="20" high="21" type="amble_type"/>
+	</reg32>
+</domain>
+
+<domain name="CP_REG_WRITE" width="32">
+	<enum name="reg_tracker">
+		<doc>
+			Keep shadow copies of these registers and only set them
+			when drawing, avoiding redundant writes:
+			- VPC_CNTL_0
+			- HLSQ_CONTROL_1_REG
+			- HLSQ_UNKNOWN_B980
+		</doc>
+		<value name="TRACK_CNTL_REG" value="0x1"/>
+		<doc>
+			Track RB_RENDER_CNTL, and insert a WFI in the following
+			situation:
+			- There is a write that disables binning
+			- There was a draw with binning left enabled, but in
+			  BYPASS mode
+			Presumably this is a hang workaround?
+		</doc>
+		<value name="TRACK_RENDER_CNTL" value="0x2"/>
+		<doc>
+			Do a mysterious CP_EVENT_WRITE 0x3f when the low bit of
+			the data to write is 0. Used by the Vulkan blob with
+			PC_MULTIVIEW_CNTL, but this isn't predicated on particular
+			register(s) like the others.
+		</doc>
+		<value name="UNK_EVENT_WRITE" value="0x4"/>
+		<doc>
+			Tracks GRAS_LRZ_CNTL::GREATER, GRAS_LRZ_CNTL::DIR, and
+			GRAS_LRZ_DEPTH_VIEW with previous values, and if one of
+			the following is true:
+			- GRAS_LRZ_CNTL::GREATER has changed
+			- GRAS_LRZ_CNTL::DIR has changed, the old value is not
+			  CUR_DIR_GE, and the new value is not CUR_DIR_DISABLED
+			- GRAS_LRZ_DEPTH_VIEW has changed
+			then it does a LRZ_FLUSH with GRAS_LRZ_CNTL::ENABLE
+			forced to 1.
+			Only exists in a650_sqe.fw.
+		</doc>
+		<value name="TRACK_LRZ" value="0x8"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="TRACKER" low="0" high="3" type="reg_tracker"/>
+	</reg32>
+	<reg32 offset="1" name="1"/>
+	<reg32 offset="2" name="2"/>
+</domain>
+
+<domain name="CP_SMMU_TABLE_UPDATE" width="32">
+	<doc>
+		Note that the SMMU's definition of TTBRn can take different forms
+		depending on the pgtable format.  But a5xx+ only uses aarch64
+		format.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="TTBR0_LO" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="TTBR0_HI" low="0" high="15"/>
+		<bitfield name="ASID" low="16" high="31"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<doc>Unused, does not apply to aarch64 pgtable format</doc>
+		<bitfield name="CONTEXTIDR" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="CONTEXTBANK" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_START_BIN" width="32">
+	<reg32 offset="0" name="BIN_COUNT" type="uint"/>
+	<reg64 offset="1" name="PREFIX_ADDR" type="address"/>
+	<reg32 offset="3" name="PREFIX_DWORDS">
+		<doc>
+			Size of prefix for each bin. For each bin index i, the
+			prefix commands at PREFIX_ADDR + i * PREFIX_DWORDS are
+			executed in an IB2 before the IB1 commands following
+			this packet.
+		</doc>
+	</reg32>
+	<reg32 offset="4" name="BODY_DWORDS">
+		<doc>Number of dwords after this packet until CP_END_BIN</doc>
+	</reg32>
+</domain>
+
+<domain name="CP_WAIT_TIMESTAMP" width="32">
+	<enum name="ts_wait_value_src">
+		<!-- Wait for value at memory address to be >= SRC_0 (signed comparison) -->
+		<value value="0" name="TS_WAIT_GE_32B"/>
+		<!-- Wait for value at memory address to be >= SRC_0 (unsigned) -->
+		<value value="1" name="TS_WAIT_GE_64B"/>
+		<!-- Write (TIMESTAMP_GLOBAL + TIMESTAMP_LOCAL) -->
+		<value value="2" name="TS_WAIT_GE_TIMESTAMP_SUM"/>
+	</enum>
+
+	<enum name="ts_wait_type">
+		<value value="0" name="TS_WAIT_RAM"/>
+		<value value="1" name="TS_WAIT_ONCHIP"/>
+	</enum>
+
+	<reg32 offset="0" name="0">
+		<bitfield name="WAIT_VALUE_SRC" low="0" high="1" type="ts_wait_value_src"/>
+		<bitfield name="WAIT_DST" pos="4" type="ts_wait_type" addvariant="yes"/>
+	</reg32>
+
+	<stripe varset="ts_wait_type" variants="TS_WAIT_RAM">
+		<reg64 offset="1" name="ADDR" type="address"/>
+	</stripe>
+
+	<stripe varset="ts_wait_type" variants="TS_WAIT_ONCHIP">
+		<reg32 offset="1" name="ONCHIP_ADDR_0" low="0" high="31"/>
+	</stripe>
+
+	<reg32 offset="3" name="SRC_0"/>
+	<reg32 offset="4" name="SRC_1"/>
+</domain>
+
+<domain name="CP_BV_BR_COUNT_OPS" width="32">
+	<enum name="pipe_count_op">
+		<value name="PIPE_CLEAR_BV_BR" value="0x1"/>
+		<value name="PIPE_SET_BR_OFFSET" value="0x2"/>
+		<!-- Wait until for BV_counter > BR_counter -->
+		<value name="PIPE_BR_WAIT_FOR_BV" value="0x3"/>
+		<!-- Wait until (BR_counter + BR_OFFSET) > BV_counter -->
+		<value name="PIPE_BV_WAIT_FOR_BR" value="0x4"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="OP" low="0" high="3" type="pipe_count_op"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<bitfield name="BR_OFFSET" low="0" high="15" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="CP_MODIFY_TIMESTAMP" width="32">
+	<enum name="timestamp_op">
+		<value name="MODIFY_TIMESTAMP_CLEAR" value="0"/>
+		<value name="MODIFY_TIMESTAMP_ADD_GLOBAL" value="1"/>
+		<value name="MODIFY_TIMESTAMP_ADD_LOCAL" value="2"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield name="ADD" low="0" high="7" type="uint"/>
+		<bitfield name="OP" low="28" high="31" type="timestamp_op"/>
+	</reg32>
+</domain>
+
+<domain name="CP_MEM_TO_SCRATCH_MEM" width="32">
+	<doc>
+		Best guess is that it is a faster way to fetch all the VSC_STATE registers
+		and keep them in a local scratch memory instead of fetching every time
+		when skipping IBs.
+	</doc>
+	<reg32 offset="0" name="0">
+		<bitfield name="CNT" low="0" high="5" type="uint"/>
+	</reg32>
+	<reg32 offset="1" name="1">
+		<doc>Scratch memory size is 48 dwords`</doc>
+		<bitfield name="OFFSET" low="0" high="5" type="uint"/>
+	</reg32>
+	<reg32 offset="2" name="2">
+		<bitfield name="SRC" low="0" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="SRC_HI" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_THREAD_CONTROL" width="32">
+	<enum name="cp_thread">
+		<value name="CP_SET_THREAD_BR" value="1"/>    <!-- Render -->
+		<value name="CP_SET_THREAD_BV" value="2"/>    <!-- Visibility -->
+		<value name="CP_SET_THREAD_BOTH" value="3"/>
+	</enum>
+	<reg32 offset="0" name="0">
+		<bitfield low="0" high="1" name="THREAD" type="cp_thread"/>
+		<bitfield pos="27" name="CONCURRENT_BIN_DISABLE" type="boolean"/>
+		<bitfield pos="31" name="SYNC_THREADS" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="CP_FIXED_STRIDE_DRAW_TABLE" width="32">
+	<reg64 offset="0" name="IB_BASE"/>
+	<reg32 offset="2" name="2">
+		<!-- STRIDE * COUNT -->
+		<bitfield name="IB_SIZE" low="0" high="11"/>
+		<bitfield name="STRIDE" low="20" high="31"/>
+	</reg32>
+	<reg32 offset="3" name="3">
+		<bitfield name="COUNT" low="0" high="31"/>
+	</reg32>
+</domain>
+
+<domain name="CP_RESET_CONTEXT_STATE" width="32">
+	<reg32 offset="0" name="0">
+		<bitfield name="CLEAR_ON_CHIP_TS" pos="0" type="boolean"/>
+		<bitfield name="CLEAR_RESOURCE_TABLE" pos="1" type="boolean"/>
+		<bitfield name="CLEAR_GLOBAL_LOCAL_TS" pos="2" type="boolean"/>
+	</reg32>
+</domain>
+
+</database>
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/dsi.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/dsi.xml
@@ -0,0 +1,390 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI" width="32">
+	<enum name="dsi_traffic_mode">
+		<value name="NON_BURST_SYNCH_PULSE" value="0"/>
+		<value name="NON_BURST_SYNCH_EVENT" value="1"/>
+		<value name="BURST_MODE" value="2"/>
+	</enum>
+	<enum name="dsi_vid_dst_format">
+		<value name="VID_DST_FORMAT_RGB565" value="0"/>
+		<value name="VID_DST_FORMAT_RGB666" value="1"/>
+		<value name="VID_DST_FORMAT_RGB666_LOOSE" value="2"/>
+		<value name="VID_DST_FORMAT_RGB888" value="3"/>
+	</enum>
+	<enum name="dsi_rgb_swap">
+		<value name="SWAP_RGB" value="0"/>
+		<value name="SWAP_RBG" value="1"/>
+		<value name="SWAP_BGR" value="2"/>
+		<value name="SWAP_BRG" value="3"/>
+		<value name="SWAP_GRB" value="4"/>
+		<value name="SWAP_GBR" value="5"/>
+	</enum>
+	<enum name="dsi_cmd_trigger">
+		<value name="TRIGGER_NONE" value="0"/>
+		<value name="TRIGGER_SEOF" value="1"/>
+		<value name="TRIGGER_TE" value="2"/>
+		<value name="TRIGGER_SW" value="4"/>
+		<value name="TRIGGER_SW_SEOF" value="5"/>
+		<value name="TRIGGER_SW_TE" value="6"/>
+	</enum>
+	<enum name="dsi_cmd_dst_format">
+		<value name="CMD_DST_FORMAT_RGB111" value="0"/>
+		<value name="CMD_DST_FORMAT_RGB332" value="3"/>
+		<value name="CMD_DST_FORMAT_RGB444" value="4"/>
+		<value name="CMD_DST_FORMAT_RGB565" value="6"/>
+		<value name="CMD_DST_FORMAT_RGB666" value="7"/>
+		<value name="CMD_DST_FORMAT_RGB888" value="8"/>
+	</enum>
+	<enum name="dsi_lane_swap">
+		<value name="LANE_SWAP_0123" value="0"/>
+		<value name="LANE_SWAP_3012" value="1"/>
+		<value name="LANE_SWAP_2301" value="2"/>
+		<value name="LANE_SWAP_1230" value="3"/>
+		<value name="LANE_SWAP_0321" value="4"/>
+		<value name="LANE_SWAP_1032" value="5"/>
+		<value name="LANE_SWAP_2103" value="6"/>
+		<value name="LANE_SWAP_3210" value="7"/>
+	</enum>
+		<enum name="video_config_bpp">
+		<value name="VIDEO_CONFIG_18BPP" value="0"/>
+		<value name="VIDEO_CONFIG_24BPP" value="1"/>
+	</enum>
+	<enum name="video_pattern_sel">
+		<value name="VID_PRBS" value="0"/>
+		<value name="VID_INCREMENTAL" value="1"/>
+		<value name="VID_FIXED" value="2"/>
+		<value name="VID_MDSS_GENERAL_PATTERN" value="3"/>
+	</enum>
+	<enum name="cmd_mdp_stream0_pattern_sel">
+		<value name="CMD_MDP_PRBS" value="0"/>
+		<value name="CMD_MDP_INCREMENTAL" value="1"/>
+		<value name="CMD_MDP_FIXED" value="2"/>
+		<value name="CMD_MDP_MDSS_GENERAL_PATTERN" value="3"/>
+	</enum>
+	<enum name="cmd_dma_pattern_sel">
+		<value name="CMD_DMA_PRBS" value="0"/>
+		<value name="CMD_DMA_INCREMENTAL" value="1"/>
+		<value name="CMD_DMA_FIXED" value="2"/>
+		<value name="CMD_DMA_CUSTOM_PATTERN_DMA_FIFO" value="3"/>
+	</enum>
+	<bitset name="DSI_IRQ">
+		<bitfield name="CMD_DMA_DONE" pos="0" type="boolean"/>
+		<bitfield name="MASK_CMD_DMA_DONE" pos="1" type="boolean"/>
+		<bitfield name="CMD_MDP_DONE" pos="8" type="boolean"/>
+		<bitfield name="MASK_CMD_MDP_DONE" pos="9" type="boolean"/>
+		<bitfield name="VIDEO_DONE" pos="16" type="boolean"/>
+		<bitfield name="MASK_VIDEO_DONE" pos="17" type="boolean"/>
+		<bitfield name="BTA_DONE" pos="20" type="boolean"/>
+		<bitfield name="MASK_BTA_DONE" pos="21" type="boolean"/>
+		<bitfield name="ERROR" pos="24" type="boolean"/>
+		<bitfield name="MASK_ERROR" pos="25" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x00000" name="6G_HW_VERSION">
+		<bitfield name="MAJOR" low="28" high="31" type="uint"/>
+		<bitfield name="MINOR" low="16" high="27" type="uint"/>
+		<bitfield name="STEP" low="0" high="15" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00000" name="CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="VID_MODE_EN" pos="1" type="boolean"/>
+		<bitfield name="CMD_MODE_EN" pos="2" type="boolean"/>
+		<bitfield name="LANE0" pos="4" type="boolean"/>
+		<bitfield name="LANE1" pos="5" type="boolean"/>
+		<bitfield name="LANE2" pos="6" type="boolean"/>
+		<bitfield name="LANE3" pos="7" type="boolean"/>
+		<bitfield name="CLK_EN" pos="8" type="boolean"/>
+		<bitfield name="ECC_CHECK" pos="20" type="boolean"/>
+		<bitfield name="CRC_CHECK" pos="24" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00004" name="STATUS0">
+		<bitfield name="CMD_MODE_ENGINE_BUSY" pos="0" type="boolean"/>
+		<bitfield name="CMD_MODE_DMA_BUSY" pos="1" type="boolean"/>
+		<bitfield name="CMD_MODE_MDP_BUSY" pos="2" type="boolean"/>
+		<bitfield name="VIDEO_MODE_ENGINE_BUSY" pos="3" type="boolean"/>
+		<bitfield name="DSI_BUSY" pos="4" type="boolean"/>  <!-- see mipi_dsi_cmd_bta_sw_trigger() -->
+		<bitfield name="INTERLEAVE_OP_CONTENTION" pos="31" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00008" name="FIFO_STATUS">
+		<bitfield name="VIDEO_MDP_FIFO_OVERFLOW" pos="0" type="boolean"/>
+		<bitfield name="VIDEO_MDP_FIFO_UNDERFLOW" pos="3" type="boolean"/>
+		<bitfield name="CMD_MDP_FIFO_UNDERFLOW" pos="7" type="boolean"/>
+		<bitfield name="CMD_DMA_FIFO_RD_WATERMARK_REACH" pos="8" type="boolean"/>
+		<bitfield name="CMD_DMA_FIFO_WR_WATERMARK_REACH" pos="9" type="boolean"/>
+		<bitfield name="CMD_DMA_FIFO_UNDERFLOW" pos="10" type="boolean"/>
+		<bitfield name="DLN0_LP_FIFO_EMPTY"     pos="12" type="boolean"/>
+		<bitfield name="DLN0_LP_FIFO_FULL"      pos="13" type="boolean"/>
+		<bitfield name="DLN0_LP_FIFO_OVERFLOW"  pos="14" type="boolean"/>
+		<bitfield name="DLN0_HS_FIFO_EMPTY"     pos="16" type="boolean"/>
+		<bitfield name="DLN0_HS_FIFO_FULL"      pos="17" type="boolean"/>
+		<bitfield name="DLN0_HS_FIFO_OVERFLOW"  pos="18" type="boolean"/>
+		<bitfield name="DLN0_HS_FIFO_UNDERFLOW" pos="19" type="boolean"/>
+		<bitfield name="DLN1_HS_FIFO_EMPTY"     pos="20" type="boolean"/>
+		<bitfield name="DLN1_HS_FIFO_FULL"      pos="21" type="boolean"/>
+		<bitfield name="DLN1_HS_FIFO_OVERFLOW"  pos="22" type="boolean"/>
+		<bitfield name="DLN1_HS_FIFO_UNDERFLOW" pos="23" type="boolean"/>
+		<bitfield name="DLN2_HS_FIFO_EMPTY"     pos="24" type="boolean"/>
+		<bitfield name="DLN2_HS_FIFO_FULL"      pos="25" type="boolean"/>
+		<bitfield name="DLN2_HS_FIFO_OVERFLOW"  pos="26" type="boolean"/>
+		<bitfield name="DLN2_HS_FIFO_UNDERFLOW" pos="27" type="boolean"/>
+		<bitfield name="DLN3_HS_FIFO_EMPTY"     pos="28" type="boolean"/>
+		<bitfield name="DLN3_HS_FIFO_FULL"      pos="29" type="boolean"/>
+		<bitfield name="DLN3_HS_FIFO_OVERFLOW"  pos="30" type="boolean"/>
+		<bitfield name="DLN3_HS_FIFO_UNDERFLOW" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0000c" name="VID_CFG0">
+		<bitfield name="VIRT_CHANNEL" low="0" high="1" type="uint"/>  <!-- always zero? -->
+		<bitfield name="DST_FORMAT" low="4" high="5" type="dsi_vid_dst_format"/>
+		<bitfield name="TRAFFIC_MODE" low="8" high="9" type="dsi_traffic_mode"/>
+		<bitfield name="BLLP_POWER_STOP" pos="12" type="boolean"/>
+		<bitfield name="EOF_BLLP_POWER_STOP" pos="15" type="boolean"/>
+		<bitfield name="HSA_POWER_STOP" pos="16" type="boolean"/>
+		<bitfield name="HBP_POWER_STOP" pos="20" type="boolean"/>
+		<bitfield name="HFP_POWER_STOP" pos="24" type="boolean"/>
+		<bitfield name="DATABUS_WIDEN" pos="25" type="boolean"/>
+		<bitfield name="PULSE_MODE_HSA_HE" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0001c" name="VID_CFG1">
+		<bitfield name="R_SEL" pos="0" type="boolean"/>
+		<bitfield name="G_SEL" pos="4" type="boolean"/>
+		<bitfield name="B_SEL" pos="8" type="boolean"/>
+		<bitfield name="RGB_SWAP" low="12" high="14" type="dsi_rgb_swap"/>
+	</reg32>
+	<reg32 offset="0x00020" name="ACTIVE_H">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00024" name="ACTIVE_V">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00028" name="TOTAL">
+		<bitfield name="H_TOTAL" low="0" high="11" type="uint"/>
+		<bitfield name="V_TOTAL" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0002c" name="ACTIVE_HSYNC">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00030" name="ACTIVE_VSYNC_HPOS">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00034" name="ACTIVE_VSYNC_VPOS">
+		<bitfield name="START" low="0" high="11" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00038" name="CMD_DMA_CTRL">
+		<bitfield name="BROADCAST_EN" pos="31" type="boolean"/>
+		<bitfield name="FROM_FRAME_BUFFER" pos="28" type="boolean"/>
+		<bitfield name="LOW_POWER" pos="26" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0003c" name="CMD_CFG0">
+		<bitfield name="DST_FORMAT" low="0" high="3" type="dsi_cmd_dst_format"/>
+		<bitfield name="R_SEL" pos="4" type="boolean"/>
+		<bitfield name="G_SEL" pos="8" type="boolean"/>
+		<bitfield name="B_SEL" pos="12" type="boolean"/>
+		<bitfield name="INTERLEAVE_MAX" low="20" high="23" type="uint"/>
+		<bitfield name="RGB_SWAP" low="16" high="18" type="dsi_rgb_swap"/>
+	</reg32>
+	<reg32 offset="0x00040" name="CMD_CFG1">
+		<bitfield name="WR_MEM_START" low="0" high="7" type="uint"/>
+		<bitfield name="WR_MEM_CONTINUE" low="8" high="15" type="uint"/>
+		<bitfield name="INSERT_DCS_COMMAND" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00044" name="DMA_BASE"/>
+	<reg32 offset="0x00048" name="DMA_LEN"/>
+	<reg32 offset="0x00054" name="CMD_MDP_STREAM0_CTRL">
+		<bitfield name="DATA_TYPE" low="0" high="5" type="uint"/>
+		<bitfield name="VIRTUAL_CHANNEL" low="8" high="9" type="uint"/>
+		<bitfield name="WORD_COUNT" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00058" name="CMD_MDP_STREAM0_TOTAL">
+		<bitfield name="H_TOTAL" low="0" high="11" type="uint"/>
+		<bitfield name="V_TOTAL" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0005c" name="CMD_MDP_STREAM1_CTRL">
+		<bitfield name="DATA_TYPE" low="0" high="5" type="uint"/>
+		<bitfield name="VIRTUAL_CHANNEL" low="8" high="9" type="uint"/>
+		<bitfield name="WORD_COUNT" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00060" name="CMD_MDP_STREAM1_TOTAL">
+		<bitfield name="H_TOTAL" low="0" high="15" type="uint"/>
+		<bitfield name="V_TOTAL" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00064" name="ACK_ERR_STATUS"/>
+	<array offset="0x00068" name="RDBK" length="4" stride="4">
+		<reg32 offset="0x0" name="DATA"/>
+	</array>
+	<reg32 offset="0x00080" name="TRIG_CTRL">
+		<bitfield name="DMA_TRIGGER" low="0" high="2" type="dsi_cmd_trigger"/>
+		<bitfield name="MDP_TRIGGER" low="4" high="6" type="dsi_cmd_trigger"/>
+		<bitfield name="STREAM" low="8" high="9" type="uint"/>
+		<bitfield name="BLOCK_DMA_WITHIN_FRAME" pos="12" type="boolean"/>
+		<bitfield name="TE" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0008c" name="TRIG_DMA"/>
+	<reg32 offset="0x000b0" name="DLN0_PHY_ERR">
+		<bitfield name="DLN0_ERR_ESC" pos="0" type="boolean"/>
+		<bitfield name="DLN0_ERR_SYNC_ESC" pos="4" type="boolean"/>
+		<bitfield name="DLN0_ERR_CONTROL" pos="8" type="boolean"/>
+		<bitfield name="DLN0_ERR_CONTENTION_LP0" pos="12" type="boolean"/>
+		<bitfield name="DLN0_ERR_CONTENTION_LP1" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000b4" name="LP_TIMER_CTRL">
+		<bitfield name="LP_RX_TO" low="0" high="15" type="uint"/>
+		<bitfield name="BTA_TO" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x000b8" name="HS_TIMER_CTRL">
+		<bitfield name="HS_TX_TO" low="0" high="15" type="uint"/>
+		<bitfield name="TIMER_RESOLUTION" low="16" high="19" type="uint"/>
+		<bitfield name="HS_TX_TO_STOP_EN" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000bc" name="TIMEOUT_STATUS"/>
+	<reg32 offset="0x000c0" name="CLKOUT_TIMING_CTRL">
+		<bitfield name="T_CLK_PRE" low="0" high="5" type="uint"/>
+		<bitfield name="T_CLK_POST" low="8" high="13" type="uint"/>
+	</reg32>
+	<reg32 offset="0x000c8" name="EOT_PACKET_CTRL">
+		<bitfield name="TX_EOT_APPEND" pos="0" type="boolean"/>
+		<bitfield name="RX_EOT_IGNORE" pos="4" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000a4" name="LANE_STATUS">
+		<bitfield name="DLN0_STOPSTATE" pos="0" type="boolean"/>
+		<bitfield name="DLN1_STOPSTATE" pos="1" type="boolean"/>
+		<bitfield name="DLN2_STOPSTATE" pos="2" type="boolean"/>
+		<bitfield name="DLN3_STOPSTATE" pos="3" type="boolean"/>
+		<bitfield name="CLKLN_STOPSTATE" pos="4" type="boolean"/>
+		<bitfield name="DLN0_ULPS_ACTIVE_NOT" pos="8" type="boolean"/>
+		<bitfield name="DLN1_ULPS_ACTIVE_NOT" pos="9" type="boolean"/>
+		<bitfield name="DLN2_ULPS_ACTIVE_NOT" pos="10" type="boolean"/>
+		<bitfield name="DLN3_ULPS_ACTIVE_NOT" pos="11" type="boolean"/>
+		<bitfield name="CLKLN_ULPS_ACTIVE_NOT" pos="12" type="boolean"/>
+		<bitfield name="DLN0_DIRECTION" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000a8" name="LANE_CTRL">
+		<bitfield name="HS_REQ_SEL_PHY" pos="24" type="boolean"/>
+		<bitfield name="CLKLN_HS_FORCE_REQUEST" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000ac" name="LANE_SWAP_CTRL">
+		<bitfield name="DLN_SWAP_SEL" low="0" high="2" type="dsi_lane_swap"/>
+	</reg32>
+	<reg32 offset="0x00108" name="ERR_INT_MASK0"/>
+	<reg32 offset="0x0010c" name="INTR_CTRL" type="DSI_IRQ"/>
+	<reg32 offset="0x00114" name="RESET"/>
+	<reg32 offset="0x00118" name="CLK_CTRL">
+		<bitfield name="AHBS_HCLK_ON" pos="0" type="boolean"/>
+		<bitfield name="AHBM_SCLK_ON" pos="1" type="boolean"/>
+		<bitfield name="PCLK_ON" pos="2" type="boolean"/>
+		<bitfield name="DSICLK_ON" pos="3" type="boolean"/>
+		<bitfield name="BYTECLK_ON" pos="4" type="boolean"/>
+		<bitfield name="ESCCLK_ON" pos="5" type="boolean"/>
+		<bitfield name="FORCE_ON_DYN_AHBM_HCLK" pos="9" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0011c" name="CLK_STATUS">
+		<bitfield name="DSI_AON_AHBM_HCLK_ACTIVE" pos="0" type="boolean"/>
+		<bitfield name="DSI_DYN_AHBM_HCLK_ACTIVE" pos="1" type="boolean"/>
+		<bitfield name="DSI_AON_AHBS_HCLK_ACTIVE" pos="2" type="boolean"/>
+		<bitfield name="DSI_DYN_AHBS_HCLK_ACTIVE" pos="3" type="boolean"/>
+		<bitfield name="DSI_AON_DSICLK_ACTIVE" pos="4" type="boolean"/>
+		<bitfield name="DSI_DYN_DSICLK_ACTIVE" pos="5" type="boolean"/>
+		<bitfield name="DSI_AON_BYTECLK_ACTIVE" pos="6" type="boolean"/>
+		<bitfield name="DSI_DYN_BYTECLK_ACTIVE" pos="7" type="boolean"/>
+		<bitfield name="DSI_AON_ESCCLK_ACTIVE" pos="8" type="boolean"/>
+		<bitfield name="DSI_AON_PCLK_ACTIVE" pos="9" type="boolean"/>
+		<bitfield name="DSI_DYN_PCLK_ACTIVE" pos="10" type="boolean"/>
+		<bitfield name="DSI_DYN_CMD_PCLK_ACTIVE" pos="12" type="boolean"/>
+		<bitfield name="DSI_CMD_PCLK_ACTIVE" pos="13" type="boolean"/>
+		<bitfield name="DSI_VID_PCLK_ACTIVE" pos="14" type="boolean"/>
+		<bitfield name="DSI_CAM_BIST_PCLK_ACT" pos="15" type="boolean"/>
+		<bitfield name="PLL_UNLOCKED" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00128" name="PHY_RESET">
+		<bitfield name="RESET" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00160" name="TEST_PATTERN_GEN_VIDEO_INIT_VAL"/>
+	<reg32 offset="0x00198" name="TPG_MAIN_CONTROL">
+		<bitfield name="CHECKERED_RECTANGLE_PATTERN" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001a0" name="TPG_VIDEO_CONFIG">
+		<bitfield name="BPP" low="0" high="1" type="video_config_bpp"/>
+		<bitfield name="RGB" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00158" name="TEST_PATTERN_GEN_CTRL">
+		<bitfield name="CMD_DMA_PATTERN_SEL" low="16" high="17" type="cmd_dma_pattern_sel"/>
+		<bitfield name="CMD_MDP_STREAM0_PATTERN_SEL" low="8" high="9" type="cmd_mdp_stream0_pattern_sel"/>
+		<bitfield name="VIDEO_PATTERN_SEL" low="4" high="5" type="video_pattern_sel"/>
+		<bitfield name="TPG_DMA_FIFO_MODE" pos="2" type="boolean"/>
+		<bitfield name="CMD_DMA_TPG_EN" pos="1" type="boolean"/>
+		<bitfield name="EN" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00168" name="TEST_PATTERN_GEN_CMD_MDP_INIT_VAL0"/>
+	<reg32 offset="0x00180" name="TEST_PATTERN_GEN_CMD_STREAM0_TRIGGER">
+		<bitfield name="SW_TRIGGER" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0019c" name="TPG_MAIN_CONTROL2">
+		<bitfield name="CMD_MDP0_CHECKERED_RECTANGLE_PATTERN" pos="7" type="boolean"/>
+		<bitfield name="CMD_MDP1_CHECKERED_RECTANGLE_PATTERN" pos="16" type="boolean"/>
+		<bitfield name="CMD_MDP2_CHECKERED_RECTANGLE_PATTERN" pos="25" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0017c" name="T_CLK_PRE_EXTEND">
+		<bitfield name="INC_BY_2_BYTECLK" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001b4" name="CMD_MODE_MDP_CTRL2">
+		<bitfield name="DST_FORMAT2" low="0" high="3" type="dsi_cmd_dst_format"/>
+		<bitfield name="R_SEL" pos="4" type="boolean"/>
+		<bitfield name="G_SEL" pos="5" type="boolean"/>
+		<bitfield name="B_SEL" pos="6" type="boolean"/>
+		<bitfield name="BYTE_MSB_LSB_FLIP" pos="7" type="boolean"/>
+		<bitfield name="RGB_SWAP" low="8" high="10" type="dsi_rgb_swap"/>
+		<bitfield name="INPUT_RGB_SWAP" low="12" high="14" type="dsi_rgb_swap"/>
+		<bitfield name="BURST_MODE" pos="16" type="boolean"/>
+		<bitfield name="DATABUS_WIDEN" pos="20" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001b8" name="CMD_MODE_MDP_STREAM2_CTRL">
+		<bitfield name="DATA_TYPE" low="0" high="5" type="uint"/>
+		<bitfield name="VIRTUAL_CHANNEL" low="8" high="9" type="uint"/>
+		<bitfield name="WORD_COUNT" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x001d0" name="RDBK_DATA_CTRL">
+		<bitfield name="COUNT" low="16" high="23" type="uint"/>
+		<bitfield name="CLR" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001f0" name="VERSION">
+		<bitfield name="MAJOR" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002d4" name="CPHY_MODE_CTRL"/>
+	<reg32 offset="0x0029c" name="VIDEO_COMPRESSION_MODE_CTRL">
+		<bitfield name="WC" low="16" high="31" type="uint"/>
+		<bitfield name="DATATYPE" low="8" high="13" type="uint"/>
+		<bitfield name="PKT_PER_LINE" low="6" high="7" type="uint"/>
+		<bitfield name="EOL_BYTE_NUM" low="4" high="5" type="uint"/>
+		<bitfield name="EN" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002a4" name="COMMAND_COMPRESSION_MODE_CTRL">
+		<bitfield name="STREAM1_DATATYPE" low="24" high="29" type="uint"/>
+		<bitfield name="STREAM1_PKT_PER_LINE" low="22" high="23" type="uint"/>
+		<bitfield name="STREAM1_EOL_BYTE_NUM" low="20" high="21" type="uint"/>
+		<bitfield name="STREAM1_EN" pos="16" type="boolean"/>
+		<bitfield name="STREAM0_DATATYPE" low="8" high="13" type="uint"/>
+		<bitfield name="STREAM0_PKT_PER_LINE" low="6" high="7" type="uint"/>
+		<bitfield name="STREAM0_EOL_BYTE_NUM" low="4" high="5" type="uint"/>
+		<bitfield name="STREAM0_EN" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002a8" name="COMMAND_COMPRESSION_MODE_CTRL2">
+		<bitfield name="STREAM1_SLICE_WIDTH" low="16" high="31" type="uint"/>
+		<bitfield name="STREAM0_SLICE_WIDTH" low="0" high="15" type="uint"/>
+	</reg32>
+
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/dsi_phy_10nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/dsi_phy_10nm.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_10nm_PHY_CMN" width="32">
+	<reg32 offset="0x00000" name="REVISION_ID0"/>
+	<reg32 offset="0x00004" name="REVISION_ID1"/>
+	<reg32 offset="0x00008" name="REVISION_ID2"/>
+	<reg32 offset="0x0000c" name="REVISION_ID3"/>
+	<reg32 offset="0x00010" name="CLK_CFG0"/>
+	<reg32 offset="0x00014" name="CLK_CFG1"/>
+	<reg32 offset="0x00018" name="GLBL_CTRL"/>
+	<reg32 offset="0x0001c" name="RBUF_CTRL"/>
+	<reg32 offset="0x00020" name="VREG_CTRL"/>
+	<reg32 offset="0x00024" name="CTRL_0"/>
+	<reg32 offset="0x00028" name="CTRL_1"/>
+	<reg32 offset="0x0002c" name="CTRL_2"/>
+	<reg32 offset="0x00030" name="LANE_CFG0"/>
+	<reg32 offset="0x00034" name="LANE_CFG1"/>
+	<reg32 offset="0x00038" name="PLL_CNTRL"/>
+	<reg32 offset="0x00098" name="LANE_CTRL0"/>
+	<reg32 offset="0x0009c" name="LANE_CTRL1"/>
+	<reg32 offset="0x000a0" name="LANE_CTRL2"/>
+	<reg32 offset="0x000a4" name="LANE_CTRL3"/>
+	<reg32 offset="0x000a8" name="LANE_CTRL4"/>
+	<reg32 offset="0x000ac" name="TIMING_CTRL_0"/>
+	<reg32 offset="0x000b0" name="TIMING_CTRL_1"/>
+	<reg32 offset="0x000b4" name="TIMING_CTRL_2"/>
+	<reg32 offset="0x000b8" name="TIMING_CTRL_3"/>
+	<reg32 offset="0x000bc" name="TIMING_CTRL_4"/>
+	<reg32 offset="0x000c0" name="TIMING_CTRL_5"/>
+	<reg32 offset="0x000c4" name="TIMING_CTRL_6"/>
+	<reg32 offset="0x000c8" name="TIMING_CTRL_7"/>
+	<reg32 offset="0x000cc" name="TIMING_CTRL_8"/>
+	<reg32 offset="0x000d0" name="TIMING_CTRL_9"/>
+	<reg32 offset="0x000d4" name="TIMING_CTRL_10"/>
+	<reg32 offset="0x000d8" name="TIMING_CTRL_11"/>
+	<reg32 offset="0x000ec" name="PHY_STATUS"/>
+	<reg32 offset="0x000f4" name="LANE_STATUS0"/>
+	<reg32 offset="0x000f8" name="LANE_STATUS1"/>
+</domain>
+
+<domain name="DSI_10nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="5" stride="0x80">
+		<reg32 offset="0x00" name="CFG0"/>
+		<reg32 offset="0x04" name="CFG1"/>
+		<reg32 offset="0x08" name="CFG2"/>
+		<reg32 offset="0x0c" name="CFG3"/>
+		<reg32 offset="0x10" name="TEST_DATAPATH"/>
+		<reg32 offset="0x14" name="PIN_SWAP"/>
+		<reg32 offset="0x18" name="HSTX_STR_CTRL"/>
+		<reg32 offset="0x1c" name="OFFSET_TOP_CTRL"/>
+		<reg32 offset="0x20" name="OFFSET_BOT_CTRL"/>
+		<reg32 offset="0x24" name="LPTX_STR_CTRL"/>
+		<reg32 offset="0x28" name="LPRX_CTRL"/>
+		<reg32 offset="0x2c" name="TX_DCTRL"/>
+	</array>
+</domain>
+
+<domain name="DSI_10nm_PHY_PLL" width="32">
+	<reg32 offset="0x0000" name="ANALOG_CONTROLS_ONE"/>
+	<reg32 offset="0x0004" name="ANALOG_CONTROLS_TWO"/>
+	<reg32 offset="0x0010" name="ANALOG_CONTROLS_THREE"/>
+	<reg32 offset="0x001c" name="DSM_DIVIDER"/>
+	<reg32 offset="0x0020" name="FEEDBACK_DIVIDER"/>
+	<reg32 offset="0x0024" name="SYSTEM_MUXES"/>
+	<reg32 offset="0x002c" name="CMODE"/>
+	<reg32 offset="0x0030" name="CALIBRATION_SETTINGS"/>
+	<reg32 offset="0x0054" name="BAND_SEL_CAL_SETTINGS_THREE"/>
+	<reg32 offset="0x0064" name="FREQ_DETECT_SETTINGS_ONE"/>
+	<reg32 offset="0x007c" name="PFILT"/>
+	<reg32 offset="0x0080" name="IFILT"/>
+	<reg32 offset="0x0094" name="OUTDIV"/>
+	<reg32 offset="0x00a4" name="CORE_OVERRIDE"/>
+	<reg32 offset="0x00a8" name="CORE_INPUT_OVERRIDE"/>
+	<reg32 offset="0x00b4" name="PLL_DIGITAL_TIMERS_TWO"/>
+	<reg32 offset="0x00cc" name="DECIMAL_DIV_START_1"/>
+	<reg32 offset="0x00d0" name="FRAC_DIV_START_LOW_1"/>
+	<reg32 offset="0x00d4" name="FRAC_DIV_START_MID_1"/>
+	<reg32 offset="0x00d8" name="FRAC_DIV_START_HIGH_1"/>
+	<reg32 offset="0x010c" name="SSC_STEPSIZE_LOW_1"/>
+	<reg32 offset="0x0110" name="SSC_STEPSIZE_HIGH_1"/>
+	<reg32 offset="0x0114" name="SSC_DIV_PER_LOW_1"/>
+	<reg32 offset="0x0118" name="SSC_DIV_PER_HIGH_1"/>
+	<reg32 offset="0x011c" name="SSC_DIV_ADJPER_LOW_1"/>
+	<reg32 offset="0x0120" name="SSC_DIV_ADJPER_HIGH_1"/>
+	<reg32 offset="0x013c" name="SSC_CONTROL"/>
+	<reg32 offset="0x0140" name="PLL_OUTDIV_RATE"/>
+	<reg32 offset="0x0144" name="PLL_LOCKDET_RATE_1"/>
+	<reg32 offset="0x014c" name="PLL_PROP_GAIN_RATE_1"/>
+	<reg32 offset="0x0154" name="PLL_BAND_SET_RATE_1"/>
+	<reg32 offset="0x015c" name="PLL_INT_GAIN_IFILT_BAND_1"/>
+	<reg32 offset="0x0164" name="PLL_FL_INT_GAIN_PFILT_BAND_1"/>
+	<reg32 offset="0x0180" name="PLL_LOCK_OVERRIDE"/>
+	<reg32 offset="0x0184" name="PLL_LOCK_DELAY"/>
+	<reg32 offset="0x018c" name="CLOCK_INVERTERS"/>
+	<reg32 offset="0x01a0" name="COMMON_STATUS_ONE"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/dsi_phy_14nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/dsi_phy_14nm.xml
@@ -0,0 +1,135 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_14nm_PHY_CMN" width="32">
+	<reg32 offset="0x00000" name="REVISION_ID0"/>
+	<reg32 offset="0x00004" name="REVISION_ID1"/>
+	<reg32 offset="0x00008" name="REVISION_ID2"/>
+	<reg32 offset="0x0000c" name="REVISION_ID3"/>
+	<reg32 offset="0x00010" name="CLK_CFG0">
+		<bitfield name="DIV_CTRL_3_0" low="4" high="7" type="uint"/>
+		<bitfield name="DIV_CTRL_7_4" low="4" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00014" name="CLK_CFG1">
+		<bitfield name="DSICLK_SEL" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00018" name="GLBL_TEST_CTRL">
+		<bitfield name="BITCLK_HS_SEL" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0001C" name="CTRL_0"/>
+	<reg32 offset="0x00020" name="CTRL_1">
+	</reg32>
+	<reg32 offset="0x00024" name="HW_TRIGGER"/>
+	<reg32 offset="0x00028" name="SW_CFG0"/>
+	<reg32 offset="0x0002C" name="SW_CFG1"/>
+	<reg32 offset="0x00030" name="SW_CFG2"/>
+	<reg32 offset="0x00034" name="HW_CFG0"/>
+	<reg32 offset="0x00038" name="HW_CFG1"/>
+	<reg32 offset="0x0003C" name="HW_CFG2"/>
+	<reg32 offset="0x00040" name="HW_CFG3"/>
+	<reg32 offset="0x00044" name="HW_CFG4"/>
+	<reg32 offset="0x00048" name="PLL_CNTRL">
+		<bitfield name="PLL_START" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0004C" name="LDO_CNTRL">
+		<bitfield name="VREG_CTRL" low="0" high="5" type="uint"/>
+	</reg32>
+</domain>
+
+<domain name="DSI_14nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="5" stride="0x80">
+		<reg32 offset="0x00" name="CFG0">
+			<bitfield name="PREPARE_DLY" low="6" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x04" name="CFG1">
+			<bitfield name="HALFBYTECLK_EN" pos="0" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x08" name="CFG2"/>
+		<reg32 offset="0x0c" name="CFG3"/>
+		<reg32 offset="0x10" name="TEST_DATAPATH"/>
+		<reg32 offset="0x14" name="TEST_STR"/>
+		<reg32 offset="0x18" name="TIMING_CTRL_4">
+			<bitfield name="HS_EXIT" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x1c" name="TIMING_CTRL_5">
+			<bitfield name="HS_ZERO" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x20" name="TIMING_CTRL_6">
+			<bitfield name="HS_PREPARE" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x24" name="TIMING_CTRL_7">
+			<bitfield name="HS_TRAIL" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x28" name="TIMING_CTRL_8">
+			<bitfield name="HS_RQST" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x2c" name="TIMING_CTRL_9">
+			<bitfield name="TA_GO" low="0" high="2" type="uint"/>
+			<bitfield name="TA_SURE" low="4" high="6" type="uint"/>
+		</reg32>
+		<reg32 offset="0x30" name="TIMING_CTRL_10">
+			<bitfield name="TA_GET" low="0" high="2" type="uint"/>
+		</reg32>
+		<reg32 offset="0x34" name="TIMING_CTRL_11">
+			<bitfield name="TRIG3_CMD" low="0" high="7" type="uint"/>
+		</reg32>
+		<reg32 offset="0x38" name="STRENGTH_CTRL_0"/>
+		<reg32 offset="0x3c" name="STRENGTH_CTRL_1"/>
+		<reg32 offset="0x64" name="VREG_CNTRL"/>
+	</array>
+</domain>
+
+<domain name="DSI_14nm_PHY_PLL" width="32">
+	<reg32 offset="0x000" name="IE_TRIM"/>
+	<reg32 offset="0x004" name="IP_TRIM"/>
+	<reg32 offset="0x010" name="IPTAT_TRIM"/>
+	<reg32 offset="0x01c" name="CLKBUFLR_EN"/>
+	<reg32 offset="0x028" name="SYSCLK_EN_RESET"/>
+	<reg32 offset="0x02c" name="RESETSM_CNTRL"/>
+	<reg32 offset="0x030" name="RESETSM_CNTRL2"/>
+	<reg32 offset="0x034" name="RESETSM_CNTRL3"/>
+	<reg32 offset="0x038" name="RESETSM_CNTRL4"/>
+	<reg32 offset="0x03c" name="RESETSM_CNTRL5"/>
+	<reg32 offset="0x040" name="KVCO_DIV_REF1"/>
+	<reg32 offset="0x044" name="KVCO_DIV_REF2"/>
+	<reg32 offset="0x048" name="KVCO_COUNT1"/>
+	<reg32 offset="0x04c" name="KVCO_COUNT2"/>
+	<reg32 offset="0x05c" name="VREF_CFG1"/>
+	<reg32 offset="0x058" name="KVCO_CODE"/>
+	<reg32 offset="0x06c" name="VCO_DIV_REF1"/>
+	<reg32 offset="0x070" name="VCO_DIV_REF2"/>
+	<reg32 offset="0x074" name="VCO_COUNT1"/>
+	<reg32 offset="0x078" name="VCO_COUNT2"/>
+	<reg32 offset="0x07c" name="PLLLOCK_CMP1"/>
+	<reg32 offset="0x080" name="PLLLOCK_CMP2"/>
+	<reg32 offset="0x084" name="PLLLOCK_CMP3"/>
+	<reg32 offset="0x088" name="PLLLOCK_CMP_EN"/>
+	<reg32 offset="0x08c" name="PLL_VCO_TUNE"/>
+	<reg32 offset="0x090" name="DEC_START"/>
+	<reg32 offset="0x094" name="SSC_EN_CENTER"/>
+	<reg32 offset="0x098" name="SSC_ADJ_PER1"/>
+	<reg32 offset="0x09c" name="SSC_ADJ_PER2"/>
+	<reg32 offset="0x0a0" name="SSC_PER1"/>
+	<reg32 offset="0x0a4" name="SSC_PER2"/>
+	<reg32 offset="0x0a8" name="SSC_STEP_SIZE1"/>
+	<reg32 offset="0x0ac" name="SSC_STEP_SIZE2"/>
+	<reg32 offset="0x0b4" name="DIV_FRAC_START1"/>
+	<reg32 offset="0x0b8" name="DIV_FRAC_START2"/>
+	<reg32 offset="0x0bc" name="DIV_FRAC_START3"/>
+	<reg32 offset="0x0c0" name="TXCLK_EN"/>
+	<reg32 offset="0x0c4" name="PLL_CRCTRL"/>
+	<reg32 offset="0x0cc" name="RESET_SM_READY_STATUS"/>
+	<reg32 offset="0x0e8" name="PLL_MISC1"/>
+	<reg32 offset="0x0f0" name="CP_SET_CUR"/>
+	<reg32 offset="0x0f4" name="PLL_ICPMSET"/>
+	<reg32 offset="0x0f8" name="PLL_ICPCSET"/>
+	<reg32 offset="0x0fc" name="PLL_ICP_SET"/>
+	<reg32 offset="0x100" name="PLL_LPF1"/>
+	<reg32 offset="0x104" name="PLL_LPF2_POSTDIV"/>
+	<reg32 offset="0x108" name="PLL_BANDGAP"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/dsi_phy_20nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/dsi_phy_20nm.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_20nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="4" stride="0x40">
+		<reg32 offset="0x00" name="CFG_0"/>
+		<reg32 offset="0x04" name="CFG_1"/>
+		<reg32 offset="0x08" name="CFG_2"/>
+		<reg32 offset="0x0c" name="CFG_3"/>
+		<reg32 offset="0x10" name="CFG_4"/>
+		<reg32 offset="0x14" name="TEST_DATAPATH"/>
+		<reg32 offset="0x18" name="DEBUG_SEL"/>
+		<reg32 offset="0x1c" name="TEST_STR_0"/>
+		<reg32 offset="0x20" name="TEST_STR_1"/>
+	</array>
+
+	<reg32 offset="0x00100" name="LNCK_CFG_0"/>
+	<reg32 offset="0x00104" name="LNCK_CFG_1"/>
+	<reg32 offset="0x00108" name="LNCK_CFG_2"/>
+	<reg32 offset="0x0010c" name="LNCK_CFG_3"/>
+	<reg32 offset="0x00110" name="LNCK_CFG_4"/>
+	<reg32 offset="0x00114" name="LNCK_TEST_DATAPATH"/>
+	<reg32 offset="0x00118" name="LNCK_DEBUG_SEL"/>
+	<reg32 offset="0x0011c" name="LNCK_TEST_STR0"/>
+	<reg32 offset="0x00120" name="LNCK_TEST_STR1"/>
+
+	<reg32 offset="0x00140" name="TIMING_CTRL_0">
+		<bitfield name="CLK_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00144" name="TIMING_CTRL_1">
+		<bitfield name="CLK_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00148" name="TIMING_CTRL_2">
+		<bitfield name="CLK_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0014c" name="TIMING_CTRL_3">
+		<bitfield name="CLK_ZERO_8" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00150" name="TIMING_CTRL_4">
+		<bitfield name="HS_EXIT" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00154" name="TIMING_CTRL_5">
+		<bitfield name="HS_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00158" name="TIMING_CTRL_6">
+		<bitfield name="HS_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0015c" name="TIMING_CTRL_7">
+		<bitfield name="HS_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00160" name="TIMING_CTRL_8">
+		<bitfield name="HS_RQST" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00164" name="TIMING_CTRL_9">
+		<bitfield name="TA_GO" low="0" high="2" type="uint"/>
+		<bitfield name="TA_SURE" low="4" high="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00168" name="TIMING_CTRL_10">
+		<bitfield name="TA_GET" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0016c" name="TIMING_CTRL_11">
+		<bitfield name="TRIG3_CMD" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00170" name="CTRL_0"/>
+	<reg32 offset="0x00174" name="CTRL_1"/>
+	<reg32 offset="0x00178" name="CTRL_2"/>
+	<reg32 offset="0x0017c" name="CTRL_3"/>
+	<reg32 offset="0x00180" name="CTRL_4"/>
+
+	<reg32 offset="0x00184" name="STRENGTH_0"/>
+	<reg32 offset="0x00188" name="STRENGTH_1"/>
+
+	<reg32 offset="0x001b4" name="BIST_CTRL_0"/>
+	<reg32 offset="0x001b8" name="BIST_CTRL_1"/>
+	<reg32 offset="0x001bc" name="BIST_CTRL_2"/>
+	<reg32 offset="0x001c0" name="BIST_CTRL_3"/>
+	<reg32 offset="0x001c4" name="BIST_CTRL_4"/>
+	<reg32 offset="0x001c8" name="BIST_CTRL_5"/>
+
+	<reg32 offset="0x001d4" name="GLBL_TEST_CTRL">
+		<bitfield name="BITCLK_HS_SEL" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001dc" name="LDO_CNTRL"/>
+</domain>
+
+<domain name="DSI_20nm_PHY_REGULATOR" width="32">
+	<reg32 offset="0x00000" name="CTRL_0"/>
+	<reg32 offset="0x00004" name="CTRL_1"/>
+	<reg32 offset="0x00008" name="CTRL_2"/>
+	<reg32 offset="0x0000c" name="CTRL_3"/>
+	<reg32 offset="0x00010" name="CTRL_4"/>
+	<reg32 offset="0x00014" name="CTRL_5"/>
+	<reg32 offset="0x00018" name="CAL_PWR_CFG"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/dsi_phy_28nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/dsi_phy_28nm.xml
@@ -0,0 +1,180 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_28nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="4" stride="0x40">
+		<reg32 offset="0x00" name="CFG_0"/>
+		<reg32 offset="0x04" name="CFG_1"/>
+		<reg32 offset="0x08" name="CFG_2"/>
+		<reg32 offset="0x0c" name="CFG_3"/>
+		<reg32 offset="0x10" name="CFG_4"/>
+		<reg32 offset="0x14" name="TEST_DATAPATH"/>
+		<reg32 offset="0x18" name="DEBUG_SEL"/>
+		<reg32 offset="0x1c" name="TEST_STR_0"/>
+		<reg32 offset="0x20" name="TEST_STR_1"/>
+	</array>
+
+	<reg32 offset="0x00100" name="LNCK_CFG_0"/>
+	<reg32 offset="0x00104" name="LNCK_CFG_1"/>
+	<reg32 offset="0x00108" name="LNCK_CFG_2"/>
+	<reg32 offset="0x0010c" name="LNCK_CFG_3"/>
+	<reg32 offset="0x00110" name="LNCK_CFG_4"/>
+	<reg32 offset="0x00114" name="LNCK_TEST_DATAPATH"/>
+	<reg32 offset="0x00118" name="LNCK_DEBUG_SEL"/>
+	<reg32 offset="0x0011c" name="LNCK_TEST_STR0"/>
+	<reg32 offset="0x00120" name="LNCK_TEST_STR1"/>
+
+	<reg32 offset="0x00140" name="TIMING_CTRL_0">
+		<bitfield name="CLK_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00144" name="TIMING_CTRL_1">
+		<bitfield name="CLK_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00148" name="TIMING_CTRL_2">
+		<bitfield name="CLK_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0014c" name="TIMING_CTRL_3">
+		<bitfield name="CLK_ZERO_8" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00150" name="TIMING_CTRL_4">
+		<bitfield name="HS_EXIT" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00154" name="TIMING_CTRL_5">
+		<bitfield name="HS_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00158" name="TIMING_CTRL_6">
+		<bitfield name="HS_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0015c" name="TIMING_CTRL_7">
+		<bitfield name="HS_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00160" name="TIMING_CTRL_8">
+		<bitfield name="HS_RQST" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00164" name="TIMING_CTRL_9">
+		<bitfield name="TA_GO" low="0" high="2" type="uint"/>
+		<bitfield name="TA_SURE" low="4" high="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00168" name="TIMING_CTRL_10">
+		<bitfield name="TA_GET" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0016c" name="TIMING_CTRL_11">
+		<bitfield name="TRIG3_CMD" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00170" name="CTRL_0"/>
+	<reg32 offset="0x00174" name="CTRL_1"/>
+	<reg32 offset="0x00178" name="CTRL_2"/>
+	<reg32 offset="0x0017c" name="CTRL_3"/>
+	<reg32 offset="0x00180" name="CTRL_4"/>
+
+	<reg32 offset="0x00184" name="STRENGTH_0"/>
+	<reg32 offset="0x00188" name="STRENGTH_1"/>
+
+	<reg32 offset="0x001b4" name="BIST_CTRL_0"/>
+	<reg32 offset="0x001b8" name="BIST_CTRL_1"/>
+	<reg32 offset="0x001bc" name="BIST_CTRL_2"/>
+	<reg32 offset="0x001c0" name="BIST_CTRL_3"/>
+	<reg32 offset="0x001c4" name="BIST_CTRL_4"/>
+	<reg32 offset="0x001c8" name="BIST_CTRL_5"/>
+
+	<reg32 offset="0x001d4" name="GLBL_TEST_CTRL">
+		<bitfield name="BITCLK_HS_SEL" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x001dc" name="LDO_CNTRL"/>
+</domain>
+
+<domain name="DSI_28nm_PHY_REGULATOR" width="32">
+	<reg32 offset="0x00000" name="CTRL_0"/>
+	<reg32 offset="0x00004" name="CTRL_1"/>
+	<reg32 offset="0x00008" name="CTRL_2"/>
+	<reg32 offset="0x0000c" name="CTRL_3"/>
+	<reg32 offset="0x00010" name="CTRL_4"/>
+	<reg32 offset="0x00014" name="CTRL_5"/>
+	<reg32 offset="0x00018" name="CAL_PWR_CFG"/>
+</domain>
+
+<domain name="DSI_28nm_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="REFCLK_CFG">
+		<bitfield name="DBLR" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00004" name="POSTDIV1_CFG"/>
+	<reg32 offset="0x00008" name="CHGPUMP_CFG"/>
+	<reg32 offset="0x0000C" name="VCOLPF_CFG"/>
+	<reg32 offset="0x00010" name="VREG_CFG">
+		<bitfield name="POSTDIV1_BYPASS_B" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00014" name="PWRGEN_CFG"/>
+	<reg32 offset="0x00018" name="DMUX_CFG"/>
+	<reg32 offset="0x0001C" name="AMUX_CFG"/>
+	<reg32 offset="0x00020" name="GLB_CFG">
+		<bitfield name="PLL_PWRDN_B" pos="0" type="boolean"/>
+		<bitfield name="PLL_LDO_PWRDN_B" pos="1" type="boolean"/>
+		<bitfield name="PLL_PWRGEN_PWRDN_B" pos="2" type="boolean"/>
+		<bitfield name="PLL_ENABLE" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00024" name="POSTDIV2_CFG"/>
+	<reg32 offset="0x00028" name="POSTDIV3_CFG"/>
+	<reg32 offset="0x0002C" name="LPFR_CFG"/>
+	<reg32 offset="0x00030" name="LPFC1_CFG"/>
+	<reg32 offset="0x00034" name="LPFC2_CFG"/>
+	<reg32 offset="0x00038" name="SDM_CFG0">
+		<bitfield name="BYP_DIV" low="0" high="5" type="uint"/>
+		<bitfield name="BYP" pos="6" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0003C" name="SDM_CFG1">
+		<bitfield name="DC_OFFSET" low="0" high="5" type="uint"/>
+		<bitfield name="DITHER_EN" pos="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00040" name="SDM_CFG2">
+		<bitfield name="FREQ_SEED_7_0" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00044" name="SDM_CFG3">
+		<bitfield name="FREQ_SEED_15_8" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00048" name="SDM_CFG4"/>
+	<reg32 offset="0x0004C" name="SSC_CFG0"/>
+	<reg32 offset="0x00050" name="SSC_CFG1"/>
+	<reg32 offset="0x00054" name="SSC_CFG2"/>
+	<reg32 offset="0x00058" name="SSC_CFG3"/>
+	<reg32 offset="0x0005C" name="LKDET_CFG0"/>
+	<reg32 offset="0x00060" name="LKDET_CFG1"/>
+	<reg32 offset="0x00064" name="LKDET_CFG2"/>
+	<reg32 offset="0x00068" name="TEST_CFG">
+		<bitfield name="PLL_SW_RESET" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0006C" name="CAL_CFG0"/>
+	<reg32 offset="0x00070" name="CAL_CFG1"/>
+	<reg32 offset="0x00074" name="CAL_CFG2"/>
+	<reg32 offset="0x00078" name="CAL_CFG3"/>
+	<reg32 offset="0x0007C" name="CAL_CFG4"/>
+	<reg32 offset="0x00080" name="CAL_CFG5"/>
+	<reg32 offset="0x00084" name="CAL_CFG6"/>
+	<reg32 offset="0x00088" name="CAL_CFG7"/>
+	<reg32 offset="0x0008C" name="CAL_CFG8"/>
+	<reg32 offset="0x00090" name="CAL_CFG9"/>
+	<reg32 offset="0x00094" name="CAL_CFG10"/>
+	<reg32 offset="0x00098" name="CAL_CFG11"/>
+	<reg32 offset="0x0009C" name="EFUSE_CFG"/>
+	<reg32 offset="0x000A0" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x000A4" name="CTRL_42"/>
+	<reg32 offset="0x000A8" name="CTRL_43"/>
+	<reg32 offset="0x000AC" name="CTRL_44"/>
+	<reg32 offset="0x000B0" name="CTRL_45"/>
+	<reg32 offset="0x000B4" name="CTRL_46"/>
+	<reg32 offset="0x000B8" name="CTRL_47"/>
+	<reg32 offset="0x000BC" name="CTRL_48"/>
+	<reg32 offset="0x000C0" name="STATUS">
+		<bitfield name="PLL_RDY" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x000C4" name="DEBUG_BUS0"/>
+	<reg32 offset="0x000C8" name="DEBUG_BUS1"/>
+	<reg32 offset="0x000CC" name="DEBUG_BUS2"/>
+	<reg32 offset="0x000D0" name="DEBUG_BUS3"/>
+	<reg32 offset="0x000D4" name="CTRL_54"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/dsi_phy_28nm_8960.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/dsi_phy_28nm_8960.xml
@@ -0,0 +1,134 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_28nm_8960_PHY" width="32">
+
+	<array offset="0x00000" name="LN" length="4" stride="0x40">
+		<reg32 offset="0x00" name="CFG_0"/>
+		<reg32 offset="0x04" name="CFG_1"/>
+		<reg32 offset="0x08" name="CFG_2"/>
+		<reg32 offset="0x0c" name="TEST_DATAPATH"/>
+		<reg32 offset="0x14" name="TEST_STR_0"/>
+		<reg32 offset="0x18" name="TEST_STR_1"/>
+	</array>
+
+	<reg32 offset="0x00100" name="LNCK_CFG_0"/>
+	<reg32 offset="0x00104" name="LNCK_CFG_1"/>
+	<reg32 offset="0x00108" name="LNCK_CFG_2"/>
+
+	<reg32 offset="0x0010c" name="LNCK_TEST_DATAPATH"/>
+	<reg32 offset="0x00114" name="LNCK_TEST_STR0"/>
+	<reg32 offset="0x00118" name="LNCK_TEST_STR1"/>
+
+	<reg32 offset="0x00140" name="TIMING_CTRL_0">
+		<bitfield name="CLK_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00144" name="TIMING_CTRL_1">
+		<bitfield name="CLK_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00148" name="TIMING_CTRL_2">
+		<bitfield name="CLK_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0014c" name="TIMING_CTRL_3"/>
+
+	<reg32 offset="0x00150" name="TIMING_CTRL_4">
+		<bitfield name="HS_EXIT" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00154" name="TIMING_CTRL_5">
+		<bitfield name="HS_ZERO" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00158" name="TIMING_CTRL_6">
+		<bitfield name="HS_PREPARE" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0015c" name="TIMING_CTRL_7">
+		<bitfield name="HS_TRAIL" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00160" name="TIMING_CTRL_8">
+		<bitfield name="HS_RQST" low="0" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00164" name="TIMING_CTRL_9">
+		<bitfield name="TA_GO" low="0" high="2" type="uint"/>
+		<bitfield name="TA_SURE" low="4" high="6" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00168" name="TIMING_CTRL_10">
+		<bitfield name="TA_GET" low="0" high="2" type="uint"/>
+	</reg32>
+	<reg32 offset="0x0016c" name="TIMING_CTRL_11">
+		<bitfield name="TRIG3_CMD" low="0" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00170" name="CTRL_0"/>
+	<reg32 offset="0x00174" name="CTRL_1"/>
+	<reg32 offset="0x00178" name="CTRL_2"/>
+	<reg32 offset="0x0017c" name="CTRL_3"/>
+
+	<reg32 offset="0x00180" name="STRENGTH_0"/>
+	<reg32 offset="0x00184" name="STRENGTH_1"/>
+	<reg32 offset="0x00188" name="STRENGTH_2"/>
+
+	<reg32 offset="0x0018c" name="BIST_CTRL_0"/>
+	<reg32 offset="0x00190" name="BIST_CTRL_1"/>
+	<reg32 offset="0x00194" name="BIST_CTRL_2"/>
+	<reg32 offset="0x00198" name="BIST_CTRL_3"/>
+	<reg32 offset="0x0019c" name="BIST_CTRL_4"/>
+
+	<reg32 offset="0x001b0" name="LDO_CTRL"/>
+</domain>
+
+<domain name="DSI_28nm_8960_PHY_MISC" width="32">
+	<reg32 offset="0x00000" name="REGULATOR_CTRL_0"/>
+	<reg32 offset="0x00004" name="REGULATOR_CTRL_1"/>
+	<reg32 offset="0x00008" name="REGULATOR_CTRL_2"/>
+	<reg32 offset="0x0000c" name="REGULATOR_CTRL_3"/>
+	<reg32 offset="0x00010" name="REGULATOR_CTRL_4"/>
+	<reg32 offset="0x00014" name="REGULATOR_CTRL_5"/>
+	<reg32 offset="0x00018" name="REGULATOR_CAL_PWR_CFG"/>
+	<reg32 offset="0x00028" name="CAL_HW_TRIGGER"/>
+	<reg32 offset="0x0002c" name="CAL_SW_CFG_0"/>
+	<reg32 offset="0x00030" name="CAL_SW_CFG_1"/>
+	<reg32 offset="0x00034" name="CAL_SW_CFG_2"/>
+	<reg32 offset="0x00038" name="CAL_HW_CFG_0"/>
+	<reg32 offset="0x0003c" name="CAL_HW_CFG_1"/>
+	<reg32 offset="0x00040" name="CAL_HW_CFG_2"/>
+	<reg32 offset="0x00044" name="CAL_HW_CFG_3"/>
+	<reg32 offset="0x00048" name="CAL_HW_CFG_4"/>
+	<reg32 offset="0x00050" name="CAL_STATUS">
+		<bitfield name="CAL_BUSY" pos="4" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="DSI_28nm_8960_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="CTRL_0">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00004" name="CTRL_1"/>
+	<reg32 offset="0x00008" name="CTRL_2"/>
+	<reg32 offset="0x0000c" name="CTRL_3"/>
+	<reg32 offset="0x00010" name="CTRL_4"/>
+	<reg32 offset="0x00014" name="CTRL_5"/>
+	<reg32 offset="0x00018" name="CTRL_6"/>
+	<reg32 offset="0x0001c" name="CTRL_7"/>
+	<reg32 offset="0x00020" name="CTRL_8"/>
+	<reg32 offset="0x00024" name="CTRL_9"/>
+	<reg32 offset="0x00028" name="CTRL_10"/>
+	<reg32 offset="0x0002c" name="CTRL_11"/>
+	<reg32 offset="0x00030" name="CTRL_12"/>
+	<reg32 offset="0x00034" name="CTRL_13"/>
+	<reg32 offset="0x00038" name="CTRL_14"/>
+	<reg32 offset="0x0003c" name="CTRL_15"/>
+	<reg32 offset="0x00040" name="CTRL_16"/>
+	<reg32 offset="0x00044" name="CTRL_17"/>
+	<reg32 offset="0x00048" name="CTRL_18"/>
+	<reg32 offset="0x0004c" name="CTRL_19"/>
+	<reg32 offset="0x00050" name="CTRL_20"/>
+
+	<reg32 offset="0x00080" name="RDY">
+		<bitfield name="PLL_RDY" pos="0" type="boolean"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/dsi_phy_7nm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/dsi_phy_7nm.xml
@@ -0,0 +1,230 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="DSI_7nm_PHY_CMN" width="32">
+	<reg32 offset="0x00000" name="REVISION_ID0"/>
+	<reg32 offset="0x00004" name="REVISION_ID1"/>
+	<reg32 offset="0x00008" name="REVISION_ID2"/>
+	<reg32 offset="0x0000c" name="REVISION_ID3"/>
+	<reg32 offset="0x00010" name="CLK_CFG0"/>
+	<reg32 offset="0x00014" name="CLK_CFG1"/>
+	<reg32 offset="0x00018" name="GLBL_CTRL"/>
+	<reg32 offset="0x0001c" name="RBUF_CTRL"/>
+	<reg32 offset="0x00020" name="VREG_CTRL_0"/>
+	<reg32 offset="0x00024" name="CTRL_0"/>
+	<reg32 offset="0x00028" name="CTRL_1"/>
+	<reg32 offset="0x0002c" name="CTRL_2"/>
+	<reg32 offset="0x00030" name="CTRL_3"/>
+	<reg32 offset="0x00034" name="LANE_CFG0"/>
+	<reg32 offset="0x00038" name="LANE_CFG1"/>
+	<reg32 offset="0x0003c" name="PLL_CNTRL"/>
+	<reg32 offset="0x00040" name="DPHY_SOT"/>
+	<reg32 offset="0x000a0" name="LANE_CTRL0"/>
+	<reg32 offset="0x000a4" name="LANE_CTRL1"/>
+	<reg32 offset="0x000a8" name="LANE_CTRL2"/>
+	<reg32 offset="0x000ac" name="LANE_CTRL3"/>
+	<reg32 offset="0x000b0" name="LANE_CTRL4"/>
+	<reg32 offset="0x000b4" name="TIMING_CTRL_0"/>
+	<reg32 offset="0x000b8" name="TIMING_CTRL_1"/>
+	<reg32 offset="0x000bc" name="TIMING_CTRL_2"/>
+	<reg32 offset="0x000c0" name="TIMING_CTRL_3"/>
+	<reg32 offset="0x000c4" name="TIMING_CTRL_4"/>
+	<reg32 offset="0x000c8" name="TIMING_CTRL_5"/>
+	<reg32 offset="0x000cc" name="TIMING_CTRL_6"/>
+	<reg32 offset="0x000d0" name="TIMING_CTRL_7"/>
+	<reg32 offset="0x000d4" name="TIMING_CTRL_8"/>
+	<reg32 offset="0x000d8" name="TIMING_CTRL_9"/>
+	<reg32 offset="0x000dc" name="TIMING_CTRL_10"/>
+	<reg32 offset="0x000e0" name="TIMING_CTRL_11"/>
+	<reg32 offset="0x000e4" name="TIMING_CTRL_12"/>
+	<reg32 offset="0x000e8" name="TIMING_CTRL_13"/>
+	<reg32 offset="0x000ec" name="GLBL_HSTX_STR_CTRL_0"/>
+	<reg32 offset="0x000f0" name="GLBL_HSTX_STR_CTRL_1"/>
+	<reg32 offset="0x000f4" name="GLBL_RESCODE_OFFSET_TOP_CTRL"/>
+	<reg32 offset="0x000f8" name="GLBL_RESCODE_OFFSET_BOT_CTRL"/>
+	<reg32 offset="0x000fc" name="GLBL_RESCODE_OFFSET_MID_CTRL"/>
+	<reg32 offset="0x00100" name="GLBL_LPTX_STR_CTRL"/>
+	<reg32 offset="0x00104" name="GLBL_PEMPH_CTRL_0"/>
+	<reg32 offset="0x00108" name="GLBL_PEMPH_CTRL_1"/>
+	<reg32 offset="0x0010c" name="GLBL_STR_SWI_CAL_SEL_CTRL"/>
+	<reg32 offset="0x00110" name="VREG_CTRL_1"/>
+	<reg32 offset="0x00114" name="CTRL_4"/>
+	<reg32 offset="0x00128" name="GLBL_DIGTOP_SPARE4"/>
+	<reg32 offset="0x00140" name="PHY_STATUS"/>
+	<reg32 offset="0x00148" name="LANE_STATUS0"/>
+	<reg32 offset="0x0014c" name="LANE_STATUS1"/>
+	<reg32 offset="0x001ac" name="GLBL_DIGTOP_SPARE10"/>
+</domain>
+
+<domain name="DSI_7nm_PHY" width="32">
+	<array offset="0x00000" name="LN" length="5" stride="0x80">
+		<reg32 offset="0x00" name="CFG0"/>
+		<reg32 offset="0x04" name="CFG1"/>
+		<reg32 offset="0x08" name="CFG2"/>
+		<reg32 offset="0x0c" name="TEST_DATAPATH"/>
+		<reg32 offset="0x10" name="PIN_SWAP"/>
+		<reg32 offset="0x14" name="LPRX_CTRL"/>
+		<reg32 offset="0x18" name="TX_DCTRL"/>
+	</array>
+</domain>
+
+<domain name="DSI_7nm_PHY_PLL" width="32">
+	<reg32 offset="0x0000" name="ANALOG_CONTROLS_ONE"/>
+	<reg32 offset="0x0004" name="ANALOG_CONTROLS_TWO"/>
+	<reg32 offset="0x0008" name="INT_LOOP_SETTINGS"/>
+	<reg32 offset="0x000c" name="INT_LOOP_SETTINGS_TWO"/>
+	<reg32 offset="0x0010" name="ANALOG_CONTROLS_THREE"/>
+	<reg32 offset="0x0014" name="ANALOG_CONTROLS_FOUR"/>
+	<reg32 offset="0x0018" name="ANALOG_CONTROLS_FIVE"/>
+	<reg32 offset="0x001c" name="INT_LOOP_CONTROLS"/>
+	<reg32 offset="0x0020" name="DSM_DIVIDER"/>
+	<reg32 offset="0x0024" name="FEEDBACK_DIVIDER"/>
+	<reg32 offset="0x0028" name="SYSTEM_MUXES"/>
+	<reg32 offset="0x002c" name="FREQ_UPDATE_CONTROL_OVERRIDES"/>
+	<reg32 offset="0x0030" name="CMODE"/>
+	<reg32 offset="0x0034" name="PSM_CTRL"/>
+	<reg32 offset="0x0038" name="RSM_CTRL"/>
+	<reg32 offset="0x003c" name="VCO_TUNE_MAP"/>
+	<reg32 offset="0x0040" name="PLL_CNTRL"/>
+	<reg32 offset="0x0044" name="CALIBRATION_SETTINGS"/>
+	<reg32 offset="0x0048" name="BAND_SEL_CAL_TIMER_LOW"/>
+	<reg32 offset="0x004c" name="BAND_SEL_CAL_TIMER_HIGH"/>
+	<reg32 offset="0x0050" name="BAND_SEL_CAL_SETTINGS"/>
+	<reg32 offset="0x0054" name="BAND_SEL_MIN"/>
+	<reg32 offset="0x0058" name="BAND_SEL_MAX"/>
+	<reg32 offset="0x005c" name="BAND_SEL_PFILT"/>
+	<reg32 offset="0x0060" name="BAND_SEL_IFILT"/>
+	<reg32 offset="0x0064" name="BAND_SEL_CAL_SETTINGS_TWO"/>
+	<reg32 offset="0x0068" name="BAND_SEL_CAL_SETTINGS_THREE"/>
+	<reg32 offset="0x006c" name="BAND_SEL_CAL_SETTINGS_FOUR"/>
+	<reg32 offset="0x0070" name="BAND_SEL_ICODE_HIGH"/>
+	<reg32 offset="0x0074" name="BAND_SEL_ICODE_LOW"/>
+	<reg32 offset="0x0078" name="FREQ_DETECT_SETTINGS_ONE"/>
+	<reg32 offset="0x007c" name="FREQ_DETECT_THRESH"/>
+	<reg32 offset="0x0080" name="FREQ_DET_REFCLK_HIGH"/>
+	<reg32 offset="0x0084" name="FREQ_DET_REFCLK_LOW"/>
+	<reg32 offset="0x0088" name="FREQ_DET_PLLCLK_HIGH"/>
+	<reg32 offset="0x008c" name="FREQ_DET_PLLCLK_LOW"/>
+	<reg32 offset="0x0090" name="PFILT"/>
+	<reg32 offset="0x0094" name="IFILT"/>
+	<reg32 offset="0x0098" name="PLL_GAIN"/>
+	<reg32 offset="0x009c" name="ICODE_LOW"/>
+	<reg32 offset="0x00a0" name="ICODE_HIGH"/>
+	<reg32 offset="0x00a4" name="LOCKDET"/>
+	<reg32 offset="0x00a8" name="OUTDIV"/>
+	<reg32 offset="0x00ac" name="FASTLOCK_CONTROL"/>
+	<reg32 offset="0x00b0" name="PASS_OUT_OVERRIDE_ONE"/>
+	<reg32 offset="0x00b4" name="PASS_OUT_OVERRIDE_TWO"/>
+	<reg32 offset="0x00b8" name="CORE_OVERRIDE"/>
+	<reg32 offset="0x00bc" name="CORE_INPUT_OVERRIDE"/>
+	<reg32 offset="0x00c0" name="RATE_CHANGE"/>
+	<reg32 offset="0x00c4" name="PLL_DIGITAL_TIMERS"/>
+	<reg32 offset="0x00c8" name="PLL_DIGITAL_TIMERS_TWO"/>
+	<reg32 offset="0x00cc" name="DECIMAL_DIV_START"/>
+	<reg32 offset="0x00d0" name="FRAC_DIV_START_LOW"/>
+	<reg32 offset="0x00d4" name="FRAC_DIV_START_MID"/>
+	<reg32 offset="0x00d8" name="FRAC_DIV_START_HIGH"/>
+	<reg32 offset="0x00dc" name="DEC_FRAC_MUXES"/>
+	<reg32 offset="0x00e0" name="DECIMAL_DIV_START_1"/>
+	<reg32 offset="0x00e4" name="FRAC_DIV_START_LOW_1"/>
+	<reg32 offset="0x00e8" name="FRAC_DIV_START_MID_1"/>
+	<reg32 offset="0x00ec" name="FRAC_DIV_START_HIGH_1"/>
+	<reg32 offset="0x00f0" name="DECIMAL_DIV_START_2"/>
+	<reg32 offset="0x00f4" name="FRAC_DIV_START_LOW_2"/>
+	<reg32 offset="0x00f8" name="FRAC_DIV_START_MID_2"/>
+	<reg32 offset="0x00fc" name="FRAC_DIV_START_HIGH_2"/>
+	<reg32 offset="0x0100" name="MASH_CONTROL"/>
+	<reg32 offset="0x0104" name="SSC_STEPSIZE_LOW"/>
+	<reg32 offset="0x0108" name="SSC_STEPSIZE_HIGH"/>
+	<reg32 offset="0x010c" name="SSC_DIV_PER_LOW"/>
+	<reg32 offset="0x0110" name="SSC_DIV_PER_HIGH"/>
+	<reg32 offset="0x0114" name="SSC_ADJPER_LOW"/>
+	<reg32 offset="0x0118" name="SSC_ADJPER_HIGH"/>
+	<reg32 offset="0x011c" name="SSC_MUX_CONTROL"/>
+	<reg32 offset="0x0120" name="SSC_STEPSIZE_LOW_1"/>
+	<reg32 offset="0x0124" name="SSC_STEPSIZE_HIGH_1"/>
+	<reg32 offset="0x0128" name="SSC_DIV_PER_LOW_1"/>
+	<reg32 offset="0x012c" name="SSC_DIV_PER_HIGH_1"/>
+	<reg32 offset="0x0130" name="SSC_ADJPER_LOW_1"/>
+	<reg32 offset="0x0134" name="SSC_ADJPER_HIGH_1"/>
+	<reg32 offset="0x0138" name="SSC_STEPSIZE_LOW_2"/>
+	<reg32 offset="0x013c" name="SSC_STEPSIZE_HIGH_2"/>
+	<reg32 offset="0x0140" name="SSC_DIV_PER_LOW_2"/>
+	<reg32 offset="0x0144" name="SSC_DIV_PER_HIGH_2"/>
+	<reg32 offset="0x0148" name="SSC_ADJPER_LOW_2"/>
+	<reg32 offset="0x014c" name="SSC_ADJPER_HIGH_2"/>
+	<reg32 offset="0x0150" name="SSC_CONTROL"/>
+	<reg32 offset="0x0154" name="PLL_OUTDIV_RATE"/>
+	<reg32 offset="0x0158" name="PLL_LOCKDET_RATE_1"/>
+	<reg32 offset="0x015c" name="PLL_LOCKDET_RATE_2"/>
+	<reg32 offset="0x0160" name="PLL_PROP_GAIN_RATE_1"/>
+	<reg32 offset="0x0164" name="PLL_PROP_GAIN_RATE_2"/>
+	<reg32 offset="0x0168" name="PLL_BAND_SEL_RATE_1"/>
+	<reg32 offset="0x016c" name="PLL_BAND_SEL_RATE_2"/>
+	<reg32 offset="0x0170" name="PLL_INT_GAIN_IFILT_BAND_1"/>
+	<reg32 offset="0x0174" name="PLL_INT_GAIN_IFILT_BAND_2"/>
+	<reg32 offset="0x0178" name="PLL_FL_INT_GAIN_PFILT_BAND_1"/>
+	<reg32 offset="0x017c" name="PLL_FL_INT_GAIN_PFILT_BAND_2"/>
+	<reg32 offset="0x0180" name="PLL_FASTLOCK_EN_BAND"/>
+	<reg32 offset="0x0184" name="FREQ_TUNE_ACCUM_INIT_MID"/>
+	<reg32 offset="0x0188" name="FREQ_TUNE_ACCUM_INIT_HIGH"/>
+	<reg32 offset="0x018c" name="FREQ_TUNE_ACCUM_INIT_MUX"/>
+	<reg32 offset="0x0190" name="PLL_LOCK_OVERRIDE"/>
+	<reg32 offset="0x0194" name="PLL_LOCK_DELAY"/>
+	<reg32 offset="0x0198" name="PLL_LOCK_MIN_DELAY"/>
+	<reg32 offset="0x019c" name="CLOCK_INVERTERS"/>
+	<reg32 offset="0x01a0" name="SPARE_AND_JPC_OVERRIDES"/>
+	<reg32 offset="0x01a4" name="BIAS_CONTROL_1"/>
+	<reg32 offset="0x01a8" name="BIAS_CONTROL_2"/>
+	<reg32 offset="0x01ac" name="ALOG_OBSV_BUS_CTRL_1"/>
+	<reg32 offset="0x01b0" name="COMMON_STATUS_ONE"/>
+	<reg32 offset="0x01b4" name="COMMON_STATUS_TWO"/>
+	<reg32 offset="0x01b8" name="BAND_SEL_CAL"/>
+	<reg32 offset="0x01bc" name="ICODE_ACCUM_STATUS_LOW"/>
+	<reg32 offset="0x01c0" name="ICODE_ACCUM_STATUS_HIGH"/>
+	<reg32 offset="0x01c4" name="FD_OUT_LOW"/>
+	<reg32 offset="0x01c8" name="FD_OUT_HIGH"/>
+	<reg32 offset="0x01cc" name="ALOG_OBSV_BUS_STATUS_1"/>
+	<reg32 offset="0x01d0" name="PLL_MISC_CONFIG"/>
+	<reg32 offset="0x01d4" name="FLL_CONFIG"/>
+	<reg32 offset="0x01d8" name="FLL_FREQ_ACQ_TIME"/>
+	<reg32 offset="0x01dc" name="FLL_CODE0"/>
+	<reg32 offset="0x01e0" name="FLL_CODE1"/>
+	<reg32 offset="0x01e4" name="FLL_GAIN0"/>
+	<reg32 offset="0x01e8" name="FLL_GAIN1"/>
+	<reg32 offset="0x01ec" name="SW_RESET"/>
+	<reg32 offset="0x01f0" name="FAST_PWRUP"/>
+	<reg32 offset="0x01f4" name="LOCKTIME0"/>
+	<reg32 offset="0x01f8" name="LOCKTIME1"/>
+	<reg32 offset="0x01fc" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x0200" name="DEBUG_BUS0"/>
+	<reg32 offset="0x0204" name="DEBUG_BUS1"/>
+	<reg32 offset="0x0208" name="DEBUG_BUS2"/>
+	<reg32 offset="0x020c" name="DEBUG_BUS3"/>
+	<reg32 offset="0x0210" name="ANALOG_FLL_CONTROL_OVERRIDES"/>
+	<reg32 offset="0x0214" name="VCO_CONFIG"/>
+	<reg32 offset="0x0218" name="VCO_CAL_CODE1_MODE0_STATUS"/>
+	<reg32 offset="0x021c" name="VCO_CAL_CODE1_MODE1_STATUS"/>
+	<reg32 offset="0x0220" name="RESET_SM_STATUS"/>
+	<reg32 offset="0x0224" name="TDC_OFFSET"/>
+	<reg32 offset="0x0228" name="PS3_PWRDOWN_CONTROLS"/>
+	<reg32 offset="0x022c" name="PS4_PWRDOWN_CONTROLS"/>
+	<reg32 offset="0x0230" name="PLL_RST_CONTROLS"/>
+	<reg32 offset="0x0234" name="GEAR_BAND_SELECT_CONTROLS"/>
+	<reg32 offset="0x0238" name="PSM_CLK_CONTROLS"/>
+	<reg32 offset="0x023c" name="SYSTEM_MUXES_2"/>
+	<reg32 offset="0x0240" name="VCO_CONFIG_1"/>
+	<reg32 offset="0x0244" name="VCO_CONFIG_2"/>
+	<reg32 offset="0x0248" name="CLOCK_INVERTERS_1"/>
+	<reg32 offset="0x024c" name="CLOCK_INVERTERS_2"/>
+	<reg32 offset="0x0250" name="CMODE_1"/>
+	<reg32 offset="0x0254" name="CMODE_2"/>
+	<reg32 offset="0x0258" name="ANALOG_CONTROLS_FIVE_1"/>
+	<reg32 offset="0x025c" name="ANALOG_CONTROLS_FIVE_2"/>
+	<reg32 offset="0x0260" name="PERF_OPTIMIZE"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/edp.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/edp.xml
@@ -0,0 +1,239 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="EDP" width="32">
+	<enum name="edp_color_depth">
+		<value name="EDP_6BIT"  value="0"/>
+		<value name="EDP_8BIT"  value="1"/>
+		<value name="EDP_10BIT" value="2"/>
+		<value name="EDP_12BIT" value="3"/>
+		<value name="EDP_16BIT" value="4"/>
+	</enum>
+
+	<enum name="edp_component_format">
+		<value name="EDP_RGB" value="0"/>
+		<value name="EDP_YUV422" value="1"/>
+		<value name="EDP_YUV444" value="2"/>
+	</enum>
+
+	<reg32 offset="0x0004" name="MAINLINK_CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="RESET"  pos="1" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0008" name="STATE_CTRL">
+		<bitfield name="TRAIN_PATTERN_1"       pos="0" type="boolean"/>
+		<bitfield name="TRAIN_PATTERN_2"       pos="1" type="boolean"/>
+		<bitfield name="TRAIN_PATTERN_3"       pos="2" type="boolean"/>
+		<bitfield name="SYMBOL_ERR_RATE_MEAS"  pos="3" type="boolean"/>
+		<bitfield name="PRBS7"                 pos="4" type="boolean"/>
+		<bitfield name="CUSTOM_80_BIT_PATTERN" pos="5" type="boolean"/>
+		<bitfield name="SEND_VIDEO"            pos="6" type="boolean"/>
+		<bitfield name="PUSH_IDLE"             pos="7" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x000c" name="CONFIGURATION_CTRL">
+		<!-- next two may be swapped? -->
+		<bitfield name="SYNC_CLK" pos="0" type="boolean"/>
+		<bitfield name="STATIC_MVID" pos="1" type="boolean"/>
+		<bitfield name="PROGRESSIVE" pos="2" type="boolean"/>
+		<!-- # of lanes minus one: -->
+		<bitfield name="LANES" low="4" high="5" type="uint"/>
+		<bitfield name="ENHANCED_FRAMING" pos="6" type="boolean"/>
+		<!--
+		   NOTE: only 6bit and 8bit valid
+		 -->
+		<bitfield name="COLOR" pos="8" type="edp_color_depth"/>
+	</reg32>
+
+	<reg32 offset="0x0014" name="SOFTWARE_MVID" type="uint"/>
+	<reg32 offset="0x0018" name="SOFTWARE_NVID" type="uint"/>
+
+	<reg32 offset="0x001c" name="TOTAL_HOR_VER">
+		<bitfield name="HORIZ" low="0" high="15" type="uint"/>
+		<bitfield name="VERT"  low="16" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0020" name="START_HOR_VER_FROM_SYNC">
+		<bitfield name="HORIZ" low="0" high="15" type="uint"/>
+		<bitfield name="VERT"  low="16" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0024" name="HSYNC_VSYNC_WIDTH_POLARITY">
+		<bitfield name="HORIZ"  low="0" high="14" type="uint"/>
+		<bitfield name="NHSYNC" pos="15" type="boolean"/>
+		<bitfield name="VERT"   low="16" high="30" type="uint"/>
+		<bitfield name="NVSYNC" pos="31" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0028" name="ACTIVE_HOR_VER">
+		<bitfield name="HORIZ" low="0" high="15" type="uint"/>
+		<bitfield name="VERT"  low="16" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x002c" name="MISC1_MISC0">
+		<!-- MISC0 from DisplayPort v1.2 spec: -->
+		<bitfield name="MISC0" low="0" high="7"/>
+		<!-- aliased MISC0 bitfields: -->
+		<bitfield name="SYNC" pos="0" type="boolean"/>
+		<bitfield name="COMPONENT_FORMAT" low="1" high="2" type="edp_component_format"/>
+		<!-- CEA (vs VESA) color range: -->
+		<bitfield name="CEA" pos="3" type="boolean"/>
+		<!-- YCbCr Colorimetry ITU-R BT709-5 (vs ITU-R BT601-5): -->
+		<bitfield name="BT709_5" pos="4" type="boolean"/>
+		<bitfield name="COLOR" low="5" high="7" type="edp_color_depth"/>
+
+		<!-- MISC1 from DisplayPort v1.2 spec: -->
+		<bitfield name="MISC1" low="8" high="15"/>
+		<!-- aliased MISC1 bitfields: -->
+		<bitfield name="INTERLACED_ODD" pos="8" type="boolean"/>
+		<bitfield name="STEREO" low="9" high="10" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x0074" name="PHY_CTRL">
+		<bitfield name="SW_RESET_PLL" pos="0" type="boolean"/>
+		<bitfield name="SW_RESET" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0084" name="MAINLINK_READY">
+		<bitfield name="TRAIN_PATTERN_1_READY" pos="3" type="boolean"/>
+		<bitfield name="TRAIN_PATTERN_2_READY" pos="4" type="boolean"/>
+		<bitfield name="TRAIN_PATTERN_3_READY" pos="5" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0300" name="AUX_CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="RESET"  pos="1" type="boolean"/>
+	</reg32>
+
+	<!-- interrupt registers come in sets of 3 bits, status/ack/en -->
+	<reg32 offset="0x0308" name="INTERRUPT_REG_1">
+		<bitfield name="HPD"                    pos="0"  type="boolean"/>
+		<bitfield name="HPD_ACK"                pos="1"  type="boolean"/>
+		<bitfield name="HPD_EN"                 pos="2"  type="boolean"/>
+		<bitfield name="AUX_I2C_DONE"           pos="3"  type="boolean"/>
+		<bitfield name="AUX_I2C_DONE_ACK"       pos="4"  type="boolean"/>
+		<bitfield name="AUX_I2C_DONE_EN"        pos="5"  type="boolean"/>
+		<bitfield name="WRONG_ADDR"             pos="6"  type="boolean"/>
+		<bitfield name="WRONG_ADDR_ACK"         pos="7"  type="boolean"/>
+		<bitfield name="WRONG_ADDR_EN"          pos="8"  type="boolean"/>
+		<bitfield name="TIMEOUT"                pos="9"  type="boolean"/>
+		<bitfield name="TIMEOUT_ACK"            pos="10" type="boolean"/>
+		<bitfield name="TIMEOUT_EN"             pos="11" type="boolean"/>
+		<bitfield name="NACK_DEFER"             pos="12" type="boolean"/>
+		<bitfield name="NACK_DEFER_ACK"         pos="13" type="boolean"/>
+		<bitfield name="NACK_DEFER_EN"          pos="14" type="boolean"/>
+		<bitfield name="WRONG_DATA_CNT"         pos="15" type="boolean"/>
+		<bitfield name="WRONG_DATA_CNT_ACK"     pos="16" type="boolean"/>
+		<bitfield name="WRONG_DATA_CNT_EN"      pos="17" type="boolean"/>
+		<bitfield name="I2C_NACK"               pos="18" type="boolean"/>
+		<bitfield name="I2C_NACK_ACK"           pos="19" type="boolean"/>
+		<bitfield name="I2C_NACK_EN"            pos="20" type="boolean"/>
+		<bitfield name="I2C_DEFER"              pos="21" type="boolean"/>
+		<bitfield name="I2C_DEFER_ACK"          pos="22" type="boolean"/>
+		<bitfield name="I2C_DEFER_EN"           pos="23" type="boolean"/>
+		<bitfield name="PLL_UNLOCK"             pos="24" type="boolean"/>
+		<bitfield name="PLL_UNLOCK_ACK"         pos="25" type="boolean"/>
+		<bitfield name="PLL_UNLOCK_EN"          pos="26" type="boolean"/>
+		<bitfield name="AUX_ERROR"              pos="27" type="boolean"/>
+		<bitfield name="AUX_ERROR_ACK"          pos="28" type="boolean"/>
+		<bitfield name="AUX_ERROR_EN"           pos="29" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x030c" name="INTERRUPT_REG_2">
+		<bitfield name="READY_FOR_VIDEO"        pos="0"  type="boolean"/>
+		<bitfield name="READY_FOR_VIDEO_ACK"    pos="1"  type="boolean"/>
+		<bitfield name="READY_FOR_VIDEO_EN"     pos="2"  type="boolean"/>
+		<bitfield name="IDLE_PATTERNs_SENT"     pos="3"  type="boolean"/>
+		<bitfield name="IDLE_PATTERNs_SENT_ACK" pos="4"  type="boolean"/>
+		<bitfield name="IDLE_PATTERNs_SENT_EN"  pos="5"  type="boolean"/>
+		<bitfield name="FRAME_END"              pos="9"  type="boolean"/>
+		<bitfield name="FRAME_END_ACK"          pos="7"  type="boolean"/>
+		<bitfield name="FRAME_END_EN"           pos="8"  type="boolean"/>
+		<bitfield name="CRC_UPDATED"            pos="9"  type="boolean"/>
+		<bitfield name="CRC_UPDATED_ACK"        pos="10" type="boolean"/>
+		<bitfield name="CRC_UPDATED_EN"         pos="11" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0310" name="INTERRUPT_TRANS_NUM"/>
+	<reg32 offset="0x0314" name="AUX_DATA">
+		<bitfield name="READ" pos="0" type="boolean"/>
+		<bitfield name="DATA" low="8" high="15"/>
+		<bitfield name="INDEX" low="16" high="23"/>
+		<bitfield name="INDEX_WRITE" pos="31" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0318" name="AUX_TRANS_CTRL">
+		<bitfield name="I2C" pos="8" type="boolean"/>
+		<bitfield name="GO"  pos="9" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0324" name="AUX_STATUS"/>
+</domain>
+
+<domain name="EDP_PHY" width="32">
+	<array offset="0x0400" name="LN" length="4" stride="0x40">
+		<reg32 offset="0x04" name="PD_CTL"/>
+	</array>
+	<reg32 offset="0x0510" name="GLB_VM_CFG0"/>
+	<reg32 offset="0x0514" name="GLB_VM_CFG1"/>
+	<reg32 offset="0x0518" name="GLB_MISC9"/>
+	<reg32 offset="0x0528" name="GLB_CFG"/>
+	<reg32 offset="0x052c" name="GLB_PD_CTL"/>
+	<reg32 offset="0x0598" name="GLB_PHY_STATUS"/>
+</domain>
+
+<domain name="EDP_28nm_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="REFCLK_CFG"/>
+	<reg32 offset="0x00004" name="POSTDIV1_CFG"/>
+	<reg32 offset="0x00008" name="CHGPUMP_CFG"/>
+	<reg32 offset="0x0000C" name="VCOLPF_CFG"/>
+	<reg32 offset="0x00010" name="VREG_CFG"/>
+	<reg32 offset="0x00014" name="PWRGEN_CFG"/>
+	<reg32 offset="0x00018" name="DMUX_CFG"/>
+	<reg32 offset="0x0001C" name="AMUX_CFG"/>
+	<reg32 offset="0x00020" name="GLB_CFG">
+		<bitfield name="PLL_PWRDN_B" pos="0" type="boolean"/>
+		<bitfield name="PLL_LDO_PWRDN_B" pos="1" type="boolean"/>
+		<bitfield name="PLL_PWRGEN_PWRDN_B" pos="2" type="boolean"/>
+		<bitfield name="PLL_ENABLE" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00024" name="POSTDIV2_CFG"/>
+	<reg32 offset="0x00028" name="POSTDIV3_CFG"/>
+	<reg32 offset="0x0002C" name="LPFR_CFG"/>
+	<reg32 offset="0x00030" name="LPFC1_CFG"/>
+	<reg32 offset="0x00034" name="LPFC2_CFG"/>
+	<reg32 offset="0x00038" name="SDM_CFG0"/>
+	<reg32 offset="0x0003C" name="SDM_CFG1"/>
+	<reg32 offset="0x00040" name="SDM_CFG2"/>
+	<reg32 offset="0x00044" name="SDM_CFG3"/>
+	<reg32 offset="0x00048" name="SDM_CFG4"/>
+	<reg32 offset="0x0004C" name="SSC_CFG0"/>
+	<reg32 offset="0x00050" name="SSC_CFG1"/>
+	<reg32 offset="0x00054" name="SSC_CFG2"/>
+	<reg32 offset="0x00058" name="SSC_CFG3"/>
+	<reg32 offset="0x0005C" name="LKDET_CFG0"/>
+	<reg32 offset="0x00060" name="LKDET_CFG1"/>
+	<reg32 offset="0x00064" name="LKDET_CFG2"/>
+	<reg32 offset="0x00068" name="TEST_CFG">
+		<bitfield name="PLL_SW_RESET" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0006C" name="CAL_CFG0"/>
+	<reg32 offset="0x00070" name="CAL_CFG1"/>
+	<reg32 offset="0x00074" name="CAL_CFG2"/>
+	<reg32 offset="0x00078" name="CAL_CFG3"/>
+	<reg32 offset="0x0007C" name="CAL_CFG4"/>
+	<reg32 offset="0x00080" name="CAL_CFG5"/>
+	<reg32 offset="0x00084" name="CAL_CFG6"/>
+	<reg32 offset="0x00088" name="CAL_CFG7"/>
+	<reg32 offset="0x0008C" name="CAL_CFG8"/>
+	<reg32 offset="0x00090" name="CAL_CFG9"/>
+	<reg32 offset="0x00094" name="CAL_CFG10"/>
+	<reg32 offset="0x00098" name="CAL_CFG11"/>
+	<reg32 offset="0x0009C" name="EFUSE_CFG"/>
+	<reg32 offset="0x000A0" name="DEBUG_BUS_SEL"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/hdmi.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/hdmi.xml
@@ -0,0 +1,1104 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<!--
+	NOTE: also see mdss_hdmi_util.h.. newer devices using MDSS appear
+	to have the same HDMI block (or maybe a newer version?) but for
+	some reason duplicate the code under drivers/video/msm/mdss
+ -->
+
+<domain name="HDMI" width="32">
+	<enum name="hdmi_hdcp_key_state">
+		<value name="HDCP_KEYS_STATE_NO_KEYS" value="0"/>
+		<value name="HDCP_KEYS_STATE_NOT_CHECKED" value="1"/>
+		<value name="HDCP_KEYS_STATE_CHECKING" value="2"/>
+		<value name="HDCP_KEYS_STATE_VALID" value="3"/>
+		<value name="HDCP_KEYS_STATE_AKSV_NOT_VALID" value="4"/>
+		<value name="HDCP_KEYS_STATE_CHKSUM_MISMATCH" value="5"/>
+		<value name="HDCP_KEYS_STATE_PROD_AKSV" value="6"/>
+		<value name="HDCP_KEYS_STATE_RESERVED" value="7"/>
+	</enum>
+	<enum name="hdmi_ddc_read_write">
+		<value name="DDC_WRITE" value="0"/>
+		<value name="DDC_READ" value="1"/>
+	</enum>
+	<enum name="hdmi_acr_cts">
+		<value name="ACR_NONE" value="0"/>
+		<value name="ACR_32" value="1"/>
+		<value name="ACR_44" value="2"/>
+		<value name="ACR_48" value="3"/>
+	</enum>
+
+	<enum name="hdmi_cec_tx_status">
+		<value name="CEC_TX_OK" value="0"/>
+		<value name="CEC_TX_NACK" value="1"/>
+		<value name="CEC_TX_ARB_LOSS" value="2"/>
+		<value name="CEC_TX_MAX_RETRIES" value="3"/>
+	</enum>
+
+	<reg32 offset="0x00000" name="CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="HDMI" pos="1" type="boolean"/>
+		<bitfield name="ENCRYPTED" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00020" name="AUDIO_PKT_CTRL1">
+		<bitfield name="AUDIO_SAMPLE_SEND" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00024" name="ACR_PKT_CTRL">
+		<!--
+			Guessing on order of bitfields from these comments:
+				/* AUDIO_PRIORITY | SOURCE */
+				acr_pck_ctrl_reg |= 0x80000100;
+				/* N_MULTIPLE(multiplier) */
+				acr_pck_ctrl_reg |= (multiplier & 7) << 16;
+				/* SEND | CONT */
+				acr_pck_ctrl_reg |= 0x00000003;
+		 -->
+		<bitfield name="CONT" pos="0" type="boolean"/>
+		<bitfield name="SEND" pos="1" type="boolean"/>
+		<bitfield name="SELECT" low="4" high="5" type="hdmi_acr_cts"/>
+		<bitfield name="SOURCE" pos="8" type="boolean"/>
+		<bitfield name="N_MULTIPLIER" low="16" high="18" type="uint"/>
+		<bitfield name="AUDIO_PRIORITY" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0028" name="VBI_PKT_CTRL">
+		<!--
+			Guessing on the order of bits from:
+				/* GC packet enable (every frame) */
+				/* HDMI_VBI_PKT_CTRL[0x0028] */
+				hdmi_msm_rmw32or(0x0028, 3 << 4);
+				/* HDMI_VBI_PKT_CTRL[0x0028] */
+				/* ISRC Send + Continuous */
+				hdmi_msm_rmw32or(0x0028, 3 << 8);
+				/* HDMI_VBI_PKT_CTRL[0x0028] */
+				/* ACP send, s/w source */
+				hdmi_msm_rmw32or(0x0028, 3 << 12);
+		 -->
+		<bitfield name="GC_ENABLE" pos="4" type="boolean"/>
+		<bitfield name="GC_EVERY_FRAME" pos="5" type="boolean"/>
+		<bitfield name="ISRC_SEND" pos="8" type="boolean"/>
+		<bitfield name="ISRC_CONTINUOUS" pos="9" type="boolean"/>
+		<bitfield name="ACP_SEND" pos="12" type="boolean"/>
+		<bitfield name="ACP_SRC_SW" pos="13" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0002c" name="INFOFRAME_CTRL0">
+		<!--
+			Guessing on the order of these flags, from this comment:
+				/* Set these flags */
+				/* AUDIO_INFO_UPDATE | AUDIO_INFO_SOURCE | AUDIO_INFO_CONT
+				 | AUDIO_INFO_SEND */
+				audio_info_ctrl_reg |= 0x000000F0;
+				/* 0x3 for AVI InfFrame enable (every frame) */
+				HDMI_OUTP(0x002C, HDMI_INP(0x002C) | 0x00000003L);
+		 -->
+		<bitfield name="AVI_SEND" pos="0" type="boolean"/>
+		<bitfield name="AVI_CONT" pos="1" type="boolean"/>           <!-- every frame -->
+		<bitfield name="AUDIO_INFO_SEND" pos="4" type="boolean"/>
+		<bitfield name="AUDIO_INFO_CONT" pos="5" type="boolean"/>    <!-- every frame -->
+		<bitfield name="AUDIO_INFO_SOURCE" pos="6" type="boolean"/>
+		<bitfield name="AUDIO_INFO_UPDATE" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00030" name="INFOFRAME_CTRL1">
+		<bitfield name="AVI_INFO_LINE" low="0" high="5" type="uint"/>
+		<bitfield name="AUDIO_INFO_LINE" low="8" high="13" type="uint"/>
+		<bitfield name="MPEG_INFO_LINE" low="16" high="21" type="uint"/>
+		<bitfield name="VENSPEC_INFO_LINE" low="24" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00034" name="GEN_PKT_CTRL">
+		<!--
+			0x0034 GEN_PKT_CTRL
+			  GENERIC0_SEND   0      0 = Disable Generic0 Packet Transmission
+			                         1 = Enable Generic0 Packet Transmission
+			  GENERIC0_CONT   1      0 = Send Generic0 Packet on next frame only
+			                         1 = Send Generic0 Packet on every frame
+			  GENERIC0_UPDATE 2      NUM
+			  GENERIC1_SEND   4      0 = Disable Generic1 Packet Transmission
+			                         1 = Enable Generic1 Packet Transmission
+			  GENERIC1_CONT   5      0 = Send Generic1 Packet on next frame only
+			                         1 = Send Generic1 Packet on every frame
+			  GENERIC0_LINE   21:16  NUM
+			  GENERIC1_LINE   29:24  NUM
+			
+			GENERIC0_LINE | GENERIC0_UPDATE | GENERIC0_CONT | GENERIC0_SEND
+			Setup HDMI TX generic packet control
+			Enable this packet to transmit every frame
+			Enable this packet to transmit every frame
+			Enable HDMI TX engine to transmit Generic packet 0
+			  HDMI_OUTP(0x0034, (1 << 16) | (1 << 2) | BIT(1) | BIT(0));
+		 -->
+		<bitfield name="GENERIC0_SEND" pos="0" type="boolean"/>
+		<bitfield name="GENERIC0_CONT" pos="1" type="boolean"/>
+		<bitfield name="GENERIC0_UPDATE" low="2" high="3" type="uint"/> <!-- ??? -->
+		<bitfield name="GENERIC1_SEND" pos="4" type="boolean"/>
+		<bitfield name="GENERIC1_CONT" pos="5" type="boolean"/>
+		<bitfield name="GENERIC0_LINE" low="16" high="21" type="uint"/>
+		<bitfield name="GENERIC1_LINE" low="24" high="29" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00040" name="GC">
+		<bitfield name="MUTE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00044" name="AUDIO_PKT_CTRL2">
+		<bitfield name="OVERRIDE" pos="0" type="boolean"/>
+		<bitfield name="LAYOUT" pos="1" type="boolean"/> <!-- 1 for >2 channels -->
+	</reg32>
+
+	<!--
+		AVI_INFO appears to be the infoframe in a slightly weird order..
+		starts with PB0 (checksum), and ends with version..
+	-->
+	<reg32 offset="0x0006c" name="AVI_INFO" stride="4" length="4"/>
+
+	<reg32 offset="0x00084" name="GENERIC0_HDR"/>
+	<reg32 offset="0x00088" name="GENERIC0" stride="4" length="7"/>
+
+	<reg32 offset="0x000a4" name="GENERIC1_HDR"/>
+	<reg32 offset="0x000a8" name="GENERIC1" stride="4" length="7"/>
+
+	<!--
+		TODO add a way to show symbolic offsets into array: hdmi_acr_cts-1
+	 -->
+	<array offset="0x00c4" name="ACR" length="3" stride="8" index="hdmi_acr_cts">
+		<reg32 offset="0" name="0">
+			<bitfield name="CTS" low="12" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="4" name="1">
+			<!-- not sure the actual # of bits.. -->
+			<bitfield name="N" low="0" high="31" type="uint"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0x000e4" name="AUDIO_INFO0">
+		<bitfield name="CHECKSUM" low="0" high="7"/>
+		<bitfield name="CC" low="8" high="10" type="uint"/> <!-- channel count -->
+	</reg32>
+	<reg32 offset="0x000e8" name="AUDIO_INFO1">
+		<bitfield name="CA" low="0" high="7"/>        <!-- Channel Allocation -->
+		<bitfield name="LSV" low="11" high="14"/>     <!-- Level Shift -->
+		<bitfield name="DM_INH" pos="15" type="boolean"/>  <!-- down-mix inhibit flag -->
+	</reg32>
+	<reg32 offset="0x00110" name="HDCP_CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="ENCRYPTION_ENABLE" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00114" name="HDCP_DEBUG_CTRL">
+		<bitfield name="RNG_CIPHER" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00118" name="HDCP_INT_CTRL">
+		<bitfield name="AUTH_SUCCESS_INT" pos="0" type="boolean"/>
+		<bitfield name="AUTH_SUCCESS_ACK" pos="1" type="boolean"/>
+		<bitfield name="AUTH_SUCCESS_MASK" pos="2" type="boolean"/>
+		<bitfield name="AUTH_FAIL_INT" pos="4" type="boolean"/>
+		<bitfield name="AUTH_FAIL_ACK" pos="5" type="boolean"/>
+		<bitfield name="AUTH_FAIL_MASK" pos="6" type="boolean"/>
+		<bitfield name="AUTH_FAIL_INFO_ACK" pos="7" type="boolean"/>
+		<bitfield name="AUTH_XFER_REQ_INT" pos="8" type="boolean"/>
+		<bitfield name="AUTH_XFER_REQ_ACK" pos="9" type="boolean"/>
+		<bitfield name="AUTH_XFER_REQ_MASK" pos="10" type="boolean"/>
+		<bitfield name="AUTH_XFER_DONE_INT" pos="12" type="boolean"/>
+		<bitfield name="AUTH_XFER_DONE_ACK" pos="13" type="boolean"/>
+		<bitfield name="AUTH_XFER_DONE_MASK" pos="14" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0011c" name="HDCP_LINK0_STATUS">
+		<bitfield name="AN_0_READY" pos="8" type="boolean"/>
+		<bitfield name="AN_1_READY" pos="9" type="boolean"/>
+		<bitfield name="RI_MATCHES" pos="12" type="boolean"/>
+		<bitfield name="V_MATCHES" pos="20" type="boolean"/>
+		<bitfield name="KEY_STATE" low="28" high="30" type="hdmi_hdcp_key_state"/>
+	</reg32>
+	<reg32 offset="0x00120" name="HDCP_DDC_CTRL_0">
+		<bitfield name="DISABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00124" name="HDCP_DDC_CTRL_1">
+		<bitfield name="FAILED_ACK" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00128" name="HDCP_DDC_STATUS">
+		<bitfield name="XFER_REQ" pos="4" type="boolean"/>
+		<bitfield name="XFER_DONE" pos="10" type="boolean"/>
+		<bitfield name="ABORTED" pos="12" type="boolean"/>
+		<bitfield name="TIMEOUT" pos="13" type="boolean"/>
+		<bitfield name="NACK0" pos="14" type="boolean"/>
+		<bitfield name="NACK1" pos="15" type="boolean"/>
+		<bitfield name="FAILED" pos="16" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0012c" name="HDCP_ENTROPY_CTRL0"/>
+	<reg32 offset="0x0025c" name="HDCP_ENTROPY_CTRL1"/>
+
+	<reg32 offset="0x00130" name="HDCP_RESET">
+		<bitfield name="LINK0_DEAUTHENTICATE" pos="0" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00134" name="HDCP_RCVPORT_DATA0"/>
+	<reg32 offset="0x00138" name="HDCP_RCVPORT_DATA1"/>
+	<reg32 offset="0x0013C" name="HDCP_RCVPORT_DATA2_0"/>
+	<reg32 offset="0x00140" name="HDCP_RCVPORT_DATA2_1"/>
+	<reg32 offset="0x00144" name="HDCP_RCVPORT_DATA3"/>
+	<reg32 offset="0x00148" name="HDCP_RCVPORT_DATA4"/>
+	<reg32 offset="0x0014c" name="HDCP_RCVPORT_DATA5"/>
+	<reg32 offset="0x00150" name="HDCP_RCVPORT_DATA6"/>
+	<reg32 offset="0x00154" name="HDCP_RCVPORT_DATA7"/>
+	<reg32 offset="0x00158" name="HDCP_RCVPORT_DATA8"/>
+	<reg32 offset="0x0015c" name="HDCP_RCVPORT_DATA9"/>
+	<reg32 offset="0x00160" name="HDCP_RCVPORT_DATA10"/>
+	<reg32 offset="0x00164" name="HDCP_RCVPORT_DATA11"/>
+	<reg32 offset="0x00168" name="HDCP_RCVPORT_DATA12"/>
+
+	<reg32 offset="0x0016c" name="VENSPEC_INFO0"/>
+	<reg32 offset="0x00170" name="VENSPEC_INFO1"/>
+	<reg32 offset="0x00174" name="VENSPEC_INFO2"/>
+	<reg32 offset="0x00178" name="VENSPEC_INFO3"/>
+	<reg32 offset="0x0017c" name="VENSPEC_INFO4"/>
+	<reg32 offset="0x00180" name="VENSPEC_INFO5"/>
+	<reg32 offset="0x00184" name="VENSPEC_INFO6"/>
+
+	<reg32 offset="0x001d0" name="AUDIO_CFG">
+		<bitfield name="ENGINE_ENABLE" pos="0" type="boolean"/>
+		<bitfield name="FIFO_WATERMARK" low="4" high="7" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00208" name="USEC_REFTIMER"/>
+	<reg32 offset="0x0020c" name="DDC_CTRL">
+		<!--
+			 0x020C HDMI_DDC_CTRL
+			[21:20] TRANSACTION_CNT
+				Number of transactions to be done in current transfer.
+				* 0x0: transaction0 only
+				* 0x1: transaction0, transaction1
+				* 0x2: transaction0, transaction1, transaction2
+				* 0x3: transaction0, transaction1, transaction2, transaction3
+			[3] SW_STATUS_RESET
+				Write 1 to reset HDMI_DDC_SW_STATUS flags, will reset SW_DONE,
+				ABORTED, TIMEOUT, SW_INTERRUPTED, BUFFER_OVERFLOW,
+				STOPPED_ON_NACK, NACK0, NACK1, NACK2, NACK3
+			[2] SEND_RESET Set to 1 to send reset sequence (9 clocks with no
+				data) at start of transfer.  This sequence is sent after GO is
+				written to 1, before the first transaction only.
+			[1] SOFT_RESET Write 1 to reset DDC controller
+			[0] GO WRITE ONLY. Write 1 to start DDC transfer.
+		 -->
+		<bitfield name="GO" pos="0" type="boolean"/>
+		<bitfield name="SOFT_RESET" pos="1" type="boolean"/>
+		<bitfield name="SEND_RESET" pos="2" type="boolean"/>
+		<bitfield name="SW_STATUS_RESET" pos="3" type="boolean"/>
+		<bitfield name="TRANSACTION_CNT" low="20" high="21" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00210" name="DDC_ARBITRATION">
+		<bitfield name="HW_ARBITRATION" pos="4" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00214" name="DDC_INT_CTRL">
+		<!--
+			HDMI_DDC_INT_CTRL[0x0214]
+			   [2] SW_DONE_MK Mask bit for SW_DONE_INT. Set to 1 to enable
+			       interrupt.
+			   [1] SW_DONE_ACK WRITE ONLY. Acknowledge bit for SW_DONE_INT.
+			       Write 1 to clear interrupt.
+			   [0] SW_DONE_INT READ ONLY. SW_DONE interrupt status */
+		 -->
+		<bitfield name="SW_DONE_INT" pos="0" type="boolean"/>
+		<bitfield name="SW_DONE_ACK" pos="1" type="boolean"/>
+		<bitfield name="SW_DONE_MASK" pos="2" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00218" name="DDC_SW_STATUS">
+		<bitfield name="NACK0" pos="12" type="boolean"/>
+		<bitfield name="NACK1" pos="13" type="boolean"/>
+		<bitfield name="NACK2" pos="14" type="boolean"/>
+		<bitfield name="NACK3" pos="15" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0021c" name="DDC_HW_STATUS">
+		<bitfield name="DONE" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00220" name="DDC_SPEED">
+		<!--
+		   0x0220 HDMI_DDC_SPEED
+		   [31:16] PRESCALE prescale = (m * xtal_frequency) /
+			(desired_i2c_speed), where m is multiply
+			factor, default: m = 1
+		   [1:0]   THRESHOLD Select threshold to use to determine whether value
+			sampled on SDA is a 1 or 0. Specified in terms of the ratio
+			between the number of sampled ones and the total number of times
+			SDA is sampled.
+			* 0x0: >0
+			* 0x1: 1/4 of total samples
+			* 0x2: 1/2 of total samples
+			* 0x3: 3/4 of total samples */
+		 -->
+		<bitfield name="THRESHOLD" low="0" high="1" type="uint"/>
+		<bitfield name="PRESCALE" low="16" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00224" name="DDC_SETUP">
+		<!--
+			 * 0x0224 HDMI_DDC_SETUP
+			 * Setting 31:24 bits : Time units to wait before timeout
+			 * when clock is being stalled by external sink device
+		 -->
+		<bitfield name="TIMEOUT" low="24" high="31" type="uint"/>
+	</reg32>
+	<!-- Guessing length is 4, as elsewhere the are references to trans0 thru trans3 -->
+	<array offset="0x00228" name="I2C_TRANSACTION" length="4" stride="4">
+		<reg32 offset="0" name="REG">
+			<!--
+				0x0228 HDMI_DDC_TRANS0
+				[23:16] CNT0 Byte count for first transaction (excluding the first
+					byte, which is usually the address).
+				[13] STOP0 Determines whether a stop bit will be sent after the first
+					transaction
+					* 0: NO STOP
+					* 1: STOP
+				[12] START0 Determines whether a start bit will be sent before the
+					first transaction
+					* 0: NO START
+					* 1: START
+				[8] STOP_ON_NACK0 Determines whether the current transfer will stop
+					if a NACK is received during the first transaction (current
+					transaction always stops).
+					* 0: STOP CURRENT TRANSACTION, GO TO NEXT TRANSACTION
+					* 1: STOP ALL TRANSACTIONS, SEND STOP BIT
+				[0] RW0 Read/write indicator for first transaction - set to 0 for
+					write, 1 for read. This bit only controls HDMI_DDC behaviour -
+					the R/W bit in the transaction is programmed into the DDC buffer
+					as the LSB of the address byte.
+					* 0: WRITE
+					* 1: READ
+			 -->
+			<bitfield name="RW" pos="0" type="hdmi_ddc_read_write"/>
+			<bitfield name="STOP_ON_NACK" pos="8" type="boolean"/>
+			<bitfield name="START" pos="12" type="boolean"/>
+			<bitfield name="STOP" pos="13" type="boolean"/>
+			<bitfield name="CNT" low="16" high="23" type="uint"/>
+		</reg32>
+	</array>
+	<reg32 offset="0x00238" name="DDC_DATA">
+		<!--
+			0x0238 HDMI_DDC_DATA
+			[31] INDEX_WRITE WRITE ONLY. To write index field, set this bit to
+				1 while writing HDMI_DDC_DATA.
+			[23:16] INDEX Use to set index into DDC buffer for next read or
+				current write, or to read index of current read or next write.
+				Writable only when INDEX_WRITE=1.
+			[15:8] DATA Use to fill or read the DDC buffer
+			[0] DATA_RW Select whether buffer access will be a read or write.
+				For writes, address auto-increments on write to HDMI_DDC_DATA.
+				For reads, address autoincrements on reads to HDMI_DDC_DATA.
+				* 0: Write
+				* 1: Read
+		 -->
+		<bitfield name="DATA_RW" pos="0" type="hdmi_ddc_read_write"/>
+		<bitfield name="DATA" low="8" high="15" type="uint"/>
+		<bitfield name="INDEX" low="16" high="23" type="uint"/>
+		<bitfield name="INDEX_WRITE" pos="31" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x0023c" name="HDCP_SHA_CTRL"/>
+	<reg32 offset="0x00240" name="HDCP_SHA_STATUS">
+		<bitfield name="BLOCK_DONE" pos="0" type="boolean"/>
+		<bitfield name="COMP_DONE" pos="4" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00244" name="HDCP_SHA_DATA">
+		<bitfield name="DONE" pos="0" type="boolean"/>
+	</reg32>
+
+	<reg32 offset="0x00250" name="HPD_INT_STATUS">
+		<bitfield name="INT" pos="0" type="boolean"/>  <!-- an irq has occurred -->
+		<bitfield name="CABLE_DETECTED" pos="1" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00254" name="HPD_INT_CTRL">
+		<!-- (this useful comment was removed in df6b645.. git archaeology is fun)
+			HPD_INT_CTRL[0x0254]
+			31:10 Reserved
+			9     RCV_PLUGIN_DET_MASK  receiver plug in interrupt mask.
+			                           When programmed to 1,
+			                           RCV_PLUGIN_DET_INT will toggle
+			                           the interrupt line
+			8:6   Reserved
+			5     RX_INT_EN            Panel RX interrupt enable
+			      0: Disable
+			      1: Enable
+			4     RX_INT_ACK           WRITE ONLY. Panel RX interrupt
+			                           ack
+			3     Reserved
+			2     INT_EN               Panel interrupt control
+			      0: Disable
+			      1: Enable
+			1     INT_POLARITY         Panel interrupt polarity
+			      0: generate interrupt on disconnect
+			      1: generate interrupt on connect
+			0     INT_ACK              WRITE ONLY. Panel interrupt ack
+		 -->
+		<bitfield name="INT_ACK" pos="0" type="boolean"/>
+		<bitfield name="INT_CONNECT" pos="1" type="boolean"/>
+		<bitfield name="INT_EN" pos="2" type="boolean"/>
+		<bitfield name="RX_INT_ACK" pos="4" type="boolean"/>
+		<bitfield name="RX_INT_EN" pos="5" type="boolean"/>
+		<bitfield name="RCV_PLUGIN_DET_MASK" pos="9" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00258" name="HPD_CTRL">
+		<bitfield name="TIMEOUT" low="0" high="12" type="uint"/>
+		<bitfield name="ENABLE" pos="28" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0027c" name="DDC_REF">
+		<!--
+			0x027C HDMI_DDC_REF
+			[16] REFTIMER_ENABLE	Enable the timer
+				* 0: Disable
+				* 1: Enable
+			[15:0] REFTIMER	Value to set the register in order to generate
+				DDC strobe. This register counts on HDCP application clock
+
+			/* Enable reference timer
+			 * 27 micro-seconds */
+			HDMI_OUTP_ND(0x027C, (1 << 16) | (27 << 0));
+		 -->
+		<bitfield name="REFTIMER_ENABLE" pos="16" type="boolean"/>
+		<bitfield name="REFTIMER" low="0" high="15" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00284" name="HDCP_SW_UPPER_AKSV"/>
+	<reg32 offset="0x00288" name="HDCP_SW_LOWER_AKSV"/>
+
+	<reg32 offset="0x0028c" name="CEC_CTRL">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="SEND_TRIGGER" pos="1" type="boolean"/>
+		<bitfield name="FRAME_SIZE" low="4" high="8" type="uint"/>
+		<bitfield name="LINE_OE" pos="9" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00290" name="CEC_WR_DATA">
+		<bitfield name="BROADCAST" pos="0" type="boolean"/>
+		<bitfield name="DATA" low="8" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00294" name="CEC_RETRANSMIT">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="COUNT" low="1" high="7" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00298" name="CEC_STATUS">
+		<bitfield name="BUSY" pos="0" type="boolean"/>
+		<bitfield name="TX_FRAME_DONE" pos="3" type="boolean"/>
+		<bitfield name="TX_STATUS" low="4" high="7" type="hdmi_cec_tx_status"/>
+	</reg32>
+	<reg32 offset="0x0029c" name="CEC_INT">
+		<bitfield name="TX_DONE" pos="0" type="boolean"/>
+		<bitfield name="TX_DONE_MASK" pos="1" type="boolean"/>
+		<bitfield name="TX_ERROR" pos="2" type="boolean"/>
+		<bitfield name="TX_ERROR_MASK" pos="3" type="boolean"/>
+		<bitfield name="MONITOR" pos="4" type="boolean"/>
+		<bitfield name="MONITOR_MASK" pos="5" type="boolean"/>
+		<bitfield name="RX_DONE" pos="6" type="boolean"/>
+		<bitfield name="RX_DONE_MASK" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002a0" name="CEC_ADDR"/>
+	<reg32 offset="0x002a4" name="CEC_TIME">
+		<bitfield name="ENABLE" pos="0" type="boolean"/>
+		<bitfield name="SIGNAL_FREE_TIME" low="7" high="15" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002a8" name="CEC_REFTIMER">
+		<bitfield name="REFTIMER" low="0" high="15" type="uint"/>
+		<bitfield name="ENABLE" pos="16" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002ac" name="CEC_RD_DATA">
+		<bitfield name="DATA" low="0" high="7" type="uint"/>
+		<bitfield name="SIZE" low="8" high="12" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002b0" name="CEC_RD_FILTER"/>
+
+	<reg32 offset="0x002b4" name="ACTIVE_HSYNC">
+		<bitfield name="START" low="0" high="12" type="uint"/>
+		<bitfield name="END" low="16" high="27" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002b8" name="ACTIVE_VSYNC">
+		<bitfield name="START" low="0" high="12" type="uint"/>
+		<bitfield name="END" low="16" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002bc" name="VSYNC_ACTIVE_F2">
+		<!-- interlaced, frame 2 -->
+		<bitfield name="START" low="0" high="12" type="uint"/>
+		<bitfield name="END" low="16" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002c0" name="TOTAL">
+		<bitfield name="H_TOTAL" low="0" high="12" type="uint"/>
+		<bitfield name="V_TOTAL" low="16" high="28" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002c4" name="VSYNC_TOTAL_F2">
+		<!-- interlaced, frame 2 -->
+		<bitfield name="V_TOTAL" low="0" high="12" type="uint"/>
+	</reg32>
+	<reg32 offset="0x002c8" name="FRAME_CTRL">
+		<bitfield name="RGB_MUX_SEL_BGR" pos="12" type="boolean"/>
+		<bitfield name="VSYNC_LOW" pos="28" type="boolean"/>
+		<bitfield name="HSYNC_LOW" pos="29" type="boolean"/>
+		<bitfield name="INTERLACED_EN" pos="31" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002cc" name="AUD_INT">
+		<!--
+			HDMI_AUD_INT[0x02CC]
+			[3] AUD_SAM_DROP_MASK [R/W]
+			[2] AUD_SAM_DROP_ACK [W], AUD_SAM_DROP_INT [R]
+			[1] AUD_FIFO_URUN_MASK [R/W]
+			[0] AUD_FIFO_URUN_ACK [W], AUD_FIFO_URUN_INT [R]
+		 -->
+		<bitfield name="AUD_FIFO_URUN_INT" pos="0" type="boolean"/>  <!-- write to ack irq -->
+		<bitfield name="AUD_FIFO_URAN_MASK" pos="1" type="boolean"/> <!-- r/w, enables irq -->
+		<bitfield name="AUD_SAM_DROP_INT" pos="2" type="boolean"/>   <!-- write to ack irq -->
+		<bitfield name="AUD_SAM_DROP_MASK" pos="3" type="boolean"/>  <!-- r/w, enables irq -->
+	</reg32>
+	<reg32 offset="0x002d4" name="PHY_CTRL">
+		<!--
+			in hdmi_phy_reset() it appears to be toggling SW_RESET/
+			SW_RESET_PLL based on the value of the bit above, so
+			I'm guessing the bit above is a polarit bit
+		 -->
+		<bitfield name="SW_RESET_PLL" pos="0" type="boolean"/>
+		<bitfield name="SW_RESET_PLL_LOW" pos="1" type="boolean"/>
+		<bitfield name="SW_RESET" pos="2" type="boolean"/>
+		<bitfield name="SW_RESET_LOW" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x002dc" name="CEC_WR_RANGE"/>
+	<reg32 offset="0x002e0" name="CEC_RD_RANGE"/>
+	<reg32 offset="0x002e4" name="VERSION"/>
+	<reg32 offset="0x00360" name="CEC_COMPL_CTL"/>
+	<reg32 offset="0x00364" name="CEC_RD_START_RANGE"/>
+	<reg32 offset="0x00368" name="CEC_RD_TOTAL_RANGE"/>
+	<reg32 offset="0x0036c" name="CEC_RD_ERR_RESP_LO"/>
+	<reg32 offset="0x00370" name="CEC_WR_CHECK_CONFIG"/>
+
+</domain>
+
+<domain name="HDMI_8x60" width="32">
+	<reg32 offset="0x00000" name="PHY_REG0">
+		<bitfield name="DESER_DEL_CTRL" low="2" high="4" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00004" name="PHY_REG1">
+		<bitfield name="DTEST_MUX_SEL" low="4" high="7" type="uint"/>
+		<bitfield name="OUTVOL_SWING_CTRL" low="0" high="3" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00008" name="PHY_REG2">
+		<bitfield name="PD_DESER" pos="0" type="boolean"/>
+		<bitfield name="PD_DRIVE_1" pos="1" type="boolean"/>
+		<bitfield name="PD_DRIVE_2" pos="2" type="boolean"/>
+		<bitfield name="PD_DRIVE_3" pos="3" type="boolean"/>
+		<bitfield name="PD_DRIVE_4" pos="4" type="boolean"/>
+		<bitfield name="PD_PLL" pos="5" type="boolean"/>
+		<bitfield name="PD_PWRGEN" pos="6" type="boolean"/>
+		<bitfield name="RCV_SENSE_EN" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0000c" name="PHY_REG3">
+		<bitfield name="PLL_ENABLE" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00010" name="PHY_REG4"/>
+	<reg32 offset="0x00014" name="PHY_REG5"/>
+	<reg32 offset="0x00018" name="PHY_REG6"/>
+	<reg32 offset="0x0001c" name="PHY_REG7"/>
+	<reg32 offset="0x00020" name="PHY_REG8"/>
+	<reg32 offset="0x00024" name="PHY_REG9"/>
+	<reg32 offset="0x00028" name="PHY_REG10"/>
+	<reg32 offset="0x0002c" name="PHY_REG11"/>
+	<reg32 offset="0x00030" name="PHY_REG12">
+		<bitfield name="RETIMING_EN" pos="0" type="boolean"/>
+		<bitfield name="PLL_LOCK_DETECT_EN" pos="1" type="boolean"/>
+		<bitfield name="FORCE_LOCK" pos="4" type="boolean"/>
+	</reg32>
+</domain>
+
+<domain name="HDMI_8960" width="32">
+	<!--
+		some of the bitfields may be same as 8x60.. but no helpful comments
+		in msm_dss_io_8960.c
+	 -->
+	<reg32 offset="0x00000" name="PHY_REG0"/>
+	<reg32 offset="0x00004" name="PHY_REG1"/>
+	<reg32 offset="0x00008" name="PHY_REG2"/>
+	<reg32 offset="0x0000c" name="PHY_REG3"/>
+	<reg32 offset="0x00010" name="PHY_REG4"/>
+	<reg32 offset="0x00014" name="PHY_REG5"/>
+	<reg32 offset="0x00018" name="PHY_REG6"/>
+	<reg32 offset="0x0001c" name="PHY_REG7"/>
+	<reg32 offset="0x00020" name="PHY_REG8"/>
+	<reg32 offset="0x00024" name="PHY_REG9"/>
+	<reg32 offset="0x00028" name="PHY_REG10"/>
+	<reg32 offset="0x0002c" name="PHY_REG11"/>
+	<reg32 offset="0x00030" name="PHY_REG12">
+		<bitfield name="SW_RESET" pos="5" type="boolean"/>
+		<bitfield name="PWRDN_B" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00034" name="PHY_REG_BIST_CFG"/>
+	<reg32 offset="0x00038" name="PHY_DEBUG_BUS_SEL"/>
+	<reg32 offset="0x0003c" name="PHY_REG_MISC0"/>
+	<reg32 offset="0x00040" name="PHY_REG13"/>
+	<reg32 offset="0x00044" name="PHY_REG14"/>
+	<reg32 offset="0x00048" name="PHY_REG15"/>
+</domain>
+
+<domain name="HDMI_8960_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="REFCLK_CFG"/>
+	<reg32 offset="0x00004" name="CHRG_PUMP_CFG"/>
+	<reg32 offset="0x00008" name="LOOP_FLT_CFG0"/>
+	<reg32 offset="0x0000c" name="LOOP_FLT_CFG1"/>
+	<reg32 offset="0x00010" name="IDAC_ADJ_CFG"/>
+	<reg32 offset="0x00014" name="I_VI_KVCO_CFG"/>
+	<reg32 offset="0x00018" name="PWRDN_B">
+		<bitfield name="PD_PLL" pos="1" type="boolean"/>
+		<bitfield name="PLL_PWRDN_B" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0001c" name="SDM_CFG0"/>
+	<reg32 offset="0x00020" name="SDM_CFG1"/>
+	<reg32 offset="0x00024" name="SDM_CFG2"/>
+	<reg32 offset="0x00028" name="SDM_CFG3"/>
+	<reg32 offset="0x0002c" name="SDM_CFG4"/>
+	<reg32 offset="0x00030" name="SSC_CFG0"/>
+	<reg32 offset="0x00034" name="SSC_CFG1"/>
+	<reg32 offset="0x00038" name="SSC_CFG2"/>
+	<reg32 offset="0x0003c" name="SSC_CFG3"/>
+	<reg32 offset="0x00040" name="LOCKDET_CFG0"/>
+	<reg32 offset="0x00044" name="LOCKDET_CFG1"/>
+	<reg32 offset="0x00048" name="LOCKDET_CFG2"/>
+	<reg32 offset="0x0004c" name="VCOCAL_CFG0"/>
+	<reg32 offset="0x00050" name="VCOCAL_CFG1"/>
+	<reg32 offset="0x00054" name="VCOCAL_CFG2"/>
+	<reg32 offset="0x00058" name="VCOCAL_CFG3"/>
+	<reg32 offset="0x0005c" name="VCOCAL_CFG4"/>
+	<reg32 offset="0x00060" name="VCOCAL_CFG5"/>
+	<reg32 offset="0x00064" name="VCOCAL_CFG6"/>
+	<reg32 offset="0x00068" name="VCOCAL_CFG7"/>
+	<reg32 offset="0x0006c" name="DEBUG_SEL"/>
+	<reg32 offset="0x00070" name="MISC0"/>
+	<reg32 offset="0x00074" name="MISC1"/>
+	<reg32 offset="0x00078" name="MISC2"/>
+	<reg32 offset="0x0007c" name="MISC3"/>
+	<reg32 offset="0x00080" name="MISC4"/>
+	<reg32 offset="0x00084" name="MISC5"/>
+	<reg32 offset="0x00088" name="MISC6"/>
+	<reg32 offset="0x0008c" name="DEBUG_BUS0"/>
+	<reg32 offset="0x00090" name="DEBUG_BUS1"/>
+	<reg32 offset="0x00094" name="DEBUG_BUS2"/>
+	<reg32 offset="0x00098" name="STATUS0">
+		<bitfield name="PLL_LOCK" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0009c" name="STATUS1"/>
+</domain>
+
+<domain name="HDMI_8x74" width="32">
+	<!--
+		seems to be all mdp5+ have same?
+	 -->
+	<reg32 offset="0x00000" name="ANA_CFG0"/>
+	<reg32 offset="0x00004" name="ANA_CFG1"/>
+	<reg32 offset="0x00008" name="ANA_CFG2"/>
+	<reg32 offset="0x0000c" name="ANA_CFG3"/>
+	<reg32 offset="0x00010" name="PD_CTRL0"/>
+	<reg32 offset="0x00014" name="PD_CTRL1"/>
+	<reg32 offset="0x00018" name="GLB_CFG"/>
+	<reg32 offset="0x0001c" name="DCC_CFG0"/>
+	<reg32 offset="0x00020" name="DCC_CFG1"/>
+	<reg32 offset="0x00024" name="TXCAL_CFG0"/>
+	<reg32 offset="0x00028" name="TXCAL_CFG1"/>
+	<reg32 offset="0x0002c" name="TXCAL_CFG2"/>
+	<reg32 offset="0x00030" name="TXCAL_CFG3"/>
+	<reg32 offset="0x00034" name="BIST_CFG0"/>
+	<reg32 offset="0x0003c" name="BIST_PATN0"/>
+	<reg32 offset="0x00040" name="BIST_PATN1"/>
+	<reg32 offset="0x00044" name="BIST_PATN2"/>
+	<reg32 offset="0x00048" name="BIST_PATN3"/>
+	<reg32 offset="0x0005c" name="STATUS"/>
+</domain>
+
+<domain name="HDMI_28nm_PHY_PLL" width="32">
+	<reg32 offset="0x00000" name="REFCLK_CFG"/>
+	<reg32 offset="0x00004" name="POSTDIV1_CFG"/>
+	<reg32 offset="0x00008" name="CHGPUMP_CFG"/>
+	<reg32 offset="0x0000C" name="VCOLPF_CFG"/>
+	<reg32 offset="0x00010" name="VREG_CFG"/>
+	<reg32 offset="0x00014" name="PWRGEN_CFG"/>
+	<reg32 offset="0x00018" name="DMUX_CFG"/>
+	<reg32 offset="0x0001C" name="AMUX_CFG"/>
+	<reg32 offset="0x00020" name="GLB_CFG">
+		<bitfield name="PLL_PWRDN_B" pos="0" type="boolean"/>
+		<bitfield name="PLL_LDO_PWRDN_B" pos="1" type="boolean"/>
+		<bitfield name="PLL_PWRGEN_PWRDN_B" pos="2" type="boolean"/>
+		<bitfield name="PLL_ENABLE" pos="3" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x00024" name="POSTDIV2_CFG"/>
+	<reg32 offset="0x00028" name="POSTDIV3_CFG"/>
+	<reg32 offset="0x0002C" name="LPFR_CFG"/>
+	<reg32 offset="0x00030" name="LPFC1_CFG"/>
+	<reg32 offset="0x00034" name="LPFC2_CFG"/>
+	<reg32 offset="0x00038" name="SDM_CFG0"/>
+	<reg32 offset="0x0003C" name="SDM_CFG1"/>
+	<reg32 offset="0x00040" name="SDM_CFG2"/>
+	<reg32 offset="0x00044" name="SDM_CFG3"/>
+	<reg32 offset="0x00048" name="SDM_CFG4"/>
+	<reg32 offset="0x0004C" name="SSC_CFG0"/>
+	<reg32 offset="0x00050" name="SSC_CFG1"/>
+	<reg32 offset="0x00054" name="SSC_CFG2"/>
+	<reg32 offset="0x00058" name="SSC_CFG3"/>
+	<reg32 offset="0x0005C" name="LKDET_CFG0"/>
+	<reg32 offset="0x00060" name="LKDET_CFG1"/>
+	<reg32 offset="0x00064" name="LKDET_CFG2"/>
+	<reg32 offset="0x00068" name="TEST_CFG">
+		<bitfield name="PLL_SW_RESET" pos="0" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0006C" name="CAL_CFG0"/>
+	<reg32 offset="0x00070" name="CAL_CFG1"/>
+	<reg32 offset="0x00074" name="CAL_CFG2"/>
+	<reg32 offset="0x00078" name="CAL_CFG3"/>
+	<reg32 offset="0x0007C" name="CAL_CFG4"/>
+	<reg32 offset="0x00080" name="CAL_CFG5"/>
+	<reg32 offset="0x00084" name="CAL_CFG6"/>
+	<reg32 offset="0x00088" name="CAL_CFG7"/>
+	<reg32 offset="0x0008C" name="CAL_CFG8"/>
+	<reg32 offset="0x00090" name="CAL_CFG9"/>
+	<reg32 offset="0x00094" name="CAL_CFG10"/>
+	<reg32 offset="0x00098" name="CAL_CFG11"/>
+	<reg32 offset="0x0009C" name="EFUSE_CFG"/>
+	<reg32 offset="0x000A0" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x000C0" name="STATUS"/>
+</domain>
+
+<domain name="HDMI_8996_PHY" width="32">
+	<reg32 offset="0x00000" name="CFG"/>
+	<reg32 offset="0x00004" name="PD_CTL"/>
+	<reg32 offset="0x00008" name="MODE"/>
+	<reg32 offset="0x0000C" name="MISR_CLEAR"/>
+	<reg32 offset="0x00010" name="TX0_TX1_BIST_CFG0"/>
+	<reg32 offset="0x00014" name="TX0_TX1_BIST_CFG1"/>
+	<reg32 offset="0x00018" name="TX0_TX1_PRBS_SEED_BYTE0"/>
+	<reg32 offset="0x0001C" name="TX0_TX1_PRBS_SEED_BYTE1"/>
+	<reg32 offset="0x00020" name="TX0_TX1_BIST_PATTERN0"/>
+	<reg32 offset="0x00024" name="TX0_TX1_BIST_PATTERN1"/>
+	<reg32 offset="0x00028" name="TX2_TX3_BIST_CFG0"/>
+	<reg32 offset="0x0002C" name="TX2_TX3_BIST_CFG1"/>
+	<reg32 offset="0x00030" name="TX2_TX3_PRBS_SEED_BYTE0"/>
+	<reg32 offset="0x00034" name="TX2_TX3_PRBS_SEED_BYTE1"/>
+	<reg32 offset="0x00038" name="TX2_TX3_BIST_PATTERN0"/>
+	<reg32 offset="0x0003C" name="TX2_TX3_BIST_PATTERN1"/>
+	<reg32 offset="0x00040" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x00044" name="TXCAL_CFG0"/>
+	<reg32 offset="0x00048" name="TXCAL_CFG1"/>
+	<reg32 offset="0x0004C" name="TX0_TX1_LANE_CTL"/>
+	<reg32 offset="0x00050" name="TX2_TX3_LANE_CTL"/>
+	<reg32 offset="0x00054" name="LANE_BIST_CONFIG"/>
+	<reg32 offset="0x00058" name="CLOCK"/>
+	<reg32 offset="0x0005C" name="MISC1"/>
+	<reg32 offset="0x00060" name="MISC2"/>
+	<reg32 offset="0x00064" name="TX0_TX1_BIST_STATUS0"/>
+	<reg32 offset="0x00068" name="TX0_TX1_BIST_STATUS1"/>
+	<reg32 offset="0x0006C" name="TX0_TX1_BIST_STATUS2"/>
+	<reg32 offset="0x00070" name="TX2_TX3_BIST_STATUS0"/>
+	<reg32 offset="0x00074" name="TX2_TX3_BIST_STATUS1"/>
+	<reg32 offset="0x00078" name="TX2_TX3_BIST_STATUS2"/>
+	<reg32 offset="0x0007C" name="PRE_MISR_STATUS0"/>
+	<reg32 offset="0x00080" name="PRE_MISR_STATUS1"/>
+	<reg32 offset="0x00084" name="PRE_MISR_STATUS2"/>
+	<reg32 offset="0x00088" name="PRE_MISR_STATUS3"/>
+	<reg32 offset="0x0008C" name="POST_MISR_STATUS0"/>
+	<reg32 offset="0x00090" name="POST_MISR_STATUS1"/>
+	<reg32 offset="0x00094" name="POST_MISR_STATUS2"/>
+	<reg32 offset="0x00098" name="POST_MISR_STATUS3"/>
+	<reg32 offset="0x0009C" name="STATUS"/>
+	<reg32 offset="0x000A0" name="MISC3_STATUS"/>
+	<reg32 offset="0x000A4" name="MISC4_STATUS"/>
+	<reg32 offset="0x000A8" name="DEBUG_BUS0"/>
+	<reg32 offset="0x000AC" name="DEBUG_BUS1"/>
+	<reg32 offset="0x000B0" name="DEBUG_BUS2"/>
+	<reg32 offset="0x000B4" name="DEBUG_BUS3"/>
+	<reg32 offset="0x000B8" name="PHY_REVISION_ID0"/>
+	<reg32 offset="0x000BC" name="PHY_REVISION_ID1"/>
+	<reg32 offset="0x000C0" name="PHY_REVISION_ID2"/>
+	<reg32 offset="0x000C4" name="PHY_REVISION_ID3"/>
+</domain>
+
+<domain name="HDMI_PHY_QSERDES_COM" width="32">
+	<reg32 offset="0x00000" name="ATB_SEL1"/>
+	<reg32 offset="0x00004" name="ATB_SEL2"/>
+	<reg32 offset="0x00008" name="FREQ_UPDATE"/>
+	<reg32 offset="0x0000C" name="BG_TIMER"/>
+	<reg32 offset="0x00010" name="SSC_EN_CENTER"/>
+	<reg32 offset="0x00014" name="SSC_ADJ_PER1"/>
+	<reg32 offset="0x00018" name="SSC_ADJ_PER2"/>
+	<reg32 offset="0x0001C" name="SSC_PER1"/>
+	<reg32 offset="0x00020" name="SSC_PER2"/>
+	<reg32 offset="0x00024" name="SSC_STEP_SIZE1"/>
+	<reg32 offset="0x00028" name="SSC_STEP_SIZE2"/>
+	<reg32 offset="0x0002C" name="POST_DIV"/>
+	<reg32 offset="0x00030" name="POST_DIV_MUX"/>
+	<reg32 offset="0x00034" name="BIAS_EN_CLKBUFLR_EN"/>
+	<reg32 offset="0x00038" name="CLK_ENABLE1"/>
+	<reg32 offset="0x0003C" name="SYS_CLK_CTRL"/>
+	<reg32 offset="0x00040" name="SYSCLK_BUF_ENABLE"/>
+	<reg32 offset="0x00044" name="PLL_EN"/>
+	<reg32 offset="0x00048" name="PLL_IVCO"/>
+	<reg32 offset="0x0004C" name="LOCK_CMP1_MODE0"/>
+	<reg32 offset="0x00050" name="LOCK_CMP2_MODE0"/>
+	<reg32 offset="0x00054" name="LOCK_CMP3_MODE0"/>
+	<reg32 offset="0x00058" name="LOCK_CMP1_MODE1"/>
+	<reg32 offset="0x0005C" name="LOCK_CMP2_MODE1"/>
+	<reg32 offset="0x00060" name="LOCK_CMP3_MODE1"/>
+	<reg32 offset="0x00064" name="LOCK_CMP1_MODE2"/>
+	<reg32 offset="0x00064" name="CMN_RSVD0"/>
+	<reg32 offset="0x00068" name="LOCK_CMP2_MODE2"/>
+	<reg32 offset="0x00068" name="EP_CLOCK_DETECT_CTRL"/>
+	<reg32 offset="0x0006C" name="LOCK_CMP3_MODE2"/>
+	<reg32 offset="0x0006C" name="SYSCLK_DET_COMP_STATUS"/>
+	<reg32 offset="0x00070" name="BG_TRIM"/>
+	<reg32 offset="0x00074" name="CLK_EP_DIV"/>
+	<reg32 offset="0x00078" name="CP_CTRL_MODE0"/>
+	<reg32 offset="0x0007C" name="CP_CTRL_MODE1"/>
+	<reg32 offset="0x00080" name="CP_CTRL_MODE2"/>
+	<reg32 offset="0x00080" name="CMN_RSVD1"/>
+	<reg32 offset="0x00084" name="PLL_RCTRL_MODE0"/>
+	<reg32 offset="0x00088" name="PLL_RCTRL_MODE1"/>
+	<reg32 offset="0x0008C" name="PLL_RCTRL_MODE2"/>
+	<reg32 offset="0x0008C" name="CMN_RSVD2"/>
+	<reg32 offset="0x00090" name="PLL_CCTRL_MODE0"/>
+	<reg32 offset="0x00094" name="PLL_CCTRL_MODE1"/>
+	<reg32 offset="0x00098" name="PLL_CCTRL_MODE2"/>
+	<reg32 offset="0x00098" name="CMN_RSVD3"/>
+	<reg32 offset="0x0009C" name="PLL_CNTRL"/>
+	<reg32 offset="0x000A0" name="PHASE_SEL_CTRL"/>
+	<reg32 offset="0x000A4" name="PHASE_SEL_DC"/>
+	<reg32 offset="0x000A8" name="CORE_CLK_IN_SYNC_SEL"/>
+	<reg32 offset="0x000A8" name="BIAS_EN_CTRL_BY_PSM"/>
+	<reg32 offset="0x000AC" name="SYSCLK_EN_SEL"/>
+	<reg32 offset="0x000B0" name="CML_SYSCLK_SEL"/>
+	<reg32 offset="0x000B4" name="RESETSM_CNTRL"/>
+	<reg32 offset="0x000B8" name="RESETSM_CNTRL2"/>
+	<reg32 offset="0x000BC" name="RESTRIM_CTRL"/>
+	<reg32 offset="0x000C0" name="RESTRIM_CTRL2"/>
+	<reg32 offset="0x000C4" name="RESCODE_DIV_NUM"/>
+	<reg32 offset="0x000C8" name="LOCK_CMP_EN"/>
+	<reg32 offset="0x000CC" name="LOCK_CMP_CFG"/>
+	<reg32 offset="0x000D0" name="DEC_START_MODE0"/>
+	<reg32 offset="0x000D4" name="DEC_START_MODE1"/>
+	<reg32 offset="0x000D8" name="DEC_START_MODE2"/>
+	<reg32 offset="0x000D8" name="VCOCAL_DEADMAN_CTRL"/>
+	<reg32 offset="0x000DC" name="DIV_FRAC_START1_MODE0"/>
+	<reg32 offset="0x000E0" name="DIV_FRAC_START2_MODE0"/>
+	<reg32 offset="0x000E4" name="DIV_FRAC_START3_MODE0"/>
+	<reg32 offset="0x000E8" name="DIV_FRAC_START1_MODE1"/>
+	<reg32 offset="0x000EC" name="DIV_FRAC_START2_MODE1"/>
+	<reg32 offset="0x000F0" name="DIV_FRAC_START3_MODE1"/>
+	<reg32 offset="0x000F4" name="DIV_FRAC_START1_MODE2"/>
+	<reg32 offset="0x000F4" name="VCO_TUNE_MINVAL1"/>
+	<reg32 offset="0x000F8" name="DIV_FRAC_START2_MODE2"/>
+	<reg32 offset="0x000F8" name="VCO_TUNE_MINVAL2"/>
+	<reg32 offset="0x000FC" name="DIV_FRAC_START3_MODE2"/>
+	<reg32 offset="0x000FC" name="CMN_RSVD4"/>
+	<reg32 offset="0x00100" name="INTEGLOOP_INITVAL"/>
+	<reg32 offset="0x00104" name="INTEGLOOP_EN"/>
+	<reg32 offset="0x00108" name="INTEGLOOP_GAIN0_MODE0"/>
+	<reg32 offset="0x0010C" name="INTEGLOOP_GAIN1_MODE0"/>
+	<reg32 offset="0x00110" name="INTEGLOOP_GAIN0_MODE1"/>
+	<reg32 offset="0x00114" name="INTEGLOOP_GAIN1_MODE1"/>
+	<reg32 offset="0x00118" name="INTEGLOOP_GAIN0_MODE2"/>
+	<reg32 offset="0x00118" name="VCO_TUNE_MAXVAL1"/>
+	<reg32 offset="0x0011C" name="INTEGLOOP_GAIN1_MODE2"/>
+	<reg32 offset="0x0011C" name="VCO_TUNE_MAXVAL2"/>
+	<reg32 offset="0x00120" name="RES_TRIM_CONTROL2"/>
+	<reg32 offset="0x00124" name="VCO_TUNE_CTRL"/>
+	<reg32 offset="0x00128" name="VCO_TUNE_MAP"/>
+	<reg32 offset="0x0012C" name="VCO_TUNE1_MODE0"/>
+	<reg32 offset="0x00130" name="VCO_TUNE2_MODE0"/>
+	<reg32 offset="0x00134" name="VCO_TUNE1_MODE1"/>
+	<reg32 offset="0x00138" name="VCO_TUNE2_MODE1"/>
+	<reg32 offset="0x0013C" name="VCO_TUNE1_MODE2"/>
+	<reg32 offset="0x0013C" name="VCO_TUNE_INITVAL1"/>
+	<reg32 offset="0x00140" name="VCO_TUNE2_MODE2"/>
+	<reg32 offset="0x00140" name="VCO_TUNE_INITVAL2"/>
+	<reg32 offset="0x00144" name="VCO_TUNE_TIMER1"/>
+	<reg32 offset="0x00148" name="VCO_TUNE_TIMER2"/>
+	<reg32 offset="0x0014C" name="SAR"/>
+	<reg32 offset="0x00150" name="SAR_CLK"/>
+	<reg32 offset="0x00154" name="SAR_CODE_OUT_STATUS"/>
+	<reg32 offset="0x00158" name="SAR_CODE_READY_STATUS"/>
+	<reg32 offset="0x0015C" name="CMN_STATUS"/>
+	<reg32 offset="0x00160" name="RESET_SM_STATUS"/>
+	<reg32 offset="0x00164" name="RESTRIM_CODE_STATUS"/>
+	<reg32 offset="0x00168" name="PLLCAL_CODE1_STATUS"/>
+	<reg32 offset="0x0016C" name="PLLCAL_CODE2_STATUS"/>
+	<reg32 offset="0x00170" name="BG_CTRL"/>
+	<reg32 offset="0x00174" name="CLK_SELECT"/>
+	<reg32 offset="0x00178" name="HSCLK_SEL"/>
+	<reg32 offset="0x0017C" name="INTEGLOOP_BINCODE_STATUS"/>
+	<reg32 offset="0x00180" name="PLL_ANALOG"/>
+	<reg32 offset="0x00184" name="CORECLK_DIV"/>
+	<reg32 offset="0x00188" name="SW_RESET"/>
+	<reg32 offset="0x0018C" name="CORE_CLK_EN"/>
+	<reg32 offset="0x00190" name="C_READY_STATUS"/>
+	<reg32 offset="0x00194" name="CMN_CONFIG"/>
+	<reg32 offset="0x00198" name="CMN_RATE_OVERRIDE"/>
+	<reg32 offset="0x0019C" name="SVS_MODE_CLK_SEL"/>
+	<reg32 offset="0x001A0" name="DEBUG_BUS0"/>
+	<reg32 offset="0x001A4" name="DEBUG_BUS1"/>
+	<reg32 offset="0x001A8" name="DEBUG_BUS2"/>
+	<reg32 offset="0x001AC" name="DEBUG_BUS3"/>
+	<reg32 offset="0x001B0" name="DEBUG_BUS_SEL"/>
+	<reg32 offset="0x001B4" name="CMN_MISC1"/>
+	<reg32 offset="0x001B8" name="CMN_MISC2"/>
+	<reg32 offset="0x001BC" name="CORECLK_DIV_MODE1"/>
+	<reg32 offset="0x001C0" name="CORECLK_DIV_MODE2"/>
+	<reg32 offset="0x001C4" name="CMN_RSVD5"/>
+</domain>
+
+
+<domain name="HDMI_PHY_QSERDES_TX_LX" width="32">
+		<reg32 offset="0x00000" name="BIST_MODE_LANENO"/>
+		<reg32 offset="0x00004" name="BIST_INVERT"/>
+		<reg32 offset="0x00008" name="CLKBUF_ENABLE"/>
+		<reg32 offset="0x0000C" name="CMN_CONTROL_ONE"/>
+		<reg32 offset="0x00010" name="CMN_CONTROL_TWO"/>
+		<reg32 offset="0x00014" name="CMN_CONTROL_THREE"/>
+		<reg32 offset="0x00018" name="TX_EMP_POST1_LVL"/>
+		<reg32 offset="0x0001C" name="TX_POST2_EMPH"/>
+		<reg32 offset="0x00020" name="TX_BOOST_LVL_UP_DN"/>
+		<reg32 offset="0x00024" name="HP_PD_ENABLES"/>
+		<reg32 offset="0x00028" name="TX_IDLE_LVL_LARGE_AMP"/>
+		<reg32 offset="0x0002C" name="TX_DRV_LVL"/>
+		<reg32 offset="0x00030" name="TX_DRV_LVL_OFFSET"/>
+		<reg32 offset="0x00034" name="RESET_TSYNC_EN"/>
+		<reg32 offset="0x00038" name="PRE_STALL_LDO_BOOST_EN"/>
+		<reg32 offset="0x0003C" name="TX_BAND"/>
+		<reg32 offset="0x00040" name="SLEW_CNTL"/>
+		<reg32 offset="0x00044" name="INTERFACE_SELECT"/>
+		<reg32 offset="0x00048" name="LPB_EN"/>
+		<reg32 offset="0x0004C" name="RES_CODE_LANE_TX"/>
+		<reg32 offset="0x00050" name="RES_CODE_LANE_RX"/>
+		<reg32 offset="0x00054" name="RES_CODE_LANE_OFFSET"/>
+		<reg32 offset="0x00058" name="PERL_LENGTH1"/>
+		<reg32 offset="0x0005C" name="PERL_LENGTH2"/>
+		<reg32 offset="0x00060" name="SERDES_BYP_EN_OUT"/>
+		<reg32 offset="0x00064" name="DEBUG_BUS_SEL"/>
+		<reg32 offset="0x00068" name="HIGHZ_TRANSCEIVEREN_BIAS_DRVR_EN"/>
+		<reg32 offset="0x0006C" name="TX_POL_INV"/>
+		<reg32 offset="0x00070" name="PARRATE_REC_DETECT_IDLE_EN"/>
+		<reg32 offset="0x00074" name="BIST_PATTERN1"/>
+		<reg32 offset="0x00078" name="BIST_PATTERN2"/>
+		<reg32 offset="0x0007C" name="BIST_PATTERN3"/>
+		<reg32 offset="0x00080" name="BIST_PATTERN4"/>
+		<reg32 offset="0x00084" name="BIST_PATTERN5"/>
+		<reg32 offset="0x00088" name="BIST_PATTERN6"/>
+		<reg32 offset="0x0008C" name="BIST_PATTERN7"/>
+		<reg32 offset="0x00090" name="BIST_PATTERN8"/>
+		<reg32 offset="0x00094" name="LANE_MODE"/>
+		<reg32 offset="0x00098" name="IDAC_CAL_LANE_MODE"/>
+		<reg32 offset="0x0009C" name="IDAC_CAL_LANE_MODE_CONFIGURATION"/>
+		<reg32 offset="0x000A0" name="ATB_SEL1"/>
+		<reg32 offset="0x000A4" name="ATB_SEL2"/>
+		<reg32 offset="0x000A8" name="RCV_DETECT_LVL"/>
+		<reg32 offset="0x000AC" name="RCV_DETECT_LVL_2"/>
+		<reg32 offset="0x000B0" name="PRBS_SEED1"/>
+		<reg32 offset="0x000B4" name="PRBS_SEED2"/>
+		<reg32 offset="0x000B8" name="PRBS_SEED3"/>
+		<reg32 offset="0x000BC" name="PRBS_SEED4"/>
+		<reg32 offset="0x000C0" name="RESET_GEN"/>
+		<reg32 offset="0x000C4" name="RESET_GEN_MUXES"/>
+		<reg32 offset="0x000C8" name="TRAN_DRVR_EMP_EN"/>
+		<reg32 offset="0x000CC" name="TX_INTERFACE_MODE"/>
+		<reg32 offset="0x000D0" name="PWM_CTRL"/>
+		<reg32 offset="0x000D4" name="PWM_ENCODED_OR_DATA"/>
+		<reg32 offset="0x000D8" name="PWM_GEAR_1_DIVIDER_BAND2"/>
+		<reg32 offset="0x000DC" name="PWM_GEAR_2_DIVIDER_BAND2"/>
+		<reg32 offset="0x000E0" name="PWM_GEAR_3_DIVIDER_BAND2"/>
+		<reg32 offset="0x000E4" name="PWM_GEAR_4_DIVIDER_BAND2"/>
+		<reg32 offset="0x000E8" name="PWM_GEAR_1_DIVIDER_BAND0_1"/>
+		<reg32 offset="0x000EC" name="PWM_GEAR_2_DIVIDER_BAND0_1"/>
+		<reg32 offset="0x000F0" name="PWM_GEAR_3_DIVIDER_BAND0_1"/>
+		<reg32 offset="0x000F4" name="PWM_GEAR_4_DIVIDER_BAND0_1"/>
+		<reg32 offset="0x000F8" name="VMODE_CTRL1"/>
+		<reg32 offset="0x000FC" name="VMODE_CTRL2"/>
+		<reg32 offset="0x00100" name="TX_ALOG_INTF_OBSV_CNTL"/>
+		<reg32 offset="0x00104" name="BIST_STATUS"/>
+		<reg32 offset="0x00108" name="BIST_ERROR_COUNT1"/>
+		<reg32 offset="0x0010C" name="BIST_ERROR_COUNT2"/>
+		<reg32 offset="0x00110" name="TX_ALOG_INTF_OBSV"/>
+</domain>
+
+<domain name="HDMI_8998_PHY" width="32">
+	<reg32 offset="0x00000" name="CFG"/>
+	<reg32 offset="0x00004" name="PD_CTL"/>
+	<reg32 offset="0x00010" name="MODE"/>
+	<reg32 offset="0x0005C" name="CLOCK"/>
+	<reg32 offset="0x00068" name="CMN_CTRL"/>
+	<reg32 offset="0x000B4" name="STATUS"/>
+</domain>
+
+<domain name="HDMI_8998_PHY_QSERDES_COM" width="32">
+	<reg32 offset="0x0000" name="ATB_SEL1"/>
+	<reg32 offset="0x0004" name="ATB_SEL2"/>
+	<reg32 offset="0x0008" name="FREQ_UPDATE"/>
+	<reg32 offset="0x000C" name="BG_TIMER"/>
+	<reg32 offset="0x0010" name="SSC_EN_CENTER"/>
+	<reg32 offset="0x0014" name="SSC_ADJ_PER1"/>
+	<reg32 offset="0x0018" name="SSC_ADJ_PER2"/>
+	<reg32 offset="0x001C" name="SSC_PER1"/>
+	<reg32 offset="0x0020" name="SSC_PER2"/>
+	<reg32 offset="0x0024" name="SSC_STEP_SIZE1"/>
+	<reg32 offset="0x0028" name="SSC_STEP_SIZE2"/>
+	<reg32 offset="0x002C" name="POST_DIV"/>
+	<reg32 offset="0x0030" name="POST_DIV_MUX"/>
+	<reg32 offset="0x0034" name="BIAS_EN_CLKBUFLR_EN"/>
+	<reg32 offset="0x0038" name="CLK_ENABLE1"/>
+	<reg32 offset="0x003C" name="SYS_CLK_CTRL"/>
+	<reg32 offset="0x0040" name="SYSCLK_BUF_ENABLE"/>
+	<reg32 offset="0x0044" name="PLL_EN"/>
+	<reg32 offset="0x0048" name="PLL_IVCO"/>
+	<reg32 offset="0x004C" name="CMN_IETRIM"/>
+	<reg32 offset="0x0050" name="CMN_IPTRIM"/>
+	<reg32 offset="0x0060" name="CP_CTRL_MODE0"/>
+	<reg32 offset="0x0064" name="CP_CTRL_MODE1"/>
+	<reg32 offset="0x0068" name="PLL_RCTRL_MODE0"/>
+	<reg32 offset="0x006C" name="PLL_RCTRL_MODE1"/>
+	<reg32 offset="0x0070" name="PLL_CCTRL_MODE0"/>
+	<reg32 offset="0x0074" name="PLL_CCTRL_MODE1"/>
+	<reg32 offset="0x0078" name="PLL_CNTRL"/>
+	<reg32 offset="0x007C" name="BIAS_EN_CTRL_BY_PSM"/>
+	<reg32 offset="0x0080" name="SYSCLK_EN_SEL"/>
+	<reg32 offset="0x0084" name="CML_SYSCLK_SEL"/>
+	<reg32 offset="0x0088" name="RESETSM_CNTRL"/>
+	<reg32 offset="0x008C" name="RESETSM_CNTRL2"/>
+	<reg32 offset="0x0090" name="LOCK_CMP_EN"/>
+	<reg32 offset="0x0094" name="LOCK_CMP_CFG"/>
+	<reg32 offset="0x0098" name="LOCK_CMP1_MODE0"/>
+	<reg32 offset="0x009C" name="LOCK_CMP2_MODE0"/>
+	<reg32 offset="0x00A0" name="LOCK_CMP3_MODE0"/>
+	<reg32 offset="0x00B0" name="DEC_START_MODE0"/>
+	<reg32 offset="0x00B4" name="DEC_START_MODE1"/>
+	<reg32 offset="0x00B8" name="DIV_FRAC_START1_MODE0"/>
+	<reg32 offset="0x00BC" name="DIV_FRAC_START2_MODE0"/>
+	<reg32 offset="0x00C0" name="DIV_FRAC_START3_MODE0"/>
+	<reg32 offset="0x00C4" name="DIV_FRAC_START1_MODE1"/>
+	<reg32 offset="0x00C8" name="DIV_FRAC_START2_MODE1"/>
+	<reg32 offset="0x00CC" name="DIV_FRAC_START3_MODE1"/>
+	<reg32 offset="0x00D0" name="INTEGLOOP_INITVAL"/>
+	<reg32 offset="0x00D4" name="INTEGLOOP_EN"/>
+	<reg32 offset="0x00D8" name="INTEGLOOP_GAIN0_MODE0"/>
+	<reg32 offset="0x00DC" name="INTEGLOOP_GAIN1_MODE0"/>
+	<reg32 offset="0x00E0" name="INTEGLOOP_GAIN0_MODE1"/>
+	<reg32 offset="0x00E4" name="INTEGLOOP_GAIN1_MODE1"/>
+	<reg32 offset="0x00E8" name="VCOCAL_DEADMAN_CTRL"/>
+	<reg32 offset="0x00EC" name="VCO_TUNE_CTRL"/>
+	<reg32 offset="0x00F0" name="VCO_TUNE_MAP"/>
+	<reg32 offset="0x0124" name="CMN_STATUS"/>
+	<reg32 offset="0x0128" name="RESET_SM_STATUS"/>
+	<reg32 offset="0x0138" name="CLK_SEL"/>
+	<reg32 offset="0x013C" name="HSCLK_SEL"/>
+	<reg32 offset="0x0148" name="CORECLK_DIV_MODE0"/>
+	<reg32 offset="0x0150" name="SW_RESET"/>
+	<reg32 offset="0x0154" name="CORE_CLK_EN"/>
+	<reg32 offset="0x0158" name="C_READY_STATUS"/>
+	<reg32 offset="0x015C" name="CMN_CONFIG"/>
+	<reg32 offset="0x0164" name="SVS_MODE_CLK_SEL"/>
+</domain>
+
+<domain name="HDMI_8998_PHY_TXn" width="32">
+	<reg32 offset="0x0000" name="EMP_POST1_LVL"/>
+	<reg32 offset="0x0008" name="INTERFACE_SELECT_TX_BAND"/>
+	<reg32 offset="0x000C" name="CLKBUF_TERM_ENABLE"/>
+	<reg32 offset="0x0014" name="DRV_LVL_RES_CODE_OFFSET"/>
+	<reg32 offset="0x0018" name="DRV_LVL"/>
+	<reg32 offset="0x001C" name="LANE_CONFIG"/>
+	<reg32 offset="0x0024" name="PRE_DRIVER_1"/>
+	<reg32 offset="0x0028" name="PRE_DRIVER_2"/>
+	<reg32 offset="0x002C" name="LANE_MODE"/>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/mdp4.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/mdp4.xml
@@ -0,0 +1,504 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="display/mdp_common.xml"/>
+
+<domain name="MDP4" width="32">
+	<enum name="mdp4_pipe">
+		<brief>pipe names, index into PIPE[]</brief>
+		<value name="VG1" value="0"/>
+		<value name="VG2" value="1"/>
+		<value name="RGB1" value="2"/>
+		<value name="RGB2" value="3"/>
+		<value name="RGB3" value="4"/>
+		<value name="VG3" value="5"/>
+		<value name="VG4" value="6"/>
+	</enum>
+
+	<enum name="mdp4_mixer">
+		<value name="MIXER0" value="0"/>
+		<value name="MIXER1" value="1"/>
+		<value name="MIXER2" value="2"/>
+	</enum>
+
+	<enum name="mdp4_intf">
+		<!--
+			A bit confusing the enums for interface selection:
+				enum {
+					LCDC_RGB_INTF,			/* 0 */
+					DTV_INTF = LCDC_RGB_INTF,	/* 0 */
+					MDDI_LCDC_INTF,			/* 1 */
+					MDDI_INTF,			/* 2 */
+					EBI2_INTF,			/* 3 */
+					TV_INTF = EBI2_INTF,		/* 3 */
+					DSI_VIDEO_INTF,
+					DSI_CMD_INTF
+				};
+			there is some overlap, and not all the values end up getting
+			written to hw (mdp4_display_intf_sel() remaps the last two
+			values to MDDI_LCDC_INTF/MDDI_INTF with extra bits set).. so
+			taking some liberties in guessing the actual meanings/names:
+		 -->
+		<value name="INTF_LCDC_DTV" value="0"/>  <!-- LCDC RGB or DTV (external) -->
+		<value name="INTF_DSI_VIDEO" value="1"/>
+		<value name="INTF_DSI_CMD" value="2"/>
+		<value name="INTF_EBI2_TV" value="3"/>   <!-- EBI2 or TV (external) -->
+	</enum>
+	<enum name="mdp4_cursor_format">
+		<value name="CURSOR_ARGB" value="1"/>
+		<value name="CURSOR_XRGB" value="2"/>
+	</enum>
+	<enum name="mdp4_frame_format">
+		<value name="FRAME_LINEAR" value="0"/>
+		<value name="FRAME_TILE_ARGB_4X4" value="1"/>
+		<value name="FRAME_TILE_YCBCR_420" value="2"/>
+	</enum>
+	<enum name="mdp4_scale_unit">
+		<value name="SCALE_FIR" value="0"/>
+		<value name="SCALE_MN_PHASE" value="1"/>
+		<value name="SCALE_PIXEL_RPT" value="2"/>
+	</enum>
+
+	<bitset name="mdp4_layermixer_in_cfg" inline="yes">
+		<brief>appears to map pipe to mixer stage</brief>
+		<bitfield name="PIPE0" low="0"  high="2"  type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE0_MIXER1" pos="3" type="boolean"/>
+		<bitfield name="PIPE1" low="4"  high="6"  type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE1_MIXER1" pos="7" type="boolean"/>
+		<bitfield name="PIPE2" low="8"  high="10" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE2_MIXER1" pos="11" type="boolean"/>
+		<bitfield name="PIPE3" low="12" high="14" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE3_MIXER1" pos="15" type="boolean"/>
+		<bitfield name="PIPE4" low="16" high="18" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE4_MIXER1" pos="19" type="boolean"/>
+		<bitfield name="PIPE5" low="20" high="22" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE5_MIXER1" pos="23" type="boolean"/>
+		<bitfield name="PIPE6" low="24" high="26" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE6_MIXER1" pos="27" type="boolean"/>
+		<bitfield name="PIPE7" low="28" high="30" type="mdp_mixer_stage_id"/>
+		<bitfield name="PIPE7_MIXER1" pos="31" type="boolean"/>
+	</bitset>
+
+	<bitset name="MDP4_IRQ">
+		<bitfield name="OVERLAY0_DONE" pos="0" type="boolean"/>
+		<bitfield name="OVERLAY1_DONE" pos="1" type="boolean"/>
+		<bitfield name="DMA_S_DONE" pos="2" type="boolean"/>
+		<bitfield name="DMA_E_DONE" pos="3" type="boolean"/>
+		<bitfield name="DMA_P_DONE" pos="4" type="boolean"/>
+		<bitfield name="VG1_HISTOGRAM" pos="5" type="boolean"/>
+		<bitfield name="VG2_HISTOGRAM" pos="6" type="boolean"/>
+		<bitfield name="PRIMARY_VSYNC" pos="7" type="boolean"/>
+		<bitfield name="PRIMARY_INTF_UDERRUN" pos="8" type="boolean"/>
+		<bitfield name="EXTERNAL_VSYNC" pos="9" type="boolean"/>
+		<bitfield name="EXTERNAL_INTF_UDERRUN" pos="10" type="boolean"/>
+		<bitfield name="PRIMARY_RDPTR" pos="11" type="boolean"/>  <!-- read pointer -->
+		<bitfield name="DMA_P_HISTOGRAM" pos="17" type="boolean"/>
+		<bitfield name="DMA_S_HISTOGRAM" pos="26" type="boolean"/>
+		<bitfield name="OVERLAY2_DONE" pos="30" type="boolean"/>
+	</bitset>
+
+	<reg32 offset="0x00000" name="VERSION">
+		<!--
+			from mdp_probe() we can see minor rev starts at 16.. assume
+			major is above that.. not sure the rest of bits but doesn't
+			really seem to matter
+		 -->
+		<bitfield name="MINOR" low="16" high="23" type="uint"/>
+		<bitfield name="MAJOR" low="24" high="31" type="uint"/>
+	</reg32>
+	<reg32 offset="0x00004" name="OVLP0_KICK"/>
+	<reg32 offset="0x00008" name="OVLP1_KICK"/>
+	<reg32 offset="0x000d0" name="OVLP2_KICK"/>
+	<reg32 offset="0x0000c" name="DMA_P_KICK"/>
+	<reg32 offset="0x00010" name="DMA_S_KICK"/>
+	<reg32 offset="0x00014" name="DMA_E_KICK"/>
+	<reg32 offset="0x00018" name="DISP_STATUS"/>
+
+	<reg32 offset="0x00038" name="DISP_INTF_SEL">
+		<bitfield name="PRIM" low="0" high="1" type="mdp4_intf"/>
+		<bitfield name="SEC" low="2" high="3" type="mdp4_intf"/>
+		<bitfield name="EXT" low="4" high="5" type="mdp4_intf"/>
+		<bitfield name="DSI_VIDEO" pos="6" type="boolean"/>
+		<bitfield name="DSI_CMD" pos="7" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x0003c" name="RESET_STATUS"/>  <!-- only mdp4 >v2.1 -->
+	<reg32 offset="0x0004c" name="READ_CNFG"/>  <!-- something about # of pending requests.. -->
+	<reg32 offset="0x00050" name="INTR_ENABLE" type="MDP4_IRQ"/>
+	<reg32 offset="0x00054" name="INTR_STATUS" type="MDP4_IRQ"/>
+	<reg32 offset="0x00058" name="INTR_CLEAR" type="MDP4_IRQ"/>
+	<reg32 offset="0x00060" name="EBI2_LCD0"/>
+	<reg32 offset="0x00064" name="EBI2_LCD1"/>
+	<reg32 offset="0x00070" name="PORTMAP_MODE"/>
+
+	<!-- mdp chip-select controller: -->
+	<reg32 offset="0x000c0" name="CS_CONTROLLER0"/>
+	<reg32 offset="0x000c4" name="CS_CONTROLLER1"/>
+
+	<reg32 offset="0x100f0" name="LAYERMIXER2_IN_CFG" type="mdp4_layermixer_in_cfg"/>
+	<reg32 offset="0x100fc" name="LAYERMIXER_IN_CFG_UPDATE_METHOD"/>
+	<reg32 offset="0x10100" name="LAYERMIXER_IN_CFG" type="mdp4_layermixer_in_cfg"/>
+
+	<reg32 offset="0x30050" name="VG2_SRC_FORMAT"/>
+	<reg32 offset="0x31008" name="VG2_CONST_COLOR"/>
+
+	<reg32 offset="0x18000" name="OVERLAY_FLUSH">
+		<bitfield name="OVLP0" pos="0" type="boolean"/>
+		<bitfield name="OVLP1" pos="1" type="boolean"/>
+		<bitfield name="VG1" pos="2" type="boolean"/>
+		<bitfield name="VG2" pos="3" type="boolean"/>
+		<bitfield name="RGB1" pos="4" type="boolean"/>
+		<bitfield name="RGB2" pos="5" type="boolean"/>
+	</reg32>
+
+	<array offsets="0x10000,0x18000,0x88000" name="OVLP" length="3" stride="0x8000">
+		<reg32 offset="0x0004" name="CFG"/>
+		<reg32 offset="0x0008" name="SIZE" type="reg_wh"/>
+		<reg32 offset="0x000c" name="BASE"/>
+		<reg32 offset="0x0010" name="STRIDE" type="uint"/>
+		<reg32 offset="0x0014" name="OPMODE"/>
+
+		<array offsets="0x0104,0x0124,0x0144,0x0160" name="STAGE" length="4" stride="0x1c">
+			<reg32 offset="0x00" name="OP">
+				<bitfield name="FG_ALPHA" low="0" high="1" type="mdp_alpha_type"/>
+				<bitfield name="FG_INV_ALPHA" pos="2" type="boolean"/>
+				<bitfield name="FG_MOD_ALPHA" pos="3" type="boolean"/>
+				<bitfield name="BG_ALPHA" low="4" high="5" type="mdp_alpha_type"/>
+				<bitfield name="BG_INV_ALPHA" pos="6" type="boolean"/>
+				<bitfield name="BG_MOD_ALPHA" pos="7" type="boolean"/>
+				<bitfield name="FG_TRANSP" pos="8" type="boolean"/>
+				<bitfield name="BG_TRANSP" pos="9" type="boolean"/>
+			</reg32>
+			<reg32 offset="0x04" name="FG_ALPHA"/>
+			<reg32 offset="0x08" name="BG_ALPHA"/>
+			<reg32 offset="0x0c" name="TRANSP_LOW0"/>
+			<reg32 offset="0x10" name="TRANSP_LOW1"/>
+			<reg32 offset="0x14" name="TRANSP_HIGH0"/>
+			<reg32 offset="0x18" name="TRANSP_HIGH1"/>
+		</array>
+
+		<array offsets="0x1004,0x1404,0x1804,0x1b84" name="STAGE_CO3" length="4" stride="4">
+			<reg32 offset="0" name="SEL">
+				<bitfield name="FG_ALPHA" pos="0" type="boolean"/> <!-- otherwise bg alpha -->
+			</reg32>
+		</array>
+
+		<reg32 offset="0x0180" name="TRANSP_LOW0"/>
+		<reg32 offset="0x0184" name="TRANSP_LOW1"/>
+		<reg32 offset="0x0188" name="TRANSP_HIGH0"/>
+		<reg32 offset="0x018c" name="TRANSP_HIGH1"/>
+
+		<reg32 offset="0x0200" name="CSC_CONFIG"/>
+
+		<array offset="0x2000" name="CSC" length="1" stride="0x700">
+			<array offset="0x400" name="MV" length="9" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x500" name="PRE_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x580" name="POST_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x600" name="PRE_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x680" name="POST_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+		</array>
+	</array>
+
+	<enum name="mdp4_dma">
+		<value name="DMA_P" value="0"/>
+		<value name="DMA_S" value="1"/>
+		<value name="DMA_E" value="2"/>
+	</enum>
+	<reg32 offset="0x90070" name="DMA_P_OP_MODE"/>
+	<array offset="0x94800" name="LUTN" length="2" stride="0x400">
+		<array offset="0" name="LUT" length="0x100" stride="4">
+			<reg32 offset="0" name="VAL"/>
+		</array>
+	</array>
+	<reg32 offset="0xa0028" name="DMA_S_OP_MODE"/>
+	<!-- I guess if DMA_S has an OP_MODE, it must have a LUT too.. -->
+	<reg32 offset="0xb0070" name="DMA_E_QUANT" length="3" stride="4"/>
+	<array offsets="0x90000,0xa0000,0xb0000" name="DMA" length="3" stride="0x10000" index="mdp4_dma">
+		<reg32 offset="0x0000" name="CONFIG">
+			<bitfield name="G_BPC" low="0" high="1" type="mdp_bpc"/>
+			<bitfield name="B_BPC" low="2" high="3" type="mdp_bpc"/>
+			<bitfield name="R_BPC" low="4" high="5" type="mdp_bpc"/>
+			<bitfield name="PACK_ALIGN_MSB" pos="7" type="boolean"/>
+			<bitfield name="PACK" low="8" high="15"/>
+			<!-- bit 24 is DITHER_EN on DMA_P, DEFLKR_EN on DMA_E -->
+			<bitfield name="DEFLKR_EN" pos="24" type="boolean"/>
+			<bitfield name="DITHER_EN" pos="24" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x0004" name="SRC_SIZE" type="reg_wh"/>
+		<reg32 offset="0x0008" name="SRC_BASE"/>
+		<reg32 offset="0x000c" name="SRC_STRIDE" type="uint"/>
+		<reg32 offset="0x0010" name="DST_SIZE" type="reg_wh"/>
+
+		<reg32 offset="0x0044" name="CURSOR_SIZE">
+			<!-- seems the limit is 64x64: -->
+			<bitfield name="WIDTH" low="0" high="6" type="uint"/>
+			<bitfield name="HEIGHT" low="16" high="22" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0048" name="CURSOR_BASE"/>
+		<reg32 offset="0x004c" name="CURSOR_POS">
+			<bitfield name="X" low="0" high="15" type="uint"/>
+			<bitfield name="Y" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0060" name="CURSOR_BLEND_CONFIG">
+			<bitfield name="CURSOR_EN" pos="0" type="boolean"/>
+			<bitfield name="FORMAT" low="1" high="2" type="mdp4_cursor_format"/>
+			<bitfield name="TRANSP_EN" pos="3" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x0064" name="CURSOR_BLEND_PARAM"/>
+		<reg32 offset="0x0068" name="BLEND_TRANS_LOW"/>
+		<reg32 offset="0x006c" name="BLEND_TRANS_HIGH"/>
+
+		<reg32 offset="0x1004" name="FETCH_CONFIG"/>
+		<array offset="0x3000" name="CSC" length="1" stride="0x700">
+			<array offset="0x400" name="MV" length="9" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x500" name="PRE_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x580" name="POST_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x600" name="PRE_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x680" name="POST_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+		</array>
+	</array>
+
+	<!--
+		TODO length should be 7, but that would collide w/ OVLP2..!?!
+		this register map is a bit strange..
+	 -->
+	<array offset="0x20000" name="PIPE" length="6" stride="0x10000" index="mdp4_pipe">
+		<reg32 offset="0x0000" name="SRC_SIZE" type="reg_wh"/>
+		<reg32 offset="0x0004" name="SRC_XY" type="reg_xy"/>
+		<reg32 offset="0x0008" name="DST_SIZE" type="reg_wh"/>
+		<reg32 offset="0x000c" name="DST_XY" type="reg_xy"/>
+		<reg32 offset="0x0010" name="SRCP0_BASE"/>
+		<reg32 offset="0x0014" name="SRCP1_BASE"/>
+		<reg32 offset="0x0018" name="SRCP2_BASE"/>
+		<reg32 offset="0x001c" name="SRCP3_BASE"/>
+		<reg32 offset="0x0040" name="SRC_STRIDE_A">
+			<bitfield name="P0" low="0" high="15" type="uint"/>
+			<bitfield name="P1" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0044" name="SRC_STRIDE_B">
+			<bitfield name="P2" low="0" high="15" type="uint"/>
+			<bitfield name="P3" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0048" name="SSTILE_FRAME_SIZE" type="reg_wh"/>
+		<reg32 offset="0x0050" name="SRC_FORMAT">
+			<bitfield name="G_BPC" low="0" high="1" type="mdp_bpc"/>
+			<bitfield name="B_BPC" low="2" high="3" type="mdp_bpc"/>
+			<bitfield name="R_BPC" low="4" high="5" type="mdp_bpc"/>
+			<bitfield name="A_BPC" low="6" high="7" type="mdp_bpc_alpha"/>
+			<bitfield name="ALPHA_ENABLE" pos="8" type="boolean"/>
+			<bitfield name="CPP" low="9" high="10" type="uint">
+				<brief>8bit characters per pixel minus 1</brief>
+			</bitfield>
+			<bitfield name="ROTATED_90" pos="12" type="boolean"/>
+			<bitfield name="UNPACK_COUNT" low="13" high="14" type="uint"/>
+			<bitfield name="UNPACK_TIGHT" pos="17" type="boolean"/>
+			<bitfield name="UNPACK_ALIGN_MSB" pos="18" type="boolean"/>
+			<bitfield name="FETCH_PLANES" low="19" high="20" type="uint"/>
+			<bitfield name="SOLID_FILL" pos="22" type="boolean"/>
+			<bitfield name="CHROMA_SAMP" low="26" high="27" type="mdp_chroma_samp_type"/>
+			<bitfield name="FRAME_FORMAT" low="29" high="30" type="mdp4_frame_format"/>
+		</reg32>
+		<reg32 offset="0x0054" name="SRC_UNPACK" type="mdp_unpack_pattern"/>
+		<reg32 offset="0x0058" name="OP_MODE">
+			<bitfield name="SCALEX_EN" pos="0" type="boolean"/>
+			<bitfield name="SCALEY_EN" pos="1" type="boolean"/>
+			<bitfield name="SCALEX_UNIT_SEL" low="2" high="3" type="mdp4_scale_unit"/>
+			<bitfield name="SCALEY_UNIT_SEL" low="4" high="5" type="mdp4_scale_unit"/>
+			<bitfield name="SRC_YCBCR" pos="9" type="boolean"/>
+			<bitfield name="DST_YCBCR" pos="10" type="boolean"/>
+			<bitfield name="CSC_EN" pos="11" type="boolean"/>
+			<bitfield name="FLIP_LR" pos="13" type="boolean"/>
+			<bitfield name="FLIP_UD" pos="14" type="boolean"/>
+			<bitfield name="DITHER_EN" pos="15" type="boolean"/>
+			<bitfield name="IGC_LUT_EN" pos="16" type="boolean"/>
+			<bitfield name="DEINT_EN" pos="18" type="boolean"/>
+			<bitfield name="DEINT_ODD_REF" pos="19" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x005c" name="PHASEX_STEP"/>
+		<reg32 offset="0x0060" name="PHASEY_STEP"/>
+		<reg32 offset="0x1004" name="FETCH_CONFIG"/>
+		<reg32 offset="0x1008" name="SOLID_COLOR"/>
+
+		<array offset="0x4000" name="CSC" length="1" stride="0x700">
+			<array offset="0x400" name="MV" length="9" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x500" name="PRE_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x580" name="POST_BV" length="3" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x600" name="PRE_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+			<array offset="0x680" name="POST_LV" length="6" stride="4">
+				<reg32 offset="0" name="VAL"/>
+			</array>
+		</array>
+	</array>
+
+	<!--
+		ENCODERS
+			LCDC and DSI seem the same, DTV is just slightly different..
+	 -->
+
+	<bitset name="mdp4_ctrl_polarity" inline="yes">
+		<!-- not entirely sure if these bits mean hi or low.. -->
+		<bitfield name="HSYNC_LOW" pos="0" type="boolean"/>
+		<bitfield name="VSYNC_LOW" pos="1" type="boolean"/>
+		<bitfield name="DATA_EN_LOW" pos="2" type="boolean"/>
+	</bitset>
+
+	<bitset name="mdp4_active_hctl" inline="yes">
+		<bitfield name="START" low="0" high="14" type="uint"/>
+		<bitfield name="END" low="16" high="30" type="uint"/>
+		<bitfield name="ACTIVE_START_X" pos="31" type="boolean"/>
+	</bitset>
+
+	<bitset name="mdp4_display_hctl" inline="yes">
+		<bitfield name="START" low="0" high="15" type="uint"/>
+		<bitfield name="END" low="16" high="31" type="uint"/>
+	</bitset>
+
+	<bitset name="mdp4_hsync_ctrl" inline="yes">
+		<bitfield name="PULSEW" low="0" high="15" type="uint"/>
+		<bitfield name="PERIOD" low="16" high="31" type="uint"/>
+	</bitset>
+
+	<bitset name="mdp4_underflow_clr" inline="yes">
+		<bitfield name="COLOR" low="0" high="23"/>
+		<bitfield name="ENABLE_RECOVERY" pos="31" type="boolean"/>
+	</bitset>
+
+	<!-- offset is 0xe0000 on !mdp4.. -->
+	<array offset="0xc0000" name="LCDC" length="1" stride="0x1000">
+		<reg32 offset="0x0000" name="ENABLE"/>
+		<reg32 offset="0x0004" name="HSYNC_CTRL" type="mdp4_hsync_ctrl"/>
+		<reg32 offset="0x0008" name="VSYNC_PERIOD" type="uint"/>
+		<reg32 offset="0x000c" name="VSYNC_LEN" type="uint"/>
+		<reg32 offset="0x0010" name="DISPLAY_HCTRL" type="mdp4_display_hctl"/>
+		<reg32 offset="0x0014" name="DISPLAY_VSTART" type="uint"/>
+		<reg32 offset="0x0018" name="DISPLAY_VEND" type="uint"/>
+		<reg32 offset="0x001c" name="ACTIVE_HCTL" type="mdp4_active_hctl"/>
+		<reg32 offset="0x0020" name="ACTIVE_VSTART" type="uint"/>
+		<reg32 offset="0x0024" name="ACTIVE_VEND" type="uint"/>
+		<reg32 offset="0x0028" name="BORDER_CLR"/>
+		<reg32 offset="0x002c" name="UNDERFLOW_CLR" type="mdp4_underflow_clr"/>
+		<reg32 offset="0x0030" name="HSYNC_SKEW"/>
+		<reg32 offset="0x0034" name="TEST_CNTL"/>
+		<reg32 offset="0x0038" name="CTRL_POLARITY" type="mdp4_ctrl_polarity"/>
+	</array>
+
+	<reg32 offset="0xc2000" name="LCDC_LVDS_INTF_CTL">
+		<bitfield name="MODE_SEL"           pos="2"  type="boolean"/>
+		<bitfield name="RGB_OUT"            pos="3"  type="boolean"/>
+		<bitfield name="CH_SWAP"            pos="4"  type="boolean"/>
+		<bitfield name="CH1_RES_BIT"        pos="5"  type="boolean"/>
+		<bitfield name="CH2_RES_BIT"        pos="6"  type="boolean"/>
+		<bitfield name="ENABLE"             pos="7"  type="boolean"/>
+		<bitfield name="CH1_DATA_LANE0_EN"  pos="8"  type="boolean"/>
+		<bitfield name="CH1_DATA_LANE1_EN"  pos="9"  type="boolean"/>
+		<bitfield name="CH1_DATA_LANE2_EN"  pos="10" type="boolean"/>
+		<bitfield name="CH1_DATA_LANE3_EN"  pos="11" type="boolean"/>
+		<bitfield name="CH2_DATA_LANE0_EN"  pos="12" type="boolean"/>
+		<bitfield name="CH2_DATA_LANE1_EN"  pos="13" type="boolean"/>
+		<bitfield name="CH2_DATA_LANE2_EN"  pos="14" type="boolean"/>
+		<bitfield name="CH2_DATA_LANE3_EN"  pos="15" type="boolean"/>
+		<bitfield name="CH1_CLK_LANE_EN"    pos="16" type="boolean"/>
+		<bitfield name="CH2_CLK_LANE_EN"    pos="17" type="boolean"/>
+	</reg32>
+
+	<array offset="0xc2014" name="LCDC_LVDS_MUX_CTL" length="4" stride="0x8">
+		<reg32 offset="0x0" name="3_TO_0">
+			<bitfield name="BIT0" low="0"  high="7"/>
+			<bitfield name="BIT1" low="8"  high="15"/>
+			<bitfield name="BIT2" low="16" high="23"/>
+			<bitfield name="BIT3" low="24" high="31"/>
+		</reg32>
+		<reg32 offset="0x4" name="6_TO_4">
+			<bitfield name="BIT4" low="0"  high="7"/>
+			<bitfield name="BIT5" low="8"  high="15"/>
+			<bitfield name="BIT6" low="16" high="23"/>
+		</reg32>
+	</array>
+
+	<reg32 offset="0xc2034" name="LCDC_LVDS_PHY_RESET"/>
+
+	<reg32 offset="0xc3000" name="LVDS_PHY_PLL_CTRL_0"/>
+	<reg32 offset="0xc3004" name="LVDS_PHY_PLL_CTRL_1"/>
+	<reg32 offset="0xc3008" name="LVDS_PHY_PLL_CTRL_2"/>
+	<reg32 offset="0xc300c" name="LVDS_PHY_PLL_CTRL_3"/>
+	<reg32 offset="0xc3014" name="LVDS_PHY_PLL_CTRL_5"/>
+	<reg32 offset="0xc3018" name="LVDS_PHY_PLL_CTRL_6"/>
+	<reg32 offset="0xc301c" name="LVDS_PHY_PLL_CTRL_7"/>
+	<reg32 offset="0xc3020" name="LVDS_PHY_PLL_CTRL_8"/>
+	<reg32 offset="0xc3024" name="LVDS_PHY_PLL_CTRL_9"/>
+	<reg32 offset="0xc3080" name="LVDS_PHY_PLL_LOCKED"/>
+	<reg32 offset="0xc3108" name="LVDS_PHY_CFG2"/>
+
+	<reg32 offset="0xc3100" name="LVDS_PHY_CFG0">
+		<bitfield name="SERIALIZATION_ENBLE" pos="4" type="boolean"/>
+		<bitfield name="CHANNEL0" pos="6" type="boolean"/>
+		<bitfield name="CHANNEL1" pos="7" type="boolean"/>
+	</reg32>
+
+	<array offset="0xd0000" name="DTV" length="1" stride="0x1000">
+		<reg32 offset="0x0000" name="ENABLE"/>
+		<reg32 offset="0x0004" name="HSYNC_CTRL" type="mdp4_hsync_ctrl"/>
+		<reg32 offset="0x0008" name="VSYNC_PERIOD" type="uint"/>
+		<reg32 offset="0x000c" name="VSYNC_LEN" type="uint"/>
+		<reg32 offset="0x0018" name="DISPLAY_HCTRL" type="mdp4_display_hctl"/>
+		<reg32 offset="0x001c" name="DISPLAY_VSTART" type="uint"/>
+		<reg32 offset="0x0020" name="DISPLAY_VEND" type="uint"/>
+		<reg32 offset="0x002c" name="ACTIVE_HCTL" type="mdp4_active_hctl"/>
+		<reg32 offset="0x0030" name="ACTIVE_VSTART" type="uint"/>
+		<reg32 offset="0x0038" name="ACTIVE_VEND" type="uint"/>
+		<reg32 offset="0x0040" name="BORDER_CLR"/>
+		<reg32 offset="0x0044" name="UNDERFLOW_CLR" type="mdp4_underflow_clr"/>
+		<reg32 offset="0x0048" name="HSYNC_SKEW"/>
+		<reg32 offset="0x004c" name="TEST_CNTL"/>
+		<reg32 offset="0x0050" name="CTRL_POLARITY" type="mdp4_ctrl_polarity"/>
+	</array>
+
+	<array offset="0xe0000" name="DSI" length="1" stride="0x1000">
+		<reg32 offset="0x0000" name="ENABLE"/>
+		<reg32 offset="0x0004" name="HSYNC_CTRL" type="mdp4_hsync_ctrl"/>
+		<reg32 offset="0x0008" name="VSYNC_PERIOD" type="uint"/>
+		<reg32 offset="0x000c" name="VSYNC_LEN" type="uint"/>
+		<reg32 offset="0x0010" name="DISPLAY_HCTRL" type="mdp4_display_hctl"/>
+		<reg32 offset="0x0014" name="DISPLAY_VSTART" type="uint"/>
+		<reg32 offset="0x0018" name="DISPLAY_VEND" type="uint"/>
+		<reg32 offset="0x001c" name="ACTIVE_HCTL" type="mdp4_active_hctl"/>
+		<reg32 offset="0x0020" name="ACTIVE_VSTART" type="uint"/>
+		<reg32 offset="0x0024" name="ACTIVE_VEND" type="uint"/>
+		<reg32 offset="0x0028" name="BORDER_CLR"/>
+		<reg32 offset="0x002c" name="UNDERFLOW_CLR" type="mdp4_underflow_clr"/>
+		<reg32 offset="0x0030" name="HSYNC_SKEW"/>
+		<reg32 offset="0x0034" name="TEST_CNTL"/>
+		<reg32 offset="0x0038" name="CTRL_POLARITY" type="mdp4_ctrl_polarity"/>
+	</array>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/mdp5.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/mdp5.xml
@@ -0,0 +1,790 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+<import file="display/mdp_common.xml"/>
+
+<!-- where does this belong? -->
+<domain name="VBIF" width="32">
+</domain>
+
+<domain name="MDP5" width="32">
+
+	<enum name="mdp5_intf_type">
+		<value name="INTF_DISABLED" value="0x0"/>
+		<value name="INTF_DSI"  value="0x1"/>
+		<value name="INTF_HDMI" value="0x3"/>
+		<value name="INTF_LCDC" value="0x5"/>
+		<value name="INTF_eDP"  value="0x9"/>
+		<value name="INTF_VIRTUAL"  value="0x64"/>
+		<!-- non-display interfaces are listed below: -->
+		<value name="INTF_WB"  value="0x65"/>
+	</enum>
+
+	<enum name="mdp5_intfnum">
+		<value name="NO_INTF" value="0"/>
+		<value name="INTF0"   value="1"/>
+		<value name="INTF1"   value="2"/>
+		<value name="INTF2"   value="3"/>
+		<value name="INTF3"   value="4"/>
+	</enum>
+
+	<enum name="mdp5_pipe">
+		<value name="SSPP_NONE" value="0"/>
+		<value name="SSPP_VIG0" value="1"/>
+		<value name="SSPP_VIG1" value="2"/>
+		<value name="SSPP_VIG2" value="3"/>
+		<value name="SSPP_RGB0" value="4"/>
+		<value name="SSPP_RGB1" value="5"/>
+		<value name="SSPP_RGB2" value="6"/>
+		<value name="SSPP_DMA0" value="7"/>
+		<value name="SSPP_DMA1" value="8"/>
+		<value name="SSPP_VIG3" value="9"/>
+		<value name="SSPP_RGB3" value="10"/>
+		<value name="SSPP_CURSOR0" value="11"/>
+		<value name="SSPP_CURSOR1" value="12"/>
+	</enum>
+
+	<enum name="mdp5_format">
+		<!-- TODO -->
+		<value name="DUMMY" value="0"/>
+	</enum>
+
+	<enum name="mdp5_ctl_mode">
+		<value name="MODE_NONE" value="0"/>
+		<value name="MODE_WB_0_BLOCK" value="1"/>
+		<value name="MODE_WB_1_BLOCK" value="2"/>
+		<value name="MODE_WB_0_LINE" value="3"/>
+		<value name="MODE_WB_1_LINE" value="4"/>
+		<value name="MODE_WB_2_LINE" value="5"/>
+	</enum>
+
+	<enum name="mdp5_pack_3d">
+		<value name="PACK_3D_FRAME_INT" value="0"/>
+		<value name="PACK_3D_H_ROW_INT" value="1"/>
+		<value name="PACK_3D_V_ROW_INT" value="2"/>
+		<value name="PACK_3D_COL_INT"   value="3"/>
+	</enum>
+
+	<enum name="mdp5_scale_filter">
+		<value name="SCALE_FILTER_NEAREST" value="0"/>
+		<value name="SCALE_FILTER_BIL" value="1"/>
+		<value name="SCALE_FILTER_PCMN" value="2"/>
+		<value name="SCALE_FILTER_CA" value="3"/>
+	</enum>
+
+	<enum name="mdp5_pipe_bwc">
+		<value name="BWC_LOSSLESS" value="0"/>
+		<value name="BWC_Q_HIGH"   value="1"/>
+		<value name="BWC_Q_MED"    value="2"/>
+	</enum>
+
+	<enum name="mdp5_cursor_format">
+		<value name="CURSOR_FMT_ARGB8888" value="0"/>
+		<value name="CURSOR_FMT_ARGB1555" value="2"/>
+		<value name="CURSOR_FMT_ARGB4444" value="4"/>
+	</enum>
+
+	<enum name="mdp5_cursor_alpha">
+		<value name="CURSOR_ALPHA_CONST" value="0"/>
+		<value name="CURSOR_ALPHA_PER_PIXEL" value="2"/>
+	</enum>
+
+	<bitset name="MDP5_IRQ">
+		<bitfield name="WB_0_DONE"                pos="0"  type="boolean"/>
+		<bitfield name="WB_1_DONE"                pos="1"  type="boolean"/>
+		<bitfield name="WB_2_DONE"                pos="4"  type="boolean"/>
+		<bitfield name="PING_PONG_0_DONE"         pos="8"  type="boolean"/>
+		<bitfield name="PING_PONG_1_DONE"         pos="9"  type="boolean"/>
+		<bitfield name="PING_PONG_2_DONE"         pos="10" type="boolean"/>
+		<bitfield name="PING_PONG_3_DONE"         pos="11" type="boolean"/>
+		<bitfield name="PING_PONG_0_RD_PTR"       pos="12" type="boolean"/>
+		<bitfield name="PING_PONG_1_RD_PTR"       pos="13" type="boolean"/>
+		<bitfield name="PING_PONG_2_RD_PTR"       pos="14" type="boolean"/>
+		<bitfield name="PING_PONG_3_RD_PTR"       pos="15" type="boolean"/>
+		<bitfield name="PING_PONG_0_WR_PTR"       pos="16" type="boolean"/>
+		<bitfield name="PING_PONG_1_WR_PTR"       pos="17" type="boolean"/>
+		<bitfield name="PING_PONG_2_WR_PTR"       pos="18" type="boolean"/>
+		<bitfield name="PING_PONG_3_WR_PTR"       pos="19" type="boolean"/>
+		<bitfield name="PING_PONG_0_AUTO_REF"     pos="20" type="boolean"/>
+		<bitfield name="PING_PONG_1_AUTO_REF"     pos="21" type="boolean"/>
+		<bitfield name="PING_PONG_2_AUTO_REF"     pos="22" type="boolean"/>
+		<bitfield name="PING_PONG_3_AUTO_REF"     pos="23" type="boolean"/>
+		<bitfield name="INTF0_UNDER_RUN"          pos="24" type="boolean"/>
+		<bitfield name="INTF0_VSYNC"              pos="25" type="boolean"/>
+		<bitfield name="INTF1_UNDER_RUN"          pos="26" type="boolean"/>
+		<bitfield name="INTF1_VSYNC"              pos="27" type="boolean"/>
+		<bitfield name="INTF2_UNDER_RUN"          pos="28" type="boolean"/>
+		<bitfield name="INTF2_VSYNC"              pos="29" type="boolean"/>
+		<bitfield name="INTF3_UNDER_RUN"          pos="30" type="boolean"/>
+		<bitfield name="INTF3_VSYNC"              pos="31" type="boolean"/>
+	</bitset>
+
+	<bitset name="mdp5_smp_alloc" inline="yes">
+        <!-- Use "mdp5_cfg->mdp.smp.clients[enum mdp5_pipe]" instead -->
+		<bitfield name="CLIENT0" low="0"  high="7"  type="uint"/>
+		<bitfield name="CLIENT1" low="8"  high="15" type="uint"/>
+		<bitfield name="CLIENT2" low="16" high="23" type="uint"/>
+	</bitset>
+
+	<reg32 offset="0x00000" name="HW_VERSION">
+		<bitfield name="STEP" low="0" high="15" type="uint"/>
+		<bitfield name="MINOR" low="16" high="27" type="uint"/>
+		<bitfield name="MAJOR" low="28" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00004" name="DISP_INTF_SEL">
+		<bitfield name="INTF0" low="0"  high="7"  type="mdp5_intf_type"/>
+		<bitfield name="INTF1" low="8"  high="15" type="mdp5_intf_type"/>
+		<bitfield name="INTF2" low="16" high="23" type="mdp5_intf_type"/>
+		<bitfield name="INTF3" low="24" high="31" type="mdp5_intf_type"/>
+	</reg32>
+	<reg32 offset="0x00010" name="INTR_EN" type="MDP5_IRQ"/>
+	<reg32 offset="0x00014" name="INTR_STATUS" type="MDP5_IRQ"/>
+	<reg32 offset="0x00018" name="INTR_CLEAR" type="MDP5_IRQ"/>
+	<reg32 offset="0x0001C" name="HIST_INTR_EN"/>
+	<reg32 offset="0x00020" name="HIST_INTR_STATUS"/>
+	<reg32 offset="0x00024" name="HIST_INTR_CLEAR"/>
+	<reg32 offset="0x00028" name="SPARE_0">
+		<bitfield name="SPLIT_DPL_SINGLE_FLUSH_EN" pos="0"/>
+	</reg32>
+
+	<array offset="0x00080" name="SMP_ALLOC_W" length="8" stride="4">
+		<reg32 offset="0" name="REG" type="mdp5_smp_alloc"/>
+	</array>
+	<array offset="0x00130" name="SMP_ALLOC_R" length="8" stride="4">
+		<reg32 offset="0" name="REG" type="mdp5_smp_alloc"/>
+	</array>
+
+	<enum name="mdp5_igc_type">
+		<value name="IGC_VIG" value="0"/>		<!-- 0x200 -->
+		<value name="IGC_RGB" value="1"/>		<!-- 0x210 -->
+		<value name="IGC_DMA" value="2"/>		<!-- 0x220 -->
+		<value name="IGC_DSPP" value="3"/>		<!-- 0x300 -->
+	</enum>
+	<array offsets="0x00200,0x00210,0x00220,0x00300" name="IGC" length="3" stride="0x10" index="mdp5_igc_type">
+		<array offset="0x00" name="LUT" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VAL" low="0" high="11"/>
+				<bitfield name="INDEX_UPDATE" pos="25" type="boolean"/>
+				<!--
+					not sure about these:
+						/* INDEX_UPDATE */
+						data = (1 << 25) | (((~(1 << blk_idx)) & 0x7) << 28);
+						MDSS_MDP_REG_WRITE(offset, (cfg->c0_c1_data[0] & 0xFFF) | data);
+				-->
+				<bitfield name="DISABLE_PIPE_0" pos="28" type="boolean"/>
+				<bitfield name="DISABLE_PIPE_1" pos="29" type="boolean"/>
+				<bitfield name="DISABLE_PIPE_2" pos="30" type="boolean"/>
+			</reg32>
+		</array>
+	</array>
+	<reg32 offset="0x002f4" name="SPLIT_DPL_EN"/>
+	<reg32 offset="0x002f8" name="SPLIT_DPL_UPPER">
+		<bitfield name="SMART_PANEL" pos="1" type="boolean"/>
+		<bitfield name="SMART_PANEL_FREE_RUN" pos="2" type="boolean"/>
+		<bitfield name="INTF1_SW_TRG_MUX" pos="4" type="boolean"/>
+		<bitfield name="INTF2_SW_TRG_MUX" pos="8" type="boolean"/>
+	</reg32>
+	<reg32 offset="0x003f0" name="SPLIT_DPL_LOWER">
+		<bitfield name="SMART_PANEL" pos="1" type="boolean"/>
+		<bitfield name="SMART_PANEL_FREE_RUN" pos="2" type="boolean"/>
+		<bitfield name="INTF1_TG_SYNC" pos="4" type="boolean"/>
+		<bitfield name="INTF2_TG_SYNC" pos="8" type="boolean"/>
+	</reg32>
+
+<!-- check length/index.. -->
+	<array doffsets="mdp5_cfg->ctl.base[0],mdp5_cfg->ctl.base[1],mdp5_cfg->ctl.base[2],mdp5_cfg->ctl.base[3],mdp5_cfg->ctl.base[4]" name="CTL" length="5" stride="0x400">
+		<array offsets="0x000,0x004,0x008,0x00C,0x010,0x024" name="LAYER" length="6" stride="4">
+			<!--
+			NOTE: for backwards compat (from when there were fewer stages),
+			this register has the low three bits of mdp_mixer_stage_id, with
+			the high bit coming from LAYER_EXT
+			 -->
+			<reg32 offset="0" name="REG">
+				<bitfield name="VIG0"  low="0"  high="2"  type="uint"/>
+				<bitfield name="VIG1"  low="3"  high="5"  type="uint"/>
+				<bitfield name="VIG2"  low="6"  high="8"  type="uint"/>
+				<bitfield name="RGB0"  low="9"  high="11" type="uint"/>
+				<bitfield name="RGB1"  low="12" high="14" type="uint"/>
+				<bitfield name="RGB2"  low="15" high="17" type="uint"/>
+				<bitfield name="DMA0"  low="18" high="20" type="uint"/>
+				<bitfield name="DMA1"  low="21" high="23" type="uint"/>
+				<bitfield name="BORDER_COLOR" pos="24" type="boolean"/>
+				<bitfield name="CURSOR_OUT"   pos="25" type="boolean"/>
+				<bitfield name="VIG3"  low="26"  high="28"  type="uint"/>
+				<bitfield name="RGB3"  low="29" high="31" type="uint"/>
+			</reg32>
+		</array>
+		<reg32 offset="0x014" name="OP">
+			<bitfield name="MODE" low="0" high="3" type="mdp5_ctl_mode"/>
+			<bitfield name="INTF_NUM" low="4" high="6" type="mdp5_intfnum"/>
+			<bitfield name="CMD_MODE" pos="17" type="boolean"/>
+			<bitfield name="PACK_3D_ENABLE" pos="19" type="boolean"/>
+			<bitfield name="PACK_3D" low="20" high="21" type="mdp5_pack_3d"/>
+		</reg32>
+		<reg32 offset="0x018" name="FLUSH">
+			<bitfield name="VIG0" pos="0"  type="boolean"/>
+			<bitfield name="VIG1" pos="1"  type="boolean"/>
+			<bitfield name="VIG2" pos="2"  type="boolean"/>
+			<bitfield name="RGB0" pos="3"  type="boolean"/>
+			<bitfield name="RGB1" pos="4"  type="boolean"/>
+			<bitfield name="RGB2" pos="5"  type="boolean"/>
+			<bitfield name="LM0"  pos="6"  type="boolean"/>
+			<bitfield name="LM1"  pos="7"  type="boolean"/>
+			<bitfield name="LM2"  pos="8"  type="boolean"/>
+			<bitfield name="LM3"  pos="9"  type="boolean"/>
+			<bitfield name="LM4"  pos="10"  type="boolean"/>
+			<bitfield name="DMA0" pos="11" type="boolean"/>
+			<bitfield name="DMA1" pos="12" type="boolean"/>
+			<bitfield name="DSPP0" pos="13" type="boolean"/>
+			<bitfield name="DSPP1" pos="14" type="boolean"/>
+			<bitfield name="DSPP2" pos="15" type="boolean"/>
+			<bitfield name="WB"   pos="16" type="boolean"/>
+			<bitfield name="CTL"   pos="17" type="boolean"/>
+			<bitfield name="VIG3" pos="18"  type="boolean"/>
+			<bitfield name="RGB3" pos="19"  type="boolean"/>
+			<bitfield name="LM5"  pos="20"  type="boolean"/>
+			<bitfield name="DSPP3" pos="21" type="boolean"/>
+			<bitfield name="CURSOR_0" pos="22" type="boolean"/>
+			<bitfield name="CURSOR_1" pos="23" type="boolean"/>
+			<bitfield name="CHROMADOWN_0" pos="26" type="boolean"/>
+			<bitfield name="TIMING_3" pos="28" type="boolean"/>
+			<bitfield name="TIMING_2" pos="29" type="boolean"/>
+			<bitfield name="TIMING_1" pos="30" type="boolean"/>
+			<bitfield name="TIMING_0" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x01C" name="START"/>
+		<reg32 offset="0x020" name="PACK_3D"/>
+		<array offsets="0x040,0x044,0x048,0x04C,0x050,0x054" name="LAYER_EXT" length="6" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VIG0_BIT3"  pos="0"  type="boolean"/>
+				<bitfield name="VIG1_BIT3"  pos="2"  type="boolean"/>
+				<bitfield name="VIG2_BIT3"  pos="4"  type="boolean"/>
+				<bitfield name="VIG3_BIT3"  pos="6"  type="boolean"/>
+				<bitfield name="RGB0_BIT3"  pos="8"  type="boolean"/>
+				<bitfield name="RGB1_BIT3"  pos="10"  type="boolean"/>
+				<bitfield name="RGB2_BIT3"  pos="12"  type="boolean"/>
+				<bitfield name="RGB3_BIT3"  pos="14"  type="boolean"/>
+				<bitfield name="DMA0_BIT3"  pos="16"  type="boolean"/>
+				<bitfield name="DMA1_BIT3"  pos="18"  type="boolean"/>
+				<bitfield name="CURSOR0" low="20"  high="23"  type="mdp_mixer_stage_id"/>
+				<bitfield name="CURSOR1" low="26"  high="29"  type="mdp_mixer_stage_id"/>
+			</reg32>
+		</array>
+	</array>
+
+	<enum name="mdp5_data_format">
+		<value name="DATA_FORMAT_RGB" value="0"/>
+		<value name="DATA_FORMAT_YUV" value="1"/>
+	</enum>
+
+	<array doffsets="INVALID_IDX(idx),mdp5_cfg->pipe_vig.base[0],mdp5_cfg->pipe_vig.base[1],mdp5_cfg->pipe_vig.base[2],mdp5_cfg->pipe_rgb.base[0],mdp5_cfg->pipe_rgb.base[1],mdp5_cfg->pipe_rgb.base[2],mdp5_cfg->pipe_dma.base[0],mdp5_cfg->pipe_dma.base[1],mdp5_cfg->pipe_vig.base[3],mdp5_cfg->pipe_rgb.base[3],mdp5_cfg->pipe_cursor.base[0],mdp5_cfg->pipe_cursor.base[1]" name="PIPE" length="10" stride="0x400" index="mdp5_pipe">
+		<reg32 offset="0x200" name="OP_MODE">
+			<bitfield name="CSC_DST_DATA_FORMAT" pos="19" type="mdp5_data_format"/>
+			<bitfield name="CSC_SRC_DATA_FORMAT" pos="18" type="mdp5_data_format"/>
+			<bitfield name="CSC_1_EN" pos="17" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x2C4" name="HIST_CTL_BASE"/>
+		<reg32 offset="0x2F0" name="HIST_LUT_BASE"/>
+		<reg32 offset="0x300" name="HIST_LUT_SWAP"/>
+		<reg32 offset="0x320" name="CSC_1_MATRIX_COEFF_0">
+			<bitfield name="COEFF_11" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_12" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x324" name="CSC_1_MATRIX_COEFF_1">
+			<bitfield name="COEFF_13" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_21" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x328" name="CSC_1_MATRIX_COEFF_2">
+			<bitfield name="COEFF_22" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_23" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x32c" name="CSC_1_MATRIX_COEFF_3">
+			<bitfield name="COEFF_31" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_32" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x330" name="CSC_1_MATRIX_COEFF_4">
+			<bitfield name="COEFF_33" low="0" high="12" type="uint"/>
+		</reg32>
+		<array offset="0x334" name="CSC_1_PRE_CLAMP" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="HIGH"  low="0"  high="7"  type="uint"/>
+				<bitfield name="LOW"  low="8"  high="15"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x340" name="CSC_1_POST_CLAMP" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="HIGH"  low="0"  high="7"  type="uint"/>
+				<bitfield name="LOW"  low="8"  high="15"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x34c" name="CSC_1_PRE_BIAS" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VALUE"  low="0"  high="8"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x358" name="CSC_1_POST_BIAS" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VALUE"  low="0"  high="8"  type="uint"/>
+			</reg32>
+		</array>
+		<!-- SSPP: -->
+		<reg32 offset="0x000" name="SRC_SIZE" type="reg_wh"/>
+		<reg32 offset="0x004" name="SRC_IMG_SIZE" type="reg_wh"/>
+		<reg32 offset="0x008" name="SRC_XY" type="reg_xy"/>
+		<reg32 offset="0x00C" name="OUT_SIZE" type="reg_wh"/>
+		<reg32 offset="0x010" name="OUT_XY" type="reg_xy"/>
+		<reg32 offset="0x014" name="SRC0_ADDR"/>
+		<reg32 offset="0x018" name="SRC1_ADDR"/>
+		<reg32 offset="0x01C" name="SRC2_ADDR"/>
+		<reg32 offset="0x020" name="SRC3_ADDR"/>
+		<reg32 offset="0x024" name="SRC_STRIDE_A">
+			<bitfield name="P0" low="0" high="15" type="uint"/>
+			<bitfield name="P1" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x028" name="SRC_STRIDE_B">
+			<bitfield name="P2" low="0" high="15" type="uint"/>
+			<bitfield name="P3" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x02C" name="STILE_FRAME_SIZE"/>
+		<reg32 offset="0x030" name="SRC_FORMAT">
+			<bitfield name="G_BPC" low="0" high="1" type="mdp_bpc"/>
+			<bitfield name="B_BPC" low="2" high="3" type="mdp_bpc"/>
+			<bitfield name="R_BPC" low="4" high="5" type="mdp_bpc"/>
+			<bitfield name="A_BPC" low="6" high="7" type="mdp_bpc_alpha"/>
+			<bitfield name="ALPHA_ENABLE" pos="8" type="boolean"/>
+			<bitfield name="CPP" low="9" high="10" type="uint">
+				<brief>8bit characters per pixel minus 1</brief>
+			</bitfield>
+			<bitfield name="ROT90" pos="11" type="boolean"/>
+			<bitfield name="UNPACK_COUNT" low="12" high="13" type="uint"/>
+			<bitfield name="UNPACK_TIGHT" pos="17" type="boolean"/>
+			<bitfield name="UNPACK_ALIGN_MSB" pos="18" type="boolean"/>
+			<bitfield name="FETCH_TYPE" low="19" high="20" type="mdp_fetch_type"/>
+			<bitfield name="CHROMA_SAMP" low="23" high="24" type="mdp_chroma_samp_type"/>
+		</reg32>
+		<reg32 offset="0x034" name="SRC_UNPACK" type="mdp_unpack_pattern"/>
+		<reg32 offset="0x038" name="SRC_OP_MODE">
+			<bitfield name="BWC_EN" pos="0" type="boolean"/>
+			<bitfield name="BWC" low="1" high="2" type="mdp5_pipe_bwc"/>
+			<bitfield name="FLIP_LR" pos="13" type="boolean"/>
+			<bitfield name="FLIP_UD" pos="14" type="boolean"/>
+			<bitfield name="IGC_EN" pos="16" type="boolean"/>
+			<bitfield name="IGC_ROM_0" pos="17" type="boolean"/>
+			<bitfield name="IGC_ROM_1" pos="18" type="boolean"/>
+			<bitfield name="DEINTERLACE" pos="22" type="boolean"/>
+			<bitfield name="DEINTERLACE_ODD" pos="23" type="boolean"/>
+			<bitfield name="SW_PIX_EXT_OVERRIDE" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x03c" name="SRC_CONSTANT_COLOR"/>
+		<reg32 offset="0x048" name="FETCH_CONFIG"/>
+		<reg32 offset="0x04c" name="VC1_RANGE"/>
+		<reg32 offset="0x050" name="REQPRIO_FIFO_WM_0"/>
+		<reg32 offset="0x054" name="REQPRIO_FIFO_WM_1"/>
+		<reg32 offset="0x058" name="REQPRIO_FIFO_WM_2"/>
+		<reg32 offset="0x070" name="SRC_ADDR_SW_STATUS"/>
+		<reg32 offset="0x0a4" name="CURRENT_SRC0_ADDR"/>
+		<reg32 offset="0x0a8" name="CURRENT_SRC1_ADDR"/>
+		<reg32 offset="0x0ac" name="CURRENT_SRC2_ADDR"/>
+		<reg32 offset="0x0b0" name="CURRENT_SRC3_ADDR"/>
+		<reg32 offset="0x0b4" name="DECIMATION">
+			<bitfield name="VERT" low="0" high="7" type="uint"/>
+			<bitfield name="HORZ" low="8" high="15" type="uint"/>
+		</reg32>
+		<array offsets="0x100,0x110,0x120" name="SW_PIX_EXT" length="3" stride="0x10" index="mdp_component_type">
+			<!--
+				Notes:
+				o These value only take effect if SW_PIX_EXT_OVERRIDE is set in SRC_OP_MODE register
+				o For signed values (int): + indicates overfetch, - indicates line drop
+			-->
+                        <reg32 offset="0x00" name="LR">
+				<bitfield name="LEFT_RPT" low="0" high="7" type="uint"/>
+				<bitfield name="LEFT_OVF" low="8" high="15" type="int"/>
+				<bitfield name="RIGHT_RPT" low="16" high="23" type="uint"/>
+				<bitfield name="RIGHT_OVF" low="24" high="31" type="int"/>
+			</reg32>
+			<reg32 offset="0x04" name="TB">
+				<bitfield name="TOP_RPT" low="0" high="7" type="uint"/>
+				<bitfield name="TOP_OVF" low="8" high="15" type="int"/>
+				<bitfield name="BOTTOM_RPT" low="16" high="23" type="uint"/>
+				<bitfield name="BOTTOM_OVF" low="24" high="31" type="int"/>
+			</reg32>
+			<reg32 offset="0x08" name="REQ_PIXELS">
+				<bitfield name="LEFT_RIGHT" low="0" high="15" type="uint"/>
+				<bitfield name="TOP_BOTTOM" low="16" high="31" type="uint"/>
+			</reg32>
+		</array>
+		<reg32 offset="0x204" name="SCALE_CONFIG">
+			<bitfield name="SCALEX_EN" pos="0" type="boolean"/>
+			<bitfield name="SCALEY_EN" pos="1" type="boolean"/>
+			<bitfield name="SCALEX_FILTER_COMP_0" low="8"  high="9"  type="mdp5_scale_filter"/>
+			<bitfield name="SCALEY_FILTER_COMP_0" low="10" high="11" type="mdp5_scale_filter"/>
+			<bitfield name="SCALEX_FILTER_COMP_1_2"  low="12" high="13" type="mdp5_scale_filter"/>
+			<bitfield name="SCALEY_FILTER_COMP_1_2"  low="14" high="15" type="mdp5_scale_filter"/>
+			<bitfield name="SCALEX_FILTER_COMP_3" low="16" high="17" type="mdp5_scale_filter"/>
+			<bitfield name="SCALEY_FILTER_COMP_3" low="18" high="19" type="mdp5_scale_filter"/>
+		</reg32>
+		<reg32 offset="0x210" name="SCALE_PHASE_STEP_X"/>
+		<reg32 offset="0x214" name="SCALE_PHASE_STEP_Y"/>
+		<reg32 offset="0x218" name="SCALE_CR_PHASE_STEP_X"/>
+		<reg32 offset="0x21c" name="SCALE_CR_PHASE_STEP_Y"/>
+		<reg32 offset="0x220" name="SCALE_INIT_PHASE_X"/>
+		<reg32 offset="0x224" name="SCALE_INIT_PHASE_Y"/>
+	</array>
+
+	<array doffsets="mdp5_cfg->lm.base[0],mdp5_cfg->lm.base[1],mdp5_cfg->lm.base[2],mdp5_cfg->lm.base[3],mdp5_cfg->lm.base[4],mdp5_cfg->lm.base[5]" name="LM" length="6" stride="0x400">
+		<reg32 offset="0x000" name="BLEND_COLOR_OUT">
+			<bitfield name="STAGE0_FG_ALPHA" pos="1" type="boolean"/>
+			<bitfield name="STAGE1_FG_ALPHA" pos="2" type="boolean"/>
+			<bitfield name="STAGE2_FG_ALPHA" pos="3" type="boolean"/>
+			<bitfield name="STAGE3_FG_ALPHA" pos="4" type="boolean"/>
+			<bitfield name="STAGE4_FG_ALPHA" pos="5" type="boolean"/>
+			<bitfield name="STAGE5_FG_ALPHA" pos="6" type="boolean"/>
+			<bitfield name="STAGE6_FG_ALPHA" pos="7" type="boolean"/>
+			<bitfield name="SPLIT_LEFT_RIGHT" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x004" name="OUT_SIZE" type="reg_wh"/>
+		<reg32 offset="0x008" name="BORDER_COLOR_0"/>
+		<reg32 offset="0x010" name="BORDER_COLOR_1"/>
+		<array offsets="0x020,0x050,0x080,0x0B0,0x230,0x260,0x290" name="BLEND" length="7" stride="0x30">
+			<reg32 offset="0x00" name="OP_MODE">
+				<bitfield name="FG_ALPHA" low="0" high="1" type="mdp_alpha_type"/>
+				<bitfield name="FG_INV_ALPHA"     pos="2"  type="boolean"/>
+				<bitfield name="FG_MOD_ALPHA"     pos="3"  type="boolean"/>
+				<bitfield name="FG_INV_MOD_ALPHA" pos="4"  type="boolean"/>
+				<bitfield name="FG_TRANSP_EN"     pos="5"  type="boolean"/>
+				<bitfield name="BG_ALPHA" low="8" high="9" type="mdp_alpha_type"/>
+				<bitfield name="BG_INV_ALPHA"     pos="10" type="boolean"/>
+				<bitfield name="BG_MOD_ALPHA"     pos="11" type="boolean"/>
+				<bitfield name="BG_INV_MOD_ALPHA" pos="12" type="boolean"/>
+				<bitfield name="BG_TRANSP_EN"     pos="13" type="boolean"/>
+			</reg32>
+			<reg32 offset="0x04" name="FG_ALPHA"/>
+			<reg32 offset="0x08" name="BG_ALPHA"/>
+			<reg32 offset="0x0c" name="FG_TRANSP_LOW0"/>
+			<reg32 offset="0x10" name="FG_TRANSP_LOW1"/>
+			<reg32 offset="0x14" name="FG_TRANSP_HIGH0"/>
+			<reg32 offset="0x18" name="FG_TRANSP_HIGH1"/>
+			<reg32 offset="0x1c" name="BG_TRANSP_LOW0"/>
+			<reg32 offset="0x20" name="BG_TRANSP_LOW1"/>
+			<reg32 offset="0x24" name="BG_TRANSP_HIGH0"/>
+			<reg32 offset="0x28" name="BG_TRANSP_HIGH1"/>
+		</array>
+		<reg32 offset="0x0e0" name="CURSOR_IMG_SIZE">
+			<bitfield name="SRC_W" low="0" high="15" type="uint"/>
+			<bitfield name="SRC_H" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0e4" name="CURSOR_SIZE">
+			<bitfield name="ROI_W" low="0" high="15" type="uint"/>
+			<bitfield name="ROI_H" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0e8" name="CURSOR_XY">
+			<bitfield name="SRC_X" low="0" high="15" type="uint"/>
+			<bitfield name="SRC_Y" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0dc" name="CURSOR_STRIDE">
+			<bitfield name="STRIDE" low="0"  high="15"  type="uint"/>
+		</reg32>
+		<reg32 offset="0x0ec" name="CURSOR_FORMAT">
+			<bitfield name="FORMAT" low="0"  high="2"  type="mdp5_cursor_format"/>
+		</reg32>
+		<reg32 offset="0x0f0" name="CURSOR_BASE_ADDR"/>
+		<reg32 offset="0x0f4" name="CURSOR_START_XY">
+			<bitfield name="X_START" low="0" high="15" type="uint"/>
+			<bitfield name="Y_START" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x0f8" name="CURSOR_BLEND_CONFIG">
+			<bitfield name="BLEND_EN" pos="0" type="boolean"/>
+			<bitfield name="BLEND_ALPHA_SEL" low="1"  high="2"  type="mdp5_cursor_alpha"/>
+			<bitfield name="BLEND_TRANSP_EN" pos="3" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x0fc" name="CURSOR_BLEND_PARAM"/>
+		<reg32 offset="0x100" name="CURSOR_BLEND_TRANSP_LOW0"/>
+		<reg32 offset="0x104" name="CURSOR_BLEND_TRANSP_LOW1"/>
+		<reg32 offset="0x108" name="CURSOR_BLEND_TRANSP_HIGH0"/>
+		<reg32 offset="0x10c" name="CURSOR_BLEND_TRANSP_HIGH1"/>
+		<reg32 offset="0x110" name="GC_LUT_BASE"/>
+	</array>
+
+	<array doffsets="mdp5_cfg->dspp.base[0],mdp5_cfg->dspp.base[1],mdp5_cfg->dspp.base[2],mdp5_cfg->dspp.base[3]" name="DSPP" length="4" stride="0x400">
+		<reg32 offset="0x000" name="OP_MODE">
+			<bitfield name="IGC_LUT_EN" pos="0" type="boolean"/>
+			<bitfield name="IGC_TBL_IDX" low="1" high="3" type="uint"/>
+			<bitfield name="PCC_EN" pos="4" type="boolean"/>
+			<bitfield name="DITHER_EN" pos="8" type="boolean"/>
+			<bitfield name="HIST_EN" pos="16" type="boolean"/>
+			<bitfield name="AUTO_CLEAR" pos="17" type="boolean"/>
+			<bitfield name="HIST_LUT_EN" pos="19" type="boolean"/>
+			<bitfield name="PA_EN" pos="20" type="boolean"/>
+			<bitfield name="GAMUT_EN" pos="23" type="boolean"/>
+			<bitfield name="GAMUT_ORDER" pos="24" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x030" name="PCC_BASE"/>
+		<reg32 offset="0x150" name="DITHER_DEPTH"/>
+		<reg32 offset="0x210" name="HIST_CTL_BASE"/>
+		<reg32 offset="0x230" name="HIST_LUT_BASE"/>
+		<reg32 offset="0x234" name="HIST_LUT_SWAP"/>
+		<reg32 offset="0x238" name="PA_BASE"/>
+		<reg32 offset="0x2dc" name="GAMUT_BASE"/>
+		<reg32 offset="0x2b0" name="GC_BASE"/>
+	</array>
+
+	<array doffsets="mdp5_cfg->pp.base[0],mdp5_cfg->pp.base[1],mdp5_cfg->pp.base[2],mdp5_cfg->pp.base[3]" name="PP" length="4" stride="0x100">
+		<reg32 offset="0x000" name="TEAR_CHECK_EN"/>
+		<reg32 offset="0x004" name="SYNC_CONFIG_VSYNC">
+			<bitfield name="COUNT" low="0" high="18" type="uint"/>
+			<bitfield name="COUNTER_EN" pos="19" type="boolean"/>
+			<bitfield name="IN_EN" pos="20" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x008" name="SYNC_CONFIG_HEIGHT"/>
+		<reg32 offset="0x00c" name="SYNC_WRCOUNT">
+			<bitfield name="LINE_COUNT" low="0" high="15" type="uint"/>
+			<bitfield name="FRAME_COUNT" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x010" name="VSYNC_INIT_VAL"/>
+		<reg32 offset="0x014" name="INT_COUNT_VAL">
+			<bitfield name="LINE_COUNT" low="0" high="15" type="uint"/>
+			<bitfield name="FRAME_COUNT" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x018" name="SYNC_THRESH">
+			<bitfield name="START" low="0" high="15" type="uint"/>
+			<bitfield name="CONTINUE" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x01c" name="START_POS"/>
+		<reg32 offset="0x020" name="RD_PTR_IRQ"/>
+		<reg32 offset="0x024" name="WR_PTR_IRQ"/>
+		<reg32 offset="0x028" name="OUT_LINE_COUNT"/>
+		<reg32 offset="0x02c" name="PP_LINE_COUNT"/>
+		<reg32 offset="0x030" name="AUTOREFRESH_CONFIG"/>
+		<reg32 offset="0x034" name="FBC_MODE"/>
+		<reg32 offset="0x038" name="FBC_BUDGET_CTL"/>
+		<reg32 offset="0x03c" name="FBC_LOSSY_MODE"/>
+	</array>
+
+	<enum name="mdp5_block_size">
+		<value name="BLOCK_SIZE_64" value="0"/>
+		<value name="BLOCK_SIZE_128" value="1"/>
+	</enum>
+
+	<enum name="mdp5_rotate_mode">
+		<value name="ROTATE_0" value="0"/>
+		<value name="ROTATE_90" value="1"/>
+	</enum>
+
+	<enum name="mdp5_chroma_downsample_method">
+		<value name="DS_MTHD_NO_PIXEL_DROP" value="0"/>
+		<value name="DS_MTHD_PIXEL_DROP" value="1"/>
+	</enum>
+
+	<array doffsets="mdp5_cfg->wb.base[0],mdp5_cfg->wb.base[1],mdp5_cfg->wb.base[2],mdp5_cfg->wb.base[3],mdp5_cfg->wb.base[4]" name="WB" length="5" stride="0x400">
+		<reg32 offset="0x000" name="DST_FORMAT">
+			<bitfield name="DSTC0_OUT" low="0" high="1" type="uint"/>
+			<bitfield name="DSTC1_OUT" low="2" high="3" type="uint"/>
+			<bitfield name="DSTC2_OUT" low="4" high="5" type="uint"/>
+			<bitfield name="DSTC3_OUT" low="6" high="7" type="uint"/>
+			<bitfield name="DSTC3_EN" pos="8" type="boolean"/>
+			<bitfield name="DST_BPP" low="9" high="10" type="uint"/>
+			<bitfield name="PACK_COUNT" low="12" high="13" type="uint"/>
+			<bitfield name="DST_ALPHA_X" pos="14" type="boolean"/>
+			<bitfield name="PACK_TIGHT" pos="17" type="boolean"/>
+			<bitfield name="PACK_ALIGN_MSB" pos="18" type="boolean"/>
+			<bitfield name="WRITE_PLANES" low="19" high="20" type="uint"/>
+			<bitfield name="DST_DITHER_EN" pos="22" type="boolean"/>
+			<bitfield name="DST_CHROMA_SAMP" low="23" high="25" type="uint"/>
+			<bitfield name="DST_CHROMA_SITE" low="26" high="29" type="uint"/>
+			<bitfield name="FRAME_FORMAT" low="30" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x004" name="DST_OP_MODE">
+			<bitfield name="BWC_ENC_EN" pos="0" type="boolean"/>
+			<bitfield name="BWC_ENC_OP" low="1" high="2" type="uint"/>
+			<bitfield name="BLOCK_SIZE" low="4" high="4" type="uint"/>
+			<bitfield name="ROT_MODE" low="5" high="5" type="uint"/>
+			<bitfield name="ROT_EN" pos="6" type="boolean"/>
+			<bitfield name="CSC_EN" pos="8" type="boolean"/>
+			<bitfield name="CSC_SRC_DATA_FORMAT" low="9" high="9" type="uint"/>
+			<bitfield name="CSC_DST_DATA_FORMAT" low="10" high="10" type="uint"/>
+			<bitfield name="CHROMA_DWN_SAMPLE_EN" pos="11" type="boolean"/>
+			<bitfield name="CHROMA_DWN_SAMPLE_FORMAT" low="12" high="12" type="uint"/>
+			<bitfield name="CHROMA_DWN_SAMPLE_H_MTHD" low="13" high="13" type="uint"/>
+			<bitfield name="CHROMA_DWN_SAMPLE_V_MTHD" low="14" high="14" type="uint"/>
+		</reg32>
+		<reg32 offset="0x008" name="DST_PACK_PATTERN">
+			<bitfield name="ELEMENT0" low="0" high="1" type="uint"/>
+			<bitfield name="ELEMENT1" low="8" high="9" type="uint"/>
+			<bitfield name="ELEMENT2" low="16" high="17" type="uint"/>
+			<bitfield name="ELEMENT3" low="24" high="25" type="uint"/>
+		</reg32>
+		<reg32 offset="0x00c" name="DST0_ADDR"/>
+		<reg32 offset="0x010" name="DST1_ADDR"/>
+		<reg32 offset="0x014" name="DST2_ADDR"/>
+		<reg32 offset="0x018" name="DST3_ADDR"/>
+		<reg32 offset="0x01c" name="DST_YSTRIDE0">
+			<bitfield name="DST0_YSTRIDE" low="0" high="15" type="uint"/>
+			<bitfield name="DST1_YSTRIDE" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x020" name="DST_YSTRIDE1">
+			<bitfield name="DST2_YSTRIDE" low="0" high="15" type="uint"/>
+			<bitfield name="DST3_YSTRIDE" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x024" name="DST_DITHER_BITDEPTH"/>
+		<reg32 offset="0x030" name="DITHER_MATRIX_ROW0"/>
+		<reg32 offset="0x034" name="DITHER_MATRIX_ROW1"/>
+		<reg32 offset="0x038" name="DITHER_MATRIX_ROW2"/>
+		<reg32 offset="0x03c" name="DITHER_MATRIX_ROW3"/>
+		<reg32 offset="0x048" name="DST_WRITE_CONFIG"/>
+		<reg32 offset="0x050" name="ROTATION_DNSCALER"/>
+		<reg32 offset="0x060" name="N16_INIT_PHASE_X_0_3"/>
+		<reg32 offset="0x064" name="N16_INIT_PHASE_X_1_2"/>
+		<reg32 offset="0x068" name="N16_INIT_PHASE_Y_0_3"/>
+		<reg32 offset="0x06c" name="N16_INIT_PHASE_Y_1_2"/>
+		<reg32 offset="0x074" name="OUT_SIZE">
+			<bitfield name="DST_W" low="0" high="15" type="uint"/>
+			<bitfield name="DST_H" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x078" name="ALPHA_X_VALUE"/>
+		<reg32 offset="0x260" name="CSC_MATRIX_COEFF_0">
+			<bitfield name="COEFF_11" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_12" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x264" name="CSC_MATRIX_COEFF_1">
+			<bitfield name="COEFF_13" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_21" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x268" name="CSC_MATRIX_COEFF_2">
+			<bitfield name="COEFF_22" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_23" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x26c" name="CSC_MATRIX_COEFF_3">
+			<bitfield name="COEFF_31" low="0" high="12" type="uint"/>
+			<bitfield name="COEFF_32" low="16" high="28" type="uint"/>
+		</reg32>
+		<reg32 offset="0x270" name="CSC_MATRIX_COEFF_4">
+			<bitfield name="COEFF_33" low="0" high="12" type="uint"/>
+		</reg32>
+		<array offset="0x274" name="CSC_COMP_PRECLAMP" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="HIGH"  low="0"  high="7"  type="uint"/>
+				<bitfield name="LOW"  low="8"  high="15"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x280" name="CSC_COMP_POSTCLAMP" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="HIGH"  low="0"  high="7"  type="uint"/>
+				<bitfield name="LOW"  low="8"  high="15"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x28c" name="CSC_COMP_PREBIAS" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VALUE"  low="0"  high="8"  type="uint"/>
+			</reg32>
+		</array>
+		<array offset="0x298" name="CSC_COMP_POSTBIAS" length="3" stride="4">
+			<reg32 offset="0" name="REG">
+				<bitfield name="VALUE"  low="0"  high="8"  type="uint"/>
+			</reg32>
+		</array>
+	</array>
+
+	<array doffsets="mdp5_cfg->intf.base[0],mdp5_cfg->intf.base[1],mdp5_cfg->intf.base[2],mdp5_cfg->intf.base[3],mdp5_cfg->intf.base[4]" name="INTF" length="5" stride="0x200">
+		<reg32 offset="0x000" name="TIMING_ENGINE_EN"/>
+		<reg32 offset="0x004" name="CONFIG"/>
+		<reg32 offset="0x008" name="HSYNC_CTL">
+			<bitfield name="PULSEW" low="0" high="15" type="uint"/>
+			<bitfield name="PERIOD" low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x00c" name="VSYNC_PERIOD_F0" type="uint"/>
+		<reg32 offset="0x010" name="VSYNC_PERIOD_F1" type="uint"/>
+		<reg32 offset="0x014" name="VSYNC_LEN_F0" type="uint"/>
+		<reg32 offset="0x018" name="VSYNC_LEN_F1" type="uint"/>
+		<reg32 offset="0x01c" name="DISPLAY_VSTART_F0" type="uint"/>
+		<reg32 offset="0x020" name="DISPLAY_VSTART_F1" type="uint"/>
+		<reg32 offset="0x024" name="DISPLAY_VEND_F0" type="uint"/>
+		<reg32 offset="0x028" name="DISPLAY_VEND_F1" type="uint"/>
+		<reg32 offset="0x02c" name="ACTIVE_VSTART_F0">
+			<bitfield name="VAL" low="0" high="30" type="uint"/>
+			<bitfield name="ACTIVE_V_ENABLE" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x030" name="ACTIVE_VSTART_F1">
+			<bitfield name="VAL" low="0" high="30" type="uint"/>
+		</reg32>
+		<reg32 offset="0x034" name="ACTIVE_VEND_F0" type="uint"/>
+		<reg32 offset="0x038" name="ACTIVE_VEND_F1" type="uint"/>
+		<reg32 offset="0x03c" name="DISPLAY_HCTL">
+			<bitfield name="START" low="0"  high="15" type="uint"/>
+			<bitfield name="END"   low="16" high="31" type="uint"/>
+		</reg32>
+		<reg32 offset="0x040" name="ACTIVE_HCTL">
+			<bitfield name="START" low="0"  high="14" type="uint"/>
+			<bitfield name="END"   low="16" high="30" type="uint"/>
+			<bitfield name="ACTIVE_H_ENABLE" pos="31" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x044" name="BORDER_COLOR"/>
+		<reg32 offset="0x048" name="UNDERFLOW_COLOR"/>
+		<reg32 offset="0x04c" name="HSYNC_SKEW"/>
+		<reg32 offset="0x050" name="POLARITY_CTL">
+			<bitfield name="HSYNC_LOW" pos="0" type="boolean"/>
+			<bitfield name="VSYNC_LOW" pos="1" type="boolean"/>
+			<bitfield name="DATA_EN_LOW" pos="2" type="boolean"/>
+		</reg32>
+		<reg32 offset="0x054" name="TEST_CTL"/>
+		<reg32 offset="0x058" name="TP_COLOR0"/>
+		<reg32 offset="0x05c" name="TP_COLOR1"/>
+		<reg32 offset="0x084" name="DSI_CMD_MODE_TRIGGER_EN"/>
+		<reg32 offset="0x090" name="PANEL_FORMAT" type="mdp5_format"/>
+		<reg32 offset="0x0a8" name="FRAME_LINE_COUNT_EN"/>
+		<reg32 offset="0x0ac" name="FRAME_COUNT"/>
+		<reg32 offset="0x0b0" name="LINE_COUNT"/>
+		<reg32 offset="0x0f0" name="DEFLICKER_CONFIG"/>
+		<reg32 offset="0x0f4" name="DEFLICKER_STRNG_COEFF"/>
+		<reg32 offset="0x0f8" name="DEFLICKER_WEAK_COEFF"/>
+		<reg32 offset="0x100" name="TPG_ENABLE"/>
+		<reg32 offset="0x104" name="TPG_MAIN_CONTROL"/>
+		<reg32 offset="0x108" name="TPG_VIDEO_CONFIG"/>
+		<reg32 offset="0x10c" name="TPG_COMPONENT_LIMITS"/>
+		<reg32 offset="0x110" name="TPG_RECTANGLE"/>
+		<reg32 offset="0x114" name="TPG_INITIAL_VALUE"/>
+		<reg32 offset="0x118" name="TPG_BLK_WHITE_PATTERN_FRAME"/>
+		<reg32 offset="0x11c" name="TPG_RGB_MAPPING"/>
+	</array>
+
+	<array doffsets="mdp5_cfg->ad.base[0],mdp5_cfg->ad.base[1]" name="AD" length="2" stride="0x200">
+		<reg32 offset="0x000" name="BYPASS"/>
+		<reg32 offset="0x004" name="CTRL_0"/>
+		<reg32 offset="0x008" name="CTRL_1"/>
+		<reg32 offset="0x00c" name="FRAME_SIZE"/>
+		<reg32 offset="0x010" name="CON_CTRL_0"/>
+		<reg32 offset="0x014" name="CON_CTRL_1"/>
+		<reg32 offset="0x018" name="STR_MAN"/>
+		<reg32 offset="0x01c" name="VAR"/>
+		<reg32 offset="0x020" name="DITH"/>
+		<reg32 offset="0x024" name="DITH_CTRL"/>
+		<reg32 offset="0x028" name="AMP_LIM"/>
+		<reg32 offset="0x02c" name="SLOPE"/>
+		<reg32 offset="0x030" name="BW_LVL"/>
+		<reg32 offset="0x034" name="LOGO_POS"/>
+		<reg32 offset="0x038" name="LUT_FI"/>
+		<reg32 offset="0x07c" name="LUT_CC"/>
+		<reg32 offset="0x0c8" name="STR_LIM"/>
+		<reg32 offset="0x0cc" name="CALIB_AB"/>
+		<reg32 offset="0x0d0" name="CALIB_CD"/>
+		<reg32 offset="0x0d4" name="MODE_SEL"/>
+		<reg32 offset="0x0d8" name="TFILT_CTRL"/>
+		<reg32 offset="0x0dc" name="BL_MINMAX"/>
+		<reg32 offset="0x0e0" name="BL"/>
+		<reg32 offset="0x0e8" name="BL_MAX"/>
+		<reg32 offset="0x0ec" name="AL"/>
+		<reg32 offset="0x0f0" name="AL_MIN"/>
+		<reg32 offset="0x0f4" name="AL_FILT"/>
+		<reg32 offset="0x0f8" name="CFG_BUF"/>
+		<reg32 offset="0x100" name="LUT_AL"/>
+		<reg32 offset="0x144" name="TARG_STR"/>
+		<reg32 offset="0x148" name="START_CALC"/>
+		<reg32 offset="0x14c" name="STR_OUT"/>
+		<reg32 offset="0x154" name="BL_OUT"/>
+		<reg32 offset="0x158" name="CALC_DONE"/>
+	</array>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/mdp_common.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/mdp_common.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+
+<!-- random bits that seem same between mdp4 and mdp5 (ie. not much) -->
+
+<enum name="mdp_chroma_samp_type">
+    <value name="CHROMA_FULL"  value="0"/>
+    <value name="CHROMA_H2V1" value="1"/>
+    <value name="CHROMA_H1V2" value="2"/>
+    <value name="CHROMA_420"  value="3"/>
+</enum>
+
+<enum name="mdp_fetch_type">
+    <value name="MDP_PLANE_INTERLEAVED"   value="0"/>
+    <value name="MDP_PLANE_PLANAR"        value="1"/>
+    <value name="MDP_PLANE_PSEUDO_PLANAR" value="2"/>
+</enum>
+
+<enum name="mdp_mixer_stage_id">
+	<value name="STAGE_UNUSED" value="0"/>
+	<value name="STAGE_BASE" value="1"/>
+	<value name="STAGE0" value="2"/>   <!-- zorder 0 -->
+	<value name="STAGE1" value="3"/>   <!-- zorder 1 -->
+	<value name="STAGE2" value="4"/>   <!-- zorder 2 -->
+	<value name="STAGE3" value="5"/>   <!-- zorder 3 -->
+	<value name="STAGE4" value="6"/>   <!-- zorder 4 -->
+	<value name="STAGE5" value="7"/>   <!-- zorder 5 -->
+	<value name="STAGE6" value="8"/>   <!-- zorder 6 -->
+	<value name="STAGE_MAX" value="8"/> <!-- maximum zorder -->
+</enum>
+
+<enum name="mdp_alpha_type">
+	<value name="FG_CONST" value="0"/>
+	<value name="BG_CONST" value="1"/>
+	<value name="FG_PIXEL" value="2"/>
+	<value name="BG_PIXEL" value="3"/>
+</enum>
+
+<enum name="mdp_component_type">
+        <value name="COMP_0" value="0"/>	<!-- Y component -->
+        <value name="COMP_1_2" value="1"/>	<!-- Cb/Cr comp. -->
+        <value name="COMP_3" value="2"/>	<!-- Trans comp. -->
+        <value name="COMP_MAX" value="3"/>
+</enum>
+
+<enum name="mdp_bpc">
+	<brief>bits per component (non-alpha channel)</brief>
+	<value name="BPC4" value="0"/> <!-- 4 bits -->
+	<value name="BPC5" value="1"/> <!-- 5 bits -->
+	<value name="BPC6" value="2"/> <!-- 6 bits -->
+	<value name="BPC8" value="3"/> <!-- 8 bits -->
+</enum>
+
+<enum name="mdp_bpc_alpha">
+	<brief>bits per component (alpha channel)</brief>
+	<value name="BPC1A" value="0"/> <!-- 1 bit -->
+	<value name="BPC4A" value="1"/> <!-- 4 bits -->
+	<value name="BPC6A" value="2"/> <!-- 6 bits -->
+	<value name="BPC8A" value="3"/> <!-- 8 bits -->
+</enum>
+
+<enum name="mdp_fetch_mode">
+	<value name="MDP_FETCH_LINEAR" value="0"/>
+	<value name="MDP_FETCH_TILE" value="1"/>
+	<value name="MDP_FETCH_UBWC" value="2"/>
+</enum>
+
+<bitset name="reg_wh" inline="yes">
+    <bitfield name="HEIGHT" low="16" high="31" type="uint"/>
+    <bitfield name="WIDTH" low="0" high="15" type="uint"/>
+</bitset>
+
+<bitset name="reg_xy" inline="yes">
+    <bitfield name="Y" low="16" high="31" type="uint"/>
+    <bitfield name="X" low="0" high="15" type="uint"/>
+</bitset>
+
+<bitset name="mdp_unpack_pattern" inline="yes">
+	<bitfield name="ELEM0" low="0"  high="7"/>
+	<bitfield name="ELEM1" low="8"  high="15"/>
+	<bitfield name="ELEM2" low="16" high="23"/>
+	<bitfield name="ELEM3" low="24" high="31"/>
+</bitset>
+
+</database>
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/mdss.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/mdss.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="MDSS" width="32">
+	<reg32 offset="0x00000" name="HW_VERSION">
+		<bitfield name="STEP" low="0" high="15" type="uint"/>
+		<bitfield name="MINOR" low="16" high="27" type="uint"/>
+		<bitfield name="MAJOR" low="28" high="31" type="uint"/>
+	</reg32>
+
+	<reg32 offset="0x00010" name="HW_INTR_STATUS">
+		<bitfield name="INTR_MDP"  pos="0"  type="boolean"/>
+		<bitfield name="INTR_DSI0" pos="4"  type="boolean"/>
+		<bitfield name="INTR_DSI1" pos="5"  type="boolean"/>
+		<bitfield name="INTR_HDMI" pos="8"  type="boolean"/>
+		<bitfield name="INTR_EDP"  pos="12" type="boolean"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/msm.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/msm.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="http://nouveau.freedesktop.org/ rules-ng.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<doc>
+	Register definitions for the display related hw blocks on
+	msm/snapdragon
+</doc>
+
+<!--
+<enum name="chipset">
+	<value name="MDP40"/>
+	<value name="MDP50"/>
+</enum>
+-->
+
+<import file="mdp4.xml"/>
+<import file="mdp5.xml"/>
+<import file="dsi.xml"/>
+<import file="dsi_phy_28nm_8960.xml"/>
+<import file="dsi_phy_28nm.xml"/>
+<import file="dsi_phy_20nm.xml"/>
+<import file="dsi_phy_14nm.xml"/>
+<import file="dsi_phy_10nm.xml"/>
+<import file="dsi_phy_7nm.xml"/>
+<import file="sfpb.xml"/>
+<import file="hdmi.xml"/>
+<import file="edp.xml"/>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/display/sfpb.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/display/sfpb.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+<import file="freedreno_copyright.xml"/>
+
+<domain name="SFPB" width="32">
+	<enum name="sfpb_ahb_arb_master_port_en">
+		<value name="SFPB_MASTER_PORT_ENABLE" value="3"/>
+		<value name="SFPB_MASTER_PORT_DISABLE" value="0"/>
+	</enum>
+	<reg32 offset="0x0058" name="GPREG">
+		<bitfield name="MASTER_PORT_EN" low="11" high="12" type="sfpb_ahb_arb_master_port_en"/>
+	</reg32>
+</domain>
+
+</database>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/freedreno_copyright.xml
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/freedreno_copyright.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<database xmlns="http://nouveau.freedesktop.org/"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+
+<copyright year="2013">
+
+<author name="Rob Clark" email="robdclark@gmail.com"><nick name="robclark"/>
+Initial Author.
+</author>
+
+<author name="Ilia Mirkin" email="imirkin@alum.mit.edu"><nick name="imirkin"/>
+many a3xx/a4xx contributions
+</author>
+
+<license>
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice (including the
+next paragraph) shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+</license>
+
+</copyright>
+</database>
+
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/gen_header.py
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/gen_header.py
@@ -0,0 +1,971 @@
+#!/usr/bin/python3
+#
+# Copyright © 2019-2024 Google, Inc.
+#
+# SPDX-License-Identifier: MIT
+
+import xml.parsers.expat
+import sys
+import os
+import collections
+import argparse
+import time
+import datetime
+
+class Error(Exception):
+	def __init__(self, message):
+		self.message = message
+
+class Enum(object):
+	def __init__(self, name):
+		self.name = name
+		self.values = []
+
+	def has_name(self, name):
+		for (n, value) in self.values:
+			if n == name:
+				return True
+		return False
+
+	def names(self):
+		return [n for (n, value) in self.values]
+
+	def dump(self):
+		use_hex = False
+		for (name, value) in self.values:
+			if value > 0x1000:
+				use_hex = True
+
+		print("enum %s {" % self.name)
+		for (name, value) in self.values:
+			if use_hex:
+				print("\t%s = 0x%08x," % (name, value))
+			else:
+				print("\t%s = %d," % (name, value))
+		print("};\n")
+
+	def dump_pack_struct(self):
+		pass
+
+class Field(object):
+	def __init__(self, name, low, high, shr, type, parser):
+		self.name = name
+		self.low = low
+		self.high = high
+		self.shr = shr
+		self.type = type
+
+		builtin_types = [ None, "a3xx_regid", "boolean", "uint", "hex", "int", "fixed", "ufixed", "float", "address", "waddress" ]
+
+		maxpos = parser.current_bitsize - 1
+
+		if low < 0 or low > maxpos:
+			raise parser.error("low attribute out of range: %d" % low)
+		if high < 0 or high > maxpos:
+			raise parser.error("high attribute out of range: %d" % high)
+		if high < low:
+			raise parser.error("low is greater than high: low=%d, high=%d" % (low, high))
+		if self.type == "boolean" and not low == high:
+			raise parser.error("booleans should be 1 bit fields")
+		elif self.type == "float" and not (high - low == 31 or high - low == 15):
+			raise parser.error("floats should be 16 or 32 bit fields")
+		elif not self.type in builtin_types and not self.type in parser.enums:
+			raise parser.error("unknown type '%s'" % self.type)
+
+	def ctype(self, var_name):
+		if self.type == None:
+			type = "uint32_t"
+			val = var_name
+		elif self.type == "boolean":
+			type = "bool"
+			val = var_name
+		elif self.type == "uint" or self.type == "hex" or self.type == "a3xx_regid":
+			type = "uint32_t"
+			val = var_name
+		elif self.type == "int":
+			type = "int32_t"
+			val = var_name
+		elif self.type == "fixed":
+			type = "float"
+			val = "((int32_t)(%s * %d.0))" % (var_name, 1 << self.radix)
+		elif self.type == "ufixed":
+			type = "float"
+			val = "((uint32_t)(%s * %d.0))" % (var_name, 1 << self.radix)
+		elif self.type == "float" and self.high - self.low == 31:
+			type = "float"
+			val = "fui(%s)" % var_name
+		elif self.type == "float" and self.high - self.low == 15:
+			type = "float"
+			val = "_mesa_float_to_half(%s)" % var_name
+		elif self.type in [ "address", "waddress" ]:
+			type = "uint64_t"
+			val = var_name
+		else:
+			type = "enum %s" % self.type
+			val = var_name
+
+		if self.shr > 0:
+			val = "(%s >> %d)" % (val, self.shr)
+
+		return (type, val)
+
+def tab_to(name, value):
+	tab_count = (68 - (len(name) & ~7)) // 8
+	if tab_count <= 0:
+		tab_count = 1
+	print(name + ('\t' * tab_count) + value)
+
+def mask(low, high):
+	return ((0xffffffffffffffff >> (64 - (high + 1 - low))) << low)
+
+def field_name(reg, f):
+	if f.name:
+		name = f.name.lower()
+	else:
+		# We hit this path when a reg is defined with no bitset fields, ie.
+		# 	<reg32 offset="0x88db" name="RB_BLIT_DST_ARRAY_PITCH" low="0" high="28" shr="6" type="uint"/>
+		name = reg.name.lower()
+
+	if (name in [ "double", "float", "int" ]) or not (name[0].isalpha()):
+			name = "_" + name
+
+	return name
+
+# indices - array of (ctype, stride, __offsets_NAME)
+def indices_varlist(indices):
+	return ", ".join(["i%d" % i for i in range(len(indices))])
+
+def indices_prototype(indices):
+	return ", ".join(["%s i%d" % (ctype, idx)
+			for (idx, (ctype, stride, offset)) in  enumerate(indices)])
+
+def indices_strides(indices):
+	return " + ".join(["0x%x*i%d" % (stride, idx)
+					if stride else
+					"%s(i%d)" % (offset, idx)
+			for (idx, (ctype, stride, offset)) in  enumerate(indices)])
+
+class Bitset(object):
+	def __init__(self, name, template):
+		self.name = name
+		self.inline = False
+		if template:
+			self.fields = template.fields[:]
+		else:
+			self.fields = []
+
+	# Get address field if there is one in the bitset, else return None:
+	def get_address_field(self):
+		for f in self.fields:
+			if f.type in [ "address", "waddress" ]:
+				return f
+		return None
+
+	def dump_regpair_builder(self, reg):
+		print("#ifndef NDEBUG")
+		known_mask = 0
+		for f in self.fields:
+			known_mask |= mask(f.low, f.high)
+			if f.type in [ "boolean", "address", "waddress" ]:
+				continue
+			type, val = f.ctype("fields.%s" % field_name(reg, f))
+			print("    assert((%-40s & 0x%08x) == 0);" % (val, 0xffffffff ^ mask(0 , f.high - f.low)))
+		print("    assert((%-40s & 0x%08x) == 0);" % ("fields.unknown", known_mask))
+		print("#endif\n")
+
+		print("    return (struct fd_reg_pair) {")
+		if reg.array:
+			print("        .reg = REG_%s(__i)," % reg.full_name)
+		else:
+			print("        .reg = REG_%s," % reg.full_name)
+
+		print("        .value =")
+		for f in self.fields:
+			if f.type in [ "address", "waddress" ]:
+				continue
+			else:
+				type, val = f.ctype("fields.%s" % field_name(reg, f))
+				print("            (%-40s << %2d) |" % (val, f.low))
+		value_name = "dword"
+		if reg.bit_size == 64:
+			value_name = "qword"
+		print("            fields.unknown | fields.%s," % (value_name,))
+
+		address = self.get_address_field()
+		if address:
+			print("        .bo = fields.bo,")
+			print("        .is_address = true,")
+			if f.type == "waddress":
+				print("        .bo_write = true,")
+			print("        .bo_offset = fields.bo_offset,")
+			print("        .bo_shift = %d," % address.shr)
+			print("        .bo_low = %d," % address.low)
+
+		print("    };")
+
+	def dump_pack_struct(self, reg=None):
+		if not reg:
+			return
+
+		prefix = reg.full_name
+
+		print("struct %s {" % prefix)
+		for f in self.fields:
+			if f.type in [ "address", "waddress" ]:
+				tab_to("    __bo_type", "bo;")
+				tab_to("    uint32_t", "bo_offset;")
+				continue
+			name = field_name(reg, f)
+
+			type, val = f.ctype("var")
+
+			tab_to("    %s" % type, "%s;" % name)
+		if reg.bit_size == 64:
+			tab_to("    uint64_t", "unknown;")
+			tab_to("    uint64_t", "qword;")
+		else:
+			tab_to("    uint32_t", "unknown;")
+			tab_to("    uint32_t", "dword;")
+		print("};\n")
+
+		if reg.array:
+			print("static inline struct fd_reg_pair\npack_%s(uint32_t __i, struct %s fields)\n{" %
+				  (prefix, prefix))
+		else:
+			print("static inline struct fd_reg_pair\npack_%s(struct %s fields)\n{" %
+				  (prefix, prefix))
+
+		self.dump_regpair_builder(reg)
+
+		print("\n}\n")
+
+		if self.get_address_field():
+			skip = ", { .reg = 0 }"
+		else:
+			skip = ""
+
+		if reg.array:
+			print("#define %s(__i, ...) pack_%s(__i, __struct_cast(%s) { __VA_ARGS__ })%s\n" %
+				  (prefix, prefix, prefix, skip))
+		else:
+			print("#define %s(...) pack_%s(__struct_cast(%s) { __VA_ARGS__ })%s\n" %
+				  (prefix, prefix, prefix, skip))
+
+
+	def dump(self, prefix=None):
+		if prefix == None:
+			prefix = self.name
+		for f in self.fields:
+			if f.name:
+				name = prefix + "_" + f.name
+			else:
+				name = prefix
+
+			if not f.name and f.low == 0 and f.shr == 0 and not f.type in ["float", "fixed", "ufixed"]:
+				pass
+			elif f.type == "boolean" or (f.type == None and f.low == f.high):
+				tab_to("#define %s" % name, "0x%08x" % (1 << f.low))
+			else:
+				tab_to("#define %s__MASK" % name, "0x%08x" % mask(f.low, f.high))
+				tab_to("#define %s__SHIFT" % name, "%d" % f.low)
+				type, val = f.ctype("val")
+
+				print("static inline uint32_t %s(%s val)\n{" % (name, type))
+				if f.shr > 0:
+					print("\tassert(!(val & 0x%x));" % mask(0, f.shr - 1))
+				print("\treturn ((%s) << %s__SHIFT) & %s__MASK;\n}" % (val, name, name))
+		print()
+
+class Array(object):
+	def __init__(self, attrs, domain, variant, parent, index_type):
+		if "name" in attrs:
+			self.local_name = attrs["name"]
+		else:
+			self.local_name = ""
+		self.domain = domain
+		self.variant = variant
+		self.parent = parent
+		if self.parent:
+			self.name = self.parent.name + "_" + self.local_name
+		else:
+			self.name = self.local_name
+		if "offsets" in attrs:
+			self.offsets = map(lambda i: "0x%08x" % int(i, 0), attrs["offsets"].split(","))
+			self.fixed_offsets = True
+		elif "doffsets" in attrs:
+			self.offsets = map(lambda s: "(%s)" % s , attrs["doffsets"].split(","))
+			self.fixed_offsets = True
+		else:
+			self.offset = int(attrs["offset"], 0)
+			self.stride = int(attrs["stride"], 0)
+			self.fixed_offsets = False
+		if "index" in attrs:
+			self.index_type = index_type
+		else:
+			self.index_type = None
+		self.length = int(attrs["length"], 0)
+		if "usage" in attrs:
+			self.usages = attrs["usage"].split(',')
+		else:
+			self.usages = None
+
+	def index_ctype(self):
+		if not self.index_type:
+			return "uint32_t"
+		else:
+			return "enum %s" % self.index_type.name
+
+	# Generate array of (ctype, stride, __offsets_NAME)
+	def indices(self):
+		if self.parent:
+			indices = self.parent.indices()
+		else:
+			indices = []
+		if self.length != 1:
+			if self.fixed_offsets:
+				indices.append((self.index_ctype(), None, "__offset_%s" % self.local_name))
+			else:
+				indices.append((self.index_ctype(), self.stride, None))
+		return indices
+
+	def total_offset(self):
+		offset = 0
+		if not self.fixed_offsets:
+			offset += self.offset
+		if self.parent:
+			offset += self.parent.total_offset()
+		return offset
+
+	def dump(self):
+		proto = indices_varlist(self.indices())
+		strides = indices_strides(self.indices())
+		array_offset = self.total_offset()
+		if self.fixed_offsets:
+			print("static inline uint32_t __offset_%s(%s idx)" % (self.local_name, self.index_ctype()))
+			print("{\n\tswitch (idx) {")
+			if self.index_type:
+				for val, offset in zip(self.index_type.names(), self.offsets):
+					print("\t\tcase %s: return %s;" % (val, offset))
+			else:
+				for idx, offset in enumerate(self.offsets):
+					print("\t\tcase %d: return %s;" % (idx, offset))
+			print("\t\tdefault: return INVALID_IDX(idx);")
+			print("\t}\n}")
+		if proto == '':
+			tab_to("#define REG_%s_%s" % (self.domain, self.name), "0x%08x\n" % array_offset)
+		else:
+			tab_to("#define REG_%s_%s(%s)" % (self.domain, self.name, proto), "(0x%08x + %s )\n" % (array_offset, strides))
+
+	def dump_pack_struct(self):
+		pass
+
+	def dump_regpair_builder(self):
+		pass
+
+class Reg(object):
+	def __init__(self, attrs, domain, array, bit_size):
+		self.name = attrs["name"]
+		self.domain = domain
+		self.array = array
+		self.offset = int(attrs["offset"], 0)
+		self.type = None
+		self.bit_size = bit_size
+		if array:
+			self.name = array.name + "_" + self.name
+		self.full_name = self.domain + "_" + self.name
+		if "stride" in attrs:
+			self.stride = int(attrs["stride"], 0)
+			self.length = int(attrs["length"], 0)
+		else:
+			self.stride = None
+			self.length = None
+
+	# Generate array of (ctype, stride, __offsets_NAME)
+	def indices(self):
+		if self.array:
+			indices = self.array.indices()
+		else:
+			indices = []
+		if self.stride:
+			indices.append(("uint32_t", self.stride, None))
+		return indices
+
+	def total_offset(self):
+		if self.array:
+			return self.array.total_offset() + self.offset
+		else:
+			return self.offset
+
+	def dump(self):
+		proto = indices_prototype(self.indices())
+		strides = indices_strides(self.indices())
+		offset = self.total_offset()
+		if proto == '':
+			tab_to("#define REG_%s" % self.full_name, "0x%08x" % offset)
+		else:
+			print("static inline uint32_t REG_%s(%s) { return 0x%08x + %s; }" % (self.full_name, proto, offset, strides))
+
+		if self.bitset.inline:
+			self.bitset.dump(self.full_name)
+
+	def dump_pack_struct(self):
+		if self.bitset.inline:
+			self.bitset.dump_pack_struct(self)
+
+	def dump_regpair_builder(self):
+		if self.bitset.inline:
+			self.bitset.dump_regpair_builder(self)
+
+	def dump_py(self):
+		print("\tREG_%s = 0x%08x" % (self.full_name, self.offset))
+
+
+class Parser(object):
+	def __init__(self):
+		self.current_array = None
+		self.current_domain = None
+		self.current_prefix = None
+		self.current_prefix_type = None
+		self.current_stripe = None
+		self.current_bitset = None
+		self.current_bitsize = 32
+		# The varset attribute on the domain specifies the enum which
+		# specifies all possible hw variants:
+		self.current_varset = None
+		# Regs that have multiple variants.. we only generated the C++
+		# template based struct-packers for these
+		self.variant_regs = {}
+		# Information in which contexts regs are used, to be used in
+		# debug options
+		self.usage_regs = collections.defaultdict(list)
+		self.bitsets = {}
+		self.enums = {}
+		self.variants = set()
+		self.file = []
+		self.xml_files = []
+		self.copyright_year = None
+		self.authors = []
+		self.license = None
+
+	def error(self, message):
+		parser, filename = self.stack[-1]
+		return Error("%s:%d:%d: %s" % (filename, parser.CurrentLineNumber, parser.CurrentColumnNumber, message))
+
+	def prefix(self, variant=None):
+		if self.current_prefix_type == "variant" and variant:
+			return variant
+		elif self.current_stripe:
+			return self.current_stripe + "_" + self.current_domain
+		elif self.current_prefix:
+			return self.current_prefix + "_" + self.current_domain
+		else:
+			return self.current_domain
+
+	def parse_field(self, name, attrs):
+		try:
+			if "pos" in attrs:
+				high = low = int(attrs["pos"], 0)
+			elif "high" in attrs and "low" in attrs:
+				high = int(attrs["high"], 0)
+				low = int(attrs["low"], 0)
+			else:
+				low = 0
+				high = self.current_bitsize - 1
+
+			if "type" in attrs:
+				type = attrs["type"]
+			else:
+				type = None
+
+			if "shr" in attrs:
+				shr = int(attrs["shr"], 0)
+			else:
+				shr = 0
+
+			b = Field(name, low, high, shr, type, self)
+
+			if type == "fixed" or type == "ufixed":
+				b.radix = int(attrs["radix"], 0)
+
+			self.current_bitset.fields.append(b)
+		except ValueError as e:
+			raise self.error(e)
+
+	def parse_varset(self, attrs):
+		# Inherit the varset from the enclosing domain if not overriden:
+		varset = self.current_varset
+		if "varset" in attrs:
+			varset = self.enums[attrs["varset"]]
+		return varset
+
+	def parse_variants(self, attrs):
+		if not "variants" in attrs:
+				return None
+		variant = attrs["variants"].split(",")[0]
+		if "-" in variant:
+			variant = variant[:variant.index("-")]
+
+		varset = self.parse_varset(attrs)
+
+		assert varset.has_name(variant)
+
+		return variant
+
+	def add_all_variants(self, reg, attrs, parent_variant):
+		# TODO this should really handle *all* variants, including dealing
+		# with open ended ranges (ie. "A2XX,A4XX-") (we have the varset
+		# enum now to make that possible)
+		variant = self.parse_variants(attrs)
+		if not variant:
+			variant = parent_variant
+
+		if reg.name not in self.variant_regs:
+			self.variant_regs[reg.name] = {}
+		else:
+			# All variants must be same size:
+			v = next(iter(self.variant_regs[reg.name]))
+			assert self.variant_regs[reg.name][v].bit_size == reg.bit_size
+
+		self.variant_regs[reg.name][variant] = reg
+
+	def add_all_usages(self, reg, usages):
+		if not usages:
+			return
+
+		for usage in usages:
+			self.usage_regs[usage].append(reg)
+
+		self.variants.add(reg.domain)
+
+	def do_validate(self, schemafile):
+		if not self.validate:
+			return
+
+		try:
+			from lxml import etree
+
+			parser, filename = self.stack[-1]
+			dirname = os.path.dirname(filename)
+
+			# we expect this to look like <namespace url> schema.xsd.. I think
+			# technically it is supposed to be just a URL, but that doesn't
+			# quite match up to what we do.. Just skip over everything up to
+			# and including the first whitespace character:
+			schemafile = schemafile[schemafile.rindex(" ")+1:]
+
+			# this is a bit cheezy, but the xml file to validate could be
+			# in a child director, ie. we don't really know where the schema
+			# file is, the way the rnn C code does.  So if it doesn't exist
+			# just look one level up
+			if not os.path.exists(dirname + "/" + schemafile):
+				schemafile = "../" + schemafile
+
+			if not os.path.exists(dirname + "/" + schemafile):
+				raise self.error("Cannot find schema for: " + filename)
+
+			xmlschema_doc = etree.parse(dirname + "/" + schemafile)
+			xmlschema = etree.XMLSchema(xmlschema_doc)
+
+			xml_doc = etree.parse(filename)
+			if not xmlschema.validate(xml_doc):
+				error_str = str(xmlschema.error_log.filter_from_errors()[0])
+				raise self.error("Schema validation failed for: " + filename + "\n" + error_str)
+		except ImportError as e:
+			if self.validate:
+				raise e
+
+			print("lxml not found, skipping validation", file=sys.stderr)
+
+	def do_parse(self, filename):
+		filepath = os.path.abspath(filename)
+		if filepath in self.xml_files:
+			return
+		self.xml_files.append(filepath)
+		file = open(filename, "rb")
+		parser = xml.parsers.expat.ParserCreate()
+		self.stack.append((parser, filename))
+		parser.StartElementHandler = self.start_element
+		parser.EndElementHandler = self.end_element
+		parser.CharacterDataHandler = self.character_data
+		parser.buffer_text = True
+		parser.ParseFile(file)
+		self.stack.pop()
+		file.close()
+
+	def parse(self, rnn_path, filename, validate):
+		self.path = rnn_path
+		self.stack = []
+		self.validate = validate
+		self.do_parse(filename)
+
+	def parse_reg(self, attrs, bit_size):
+		self.current_bitsize = bit_size
+		if "type" in attrs and attrs["type"] in self.bitsets:
+			bitset = self.bitsets[attrs["type"]]
+			if bitset.inline:
+				self.current_bitset = Bitset(attrs["name"], bitset)
+				self.current_bitset.inline = True
+			else:
+				self.current_bitset = bitset
+		else:
+			self.current_bitset = Bitset(attrs["name"], None)
+			self.current_bitset.inline = True
+			if "type" in attrs:
+				self.parse_field(None, attrs)
+
+		variant = self.parse_variants(attrs)
+		if not variant and self.current_array:
+			variant = self.current_array.variant
+
+		self.current_reg = Reg(attrs, self.prefix(variant), self.current_array, bit_size)
+		self.current_reg.bitset = self.current_bitset
+
+		if len(self.stack) == 1:
+			self.file.append(self.current_reg)
+
+		if variant is not None:
+			self.add_all_variants(self.current_reg, attrs, variant)
+
+		usages = None
+		if "usage" in attrs:
+			usages = attrs["usage"].split(',')
+		elif self.current_array:
+			usages = self.current_array.usages
+
+		self.add_all_usages(self.current_reg, usages)
+
+	def start_element(self, name, attrs):
+		self.cdata = ""
+		if name == "import":
+			filename = attrs["file"]
+			self.do_parse(os.path.join(self.path, filename))
+		elif name == "domain":
+			self.current_domain = attrs["name"]
+			if "prefix" in attrs:
+				self.current_prefix = self.parse_variants(attrs)
+				self.current_prefix_type = attrs["prefix"]
+			else:
+				self.current_prefix = None
+				self.current_prefix_type = None
+			if "varset" in attrs:
+				self.current_varset = self.enums[attrs["varset"]]
+		elif name == "stripe":
+			self.current_stripe = self.parse_variants(attrs)
+		elif name == "enum":
+			self.current_enum_value = 0
+			self.current_enum = Enum(attrs["name"])
+			self.enums[attrs["name"]] = self.current_enum
+			if len(self.stack) == 1:
+				self.file.append(self.current_enum)
+		elif name == "value":
+			if "value" in attrs:
+				value = int(attrs["value"], 0)
+			else:
+				value = self.current_enum_value
+			self.current_enum.values.append((attrs["name"], value))
+		elif name == "reg32":
+			self.parse_reg(attrs, 32)
+		elif name == "reg64":
+			self.parse_reg(attrs, 64)
+		elif name == "array":
+			self.current_bitsize = 32
+			variant = self.parse_variants(attrs)
+			index_type = self.enums[attrs["index"]] if "index" in attrs else None
+			self.current_array = Array(attrs, self.prefix(variant), variant, self.current_array, index_type)
+			if len(self.stack) == 1:
+				self.file.append(self.current_array)
+		elif name == "bitset":
+			self.current_bitset = Bitset(attrs["name"], None)
+			if "inline" in attrs and attrs["inline"] == "yes":
+				self.current_bitset.inline = True
+			self.bitsets[self.current_bitset.name] = self.current_bitset
+			if len(self.stack) == 1 and not self.current_bitset.inline:
+				self.file.append(self.current_bitset)
+		elif name == "bitfield" and self.current_bitset:
+			self.parse_field(attrs["name"], attrs)
+		elif name == "database":
+			self.do_validate(attrs["xsi:schemaLocation"])
+		elif name == "copyright":
+			self.copyright_year = attrs["year"]
+		elif name == "author":
+			self.authors.append(attrs["name"] + " <" + attrs["email"] + "> " + attrs["name"])
+
+	def end_element(self, name):
+		if name == "domain":
+			self.current_domain = None
+			self.current_prefix = None
+			self.current_prefix_type = None
+		elif name == "stripe":
+			self.current_stripe = None
+		elif name == "bitset":
+			self.current_bitset = None
+		elif name == "reg32":
+			self.current_reg = None
+		elif name == "array":
+			self.current_array = self.current_array.parent
+		elif name == "enum":
+			self.current_enum = None
+		elif name == "license":
+			self.license = self.cdata
+
+	def character_data(self, data):
+		self.cdata += data
+
+	def dump_reg_usages(self):
+		d = collections.defaultdict(list)
+		for usage, regs in self.usage_regs.items():
+			for reg in regs:
+				variants = self.variant_regs.get(reg.name)
+				if variants:
+					for variant, vreg in variants.items():
+						if reg == vreg:
+							d[(usage, variant)].append(reg)
+				else:
+					for variant in self.variants:
+						d[(usage, variant)].append(reg)
+
+		print("#ifdef __cplusplus")
+
+		for usage, regs in self.usage_regs.items():
+			print("template<chip CHIP> constexpr inline uint16_t %s_REGS[] = {};" % (usage.upper()))
+
+		for (usage, variant), regs in d.items():
+			offsets = []
+
+			for reg in regs:
+				if reg.array:
+					for i in range(reg.array.length):
+						offsets.append(reg.array.offset + reg.offset + i * reg.array.stride)
+						if reg.bit_size == 64:
+							offsets.append(offsets[-1] + 1)
+				else:
+					offsets.append(reg.offset)
+					if reg.bit_size == 64:
+						offsets.append(offsets[-1] + 1)
+
+			offsets.sort()
+
+			print("template<> constexpr inline uint16_t %s_REGS<%s>[] = {" % (usage.upper(), variant))
+			for offset in offsets:
+				print("\t%s," % hex(offset))
+			print("};")
+
+		print("#endif")
+
+	def dump(self):
+		enums = []
+		bitsets = []
+		regs = []
+		for e in self.file:
+			if isinstance(e, Enum):
+				enums.append(e)
+			elif isinstance(e, Bitset):
+				bitsets.append(e)
+			else:
+				regs.append(e)
+
+		for e in enums + bitsets + regs:
+			e.dump()
+
+		self.dump_reg_usages()
+
+
+	def dump_regs_py(self):
+		regs = []
+		for e in self.file:
+			if isinstance(e, Reg):
+				regs.append(e)
+
+		for e in regs:
+			e.dump_py()
+
+
+	def dump_reg_variants(self, regname, variants):
+		# Don't bother for things that only have a single variant:
+		if len(variants) == 1:
+			return
+		print("#ifdef __cplusplus")
+		print("struct __%s {" % regname)
+		# TODO be more clever.. we should probably figure out which
+		# fields have the same type in all variants (in which they
+		# appear) and stuff everything else in a variant specific
+		# sub-structure.
+		seen_fields = []
+		bit_size = 32
+		array = False
+		address = None
+		for variant in variants.keys():
+			print("    /* %s fields: */" % variant)
+			reg = variants[variant]
+			bit_size = reg.bit_size
+			array = reg.array
+			for f in reg.bitset.fields:
+				fld_name = field_name(reg, f)
+				if fld_name in seen_fields:
+					continue
+				seen_fields.append(fld_name)
+				name = fld_name.lower()
+				if f.type in [ "address", "waddress" ]:
+					if address:
+						continue
+					address = f
+					tab_to("    __bo_type", "bo;")
+					tab_to("    uint32_t", "bo_offset;")
+					continue
+				type, val = f.ctype("var")
+				tab_to("    %s" %type, "%s;" %name)
+		print("    /* fallback fields: */")
+		if bit_size == 64:
+			tab_to("    uint64_t", "unknown;")
+			tab_to("    uint64_t", "qword;")
+		else:
+			tab_to("    uint32_t", "unknown;")
+			tab_to("    uint32_t", "dword;")
+		print("};")
+		# TODO don't hardcode the varset enum name
+		varenum = "chip"
+		print("template <%s %s>" % (varenum, varenum.upper()))
+		print("static inline struct fd_reg_pair")
+		xtra = ""
+		xtravar = ""
+		if array:
+			xtra = "int __i, "
+			xtravar = "__i, "
+		print("__%s(%sstruct __%s fields) {" % (regname, xtra, regname))
+		for variant in variants.keys():
+			print("  if (%s == %s) {" % (varenum.upper(), variant))
+			reg = variants[variant]
+			reg.dump_regpair_builder()
+			print("  } else")
+		print("    assert(!\"invalid variant\");")
+		print("}")
+
+		if bit_size == 64:
+			skip = ", { .reg = 0 }"
+		else:
+			skip = ""
+
+		print("#define %s(VARIANT, %s...) __%s<VARIANT>(%s{__VA_ARGS__})%s" % (regname, xtravar, regname, xtravar, skip))
+		print("#endif /* __cplusplus */")
+
+	def dump_structs(self):
+		for e in self.file:
+			e.dump_pack_struct()
+
+		for regname in self.variant_regs:
+			self.dump_reg_variants(regname, self.variant_regs[regname])
+
+
+def dump_c(args, guard, func):
+	p = Parser()
+
+	try:
+		p.parse(args.rnn, args.xml, args.validate)
+	except Error as e:
+		print(e, file=sys.stderr)
+		exit(1)
+
+	print("#ifndef %s\n#define %s\n" % (guard, guard))
+
+	print("""/* Autogenerated file, DO NOT EDIT manually!
+
+This file was generated by the rules-ng-ng gen_header.py tool in this git repository:
+http://gitlab.freedesktop.org/mesa/mesa/
+git clone https://gitlab.freedesktop.org/mesa/mesa.git
+
+The rules-ng-ng source files this header was generated from are:
+""")
+	maxlen = 0
+	for filepath in p.xml_files:
+		maxlen = max(maxlen, len(filepath))
+	for filepath in p.xml_files:
+		pad = " " * (maxlen - len(filepath))
+		filesize = str(os.path.getsize(filepath))
+		filesize = " " * (7 - len(filesize)) + filesize
+		filetime = time.ctime(os.path.getmtime(filepath))
+		print("- " + filepath + pad + " (" + filesize + " bytes, from " + filetime + ")")
+	if p.copyright_year:
+		current_year = str(datetime.date.today().year)
+		print()
+		print("Copyright (C) %s-%s by the following authors:" % (p.copyright_year, current_year))
+		for author in p.authors:
+			print("- " + author)
+	if p.license:
+		print(p.license)
+	print("*/")
+
+	print()
+	print("#ifdef __KERNEL__")
+	print("#include <linux/bug.h>")
+	print("#define assert(x) BUG_ON(!(x))")
+	print("#else")
+	print("#include <assert.h>")
+	print("#endif")
+	print()
+
+	print("#ifdef __cplusplus")
+	print("#define __struct_cast(X)")
+	print("#else")
+	print("#define __struct_cast(X) (struct X)")
+	print("#endif")
+	print()
+
+	func(p)
+
+	print("\n#endif /* %s */" % guard)
+
+
+def dump_c_defines(args):
+	guard = str.replace(os.path.basename(args.xml), '.', '_').upper()
+	dump_c(args, guard, lambda p: p.dump())
+
+
+def dump_c_pack_structs(args):
+	guard = str.replace(os.path.basename(args.xml), '.', '_').upper() + '_STRUCTS'
+	dump_c(args, guard, lambda p: p.dump_structs())
+
+
+def dump_py_defines(args):
+	p = Parser()
+
+	try:
+		p.parse(args.rnn, args.xml)
+	except Error as e:
+		print(e, file=sys.stderr)
+		exit(1)
+
+	file_name = os.path.splitext(os.path.basename(args.xml))[0]
+
+	print("from enum import IntEnum")
+	print("class %sRegs(IntEnum):" % file_name.upper())
+
+	os.path.basename(args.xml)
+
+	p.dump_regs_py()
+
+
+def main():
+	parser = argparse.ArgumentParser()
+	parser.add_argument('--rnn', type=str, required=True)
+	parser.add_argument('--xml', type=str, required=True)
+	parser.add_argument('--validate', default=False, action='store_true')
+	parser.add_argument('--no-validate', dest='validate', action='store_false')
+
+	subparsers = parser.add_subparsers()
+	subparsers.required = True
+
+	parser_c_defines = subparsers.add_parser('c-defines')
+	parser_c_defines.set_defaults(func=dump_c_defines)
+
+	parser_c_pack_structs = subparsers.add_parser('c-pack-structs')
+	parser_c_pack_structs.set_defaults(func=dump_c_pack_structs)
+
+	parser_py_defines = subparsers.add_parser('py-defines')
+	parser_py_defines.set_defaults(func=dump_py_defines)
+
+	args = parser.parse_args()
+	args.func(args)
+
+
+if __name__ == '__main__':
+	main()
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/msm_default/registers/rules-fd.xsd
+++ linux-qcom-6.8.0/drivers/gpu/drm/msm_default/registers/rules-fd.xsd
@@ -0,0 +1,404 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema"
+	targetNamespace="http://nouveau.freedesktop.org/"
+	xmlns:rng="http://nouveau.freedesktop.org/"
+	elementFormDefault="qualified">
+
+	<annotation>
+		<documentation>
+			An updated version of the old rules.xml file from the
+			RivaTV project. Specifications by Pekka Paalanen,
+			preliminary attempt by KoalaBR,
+			first working version by Jakob Bornecrantz.
+			For specifications, see the file rules-ng-format.txt
+			in Nouveau CVS module 'rules-ng'.
+		</documentation>
+		<documentation>Version 0.1</documentation>
+	</annotation>
+
+
+	<!-- Elements -->
+
+	<element name="database"       type="rng:databaseType" />
+	<element name="import"         type="rng:importType" />
+	<element name="copyright"      type="rng:copyrightType" />
+	<element name="domain"         type="rng:domainType" />
+	<element name="array"          type="rng:arrayType" />
+	<element name="stripe"         type="rng:stripeType" />
+	<element name="reg64"          type="rng:registerType" />
+	<element name="reg32"          type="rng:registerType" />
+	<element name="bitset"         type="rng:bitsetType" />
+	<element name="bitfield"       type="rng:bitfieldType" />
+	<element name="enum"           type="rng:enumType" />
+	<element name="value"          type="rng:valueType" />
+
+	<!-- Copyright elements -->
+	<element name="author"         type="rng:authorType" />
+	<element name="nick"           type="rng:nickType" />
+	<element name="license"        type="rng:docType" />
+
+	<!-- Documentation elements -->
+	
+	<!-- FIXME: allowed only one  per parent element -->
+	<element name="brief" type="rng:briefType" />
+	
+	<element name="doc"  type="rng:docType" />
+	<element name="b"    type="rng:textformatType" />
+	<element name="i"    type="rng:textformatType" />
+	<element name="u"    type="rng:textformatType" />
+	<element name="code" type="rng:textcodeType" />
+	<element name="ul"   type="rng:listType" />
+	<element name="ol"   type="rng:listType" />
+	<element name="li"   type="rng:listitemType" />
+
+	<!-- Copyright element types -->
+
+	<complexType name="authorType" mixed="true">
+		<annotation>
+			<documentation>
+				register database author
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<element ref="rng:nick" />
+		</choice>
+		<attribute name="name" type="string" use="required" />
+		<attribute name="email" type="string" use="required" />
+	</complexType>
+
+	<complexType name="nickType">
+		<annotation>
+			<documentation>nickType</documentation>
+		</annotation>
+		<attribute name="name" type="string" use="required" />
+	</complexType>
+
+	<!-- Database element types -->
+
+	<complexType name="databaseType">
+		<annotation>
+			<documentation>databaseType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+	</complexType>
+
+	<complexType name="importType">
+		<annotation>
+			<documentation>importType</documentation>
+		</annotation>
+		<attribute name="file" type="string" use="required" />
+	</complexType>
+
+	<complexType name="copyrightType">
+		<annotation>
+			<documentation>copyrightType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<element ref="rng:author" />
+			<element ref="rng:license" />
+		</choice>
+		<attribute name="year" type="nonNegativeInteger" use="optional" />
+	</complexType>
+
+	<complexType name="domainType">
+		<annotation>
+			<documentation>domainType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<group ref="rng:regarrayGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="prefix" type="NMTOKENS" use="optional" />
+		<attribute name="width" type="rng:DomainWidth" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+	</complexType>
+
+	<complexType name="arrayType">
+		<annotation>
+			<documentation>arrayType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<group ref="rng:regarrayGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="optional" />
+		<attribute name="offset" type="rng:HexOrNumber" use="optional" />
+		<attribute name="offsets" type="string" use="optional"/>
+		<attribute name="doffsets" type="string" use="optional"/>
+		<attribute name="index" type="NMTOKENS" use="optional"/>
+		<attribute name="stride" type="rng:HexOrNumber" use="required" />
+		<attribute name="length" type="rng:HexOrNumber" use="required" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+		<attribute name="usage" type="string" use="optional" />
+	</complexType>
+
+	<complexType name="stripeType">
+		<annotation>
+			<documentation>stripeType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<group ref="rng:regarrayGroup" minOccurs="0" />
+		</choice>
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+		<attribute name="prefix" type="NMTOKENS" use="optional" />
+	</complexType>
+
+	<complexType name="registerType">
+		<annotation>
+			<documentation>
+				registerType used by reg32, reg64
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+			<element ref="rng:value" />
+			<element ref="rng:bitfield" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="offset" type="rng:HexOrNumber" use="required" />
+		<attribute name="type" type="NMTOKENS" use="optional" />
+		<attribute name="shr" type="nonNegativeInteger" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+		<attribute name="stride" type="rng:HexOrNumber" use="optional" />
+		<attribute name="length" type="rng:HexOrNumber" use="optional" />
+		<attribute name="high" type="nonNegativeInteger" use="optional" />
+		<attribute name="low" type="nonNegativeInteger" use="optional" />
+		<attribute name="pos" type="nonNegativeInteger" use="optional" />
+		<attribute name="align" type="nonNegativeInteger" use="optional" />
+		<attribute name="radix" type="nonNegativeInteger" use="optional" />
+		<attribute name="usage" type="string" use="optional" />
+	</complexType>
+
+	<complexType name="bitsetType">
+		<annotation>
+			<documentation>bitsetType</documentation>
+		</annotation>
+		<choice maxOccurs="unbounded">
+			<element ref="rng:bitfield" />
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="inline" type="rng:Boolean" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+	</complexType>
+
+	<complexType name="bitfieldType">
+		<annotation>
+			<documentation>bitfieldType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<element ref="rng:value" maxOccurs="unbounded" />
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="high" type="nonNegativeInteger" use="optional" />
+		<attribute name="low" type="nonNegativeInteger" use="optional" />
+		<attribute name="pos" type="nonNegativeInteger" use="optional" />
+		<attribute name="radix" type="nonNegativeInteger" use="optional" />
+		<attribute name="type" type="NMTOKENS" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+		<attribute name="addvariant" type="rng:Boolean" use="optional" />
+		<attribute name="shr" type="nonNegativeInteger" use="optional" />
+	</complexType>
+
+	<complexType name="enumType">
+		<annotation>
+			<documentation>enumType</documentation>
+		</annotation>
+		<choice maxOccurs="unbounded">
+			<element ref="rng:value" />
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="bare" type="rng:Boolean" use="optional" />
+		<attribute name="prefix" type="NMTOKENS" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+	</complexType>
+
+	<complexType name="valueType">
+		<annotation>
+			<documentation>valueType</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:docGroup" />
+			<group ref="rng:topGroup" />
+		</choice>
+		<attribute name="name" type="NMTOKEN" use="required" />
+		<attribute name="value" type="string" use="optional" />
+		<attribute name="varset" type="NMTOKEN" use="optional" />
+		<attribute name="variants" type="string" use="optional" />
+	</complexType>
+
+	<!-- Documentation element types -->
+
+	<complexType name="briefType">
+		<annotation>
+			<documentation>
+				brief documentation, no markup
+			</documentation>
+		</annotation>
+		<simpleContent>
+			<extension base="string" />
+		</simpleContent>
+	</complexType>
+	
+	<complexType name="docType" mixed="true">
+		<annotation>
+			<documentation>
+				root element of documentation sub-tree
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:textformatGroup" />
+			<group ref="rng:listGroup" />
+			<element ref="rng:code" />
+		</choice>
+	</complexType>
+	
+	<complexType name="textformatType" mixed="true">
+		<annotation>
+			<documentation>
+				for bold, underline, italics
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:textformatGroup" />
+		</choice>
+	</complexType>
+	
+	<complexType name="textcodeType">
+		<simpleContent>
+			<extension base="string">
+				<attribute name="title" type="string" />
+			</extension>
+		</simpleContent>
+	</complexType>
+	
+	<complexType name="listType">
+		<annotation>
+			<documentation>
+				definition of a list, ordered or unordered
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<element ref="rng:li" />
+		</choice>
+	</complexType>
+	
+	<complexType name="listitemType" mixed="true">
+		<annotation>
+			<documentation>
+				items of a list
+			</documentation>
+		</annotation>
+		<choice minOccurs="0" maxOccurs="unbounded">
+			<group ref="rng:textformatGroup" />
+			<group ref="rng:listGroup" />
+			<element ref="rng:code" />
+		</choice>
+	</complexType>
+
+
+
+	<!-- Attribute value types -->
+
+	<simpleType name="Hexadecimal">
+		<restriction base="string">
+			<pattern value="0x[0-9a-f]+" />
+			<pattern value="0x[0-9A-F]+" />
+			<pattern value="[0-9]" />
+		</restriction>
+	</simpleType>
+
+	<simpleType name="HexOrNumber">
+		<annotation>
+			<documentation>HexOrNumber</documentation>
+		</annotation>
+		<union memberTypes="rng:Hexadecimal nonNegativeInteger" />
+	</simpleType>
+
+	<simpleType name="Boolean">
+		<restriction base="string">
+			<enumeration value="true" />
+			<enumeration value="1" />
+			<enumeration value="yes" />
+			<enumeration value="false" />
+			<enumeration value="0" />
+			<enumeration value="no" />
+		</restriction>
+	</simpleType>
+
+	<simpleType name="DomainWidth">
+		<annotation>
+			<documentation>DomainWidth</documentation>
+		</annotation>
+		<restriction base="string">
+			<enumeration value="32" />
+		</restriction>
+	</simpleType>
+
+
+
+	<!-- Element groups -->
+
+	<group name="topGroup">
+		<choice>
+			<element ref="rng:copyright" />
+			<element ref="rng:domain" />
+			<element ref="rng:enum" />
+			<element ref="rng:bitset" />
+			<element ref="rng:import" />
+		</choice>
+	</group>
+	
+	<group name="regarrayGroup">
+		<choice>
+			<element ref="rng:reg64" />
+			<element ref="rng:reg32" />
+			<element ref="rng:array" />
+			<element ref="rng:stripe" />
+		</choice>
+	</group>
+	
+	<group name="docGroup">
+		<choice>
+			<element ref="rng:brief" />
+			<element ref="rng:doc" />
+		</choice>
+	</group>
+	
+	<group name="textformatGroup">
+		<choice>
+			<element ref="rng:b" />
+			<element ref="rng:i" />
+			<element ref="rng:u" />
+		</choice>
+	</group>
+	
+	<group name="listGroup">
+		<choice>
+			<element ref="rng:ul" />
+			<element ref="rng:ol" />
+		</choice>
+	</group>
+
+</schema>
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/mxsfb/lcdif_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/mxsfb/lcdif_drv.c
@@ -340,6 +340,9 @@
 	if (ret)
 		return ret;
 
+	if (pm_runtime_suspended(dev))
+		return 0;
+
 	return lcdif_rpm_suspend(dev);
 }
 
@@ -347,7 +350,8 @@
 {
 	struct drm_device *drm = dev_get_drvdata(dev);
 
-	lcdif_rpm_resume(dev);
+	if (!pm_runtime_suspended(dev))
+		lcdif_rpm_resume(dev);
 
 	return drm_mode_config_helper_resume(drm);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/dispnv04/crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/dispnv04/crtc.c
@@ -1157,7 +1157,7 @@
 	chan = drm->channel;
 	if (!chan)
 		return -ENODEV;
-	cli = (void *)chan->user.client;
+	cli = chan->cli;
 	push = chan->chan.push;
 
 	s = kzalloc(sizeof(*s), GFP_KERNEL);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/dispnv04/disp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/dispnv04/disp.c
@@ -68,7 +68,7 @@
 	if (nv_two_heads(dev))
 		NVWriteCRTC(dev, 1, NV_PCRTC_INTR_EN_0, 0);
 
-	if (!runtime)
+	if (!runtime && !drm->headless)
 		cancel_work_sync(&drm->hpd_work);
 
 	if (!suspend)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
@@ -209,6 +209,8 @@
 		struct drm_display_mode *mode;
 
 		mode = drm_mode_duplicate(encoder->dev, tv_mode);
+		if (!mode)
+			continue;
 
 		mode->clock = tv_norm->tv_enc_mode.vrefresh *
 			mode->htotal / 1000 *
@@ -258,6 +260,8 @@
 		if (modes[i].hdisplay == output_mode->hdisplay &&
 		    modes[i].vdisplay == output_mode->vdisplay) {
 			mode = drm_mode_duplicate(encoder->dev, output_mode);
+			if (!mode)
+				continue;
 			mode->type |= DRM_MODE_TYPE_PREFERRED;
 
 		} else {
@@ -265,6 +269,8 @@
 					    modes[i].vdisplay, 60, false,
 					    (output_mode->flags &
 					     DRM_MODE_FLAG_INTERLACE), false);
+			if (!mode)
+				continue;
 		}
 
 		/* CVT modes are sometimes unsuitable... */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -914,7 +914,7 @@
 		msto->disabled = false;
 		drm_dp_remove_payload_part2(mgr, new_mst_state, old_payload, new_payload);
 	} else if (msto->enabled) {
-		drm_dp_add_payload_part2(mgr, state, new_payload);
+		drm_dp_add_payload_part2(mgr, new_payload);
 		msto->enabled = false;
 	}
 }
@@ -2679,7 +2679,7 @@
 			nv50_mstm_fini(nouveau_encoder(encoder));
 	}
 
-	if (!runtime)
+	if (!runtime && !drm->headless)
 		cancel_work_sync(&drm->hpd_work);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h
@@ -15,7 +15,9 @@
 };
 
 struct nvkm_gsp_radix3 {
-	struct nvkm_gsp_mem mem[3];
+	struct nvkm_gsp_mem lvl0;
+	struct nvkm_gsp_mem lvl1;
+	struct sg_table lvl2;
 };
 
 int nvkm_gsp_sg(struct nvkm_device *, u64 size, struct sg_table *);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -272,6 +272,9 @@
 		getparam->value = (u64)ttm_resource_manager_usage(vram_mgr);
 		break;
 	}
+	case NOUVEAU_GETPARAM_HAS_VMA_TILEMODE:
+		getparam->value = 1;
+		break;
 	default:
 		NV_PRINTK(dbg, cli, "unknown parameter %lld\n", getparam->param);
 		return -EINVAL;
@@ -343,7 +346,7 @@
 	list_add(&chan->head, &abi16->channels);
 
 	/* create channel object and initialise dma and fence management */
-	ret = nouveau_channel_new(drm, device, false, runm, init->fb_ctxdma_handle,
+	ret = nouveau_channel_new(cli, false, runm, init->fb_ctxdma_handle,
 				  init->tt_ctxdma_handle, &chan->chan);
 	if (ret)
 		goto done;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -23,6 +23,7 @@
  */
 
 #include "nouveau_drv.h"
+#include "nouveau_bios.h"
 #include "nouveau_reg.h"
 #include "dispnv04/hw.h"
 #include "nouveau_encoder.h"
@@ -1677,7 +1678,7 @@
 	 */
 	if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) {
 		if (*conn == 0xf2005014 && *conf == 0xffffffff) {
-			fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, 1);
+			fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, DCB_OUTPUT_B);
 			return false;
 		}
 	}
@@ -1763,26 +1764,26 @@
 #ifdef __powerpc__
 	/* Apple iMac G4 NV17 */
 	if (of_machine_is_compatible("PowerMac4,5")) {
-		fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, 1);
-		fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, 2);
+		fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, DCB_OUTPUT_B);
+		fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, DCB_OUTPUT_C);
 		return;
 	}
 #endif
 
 	/* Make up some sane defaults */
 	fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG,
-			     bios->legacy.i2c_indices.crt, 1, 1);
+			     bios->legacy.i2c_indices.crt, 1, DCB_OUTPUT_B);
 
 	if (nv04_tv_identify(dev, bios->legacy.i2c_indices.tv) >= 0)
 		fabricate_dcb_output(dcb, DCB_OUTPUT_TV,
 				     bios->legacy.i2c_indices.tv,
-				     all_heads, 0);
+				     all_heads, DCB_OUTPUT_A);
 
 	else if (bios->tmds.output0_script_ptr ||
 		 bios->tmds.output1_script_ptr)
 		fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS,
 				     bios->legacy.i2c_indices.panel,
-				     all_heads, 1);
+				     all_heads, DCB_OUTPUT_B);
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -241,28 +241,28 @@
 	}
 
 	nvbo->contig = !(tile_flags & NOUVEAU_GEM_TILE_NONCONTIG);
-	if (!nouveau_cli_uvmm(cli) || internal) {
-		/* for BO noVM allocs, don't assign kinds */
-		if (cli->device.info.family >= NV_DEVICE_INFO_V0_FERMI) {
-			nvbo->kind = (tile_flags & 0x0000ff00) >> 8;
-			if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) {
-				kfree(nvbo);
-				return ERR_PTR(-EINVAL);
-			}
 
-			nvbo->comp = mmu->kind[nvbo->kind] != nvbo->kind;
-		} else if (cli->device.info.family >= NV_DEVICE_INFO_V0_TESLA) {
-			nvbo->kind = (tile_flags & 0x00007f00) >> 8;
-			nvbo->comp = (tile_flags & 0x00030000) >> 16;
-			if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) {
-				kfree(nvbo);
-				return ERR_PTR(-EINVAL);
-			}
-		} else {
-			nvbo->zeta = (tile_flags & 0x00000007);
+	if (cli->device.info.family >= NV_DEVICE_INFO_V0_FERMI) {
+		nvbo->kind = (tile_flags & 0x0000ff00) >> 8;
+		if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) {
+			kfree(nvbo);
+			return ERR_PTR(-EINVAL);
+		}
+
+		nvbo->comp = mmu->kind[nvbo->kind] != nvbo->kind;
+	} else if (cli->device.info.family >= NV_DEVICE_INFO_V0_TESLA) {
+		nvbo->kind = (tile_flags & 0x00007f00) >> 8;
+		nvbo->comp = (tile_flags & 0x00030000) >> 16;
+		if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) {
+			kfree(nvbo);
+			return ERR_PTR(-EINVAL);
 		}
-		nvbo->mode = tile_mode;
+	} else {
+		nvbo->zeta = (tile_flags & 0x00000007);
+	}
+	nvbo->mode = tile_mode;
 
+	if (!nouveau_cli_uvmm(cli) || internal) {
 		/* Determine the desirable target GPU page size for the buffer. */
 		for (i = 0; i < vmm->page_nr; i++) {
 			/* Because we cannot currently allow VMM maps to fail
@@ -304,12 +304,6 @@
 		}
 		nvbo->page = vmm->page[pi].shift;
 	} else {
-		/* reject other tile flags when in VM mode. */
-		if (tile_mode)
-			return ERR_PTR(-EINVAL);
-		if (tile_flags & ~NOUVEAU_GEM_TILE_NONCONTIG)
-			return ERR_PTR(-EINVAL);
-
 		/* Determine the desirable target GPU page size for the buffer. */
 		for (i = 0; i < vmm->page_nr; i++) {
 			/* Because we cannot currently allow VMM maps to fail
@@ -856,7 +850,7 @@
 {
 	struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
 	struct nouveau_channel *chan = drm->ttm.chan;
-	struct nouveau_cli *cli = (void *)chan->user.client;
+	struct nouveau_cli *cli = chan->cli;
 	struct nouveau_fence *fence;
 	int ret;
 
@@ -1264,6 +1258,8 @@
 			drm_vma_node_unmap(&nvbo->bo.base.vma_node,
 					   bdev->dev_mapping);
 			nouveau_ttm_io_mem_free_locked(drm, nvbo->bo.resource);
+			nvbo->bo.resource->bus.offset = 0;
+			nvbo->bo.resource->bus.addr = NULL;
 			goto retry;
 		}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_chan.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_chan.c
@@ -52,7 +52,7 @@
 nouveau_channel_killed(struct nvif_event *event, void *repv, u32 repc)
 {
 	struct nouveau_channel *chan = container_of(event, typeof(*chan), kill);
-	struct nouveau_cli *cli = (void *)chan->user.client;
+	struct nouveau_cli *cli = chan->cli;
 
 	NV_PRINTK(warn, cli, "channel %d killed!\n", chan->chid);
 
@@ -66,7 +66,7 @@
 nouveau_channel_idle(struct nouveau_channel *chan)
 {
 	if (likely(chan && chan->fence && !atomic_read(&chan->killed))) {
-		struct nouveau_cli *cli = (void *)chan->user.client;
+		struct nouveau_cli *cli = chan->cli;
 		struct nouveau_fence *fence = NULL;
 		int ret;
 
@@ -142,10 +142,11 @@
 }
 
 static int
-nouveau_channel_prep(struct nouveau_drm *drm, struct nvif_device *device,
+nouveau_channel_prep(struct nouveau_cli *cli,
 		     u32 size, struct nouveau_channel **pchan)
 {
-	struct nouveau_cli *cli = (void *)device->object.client;
+	struct nouveau_drm *drm = cli->drm;
+	struct nvif_device *device = &cli->device;
 	struct nv_dma_v0 args = {};
 	struct nouveau_channel *chan;
 	u32 target;
@@ -155,6 +156,7 @@
 	if (!chan)
 		return -ENOMEM;
 
+	chan->cli = cli;
 	chan->device = device;
 	chan->drm = drm;
 	chan->vmm = nouveau_cli_vmm(cli);
@@ -254,7 +256,7 @@
 }
 
 static int
-nouveau_channel_ctor(struct nouveau_drm *drm, struct nvif_device *device, bool priv, u64 runm,
+nouveau_channel_ctor(struct nouveau_cli *cli, bool priv, u64 runm,
 		     struct nouveau_channel **pchan)
 {
 	const struct nvif_mclass hosts[] = {
@@ -279,7 +281,7 @@
 		struct nvif_chan_v0 chan;
 		char name[TASK_COMM_LEN+16];
 	} args;
-	struct nouveau_cli *cli = (void *)device->object.client;
+	struct nvif_device *device = &cli->device;
 	struct nouveau_channel *chan;
 	const u64 plength = 0x10000;
 	const u64 ioffset = plength;
@@ -298,7 +300,7 @@
 		size = ioffset + ilength;
 
 	/* allocate dma push buffer */
-	ret = nouveau_channel_prep(drm, device, size, &chan);
+	ret = nouveau_channel_prep(cli, size, &chan);
 	*pchan = chan;
 	if (ret)
 		return ret;
@@ -493,13 +495,12 @@
 }
 
 int
-nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device,
+nouveau_channel_new(struct nouveau_cli *cli,
 		    bool priv, u64 runm, u32 vram, u32 gart, struct nouveau_channel **pchan)
 {
-	struct nouveau_cli *cli = (void *)device->object.client;
 	int ret;
 
-	ret = nouveau_channel_ctor(drm, device, priv, runm, pchan);
+	ret = nouveau_channel_ctor(cli, priv, runm, pchan);
 	if (ret) {
 		NV_PRINTK(dbg, cli, "channel create, %d\n", ret);
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_chan.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_chan.h
@@ -12,6 +12,7 @@
 		struct nvif_push *push;
 	} chan;
 
+	struct nouveau_cli *cli;
 	struct nvif_device *device;
 	struct nouveau_drm *drm;
 	struct nouveau_vmm *vmm;
@@ -62,7 +63,7 @@
 int nouveau_channels_init(struct nouveau_drm *);
 void nouveau_channels_fini(struct nouveau_drm *);
 
-int  nouveau_channel_new(struct nouveau_drm *, struct nvif_device *, bool priv, u64 runm,
+int  nouveau_channel_new(struct nouveau_cli *, bool priv, u64 runm,
 			 u32 vram, u32 gart, struct nouveau_channel **);
 void nouveau_channel_del(struct nouveau_channel **);
 int  nouveau_channel_idle(struct nouveau_channel *);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -1001,6 +1001,9 @@
 		struct drm_display_mode *mode;
 
 		mode = drm_mode_duplicate(dev, nv_connector->native_mode);
+		if (!mode)
+			return 0;
+
 		drm_mode_probed_add(connector, mode);
 		ret = 1;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_display.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -450,6 +450,9 @@
 {
 	struct nouveau_drm *drm = nouveau_drm(dev);
 
+	if (drm->headless)
+		return;
+
 	spin_lock_irq(&drm->hpd_lock);
 	drm->hpd_pending = ~0;
 	spin_unlock_irq(&drm->hpd_lock);
@@ -635,7 +638,7 @@
 	}
 	drm_connector_list_iter_end(&conn_iter);
 
-	if (!runtime)
+	if (!runtime && !drm->headless)
 		cancel_work_sync(&drm->hpd_work);
 
 	drm_kms_helper_poll_disable(dev);
@@ -729,6 +732,7 @@
 		/* no display hw */
 		if (ret == -ENODEV) {
 			ret = 0;
+			drm->headless = true;
 			goto disp_create_err;
 		}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_dmem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_dmem.c
@@ -193,7 +193,7 @@
 	if (!spage || !(src & MIGRATE_PFN_MIGRATE))
 		goto done;
 
-	dpage = alloc_page_vma(GFP_HIGHUSER, vmf->vma, vmf->address);
+	dpage = alloc_page_vma(GFP_HIGHUSER | __GFP_ZERO, vmf->vma, vmf->address);
 	if (!dpage)
 		goto done;
 
@@ -378,9 +378,9 @@
 	dma_addr_t *dma_addrs;
 	struct nouveau_fence *fence;
 
-	src_pfns = kcalloc(npages, sizeof(*src_pfns), GFP_KERNEL);
-	dst_pfns = kcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL);
-	dma_addrs = kcalloc(npages, sizeof(*dma_addrs), GFP_KERNEL);
+	src_pfns = kvcalloc(npages, sizeof(*src_pfns), GFP_KERNEL | __GFP_NOFAIL);
+	dst_pfns = kvcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL | __GFP_NOFAIL);
+	dma_addrs = kvcalloc(npages, sizeof(*dma_addrs), GFP_KERNEL | __GFP_NOFAIL);
 
 	migrate_device_range(src_pfns, chunk->pagemap.range.start >> PAGE_SHIFT,
 			npages);
@@ -406,11 +406,11 @@
 	migrate_device_pages(src_pfns, dst_pfns, npages);
 	nouveau_dmem_fence_done(&fence);
 	migrate_device_finalize(src_pfns, dst_pfns, npages);
-	kfree(src_pfns);
-	kfree(dst_pfns);
+	kvfree(src_pfns);
+	kvfree(dst_pfns);
 	for (i = 0; i < npages; i++)
 		dma_unmap_page(chunk->drm->dev->dev, dma_addrs[i], PAGE_SIZE, DMA_BIDIRECTIONAL);
-	kfree(dma_addrs);
+	kvfree(dma_addrs);
 }
 
 void
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_dp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_dp.c
@@ -225,12 +225,15 @@
 	u8 *dpcd = nv_encoder->dp.dpcd;
 	int ret = NOUVEAU_DP_NONE, hpd;
 
-	/* If we've already read the DPCD on an eDP device, we don't need to
-	 * reread it as it won't change
+	/* eDP ports don't support hotplugging - so there's no point in probing eDP ports unless we
+	 * haven't probed them once before.
 	 */
-	if (connector->connector_type == DRM_MODE_CONNECTOR_eDP &&
-	    dpcd[DP_DPCD_REV] != 0)
-		return NOUVEAU_DP_SST;
+	if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+		if (connector->status == connector_status_connected)
+			return NOUVEAU_DP_SST;
+		else if (connector->status == connector_status_disconnected)
+			return NOUVEAU_DP_NONE;
+	}
 
 	mutex_lock(&nv_encoder->dp.hpd_irq_lock);
 	if (mstm) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -356,7 +356,7 @@
 		return;
 	}
 
-	ret = nouveau_channel_new(drm, device, false, runm, NvDmaFB, NvDmaTT, &drm->cechan);
+	ret = nouveau_channel_new(&drm->client, true, runm, NvDmaFB, NvDmaTT, &drm->cechan);
 	if (ret)
 		NV_ERROR(drm, "failed to create ce channel, %d\n", ret);
 }
@@ -384,7 +384,7 @@
 		return;
 	}
 
-	ret = nouveau_channel_new(drm, device, false, runm, NvDmaFB, NvDmaTT, &drm->channel);
+	ret = nouveau_channel_new(&drm->client, false, runm, NvDmaFB, NvDmaTT, &drm->channel);
 	if (ret) {
 		NV_ERROR(drm, "failed to create kernel channel, %d\n", ret);
 		nouveau_accel_gr_fini(drm);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -276,6 +276,7 @@
 	/* modesetting */
 	struct nvbios vbios;
 	struct nouveau_display *display;
+	bool headless;
 	struct work_struct hpd_work;
 	spinlock_t hpd_lock;
 	u32 hpd_pending;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -386,11 +386,13 @@
 			if (f) {
 				struct nouveau_channel *prev;
 				bool must_wait = true;
+				bool local;
 
 				rcu_read_lock();
 				prev = rcu_dereference(f->channel);
-				if (prev && (prev == chan ||
-					     fctx->sync(f, prev, chan) == 0))
+				local = prev && prev->cli->drm == chan->cli->drm;
+				if (local && (prev == chan ||
+					      fctx->sync(f, prev, chan) == 0))
 					must_wait = false;
 				rcu_read_unlock();
 				if (!must_wait)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_prime.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_prime.c
@@ -64,7 +64,8 @@
 	 * to the caller, instead of a normal nouveau_bo ttm reference. */
 	ret = drm_gem_object_init(dev, &nvbo->bo.base, size);
 	if (ret) {
-		nouveau_bo_ref(NULL, &nvbo);
+		drm_gem_object_release(&nvbo->bo.base);
+		kfree(nvbo);
 		obj = ERR_PTR(-ENOMEM);
 		goto unlock;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nouveau_uvmm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nouveau_uvmm.c
@@ -812,15 +812,15 @@
 	struct drm_gpuva_op_unmap *u = r->unmap;
 	struct nouveau_uvma *uvma = uvma_from_va(u->va);
 	u64 addr = uvma->va.va.addr;
-	u64 range = uvma->va.va.range;
+	u64 end = uvma->va.va.addr + uvma->va.va.range;
 
 	if (r->prev)
 		addr = r->prev->va.addr + r->prev->va.range;
 
 	if (r->next)
-		range = r->next->va.addr - addr;
+		end = r->next->va.addr;
 
-	op_unmap_range(u, addr, range);
+	op_unmap_range(u, addr, end - addr);
 }
 
 static int
@@ -1803,6 +1803,7 @@
 {
 	struct nouveau_bo *nvbo = nouveau_gem_object(vm_bo->obj);
 
+	nouveau_bo_placement_set(nvbo, nvbo->valid_domains, 0);
 	return nouveau_bo_validate(nvbo, true, false);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/core/firmware.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/core/firmware.c
@@ -205,7 +205,8 @@
 		break;
 	case NVKM_FIRMWARE_IMG_DMA:
 		nvkm_memory_unref(&memory);
-		dma_free_coherent(fw->device->dev, sg_dma_len(&fw->mem.sgl), fw->img, fw->phys);
+		dma_free_noncoherent(fw->device->dev, sg_dma_len(&fw->mem.sgl),
+				     fw->img, fw->phys, DMA_TO_DEVICE);
 		break;
 	case NVKM_FIRMWARE_IMG_SGT:
 		nvkm_memory_unref(&memory);
@@ -236,10 +237,12 @@
 		break;
 	case NVKM_FIRMWARE_IMG_DMA: {
 		dma_addr_t addr;
-
 		len = ALIGN(fw->len, PAGE_SIZE);
 
-		fw->img = dma_alloc_coherent(fw->device->dev, len, &addr, GFP_KERNEL);
+		fw->img = dma_alloc_noncoherent(fw->device->dev,
+						len, &addr,
+						DMA_TO_DEVICE,
+						GFP_KERNEL);
 		if (fw->img) {
 			memcpy(fw->img, src, fw->len);
 			fw->phys = addr;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/engine/disp/mcp77.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/engine/disp/mcp77.c
@@ -31,6 +31,7 @@
 	.state = g94_sor_state,
 	.power = nv50_sor_power,
 	.clock = nv50_sor_clock,
+	.bl = &nv50_sor_bl,
 	.hdmi = &g84_sor_hdmi,
 	.dp = &g94_sor_dp,
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c
@@ -992,7 +992,7 @@
 		ctrl->data = data;
 
 		ret = nvkm_gsp_rm_ctrl_push(&disp->rm.objcom, &ctrl, sizeof(*ctrl));
-		if (ret == -EAGAIN && ctrl->retryTimeMs) {
+		if ((ret == -EAGAIN || ret == -EBUSY) && ctrl->retryTimeMs) {
 			/*
 			 * Device (likely an eDP panel) isn't ready yet, wait for the time specified
 			 * by GSP before retrying again
@@ -1060,33 +1060,44 @@
 	NV0073_CTRL_DP_AUXCH_CTRL_PARAMS *ctrl;
 	u8 size = *psize;
 	int ret;
+	int retries;
 
-	ctrl = nvkm_gsp_rm_ctrl_get(&disp->rm.objcom, NV0073_CTRL_CMD_DP_AUXCH_CTRL, sizeof(*ctrl));
-	if (IS_ERR(ctrl))
-		return PTR_ERR(ctrl);
+	for (retries = 0; retries < 3; ++retries) {
+		ctrl = nvkm_gsp_rm_ctrl_get(&disp->rm.objcom, NV0073_CTRL_CMD_DP_AUXCH_CTRL, sizeof(*ctrl));
+		if (IS_ERR(ctrl))
+			return PTR_ERR(ctrl);
+
+		ctrl->subDeviceInstance = 0;
+		ctrl->displayId = BIT(outp->index);
+		ctrl->bAddrOnly = !size;
+		ctrl->cmd = type;
+		if (ctrl->bAddrOnly) {
+			ctrl->cmd = NVDEF_SET(ctrl->cmd, NV0073_CTRL, DP_AUXCH_CMD, REQ_TYPE, WRITE);
+			ctrl->cmd = NVDEF_SET(ctrl->cmd, NV0073_CTRL, DP_AUXCH_CMD,  I2C_MOT, FALSE);
+		}
+		ctrl->addr = addr;
+		ctrl->size = !ctrl->bAddrOnly ? (size - 1) : 0;
+		memcpy(ctrl->data, data, size);
 
-	ctrl->subDeviceInstance = 0;
-	ctrl->displayId = BIT(outp->index);
-	ctrl->bAddrOnly = !size;
-	ctrl->cmd = type;
-	if (ctrl->bAddrOnly) {
-		ctrl->cmd = NVDEF_SET(ctrl->cmd, NV0073_CTRL, DP_AUXCH_CMD, REQ_TYPE, WRITE);
-		ctrl->cmd = NVDEF_SET(ctrl->cmd, NV0073_CTRL, DP_AUXCH_CMD,  I2C_MOT, FALSE);
-	}
-	ctrl->addr = addr;
-	ctrl->size = !ctrl->bAddrOnly ? (size - 1) : 0;
-	memcpy(ctrl->data, data, size);
-
-	ret = nvkm_gsp_rm_ctrl_push(&disp->rm.objcom, &ctrl, sizeof(*ctrl));
-	if (ret) {
-		nvkm_gsp_rm_ctrl_done(&disp->rm.objcom, ctrl);
-		return PTR_ERR(ctrl);
+		ret = nvkm_gsp_rm_ctrl_push(&disp->rm.objcom, &ctrl, sizeof(*ctrl));
+		if ((ret == -EAGAIN || ret == -EBUSY) && ctrl->retryTimeMs) {
+			/*
+			 * Device (likely an eDP panel) isn't ready yet, wait for the time specified
+			 * by GSP before retrying again
+			 */
+			nvkm_debug(&disp->engine.subdev,
+				   "Waiting %dms for GSP LT panel delay before retrying in AUX\n",
+				   ctrl->retryTimeMs);
+			msleep(ctrl->retryTimeMs);
+			nvkm_gsp_rm_ctrl_done(&disp->rm.objcom, ctrl);
+		} else {
+			memcpy(data, ctrl->data, size);
+			*psize = ctrl->size;
+			ret = ctrl->replyType;
+			nvkm_gsp_rm_ctrl_done(&disp->rm.objcom, ctrl);
+			break;
+		}
 	}
-
-	memcpy(data, ctrl->data, size);
-	*psize = ctrl->size;
-	ret = ctrl->replyType;
-	nvkm_gsp_rm_ctrl_done(&disp->rm.objcom, ctrl);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
@@ -443,6 +443,7 @@
 		ret = gf100_grctx_generate(gr, chan, fifoch->inst);
 		if (ret) {
 			nvkm_error(&base->engine.subdev, "failed to construct context\n");
+			mutex_unlock(&gr->fecs.mutex);
 			return ret;
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c
@@ -89,6 +89,7 @@
 		nvkm_falcon_fw_dtor_sigs(fw);
 	}
 
+
 	FLCNFW_DBG(fw, "resetting");
 	fw->func->reset(fw);
 
@@ -99,6 +100,12 @@
 			goto done;
 	}
 
+	/* after last write to the img, sync dma mappings */
+	dma_sync_single_for_device(fw->fw.device->dev,
+				   fw->fw.phys,
+				   sg_dma_len(&fw->fw.mem.sgl),
+				   DMA_TO_DEVICE);
+
 	ret = fw->func->load(fw);
 	if (ret)
 		goto done;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c
@@ -66,11 +66,16 @@
 	return ERR_PTR(-EINVAL);
 }
 
+static void of_fini(void *p)
+{
+	kfree(p);
+}
+
 const struct nvbios_source
 nvbios_of = {
 	.name = "OpenFirmware",
 	.init = of_init,
-	.fini = (void(*)(void *))kfree,
+	.fini = of_fini,
 	.read = of_read,
 	.size = of_size,
 	.rw = false,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c
@@ -25,6 +25,7 @@
 
 #include <subdev/bios.h>
 #include <subdev/bios/init.h>
+#include <subdev/gsp.h>
 
 void
 gm107_devinit_disable(struct nvkm_devinit *init)
@@ -33,10 +34,13 @@
 	u32 r021c00 = nvkm_rd32(device, 0x021c00);
 	u32 r021c04 = nvkm_rd32(device, 0x021c04);
 
-	if (r021c00 & 0x00000001)
-		nvkm_subdev_disable(device, NVKM_ENGINE_CE, 0);
-	if (r021c00 & 0x00000004)
-		nvkm_subdev_disable(device, NVKM_ENGINE_CE, 2);
+	/* gsp only wants to enable/disable display */
+	if (!nvkm_gsp_rm(device->gsp)) {
+		if (r021c00 & 0x00000001)
+			nvkm_subdev_disable(device, NVKM_ENGINE_CE, 0);
+		if (r021c00 & 0x00000004)
+			nvkm_subdev_disable(device, NVKM_ENGINE_CE, 2);
+	}
 	if (r021c04 & 0x00000001)
 		nvkm_subdev_disable(device, NVKM_ENGINE_DISP, 0);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ram.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ram.h
@@ -46,6 +46,8 @@
 u32 gm200_ram_probe_fbp_amount(const struct nvkm_ram_func *, u32,
 			       struct nvkm_device *, int, int *);
 
+int gp100_ram_init(struct nvkm_ram *);
+
 /* RAM type-specific MR calculation routines */
 int nvkm_sddr2_calc(struct nvkm_ram *);
 int nvkm_sddr3_calc(struct nvkm_ram *);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgp100.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgp100.c
@@ -27,7 +27,7 @@
 #include <subdev/bios/init.h>
 #include <subdev/bios/rammap.h>
 
-static int
+int
 gp100_ram_init(struct nvkm_ram *ram)
 {
 	struct nvkm_subdev *subdev = &ram->fb->subdev;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgp102.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgp102.c
@@ -5,6 +5,7 @@
 
 static const struct nvkm_ram_func
 gp102_ram = {
+	.init = gp100_ram_init,
 };
 
 int
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c
@@ -324,7 +324,7 @@
 		return ret;
 
 	/* Verify. */
-	err = nvkm_rd32(device, 0x001400 + (0xf * 4)) & 0x0000ffff;
+	err = nvkm_rd32(device, 0x001400 + (0x15 * 4)) & 0x0000ffff;
 	if (err) {
 		nvkm_error(subdev, "fwsec-sb: 0x%04x\n", err);
 		return -EIO;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
@@ -76,7 +76,7 @@
 	switch (rpc_status) {
 	case 0x55: /* NV_ERR_NOT_READY */
 	case 0x66: /* NV_ERR_TIMEOUT_RETRY */
-		return -EAGAIN;
+		return -EBUSY;
 	case 0x51: /* NV_ERR_NO_MEMORY */
 		return -ENOMEM;
 	default:
@@ -599,7 +599,7 @@
 
 	if (rpc->status) {
 		ret = ERR_PTR(r535_rpc_status_to_errno(rpc->status));
-		if (PTR_ERR(ret) != -EAGAIN)
+		if (PTR_ERR(ret) != -EAGAIN && PTR_ERR(ret) != -EBUSY)
 			nvkm_error(&gsp->subdev, "RM_ALLOC: 0x%x\n", rpc->status);
 	} else {
 		ret = repc ? rpc->params : NULL;
@@ -658,7 +658,7 @@
 
 	if (rpc->status) {
 		ret = r535_rpc_status_to_errno(rpc->status);
-		if (ret != -EAGAIN)
+		if (ret != -EAGAIN && ret != -EBUSY)
 			nvkm_error(&gsp->subdev, "cli:0x%08x obj:0x%08x ctrl cmd:0x%08x failed: 0x%08x\n",
 				   object->client->object.handle, object->handle, rpc->cmd, rpc->status);
 	}
@@ -1112,7 +1112,7 @@
 	rpc->numEntries = NV_GSP_REG_NUM_ENTRIES;
 
 	str_offset = offsetof(typeof(*rpc), entries[NV_GSP_REG_NUM_ENTRIES]);
-	strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES];
+	strings = (char *)rpc + str_offset;
 	for (i = 0; i < NV_GSP_REG_NUM_ENTRIES; i++) {
 		int name_len = strlen(r535_registry_entries[i].name) + 1;
 
@@ -1620,7 +1620,7 @@
 	meta->magic = GSP_FW_WPR_META_MAGIC;
 	meta->revision = GSP_FW_WPR_META_REVISION;
 
-	meta->sysmemAddrOfRadix3Elf = gsp->radix3.mem[0].addr;
+	meta->sysmemAddrOfRadix3Elf = gsp->radix3.lvl0.addr;
 	meta->sizeOfRadix3Elf = gsp->fb.wpr2.elf.size;
 
 	meta->sysmemAddrOfBootloader = gsp->boot.fw.addr;
@@ -1914,8 +1914,9 @@
 static void
 nvkm_gsp_radix3_dtor(struct nvkm_gsp *gsp, struct nvkm_gsp_radix3 *rx3)
 {
-	for (int i = ARRAY_SIZE(rx3->mem) - 1; i >= 0; i--)
-		nvkm_gsp_mem_dtor(gsp, &rx3->mem[i]);
+	nvkm_gsp_sg_free(gsp->subdev.device, &rx3->lvl2);
+	nvkm_gsp_mem_dtor(gsp, &rx3->lvl1);
+	nvkm_gsp_mem_dtor(gsp, &rx3->lvl0);
 }
 
 /**
@@ -1951,36 +1952,60 @@
 nvkm_gsp_radix3_sg(struct nvkm_gsp *gsp, struct sg_table *sgt, u64 size,
 		   struct nvkm_gsp_radix3 *rx3)
 {
-	u64 addr;
+	struct sg_dma_page_iter sg_dma_iter;
+	struct scatterlist *sg;
+	size_t bufsize;
+	u64 *pte;
+	int ret, i, page_idx = 0;
 
-	for (int i = ARRAY_SIZE(rx3->mem) - 1; i >= 0; i--) {
-		u64 *ptes;
-		size_t bufsize;
-		int ret, idx;
+	ret = nvkm_gsp_mem_ctor(gsp, GSP_PAGE_SIZE, &rx3->lvl0);
+	if (ret)
+		return ret;
 
-		bufsize = ALIGN((size / GSP_PAGE_SIZE) * sizeof(u64), GSP_PAGE_SIZE);
-		ret = nvkm_gsp_mem_ctor(gsp, bufsize, &rx3->mem[i]);
-		if (ret)
-			return ret;
+	ret = nvkm_gsp_mem_ctor(gsp, GSP_PAGE_SIZE, &rx3->lvl1);
+	if (ret)
+		goto lvl1_fail;
 
-		ptes = rx3->mem[i].data;
-		if (i == 2) {
-			struct scatterlist *sgl;
-
-			for_each_sgtable_dma_sg(sgt, sgl, idx) {
-				for (int j = 0; j < sg_dma_len(sgl) / GSP_PAGE_SIZE; j++)
-					*ptes++ = sg_dma_address(sgl) + (GSP_PAGE_SIZE * j);
-			}
-		} else {
-			for (int j = 0; j < size / GSP_PAGE_SIZE; j++)
-				*ptes++ = addr + GSP_PAGE_SIZE * j;
+	// Allocate level 2
+	bufsize = ALIGN((size / GSP_PAGE_SIZE) * sizeof(u64), GSP_PAGE_SIZE);
+	ret = nvkm_gsp_sg(gsp->subdev.device, bufsize, &rx3->lvl2);
+	if (ret)
+		goto lvl2_fail;
+
+	// Write the bus address of level 1 to level 0
+	pte = rx3->lvl0.data;
+	*pte = rx3->lvl1.addr;
+
+	// Write the bus address of each page in level 2 to level 1
+	pte = rx3->lvl1.data;
+	for_each_sgtable_dma_page(&rx3->lvl2, &sg_dma_iter, 0)
+		*pte++ = sg_page_iter_dma_address(&sg_dma_iter);
+
+	// Finally, write the bus address of each page in sgt to level 2
+	for_each_sgtable_sg(&rx3->lvl2, sg, i) {
+		void *sgl_end;
+
+		pte = sg_virt(sg);
+		sgl_end = (void *)pte + sg->length;
+
+		for_each_sgtable_dma_page(sgt, &sg_dma_iter, page_idx) {
+			*pte++ = sg_page_iter_dma_address(&sg_dma_iter);
+			page_idx++;
+
+			// Go to the next scatterlist for level 2 if we've reached the end
+			if ((void *)pte >= sgl_end)
+				break;
 		}
+	}
 
-		size = rx3->mem[i].size;
-		addr = rx3->mem[i].addr;
+	if (ret) {
+lvl2_fail:
+		nvkm_gsp_mem_dtor(gsp, &rx3->lvl1);
+lvl1_fail:
+		nvkm_gsp_mem_dtor(gsp, &rx3->lvl0);
 	}
 
-	return 0;
+	return ret;
 }
 
 int
@@ -2012,7 +2037,7 @@
 		sr = gsp->sr.meta.data;
 		sr->magic = GSP_FW_SR_META_MAGIC;
 		sr->revision = GSP_FW_SR_META_REVISION;
-		sr->sysmemAddrOfSuspendResumeData = gsp->sr.radix3.mem[0].addr;
+		sr->sysmemAddrOfSuspendResumeData = gsp->sr.radix3.lvl0.addr;
 		sr->sizeOfSuspendResumeData = len;
 
 		mbox0 = lower_32_bits(gsp->sr.meta.addr);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
@@ -222,8 +222,11 @@
 	void __iomem *map = NULL;
 
 	/* Already mapped? */
-	if (refcount_inc_not_zero(&iobj->maps))
+	if (refcount_inc_not_zero(&iobj->maps)) {
+		/* read barrier match the wmb on refcount set */
+		smp_rmb();
 		return iobj->map;
+	}
 
 	/* Take the lock, and re-check that another thread hasn't
 	 * already mapped the object in the meantime.
@@ -250,6 +253,8 @@
 			iobj->base.memory.ptrs = &nv50_instobj_fast;
 		else
 			iobj->base.memory.ptrs = &nv50_instobj_slow;
+		/* barrier to ensure the ptrs are written before refcount is set */
+		smp_wmb();
 		refcount_set(&iobj->maps, 1);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/omapdrm/Kconfig
+++ linux-qcom-6.8.0/drivers/gpu/drm/omapdrm/Kconfig
@@ -4,7 +4,7 @@
 	depends on DRM && OF
 	depends on ARCH_OMAP2PLUS
 	select DRM_KMS_HELPER
-	select FB_DMAMEM_HELPERS if DRM_FBDEV_EMULATION
+	select FB_DMAMEM_HELPERS_DEFERRED if DRM_FBDEV_EMULATION
 	select VIDEOMODE_HELPERS
 	select HDMI
 	default n
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/omapdrm/dss/base.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/omapdrm/dss/base.c
@@ -139,21 +139,13 @@
 }
 
 int omapdss_device_connect(struct dss_device *dss,
-			   struct omap_dss_device *src,
 			   struct omap_dss_device *dst)
 {
-	dev_dbg(&dss->pdev->dev, "connect(%s, %s)\n",
-		src ? dev_name(src->dev) : "NULL",
+	dev_dbg(&dss->pdev->dev, "connect(%s)\n",
 		dst ? dev_name(dst->dev) : "NULL");
 
-	if (!dst) {
-		/*
-		 * The destination is NULL when the source is connected to a
-		 * bridge instead of a DSS device. Stop here, we will attach
-		 * the bridge later when we will have a DRM encoder.
-		 */
-		return src && src->bridge ? 0 : -EINVAL;
-	}
+	if (!dst)
+		return -EINVAL;
 
 	if (omapdss_device_is_connected(dst))
 		return -EBUSY;
@@ -163,19 +155,14 @@
 	return 0;
 }
 
-void omapdss_device_disconnect(struct omap_dss_device *src,
+void omapdss_device_disconnect(struct dss_device *dss,
 			       struct omap_dss_device *dst)
 {
-	struct dss_device *dss = src ? src->dss : dst->dss;
-
-	dev_dbg(&dss->pdev->dev, "disconnect(%s, %s)\n",
-		src ? dev_name(src->dev) : "NULL",
+	dev_dbg(&dss->pdev->dev, "disconnect(%s)\n",
 		dst ? dev_name(dst->dev) : "NULL");
 
-	if (!dst) {
-		WARN_ON(!src->bridge);
+	if (WARN_ON(!dst))
 		return;
-	}
 
 	if (!dst->id && !omapdss_device_is_connected(dst)) {
 		WARN_ON(1);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/omapdrm/dss/omapdss.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/omapdrm/dss/omapdss.h
@@ -242,9 +242,8 @@
 void omapdss_device_put(struct omap_dss_device *dssdev);
 struct omap_dss_device *omapdss_find_device_by_node(struct device_node *node);
 int omapdss_device_connect(struct dss_device *dss,
-			   struct omap_dss_device *src,
 			   struct omap_dss_device *dst);
-void omapdss_device_disconnect(struct omap_dss_device *src,
+void omapdss_device_disconnect(struct dss_device *dss,
 			       struct omap_dss_device *dst);
 
 int omap_dss_get_num_overlay_managers(void);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/omapdrm/omap_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/omapdrm/omap_drv.c
@@ -307,7 +307,7 @@
 	for (i = 0; i < priv->num_pipes; i++) {
 		struct omap_drm_pipeline *pipe = &priv->pipes[i];
 
-		omapdss_device_disconnect(NULL, pipe->output);
+		omapdss_device_disconnect(priv->dss, pipe->output);
 
 		omapdss_device_put(pipe->output);
 		pipe->output = NULL;
@@ -325,7 +325,7 @@
 	int r;
 
 	for_each_dss_output(output) {
-		r = omapdss_device_connect(priv->dss, NULL, output);
+		r = omapdss_device_connect(priv->dss, output);
 		if (r == -EPROBE_DEFER) {
 			omapdss_device_put(output);
 			return r;
@@ -695,6 +695,10 @@
 	soc = soc_device_match(omapdrm_soc_devices);
 	priv->omaprev = soc ? (uintptr_t)soc->data : 0;
 	priv->wq = alloc_ordered_workqueue("omapdrm", 0);
+	if (!priv->wq) {
+		ret = -ENOMEM;
+		goto err_alloc_workqueue;
+	}
 
 	mutex_init(&priv->list_lock);
 	INIT_LIST_HEAD(&priv->obj_list);
@@ -753,6 +757,7 @@
 	drm_mode_config_cleanup(ddev);
 	omap_gem_deinit(ddev);
 	destroy_workqueue(priv->wq);
+err_alloc_workqueue:
 	omap_disconnect_pipelines(ddev);
 	drm_dev_put(ddev);
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/omapdrm/omap_fbdev.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/omapdrm/omap_fbdev.c
@@ -51,6 +51,10 @@
 	omap_gem_roll(bo, fbi->var.yoffset * npages);
 }
 
+FB_GEN_DEFAULT_DEFERRED_DMAMEM_OPS(omap_fbdev,
+				   drm_fb_helper_damage_range,
+				   drm_fb_helper_damage_area)
+
 static int omap_fbdev_pan_display(struct fb_var_screeninfo *var,
 		struct fb_info *fbi)
 {
@@ -78,11 +82,9 @@
 
 static int omap_fbdev_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
-	struct drm_fb_helper *helper = info->par;
-	struct drm_framebuffer *fb = helper->fb;
-	struct drm_gem_object *bo = drm_gem_fb_get_obj(fb, 0);
+	vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
 
-	return drm_gem_mmap_obj(bo, omap_gem_mmap_size(bo), vma);
+	return fb_deferred_io_mmap(info, vma);
 }
 
 static void omap_fbdev_fb_destroy(struct fb_info *info)
@@ -94,6 +96,7 @@
 
 	DBG();
 
+	fb_deferred_io_cleanup(info);
 	drm_fb_helper_fini(helper);
 
 	omap_gem_unpin(bo);
@@ -104,15 +107,19 @@
 	kfree(fbdev);
 }
 
+/*
+ * For now, we cannot use FB_DEFAULT_DEFERRED_OPS and fb_deferred_io_mmap()
+ * because we use write-combine.
+ */
 static const struct fb_ops omap_fb_ops = {
 	.owner = THIS_MODULE,
-	__FB_DEFAULT_DMAMEM_OPS_RDWR,
+	__FB_DEFAULT_DEFERRED_OPS_RDWR(omap_fbdev),
 	.fb_check_var	= drm_fb_helper_check_var,
 	.fb_set_par	= drm_fb_helper_set_par,
 	.fb_setcmap	= drm_fb_helper_setcmap,
 	.fb_blank	= drm_fb_helper_blank,
 	.fb_pan_display = omap_fbdev_pan_display,
-	__FB_DEFAULT_DMAMEM_OPS_DRAW,
+	__FB_DEFAULT_DEFERRED_OPS_DRAW(omap_fbdev),
 	.fb_ioctl	= drm_fb_helper_ioctl,
 	.fb_mmap	= omap_fbdev_fb_mmap,
 	.fb_destroy	= omap_fbdev_fb_destroy,
@@ -213,6 +220,15 @@
 	fbi->fix.smem_start = dma_addr;
 	fbi->fix.smem_len = bo->size;
 
+	/* deferred I/O */
+	helper->fbdefio.delay = HZ / 20;
+	helper->fbdefio.deferred_io = drm_fb_helper_deferred_io;
+
+	fbi->fbdefio = &helper->fbdefio;
+	ret = fb_deferred_io_init(fbi);
+	if (ret)
+		goto fail;
+
 	/* if we have DMM, then we can use it for scrolling by just
 	 * shuffling pages around in DMM rather than doing sw blit.
 	 */
@@ -238,8 +254,20 @@
 	return ret;
 }
 
+static int omap_fbdev_dirty(struct drm_fb_helper *helper, struct drm_clip_rect *clip)
+{
+	if (!(clip->x1 < clip->x2 && clip->y1 < clip->y2))
+		return 0;
+
+	if (helper->fb->funcs->dirty)
+		return helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, clip, 1);
+
+	return 0;
+}
+
 static const struct drm_fb_helper_funcs omap_fb_helper_funcs = {
 	.fb_probe = omap_fbdev_create,
+	.fb_dirty = omap_fbdev_dirty,
 };
 
 static struct drm_fb_helper *get_fb(struct fb_info *fbi)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/omapdrm/omap_gem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/omapdrm/omap_gem.c
@@ -1401,8 +1401,6 @@
 
 	omap_obj = to_omap_bo(obj);
 
-	mutex_lock(&omap_obj->lock);
-
 	omap_obj->sgt = sgt;
 
 	if (omap_gem_sgt_is_contiguous(sgt, size)) {
@@ -1417,21 +1415,17 @@
 		pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL);
 		if (!pages) {
 			omap_gem_free_object(obj);
-			obj = ERR_PTR(-ENOMEM);
-			goto done;
+			return ERR_PTR(-ENOMEM);
 		}
 
 		omap_obj->pages = pages;
 		ret = drm_prime_sg_to_page_array(sgt, pages, npages);
 		if (ret) {
 			omap_gem_free_object(obj);
-			obj = ERR_PTR(-ENOMEM);
-			goto done;
+			return ERR_PTR(-ENOMEM);
 		}
 	}
 
-done:
-	mutex_unlock(&omap_obj->lock);
 	return obj;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/Kconfig
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/Kconfig
@@ -184,7 +184,7 @@
 
 config DRM_PANEL_ILITEK_ILI9341
 	tristate "Ilitek ILI9341 240x320 QVGA panels"
-	depends on OF && SPI
+	depends on SPI
 	select DRM_KMS_HELPER
 	select DRM_GEM_DMA_HELPER
 	depends on BACKLIGHT_CLASS_DEVICE
@@ -438,6 +438,16 @@
 	  around the Novatek NT36672A display controller, such as some
 	  Tianma panels used in a few Xiaomi Poco F1 mobile phones.
 
+config DRM_PANEL_NOVATEK_NT36672E
+	tristate "Novatek NT36672E DSI panel"
+	depends on OF
+	depends on DRM_MIPI_DSI
+	depends on BACKLIGHT_CLASS_DEVICE
+	help
+	  Say Y here if you want to enable support for Novatek NT36672E DSI Video Mode
+	  LCD panel module. The panel has a resolution of 1080x2408 and uses 24 bit
+	  RGB per pixel.
+
 config DRM_PANEL_NOVATEK_NT39016
 	tristate "Novatek NT39016 RGB/SPI panel"
 	depends on OF && SPI
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/Makefile
@@ -41,6 +41,7 @@
 obj-$(CONFIG_DRM_PANEL_NOVATEK_NT35950) += panel-novatek-nt35950.o
 obj-$(CONFIG_DRM_PANEL_NOVATEK_NT36523) += panel-novatek-nt36523.o
 obj-$(CONFIG_DRM_PANEL_NOVATEK_NT36672A) += panel-novatek-nt36672a.o
+obj-$(CONFIG_DRM_PANEL_NOVATEK_NT36672E) += panel-novatek-nt36672e.o
 obj-$(CONFIG_DRM_PANEL_NOVATEK_NT39016) += panel-novatek-nt39016.o
 obj-$(CONFIG_DRM_PANEL_MANTIX_MLAF057WE51) += panel-mantix-mlaf057we51.o
 obj-$(CONFIG_DRM_PANEL_OLIMEX_LCD_OLINUXINO) += panel-olimex-lcd-olinuxino.o
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
@@ -1507,7 +1507,11 @@
 	usleep_range(10000, 11000);
 
 	if (boe->desc->lp11_before_reset) {
-		mipi_dsi_dcs_nop(boe->dsi);
+		ret = mipi_dsi_dcs_nop(boe->dsi);
+		if (ret < 0) {
+			dev_err(&boe->dsi->dev, "Failed to send NOP: %d\n", ret);
+			goto poweroff;
+		}
 		usleep_range(1000, 2000);
 	}
 	gpiod_set_value(boe->enable_gpio, 1);
@@ -1528,13 +1532,13 @@
 	return 0;
 
 poweroff:
+	gpiod_set_value(boe->enable_gpio, 0);
 	regulator_disable(boe->avee);
 poweroffavdd:
 	regulator_disable(boe->avdd);
 poweroff1v8:
 	usleep_range(5000, 7000);
 	regulator_disable(boe->pp1800);
-	gpiod_set_value(boe->enable_gpio, 0);
 
 	return ret;
 }
@@ -1871,6 +1875,8 @@
 
 	gpiod_set_value(boe->enable_gpio, 0);
 
+	boe->base.prepare_prev_first = true;
+
 	drm_panel_init(&boe->base, dev, &boe_panel_funcs,
 		       DRM_MODE_CONNECTOR_DSI);
 	err = of_drm_get_panel_orientation(dev->of_node, &boe->orientation);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-edp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-edp.c
@@ -397,6 +397,7 @@
 {
 	struct panel_edp *p = dev_get_drvdata(dev);
 
+	drm_dp_dpcd_set_powered(p->aux, false);
 	gpiod_set_value_cansleep(p->enable_gpio, 0);
 	regulator_disable(p->supply);
 	p->unprepared_time = ktime_get_boottime();
@@ -413,8 +414,7 @@
 	if (!p->prepared)
 		return 0;
 
-	pm_runtime_mark_last_busy(panel->dev);
-	ret = pm_runtime_put_autosuspend(panel->dev);
+	ret = pm_runtime_put_sync_suspend(panel->dev);
 	if (ret < 0)
 		return ret;
 	p->prepared = false;
@@ -454,6 +454,7 @@
 	}
 
 	gpiod_set_value_cansleep(p->enable_gpio, 1);
+	drm_dp_dpcd_set_powered(p->aux, true);
 
 	delay = p->desc->delay.hpd_reliable;
 	if (p->no_hpd)
@@ -490,6 +491,7 @@
 	return 0;
 
 error:
+	drm_dp_dpcd_set_powered(p->aux, false);
 	gpiod_set_value_cansleep(p->enable_gpio, 0);
 	regulator_disable(p->supply);
 	p->unprepared_time = ktime_get_boottime();
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-himax-hx8394.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-himax-hx8394.c
@@ -370,8 +370,7 @@
 
 sleep_in:
 	/* This will probably fail, but let's try orderly power off anyway. */
-	ret = mipi_dsi_dcs_enter_sleep_mode(dsi);
-	if (!ret)
+	if (!mipi_dsi_dcs_enter_sleep_mode(dsi))
 		msleep(50);
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-ilitek-ili9341.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-ilitek-ili9341.c
@@ -22,8 +22,9 @@
 #include <linux/bitops.h>
 #include <linux/delay.h>
 #include <linux/gpio/consumer.h>
+#include <linux/mod_devicetable.h>
 #include <linux/module.h>
-#include <linux/of.h>
+#include <linux/property.h>
 #include <linux/regulator/consumer.h>
 #include <linux/spi/spi.h>
 
@@ -421,7 +422,7 @@
 
 	ili9341_dpi_init(ili);
 
-	return ret;
+	return 0;
 }
 
 static int ili9341_dpi_enable(struct drm_panel *panel)
@@ -691,7 +692,7 @@
 	 * Every new incarnation of this display must have a unique
 	 * data entry for the system in this driver.
 	 */
-	ili->conf = of_device_get_match_data(dev);
+	ili->conf = device_get_match_data(dev);
 	if (!ili->conf) {
 		dev_err(dev, "missing device configuration\n");
 		return -ENODEV;
@@ -714,18 +715,18 @@
 
 	reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
 	if (IS_ERR(reset))
-		dev_err(dev, "Failed to get gpio 'reset'\n");
+		return dev_err_probe(dev, PTR_ERR(reset), "Failed to get gpio 'reset'\n");
 
 	dc = devm_gpiod_get_optional(dev, "dc", GPIOD_OUT_LOW);
 	if (IS_ERR(dc))
-		dev_err(dev, "Failed to get gpio 'dc'\n");
+		return dev_err_probe(dev, PTR_ERR(dc), "Failed to get gpio 'dc'\n");
 
 	if (!strcmp(id->name, "sf-tc240t-9370-t"))
 		return ili9341_dpi_probe(spi, dc, reset);
 	else if (!strcmp(id->name, "yx240qv29"))
 		return ili9341_dbi_probe(spi, dc, reset);
 
-	return -1;
+	return -ENODEV;
 }
 
 static void ili9341_remove(struct spi_device *spi)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
@@ -1080,10 +1080,10 @@
 	msleep(5);
 
 	/* And reset it */
-	gpiod_set_value(ctx->reset, 1);
+	gpiod_set_value_cansleep(ctx->reset, 1);
 	msleep(20);
 
-	gpiod_set_value(ctx->reset, 0);
+	gpiod_set_value_cansleep(ctx->reset, 0);
 	msleep(20);
 
 	for (i = 0; i < ctx->desc->init_length; i++) {
@@ -1138,7 +1138,7 @@
 
 	mipi_dsi_dcs_enter_sleep_mode(ctx->dsi);
 	regulator_disable(ctx->power);
-	gpiod_set_value(ctx->reset, 1);
+	gpiod_set_value_cansleep(ctx->reset, 1);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c
@@ -560,7 +560,11 @@
 	usleep_range(10000, 11000);
 
 	// MIPI needs to keep the LP11 state before the lcm_reset pin is pulled high
-	mipi_dsi_dcs_nop(ili->dsi);
+	ret = mipi_dsi_dcs_nop(ili->dsi);
+	if (ret < 0) {
+		dev_err(&ili->dsi->dev, "Failed to send NOP: %d\n", ret);
+		goto poweroff;
+	}
 	usleep_range(1000, 2000);
 
 	gpiod_set_value(ili->enable_gpio, 1);
@@ -579,13 +583,13 @@
 	return 0;
 
 poweroff:
+	gpiod_set_value(ili->enable_gpio, 0);
 	regulator_disable(ili->avee);
 poweroffavdd:
 	regulator_disable(ili->avdd);
 poweroff1v8:
 	usleep_range(5000, 7000);
 	regulator_disable(ili->pp1800);
-	gpiod_set_value(ili->enable_gpio, 0);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-leadtek-ltk050h3146w.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-leadtek-ltk050h3146w.c
@@ -295,8 +295,6 @@
 	mipi_dsi_dcs_write_seq(dsi, 0xbd, 0x00);
 	mipi_dsi_dcs_write_seq(dsi, 0xc6, 0xef);
 	mipi_dsi_dcs_write_seq(dsi, 0xd4, 0x02);
-	mipi_dsi_dcs_write_seq(dsi, 0x11);
-	mipi_dsi_dcs_write_seq(dsi, 0x29);
 
 	ret = mipi_dsi_dcs_set_tear_on(dsi, 1);
 	if (ret < 0) {
@@ -326,7 +324,8 @@
 static const struct ltk050h3146w_desc ltk050h3148w_data = {
 	.mode = &ltk050h3148w_mode,
 	.init = ltk050h3148w_init_sequence,
-	.mode_flags = MIPI_DSI_MODE_VIDEO_SYNC_PULSE | MIPI_DSI_MODE_VIDEO_BURST,
+	.mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
+		      MIPI_DSI_MODE_VIDEO_BURST,
 };
 
 static int ltk050h3146w_init_sequence(struct ltk050h3146w *ctx)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-novatek-nt35950.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-novatek-nt35950.c
@@ -556,15 +556,13 @@
 		}
 		dsi_r_host = of_find_mipi_dsi_host_by_node(dsi_r);
 		of_node_put(dsi_r);
-		if (!dsi_r_host) {
-			dev_err(dev, "Cannot get secondary DSI host\n");
-			return -EPROBE_DEFER;
-		}
+		if (!dsi_r_host)
+			return dev_err_probe(dev, -EPROBE_DEFER, "Cannot get secondary DSI host\n");
 
 		nt->dsi[1] = mipi_dsi_device_register_full(dsi_r_host, info);
-		if (!nt->dsi[1]) {
+		if (IS_ERR(nt->dsi[1])) {
 			dev_err(dev, "Cannot get secondary DSI node\n");
-			return -ENODEV;
+			return PTR_ERR(nt->dsi[1]);
 		}
 		num_dsis++;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-novatek-nt36523.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-novatek-nt36523.c
@@ -933,8 +933,7 @@
 
 static const struct drm_display_mode elish_boe_modes[] = {
 	{
-		/* There is only one 120 Hz timing, but it doesn't work perfectly, 104 Hz preferred */
-		.clock = (1600 + 60 + 8 + 60) * (2560 + 26 + 4 + 168) * 104 / 1000,
+		.clock = (1600 + 60 + 8 + 60) * (2560 + 26 + 4 + 168) * 120 / 1000,
 		.hdisplay = 1600,
 		.hsync_start = 1600 + 60,
 		.hsync_end = 1600 + 60 + 8,
@@ -948,8 +947,7 @@
 
 static const struct drm_display_mode elish_csot_modes[] = {
 	{
-		/* There is only one 120 Hz timing, but it doesn't work perfectly, 104 Hz preferred */
-		.clock = (1600 + 200 + 40 + 52) * (2560 + 26 + 4 + 168) * 104 / 1000,
+		.clock = (1600 + 200 + 40 + 52) * (2560 + 26 + 4 + 168) * 120 / 1000,
 		.hdisplay = 1600,
 		.hsync_start = 1600 + 200,
 		.hsync_end = 1600 + 200 + 40,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-novatek-nt36672e.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-novatek-nt36672e.c
@@ -0,0 +1,643 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <linux/delay.h>
+#include <linux/gpio/consumer.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/regulator/consumer.h>
+
+#include <drm/drm_mipi_dsi.h>
+#include <drm/drm_modes.h>
+#include <drm/drm_panel.h>
+
+#include <video/mipi_display.h>
+
+static const char * const regulator_names[] = {
+	"vddi",
+	"avdd",
+	"avee",
+};
+
+static const unsigned long regulator_enable_loads[] = {
+	62000,
+	100000,
+	100000,
+};
+
+static const unsigned long regulator_disable_loads[] = {
+	80,
+	100,
+	100,
+};
+
+struct panel_desc {
+	const struct drm_display_mode *display_mode;
+	u32 width_mm;
+	u32 height_mm;
+	unsigned long mode_flags;
+	enum mipi_dsi_pixel_format format;
+	unsigned int lanes;
+	const char *panel_name;
+	int (*init_sequence)(struct mipi_dsi_device *dsi);
+};
+
+struct nt36672e_panel {
+	struct drm_panel panel;
+	struct mipi_dsi_device *dsi;
+	struct gpio_desc *reset_gpio;
+	struct regulator_bulk_data supplies[3];
+	const struct panel_desc *desc;
+};
+
+static inline struct nt36672e_panel *to_nt36672e_panel(struct drm_panel *panel)
+{
+	return container_of(panel, struct nt36672e_panel, panel);
+}
+
+static int nt36672e_1080x2408_60hz_init(struct mipi_dsi_device *dsi)
+{
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x10);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0xb0, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xc0, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xc1, 0x89, 0x28, 0x00, 0x08, 0x00, 0xaa, 0x02,
+				0x0e, 0x00, 0x2b, 0x00, 0x07, 0x0d, 0xb7, 0x0c, 0xb7);
+
+	mipi_dsi_dcs_write_seq(dsi, 0xc2, 0x1b, 0xa0);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x20);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x01, 0x66);
+	mipi_dsi_dcs_write_seq(dsi, 0x06, 0x40);
+	mipi_dsi_dcs_write_seq(dsi, 0x07, 0x38);
+	mipi_dsi_dcs_write_seq(dsi, 0x2f, 0x83);
+	mipi_dsi_dcs_write_seq(dsi, 0x69, 0x91);
+	mipi_dsi_dcs_write_seq(dsi, 0x95, 0xd1);
+	mipi_dsi_dcs_write_seq(dsi, 0x96, 0xd1);
+	mipi_dsi_dcs_write_seq(dsi, 0xf2, 0x64);
+	mipi_dsi_dcs_write_seq(dsi, 0xf3, 0x54);
+	mipi_dsi_dcs_write_seq(dsi, 0xf4, 0x64);
+	mipi_dsi_dcs_write_seq(dsi, 0xf5, 0x54);
+	mipi_dsi_dcs_write_seq(dsi, 0xf6, 0x64);
+	mipi_dsi_dcs_write_seq(dsi, 0xf7, 0x54);
+	mipi_dsi_dcs_write_seq(dsi, 0xf8, 0x64);
+	mipi_dsi_dcs_write_seq(dsi, 0xf9, 0x54);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x24);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x01, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0x03, 0x0c);
+	mipi_dsi_dcs_write_seq(dsi, 0x05, 0x1d);
+	mipi_dsi_dcs_write_seq(dsi, 0x08, 0x2f);
+	mipi_dsi_dcs_write_seq(dsi, 0x09, 0x2e);
+	mipi_dsi_dcs_write_seq(dsi, 0x0a, 0x2d);
+	mipi_dsi_dcs_write_seq(dsi, 0x0b, 0x2c);
+	mipi_dsi_dcs_write_seq(dsi, 0x11, 0x17);
+	mipi_dsi_dcs_write_seq(dsi, 0x12, 0x13);
+	mipi_dsi_dcs_write_seq(dsi, 0x13, 0x15);
+	mipi_dsi_dcs_write_seq(dsi, 0x15, 0x14);
+	mipi_dsi_dcs_write_seq(dsi, 0x16, 0x16);
+	mipi_dsi_dcs_write_seq(dsi, 0x17, 0x18);
+	mipi_dsi_dcs_write_seq(dsi, 0x1b, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x1d, 0x1d);
+	mipi_dsi_dcs_write_seq(dsi, 0x20, 0x2f);
+	mipi_dsi_dcs_write_seq(dsi, 0x21, 0x2e);
+	mipi_dsi_dcs_write_seq(dsi, 0x22, 0x2d);
+	mipi_dsi_dcs_write_seq(dsi, 0x23, 0x2c);
+	mipi_dsi_dcs_write_seq(dsi, 0x29, 0x17);
+	mipi_dsi_dcs_write_seq(dsi, 0x2a, 0x13);
+	mipi_dsi_dcs_write_seq(dsi, 0x2b, 0x15);
+	mipi_dsi_dcs_write_seq(dsi, 0x2f, 0x14);
+	mipi_dsi_dcs_write_seq(dsi, 0x30, 0x16);
+	mipi_dsi_dcs_write_seq(dsi, 0x31, 0x18);
+	mipi_dsi_dcs_write_seq(dsi, 0x32, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0x34, 0x10);
+	mipi_dsi_dcs_write_seq(dsi, 0x35, 0x1f);
+	mipi_dsi_dcs_write_seq(dsi, 0x36, 0x1f);
+	mipi_dsi_dcs_write_seq(dsi, 0x4d, 0x14);
+	mipi_dsi_dcs_write_seq(dsi, 0x4e, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0x4f, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0x53, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0x71, 0x30);
+	mipi_dsi_dcs_write_seq(dsi, 0x79, 0x11);
+	mipi_dsi_dcs_write_seq(dsi, 0x7a, 0x82);
+	mipi_dsi_dcs_write_seq(dsi, 0x7b, 0x8f);
+	mipi_dsi_dcs_write_seq(dsi, 0x7d, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0x80, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0x81, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0x82, 0x13);
+	mipi_dsi_dcs_write_seq(dsi, 0x84, 0x31);
+	mipi_dsi_dcs_write_seq(dsi, 0x85, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x86, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x87, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x90, 0x13);
+	mipi_dsi_dcs_write_seq(dsi, 0x92, 0x31);
+	mipi_dsi_dcs_write_seq(dsi, 0x93, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x94, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x95, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x9c, 0xf4);
+	mipi_dsi_dcs_write_seq(dsi, 0x9d, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0xa0, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0xa2, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0xa3, 0x02);
+	mipi_dsi_dcs_write_seq(dsi, 0xa4, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0xa5, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0xc6, 0xc0);
+	mipi_dsi_dcs_write_seq(dsi, 0xc9, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xd9, 0x80);
+	mipi_dsi_dcs_write_seq(dsi, 0xe9, 0x02);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x25);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x18, 0x22);
+	mipi_dsi_dcs_write_seq(dsi, 0x19, 0xe4);
+	mipi_dsi_dcs_write_seq(dsi, 0x21, 0x40);
+	mipi_dsi_dcs_write_seq(dsi, 0x66, 0xd8);
+	mipi_dsi_dcs_write_seq(dsi, 0x68, 0x50);
+	mipi_dsi_dcs_write_seq(dsi, 0x69, 0x10);
+	mipi_dsi_dcs_write_seq(dsi, 0x6b, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x6d, 0x0d);
+	mipi_dsi_dcs_write_seq(dsi, 0x6e, 0x48);
+	mipi_dsi_dcs_write_seq(dsi, 0x72, 0x41);
+	mipi_dsi_dcs_write_seq(dsi, 0x73, 0x4a);
+	mipi_dsi_dcs_write_seq(dsi, 0x74, 0xd0);
+	mipi_dsi_dcs_write_seq(dsi, 0x77, 0x62);
+	mipi_dsi_dcs_write_seq(dsi, 0x79, 0x7e);
+	mipi_dsi_dcs_write_seq(dsi, 0x7d, 0x03);
+	mipi_dsi_dcs_write_seq(dsi, 0x7e, 0x15);
+	mipi_dsi_dcs_write_seq(dsi, 0x7f, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x84, 0x4d);
+	mipi_dsi_dcs_write_seq(dsi, 0xcf, 0x80);
+	mipi_dsi_dcs_write_seq(dsi, 0xd6, 0x80);
+	mipi_dsi_dcs_write_seq(dsi, 0xd7, 0x80);
+	mipi_dsi_dcs_write_seq(dsi, 0xef, 0x20);
+	mipi_dsi_dcs_write_seq(dsi, 0xf0, 0x84);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x26);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x81, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0x83, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x84, 0x03);
+	mipi_dsi_dcs_write_seq(dsi, 0x85, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x86, 0x03);
+	mipi_dsi_dcs_write_seq(dsi, 0x87, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x88, 0x05);
+	mipi_dsi_dcs_write_seq(dsi, 0x8a, 0x1a);
+	mipi_dsi_dcs_write_seq(dsi, 0x8b, 0x11);
+	mipi_dsi_dcs_write_seq(dsi, 0x8c, 0x24);
+	mipi_dsi_dcs_write_seq(dsi, 0x8e, 0x42);
+	mipi_dsi_dcs_write_seq(dsi, 0x8f, 0x11);
+	mipi_dsi_dcs_write_seq(dsi, 0x90, 0x11);
+	mipi_dsi_dcs_write_seq(dsi, 0x91, 0x11);
+	mipi_dsi_dcs_write_seq(dsi, 0x9a, 0x80);
+	mipi_dsi_dcs_write_seq(dsi, 0x9b, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0x9c, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x9d, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x9e, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x27);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x01, 0x68);
+	mipi_dsi_dcs_write_seq(dsi, 0x20, 0x81);
+	mipi_dsi_dcs_write_seq(dsi, 0x21, 0x6a);
+	mipi_dsi_dcs_write_seq(dsi, 0x25, 0x81);
+	mipi_dsi_dcs_write_seq(dsi, 0x26, 0x94);
+	mipi_dsi_dcs_write_seq(dsi, 0x6e, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x6f, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x70, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x71, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x72, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x75, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x76, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x77, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0x7d, 0x09);
+	mipi_dsi_dcs_write_seq(dsi, 0x7e, 0x67);
+	mipi_dsi_dcs_write_seq(dsi, 0x80, 0x23);
+	mipi_dsi_dcs_write_seq(dsi, 0x82, 0x09);
+	mipi_dsi_dcs_write_seq(dsi, 0x83, 0x67);
+	mipi_dsi_dcs_write_seq(dsi, 0x88, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x89, 0x10);
+	mipi_dsi_dcs_write_seq(dsi, 0xa5, 0x10);
+	mipi_dsi_dcs_write_seq(dsi, 0xa6, 0x23);
+	mipi_dsi_dcs_write_seq(dsi, 0xa7, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0xb6, 0x40);
+	mipi_dsi_dcs_write_seq(dsi, 0xe5, 0x02);
+	mipi_dsi_dcs_write_seq(dsi, 0xe6, 0xd3);
+	mipi_dsi_dcs_write_seq(dsi, 0xeb, 0x03);
+	mipi_dsi_dcs_write_seq(dsi, 0xec, 0x28);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x2a);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x00, 0x91);
+	mipi_dsi_dcs_write_seq(dsi, 0x03, 0x20);
+	mipi_dsi_dcs_write_seq(dsi, 0x07, 0x50);
+	mipi_dsi_dcs_write_seq(dsi, 0x0a, 0x70);
+	mipi_dsi_dcs_write_seq(dsi, 0x0c, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0x0d, 0x40);
+	mipi_dsi_dcs_write_seq(dsi, 0x0f, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x11, 0xe0);
+	mipi_dsi_dcs_write_seq(dsi, 0x15, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0x16, 0xa4);
+	mipi_dsi_dcs_write_seq(dsi, 0x19, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0x1a, 0x78);
+	mipi_dsi_dcs_write_seq(dsi, 0x1b, 0x23);
+	mipi_dsi_dcs_write_seq(dsi, 0x1d, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0x1e, 0x3e);
+	mipi_dsi_dcs_write_seq(dsi, 0x1f, 0x3e);
+	mipi_dsi_dcs_write_seq(dsi, 0x20, 0x3e);
+	mipi_dsi_dcs_write_seq(dsi, 0x28, 0xfd);
+	mipi_dsi_dcs_write_seq(dsi, 0x29, 0x12);
+	mipi_dsi_dcs_write_seq(dsi, 0x2a, 0xe1);
+	mipi_dsi_dcs_write_seq(dsi, 0x2d, 0x0a);
+	mipi_dsi_dcs_write_seq(dsi, 0x30, 0x49);
+	mipi_dsi_dcs_write_seq(dsi, 0x33, 0x96);
+	mipi_dsi_dcs_write_seq(dsi, 0x34, 0xff);
+	mipi_dsi_dcs_write_seq(dsi, 0x35, 0x40);
+	mipi_dsi_dcs_write_seq(dsi, 0x36, 0xde);
+	mipi_dsi_dcs_write_seq(dsi, 0x37, 0xf9);
+	mipi_dsi_dcs_write_seq(dsi, 0x38, 0x45);
+	mipi_dsi_dcs_write_seq(dsi, 0x39, 0xd9);
+	mipi_dsi_dcs_write_seq(dsi, 0x3a, 0x49);
+	mipi_dsi_dcs_write_seq(dsi, 0x4a, 0xf0);
+	mipi_dsi_dcs_write_seq(dsi, 0x7a, 0x09);
+	mipi_dsi_dcs_write_seq(dsi, 0x7b, 0x40);
+	mipi_dsi_dcs_write_seq(dsi, 0x7f, 0xf0);
+	mipi_dsi_dcs_write_seq(dsi, 0x83, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0x84, 0xa4);
+	mipi_dsi_dcs_write_seq(dsi, 0x87, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0x88, 0x78);
+	mipi_dsi_dcs_write_seq(dsi, 0x89, 0x23);
+	mipi_dsi_dcs_write_seq(dsi, 0x8b, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0x8c, 0x7d);
+	mipi_dsi_dcs_write_seq(dsi, 0x8d, 0x7d);
+	mipi_dsi_dcs_write_seq(dsi, 0x8e, 0x7d);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x20);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0xb0, 0x00, 0x00, 0x00, 0x17, 0x00, 0x49, 0x00,
+				0x6a, 0x00, 0x89, 0x00, 0x9f, 0x00, 0xb6, 0x00, 0xc8);
+	mipi_dsi_dcs_write_seq(dsi, 0xb1, 0x00, 0xd9, 0x01, 0x10, 0x01, 0x3a, 0x01,
+				0x7a, 0x01, 0xa9, 0x01, 0xf2, 0x02, 0x2d, 0x02, 0x2e);
+	mipi_dsi_dcs_write_seq(dsi, 0xb2, 0x02, 0x64, 0x02, 0xa3, 0x02, 0xca, 0x03,
+				0x00, 0x03, 0x1e, 0x03, 0x4a, 0x03, 0x59, 0x03, 0x6a);
+	mipi_dsi_dcs_write_seq(dsi, 0xb3, 0x03, 0x7d, 0x03, 0x93, 0x03, 0xab, 0x03,
+				0xc8, 0x03, 0xec, 0x03, 0xfe, 0x00, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xb4, 0x00, 0x00, 0x00, 0x1b, 0x00, 0x51, 0x00,
+				0x71, 0x00, 0x90, 0x00, 0xa7, 0x00, 0xbf, 0x00, 0xd1);
+	mipi_dsi_dcs_write_seq(dsi, 0xb5, 0x00, 0xe2, 0x01, 0x1a, 0x01, 0x43, 0x01,
+				0x83, 0x01, 0xb2, 0x01, 0xfa, 0x02, 0x34, 0x02, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0xb6, 0x02, 0x6b, 0x02, 0xa8, 0x02, 0xd0, 0x03,
+				0x03, 0x03, 0x21, 0x03, 0x4d, 0x03, 0x5b, 0x03, 0x6b);
+	mipi_dsi_dcs_write_seq(dsi, 0xb7, 0x03, 0x7e, 0x03, 0x94, 0x03, 0xac, 0x03,
+				0xc8, 0x03, 0xec, 0x03, 0xfe, 0x00, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xb8, 0x00, 0x00, 0x00, 0x1b, 0x00, 0x51, 0x00,
+				0x72, 0x00, 0x92, 0x00, 0xa8, 0x00, 0xbf, 0x00, 0xd1);
+	mipi_dsi_dcs_write_seq(dsi, 0xb9, 0x00, 0xe2, 0x01, 0x18, 0x01, 0x42, 0x01,
+				0x81, 0x01, 0xaf, 0x01, 0xf5, 0x02, 0x2f, 0x02, 0x31);
+	mipi_dsi_dcs_write_seq(dsi, 0xba, 0x02, 0x68, 0x02, 0xa6, 0x02, 0xcd, 0x03,
+				0x01, 0x03, 0x1f, 0x03, 0x4a, 0x03, 0x59, 0x03, 0x6a);
+	mipi_dsi_dcs_write_seq(dsi, 0xbb, 0x03, 0x7d, 0x03, 0x93, 0x03, 0xab, 0x03,
+				0xc8, 0x03, 0xec, 0x03, 0xfe, 0x00, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x21);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0xb0, 0x00, 0x00, 0x00, 0x17, 0x00, 0x49, 0x00,
+				0x6a, 0x00, 0x89, 0x00, 0x9f, 0x00, 0xb6, 0x00, 0xc8);
+	mipi_dsi_dcs_write_seq(dsi, 0xb1, 0x00, 0xd9, 0x01, 0x10, 0x01, 0x3a, 0x01,
+				0x7a, 0x01, 0xa9, 0x01, 0xf2, 0x02, 0x2d, 0x02, 0x2e);
+	mipi_dsi_dcs_write_seq(dsi, 0xb2, 0x02, 0x64, 0x02, 0xa3, 0x02, 0xca, 0x03,
+				0x00, 0x03, 0x1e, 0x03, 0x4a, 0x03, 0x59, 0x03, 0x6a);
+	mipi_dsi_dcs_write_seq(dsi, 0xb3, 0x03, 0x7d, 0x03, 0x93, 0x03, 0xab, 0x03,
+				0xc8, 0x03, 0xec, 0x03, 0xfe, 0x00, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xb4, 0x00, 0x00, 0x00, 0x1b, 0x00, 0x51, 0x00,
+				0x71, 0x00, 0x90, 0x00, 0xa7, 0x00, 0xbf, 0x00, 0xd1);
+	mipi_dsi_dcs_write_seq(dsi, 0xb5, 0x00, 0xe2, 0x01, 0x1a, 0x01, 0x43, 0x01,
+				0x83, 0x01, 0xb2, 0x01, 0xfa, 0x02, 0x34, 0x02, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0xb6, 0x02, 0x6b, 0x02, 0xa8, 0x02, 0xd0, 0x03,
+				0x03, 0x03, 0x21, 0x03, 0x4d, 0x03, 0x5b, 0x03, 0x6b);
+	mipi_dsi_dcs_write_seq(dsi, 0xb7, 0x03, 0x7e, 0x03, 0x94, 0x03, 0xac, 0x03,
+				0xc8, 0x03, 0xec, 0x03, 0xfe, 0x00, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xb8, 0x00, 0x00, 0x00, 0x1b, 0x00, 0x51, 0x00,
+				0x72, 0x00, 0x92, 0x00, 0xa8, 0x00, 0xbf, 0x00, 0xd1);
+	mipi_dsi_dcs_write_seq(dsi, 0xb9, 0x00, 0xe2, 0x01, 0x18, 0x01, 0x42, 0x01,
+				0x81, 0x01, 0xaf, 0x01, 0xf5, 0x02, 0x2f, 0x02, 0x31);
+	mipi_dsi_dcs_write_seq(dsi, 0xba, 0x02, 0x68, 0x02, 0xa6, 0x02, 0xcd, 0x03,
+				0x01, 0x03, 0x1f, 0x03, 0x4a, 0x03, 0x59, 0x03, 0x6a);
+	mipi_dsi_dcs_write_seq(dsi, 0xbb, 0x03, 0x7d, 0x03, 0x93, 0x03, 0xab, 0x03,
+				0xc8, 0x03, 0xec, 0x03, 0xfe, 0x00, 0x00);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x2c);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x61, 0x1f);
+	mipi_dsi_dcs_write_seq(dsi, 0x62, 0x1f);
+	mipi_dsi_dcs_write_seq(dsi, 0x7e, 0x03);
+	mipi_dsi_dcs_write_seq(dsi, 0x6a, 0x14);
+	mipi_dsi_dcs_write_seq(dsi, 0x6b, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0x6c, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0x6d, 0x36);
+	mipi_dsi_dcs_write_seq(dsi, 0x53, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0x54, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0x55, 0x04);
+	mipi_dsi_dcs_write_seq(dsi, 0x56, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0x58, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0x59, 0x0f);
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0xf0);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x5a, 0x00);
+
+	mipi_dsi_dcs_write_seq(dsi, 0xff, 0x10);
+	mipi_dsi_dcs_write_seq(dsi, 0xfb, 0x01);
+	mipi_dsi_dcs_write_seq(dsi, 0x51, 0xff);
+	mipi_dsi_dcs_write_seq(dsi, 0x53, 0x24);
+	mipi_dsi_dcs_write_seq(dsi, 0x55, 0x01);
+
+	return 0;
+}
+
+static int nt36672e_power_on(struct nt36672e_panel *ctx)
+{
+	struct mipi_dsi_device *dsi = ctx->dsi;
+	int ret, i;
+
+	for (i = 0; i < ARRAY_SIZE(ctx->supplies); i++) {
+		ret = regulator_set_load(ctx->supplies[i].consumer,
+				regulator_enable_loads[i]);
+		if (ret) {
+			dev_err(&dsi->dev, "regulator set load failed for supply %s: %d\n",
+				ctx->supplies[i].supply, ret);
+			return ret;
+		}
+	}
+
+	ret = regulator_bulk_enable(ARRAY_SIZE(ctx->supplies), ctx->supplies);
+	if (ret < 0) {
+		dev_err(&dsi->dev, "regulator bulk enable failed: %d\n", ret);
+		return ret;
+	}
+
+	/*
+	 * Reset sequence of nt36672e panel requires the panel to be out of reset
+	 * for 10ms, followed by being held in reset for 10ms and then out again.
+	 */
+	gpiod_set_value(ctx->reset_gpio, 1);
+	usleep_range(10000, 20000);
+	gpiod_set_value(ctx->reset_gpio, 0);
+	usleep_range(10000, 20000);
+	gpiod_set_value(ctx->reset_gpio, 1);
+	usleep_range(10000, 20000);
+
+	return 0;
+}
+
+static int nt36672e_power_off(struct nt36672e_panel *ctx)
+{
+	struct mipi_dsi_device *dsi = ctx->dsi;
+	int ret = 0;
+	int i;
+
+	gpiod_set_value(ctx->reset_gpio, 0);
+
+	for (i = 0; i < ARRAY_SIZE(ctx->supplies); i++) {
+		ret = regulator_set_load(ctx->supplies[i].consumer,
+				regulator_disable_loads[i]);
+		if (ret) {
+			dev_err(&dsi->dev, "regulator set load failed for supply %s: %d\n",
+				ctx->supplies[i].supply, ret);
+			return ret;
+		}
+	}
+
+	ret = regulator_bulk_disable(ARRAY_SIZE(ctx->supplies), ctx->supplies);
+	if (ret)
+		dev_err(&dsi->dev, "regulator bulk disable failed: %d\n", ret);
+
+	return ret;
+}
+
+static int nt36672e_on(struct nt36672e_panel *ctx)
+{
+	struct mipi_dsi_device *dsi = ctx->dsi;
+	const struct panel_desc *desc = ctx->desc;
+	int ret = 0;
+
+	dsi->mode_flags |= MIPI_DSI_MODE_LPM;
+
+	if (desc->init_sequence) {
+		ret = desc->init_sequence(dsi);
+		if (ret < 0) {
+			dev_err(&dsi->dev, "panel init sequence failed: %d\n", ret);
+			return ret;
+		}
+	}
+
+	ret = mipi_dsi_dcs_exit_sleep_mode(dsi);
+	if (ret < 0) {
+		dev_err(&dsi->dev, "Failed to exit sleep mode: %d\n", ret);
+		return ret;
+	}
+	msleep(120);
+
+	ret = mipi_dsi_dcs_set_display_on(dsi);
+	if (ret < 0) {
+		dev_err(&dsi->dev, "Failed to set display on: %d\n", ret);
+		return ret;
+	}
+	msleep(100);
+
+	return 0;
+}
+
+static int nt36672e_off(struct nt36672e_panel *ctx)
+{
+	struct mipi_dsi_device *dsi = ctx->dsi;
+	int ret = 0;
+
+	dsi->mode_flags &= ~MIPI_DSI_MODE_LPM;
+
+	ret = mipi_dsi_dcs_set_display_off(dsi);
+	if (ret < 0) {
+		dev_err(&dsi->dev, "Failed to set display off: %d\n", ret);
+		return ret;
+	}
+	msleep(20);
+
+	ret = mipi_dsi_dcs_enter_sleep_mode(dsi);
+	if (ret < 0) {
+		dev_err(&dsi->dev, "Failed to enter sleep mode: %d\n", ret);
+		return ret;
+	}
+	msleep(60);
+
+	return 0;
+}
+
+static int nt36672e_panel_prepare(struct drm_panel *panel)
+{
+	struct nt36672e_panel *ctx = to_nt36672e_panel(panel);
+	struct mipi_dsi_device *dsi = ctx->dsi;
+	int ret = 0;
+
+	ret = nt36672e_power_on(ctx);
+	if (ret < 0)
+		return ret;
+
+	ret = nt36672e_on(ctx);
+	if (ret < 0) {
+		dev_err(&dsi->dev, "Failed to initialize panel: %d\n", ret);
+		if (nt36672e_power_off(ctx))
+			dev_err(&dsi->dev, "power off failed\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+static int nt36672e_panel_unprepare(struct drm_panel *panel)
+{
+	struct nt36672e_panel *ctx = to_nt36672e_panel(panel);
+	struct mipi_dsi_device *dsi = ctx->dsi;
+	int ret = 0;
+
+	ret = nt36672e_off(ctx);
+	if (ret < 0)
+		dev_err(&dsi->dev, "Failed to un-initialize panel: %d\n", ret);
+
+	ret = nt36672e_power_off(ctx);
+	if (ret < 0)
+		dev_err(&dsi->dev, "power off failed: %d\n", ret);
+
+	return 0;
+}
+
+static const struct drm_display_mode nt36672e_1080x2408_60hz = {
+	.name = "1080x2408",
+	.clock = 181690,
+	.hdisplay = 1080,
+	.hsync_start = 1080 + 76,
+	.hsync_end = 1080 + 76 + 12,
+	.htotal = 1080 + 76 + 12 + 56,
+	.vdisplay = 2408,
+	.vsync_start = 2408 + 46,
+	.vsync_end = 2408 + 46 + 10,
+	.vtotal = 2408 + 46 + 10 + 10,
+	.flags = 0,
+};
+
+static const struct panel_desc nt36672e_panel_desc = {
+	.display_mode = &nt36672e_1080x2408_60hz,
+	.width_mm = 74,
+	.height_mm = 131,
+	.mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_LPM | MIPI_DSI_CLOCK_NON_CONTINUOUS,
+	.format = MIPI_DSI_FMT_RGB888,
+	.lanes = 4,
+	.panel_name = "nt36672e fhd plus panel",
+	.init_sequence = nt36672e_1080x2408_60hz_init,
+};
+
+static int nt36672e_panel_get_modes(struct drm_panel *panel, struct drm_connector *connector)
+{
+	struct nt36672e_panel *ctx = to_nt36672e_panel(panel);
+	struct drm_display_mode *mode;
+
+	mode = drm_mode_duplicate(connector->dev, ctx->desc->display_mode);
+	if (!mode)
+		return -ENOMEM;
+
+	drm_mode_set_name(mode);
+
+	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
+	connector->display_info.width_mm = ctx->desc->width_mm;
+	connector->display_info.height_mm = ctx->desc->height_mm;
+	drm_mode_probed_add(connector, mode);
+
+	return 1;
+}
+
+static const struct drm_panel_funcs nt36672e_drm_funcs = {
+	.prepare = nt36672e_panel_prepare,
+	.unprepare = nt36672e_panel_unprepare,
+	.get_modes = nt36672e_panel_get_modes,
+};
+
+static int nt36672e_panel_probe(struct mipi_dsi_device *dsi)
+{
+	struct device *dev = &dsi->dev;
+	struct nt36672e_panel *ctx;
+	int i, ret = 0;
+
+	ctx = devm_kzalloc(dev, sizeof(*ctx), GFP_KERNEL);
+	if (!ctx)
+		return -ENOMEM;
+
+	ctx->desc = of_device_get_match_data(dev);
+	if (!ctx->desc) {
+		dev_err(dev, "missing device configuration\n");
+		return -ENODEV;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(ctx->supplies); i++)
+		ctx->supplies[i].supply = regulator_names[i];
+
+	ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(ctx->supplies),
+			ctx->supplies);
+	if (ret < 0)
+		return ret;
+
+	ctx->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);
+	if (IS_ERR(ctx->reset_gpio))
+		return dev_err_probe(dev, PTR_ERR(ctx->reset_gpio), "Failed to get reset-gpios\n");
+
+	ctx->dsi = dsi;
+	mipi_dsi_set_drvdata(dsi, ctx);
+
+	dsi->lanes = ctx->desc->lanes;
+	dsi->format = ctx->desc->format;
+	dsi->mode_flags = ctx->desc->mode_flags;
+
+	drm_panel_init(&ctx->panel, dev, &nt36672e_drm_funcs, DRM_MODE_CONNECTOR_DSI);
+
+	ret = drm_panel_of_backlight(&ctx->panel);
+	if (ret)
+		return dev_err_probe(dev, ret, "Failed to get backlight\n");
+
+	ctx->panel.prepare_prev_first = true;
+
+	drm_panel_add(&ctx->panel);
+
+	ret = mipi_dsi_attach(dsi);
+	if (ret < 0) {
+		dev_err(dev, "Failed to attach to DSI host: %d\n", ret);
+		goto err_dsi_attach;
+	}
+
+	return 0;
+
+err_dsi_attach:
+	drm_panel_remove(&ctx->panel);
+	return ret;
+}
+
+static void nt36672e_panel_remove(struct mipi_dsi_device *dsi)
+{
+	struct nt36672e_panel *ctx = mipi_dsi_get_drvdata(dsi);
+
+	mipi_dsi_detach(ctx->dsi);
+	mipi_dsi_device_unregister(ctx->dsi);
+
+	drm_panel_remove(&ctx->panel);
+}
+
+static const struct of_device_id nt36672e_of_match[] = {
+	{
+		.compatible = "novatek,nt36672e",
+		.data = &nt36672e_panel_desc,
+	},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, nt36672e_of_match);
+
+static struct mipi_dsi_driver nt36672e_panel_driver = {
+	.driver = {
+		.name = "panel-novatek-nt36672e",
+		.of_match_table = nt36672e_of_match,
+	},
+	.probe = nt36672e_panel_probe,
+	.remove = nt36672e_panel_remove,
+};
+module_mipi_dsi_driver(nt36672e_panel_driver);
+
+MODULE_AUTHOR("Ritesh Kumar <quic_riteshk@quicinc.com>");
+MODULE_DESCRIPTION("Novatek NT36672E DSI Panel Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-samsung-atna33xc20.c
@@ -72,6 +72,7 @@
 	if (p->el3_was_on)
 		atana33xc20_wait(p->el_on3_off_time, 150);
 
+	drm_dp_dpcd_set_powered(p->aux, false);
 	ret = regulator_disable(p->supply);
 	if (ret)
 		return ret;
@@ -93,6 +94,7 @@
 	ret = regulator_enable(p->supply);
 	if (ret)
 		return ret;
+	drm_dp_dpcd_set_powered(p->aux, true);
 	p->powered_on_time = ktime_get_boottime();
 
 	if (p->no_hpd) {
@@ -107,19 +109,17 @@
 		if (hpd_asserted < 0)
 			ret = hpd_asserted;
 
-		if (ret)
+		if (ret) {
 			dev_warn(dev, "Error waiting for HPD GPIO: %d\n", ret);
-
-		return ret;
-	}
-
-	if (p->aux->wait_hpd_asserted) {
+			goto error;
+		}
+	} else if (p->aux->wait_hpd_asserted) {
 		ret = p->aux->wait_hpd_asserted(p->aux, HPD_MAX_US);
 
-		if (ret)
+		if (ret) {
 			dev_warn(dev, "Controller error waiting for HPD: %d\n", ret);
-
-		return ret;
+			goto error;
+		}
 	}
 
 	/*
@@ -131,6 +131,12 @@
 	 * right times.
 	 */
 	return 0;
+
+error:
+	drm_dp_dpcd_set_powered(p->aux, false);
+	regulator_disable(p->supply);
+
+	return ret;
 }
 
 static int atana33xc20_disable(struct drm_panel *panel)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-simple.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-simple.c
@@ -1367,6 +1367,23 @@
 	.vtotal = 800 + 6 + 8 + 2,
 };
 
+static const struct panel_desc boe_bp082wx1_100 = {
+	.modes = &boe_bp101wx1_100_mode,
+	.num_modes = 1,
+	.bpc = 8,
+	.size = {
+		.width = 177,
+		.height = 110,
+	},
+	.delay = {
+		.enable = 50,
+		.disable = 50,
+	},
+	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA,
+	.bus_flags = DRM_BUS_FLAG_DE_HIGH,
+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
+};
+
 static const struct panel_desc boe_bp101wx1_100 = {
 	.modes = &boe_bp101wx1_100_mode,
 	.num_modes = 1,
@@ -2547,6 +2564,9 @@
 		.unprepare = 200,
 		.disable = 400,
 	},
+	.bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG,
+	.bus_flags = DRM_BUS_FLAG_DE_HIGH,
+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
 };
 
 static const struct display_timing innolux_g156hce_l01_timings = {
@@ -2660,6 +2680,7 @@
 	.vfront_porch = { 3, 5, 10 },
 	.vback_porch = { 2, 5, 10 },
 	.vsync_len = { 5, 5, 5 },
+	.flags = DISPLAY_FLAGS_DE_HIGH,
 };
 
 static const struct panel_desc koe_tx26d202vm0bwa = {
@@ -4249,6 +4270,31 @@
 	.connector_type = DRM_MODE_CONNECTOR_LVDS,
 };
 
+static const struct drm_display_mode mchp_ac69t88a_mode = {
+	.clock = 25000,
+	.hdisplay = 800,
+	.hsync_start = 800 + 88,
+	.hsync_end = 800 + 88 + 5,
+	.htotal = 800 + 88 + 5 + 40,
+	.vdisplay = 480,
+	.vsync_start = 480 + 23,
+	.vsync_end = 480 + 23 + 5,
+	.vtotal = 480 + 23 + 5 + 1,
+};
+
+static const struct panel_desc mchp_ac69t88a = {
+	.modes = &mchp_ac69t88a_mode,
+	.num_modes = 1,
+	.bpc = 8,
+	.size = {
+		.width = 108,
+		.height = 65,
+	},
+	.bus_flags = DRM_BUS_FLAG_DE_HIGH,
+	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA,
+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
+};
+
 static const struct drm_display_mode arm_rtsm_mode[] = {
 	{
 		.clock = 65000,
@@ -4346,6 +4392,9 @@
 		.compatible = "bananapi,s070wv20-ct16",
 		.data = &bananapi_s070wv20_ct16,
 	}, {
+		.compatible = "boe,bp082wx1-100",
+		.data = &boe_bp082wx1_100,
+	}, {
 		.compatible = "boe,bp101wx1-100",
 		.data = &boe_bp101wx1_100,
 	}, {
@@ -4697,6 +4746,9 @@
 		.compatible = "yes-optoelectronics,ytc700tlag-05-201c",
 		.data = &yes_optoelectronics_ytc700tlag_05_201c,
 	}, {
+		.compatible = "microchip,ac69t88a",
+		.data = &mchp_ac69t88a,
+	}, {
 		/* Must be the last entry */
 		.compatible = "panel-dpi",
 		.data = &panel_dpi,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-sitronix-st7701.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-sitronix-st7701.c
@@ -1010,6 +1010,7 @@
 
 	drm_panel_init(&st7701->panel, &dsi->dev, &st7701_funcs,
 		       DRM_MODE_CONNECTOR_DSI);
+	st7701->panel.prepare_prev_first = true;
 
 	/**
 	 * Once sleep out has been issued, ST7701 IC required to wait 120ms
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
@@ -282,15 +282,15 @@
 static const struct drm_display_mode jt240mhqs_hwt_ek_e3_mode = {
 	.clock = 6000,
 	.hdisplay = 240,
-	.hsync_start = 240 + 28,
-	.hsync_end = 240 + 28 + 10,
-	.htotal = 240 + 28 + 10 + 10,
+	.hsync_start = 240 + 38,
+	.hsync_end = 240 + 38 + 10,
+	.htotal = 240 + 38 + 10 + 10,
 	.vdisplay = 280,
-	.vsync_start = 280 + 8,
-	.vsync_end = 280 + 8 + 4,
-	.vtotal = 280 + 8 + 4 + 4,
-	.width_mm = 43,
-	.height_mm = 37,
+	.vsync_start = 280 + 48,
+	.vsync_end = 280 + 48 + 4,
+	.vtotal = 280 + 48 + 4 + 4,
+	.width_mm = 37,
+	.height_mm = 43,
 	.flags = DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC,
 };
 
@@ -643,7 +643,9 @@
 	if (ret)
 		return dev_err_probe(dev, ret, "Failed to get backlight\n");
 
-	of_drm_get_panel_orientation(spi->dev.of_node, &ctx->orientation);
+	ret = of_drm_get_panel_orientation(spi->dev.of_node, &ctx->orientation);
+	if (ret)
+		return dev_err_probe(&spi->dev, ret, "Failed to get orientation\n");
 
 	drm_panel_add(&ctx->panel);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-synaptics-r63353.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-synaptics-r63353.c
@@ -325,7 +325,7 @@
 {
 	struct r63353_panel *rpanel = mipi_dsi_get_drvdata(dsi);
 
-	r63353_panel_unprepare(&rpanel->base);
+	drm_panel_unprepare(&rpanel->base);
 }
 
 static const struct r63353_desc sharp_ls068b3sx02_data = {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panel/panel-visionox-rm69299.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panel/panel-visionox-rm69299.c
@@ -253,8 +253,6 @@
 	struct visionox_rm69299 *ctx = mipi_dsi_get_drvdata(dsi);
 
 	mipi_dsi_detach(ctx->dsi);
-	mipi_dsi_device_unregister(ctx->dsi);
-
 	drm_panel_remove(&ctx->panel);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panfrost/panfrost_devfreq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panfrost/panfrost_devfreq.c
@@ -38,7 +38,7 @@
 		return PTR_ERR(opp);
 	dev_pm_opp_put(opp);
 
-	err =  dev_pm_opp_set_rate(dev, *freq);
+	err = dev_pm_opp_set_rate(dev, *freq);
 	if (!err)
 		ptdev->pfdevfreq.current_frequency = *freq;
 
@@ -182,6 +182,7 @@
 	 * if any and will avoid a switch off by regulator_late_cleanup()
 	 */
 	ret = dev_pm_opp_set_opp(dev, opp);
+	dev_pm_opp_put(opp);
 	if (ret) {
 		DRM_DEV_ERROR(dev, "Couldn't set recommended OPP\n");
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panfrost/panfrost_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panfrost/panfrost_drv.c
@@ -796,3 +796,4 @@
 MODULE_AUTHOR("Panfrost Project Developers");
 MODULE_DESCRIPTION("Panfrost DRM Driver");
 MODULE_LICENSE("GPL v2");
+MODULE_SOFTDEP("pre: governor_simpleondemand");
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panfrost/panfrost_gpu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panfrost/panfrost_gpu.c
@@ -177,7 +177,6 @@
 struct panfrost_model {
 	const char *name;
 	u32 id;
-	u32 id_mask;
 	u64 features;
 	u64 issues;
 	struct {
@@ -441,19 +440,19 @@
 
 	gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present);
 	ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_PWRTRANS_LO,
-					 val, !val, 1, 1000);
+					 val, !val, 1, 2000);
 	if (ret)
 		dev_err(pfdev->dev, "shader power transition timeout");
 
 	gpu_write(pfdev, TILER_PWROFF_LO, pfdev->features.tiler_present);
 	ret = readl_relaxed_poll_timeout(pfdev->iomem + TILER_PWRTRANS_LO,
-					 val, !val, 1, 1000);
+					 val, !val, 1, 2000);
 	if (ret)
 		dev_err(pfdev->dev, "tiler power transition timeout");
 
 	gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present);
 	ret = readl_poll_timeout(pfdev->iomem + L2_PWRTRANS_LO,
-				 val, !val, 0, 1000);
+				 val, !val, 0, 2000);
 	if (ret)
 		dev_err(pfdev->dev, "l2 power transition timeout");
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/panfrost/panfrost_mmu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/panfrost/panfrost_mmu.c
@@ -502,11 +502,18 @@
 	mapping_set_unevictable(mapping);
 
 	for (i = page_offset; i < page_offset + NUM_FAULT_PAGES; i++) {
+		/* Can happen if the last fault only partially filled this
+		 * section of the pages array before failing. In that case
+		 * we skip already filled pages.
+		 */
+		if (pages[i])
+			continue;
+
 		pages[i] = shmem_read_mapping_page(mapping, i);
 		if (IS_ERR(pages[i])) {
 			ret = PTR_ERR(pages[i]);
 			pages[i] = NULL;
-			goto err_pages;
+			goto err_unlock;
 		}
 	}
 
@@ -514,7 +521,7 @@
 	ret = sg_alloc_table_from_pages(sgt, pages + page_offset,
 					NUM_FAULT_PAGES, 0, SZ_2M, GFP_KERNEL);
 	if (ret)
-		goto err_pages;
+		goto err_unlock;
 
 	ret = dma_map_sgtable(pfdev->dev, sgt, DMA_BIDIRECTIONAL, 0);
 	if (ret)
@@ -537,8 +544,6 @@
 
 err_map:
 	sg_free_table(sgt);
-err_pages:
-	drm_gem_shmem_put_pages(&bo->base);
 err_unlock:
 	dma_resv_unlock(obj->resv);
 err_bo:
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/qxl/qxl_display.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/qxl/qxl_display.c
@@ -236,6 +236,9 @@
 		return 0;
 
 	mode = drm_cvt_mode(dev, width, height, 60, false, false, false);
+	if (!mode)
+		return 0;
+
 	if (preferred)
 		mode->type |= DRM_MODE_TYPE_PREFERRED;
 	mode->hdisplay = width;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/atombios_encoders.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -2179,7 +2179,7 @@
 void
 radeon_atom_encoder_init(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_encoder *encoder;
 
 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/cik.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/cik.c
@@ -7585,7 +7585,7 @@
 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
 
 				if (rdev->irq.crtc_vblank_int[0]) {
-					drm_handle_vblank(rdev->ddev, 0);
+					drm_handle_vblank(rdev_to_drm(rdev), 0);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -7615,7 +7615,7 @@
 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
 
 				if (rdev->irq.crtc_vblank_int[1]) {
-					drm_handle_vblank(rdev->ddev, 1);
+					drm_handle_vblank(rdev_to_drm(rdev), 1);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -7645,7 +7645,7 @@
 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
 
 				if (rdev->irq.crtc_vblank_int[2]) {
-					drm_handle_vblank(rdev->ddev, 2);
+					drm_handle_vblank(rdev_to_drm(rdev), 2);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -7675,7 +7675,7 @@
 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
 
 				if (rdev->irq.crtc_vblank_int[3]) {
-					drm_handle_vblank(rdev->ddev, 3);
+					drm_handle_vblank(rdev_to_drm(rdev), 3);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -7705,7 +7705,7 @@
 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
 
 				if (rdev->irq.crtc_vblank_int[4]) {
-					drm_handle_vblank(rdev->ddev, 4);
+					drm_handle_vblank(rdev_to_drm(rdev), 4);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -7735,7 +7735,7 @@
 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
 
 				if (rdev->irq.crtc_vblank_int[5]) {
-					drm_handle_vblank(rdev->ddev, 5);
+					drm_handle_vblank(rdev_to_drm(rdev), 5);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -8581,7 +8581,7 @@
 	/* Initialize surface registers */
 	radeon_surface_init(rdev);
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 
 	/* Fence driver */
 	radeon_fence_driver_init(rdev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/dce6_afmt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -91,7 +91,7 @@
 			pin = &rdev->audio.pin[i];
 			pin_count = 0;
 
-			list_for_each_entry(encoder, &rdev->ddev->mode_config.encoder_list, head) {
+			list_for_each_entry(encoder, &rdev_to_drm(rdev)->mode_config.encoder_list, head) {
 				if (radeon_encoder_is_digital(encoder)) {
 					radeon_encoder = to_radeon_encoder(encoder);
 					dig = radeon_encoder->enc_priv;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/evergreen.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/evergreen.c
@@ -1673,7 +1673,7 @@
  */
 void evergreen_pm_prepare(struct radeon_device *rdev)
 {
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 	u32 tmp;
@@ -1698,7 +1698,7 @@
  */
 void evergreen_pm_finish(struct radeon_device *rdev)
 {
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 	u32 tmp;
@@ -1763,7 +1763,7 @@
  */
 void evergreen_hpd_init(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_connector *connector;
 	unsigned enabled = 0;
 	u32 tmp = DC_HPDx_CONNECTION_TIMER(0x9c4) |
@@ -1804,7 +1804,7 @@
  */
 void evergreen_hpd_fini(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_connector *connector;
 	unsigned disabled = 0;
 
@@ -4757,7 +4757,7 @@
 				event_name = "vblank";
 
 				if (rdev->irq.crtc_vblank_int[crtc_idx]) {
-					drm_handle_vblank(rdev->ddev, crtc_idx);
+					drm_handle_vblank(rdev_to_drm(rdev), crtc_idx);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -5215,7 +5215,7 @@
 	/* Initialize surface registers */
 	radeon_surface_init(rdev);
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* Fence driver */
 	radeon_fence_driver_init(rdev);
 	/* initialize AGP */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/evergreen_cs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -395,7 +395,7 @@
 	struct evergreen_cs_track *track = p->track;
 	struct eg_surface surf;
 	unsigned pitch, slice, mslice;
-	unsigned long offset;
+	u64 offset;
 	int r;
 
 	mslice = G_028C6C_SLICE_MAX(track->cb_color_view[id]) + 1;
@@ -433,14 +433,14 @@
 		return r;
 	}
 
-	offset = track->cb_color_bo_offset[id] << 8;
+	offset = (u64)track->cb_color_bo_offset[id] << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d cb[%d] bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d cb[%d] bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, id, offset, surf.base_align);
 		return -EINVAL;
 	}
 
-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->cb_color_bo[id])) {
 		/* old ddx are broken they allocate bo with w*h*bpp but
 		 * program slice with ALIGN(h, 8), catch this and patch
@@ -448,14 +448,14 @@
 		 */
 		if (!surf.mode) {
 			uint32_t *ib = p->ib.ptr;
-			unsigned long tmp, nby, bsize, size, min = 0;
+			u64 tmp, nby, bsize, size, min = 0;
 
 			/* find the height the ddx wants */
 			if (surf.nby > 8) {
 				min = surf.nby - 8;
 			}
 			bsize = radeon_bo_size(track->cb_color_bo[id]);
-			tmp = track->cb_color_bo_offset[id] << 8;
+			tmp = (u64)track->cb_color_bo_offset[id] << 8;
 			for (nby = surf.nby; nby > min; nby--) {
 				size = nby * surf.nbx * surf.bpe * surf.nsamples;
 				if ((tmp + size * mslice) <= bsize) {
@@ -467,7 +467,7 @@
 				slice = ((nby * surf.nbx) / 64) - 1;
 				if (!evergreen_surface_check(p, &surf, "cb")) {
 					/* check if this one works */
-					tmp += surf.layer_size * mslice;
+					tmp += (u64)surf.layer_size * mslice;
 					if (tmp <= bsize) {
 						ib[track->cb_color_slice_idx[id]] = slice;
 						goto old_ddx_ok;
@@ -476,9 +476,9 @@
 			}
 		}
 		dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
-			 "offset %d, max layer %d, bo size %ld, slice %d)\n",
+			 "offset %llu, max layer %d, bo size %ld, slice %d)\n",
 			 __func__, __LINE__, id, surf.layer_size,
-			track->cb_color_bo_offset[id] << 8, mslice,
+			(u64)track->cb_color_bo_offset[id] << 8, mslice,
 			radeon_bo_size(track->cb_color_bo[id]), slice);
 		dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n",
 			 __func__, __LINE__, surf.nbx, surf.nby,
@@ -562,7 +562,7 @@
 	struct evergreen_cs_track *track = p->track;
 	struct eg_surface surf;
 	unsigned pitch, slice, mslice;
-	unsigned long offset;
+	u64 offset;
 	int r;
 
 	mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
@@ -608,18 +608,18 @@
 		return r;
 	}
 
-	offset = track->db_s_read_offset << 8;
+	offset = (u64)track->db_s_read_offset << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, offset, surf.base_align);
 		return -EINVAL;
 	}
-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->db_s_read_bo)) {
 		dev_warn(p->dev, "%s:%d stencil read bo too small (layer size %d, "
-			 "offset %ld, max layer %d, bo size %ld)\n",
+			 "offset %llu, max layer %d, bo size %ld)\n",
 			 __func__, __LINE__, surf.layer_size,
-			(unsigned long)track->db_s_read_offset << 8, mslice,
+			(u64)track->db_s_read_offset << 8, mslice,
 			radeon_bo_size(track->db_s_read_bo));
 		dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
 			 __func__, __LINE__, track->db_depth_size,
@@ -627,18 +627,18 @@
 		return -EINVAL;
 	}
 
-	offset = track->db_s_write_offset << 8;
+	offset = (u64)track->db_s_write_offset << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, offset, surf.base_align);
 		return -EINVAL;
 	}
-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->db_s_write_bo)) {
 		dev_warn(p->dev, "%s:%d stencil write bo too small (layer size %d, "
-			 "offset %ld, max layer %d, bo size %ld)\n",
+			 "offset %llu, max layer %d, bo size %ld)\n",
 			 __func__, __LINE__, surf.layer_size,
-			(unsigned long)track->db_s_write_offset << 8, mslice,
+			(u64)track->db_s_write_offset << 8, mslice,
 			radeon_bo_size(track->db_s_write_bo));
 		return -EINVAL;
 	}
@@ -659,7 +659,7 @@
 	struct evergreen_cs_track *track = p->track;
 	struct eg_surface surf;
 	unsigned pitch, slice, mslice;
-	unsigned long offset;
+	u64 offset;
 	int r;
 
 	mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
@@ -706,34 +706,34 @@
 		return r;
 	}
 
-	offset = track->db_z_read_offset << 8;
+	offset = (u64)track->db_z_read_offset << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, offset, surf.base_align);
 		return -EINVAL;
 	}
-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->db_z_read_bo)) {
 		dev_warn(p->dev, "%s:%d depth read bo too small (layer size %d, "
-			 "offset %ld, max layer %d, bo size %ld)\n",
+			 "offset %llu, max layer %d, bo size %ld)\n",
 			 __func__, __LINE__, surf.layer_size,
-			(unsigned long)track->db_z_read_offset << 8, mslice,
+			(u64)track->db_z_read_offset << 8, mslice,
 			radeon_bo_size(track->db_z_read_bo));
 		return -EINVAL;
 	}
 
-	offset = track->db_z_write_offset << 8;
+	offset = (u64)track->db_z_write_offset << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, offset, surf.base_align);
 		return -EINVAL;
 	}
-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->db_z_write_bo)) {
 		dev_warn(p->dev, "%s:%d depth write bo too small (layer size %d, "
-			 "offset %ld, max layer %d, bo size %ld)\n",
+			 "offset %llu, max layer %d, bo size %ld)\n",
 			 __func__, __LINE__, surf.layer_size,
-			(unsigned long)track->db_z_write_offset << 8, mslice,
+			(u64)track->db_z_write_offset << 8, mslice,
 			radeon_bo_size(track->db_z_write_bo));
 		return -EINVAL;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/ni.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/ni.c
@@ -813,7 +813,7 @@
 			err = 0;
 		} else if (rdev->smc_fw->size != smc_req_size) {
 			pr_err("ni_mc: Bogus length %zu in firmware \"%s\"\n",
-			       rdev->mc_fw->size, fw_name);
+			       rdev->smc_fw->size, fw_name);
 			err = -EINVAL;
 		}
 	}
@@ -2373,7 +2373,7 @@
 	/* Initialize surface registers */
 	radeon_surface_init(rdev);
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* Fence driver */
 	radeon_fence_driver_init(rdev);
 	/* initialize memory controller */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/pptable.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/pptable.h
@@ -424,7 +424,7 @@
 typedef struct _ATOM_PPLIB_STATE_V2
 {
       //number of valid dpm levels in this state; Driver uses it to calculate the whole 
-      //size of the state: sizeof(ATOM_PPLIB_STATE_V2) + (ucNumDPMLevels - 1) * sizeof(UCHAR)
+      //size of the state: struct_size(ATOM_PPLIB_STATE_V2, clockInfoIndex, ucNumDPMLevels)
       UCHAR ucNumDPMLevels;
       
       //a index to the array of nonClockInfos
@@ -432,14 +432,14 @@
       /**
       * Driver will read the first ucNumDPMLevels in this array
       */
-      UCHAR clockInfoIndex[1];
+      UCHAR clockInfoIndex[] __counted_by(ucNumDPMLevels);
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
     //how many states we have 
     UCHAR ucNumEntries;
     
-    ATOM_PPLIB_STATE_V2 states[1];
+    ATOM_PPLIB_STATE_V2 states[] /* __counted_by(ucNumEntries) */;
 }StateArray;
 
 
@@ -450,7 +450,7 @@
     //sizeof(ATOM_PPLIB_CLOCK_INFO)
     UCHAR ucEntrySize;
     
-    UCHAR clockInfo[1];
+    UCHAR clockInfo[] __counted_by(ucNumEntries);
 }ClockInfoArray;
 
 typedef struct _NonClockInfoArray{
@@ -460,7 +460,7 @@
     //sizeof(ATOM_PPLIB_NONCLOCK_INFO)
     UCHAR ucEntrySize;
     
-    ATOM_PPLIB_NONCLOCK_INFO nonClockInfo[1];
+    ATOM_PPLIB_NONCLOCK_INFO nonClockInfo[] __counted_by(ucNumEntries);
 }NonClockInfoArray;
 
 typedef struct _ATOM_PPLIB_Clock_Voltage_Dependency_Record
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/r100.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/r100.c
@@ -458,7 +458,7 @@
  */
 void r100_pm_prepare(struct radeon_device *rdev)
 {
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 	u32 tmp;
@@ -489,7 +489,7 @@
  */
 void r100_pm_finish(struct radeon_device *rdev)
 {
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 	u32 tmp;
@@ -602,7 +602,7 @@
  */
 void r100_hpd_init(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_connector *connector;
 	unsigned enable = 0;
 
@@ -625,7 +625,7 @@
  */
 void r100_hpd_fini(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_connector *connector;
 	unsigned disable = 0;
 
@@ -797,7 +797,7 @@
 		/* Vertical blank interrupts */
 		if (status & RADEON_CRTC_VBLANK_STAT) {
 			if (rdev->irq.crtc_vblank_int[0]) {
-				drm_handle_vblank(rdev->ddev, 0);
+				drm_handle_vblank(rdev_to_drm(rdev), 0);
 				rdev->pm.vblank_sync = true;
 				wake_up(&rdev->irq.vblank_queue);
 			}
@@ -806,7 +806,7 @@
 		}
 		if (status & RADEON_CRTC2_VBLANK_STAT) {
 			if (rdev->irq.crtc_vblank_int[1]) {
-				drm_handle_vblank(rdev->ddev, 1);
+				drm_handle_vblank(rdev_to_drm(rdev), 1);
 				rdev->pm.vblank_sync = true;
 				wake_up(&rdev->irq.vblank_queue);
 			}
@@ -1015,45 +1015,65 @@
 
 	DRM_DEBUG_KMS("\n");
 
-	if ((rdev->family == CHIP_R100) || (rdev->family == CHIP_RV100) ||
-	    (rdev->family == CHIP_RV200) || (rdev->family == CHIP_RS100) ||
-	    (rdev->family == CHIP_RS200)) {
+	switch (rdev->family) {
+	case CHIP_R100:
+	case CHIP_RV100:
+	case CHIP_RV200:
+	case CHIP_RS100:
+	case CHIP_RS200:
 		DRM_INFO("Loading R100 Microcode\n");
 		fw_name = FIRMWARE_R100;
-	} else if ((rdev->family == CHIP_R200) ||
-		   (rdev->family == CHIP_RV250) ||
-		   (rdev->family == CHIP_RV280) ||
-		   (rdev->family == CHIP_RS300)) {
+		break;
+
+	case CHIP_R200:
+	case CHIP_RV250:
+	case CHIP_RV280:
+	case CHIP_RS300:
 		DRM_INFO("Loading R200 Microcode\n");
 		fw_name = FIRMWARE_R200;
-	} else if ((rdev->family == CHIP_R300) ||
-		   (rdev->family == CHIP_R350) ||
-		   (rdev->family == CHIP_RV350) ||
-		   (rdev->family == CHIP_RV380) ||
-		   (rdev->family == CHIP_RS400) ||
-		   (rdev->family == CHIP_RS480)) {
+		break;
+
+	case CHIP_R300:
+	case CHIP_R350:
+	case CHIP_RV350:
+	case CHIP_RV380:
+	case CHIP_RS400:
+	case CHIP_RS480:
 		DRM_INFO("Loading R300 Microcode\n");
 		fw_name = FIRMWARE_R300;
-	} else if ((rdev->family == CHIP_R420) ||
-		   (rdev->family == CHIP_R423) ||
-		   (rdev->family == CHIP_RV410)) {
+		break;
+
+	case CHIP_R420:
+	case CHIP_R423:
+	case CHIP_RV410:
 		DRM_INFO("Loading R400 Microcode\n");
 		fw_name = FIRMWARE_R420;
-	} else if ((rdev->family == CHIP_RS690) ||
-		   (rdev->family == CHIP_RS740)) {
+		break;
+
+	case CHIP_RS690:
+	case CHIP_RS740:
 		DRM_INFO("Loading RS690/RS740 Microcode\n");
 		fw_name = FIRMWARE_RS690;
-	} else if (rdev->family == CHIP_RS600) {
+		break;
+
+	case CHIP_RS600:
 		DRM_INFO("Loading RS600 Microcode\n");
 		fw_name = FIRMWARE_RS600;
-	} else if ((rdev->family == CHIP_RV515) ||
-		   (rdev->family == CHIP_R520) ||
-		   (rdev->family == CHIP_RV530) ||
-		   (rdev->family == CHIP_R580) ||
-		   (rdev->family == CHIP_RV560) ||
-		   (rdev->family == CHIP_RV570)) {
+		break;
+
+	case CHIP_RV515:
+	case CHIP_R520:
+	case CHIP_RV530:
+	case CHIP_R580:
+	case CHIP_RV560:
+	case CHIP_RV570:
 		DRM_INFO("Loading R500 Microcode\n");
 		fw_name = FIRMWARE_R520;
+		break;
+
+	default:
+		DRM_ERROR("Unsupported Radeon family %u\n", rdev->family);
+		return -EINVAL;
 	}
 
 	err = request_firmware(&rdev->me_fw, fw_name, rdev->dev);
@@ -1470,7 +1490,7 @@
 	header = radeon_get_ib_value(p, h_idx);
 	crtc_id = radeon_get_ib_value(p, h_idx + 5);
 	reg = R100_CP_PACKET0_GET_REG(header);
-	crtc = drm_crtc_find(p->rdev->ddev, p->filp, crtc_id);
+	crtc = drm_crtc_find(rdev_to_drm(p->rdev), p->filp, crtc_id);
 	if (!crtc) {
 		DRM_ERROR("cannot find crtc %d\n", crtc_id);
 		return -ENOENT;
@@ -3058,7 +3078,7 @@
 void  r100_debugfs_rbbm_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("r100_rbbm_info", 0444, root, rdev,
 			    &r100_debugfs_rbbm_info_fops);
@@ -3068,7 +3088,7 @@
 void r100_debugfs_cp_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("r100_cp_ring_info", 0444, root, rdev,
 			    &r100_debugfs_cp_ring_info_fops);
@@ -3080,7 +3100,7 @@
 void  r100_debugfs_mc_info_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("r100_mc_info", 0444, root, rdev,
 			    &r100_debugfs_mc_info_fops);
@@ -3946,7 +3966,7 @@
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* post */
-	radeon_combios_asic_init(rdev->ddev);
+	radeon_combios_asic_init(rdev_to_drm(rdev));
 	/* Resume clock after posting */
 	r100_clock_startup(rdev);
 	/* Initialize surface registers */
@@ -4055,7 +4075,7 @@
 	/* Set asic errata */
 	r100_errata(rdev);
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* initialize AGP */
 	if (rdev->flags & RADEON_IS_AGP) {
 		r = radeon_agp_init(rdev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/r300.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/r300.c
@@ -615,7 +615,7 @@
 static void rv370_debugfs_pcie_gart_info_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("rv370_pcie_gart_info", 0444, root, rdev,
 			    &rv370_debugfs_pcie_gart_info_fops);
@@ -1451,7 +1451,7 @@
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* post */
-	radeon_combios_asic_init(rdev->ddev);
+	radeon_combios_asic_init(rdev_to_drm(rdev));
 	/* Resume clock after posting */
 	r300_clock_startup(rdev);
 	/* Initialize surface registers */
@@ -1537,7 +1537,7 @@
 	/* Set asic errata */
 	r300_errata(rdev);
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* initialize AGP */
 	if (rdev->flags & RADEON_IS_AGP) {
 		r = radeon_agp_init(rdev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/r420.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/r420.c
@@ -321,7 +321,7 @@
 	if (rdev->is_atom_bios) {
 		atom_asic_init(rdev->mode_info.atom_context);
 	} else {
-		radeon_combios_asic_init(rdev->ddev);
+		radeon_combios_asic_init(rdev_to_drm(rdev));
 	}
 	/* Resume clock after posting */
 	r420_clock_resume(rdev);
@@ -413,7 +413,7 @@
 		return -EINVAL;
 
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* initialize AGP */
 	if (rdev->flags & RADEON_IS_AGP) {
 		r = radeon_agp_init(rdev);
@@ -492,7 +492,7 @@
 void r420_debugfs_pipes_info_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("r420_pipes_info", 0444, root, rdev,
 			    &r420_debugfs_pipes_info_fops);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/r520.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/r520.c
@@ -287,7 +287,7 @@
 		atom_asic_init(rdev->mode_info.atom_context);
 	}
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* initialize AGP */
 	if (rdev->flags & RADEON_IS_AGP) {
 		r = radeon_agp_init(rdev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/r600.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/r600.c
@@ -950,7 +950,7 @@
 
 void r600_hpd_init(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_connector *connector;
 	unsigned enable = 0;
 
@@ -1017,7 +1017,7 @@
 
 void r600_hpd_fini(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_connector *connector;
 	unsigned disable = 0;
 
@@ -3280,7 +3280,7 @@
 	/* Initialize surface registers */
 	radeon_surface_init(rdev);
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* Fence driver */
 	radeon_fence_driver_init(rdev);
 	if (rdev->flags & RADEON_IS_AGP) {
@@ -4136,7 +4136,7 @@
 					DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n");
 
 				if (rdev->irq.crtc_vblank_int[0]) {
-					drm_handle_vblank(rdev->ddev, 0);
+					drm_handle_vblank(rdev_to_drm(rdev), 0);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -4166,7 +4166,7 @@
 					DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n");
 
 				if (rdev->irq.crtc_vblank_int[1]) {
-					drm_handle_vblank(rdev->ddev, 1);
+					drm_handle_vblank(rdev_to_drm(rdev), 1);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -4358,7 +4358,7 @@
 static void r600_debugfs_mc_info_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("r600_mc_info", 0444, root, rdev,
 			    &r600_debugfs_mc_info_fops);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/r600_cs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/r600_cs.c
@@ -884,7 +884,7 @@
 	crtc_id = radeon_get_ib_value(p, h_idx + 2 + 7 + 1);
 	reg = R600_CP_PACKET0_GET_REG(header);
 
-	crtc = drm_crtc_find(p->rdev->ddev, p->filp, crtc_id);
+	crtc = drm_crtc_find(rdev_to_drm(p->rdev), p->filp, crtc_id);
 	if (!crtc) {
 		DRM_ERROR("cannot find crtc %d\n", crtc_id);
 		return -ENOENT;
@@ -2104,7 +2104,7 @@
 				return -EINVAL;
 			}
 
-			offset = radeon_get_ib_value(p, idx+1) << 8;
+			offset = (u64)radeon_get_ib_value(p, idx+1) << 8;
 			if (offset != track->vgt_strmout_bo_offset[idx_value]) {
 				DRM_ERROR("bad STRMOUT_BASE_UPDATE, bo offset does not match: 0x%llx, 0x%x\n",
 					  offset, track->vgt_strmout_bo_offset[idx_value]);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/r600_dpm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/r600_dpm.c
@@ -155,7 +155,7 @@
 
 u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 	u32 vblank_in_pixels;
@@ -182,7 +182,7 @@
 
 u32 r600_dpm_get_vrefresh(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 	u32 vrefresh = 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/r600_hdmi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -116,7 +116,7 @@
 {
 	struct radeon_device *rdev = container_of(work, struct radeon_device,
 						  audio_work);
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct r600_audio_pin audio_status = r600_audio_status(rdev);
 	struct drm_encoder *encoder;
 	bool changed = false;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon.h
@@ -132,7 +132,6 @@
 /* RADEON_IB_POOL_SIZE must be a power of 2 */
 #define RADEON_IB_POOL_SIZE			16
 #define RADEON_DEBUGFS_MAX_COMPONENTS		32
-#define RADEONFB_CONN_LIMIT			4
 #define RADEON_BIOS_NUM_SCRATCH			8
 
 /* internal ring indices */
@@ -2479,6 +2478,11 @@
 u32 cik_mm_rdoorbell(struct radeon_device *rdev, u32 index);
 void cik_mm_wdoorbell(struct radeon_device *rdev, u32 index, u32 v);
 
+static inline struct drm_device *rdev_to_drm(struct radeon_device *rdev)
+{
+	return rdev->ddev;
+}
+
 /*
  * Cast helper
  */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_acpi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_acpi.c
@@ -405,11 +405,11 @@
 	if (req.pending & ATIF_DGPU_DISPLAY_EVENT) {
 		if ((rdev->flags & RADEON_IS_PX) &&
 		    radeon_atpx_dgpu_req_power_for_displays()) {
-			pm_runtime_get_sync(rdev->ddev->dev);
+			pm_runtime_get_sync(rdev_to_drm(rdev)->dev);
 			/* Just fire off a uevent and let userspace tell us what to do */
-			drm_helper_hpd_irq_event(rdev->ddev);
-			pm_runtime_mark_last_busy(rdev->ddev->dev);
-			pm_runtime_put_autosuspend(rdev->ddev->dev);
+			drm_helper_hpd_irq_event(rdev_to_drm(rdev));
+			pm_runtime_mark_last_busy(rdev_to_drm(rdev)->dev);
+			pm_runtime_put_autosuspend(rdev_to_drm(rdev)->dev);
 		}
 	}
 	/* TODO: check other events */
@@ -736,7 +736,7 @@
 		struct radeon_encoder *target = NULL;
 
 		/* Find the encoder controlling the brightness */
-		list_for_each_entry(tmp, &rdev->ddev->mode_config.encoder_list,
+		list_for_each_entry(tmp, &rdev_to_drm(rdev)->mode_config.encoder_list,
 				head) {
 			struct radeon_encoder *enc = to_radeon_encoder(tmp);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_agp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_agp.c
@@ -161,7 +161,7 @@
 
 static int radeon_agp_head_acquire(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct pci_dev *pdev = to_pci_dev(dev->dev);
 
 	if (!rdev->agp)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_atombios.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -187,7 +187,7 @@
 
 			if (i2c.valid) {
 				sprintf(stmp, "0x%x", i2c.i2c_id);
-				rdev->i2c_bus[i] = radeon_i2c_create(rdev->ddev, &i2c, stmp);
+				rdev->i2c_bus[i] = radeon_i2c_create(rdev_to_drm(rdev), &i2c, stmp);
 			}
 			gpio = (ATOM_GPIO_I2C_ASSIGMENT *)
 				((u8 *)gpio + sizeof(ATOM_GPIO_I2C_ASSIGMENT));
@@ -923,8 +923,12 @@
 		max_device = ATOM_MAX_SUPPORTED_DEVICE_INFO;
 
 	for (i = 0; i < max_device; i++) {
-		ATOM_CONNECTOR_INFO_I2C ci =
-		    supported_devices->info.asConnInfo[i];
+		ATOM_CONNECTOR_INFO_I2C ci;
+
+		if (frev > 1)
+			ci = supported_devices->info_2d1.asConnInfo[i];
+		else
+			ci = supported_devices->info.asConnInfo[i];
 
 		bios_connectors[i].valid = false;
 
@@ -1713,26 +1717,29 @@
 					fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;
 					if (fake_edid_record->ucFakeEDIDLength) {
 						struct edid *edid;
-						int edid_size =
-							max((int)EDID_LENGTH, (int)fake_edid_record->ucFakeEDIDLength);
-						edid = kmalloc(edid_size, GFP_KERNEL);
-						if (edid) {
-							memcpy((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0],
-							       fake_edid_record->ucFakeEDIDLength);
+						int edid_size;
 
+						if (fake_edid_record->ucFakeEDIDLength == 128)
+							edid_size = fake_edid_record->ucFakeEDIDLength;
+						else
+							edid_size = fake_edid_record->ucFakeEDIDLength * 128;
+						edid = kmemdup(&fake_edid_record->ucFakeEDIDString[0],
+							       edid_size, GFP_KERNEL);
+						if (edid) {
 							if (drm_edid_is_valid(edid)) {
 								rdev->mode_info.bios_hardcoded_edid = edid;
 								rdev->mode_info.bios_hardcoded_edid_size = edid_size;
-							} else
+							} else {
 								kfree(edid);
+							}
 						}
+						record += struct_size(fake_edid_record,
+								      ucFakeEDIDString,
+								      edid_size);
+					} else {
+						/* empty fake edid record must be 3 bytes long */
+						record += sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
 					}
-					record += fake_edid_record->ucFakeEDIDLength ?
-						  struct_size(fake_edid_record,
-							      ucFakeEDIDString,
-							      fake_edid_record->ucFakeEDIDLength) :
-						  /* empty fake edid record must be 3 bytes long */
-						  sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
 					break;
 				case LCD_PANEL_RESOLUTION_RECORD_TYPE:
 					panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_audio.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_audio.c
@@ -197,7 +197,7 @@
 		return;
 
 	if (rdev->mode_info.mode_config_initialized) {
-		list_for_each_entry(encoder, &rdev->ddev->mode_config.encoder_list, head) {
+		list_for_each_entry(encoder, &rdev_to_drm(rdev)->mode_config.encoder_list, head) {
 			if (radeon_encoder_is_digital(encoder)) {
 				radeon_encoder = to_radeon_encoder(encoder);
 				dig = radeon_encoder->enc_priv;
@@ -760,16 +760,20 @@
 	if (!rdev->audio.enabled || !rdev->mode_info.mode_config_initialized)
 		return 0;
 
-	list_for_each_entry(encoder, &rdev->ddev->mode_config.encoder_list, head) {
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		const struct drm_connector_helper_funcs *connector_funcs =
+				connector->helper_private;
+		encoder = connector_funcs->best_encoder(connector);
+
+		if (!encoder)
+			continue;
+
 		if (!radeon_encoder_is_digital(encoder))
 			continue;
 		radeon_encoder = to_radeon_encoder(encoder);
 		dig = radeon_encoder->enc_priv;
 		if (!dig->pin || dig->pin->id != port)
 			continue;
-		connector = radeon_get_connector_for_encoder(encoder);
-		if (!connector)
-			continue;
 		*enabled = true;
 		ret = drm_eld_size(connector->eld);
 		memcpy(buf, connector->eld, min(max_bytes, ret));
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_combios.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_combios.c
@@ -372,7 +372,7 @@
 	int edid_info, size;
 	struct edid *edid;
 	unsigned char *raw;
-	edid_info = combios_get_table_offset(rdev->ddev, COMBIOS_HARDCODED_EDID_TABLE);
+	edid_info = combios_get_table_offset(rdev_to_drm(rdev), COMBIOS_HARDCODED_EDID_TABLE);
 	if (!edid_info)
 		return false;
 
@@ -642,7 +642,7 @@
 
 static struct radeon_i2c_bus_rec radeon_combios_get_i2c_info_from_table(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct radeon_i2c_bus_rec i2c;
 	u16 offset;
 	u8 id, blocks, clk, data;
@@ -670,7 +670,7 @@
 
 void radeon_combios_i2c_init(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct radeon_i2c_bus_rec i2c;
 
 	/* actual hw pads
@@ -812,7 +812,7 @@
 
 bool radeon_combios_sideport_present(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	u16 igp_info;
 
 	/* sideport is AMD only */
@@ -915,7 +915,7 @@
 enum radeon_tv_std
 radeon_combios_get_tv_info(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	uint16_t tv_info;
 	enum radeon_tv_std tv_std = TV_STD_NTSC;
 
@@ -2637,7 +2637,7 @@
 
 void radeon_combios_get_power_modes(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	u16 offset, misc, misc2 = 0;
 	u8 rev, tmp;
 	int state_index = 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_device.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_device.c
@@ -760,7 +760,7 @@
 		if (rdev->is_atom_bios)
 			atom_asic_init(rdev->mode_info.atom_context);
 		else
-			radeon_combios_asic_init(rdev->ddev);
+			radeon_combios_asic_init(rdev_to_drm(rdev));
 		return true;
 	} else {
 		dev_err(rdev->dev, "Card not posted and no BIOS - ignoring\n");
@@ -980,7 +980,7 @@
 		return -ENOMEM;
 
 	rdev->mode_info.atom_card_info = atom_card_info;
-	atom_card_info->dev = rdev->ddev;
+	atom_card_info->dev = rdev_to_drm(rdev);
 	atom_card_info->reg_read = cail_reg_read;
 	atom_card_info->reg_write = cail_reg_write;
 	/* needed for iio ops */
@@ -1005,7 +1005,7 @@
 
 	mutex_init(&rdev->mode_info.atom_context->mutex);
 	mutex_init(&rdev->mode_info.atom_context->scratch_mutex);
-	radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
+	radeon_atom_initialize_bios_scratch_regs(rdev_to_drm(rdev));
 	atom_allocate_fb_scratch(rdev->mode_info.atom_context);
 	return 0;
 }
@@ -1049,7 +1049,7 @@
  */
 int radeon_combios_init(struct radeon_device *rdev)
 {
-	radeon_combios_initialize_bios_scratch_regs(rdev->ddev);
+	radeon_combios_initialize_bios_scratch_regs(rdev_to_drm(rdev));
 	return 0;
 }
 
@@ -1847,7 +1847,7 @@
 
 	downgrade_write(&rdev->exclusive_lock);
 
-	drm_helper_resume_force_mode(rdev->ddev);
+	drm_helper_resume_force_mode(rdev_to_drm(rdev));
 
 	/* set the power state here in case we are a PX system or headless */
 	if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_display.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_display.c
@@ -302,13 +302,13 @@
 	if ((radeon_use_pflipirq == 2) && ASIC_IS_DCE4(rdev))
 		return;
 
-	spin_lock_irqsave(&rdev->ddev->event_lock, flags);
+	spin_lock_irqsave(&rdev_to_drm(rdev)->event_lock, flags);
 	if (radeon_crtc->flip_status != RADEON_FLIP_SUBMITTED) {
 		DRM_DEBUG_DRIVER("radeon_crtc->flip_status = %d != "
 				 "RADEON_FLIP_SUBMITTED(%d)\n",
 				 radeon_crtc->flip_status,
 				 RADEON_FLIP_SUBMITTED);
-		spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
+		spin_unlock_irqrestore(&rdev_to_drm(rdev)->event_lock, flags);
 		return;
 	}
 
@@ -334,7 +334,7 @@
 	 */
 	if (update_pending &&
 	    (DRM_SCANOUTPOS_VALID &
-	     radeon_get_crtc_scanoutpos(rdev->ddev, crtc_id,
+	     radeon_get_crtc_scanoutpos(rdev_to_drm(rdev), crtc_id,
 					GET_DISTANCE_TO_VBLANKSTART,
 					&vpos, &hpos, NULL, NULL,
 					&rdev->mode_info.crtcs[crtc_id]->base.hwmode)) &&
@@ -347,7 +347,7 @@
 		 */
 		update_pending = 0;
 	}
-	spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
+	spin_unlock_irqrestore(&rdev_to_drm(rdev)->event_lock, flags);
 	if (!update_pending)
 		radeon_crtc_handle_flip(rdev, crtc_id);
 }
@@ -370,14 +370,14 @@
 	if (radeon_crtc == NULL)
 		return;
 
-	spin_lock_irqsave(&rdev->ddev->event_lock, flags);
+	spin_lock_irqsave(&rdev_to_drm(rdev)->event_lock, flags);
 	work = radeon_crtc->flip_work;
 	if (radeon_crtc->flip_status != RADEON_FLIP_SUBMITTED) {
 		DRM_DEBUG_DRIVER("radeon_crtc->flip_status = %d != "
 				 "RADEON_FLIP_SUBMITTED(%d)\n",
 				 radeon_crtc->flip_status,
 				 RADEON_FLIP_SUBMITTED);
-		spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
+		spin_unlock_irqrestore(&rdev_to_drm(rdev)->event_lock, flags);
 		return;
 	}
 
@@ -389,7 +389,7 @@
 	if (work->event)
 		drm_crtc_send_vblank_event(&radeon_crtc->base, work->event);
 
-	spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
+	spin_unlock_irqrestore(&rdev_to_drm(rdev)->event_lock, flags);
 
 	drm_crtc_vblank_put(&radeon_crtc->base);
 	radeon_irq_kms_pflip_irq_put(rdev, work->crtc_id);
@@ -408,7 +408,7 @@
 	struct radeon_flip_work *work =
 		container_of(__work, struct radeon_flip_work, flip_work);
 	struct radeon_device *rdev = work->rdev;
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[work->crtc_id];
 
 	struct drm_crtc *crtc = &radeon_crtc->base;
@@ -683,7 +683,7 @@
 	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_crtc *radeon_crtc;
 
-	radeon_crtc = kzalloc(sizeof(struct radeon_crtc) + (RADEONFB_CONN_LIMIT * sizeof(struct drm_connector *)), GFP_KERNEL);
+	radeon_crtc = kzalloc(sizeof(*radeon_crtc), GFP_KERNEL);
 	if (radeon_crtc == NULL)
 		return;
 
@@ -709,12 +709,6 @@
 	dev->mode_config.cursor_width = radeon_crtc->max_cursor_width;
 	dev->mode_config.cursor_height = radeon_crtc->max_cursor_height;
 
-#if 0
-	radeon_crtc->mode_set.crtc = &radeon_crtc->base;
-	radeon_crtc->mode_set.connectors = (struct drm_connector **)(radeon_crtc + 1);
-	radeon_crtc->mode_set.num_connectors = 0;
-#endif
-
 	if (rdev->is_atom_bios && (ASIC_IS_AVIVO(rdev) || radeon_r4xx_atom))
 		radeon_atombios_init_crtc(dev, radeon_crtc);
 	else
@@ -1407,7 +1401,7 @@
 
 	if (rdev->is_atom_bios) {
 		rdev->mode_info.coherent_mode_property =
-			drm_property_create_range(rdev->ddev, 0 , "coherent", 0, 1);
+			drm_property_create_range(rdev_to_drm(rdev), 0, "coherent", 0, 1);
 		if (!rdev->mode_info.coherent_mode_property)
 			return -ENOMEM;
 	}
@@ -1415,57 +1409,57 @@
 	if (!ASIC_IS_AVIVO(rdev)) {
 		sz = ARRAY_SIZE(radeon_tmds_pll_enum_list);
 		rdev->mode_info.tmds_pll_property =
-			drm_property_create_enum(rdev->ddev, 0,
+			drm_property_create_enum(rdev_to_drm(rdev), 0,
 					    "tmds_pll",
 					    radeon_tmds_pll_enum_list, sz);
 	}
 
 	rdev->mode_info.load_detect_property =
-		drm_property_create_range(rdev->ddev, 0, "load detection", 0, 1);
+		drm_property_create_range(rdev_to_drm(rdev), 0, "load detection", 0, 1);
 	if (!rdev->mode_info.load_detect_property)
 		return -ENOMEM;
 
-	drm_mode_create_scaling_mode_property(rdev->ddev);
+	drm_mode_create_scaling_mode_property(rdev_to_drm(rdev));
 
 	sz = ARRAY_SIZE(radeon_tv_std_enum_list);
 	rdev->mode_info.tv_std_property =
-		drm_property_create_enum(rdev->ddev, 0,
+		drm_property_create_enum(rdev_to_drm(rdev), 0,
 				    "tv standard",
 				    radeon_tv_std_enum_list, sz);
 
 	sz = ARRAY_SIZE(radeon_underscan_enum_list);
 	rdev->mode_info.underscan_property =
-		drm_property_create_enum(rdev->ddev, 0,
+		drm_property_create_enum(rdev_to_drm(rdev), 0,
 				    "underscan",
 				    radeon_underscan_enum_list, sz);
 
 	rdev->mode_info.underscan_hborder_property =
-		drm_property_create_range(rdev->ddev, 0,
+		drm_property_create_range(rdev_to_drm(rdev), 0,
 					"underscan hborder", 0, 128);
 	if (!rdev->mode_info.underscan_hborder_property)
 		return -ENOMEM;
 
 	rdev->mode_info.underscan_vborder_property =
-		drm_property_create_range(rdev->ddev, 0,
+		drm_property_create_range(rdev_to_drm(rdev), 0,
 					"underscan vborder", 0, 128);
 	if (!rdev->mode_info.underscan_vborder_property)
 		return -ENOMEM;
 
 	sz = ARRAY_SIZE(radeon_audio_enum_list);
 	rdev->mode_info.audio_property =
-		drm_property_create_enum(rdev->ddev, 0,
+		drm_property_create_enum(rdev_to_drm(rdev), 0,
 					 "audio",
 					 radeon_audio_enum_list, sz);
 
 	sz = ARRAY_SIZE(radeon_dither_enum_list);
 	rdev->mode_info.dither_property =
-		drm_property_create_enum(rdev->ddev, 0,
+		drm_property_create_enum(rdev_to_drm(rdev), 0,
 					 "dither",
 					 radeon_dither_enum_list, sz);
 
 	sz = ARRAY_SIZE(radeon_output_csc_enum_list);
 	rdev->mode_info.output_csc_property =
-		drm_property_create_enum(rdev->ddev, 0,
+		drm_property_create_enum(rdev_to_drm(rdev), 0,
 					 "output_csc",
 					 radeon_output_csc_enum_list, sz);
 
@@ -1584,29 +1578,29 @@
 	int i;
 	int ret;
 
-	drm_mode_config_init(rdev->ddev);
+	drm_mode_config_init(rdev_to_drm(rdev));
 	rdev->mode_info.mode_config_initialized = true;
 
-	rdev->ddev->mode_config.funcs = &radeon_mode_funcs;
+	rdev_to_drm(rdev)->mode_config.funcs = &radeon_mode_funcs;
 
 	if (radeon_use_pflipirq == 2 && rdev->family >= CHIP_R600)
-		rdev->ddev->mode_config.async_page_flip = true;
+		rdev_to_drm(rdev)->mode_config.async_page_flip = true;
 
 	if (ASIC_IS_DCE5(rdev)) {
-		rdev->ddev->mode_config.max_width = 16384;
-		rdev->ddev->mode_config.max_height = 16384;
+		rdev_to_drm(rdev)->mode_config.max_width = 16384;
+		rdev_to_drm(rdev)->mode_config.max_height = 16384;
 	} else if (ASIC_IS_AVIVO(rdev)) {
-		rdev->ddev->mode_config.max_width = 8192;
-		rdev->ddev->mode_config.max_height = 8192;
+		rdev_to_drm(rdev)->mode_config.max_width = 8192;
+		rdev_to_drm(rdev)->mode_config.max_height = 8192;
 	} else {
-		rdev->ddev->mode_config.max_width = 4096;
-		rdev->ddev->mode_config.max_height = 4096;
+		rdev_to_drm(rdev)->mode_config.max_width = 4096;
+		rdev_to_drm(rdev)->mode_config.max_height = 4096;
 	}
 
-	rdev->ddev->mode_config.preferred_depth = 24;
-	rdev->ddev->mode_config.prefer_shadow = 1;
+	rdev_to_drm(rdev)->mode_config.preferred_depth = 24;
+	rdev_to_drm(rdev)->mode_config.prefer_shadow = 1;
 
-	rdev->ddev->mode_config.fb_modifiers_not_supported = true;
+	rdev_to_drm(rdev)->mode_config.fb_modifiers_not_supported = true;
 
 	ret = radeon_modeset_create_props(rdev);
 	if (ret) {
@@ -1624,11 +1618,11 @@
 
 	/* allocate crtcs */
 	for (i = 0; i < rdev->num_crtc; i++) {
-		radeon_crtc_init(rdev->ddev, i);
+		radeon_crtc_init(rdev_to_drm(rdev), i);
 	}
 
 	/* okay we should have all the bios connectors */
-	ret = radeon_setup_enc_conn(rdev->ddev);
+	ret = radeon_setup_enc_conn(rdev_to_drm(rdev));
 	if (!ret) {
 		return ret;
 	}
@@ -1645,7 +1639,7 @@
 	/* setup afmt */
 	radeon_afmt_init(rdev);
 
-	drm_kms_helper_poll_init(rdev->ddev);
+	drm_kms_helper_poll_init(rdev_to_drm(rdev));
 
 	/* do pm late init */
 	ret = radeon_pm_late_init(rdev);
@@ -1656,11 +1650,11 @@
 void radeon_modeset_fini(struct radeon_device *rdev)
 {
 	if (rdev->mode_info.mode_config_initialized) {
-		drm_kms_helper_poll_fini(rdev->ddev);
+		drm_kms_helper_poll_fini(rdev_to_drm(rdev));
 		radeon_hpd_fini(rdev);
-		drm_helper_force_disable_all(rdev->ddev);
+		drm_helper_force_disable_all(rdev_to_drm(rdev));
 		radeon_afmt_fini(rdev);
-		drm_mode_config_cleanup(rdev->ddev);
+		drm_mode_config_cleanup(rdev_to_drm(rdev));
 		rdev->mode_info.mode_config_initialized = false;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_encoders.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -43,7 +43,7 @@
 	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 	struct drm_encoder *clone_encoder;
-	uint32_t index_mask = 0;
+	uint32_t index_mask = drm_encoder_mask(encoder);
 	int count;
 
 	/* DIG routing gets problematic */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_fbdev.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_fbdev.c
@@ -67,7 +67,7 @@
 	int height = mode_cmd->height;
 	u32 cpp;
 
-	info = drm_get_format_info(rdev->ddev, mode_cmd);
+	info = drm_get_format_info(rdev_to_drm(rdev), mode_cmd);
 	cpp = info->cpp[0];
 
 	/* need to align pitch with crtc limits */
@@ -148,15 +148,15 @@
 	struct radeon_device *rdev = fb_helper->dev->dev_private;
 	int ret;
 
-	ret = pm_runtime_get_sync(rdev->ddev->dev);
+	ret = pm_runtime_get_sync(rdev_to_drm(rdev)->dev);
 	if (ret < 0 && ret != -EACCES)
 		goto err_pm_runtime_mark_last_busy;
 
 	return 0;
 
 err_pm_runtime_mark_last_busy:
-	pm_runtime_mark_last_busy(rdev->ddev->dev);
-	pm_runtime_put_autosuspend(rdev->ddev->dev);
+	pm_runtime_mark_last_busy(rdev_to_drm(rdev)->dev);
+	pm_runtime_put_autosuspend(rdev_to_drm(rdev)->dev);
 	return ret;
 }
 
@@ -165,8 +165,8 @@
 	struct drm_fb_helper *fb_helper = info->par;
 	struct radeon_device *rdev = fb_helper->dev->dev_private;
 
-	pm_runtime_mark_last_busy(rdev->ddev->dev);
-	pm_runtime_put_autosuspend(rdev->ddev->dev);
+	pm_runtime_mark_last_busy(rdev_to_drm(rdev)->dev);
+	pm_runtime_put_autosuspend(rdev_to_drm(rdev)->dev);
 
 	return 0;
 }
@@ -236,7 +236,7 @@
 		ret = -ENOMEM;
 		goto err_radeon_fbdev_destroy_pinned_object;
 	}
-	ret = radeon_framebuffer_init(rdev->ddev, fb, &mode_cmd, gobj);
+	ret = radeon_framebuffer_init(rdev_to_drm(rdev), fb, &mode_cmd, gobj);
 	if (ret) {
 		DRM_ERROR("failed to initialize framebuffer %d\n", ret);
 		goto err_kfree;
@@ -374,12 +374,12 @@
 	fb_helper = kzalloc(sizeof(*fb_helper), GFP_KERNEL);
 	if (!fb_helper)
 		return;
-	drm_fb_helper_prepare(rdev->ddev, fb_helper, bpp_sel, &radeon_fbdev_fb_helper_funcs);
+	drm_fb_helper_prepare(rdev_to_drm(rdev), fb_helper, bpp_sel, &radeon_fbdev_fb_helper_funcs);
 
-	ret = drm_client_init(rdev->ddev, &fb_helper->client, "radeon-fbdev",
+	ret = drm_client_init(rdev_to_drm(rdev), &fb_helper->client, "radeon-fbdev",
 			      &radeon_fbdev_client_funcs);
 	if (ret) {
-		drm_err(rdev->ddev, "Failed to register client: %d\n", ret);
+		drm_err(rdev_to_drm(rdev), "Failed to register client: %d\n", ret);
 		goto err_drm_client_init;
 	}
 
@@ -394,13 +394,13 @@
 
 void radeon_fbdev_set_suspend(struct radeon_device *rdev, int state)
 {
-	if (rdev->ddev->fb_helper)
-		drm_fb_helper_set_suspend(rdev->ddev->fb_helper, state);
+	if (rdev_to_drm(rdev)->fb_helper)
+		drm_fb_helper_set_suspend(rdev_to_drm(rdev)->fb_helper, state);
 }
 
 bool radeon_fbdev_robj_is_fb(struct radeon_device *rdev, struct radeon_bo *robj)
 {
-	struct drm_fb_helper *fb_helper = rdev->ddev->fb_helper;
+	struct drm_fb_helper *fb_helper = rdev_to_drm(rdev)->fb_helper;
 	struct drm_gem_object *gobj;
 
 	if (!fb_helper)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_fence.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_fence.c
@@ -149,7 +149,7 @@
 		       rdev->fence_context + ring,
 		       seq);
 	radeon_fence_ring_emit(rdev, ring, *fence);
-	trace_radeon_fence_emit(rdev->ddev, ring, (*fence)->seq);
+	trace_radeon_fence_emit(rdev_to_drm(rdev), ring, (*fence)->seq);
 	radeon_fence_schedule_check(rdev, ring);
 	return 0;
 }
@@ -488,7 +488,7 @@
 		if (!target_seq[i])
 			continue;
 
-		trace_radeon_fence_wait_begin(rdev->ddev, i, target_seq[i]);
+		trace_radeon_fence_wait_begin(rdev_to_drm(rdev), i, target_seq[i]);
 		radeon_irq_kms_sw_irq_get(rdev, i);
 	}
 
@@ -510,7 +510,7 @@
 			continue;
 
 		radeon_irq_kms_sw_irq_put(rdev, i);
-		trace_radeon_fence_wait_end(rdev->ddev, i, target_seq[i]);
+		trace_radeon_fence_wait_end(rdev_to_drm(rdev), i, target_seq[i]);
 	}
 
 	return r;
@@ -994,7 +994,7 @@
 void radeon_debugfs_fence_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("radeon_gpu_reset", 0444, root, rdev,
 			    &radeon_debugfs_gpu_reset_fops);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_gem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_gem.c
@@ -641,7 +641,7 @@
 	if (r)
 		goto error_unlock;
 
-	if (bo_va->it.start)
+	if (bo_va->it.start && bo_va->bo)
 		r = radeon_vm_bo_update(rdev, bo_va, bo_va->bo->tbo.resource);
 
 error_unlock:
@@ -898,7 +898,7 @@
 void radeon_gem_debugfs_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("radeon_gem_info", 0444, root, rdev,
 			    &radeon_debugfs_gem_info_fops);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_i2c.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -1011,7 +1011,7 @@
 		    struct radeon_i2c_bus_rec *rec,
 		    const char *name)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	int i;
 
 	for (i = 0; i < RADEON_MAX_I2C_BUS; i++) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_ib.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_ib.c
@@ -307,7 +307,7 @@
 static void radeon_debugfs_sa_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("radeon_sa_info", 0444, root, rdev,
 			    &radeon_debugfs_sa_info_fops);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -80,7 +80,7 @@
 {
 	struct radeon_device *rdev = container_of(work, struct radeon_device,
 						  hotplug_work.work);
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_mode_config *mode_config = &dev->mode_config;
 	struct drm_connector *connector;
 
@@ -101,7 +101,7 @@
 {
 	struct radeon_device *rdev = container_of(work, struct radeon_device,
 						  dp_work);
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_mode_config *mode_config = &dev->mode_config;
 	struct drm_connector *connector;
 
@@ -197,7 +197,7 @@
 
 static int radeon_irq_install(struct radeon_device *rdev, int irq)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	int ret;
 
 	if (irq == IRQ_NOTCONNECTED)
@@ -218,7 +218,7 @@
 
 static void radeon_irq_uninstall(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct pci_dev *pdev = to_pci_dev(dev->dev);
 
 	radeon_driver_irq_uninstall_kms(dev);
@@ -322,9 +322,9 @@
 	spin_lock_init(&rdev->irq.lock);
 
 	/* Disable vblank irqs aggressively for power-saving */
-	rdev->ddev->vblank_disable_immediate = true;
+	rdev_to_drm(rdev)->vblank_disable_immediate = true;
 
-	r = drm_vblank_init(rdev->ddev, rdev->num_crtc);
+	r = drm_vblank_init(rdev_to_drm(rdev), rdev->num_crtc);
 	if (r) {
 		return r;
 	}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_object.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_object.c
@@ -152,7 +152,7 @@
 	bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
 	if (bo == NULL)
 		return -ENOMEM;
-	drm_gem_private_object_init(rdev->ddev, &bo->tbo.base, size);
+	drm_gem_private_object_init(rdev_to_drm(rdev), &bo->tbo.base, size);
 	bo->rdev = rdev;
 	bo->surface_reg = -1;
 	INIT_LIST_HEAD(&bo->list);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_pm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_pm.c
@@ -281,7 +281,7 @@
 
 	if (rdev->irq.installed) {
 		i = 0;
-		drm_for_each_crtc(crtc, rdev->ddev) {
+		drm_for_each_crtc(crtc, rdev_to_drm(rdev)) {
 			if (rdev->pm.active_crtcs & (1 << i)) {
 				/* This can fail if a modeset is in progress */
 				if (drm_crtc_vblank_get(crtc) == 0)
@@ -298,7 +298,7 @@
 
 	if (rdev->irq.installed) {
 		i = 0;
-		drm_for_each_crtc(crtc, rdev->ddev) {
+		drm_for_each_crtc(crtc, rdev_to_drm(rdev)) {
 			if (rdev->pm.req_vblank & (1 << i)) {
 				rdev->pm.req_vblank &= ~(1 << i);
 				drm_crtc_vblank_put(crtc);
@@ -670,7 +670,7 @@
 				      char *buf)
 {
 	struct radeon_device *rdev = dev_get_drvdata(dev);
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	int temp;
 
 	/* Can't get temperature when the card is off */
@@ -714,7 +714,7 @@
 				      struct device_attribute *attr, char *buf)
 {
 	struct radeon_device *rdev = dev_get_drvdata(dev);
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	u32 sclk = 0;
 
 	/* Can't get clock frequency when the card is off */
@@ -739,7 +739,7 @@
 				      struct device_attribute *attr, char *buf)
 {
 	struct radeon_device *rdev = dev_get_drvdata(dev);
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	u16 vddc = 0;
 
 	/* Can't get vddc when the card is off */
@@ -1691,7 +1691,7 @@
 
 static void radeon_pm_compute_clocks_old(struct radeon_device *rdev)
 {
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 
@@ -1764,7 +1764,7 @@
 
 static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev)
 {
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 	struct radeon_connector *radeon_connector;
@@ -1825,7 +1825,7 @@
 	 */
 	for (crtc = 0; (crtc < rdev->num_crtc) && in_vbl; crtc++) {
 		if (rdev->pm.active_crtcs & (1 << crtc)) {
-			vbl_status = radeon_get_crtc_scanoutpos(rdev->ddev,
+			vbl_status = radeon_get_crtc_scanoutpos(rdev_to_drm(rdev),
 								crtc,
 								USE_REAL_VBLANKSTART,
 								&vpos, &hpos, NULL, NULL,
@@ -1917,7 +1917,7 @@
 static int radeon_debugfs_pm_info_show(struct seq_file *m, void *unused)
 {
 	struct radeon_device *rdev = m->private;
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 
 	if  ((rdev->flags & RADEON_IS_PX) &&
 	     (ddev->switch_power_state != DRM_SWITCH_POWER_ON)) {
@@ -1954,7 +1954,7 @@
 static void radeon_debugfs_pm_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("radeon_pm_info", 0444, root, rdev,
 			    &radeon_debugfs_pm_info_fops);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_ring.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_ring.c
@@ -548,7 +548,7 @@
 {
 #if defined(CONFIG_DEBUG_FS)
 	const char *ring_name = radeon_debugfs_ring_idx_to_name(ring->idx);
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	if (ring_name)
 		debugfs_create_file(ring_name, 0444, root, ring,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/radeon_ttm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -687,8 +687,8 @@
 
 	/* No others user of address space so set it to 0 */
 	r = ttm_device_init(&rdev->mman.bdev, &radeon_bo_driver, rdev->dev,
-			       rdev->ddev->anon_inode->i_mapping,
-			       rdev->ddev->vma_offset_manager,
+			       rdev_to_drm(rdev)->anon_inode->i_mapping,
+			       rdev_to_drm(rdev)->vma_offset_manager,
 			       rdev->need_swiotlb,
 			       dma_addressing_limited(&rdev->pdev->dev));
 	if (r) {
@@ -895,7 +895,7 @@
 static void radeon_ttm_debugfs_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct drm_minor *minor = rdev->ddev->primary;
+	struct drm_minor *minor = rdev_to_drm(rdev)->primary;
 	struct dentry *root = minor->debugfs_root;
 
 	debugfs_create_file("radeon_vram", 0444, root, rdev,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/rs400.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/rs400.c
@@ -378,7 +378,7 @@
 static void rs400_debugfs_pcie_gart_info_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("rs400_gart_info", 0444, root, rdev,
 			    &rs400_debugfs_gart_info_fops);
@@ -473,7 +473,7 @@
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* post */
-	radeon_combios_asic_init(rdev->ddev);
+	radeon_combios_asic_init(rdev_to_drm(rdev));
 	/* Resume clock after posting */
 	r300_clock_startup(rdev);
 	/* Initialize surface registers */
@@ -551,7 +551,7 @@
 		return -EINVAL;
 
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* initialize memory controller */
 	rs400_mc_init(rdev);
 	/* Fence driver */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/rs600.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/rs600.c
@@ -322,7 +322,7 @@
 
 void rs600_pm_prepare(struct radeon_device *rdev)
 {
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 	u32 tmp;
@@ -340,7 +340,7 @@
 
 void rs600_pm_finish(struct radeon_device *rdev)
 {
-	struct drm_device *ddev = rdev->ddev;
+	struct drm_device *ddev = rdev_to_drm(rdev);
 	struct drm_crtc *crtc;
 	struct radeon_crtc *radeon_crtc;
 	u32 tmp;
@@ -409,7 +409,7 @@
 
 void rs600_hpd_init(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_connector *connector;
 	unsigned enable = 0;
 
@@ -436,7 +436,7 @@
 
 void rs600_hpd_fini(struct radeon_device *rdev)
 {
-	struct drm_device *dev = rdev->ddev;
+	struct drm_device *dev = rdev_to_drm(rdev);
 	struct drm_connector *connector;
 	unsigned disable = 0;
 
@@ -798,7 +798,7 @@
 		/* Vertical blank interrupts */
 		if (G_007EDC_LB_D1_VBLANK_INTERRUPT(rdev->irq.stat_regs.r500.disp_int)) {
 			if (rdev->irq.crtc_vblank_int[0]) {
-				drm_handle_vblank(rdev->ddev, 0);
+				drm_handle_vblank(rdev_to_drm(rdev), 0);
 				rdev->pm.vblank_sync = true;
 				wake_up(&rdev->irq.vblank_queue);
 			}
@@ -807,7 +807,7 @@
 		}
 		if (G_007EDC_LB_D2_VBLANK_INTERRUPT(rdev->irq.stat_regs.r500.disp_int)) {
 			if (rdev->irq.crtc_vblank_int[1]) {
-				drm_handle_vblank(rdev->ddev, 1);
+				drm_handle_vblank(rdev_to_drm(rdev), 1);
 				rdev->pm.vblank_sync = true;
 				wake_up(&rdev->irq.vblank_queue);
 			}
@@ -1134,7 +1134,7 @@
 		return -EINVAL;
 
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* initialize memory controller */
 	rs600_mc_init(rdev);
 	r100_debugfs_rbbm_init(rdev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/rs690.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/rs690.c
@@ -845,7 +845,7 @@
 		return -EINVAL;
 
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* initialize memory controller */
 	rs690_mc_init(rdev);
 	rv515_debugfs(rdev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/rv515.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/rv515.c
@@ -255,7 +255,7 @@
 void rv515_debugfs(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-	struct dentry *root = rdev->ddev->primary->debugfs_root;
+	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
 
 	debugfs_create_file("rv515_pipes_info", 0444, root, rdev,
 			    &rv515_debugfs_pipes_info_fops);
@@ -636,7 +636,7 @@
 	if (radeon_boot_test_post_card(rdev) == false)
 		return -EINVAL;
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* initialize AGP */
 	if (rdev->flags & RADEON_IS_AGP) {
 		r = radeon_agp_init(rdev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/rv770.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/rv770.c
@@ -1935,7 +1935,7 @@
 	/* Initialize surface registers */
 	radeon_surface_init(rdev);
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 	/* Fence driver */
 	radeon_fence_driver_init(rdev);
 	/* initialize AGP */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/si.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/si.c
@@ -6296,7 +6296,7 @@
 				event_name = "vblank";
 
 				if (rdev->irq.crtc_vblank_int[crtc_idx]) {
-					drm_handle_vblank(rdev->ddev, crtc_idx);
+					drm_handle_vblank(rdev_to_drm(rdev), crtc_idx);
 					rdev->pm.vblank_sync = true;
 					wake_up(&rdev->irq.vblank_queue);
 				}
@@ -6858,7 +6858,7 @@
 	/* Initialize surface registers */
 	radeon_surface_init(rdev);
 	/* Initialize clocks */
-	radeon_get_clock_info(rdev->ddev);
+	radeon_get_clock_info(rdev_to_drm(rdev));
 
 	/* Fence driver */
 	radeon_fence_driver_init(rdev);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/radeon/sumo_dpm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -1621,6 +1621,8 @@
 
 	for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) {
 		if (table[i].ulSupportedSCLK != 0) {
+			if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES)
+				continue;
 			vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit =
 				table[i].usVoltageID;
 			vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit =
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/renesas/shmobile/shmob_drm_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/renesas/shmobile/shmob_drm_drv.c
@@ -171,6 +171,13 @@
 	drm_kms_helper_poll_fini(ddev);
 }
 
+static void shmob_drm_shutdown(struct platform_device *pdev)
+{
+	struct shmob_drm_device *sdev = platform_get_drvdata(pdev);
+
+	drm_atomic_helper_shutdown(&sdev->ddev);
+}
+
 static int shmob_drm_probe(struct platform_device *pdev)
 {
 	struct shmob_drm_platform_data *pdata = pdev->dev.platform_data;
@@ -273,6 +280,7 @@
 static struct platform_driver shmob_drm_platform_driver = {
 	.probe		= shmob_drm_probe,
 	.remove_new	= shmob_drm_remove,
+	.shutdown	= shmob_drm_shutdown,
 	.driver		= {
 		.name	= "shmob-drm",
 		.of_match_table = of_match_ptr(shmob_drm_of_table),
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
@@ -434,6 +434,8 @@
 		HIWORD_UPDATE(RK3328_HDMI_SDAIN_MSK | RK3328_HDMI_SCLIN_MSK,
 			      RK3328_HDMI_SDAIN_MSK | RK3328_HDMI_SCLIN_MSK |
 			      RK3328_HDMI_HPD_IOE));
+
+	dw_hdmi_rk3328_read_hpd(dw_hdmi, data);
 }
 
 static const struct dw_hdmi_phy_ops rk3228_hdmi_phy_ops = {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/rockchip/inno_hdmi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/rockchip/inno_hdmi.c
@@ -411,7 +411,7 @@
 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HBLANK_L, value & 0xFF);
 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HBLANK_H, (value >> 8) & 0xFF);
 
-	value = mode->hsync_start - mode->hdisplay;
+	value = mode->htotal - mode->hsync_start;
 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HDELAY_L, value & 0xFF);
 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HDELAY_H, (value >> 8) & 0xFF);
 
@@ -426,7 +426,7 @@
 	value = mode->vtotal - mode->vdisplay;
 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_VBLANK, value & 0xFF);
 
-	value = mode->vsync_start - mode->vdisplay;
+	value = mode->vtotal - mode->vsync_start;
 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_VDELAY, value & 0xFF);
 
 	value = mode->vsync_end - mode->vsync_start;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -396,8 +396,8 @@
 	if (info->is_yuv)
 		is_yuv = true;
 
-	if (dst_w > 3840) {
-		DRM_DEV_ERROR(vop->dev, "Maximum dst width (3840) exceeded\n");
+	if (dst_w > 4096) {
+		DRM_DEV_ERROR(vop->dev, "Maximum dst width (4096) exceeded\n");
 		return;
 	}
 
@@ -1093,10 +1093,10 @@
 	if (!plane->state->fb)
 		return -EINVAL;
 
-	if (state)
-		crtc_state = drm_atomic_get_existing_crtc_state(state,
-								new_plane_state->crtc);
-	else /* Special case for asynchronous cursor updates. */
+	crtc_state = drm_atomic_get_existing_crtc_state(state, new_plane_state->crtc);
+
+	/* Special case for asynchronous cursor updates. */
+	if (!crtc_state)
 		crtc_state = plane->crtc->state;
 
 	return drm_atomic_helper_check_plane_state(plane->state, crtc_state,
@@ -1583,6 +1583,10 @@
 	VOP_AFBC_SET(vop, enable, s->enable_afbc);
 	vop_cfg_done(vop);
 
+	/* Ack the DMA transfer of the previous frame (RK3066). */
+	if (VOP_HAS_REG(vop, common, dma_stop))
+		VOP_REG_SET(vop, common, dma_stop, 0);
+
 	spin_unlock(&vop->reg_lock);
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
@@ -122,6 +122,7 @@
 	struct vop_reg lut_buffer_index;
 	struct vop_reg gate_en;
 	struct vop_reg mmu_en;
+	struct vop_reg dma_stop;
 	struct vop_reg out_mode;
 	struct vop_reg standby;
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
@@ -706,6 +706,8 @@
 	const struct drm_format_info *info;
 	u16 hor_scl_mode, ver_scl_mode;
 	u16 hscl_filter_mode, vscl_filter_mode;
+	uint16_t cbcr_src_w = src_w;
+	uint16_t cbcr_src_h = src_h;
 	u8 gt2 = 0;
 	u8 gt4 = 0;
 	u32 val;
@@ -763,27 +765,27 @@
 	vop2_win_write(win, VOP2_WIN_YRGB_VSCL_FILTER_MODE, vscl_filter_mode);
 
 	if (info->is_yuv) {
-		src_w /= info->hsub;
-		src_h /= info->vsub;
+		cbcr_src_w /= info->hsub;
+		cbcr_src_h /= info->vsub;
 
 		gt4 = 0;
 		gt2 = 0;
 
-		if (src_h >= (4 * dst_h)) {
+		if (cbcr_src_h >= (4 * dst_h)) {
 			gt4 = 1;
-			src_h >>= 2;
-		} else if (src_h >= (2 * dst_h)) {
+			cbcr_src_h >>= 2;
+		} else if (cbcr_src_h >= (2 * dst_h)) {
 			gt2 = 1;
-			src_h >>= 1;
+			cbcr_src_h >>= 1;
 		}
 
-		hor_scl_mode = scl_get_scl_mode(src_w, dst_w);
-		ver_scl_mode = scl_get_scl_mode(src_h, dst_h);
+		hor_scl_mode = scl_get_scl_mode(cbcr_src_w, dst_w);
+		ver_scl_mode = scl_get_scl_mode(cbcr_src_h, dst_h);
 
-		val = vop2_scale_factor(src_w, dst_w);
+		val = vop2_scale_factor(cbcr_src_w, dst_w);
 		vop2_win_write(win, VOP2_WIN_SCALE_CBCR_X, val);
 
-		val = vop2_scale_factor(src_h, dst_h);
+		val = vop2_scale_factor(cbcr_src_h, dst_h);
 		vop2_win_write(win, VOP2_WIN_SCALE_CBCR_Y, val);
 
 		vop2_win_write(win, VOP2_WIN_VSD_CBCR_GT4, gt4);
@@ -2342,7 +2344,7 @@
 		port_sel |= FIELD_PREP(RK3568_OVL_PORT_SET__PORT2_MUX,
 			(vp2->nlayers + vp1->nlayers + vp0->nlayers - 1));
 	else
-		port_sel |= FIELD_PREP(RK3568_OVL_PORT_SET__PORT1_MUX, 8);
+		port_sel |= FIELD_PREP(RK3568_OVL_PORT_SET__PORT2_MUX, 8);
 
 	layer_sel = vop2_readl(vop2, RK3568_OVL_LAYER_SEL);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/rockchip/rockchip_lvds.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/rockchip/rockchip_lvds.c
@@ -576,8 +576,7 @@
 		ret = -EINVAL;
 		goto err_put_port;
 	} else if (ret) {
-		DRM_DEV_ERROR(dev, "failed to find panel and bridge node\n");
-		ret = -EPROBE_DEFER;
+		dev_err_probe(dev, ret, "failed to find panel and bridge node\n");
 		goto err_put_port;
 	}
 	if (lvds->panel)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c
@@ -17,9 +17,7 @@
 
 static const uint32_t formats_cluster[] = {
 	DRM_FORMAT_XRGB2101010,
-	DRM_FORMAT_ARGB2101010,
 	DRM_FORMAT_XBGR2101010,
-	DRM_FORMAT_ABGR2101010,
 	DRM_FORMAT_XRGB8888,
 	DRM_FORMAT_ARGB8888,
 	DRM_FORMAT_XBGR8888,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
@@ -455,6 +455,7 @@
 };
 
 static const struct vop_common rk3066_common = {
+	.dma_stop = VOP_REG(RK3066_SYS_CTRL0, 0x1, 0),
 	.standby = VOP_REG(RK3066_SYS_CTRL0, 0x1, 1),
 	.out_mode = VOP_REG(RK3066_DSP_CTRL0, 0xf, 0),
 	.cfg_done = VOP_REG(RK3066_REG_CFG_DONE, 0x1, 0),
@@ -503,6 +504,7 @@
 	.output = &rk3066_output,
 	.win = rk3066_vop_win_data,
 	.win_size = ARRAY_SIZE(rk3066_vop_win_data),
+	.feature = VOP_FEATURE_INTERNAL_RGB,
 	.max_output = { 1920, 1080 },
 };
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/scheduler/sched_entity.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/scheduler/sched_entity.c
@@ -71,13 +71,19 @@
 	entity->guilty = guilty;
 	entity->num_sched_list = num_sched_list;
 	entity->priority = priority;
+	/*
+	 * It's perfectly valid to initialize an entity without having a valid
+	 * scheduler attached. It's just not valid to use the scheduler before it
+	 * is initialized itself.
+	 */
 	entity->sched_list = num_sched_list > 1 ? sched_list : NULL;
 	RCU_INIT_POINTER(entity->last_scheduled, NULL);
 	RB_CLEAR_NODE(&entity->rb_tree_node);
 
-	if (!sched_list[0]->sched_rq) {
-		/* Warn drivers not to do this and to fix their DRM
-		 * calling order.
+	if (num_sched_list && !sched_list[0]->sched_rq) {
+		/* Since every entry covered by num_sched_list
+		 * should be non-NULL and therefore we warn drivers
+		 * not to do this and to fix their DRM calling order.
 		 */
 		pr_warn("%s: called with uninitialized scheduler\n", __func__);
 	} else if (num_sched_list) {
@@ -127,8 +133,10 @@
 {
 	WARN_ON(!num_sched_list || !sched_list);
 
+	spin_lock(&entity->rq_lock);
 	entity->sched_list = sched_list;
 	entity->num_sched_list = num_sched_list;
+	spin_unlock(&entity->rq_lock);
 }
 EXPORT_SYMBOL(drm_sched_entity_modify_sched);
 
@@ -374,7 +382,7 @@
 		container_of(cb, struct drm_sched_entity, cb);
 
 	drm_sched_entity_clear_dep(f, cb);
-	drm_sched_wakeup(entity->rq->sched, entity);
+	drm_sched_wakeup(entity->rq->sched);
 }
 
 /**
@@ -591,6 +599,9 @@
 
 	/* first job wakes up scheduler */
 	if (first) {
+		struct drm_gpu_scheduler *sched;
+		struct drm_sched_rq *rq;
+
 		/* Add the entity to the run queue */
 		spin_lock(&entity->rq_lock);
 		if (entity->stopped) {
@@ -600,13 +611,16 @@
 			return;
 		}
 
-		drm_sched_rq_add_entity(entity->rq, entity);
+		rq = entity->rq;
+		sched = rq->sched;
+
+		drm_sched_rq_add_entity(rq, entity);
 		spin_unlock(&entity->rq_lock);
 
 		if (drm_sched_policy == DRM_SCHED_POLICY_FIFO)
 			drm_sched_rq_update_fifo(entity, submit_ts);
 
-		drm_sched_wakeup(entity->rq->sched, entity);
+		drm_sched_wakeup(sched);
 	}
 }
 EXPORT_SYMBOL(drm_sched_entity_push_job);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/scheduler/sched_main.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/scheduler/sched_main.c
@@ -806,6 +806,14 @@
 		return -EINVAL;
 	}
 
+	/*
+	 * We don't know for sure how the user has allocated. Thus, zero the
+	 * struct so that unallowed (i.e., too early) usage of pointers that
+	 * this function does not set is guaranteed to lead to a NULL pointer
+	 * exception instead of UB.
+	 */
+	memset(job, 0, sizeof(*job));
+
 	job->entity = entity;
 	job->credits = credits;
 	job->s_fence = drm_sched_fence_alloc(entity, owner);
@@ -1022,15 +1030,12 @@
 /**
  * drm_sched_wakeup - Wake up the scheduler if it is ready to queue
  * @sched: scheduler instance
- * @entity: the scheduler entity
  *
  * Wake up the scheduler if we can queue jobs.
  */
-void drm_sched_wakeup(struct drm_gpu_scheduler *sched,
-		      struct drm_sched_entity *entity)
+void drm_sched_wakeup(struct drm_gpu_scheduler *sched)
 {
-	if (drm_sched_can_queue(sched, entity))
-		drm_sched_run_job_queue(sched);
+	drm_sched_run_job_queue(sched);
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/sti/sti_cursor.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/sti/sti_cursor.c
@@ -200,6 +200,9 @@
 		return 0;
 
 	crtc_state = drm_atomic_get_crtc_state(state, crtc);
+	if (IS_ERR(crtc_state))
+		return PTR_ERR(crtc_state);
+
 	mode = &crtc_state->mode;
 	dst_x = new_plane_state->crtc_x;
 	dst_y = new_plane_state->crtc_y;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/sti/sti_gdp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/sti/sti_gdp.c
@@ -638,6 +638,9 @@
 
 	mixer = to_sti_mixer(crtc);
 	crtc_state = drm_atomic_get_crtc_state(state, crtc);
+	if (IS_ERR(crtc_state))
+		return PTR_ERR(crtc_state);
+
 	mode = &crtc_state->mode;
 	dst_x = new_plane_state->crtc_x;
 	dst_y = new_plane_state->crtc_y;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/sti/sti_hqvdp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/sti/sti_hqvdp.c
@@ -1037,6 +1037,9 @@
 		return 0;
 
 	crtc_state = drm_atomic_get_crtc_state(state, crtc);
+	if (IS_ERR(crtc_state))
+		return PTR_ERR(crtc_state);
+
 	mode = &crtc_state->mode;
 	dst_x = new_plane_state->crtc_x;
 	dst_y = new_plane_state->crtc_y;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/sti/sti_mixer.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/sti/sti_mixer.c
@@ -137,7 +137,7 @@
 	}
 }
 
-static void mixer_dbg_mxn(struct seq_file *s, void *addr)
+static void mixer_dbg_mxn(struct seq_file *s, void __iomem *addr)
 {
 	int i;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/stm/drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/stm/drv.c
@@ -25,6 +25,7 @@
 #include <drm/drm_module.h>
 #include <drm/drm_probe_helper.h>
 #include <drm/drm_vblank.h>
+#include <drm/drm_managed.h>
 
 #include "ltdc.h"
 
@@ -75,7 +76,7 @@
 
 	DRM_DEBUG("%s\n", __func__);
 
-	ldev = devm_kzalloc(ddev->dev, sizeof(*ldev), GFP_KERNEL);
+	ldev = drmm_kzalloc(ddev, sizeof(*ldev), GFP_KERNEL);
 	if (!ldev)
 		return -ENOMEM;
 
@@ -203,12 +204,14 @@
 
 	ret = drm_dev_register(ddev, 0);
 	if (ret)
-		goto err_put;
+		goto err_unload;
 
 	drm_fbdev_dma_setup(ddev, 16);
 
 	return 0;
 
+err_unload:
+	drv_unload(ddev);
 err_put:
 	drm_dev_put(ddev);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/stm/ltdc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/stm/ltdc.c
@@ -36,6 +36,7 @@
 #include <drm/drm_probe_helper.h>
 #include <drm/drm_simple_kms_helper.h>
 #include <drm/drm_vblank.h>
+#include <drm/drm_managed.h>
 
 #include <video/videomode.h>
 
@@ -1199,7 +1200,6 @@
 }
 
 static const struct drm_crtc_funcs ltdc_crtc_funcs = {
-	.destroy = drm_crtc_cleanup,
 	.set_config = drm_atomic_helper_set_config,
 	.page_flip = drm_atomic_helper_page_flip,
 	.reset = drm_atomic_helper_crtc_reset,
@@ -1212,7 +1212,6 @@
 };
 
 static const struct drm_crtc_funcs ltdc_crtc_with_crc_support_funcs = {
-	.destroy = drm_crtc_cleanup,
 	.set_config = drm_atomic_helper_set_config,
 	.page_flip = drm_atomic_helper_page_flip,
 	.reset = drm_atomic_helper_crtc_reset,
@@ -1514,6 +1513,9 @@
 	/* Disable layer */
 	regmap_write_bits(ldev->regmap, LTDC_L1CR + lofs, LXCR_LEN | LXCR_CLUTEN |  LXCR_HMEN, 0);
 
+	/* Reset the layer transparency to hide any related background color */
+	regmap_write_bits(ldev->regmap, LTDC_L1CACR + lofs, LXCACR_CONSTA, 0x00);
+
 	/* Commit shadow registers = update plane at next vblank */
 	if (ldev->caps.plane_reg_shadow)
 		regmap_write_bits(ldev->regmap, LTDC_L1RCR + lofs,
@@ -1545,7 +1547,6 @@
 static const struct drm_plane_funcs ltdc_plane_funcs = {
 	.update_plane = drm_atomic_helper_update_plane,
 	.disable_plane = drm_atomic_helper_disable_plane,
-	.destroy = drm_plane_cleanup,
 	.reset = drm_atomic_helper_plane_reset,
 	.atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
@@ -1572,7 +1573,6 @@
 	const u64 *modifiers = ltdc_format_modifiers;
 	u32 lofs = index * LAY_OFS;
 	u32 val;
-	int ret;
 
 	/* Allocate the biggest size according to supported color formats */
 	formats = devm_kzalloc(dev, (ldev->caps.pix_fmt_nb +
@@ -1580,6 +1580,8 @@
 			       ARRAY_SIZE(ltdc_drm_fmt_ycbcr_sp) +
 			       ARRAY_SIZE(ltdc_drm_fmt_ycbcr_fp)) *
 			       sizeof(*formats), GFP_KERNEL);
+	if (!formats)
+		return NULL;
 
 	for (i = 0; i < ldev->caps.pix_fmt_nb; i++) {
 		drm_fmt = ldev->caps.pix_fmt_drm[i];
@@ -1613,14 +1615,10 @@
 		}
 	}
 
-	plane = devm_kzalloc(dev, sizeof(*plane), GFP_KERNEL);
-	if (!plane)
-		return NULL;
-
-	ret = drm_universal_plane_init(ddev, plane, possible_crtcs,
-				       &ltdc_plane_funcs, formats, nb_fmt,
-				       modifiers, type, NULL);
-	if (ret < 0)
+	plane = drmm_universal_plane_alloc(ddev, struct drm_plane, dev,
+					   possible_crtcs, &ltdc_plane_funcs, formats,
+					   nb_fmt, modifiers, type, NULL);
+	if (IS_ERR(plane))
 		return NULL;
 
 	if (ldev->caps.ycbcr_input) {
@@ -1643,15 +1641,6 @@
 	return plane;
 }
 
-static void ltdc_plane_destroy_all(struct drm_device *ddev)
-{
-	struct drm_plane *plane, *plane_temp;
-
-	list_for_each_entry_safe(plane, plane_temp,
-				 &ddev->mode_config.plane_list, head)
-		drm_plane_cleanup(plane);
-}
-
 static int ltdc_crtc_init(struct drm_device *ddev, struct drm_crtc *crtc)
 {
 	struct ltdc_device *ldev = ddev->dev_private;
@@ -1677,14 +1666,14 @@
 
 	/* Init CRTC according to its hardware features */
 	if (ldev->caps.crc)
-		ret = drm_crtc_init_with_planes(ddev, crtc, primary, NULL,
-						&ltdc_crtc_with_crc_support_funcs, NULL);
+		ret = drmm_crtc_init_with_planes(ddev, crtc, primary, NULL,
+						 &ltdc_crtc_with_crc_support_funcs, NULL);
 	else
-		ret = drm_crtc_init_with_planes(ddev, crtc, primary, NULL,
-						&ltdc_crtc_funcs, NULL);
+		ret = drmm_crtc_init_with_planes(ddev, crtc, primary, NULL,
+						 &ltdc_crtc_funcs, NULL);
 	if (ret) {
 		DRM_ERROR("Can not initialize CRTC\n");
-		goto cleanup;
+		return ret;
 	}
 
 	drm_crtc_helper_add(crtc, &ltdc_crtc_helper_funcs);
@@ -1698,9 +1687,8 @@
 	for (i = 1; i < ldev->caps.nb_layers; i++) {
 		overlay = ltdc_plane_create(ddev, DRM_PLANE_TYPE_OVERLAY, i);
 		if (!overlay) {
-			ret = -ENOMEM;
 			DRM_ERROR("Can not create overlay plane %d\n", i);
-			goto cleanup;
+			return -ENOMEM;
 		}
 		if (ldev->caps.dynamic_zorder)
 			drm_plane_create_zpos_property(overlay, i, 0, ldev->caps.nb_layers - 1);
@@ -1713,10 +1701,6 @@
 	}
 
 	return 0;
-
-cleanup:
-	ltdc_plane_destroy_all(ddev);
-	return ret;
 }
 
 static void ltdc_encoder_disable(struct drm_encoder *encoder)
@@ -1776,23 +1760,19 @@
 	struct drm_encoder *encoder;
 	int ret;
 
-	encoder = devm_kzalloc(ddev->dev, sizeof(*encoder), GFP_KERNEL);
-	if (!encoder)
-		return -ENOMEM;
+	encoder = drmm_simple_encoder_alloc(ddev, struct drm_encoder, dev,
+					    DRM_MODE_ENCODER_DPI);
+	if (IS_ERR(encoder))
+		return PTR_ERR(encoder);
 
 	encoder->possible_crtcs = CRTC_MASK;
 	encoder->possible_clones = 0;	/* No cloning support */
 
-	drm_simple_encoder_init(ddev, encoder, DRM_MODE_ENCODER_DPI);
-
 	drm_encoder_helper_add(encoder, &ltdc_encoder_helper_funcs);
 
 	ret = drm_bridge_attach(encoder, bridge, NULL, 0);
-	if (ret) {
-		if (ret != -EPROBE_DEFER)
-			drm_encoder_cleanup(encoder);
+	if (ret)
 		return ret;
-	}
 
 	DRM_DEBUG_DRIVER("Bridge encoder:%d created\n", encoder->base.id);
 
@@ -1962,8 +1942,7 @@
 			goto err;
 
 		if (panel) {
-			bridge = drm_panel_bridge_add_typed(panel,
-							    DRM_MODE_CONNECTOR_DPI);
+			bridge = drmm_panel_bridge_add(ddev, panel);
 			if (IS_ERR(bridge)) {
 				DRM_ERROR("panel-bridge endpoint %d\n", i);
 				ret = PTR_ERR(bridge);
@@ -2045,7 +2024,7 @@
 		}
 	}
 
-	crtc = devm_kzalloc(dev, sizeof(*crtc), GFP_KERNEL);
+	crtc = drmm_kzalloc(ddev, sizeof(*crtc), GFP_KERNEL);
 	if (!crtc) {
 		DRM_ERROR("Failed to allocate crtc\n");
 		ret = -ENOMEM;
@@ -2072,9 +2051,6 @@
 
 	return 0;
 err:
-	for (i = 0; i < nb_endpoints; i++)
-		drm_of_panel_bridge_remove(ddev->dev->of_node, 0, i);
-
 	clk_disable_unprepare(ldev->pixel_clk);
 
 	return ret;
@@ -2082,16 +2058,8 @@
 
 void ltdc_unload(struct drm_device *ddev)
 {
-	struct device *dev = ddev->dev;
-	int nb_endpoints, i;
-
 	DRM_DEBUG_DRIVER("\n");
 
-	nb_endpoints = of_graph_get_endpoint_count(dev->of_node);
-
-	for (i = 0; i < nb_endpoints; i++)
-		drm_of_panel_bridge_remove(ddev->dev->of_node, 0, i);
-
 	pm_runtime_disable(ddev->dev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -82,7 +82,8 @@
 	return 0;
 }
 
-static void sun4i_hdmi_disable(struct drm_encoder *encoder)
+static void sun4i_hdmi_disable(struct drm_encoder *encoder,
+			       struct drm_atomic_state *state)
 {
 	struct sun4i_hdmi *hdmi = drm_encoder_to_sun4i_hdmi(encoder);
 	u32 val;
@@ -96,37 +97,17 @@
 	clk_disable_unprepare(hdmi->tmds_clk);
 }
 
-static void sun4i_hdmi_enable(struct drm_encoder *encoder)
+static void sun4i_hdmi_enable(struct drm_encoder *encoder,
+			      struct drm_atomic_state *state)
 {
 	struct drm_display_mode *mode = &encoder->crtc->state->adjusted_mode;
 	struct sun4i_hdmi *hdmi = drm_encoder_to_sun4i_hdmi(encoder);
 	struct drm_display_info *display = &hdmi->connector.display_info;
+	unsigned int x, y;
 	u32 val = 0;
 
 	DRM_DEBUG_DRIVER("Enabling the HDMI Output\n");
 
-	clk_prepare_enable(hdmi->tmds_clk);
-
-	sun4i_hdmi_setup_avi_infoframes(hdmi, mode);
-	val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
-	val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END);
-	writel(val, hdmi->base + SUN4I_HDMI_PKT_CTRL_REG(0));
-
-	val = SUN4I_HDMI_VID_CTRL_ENABLE;
-	if (display->is_hdmi)
-		val |= SUN4I_HDMI_VID_CTRL_HDMI_MODE;
-
-	writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
-}
-
-static void sun4i_hdmi_mode_set(struct drm_encoder *encoder,
-				struct drm_display_mode *mode,
-				struct drm_display_mode *adjusted_mode)
-{
-	struct sun4i_hdmi *hdmi = drm_encoder_to_sun4i_hdmi(encoder);
-	unsigned int x, y;
-	u32 val;
-
 	clk_set_rate(hdmi->mod_clk, mode->crtc_clock * 1000);
 	clk_set_rate(hdmi->tmds_clk, mode->crtc_clock * 1000);
 
@@ -178,6 +159,19 @@
 		val |= SUN4I_HDMI_VID_TIMING_POL_VSYNC;
 
 	writel(val, hdmi->base + SUN4I_HDMI_VID_TIMING_POL_REG);
+
+	clk_prepare_enable(hdmi->tmds_clk);
+
+	sun4i_hdmi_setup_avi_infoframes(hdmi, mode);
+	val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
+	val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END);
+	writel(val, hdmi->base + SUN4I_HDMI_PKT_CTRL_REG(0));
+
+	val = SUN4I_HDMI_VID_CTRL_ENABLE;
+	if (display->is_hdmi)
+		val |= SUN4I_HDMI_VID_CTRL_HDMI_MODE;
+
+	writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
 }
 
 static enum drm_mode_status sun4i_hdmi_mode_valid(struct drm_encoder *encoder,
@@ -201,9 +195,8 @@
 
 static const struct drm_encoder_helper_funcs sun4i_hdmi_helper_funcs = {
 	.atomic_check	= sun4i_hdmi_atomic_check,
-	.disable	= sun4i_hdmi_disable,
-	.enable		= sun4i_hdmi_enable,
-	.mode_set	= sun4i_hdmi_mode_set,
+	.atomic_disable	= sun4i_hdmi_disable,
+	.atomic_enable	= sun4i_hdmi_enable,
 	.mode_valid	= sun4i_hdmi_mode_valid,
 };
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tegra/dpaux.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tegra/dpaux.c
@@ -522,7 +522,7 @@
 	if (err < 0) {
 		dev_err(dpaux->dev, "failed to request IRQ#%u: %d\n",
 			dpaux->irq, err);
-		return err;
+		goto err_pm_disable;
 	}
 
 	disable_irq(dpaux->irq);
@@ -542,7 +542,7 @@
 	 */
 	err = tegra_dpaux_pad_config(dpaux, DPAUX_PADCTL_FUNC_I2C);
 	if (err < 0)
-		return err;
+		goto err_pm_disable;
 
 #ifdef CONFIG_GENERIC_PINCONF
 	dpaux->desc.name = dev_name(&pdev->dev);
@@ -555,7 +555,8 @@
 	dpaux->pinctrl = devm_pinctrl_register(&pdev->dev, &dpaux->desc, dpaux);
 	if (IS_ERR(dpaux->pinctrl)) {
 		dev_err(&pdev->dev, "failed to register pincontrol\n");
-		return PTR_ERR(dpaux->pinctrl);
+		err = PTR_ERR(dpaux->pinctrl);
+		goto err_pm_disable;
 	}
 #endif
 	/* enable and clear all interrupts */
@@ -571,10 +572,15 @@
 	err = devm_of_dp_aux_populate_ep_devices(&dpaux->aux);
 	if (err < 0) {
 		dev_err(dpaux->dev, "failed to populate AUX bus: %d\n", err);
-		return err;
+		goto err_pm_disable;
 	}
 
 	return 0;
+
+err_pm_disable:
+	pm_runtime_put_sync(&pdev->dev);
+	pm_runtime_disable(&pdev->dev);
+	return err;
 }
 
 static void tegra_dpaux_remove(struct platform_device *pdev)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tegra/dsi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tegra/dsi.c
@@ -1544,9 +1544,11 @@
 	np = of_parse_phandle(dsi->dev->of_node, "nvidia,ganged-mode", 0);
 	if (np) {
 		struct platform_device *gangster = of_find_device_by_node(np);
+		of_node_put(np);
+		if (!gangster)
+			return -EPROBE_DEFER;
 
 		dsi->slave = platform_get_drvdata(gangster);
-		of_node_put(np);
 
 		if (!dsi->slave) {
 			put_device(&gangster->dev);
@@ -1594,44 +1596,58 @@
 
 	if (!pdev->dev.pm_domain) {
 		dsi->rst = devm_reset_control_get(&pdev->dev, "dsi");
-		if (IS_ERR(dsi->rst))
-			return PTR_ERR(dsi->rst);
+		if (IS_ERR(dsi->rst)) {
+			err = PTR_ERR(dsi->rst);
+			goto remove;
+		}
 	}
 
 	dsi->clk = devm_clk_get(&pdev->dev, NULL);
-	if (IS_ERR(dsi->clk))
-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk),
-				     "cannot get DSI clock\n");
+	if (IS_ERR(dsi->clk)) {
+		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk),
+				    "cannot get DSI clock\n");
+		goto remove;
+	}
 
 	dsi->clk_lp = devm_clk_get(&pdev->dev, "lp");
-	if (IS_ERR(dsi->clk_lp))
-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_lp),
-				     "cannot get low-power clock\n");
+	if (IS_ERR(dsi->clk_lp)) {
+		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_lp),
+				    "cannot get low-power clock\n");
+		goto remove;
+	}
 
 	dsi->clk_parent = devm_clk_get(&pdev->dev, "parent");
-	if (IS_ERR(dsi->clk_parent))
-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_parent),
-				     "cannot get parent clock\n");
+	if (IS_ERR(dsi->clk_parent)) {
+		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_parent),
+				    "cannot get parent clock\n");
+		goto remove;
+	}
 
 	dsi->vdd = devm_regulator_get(&pdev->dev, "avdd-dsi-csi");
-	if (IS_ERR(dsi->vdd))
-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->vdd),
-				     "cannot get VDD supply\n");
+	if (IS_ERR(dsi->vdd)) {
+		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->vdd),
+				    "cannot get VDD supply\n");
+		goto remove;
+	}
 
 	err = tegra_dsi_setup_clocks(dsi);
 	if (err < 0) {
 		dev_err(&pdev->dev, "cannot setup clocks\n");
-		return err;
+		goto remove;
 	}
 
 	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	dsi->regs = devm_ioremap_resource(&pdev->dev, regs);
-	if (IS_ERR(dsi->regs))
-		return PTR_ERR(dsi->regs);
+	if (IS_ERR(dsi->regs)) {
+		err = PTR_ERR(dsi->regs);
+		goto remove;
+	}
 
 	dsi->mipi = tegra_mipi_request(&pdev->dev, pdev->dev.of_node);
-	if (IS_ERR(dsi->mipi))
-		return PTR_ERR(dsi->mipi);
+	if (IS_ERR(dsi->mipi)) {
+		err = PTR_ERR(dsi->mipi);
+		goto remove;
+	}
 
 	dsi->host.ops = &tegra_dsi_host_ops;
 	dsi->host.dev = &pdev->dev;
@@ -1659,9 +1675,12 @@
 	return 0;
 
 unregister:
+	pm_runtime_disable(&pdev->dev);
 	mipi_dsi_host_unregister(&dsi->host);
 mipi_free:
 	tegra_mipi_free(dsi->mipi);
+remove:
+	tegra_output_remove(&dsi->output);
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tegra/fb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tegra/fb.c
@@ -159,6 +159,7 @@
 
 		if (gem->size < size) {
 			err = -EINVAL;
+			drm_gem_object_put(gem);
 			goto unreference;
 		}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tegra/hdmi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tegra/hdmi.c
@@ -1856,12 +1856,14 @@
 		return err;
 
 	hdmi->regs = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(hdmi->regs))
-		return PTR_ERR(hdmi->regs);
+	if (IS_ERR(hdmi->regs)) {
+		err = PTR_ERR(hdmi->regs);
+		goto remove;
+	}
 
 	err = platform_get_irq(pdev, 0);
 	if (err < 0)
-		return err;
+		goto remove;
 
 	hdmi->irq = err;
 
@@ -1870,18 +1872,18 @@
 	if (err < 0) {
 		dev_err(&pdev->dev, "failed to request IRQ#%u: %d\n",
 			hdmi->irq, err);
-		return err;
+		goto remove;
 	}
 
 	platform_set_drvdata(pdev, hdmi);
 
 	err = devm_pm_runtime_enable(&pdev->dev);
 	if (err)
-		return err;
+		goto remove;
 
 	err = devm_tegra_core_dev_init_opp_table_common(&pdev->dev);
 	if (err)
-		return err;
+		goto remove;
 
 	INIT_LIST_HEAD(&hdmi->client.list);
 	hdmi->client.ops = &hdmi_client_ops;
@@ -1891,10 +1893,14 @@
 	if (err < 0) {
 		dev_err(&pdev->dev, "failed to register host1x client: %d\n",
 			err);
-		return err;
+		goto remove;
 	}
 
 	return 0;
+
+remove:
+	tegra_output_remove(&hdmi->output);
+	return err;
 }
 
 static void tegra_hdmi_remove(struct platform_device *pdev)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tegra/output.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tegra/output.c
@@ -142,8 +142,10 @@
 					GPIOD_IN,
 					"HDMI hotplug detect");
 	if (IS_ERR(output->hpd_gpio)) {
-		if (PTR_ERR(output->hpd_gpio) != -ENOENT)
-			return PTR_ERR(output->hpd_gpio);
+		if (PTR_ERR(output->hpd_gpio) != -ENOENT) {
+			err = PTR_ERR(output->hpd_gpio);
+			goto put_i2c;
+		}
 
 		output->hpd_gpio = NULL;
 	}
@@ -152,7 +154,7 @@
 		err = gpiod_to_irq(output->hpd_gpio);
 		if (err < 0) {
 			dev_err(output->dev, "gpiod_to_irq(): %d\n", err);
-			return err;
+			goto put_i2c;
 		}
 
 		output->hpd_irq = err;
@@ -165,7 +167,7 @@
 		if (err < 0) {
 			dev_err(output->dev, "failed to request IRQ#%u: %d\n",
 				output->hpd_irq, err);
-			return err;
+			goto put_i2c;
 		}
 
 		output->connector.polled = DRM_CONNECTOR_POLL_HPD;
@@ -179,6 +181,12 @@
 	}
 
 	return 0;
+
+put_i2c:
+	if (output->ddc)
+		i2c_put_adapter(output->ddc);
+
+	return err;
 }
 
 void tegra_output_remove(struct tegra_output *output)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tegra/rgb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tegra/rgb.c
@@ -225,26 +225,28 @@
 	rgb->clk = devm_clk_get(dc->dev, NULL);
 	if (IS_ERR(rgb->clk)) {
 		dev_err(dc->dev, "failed to get clock\n");
-		return PTR_ERR(rgb->clk);
+		err = PTR_ERR(rgb->clk);
+		goto remove;
 	}
 
 	rgb->clk_parent = devm_clk_get(dc->dev, "parent");
 	if (IS_ERR(rgb->clk_parent)) {
 		dev_err(dc->dev, "failed to get parent clock\n");
-		return PTR_ERR(rgb->clk_parent);
+		err = PTR_ERR(rgb->clk_parent);
+		goto remove;
 	}
 
 	err = clk_set_parent(rgb->clk, rgb->clk_parent);
 	if (err < 0) {
 		dev_err(dc->dev, "failed to set parent clock: %d\n", err);
-		return err;
+		goto remove;
 	}
 
 	rgb->pll_d_out0 = clk_get_sys(NULL, "pll_d_out0");
 	if (IS_ERR(rgb->pll_d_out0)) {
 		err = PTR_ERR(rgb->pll_d_out0);
 		dev_err(dc->dev, "failed to get pll_d_out0: %d\n", err);
-		return err;
+		goto remove;
 	}
 
 	if (dc->soc->has_pll_d2_out0) {
@@ -252,13 +254,19 @@
 		if (IS_ERR(rgb->pll_d2_out0)) {
 			err = PTR_ERR(rgb->pll_d2_out0);
 			dev_err(dc->dev, "failed to get pll_d2_out0: %d\n", err);
-			return err;
+			goto put_pll;
 		}
 	}
 
 	dc->rgb = &rgb->output;
 
 	return 0;
+
+put_pll:
+	clk_put(rgb->pll_d_out0);
+remove:
+	tegra_output_remove(&rgb->output);
+	return err;
 }
 
 void tegra_dc_rgb_remove(struct tegra_dc *dc)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tests/drm_buddy_test.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tests/drm_buddy_test.c
@@ -260,30 +260,30 @@
 		KUNIT_ASSERT_FALSE_MSG(test,
 				       drm_buddy_alloc_blocks(&mm, 0, mm_size,
 							      ps, ps, list, 0),
-				       "buddy_alloc hit an error size=%u\n",
+				       "buddy_alloc hit an error size=%lu\n",
 				       ps);
 	} while (++i < n_pages);
 
 	KUNIT_ASSERT_TRUE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
 							   3 * ps, ps, &allocated,
 							   DRM_BUDDY_CONTIGUOUS_ALLOCATION),
-			       "buddy_alloc didn't error size=%u\n", 3 * ps);
+			       "buddy_alloc didn't error size=%lu\n", 3 * ps);
 
 	drm_buddy_free_list(&mm, &middle);
 	KUNIT_ASSERT_TRUE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
 							   3 * ps, ps, &allocated,
 							   DRM_BUDDY_CONTIGUOUS_ALLOCATION),
-			       "buddy_alloc didn't error size=%u\n", 3 * ps);
+			       "buddy_alloc didn't error size=%lu\n", 3 * ps);
 	KUNIT_ASSERT_TRUE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
 							   2 * ps, ps, &allocated,
 							   DRM_BUDDY_CONTIGUOUS_ALLOCATION),
-			       "buddy_alloc didn't error size=%u\n", 2 * ps);
+			       "buddy_alloc didn't error size=%lu\n", 2 * ps);
 
 	drm_buddy_free_list(&mm, &right);
 	KUNIT_ASSERT_TRUE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
 							   3 * ps, ps, &allocated,
 							   DRM_BUDDY_CONTIGUOUS_ALLOCATION),
-			       "buddy_alloc didn't error size=%u\n", 3 * ps);
+			       "buddy_alloc didn't error size=%lu\n", 3 * ps);
 	/*
 	 * At this point we should have enough contiguous space for 2 blocks,
 	 * however they are never buddies (since we freed middle and right) so
@@ -292,13 +292,13 @@
 	KUNIT_ASSERT_FALSE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
 							    2 * ps, ps, &allocated,
 							    DRM_BUDDY_CONTIGUOUS_ALLOCATION),
-			       "buddy_alloc hit an error size=%u\n", 2 * ps);
+			       "buddy_alloc hit an error size=%lu\n", 2 * ps);
 
 	drm_buddy_free_list(&mm, &left);
 	KUNIT_ASSERT_FALSE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
 							    3 * ps, ps, &allocated,
 							    DRM_BUDDY_CONTIGUOUS_ALLOCATION),
-			       "buddy_alloc hit an error size=%u\n", 3 * ps);
+			       "buddy_alloc hit an error size=%lu\n", 3 * ps);
 
 	total = 0;
 	list_for_each_entry(block, &allocated, link)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tests/drm_gem_shmem_test.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tests/drm_gem_shmem_test.c
@@ -102,6 +102,17 @@
 
 	sg_init_one(sgt->sgl, buf, TEST_SIZE);
 
+	/*
+	 * Set the DMA mask to 64-bits and map the sgtables
+	 * otherwise drm_gem_shmem_free will cause a warning
+	 * on debug kernels.
+	 */
+	ret = dma_set_mask(drm_dev->dev, DMA_BIT_MASK(64));
+	KUNIT_ASSERT_EQ(test, ret, 0);
+
+	ret = dma_map_sgtable(drm_dev->dev, sgt, DMA_BIDIRECTIONAL, 0);
+	KUNIT_ASSERT_EQ(test, ret, 0);
+
 	/* Init a mock DMA-BUF */
 	buf_mock.size = TEST_SIZE;
 	attach_mock.dmabuf = &buf_mock;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tests/drm_mm_test.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tests/drm_mm_test.c
@@ -157,7 +157,7 @@
 
 	/* After creation, it should all be one massive hole */
 	if (!assert_one_hole(test, &mm, 0, size)) {
-		KUNIT_FAIL(test, "");
+		KUNIT_FAIL(test, "mm not one hole on creation");
 		goto out;
 	}
 
@@ -171,14 +171,14 @@
 
 	/* After filling the range entirely, there should be no holes */
 	if (!assert_no_holes(test, &mm)) {
-		KUNIT_FAIL(test, "");
+		KUNIT_FAIL(test, "mm has holes when filled");
 		goto out;
 	}
 
 	/* And then after emptying it again, the massive hole should be back */
 	drm_mm_remove_node(&tmp);
 	if (!assert_one_hole(test, &mm, 0, size)) {
-		KUNIT_FAIL(test, "");
+		KUNIT_FAIL(test, "mm does not have single hole after emptying");
 		goto out;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tidss/tidss_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tidss/tidss_crtc.c
@@ -265,6 +265,16 @@
 
 	reinit_completion(&tcrtc->framedone_completion);
 
+	/*
+	 * If a layer is left enabled when the videoport is disabled, and the
+	 * vid pipeline that was used for the layer is taken into use on
+	 * another videoport, the DSS will report sync lost issues. Disable all
+	 * the layers here as a work-around.
+	 */
+	for (u32 layer = 0; layer < tidss->feat->num_planes; layer++)
+		dispc_ovr_enable_layer(tidss->dispc, tcrtc->hw_videoport, layer,
+				       false);
+
 	dispc_vp_disable(tidss->dispc, tcrtc->hw_videoport);
 
 	if (!wait_for_completion_timeout(&tcrtc->framedone_completion,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/tidss/tidss_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/tidss/tidss_plane.c
@@ -213,7 +213,7 @@
 
 	drm_plane_helper_add(&tplane->plane, &tidss_plane_helper_funcs);
 
-	drm_plane_create_zpos_property(&tplane->plane, hw_plane_id, 0,
+	drm_plane_create_zpos_property(&tplane->plane, tidss->num_planes, 0,
 				       num_planes - 1);
 
 	ret = drm_plane_create_color_properties(&tplane->plane,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ttm/ttm_bo.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/ttm/ttm_bo.c
@@ -346,6 +346,7 @@
 		if (!dma_resv_test_signaled(bo->base.resv,
 					    DMA_RESV_USAGE_BOOKKEEP) ||
 		    (want_init_on_free() && (bo->ttm != NULL)) ||
+		    bo->type == ttm_bo_type_sg ||
 		    !dma_resv_trylock(bo->base.resv)) {
 			/* The BO is not idle, resurrect it for delayed destroy */
 			ttm_bo_flush_all_fences(bo);
@@ -770,7 +771,7 @@
  * This function may sleep while waiting for space to become available.
  * Returns:
  * -EBUSY: No space available (only if no_wait == 1).
- * -ENOMEM: Could not allocate memory for the buffer object, either due to
+ * -ENOSPC: Could not allocate space for the buffer object, either due to
  * fragmentation or concurrent allocators.
  * -ERESTARTSYS: An interruptible sleep was interrupted by a signal.
  */
@@ -830,7 +831,7 @@
 			goto error;
 	}
 
-	ret = -ENOMEM;
+	ret = -ENOSPC;
 	if (!type_found) {
 		pr_err(TTM_PFX "No compatible memory type found\n");
 		ret = -EINVAL;
@@ -916,6 +917,9 @@
 		return -EINVAL;
 
 	ret = ttm_bo_move_buffer(bo, placement, ctx);
+	/* For backward compatibility with userspace */
+	if (ret == -ENOSPC)
+		return -ENOMEM;
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -294,7 +294,13 @@
 	enum ttm_caching caching;
 
 	man = ttm_manager_type(bo->bdev, res->mem_type);
-	caching = man->use_tt ? bo->ttm->caching : res->bus.caching;
+	if (man->use_tt) {
+		caching = bo->ttm->caching;
+		if (bo->ttm->page_flags & TTM_TT_FLAG_DECRYPTED)
+			tmp = pgprot_decrypted(tmp);
+	} else  {
+		caching = res->bus.caching;
+	}
 
 	return ttm_prot_from_caching(caching, tmp);
 }
@@ -337,6 +343,8 @@
 		.no_wait_gpu = false
 	};
 	struct ttm_tt *ttm = bo->ttm;
+	struct ttm_resource_manager *man =
+			ttm_manager_type(bo->bdev, bo->resource->mem_type);
 	pgprot_t prot;
 	int ret;
 
@@ -346,7 +354,8 @@
 	if (ret)
 		return ret;
 
-	if (num_pages == 1 && ttm->caching == ttm_cached) {
+	if (num_pages == 1 && ttm->caching == ttm_cached &&
+	    !(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) {
 		/*
 		 * We're mapping a single page, and the desired
 		 * page protection is consistent with the bo.
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ttm/ttm_pool.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/ttm/ttm_pool.c
@@ -288,17 +288,23 @@
 						  enum ttm_caching caching,
 						  unsigned int order)
 {
-	if (pool->use_dma_alloc || pool->nid != NUMA_NO_NODE)
+	if (pool->use_dma_alloc)
 		return &pool->caching[caching].orders[order];
 
 #ifdef CONFIG_X86
 	switch (caching) {
 	case ttm_write_combined:
+		if (pool->nid != NUMA_NO_NODE)
+			return &pool->caching[caching].orders[order];
+
 		if (pool->use_dma32)
 			return &global_dma32_write_combined[order];
 
 		return &global_write_combined[order];
 	case ttm_uncached:
+		if (pool->nid != NUMA_NO_NODE)
+			return &pool->caching[caching].orders[order];
+
 		if (pool->use_dma32)
 			return &global_dma32_uncached[order];
 
@@ -566,11 +572,17 @@
 	pool->use_dma_alloc = use_dma_alloc;
 	pool->use_dma32 = use_dma32;
 
-	if (use_dma_alloc || nid != NUMA_NO_NODE) {
-		for (i = 0; i < TTM_NUM_CACHING_TYPES; ++i)
-			for (j = 0; j < NR_PAGE_ORDERS; ++j)
-				ttm_pool_type_init(&pool->caching[i].orders[j],
-						   pool, i, j);
+	for (i = 0; i < TTM_NUM_CACHING_TYPES; ++i) {
+		for (j = 0; j < NR_PAGE_ORDERS; ++j) {
+			struct ttm_pool_type *pt;
+
+			/* Initialize only pool types which are actually used */
+			pt = ttm_pool_select_type(pool, i, j);
+			if (pt != &pool->caching[i].orders[j])
+				continue;
+
+			ttm_pool_type_init(pt, pool, i, j);
+		}
 	}
 }
 EXPORT_SYMBOL(ttm_pool_init);
@@ -599,10 +611,16 @@
 {
 	unsigned int i, j;
 
-	if (pool->use_dma_alloc || pool->nid != NUMA_NO_NODE) {
-		for (i = 0; i < TTM_NUM_CACHING_TYPES; ++i)
-			for (j = 0; j < NR_PAGE_ORDERS; ++j)
-				ttm_pool_type_fini(&pool->caching[i].orders[j]);
+	for (i = 0; i < TTM_NUM_CACHING_TYPES; ++i) {
+		for (j = 0; j < NR_PAGE_ORDERS; ++j) {
+			struct ttm_pool_type *pt;
+
+			pt = ttm_pool_select_type(pool, i, j);
+			if (pt != &pool->caching[i].orders[j])
+				continue;
+
+			ttm_pool_type_fini(pt);
+		}
 	}
 
 	/* We removed the pool types from the LRU, but we need to also make sure
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/ttm/ttm_tt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/ttm/ttm_tt.c
@@ -31,11 +31,14 @@
 
 #define pr_fmt(fmt) "[TTM] " fmt
 
+#include <linux/cc_platform.h>
 #include <linux/sched.h>
 #include <linux/shmem_fs.h>
 #include <linux/file.h>
 #include <linux/module.h>
 #include <drm/drm_cache.h>
+#include <drm/drm_device.h>
+#include <drm/drm_util.h>
 #include <drm/ttm/ttm_bo.h>
 #include <drm/ttm/ttm_tt.h>
 
@@ -60,6 +63,7 @@
 int ttm_tt_create(struct ttm_buffer_object *bo, bool zero_alloc)
 {
 	struct ttm_device *bdev = bo->bdev;
+	struct drm_device *ddev = bo->base.dev;
 	uint32_t page_flags = 0;
 
 	dma_resv_assert_held(bo->base.resv);
@@ -81,6 +85,15 @@
 		pr_err("Illegal buffer object type\n");
 		return -EINVAL;
 	}
+	/*
+	 * When using dma_alloc_coherent with memory encryption the
+	 * mapped TT pages need to be decrypted or otherwise the drivers
+	 * will end up sending encrypted mem to the gpu.
+	 */
+	if (bdev->pool.use_dma_alloc && cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) {
+		page_flags |= TTM_TT_FLAG_DECRYPTED;
+		drm_info_once(ddev, "TT memory decryption enabled.");
+	}
 
 	bo->ttm = bdev->funcs->ttm_tt_create(bo, page_flags);
 	if (unlikely(bo->ttm == NULL))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/udl/udl_modeset.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/udl/udl_modeset.c
@@ -527,8 +527,7 @@
 
 	drm_connector_helper_add(connector, &udl_connector_helper_funcs);
 
-	connector->polled = DRM_CONNECTOR_POLL_HPD |
-			    DRM_CONNECTOR_POLL_CONNECT |
+	connector->polled = DRM_CONNECTOR_POLL_CONNECT |
 			    DRM_CONNECTOR_POLL_DISCONNECT;
 
 	return connector;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/v3d/v3d_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/v3d/v3d_drv.h
@@ -536,11 +536,16 @@
 void v3d_irq_reset(struct v3d_dev *v3d);
 
 /* v3d_mmu.c */
+int v3d_mmu_flush_all(struct v3d_dev *v3d);
 int v3d_mmu_set_page_table(struct v3d_dev *v3d);
 void v3d_mmu_insert_ptes(struct v3d_bo *bo);
 void v3d_mmu_remove_ptes(struct v3d_bo *bo);
 
 /* v3d_sched.c */
+void v3d_timestamp_query_info_free(struct v3d_timestamp_query_info *query_info,
+				   unsigned int count);
+void v3d_performance_query_info_free(struct v3d_performance_query_info *query_info,
+				     unsigned int count);
 int v3d_sched_init(struct v3d_dev *v3d);
 void v3d_sched_fini(struct v3d_dev *v3d);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/v3d/v3d_irq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/v3d/v3d_irq.c
@@ -70,6 +70,8 @@
 	list_add_tail(&bo->unref_head, &v3d->bin_job->render->unref_list);
 	spin_unlock_irqrestore(&v3d->job_lock, irqflags);
 
+	v3d_mmu_flush_all(v3d);
+
 	V3D_CORE_WRITE(0, V3D_PTB_BPOA, bo->node.start << PAGE_SHIFT);
 	V3D_CORE_WRITE(0, V3D_PTB_BPOS, obj->size);
 
@@ -105,7 +107,6 @@
 		struct v3d_file_priv *file = v3d->bin_job->base.file->driver_priv;
 		u64 runtime = local_clock() - file->start_ns[V3D_BIN];
 
-		file->enabled_ns[V3D_BIN] += local_clock() - file->start_ns[V3D_BIN];
 		file->jobs_sent[V3D_BIN]++;
 		v3d->queue[V3D_BIN].jobs_sent++;
 
@@ -116,7 +117,10 @@
 		v3d->queue[V3D_BIN].enabled_ns += runtime;
 
 		trace_v3d_bcl_irq(&v3d->drm, fence->seqno);
+
+		v3d->bin_job = NULL;
 		dma_fence_signal(&fence->base);
+
 		status = IRQ_HANDLED;
 	}
 
@@ -126,7 +130,6 @@
 		struct v3d_file_priv *file = v3d->render_job->base.file->driver_priv;
 		u64 runtime = local_clock() - file->start_ns[V3D_RENDER];
 
-		file->enabled_ns[V3D_RENDER] += local_clock() - file->start_ns[V3D_RENDER];
 		file->jobs_sent[V3D_RENDER]++;
 		v3d->queue[V3D_RENDER].jobs_sent++;
 
@@ -137,7 +140,10 @@
 		v3d->queue[V3D_RENDER].enabled_ns += runtime;
 
 		trace_v3d_rcl_irq(&v3d->drm, fence->seqno);
+
+		v3d->render_job = NULL;
 		dma_fence_signal(&fence->base);
+
 		status = IRQ_HANDLED;
 	}
 
@@ -147,7 +153,6 @@
 		struct v3d_file_priv *file = v3d->csd_job->base.file->driver_priv;
 		u64 runtime = local_clock() - file->start_ns[V3D_CSD];
 
-		file->enabled_ns[V3D_CSD] += local_clock() - file->start_ns[V3D_CSD];
 		file->jobs_sent[V3D_CSD]++;
 		v3d->queue[V3D_CSD].jobs_sent++;
 
@@ -158,7 +163,10 @@
 		v3d->queue[V3D_CSD].enabled_ns += runtime;
 
 		trace_v3d_csd_irq(&v3d->drm, fence->seqno);
+
+		v3d->csd_job = NULL;
 		dma_fence_signal(&fence->base);
+
 		status = IRQ_HANDLED;
 	}
 
@@ -195,7 +203,6 @@
 		struct v3d_file_priv *file = v3d->tfu_job->base.file->driver_priv;
 		u64 runtime = local_clock() - file->start_ns[V3D_TFU];
 
-		file->enabled_ns[V3D_TFU] += local_clock() - file->start_ns[V3D_TFU];
 		file->jobs_sent[V3D_TFU]++;
 		v3d->queue[V3D_TFU].jobs_sent++;
 
@@ -206,7 +213,10 @@
 		v3d->queue[V3D_TFU].enabled_ns += runtime;
 
 		trace_v3d_tfu_irq(&v3d->drm, fence->seqno);
+
+		v3d->tfu_job = NULL;
 		dma_fence_signal(&fence->base);
+
 		status = IRQ_HANDLED;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/v3d/v3d_mmu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/v3d/v3d_mmu.c
@@ -30,36 +30,27 @@
 #define V3D_PTE_WRITEABLE BIT(29)
 #define V3D_PTE_VALID BIT(28)
 
-static int v3d_mmu_flush_all(struct v3d_dev *v3d)
+int v3d_mmu_flush_all(struct v3d_dev *v3d)
 {
 	int ret;
 
-	/* Make sure that another flush isn't already running when we
-	 * start this one.
-	 */
-	ret = wait_for(!(V3D_READ(V3D_MMU_CTL) &
-			 V3D_MMU_CTL_TLB_CLEARING), 100);
-	if (ret)
-		dev_err(v3d->drm.dev, "TLB clear wait idle pre-wait failed\n");
-
-	V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL) |
-		  V3D_MMU_CTL_TLB_CLEAR);
-
-	V3D_WRITE(V3D_MMUC_CONTROL,
-		  V3D_MMUC_CONTROL_FLUSH |
+	V3D_WRITE(V3D_MMUC_CONTROL, V3D_MMUC_CONTROL_FLUSH |
 		  V3D_MMUC_CONTROL_ENABLE);
 
-	ret = wait_for(!(V3D_READ(V3D_MMU_CTL) &
-			 V3D_MMU_CTL_TLB_CLEARING), 100);
+	ret = wait_for(!(V3D_READ(V3D_MMUC_CONTROL) &
+			 V3D_MMUC_CONTROL_FLUSHING), 100);
 	if (ret) {
-		dev_err(v3d->drm.dev, "TLB clear wait idle failed\n");
+		dev_err(v3d->drm.dev, "MMUC flush wait idle failed\n");
 		return ret;
 	}
 
-	ret = wait_for(!(V3D_READ(V3D_MMUC_CONTROL) &
-			 V3D_MMUC_CONTROL_FLUSHING), 100);
+	V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL) |
+		  V3D_MMU_CTL_TLB_CLEAR);
+
+	ret = wait_for(!(V3D_READ(V3D_MMU_CTL) &
+			 V3D_MMU_CTL_TLB_CLEARING), 100);
 	if (ret)
-		dev_err(v3d->drm.dev, "MMUC flush wait idle failed\n");
+		dev_err(v3d->drm.dev, "MMU TLB clear wait idle failed\n");
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/v3d/v3d_perfmon.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/v3d/v3d_perfmon.c
@@ -51,9 +51,9 @@
 		V3D_CORE_WRITE(0, V3D_V4_PCTR_0_SRC_X(source), channel);
 	}
 
+	V3D_CORE_WRITE(0, V3D_V4_PCTR_0_EN, mask);
 	V3D_CORE_WRITE(0, V3D_V4_PCTR_0_CLR, mask);
 	V3D_CORE_WRITE(0, V3D_PCTR_0_OVERFLOW, mask);
-	V3D_CORE_WRITE(0, V3D_V4_PCTR_0_EN, mask);
 
 	v3d->active_perfmon = perfmon;
 }
@@ -103,6 +103,11 @@
 static int v3d_perfmon_idr_del(int id, void *elem, void *data)
 {
 	struct v3d_perfmon *perfmon = elem;
+	struct v3d_dev *v3d = (struct v3d_dev *)data;
+
+	/* If the active perfmon is being destroyed, stop it first */
+	if (perfmon == v3d->active_perfmon)
+		v3d_perfmon_stop(v3d, perfmon, false);
 
 	v3d_perfmon_put(perfmon);
 
@@ -111,8 +116,10 @@
 
 void v3d_perfmon_close_file(struct v3d_file_priv *v3d_priv)
 {
+	struct v3d_dev *v3d = v3d_priv->v3d;
+
 	mutex_lock(&v3d_priv->perfmon.lock);
-	idr_for_each(&v3d_priv->perfmon.idr, v3d_perfmon_idr_del, NULL);
+	idr_for_each(&v3d_priv->perfmon.idr, v3d_perfmon_idr_del, v3d);
 	idr_destroy(&v3d_priv->perfmon.idr);
 	mutex_unlock(&v3d_priv->perfmon.lock);
 	mutex_destroy(&v3d_priv->perfmon.lock);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/v3d/v3d_sched.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/v3d/v3d_sched.c
@@ -73,24 +73,44 @@
 	v3d_job_cleanup(job);
 }
 
+void
+v3d_timestamp_query_info_free(struct v3d_timestamp_query_info *query_info,
+			      unsigned int count)
+{
+	if (query_info->queries) {
+		unsigned int i;
+
+		for (i = 0; i < count; i++)
+			drm_syncobj_put(query_info->queries[i].syncobj);
+
+		kvfree(query_info->queries);
+	}
+}
+
+void
+v3d_performance_query_info_free(struct v3d_performance_query_info *query_info,
+				unsigned int count)
+{
+	if (query_info->queries) {
+		unsigned int i;
+
+		for (i = 0; i < count; i++)
+			drm_syncobj_put(query_info->queries[i].syncobj);
+
+		kvfree(query_info->queries);
+	}
+}
+
 static void
 v3d_cpu_job_free(struct drm_sched_job *sched_job)
 {
 	struct v3d_cpu_job *job = to_cpu_job(sched_job);
-	struct v3d_timestamp_query_info *timestamp_query = &job->timestamp_query;
-	struct v3d_performance_query_info *performance_query = &job->performance_query;
 
-	if (timestamp_query->queries) {
-		for (int i = 0; i < timestamp_query->count; i++)
-			drm_syncobj_put(timestamp_query->queries[i].syncobj);
-		kvfree(timestamp_query->queries);
-	}
+	v3d_timestamp_query_info_free(&job->timestamp_query,
+				      job->timestamp_query.count);
 
-	if (performance_query->queries) {
-		for (int i = 0; i < performance_query->count; i++)
-			drm_syncobj_put(performance_query->queries[i].syncobj);
-		kvfree(performance_query->queries);
-	}
+	v3d_performance_query_info_free(&job->performance_query,
+					job->performance_query.count);
 
 	v3d_job_cleanup(&job->base);
 }
@@ -263,7 +283,7 @@
 	struct v3d_file_priv *file = job->base.file->driver_priv;
 	struct drm_device *dev = &v3d->drm;
 	struct dma_fence *fence;
-	int i, csd_cfg0_reg, csd_cfg_reg_count;
+	int i, csd_cfg0_reg;
 
 	v3d->csd_job = job;
 
@@ -285,9 +305,17 @@
 	v3d_switch_perfmon(v3d, &job->base);
 
 	csd_cfg0_reg = V3D_CSD_QUEUED_CFG0(v3d->ver);
-	csd_cfg_reg_count = v3d->ver < 71 ? 6 : 7;
-	for (i = 1; i <= csd_cfg_reg_count; i++)
+	for (i = 1; i <= 6; i++)
 		V3D_CORE_WRITE(0, csd_cfg0_reg + 4 * i, job->args.cfg[i]);
+
+	/* Although V3D 7.1 has an eighth configuration register, we are not
+	 * using it. Therefore, make sure it remains unused.
+	 *
+	 * XXX: Set the CFG7 register
+	 */
+	if (v3d->ver >= 71)
+		V3D_CORE_WRITE(0, V3D_V7_CSD_QUEUED_CFG7, 0);
+
 	/* CFG0 write kicks off the job. */
 	V3D_CORE_WRITE(0, csd_cfg0_reg, job->args.cfg[0]);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/v3d/v3d_submit.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/v3d/v3d_submit.c
@@ -452,6 +452,8 @@
 {
 	u32 __user *offsets, *syncs;
 	struct drm_v3d_timestamp_query timestamp;
+	unsigned int i;
+	int err;
 
 	if (!job) {
 		DRM_DEBUG("CPU job extension was attached to a GPU job.\n");
@@ -480,26 +482,34 @@
 	offsets = u64_to_user_ptr(timestamp.offsets);
 	syncs = u64_to_user_ptr(timestamp.syncs);
 
-	for (int i = 0; i < timestamp.count; i++) {
+	for (i = 0; i < timestamp.count; i++) {
 		u32 offset, sync;
 
 		if (copy_from_user(&offset, offsets++, sizeof(offset))) {
-			kvfree(job->timestamp_query.queries);
-			return -EFAULT;
+			err = -EFAULT;
+			goto error;
 		}
 
 		job->timestamp_query.queries[i].offset = offset;
 
 		if (copy_from_user(&sync, syncs++, sizeof(sync))) {
-			kvfree(job->timestamp_query.queries);
-			return -EFAULT;
+			err = -EFAULT;
+			goto error;
 		}
 
 		job->timestamp_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
+		if (!job->timestamp_query.queries[i].syncobj) {
+			err = -ENOENT;
+			goto error;
+		}
 	}
 	job->timestamp_query.count = timestamp.count;
 
 	return 0;
+
+error:
+	v3d_timestamp_query_info_free(&job->timestamp_query, i);
+	return err;
 }
 
 static int
@@ -509,6 +519,8 @@
 {
 	u32 __user *syncs;
 	struct drm_v3d_reset_timestamp_query reset;
+	unsigned int i;
+	int err;
 
 	if (!job) {
 		DRM_DEBUG("CPU job extension was attached to a GPU job.\n");
@@ -533,21 +545,29 @@
 
 	syncs = u64_to_user_ptr(reset.syncs);
 
-	for (int i = 0; i < reset.count; i++) {
+	for (i = 0; i < reset.count; i++) {
 		u32 sync;
 
 		job->timestamp_query.queries[i].offset = reset.offset + 8 * i;
 
 		if (copy_from_user(&sync, syncs++, sizeof(sync))) {
-			kvfree(job->timestamp_query.queries);
-			return -EFAULT;
+			err = -EFAULT;
+			goto error;
 		}
 
 		job->timestamp_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
+		if (!job->timestamp_query.queries[i].syncobj) {
+			err = -ENOENT;
+			goto error;
+		}
 	}
 	job->timestamp_query.count = reset.count;
 
 	return 0;
+
+error:
+	v3d_timestamp_query_info_free(&job->timestamp_query, i);
+	return err;
 }
 
 /* Get data for the copy timestamp query results job submission. */
@@ -558,7 +578,8 @@
 {
 	u32 __user *offsets, *syncs;
 	struct drm_v3d_copy_timestamp_query copy;
-	int i;
+	unsigned int i;
+	int err;
 
 	if (!job) {
 		DRM_DEBUG("CPU job extension was attached to a GPU job.\n");
@@ -591,18 +612,22 @@
 		u32 offset, sync;
 
 		if (copy_from_user(&offset, offsets++, sizeof(offset))) {
-			kvfree(job->timestamp_query.queries);
-			return -EFAULT;
+			err = -EFAULT;
+			goto error;
 		}
 
 		job->timestamp_query.queries[i].offset = offset;
 
 		if (copy_from_user(&sync, syncs++, sizeof(sync))) {
-			kvfree(job->timestamp_query.queries);
-			return -EFAULT;
+			err = -EFAULT;
+			goto error;
 		}
 
 		job->timestamp_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
+		if (!job->timestamp_query.queries[i].syncobj) {
+			err = -ENOENT;
+			goto error;
+		}
 	}
 	job->timestamp_query.count = copy.count;
 
@@ -613,6 +638,10 @@
 	job->copy.stride = copy.stride;
 
 	return 0;
+
+error:
+	v3d_timestamp_query_info_free(&job->timestamp_query, i);
+	return err;
 }
 
 static int
@@ -623,6 +652,8 @@
 	u32 __user *syncs;
 	u64 __user *kperfmon_ids;
 	struct drm_v3d_reset_performance_query reset;
+	unsigned int i, j;
+	int err;
 
 	if (!job) {
 		DRM_DEBUG("CPU job extension was attached to a GPU job.\n");
@@ -637,6 +668,12 @@
 	if (copy_from_user(&reset, ext, sizeof(reset)))
 		return -EFAULT;
 
+	if (reset.nperfmons > V3D_MAX_PERFMONS)
+		return -EINVAL;
+
+	if (reset.nperfmons > V3D_MAX_PERFMONS)
+		return -EINVAL;
+
 	job->job_type = V3D_CPU_JOB_TYPE_RESET_PERFORMANCE_QUERY;
 
 	job->performance_query.queries = kvmalloc_array(reset.count,
@@ -648,39 +685,47 @@
 	syncs = u64_to_user_ptr(reset.syncs);
 	kperfmon_ids = u64_to_user_ptr(reset.kperfmon_ids);
 
-	for (int i = 0; i < reset.count; i++) {
+	for (i = 0; i < reset.count; i++) {
 		u32 sync;
 		u64 ids;
 		u32 __user *ids_pointer;
 		u32 id;
 
 		if (copy_from_user(&sync, syncs++, sizeof(sync))) {
-			kvfree(job->performance_query.queries);
-			return -EFAULT;
+			err = -EFAULT;
+			goto error;
 		}
 
-		job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
-
 		if (copy_from_user(&ids, kperfmon_ids++, sizeof(ids))) {
-			kvfree(job->performance_query.queries);
-			return -EFAULT;
+			err = -EFAULT;
+			goto error;
 		}
 
 		ids_pointer = u64_to_user_ptr(ids);
 
-		for (int j = 0; j < reset.nperfmons; j++) {
+		for (j = 0; j < reset.nperfmons; j++) {
 			if (copy_from_user(&id, ids_pointer++, sizeof(id))) {
-				kvfree(job->performance_query.queries);
-				return -EFAULT;
+				err = -EFAULT;
+				goto error;
 			}
 
 			job->performance_query.queries[i].kperfmon_ids[j] = id;
 		}
+
+		job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
+		if (!job->performance_query.queries[i].syncobj) {
+			err = -ENOENT;
+			goto error;
+		}
 	}
 	job->performance_query.count = reset.count;
 	job->performance_query.nperfmons = reset.nperfmons;
 
 	return 0;
+
+error:
+	v3d_performance_query_info_free(&job->performance_query, i);
+	return err;
 }
 
 static int
@@ -691,6 +736,8 @@
 	u32 __user *syncs;
 	u64 __user *kperfmon_ids;
 	struct drm_v3d_copy_performance_query copy;
+	unsigned int i, j;
+	int err;
 
 	if (!job) {
 		DRM_DEBUG("CPU job extension was attached to a GPU job.\n");
@@ -708,6 +755,12 @@
 	if (copy.pad)
 		return -EINVAL;
 
+	if (copy.nperfmons > V3D_MAX_PERFMONS)
+		return -EINVAL;
+
+	if (copy.nperfmons > V3D_MAX_PERFMONS)
+		return -EINVAL;
+
 	job->job_type = V3D_CPU_JOB_TYPE_COPY_PERFORMANCE_QUERY;
 
 	job->performance_query.queries = kvmalloc_array(copy.count,
@@ -719,34 +772,38 @@
 	syncs = u64_to_user_ptr(copy.syncs);
 	kperfmon_ids = u64_to_user_ptr(copy.kperfmon_ids);
 
-	for (int i = 0; i < copy.count; i++) {
+	for (i = 0; i < copy.count; i++) {
 		u32 sync;
 		u64 ids;
 		u32 __user *ids_pointer;
 		u32 id;
 
 		if (copy_from_user(&sync, syncs++, sizeof(sync))) {
-			kvfree(job->performance_query.queries);
-			return -EFAULT;
+			err = -EFAULT;
+			goto error;
 		}
 
-		job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
-
 		if (copy_from_user(&ids, kperfmon_ids++, sizeof(ids))) {
-			kvfree(job->performance_query.queries);
-			return -EFAULT;
+			err = -EFAULT;
+			goto error;
 		}
 
 		ids_pointer = u64_to_user_ptr(ids);
 
-		for (int j = 0; j < copy.nperfmons; j++) {
+		for (j = 0; j < copy.nperfmons; j++) {
 			if (copy_from_user(&id, ids_pointer++, sizeof(id))) {
-				kvfree(job->performance_query.queries);
-				return -EFAULT;
+				err = -EFAULT;
+				goto error;
 			}
 
 			job->performance_query.queries[i].kperfmon_ids[j] = id;
 		}
+
+		job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
+		if (!job->performance_query.queries[i].syncobj) {
+			err = -ENOENT;
+			goto error;
+		}
 	}
 	job->performance_query.count = copy.count;
 	job->performance_query.nperfmons = copy.nperfmons;
@@ -759,6 +816,10 @@
 	job->copy.stride = copy.stride;
 
 	return 0;
+
+error:
+	v3d_performance_query_info_free(&job->performance_query, i);
+	return err;
 }
 
 /* Whenever userspace sets ioctl extensions, v3d_get_extensions parses data
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vboxvideo/hgsmi_base.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vboxvideo/hgsmi_base.c
@@ -139,7 +139,15 @@
 		flags |= VBOX_MOUSE_POINTER_VISIBLE;
 	}
 
-	p = hgsmi_buffer_alloc(ctx, sizeof(*p) + pixel_len, HGSMI_CH_VBVA,
+	/*
+	 * The 4 extra bytes come from switching struct vbva_mouse_pointer_shape
+	 * from having a 4 bytes fixed array at the end to using a proper VLA
+	 * at the end. These 4 extra bytes were not subtracted from sizeof(*p)
+	 * before the switch to the VLA, so this way the behavior is unchanged.
+	 * Chances are these 4 extra bytes are not necessary but they are kept
+	 * to avoid regressions.
+	 */
+	p = hgsmi_buffer_alloc(ctx, sizeof(*p) + pixel_len + 4, HGSMI_CH_VBVA,
 			       VBVA_MOUSE_POINTER_SHAPE);
 	if (!p)
 		return -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vboxvideo/vboxvideo.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/vboxvideo/vboxvideo.h
@@ -351,10 +351,8 @@
 	 * Bytes in the gap between the AND and the XOR mask are undefined.
 	 * XOR mask scanlines have no gap between them and size of XOR mask is:
 	 * xor_len = width * 4 * height.
-	 *
-	 * Preallocate 4 bytes for accessing actual data as p->data.
 	 */
-	u8 data[4];
+	u8 data[];
 } __packed;
 
 /* pointer is visible */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/tests/vc4_mock.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/tests/vc4_mock.c
@@ -157,11 +157,11 @@
 			    drm_dev_unregister,
 			    struct drm_device *);
 
-static struct vc4_dev *__mock_device(struct kunit *test, bool is_vc5)
+static struct vc4_dev *__mock_device(struct kunit *test, enum vc4_gen gen)
 {
 	struct drm_device *drm;
-	const struct drm_driver *drv = is_vc5 ? &vc5_drm_driver : &vc4_drm_driver;
-	const struct vc4_mock_desc *desc = is_vc5 ? &vc5_mock : &vc4_mock;
+	const struct drm_driver *drv = (gen == VC4_GEN_5) ? &vc5_drm_driver : &vc4_drm_driver;
+	const struct vc4_mock_desc *desc = (gen == VC4_GEN_5) ? &vc5_mock : &vc4_mock;
 	struct vc4_dev *vc4;
 	struct device *dev;
 	int ret;
@@ -175,7 +175,7 @@
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4);
 
 	vc4->dev = dev;
-	vc4->is_vc5 = is_vc5;
+	vc4->gen = gen;
 
 	vc4->hvs = __vc4_hvs_alloc(vc4, NULL);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vc4->hvs);
@@ -200,10 +200,10 @@
 
 struct vc4_dev *vc4_mock_device(struct kunit *test)
 {
-	return __mock_device(test, false);
+	return __mock_device(test, VC4_GEN_4);
 }
 
 struct vc4_dev *vc5_mock_device(struct kunit *test)
 {
-	return __mock_device(test, true);
+	return __mock_device(test, VC4_GEN_5);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_bo.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_bo.c
@@ -251,7 +251,7 @@
 {
 	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	mutex_lock(&vc4->purgeable.lock);
@@ -265,7 +265,7 @@
 {
 	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	/* list_del_init() is used here because the caller might release
@@ -396,7 +396,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_bo *bo;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return ERR_PTR(-ENODEV);
 
 	bo = kzalloc(sizeof(*bo), GFP_KERNEL);
@@ -427,7 +427,7 @@
 	struct drm_gem_dma_object *dma_obj;
 	struct vc4_bo *bo;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return ERR_PTR(-ENODEV);
 
 	if (size == 0)
@@ -496,7 +496,7 @@
 	struct vc4_bo *bo = NULL;
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	ret = vc4_dumb_fixup_args(args);
@@ -622,7 +622,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	/* Fast path: if the BO is already retained by someone, no need to
@@ -661,7 +661,7 @@
 {
 	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	/* Fast path: if the BO is still retained by someone, no need to test
@@ -783,7 +783,7 @@
 	struct vc4_bo *bo = NULL;
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	ret = vc4_grab_bin_bo(vc4, vc4file);
@@ -813,7 +813,7 @@
 	struct drm_vc4_mmap_bo *args = data;
 	struct drm_gem_object *gem_obj;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	gem_obj = drm_gem_object_lookup(file_priv, args->handle);
@@ -839,7 +839,7 @@
 	struct vc4_bo *bo = NULL;
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (args->size == 0)
@@ -918,7 +918,7 @@
 	struct vc4_bo *bo;
 	bool t_format;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (args->flags != 0)
@@ -964,7 +964,7 @@
 	struct drm_gem_object *gem_obj;
 	struct vc4_bo *bo;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (args->flags != 0 || args->modifier != 0)
@@ -1007,7 +1007,7 @@
 	int ret;
 	int i;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	/* Create the initial set of BO labels that the kernel will
@@ -1071,7 +1071,7 @@
 	struct drm_gem_object *gem_obj;
 	int ret = 0, label;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (!args->len)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_crtc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -263,7 +263,7 @@
 		 * Removing 1 from the FIFO full level however
 		 * seems to completely remove that issue.
 		 */
-		if (!vc4->is_vc5)
+		if (vc4->gen == VC4_GEN_4)
 			return fifo_len_bytes - 3 * HVS_FIFO_LATENCY_PIX - 1;
 
 		return fifo_len_bytes - 3 * HVS_FIFO_LATENCY_PIX;
@@ -428,7 +428,7 @@
 	if (is_dsi)
 		CRTC_WRITE(PV_HACT_ACT, mode->hdisplay * pixel_rep);
 
-	if (vc4->is_vc5)
+	if (vc4->gen == VC4_GEN_5)
 		CRTC_WRITE(PV_MUX_CFG,
 			   VC4_SET_FIELD(PV_MUX_CFG_RGB_PIXEL_MUX_MODE_NO_SWAP,
 					 PV_MUX_CFG_RGB_PIXEL_MUX_MODE));
@@ -913,7 +913,7 @@
 	struct dma_fence *fence;
 	int ret;
 
-	if (!vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_4) {
 		struct vc4_bo *bo = to_vc4_bo(&dma_bo->base);
 
 		return vc4_queue_seqno_cb(dev, &flip_state->cb.seqno, bo->seqno,
@@ -1000,7 +1000,7 @@
 	struct vc4_bo *bo = to_vc4_bo(&dma_bo->base);
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	/*
@@ -1043,7 +1043,7 @@
 		struct drm_device *dev = crtc->dev;
 		struct vc4_dev *vc4 = to_vc4_dev(dev);
 
-		if (vc4->is_vc5)
+		if (vc4->gen == VC4_GEN_5)
 			return vc5_async_page_flip(crtc, fb, event, flags);
 		else
 			return vc4_async_page_flip(crtc, fb, event, flags);
@@ -1338,9 +1338,8 @@
 
 	drm_crtc_helper_add(crtc, crtc_helper_funcs);
 
-	if (!vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_4) {
 		drm_mode_crtc_set_gamma_size(crtc, ARRAY_SIZE(vc4_crtc->lut_r));
-
 		drm_crtc_enable_color_mgmt(crtc, 0, false, crtc->gamma_size);
 
 		/* We support CTM, but only for one CRTC at a time. It's therefore
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_drv.c
@@ -98,7 +98,7 @@
 	if (args->pad != 0)
 		return -EINVAL;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (!vc4->v3d)
@@ -147,7 +147,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_file *vc4file;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	vc4file = kzalloc(sizeof(*vc4file), GFP_KERNEL);
@@ -165,7 +165,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_file *vc4file = file->driver_priv;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	if (vc4file->bin_bo_used)
@@ -291,13 +291,17 @@
 	struct vc4_dev *vc4;
 	struct device_node *node;
 	struct drm_crtc *crtc;
-	bool is_vc5;
+	enum vc4_gen gen;
 	int ret = 0;
 
 	dev->coherent_dma_mask = DMA_BIT_MASK(32);
 
-	is_vc5 = of_device_is_compatible(dev->of_node, "brcm,bcm2711-vc5");
-	if (is_vc5)
+	if (of_device_is_compatible(dev->of_node, "brcm,bcm2711-vc5"))
+		gen = VC4_GEN_5;
+	else
+		gen = VC4_GEN_4;
+
+	if (gen == VC4_GEN_5)
 		driver = &vc5_drm_driver;
 	else
 		driver = &vc4_drm_driver;
@@ -315,13 +319,13 @@
 	vc4 = devm_drm_dev_alloc(dev, driver, struct vc4_dev, base);
 	if (IS_ERR(vc4))
 		return PTR_ERR(vc4);
-	vc4->is_vc5 = is_vc5;
+	vc4->gen = gen;
 	vc4->dev = dev;
 
 	drm = &vc4->base;
 	platform_set_drvdata(pdev, drm);
 
-	if (!is_vc5) {
+	if (gen == VC4_GEN_4) {
 		ret = drmm_mutex_init(drm, &vc4->bin_bo_lock);
 		if (ret)
 			goto err;
@@ -335,7 +339,7 @@
 	if (ret)
 		goto err;
 
-	if (!is_vc5) {
+	if (gen == VC4_GEN_4) {
 		ret = vc4_gem_init(drm);
 		if (ret)
 			goto err;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_drv.h
@@ -79,11 +79,16 @@
 	u64 counters[] __counted_by(ncounters);
 };
 
+enum vc4_gen {
+	VC4_GEN_4,
+	VC4_GEN_5,
+};
+
 struct vc4_dev {
 	struct drm_device base;
 	struct device *dev;
 
-	bool is_vc5;
+	enum vc4_gen gen;
 
 	unsigned int irq;
 
@@ -314,6 +319,7 @@
 	struct platform_device *pdev;
 	void __iomem *regs;
 	u32 __iomem *dlist;
+	unsigned int dlist_mem_size;
 
 	struct clk *core_clk;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_gem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_gem.c
@@ -76,7 +76,7 @@
 	u32 i;
 	int ret = 0;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (!vc4->v3d) {
@@ -389,7 +389,7 @@
 	unsigned long timeout_expire;
 	DEFINE_WAIT(wait);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (vc4->finished_seqno >= seqno)
@@ -474,7 +474,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_exec_info *exec;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 again:
@@ -522,7 +522,7 @@
 	if (!exec)
 		return;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	/* A previous RCL may have written to one of our textures, and
@@ -543,7 +543,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	bool was_empty = list_empty(&vc4->render_job_list);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	list_move_tail(&exec->head, &vc4->render_job_list);
@@ -970,7 +970,7 @@
 	unsigned long irqflags;
 	struct vc4_seqno_cb *cb, *cb_temp;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	spin_lock_irqsave(&vc4->job_lock, irqflags);
@@ -1009,7 +1009,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	unsigned long irqflags;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	cb->func = func;
@@ -1065,7 +1065,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct drm_vc4_wait_seqno *args = data;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	return vc4_wait_for_seqno_ioctl_helper(dev, args->seqno,
@@ -1082,7 +1082,7 @@
 	struct drm_gem_object *gem_obj;
 	struct vc4_bo *bo;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (args->pad != 0)
@@ -1131,7 +1131,7 @@
 				  args->shader_rec_size,
 				  args->bo_handle_count);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (!vc4->v3d) {
@@ -1268,7 +1268,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	vc4->dma_fence_context = dma_fence_context_alloc(1);
@@ -1327,7 +1327,7 @@
 	struct vc4_bo *bo;
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	switch (args->madv) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -179,6 +179,8 @@
 	if (!drm_dev_enter(drm, &idx))
 		return -ENODEV;
 
+	WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev));
+
 	drm_print_regset32(&p, &vc4_hdmi->hdmi_regset);
 	drm_print_regset32(&p, &vc4_hdmi->hd_regset);
 	drm_print_regset32(&p, &vc4_hdmi->cec_regset);
@@ -188,6 +190,8 @@
 	drm_print_regset32(&p, &vc4_hdmi->ram_regset);
 	drm_print_regset32(&p, &vc4_hdmi->rm_regset);
 
+	pm_runtime_put(&vc4_hdmi->pdev->dev);
+
 	drm_dev_exit(idx);
 
 	return 0;
@@ -458,6 +462,7 @@
 {
 	struct vc4_hdmi *vc4_hdmi = connector_to_vc4_hdmi(connector);
 	enum drm_connector_status status = connector_status_disconnected;
+	int ret;
 
 	/*
 	 * NOTE: This function should really take vc4_hdmi->mutex, but
@@ -470,7 +475,12 @@
 	 * the lock for now.
 	 */
 
-	WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev));
+	ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev);
+	if (ret) {
+		drm_err_once(connector->dev, "Failed to retain HDMI power domain: %d\n",
+			     ret);
+		return connector_status_unknown;
+	}
 
 	if (vc4_hdmi->hpd_gpio) {
 		if (gpiod_get_value_cansleep(vc4_hdmi->hpd_gpio))
@@ -508,7 +518,7 @@
 	edid = drm_get_edid(connector, vc4_hdmi->ddc);
 	cec_s_phys_addr_from_edid(vc4_hdmi->cec_adap, edid);
 	if (!edid)
-		return -ENODEV;
+		return 0;
 
 	drm_connector_update_edid_property(connector, edid);
 	ret = drm_add_edid_modes(connector, edid);
@@ -2396,7 +2406,7 @@
 	}
 
 	if (!vc4_hdmi_audio_can_stream(vc4_hdmi)) {
-		ret = -ENODEV;
+		ret = -ENOTSUPP;
 		goto out_dev_exit;
 	}
 
@@ -2524,6 +2534,7 @@
 	struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
 	struct drm_device *drm = vc4_hdmi->connector.dev;
 	struct drm_encoder *encoder = &vc4_hdmi->encoder.base;
+	struct vc4_dev *vc4 = to_vc4_dev(drm);
 	unsigned int sample_rate = params->sample_rate;
 	unsigned int channels = params->channels;
 	unsigned long flags;
@@ -2581,11 +2592,18 @@
 					     VC4_HDMI_AUDIO_PACKET_CEA_MASK);
 
 	/* Set the MAI threshold */
-	HDMI_WRITE(HDMI_MAI_THR,
-		   VC4_SET_FIELD(0x08, VC4_HD_MAI_THR_PANICHIGH) |
-		   VC4_SET_FIELD(0x08, VC4_HD_MAI_THR_PANICLOW) |
-		   VC4_SET_FIELD(0x06, VC4_HD_MAI_THR_DREQHIGH) |
-		   VC4_SET_FIELD(0x08, VC4_HD_MAI_THR_DREQLOW));
+	if (vc4->gen >= VC4_GEN_5)
+		HDMI_WRITE(HDMI_MAI_THR,
+			   VC4_SET_FIELD(0x10, VC4_HD_MAI_THR_PANICHIGH) |
+			   VC4_SET_FIELD(0x10, VC4_HD_MAI_THR_PANICLOW) |
+			   VC4_SET_FIELD(0x1c, VC4_HD_MAI_THR_DREQHIGH) |
+			   VC4_SET_FIELD(0x1c, VC4_HD_MAI_THR_DREQLOW));
+	else
+		HDMI_WRITE(HDMI_MAI_THR,
+			   VC4_SET_FIELD(0x8, VC4_HD_MAI_THR_PANICHIGH) |
+			   VC4_SET_FIELD(0x8, VC4_HD_MAI_THR_PANICLOW) |
+			   VC4_SET_FIELD(0x6, VC4_HD_MAI_THR_DREQHIGH) |
+			   VC4_SET_FIELD(0x8, VC4_HD_MAI_THR_DREQLOW));
 
 	HDMI_WRITE(HDMI_MAI_CONFIG,
 		   VC4_HDMI_MAI_CONFIG_BIT_REVERSE |
@@ -2739,6 +2757,8 @@
 		index = 1;
 
 	addr = of_get_address(dev->of_node, index, NULL, NULL);
+	if (!addr)
+		return -EINVAL;
 
 	vc4_hdmi->audio.dma_data.addr = be32_to_cpup(addr) + mai_data->offset;
 	vc4_hdmi->audio.dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_hvs.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_hvs.c
@@ -110,7 +110,8 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_hvs *hvs = vc4->hvs;
 	struct drm_printer p = drm_seq_file_printer(m);
-	unsigned int next_entry_start = 0;
+	unsigned int dlist_mem_size = hvs->dlist_mem_size;
+	unsigned int next_entry_start;
 	unsigned int i, j;
 	u32 dlist_word, dispstat;
 
@@ -124,8 +125,9 @@
 		}
 
 		drm_printf(&p, "HVS chan %u:\n", i);
+		next_entry_start = 0;
 
-		for (j = HVS_READ(SCALER_DISPLISTX(i)); j < 256; j++) {
+		for (j = HVS_READ(SCALER_DISPLISTX(i)); j < dlist_mem_size; j++) {
 			dlist_word = readl((u32 __iomem *)vc4->hvs->dlist + j);
 			drm_printf(&p, "dlist: %02d: 0x%08x\n", j,
 				   dlist_word);
@@ -222,6 +224,9 @@
 	if (!drm_dev_enter(drm, &idx))
 		return;
 
+	if (hvs->vc4->gen != VC4_GEN_4)
+		goto exit;
+
 	/* The LUT memory is laid out with each HVS channel in order,
 	 * each of which takes 256 writes for R, 256 for G, then 256
 	 * for B.
@@ -237,6 +242,7 @@
 	for (i = 0; i < crtc->gamma_size; i++)
 		HVS_WRITE(SCALER_GAMDATA, vc4_crtc->lut_b[i]);
 
+exit:
 	drm_dev_exit(idx);
 }
 
@@ -291,7 +297,7 @@
 	u32 reg;
 	int ret;
 
-	if (!vc4->is_vc5)
+	if (vc4->gen == VC4_GEN_4)
 		return output;
 
 	/*
@@ -372,7 +378,7 @@
 	dispctrl = SCALER_DISPCTRLX_ENABLE;
 	dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(chan));
 
-	if (!vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_4) {
 		dispctrl |= VC4_SET_FIELD(mode->hdisplay,
 					  SCALER_DISPCTRLX_WIDTH) |
 			    VC4_SET_FIELD(mode->vdisplay,
@@ -394,7 +400,7 @@
 	dispbkgndx &= ~SCALER_DISPBKGND_INTERLACE;
 
 	HVS_WRITE(SCALER_DISPBKGNDX(chan), dispbkgndx |
-		  ((!vc4->is_vc5) ? SCALER_DISPBKGND_GAMMA : 0) |
+		  ((vc4->gen == VC4_GEN_4) ? SCALER_DISPBKGND_GAMMA : 0) |
 		  (interlace ? SCALER_DISPBKGND_INTERLACE : 0));
 
 	/* Reload the LUT, since the SRAMs would have been disabled if
@@ -415,13 +421,11 @@
 	if (!drm_dev_enter(drm, &idx))
 		return;
 
-	if (HVS_READ(SCALER_DISPCTRLX(chan)) & SCALER_DISPCTRLX_ENABLE)
+	if (!(HVS_READ(SCALER_DISPCTRLX(chan)) & SCALER_DISPCTRLX_ENABLE))
 		goto out;
 
-	HVS_WRITE(SCALER_DISPCTRLX(chan),
-		  HVS_READ(SCALER_DISPCTRLX(chan)) | SCALER_DISPCTRLX_RESET);
-	HVS_WRITE(SCALER_DISPCTRLX(chan),
-		  HVS_READ(SCALER_DISPCTRLX(chan)) & ~SCALER_DISPCTRLX_ENABLE);
+	HVS_WRITE(SCALER_DISPCTRLX(chan), SCALER_DISPCTRLX_RESET);
+	HVS_WRITE(SCALER_DISPCTRLX(chan), 0);
 
 	/* Once we leave, the scaler should be disabled and its fifo empty. */
 	WARN_ON_ONCE(HVS_READ(SCALER_DISPCTRLX(chan)) & SCALER_DISPCTRLX_RESET);
@@ -580,7 +584,7 @@
 	}
 
 	if (vc4_state->assigned_channel == VC4_HVS_CHANNEL_DISABLED)
-		return;
+		goto exit;
 
 	if (debug_dump_regs) {
 		DRM_INFO("CRTC %d HVS before:\n", drm_crtc_index(crtc));
@@ -663,12 +667,14 @@
 		vc4_hvs_dump_state(hvs);
 	}
 
+exit:
 	drm_dev_exit(idx);
 }
 
 void vc4_hvs_mask_underrun(struct vc4_hvs *hvs, int channel)
 {
-	struct drm_device *drm = &hvs->vc4->base;
+	struct vc4_dev *vc4 = hvs->vc4;
+	struct drm_device *drm = &vc4->base;
 	u32 dispctrl;
 	int idx;
 
@@ -676,8 +682,9 @@
 		return;
 
 	dispctrl = HVS_READ(SCALER_DISPCTRL);
-	dispctrl &= ~(hvs->vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) :
-					 SCALER_DISPCTRL_DSPEISLUR(channel));
+	dispctrl &= ~((vc4->gen == VC4_GEN_5) ?
+		      SCALER5_DISPCTRL_DSPEISLUR(channel) :
+		      SCALER_DISPCTRL_DSPEISLUR(channel));
 
 	HVS_WRITE(SCALER_DISPCTRL, dispctrl);
 
@@ -686,7 +693,8 @@
 
 void vc4_hvs_unmask_underrun(struct vc4_hvs *hvs, int channel)
 {
-	struct drm_device *drm = &hvs->vc4->base;
+	struct vc4_dev *vc4 = hvs->vc4;
+	struct drm_device *drm = &vc4->base;
 	u32 dispctrl;
 	int idx;
 
@@ -694,8 +702,9 @@
 		return;
 
 	dispctrl = HVS_READ(SCALER_DISPCTRL);
-	dispctrl |= (hvs->vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) :
-					SCALER_DISPCTRL_DSPEISLUR(channel));
+	dispctrl |= ((vc4->gen == VC4_GEN_5) ?
+		     SCALER5_DISPCTRL_DSPEISLUR(channel) :
+		     SCALER_DISPCTRL_DSPEISLUR(channel));
 
 	HVS_WRITE(SCALER_DISPSTAT,
 		  SCALER_DISPSTAT_EUFLOW(channel));
@@ -738,8 +747,10 @@
 	control = HVS_READ(SCALER_DISPCTRL);
 
 	for (channel = 0; channel < SCALER_CHANNELS_COUNT; channel++) {
-		dspeislur = vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) :
-					  SCALER_DISPCTRL_DSPEISLUR(channel);
+		dspeislur = (vc4->gen == VC4_GEN_5) ?
+			SCALER5_DISPCTRL_DSPEISLUR(channel) :
+			SCALER_DISPCTRL_DSPEISLUR(channel);
+
 		/* Interrupt masking is not always honored, so check it here. */
 		if (status & SCALER_DISPSTAT_EUFLOW(channel) &&
 		    control & dspeislur) {
@@ -767,7 +778,7 @@
 	if (!vc4->hvs)
 		return -ENODEV;
 
-	if (!vc4->is_vc5)
+	if (vc4->gen == VC4_GEN_4)
 		debugfs_create_bool("hvs_load_tracker", S_IRUGO | S_IWUSR,
 				    minor->debugfs_root,
 				    &vc4->load_tracker_enabled);
@@ -800,16 +811,17 @@
 	 * our 16K), since we don't want to scramble the screen when
 	 * transitioning from the firmware's boot setup to runtime.
 	 */
+	hvs->dlist_mem_size = (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END;
 	drm_mm_init(&hvs->dlist_mm,
 		    HVS_BOOTLOADER_DLIST_END,
-		    (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END);
+		    hvs->dlist_mem_size);
 
 	/* Set up the HVS LBM memory manager.  We could have some more
 	 * complicated data structure that allowed reuse of LBM areas
 	 * between planes when they don't overlap on the screen, but
 	 * for now we just allocate globally.
 	 */
-	if (!vc4->is_vc5)
+	if (vc4->gen == VC4_GEN_4)
 		/* 48k words of 2x12-bit pixels */
 		drm_mm_init(&hvs->lbm_mm, 0, 48 * 1024);
 	else
@@ -843,7 +855,7 @@
 	hvs->regset.regs = hvs_regs;
 	hvs->regset.nregs = ARRAY_SIZE(hvs_regs);
 
-	if (vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_5) {
 		struct rpi_firmware *firmware;
 		struct device_node *node;
 		unsigned int max_rate;
@@ -881,7 +893,7 @@
 		}
 	}
 
-	if (!vc4->is_vc5)
+	if (vc4->gen == VC4_GEN_4)
 		hvs->dlist = hvs->regs + SCALER_DLIST_START;
 	else
 		hvs->dlist = hvs->regs + SCALER5_DLIST_START;
@@ -922,7 +934,7 @@
 		    SCALER_DISPCTRL_DISPEIRQ(1) |
 		    SCALER_DISPCTRL_DISPEIRQ(2);
 
-	if (!vc4->is_vc5)
+	if (vc4->gen == VC4_GEN_4)
 		dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ |
 			      SCALER_DISPCTRL_SLVWREIRQ |
 			      SCALER_DISPCTRL_SLVRDEIRQ |
@@ -962,11 +974,22 @@
 	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1);
 	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2);
 
+	/* Set AXI panic mode.
+	 * VC4 panics when < 2 lines in FIFO.
+	 * VC5 panics when less than 1 line in the FIFO.
+	 */
+	dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK |
+		      SCALER_DISPCTRL_PANIC1_MASK |
+		      SCALER_DISPCTRL_PANIC2_MASK);
+	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0);
+	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1);
+	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2);
+
 	HVS_WRITE(SCALER_DISPCTRL, dispctrl);
 
 	/* Recompute Composite Output Buffer (COB) allocations for the displays
 	 */
-	if (!vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_4) {
 		/* The COB is 20736 pixels, or just over 10 lines at 2048 wide.
 		 * The bottom 2048 pixels are full 32bpp RGBA (intended for the
 		 * TXP composing RGBA to memory), whilst the remainder are only
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_irq.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_irq.c
@@ -263,7 +263,7 @@
 {
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	if (!vc4->v3d)
@@ -280,7 +280,7 @@
 {
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	if (!vc4->v3d)
@@ -303,7 +303,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (irq == IRQ_NOTCONNECTED)
@@ -324,7 +324,7 @@
 {
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	vc4_irq_disable(dev);
@@ -337,7 +337,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	unsigned long irqflags;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	/* Acknowledge any stale IRQs. */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_kms.c
@@ -369,7 +369,7 @@
 		old_hvs_state->fifo_state[channel].pending_commit = NULL;
 	}
 
-	if (vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_5) {
 		unsigned long state_rate = max(old_hvs_state->core_clock_rate,
 					       new_hvs_state->core_clock_rate);
 		unsigned long core_rate = clamp_t(unsigned long, state_rate,
@@ -388,7 +388,7 @@
 
 	vc4_ctm_commit(vc4, state);
 
-	if (vc4->is_vc5)
+	if (vc4->gen == VC4_GEN_5)
 		vc5_hvs_pv_muxing_commit(vc4, state);
 	else
 		vc4_hvs_pv_muxing_commit(vc4, state);
@@ -406,7 +406,7 @@
 
 	drm_atomic_helper_cleanup_planes(dev, state);
 
-	if (vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_5) {
 		unsigned long core_rate = min_t(unsigned long,
 						hvs->max_core_rate,
 						new_hvs_state->core_clock_rate);
@@ -461,7 +461,7 @@
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct drm_mode_fb_cmd2 mode_cmd_local;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return ERR_PTR(-ENODEV);
 
 	/* If the user didn't specify a modifier, use the
@@ -1040,7 +1040,7 @@
 	 * the BCM2711, but the load tracker computations are used for
 	 * the core clock rate calculation.
 	 */
-	if (!vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_4) {
 		/* Start with the load tracker enabled. Can be
 		 * disabled through the debugfs load_tracker file.
 		 */
@@ -1056,7 +1056,7 @@
 		return ret;
 	}
 
-	if (vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_5) {
 		dev->mode_config.max_width = 7680;
 		dev->mode_config.max_height = 7680;
 	} else {
@@ -1064,7 +1064,7 @@
 		dev->mode_config.max_height = 2048;
 	}
 
-	dev->mode_config.funcs = vc4->is_vc5 ? &vc5_mode_funcs : &vc4_mode_funcs;
+	dev->mode_config.funcs = (vc4->gen > VC4_GEN_4) ? &vc5_mode_funcs : &vc4_mode_funcs;
 	dev->mode_config.helper_private = &vc4_mode_config_helpers;
 	dev->mode_config.preferred_depth = 24;
 	dev->mode_config.async_page_flip = true;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_perfmon.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_perfmon.c
@@ -23,7 +23,7 @@
 		return;
 
 	vc4 = perfmon->dev;
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	refcount_inc(&perfmon->refcnt);
@@ -37,7 +37,7 @@
 		return;
 
 	vc4 = perfmon->dev;
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	if (refcount_dec_and_test(&perfmon->refcnt))
@@ -49,7 +49,7 @@
 	unsigned int i;
 	u32 mask;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	if (WARN_ON_ONCE(!perfmon || vc4->active_perfmon))
@@ -69,7 +69,7 @@
 {
 	unsigned int i;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	if (WARN_ON_ONCE(!vc4->active_perfmon ||
@@ -90,7 +90,7 @@
 	struct vc4_dev *vc4 = vc4file->dev;
 	struct vc4_perfmon *perfmon;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return NULL;
 
 	mutex_lock(&vc4file->perfmon.lock);
@@ -105,7 +105,7 @@
 {
 	struct vc4_dev *vc4 = vc4file->dev;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	mutex_init(&vc4file->perfmon.lock);
@@ -116,6 +116,11 @@
 static int vc4_perfmon_idr_del(int id, void *elem, void *data)
 {
 	struct vc4_perfmon *perfmon = elem;
+	struct vc4_dev *vc4 = (struct vc4_dev *)data;
+
+	/* If the active perfmon is being destroyed, stop it first */
+	if (perfmon == vc4->active_perfmon)
+		vc4_perfmon_stop(vc4, perfmon, false);
 
 	vc4_perfmon_put(perfmon);
 
@@ -126,11 +131,11 @@
 {
 	struct vc4_dev *vc4 = vc4file->dev;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	mutex_lock(&vc4file->perfmon.lock);
-	idr_for_each(&vc4file->perfmon.idr, vc4_perfmon_idr_del, NULL);
+	idr_for_each(&vc4file->perfmon.idr, vc4_perfmon_idr_del, vc4);
 	idr_destroy(&vc4file->perfmon.idr);
 	mutex_unlock(&vc4file->perfmon.lock);
 	mutex_destroy(&vc4file->perfmon.lock);
@@ -146,7 +151,7 @@
 	unsigned int i;
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (!vc4->v3d) {
@@ -200,7 +205,7 @@
 	struct drm_vc4_perfmon_destroy *req = data;
 	struct vc4_perfmon *perfmon;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (!vc4->v3d) {
@@ -228,7 +233,7 @@
 	struct vc4_perfmon *perfmon;
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (!vc4->v3d) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_plane.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_plane.c
@@ -587,10 +587,10 @@
 	}
 
 	/* Align it to 64 or 128 (hvs5) bytes */
-	lbm = roundup(lbm, vc4->is_vc5 ? 128 : 64);
+	lbm = roundup(lbm, vc4->gen == VC4_GEN_5 ? 128 : 64);
 
 	/* Each "word" of the LBM memory contains 2 or 4 (hvs5) pixels */
-	lbm /= vc4->is_vc5 ? 4 : 2;
+	lbm /= vc4->gen == VC4_GEN_5 ? 4 : 2;
 
 	return lbm;
 }
@@ -706,7 +706,7 @@
 		ret = drm_mm_insert_node_generic(&vc4->hvs->lbm_mm,
 						 &vc4_state->lbm,
 						 lbm_size,
-						 vc4->is_vc5 ? 64 : 32,
+						 vc4->gen == VC4_GEN_5 ? 64 : 32,
 						 0, 0);
 		spin_unlock_irqrestore(&vc4->hvs->mm_lock, irqflags);
 
@@ -1057,7 +1057,7 @@
 	mix_plane_alpha = state->alpha != DRM_BLEND_ALPHA_OPAQUE &&
 			  fb->format->has_alpha;
 
-	if (!vc4->is_vc5) {
+	if (vc4->gen == VC4_GEN_4) {
 	/* Control word */
 		vc4_dlist_write(vc4_state,
 				SCALER_CTL0_VALID |
@@ -1505,9 +1505,6 @@
 
 	drm_gem_plane_helper_prepare_fb(plane, state);
 
-	if (plane->state->fb == state->fb)
-		return 0;
-
 	return vc4_bo_inc_usecnt(bo);
 }
 
@@ -1516,7 +1513,7 @@
 {
 	struct vc4_bo *bo;
 
-	if (plane->state->fb == state->fb || !state->fb)
+	if (!state->fb)
 		return;
 
 	bo = to_vc4_bo(&drm_fb_dma_get_gem_obj(state->fb, 0)->base);
@@ -1632,7 +1629,7 @@
 	};
 
 	for (i = 0; i < ARRAY_SIZE(hvs_formats); i++) {
-		if (!hvs_formats[i].hvs5_only || vc4->is_vc5) {
+		if (!hvs_formats[i].hvs5_only || vc4->gen == VC4_GEN_5) {
 			formats[num_formats] = hvs_formats[i].drm;
 			num_formats++;
 		}
@@ -1647,7 +1644,7 @@
 		return ERR_CAST(vc4_plane);
 	plane = &vc4_plane->base;
 
-	if (vc4->is_vc5)
+	if (vc4->gen == VC4_GEN_5)
 		drm_plane_helper_add(plane, &vc5_plane_helper_funcs);
 	else
 		drm_plane_helper_add(plane, &vc4_plane_helper_funcs);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_render_cl.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_render_cl.c
@@ -599,7 +599,7 @@
 	bool has_bin = args->bin_cl_size != 0;
 	int ret;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	if (args->min_x_tile > args->max_x_tile ||
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_v3d.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_v3d.c
@@ -127,7 +127,7 @@
 int
 vc4_v3d_pm_get(struct vc4_dev *vc4)
 {
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	mutex_lock(&vc4->power_lock);
@@ -148,7 +148,7 @@
 void
 vc4_v3d_pm_put(struct vc4_dev *vc4)
 {
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	mutex_lock(&vc4->power_lock);
@@ -178,7 +178,7 @@
 	uint64_t seqno = 0;
 	struct vc4_exec_info *exec;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 try_again:
@@ -325,7 +325,7 @@
 {
 	int ret = 0;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	mutex_lock(&vc4->bin_bo_lock);
@@ -360,7 +360,7 @@
 
 void vc4_v3d_bin_bo_put(struct vc4_dev *vc4)
 {
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return;
 
 	mutex_lock(&vc4->bin_bo_lock);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_validate.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_validate.c
@@ -109,7 +109,7 @@
 	struct drm_gem_dma_object *obj;
 	struct vc4_bo *bo;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return NULL;
 
 	if (hindex >= exec->bo_count) {
@@ -169,7 +169,7 @@
 	uint32_t utile_w = utile_width(cpp);
 	uint32_t utile_h = utile_height(cpp);
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return false;
 
 	/* The shaded vertex format stores signed 12.4 fixed point
@@ -495,7 +495,7 @@
 	uint32_t dst_offset = 0;
 	uint32_t src_offset = 0;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	while (src_offset < len) {
@@ -942,7 +942,7 @@
 	uint32_t i;
 	int ret = 0;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return -ENODEV;
 
 	for (i = 0; i < exec->shader_state_count; i++) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -786,7 +786,7 @@
 	struct vc4_validated_shader_info *validated_shader = NULL;
 	struct vc4_shader_validation_state validation_state;
 
-	if (WARN_ON_ONCE(vc4->is_vc5))
+	if (WARN_ON_ONCE(vc4->gen == VC4_GEN_5))
 		return NULL;
 
 	memset(&validation_state, 0, sizeof(validation_state));
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/virtio/virtgpu_submit.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/virtio/virtgpu_submit.c
@@ -48,7 +48,7 @@
 static int virtio_gpu_do_fence_wait(struct virtio_gpu_submit *submit,
 				    struct dma_fence *in_fence)
 {
-	u32 context = submit->fence_ctx + submit->ring_idx;
+	u64 context = submit->fence_ctx + submit->ring_idx;
 
 	if (dma_fence_match_context(in_fence, context))
 		return 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vkms/vkms_composer.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vkms/vkms_composer.c
@@ -123,6 +123,8 @@
 				      enum lut_channel channel)
 {
 	s64 lut_index = get_lut_index(lut, channel_value);
+	u16 *floor_lut_value, *ceil_lut_value;
+	u16 floor_channel_value, ceil_channel_value;
 
 	/*
 	 * This checks if `struct drm_color_lut` has any gap added by the compiler
@@ -130,11 +132,15 @@
 	 */
 	static_assert(sizeof(struct drm_color_lut) == sizeof(__u16) * 4);
 
-	u16 *floor_lut_value = (__u16 *)&lut->base[drm_fixp2int(lut_index)];
-	u16 *ceil_lut_value = (__u16 *)&lut->base[drm_fixp2int_ceil(lut_index)];
+	floor_lut_value = (__u16 *)&lut->base[drm_fixp2int(lut_index)];
+	if (drm_fixp2int(lut_index) == (lut->lut_length - 1))
+		/* We're at the end of the LUT array, use same value for ceil and floor */
+		ceil_lut_value = floor_lut_value;
+	else
+		ceil_lut_value = (__u16 *)&lut->base[drm_fixp2int_ceil(lut_index)];
 
-	u16 floor_channel_value = floor_lut_value[channel];
-	u16 ceil_channel_value = ceil_lut_value[channel];
+	floor_channel_value = floor_lut_value[channel];
+	ceil_channel_value = ceil_lut_value[channel];
 
 	return lerp_u16(floor_channel_value, ceil_channel_value,
 			lut_index & DRM_FIXED_DECIMAL_MASK);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vkms/vkms_output.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vkms/vkms_output.c
@@ -84,7 +84,7 @@
 				 DRM_MODE_CONNECTOR_VIRTUAL);
 	if (ret) {
 		DRM_ERROR("Failed to init connector\n");
-		goto err_connector;
+		return ret;
 	}
 
 	drm_connector_helper_add(connector, &vkms_conn_helper_funcs);
@@ -119,8 +119,5 @@
 err_encoder:
 	drm_connector_cleanup(connector);
 
-err_connector:
-	drm_crtc_cleanup(crtc);
-
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/Kconfig
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/Kconfig
@@ -2,7 +2,7 @@
 config DRM_VMWGFX
 	tristate "DRM driver for VMware Virtual GPU"
 	depends on DRM && PCI && MMU
-	depends on X86 || ARM64
+	depends on (X86 && HYPERVISOR_GUEST) || ARM64
 	select DRM_TTM
 	select DRM_TTM_HELPER
 	select MAPPING_DIRTY_HELPERS
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/ttm_object.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/ttm_object.c
@@ -87,14 +87,11 @@
  *
  * @object_lock: lock that protects idr.
  *
- * @object_count: Per device object count.
- *
  * This is the per-device data structure needed for ttm object management.
  */
 
 struct ttm_object_device {
 	spinlock_t object_lock;
-	atomic_t object_count;
 	struct dma_buf_ops ops;
 	void (*dmabuf_release)(struct dma_buf *dma_buf);
 	struct idr idr;
@@ -431,7 +428,6 @@
 		return NULL;
 
 	spin_lock_init(&tdev->object_lock);
-	atomic_set(&tdev->object_count, 0);
 
 	/*
 	 * Our base is at VMWGFX_NUM_MOB + 1 because we want to create
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmw_surface_cache.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmw_surface_cache.h
@@ -1,6 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0 OR MIT */
 /**********************************************************
- * Copyright 2021 VMware, Inc.
- * SPDX-License-Identifier: GPL-2.0 OR MIT
+ *
+ * Copyright (c) 2021-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -31,6 +33,10 @@
 
 #include <drm/vmwgfx_drm.h>
 
+#define SVGA3D_FLAGS_UPPER_32(svga3d_flags) ((svga3d_flags) >> 32)
+#define SVGA3D_FLAGS_LOWER_32(svga3d_flags) \
+	((svga3d_flags) & ((uint64_t)U32_MAX))
+
 static inline u32 clamped_umul32(u32 a, u32 b)
 {
 	uint64_t tmp = (uint64_t) a*b;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c
@@ -27,6 +27,8 @@
  **************************************************************************/
 
 #include "vmwgfx_drv.h"
+
+#include "vmwgfx_bo.h"
 #include <linux/highmem.h>
 
 /*
@@ -420,13 +422,105 @@
 	return 0;
 }
 
+static void *map_external(struct vmw_bo *bo, struct iosys_map *map)
+{
+	struct vmw_private *vmw =
+		container_of(bo->tbo.bdev, struct vmw_private, bdev);
+	void *ptr = NULL;
+	int ret;
+
+	if (bo->tbo.base.import_attach) {
+		ret = dma_buf_vmap(bo->tbo.base.dma_buf, map);
+		if (ret) {
+			drm_dbg_driver(&vmw->drm,
+				       "Wasn't able to map external bo!\n");
+			goto out;
+		}
+		ptr = map->vaddr;
+	} else {
+		ptr = vmw_bo_map_and_cache(bo);
+	}
+
+out:
+	return ptr;
+}
+
+static void unmap_external(struct vmw_bo *bo, struct iosys_map *map)
+{
+	if (bo->tbo.base.import_attach)
+		dma_buf_vunmap(bo->tbo.base.dma_buf, map);
+	else
+		vmw_bo_unmap(bo);
+}
+
+static int vmw_external_bo_copy(struct vmw_bo *dst, u32 dst_offset,
+				u32 dst_stride, struct vmw_bo *src,
+				u32 src_offset, u32 src_stride,
+				u32 width_in_bytes, u32 height,
+				struct vmw_diff_cpy *diff)
+{
+	struct vmw_private *vmw =
+		container_of(dst->tbo.bdev, struct vmw_private, bdev);
+	size_t dst_size = dst->tbo.resource->size;
+	size_t src_size = src->tbo.resource->size;
+	struct iosys_map dst_map = {0};
+	struct iosys_map src_map = {0};
+	int ret, i;
+	int x_in_bytes;
+	u8 *vsrc;
+	u8 *vdst;
+
+	vsrc = map_external(src, &src_map);
+	if (!vsrc) {
+		drm_dbg_driver(&vmw->drm, "Wasn't able to map src\n");
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	vdst = map_external(dst, &dst_map);
+	if (!vdst) {
+		drm_dbg_driver(&vmw->drm, "Wasn't able to map dst\n");
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	vsrc += src_offset;
+	vdst += dst_offset;
+	if (src_stride == dst_stride) {
+		dst_size -= dst_offset;
+		src_size -= src_offset;
+		memcpy(vdst, vsrc,
+		       min(dst_stride * height, min(dst_size, src_size)));
+	} else {
+		WARN_ON(dst_stride < width_in_bytes);
+		for (i = 0; i < height; ++i) {
+			memcpy(vdst, vsrc, width_in_bytes);
+			vsrc += src_stride;
+			vdst += dst_stride;
+		}
+	}
+
+	x_in_bytes = (dst_offset % dst_stride);
+	diff->rect.x1 =  x_in_bytes / diff->cpp;
+	diff->rect.y1 = ((dst_offset - x_in_bytes) / dst_stride);
+	diff->rect.x2 = diff->rect.x1 + width_in_bytes / diff->cpp;
+	diff->rect.y2 = diff->rect.y1 + height;
+
+	ret = 0;
+out:
+	unmap_external(src, &src_map);
+	unmap_external(dst, &dst_map);
+
+	return ret;
+}
+
 /**
  * vmw_bo_cpu_blit - in-kernel cpu blit.
  *
- * @dst: Destination buffer object.
+ * @vmw_dst: Destination buffer object.
  * @dst_offset: Destination offset of blit start in bytes.
  * @dst_stride: Destination stride in bytes.
- * @src: Source buffer object.
+ * @vmw_src: Source buffer object.
  * @src_offset: Source offset of blit start in bytes.
  * @src_stride: Source stride in bytes.
  * @w: Width of blit.
@@ -444,20 +538,29 @@
  * Neither of the buffer objects may be placed in PCI memory
  * (Fixed memory in TTM terminology) when using this function.
  */
-int vmw_bo_cpu_blit(struct ttm_buffer_object *dst,
+int vmw_bo_cpu_blit(struct vmw_bo *vmw_dst,
 		    u32 dst_offset, u32 dst_stride,
-		    struct ttm_buffer_object *src,
+		    struct vmw_bo *vmw_src,
 		    u32 src_offset, u32 src_stride,
 		    u32 w, u32 h,
 		    struct vmw_diff_cpy *diff)
 {
+	struct ttm_buffer_object *src = &vmw_src->tbo;
+	struct ttm_buffer_object *dst = &vmw_dst->tbo;
 	struct ttm_operation_ctx ctx = {
 		.interruptible = false,
 		.no_wait_gpu = false
 	};
 	u32 j, initial_line = dst_offset / dst_stride;
-	struct vmw_bo_blit_line_data d;
+	struct vmw_bo_blit_line_data d = {0};
 	int ret = 0;
+	struct page **dst_pages = NULL;
+	struct page **src_pages = NULL;
+	bool src_external = (src->ttm->page_flags & TTM_TT_FLAG_EXTERNAL) != 0;
+	bool dst_external = (dst->ttm->page_flags & TTM_TT_FLAG_EXTERNAL) != 0;
+
+	if (WARN_ON(dst == src))
+		return -EINVAL;
 
 	/* Buffer objects need to be either pinned or reserved: */
 	if (!(dst->pin_count))
@@ -477,12 +580,40 @@
 			return ret;
 	}
 
+	if (src_external || dst_external)
+		return vmw_external_bo_copy(vmw_dst, dst_offset, dst_stride,
+					    vmw_src, src_offset, src_stride,
+					    w, h, diff);
+
+	if (!src->ttm->pages && src->ttm->sg) {
+		src_pages = kvmalloc_array(src->ttm->num_pages,
+					   sizeof(struct page *), GFP_KERNEL);
+		if (!src_pages)
+			return -ENOMEM;
+		ret = drm_prime_sg_to_page_array(src->ttm->sg, src_pages,
+						 src->ttm->num_pages);
+		if (ret)
+			goto out;
+	}
+	if (!dst->ttm->pages && dst->ttm->sg) {
+		dst_pages = kvmalloc_array(dst->ttm->num_pages,
+					   sizeof(struct page *), GFP_KERNEL);
+		if (!dst_pages) {
+			ret = -ENOMEM;
+			goto out;
+		}
+		ret = drm_prime_sg_to_page_array(dst->ttm->sg, dst_pages,
+						 dst->ttm->num_pages);
+		if (ret)
+			goto out;
+	}
+
 	d.mapped_dst = 0;
 	d.mapped_src = 0;
 	d.dst_addr = NULL;
 	d.src_addr = NULL;
-	d.dst_pages = dst->ttm->pages;
-	d.src_pages = src->ttm->pages;
+	d.dst_pages = dst->ttm->pages ? dst->ttm->pages : dst_pages;
+	d.src_pages = src->ttm->pages ? src->ttm->pages : src_pages;
 	d.dst_num_pages = PFN_UP(dst->resource->size);
 	d.src_num_pages = PFN_UP(src->resource->size);
 	d.dst_prot = ttm_io_prot(dst, dst->resource, PAGE_KERNEL);
@@ -504,6 +635,10 @@
 		kunmap_atomic(d.src_addr);
 	if (d.dst_addr)
 		kunmap_atomic(d.dst_addr);
+	if (src_pages)
+		kvfree(src_pages);
+	if (dst_pages)
+		kvfree(dst_pages);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0 OR MIT
 /**************************************************************************
  *
- * Copyright © 2011-2023 VMware, Inc., Palo Alto, CA., USA
- * All Rights Reserved.
+ * Copyright (c) 2011-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -28,15 +28,39 @@
 
 #include "vmwgfx_bo.h"
 #include "vmwgfx_drv.h"
-
+#include "vmwgfx_resource_priv.h"
 
 #include <drm/ttm/ttm_placement.h>
 
 static void vmw_bo_release(struct vmw_bo *vbo)
 {
+	struct vmw_resource *res;
+
 	WARN_ON(vbo->tbo.base.funcs &&
 		kref_read(&vbo->tbo.base.refcount) != 0);
 	vmw_bo_unmap(vbo);
+
+	xa_destroy(&vbo->detached_resources);
+	WARN_ON(vbo->is_dumb && !vbo->dumb_surface);
+	if (vbo->is_dumb && vbo->dumb_surface) {
+		res = &vbo->dumb_surface->res;
+		WARN_ON(vbo != res->guest_memory_bo);
+		WARN_ON(!res->guest_memory_bo);
+		if (res->guest_memory_bo) {
+			/* Reserve and switch the backing mob. */
+			mutex_lock(&res->dev_priv->cmdbuf_mutex);
+			(void)vmw_resource_reserve(res, false, true);
+			vmw_resource_mob_detach(res);
+			if (res->coherent)
+				vmw_bo_dirty_release(res->guest_memory_bo);
+			res->guest_memory_bo = NULL;
+			res->guest_memory_offset = 0;
+			vmw_resource_unreserve(res, false, false, false, NULL,
+					       0);
+			mutex_unlock(&res->dev_priv->cmdbuf_mutex);
+		}
+		vmw_surface_unreference(&vbo->dumb_surface);
+	}
 	drm_gem_object_release(&vbo->tbo.base);
 }
 
@@ -204,6 +228,7 @@
 			     VMW_BO_DOMAIN_VRAM,
 			     VMW_BO_DOMAIN_VRAM);
 	buf->places[0].lpfn = PFN_UP(bo->resource->size);
+	buf->busy_places[0].lpfn = PFN_UP(bo->resource->size);
 	ret = ttm_bo_validate(bo, &buf->placement, &ctx);
 
 	/* For some reason we didn't end up at the start of vram */
@@ -325,18 +350,26 @@
  */
 void *vmw_bo_map_and_cache(struct vmw_bo *vbo)
 {
+	return vmw_bo_map_and_cache_size(vbo, vbo->tbo.base.size);
+}
+
+void *vmw_bo_map_and_cache_size(struct vmw_bo *vbo, size_t size)
+{
 	struct ttm_buffer_object *bo = &vbo->tbo;
 	bool not_used;
 	void *virtual;
 	int ret;
 
+	atomic_inc(&vbo->map_count);
+
 	virtual = ttm_kmap_obj_virtual(&vbo->map, &not_used);
 	if (virtual)
 		return virtual;
 
-	ret = ttm_bo_kmap(bo, 0, PFN_UP(bo->base.size), &vbo->map);
+	ret = ttm_bo_kmap(bo, 0, PFN_UP(size), &vbo->map);
 	if (ret)
-		DRM_ERROR("Buffer object map failed: %d.\n", ret);
+		DRM_ERROR("Buffer object map failed: %d (size: bo = %zu, map = %zu).\n",
+			  ret, bo->base.size, size);
 
 	return ttm_kmap_obj_virtual(&vbo->map, &not_used);
 }
@@ -352,11 +385,17 @@
  */
 void vmw_bo_unmap(struct vmw_bo *vbo)
 {
+	int map_count;
+
 	if (vbo->map.bo == NULL)
 		return;
 
-	ttm_bo_kunmap(&vbo->map);
-	vbo->map.bo = NULL;
+	map_count = atomic_dec_return(&vbo->map_count);
+
+	if (!map_count) {
+		ttm_bo_kunmap(&vbo->map);
+		vbo->map.bo = NULL;
+	}
 }
 
 
@@ -377,7 +416,8 @@
 {
 	struct ttm_operation_ctx ctx = {
 		.interruptible = params->bo_type != ttm_bo_type_kernel,
-		.no_wait_gpu = false
+		.no_wait_gpu = false,
+		.resv = params->resv,
 	};
 	struct ttm_device *bdev = &dev_priv->bdev;
 	struct drm_device *vdev = &dev_priv->drm;
@@ -388,20 +428,23 @@
 	BUILD_BUG_ON(TTM_MAX_BO_PRIORITY <= 3);
 	vmw_bo->tbo.priority = 3;
 	vmw_bo->res_tree = RB_ROOT;
+	xa_init(&vmw_bo->detached_resources);
+	atomic_set(&vmw_bo->map_count, 0);
 
 	params->size = ALIGN(params->size, PAGE_SIZE);
 	drm_gem_private_object_init(vdev, &vmw_bo->tbo.base, params->size);
 
 	vmw_bo_placement_set(vmw_bo, params->domain, params->busy_domain);
 	ret = ttm_bo_init_reserved(bdev, &vmw_bo->tbo, params->bo_type,
-				   &vmw_bo->placement, 0, &ctx, NULL,
-				   NULL, destroy);
+				   &vmw_bo->placement, 0, &ctx,
+				   params->sg, params->resv, destroy);
 	if (unlikely(ret))
 		return ret;
 
 	if (params->pin)
 		ttm_bo_pin(&vmw_bo->tbo);
-	ttm_bo_unreserve(&vmw_bo->tbo);
+	if (!params->keep_resv)
+		ttm_bo_unreserve(&vmw_bo->tbo);
 
 	return 0;
 }
@@ -652,52 +695,6 @@
 	dma_fence_put(&fence->base);
 }
 
-
-/**
- * vmw_dumb_create - Create a dumb kms buffer
- *
- * @file_priv: Pointer to a struct drm_file identifying the caller.
- * @dev: Pointer to the drm device.
- * @args: Pointer to a struct drm_mode_create_dumb structure
- * Return: Zero on success, negative error code on failure.
- *
- * This is a driver callback for the core drm create_dumb functionality.
- * Note that this is very similar to the vmw_bo_alloc ioctl, except
- * that the arguments have a different format.
- */
-int vmw_dumb_create(struct drm_file *file_priv,
-		    struct drm_device *dev,
-		    struct drm_mode_create_dumb *args)
-{
-	struct vmw_private *dev_priv = vmw_priv(dev);
-	struct vmw_bo *vbo;
-	int cpp = DIV_ROUND_UP(args->bpp, 8);
-	int ret;
-
-	switch (cpp) {
-	case 1: /* DRM_FORMAT_C8 */
-	case 2: /* DRM_FORMAT_RGB565 */
-	case 4: /* DRM_FORMAT_XRGB8888 */
-		break;
-	default:
-		/*
-		 * Dumb buffers don't allow anything else.
-		 * This is tested via IGT's dumb_buffers
-		 */
-		return -EINVAL;
-	}
-
-	args->pitch = args->width * cpp;
-	args->size = ALIGN(args->pitch * args->height, PAGE_SIZE);
-
-	ret = vmw_gem_object_create_with_handle(dev_priv, file_priv,
-						args->size, &args->handle,
-						&vbo);
-	/* drop reference from allocate - handle holds it now */
-	drm_gem_object_put(&vbo->tbo.base);
-	return ret;
-}
-
 /**
  * vmw_bo_swap_notify - swapout notify callback.
  *
@@ -836,3 +833,43 @@
 
 	vmw_bo_placement_set(bo, domain, domain);
 }
+
+void vmw_bo_add_detached_resource(struct vmw_bo *vbo, struct vmw_resource *res)
+{
+	xa_store(&vbo->detached_resources, (unsigned long)res, res, GFP_KERNEL);
+}
+
+void vmw_bo_del_detached_resource(struct vmw_bo *vbo, struct vmw_resource *res)
+{
+	xa_erase(&vbo->detached_resources, (unsigned long)res);
+}
+
+struct vmw_surface *vmw_bo_surface(struct vmw_bo *vbo)
+{
+	unsigned long index;
+	struct vmw_resource *res = NULL;
+	struct vmw_surface *surf = NULL;
+	struct rb_node *rb_itr = vbo->res_tree.rb_node;
+
+	if (vbo->is_dumb && vbo->dumb_surface) {
+		res = &vbo->dumb_surface->res;
+		goto out;
+	}
+
+	xa_for_each(&vbo->detached_resources, index, res) {
+		if (res->func->res_type == vmw_res_surface)
+			goto out;
+	}
+
+	for (rb_itr = rb_first(&vbo->res_tree); rb_itr;
+	     rb_itr = rb_next(rb_itr)) {
+		res = rb_entry(rb_itr, struct vmw_resource, mob_node);
+		if (res->func->res_type == vmw_res_surface)
+			goto out;
+	}
+
+out:
+	if (res)
+		surf = vmw_res_to_srf(res);
+	return surf;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_bo.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_bo.h
@@ -1,7 +1,8 @@
 /* SPDX-License-Identifier: GPL-2.0 OR MIT */
 /**************************************************************************
  *
- * Copyright 2023 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2023-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -35,11 +36,13 @@
 
 #include <linux/rbtree_types.h>
 #include <linux/types.h>
+#include <linux/xarray.h>
 
 struct vmw_bo_dirty;
 struct vmw_fence_obj;
 struct vmw_private;
 struct vmw_resource;
+struct vmw_surface;
 
 enum vmw_bo_domain {
 	VMW_BO_DOMAIN_SYS           = BIT(0),
@@ -53,8 +56,11 @@
 	u32 domain;
 	u32 busy_domain;
 	enum ttm_bo_type bo_type;
-	size_t size;
 	bool pin;
+	bool keep_resv;
+	size_t size;
+	struct dma_resv *resv;
+	struct sg_table *sg;
 };
 
 /**
@@ -66,6 +72,8 @@
  * @map: Kmap object for semi-persistent mappings
  * @res_tree: RB tree of resources using this buffer object as a backing MOB
  * @res_prios: Eviction priority counts for attached resources
+ * @map_count: The number of currently active maps. Will differ from the
+ * cpu_writers because it includes kernel maps.
  * @cpu_writers: Number of synccpu write grabs. Protected by reservation when
  * increased. May be decreased without reservation.
  * @dx_query_ctx: DX context if this buffer object is used as a DX query MOB
@@ -83,11 +91,16 @@
 
 	struct rb_root res_tree;
 	u32 res_prios[TTM_MAX_BO_PRIORITY];
+	struct xarray detached_resources;
 
+	atomic_t map_count;
 	atomic_t cpu_writers;
 	/* Not ref-counted.  Protected by binding_mutex */
 	struct vmw_resource *dx_query_ctx;
 	struct vmw_bo_dirty *dirty;
+
+	bool is_dumb;
+	struct vmw_surface *dumb_surface;
 };
 
 void vmw_bo_placement_set(struct vmw_bo *bo, u32 domain, u32 busy_domain);
@@ -122,15 +135,21 @@
 			 struct vmw_fence_obj *fence);
 
 void *vmw_bo_map_and_cache(struct vmw_bo *vbo);
+void *vmw_bo_map_and_cache_size(struct vmw_bo *vbo, size_t size);
 void vmw_bo_unmap(struct vmw_bo *vbo);
 
 void vmw_bo_move_notify(struct ttm_buffer_object *bo,
 			struct ttm_resource *mem);
 void vmw_bo_swap_notify(struct ttm_buffer_object *bo);
 
+void vmw_bo_add_detached_resource(struct vmw_bo *vbo, struct vmw_resource *res);
+void vmw_bo_del_detached_resource(struct vmw_bo *vbo, struct vmw_resource *res);
+struct vmw_surface *vmw_bo_surface(struct vmw_bo *vbo);
+
 int vmw_user_bo_lookup(struct drm_file *filp,
 		       u32 handle,
 		       struct vmw_bo **out);
+
 /**
  * vmw_bo_adjust_prio - Adjust the buffer object eviction priority
  * according to attached resources
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -399,7 +399,8 @@
 		.busy_domain = VMW_BO_DOMAIN_SYS,
 		.bo_type = ttm_bo_type_kernel,
 		.size = PAGE_SIZE,
-		.pin = true
+		.pin = true,
+		.keep_resv = true,
 	};
 
 	/*
@@ -411,10 +412,6 @@
 	if (unlikely(ret != 0))
 		return ret;
 
-	ret = ttm_bo_reserve(&vbo->tbo, false, true, NULL);
-	BUG_ON(ret != 0);
-	vmw_bo_pin_reserved(vbo, true);
-
 	ret = ttm_bo_kmap(&vbo->tbo, 0, 1, &map);
 	if (likely(ret == 0)) {
 		result = ttm_kmap_obj_virtual(&map, &dummy);
@@ -666,11 +663,12 @@
 		[vmw_dma_map_populate] = "Caching DMA mappings.",
 		[vmw_dma_map_bind] = "Giving up DMA mappings early."};
 
-	/* TTM currently doesn't fully support SEV encryption. */
-	if (cc_platform_has(CC_ATTR_MEM_ENCRYPT))
-		return -EINVAL;
-
-	if (vmw_force_coherent)
+	/*
+	 * When running with SEV we always want dma mappings, because
+	 * otherwise ttm tt pool pages will bounce through swiotlb running
+	 * out of available space.
+	 */
+	if (vmw_force_coherent || cc_platform_has(CC_ATTR_MEM_ENCRYPT))
 		dev_priv->map_mode = vmw_dma_alloc_coherent;
 	else if (vmw_restrict_iommu)
 		dev_priv->map_mode = vmw_dma_map_bind;
@@ -955,13 +953,6 @@
 				vmw_read(dev_priv,
 					 SVGA_REG_SUGGESTED_GBOBJECT_MEM_SIZE_KB);
 
-		/*
-		 * Workaround for low memory 2D VMs to compensate for the
-		 * allocation taken by fbdev
-		 */
-		if (!(dev_priv->capabilities & SVGA_CAP_3D))
-			mem_size *= 3;
-
 		dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE;
 		dev_priv->max_primary_mem =
 			vmw_read(dev_priv, SVGA_REG_MAX_PRIMARY_MEM);
@@ -1444,12 +1435,15 @@
 					    root, "system_ttm");
 	ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, TTM_PL_VRAM),
 					    root, "vram_ttm");
-	ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_GMR),
-					    root, "gmr_ttm");
-	ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_MOB),
-					    root, "mob_ttm");
-	ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_SYSTEM),
-					    root, "system_mob_ttm");
+	if (vmw->has_gmr)
+		ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_GMR),
+						    root, "gmr_ttm");
+	if (vmw->has_mob) {
+		ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_MOB),
+						    root, "mob_ttm");
+		ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_SYSTEM),
+						    root, "system_mob_ttm");
+	}
 }
 
 static int vmwgfx_pm_notifier(struct notifier_block *nb, unsigned long val,
@@ -1624,6 +1618,7 @@
 
 	.prime_fd_to_handle = vmw_prime_fd_to_handle,
 	.prime_handle_to_fd = vmw_prime_handle_to_fd,
+	.gem_prime_import_sg_table = vmw_prime_import_sg_table,
 
 	.fops = &vmwgfx_driver_fops,
 	.name = VMWGFX_DRIVER_NAME,
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -1,7 +1,8 @@
 /* SPDX-License-Identifier: GPL-2.0 OR MIT */
 /**************************************************************************
  *
- * Copyright 2009-2023 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2009-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -61,7 +62,7 @@
 #define VMWGFX_DRIVER_MINOR 20
 #define VMWGFX_DRIVER_PATCHLEVEL 0
 #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
-#define VMWGFX_MAX_DISPLAYS 16
+#define VMWGFX_NUM_DISPLAY_UNITS 8
 #define VMWGFX_CMD_BOUNCE_INIT_SIZE 32768
 
 #define VMWGFX_MIN_INITIAL_WIDTH 1280
@@ -81,7 +82,7 @@
 #define VMWGFX_NUM_GB_CONTEXT 256
 #define VMWGFX_NUM_GB_SHADER 20000
 #define VMWGFX_NUM_GB_SURFACE 32768
-#define VMWGFX_NUM_GB_SCREEN_TARGET VMWGFX_MAX_DISPLAYS
+#define VMWGFX_NUM_GB_SCREEN_TARGET VMWGFX_NUM_DISPLAY_UNITS
 #define VMWGFX_NUM_DXCONTEXT 256
 #define VMWGFX_NUM_DXQUERY 512
 #define VMWGFX_NUM_MOB (VMWGFX_NUM_GB_CONTEXT +\
@@ -117,25 +118,8 @@
 	unsigned long key;
 };
 
-
-/**
- * struct vmw_validate_buffer - Carries validation info about buffers.
- *
- * @base: Validation info for TTM.
- * @hash: Hash entry for quick lookup of the TTM buffer object.
- *
- * This structure contains also driver private validation info
- * on top of the info needed by TTM.
- */
-struct vmw_validate_buffer {
-	struct ttm_validate_buffer base;
-	struct vmwgfx_hash_item hash;
-	bool validate_as_mob;
-};
-
 struct vmw_res_func;
 
-
 /**
  * struct vmw-resource - base class for hardware resources
  *
@@ -445,15 +429,6 @@
 struct vmw_legacy_display;
 struct vmw_overlay;
 
-struct vmw_vga_topology_state {
-	uint32_t width;
-	uint32_t height;
-	uint32_t primary;
-	uint32_t pos_x;
-	uint32_t pos_y;
-};
-
-
 /*
  * struct vmw_otable - Guest Memory OBject table metadata
  *
@@ -501,7 +476,6 @@
 	struct drm_device drm;
 	struct ttm_device bdev;
 
-	struct drm_vma_offset_manager vma_manager;
 	u32 pci_id;
 	resource_size_t io_start;
 	resource_size_t vram_start;
@@ -787,6 +761,26 @@
 extern void vmw_gmr_unbind(struct vmw_private *dev_priv, int gmr_id);
 
 /**
+ * User handles
+ */
+struct vmw_user_object {
+	struct vmw_surface *surface;
+	struct vmw_bo *buffer;
+};
+
+int vmw_user_object_lookup(struct vmw_private *dev_priv, struct drm_file *filp,
+			   u32 handle, struct vmw_user_object *uo);
+struct vmw_user_object *vmw_user_object_ref(struct vmw_user_object *uo);
+void vmw_user_object_unref(struct vmw_user_object *uo);
+bool vmw_user_object_is_null(struct vmw_user_object *uo);
+struct vmw_surface *vmw_user_object_surface(struct vmw_user_object *uo);
+struct vmw_bo *vmw_user_object_buffer(struct vmw_user_object *uo);
+void *vmw_user_object_map(struct vmw_user_object *uo);
+void *vmw_user_object_map_size(struct vmw_user_object *uo, size_t size);
+void vmw_user_object_unmap(struct vmw_user_object *uo);
+bool vmw_user_object_is_mapped(struct vmw_user_object *uo);
+
+/**
  * Resource utilities - vmwgfx_resource.c
  */
 struct vmw_user_resource_conv;
@@ -800,11 +794,6 @@
 extern int vmw_resource_reserve(struct vmw_resource *res, bool interruptible,
 				bool no_backup);
 extern bool vmw_resource_needs_backup(const struct vmw_resource *res);
-extern int vmw_user_lookup_handle(struct vmw_private *dev_priv,
-				  struct drm_file *filp,
-				  uint32_t handle,
-				  struct vmw_surface **out_surf,
-				  struct vmw_bo **out_buf);
 extern int vmw_user_resource_lookup_handle(
 	struct vmw_private *dev_priv,
 	struct ttm_object_file *tfile,
@@ -1067,9 +1056,6 @@
 int vmw_kms_write_svga(struct vmw_private *vmw_priv,
 		       unsigned width, unsigned height, unsigned pitch,
 		       unsigned bpp, unsigned depth);
-bool vmw_kms_validate_mode_vram(struct vmw_private *dev_priv,
-				uint32_t pitch,
-				uint32_t height);
 int vmw_kms_present(struct vmw_private *dev_priv,
 		    struct drm_file *file_priv,
 		    struct vmw_framebuffer *vfb,
@@ -1084,9 +1070,6 @@
 int vmw_kms_resume(struct drm_device *dev);
 void vmw_kms_lost_device(struct drm_device *dev);
 
-int vmw_dumb_create(struct drm_file *file_priv,
-		    struct drm_device *dev,
-		    struct drm_mode_create_dumb *args);
 extern int vmw_resource_pin(struct vmw_resource *res, bool interruptible);
 extern void vmw_resource_unpin(struct vmw_resource *res);
 extern enum vmw_res_type vmw_res_type(const struct vmw_resource *res);
@@ -1131,6 +1114,9 @@
 				  struct drm_file *file_priv,
 				  uint32_t handle, uint32_t flags,
 				  int *prime_fd);
+struct drm_gem_object *vmw_prime_import_sg_table(struct drm_device *dev,
+						 struct dma_buf_attachment *attach,
+						 struct sg_table *table);
 
 /*
  * MemoryOBject management -  vmwgfx_mob.c
@@ -1200,6 +1186,15 @@
 int vmw_gb_surface_define(struct vmw_private *dev_priv,
 			  const struct vmw_surface_metadata *req,
 			  struct vmw_surface **srf_out);
+struct vmw_surface *vmw_lookup_surface_for_buffer(struct vmw_private *vmw,
+						  struct vmw_bo *bo,
+						  u32 handle);
+u32 vmw_lookup_surface_handle_for_buffer(struct vmw_private *vmw,
+					 struct vmw_bo *bo,
+					 u32 handle);
+int vmw_dumb_create(struct drm_file *file_priv,
+		    struct drm_device *dev,
+		    struct drm_mode_create_dumb *args);
 
 /*
  * Shader management - vmwgfx_shader.c
@@ -1355,9 +1350,9 @@
 
 void vmw_memcpy(struct vmw_diff_cpy *diff, u8 *dest, const u8 *src, size_t n);
 
-int vmw_bo_cpu_blit(struct ttm_buffer_object *dst,
+int vmw_bo_cpu_blit(struct vmw_bo *dst,
 		    u32 dst_offset, u32 dst_stride,
-		    struct ttm_buffer_object *src,
+		    struct vmw_bo *src,
 		    u32 src_offset, u32 src_stride,
 		    u32 w, u32 h,
 		    struct vmw_diff_cpy *diff);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -447,7 +447,7 @@
 	    vmw_res_type(ctx) == vmw_res_dx_context) {
 		for (i = 0; i < cotable_max; ++i) {
 			res = vmw_context_cotable(ctx, i);
-			if (IS_ERR(res))
+			if (IS_ERR_OR_NULL(res))
 				continue;
 
 			ret = vmw_execbuf_res_val_add(sw_context, res,
@@ -1266,6 +1266,8 @@
 		return -EINVAL;
 
 	cotable_res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXQUERY);
+	if (IS_ERR_OR_NULL(cotable_res))
+		return cotable_res ? PTR_ERR(cotable_res) : -EINVAL;
 	ret = vmw_cotable_notify(cotable_res, cmd->body.queryId);
 
 	return ret;
@@ -2484,6 +2486,8 @@
 		return ret;
 
 	res = vmw_context_cotable(ctx_node->ctx, vmw_view_cotables[view_type]);
+	if (IS_ERR_OR_NULL(res))
+		return res ? PTR_ERR(res) : -EINVAL;
 	ret = vmw_cotable_notify(res, cmd->defined_id);
 	if (unlikely(ret != 0))
 		return ret;
@@ -2569,8 +2573,8 @@
 
 	so_type = vmw_so_cmd_to_type(header->id);
 	res = vmw_context_cotable(ctx_node->ctx, vmw_so_cotables[so_type]);
-	if (IS_ERR(res))
-		return PTR_ERR(res);
+	if (IS_ERR_OR_NULL(res))
+		return res ? PTR_ERR(res) : -EINVAL;
 	cmd = container_of(header, typeof(*cmd), header);
 	ret = vmw_cotable_notify(res, cmd->defined_id);
 
@@ -2689,6 +2693,8 @@
 		return -EINVAL;
 
 	res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXSHADER);
+	if (IS_ERR_OR_NULL(res))
+		return res ? PTR_ERR(res) : -EINVAL;
 	ret = vmw_cotable_notify(res, cmd->body.shaderId);
 	if (ret)
 		return ret;
@@ -3010,6 +3016,8 @@
 	}
 
 	res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_STREAMOUTPUT);
+	if (IS_ERR_OR_NULL(res))
+		return res ? PTR_ERR(res) : -EINVAL;
 	ret = vmw_cotable_notify(res, cmd->body.soid);
 	if (ret)
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -32,7 +32,6 @@
 #define VMW_FENCE_WRAP (1 << 31)
 
 struct vmw_fence_manager {
-	int num_fence_objects;
 	struct vmw_private *dev_priv;
 	spinlock_t lock;
 	struct list_head fence_list;
@@ -124,13 +123,13 @@
 {
 	struct vmw_fence_obj *fence =
 		container_of(f, struct vmw_fence_obj, base);
-
 	struct vmw_fence_manager *fman = fman_from_fence(fence);
 
-	spin_lock(&fman->lock);
-	list_del_init(&fence->head);
-	--fman->num_fence_objects;
-	spin_unlock(&fman->lock);
+	if (!list_empty(&fence->head)) {
+		spin_lock(&fman->lock);
+		list_del_init(&fence->head);
+		spin_unlock(&fman->lock);
+	}
 	fence->destroy(fence);
 }
 
@@ -257,7 +256,6 @@
 	.release = vmw_fence_obj_destroy,
 };
 
-
 /*
  * Execute signal actions on fences recently signaled.
  * This is done from a workqueue so we don't have to execute
@@ -355,7 +353,6 @@
 		goto out_unlock;
 	}
 	list_add_tail(&fence->head, &fman->fence_list);
-	++fman->num_fence_objects;
 
 out_unlock:
 	spin_unlock(&fman->lock);
@@ -403,7 +400,7 @@
 				      u32 passed_seqno)
 {
 	u32 goal_seqno;
-	struct vmw_fence_obj *fence;
+	struct vmw_fence_obj *fence, *next_fence;
 
 	if (likely(!fman->seqno_valid))
 		return false;
@@ -413,7 +410,7 @@
 		return false;
 
 	fman->seqno_valid = false;
-	list_for_each_entry(fence, &fman->fence_list, head) {
+	list_for_each_entry_safe(fence, next_fence, &fman->fence_list, head) {
 		if (!list_empty(&fence->seq_passed_actions)) {
 			fman->seqno_valid = true;
 			vmw_fence_goal_write(fman->dev_priv,
@@ -991,7 +988,7 @@
 	}
 
 	event->event.base.type = DRM_VMW_EVENT_FENCE_SIGNALED;
-	event->event.base.length = sizeof(*event);
+	event->event.base.length = sizeof(event->event);
 	event->event.user_data = user_data;
 
 	ret = drm_event_reserve_init(dev, file_priv, &event->base, &event->event.base);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
@@ -149,6 +149,39 @@
 	return ret;
 }
 
+struct drm_gem_object *vmw_prime_import_sg_table(struct drm_device *dev,
+						 struct dma_buf_attachment *attach,
+						 struct sg_table *table)
+{
+	int ret;
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct drm_gem_object *gem = NULL;
+	struct vmw_bo *vbo;
+	struct vmw_bo_params params = {
+		.domain = (dev_priv->has_mob) ? VMW_BO_DOMAIN_SYS : VMW_BO_DOMAIN_VRAM,
+		.busy_domain = VMW_BO_DOMAIN_SYS,
+		.bo_type = ttm_bo_type_sg,
+		.size = attach->dmabuf->size,
+		.pin = false,
+		.keep_resv = true,
+		.resv = attach->dmabuf->resv,
+		.sg = table,
+
+	};
+
+	dma_resv_lock(params.resv, NULL);
+
+	ret = vmw_bo_create(dev_priv, &params, &vbo);
+	if (ret != 0)
+		goto out_no_bo;
+
+	vbo->tbo.base.funcs = &vmw_gem_object_funcs;
+
+	gem = &vbo->tbo.base;
+out_no_bo:
+	dma_resv_unlock(params.resv);
+	return gem;
+}
 
 int vmw_gem_object_create_ioctl(struct drm_device *dev, void *data,
 				struct drm_file *filp)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
@@ -64,8 +64,11 @@
 	ttm_resource_init(bo, place, *res);
 
 	id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL);
-	if (id < 0)
+	if (id < 0) {
+		ttm_resource_fini(man, *res);
+		kfree(*res);
 		return id;
+	}
 
 	spin_lock(&gman->lock);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0 OR MIT
 /**************************************************************************
  *
- * Copyright 2009-2023 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2009-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -35,6 +36,7 @@
 #include <drm/drm_fourcc.h>
 #include <drm/drm_rect.h>
 #include <drm/drm_sysfs.h>
+#include <drm/drm_edid.h>
 
 void vmw_du_cleanup(struct vmw_display_unit *du)
 {
@@ -184,14 +186,16 @@
  */
 static u32 *vmw_du_cursor_plane_acquire_image(struct vmw_plane_state *vps)
 {
-	bool is_iomem;
-	if (vps->surf) {
-		if (vps->surf_mapped)
-			return vmw_bo_map_and_cache(vps->surf->res.guest_memory_bo);
-		return vps->surf->snooper.image;
-	} else if (vps->bo)
-		return ttm_kmap_obj_virtual(&vps->bo->map, &is_iomem);
-	return NULL;
+	struct vmw_surface *surf;
+
+	if (vmw_user_object_is_null(&vps->uo))
+		return NULL;
+
+	surf = vmw_user_object_surface(&vps->uo);
+	if (surf && !vmw_user_object_is_mapped(&vps->uo))
+		return surf->snooper.image;
+
+	return vmw_user_object_map(&vps->uo);
 }
 
 static bool vmw_du_cursor_plane_has_changed(struct vmw_plane_state *old_vps,
@@ -216,7 +220,7 @@
 	new_image = vmw_du_cursor_plane_acquire_image(new_vps);
 
 	changed = false;
-	if (old_image && new_image)
+	if (old_image && new_image && old_image != new_image)
 		changed = memcmp(old_image, new_image, size) != 0;
 
 	return changed;
@@ -272,6 +276,7 @@
 	u32 size = vmw_du_cursor_mob_size(vps->base.crtc_w, vps->base.crtc_h);
 	u32 i;
 	u32 cursor_max_dim, mob_max_size;
+	struct vmw_fence_obj *fence = NULL;
 	int ret;
 
 	if (!dev_priv->has_mob ||
@@ -313,7 +318,15 @@
 	if (ret != 0)
 		goto teardown;
 
-	vmw_bo_fence_single(&vps->cursor.bo->tbo, NULL);
+	ret = vmw_execbuf_fence_commands(NULL, dev_priv, &fence, NULL);
+	if (ret != 0) {
+		ttm_bo_unreserve(&vps->cursor.bo->tbo);
+		goto teardown;
+	}
+
+	dma_fence_wait(&fence->base, false);
+	dma_fence_put(&fence->base);
+
 	ttm_bo_unreserve(&vps->cursor.bo->tbo);
 	return 0;
 
@@ -519,22 +532,16 @@
  * vmw_du_plane_unpin_surf - unpins resource associated with a framebuffer surface
  *
  * @vps: plane state associated with the display surface
- * @unreference: true if we also want to unreference the display.
  */
-void vmw_du_plane_unpin_surf(struct vmw_plane_state *vps,
-			     bool unreference)
+void vmw_du_plane_unpin_surf(struct vmw_plane_state *vps)
 {
-	if (vps->surf) {
+	struct vmw_surface *surf = vmw_user_object_surface(&vps->uo);
+
+	if (surf) {
 		if (vps->pinned) {
-			vmw_resource_unpin(&vps->surf->res);
+			vmw_resource_unpin(&surf->res);
 			vps->pinned--;
 		}
-
-		if (unreference) {
-			if (vps->pinned)
-				DRM_ERROR("Surface still pinned\n");
-			vmw_surface_unreference(&vps->surf);
-		}
 	}
 }
 
@@ -555,7 +562,7 @@
 {
 	struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state);
 
-	vmw_du_plane_unpin_surf(vps, false);
+	vmw_du_plane_unpin_surf(vps);
 }
 
 
@@ -643,36 +650,15 @@
 {
 	struct vmw_cursor_plane *vcp = vmw_plane_to_vcp(plane);
 	struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state);
-	bool is_iomem;
-
-	if (vps->surf_mapped) {
-		vmw_bo_unmap(vps->surf->res.guest_memory_bo);
-		vps->surf_mapped = false;
-	}
-
-	if (vps->bo && ttm_kmap_obj_virtual(&vps->bo->map, &is_iomem)) {
-		const int ret = ttm_bo_reserve(&vps->bo->tbo, true, false, NULL);
 
-		if (likely(ret == 0)) {
-			ttm_bo_kunmap(&vps->bo->map);
-			ttm_bo_unreserve(&vps->bo->tbo);
-		}
-	}
+	if (!vmw_user_object_is_null(&vps->uo))
+		vmw_user_object_unmap(&vps->uo);
 
 	vmw_du_cursor_plane_unmap_cm(vps);
 	vmw_du_put_cursor_mob(vcp, vps);
 
-	vmw_du_plane_unpin_surf(vps, false);
-
-	if (vps->surf) {
-		vmw_surface_unreference(&vps->surf);
-		vps->surf = NULL;
-	}
-
-	if (vps->bo) {
-		vmw_bo_unreference(&vps->bo);
-		vps->bo = NULL;
-	}
+	vmw_du_plane_unpin_surf(vps);
+	vmw_user_object_unref(&vps->uo);
 }
 
 
@@ -691,60 +677,48 @@
 	struct drm_framebuffer *fb = new_state->fb;
 	struct vmw_cursor_plane *vcp = vmw_plane_to_vcp(plane);
 	struct vmw_plane_state *vps = vmw_plane_state_to_vps(new_state);
+	struct vmw_bo *bo = NULL;
 	int ret = 0;
 
-	if (vps->surf) {
-		vmw_surface_unreference(&vps->surf);
-		vps->surf = NULL;
-	}
-
-	if (vps->bo) {
-		vmw_bo_unreference(&vps->bo);
-		vps->bo = NULL;
+	if (!vmw_user_object_is_null(&vps->uo)) {
+		vmw_user_object_unmap(&vps->uo);
+		vmw_user_object_unref(&vps->uo);
 	}
 
 	if (fb) {
 		if (vmw_framebuffer_to_vfb(fb)->bo) {
-			vps->bo = vmw_framebuffer_to_vfbd(fb)->buffer;
-			vmw_bo_reference(vps->bo);
+			vps->uo.buffer = vmw_framebuffer_to_vfbd(fb)->buffer;
+			vps->uo.surface = NULL;
 		} else {
-			vps->surf = vmw_framebuffer_to_vfbs(fb)->surface;
-			vmw_surface_reference(vps->surf);
+			memcpy(&vps->uo, &vmw_framebuffer_to_vfbs(fb)->uo, sizeof(vps->uo));
 		}
+		vmw_user_object_ref(&vps->uo);
 	}
 
-	if (!vps->surf && vps->bo) {
-		const u32 size = new_state->crtc_w * new_state->crtc_h * sizeof(u32);
+	bo = vmw_user_object_buffer(&vps->uo);
+	if (bo) {
+		struct ttm_operation_ctx ctx = {false, false};
 
-		/*
-		 * Not using vmw_bo_map_and_cache() helper here as we need to
-		 * reserve the ttm_buffer_object first which
-		 * vmw_bo_map_and_cache() omits.
-		 */
-		ret = ttm_bo_reserve(&vps->bo->tbo, true, false, NULL);
-
-		if (unlikely(ret != 0))
+		ret = ttm_bo_reserve(&bo->tbo, true, false, NULL);
+		if (ret != 0)
 			return -ENOMEM;
 
-		ret = ttm_bo_kmap(&vps->bo->tbo, 0, PFN_UP(size), &vps->bo->map);
-
-		ttm_bo_unreserve(&vps->bo->tbo);
-
-		if (unlikely(ret != 0))
+		ret = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
+		if (ret != 0)
 			return -ENOMEM;
-	} else if (vps->surf && !vps->bo && vps->surf->res.guest_memory_bo) {
 
-		WARN_ON(vps->surf->snooper.image);
-		ret = ttm_bo_reserve(&vps->surf->res.guest_memory_bo->tbo, true, false,
-				     NULL);
-		if (unlikely(ret != 0))
-			return -ENOMEM;
-		vmw_bo_map_and_cache(vps->surf->res.guest_memory_bo);
-		ttm_bo_unreserve(&vps->surf->res.guest_memory_bo->tbo);
-		vps->surf_mapped = true;
+		vmw_bo_pin_reserved(bo, true);
+		if (vmw_framebuffer_to_vfb(fb)->bo) {
+			const u32 size = new_state->crtc_w * new_state->crtc_h * sizeof(u32);
+
+			(void)vmw_bo_map_and_cache_size(bo, size);
+		} else {
+			vmw_bo_map_and_cache(bo);
+		}
+		ttm_bo_unreserve(&bo->tbo);
 	}
 
-	if (vps->surf || vps->bo) {
+	if (!vmw_user_object_is_null(&vps->uo)) {
 		vmw_du_get_cursor_mob(vcp, vps);
 		vmw_du_cursor_plane_map_cm(vps);
 	}
@@ -766,15 +740,18 @@
 	struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
 	struct vmw_plane_state *vps = vmw_plane_state_to_vps(new_state);
 	struct vmw_plane_state *old_vps = vmw_plane_state_to_vps(old_state);
+	struct vmw_bo *old_bo = NULL;
+	struct vmw_bo *new_bo = NULL;
+	struct ww_acquire_ctx ctx;
 	s32 hotspot_x, hotspot_y;
+	int ret;
 
 	hotspot_x = du->hotspot_x + new_state->hotspot_x;
 	hotspot_y = du->hotspot_y + new_state->hotspot_y;
 
-	du->cursor_surface = vps->surf;
-	du->cursor_bo = vps->bo;
+	du->cursor_surface = vmw_user_object_surface(&vps->uo);
 
-	if (!vps->surf && !vps->bo) {
+	if (vmw_user_object_is_null(&vps->uo)) {
 		vmw_cursor_update_position(dev_priv, false, 0, 0);
 		return;
 	}
@@ -782,10 +759,33 @@
 	vps->cursor.hotspot_x = hotspot_x;
 	vps->cursor.hotspot_y = hotspot_y;
 
-	if (vps->surf) {
+	if (du->cursor_surface)
 		du->cursor_age = du->cursor_surface->snooper.age;
+
+	ww_acquire_init(&ctx, &reservation_ww_class);
+
+	if (!vmw_user_object_is_null(&old_vps->uo)) {
+		old_bo = vmw_user_object_buffer(&old_vps->uo);
+		ret = ttm_bo_reserve(&old_bo->tbo, false, false, &ctx);
+		if (ret != 0)
+			return;
 	}
 
+	if (!vmw_user_object_is_null(&vps->uo)) {
+		new_bo = vmw_user_object_buffer(&vps->uo);
+		if (old_bo != new_bo) {
+			ret = ttm_bo_reserve(&new_bo->tbo, false, false, &ctx);
+			if (ret != 0) {
+				if (old_bo) {
+					ttm_bo_unreserve(&old_bo->tbo);
+					ww_acquire_fini(&ctx);
+				}
+				return;
+			}
+		} else {
+			new_bo = NULL;
+		}
+	}
 	if (!vmw_du_cursor_plane_has_changed(old_vps, vps)) {
 		/*
 		 * If it hasn't changed, avoid making the device do extra
@@ -803,6 +803,13 @@
 						hotspot_x, hotspot_y);
 	}
 
+	if (new_bo)
+		ttm_bo_unreserve(&new_bo->tbo);
+	if (old_bo)
+		ttm_bo_unreserve(&old_bo->tbo);
+
+	ww_acquire_fini(&ctx);
+
 	du->cursor_x = new_state->crtc_x + du->set_gui_x;
 	du->cursor_y = new_state->crtc_y + du->set_gui_y;
 
@@ -855,15 +862,6 @@
 						  DRM_PLANE_NO_SCALING,
 						  DRM_PLANE_NO_SCALING,
 						  false, true);
-
-	if (!ret && new_fb) {
-		struct drm_crtc *crtc = new_state->crtc;
-		struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
-
-		vmw_connector_state_to_vcs(du->connector.state);
-	}
-
-
 	return ret;
 }
 
@@ -912,7 +910,7 @@
 	}
 
 	if (!vmw_framebuffer_to_vfb(fb)->bo) {
-		surface = vmw_framebuffer_to_vfbs(fb)->surface;
+		surface = vmw_user_object_surface(&vmw_framebuffer_to_vfbs(fb)->uo);
 
 		WARN_ON(!surface);
 
@@ -930,6 +928,7 @@
 int vmw_du_crtc_atomic_check(struct drm_crtc *crtc,
 			     struct drm_atomic_state *state)
 {
+	struct vmw_private *vmw = vmw_priv(crtc->dev);
 	struct drm_crtc_state *new_state = drm_atomic_get_new_crtc_state(state,
 									 crtc);
 	struct vmw_display_unit *du = vmw_crtc_to_du(new_state->crtc);
@@ -937,9 +936,13 @@
 	bool has_primary = new_state->plane_mask &
 			   drm_plane_mask(crtc->primary);
 
-	/* We always want to have an active plane with an active CRTC */
-	if (has_primary != new_state->enable)
-		return -EINVAL;
+	/*
+	 * This is fine in general, but broken userspace might expect
+	 * some actual rendering so give a clue as why it's blank.
+	 */
+	if (new_state->enable && !has_primary)
+		drm_dbg_driver(&vmw->drm,
+			       "CRTC without a primary plane will be blank.\n");
 
 
 	if (new_state->connector_mask != connector_mask &&
@@ -1074,12 +1077,7 @@
 	memset(&vps->cursor, 0, sizeof(vps->cursor));
 
 	/* Each ref counted resource needs to be acquired again */
-	if (vps->surf)
-		(void) vmw_surface_reference(vps->surf);
-
-	if (vps->bo)
-		(void) vmw_bo_reference(vps->bo);
-
+	vmw_user_object_ref(&vps->uo);
 	state = &vps->base;
 
 	__drm_atomic_helper_plane_duplicate_state(plane, state);
@@ -1128,11 +1126,7 @@
 	struct vmw_plane_state *vps = vmw_plane_state_to_vps(state);
 
 	/* Should have been freed by cleanup_fb */
-	if (vps->surf)
-		vmw_surface_unreference(&vps->surf);
-
-	if (vps->bo)
-		vmw_bo_unreference(&vps->bo);
+	vmw_user_object_unref(&vps->uo);
 
 	drm_atomic_helper_plane_destroy_state(plane, state);
 }
@@ -1227,7 +1221,7 @@
 		vmw_framebuffer_to_vfbs(framebuffer);
 
 	drm_framebuffer_cleanup(framebuffer);
-	vmw_surface_unreference(&vfbs->surface);
+	vmw_user_object_unref(&vfbs->uo);
 
 	kfree(vfbs);
 }
@@ -1272,29 +1266,42 @@
 	return -ENOSYS;
 }
 
+static int vmw_framebuffer_surface_create_handle(struct drm_framebuffer *fb,
+						 struct drm_file *file_priv,
+						 unsigned int *handle)
+{
+	struct vmw_framebuffer_surface *vfbs = vmw_framebuffer_to_vfbs(fb);
+	struct vmw_bo *bo = vmw_user_object_buffer(&vfbs->uo);
+
+	if (WARN_ON(!bo))
+		return -EINVAL;
+	return drm_gem_handle_create(file_priv, &bo->tbo.base, handle);
+}
 
 static const struct drm_framebuffer_funcs vmw_framebuffer_surface_funcs = {
+	.create_handle = vmw_framebuffer_surface_create_handle,
 	.destroy = vmw_framebuffer_surface_destroy,
 	.dirty = drm_atomic_helper_dirtyfb,
 };
 
 static int vmw_kms_new_framebuffer_surface(struct vmw_private *dev_priv,
-					   struct vmw_surface *surface,
+					   struct vmw_user_object *uo,
 					   struct vmw_framebuffer **out,
 					   const struct drm_mode_fb_cmd2
-					   *mode_cmd,
-					   bool is_bo_proxy)
+					   *mode_cmd)
 
 {
 	struct drm_device *dev = &dev_priv->drm;
 	struct vmw_framebuffer_surface *vfbs;
-	enum SVGA3dSurfaceFormat format;
+	struct vmw_surface *surface;
 	int ret;
 
 	/* 3D is only supported on HWv8 and newer hosts */
 	if (dev_priv->active_display_unit == vmw_du_legacy)
 		return -ENOSYS;
 
+	surface = vmw_user_object_surface(uo);
+
 	/*
 	 * Sanity checks.
 	 */
@@ -1322,34 +1329,6 @@
 		return -EINVAL;
 	}
 
-	switch (mode_cmd->pixel_format) {
-	case DRM_FORMAT_ARGB8888:
-		format = SVGA3D_A8R8G8B8;
-		break;
-	case DRM_FORMAT_XRGB8888:
-		format = SVGA3D_X8R8G8B8;
-		break;
-	case DRM_FORMAT_RGB565:
-		format = SVGA3D_R5G6B5;
-		break;
-	case DRM_FORMAT_XRGB1555:
-		format = SVGA3D_A1R5G5B5;
-		break;
-	default:
-		DRM_ERROR("Invalid pixel format: %p4cc\n",
-			  &mode_cmd->pixel_format);
-		return -EINVAL;
-	}
-
-	/*
-	 * For DX, surface format validation is done when surface->scanout
-	 * is set.
-	 */
-	if (!has_sm4_context(dev_priv) && format != surface->metadata.format) {
-		DRM_ERROR("Invalid surface format for requested mode.\n");
-		return -EINVAL;
-	}
-
 	vfbs = kzalloc(sizeof(*vfbs), GFP_KERNEL);
 	if (!vfbs) {
 		ret = -ENOMEM;
@@ -1357,9 +1336,8 @@
 	}
 
 	drm_helper_mode_fill_fb_struct(dev, &vfbs->base.base, mode_cmd);
-	vfbs->surface = vmw_surface_reference(surface);
-	vfbs->base.user_handle = mode_cmd->handles[0];
-	vfbs->is_bo_proxy = is_bo_proxy;
+	memcpy(&vfbs->uo, uo, sizeof(vfbs->uo));
+	vmw_user_object_ref(&vfbs->uo);
 
 	*out = &vfbs->base;
 
@@ -1371,7 +1349,7 @@
 	return 0;
 
 out_err2:
-	vmw_surface_unreference(&surface);
+	vmw_user_object_unref(&vfbs->uo);
 	kfree(vfbs);
 out_err1:
 	return ret;
@@ -1387,7 +1365,6 @@
 {
 	struct vmw_framebuffer_bo *vfbd =
 			vmw_framebuffer_to_vfbd(fb);
-
 	return drm_gem_handle_create(file_priv, &vfbd->buffer->tbo.base, handle);
 }
 
@@ -1408,86 +1385,6 @@
 	.dirty = drm_atomic_helper_dirtyfb,
 };
 
-/**
- * vmw_create_bo_proxy - create a proxy surface for the buffer object
- *
- * @dev: DRM device
- * @mode_cmd: parameters for the new surface
- * @bo_mob: MOB backing the buffer object
- * @srf_out: newly created surface
- *
- * When the content FB is a buffer object, we create a surface as a proxy to the
- * same buffer.  This way we can do a surface copy rather than a surface DMA.
- * This is a more efficient approach
- *
- * RETURNS:
- * 0 on success, error code otherwise
- */
-static int vmw_create_bo_proxy(struct drm_device *dev,
-			       const struct drm_mode_fb_cmd2 *mode_cmd,
-			       struct vmw_bo *bo_mob,
-			       struct vmw_surface **srf_out)
-{
-	struct vmw_surface_metadata metadata = {0};
-	uint32_t format;
-	struct vmw_resource *res;
-	unsigned int bytes_pp;
-	int ret;
-
-	switch (mode_cmd->pixel_format) {
-	case DRM_FORMAT_ARGB8888:
-	case DRM_FORMAT_XRGB8888:
-		format = SVGA3D_X8R8G8B8;
-		bytes_pp = 4;
-		break;
-
-	case DRM_FORMAT_RGB565:
-	case DRM_FORMAT_XRGB1555:
-		format = SVGA3D_R5G6B5;
-		bytes_pp = 2;
-		break;
-
-	case 8:
-		format = SVGA3D_P8;
-		bytes_pp = 1;
-		break;
-
-	default:
-		DRM_ERROR("Invalid framebuffer format %p4cc\n",
-			  &mode_cmd->pixel_format);
-		return -EINVAL;
-	}
-
-	metadata.format = format;
-	metadata.mip_levels[0] = 1;
-	metadata.num_sizes = 1;
-	metadata.base_size.width = mode_cmd->pitches[0] / bytes_pp;
-	metadata.base_size.height =  mode_cmd->height;
-	metadata.base_size.depth = 1;
-	metadata.scanout = true;
-
-	ret = vmw_gb_surface_define(vmw_priv(dev), &metadata, srf_out);
-	if (ret) {
-		DRM_ERROR("Failed to allocate proxy content buffer\n");
-		return ret;
-	}
-
-	res = &(*srf_out)->res;
-
-	/* Reserve and switch the backing mob. */
-	mutex_lock(&res->dev_priv->cmdbuf_mutex);
-	(void) vmw_resource_reserve(res, false, true);
-	vmw_user_bo_unref(&res->guest_memory_bo);
-	res->guest_memory_bo = vmw_user_bo_ref(bo_mob);
-	res->guest_memory_offset = 0;
-	vmw_resource_unreserve(res, false, false, false, NULL, 0);
-	mutex_unlock(&res->dev_priv->cmdbuf_mutex);
-
-	return 0;
-}
-
-
-
 static int vmw_kms_new_framebuffer_bo(struct vmw_private *dev_priv,
 				      struct vmw_bo *bo,
 				      struct vmw_framebuffer **out,
@@ -1526,7 +1423,6 @@
 	drm_helper_mode_fill_fb_struct(dev, &vfbd->base.base, mode_cmd);
 	vfbd->base.bo = true;
 	vfbd->buffer = vmw_bo_reference(bo);
-	vfbd->base.user_handle = mode_cmd->handles[0];
 	*out = &vfbd->base;
 
 	ret = drm_framebuffer_init(dev, &vfbd->base.base,
@@ -1567,55 +1463,24 @@
  * vmw_kms_new_framebuffer - Create a new framebuffer.
  *
  * @dev_priv: Pointer to device private struct.
- * @bo: Pointer to buffer object to wrap the kms framebuffer around.
- * Either @bo or @surface must be NULL.
- * @surface: Pointer to a surface to wrap the kms framebuffer around.
- * Either @bo or @surface must be NULL.
- * @only_2d: No presents will occur to this buffer object based framebuffer.
- * This helps the code to do some important optimizations.
+ * @uo: Pointer to user object to wrap the kms framebuffer around.
+ * Either the buffer or surface inside the user object must be NULL.
  * @mode_cmd: Frame-buffer metadata.
  */
 struct vmw_framebuffer *
 vmw_kms_new_framebuffer(struct vmw_private *dev_priv,
-			struct vmw_bo *bo,
-			struct vmw_surface *surface,
-			bool only_2d,
+			struct vmw_user_object *uo,
 			const struct drm_mode_fb_cmd2 *mode_cmd)
 {
 	struct vmw_framebuffer *vfb = NULL;
-	bool is_bo_proxy = false;
 	int ret;
 
-	/*
-	 * We cannot use the SurfaceDMA command in an non-accelerated VM,
-	 * therefore, wrap the buffer object in a surface so we can use the
-	 * SurfaceCopy command.
-	 */
-	if (vmw_kms_srf_ok(dev_priv, mode_cmd->width, mode_cmd->height)  &&
-	    bo && only_2d &&
-	    mode_cmd->width > 64 &&  /* Don't create a proxy for cursor */
-	    dev_priv->active_display_unit == vmw_du_screen_target) {
-		ret = vmw_create_bo_proxy(&dev_priv->drm, mode_cmd,
-					  bo, &surface);
-		if (ret)
-			return ERR_PTR(ret);
-
-		is_bo_proxy = true;
-	}
-
 	/* Create the new framebuffer depending one what we have */
-	if (surface) {
-		ret = vmw_kms_new_framebuffer_surface(dev_priv, surface, &vfb,
-						      mode_cmd,
-						      is_bo_proxy);
-		/*
-		 * vmw_create_bo_proxy() adds a reference that is no longer
-		 * needed
-		 */
-		if (is_bo_proxy)
-			vmw_surface_unreference(&surface);
-	} else if (bo) {
-		ret = vmw_kms_new_framebuffer_bo(dev_priv, bo, &vfb,
+	if (vmw_user_object_surface(uo)) {
+		ret = vmw_kms_new_framebuffer_surface(dev_priv, uo, &vfb,
+						      mode_cmd);
+	} else if (uo->buffer) {
+		ret = vmw_kms_new_framebuffer_bo(dev_priv, uo->buffer, &vfb,
 						 mode_cmd);
 	} else {
 		BUG();
@@ -1637,14 +1502,12 @@
 {
 	struct vmw_private *dev_priv = vmw_priv(dev);
 	struct vmw_framebuffer *vfb = NULL;
-	struct vmw_surface *surface = NULL;
-	struct vmw_bo *bo = NULL;
+	struct vmw_user_object uo = {0};
 	int ret;
 
 	/* returns either a bo or surface */
-	ret = vmw_user_lookup_handle(dev_priv, file_priv,
-				     mode_cmd->handles[0],
-				     &surface, &bo);
+	ret = vmw_user_object_lookup(dev_priv, file_priv, mode_cmd->handles[0],
+				     &uo);
 	if (ret) {
 		DRM_ERROR("Invalid buffer object handle %u (0x%x).\n",
 			  mode_cmd->handles[0], mode_cmd->handles[0]);
@@ -1652,29 +1515,25 @@
 	}
 
 
-	if (!bo &&
+	if (vmw_user_object_surface(&uo) &&
 	    !vmw_kms_srf_ok(dev_priv, mode_cmd->width, mode_cmd->height)) {
 		DRM_ERROR("Surface size cannot exceed %dx%d\n",
 			dev_priv->texture_max_width,
 			dev_priv->texture_max_height);
+		ret = -EINVAL;
 		goto err_out;
 	}
 
 
-	vfb = vmw_kms_new_framebuffer(dev_priv, bo, surface,
-				      !(dev_priv->capabilities & SVGA_CAP_3D),
-				      mode_cmd);
+	vfb = vmw_kms_new_framebuffer(dev_priv, &uo, mode_cmd);
 	if (IS_ERR(vfb)) {
 		ret = PTR_ERR(vfb);
 		goto err_out;
 	}
 
 err_out:
-	/* vmw_user_lookup_handle takes one ref so does new_fb */
-	if (bo)
-		vmw_user_bo_unref(&bo);
-	if (surface)
-		vmw_surface_unreference(&surface);
+	/* vmw_user_object_lookup takes one ref so does new_fb */
+	vmw_user_object_unref(&uo);
 
 	if (ret) {
 		DRM_ERROR("failed to create vmw_framebuffer: %i\n", ret);
@@ -2149,13 +2008,12 @@
 	return 0;
 }
 
+static
 bool vmw_kms_validate_mode_vram(struct vmw_private *dev_priv,
-				uint32_t pitch,
-				uint32_t height)
+				u64 pitch,
+				u64 height)
 {
-	return ((u64) pitch * (u64) height) < (u64)
-		((dev_priv->active_display_unit == vmw_du_screen_target) ?
-		 dev_priv->max_primary_mem : dev_priv->vram_size);
+	return (pitch * height) < (u64)dev_priv->vram_size;
 }
 
 /**
@@ -2278,107 +2136,6 @@
 		connector_status_connected : connector_status_disconnected);
 }
 
-static struct drm_display_mode vmw_kms_connector_builtin[] = {
-	/* 640x480@60Hz */
-	{ DRM_MODE("640x480", DRM_MODE_TYPE_DRIVER, 25175, 640, 656,
-		   752, 800, 0, 480, 489, 492, 525, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC) },
-	/* 800x600@60Hz */
-	{ DRM_MODE("800x600", DRM_MODE_TYPE_DRIVER, 40000, 800, 840,
-		   968, 1056, 0, 600, 601, 605, 628, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1024x768@60Hz */
-	{ DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 65000, 1024, 1048,
-		   1184, 1344, 0, 768, 771, 777, 806, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC) },
-	/* 1152x864@75Hz */
-	{ DRM_MODE("1152x864", DRM_MODE_TYPE_DRIVER, 108000, 1152, 1216,
-		   1344, 1600, 0, 864, 865, 868, 900, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1280x720@60Hz */
-	{ DRM_MODE("1280x720", DRM_MODE_TYPE_DRIVER, 74500, 1280, 1344,
-		   1472, 1664, 0, 720, 723, 728, 748, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1280x768@60Hz */
-	{ DRM_MODE("1280x768", DRM_MODE_TYPE_DRIVER, 79500, 1280, 1344,
-		   1472, 1664, 0, 768, 771, 778, 798, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1280x800@60Hz */
-	{ DRM_MODE("1280x800", DRM_MODE_TYPE_DRIVER, 83500, 1280, 1352,
-		   1480, 1680, 0, 800, 803, 809, 831, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NVSYNC) },
-	/* 1280x960@60Hz */
-	{ DRM_MODE("1280x960", DRM_MODE_TYPE_DRIVER, 108000, 1280, 1376,
-		   1488, 1800, 0, 960, 961, 964, 1000, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1280x1024@60Hz */
-	{ DRM_MODE("1280x1024", DRM_MODE_TYPE_DRIVER, 108000, 1280, 1328,
-		   1440, 1688, 0, 1024, 1025, 1028, 1066, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1360x768@60Hz */
-	{ DRM_MODE("1360x768", DRM_MODE_TYPE_DRIVER, 85500, 1360, 1424,
-		   1536, 1792, 0, 768, 771, 777, 795, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1440x1050@60Hz */
-	{ DRM_MODE("1400x1050", DRM_MODE_TYPE_DRIVER, 121750, 1400, 1488,
-		   1632, 1864, 0, 1050, 1053, 1057, 1089, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1440x900@60Hz */
-	{ DRM_MODE("1440x900", DRM_MODE_TYPE_DRIVER, 106500, 1440, 1520,
-		   1672, 1904, 0, 900, 903, 909, 934, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1600x1200@60Hz */
-	{ DRM_MODE("1600x1200", DRM_MODE_TYPE_DRIVER, 162000, 1600, 1664,
-		   1856, 2160, 0, 1200, 1201, 1204, 1250, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1680x1050@60Hz */
-	{ DRM_MODE("1680x1050", DRM_MODE_TYPE_DRIVER, 146250, 1680, 1784,
-		   1960, 2240, 0, 1050, 1053, 1059, 1089, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1792x1344@60Hz */
-	{ DRM_MODE("1792x1344", DRM_MODE_TYPE_DRIVER, 204750, 1792, 1920,
-		   2120, 2448, 0, 1344, 1345, 1348, 1394, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1853x1392@60Hz */
-	{ DRM_MODE("1856x1392", DRM_MODE_TYPE_DRIVER, 218250, 1856, 1952,
-		   2176, 2528, 0, 1392, 1393, 1396, 1439, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1920x1080@60Hz */
-	{ DRM_MODE("1920x1080", DRM_MODE_TYPE_DRIVER, 173000, 1920, 2048,
-		   2248, 2576, 0, 1080, 1083, 1088, 1120, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1920x1200@60Hz */
-	{ DRM_MODE("1920x1200", DRM_MODE_TYPE_DRIVER, 193250, 1920, 2056,
-		   2256, 2592, 0, 1200, 1203, 1209, 1245, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 1920x1440@60Hz */
-	{ DRM_MODE("1920x1440", DRM_MODE_TYPE_DRIVER, 234000, 1920, 2048,
-		   2256, 2600, 0, 1440, 1441, 1444, 1500, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 2560x1440@60Hz */
-	{ DRM_MODE("2560x1440", DRM_MODE_TYPE_DRIVER, 241500, 2560, 2608,
-		   2640, 2720, 0, 1440, 1443, 1448, 1481, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NVSYNC) },
-	/* 2560x1600@60Hz */
-	{ DRM_MODE("2560x1600", DRM_MODE_TYPE_DRIVER, 348500, 2560, 2752,
-		   3032, 3504, 0, 1600, 1603, 1609, 1658, 0,
-		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
-	/* 2880x1800@60Hz */
-	{ DRM_MODE("2880x1800", DRM_MODE_TYPE_DRIVER, 337500, 2880, 2928,
-		   2960, 3040, 0, 1800, 1803, 1809, 1852, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NVSYNC) },
-	/* 3840x2160@60Hz */
-	{ DRM_MODE("3840x2160", DRM_MODE_TYPE_DRIVER, 533000, 3840, 3888,
-		   3920, 4000, 0, 2160, 2163, 2168, 2222, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NVSYNC) },
-	/* 3840x2400@60Hz */
-	{ DRM_MODE("3840x2400", DRM_MODE_TYPE_DRIVER, 592250, 3840, 3888,
-		   3920, 4000, 0, 2400, 2403, 2409, 2469, 0,
-		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NVSYNC) },
-	/* Terminate */
-	{ DRM_MODE("", 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) },
-};
-
 /**
  * vmw_guess_mode_timing - Provide fake timings for a
  * 60Hz vrefresh mode.
@@ -2400,88 +2157,6 @@
 }
 
 
-int vmw_du_connector_fill_modes(struct drm_connector *connector,
-				uint32_t max_width, uint32_t max_height)
-{
-	struct vmw_display_unit *du = vmw_connector_to_du(connector);
-	struct drm_device *dev = connector->dev;
-	struct vmw_private *dev_priv = vmw_priv(dev);
-	struct drm_display_mode *mode = NULL;
-	struct drm_display_mode *bmode;
-	struct drm_display_mode prefmode = { DRM_MODE("preferred",
-		DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-		DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
-	};
-	int i;
-	u32 assumed_bpp = 4;
-
-	if (dev_priv->assume_16bpp)
-		assumed_bpp = 2;
-
-	max_width  = min(max_width,  dev_priv->texture_max_width);
-	max_height = min(max_height, dev_priv->texture_max_height);
-
-	/*
-	 * For STDU extra limit for a mode on SVGA_REG_SCREENTARGET_MAX_WIDTH/
-	 * HEIGHT registers.
-	 */
-	if (dev_priv->active_display_unit == vmw_du_screen_target) {
-		max_width  = min(max_width,  dev_priv->stdu_max_width);
-		max_height = min(max_height, dev_priv->stdu_max_height);
-	}
-
-	/* Add preferred mode */
-	mode = drm_mode_duplicate(dev, &prefmode);
-	if (!mode)
-		return 0;
-	mode->hdisplay = du->pref_width;
-	mode->vdisplay = du->pref_height;
-	vmw_guess_mode_timing(mode);
-	drm_mode_set_name(mode);
-
-	if (vmw_kms_validate_mode_vram(dev_priv,
-					mode->hdisplay * assumed_bpp,
-					mode->vdisplay)) {
-		drm_mode_probed_add(connector, mode);
-	} else {
-		drm_mode_destroy(dev, mode);
-		mode = NULL;
-	}
-
-	if (du->pref_mode) {
-		list_del_init(&du->pref_mode->head);
-		drm_mode_destroy(dev, du->pref_mode);
-	}
-
-	/* mode might be null here, this is intended */
-	du->pref_mode = mode;
-
-	for (i = 0; vmw_kms_connector_builtin[i].type != 0; i++) {
-		bmode = &vmw_kms_connector_builtin[i];
-		if (bmode->hdisplay > max_width ||
-		    bmode->vdisplay > max_height)
-			continue;
-
-		if (!vmw_kms_validate_mode_vram(dev_priv,
-						bmode->hdisplay * assumed_bpp,
-						bmode->vdisplay))
-			continue;
-
-		mode = drm_mode_duplicate(dev, bmode);
-		if (!mode)
-			return 0;
-
-		drm_mode_probed_add(connector, mode);
-	}
-
-	drm_connector_list_update(connector);
-	/* Move the prefered mode first, help apps pick the right mode. */
-	drm_mode_sort(&connector->modes);
-
-	return 1;
-}
-
 /**
  * vmw_kms_update_layout_ioctl - Handler for DRM_VMW_UPDATE_LAYOUT ioctl
  * @dev: drm device for the ioctl
@@ -2508,7 +2183,7 @@
 	struct drm_mode_config *mode_config = &dev->mode_config;
 	struct drm_vmw_update_layout_arg *arg =
 		(struct drm_vmw_update_layout_arg *)data;
-	void __user *user_rects;
+	const void __user *user_rects;
 	struct drm_vmw_rect *rects;
 	struct drm_rect *drm_rects;
 	unsigned rects_size;
@@ -2520,6 +2195,8 @@
 					    VMWGFX_MIN_INITIAL_HEIGHT};
 		vmw_du_update_layout(dev_priv, 1, &def_rect);
 		return 0;
+	} else if (arg->num_outputs > VMWGFX_NUM_DISPLAY_UNITS) {
+		return -E2BIG;
 	}
 
 	rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
@@ -2747,72 +2424,6 @@
 }
 
 /**
- * vmw_kms_update_proxy - Helper function to update a proxy surface from
- * its backing MOB.
- *
- * @res: Pointer to the surface resource
- * @clips: Clip rects in framebuffer (surface) space.
- * @num_clips: Number of clips in @clips.
- * @increment: Integer with which to increment the clip counter when looping.
- * Used to skip a predetermined number of clip rects.
- *
- * This function makes sure the proxy surface is updated from its backing MOB
- * using the region given by @clips. The surface resource @res and its backing
- * MOB needs to be reserved and validated on call.
- */
-int vmw_kms_update_proxy(struct vmw_resource *res,
-			 const struct drm_clip_rect *clips,
-			 unsigned num_clips,
-			 int increment)
-{
-	struct vmw_private *dev_priv = res->dev_priv;
-	struct drm_vmw_size *size = &vmw_res_to_srf(res)->metadata.base_size;
-	struct {
-		SVGA3dCmdHeader header;
-		SVGA3dCmdUpdateGBImage body;
-	} *cmd;
-	SVGA3dBox *box;
-	size_t copy_size = 0;
-	int i;
-
-	if (!clips)
-		return 0;
-
-	cmd = VMW_CMD_RESERVE(dev_priv, sizeof(*cmd) * num_clips);
-	if (!cmd)
-		return -ENOMEM;
-
-	for (i = 0; i < num_clips; ++i, clips += increment, ++cmd) {
-		box = &cmd->body.box;
-
-		cmd->header.id = SVGA_3D_CMD_UPDATE_GB_IMAGE;
-		cmd->header.size = sizeof(cmd->body);
-		cmd->body.image.sid = res->id;
-		cmd->body.image.face = 0;
-		cmd->body.image.mipmap = 0;
-
-		if (clips->x1 > size->width || clips->x2 > size->width ||
-		    clips->y1 > size->height || clips->y2 > size->height) {
-			DRM_ERROR("Invalid clips outsize of framebuffer.\n");
-			return -EINVAL;
-		}
-
-		box->x = clips->x1;
-		box->y = clips->y1;
-		box->z = 0;
-		box->w = clips->x2 - clips->x1;
-		box->h = clips->y2 - clips->y1;
-		box->d = 1;
-
-		copy_size += sizeof(*cmd);
-	}
-
-	vmw_cmd_commit(dev_priv, copy_size);
-
-	return 0;
-}
-
-/**
  * vmw_kms_create_implicit_placement_property - Set up the implicit placement
  * property.
  *
@@ -2946,8 +2557,9 @@
 	} else {
 		struct vmw_framebuffer_surface *vfbs =
 			container_of(update->vfb, typeof(*vfbs), base);
+		struct vmw_surface *surf = vmw_user_object_surface(&vfbs->uo);
 
-		ret = vmw_validation_add_resource(&val_ctx, &vfbs->surface->res,
+		ret = vmw_validation_add_resource(&val_ctx, &surf->res,
 						  0, VMW_RES_DIRTY_NONE, NULL,
 						  NULL);
 	}
@@ -3022,3 +2634,174 @@
 	vmw_validation_unref_lists(&val_ctx);
 	return ret;
 }
+
+/**
+ * vmw_connector_mode_valid - implements drm_connector_helper_funcs.mode_valid callback
+ *
+ * @connector: the drm connector, part of a DU container
+ * @mode: drm mode to check
+ *
+ * Returns MODE_OK on success, or a drm_mode_status error code.
+ */
+enum drm_mode_status vmw_connector_mode_valid(struct drm_connector *connector,
+					      struct drm_display_mode *mode)
+{
+	enum drm_mode_status ret;
+	struct drm_device *dev = connector->dev;
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	u32 assumed_cpp = 4;
+
+	if (dev_priv->assume_16bpp)
+		assumed_cpp = 2;
+
+	ret = drm_mode_validate_size(mode, dev_priv->texture_max_width,
+				     dev_priv->texture_max_height);
+	if (ret != MODE_OK)
+		return ret;
+
+	if (!vmw_kms_validate_mode_vram(dev_priv,
+					mode->hdisplay * assumed_cpp,
+					mode->vdisplay))
+		return MODE_MEM;
+
+	return MODE_OK;
+}
+
+/**
+ * vmw_connector_get_modes - implements drm_connector_helper_funcs.get_modes callback
+ *
+ * @connector: the drm connector, part of a DU container
+ *
+ * Returns the number of added modes.
+ */
+int vmw_connector_get_modes(struct drm_connector *connector)
+{
+	struct vmw_display_unit *du = vmw_connector_to_du(connector);
+	struct drm_device *dev = connector->dev;
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct drm_display_mode *mode = NULL;
+	struct drm_display_mode prefmode = { DRM_MODE("preferred",
+		DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
+	};
+	u32 max_width;
+	u32 max_height;
+	u32 num_modes;
+
+	/* Add preferred mode */
+	mode = drm_mode_duplicate(dev, &prefmode);
+	if (!mode)
+		return 0;
+
+	mode->hdisplay = du->pref_width;
+	mode->vdisplay = du->pref_height;
+	vmw_guess_mode_timing(mode);
+	drm_mode_set_name(mode);
+
+	drm_mode_probed_add(connector, mode);
+	drm_dbg_kms(dev, "preferred mode " DRM_MODE_FMT "\n", DRM_MODE_ARG(mode));
+
+	/* Probe connector for all modes not exceeding our geom limits */
+	max_width  = dev_priv->texture_max_width;
+	max_height = dev_priv->texture_max_height;
+
+	if (dev_priv->active_display_unit == vmw_du_screen_target) {
+		max_width  = min(dev_priv->stdu_max_width,  max_width);
+		max_height = min(dev_priv->stdu_max_height, max_height);
+	}
+
+	num_modes = 1 + drm_add_modes_noedid(connector, max_width, max_height);
+
+	return num_modes;
+}
+
+struct vmw_user_object *vmw_user_object_ref(struct vmw_user_object *uo)
+{
+	if (uo->buffer)
+		vmw_user_bo_ref(uo->buffer);
+	else if (uo->surface)
+		vmw_surface_reference(uo->surface);
+	return uo;
+}
+
+void vmw_user_object_unref(struct vmw_user_object *uo)
+{
+	if (uo->buffer)
+		vmw_user_bo_unref(&uo->buffer);
+	else if (uo->surface)
+		vmw_surface_unreference(&uo->surface);
+}
+
+struct vmw_bo *
+vmw_user_object_buffer(struct vmw_user_object *uo)
+{
+	if (uo->buffer)
+		return uo->buffer;
+	else if (uo->surface)
+		return uo->surface->res.guest_memory_bo;
+	return NULL;
+}
+
+struct vmw_surface *
+vmw_user_object_surface(struct vmw_user_object *uo)
+{
+	if (uo->buffer)
+		return uo->buffer->dumb_surface;
+	return uo->surface;
+}
+
+void *vmw_user_object_map(struct vmw_user_object *uo)
+{
+	struct vmw_bo *bo = vmw_user_object_buffer(uo);
+
+	WARN_ON(!bo);
+	return vmw_bo_map_and_cache(bo);
+}
+
+void *vmw_user_object_map_size(struct vmw_user_object *uo, size_t size)
+{
+	struct vmw_bo *bo = vmw_user_object_buffer(uo);
+
+	WARN_ON(!bo);
+	return vmw_bo_map_and_cache_size(bo, size);
+}
+
+void vmw_user_object_unmap(struct vmw_user_object *uo)
+{
+	struct vmw_bo *bo = vmw_user_object_buffer(uo);
+	int ret;
+
+	WARN_ON(!bo);
+
+	/* Fence the mob creation so we are guarateed to have the mob */
+	ret = ttm_bo_reserve(&bo->tbo, false, false, NULL);
+	if (ret != 0)
+		return;
+
+	vmw_bo_unmap(bo);
+	vmw_bo_pin_reserved(bo, false);
+
+	ttm_bo_unreserve(&bo->tbo);
+}
+
+bool vmw_user_object_is_mapped(struct vmw_user_object *uo)
+{
+	struct vmw_bo *bo;
+
+	if (!uo || vmw_user_object_is_null(uo))
+		return false;
+
+	bo = vmw_user_object_buffer(uo);
+
+	if (WARN_ON(!bo))
+		return false;
+
+	WARN_ON(bo->map.bo && !bo->map.virtual);
+	return bo->map.virtual;
+}
+
+bool vmw_user_object_is_null(struct vmw_user_object *uo)
+{
+	return !uo->buffer && !uo->surface;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -1,7 +1,8 @@
 /* SPDX-License-Identifier: GPL-2.0 OR MIT */
 /**************************************************************************
  *
- * Copyright 2009-2023 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2009-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -198,9 +199,6 @@
 	s32 unit_y2;
 };
 
-#define VMWGFX_NUM_DISPLAY_UNITS 8
-
-
 #define vmw_framebuffer_to_vfb(x) \
 	container_of(x, struct vmw_framebuffer, base)
 #define vmw_framebuffer_to_vfbs(x) \
@@ -217,25 +215,13 @@
 struct vmw_framebuffer {
 	struct drm_framebuffer base;
 	bool bo;
-	uint32_t user_handle;
-};
-
-/*
- * Clip rectangle
- */
-struct vmw_clip_rect {
-	int x1, x2, y1, y2;
 };
 
 struct vmw_framebuffer_surface {
 	struct vmw_framebuffer base;
-	struct vmw_surface *surface;
-	struct vmw_bo *buffer;
-	struct list_head head;
-	bool is_bo_proxy;  /* true if this is proxy surface for DMA buf */
+	struct vmw_user_object uo;
 };
 
-
 struct vmw_framebuffer_bo {
 	struct vmw_framebuffer base;
 	struct vmw_bo *buffer;
@@ -243,10 +229,10 @@
 
 
 static const uint32_t __maybe_unused vmw_primary_plane_formats[] = {
-	DRM_FORMAT_XRGB1555,
-	DRM_FORMAT_RGB565,
 	DRM_FORMAT_XRGB8888,
 	DRM_FORMAT_ARGB8888,
+	DRM_FORMAT_RGB565,
+	DRM_FORMAT_XRGB1555,
 };
 
 static const uint32_t __maybe_unused vmw_cursor_plane_formats[] = {
@@ -287,8 +273,7 @@
  */
 struct vmw_plane_state {
 	struct drm_plane_state base;
-	struct vmw_surface *surf;
-	struct vmw_bo *bo;
+	struct vmw_user_object uo;
 
 	int content_fb_type;
 	unsigned long bo_size;
@@ -359,7 +344,6 @@
 	struct vmw_cursor_plane cursor;
 
 	struct vmw_surface *cursor_surface;
-	struct vmw_bo *cursor_bo;
 	size_t cursor_age;
 
 	int cursor_x;
@@ -378,7 +362,6 @@
 	unsigned pref_width;
 	unsigned pref_height;
 	bool pref_active;
-	struct drm_display_mode *pref_mode;
 
 	/*
 	 * Gui positioning
@@ -390,11 +373,6 @@
 	int set_gui_y;
 };
 
-struct vmw_validation_ctx {
-	struct vmw_resource *res;
-	struct vmw_bo *buf;
-};
-
 #define vmw_crtc_to_du(x) \
 	container_of(x, struct vmw_display_unit, crtc)
 #define vmw_connector_to_du(x) \
@@ -428,8 +406,6 @@
 void vmw_du_connector_restore(struct drm_connector *connector);
 enum drm_connector_status
 vmw_du_connector_detect(struct drm_connector *connector, bool force);
-int vmw_du_connector_fill_modes(struct drm_connector *connector,
-				uint32_t max_width, uint32_t max_height);
 int vmw_kms_helper_dirty(struct vmw_private *dev_priv,
 			 struct vmw_framebuffer *framebuffer,
 			 const struct drm_clip_rect *clips,
@@ -438,6 +414,9 @@
 			 int num_clips,
 			 int increment,
 			 struct vmw_kms_dirty *dirty);
+enum drm_mode_status vmw_connector_mode_valid(struct drm_connector *connector,
+					      struct drm_display_mode *mode);
+int vmw_connector_get_modes(struct drm_connector *connector);
 
 void vmw_kms_helper_validation_finish(struct vmw_private *dev_priv,
 				      struct drm_file *file_priv,
@@ -453,9 +432,7 @@
 		     uint32_t num_clips);
 struct vmw_framebuffer *
 vmw_kms_new_framebuffer(struct vmw_private *dev_priv,
-			struct vmw_bo *bo,
-			struct vmw_surface *surface,
-			bool only_2d,
+			struct vmw_user_object *uo,
 			const struct drm_mode_fb_cmd2 *mode_cmd);
 void vmw_guess_mode_timing(struct drm_display_mode *mode);
 void vmw_kms_update_implicit_fb(struct vmw_private *dev_priv);
@@ -482,8 +459,7 @@
 struct drm_plane_state *vmw_du_plane_duplicate_state(struct drm_plane *plane);
 void vmw_du_plane_destroy_state(struct drm_plane *plane,
 				struct drm_plane_state *state);
-void vmw_du_plane_unpin_surf(struct vmw_plane_state *vps,
-			     bool unreference);
+void vmw_du_plane_unpin_surf(struct vmw_plane_state *vps);
 
 int vmw_du_crtc_atomic_check(struct drm_crtc *crtc,
 			     struct drm_atomic_state *state);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0 OR MIT
 /**************************************************************************
  *
- * Copyright 2009-2023 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2009-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -146,8 +147,9 @@
 	struct vmw_bo *buf;
 	int ret;
 
-	buf = vfb->bo ?  vmw_framebuffer_to_vfbd(&vfb->base)->buffer :
-		vmw_framebuffer_to_vfbs(&vfb->base)->surface->res.guest_memory_bo;
+	buf = vfb->bo ?
+		vmw_framebuffer_to_vfbd(&vfb->base)->buffer :
+		vmw_user_object_buffer(&vmw_framebuffer_to_vfbs(&vfb->base)->uo);
 
 	if (!buf)
 		return 0;
@@ -168,8 +170,10 @@
 	struct vmw_private *dev_priv = vmw_priv(vfb->base.dev);
 	struct vmw_bo *buf;
 
-	buf = vfb->bo ?  vmw_framebuffer_to_vfbd(&vfb->base)->buffer :
-		vmw_framebuffer_to_vfbs(&vfb->base)->surface->res.guest_memory_bo;
+	buf = vfb->bo ?
+		vmw_framebuffer_to_vfbd(&vfb->base)->buffer :
+		vmw_user_object_buffer(&vmw_framebuffer_to_vfbs(&vfb->base)->uo);
+
 
 	if (WARN_ON(!buf))
 		return 0;
@@ -304,7 +308,7 @@
 static const struct drm_connector_funcs vmw_legacy_connector_funcs = {
 	.dpms = vmw_du_connector_dpms,
 	.detect = vmw_du_connector_detect,
-	.fill_modes = vmw_du_connector_fill_modes,
+	.fill_modes = drm_helper_probe_single_connector_modes,
 	.destroy = vmw_ldu_connector_destroy,
 	.reset = vmw_du_connector_reset,
 	.atomic_duplicate_state = vmw_du_connector_duplicate_state,
@@ -313,6 +317,8 @@
 
 static const struct
 drm_connector_helper_funcs vmw_ldu_connector_helper_funcs = {
+	.get_modes = vmw_connector_get_modes,
+	.mode_valid = vmw_connector_mode_valid
 };
 
 static int vmw_kms_ldu_do_bo_dirty(struct vmw_private *dev_priv,
@@ -449,7 +455,6 @@
 	ldu->base.pref_active = (unit == 0);
 	ldu->base.pref_width = dev_priv->initial_width;
 	ldu->base.pref_height = dev_priv->initial_height;
-	ldu->base.pref_mode = NULL;
 
 	/*
 	 * Remove this after enabling atomic because property values can
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -48,8 +48,6 @@
 
 #define RETRIES                 3
 
-#define VMW_HYPERVISOR_MAGIC    0x564D5868
-
 #define VMW_PORT_CMD_MSG        30
 #define VMW_PORT_CMD_HB_MSG     0
 #define VMW_PORT_CMD_OPEN_CHANNEL  (MSG_TYPE_OPEN << 16 | VMW_PORT_CMD_MSG)
@@ -104,20 +102,18 @@
  */
 static int vmw_open_channel(struct rpc_channel *channel, unsigned int protocol)
 {
-	unsigned long eax, ebx, ecx, edx, si = 0, di = 0;
+	u32 ecx, edx, esi, edi;
 
-	VMW_PORT(VMW_PORT_CMD_OPEN_CHANNEL,
-		(protocol | GUESTMSG_FLAG_COOKIE), si, di,
-		0,
-		VMW_HYPERVISOR_MAGIC,
-		eax, ebx, ecx, edx, si, di);
+	vmware_hypercall6(VMW_PORT_CMD_OPEN_CHANNEL,
+			  (protocol | GUESTMSG_FLAG_COOKIE), 0,
+			  &ecx, &edx, &esi, &edi);
 
 	if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0)
 		return -EINVAL;
 
 	channel->channel_id  = HIGH_WORD(edx);
-	channel->cookie_high = si;
-	channel->cookie_low  = di;
+	channel->cookie_high = esi;
+	channel->cookie_low  = edi;
 
 	return 0;
 }
@@ -133,17 +129,13 @@
  */
 static int vmw_close_channel(struct rpc_channel *channel)
 {
-	unsigned long eax, ebx, ecx, edx, si, di;
+	u32 ecx;
 
-	/* Set up additional parameters */
-	si  = channel->cookie_high;
-	di  = channel->cookie_low;
-
-	VMW_PORT(VMW_PORT_CMD_CLOSE_CHANNEL,
-		0, si, di,
-		channel->channel_id << 16,
-		VMW_HYPERVISOR_MAGIC,
-		eax, ebx, ecx, edx, si, di);
+	vmware_hypercall5(VMW_PORT_CMD_CLOSE_CHANNEL,
+			  0, channel->channel_id << 16,
+			  channel->cookie_high,
+			  channel->cookie_low,
+			  &ecx);
 
 	if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0)
 		return -EINVAL;
@@ -163,24 +155,18 @@
 static unsigned long vmw_port_hb_out(struct rpc_channel *channel,
 				     const char *msg, bool hb)
 {
-	unsigned long si, di, eax, ebx, ecx, edx;
+	u32 ebx, ecx;
 	unsigned long msg_len = strlen(msg);
 
 	/* HB port can't access encrypted memory. */
 	if (hb && !cc_platform_has(CC_ATTR_MEM_ENCRYPT)) {
-		unsigned long bp = channel->cookie_high;
-		u32 channel_id = (channel->channel_id << 16);
-
-		si = (uintptr_t) msg;
-		di = channel->cookie_low;
-
-		VMW_PORT_HB_OUT(
+		vmware_hypercall_hb_out(
 			(MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
-			msg_len, si, di,
-			VMWARE_HYPERVISOR_HB | channel_id |
-			VMWARE_HYPERVISOR_OUT,
-			VMW_HYPERVISOR_MAGIC, bp,
-			eax, ebx, ecx, edx, si, di);
+			msg_len,
+			channel->channel_id << 16,
+			(uintptr_t) msg, channel->cookie_low,
+			channel->cookie_high,
+			&ebx);
 
 		return ebx;
 	}
@@ -194,14 +180,13 @@
 		memcpy(&word, msg, bytes);
 		msg_len -= bytes;
 		msg += bytes;
-		si = channel->cookie_high;
-		di = channel->cookie_low;
 
-		VMW_PORT(VMW_PORT_CMD_MSG | (MSG_TYPE_SENDPAYLOAD << 16),
-			 word, si, di,
-			 channel->channel_id << 16,
-			 VMW_HYPERVISOR_MAGIC,
-			 eax, ebx, ecx, edx, si, di);
+		vmware_hypercall5(VMW_PORT_CMD_MSG |
+				  (MSG_TYPE_SENDPAYLOAD << 16),
+				  word, channel->channel_id << 16,
+				  channel->cookie_high,
+				  channel->cookie_low,
+				  &ecx);
 	}
 
 	return ecx;
@@ -220,22 +205,17 @@
 static unsigned long vmw_port_hb_in(struct rpc_channel *channel, char *reply,
 				    unsigned long reply_len, bool hb)
 {
-	unsigned long si, di, eax, ebx, ecx, edx;
+	u32 ebx, ecx, edx;
 
 	/* HB port can't access encrypted memory */
 	if (hb && !cc_platform_has(CC_ATTR_MEM_ENCRYPT)) {
-		unsigned long bp = channel->cookie_low;
-		u32 channel_id = (channel->channel_id << 16);
-
-		si = channel->cookie_high;
-		di = (uintptr_t) reply;
-
-		VMW_PORT_HB_IN(
+		vmware_hypercall_hb_in(
 			(MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
-			reply_len, si, di,
-			VMWARE_HYPERVISOR_HB | channel_id,
-			VMW_HYPERVISOR_MAGIC, bp,
-			eax, ebx, ecx, edx, si, di);
+			reply_len,
+			channel->channel_id << 16,
+			channel->cookie_high,
+			(uintptr_t) reply, channel->cookie_low,
+			&ebx);
 
 		return ebx;
 	}
@@ -245,14 +225,13 @@
 	while (reply_len) {
 		unsigned int bytes = min_t(unsigned long, reply_len, 4);
 
-		si = channel->cookie_high;
-		di = channel->cookie_low;
-
-		VMW_PORT(VMW_PORT_CMD_MSG | (MSG_TYPE_RECVPAYLOAD << 16),
-			 MESSAGE_STATUS_SUCCESS, si, di,
-			 channel->channel_id << 16,
-			 VMW_HYPERVISOR_MAGIC,
-			 eax, ebx, ecx, edx, si, di);
+		vmware_hypercall7(VMW_PORT_CMD_MSG |
+				  (MSG_TYPE_RECVPAYLOAD << 16),
+				  MESSAGE_STATUS_SUCCESS,
+				  channel->channel_id << 16,
+				  channel->cookie_high,
+				  channel->cookie_low,
+				  &ebx, &ecx, &edx);
 
 		if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0)
 			break;
@@ -276,22 +255,18 @@
  */
 static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
 {
-	unsigned long eax, ebx, ecx, edx, si, di;
+	u32 ebx, ecx;
 	size_t msg_len = strlen(msg);
 	int retries = 0;
 
 	while (retries < RETRIES) {
 		retries++;
 
-		/* Set up additional parameters */
-		si  = channel->cookie_high;
-		di  = channel->cookie_low;
-
-		VMW_PORT(VMW_PORT_CMD_SENDSIZE,
-			msg_len, si, di,
-			channel->channel_id << 16,
-			VMW_HYPERVISOR_MAGIC,
-			eax, ebx, ecx, edx, si, di);
+		vmware_hypercall5(VMW_PORT_CMD_SENDSIZE,
+				  msg_len, channel->channel_id << 16,
+				  channel->cookie_high,
+				  channel->cookie_low,
+				  &ecx);
 
 		if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
 			/* Expected success. Give up. */
@@ -329,7 +304,7 @@
 static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
 			size_t *msg_len)
 {
-	unsigned long eax, ebx, ecx, edx, si, di;
+	u32 ebx, ecx, edx;
 	char *reply;
 	size_t reply_len;
 	int retries = 0;
@@ -341,15 +316,11 @@
 	while (retries < RETRIES) {
 		retries++;
 
-		/* Set up additional parameters */
-		si  = channel->cookie_high;
-		di  = channel->cookie_low;
-
-		VMW_PORT(VMW_PORT_CMD_RECVSIZE,
-			0, si, di,
-			channel->channel_id << 16,
-			VMW_HYPERVISOR_MAGIC,
-			eax, ebx, ecx, edx, si, di);
+		vmware_hypercall7(VMW_PORT_CMD_RECVSIZE,
+				  0, channel->channel_id << 16,
+				  channel->cookie_high,
+				  channel->cookie_low,
+				  &ebx, &ecx, &edx);
 
 		if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
 			DRM_ERROR("Failed to get reply size for host message.\n");
@@ -384,16 +355,12 @@
 
 		reply[reply_len] = '\0';
 
-
-		/* Ack buffer */
-		si  = channel->cookie_high;
-		di  = channel->cookie_low;
-
-		VMW_PORT(VMW_PORT_CMD_RECVSTATUS,
-			MESSAGE_STATUS_SUCCESS, si, di,
-			channel->channel_id << 16,
-			VMW_HYPERVISOR_MAGIC,
-			eax, ebx, ecx, edx, si, di);
+		vmware_hypercall5(VMW_PORT_CMD_RECVSTATUS,
+				  MESSAGE_STATUS_SUCCESS,
+				  channel->channel_id << 16,
+				  channel->cookie_high,
+				  channel->cookie_low,
+				  &ecx);
 
 		if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
 			kfree(reply);
@@ -652,13 +619,7 @@
  */
 static inline void hypervisor_ppn_reset_all(void)
 {
-	unsigned long eax, ebx, ecx, edx, si = 0, di = 0;
-
-	VMW_PORT(VMW_PORT_CMD_MKSGS_RESET,
-		0, si, di,
-		0,
-		VMW_HYPERVISOR_MAGIC,
-		eax, ebx, ecx, edx, si, di);
+	vmware_hypercall1(VMW_PORT_CMD_MKSGS_RESET, 0);
 }
 
 /**
@@ -669,13 +630,7 @@
  */
 static inline void hypervisor_ppn_add(PPN64 pfn)
 {
-	unsigned long eax, ebx, ecx, edx, si = 0, di = 0;
-
-	VMW_PORT(VMW_PORT_CMD_MKSGS_ADD_PPN,
-		(unsigned long)pfn, si, di,
-		0,
-		VMW_HYPERVISOR_MAGIC,
-		eax, ebx, ecx, edx, si, di);
+	vmware_hypercall1(VMW_PORT_CMD_MKSGS_ADD_PPN, (unsigned long)pfn);
 }
 
 /**
@@ -686,13 +641,7 @@
  */
 static inline void hypervisor_ppn_remove(PPN64 pfn)
 {
-	unsigned long eax, ebx, ecx, edx, si = 0, di = 0;
-
-	VMW_PORT(VMW_PORT_CMD_MKSGS_REMOVE_PPN,
-		(unsigned long)pfn, si, di,
-		0,
-		VMW_HYPERVISOR_MAGIC,
-		eax, ebx, ecx, edx, si, di);
+	vmware_hypercall1(VMW_PORT_CMD_MKSGS_REMOVE_PPN, (unsigned long)pfn);
 }
 
 #if IS_ENABLED(CONFIG_DRM_VMWGFX_MKSSTATS)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_msg_arm64.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_msg_arm64.h
@@ -34,6 +34,8 @@
 #define VMWARE_HYPERVISOR_HB  BIT(0)
 #define VMWARE_HYPERVISOR_OUT BIT(1)
 
+#define VMWARE_HYPERVISOR_MAGIC	0x564D5868
+
 #define X86_IO_MAGIC 0x86
 
 #define X86_IO_W7_SIZE_SHIFT 0
@@ -45,86 +47,158 @@
 #define X86_IO_W7_IMM_SHIFT  5
 #define X86_IO_W7_IMM_MASK  (0xff << X86_IO_W7_IMM_SHIFT)
 
-static inline void vmw_port(unsigned long cmd, unsigned long in_ebx,
-			    unsigned long in_si, unsigned long in_di,
-			    unsigned long flags, unsigned long magic,
-			    unsigned long *eax, unsigned long *ebx,
-			    unsigned long *ecx, unsigned long *edx,
-			    unsigned long *si, unsigned long *di)
+static inline
+unsigned long vmware_hypercall1(unsigned long cmd, unsigned long in1)
+{
+	register u64 x0 asm("x0") = VMWARE_HYPERVISOR_MAGIC;
+	register u64 x1 asm("x1") = in1;
+	register u64 x2 asm("x2") = cmd;
+	register u64 x3 asm("x3") = VMWARE_HYPERVISOR_PORT;
+	register u64 x7 asm("x7") = ((u64)X86_IO_MAGIC << 32) |
+				    X86_IO_W7_WITH |
+				    X86_IO_W7_DIR |
+				    (2 << X86_IO_W7_SIZE_SHIFT);
+
+	asm_inline volatile (
+		"mrs xzr, mdccsr_el0; "
+		: "+r" (x0)
+		: "r" (x1), "r" (x2), "r" (x3), "r" (x7)
+		: "memory");
+
+	return x0;
+}
+
+static inline
+unsigned long vmware_hypercall5(unsigned long cmd, unsigned long in1,
+				unsigned long in3, unsigned long in4,
+				unsigned long in5, u32 *out2)
+{
+	register u64 x0 asm("x0") = VMWARE_HYPERVISOR_MAGIC;
+	register u64 x1 asm("x1") = in1;
+	register u64 x2 asm("x2") = cmd;
+	register u64 x3 asm("x3") = in3 | VMWARE_HYPERVISOR_PORT;
+	register u64 x4 asm("x4") = in4;
+	register u64 x5 asm("x5") = in5;
+	register u64 x7 asm("x7") = ((u64)X86_IO_MAGIC << 32) |
+				    X86_IO_W7_WITH |
+				    X86_IO_W7_DIR |
+				    (2 << X86_IO_W7_SIZE_SHIFT);
+
+	asm_inline volatile (
+		"mrs xzr, mdccsr_el0; "
+		: "+r" (x0), "+r" (x2)
+		: "r" (x1), "r" (x3), "r" (x4), "r" (x5), "r" (x7)
+		: "memory");
+
+	*out2 = x2;
+	return x0;
+}
+
+static inline
+unsigned long vmware_hypercall6(unsigned long cmd, unsigned long in1,
+				unsigned long in3, u32 *out2,
+				u32 *out3, u32 *out4, u32 *out5)
 {
-	register u64 x0 asm("x0") = magic;
-	register u64 x1 asm("x1") = in_ebx;
+	register u64 x0 asm("x0") = VMWARE_HYPERVISOR_MAGIC;
+	register u64 x1 asm("x1") = in1;
 	register u64 x2 asm("x2") = cmd;
-	register u64 x3 asm("x3") = flags | VMWARE_HYPERVISOR_PORT;
-	register u64 x4 asm("x4") = in_si;
-	register u64 x5 asm("x5") = in_di;
+	register u64 x3 asm("x3") = in3 | VMWARE_HYPERVISOR_PORT;
+	register u64 x4 asm("x4");
+	register u64 x5 asm("x5");
+	register u64 x7 asm("x7") = ((u64)X86_IO_MAGIC << 32) |
+				    X86_IO_W7_WITH |
+				    X86_IO_W7_DIR |
+				    (2 << X86_IO_W7_SIZE_SHIFT);
+
+	asm_inline volatile (
+		"mrs xzr, mdccsr_el0; "
+		: "+r" (x0), "+r" (x2), "+r" (x3), "=r" (x4), "=r" (x5)
+		: "r" (x1), "r" (x7)
+		: "memory");
+
+	*out2 = x2;
+	*out3 = x3;
+	*out4 = x4;
+	*out5 = x5;
+	return x0;
+}
 
+static inline
+unsigned long vmware_hypercall7(unsigned long cmd, unsigned long in1,
+				unsigned long in3, unsigned long in4,
+				unsigned long in5, u32 *out1,
+				u32 *out2, u32 *out3)
+{
+	register u64 x0 asm("x0") = VMWARE_HYPERVISOR_MAGIC;
+	register u64 x1 asm("x1") = in1;
+	register u64 x2 asm("x2") = cmd;
+	register u64 x3 asm("x3") = in3 | VMWARE_HYPERVISOR_PORT;
+	register u64 x4 asm("x4") = in4;
+	register u64 x5 asm("x5") = in5;
 	register u64 x7 asm("x7") = ((u64)X86_IO_MAGIC << 32) |
 				    X86_IO_W7_WITH |
 				    X86_IO_W7_DIR |
 				    (2 << X86_IO_W7_SIZE_SHIFT);
 
-	asm volatile("mrs xzr, mdccsr_el0 \n\t"
-		     : "+r"(x0), "+r"(x1), "+r"(x2),
-		       "+r"(x3), "+r"(x4), "+r"(x5)
-		     : "r"(x7)
-		     :);
-	*eax = x0;
-	*ebx = x1;
-	*ecx = x2;
-	*edx = x3;
-	*si = x4;
-	*di = x5;
-}
-
-static inline void vmw_port_hb(unsigned long cmd, unsigned long in_ecx,
-			       unsigned long in_si, unsigned long in_di,
-			       unsigned long flags, unsigned long magic,
-			       unsigned long bp, u32 w7dir,
-			       unsigned long *eax, unsigned long *ebx,
-			       unsigned long *ecx, unsigned long *edx,
-			       unsigned long *si, unsigned long *di)
+	asm_inline volatile (
+		"mrs xzr, mdccsr_el0; "
+		: "+r" (x0), "+r" (x1), "+r" (x2), "+r" (x3)
+		: "r" (x4), "r" (x5), "r" (x7)
+		: "memory");
+
+	*out1 = x1;
+	*out2 = x2;
+	*out3 = x3;
+	return x0;
+}
+
+static inline
+unsigned long vmware_hypercall_hb(unsigned long cmd, unsigned long in2,
+				  unsigned long in3, unsigned long in4,
+				  unsigned long in5, unsigned long in6,
+				  u32 *out1, int dir)
 {
-	register u64 x0 asm("x0") = magic;
+	register u64 x0 asm("x0") = VMWARE_HYPERVISOR_MAGIC;
 	register u64 x1 asm("x1") = cmd;
-	register u64 x2 asm("x2") = in_ecx;
-	register u64 x3 asm("x3") = flags | VMWARE_HYPERVISOR_PORT_HB;
-	register u64 x4 asm("x4") = in_si;
-	register u64 x5 asm("x5") = in_di;
-	register u64 x6 asm("x6") = bp;
+	register u64 x2 asm("x2") = in2;
+	register u64 x3 asm("x3") = in3 | VMWARE_HYPERVISOR_PORT_HB;
+	register u64 x4 asm("x4") = in4;
+	register u64 x5 asm("x5") = in5;
+	register u64 x6 asm("x6") = in6;
 	register u64 x7 asm("x7") = ((u64)X86_IO_MAGIC << 32) |
 				    X86_IO_W7_STR |
 				    X86_IO_W7_WITH |
-				    w7dir;
+				    dir;
 
-	asm volatile("mrs xzr, mdccsr_el0 \n\t"
-		     : "+r"(x0), "+r"(x1), "+r"(x2),
-		       "+r"(x3), "+r"(x4), "+r"(x5)
-		     : "r"(x6), "r"(x7)
-		     :);
-	*eax = x0;
-	*ebx = x1;
-	*ecx = x2;
-	*edx = x3;
-	*si  = x4;
-	*di  = x5;
-}
-
-#define VMW_PORT(cmd, in_ebx, in_si, in_di, flags, magic, eax, ebx, ecx, edx,  \
-		 si, di)                                                       \
-	vmw_port(cmd, in_ebx, in_si, in_di, flags, magic, &eax, &ebx, &ecx,    \
-		 &edx, &si, &di)
-
-#define VMW_PORT_HB_OUT(cmd, in_ecx, in_si, in_di, flags, magic, bp, eax, ebx, \
-		        ecx, edx, si, di)                                      \
-	vmw_port_hb(cmd, in_ecx, in_si, in_di, flags, magic, bp,               \
-                    0, &eax, &ebx, &ecx, &edx, &si, &di)
-
-#define VMW_PORT_HB_IN(cmd, in_ecx, in_si, in_di, flags, magic, bp, eax, ebx,  \
-		       ecx, edx, si, di)                                       \
-	vmw_port_hb(cmd, in_ecx, in_si, in_di, flags, magic, bp,               \
-		    X86_IO_W7_DIR, &eax, &ebx, &ecx, &edx, &si, &di)
+	asm_inline volatile (
+		"mrs xzr, mdccsr_el0; "
+		: "+r" (x0), "+r" (x1)
+		: "r" (x2), "r" (x3), "r" (x4), "r" (x5),
+		  "r" (x6), "r" (x7)
+		: "memory");
 
+	*out1 = x1;
+	return x0;
+}
+
+static inline
+unsigned long vmware_hypercall_hb_out(unsigned long cmd, unsigned long in2,
+				      unsigned long in3, unsigned long in4,
+				      unsigned long in5, unsigned long in6,
+				      u32 *out1)
+{
+	return vmware_hypercall_hb(cmd, in2, in3, in4, in5, in6, out1, 0);
+}
+
+static inline
+unsigned long vmware_hypercall_hb_in(unsigned long cmd, unsigned long in2,
+				     unsigned long in3, unsigned long in4,
+				     unsigned long in5, unsigned long in6,
+				     u32 *out1)
+{
+	return vmware_hypercall_hb(cmd, in2, in3, in4, in5, in6,  out1,
+				   X86_IO_W7_DIR);
+}
 #endif
 
 #endif /* _VMWGFX_MSG_ARM64_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_msg_x86.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_msg_x86.h
@@ -37,191 +37,6 @@
 
 #include <asm/vmware.h>
 
-/**
- * Hypervisor-specific bi-directional communication channel.  Should never
- * execute on bare metal hardware.  The caller must make sure to check for
- * supported hypervisor before using these macros.
- *
- * The last two parameters are both input and output and must be initialized.
- *
- * @cmd: [IN] Message Cmd
- * @in_ebx: [IN] Message Len, through EBX
- * @in_si: [IN] Input argument through SI, set to 0 if not used
- * @in_di: [IN] Input argument through DI, set ot 0 if not used
- * @flags: [IN] hypercall flags + [channel id]
- * @magic: [IN] hypervisor magic value
- * @eax: [OUT] value of EAX register
- * @ebx: [OUT] e.g. status from an HB message status command
- * @ecx: [OUT] e.g. status from a non-HB message status command
- * @edx: [OUT] e.g. channel id
- * @si:  [OUT]
- * @di:  [OUT]
- */
-#define VMW_PORT(cmd, in_ebx, in_si, in_di,	\
-                 flags, magic,		\
-                 eax, ebx, ecx, edx, si, di)	\
-({						\
-        asm volatile (VMWARE_HYPERCALL :	\
-                "=a"(eax),			\
-                "=b"(ebx),			\
-                "=c"(ecx),			\
-                "=d"(edx),			\
-                "=S"(si),			\
-                "=D"(di) :			\
-                "a"(magic),			\
-                "b"(in_ebx),			\
-                "c"(cmd),			\
-                "d"(flags),			\
-                "S"(in_si),			\
-                "D"(in_di) :			\
-                "memory");			\
-})
-
-
-/**
- * Hypervisor-specific bi-directional communication channel.  Should never
- * execute on bare metal hardware.  The caller must make sure to check for
- * supported hypervisor before using these macros.
- *
- * The last 3 parameters are both input and output and must be initialized.
- *
- * @cmd: [IN] Message Cmd
- * @in_ecx: [IN] Message Len, through ECX
- * @in_si: [IN] Input argument through SI, set to 0 if not used
- * @in_di: [IN] Input argument through DI, set to 0 if not used
- * @flags: [IN] hypercall flags + [channel id]
- * @magic: [IN] hypervisor magic value
- * @bp:  [IN]
- * @eax: [OUT] value of EAX register
- * @ebx: [OUT] e.g. status from an HB message status command
- * @ecx: [OUT] e.g. status from a non-HB message status command
- * @edx: [OUT] e.g. channel id
- * @si:  [OUT]
- * @di:  [OUT]
- */
-#ifdef __x86_64__
-
-#define VMW_PORT_HB_OUT(cmd, in_ecx, in_si, in_di,	\
-                        flags, magic, bp,		\
-                        eax, ebx, ecx, edx, si, di)	\
-({							\
-        asm volatile (					\
-		UNWIND_HINT_SAVE			\
-		"push %%rbp;"				\
-		UNWIND_HINT_UNDEFINED			\
-                "mov %12, %%rbp;"			\
-                VMWARE_HYPERCALL_HB_OUT			\
-                "pop %%rbp;"				\
-		UNWIND_HINT_RESTORE :			\
-                "=a"(eax),				\
-                "=b"(ebx),				\
-                "=c"(ecx),				\
-                "=d"(edx),				\
-                "=S"(si),				\
-                "=D"(di) :				\
-                "a"(magic),				\
-                "b"(cmd),				\
-                "c"(in_ecx),				\
-                "d"(flags),				\
-                "S"(in_si),				\
-                "D"(in_di),				\
-                "r"(bp) :				\
-                "memory", "cc");			\
-})
-
-
-#define VMW_PORT_HB_IN(cmd, in_ecx, in_si, in_di,	\
-                       flags, magic, bp,		\
-                       eax, ebx, ecx, edx, si, di)	\
-({							\
-        asm volatile (					\
-		UNWIND_HINT_SAVE			\
-		"push %%rbp;"				\
-		UNWIND_HINT_UNDEFINED			\
-                "mov %12, %%rbp;"			\
-                VMWARE_HYPERCALL_HB_IN			\
-                "pop %%rbp;"				\
-		UNWIND_HINT_RESTORE :			\
-                "=a"(eax),				\
-                "=b"(ebx),				\
-                "=c"(ecx),				\
-                "=d"(edx),				\
-                "=S"(si),				\
-                "=D"(di) :				\
-                "a"(magic),				\
-                "b"(cmd),				\
-                "c"(in_ecx),				\
-                "d"(flags),				\
-                "S"(in_si),				\
-                "D"(in_di),				\
-                "r"(bp) :				\
-                "memory", "cc");			\
-})
-
-#elif defined(__i386__)
-
-/*
- * In the 32-bit version of this macro, we store bp in a memory location
- * because we've ran out of registers.
- * Now we can't reference that memory location while we've modified
- * %esp or %ebp, so we first push it on the stack, just before we push
- * %ebp, and then when we need it we read it from the stack where we
- * just pushed it.
- */
-#define VMW_PORT_HB_OUT(cmd, in_ecx, in_si, in_di,	\
-                        flags, magic, bp,		\
-                        eax, ebx, ecx, edx, si, di)	\
-({							\
-        asm volatile ("push %12;"			\
-                "push %%ebp;"				\
-                "mov 0x04(%%esp), %%ebp;"		\
-                VMWARE_HYPERCALL_HB_OUT			\
-                "pop %%ebp;"				\
-                "add $0x04, %%esp;" :			\
-                "=a"(eax),				\
-                "=b"(ebx),				\
-                "=c"(ecx),				\
-                "=d"(edx),				\
-                "=S"(si),				\
-                "=D"(di) :				\
-                "a"(magic),				\
-                "b"(cmd),				\
-                "c"(in_ecx),				\
-                "d"(flags),				\
-                "S"(in_si),				\
-                "D"(in_di),				\
-                "m"(bp) :				\
-                "memory", "cc");			\
-})
-
-
-#define VMW_PORT_HB_IN(cmd, in_ecx, in_si, in_di,	\
-                       flags, magic, bp,		\
-                       eax, ebx, ecx, edx, si, di)	\
-({							\
-        asm volatile ("push %12;"			\
-                "push %%ebp;"				\
-                "mov 0x04(%%esp), %%ebp;"		\
-                VMWARE_HYPERCALL_HB_IN			\
-                "pop %%ebp;"				\
-                "add $0x04, %%esp;" :			\
-                "=a"(eax),				\
-                "=b"(ebx),				\
-                "=c"(ecx),				\
-                "=d"(edx),				\
-                "=S"(si),				\
-                "=D"(di) :				\
-                "a"(magic),				\
-                "b"(cmd),				\
-                "c"(in_ecx),				\
-                "d"(flags),				\
-                "S"(in_si),				\
-                "D"(in_di),				\
-                "m"(bp) :				\
-                "memory", "cc");			\
-})
-#endif /* defined(__i386__) */
-
 #endif /* defined(__i386__) || defined(__x86_64__) */
 
 #endif /* _VMWGFX_MSG_X86_H */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
@@ -92,7 +92,7 @@
 {
 	struct vmw_escape_video_flush *flush;
 	size_t fifo_size;
-	bool have_so = (dev_priv->active_display_unit == vmw_du_screen_object);
+	bool have_so = (dev_priv->active_display_unit != vmw_du_legacy);
 	int i, num_items;
 	SVGAGuestPtr ptr;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_prime.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_prime.c
@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0 OR MIT
 /**************************************************************************
  *
- * Copyright 2013 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2013-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -31,6 +32,7 @@
  */
 
 #include "vmwgfx_drv.h"
+#include "vmwgfx_bo.h"
 #include "ttm_object.h"
 #include <linux/dma-buf.h>
 
@@ -75,8 +77,12 @@
 			   int fd, u32 *handle)
 {
 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	int ret = ttm_prime_fd_to_handle(tfile, fd, handle);
 
-	return ttm_prime_fd_to_handle(tfile, fd, handle);
+	if (ret)
+		ret = drm_gem_prime_fd_to_handle(dev, file_priv, fd, handle);
+
+	return ret;
 }
 
 int vmw_prime_handle_to_fd(struct drm_device *dev,
@@ -84,6 +90,35 @@
 			   uint32_t handle, uint32_t flags,
 			   int *prime_fd)
 {
+	struct vmw_private *vmw = vmw_priv(dev);
 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
-	return ttm_prime_handle_to_fd(tfile, handle, flags, prime_fd);
+	struct vmw_bo *vbo;
+	int ret;
+	int surf_handle;
+
+	if (handle > VMWGFX_NUM_MOB) {
+		ret = ttm_prime_handle_to_fd(tfile, handle, flags, prime_fd);
+	} else {
+		ret = vmw_user_bo_lookup(file_priv, handle, &vbo);
+		if (ret)
+			return ret;
+		if (vbo && vbo->is_dumb) {
+			ret = drm_gem_prime_handle_to_fd(dev, file_priv, handle,
+							 flags, prime_fd);
+		} else {
+			surf_handle = vmw_lookup_surface_handle_for_buffer(vmw,
+									   vbo,
+									   handle);
+			if (surf_handle > 0)
+				ret = ttm_prime_handle_to_fd(tfile, surf_handle,
+							     flags, prime_fd);
+			else
+				ret = drm_gem_prime_handle_to_fd(dev, file_priv,
+								 handle, flags,
+								 prime_fd);
+		}
+		vmw_user_bo_unref(&vbo);
+	}
+
+	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0 OR MIT
 /**************************************************************************
  *
- * Copyright 2009-2023 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2009-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -58,6 +59,7 @@
 
 	rb_link_node(&res->mob_node, parent, new);
 	rb_insert_color(&res->mob_node, &gbo->res_tree);
+	vmw_bo_del_detached_resource(gbo, res);
 
 	vmw_bo_prio_add(gbo, res->used_prio);
 }
@@ -287,28 +289,35 @@
  *
  * The pointer this pointed at by out_surf and out_buf needs to be null.
  */
-int vmw_user_lookup_handle(struct vmw_private *dev_priv,
+int vmw_user_object_lookup(struct vmw_private *dev_priv,
 			   struct drm_file *filp,
-			   uint32_t handle,
-			   struct vmw_surface **out_surf,
-			   struct vmw_bo **out_buf)
+			   u32 handle,
+			   struct vmw_user_object *uo)
 {
 	struct ttm_object_file *tfile = vmw_fpriv(filp)->tfile;
 	struct vmw_resource *res;
 	int ret;
 
-	BUG_ON(*out_surf || *out_buf);
+	WARN_ON(uo->surface || uo->buffer);
 
 	ret = vmw_user_resource_lookup_handle(dev_priv, tfile, handle,
 					      user_surface_converter,
 					      &res);
 	if (!ret) {
-		*out_surf = vmw_res_to_srf(res);
+		uo->surface = vmw_res_to_srf(res);
 		return 0;
 	}
 
-	*out_surf = NULL;
-	ret = vmw_user_bo_lookup(filp, handle, out_buf);
+	uo->surface = NULL;
+	ret = vmw_user_bo_lookup(filp, handle, &uo->buffer);
+	if (!ret && !uo->buffer->is_dumb) {
+		uo->surface = vmw_lookup_surface_for_buffer(dev_priv,
+							    uo->buffer,
+							    handle);
+		if (uo->surface)
+			vmw_user_bo_unref(&uo->buffer);
+	}
+
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0 OR MIT
 /**************************************************************************
  *
- * Copyright 2011-2023 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2011-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -89,7 +90,6 @@
 struct vmw_screen_object_unit {
 	struct vmw_display_unit base;
 
-	unsigned long buffer_size; /**< Size of allocated buffer */
 	struct vmw_bo *buffer; /**< Backing store buffer */
 
 	bool defined;
@@ -239,8 +239,7 @@
 		struct vmw_connector_state *vmw_conn_state;
 		int x, y;
 
-		sou->buffer = vps->bo;
-		sou->buffer_size = vps->bo_size;
+		sou->buffer = vmw_user_object_buffer(&vps->uo);
 
 		conn_state = sou->base.connector.state;
 		vmw_conn_state = vmw_connector_state_to_vcs(conn_state);
@@ -255,7 +254,6 @@
 
 	} else {
 		sou->buffer = NULL;
-		sou->buffer_size = 0;
 	}
 }
 
@@ -347,7 +345,7 @@
 static const struct drm_connector_funcs vmw_sou_connector_funcs = {
 	.dpms = vmw_du_connector_dpms,
 	.detect = vmw_du_connector_detect,
-	.fill_modes = vmw_du_connector_fill_modes,
+	.fill_modes = drm_helper_probe_single_connector_modes,
 	.destroy = vmw_sou_connector_destroy,
 	.reset = vmw_du_connector_reset,
 	.atomic_duplicate_state = vmw_du_connector_duplicate_state,
@@ -357,6 +355,8 @@
 
 static const struct
 drm_connector_helper_funcs vmw_sou_connector_helper_funcs = {
+	.get_modes = vmw_connector_get_modes,
+	.mode_valid = vmw_connector_mode_valid
 };
 
 
@@ -382,10 +382,11 @@
 	struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state);
 	struct drm_crtc *crtc = plane->state->crtc ?
 		plane->state->crtc : old_state->crtc;
+	struct vmw_bo *bo = vmw_user_object_buffer(&vps->uo);
 
-	if (vps->bo)
-		vmw_bo_unpin(vmw_priv(crtc->dev), vps->bo, false);
-	vmw_bo_unreference(&vps->bo);
+	if (bo)
+		vmw_bo_unpin(vmw_priv(crtc->dev), bo, false);
+	vmw_user_object_unref(&vps->uo);
 	vps->bo_size = 0;
 
 	vmw_du_plane_cleanup_fb(plane, old_state);
@@ -417,9 +418,10 @@
 		.bo_type = ttm_bo_type_device,
 		.pin = true
 	};
+	struct vmw_bo *bo = NULL;
 
 	if (!new_fb) {
-		vmw_bo_unreference(&vps->bo);
+		vmw_user_object_unref(&vps->uo);
 		vps->bo_size = 0;
 
 		return 0;
@@ -428,17 +430,17 @@
 	bo_params.size = new_state->crtc_w * new_state->crtc_h * 4;
 	dev_priv = vmw_priv(crtc->dev);
 
-	if (vps->bo) {
+	bo = vmw_user_object_buffer(&vps->uo);
+	if (bo) {
 		if (vps->bo_size == bo_params.size) {
 			/*
 			 * Note that this might temporarily up the pin-count
 			 * to 2, until cleanup_fb() is called.
 			 */
-			return vmw_bo_pin_in_vram(dev_priv, vps->bo,
-						      true);
+			return vmw_bo_pin_in_vram(dev_priv, bo, true);
 		}
 
-		vmw_bo_unreference(&vps->bo);
+		vmw_user_object_unref(&vps->uo);
 		vps->bo_size = 0;
 	}
 
@@ -448,7 +450,7 @@
 	 * resume the overlays, this is preferred to failing to alloc.
 	 */
 	vmw_overlay_pause_all(dev_priv);
-	ret = vmw_bo_create(dev_priv, &bo_params, &vps->bo);
+	ret = vmw_gem_object_create(dev_priv, &bo_params, &vps->uo.buffer);
 	vmw_overlay_resume_all(dev_priv);
 	if (ret)
 		return ret;
@@ -459,7 +461,7 @@
 	 * TTM already thinks the buffer is pinned, but make sure the
 	 * pin_count is upped.
 	 */
-	return vmw_bo_pin_in_vram(dev_priv, vps->bo, true);
+	return vmw_bo_pin_in_vram(dev_priv, vps->uo.buffer, true);
 }
 
 static uint32_t vmw_sou_bo_fifo_size(struct vmw_du_update_plane *update,
@@ -586,6 +588,7 @@
 {
 	struct vmw_kms_sou_dirty_cmd *blit = cmd;
 	struct vmw_framebuffer_surface *vfbs;
+	struct vmw_surface *surf = NULL;
 
 	vfbs = container_of(update->vfb, typeof(*vfbs), base);
 
@@ -593,7 +596,8 @@
 	blit->header.size = sizeof(blit->body) + sizeof(SVGASignedRect) *
 		num_hits;
 
-	blit->body.srcImage.sid = vfbs->surface->res.id;
+	surf = vmw_user_object_surface(&vfbs->uo);
+	blit->body.srcImage.sid = surf->res.id;
 	blit->body.destScreenId = update->du->unit;
 
 	/* Update the source and destination bounding box later in post_clip */
@@ -826,7 +830,6 @@
 	sou->base.pref_active = (unit == 0);
 	sou->base.pref_width = dev_priv->initial_width;
 	sou->base.pref_height = dev_priv->initial_height;
-	sou->base.pref_mode = NULL;
 
 	/*
 	 * Remove this after enabling atomic because property values can
@@ -1108,7 +1111,7 @@
 	int ret;
 
 	if (!srf)
-		srf = &vfbs->surface->res;
+		srf = &vmw_user_object_surface(&vfbs->uo)->res;
 
 	ret = vmw_validation_add_resource(&val_ctx, srf, 0, VMW_RES_DIRTY_NONE,
 					  NULL, NULL);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
@@ -896,7 +896,8 @@
 		.busy_domain = VMW_BO_DOMAIN_SYS,
 		.bo_type = ttm_bo_type_device,
 		.size = size,
-		.pin = true
+		.pin = true,
+		.keep_resv = true,
 	};
 
 	if (!vmw_shader_id_ok(user_key, shader_type))
@@ -906,10 +907,6 @@
 	if (unlikely(ret != 0))
 		goto out;
 
-	ret = ttm_bo_reserve(&buf->tbo, false, true, NULL);
-	if (unlikely(ret != 0))
-		goto no_reserve;
-
 	/* Map and copy shader bytecode. */
 	ret = ttm_bo_kmap(&buf->tbo, 0, PFN_UP(size), &map);
 	if (unlikely(ret != 0)) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0 OR MIT
 /******************************************************************************
  *
- * COPYRIGHT (C) 2014-2023 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2014-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -28,6 +29,7 @@
 #include "vmwgfx_bo.h"
 #include "vmwgfx_kms.h"
 #include "vmw_surface_cache.h"
+#include <linux/fsnotify.h>
 
 #include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
@@ -41,7 +43,14 @@
 #define vmw_connector_to_stdu(x) \
 	container_of(x, struct vmw_screen_target_display_unit, base.connector)
 
-
+/*
+ * Some renderers such as llvmpipe will align the width and height of their
+ * buffers to match their tile size. We need to keep this in mind when exposing
+ * modes to userspace so that this possible over-allocation will not exceed
+ * graphics memory. 64x64 pixels seems to be a reasonable upper bound for the
+ * tile size of current renderers.
+ */
+#define GPU_TILE_SIZE 64
 
 enum stdu_content_type {
 	SAME_AS_DISPLAY = 0,
@@ -490,7 +499,7 @@
 		container_of(dirty->unit, typeof(*stdu), base);
 	s32 width, height;
 	s32 src_pitch, dst_pitch;
-	struct ttm_buffer_object *src_bo, *dst_bo;
+	struct vmw_bo *src_bo, *dst_bo;
 	u32 src_offset, dst_offset;
 	struct vmw_diff_cpy diff = VMW_CPU_BLIT_DIFF_INITIALIZER(stdu->cpp);
 
@@ -505,11 +514,11 @@
 
 	/* Assume we are blitting from Guest (bo) to Host (display_srf) */
 	src_pitch = stdu->display_srf->metadata.base_size.width * stdu->cpp;
-	src_bo = &stdu->display_srf->res.guest_memory_bo->tbo;
+	src_bo = stdu->display_srf->res.guest_memory_bo;
 	src_offset = ddirty->top * src_pitch + ddirty->left * stdu->cpp;
 
 	dst_pitch = ddirty->pitch;
-	dst_bo = &ddirty->buf->tbo;
+	dst_bo = ddirty->buf;
 	dst_offset = ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp;
 
 	(void) vmw_bo_cpu_blit(dst_bo, dst_offset, dst_pitch,
@@ -724,7 +733,7 @@
 	int ret;
 
 	if (!srf)
-		srf = &vfbs->surface->res;
+		srf = &vmw_user_object_surface(&vfbs->uo)->res;
 
 	ret = vmw_validation_add_resource(&val_ctx, srf, 0, VMW_RES_DIRTY_NONE,
 					  NULL, NULL);
@@ -735,12 +744,6 @@
 	if (ret)
 		goto out_unref;
 
-	if (vfbs->is_bo_proxy) {
-		ret = vmw_kms_update_proxy(srf, clips, num_clips, inc);
-		if (ret)
-			goto out_finish;
-	}
-
 	sdirty.base.fifo_commit = vmw_kms_stdu_surface_fifo_commit;
 	sdirty.base.clip = vmw_kms_stdu_surface_clip;
 	sdirty.base.fifo_reserve_size = sizeof(struct vmw_stdu_surface_copy) +
@@ -754,7 +757,7 @@
 	ret = vmw_kms_helper_dirty(dev_priv, framebuffer, clips, vclips,
 				   dest_x, dest_y, num_clips, inc,
 				   &sdirty.base);
-out_finish:
+
 	vmw_kms_helper_validation_finish(dev_priv, NULL, &val_ctx, out_fence,
 					 NULL);
 
@@ -825,12 +828,76 @@
 	vmw_stdu_destroy(vmw_connector_to_stdu(connector));
 }
 
+static enum drm_mode_status
+vmw_stdu_connector_mode_valid(struct drm_connector *connector,
+			      struct drm_display_mode *mode)
+{
+	enum drm_mode_status ret;
+	struct drm_device *dev = connector->dev;
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	u64 assumed_cpp = dev_priv->assume_16bpp ? 2 : 4;
+	/* Align width and height to account for GPU tile over-alignment */
+	u64 required_mem = ALIGN(mode->hdisplay, GPU_TILE_SIZE) *
+			   ALIGN(mode->vdisplay, GPU_TILE_SIZE) *
+			   assumed_cpp;
+	required_mem = ALIGN(required_mem, PAGE_SIZE);
+
+	ret = drm_mode_validate_size(mode, dev_priv->stdu_max_width,
+				     dev_priv->stdu_max_height);
+	if (ret != MODE_OK)
+		return ret;
+
+	ret = drm_mode_validate_size(mode, dev_priv->texture_max_width,
+				     dev_priv->texture_max_height);
+	if (ret != MODE_OK)
+		return ret;
+
+	if (required_mem > dev_priv->max_primary_mem)
+		return MODE_MEM;
+
+	if (required_mem > dev_priv->max_mob_pages * PAGE_SIZE)
+		return MODE_MEM;
+
+	if (required_mem > dev_priv->max_mob_size)
+		return MODE_MEM;
+
+	return MODE_OK;
+}
+
+/*
+ * Trigger a modeset if the X,Y position of the Screen Target changes.
+ * This is needed when multi-mon is cycled. The original Screen Target will have
+ * the same mode but its relative X,Y position in the topology will change.
+ */
+static int vmw_stdu_connector_atomic_check(struct drm_connector *conn,
+					   struct drm_atomic_state *state)
+{
+	struct drm_connector_state *conn_state;
+	struct vmw_screen_target_display_unit *du;
+	struct drm_crtc_state *new_crtc_state;
+
+	conn_state = drm_atomic_get_connector_state(state, conn);
 
+	if (IS_ERR(conn_state))
+		return PTR_ERR(conn_state);
+
+	du = vmw_connector_to_stdu(conn);
+
+	if (!conn_state->crtc)
+		return 0;
+
+	new_crtc_state = drm_atomic_get_new_crtc_state(state, conn_state->crtc);
+	if (du->base.gui_x != du->base.set_gui_x ||
+	    du->base.gui_y != du->base.set_gui_y)
+		new_crtc_state->mode_changed = true;
+
+	return 0;
+}
 
 static const struct drm_connector_funcs vmw_stdu_connector_funcs = {
 	.dpms = vmw_du_connector_dpms,
 	.detect = vmw_du_connector_detect,
-	.fill_modes = vmw_du_connector_fill_modes,
+	.fill_modes = drm_helper_probe_single_connector_modes,
 	.destroy = vmw_stdu_connector_destroy,
 	.reset = vmw_du_connector_reset,
 	.atomic_duplicate_state = vmw_du_connector_duplicate_state,
@@ -840,6 +907,9 @@
 
 static const struct
 drm_connector_helper_funcs vmw_stdu_connector_helper_funcs = {
+	.get_modes = vmw_connector_get_modes,
+	.mode_valid = vmw_stdu_connector_mode_valid,
+	.atomic_check = vmw_stdu_connector_atomic_check,
 };
 
 
@@ -866,9 +936,8 @@
 {
 	struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state);
 
-	if (vps->surf)
+	if (vmw_user_object_surface(&vps->uo))
 		WARN_ON(!vps->pinned);
-
 	vmw_du_plane_cleanup_fb(plane, old_state);
 
 	vps->content_fb_type = SAME_AS_DISPLAY;
@@ -876,7 +945,6 @@
 }
 
 
-
 /**
  * vmw_stdu_primary_plane_prepare_fb - Readies the display surface
  *
@@ -900,13 +968,15 @@
 	enum stdu_content_type new_content_type;
 	struct vmw_framebuffer_surface *new_vfbs;
 	uint32_t hdisplay = new_state->crtc_w, vdisplay = new_state->crtc_h;
+	struct drm_plane_state *old_state = plane->state;
+	struct drm_rect rect;
 	int ret;
 
 	/* No FB to prepare */
 	if (!new_fb) {
-		if (vps->surf) {
+		if (vmw_user_object_surface(&vps->uo)) {
 			WARN_ON(vps->pinned != 0);
-			vmw_surface_unreference(&vps->surf);
+			vmw_user_object_unref(&vps->uo);
 		}
 
 		return 0;
@@ -916,8 +986,8 @@
 	new_vfbs = (vfb->bo) ? NULL : vmw_framebuffer_to_vfbs(new_fb);
 
 	if (new_vfbs &&
-	    new_vfbs->surface->metadata.base_size.width == hdisplay &&
-	    new_vfbs->surface->metadata.base_size.height == vdisplay)
+	    vmw_user_object_surface(&new_vfbs->uo)->metadata.base_size.width == hdisplay &&
+	    vmw_user_object_surface(&new_vfbs->uo)->metadata.base_size.height == vdisplay)
 		new_content_type = SAME_AS_DISPLAY;
 	else if (vfb->bo)
 		new_content_type = SEPARATE_BO;
@@ -955,29 +1025,29 @@
 			metadata.num_sizes = 1;
 			metadata.scanout = true;
 		} else {
-			metadata = new_vfbs->surface->metadata;
+			metadata = vmw_user_object_surface(&new_vfbs->uo)->metadata;
 		}
 
 		metadata.base_size.width = hdisplay;
 		metadata.base_size.height = vdisplay;
 		metadata.base_size.depth = 1;
 
-		if (vps->surf) {
+		if (vmw_user_object_surface(&vps->uo)) {
 			struct drm_vmw_size cur_base_size =
-				vps->surf->metadata.base_size;
+				vmw_user_object_surface(&vps->uo)->metadata.base_size;
 
 			if (cur_base_size.width != metadata.base_size.width ||
 			    cur_base_size.height != metadata.base_size.height ||
-			    vps->surf->metadata.format != metadata.format) {
+			    vmw_user_object_surface(&vps->uo)->metadata.format != metadata.format) {
 				WARN_ON(vps->pinned != 0);
-				vmw_surface_unreference(&vps->surf);
+				vmw_user_object_unref(&vps->uo);
 			}
 
 		}
 
-		if (!vps->surf) {
+		if (!vmw_user_object_surface(&vps->uo)) {
 			ret = vmw_gb_surface_define(dev_priv, &metadata,
-						    &vps->surf);
+						    &vps->uo.surface);
 			if (ret != 0) {
 				DRM_ERROR("Couldn't allocate STDU surface.\n");
 				return ret;
@@ -990,18 +1060,19 @@
 		 * The only time we add a reference in prepare_fb is if the
 		 * state object doesn't have a reference to begin with
 		 */
-		if (vps->surf) {
+		if (vmw_user_object_surface(&vps->uo)) {
 			WARN_ON(vps->pinned != 0);
-			vmw_surface_unreference(&vps->surf);
+			vmw_user_object_unref(&vps->uo);
 		}
 
-		vps->surf = vmw_surface_reference(new_vfbs->surface);
+		memcpy(&vps->uo, &new_vfbs->uo, sizeof(vps->uo));
+		vmw_user_object_ref(&vps->uo);
 	}
 
-	if (vps->surf) {
+	if (vmw_user_object_surface(&vps->uo)) {
 
 		/* Pin new surface before flipping */
-		ret = vmw_resource_pin(&vps->surf->res, false);
+		ret = vmw_resource_pin(&vmw_user_object_surface(&vps->uo)->res, false);
 		if (ret)
 			goto out_srf_unref;
 
@@ -1011,6 +1082,34 @@
 	vps->content_fb_type = new_content_type;
 
 	/*
+	 * The drm fb code will do blit's via the vmap interface, which doesn't
+	 * trigger vmw_bo page dirty tracking due to being kernel side (and thus
+	 * doesn't require mmap'ing) so we have to update the surface's dirty
+	 * regions by hand but we want to be careful to not overwrite the
+	 * resource if it has been written to by the gpu (res_dirty).
+	 */
+	if (vps->uo.buffer && vps->uo.buffer->is_dumb) {
+		struct vmw_surface *surf = vmw_user_object_surface(&vps->uo);
+		struct vmw_resource *res = &surf->res;
+
+		if (!res->res_dirty && drm_atomic_helper_damage_merged(old_state,
+								       new_state,
+								       &rect)) {
+			/*
+			 * At some point it might be useful to actually translate
+			 * (rect.x1, rect.y1) => start, and (rect.x2, rect.y2) => end,
+			 * but currently the fb code will just report the entire fb
+			 * dirty so in practice it doesn't matter.
+			 */
+			pgoff_t start = res->guest_memory_offset >> PAGE_SHIFT;
+			pgoff_t end = __KERNEL_DIV_ROUND_UP(res->guest_memory_offset +
+							    res->guest_memory_size,
+							    PAGE_SIZE);
+			vmw_resource_dirty_update(res, start, end);
+		}
+	}
+
+	/*
 	 * This should only happen if the buffer object is too large to create a
 	 * proxy surface for.
 	 */
@@ -1020,7 +1119,7 @@
 	return 0;
 
 out_srf_unref:
-	vmw_surface_unreference(&vps->surf);
+	vmw_user_object_unref(&vps->uo);
 	return ret;
 }
 
@@ -1066,7 +1165,7 @@
 	struct vmw_diff_cpy diff = VMW_CPU_BLIT_DIFF_INITIALIZER(0);
 	struct vmw_stdu_update_gb_image *cmd_img = cmd;
 	struct vmw_stdu_update *cmd_update;
-	struct ttm_buffer_object *src_bo, *dst_bo;
+	struct vmw_bo *src_bo, *dst_bo;
 	u32 src_offset, dst_offset;
 	s32 src_pitch, dst_pitch;
 	s32 width, height;
@@ -1080,11 +1179,11 @@
 
 	diff.cpp = stdu->cpp;
 
-	dst_bo = &stdu->display_srf->res.guest_memory_bo->tbo;
+	dst_bo = stdu->display_srf->res.guest_memory_bo;
 	dst_pitch = stdu->display_srf->metadata.base_size.width * stdu->cpp;
 	dst_offset = bb->y1 * dst_pitch + bb->x1 * stdu->cpp;
 
-	src_bo = &vfbbo->buffer->tbo;
+	src_bo = vfbbo->buffer;
 	src_pitch = update->vfb->base.pitches[0];
 	src_offset = bo_update->fb_top * src_pitch + bo_update->fb_left *
 		stdu->cpp;
@@ -1162,14 +1261,8 @@
 vmw_stdu_surface_fifo_size_same_display(struct vmw_du_update_plane *update,
 					uint32_t num_hits)
 {
-	struct vmw_framebuffer_surface *vfbs;
 	uint32_t size = 0;
 
-	vfbs = container_of(update->vfb, typeof(*vfbs), base);
-
-	if (vfbs->is_bo_proxy)
-		size += sizeof(struct vmw_stdu_update_gb_image) * num_hits;
-
 	size += sizeof(struct vmw_stdu_update);
 
 	return size;
@@ -1178,14 +1271,8 @@
 static uint32_t vmw_stdu_surface_fifo_size(struct vmw_du_update_plane *update,
 					   uint32_t num_hits)
 {
-	struct vmw_framebuffer_surface *vfbs;
 	uint32_t size = 0;
 
-	vfbs = container_of(update->vfb, typeof(*vfbs), base);
-
-	if (vfbs->is_bo_proxy)
-		size += sizeof(struct vmw_stdu_update_gb_image) * num_hits;
-
 	size += sizeof(struct vmw_stdu_surface_copy) + sizeof(SVGA3dCopyBox) *
 		num_hits + sizeof(struct vmw_stdu_update);
 
@@ -1193,47 +1280,6 @@
 }
 
 static uint32_t
-vmw_stdu_surface_update_proxy(struct vmw_du_update_plane *update, void *cmd)
-{
-	struct vmw_framebuffer_surface *vfbs;
-	struct drm_plane_state *state = update->plane->state;
-	struct drm_plane_state *old_state = update->old_state;
-	struct vmw_stdu_update_gb_image *cmd_update = cmd;
-	struct drm_atomic_helper_damage_iter iter;
-	struct drm_rect clip;
-	uint32_t copy_size = 0;
-
-	vfbs = container_of(update->vfb, typeof(*vfbs), base);
-
-	/*
-	 * proxy surface is special where a buffer object type fb is wrapped
-	 * in a surface and need an update gb image command to sync with device.
-	 */
-	drm_atomic_helper_damage_iter_init(&iter, old_state, state);
-	drm_atomic_for_each_plane_damage(&iter, &clip) {
-		SVGA3dBox *box = &cmd_update->body.box;
-
-		cmd_update->header.id = SVGA_3D_CMD_UPDATE_GB_IMAGE;
-		cmd_update->header.size = sizeof(cmd_update->body);
-		cmd_update->body.image.sid = vfbs->surface->res.id;
-		cmd_update->body.image.face = 0;
-		cmd_update->body.image.mipmap = 0;
-
-		box->x = clip.x1;
-		box->y = clip.y1;
-		box->z = 0;
-		box->w = drm_rect_width(&clip);
-		box->h = drm_rect_height(&clip);
-		box->d = 1;
-
-		copy_size += sizeof(*cmd_update);
-		cmd_update++;
-	}
-
-	return copy_size;
-}
-
-static uint32_t
 vmw_stdu_surface_populate_copy(struct vmw_du_update_plane  *update, void *cmd,
 			       uint32_t num_hits)
 {
@@ -1247,7 +1293,7 @@
 	cmd_copy->header.id = SVGA_3D_CMD_SURFACE_COPY;
 	cmd_copy->header.size = sizeof(cmd_copy->body) + sizeof(SVGA3dCopyBox) *
 		num_hits;
-	cmd_copy->body.src.sid = vfbs->surface->res.id;
+	cmd_copy->body.src.sid = vmw_user_object_surface(&vfbs->uo)->res.id;
 	cmd_copy->body.dest.sid = stdu->display_srf->res.id;
 
 	return sizeof(*cmd_copy);
@@ -1318,10 +1364,7 @@
 	srf_update.mutex = &dev_priv->cmdbuf_mutex;
 	srf_update.intr = true;
 
-	if (vfbs->is_bo_proxy)
-		srf_update.post_prepare = vmw_stdu_surface_update_proxy;
-
-	if (vfbs->surface->res.id != stdu->display_srf->res.id) {
+	if (vmw_user_object_surface(&vfbs->uo)->res.id != stdu->display_srf->res.id) {
 		srf_update.calc_fifo_size = vmw_stdu_surface_fifo_size;
 		srf_update.pre_clip = vmw_stdu_surface_populate_copy;
 		srf_update.clip = vmw_stdu_surface_populate_clip;
@@ -1365,7 +1408,7 @@
 		stdu = vmw_crtc_to_stdu(crtc);
 		dev_priv = vmw_priv(crtc->dev);
 
-		stdu->display_srf = vps->surf;
+		stdu->display_srf = vmw_user_object_surface(&vps->uo);
 		stdu->content_fb_type = vps->content_fb_type;
 		stdu->cpp = vps->cpp;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0 OR MIT
 /**************************************************************************
  *
- * Copyright 2009-2023 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2009-2024 Broadcom. All Rights Reserved. The term
+ * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
@@ -36,9 +37,6 @@
 #include <drm/ttm/ttm_placement.h>
 
 #define SVGA3D_FLAGS_64(upper32, lower32) (((uint64_t)upper32 << 32) | lower32)
-#define SVGA3D_FLAGS_UPPER_32(svga3d_flags) (svga3d_flags >> 32)
-#define SVGA3D_FLAGS_LOWER_32(svga3d_flags) \
-	(svga3d_flags & ((uint64_t)U32_MAX))
 
 /**
  * struct vmw_user_surface - User-space visible surface resource
@@ -687,6 +685,14 @@
 	struct vmw_resource *res = &user_srf->srf.res;
 
 	*p_base = NULL;
+
+	/*
+	 * Dumb buffers own the resource and they'll unref the
+	 * resource themselves
+	 */
+	if (res && res->guest_memory_bo && res->guest_memory_bo->is_dumb)
+		return;
+
 	vmw_resource_unreference(&res);
 }
 
@@ -813,7 +819,8 @@
 		}
 	}
 	res->guest_memory_size = cur_bo_offset;
-	if (metadata->scanout &&
+	if (!file_priv->atomic &&
+	    metadata->scanout &&
 	    metadata->num_sizes == 1 &&
 	    metadata->sizes[0].width == VMW_CURSOR_SNOOP_WIDTH &&
 	    metadata->sizes[0].height == VMW_CURSOR_SNOOP_HEIGHT &&
@@ -867,6 +874,7 @@
 			vmw_resource_unreference(&res);
 			goto out_unlock;
 		}
+		vmw_bo_add_detached_resource(res->guest_memory_bo, res);
 	}
 
 	tmp = vmw_resource_reference(&srf->res);
@@ -894,6 +902,113 @@
 	return ret;
 }
 
+static struct vmw_user_surface *
+vmw_lookup_user_surface_for_buffer(struct vmw_private *vmw, struct vmw_bo *bo,
+				   u32 handle)
+{
+	struct vmw_user_surface *user_srf = NULL;
+	struct vmw_surface *surf;
+	struct ttm_base_object *base;
+
+	surf = vmw_bo_surface(bo);
+	if (surf) {
+		rcu_read_lock();
+		user_srf = container_of(surf, struct vmw_user_surface, srf);
+		base = &user_srf->prime.base;
+		if (base && !kref_get_unless_zero(&base->refcount)) {
+			drm_dbg_driver(&vmw->drm,
+				       "%s: referencing a stale surface handle %d\n",
+					__func__, handle);
+			base = NULL;
+			user_srf = NULL;
+		}
+		rcu_read_unlock();
+	}
+
+	return user_srf;
+}
+
+struct vmw_surface *vmw_lookup_surface_for_buffer(struct vmw_private *vmw,
+						  struct vmw_bo *bo,
+						  u32 handle)
+{
+	struct vmw_user_surface *user_srf =
+		vmw_lookup_user_surface_for_buffer(vmw, bo, handle);
+	struct vmw_surface *surf = NULL;
+	struct ttm_base_object *base;
+
+	if (user_srf) {
+		surf = vmw_surface_reference(&user_srf->srf);
+		base = &user_srf->prime.base;
+		ttm_base_object_unref(&base);
+	}
+	return surf;
+}
+
+u32 vmw_lookup_surface_handle_for_buffer(struct vmw_private *vmw,
+					 struct vmw_bo *bo,
+					 u32 handle)
+{
+	struct vmw_user_surface *user_srf =
+		vmw_lookup_user_surface_for_buffer(vmw, bo, handle);
+	int surf_handle = 0;
+	struct ttm_base_object *base;
+
+	if (user_srf) {
+		base = &user_srf->prime.base;
+		surf_handle = (u32)base->handle;
+		ttm_base_object_unref(&base);
+	}
+	return surf_handle;
+}
+
+static int vmw_buffer_prime_to_surface_base(struct vmw_private *dev_priv,
+					    struct drm_file *file_priv,
+					    u32 fd, u32 *handle,
+					    struct ttm_base_object **base_p)
+{
+	struct ttm_base_object *base;
+	struct vmw_bo *bo;
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	struct vmw_user_surface *user_srf;
+	int ret;
+
+	ret = drm_gem_prime_fd_to_handle(&dev_priv->drm, file_priv, fd, handle);
+	if (ret) {
+		drm_warn(&dev_priv->drm,
+			 "Wasn't able to find user buffer for fd = %u.\n", fd);
+		return ret;
+	}
+
+	ret = vmw_user_bo_lookup(file_priv, *handle, &bo);
+	if (ret) {
+		drm_warn(&dev_priv->drm,
+			 "Wasn't able to lookup user buffer for handle = %u.\n", *handle);
+		return ret;
+	}
+
+	user_srf = vmw_lookup_user_surface_for_buffer(dev_priv, bo, *handle);
+	if (WARN_ON(!user_srf)) {
+		drm_warn(&dev_priv->drm,
+			 "User surface fd %d (handle %d) is null.\n", fd, *handle);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	base = &user_srf->prime.base;
+	ret = ttm_ref_object_add(tfile, base, NULL, false);
+	if (ret) {
+		drm_warn(&dev_priv->drm,
+			 "Couldn't add an object ref for the buffer (%d).\n", *handle);
+		goto out;
+	}
+
+	*base_p = base;
+out:
+	vmw_user_bo_unref(&bo);
+
+	return ret;
+}
 
 static int
 vmw_surface_handle_reference(struct vmw_private *dev_priv,
@@ -903,15 +1018,19 @@
 			     struct ttm_base_object **base_p)
 {
 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
-	struct vmw_user_surface *user_srf;
+	struct vmw_user_surface *user_srf = NULL;
 	uint32_t handle;
 	struct ttm_base_object *base;
 	int ret;
 
 	if (handle_type == DRM_VMW_HANDLE_PRIME) {
 		ret = ttm_prime_fd_to_handle(tfile, u_handle, &handle);
-		if (unlikely(ret != 0))
-			return ret;
+		if (ret)
+			return vmw_buffer_prime_to_surface_base(dev_priv,
+								file_priv,
+								u_handle,
+								&handle,
+								base_p);
 	} else {
 		handle = u_handle;
 	}
@@ -1505,7 +1624,12 @@
 		ret = vmw_user_bo_lookup(file_priv, req->base.buffer_handle,
 					 &res->guest_memory_bo);
 		if (ret == 0) {
-			if (res->guest_memory_bo->tbo.base.size < res->guest_memory_size) {
+			if (res->guest_memory_bo->is_dumb) {
+				VMW_DEBUG_USER("Can't backup surface with a dumb buffer.\n");
+				vmw_user_bo_unref(&res->guest_memory_bo);
+				ret = -EINVAL;
+				goto out_unlock;
+			} else if (res->guest_memory_bo->tbo.base.size < res->guest_memory_size) {
 				VMW_DEBUG_USER("Surface backup buffer too small.\n");
 				vmw_user_bo_unref(&res->guest_memory_bo);
 				ret = -EINVAL;
@@ -1564,6 +1688,7 @@
 	rep->handle      = user_srf->prime.base.handle;
 	rep->backup_size = res->guest_memory_size;
 	if (res->guest_memory_bo) {
+		vmw_bo_add_detached_resource(res->guest_memory_bo, res);
 		rep->buffer_map_handle =
 			drm_vma_node_offset_addr(&res->guest_memory_bo->tbo.base.vma_node);
 		rep->buffer_size = res->guest_memory_bo->tbo.base.size;
@@ -2106,3 +2231,145 @@
 out_unlock:
 	return ret;
 }
+
+static SVGA3dSurfaceFormat vmw_format_bpp_to_svga(struct vmw_private *vmw,
+						  int bpp)
+{
+	switch (bpp) {
+	case 8: /* DRM_FORMAT_C8 */
+		return SVGA3D_P8;
+	case 16: /* DRM_FORMAT_RGB565 */
+		return SVGA3D_R5G6B5;
+	case 32: /* DRM_FORMAT_XRGB8888 */
+		if (has_sm4_context(vmw))
+			return SVGA3D_B8G8R8X8_UNORM;
+		return SVGA3D_X8R8G8B8;
+	default:
+		drm_warn(&vmw->drm, "Unsupported format bpp: %d\n", bpp);
+		return SVGA3D_X8R8G8B8;
+	}
+}
+
+/**
+ * vmw_dumb_create - Create a dumb kms buffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @args: Pointer to a struct drm_mode_create_dumb structure
+ * Return: Zero on success, negative error code on failure.
+ *
+ * This is a driver callback for the core drm create_dumb functionality.
+ * Note that this is very similar to the vmw_bo_alloc ioctl, except
+ * that the arguments have a different format.
+ */
+int vmw_dumb_create(struct drm_file *file_priv,
+		    struct drm_device *dev,
+		    struct drm_mode_create_dumb *args)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	struct vmw_bo *vbo = NULL;
+	struct vmw_resource *res = NULL;
+	union drm_vmw_gb_surface_create_ext_arg arg = { 0 };
+	struct drm_vmw_gb_surface_create_ext_req *req = &arg.req;
+	int ret;
+	struct drm_vmw_size drm_size = {
+		.width = args->width,
+		.height = args->height,
+		.depth = 1,
+	};
+	SVGA3dSurfaceFormat format = vmw_format_bpp_to_svga(dev_priv, args->bpp);
+	const struct SVGA3dSurfaceDesc *desc = vmw_surface_get_desc(format);
+	SVGA3dSurfaceAllFlags flags = SVGA3D_SURFACE_HINT_TEXTURE |
+				      SVGA3D_SURFACE_HINT_RENDERTARGET |
+				      SVGA3D_SURFACE_SCREENTARGET;
+
+	if (vmw_surface_is_dx_screen_target_format(format)) {
+		flags |= SVGA3D_SURFACE_BIND_SHADER_RESOURCE |
+			 SVGA3D_SURFACE_BIND_RENDER_TARGET;
+	}
+
+	/*
+	 * Without mob support we're just going to use raw memory buffer
+	 * because we wouldn't be able to support full surface coherency
+	 * without mobs. There also no reason to support surface coherency
+	 * without 3d (i.e. gpu usage on the host) because then all the
+	 * contents is going to be rendered guest side.
+	 */
+	if (!dev_priv->has_mob || !vmw_supports_3d(dev_priv)) {
+		int cpp = DIV_ROUND_UP(args->bpp, 8);
+
+		switch (cpp) {
+		case 1: /* DRM_FORMAT_C8 */
+		case 2: /* DRM_FORMAT_RGB565 */
+		case 4: /* DRM_FORMAT_XRGB8888 */
+			break;
+		default:
+			/*
+			 * Dumb buffers don't allow anything else.
+			 * This is tested via IGT's dumb_buffers
+			 */
+			return -EINVAL;
+		}
+
+		args->pitch = args->width * cpp;
+		args->size = ALIGN(args->pitch * args->height, PAGE_SIZE);
+
+		ret = vmw_gem_object_create_with_handle(dev_priv, file_priv,
+							args->size, &args->handle,
+							&vbo);
+		/* drop reference from allocate - handle holds it now */
+		drm_gem_object_put(&vbo->tbo.base);
+		return ret;
+	}
+
+	req->version = drm_vmw_gb_surface_v1;
+	req->multisample_pattern = SVGA3D_MS_PATTERN_NONE;
+	req->quality_level = SVGA3D_MS_QUALITY_NONE;
+	req->buffer_byte_stride = 0;
+	req->must_be_zero = 0;
+	req->base.svga3d_flags = SVGA3D_FLAGS_LOWER_32(flags);
+	req->svga3d_flags_upper_32_bits = SVGA3D_FLAGS_UPPER_32(flags);
+	req->base.format = (uint32_t)format;
+	req->base.drm_surface_flags = drm_vmw_surface_flag_scanout;
+	req->base.drm_surface_flags |= drm_vmw_surface_flag_shareable;
+	req->base.drm_surface_flags |= drm_vmw_surface_flag_create_buffer;
+	req->base.drm_surface_flags |= drm_vmw_surface_flag_coherent;
+	req->base.base_size.width = args->width;
+	req->base.base_size.height = args->height;
+	req->base.base_size.depth = 1;
+	req->base.array_size = 0;
+	req->base.mip_levels = 1;
+	req->base.multisample_count = 0;
+	req->base.buffer_handle = SVGA3D_INVALID_ID;
+	req->base.autogen_filter = SVGA3D_TEX_FILTER_NONE;
+	ret = vmw_gb_surface_define_ext_ioctl(dev, &arg, file_priv);
+	if (ret) {
+		drm_warn(dev, "Unable to create a dumb buffer\n");
+		return ret;
+	}
+
+	args->handle = arg.rep.buffer_handle;
+	args->size = arg.rep.buffer_size;
+	args->pitch = vmw_surface_calculate_pitch(desc, &drm_size);
+
+	ret = vmw_user_resource_lookup_handle(dev_priv, tfile, arg.rep.handle,
+					      user_surface_converter,
+					      &res);
+	if (ret) {
+		drm_err(dev, "Created resource handle doesn't exist!\n");
+		goto err;
+	}
+
+	vbo = res->guest_memory_bo;
+	vbo->is_dumb = true;
+	vbo->dumb_surface = vmw_res_to_srf(res);
+
+err:
+	if (res)
+		vmw_resource_unreference(&res);
+	if (ret)
+		ttm_ref_object_base_unref(tfile, arg.rep.handle);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c
@@ -220,13 +220,18 @@
 	switch (dev_priv->map_mode) {
 	case vmw_dma_map_bind:
 	case vmw_dma_map_populate:
-		vsgt->sgt = &vmw_tt->sgt;
-		ret = sg_alloc_table_from_pages_segment(
-			&vmw_tt->sgt, vsgt->pages, vsgt->num_pages, 0,
-			(unsigned long)vsgt->num_pages << PAGE_SHIFT,
-			dma_get_max_seg_size(dev_priv->drm.dev), GFP_KERNEL);
-		if (ret)
-			goto out_sg_alloc_fail;
+		if (vmw_tt->dma_ttm.page_flags  & TTM_TT_FLAG_EXTERNAL) {
+			vsgt->sgt = vmw_tt->dma_ttm.sg;
+		} else {
+			vsgt->sgt = &vmw_tt->sgt;
+			ret = sg_alloc_table_from_pages_segment(&vmw_tt->sgt,
+				vsgt->pages, vsgt->num_pages, 0,
+				(unsigned long)vsgt->num_pages << PAGE_SHIFT,
+				dma_get_max_seg_size(dev_priv->drm.dev),
+				GFP_KERNEL);
+			if (ret)
+				goto out_sg_alloc_fail;
+		}
 
 		ret = vmw_ttm_map_for_dma(vmw_tt);
 		if (unlikely(ret != 0))
@@ -241,8 +246,9 @@
 	return 0;
 
 out_map_fail:
-	sg_free_table(vmw_tt->vsgt.sgt);
-	vmw_tt->vsgt.sgt = NULL;
+	drm_warn(&dev_priv->drm, "VSG table map failed!");
+	sg_free_table(vsgt->sgt);
+	vsgt->sgt = NULL;
 out_sg_alloc_fail:
 	return ret;
 }
@@ -388,15 +394,17 @@
 static int vmw_ttm_populate(struct ttm_device *bdev,
 			    struct ttm_tt *ttm, struct ttm_operation_ctx *ctx)
 {
-	int ret;
+	bool external = (ttm->page_flags & TTM_TT_FLAG_EXTERNAL) != 0;
 
-	/* TODO: maybe completely drop this ? */
 	if (ttm_tt_is_populated(ttm))
 		return 0;
 
-	ret = ttm_pool_alloc(&bdev->pool, ttm, ctx);
+	if (external && ttm->sg)
+		return  drm_prime_sg_to_dma_addr_array(ttm->sg,
+						       ttm->dma_address,
+						       ttm->num_pages);
 
-	return ret;
+	return ttm_pool_alloc(&bdev->pool, ttm, ctx);
 }
 
 static void vmw_ttm_unpopulate(struct ttm_device *bdev,
@@ -404,6 +412,10 @@
 {
 	struct vmw_ttm_tt *vmw_tt = container_of(ttm, struct vmw_ttm_tt,
 						 dma_ttm);
+	bool external = (ttm->page_flags & TTM_TT_FLAG_EXTERNAL) != 0;
+
+	if (external)
+		return;
 
 	vmw_ttm_unbind(bdev, ttm);
 
@@ -422,6 +434,7 @@
 {
 	struct vmw_ttm_tt *vmw_be;
 	int ret;
+	bool external = bo->type == ttm_bo_type_sg;
 
 	vmw_be = kzalloc(sizeof(*vmw_be), GFP_KERNEL);
 	if (!vmw_be)
@@ -430,7 +443,10 @@
 	vmw_be->dev_priv = vmw_priv_from_ttm(bo->bdev);
 	vmw_be->mob = NULL;
 
-	if (vmw_be->dev_priv->map_mode == vmw_dma_alloc_coherent)
+	if (external)
+		page_flags |= TTM_TT_FLAG_EXTERNAL | TTM_TT_FLAG_EXTERNAL_MAPPABLE;
+
+	if (vmw_be->dev_priv->map_mode == vmw_dma_alloc_coherent || external)
 		ret = ttm_sg_tt_init(&vmw_be->dma_ttm, bo, page_flags,
 				     ttm_cached);
 	else
@@ -588,15 +604,14 @@
 		.busy_domain = domain,
 		.bo_type = ttm_bo_type_kernel,
 		.size = bo_size,
-		.pin = true
+		.pin = true,
+		.keep_resv = true,
 	};
 
 	ret = vmw_bo_create(dev_priv, &bo_params, &vbo);
 	if (unlikely(ret != 0))
 		return ret;
 
-	ret = ttm_bo_reserve(&vbo->tbo, false, true, NULL);
-	BUG_ON(ret != 0);
 	ret = vmw_ttm_populate(vbo->tbo.bdev, vbo->tbo.ttm, &ctx);
 	if (likely(ret == 0)) {
 		struct vmw_ttm_tt *vmw_tt =
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
@@ -32,9 +32,6 @@
 
 #include <linux/slab.h>
 
-
-#define VMWGFX_VALIDATION_MEM_GRAN (16*PAGE_SIZE)
-
 /**
  * struct vmw_validation_bo_node - Buffer object validation metadata.
  * @base: Metadata used for TTM reservation- and validation.
@@ -112,20 +109,10 @@
 		return NULL;
 
 	if (ctx->mem_size_left < size) {
-		struct page *page;
-
-		if (ctx->vm && ctx->vm_size_left < PAGE_SIZE) {
-			ctx->vm_size_left += VMWGFX_VALIDATION_MEM_GRAN;
-			ctx->total_mem += VMWGFX_VALIDATION_MEM_GRAN;
-		}
-
-		page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+		struct page *page = alloc_page(GFP_KERNEL | __GFP_ZERO);
 		if (!page)
 			return NULL;
 
-		if (ctx->vm)
-			ctx->vm_size_left -= PAGE_SIZE;
-
 		list_add_tail(&page->lru, &ctx->page_list);
 		ctx->page_address = page_address(page);
 		ctx->mem_size_left = PAGE_SIZE;
@@ -155,10 +142,6 @@
 	}
 
 	ctx->mem_size_left = 0;
-	if (ctx->vm && ctx->total_mem) {
-		ctx->total_mem = 0;
-		ctx->vm_size_left = 0;
-	}
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
@@ -52,10 +52,6 @@
  * buffer objects
  * @mem_size_left: Free memory left in the last page in @page_list
  * @page_address: Kernel virtual address of the last page in @page_list
- * @vm: A pointer to the memory reservation interface or NULL if no
- * memory reservation is needed.
- * @vm_size_left: Amount of reserved memory that so far has not been allocated.
- * @total_mem: Amount of reserved memory.
  */
 struct vmw_validation_context {
 	struct vmw_sw_context *sw_context;
@@ -68,9 +64,6 @@
 	unsigned int merge_dups;
 	unsigned int mem_size_left;
 	u8 *page_address;
-	struct vmw_validation_mem *vm;
-	size_t vm_size_left;
-	size_t total_mem;
 };
 
 struct vmw_bo;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/Makefile
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/Makefile
@@ -35,27 +35,15 @@
 subdir-ccflags-y += -I$(obj) -I$(srctree)/$(src)
 
 # generated sources
-hostprogs := xe_gen_wa_oob
 
+hostprogs := xe_gen_wa_oob
 generated_oob := $(obj)/generated/xe_wa_oob.c $(obj)/generated/xe_wa_oob.h
-
 quiet_cmd_wa_oob = GEN     $(notdir $(generated_oob))
       cmd_wa_oob = mkdir -p $(@D); $^ $(generated_oob)
-
-$(generated_oob) &: $(obj)/xe_gen_wa_oob $(srctree)/$(src)/xe_wa_oob.rules
+$(obj)/generated/%_wa_oob.c $(obj)/generated/%_wa_oob.h: $(obj)/xe_gen_wa_oob \
+		 $(srctree)/$(src)/xe_wa_oob.rules
 	$(call cmd,wa_oob)
 
-uses_generated_oob := \
-	$(obj)/xe_gsc.o \
-	$(obj)/xe_guc.o \
-	$(obj)/xe_migrate.o \
-	$(obj)/xe_ring_ops.o \
-	$(obj)/xe_vm.o \
-	$(obj)/xe_wa.o \
-	$(obj)/xe_ttm_stolen_mgr.o
-
-$(uses_generated_oob): $(generated_oob)
-
 # Please keep these build lists sorted!
 
 # core driver code
@@ -161,8 +149,8 @@
 	-Ddrm_i915_gem_object=xe_bo \
 	-Ddrm_i915_private=xe_device
 
-CFLAGS_i915-display/intel_fbdev.o = $(call cc-disable-warning, override-init)
-CFLAGS_i915-display/intel_display_device.o = $(call cc-disable-warning, override-init)
+CFLAGS_i915-display/intel_fbdev.o = -Wno-override-init
+CFLAGS_i915-display/intel_display_device.o = -Wno-override-init
 
 # Rule to build SOC code shared with i915
 $(obj)/i915-soc/%.o: $(srctree)/drivers/gpu/drm/i915/soc/%.c FORCE
@@ -302,3 +290,6 @@
 
 $(obj)/%.hdrtest: $(src)/%.h FORCE
 	$(call if_changed_dep,hdrtest)
+
+uses_generated_oob := $(addprefix $(obj)/, $(xe-y))
+$(uses_generated_oob): $(obj)/generated/xe_wa_oob.h
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h
@@ -84,7 +84,8 @@
 #define IS_ROCKETLAKE(dev_priv)	IS_PLATFORM(dev_priv, XE_ROCKETLAKE)
 #define IS_DG1(dev_priv)        IS_PLATFORM(dev_priv, XE_DG1)
 #define IS_ALDERLAKE_S(dev_priv) IS_PLATFORM(dev_priv, XE_ALDERLAKE_S)
-#define IS_ALDERLAKE_P(dev_priv) IS_PLATFORM(dev_priv, XE_ALDERLAKE_P)
+#define IS_ALDERLAKE_P(dev_priv) (IS_PLATFORM(dev_priv, XE_ALDERLAKE_P) || \
+				  IS_PLATFORM(dev_priv, XE_ALDERLAKE_N))
 #define IS_XEHPSDV(dev_priv) (dev_priv && 0)
 #define IS_DG2(dev_priv)	IS_PLATFORM(dev_priv, XE_DG2)
 #define IS_PONTEVECCHIO(dev_priv) IS_PLATFORM(dev_priv, XE_PVC)
@@ -108,7 +109,7 @@
 #define HAS_GMD_ID(xe) GRAPHICS_VERx100(xe) >= 1270
 
 /* Workarounds not handled yet */
-#define IS_DISPLAY_STEP(xe, first, last) ({u8 __step = (xe)->info.step.display; first <= __step && __step <= last; })
+#define IS_DISPLAY_STEP(xe, first, last) ({u8 __step = (xe)->info.step.display; first <= __step && __step < last; })
 #define IS_GRAPHICS_STEP(xe, first, last) ({u8 __step = (xe)->info.step.graphics; first <= __step && __step <= last; })
 
 #define IS_LP(xe) (0)
@@ -214,7 +215,6 @@
 	     intel_runtime_pm_put((rpm), (wf)), (wf) = 0)
 
 #define pdev_to_i915 pdev_to_xe_device
-#define RUNTIME_INFO(xe)		(&(xe)->info.i915_runtime)
 
 #define FORCEWAKE_ALL XE_FORCEWAKE_ALL
 #define HPD_STORM_DEFAULT_THRESHOLD 50
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/display/intel_fb_bo.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/display/intel_fb_bo.c
@@ -31,7 +31,7 @@
 
 	ret = ttm_bo_reserve(&bo->ttm, true, false, NULL);
 	if (ret)
-		return ret;
+		goto err;
 
 	if (!(bo->flags & XE_BO_SCANOUT_BIT)) {
 		/*
@@ -42,12 +42,16 @@
 		 */
 		if (XE_IOCTL_DBG(i915, !list_empty(&bo->ttm.base.gpuva.list))) {
 			ttm_bo_unreserve(&bo->ttm);
-			return -EINVAL;
+			ret = -EINVAL;
+			goto err;
 		}
 		bo->flags |= XE_BO_SCANOUT_BIT;
 	}
 	ttm_bo_unreserve(&bo->ttm);
+	return 0;
 
+err:
+	xe_bo_put(bo);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/regs/xe_engine_regs.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/regs/xe_engine_regs.h
@@ -44,9 +44,10 @@
 #define GSCCS_RING_BASE				0x11a000
 
 #define RING_TAIL(base)				XE_REG((base) + 0x30)
+#define   TAIL_ADDR				REG_GENMASK(20, 3)
 
 #define RING_HEAD(base)				XE_REG((base) + 0x34)
-#define   HEAD_ADDR				0x001FFFFC
+#define   HEAD_ADDR				REG_GENMASK(20, 2)
 
 #define RING_START(base)			XE_REG((base) + 0x38)
 
@@ -120,7 +121,7 @@
 #define RING_EXECLIST_STATUS_LO(base)		XE_REG((base) + 0x234)
 #define RING_EXECLIST_STATUS_HI(base)		XE_REG((base) + 0x234 + 4)
 
-#define RING_CONTEXT_CONTROL(base)		XE_REG((base) + 0x244)
+#define RING_CONTEXT_CONTROL(base)		XE_REG((base) + 0x244, XE_REG_OPTION_MASKED)
 #define	  CTX_CTRL_INHIBIT_SYN_CTX_SWITCH	REG_BIT(3)
 #define	  CTX_CTRL_ENGINE_CTX_RESTORE_INHIBIT	REG_BIT(0)
 
@@ -133,7 +134,6 @@
 #define   RING_VALID_MASK			0x00000001
 #define   RING_VALID				0x00000001
 #define   STOP_RING				REG_BIT(8)
-#define   TAIL_ADDR				0x001FFFF8
 
 #define RING_CTX_TIMESTAMP(base)		XE_REG((base) + 0x3a8)
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/regs/xe_gt_regs.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/regs/xe_gt_regs.h
@@ -78,6 +78,7 @@
 
 #define FF_MODE					XE_REG_MCR(0x6210)
 #define   DIS_TE_AUTOSTRIP			REG_BIT(31)
+#define   VS_HIT_MAX_VALUE_MASK			REG_GENMASK(25, 20)
 #define   DIS_MESH_PARTIAL_AUTOSTRIP		REG_BIT(16)
 #define   DIS_MESH_AUTOSTRIP			REG_BIT(15)
 
@@ -327,6 +328,7 @@
 
 #define HALF_SLICE_CHICKEN7				XE_REG_MCR(0xe194, XE_REG_OPTION_MASKED)
 #define   DG2_DISABLE_ROUND_ENABLE_ALLOW_FOR_SSLA	REG_BIT(15)
+#define   CLEAR_OPTIMIZATION_DISABLE			REG_BIT(6)
 
 #define CACHE_MODE_SS				XE_REG_MCR(0xe420, XE_REG_OPTION_MASKED)
 #define   DISABLE_ECC				REG_BIT(5)
@@ -392,7 +394,7 @@
  *   [4-6]     RSVD
  *   [7]       Disabled
  */
-#define CCS_MODE				XE_REG(0x14804)
+#define CCS_MODE				XE_REG(0x14804, XE_REG_OPTION_MASKED)
 #define   CCS_MODE_CSLICE_0_3_MASK		REG_GENMASK(11, 0) /* 3 bits per cslice */
 #define   CCS_MODE_CSLICE_MASK			0x7 /* CCS0-3 + rsvd */
 #define   CCS_MODE_CSLICE_WIDTH			ilog2(CCS_MODE_CSLICE_MASK + 1)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/tests/xe_dma_buf.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/tests/xe_dma_buf.c
@@ -12,6 +12,7 @@
 #include "tests/xe_pci_test.h"
 
 #include "xe_pci.h"
+#include "xe_pm.h"
 
 static bool p2p_enabled(struct dma_buf_test_params *params)
 {
@@ -259,6 +260,7 @@
 	const struct dma_buf_test_params *params;
 	struct kunit *test = xe_cur_kunit();
 
+	xe_pm_runtime_get(xe);
 	for (params = test_params; params->mem_mask; ++params) {
 		struct dma_buf_test_params p = *params;
 
@@ -266,6 +268,7 @@
 		test->priv = &p;
 		xe_test_dmabuf_import_same_driver(xe);
 	}
+	xe_pm_runtime_put(xe);
 
 	/* A non-zero return would halt iteration over driver devices */
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/tests/xe_migrate.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/tests/xe_migrate.c
@@ -114,21 +114,21 @@
 						   region |
 						   XE_BO_NEEDS_CPU_ACCESS);
 	if (IS_ERR(remote)) {
-		KUNIT_FAIL(test, "Failed to allocate remote bo for %s: %li\n",
-			   str, PTR_ERR(remote));
+		KUNIT_FAIL(test, "Failed to allocate remote bo for %s: %pe\n",
+			   str, remote);
 		return;
 	}
 
 	err = xe_bo_validate(remote, NULL, false);
 	if (err) {
-		KUNIT_FAIL(test, "Failed to validate system bo for %s: %li\n",
+		KUNIT_FAIL(test, "Failed to validate system bo for %s: %i\n",
 			   str, err);
 		goto out_unlock;
 	}
 
 	err = xe_bo_vmap(remote);
 	if (err) {
-		KUNIT_FAIL(test, "Failed to vmap system bo for %s: %li\n",
+		KUNIT_FAIL(test, "Failed to vmap system bo for %s: %i\n",
 			   str, err);
 		goto out_unlock;
 	}
@@ -303,8 +303,8 @@
 				    XE_BO_CREATE_VRAM_IF_DGFX(tile) |
 				    XE_BO_CREATE_PINNED_BIT);
 	if (IS_ERR(tiny)) {
-		KUNIT_FAIL(test, "Failed to allocate fake pt: %li\n",
-			   PTR_ERR(pt));
+		KUNIT_FAIL(test, "Failed to allocate tiny fake pt: %li\n",
+			   PTR_ERR(tiny));
 		goto free_pt;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_bb.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_bb.c
@@ -65,7 +65,8 @@
 {
 	u32 size = drm_suballoc_size(bb->bo);
 
-	bb->cs[bb->len++] = MI_BATCH_BUFFER_END;
+	if (bb->len == 0 || bb->cs[bb->len - 1] != MI_BATCH_BUFFER_END)
+		bb->cs[bb->len++] = MI_BATCH_BUFFER_END;
 
 	xe_gt_assert(q->gt, bb->len * 4 + bb_prefetch(q->gt) <= size);
 
@@ -96,7 +97,8 @@
 {
 	u64 addr = xe_sa_bo_gpu_addr(bb->bo);
 
-	xe_gt_assert(q->gt, !(q->vm && q->vm->flags & XE_VM_FLAG_MIGRATION));
+	xe_gt_assert(q->gt, !xe_sched_job_is_migration(q));
+	xe_gt_assert(q->gt, q->width == 1);
 	return __xe_bb_create_job(q, bb, &addr);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_bo.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_bo.c
@@ -140,9 +140,6 @@
 			.mem_type = XE_PL_TT,
 		};
 		*c += 1;
-
-		if (bo->props.preferred_mem_type == XE_BO_PROPS_INVALID)
-			bo->props.preferred_mem_type = XE_PL_TT;
 	}
 }
 
@@ -177,25 +174,15 @@
 	}
 	places[*c] = place;
 	*c += 1;
-
-	if (bo->props.preferred_mem_type == XE_BO_PROPS_INVALID)
-		bo->props.preferred_mem_type = mem_type;
 }
 
 static void try_add_vram(struct xe_device *xe, struct xe_bo *bo,
 			 u32 bo_flags, u32 *c)
 {
-	if (bo->props.preferred_gt == XE_GT1) {
-		if (bo_flags & XE_BO_CREATE_VRAM1_BIT)
-			add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM1, c);
-		if (bo_flags & XE_BO_CREATE_VRAM0_BIT)
-			add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM0, c);
-	} else {
-		if (bo_flags & XE_BO_CREATE_VRAM0_BIT)
-			add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM0, c);
-		if (bo_flags & XE_BO_CREATE_VRAM1_BIT)
-			add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM1, c);
-	}
+	if (bo_flags & XE_BO_CREATE_VRAM0_BIT)
+		add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM0, c);
+	if (bo_flags & XE_BO_CREATE_VRAM1_BIT)
+		add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM1, c);
 }
 
 static void try_add_stolen(struct xe_device *xe, struct xe_bo *bo,
@@ -219,17 +206,8 @@
 {
 	u32 c = 0;
 
-	bo->props.preferred_mem_type = XE_BO_PROPS_INVALID;
-
-	/* The order of placements should indicate preferred location */
-
-	if (bo->props.preferred_mem_class == DRM_XE_MEM_REGION_CLASS_SYSMEM) {
-		try_add_system(xe, bo, bo_flags, &c);
-		try_add_vram(xe, bo, bo_flags, &c);
-	} else {
-		try_add_vram(xe, bo, bo_flags, &c);
-		try_add_system(xe, bo, bo_flags, &c);
-	}
+	try_add_vram(xe, bo, bo_flags, &c);
+	try_add_system(xe, bo, bo_flags, &c);
 	try_add_stolen(xe, bo, bo_flags, &c);
 
 	if (!c)
@@ -337,7 +315,7 @@
 	struct xe_device *xe = xe_bo_device(bo);
 	struct xe_ttm_tt *tt;
 	unsigned long extra_pages;
-	enum ttm_caching caching;
+	enum ttm_caching caching = ttm_cached;
 	int err;
 
 	tt = kzalloc(sizeof(*tt), GFP_KERNEL);
@@ -351,26 +329,35 @@
 		extra_pages = DIV_ROUND_UP(xe_device_ccs_bytes(xe, bo->size),
 					   PAGE_SIZE);
 
-	switch (bo->cpu_caching) {
-	case DRM_XE_GEM_CPU_CACHING_WC:
-		caching = ttm_write_combined;
-		break;
-	default:
-		caching = ttm_cached;
-		break;
-	}
-
-	WARN_ON((bo->flags & XE_BO_CREATE_USER_BIT) && !bo->cpu_caching);
-
 	/*
-	 * Display scanout is always non-coherent with the CPU cache.
-	 *
-	 * For Xe_LPG and beyond, PPGTT PTE lookups are also non-coherent and
-	 * require a CPU:WC mapping.
+	 * DGFX system memory is always WB / ttm_cached, since
+	 * other caching modes are only supported on x86. DGFX
+	 * GPU system memory accesses are always coherent with the
+	 * CPU.
 	 */
-	if ((!bo->cpu_caching && bo->flags & XE_BO_SCANOUT_BIT) ||
-	    (xe->info.graphics_verx100 >= 1270 && bo->flags & XE_BO_PAGETABLE))
-		caching = ttm_write_combined;
+	if (!IS_DGFX(xe)) {
+		switch (bo->cpu_caching) {
+		case DRM_XE_GEM_CPU_CACHING_WC:
+			caching = ttm_write_combined;
+			break;
+		default:
+			caching = ttm_cached;
+			break;
+		}
+
+		WARN_ON((bo->flags & XE_BO_CREATE_USER_BIT) && !bo->cpu_caching);
+
+		/*
+		 * Display scanout is always non-coherent with the CPU cache.
+		 *
+		 * For Xe_LPG and beyond, PPGTT PTE lookups are also
+		 * non-coherent and require a CPU:WC mapping.
+		 */
+		if ((!bo->cpu_caching && bo->flags & XE_BO_SCANOUT_BIT) ||
+		    (xe->info.graphics_verx100 >= 1270 &&
+		     bo->flags & XE_BO_PAGETABLE))
+			caching = ttm_write_combined;
+	}
 
 	err = ttm_tt_init(&tt->ttm, &bo->ttm, page_flags, caching, extra_pages);
 	if (err) {
@@ -650,8 +637,8 @@
 	tt_has_data = ttm && (ttm_tt_is_populated(ttm) ||
 			      (ttm->page_flags & TTM_TT_FLAG_SWAPPED));
 
-	move_lacks_source = handle_system_ccs ? (!bo->ccs_cleared)  :
-						(!mem_type_is_vram(old_mem_type) && !tt_has_data);
+	move_lacks_source = !old_mem || (handle_system_ccs ? (!bo->ccs_cleared) :
+					 (!mem_type_is_vram(old_mem_type) && !tt_has_data));
 
 	needs_clear = (ttm && ttm->page_flags & TTM_TT_FLAG_ZERO_ALLOC) ||
 		(!ttm && ttm_bo->type == ttm_bo_type_device);
@@ -831,8 +818,8 @@
 	if (WARN_ON(!xe_bo_is_pinned(bo)))
 		return -EINVAL;
 
-	if (WARN_ON(!xe_bo_is_vram(bo)))
-		return -EINVAL;
+	if (!xe_bo_is_vram(bo))
+		return 0;
 
 	ret = ttm_bo_mem_space(&bo->ttm, &placement, &new_mem, &ctx);
 	if (ret)
@@ -886,6 +873,7 @@
 		.interruptible = false,
 	};
 	struct ttm_resource *new_mem;
+	struct ttm_place *place = &bo->placements[0];
 	int ret;
 
 	xe_bo_assert_held(bo);
@@ -896,9 +884,15 @@
 	if (WARN_ON(!xe_bo_is_pinned(bo)))
 		return -EINVAL;
 
-	if (WARN_ON(xe_bo_is_vram(bo) || !bo->ttm.ttm))
+	if (WARN_ON(xe_bo_is_vram(bo)))
+		return -EINVAL;
+
+	if (WARN_ON(!bo->ttm.ttm && !xe_bo_is_stolen(bo)))
 		return -EINVAL;
 
+	if (!mem_type_is_vram(place->mem_type))
+		return 0;
+
 	ret = ttm_bo_mem_space(&bo->ttm, &bo->placement, &new_mem, &ctx);
 	if (ret)
 		return ret;
@@ -1106,19 +1100,12 @@
 	}
 }
 
-static bool should_migrate_to_system(struct xe_bo *bo)
-{
-	struct xe_device *xe = xe_bo_device(bo);
-
-	return xe_device_in_fault_mode(xe) && bo->props.cpu_atomic;
-}
-
 static vm_fault_t xe_gem_fault(struct vm_fault *vmf)
 {
 	struct ttm_buffer_object *tbo = vmf->vma->vm_private_data;
 	struct drm_device *ddev = tbo->base.dev;
 	vm_fault_t ret;
-	int idx, r = 0;
+	int idx;
 
 	ret = ttm_bo_vm_reserve(tbo, vmf);
 	if (ret)
@@ -1129,17 +1116,8 @@
 
 		trace_xe_bo_cpu_fault(bo);
 
-		if (should_migrate_to_system(bo)) {
-			r = xe_bo_migrate(bo, XE_PL_TT);
-			if (r == -EBUSY || r == -ERESTARTSYS || r == -EINTR)
-				ret = VM_FAULT_NOPAGE;
-			else if (r)
-				ret = VM_FAULT_SIGBUS;
-		}
-		if (!ret)
-			ret = ttm_bo_vm_fault_reserved(vmf,
-						       vmf->vma->vm_page_prot,
-						       TTM_BO_VM_NUM_PREFAULT);
+		ret = ttm_bo_vm_fault_reserved(vmf, vmf->vma->vm_page_prot,
+					       TTM_BO_VM_NUM_PREFAULT);
 		drm_dev_exit(idx);
 	} else {
 		ret = ttm_bo_vm_dummy_page(vmf, vmf->vma->vm_page_prot);
@@ -1253,9 +1231,6 @@
 	bo->flags = flags;
 	bo->cpu_caching = cpu_caching;
 	bo->ttm.base.funcs = &xe_gem_object_funcs;
-	bo->props.preferred_mem_class = XE_BO_PROPS_INVALID;
-	bo->props.preferred_gt = XE_BO_PROPS_INVALID;
-	bo->props.preferred_mem_type = XE_BO_PROPS_INVALID;
 	bo->ttm.priority = XE_BO_PRIORITY_NORMAL;
 	INIT_LIST_HEAD(&bo->pinned_link);
 #ifdef CONFIG_PROC_FS
@@ -1540,7 +1515,7 @@
 	return bo;
 }
 
-static void __xe_bo_unpin_map_no_vm(struct drm_device *drm, void *arg)
+static void __xe_bo_unpin_map_no_vm(void *arg)
 {
 	xe_bo_unpin_map_no_vm(arg);
 }
@@ -1555,7 +1530,7 @@
 	if (IS_ERR(bo))
 		return bo;
 
-	ret = drmm_add_action_or_reset(&xe->drm, __xe_bo_unpin_map_no_vm, bo);
+	ret = devm_add_action_or_reset(xe->drm.dev, __xe_bo_unpin_map_no_vm, bo);
 	if (ret)
 		return ERR_PTR(ret);
 
@@ -1633,6 +1608,7 @@
 
 int xe_bo_pin(struct xe_bo *bo)
 {
+	struct ttm_place *place = &bo->placements[0];
 	struct xe_device *xe = xe_bo_device(bo);
 	int err;
 
@@ -1663,21 +1639,21 @@
 	 */
 	if (IS_DGFX(xe) && !(IS_ENABLED(CONFIG_DRM_XE_DEBUG) &&
 	    bo->flags & XE_BO_INTERNAL_TEST)) {
-		struct ttm_place *place = &(bo->placements[0]);
-
 		if (mem_type_is_vram(place->mem_type)) {
 			xe_assert(xe, place->flags & TTM_PL_FLAG_CONTIGUOUS);
 
 			place->fpfn = (xe_bo_addr(bo, 0, PAGE_SIZE) -
 				       vram_region_gpu_offset(bo->ttm.resource)) >> PAGE_SHIFT;
 			place->lpfn = place->fpfn + (bo->size >> PAGE_SHIFT);
-
-			spin_lock(&xe->pinned.lock);
-			list_add_tail(&bo->pinned_link, &xe->pinned.kernel_bo_present);
-			spin_unlock(&xe->pinned.lock);
 		}
 	}
 
+	if (mem_type_is_vram(place->mem_type) || bo->flags & XE_BO_CREATE_GGTT_BIT) {
+		spin_lock(&xe->pinned.lock);
+		list_add_tail(&bo->pinned_link, &xe->pinned.kernel_bo_present);
+		spin_unlock(&xe->pinned.lock);
+	}
+
 	ttm_bo_pin(&bo->ttm);
 
 	/*
@@ -1724,24 +1700,19 @@
 
 void xe_bo_unpin(struct xe_bo *bo)
 {
+	struct ttm_place *place = &bo->placements[0];
 	struct xe_device *xe = xe_bo_device(bo);
 
 	xe_assert(xe, !bo->ttm.base.import_attach);
 	xe_assert(xe, xe_bo_is_pinned(bo));
 
-	if (IS_DGFX(xe) && !(IS_ENABLED(CONFIG_DRM_XE_DEBUG) &&
-	    bo->flags & XE_BO_INTERNAL_TEST)) {
-		struct ttm_place *place = &(bo->placements[0]);
+	if (mem_type_is_vram(place->mem_type) || bo->flags & XE_BO_CREATE_GGTT_BIT) {
+		xe_assert(xe, !list_empty(&bo->pinned_link));
 
-		if (mem_type_is_vram(place->mem_type)) {
-			xe_assert(xe, !list_empty(&bo->pinned_link));
-
-			spin_lock(&xe->pinned.lock);
-			list_del_init(&bo->pinned_link);
-			spin_unlock(&xe->pinned.lock);
-		}
+		spin_lock(&xe->pinned.lock);
+		list_del_init(&bo->pinned_link);
+		spin_unlock(&xe->pinned.lock);
 	}
-
 	ttm_bo_unpin(&bo->ttm);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_bo_evict.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_bo_evict.c
@@ -34,14 +34,22 @@
 	u8 id;
 	int ret;
 
-	if (!IS_DGFX(xe))
-		return 0;
-
 	/* User memory */
-	for (mem_type = XE_PL_VRAM0; mem_type <= XE_PL_VRAM1; ++mem_type) {
+	for (mem_type = XE_PL_TT; mem_type <= XE_PL_VRAM1; ++mem_type) {
 		struct ttm_resource_manager *man =
 			ttm_manager_type(bdev, mem_type);
 
+		/*
+		 * On igpu platforms with flat CCS we need to ensure we save and restore any CCS
+		 * state since this state lives inside graphics stolen memory which doesn't survive
+		 * hibernation.
+		 *
+		 * This can be further improved by only evicting objects that we know have actually
+		 * used a compression enabled PAT index.
+		 */
+		if (mem_type == XE_PL_TT && (IS_DGFX(xe) || !xe_device_has_flat_ccs(xe)))
+			continue;
+
 		if (man) {
 			ret = ttm_resource_manager_evict_all(bdev, man);
 			if (ret)
@@ -125,9 +133,6 @@
 	struct xe_bo *bo;
 	int ret;
 
-	if (!IS_DGFX(xe))
-		return 0;
-
 	spin_lock(&xe->pinned.lock);
 	for (;;) {
 		bo = list_first_entry_or_null(&xe->pinned.evicted,
@@ -159,7 +164,6 @@
 		 * should setup the iosys map.
 		 */
 		xe_assert(xe, !iosys_map_is_null(&bo->vmap));
-		xe_assert(xe, xe_bo_is_vram(bo));
 
 		xe_bo_put(bo);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_bo_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_bo_types.h
@@ -56,25 +56,6 @@
 	 */
 	struct list_head client_link;
 #endif
-	/** @props: BO user controlled properties */
-	struct {
-		/** @preferred_mem: preferred memory class for this BO */
-		s16 preferred_mem_class;
-		/** @prefered_gt: preferred GT for this BO */
-		s16 preferred_gt;
-		/** @preferred_mem_type: preferred memory type */
-		s32 preferred_mem_type;
-		/**
-		 * @cpu_atomic: the CPU expects to do atomics operations to
-		 * this BO
-		 */
-		bool cpu_atomic;
-		/**
-		 * @device_atomic: the device expects to do atomics operations
-		 * to this BO
-		 */
-		bool device_atomic;
-	} props;
 	/** @freed: List node for delayed put. */
 	struct llist_node freed;
 	/** @created: Whether the bo has passed initial creation */
@@ -85,7 +66,8 @@
 
 	/**
 	 * @cpu_caching: CPU caching mode. Currently only used for userspace
-	 * objects.
+	 * objects. Exceptions are system memory on DGFX, which is always
+	 * WB.
 	 */
 	u16 cpu_caching;
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_devcoredump.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_devcoredump.c
@@ -62,16 +62,19 @@
 				   size_t count, void *data, size_t datalen)
 {
 	struct xe_devcoredump *coredump = data;
+	struct xe_device *xe;
 	struct xe_devcoredump_snapshot *ss;
 	struct drm_printer p;
 	struct drm_print_iterator iter;
 	struct timespec64 ts;
 	int i;
 
-	/* Our device is gone already... */
-	if (!data || !coredump_to_xe(coredump))
+	if (!coredump)
 		return -ENODEV;
 
+	xe = coredump_to_xe(coredump);
+	ss = &coredump->snapshot;
+
 	iter.data = buffer;
 	iter.offset = 0;
 	iter.start = offset;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_device.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_device.c
@@ -190,12 +190,18 @@
 {
 	struct xe_device *xe = to_xe_device(dev);
 
+	if (xe->preempt_fence_wq)
+		destroy_workqueue(xe->preempt_fence_wq);
+
 	if (xe->ordered_wq)
 		destroy_workqueue(xe->ordered_wq);
 
 	if (xe->unordered_wq)
 		destroy_workqueue(xe->unordered_wq);
 
+	if (xe->destroy_wq)
+		destroy_workqueue(xe->destroy_wq);
+
 	ttm_device_fini(&xe->ttm);
 }
 
@@ -255,9 +261,16 @@
 	INIT_LIST_HEAD(&xe->pinned.external_vram);
 	INIT_LIST_HEAD(&xe->pinned.evicted);
 
+	xe->preempt_fence_wq = alloc_ordered_workqueue("xe-preempt-fence-wq", 0);
 	xe->ordered_wq = alloc_ordered_workqueue("xe-ordered-wq", 0);
 	xe->unordered_wq = alloc_workqueue("xe-unordered-wq", 0, 0);
-	if (!xe->ordered_wq || !xe->unordered_wq) {
+	xe->destroy_wq = alloc_workqueue("xe-destroy-wq", 0, 0);
+	if (!xe->ordered_wq || !xe->unordered_wq ||
+	    !xe->preempt_fence_wq || !xe->destroy_wq) {
+		/*
+		 * Cleanup done in xe_device_destroy via
+		 * drmm_add_action_or_reset register above
+		 */
 		drm_err(&xe->drm, "Failed to allocate xe workqueues\n");
 		err = -ENOMEM;
 		goto err;
@@ -377,8 +390,14 @@
 	return err;
 }
 
-/*
- * Initialize MMIO resources that don't require any knowledge about tile count.
+/**
+ * xe_device_probe_early: Device early probe
+ * @xe: xe device instance
+ *
+ * Initialize MMIO resources that don't require any
+ * knowledge about tile count. Also initialize pcode
+ *
+ * Return: 0 on success, error code on failure
  */
 int xe_device_probe_early(struct xe_device *xe)
 {
@@ -392,6 +411,10 @@
 	if (err)
 		return err;
 
+	err = xe_pcode_probe_early(xe);
+	if (err)
+		return err;
+
 	return 0;
 }
 
@@ -437,7 +460,9 @@
 	if (err)
 		return err;
 
-	xe_mmio_probe_tiles(xe);
+	err = xe_mmio_probe_tiles(xe);
+	if (err)
+		return err;
 
 	xe_ttm_sys_mgr_init(xe);
 
@@ -454,11 +479,8 @@
 	if (err)
 		return err;
 
-	for_each_gt(gt, xe, id) {
-		err = xe_pcode_probe(gt);
-		if (err)
-			return err;
-	}
+	for_each_gt(gt, xe, id)
+		xe_pcode_init(gt);
 
 	err = xe_display_init_noirq(xe);
 	if (err)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_device.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_device.h
@@ -58,7 +58,7 @@
 
 static inline struct xe_gt *xe_tile_get_gt(struct xe_tile *tile, u8 gt_id)
 {
-	if (drm_WARN_ON(&tile_to_xe(tile)->drm, gt_id > XE_MAX_GT_PER_TILE))
+	if (drm_WARN_ON(&tile_to_xe(tile)->drm, gt_id >= XE_MAX_GT_PER_TILE))
 		gt_id = 0;
 
 	return gt_id ? tile->media_gt : tile->primary_gt;
@@ -79,7 +79,7 @@
 	if (MEDIA_VER(xe) >= 13) {
 		gt = xe_tile_get_gt(root_tile, gt_id);
 	} else {
-		if (drm_WARN_ON(&xe->drm, gt_id > XE_MAX_TILES_PER_DEVICE))
+		if (drm_WARN_ON(&xe->drm, gt_id >= XE_MAX_TILES_PER_DEVICE))
 			gt_id = 0;
 
 		gt = xe->tiles[gt_id].primary_gt;
@@ -166,4 +166,18 @@
 
 u32 xe_device_ccs_bytes(struct xe_device *xe, u64 size);
 
+/*
+ * Occasionally it is seen that the G2H worker starts running after a delay of more than
+ * a second even after being queued and activated by the Linux workqueue subsystem. This
+ * leads to G2H timeout error. The root cause of issue lies with scheduling latency of
+ * Lunarlake Hybrid CPU. Issue disappears if we disable Lunarlake atom cores from BIOS
+ * and this is beyond xe kmd.
+ *
+ * TODO: Drop this change once workqueue scheduling delay issue is fixed on LNL Hybrid CPU.
+ */
+#define LNL_FLUSH_WORKQUEUE(wq__) \
+	flush_workqueue(wq__)
+#define LNL_FLUSH_WORK(wrk__) \
+	flush_work(wrk__)
+
 #endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_device_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_device_types.h
@@ -276,12 +276,6 @@
 		u8 has_heci_gscfi:1;
 		/** @skip_guc_pc: Skip GuC based PM feature init */
 		u8 skip_guc_pc:1;
-
-#if IS_ENABLED(CONFIG_DRM_XE_DISPLAY)
-		struct {
-			u32 rawclk_freq;
-		} i915_runtime;
-#endif
 	} info;
 
 	/** @irq: device interrupt state */
@@ -356,12 +350,18 @@
 	/** @ufence_wq: user fence wait queue */
 	wait_queue_head_t ufence_wq;
 
+	/** @preempt_fence_wq: used to serialize preempt fences */
+	struct workqueue_struct *preempt_fence_wq;
+
 	/** @ordered_wq: used to serialize compute mode resume */
 	struct workqueue_struct *ordered_wq;
 
 	/** @unordered_wq: used to serialize unordered work, mostly display */
 	struct workqueue_struct *unordered_wq;
 
+	/** @destroy_wq: used to serialize user destroy work, like queue */
+	struct workqueue_struct *destroy_wq;
+
 	/** @tiles: device tiles */
 	struct xe_tile tiles[XE_MAX_TILES_PER_DEVICE];
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_display.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_display.c
@@ -108,11 +108,6 @@
 	xe->display.hotplug.dp_wq = alloc_ordered_workqueue("xe-dp", 0);
 
 	drmm_mutex_init(&xe->drm, &xe->sb_lock);
-	drmm_mutex_init(&xe->drm, &xe->display.backlight.lock);
-	drmm_mutex_init(&xe->drm, &xe->display.audio.mutex);
-	drmm_mutex_init(&xe->drm, &xe->display.wm.wm_mutex);
-	drmm_mutex_init(&xe->drm, &xe->display.pps.mutex);
-	drmm_mutex_init(&xe->drm, &xe->display.hdcp.hdcp_mutex);
 	xe->enabled_irq_mask = ~0;
 
 	err = drmm_add_action_or_reset(&xe->drm, display_destroy, NULL);
@@ -154,7 +149,7 @@
 		return;
 
 	intel_display_driver_remove_noirq(xe);
-	intel_power_domains_driver_remove(xe);
+	intel_opregion_cleanup(xe);
 }
 
 int xe_display_init_noirq(struct xe_device *xe)
@@ -180,8 +175,10 @@
 	intel_display_device_info_runtime_init(xe);
 
 	err = intel_display_driver_probe_noirq(xe);
-	if (err)
+	if (err) {
+		intel_opregion_cleanup(xe);
 		return err;
+	}
 
 	return drmm_add_action_or_reset(&xe->drm, xe_display_fini_noirq, NULL);
 }
@@ -322,7 +319,28 @@
 	return false;
 }
 
-void xe_display_pm_suspend(struct xe_device *xe)
+static void xe_display_flush_cleanup_work(struct xe_device *xe)
+{
+	struct intel_crtc *crtc;
+
+	for_each_intel_crtc(&xe->drm, crtc) {
+		struct drm_crtc_commit *commit;
+
+		spin_lock(&crtc->base.commit_lock);
+		commit = list_first_entry_or_null(&crtc->base.commit_list,
+						  struct drm_crtc_commit, commit_entry);
+		if (commit)
+			drm_crtc_commit_get(commit);
+		spin_unlock(&crtc->base.commit_lock);
+
+		if (commit) {
+			wait_for_completion(&commit->cleanup_done);
+			drm_crtc_commit_put(commit);
+		}
+	}
+}
+
+void xe_display_pm_suspend(struct xe_device *xe, bool runtime)
 {
 	bool s2idle = suspend_to_idle();
 	if (!xe->info.enable_display)
@@ -336,7 +354,10 @@
 	if (has_display(xe))
 		drm_kms_helper_poll_disable(&xe->drm);
 
-	intel_display_driver_suspend(xe);
+	if (!runtime)
+		intel_display_driver_suspend(xe);
+
+	xe_display_flush_cleanup_work(xe);
 
 	intel_dp_mst_suspend(xe);
 
@@ -372,7 +393,7 @@
 	intel_power_domains_resume(xe);
 }
 
-void xe_display_pm_resume(struct xe_device *xe)
+void xe_display_pm_resume(struct xe_device *xe, bool runtime)
 {
 	if (!xe->info.enable_display)
 		return;
@@ -387,7 +408,8 @@
 
 	/* MST sideband requires HPD interrupts enabled */
 	intel_dp_mst_resume(xe);
-	intel_display_driver_resume(xe);
+	if (!runtime)
+		intel_display_driver_resume(xe);
 
 	intel_hpd_poll_disable(xe);
 	if (has_display(xe))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_display.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_display.h
@@ -34,10 +34,10 @@
 void xe_display_irq_reset(struct xe_device *xe);
 void xe_display_irq_postinstall(struct xe_device *xe, struct xe_gt *gt);
 
-void xe_display_pm_suspend(struct xe_device *xe);
+void xe_display_pm_suspend(struct xe_device *xe, bool runtime);
 void xe_display_pm_suspend_late(struct xe_device *xe);
 void xe_display_pm_resume_early(struct xe_device *xe);
-void xe_display_pm_resume(struct xe_device *xe);
+void xe_display_pm_resume(struct xe_device *xe, bool runtime);
 
 #else
 
@@ -63,10 +63,10 @@
 static inline void xe_display_irq_reset(struct xe_device *xe) {}
 static inline void xe_display_irq_postinstall(struct xe_device *xe, struct xe_gt *gt) {}
 
-static inline void xe_display_pm_suspend(struct xe_device *xe) {}
+static inline void xe_display_pm_suspend(struct xe_device *xe, bool runtime) {}
 static inline void xe_display_pm_suspend_late(struct xe_device *xe) {}
 static inline void xe_display_pm_resume_early(struct xe_device *xe) {}
-static inline void xe_display_pm_resume(struct xe_device *xe) {}
+static inline void xe_display_pm_resume(struct xe_device *xe, bool runtime) {}
 
 #endif /* CONFIG_DRM_XE_DISPLAY */
 #endif /* _XE_DISPLAY_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_drm_client.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_drm_client.c
@@ -9,6 +9,7 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 
+#include "xe_assert.h"
 #include "xe_bo.h"
 #include "xe_bo_types.h"
 #include "xe_device_types.h"
@@ -78,7 +79,7 @@
 
 	spin_lock(&client->bos_lock);
 	bo->client = xe_drm_client_get(client);
-	list_add_tail_rcu(&bo->client_link, &client->bos_list);
+	list_add_tail(&bo->client_link, &client->bos_list);
 	spin_unlock(&client->bos_lock);
 }
 
@@ -93,10 +94,13 @@
  */
 void xe_drm_client_remove_bo(struct xe_bo *bo)
 {
+	struct xe_device *xe = ttm_to_xe_device(bo->ttm.bdev);
 	struct xe_drm_client *client = bo->client;
 
+	xe_assert(xe, !kref_read(&bo->ttm.base.refcount));
+
 	spin_lock(&client->bos_lock);
-	list_del_rcu(&bo->client_link);
+	list_del_init(&bo->client_link);
 	spin_unlock(&client->bos_lock);
 
 	xe_drm_client_put(client);
@@ -108,6 +112,8 @@
 	u64 sz = bo->size;
 	u32 mem_type;
 
+	xe_bo_assert_held(bo);
+
 	if (bo->placement.placement)
 		mem_type = bo->placement.placement->mem_type;
 	else
@@ -138,6 +144,7 @@
 	struct xe_drm_client *client;
 	struct drm_gem_object *obj;
 	struct xe_bo *bo;
+	LLIST_HEAD(deferred);
 	unsigned int id;
 	u32 mem_type;
 
@@ -148,20 +155,50 @@
 	idr_for_each_entry(&file->object_idr, obj, id) {
 		struct xe_bo *bo = gem_to_xe_bo(obj);
 
-		bo_meminfo(bo, stats);
+		if (dma_resv_trylock(bo->ttm.base.resv)) {
+			bo_meminfo(bo, stats);
+			xe_bo_unlock(bo);
+		} else {
+			xe_bo_get(bo);
+			spin_unlock(&file->table_lock);
+
+			xe_bo_lock(bo, false);
+			bo_meminfo(bo, stats);
+			xe_bo_unlock(bo);
+
+			xe_bo_put(bo);
+			spin_lock(&file->table_lock);
+		}
 	}
 	spin_unlock(&file->table_lock);
 
 	/* Internal objects. */
 	spin_lock(&client->bos_lock);
-	list_for_each_entry_rcu(bo, &client->bos_list, client_link) {
+	list_for_each_entry(bo, &client->bos_list, client_link) {
 		if (!bo || !kref_get_unless_zero(&bo->ttm.base.refcount))
 			continue;
-		bo_meminfo(bo, stats);
-		xe_bo_put(bo);
+
+		if (dma_resv_trylock(bo->ttm.base.resv)) {
+			bo_meminfo(bo, stats);
+			xe_bo_unlock(bo);
+		} else {
+			spin_unlock(&client->bos_lock);
+
+			xe_bo_lock(bo, false);
+			bo_meminfo(bo, stats);
+			xe_bo_unlock(bo);
+
+			spin_lock(&client->bos_lock);
+			/* The bo ref will prevent this bo from being removed from the list */
+			xe_assert(xef->xe, !list_empty(&bo->client_link));
+		}
+
+		xe_bo_put_deferred(bo, &deferred);
 	}
 	spin_unlock(&client->bos_lock);
 
+	xe_bo_put_commit(&deferred);
+
 	for (mem_type = XE_PL_SYSTEM; mem_type < TTM_NUM_MEM_TYPES; ++mem_type) {
 		if (!xe_mem_type_to_name[mem_type])
 			continue;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_exec.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_exec.c
@@ -40,11 +40,6 @@
  * user knows an exec writes to a BO and reads from the BO in the next exec, it
  * is the user's responsibility to pass in / out fence between the two execs).
  *
- * Implicit dependencies for external BOs are handled by using the dma-buf
- * implicit dependency uAPI (TODO: add link). To make this works each exec must
- * install the job's fence into the DMA_RESV_USAGE_WRITE slot of every external
- * BO mapped in the VM.
- *
  * We do not allow a user to trigger a bind at exec time rather we have a VM
  * bind IOCTL which uses the same in / out fence interface as exec. In that
  * sense, a VM bind is basically the same operation as an exec from the user
@@ -58,8 +53,8 @@
  * behind any pending kernel operations on any external BOs in VM or any BOs
  * private to the VM. This is accomplished by the rebinds waiting on BOs
  * DMA_RESV_USAGE_KERNEL slot (kernel ops) and kernel ops waiting on all BOs
- * slots (inflight execs are in the DMA_RESV_USAGE_BOOKING for private BOs and
- * in DMA_RESV_USAGE_WRITE for external BOs).
+ * slots (inflight execs are in the DMA_RESV_USAGE_BOOKKEEP for private BOs and
+ * for external BOs).
  *
  * Rebinds / dma-resv usage applies to non-compute mode VMs only as for compute
  * mode VMs we use preempt fences and a rebind worker (TODO: add link).
@@ -111,9 +106,8 @@
 	u64 addresses[XE_HW_ENGINE_MAX_INSTANCE];
 	struct drm_gpuvm_exec vm_exec = {.extra.fn = xe_exec_fn};
 	struct drm_exec *exec = &vm_exec.exec;
-	u32 i, num_syncs = 0, num_ufence = 0;
+	u32 i, num_syncs, num_ufence = 0;
 	struct xe_sched_job *job;
-	struct dma_fence *rebind_fence;
 	struct xe_vm *vm;
 	bool write_locked, skip_retry = false;
 	ktime_t end = 0;
@@ -128,12 +122,16 @@
 	if (XE_IOCTL_DBG(xe, !q))
 		return -ENOENT;
 
-	if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM))
-		return -EINVAL;
+	if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM)) {
+		err = -EINVAL;
+		goto err_exec_queue;
+	}
 
 	if (XE_IOCTL_DBG(xe, args->num_batch_buffer &&
-			 q->width != args->num_batch_buffer))
-		return -EINVAL;
+			 q->width != args->num_batch_buffer)) {
+		err = -EINVAL;
+		goto err_exec_queue;
+	}
 
 	if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_BANNED)) {
 		err = -ECANCELED;
@@ -150,15 +148,15 @@
 
 	vm = q->vm;
 
-	for (i = 0; i < args->num_syncs; i++) {
-		err = xe_sync_entry_parse(xe, xef, &syncs[num_syncs++],
-					  &syncs_user[i], SYNC_PARSE_FLAG_EXEC |
+	for (num_syncs = 0; num_syncs < args->num_syncs; num_syncs++) {
+		err = xe_sync_entry_parse(xe, xef, &syncs[num_syncs],
+					  &syncs_user[num_syncs], SYNC_PARSE_FLAG_EXEC |
 					  (xe_vm_in_lr_mode(vm) ?
 					   SYNC_PARSE_FLAG_LR_MODE : 0));
 		if (err)
 			goto err_syncs;
 
-		if (xe_sync_is_ufence(&syncs[i]))
+		if (xe_sync_is_ufence(&syncs[num_syncs]))
 			num_ufence++;
 	}
 
@@ -196,6 +194,30 @@
 			goto err_unlock_list;
 	}
 
+	if (!args->num_batch_buffer) {
+		err = xe_vm_lock(vm, true);
+		if (err)
+			goto err_unlock_list;
+
+		if (!xe_vm_in_lr_mode(vm)) {
+			struct dma_fence *fence;
+
+			fence = xe_sync_in_fence_get(syncs, num_syncs, q, vm);
+			if (IS_ERR(fence)) {
+				err = PTR_ERR(fence);
+				xe_vm_unlock(vm);
+				goto err_unlock_list;
+			}
+			for (i = 0; i < num_syncs; i++)
+				xe_sync_entry_signal(&syncs[i], NULL, fence);
+			xe_exec_queue_last_fence_set(q, vm, fence);
+			dma_fence_put(fence);
+		}
+
+		xe_vm_unlock(vm);
+		goto err_unlock_list;
+	}
+
 	vm_exec.vm = &vm->gpuvm;
 	vm_exec.num_fences = 1 + vm->xe->info.tile_count;
 	vm_exec.flags = DRM_EXEC_INTERRUPTIBLE_WAIT;
@@ -216,24 +238,6 @@
 		goto err_exec;
 	}
 
-	if (!args->num_batch_buffer) {
-		if (!xe_vm_in_lr_mode(vm)) {
-			struct dma_fence *fence;
-
-			fence = xe_sync_in_fence_get(syncs, num_syncs, q, vm);
-			if (IS_ERR(fence)) {
-				err = PTR_ERR(fence);
-				goto err_exec;
-			}
-			for (i = 0; i < num_syncs; i++)
-				xe_sync_entry_signal(&syncs[i], NULL, fence);
-			xe_exec_queue_last_fence_set(q, vm, fence);
-			dma_fence_put(fence);
-		}
-
-		goto err_exec;
-	}
-
 	if (xe_exec_queue_is_lr(q) && xe_exec_queue_ring_full(q)) {
 		err = -EWOULDBLOCK;	/* Aliased to -EAGAIN */
 		skip_retry = true;
@@ -251,35 +255,11 @@
 	 * Rebind any invalidated userptr or evicted BOs in the VM, non-compute
 	 * VM mode only.
 	 */
-	rebind_fence = xe_vm_rebind(vm, false);
-	if (IS_ERR(rebind_fence)) {
-		err = PTR_ERR(rebind_fence);
+	err = xe_vm_rebind(vm, false);
+	if (err)
 		goto err_put_job;
-	}
 
-	/*
-	 * We store the rebind_fence in the VM so subsequent execs don't get
-	 * scheduled before the rebinds of userptrs / evicted BOs is complete.
-	 */
-	if (rebind_fence) {
-		dma_fence_put(vm->rebind_fence);
-		vm->rebind_fence = rebind_fence;
-	}
-	if (vm->rebind_fence) {
-		if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
-			     &vm->rebind_fence->flags)) {
-			dma_fence_put(vm->rebind_fence);
-			vm->rebind_fence = NULL;
-		} else {
-			dma_fence_get(vm->rebind_fence);
-			err = drm_sched_job_add_dependency(&job->drm,
-							   vm->rebind_fence);
-			if (err)
-				goto err_put_job;
-		}
-	}
-
-	/* Wait behind munmap style rebinds */
+	/* Wait behind rebinds */
 	if (!xe_vm_in_lr_mode(vm)) {
 		err = drm_sched_job_add_resv_dependencies(&job->drm,
 							  xe_vm_resv(vm),
@@ -314,7 +294,8 @@
 	xe_sched_job_arm(job);
 	if (!xe_vm_in_lr_mode(vm))
 		drm_gpuvm_resv_add_fence(&vm->gpuvm, exec, &job->drm.s_fence->finished,
-					 DMA_RESV_USAGE_BOOKKEEP, DMA_RESV_USAGE_WRITE);
+					 DMA_RESV_USAGE_BOOKKEEP,
+					 DMA_RESV_USAGE_BOOKKEEP);
 
 	for (i = 0; i < num_syncs; i++)
 		xe_sync_entry_signal(&syncs[i], job,
@@ -349,8 +330,8 @@
 	if (err == -EAGAIN && !skip_retry)
 		goto retry;
 err_syncs:
-	for (i = 0; i < num_syncs; i++)
-		xe_sync_entry_cleanup(&syncs[i]);
+	while (num_syncs--)
+		xe_sync_entry_cleanup(&syncs[num_syncs]);
 	kfree(syncs);
 err_exec_queue:
 	xe_exec_queue_put(q);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_exec_queue.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_exec_queue.c
@@ -60,12 +60,14 @@
 	q->fence_irq = &gt->fence_irq[hwe->class];
 	q->ring_ops = gt->ring_ops[hwe->class];
 	q->ops = gt->exec_queue_ops;
-	INIT_LIST_HEAD(&q->compute.link);
+	INIT_LIST_HEAD(&q->lr.link);
 	INIT_LIST_HEAD(&q->multi_gt_link);
 
 	q->sched_props.timeslice_us = hwe->eclass->sched_props.timeslice_us;
 	q->sched_props.preempt_timeout_us =
 				hwe->eclass->sched_props.preempt_timeout_us;
+	q->sched_props.job_timeout_ms =
+				hwe->eclass->sched_props.job_timeout_ms;
 	if (q->flags & EXEC_QUEUE_FLAG_KERNEL &&
 	    q->flags & EXEC_QUEUE_FLAG_HIGH_PRIORITY)
 		q->sched_props.priority = XE_EXEC_QUEUE_PRIORITY_KERNEL;
@@ -389,34 +391,6 @@
 	return 0;
 }
 
-static const enum xe_engine_class user_to_xe_engine_class[] = {
-	[DRM_XE_ENGINE_CLASS_RENDER] = XE_ENGINE_CLASS_RENDER,
-	[DRM_XE_ENGINE_CLASS_COPY] = XE_ENGINE_CLASS_COPY,
-	[DRM_XE_ENGINE_CLASS_VIDEO_DECODE] = XE_ENGINE_CLASS_VIDEO_DECODE,
-	[DRM_XE_ENGINE_CLASS_VIDEO_ENHANCE] = XE_ENGINE_CLASS_VIDEO_ENHANCE,
-	[DRM_XE_ENGINE_CLASS_COMPUTE] = XE_ENGINE_CLASS_COMPUTE,
-};
-
-static struct xe_hw_engine *
-find_hw_engine(struct xe_device *xe,
-	       struct drm_xe_engine_class_instance eci)
-{
-	u32 idx;
-
-	if (eci.engine_class > ARRAY_SIZE(user_to_xe_engine_class))
-		return NULL;
-
-	if (eci.gt_id >= xe->info.gt_count)
-		return NULL;
-
-	idx = array_index_nospec(eci.engine_class,
-				 ARRAY_SIZE(user_to_xe_engine_class));
-
-	return xe_gt_hw_engine(xe_device_get_gt(xe, eci.gt_id),
-			       user_to_xe_engine_class[idx],
-			       eci.engine_instance, true);
-}
-
 static u32 bind_exec_queue_logical_mask(struct xe_device *xe, struct xe_gt *gt,
 					struct drm_xe_engine_class_instance *eci,
 					u16 width, u16 num_placements)
@@ -438,8 +412,7 @@
 		if (xe_hw_engine_is_reserved(hwe))
 			continue;
 
-		if (hwe->class ==
-		    user_to_xe_engine_class[DRM_XE_ENGINE_CLASS_COPY])
+		if (hwe->class == XE_ENGINE_CLASS_COPY)
 			logical_mask |= BIT(hwe->logical_instance);
 	}
 
@@ -468,7 +441,7 @@
 
 			n = j * width + i;
 
-			hwe = find_hw_engine(xe, eci[n]);
+			hwe = xe_hw_engine_lookup(xe, eci[n]);
 			if (XE_IOCTL_DBG(xe, !hwe))
 				return 0;
 
@@ -546,7 +519,7 @@
 			if (XE_IOCTL_DBG(xe, !logical_mask))
 				return -EINVAL;
 
-			hwe = find_hw_engine(xe, eci[0]);
+			hwe = xe_hw_engine_lookup(xe, eci[0]);
 			if (XE_IOCTL_DBG(xe, !hwe))
 				return -EINVAL;
 
@@ -585,7 +558,7 @@
 		if (XE_IOCTL_DBG(xe, !logical_mask))
 			return -EINVAL;
 
-		hwe = find_hw_engine(xe, eci[0]);
+		hwe = xe_hw_engine_lookup(xe, eci[0]);
 		if (XE_IOCTL_DBG(xe, !hwe))
 			return -EINVAL;
 
@@ -613,8 +586,7 @@
 			return PTR_ERR(q);
 
 		if (xe_vm_in_preempt_fence_mode(vm)) {
-			q->compute.context = dma_fence_context_alloc(1);
-			spin_lock_init(&q->compute.lock);
+			q->lr.context = dma_fence_context_alloc(1);
 
 			err = xe_vm_add_compute_exec_queue(vm, q);
 			if (XE_IOCTL_DBG(xe, err))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_exec_queue_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_exec_queue_types.h
@@ -132,11 +132,13 @@
 		u32 timeslice_us;
 		/** @preempt_timeout_us: preemption timeout in micro-seconds */
 		u32 preempt_timeout_us;
+		/** @job_timeout_ms: job timeout in milliseconds */
+		u32 job_timeout_ms;
 		/** @priority: priority of this exec queue */
 		enum xe_exec_queue_priority priority;
 	} sched_props;
 
-	/** @compute: compute exec queue state */
+	/** @lr: long-running exec queue state */
 	struct {
 		/** @pfence: preemption fence */
 		struct dma_fence *pfence;
@@ -146,9 +148,7 @@
 		u32 seqno;
 		/** @link: link into VM's list of exec queues */
 		struct list_head link;
-		/** @lock: preemption fences lock */
-		spinlock_t lock;
-	} compute;
+	} lr;
 
 	/** @ops: submission backend exec queue operations */
 	const struct xe_exec_queue_ops *ops;
@@ -157,6 +157,11 @@
 	const struct xe_ring_ops *ring_ops;
 	/** @entity: DRM sched entity for this exec queue (1 to 1 relationship) */
 	struct drm_sched_entity *entity;
+	/**
+	 * @tlb_flush_seqno: The seqno of the last rebind tlb flush performed
+	 * Protected by @vm's resv. Unused if @vm == NULL.
+	 */
+	u64 tlb_flush_seqno;
 	/** @lrc: logical ring context for this exec queue */
 	struct xe_lrc lrc[];
 };
@@ -188,9 +193,11 @@
 	int (*suspend)(struct xe_exec_queue *q);
 	/**
 	 * @suspend_wait: Wait for an exec queue to suspend executing, should be
-	 * call after suspend.
+	 * call after suspend. In dma-fencing path thus must return within a
+	 * reasonable amount of time. -ETIME return shall indicate an error
+	 * waiting for suspend resulting in associated VM getting killed.
 	 */
-	void (*suspend_wait)(struct xe_exec_queue *q);
+	int (*suspend_wait)(struct xe_exec_queue *q);
 	/**
 	 * @resume: Resume exec queue execution, exec queue must be in a suspended
 	 * state and dma fence returned from most recent suspend call must be
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_execlist.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_execlist.c
@@ -429,10 +429,11 @@
 	return 0;
 }
 
-static void execlist_exec_queue_suspend_wait(struct xe_exec_queue *q)
+static int execlist_exec_queue_suspend_wait(struct xe_exec_queue *q)
 
 {
 	/* NIY */
+	return 0;
 }
 
 static void execlist_exec_queue_resume(struct xe_exec_queue *q)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_force_wake.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_force_wake.h
@@ -24,14 +24,25 @@
 xe_force_wake_ref(struct xe_force_wake *fw,
 		  enum xe_force_wake_domains domain)
 {
-	xe_gt_assert(fw->gt, domain);
+	xe_gt_assert(fw->gt, domain != XE_FORCEWAKE_ALL);
 	return fw->domains[ffs(domain) - 1].ref;
 }
 
+/**
+ * xe_force_wake_assert_held - asserts domain is awake
+ * @fw : xe_force_wake structure
+ * @domain: xe_force_wake_domains apart from XE_FORCEWAKE_ALL
+ *
+ * xe_force_wake_assert_held() is designed to confirm a particular
+ * forcewake domain's wakefulness; it doesn't verify the wakefulness of
+ * multiple domains. Make sure the caller doesn't input multiple
+ * domains(XE_FORCEWAKE_ALL) as a parameter.
+ */
 static inline void
 xe_force_wake_assert_held(struct xe_force_wake *fw,
 			  enum xe_force_wake_domains domain)
 {
+	xe_gt_assert(fw->gt, domain != XE_FORCEWAKE_ALL);
 	xe_gt_assert(fw->gt, fw->awake_domains & domain);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gpu_scheduler.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gpu_scheduler.c
@@ -90,6 +90,11 @@
 	cancel_work_sync(&sched->work_process_msg);
 }
 
+void xe_sched_submission_resume_tdr(struct xe_gpu_scheduler *sched)
+{
+	drm_sched_resume_timeout(&sched->base, sched->base.timeout);
+}
+
 void xe_sched_add_msg(struct xe_gpu_scheduler *sched,
 		      struct xe_sched_msg *msg)
 {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gpu_scheduler.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gpu_scheduler.h
@@ -22,6 +22,8 @@
 void xe_sched_submission_start(struct xe_gpu_scheduler *sched);
 void xe_sched_submission_stop(struct xe_gpu_scheduler *sched);
 
+void xe_sched_submission_resume_tdr(struct xe_gpu_scheduler *sched);
+
 void xe_sched_add_msg(struct xe_gpu_scheduler *sched,
 		      struct xe_sched_msg *msg);
 
@@ -49,7 +51,9 @@
 static inline void xe_sched_add_pending_job(struct xe_gpu_scheduler *sched,
 					    struct xe_sched_job *job)
 {
+	spin_lock(&sched->base.job_list_lock);
 	list_add(&job->drm.list, &sched->base.pending_list);
+	spin_unlock(&sched->base.job_list_lock);
 }
 
 static inline
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gsc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gsc.c
@@ -391,10 +391,22 @@
 void xe_gsc_load_start(struct xe_gsc *gsc)
 {
 	struct xe_gt *gt = gsc_to_gt(gsc);
+	struct xe_device *xe = gt_to_xe(gt);
 
 	if (!xe_uc_fw_is_loadable(&gsc->fw) || !gsc->q)
 		return;
 
+	/*
+	 * The GSC HW is only reset by driver FLR or D3cold entry. We don't
+	 * support the former at runtime, while the latter is only supported on
+	 * DGFX, for which we don't support GSC. Therefore, if GSC failed to
+	 * load previously there is no need to try again because the HW is
+	 * stuck in the error state.
+	 */
+	xe_assert(xe, !IS_DGFX(xe));
+	if (xe_uc_fw_is_in_error_state(&gsc->fw))
+		return;
+
 	/* GSC FW survives GT reset and D3Hot */
 	if (gsc_fw_is_loaded(gt)) {
 		xe_uc_fw_change_status(&gsc->fw, XE_UC_FIRMWARE_TRANSFERRED);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt.c
@@ -384,7 +384,9 @@
 			 err);
 
 	/* Initialize CCS mode sysfs after early initialization of HW engines */
-	xe_gt_ccs_mode_sysfs_init(gt);
+	err = xe_gt_ccs_mode_sysfs_init(gt);
+	if (err)
+		goto err_force_wake;
 
 	err = xe_force_wake_put(gt_to_fw(gt), XE_FW_GT);
 	XE_WARN_ON(err);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_ccs_mode.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_ccs_mode.c
@@ -66,10 +66,16 @@
 		}
 	}
 
+	/*
+	 * Mask bits need to be set for the register. Though only Xe2+
+	 * platforms require setting of mask bits, it won't harm for older
+	 * platforms as these bits are unused there.
+	 */
+	mode |= CCS_MODE_CSLICE_0_3_MASK << 16;
 	xe_mmio_write32(gt, CCS_MODE, mode);
 
-	xe_gt_info(gt, "CCS_MODE=%x config:%08x, num_engines:%d, num_slices:%d\n",
-		   mode, config, num_engines, num_slices);
+	xe_gt_dbg(gt, "CCS_MODE=%x config:%08x, num_engines:%d, num_slices:%d\n",
+		  mode, config, num_engines, num_slices);
 }
 
 void xe_gt_apply_ccs_mode(struct xe_gt *gt)
@@ -167,25 +173,20 @@
  * and it is expected that there are no open drm clients while doing so.
  * The number of available compute slices is exposed to user through a per-gt
  * 'num_cslices' sysfs interface.
+ *
+ * Returns: Returns error value for failure and 0 for success.
  */
-void xe_gt_ccs_mode_sysfs_init(struct xe_gt *gt)
+int xe_gt_ccs_mode_sysfs_init(struct xe_gt *gt)
 {
 	struct xe_device *xe = gt_to_xe(gt);
 	int err;
 
 	if (!xe_gt_ccs_mode_enabled(gt))
-		return;
+		return 0;
 
 	err = sysfs_create_files(gt->sysfs, gt_ccs_mode_attrs);
-	if (err) {
-		drm_warn(&xe->drm, "Sysfs creation for ccs_mode failed err: %d\n", err);
-		return;
-	}
+	if (err)
+		return err;
 
-	err = drmm_add_action_or_reset(&xe->drm, xe_gt_ccs_mode_sysfs_fini, gt);
-	if (err) {
-		sysfs_remove_files(gt->sysfs, gt_ccs_mode_attrs);
-		drm_warn(&xe->drm, "%s: drmm_add_action_or_reset failed, err: %d\n",
-			 __func__, err);
-	}
+	return drmm_add_action_or_reset(&xe->drm, xe_gt_ccs_mode_sysfs_fini, gt);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_ccs_mode.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_ccs_mode.h
@@ -12,7 +12,7 @@
 #include "xe_platform_types.h"
 
 void xe_gt_apply_ccs_mode(struct xe_gt *gt);
-void xe_gt_ccs_mode_sysfs_init(struct xe_gt *gt);
+int xe_gt_ccs_mode_sysfs_init(struct xe_gt *gt);
 
 static inline bool xe_gt_ccs_mode_enabled(const struct xe_gt *gt)
 {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_idle.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_idle.c
@@ -126,6 +126,13 @@
 static void gt_idle_sysfs_fini(struct drm_device *drm, void *arg)
 {
 	struct kobject *kobj = arg;
+	struct xe_gt *gt = kobj_to_gt(kobj->parent);
+
+	if (gt_to_xe(gt)->info.skip_guc_pc) {
+		XE_WARN_ON(xe_force_wake_get(gt_to_fw(gt), XE_FW_GT));
+		xe_gt_idle_disable_c6(gt);
+		xe_force_wake_put(gt_to_fw(gt), XE_FW_GT);
+	}
 
 	sysfs_remove_files(kobj, gt_idle_attrs);
 	kobject_put(kobj);
@@ -184,7 +191,7 @@
 void xe_gt_idle_disable_c6(struct xe_gt *gt)
 {
 	xe_device_assert_mem_access(gt_to_xe(gt));
-	xe_force_wake_assert_held(gt_to_fw(gt), XE_FORCEWAKE_ALL);
+	xe_force_wake_assert_held(gt_to_fw(gt), XE_FW_GT);
 
 	xe_mmio_write32(gt, PG_ENABLE, 0);
 	xe_mmio_write32(gt, RC_CONTROL, 0);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_mcr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_mcr.c
@@ -6,6 +6,7 @@
 #include "xe_gt_mcr.h"
 
 #include "regs/xe_gt_regs.h"
+#include "xe_assert.h"
 #include "xe_gt.h"
 #include "xe_gt_topology.h"
 #include "xe_gt_types.h"
@@ -291,14 +292,40 @@
 	gt->steering[LNCF].instance_target = 0;		/* unused */
 }
 
-static void init_steering_dss(struct xe_gt *gt)
+static unsigned int dss_per_group(struct xe_gt *gt)
+{
+	if (gt_to_xe(gt)->info.platform == XE_PVC)
+		return 8;
+	else if (GRAPHICS_VERx100(gt_to_xe(gt)) >= 1250)
+		return 4;
+	else
+		return 6;
+}
+
+/**
+ * xe_gt_mcr_get_dss_steering - Get the group/instance steering for a DSS
+ * @gt: GT structure
+ * @dss: DSS ID to obtain steering for
+ * @group: pointer to storage for steering group ID
+ * @instance: pointer to storage for steering instance ID
+ */
+void xe_gt_mcr_get_dss_steering(struct xe_gt *gt, unsigned int dss, u16 *group, u16 *instance)
 {
-	unsigned int dss = min(xe_dss_mask_group_ffs(gt->fuse_topo.g_dss_mask, 0, 0),
-			       xe_dss_mask_group_ffs(gt->fuse_topo.c_dss_mask, 0, 0));
-	unsigned int dss_per_grp = gt_to_xe(gt)->info.platform == XE_PVC ? 8 : 4;
+	int dss_per_grp = dss_per_group(gt);
+
+	xe_gt_assert(gt, dss < XE_MAX_DSS_FUSE_BITS);
+
+	*group = dss / dss_per_grp;
+	*instance = dss % dss_per_grp;
+}
 
-	gt->steering[DSS].group_target = dss / dss_per_grp;
-	gt->steering[DSS].instance_target = dss % dss_per_grp;
+static void init_steering_dss(struct xe_gt *gt)
+{
+	xe_gt_mcr_get_dss_steering(gt,
+				   min(xe_dss_mask_group_ffs(gt->fuse_topo.g_dss_mask, 0, 0),
+				       xe_dss_mask_group_ffs(gt->fuse_topo.c_dss_mask, 0, 0)),
+				   &gt->steering[DSS].group_target,
+				   &gt->steering[DSS].instance_target);
 }
 
 static void init_steering_oaddrm(struct xe_gt *gt)
@@ -312,7 +339,7 @@
 	else
 		gt->steering[OADDRM].group_target = 1;
 
-	gt->steering[DSS].instance_target = 0;		/* unused */
+	gt->steering[OADDRM].instance_target = 0;	/* unused */
 }
 
 static void init_steering_sqidi_psmi(struct xe_gt *gt)
@@ -327,8 +354,8 @@
 
 static void init_steering_inst0(struct xe_gt *gt)
 {
-	gt->steering[DSS].group_target = 0;		/* unused */
-	gt->steering[DSS].instance_target = 0;		/* unused */
+	gt->steering[INSTANCE0].group_target = 0;	/* unused */
+	gt->steering[INSTANCE0].instance_target = 0;	/* unused */
 }
 
 static const struct {
@@ -357,7 +384,7 @@
 	if (gt->info.type == XE_GT_TYPE_MEDIA) {
 		drm_WARN_ON(&xe->drm, MEDIA_VER(xe) < 13);
 
-		if (MEDIA_VER(xe) >= 20) {
+		if (MEDIA_VERx100(xe) >= 1301) {
 			gt->steering[OADDRM].ranges = xe2lpm_gpmxmt_steering_table;
 			gt->steering[INSTANCE0].ranges = xe2lpm_instance0_steering_table;
 		} else {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_mcr.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_mcr.h
@@ -7,6 +7,7 @@
 #define _XE_GT_MCR_H_
 
 #include "regs/xe_reg_defs.h"
+#include "xe_gt_topology.h"
 
 struct drm_printer;
 struct xe_gt;
@@ -25,5 +26,18 @@
 			       u32 value);
 
 void xe_gt_mcr_steering_dump(struct xe_gt *gt, struct drm_printer *p);
+void xe_gt_mcr_get_dss_steering(struct xe_gt *gt, unsigned int dss, u16 *group, u16 *instance);
+
+/*
+ * Loop over each DSS and determine the group and instance IDs that
+ * should be used to steer MCR accesses toward this DSS.
+ * @dss: DSS ID to obtain steering for
+ * @gt: GT structure
+ * @group: steering group ID, data type: u16
+ * @instance: steering instance ID, data type: u16
+ */
+#define for_each_dss_steering(dss, gt, group, instance) \
+	for_each_dss((dss), (gt)) \
+		for_each_if((xe_gt_mcr_get_dss_steering((gt), (dss), &(group), &(instance)), true))
 
 #endif /* _XE_GT_MCR_H_ */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_pagefault.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_pagefault.c
@@ -69,7 +69,7 @@
 static bool vma_is_valid(struct xe_tile *tile, struct xe_vma *vma)
 {
 	return BIT(tile->id) & vma->tile_present &&
-		!(BIT(tile->id) & vma->usm.tile_invalidated);
+		!(BIT(tile->id) & vma->tile_invalidated);
 }
 
 static bool vma_matches(struct xe_vma *vma, u64 page_addr)
@@ -146,10 +146,12 @@
 	/* ASID to VM */
 	mutex_lock(&xe->usm.lock);
 	vm = xa_load(&xe->usm.asid_to_vm, pf->asid);
-	if (vm)
+	if (vm && xe_vm_in_fault_mode(vm))
 		xe_vm_get(vm);
+	else
+		vm = NULL;
 	mutex_unlock(&xe->usm.lock);
-	if (!vm || !xe_vm_in_fault_mode(vm))
+	if (!vm)
 		return -EINVAL;
 
 retry_userptr:
@@ -224,7 +226,7 @@
 
 	if (xe_vma_is_userptr(vma))
 		ret = xe_vma_userptr_check_repin(to_userptr_vma(vma));
-	vma->usm.tile_invalidated &= ~BIT(tile->id);
+	vma->tile_invalidated &= ~BIT(tile->id);
 
 unlock_dma_resv:
 	drm_exec_fini(&exec);
@@ -285,9 +287,9 @@
 	bool ret = false;
 
 	spin_lock_irq(&pf_queue->lock);
-	if (pf_queue->head != pf_queue->tail) {
+	if (pf_queue->tail != pf_queue->head) {
 		desc = (const struct xe_guc_pagefault_desc *)
-			(pf_queue->data + pf_queue->head);
+			(pf_queue->data + pf_queue->tail);
 
 		pf->fault_level = FIELD_GET(PFD_FAULT_LEVEL, desc->dw0);
 		pf->trva_fault = FIELD_GET(XE2_PFD_TRVA_FAULT, desc->dw0);
@@ -305,8 +307,8 @@
 		pf->page_addr |= FIELD_GET(PFD_VIRTUAL_ADDR_LO, desc->dw2) <<
 			PFD_VIRTUAL_ADDR_LO_SHIFT;
 
-		pf_queue->head = (pf_queue->head + PF_MSG_LEN_DW) %
-			PF_QUEUE_NUM_DW;
+		pf_queue->tail = (pf_queue->tail + PF_MSG_LEN_DW) %
+			pf_queue->num_dw;
 		ret = true;
 	}
 	spin_unlock_irq(&pf_queue->lock);
@@ -318,7 +320,8 @@
 {
 	lockdep_assert_held(&pf_queue->lock);
 
-	return CIRC_SPACE(pf_queue->tail, pf_queue->head, PF_QUEUE_NUM_DW) <=
+	return CIRC_SPACE(pf_queue->head, pf_queue->tail,
+			  pf_queue->num_dw) <=
 		PF_MSG_LEN_DW;
 }
 
@@ -337,11 +340,17 @@
 	asid = FIELD_GET(PFD_ASID, msg[1]);
 	pf_queue = gt->usm.pf_queue + (asid % NUM_PF_QUEUE);
 
+	/*
+	 * The below logic doesn't work unless PF_QUEUE_NUM_DW % PF_MSG_LEN_DW == 0
+	 */
+	xe_gt_assert(gt, !(pf_queue->num_dw % PF_MSG_LEN_DW));
+
 	spin_lock_irqsave(&pf_queue->lock, flags);
 	full = pf_queue_full(pf_queue);
 	if (!full) {
-		memcpy(pf_queue->data + pf_queue->tail, msg, len * sizeof(u32));
-		pf_queue->tail = (pf_queue->tail + len) % PF_QUEUE_NUM_DW;
+		memcpy(pf_queue->data + pf_queue->head, msg, len * sizeof(u32));
+		pf_queue->head = (pf_queue->head + len) %
+			pf_queue->num_dw;
 		queue_work(gt->usm.pf_wq, &pf_queue->worker);
 	} else {
 		drm_warn(&xe->drm, "PF Queue full, shouldn't be possible");
@@ -387,7 +396,7 @@
 		send_pagefault_reply(&gt->uc.guc, &reply);
 
 		if (time_after(jiffies, threshold) &&
-		    pf_queue->head != pf_queue->tail) {
+		    pf_queue->tail != pf_queue->head) {
 			queue_work(gt->usm.pf_wq, w);
 			break;
 		}
@@ -396,18 +405,59 @@
 
 static void acc_queue_work_func(struct work_struct *w);
 
+static void pagefault_fini(void *arg)
+{
+	struct xe_gt *gt = arg;
+	struct xe_device *xe = gt_to_xe(gt);
+
+	if (!xe->info.has_usm)
+		return;
+
+	destroy_workqueue(gt->usm.acc_wq);
+	destroy_workqueue(gt->usm.pf_wq);
+}
+
+static int xe_alloc_pf_queue(struct xe_gt *gt, struct pf_queue *pf_queue)
+{
+	struct xe_device *xe = gt_to_xe(gt);
+	xe_dss_mask_t all_dss;
+	int num_dss, num_eus;
+
+	bitmap_or(all_dss, gt->fuse_topo.g_dss_mask, gt->fuse_topo.c_dss_mask,
+		  XE_MAX_DSS_FUSE_BITS);
+
+	num_dss = bitmap_weight(all_dss, XE_MAX_DSS_FUSE_BITS);
+	num_eus = bitmap_weight(gt->fuse_topo.eu_mask_per_dss,
+				XE_MAX_EU_FUSE_BITS) * num_dss;
+
+	/* user can issue separate page faults per EU and per CS */
+	pf_queue->num_dw =
+		(num_eus + XE_NUM_HW_ENGINES) * PF_MSG_LEN_DW;
+
+	pf_queue->gt = gt;
+	pf_queue->data = devm_kcalloc(xe->drm.dev, pf_queue->num_dw,
+				      sizeof(u32), GFP_KERNEL);
+	if (!pf_queue->data)
+		return -ENOMEM;
+
+	spin_lock_init(&pf_queue->lock);
+	INIT_WORK(&pf_queue->worker, pf_queue_work_func);
+
+	return 0;
+}
+
 int xe_gt_pagefault_init(struct xe_gt *gt)
 {
 	struct xe_device *xe = gt_to_xe(gt);
-	int i;
+	int i, ret = 0;
 
 	if (!xe->info.has_usm)
 		return 0;
 
 	for (i = 0; i < NUM_PF_QUEUE; ++i) {
-		gt->usm.pf_queue[i].gt = gt;
-		spin_lock_init(&gt->usm.pf_queue[i].lock);
-		INIT_WORK(&gt->usm.pf_queue[i].worker, pf_queue_work_func);
+		ret = xe_alloc_pf_queue(gt, &gt->usm.pf_queue[i]);
+		if (ret)
+			return ret;
 	}
 	for (i = 0; i < NUM_ACC_QUEUE; ++i) {
 		gt->usm.acc_queue[i].gt = gt;
@@ -423,10 +473,12 @@
 	gt->usm.acc_wq = alloc_workqueue("xe_gt_access_counter_work_queue",
 					 WQ_UNBOUND | WQ_HIGHPRI,
 					 NUM_ACC_QUEUE);
-	if (!gt->usm.acc_wq)
+	if (!gt->usm.acc_wq) {
+		destroy_workqueue(gt->usm.pf_wq);
 		return -ENOMEM;
+	}
 
-	return 0;
+	return devm_add_action_or_reset(xe->drm.dev, pagefault_fini, gt);
 }
 
 void xe_gt_pagefault_reset(struct xe_gt *gt)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c
@@ -20,6 +20,8 @@
 					tlb_invalidation.fence_tdr.work);
 	struct xe_gt_tlb_invalidation_fence *fence, *next;
 
+	LNL_FLUSH_WORK(&gt->uc.guc.ct.g2h_worker);
+
 	spin_lock_irq(&gt->tlb_invalidation.pending_lock);
 	list_for_each_entry_safe(fence, next,
 				 &gt->tlb_invalidation.pending_fences, link) {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_topology.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_topology.c
@@ -11,9 +11,6 @@
 #include "xe_gt.h"
 #include "xe_mmio.h"
 
-#define XE_MAX_DSS_FUSE_BITS (32 * XE_MAX_DSS_FUSE_REGS)
-#define XE_MAX_EU_FUSE_BITS (32 * XE_MAX_EU_FUSE_REGS)
-
 static void
 load_dss_mask(struct xe_gt *gt, xe_dss_mask_t mask, int numregs, ...)
 {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_topology.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_topology.h
@@ -8,6 +8,17 @@
 
 #include "xe_gt_types.h"
 
+/*
+ * Loop over each DSS with the bit is 1 in geometry or compute mask
+ * @dss: iterated DSS bit from the DSS mask
+ * @gt: GT structure
+ */
+#define for_each_dss(dss, gt) \
+	for_each_or_bit((dss), \
+			(gt)->fuse_topo.g_dss_mask, \
+			(gt)->fuse_topo.c_dss_mask, \
+			XE_MAX_DSS_FUSE_BITS)
+
 struct drm_printer;
 
 void xe_gt_topology_init(struct xe_gt *gt);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_gt_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_gt_types.h
@@ -25,10 +25,12 @@
 };
 
 #define XE_MAX_DSS_FUSE_REGS	3
+#define XE_MAX_DSS_FUSE_BITS	(32 * XE_MAX_DSS_FUSE_REGS)
 #define XE_MAX_EU_FUSE_REGS	1
+#define XE_MAX_EU_FUSE_BITS	(32 * XE_MAX_EU_FUSE_REGS)
 
-typedef unsigned long xe_dss_mask_t[BITS_TO_LONGS(32 * XE_MAX_DSS_FUSE_REGS)];
-typedef unsigned long xe_eu_mask_t[BITS_TO_LONGS(32 * XE_MAX_EU_FUSE_REGS)];
+typedef unsigned long xe_dss_mask_t[BITS_TO_LONGS(XE_MAX_DSS_FUSE_BITS)];
+typedef unsigned long xe_eu_mask_t[BITS_TO_LONGS(XE_MAX_EU_FUSE_BITS)];
 
 struct xe_mmio_range {
 	u32 start;
@@ -222,19 +224,24 @@
 		struct pf_queue {
 			/** @gt: back pointer to GT */
 			struct xe_gt *gt;
-#define PF_QUEUE_NUM_DW	128
 			/** @data: data in the page fault queue */
-			u32 data[PF_QUEUE_NUM_DW];
+			u32 *data;
 			/**
-			 * @head: head pointer in DWs for page fault queue,
-			 * moved by worker which processes faults.
+			 * @usm.pf_queue.num_dw: number of DWORDS in the page
+			 * fault queue. Dynamically calculated based on the number
+			 * of compute resources available.
 			 */
-			u16 head;
+			u32 num_dw;
 			/**
 			 * @tail: tail pointer in DWs for page fault queue,
-			 * moved by G2H handler.
+			 * moved by worker which processes faults (consumer).
 			 */
 			u16 tail;
+			/**
+			 * @head: head pointer in DWs for page fault queue,
+			 * moved by G2H handler (producer).
+			 */
+			u16 head;
 			/** @lock: protects page fault queue */
 			spinlock_t lock;
 			/** @worker: to process page faults */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_guc_ct.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_guc_ct.c
@@ -503,16 +503,12 @@
 		num_g2h = 1;
 
 		if (g2h_fence_needs_alloc(g2h_fence)) {
-			void *ptr;
-
 			g2h_fence->seqno = (ct->fence_seqno++ & 0xffff);
-			ptr = xa_store(&ct->fence_lookup,
-				       g2h_fence->seqno,
-				       g2h_fence, GFP_ATOMIC);
-			if (IS_ERR(ptr)) {
-				ret = PTR_ERR(ptr);
+			ret = xa_err(xa_store(&ct->fence_lookup,
+					      g2h_fence->seqno, g2h_fence,
+					      GFP_ATOMIC));
+			if (ret)
 				goto out;
-			}
 		}
 	}
 
@@ -710,14 +706,11 @@
 retry_same_fence:
 	ret = guc_ct_send(ct, action, len, 0, 0, &g2h_fence);
 	if (unlikely(ret == -ENOMEM)) {
-		void *ptr;
-
 		/* Retry allocation /w GFP_KERNEL */
-		ptr = xa_store(&ct->fence_lookup,
-			       g2h_fence.seqno,
-			       &g2h_fence, GFP_KERNEL);
-		if (IS_ERR(ptr))
-			return PTR_ERR(ptr);
+		ret = xa_err(xa_store(&ct->fence_lookup, g2h_fence.seqno,
+				      &g2h_fence, GFP_KERNEL));
+		if (ret)
+			return ret;
 
 		goto retry_same_fence;
 	} else if (unlikely(ret)) {
@@ -734,16 +727,35 @@
 	}
 
 	ret = wait_event_timeout(ct->g2h_fence_wq, g2h_fence.done, HZ);
+
+	if (!ret) {
+		LNL_FLUSH_WORK(&ct->g2h_worker);
+		if (g2h_fence.done) {
+			drm_warn(&xe->drm, "G2H fence %u, action %04x, done\n",
+				 g2h_fence.seqno, action[0]);
+			ret = 1;
+		}
+	}
+
+	/*
+	 * Ensure we serialize with completion side to prevent UAF with fence going out of scope on
+	 * the stack, since we have no clue if it will fire after the timeout before we can erase
+	 * from the xa. Also we have some dependent loads and stores below for which we need the
+	 * correct ordering, and we lack the needed barriers.
+	 */
+	mutex_lock(&ct->lock);
 	if (!ret) {
-		drm_err(&xe->drm, "Timed out wait for G2H, fence %u, action %04x",
-			g2h_fence.seqno, action[0]);
+		drm_err(&xe->drm, "Timed out wait for G2H, fence %u, action %04x, done %s",
+			g2h_fence.seqno, action[0], str_yes_no(g2h_fence.done));
 		xa_erase_irq(&ct->fence_lookup, g2h_fence.seqno);
+		mutex_unlock(&ct->lock);
 		return -ETIME;
 	}
 
 	if (g2h_fence.retry) {
 		drm_warn(&xe->drm, "Send retry, action 0x%04x, reason %d",
 			 action[0], g2h_fence.reason);
+		mutex_unlock(&ct->lock);
 		goto retry;
 	}
 	if (g2h_fence.fail) {
@@ -752,6 +764,8 @@
 		ret = -EIO;
 	}
 
+	mutex_unlock(&ct->lock);
+
 	return ret > 0 ? 0 : ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_guc_pc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_guc_pc.c
@@ -381,8 +381,6 @@
 	struct xe_device *xe = gt_to_xe(gt);
 	u32 freq;
 
-	xe_device_mem_access_get(gt_to_xe(gt));
-
 	/* When in RC6, actual frequency reported will be 0. */
 	if (GRAPHICS_VERx100(xe) >= 1270) {
 		freq = xe_mmio_read32(gt, MTL_MIRROR_TARGET_WP1);
@@ -394,8 +392,6 @@
 
 	freq = decode_freq(freq);
 
-	xe_device_mem_access_put(gt_to_xe(gt));
-
 	return freq;
 }
 
@@ -412,14 +408,13 @@
 	struct xe_gt *gt = pc_to_gt(pc);
 	int ret;
 
-	xe_device_mem_access_get(gt_to_xe(gt));
 	/*
 	 * GuC SLPC plays with cur freq request when GuCRC is enabled
 	 * Block RC6 for a more reliable read.
 	 */
 	ret = xe_force_wake_get(gt_to_fw(gt), XE_FORCEWAKE_ALL);
 	if (ret)
-		goto out;
+		return ret;
 
 	*freq = xe_mmio_read32(gt, RPNSWREQ);
 
@@ -427,9 +422,7 @@
 	*freq = decode_freq(*freq);
 
 	XE_WARN_ON(xe_force_wake_put(gt_to_fw(gt), XE_FORCEWAKE_ALL));
-out:
-	xe_device_mem_access_put(gt_to_xe(gt));
-	return ret;
+	return 0;
 }
 
 /**
@@ -451,12 +444,7 @@
  */
 u32 xe_guc_pc_get_rpe_freq(struct xe_guc_pc *pc)
 {
-	struct xe_gt *gt = pc_to_gt(pc);
-	struct xe_device *xe = gt_to_xe(gt);
-
-	xe_device_mem_access_get(xe);
 	pc_update_rp_values(pc);
-	xe_device_mem_access_put(xe);
 
 	return pc->rpe_freq;
 }
@@ -485,7 +473,6 @@
 	struct xe_gt *gt = pc_to_gt(pc);
 	int ret;
 
-	xe_device_mem_access_get(pc_to_xe(pc));
 	mutex_lock(&pc->freq_lock);
 	if (!pc->freq_ready) {
 		/* Might be in the middle of a gt reset */
@@ -511,7 +498,6 @@
 	XE_WARN_ON(xe_force_wake_put(gt_to_fw(gt), XE_FORCEWAKE_ALL));
 out:
 	mutex_unlock(&pc->freq_lock);
-	xe_device_mem_access_put(pc_to_xe(pc));
 	return ret;
 }
 
@@ -528,7 +514,6 @@
 {
 	int ret;
 
-	xe_device_mem_access_get(pc_to_xe(pc));
 	mutex_lock(&pc->freq_lock);
 	if (!pc->freq_ready) {
 		/* Might be in the middle of a gt reset */
@@ -544,8 +529,6 @@
 
 out:
 	mutex_unlock(&pc->freq_lock);
-	xe_device_mem_access_put(pc_to_xe(pc));
-
 	return ret;
 }
 
@@ -561,7 +544,6 @@
 {
 	int ret;
 
-	xe_device_mem_access_get(pc_to_xe(pc));
 	mutex_lock(&pc->freq_lock);
 	if (!pc->freq_ready) {
 		/* Might be in the middle of a gt reset */
@@ -577,7 +559,6 @@
 
 out:
 	mutex_unlock(&pc->freq_lock);
-	xe_device_mem_access_put(pc_to_xe(pc));
 	return ret;
 }
 
@@ -594,7 +575,6 @@
 {
 	int ret;
 
-	xe_device_mem_access_get(pc_to_xe(pc));
 	mutex_lock(&pc->freq_lock);
 	if (!pc->freq_ready) {
 		/* Might be in the middle of a gt reset */
@@ -610,7 +590,6 @@
 
 out:
 	mutex_unlock(&pc->freq_lock);
-	xe_device_mem_access_put(pc_to_xe(pc));
 	return ret;
 }
 
@@ -623,8 +602,6 @@
 	struct xe_gt *gt = pc_to_gt(pc);
 	u32 reg, gt_c_state;
 
-	xe_device_mem_access_get(gt_to_xe(gt));
-
 	if (GRAPHICS_VERx100(gt_to_xe(gt)) >= 1270) {
 		reg = xe_mmio_read32(gt, MTL_MIRROR_TARGET_WP1);
 		gt_c_state = REG_FIELD_GET(MTL_CC_MASK, reg);
@@ -633,8 +610,6 @@
 		gt_c_state = REG_FIELD_GET(RCN_MASK, reg);
 	}
 
-	xe_device_mem_access_put(gt_to_xe(gt));
-
 	switch (gt_c_state) {
 	case GT_C6:
 		return GT_IDLE_C6;
@@ -654,9 +629,7 @@
 	struct xe_gt *gt = pc_to_gt(pc);
 	u32 reg;
 
-	xe_device_mem_access_get(gt_to_xe(gt));
 	reg = xe_mmio_read32(gt, GT_GFX_RC6);
-	xe_device_mem_access_put(gt_to_xe(gt));
 
 	return reg;
 }
@@ -670,9 +643,7 @@
 	struct xe_gt *gt = pc_to_gt(pc);
 	u64 reg;
 
-	xe_device_mem_access_get(gt_to_xe(gt));
 	reg = xe_mmio_read32(gt, MTL_MEDIA_MC6);
-	xe_device_mem_access_put(gt_to_xe(gt));
 
 	return reg;
 }
@@ -801,23 +772,19 @@
 	if (xe->info.skip_guc_pc)
 		return 0;
 
-	xe_device_mem_access_get(pc_to_xe(pc));
-
 	ret = pc_action_setup_gucrc(pc, XE_GUCRC_HOST_CONTROL);
 	if (ret)
-		goto out;
+		return ret;
 
 	ret = xe_force_wake_get(gt_to_fw(gt), XE_FORCEWAKE_ALL);
 	if (ret)
-		goto out;
+		return ret;
 
 	xe_gt_idle_disable_c6(gt);
 
 	XE_WARN_ON(xe_force_wake_put(gt_to_fw(gt), XE_FORCEWAKE_ALL));
 
-out:
-	xe_device_mem_access_put(pc_to_xe(pc));
-	return ret;
+	return 0;
 }
 
 static void pc_init_pcode_freq(struct xe_guc_pc *pc)
@@ -870,11 +837,9 @@
 
 	xe_gt_assert(gt, xe_device_uc_enabled(xe));
 
-	xe_device_mem_access_get(pc_to_xe(pc));
-
 	ret = xe_force_wake_get(gt_to_fw(gt), XE_FORCEWAKE_ALL);
 	if (ret)
-		goto out_fail_force_wake;
+		return ret;
 
 	if (xe->info.skip_guc_pc) {
 		if (xe->info.platform != XE_PVC)
@@ -914,8 +879,6 @@
 
 out:
 	XE_WARN_ON(xe_force_wake_put(gt_to_fw(gt), XE_FORCEWAKE_ALL));
-out_fail_force_wake:
-	xe_device_mem_access_put(pc_to_xe(pc));
 	return ret;
 }
 
@@ -928,12 +891,9 @@
 	struct xe_device *xe = pc_to_xe(pc);
 	int ret;
 
-	xe_device_mem_access_get(pc_to_xe(pc));
-
 	if (xe->info.skip_guc_pc) {
 		xe_gt_idle_disable_c6(pc_to_gt(pc));
-		ret = 0;
-		goto out;
+		return 0;
 	}
 
 	mutex_lock(&pc->freq_lock);
@@ -942,16 +902,14 @@
 
 	ret = pc_action_shutdown(pc);
 	if (ret)
-		goto out;
+		return ret;
 
 	if (wait_for_pc_state(pc, SLPC_GLOBAL_STATE_NOT_RUNNING)) {
 		drm_err(&pc_to_xe(pc)->drm, "GuC PC Shutdown failed\n");
-		ret = -EIO;
+		return -EIO;
 	}
 
-out:
-	xe_device_mem_access_put(pc_to_xe(pc));
-	return ret;
+	return 0;
 }
 
 /**
@@ -960,16 +918,7 @@
  */
 void xe_guc_pc_fini(struct xe_guc_pc *pc)
 {
-	struct xe_device *xe = pc_to_xe(pc);
-
-	if (xe->info.skip_guc_pc) {
-		xe_device_mem_access_get(xe);
-		xe_gt_idle_disable_c6(pc_to_gt(pc));
-		xe_device_mem_access_put(xe);
-		return;
-	}
-
-	XE_WARN_ON(xe_guc_pc_gucrc_disable(pc));
+	xe_guc_pc_gucrc_disable(pc);
 	XE_WARN_ON(xe_guc_pc_stop(pc));
 	mutex_destroy(&pc->freq_lock);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_guc_submit.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -23,6 +23,7 @@
 #include "xe_force_wake.h"
 #include "xe_gpu_scheduler.h"
 #include "xe_gt.h"
+#include "xe_gt_printk.h"
 #include "xe_guc.h"
 #include "xe_guc_ct.h"
 #include "xe_guc_exec_queue_types.h"
@@ -230,10 +231,26 @@
 }
 #endif
 
+static void xe_guc_submit_fini(struct xe_guc *guc)
+{
+	struct xe_device *xe = guc_to_xe(guc);
+	struct xe_gt *gt = guc_to_gt(guc);
+	int ret;
+
+	ret = wait_event_timeout(guc->submission_state.fini_wq,
+				 xa_empty(&guc->submission_state.exec_queue_lookup),
+				 HZ * 5);
+
+	drain_workqueue(xe->destroy_wq);
+
+	xe_gt_assert(gt, ret);
+}
+
 static void guc_submit_fini(struct drm_device *drm, void *arg)
 {
 	struct xe_guc *guc = arg;
 
+	xe_guc_submit_fini(guc);
 	xa_destroy(&guc->submission_state.exec_queue_lookup);
 	ida_destroy(&guc->submission_state.guc_ids);
 	bitmap_free(guc->submission_state.guc_ids_bitmap);
@@ -256,7 +273,6 @@
 	fs_reclaim_acquire(GFP_KERNEL);
 
 	mutex_lock(&guc->submission_state.lock);
-	might_lock(&guc->submission_state.suspend.lock);
 	mutex_unlock(&guc->submission_state.lock);
 
 	fs_reclaim_release(GFP_KERNEL);
@@ -285,8 +301,7 @@
 	xa_init(&guc->submission_state.exec_queue_lookup);
 	ida_init(&guc->submission_state.guc_ids);
 
-	spin_lock_init(&guc->submission_state.suspend.lock);
-	guc->submission_state.suspend.context = dma_fence_context_alloc(1);
+	init_waitqueue_head(&guc->submission_state.fini_wq);
 
 	primelockdep(guc);
 
@@ -312,12 +327,14 @@
 				      order_base_2(q->width));
 	else
 		ida_simple_remove(&guc->submission_state.guc_ids, q->guc->id);
+
+	if (xa_empty(&guc->submission_state.exec_queue_lookup))
+		wake_up(&guc->submission_state.fini_wq);
 }
 
 static int alloc_guc_id(struct xe_guc *guc, struct xe_exec_queue *q)
 {
 	int ret;
-	void *ptr;
 	int i;
 
 	/*
@@ -346,12 +363,10 @@
 		q->guc->id += GUC_ID_START_MLRC;
 
 	for (i = 0; i < q->width; ++i) {
-		ptr = xa_store(&guc->submission_state.exec_queue_lookup,
-			       q->guc->id + i, q, GFP_NOWAIT);
-		if (IS_ERR(ptr)) {
-			ret = PTR_ERR(ptr);
+		ret = xa_err(xa_store(&guc->submission_state.exec_queue_lookup,
+				      q->guc->id + i, q, GFP_NOWAIT));
+		if (ret)
 			goto err_release;
-		}
 	}
 
 	return 0;
@@ -1038,13 +1053,16 @@
 
 static void guc_exec_queue_fini_async(struct xe_exec_queue *q)
 {
+	struct xe_guc *guc = exec_queue_to_guc(q);
+	struct xe_device *xe = guc_to_xe(guc);
+
 	INIT_WORK(&q->guc->fini_async, __guc_exec_queue_fini_async);
 
 	/* We must block on kernel engines so slabs are empty on driver unload */
 	if (q->flags & EXEC_QUEUE_FLAG_PERMANENT)
 		__guc_exec_queue_fini_async(&q->guc->fini_async);
 	else
-		queue_work(system_wq, &q->guc->fini_async);
+		queue_work(xe->destroy_wq, &q->guc->fini_async);
 }
 
 static void __guc_exec_queue_fini(struct xe_guc *guc, struct xe_exec_queue *q)
@@ -1089,6 +1107,15 @@
 	kfree(msg);
 }
 
+static void __suspend_fence_signal(struct xe_exec_queue *q)
+{
+	if (!q->guc->suspend_pending)
+		return;
+
+	WRITE_ONCE(q->guc->suspend_pending, false);
+	wake_up(&q->guc->suspend_wait);
+}
+
 static void suspend_fence_signal(struct xe_exec_queue *q)
 {
 	struct xe_guc *guc = exec_queue_to_guc(q);
@@ -1098,9 +1125,7 @@
 		  guc_read_stopped(guc));
 	xe_assert(xe, q->guc->suspend_pending);
 
-	q->guc->suspend_pending = false;
-	smp_wmb();
-	wake_up(&q->guc->suspend_wait);
+	__suspend_fence_signal(q);
 }
 
 static void __guc_exec_queue_process_msg_suspend(struct xe_sched_msg *msg)
@@ -1216,7 +1241,7 @@
 	init_waitqueue_head(&ge->suspend_wait);
 
 	timeout = (q->vm && xe_vm_in_lr_mode(q->vm)) ? MAX_SCHEDULE_TIMEOUT :
-		  q->hwe->eclass->sched_props.job_timeout_ms;
+		  msecs_to_jiffies(q->sched_props.job_timeout_ms);
 	err = xe_sched_init(&ge->sched, &drm_sched_ops, &xe_sched_ops,
 			    get_submit_wq(guc),
 			    q->lrc[0].ring.size / MAX_JOB_SIZE_BYTES, 64,
@@ -1253,6 +1278,7 @@
 	return 0;
 
 err_entity:
+	mutex_unlock(&guc->submission_state.lock);
 	xe_sched_entity_fini(&ge->entity);
 err_sched:
 	xe_sched_fini(&ge->sched);
@@ -1266,6 +1292,7 @@
 {
 	trace_xe_exec_queue_kill(q);
 	set_exec_queue_killed(q);
+	__suspend_fence_signal(q);
 	xe_guc_exec_queue_trigger_cleanup(q);
 }
 
@@ -1376,12 +1403,31 @@
 	return 0;
 }
 
-static void guc_exec_queue_suspend_wait(struct xe_exec_queue *q)
+static int guc_exec_queue_suspend_wait(struct xe_exec_queue *q)
 {
 	struct xe_guc *guc = exec_queue_to_guc(q);
+	int ret;
+
+	/*
+	 * Likely don't need to check exec_queue_killed() as we clear
+	 * suspend_pending upon kill but to be paranoid but races in which
+	 * suspend_pending is set after kill also check kill here.
+	 */
+	ret = wait_event_timeout(q->guc->suspend_wait,
+				 !READ_ONCE(q->guc->suspend_pending) ||
+				 exec_queue_killed(q) ||
+				 guc_read_stopped(guc),
+				 HZ * 5);
 
-	wait_event(q->guc->suspend_wait, !q->guc->suspend_pending ||
-		   guc_read_stopped(guc));
+	if (!ret) {
+		xe_gt_warn(guc_to_gt(guc),
+			   "Suspend fence, guc_id=%d, failed to respond",
+			   q->guc->id);
+		/* XXX: Trigger GT reset? */
+		return -ETIME;
+	}
+
+	return 0;
 }
 
 static void guc_exec_queue_resume(struct xe_exec_queue *q)
@@ -1457,8 +1503,8 @@
 			    !xe_sched_job_completed(job)) ||
 			    xe_sched_invalidate_job(job, 2)) {
 				trace_xe_sched_job_ban(job);
-				xe_sched_tdr_queue_imm(&q->guc->sched);
 				set_exec_queue_banned(q);
+				xe_sched_tdr_queue_imm(&q->guc->sched);
 			}
 		}
 	}
@@ -1497,8 +1543,13 @@
 
 	mutex_lock(&guc->submission_state.lock);
 
-	xa_for_each(&guc->submission_state.exec_queue_lookup, index, q)
+	xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) {
+		/* Prevent redundant attempts to stop parallel queues */
+		if (q->guc->id != index)
+			continue;
+
 		guc_exec_queue_stop(guc, q);
+	}
 
 	mutex_unlock(&guc->submission_state.lock);
 
@@ -1524,6 +1575,7 @@
 	}
 
 	xe_sched_submission_start(sched);
+	xe_sched_submission_resume_tdr(sched);
 }
 
 int xe_guc_submit_start(struct xe_guc *guc)
@@ -1536,8 +1588,13 @@
 
 	mutex_lock(&guc->submission_state.lock);
 	atomic_dec(&guc->submission_state.stopped);
-	xa_for_each(&guc->submission_state.exec_queue_lookup, index, q)
+	xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) {
+		/* Prevent redundant attempts to start parallel queues */
+		if (q->guc->id != index)
+			continue;
+
 		guc_exec_queue_start(q);
+	}
 	mutex_unlock(&guc->submission_state.lock);
 
 	wake_up_all(&guc->ct.wq);
@@ -1575,6 +1632,11 @@
 		q->guc->id,
 	};
 
+	xe_gt_assert(guc_to_gt(guc), exec_queue_destroyed(q));
+	xe_gt_assert(guc_to_gt(guc), exec_queue_registered(q));
+	xe_gt_assert(guc_to_gt(guc), !exec_queue_pending_disable(q));
+	xe_gt_assert(guc_to_gt(guc), !exec_queue_pending_enable(q));
+
 	trace_xe_exec_queue_deregister(q);
 
 	xe_guc_ct_send_g2h_handler(&guc->ct, action, ARRAY_SIZE(action));
@@ -1830,7 +1892,7 @@
 	snapshot->sched_props.preempt_timeout_us =
 		q->sched_props.preempt_timeout_us;
 
-	snapshot->lrc = kmalloc_array(q->width, sizeof(struct lrc_snapshot),
+	snapshot->lrc = kmalloc_array(q->width, sizeof(struct xe_lrc_snapshot *),
 				      GFP_ATOMIC);
 
 	if (!snapshot->lrc) {
@@ -1839,14 +1901,7 @@
 		for (i = 0; i < q->width; ++i) {
 			struct xe_lrc *lrc = q->lrc + i;
 
-			snapshot->lrc[i].context_desc =
-				lower_32_bits(xe_lrc_ggtt_addr(lrc));
-			snapshot->lrc[i].head = xe_lrc_ring_head(lrc);
-			snapshot->lrc[i].tail.internal = lrc->ring.tail;
-			snapshot->lrc[i].tail.memory =
-				xe_lrc_read_ctx_reg(lrc, CTX_RING_TAIL);
-			snapshot->lrc[i].start_seqno = xe_lrc_start_seqno(lrc);
-			snapshot->lrc[i].seqno = xe_lrc_seqno(lrc);
+			snapshot->lrc[i] = xe_lrc_snapshot_capture(lrc);
 		}
 	}
 
@@ -1912,18 +1967,9 @@
 	drm_printf(p, "\tPreempt timeout: %u (us)\n",
 		   snapshot->sched_props.preempt_timeout_us);
 
-	for (i = 0; snapshot->lrc && i < snapshot->width; ++i) {
-		drm_printf(p, "\tHW Context Desc: 0x%08x\n",
-			   snapshot->lrc[i].context_desc);
-		drm_printf(p, "\tLRC Head: (memory) %u\n",
-			   snapshot->lrc[i].head);
-		drm_printf(p, "\tLRC Tail: (internal) %u, (memory) %u\n",
-			   snapshot->lrc[i].tail.internal,
-			   snapshot->lrc[i].tail.memory);
-		drm_printf(p, "\tStart seqno: (memory) %d\n",
-			   snapshot->lrc[i].start_seqno);
-		drm_printf(p, "\tSeqno: (memory) %d\n", snapshot->lrc[i].seqno);
-	}
+	for (i = 0; snapshot->lrc && i < snapshot->width; ++i)
+		xe_lrc_snapshot_print(snapshot->lrc[i], p);
+
 	drm_printf(p, "\tSchedule State: 0x%x\n", snapshot->schedule_state);
 	drm_printf(p, "\tFlags: 0x%lx\n", snapshot->exec_queue_flags);
 
@@ -1948,10 +1994,15 @@
  */
 void xe_guc_exec_queue_snapshot_free(struct xe_guc_submit_exec_queue_snapshot *snapshot)
 {
+	int i;
 	if (!snapshot)
 		return;
 
-	kfree(snapshot->lrc);
+	if (snapshot->lrc) {
+		for (i = 0; i < snapshot->width; i++)
+			xe_lrc_snapshot_free(snapshot->lrc[i]);
+		kfree(snapshot->lrc);
+	}
 	kfree(snapshot->pending_list);
 	kfree(snapshot);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_guc_submit_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_guc_submit_types.h
@@ -61,17 +61,6 @@
 	u32 wq[WQ_SIZE / sizeof(u32)];
 };
 
-struct lrc_snapshot {
-	u32 context_desc;
-	u32 head;
-	struct {
-		u32 internal;
-		u32 memory;
-	} tail;
-	u32 start_seqno;
-	u32 seqno;
-};
-
 struct pending_list_snapshot {
 	u32 seqno;
 	bool fence;
@@ -109,7 +98,7 @@
 	} sched_props;
 
 	/** @lrc: LRC Snapshot */
-	struct lrc_snapshot *lrc;
+	struct xe_lrc_snapshot **lrc;
 
 	/** @schedule_state: Schedule State at the moment of Crash */
 	u32 schedule_state;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_guc_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_guc_types.h
@@ -43,15 +43,6 @@
 		atomic_t stopped;
 		/** @lock: protects submission state */
 		struct mutex lock;
-		/** @suspend: suspend fence state */
-		struct {
-			/** @lock: suspend fences lock */
-			spinlock_t lock;
-			/** @context: suspend fences context */
-			u64 context;
-			/** @seqno: suspend fences seqno */
-			u32 seqno;
-		} suspend;
 #ifdef CONFIG_PROVE_LOCKING
 #define NUM_SUBMIT_WQ	256
 		/** @submit_wq_pool: submission ordered workqueues pool */
@@ -61,6 +52,8 @@
 #endif
 		/** @enabled: submission is enabled */
 		bool enabled;
+		/** @submission_state.fini_wq: submit fini wait queue */
+		wait_queue_head_t fini_wq;
 	} submission_state;
 	/** @hwconfig: Hardware config state */
 	struct {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_huc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_huc.c
@@ -53,7 +53,6 @@
 	struct xe_gt *gt = huc_to_gt(huc);
 	struct xe_device *xe = gt_to_xe(gt);
 	struct xe_bo *bo;
-	int err;
 
 	/* we use a single object for both input and output */
 	bo = xe_bo_create_pin_map(xe, gt_to_tile(gt), NULL,
@@ -66,13 +65,7 @@
 
 	huc->gsc_pkt = bo;
 
-	err = drmm_add_action_or_reset(&xe->drm, free_gsc_pkt, huc);
-	if (err) {
-		free_gsc_pkt(&xe->drm, huc);
-		return err;
-	}
-
-	return 0;
+	return drmm_add_action_or_reset(&xe->drm, free_gsc_pkt, huc);
 }
 
 int xe_huc_init(struct xe_huc *huc)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_hw_engine.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_hw_engine.c
@@ -5,7 +5,10 @@
 
 #include "xe_hw_engine.h"
 
+#include <linux/nospec.h>
+
 #include <drm/drm_managed.h>
+#include <drm/xe_drm.h>
 
 #include "regs/xe_engine_regs.h"
 #include "regs/xe_gt_regs.h"
@@ -341,7 +344,7 @@
 	 * Bspec: 72161
 	 */
 	const u8 mocs_write_idx = gt->mocs.uc_index;
-	const u8 mocs_read_idx = hwe->class == XE_ENGINE_CLASS_COMPUTE &&
+	const u8 mocs_read_idx = hwe->class == XE_ENGINE_CLASS_COMPUTE && IS_DGFX(xe) &&
 				 (GRAPHICS_VER(xe) >= 20 || xe->info.platform == XE_PVC) ?
 				 gt->mocs.wb_index : gt->mocs.uc_index;
 	u32 ring_cmd_cctl_val = REG_FIELD_PREP(CMD_CCTL_WRITE_OVERRIDE_MASK, mocs_write_idx) |
@@ -881,3 +884,31 @@
 	return xe->info.has_usm && hwe->class == XE_ENGINE_CLASS_COPY &&
 		hwe->instance == gt->usm.reserved_bcs_instance;
 }
+
+static const enum xe_engine_class user_to_xe_engine_class[] = {
+	[DRM_XE_ENGINE_CLASS_RENDER] = XE_ENGINE_CLASS_RENDER,
+	[DRM_XE_ENGINE_CLASS_COPY] = XE_ENGINE_CLASS_COPY,
+	[DRM_XE_ENGINE_CLASS_VIDEO_DECODE] = XE_ENGINE_CLASS_VIDEO_DECODE,
+	[DRM_XE_ENGINE_CLASS_VIDEO_ENHANCE] = XE_ENGINE_CLASS_VIDEO_ENHANCE,
+	[DRM_XE_ENGINE_CLASS_COMPUTE] = XE_ENGINE_CLASS_COMPUTE,
+};
+
+struct xe_hw_engine *
+xe_hw_engine_lookup(struct xe_device *xe,
+		    struct drm_xe_engine_class_instance eci)
+{
+	unsigned int idx;
+
+	if (eci.engine_class > ARRAY_SIZE(user_to_xe_engine_class))
+		return NULL;
+
+	if (eci.gt_id >= xe->info.gt_count)
+		return NULL;
+
+	idx = array_index_nospec(eci.engine_class,
+				 ARRAY_SIZE(user_to_xe_engine_class));
+
+	return xe_gt_hw_engine(xe_device_get_gt(xe, eci.gt_id),
+			       user_to_xe_engine_class[idx],
+			       eci.engine_instance, true);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_hw_engine.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_hw_engine.h
@@ -9,6 +9,8 @@
 #include "xe_hw_engine_types.h"
 
 struct drm_printer;
+struct drm_xe_engine_class_instance;
+struct xe_device;
 
 #ifdef CONFIG_DRM_XE_JOB_TIMEOUT_MIN
 #define XE_HW_ENGINE_JOB_TIMEOUT_MIN CONFIG_DRM_XE_JOB_TIMEOUT_MIN
@@ -62,6 +64,11 @@
 void xe_hw_engine_setup_default_lrc_state(struct xe_hw_engine *hwe);
 
 bool xe_hw_engine_is_reserved(struct xe_hw_engine *hwe);
+
+struct xe_hw_engine *
+xe_hw_engine_lookup(struct xe_device *xe,
+		    struct drm_xe_engine_class_instance eci);
+
 static inline bool xe_hw_engine_is_valid(struct xe_hw_engine *hwe)
 {
 	return hwe->name;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_hwmon.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_hwmon.c
@@ -191,9 +191,10 @@
 				     PKG_PWR_LIM_1_EN, 0);
 
 		if (reg_val & PKG_PWR_LIM_1_EN) {
+			drm_warn(&gt_to_xe(hwmon->gt)->drm, "PL1 disable is not supported!\n");
 			ret = -EOPNOTSUPP;
-			goto unlock;
 		}
+		goto unlock;
 	}
 
 	/* Computation in 64-bits to avoid overflow. Round to nearest. */
@@ -288,7 +289,7 @@
 	 * As y can be < 2, we compute tau4 = (4 | x) << y
 	 * and then add 2 when doing the final right shift to account for units
 	 */
-	tau4 = ((1 << x_w) | x) << y;
+	tau4 = (u64)((1 << x_w) | x) << y;
 
 	/* val in hwmon interface units (millisec) */
 	out = mul_u64_u32_shr(tau4, SF_TIME, hwmon->scl_shift_time + x_w);
@@ -328,7 +329,7 @@
 	r = FIELD_PREP(PKG_MAX_WIN, PKG_MAX_WIN_DEFAULT);
 	x = REG_FIELD_GET(PKG_MAX_WIN_X, r);
 	y = REG_FIELD_GET(PKG_MAX_WIN_Y, r);
-	tau4 = ((1 << x_w) | x) << y;
+	tau4 = (u64)((1 << x_w) | x) << y;
 	max_win = mul_u64_u32_shr(tau4, SF_TIME, hwmon->scl_shift_time + x_w);
 
 	if (val > max_win)
@@ -426,7 +427,7 @@
 {
 	return xe_pcode_write(gt, PCODE_MBOX(PCODE_POWER_SETUP,
 			      POWER_SETUP_SUBCOMMAND_WRITE_I1, 0),
-			      uval);
+			      (uval & POWER_SETUP_I1_DATA_MASK));
 }
 
 static int xe_hwmon_power_curr_crit_read(struct xe_hwmon *hwmon, long *value, u32 scale_factor)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_lrc.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_lrc.c
@@ -5,6 +5,8 @@
 
 #include "xe_lrc.h"
 
+#include <generated/xe_wa_oob.h>
+
 #include "instructions/xe_mi_commands.h"
 #include "instructions/xe_gfxpipe_commands.h"
 #include "regs/xe_engine_regs.h"
@@ -20,6 +22,7 @@
 #include "xe_hw_fence.h"
 #include "xe_map.h"
 #include "xe_vm.h"
+#include "xe_wa.h"
 
 #define LRC_VALID				(1 << 0)
 #define LRC_PRIVILEGE				(1 << 8)
@@ -29,6 +32,17 @@
 #define ENGINE_CLASS_SHIFT			61
 #define ENGINE_INSTANCE_SHIFT			48
 
+struct xe_lrc_snapshot {
+	u32 context_desc;
+	u32 head;
+	struct {
+		u32 internal;
+		u32 memory;
+	} tail;
+	u32 start_seqno;
+	u32 seqno;
+};
+
 static struct xe_device *
 lrc_to_xe(struct xe_lrc *lrc)
 {
@@ -95,7 +109,6 @@
 #define REG16(x) \
 	(((x) >> 9) | BIT(7) | BUILD_BUG_ON_ZERO(x >= 0x10000)), \
 	(((x) >> 2) & 0x7f)
-#define END 0
 {
 	const u32 base = hwe->mmio_base;
 
@@ -166,7 +179,7 @@
 	REG16(0x274),
 	REG16(0x270),
 
-	END
+	0
 };
 
 static const u8 dg2_xcs_offsets[] = {
@@ -200,7 +213,7 @@
 	REG16(0x274),
 	REG16(0x270),
 
-	END
+	0
 };
 
 static const u8 gen12_rcs_offsets[] = {
@@ -296,7 +309,7 @@
 	REG(0x084),
 	NOP(1),
 
-	END
+	0
 };
 
 static const u8 xehp_rcs_offsets[] = {
@@ -337,7 +350,7 @@
 	LRI(1, 0),
 	REG(0x0c8),
 
-	END
+	0
 };
 
 static const u8 dg2_rcs_offsets[] = {
@@ -380,7 +393,7 @@
 	LRI(1, 0),
 	REG(0x0c8),
 
-	END
+	0
 };
 
 static const u8 mtl_rcs_offsets[] = {
@@ -423,7 +436,7 @@
 	LRI(1, 0),
 	REG(0x0c8),
 
-	END
+	0
 };
 
 #define XE2_CTX_COMMON \
@@ -469,7 +482,7 @@
 	LRI(1, 0),              /* [0x47] */
 	REG(0x0c8),             /* [0x48] R_PWR_CLK_STATE */
 
-	END
+	0
 };
 
 static const u8 xe2_bcs_offsets[] = {
@@ -480,16 +493,15 @@
 	REG16(0x200),           /* [0x42] BCS_SWCTRL */
 	REG16(0x204),           /* [0x44] BLIT_CCTL */
 
-	END
+	0
 };
 
 static const u8 xe2_xcs_offsets[] = {
 	XE2_CTX_COMMON,
 
-	END
+	0
 };
 
-#undef END
 #undef REG16
 #undef REG
 #undef LRI
@@ -525,9 +537,8 @@
 
 static void set_context_control(u32 *regs, struct xe_hw_engine *hwe)
 {
-	regs[CTX_CONTEXT_CONTROL] = _MASKED_BIT_ENABLE(CTX_CTRL_INHIBIT_SYN_CTX_SWITCH) |
-				    _MASKED_BIT_DISABLE(CTX_CTRL_ENGINE_CTX_RESTORE_INHIBIT) |
-				    CTX_CTRL_ENGINE_CTX_RESTORE_INHIBIT;
+	regs[CTX_CONTEXT_CONTROL] = _MASKED_BIT_ENABLE(CTX_CTRL_INHIBIT_SYN_CTX_SWITCH |
+						       CTX_CTRL_ENGINE_CTX_RESTORE_INHIBIT);
 
 	/* TODO: Timestamp */
 }
@@ -1217,19 +1228,31 @@
 	int state_table_size = 0;
 
 	/*
-	 * At the moment we only need to emit non-register state for the RCS
-	 * engine.
+	 * Wa_14019789679
+	 *
+	 * If the driver doesn't explicitly emit the SVG instructions while
+	 * setting up the default LRC, the context switch will write 0's
+	 * (noops) into the LRC memory rather than the expected instruction
+	 * headers.  Application contexts start out as a copy of the default
+	 * LRC, and if they also do not emit specific settings for some SVG
+	 * state, then on context restore they'll unintentionally inherit
+	 * whatever state setting the previous context had programmed into the
+	 * hardware (i.e., the lack of a 3DSTATE_* instruction in the LRC will
+	 * prevent the hardware from resetting that state back to any specific
+	 * value).
+	 *
+	 * The official workaround only requires emitting 3DSTATE_MESH_CONTROL
+	 * since that's a specific state setting that can easily cause GPU
+	 * hangs if unintentionally inherited.  However to be safe we'll
+	 * continue to emit all of the SVG state since it's best not to leak
+	 * any of the state between contexts, even if that leakage is harmless.
 	 */
-	if (q->hwe->class != XE_ENGINE_CLASS_RENDER)
-		return;
-
-	switch (GRAPHICS_VERx100(xe)) {
-	case 1255:
-	case 1270 ... 2004:
+	if (XE_WA(gt, 14019789679) && q->hwe->class == XE_ENGINE_CLASS_RENDER) {
 		state_table = xe_hpg_svg_state;
 		state_table_size = ARRAY_SIZE(xe_hpg_svg_state);
-		break;
-	default:
+	}
+
+	if (!state_table) {
 		xe_gt_dbg(gt, "No non-register state to emit on graphics ver %d.%02d\n",
 			  GRAPHICS_VER(xe), GRAPHICS_VERx100(xe) % 100);
 		return;
@@ -1262,3 +1285,37 @@
 		bb->len += num_dw;
 	}
 }
+
+struct xe_lrc_snapshot *xe_lrc_snapshot_capture(struct xe_lrc *lrc)
+{
+	struct xe_lrc_snapshot *snapshot = kmalloc(sizeof(*snapshot), GFP_NOWAIT);
+
+	if (!snapshot)
+		return NULL;
+
+	snapshot->context_desc = xe_lrc_ggtt_addr(lrc);
+	snapshot->head = xe_lrc_ring_head(lrc);
+	snapshot->tail.internal = lrc->ring.tail;
+	snapshot->tail.memory = xe_lrc_read_ctx_reg(lrc, CTX_RING_TAIL);
+	snapshot->start_seqno = xe_lrc_start_seqno(lrc);
+	snapshot->seqno = xe_lrc_seqno(lrc);
+	return snapshot;
+}
+
+void xe_lrc_snapshot_print(struct xe_lrc_snapshot *snapshot, struct drm_printer *p)
+{
+	if (!snapshot)
+		return;
+
+	drm_printf(p, "\tHW Context Desc: 0x%08x\n", snapshot->context_desc);
+	drm_printf(p, "\tLRC Head: (memory) %u\n", snapshot->head);
+	drm_printf(p, "\tLRC Tail: (internal) %u, (memory) %u\n",
+		   snapshot->tail.internal, snapshot->tail.memory);
+	drm_printf(p, "\tStart seqno: (memory) %d\n", snapshot->start_seqno);
+	drm_printf(p, "\tSeqno: (memory) %d\n", snapshot->seqno);
+}
+
+void xe_lrc_snapshot_free(struct xe_lrc_snapshot *snapshot)
+{
+	kfree(snapshot);
+}
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_lrc.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_lrc.h
@@ -55,4 +55,8 @@
 
 void xe_lrc_emit_hwe_state_instructions(struct xe_exec_queue *q, struct xe_bb *bb);
 
+struct xe_lrc_snapshot *xe_lrc_snapshot_capture(struct xe_lrc *lrc);
+void xe_lrc_snapshot_print(struct xe_lrc_snapshot *snapshot, struct drm_printer *p);
+void xe_lrc_snapshot_free(struct xe_lrc_snapshot *snapshot);
+
 #endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_lrc_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_lrc_types.h
@@ -43,4 +43,6 @@
 	struct xe_hw_fence_ctx fence_ctx;
 };
 
+struct xe_lrc_snapshot;
+
 #endif
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_migrate.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_migrate.c
@@ -32,7 +32,6 @@
 #include "xe_sync.h"
 #include "xe_trace.h"
 #include "xe_vm.h"
-#include "xe_wa.h"
 
 /**
  * struct xe_migrate - migrate context.
@@ -68,7 +67,7 @@
 
 #define MAX_PREEMPTDISABLE_TRANSFER SZ_8M /* Around 1ms. */
 #define MAX_CCS_LIMITED_TRANSFER SZ_4M /* XE_PAGE_SIZE * (FIELD_MAX(XE2_CCS_SIZE_MASK) + 1) */
-#define NUM_KERNEL_PDE 17
+#define NUM_KERNEL_PDE 15
 #define NUM_PT_SLOTS 32
 #define LEVEL0_PAGE_TABLE_ENCODE_SIZE SZ_2M
 
@@ -126,10 +125,11 @@
 	struct xe_device *xe = tile_to_xe(tile);
 	u16 pat_index = xe->pat.idx[XE_CACHE_WB];
 	u8 id = tile->id;
-	u32 num_entries = NUM_PT_SLOTS, num_level = vm->pt_root[id]->level;
+	u32 num_entries = NUM_PT_SLOTS, num_level = vm->pt_root[id]->level,
+	    num_setup = num_level + 1;
 	u32 map_ofs, level, i;
 	struct xe_bo *bo, *batch = tile->mem.kernel_bb_pool->bo;
-	u64 entry;
+	u64 entry, pt30_ofs;
 
 	/* Can't bump NUM_PT_SLOTS too high */
 	BUILD_BUG_ON(NUM_PT_SLOTS > SZ_2M/XE_PAGE_SIZE);
@@ -145,14 +145,17 @@
 				  num_entries * XE_PAGE_SIZE,
 				  ttm_bo_type_kernel,
 				  XE_BO_CREATE_VRAM_IF_DGFX(tile) |
-				  XE_BO_CREATE_PINNED_BIT);
+				  XE_BO_CREATE_PINNED_BIT |
+				  XE_BO_PAGETABLE);
 	if (IS_ERR(bo))
 		return PTR_ERR(bo);
 
-	entry = vm->pt_ops->pde_encode_bo(bo, bo->size - XE_PAGE_SIZE, pat_index);
+	/* PT31 reserved for 2M identity map */
+	pt30_ofs = bo->size - 2 * XE_PAGE_SIZE;
+	entry = vm->pt_ops->pde_encode_bo(bo, pt30_ofs, pat_index);
 	xe_pt_write(xe, &vm->pt_root[id]->bo->vmap, 0, entry);
 
-	map_ofs = (num_entries - num_level) * XE_PAGE_SIZE;
+	map_ofs = (num_entries - num_setup) * XE_PAGE_SIZE;
 
 	/* Map the entire BO in our level 0 pt */
 	for (i = 0, level = 0; i < num_entries; level++) {
@@ -216,15 +219,15 @@
 		if (vm->flags & XE_VM_FLAG_64K && level == 1)
 			flags = XE_PDE_64K;
 
-		entry = vm->pt_ops->pde_encode_bo(bo, map_ofs + (level - 1) *
+		entry = vm->pt_ops->pde_encode_bo(bo, map_ofs + (u64)(level - 1) *
 						  XE_PAGE_SIZE, pat_index);
 		xe_map_wr(xe, &bo->vmap, map_ofs + XE_PAGE_SIZE * level, u64,
 			  entry | flags);
 	}
 
 	/* Write PDE's that point to our BO. */
-	for (i = 0; i < num_entries - num_level; i++) {
-		entry = vm->pt_ops->pde_encode_bo(bo, i * XE_PAGE_SIZE,
+	for (i = 0; i < map_ofs / PAGE_SIZE; i++) {
+		entry = vm->pt_ops->pde_encode_bo(bo, (u64)i * XE_PAGE_SIZE,
 						  pat_index);
 
 		xe_map_wr(xe, &bo->vmap, map_ofs + XE_PAGE_SIZE +
@@ -241,28 +244,54 @@
 	/* Identity map the entire vram at 256GiB offset */
 	if (IS_DGFX(xe)) {
 		u64 pos, ofs, flags;
+		/* XXX: Unclear if this should be usable_size? */
+		u64 vram_limit =  xe->mem.vram.actual_physical_size +
+			xe->mem.vram.dpa_base;
 
 		level = 2;
 		ofs = map_ofs + XE_PAGE_SIZE * level + 256 * 8;
 		flags = vm->pt_ops->pte_encode_addr(xe, 0, pat_index, level,
 						    true, 0);
 
+		xe_assert(xe, IS_ALIGNED(xe->mem.vram.usable_size, SZ_2M));
+
 		/*
-		 * Use 1GB pages, it shouldn't matter the physical amount of
-		 * vram is less, when we don't access it.
+		 * Use 1GB pages when possible, last chunk always use 2M
+		 * pages as mixing reserved memory (stolen, WOCPM) with a single
+		 * mapping is not allowed on certain platforms.
 		 */
-		for (pos = xe->mem.vram.dpa_base;
-		     pos < xe->mem.vram.actual_physical_size + xe->mem.vram.dpa_base;
-		     pos += SZ_1G, ofs += 8)
+		for (pos = xe->mem.vram.dpa_base; pos < vram_limit;
+		     pos += SZ_1G, ofs += 8) {
+			if (pos + SZ_1G >= vram_limit) {
+				u64 pt31_ofs = bo->size - XE_PAGE_SIZE;
+
+				entry = vm->pt_ops->pde_encode_bo(bo, pt31_ofs,
+								  pat_index);
+				xe_map_wr(xe, &bo->vmap, ofs, u64, entry);
+
+				flags = vm->pt_ops->pte_encode_addr(xe, 0,
+								    pat_index,
+								    level - 1,
+								    true, 0);
+
+				for (ofs = pt31_ofs; pos < vram_limit;
+				     pos += SZ_2M, ofs += 8)
+					xe_map_wr(xe, &bo->vmap, ofs, u64, pos | flags);
+				break;	/* Ensure pos == vram_limit assert correct */
+			}
+
 			xe_map_wr(xe, &bo->vmap, ofs, u64, pos | flags);
+		}
+
+		xe_assert(xe, pos == vram_limit);
 	}
 
 	/*
 	 * Example layout created above, with root level = 3:
 	 * [PT0...PT7]: kernel PT's for copy/clear; 64 or 4KiB PTE's
 	 * [PT8]: Kernel PT for VM_BIND, 4 KiB PTE's
-	 * [PT9...PT28]: Userspace PT's for VM_BIND, 4 KiB PTE's
-	 * [PT29 = PDE 0] [PT30 = PDE 1] [PT31 = PDE 2]
+	 * [PT9...PT27]: Userspace PT's for VM_BIND, 4 KiB PTE's
+	 * [PT28 = PDE 0] [PT29 = PDE 1] [PT30 = PDE 2] [PT31 = 2M vram identity map]
 	 *
 	 * This makes the lowest part of the VM point to the pagetables.
 	 * Hence the lowest 2M in the vm should point to itself, with a few writes
@@ -280,7 +309,7 @@
 #define VM_SA_UPDATE_UNIT_SIZE		(XE_PAGE_SIZE / NUM_VMUSA_UNIT_PER_PAGE)
 #define NUM_VMUSA_WRITES_PER_UNIT	(VM_SA_UPDATE_UNIT_SIZE / sizeof(u64))
 	drm_suballoc_manager_init(&m->vm_update_sa,
-				  (map_ofs / XE_PAGE_SIZE - NUM_KERNEL_PDE) *
+				  (size_t)(map_ofs / XE_PAGE_SIZE - NUM_KERNEL_PDE) *
 				  NUM_VMUSA_UNIT_PER_PAGE, 0);
 
 	m->pt_bo = bo;
@@ -288,10 +317,6 @@
 }
 
 /*
- * Due to workaround 16017236439, odd instance hardware copy engines are
- * faster than even instance ones.
- * This function returns the mask involving all fast copy engines and the
- * reserved copy engine to be used as logical mask for migrate engine.
  * Including the reserved copy engine is required to avoid deadlocks due to
  * migrate jobs servicing the faults gets stuck behind the job that faulted.
  */
@@ -305,8 +330,7 @@
 		if (hwe->class != XE_ENGINE_CLASS_COPY)
 			continue;
 
-		if (!XE_WA(gt, 16017236439) ||
-		    xe_gt_is_usm_hwe(gt, hwe) || hwe->instance & 1)
+		if (xe_gt_is_usm_hwe(gt, hwe))
 			logical_mask |= BIT(hwe->logical_instance);
 	}
 
@@ -357,6 +381,10 @@
 		if (!hwe || !logical_mask)
 			return ERR_PTR(-EINVAL);
 
+		/*
+		 * XXX: Currently only reserving 1 (likely slow) BCS instance on
+		 * PVC, may want to revisit if performance is needed.
+		 */
 		m->q = xe_exec_queue_create(xe, vm, logical_mask, 1, hwe,
 					    EXEC_QUEUE_FLAG_KERNEL |
 					    EXEC_QUEUE_FLAG_PERMANENT |
@@ -479,7 +507,7 @@
 	struct xe_vm *vm = m->q->vm;
 	u16 pat_index;
 	u32 ptes;
-	u64 ofs = at_pt * XE_PAGE_SIZE;
+	u64 ofs = (u64)at_pt * XE_PAGE_SIZE;
 	u64 cur_ofs;
 
 	/* Indirect access needs compression enabled uncached PAT index */
@@ -1327,7 +1355,7 @@
 						 GFP_KERNEL, true, 0);
 			if (IS_ERR(sa_bo)) {
 				err = PTR_ERR(sa_bo);
-				goto err;
+				goto err_bb;
 			}
 
 			ppgtt_ofs = NUM_KERNEL_PDE +
@@ -1378,7 +1406,7 @@
 					 update_idx);
 	if (IS_ERR(job)) {
 		err = PTR_ERR(job);
-		goto err_bb;
+		goto err_sa;
 	}
 
 	/* Wait on BO move */
@@ -1427,12 +1455,12 @@
 
 err_job:
 	xe_sched_job_put(job);
+err_sa:
+	drm_suballoc_free(sa_bo, NULL);
 err_bb:
 	if (!q)
 		mutex_unlock(&m->job_mutex);
 	xe_bb_free(bb, NULL);
-err:
-	drm_suballoc_free(sa_bo, NULL);
 	return ERR_PTR(err);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_mmio.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_mmio.c
@@ -218,6 +218,21 @@
 	return xe_force_wake_put(gt_to_fw(gt), XE_FW_GT);
 }
 
+static void vram_fini(void *arg)
+{
+	struct xe_device *xe = arg;
+	struct xe_tile *tile;
+	int id;
+
+	if (xe->mem.vram.mapping)
+		iounmap(xe->mem.vram.mapping);
+
+	xe->mem.vram.mapping = NULL;
+
+	for_each_tile(tile, xe, id)
+		tile->mem.vram.mapping = NULL;
+}
+
 int xe_mmio_probe_vram(struct xe_device *xe)
 {
 	struct xe_tile *tile;
@@ -294,10 +309,21 @@
 	drm_info(&xe->drm, "Available VRAM: %pa, %pa\n", &xe->mem.vram.io_start,
 		 &available_size);
 
-	return 0;
+	return devm_add_action_or_reset(xe->drm.dev, vram_fini, xe);
+}
+
+static void tiles_fini(void *arg)
+{
+	struct xe_device *xe = arg;
+	struct xe_tile *tile;
+	int id;
+
+	for_each_tile(tile, xe, id)
+		if (tile != xe_device_get_root_tile(xe))
+			tile->mmio.regs = NULL;
 }
 
-void xe_mmio_probe_tiles(struct xe_device *xe)
+int xe_mmio_probe_tiles(struct xe_device *xe)
 {
 	size_t tile_mmio_size = SZ_16M, tile_mmio_ext_size = xe->info.tile_mmio_ext_size;
 	u8 id, tile_count = xe->info.tile_count;
@@ -348,15 +374,18 @@
 			regs += tile_mmio_ext_size;
 		}
 	}
+
+	return devm_add_action_or_reset(xe->drm.dev, tiles_fini, xe);
 }
 
-static void mmio_fini(struct drm_device *drm, void *arg)
+static void mmio_fini(void *arg)
 {
 	struct xe_device *xe = arg;
+	struct xe_tile *root_tile = xe_device_get_root_tile(xe);
 
 	pci_iounmap(to_pci_dev(xe->drm.dev), xe->mmio.regs);
-	if (xe->mem.vram.mapping)
-		iounmap(xe->mem.vram.mapping);
+	xe->mmio.regs = NULL;
+	root_tile->mmio.regs = NULL;
 }
 
 static int xe_verify_lmem_ready(struct xe_device *xe)
@@ -394,7 +423,7 @@
 		return -EIO;
 	}
 
-	return drmm_add_action_or_reset(&xe->drm, mmio_fini, xe);
+	return devm_add_action_or_reset(xe->drm.dev, mmio_fini, xe);
 }
 
 int xe_mmio_root_tile_init(struct xe_device *xe)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_mmio.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_mmio.h
@@ -22,7 +22,7 @@
 
 int xe_mmio_init(struct xe_device *xe);
 int xe_mmio_root_tile_init(struct xe_device *xe);
-void xe_mmio_probe_tiles(struct xe_device *xe);
+int xe_mmio_probe_tiles(struct xe_device *xe);
 
 static inline u8 xe_mmio_read8(struct xe_gt *gt, struct xe_reg reg)
 {
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_module.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_module.c
@@ -8,6 +8,8 @@
 #include <linux/init.h>
 #include <linux/module.h>
 
+#include <drm/drm_module.h>
+
 #include "xe_drv.h"
 #include "xe_hw_fence.h"
 #include "xe_pci.h"
@@ -48,6 +50,14 @@
 MODULE_PARM_DESC(force_probe,
 		 "Force probe options for specified devices. See CONFIG_DRM_XE_FORCE_PROBE for details.");
 
+static int xe_check_nomodeset(void)
+{
+	if (drm_firmware_drivers_only())
+		return -ENODEV;
+
+	return 0;
+}
+
 struct init_funcs {
 	int (*init)(void);
 	void (*exit)(void);
@@ -55,6 +65,9 @@
 
 static const struct init_funcs init_funcs[] = {
 	{
+		.init = xe_check_nomodeset,
+	},
+	{
 		.init = xe_hw_fence_module_init,
 		.exit = xe_hw_fence_module_exit,
 	},
@@ -68,15 +81,35 @@
 	},
 };
 
+static int __init xe_call_init_func(unsigned int i)
+{
+	if (WARN_ON(i >= ARRAY_SIZE(init_funcs)))
+		return 0;
+	if (!init_funcs[i].init)
+		return 0;
+
+	return init_funcs[i].init();
+}
+
+static void xe_call_exit_func(unsigned int i)
+{
+	if (WARN_ON(i >= ARRAY_SIZE(init_funcs)))
+		return;
+	if (!init_funcs[i].exit)
+		return;
+
+	init_funcs[i].exit();
+}
+
 static int __init xe_init(void)
 {
 	int err, i;
 
 	for (i = 0; i < ARRAY_SIZE(init_funcs); i++) {
-		err = init_funcs[i].init();
+		err = xe_call_init_func(i);
 		if (err) {
 			while (i--)
-				init_funcs[i].exit();
+				xe_call_exit_func(i);
 			return err;
 		}
 	}
@@ -89,7 +122,7 @@
 	int i;
 
 	for (i = ARRAY_SIZE(init_funcs) - 1; i >= 0; i--)
-		init_funcs[i].exit();
+		xe_call_exit_func(i);
 }
 
 module_init(xe_init);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_pat.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_pat.c
@@ -452,7 +452,7 @@
 {
 	struct xe_device *xe = gt_to_xe(gt);
 
-	if (!xe->pat.ops->dump)
+	if (!xe->pat.ops)
 		return;
 
 	xe->pat.ops->dump(gt, p);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_pci.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_pci.c
@@ -848,6 +848,8 @@
 	if (err)
 		return err;
 
+	pci_restore_state(pdev);
+
 	err = pci_enable_device(pdev);
 	if (err)
 		return err;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_pcode.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_pcode.c
@@ -10,6 +10,8 @@
 
 #include <drm/drm_managed.h>
 
+#include "xe_assert.h"
+#include "xe_device.h"
 #include "xe_gt.h"
 #include "xe_mmio.h"
 #include "xe_pcode_api.h"
@@ -43,8 +45,6 @@
 		[PCODE_ERROR_MASK] = {-EPROTO, "Unknown"},
 	};
 
-	lockdep_assert_held(&gt->pcode.lock);
-
 	err = xe_mmio_read32(gt, PCODE_MAILBOX) & PCODE_ERROR_MASK;
 	if (err) {
 		drm_err(&gt_to_xe(gt)->drm, "PCODE Mailbox failed: %d %s", err,
@@ -55,17 +55,15 @@
 	return 0;
 }
 
-static int pcode_mailbox_rw(struct xe_gt *gt, u32 mbox, u32 *data0, u32 *data1,
-			    unsigned int timeout_ms, bool return_data,
-			    bool atomic)
+static int __pcode_mailbox_rw(struct xe_gt *gt, u32 mbox, u32 *data0, u32 *data1,
+			      unsigned int timeout_ms, bool return_data,
+			      bool atomic)
 {
 	int err;
 
 	if (gt_to_xe(gt)->info.skip_pcode)
 		return 0;
 
-	lockdep_assert_held(&gt->pcode.lock);
-
 	if ((xe_mmio_read32(gt, PCODE_MAILBOX) & PCODE_READY) != 0)
 		return -EAGAIN;
 
@@ -87,6 +85,18 @@
 	return pcode_mailbox_status(gt);
 }
 
+static int pcode_mailbox_rw(struct xe_gt *gt, u32 mbox, u32 *data0, u32 *data1,
+			    unsigned int timeout_ms, bool return_data,
+			    bool atomic)
+{
+	if (gt_to_xe(gt)->info.skip_pcode)
+		return 0;
+
+	lockdep_assert_held(&gt->pcode.lock);
+
+	return __pcode_mailbox_rw(gt, mbox, data0, data1, timeout_ms, return_data, atomic);
+}
+
 int xe_pcode_write_timeout(struct xe_gt *gt, u32 mbox, u32 data, int timeout)
 {
 	int err;
@@ -109,15 +119,21 @@
 	return err;
 }
 
-static int xe_pcode_try_request(struct xe_gt *gt, u32 mbox,
-				u32 request, u32 reply_mask, u32 reply,
-				u32 *status, bool atomic, int timeout_us)
+static int pcode_try_request(struct xe_gt *gt, u32 mbox,
+			     u32 request, u32 reply_mask, u32 reply,
+			     u32 *status, bool atomic, int timeout_us, bool locked)
 {
 	int slept, wait = 10;
 
+	xe_gt_assert(gt, timeout_us > 0);
+
 	for (slept = 0; slept < timeout_us; slept += wait) {
-		*status = pcode_mailbox_rw(gt, mbox, &request, NULL, 1, true,
-					   atomic);
+		if (locked)
+			*status = pcode_mailbox_rw(gt, mbox, &request, NULL, 1, true,
+						   atomic);
+		else
+			*status = __pcode_mailbox_rw(gt, mbox, &request, NULL, 1, true,
+						     atomic);
 		if ((*status == 0) && ((request & reply_mask) == reply))
 			return 0;
 
@@ -156,10 +172,12 @@
 	u32 status;
 	int ret;
 
+	xe_gt_assert(gt, timeout_base_ms <= 3);
+
 	mutex_lock(&gt->pcode.lock);
 
-	ret = xe_pcode_try_request(gt, mbox, request, reply_mask, reply, &status,
-				   false, timeout_base_ms * 1000);
+	ret = pcode_try_request(gt, mbox, request, reply_mask, reply, &status,
+				false, timeout_base_ms * 1000, true);
 	if (!ret)
 		goto out;
 
@@ -175,10 +193,9 @@
 	 */
 	drm_err(&gt_to_xe(gt)->drm,
 		"PCODE timeout, retrying with preemption disabled\n");
-	drm_WARN_ON_ONCE(&gt_to_xe(gt)->drm, timeout_base_ms > 1);
 	preempt_disable();
-	ret = xe_pcode_try_request(gt, mbox, request, reply_mask, reply, &status,
-				   true, timeout_base_ms * 1000);
+	ret = pcode_try_request(gt, mbox, request, reply_mask, reply, &status,
+				true, 50 * 1000, true);
 	preempt_enable();
 
 out:
@@ -238,59 +255,71 @@
 }
 
 /**
- * xe_pcode_init - Ensure PCODE is initialized
- * @gt: gt instance
+ * xe_pcode_ready - Ensure PCODE is initialized
+ * @xe: xe instance
+ * @locked: true if lock held, false otherwise
  *
- * This function ensures that PCODE is properly initialized. To be called during
- * probe and resume paths.
+ * PCODE init mailbox is polled only on root gt of root tile
+ * as the root tile provides the initialization is complete only
+ * after all the tiles have completed the initialization.
+ * Called only on early probe without locks and with locks in
+ * resume path.
  *
- * It returns 0 on success, and -error number on failure.
+ * Returns 0 on success, and -error number on failure.
  */
-int xe_pcode_init(struct xe_gt *gt)
+int xe_pcode_ready(struct xe_device *xe, bool locked)
 {
 	u32 status, request = DGFX_GET_INIT_STATUS;
+	struct xe_gt *gt = xe_root_mmio_gt(xe);
 	int timeout_us = 180000000; /* 3 min */
 	int ret;
 
-	if (gt_to_xe(gt)->info.skip_pcode)
+	if (xe->info.skip_pcode)
 		return 0;
 
-	if (!IS_DGFX(gt_to_xe(gt)))
+	if (!IS_DGFX(xe))
 		return 0;
 
-	mutex_lock(&gt->pcode.lock);
-	ret = xe_pcode_try_request(gt, DGFX_PCODE_STATUS, request,
-				   DGFX_INIT_STATUS_COMPLETE,
-				   DGFX_INIT_STATUS_COMPLETE,
-				   &status, false, timeout_us);
-	mutex_unlock(&gt->pcode.lock);
+	if (locked)
+		mutex_lock(&gt->pcode.lock);
+
+	ret = pcode_try_request(gt, DGFX_PCODE_STATUS, request,
+				DGFX_INIT_STATUS_COMPLETE,
+				DGFX_INIT_STATUS_COMPLETE,
+				&status, false, timeout_us, locked);
+
+	if (locked)
+		mutex_unlock(&gt->pcode.lock);
 
 	if (ret)
-		drm_err(&gt_to_xe(gt)->drm,
+		drm_err(&xe->drm,
 			"PCODE initialization timedout after: 3 min\n");
 
 	return ret;
 }
 
 /**
- * xe_pcode_probe - Prepare xe_pcode and also ensure PCODE is initialized.
+ * xe_pcode_init: initialize components of PCODE
  * @gt: gt instance
  *
- * This function initializes the xe_pcode component, and when needed, it ensures
- * that PCODE has properly performed its initialization and it is really ready
- * to go. To be called once only during probe.
- *
- * It returns 0 on success, and -error number on failure.
+ * This function initializes the xe_pcode component.
+ * To be called once only during probe.
  */
-int xe_pcode_probe(struct xe_gt *gt)
+void xe_pcode_init(struct xe_gt *gt)
 {
 	drmm_mutex_init(&gt_to_xe(gt)->drm, &gt->pcode.lock);
+}
 
-	if (gt_to_xe(gt)->info.skip_pcode)
-		return 0;
-
-	if (!IS_DGFX(gt_to_xe(gt)))
-		return 0;
-
-	return xe_pcode_init(gt);
+/**
+ * xe_pcode_probe_early: initializes PCODE
+ * @xe: xe instance
+ *
+ * This function checks the initialization status of PCODE
+ * To be called once only during early probe without locks.
+ *
+ * Returns 0 on success, error code otherwise
+ */
+int xe_pcode_probe_early(struct xe_device *xe)
+{
+	return xe_pcode_ready(xe, false);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_pcode.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_pcode.h
@@ -8,9 +8,11 @@
 
 #include <linux/types.h>
 struct xe_gt;
+struct xe_device;
 
-int xe_pcode_probe(struct xe_gt *gt);
-int xe_pcode_init(struct xe_gt *gt);
+void xe_pcode_init(struct xe_gt *gt);
+int xe_pcode_probe_early(struct xe_device *xe);
+int xe_pcode_ready(struct xe_device *xe, bool locked);
 int xe_pcode_init_min_freq_table(struct xe_gt *gt, u32 min_gt_freq,
 				 u32 max_gt_freq);
 int xe_pcode_read(struct xe_gt *gt, u32 mbox, u32 *val, u32 *val1);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_pm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_pm.c
@@ -54,21 +54,23 @@
 	u8 id;
 	int err;
 
+	drm_dbg(&xe->drm, "Suspending device\n");
+
 	for_each_gt(gt, xe, id)
 		xe_gt_suspend_prepare(gt);
 
+	xe_display_pm_suspend(xe, false);
+
 	/* FIXME: Super racey... */
 	err = xe_bo_evict_all(xe);
 	if (err)
-		return err;
-
-	xe_display_pm_suspend(xe);
+		goto err;
 
 	for_each_gt(gt, xe, id) {
 		err = xe_gt_suspend(gt);
 		if (err) {
-			xe_display_pm_resume(xe);
-			return err;
+			xe_display_pm_resume(xe, false);
+			goto err;
 		}
 	}
 
@@ -76,7 +78,11 @@
 
 	xe_display_pm_suspend_late(xe);
 
+	drm_dbg(&xe->drm, "Device suspended\n");
 	return 0;
+err:
+	drm_dbg(&xe->drm, "Device suspend failed %d\n", err);
+	return err;
 }
 
 /**
@@ -92,14 +98,14 @@
 	u8 id;
 	int err;
 
+	drm_dbg(&xe->drm, "Resuming device\n");
+
 	for_each_tile(tile, xe, id)
 		xe_wa_apply_tile_workarounds(tile);
 
-	for_each_gt(gt, xe, id) {
-		err = xe_pcode_init(gt);
-		if (err)
-			return err;
-	}
+	err = xe_pcode_ready(xe, true);
+	if (err)
+		return err;
 
 	xe_display_pm_resume_early(xe);
 
@@ -109,20 +115,24 @@
 	 */
 	err = xe_bo_restore_kernel(xe);
 	if (err)
-		return err;
+		goto err;
 
 	xe_irq_resume(xe);
 
-	xe_display_pm_resume(xe);
-
 	for_each_gt(gt, xe, id)
 		xe_gt_resume(gt);
 
+	xe_display_pm_resume(xe, false);
+
 	err = xe_bo_restore_user(xe);
 	if (err)
-		return err;
+		goto err;
 
+	drm_dbg(&xe->drm, "Device resumed\n");
 	return 0;
+err:
+	drm_dbg(&xe->drm, "Device resume failed %d\n", err);
+	return err;
 }
 
 static bool xe_pm_pci_d3cold_capable(struct pci_dev *pdev)
@@ -248,6 +258,8 @@
 	lock_map_acquire(&xe_device_mem_access_lockdep_map);
 
 	if (xe->d3cold.allowed) {
+		xe_display_pm_suspend(xe, true);
+
 		err = xe_bo_evict_all(xe);
 		if (err)
 			goto out;
@@ -260,7 +272,12 @@
 	}
 
 	xe_irq_suspend(xe);
+
+	if (xe->d3cold.allowed)
+		xe_display_pm_suspend_late(xe);
 out:
+	if (err)
+		xe_display_pm_resume(xe, true);
 	lock_map_release(&xe_device_mem_access_lockdep_map);
 	xe_pm_write_callback_task(xe, NULL);
 	return err;
@@ -286,11 +303,11 @@
 	xe->d3cold.power_lost = xe_guc_in_reset(&gt->uc.guc);
 
 	if (xe->d3cold.allowed && xe->d3cold.power_lost) {
-		for_each_gt(gt, xe, id) {
-			err = xe_pcode_init(gt);
-			if (err)
-				goto out;
-		}
+		err = xe_pcode_ready(xe, true);
+		if (err)
+			goto out;
+
+		xe_display_pm_resume_early(xe);
 
 		/*
 		 * This only restores pinned memory which is the memory
@@ -307,6 +324,7 @@
 		xe_gt_resume(gt);
 
 	if (xe->d3cold.allowed && xe->d3cold.power_lost) {
+		xe_display_pm_resume(xe, true);
 		err = xe_bo_restore_user(xe);
 		if (err)
 			goto out;
@@ -330,7 +348,7 @@
 
 int xe_pm_runtime_get_if_active(struct xe_device *xe)
 {
-	return pm_runtime_get_if_active(xe->drm.dev, true);
+	return pm_runtime_get_if_active(xe->drm.dev);
 }
 
 void xe_pm_assert_unbounded_bridge(struct xe_device *xe)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_preempt_fence.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_preempt_fence.c
@@ -17,17 +17,31 @@
 		container_of(w, typeof(*pfence), preempt_work);
 	struct xe_exec_queue *q = pfence->q;
 
-	if (pfence->error)
+	if (pfence->error) {
 		dma_fence_set_error(&pfence->base, pfence->error);
-	else
-		q->ops->suspend_wait(q);
+	} else if (!q->ops->reset_status(q)) {
+		int err = q->ops->suspend_wait(q);
 
-	dma_fence_signal(&pfence->base);
-	dma_fence_end_signalling(cookie);
+		if (err)
+			dma_fence_set_error(&pfence->base, err);
+	} else {
+		dma_fence_set_error(&pfence->base, -ENOENT);
+	}
 
+	dma_fence_signal(&pfence->base);
+	/*
+	 * Opt for keep everything in the fence critical section. This looks really strange since we
+	 * have just signalled the fence, however the preempt fences are all signalled via single
+	 * global ordered-wq, therefore anything that happens in this callback can easily block
+	 * progress on the entire wq, which itself may prevent other published preempt fences from
+	 * ever signalling.  Therefore try to keep everything here in the callback in the fence
+	 * critical section. For example if something below grabs a scary lock like vm->lock,
+	 * lockdep should complain since we also hold that lock whilst waiting on preempt fences to
+	 * complete.
+	 */
 	xe_vm_queue_rebind_worker(q->vm);
-
 	xe_exec_queue_put(q);
+	dma_fence_end_signalling(cookie);
 }
 
 static const char *
@@ -49,7 +63,7 @@
 	struct xe_exec_queue *q = pfence->q;
 
 	pfence->error = q->ops->suspend(q);
-	queue_work(system_unbound_wq, &pfence->preempt_work);
+	queue_work(q->vm->xe->preempt_fence_wq, &pfence->preempt_work);
 	return true;
 }
 
@@ -120,8 +134,9 @@
 {
 	list_del_init(&pfence->link);
 	pfence->q = xe_exec_queue_get(q);
+	spin_lock_init(&pfence->lock);
 	dma_fence_init(&pfence->base, &preempt_fence_ops,
-		      &q->compute.lock, context, seqno);
+		      &pfence->lock, context, seqno);
 
 	return &pfence->base;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_preempt_fence_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_preempt_fence_types.h
@@ -25,6 +25,8 @@
 	struct xe_exec_queue *q;
 	/** @preempt_work: work struct which issues preemption */
 	struct work_struct preempt_work;
+	/** @lock: dma-fence fence lock */
+	spinlock_t lock;
 	/** @error: preempt fence is in error state */
 	int error;
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_pt.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_pt.c
@@ -1255,11 +1255,13 @@
 	 * non-faulting LR, in particular on user-space batch buffer chaining,
 	 * it needs to be done here.
 	 */
-	if ((rebind && !xe_vm_in_lr_mode(vm) && !vm->batch_invalidate_tlb) ||
-	    (!rebind && xe_vm_has_scratch(vm) && xe_vm_in_preempt_fence_mode(vm))) {
+	if ((!rebind && xe_vm_has_scratch(vm) && xe_vm_in_preempt_fence_mode(vm))) {
 		ifence = kzalloc(sizeof(*ifence), GFP_KERNEL);
 		if (!ifence)
 			return ERR_PTR(-ENOMEM);
+	} else if (rebind && !xe_vm_in_lr_mode(vm)) {
+		/* We bump also if batch_invalidate_tlb is true */
+		vm->tlb_flush_seqno++;
 	}
 
 	rfence = kzalloc(sizeof(*rfence), GFP_KERNEL);
@@ -1298,7 +1300,7 @@
 		}
 
 		/* add shared fence now for pagetable delayed destroy */
-		dma_resv_add_fence(xe_vm_resv(vm), fence, !rebind &&
+		dma_resv_add_fence(xe_vm_resv(vm), fence, rebind ||
 				   last_munmap_rebind ?
 				   DMA_RESV_USAGE_KERNEL :
 				   DMA_RESV_USAGE_BOOKKEEP);
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_query.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_query.c
@@ -132,7 +132,7 @@
 		return -EINVAL;
 
 	eci = &resp.eci;
-	if (eci->gt_id > XE_MAX_GT_PER_TILE)
+	if (eci->gt_id >= XE_MAX_GT_PER_TILE)
 		return -EINVAL;
 
 	gt = xe_device_get_gt(xe, eci->gt_id);
@@ -160,7 +160,11 @@
 
 	xe_force_wake_put(gt_to_fw(gt), XE_FORCEWAKE_ALL);
 	xe_device_mem_access_put(xe);
-	resp.width = 36;
+
+	if (GRAPHICS_VER(xe) >= 20)
+		resp.width = 64;
+	else
+		resp.width = 36;
 
 	/* Only write to the output fields of user query */
 	if (put_user(resp.cpu_timestamp, &query_ptr->cpu_timestamp))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_reg_sr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_reg_sr.c
@@ -26,46 +26,27 @@
 #include "xe_reg_whitelist.h"
 #include "xe_rtp_types.h"
 
-#define XE_REG_SR_GROW_STEP_DEFAULT	16
-
 static void reg_sr_fini(struct drm_device *drm, void *arg)
 {
 	struct xe_reg_sr *sr = arg;
+	struct xe_reg_sr_entry *entry;
+	unsigned long reg;
+
+	xa_for_each(&sr->xa, reg, entry)
+		kfree(entry);
 
 	xa_destroy(&sr->xa);
-	kfree(sr->pool.arr);
-	memset(&sr->pool, 0, sizeof(sr->pool));
 }
 
 int xe_reg_sr_init(struct xe_reg_sr *sr, const char *name, struct xe_device *xe)
 {
 	xa_init(&sr->xa);
-	memset(&sr->pool, 0, sizeof(sr->pool));
-	sr->pool.grow_step = XE_REG_SR_GROW_STEP_DEFAULT;
 	sr->name = name;
 
 	return drmm_add_action_or_reset(&xe->drm, reg_sr_fini, sr);
 }
 EXPORT_SYMBOL_IF_KUNIT(xe_reg_sr_init);
 
-static struct xe_reg_sr_entry *alloc_entry(struct xe_reg_sr *sr)
-{
-	if (sr->pool.used == sr->pool.allocated) {
-		struct xe_reg_sr_entry *arr;
-
-		arr = krealloc_array(sr->pool.arr,
-				     ALIGN(sr->pool.allocated + 1, sr->pool.grow_step),
-				     sizeof(*arr), GFP_KERNEL);
-		if (!arr)
-			return NULL;
-
-		sr->pool.arr = arr;
-		sr->pool.allocated += sr->pool.grow_step;
-	}
-
-	return &sr->pool.arr[sr->pool.used++];
-}
-
 static bool compatible_entries(const struct xe_reg_sr_entry *e1,
 			       const struct xe_reg_sr_entry *e2)
 {
@@ -111,7 +92,7 @@
 		return 0;
 	}
 
-	pentry = alloc_entry(sr);
+	pentry = kmalloc(sizeof(*pentry), GFP_KERNEL);
 	if (!pentry) {
 		ret = -ENOMEM;
 		goto fail;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_reg_sr_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_reg_sr_types.h
@@ -20,12 +20,6 @@
 };
 
 struct xe_reg_sr {
-	struct {
-		struct xe_reg_sr_entry *arr;
-		unsigned int used;
-		unsigned int allocated;
-		unsigned int grow_step;
-	} pool;
 	struct xarray xa;
 	const char *name;
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_ring_ops.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_ring_ops.c
@@ -78,6 +78,16 @@
 	return i;
 }
 
+static int emit_flush_dw(u32 *dw, int i)
+{
+	dw[i++] = MI_FLUSH_DW | MI_FLUSH_IMM_DW;
+	dw[i++] = 0;
+	dw[i++] = 0;
+	dw[i++] = 0;
+
+	return i;
+}
+
 static int emit_flush_imm_ggtt(u32 addr, u32 value, bool invalidate_tlb,
 			       u32 *dw, int i)
 {
@@ -227,10 +237,9 @@
 {
 	u32 dw[MAX_JOB_SIZE_DW], i = 0;
 	u32 ppgtt_flag = get_ppgtt_flag(job);
-	struct xe_vm *vm = job->q->vm;
 	struct xe_gt *gt = job->q->gt;
 
-	if (vm && vm->batch_invalidate_tlb) {
+	if (job->ring_ops_flush_tlb) {
 		dw[i++] = preparser_disable(true);
 		i = emit_flush_imm_ggtt(xe_lrc_start_seqno_ggtt_addr(lrc),
 					seqno, true, dw, i);
@@ -242,10 +251,12 @@
 
 	i = emit_bb_start(batch_addr, ppgtt_flag, dw, i);
 
-	if (job->user_fence.used)
+	if (job->user_fence.used) {
+		i = emit_flush_dw(dw, i);
 		i = emit_store_imm_ppgtt_posted(job->user_fence.addr,
 						job->user_fence.value,
 						dw, i);
+	}
 
 	i = emit_flush_imm_ggtt(xe_lrc_seqno_ggtt_addr(lrc), seqno, false, dw, i);
 
@@ -278,7 +289,6 @@
 	struct xe_gt *gt = job->q->gt;
 	struct xe_device *xe = gt_to_xe(gt);
 	bool decode = job->q->class == XE_ENGINE_CLASS_VIDEO_DECODE;
-	struct xe_vm *vm = job->q->vm;
 
 	dw[i++] = preparser_disable(true);
 
@@ -290,22 +300,24 @@
 			i = emit_aux_table_inv(gt, VE0_AUX_INV, dw, i);
 	}
 
-	if (vm && vm->batch_invalidate_tlb)
+	if (job->ring_ops_flush_tlb)
 		i = emit_flush_imm_ggtt(xe_lrc_start_seqno_ggtt_addr(lrc),
 					seqno, true, dw, i);
 
 	dw[i++] = preparser_disable(false);
 
-	if (!vm || !vm->batch_invalidate_tlb)
+	if (!job->ring_ops_flush_tlb)
 		i = emit_store_imm_ggtt(xe_lrc_start_seqno_ggtt_addr(lrc),
 					seqno, dw, i);
 
 	i = emit_bb_start(batch_addr, ppgtt_flag, dw, i);
 
-	if (job->user_fence.used)
+	if (job->user_fence.used) {
+		i = emit_flush_dw(dw, i);
 		i = emit_store_imm_ppgtt_posted(job->user_fence.addr,
 						job->user_fence.value,
 						dw, i);
+	}
 
 	i = emit_flush_imm_ggtt(xe_lrc_seqno_ggtt_addr(lrc), seqno, false, dw, i);
 
@@ -325,7 +337,6 @@
 	struct xe_gt *gt = job->q->gt;
 	struct xe_device *xe = gt_to_xe(gt);
 	bool lacks_render = !(gt->info.engine_mask & XE_HW_ENGINE_RCS_MASK);
-	struct xe_vm *vm = job->q->vm;
 	u32 mask_flags = 0;
 
 	dw[i++] = preparser_disable(true);
@@ -335,7 +346,7 @@
 		mask_flags = PIPE_CONTROL_3D_ENGINE_FLAGS;
 
 	/* See __xe_pt_bind_vma() for a discussion on TLB invalidations. */
-	i = emit_pipe_invalidate(mask_flags, vm && vm->batch_invalidate_tlb, dw, i);
+	i = emit_pipe_invalidate(mask_flags, job->ring_ops_flush_tlb, dw, i);
 
 	/* hsdes: 1809175790 */
 	if (has_aux_ccs(xe))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_rtp.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_rtp.c
@@ -200,7 +200,7 @@
 	if (first == last)
 		bitmap_set(ctx->active_entries, first, 1);
 	else
-		bitmap_set(ctx->active_entries, first, last - first + 2);
+		bitmap_set(ctx->active_entries, first, last - first + 1);
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_sched_job.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_sched_job.c
@@ -188,13 +188,14 @@
 {
 	struct xe_sched_job *job =
 		container_of(ref, struct xe_sched_job, refcount);
+	struct xe_exec_queue *q = job->q;
 
 	if (unlikely(job->q->flags & EXEC_QUEUE_FLAG_KERNEL))
 		xe_device_mem_access_put(job_to_xe(job));
-	xe_exec_queue_put(job->q);
 	dma_fence_put(job->fence);
 	drm_sched_job_cleanup(&job->drm);
 	job_free(job);
+	xe_exec_queue_put(q);
 }
 
 void xe_sched_job_set_error(struct xe_sched_job *job, int error)
@@ -250,6 +251,16 @@
 
 void xe_sched_job_arm(struct xe_sched_job *job)
 {
+	struct xe_exec_queue *q = job->q;
+	struct xe_vm *vm = q->vm;
+
+	if (vm && !xe_sched_job_is_migration(q) && !xe_vm_in_lr_mode(vm) &&
+	    (vm->batch_invalidate_tlb || vm->tlb_flush_seqno != q->tlb_flush_seqno)) {
+		xe_vm_assert_held(vm);
+		q->tlb_flush_seqno = vm->tlb_flush_seqno;
+		job->ring_ops_flush_tlb = true;
+	}
+
 	drm_sched_job_arm(&job->drm);
 }
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_sched_job_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_sched_job_types.h
@@ -39,6 +39,8 @@
 	} user_fence;
 	/** @migrate_flush_flags: Additional flush flags for migration jobs */
 	u32 migrate_flush_flags;
+	/** @ring_ops_flush_tlb: The ring ops need to flush TLB before payload. */
+	bool ring_ops_flush_tlb;
 	/** @batch_addr: batch buffer address of job */
 	u64 batch_addr[];
 };
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_sync.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_sync.c
@@ -54,7 +54,7 @@
 {
 	struct xe_user_fence *ufence;
 
-	ufence = kmalloc(sizeof(*ufence), GFP_KERNEL);
+	ufence = kzalloc(sizeof(*ufence), GFP_KERNEL);
 	if (!ufence)
 		return NULL;
 
@@ -80,8 +80,12 @@
 		mmput(ufence->mm);
 	}
 
-	wake_up_all(&ufence->xe->ufence_wq);
+	/*
+	 * Wake up waiters only after updating the ufence state, allowing the UMD
+	 * to safely reuse the same ufence without encountering -EBUSY errors.
+	 */
 	WRITE_ONCE(ufence->signalled, 1);
+	wake_up_all(&ufence->xe->ufence_wq);
 	user_fence_put(ufence);
 }
 
@@ -268,7 +272,7 @@
 	if (sync->fence)
 		dma_fence_put(sync->fence);
 	if (sync->chain_fence)
-		dma_fence_put(&sync->chain_fence->base);
+		dma_fence_chain_free(sync->chain_fence);
 	if (sync->ufence)
 		user_fence_put(sync->ufence);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_trace.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_trace.h
@@ -468,7 +468,7 @@
 	     TP_ARGS(vma)
 );
 
-DEFINE_EVENT(xe_vma, xe_vma_usm_invalidate,
+DEFINE_EVENT(xe_vma, xe_vma_invalidate,
 	     TP_PROTO(struct xe_vma *vma),
 	     TP_ARGS(vma)
 );
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c
@@ -205,6 +205,11 @@
 	u64 stolen_size, io_size, pgsize;
 	int err;
 
+	if (!mgr) {
+		drm_dbg_kms(&xe->drm, "Stolen mgr init failed\n");
+		return;
+	}
+
 	if (IS_DGFX(xe))
 		stolen_size = detect_bar2_dgfx(xe, mgr);
 	else if (GRAPHICS_VERx100(xe) >= 1270)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c
@@ -91,7 +91,7 @@
 
 	min_page_size = mgr->default_page_size;
 	if (tbo->page_alignment)
-		min_page_size = tbo->page_alignment << PAGE_SHIFT;
+		min_page_size = (u64)tbo->page_alignment << PAGE_SHIFT;
 
 	if (WARN_ON(min_page_size < mm->chunk_size)) {
 		err = -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_tuning.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_tuning.c
@@ -86,6 +86,14 @@
 				   REG_FIELD_PREP(L3_PWM_TIMER_INIT_VAL_MASK, 0x7f)))
 	},
 
+	/* Xe2_HPG */
+
+	{ XE_RTP_NAME("Tuning: vs hit max value"),
+	  XE_RTP_RULES(GRAPHICS_VERSION(2001), ENGINE_CLASS(RENDER)),
+	  XE_RTP_ACTIONS(FIELD_SET(FF_MODE, VS_HIT_MAX_VALUE_MASK,
+				   REG_FIELD_PREP(VS_HIT_MAX_VALUE_MASK, 0x3f)))
+	},
+
 	{}
 };
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_uc_fw.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_uc_fw.h
@@ -63,7 +63,7 @@
 	return "<invalid>";
 }
 
-static inline int xe_uc_fw_status_to_error(enum xe_uc_fw_status status)
+static inline int xe_uc_fw_status_to_error(const enum xe_uc_fw_status status)
 {
 	switch (status) {
 	case XE_UC_FIRMWARE_NOT_SUPPORTED:
@@ -105,7 +105,7 @@
 }
 
 static inline enum xe_uc_fw_status
-__xe_uc_fw_status(struct xe_uc_fw *uc_fw)
+__xe_uc_fw_status(const struct xe_uc_fw *uc_fw)
 {
 	/* shouldn't call this before checking hw/blob availability */
 	XE_WARN_ON(uc_fw->status == XE_UC_FIRMWARE_UNINITIALIZED);
@@ -152,6 +152,11 @@
 	return uc_fw->user_overridden;
 }
 
+static inline bool xe_uc_fw_is_in_error_state(const struct xe_uc_fw *uc_fw)
+{
+	return xe_uc_fw_status_to_error(__xe_uc_fw_status(uc_fw)) < 0;
+}
+
 static inline void xe_uc_fw_sanitize(struct xe_uc_fw *uc_fw)
 {
 	if (xe_uc_fw_is_loaded(uc_fw))
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_vm.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_vm.c
@@ -179,10 +179,10 @@
 	lockdep_assert_held(&vm->lock);
 	xe_vm_assert_held(vm);
 
-	list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) {
-		if (!q->compute.pfence ||
-		    (q->compute.pfence && test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
-						   &q->compute.pfence->flags))) {
+	list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) {
+		if (!q->lr.pfence ||
+		    test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
+			     &q->lr.pfence->flags)) {
 			return true;
 		}
 	}
@@ -225,14 +225,16 @@
 
 	xe_vm_assert_held(vm);
 
-	list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) {
-		if (q->compute.pfence) {
-			long timeout = dma_fence_wait(q->compute.pfence, false);
+	list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) {
+		if (q->lr.pfence) {
+			long timeout = dma_fence_wait(q->lr.pfence, false);
 
-			if (timeout < 0)
+			/* Only -ETIME on fence indicates VM needs to be killed */
+			if (timeout < 0 || q->lr.pfence->error == -ETIME)
 				return -ETIME;
-			dma_fence_put(q->compute.pfence);
-			q->compute.pfence = NULL;
+
+			dma_fence_put(q->lr.pfence);
+			q->lr.pfence = NULL;
 		}
 	}
 
@@ -244,7 +246,7 @@
 	struct xe_exec_queue *q;
 
 	xe_vm_assert_held(vm);
-	list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) {
+	list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) {
 		if (!xe_exec_queue_is_idle(q))
 			return false;
 	}
@@ -257,17 +259,17 @@
 	struct list_head *link;
 	struct xe_exec_queue *q;
 
-	list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) {
+	list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) {
 		struct dma_fence *fence;
 
 		link = list->next;
 		xe_assert(vm->xe, link != list);
 
 		fence = xe_preempt_fence_arm(to_preempt_fence_from_link(link),
-					     q, q->compute.context,
-					     ++q->compute.seqno);
-		dma_fence_put(q->compute.pfence);
-		q->compute.pfence = fence;
+					     q, q->lr.context,
+					     ++q->lr.seqno);
+		dma_fence_put(q->lr.pfence);
+		q->lr.pfence = fence;
 	}
 }
 
@@ -287,10 +289,10 @@
 	if (err)
 		goto out_unlock;
 
-	list_for_each_entry(q, &vm->preempt.exec_queues, compute.link)
-		if (q->compute.pfence) {
+	list_for_each_entry(q, &vm->preempt.exec_queues, lr.link)
+		if (q->lr.pfence) {
 			dma_resv_add_fence(bo->ttm.base.resv,
-					   q->compute.pfence,
+					   q->lr.pfence,
 					   DMA_RESV_USAGE_BOOKKEEP);
 		}
 
@@ -307,10 +309,10 @@
 	lockdep_assert_held(&vm->lock);
 	xe_vm_assert_held(vm);
 
-	list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) {
+	list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) {
 		q->ops->resume(q);
 
-		drm_gpuvm_resv_add_fence(&vm->gpuvm, exec, q->compute.pfence,
+		drm_gpuvm_resv_add_fence(&vm->gpuvm, exec, q->lr.pfence,
 					 DMA_RESV_USAGE_BOOKKEEP, DMA_RESV_USAGE_BOOKKEEP);
 	}
 }
@@ -334,16 +336,16 @@
 	if (err)
 		goto out_up_write;
 
-	pfence = xe_preempt_fence_create(q, q->compute.context,
-					 ++q->compute.seqno);
+	pfence = xe_preempt_fence_create(q, q->lr.context,
+					 ++q->lr.seqno);
 	if (!pfence) {
 		err = -ENOMEM;
 		goto out_fini;
 	}
 
-	list_add(&q->compute.link, &vm->preempt.exec_queues);
+	list_add(&q->lr.link, &vm->preempt.exec_queues);
 	++vm->preempt.num_exec_queues;
-	q->compute.pfence = pfence;
+	q->lr.pfence = pfence;
 
 	down_read(&vm->userptr.notifier_lock);
 
@@ -380,12 +382,12 @@
 		return;
 
 	down_write(&vm->lock);
-	list_del(&q->compute.link);
+	list_del(&q->lr.link);
 	--vm->preempt.num_exec_queues;
-	if (q->compute.pfence) {
-		dma_fence_enable_sw_signaling(q->compute.pfence);
-		dma_fence_put(q->compute.pfence);
-		q->compute.pfence = NULL;
+	if (q->lr.pfence) {
+		dma_fence_enable_sw_signaling(q->lr.pfence);
+		dma_fence_put(q->lr.pfence);
+		q->lr.pfence = NULL;
 	}
 	up_write(&vm->lock);
 }
@@ -411,6 +413,14 @@
 
 #define XE_VM_REBIND_RETRY_TIMEOUT_MS 1000
 
+/*
+ * xe_vm_kill() - VM Kill
+ * @vm: The VM.
+ * @unlocked: Flag indicates the VM's dma-resv is not held
+ *
+ * Kill the VM by setting banned flag indicated VM is no longer available for
+ * use. If in preempt fence mode, also kill all exec queue attached to the VM.
+ */
 static void xe_vm_kill(struct xe_vm *vm)
 {
 	struct xe_exec_queue *q;
@@ -421,7 +431,7 @@
 	vm->flags |= XE_VM_FLAG_BANNED;
 	trace_xe_vm_kill(vm);
 
-	list_for_each_entry(q, &vm->preempt.exec_queues, compute.link)
+	list_for_each_entry(q, &vm->preempt.exec_queues, lr.link)
 		q->ops->kill(q);
 	xe_vm_unlock(vm);
 
@@ -520,7 +530,6 @@
 {
 	struct xe_vm *vm = container_of(w, struct xe_vm, preempt.rebind_work);
 	struct drm_exec exec;
-	struct dma_fence *rebind_fence;
 	unsigned int fence_count = 0;
 	LIST_HEAD(preempt_fences);
 	ktime_t end = 0;
@@ -566,18 +575,11 @@
 	if (err)
 		goto out_unlock;
 
-	rebind_fence = xe_vm_rebind(vm, true);
-	if (IS_ERR(rebind_fence)) {
-		err = PTR_ERR(rebind_fence);
+	err = xe_vm_rebind(vm, true);
+	if (err)
 		goto out_unlock;
-	}
-
-	if (rebind_fence) {
-		dma_fence_wait(rebind_fence, false);
-		dma_fence_put(rebind_fence);
-	}
 
-	/* Wait on munmap style VM unbinds */
+	/* Wait on rebinds and munmap style VM unbinds */
 	wait = dma_resv_wait_timeout(xe_vm_resv(vm),
 				     DMA_RESV_USAGE_KERNEL,
 				     false, MAX_SCHEDULE_TIMEOUT);
@@ -706,6 +708,7 @@
 	int err = 0;
 	LIST_HEAD(tmp_evict);
 
+	xe_assert(vm->xe, !xe_vm_in_fault_mode(vm));
 	lockdep_assert_held_write(&vm->lock);
 
 	/* Collect invalidated userptrs */
@@ -722,11 +725,27 @@
 	list_for_each_entry_safe(uvma, next, &vm->userptr.repin_list,
 				 userptr.repin_link) {
 		err = xe_vma_userptr_pin_pages(uvma);
-		if (err < 0)
-			return err;
+		if (err == -EFAULT) {
+			list_del_init(&uvma->userptr.repin_link);
 
-		list_del_init(&uvma->userptr.repin_link);
-		list_move_tail(&uvma->vma.combined_links.rebind, &vm->rebind_list);
+			/* Wait for pending binds */
+			xe_vm_lock(vm, false);
+			dma_resv_wait_timeout(xe_vm_resv(vm),
+					      DMA_RESV_USAGE_BOOKKEEP,
+					      false, MAX_SCHEDULE_TIMEOUT);
+
+			err = xe_vm_invalidate_vma(&uvma->vma);
+			xe_vm_unlock(vm);
+			if (err)
+				return err;
+		} else {
+			if (err < 0)
+				return err;
+
+			list_del_init(&uvma->userptr.repin_link);
+			list_move_tail(&uvma->vma.combined_links.rebind,
+				       &vm->rebind_list);
+		}
 	}
 
 	return 0;
@@ -754,14 +773,14 @@
 	       struct xe_sync_entry *syncs, u32 num_syncs,
 	       bool first_op, bool last_op);
 
-struct dma_fence *xe_vm_rebind(struct xe_vm *vm, bool rebind_worker)
+int xe_vm_rebind(struct xe_vm *vm, bool rebind_worker)
 {
-	struct dma_fence *fence = NULL;
+	struct dma_fence *fence;
 	struct xe_vma *vma, *next;
 
 	lockdep_assert_held(&vm->lock);
 	if (xe_vm_in_lr_mode(vm) && !rebind_worker)
-		return NULL;
+		return 0;
 
 	xe_vm_assert_held(vm);
 	list_for_each_entry_safe(vma, next, &vm->rebind_list,
@@ -769,17 +788,17 @@
 		xe_assert(vm->xe, vma->tile_present);
 
 		list_del_init(&vma->combined_links.rebind);
-		dma_fence_put(fence);
 		if (rebind_worker)
 			trace_xe_vma_rebind_worker(vma);
 		else
 			trace_xe_vma_rebind_exec(vma);
 		fence = xe_vm_bind_vma(vma, NULL, NULL, 0, false, false);
 		if (IS_ERR(fence))
-			return fence;
+			return PTR_ERR(fence);
+		dma_fence_put(fence);
 	}
 
-	return fence;
+	return 0;
 }
 
 static void xe_vma_free(struct xe_vma *vma)
@@ -1558,7 +1577,6 @@
 		XE_WARN_ON(vm->pt_root[id]);
 
 	trace_xe_vm_free(vm);
-	dma_fence_put(vm->rebind_fence);
 	kfree(vm);
 }
 
@@ -1916,12 +1934,6 @@
 	if (IS_ERR(vm))
 		return PTR_ERR(vm);
 
-	mutex_lock(&xef->vm.lock);
-	err = xa_alloc(&xef->vm.xa, &id, vm, xa_limit_32b, GFP_KERNEL);
-	mutex_unlock(&xef->vm.lock);
-	if (err)
-		goto err_close_and_put;
-
 	if (xe->info.has_asid) {
 		mutex_lock(&xe->usm.lock);
 		err = xa_alloc_cyclic(&xe->usm.asid_to_vm, &asid, vm,
@@ -1929,12 +1941,11 @@
 				      &xe->usm.next_asid, GFP_KERNEL);
 		mutex_unlock(&xe->usm.lock);
 		if (err < 0)
-			goto err_free_id;
+			goto err_close_and_put;
 
 		vm->usm.asid = asid;
 	}
 
-	args->vm_id = id;
 	vm->xef = xef;
 
 	/* Record BO memory for VM pagetable created against client */
@@ -1947,12 +1958,17 @@
 	args->reserved[0] = xe_bo_main_addr(vm->pt_root[0]->bo, XE_PAGE_SIZE);
 #endif
 
-	return 0;
-
-err_free_id:
+	/* user id alloc must always be last in ioctl to prevent UAF */
 	mutex_lock(&xef->vm.lock);
-	xa_erase(&xef->vm.xa, id);
+	err = xa_alloc(&xef->vm.xa, &id, vm, xa_limit_32b, GFP_KERNEL);
 	mutex_unlock(&xef->vm.lock);
+	if (err)
+		goto err_close_and_put;
+
+	args->vm_id = id;
+
+	return 0;
+
 err_close_and_put:
 	xe_vm_close_and_put(vm);
 
@@ -2010,7 +2026,7 @@
 			return err;
 	}
 
-	if (vma->tile_mask != (vma->tile_present & ~vma->usm.tile_invalidated)) {
+	if (vma->tile_mask != (vma->tile_present & ~vma->tile_invalidated)) {
 		return xe_vm_bind(vm, vma, q, xe_vma_bo(vma), syncs, num_syncs,
 				  true, first_op, last_op);
 	} else {
@@ -3184,9 +3200,8 @@
 	u8 id;
 	int ret;
 
-	xe_assert(xe, xe_vm_in_fault_mode(xe_vma_vm(vma)));
 	xe_assert(xe, !xe_vma_is_null(vma));
-	trace_xe_vma_usm_invalidate(vma);
+	trace_xe_vma_invalidate(vma);
 
 	/* Check that we don't race with page-table updates */
 	if (IS_ENABLED(CONFIG_PROVE_LOCKING)) {
@@ -3224,7 +3239,7 @@
 		}
 	}
 
-	vma->usm.tile_invalidated = vma->tile_mask;
+	vma->tile_invalidated = vma->tile_mask;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_vm.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_vm.h
@@ -207,7 +207,7 @@
 
 int xe_vm_userptr_check_repin(struct xe_vm *vm);
 
-struct dma_fence *xe_vm_rebind(struct xe_vm *vm, bool rebind_worker);
+int xe_vm_rebind(struct xe_vm *vm, bool rebind_worker);
 
 int xe_vm_invalidate_vma(struct xe_vma *vma);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_vm_types.h
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_vm_types.h
@@ -83,11 +83,8 @@
 		struct work_struct destroy_work;
 	};
 
-	/** @usm: unified shared memory state */
-	struct {
-		/** @tile_invalidated: VMA has been invalidated */
-		u8 tile_invalidated;
-	} usm;
+	/** @tile_invalidated: VMA has been invalidated */
+	u8 tile_invalidated;
 
 	/** @tile_mask: Tile mask of where to create binding for this VMA */
 	u8 tile_mask;
@@ -174,9 +171,6 @@
 	 */
 	struct list_head rebind_list;
 
-	/** @rebind_fence: rebind fence from execbuf */
-	struct dma_fence *rebind_fence;
-
 	/**
 	 * @destroy_work: worker to destroy VM, needed as a dma_fence signaling
 	 * from an irq context can be last put and the destroy needs to be able
@@ -285,6 +279,11 @@
 		bool capture_once;
 	} error_capture;
 
+	/**
+	 * @tlb_flush_seqno: Required TLB flush seqno for the next exec.
+	 * protected by the vm resv.
+	 */
+	u64 tlb_flush_seqno;
 	/** @batch_invalidate_tlb: Always invalidate TLB before batch start */
 	bool batch_invalidate_tlb;
 	/** @xef: XE file handle for tracking this VM's drm client */
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_wa.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_wa.c
@@ -528,6 +528,14 @@
 	  XE_RTP_ACTIONS(SET(XEHP_HDC_CHICKEN0, DIS_ATOMIC_CHAINING_TYPED_WRITES,
 			     XE_RTP_NOCHECK))
 	},
+	{ XE_RTP_NAME("14021402888"),
+	  XE_RTP_RULES(GRAPHICS_VERSION(2001), ENGINE_CLASS(RENDER)),
+	  XE_RTP_ACTIONS(SET(HALF_SLICE_CHICKEN7, CLEAR_OPTIMIZATION_DISABLE))
+	},
+	{ XE_RTP_NAME("14021402888"),
+	  XE_RTP_RULES(GRAPHICS_VERSION(2004), ENGINE_CLASS(RENDER)),
+	  XE_RTP_ACTIONS(SET(HALF_SLICE_CHICKEN7, CLEAR_OPTIMIZATION_DISABLE))
+	},
 
 	/* PVC */
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_wa_oob.rules
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_wa_oob.rules
@@ -22,3 +22,5 @@
 14019821291	MEDIA_VERSION_RANGE(1300, 2000)
 14015076503	MEDIA_VERSION(1300)
 16020292621	GRAPHICS_VERSION(2004), GRAPHICS_STEP(A0, B0)
+14019789679	GRAPHICS_VERSION(1255)
+		GRAPHICS_VERSION_RANGE(1270, 2004)
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xe/xe_wait_user_fence.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xe/xe_wait_user_fence.c
@@ -155,6 +155,13 @@
 		}
 
 		if (!timeout) {
+			LNL_FLUSH_WORKQUEUE(xe->ordered_wq);
+			err = do_compare(addr, args->value, args->mask,
+					 args->op);
+			if (err <= 0) {
+				drm_dbg(&xe->drm, "LNL_FLUSH_WORKQUEUE resolved ufence timeout\n");
+				break;
+			}
 			err = -ETIME;
 			break;
 		}
@@ -169,9 +176,6 @@
 			args->timeout = 0;
 	}
 
-	if (!timeout && !(err < 0))
-		err = -ETIME;
-
 	if (q)
 		xe_exec_queue_put(q);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
@@ -256,12 +256,12 @@
 	if (ret)
 		goto err_dp;
 
+	drm_bridge_add(dpsub->bridge);
+
 	if (dpsub->dma_enabled) {
 		ret = zynqmp_dpsub_drm_init(dpsub);
 		if (ret)
 			goto err_disp;
-	} else {
-		drm_bridge_add(dpsub->bridge);
 	}
 
 	dev_info(&pdev->dev, "ZynqMP DisplayPort Subsystem driver probed");
@@ -269,6 +269,7 @@
 	return 0;
 
 err_disp:
+	drm_bridge_remove(dpsub->bridge);
 	zynqmp_disp_remove(dpsub);
 err_dp:
 	zynqmp_dp_remove(dpsub);
@@ -288,9 +289,8 @@
 
 	if (dpsub->drm)
 		zynqmp_dpsub_drm_cleanup(dpsub);
-	else
-		drm_bridge_remove(dpsub->bridge);
 
+	drm_bridge_remove(dpsub->bridge);
 	zynqmp_disp_remove(dpsub);
 	zynqmp_dp_remove(dpsub);
 
--- linux-qcom-6.8.0.orig/drivers/gpu/drm/xlnx/zynqmp_kms.c
+++ linux-qcom-6.8.0/drivers/gpu/drm/xlnx/zynqmp_kms.c
@@ -433,23 +433,28 @@
 				DRM_BRIDGE_ATTACH_NO_CONNECTOR);
 	if (ret) {
 		dev_err(dpsub->dev, "failed to attach bridge to encoder\n");
-		return ret;
+		goto err_encoder;
 	}
 
 	/* Create the connector for the chain of bridges. */
 	connector = drm_bridge_connector_init(&dpsub->drm->dev, encoder);
 	if (IS_ERR(connector)) {
 		dev_err(dpsub->dev, "failed to created connector\n");
-		return PTR_ERR(connector);
+		ret = PTR_ERR(connector);
+		goto err_encoder;
 	}
 
 	ret = drm_connector_attach_encoder(connector, encoder);
 	if (ret < 0) {
 		dev_err(dpsub->dev, "failed to attach connector to encoder\n");
-		return ret;
+		goto err_encoder;
 	}
 
 	return 0;
+
+err_encoder:
+	drm_encoder_cleanup(encoder);
+	return ret;
 }
 
 static void zynqmp_dpsub_drm_release(struct drm_device *drm, void *res)
@@ -500,12 +505,12 @@
 	if (ret)
 		return ret;
 
-	drm_kms_helper_poll_init(drm);
-
 	ret = zynqmp_dpsub_kms_init(dpsub);
 	if (ret < 0)
 		goto err_poll_fini;
 
+	drm_kms_helper_poll_init(drm);
+
 	/* Reset all components and register the DRM device. */
 	drm_mode_config_reset(drm);
 
@@ -527,7 +532,8 @@
 {
 	struct drm_device *drm = &dpsub->drm->dev;
 
-	drm_dev_unregister(drm);
+	drm_dev_unplug(drm);
 	drm_atomic_helper_shutdown(drm);
+	drm_encoder_cleanup(&dpsub->drm->encoder);
 	drm_kms_helper_poll_fini(drm);
 }
--- linux-qcom-6.8.0.orig/drivers/gpu/host1x/bus.c
+++ linux-qcom-6.8.0/drivers/gpu/host1x/bus.c
@@ -351,11 +351,6 @@
 	return 0;
 }
 
-static int host1x_dma_configure(struct device *dev)
-{
-	return of_dma_configure(dev, dev->of_node, true);
-}
-
 static const struct dev_pm_ops host1x_device_pm_ops = {
 	.suspend = pm_generic_suspend,
 	.resume = pm_generic_resume,
@@ -369,7 +364,6 @@
 	.name = "host1x",
 	.match = host1x_device_match,
 	.uevent = host1x_device_uevent,
-	.dma_configure = host1x_dma_configure,
 	.pm = &host1x_device_pm_ops,
 };
 
@@ -458,8 +452,6 @@
 	device->dev.bus = &host1x_bus_type;
 	device->dev.parent = host1x->dev;
 
-	of_dma_configure(&device->dev, host1x->dev->of_node, true);
-
 	device->dev.dma_parms = &device->dma_parms;
 	dma_set_max_seg_size(&device->dev, UINT_MAX);
 
--- linux-qcom-6.8.0.orig/drivers/greybus/interface.c
+++ linux-qcom-6.8.0/drivers/greybus/interface.c
@@ -694,6 +694,7 @@
 
 	trace_gb_interface_release(intf);
 
+	cancel_work_sync(&intf->mode_switch_work);
 	kfree(intf);
 }
 
--- linux-qcom-6.8.0.orig/drivers/hid/amd-sfh-hid/Kconfig
+++ linux-qcom-6.8.0/drivers/hid/amd-sfh-hid/Kconfig
@@ -6,6 +6,7 @@
 config AMD_SFH_HID
 	tristate "AMD Sensor Fusion Hub"
 	depends on HID
+	depends on X86
 	help
 	  If you say yes to this option, support will be included for the
 	  AMD Sensor Fusion Hub.
--- linux-qcom-6.8.0.orig/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+++ linux-qcom-6.8.0/drivers/hid/amd-sfh-hid/amd_sfh_client.c
@@ -236,9 +236,9 @@
 	cl_data->in_data = in_data;
 
 	for (i = 0; i < cl_data->num_hid_devices; i++) {
-		in_data->sensor_virt_addr[i] = dma_alloc_coherent(dev, sizeof(int) * 8,
-								  &cl_data->sensor_dma_addr[i],
-								  GFP_KERNEL);
+		in_data->sensor_virt_addr[i] = dmam_alloc_coherent(dev, sizeof(int) * 8,
+								   &cl_data->sensor_dma_addr[i],
+								   GFP_KERNEL);
 		if (!in_data->sensor_virt_addr[i]) {
 			rc = -ENOMEM;
 			goto cleanup;
@@ -288,12 +288,22 @@
 		mp2_ops->start(privdata, info);
 		cl_data->sensor_sts[i] = amd_sfh_wait_for_response
 						(privdata, cl_data->sensor_idx[i], SENSOR_ENABLED);
+
+		if (cl_data->sensor_sts[i] == SENSOR_ENABLED)
+			cl_data->is_any_sensor_enabled = true;
+	}
+
+	if (!cl_data->is_any_sensor_enabled ||
+	    (mp2_ops->discovery_status && mp2_ops->discovery_status(privdata) == 0)) {
+		dev_warn(dev, "Failed to discover, sensors not enabled is %d\n",
+			 cl_data->is_any_sensor_enabled);
+		rc = -EOPNOTSUPP;
+		goto cleanup;
 	}
 
 	for (i = 0; i < cl_data->num_hid_devices; i++) {
 		cl_data->cur_hid_dev = i;
 		if (cl_data->sensor_sts[i] == SENSOR_ENABLED) {
-			cl_data->is_any_sensor_enabled = true;
 			rc = amdtp_hid_probe(i, cl_data);
 			if (rc)
 				goto cleanup;
@@ -305,12 +315,6 @@
 			cl_data->sensor_sts[i]);
 	}
 
-	if (!cl_data->is_any_sensor_enabled ||
-	   (mp2_ops->discovery_status && mp2_ops->discovery_status(privdata) == 0)) {
-		dev_warn(dev, "Failed to discover, sensors not enabled is %d\n", cl_data->is_any_sensor_enabled);
-		rc = -EOPNOTSUPP;
-		goto cleanup;
-	}
 	schedule_delayed_work(&cl_data->work_buffer, msecs_to_jiffies(AMD_SFH_IDLE_LOOP));
 	return 0;
 
@@ -327,7 +331,6 @@
 int amd_sfh_hid_client_deinit(struct amd_mp2_dev *privdata)
 {
 	struct amdtp_cl_data *cl_data = privdata->cl_data;
-	struct amd_input_data *in_data = cl_data->in_data;
 	int i, status;
 
 	for (i = 0; i < cl_data->num_hid_devices; i++) {
@@ -347,12 +350,5 @@
 	cancel_delayed_work_sync(&cl_data->work_buffer);
 	amdtp_hid_remove(cl_data);
 
-	for (i = 0; i < cl_data->num_hid_devices; i++) {
-		if (in_data->sensor_virt_addr[i]) {
-			dma_free_coherent(&privdata->pdev->dev, 8 * sizeof(int),
-					  in_data->sensor_virt_addr[i],
-					  cl_data->sensor_dma_addr[i]);
-		}
-	}
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/hid/amd-sfh-hid/amd_sfh_common.h
+++ linux-qcom-6.8.0/drivers/hid/amd-sfh-hid/amd_sfh_common.h
@@ -19,6 +19,9 @@
 #define AMD_C2P_MSG(regno) (0x10500 + ((regno) * 4))
 #define AMD_P2C_MSG(regno) (0x10680 + ((regno) * 4))
 
+#define AMD_C2P_MSG_V1(regno) (0x10900 + ((regno) * 4))
+#define AMD_P2C_MSG_V1(regno) (0x10500 + ((regno) * 4))
+
 #define SENSOR_ENABLED			4
 #define SENSOR_DISABLED			5
 
@@ -53,6 +56,9 @@
 	/* mp2 active control status */
 	u32 mp2_acs;
 	struct sfh_dev_status dev_en;
+	struct work_struct work;
+	u8 init_done;
+	u8 rver;
 };
 
 struct amd_mp2_ops {
@@ -79,4 +85,14 @@
 int amd_sfh_irq_init_v2(struct amd_mp2_dev *privdata);
 void amd_sfh_clear_intr(struct amd_mp2_dev *privdata);
 int amd_sfh_irq_init(struct amd_mp2_dev *privdata);
+
+static inline u64 amd_get_c2p_val(struct amd_mp2_dev *mp2, u32 idx)
+{
+	return mp2->rver == 1 ? AMD_C2P_MSG_V1(idx) :  AMD_C2P_MSG(idx);
+}
+
+static inline u64 amd_get_p2c_val(struct amd_mp2_dev *mp2, u32 idx)
+{
+	return mp2->rver == 1 ? AMD_P2C_MSG_V1(idx) :  AMD_P2C_MSG(idx);
+}
 #endif
--- linux-qcom-6.8.0.orig/drivers/hid/amd-sfh-hid/amd_sfh_hid.c
+++ linux-qcom-6.8.0/drivers/hid/amd-sfh-hid/amd_sfh_hid.c
@@ -171,11 +171,13 @@
 void amdtp_hid_remove(struct amdtp_cl_data *cli_data)
 {
 	int i;
+	struct amdtp_hid_data *hid_data;
 
 	for (i = 0; i < cli_data->num_hid_devices; ++i) {
 		if (cli_data->hid_sensor_hubs[i]) {
-			kfree(cli_data->hid_sensor_hubs[i]->driver_data);
+			hid_data = cli_data->hid_sensor_hubs[i]->driver_data;
 			hid_destroy_device(cli_data->hid_sensor_hubs[i]);
+			kfree(hid_data);
 			cli_data->hid_sensor_hubs[i] = NULL;
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+++ linux-qcom-6.8.0/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
@@ -10,6 +10,7 @@
 
 #include <linux/bitops.h>
 #include <linux/delay.h>
+#include <linux/devm-helpers.h>
 #include <linux/dma-mapping.h>
 #include <linux/dmi.h>
 #include <linux/interrupt.h>
@@ -35,15 +36,17 @@
 module_param_named(sensor_mask, sensor_mask_override, int, 0444);
 MODULE_PARM_DESC(sensor_mask, "override the detected sensors mask");
 
+static bool intr_disable = true;
+
 static int amd_sfh_wait_response_v2(struct amd_mp2_dev *mp2, u8 sid, u32 sensor_sts)
 {
 	union cmd_response cmd_resp;
 
-	/* Get response with status within a max of 1600 ms timeout */
+	/* Get response with status within a max of 10 seconds timeout */
 	if (!readl_poll_timeout(mp2->mmio + AMD_P2C_MSG(0), cmd_resp.resp,
 				(cmd_resp.response_v2.response == sensor_sts &&
 				cmd_resp.response_v2.status == 0 && (sid == 0xff ||
-				cmd_resp.response_v2.sensor_id == sid)), 500, 1600000))
+				cmd_resp.response_v2.sensor_id == sid)), 500, 10000000))
 		return cmd_resp.response_v2.response;
 
 	return SENSOR_DISABLED;
@@ -55,7 +58,7 @@
 
 	cmd_base.ul = 0;
 	cmd_base.cmd_v2.cmd_id = ENABLE_SENSOR;
-	cmd_base.cmd_v2.intr_disable = 1;
+	cmd_base.cmd_v2.intr_disable = intr_disable;
 	cmd_base.cmd_v2.period = info.period;
 	cmd_base.cmd_v2.sensor_id = info.sensor_idx;
 	cmd_base.cmd_v2.length = 16;
@@ -73,7 +76,7 @@
 
 	cmd_base.ul = 0;
 	cmd_base.cmd_v2.cmd_id = DISABLE_SENSOR;
-	cmd_base.cmd_v2.intr_disable = 1;
+	cmd_base.cmd_v2.intr_disable = intr_disable;
 	cmd_base.cmd_v2.period = 0;
 	cmd_base.cmd_v2.sensor_id = sensor_idx;
 	cmd_base.cmd_v2.length  = 16;
@@ -87,7 +90,7 @@
 	union sfh_cmd_base cmd_base;
 
 	cmd_base.cmd_v2.cmd_id = STOP_ALL_SENSORS;
-	cmd_base.cmd_v2.intr_disable = 1;
+	cmd_base.cmd_v2.intr_disable = intr_disable;
 	cmd_base.cmd_v2.period = 0;
 	cmd_base.cmd_v2.sensor_id = 0;
 
@@ -96,9 +99,9 @@
 
 void amd_sfh_clear_intr_v2(struct amd_mp2_dev *privdata)
 {
-	if (readl(privdata->mmio + AMD_P2C_MSG(4))) {
-		writel(0, privdata->mmio + AMD_P2C_MSG(4));
-		writel(0xf, privdata->mmio + AMD_P2C_MSG(5));
+	if (readl(privdata->mmio + amd_get_p2c_val(privdata, 4))) {
+		writel(0, privdata->mmio + amd_get_p2c_val(privdata, 4));
+		writel(0xf, privdata->mmio + amd_get_p2c_val(privdata, 5));
 	}
 }
 
@@ -292,6 +295,26 @@
 	return 0;
 }
 
+static int mp2_disable_intr(const struct dmi_system_id *id)
+{
+	intr_disable = false;
+	return 0;
+}
+
+static const struct dmi_system_id dmi_sfh_table[] = {
+	{
+		/*
+		 * https://bugzilla.kernel.org/show_bug.cgi?id=218104
+		 */
+		.callback = mp2_disable_intr,
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook x360 435 G7"),
+		},
+	},
+	{}
+};
+
 static const struct dmi_system_id dmi_nodevs[] = {
 	{
 		/*
@@ -307,6 +330,48 @@
 	{ }
 };
 
+static void sfh1_1_init_work(struct work_struct *work)
+{
+	struct amd_mp2_dev *mp2 = container_of(work, struct amd_mp2_dev, work);
+	struct pci_dev *pdev = mp2->pdev;
+	int rc;
+
+	rc = mp2->sfh1_1_ops->init(mp2);
+	if (rc) {
+		dev_err(&pdev->dev, "sfh1_1_init failed err %d\n", rc);
+		return;
+	}
+
+	amd_sfh_clear_intr(mp2);
+	mp2->init_done = 1;
+}
+
+static void sfh_init_work(struct work_struct *work)
+{
+	struct amd_mp2_dev *mp2 = container_of(work, struct amd_mp2_dev, work);
+	struct pci_dev *pdev = mp2->pdev;
+	int rc;
+
+	rc = amd_sfh_hid_client_init(mp2);
+	if (rc) {
+		amd_sfh_clear_intr(mp2);
+		dev_err(&pdev->dev, "amd_sfh_hid_client_init failed err %d\n", rc);
+		return;
+	}
+
+	amd_sfh_clear_intr(mp2);
+	mp2->init_done = 1;
+}
+
+static void amd_sfh_remove(struct pci_dev *pdev)
+{
+	struct amd_mp2_dev *mp2 = pci_get_drvdata(pdev);
+
+	flush_work(&mp2->work);
+	if (mp2->init_done)
+		mp2->mp2_ops->remove(mp2);
+}
+
 static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
 	struct amd_mp2_dev *privdata;
@@ -315,6 +380,8 @@
 	if (dmi_first_match(dmi_nodevs))
 		return -ENODEV;
 
+	dmi_check_system(dmi_sfh_table);
+
 	privdata = devm_kzalloc(&pdev->dev, sizeof(*privdata), GFP_KERNEL);
 	if (!privdata)
 		return -ENOMEM;
@@ -343,10 +410,15 @@
 
 	privdata->sfh1_1_ops = (const struct amd_sfh1_1_ops *)id->driver_data;
 	if (privdata->sfh1_1_ops) {
-		rc = privdata->sfh1_1_ops->init(privdata);
+		if (boot_cpu_data.x86 >= 0x1A)
+			privdata->rver = 1;
+
+		rc = devm_work_autocancel(&pdev->dev, &privdata->work, sfh1_1_init_work);
 		if (rc)
 			return rc;
-		goto init_done;
+
+		schedule_work(&privdata->work);
+		return 0;
 	}
 
 	mp2_select_ops(privdata);
@@ -357,33 +429,34 @@
 		return rc;
 	}
 
-	rc = amd_sfh_hid_client_init(privdata);
+	rc = devm_work_autocancel(&pdev->dev, &privdata->work, sfh_init_work);
 	if (rc) {
 		amd_sfh_clear_intr(privdata);
-		if (rc != -EOPNOTSUPP)
-			dev_err(&pdev->dev, "amd_sfh_hid_client_init failed\n");
 		return rc;
 	}
 
-init_done:
-	amd_sfh_clear_intr(privdata);
-
-	return devm_add_action_or_reset(&pdev->dev, privdata->mp2_ops->remove, privdata);
+	schedule_work(&privdata->work);
+	return 0;
 }
 
 static void amd_sfh_shutdown(struct pci_dev *pdev)
 {
 	struct amd_mp2_dev *mp2 = pci_get_drvdata(pdev);
 
-	if (mp2 && mp2->mp2_ops)
-		mp2->mp2_ops->stop_all(mp2);
+	if (mp2) {
+		flush_work(&mp2->work);
+		if (mp2->init_done)
+			mp2->mp2_ops->stop_all(mp2);
+	}
 }
 
 static int __maybe_unused amd_mp2_pci_resume(struct device *dev)
 {
 	struct amd_mp2_dev *mp2 = dev_get_drvdata(dev);
 
-	mp2->mp2_ops->resume(mp2);
+	flush_work(&mp2->work);
+	if (mp2->init_done)
+		mp2->mp2_ops->resume(mp2);
 
 	return 0;
 }
@@ -392,7 +465,9 @@
 {
 	struct amd_mp2_dev *mp2 = dev_get_drvdata(dev);
 
-	mp2->mp2_ops->suspend(mp2);
+	flush_work(&mp2->work);
+	if (mp2->init_done)
+		mp2->mp2_ops->suspend(mp2);
 
 	return 0;
 }
@@ -414,6 +489,7 @@
 	.probe		= amd_mp2_pci_probe,
 	.driver.pm	= &amd_mp2_pm_ops,
 	.shutdown	= amd_sfh_shutdown,
+	.remove		= amd_sfh_remove,
 };
 module_pci_driver(amd_mp2_pci_driver);
 
--- linux-qcom-6.8.0.orig/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
+++ linux-qcom-6.8.0/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
@@ -90,10 +90,10 @@
 struct hpd_status {
 	union {
 		struct {
-			u32 human_presence_report : 4;
-			u32 human_presence_actual : 4;
-			u32 probablity		  : 8;
 			u32 object_distance       : 16;
+			u32 probablity		  : 8;
+			u32 human_presence_actual : 4;
+			u32 human_presence_report : 4;
 		} shpd;
 		u32 val;
 	};
--- linux-qcom-6.8.0.orig/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c
+++ linux-qcom-6.8.0/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c
@@ -251,7 +251,7 @@
 		break;
 	case HPD_IDX:
 		get_common_inputs(&hpd_input.common_property, report_id);
-		hpdstatus.val = readl(mp2->mmio + AMD_C2P_MSG(4));
+		hpdstatus.val = readl(mp2->mmio + amd_get_c2p_val(mp2, 4));
 		hpd_input.human_presence = hpdstatus.shpd.presence;
 		report_size = sizeof(hpd_input);
 		memcpy(input_report, &hpd_input, sizeof(hpd_input));
--- linux-qcom-6.8.0.orig/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c
+++ linux-qcom-6.8.0/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c
@@ -172,7 +172,7 @@
 		if (rc)
 			goto cleanup;
 
-		writel(0, privdata->mmio + AMD_P2C_MSG(0));
+		writel(0, privdata->mmio + amd_get_p2c_val(privdata, 0));
 		mp2_ops->start(privdata, info);
 		status = amd_sfh_wait_for_response
 				(privdata, cl_data->sensor_idx[i], ENABLE_SENSOR);
@@ -227,6 +227,11 @@
 	struct amd_mp2_sensor_info info;
 	int i, status;
 
+	if (!cl_data->is_any_sensor_enabled) {
+		amd_sfh_clear_intr(mp2);
+		return;
+	}
+
 	for (i = 0; i < cl_data->num_hid_devices; i++) {
 		if (cl_data->sensor_sts[i] == SENSOR_DISABLED) {
 			info.sensor_idx = cl_data->sensor_idx[i];
@@ -252,6 +257,11 @@
 	struct amdtp_cl_data *cl_data = mp2->cl_data;
 	int i, status;
 
+	if (!cl_data->is_any_sensor_enabled) {
+		amd_sfh_clear_intr(mp2);
+		return;
+	}
+
 	for (i = 0; i < cl_data->num_hid_devices; i++) {
 		if (cl_data->sensor_idx[i] != HPD_IDX &&
 		    cl_data->sensor_sts[i] == SENSOR_ENABLED) {
@@ -298,7 +308,7 @@
 
 int amd_sfh1_1_init(struct amd_mp2_dev *mp2)
 {
-	u32 phy_base = readl(mp2->mmio + AMD_C2P_MSG(22));
+	u32 phy_base = readl(mp2->mmio + amd_get_c2p_val(mp2, 22));
 	struct device *dev = &mp2->pdev->dev;
 	struct sfh_base_info binfo;
 	int rc;
--- linux-qcom-6.8.0.orig/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
+++ linux-qcom-6.8.0/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
@@ -20,7 +20,7 @@
 	struct sfh_cmd_response cmd_resp;
 
 	/* Get response with status within a max of 10000 ms timeout */
-	if (!readl_poll_timeout(mp2->mmio + AMD_P2C_MSG(0), cmd_resp.resp,
+	if (!readl_poll_timeout(mp2->mmio + amd_get_p2c_val(mp2, 0), cmd_resp.resp,
 				(cmd_resp.response.response == 0 &&
 				cmd_resp.response.cmd_id == cmd_id && (sid == 0xff ||
 				cmd_resp.response.sensor_id == sid)), 500, 10000000))
@@ -39,7 +39,7 @@
 	cmd_base.cmd.sub_cmd_value = 1;
 	cmd_base.cmd.sensor_id = info.sensor_idx;
 
-	writel(cmd_base.ul, privdata->mmio + AMD_C2P_MSG(0));
+	writel(cmd_base.ul, privdata->mmio + amd_get_c2p_val(privdata, 0));
 }
 
 static void amd_stop_sensor(struct amd_mp2_dev *privdata, u16 sensor_idx)
@@ -52,8 +52,8 @@
 	cmd_base.cmd.sub_cmd_value = 1;
 	cmd_base.cmd.sensor_id = sensor_idx;
 
-	writeq(0x0, privdata->mmio + AMD_C2P_MSG(1));
-	writel(cmd_base.ul, privdata->mmio + AMD_C2P_MSG(0));
+	writeq(0x0, privdata->mmio + amd_get_c2p_val(privdata, 1));
+	writel(cmd_base.ul, privdata->mmio + amd_get_c2p_val(privdata, 0));
 }
 
 static void amd_stop_all_sensor(struct amd_mp2_dev *privdata)
@@ -66,7 +66,7 @@
 	/* 0xf indicates all sensors */
 	cmd_base.cmd.sensor_id = 0xf;
 
-	writel(cmd_base.ul, privdata->mmio + AMD_C2P_MSG(0));
+	writel(cmd_base.ul, privdata->mmio + amd_get_c2p_val(privdata, 0));
 }
 
 static struct amd_mp2_ops amd_sfh_ops = {
--- linux-qcom-6.8.0.orig/drivers/hid/bpf/Kconfig
+++ linux-qcom-6.8.0/drivers/hid/bpf/Kconfig
@@ -3,7 +3,7 @@
 
 config HID_BPF
 	bool "HID-BPF support"
-	depends on BPF
+	depends on BPF_JIT
 	depends on BPF_SYSCALL
 	depends on DYNAMIC_FTRACE_WITH_DIRECT_CALLS
 	help
--- linux-qcom-6.8.0.orig/drivers/hid/hid-asus.c
+++ linux-qcom-6.8.0/drivers/hid/hid-asus.c
@@ -335,36 +335,20 @@
 	if (drvdata->quirks & QUIRK_MEDION_E1239T)
 		return asus_e1239t_event(drvdata, data, size);
 
-	if (drvdata->quirks & QUIRK_USE_KBD_BACKLIGHT) {
+	/*
+	 * Skip these report ID, the device emits a continuous stream associated
+	 * with the AURA mode it is in which looks like an 'echo'.
+	 */
+	if (report->id == FEATURE_KBD_LED_REPORT_ID1 || report->id == FEATURE_KBD_LED_REPORT_ID2)
+		return -1;
+	if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD) {
 		/*
-		 * Skip these report ID, the device emits a continuous stream associated
-		 * with the AURA mode it is in which looks like an 'echo'.
+		 * G713 and G733 send these codes on some keypresses, depending on
+		 * the key pressed it can trigger a shutdown event if not caught.
 		*/
-		if (report->id == FEATURE_KBD_LED_REPORT_ID1 ||
-				report->id == FEATURE_KBD_LED_REPORT_ID2) {
+		if (data[0] == 0x02 && data[1] == 0x30) {
 			return -1;
-		/* Additional report filtering */
-		} else if (report->id == FEATURE_KBD_REPORT_ID) {
-			/*
-			 * G14 and G15 send these codes on some keypresses with no
-			 * discernable reason for doing so. We'll filter them out to avoid
-			 * unmapped warning messages later.
-			*/
-			if (data[1] == 0xea || data[1] == 0xec || data[1] == 0x02 ||
-					data[1] == 0x8a || data[1] == 0x9e) {
-				return -1;
-			}
 		}
-		if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD) {
-			/*
-			 * G713 and G733 send these codes on some keypresses, depending on
-			 * the key pressed it can trigger a shutdown event if not caught.
-			*/
-			if(data[0] == 0x02 && data[1] == 0x30) {
-				return -1;
-			}
-		}
-
 	}
 
 	if (drvdata->quirks & QUIRK_ROG_CLAYMORE_II_KEYBOARD) {
@@ -897,7 +881,10 @@
 		case 0xb3: asus_map_key_clear(KEY_PROG3);	break; /* Fn+Left next aura */
 		case 0x6a: asus_map_key_clear(KEY_F13);		break; /* Screenpad toggle */
 		case 0x4b: asus_map_key_clear(KEY_F14);		break; /* Arrows/Pg-Up/Dn toggle */
-
+		case 0xa5: asus_map_key_clear(KEY_F15);		break; /* ROG Ally left back */
+		case 0xa6: asus_map_key_clear(KEY_F16);		break; /* ROG Ally QAM button */
+		case 0xa7: asus_map_key_clear(KEY_F17);		break; /* ROG Ally ROG long-press */
+		case 0xa8: asus_map_key_clear(KEY_F18);		break; /* ROG Ally ROG long-press-release */
 
 		default:
 			/* ASUS lazily declares 256 usages, ignore the rest,
@@ -1250,6 +1237,19 @@
 		rdesc[205] = 0x01;
 	}
 
+	/* match many more n-key devices */
+	if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD && *rsize > 15) {
+		for (int i = 0; i < *rsize - 15; i++) {
+			/* offset to the count from 0x5a report part always 14 */
+			if (rdesc[i] == 0x85 && rdesc[i + 1] == 0x5a &&
+			    rdesc[i + 14] == 0x95 && rdesc[i + 15] == 0x05) {
+				hid_info(hdev, "Fixing up Asus N-Key report descriptor\n");
+				rdesc[i + 15] = 0x01;
+				break;
+			}
+		}
+	}
+
 	return rdesc;
 }
 
@@ -1277,6 +1277,15 @@
 	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3),
 	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+	    USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR),
+	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY),
+	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X),
+	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
 	    USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD),
 	  QUIRK_ROG_CLAYMORE_II_KEYBOARD },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
@@ -1319,4 +1328,4 @@
 };
 module_hid_driver(asus_driver);
 
-MODULE_LICENSE("GPL");
\ No newline at end of file
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/hid/hid-core.c
+++ linux-qcom-6.8.0/drivers/hid/hid-core.c
@@ -1448,7 +1448,6 @@
 			hid_warn(hid,
 				 "%s() called with too large value %d (n: %d)! (%s)\n",
 				 __func__, value, n, current->comm);
-			WARN_ON(1);
 			value &= m;
 		}
 	}
@@ -1876,7 +1875,7 @@
 
 	u32 len = hid_report_len(report) + 7;
 
-	return kmalloc(len, flags);
+	return kzalloc(len, flags);
 }
 EXPORT_SYMBOL_GPL(hid_alloc_report_buf);
 
@@ -2608,9 +2607,10 @@
 	/*
 	 * hid-generic implements .match(), so we must be dealing with a
 	 * different HID driver here, and can simply check if
-	 * hid_ignore_special_drivers is set or not.
+	 * hid_ignore_special_drivers or HID_QUIRK_IGNORE_SPECIAL_DRIVER
+	 * are set or not.
 	 */
-	return !hid_ignore_special_drivers;
+	return !hid_ignore_special_drivers && !(hdev->quirks & HID_QUIRK_IGNORE_SPECIAL_DRIVER);
 }
 
 static int __hid_device_probe(struct hid_device *hdev, struct hid_driver *hdrv)
--- linux-qcom-6.8.0.orig/drivers/hid/hid-cougar.c
+++ linux-qcom-6.8.0/drivers/hid/hid-cougar.c
@@ -106,7 +106,7 @@
 static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 				 unsigned int *rsize)
 {
-	if (rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
+	if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
 	    (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) {
 		hid_info(hdev,
 			"usage count exceeds max: fixing up report descriptor\n");
--- linux-qcom-6.8.0.orig/drivers/hid/hid-debug.c
+++ linux-qcom-6.8.0/drivers/hid/hid-debug.c
@@ -974,6 +974,8 @@
 	[KEY_CAMERA_ACCESS_ENABLE] = "CameraAccessEnable",
 	[KEY_CAMERA_ACCESS_DISABLE] = "CameraAccessDisable",
 	[KEY_CAMERA_ACCESS_TOGGLE] = "CameraAccessToggle",
+	[KEY_ACCESSIBILITY] = "Accessibility",
+	[KEY_DO_NOT_DISTURB] = "DoNotDisturb",
 	[KEY_DICTATE] = "Dictate",
 	[KEY_MICMUTE] = "MicrophoneMute",
 	[KEY_BRIGHTNESS_MIN] = "BrightnessMin",
--- linux-qcom-6.8.0.orig/drivers/hid/hid-generic.c
+++ linux-qcom-6.8.0/drivers/hid/hid-generic.c
@@ -40,6 +40,9 @@
 	if (ignore_special_driver)
 		return true;
 
+	if (hdev->quirks & HID_QUIRK_IGNORE_SPECIAL_DRIVER)
+		return true;
+
 	if (hdev->quirks & HID_QUIRK_HAVE_SPECIAL_DRIVER)
 		return false;
 
--- linux-qcom-6.8.0.orig/drivers/hid/hid-hyperv.c
+++ linux-qcom-6.8.0/drivers/hid/hid-hyperv.c
@@ -422,6 +422,25 @@
 	return 0;
 }
 
+static int mousevsc_hid_probe(struct hid_device *hid_dev, const struct hid_device_id *id)
+{
+	int ret;
+
+	ret = hid_parse(hid_dev);
+	if (ret) {
+		hid_err(hid_dev, "parse failed\n");
+		return ret;
+	}
+
+	ret = hid_hw_start(hid_dev, HID_CONNECT_HIDINPUT | HID_CONNECT_HIDDEV);
+	if (ret) {
+		hid_err(hid_dev, "hw start failed\n");
+		return ret;
+	}
+
+	return 0;
+}
+
 static const struct hid_ll_driver mousevsc_ll_driver = {
 	.parse = mousevsc_hid_parse,
 	.open = mousevsc_hid_open,
@@ -431,7 +450,16 @@
 	.raw_request = mousevsc_hid_raw_request,
 };
 
-static struct hid_driver mousevsc_hid_driver;
+static const struct hid_device_id mousevsc_devices[] = {
+	{ HID_DEVICE(BUS_VIRTUAL, HID_GROUP_ANY, 0x045E, 0x0621) },
+	{ }
+};
+
+static struct hid_driver mousevsc_hid_driver = {
+	.name = "hid-hyperv",
+	.id_table = mousevsc_devices,
+	.probe = mousevsc_hid_probe,
+};
 
 static int mousevsc_probe(struct hv_device *device,
 			const struct hv_vmbus_device_id *dev_id)
@@ -473,7 +501,6 @@
 	}
 
 	hid_dev->ll_driver = &mousevsc_ll_driver;
-	hid_dev->driver = &mousevsc_hid_driver;
 	hid_dev->bus = BUS_VIRTUAL;
 	hid_dev->vendor = input_dev->hid_dev_info.vendor;
 	hid_dev->product = input_dev->hid_dev_info.product;
@@ -488,20 +515,6 @@
 	if (ret)
 		goto probe_err2;
 
-
-	ret = hid_parse(hid_dev);
-	if (ret) {
-		hid_err(hid_dev, "parse failed\n");
-		goto probe_err2;
-	}
-
-	ret = hid_hw_start(hid_dev, HID_CONNECT_HIDINPUT | HID_CONNECT_HIDDEV);
-
-	if (ret) {
-		hid_err(hid_dev, "hw start failed\n");
-		goto probe_err2;
-	}
-
 	device_init_wakeup(&device->device, true);
 
 	input_dev->connected = true;
@@ -579,12 +592,23 @@
 
 static int __init mousevsc_init(void)
 {
-	return vmbus_driver_register(&mousevsc_drv);
+	int ret;
+
+	ret = hid_register_driver(&mousevsc_hid_driver);
+	if (ret)
+		return ret;
+
+	ret = vmbus_driver_register(&mousevsc_drv);
+	if (ret)
+		hid_unregister_driver(&mousevsc_hid_driver);
+
+	return ret;
 }
 
 static void __exit mousevsc_exit(void)
 {
 	vmbus_driver_unregister(&mousevsc_drv);
+	hid_unregister_driver(&mousevsc_hid_driver);
 }
 
 MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/hid/hid-ids.h
+++ linux-qcom-6.8.0/drivers/hid/hid-ids.h
@@ -94,6 +94,7 @@
 #define USB_DEVICE_ID_APPLE_MAGICMOUSE2	0x0269
 #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD	0x030e
 #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD2	0x0265
+#define USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC	0x0324
 #define USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI	0x020e
 #define USB_DEVICE_ID_APPLE_FOUNTAIN_ISO	0x020f
 #define USB_DEVICE_ID_APPLE_GEYSER_ANSI	0x0214
@@ -208,6 +209,9 @@
 #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD	0x1866
 #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2	0x19b6
 #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3	0x1a30
+#define USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR		0x18c6
+#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY		0x1abe
+#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X		0x1b4c
 #define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD	0x196b
 #define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD	0x1869
 
@@ -414,22 +418,9 @@
 #define USB_DEVICE_ID_TOSHIBA_CLICK_L9W	0x0401
 #define USB_DEVICE_ID_HP_X2		0x074d
 #define USB_DEVICE_ID_HP_X2_10_COVER	0x0755
-#define I2C_DEVICE_ID_HP_ENVY_X360_15	0x2d05
-#define I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100	0x29CF
-#define I2C_DEVICE_ID_HP_ENVY_X360_EU0009NV	0x2CF9
-#define I2C_DEVICE_ID_HP_SPECTRE_X360_15	0x2817
-#define I2C_DEVICE_ID_HP_SPECTRE_X360_13_AW0020NG  0x29DF
-#define I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN 0x2BC8
-#define I2C_DEVICE_ID_ASUS_GV301RA_TOUCHSCREEN 0x2C82
 #define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN	0x2544
 #define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN	0x2706
-#define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN	0x261A
-#define I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN	0x2A1C
-#define I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN	0x279F
-#define I2C_DEVICE_ID_HP_SPECTRE_X360_13T_AW100	0x29F5
-#define I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V1	0x2BED
-#define I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V2	0x2BEE
-#define I2C_DEVICE_ID_HP_ENVY_X360_15_EU0556NG		0x2D02
+#define I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM	0x2F81
 
 #define USB_VENDOR_ID_ELECOM		0x056e
 #define USB_DEVICE_ID_ELECOM_BM084	0x0061
@@ -515,7 +506,10 @@
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
 
 #define I2C_VENDOR_ID_GOODIX		0x27c6
+#define I2C_DEVICE_ID_GOODIX_01E8	0x01e8
+#define I2C_DEVICE_ID_GOODIX_01E9	0x01e9
 #define I2C_DEVICE_ID_GOODIX_01F0	0x01f0
+#define I2C_DEVICE_ID_GOODIX_0D42	0x0d42
 
 #define USB_VENDOR_ID_GOODTOUCH		0x1aad
 #define USB_DEVICE_ID_GOODTOUCH_000f	0x000f
@@ -802,6 +796,7 @@
 #define USB_DEVICE_ID_LENOVO_X1_TAB	0x60a3
 #define USB_DEVICE_ID_LENOVO_X1_TAB3	0x60b5
 #define USB_DEVICE_ID_LENOVO_X12_TAB	0x60fe
+#define USB_DEVICE_ID_LENOVO_X12_TAB2	0x61ae
 #define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E	0x600e
 #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D	0x608d
 #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019	0x6019
@@ -822,6 +817,7 @@
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
 #define USB_DEVICE_ID_LOGITECH_T651	0xb00c
 #define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD	0xb309
+#define USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD	0xbb00
 #define USB_DEVICE_ID_LOGITECH_C007	0xc007
 #define USB_DEVICE_ID_LOGITECH_C077	0xc077
 #define USB_DEVICE_ID_LOGITECH_RECEIVER	0xc101
@@ -873,6 +869,7 @@
 #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1	0xc539
 #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1	0xc53f
 #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY	0xc53a
+#define USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER	0xc548
 #define USB_DEVICE_ID_SPACETRAVELLER	0xc623
 #define USB_DEVICE_ID_SPACENAVIGATOR	0xc626
 #define USB_DEVICE_ID_DINOVO_DESKTOP	0xc704
@@ -1041,6 +1038,8 @@
 #define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES	0xc056
 #define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES	0xc057
 #define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES	0xc058
+#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3325_SERIES	0x430c
+#define USB_DEVICE_ID_PLANTRONICS_ENCOREPRO_500_SERIES		0x431e
 
 #define USB_VENDOR_ID_PANASONIC		0x04da
 #define USB_DEVICE_ID_PANABOARD_UBT780	0x1044
--- linux-qcom-6.8.0.orig/drivers/hid/hid-input.c
+++ linux-qcom-6.8.0/drivers/hid/hid-input.c
@@ -373,10 +373,6 @@
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
 		USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
 	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_GV301RA_TOUCHSCREEN),
-	  HID_BATTERY_QUIRK_IGNORE },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN),
 	  HID_BATTERY_QUIRK_IGNORE },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN),
@@ -387,30 +383,13 @@
 	  HID_BATTERY_QUIRK_AVOID_QUERY },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW),
 	  HID_BATTERY_QUIRK_AVOID_QUERY },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_EU0009NV),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_15),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_13_AW0020NG),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_13T_AW100),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V1),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V2),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15_EU0556NG),
-	  HID_BATTERY_QUIRK_IGNORE },
+	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM),
+	  HID_BATTERY_QUIRK_AVOID_QUERY },
+	/*
+	 * Elan I2C-HID touchscreens seem to all report a non present battery,
+	 * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices.
+	 */
+	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
 	{}
 };
 
@@ -831,9 +810,18 @@
 			break;
 		}
 
+		if ((usage->hid & 0xf0) == 0x90) { /* SystemControl*/
+			switch (usage->hid & 0xf) {
+			case 0xb: map_key_clear(KEY_DO_NOT_DISTURB); break;
+			default: goto ignore;
+			}
+			break;
+		}
+
 		if ((usage->hid & 0xf0) == 0xa0) {	/* SystemControl */
 			switch (usage->hid & 0xf) {
 			case 0x9: map_key_clear(KEY_MICMUTE); break;
+			case 0xa: map_key_clear(KEY_ACCESSIBILITY); break;
 			default: goto ignore;
 			}
 			break;
--- linux-qcom-6.8.0.orig/drivers/hid/hid-lenovo.c
+++ linux-qcom-6.8.0/drivers/hid/hid-lenovo.c
@@ -54,10 +54,10 @@
 	/* 0: Up
 	 * 1: Down (undecided)
 	 * 2: Scrolling
-	 * 3: Patched firmware, disable workaround
 	 */
 	u8 middlebutton_state;
 	bool fn_lock;
+	bool middleclick_workaround_cptkbd;
 };
 
 #define map_key_clear(c) hid_map_usage_clear(hi, usage, bit, max, EV_KEY, (c))
@@ -473,6 +473,7 @@
 		return lenovo_input_mapping_tp10_ultrabook_kbd(hdev, hi, field,
 							       usage, bit, max);
 	case USB_DEVICE_ID_LENOVO_X1_TAB:
+	case USB_DEVICE_ID_LENOVO_X1_TAB3:
 		return lenovo_input_mapping_x1_tab_kbd(hdev, hi, field, usage, bit, max);
 	default:
 		return 0;
@@ -583,6 +584,7 @@
 		break;
 	case USB_DEVICE_ID_LENOVO_TP10UBKBD:
 	case USB_DEVICE_ID_LENOVO_X1_TAB:
+	case USB_DEVICE_ID_LENOVO_X1_TAB3:
 		ret = lenovo_led_set_tp10ubkbd(hdev, TP10UBKBD_FN_LOCK_LED, value);
 		if (ret)
 			return ret;
@@ -621,6 +623,36 @@
 	return count;
 }
 
+static ssize_t attr_middleclick_workaround_show_cptkbd(struct device *dev,
+		struct device_attribute *attr,
+		char *buf)
+{
+	struct hid_device *hdev = to_hid_device(dev);
+	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
+
+	return snprintf(buf, PAGE_SIZE, "%u\n",
+		cptkbd_data->middleclick_workaround_cptkbd);
+}
+
+static ssize_t attr_middleclick_workaround_store_cptkbd(struct device *dev,
+		struct device_attribute *attr,
+		const char *buf,
+		size_t count)
+{
+	struct hid_device *hdev = to_hid_device(dev);
+	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
+	int value;
+
+	if (kstrtoint(buf, 10, &value))
+		return -EINVAL;
+	if (value < 0 || value > 1)
+		return -EINVAL;
+
+	cptkbd_data->middleclick_workaround_cptkbd = !!value;
+
+	return count;
+}
+
 
 static struct device_attribute dev_attr_fn_lock =
 	__ATTR(fn_lock, S_IWUSR | S_IRUGO,
@@ -632,10 +664,16 @@
 			attr_sensitivity_show_cptkbd,
 			attr_sensitivity_store_cptkbd);
 
+static struct device_attribute dev_attr_middleclick_workaround_cptkbd =
+	__ATTR(middleclick_workaround, S_IWUSR | S_IRUGO,
+			attr_middleclick_workaround_show_cptkbd,
+			attr_middleclick_workaround_store_cptkbd);
+
 
 static struct attribute *lenovo_attributes_cptkbd[] = {
 	&dev_attr_fn_lock.attr,
 	&dev_attr_sensitivity_cptkbd.attr,
+	&dev_attr_middleclick_workaround_cptkbd.attr,
 	NULL
 };
 
@@ -686,23 +724,7 @@
 {
 	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
 
-	if (cptkbd_data->middlebutton_state != 3) {
-		/* REL_X and REL_Y events during middle button pressed
-		 * are only possible on patched, bug-free firmware
-		 * so set middlebutton_state to 3
-		 * to never apply workaround anymore
-		 */
-		if (hdev->product == USB_DEVICE_ID_LENOVO_CUSBKBD &&
-				cptkbd_data->middlebutton_state == 1 &&
-				usage->type == EV_REL &&
-				(usage->code == REL_X || usage->code == REL_Y)) {
-			cptkbd_data->middlebutton_state = 3;
-			/* send middle button press which was hold before */
-			input_event(field->hidinput->input,
-				EV_KEY, BTN_MIDDLE, 1);
-			input_sync(field->hidinput->input);
-		}
-
+	if (cptkbd_data->middleclick_workaround_cptkbd) {
 		/* "wheel" scroll events */
 		if (usage->type == EV_REL && (usage->code == REL_WHEEL ||
 				usage->code == REL_HWHEEL)) {
@@ -757,6 +779,7 @@
 		return lenovo_event_cptkbd(hdev, field, usage, value);
 	case USB_DEVICE_ID_LENOVO_TP10UBKBD:
 	case USB_DEVICE_ID_LENOVO_X1_TAB:
+	case USB_DEVICE_ID_LENOVO_X1_TAB3:
 		return lenovo_event_tp10ubkbd(hdev, field, usage, value);
 	default:
 		return 0;
@@ -1039,6 +1062,7 @@
 		break;
 	case USB_DEVICE_ID_LENOVO_TP10UBKBD:
 	case USB_DEVICE_ID_LENOVO_X1_TAB:
+	case USB_DEVICE_ID_LENOVO_X1_TAB3:
 		ret = lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value);
 		break;
 	}
@@ -1166,6 +1190,7 @@
 	cptkbd_data->middlebutton_state = 0;
 	cptkbd_data->fn_lock = true;
 	cptkbd_data->sensitivity = 0x05;
+	cptkbd_data->middleclick_workaround_cptkbd = true;
 	lenovo_features_set_cptkbd(hdev);
 
 	ret = sysfs_create_group(&hdev->dev.kobj, &lenovo_attr_group_cptkbd);
@@ -1268,6 +1293,7 @@
 		break;
 	case USB_DEVICE_ID_LENOVO_TP10UBKBD:
 	case USB_DEVICE_ID_LENOVO_X1_TAB:
+	case USB_DEVICE_ID_LENOVO_X1_TAB3:
 		ret = lenovo_probe_tp10ubkbd(hdev);
 		break;
 	default:
@@ -1354,6 +1380,7 @@
 		break;
 	case USB_DEVICE_ID_LENOVO_TP10UBKBD:
 	case USB_DEVICE_ID_LENOVO_X1_TAB:
+	case USB_DEVICE_ID_LENOVO_X1_TAB3:
 		lenovo_remove_tp10ubkbd(hdev);
 		break;
 	}
@@ -1403,6 +1430,8 @@
 	 */
 	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
 		     USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB) },
+	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+		     USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB3) },
 	{ }
 };
 
--- linux-qcom-6.8.0.orig/drivers/hid/hid-logitech-dj.c
+++ linux-qcom-6.8.0/drivers/hid/hid-logitech-dj.c
@@ -965,9 +965,7 @@
 		}
 		break;
 	case REPORT_TYPE_MOUSE:
-		workitem->reports_supported |= STD_MOUSE | HIDPP;
-		if (djrcv_dev->type == recvr_type_mouse_only)
-			workitem->reports_supported |= MULTIMEDIA;
+		workitem->reports_supported |= STD_MOUSE | HIDPP | MULTIMEDIA;
 		break;
 	}
 }
@@ -1286,8 +1284,10 @@
 		 */
 		msleep(50);
 
-		if (retval)
+		if (retval) {
+			kfree(dj_report);
 			return retval;
+		}
 	}
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/hid/hid-magicmouse.c
+++ linux-qcom-6.8.0/drivers/hid/hid-magicmouse.c
@@ -227,7 +227,9 @@
 		touch_minor = tdata[4];
 		state = tdata[7] & TOUCH_STATE_MASK;
 		down = state != TOUCH_STATE_NONE;
-	} else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
+	} else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+		   input->id.product ==
+			   USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
 		id = tdata[8] & 0xf;
 		x = (tdata[1] << 27 | tdata[0] << 19) >> 19;
 		y = -((tdata[3] << 30 | tdata[2] << 22 | tdata[1] << 14) >> 19);
@@ -259,8 +261,9 @@
 	/* If requested, emulate a scroll wheel by detecting small
 	 * vertical touch motions.
 	 */
-	if (emulate_scroll_wheel && (input->id.product !=
-			USB_DEVICE_ID_APPLE_MAGICTRACKPAD2)) {
+	if (emulate_scroll_wheel &&
+	    input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 &&
+	    input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
 		unsigned long now = jiffies;
 		int step_x = msc->touches[id].scroll_x - x;
 		int step_y = msc->touches[id].scroll_y - y;
@@ -359,7 +362,9 @@
 		input_report_abs(input, ABS_MT_POSITION_X, x);
 		input_report_abs(input, ABS_MT_POSITION_Y, y);
 
-		if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2)
+		if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+		    input->id.product ==
+			    USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC)
 			input_report_abs(input, ABS_MT_PRESSURE, pressure);
 
 		if (report_undeciphered) {
@@ -367,7 +372,9 @@
 			    input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE2)
 				input_event(input, EV_MSC, MSC_RAW, tdata[7]);
 			else if (input->id.product !=
-					USB_DEVICE_ID_APPLE_MAGICTRACKPAD2)
+					 USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 &&
+				 input->id.product !=
+					 USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC)
 				input_event(input, EV_MSC, MSC_RAW, tdata[8]);
 		}
 	}
@@ -493,7 +500,9 @@
 		magicmouse_emit_buttons(msc, clicks & 3);
 		input_report_rel(input, REL_X, x);
 		input_report_rel(input, REL_Y, y);
-	} else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
+	} else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+		   input->id.product ==
+			   USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
 		input_mt_sync_frame(input);
 		input_report_key(input, BTN_MOUSE, clicks & 1);
 	} else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
@@ -545,7 +554,9 @@
 			__set_bit(REL_WHEEL_HI_RES, input->relbit);
 			__set_bit(REL_HWHEEL_HI_RES, input->relbit);
 		}
-	} else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
+	} else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+		   input->id.product ==
+			   USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
 		/* If the trackpad has been connected to a Mac, the name is
 		 * automatically personalized, e.g., "José Expósito's Trackpad".
 		 * When connected through Bluetooth, the personalized name is
@@ -621,7 +632,9 @@
 				  MOUSE_RES_X);
 		input_abs_set_res(input, ABS_MT_POSITION_Y,
 				  MOUSE_RES_Y);
-	} else if (input->id.product ==  USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
+	} else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+		   input->id.product ==
+			   USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
 		input_set_abs_params(input, ABS_MT_PRESSURE, 0, 253, 0, 0);
 		input_set_abs_params(input, ABS_PRESSURE, 0, 253, 0, 0);
 		input_set_abs_params(input, ABS_MT_ORIENTATION, -3, 4, 0, 0);
@@ -660,7 +673,8 @@
 	input_set_events_per_packet(input, 60);
 
 	if (report_undeciphered &&
-	    input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
+	    input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 &&
+	    input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
 		__set_bit(EV_MSC, input->evbit);
 		__set_bit(MSC_RAW, input->mscbit);
 	}
@@ -685,7 +699,9 @@
 
 	/* Magic Trackpad does not give relative data after switching to MT */
 	if ((hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD ||
-	     hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) &&
+	     hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+	     hi->input->id.product ==
+		     USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) &&
 	    field->flags & HID_MAIN_ITEM_RELATIVE)
 		return -1;
 
@@ -721,7 +737,8 @@
 	int ret;
 	int feature_size;
 
-	if (hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
+	if (hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+	    hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
 		if (hdev->vendor == BT_VENDOR_ID_APPLE) {
 			feature_size = sizeof(feature_mt_trackpad2_bt);
 			feature = feature_mt_trackpad2_bt;
@@ -766,7 +783,8 @@
 
 	if (!hdev->battery || hdev->vendor != USB_VENDOR_ID_APPLE ||
 	    (hdev->product != USB_DEVICE_ID_APPLE_MAGICMOUSE2 &&
-	     hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2))
+	     hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 &&
+	     hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC))
 		return -1;
 
 	report_enum = &hdev->report_enum[hdev->battery_report_type];
@@ -835,7 +853,9 @@
 
 	if (id->vendor == USB_VENDOR_ID_APPLE &&
 	    (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2 ||
-	     (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 && hdev->type != HID_TYPE_USBMOUSE)))
+	     ((id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+	       id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) &&
+	      hdev->type != HID_TYPE_USBMOUSE)))
 		return 0;
 
 	if (!msc->input) {
@@ -850,7 +870,8 @@
 	else if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2)
 		report = hid_register_report(hdev, HID_INPUT_REPORT,
 			MOUSE2_REPORT_ID, 0);
-	else if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
+	else if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+		 id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
 		if (id->vendor == BT_VENDOR_ID_APPLE)
 			report = hid_register_report(hdev, HID_INPUT_REPORT,
 				TRACKPAD2_BT_REPORT_ID, 0);
@@ -920,7 +941,8 @@
 	 */
 	if (hdev->vendor == USB_VENDOR_ID_APPLE &&
 	    (hdev->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2 ||
-	     hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) &&
+	     hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
+	     hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) &&
 	    *rsize == 83 && rdesc[46] == 0x84 && rdesc[58] == 0x85) {
 		hid_info(hdev,
 			 "fixing up magicmouse battery report descriptor\n");
@@ -951,6 +973,10 @@
 		USB_DEVICE_ID_APPLE_MAGICTRACKPAD2), .driver_data = 0 },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE,
 		USB_DEVICE_ID_APPLE_MAGICTRACKPAD2), .driver_data = 0 },
+	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE,
+		USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC), .driver_data = 0 },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE,
+		USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC), .driver_data = 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(hid, magic_mice);
--- linux-qcom-6.8.0.orig/drivers/hid/hid-mcp2221.c
+++ linux-qcom-6.8.0/drivers/hid/hid-mcp2221.c
@@ -944,9 +944,11 @@
 /* This is needed to be sure hid_hw_stop() isn't called twice by the subsystem */
 static void mcp2221_remove(struct hid_device *hdev)
 {
+#if IS_REACHABLE(CONFIG_IIO)
 	struct mcp2221 *mcp = hid_get_drvdata(hdev);
 
 	cancel_delayed_work_sync(&mcp->init_work);
+#endif
 }
 
 #if IS_REACHABLE(CONFIG_IIO)
--- linux-qcom-6.8.0.orig/drivers/hid/hid-multitouch.c
+++ linux-qcom-6.8.0/drivers/hid/hid-multitouch.c
@@ -1442,6 +1442,30 @@
 	return 0;
 }
 
+static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+			     unsigned int *size)
+{
+	if (hdev->vendor == I2C_VENDOR_ID_GOODIX &&
+	    (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 ||
+	     hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) {
+		if (rdesc[607] == 0x15) {
+			rdesc[607] = 0x25;
+			dev_info(
+				&hdev->dev,
+				"GT7868Q report descriptor fixup is applied.\n");
+		} else {
+			dev_info(
+				&hdev->dev,
+				"The byte is not expected for fixing the report descriptor. \
+It's possible that the touchpad firmware is not suitable for applying the fix. \
+got: %x\n",
+				rdesc[607]);
+		}
+	}
+
+	return rdesc;
+}
+
 static void mt_report(struct hid_device *hid, struct hid_report *report)
 {
 	struct mt_device *td = hid_get_drvdata(hid);
@@ -1993,6 +2017,10 @@
 		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
 			USB_VENDOR_ID_ELAN, 0x3148) },
 
+	{ .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
+		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+			USB_VENDOR_ID_ELAN, 0x32ae) },
+
 	/* Elitegroup panel */
 	{ .driver_data = MT_CLS_SERIAL,
 		MT_USB_DEVICE(USB_VENDOR_ID_ELITEGROUP,
@@ -2036,6 +2064,14 @@
 		MT_BT_DEVICE(USB_VENDOR_ID_FRUCTEL,
 			USB_DEVICE_ID_GAMETEL_MT_MODE) },
 
+	/* Goodix GT7868Q devices */
+	{ .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
+	  HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX,
+		     I2C_DEVICE_ID_GOODIX_01E8) },
+	{ .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
+	  HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX,
+		     I2C_DEVICE_ID_GOODIX_01E8) },
+
 	/* GoodTouch panels */
 	{ .driver_data = MT_CLS_NSMU,
 		MT_USB_DEVICE(USB_VENDOR_ID_GOODTOUCH,
@@ -2051,6 +2087,11 @@
 		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
 			0x347d, 0x7853) },
 
+	/* HONOR MagicBook Art 14 touchpad */
+	{ .driver_data = MT_CLS_VTL,
+		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+			0x35cc, 0x0104) },
+
 	/* Ilitek dual touch panel */
 	{  .driver_data = MT_CLS_NSMU,
 		MT_USB_DEVICE(USB_VENDOR_ID_ILITEK,
@@ -2082,6 +2123,22 @@
 			   USB_VENDOR_ID_LENOVO,
 			   USB_DEVICE_ID_LENOVO_X12_TAB) },
 
+	/* Lenovo X12 TAB Gen 2 */
+	{ .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
+		HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+			   USB_VENDOR_ID_LENOVO,
+			   USB_DEVICE_ID_LENOVO_X12_TAB2) },
+
+	/* Logitech devices */
+	{ .driver_data = MT_CLS_NSMU,
+		HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8,
+			USB_VENDOR_ID_LOGITECH,
+			USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD) },
+	{ .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
+		HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+			USB_VENDOR_ID_LOGITECH,
+			USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER) },
+
 	/* MosArt panels */
 	{ .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE,
 		MT_USB_DEVICE(USB_VENDOR_ID_ASUS,
@@ -2265,6 +2322,7 @@
 	.feature_mapping = mt_feature_mapping,
 	.usage_table = mt_grabbed_usages,
 	.event = mt_event,
+	.report_fixup = mt_report_fixup,
 	.report = mt_report,
 	.suspend = pm_ptr(mt_suspend),
 	.reset_resume = pm_ptr(mt_reset_resume),
--- linux-qcom-6.8.0.orig/drivers/hid/hid-nintendo.c
+++ linux-qcom-6.8.0/drivers/hid/hid-nintendo.c
@@ -481,10 +481,10 @@
 	{ BTN_TR,		JC_BTN_R,	},
 	{ BTN_TR2,		JC_BTN_LSTICK,	}, /* ZR */
 	{ BTN_START,		JC_BTN_PLUS,	},
-	{ BTN_FORWARD,		JC_BTN_Y,	}, /* C UP */
-	{ BTN_BACK,		JC_BTN_ZR,	}, /* C DOWN */
-	{ BTN_LEFT,		JC_BTN_X,	}, /* C LEFT */
-	{ BTN_RIGHT,		JC_BTN_MINUS,	}, /* C RIGHT */
+	{ BTN_SELECT,		JC_BTN_Y,	}, /* C UP */
+	{ BTN_X,		JC_BTN_ZR,	}, /* C DOWN */
+	{ BTN_Y,		JC_BTN_X,	}, /* C LEFT */
+	{ BTN_C,		JC_BTN_MINUS,	}, /* C RIGHT */
 	{ BTN_MODE,		JC_BTN_HOME,	},
 	{ BTN_Z,		JC_BTN_CAP,	},
 	{ /* sentinel */ },
--- linux-qcom-6.8.0.orig/drivers/hid/hid-nvidia-shield.c
+++ linux-qcom-6.8.0/drivers/hid/hid-nvidia-shield.c
@@ -283,7 +283,9 @@
 		return haptics;
 
 	input_set_capability(haptics, EV_FF, FF_RUMBLE);
-	input_ff_create_memless(haptics, NULL, play_effect);
+	ret = input_ff_create_memless(haptics, NULL, play_effect);
+	if (ret)
+		goto err;
 
 	ret = input_register_device(haptics);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/hid/hid-plantronics.c
+++ linux-qcom-6.8.0/drivers/hid/hid-plantronics.c
@@ -38,8 +38,10 @@
 			    (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER)
 
 #define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0)
+#define PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS BIT(1)
 
 #define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */
+#define PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT 220 /* ms */
 
 struct plt_drv_data {
 	unsigned long device_type;
@@ -137,6 +139,21 @@
 
 		drv_data->last_volume_key_ts = cur_ts;
 	}
+	if (drv_data->quirks & PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS) {
+		unsigned long prev_ts, cur_ts;
+
+		/* Usages are filtered in plantronics_usages. */
+
+		if (!value) /* Handle key presses only. */
+			return 0;
+
+		prev_ts = drv_data->last_volume_key_ts;
+		cur_ts = jiffies;
+		if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT)
+			return 1; /* Ignore the followed opposite volume key. */
+
+		drv_data->last_volume_key_ts = cur_ts;
+	}
 
 	return 0;
 }
@@ -210,6 +227,12 @@
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
 					 USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES),
 		.driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
+					 USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3325_SERIES),
+		.driver_data = PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
+					 USB_DEVICE_ID_PLANTRONICS_ENCOREPRO_500_SERIES),
+		.driver_data = PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
 	{ }
 };
--- linux-qcom-6.8.0.orig/drivers/hid/i2c-hid/i2c-hid-core.c
+++ linux-qcom-6.8.0/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -50,6 +50,7 @@
 #define I2C_HID_QUIRK_BAD_INPUT_SIZE		BIT(3)
 #define I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET	BIT(4)
 #define I2C_HID_QUIRK_NO_SLEEP_ON_SUSPEND	BIT(5)
+#define I2C_HID_QUIRK_DELAY_WAKEUP_AFTER_RESUME BIT(6)
 
 /* Command opcodes */
 #define I2C_HID_OPCODE_RESET			0x01
@@ -64,7 +65,6 @@
 /* flags */
 #define I2C_HID_STARTED		0
 #define I2C_HID_RESET_PENDING	1
-#define I2C_HID_READ_PENDING	2
 
 #define I2C_HID_PWR_ON		0x00
 #define I2C_HID_PWR_SLEEP	0x01
@@ -106,6 +106,7 @@
 
 	wait_queue_head_t	wait;		/* For waiting the interrupt */
 
+	struct mutex		cmd_lock;	/* protects cmdbuf and rawbuf */
 	struct mutex		reset_lock;
 
 	struct i2chid_ops	*ops;
@@ -140,6 +141,8 @@
 	{ USB_VENDOR_ID_ELAN, HID_ANY_ID,
 		 I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET |
 		 I2C_HID_QUIRK_BOGUS_IRQ },
+	{ I2C_VENDOR_ID_GOODIX, I2C_DEVICE_ID_GOODIX_0D42,
+		 I2C_HID_QUIRK_DELAY_WAKEUP_AFTER_RESUME },
 	{ 0, 0 }
 };
 
@@ -190,15 +193,10 @@
 		msgs[n].len = recv_len;
 		msgs[n].buf = recv_buf;
 		n++;
-
-		set_bit(I2C_HID_READ_PENDING, &ihid->flags);
 	}
 
 	ret = i2c_transfer(client->adapter, msgs, n);
 
-	if (recv_len)
-		clear_bit(I2C_HID_READ_PENDING, &ihid->flags);
-
 	if (ret != n)
 		return ret < 0 ? ret : -EIO;
 
@@ -208,6 +206,8 @@
 static int i2c_hid_read_register(struct i2c_hid *ihid, __le16 reg,
 				 void *buf, size_t len)
 {
+	guard(mutex)(&ihid->cmd_lock);
+
 	*(__le16 *)ihid->cmdbuf = reg;
 
 	return i2c_hid_xfer(ihid, ihid->cmdbuf, sizeof(__le16), buf, len);
@@ -240,6 +240,8 @@
 
 	i2c_hid_dbg(ihid, "%s\n", __func__);
 
+	guard(mutex)(&ihid->cmd_lock);
+
 	/* Command register goes first */
 	*(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister;
 	length += sizeof(__le16);
@@ -330,6 +332,8 @@
 	if (!do_set && le16_to_cpu(ihid->hdesc.wMaxOutputLength) == 0)
 		return -ENOSYS;
 
+	guard(mutex)(&ihid->cmd_lock);
+
 	if (do_set) {
 		/* Command register goes first */
 		*(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister;
@@ -372,6 +376,8 @@
 {
 	size_t length;
 
+	guard(mutex)(&ihid->cmd_lock);
+
 	/* SET_POWER uses command register */
 	*(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister;
 	length = sizeof(__le16);
@@ -443,25 +449,27 @@
 	if (ret)
 		return ret;
 
-	/* Prepare reset command. Command register goes first. */
-	*(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister;
-	length += sizeof(__le16);
-	/* Next is RESET command itself */
-	length += i2c_hid_encode_command(ihid->cmdbuf + length,
-					 I2C_HID_OPCODE_RESET, 0, 0);
+	scoped_guard(mutex, &ihid->cmd_lock) {
+		/* Prepare reset command. Command register goes first. */
+		*(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister;
+		length += sizeof(__le16);
+		/* Next is RESET command itself */
+		length += i2c_hid_encode_command(ihid->cmdbuf + length,
+						 I2C_HID_OPCODE_RESET, 0, 0);
 
-	set_bit(I2C_HID_RESET_PENDING, &ihid->flags);
+		set_bit(I2C_HID_RESET_PENDING, &ihid->flags);
 
-	ret = i2c_hid_xfer(ihid, ihid->cmdbuf, length, NULL, 0);
-	if (ret) {
-		dev_err(&ihid->client->dev,
-			"failed to reset device: %d\n", ret);
-		goto err_clear_reset;
-	}
+		ret = i2c_hid_xfer(ihid, ihid->cmdbuf, length, NULL, 0);
+		if (ret) {
+			dev_err(&ihid->client->dev,
+				"failed to reset device: %d\n", ret);
+			break;
+		}
 
-	return 0;
+		return 0;
+	}
 
-err_clear_reset:
+	/* Clean up if sending reset command failed */
 	clear_bit(I2C_HID_RESET_PENDING, &ihid->flags);
 	i2c_hid_set_power(ihid, I2C_HID_PWR_SLEEP);
 	return ret;
@@ -556,9 +564,6 @@
 {
 	struct i2c_hid *ihid = dev_id;
 
-	if (test_bit(I2C_HID_READ_PENDING, &ihid->flags))
-		return IRQ_HANDLED;
-
 	i2c_hid_get_input(ihid);
 
 	return IRQ_HANDLED;
@@ -735,12 +740,15 @@
 	mutex_lock(&ihid->reset_lock);
 	do {
 		ret = i2c_hid_start_hwreset(ihid);
-		if (ret)
+		if (ret == 0)
+			ret = i2c_hid_finish_hwreset(ihid);
+		else
 			msleep(1000);
 	} while (tries-- > 0 && ret);
+	mutex_unlock(&ihid->reset_lock);
 
 	if (ret)
-		goto abort_reset;
+		return ret;
 
 	use_override = i2c_hid_get_dmi_hid_report_desc_override(client->name,
 								&rsize);
@@ -750,11 +758,8 @@
 		i2c_hid_dbg(ihid, "Using a HID report descriptor override\n");
 	} else {
 		rdesc = kzalloc(rsize, GFP_KERNEL);
-
-		if (!rdesc) {
-			ret = -ENOMEM;
-			goto abort_reset;
-		}
+		if (!rdesc)
+			return -ENOMEM;
 
 		i2c_hid_dbg(ihid, "asking HID report descriptor\n");
 
@@ -763,23 +768,10 @@
 					    rdesc, rsize);
 		if (ret) {
 			hid_err(hid, "reading report descriptor failed\n");
-			goto abort_reset;
+			goto out;
 		}
 	}
 
-	/*
-	 * Windows directly reads the report-descriptor after sending reset
-	 * and then waits for resets completion afterwards. Some touchpads
-	 * actually wait for the report-descriptor to be read before signalling
-	 * reset completion.
-	 */
-	ret = i2c_hid_finish_hwreset(ihid);
-abort_reset:
-	clear_bit(I2C_HID_RESET_PENDING, &ihid->flags);
-	mutex_unlock(&ihid->reset_lock);
-	if (ret)
-		goto out;
-
 	i2c_hid_dbg(ihid, "Report Descriptor: %*ph\n", rsize, rdesc);
 
 	ret = hid_parse_report(hid, rdesc, rsize);
@@ -981,6 +973,13 @@
 
 	enable_irq(client->irq);
 
+	/* On Goodix 27c6:0d42 wait extra time before device wakeup.
+	 * It's not clear why but if we send wakeup too early, the device will
+	 * never trigger input interrupts.
+	 */
+	if (ihid->quirks & I2C_HID_QUIRK_DELAY_WAKEUP_AFTER_RESUME)
+		msleep(1500);
+
 	/* Instead of resetting device, simply powers the device on. This
 	 * solves "incomplete reports" on Raydium devices 2386:3118 and
 	 * 2386:4B33 and fixes various SIS touchscreens no longer sending
@@ -1212,6 +1211,7 @@
 	ihid->is_panel_follower = drm_is_panel_follower(&client->dev);
 
 	init_waitqueue_head(&ihid->wait);
+	mutex_init(&ihid->cmd_lock);
 	mutex_init(&ihid->reset_lock);
 	INIT_WORK(&ihid->panel_follower_prepare_work, ihid_core_panel_prepare_work);
 
--- linux-qcom-6.8.0.orig/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+++ linux-qcom-6.8.0/drivers/hid/i2c-hid/i2c-hid-of-elan.c
@@ -31,6 +31,7 @@
 	struct regulator *vcc33;
 	struct regulator *vccio;
 	struct gpio_desc *reset_gpio;
+	bool no_reset_on_power_off;
 	const struct elan_i2c_hid_chip_data *chip_data;
 };
 
@@ -40,17 +41,17 @@
 		container_of(ops, struct i2c_hid_of_elan, ops);
 	int ret;
 
+	gpiod_set_value_cansleep(ihid_elan->reset_gpio, 1);
+
 	if (ihid_elan->vcc33) {
 		ret = regulator_enable(ihid_elan->vcc33);
 		if (ret)
-			return ret;
+			goto err_deassert_reset;
 	}
 
 	ret = regulator_enable(ihid_elan->vccio);
-	if (ret) {
-		regulator_disable(ihid_elan->vcc33);
-		return ret;
-	}
+	if (ret)
+		goto err_disable_vcc33;
 
 	if (ihid_elan->chip_data->post_power_delay_ms)
 		msleep(ihid_elan->chip_data->post_power_delay_ms);
@@ -60,6 +61,15 @@
 		msleep(ihid_elan->chip_data->post_gpio_reset_on_delay_ms);
 
 	return 0;
+
+err_disable_vcc33:
+	if (ihid_elan->vcc33)
+		regulator_disable(ihid_elan->vcc33);
+err_deassert_reset:
+	if (ihid_elan->no_reset_on_power_off)
+		gpiod_set_value_cansleep(ihid_elan->reset_gpio, 0);
+
+	return ret;
 }
 
 static void elan_i2c_hid_power_down(struct i2chid_ops *ops)
@@ -67,7 +77,14 @@
 	struct i2c_hid_of_elan *ihid_elan =
 		container_of(ops, struct i2c_hid_of_elan, ops);
 
-	gpiod_set_value_cansleep(ihid_elan->reset_gpio, 1);
+	/*
+	 * Do not assert reset when the hardware allows for it to remain
+	 * deasserted regardless of the state of the (shared) power supply to
+	 * avoid wasting power when the supply is left on.
+	 */
+	if (!ihid_elan->no_reset_on_power_off)
+		gpiod_set_value_cansleep(ihid_elan->reset_gpio, 1);
+
 	if (ihid_elan->chip_data->post_gpio_reset_off_delay_ms)
 		msleep(ihid_elan->chip_data->post_gpio_reset_off_delay_ms);
 
@@ -79,6 +96,7 @@
 static int i2c_hid_of_elan_probe(struct i2c_client *client)
 {
 	struct i2c_hid_of_elan *ihid_elan;
+	int ret;
 
 	ihid_elan = devm_kzalloc(&client->dev, sizeof(*ihid_elan), GFP_KERNEL);
 	if (!ihid_elan)
@@ -93,21 +111,38 @@
 	if (IS_ERR(ihid_elan->reset_gpio))
 		return PTR_ERR(ihid_elan->reset_gpio);
 
+	ihid_elan->no_reset_on_power_off = of_property_read_bool(client->dev.of_node,
+						"no-reset-on-power-off");
+
 	ihid_elan->vccio = devm_regulator_get(&client->dev, "vccio");
-	if (IS_ERR(ihid_elan->vccio))
-		return PTR_ERR(ihid_elan->vccio);
+	if (IS_ERR(ihid_elan->vccio)) {
+		ret = PTR_ERR(ihid_elan->vccio);
+		goto err_deassert_reset;
+	}
 
 	ihid_elan->chip_data = device_get_match_data(&client->dev);
 
 	if (ihid_elan->chip_data->main_supply_name) {
 		ihid_elan->vcc33 = devm_regulator_get(&client->dev,
 						      ihid_elan->chip_data->main_supply_name);
-		if (IS_ERR(ihid_elan->vcc33))
-			return PTR_ERR(ihid_elan->vcc33);
+		if (IS_ERR(ihid_elan->vcc33)) {
+			ret = PTR_ERR(ihid_elan->vcc33);
+			goto err_deassert_reset;
+		}
 	}
 
-	return i2c_hid_core_probe(client, &ihid_elan->ops,
-				  ihid_elan->chip_data->hid_descriptor_address, 0);
+	ret = i2c_hid_core_probe(client, &ihid_elan->ops,
+				 ihid_elan->chip_data->hid_descriptor_address, 0);
+	if (ret)
+		goto err_deassert_reset;
+
+	return 0;
+
+err_deassert_reset:
+	if (ihid_elan->no_reset_on_power_off)
+		gpiod_set_value_cansleep(ihid_elan->reset_gpio, 0);
+
+	return ret;
 }
 
 static const struct elan_i2c_hid_chip_data elan_ekth6915_chip_data = {
--- linux-qcom-6.8.0.orig/drivers/hid/intel-ish-hid/ipc/ipc.c
+++ linux-qcom-6.8.0/drivers/hid/intel-ish-hid/ipc/ipc.c
@@ -948,6 +948,7 @@
 	if (!dev)
 		return NULL;
 
+	dev->devc = &pdev->dev;
 	ishtp_device_init(dev);
 
 	init_waitqueue_head(&dev->wait_hw_ready);
@@ -983,7 +984,6 @@
 	}
 
 	dev->ops = &ish_hw_ops;
-	dev->devc = &pdev->dev;
 	dev->mtu = IPC_PAYLOAD_SIZE - sizeof(struct ishtp_msg_hdr);
 	return dev;
 }
--- linux-qcom-6.8.0.orig/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ linux-qcom-6.8.0/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -172,6 +172,11 @@
 
 	/* request and enable interrupt */
 	ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
+	if (ret < 0) {
+		dev_err(dev, "ISH: Failed to allocate IRQ vectors\n");
+		return ret;
+	}
+
 	if (!pdev->msi_enabled && !pdev->msix_enabled)
 		irq_flag = IRQF_SHARED;
 
--- linux-qcom-6.8.0.orig/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
+++ linux-qcom-6.8.0/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
@@ -635,7 +635,7 @@
 				  const struct firmware *fw,
 				  const struct shim_fw_info fw_info)
 {
-	int rv;
+	int rv = 0;
 	void *dma_buf;
 	dma_addr_t dma_buf_phy;
 	u32 fragment_offset, fragment_size, payload_max_size;
--- linux-qcom-6.8.0.orig/drivers/hid/wacom_sys.c
+++ linux-qcom-6.8.0/drivers/hid/wacom_sys.c
@@ -1370,17 +1370,6 @@
 	if (!name)
 		return -ENOMEM;
 
-	if (!read_only) {
-		led->trigger.name = name;
-		error = devm_led_trigger_register(dev, &led->trigger);
-		if (error) {
-			hid_err(wacom->hdev,
-				"failed to register LED trigger %s: %d\n",
-				led->cdev.name, error);
-			return error;
-		}
-	}
-
 	led->group = group;
 	led->id = id;
 	led->wacom = wacom;
@@ -1397,6 +1386,19 @@
 		led->cdev.brightness_set = wacom_led_readonly_brightness_set;
 	}
 
+	if (!read_only) {
+		led->trigger.name = name;
+		if (id == wacom->led.groups[group].select)
+			led->trigger.brightness = wacom_leds_brightness_get(led);
+		error = devm_led_trigger_register(dev, &led->trigger);
+		if (error) {
+			hid_err(wacom->hdev,
+				"failed to register LED trigger %s: %d\n",
+				led->cdev.name, error);
+			return error;
+		}
+	}
+
 	error = devm_led_classdev_register(dev, &led->cdev);
 	if (error) {
 		hid_err(wacom->hdev,
@@ -2241,7 +2243,8 @@
 		if (hid_is_usb(wacom->hdev)) {
 			struct usb_interface *intf = to_usb_interface(wacom->hdev->dev.parent);
 			struct usb_device *dev = interface_to_usbdev(intf);
-			product_name = dev->product;
+			if (dev->product != NULL)
+				product_name = dev->product;
 		}
 
 		if (wacom->hdev->bus == BUS_I2C) {
--- linux-qcom-6.8.0.orig/drivers/hid/wacom_wac.c
+++ linux-qcom-6.8.0/drivers/hid/wacom_wac.c
@@ -714,13 +714,12 @@
 	case 0x8e2: /* IntuosHT2 pen */
 	case 0x022:
 	case 0x200: /* Pro Pen 3 */
-	case 0x04200: /* Pro Pen 3 */
 	case 0x10842: /* MobileStudio Pro Pro Pen slim */
 	case 0x14802: /* Intuos4/5 13HD/24HD Classic Pen */
 	case 0x16802: /* Cintiq 13HD Pro Pen */
 	case 0x18802: /* DTH2242 Pen */
 	case 0x10802: /* Intuos4/5 13HD/24HD General Pen */
-	case 0x80842: /* Intuos Pro and Cintiq Pro 3D Pen */
+	case 0x8842: /* Intuos Pro and Cintiq Pro 3D Pen */
 		tool_type = BTN_TOOL_PEN;
 		break;
 
@@ -1400,9 +1399,9 @@
 					rotation -= 1800;
 
 				input_report_abs(pen_input, ABS_TILT_X,
-						 (char)frame[7]);
+						 (signed char)frame[7]);
 				input_report_abs(pen_input, ABS_TILT_Y,
-						 (char)frame[8]);
+						 (signed char)frame[8]);
 				input_report_abs(pen_input, ABS_Z, rotation);
 				input_report_abs(pen_input, ABS_WHEEL,
 						 get_unaligned_le16(&frame[11]));
@@ -1925,12 +1924,14 @@
 	int fmax = field->logical_maximum;
 	unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid);
 	int resolution_code = code;
-	int resolution = hidinput_calc_abs_res(field, resolution_code);
+	int resolution;
 
 	if (equivalent_usage == HID_DG_TWIST) {
 		resolution_code = ABS_RZ;
 	}
 
+	resolution = hidinput_calc_abs_res(field, resolution_code);
+
 	if (equivalent_usage == HID_GD_X) {
 		fmin += features->offset_left;
 		fmax -= features->offset_right;
@@ -2367,6 +2368,9 @@
 		wacom_map_usage(input, usage, field, EV_KEY, BTN_STYLUS3, 0);
 		features->quirks &= ~WACOM_QUIRK_PEN_BUTTON3;
 		break;
+	case WACOM_HID_WD_SEQUENCENUMBER:
+		wacom_wac->hid_data.sequence_number = -1;
+		break;
 	}
 }
 
@@ -2491,9 +2495,15 @@
 		wacom_wac->hid_data.barrelswitch3 = value;
 		return;
 	case WACOM_HID_WD_SEQUENCENUMBER:
-		if (wacom_wac->hid_data.sequence_number != value)
-			hid_warn(hdev, "Dropped %hu packets", (unsigned short)(value - wacom_wac->hid_data.sequence_number));
+		if (wacom_wac->hid_data.sequence_number != value &&
+		    wacom_wac->hid_data.sequence_number >= 0) {
+			int sequence_size = field->logical_maximum - field->logical_minimum + 1;
+			int drop_count = (value - wacom_wac->hid_data.sequence_number) % sequence_size;
+			hid_warn(hdev, "Dropped %d packets", drop_count);
+		}
 		wacom_wac->hid_data.sequence_number = value + 1;
+		if (wacom_wac->hid_data.sequence_number > field->logical_maximum)
+			wacom_wac->hid_data.sequence_number = field->logical_minimum;
 		return;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/hid/wacom_wac.h
+++ linux-qcom-6.8.0/drivers/hid/wacom_wac.h
@@ -325,7 +325,7 @@
 	int bat_connected;
 	int ps_connected;
 	bool pad_input_event_flag;
-	unsigned short sequence_number;
+	int sequence_number;
 	ktime_t time_delayed;
 };
 
--- linux-qcom-6.8.0.orig/drivers/hv/Kconfig
+++ linux-qcom-6.8.0/drivers/hv/Kconfig
@@ -16,6 +16,7 @@
 config HYPERV_VTL_MODE
 	bool "Enable Linux to boot in VTL context"
 	depends on X86_64 && HYPERV
+	depends on SMP
 	default n
 	help
 	  Virtual Secure Mode (VSM) is a set of hypervisor capabilities and
--- linux-qcom-6.8.0.orig/drivers/hv/channel.c
+++ linux-qcom-6.8.0/drivers/hv/channel.c
@@ -153,7 +153,9 @@
 	hv_ringbuffer_cleanup(&channel->inbound);
 
 	if (channel->ringbuffer_page) {
-		__free_pages(channel->ringbuffer_page,
+		/* In a CoCo VM leak the memory if it didn't get re-encrypted */
+		if (!channel->ringbuffer_gpadlhandle.decrypted)
+			__free_pages(channel->ringbuffer_page,
 			     get_order(channel->ringbuffer_pagecount
 				       << PAGE_SHIFT));
 		channel->ringbuffer_page = NULL;
@@ -436,9 +438,18 @@
 		(atomic_inc_return(&vmbus_connection.next_gpadl_handle) - 1);
 
 	ret = create_gpadl_header(type, kbuffer, size, send_offset, &msginfo);
-	if (ret)
+	if (ret) {
+		gpadl->decrypted = false;
 		return ret;
+	}
 
+	/*
+	 * Set the "decrypted" flag to true for the set_memory_decrypted()
+	 * success case. In the failure case, the encryption state of the
+	 * memory is unknown. Leave "decrypted" as true to ensure the
+	 * memory will be leaked instead of going back on the free list.
+	 */
+	gpadl->decrypted = true;
 	ret = set_memory_decrypted((unsigned long)kbuffer,
 				   PFN_UP(size));
 	if (ret) {
@@ -527,9 +538,15 @@
 
 	kfree(msginfo);
 
-	if (ret)
-		set_memory_encrypted((unsigned long)kbuffer,
-				     PFN_UP(size));
+	if (ret) {
+		/*
+		 * If set_memory_encrypted() fails, the decrypted flag is
+		 * left as true so the memory is leaked instead of being
+		 * put back on the free list.
+		 */
+		if (!set_memory_encrypted((unsigned long)kbuffer, PFN_UP(size)))
+			gpadl->decrypted = false;
+	}
 
 	return ret;
 }
@@ -850,6 +867,8 @@
 	if (ret)
 		pr_warn("Fail to set mem host visibility in GPADL teardown %d.\n", ret);
 
+	gpadl->decrypted = ret;
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(vmbus_teardown_gpadl);
--- linux-qcom-6.8.0.orig/drivers/hv/connection.c
+++ linux-qcom-6.8.0/drivers/hv/connection.c
@@ -237,8 +237,17 @@
 				vmbus_connection.monitor_pages[0], 1);
 	ret |= set_memory_decrypted((unsigned long)
 				vmbus_connection.monitor_pages[1], 1);
-	if (ret)
+	if (ret) {
+		/*
+		 * If set_memory_decrypted() fails, the encryption state
+		 * of the memory is unknown. So leak the memory instead
+		 * of risking returning decrypted memory to the free list.
+		 * For simplicity, always handle both pages the same.
+		 */
+		vmbus_connection.monitor_pages[0] = NULL;
+		vmbus_connection.monitor_pages[1] = NULL;
 		goto cleanup;
+	}
 
 	/*
 	 * Set_memory_decrypted() will change the memory contents if
@@ -337,13 +346,19 @@
 		vmbus_connection.int_page = NULL;
 	}
 
-	set_memory_encrypted((unsigned long)vmbus_connection.monitor_pages[0], 1);
-	set_memory_encrypted((unsigned long)vmbus_connection.monitor_pages[1], 1);
+	if (vmbus_connection.monitor_pages[0]) {
+		if (!set_memory_encrypted(
+			(unsigned long)vmbus_connection.monitor_pages[0], 1))
+			hv_free_hyperv_page(vmbus_connection.monitor_pages[0]);
+		vmbus_connection.monitor_pages[0] = NULL;
+	}
 
-	hv_free_hyperv_page(vmbus_connection.monitor_pages[0]);
-	hv_free_hyperv_page(vmbus_connection.monitor_pages[1]);
-	vmbus_connection.monitor_pages[0] = NULL;
-	vmbus_connection.monitor_pages[1] = NULL;
+	if (vmbus_connection.monitor_pages[1]) {
+		if (!set_memory_encrypted(
+			(unsigned long)vmbus_connection.monitor_pages[1], 1))
+			hv_free_hyperv_page(vmbus_connection.monitor_pages[1]);
+		vmbus_connection.monitor_pages[1] = NULL;
+	}
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/hv/hv_kvp.c
+++ linux-qcom-6.8.0/drivers/hv/hv_kvp.c
@@ -767,6 +767,12 @@
 	 */
 	kvp_transaction.state = HVUTIL_DEVICE_INIT;
 
+	return 0;
+}
+
+int
+hv_kvp_init_transport(void)
+{
 	hvt = hvutil_transport_init(kvp_devname, CN_KVP_IDX, CN_KVP_VAL,
 				    kvp_on_msg, kvp_on_reset);
 	if (!hvt)
--- linux-qcom-6.8.0.orig/drivers/hv/hv_snapshot.c
+++ linux-qcom-6.8.0/drivers/hv/hv_snapshot.c
@@ -388,6 +388,12 @@
 	 */
 	vss_transaction.state = HVUTIL_DEVICE_INIT;
 
+	return 0;
+}
+
+int
+hv_vss_init_transport(void)
+{
 	hvt = hvutil_transport_init(vss_devname, CN_VSS_IDX, CN_VSS_VAL,
 				    vss_on_msg, vss_on_reset);
 	if (!hvt) {
--- linux-qcom-6.8.0.orig/drivers/hv/hv_util.c
+++ linux-qcom-6.8.0/drivers/hv/hv_util.c
@@ -141,6 +141,7 @@
 static struct hv_util_service util_kvp = {
 	.util_cb = hv_kvp_onchannelcallback,
 	.util_init = hv_kvp_init,
+	.util_init_transport = hv_kvp_init_transport,
 	.util_pre_suspend = hv_kvp_pre_suspend,
 	.util_pre_resume = hv_kvp_pre_resume,
 	.util_deinit = hv_kvp_deinit,
@@ -149,6 +150,7 @@
 static struct hv_util_service util_vss = {
 	.util_cb = hv_vss_onchannelcallback,
 	.util_init = hv_vss_init,
+	.util_init_transport = hv_vss_init_transport,
 	.util_pre_suspend = hv_vss_pre_suspend,
 	.util_pre_resume = hv_vss_pre_resume,
 	.util_deinit = hv_vss_deinit,
@@ -621,6 +623,13 @@
 	if (ret)
 		goto error;
 
+	if (srv->util_init_transport) {
+		ret = srv->util_init_transport();
+		if (ret) {
+			vmbus_close(dev->channel);
+			goto error;
+		}
+	}
 	return 0;
 
 error:
--- linux-qcom-6.8.0.orig/drivers/hv/hyperv_vmbus.h
+++ linux-qcom-6.8.0/drivers/hv/hyperv_vmbus.h
@@ -370,12 +370,14 @@
 void vmbus_on_msg_dpc(unsigned long data);
 
 int hv_kvp_init(struct hv_util_service *srv);
+int hv_kvp_init_transport(void);
 void hv_kvp_deinit(void);
 int hv_kvp_pre_suspend(void);
 int hv_kvp_pre_resume(void);
 void hv_kvp_onchannelcallback(void *context);
 
 int hv_vss_init(struct hv_util_service *srv);
+int hv_vss_init_transport(void);
 void hv_vss_deinit(void);
 int hv_vss_pre_suspend(void);
 int hv_vss_pre_resume(void);
--- linux-qcom-6.8.0.orig/drivers/hv/vmbus_drv.c
+++ linux-qcom-6.8.0/drivers/hv/vmbus_drv.c
@@ -1962,6 +1962,7 @@
 	 */
 	device_unregister(&device_obj->device);
 }
+EXPORT_SYMBOL_GPL(vmbus_device_unregister);
 
 #ifdef CONFIG_ACPI
 /*
--- linux-qcom-6.8.0.orig/drivers/hwmon/Kconfig
+++ linux-qcom-6.8.0/drivers/hwmon/Kconfig
@@ -38,6 +38,18 @@
 
 comment "Native drivers"
 
+config SENSORS_AAEON
+	tristate "AAEON hwmon driver"
+	depends on X86
+	depends on UBUNTU_ODM_DRIVERS
+	select MFD_AAEON
+	help
+	  This hwmon driver adds support for reporting temperature or fan
+	  speed and voltage on Single Board Computers produced by AAEON.
+
+	  This driver leverages the ASUS WMI interface to access device
+	  resources.
+
 config SENSORS_ABITUGURU
 	tristate "Abit uGuru (rev 1 & 2)"
 	depends on (X86 && DMI) || COMPILE_TEST
@@ -174,6 +186,7 @@
 	tristate "Analog Devices ADM9240 and compatibles"
 	depends on I2C
 	select HWMON_VID
+	select REGMAP_I2C
 	help
 	  If you say yes here you get support for Analog Devices ADM9240,
 	  Dallas DS1780, National Semiconductor LM81 sensor chips.
@@ -235,6 +248,7 @@
 config SENSORS_ADT7470
 	tristate "Analog Devices ADT7470"
 	depends on I2C
+	select REGMAP_I2C
 	help
 	  If you say yes here you get support for the Analog Devices
 	  ADT7470 temperature monitoring chips.
@@ -956,6 +970,7 @@
 config SENSORS_LTC2991
 	tristate "Analog Devices LTC2991"
 	depends on I2C
+	select REGMAP_I2C
 	help
 	  If you say yes here you get support for Analog Devices LTC2991
 	  Octal I2C Voltage, Current, and Temperature Monitor. The LTC2991
@@ -1232,6 +1247,7 @@
 config SENSORS_MC34VR500
 	tristate "NXP MC34VR500 hardware monitoring driver"
 	depends on I2C
+	select REGMAP_I2C
 	help
 	  If you say yes here you get support for the temperature and input
 	  voltage sensors of the NXP MC34VR500.
@@ -2170,6 +2186,7 @@
 config SENSORS_TMP513
 	tristate "Texas Instruments TMP513 and compatibles"
 	depends on I2C
+	select REGMAP_I2C
 	help
 	  If you say yes here you get support for Texas Instruments TMP512,
 	  and TMP513 temperature and power supply sensor chips.
--- linux-qcom-6.8.0.orig/drivers/hwmon/Makefile
+++ linux-qcom-6.8.0/drivers/hwmon/Makefile
@@ -15,6 +15,7 @@
 
 # Native drivers
 # asb100, then w83781d go first, as they can override other drivers' addresses.
+obj-$(CONFIG_SENSORS_AAEON)     += hwmon-aaeon.o
 obj-$(CONFIG_SENSORS_ASB100)	+= asb100.o
 obj-$(CONFIG_SENSORS_W83627HF)	+= w83627hf.o
 obj-$(CONFIG_SENSORS_W83773G)	+= w83773g.o
--- linux-qcom-6.8.0.orig/drivers/hwmon/acpi_power_meter.c
+++ linux-qcom-6.8.0/drivers/hwmon/acpi_power_meter.c
@@ -883,6 +883,22 @@
 	strcpy(acpi_device_class(device), ACPI_POWER_METER_CLASS);
 	device->driver_data = resource;
 
+#if IS_REACHABLE(CONFIG_ACPI_IPMI)
+	/*
+	 * On Dell systems several methods of acpi_power_meter access
+	 * variables in IPMI region, so wait until IPMI space handler is
+	 * installed by acpi_ipmi and also wait until SMI is selected to make
+	 * the space handler fully functional.
+	 */
+	if (dmi_match(DMI_SYS_VENDOR, "Dell Inc.")) {
+		struct acpi_device *ipi_device = acpi_dev_get_first_match_dev("IPI0001", NULL, -1);
+
+		if (ipi_device && acpi_wait_for_acpi_ipmi())
+				dev_warn(&device->dev, "Waiting for ACPI IPMI timeout");
+		acpi_dev_put(ipi_device);
+	}
+#endif
+
 	res = read_capabilities(resource);
 	if (res)
 		goto exit_free;
--- linux-qcom-6.8.0.orig/drivers/hwmon/adc128d818.c
+++ linux-qcom-6.8.0/drivers/hwmon/adc128d818.c
@@ -176,7 +176,7 @@
 
 	mutex_lock(&data->update_lock);
 	/* 10 mV LSB on limit registers */
-	regval = clamp_val(DIV_ROUND_CLOSEST(val, 10), 0, 255);
+	regval = DIV_ROUND_CLOSEST(clamp_val(val, 0, 2550), 10);
 	data->in[index][nr] = regval << 4;
 	reg = index == 1 ? ADC128_REG_IN_MIN(nr) : ADC128_REG_IN_MAX(nr);
 	i2c_smbus_write_byte_data(data->client, reg, regval);
@@ -214,7 +214,7 @@
 		return err;
 
 	mutex_lock(&data->update_lock);
-	regval = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127);
+	regval = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000);
 	data->temp[index] = regval << 1;
 	i2c_smbus_write_byte_data(data->client,
 				  index == 1 ? ADC128_REG_TEMP_MAX
--- linux-qcom-6.8.0.orig/drivers/hwmon/adt7475.c
+++ linux-qcom-6.8.0/drivers/hwmon/adt7475.c
@@ -1900,7 +1900,7 @@
 		data->pwm[CONTROL][index] &= ~0xE0;
 		data->pwm[CONTROL][index] |= (7 << 5);
 
-		i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index),
+		i2c_smbus_write_byte_data(client, PWM_REG(index),
 					  data->pwm[INPUT][index]);
 
 		i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index),
--- linux-qcom-6.8.0.orig/drivers/hwmon/amc6821.c
+++ linux-qcom-6.8.0/drivers/hwmon/amc6821.c
@@ -934,10 +934,21 @@
 
 MODULE_DEVICE_TABLE(i2c, amc6821_id);
 
+static const struct of_device_id __maybe_unused amc6821_of_match[] = {
+	{
+		.compatible = "ti,amc6821",
+		.data = (void *)amc6821,
+	},
+	{ }
+};
+
+MODULE_DEVICE_TABLE(of, amc6821_of_match);
+
 static struct i2c_driver amc6821_driver = {
 	.class = I2C_CLASS_HWMON,
 	.driver = {
 		.name	= "amc6821",
+		.of_match_table = of_match_ptr(amc6821_of_match),
 	},
 	.probe = amc6821_probe,
 	.id_table = amc6821_id,
--- linux-qcom-6.8.0.orig/drivers/hwmon/asus-ec-sensors.c
+++ linux-qcom-6.8.0/drivers/hwmon/asus-ec-sensors.c
@@ -412,7 +412,7 @@
 
 static const struct ec_board_info board_info_strix_x570_e_gaming = {
 	.sensors = SENSOR_SET_TEMP_CHIPSET_CPU_MB |
-		SENSOR_TEMP_T_SENSOR | SENSOR_TEMP_VRM |
+		SENSOR_TEMP_T_SENSOR |
 		SENSOR_FAN_CHIPSET | SENSOR_CURR_CPU |
 		SENSOR_IN_CPU_CORE,
 	.mutex_path = ASUS_HW_ACCESS_MUTEX_ASMX,
--- linux-qcom-6.8.0.orig/drivers/hwmon/coretemp.c
+++ linux-qcom-6.8.0/drivers/hwmon/coretemp.c
@@ -39,13 +39,18 @@
 module_param_named(tjmax, force_tjmax, int, 0444);
 MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
 
-#define PKG_SYSFS_ATTR_NO	1	/* Sysfs attribute for package temp */
-#define BASE_SYSFS_ATTR_NO	2	/* Sysfs Base attr no for coretemp */
 #define NUM_REAL_CORES		512	/* Number of Real cores per cpu */
 #define CORETEMP_NAME_LENGTH	28	/* String Length of attrs */
-#define MAX_CORE_ATTRS		4	/* Maximum no of basic attrs */
-#define TOTAL_ATTRS		(MAX_CORE_ATTRS + 1)
-#define MAX_CORE_DATA		(NUM_REAL_CORES + BASE_SYSFS_ATTR_NO)
+
+enum coretemp_attr_index {
+	ATTR_LABEL,
+	ATTR_CRIT_ALARM,
+	ATTR_TEMP,
+	ATTR_TJMAX,
+	ATTR_TTARGET,
+	MAX_CORE_ATTRS = ATTR_TJMAX + 1,	/* Maximum no of basic attrs */
+	TOTAL_ATTRS = ATTR_TTARGET + 1		/* Maximum no of possible attrs */
+};
 
 #ifdef CONFIG_SMP
 #define for_each_sibling(i, cpu) \
@@ -65,19 +70,17 @@
  * @status_reg: One of IA32_THERM_STATUS or IA32_PACKAGE_THERM_STATUS,
  *		from where the temperature values should be read.
  * @attr_size:  Total number of pre-core attrs displayed in the sysfs.
- * @is_pkg_data: If this is 1, the temp_data holds pkgtemp data.
- *		Otherwise, temp_data holds coretemp data.
  */
 struct temp_data {
 	int temp;
 	int tjmax;
 	unsigned long last_updated;
 	unsigned int cpu;
+	int index;
 	u32 cpu_core_id;
 	u32 status_reg;
 	int attr_size;
-	bool is_pkg_data;
-	struct sensor_device_attribute sd_attrs[TOTAL_ATTRS];
+	struct device_attribute sd_attrs[TOTAL_ATTRS];
 	char attr_name[TOTAL_ATTRS][CORETEMP_NAME_LENGTH];
 	struct attribute *attrs[TOTAL_ATTRS + 1];
 	struct attribute_group attr_group;
@@ -88,10 +91,11 @@
 struct platform_data {
 	struct device		*hwmon_dev;
 	u16			pkg_id;
-	u16			cpu_map[NUM_REAL_CORES];
+	int			nr_cores;
 	struct ida		ida;
 	struct cpumask		cpumask;
-	struct temp_data	*core_data[MAX_CORE_DATA];
+	struct temp_data	*pkg_data;
+	struct temp_data	**core_data;
 	struct device_attribute name_attr;
 };
 
@@ -143,6 +147,11 @@
 				 */
 };
 
+static bool is_pkg_temp_data(struct temp_data *tdata)
+{
+	return tdata->index < 0;
+}
+
 static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
 {
 	/* The 100C is default for both mobile and non mobile CPUs */
@@ -332,11 +341,10 @@
 static ssize_t show_label(struct device *dev,
 				struct device_attribute *devattr, char *buf)
 {
-	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
 	struct platform_data *pdata = dev_get_drvdata(dev);
-	struct temp_data *tdata = pdata->core_data[attr->index];
+	struct temp_data *tdata = container_of(devattr, struct temp_data, sd_attrs[ATTR_LABEL]);
 
-	if (tdata->is_pkg_data)
+	if (is_pkg_temp_data(tdata))
 		return sprintf(buf, "Package id %u\n", pdata->pkg_id);
 
 	return sprintf(buf, "Core %u\n", tdata->cpu_core_id);
@@ -346,9 +354,8 @@
 				struct device_attribute *devattr, char *buf)
 {
 	u32 eax, edx;
-	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-	struct platform_data *pdata = dev_get_drvdata(dev);
-	struct temp_data *tdata = pdata->core_data[attr->index];
+	struct temp_data *tdata = container_of(devattr, struct temp_data,
+						sd_attrs[ATTR_CRIT_ALARM]);
 
 	mutex_lock(&tdata->update_lock);
 	rdmsr_on_cpu(tdata->cpu, tdata->status_reg, &eax, &edx);
@@ -360,9 +367,7 @@
 static ssize_t show_tjmax(struct device *dev,
 			struct device_attribute *devattr, char *buf)
 {
-	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-	struct platform_data *pdata = dev_get_drvdata(dev);
-	struct temp_data *tdata = pdata->core_data[attr->index];
+	struct temp_data *tdata = container_of(devattr, struct temp_data, sd_attrs[ATTR_TJMAX]);
 	int tjmax;
 
 	mutex_lock(&tdata->update_lock);
@@ -375,9 +380,7 @@
 static ssize_t show_ttarget(struct device *dev,
 				struct device_attribute *devattr, char *buf)
 {
-	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-	struct platform_data *pdata = dev_get_drvdata(dev);
-	struct temp_data *tdata = pdata->core_data[attr->index];
+	struct temp_data *tdata = container_of(devattr, struct temp_data, sd_attrs[ATTR_TTARGET]);
 	int ttarget;
 
 	mutex_lock(&tdata->update_lock);
@@ -393,9 +396,7 @@
 			struct device_attribute *devattr, char *buf)
 {
 	u32 eax, edx;
-	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-	struct platform_data *pdata = dev_get_drvdata(dev);
-	struct temp_data *tdata = pdata->core_data[attr->index];
+	struct temp_data *tdata = container_of(devattr, struct temp_data, sd_attrs[ATTR_TEMP]);
 	int tjmax;
 
 	mutex_lock(&tdata->update_lock);
@@ -410,7 +411,7 @@
 		 * Return it instead of reporting an error which doesn't
 		 * really help at all.
 		 */
-		tdata->temp = tjmax - ((eax >> 16) & 0x7f) * 1000;
+		tdata->temp = tjmax - ((eax >> 16) & 0xff) * 1000;
 		tdata->last_updated = jiffies;
 	}
 
@@ -418,8 +419,7 @@
 	return sprintf(buf, "%d\n", tdata->temp);
 }
 
-static int create_core_attrs(struct temp_data *tdata, struct device *dev,
-			     int index)
+static int create_core_attrs(struct temp_data *tdata, struct device *dev)
 {
 	int i;
 	static ssize_t (*const rd_ptr[TOTAL_ATTRS]) (struct device *dev,
@@ -436,16 +436,15 @@
 		 * The attr number is always core id + 2
 		 * The Pkgtemp will always show up as temp1_*, if available
 		 */
-		int attr_no = tdata->is_pkg_data ? 1 : tdata->cpu_core_id + 2;
+		int attr_no = is_pkg_temp_data(tdata) ? 1 : tdata->cpu_core_id + 2;
 
 		snprintf(tdata->attr_name[i], CORETEMP_NAME_LENGTH,
 			 "temp%d_%s", attr_no, suffixes[i]);
-		sysfs_attr_init(&tdata->sd_attrs[i].dev_attr.attr);
-		tdata->sd_attrs[i].dev_attr.attr.name = tdata->attr_name[i];
-		tdata->sd_attrs[i].dev_attr.attr.mode = 0444;
-		tdata->sd_attrs[i].dev_attr.show = rd_ptr[i];
-		tdata->sd_attrs[i].index = index;
-		tdata->attrs[i] = &tdata->sd_attrs[i].dev_attr.attr;
+		sysfs_attr_init(&tdata->sd_attrs[i].attr);
+		tdata->sd_attrs[i].attr.name = tdata->attr_name[i];
+		tdata->sd_attrs[i].attr.mode = 0444;
+		tdata->sd_attrs[i].show = rd_ptr[i];
+		tdata->attrs[i] = &tdata->sd_attrs[i].attr;
 	}
 	tdata->attr_group.attrs = tdata->attrs;
 	return sysfs_create_group(&dev->kobj, &tdata->attr_group);
@@ -477,17 +476,44 @@
 	return NULL;
 }
 
-static struct temp_data *init_temp_data(unsigned int cpu, int pkg_flag)
+static struct temp_data *
+init_temp_data(struct platform_data *pdata, unsigned int cpu, int pkg_flag)
 {
 	struct temp_data *tdata;
 
+	if (!pdata->core_data) {
+		/*
+		 * TODO:
+		 * The information of actual possible cores in a package is broken for now.
+		 * Will replace hardcoded NUM_REAL_CORES with actual per package core count
+		 * when this information becomes available.
+		 */
+		pdata->nr_cores = NUM_REAL_CORES;
+		pdata->core_data = kcalloc(pdata->nr_cores, sizeof(struct temp_data *),
+					   GFP_KERNEL);
+		if (!pdata->core_data)
+			return NULL;
+	}
+
 	tdata = kzalloc(sizeof(struct temp_data), GFP_KERNEL);
 	if (!tdata)
 		return NULL;
 
+	if (pkg_flag) {
+		pdata->pkg_data = tdata;
+		/* Use tdata->index as indicator of package temp data */
+		tdata->index = -1;
+	} else {
+		tdata->index = ida_alloc_max(&pdata->ida, pdata->nr_cores - 1, GFP_KERNEL);
+		if (tdata->index < 0) {
+			kfree(tdata);
+			return NULL;
+		}
+		pdata->core_data[tdata->index] = tdata;
+	}
+
 	tdata->status_reg = pkg_flag ? MSR_IA32_PACKAGE_THERM_STATUS :
 							MSR_IA32_THERM_STATUS;
-	tdata->is_pkg_data = pkg_flag;
 	tdata->cpu = cpu;
 	tdata->cpu_core_id = topology_core_id(cpu);
 	tdata->attr_size = MAX_CORE_ATTRS;
@@ -495,6 +521,36 @@
 	return tdata;
 }
 
+static void destroy_temp_data(struct platform_data *pdata, struct temp_data *tdata)
+{
+	if (is_pkg_temp_data(tdata)) {
+		pdata->pkg_data = NULL;
+		kfree(pdata->core_data);
+		pdata->core_data = NULL;
+		pdata->nr_cores = 0;
+	} else {
+		pdata->core_data[tdata->index] = NULL;
+		ida_free(&pdata->ida, tdata->index);
+	}
+	kfree(tdata);
+}
+
+static struct temp_data *get_temp_data(struct platform_data *pdata, int cpu)
+{
+	int i;
+
+	/* cpu < 0 means get pkg temp_data */
+	if (cpu < 0)
+		return pdata->pkg_data;
+
+	for (i = 0; i < pdata->nr_cores; i++) {
+		if (pdata->core_data[i] &&
+		    pdata->core_data[i]->cpu_core_id == topology_core_id(cpu))
+			return pdata->core_data[i];
+	}
+	return NULL;
+}
+
 static int create_core_data(struct platform_device *pdev, unsigned int cpu,
 			    int pkg_flag)
 {
@@ -502,37 +558,19 @@
 	struct platform_data *pdata = platform_get_drvdata(pdev);
 	struct cpuinfo_x86 *c = &cpu_data(cpu);
 	u32 eax, edx;
-	int err, index;
+	int err;
 
 	if (!housekeeping_cpu(cpu, HK_TYPE_MISC))
 		return 0;
 
-	/*
-	 * Get the index of tdata in pdata->core_data[]
-	 * tdata for package: pdata->core_data[1]
-	 * tdata for core: pdata->core_data[2] .. pdata->core_data[NUM_REAL_CORES + 1]
-	 */
-	if (pkg_flag) {
-		index = PKG_SYSFS_ATTR_NO;
-	} else {
-		index = ida_alloc_max(&pdata->ida, NUM_REAL_CORES - 1, GFP_KERNEL);
-		if (index < 0)
-			return index;
-
-		pdata->cpu_map[index] = topology_core_id(cpu);
-		index += BASE_SYSFS_ATTR_NO;
-	}
-
-	tdata = init_temp_data(cpu, pkg_flag);
-	if (!tdata) {
-		err = -ENOMEM;
-		goto ida_free;
-	}
+	tdata = init_temp_data(pdata, cpu, pkg_flag);
+	if (!tdata)
+		return -ENOMEM;
 
 	/* Test if we can access the status register */
 	err = rdmsr_safe_on_cpu(cpu, tdata->status_reg, &eax, &edx);
 	if (err)
-		goto exit_free;
+		goto err;
 
 	/* Make sure tdata->tjmax is a valid indicator for dynamic/static tjmax */
 	get_tjmax(tdata, &pdev->dev);
@@ -546,20 +584,15 @@
 		if (get_ttarget(tdata, &pdev->dev) >= 0)
 			tdata->attr_size++;
 
-	pdata->core_data[index] = tdata;
-
 	/* Create sysfs interfaces */
-	err = create_core_attrs(tdata, pdata->hwmon_dev, index);
+	err = create_core_attrs(tdata, pdata->hwmon_dev);
 	if (err)
-		goto exit_free;
+		goto err;
 
 	return 0;
-exit_free:
-	pdata->core_data[index] = NULL;
-	kfree(tdata);
-ida_free:
-	if (!pkg_flag)
-		ida_free(&pdata->ida, index - BASE_SYSFS_ATTR_NO);
+
+err:
+	destroy_temp_data(pdata, tdata);
 	return err;
 }
 
@@ -570,10 +603,8 @@
 		dev_err(&pdev->dev, "Adding Core %u failed\n", cpu);
 }
 
-static void coretemp_remove_core(struct platform_data *pdata, int indx)
+static void coretemp_remove_core(struct platform_data *pdata, struct temp_data *tdata)
 {
-	struct temp_data *tdata = pdata->core_data[indx];
-
 	/* if we errored on add then this is already gone */
 	if (!tdata)
 		return;
@@ -581,11 +612,7 @@
 	/* Remove the sysfs attributes */
 	sysfs_remove_group(&pdata->hwmon_dev->kobj, &tdata->attr_group);
 
-	kfree(pdata->core_data[indx]);
-	pdata->core_data[indx] = NULL;
-
-	if (indx >= BASE_SYSFS_ATTR_NO)
-		ida_free(&pdata->ida, indx - BASE_SYSFS_ATTR_NO);
+	destroy_temp_data(pdata, tdata);
 }
 
 static int coretemp_device_add(int zoneid)
@@ -698,7 +725,7 @@
 	struct platform_device *pdev = coretemp_get_pdev(cpu);
 	struct platform_data *pd;
 	struct temp_data *tdata;
-	int i, indx = -1, target;
+	int target;
 
 	/* No need to tear down any interfaces for suspend */
 	if (cpuhp_tasks_frozen)
@@ -709,18 +736,7 @@
 	if (!pd->hwmon_dev)
 		return 0;
 
-	for (i = 0; i < NUM_REAL_CORES; i++) {
-		if (pd->cpu_map[i] == topology_core_id(cpu)) {
-			indx = i + BASE_SYSFS_ATTR_NO;
-			break;
-		}
-	}
-
-	/* Too many cores and this core is not populated, just return */
-	if (indx < 0)
-		return 0;
-
-	tdata = pd->core_data[indx];
+	tdata = get_temp_data(pd, cpu);
 
 	cpumask_clear_cpu(cpu, &pd->cpumask);
 
@@ -731,7 +747,7 @@
 	 */
 	target = cpumask_any_and(&pd->cpumask, topology_sibling_cpumask(cpu));
 	if (target >= nr_cpu_ids) {
-		coretemp_remove_core(pd, indx);
+		coretemp_remove_core(pd, tdata);
 	} else if (tdata && tdata->cpu == cpu) {
 		mutex_lock(&tdata->update_lock);
 		tdata->cpu = target;
@@ -741,10 +757,10 @@
 	/*
 	 * If all cores in this pkg are offline, remove the interface.
 	 */
-	tdata = pd->core_data[PKG_SYSFS_ATTR_NO];
+	tdata = get_temp_data(pd, -1);
 	if (cpumask_empty(&pd->cpumask)) {
 		if (tdata)
-			coretemp_remove_core(pd, PKG_SYSFS_ATTR_NO);
+			coretemp_remove_core(pd, tdata);
 		hwmon_device_unregister(pd->hwmon_dev);
 		pd->hwmon_dev = NULL;
 		return 0;
--- linux-qcom-6.8.0.orig/drivers/hwmon/corsair-cpro.c
+++ linux-qcom-6.8.0/drivers/hwmon/corsair-cpro.c
@@ -16,6 +16,7 @@
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>
+#include <linux/spinlock.h>
 #include <linux/types.h>
 
 #define USB_VENDOR_ID_CORSAIR			0x1b1c
@@ -77,8 +78,11 @@
 struct ccp_device {
 	struct hid_device *hdev;
 	struct device *hwmon_dev;
+	/* For reinitializing the completion below */
+	spinlock_t wait_input_report_lock;
 	struct completion wait_input_report;
 	struct mutex mutex; /* whenever buffer is used, lock before send_usb_cmd */
+	u8 *cmd_buffer;
 	u8 *buffer;
 	int target[6];
 	DECLARE_BITMAP(temp_cnct, NUM_TEMP_SENSORS);
@@ -111,15 +115,23 @@
 	unsigned long t;
 	int ret;
 
-	memset(ccp->buffer, 0x00, OUT_BUFFER_SIZE);
-	ccp->buffer[0] = command;
-	ccp->buffer[1] = byte1;
-	ccp->buffer[2] = byte2;
-	ccp->buffer[3] = byte3;
-
+	memset(ccp->cmd_buffer, 0x00, OUT_BUFFER_SIZE);
+	ccp->cmd_buffer[0] = command;
+	ccp->cmd_buffer[1] = byte1;
+	ccp->cmd_buffer[2] = byte2;
+	ccp->cmd_buffer[3] = byte3;
+
+	/*
+	 * Disable raw event parsing for a moment to safely reinitialize the
+	 * completion. Reinit is done because hidraw could have triggered
+	 * the raw event parsing and marked the ccp->wait_input_report
+	 * completion as done.
+	 */
+	spin_lock_bh(&ccp->wait_input_report_lock);
 	reinit_completion(&ccp->wait_input_report);
+	spin_unlock_bh(&ccp->wait_input_report_lock);
 
-	ret = hid_hw_output_report(ccp->hdev, ccp->buffer, OUT_BUFFER_SIZE);
+	ret = hid_hw_output_report(ccp->hdev, ccp->cmd_buffer, OUT_BUFFER_SIZE);
 	if (ret < 0)
 		return ret;
 
@@ -135,11 +147,12 @@
 	struct ccp_device *ccp = hid_get_drvdata(hdev);
 
 	/* only copy buffer when requested */
-	if (completion_done(&ccp->wait_input_report))
-		return 0;
-
-	memcpy(ccp->buffer, data, min(IN_BUFFER_SIZE, size));
-	complete(&ccp->wait_input_report);
+	spin_lock(&ccp->wait_input_report_lock);
+	if (!completion_done(&ccp->wait_input_report)) {
+		memcpy(ccp->buffer, data, min(IN_BUFFER_SIZE, size));
+		complete_all(&ccp->wait_input_report);
+	}
+	spin_unlock(&ccp->wait_input_report_lock);
 
 	return 0;
 }
@@ -492,7 +505,11 @@
 	if (!ccp)
 		return -ENOMEM;
 
-	ccp->buffer = devm_kmalloc(&hdev->dev, OUT_BUFFER_SIZE, GFP_KERNEL);
+	ccp->cmd_buffer = devm_kmalloc(&hdev->dev, OUT_BUFFER_SIZE, GFP_KERNEL);
+	if (!ccp->cmd_buffer)
+		return -ENOMEM;
+
+	ccp->buffer = devm_kmalloc(&hdev->dev, IN_BUFFER_SIZE, GFP_KERNEL);
 	if (!ccp->buffer)
 		return -ENOMEM;
 
@@ -510,7 +527,9 @@
 
 	ccp->hdev = hdev;
 	hid_set_drvdata(hdev, ccp);
+
 	mutex_init(&ccp->mutex);
+	spin_lock_init(&ccp->wait_input_report_lock);
 	init_completion(&ccp->wait_input_report);
 
 	hid_device_io_start(hdev);
--- linux-qcom-6.8.0.orig/drivers/hwmon/corsair-psu.c
+++ linux-qcom-6.8.0/drivers/hwmon/corsair-psu.c
@@ -875,15 +875,16 @@
 	{ HID_USB_DEVICE(0x1b1c, 0x1c04) }, /* Corsair HX650i */
 	{ HID_USB_DEVICE(0x1b1c, 0x1c05) }, /* Corsair HX750i */
 	{ HID_USB_DEVICE(0x1b1c, 0x1c06) }, /* Corsair HX850i */
-	{ HID_USB_DEVICE(0x1b1c, 0x1c07) }, /* Corsair HX1000i Series 2022 */
-	{ HID_USB_DEVICE(0x1b1c, 0x1c08) }, /* Corsair HX1200i */
+	{ HID_USB_DEVICE(0x1b1c, 0x1c07) }, /* Corsair HX1000i Legacy */
+	{ HID_USB_DEVICE(0x1b1c, 0x1c08) }, /* Corsair HX1200i Legacy */
 	{ HID_USB_DEVICE(0x1b1c, 0x1c09) }, /* Corsair RM550i */
 	{ HID_USB_DEVICE(0x1b1c, 0x1c0a) }, /* Corsair RM650i */
 	{ HID_USB_DEVICE(0x1b1c, 0x1c0b) }, /* Corsair RM750i */
 	{ HID_USB_DEVICE(0x1b1c, 0x1c0c) }, /* Corsair RM850i */
 	{ HID_USB_DEVICE(0x1b1c, 0x1c0d) }, /* Corsair RM1000i */
 	{ HID_USB_DEVICE(0x1b1c, 0x1c1e) }, /* Corsair HX1000i Series 2023 */
-	{ HID_USB_DEVICE(0x1b1c, 0x1c1f) }, /* Corsair HX1500i Series 2022 and 2023 */
+	{ HID_USB_DEVICE(0x1b1c, 0x1c1f) }, /* Corsair HX1500i Legacy and Series 2023 */
+	{ HID_USB_DEVICE(0x1b1c, 0x1c23) }, /* Corsair HX1200i Series 2023 */
 	{ },
 };
 MODULE_DEVICE_TABLE(hid, corsairpsu_idtable);
--- linux-qcom-6.8.0.orig/drivers/hwmon/drivetemp.c
+++ linux-qcom-6.8.0/drivers/hwmon/drivetemp.c
@@ -165,6 +165,7 @@
 {
 	u8 scsi_cmd[MAX_COMMAND_SIZE];
 	enum req_op op;
+	int err;
 
 	memset(scsi_cmd, 0, sizeof(scsi_cmd));
 	scsi_cmd[0] = ATA_16;
@@ -192,8 +193,11 @@
 	scsi_cmd[12] = lba_high;
 	scsi_cmd[14] = ata_command;
 
-	return scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,
-				ATA_SECT_SIZE, HZ, 5, NULL);
+	err = scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,
+			       ATA_SECT_SIZE, 10 * HZ, 5, NULL);
+	if (err > 0)
+		err = -EIO;
+	return err;
 }
 
 static int drivetemp_ata_command(struct drivetemp_data *st, u8 feature,
--- linux-qcom-6.8.0.orig/drivers/hwmon/emc2305.c
+++ linux-qcom-6.8.0/drivers/hwmon/emc2305.c
@@ -3,6 +3,7 @@
  * Hardware monitoring driver for EMC2305 fan controller
  *
  * Copyright (C) 2022 Nvidia Technologies Ltd.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/err.h>
@@ -530,6 +531,18 @@
 	return 0;
 }
 
+
+static int emc2305_detect(struct i2c_client *client, struct i2c_board_info *info)
+{
+	struct i2c_adapter *adapter = client->adapter;
+
+	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+		return -ENODEV;
+
+	strscpy(info->type, "emc2303", I2C_NAME_SIZE);
+	return 0;
+}
+
 static int emc2305_probe(struct i2c_client *client)
 {
 	struct i2c_adapter *adapter = client->adapter;
@@ -618,10 +631,27 @@
 	.probe = emc2305_probe,
 	.remove	  = emc2305_remove,
 	.id_table = emc2305_ids,
+	.detect = emc2305_detect,
 	.address_list = emc2305_normal_i2c,
 };
 
-module_i2c_driver(emc2305_driver);
+static struct i2c_board_info emc2305_i2c_info = {
+	I2C_BOARD_INFO("emc2303", 0x2c),
+};
+
+static int __init emc2305_init(void)
+{
+	i2c_register_board_info(1, &emc2305_i2c_info, 1);
+	return i2c_add_driver(&emc2305_driver);
+}
+
+static void __exit emc2305_exit(void)
+{
+	i2c_del_driver(&emc2305_driver);
+}
+
+module_init(emc2305_init);
+module_exit(emc2305_exit);
 
 MODULE_AUTHOR("Nvidia");
 MODULE_DESCRIPTION("Microchip EMC2305 fan controller driver");
--- linux-qcom-6.8.0.orig/drivers/hwmon/hp-wmi-sensors.c
+++ linux-qcom-6.8.0/drivers/hwmon/hp-wmi-sensors.c
@@ -1637,6 +1637,8 @@
 		goto out_unlock;
 
 	wobj = out.pointer;
+	if (!wobj)
+		goto out_unlock;
 
 	err = populate_event_from_wobj(dev, &event, wobj);
 	if (err) {
--- linux-qcom-6.8.0.orig/drivers/hwmon/hwmon-aaeon.c
+++ linux-qcom-6.8.0/drivers/hwmon/hwmon-aaeon.c
@@ -0,0 +1,568 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * AAEON HWMON driver
+ * Copyright (c) 2021, AAEON Ltd.
+ *
+ * Author: Edward Lin	<edward1_lin@aaeon.com.tw>
+ * Author: Kunyang Fan	<kunyang_fan@aaeon.com.tw>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/acpi.h>
+#include <linux/err.h>
+#include <linux/jiffies.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/platform_data/x86/asus-wmi.h>
+#include <linux/platform_device.h>
+
+#define DRVNAME "hwmon-aaeon"
+
+#define AAEON_WMI_MGMT_GUID		"97845ED0-4E6D-11DE-8A39-0800200C9A66"
+
+#define AAEON_VERSION_METHOD_ID		0x00000000
+#define HWM_INFORMATION_METHOD_ID	0x00030000
+#define HWM_METHOD_ID				0x00030001
+
+#define BITMAP_TEMP_ARG			0x12
+#define BITMAP_FAN_ARG			0x13
+#define BITMAP_VOLTAGE_ARG		0x14
+
+#define SENSOR_TEMP_NUMBER		0
+#define SENSOR_FAN_NUMBER		1
+#define SENSOR_VOLTAGE_NUMBER	2
+#define SENSOR_MAX_NUMBER		2
+
+static ssize_t aaeon_show_sensor(struct device *dev,
+			       struct device_attribute *devattr, char *buf);
+static ssize_t aaeon_show_sensor_name(struct device *dev,
+				    struct device_attribute *devattr,
+				    char *buf);
+static ssize_t aaeon_show_version(struct device *dev,
+				  struct device_attribute *devattr, char *buf);
+static ssize_t name_show(struct device *dev, struct device_attribute *devattr,
+			 char *buf);
+static int aaeon_get_version(void);
+static int aaeon_hwmon_probe(struct platform_device *pdev);
+static int aaeon_hwmon_remove(struct platform_device *pdev);
+
+static const char * const temp_sensors_name_table[] = {
+			"CPU_Temp",
+			"SYS1_Temp",
+			"SYS2_Temp",
+};
+
+static const char * const temp_sensors_name_table_V3[] = {
+			"SYS_Temp",
+			"CPU_Temp",
+};
+
+static const char * const fan_sensors_name_table[] = {
+			"CPU_FAN",
+			"SYS1_FAN",
+			"SYS2_FAN",
+			"Chasis1_FAN",
+			"Chasis2_FAN",
+};
+
+static const char * const fan_sensors_name_table_V3[] = {
+			"Chasis_FAN",
+			"CPU_FAN",
+};
+
+static const char * const voltage_sensors_name_table[] = {
+			"VCORE_Voltage",
+			"VMEM_Voltage",
+			"+12_Voltage",
+			"+5_Voltage",
+			"+3.3_Voltage",
+			"+1.8_Voltage",
+			"5VSB_Voltage",
+			"3VSB_Voltage",
+			"VBAT_Voltage",
+};
+
+static const char * const voltage_sensors_name_table_V3[] = {
+			"VCORE_Voltage",
+			"+5_Voltage",
+			"AVCC_Voltage",
+			"+3.3_Voltage",
+			"+12_Voltage",
+			"VCOREREFIN_Voltage",
+			"VIN4_Voltage",
+			"3VSB_Voltage",
+			"VBAT_Voltage",
+};
+
+struct aaeon_hwmon_data {
+	struct device *hwmon_dev;
+	int bfpi_version;
+	u32 temp_bitmap;
+	u32 fan_bitmap;
+	u32 voltage_bitmap;
+	unsigned int sensors_number[SENSOR_MAX_NUMBER + 1];
+	const char * const *temp_names;
+	const char * const *fan_names;
+	const char * const *voltage_names;
+};
+
+/* Temperature attributes */
+static struct sensor_device_attribute_2 temp_sys_nodes_atts[] = {
+	SENSOR_ATTR_2(temp1_input, 0444, aaeon_show_sensor, NULL,
+				SENSOR_TEMP_NUMBER, 0),
+	SENSOR_ATTR_2(temp1_label, 0444, aaeon_show_sensor_name, NULL,
+				SENSOR_TEMP_NUMBER, 0),
+	SENSOR_ATTR_2(temp2_input, 0444, aaeon_show_sensor, NULL,
+				SENSOR_TEMP_NUMBER, 1),
+	SENSOR_ATTR_2(temp2_label, 0444, aaeon_show_sensor_name, NULL,
+				SENSOR_TEMP_NUMBER, 1),
+	SENSOR_ATTR_2(temp3_input, 0444, aaeon_show_sensor, NULL,
+				SENSOR_TEMP_NUMBER, 2),
+	SENSOR_ATTR_2(temp3_label, 0444, aaeon_show_sensor_name, NULL,
+				SENSOR_TEMP_NUMBER, 2),
+};
+
+/* Cooler Fan attributes */
+static struct sensor_device_attribute_2 fan_sys_nodes_atts[] = {
+	SENSOR_ATTR_2(fan1_input, 0444, aaeon_show_sensor, NULL,
+				SENSOR_FAN_NUMBER, 0),
+	SENSOR_ATTR_2(fan1_label, 0444, aaeon_show_sensor_name, NULL,
+				SENSOR_FAN_NUMBER, 0),
+	SENSOR_ATTR_2(fan2_input, 0444, aaeon_show_sensor, NULL,
+				SENSOR_FAN_NUMBER, 1),
+	SENSOR_ATTR_2(fan2_label, 0444, aaeon_show_sensor_name, NULL,
+				SENSOR_FAN_NUMBER, 1),
+	SENSOR_ATTR_2(fan3_input, 0444, aaeon_show_sensor, NULL,
+				SENSOR_FAN_NUMBER, 2),
+	SENSOR_ATTR_2(fan3_label, 0444, aaeon_show_sensor_name, NULL,
+				SENSOR_FAN_NUMBER, 2),
+	SENSOR_ATTR_2(fan4_input, 0444, aaeon_show_sensor, NULL,
+				SENSOR_FAN_NUMBER, 3),
+	SENSOR_ATTR_2(fan4_label, 0444, aaeon_show_sensor_name, NULL,
+				SENSOR_FAN_NUMBER, 3),
+	SENSOR_ATTR_2(fan5_input, 0444, aaeon_show_sensor, NULL,
+				SENSOR_FAN_NUMBER, 4),
+	SENSOR_ATTR_2(fan5_label, 0444, aaeon_show_sensor_name, NULL,
+				SENSOR_FAN_NUMBER, 4),
+};
+
+/* Voltage attributes */
+static struct sensor_device_attribute_2 voltage_sys_nodes_atts[] = {
+	SENSOR_ATTR_2(in1_input, 0444, aaeon_show_sensor, NULL,
+			SENSOR_VOLTAGE_NUMBER, 0),
+	SENSOR_ATTR_2(in1_label, 0444, aaeon_show_sensor_name, NULL,
+			SENSOR_VOLTAGE_NUMBER, 0),
+	SENSOR_ATTR_2(in2_input, 0444, aaeon_show_sensor, NULL,
+			SENSOR_VOLTAGE_NUMBER, 1),
+	SENSOR_ATTR_2(in2_label, 0444, aaeon_show_sensor_name, NULL,
+			SENSOR_VOLTAGE_NUMBER, 1),
+	SENSOR_ATTR_2(in3_input, 0444, aaeon_show_sensor, NULL,
+			SENSOR_VOLTAGE_NUMBER, 2),
+	SENSOR_ATTR_2(in3_label, 0444, aaeon_show_sensor_name, NULL,
+			SENSOR_VOLTAGE_NUMBER, 2),
+	SENSOR_ATTR_2(in4_input, 0444, aaeon_show_sensor, NULL,
+			SENSOR_VOLTAGE_NUMBER, 3),
+	SENSOR_ATTR_2(in4_label, 0444, aaeon_show_sensor_name, NULL,
+			SENSOR_VOLTAGE_NUMBER, 3),
+	SENSOR_ATTR_2(in5_input, 0444, aaeon_show_sensor, NULL,
+			SENSOR_VOLTAGE_NUMBER, 4),
+	SENSOR_ATTR_2(in5_label, 0444, aaeon_show_sensor_name, NULL,
+			SENSOR_VOLTAGE_NUMBER, 4),
+	SENSOR_ATTR_2(in6_input, 0444, aaeon_show_sensor, NULL,
+			SENSOR_VOLTAGE_NUMBER, 5),
+	SENSOR_ATTR_2(in6_label, 0444, aaeon_show_sensor_name, NULL,
+			SENSOR_VOLTAGE_NUMBER, 5),
+	SENSOR_ATTR_2(in7_input, 0444, aaeon_show_sensor, NULL,
+			SENSOR_VOLTAGE_NUMBER, 6),
+	SENSOR_ATTR_2(in7_label, 0444, aaeon_show_sensor_name, NULL,
+			SENSOR_VOLTAGE_NUMBER, 6),
+	SENSOR_ATTR_2(in8_input, 0444, aaeon_show_sensor, NULL,
+			SENSOR_VOLTAGE_NUMBER, 7),
+	SENSOR_ATTR_2(in8_label, 0444, aaeon_show_sensor_name, NULL,
+			SENSOR_VOLTAGE_NUMBER, 7),
+	SENSOR_ATTR_2(in9_input, 0444, aaeon_show_sensor, NULL,
+			SENSOR_VOLTAGE_NUMBER, 8),
+	SENSOR_ATTR_2(in9_label, 0444, aaeon_show_sensor_name, NULL,
+			SENSOR_VOLTAGE_NUMBER, 8),
+
+};
+
+static struct sensor_device_attribute_2 info_sys_nodes_atts[] = {
+	/* WMI version Information */
+	SENSOR_ATTR_2(AAEON_VERSION, 0444, aaeon_show_version, NULL, 0, 0),
+};
+
+DEVICE_ATTR_RO(name);
+static ssize_t name_show(struct device *dev, struct device_attribute *devattr,
+			 char *buf)
+{
+	return sprintf(buf, "%s\n", DRVNAME);
+}
+
+static ssize_t aaeon_show_version(struct device *dev,
+				  struct device_attribute *devattr, char *buf)
+{
+	struct aaeon_hwmon_data *data =
+			(struct aaeon_hwmon_data *)dev_get_drvdata(dev);
+
+	return sprintf(buf, "%d\n", data->bfpi_version);
+}
+
+static ssize_t aaeon_show_sensor_name(struct device *dev,
+				    struct device_attribute *devattr, char *buf)
+{
+	u8 nr = to_sensor_dev_attr_2(devattr)->nr;
+	u8 index = to_sensor_dev_attr_2(devattr)->index;
+	struct aaeon_hwmon_data *data =
+			(struct aaeon_hwmon_data *)dev_get_drvdata(dev);
+
+	if (nr > SENSOR_MAX_NUMBER || index >= data->sensors_number[nr]) {
+		pr_debug("Can not check the device");
+		return -1;
+	}
+
+	switch (nr) {
+	case SENSOR_TEMP_NUMBER:
+		return sprintf(buf, "%s\n", data->temp_names[index]);
+	case SENSOR_FAN_NUMBER:
+		return sprintf(buf, "%s\n", data->fan_names[index]);
+	case SENSOR_VOLTAGE_NUMBER:
+		return sprintf(buf, "%s\n", data->voltage_names[index]);
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static ssize_t aaeon_show_sensor(struct device *dev,
+			       struct device_attribute *devattr, char *buf)
+{
+	u8 nr = to_sensor_dev_attr_2(devattr)->nr;
+	u8 index = to_sensor_dev_attr_2(devattr)->index;
+	u32 dev_id;
+	int retval, err;
+	struct aaeon_hwmon_data *data =
+			(struct aaeon_hwmon_data *)dev_get_drvdata(dev);
+
+	if (nr > SENSOR_MAX_NUMBER || index >= data->sensors_number[nr]) {
+		pr_debug("Can not check the device");
+		return -1;
+	}
+
+	/* For the V3 version, index need offset */
+	if (data->bfpi_version == 0x03 && nr != SENSOR_VOLTAGE_NUMBER)
+		index++;
+
+	dev_id = (index << 12) | (nr << 8);
+	err = asus_wmi_evaluate_method(HWM_METHOD_ID, dev_id, 0, &retval);
+	if (err)
+		return err;
+
+	/* For the V3 version, need to convert the raw value*/
+	if (nr == SENSOR_VOLTAGE_NUMBER && data->bfpi_version == 0x03) {
+		switch (index) {
+		case 0: /* VCORE */
+			retval = retval * 16;
+			break;
+		case 1: /* +5V */
+			retval = (retval * 2008) / 50;
+			break;
+		case 2: /* AVCC */
+			retval = retval * 16;
+			break;
+		case 3: /* +3.3V */
+			retval = retval * 16;
+			break;
+		case 4: /* +12V */
+			retval = retval * 96;
+			break;
+		case 5: /* VCOREREFIN */
+			retval = (retval * 552) / 41;
+			break;
+		case 6: /* VIN4 */
+			retval = retval * 8;
+			break;
+		case 7: /* 3VSB */
+			retval = retval * 16;
+			break;
+		case 8: /* VBAT */
+			retval = retval * 16;
+			break;
+		default:
+			break;
+		}
+	} else if (nr == SENSOR_TEMP_NUMBER && data->bfpi_version == 0x03)
+		retval = retval * 1000;
+
+	return sprintf(buf, "%d\n", retval);
+}
+
+static int aaeon_hwmon_create_sub_sysfs_fs(struct platform_device *pdev,
+					struct sensor_device_attribute_2 *attr,
+					int sensor_number,
+					u32 sensor_mask,
+					int bfpi_version)
+{
+	int i, err = 0;
+
+	for (i = 0; i < sensor_number; i++) {
+		if (bfpi_version == 0x03 || sensor_mask & BIT(i)) {
+			err = device_create_file(&pdev->dev, &attr[2 * i].dev_attr);
+			if (err)
+				break;
+			err = device_create_file(&pdev->dev, &attr[2 * i + 1].dev_attr);
+			if (err)
+				break;
+		}
+	}
+
+	return err;
+}
+
+static int
+aaeon_hwmon_create_sysfs_files(struct platform_device *pdev, struct aaeon_hwmon_data *data)
+{
+	int err;
+
+	/* register sysfs interface files */
+	err = device_create_file(&pdev->dev, &dev_attr_name);
+	if (err)
+		return err;
+
+	/* registe sysfs to dump sensors BFPI version */
+	err = device_create_file(&pdev->dev, &info_sys_nodes_atts[0].dev_attr);
+	if (err)
+		return err;
+
+	/* create temperature name and value node */
+	err = aaeon_hwmon_create_sub_sysfs_fs(pdev, temp_sys_nodes_atts,
+				data->sensors_number[SENSOR_TEMP_NUMBER],
+				data->temp_bitmap, data->bfpi_version);
+	if (err)
+		return err;
+
+	/* create fan name and value node */
+	err = aaeon_hwmon_create_sub_sysfs_fs(pdev, fan_sys_nodes_atts,
+				data->sensors_number[SENSOR_FAN_NUMBER],
+				data->fan_bitmap, data->bfpi_version);
+	if (err)
+		return err;
+
+	/* create voltage name and value node */
+	err = aaeon_hwmon_create_sub_sysfs_fs(pdev, voltage_sys_nodes_atts,
+				data->sensors_number[SENSOR_VOLTAGE_NUMBER],
+				data->voltage_bitmap, data->bfpi_version);
+	if (err)
+		return err;
+
+	return 0;
+}
+
+static void aaeon_hwmon_remove_sub_sysfs_fs(struct platform_device *pdev,
+					struct sensor_device_attribute_2 *attr,
+					int sensor_number,
+					u32 sensor_mask,
+					int bfpi_version)
+{
+	int i;
+
+	for (i = 0; i < sensor_number; i++) {
+		if (bfpi_version == 0x03 || sensor_mask & BIT(i)) {
+			device_remove_file(&pdev->dev, &attr[2 * i].dev_attr);
+			device_remove_file(&pdev->dev, &attr[2 * i + 1].dev_attr);
+		}
+	}
+}
+
+static void
+aaeon_hwmon_remove_sysfs_files(struct platform_device *pdev,
+			       struct aaeon_hwmon_data *data)
+{
+	/* degister sysfs interface files */
+	device_remove_file(&pdev->dev, &dev_attr_name);
+
+	/* degiste sysfs to dump sensors BFPI version */
+	device_remove_file(&pdev->dev, &info_sys_nodes_atts[0].dev_attr);
+
+	/* remove temperature name and value node */
+	aaeon_hwmon_remove_sub_sysfs_fs(pdev, temp_sys_nodes_atts,
+				data->sensors_number[SENSOR_TEMP_NUMBER],
+				data->temp_bitmap,
+				data->bfpi_version);
+
+	/* remove fan name and value node */
+	aaeon_hwmon_remove_sub_sysfs_fs(pdev, fan_sys_nodes_atts,
+				data->sensors_number[SENSOR_FAN_NUMBER],
+				data->fan_bitmap,
+				data->bfpi_version);
+
+	/* remove voltage name and value node */
+	aaeon_hwmon_remove_sub_sysfs_fs(pdev, voltage_sys_nodes_atts,
+				data->sensors_number[SENSOR_VOLTAGE_NUMBER],
+				data->voltage_bitmap,
+				data->bfpi_version);
+}
+
+static int aaeon_hwmon_remove(struct platform_device *pdev)
+{
+	struct aaeon_hwmon_data *data = platform_get_drvdata(pdev);
+
+	if (data->hwmon_dev)
+		hwmon_device_unregister(data->hwmon_dev);
+
+	aaeon_hwmon_remove_sysfs_files(pdev, data);
+
+	return 0;
+}
+
+static int aaeon_get_version(void)
+{
+	int err, retval;
+	u32 dev_id = 0x00;
+
+	err = asus_wmi_evaluate_method(AAEON_VERSION_METHOD_ID, dev_id, 0,
+				       &retval);
+	if (err)
+		return err;
+
+	return retval;
+}
+
+static int aaeon_hwmon_init_drv_data(struct aaeon_hwmon_data *data)
+{
+	int err;
+
+	data->bfpi_version = aaeon_get_version();
+	if (data->bfpi_version < 0) {
+		pr_debug("Error BFPI verion\n");
+		return -1;
+	}
+
+	if (data->bfpi_version == 0x03) {
+		/* set the number of bits in temp bitmap */
+		data->sensors_number[SENSOR_TEMP_NUMBER] =
+				ARRAY_SIZE(temp_sensors_name_table_V3);
+		data->temp_names = temp_sensors_name_table_V3;
+
+		/* set the number of bits in fan bitmap */
+		data->sensors_number[SENSOR_FAN_NUMBER] =
+				ARRAY_SIZE(fan_sensors_name_table_V3);
+		data->fan_names = fan_sensors_name_table_V3;
+
+		/* set the number of bits in voltage bitmap */
+		data->sensors_number[SENSOR_VOLTAGE_NUMBER] =
+				ARRAY_SIZE(voltage_sensors_name_table_V3);
+		data->voltage_names = voltage_sensors_name_table_V3;
+	} else {
+		/* set the number of bits in temp bitmap */
+		data->sensors_number[SENSOR_TEMP_NUMBER] =
+				ARRAY_SIZE(temp_sensors_name_table);
+		data->temp_names = temp_sensors_name_table;
+
+		/* set the number of bits in fan bitmap */
+		data->sensors_number[SENSOR_FAN_NUMBER] =
+				ARRAY_SIZE(fan_sensors_name_table);
+		data->fan_names = fan_sensors_name_table;
+
+		/* set the number of bits in voltage bitmap */
+		data->sensors_number[SENSOR_VOLTAGE_NUMBER] =
+				ARRAY_SIZE(voltage_sensors_name_table);
+		data->voltage_names = voltage_sensors_name_table;
+	}
+
+	/* get temp supported bitmap */
+	err = asus_wmi_evaluate_method(HWM_INFORMATION_METHOD_ID,
+				BITMAP_TEMP_ARG, 0, &data->temp_bitmap);
+	if (err)
+		return err;
+
+	/* get fan supported bitmap */
+	err = asus_wmi_evaluate_method(HWM_INFORMATION_METHOD_ID,
+				BITMAP_FAN_ARG, 0, &data->fan_bitmap);
+	if (err)
+		return err;
+
+	/* get voltage supported bitmap */
+	err = asus_wmi_evaluate_method(HWM_INFORMATION_METHOD_ID,
+				BITMAP_VOLTAGE_ARG, 0, &data->voltage_bitmap);
+	if (err)
+		return err;
+
+	return 0;
+}
+
+static int aaeon_hwmon_probe(struct platform_device *pdev)
+{
+	int err;
+	struct aaeon_hwmon_data *data;
+
+	pr_debug("aaeon hwomon device probe (support V3)!\n");
+	if (!wmi_has_guid(AAEON_WMI_MGMT_GUID)) {
+		pr_info("AAEON Management GUID not found\n");
+		return -ENODEV;
+	}
+
+	data = devm_kzalloc(&pdev->dev, sizeof(struct aaeon_hwmon_data),
+			    GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	err = aaeon_hwmon_init_drv_data(data);
+	if (err) {
+		pr_info("Error to get sensor support bitmap\n");
+		goto exit;
+	}
+
+	if (data->bfpi_version != 0x03 && data->temp_bitmap == 0 &&
+		data->fan_bitmap == 0 && data->voltage_bitmap == 0) {
+		pr_debug("No sensors found\n");
+		err = -ENODEV;
+		goto exit;
+	}
+
+	platform_set_drvdata(pdev, data);
+	err = aaeon_hwmon_create_sysfs_files(pdev, data);
+	if (err)
+		goto exit;
+
+	data->hwmon_dev = devm_hwmon_device_register_with_info(&pdev->dev,
+							  "AAEON_HWM",
+							  data,
+							  NULL,
+							  NULL);
+	if (IS_ERR(data->hwmon_dev)) {
+		err = PTR_ERR(data->hwmon_dev);
+		data->hwmon_dev = NULL;
+		goto exit_unregister_sysfs;
+	}
+
+	return 0;
+
+exit_unregister_sysfs:
+	aaeon_hwmon_remove(pdev);
+exit:
+	return err;
+}
+
+static struct platform_driver aaeon_hwmon_driver = {
+	.driver = {
+		.name = DRVNAME,
+		.owner = THIS_MODULE,
+	},
+	.probe = aaeon_hwmon_probe,
+	.remove = aaeon_hwmon_remove,
+};
+
+module_platform_driver_probe(aaeon_hwmon_driver, aaeon_hwmon_probe);
+
+MODULE_ALIAS("platform:hwmon-aaeon");
+MODULE_DESCRIPTION("AAEON Hardware Monitoring Driver");
+MODULE_AUTHOR("Edward Lin <edward1_lin@aaeon.com.tw>");
+MODULE_AUTHOR("Kunyang Fan <kunyang_fan@aaeon.com.tw>");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/drivers/hwmon/intel-m10-bmc-hwmon.c
+++ linux-qcom-6.8.0/drivers/hwmon/intel-m10-bmc-hwmon.c
@@ -358,7 +358,7 @@
 	{ 0x4f0, 0x4f4, 0x4f8, 0x52c, 0x0, 500, "Board Top Near FPGA Temperature" },
 	{ 0x4fc, 0x500, 0x504, 0x52c, 0x0, 500, "Board Bottom Near CVL Temperature" },
 	{ 0x508, 0x50c, 0x510, 0x52c, 0x0, 500, "Board Top East Near VRs Temperature" },
-	{ 0x514, 0x518, 0x51c, 0x52c, 0x0, 500, "Columbiaville Die Temperature" },
+	{ 0x514, 0x518, 0x51c, 0x52c, 0x0, 500, "CVL Die Temperature" },
 	{ 0x520, 0x524, 0x528, 0x52c, 0x0, 500, "Board Rear Side Temperature" },
 	{ 0x530, 0x534, 0x538, 0x52c, 0x0, 500, "Board Front Side Temperature" },
 	{ 0x53c, 0x540, 0x544, 0x0, 0x0, 500, "QSFP1 Case Temperature" },
@@ -429,7 +429,7 @@
 };
 
 static const struct m10bmc_sdata n6000bmc_power_tbl[] = {
-	{ 0x724, 0x0, 0x0, 0x0, 0x0, 1, "Board Power" },
+	{ 0x724, 0x0, 0x0, 0x0, 0x0, 1000, "Board Power" },
 };
 
 static const struct hwmon_channel_info * const n6000bmc_hinfo[] = {
--- linux-qcom-6.8.0.orig/drivers/hwmon/k10temp.c
+++ linux-qcom-6.8.0/drivers/hwmon/k10temp.c
@@ -153,8 +153,9 @@
 
 static void read_tempreg_nb_zen(struct pci_dev *pdev, u32 *regval)
 {
-	amd_smn_read(amd_pci_dev_to_node_id(pdev),
-		     ZEN_REPORTED_TEMP_CTRL_BASE, regval);
+	if (amd_smn_read(amd_pci_dev_to_node_id(pdev),
+			 ZEN_REPORTED_TEMP_CTRL_BASE, regval))
+		*regval = 0;
 }
 
 static long get_raw_temp(struct k10temp_data *data)
@@ -205,6 +206,7 @@
 			     long *val)
 {
 	struct k10temp_data *data = dev_get_drvdata(dev);
+	int ret = -EOPNOTSUPP;
 	u32 regval;
 
 	switch (attr) {
@@ -221,13 +223,17 @@
 				*val = 0;
 			break;
 		case 2 ... 13:		/* Tccd{1-12} */
-			amd_smn_read(amd_pci_dev_to_node_id(data->pdev),
-				     ZEN_CCD_TEMP(data->ccd_offset, channel - 2),
-						  &regval);
+			ret = amd_smn_read(amd_pci_dev_to_node_id(data->pdev),
+					   ZEN_CCD_TEMP(data->ccd_offset, channel - 2),
+					   &regval);
+
+			if (ret)
+				return ret;
+
 			*val = (regval & ZEN_CCD_TEMP_MASK) * 125 - 49000;
 			break;
 		default:
-			return -EOPNOTSUPP;
+			return ret;
 		}
 		break;
 	case hwmon_temp_max:
@@ -243,7 +249,7 @@
 			- ((regval >> 24) & 0xf)) * 500 + 52000;
 		break;
 	default:
-		return -EOPNOTSUPP;
+		return ret;
 	}
 	return 0;
 }
@@ -381,8 +387,20 @@
 	int i;
 
 	for (i = 0; i < limit; i++) {
-		amd_smn_read(amd_pci_dev_to_node_id(pdev),
-			     ZEN_CCD_TEMP(data->ccd_offset, i), &regval);
+		/*
+		 * Ignore inaccessible CCDs.
+		 *
+		 * Some systems will return a register value of 0, and the TEMP_VALID
+		 * bit check below will naturally fail.
+		 *
+		 * Other systems will return a PCI_ERROR_RESPONSE (0xFFFFFFFF) for
+		 * the register value. And this will incorrectly pass the TEMP_VALID
+		 * bit check.
+		 */
+		if (amd_smn_read(amd_pci_dev_to_node_id(pdev),
+				 ZEN_CCD_TEMP(data->ccd_offset, i), &regval))
+			continue;
+
 		if (regval & ZEN_CCD_TEMP_VALID)
 			data->show_temp |= BIT(TCCD_BIT(i));
 	}
@@ -528,6 +546,7 @@
 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) },
 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
+	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
 	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
 	{}
 };
--- linux-qcom-6.8.0.orig/drivers/hwmon/lm95234.c
+++ linux-qcom-6.8.0/drivers/hwmon/lm95234.c
@@ -301,7 +301,8 @@
 	if (ret < 0)
 		return ret;
 
-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, index ? 255 : 127);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, (index ? 255 : 127) * 1000),
+				1000);
 
 	mutex_lock(&data->update_lock);
 	data->tcrit2[index] = val;
@@ -350,7 +351,7 @@
 	if (ret < 0)
 		return ret;
 
-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000);
 
 	mutex_lock(&data->update_lock);
 	data->tcrit1[index] = val;
@@ -391,7 +392,7 @@
 	if (ret < 0)
 		return ret;
 
-	val = DIV_ROUND_CLOSEST(val, 1000);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, -255000, 255000), 1000);
 	val = clamp_val((int)data->tcrit1[index] - val, 0, 31);
 
 	mutex_lock(&data->update_lock);
@@ -431,7 +432,7 @@
 		return ret;
 
 	/* Accuracy is 1/2 degrees C */
-	val = clamp_val(DIV_ROUND_CLOSEST(val, 500), -128, 127);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, -64000, 63500), 500);
 
 	mutex_lock(&data->update_lock);
 	data->toffset[index] = val;
--- linux-qcom-6.8.0.orig/drivers/hwmon/ltc2991.c
+++ linux-qcom-6.8.0/drivers/hwmon/ltc2991.c
@@ -42,9 +42,9 @@
 #define LTC2991_V7_V8_FILT_EN		BIT(7)
 #define LTC2991_V7_V8_TEMP_EN		BIT(5)
 #define LTC2991_V7_V8_DIFF_EN		BIT(4)
-#define LTC2991_V5_V6_FILT_EN		BIT(7)
-#define LTC2991_V5_V6_TEMP_EN		BIT(5)
-#define LTC2991_V5_V6_DIFF_EN		BIT(4)
+#define LTC2991_V5_V6_FILT_EN		BIT(3)
+#define LTC2991_V5_V6_TEMP_EN		BIT(1)
+#define LTC2991_V5_V6_DIFF_EN		BIT(0)
 
 #define LTC2991_REPEAT_ACQ_EN		BIT(4)
 #define LTC2991_T_INT_FILT_EN		BIT(3)
@@ -125,7 +125,7 @@
 
 	/* Vx-Vy, 19.075uV/LSB */
 	*val = DIV_ROUND_CLOSEST(sign_extend32(reg_val, 14) * 19075,
-				 st->r_sense_uohm[channel]);
+				 (s32)st->r_sense_uohm[channel]);
 
 	return 0;
 }
@@ -225,8 +225,8 @@
 	case hwmon_temp:
 		switch (attr) {
 		case hwmon_temp_input:
-			if (st->temp_en[channel] ||
-			    channel == LTC2991_T_INT_CH_NR)
+			if (channel == LTC2991_T_INT_CH_NR ||
+			    st->temp_en[channel])
 				return 0444;
 			break;
 		}
--- linux-qcom-6.8.0.orig/drivers/hwmon/ltc2992.c
+++ linux-qcom-6.8.0/drivers/hwmon/ltc2992.c
@@ -876,9 +876,11 @@
 
 		ret = fwnode_property_read_u32(child, "shunt-resistor-micro-ohms", &val);
 		if (!ret) {
-			if (!val)
+			if (!val) {
+				fwnode_handle_put(child);
 				return dev_err_probe(&st->client->dev, -EINVAL,
 						     "shunt resistor value cannot be zero\n");
+			}
 			st->r_sense_uohm[addr] = val;
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/hwmon/max16065.c
+++ linux-qcom-6.8.0/drivers/hwmon/max16065.c
@@ -79,7 +79,7 @@
 };
 
 struct max16065_data {
-	enum chips type;
+	enum chips chip;
 	struct i2c_client *client;
 	const struct attribute_group *groups[4];
 	struct mutex update_lock;
@@ -114,9 +114,10 @@
 	return limit * range / 256;
 }
 
-static inline int MV_TO_LIMIT(int mv, int range)
+static inline int MV_TO_LIMIT(unsigned long mv, int range)
 {
-	return clamp_val(DIV_ROUND_CLOSEST(mv * 256, range), 0, 255);
+	mv = clamp_val(mv, 0, ULONG_MAX / 256);
+	return DIV_ROUND_CLOSEST(clamp_val(mv * 256, 0, range * 255), range);
 }
 
 static inline int ADC_TO_CURR(int adc, int gain)
@@ -161,10 +162,17 @@
 						     MAX16065_CURR_SENSE);
 		}
 
-		for (i = 0; i < DIV_ROUND_UP(data->num_adc, 8); i++)
+		for (i = 0; i < 2; i++)
 			data->fault[i]
 			  = i2c_smbus_read_byte_data(client, MAX16065_FAULT(i));
 
+		/*
+		 * MAX16067 and MAX16068 have separate undervoltage and
+		 * overvoltage alarm bits. Squash them together.
+		 */
+		if (data->chip == max16067 || data->chip == max16068)
+			data->fault[0] |= data->fault[1];
+
 		data->last_updated = jiffies;
 		data->valid = true;
 	}
@@ -493,8 +501,6 @@
 	.is_visible = max16065_secondary_is_visible,
 };
 
-static const struct i2c_device_id max16065_id[];
-
 static int max16065_probe(struct i2c_client *client)
 {
 	struct i2c_adapter *adapter = client->adapter;
@@ -505,7 +511,7 @@
 	bool have_secondary;		/* true if chip has secondary limits */
 	bool secondary_is_max = false;	/* secondary limits reflect max */
 	int groups = 0;
-	const struct i2c_device_id *id = i2c_match_id(max16065_id, client);
+	enum chips chip = (uintptr_t)i2c_get_match_data(client);
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA
 				     | I2C_FUNC_SMBUS_READ_WORD_DATA))
@@ -515,12 +521,13 @@
 	if (unlikely(!data))
 		return -ENOMEM;
 
+	data->chip = chip;
 	data->client = client;
 	mutex_init(&data->update_lock);
 
-	data->num_adc = max16065_num_adc[id->driver_data];
-	data->have_current = max16065_have_current[id->driver_data];
-	have_secondary = max16065_have_secondary[id->driver_data];
+	data->num_adc = max16065_num_adc[chip];
+	data->have_current = max16065_have_current[chip];
+	have_secondary = max16065_have_secondary[chip];
 
 	if (have_secondary) {
 		val = i2c_smbus_read_byte_data(client, MAX16065_SW_ENABLE);
--- linux-qcom-6.8.0.orig/drivers/hwmon/max6697.c
+++ linux-qcom-6.8.0/drivers/hwmon/max6697.c
@@ -311,6 +311,7 @@
 		return ret;
 
 	mutex_lock(&data->update_lock);
+	temp = clamp_val(temp, -1000000, 1000000);	/* prevent underflow */
 	temp = DIV_ROUND_CLOSEST(temp, 1000) + data->temp_offset;
 	temp = clamp_val(temp, 0, data->type == max6581 ? 255 : 127);
 	data->temp[nr][index] = temp;
@@ -428,14 +429,14 @@
 static SENSOR_DEVICE_ATTR_RO(temp7_max_alarm, alarm, 21);
 static SENSOR_DEVICE_ATTR_RO(temp8_max_alarm, alarm, 23);
 
-static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 14);
+static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 15);
 static SENSOR_DEVICE_ATTR_RO(temp2_crit_alarm, alarm, 8);
 static SENSOR_DEVICE_ATTR_RO(temp3_crit_alarm, alarm, 9);
 static SENSOR_DEVICE_ATTR_RO(temp4_crit_alarm, alarm, 10);
 static SENSOR_DEVICE_ATTR_RO(temp5_crit_alarm, alarm, 11);
 static SENSOR_DEVICE_ATTR_RO(temp6_crit_alarm, alarm, 12);
 static SENSOR_DEVICE_ATTR_RO(temp7_crit_alarm, alarm, 13);
-static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 15);
+static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 14);
 
 static SENSOR_DEVICE_ATTR_RO(temp2_fault, alarm, 1);
 static SENSOR_DEVICE_ATTR_RO(temp3_fault, alarm, 2);
--- linux-qcom-6.8.0.orig/drivers/hwmon/nct6775-core.c
+++ linux-qcom-6.8.0/drivers/hwmon/nct6775-core.c
@@ -2262,7 +2262,7 @@
 	if (err < 0)
 		return err;
 
-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000);
 
 	mutex_lock(&data->update_lock);
 	data->temp_offset[nr] = val;
@@ -2878,8 +2878,7 @@
 	if (err < 0)
 		return err;
 
-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0,
-			data->target_temp_mask);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, data->target_temp_mask * 1000), 1000);
 
 	mutex_lock(&data->update_lock);
 	data->target_temp[nr] = val;
@@ -2959,7 +2958,7 @@
 		return err;
 
 	/* Limit tolerance as needed */
-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, data->tolerance_mask);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, data->tolerance_mask * 1000), 1000);
 
 	mutex_lock(&data->update_lock);
 	data->temp_tolerance[index][nr] = val;
@@ -3085,7 +3084,7 @@
 	if (err < 0)
 		return err;
 
-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000);
 
 	mutex_lock(&data->update_lock);
 	data->weight_temp[index][nr] = val;
--- linux-qcom-6.8.0.orig/drivers/hwmon/nct6775-platform.c
+++ linux-qcom-6.8.0/drivers/hwmon/nct6775-platform.c
@@ -1269,6 +1269,7 @@
 	"EX-B760M-V5 D4",
 	"EX-H510M-V3",
 	"EX-H610M-V3 D4",
+	"G15CF",
 	"PRIME A620M-A",
 	"PRIME B560-PLUS",
 	"PRIME B560-PLUS AC-HES",
@@ -1349,6 +1350,8 @@
 	"Pro H610M-CT D4",
 	"Pro H610T D4",
 	"Pro Q670M-C",
+	"Pro WS 600M-CL",
+	"Pro WS 665-ACE",
 	"Pro WS W680-ACE",
 	"Pro WS W680-ACE IPMI",
 	"Pro WS W790-ACE",
--- linux-qcom-6.8.0.orig/drivers/hwmon/ntc_thermistor.c
+++ linux-qcom-6.8.0/drivers/hwmon/ntc_thermistor.c
@@ -62,6 +62,7 @@
 	[NTC_SSG1404001221]   = { "ssg1404_001221",  TYPE_NCPXXWB473 },
 	[NTC_LAST]            = { },
 };
+MODULE_DEVICE_TABLE(platform, ntc_thermistor_id);
 
 /*
  * A compensation table should be sorted by the values of .ohm
--- linux-qcom-6.8.0.orig/drivers/hwmon/pmbus/pmbus.h
+++ linux-qcom-6.8.0/drivers/hwmon/pmbus/pmbus.h
@@ -418,6 +418,12 @@
 enum pmbus_data_format { linear = 0, ieee754, direct, vid };
 enum vrm_version { vr11 = 0, vr12, vr13, imvp9, amd625mv };
 
+/* PMBus revision identifiers */
+#define PMBUS_REV_10 0x00	/* PMBus revision 1.0 */
+#define PMBUS_REV_11 0x11	/* PMBus revision 1.1 */
+#define PMBUS_REV_12 0x22	/* PMBus revision 1.2 */
+#define PMBUS_REV_13 0x33	/* PMBus revision 1.3 */
+
 struct pmbus_driver_info {
 	int pages;		/* Total number of pages */
 	u8 phases[PMBUS_PAGES];	/* Number of phases per page */
--- linux-qcom-6.8.0.orig/drivers/hwmon/pmbus/pmbus_core.c
+++ linux-qcom-6.8.0/drivers/hwmon/pmbus/pmbus_core.c
@@ -85,6 +85,8 @@
 
 	u32 flags;		/* from platform data */
 
+	u8 revision;	/* The PMBus revision the device is compliant with */
+
 	int exponent[PMBUS_PAGES];
 				/* linear mode: exponent for output voltages */
 
@@ -1095,9 +1097,14 @@
 
 	regval = status & mask;
 	if (regval) {
-		ret = _pmbus_write_byte_data(client, page, reg, regval);
-		if (ret)
-			goto unlock;
+		if (data->revision >= PMBUS_REV_12) {
+			ret = _pmbus_write_byte_data(client, page, reg, regval);
+			if (ret)
+				goto unlock;
+		} else {
+			pmbus_clear_fault_page(client, page);
+		}
+
 	}
 	if (s1 && s2) {
 		s64 v1, v2;
@@ -2640,6 +2647,10 @@
 			data->flags |= PMBUS_WRITE_PROTECTED | PMBUS_SKIP_STATUS_CHECK;
 	}
 
+	ret = i2c_smbus_read_byte_data(client, PMBUS_REVISION);
+	if (ret >= 0)
+		data->revision = ret;
+
 	if (data->info->pages)
 		pmbus_clear_faults(client);
 	else
@@ -3188,7 +3199,17 @@
 
 static int pmbus_write_smbalert_mask(struct i2c_client *client, u8 page, u8 reg, u8 val)
 {
-	return pmbus_write_word_data(client, page, PMBUS_SMBALERT_MASK, reg | (val << 8));
+	int ret;
+
+	ret = _pmbus_write_word_data(client, page, PMBUS_SMBALERT_MASK, reg | (val << 8));
+
+	/*
+	 * Clear fault systematically in case writing PMBUS_SMBALERT_MASK
+	 * is not supported by the chip.
+	 */
+	pmbus_clear_fault_page(client, page);
+
+	return ret;
 }
 
 static irqreturn_t pmbus_fault_handler(int irq, void *pdata)
--- linux-qcom-6.8.0.orig/drivers/hwmon/pmbus/ucd9000.c
+++ linux-qcom-6.8.0/drivers/hwmon/pmbus/ucd9000.c
@@ -80,11 +80,11 @@
  * It has been observed that the UCD90320 randomly fails register access when
  * doing another access right on the back of a register write. To mitigate this
  * make sure that there is a minimum delay between a write access and the
- * following access. The 250us is based on experimental data. At a delay of
- * 200us the issue seems to go away. Add a bit of extra margin to allow for
+ * following access. The 500 is based on experimental data. At a delay of
+ * 350us the issue seems to go away. Add a bit of extra margin to allow for
  * system to system differences.
  */
-#define UCD90320_WAIT_DELAY_US 250
+#define UCD90320_WAIT_DELAY_US 500
 
 static inline void ucd90320_wait(const struct ucd9000_data *data)
 {
--- linux-qcom-6.8.0.orig/drivers/hwmon/shtc1.c
+++ linux-qcom-6.8.0/drivers/hwmon/shtc1.c
@@ -238,7 +238,7 @@
 
 	if (np) {
 		data->setup.blocking_io = of_property_read_bool(np, "sensirion,blocking-io");
-		data->setup.high_precision = !of_property_read_bool(np, "sensicon,low-precision");
+		data->setup.high_precision = !of_property_read_bool(np, "sensirion,low-precision");
 	} else {
 		if (client->dev.platform_data)
 			data->setup = *(struct shtc1_platform_data *)dev->platform_data;
--- linux-qcom-6.8.0.orig/drivers/hwmon/tmp513.c
+++ linux-qcom-6.8.0/drivers/hwmon/tmp513.c
@@ -182,7 +182,7 @@
 	struct regmap *regmap;
 };
 
-// Set the shift based on the gain 8=4, 4=3, 2=2, 1=1
+// Set the shift based on the gain: 8 -> 1, 4 -> 2, 2 -> 3, 1 -> 4
 static inline u8 tmp51x_get_pga_shift(struct tmp51x_data *data)
 {
 	return 5 - ffs(data->pga_gain);
@@ -204,8 +204,11 @@
 		 * 2's complement number shifted by one to four depending
 		 * on the pga gain setting. 1lsb = 10uV
 		 */
-		*val = sign_extend32(regval, 17 - tmp51x_get_pga_shift(data));
-		*val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms);
+		*val = sign_extend32(regval,
+				     reg == TMP51X_SHUNT_CURRENT_RESULT ?
+				     16 - tmp51x_get_pga_shift(data) : 15);
+		*val = DIV_ROUND_CLOSEST(*val * 10 * (long)MILLI, (long)data->shunt_uohms);
+
 		break;
 	case TMP51X_BUS_VOLTAGE_RESULT:
 	case TMP51X_BUS_VOLTAGE_H_LIMIT:
@@ -220,8 +223,8 @@
 		break;
 	case TMP51X_BUS_CURRENT_RESULT:
 		// Current = (ShuntVoltage * CalibrationRegister) / 4096
-		*val = sign_extend32(regval, 16) * data->curr_lsb_ua;
-		*val = DIV_ROUND_CLOSEST(*val, MILLI);
+		*val = sign_extend32(regval, 15) * (long)data->curr_lsb_ua;
+		*val = DIV_ROUND_CLOSEST(*val, (long)MILLI);
 		break;
 	case TMP51X_LOCAL_TEMP_RESULT:
 	case TMP51X_REMOTE_TEMP_RESULT_1:
@@ -232,7 +235,7 @@
 	case TMP51X_REMOTE_TEMP_LIMIT_2:
 	case TMP513_REMOTE_TEMP_LIMIT_3:
 		// 1lsb = 0.0625 degrees centigrade
-		*val = sign_extend32(regval, 16) >> TMP51X_TEMP_SHIFT;
+		*val = sign_extend32(regval, 15) >> TMP51X_TEMP_SHIFT;
 		*val = DIV_ROUND_CLOSEST(*val * 625, 10);
 		break;
 	case TMP51X_N_FACTOR_AND_HYST_1:
@@ -261,7 +264,7 @@
 		 * The user enter current value and we convert it to
 		 * voltage. 1lsb = 10uV
 		 */
-		val = DIV_ROUND_CLOSEST(val * data->shunt_uohms, 10 * MILLI);
+		val = DIV_ROUND_CLOSEST(val * (long)data->shunt_uohms, 10 * (long)MILLI);
 		max_val = U16_MAX >> tmp51x_get_pga_shift(data);
 		regval = clamp_val(val, -max_val, max_val);
 		break;
--- linux-qcom-6.8.0.orig/drivers/hwmon/tps23861.c
+++ linux-qcom-6.8.0/drivers/hwmon/tps23861.c
@@ -132,7 +132,7 @@
 	if (err < 0)
 		return err;
 
-	*val = (regval * TEMPERATURE_LSB) - 20000;
+	*val = ((long)regval * TEMPERATURE_LSB) - 20000;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/hwmon/w83627ehf.c
+++ linux-qcom-6.8.0/drivers/hwmon/w83627ehf.c
@@ -895,7 +895,7 @@
 	if (err < 0)
 		return err;
 
-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 127);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 127000), 1000);
 
 	mutex_lock(&data->update_lock);
 	data->target_temp[nr] = val;
@@ -920,7 +920,7 @@
 		return err;
 
 	/* Limit the temp to 0C - 15C */
-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 15);
+	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 15000), 1000);
 
 	mutex_lock(&data->update_lock);
 	reg = w83627ehf_read_value(data, W83627EHF_REG_TOLERANCE[nr]);
--- linux-qcom-6.8.0.orig/drivers/hwspinlock/hwspinlock_core.c
+++ linux-qcom-6.8.0/drivers/hwspinlock/hwspinlock_core.c
@@ -306,6 +306,34 @@
 EXPORT_SYMBOL_GPL(__hwspin_unlock);
 
 /**
+ * hwspin_lock_bust() - bust a specific hwspinlock
+ * @hwlock: a previously-acquired hwspinlock which we want to bust
+ * @id: identifier of the remote lock holder, if applicable
+ *
+ * This function will bust a hwspinlock that was previously acquired as
+ * long as the current owner of the lock matches the id given by the caller.
+ *
+ * Context: Process context.
+ *
+ * Returns: 0 on success, or -EINVAL if the hwspinlock does not exist, or
+ * the bust operation fails, and -EOPNOTSUPP if the bust operation is not
+ * defined for the hwspinlock.
+ */
+int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id)
+{
+	if (WARN_ON(!hwlock))
+		return -EINVAL;
+
+	if (!hwlock->bank->ops->bust) {
+		pr_err("bust operation not defined\n");
+		return -EOPNOTSUPP;
+	}
+
+	return hwlock->bank->ops->bust(hwlock, id);
+}
+EXPORT_SYMBOL_GPL(hwspin_lock_bust);
+
+/**
  * of_hwspin_lock_simple_xlate - translate hwlock_spec to return a lock id
  * @hwlock_spec: hwlock specifier as found in the device tree
  *
--- linux-qcom-6.8.0.orig/drivers/hwspinlock/hwspinlock_internal.h
+++ linux-qcom-6.8.0/drivers/hwspinlock/hwspinlock_internal.h
@@ -21,6 +21,8 @@
  * @trylock: make a single attempt to take the lock. returns 0 on
  *	     failure and true on success. may _not_ sleep.
  * @unlock:  release the lock. always succeed. may _not_ sleep.
+ * @bust:    optional, platform-specific bust handler, called by hwspinlock
+ *	     core to bust a specific lock.
  * @relax:   optional, platform-specific relax handler, called by hwspinlock
  *	     core while spinning on a lock, between two successive
  *	     invocations of @trylock. may _not_ sleep.
@@ -28,6 +30,7 @@
 struct hwspinlock_ops {
 	int (*trylock)(struct hwspinlock *lock);
 	void (*unlock)(struct hwspinlock *lock);
+	int (*bust)(struct hwspinlock *lock, unsigned int id);
 	void (*relax)(struct hwspinlock *lock);
 };
 
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/Kconfig
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/Kconfig
@@ -35,6 +35,7 @@
 	tristate "Coresight generic TMC driver"
 
 	depends on CORESIGHT_LINKS_AND_SINKS
+	select CORESIGHT_CSR
 	help
 	  This enables support for the Trace Memory Controller driver.
 	  Depending on its configuration the device can act as a link (embedded
@@ -133,6 +134,14 @@
 	  To compile this driver as a module, choose M here: the
 	  module will be called coresight-stm.
 
+config CORESIGHT_CSR
+	tristate "CoreSight Slave Register driver"
+	help
+	  This driver provides support for CoreSight Slave Register block
+	  that hosts miscellaneous configuration registers.
+	  Those configuration registers can be used to control, various
+	  coresight configurations.
+
 config CORESIGHT_CPU_DEBUG
 	tristate "CoreSight CPU Debug driver"
 	depends on ARM || ARM64
@@ -163,6 +172,15 @@
 
 	  Say N if unsure.
 
+config CORESIGHT_REMOTE_ETM
+	tristate "Remote processor ETM trace support"
+	select QCOM_QMI_HELPERS
+	help
+	  Enables support for ETM trace collection on remote processor using
+	  CoreSight framework. Enabling this will allow turning on ETM
+	  tracing on remote processor via sysfs by configuring the required
+	  CoreSight components.
+
 config CORESIGHT_CTI
 	tristate "CoreSight Cross Trigger Interface (CTI) driver"
 	depends on ARM || ARM64
@@ -202,6 +220,20 @@
 	  To compile this driver as a module, choose M here: the module will be
 	  called coresight-trbe.
 
+config CORESIGHT_TGU
+	tristate "CoreSight Trigger Generation Unit driver"
+	help
+	  This driver provides support for Trigger Generation Unit that is
+	  used to detect patterns or sequences on a given set of signals.
+	  TGU is used to monitor a particular bus within a given region to
+	  detect illegal transaction sequences or slave responses. It is also
+	  used to monitor a data stream to detect protocol violations and to
+	  provide a trigger point for centering data around a specific event
+	  within the trace data buffer.
+
+	  To compile this driver as a module, choose M here: the module will be
+	  called coresight-tgu.
+
 config ULTRASOC_SMB
 	tristate "Ultrasoc system memory buffer drivers"
 	depends on ACPI || COMPILE_TEST
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/Makefile
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/Makefile
@@ -2,6 +2,8 @@
 #
 # Makefile for CoreSight drivers.
 #
+CFLAGS_coresight-stm.o := -D__DISABLE_TRACE_MMIO__
+
 obj-$(CONFIG_CORESIGHT) += coresight.o
 coresight-y := coresight-core.o  coresight-etm-perf.o coresight-platform.o \
 		coresight-sysfs.o coresight-syscfg.o coresight-config.o \
@@ -9,7 +11,8 @@
 		coresight-syscfg-configfs.o coresight-trace-id.o
 obj-$(CONFIG_CORESIGHT_LINK_AND_SINK_TMC) += coresight-tmc.o
 coresight-tmc-y := coresight-tmc-core.o coresight-tmc-etf.o \
-		      coresight-tmc-etr.o
+		      coresight-tmc-etr.o coresight-byte-cntr.o \
+		      coresight-tmc-usb.o
 obj-$(CONFIG_CORESIGHT_SINK_TPIU) += coresight-tpiu.o
 obj-$(CONFIG_CORESIGHT_SINK_ETBV10) += coresight-etb10.o
 obj-$(CONFIG_CORESIGHT_LINKS_AND_SINKS) += coresight-funnel.o \
@@ -24,6 +27,7 @@
 obj-$(CONFIG_CORESIGHT_CPU_DEBUG) += coresight-cpu-debug.o
 obj-$(CONFIG_CORESIGHT_CATU) += coresight-catu.o
 obj-$(CONFIG_CORESIGHT_CTI) += coresight-cti.o
+obj-$(CONFIG_CORESIGHT_REMOTE_ETM) += coresight-remote-etm.o
 obj-$(CONFIG_CORESIGHT_TRBE) += coresight-trbe.o
 obj-$(CONFIG_CORESIGHT_TPDM) += coresight-tpdm.o
 obj-$(CONFIG_CORESIGHT_TPDA) += coresight-tpda.o
@@ -31,3 +35,5 @@
 		   coresight-cti-sysfs.o
 obj-$(CONFIG_ULTRASOC_SMB) += ultrasoc-smb.o
 obj-$(CONFIG_CORESIGHT_DUMMY) += coresight-dummy.o
+obj-$(CONFIG_CORESIGHT_CSR) += coresight-csr.o
+obj-$(CONFIG_CORESIGHT_TGU) += coresight-tgu.o
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-byte-cntr.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-byte-cntr.c
@@ -0,0 +1,400 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/dma-mapping.h>
+#include <linux/fs.h>
+#include <linux/of_irq.h>
+#include <linux/moduleparam.h>
+#include <linux/delay.h>
+#include <linux/uaccess.h>
+#include <linux/property.h>
+
+#include "coresight-priv.h"
+#include "coresight-byte-cntr.h"
+#include "coresight-common.h"
+
+#define CSR_BYTECNTVAL		(0x06C)
+
+static void tmc_etr_read_bytes(struct byte_cntr *byte_cntr_data, long offset,
+			       size_t bytes, size_t *len, char **bufp)
+{
+	struct tmc_drvdata *tmcdrvdata = byte_cntr_data->tmcdrvdata;
+	struct etr_buf *etr_buf = tmcdrvdata->sysfs_buf;
+	size_t actual;
+
+	if (*len >= bytes)
+		*len = bytes;
+	else if (((uint32_t)offset % bytes) + *len > bytes)
+		*len = bytes - ((uint32_t)offset % bytes);
+
+	actual = tmc_etr_buf_get_data(etr_buf, offset, *len, bufp);
+	*len = actual;
+	if (actual == bytes || (actual + (uint32_t)offset) % bytes == 0)
+		atomic_dec(&byte_cntr_data->irq_cnt);
+}
+
+
+static irqreturn_t etr_handler(int irq, void *data)
+{
+	struct byte_cntr *byte_cntr_data = data;
+	struct tmc_drvdata *tmcdrvdata = byte_cntr_data->tmcdrvdata;
+
+	if (tmcdrvdata->out_mode == TMC_ETR_OUT_MODE_USB) {
+		atomic_inc(&byte_cntr_data->irq_cnt);
+		wake_up(&byte_cntr_data->usb_wait_wq);
+	} else if (tmcdrvdata->out_mode == TMC_ETR_OUT_MODE_MEM) {
+		atomic_inc(&byte_cntr_data->irq_cnt);
+		wake_up(&byte_cntr_data->wq);
+	}
+
+	byte_cntr_data->total_irq++;
+
+	return IRQ_HANDLED;
+}
+
+
+static long tmc_etr_flush_remaining_bytes(struct tmc_drvdata *tmcdrvdata, long offset,
+			size_t len, char **bufpp)
+{
+	long req_size, actual = 0;
+	struct etr_buf *etr_buf;
+	struct device *dev;
+	struct byte_cntr *byte_cntr_data;
+
+	if (!tmcdrvdata)
+		return -EINVAL;
+
+	byte_cntr_data = tmcdrvdata->byte_cntr;
+	if (!byte_cntr_data)
+		return -EINVAL;
+
+	etr_buf = tmcdrvdata->sysfs_buf;
+	dev = &tmcdrvdata->csdev->dev;
+
+	req_size = ((byte_cntr_data->rwp_offset < offset) ? tmcdrvdata->size : 0) +
+		byte_cntr_data->rwp_offset - offset;
+
+	if (req_size > len)
+		req_size = len;
+
+	if (req_size > 0)
+		actual = tmc_etr_buf_get_data(etr_buf, offset, req_size, bufpp);
+
+	return actual;
+}
+
+
+static ssize_t tmc_etr_byte_cntr_read(struct file *fp, char __user *data,
+			       size_t len, loff_t *ppos)
+{
+	struct byte_cntr *byte_cntr_data = fp->private_data;
+	struct tmc_drvdata *tmcdrvdata = byte_cntr_data->tmcdrvdata;
+	char *bufp = NULL;
+	long actual;
+	int ret = 0;
+
+	if (!data)
+		return -EINVAL;
+
+	mutex_lock(&byte_cntr_data->byte_cntr_lock);
+	if (!byte_cntr_data->read_active) {
+		actual = tmc_etr_flush_remaining_bytes(tmcdrvdata,
+				byte_cntr_data->offset, len, &bufp);
+		if (actual > 0) {
+			len = actual;
+			goto copy;
+		} else {
+			ret = -EINVAL;
+			goto err0;
+		}
+	}
+
+	if (byte_cntr_data->enable) {
+		if (!atomic_read(&byte_cntr_data->irq_cnt)) {
+			mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+			if (wait_event_interruptible(byte_cntr_data->wq,
+				atomic_read(&byte_cntr_data->irq_cnt) > 0
+				|| !byte_cntr_data->enable))
+				return -ERESTARTSYS;
+			mutex_lock(&byte_cntr_data->byte_cntr_lock);
+			if (!byte_cntr_data->read_active) {
+				actual = tmc_etr_flush_remaining_bytes(tmcdrvdata,
+						byte_cntr_data->offset, len, &bufp);
+				if (actual > 0) {
+					len = actual;
+					goto copy;
+				} else {
+					ret = -EINVAL;
+					goto err0;
+				}
+			}
+		}
+
+		tmc_etr_read_bytes(byte_cntr_data, byte_cntr_data->offset,
+				   byte_cntr_data->block_size, &len, &bufp);
+
+	} else {
+		actual = tmc_etr_flush_remaining_bytes(tmcdrvdata,
+				byte_cntr_data->offset, len, &bufp);
+		if (actual > 0) {
+			len = actual;
+			goto copy;
+		} else {
+			ret = -EINVAL;
+			goto err0;
+		}
+	}
+
+copy:
+	if (copy_to_user(data, bufp, len)) {
+		mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+		dev_dbg(&tmcdrvdata->csdev->dev,
+			"%s: copy_to_user failed\n", __func__);
+		return -EFAULT;
+	}
+
+	byte_cntr_data->total_size += len;
+
+	if (byte_cntr_data->offset + len >= tmcdrvdata->size)
+		byte_cntr_data->offset = 0;
+	else
+		byte_cntr_data->offset += len;
+
+	goto out;
+
+err0:
+	mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+	return ret;
+out:
+	mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+	return len;
+}
+
+void tmc_etr_byte_cntr_start(struct byte_cntr *byte_cntr_data)
+{
+	if (!byte_cntr_data)
+		return;
+
+	mutex_lock(&byte_cntr_data->byte_cntr_lock);
+
+	if (byte_cntr_data->block_size == 0
+		|| byte_cntr_data->read_active) {
+		mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+		return;
+	}
+
+	atomic_set(&byte_cntr_data->irq_cnt, 0);
+	byte_cntr_data->enable = true;
+	mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+}
+EXPORT_SYMBOL_GPL(tmc_etr_byte_cntr_start);
+
+void tmc_etr_byte_cntr_stop(struct byte_cntr *byte_cntr_data)
+{
+	if (!byte_cntr_data)
+		return;
+
+	mutex_lock(&byte_cntr_data->byte_cntr_lock);
+	byte_cntr_data->rwp_offset =
+		tmc_get_rwp_offset(byte_cntr_data->tmcdrvdata);
+	byte_cntr_data->enable = false;
+	byte_cntr_data->read_active = false;
+	atomic_set(&byte_cntr_data->irq_cnt, 0);
+	wake_up(&byte_cntr_data->wq);
+	coresight_csr_set_byte_cntr(byte_cntr_data->csr,
+				byte_cntr_data->irqctrl_offset, 0);
+	mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+
+}
+EXPORT_SYMBOL_GPL(tmc_etr_byte_cntr_stop);
+
+static int tmc_etr_byte_cntr_release(struct inode *in, struct file *fp)
+{
+	struct byte_cntr *byte_cntr_data = fp->private_data;
+	struct device *dev = &byte_cntr_data->tmcdrvdata->csdev->dev;
+
+	mutex_lock(&byte_cntr_data->byte_cntr_lock);
+	byte_cntr_data->read_active = false;
+
+	atomic_set(&byte_cntr_data->irq_cnt, 0);
+
+	if (byte_cntr_data->enable)
+		coresight_csr_set_byte_cntr(byte_cntr_data->csr,
+				byte_cntr_data->irqctrl_offset, 0);
+
+	disable_irq_wake(byte_cntr_data->byte_cntr_irq);
+
+	dev_dbg(dev, "send data total size: %lld bytes, irq_cnt: %lld, offset: %lld rwp_offset: %lld\n",
+		byte_cntr_data->total_size, byte_cntr_data->total_irq,
+		byte_cntr_data->offset,	byte_cntr_data->rwp_offset);
+	mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+
+	return 0;
+}
+
+static int tmc_etr_byte_cntr_open(struct inode *in, struct file *fp)
+{
+	struct byte_cntr *byte_cntr_data =
+			container_of(in->i_cdev, struct byte_cntr, dev);
+	struct tmc_drvdata *tmcdrvdata = byte_cntr_data->tmcdrvdata;
+
+	mutex_lock(&byte_cntr_data->byte_cntr_lock);
+
+	if (byte_cntr_data->read_active) {
+		mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+		return -EBUSY;
+	}
+
+	if (tmcdrvdata->mode != CS_MODE_SYSFS ||
+			!byte_cntr_data->block_size) {
+		mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+		return -EINVAL;
+	}
+
+	enable_irq_wake(byte_cntr_data->byte_cntr_irq);
+	/* IRQ is a '8- byte' counter and to observe interrupt at
+	 * 'block_size' bytes of data
+	 */
+
+	coresight_csr_set_byte_cntr(byte_cntr_data->csr, byte_cntr_data->irqctrl_offset,
+				(byte_cntr_data->block_size) / 8);
+
+	fp->private_data = byte_cntr_data;
+	nonseekable_open(in, fp);
+	byte_cntr_data->enable = true;
+	byte_cntr_data->read_active = true;
+	byte_cntr_data->total_size = 0;
+	byte_cntr_data->offset = tmc_get_rwp_offset(tmcdrvdata);
+	byte_cntr_data->total_irq = 0;
+	mutex_unlock(&byte_cntr_data->byte_cntr_lock);
+	return 0;
+}
+
+static const struct file_operations byte_cntr_fops = {
+	.owner		= THIS_MODULE,
+	.open		= tmc_etr_byte_cntr_open,
+	.read		= tmc_etr_byte_cntr_read,
+	.release	= tmc_etr_byte_cntr_release,
+	.llseek		= no_llseek,
+};
+
+static int byte_cntr_register_chardev(struct byte_cntr *byte_cntr_data)
+{
+	int ret;
+	unsigned int baseminor = 0;
+	unsigned int count = 1;
+	struct device *device;
+	dev_t dev;
+
+	ret = alloc_chrdev_region(&dev, baseminor, count, byte_cntr_data->name);
+	if (ret < 0) {
+		pr_err("alloc_chrdev_region failed %d\n", ret);
+		return ret;
+	}
+	cdev_init(&byte_cntr_data->dev, &byte_cntr_fops);
+
+	byte_cntr_data->dev.owner = THIS_MODULE;
+	byte_cntr_data->dev.ops = &byte_cntr_fops;
+
+	ret = cdev_add(&byte_cntr_data->dev, dev, 1);
+	if (ret)
+		goto exit_unreg_chrdev_region;
+
+	byte_cntr_data->driver_class = class_create(byte_cntr_data->class_name);
+	if (IS_ERR(byte_cntr_data->driver_class)) {
+		ret = -ENOMEM;
+		pr_err("class_create failed %d\n", ret);
+		goto exit_unreg_chrdev_region;
+	}
+
+	device = device_create(byte_cntr_data->driver_class, NULL,
+			       byte_cntr_data->dev.dev, byte_cntr_data,
+			       byte_cntr_data->name);
+
+	if (IS_ERR(device)) {
+		pr_err("class_device_create failed %d\n", ret);
+		ret = -ENOMEM;
+		goto exit_destroy_class;
+	}
+
+	return 0;
+
+exit_destroy_class:
+	class_destroy(byte_cntr_data->driver_class);
+exit_unreg_chrdev_region:
+	unregister_chrdev_region(byte_cntr_data->dev.dev, 1);
+	return ret;
+}
+
+struct byte_cntr *byte_cntr_init(struct amba_device *adev,
+				 struct tmc_drvdata *drvdata)
+{
+	struct device *dev = &adev->dev;
+	struct device_node *np = adev->dev.of_node;
+	int byte_cntr_irq;
+	int ret;
+	struct byte_cntr *byte_cntr_data;
+
+	byte_cntr_irq = of_irq_get_byname(np, "byte-cntr-irq");
+	if (byte_cntr_irq < 0)
+		return NULL;
+
+	byte_cntr_data = devm_kzalloc(dev, sizeof(*byte_cntr_data), GFP_KERNEL);
+	if (!byte_cntr_data)
+		return NULL;
+
+	ret = devm_request_irq(dev, byte_cntr_irq, etr_handler,
+			       IRQF_TRIGGER_RISING | IRQF_SHARED,
+			       dev_name(dev), byte_cntr_data);
+	if (ret) {
+		dev_err(dev, "Byte_cntr interrupt registration failed\n");
+		return NULL;
+	}
+
+	ret = of_property_read_u32(dev->of_node, "csr-irqctrl-offset",
+				&byte_cntr_data->irqctrl_offset);
+
+	if (ret) {
+		dev_dbg(dev, "Get byte cntr csr irqctrl offset failed\n");
+		byte_cntr_data->irqctrl_offset = CSR_BYTECNTVAL;
+	}
+
+	ret = device_property_read_string(dev, "byte-cntr-name", &byte_cntr_data->name);
+	if (ret) {
+		dev_dbg(dev, "Get byte cntr name failed\n");
+		byte_cntr_data->name = "byte-cntr";
+	}
+
+	ret = device_property_read_string(dev, "byte-cntr-class-name",
+				&byte_cntr_data->class_name);
+	if (ret) {
+		dev_dbg(dev, "Get byte cntr class name failed\n");
+		byte_cntr_data->class_name = "coresight-tmc-etr-stream";
+	}
+
+	ret = byte_cntr_register_chardev(byte_cntr_data);
+	if (ret) {
+		dev_err(dev, "Byte_cntr char dev registration failed\n");
+		return NULL;
+	}
+
+	byte_cntr_data->byte_cntr_irq = byte_cntr_irq;
+	byte_cntr_data->csr = drvdata->csr;
+	byte_cntr_data->tmcdrvdata = drvdata;
+	atomic_set(&byte_cntr_data->irq_cnt, 0);
+	init_waitqueue_head(&byte_cntr_data->wq);
+	mutex_init(&byte_cntr_data->byte_cntr_lock);
+
+	return byte_cntr_data;
+}
+
+void byte_cntr_remove(struct byte_cntr *byte_cntr_data)
+{
+	device_destroy(byte_cntr_data->driver_class,
+				byte_cntr_data->dev.dev);
+	class_destroy(byte_cntr_data->driver_class);
+	unregister_chrdev_region(byte_cntr_data->dev.dev, 1);
+}
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-byte-cntr.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-byte-cntr.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CORESIGHT_BYTE_CNTR_H
+#define _CORESIGHT_BYTE_CNTR_H
+#include <linux/cdev.h>
+#include <linux/amba/bus.h>
+#include <linux/wait.h>
+#include <linux/mutex.h>
+#include "coresight-tmc.h"
+
+struct byte_cntr {
+	struct cdev		dev;
+	struct class		*driver_class;
+	bool			enable;
+	bool			read_active;
+	uint32_t		byte_cntr_value;
+	uint32_t		block_size;
+	int			byte_cntr_irq;
+	atomic_t		irq_cnt;
+	atomic_t	usb_free_buf;
+	wait_queue_head_t	wq;
+	wait_queue_head_t	usb_wait_wq;
+	struct workqueue_struct	*usb_wq;
+	struct qdss_request	*usb_req;
+	struct work_struct	read_work;
+	struct mutex		usb_bypass_lock;
+	struct mutex		byte_cntr_lock;
+	struct coresight_csr		*csr;
+	struct tmc_drvdata	*tmcdrvdata;
+	const char		*name;
+	const char		*class_name;
+	int			irqctrl_offset;
+	unsigned long	offset;
+	unsigned long	rwp_offset;
+	uint64_t		total_size;
+	uint64_t		total_irq;
+
+};
+
+extern void tmc_etr_byte_cntr_start(struct byte_cntr *byte_cntr_data);
+extern void tmc_etr_byte_cntr_stop(struct byte_cntr *byte_cntr_data);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-common.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-common.h
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CORESIGHT_COMMON_H
+#define _CORESIGHT_COMMON_H
+
+#define BM(lsb, msb)		((BIT(msb) - BIT(lsb)) + BIT(msb))
+#define BVAL(val, n)            ((val & BIT(n)) >> n)
+
+struct coresight_csr {
+	const char *name;
+	struct list_head link;
+};
+
+#if IS_ENABLED(CONFIG_CORESIGHT_CSR)
+extern void msm_qdss_csr_enable_bam_to_usb(struct coresight_csr *csr);
+extern void msm_qdss_csr_enable_flush(struct coresight_csr *csr);
+extern void msm_qdss_csr_disable_bam_to_usb(struct coresight_csr *csr);
+extern void msm_qdss_csr_disable_flush(struct coresight_csr *csr);
+extern void msm_qdss_csr_enable_eth(struct coresight_csr *csr);
+extern void msm_qdss_csr_disable_eth(struct coresight_csr *csr);
+extern int coresight_csr_hwctrl_set(struct coresight_csr *csr, uint64_t addr,
+				 uint32_t val);
+extern void coresight_csr_set_byte_cntr(struct coresight_csr *csr, int irqctrl_offset,
+				 uint32_t count);
+extern struct coresight_csr *coresight_csr_get(const char *name);
+extern int coresight_csr_set_etr_atid(struct coresight_device *csdev, int atid, bool enable);
+#if IS_ENABLED(CONFIG_OF)
+extern int of_get_coresight_csr_name(struct device_node *node,
+				const char **csr_name);
+#else
+static inline int of_get_coresight_csr_name(struct device_node *node,
+		const char **csr_name){ return -EINVAL; }
+#endif
+
+#else
+static inline void msm_qdss_csr_enable_bam_to_usb(struct coresight_csr *csr) {}
+static inline void msm_qdss_csr_disable_bam_to_usb(struct coresight_csr *csr) {}
+static inline void msm_qdss_csr_disable_flush(struct coresight_csr *csr) {}
+static inline void msm_qdss_csr_enable_eth(struct coresight_csr *csr) {}
+static inline void msm_qdss_csr_disable_eth(struct coresight_csr *csr) {}
+static inline int coresight_csr_hwctrl_set(struct coresight_csr *csr,
+	uint64_t addr, uint32_t val) { return -EINVAL; }
+static inline void coresight_csr_set_byte_cntr(struct coresight_csr *csr, int irqctrl_offset,
+					   uint32_t count) {}
+static inline struct coresight_csr *coresight_csr_get(const char *name)
+					{ return NULL; }
+static inline int coresight_csr_set_etr_atid(struct coresight_device *csdev, int atid, bool enable)
+				{return -EINVAL; }
+static inline int of_get_coresight_csr_name(struct device_node *node,
+		const char **csr_name){ return -EINVAL; }
+#endif
+#endif
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-core.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-core.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2012, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/build_bug.h>
@@ -441,8 +442,26 @@
 	}
 }
 
+/*
+ * Helper function to call source_ops(csdev)->disable and also disable the
+ * helpers.
+ *
+ * There is an imbalance between coresight_enable_path() and
+ * coresight_disable_path(). Enabling also enables the source's helpers as part
+ * of the path, but disabling always skips the first item in the path (which is
+ * the source), so sources and their helpers don't get disabled as part of that
+ * function and we need the extra step here.
+ */
+void coresight_disable_source(struct coresight_device *csdev, void *data)
+{
+	if (source_ops(csdev)->disable)
+		source_ops(csdev)->disable(csdev, data);
+	coresight_disable_helpers(csdev);
+}
+EXPORT_SYMBOL_GPL(coresight_disable_source);
+
 /**
- *  coresight_disable_source - Drop the reference count by 1 and disable
+ *  coresight_disable_source_sysfs - Drop the reference count by 1 and disable
  *  the device if there are no users left.
  *
  *  @csdev: The coresight device to disable
@@ -451,17 +470,15 @@
  *
  *  Returns true if the device has been disabled.
  */
-bool coresight_disable_source(struct coresight_device *csdev, void *data)
+static bool coresight_disable_source_sysfs(struct coresight_device *csdev,
+					   void *data)
 {
 	if (atomic_dec_return(&csdev->refcnt) == 0) {
-		if (source_ops(csdev)->disable)
-			source_ops(csdev)->disable(csdev, data);
-		coresight_disable_helpers(csdev);
+		coresight_disable_source(csdev, data);
 		csdev->enable = false;
 	}
 	return !csdev->enable;
 }
-EXPORT_SYMBOL_GPL(coresight_disable_source);
 
 /*
  * coresight_disable_path_from : Disable components in the given path beyond
@@ -618,6 +635,7 @@
 
 	return csdev;
 }
+EXPORT_SYMBOL_GPL(coresight_get_sink);
 
 static struct coresight_device *
 coresight_find_enabled_sink(struct coresight_device *csdev)
@@ -1094,6 +1112,7 @@
 	if (subtype != CORESIGHT_DEV_SUBTYPE_SOURCE_PROC &&
 	    subtype != CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE &&
 	    subtype != CORESIGHT_DEV_SUBTYPE_SOURCE_TPDM &&
+	    subtype != CORESIGHT_DEV_SUBTYPE_SOURCE_REMOTE_PROC &&
 	    subtype != CORESIGHT_DEV_SUBTYPE_SOURCE_OTHERS) {
 		dev_err(&csdev->dev, "wrong device subtype in %s\n", function);
 		return -EINVAL;
@@ -1102,13 +1121,120 @@
 	return 0;
 }
 
+static int coresight_store_path(struct coresight_device *csdev,
+		struct list_head *path)
+{
+	int cpu, ret;
+	enum coresight_dev_subtype_source subtype;
+	u32 hash;
+
+	subtype = csdev->subtype.source_subtype;
+
+	switch (subtype) {
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_PROC:
+		/*
+		 * When working from sysFS it is important to keep track
+		 * of the paths that were created so that they can be
+		 * undone in 'coresight_disable()'.  Since there can only
+		 * be a single session per tracer (when working from sysFS)
+		 * a per-cpu variable will do just fine.
+		 */
+		cpu = source_ops(csdev)->cpu_id(csdev);
+		per_cpu(tracer_path, cpu) = path;
+		break;
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE:
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_TPDM:
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_REMOTE_PROC:
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_OTHERS:
+		/*
+		 * Use the hash of source's device name as ID
+		 * and map the ID to the pointer of the path.
+		 */
+		hash = hashlen_hash(hashlen_string(NULL, dev_name(&csdev->dev)));
+		ret = idr_alloc_u32(&path_idr, path, &hash, hash, GFP_KERNEL);
+		if (ret)
+			return ret;
+		break;
+	default:
+		/* We can't be here */
+		break;
+	}
+
+	return 0;
+}
+
+static struct list_head *coresight_remove_path(struct coresight_device *csdev)
+{
+	int cpu;
+	struct list_head *path;
+	u32 hash;
+
+	switch (csdev->subtype.source_subtype) {
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_PROC:
+		cpu = source_ops(csdev)->cpu_id(csdev);
+		path = per_cpu(tracer_path, cpu);
+		per_cpu(tracer_path, cpu) = NULL;
+		break;
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE:
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_TPDM:
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_REMOTE_PROC:
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_OTHERS:
+		hash = hashlen_hash(hashlen_string(NULL, dev_name(&csdev->dev)));
+		/* Find the path by the hash. */
+		path = idr_find(&path_idr, hash);
+		if (path == NULL) {
+			pr_err("Path is not found for %s\n", dev_name(&csdev->dev));
+			return NULL;
+		}
+		idr_remove(&path_idr, hash);
+		break;
+	default:
+		/* We can't be here */
+		path = NULL;
+		break;
+	}
+
+	return path;
+}
+
+struct list_head *coresight_get_path(struct coresight_device *csdev)
+{
+	int cpu;
+	struct list_head *path;
+	u32 hash;
+
+	switch (csdev->subtype.source_subtype) {
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_PROC:
+		cpu = source_ops(csdev)->cpu_id(csdev);
+		path = per_cpu(tracer_path, cpu);
+		break;
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE:
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_TPDM:
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_REMOTE_PROC:
+	case CORESIGHT_DEV_SUBTYPE_SOURCE_OTHERS:
+		hash = hashlen_hash(hashlen_string(NULL, dev_name(&csdev->dev)));
+		/* Find the path by the hash. */
+		path = idr_find(&path_idr, hash);
+		if (path == NULL) {
+			pr_err("Path is not found for %s\n", dev_name(&csdev->dev));
+			return NULL;
+		}
+		break;
+	default:
+		path = NULL;
+		break;
+	}
+
+	return path;
+}
+EXPORT_SYMBOL_GPL(coresight_get_path);
+
 int coresight_enable(struct coresight_device *csdev)
 {
-	int cpu, ret = 0;
+	int ret = 0;
 	struct coresight_device *sink;
 	struct list_head *path;
 	enum coresight_dev_subtype_source subtype;
-	u32 hash;
 
 	subtype = csdev->subtype.source_subtype;
 
@@ -1142,43 +1268,18 @@
 		goto out;
 	}
 
-	ret = coresight_enable_path(path, CS_MODE_SYSFS, NULL);
+	ret = coresight_store_path(csdev, path);
 	if (ret)
 		goto err_path;
 
+	ret = coresight_enable_path(path, CS_MODE_SYSFS, NULL);
+	if (ret)
+		goto err_enable_path;
+
 	ret = coresight_enable_source(csdev, CS_MODE_SYSFS, NULL);
 	if (ret)
 		goto err_source;
 
-	switch (subtype) {
-	case CORESIGHT_DEV_SUBTYPE_SOURCE_PROC:
-		/*
-		 * When working from sysFS it is important to keep track
-		 * of the paths that were created so that they can be
-		 * undone in 'coresight_disable()'.  Since there can only
-		 * be a single session per tracer (when working from sysFS)
-		 * a per-cpu variable will do just fine.
-		 */
-		cpu = source_ops(csdev)->cpu_id(csdev);
-		per_cpu(tracer_path, cpu) = path;
-		break;
-	case CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE:
-	case CORESIGHT_DEV_SUBTYPE_SOURCE_TPDM:
-	case CORESIGHT_DEV_SUBTYPE_SOURCE_OTHERS:
-		/*
-		 * Use the hash of source's device name as ID
-		 * and map the ID to the pointer of the path.
-		 */
-		hash = hashlen_hash(hashlen_string(NULL, dev_name(&csdev->dev)));
-		ret = idr_alloc_u32(&path_idr, path, &hash, hash, GFP_KERNEL);
-		if (ret)
-			goto err_source;
-		break;
-	default:
-		/* We can't be here */
-		break;
-	}
-
 out:
 	mutex_unlock(&coresight_mutex);
 	return ret;
@@ -1186,6 +1287,9 @@
 err_source:
 	coresight_disable_path(path);
 
+err_enable_path:
+	coresight_remove_path(csdev);
+
 err_path:
 	coresight_release_path(path);
 	goto out;
@@ -1194,9 +1298,8 @@
 
 void coresight_disable(struct coresight_device *csdev)
 {
-	int cpu, ret;
+	int ret;
 	struct list_head *path = NULL;
-	u32 hash;
 
 	mutex_lock(&coresight_mutex);
 
@@ -1204,31 +1307,12 @@
 	if (ret)
 		goto out;
 
-	if (!csdev->enable || !coresight_disable_source(csdev, NULL))
+	if (!csdev->enable || !coresight_disable_source_sysfs(csdev, NULL))
 		goto out;
 
-	switch (csdev->subtype.source_subtype) {
-	case CORESIGHT_DEV_SUBTYPE_SOURCE_PROC:
-		cpu = source_ops(csdev)->cpu_id(csdev);
-		path = per_cpu(tracer_path, cpu);
-		per_cpu(tracer_path, cpu) = NULL;
-		break;
-	case CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE:
-	case CORESIGHT_DEV_SUBTYPE_SOURCE_TPDM:
-	case CORESIGHT_DEV_SUBTYPE_SOURCE_OTHERS:
-		hash = hashlen_hash(hashlen_string(NULL, dev_name(&csdev->dev)));
-		/* Find the path by the hash. */
-		path = idr_find(&path_idr, hash);
-		if (path == NULL) {
-			pr_err("Path is not found for %s\n", dev_name(&csdev->dev));
-			goto out;
-		}
-		idr_remove(&path_idr, hash);
-		break;
-	default:
-		/* We can't be here */
-		break;
-	}
+	path = coresight_remove_path(csdev);
+	if (!path)
+		goto out;
 
 	coresight_disable_path(path);
 	coresight_release_path(path);
@@ -1766,33 +1850,36 @@
  * duplicate indices for the same device (e.g, if we defer probing of
  * a device due to dependencies), in case the index is requested again.
  */
-char *coresight_alloc_device_name(struct coresight_dev_list *dict,
+const char *coresight_alloc_device_name(struct coresight_dev_list *dict,
 				  struct device *dev)
 {
 	int idx;
-	char *name = NULL;
+	const char *name = NULL;
 	struct fwnode_handle **list;
 
 	mutex_lock(&coresight_mutex);
 
-	idx = coresight_search_device_idx(dict, dev_fwnode(dev));
-	if (idx < 0) {
-		/* Make space for the new entry */
-		idx = dict->nr_idx;
-		list = krealloc_array(dict->fwnode_list,
-				      idx + 1, sizeof(*dict->fwnode_list),
-				      GFP_KERNEL);
-		if (ZERO_OR_NULL_PTR(list)) {
-			idx = -ENOMEM;
-			goto done;
+	name = coresight_get_device_name(dev);
+	if (!name) {
+		idx = coresight_search_device_idx(dict, dev_fwnode(dev));
+		if (idx < 0) {
+			/* Make space for the new entry */
+			idx = dict->nr_idx;
+			list = krealloc_array(dict->fwnode_list,
+					      idx + 1, sizeof(*dict->fwnode_list),
+					      GFP_KERNEL);
+			if (ZERO_OR_NULL_PTR(list)) {
+				idx = -ENOMEM;
+				goto done;
+			}
+
+			list[idx] = dev_fwnode(dev);
+			dict->fwnode_list = list;
+			dict->nr_idx = idx + 1;
 		}
 
-		list[idx] = dev_fwnode(dev);
-		dict->fwnode_list = list;
-		dict->nr_idx = idx + 1;
+		name = devm_kasprintf(dev, GFP_KERNEL, "%s%d", dict->pfx, idx);
 	}
-
-	name = devm_kasprintf(dev, GFP_KERNEL, "%s%d", dict->pfx, idx);
 done:
 	mutex_unlock(&coresight_mutex);
 	return name;
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-csr.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-csr.c
@@ -0,0 +1,1089 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2013, 2015-2017, 2019-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/coresight.h>
+#include <linux/clk.h>
+#include <linux/mutex.h>
+#include <linux/of_platform.h>
+
+#include "coresight-priv.h"
+#include "coresight-common.h"
+#include "coresight-tmc.h"
+
+#define csr_writel(drvdata, val, off)	__raw_writel((val), drvdata->base + off)
+#define csr_readl(drvdata, off)		__raw_readl(drvdata->base + off)
+
+#define CSR_LOCK(drvdata)						\
+do {									\
+	mb(); /* ensure configuration take effect before we lock it */	\
+	csr_writel(drvdata, 0x0, CORESIGHT_LAR);			\
+} while (0)
+#define CSR_UNLOCK(drvdata)						\
+do {									\
+	csr_writel(drvdata, CORESIGHT_UNLOCK, CORESIGHT_LAR);		\
+	mb(); /* ensure unlock take effect before we configure */	\
+} while (0)
+
+#define CSR_SWDBGPWRCTRL	(0x000)
+#define CSR_SWDBGPWRACK		(0x004)
+#define CSR_SWSPADREG0		(0x008)
+#define CSR_SWSPADREG1		(0x00C)
+#define CSR_STMTRANSCTRL	(0x010)
+#define CSR_STMAWIDCTRL		(0x014)
+#define CSR_STMCHNOFST0		(0x018)
+#define CSR_STMCHNOFST1		(0x01C)
+#define CSR_STMEXTHWCTRL0	(0x020)
+#define CSR_STMEXTHWCTRL1	(0x024)
+#define CSR_STMEXTHWCTRL2	(0x028)
+#define CSR_STMEXTHWCTRL3	(0x02C)
+#define CSR_USBBAMCTRL		(0x030)
+#define CSR_USBFLSHCTRL		(0x034)
+#define CSR_TIMESTAMPCTRL	(0x038)
+#define CSR_AOTIMEVAL0		(0x03C)
+#define CSR_AOTIMEVAL1		(0x040)
+#define CSR_QDSSTIMEVAL0	(0x044)
+#define CSR_QDSSTIMEVAL1	(0x048)
+#define CSR_QDSSTIMELOAD0	(0x04C)
+#define CSR_QDSSTIMELOAD1	(0x050)
+#define CSR_DAPMSAVAL		(0x054)
+#define CSR_QDSSCLKVOTE		(0x058)
+#define CSR_QDSSCLKIPI		(0x05C)
+#define CSR_QDSSPWRREQIGNORE	(0x060)
+#define CSR_QDSSSPARE		(0x064)
+#define CSR_IPCAT		(0x068)
+#define CSR_BYTECNTVAL		(0x06C)
+#define CSR_TS_HBEAT_VAL0_LO	(0x084)
+#define CSR_TS_HBEAT_VAL0_HI	(0x088)
+#define CSR_TS_HBEAT_VAL1_LO	(0x08c)
+#define CSR_TS_HBEAT_VAL1_HI	(0x090)
+#define CSR_TS_HBEAT_MASK0_LO	(0x094)
+#define CSR_TS_HBEAT_MASK0_HI	(0x098)
+#define CSR_TS_HBEAT_MASK1_LO	(0x09c)
+#define CSR_TS_HBEAT_MASK1_HI	(0x0a0)
+#define CSR_ARADDR_EXT		(0x130)
+#define CSR_AWADDR_EXT		(0x134)
+#define MSR_NUM			((drvdata->msr_end - drvdata->msr_start + 1) \
+				/ sizeof(uint32_t))
+#define MSR_MAX_NUM		128
+
+#define BLKSIZE_256		0
+#define BLKSIZE_512		1
+#define BLKSIZE_1024		2
+#define BLKSIZE_2048		3
+
+#define FLUSHPERIOD_1	    0x1
+#define FLUSHPERIOD_2048	0x800
+#define PERFLSHEOT_BIT		BIT(18)
+
+#define CSR_ATID_REG_OFFSET(atid, atid_offset) \
+		((atid / 32) * 4 + atid_offset)
+
+#define CSR_ATID_REG_BIT(atid)	(atid % 32)
+#define CSR_MAX_ATID	128
+#define CSR_ATID_REG_SIZE	0xc
+
+#define CSR_ARADDR_EXT_VAL	0x104
+#define CSR_AWADDR_EXT_VAL	0x104
+
+#define CSR_ATID_REG_OFFSET(atid, atid_offset) \
+		((atid / 32) * 4 + atid_offset)
+
+#define CSR_ATID_REG_BIT(atid)	(atid % 32)
+#define CSR_MAX_ATID	128
+#define CSR_ATID_REG_SIZE	0xc
+
+struct csr_drvdata {
+	void __iomem		*base;
+	phys_addr_t		pbase;
+	phys_addr_t		msr_start;
+	phys_addr_t		msr_end;
+	struct device		*dev;
+	struct coresight_device	*csdev;
+	uint32_t		*msr;
+	atomic_t		*msr_refcnt;
+	uint32_t		blksize;
+	uint32_t		flushperiod;
+	u64			hbeat_val0;
+	u64			hbeat_val1;
+	u64			hbeat_mask0;
+	u64			hbeat_mask1;
+	struct coresight_csr		csr;
+	struct clk		*clk;
+	spinlock_t		spin_lock;
+	bool			usb_bam_support;
+	bool			perflsheot_set_support;
+	bool			hwctrl_set_support;
+	bool			set_byte_cntr_support;
+	bool			timestamp_support;
+	bool			enable_flush;
+	bool			msr_support;
+	uint32_t		atid_offset;
+};
+
+DEFINE_CORESIGHT_DEVLIST(csr_devs, "csr");
+
+static LIST_HEAD(csr_list);
+static DEFINE_SPINLOCK(csr_spinlock);
+
+#define to_csr_drvdata(c) container_of(c, struct csr_drvdata, csr)
+
+static void msm_qdss_csr_config_flush_period(struct csr_drvdata *drvdata)
+{
+	uint32_t usbflshctrl;
+
+	CSR_UNLOCK(drvdata);
+
+	usbflshctrl = csr_readl(drvdata, CSR_USBFLSHCTRL);
+	usbflshctrl = (usbflshctrl & ~0x3FFFC) | (drvdata->flushperiod << 2);
+	csr_writel(drvdata, usbflshctrl, CSR_USBFLSHCTRL);
+
+	CSR_LOCK(drvdata);
+}
+
+void msm_qdss_csr_enable_bam_to_usb(struct coresight_csr *csr)
+{
+	struct csr_drvdata *drvdata;
+	uint32_t usbbamctrl;
+	unsigned long flags;
+
+	if (csr == NULL)
+		return;
+
+	drvdata = to_csr_drvdata(csr);
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->usb_bam_support)
+		return;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+
+	usbbamctrl = csr_readl(drvdata, CSR_USBBAMCTRL);
+	usbbamctrl = (usbbamctrl & ~0x3) | drvdata->blksize;
+	csr_writel(drvdata, usbbamctrl, CSR_USBBAMCTRL);
+
+	usbbamctrl |= 0x4;
+	csr_writel(drvdata, usbbamctrl, CSR_USBBAMCTRL);
+
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+}
+EXPORT_SYMBOL_GPL(msm_qdss_csr_enable_bam_to_usb);
+
+void msm_qdss_csr_enable_flush(struct coresight_csr *csr)
+{
+	struct csr_drvdata *drvdata;
+	uint32_t usbflshctrl;
+	unsigned long flags;
+
+	if (csr == NULL)
+		return;
+
+	drvdata = to_csr_drvdata(csr);
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->usb_bam_support)
+		return;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+
+	msm_qdss_csr_config_flush_period(drvdata);
+
+	CSR_UNLOCK(drvdata);
+
+	usbflshctrl = csr_readl(drvdata, CSR_USBFLSHCTRL);
+	usbflshctrl |= 0x2;
+	if (drvdata->perflsheot_set_support)
+		usbflshctrl |= PERFLSHEOT_BIT;
+	csr_writel(drvdata, usbflshctrl, CSR_USBFLSHCTRL);
+
+	CSR_LOCK(drvdata);
+	drvdata->enable_flush = true;
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+}
+EXPORT_SYMBOL_GPL(msm_qdss_csr_enable_flush);
+
+void msm_qdss_csr_disable_bam_to_usb(struct coresight_csr *csr)
+{
+	struct csr_drvdata *drvdata;
+	uint32_t usbbamctrl;
+	unsigned long flags;
+
+	if (csr == NULL)
+		return;
+
+	drvdata = to_csr_drvdata(csr);
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->usb_bam_support)
+		return;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+
+	usbbamctrl = csr_readl(drvdata, CSR_USBBAMCTRL);
+	usbbamctrl &= (~0x4);
+	csr_writel(drvdata, usbbamctrl, CSR_USBBAMCTRL);
+
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+}
+EXPORT_SYMBOL_GPL(msm_qdss_csr_disable_bam_to_usb);
+
+void msm_qdss_csr_disable_flush(struct coresight_csr *csr)
+{
+	struct csr_drvdata *drvdata;
+	uint32_t usbflshctrl;
+	unsigned long flags;
+
+	if (csr == NULL)
+		return;
+
+	drvdata = to_csr_drvdata(csr);
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->usb_bam_support)
+		return;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+
+	usbflshctrl = csr_readl(drvdata, CSR_USBFLSHCTRL);
+	usbflshctrl &= ~0x2;
+	if (drvdata->perflsheot_set_support)
+		usbflshctrl &= ~PERFLSHEOT_BIT;
+	csr_writel(drvdata, usbflshctrl, CSR_USBFLSHCTRL);
+
+	CSR_LOCK(drvdata);
+	drvdata->enable_flush = false;
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+}
+EXPORT_SYMBOL_GPL(msm_qdss_csr_disable_flush);
+
+void msm_qdss_csr_enable_eth(struct coresight_csr *csr)
+{
+	struct csr_drvdata *drvdata;
+	unsigned long flags;
+
+	if (csr == NULL)
+		return;
+
+	drvdata = to_csr_drvdata(csr);
+	if (IS_ERR_OR_NULL(drvdata))
+		return;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+	csr_writel(drvdata, CSR_ARADDR_EXT_VAL, CSR_ARADDR_EXT);
+	csr_writel(drvdata, CSR_AWADDR_EXT_VAL, CSR_AWADDR_EXT);
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+}
+EXPORT_SYMBOL_GPL(msm_qdss_csr_enable_eth);
+
+void msm_qdss_csr_disable_eth(struct coresight_csr *csr)
+{
+	struct csr_drvdata *drvdata;
+	unsigned long flags;
+
+	if (csr == NULL)
+		return;
+
+	drvdata = to_csr_drvdata(csr);
+	if (IS_ERR_OR_NULL(drvdata))
+		return;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+	csr_writel(drvdata, 0, CSR_ARADDR_EXT);
+	csr_writel(drvdata, 0, CSR_AWADDR_EXT);
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+}
+EXPORT_SYMBOL_GPL(msm_qdss_csr_disable_eth);
+
+int coresight_csr_hwctrl_set(struct coresight_csr *csr, uint64_t addr,
+			 uint32_t val)
+{
+	struct csr_drvdata *drvdata;
+	int ret = 0;
+	unsigned long flags;
+
+	if (csr == NULL)
+		return -EINVAL;
+
+	drvdata = to_csr_drvdata(csr);
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->hwctrl_set_support)
+		return -EINVAL;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+
+	if (addr == (drvdata->pbase + CSR_STMEXTHWCTRL0))
+		csr_writel(drvdata, val, CSR_STMEXTHWCTRL0);
+	else if (addr == (drvdata->pbase + CSR_STMEXTHWCTRL1))
+		csr_writel(drvdata, val, CSR_STMEXTHWCTRL1);
+	else if (addr == (drvdata->pbase + CSR_STMEXTHWCTRL2))
+		csr_writel(drvdata, val, CSR_STMEXTHWCTRL2);
+	else if (addr == (drvdata->pbase + CSR_STMEXTHWCTRL3))
+		csr_writel(drvdata, val, CSR_STMEXTHWCTRL3);
+	else
+		ret = -EINVAL;
+
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(coresight_csr_hwctrl_set);
+
+void coresight_csr_set_byte_cntr(struct coresight_csr *csr, int irqctrl_offset, uint32_t count)
+{
+	struct csr_drvdata *drvdata;
+	unsigned long flags;
+
+	if (csr == NULL)
+		return;
+
+	drvdata = to_csr_drvdata(csr);
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->set_byte_cntr_support)
+		return;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+
+	csr_writel(drvdata, count, irqctrl_offset);
+
+	/* make sure byte count value is written */
+	mb();
+
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+}
+EXPORT_SYMBOL_GPL(coresight_csr_set_byte_cntr);
+
+static int __coresight_csr_set_etr_atid(struct coresight_csr *csr,
+			uint32_t atid_offset, uint32_t atid,
+			bool enable)
+{
+	struct csr_drvdata *drvdata;
+	unsigned long flags;
+	uint32_t reg_offset;
+	int bit;
+	uint32_t val;
+
+	if (csr == NULL)
+		return -EINVAL;
+
+	drvdata = to_csr_drvdata(csr);
+	if (IS_ERR_OR_NULL(drvdata))
+		return -EINVAL;
+
+	if (atid < 0 || atid_offset <= 0)
+		return -EINVAL;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+
+	reg_offset = CSR_ATID_REG_OFFSET(atid, atid_offset);
+	bit = CSR_ATID_REG_BIT(atid);
+	if (reg_offset - atid_offset > CSR_ATID_REG_SIZE
+		|| bit >= CSR_MAX_ATID) {
+		CSR_LOCK(drvdata);
+		spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+		return -EINVAL;
+	}
+
+	val = csr_readl(drvdata, reg_offset);
+	if (enable)
+		val = val | BIT(bit);
+	else
+		val = val & ~BIT(bit);
+	csr_writel(drvdata, val, reg_offset);
+
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+	return 0;
+}
+
+/*
+ * of_coresight_get_csr_atid_offset: Get the csr atid register offset of a sink device.
+ *
+ * Returns the csr atid offset. If the result is less than zero, it means
+ * failure.
+ */
+static int of_coresight_get_csr_atid_offset(struct coresight_device *csdev,
+				u32 *atid_offset)
+{
+	return of_property_read_u32(csdev->dev.parent->of_node,
+					"csr-atid-offset", atid_offset);
+}
+
+int coresight_csr_set_etr_atid(struct coresight_device *csdev, int atid, bool enable)
+{
+	struct list_head *path = NULL;
+	struct coresight_device *sink_csdev;
+	int atid_offset;
+	struct coresight_csr *csr;
+	const char *csr_name;
+	struct tmc_drvdata *drvdata;
+	unsigned long flags;
+
+	path = coresight_get_path(csdev);
+
+	if (!path)
+		return -EINVAL;
+
+	sink_csdev = coresight_get_sink(path);
+
+	if (!sink_csdev)
+		return -EINVAL;
+	/* if no csr for this sink, indicates this sink is not etr.*/
+	if (of_get_coresight_csr_name(sink_csdev->dev.parent->of_node, &csr_name))
+		return 0;
+
+	csr = coresight_csr_get(csr_name);
+
+	if (of_coresight_get_csr_atid_offset(sink_csdev, &atid_offset))
+		return -EINVAL;
+
+	drvdata = dev_get_drvdata(sink_csdev->dev.parent);
+	spin_lock_irqsave(&drvdata->spinlock, flags);
+	if (enable && (++drvdata->atid_refcnt[atid] == 1)) {
+		spin_unlock_irqrestore(&drvdata->spinlock, flags);
+		return __coresight_csr_set_etr_atid(csr, atid_offset, atid, enable);
+	} else if (!enable && (--drvdata->atid_refcnt[atid] == 0)) {
+		spin_unlock_irqrestore(&drvdata->spinlock, flags);
+		return __coresight_csr_set_etr_atid(csr, atid_offset, atid, enable);
+	}
+	spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(coresight_csr_set_etr_atid);
+
+struct coresight_csr *coresight_csr_get(const char *name)
+{
+	struct coresight_csr *csr;
+	unsigned long flags;
+
+	spin_lock_irqsave(&csr_spinlock, flags);
+	list_for_each_entry(csr, &csr_list, link) {
+		if (!strcmp(csr->name, name)) {
+			spin_unlock_irqrestore(&csr_spinlock, flags);
+			return csr;
+		}
+	}
+
+	spin_unlock_irqrestore(&csr_spinlock, flags);
+	return ERR_PTR(-EINVAL);
+}
+EXPORT_SYMBOL_GPL(coresight_csr_get);
+
+int of_get_coresight_csr_name(struct device_node *node, const char **csr_name)
+{
+	struct device_node *csr_node;
+	struct csr_drvdata *drvdata;
+	struct platform_device *pdev;
+
+	csr_node = of_parse_phandle(node, "coresight-csr", 0);
+	if (!csr_node)
+		return -EINVAL;
+
+	pdev = of_find_device_by_node(csr_node);
+	if (!pdev)
+		return -EINVAL;
+
+	drvdata = platform_get_drvdata(pdev);
+	*csr_name = drvdata->csr.name;
+	of_node_put(csr_node);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(of_get_coresight_csr_name);
+
+static ssize_t timestamp_show(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	ssize_t size = 0;
+	uint64_t time_tick = 0;
+	uint32_t val, time_val0, time_val1;
+	int ret;
+	unsigned long flags;
+
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->timestamp_support) {
+		dev_err(dev, "Invalid param\n");
+		return 0;
+	}
+
+	ret = clk_prepare_enable(drvdata->clk);
+	if (ret)
+		return ret;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+
+	val = csr_readl(drvdata, CSR_TIMESTAMPCTRL);
+
+	val  = val & ~BIT(0);
+	csr_writel(drvdata, val, CSR_TIMESTAMPCTRL);
+
+	val  = val | BIT(0);
+	csr_writel(drvdata, val, CSR_TIMESTAMPCTRL);
+
+	time_val0 = csr_readl(drvdata, CSR_QDSSTIMEVAL0);
+	time_val1 = csr_readl(drvdata, CSR_QDSSTIMEVAL1);
+
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+
+	clk_disable_unprepare(drvdata->clk);
+
+	time_tick |= (uint64_t)time_val1 << 32;
+	time_tick |= (uint64_t)time_val0;
+	size = scnprintf(buf, PAGE_SIZE, "%llu\n", time_tick);
+	dev_dbg(dev, "timestamp : %s\n", buf);
+	return size;
+}
+
+static DEVICE_ATTR_RO(timestamp);
+
+static ssize_t msr_show(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	int i;
+	ssize_t len = 0;
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->msr_support ||
+			IS_ERR_OR_NULL(drvdata->msr))
+		return -EINVAL;
+	for (i = 0; i < MSR_NUM; i++)
+		len += scnprintf(buf + len, PAGE_SIZE - len, "%d 0x%x\n",
+			i, drvdata->msr[i]);
+	return len;
+}
+
+static ssize_t msr_store(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf,
+				 size_t size)
+{
+	uint32_t offset, val, rval;
+	int nval, ret;
+	unsigned long flags;
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->msr_support ||
+			IS_ERR_OR_NULL(drvdata->msr))
+		return -EINVAL;
+
+	nval = sscanf(buf, "%x %x", &offset, &val);
+	if (nval != 2)
+		return -EINVAL;
+	if (offset >= MSR_NUM)
+		return -EINVAL;
+
+	if (atomic_read(drvdata->msr_refcnt) == 0) {
+		ret = clk_prepare_enable(drvdata->clk);
+		if (ret)
+			return ret;
+		atomic_inc(drvdata->msr_refcnt);
+	}
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+	csr_writel(drvdata, val, drvdata->msr_start + offset * 4);
+	rval = csr_readl(drvdata, drvdata->msr_start + offset * 4);
+	drvdata->msr[offset] = rval;
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+	return size;
+}
+
+static DEVICE_ATTR_RW(msr);
+
+static ssize_t msr_reset_store(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf,
+				 size_t size)
+{
+	unsigned long flags, val;
+	int i;
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->msr_support ||
+			IS_ERR_OR_NULL(drvdata->msr))
+		return -EINVAL;
+
+	if (kstrtoul(buf, 0, &val) || val != 1)
+		return -EINVAL;
+
+	if (atomic_read(drvdata->msr_refcnt) == 0)
+		return -EINVAL;
+
+	atomic_set(drvdata->msr_refcnt, 0);
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+	CSR_UNLOCK(drvdata);
+	for (i = 0; i < MSR_NUM; i++) {
+		csr_writel(drvdata, 0, drvdata->msr_start + i * 4);
+		drvdata->msr[i] = 0;
+	}
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+	clk_disable_unprepare(drvdata->clk);
+	return size;
+}
+
+static DEVICE_ATTR_WO(msr_reset);
+
+static ssize_t flushperiod_show(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->usb_bam_support) {
+		dev_err(dev, "Invalid param\n");
+		return -EINVAL;
+	}
+
+	return scnprintf(buf, PAGE_SIZE, "%#x\n", drvdata->flushperiod);
+}
+
+static ssize_t flushperiod_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf,
+				size_t size)
+{
+	unsigned long flags;
+	unsigned long val;
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->usb_bam_support) {
+		dev_err(dev, "Invalid param\n");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+
+	if (kstrtoul(buf, 0, &val) || val > 0xffff) {
+		spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+		return -EINVAL;
+	}
+
+	if (drvdata->flushperiod == val)
+		goto out;
+
+	drvdata->flushperiod = val;
+
+	if (drvdata->enable_flush)
+		msm_qdss_csr_config_flush_period(drvdata);
+
+out:
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+	return size;
+}
+
+static DEVICE_ATTR_RW(flushperiod);
+
+static ssize_t hbeat_val0_show(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->timestamp_support)
+		return -EINVAL;
+
+	return scnprintf(buf, PAGE_SIZE, "%llx\n", drvdata->hbeat_val0);
+}
+
+static ssize_t hbeat_val0_store(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf,
+				 size_t size)
+{
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long val, flags;
+	u32 val_lo, val_hi;
+	int ret;
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->timestamp_support)
+		return -EINVAL;
+
+	if (kstrtoul(buf, 16, &val))
+		return -EINVAL;
+
+	ret = clk_prepare_enable(drvdata->clk);
+	if (ret)
+		return ret;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+
+	drvdata->hbeat_val0 = val;
+	val_lo = val & 0xFFFFFFFF;
+	val_hi = val >> 32;
+
+	CSR_UNLOCK(drvdata);
+	csr_writel(drvdata, val_lo, CSR_TS_HBEAT_VAL0_LO);
+	csr_writel(drvdata, val_hi, CSR_TS_HBEAT_VAL0_HI);
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+	clk_disable_unprepare(drvdata->clk);
+	return size;
+}
+static DEVICE_ATTR_RW(hbeat_val0);
+
+static ssize_t hbeat_val1_show(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->timestamp_support)
+		return -EINVAL;
+
+	return scnprintf(buf, PAGE_SIZE, "%llx\n", drvdata->hbeat_val1);
+}
+
+static ssize_t hbeat_val1_store(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf,
+				 size_t size)
+{
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long val, flags;
+	u32 val_lo, val_hi;
+	int ret;
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->timestamp_support)
+		return -EINVAL;
+
+	if (kstrtoul(buf, 16, &val))
+		return -EINVAL;
+
+	ret = clk_prepare_enable(drvdata->clk);
+	if (ret)
+		return ret;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+
+	drvdata->hbeat_val1 = val;
+	val_lo = val & 0xFFFFFFFF;
+	val_hi = val >> 32;
+
+	CSR_UNLOCK(drvdata);
+	csr_writel(drvdata, val_lo, CSR_TS_HBEAT_VAL1_LO);
+	csr_writel(drvdata, val_hi, CSR_TS_HBEAT_VAL1_HI);
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+	clk_disable_unprepare(drvdata->clk);
+	return size;
+}
+static DEVICE_ATTR_RW(hbeat_val1);
+
+static ssize_t hbeat_mask0_show(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->timestamp_support)
+		return -EINVAL;
+
+	return scnprintf(buf, PAGE_SIZE, "%llx\n", drvdata->hbeat_mask0);
+}
+
+static ssize_t hbeat_mask0_store(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf,
+				 size_t size)
+{
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long val, flags;
+	u32 val_lo, val_hi;
+	int ret;
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->timestamp_support)
+		return -EINVAL;
+
+	if (kstrtoul(buf, 16, &val))
+		return -EINVAL;
+
+	ret = clk_prepare_enable(drvdata->clk);
+	if (ret)
+		return ret;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+
+	drvdata->hbeat_mask0 = val;
+	val_lo = val & 0xFFFFFFFF;
+	val_hi = val >> 32;
+
+	CSR_UNLOCK(drvdata);
+	csr_writel(drvdata, val_lo, CSR_TS_HBEAT_MASK0_LO);
+	csr_writel(drvdata, val_hi, CSR_TS_HBEAT_MASK0_HI);
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+	clk_disable_unprepare(drvdata->clk);
+	return size;
+}
+static DEVICE_ATTR_RW(hbeat_mask0);
+
+static ssize_t hbeat_mask1_show(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->timestamp_support)
+		return -EINVAL;
+
+	return scnprintf(buf, PAGE_SIZE, "%llx\n", drvdata->hbeat_mask1);
+}
+
+static ssize_t hbeat_mask1_store(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf,
+				 size_t size)
+{
+	struct csr_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long val, flags;
+	u32 val_lo, val_hi;
+	int ret;
+
+	if (IS_ERR_OR_NULL(drvdata) || !drvdata->timestamp_support)
+		return -EINVAL;
+
+	if (kstrtoul(buf, 16, &val))
+		return -EINVAL;
+
+	ret = clk_prepare_enable(drvdata->clk);
+	if (ret)
+		return ret;
+
+	spin_lock_irqsave(&drvdata->spin_lock, flags);
+
+	drvdata->hbeat_mask1 = val;
+	val_lo = val & 0xFFFFFFFF;
+	val_hi = val >> 32;
+
+	CSR_UNLOCK(drvdata);
+	csr_writel(drvdata, val_lo, CSR_TS_HBEAT_MASK1_LO);
+	csr_writel(drvdata, val_hi, CSR_TS_HBEAT_MASK1_HI);
+	CSR_LOCK(drvdata);
+	spin_unlock_irqrestore(&drvdata->spin_lock, flags);
+	clk_disable_unprepare(drvdata->clk);
+	return size;
+}
+static DEVICE_ATTR_RW(hbeat_mask1);
+
+static struct attribute *swao_csr_attrs[] = {
+	&dev_attr_timestamp.attr,
+	&dev_attr_msr.attr,
+	&dev_attr_msr_reset.attr,
+	&dev_attr_hbeat_val0.attr,
+	&dev_attr_hbeat_val1.attr,
+	&dev_attr_hbeat_mask0.attr,
+	&dev_attr_hbeat_mask1.attr,
+	NULL,
+};
+
+static struct attribute_group swao_csr_attr_grp = {
+	.attrs = swao_csr_attrs,
+};
+
+static const struct attribute_group *swao_csr_attr_grps[] = {
+	&swao_csr_attr_grp,
+	NULL,
+};
+
+static struct attribute *csr_attrs[] = {
+	&dev_attr_flushperiod.attr,
+	NULL,
+};
+
+static struct attribute_group csr_attr_grp = {
+	.attrs = csr_attrs,
+};
+
+static const struct attribute_group *csr_attr_grps[] = {
+	&csr_attr_grp,
+	NULL,
+};
+
+static int csr_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct device *dev = &pdev->dev;
+	struct coresight_platform_data *pdata;
+	struct csr_drvdata *drvdata;
+	struct resource *res, *msr_res;
+	struct coresight_desc desc = { 0 };
+
+	desc.name = coresight_alloc_device_name(&csr_devs, dev);
+	if (!desc.name)
+		return -ENOMEM;
+	pdata = coresight_get_platform_data(dev);
+	if (IS_ERR(pdata))
+		return PTR_ERR(pdata);
+	pdev->dev.platform_data = pdata;
+
+	drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL);
+	if (!drvdata)
+		return -ENOMEM;
+	drvdata->dev = &pdev->dev;
+	platform_set_drvdata(pdev, drvdata);
+
+	drvdata->clk = devm_clk_get(dev, "apb_pclk");
+	if (IS_ERR(drvdata->clk))
+		dev_dbg(dev, "csr not config clk\n");
+
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "csr-base");
+	if (!res)
+		return -ENODEV;
+	drvdata->pbase = res->start;
+
+	drvdata->base = devm_ioremap(dev, res->start, resource_size(res));
+	if (!drvdata->base)
+		return -ENOMEM;
+
+	ret = of_property_read_u32(pdev->dev.of_node, "qcom,blk-size",
+			&drvdata->blksize);
+	if (ret)
+		drvdata->blksize = BLKSIZE_256;
+
+	drvdata->usb_bam_support = of_property_read_bool(pdev->dev.of_node,
+						"qcom,usb-bam-support");
+	if (!drvdata->usb_bam_support)
+		dev_dbg(dev, "usb_bam support handled by other subsystem\n");
+	else
+		dev_dbg(dev, "usb_bam operation supported\n");
+
+	drvdata->hwctrl_set_support = of_property_read_bool(pdev->dev.of_node,
+						"qcom,hwctrl-set-support");
+	if (!drvdata->hwctrl_set_support)
+		dev_dbg(dev, "hwctrl_set_support handled by other subsystem\n");
+	else
+		dev_dbg(dev, "hwctrl_set_support operation supported\n");
+
+	drvdata->set_byte_cntr_support = of_property_read_bool(
+			pdev->dev.of_node, "qcom,set-byte-cntr-support");
+	if (!drvdata->set_byte_cntr_support)
+		dev_dbg(dev, "set byte_cntr_support handled by other subsystem\n");
+	else
+		dev_dbg(dev, "set_byte_cntr_support operation supported\n");
+
+	drvdata->timestamp_support = of_property_read_bool(pdev->dev.of_node,
+						"qcom,timestamp-support");
+	if (!drvdata->timestamp_support)
+		dev_dbg(dev, "timestamp_support handled by other subsystem\n");
+	else
+		dev_dbg(dev, "timestamp_support operation supported\n");
+
+	drvdata->perflsheot_set_support = of_property_read_bool(
+			pdev->dev.of_node, "qcom,perflsheot-set-support");
+	if (!drvdata->perflsheot_set_support)
+		dev_dbg(dev, "perflsheot_set_support handled by other subsystem\n");
+	else
+		dev_dbg(dev, "perflsheot_set_support operation supported\n");
+
+	if (drvdata->usb_bam_support)
+		drvdata->flushperiod = FLUSHPERIOD_1;
+	drvdata->msr_support = of_property_read_bool(pdev->dev.of_node,
+						"qcom,msr-support");
+	if (!drvdata->msr_support) {
+		dev_dbg(dev, "msr_support handled by other subsystem\n");
+	} else {
+		msr_res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+				"msr-base");
+		if (!msr_res || msr_res->start < res->start || msr_res->end
+		> res->end)
+			return -ENODEV;
+		drvdata->msr_start = msr_res->start - res->start;
+		drvdata->msr_end = msr_res->end - res->start;
+		drvdata->msr = devm_kzalloc(dev, MSR_NUM * sizeof(uint32_t),
+						GFP_KERNEL);
+		if (!drvdata->msr)
+			return -ENOMEM;
+
+		drvdata->msr_refcnt = devm_kzalloc(dev, sizeof(atomic_t),
+				GFP_KERNEL);
+		if (!drvdata->msr_refcnt)
+			return -ENOMEM;
+		atomic_set(drvdata->msr_refcnt, 0);
+		dev_dbg(dev, "msr_support operation supported\n");
+	}
+
+	desc.type = CORESIGHT_DEV_TYPE_HELPER;
+	desc.pdata = pdev->dev.platform_data;
+	desc.dev = &pdev->dev;
+	if (drvdata->timestamp_support || drvdata->msr_support)
+		desc.groups = swao_csr_attr_grps;
+	else if (drvdata->usb_bam_support)
+		desc.groups = csr_attr_grps;
+
+	drvdata->csdev = coresight_register(&desc);
+	if (IS_ERR(drvdata->csdev))
+		return PTR_ERR(drvdata->csdev);
+
+	/* Store the driver data pointer for use in exported functions */
+	spin_lock_init(&drvdata->spin_lock);
+	drvdata->csr.name = desc.name;
+
+	spin_lock(&csr_spinlock);
+	list_add_tail(&drvdata->csr.link, &csr_list);
+	spin_unlock(&csr_spinlock);
+
+	dev_info(dev, "CSR initialized: %s\n", drvdata->csr.name);
+	return 0;
+}
+
+static int csr_remove(struct platform_device *pdev)
+{
+	struct csr_drvdata *drvdata = platform_get_drvdata(pdev);
+
+	spin_lock(&csr_spinlock);
+	list_del(&drvdata->csr.link);
+	spin_unlock(&csr_spinlock);
+
+	coresight_unregister(drvdata->csdev);
+	return 0;
+}
+
+static const struct of_device_id csr_match[] = {
+	{.compatible = "qcom,coresight-csr"},
+	{}
+};
+
+static struct platform_driver csr_driver = {
+	.probe          = csr_probe,
+	.remove         = csr_remove,
+	.driver         = {
+		.name   = "coresight-csr",
+		.of_match_table = csr_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+static int __init csr_init(void)
+{
+	return platform_driver_register(&csr_driver);
+}
+module_init(csr_init);
+
+static void __exit csr_exit(void)
+{
+	platform_driver_unregister(&csr_driver);
+}
+module_exit(csr_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("CoreSight CSR driver");
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-cti-core.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-cti-core.c
@@ -69,16 +69,29 @@
 	writel_relaxed(0, drvdata->base + CTICONTROL);
 
 	/* write the CTI trigger registers */
-	for (i = 0; i < config->nr_trig_max; i++) {
-		writel_relaxed(config->ctiinen[i], drvdata->base + CTIINEN(i));
-		writel_relaxed(config->ctiouten[i],
-			       drvdata->base + CTIOUTEN(i));
-	}
+	if (drvdata->extended_cti) {
+		for (i = 0; i < config->nr_trig_max; i++) {
+			writel_relaxed(config->ctiinen[i], drvdata->base + CTIINEN_EXTENDED(i));
+			writel_relaxed(config->ctiouten[i],
+				      drvdata->base + CTIOUTEN_EXTENDED(i));
+		}
 
-	/* other regs */
-	writel_relaxed(config->ctigate, drvdata->base + CTIGATE);
-	writel_relaxed(config->asicctl, drvdata->base + ASICCTL);
-	writel_relaxed(config->ctiappset, drvdata->base + CTIAPPSET);
+		/* other regs */
+		writel_relaxed(config->ctigate, drvdata->base + CTIGATE_EXTENDED);
+		writel_relaxed(config->asicctl, drvdata->base + ASICCTL_EXTENDED);
+		writel_relaxed(config->ctiappset, drvdata->base + CTIAPPSET_EXTENDED);
+	} else {
+		for (i = 0; i < config->nr_trig_max; i++) {
+			writel_relaxed(config->ctiinen[i], drvdata->base + CTIINEN(i));
+			writel_relaxed(config->ctiouten[i],
+					      drvdata->base + CTIOUTEN(i));
+		}
+
+		/* other regs */
+		writel_relaxed(config->ctigate, drvdata->base + CTIGATE);
+		writel_relaxed(config->asicctl, drvdata->base + ASICCTL);
+		writel_relaxed(config->ctiappset, drvdata->base + CTIAPPSET);
+	}
 
 	/* re-enable CTI */
 	writel_relaxed(1, drvdata->base + CTICONTROL);
@@ -99,10 +112,12 @@
 	if (config->hw_enabled || !config->hw_powered)
 		goto cti_state_unchanged;
 
-	/* claim the device */
-	rc = coresight_claim_device(drvdata->csdev);
-	if (rc)
-		goto cti_err_not_enabled;
+	if (!drvdata->extended_cti) {
+		/* claim the device */
+		rc = coresight_claim_device(drvdata->csdev);
+		if (rc)
+			goto cti_err_not_enabled;
+	}
 
 	cti_write_all_hw_regs(drvdata);
 
@@ -175,7 +190,8 @@
 	writel_relaxed(0, drvdata->base + CTICONTROL);
 	config->hw_enabled = false;
 
-	coresight_disclaim_device_unlocked(csdev);
+	if (!drvdata->extended_cti)
+		coresight_disclaim_device_unlocked(csdev);
 	CS_LOCK(drvdata->base);
 	spin_unlock(&drvdata->spinlock);
 	return ret;
@@ -270,8 +286,10 @@
 	cti_dev->nr_trig_con++;
 
 	/* add connection usage bit info to overall info */
-	drvdata->config.trig_in_use |= tc->con_in->used_mask;
-	drvdata->config.trig_out_use |= tc->con_out->used_mask;
+	bitmap_or(drvdata->config.trig_in_use, drvdata->config.trig_in_use,
+			tc->con_in->used_mask, drvdata->config.nr_trig_max);
+	bitmap_or(drvdata->config.trig_out_use, drvdata->config.trig_out_use,
+			tc->con_out->used_mask, drvdata->config.nr_trig_max);
 
 	return 0;
 }
@@ -314,7 +332,6 @@
 {
 	int ret = 0;
 	int n_trigs = drvdata->config.nr_trig_max;
-	u32 n_trig_mask = GENMASK(n_trigs - 1, 0);
 	struct cti_trig_con *tc = NULL;
 
 	/*
@@ -325,8 +342,8 @@
 	if (!tc)
 		return -ENOMEM;
 
-	tc->con_in->used_mask = n_trig_mask;
-	tc->con_out->used_mask = n_trig_mask;
+	bitmap_fill(tc->con_in->used_mask, n_trigs);
+	bitmap_fill(tc->con_out->used_mask, n_trigs);
 	ret = cti_add_connection_entry(dev, drvdata, tc, NULL, "default");
 	return ret;
 }
@@ -339,7 +356,6 @@
 {
 	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
 	struct cti_config *config = &drvdata->config;
-	u32 trig_bitmask;
 	u32 chan_bitmask;
 	u32 reg_value;
 	int reg_offset;
@@ -349,25 +365,27 @@
 	   (trigger_idx >= config->nr_trig_max))
 		return -EINVAL;
 
-	trig_bitmask = BIT(trigger_idx);
-
 	/* ensure registered triggers and not out filtered */
 	if (direction == CTI_TRIG_IN)	{
-		if (!(trig_bitmask & config->trig_in_use))
+		if (!(test_bit(trigger_idx, config->trig_in_use)))
 			return -EINVAL;
 	} else {
-		if (!(trig_bitmask & config->trig_out_use))
+		if (!(test_bit(trigger_idx, config->trig_out_use)))
 			return -EINVAL;
 
 		if ((config->trig_filter_enable) &&
-		    (config->trig_out_filter & trig_bitmask))
+		    test_bit(trigger_idx, config->trig_out_filter))
 			return -EINVAL;
 	}
 
 	/* update the local register values */
 	chan_bitmask = BIT(channel_idx);
-	reg_offset = (direction == CTI_TRIG_IN ? CTIINEN(trigger_idx) :
-		      CTIOUTEN(trigger_idx));
+	if (drvdata->extended_cti)
+		reg_offset = (direction == CTI_TRIG_IN ? CTIINEN_EXTENDED(trigger_idx) :
+			      CTIOUTEN_EXTENDED(trigger_idx));
+	else
+		reg_offset = (direction == CTI_TRIG_IN ? CTIINEN(trigger_idx) :
+			      CTIOUTEN(trigger_idx));
 
 	spin_lock(&drvdata->spinlock);
 
@@ -423,8 +441,12 @@
 	}
 	if (err == 0) {
 		config->ctigate = reg_value;
-		if (cti_active(config))
-			cti_write_single_reg(drvdata, CTIGATE, reg_value);
+		if (cti_active(config)) {
+			if (drvdata->extended_cti)
+				cti_write_single_reg(drvdata, CTIGATE_EXTENDED, reg_value);
+			else
+				cti_write_single_reg(drvdata, CTIGATE, reg_value);
+		}
 	}
 	spin_unlock(&drvdata->spinlock);
 	return err;
@@ -451,19 +473,28 @@
 	case CTI_CHAN_SET:
 		config->ctiappset |= chan_bitmask;
 		reg_value  = config->ctiappset;
-		reg_offset = CTIAPPSET;
+		if (drvdata->extended_cti)
+			reg_offset = CTIAPPSET_EXTENDED;
+		else
+			reg_offset = CTIAPPSET;
 		break;
 
 	case CTI_CHAN_CLR:
 		config->ctiappset &= ~chan_bitmask;
 		reg_value = chan_bitmask;
-		reg_offset = CTIAPPCLEAR;
+		if (drvdata->extended_cti)
+			reg_offset = CTIAPPCLEAR_EXTENDED;
+		else
+			reg_offset = CTIAPPCLEAR;
 		break;
 
 	case CTI_CHAN_PULSE:
 		config->ctiappset &= ~chan_bitmask;
 		reg_value = chan_bitmask;
-		reg_offset = CTIAPPPULSE;
+		if (drvdata->extended_cti)
+			reg_offset = CTIAPPPULSE_EXTENDED;
+		else
+			reg_offset = CTIAPPPULSE;
 		break;
 
 	default:
@@ -857,6 +888,11 @@
 	coresight_unregister(drvdata->csdev);
 }
 
+static bool is_extended_cti(struct device *dev)
+{
+	return fwnode_property_present(dev->fwnode, "qcom,extended_cti");
+}
+
 static int cti_probe(struct amba_device *adev, const struct amba_id *id)
 {
 	int ret = 0;
@@ -948,6 +984,7 @@
 	drvdata->csdev_release = drvdata->csdev->dev.release;
 	drvdata->csdev->dev.release = cti_device_release;
 
+	drvdata->extended_cti = is_extended_cti(dev);
 	/* all done - dec pm refcount */
 	pm_runtime_put(&adev->dev);
 	dev_info(&drvdata->csdev->dev, "CTI initialized\n");
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-cti-platform.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-cti-platform.c
@@ -136,8 +136,8 @@
 		goto create_v8_etm_out;
 
 	/* build connection data */
-	tc->con_in->used_mask = 0xF0; /* sigs <4,5,6,7> */
-	tc->con_out->used_mask = 0xF0; /* sigs <4,5,6,7> */
+	bitmap_set(tc->con_in->used_mask, 4, 4); /* sigs <4,5,6,7> */
+	bitmap_set(tc->con_out->used_mask, 4, 4); /* sigs <4,5,6,7> */
 
 	/*
 	 * The EXTOUT type signals from the ETM are connected to a set of input
@@ -194,10 +194,10 @@
 		goto of_create_v8_out;
 
 	/* Set the v8 PE CTI connection data */
-	tc->con_in->used_mask = 0x3; /* sigs <0 1> */
+	bitmap_set(tc->con_in->used_mask, 0, 2); /* sigs <0 1> */
 	tc->con_in->sig_types[0] = PE_DBGTRIGGER;
 	tc->con_in->sig_types[1] = PE_PMUIRQ;
-	tc->con_out->used_mask = 0x7; /* sigs <0 1 2 > */
+	bitmap_set(tc->con_out->used_mask, 0, 3); /* sigs <0 1 2 > */
 	tc->con_out->sig_types[0] = PE_EDBGREQ;
 	tc->con_out->sig_types[1] = PE_DBGRESTART;
 	tc->con_out->sig_types[2] = PE_CTIIRQ;
@@ -213,7 +213,7 @@
 		goto of_create_v8_out;
 
 	/* filter pe_edbgreq - PE trigout sig <0> */
-	drvdata->config.trig_out_filter |= 0x1;
+	set_bit(0, drvdata->config.trig_out_filter);
 
 of_create_v8_out:
 	return ret;
@@ -257,7 +257,7 @@
 	if (!err) {
 		/* set the signal usage mask */
 		for (idx = 0; idx < tgrp->nr_sigs; idx++)
-			tgrp->used_mask |= BIT(values[idx]);
+			set_bit(values[idx], tgrp->used_mask);
 	}
 
 	kfree(values);
@@ -331,7 +331,9 @@
 
 	err = cti_plat_read_trig_group(tg, fwnode, CTI_DT_FILTER_OUT_SIGS);
 	if (!err)
-		drvdata->config.trig_out_filter |= tg->used_mask;
+		bitmap_or(drvdata->config.trig_out_filter,
+				drvdata->config.trig_out_filter,
+				tg->used_mask, drvdata->config.nr_trig_max);
 
 	kfree(tg);
 	return err;
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-cti-sysfs.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-cti-sysfs.c
@@ -251,60 +251,6 @@
 	NULL,
 };
 
-/* CTI low level programming registers */
-
-/*
- * Show a simple 32 bit value if enabled and powered.
- * If inaccessible & pcached_val not NULL then show cached value.
- */
-static ssize_t cti_reg32_show(struct device *dev, char *buf,
-			      u32 *pcached_val, int reg_offset)
-{
-	u32 val = 0;
-	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
-	struct cti_config *config = &drvdata->config;
-
-	spin_lock(&drvdata->spinlock);
-	if ((reg_offset >= 0) && cti_active(config)) {
-		CS_UNLOCK(drvdata->base);
-		val = readl_relaxed(drvdata->base + reg_offset);
-		if (pcached_val)
-			*pcached_val = val;
-		CS_LOCK(drvdata->base);
-	} else if (pcached_val) {
-		val = *pcached_val;
-	}
-	spin_unlock(&drvdata->spinlock);
-	return sprintf(buf, "%#x\n", val);
-}
-
-/*
- * Store a simple 32 bit value.
- * If pcached_val not NULL, then copy to here too,
- * if reg_offset >= 0 then write through if enabled.
- */
-static ssize_t cti_reg32_store(struct device *dev, const char *buf,
-			       size_t size, u32 *pcached_val, int reg_offset)
-{
-	unsigned long val;
-	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
-	struct cti_config *config = &drvdata->config;
-
-	if (kstrtoul(buf, 0, &val))
-		return -EINVAL;
-
-	spin_lock(&drvdata->spinlock);
-	/* local store */
-	if (pcached_val)
-		*pcached_val = (u32)val;
-
-	/* write through if offset and enabled */
-	if ((reg_offset >= 0) && cti_active(config))
-		cti_write_single_reg(drvdata, reg_offset, val);
-	spin_unlock(&drvdata->spinlock);
-	return size;
-}
-
 /* Standard macro for simple rw cti config registers */
 #define cti_config_reg32_rw(name, cfgname, offset)			\
 static ssize_t name##_show(struct device *dev,				\
@@ -388,8 +334,13 @@
 	config->ctiinen[index] = val;
 
 	/* write through if enabled */
-	if (cti_active(config))
-		cti_write_single_reg(drvdata, CTIINEN(index), val);
+	if (cti_active(config)) {
+		if (drvdata->extended_cti)
+			cti_write_single_reg(drvdata, CTIINEN_EXTENDED(index), val);
+		else
+			cti_write_single_reg(drvdata, CTIINEN(index), val);
+	}
+
 	spin_unlock(&drvdata->spinlock);
 	return size;
 }
@@ -427,8 +378,13 @@
 	config->ctiouten[index] = val;
 
 	/* write through if enabled */
-	if (cti_active(config))
-		cti_write_single_reg(drvdata, CTIOUTEN(index), val);
+	if (cti_active(config)) {
+		if (drvdata->extended_cti)
+			cti_write_single_reg(drvdata, CTIOUTEN_EXTENDED(index), val);
+		else
+			cti_write_single_reg(drvdata, CTIOUTEN(index), val);
+	}
+
 	spin_unlock(&drvdata->spinlock);
 	return size;
 }
@@ -448,9 +404,143 @@
 }
 static DEVICE_ATTR_WO(intack);
 
-cti_config_reg32_rw(gate, ctigate, CTIGATE);
-cti_config_reg32_rw(asicctl, asicctl, ASICCTL);
-cti_config_reg32_rw(appset, ctiappset, CTIAPPSET);
+static ssize_t gate_show(struct device *dev,
+			   struct device_attribute *attr,
+			   char *buf)
+{
+	u32 val = 0;
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct cti_config *config = &drvdata->config;
+
+	spin_lock(&drvdata->spinlock);
+	if (cti_active(config)) {
+		CS_UNLOCK(drvdata->base);
+		if (drvdata->extended_cti)
+			val = readl_relaxed(drvdata->base + CTIGATE_EXTENDED);
+		else
+			val = readl_relaxed(drvdata->base + CTIGATE);
+		CS_LOCK(drvdata->base);
+	}
+	spin_unlock(&drvdata->spinlock);
+	return scnprintf(buf, PAGE_SIZE, "%#x\n", val);
+
+}
+
+static ssize_t gate_store(struct device *dev,
+			       struct device_attribute *attr,
+			       const char *buf, size_t size)
+{
+	unsigned long val;
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct cti_config *config = &drvdata->config;
+
+	if (kstrtoul(buf, 0, &val))
+		return -EINVAL;
+
+	spin_lock(&drvdata->spinlock);
+	/* write through if offset and enabled */
+	if (cti_active(config)) {
+		if (drvdata->extended_cti)
+			cti_write_single_reg(drvdata, CTIGATE_EXTENDED, val);
+		else
+			cti_write_single_reg(drvdata, CTIGATE, val);
+	}
+	spin_unlock(&drvdata->spinlock);
+	return size;
+}
+static DEVICE_ATTR_RW(gate);
+
+static ssize_t asicctl_show(struct device *dev,
+			   struct device_attribute *attr,
+			   char *buf)
+{
+	u32 val = 0;
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct cti_config *config = &drvdata->config;
+
+	spin_lock(&drvdata->spinlock);
+	if (cti_active(config)) {
+		CS_UNLOCK(drvdata->base);
+		if (drvdata->extended_cti)
+			val = readl_relaxed(drvdata->base + ASICCTL_EXTENDED);
+		else
+			val = readl_relaxed(drvdata->base + ASICCTL);
+		CS_LOCK(drvdata->base);
+	}
+	spin_unlock(&drvdata->spinlock);
+	return scnprintf(buf, PAGE_SIZE, "%#x\n", val);
+
+}
+
+static ssize_t asicctl_store(struct device *dev,
+			       struct device_attribute *attr,
+			       const char *buf, size_t size)
+{
+	unsigned long val;
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct cti_config *config = &drvdata->config;
+
+	if (kstrtoul(buf, 0, &val))
+		return -EINVAL;
+
+	spin_lock(&drvdata->spinlock);
+	/* write through if offset and enabled */
+	if (cti_active(config)) {
+		if (drvdata->extended_cti)
+			cti_write_single_reg(drvdata, ASICCTL_EXTENDED, val);
+		else
+			cti_write_single_reg(drvdata, ASICCTL, val);
+	}
+	spin_unlock(&drvdata->spinlock);
+	return size;
+}
+static DEVICE_ATTR_RW(asicctl);
+
+static ssize_t appset_show(struct device *dev,
+			   struct device_attribute *attr,
+			   char *buf)
+{
+	u32 val = 0;
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct cti_config *config = &drvdata->config;
+
+	spin_lock(&drvdata->spinlock);
+	if (cti_active(config)) {
+		CS_UNLOCK(drvdata->base);
+		if (drvdata->extended_cti)
+			val = readl_relaxed(drvdata->base + CTIAPPSET_EXTENDED);
+		else
+			val = readl_relaxed(drvdata->base + CTIAPPSET);
+		CS_LOCK(drvdata->base);
+	}
+	spin_unlock(&drvdata->spinlock);
+	return scnprintf(buf, PAGE_SIZE, "%#x\n", val);
+
+}
+
+static ssize_t appset_store(struct device *dev,
+			       struct device_attribute *attr,
+			       const char *buf, size_t size)
+{
+	unsigned long val;
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct cti_config *config = &drvdata->config;
+
+	if (kstrtoul(buf, 0, &val))
+		return -EINVAL;
+
+	spin_lock(&drvdata->spinlock);
+	/* write through if offset and enabled */
+	if (cti_active(config)) {
+		if (drvdata->extended_cti)
+			cti_write_single_reg(drvdata, CTIAPPSET_EXTENDED, val);
+		else
+			cti_write_single_reg(drvdata, CTIAPPSET, val);
+	}
+	spin_unlock(&drvdata->spinlock);
+	return size;
+}
+static DEVICE_ATTR_RW(appset);
 
 static ssize_t appclear_store(struct device *dev,
 			      struct device_attribute *attr,
@@ -469,8 +559,12 @@
 	config->ctiappset &= ~val;
 
 	/* write through if enabled */
-	if (cti_active(config))
-		cti_write_single_reg(drvdata, CTIAPPCLEAR, val);
+	if (cti_active(config)) {
+		if (drvdata->extended_cti)
+			cti_write_single_reg(drvdata, CTIAPPCLEAR, val);
+		else
+			cti_write_single_reg(drvdata, CTIAPPCLEAR_EXTENDED, val);
+	}
 	spin_unlock(&drvdata->spinlock);
 	return size;
 }
@@ -490,13 +584,147 @@
 	spin_lock(&drvdata->spinlock);
 
 	/* write through if enabled */
-	if (cti_active(config))
-		cti_write_single_reg(drvdata, CTIAPPPULSE, val);
+	if (cti_active(config)) {
+		if (drvdata->extended_cti)
+			cti_write_single_reg(drvdata, CTIAPPPULSE_EXTENDED, val);
+		else
+			cti_write_single_reg(drvdata, CTIAPPPULSE, val);
+	}
 	spin_unlock(&drvdata->spinlock);
 	return size;
 }
 static DEVICE_ATTR_WO(apppulse);
 
+static ssize_t triginstatus_show(struct device *dev,
+			   struct device_attribute *attr, char *buf)
+{
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct cti_config *config = &drvdata->config;
+	u32 val = 0;
+	u32 n, i = 0;
+	ssize_t len = 0;
+	int ret;
+
+	ret = pm_runtime_get_sync(dev->parent);
+	if (ret < 0) {
+		pm_runtime_put_noidle(dev->parent);
+		return ret;
+	}
+
+	spin_lock(&drvdata->spinlock);
+	if (drvdata->config.hw_powered) {
+		if (drvdata->extended_cti) {
+			i = (config->nr_trig_max - 1) / 32;
+			for (n = 0; n <= i; n++) {
+				val = readl_relaxed(drvdata->base + CTITRIGINSTATUS_EXTENDED(n));
+				len += scnprintf(buf + len, PAGE_SIZE - len, "%u - %u : 0x%x\n", n,
+							((n+1) * 32) - 1, val);
+			}
+		} else
+			val = readl_relaxed(drvdata->base + CTITRIGINSTATUS);
+	}
+	spin_unlock(&drvdata->spinlock);
+	pm_runtime_put_sync(dev->parent);
+
+	if (drvdata->extended_cti)
+		return len;
+	else
+		return scnprintf(buf, PAGE_SIZE, "0x%x\n", val);
+}
+static DEVICE_ATTR_RO(triginstatus);
+
+static ssize_t trigoutstatus_show(struct device *dev,
+			   struct device_attribute *attr, char *buf)
+{
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct cti_config *config = &drvdata->config;
+	u32 val = 0;
+	u32 n, i = 0;
+	ssize_t len = 0;
+	int ret;
+
+	ret = pm_runtime_get_sync(dev->parent);
+	if (ret < 0) {
+		pm_runtime_put_noidle(dev->parent);
+		return ret;
+	}
+
+	spin_lock(&drvdata->spinlock);
+	if (drvdata->config.hw_powered) {
+		if (drvdata->extended_cti) {
+			i = (config->nr_trig_max - 1) / 32;
+			for (n = 0; n <= i; n++) {
+				val = readl_relaxed(drvdata->base + CTITRIGOUTSTATUS_EXTENDED(n));
+				len += scnprintf(buf + len, PAGE_SIZE - len, "%u - %u : 0x%x\n", n,
+						((n+1) * 32) - 1,  val);
+			}
+		} else
+			val = readl_relaxed(drvdata->base + CTITRIGOUTSTATUS);
+	}
+	spin_unlock(&drvdata->spinlock);
+	pm_runtime_put_sync(dev->parent);
+
+	if (drvdata->extended_cti)
+		return len;
+	else
+		return scnprintf(buf, PAGE_SIZE, "0x%x\n", val);
+}
+static DEVICE_ATTR_RO(trigoutstatus);
+
+static ssize_t chinstatus_show(struct device *dev,
+			   struct device_attribute *attr, char *buf)
+{
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	u32 val = 0;
+	int ret;
+
+	ret = pm_runtime_get_sync(dev->parent);
+	if (ret < 0) {
+		pm_runtime_put_noidle(dev->parent);
+		return ret;
+	}
+
+	spin_lock(&drvdata->spinlock);
+	if (drvdata->config.hw_powered) {
+		if (drvdata->extended_cti)
+			val = readl_relaxed(drvdata->base + CTICHINSTATUS_EXTENDED);
+		else
+			val = readl_relaxed(drvdata->base + CTICHINSTATUS);
+	}
+	spin_unlock(&drvdata->spinlock);
+	pm_runtime_put_sync(dev->parent);
+
+	return scnprintf(buf, PAGE_SIZE, "0x%x\n", val);
+}
+static DEVICE_ATTR_RO(chinstatus);
+
+static ssize_t choutstatus_show(struct device *dev,
+			   struct device_attribute *attr, char *buf)
+{
+	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	u32 val = 0;
+	int ret;
+
+	ret = pm_runtime_get_sync(dev->parent);
+	if (ret < 0) {
+		pm_runtime_put_noidle(dev->parent);
+		return ret;
+	}
+
+	spin_lock(&drvdata->spinlock);
+	if (drvdata->config.hw_powered) {
+		if (drvdata->extended_cti)
+			val = readl_relaxed(drvdata->base + CTICHOUTSTATUS_EXTENDED);
+		else
+			val = readl_relaxed(drvdata->base + CTICHOUTSTATUS);
+	}
+	spin_unlock(&drvdata->spinlock);
+	pm_runtime_put_sync(dev->parent);
+
+	return scnprintf(buf, PAGE_SIZE, "0x%x\n", val);
+}
+static DEVICE_ATTR_RO(choutstatus);
+
 /*
  * Define CONFIG_CORESIGHT_CTI_INTEGRATION_REGS to enable the access to the
  * integration control registers. Normally only used to investigate connection
@@ -512,10 +740,10 @@
 	&dev_attr_appset.attr,
 	&dev_attr_appclear.attr,
 	&dev_attr_apppulse.attr,
-	coresight_cti_reg(triginstatus, CTITRIGINSTATUS),
-	coresight_cti_reg(trigoutstatus, CTITRIGOUTSTATUS),
-	coresight_cti_reg(chinstatus, CTICHINSTATUS),
-	coresight_cti_reg(choutstatus, CTICHOUTSTATUS),
+	&dev_attr_triginstatus.attr,
+	&dev_attr_trigoutstatus.attr,
+	&dev_attr_chinstatus.attr,
+	&dev_attr_choutstatus.attr,
 #ifdef CONFIG_CORESIGHT_CTI_INTEGRATION_REGS
 	coresight_cti_reg_rw(itctrl, CORESIGHT_ITCTRL),
 	coresight_cti_reg(ittrigin, ITTRIGIN),
@@ -711,10 +939,8 @@
 	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
 	struct cti_config *cfg = &drvdata->config;
 	int size = 0, nr_trig_max = cfg->nr_trig_max;
-	unsigned long mask = cfg->trig_out_filter;
 
-	if (mask)
-		size = bitmap_print_to_pagebuf(true, buf, &mask, nr_trig_max);
+	size = bitmap_print_to_pagebuf(true, buf, cfg->trig_out_filter, nr_trig_max);
 	return size;
 }
 static DEVICE_ATTR_RO(trigout_filtered);
@@ -926,9 +1152,8 @@
 	struct cti_trig_con *con = (struct cti_trig_con *)ext_attr->var;
 	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
 	struct cti_config *cfg = &drvdata->config;
-	unsigned long mask = con->con_in->used_mask;
 
-	return bitmap_print_to_pagebuf(true, buf, &mask, cfg->nr_trig_max);
+	return bitmap_print_to_pagebuf(true, buf, con->con_in->used_mask, cfg->nr_trig_max);
 }
 
 static ssize_t trigout_sig_show(struct device *dev,
@@ -940,9 +1165,8 @@
 	struct cti_trig_con *con = (struct cti_trig_con *)ext_attr->var;
 	struct cti_drvdata *drvdata = dev_get_drvdata(dev->parent);
 	struct cti_config *cfg = &drvdata->config;
-	unsigned long mask = con->con_out->used_mask;
 
-	return bitmap_print_to_pagebuf(true, buf, &mask, cfg->nr_trig_max);
+	return bitmap_print_to_pagebuf(true, buf, con->con_out->used_mask, cfg->nr_trig_max);
 }
 
 /* convert a sig type id to a name */
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-cti.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-cti.h
@@ -37,6 +37,20 @@
 #define CTICHOUTSTATUS		0x13C
 #define CTIGATE			0x140
 #define ASICCTL			0x144
+
+#define CTIINTACK_EXTENDED(n)   (0x020 + (4 * n))
+#define CTIAPPSET_EXTENDED      0x004
+#define CTIAPPCLEAR_EXTENDED    0x008
+#define CTIAPPPULSE_EXTENDED    0x00C
+#define CTIINEN_EXTENDED(n)     (0x400 + (4 * n))
+#define CTIOUTEN_EXTENDED(n)    (0x800 + (4 * n))
+#define CTITRIGINSTATUS_EXTENDED(n)     (0x040 + (4 * n))
+#define CTITRIGOUTSTATUS_EXTENDED(n)    (0x060 + (4 * n))
+#define CTICHINSTATUS_EXTENDED  0x080
+#define CTICHOUTSTATUS_EXTENDED 0x084
+#define CTIGATE_EXTENDED        0x088
+#define ASICCTL_EXTENDED        0x08c
+
 /* Integration test registers */
 #define ITCHINACK		0xEDC /* WO CTI CSSoc 400 only*/
 #define ITTRIGINACK		0xEE0 /* WO CTI CSSoc 400 only*/
@@ -46,6 +60,16 @@
 #define ITTRIGOUTACK		0xEF0 /* RO CTI CSSoc 400 only*/
 #define ITCHIN			0xEF4 /* RO */
 #define ITTRIGIN		0xEF8 /* RO */
+
+#define ITCHINACK_EXTENDED		0xE70 /* WO CTI CSSoc 400 only*/
+#define ITTRIGINACK_EXTENDED(n)		(0xE80 + (4 * n)) /* WO CTI CSSoc 400 only*/
+#define ITCHOUT_EXTENDED		0xE74 /* WO RW-600 */
+#define ITTRIGOUT_EXTENDED(n)		(0xEA + (4 * n)) /* WO RW-600 */
+#define ITCHOUTACK_EXTENDED		0xE78 /* RO CTI CSSoc 400 only*/
+#define ITTRIGOUTACK_EXTENDED(n)	(0xEC0 + (4 * n)) /* RO CTI CSSoc 400 only*/
+#define ITCHIN_EXTENDED			0xE7C /* RO */
+#define ITTRIGIN_EXTENDED(n)		(0xEE0 + (4 * n)) /* RO */
+
 /* management registers */
 #define CTIDEVAFF0		0xFA8
 #define CTIDEVAFF1		0xFAC
@@ -56,7 +80,7 @@
  * Max of in and out defined in the DEVID register.
  * - pick up actual number used from .dts parameters if present.
  */
-#define CTIINOUTEN_MAX		32
+#define CTIINOUTEN_MAX		128
 
 /**
  * Group of related trigger signals
@@ -67,7 +91,7 @@
  */
 struct cti_trig_grp {
 	int nr_sigs;
-	u32 used_mask;
+	DECLARE_BITMAP(used_mask, CTIINOUTEN_MAX);
 	int sig_types[];
 };
 
@@ -146,9 +170,9 @@
 	bool hw_powered;
 
 	/* registered triggers and filtering */
-	u32 trig_in_use;
-	u32 trig_out_use;
-	u32 trig_out_filter;
+	DECLARE_BITMAP(trig_in_use, CTIINOUTEN_MAX);
+	DECLARE_BITMAP(trig_out_use, CTIINOUTEN_MAX);
+	DECLARE_BITMAP(trig_out_filter, CTIINOUTEN_MAX);
 	bool trig_filter_enable;
 	u8 xtrig_rchan_sel;
 
@@ -179,6 +203,7 @@
 	struct cti_config config;
 	struct list_head node;
 	void (*csdev_release)(struct device *dev);
+	bool	extended_cti;
 };
 
 /*
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-dummy.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-dummy.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/coresight.h>
@@ -11,10 +11,12 @@
 #include <linux/pm_runtime.h>
 
 #include "coresight-priv.h"
+#include "coresight-trace-id.h"
 
 struct dummy_drvdata {
 	struct device			*dev;
 	struct coresight_device		*csdev;
+	u8				traceid;
 };
 
 DEFINE_CORESIGHT_DEVLIST(source_devs, "dummy_source");
@@ -23,6 +25,9 @@
 static int dummy_source_enable(struct coresight_device *csdev,
 			       struct perf_event *event, enum cs_mode mode)
 {
+	if (!coresight_take_mode(csdev, mode))
+		return -EBUSY;
+
 	dev_dbg(csdev->dev.parent, "Dummy source enabled\n");
 
 	return 0;
@@ -31,6 +36,7 @@
 static void dummy_source_disable(struct coresight_device *csdev,
 				 struct perf_event *event)
 {
+	coresight_set_mode(csdev, CS_MODE_DISABLED);
 	dev_dbg(csdev->dev.parent, "Dummy source disabled\n");
 }
 
@@ -67,6 +73,32 @@
 	.sink_ops = &dummy_sink_ops,
 };
 
+/* User can get the trace id of dummy source from this node. */
+static ssize_t traceid_show(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	unsigned long val;
+	struct dummy_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	val = drvdata->traceid;
+	return scnprintf(buf, PAGE_SIZE, "%#lx\n", val);
+}
+static DEVICE_ATTR_RO(traceid);
+
+static struct attribute *coresight_dummy_attrs[] = {
+	&dev_attr_traceid.attr,
+	NULL,
+};
+
+static const struct attribute_group coresight_dummy_group = {
+	.attrs = coresight_dummy_attrs,
+};
+
+static const struct attribute_group *coresight_dummy_groups[] = {
+	&coresight_dummy_group,
+	NULL,
+};
+
 static int dummy_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -74,6 +106,11 @@
 	struct coresight_platform_data *pdata;
 	struct dummy_drvdata *drvdata;
 	struct coresight_desc desc = { 0 };
+	int ret, trace_id;
+
+	drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL);
+	if (!drvdata)
+		return -ENOMEM;
 
 	if (of_device_is_compatible(node, "arm,coresight-dummy-source")) {
 
@@ -85,6 +122,25 @@
 		desc.subtype.source_subtype =
 					CORESIGHT_DEV_SUBTYPE_SOURCE_OTHERS;
 		desc.ops = &dummy_source_cs_ops;
+		desc.groups = coresight_dummy_groups;
+
+		ret = coresight_get_source_traceid(dev, &trace_id);
+		if (!ret) {
+			/* Get the preferred id if id is set in device tree. */
+			ret = coresight_trace_id_get_system_id(trace_id);
+			if (ret < 0)
+				return ret;
+
+		} else {
+			/* Get next available id if id is not set in device tree. */
+			trace_id = coresight_trace_id_get_system_id(TRACE_ID_ANY);
+			if (trace_id < 0) {
+				ret = trace_id;
+				return ret;
+			}
+		}
+		drvdata->traceid = (u8)trace_id;
+
 	} else if (of_device_is_compatible(node, "arm,coresight-dummy-sink")) {
 		desc.name = coresight_alloc_device_name(&sink_devs, dev);
 		if (!desc.name)
@@ -103,10 +159,6 @@
 		return PTR_ERR(pdata);
 	pdev->dev.platform_data = pdata;
 
-	drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL);
-	if (!drvdata)
-		return -ENOMEM;
-
 	drvdata->dev = &pdev->dev;
 	platform_set_drvdata(pdev, drvdata);
 
@@ -126,7 +178,10 @@
 {
 	struct dummy_drvdata *drvdata = platform_get_drvdata(pdev);
 	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
 
+	if (of_device_is_compatible(node, "arm,coresight-dummy-source"))
+		coresight_trace_id_put_system_id(drvdata->traceid);
 	pm_runtime_disable(dev);
 	coresight_unregister(drvdata->csdev);
 }
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-etm-perf.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-etm-perf.c
@@ -589,7 +589,7 @@
 		return;
 
 	/* stop tracer */
-	source_ops(csdev)->disable(csdev, event);
+	coresight_disable_source(csdev, event);
 
 	/* tell the core */
 	event->hw.state = PERF_HES_STOPPED;
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-etm3x-core.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-etm3x-core.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Description: CoreSight Program Flow Trace driver
  */
@@ -33,6 +34,7 @@
 #include "coresight-etm.h"
 #include "coresight-etm-perf.h"
 #include "coresight-trace-id.h"
+#include "coresight-common.h"
 
 /*
  * Not really modular but using module_param is the easiest way to
@@ -484,7 +486,7 @@
 			   struct perf_event *event)
 {
 	struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
-	int trace_id;
+	int trace_id, ret = 0;
 
 	if (WARN_ON_ONCE(drvdata->cpu != smp_processor_id()))
 		return -EINVAL;
@@ -508,8 +510,14 @@
 	}
 	drvdata->traceid = (u8)trace_id;
 
+	coresight_csr_set_etr_atid(csdev, drvdata->traceid, true);
+
 	/* And enable it */
-	return etm_enable_hw(drvdata);
+	ret = etm_enable_hw(drvdata);
+	if (ret)
+		coresight_csr_set_etr_atid(csdev, drvdata->traceid, false);
+
+	return ret;
 }
 
 static int etm_enable_sysfs(struct coresight_device *csdev)
@@ -525,6 +533,8 @@
 	if (ret < 0)
 		goto unlock_enable_sysfs;
 
+	coresight_csr_set_etr_atid(csdev, drvdata->traceid, true);
+
 	/*
 	 * Configure the ETM only if the CPU is online.  If it isn't online
 	 * hw configuration will take place on the local CPU during bring up.
@@ -541,8 +551,10 @@
 		ret = -ENODEV;
 	}
 
-	if (ret)
+	if (ret) {
+		coresight_csr_set_etr_atid(csdev, drvdata->traceid, false);
 		etm_release_trace_id(drvdata);
+	}
 
 unlock_enable_sysfs:
 	spin_unlock(&drvdata->spinlock);
@@ -695,6 +707,8 @@
 		return;
 	}
 
+	coresight_csr_set_etr_atid(csdev, drvdata->traceid, false);
+
 	if (mode)
 		local_set(&drvdata->mode, CS_MODE_DISABLED);
 }
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/acpi.h>
@@ -45,6 +46,7 @@
 #include "coresight-self-hosted-trace.h"
 #include "coresight-syscfg.h"
 #include "coresight-trace-id.h"
+#include "coresight-common.h"
 
 static int boot_enable;
 module_param(boot_enable, int, 0444);
@@ -784,8 +786,12 @@
 	}
 	drvdata->trcid = (u8)trace_id;
 
+	coresight_csr_set_etr_atid(csdev, drvdata->trcid, true);
+
 	/* And enable it */
 	ret = etm4_enable_hw(drvdata);
+	if (ret)
+		coresight_csr_set_etr_atid(csdev, drvdata->trcid, false);
 
 out:
 	return ret;
@@ -813,6 +819,8 @@
 	if (ret < 0)
 		goto unlock_sysfs_enable;
 
+	coresight_csr_set_etr_atid(csdev, drvdata->trcid, true);
+
 	/*
 	 * Executing etm4_enable_hw on the cpu whose ETM is being enabled
 	 * ensures that register writes occur when cpu is powered.
@@ -825,8 +833,10 @@
 	if (!ret)
 		drvdata->sticky_enable = true;
 
-	if (ret)
+	if (ret) {
+		coresight_csr_set_etr_atid(csdev, drvdata->trcid, false);
 		etm4_release_trace_id(drvdata);
+	}
 
 unlock_sysfs_enable:
 	spin_unlock(&drvdata->spinlock);
@@ -1024,6 +1034,8 @@
 		break;
 	}
 
+	coresight_csr_set_etr_atid(csdev, drvdata->trcid, false);
+
 	if (mode)
 		local_set(&drvdata->mode, CS_MODE_DISABLED);
 }
@@ -1200,6 +1212,7 @@
 	struct etm4_init_arg *init_arg = info;
 	struct etmv4_drvdata *drvdata;
 	struct csdev_access *csa;
+	struct device *dev = init_arg->dev;
 	int i;
 
 	drvdata = dev_get_drvdata(init_arg->dev);
@@ -1213,6 +1226,10 @@
 	if (!etm4_init_csdev_access(drvdata, csa))
 		return;
 
+	if (!csa->io_mem ||
+	    fwnode_property_present(dev_fwnode(dev), "qcom,skip-power-up"))
+		drvdata->skip_power_up = true;
+
 	/* Detect the support for OS Lock before we actually use it */
 	etm_detect_os_lock(drvdata, csa);
 
@@ -1239,6 +1256,8 @@
 	drvdata->nr_event = FIELD_GET(TRCIDR0_NUMEVENT_MASK, etmidr0);
 	/* QSUPP, bits[16:15] Q element support field */
 	drvdata->q_support = FIELD_GET(TRCIDR0_QSUPP_MASK, etmidr0);
+	if (drvdata->q_support)
+		drvdata->q_filt = !!(etmidr0 & TRCIDR0_QFILT);
 	/* TSSIZE, bits[28:24] Global timestamp size field */
 	drvdata->ts_size = FIELD_GET(TRCIDR0_TSSIZE_MASK, etmidr0);
 
@@ -1731,16 +1750,14 @@
 	state->trcccctlr = etm4x_read32(csa, TRCCCCTLR);
 	state->trcbbctlr = etm4x_read32(csa, TRCBBCTLR);
 	state->trctraceidr = etm4x_read32(csa, TRCTRACEIDR);
-	state->trcqctlr = etm4x_read32(csa, TRCQCTLR);
+	if (drvdata->q_filt)
+		state->trcqctlr = etm4x_read32(csa, TRCQCTLR);
 
 	state->trcvictlr = etm4x_read32(csa, TRCVICTLR);
 	state->trcviiectlr = etm4x_read32(csa, TRCVIIECTLR);
 	state->trcvissctlr = etm4x_read32(csa, TRCVISSCTLR);
 	if (drvdata->nr_pe_cmp)
 		state->trcvipcssctlr = etm4x_read32(csa, TRCVIPCSSCTLR);
-	state->trcvdctlr = etm4x_read32(csa, TRCVDCTLR);
-	state->trcvdsacctlr = etm4x_read32(csa, TRCVDSACCTLR);
-	state->trcvdarcctlr = etm4x_read32(csa, TRCVDARCCTLR);
 
 	for (i = 0; i < drvdata->nrseqstate - 1; i++)
 		state->trcseqevr[i] = etm4x_read32(csa, TRCSEQEVRn(i));
@@ -1757,7 +1774,8 @@
 		state->trccntvr[i] = etm4x_read32(csa, TRCCNTVRn(i));
 	}
 
-	for (i = 0; i < drvdata->nr_resource * 2; i++)
+	/* Resource selector pair 0 is reserved */
+	for (i = 2; i < drvdata->nr_resource * 2; i++)
 		state->trcrsctlr[i] = etm4x_read32(csa, TRCRSCTLRn(i));
 
 	for (i = 0; i < drvdata->nr_ss_cmp; i++) {
@@ -1842,8 +1860,10 @@
 {
 	int i;
 	struct etmv4_save_state *state = drvdata->save_state;
-	struct csdev_access tmp_csa = CSDEV_ACCESS_IOMEM(drvdata->base);
-	struct csdev_access *csa = &tmp_csa;
+	struct csdev_access *csa = &drvdata->csdev->access;
+
+	if (WARN_ON(!drvdata->csdev))
+		return;
 
 	etm4_cs_unlock(drvdata, csa);
 	etm4x_relaxed_write32(csa, state->trcclaimset, TRCCLAIMSET);
@@ -1862,16 +1882,14 @@
 	etm4x_relaxed_write32(csa, state->trcccctlr, TRCCCCTLR);
 	etm4x_relaxed_write32(csa, state->trcbbctlr, TRCBBCTLR);
 	etm4x_relaxed_write32(csa, state->trctraceidr, TRCTRACEIDR);
-	etm4x_relaxed_write32(csa, state->trcqctlr, TRCQCTLR);
+	if (drvdata->q_filt)
+		etm4x_relaxed_write32(csa, state->trcqctlr, TRCQCTLR);
 
 	etm4x_relaxed_write32(csa, state->trcvictlr, TRCVICTLR);
 	etm4x_relaxed_write32(csa, state->trcviiectlr, TRCVIIECTLR);
 	etm4x_relaxed_write32(csa, state->trcvissctlr, TRCVISSCTLR);
 	if (drvdata->nr_pe_cmp)
 		etm4x_relaxed_write32(csa, state->trcvipcssctlr, TRCVIPCSSCTLR);
-	etm4x_relaxed_write32(csa, state->trcvdctlr, TRCVDCTLR);
-	etm4x_relaxed_write32(csa, state->trcvdsacctlr, TRCVDSACCTLR);
-	etm4x_relaxed_write32(csa, state->trcvdarcctlr, TRCVDARCCTLR);
 
 	for (i = 0; i < drvdata->nrseqstate - 1; i++)
 		etm4x_relaxed_write32(csa, state->trcseqevr[i], TRCSEQEVRn(i));
@@ -1888,7 +1906,8 @@
 		etm4x_relaxed_write32(csa, state->trccntvr[i], TRCCNTVRn(i));
 	}
 
-	for (i = 0; i < drvdata->nr_resource * 2; i++)
+	/* Resource selector pair 0 is reserved */
+	for (i = 2; i < drvdata->nr_resource * 2; i++)
 		etm4x_relaxed_write32(csa, state->trcrsctlr[i], TRCRSCTLRn(i));
 
 	for (i = 0; i < drvdata->nr_ss_cmp; i++) {
@@ -2040,11 +2059,6 @@
 	if (!drvdata->arch)
 		return -EINVAL;
 
-	/* TRCPDCR is not accessible with system instructions. */
-	if (!desc.access.io_mem ||
-	    fwnode_property_present(dev_fwnode(dev), "qcom,skip-power-up"))
-		drvdata->skip_power_up = true;
-
 	major = ETM_ARCH_MAJOR_VERSION(drvdata->arch);
 	minor = ETM_ARCH_MINOR_VERSION(drvdata->arch);
 
@@ -2217,6 +2231,9 @@
 	ret = etm4_probe(&pdev->dev);
 
 	pm_runtime_put(&pdev->dev);
+	if (ret)
+		pm_runtime_disable(&pdev->dev);
+
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-etm4x.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -43,9 +43,6 @@
 #define TRCVIIECTLR			0x084
 #define TRCVISSCTLR			0x088
 #define TRCVIPCSSCTLR			0x08C
-#define TRCVDCTLR			0x0A0
-#define TRCVDSACCTLR			0x0A4
-#define TRCVDARCCTLR			0x0A8
 /* Derived resources registers */
 #define TRCSEQEVRn(n)			(0x100 + (n * 4)) /* n = 0-2 */
 #define TRCSEQRSTEVR			0x118
@@ -90,9 +87,6 @@
 /* Address Comparator registers n = 0-15 */
 #define TRCACVRn(n)			(0x400 + (n * 8))
 #define TRCACATRn(n)			(0x480 + (n * 8))
-/* Data Value Comparator Value registers, n = 0-7 */
-#define TRCDVCVRn(n)			(0x500 + (n * 16))
-#define TRCDVCMRn(n)			(0x580 + (n * 16))
 /* ContextID/Virtual ContextID comparators, n = 0-7 */
 #define TRCCIDCVRn(n)			(0x600 + (n * 8))
 #define TRCVMIDCVRn(n)			(0x640 + (n * 8))
@@ -141,6 +135,7 @@
 #define TRCIDR0_TRCCCI				BIT(7)
 #define TRCIDR0_RETSTACK			BIT(9)
 #define TRCIDR0_NUMEVENT_MASK			GENMASK(11, 10)
+#define TRCIDR0_QFILT				BIT(14)
 #define TRCIDR0_QSUPP_MASK			GENMASK(16, 15)
 #define TRCIDR0_TSSIZE_MASK			GENMASK(28, 24)
 
@@ -272,9 +267,6 @@
 /* List of registers accessible via System instructions */
 #define ETM4x_ONLY_SYSREG_LIST(op, val)		\
 	CASE_##op((val), TRCPROCSELR)		\
-	CASE_##op((val), TRCVDCTLR)		\
-	CASE_##op((val), TRCVDSACCTLR)		\
-	CASE_##op((val), TRCVDARCCTLR)		\
 	CASE_##op((val), TRCOSLAR)
 
 #define ETM_COMMON_SYSREG_LIST(op, val)		\
@@ -422,22 +414,6 @@
 	CASE_##op((val), TRCACATRn(13))		\
 	CASE_##op((val), TRCACATRn(14))		\
 	CASE_##op((val), TRCACATRn(15))		\
-	CASE_##op((val), TRCDVCVRn(0))		\
-	CASE_##op((val), TRCDVCVRn(1))		\
-	CASE_##op((val), TRCDVCVRn(2))		\
-	CASE_##op((val), TRCDVCVRn(3))		\
-	CASE_##op((val), TRCDVCVRn(4))		\
-	CASE_##op((val), TRCDVCVRn(5))		\
-	CASE_##op((val), TRCDVCVRn(6))		\
-	CASE_##op((val), TRCDVCVRn(7))		\
-	CASE_##op((val), TRCDVCMRn(0))		\
-	CASE_##op((val), TRCDVCMRn(1))		\
-	CASE_##op((val), TRCDVCMRn(2))		\
-	CASE_##op((val), TRCDVCMRn(3))		\
-	CASE_##op((val), TRCDVCMRn(4))		\
-	CASE_##op((val), TRCDVCMRn(5))		\
-	CASE_##op((val), TRCDVCMRn(6))		\
-	CASE_##op((val), TRCDVCMRn(7))		\
 	CASE_##op((val), TRCCIDCVRn(0))		\
 	CASE_##op((val), TRCCIDCVRn(1))		\
 	CASE_##op((val), TRCCIDCVRn(2))		\
@@ -907,9 +883,6 @@
 	u32	trcviiectlr;
 	u32	trcvissctlr;
 	u32	trcvipcssctlr;
-	u32	trcvdctlr;
-	u32	trcvdsacctlr;
-	u32	trcvdarcctlr;
 
 	u32	trcseqevr[ETM_MAX_SEQ_STATES];
 	u32	trcseqrstevr;
@@ -982,6 +955,7 @@
  * @os_unlock:  True if access to management registers is allowed.
  * @instrp0:	Tracing of load and store instructions
  *		as P0 elements is supported.
+ * @q_filt:	Q element filtering support, if Q elements are supported.
  * @trcbb:	Indicates if the trace unit supports branch broadcast tracing.
  * @trccond:	If the trace unit supports conditional
  *		instruction tracing.
@@ -1045,6 +1019,7 @@
 	bool				boot_enable;
 	bool				os_unlock;
 	bool				instrp0;
+	bool				q_filt;
 	bool				trcbb;
 	bool				trccond;
 	bool				retstack;
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-funnel.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-funnel.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2012, 2017, The Linux Foundation. All rights reserved.
  *
  * Description: CoreSight Funnel driver
  */
@@ -19,6 +19,7 @@
 #include <linux/coresight.h>
 #include <linux/amba/bus.h>
 #include <linux/clk.h>
+#include <linux/of_address.h>
 
 #include "coresight-priv.h"
 
@@ -209,13 +210,38 @@
 };
 ATTRIBUTE_GROUPS(coresight_funnel);
 
+static int funnel_get_resource_byname(struct device_node *np,
+				   char *ch_base, struct resource *res)
+{
+	const char *name = NULL;
+	int index = 0, found = 0;
+
+	while (!of_property_read_string_index(np, "reg-names", index, &name)) {
+		if (strcmp(ch_base, name)) {
+			index++;
+			continue;
+		}
+
+		/* We have a match and @index is where it's at */
+		found = 1;
+		break;
+	}
+
+	if (!found)
+		return -EINVAL;
+
+	return of_address_to_resource(np, index, res);
+}
+
 static int funnel_probe(struct device *dev, struct resource *res)
 {
 	int ret;
 	void __iomem *base;
 	struct coresight_platform_data *pdata = NULL;
 	struct funnel_drvdata *drvdata;
+	struct resource res_real;
 	struct coresight_desc desc = { 0 };
+	struct device_node *np = dev->of_node;
 
 	if (is_of_node(dev_fwnode(dev)) &&
 	    of_device_is_compatible(dev->of_node, "arm,coresight-funnel"))
@@ -236,11 +262,26 @@
 			return ret;
 	}
 
-	/*
-	 * Map the device base for dynamic-funnel, which has been
-	 * validated by AMBA core.
-	 */
-	if (res) {
+	if (of_property_read_bool(np, "qcom,duplicate-funnel")) {
+		ret = funnel_get_resource_byname(np, "funnel-base-real",
+						 &res_real);
+		if (ret)
+			return ret;
+
+		res = &res_real;
+		base = devm_ioremap(dev, res->start, resource_size(res));
+		if (IS_ERR(base)) {
+			ret = PTR_ERR(base);
+			goto out_disable_clk;
+		}
+		drvdata->base = base;
+		desc.groups = coresight_funnel_groups;
+		desc.access = CSDEV_ACCESS_IOMEM(base);
+	} else if (res) {
+		/*
+		 * Map the device base for dynamic-funnel, which has been
+		 * validated by AMBA core.
+		 */
 		base = devm_ioremap_resource(dev, res);
 		if (IS_ERR(base)) {
 			ret = PTR_ERR(base);
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-platform.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-platform.c
@@ -184,6 +184,33 @@
 }
 
 /*
+ * of_coresight_get_trace_id: Get the atid of a source device.
+ *
+ * Returns 0 on success.
+ */
+static int of_coresight_get_trace_id(struct device *dev, u32 *id)
+{
+
+	return of_property_read_u32(dev->of_node, "arm,trace-id", id);
+}
+
+static const char *of_coresight_get_device_name(struct device *dev)
+{
+	const char *name = NULL;
+
+	if (!dev->of_node)
+		return NULL;
+
+	/*
+	 * Get the device name from DT. The name describes the HW or
+	 * system the device is for.
+	 */
+	of_property_read_string(dev->of_node, "device-name", &name);
+
+	return name;
+}
+
+/*
  * of_coresight_parse_endpoint : Parse the given output endpoint @ep
  * and fill the connection information in @pdata->out_conns
  *
@@ -297,8 +324,10 @@
 			continue;
 
 		ret = of_coresight_parse_endpoint(dev, ep, pdata);
-		if (ret)
+		if (ret) {
+			of_node_put(ep);
 			return ret;
+		}
 	}
 
 	return 0;
@@ -315,6 +344,17 @@
 {
 	return -ENODEV;
 }
+
+static inline int of_coresight_get_trace_id(struct device *dev, u32 *id)
+{
+	return -ENODEV;
+}
+
+static inline const char *of_coresight_get_device_name(struct device *dev)
+{
+	return NULL;
+}
+
 #endif
 
 #ifdef CONFIG_ACPI
@@ -794,6 +834,24 @@
 }
 EXPORT_SYMBOL_GPL(coresight_get_cpu);
 
+int coresight_get_source_traceid(struct device *dev, u32 *id)
+{
+	if (!is_of_node(dev->fwnode))
+		return -EINVAL;
+
+	return of_coresight_get_trace_id(dev, id);
+}
+EXPORT_SYMBOL_GPL(coresight_get_source_traceid);
+
+const char *coresight_get_device_name(struct device *dev)
+{
+	if (is_of_node(dev->fwnode))
+		return of_coresight_get_device_name(dev);
+	else
+		return NULL;
+}
+EXPORT_SYMBOL_GPL(coresight_get_device_name);
+
 struct coresight_platform_data *
 coresight_get_platform_data(struct device *dev)
 {
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-priv.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-priv.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef _CORESIGHT_PRIV_H
@@ -132,6 +133,7 @@
 struct coresight_device *coresight_get_sink(struct list_head *path);
 struct coresight_device *
 coresight_get_enabled_sink(struct coresight_device *source);
+struct list_head *coresight_get_path(struct coresight_device *csdev);
 struct coresight_device *coresight_get_sink_by_id(u32 id);
 struct coresight_device *
 coresight_find_default_sink(struct coresight_device *csdev);
@@ -233,6 +235,6 @@
 struct coresight_device *coresight_get_percpu_sink(int cpu);
 int coresight_enable_source(struct coresight_device *csdev, enum cs_mode mode,
 			    void *data);
-bool coresight_disable_source(struct coresight_device *csdev, void *data);
+void coresight_disable_source(struct coresight_device *csdev, void *data);
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-qmi.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-qmi.h
@@ -0,0 +1,109 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CORESIGHT_QMI_H
+#define _CORESIGHT_QMI_H
+
+#include <linux/soc/qcom/qmi.h>
+
+#define CORESIGHT_QMI_SVC_ID			(0x33)
+#define CORESIGHT_QMI_VERSION			(1)
+
+#define CORESIGHT_QMI_GET_ETM_REQ_V01		(0x002B)
+#define CORESIGHT_QMI_GET_ETM_RESP_V01		(0x002B)
+#define CORESIGHT_QMI_SET_ETM_REQ_V01		(0x002C)
+#define CORESIGHT_QMI_SET_ETM_RESP_V01		(0x002C)
+
+#define CORESIGHT_QMI_GET_ETM_REQ_MAX_LEN	(0)
+#define CORESIGHT_QMI_GET_ETM_RESP_MAX_LEN	(14)
+#define CORESIGHT_QMI_SET_ETM_REQ_MAX_LEN	(7)
+#define CORESIGHT_QMI_SET_ETM_RESP_MAX_LEN	(7)
+
+#define TIMEOUT_MS				(10000)
+
+enum coresight_etm_state_enum_type_v01 {
+	/* To force a 32 bit signed enum. Do not change or use */
+	CORESIGHT_ETM_STATE_ENUM_TYPE_MIN_ENUM_VAL_V01 = INT_MIN,
+	CORESIGHT_ETM_STATE_DISABLED_V01 = 0,
+	CORESIGHT_ETM_STATE_ENABLED_V01 = 1,
+	CORESIGHT_ETM_STATE_ENUM_TYPE_MAX_ENUM_VAL_01 = INT_MAX,
+};
+
+struct coresight_get_etm_req_msg_v01 {
+	/*
+	 * This element is a placeholder to prevent declaration of
+	 * empty struct. Do not change.
+	 */
+	char __placeholder;
+};
+
+struct coresight_get_etm_resp_msg_v01 {
+	/* Mandatory */
+	/* QMI result Code */
+	struct qmi_response_type_v01 resp;
+
+	/* Optional */
+	/* ETM output state, must be set to true if state is being passed */
+	uint8_t state_valid;
+	/* Present when result code is QMI_RESULT_SUCCESS */
+	enum coresight_etm_state_enum_type_v01 state;
+};
+
+struct coresight_set_etm_req_msg_v01 {
+	/* Mandatory */
+	/* ETM output state */
+	enum coresight_etm_state_enum_type_v01 state;
+};
+
+struct coresight_set_etm_resp_msg_v01 {
+	/* Mandatory */
+	struct qmi_response_type_v01 resp;
+};
+
+static struct qmi_elem_info coresight_set_etm_req_msg_v01_ei[] = {
+	{
+		.data_type = QMI_UNSIGNED_4_BYTE,
+		.elem_len  = 1,
+		.elem_size = sizeof(enum coresight_etm_state_enum_type_v01),
+		.array_type  = NO_ARRAY,
+		.tlv_type  = 0x01,
+		.offset    = offsetof(struct coresight_set_etm_req_msg_v01,
+				      state),
+		.ei_array  = NULL,
+	},
+	{
+		.data_type = QMI_EOTI,
+		.elem_len  = 0,
+		.elem_size = 0,
+		.array_type  = NO_ARRAY,
+		.tlv_type  = 0,
+		.offset    = 0,
+		.ei_array  = NULL,
+	},
+};
+
+static struct qmi_elem_info coresight_set_etm_resp_msg_v01_ei[] = {
+	{
+		.data_type = QMI_STRUCT,
+		.elem_len  = 1,
+		.elem_size = sizeof(struct qmi_response_type_v01),
+		.array_type  = NO_ARRAY,
+		.tlv_type  = 0x02,
+		.offset    = offsetof(struct coresight_set_etm_resp_msg_v01,
+				      resp),
+		.ei_array  = qmi_response_type_v01_ei,
+	},
+	{
+		.data_type = QMI_EOTI,
+		.elem_len  = 0,
+		.elem_size = 0,
+		.array_type  = NO_ARRAY,
+		.tlv_type  = 0,
+		.offset    = 0,
+		.ei_array  = NULL,
+	},
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-remote-etm.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-remote-etm.c
@@ -0,0 +1,376 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/io.h>
+#include <linux/err.h>
+#include <linux/sysfs.h>
+#include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/coresight.h>
+#include "coresight-qmi.h"
+#include "coresight-priv.h"
+#include "coresight-common.h"
+
+#define REMOTE_ETM_TRACE_ID_START	192
+
+DEFINE_CORESIGHT_DEVLIST(remote_etm_devs, "remote-etm");
+
+static DEFINE_MUTEX(remote_etm_lock);
+static LIST_HEAD(remote_etm_list);
+
+struct remote_etm_drvdata {
+	struct device			*dev;
+	struct coresight_device		*csdev;
+	struct mutex			mutex;
+	struct qmi_handle		handle;
+	uint32_t			inst_id;
+	bool				enable;
+	bool service_connected;
+	bool security;
+	struct sockaddr_qrtr s_addr;
+	struct list_head link;
+	uint32_t			*traceids;
+	uint32_t			num_trcid;
+};
+
+static int service_remote_etm_new_server(struct qmi_handle *qmi,
+		struct qmi_service *svc)
+{
+	struct remote_etm_drvdata *drvdata = container_of(qmi,
+					struct remote_etm_drvdata, handle);
+
+	drvdata->s_addr.sq_family = AF_QIPCRTR;
+	drvdata->s_addr.sq_node = svc->node;
+	drvdata->s_addr.sq_port = svc->port;
+	drvdata->service_connected = true;
+	dev_info(drvdata->dev,
+		"Connection established between QMI handle and %d service\n",
+		drvdata->inst_id);
+
+	return 0;
+}
+
+static void service_remote_etm_del_server(struct qmi_handle *qmi,
+		struct qmi_service *svc)
+{
+	struct remote_etm_drvdata *drvdata = container_of(qmi,
+					struct remote_etm_drvdata, handle);
+	drvdata->service_connected = false;
+	dev_info(drvdata->dev,
+		"Connection disconnected between QMI handle and %d service\n",
+		drvdata->inst_id);
+}
+
+static struct qmi_ops server_ops = {
+	.new_server = service_remote_etm_new_server,
+	.del_server = service_remote_etm_del_server,
+};
+
+static int remote_etm_enable(struct coresight_device *csdev,
+			     struct perf_event *event, u32 mode)
+{
+	struct remote_etm_drvdata *drvdata =
+		dev_get_drvdata(csdev->dev.parent);
+	struct coresight_set_etm_req_msg_v01 req;
+	struct coresight_set_etm_resp_msg_v01 resp = { { 0, 0 } };
+	struct qmi_txn txn;
+	int i, ret;
+
+	mutex_lock(&drvdata->mutex);
+	for (i = 0; i < drvdata->num_trcid; i++)
+		coresight_csr_set_etr_atid(csdev, drvdata->traceids[i], true);
+
+	if (!drvdata->service_connected) {
+		dev_err(drvdata->dev, "QMI service not connected!\n");
+		ret = EINVAL;
+		goto err;
+	}
+	/*
+	 * The QMI handle may be NULL in the following scenarios:
+	 * 1. QMI service is not present
+	 * 2. QMI service is present but attempt to enable remote ETM is earlier
+	 *    than service is ready to handle request
+	 * 3. Connection between QMI client and QMI service failed
+	 *
+	 * Enable CoreSight without processing further QMI commands which
+	 * provides the option to enable remote ETM by other means.
+	 */
+	req.state = CORESIGHT_ETM_STATE_ENABLED_V01;
+
+	ret = qmi_txn_init(&drvdata->handle, &txn,
+			coresight_set_etm_resp_msg_v01_ei,
+			&resp);
+
+	if (ret < 0) {
+		dev_err(drvdata->dev, "QMI tx init failed , ret:%d\n",
+				ret);
+		goto err;
+	}
+
+	ret = qmi_send_request(&drvdata->handle, &drvdata->s_addr,
+			&txn, CORESIGHT_QMI_SET_ETM_REQ_V01,
+			CORESIGHT_QMI_SET_ETM_REQ_MAX_LEN,
+			coresight_set_etm_req_msg_v01_ei,
+			&req);
+	if (ret < 0) {
+		dev_err(drvdata->dev, "QMI send ACK failed, ret:%d\n",
+				ret);
+		qmi_txn_cancel(&txn);
+		goto err;
+	}
+
+	ret = qmi_txn_wait(&txn, msecs_to_jiffies(TIMEOUT_MS));
+	if (ret < 0) {
+		dev_err(drvdata->dev, "QMI qmi txn wait failed, ret:%d\n",
+				ret);
+		goto err;
+	}
+
+	/* Check the response */
+	if (resp.resp.result != QMI_RESULT_SUCCESS_V01)
+		dev_err(drvdata->dev, "QMI request failed 0x%x\n",
+				resp.resp.error);
+
+	drvdata->enable = true;
+	mutex_unlock(&drvdata->mutex);
+
+	dev_info(drvdata->dev, "Remote ETM tracing enabled for instance %d\n",
+				drvdata->inst_id);
+	return 0;
+err:
+	for (i = 0; i < drvdata->num_trcid; i++)
+		coresight_csr_set_etr_atid(csdev, drvdata->traceids[i], false);
+
+	mutex_unlock(&drvdata->mutex);
+	return ret;
+}
+
+static void remote_etm_disable(struct coresight_device *csdev,
+			       struct perf_event *event)
+{
+	struct remote_etm_drvdata *drvdata =
+		 dev_get_drvdata(csdev->dev.parent);
+	struct coresight_set_etm_req_msg_v01 req;
+	struct coresight_set_etm_resp_msg_v01 resp = { { 0, 0 } };
+	struct qmi_txn txn;
+	int i, ret;
+
+	mutex_lock(&drvdata->mutex);
+	if (!drvdata->service_connected) {
+		dev_err(drvdata->dev, "QMI service not connected!\n");
+		goto err;
+	}
+
+	req.state = CORESIGHT_ETM_STATE_DISABLED_V01;
+
+	ret = qmi_txn_init(&drvdata->handle, &txn,
+			coresight_set_etm_resp_msg_v01_ei,
+			&resp);
+
+	if (ret < 0) {
+		dev_err(drvdata->dev, "QMI tx init failed , ret:%d\n",
+				ret);
+		goto err;
+	}
+
+	ret = qmi_send_request(&drvdata->handle, &drvdata->s_addr,
+			&txn, CORESIGHT_QMI_SET_ETM_REQ_V01,
+			CORESIGHT_QMI_SET_ETM_REQ_MAX_LEN,
+			coresight_set_etm_req_msg_v01_ei,
+			&req);
+	if (ret < 0) {
+		dev_err(drvdata->dev, "QMI send req failed, ret:%d\n",
+				 ret);
+		qmi_txn_cancel(&txn);
+		goto err;
+	}
+
+	ret = qmi_txn_wait(&txn, msecs_to_jiffies(TIMEOUT_MS));
+	if (ret < 0) {
+		dev_err(drvdata->dev, "QMI qmi txn wait failed, ret:%d\n",
+				ret);
+		goto err;
+	}
+
+	/* Check the response */
+	if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
+		dev_err(drvdata->dev, "QMI request failed 0x%x\n",
+				resp.resp.error);
+		goto err;
+	}
+
+	for (i = 0; i < drvdata->num_trcid; i++)
+		coresight_csr_set_etr_atid(csdev, drvdata->traceids[i], false);
+
+	drvdata->enable = false;
+	dev_info(drvdata->dev, "Remote ETM tracing disabled for instance %d\n",
+				drvdata->inst_id);
+err:
+	mutex_unlock(&drvdata->mutex);
+}
+
+static const struct coresight_ops_source remote_etm_source_ops = {
+	.enable		= remote_etm_enable,
+	.disable	= remote_etm_disable,
+};
+
+static const struct coresight_ops remote_cs_ops = {
+	.source_ops	= &remote_etm_source_ops,
+};
+
+static int remote_etm_get_traceid(struct remote_etm_drvdata *drvdata)
+{
+	int ret, i;
+	struct device *dev = drvdata->dev;
+	uint32_t *atid;
+
+	ret = of_property_count_u32_elems(dev->of_node, "atid");
+	if (ret < 0) {
+		ret = of_property_read_u32(dev->of_node, "qcom,atid-num",
+				&drvdata->num_trcid);
+		if (ret)
+			return -EINVAL;
+	} else
+		drvdata->num_trcid = ret;
+
+	atid = devm_kcalloc(dev, drvdata->num_trcid, sizeof(*atid), GFP_KERNEL);
+	if (!atid)
+		return -ENOMEM;
+
+	ret = of_property_read_u32_array(dev->of_node, "atid",
+					 atid, drvdata->num_trcid);
+	if (ret)
+		return ret;
+
+	drvdata->traceids = devm_kcalloc(dev, drvdata->num_trcid,
+					 sizeof(uint32_t), GFP_KERNEL);
+	if (!drvdata->traceids)
+		return -ENOMEM;
+
+	for (i = 0; i < drvdata->num_trcid; i++)
+		drvdata->traceids[i] = (uint32_t)atid[i];
+
+	return 0;
+}
+
+static int remote_etm_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct coresight_platform_data *pdata;
+	struct remote_etm_drvdata *drvdata;
+	struct coresight_desc desc = {0 };
+	int ret;
+
+	desc.name = coresight_alloc_device_name(&remote_etm_devs, dev);
+	if (!desc.name)
+		return -ENOMEM;
+	pdata = coresight_get_platform_data(dev);
+	if (IS_ERR(pdata))
+		return PTR_ERR(pdata);
+	pdev->dev.platform_data = pdata;
+
+	drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL);
+	if (!drvdata)
+		return -ENOMEM;
+
+	drvdata->dev = &pdev->dev;
+	platform_set_drvdata(pdev, drvdata);
+
+	ret = of_property_read_u32(pdev->dev.of_node, "qcom,inst-id",
+			&drvdata->inst_id);
+	if (ret)
+		return ret;
+
+	mutex_init(&drvdata->mutex);
+
+	ret = qmi_handle_init(&drvdata->handle,
+			CORESIGHT_QMI_SET_ETM_REQ_MAX_LEN,
+			&server_ops, NULL);
+	if (ret < 0) {
+		dev_err(dev, "Remote ETM client init failed ret:%d\n", ret);
+		return ret;
+	}
+
+	qmi_add_lookup(&drvdata->handle,
+			CORESIGHT_QMI_SVC_ID,
+			CORESIGHT_QMI_VERSION,
+			drvdata->inst_id);
+
+	desc.type = CORESIGHT_DEV_TYPE_SOURCE;
+	desc.subtype.source_subtype = CORESIGHT_DEV_SUBTYPE_SOURCE_REMOTE_PROC;
+	desc.ops = &remote_cs_ops;
+	desc.pdata = pdev->dev.platform_data;
+	desc.dev = &pdev->dev;
+	drvdata->csdev = coresight_register(&desc);
+	if (IS_ERR(drvdata->csdev)) {
+		ret = PTR_ERR(drvdata->csdev);
+		goto err;
+	}
+
+	ret = remote_etm_get_traceid(drvdata);
+	if (ret)
+		drvdata->num_trcid = 0;
+
+	dev_info(dev, "Remote ETM initialized\n");
+
+	pm_runtime_enable(dev);
+	if (drvdata->inst_id >= sizeof(int)*BITS_PER_BYTE)
+		dev_err(dev, "inst_id greater than boot_enable bit mask\n");
+
+	list_add_tail(&drvdata->link, &remote_etm_list);
+
+	return 0;
+err:
+	qmi_handle_release(&drvdata->handle);
+	return ret;
+}
+
+static int remote_etm_remove(struct platform_device *pdev)
+{
+	struct remote_etm_drvdata *drvdata = platform_get_drvdata(pdev);
+	struct device *dev = &pdev->dev;
+
+	list_del(&drvdata->link);
+	pm_runtime_disable(dev);
+	qmi_handle_release(&drvdata->handle);
+	coresight_unregister(drvdata->csdev);
+	return 0;
+}
+
+static const struct of_device_id remote_etm_match[] = {
+	{.compatible = "qcom,coresight-remote-etm"},
+	{}
+};
+
+static struct platform_driver remote_etm_driver = {
+	.probe          = remote_etm_probe,
+	.remove         = remote_etm_remove,
+	.driver         = {
+		.name   = "coresight-remote-etm",
+		.of_match_table = remote_etm_match,
+	},
+};
+
+int __init remote_etm_init(void)
+{
+	return platform_driver_register(&remote_etm_driver);
+}
+module_init(remote_etm_init);
+
+void __exit remote_etm_exit(void)
+{
+	platform_driver_unregister(&remote_etm_driver);
+}
+module_exit(remote_etm_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("CoreSight Remote ETM driver");
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-stm.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-stm.c
@@ -2,6 +2,8 @@
 /*
  * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
  * Description: CoreSight System Trace Macrocell driver
  *
  * Initial implementation by Pratik Patel
@@ -32,6 +34,7 @@
 
 #include "coresight-priv.h"
 #include "coresight-trace-id.h"
+#include "coresight-common.h"
 
 #define STMDMASTARTR			0xc04
 #define STMDMASTOPR			0xc08
@@ -207,6 +210,8 @@
 	if (val)
 		return -EBUSY;
 
+	coresight_csr_set_etr_atid(csdev, drvdata->traceid, true);
+
 	pm_runtime_get_sync(csdev->dev.parent);
 
 	spin_lock(&drvdata->spinlock);
@@ -276,6 +281,8 @@
 
 		pm_runtime_put(csdev->dev.parent);
 
+		coresight_csr_set_etr_atid(csdev, drvdata->traceid, false);
+
 		local_set(&drvdata->mode, CS_MODE_DISABLED);
 		dev_dbg(&csdev->dev, "STM tracing disabled\n");
 	}
@@ -890,7 +897,7 @@
 		goto stm_unregister;
 	}
 
-	trace_id = coresight_trace_id_get_system_id();
+	trace_id = coresight_trace_id_get_system_id(TRACE_ID_ANY);
 	if (trace_id < 0) {
 		ret = trace_id;
 		goto cs_unregister;
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tgu.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tgu.c
@@ -0,0 +1,529 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include <linux/amba/bus.h>
+#include <linux/topology.h>
+#include <linux/of.h>
+#include <linux/coresight.h>
+
+#include "coresight-priv.h"
+
+#define tgu_writel(drvdata, val, off)	__raw_writel((val), drvdata->base + off)
+#define tgu_readl(drvdata, off)		__raw_readl(drvdata->base + off)
+
+#define TGU_LOCK(drvdata)						\
+do {									\
+	mb(); /* ensure configuration take effect before we lock it */	\
+	tgu_writel(drvdata, 0x0, CORESIGHT_LAR);			\
+} while (0)
+#define TGU_UNLOCK(drvdata)						\
+do {									\
+	tgu_writel(drvdata, CORESIGHT_UNLOCK, CORESIGHT_LAR);		\
+	mb(); /* ensure unlock take effect before we configure */	\
+} while (0)
+
+#define TGU_CONTROL			0x0000
+#define TIMER0_STATUS			0x0004
+#define COUNTER0_STATUS			0x000C
+#define TGU_STATUS			0x0014
+#define TIMER0_COMPARE_STEP(n)		(0x0040 + 0x1D8 * n)
+#define COUNTER0_COMPARE_STEP(n)	(0x0048 + 0x1D8 * n)
+#define GROUP_REG_STEP(grp, reg, step)	(0x0074 + 0x60 * grp + 0x4 * reg + \
+								 0x1D8 * step)
+#define CONDITION_DECODE_STEP(m, n)	(0x0050 + 0x4 * m + 0x1D8 * n)
+#define CONDITION_SELECT_STEP(m, n)	(0x0060 + 0x4 * m + 0x1D8 * n)
+#define GROUP0				0x0074
+#define GROUP1				0x00D4
+#define GROUP2				0x0134
+#define GROUP3				0x0194
+#define TGU_LAR				0x0FB0
+
+#define MAX_GROUP_SETS			256
+#define MAX_GROUPS			4
+#define MAX_CONDITION_SETS		64
+#define MAX_TIMER_COUNTER_SETS		8
+
+#define to_tgu_drvdata(c)		container_of(c, struct tgu_drvdata, tgu)
+
+struct Trigger_group_data {
+	unsigned long grpaddr;
+	unsigned long value;
+};
+
+struct Trigger_condition_data {
+	unsigned long condaddr;
+	unsigned long value;
+};
+
+struct Trigger_select_data {
+	unsigned long selectaddr;
+	unsigned long value;
+};
+
+struct Trigger_timer_data {
+	unsigned long timeraddr;
+	unsigned long value;
+};
+
+struct Trigger_counter_data {
+	unsigned long counteraddr;
+	unsigned long value;
+};
+struct tgu_drvdata {
+	void __iomem			*base;
+	struct device			*dev;
+	struct coresight_device		*csdev;
+	struct clk			*clk;
+	spinlock_t			spinlock;
+	int				max_steps;
+	int				max_conditions;
+	int				max_regs;
+	int				max_timer_counter;
+	struct Trigger_group_data	*grp_data;
+	struct Trigger_condition_data	*condition_data;
+	struct Trigger_select_data	*select_data;
+	struct Trigger_timer_data	*timer_data;
+	struct Trigger_counter_data	*counter_data;
+	int				grp_refcnt;
+	int				cond_refcnt;
+	int				select_refcnt;
+	int				timer_refcnt;
+	int				counter_refcnt;
+	bool				enable;
+};
+
+DEFINE_CORESIGHT_DEVLIST(tgu_devs, "tgu");
+
+static ssize_t enable_tgu_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t size)
+{
+	unsigned long value;
+	struct tgu_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	int ret, i, j;
+
+	if (kstrtoul(buf, 16, &value))
+		return -EINVAL;
+
+	/* Enable clock */
+	ret = pm_runtime_get_sync(drvdata->dev);
+	if (ret < 0) {
+		pm_runtime_put(drvdata->dev);
+		return ret;
+	}
+
+	spin_lock(&drvdata->spinlock);
+	/* Unlock the TGU LAR */
+	TGU_UNLOCK(drvdata);
+
+	if (value) {
+
+		/* Disable TGU to program the triggers */
+		tgu_writel(drvdata, 0, TGU_CONTROL);
+
+		/* program the TGU Group data for the desired use case*/
+
+		for (i = 0; i <= drvdata->grp_refcnt; i++)
+			tgu_writel(drvdata, drvdata->grp_data[i].value,
+						drvdata->grp_data[i].grpaddr);
+
+		/* program the unused Condition Decode registers NOT bits to 1*/
+		for (i = 0; i <= drvdata->max_conditions; i++) {
+			for (j = 0; j <= drvdata->max_steps; j++)
+				tgu_writel(drvdata, 0x1000000,
+						CONDITION_DECODE_STEP(i, j));
+		}
+		/* program the TGU Condition Decode for the desired use case*/
+		for (i = 0; i <= drvdata->cond_refcnt; i++)
+			tgu_writel(drvdata, drvdata->condition_data[i].value,
+					drvdata->condition_data[i].condaddr);
+
+		/* program the TGU Condition Select for the desired use case*/
+		for (i = 0; i <= drvdata->select_refcnt; i++)
+			tgu_writel(drvdata, drvdata->select_data[i].value,
+					drvdata->select_data[i].selectaddr);
+
+		/*  Timer and Counter Check */
+		for (i = 0; i <= drvdata->timer_refcnt; i++)
+			tgu_writel(drvdata, drvdata->timer_data[i].value,
+					drvdata->timer_data[i].timeraddr);
+
+		for (i = 0; i <= drvdata->counter_refcnt; i++)
+			tgu_writel(drvdata, drvdata->counter_data[i].value,
+					drvdata->counter_data[i].counteraddr);
+
+		/* Enable TGU to program the triggers */
+		tgu_writel(drvdata, 1, TGU_CONTROL);
+
+		drvdata->enable = true;
+		dev_dbg(dev, "Coresight-TGU enabled\n");
+
+	} else {
+		/* Disable TGU to program the triggers */
+		tgu_writel(drvdata, 0, TGU_CONTROL);
+
+		pm_runtime_put(drvdata->dev);
+		dev_dbg(dev, "Coresight-TGU disabled\n");
+	}
+
+	TGU_LOCK(drvdata);
+	spin_unlock(&drvdata->spinlock);
+	return size;
+}
+static DEVICE_ATTR_WO(enable_tgu);
+
+static ssize_t reset_tgu_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t size)
+{
+	unsigned long value;
+	struct tgu_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	int ret;
+
+	if (kstrtoul(buf, 16, &value))
+		return -EINVAL;
+
+	if (!drvdata->enable) {
+		/* Enable clock */
+		ret = pm_runtime_get_sync(drvdata->dev);
+		if (ret < 0) {
+			pm_runtime_put(drvdata->dev);
+			return ret;
+		}
+	}
+
+	spin_lock(&drvdata->spinlock);
+	/* Unlock the TGU LAR */
+	TGU_UNLOCK(drvdata);
+
+	if (value) {
+		/* Disable TGU to program the triggers */
+		tgu_writel(drvdata, 0, TGU_CONTROL);
+
+		/* Reset the Reference counters*/
+		drvdata->grp_refcnt = 0;
+		drvdata->cond_refcnt = 0;
+		drvdata->select_refcnt = 0;
+		drvdata->timer_refcnt = 0;
+		drvdata->counter_refcnt = 0;
+
+		dev_dbg(dev, "Coresight-TGU disabled\n");
+	} else
+		dev_dbg(dev, "Invalid input to reset the TGU\n");
+
+	TGU_LOCK(drvdata);
+	spin_unlock(&drvdata->spinlock);
+	pm_runtime_put(drvdata->dev);
+	return size;
+}
+static DEVICE_ATTR_WO(reset_tgu);
+
+static ssize_t set_group_store(struct device *dev, struct device_attribute
+					*attr, const char *buf, size_t size)
+{
+	struct tgu_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	int grp, reg, step;
+	unsigned long value;
+
+	if (drvdata->grp_refcnt >= MAX_GROUP_SETS) {
+		dev_err(drvdata->dev, " Too many groups are being configured\n");
+		return -EINVAL;
+	}
+
+	if (sscanf(buf, "%d %d %d %lx", &grp, &reg, &step, &value) != 4)
+		return -EINVAL;
+
+	spin_lock(&drvdata->spinlock);
+	if ((grp <= MAX_GROUPS) && (reg <= drvdata->max_regs)) {
+		drvdata->grp_data[drvdata->grp_refcnt].grpaddr =
+						GROUP_REG_STEP(grp, reg, step);
+		drvdata->grp_data[drvdata->grp_refcnt].value = value;
+		drvdata->grp_refcnt++;
+	} else
+		dev_err(drvdata->dev, "Invalid group data\n");
+
+	spin_unlock(&drvdata->spinlock);
+
+	return size;
+}
+static DEVICE_ATTR_WO(set_group);
+
+static ssize_t set_condition_store(struct device *dev, struct device_attribute
+					*attr, const char *buf, size_t size)
+{
+	struct tgu_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long value;
+	int cond, step;
+
+	if (drvdata->cond_refcnt >= MAX_CONDITION_SETS) {
+		dev_err(drvdata->dev, " Too many groups are being configured\n");
+		return -EINVAL;
+	}
+
+	if (sscanf(buf, "%d %d %lx", &cond, &step, &value) != 3)
+		return -EINVAL;
+
+	spin_lock(&drvdata->spinlock);
+	if ((cond <= drvdata->max_conditions) && (step <=
+						drvdata->max_steps)) {
+		drvdata->condition_data[drvdata->cond_refcnt].condaddr =
+					CONDITION_DECODE_STEP(cond, step);
+		drvdata->condition_data[drvdata->cond_refcnt].value = value;
+		drvdata->cond_refcnt++;
+	} else
+		dev_err(drvdata->dev, "Invalid condition decode data\n");
+
+	spin_unlock(&drvdata->spinlock);
+
+	return size;
+}
+static DEVICE_ATTR_WO(set_condition);
+
+static ssize_t set_select_store(struct device *dev, struct device_attribute
+					*attr, const char *buf, size_t size)
+{
+	struct tgu_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long value;
+	int select, step;
+
+	if (drvdata->select_refcnt >= MAX_CONDITION_SETS) {
+		dev_err(drvdata->dev, " Too many groups are being configured\n");
+		return -EINVAL;
+	}
+
+	if (sscanf(buf, "%d %d %lx", &select, &step, &value) != 3)
+		return -EINVAL;
+
+	spin_lock(&drvdata->spinlock);
+
+	if ((select <= drvdata->max_conditions) && (step <=
+					drvdata->max_steps)) {
+		drvdata->select_data[drvdata->select_refcnt].selectaddr =
+					CONDITION_SELECT_STEP(select, step);
+		drvdata->select_data[drvdata->select_refcnt].value = value;
+		drvdata->select_refcnt++;
+	} else
+		dev_err(drvdata->dev, "Invalid select decode data\n");
+
+	spin_unlock(&drvdata->spinlock);
+
+	return size;
+}
+static DEVICE_ATTR_WO(set_select);
+
+static ssize_t set_timer_store(struct device *dev, struct device_attribute
+					*attr, const char *buf, size_t size)
+{
+	struct tgu_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long value;
+	int step;
+
+	if (drvdata->timer_refcnt >= MAX_TIMER_COUNTER_SETS) {
+		dev_err(drvdata->dev, " Too many groups are being configured\n");
+		return -EINVAL;
+	}
+
+	if (sscanf(buf, "%d %lx", &step, &value) != 2)
+		return -EINVAL;
+
+	spin_lock(&drvdata->spinlock);
+	if (step <= drvdata->max_timer_counter) {
+		drvdata->timer_data[drvdata->timer_refcnt].timeraddr =
+						TIMER0_COMPARE_STEP(step);
+		drvdata->timer_data[drvdata->timer_refcnt].value = value;
+		drvdata->timer_refcnt++;
+	} else
+		dev_err(drvdata->dev, "Invalid TGU timer data\n");
+
+	spin_unlock(&drvdata->spinlock);
+
+	return size;
+}
+static DEVICE_ATTR_WO(set_timer);
+
+static ssize_t set_counter_store(struct device *dev, struct device_attribute
+					*attr, const char *buf, size_t size)
+{
+	struct tgu_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long value;
+	int step;
+
+	if (drvdata->counter_refcnt >= MAX_TIMER_COUNTER_SETS) {
+		dev_err(drvdata->dev, " Too many groups are being configured\n");
+		return -EINVAL;
+	}
+
+	if (sscanf(buf, "%d %lx", &step, &value) != 2)
+		return -EINVAL;
+
+	spin_lock(&drvdata->spinlock);
+	if (step <= drvdata->max_timer_counter) {
+		drvdata->counter_data[drvdata->counter_refcnt].counteraddr =
+						COUNTER0_COMPARE_STEP(step);
+		drvdata->counter_data[drvdata->counter_refcnt].value = value;
+		drvdata->counter_refcnt++;
+	} else
+		dev_err(drvdata->dev, "Invalid TGU counter data\n");
+
+	spin_unlock(&drvdata->spinlock);
+
+	return size;
+}
+static DEVICE_ATTR_WO(set_counter);
+
+static struct attribute *tgu_attrs[] = {
+	&dev_attr_enable_tgu.attr,
+	&dev_attr_reset_tgu.attr,
+	&dev_attr_set_group.attr,
+	&dev_attr_set_condition.attr,
+	&dev_attr_set_select.attr,
+	&dev_attr_set_timer.attr,
+	&dev_attr_set_counter.attr,
+	NULL,
+};
+
+static struct attribute_group tgu_attr_grp = {
+	.attrs = tgu_attrs,
+};
+
+static const struct attribute_group *tgu_attr_grps[] = {
+	&tgu_attr_grp,
+	NULL,
+};
+
+static int tgu_probe(struct amba_device *adev, const struct amba_id *id)
+{
+	int ret = 0;
+	struct device *dev = &adev->dev;
+	struct coresight_platform_data *pdata;
+	struct tgu_drvdata *drvdata;
+	struct coresight_desc desc = { 0 };
+
+	desc.name = coresight_alloc_device_name(&tgu_devs, dev);
+	if (!desc.name)
+		return -ENOMEM;
+	pdata = coresight_get_platform_data(dev);
+	if (IS_ERR(pdata))
+		return PTR_ERR(pdata);
+	adev->dev.platform_data = pdata;
+
+	drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL);
+	if (!drvdata)
+		return -ENOMEM;
+
+	drvdata->dev = &adev->dev;
+
+	dev_set_drvdata(dev, drvdata);
+
+	drvdata->base = devm_ioremap_resource(dev, &adev->res);
+	if (!drvdata->base)
+		return -ENOMEM;
+
+	spin_lock_init(&drvdata->spinlock);
+
+	ret = of_property_read_u32(adev->dev.of_node, "tgu-steps",
+						&drvdata->max_steps);
+	if (ret)
+		return -EINVAL;
+
+	ret = of_property_read_u32(adev->dev.of_node, "tgu-conditions",
+						&drvdata->max_conditions);
+	if (ret)
+		return -EINVAL;
+
+	ret = of_property_read_u32(adev->dev.of_node, "tgu-regs",
+							&drvdata->max_regs);
+	if (ret)
+		return -EINVAL;
+
+	ret = of_property_read_u32(adev->dev.of_node, "tgu-timer-counters",
+						&drvdata->max_timer_counter);
+	if (ret)
+		return -EINVAL;
+
+	/* Alloc memory for Grps, Conditions and Steps */
+	drvdata->grp_data = devm_kzalloc(dev, MAX_GROUP_SETS *
+				       sizeof(*drvdata->grp_data),
+				       GFP_KERNEL);
+	if (!drvdata->grp_data)
+		return -ENOMEM;
+
+	drvdata->condition_data = devm_kzalloc(dev, MAX_CONDITION_SETS *
+				       sizeof(*drvdata->condition_data),
+				       GFP_KERNEL);
+
+	if (!drvdata->condition_data)
+		return -ENOMEM;
+
+	drvdata->select_data = devm_kzalloc(dev, MAX_CONDITION_SETS *
+				       sizeof(*drvdata->select_data),
+				       GFP_KERNEL);
+	if (!drvdata->select_data)
+		return -ENOMEM;
+
+	drvdata->timer_data = devm_kzalloc(dev, MAX_TIMER_COUNTER_SETS *
+				       sizeof(*drvdata->timer_data),
+				       GFP_KERNEL);
+	if (!drvdata->timer_data)
+		return -ENOMEM;
+
+	drvdata->counter_data = devm_kzalloc(dev, MAX_TIMER_COUNTER_SETS *
+				       sizeof(*drvdata->counter_data),
+				       GFP_KERNEL);
+	if (!drvdata->counter_data)
+		return -ENOMEM;
+
+	drvdata->enable = false;
+
+	desc.type = CORESIGHT_DEV_TYPE_HELPER;
+	desc.pdata = adev->dev.platform_data;
+	desc.dev = &adev->dev;
+	desc.groups = tgu_attr_grps;
+	drvdata->csdev = coresight_register(&desc);
+	if (IS_ERR(drvdata->csdev)) {
+		ret = PTR_ERR(drvdata->csdev);
+		goto err;
+	}
+
+	pm_runtime_put(&adev->dev);
+	dev_dbg(dev, "TGU initialized\n");
+	return 0;
+err:
+	pm_runtime_put(&adev->dev);
+	return ret;
+}
+
+static struct amba_id tgu_ids[] = {
+	{
+		.id	=	0x0003b999,
+		.mask	=	0x0003ffff,
+		.data	=	"TGU",
+	},
+	{ 0, 0},
+};
+
+static struct amba_driver tgu_driver = {
+	.drv = {
+		.name			=	"coresight-tgu",
+		.owner			=	THIS_MODULE,
+		.suppress_bind_attrs	=	true,
+	},
+	.probe		=	tgu_probe,
+	.id_table	=	tgu_ids,
+};
+
+builtin_amba_driver(tgu_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("CoreSight TGU driver");
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tmc-core.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tmc-core.c
@@ -2,6 +2,8 @@
 /* Copyright (c) 2012, The Linux Foundation. All rights reserved.
  *
  * Description: CoreSight Trace Memory Controller driver
+ *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/kernel.h>
@@ -10,7 +12,6 @@
 #include <linux/device.h>
 #include <linux/idr.h>
 #include <linux/io.h>
-#include <linux/iommu.h>
 #include <linux/err.h>
 #include <linux/fs.h>
 #include <linux/miscdevice.h>
@@ -27,6 +28,7 @@
 
 #include "coresight-priv.h"
 #include "coresight-tmc.h"
+#include "coresight-common.h"
 
 DEFINE_CORESIGHT_DEVLIST(etb_devs, "tmc_etb");
 DEFINE_CORESIGHT_DEVLIST(etf_devs, "tmc_etf");
@@ -183,19 +185,25 @@
 	ssize_t actual;
 	struct tmc_drvdata *drvdata = container_of(file->private_data,
 						   struct tmc_drvdata, miscdev);
+
+	mutex_lock(&drvdata->mem_lock);
 	actual = tmc_get_sysfs_trace(drvdata, *ppos, len, &bufp);
-	if (actual <= 0)
+	if (actual <= 0) {
+		mutex_unlock(&drvdata->mem_lock);
 		return 0;
+	}
 
 	if (copy_to_user(data, bufp, actual)) {
 		dev_dbg(&drvdata->csdev->dev,
 			"%s: copy_to_user failed\n", __func__);
+		mutex_unlock(&drvdata->mem_lock);
 		return -EFAULT;
 	}
 
 	*ppos += actual;
 	dev_dbg(&drvdata->csdev->dev, "%zu bytes copied\n", actual);
 
+	mutex_unlock(&drvdata->mem_lock);
 	return actual;
 }
 
@@ -330,14 +338,93 @@
 
 static DEVICE_ATTR_RW(buffer_size);
 
-static struct attribute *coresight_tmc_attrs[] = {
+static ssize_t block_size_show(struct device *dev,
+			     struct device_attribute *attr,
+			     char *buf)
+{
+	struct tmc_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	uint32_t val = 0;
+
+	if (drvdata->byte_cntr)
+		val = drvdata->byte_cntr->block_size;
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+			val);
+}
+
+static ssize_t block_size_store(struct device *dev,
+			      struct device_attribute *attr,
+			      const char *buf,
+			      size_t size)
+{
+	struct tmc_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long val;
+
+	if (kstrtoul(buf, 0, &val))
+		return -EINVAL;
+
+	if (!drvdata->byte_cntr)
+		return -EINVAL;
+
+	if (val && val < 4096) {
+		pr_err("Assign minimum block size of 4096 bytes\n");
+		return -EINVAL;
+	}
+
+	mutex_lock(&drvdata->byte_cntr->byte_cntr_lock);
+	drvdata->byte_cntr->block_size = val;
+	mutex_unlock(&drvdata->byte_cntr->byte_cntr_lock);
+
+	return size;
+}
+static DEVICE_ATTR_RW(block_size);
+
+static ssize_t out_mode_show(struct device *dev,
+			     struct device_attribute *attr, char *buf)
+{
+	struct tmc_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	return scnprintf(buf, PAGE_SIZE, "%s\n",
+			str_tmc_etr_out_mode[drvdata->out_mode]);
+}
+
+static ssize_t out_mode_store(struct device *dev,
+			      struct device_attribute *attr,
+			      const char *buf, size_t size)
+{
+	struct tmc_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	char str[10] = "";
+	int ret;
+
+	if (strlen(buf) >= 10)
+		return -EINVAL;
+	if (sscanf(buf, "%s", str) != 1)
+		return -EINVAL;
+
+	ret = tmc_etr_switch_mode(drvdata, str);
+	return ret ? ret : size;
+}
+static DEVICE_ATTR_RW(out_mode);
+
+static struct attribute *coresight_tmc_etr_attrs[] = {
 	&dev_attr_trigger_cntr.attr,
 	&dev_attr_buffer_size.attr,
+	&dev_attr_block_size.attr,
+	&dev_attr_out_mode.attr,
+	NULL,
+};
+
+static struct attribute *coresight_tmc_etf_attrs[] = {
+	&dev_attr_trigger_cntr.attr,
 	NULL,
 };
 
-static const struct attribute_group coresight_tmc_group = {
-	.attrs = coresight_tmc_attrs,
+static const struct attribute_group coresight_tmc_etr_group = {
+	.attrs = coresight_tmc_etr_attrs,
+};
+
+static const struct attribute_group coresight_tmc_etf_group = {
+	.attrs = coresight_tmc_etf_attrs,
 };
 
 static const struct attribute_group coresight_tmc_mgmt_group = {
@@ -345,15 +432,14 @@
 	.name = "mgmt",
 };
 
-static const struct attribute_group *coresight_etf_groups[] = {
-	&coresight_tmc_group,
+static const struct attribute_group *coresight_tmc_etr_groups[] = {
+	&coresight_tmc_etr_group,
 	&coresight_tmc_mgmt_group,
 	NULL,
 };
 
-static const struct attribute_group *coresight_etr_groups[] = {
-	&coresight_etr_group,
-	&coresight_tmc_group,
+static const struct attribute_group *coresight_tmc_etf_groups[] = {
+	&coresight_tmc_etf_group,
 	&coresight_tmc_mgmt_group,
 	NULL,
 };
@@ -467,36 +553,48 @@
 	desc.access = CSDEV_ACCESS_IOMEM(base);
 
 	spin_lock_init(&drvdata->spinlock);
+	mutex_init(&drvdata->mem_lock);
 
 	devid = readl_relaxed(drvdata->base + CORESIGHT_DEVID);
 	drvdata->config_type = BMVAL(devid, 6, 7);
 	drvdata->memwidth = tmc_get_memwidth(devid);
 	/* This device is not associated with a session */
 	drvdata->pid = -1;
-	drvdata->etr_mode = ETR_MODE_AUTO;
 
 	if (drvdata->config_type == TMC_CONFIG_TYPE_ETR) {
+		drvdata->out_mode = TMC_ETR_OUT_MODE_MEM;
 		drvdata->size = tmc_etr_get_default_buffer_size(dev);
 		drvdata->max_burst_size = tmc_etr_get_max_burst_size(dev);
 	} else {
 		drvdata->size = readl_relaxed(drvdata->base + TMC_RSZ) * 4;
 	}
 
+	ret = of_get_coresight_csr_name(adev->dev.of_node, &drvdata->csr_name);
+	if (ret)
+		dev_info(dev, "No csr data\n");
+	else {
+		drvdata->csr = coresight_csr_get(drvdata->csr_name);
+		if (IS_ERR(drvdata->csr)) {
+			dev_info(dev, "failed to get csr, defer probe\n");
+			return -EPROBE_DEFER;
+		}
+	}
+
 	desc.dev = dev;
 
 	switch (drvdata->config_type) {
 	case TMC_CONFIG_TYPE_ETB:
-		desc.groups = coresight_etf_groups;
 		desc.type = CORESIGHT_DEV_TYPE_SINK;
 		desc.subtype.sink_subtype = CORESIGHT_DEV_SUBTYPE_SINK_BUFFER;
 		desc.ops = &tmc_etb_cs_ops;
+		desc.groups = coresight_tmc_etf_groups;
 		dev_list = &etb_devs;
 		break;
 	case TMC_CONFIG_TYPE_ETR:
-		desc.groups = coresight_etr_groups;
 		desc.type = CORESIGHT_DEV_TYPE_SINK;
 		desc.subtype.sink_subtype = CORESIGHT_DEV_SUBTYPE_SINK_SYSMEM;
 		desc.ops = &tmc_etr_cs_ops;
+		desc.groups = coresight_tmc_etr_groups;
 		ret = tmc_etr_setup_caps(dev, devid,
 					 coresight_get_uci_data(id));
 		if (ret)
@@ -504,13 +602,18 @@
 		idr_init(&drvdata->idr);
 		mutex_init(&drvdata->idr_mutex);
 		dev_list = &etr_devs;
+
+		drvdata->byte_cntr = byte_cntr_init(adev, drvdata);
+		ret = tmc_etr_usb_init(adev, drvdata);
+		if (ret)
+			goto out;
 		break;
 	case TMC_CONFIG_TYPE_ETF:
-		desc.groups = coresight_etf_groups;
 		desc.type = CORESIGHT_DEV_TYPE_LINKSINK;
 		desc.subtype.sink_subtype = CORESIGHT_DEV_SUBTYPE_SINK_BUFFER;
 		desc.subtype.link_subtype = CORESIGHT_DEV_SUBTYPE_LINK_FIFO;
 		desc.ops = &tmc_etf_cs_ops;
+		desc.groups = coresight_tmc_etf_groups;
 		dev_list = &etf_devs;
 		break;
 	default:
@@ -561,7 +664,10 @@
 	if (drvdata->mode == CS_MODE_DISABLED)
 		goto out;
 
-	if (drvdata->config_type == TMC_CONFIG_TYPE_ETR)
+	if (drvdata->config_type == TMC_CONFIG_TYPE_ETR &&
+		(drvdata->out_mode == TMC_ETR_OUT_MODE_MEM ||
+		 (drvdata->out_mode == TMC_ETR_OUT_MODE_USB &&
+		  drvdata->usb_data->usb_mode == TMC_ETR_USB_SW)))
 		tmc_etr_disable_hw(drvdata);
 
 	/*
@@ -582,6 +688,11 @@
 	 * etb fops in this case, device is there until last file
 	 * handler to this device is closed.
 	 */
+
+	if (drvdata->config_type == TMC_CONFIG_TYPE_ETR
+			&& drvdata->byte_cntr)
+		byte_cntr_remove(drvdata->byte_cntr);
+
 	misc_deregister(&drvdata->miscdev);
 	coresight_unregister(drvdata->csdev);
 }
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -84,6 +84,12 @@
 {
 	CS_UNLOCK(drvdata->base);
 
+	/* Check if the etf already disabled*/
+	if (!(readl_relaxed(drvdata->base + TMC_CTL) & TMC_CTL_CAPT_EN)) {
+		CS_LOCK(drvdata->base);
+		return;
+	}
+
 	tmc_flush_and_stop(drvdata);
 	/*
 	 * When operating in sysFS mode the content of the buffer needs to be
@@ -663,7 +669,6 @@
 	char *buf = NULL;
 	enum tmc_mode mode;
 	unsigned long flags;
-	int rc = 0;
 
 	/* config types are set a boot time and never change */
 	if (WARN_ON_ONCE(drvdata->config_type != TMC_CONFIG_TYPE_ETB &&
@@ -689,11 +694,7 @@
 		 * can't be NULL.
 		 */
 		memset(drvdata->buf, 0, drvdata->size);
-		rc = __tmc_etb_enable_hw(drvdata);
-		if (rc) {
-			spin_unlock_irqrestore(&drvdata->spinlock, flags);
-			return rc;
-		}
+		__tmc_etb_enable_hw(drvdata);
 	} else {
 		/*
 		 * The ETB/ETF is not tracing and the buffer was just read.
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -26,12 +26,6 @@
 	size_t		size;
 };
 
-struct etr_buf_hw {
-	bool	has_iommu;
-	bool	has_etr_sg;
-	bool	has_catu;
-};
-
 /*
  * etr_perf_buffer - Perf buffer used for ETR
  * @drvdata		- The ETR drvdaga this buffer has been allocated for.
@@ -57,6 +51,10 @@
 /* Lower limit for ETR hardware buffer */
 #define TMC_ETR_PERF_MIN_BUF_SIZE	SZ_1M
 
+
+/* SW USB reserved memory size */
+#define TMC_ETR_SW_USB_BUF_SIZE SZ_64M
+
 /*
  * The TMC ETR SG has a page size of 4K. The SG table contains pointers
  * to 4KB buffers. However, the OS may use a PAGE_SIZE different from
@@ -261,9 +259,43 @@
 {
 	tmc_free_table_pages(sg_table);
 	tmc_free_data_pages(sg_table);
+	kfree(sg_table);
 }
 EXPORT_SYMBOL_GPL(tmc_free_sg_table);
 
+static long tmc_flat_get_rwp_offset(struct tmc_drvdata *drvdata)
+{
+	dma_addr_t paddr = drvdata->sysfs_buf->hwaddr;
+	u64 rwp;
+
+	rwp = tmc_read_rwp(drvdata);
+	return rwp - paddr;
+}
+
+static long tmc_sg_get_rwp_offset(struct tmc_drvdata *drvdata)
+{
+	struct etr_buf *etr_buf = drvdata->sysfs_buf;
+	struct etr_sg_table *etr_table = etr_buf->private;
+	struct tmc_sg_table *table = etr_table->sg_table;
+	u64 rwp;
+	long w_offset;
+
+	rwp = tmc_read_rwp(drvdata);
+	w_offset = tmc_sg_get_data_page_offset(table, rwp);
+
+	return w_offset;
+}
+
+long tmc_get_rwp_offset(struct tmc_drvdata *drvdata)
+{
+	struct etr_buf *etr_buf = drvdata->sysfs_buf;
+
+	if (etr_buf->mode == ETR_MODE_FLAT)
+		return tmc_flat_get_rwp_offset(drvdata);
+	else
+		return tmc_sg_get_rwp_offset(drvdata);
+}
+
 /*
  * Alloc pages for the table. Since this will be used by the device,
  * allocate the pages closer to the device (i.e, dev_to_node(dev)
@@ -342,7 +374,6 @@
 		rc = tmc_alloc_table_pages(sg_table);
 	if (rc) {
 		tmc_free_sg_table(sg_table);
-		kfree(sg_table);
 		return ERR_PTR(rc);
 	}
 
@@ -836,22 +867,6 @@
 	}
 }
 
-static void get_etr_buf_hw(struct device *dev, struct etr_buf_hw *buf_hw)
-{
-	struct tmc_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-	buf_hw->has_iommu = iommu_get_domain_for_dev(dev->parent);
-	buf_hw->has_etr_sg = tmc_etr_has_cap(drvdata, TMC_ETR_SG);
-	buf_hw->has_catu = !!tmc_etr_get_catu_device(drvdata);
-}
-
-static bool etr_can_use_flat_mode(struct etr_buf_hw *buf_hw, ssize_t etr_buf_size)
-{
-	bool has_sg = buf_hw->has_catu || buf_hw->has_etr_sg;
-
-	return !has_sg || buf_hw->has_iommu || etr_buf_size < SZ_1M;
-}
-
 /*
  * tmc_alloc_etr_buf: Allocate a buffer use by ETR.
  * @drvdata	: ETR device details.
@@ -865,22 +880,23 @@
 					 int node, void **pages)
 {
 	int rc = -ENOMEM;
+	bool has_etr_sg, has_iommu;
+	bool has_sg, has_catu;
 	struct etr_buf *etr_buf;
-	struct etr_buf_hw buf_hw;
 	struct device *dev = &drvdata->csdev->dev;
 
-	get_etr_buf_hw(dev, &buf_hw);
+	has_etr_sg = tmc_etr_has_cap(drvdata, TMC_ETR_SG);
+	has_iommu = iommu_get_domain_for_dev(dev->parent);
+	has_catu = !!tmc_etr_get_catu_device(drvdata);
+
+	has_sg = has_catu || has_etr_sg;
+
 	etr_buf = kzalloc(sizeof(*etr_buf), GFP_KERNEL);
 	if (!etr_buf)
 		return ERR_PTR(-ENOMEM);
 
 	etr_buf->size = size;
 
-	/* If there is user directive for buffer mode, try that first */
-	if (drvdata->etr_mode != ETR_MODE_AUTO)
-		rc = tmc_etr_mode_alloc_buf(drvdata->etr_mode, drvdata,
-					    etr_buf, node, pages);
-
 	/*
 	 * If we have to use an existing list of pages, we cannot reliably
 	 * use a contiguous DMA memory (even if we have an IOMMU). Otherwise,
@@ -893,13 +909,14 @@
 	 * Fallback to available mechanisms.
 	 *
 	 */
-	if (rc && !pages && etr_can_use_flat_mode(&buf_hw, size))
+	if (!pages && (drvdata->out_mode != TMC_ETR_OUT_MODE_USB) &&
+	    (!has_sg || has_iommu || size < SZ_1M))
 		rc = tmc_etr_mode_alloc_buf(ETR_MODE_FLAT, drvdata,
 					    etr_buf, node, pages);
-	if (rc && buf_hw.has_etr_sg)
+	if (rc && has_etr_sg)
 		rc = tmc_etr_mode_alloc_buf(ETR_MODE_ETR_SG, drvdata,
 					    etr_buf, node, pages);
-	if (rc && buf_hw.has_catu)
+	if (rc && has_catu)
 		rc = tmc_etr_mode_alloc_buf(ETR_MODE_CATU, drvdata,
 					    etr_buf, node, pages);
 	if (rc) {
@@ -926,7 +943,7 @@
  * Returns: The size of the linear data available @pos, with *bufpp
  * updated to point to the buffer.
  */
-static ssize_t tmc_etr_buf_get_data(struct etr_buf *etr_buf,
+ssize_t tmc_etr_buf_get_data(struct etr_buf *etr_buf,
 				    u64 offset, size_t len, char **bufpp)
 {
 	/* Adjust the length to limit this transaction to end of buffer */
@@ -1104,7 +1121,12 @@
 static struct etr_buf *
 tmc_etr_setup_sysfs_buf(struct tmc_drvdata *drvdata)
 {
-	return tmc_alloc_etr_buf(drvdata, drvdata->size,
+	if (drvdata->out_mode == TMC_ETR_OUT_MODE_USB &&
+		drvdata->usb_data->usb_mode == TMC_ETR_USB_SW)
+		return tmc_alloc_etr_buf(drvdata, TMC_ETR_SW_USB_BUF_SIZE,
+				0, cpu_to_node(0), NULL);
+	else
+		return tmc_alloc_etr_buf(drvdata, drvdata->size,
 				 0, cpu_to_node(0), NULL);
 }
 
@@ -1218,13 +1240,10 @@
 	int ret = 0;
 	unsigned long flags;
 	struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
-	struct etr_buf *sysfs_buf = tmc_etr_get_sysfs_buffer(csdev);
+	struct etr_buf *sysfs_buf = NULL;
 
-	if (IS_ERR(sysfs_buf))
-		return PTR_ERR(sysfs_buf);
 
 	spin_lock_irqsave(&drvdata->spinlock, flags);
-
 	/*
 	 * In sysFS mode we can have multiple writers per sink.  Since this
 	 * sink is already enabled no memory is needed and the HW need not be
@@ -1232,20 +1251,49 @@
 	 */
 	if (drvdata->mode == CS_MODE_SYSFS) {
 		atomic_inc(&csdev->refcnt);
-		goto out;
+		goto unlock_out;
+	}
+
+	if (drvdata->reading || drvdata->mode == CS_MODE_PERF) {
+		ret = -EBUSY;
+		goto unlock_out;
+	}
+	spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+	sysfs_buf = tmc_etr_get_sysfs_buffer(csdev);
+
+	if (IS_ERR(sysfs_buf))
+		return PTR_ERR(sysfs_buf);
+
+	spin_lock_irqsave(&drvdata->spinlock, flags);
+
+	if ((drvdata->out_mode == TMC_ETR_OUT_MODE_MEM) ||
+		(drvdata->out_mode == TMC_ETR_OUT_MODE_USB &&
+			drvdata->usb_data->usb_mode ==
+			TMC_ETR_USB_SW)) {
+		ret = tmc_etr_enable_hw(drvdata, sysfs_buf);
+		if (ret)
+			goto unlock_out;
 	}
 
-	ret = tmc_etr_enable_hw(drvdata, sysfs_buf);
 	if (!ret) {
 		drvdata->mode = CS_MODE_SYSFS;
 		atomic_inc(&csdev->refcnt);
 	}
 
-out:
 	spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-	if (!ret)
-		dev_dbg(&csdev->dev, "TMC-ETR enabled\n");
+	if (drvdata->out_mode == TMC_ETR_OUT_MODE_MEM)
+		tmc_etr_byte_cntr_start(drvdata->byte_cntr);
+	if (drvdata->out_mode == TMC_ETR_OUT_MODE_USB)
+		tmc_usb_enable(drvdata->usb_data);
+
+	dev_dbg(&csdev->dev, "TMC-ETR enabled\n");
+
+	return 0;
+
+unlock_out:
+	spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
 	return ret;
 }
@@ -1697,9 +1745,15 @@
 static int tmc_enable_etr_sink(struct coresight_device *csdev,
 			       enum cs_mode mode, void *data)
 {
+	struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+	int ret;
+
 	switch (mode) {
 	case CS_MODE_SYSFS:
-		return tmc_enable_etr_sink_sysfs(csdev);
+		mutex_lock(&drvdata->mem_lock);
+		ret = tmc_enable_etr_sink_sysfs(csdev);
+		mutex_unlock(&drvdata->mem_lock);
+		return ret;
 	case CS_MODE_PERF:
 		return tmc_enable_etr_sink_perf(csdev, data);
 	default:
@@ -1707,7 +1761,8 @@
 	}
 }
 
-static int tmc_disable_etr_sink(struct coresight_device *csdev)
+static int _tmc_disable_etr_sink(struct coresight_device *csdev,
+				bool mode_switch)
 {
 	unsigned long flags;
 	struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
@@ -1719,14 +1774,27 @@
 		return -EBUSY;
 	}
 
-	if (atomic_dec_return(&csdev->refcnt)) {
+	if (atomic_dec_return(&csdev->refcnt) && !mode_switch) {
 		spin_unlock_irqrestore(&drvdata->spinlock, flags);
 		return -EBUSY;
 	}
 
 	/* Complain if we (somehow) got out of sync */
 	WARN_ON_ONCE(drvdata->mode == CS_MODE_DISABLED);
-	tmc_etr_disable_hw(drvdata);
+	if (drvdata->out_mode == TMC_ETR_OUT_MODE_MEM ||
+		(drvdata->out_mode == TMC_ETR_OUT_MODE_USB &&
+			drvdata->usb_data->usb_mode == TMC_ETR_USB_SW)) {
+		if (drvdata->out_mode == TMC_ETR_OUT_MODE_USB) {
+			spin_unlock_irqrestore(&drvdata->spinlock, flags);
+			tmc_usb_disable(drvdata->usb_data);
+			spin_lock_irqsave(&drvdata->spinlock, flags);
+		}
+		tmc_etr_disable_hw(drvdata);
+	} else {
+		spin_unlock_irqrestore(&drvdata->spinlock, flags);
+		return -EINVAL;
+	}
+
 	/* Dissociate from monitored process. */
 	drvdata->pid = -1;
 	drvdata->mode = CS_MODE_DISABLED;
@@ -1734,11 +1802,73 @@
 	drvdata->perf_buf = NULL;
 
 	spin_unlock_irqrestore(&drvdata->spinlock, flags);
+	tmc_etr_byte_cntr_stop(drvdata->byte_cntr);
 
 	dev_dbg(&csdev->dev, "TMC-ETR disabled\n");
 	return 0;
 }
 
+static int tmc_disable_etr_sink(struct coresight_device *csdev)
+{
+	struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+	int ret;
+
+	mutex_lock(&drvdata->mem_lock);
+	ret = _tmc_disable_etr_sink(csdev, false);
+	mutex_unlock(&drvdata->mem_lock);
+	return ret;
+}
+
+int tmc_etr_switch_mode(struct tmc_drvdata *drvdata, const char *out_mode)
+{
+	enum tmc_etr_out_mode new_mode, old_mode;
+
+	mutex_lock(&drvdata->mem_lock);
+	if (!strcmp(out_mode, str_tmc_etr_out_mode[TMC_ETR_OUT_MODE_MEM]))
+		new_mode = TMC_ETR_OUT_MODE_MEM;
+	else if (!strcmp(out_mode, str_tmc_etr_out_mode[TMC_ETR_OUT_MODE_USB])) {
+		if (drvdata->usb_data->usb_mode == TMC_ETR_USB_NONE) {
+			dev_err(&drvdata->csdev->dev,
+					"USB mode is not supported.\n");
+			mutex_unlock(&drvdata->mem_lock);
+			return -EINVAL;
+		}
+		new_mode = TMC_ETR_OUT_MODE_USB;
+	} else {
+		mutex_unlock(&drvdata->mem_lock);
+		return -EINVAL;
+	}
+
+	if (new_mode == drvdata->out_mode) {
+		mutex_unlock(&drvdata->mem_lock);
+		return 0;
+	}
+
+	if (drvdata->mode == CS_MODE_DISABLED) {
+		drvdata->out_mode = new_mode;
+		mutex_unlock(&drvdata->mem_lock);
+		return 0;
+	}
+
+	_tmc_disable_etr_sink(drvdata->csdev, true);
+	old_mode = drvdata->out_mode;
+	drvdata->out_mode = new_mode;
+
+	if (tmc_enable_etr_sink_sysfs(drvdata->csdev)) {
+		drvdata->out_mode = old_mode;
+		tmc_enable_etr_sink_sysfs(drvdata->csdev);
+		dev_err(&drvdata->csdev->dev,
+				"Switch to %s failed. Fall back to %s.\n",
+				str_tmc_etr_out_mode[new_mode],
+				str_tmc_etr_out_mode[old_mode]);
+		mutex_unlock(&drvdata->mem_lock);
+		return -EINVAL;
+	}
+
+	mutex_unlock(&drvdata->mem_lock);
+	return 0;
+}
+
 static const struct coresight_ops_sink tmc_etr_sink_ops = {
 	.enable		= tmc_enable_etr_sink,
 	.disable	= tmc_disable_etr_sink,
@@ -1760,12 +1890,18 @@
 	if (WARN_ON_ONCE(drvdata->config_type != TMC_CONFIG_TYPE_ETR))
 		return -EINVAL;
 
+	mutex_lock(&drvdata->mem_lock);
 	spin_lock_irqsave(&drvdata->spinlock, flags);
 	if (drvdata->reading) {
 		ret = -EBUSY;
 		goto out;
 	}
 
+	if (drvdata->byte_cntr && drvdata->byte_cntr->enable) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	/*
 	 * We can safely allow reads even if the ETR is operating in PERF mode,
 	 * since the sysfs session is captured in mode specific data.
@@ -1783,6 +1919,7 @@
 	drvdata->reading = true;
 out:
 	spin_unlock_irqrestore(&drvdata->spinlock, flags);
+	mutex_unlock(&drvdata->mem_lock);
 
 	return ret;
 }
@@ -1796,6 +1933,7 @@
 	if (WARN_ON_ONCE(drvdata->config_type != TMC_CONFIG_TYPE_ETR))
 		return -EINVAL;
 
+	mutex_lock(&drvdata->mem_lock);
 	spin_lock_irqsave(&drvdata->spinlock, flags);
 
 	/* RE-enable the TMC if need be */
@@ -1822,72 +1960,6 @@
 	if (sysfs_buf)
 		tmc_etr_free_sysfs_buf(sysfs_buf);
 
+	mutex_unlock(&drvdata->mem_lock);
 	return 0;
 }
-
-static const char *const buf_modes_str[] = {
-	[ETR_MODE_FLAT]		= "flat",
-	[ETR_MODE_ETR_SG]	= "tmc-sg",
-	[ETR_MODE_CATU]		= "catu",
-	[ETR_MODE_AUTO]		= "auto",
-};
-
-static ssize_t buf_modes_available_show(struct device *dev,
-					    struct device_attribute *attr, char *buf)
-{
-	struct etr_buf_hw buf_hw;
-	ssize_t size = 0;
-
-	get_etr_buf_hw(dev, &buf_hw);
-	size += sysfs_emit(buf, "%s ", buf_modes_str[ETR_MODE_AUTO]);
-	size += sysfs_emit_at(buf, size, "%s ", buf_modes_str[ETR_MODE_FLAT]);
-	if (buf_hw.has_etr_sg)
-		size += sysfs_emit_at(buf, size, "%s ", buf_modes_str[ETR_MODE_ETR_SG]);
-
-	if (buf_hw.has_catu)
-		size += sysfs_emit_at(buf, size, "%s ", buf_modes_str[ETR_MODE_CATU]);
-
-	size += sysfs_emit_at(buf, size, "\n");
-	return size;
-}
-static DEVICE_ATTR_RO(buf_modes_available);
-
-static ssize_t buf_mode_preferred_show(struct device *dev,
-					 struct device_attribute *attr, char *buf)
-{
-	struct tmc_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-	return sysfs_emit(buf, "%s\n", buf_modes_str[drvdata->etr_mode]);
-}
-
-static ssize_t buf_mode_preferred_store(struct device *dev,
-					  struct device_attribute *attr,
-					  const char *buf, size_t size)
-{
-	struct tmc_drvdata *drvdata = dev_get_drvdata(dev->parent);
-	struct etr_buf_hw buf_hw;
-
-	get_etr_buf_hw(dev, &buf_hw);
-	if (sysfs_streq(buf, buf_modes_str[ETR_MODE_FLAT]))
-		drvdata->etr_mode = ETR_MODE_FLAT;
-	else if (sysfs_streq(buf, buf_modes_str[ETR_MODE_ETR_SG]) && buf_hw.has_etr_sg)
-		drvdata->etr_mode = ETR_MODE_ETR_SG;
-	else if (sysfs_streq(buf, buf_modes_str[ETR_MODE_CATU]) && buf_hw.has_catu)
-		drvdata->etr_mode = ETR_MODE_CATU;
-	else if (sysfs_streq(buf, buf_modes_str[ETR_MODE_AUTO]))
-		drvdata->etr_mode = ETR_MODE_AUTO;
-	else
-		return -EINVAL;
-	return size;
-}
-static DEVICE_ATTR_RW(buf_mode_preferred);
-
-static struct attribute *coresight_etr_attrs[] = {
-	&dev_attr_buf_modes_available.attr,
-	&dev_attr_buf_mode_preferred.attr,
-	NULL,
-};
-
-const struct attribute_group coresight_etr_group = {
-	.attrs = coresight_etr_attrs,
-};
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tmc-usb.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tmc-usb.c
@@ -0,0 +1,470 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * Description: CoreSight TMC USB driver
+ */
+
+#include <linux/of_address.h>
+#include <linux/delay.h>
+#include <linux/soc/qcom/usb_qdss.h>
+#include <linux/time.h>
+#include <linux/slab.h>
+#include "coresight-tmc-usb.h"
+#include "coresight-priv.h"
+#include "coresight-common.h"
+#include "coresight-tmc.h"
+
+#define USB_BLK_SIZE 65536
+#define USB_SG_NUM (USB_BLK_SIZE / PAGE_SIZE)
+#define USB_BUF_NUM 255
+#define USB_TIME_OUT (5 * HZ)
+
+#define TMC_AXICTL_VALUE	(0xf02)
+#define TMC_FFCR_VALUE		(0x133)
+
+static int usb_bypass_start(struct byte_cntr *byte_cntr_data)
+{
+	long offset;
+	struct tmc_drvdata *tmcdrvdata;
+
+	if (!byte_cntr_data)
+		return -ENOMEM;
+
+	tmcdrvdata = byte_cntr_data->tmcdrvdata;
+	mutex_lock(&byte_cntr_data->usb_bypass_lock);
+
+
+	dev_info(&tmcdrvdata->csdev->dev,
+			"%s: Start usb bypass\n", __func__);
+	if (tmcdrvdata->mode != CS_MODE_SYSFS) {
+		mutex_unlock(&byte_cntr_data->usb_bypass_lock);
+		return -EINVAL;
+	}
+
+	offset = tmc_get_rwp_offset(tmcdrvdata);
+	if (offset < 0) {
+		dev_err(&tmcdrvdata->csdev->dev,
+			"%s: invalid rwp offset value\n", __func__);
+		mutex_unlock(&byte_cntr_data->usb_bypass_lock);
+		return offset;
+	}
+	byte_cntr_data->offset = offset;
+
+	/*Ensure usbch is ready*/
+	if (!tmcdrvdata->usb_data->usbch) {
+		int i;
+
+		for (i = TIMEOUT_US; i > 0; i--) {
+			if (tmcdrvdata->usb_data->usbch)
+				break;
+
+			if (i - 1)
+				udelay(1);
+			else {
+				dev_err(&tmcdrvdata->csdev->dev,
+					"timeout while waiting usbch to be ready\n");
+				mutex_unlock(&byte_cntr_data->usb_bypass_lock);
+				return -EAGAIN;
+			}
+		}
+	}
+	atomic_set(&byte_cntr_data->usb_free_buf, USB_BUF_NUM);
+
+	byte_cntr_data->read_active = true;
+	/*
+	 * IRQ is a '8- byte' counter and to observe interrupt at
+	 * 'block_size' bytes of data
+	 */
+	coresight_csr_set_byte_cntr(byte_cntr_data->csr,
+			byte_cntr_data->irqctrl_offset,
+			USB_BLK_SIZE / 8);
+
+	atomic_set(&byte_cntr_data->irq_cnt, 0);
+	mutex_unlock(&byte_cntr_data->usb_bypass_lock);
+
+	return 0;
+}
+
+static void usb_bypass_stop(struct byte_cntr *byte_cntr_data)
+{
+	if (!byte_cntr_data)
+		return;
+
+	mutex_lock(&byte_cntr_data->usb_bypass_lock);
+	if (byte_cntr_data->read_active)
+		byte_cntr_data->read_active = false;
+	else {
+		mutex_unlock(&byte_cntr_data->usb_bypass_lock);
+		return;
+	}
+	wake_up(&byte_cntr_data->usb_wait_wq);
+	pr_info("coresight: stop usb bypass\n");
+	coresight_csr_set_byte_cntr(byte_cntr_data->csr, byte_cntr_data->irqctrl_offset, 0);
+	mutex_unlock(&byte_cntr_data->usb_bypass_lock);
+
+}
+
+static int usb_transfer_small_packet(struct byte_cntr *drvdata, size_t *small_size)
+{
+	int ret = 0;
+	struct tmc_drvdata *tmcdrvdata = drvdata->tmcdrvdata;
+	struct etr_buf *etr_buf = tmcdrvdata->sysfs_buf;
+	struct qdss_request *usb_req = NULL;
+	size_t req_size;
+	long actual;
+	long w_offset;
+
+	w_offset = tmc_get_rwp_offset(tmcdrvdata);
+	if (w_offset < 0) {
+		ret = w_offset;
+		dev_err_ratelimited(&tmcdrvdata->csdev->dev,
+			"%s: RWP offset is invalid\n", __func__);
+		goto out;
+	}
+
+	req_size = ((w_offset < drvdata->offset) ? etr_buf->size : 0) +
+				w_offset - drvdata->offset;
+
+	/*
+	 * Byte-cntr irq number may mismatch with the data size in ETR sink.
+	 * When irq_cnt is 0 and pending data size is more than block size,
+	 * calculate the irq_cnt by SW.
+	 */
+	if (req_size + *small_size >= USB_BLK_SIZE
+			&& atomic_read(&drvdata->irq_cnt) == 0) {
+		atomic_set(&drvdata->irq_cnt, (req_size + *small_size)/USB_BLK_SIZE);
+		goto out;
+	}
+
+	while (req_size > 0) {
+
+		usb_req = kzalloc(sizeof(*usb_req), GFP_KERNEL);
+		if (!usb_req) {
+			ret = -EFAULT;
+			goto out;
+		}
+
+		actual = tmc_etr_buf_get_data(etr_buf, drvdata->offset,
+					req_size, &usb_req->buf);
+
+		if (actual <= 0 || actual > req_size) {
+			kfree(usb_req);
+			usb_req = NULL;
+			dev_err_ratelimited(&tmcdrvdata->csdev->dev,
+				"%s: Invalid data in ETR\n", __func__);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		usb_req->length = actual;
+		drvdata->usb_req = usb_req;
+		req_size -= actual;
+
+		if ((drvdata->offset + actual) >=
+				tmcdrvdata->sysfs_buf->size)
+			drvdata->offset = 0;
+		else
+			drvdata->offset += actual;
+
+		*small_size += actual;
+
+		if (atomic_read(&drvdata->usb_free_buf) > 0) {
+			ret = usb_qdss_write(tmcdrvdata->usb_data->usbch, usb_req);
+
+			if (ret) {
+				kfree(usb_req);
+				usb_req = NULL;
+				drvdata->usb_req = NULL;
+				dev_err_ratelimited(&tmcdrvdata->csdev->dev,
+					"Write data failed:%d\n", ret);
+				goto out;
+			}
+
+			atomic_dec(&drvdata->usb_free_buf);
+		} else {
+			dev_err(&tmcdrvdata->csdev->dev,
+			"Drop data, offset = %ld, len = %ld\n",
+				drvdata->offset, req_size);
+			kfree(usb_req);
+			drvdata->usb_req = NULL;
+		}
+	}
+
+out:
+	return ret;
+}
+
+static void usb_read_work_fn(struct work_struct *work)
+{
+	int ret, i, seq = 0;
+	struct qdss_request *usb_req = NULL;
+	size_t req_size, req_sg_num, small_size = 0;
+	long actual;
+	ssize_t actual_total = 0;
+	char *buf;
+	struct byte_cntr *drvdata =
+		container_of(work, struct byte_cntr, read_work);
+	struct tmc_drvdata *tmcdrvdata = drvdata->tmcdrvdata;
+	struct etr_buf *etr_buf = tmcdrvdata->sysfs_buf;
+
+	while (tmcdrvdata->mode == CS_MODE_SYSFS
+		&& tmcdrvdata->out_mode == TMC_ETR_OUT_MODE_USB) {
+		if (!atomic_read(&drvdata->irq_cnt)) {
+			ret =  wait_event_interruptible_timeout(
+				drvdata->usb_wait_wq,
+				atomic_read(&drvdata->irq_cnt) > 0
+				|| tmcdrvdata->mode != CS_MODE_SYSFS || tmcdrvdata->out_mode
+				!= TMC_ETR_OUT_MODE_USB
+				|| !drvdata->read_active, USB_TIME_OUT);
+			if (ret == -ERESTARTSYS || tmcdrvdata->mode != CS_MODE_SYSFS
+			|| tmcdrvdata->out_mode != TMC_ETR_OUT_MODE_USB
+			|| !drvdata->read_active)
+				break;
+
+			if (ret == 0) {
+				ret = usb_transfer_small_packet(drvdata, &small_size);
+				if (ret && ret != -EAGAIN)
+					return;
+				continue;
+			}
+		}
+
+		req_size = USB_BLK_SIZE - small_size;
+		small_size = 0;
+		actual_total = 0;
+
+		if (req_size > 0) {
+			seq++;
+			req_sg_num = (req_size - 1) / PAGE_SIZE + 1;
+			usb_req = kzalloc(sizeof(*usb_req), GFP_KERNEL);
+			if (!usb_req)
+				return;
+			usb_req->sg = kcalloc(req_sg_num,
+				sizeof(*(usb_req->sg)), GFP_KERNEL);
+			if (!usb_req->sg) {
+				kfree(usb_req);
+				usb_req = NULL;
+				return;
+			}
+
+			for (i = 0; i < req_sg_num; i++) {
+				actual = tmc_etr_buf_get_data(etr_buf,
+							drvdata->offset,
+							PAGE_SIZE, &buf);
+
+				if (actual <= 0 || actual > PAGE_SIZE) {
+					kfree(usb_req->sg);
+					kfree(usb_req);
+					usb_req = NULL;
+					dev_err_ratelimited(
+						&tmcdrvdata->csdev->dev,
+						"Invalid data in ETR\n");
+					return;
+				}
+
+				sg_set_buf(&usb_req->sg[i], buf, actual);
+
+				if (i == 0)
+					usb_req->buf = buf;
+				if (i == req_sg_num - 1)
+					sg_mark_end(&usb_req->sg[i]);
+
+				if ((drvdata->offset + actual) >=
+					tmcdrvdata->sysfs_buf->size)
+					drvdata->offset = 0;
+				else
+					drvdata->offset += actual;
+				actual_total += actual;
+			}
+
+			usb_req->length = actual_total;
+			drvdata->usb_req = usb_req;
+			usb_req->num_sgs = i;
+
+			if (atomic_read(&drvdata->usb_free_buf) > 0) {
+				ret = usb_qdss_write(tmcdrvdata->usb_data->usbch,
+						drvdata->usb_req);
+				if (ret) {
+					kfree(usb_req->sg);
+					kfree(usb_req);
+					usb_req = NULL;
+					drvdata->usb_req = NULL;
+					dev_err_ratelimited(
+						&tmcdrvdata->csdev->dev,
+						"Write data failed:%d\n", ret);
+					if (ret == -EAGAIN)
+						continue;
+					return;
+				}
+				atomic_dec(&drvdata->usb_free_buf);
+
+			} else {
+				dev_err(&tmcdrvdata->csdev->dev,
+				"Drop data, offset = %ld, seq = %d, irq = %d\n",
+					drvdata->offset, seq,
+					atomic_read(&drvdata->irq_cnt));
+				kfree(usb_req->sg);
+				kfree(usb_req);
+				drvdata->usb_req = NULL;
+			}
+		}
+
+		if (atomic_read(&drvdata->irq_cnt) > 0)
+			atomic_dec(&drvdata->irq_cnt);
+	}
+	dev_err(&tmcdrvdata->csdev->dev, "TMC has been stopped.\n");
+}
+
+static void usb_write_done(struct byte_cntr *drvdata,
+				   struct qdss_request *d_req)
+{
+	atomic_inc(&drvdata->usb_free_buf);
+	if (d_req->status)
+		pr_err_ratelimited("USB write failed err:%d\n", d_req->status);
+	kfree(d_req->sg);
+	kfree(d_req);
+}
+
+static int usb_bypass_init(struct byte_cntr *byte_cntr_data)
+{
+	byte_cntr_data->usb_wq = create_singlethread_workqueue("byte-cntr");
+	if (!byte_cntr_data->usb_wq)
+		return -ENOMEM;
+
+	byte_cntr_data->offset = 0;
+	mutex_init(&byte_cntr_data->usb_bypass_lock);
+	init_waitqueue_head(&byte_cntr_data->usb_wait_wq);
+	atomic_set(&byte_cntr_data->usb_free_buf, USB_BUF_NUM);
+	INIT_WORK(&(byte_cntr_data->read_work), usb_read_work_fn);
+
+	return 0;
+}
+
+void usb_notifier(void *priv, unsigned int event, struct qdss_request *d_req,
+		  struct usb_qdss_ch *ch)
+{
+	struct tmc_drvdata *drvdata = priv;
+	int ret = 0;
+
+	if (!drvdata)
+		return;
+
+	if (drvdata->out_mode != TMC_ETR_OUT_MODE_USB) {
+		dev_err(&drvdata->csdev->dev,
+		"%s: ETR is not USB mode.\n", __func__);
+		return;
+	}
+
+	switch (event) {
+	case USB_QDSS_CONNECT:
+		if (drvdata->mode == CS_MODE_DISABLED) {
+			dev_err_ratelimited(&drvdata->csdev->dev,
+				"%s: ETR is disabled.\n", __func__);
+			return;
+		}
+
+		if (drvdata->usb_data->usb_mode == TMC_ETR_USB_SW) {
+			ret = usb_bypass_start(drvdata->byte_cntr);
+			if (ret < 0)
+				return;
+
+			usb_qdss_alloc_req(ch, USB_BUF_NUM);
+			queue_work(drvdata->byte_cntr->usb_wq, &(drvdata->byte_cntr->read_work));
+		}
+		break;
+
+	case USB_QDSS_DISCONNECT:
+		if (drvdata->mode == CS_MODE_DISABLED) {
+			dev_err_ratelimited(&drvdata->csdev->dev,
+				 "%s: ETR is disabled.\n", __func__);
+			return;
+		}
+
+		if (drvdata->usb_data->usb_mode == TMC_ETR_USB_SW) {
+			usb_bypass_stop(drvdata->byte_cntr);
+			flush_work(&((drvdata->byte_cntr->read_work)));
+			usb_qdss_free_req(drvdata->usb_data->usbch);
+		}
+		break;
+
+	case USB_QDSS_DATA_WRITE_DONE:
+		if (drvdata->usb_data->usb_mode == TMC_ETR_USB_SW)
+			usb_write_done(drvdata->byte_cntr, d_req);
+		break;
+
+	default:
+		break;
+	}
+
+}
+
+static bool tmc_etr_support_usb_bypass(struct device *dev)
+{
+	return fwnode_property_present(dev->fwnode, "qcom,sw-usb");
+}
+
+int tmc_usb_enable(struct tmc_usb_data *usb_data)
+{
+	struct tmc_drvdata *tmcdrvdata;
+
+	if (!usb_data)
+		return -EINVAL;
+
+	tmcdrvdata = usb_data->tmcdrvdata;
+	if (usb_data->usb_mode == TMC_ETR_USB_SW)
+		usb_data->usbch = usb_qdss_open(USB_QDSS_CH_SW, tmcdrvdata, usb_notifier);
+
+	if (IS_ERR_OR_NULL(usb_data->usbch)) {
+		dev_err(&tmcdrvdata->csdev->dev, "usb_qdss_open failed for qdss.\n");
+		return -ENODEV;
+	}
+	return 0;
+}
+
+void tmc_usb_disable(struct tmc_usb_data *usb_data)
+{
+	struct tmc_drvdata *tmcdrvdata = usb_data->tmcdrvdata;
+
+	if (usb_data->usb_mode == TMC_ETR_USB_SW)
+		usb_bypass_stop(tmcdrvdata->byte_cntr);
+
+	if (usb_data->usbch)
+		usb_qdss_close(usb_data->usbch);
+	else
+		dev_err(&tmcdrvdata->csdev->dev, "usb channel is null.\n");
+}
+
+int tmc_etr_usb_init(struct amba_device *adev,
+		     struct tmc_drvdata *drvdata)
+{
+	struct device *dev = &adev->dev;
+	struct tmc_usb_data *usb_data;
+	struct byte_cntr *byte_cntr_data;
+	int ret;
+
+	usb_data = devm_kzalloc(dev, sizeof(*usb_data), GFP_KERNEL);
+	if (!usb_data)
+		return -ENOMEM;
+
+	drvdata->usb_data = usb_data;
+	drvdata->usb_data->tmcdrvdata = drvdata;
+	byte_cntr_data = drvdata->byte_cntr;
+
+	if (tmc_etr_support_usb_bypass(dev)) {
+		usb_data->usb_mode = TMC_ETR_USB_SW;
+
+		if (!byte_cntr_data)
+			return -EINVAL;
+
+		ret = usb_bypass_init(byte_cntr_data);
+		if (ret)
+			return -EINVAL;
+
+		return 0;
+	}
+
+	usb_data->usb_mode = TMC_ETR_USB_NONE;
+	pr_err("%s: ETR usb property is not configured!\n", dev_name(dev));
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tmc-usb.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tmc-usb.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CORESIGHT_TMC_USB_H
+#define _CORESIGHT_TMC_USB_H
+
+#include <linux/amba/bus.h>
+#include <linux/soc/qcom/usb_qdss.h>
+
+#define TMC_USB_BAM_PIPE_INDEX	0
+#define TMC_USB_BAM_NR_PIPES	2
+
+#define USB_QDSS_CH_SW	"qdss"
+
+enum tmc_etr_usb_mode {
+	TMC_ETR_USB_NONE,
+	TMC_ETR_USB_SW,
+};
+
+struct tmc_usb_data {
+	struct usb_qdss_ch	*usbch;
+	enum tmc_etr_usb_mode	usb_mode;
+	struct tmc_drvdata	*tmcdrvdata;
+};
+
+extern int tmc_usb_enable(struct tmc_usb_data *usb_data);
+extern void tmc_usb_disable(struct tmc_usb_data *usb_data);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tmc.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tmc.h
@@ -12,6 +12,9 @@
 #include <linux/miscdevice.h>
 #include <linux/mutex.h>
 #include <linux/refcount.h>
+#include "coresight-byte-cntr.h"
+#include "coresight-tmc-usb.h"
+#include "coresight-trace-id.h"
 
 #define TMC_RSZ			0x004
 #define TMC_STS			0x00c
@@ -135,11 +138,22 @@
 	ETR_MODE_FLAT,		/* Uses contiguous flat buffer */
 	ETR_MODE_ETR_SG,	/* Uses in-built TMC ETR SG mechanism */
 	ETR_MODE_CATU,		/* Use SG mechanism in CATU */
-	ETR_MODE_AUTO,		/* Use the default mechanism */
 };
 
 struct etr_buf_operations;
 
+enum tmc_etr_out_mode {
+	TMC_ETR_OUT_MODE_NONE,
+	TMC_ETR_OUT_MODE_MEM,
+	TMC_ETR_OUT_MODE_USB,
+};
+
+static const char * const str_tmc_etr_out_mode[] = {
+	[TMC_ETR_OUT_MODE_NONE]		= "none",
+	[TMC_ETR_OUT_MODE_MEM]		= "mem",
+	[TMC_ETR_OUT_MODE_USB]		= "usb",
+};
+
 /**
  * struct etr_buf - Details of the buffer used by ETR
  * refcount	; Number of sources currently using this etr_buf.
@@ -206,13 +220,19 @@
 	u32			mode;
 	enum tmc_config_type	config_type;
 	enum tmc_mem_intf_width	memwidth;
+	struct mutex		mem_lock;
 	u32			trigger_cntr;
 	u32			etr_caps;
-	enum etr_mode		etr_mode;
 	struct idr		idr;
 	struct mutex		idr_mutex;
 	struct etr_buf		*sysfs_buf;
+	struct byte_cntr	*byte_cntr;
+	struct coresight_csr	*csr;
+	const char		*csr_name;
 	struct etr_buf		*perf_buf;
+	enum tmc_etr_out_mode	out_mode;
+	struct tmc_usb_data	*usb_data;
+	u8			atid_refcnt[CORESIGHT_TRACE_ID_RES_TOP];
 };
 
 struct etr_buf_operations {
@@ -261,6 +281,8 @@
 void tmc_flush_and_stop(struct tmc_drvdata *drvdata);
 void tmc_enable_hw(struct tmc_drvdata *drvdata);
 void tmc_disable_hw(struct tmc_drvdata *drvdata);
+extern int tmc_etr_usb_init(struct amba_device *adev,
+		struct tmc_drvdata *drvdata);
 u32 tmc_get_memwidth_mask(struct tmc_drvdata *drvdata);
 
 /* ETB/ETF functions */
@@ -271,13 +293,20 @@
 
 ssize_t tmc_etb_get_sysfs_trace(struct tmc_drvdata *drvdata,
 				loff_t pos, size_t len, char **bufpp);
+ssize_t tmc_etr_buf_get_data(struct etr_buf *etr_buf,
+				u64 offset, size_t len, char **bufpp);
 /* ETR functions */
 int tmc_read_prepare_etr(struct tmc_drvdata *drvdata);
 int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata);
 void tmc_etr_disable_hw(struct tmc_drvdata *drvdata);
+struct byte_cntr *byte_cntr_init(struct amba_device *adev,
+					struct tmc_drvdata *drvdata);
+void byte_cntr_remove(struct byte_cntr *byte_cntr);
 extern const struct coresight_ops tmc_etr_cs_ops;
 ssize_t tmc_etr_get_sysfs_trace(struct tmc_drvdata *drvdata,
 				loff_t pos, size_t len, char **bufpp);
+long tmc_get_rwp_offset(struct tmc_drvdata *drvdata);
+int tmc_etr_switch_mode(struct tmc_drvdata *drvdata, const char *out_mode);
 
 
 #define TMC_REG_PAIR(name, lo_off, hi_off)				\
@@ -336,6 +365,5 @@
 void tmc_etr_remove_catu_ops(void);
 struct etr_buf *tmc_etr_get_buffer(struct coresight_device *csdev,
 				   enum cs_mode mode, void *data);
-extern const struct attribute_group coresight_etr_group;
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tpda.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tpda.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/amba/bus.h>
@@ -18,6 +18,7 @@
 #include "coresight-priv.h"
 #include "coresight-tpda.h"
 #include "coresight-trace-id.h"
+#include "coresight-tpdm.h"
 
 DEFINE_CORESIGHT_DEVLIST(tpda_devs, "tpda");
 
@@ -28,24 +29,59 @@
 			CORESIGHT_DEV_SUBTYPE_SOURCE_TPDM);
 }
 
+static void tpda_clear_element_size(struct coresight_device *csdev)
+{
+	struct tpda_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+	drvdata->dsb_esize = 0;
+	drvdata->cmb_esize = 0;
+}
+
+static void tpda_set_element_size(struct tpda_drvdata *drvdata, u32 *val)
+{
+	/* Clear all relevant fields */
+	*val &= ~(TPDA_Pn_CR_DSBSIZE | TPDA_Pn_CR_CMBSIZE);
+
+	if (drvdata->dsb_esize == 64)
+		*val |= TPDA_Pn_CR_DSBSIZE;
+	else if (drvdata->dsb_esize == 32)
+		*val &= ~TPDA_Pn_CR_DSBSIZE;
+
+	if (drvdata->cmb_esize == 64)
+		*val |= FIELD_PREP(TPDA_Pn_CR_CMBSIZE, 0x2);
+	else if (drvdata->cmb_esize == 32)
+		*val |= FIELD_PREP(TPDA_Pn_CR_CMBSIZE, 0x1);
+	else if (drvdata->cmb_esize == 8)
+		*val &= ~TPDA_Pn_CR_CMBSIZE;
+}
+
 /*
- * Read the DSB element size from the TPDM device
+ * Read the element size from the TPDM device. One TPDM must have at least one of the
+ * element size property.
  * Returns
- *    The dsb element size read from the devicetree if available.
- *    0 - Otherwise, with a warning once.
+ *    0 - The element size property is read
+ *    Others - Cannot read the property of the element size
  */
-static int tpdm_read_dsb_element_size(struct coresight_device *csdev)
+static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
+				  struct coresight_device *csdev)
 {
-	int rc = 0;
-	u8 size = 0;
+	int rc = -EINVAL;
+	struct tpdm_drvdata *tpdm_data = dev_get_drvdata(csdev->dev.parent);
+
+	if (tpdm_has_dsb_dataset(tpdm_data)) {
+		rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
+				"qcom,dsb-element-bits", &drvdata->dsb_esize);
+	}
+	if (tpdm_has_cmb_dataset(tpdm_data)) {
+		rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
+				"qcom,cmb-element-bits", &drvdata->cmb_esize);
+	}
 
-	rc = fwnode_property_read_u8(dev_fwnode(csdev->dev.parent),
-			"qcom,dsb-element-size", &size);
 	if (rc)
 		dev_warn_once(&csdev->dev,
-			"Failed to read TPDM DSB Element size: %d\n", rc);
+			"Failed to read TPDM Element size: %d\n", rc);
 
-	return size;
+	return rc;
 }
 
 /*
@@ -56,11 +92,12 @@
  * Parameter "inport" is used to pass in the input port number
  * of TPDA, and it is set to -1 in the recursize call.
  */
-static int tpda_get_element_size(struct coresight_device *csdev,
+static int tpda_get_element_size(struct tpda_drvdata *drvdata,
+				 struct coresight_device *csdev,
 				 int inport)
 {
-	int dsb_size = -ENOENT;
-	int i, size;
+	int rc = 0;
+	int i;
 	struct coresight_device *in;
 
 	for (i = 0; i < csdev->pdata->nr_inconns; i++) {
@@ -69,30 +106,26 @@
 			continue;
 
 		/* Ignore the paths that do not match port */
-		if (inport > 0 &&
+		if (inport >= 0 &&
 		    csdev->pdata->in_conns[i]->dest_port != inport)
 			continue;
 
 		if (coresight_device_is_tpdm(in)) {
-			size = tpdm_read_dsb_element_size(in);
+			if (drvdata->dsb_esize || drvdata->cmb_esize)
+				return -EEXIST;
+			rc = tpdm_read_element_size(drvdata, in);
+			if (rc)
+				return rc;
 		} else {
 			/* Recurse down the path */
-			size = tpda_get_element_size(in, -1);
-		}
-
-		if (size < 0)
-			return size;
-
-		if (dsb_size < 0) {
-			/* Found a size, save it. */
-			dsb_size = size;
-		} else {
-			/* Found duplicate TPDMs */
-			return -EEXIST;
+			rc = tpda_get_element_size(drvdata, in, -1);
+			if (rc)
+				return rc;
 		}
 	}
 
-	return dsb_size;
+
+	return rc;
 }
 
 /* Settings pre enabling port control register */
@@ -109,37 +142,24 @@
 static int tpda_enable_port(struct tpda_drvdata *drvdata, int port)
 {
 	u32 val;
-	int size;
+	int rc;
 
 	val = readl_relaxed(drvdata->base + TPDA_Pn_CR(port));
-	/*
-	 * Configure aggregator port n DSB data set element size
-	 * Set the bit to 0 if the size is 32
-	 * Set the bit to 1 if the size is 64
-	 */
-	size = tpda_get_element_size(drvdata->csdev, port);
-	switch (size) {
-	case 32:
-		val &= ~TPDA_Pn_CR_DSBSIZE;
-		break;
-	case 64:
-		val |= TPDA_Pn_CR_DSBSIZE;
-		break;
-	case 0:
-		return -EEXIST;
-	case -EEXIST:
+	tpda_clear_element_size(drvdata->csdev);
+	rc = tpda_get_element_size(drvdata, drvdata->csdev, port);
+	if (!rc && (drvdata->dsb_esize || drvdata->cmb_esize)) {
+		tpda_set_element_size(drvdata, &val);
+		/* Enable the port */
+		val |= TPDA_Pn_CR_ENA;
+		writel_relaxed(val, drvdata->base + TPDA_Pn_CR(port));
+	} else if (rc == -EEXIST)
 		dev_warn_once(&drvdata->csdev->dev,
-			"Detected multiple TPDMs on port %d", -EEXIST);
-		return -EEXIST;
-	default:
-		return -EINVAL;
-	}
-
-	/* Enable the port */
-	val |= TPDA_Pn_CR_ENA;
-	writel_relaxed(val, drvdata->base + TPDA_Pn_CR(port));
+			      "Detected multiple TPDMs on port %d", port);
+	else
+		dev_warn_once(&drvdata->csdev->dev,
+			      "Didn't find TPDM element size");
 
-	return 0;
+	return rc;
 }
 
 static int __tpda_enable(struct tpda_drvdata *drvdata, int port)
@@ -224,7 +244,7 @@
 	 * same trace-id. When TPDA does packetization, different
 	 * port will have unique channel number for decoding.
 	 */
-	atid = coresight_trace_id_get_system_id();
+	atid = coresight_trace_id_get_system_id(TRACE_ID_ANY);
 	if (atid < 0)
 		return atid;
 
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tpda.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tpda.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef _CORESIGHT_CORESIGHT_TPDA_H
@@ -10,6 +10,8 @@
 #define TPDA_Pn_CR(n)		(0x004 + (n * 4))
 /* Aggregator port enable bit */
 #define TPDA_Pn_CR_ENA		BIT(0)
+/* Aggregator port CMB data set element size bit */
+#define TPDA_Pn_CR_CMBSIZE		GENMASK(7, 6)
 /* Aggregator port DSB data set element size bit */
 #define TPDA_Pn_CR_DSBSIZE		BIT(8)
 
@@ -25,6 +27,8 @@
  * @csdev:      component vitals needed by the framework.
  * @spinlock:   lock for the drvdata value.
  * @enable:     enable status of the component.
+ * @dsb_esize   Record the DSB element size.
+ * @cmb_esize   Record the CMB element size.
  */
 struct tpda_drvdata {
 	void __iomem		*base;
@@ -32,6 +36,8 @@
 	struct coresight_device	*csdev;
 	spinlock_t		spinlock;
 	u8			atid;
+	u32			dsb_esize;
+	u32			cmb_esize;
 };
 
 #endif  /* _CORESIGHT_CORESIGHT_TPDA_H */
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tpdm.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tpdm.c
@@ -18,9 +18,15 @@
 
 #include "coresight-priv.h"
 #include "coresight-tpdm.h"
+#include "coresight-common.h"
+#include "coresight-tpda.h"
+
+#define TPDA_KEY	"tpda"
 
 DEFINE_CORESIGHT_DEVLIST(tpdm_devs, "tpdm");
 
+static int coresight_get_aggre_atid(struct coresight_device *csdev);
+
 /* Read dataset array member with the index number */
 static ssize_t tpdm_simple_dataset_show(struct device *dev,
 					struct device_attribute *attr,
@@ -66,6 +72,31 @@
 			return -EINVAL;
 		return sysfs_emit(buf, "0x%x\n",
 				drvdata->dsb->msr[tpdm_attr->idx]);
+	case CMB_TRIG_PATT:
+		if (tpdm_attr->idx >= TPDM_CMB_MAX_PATT)
+			return -EINVAL;
+		return sysfs_emit(buf, "0x%x\n",
+			drvdata->cmb->trig_patt[tpdm_attr->idx]);
+	case CMB_TRIG_PATT_MASK:
+		if (tpdm_attr->idx >= TPDM_CMB_MAX_PATT)
+			return -EINVAL;
+		return sysfs_emit(buf, "0x%x\n",
+			drvdata->cmb->trig_patt_mask[tpdm_attr->idx]);
+	case CMB_PATT:
+		if (tpdm_attr->idx >= TPDM_CMB_MAX_PATT)
+			return -EINVAL;
+		return sysfs_emit(buf, "0x%x\n",
+			drvdata->cmb->patt_val[tpdm_attr->idx]);
+	case CMB_PATT_MASK:
+		if (tpdm_attr->idx >= TPDM_CMB_MAX_PATT)
+			return -EINVAL;
+		return sysfs_emit(buf, "0x%x\n",
+			drvdata->cmb->patt_mask[tpdm_attr->idx]);
+	case CMB_MSR:
+		if (tpdm_attr->idx >= drvdata->cmb_msr_num)
+			return -EINVAL;
+		return sysfs_emit(buf, "0x%x\n",
+				drvdata->cmb->msr[tpdm_attr->idx]);
 	}
 	return -EINVAL;
 }
@@ -77,67 +108,103 @@
 					 size_t size)
 {
 	unsigned long val;
-	ssize_t ret = size;
+	ssize_t ret = -EINVAL;
 
 	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
 	struct tpdm_dataset_attribute *tpdm_attr =
 		container_of(attr, struct tpdm_dataset_attribute, attr);
 
 	if (kstrtoul(buf, 0, &val))
-		return -EINVAL;
+		return ret;
 
-	spin_lock(&drvdata->spinlock);
+	guard(spinlock)(&drvdata->spinlock);
 	switch (tpdm_attr->mem) {
 	case DSB_TRIG_PATT:
-		if (tpdm_attr->idx < TPDM_DSB_MAX_PATT)
+		if (tpdm_attr->idx < TPDM_DSB_MAX_PATT) {
 			drvdata->dsb->trig_patt[tpdm_attr->idx] = val;
-		else
-			ret = -EINVAL;
+			ret = size;
+		}
 		break;
 	case DSB_TRIG_PATT_MASK:
-		if (tpdm_attr->idx < TPDM_DSB_MAX_PATT)
+		if (tpdm_attr->idx < TPDM_DSB_MAX_PATT) {
 			drvdata->dsb->trig_patt_mask[tpdm_attr->idx] = val;
-		else
-			ret = -EINVAL;
+			ret = size;
+		}
 		break;
 	case DSB_PATT:
-		if (tpdm_attr->idx < TPDM_DSB_MAX_PATT)
+		if (tpdm_attr->idx < TPDM_DSB_MAX_PATT) {
 			drvdata->dsb->patt_val[tpdm_attr->idx] = val;
-		else
-			ret = -EINVAL;
+			ret = size;
+		}
 		break;
 	case DSB_PATT_MASK:
-		if (tpdm_attr->idx < TPDM_DSB_MAX_PATT)
+		if (tpdm_attr->idx < TPDM_DSB_MAX_PATT) {
 			drvdata->dsb->patt_mask[tpdm_attr->idx] = val;
-		else
-			ret = -EINVAL;
+			ret = size;
+		}
 		break;
 	case DSB_MSR:
-		if (tpdm_attr->idx < drvdata->dsb_msr_num)
+		if (tpdm_attr->idx < drvdata->dsb_msr_num) {
 			drvdata->dsb->msr[tpdm_attr->idx] = val;
-		else
-			ret = -EINVAL;
+			ret = size;
+		}
+		break;
+	case CMB_TRIG_PATT:
+		if (tpdm_attr->idx < TPDM_CMB_MAX_PATT) {
+			drvdata->cmb->trig_patt[tpdm_attr->idx] = val;
+			ret = size;
+		}
+		break;
+	case CMB_TRIG_PATT_MASK:
+		if (tpdm_attr->idx < TPDM_CMB_MAX_PATT) {
+			drvdata->cmb->trig_patt_mask[tpdm_attr->idx] = val;
+			ret = size;
+		}
+		break;
+	case CMB_PATT:
+		if (tpdm_attr->idx < TPDM_CMB_MAX_PATT) {
+			drvdata->cmb->patt_val[tpdm_attr->idx] = val;
+			ret = size;
+		}
+		break;
+	case CMB_PATT_MASK:
+		if (tpdm_attr->idx < TPDM_CMB_MAX_PATT) {
+			drvdata->cmb->patt_mask[tpdm_attr->idx] = val;
+			ret = size;
+		}
+		break;
+	case CMB_MSR:
+		if (tpdm_attr->idx < drvdata->cmb_msr_num) {
+			drvdata->cmb->msr[tpdm_attr->idx] = val;
+			ret = size;
+		}
 		break;
 	default:
-		ret = -EINVAL;
+		break;
 	}
-	spin_unlock(&drvdata->spinlock);
 
 	return ret;
 }
 
-static bool tpdm_has_dsb_dataset(struct tpdm_drvdata *drvdata)
+static umode_t tpdm_dsb_is_visible(struct kobject *kobj,
+				   struct attribute *attr, int n)
 {
-	return (drvdata->datasets & TPDM_PIDR0_DS_DSB);
+	struct device *dev = kobj_to_dev(kobj);
+	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	if (drvdata && tpdm_has_dsb_dataset(drvdata))
+		return attr->mode;
+
+	return 0;
 }
 
-static umode_t tpdm_dsb_is_visible(struct kobject *kobj,
+static umode_t tpdm_cmb_is_visible(struct kobject *kobj,
 				   struct attribute *attr, int n)
 {
 	struct device *dev = kobj_to_dev(kobj);
 	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
 
-	if (drvdata && tpdm_has_dsb_dataset(drvdata))
+	if (drvdata && tpdm_has_cmb_dataset(drvdata))
 		return attr->mode;
 
 	return 0;
@@ -159,6 +226,23 @@
 	return 0;
 }
 
+static umode_t tpdm_cmb_msr_is_visible(struct kobject *kobj,
+				       struct attribute *attr, int n)
+{
+	struct device *dev = kobj_to_dev(kobj);
+	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	struct device_attribute *dev_attr =
+		container_of(attr, struct device_attribute, attr);
+	struct tpdm_dataset_attribute *tpdm_attr =
+		container_of(dev_attr, struct tpdm_dataset_attribute, attr);
+
+	if (tpdm_attr->idx < drvdata->cmb_msr_num)
+		return attr->mode;
+
+	return 0;
+}
+
 static void tpdm_reset_datasets(struct tpdm_drvdata *drvdata)
 {
 	if (tpdm_has_dsb_dataset(drvdata)) {
@@ -167,6 +251,9 @@
 		drvdata->dsb->trig_ts = true;
 		drvdata->dsb->trig_type = false;
 	}
+
+	if (drvdata->cmb)
+		memset(drvdata->cmb, 0, sizeof(struct cmb_dataset));
 }
 
 static void set_dsb_mode(struct tpdm_drvdata *drvdata, u32 *val)
@@ -233,25 +320,27 @@
 {
 	u32 val, i;
 
+	if (!tpdm_has_dsb_dataset(drvdata))
+		return;
+
 	for (i = 0; i < TPDM_DSB_MAX_EDCR; i++)
 		writel_relaxed(drvdata->dsb->edge_ctrl[i],
-			   drvdata->base + TPDM_DSB_EDCR(i));
+			       drvdata->base + TPDM_DSB_EDCR(i));
 	for (i = 0; i < TPDM_DSB_MAX_EDCMR; i++)
 		writel_relaxed(drvdata->dsb->edge_ctrl_mask[i],
-			   drvdata->base + TPDM_DSB_EDCMR(i));
+			       drvdata->base + TPDM_DSB_EDCMR(i));
 	for (i = 0; i < TPDM_DSB_MAX_PATT; i++) {
 		writel_relaxed(drvdata->dsb->patt_val[i],
-			   drvdata->base + TPDM_DSB_TPR(i));
+			       drvdata->base + TPDM_DSB_TPR(i));
 		writel_relaxed(drvdata->dsb->patt_mask[i],
-			   drvdata->base + TPDM_DSB_TPMR(i));
+			       drvdata->base + TPDM_DSB_TPMR(i));
 		writel_relaxed(drvdata->dsb->trig_patt[i],
-			   drvdata->base + TPDM_DSB_XPR(i));
+			       drvdata->base + TPDM_DSB_XPR(i));
 		writel_relaxed(drvdata->dsb->trig_patt_mask[i],
-			   drvdata->base + TPDM_DSB_XPMR(i));
+			       drvdata->base + TPDM_DSB_XPMR(i));
 	}
 
 	set_dsb_tier(drvdata);
-
 	set_dsb_msr(drvdata);
 
 	val = readl_relaxed(drvdata->base + TPDM_DSB_CR);
@@ -267,6 +356,76 @@
 	writel_relaxed(val, drvdata->base + TPDM_DSB_CR);
 }
 
+static void set_cmb_tier(struct tpdm_drvdata *drvdata)
+{
+	u32 val;
+
+	val = readl_relaxed(drvdata->base + TPDM_CMB_TIER);
+
+	/* Clear all relevant fields */
+	val &= ~(TPDM_CMB_TIER_PATT_TSENAB | TPDM_CMB_TIER_TS_ALL |
+		 TPDM_CMB_TIER_XTRIG_TSENAB);
+
+	/* Set pattern timestamp type and enablement */
+	if (drvdata->cmb->patt_ts)
+		val |= TPDM_CMB_TIER_PATT_TSENAB;
+
+	/* Set trigger timestamp */
+	if (drvdata->cmb->trig_ts)
+		val |= TPDM_CMB_TIER_XTRIG_TSENAB;
+
+	/* Set all timestamp enablement*/
+	if (drvdata->cmb->ts_all)
+		val |= TPDM_CMB_TIER_TS_ALL;
+
+	writel_relaxed(val, drvdata->base + TPDM_CMB_TIER);
+}
+
+static void set_cmb_msr(struct tpdm_drvdata *drvdata)
+{
+	int i;
+
+	for (i = 0; i < drvdata->cmb_msr_num; i++)
+		writel_relaxed(drvdata->cmb->msr[i],
+			   drvdata->base + TPDM_CMB_MSR(i));
+}
+
+static void tpdm_enable_cmb(struct tpdm_drvdata *drvdata)
+{
+	u32 val, i;
+
+	if (!tpdm_has_cmb_dataset(drvdata))
+		return;
+
+	/* Configure pattern registers */
+	for (i = 0; i < TPDM_CMB_MAX_PATT; i++) {
+		writel_relaxed(drvdata->cmb->patt_val[i],
+			drvdata->base + TPDM_CMB_TPR(i));
+		writel_relaxed(drvdata->cmb->patt_mask[i],
+			drvdata->base + TPDM_CMB_TPMR(i));
+		writel_relaxed(drvdata->cmb->trig_patt[i],
+			drvdata->base + TPDM_CMB_XPR(i));
+		writel_relaxed(drvdata->cmb->trig_patt_mask[i],
+			drvdata->base + TPDM_CMB_XPMR(i));
+	}
+
+	set_cmb_tier(drvdata);
+	set_cmb_msr(drvdata);
+
+	val = readl_relaxed(drvdata->base + TPDM_CMB_CR);
+	/*
+	 * Set to 0 for continuous CMB collection mode,
+	 * 1 for trace-on-change CMB collection mode.
+	 */
+	if (drvdata->cmb->trace_mode)
+		val |= TPDM_CMB_CR_MODE;
+	else
+		val &= ~TPDM_CMB_CR_MODE;
+	/* Set the enable bit of CMB control register to 1 */
+	val |= TPDM_CMB_CR_ENA;
+	writel_relaxed(val, drvdata->base + TPDM_CMB_CR);
+}
+
 /*
  * TPDM enable operations
  * The TPDM or Monitor serves as data collection component for various
@@ -279,8 +438,8 @@
 {
 	CS_UNLOCK(drvdata->base);
 
-	if (tpdm_has_dsb_dataset(drvdata))
-		tpdm_enable_dsb(drvdata);
+	tpdm_enable_dsb(drvdata);
+	tpdm_enable_cmb(drvdata);
 
 	CS_LOCK(drvdata->base);
 }
@@ -289,6 +448,7 @@
 		       enum cs_mode mode)
 {
 	struct tpdm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+	int ret = -EINVAL;
 
 	spin_lock(&drvdata->spinlock);
 	if (drvdata->enable) {
@@ -296,6 +456,19 @@
 		return -EBUSY;
 	}
 
+	if (!coresight_take_mode(csdev, mode)) {
+		spin_unlock(&drvdata->spinlock);
+		return -EBUSY;
+	}
+
+	ret = coresight_get_aggre_atid(csdev);
+	if (ret < 0) {
+		spin_unlock(&drvdata->spinlock);
+		return ret;
+	}
+	drvdata->traceid = ret;
+	coresight_csr_set_etr_atid(csdev, drvdata->traceid, true);
+
 	__tpdm_enable(drvdata);
 	drvdata->enable = true;
 	spin_unlock(&drvdata->spinlock);
@@ -308,19 +481,35 @@
 {
 	u32 val;
 
+	if (!tpdm_has_dsb_dataset(drvdata))
+		return;
+
 	/* Set the enable bit of DSB control register to 0 */
 	val = readl_relaxed(drvdata->base + TPDM_DSB_CR);
 	val &= ~TPDM_DSB_CR_ENA;
 	writel_relaxed(val, drvdata->base + TPDM_DSB_CR);
 }
 
+static void tpdm_disable_cmb(struct tpdm_drvdata *drvdata)
+{
+	u32 val;
+
+	if (!tpdm_has_cmb_dataset(drvdata))
+		return;
+
+	val = readl_relaxed(drvdata->base + TPDM_CMB_CR);
+	/* Set the enable bit of CMB control register to 0 */
+	val &= ~TPDM_CMB_CR_ENA;
+	writel_relaxed(val, drvdata->base + TPDM_CMB_CR);
+}
+
 /* TPDM disable operations */
 static void __tpdm_disable(struct tpdm_drvdata *drvdata)
 {
 	CS_UNLOCK(drvdata->base);
 
-	if (tpdm_has_dsb_dataset(drvdata))
-		tpdm_disable_dsb(drvdata);
+	tpdm_disable_dsb(drvdata);
+	tpdm_disable_cmb(drvdata);
 
 	CS_LOCK(drvdata->base);
 }
@@ -337,7 +526,10 @@
 	}
 
 	__tpdm_disable(drvdata);
+	coresight_set_mode(csdev, CS_MODE_DISABLED);
 	drvdata->enable = false;
+	coresight_csr_set_etr_atid(csdev, drvdata->traceid, false);
+	drvdata->traceid = 0;
 	spin_unlock(&drvdata->spinlock);
 
 	dev_dbg(drvdata->dev, "TPDM tracing disabled\n");
@@ -366,6 +558,12 @@
 		if (!drvdata->dsb)
 			return -ENOMEM;
 	}
+	if (tpdm_has_cmb_dataset(drvdata) && (!drvdata->cmb)) {
+		drvdata->cmb = devm_kzalloc(drvdata->dev,
+						sizeof(*drvdata->cmb), GFP_KERNEL);
+		if (!drvdata->cmb)
+			return -ENOMEM;
+	}
 	tpdm_reset_datasets(drvdata);
 
 	return 0;
@@ -431,9 +629,56 @@
 }
 static DEVICE_ATTR_WO(integration_test);
 
+static bool coresight_is_tpda_device(struct coresight_device *csdev)
+{
+	if (strnstr(dev_name(&csdev->dev), TPDA_KEY, strlen(dev_name(&csdev->dev))))
+		return true;
+
+	return false;
+}
+
+static int coresight_get_aggre_atid(struct coresight_device *csdev)
+{
+	int i, atid;
+	struct tpda_drvdata *tpda_drvdata;
+
+	if (coresight_is_tpda_device(csdev)) {
+		tpda_drvdata = dev_get_drvdata(csdev->dev.parent);
+		return tpda_drvdata->atid;
+	}
+
+	/*
+	 * Recursively explore each port found on this element.
+	 */
+	for (i = 0; i < csdev->pdata->nr_outconns; i++) {
+		struct coresight_device *child_dev;
+
+		child_dev = csdev->pdata->out_conns[i]->dest_dev;
+		if (child_dev)
+			atid = coresight_get_aggre_atid(child_dev);
+		if (atid > 0)
+			return atid;
+	}
+
+	return -EINVAL;
+}
+
+static ssize_t traceid_show(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	unsigned long atid;
+	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	atid = drvdata->traceid;
+
+	return scnprintf(buf, PAGE_SIZE, "%#lx\n", atid);
+}
+static DEVICE_ATTR_RO(traceid);
+
 static struct attribute *tpdm_attrs[] = {
 	&dev_attr_reset_dataset.attr,
 	&dev_attr_integration_test.attr,
+	&dev_attr_traceid.attr,
 	NULL,
 };
 
@@ -577,9 +822,18 @@
 			      char *buf)
 {
 	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct tpdm_dataset_attribute *tpdm_attr =
+		container_of(attr, struct tpdm_dataset_attribute, attr);
+	ssize_t size = -EINVAL;
 
-	return sysfs_emit(buf, "%u\n",
-			 (unsigned int)drvdata->dsb->patt_ts);
+	if (tpdm_attr->mem == DSB_PATT)
+		size = sysfs_emit(buf, "%u\n",
+				  (unsigned int)drvdata->dsb->patt_ts);
+	else if (tpdm_attr->mem == CMB_PATT)
+		size = sysfs_emit(buf, "%u\n",
+				  (unsigned int)drvdata->cmb->patt_ts);
+
+	return size;
 }
 
 /*
@@ -591,17 +845,23 @@
 			       size_t size)
 {
 	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	struct tpdm_dataset_attribute *tpdm_attr =
+		container_of(attr, struct tpdm_dataset_attribute, attr);
 	unsigned long val;
 
 	if ((kstrtoul(buf, 0, &val)) || (val & ~1UL))
 		return -EINVAL;
 
-	spin_lock(&drvdata->spinlock);
-	drvdata->dsb->patt_ts = !!val;
-	spin_unlock(&drvdata->spinlock);
+	guard(spinlock)(&drvdata->spinlock);
+	if (tpdm_attr->mem == DSB_PATT)
+		drvdata->dsb->patt_ts = !!val;
+	else if (tpdm_attr->mem == CMB_PATT)
+		drvdata->cmb->patt_ts = !!val;
+	else
+		return -EINVAL;
+
 	return size;
 }
-static DEVICE_ATTR_RW(enable_ts);
 
 static ssize_t set_type_show(struct device *dev,
 			     struct device_attribute *attr,
@@ -704,6 +964,96 @@
 }
 static DEVICE_ATTR_RW(dsb_trig_ts);
 
+static ssize_t cmb_mode_show(struct device *dev,
+			     struct device_attribute *attr,
+			     char *buf)
+{
+	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	return sysfs_emit(buf, "%x\n", drvdata->cmb->trace_mode);
+
+}
+
+static ssize_t cmb_mode_store(struct device *dev,
+			      struct device_attribute *attr,
+			      const char *buf,
+			      size_t size)
+{
+	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long trace_mode;
+
+	if (kstrtoul(buf, 0, &trace_mode) || (trace_mode & ~1UL))
+		return -EINVAL;
+
+	spin_lock(&drvdata->spinlock);
+	drvdata->cmb->trace_mode = trace_mode;
+	spin_unlock(&drvdata->spinlock);
+	return size;
+}
+static DEVICE_ATTR_RW(cmb_mode);
+
+static ssize_t cmb_ts_all_show(struct device *dev,
+			       struct device_attribute *attr,
+			       char *buf)
+{
+	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	return sysfs_emit(buf, "%u\n",
+			  (unsigned int)drvdata->cmb->ts_all);
+}
+
+static ssize_t cmb_ts_all_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf,
+				size_t size)
+{
+	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long val;
+
+	if ((kstrtoul(buf, 0, &val)) || (val & ~1UL))
+		return -EINVAL;
+
+	guard(spinlock)(&drvdata->spinlock);
+	if (val)
+		drvdata->cmb->ts_all = true;
+	else
+		drvdata->cmb->ts_all = false;
+
+	return size;
+}
+static DEVICE_ATTR_RW(cmb_ts_all);
+
+static ssize_t cmb_trig_ts_show(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+	return sysfs_emit(buf, "%u\n",
+			  (unsigned int)drvdata->cmb->trig_ts);
+}
+
+static ssize_t cmb_trig_ts_store(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf,
+				 size_t size)
+{
+	struct tpdm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+	unsigned long val;
+
+	if ((kstrtoul(buf, 0, &val)) || (val & ~1UL))
+		return -EINVAL;
+
+	guard(spinlock)(&drvdata->spinlock);
+	if (val)
+		drvdata->cmb->trig_ts = true;
+	else
+		drvdata->cmb->trig_ts = false;
+
+	return size;
+}
+static DEVICE_ATTR_RW(cmb_trig_ts);
+
 static struct attribute *tpdm_dsb_edge_attrs[] = {
 	&dev_attr_ctrl_idx.attr,
 	&dev_attr_ctrl_val.attr,
@@ -772,7 +1122,7 @@
 	DSB_PATT_MASK_ATTR(5),
 	DSB_PATT_MASK_ATTR(6),
 	DSB_PATT_MASK_ATTR(7),
-	&dev_attr_enable_ts.attr,
+	DSB_PATT_ENABLE_TS,
 	&dev_attr_set_type.attr,
 	NULL,
 };
@@ -813,6 +1163,59 @@
 	NULL,
 };
 
+static struct attribute *tpdm_cmb_trig_patt_attrs[] = {
+	CMB_TRIG_PATT_ATTR(0),
+	CMB_TRIG_PATT_ATTR(1),
+	CMB_TRIG_PATT_MASK_ATTR(0),
+	CMB_TRIG_PATT_MASK_ATTR(1),
+	NULL,
+};
+
+static struct attribute *tpdm_cmb_patt_attrs[] = {
+	CMB_PATT_ATTR(0),
+	CMB_PATT_ATTR(1),
+	CMB_PATT_MASK_ATTR(0),
+	CMB_PATT_MASK_ATTR(1),
+	CMB_PATT_ENABLE_TS,
+	NULL,
+};
+
+static struct attribute *tpdm_cmb_msr_attrs[] = {
+	CMB_MSR_ATTR(0),
+	CMB_MSR_ATTR(1),
+	CMB_MSR_ATTR(2),
+	CMB_MSR_ATTR(3),
+	CMB_MSR_ATTR(4),
+	CMB_MSR_ATTR(5),
+	CMB_MSR_ATTR(6),
+	CMB_MSR_ATTR(7),
+	CMB_MSR_ATTR(8),
+	CMB_MSR_ATTR(9),
+	CMB_MSR_ATTR(10),
+	CMB_MSR_ATTR(11),
+	CMB_MSR_ATTR(12),
+	CMB_MSR_ATTR(13),
+	CMB_MSR_ATTR(14),
+	CMB_MSR_ATTR(15),
+	CMB_MSR_ATTR(16),
+	CMB_MSR_ATTR(17),
+	CMB_MSR_ATTR(18),
+	CMB_MSR_ATTR(19),
+	CMB_MSR_ATTR(20),
+	CMB_MSR_ATTR(21),
+	CMB_MSR_ATTR(22),
+	CMB_MSR_ATTR(23),
+	CMB_MSR_ATTR(24),
+	CMB_MSR_ATTR(25),
+	CMB_MSR_ATTR(26),
+	CMB_MSR_ATTR(27),
+	CMB_MSR_ATTR(28),
+	CMB_MSR_ATTR(29),
+	CMB_MSR_ATTR(30),
+	CMB_MSR_ATTR(31),
+	NULL,
+};
+
 static struct attribute *tpdm_dsb_attrs[] = {
 	&dev_attr_dsb_mode.attr,
 	&dev_attr_dsb_trig_ts.attr,
@@ -820,6 +1223,13 @@
 	NULL,
 };
 
+static struct attribute *tpdm_cmb_attrs[] = {
+	&dev_attr_cmb_mode.attr,
+	&dev_attr_cmb_ts_all.attr,
+	&dev_attr_cmb_trig_ts.attr,
+	NULL,
+};
+
 static struct attribute_group tpdm_dsb_attr_grp = {
 	.attrs = tpdm_dsb_attrs,
 	.is_visible = tpdm_dsb_is_visible,
@@ -849,6 +1259,29 @@
 	.name = "dsb_msr",
 };
 
+static struct attribute_group tpdm_cmb_attr_grp = {
+	.attrs = tpdm_cmb_attrs,
+	.is_visible = tpdm_cmb_is_visible,
+};
+
+static struct attribute_group tpdm_cmb_trig_patt_grp = {
+	.attrs = tpdm_cmb_trig_patt_attrs,
+	.is_visible = tpdm_cmb_is_visible,
+	.name = "cmb_trig_patt",
+};
+
+static struct attribute_group tpdm_cmb_patt_grp = {
+	.attrs = tpdm_cmb_patt_attrs,
+	.is_visible = tpdm_cmb_is_visible,
+	.name = "cmb_patt",
+};
+
+static struct attribute_group tpdm_cmb_msr_grp = {
+	.attrs = tpdm_cmb_msr_attrs,
+	.is_visible = tpdm_cmb_msr_is_visible,
+	.name = "cmb_msr",
+};
+
 static const struct attribute_group *tpdm_attr_grps[] = {
 	&tpdm_attr_grp,
 	&tpdm_dsb_attr_grp,
@@ -856,6 +1289,10 @@
 	&tpdm_dsb_trig_patt_grp,
 	&tpdm_dsb_patt_grp,
 	&tpdm_dsb_msr_grp,
+	&tpdm_cmb_attr_grp,
+	&tpdm_cmb_trig_patt_grp,
+	&tpdm_cmb_patt_grp,
+	&tpdm_cmb_msr_grp,
 	NULL,
 };
 
@@ -894,6 +1331,10 @@
 		of_property_read_u32(drvdata->dev->of_node,
 			   "qcom,dsb-msrs-num", &drvdata->dsb_msr_num);
 
+	if (drvdata && tpdm_has_cmb_dataset(drvdata))
+		of_property_read_u32(drvdata->dev->of_node,
+			   "qcom,cmb-msrs-num", &drvdata->cmb_msr_num);
+
 	/* Set up coresight component description */
 	desc.name = coresight_alloc_device_name(&tpdm_devs, dev);
 	if (!desc.name)
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-tpdm.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-tpdm.h
@@ -9,6 +9,38 @@
 /* The max number of the datasets that TPDM supports */
 #define TPDM_DATASETS       7
 
+/* CMB Subunit Registers */
+#define TPDM_CMB_CR		(0xA00)
+/* CMB subunit timestamp insertion enable register */
+#define TPDM_CMB_TIER		(0xA04)
+/* CMB subunit timestamp pattern registers */
+#define TPDM_CMB_TPR(n)		(0xA08 + (n * 4))
+/* CMB subunit timestamp pattern mask registers */
+#define TPDM_CMB_TPMR(n)	(0xA10 + (n * 4))
+/* CMB subunit trigger pattern registers */
+#define TPDM_CMB_XPR(n)		(0xA18 + (n * 4))
+/* CMB subunit trigger pattern mask registers */
+#define TPDM_CMB_XPMR(n)	(0xA20 + (n * 4))
+/* CMB MSR register */
+#define TPDM_CMB_MSR(n)		(0xA80 + (n * 4))
+
+/* Enable bit for CMB subunit */
+#define TPDM_CMB_CR_ENA		BIT(0)
+/* Trace collection mode for CMB subunit */
+#define TPDM_CMB_CR_MODE	BIT(1)
+/* Timestamp control for pattern match */
+#define TPDM_CMB_TIER_PATT_TSENAB	BIT(0)
+/* CMB CTI timestamp request */
+#define TPDM_CMB_TIER_XTRIG_TSENAB	BIT(1)
+/* For timestamp fo all trace */
+#define TPDM_CMB_TIER_TS_ALL		BIT(2)
+
+/* Patten register number */
+#define TPDM_CMB_MAX_PATT		2
+
+/* MAX number of DSB MSR */
+#define TPDM_CMB_MAX_MSR 32
+
 /* DSB Subunit Registers */
 #define TPDM_DSB_CR		(0x780)
 #define TPDM_DSB_TIER		(0x784)
@@ -79,10 +111,12 @@
  *
  * PERIPHIDR0[0] : Fix to 1 if ImplDef subunit present, else 0
  * PERIPHIDR0[1] : Fix to 1 if DSB subunit present, else 0
+ * PERIPHIDR0[2] : Fix to 1 if CMB subunit present, else 0
  */
 
 #define TPDM_PIDR0_DS_IMPDEF	BIT(0)
 #define TPDM_PIDR0_DS_DSB	BIT(1)
+#define TPDM_PIDR0_DS_CMB	BIT(2)
 
 #define TPDM_DSB_MAX_LINES	256
 /* MAX number of EDCR registers */
@@ -113,6 +147,15 @@
 	   }								\
 	})[0].attr.attr)
 
+#define tpdm_patt_enable_ts(name, mem)				\
+	(&((struct tpdm_dataset_attribute[]) {			\
+	   {							\
+		__ATTR(name, 0644, enable_ts_show,		\
+		enable_ts_store),		\
+		mem,						\
+	   }							\
+	})[0].attr.attr)
+
 #define DSB_EDGE_CTRL_ATTR(nr)					\
 		tpdm_simple_dataset_ro(edcr##nr,		\
 		DSB_EDGE_CTRL, nr)
@@ -137,10 +180,38 @@
 		tpdm_simple_dataset_rw(tpmr##nr,		\
 		DSB_PATT_MASK, nr)
 
+#define DSB_PATT_ENABLE_TS					\
+		tpdm_patt_enable_ts(enable_ts,			\
+		DSB_PATT)
+
 #define DSB_MSR_ATTR(nr)					\
 		tpdm_simple_dataset_rw(msr##nr,			\
 		DSB_MSR, nr)
 
+#define CMB_TRIG_PATT_ATTR(nr)					\
+		tpdm_simple_dataset_rw(xpr##nr,			\
+		CMB_TRIG_PATT, nr)
+
+#define CMB_TRIG_PATT_MASK_ATTR(nr)				\
+		tpdm_simple_dataset_rw(xpmr##nr,		\
+		CMB_TRIG_PATT_MASK, nr)
+
+#define CMB_PATT_ATTR(nr)					\
+		tpdm_simple_dataset_rw(tpr##nr,			\
+		CMB_PATT, nr)
+
+#define CMB_PATT_MASK_ATTR(nr)					\
+		tpdm_simple_dataset_rw(tpmr##nr,		\
+		CMB_PATT_MASK, nr)
+
+#define CMB_PATT_ENABLE_TS					\
+		tpdm_patt_enable_ts(enable_ts,			\
+		CMB_PATT)
+
+#define CMB_MSR_ATTR(nr)					\
+		tpdm_simple_dataset_rw(msr##nr,			\
+		CMB_MSR, nr)
+
 /**
  * struct dsb_dataset - specifics associated to dsb dataset
  * @mode:             DSB programming mode
@@ -174,6 +245,30 @@
 };
 
 /**
+ * struct cmb_dataset
+ * @trace_mode:       Dataset collection mode
+ * @patt_val:         Save value for pattern
+ * @patt_mask:        Save value for pattern mask
+ * @trig_patt:        Save value for trigger pattern
+ * @trig_patt_mask:   Save value for trigger pattern mask
+ * @msr               Save value for MSR
+ * @patt_ts:          Indicates if pattern match for timestamp is enabled.
+ * @trig_ts:          Indicates if CTI trigger for timestamp is enabled.
+ * @ts_all:           Indicates if timestamp is enabled for all packets.
+ */
+struct cmb_dataset {
+	u32			trace_mode;
+	u32			patt_val[TPDM_CMB_MAX_PATT];
+	u32			patt_mask[TPDM_CMB_MAX_PATT];
+	u32			trig_patt[TPDM_CMB_MAX_PATT];
+	u32			trig_patt_mask[TPDM_CMB_MAX_PATT];
+	u32			msr[TPDM_CMB_MAX_MSR];
+	bool			patt_ts;
+	bool			trig_ts;
+	bool			ts_all;
+};
+
+/**
  * struct tpdm_drvdata - specifics associated to an TPDM component
  * @base:       memory mapped base address for this component.
  * @dev:        The device entity associated to this component.
@@ -182,7 +277,9 @@
  * @enable:     enable status of the component.
  * @datasets:   The datasets types present of the TPDM.
  * @dsb         Specifics associated to TPDM DSB.
+ * @cmb         Specifics associated to TPDM CMB.
  * @dsb_msr_num Number of MSR supported by DSB TPDM
+ * @cmb_msr_num Number of MSR supported by CMB TPDM
  */
 
 struct tpdm_drvdata {
@@ -193,7 +290,10 @@
 	bool			enable;
 	unsigned long		datasets;
 	struct dsb_dataset	*dsb;
+	struct cmb_dataset	*cmb;
 	u32			dsb_msr_num;
+	u32			cmb_msr_num;
+	u32			traceid;
 };
 
 /* Enumerate members of various datasets */
@@ -205,6 +305,11 @@
 	DSB_PATT,
 	DSB_PATT_MASK,
 	DSB_MSR,
+	CMB_TRIG_PATT,
+	CMB_TRIG_PATT_MASK,
+	CMB_PATT,
+	CMB_PATT_MASK,
+	CMB_MSR
 };
 
 /**
@@ -220,4 +325,13 @@
 	u32 idx;
 };
 
+static bool tpdm_has_dsb_dataset(struct tpdm_drvdata *drvdata)
+{
+	return (drvdata->datasets & TPDM_PIDR0_DS_DSB);
+}
+
+static bool tpdm_has_cmb_dataset(struct tpdm_drvdata *drvdata)
+{
+	return (drvdata->datasets & TPDM_PIDR0_DS_CMB);
+}
 #endif  /* _CORESIGHT_CORESIGHT_TPDM_H */
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-trace-id.c
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-trace-id.c
@@ -75,21 +75,26 @@
  * Allocate new ID and set in use
  *
  * if @preferred_id is a valid id then try to use that value if available.
- * if @preferred_id is not valid and @prefer_odd_id is true, try for odd id.
+ * if TRACE_ID_WANT_PREFERRED is set, @preferred_id must be free, otherwise return
+ * error -EINVAL.
+ * if @preferred_id is not valid and TRACE_ID_WANT_ODD is true, try for odd id.
  *
  * Otherwise allocate next available ID.
  */
 static int coresight_trace_id_alloc_new_id(struct coresight_trace_id_map *id_map,
-					   int preferred_id, bool prefer_odd_id)
+					   int preferred_id, unsigned int flags)
 {
 	int id = 0;
 
 	/* for backwards compatibility, cpu IDs may use preferred value */
-	if (IS_VALID_CS_TRACE_ID(preferred_id) &&
-	    !test_bit(preferred_id, id_map->used_ids)) {
-		id = preferred_id;
-		goto trace_id_allocated;
-	} else if (prefer_odd_id) {
+	if (IS_VALID_CS_TRACE_ID(preferred_id)) {
+		if (!test_bit(preferred_id, id_map->used_ids)) {
+			id = preferred_id;
+			goto trace_id_allocated;
+		} else if (WARN((flags & TRACE_ID_WANT_PREFERRED), "Trace ID %d is used.\n",
+					preferred_id))
+			return -EINVAL;
+	} else if (flags & TRACE_ID_WANT_ODD) {
 	/* may use odd ids to avoid preferred legacy cpu IDs */
 		id = coresight_trace_id_find_odd_id(id_map);
 		if (id)
@@ -175,7 +180,7 @@
 	 */
 	id = coresight_trace_id_alloc_new_id(id_map,
 					     CORESIGHT_LEGACY_CPU_TRACE_ID(cpu),
-					     false);
+					     TRACE_ID_ANY);
 	if (!IS_VALID_CS_TRACE_ID(id))
 		goto get_cpu_id_out_unlock;
 
@@ -222,14 +227,19 @@
 	DUMP_ID_MAP(id_map);
 }
 
-static int coresight_trace_id_map_get_system_id(struct coresight_trace_id_map *id_map)
+static int coresight_trace_id_map_get_system_id(struct coresight_trace_id_map *id_map,
+					int preferred_id)
 {
 	unsigned long flags;
 	int id;
+	unsigned int traceid_flags = 0;
 
 	spin_lock_irqsave(&id_map_lock, flags);
 	/* prefer odd IDs for system components to avoid legacy CPU IDS */
-	id = coresight_trace_id_alloc_new_id(id_map, 0, true);
+	traceid_flags = TRACE_ID_WANT_ODD;
+	traceid_flags |= preferred_id > 0 ? TRACE_ID_WANT_PREFERRED : 0;
+
+	id = coresight_trace_id_alloc_new_id(id_map, preferred_id, traceid_flags);
 	spin_unlock_irqrestore(&id_map_lock, flags);
 
 	DUMP_ID(id);
@@ -269,9 +279,9 @@
 }
 EXPORT_SYMBOL_GPL(coresight_trace_id_read_cpu_id);
 
-int coresight_trace_id_get_system_id(void)
+int coresight_trace_id_get_system_id(int id)
 {
-	return coresight_trace_id_map_get_system_id(&id_map_default);
+	return coresight_trace_id_map_get_system_id(&id_map_default, id);
 }
 EXPORT_SYMBOL_GPL(coresight_trace_id_get_system_id);
 
--- linux-qcom-6.8.0.orig/drivers/hwtracing/coresight/coresight-trace-id.h
+++ linux-qcom-6.8.0/drivers/hwtracing/coresight/coresight-trace-id.h
@@ -61,6 +61,12 @@
 	DECLARE_BITMAP(pend_rel_ids, CORESIGHT_TRACE_IDS_MAX);
 };
 
+enum trace_id_flags {
+	TRACE_ID_ANY = 0x0,
+	TRACE_ID_WANT_ODD = 0x1,
+	TRACE_ID_WANT_PREFERRED = 0x2,
+};
+
 /* Allocate and release IDs for a single default trace ID map */
 
 /**
@@ -118,9 +124,12 @@
  *
  * Used to allocate IDs for system trace sources such as STM.
  *
+ * @id: Preferred id value. If id is TRACE_ID_ANY, get a free id from id map.
+ * If id is greater than TRACE_ID_ANY, get a preferred id.
+ *
  * return: Trace ID or -EINVAL if allocation is impossible.
  */
-int coresight_trace_id_get_system_id(void);
+int coresight_trace_id_get_system_id(int id);
 
 /**
  * Release an allocated system trace ID.
--- linux-qcom-6.8.0.orig/drivers/hwtracing/intel_th/pci.c
+++ linux-qcom-6.8.0/drivers/hwtracing/intel_th/pci.c
@@ -290,6 +290,16 @@
 		.driver_data = (kernel_ulong_t)&intel_th_2x,
 	},
 	{
+		/* Meteor Lake-S CPU */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xae24),
+		.driver_data = (kernel_ulong_t)&intel_th_2x,
+	},
+	{
+		/* Meteor Lake-S */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7f26),
+		.driver_data = (kernel_ulong_t)&intel_th_2x,
+	},
+	{
 		/* Raptor Lake-S */
 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7a26),
 		.driver_data = (kernel_ulong_t)&intel_th_2x,
@@ -300,6 +310,26 @@
 		.driver_data = (kernel_ulong_t)&intel_th_2x,
 	},
 	{
+		/* Granite Rapids */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0963),
+		.driver_data = (kernel_ulong_t)&intel_th_2x,
+	},
+	{
+		/* Granite Rapids SOC */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x3256),
+		.driver_data = (kernel_ulong_t)&intel_th_2x,
+	},
+	{
+		/* Sapphire Rapids SOC */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x3456),
+		.driver_data = (kernel_ulong_t)&intel_th_2x,
+	},
+	{
+		/* Lunar Lake */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa824),
+		.driver_data = (kernel_ulong_t)&intel_th_2x,
+	},
+	{
 		/* Alder Lake CPU */
 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x466f),
 		.driver_data = (kernel_ulong_t)&intel_th_2x,
--- linux-qcom-6.8.0.orig/drivers/hwtracing/ptt/hisi_ptt.c
+++ linux-qcom-6.8.0/drivers/hwtracing/ptt/hisi_ptt.c
@@ -998,6 +998,9 @@
 	int ret;
 	u32 val;
 
+	if (event->attr.type != hisi_ptt->hisi_ptt_pmu.type)
+		return -ENOENT;
+
 	if (event->cpu < 0) {
 		dev_dbg(event->pmu->dev, "Per-task mode not supported\n");
 		return -EOPNOTSUPP;
@@ -1006,9 +1009,6 @@
 	if (event->attach_state & PERF_ATTACH_TASK)
 		return -EOPNOTSUPP;
 
-	if (event->attr.type != hisi_ptt->hisi_ptt_pmu.type)
-		return -ENOENT;
-
 	ret = hisi_ptt_trace_valid_filter(hisi_ptt, event->attr.config);
 	if (ret < 0)
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/hwtracing/stm/Kconfig
+++ linux-qcom-6.8.0/drivers/hwtracing/stm/Kconfig
@@ -48,6 +48,20 @@
 
 	  If you don't know what this is, say N.
 
+config STM_PROTO_OST
+	tristate "MIPI OST STM framing protocol driver"
+	default CONFIG_STM
+	help
+	  This is an implementation of MIPI OST protocol to be used
+	  over the STP transport. In addition to the data payload, it
+	  also carries additional metadata for entity, better
+	  means of trace source identification, etc.
+
+	  The receiving side must be able to decode this protocol in
+	  addition to the MIPI STP, in order to extract the data.
+
+	  If you don't know what this is, say N.
+
 config STM_SOURCE_CONSOLE
 	tristate "Kernel console over STM devices"
 	help
--- linux-qcom-6.8.0.orig/drivers/hwtracing/stm/Makefile
+++ linux-qcom-6.8.0/drivers/hwtracing/stm/Makefile
@@ -5,9 +5,11 @@
 
 obj-$(CONFIG_STM_PROTO_BASIC) += stm_p_basic.o
 obj-$(CONFIG_STM_PROTO_SYS_T) += stm_p_sys-t.o
+obj-$(CONFIG_STM_PROTO_OST) += stm_p_ost.o
 
 stm_p_basic-y		:= p_basic.o
 stm_p_sys-t-y		:= p_sys-t.o
+stm_p_ost-y		:= p_ost.o
 
 obj-$(CONFIG_STM_DUMMY)	+= dummy_stm.o
 
--- linux-qcom-6.8.0.orig/drivers/hwtracing/stm/core.c
+++ linux-qcom-6.8.0/drivers/hwtracing/stm/core.c
@@ -868,8 +868,11 @@
 		return -ENOMEM;
 
 	stm->major = register_chrdev(0, stm_data->name, &stm_fops);
-	if (stm->major < 0)
-		goto err_free;
+	if (stm->major < 0) {
+		err = stm->major;
+		vfree(stm);
+		return err;
+	}
 
 	device_initialize(&stm->dev);
 	stm->dev.devt = MKDEV(stm->major, 0);
@@ -913,10 +916,8 @@
 err_device:
 	unregister_chrdev(stm->major, stm_data->name);
 
-	/* matches device_initialize() above */
+	/* calls stm_device_release() */
 	put_device(&stm->dev);
-err_free:
-	vfree(stm);
 
 	return err;
 }
--- linux-qcom-6.8.0.orig/drivers/hwtracing/stm/p_ost.c
+++ linux-qcom-6.8.0/drivers/hwtracing/stm/p_ost.c
@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * MIPI OST framing protocol for STM devices.
+ */
+
+#include <linux/configfs.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/stm.h>
+#include <linux/sched/clock.h>
+#include "stm.h"
+
+#define OST_TOKEN_STARTSIMPLE		(0x10)
+#define OST_VERSION_MIPI1		(0x10 << 8)
+#define OST_ENTITY_FTRACE		(0x01 << 16)
+#define OST_CONTROL_PROTOCOL		(0x0 << 24)
+
+#define DATA_HEADER (OST_TOKEN_STARTSIMPLE | OST_VERSION_MIPI1 | \
+			OST_ENTITY_FTRACE | OST_CONTROL_PROTOCOL)
+
+#define STM_MAKE_VERSION(ma, mi)	((ma << 8) | mi)
+#define STM_HEADER_MAGIC		(0x5953)
+
+static ssize_t notrace ost_write(struct stm_data *data,
+		struct stm_output *output, unsigned int chan,
+		const char *buf, size_t count)
+{
+	unsigned int c = output->channel + chan;
+	unsigned int m = output->master;
+	const unsigned char nil = 0;
+	u32 header = DATA_HEADER;
+	u8 trc_hdr[24];
+	ssize_t sz;
+
+	/*
+	 * STP framing rules for OST frames:
+	 *   * the first packet of the OST frame is marked;
+	 *   * the last packet is a FLAG.
+	 */
+	/* Message layout: HEADER / DATA / TAIL */
+	/* HEADER */
+
+	sz = data->packet(data, m, c, STP_PACKET_DATA, STP_PACKET_MARKED,
+			  4, (u8 *)&header);
+	if (sz <= 0)
+		return sz;
+	*(uint16_t *)(trc_hdr) = STM_MAKE_VERSION(0, 3);
+	*(uint16_t *)(trc_hdr + 2) = STM_HEADER_MAGIC;
+	*(uint32_t *)(trc_hdr + 4) = raw_smp_processor_id();
+	*(uint64_t *)(trc_hdr + 8) = sched_clock();
+	*(uint64_t *)(trc_hdr + 16) = task_tgid_nr(get_current());
+	sz = stm_data_write(data, m, c, false, trc_hdr, sizeof(trc_hdr));
+	if (sz <= 0)
+		return sz;
+
+	/* DATA */
+	sz = stm_data_write(data, m, c, false, buf, count);
+
+	/* TAIL */
+	if (sz > 0)
+		data->packet(data, m, c, STP_PACKET_FLAG,
+			STP_PACKET_TIMESTAMPED, 0, &nil);
+
+	return sz;
+}
+
+static const struct stm_protocol_driver ost_pdrv = {
+	.owner			= THIS_MODULE,
+	.name			= "p_ost",
+	.write			= ost_write,
+};
+
+static int ost_stm_init(void)
+{
+	return stm_register_protocol(&ost_pdrv);
+}
+
+static void ost_stm_exit(void)
+{
+	stm_unregister_protocol(&ost_pdrv);
+}
+
+module_init(ost_stm_init);
+module_exit(ost_stm_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("MIPI Open System Trace STM framing protocol driver");
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/Kconfig
+++ linux-qcom-6.8.0/drivers/i2c/busses/Kconfig
@@ -159,6 +159,8 @@
 	    Raptor Lake (PCH)
 	    Meteor Lake (SOC and PCH)
 	    Birch Stream (SOC)
+	    Arrow Lake (SOC)
+	    Panther Lake (SOC)
 
 	  This driver can also be built as a module.  If so, the module
 	  will be called i2c-i801.
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-aspeed.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-aspeed.c
@@ -170,6 +170,13 @@
 
 static int aspeed_i2c_reset(struct aspeed_i2c_bus *bus);
 
+/* precondition: bus.lock has been acquired. */
+static void aspeed_i2c_do_stop(struct aspeed_i2c_bus *bus)
+{
+	bus->master_state = ASPEED_I2C_MASTER_STOP;
+	writel(ASPEED_I2CD_M_STOP_CMD, bus->base + ASPEED_I2C_CMD_REG);
+}
+
 static int aspeed_i2c_recover_bus(struct aspeed_i2c_bus *bus)
 {
 	unsigned long time_left, flags;
@@ -187,7 +194,7 @@
 			command);
 
 		reinit_completion(&bus->cmd_complete);
-		writel(ASPEED_I2CD_M_STOP_CMD, bus->base + ASPEED_I2C_CMD_REG);
+		aspeed_i2c_do_stop(bus);
 		spin_unlock_irqrestore(&bus->lock, flags);
 
 		time_left = wait_for_completion_timeout(
@@ -391,13 +398,6 @@
 }
 
 /* precondition: bus.lock has been acquired. */
-static void aspeed_i2c_do_stop(struct aspeed_i2c_bus *bus)
-{
-	bus->master_state = ASPEED_I2C_MASTER_STOP;
-	writel(ASPEED_I2CD_M_STOP_CMD, bus->base + ASPEED_I2C_CMD_REG);
-}
-
-/* precondition: bus.lock has been acquired. */
 static void aspeed_i2c_next_msg_or_stop(struct aspeed_i2c_bus *bus)
 {
 	if (bus->msgs_index + 1 < bus->msgs_count) {
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-at91-slave.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-at91-slave.c
@@ -106,8 +106,7 @@
 
 static u32 at91_twi_func(struct i2c_adapter *adapter)
 {
-	return I2C_FUNC_SLAVE | I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL
-		| I2C_FUNC_SMBUS_READ_BLOCK_DATA;
+	return I2C_FUNC_SLAVE;
 }
 
 static const struct i2c_algorithm at91_twi_algorithm_slave = {
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-cadence.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-cadence.c
@@ -633,6 +633,7 @@
 
 	if (hold_clear) {
 		ctrl_reg &= ~CDNS_I2C_CR_HOLD;
+		ctrl_reg &= ~CDNS_I2C_CR_CLR_FIFO;
 		/*
 		 * In case of Xilinx Zynq SOC, clear the HOLD bit before transfer size
 		 * register reaches '0'. This is an IP bug which causes transfer size
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-designware-common.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-designware-common.c
@@ -441,7 +441,8 @@
 
 void __i2c_dw_disable(struct dw_i2c_dev *dev)
 {
-	unsigned int raw_intr_stats;
+	struct i2c_timings *t = &dev->timings;
+	unsigned int raw_intr_stats, ic_stats;
 	unsigned int enable;
 	int timeout = 100;
 	bool abort_needed;
@@ -449,10 +450,25 @@
 	int ret;
 
 	regmap_read(dev->map, DW_IC_RAW_INTR_STAT, &raw_intr_stats);
+	regmap_read(dev->map, DW_IC_STATUS, &ic_stats);
 	regmap_read(dev->map, DW_IC_ENABLE, &enable);
 
-	abort_needed = raw_intr_stats & DW_IC_INTR_MST_ON_HOLD;
+	abort_needed = (raw_intr_stats & DW_IC_INTR_MST_ON_HOLD) ||
+			(ic_stats & DW_IC_STATUS_MASTER_HOLD_TX_FIFO_EMPTY);
 	if (abort_needed) {
+		if (!(enable & DW_IC_ENABLE_ENABLE)) {
+			regmap_write(dev->map, DW_IC_ENABLE, DW_IC_ENABLE_ENABLE);
+			/*
+			 * Wait 10 times the signaling period of the highest I2C
+			 * transfer supported by the driver (for 400KHz this is
+			 * 25us) to ensure the I2C ENABLE bit is already set
+			 * as described in the DesignWare I2C databook.
+			 */
+			fsleep(DIV_ROUND_CLOSEST_ULL(10 * MICRO, t->bus_freq_hz));
+			/* Set ENABLE bit before setting ABORT */
+			enable |= DW_IC_ENABLE_ENABLE;
+		}
+
 		regmap_write(dev->map, DW_IC_ENABLE, enable | DW_IC_ENABLE_ABORT);
 		ret = regmap_read_poll_timeout(dev->map, DW_IC_ENABLE, enable,
 					       !(enable & DW_IC_ENABLE_ABORT), 10,
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-designware-core.h
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-designware-core.h
@@ -109,6 +109,7 @@
 						 DW_IC_INTR_RX_UNDER | \
 						 DW_IC_INTR_RD_REQ)
 
+#define DW_IC_ENABLE_ENABLE			BIT(0)
 #define DW_IC_ENABLE_ABORT			BIT(1)
 
 #define DW_IC_STATUS_ACTIVITY			BIT(0)
@@ -116,6 +117,7 @@
 #define DW_IC_STATUS_RFNE			BIT(3)
 #define DW_IC_STATUS_MASTER_ACTIVITY		BIT(5)
 #define DW_IC_STATUS_SLAVE_ACTIVITY		BIT(6)
+#define DW_IC_STATUS_MASTER_HOLD_TX_FIFO_EMPTY	BIT(7)
 
 #define DW_IC_SDA_HOLD_RX_SHIFT			16
 #define DW_IC_SDA_HOLD_RX_MASK			GENMASK(23, 16)
@@ -318,7 +320,7 @@
 #define AMD_UCSI_INTR_EN			0xd
 
 #define TXGBE_TX_FIFO_DEPTH			4
-#define TXGBE_RX_FIFO_DEPTH			0
+#define TXGBE_RX_FIFO_DEPTH			1
 
 struct i2c_dw_semaphore_callbacks {
 	int	(*probe)(struct dw_i2c_dev *dev);
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-designware-master.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-designware-master.c
@@ -253,6 +253,34 @@
 	regmap_write(dev->map, DW_IC_INTR_MASK, DW_IC_INTR_MASTER_MASK);
 }
 
+/*
+ * This function waits for the controller to be idle before disabling I2C
+ * When the controller is not in the IDLE state, the MST_ACTIVITY bit
+ * (IC_STATUS[5]) is set.
+ *
+ * Values:
+ * 0x1 (ACTIVE): Controller not idle
+ * 0x0 (IDLE): Controller is idle
+ *
+ * The function is called after completing the current transfer.
+ *
+ * Returns:
+ * False when the controller is in the IDLE state.
+ * True when the controller is in the ACTIVE state.
+ */
+static bool i2c_dw_is_controller_active(struct dw_i2c_dev *dev)
+{
+	u32 status;
+
+	regmap_read(dev->map, DW_IC_STATUS, &status);
+	if (!(status & DW_IC_STATUS_MASTER_ACTIVITY))
+		return false;
+
+	return regmap_read_poll_timeout(dev->map, DW_IC_STATUS, status,
+				       !(status & DW_IC_STATUS_MASTER_ACTIVITY),
+				       1100, 20000) != 0;
+}
+
 static int i2c_dw_check_stopbit(struct dw_i2c_dev *dev)
 {
 	u32 val;
@@ -695,6 +723,16 @@
 	}
 
 	/*
+	 * This happens rarely (~1:500) and is hard to reproduce. Debug trace
+	 * showed that IC_STATUS had value of 0x23 when STOP_DET occurred,
+	 * if disable IC_ENABLE.ENABLE immediately that can result in
+	 * IC_RAW_INTR_STAT.MASTER_ON_HOLD holding SCL low. Check if
+	 * controller is still ACTIVE before disabling I2C.
+	 */
+	if (i2c_dw_is_controller_active(dev))
+		dev_err(dev->dev, "controller active\n");
+
+	/*
 	 * We must disable the adapter before returning and signaling the end
 	 * of the current transfer. Otherwise the hardware might continue
 	 * generating interrupts which in turn causes a race condition with
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-designware-slave.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-designware-slave.c
@@ -220,7 +220,7 @@
 
 void i2c_dw_configure_slave(struct dw_i2c_dev *dev)
 {
-	dev->functionality = I2C_FUNC_SLAVE | DW_IC_DEFAULT_FUNCTIONALITY;
+	dev->functionality = I2C_FUNC_SLAVE;
 
 	dev->slave_cfg = DW_IC_CON_RX_FIFO_FULL_HLD_CTRL |
 			 DW_IC_CON_RESTART_EN | DW_IC_CON_STOP_DET_IFADDRESSED;
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-i801.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-i801.c
@@ -80,6 +80,9 @@
  * Meteor Lake SoC-S (SOC)	0xae22	32	hard	yes	yes	yes
  * Meteor Lake PCH-S (PCH)	0x7f23	32	hard	yes	yes	yes
  * Birch Stream (SOC)		0x5796	32	hard	yes	yes	yes
+ * Arrow Lake-H (SOC)		0x7722	32	hard	yes	yes	yes
+ * Panther Lake-H (SOC)		0xe322	32	hard	yes	yes	yes
+ * Panther Lake-P (SOC)		0xe422	32	hard	yes	yes	yes
  *
  * Features supported by this driver:
  * Software PEC				no
@@ -234,6 +237,7 @@
 #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_M_SMBUS		0x54a3
 #define PCI_DEVICE_ID_INTEL_BIRCH_STREAM_SMBUS		0x5796
 #define PCI_DEVICE_ID_INTEL_BROXTON_SMBUS		0x5ad4
+#define PCI_DEVICE_ID_INTEL_ARROW_LAKE_H_SMBUS		0x7722
 #define PCI_DEVICE_ID_INTEL_RAPTOR_LAKE_S_SMBUS		0x7a23
 #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_S_SMBUS		0x7aa3
 #define PCI_DEVICE_ID_INTEL_METEOR_LAKE_P_SMBUS		0x7e22
@@ -256,6 +260,8 @@
 #define PCI_DEVICE_ID_INTEL_CANNONLAKE_H_SMBUS		0xa323
 #define PCI_DEVICE_ID_INTEL_COMETLAKE_V_SMBUS		0xa3a3
 #define PCI_DEVICE_ID_INTEL_METEOR_LAKE_SOC_S_SMBUS	0xae22
+#define PCI_DEVICE_ID_INTEL_PANTHER_LAKE_H_SMBUS	0xe322
+#define PCI_DEVICE_ID_INTEL_PANTHER_LAKE_P_SMBUS	0xe422
 
 struct i801_mux_config {
 	char *gpio_chip;
@@ -1040,13 +1046,16 @@
 	{ PCI_DEVICE_DATA(INTEL, METEOR_LAKE_SOC_S_SMBUS,	FEATURES_ICH5 | FEATURE_TCO_CNL) },
 	{ PCI_DEVICE_DATA(INTEL, METEOR_LAKE_PCH_S_SMBUS,	FEATURES_ICH5 | FEATURE_TCO_CNL) },
 	{ PCI_DEVICE_DATA(INTEL, BIRCH_STREAM_SMBUS,		FEATURES_ICH5 | FEATURE_TCO_CNL) },
+	{ PCI_DEVICE_DATA(INTEL, ARROW_LAKE_H_SMBUS,		FEATURES_ICH5 | FEATURE_TCO_CNL) },
+	{ PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_H_SMBUS,		FEATURES_ICH5 | FEATURE_TCO_CNL) },
+	{ PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_P_SMBUS,		FEATURES_ICH5 | FEATURE_TCO_CNL) },
 	{ 0, }
 };
 
 MODULE_DEVICE_TABLE(pci, i801_ids);
 
 #if defined CONFIG_X86 && defined CONFIG_DMI
-static unsigned char apanel_addr;
+static unsigned char apanel_addr __ro_after_init;
 
 /* Scan the system ROM for the signature "FJKEYINF" */
 static __init const void __iomem *bios_signature(const void __iomem *bios)
@@ -1732,8 +1741,15 @@
 
 	i801_add_tco(priv);
 
+	/*
+	 * adapter.name is used by platform code to find the main I801 adapter
+	 * to instantiante i2c_clients, do not change.
+	 */
 	snprintf(priv->adapter.name, sizeof(priv->adapter.name),
-		"SMBus I801 adapter at %04lx", priv->smba);
+		 "SMBus %s adapter at %04lx",
+		 (priv->features & FEATURE_IDF) ? "I801 IDF" : "I801",
+		 priv->smba);
+
 	err = i2c_add_adapter(&priv->adapter);
 	if (err) {
 		platform_device_unregister(priv->tco_pdev);
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-imx-lpi2c.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-imx-lpi2c.c
@@ -99,6 +99,7 @@
 	__u8			*rx_buf;
 	__u8			*tx_buf;
 	struct completion	complete;
+	unsigned long		rate_per;
 	unsigned int		msglen;
 	unsigned int		delivered;
 	unsigned int		block_data;
@@ -207,9 +208,7 @@
 
 	lpi2c_imx_set_mode(lpi2c_imx);
 
-	clk_rate = clk_get_rate(lpi2c_imx->clks[0].clk);
-	if (!clk_rate)
-		return -EINVAL;
+	clk_rate = lpi2c_imx->rate_per;
 
 	if (lpi2c_imx->mode == HS || lpi2c_imx->mode == ULTRA_FAST)
 		filt = 0;
@@ -590,6 +589,20 @@
 	if (ret)
 		return ret;
 
+	/*
+	 * Lock the parent clock rate to avoid getting parent clock upon
+	 * each transfer
+	 */
+	ret = devm_clk_rate_exclusive_get(&pdev->dev, lpi2c_imx->clks[0].clk);
+	if (ret)
+		return dev_err_probe(&pdev->dev, ret,
+				     "can't lock I2C peripheral clock rate\n");
+
+	lpi2c_imx->rate_per = clk_get_rate(lpi2c_imx->clks[0].clk);
+	if (!lpi2c_imx->rate_per)
+		return dev_err_probe(&pdev->dev, -EINVAL,
+				     "can't get I2C peripheral clock rate\n");
+
 	pm_runtime_set_autosuspend_delay(&pdev->dev, I2C_PM_TIMEOUT);
 	pm_runtime_use_autosuspend(&pdev->dev);
 	pm_runtime_get_noresume(&pdev->dev);
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-imx.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-imx.c
@@ -286,6 +286,7 @@
 	{ .compatible = "fsl,imx6sll-i2c", .data = &imx6_i2c_hwdata, },
 	{ .compatible = "fsl,imx6sx-i2c", .data = &imx6_i2c_hwdata, },
 	{ .compatible = "fsl,imx6ul-i2c", .data = &imx6_i2c_hwdata, },
+	{ .compatible = "fsl,imx7d-i2c", .data = &imx6_i2c_hwdata, },
 	{ .compatible = "fsl,imx7s-i2c", .data = &imx6_i2c_hwdata, },
 	{ .compatible = "fsl,imx8mm-i2c", .data = &imx6_i2c_hwdata, },
 	{ .compatible = "fsl,imx8mn-i2c", .data = &imx6_i2c_hwdata, },
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-isch.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-isch.c
@@ -99,8 +99,7 @@
 	if (retries > MAX_RETRIES) {
 		dev_err(&sch_adapter.dev, "SMBus Timeout!\n");
 		result = -ETIMEDOUT;
-	}
-	if (temp & 0x04) {
+	} else if (temp & 0x04) {
 		result = -EIO;
 		dev_dbg(&sch_adapter.dev, "Bus collision! SMBus may be "
 			"locked until next hard reset. (sorry!)\n");
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-microchip-corei2c.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-microchip-corei2c.c
@@ -93,27 +93,35 @@
  * @base:		pointer to register struct
  * @dev:		device reference
  * @i2c_clk:		clock reference for i2c input clock
+ * @msg_queue:		pointer to the messages requiring sending
  * @buf:		pointer to msg buffer for easier use
  * @msg_complete:	xfer completion object
  * @adapter:		core i2c abstraction
  * @msg_err:		error code for completed message
  * @bus_clk_rate:	current i2c bus clock rate
  * @isr_status:		cached copy of local ISR status
+ * @total_num:		total number of messages to be sent/received
+ * @current_num:	index of the current message being sent/received
  * @msg_len:		number of bytes transferred in msg
  * @addr:		address of the current slave
+ * @restart_needed:	whether or not a repeated start is required after current message
  */
 struct mchp_corei2c_dev {
 	void __iomem *base;
 	struct device *dev;
 	struct clk *i2c_clk;
+	struct i2c_msg *msg_queue;
 	u8 *buf;
 	struct completion msg_complete;
 	struct i2c_adapter adapter;
 	int msg_err;
+	int total_num;
+	int current_num;
 	u32 bus_clk_rate;
 	u32 isr_status;
 	u16 msg_len;
 	u8 addr;
+	bool restart_needed;
 };
 
 static void mchp_corei2c_core_disable(struct mchp_corei2c_dev *idev)
@@ -222,6 +230,47 @@
 	return 0;
 }
 
+static void mchp_corei2c_next_msg(struct mchp_corei2c_dev *idev)
+{
+	struct i2c_msg *this_msg;
+	u8 ctrl;
+
+	if (idev->current_num >= idev->total_num) {
+		complete(&idev->msg_complete);
+		return;
+	}
+
+	/*
+	 * If there's been an error, the isr needs to return control
+	 * to the "main" part of the driver, so as not to keep sending
+	 * messages once it completes and clears the SI bit.
+	 */
+	if (idev->msg_err) {
+		complete(&idev->msg_complete);
+		return;
+	}
+
+	this_msg = idev->msg_queue++;
+
+	if (idev->current_num < (idev->total_num - 1)) {
+		struct i2c_msg *next_msg = idev->msg_queue;
+
+		idev->restart_needed = next_msg->flags & I2C_M_RD;
+	} else {
+		idev->restart_needed = false;
+	}
+
+	idev->addr = i2c_8bit_addr_from_msg(this_msg);
+	idev->msg_len = this_msg->len;
+	idev->buf = this_msg->buf;
+
+	ctrl = readb(idev->base + CORE_I2C_CTRL);
+	ctrl |= CTRL_STA;
+	writeb(ctrl, idev->base + CORE_I2C_CTRL);
+
+	idev->current_num++;
+}
+
 static irqreturn_t mchp_corei2c_handle_isr(struct mchp_corei2c_dev *idev)
 {
 	u32 status = idev->isr_status;
@@ -238,8 +287,6 @@
 		ctrl &= ~CTRL_STA;
 		writeb(idev->addr, idev->base + CORE_I2C_DATA);
 		writeb(ctrl, idev->base + CORE_I2C_CTRL);
-		if (idev->msg_len == 0)
-			finished = true;
 		break;
 	case STATUS_M_ARB_LOST:
 		idev->msg_err = -EAGAIN;
@@ -247,10 +294,14 @@
 		break;
 	case STATUS_M_SLAW_ACK:
 	case STATUS_M_TX_DATA_ACK:
-		if (idev->msg_len > 0)
+		if (idev->msg_len > 0) {
 			mchp_corei2c_fill_tx(idev);
-		else
-			last_byte = true;
+		} else {
+			if (idev->restart_needed)
+				finished = true;
+			else
+				last_byte = true;
+		}
 		break;
 	case STATUS_M_TX_DATA_NACK:
 	case STATUS_M_SLAR_NACK:
@@ -287,7 +338,7 @@
 		mchp_corei2c_stop(idev);
 
 	if (last_byte || finished)
-		complete(&idev->msg_complete);
+		mchp_corei2c_next_msg(idev);
 
 	return IRQ_HANDLED;
 }
@@ -311,21 +362,48 @@
 	return ret;
 }
 
-static int mchp_corei2c_xfer_msg(struct mchp_corei2c_dev *idev,
-				 struct i2c_msg *msg)
+static int mchp_corei2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
+			     int num)
 {
-	u8 ctrl;
+	struct mchp_corei2c_dev *idev = i2c_get_adapdata(adap);
+	struct i2c_msg *this_msg = msgs;
 	unsigned long time_left;
+	u8 ctrl;
+
+	mchp_corei2c_core_enable(idev);
 
-	idev->addr = i2c_8bit_addr_from_msg(msg);
-	idev->msg_len = msg->len;
-	idev->buf = msg->buf;
+	/*
+	 * The isr controls the flow of a transfer, this info needs to be saved
+	 * to a location that it can access the queue information from.
+	 */
+	idev->restart_needed = false;
+	idev->msg_queue = msgs;
+	idev->total_num = num;
+	idev->current_num = 0;
+
+	/*
+	 * But the first entry to the isr is triggered by the start in this
+	 * function, so the first message needs to be "dequeued".
+	 */
+	idev->addr = i2c_8bit_addr_from_msg(this_msg);
+	idev->msg_len = this_msg->len;
+	idev->buf = this_msg->buf;
 	idev->msg_err = 0;
 
-	reinit_completion(&idev->msg_complete);
+	if (idev->total_num > 1) {
+		struct i2c_msg *next_msg = msgs + 1;
 
-	mchp_corei2c_core_enable(idev);
+		idev->restart_needed = next_msg->flags & I2C_M_RD;
+	}
 
+	idev->current_num++;
+	idev->msg_queue++;
+
+	reinit_completion(&idev->msg_complete);
+
+	/*
+	 * Send the first start to pass control to the isr
+	 */
 	ctrl = readb(idev->base + CORE_I2C_CTRL);
 	ctrl |= CTRL_STA;
 	writeb(ctrl, idev->base + CORE_I2C_CTRL);
@@ -335,20 +413,8 @@
 	if (!time_left)
 		return -ETIMEDOUT;
 
-	return idev->msg_err;
-}
-
-static int mchp_corei2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
-			     int num)
-{
-	struct mchp_corei2c_dev *idev = i2c_get_adapdata(adap);
-	int i, ret;
-
-	for (i = 0; i < num; i++) {
-		ret = mchp_corei2c_xfer_msg(idev, msgs++);
-		if (ret)
-			return ret;
-	}
+	if (idev->msg_err)
+		return idev->msg_err;
 
 	return num;
 }
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-ocores.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-ocores.c
@@ -442,8 +442,8 @@
 	oc_setreg(i2c, OCI2C_PREHIGH, prescale >> 8);
 
 	/* Init the device */
-	oc_setreg(i2c, OCI2C_CMD, OCI2C_CMD_IACK);
 	oc_setreg(i2c, OCI2C_CONTROL, ctrl | OCI2C_CTRL_EN);
+	oc_setreg(i2c, OCI2C_CMD, OCI2C_CMD_IACK);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-pnx.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-pnx.c
@@ -15,7 +15,6 @@
 #include <linux/ioport.h>
 #include <linux/delay.h>
 #include <linux/i2c.h>
-#include <linux/timer.h>
 #include <linux/completion.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
@@ -32,7 +31,6 @@
 	int			ret;		/* Return value */
 	int			mode;		/* Interface mode */
 	struct completion	complete;	/* I/O completion */
-	struct timer_list	timer;		/* Timeout */
 	u8 *			buf;		/* Data buffer */
 	int			len;		/* Length of data buffer */
 	int			order;		/* RX Bytes to order via TX */
@@ -97,7 +95,7 @@
 
 static inline int wait_timeout(struct i2c_pnx_algo_data *data)
 {
-	long timeout = data->timeout;
+	long timeout = jiffies_to_msecs(data->timeout);
 	while (timeout > 0 &&
 			(ioread32(I2C_REG_STS(data)) & mstatus_active)) {
 		mdelay(1);
@@ -108,7 +106,7 @@
 
 static inline int wait_reset(struct i2c_pnx_algo_data *data)
 {
-	long timeout = data->timeout;
+	long timeout = jiffies_to_msecs(data->timeout);
 	while (timeout > 0 &&
 			(ioread32(I2C_REG_CTL(data)) & mcntrl_reset)) {
 		mdelay(1);
@@ -117,24 +115,6 @@
 	return (timeout <= 0);
 }
 
-static inline void i2c_pnx_arm_timer(struct i2c_pnx_algo_data *alg_data)
-{
-	struct timer_list *timer = &alg_data->mif.timer;
-	unsigned long expires = msecs_to_jiffies(alg_data->timeout);
-
-	if (expires <= 1)
-		expires = 2;
-
-	del_timer_sync(timer);
-
-	dev_dbg(&alg_data->adapter.dev, "Timer armed at %lu plus %lu jiffies.\n",
-		jiffies, expires);
-
-	timer->expires = jiffies + expires;
-
-	add_timer(timer);
-}
-
 /**
  * i2c_pnx_start - start a device
  * @slave_addr:		slave address
@@ -259,8 +239,6 @@
 				~(mcntrl_afie | mcntrl_naie | mcntrl_drmie),
 				  I2C_REG_CTL(alg_data));
 
-			del_timer_sync(&alg_data->mif.timer);
-
 			dev_dbg(&alg_data->adapter.dev,
 				"%s(): Waking up xfer routine.\n",
 				__func__);
@@ -276,8 +254,6 @@
 			~(mcntrl_afie | mcntrl_naie | mcntrl_drmie),
 			  I2C_REG_CTL(alg_data));
 
-		/* Stop timer. */
-		del_timer_sync(&alg_data->mif.timer);
 		dev_dbg(&alg_data->adapter.dev,
 			"%s(): Waking up xfer routine after zero-xfer.\n",
 			__func__);
@@ -364,8 +340,6 @@
 				 mcntrl_drmie | mcntrl_daie);
 			iowrite32(ctl, I2C_REG_CTL(alg_data));
 
-			/* Kill timer. */
-			del_timer_sync(&alg_data->mif.timer);
 			complete(&alg_data->mif.complete);
 		}
 	}
@@ -400,8 +374,6 @@
 			 mcntrl_drmie);
 		iowrite32(ctl, I2C_REG_CTL(alg_data));
 
-		/* Stop timer, to prevent timeout. */
-		del_timer_sync(&alg_data->mif.timer);
 		complete(&alg_data->mif.complete);
 	} else if (stat & mstatus_nai) {
 		/* Slave did not acknowledge, generate a STOP */
@@ -419,8 +391,6 @@
 		/* Our return value. */
 		alg_data->mif.ret = -EIO;
 
-		/* Stop timer, to prevent timeout. */
-		del_timer_sync(&alg_data->mif.timer);
 		complete(&alg_data->mif.complete);
 	} else {
 		/*
@@ -453,9 +423,8 @@
 	return IRQ_HANDLED;
 }
 
-static void i2c_pnx_timeout(struct timer_list *t)
+static void i2c_pnx_timeout(struct i2c_pnx_algo_data *alg_data)
 {
-	struct i2c_pnx_algo_data *alg_data = from_timer(alg_data, t, mif.timer);
 	u32 ctl;
 
 	dev_err(&alg_data->adapter.dev,
@@ -472,7 +441,6 @@
 	iowrite32(ctl, I2C_REG_CTL(alg_data));
 	wait_reset(alg_data);
 	alg_data->mif.ret = -EIO;
-	complete(&alg_data->mif.complete);
 }
 
 static inline void bus_reset_if_active(struct i2c_pnx_algo_data *alg_data)
@@ -514,6 +482,7 @@
 	struct i2c_msg *pmsg;
 	int rc = 0, completed = 0, i;
 	struct i2c_pnx_algo_data *alg_data = adap->algo_data;
+	unsigned long time_left;
 	u32 stat;
 
 	dev_dbg(&alg_data->adapter.dev,
@@ -548,7 +517,6 @@
 		dev_dbg(&alg_data->adapter.dev, "%s(): mode %d, %d bytes\n",
 			__func__, alg_data->mif.mode, alg_data->mif.len);
 
-		i2c_pnx_arm_timer(alg_data);
 
 		/* initialize the completion var */
 		init_completion(&alg_data->mif.complete);
@@ -564,7 +532,10 @@
 			break;
 
 		/* Wait for completion */
-		wait_for_completion(&alg_data->mif.complete);
+		time_left = wait_for_completion_timeout(&alg_data->mif.complete,
+							alg_data->timeout);
+		if (time_left == 0)
+			i2c_pnx_timeout(alg_data);
 
 		if (!(rc = alg_data->mif.ret))
 			completed++;
@@ -653,7 +624,10 @@
 	alg_data->adapter.algo_data = alg_data;
 	alg_data->adapter.nr = pdev->id;
 
-	alg_data->timeout = I2C_PNX_TIMEOUT_DEFAULT;
+	alg_data->timeout = msecs_to_jiffies(I2C_PNX_TIMEOUT_DEFAULT);
+	if (alg_data->timeout <= 1)
+		alg_data->timeout = 2;
+
 #ifdef CONFIG_OF
 	alg_data->adapter.dev.of_node = of_node_get(pdev->dev.of_node);
 	if (pdev->dev.of_node) {
@@ -673,8 +647,6 @@
 	if (IS_ERR(alg_data->clk))
 		return PTR_ERR(alg_data->clk);
 
-	timer_setup(&alg_data->mif.timer, i2c_pnx_timeout, 0);
-
 	snprintf(alg_data->adapter.name, sizeof(alg_data->adapter.name),
 		 "%s", pdev->name);
 
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-qcom-cci.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-qcom-cci.c
@@ -817,6 +817,7 @@
 	 * Do not add any new ones unless they introduce a new config
 	 */
 	{ .compatible = "qcom,msm8916-cci", .data = &cci_v1_data},
+	{ .compatible = "qcom,sc7280-cci", .data = &cci_v2_data},
 	{ .compatible = "qcom,sdm845-cci", .data = &cci_v2_data},
 	{ .compatible = "qcom,sm8250-cci", .data = &cci_v2_data},
 	{ .compatible = "qcom,sm8450-cci", .data = &cci_v2_data},
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-qcom-geni.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-qcom-geni.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+// Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/acpi.h>
 #include <linux/clk.h>
@@ -16,6 +17,24 @@
 #include <linux/pm_runtime.h>
 #include <linux/soc/qcom/geni-se.h>
 #include <linux/spinlock.h>
+#include <soc/qcom/qup_fw_load.h>
+
+#define CREATE_TRACE_POINTS
+#include <trace/events/qup_buses_trace.h>
+
+void i2c_trace_log(struct device *dev, const char *fmt, ...)
+{
+	struct va_format vaf = {
+		.fmt = fmt,
+	};
+
+	va_list args;
+
+	va_start(args, fmt);
+	vaf.va = &args;
+	trace_buses_log_info(dev_name(dev), &vaf);
+	va_end(args);
+}
 
 #define SE_I2C_TX_TRANS_LEN		0x26c
 #define SE_I2C_RX_TRANS_LEN		0x270
@@ -77,6 +96,8 @@
 #define XFER_TIMEOUT		HZ
 #define RST_TIMEOUT		HZ
 
+static int geni_i2c_runtime_resume(struct device *dev);
+
 struct geni_i2c_dev {
 	struct geni_se se;
 	u32 tx_wm;
@@ -99,6 +120,7 @@
 	struct dma_chan *rx_c;
 	bool gpi_mode;
 	bool abort_done;
+	bool is_shared;
 };
 
 struct geni_i2c_desc {
@@ -198,10 +220,10 @@
 		rx_st = readl_relaxed(gi2c->se.base + SE_GENI_RX_FIFO_STATUS);
 		tx_st = readl_relaxed(gi2c->se.base + SE_GENI_TX_FIFO_STATUS);
 	}
-	dev_dbg(gi2c->se.dev, "DMA:%d tx_stat:0x%x, rx_stat:0x%x, irq-stat:0x%x\n",
-		dma, tx_st, rx_st, m_stat);
-	dev_dbg(gi2c->se.dev, "m_cmd:0x%x, geni_status:0x%x, geni_ios:0x%x\n",
-		m_cmd, geni_s, geni_ios);
+	i2c_trace_log(gi2c->se.dev, "DMA:%d tx_stat:0x%x, rx_stat:0x%x, irq-stat:0x%x\n",
+		      dma, tx_st, rx_st, m_stat);
+	i2c_trace_log(gi2c->se.dev, "m_cmd:0x%x, geni_status:0x%x, geni_ios:0x%x\n",
+		      m_cmd, geni_s, geni_ios);
 }
 
 static void geni_i2c_err(struct geni_i2c_dev *gi2c, int err)
@@ -209,8 +231,8 @@
 	if (!gi2c->err)
 		gi2c->err = gi2c_log[err].err;
 	if (gi2c->cur)
-		dev_dbg(gi2c->se.dev, "len:%d, slv-addr:0x%x, RD/WR:%d\n",
-			gi2c->cur->len, gi2c->cur->addr, gi2c->cur->flags);
+		i2c_trace_log(gi2c->se.dev, "len:%d, slv-addr:0x%x, RD/WR:%d\n",
+			      gi2c->cur->len, gi2c->cur->addr, gi2c->cur->flags);
 
 	switch (err) {
 	case GENI_ABORT_DONE:
@@ -218,7 +240,7 @@
 		break;
 	case NACK:
 	case GENI_TIMEOUT:
-		dev_dbg(gi2c->se.dev, "%s\n", gi2c_log[err].msg);
+		i2c_trace_log(gi2c->se.dev, "%s\n", gi2c_log[err].msg);
 		break;
 	default:
 		dev_err(gi2c->se.dev, "%s\n", gi2c_log[err].msg);
@@ -270,8 +292,8 @@
 		if (!dma)
 			writel_relaxed(0, base + SE_GENI_TX_WATERMARK_REG);
 	} else if (dma) {
-		dev_dbg(gi2c->se.dev, "i2c dma tx:0x%x, dma rx:0x%x\n",
-			dm_tx_st, dm_rx_st);
+		i2c_trace_log(gi2c->se.dev, "i2c dma tx:0x%x, dma rx:0x%x\n",
+			      dm_tx_st, dm_rx_st);
 	} else if (cur->flags & I2C_M_RD &&
 		   m_stat & (M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN)) {
 		u32 rxcnt = rx_st & RX_FIFO_WC_MSK;
@@ -484,13 +506,20 @@
 
 static void i2c_gpi_cb_result(void *cb, const struct dmaengine_result *result)
 {
-	struct geni_i2c_dev *gi2c = cb;
+	struct gpi_i2c_config *i2c = cb;
+	struct geni_i2c_dev *gi2c = i2c->gi2c;
 
-	if (result->result != DMA_TRANS_NOERROR) {
+	if (i2c->status & (BIT(NACK) << 5)) {
+		geni_i2c_err(gi2c, NACK);
+	} else if (i2c->status & (BIT(BUS_PROTO) << 5)) {
+		geni_i2c_err(gi2c, BUS_PROTO);
+	} else if (i2c->status & (BIT(ARB_LOST) << 5)) {
+		geni_i2c_err(gi2c, ARB_LOST);
+	} else if (result->result != DMA_TRANS_NOERROR) {
 		dev_err(gi2c->se.dev, "DMA txn failed:%d\n", result->result);
 		gi2c->err = -EIO;
 	} else if (result->residue) {
-		dev_dbg(gi2c->se.dev, "DMA xfer has pending: %d\n", result->residue);
+		i2c_trace_log(gi2c->se.dev, "DMA xfer has pending: %d\n", result->residue);
 	}
 
 	complete(&gi2c->done);
@@ -568,7 +597,7 @@
 	}
 
 	desc->callback_result = i2c_gpi_cb_result;
-	desc->callback_param = gi2c;
+	desc->callback_param = peripheral;
 
 	dmaengine_submit(desc);
 	*buf = dma_buf;
@@ -585,33 +614,46 @@
 static int geni_i2c_gpi_xfer(struct geni_i2c_dev *gi2c, struct i2c_msg msgs[], int num)
 {
 	struct dma_slave_config config = {};
-	struct gpi_i2c_config peripheral = {};
-	int i, ret = 0, timeout;
+	struct gpi_i2c_config *peripheral;
+	int i, ret = 0;
+	unsigned long time_left;
 	dma_addr_t tx_addr, rx_addr;
 	void *tx_buf = NULL, *rx_buf = NULL;
 	const struct geni_i2c_clk_fld *itr = gi2c->clk_fld;
 
-	config.peripheral_config = &peripheral;
-	config.peripheral_size = sizeof(peripheral);
+	peripheral = devm_kzalloc(gi2c->se.dev, sizeof(*peripheral), GFP_KERNEL);
+	if (!peripheral)
+		return -ENOMEM;
+
+	config.peripheral_config = peripheral;
+	config.peripheral_size = sizeof(struct gpi_i2c_config);
 
-	peripheral.pack_enable = I2C_PACK_TX | I2C_PACK_RX;
-	peripheral.cycle_count = itr->t_cycle_cnt;
-	peripheral.high_count = itr->t_high_cnt;
-	peripheral.low_count = itr->t_low_cnt;
-	peripheral.clk_div = itr->clk_div;
-	peripheral.set_config = 1;
-	peripheral.multi_msg = false;
+	peripheral->pack_enable = I2C_PACK_TX | I2C_PACK_RX;
+	peripheral->cycle_count = itr->t_cycle_cnt;
+	peripheral->high_count = itr->t_high_cnt;
+	peripheral->low_count = itr->t_low_cnt;
+	peripheral->clk_div = itr->clk_div;
+	peripheral->set_config = 1;
+	peripheral->multi_msg = false;
+	peripheral->gi2c = gi2c;
 
+	if (gi2c->is_shared)
+		peripheral->shared_se = true;
+
+	i2c_trace_log(gi2c->se.dev, "%s: num:%d addr:0x%x\n",
+		      __func__, num, msgs[0].addr);
 	for (i = 0; i < num; i++) {
 		gi2c->cur = &msgs[i];
 		gi2c->err = 0;
-		dev_dbg(gi2c->se.dev, "msg[%d].len:%d\n", i, gi2c->cur->len);
+		i2c_trace_log(gi2c->se.dev, "msg[%d].len:%d\n", i, gi2c->cur->len);
 
-		peripheral.stretch = 0;
+		peripheral->first_msg = (i == 0) ? 1 : 0;
+		peripheral->last_msg = (i == num - 1) ? 1 : 0;
+		peripheral->stretch = 0;
 		if (i < num - 1)
-			peripheral.stretch = 1;
+			peripheral->stretch = 1;
 
-		peripheral.addr = msgs[i].addr;
+		peripheral->addr = msgs[i].addr;
 
 		ret =  geni_i2c_gpi(gi2c, &msgs[i], &config,
 				    &tx_addr, &tx_buf, I2C_WRITE, gi2c->tx_c);
@@ -629,12 +671,9 @@
 
 		dma_async_issue_pending(gi2c->tx_c);
 
-		timeout = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
-		if (!timeout) {
-			dev_err(gi2c->se.dev, "I2C timeout gpi flags:%d addr:0x%x\n",
-				gi2c->cur->flags, gi2c->cur->addr);
+		time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
+		if (!time_left)
 			gi2c->err = -ETIMEDOUT;
-		}
 
 		if (gi2c->err) {
 			ret = gi2c->err;
@@ -659,17 +698,23 @@
 {
 	int i, ret = 0;
 
+	i2c_trace_log(gi2c->se.dev, "%s: num:%d addr:0x%x\n",
+		      __func__, num, msgs[0].addr);
 	for (i = 0; i < num; i++) {
 		u32 m_param = i < (num - 1) ? STOP_STRETCH : 0;
 
 		m_param |= ((msgs[i].addr << SLV_ADDR_SHFT) & SLV_ADDR_MSK);
 
 		gi2c->cur = &msgs[i];
-		if (msgs[i].flags & I2C_M_RD)
+		if (msgs[i].flags & I2C_M_RD) {
+			i2c_trace_log(gi2c->se.dev, "%s: msgs[%d].len:%d R\n",
+				      __func__, i, gi2c->cur->len);
 			ret = geni_i2c_rx_one_msg(gi2c, &msgs[i], m_param);
-		else
+		} else {
+			i2c_trace_log(gi2c->se.dev, "%s: msgs[%d].len:%d W\n",
+				      __func__, i, gi2c->cur->len);
 			ret = geni_i2c_tx_one_msg(gi2c, &msgs[i], m_param);
-
+		}
 		if (ret)
 			return ret;
 	}
@@ -682,17 +727,24 @@
 			 int num)
 {
 	struct geni_i2c_dev *gi2c = i2c_get_adapdata(adap);
+	struct device *dev = gi2c->se.dev;
 	int ret;
 
 	gi2c->err = 0;
 	reinit_completion(&gi2c->done);
 	ret = pm_runtime_get_sync(gi2c->se.dev);
-	if (ret < 0) {
-		dev_err(gi2c->se.dev, "error turning SE resources:%d\n", ret);
-		pm_runtime_put_noidle(gi2c->se.dev);
-		/* Set device in suspended since resume failed */
-		pm_runtime_set_suspended(gi2c->se.dev);
-		return ret;
+	if (ret < 0 && gi2c->suspended) {
+		i2c_trace_log(gi2c->se.dev, "%s: pm_runtime_get_sync failed ! doing force resume\n",
+			      __func__);
+		ret = geni_i2c_runtime_resume(gi2c->se.dev);
+		if (ret) {
+			dev_err(gi2c->se.dev, "error turning SE resources:%d\n", ret);
+			pm_runtime_put_noidle(gi2c->se.dev);
+			/* Set device in suspended since resume failed */
+			pm_runtime_set_suspended(gi2c->se.dev);
+			return ret;
+		}
+		atomic_inc(&dev->power.usage_count);
 	}
 
 	qcom_geni_i2c_conf(gi2c);
@@ -756,7 +808,7 @@
 		goto err_rx;
 	}
 
-	dev_dbg(gi2c->se.dev, "Grabbed GPI dma channels\n");
+	i2c_trace_log(gi2c->se.dev, "Grabbed GPI dma channels\n");
 	return 0;
 
 err_rx:
@@ -765,10 +817,39 @@
 	return ret;
 }
 
+/**
+ * geni_check_fw_validity: Function to checks firmware validity.
+ * @gi2c: geni i2c device.
+ *
+ * This function checks firmware validity by reading se protocol
+ * register. In case protocol value is not correct, it will try
+ * to load se firmware. if firmware load is failed, it will return
+ * failure. if firmware load is success, it will recheck firmware
+ * validity by checking proto value.
+ *
+ * return: Return 0 if no error, else return error value.
+ */
+static int geni_check_fw_validity(struct geni_i2c_dev *gi2c)
+{
+	struct device *dev = gi2c->se.dev;
+	u32 proto;
+	int ret;
+
+	proto = geni_se_read_proto(&gi2c->se);
+	if (proto != GENI_SE_I2C) {
+		ret = geni_load_se_firmware(&gi2c->se, GENI_SE_I2C);
+		if (ret) {
+			dev_err(dev, "Cannot load firmware from linux for i2c error: %d\n", ret);
+			return -ENXIO;
+		}
+	}
+	return 0;
+}
+
 static int geni_i2c_probe(struct platform_device *pdev)
 {
 	struct geni_i2c_dev *gi2c;
-	u32 proto, tx_depth, fifo_disable;
+	u32 tx_depth, fifo_disable;
 	int ret;
 	struct device *dev = &pdev->dev;
 	const struct geni_i2c_desc *desc = NULL;
@@ -798,7 +879,7 @@
 	ret = device_property_read_u32(dev, "clock-frequency",
 				       &gi2c->clk_freq_out);
 	if (ret) {
-		dev_info(dev, "Bus frequency not specified, default to 100kHz.\n");
+		i2c_trace_log(dev, "Bus frequency not specified, default to 100kHz.\n");
 		gi2c->clk_freq_out = KHZ(100);
 	}
 
@@ -820,15 +901,13 @@
 	init_completion(&gi2c->done);
 	spin_lock_init(&gi2c->lock);
 	platform_set_drvdata(pdev, gi2c);
-	ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, 0,
+	ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, IRQF_NO_AUTOEN | IRQF_EARLY_RESUME | IRQF_NO_SUSPEND,
 			       dev_name(dev), gi2c);
 	if (ret) {
 		dev_err(dev, "Request_irq failed:%d: err:%d\n",
 			gi2c->irq, ret);
 		return ret;
 	}
-	/* Disable the interrupt so that the system can enter low-power mode */
-	disable_irq(gi2c->irq);
 	i2c_set_adapdata(&gi2c->adap, gi2c);
 	gi2c->adap.dev.parent = dev;
 	gi2c->adap.dev.of_node = dev->of_node;
@@ -861,12 +940,12 @@
 		clk_disable_unprepare(gi2c->core_clk);
 		return ret;
 	}
-	proto = geni_se_read_proto(&gi2c->se);
-	if (proto != GENI_SE_I2C) {
-		dev_err(dev, "Invalid proto %d\n", proto);
+
+	ret = geni_check_fw_validity(gi2c);
+	if (ret) {
 		geni_se_resources_off(&gi2c->se);
 		clk_disable_unprepare(gi2c->core_clk);
-		return -ENXIO;
+		return ret;
 	}
 
 	if (desc && desc->no_dma_support)
@@ -884,7 +963,7 @@
 			return dev_err_probe(dev, ret, "Failed to setup GPI DMA mode\n");
 		}
 
-		dev_dbg(dev, "Using GPI DMA mode for I2C\n");
+		i2c_trace_log(dev, "Using GPI DMA mode for I2C\n");
 	} else {
 		gi2c->gpi_mode = false;
 		tx_depth = geni_se_get_tx_fifo_depth(&gi2c->se);
@@ -905,7 +984,12 @@
 		geni_se_config_packing(&gi2c->se, BITS_PER_BYTE,
 				       PACKING_BYTES_PW, true, true, true);
 
-		dev_dbg(dev, "i2c fifo/se-dma mode. fifo depth:%d\n", tx_depth);
+		i2c_trace_log(dev, "i2c fifo/se-dma mode. fifo depth:%d\n", tx_depth);
+	}
+
+	if (of_property_read_bool(pdev->dev.of_node, "qcom,shared-se")) {
+		gi2c->is_shared = true;
+		i2c_trace_log(&pdev->dev, "Multi-EE usecase with shared SE\n");
 	}
 
 	clk_disable_unprepare(gi2c->core_clk);
@@ -932,7 +1016,7 @@
 		goto err_dma;
 	}
 
-	dev_dbg(dev, "Geni-I2C adaptor successfully added\n");
+	i2c_trace_log(dev, "Geni-I2C adaptor successfully added\n");
 
 	return 0;
 
@@ -964,14 +1048,17 @@
 	struct geni_i2c_dev *gi2c = dev_get_drvdata(dev);
 
 	disable_irq(gi2c->irq);
-	ret = geni_se_resources_off(&gi2c->se);
-	if (ret) {
-		enable_irq(gi2c->irq);
-		return ret;
 
+	if (gi2c->is_shared) {
+		geni_se_clks_off(&gi2c->se);
 	} else {
-		gi2c->suspended = 1;
+		ret = geni_se_resources_off(&gi2c->se);
+		if (ret) {
+			enable_irq(gi2c->irq);
+			return ret;
+		}
 	}
+	gi2c->suspended = 1;
 
 	clk_disable_unprepare(gi2c->core_clk);
 
@@ -988,12 +1075,17 @@
 		return ret;
 
 	ret = clk_prepare_enable(gi2c->core_clk);
-	if (ret)
+	if (ret) {
+		geni_icc_disable(&gi2c->se);
 		return ret;
+	}
 
 	ret = geni_se_resources_on(&gi2c->se);
-	if (ret)
+	if (ret) {
+		clk_disable_unprepare(gi2c->core_clk);
+		geni_icc_disable(&gi2c->se);
 		return ret;
+	}
 
 	enable_irq(gi2c->irq);
 	gi2c->suspended = 0;
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-rcar.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-rcar.c
@@ -130,6 +130,8 @@
 #define ID_P_PM_BLOCKED		BIT(31)
 #define ID_P_MASK		GENMASK(31, 27)
 
+#define ID_SLAVE_NACK		BIT(0)
+
 enum rcar_i2c_type {
 	I2C_RCAR_GEN1,
 	I2C_RCAR_GEN2,
@@ -166,6 +168,7 @@
 	int irq;
 
 	struct i2c_client *host_notify_client;
+	u8 slave_flags;
 };
 
 #define rcar_i2c_priv_to_dev(p)		((p)->adap.dev.parent)
@@ -257,6 +260,14 @@
 	}
 }
 
+static void rcar_i2c_reset_slave(struct rcar_i2c_priv *priv)
+{
+	rcar_i2c_write(priv, ICSIER, 0);
+	rcar_i2c_write(priv, ICSSR, 0);
+	rcar_i2c_write(priv, ICSCR, SDBS);
+	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+}
+
 static int rcar_i2c_bus_barrier(struct rcar_i2c_priv *priv)
 {
 	int ret;
@@ -648,6 +659,7 @@
 {
 	u32 ssr_raw, ssr_filtered;
 	u8 value;
+	int ret;
 
 	ssr_raw = rcar_i2c_read(priv, ICSSR) & 0xff;
 	ssr_filtered = ssr_raw & rcar_i2c_read(priv, ICSIER);
@@ -663,7 +675,10 @@
 			rcar_i2c_write(priv, ICRXTX, value);
 			rcar_i2c_write(priv, ICSIER, SDE | SSR | SAR);
 		} else {
-			i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value);
+			ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value);
+			if (ret)
+				priv->slave_flags |= ID_SLAVE_NACK;
+
 			rcar_i2c_read(priv, ICRXTX);	/* dummy read */
 			rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR);
 		}
@@ -676,18 +691,21 @@
 	if (ssr_filtered & SSR) {
 		i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
 		rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
+		priv->slave_flags &= ~ID_SLAVE_NACK;
 		rcar_i2c_write(priv, ICSIER, SAR);
 		rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
 	}
 
 	/* master wants to write to us */
 	if (ssr_filtered & SDR) {
-		int ret;
-
 		value = rcar_i2c_read(priv, ICRXTX);
 		ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_RECEIVED, &value);
-		/* Send NACK in case of error */
-		rcar_i2c_write(priv, ICSCR, SIE | SDBS | (ret < 0 ? FNA : 0));
+		if (ret)
+			priv->slave_flags |= ID_SLAVE_NACK;
+
+		/* Send NACK in case of error, but it will come 1 byte late :( */
+		rcar_i2c_write(priv, ICSCR, SIE | SDBS |
+			       (priv->slave_flags & ID_SLAVE_NACK ? FNA : 0));
 		rcar_i2c_write(priv, ICSSR, ~SDR & 0xff);
 	}
 
@@ -875,6 +893,10 @@
 {
 	int ret;
 
+	/* Don't reset if a slave instance is currently running */
+	if (priv->slave)
+		return -EISCONN;
+
 	ret = reset_control_reset(priv->rstc);
 	if (ret)
 		return ret;
@@ -903,10 +925,10 @@
 
 	/* Gen3+ needs a reset. That also allows RXDMA once */
 	if (priv->devtype >= I2C_RCAR_GEN3) {
-		priv->flags &= ~ID_P_NO_RXDMA;
 		ret = rcar_i2c_do_reset(priv);
 		if (ret)
 			goto out;
+		priv->flags &= ~ID_P_NO_RXDMA;
 	}
 
 	rcar_i2c_init(priv);
@@ -1033,11 +1055,8 @@
 
 	/* ensure no irq is running before clearing ptr */
 	disable_irq(priv->irq);
-	rcar_i2c_write(priv, ICSIER, 0);
-	rcar_i2c_write(priv, ICSSR, 0);
+	rcar_i2c_reset_slave(priv);
 	enable_irq(priv->irq);
-	rcar_i2c_write(priv, ICSCR, SDBS);
-	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
 
 	priv->slave = NULL;
 
@@ -1152,7 +1171,9 @@
 		goto out_pm_disable;
 	}
 
-	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+	/* Bring hardware to known state */
+	rcar_i2c_init(priv);
+	rcar_i2c_reset_slave(priv);
 
 	if (priv->devtype < I2C_RCAR_GEN3) {
 		irqflags |= IRQF_NO_THREAD;
@@ -1168,6 +1189,7 @@
 	if (of_property_read_bool(dev->of_node, "smbus"))
 		priv->flags |= ID_P_HOST_NOTIFY;
 
+	/* R-Car Gen3+ needs a reset before every transfer */
 	if (priv->devtype >= I2C_RCAR_GEN3) {
 		priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
 		if (IS_ERR(priv->rstc)) {
@@ -1178,6 +1200,9 @@
 		ret = reset_control_status(priv->rstc);
 		if (ret < 0)
 			goto out_pm_put;
+
+		/* hard reset disturbs HostNotify local target, so disable it */
+		priv->flags &= ~ID_P_HOST_NOTIFY;
 	}
 
 	ret = platform_get_irq(pdev, 0);
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-riic.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-riic.c
@@ -324,7 +324,7 @@
 		if (brl <= (0x1F + 3))
 			break;
 
-		total_ticks /= 2;
+		total_ticks = DIV_ROUND_UP(total_ticks, 2);
 		rate /= 2;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-stm32f7.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-stm32f7.c
@@ -2395,7 +2395,7 @@
 	struct stm32f7_i2c_dev *i2c_dev = dev_get_drvdata(dev);
 
 	if (!stm32f7_i2c_is_slave_registered(i2c_dev))
-		clk_disable_unprepare(i2c_dev->clk);
+		clk_disable(i2c_dev->clk);
 
 	return 0;
 }
@@ -2406,9 +2406,9 @@
 	int ret;
 
 	if (!stm32f7_i2c_is_slave_registered(i2c_dev)) {
-		ret = clk_prepare_enable(i2c_dev->clk);
+		ret = clk_enable(i2c_dev->clk);
 		if (ret) {
-			dev_err(dev, "failed to prepare_enable clock\n");
+			dev_err(dev, "failed to enable clock\n");
 			return ret;
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-synquacer.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-synquacer.c
@@ -138,7 +138,6 @@
 	int			irq;
 	struct device		*dev;
 	void __iomem		*base;
-	struct clk		*pclk;
 	u32			pclkrate;
 	u32			speed_khz;
 	u32			timeout_ms;
@@ -535,6 +534,7 @@
 static int synquacer_i2c_probe(struct platform_device *pdev)
 {
 	struct synquacer_i2c *i2c;
+	struct clk *pclk;
 	u32 bus_speed;
 	int ret;
 
@@ -550,17 +550,13 @@
 	device_property_read_u32(&pdev->dev, "socionext,pclk-rate",
 				 &i2c->pclkrate);
 
-	i2c->pclk = devm_clk_get(&pdev->dev, "pclk");
-	if (PTR_ERR(i2c->pclk) == -EPROBE_DEFER)
-		return -EPROBE_DEFER;
-	if (!IS_ERR_OR_NULL(i2c->pclk)) {
-		dev_dbg(&pdev->dev, "clock source %p\n", i2c->pclk);
-
-		ret = clk_prepare_enable(i2c->pclk);
-		if (ret)
-			return dev_err_probe(&pdev->dev, ret, "failed to enable clock\n");
-		i2c->pclkrate = clk_get_rate(i2c->pclk);
-	}
+	pclk = devm_clk_get_optional_enabled(&pdev->dev, "pclk");
+	if (IS_ERR(pclk))
+		return dev_err_probe(&pdev->dev, PTR_ERR(pclk),
+				     "failed to get and enable clock\n");
+
+	if (pclk)
+		i2c->pclkrate = clk_get_rate(pclk);
 
 	if (i2c->pclkrate < SYNQUACER_I2C_MIN_CLK_RATE ||
 	    i2c->pclkrate > SYNQUACER_I2C_MAX_CLK_RATE)
@@ -615,8 +611,6 @@
 	struct synquacer_i2c *i2c = platform_get_drvdata(pdev);
 
 	i2c_del_adapter(&i2c->adapter);
-	if (!IS_ERR(i2c->pclk))
-		clk_disable_unprepare(i2c->pclk);
 };
 
 static const struct of_device_id synquacer_i2c_dt_ids[] __maybe_unused = {
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-tegra.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-tegra.c
@@ -1804,9 +1804,9 @@
 	 * domain.
 	 *
 	 * VI I2C device shouldn't be marked as IRQ-safe because VI I2C won't
-	 * be used for atomic transfers.
+	 * be used for atomic transfers. ACPI device is not IRQ safe also.
 	 */
-	if (!IS_VI(i2c_dev))
+	if (!IS_VI(i2c_dev) && !has_acpi_companion(i2c_dev->dev))
 		pm_runtime_irq_safe(i2c_dev->dev);
 
 	pm_runtime_enable(i2c_dev->dev);
--- linux-qcom-6.8.0.orig/drivers/i2c/busses/i2c-xiic.c
+++ linux-qcom-6.8.0/drivers/i2c/busses/i2c-xiic.c
@@ -772,14 +772,17 @@
 			goto out;
 		}
 
-		xiic_fill_tx_fifo(i2c);
-
-		/* current message sent and there is space in the fifo */
-		if (!xiic_tx_space(i2c) && xiic_tx_fifo_space(i2c) >= 2) {
+		if (xiic_tx_space(i2c)) {
+			xiic_fill_tx_fifo(i2c);
+		} else {
+			/* current message fully written */
 			dev_dbg(i2c->adap.dev.parent,
 				"%s end of message sent, nmsgs: %d\n",
 				__func__, i2c->nmsgs);
-			if (i2c->nmsgs > 1) {
+			/* Don't move onto the next message until the TX FIFO empties,
+			 * to ensure that a NAK is not missed.
+			 */
+			if (i2c->nmsgs > 1 && (pend & XIIC_INTR_TX_EMPTY_MASK)) {
 				i2c->nmsgs--;
 				i2c->tx_msg++;
 				xfer_more = 1;
@@ -790,11 +793,7 @@
 					"%s Got TX IRQ but no more to do...\n",
 					__func__);
 			}
-		} else if (!xiic_tx_space(i2c) && (i2c->nmsgs == 1))
-			/* current frame is sent and is last,
-			 * make sure to disable tx half
-			 */
-			xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK);
+		}
 	}
 
 	if (pend & XIIC_INTR_BNB_MASK) {
@@ -844,23 +843,11 @@
 	return (sr & XIIC_SR_BUS_BUSY_MASK) ? -EBUSY : 0;
 }
 
-static int xiic_busy(struct xiic_i2c *i2c)
+static int xiic_wait_not_busy(struct xiic_i2c *i2c)
 {
 	int tries = 3;
 	int err;
 
-	if (i2c->tx_msg || i2c->rx_msg)
-		return -EBUSY;
-
-	/* In single master mode bus can only be busy, when in use by this
-	 * driver. If the register indicates bus being busy for some reason we
-	 * should ignore it, since bus will never be released and i2c will be
-	 * stuck forever.
-	 */
-	if (i2c->singlemaster) {
-		return 0;
-	}
-
 	/* for instance if previous transfer was terminated due to TX error
 	 * it might be that the bus is on it's way to become available
 	 * give it at most 3 ms to wake
@@ -1104,9 +1091,35 @@
 
 	mutex_lock(&i2c->lock);
 
-	ret = xiic_busy(i2c);
-	if (ret)
+	if (i2c->tx_msg || i2c->rx_msg) {
+		dev_err(i2c->adap.dev.parent,
+			"cannot start a transfer while busy\n");
+		ret = -EBUSY;
 		goto out;
+	}
+
+	/* In single master mode bus can only be busy, when in use by this
+	 * driver. If the register indicates bus being busy for some reason we
+	 * should ignore it, since bus will never be released and i2c will be
+	 * stuck forever.
+	 */
+	if (!i2c->singlemaster) {
+		ret = xiic_wait_not_busy(i2c);
+		if (ret) {
+			/* If the bus is stuck in a busy state, such as due to spurious low
+			 * pulses on the bus causing a false start condition to be detected,
+			 * then try to recover by re-initializing the controller and check
+			 * again if the bus is still busy.
+			 */
+			dev_warn(i2c->adap.dev.parent, "I2C bus busy timeout, reinitializing\n");
+			ret = xiic_reinit(i2c);
+			if (ret)
+				goto out;
+			ret = xiic_wait_not_busy(i2c);
+			if (ret)
+				goto out;
+		}
+	}
 
 	i2c->tx_msg = msgs;
 	i2c->rx_msg = NULL;
@@ -1164,10 +1177,8 @@
 		return err;
 
 	err = xiic_start_xfer(i2c, msgs, num);
-	if (err < 0) {
-		dev_err(adap->dev.parent, "Error xiic_start_xfer\n");
+	if (err < 0)
 		goto out;
-	}
 
 	err = wait_for_completion_timeout(&i2c->completion, XIIC_XFER_TIMEOUT);
 	mutex_lock(&i2c->lock);
@@ -1326,8 +1337,8 @@
 	return 0;
 
 err_pm_disable:
-	pm_runtime_set_suspended(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
+	pm_runtime_set_suspended(&pdev->dev);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/i2c/i2c-atr.c
+++ linux-qcom-6.8.0/drivers/i2c/i2c-atr.c
@@ -412,7 +412,7 @@
 				dev_name(dev), ret);
 		break;
 
-	case BUS_NOTIFY_DEL_DEVICE:
+	case BUS_NOTIFY_REMOVED_DEVICE:
 		i2c_atr_detach_client(client->adapter, client);
 		break;
 
--- linux-qcom-6.8.0.orig/drivers/i2c/i2c-core-acpi.c
+++ linux-qcom-6.8.0/drivers/i2c/i2c-core-acpi.c
@@ -445,6 +445,11 @@
 	return i2c_find_device_by_fwnode(acpi_fwnode_handle(adev));
 }
 
+static struct i2c_adapter *i2c_acpi_find_adapter_by_adev(struct acpi_device *adev)
+{
+	return i2c_find_adapter_by_fwnode(acpi_fwnode_handle(adev));
+}
+
 static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value,
 			   void *arg)
 {
@@ -471,11 +476,17 @@
 			break;
 
 		client = i2c_acpi_find_client_by_adev(adev);
-		if (!client)
-			break;
+		if (client) {
+			i2c_unregister_device(client);
+			put_device(&client->dev);
+		}
+
+		adapter = i2c_acpi_find_adapter_by_adev(adev);
+		if (adapter) {
+			acpi_unbind_one(&adapter->dev);
+			put_device(&adapter->dev);
+		}
 
-		i2c_unregister_device(client);
-		put_device(&client->dev);
 		break;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/i2c/i2c-core-base.c
+++ linux-qcom-6.8.0/drivers/i2c/i2c-core-base.c
@@ -915,6 +915,27 @@
 	return 0;
 }
 
+/*
+ * Serialize device instantiation in case it can be instantiated explicitly
+ * and by auto-detection
+ */
+static int i2c_lock_addr(struct i2c_adapter *adap, unsigned short addr,
+			 unsigned short flags)
+{
+	if (!(flags & I2C_CLIENT_TEN) &&
+	    test_and_set_bit(addr, adap->addrs_in_instantiation))
+		return -EBUSY;
+
+	return 0;
+}
+
+static void i2c_unlock_addr(struct i2c_adapter *adap, unsigned short addr,
+			    unsigned short flags)
+{
+	if (!(flags & I2C_CLIENT_TEN))
+		clear_bit(addr, adap->addrs_in_instantiation);
+}
+
 /**
  * i2c_new_client_device - instantiate an i2c device
  * @adap: the adapter managing the device
@@ -962,6 +983,10 @@
 		goto out_err_silent;
 	}
 
+	status = i2c_lock_addr(adap, client->addr, client->flags);
+	if (status)
+		goto out_err_silent;
+
 	/* Check for address business */
 	status = i2c_check_addr_busy(adap, i2c_encode_flags_to_addr(client));
 	if (status)
@@ -993,6 +1018,8 @@
 	dev_dbg(&adap->dev, "client [%s] registered with bus id %s\n",
 		client->name, dev_name(&client->dev));
 
+	i2c_unlock_addr(adap, client->addr, client->flags);
+
 	return client;
 
 out_remove_swnode:
@@ -1004,6 +1031,7 @@
 	dev_err(&adap->dev,
 		"Failed to register i2c client %s at 0x%02x (%d)\n",
 		client->name, client->addr, status);
+	i2c_unlock_addr(adap, client->addr, client->flags);
 out_err_silent:
 	if (need_put)
 		put_device(&client->dev);
@@ -1067,6 +1095,7 @@
 
 static const struct i2c_device_id dummy_id[] = {
 	{ "dummy", 0 },
+	{ "smbus_host_notify", 0 },
 	{ },
 };
 
@@ -2200,13 +2229,18 @@
  * Returns negative errno, else the number of messages executed.
  *
  * Adapter lock must be held when calling this function. No debug logging
- * takes place. adap->algo->master_xfer existence isn't checked.
+ * takes place.
  */
 int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 {
 	unsigned long orig_jiffies;
 	int ret, try;
 
+	if (!adap->algo->master_xfer) {
+		dev_dbg(&adap->dev, "I2C level transfers not supported\n");
+		return -EOPNOTSUPP;
+	}
+
 	if (WARN_ON(!msgs || num < 1))
 		return -EINVAL;
 
@@ -2273,11 +2307,6 @@
 {
 	int ret;
 
-	if (!adap->algo->master_xfer) {
-		dev_dbg(&adap->dev, "I2C level transfers not supported\n");
-		return -EOPNOTSUPP;
-	}
-
 	/* REVISIT the fault reporting model here is weak:
 	 *
 	 *  - When we get an error after receiving N bytes from a slave,
--- linux-qcom-6.8.0.orig/drivers/i2c/i2c-slave-testunit.c
+++ linux-qcom-6.8.0/drivers/i2c/i2c-slave-testunit.c
@@ -33,6 +33,7 @@
 
 enum testunit_flags {
 	TU_FLAG_IN_PROCESS,
+	TU_FLAG_NACK,
 };
 
 struct testunit_data {
@@ -95,8 +96,10 @@
 
 	switch (event) {
 	case I2C_SLAVE_WRITE_RECEIVED:
-		if (test_bit(TU_FLAG_IN_PROCESS, &tu->flags))
-			return -EBUSY;
+		if (test_bit(TU_FLAG_IN_PROCESS | TU_FLAG_NACK, &tu->flags)) {
+			ret = -EBUSY;
+			break;
+		}
 
 		if (tu->reg_idx < TU_NUM_REGS)
 			tu->regs[tu->reg_idx] = *val;
@@ -118,9 +121,23 @@
 			queue_delayed_work(system_long_wq, &tu->worker,
 					   msecs_to_jiffies(10 * tu->regs[TU_REG_DELAY]));
 		}
-		fallthrough;
+
+		/*
+		 * Reset reg_idx to avoid that work gets queued again in case of
+		 * STOP after a following read message. But do not clear TU regs
+		 * here because we still need them in the workqueue!
+		 */
+		tu->reg_idx = 0;
+
+		clear_bit(TU_FLAG_NACK, &tu->flags);
+		break;
 
 	case I2C_SLAVE_WRITE_REQUESTED:
+		if (test_bit(TU_FLAG_IN_PROCESS | TU_FLAG_NACK, &tu->flags)) {
+			ret = -EBUSY;
+			break;
+		}
+
 		memset(tu->regs, 0, TU_NUM_REGS);
 		tu->reg_idx = 0;
 		break;
@@ -135,6 +152,10 @@
 		break;
 	}
 
+	/* If an error occurred somewhen, we NACK everything until next STOP */
+	if (ret)
+		set_bit(TU_FLAG_NACK, &tu->flags);
+
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/i2c/i2c-smbus.c
+++ linux-qcom-6.8.0/drivers/i2c/i2c-smbus.c
@@ -34,6 +34,7 @@
 	struct i2c_client *client = i2c_verify_client(dev);
 	struct alert_data *data = addrp;
 	struct i2c_driver *driver;
+	int ret;
 
 	if (!client || client->addr != data->addr)
 		return 0;
@@ -47,16 +48,47 @@
 	device_lock(dev);
 	if (client->dev.driver) {
 		driver = to_i2c_driver(client->dev.driver);
-		if (driver->alert)
+		if (driver->alert) {
+			/* Stop iterating after we find the device */
 			driver->alert(client, data->type, data->data);
-		else
+			ret = -EBUSY;
+		} else {
 			dev_warn(&client->dev, "no driver alert()!\n");
-	} else
+			ret = -EOPNOTSUPP;
+		}
+	} else {
 		dev_dbg(&client->dev, "alert with no driver\n");
+		ret = -ENODEV;
+	}
+	device_unlock(dev);
+
+	return ret;
+}
+
+/* Same as above, but call back all drivers with alert handler */
+
+static int smbus_do_alert_force(struct device *dev, void *addrp)
+{
+	struct i2c_client *client = i2c_verify_client(dev);
+	struct alert_data *data = addrp;
+	struct i2c_driver *driver;
+
+	if (!client || (client->flags & I2C_CLIENT_TEN))
+		return 0;
+
+	/*
+	 * Drivers should either disable alerts, or provide at least
+	 * a minimal handler. Lock so the driver won't change.
+	 */
+	device_lock(dev);
+	if (client->dev.driver) {
+		driver = to_i2c_driver(client->dev.driver);
+		if (driver->alert)
+			driver->alert(client, data->type, data->data);
+	}
 	device_unlock(dev);
 
-	/* Stop iterating after we find the device */
-	return -EBUSY;
+	return 0;
 }
 
 /*
@@ -67,6 +99,7 @@
 {
 	struct i2c_smbus_alert *alert = d;
 	struct i2c_client *ara;
+	unsigned short prev_addr = I2C_CLIENT_END; /* Not a valid address */
 
 	ara = alert->ara;
 
@@ -94,8 +127,25 @@
 			data.addr, data.data);
 
 		/* Notify driver for the device which issued the alert */
-		device_for_each_child(&ara->adapter->dev, &data,
-				      smbus_do_alert);
+		status = device_for_each_child(&ara->adapter->dev, &data,
+					       smbus_do_alert);
+		/*
+		 * If we read the same address more than once, and the alert
+		 * was not handled by a driver, it won't do any good to repeat
+		 * the loop because it will never terminate. Try again, this
+		 * time calling the alert handlers of all devices connected to
+		 * the bus, and abort the loop afterwards. If this helps, we
+		 * are all set. If it doesn't, there is nothing else we can do,
+		 * so we might as well abort the loop.
+		 * Note: This assumes that a driver with alert handler handles
+		 * the alert properly and clears it if necessary.
+		 */
+		if (data.addr == prev_addr && status != -EBUSY) {
+			device_for_each_child(&ara->adapter->dev, &data,
+					      smbus_do_alert_force);
+			break;
+		}
+		prev_addr = data.addr;
 	}
 
 	return IRQ_HANDLED;
--- linux-qcom-6.8.0.orig/drivers/i2c/muxes/i2c-demux-pinctrl.c
+++ linux-qcom-6.8.0/drivers/i2c/muxes/i2c-demux-pinctrl.c
@@ -261,7 +261,9 @@
 	pm_runtime_no_callbacks(&pdev->dev);
 
 	/* switch to first parent as active master */
-	i2c_demux_activate_master(priv, 0);
+	err = i2c_demux_activate_master(priv, 0);
+	if (err)
+		goto err_rollback;
 
 	err = device_create_file(&pdev->dev, &dev_attr_available_masters);
 	if (err)
--- linux-qcom-6.8.0.orig/drivers/i3c/master.c
+++ linux-qcom-6.8.0/drivers/i3c/master.c
@@ -281,7 +281,8 @@
 	struct i3c_device_info devinfo;
 	u16 manuf, part, ext;
 
-	i3c_device_get_info(i3cdev, &devinfo);
+	if (i3cdev->desc)
+		devinfo = i3cdev->desc->info;
 	manuf = I3C_PID_MANUF_ID(devinfo.pid);
 	part = I3C_PID_PART_ID(devinfo.pid);
 	ext = I3C_PID_EXTRA_INFO(devinfo.pid);
@@ -343,10 +344,10 @@
 };
 
 static enum i3c_addr_slot_status
-i3c_bus_get_addr_slot_status(struct i3c_bus *bus, u16 addr)
+i3c_bus_get_addr_slot_status_mask(struct i3c_bus *bus, u16 addr, u32 mask)
 {
 	unsigned long status;
-	int bitpos = addr * 2;
+	int bitpos = addr * I3C_ADDR_SLOT_STATUS_BITS;
 
 	if (addr > I2C_MAX_ADDR)
 		return I3C_ADDR_SLOT_RSVD;
@@ -354,22 +355,33 @@
 	status = bus->addrslots[bitpos / BITS_PER_LONG];
 	status >>= bitpos % BITS_PER_LONG;
 
-	return status & I3C_ADDR_SLOT_STATUS_MASK;
+	return status & mask;
 }
 
-static void i3c_bus_set_addr_slot_status(struct i3c_bus *bus, u16 addr,
-					 enum i3c_addr_slot_status status)
+static enum i3c_addr_slot_status
+i3c_bus_get_addr_slot_status(struct i3c_bus *bus, u16 addr)
 {
-	int bitpos = addr * 2;
+	return i3c_bus_get_addr_slot_status_mask(bus, addr, I3C_ADDR_SLOT_STATUS_MASK);
+}
+
+static void i3c_bus_set_addr_slot_status_mask(struct i3c_bus *bus, u16 addr,
+					      enum i3c_addr_slot_status status, u32 mask)
+{
+	int bitpos = addr * I3C_ADDR_SLOT_STATUS_BITS;
 	unsigned long *ptr;
 
 	if (addr > I2C_MAX_ADDR)
 		return;
 
 	ptr = bus->addrslots + (bitpos / BITS_PER_LONG);
-	*ptr &= ~((unsigned long)I3C_ADDR_SLOT_STATUS_MASK <<
-						(bitpos % BITS_PER_LONG));
-	*ptr |= (unsigned long)status << (bitpos % BITS_PER_LONG);
+	*ptr &= ~((unsigned long)mask << (bitpos % BITS_PER_LONG));
+	*ptr |= ((unsigned long)status & mask) << (bitpos % BITS_PER_LONG);
+}
+
+static void i3c_bus_set_addr_slot_status(struct i3c_bus *bus, u16 addr,
+					 enum i3c_addr_slot_status status)
+{
+	i3c_bus_set_addr_slot_status_mask(bus, addr, status, I3C_ADDR_SLOT_STATUS_MASK);
 }
 
 static bool i3c_bus_dev_addr_is_avail(struct i3c_bus *bus, u8 addr)
@@ -381,13 +393,44 @@
 	return status == I3C_ADDR_SLOT_FREE;
 }
 
+/*
+ * ┌────┬─────────────┬───┬─────────┬───┐
+ * │S/Sr│ 7'h7E RnW=0 │ACK│ ENTDAA  │ T ├────┐
+ * └────┴─────────────┴───┴─────────┴───┘    │
+ * ┌─────────────────────────────────────────┘
+ * │  ┌──┬─────────────┬───┬─────────────────┬────────────────┬───┬─────────┐
+ * └─►│Sr│7'h7E RnW=1  │ACK│48bit UID BCR DCR│Assign 7bit Addr│PAR│ ACK/NACK│
+ *    └──┴─────────────┴───┴─────────────────┴────────────────┴───┴─────────┘
+ * Some master controllers (such as HCI) need to prepare the entire above transaction before
+ * sending it out to the I3C bus. This means that a 7-bit dynamic address needs to be allocated
+ * before knowing the target device's UID information.
+ *
+ * However, some I3C targets may request specific addresses (called as "init_dyn_addr"), which is
+ * typically specified by the DT-'s assigned-address property. Lower addresses having higher IBI
+ * priority. If it is available, i3c_bus_get_free_addr() preferably return a free address that is
+ * not in the list of desired addresses (called as "init_dyn_addr"). This allows the device with
+ * the "init_dyn_addr" to switch to its "init_dyn_addr" when it hot-joins the I3C bus. Otherwise,
+ * if the "init_dyn_addr" is already in use by another I3C device, the target device will not be
+ * able to switch to its desired address.
+ *
+ * If the previous step fails, fallback returning one of the remaining unassigned address,
+ * regardless of its state in the desired list.
+ */
 static int i3c_bus_get_free_addr(struct i3c_bus *bus, u8 start_addr)
 {
 	enum i3c_addr_slot_status status;
 	u8 addr;
 
 	for (addr = start_addr; addr < I3C_MAX_ADDR; addr++) {
-		status = i3c_bus_get_addr_slot_status(bus, addr);
+		status = i3c_bus_get_addr_slot_status_mask(bus, addr,
+							   I3C_ADDR_SLOT_EXT_STATUS_MASK);
+		if (status == I3C_ADDR_SLOT_FREE)
+			return addr;
+	}
+
+	for (addr = start_addr; addr < I3C_MAX_ADDR; addr++) {
+		status = i3c_bus_get_addr_slot_status_mask(bus, addr,
+							   I3C_ADDR_SLOT_STATUS_MASK);
 		if (status == I3C_ADDR_SLOT_FREE)
 			return addr;
 	}
@@ -1415,7 +1458,7 @@
 					     I3C_ADDR_SLOT_FREE);
 
 	if (dev->boardinfo && dev->boardinfo->init_dyn_addr)
-		i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr,
+		i3c_bus_set_addr_slot_status(&master->bus, dev->boardinfo->init_dyn_addr,
 					     I3C_ADDR_SLOT_FREE);
 }
 
@@ -1504,16 +1547,9 @@
 				       u8 old_dyn_addr)
 {
 	struct i3c_master_controller *master = i3c_dev_get_master(dev);
-	enum i3c_addr_slot_status status;
 	int ret;
 
-	if (dev->info.dyn_addr != old_dyn_addr &&
-	    (!dev->boardinfo ||
-	     dev->info.dyn_addr != dev->boardinfo->init_dyn_addr)) {
-		status = i3c_bus_get_addr_slot_status(&master->bus,
-						      dev->info.dyn_addr);
-		if (status != I3C_ADDR_SLOT_FREE)
-			return -EBUSY;
+	if (dev->info.dyn_addr != old_dyn_addr) {
 		i3c_bus_set_addr_slot_status(&master->bus,
 					     dev->info.dyn_addr,
 					     I3C_ADDR_SLOT_I3C_DEV);
@@ -1866,6 +1902,12 @@
 		goto err_bus_cleanup;
 	}
 
+	if (master->ops->set_speed) {
+		ret = master->ops->set_speed(master, I3C_OPEN_DRAIN_SLOW_SPEED);
+		if (ret)
+			goto err_bus_cleanup;
+	}
+
 	/*
 	 * Reset all dynamic address that may have been assigned before
 	 * (assigned by the bootloader for example).
@@ -1874,6 +1916,12 @@
 	if (ret && ret != I3C_ERROR_M2)
 		goto err_bus_cleanup;
 
+	if (master->ops->set_speed) {
+		ret = master->ops->set_speed(master, I3C_OPEN_DRAIN_NORMAL_SPEED);
+		if (ret)
+			goto err_bus_cleanup;
+	}
+
 	/* Disable all slave events before starting DAA. */
 	ret = i3c_master_disec_locked(master, I3C_BROADCAST_ADDR,
 				      I3C_CCC_EVENT_SIR | I3C_CCC_EVENT_MR |
@@ -1904,9 +1952,11 @@
 			goto err_rstdaa;
 		}
 
-		i3c_bus_set_addr_slot_status(&master->bus,
-					     i3cboardinfo->init_dyn_addr,
-					     I3C_ADDR_SLOT_I3C_DEV);
+		/* Do not mark as occupied until real device exist in bus */
+		i3c_bus_set_addr_slot_status_mask(&master->bus,
+						  i3cboardinfo->init_dyn_addr,
+						  I3C_ADDR_SLOT_EXT_DESIRED,
+						  I3C_ADDR_SLOT_EXT_STATUS_MASK);
 
 		/*
 		 * Only try to create/attach devices that have a static
@@ -2037,11 +2087,16 @@
 			ibireq.max_payload_len = olddev->ibi->max_payload_len;
 			ibireq.num_slots = olddev->ibi->num_slots;
 
-			if (olddev->ibi->enabled) {
+			if (olddev->ibi->enabled)
 				enable_ibi = true;
-				i3c_dev_disable_ibi_locked(olddev);
-			}
-
+			/*
+			 * The olddev should not receive any commands on the
+			 * i3c bus as it does not exist and has been assigned
+			 * a new address. This will result in NACK or timeout.
+			 * So, update the olddev->ibi->enabled flag to false
+			 * to avoid DISEC with OldAddr.
+			 */
+			olddev->ibi->enabled = false;
 			i3c_dev_free_ibi_locked(olddev);
 		}
 		mutex_unlock(&olddev->ibi_lock);
@@ -2069,7 +2124,8 @@
 	else
 		expected_dyn_addr = newdev->info.dyn_addr;
 
-	if (newdev->info.dyn_addr != expected_dyn_addr) {
+	if (newdev->info.dyn_addr != expected_dyn_addr &&
+	    i3c_bus_get_addr_slot_status(&master->bus, expected_dyn_addr) == I3C_ADDR_SLOT_FREE) {
 		/*
 		 * Try to apply the expected dynamic address. If it fails, keep
 		 * the address assigned by the master.
--- linux-qcom-6.8.0.orig/drivers/i3c/master/dw-i3c-master.c
+++ linux-qcom-6.8.0/drivers/i3c/master/dw-i3c-master.c
@@ -1163,8 +1163,10 @@
 		global = reg == 0xffffffff;
 		reg &= ~BIT(idx);
 	} else {
-		global = reg == 0;
+		bool hj_rejected = !!(readl(master->regs + DEVICE_CTRL) & DEV_CTRL_HOT_JOIN_NACK);
+
 		reg |= BIT(idx);
+		global = (reg == 0xffffffff) && hj_rejected;
 	}
 	writel(reg, master->regs + IBI_SIR_REQ_REJECT);
 
--- linux-qcom-6.8.0.orig/drivers/i3c/master/i3c-master-cdns.c
+++ linux-qcom-6.8.0/drivers/i3c/master/i3c-master-cdns.c
@@ -1666,6 +1666,7 @@
 {
 	struct cdns_i3c_master *master = platform_get_drvdata(pdev);
 
+	cancel_work_sync(&master->hj_work);
 	i3c_master_unregister(&master->base);
 
 	clk_disable_unprepare(master->sysclk);
--- linux-qcom-6.8.0.orig/drivers/i3c/master/mipi-i3c-hci/core.c
+++ linux-qcom-6.8.0/drivers/i3c/master/mipi-i3c-hci/core.c
@@ -631,6 +631,7 @@
 static int i3c_hci_init(struct i3c_hci *hci)
 {
 	u32 regval, offset;
+	bool size_in_dwords;
 	int ret;
 
 	/* Validate HCI hardware version */
@@ -654,11 +655,16 @@
 	hci->caps = reg_read(HC_CAPABILITIES);
 	DBG("caps = %#x", hci->caps);
 
+	size_in_dwords = hci->version_major < 1 ||
+			 (hci->version_major == 1 && hci->version_minor < 1);
+
 	regval = reg_read(DAT_SECTION);
 	offset = FIELD_GET(DAT_TABLE_OFFSET, regval);
 	hci->DAT_regs = offset ? hci->base_regs + offset : NULL;
 	hci->DAT_entries = FIELD_GET(DAT_TABLE_SIZE, regval);
 	hci->DAT_entry_size = FIELD_GET(DAT_ENTRY_SIZE, regval) ? 0 : 8;
+	if (size_in_dwords)
+		hci->DAT_entries = 4 * hci->DAT_entries / hci->DAT_entry_size;
 	dev_info(&hci->master.dev, "DAT: %u %u-bytes entries at offset %#x\n",
 		 hci->DAT_entries, hci->DAT_entry_size, offset);
 
@@ -667,6 +673,8 @@
 	hci->DCT_regs = offset ? hci->base_regs + offset : NULL;
 	hci->DCT_entries = FIELD_GET(DCT_TABLE_SIZE, regval);
 	hci->DCT_entry_size = FIELD_GET(DCT_ENTRY_SIZE, regval) ? 0 : 16;
+	if (size_in_dwords)
+		hci->DCT_entries = 4 * hci->DCT_entries / hci->DCT_entry_size;
 	dev_info(&hci->master.dev, "DCT: %u %u-bytes entries at offset %#x\n",
 		 hci->DCT_entries, hci->DCT_entry_size, offset);
 
--- linux-qcom-6.8.0.orig/drivers/i3c/master/mipi-i3c-hci/dma.c
+++ linux-qcom-6.8.0/drivers/i3c/master/mipi-i3c-hci/dma.c
@@ -174,10 +174,10 @@
 	for (i = 0; i < rings->total; i++) {
 		rh = &rings->headers[i];
 
+		rh_reg_write(INTR_SIGNAL_ENABLE, 0);
 		rh_reg_write(RING_CONTROL, 0);
 		rh_reg_write(CR_SETUP, 0);
 		rh_reg_write(IBI_SETUP, 0);
-		rh_reg_write(INTR_SIGNAL_ENABLE, 0);
 
 		if (rh->xfer)
 			dma_free_coherent(&hci->master.dev,
@@ -294,7 +294,10 @@
 
 		rh->ibi_chunk_sz = dma_get_cache_alignment();
 		rh->ibi_chunk_sz *= IBI_CHUNK_CACHELINES;
-		BUG_ON(rh->ibi_chunk_sz > 256);
+		if (rh->ibi_chunk_sz > 256) {
+			ret = -EINVAL;
+			goto err_out;
+		}
 
 		ibi_status_ring_sz = rh->ibi_status_sz * rh->ibi_status_entries;
 		ibi_data_ring_sz = rh->ibi_chunk_sz * rh->ibi_chunks_total;
--- linux-qcom-6.8.0.orig/drivers/i3c/master/svc-i3c-master.c
+++ linux-qcom-6.8.0/drivers/i3c/master/svc-i3c-master.c
@@ -128,8 +128,8 @@
 /* This parameter depends on the implementation and may be tuned */
 #define SVC_I3C_FIFO_SIZE 16
 
-#define SVC_I3C_EVENT_IBI	BIT(0)
-#define SVC_I3C_EVENT_HOTJOIN	BIT(1)
+#define SVC_I3C_EVENT_IBI	GENMASK(7, 0)
+#define SVC_I3C_EVENT_HOTJOIN	BIT(31)
 
 struct svc_i3c_cmd {
 	u8 addr;
@@ -182,6 +182,7 @@
  * @ibi.lock: IBI lock
  * @lock: Transfer lock, protect between IBI work thread and callbacks from master
  * @enabled_events: Bit masks for enable events (IBI, HotJoin).
+ * @mctrl_config: Configuration value in SVC_I3C_MCTRL for setting speed back.
  */
 struct svc_i3c_master {
 	struct i3c_master_controller base;
@@ -211,7 +212,8 @@
 		spinlock_t lock;
 	} ibi;
 	struct mutex lock;
-	int enabled_events;
+	u32 enabled_events;
+	u32 mctrl_config;
 };
 
 /**
@@ -415,6 +417,19 @@
 	int ret;
 
 	mutex_lock(&master->lock);
+	/*
+	 * IBIWON may be set before SVC_I3C_MCTRL_REQUEST_AUTO_IBI, causing
+	 * readl_relaxed_poll_timeout() to return immediately. Consequently,
+	 * ibitype will be 0 since it was last updated only after the 8th SCL
+	 * cycle, leading to missed client IBI handlers.
+	 *
+	 * A typical scenario is when IBIWON occurs and bus arbitration is lost
+	 * at svc_i3c_master_priv_xfers().
+	 *
+	 * Clear SVC_I3C_MINT_IBIWON before sending SVC_I3C_MCTRL_REQUEST_AUTO_IBI.
+	 */
+	writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
+
 	/* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
 	writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
 	       SVC_I3C_MCTRL_IBIRESP_AUTO,
@@ -429,9 +444,6 @@
 		goto reenable_ibis;
 	}
 
-	/* Clear the interrupt status */
-	writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
-
 	status = readl(master->regs + SVC_I3C_MSTATUS);
 	ibitype = SVC_I3C_MSTATUS_IBITYPE(status);
 	ibiaddr = SVC_I3C_MSTATUS_IBIADDR(status);
@@ -519,6 +531,54 @@
 	return IRQ_HANDLED;
 }
 
+static int svc_i3c_master_set_speed(struct i3c_master_controller *m,
+				     enum i3c_open_drain_speed speed)
+{
+	struct svc_i3c_master *master = to_svc_i3c_master(m);
+	struct i3c_bus *bus = i3c_master_get_bus(&master->base);
+	u32 ppbaud, odbaud, odhpp, mconfig;
+	unsigned long fclk_rate;
+	int ret;
+
+	ret = pm_runtime_resume_and_get(master->dev);
+	if (ret < 0) {
+		dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__);
+		return ret;
+	}
+
+	switch (speed) {
+	case I3C_OPEN_DRAIN_SLOW_SPEED:
+		fclk_rate = clk_get_rate(master->fclk);
+		if (!fclk_rate) {
+			ret = -EINVAL;
+			goto rpm_out;
+		}
+		/*
+		 * Set 50% duty-cycle I2C speed to I3C OPEN-DRAIN mode, so the first
+		 * broadcast address is visible to all I2C/I3C devices on the I3C bus.
+		 * I3C device working as a I2C device will turn off its 50ns Spike
+		 * Filter to change to I3C mode.
+		 */
+		mconfig = master->mctrl_config;
+		ppbaud = FIELD_GET(GENMASK(11, 8), mconfig);
+		odhpp = 0;
+		odbaud = DIV_ROUND_UP(fclk_rate, bus->scl_rate.i2c * (2 + 2 * ppbaud)) - 1;
+		mconfig &= ~GENMASK(24, 16);
+		mconfig |= SVC_I3C_MCONFIG_ODBAUD(odbaud) | SVC_I3C_MCONFIG_ODHPP(odhpp);
+		writel(mconfig, master->regs + SVC_I3C_MCONFIG);
+		break;
+	case I3C_OPEN_DRAIN_NORMAL_SPEED:
+		writel(master->mctrl_config, master->regs + SVC_I3C_MCONFIG);
+		break;
+	}
+
+rpm_out:
+	pm_runtime_mark_last_busy(master->dev);
+	pm_runtime_put_autosuspend(master->dev);
+
+	return ret;
+}
+
 static int svc_i3c_master_bus_init(struct i3c_master_controller *m)
 {
 	struct svc_i3c_master *master = to_svc_i3c_master(m);
@@ -601,6 +661,7 @@
 	      SVC_I3C_MCONFIG_I2CBAUD(i2cbaud);
 	writel(reg, master->regs + SVC_I3C_MCONFIG);
 
+	master->mctrl_config = reg;
 	/* Master core's registration */
 	ret = i3c_master_get_free_addr(m, 0);
 	if (ret < 0)
@@ -957,12 +1018,27 @@
 		goto rpm_out;
 	}
 
-	/* Register all devices who participated to the core */
-	for (i = 0; i < dev_nb; i++) {
-		ret = i3c_master_add_i3c_dev_locked(m, addrs[i]);
-		if (ret)
-			goto rpm_out;
-	}
+	/*
+	 * Register all devices who participated to the core
+	 *
+	 * If two devices (A and B) are detected in DAA and address 0xa is assigned to
+	 * device A and 0xb to device B, a failure in i3c_master_add_i3c_dev_locked()
+	 * for device A (addr: 0xa) could prevent device B (addr: 0xb) from being
+	 * registered on the bus. The I3C stack might still consider 0xb a free
+	 * address. If a subsequent Hotjoin occurs, 0xb might be assigned to Device A,
+	 * causing both devices A and B to use the same address 0xb, violating the I3C
+	 * specification.
+	 *
+	 * The return value for i3c_master_add_i3c_dev_locked() should not be checked
+	 * because subsequent steps will scan the entire I3C bus, independent of
+	 * whether i3c_master_add_i3c_dev_locked() returns success.
+	 *
+	 * If device A registration fails, there is still a chance to register device
+	 * B. i3c_master_add_i3c_dev_locked() can reset DAA if a failure occurs while
+	 * retrieving device information.
+	 */
+	for (i = 0; i < dev_nb; i++)
+		i3c_master_add_i3c_dev_locked(m, addrs[i]);
 
 	/* Configure IBI auto-rules */
 	ret = svc_i3c_update_ibirules(master);
@@ -1042,29 +1118,59 @@
 			       u8 *in, const u8 *out, unsigned int xfer_len,
 			       unsigned int *actual_len, bool continued)
 {
+	int retry = 2;
 	u32 reg;
 	int ret;
 
 	/* clean SVC_I3C_MINT_IBIWON w1c bits */
 	writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
 
-	writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
-	       xfer_type |
-	       SVC_I3C_MCTRL_IBIRESP_NACK |
-	       SVC_I3C_MCTRL_DIR(rnw) |
-	       SVC_I3C_MCTRL_ADDR(addr) |
-	       SVC_I3C_MCTRL_RDTERM(*actual_len),
-	       master->regs + SVC_I3C_MCTRL);
 
-	ret = readl_poll_timeout(master->regs + SVC_I3C_MSTATUS, reg,
+	while (retry--) {
+		writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
+		       xfer_type |
+		       SVC_I3C_MCTRL_IBIRESP_NACK |
+		       SVC_I3C_MCTRL_DIR(rnw) |
+		       SVC_I3C_MCTRL_ADDR(addr) |
+		       SVC_I3C_MCTRL_RDTERM(*actual_len),
+		       master->regs + SVC_I3C_MCTRL);
+
+		ret = readl_poll_timeout(master->regs + SVC_I3C_MSTATUS, reg,
 				 SVC_I3C_MSTATUS_MCTRLDONE(reg), 0, 1000);
-	if (ret)
-		goto emit_stop;
+		if (ret)
+			goto emit_stop;
 
-	if (readl(master->regs + SVC_I3C_MERRWARN) & SVC_I3C_MERRWARN_NACK) {
-		ret = -ENXIO;
-		*actual_len = 0;
-		goto emit_stop;
+		if (readl(master->regs + SVC_I3C_MERRWARN) & SVC_I3C_MERRWARN_NACK) {
+			/*
+			 * According to I3C Spec 1.1.1, 11-Jun-2021, section: 5.1.2.2.3.
+			 * If the Controller chooses to start an I3C Message with an I3C Dynamic
+			 * Address, then special provisions shall be made because that same I3C
+			 * Target may be initiating an IBI or a Controller Role Request. So, one of
+			 * three things may happen: (skip 1, 2)
+			 *
+			 * 3. The Addresses match and the RnW bits also match, and so neither
+			 * Controller nor Target will ACK since both are expecting the other side to
+			 * provide ACK. As a result, each side might think it had "won" arbitration,
+			 * but neither side would continue, as each would subsequently see that the
+			 * other did not provide ACK.
+			 * ...
+			 * For either value of RnW: Due to the NACK, the Controller shall defer the
+			 * Private Write or Private Read, and should typically transmit the Target
+			 * Address again after a Repeated START (i.e., the next one or any one prior
+			 * to a STOP in the Frame). Since the Address Header following a Repeated
+			 * START is not arbitrated, the Controller will always win (see Section
+			 * 5.1.2.2.4).
+			 */
+			if (retry && addr != 0x7e) {
+				writel(SVC_I3C_MERRWARN_NACK, master->regs + SVC_I3C_MERRWARN);
+			} else {
+				ret = -ENXIO;
+				*actual_len = 0;
+				goto emit_stop;
+			}
+		} else {
+			break;
+		}
 	}
 
 	/*
@@ -1080,7 +1186,7 @@
 	 * and yield the above events handler.
 	 */
 	if (SVC_I3C_MSTATUS_IBIWON(reg)) {
-		ret = -ENXIO;
+		ret = -EAGAIN;
 		*actual_len = 0;
 		goto emit_stop;
 	}
@@ -1495,7 +1601,7 @@
 		return ret;
 	}
 
-	master->enabled_events |= SVC_I3C_EVENT_IBI;
+	master->enabled_events++;
 	svc_i3c_master_enable_interrupts(master, SVC_I3C_MINT_SLVSTART);
 
 	return i3c_master_enec_locked(m, dev->info.dyn_addr, I3C_CCC_EVENT_SIR);
@@ -1507,7 +1613,7 @@
 	struct svc_i3c_master *master = to_svc_i3c_master(m);
 	int ret;
 
-	master->enabled_events &= ~SVC_I3C_EVENT_IBI;
+	master->enabled_events--;
 	if (!master->enabled_events)
 		svc_i3c_master_disable_interrupts(master);
 
@@ -1580,6 +1686,7 @@
 	.disable_ibi = svc_i3c_master_disable_ibi,
 	.enable_hotjoin = svc_i3c_master_enable_hotjoin,
 	.disable_hotjoin = svc_i3c_master_disable_hotjoin,
+	.set_speed = svc_i3c_master_set_speed,
 };
 
 static int svc_i3c_master_prepare_clks(struct svc_i3c_master *master)
@@ -1697,8 +1804,8 @@
 rpm_disable:
 	pm_runtime_dont_use_autosuspend(&pdev->dev);
 	pm_runtime_put_noidle(&pdev->dev);
-	pm_runtime_set_suspended(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
+	pm_runtime_set_suspended(&pdev->dev);
 
 err_disable_clks:
 	svc_i3c_master_unprepare_clks(master);
@@ -1710,6 +1817,7 @@
 {
 	struct svc_i3c_master *master = platform_get_drvdata(pdev);
 
+	cancel_work_sync(&master->hj_work);
 	i3c_master_unregister(&master->base);
 
 	pm_runtime_dont_use_autosuspend(&pdev->dev);
--- linux-qcom-6.8.0.orig/drivers/idle/intel_idle.c
+++ linux-qcom-6.8.0/drivers/idle/intel_idle.c
@@ -121,6 +121,12 @@
 #define CPUIDLE_FLAG_INIT_XSTATE	BIT(17)
 
 /*
+ * Ignore the sub-state when matching mwait hints between the ACPI _CST and
+ * custom tables.
+ */
+#define CPUIDLE_FLAG_PARTIAL_HINT_MATCH	BIT(18)
+
+/*
  * MWAIT takes an 8-bit "hint" in EAX "suggesting"
  * the C-state (top nibble) and sub-state (bottom nibble)
  * 0x00 means "MWAIT(C1)", 0x10 means "MWAIT(C2)" etc.
@@ -1022,6 +1028,88 @@
 		.enter = NULL }
 };
 
+static struct cpuidle_state gnr_cstates[] __initdata = {
+	{
+		.name = "C1",
+		.desc = "MWAIT 0x00",
+		.flags = MWAIT2flg(0x00),
+		.exit_latency = 1,
+		.target_residency = 1,
+		.enter = &intel_idle,
+		.enter_s2idle = intel_idle_s2idle, },
+	{
+		.name = "C1E",
+		.desc = "MWAIT 0x01",
+		.flags = MWAIT2flg(0x01) | CPUIDLE_FLAG_ALWAYS_ENABLE,
+		.exit_latency = 4,
+		.target_residency = 4,
+		.enter = &intel_idle,
+		.enter_s2idle = intel_idle_s2idle, },
+	{
+		.name = "C6",
+		.desc = "MWAIT 0x20",
+		.flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED |
+					   CPUIDLE_FLAG_INIT_XSTATE |
+					   CPUIDLE_FLAG_PARTIAL_HINT_MATCH,
+		.exit_latency = 170,
+		.target_residency = 650,
+		.enter = &intel_idle,
+		.enter_s2idle = intel_idle_s2idle, },
+	{
+		.name = "C6P",
+		.desc = "MWAIT 0x21",
+		.flags = MWAIT2flg(0x21) | CPUIDLE_FLAG_TLB_FLUSHED |
+					   CPUIDLE_FLAG_INIT_XSTATE |
+					   CPUIDLE_FLAG_PARTIAL_HINT_MATCH,
+		.exit_latency = 210,
+		.target_residency = 1000,
+		.enter = &intel_idle,
+		.enter_s2idle = intel_idle_s2idle, },
+	{
+		.enter = NULL }
+};
+
+static struct cpuidle_state gnrd_cstates[] __initdata = {
+	{
+		.name = "C1",
+		.desc = "MWAIT 0x00",
+		.flags = MWAIT2flg(0x00),
+		.exit_latency = 1,
+		.target_residency = 1,
+		.enter = &intel_idle,
+		.enter_s2idle = intel_idle_s2idle, },
+	{
+		.name = "C1E",
+		.desc = "MWAIT 0x01",
+		.flags = MWAIT2flg(0x01) | CPUIDLE_FLAG_ALWAYS_ENABLE,
+		.exit_latency = 4,
+		.target_residency = 4,
+		.enter = &intel_idle,
+		.enter_s2idle = intel_idle_s2idle, },
+	{
+		.name = "C6",
+		.desc = "MWAIT 0x20",
+		.flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED |
+					   CPUIDLE_FLAG_INIT_XSTATE |
+					   CPUIDLE_FLAG_PARTIAL_HINT_MATCH,
+		.exit_latency = 220,
+		.target_residency = 650,
+		.enter = &intel_idle,
+		.enter_s2idle = intel_idle_s2idle, },
+	{
+		.name = "C6P",
+		.desc = "MWAIT 0x21",
+		.flags = MWAIT2flg(0x21) | CPUIDLE_FLAG_TLB_FLUSHED |
+					   CPUIDLE_FLAG_INIT_XSTATE |
+					   CPUIDLE_FLAG_PARTIAL_HINT_MATCH,
+		.exit_latency = 240,
+		.target_residency = 750,
+		.enter = &intel_idle,
+		.enter_s2idle = intel_idle_s2idle, },
+	{
+		.enter = NULL }
+};
+
 static struct cpuidle_state atom_cstates[] __initdata = {
 	{
 		.name = "C1E",
@@ -1315,7 +1403,8 @@
 	{
 		.name = "C6S",
 		.desc = "MWAIT 0x22",
-		.flags = MWAIT2flg(0x22) | CPUIDLE_FLAG_TLB_FLUSHED,
+		.flags = MWAIT2flg(0x22) | CPUIDLE_FLAG_TLB_FLUSHED |
+					   CPUIDLE_FLAG_PARTIAL_HINT_MATCH,
 		.exit_latency = 270,
 		.target_residency = 700,
 		.enter = &intel_idle,
@@ -1323,7 +1412,8 @@
 	{
 		.name = "C6SP",
 		.desc = "MWAIT 0x23",
-		.flags = MWAIT2flg(0x23) | CPUIDLE_FLAG_TLB_FLUSHED,
+		.flags = MWAIT2flg(0x23) | CPUIDLE_FLAG_TLB_FLUSHED |
+					   CPUIDLE_FLAG_PARTIAL_HINT_MATCH,
 		.exit_latency = 310,
 		.target_residency = 900,
 		.enter = &intel_idle,
@@ -1453,6 +1543,18 @@
 	.use_acpi = true,
 };
 
+static const struct idle_cpu idle_cpu_gnr __initconst = {
+	.state_table = gnr_cstates,
+	.disable_promotion_to_c1e = true,
+	.use_acpi = true,
+};
+
+static const struct idle_cpu idle_cpu_gnrd __initconst = {
+	.state_table = gnrd_cstates,
+	.disable_promotion_to_c1e = true,
+	.use_acpi = true,
+};
+
 static const struct idle_cpu idle_cpu_avn __initconst = {
 	.state_table = avn_cstates,
 	.disable_promotion_to_c1e = true,
@@ -1475,6 +1577,10 @@
 	.use_acpi = true,
 };
 
+static const struct idle_cpu idle_cpu_tmt __initconst = {
+	.disable_promotion_to_c1e = true,
+};
+
 static const struct idle_cpu idle_cpu_snr __initconst = {
 	.state_table = snr_cstates,
 	.disable_promotion_to_c1e = true,
@@ -1533,11 +1639,15 @@
 	X86_MATCH_INTEL_FAM6_MODEL(ATOM_GRACEMONT,	&idle_cpu_gmt),
 	X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X,	&idle_cpu_spr),
 	X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X,	&idle_cpu_spr),
+	X86_MATCH_INTEL_FAM6_MODEL(GRANITERAPIDS_X,	&idle_cpu_gnr),
+	X86_MATCH_INTEL_FAM6_MODEL(GRANITERAPIDS_D,	&idle_cpu_gnrd),
 	X86_MATCH_INTEL_FAM6_MODEL(XEON_PHI_KNL,	&idle_cpu_knl),
 	X86_MATCH_INTEL_FAM6_MODEL(XEON_PHI_KNM,	&idle_cpu_knl),
 	X86_MATCH_INTEL_FAM6_MODEL(ATOM_GOLDMONT,	&idle_cpu_bxt),
 	X86_MATCH_INTEL_FAM6_MODEL(ATOM_GOLDMONT_PLUS,	&idle_cpu_bxt),
 	X86_MATCH_INTEL_FAM6_MODEL(ATOM_GOLDMONT_D,	&idle_cpu_dnv),
+	X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT,	&idle_cpu_tmt),
+	X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT_L,	&idle_cpu_tmt),
 	X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT_D,	&idle_cpu_snr),
 	X86_MATCH_INTEL_FAM6_MODEL(ATOM_CRESTMONT,	&idle_cpu_grr),
 	X86_MATCH_INTEL_FAM6_MODEL(ATOM_CRESTMONT_X,	&idle_cpu_srf),
@@ -1692,7 +1802,7 @@
 	}
 }
 
-static bool __init intel_idle_off_by_default(u32 mwait_hint)
+static bool __init intel_idle_off_by_default(unsigned int flags, u32 mwait_hint)
 {
 	int cstate, limit;
 
@@ -1709,7 +1819,15 @@
 	 * the interesting states are ACPI_CSTATE_FFH.
 	 */
 	for (cstate = 1; cstate < limit; cstate++) {
-		if (acpi_state_table.states[cstate].address == mwait_hint)
+		u32 acpi_hint = acpi_state_table.states[cstate].address;
+		u32 table_hint = mwait_hint;
+
+		if (flags & CPUIDLE_FLAG_PARTIAL_HINT_MATCH) {
+			acpi_hint &= ~MWAIT_SUBSTATE_MASK;
+			table_hint &= ~MWAIT_SUBSTATE_MASK;
+		}
+
+		if (acpi_hint == table_hint)
 			return false;
 	}
 	return true;
@@ -1719,7 +1837,10 @@
 
 static inline bool intel_idle_acpi_cst_extract(void) { return false; }
 static inline void intel_idle_init_cstates_acpi(struct cpuidle_driver *drv) { }
-static inline bool intel_idle_off_by_default(u32 mwait_hint) { return false; }
+static inline bool intel_idle_off_by_default(unsigned int flags, u32 mwait_hint)
+{
+	return false;
+}
 #endif /* !CONFIG_ACPI_PROCESSOR_CSTATE */
 
 /**
@@ -2045,7 +2166,7 @@
 
 		if ((disabled_states_mask & BIT(drv->state_count)) ||
 		    ((icpu->use_acpi || force_use_acpi) &&
-		     intel_idle_off_by_default(mwait_hint) &&
+		     intel_idle_off_by_default(state->flags, mwait_hint) &&
 		     !(state->flags & CPUIDLE_FLAG_ALWAYS_ENABLE)))
 			state->flags |= CPUIDLE_FLAG_OFF;
 
@@ -2074,7 +2195,7 @@
 
 	drv->state_count = 1;
 
-	if (icpu)
+	if (icpu && icpu->state_table)
 		intel_idle_init_cstates_icpu(drv);
 	else
 		intel_idle_init_cstates_acpi(drv);
@@ -2208,7 +2329,11 @@
 
 	icpu = (const struct idle_cpu *)id->driver_data;
 	if (icpu) {
-		cpuidle_state_table = icpu->state_table;
+		if (icpu->state_table)
+			cpuidle_state_table = icpu->state_table;
+		else if (!intel_idle_acpi_cst_extract())
+			return -ENODEV;
+
 		auto_demotion_disable_flags = icpu->auto_demotion_disable_flags;
 		if (icpu->disable_promotion_to_c1e)
 			c1e_promotion = C1E_PROMOTION_DISABLE;
--- linux-qcom-6.8.0.orig/drivers/iio/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/Kconfig
@@ -71,6 +71,15 @@
 	help
 	  Provides helper functions for setting up triggered events.
 
+config IIO_BACKEND
+	tristate
+	help
+	  Framework to handle complex IIO aggregate devices. The typical
+	  architecture that can make use of this framework is to have one
+	  device as the frontend device which can be "linked" against one or
+	  multiple backend devices. The framework then makes it easy to get
+	  and control such backend devices.
+
 source "drivers/iio/accel/Kconfig"
 source "drivers/iio/adc/Kconfig"
 source "drivers/iio/addac/Kconfig"
--- linux-qcom-6.8.0.orig/drivers/iio/Makefile
+++ linux-qcom-6.8.0/drivers/iio/Makefile
@@ -13,6 +13,7 @@
 obj-$(CONFIG_IIO_SW_DEVICE) += industrialio-sw-device.o
 obj-$(CONFIG_IIO_SW_TRIGGER) += industrialio-sw-trigger.o
 obj-$(CONFIG_IIO_TRIGGERED_EVENT) += industrialio-triggered-event.o
+obj-$(CONFIG_IIO_BACKEND) += industrialio-backend.o
 
 obj-y += accel/
 obj-y += adc/
--- linux-qcom-6.8.0.orig/drivers/iio/accel/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/accel/Kconfig
@@ -326,6 +326,8 @@
 config FXLS8962AF
 	tristate
 	depends on I2C || !I2C # cannot be built-in for modular I2C
+	select IIO_BUFFER
+	select IIO_KFIFO_BUF
 
 config FXLS8962AF_I2C
 	tristate "NXP FXLS8962AF/FXLS8964AF Accelerometer I2C Driver"
@@ -414,6 +416,8 @@
 
 config IIO_KX022A
 	tristate
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 
 config IIO_KX022A_SPI
 	tristate "Kionix KX022A tri-axis digital accelerometer SPI interface"
--- linux-qcom-6.8.0.orig/drivers/iio/accel/bma400_core.c
+++ linux-qcom-6.8.0/drivers/iio/accel/bma400_core.c
@@ -1219,7 +1219,8 @@
 static int bma400_tap_event_en(struct bma400_data *data,
 			       enum iio_event_direction dir, int state)
 {
-	unsigned int mask, field_value;
+	unsigned int mask;
+	unsigned int field_value = 0;
 	int ret;
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/iio/accel/kionix-kx022a.c
+++ linux-qcom-6.8.0/drivers/iio/accel/kionix-kx022a.c
@@ -594,7 +594,7 @@
 	if (ret)
 		return ret;
 
-	*val = le16_to_cpu(data->buffer[0]);
+	*val = (s16)le16_to_cpu(data->buffer[0]);
 
 	return IIO_VAL_INT;
 }
--- linux-qcom-6.8.0.orig/drivers/iio/accel/mxc4005.c
+++ linux-qcom-6.8.0/drivers/iio/accel/mxc4005.c
@@ -5,6 +5,7 @@
  * Copyright (c) 2014, Intel Corporation.
  */
 
+#include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/i2c.h>
 #include <linux/iio/iio.h>
@@ -27,11 +28,16 @@
 #define MXC4005_REG_ZOUT_UPPER		0x07
 #define MXC4005_REG_ZOUT_LOWER		0x08
 
+#define MXC4005_REG_INT_MASK0		0x0A
+
 #define MXC4005_REG_INT_MASK1		0x0B
 #define MXC4005_REG_INT_MASK1_BIT_DRDYE	0x01
 
+#define MXC4005_REG_INT_CLR0		0x00
+
 #define MXC4005_REG_INT_CLR1		0x01
 #define MXC4005_REG_INT_CLR1_BIT_DRDYC	0x01
+#define MXC4005_REG_INT_CLR1_SW_RST	0x10
 
 #define MXC4005_REG_CONTROL		0x0D
 #define MXC4005_REG_CONTROL_MASK_FSR	GENMASK(6, 5)
@@ -39,6 +45,9 @@
 
 #define MXC4005_REG_DEVICE_ID		0x0E
 
+/* Datasheet does not specify a reset time, this is a conservative guess */
+#define MXC4005_RESET_TIME_US		2000
+
 enum mxc4005_axis {
 	AXIS_X,
 	AXIS_Y,
@@ -62,6 +71,8 @@
 		s64 timestamp __aligned(8);
 	} scan;
 	bool trigger_enabled;
+	unsigned int control;
+	unsigned int int_mask1;
 };
 
 /*
@@ -113,7 +124,9 @@
 static bool mxc4005_is_writeable_reg(struct device *dev, unsigned int reg)
 {
 	switch (reg) {
+	case MXC4005_REG_INT_CLR0:
 	case MXC4005_REG_INT_CLR1:
+	case MXC4005_REG_INT_MASK0:
 	case MXC4005_REG_INT_MASK1:
 	case MXC4005_REG_CONTROL:
 		return true;
@@ -330,23 +343,20 @@
 {
 	struct iio_dev *indio_dev = iio_trigger_get_drvdata(trig);
 	struct mxc4005_data *data = iio_priv(indio_dev);
+	unsigned int val;
 	int ret;
 
 	mutex_lock(&data->mutex);
-	if (state) {
-		ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1,
-				   MXC4005_REG_INT_MASK1_BIT_DRDYE);
-	} else {
-		ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1,
-				   ~MXC4005_REG_INT_MASK1_BIT_DRDYE);
-	}
 
+	val = state ? MXC4005_REG_INT_MASK1_BIT_DRDYE : 0;
+	ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1, val);
 	if (ret < 0) {
 		mutex_unlock(&data->mutex);
 		dev_err(data->dev, "failed to update reg_int_mask1");
 		return ret;
 	}
 
+	data->int_mask1 = val;
 	data->trigger_enabled = state;
 	mutex_unlock(&data->mutex);
 
@@ -382,6 +392,21 @@
 
 	dev_dbg(data->dev, "MXC4005 chip id %02x\n", reg);
 
+	ret = regmap_write(data->regmap, MXC4005_REG_INT_CLR1,
+			   MXC4005_REG_INT_CLR1_SW_RST);
+	if (ret < 0)
+		return dev_err_probe(data->dev, ret, "resetting chip\n");
+
+	fsleep(MXC4005_RESET_TIME_US);
+
+	ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK0, 0);
+	if (ret < 0)
+		return dev_err_probe(data->dev, ret, "writing INT_MASK0\n");
+
+	ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1, 0);
+	if (ret < 0)
+		return dev_err_probe(data->dev, ret, "writing INT_MASK1\n");
+
 	return 0;
 }
 
@@ -469,6 +494,58 @@
 	return devm_iio_device_register(&client->dev, indio_dev);
 }
 
+static int mxc4005_suspend(struct device *dev)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct mxc4005_data *data = iio_priv(indio_dev);
+	int ret;
+
+	/* Save control to restore it on resume */
+	ret = regmap_read(data->regmap, MXC4005_REG_CONTROL, &data->control);
+	if (ret < 0)
+		dev_err(data->dev, "failed to read reg_control\n");
+
+	return ret;
+}
+
+static int mxc4005_resume(struct device *dev)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct mxc4005_data *data = iio_priv(indio_dev);
+	int ret;
+
+	ret = regmap_write(data->regmap, MXC4005_REG_INT_CLR1,
+			   MXC4005_REG_INT_CLR1_SW_RST);
+	if (ret) {
+		dev_err(data->dev, "failed to reset chip: %d\n", ret);
+		return ret;
+	}
+
+	fsleep(MXC4005_RESET_TIME_US);
+
+	ret = regmap_write(data->regmap, MXC4005_REG_CONTROL, data->control);
+	if (ret) {
+		dev_err(data->dev, "failed to restore control register\n");
+		return ret;
+	}
+
+	ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK0, 0);
+	if (ret) {
+		dev_err(data->dev, "failed to restore interrupt 0 mask\n");
+		return ret;
+	}
+
+	ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1, data->int_mask1);
+	if (ret) {
+		dev_err(data->dev, "failed to restore interrupt 1 mask\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+static DEFINE_SIMPLE_DEV_PM_OPS(mxc4005_pm_ops, mxc4005_suspend, mxc4005_resume);
+
 static const struct acpi_device_id mxc4005_acpi_match[] = {
 	{"MXC4005",	0},
 	{"MXC6655",	0},
@@ -495,6 +572,7 @@
 		.name = MXC4005_DRV_NAME,
 		.acpi_match_table = ACPI_PTR(mxc4005_acpi_match),
 		.of_match_table = mxc4005_of_match,
+		.pm = pm_sleep_ptr(&mxc4005_pm_ops),
 	},
 	.probe		= mxc4005_probe,
 	.id_table	= mxc4005_id,
--- linux-qcom-6.8.0.orig/drivers/iio/adc/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/adc/Kconfig
@@ -291,7 +291,7 @@
 config AD9467
 	tristate "Analog Devices AD9467 High Speed ADC driver"
 	depends on SPI
-	depends on ADI_AXI_ADC
+	select IIO_BACKEND
 	help
 	  Say yes here to build support for Analog Devices:
 	  * AD9467 16-Bit, 200 MSPS/250 MSPS Analog-to-Digital Converter
@@ -309,7 +309,7 @@
 	select IIO_BUFFER_HW_CONSUMER
 	select IIO_BUFFER_DMAENGINE
 	select REGMAP_MMIO
-	depends on OF
+	select IIO_BACKEND
 	help
 	  Say yes here to build support for Analog Devices Generic
 	  AXI ADC IP core. The IP core is used for interfacing with
@@ -1013,6 +1013,31 @@
 	  To compile this driver as a module, choose M here: the module will
 	  be called qcom-spmi-adc5.
 
+config QCOM_SPMI_ADC5_GEN3
+	tristate "Qualcomm Technologies Inc. SPMI PMIC5 GEN3 ADC"
+	depends on SPMI && THERMAL
+	select REGMAP_SPMI
+	select QCOM_VADC_COMMON
+	help
+	  This is the IIO Voltage PMIC5 Gen3 ADC driver for Qualcomm Technologies Inc. PMICs.
+
+	  The driver supports reading multiple channels. The ADC is a 16-bit
+	  sigma-delta ADC. The hardware supports calibrated results for
+	  conversion requests and clients include reading phone power supply
+	  voltage, on board system thermistors connected to the PMIC ADC,
+	  PMIC die temperature, charger temperature, battery current, USB voltage
+	  input and voltage signals connected to supported PMIC GPIO pins. The
+	  hardware supports internal pull-up for thermistors and can choose between
+	  a 30k, 100k or 400k ohm pull up using the ADC channels.
+
+	  In addition, the same driver supports ADC thermal monitoring devices too.
+	  They appear as thermal zones with multiple trip points. A thermal client sets
+	  threshold temperature for both warm and cool trips and gets updated when a
+	  threshold is reached.
+
+	  To compile this driver as a module, choose M here: the module will
+	  be called qcom-spmi-adc5-gen3.
+
 config RCAR_GYRO_ADC
 	tristate "Renesas R-Car GyroADC driver"
 	depends on ARCH_RCAR_GEN2 || COMPILE_TEST
@@ -1338,6 +1363,8 @@
 config TI_ADS8688
 	tristate "Texas Instruments ADS8688"
 	depends on SPI
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 	help
 	  If you say yes here you get support for Texas Instruments ADS8684 and
 	  and ADS8688 ADC chips
@@ -1348,6 +1375,8 @@
 config TI_ADS124S08
 	tristate "Texas Instruments ADS124S08"
 	depends on SPI
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 	help
 	  If you say yes here you get support for Texas Instruments ADS124S08
 	  and ADS124S06 ADC chips
@@ -1382,6 +1411,9 @@
 config TI_LMP92064
 	tristate "Texas Instruments LMP92064 ADC driver"
 	depends on SPI
+	select REGMAP_SPI
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 	help
 	  Say yes here to build support for the LMP92064 Precision Current and Voltage
 	  sensor.
--- linux-qcom-6.8.0.orig/drivers/iio/adc/Makefile
+++ linux-qcom-6.8.0/drivers/iio/adc/Makefile
@@ -88,6 +88,7 @@
 obj-$(CONFIG_NPCM_ADC) += npcm_adc.o
 obj-$(CONFIG_PALMAS_GPADC) += palmas_gpadc.o
 obj-$(CONFIG_QCOM_SPMI_ADC5) += qcom-spmi-adc5.o
+obj-$(CONFIG_QCOM_SPMI_ADC5_GEN3) += qcom-spmi-adc5-gen3.o
 obj-$(CONFIG_QCOM_SPMI_IADC) += qcom-spmi-iadc.o
 obj-$(CONFIG_QCOM_SPMI_RRADC) += qcom-spmi-rradc.o
 obj-$(CONFIG_QCOM_VADC_COMMON) += qcom-vadc-common.o
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad7124.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ad7124.c
@@ -14,7 +14,8 @@
 #include <linux/kernel.h>
 #include <linux/kfifo.h>
 #include <linux/module.h>
-#include <linux/of.h>
+#include <linux/mod_devicetable.h>
+#include <linux/property.h>
 #include <linux/regulator/consumer.h>
 #include <linux/spi/spi.h>
 
@@ -146,15 +147,18 @@
 struct ad7124_channel_config {
 	bool live;
 	unsigned int cfg_slot;
-	enum ad7124_ref_sel refsel;
-	bool bipolar;
-	bool buf_positive;
-	bool buf_negative;
-	unsigned int vref_mv;
-	unsigned int pga_bits;
-	unsigned int odr;
-	unsigned int odr_sel_bits;
-	unsigned int filter_type;
+	/* Following fields are used to compare equality. */
+	struct_group(config_props,
+		enum ad7124_ref_sel refsel;
+		bool bipolar;
+		bool buf_positive;
+		bool buf_negative;
+		unsigned int vref_mv;
+		unsigned int pga_bits;
+		unsigned int odr;
+		unsigned int odr_sel_bits;
+		unsigned int filter_type;
+	);
 };
 
 struct ad7124_channel {
@@ -333,11 +337,12 @@
 	ptrdiff_t cmp_size;
 	int i;
 
-	cmp_size = (u8 *)&cfg->live - (u8 *)cfg;
+	cmp_size = sizeof_field(struct ad7124_channel_config, config_props);
 	for (i = 0; i < st->num_channels; i++) {
 		cfg_aux = &st->channels[i].cfg;
 
-		if (cfg_aux->live && !memcmp(cfg, cfg_aux, cmp_size))
+		if (cfg_aux->live &&
+		    !memcmp(&cfg->config_props, &cfg_aux->config_props, cmp_size))
 			return cfg_aux;
 	}
 
@@ -638,7 +643,7 @@
 
 	switch (info) {
 	case IIO_CHAN_INFO_SAMP_FREQ:
-		if (val2 != 0) {
+		if (val2 != 0 || val == 0) {
 			ret = -EINVAL;
 			break;
 		}
@@ -761,6 +766,7 @@
 	if (ret < 0)
 		return ret;
 
+	fsleep(200);
 	timeout = 100;
 	do {
 		ret = ad_sd_read_reg(&st->sd, AD7124_STATUS, 1, &readval);
@@ -807,22 +813,19 @@
 	return 0;
 }
 
-static int ad7124_of_parse_channel_config(struct iio_dev *indio_dev,
-					  struct device_node *np)
+static int ad7124_parse_channel_config(struct iio_dev *indio_dev,
+				       struct device *dev)
 {
 	struct ad7124_state *st = iio_priv(indio_dev);
 	struct ad7124_channel_config *cfg;
 	struct ad7124_channel *channels;
-	struct device_node *child;
 	struct iio_chan_spec *chan;
 	unsigned int ain[2], channel = 0, tmp;
 	int ret;
 
-	st->num_channels = of_get_available_child_count(np);
-	if (!st->num_channels) {
-		dev_err(indio_dev->dev.parent, "no channel children\n");
-		return -ENODEV;
-	}
+	st->num_channels = device_get_child_node_count(dev);
+	if (!st->num_channels)
+		return dev_err_probe(dev, -ENODEV, "no channel children\n");
 
 	chan = devm_kcalloc(indio_dev->dev.parent, st->num_channels,
 			    sizeof(*chan), GFP_KERNEL);
@@ -838,39 +841,37 @@
 	indio_dev->num_channels = st->num_channels;
 	st->channels = channels;
 
-	for_each_available_child_of_node(np, child) {
-		cfg = &st->channels[channel].cfg;
-
-		ret = of_property_read_u32(child, "reg", &channel);
+	device_for_each_child_node_scoped(dev, child) {
+		ret = fwnode_property_read_u32(child, "reg", &channel);
 		if (ret)
-			goto err;
+			return ret;
 
-		if (channel >= indio_dev->num_channels) {
-			dev_err(indio_dev->dev.parent,
+		if (channel >= indio_dev->num_channels)
+			return dev_err_probe(dev, -EINVAL,
 				"Channel index >= number of channels\n");
-			ret = -EINVAL;
-			goto err;
-		}
 
-		ret = of_property_read_u32_array(child, "diff-channels",
-						 ain, 2);
+		ret = fwnode_property_read_u32_array(child, "diff-channels",
+						     ain, 2);
 		if (ret)
-			goto err;
+			return ret;
 
 		st->channels[channel].nr = channel;
 		st->channels[channel].ain = AD7124_CHANNEL_AINP(ain[0]) |
 						  AD7124_CHANNEL_AINM(ain[1]);
 
-		cfg->bipolar = of_property_read_bool(child, "bipolar");
+		cfg = &st->channels[channel].cfg;
+		cfg->bipolar = fwnode_property_read_bool(child, "bipolar");
 
-		ret = of_property_read_u32(child, "adi,reference-select", &tmp);
+		ret = fwnode_property_read_u32(child, "adi,reference-select", &tmp);
 		if (ret)
 			cfg->refsel = AD7124_INT_REF;
 		else
 			cfg->refsel = tmp;
 
-		cfg->buf_positive = of_property_read_bool(child, "adi,buffered-positive");
-		cfg->buf_negative = of_property_read_bool(child, "adi,buffered-negative");
+		cfg->buf_positive =
+			fwnode_property_read_bool(child, "adi,buffered-positive");
+		cfg->buf_negative =
+			fwnode_property_read_bool(child, "adi,buffered-negative");
 
 		chan[channel] = ad7124_channel_template;
 		chan[channel].address = channel;
@@ -880,10 +881,6 @@
 	}
 
 	return 0;
-err:
-	of_node_put(child);
-
-	return ret;
 }
 
 static int ad7124_setup(struct ad7124_state *st)
@@ -926,6 +923,9 @@
 		 * set all channels to this default value.
 		 */
 		ad7124_set_channel_odr(st, i, 10);
+
+		/* Disable all channels to prevent unintended conversions. */
+		ad_sd_write_reg(&st->sd, AD7124_CHANNEL(i), 2, 0);
 	}
 
 	return ret;
@@ -943,9 +943,7 @@
 	struct iio_dev *indio_dev;
 	int i, ret;
 
-	info = of_device_get_match_data(&spi->dev);
-	if (!info)
-		info = (void *)spi_get_device_id(spi)->driver_data;
+	info = spi_get_device_match_data(spi);
 	if (!info)
 		return -ENODEV;
 
@@ -965,7 +963,7 @@
 	if (ret < 0)
 		return ret;
 
-	ret = ad7124_of_parse_channel_config(indio_dev, spi->dev.of_node);
+	ret = ad7124_parse_channel_config(indio_dev, &spi->dev);
 	if (ret < 0)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad7192.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ad7192.c
@@ -17,7 +17,9 @@
 #include <linux/err.h>
 #include <linux/sched.h>
 #include <linux/delay.h>
-#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/property.h>
 
 #include <linux/iio/iio.h>
 #include <linux/iio/sysfs.h>
@@ -364,19 +366,19 @@
 		freq <= AD7192_EXT_FREQ_MHZ_MAX);
 }
 
-static int ad7192_of_clock_select(struct ad7192_state *st)
+static int ad7192_clock_select(struct ad7192_state *st)
 {
-	struct device_node *np = st->sd.spi->dev.of_node;
+	struct device *dev = &st->sd.spi->dev;
 	unsigned int clock_sel;
 
 	clock_sel = AD7192_CLK_INT;
 
 	/* use internal clock */
 	if (!st->mclk) {
-		if (of_property_read_bool(np, "adi,int-clock-output-enable"))
+		if (device_property_read_bool(dev, "adi,int-clock-output-enable"))
 			clock_sel = AD7192_CLK_INT_CO;
 	} else {
-		if (of_property_read_bool(np, "adi,clock-xtal"))
+		if (device_property_read_bool(dev, "adi,clock-xtal"))
 			clock_sel = AD7192_CLK_EXT_MCLK1_2;
 		else
 			clock_sel = AD7192_CLK_EXT_MCLK2;
@@ -385,7 +387,7 @@
 	return clock_sel;
 }
 
-static int ad7192_setup(struct iio_dev *indio_dev, struct device_node *np)
+static int ad7192_setup(struct iio_dev *indio_dev, struct device *dev)
 {
 	struct ad7192_state *st = iio_priv(indio_dev);
 	bool rej60_en, refin2_en;
@@ -407,7 +409,7 @@
 	id = FIELD_GET(AD7192_ID_MASK, id);
 
 	if (id != st->chip_info->chip_id)
-		dev_warn(&st->sd.spi->dev, "device ID query failed (0x%X != 0x%X)\n",
+		dev_warn(dev, "device ID query failed (0x%X != 0x%X)\n",
 			 id, st->chip_info->chip_id);
 
 	st->mode = FIELD_PREP(AD7192_MODE_SEL_MASK, AD7192_MODE_IDLE) |
@@ -416,30 +418,30 @@
 
 	st->conf = FIELD_PREP(AD7192_CONF_GAIN_MASK, 0);
 
-	rej60_en = of_property_read_bool(np, "adi,rejection-60-Hz-enable");
+	rej60_en = device_property_read_bool(dev, "adi,rejection-60-Hz-enable");
 	if (rej60_en)
 		st->mode |= AD7192_MODE_REJ60;
 
-	refin2_en = of_property_read_bool(np, "adi,refin2-pins-enable");
+	refin2_en = device_property_read_bool(dev, "adi,refin2-pins-enable");
 	if (refin2_en && st->chip_info->chip_id != CHIPID_AD7195)
 		st->conf |= AD7192_CONF_REFSEL;
 
 	st->conf &= ~AD7192_CONF_CHOP;
 
-	buf_en = of_property_read_bool(np, "adi,buffer-enable");
+	buf_en = device_property_read_bool(dev, "adi,buffer-enable");
 	if (buf_en)
 		st->conf |= AD7192_CONF_BUF;
 
-	bipolar = of_property_read_bool(np, "bipolar");
+	bipolar = device_property_read_bool(dev, "bipolar");
 	if (!bipolar)
 		st->conf |= AD7192_CONF_UNIPOLAR;
 
-	burnout_curr_en = of_property_read_bool(np,
-						"adi,burnout-currents-enable");
+	burnout_curr_en = device_property_read_bool(dev,
+						    "adi,burnout-currents-enable");
 	if (burnout_curr_en && buf_en) {
 		st->conf |= AD7192_CONF_BURN;
 	} else if (burnout_curr_en) {
-		dev_warn(&st->sd.spi->dev,
+		dev_warn(dev,
 			 "Can't enable burnout currents: see CHOP or buffer\n");
 	}
 
@@ -1117,9 +1119,10 @@
 	}
 	st->int_vref_mv = ret / 1000;
 
-	st->chip_info = of_device_get_match_data(&spi->dev);
+	st->chip_info = spi_get_device_match_data(spi);
 	if (!st->chip_info)
-		st->chip_info = (void *)spi_get_device_id(spi)->driver_data;
+		return -ENODEV;
+
 	indio_dev->name = st->chip_info->name;
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->channels = st->chip_info->channels;
@@ -1140,7 +1143,7 @@
 	if (IS_ERR(st->mclk))
 		return PTR_ERR(st->mclk);
 
-	st->clock_sel = ad7192_of_clock_select(st);
+	st->clock_sel = ad7192_clock_select(st);
 
 	if (st->clock_sel == AD7192_CLK_EXT_MCLK1_2 ||
 	    st->clock_sel == AD7192_CLK_EXT_MCLK2) {
@@ -1152,7 +1155,7 @@
 		}
 	}
 
-	ret = ad7192_setup(indio_dev, spi->dev.of_node);
+	ret = ad7192_setup(indio_dev, &spi->dev);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad7266.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ad7266.c
@@ -157,6 +157,8 @@
 		ret = ad7266_read_single(st, val, chan->address);
 		iio_device_release_direct_mode(indio_dev);
 
+		if (ret < 0)
+			return ret;
 		*val = (*val >> 2) & 0xfff;
 		if (chan->scan_type.sign == 's')
 			*val = sign_extend32(*val,
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad7606.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ad7606.c
@@ -49,7 +49,7 @@
 	1, 2, 4, 8, 16, 32, 64, 128,
 };
 
-static int ad7606_reset(struct ad7606_state *st)
+int ad7606_reset(struct ad7606_state *st)
 {
 	if (st->gpio_reset) {
 		gpiod_set_value(st->gpio_reset, 1);
@@ -60,6 +60,7 @@
 
 	return -ENODEV;
 }
+EXPORT_SYMBOL_NS_GPL(ad7606_reset, IIO_AD7606);
 
 static int ad7606_reg_access(struct iio_dev *indio_dev,
 			     unsigned int reg,
@@ -88,31 +89,6 @@
 {
 	unsigned int num = st->chip_info->num_channels - 1;
 	u16 *data = st->data;
-	int ret;
-
-	/*
-	 * The frstdata signal is set to high while and after reading the sample
-	 * of the first channel and low for all other channels. This can be used
-	 * to check that the incoming data is correctly aligned. During normal
-	 * operation the data should never become unaligned, but some glitch or
-	 * electrostatic discharge might cause an extra read or clock cycle.
-	 * Monitoring the frstdata signal allows to recover from such failure
-	 * situations.
-	 */
-
-	if (st->gpio_frstdata) {
-		ret = st->bops->read_block(st->dev, 1, data);
-		if (ret)
-			return ret;
-
-		if (!gpiod_get_value(st->gpio_frstdata)) {
-			ad7606_reset(st);
-			return -EIO;
-		}
-
-		data++;
-		num--;
-	}
 
 	return st->bops->read_block(st->dev, num, data);
 }
@@ -239,9 +215,9 @@
 	struct ad7606_state *st = iio_priv(indio_dev);
 	DECLARE_BITMAP(values, 3);
 
-	values[0] = val;
+	values[0] = val & GENMASK(2, 0);
 
-	gpiod_set_array_value(ARRAY_SIZE(values), st->gpio_os->desc,
+	gpiod_set_array_value(st->gpio_os->ndescs, st->gpio_os->desc,
 			      st->gpio_os->info, values);
 
 	/* AD7616 requires a reset to update value */
@@ -446,7 +422,7 @@
 		return PTR_ERR(st->gpio_range);
 
 	st->gpio_standby = devm_gpiod_get_optional(dev, "standby",
-						   GPIOD_OUT_HIGH);
+						   GPIOD_OUT_LOW);
 	if (IS_ERR(st->gpio_standby))
 		return PTR_ERR(st->gpio_standby);
 
@@ -689,7 +665,7 @@
 
 	if (st->gpio_standby) {
 		gpiod_set_value(st->gpio_range, 1);
-		gpiod_set_value(st->gpio_standby, 0);
+		gpiod_set_value(st->gpio_standby, 1);
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad7606.h
+++ linux-qcom-6.8.0/drivers/iio/adc/ad7606.h
@@ -151,6 +151,8 @@
 		 const char *name, unsigned int id,
 		 const struct ad7606_bus_ops *bops);
 
+int ad7606_reset(struct ad7606_state *st);
+
 enum ad7606_supported_device_ids {
 	ID_AD7605_4,
 	ID_AD7606_8,
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad7606_par.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ad7606_par.c
@@ -7,6 +7,7 @@
 
 #include <linux/mod_devicetable.h>
 #include <linux/module.h>
+#include <linux/gpio/consumer.h>
 #include <linux/platform_device.h>
 #include <linux/types.h>
 #include <linux/err.h>
@@ -21,8 +22,29 @@
 	struct iio_dev *indio_dev = dev_get_drvdata(dev);
 	struct ad7606_state *st = iio_priv(indio_dev);
 
-	insw((unsigned long)st->base_address, buf, count);
 
+	/*
+	 * On the parallel interface, the frstdata signal is set to high while
+	 * and after reading the sample of the first channel and low for all
+	 * other channels.  This can be used to check that the incoming data is
+	 * correctly aligned.  During normal operation the data should never
+	 * become unaligned, but some glitch or electrostatic discharge might
+	 * cause an extra read or clock cycle.  Monitoring the frstdata signal
+	 * allows to recover from such failure situations.
+	 */
+	int num = count;
+	u16 *_buf = buf;
+
+	if (st->gpio_frstdata) {
+		insw((unsigned long)st->base_address, _buf, 1);
+		if (!gpiod_get_value(st->gpio_frstdata)) {
+			ad7606_reset(st);
+			return -EIO;
+		}
+		_buf++;
+		num--;
+	}
+	insw((unsigned long)st->base_address, _buf, num);
 	return 0;
 }
 
@@ -35,8 +57,28 @@
 {
 	struct iio_dev *indio_dev = dev_get_drvdata(dev);
 	struct ad7606_state *st = iio_priv(indio_dev);
-
-	insb((unsigned long)st->base_address, buf, count * 2);
+	/*
+	 * On the parallel interface, the frstdata signal is set to high while
+	 * and after reading the sample of the first channel and low for all
+	 * other channels.  This can be used to check that the incoming data is
+	 * correctly aligned.  During normal operation the data should never
+	 * become unaligned, but some glitch or electrostatic discharge might
+	 * cause an extra read or clock cycle.  Monitoring the frstdata signal
+	 * allows to recover from such failure situations.
+	 */
+	int num = count;
+	u16 *_buf = buf;
+
+	if (st->gpio_frstdata) {
+		insb((unsigned long)st->base_address, _buf, 2);
+		if (!gpiod_get_value(st->gpio_frstdata)) {
+			ad7606_reset(st);
+			return -EIO;
+		}
+		_buf++;
+		num--;
+	}
+	insb((unsigned long)st->base_address, _buf, num * 2);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad7606_spi.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ad7606_spi.c
@@ -249,8 +249,9 @@
 static int ad7606B_sw_mode_config(struct iio_dev *indio_dev)
 {
 	struct ad7606_state *st = iio_priv(indio_dev);
-	unsigned long os[3] = {1};
+	DECLARE_BITMAP(os, 3);
 
+	bitmap_fill(os, 3);
 	/*
 	 * Software mode is enabled when all three oversampling
 	 * pins are set to high. If oversampling gpios are defined
@@ -258,7 +259,7 @@
 	 * otherwise, they must be hardwired to VDD
 	 */
 	if (st->gpio_os) {
-		gpiod_set_array_value(ARRAY_SIZE(os),
+		gpiod_set_array_value(st->gpio_os->ndescs,
 				      st->gpio_os->desc, st->gpio_os->info, os);
 	}
 	/* OS of 128 and 256 are available only in software mode */
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad7780.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ad7780.c
@@ -152,7 +152,7 @@
 
 	switch (m) {
 	case IIO_CHAN_INFO_SCALE:
-		if (val != 0)
+		if (val != 0 || val2 == 0)
 			return -EINVAL;
 
 		vref = st->int_vref_mv * 1000000LL;
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad7923.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ad7923.c
@@ -48,7 +48,7 @@
 
 struct ad7923_state {
 	struct spi_device		*spi;
-	struct spi_transfer		ring_xfer[5];
+	struct spi_transfer		ring_xfer[9];
 	struct spi_transfer		scan_single_xfer[2];
 	struct spi_message		ring_msg;
 	struct spi_message		scan_single_msg;
@@ -64,7 +64,7 @@
 	 * Length = 8 channels + 4 extra for 8 byte timestamp
 	 */
 	__be16				rx_buf[12] __aligned(IIO_DMA_MINALIGN);
-	__be16				tx_buf[4];
+	__be16				tx_buf[8];
 };
 
 struct ad7923_chip_info {
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ad9467.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ad9467.c
@@ -17,13 +17,12 @@
 #include <linux/of.h>
 
 
+#include <linux/iio/backend.h>
 #include <linux/iio/iio.h>
 #include <linux/iio/sysfs.h>
 
 #include <linux/clk.h>
 
-#include <linux/iio/adc/adi-axi-adc.h>
-
 /*
  * ADI High-Speed ADC common spi interface registers
  * See Application-Note AN-877:
@@ -102,15 +101,20 @@
 #define AD9467_REG_VREF_MASK		0x0F
 
 struct ad9467_chip_info {
-	struct adi_axi_adc_chip_info	axi_adc_info;
-	unsigned int			default_output_mode;
-	unsigned int			vref_mask;
+	const char		*name;
+	unsigned int		id;
+	const struct		iio_chan_spec *channels;
+	unsigned int		num_channels;
+	const unsigned int	(*scale_table)[2];
+	int			num_scales;
+	unsigned long		max_rate;
+	unsigned int		default_output_mode;
+	unsigned int		vref_mask;
 };
 
-#define to_ad9467_chip_info(_info)	\
-	container_of(_info, struct ad9467_chip_info, axi_adc_info)
-
 struct ad9467_state {
+	const struct ad9467_chip_info	*info;
+	struct iio_backend		*back;
 	struct spi_device		*spi;
 	struct clk			*clk;
 	unsigned int			output_mode;
@@ -151,10 +155,10 @@
 	return spi_write(spi, buf, ARRAY_SIZE(buf));
 }
 
-static int ad9467_reg_access(struct adi_axi_adc_conv *conv, unsigned int reg,
+static int ad9467_reg_access(struct iio_dev *indio_dev, unsigned int reg,
 			     unsigned int writeval, unsigned int *readval)
 {
-	struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+	struct ad9467_state *st = iio_priv(indio_dev);
 	struct spi_device *spi = st->spi;
 	int ret;
 
@@ -191,10 +195,10 @@
 	{2300, 8}, {2400, 9}, {2500, 10},
 };
 
-static void __ad9467_get_scale(struct adi_axi_adc_conv *conv, int index,
+static void __ad9467_get_scale(struct ad9467_state *st, int index,
 			       unsigned int *val, unsigned int *val2)
 {
-	const struct adi_axi_adc_chip_info *info = conv->chip_info;
+	const struct ad9467_chip_info *info = st->info;
 	const struct iio_chan_spec *chan = &info->channels[0];
 	unsigned int tmp;
 
@@ -221,60 +225,52 @@
 }
 
 static const struct iio_chan_spec ad9434_channels[] = {
-	AD9467_CHAN(0, 0, 12, 'S'),
+	AD9467_CHAN(0, 0, 12, 's'),
 };
 
 static const struct iio_chan_spec ad9467_channels[] = {
-	AD9467_CHAN(0, 0, 16, 'S'),
+	AD9467_CHAN(0, 0, 16, 's'),
 };
 
 static const struct ad9467_chip_info ad9467_chip_tbl = {
-	.axi_adc_info = {
-		.name = "ad9467",
-		.id = CHIPID_AD9467,
-		.max_rate = 250000000UL,
-		.scale_table = ad9467_scale_table,
-		.num_scales = ARRAY_SIZE(ad9467_scale_table),
-		.channels = ad9467_channels,
-		.num_channels = ARRAY_SIZE(ad9467_channels),
-	},
+	.name = "ad9467",
+	.id = CHIPID_AD9467,
+	.max_rate = 250000000UL,
+	.scale_table = ad9467_scale_table,
+	.num_scales = ARRAY_SIZE(ad9467_scale_table),
+	.channels = ad9467_channels,
+	.num_channels = ARRAY_SIZE(ad9467_channels),
 	.default_output_mode = AD9467_DEF_OUTPUT_MODE,
 	.vref_mask = AD9467_REG_VREF_MASK,
 };
 
 static const struct ad9467_chip_info ad9434_chip_tbl = {
-	.axi_adc_info = {
-		.name = "ad9434",
-		.id = CHIPID_AD9434,
-		.max_rate = 500000000UL,
-		.scale_table = ad9434_scale_table,
-		.num_scales = ARRAY_SIZE(ad9434_scale_table),
-		.channels = ad9434_channels,
-		.num_channels = ARRAY_SIZE(ad9434_channels),
-	},
+	.name = "ad9434",
+	.id = CHIPID_AD9434,
+	.max_rate = 500000000UL,
+	.scale_table = ad9434_scale_table,
+	.num_scales = ARRAY_SIZE(ad9434_scale_table),
+	.channels = ad9434_channels,
+	.num_channels = ARRAY_SIZE(ad9434_channels),
 	.default_output_mode = AD9434_DEF_OUTPUT_MODE,
 	.vref_mask = AD9434_REG_VREF_MASK,
 };
 
 static const struct ad9467_chip_info ad9265_chip_tbl = {
-	.axi_adc_info = {
-		.name = "ad9265",
-		.id = CHIPID_AD9265,
-		.max_rate = 125000000UL,
-		.scale_table = ad9265_scale_table,
-		.num_scales = ARRAY_SIZE(ad9265_scale_table),
-		.channels = ad9467_channels,
-		.num_channels = ARRAY_SIZE(ad9467_channels),
-	},
+	.name = "ad9265",
+	.id = CHIPID_AD9265,
+	.max_rate = 125000000UL,
+	.scale_table = ad9265_scale_table,
+	.num_scales = ARRAY_SIZE(ad9265_scale_table),
+	.channels = ad9467_channels,
+	.num_channels = ARRAY_SIZE(ad9467_channels),
 	.default_output_mode = AD9265_DEF_OUTPUT_MODE,
 	.vref_mask = AD9265_REG_VREF_MASK,
 };
 
-static int ad9467_get_scale(struct adi_axi_adc_conv *conv, int *val, int *val2)
+static int ad9467_get_scale(struct ad9467_state *st, int *val, int *val2)
 {
-	const struct adi_axi_adc_chip_info *info = conv->chip_info;
-	const struct ad9467_chip_info *info1 = to_ad9467_chip_info(info);
-	struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+	const struct ad9467_chip_info *info = st->info;
 	unsigned int i, vref_val;
 	int ret;
 
@@ -282,7 +278,7 @@
 	if (ret < 0)
 		return ret;
 
-	vref_val = ret & info1->vref_mask;
+	vref_val = ret & info->vref_mask;
 
 	for (i = 0; i < info->num_scales; i++) {
 		if (vref_val == info->scale_table[i][1])
@@ -292,15 +288,14 @@
 	if (i == info->num_scales)
 		return -ERANGE;
 
-	__ad9467_get_scale(conv, i, val, val2);
+	__ad9467_get_scale(st, i, val, val2);
 
 	return IIO_VAL_INT_PLUS_MICRO;
 }
 
-static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2)
+static int ad9467_set_scale(struct ad9467_state *st, int val, int val2)
 {
-	const struct adi_axi_adc_chip_info *info = conv->chip_info;
-	struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+	const struct ad9467_chip_info *info = st->info;
 	unsigned int scale_val[2];
 	unsigned int i;
 	int ret;
@@ -309,7 +304,7 @@
 		return -EINVAL;
 
 	for (i = 0; i < info->num_scales; i++) {
-		__ad9467_get_scale(conv, i, &scale_val[0], &scale_val[1]);
+		__ad9467_get_scale(st, i, &scale_val[0], &scale_val[1]);
 		if (scale_val[0] != val || scale_val[1] != val2)
 			continue;
 
@@ -326,15 +321,15 @@
 	return -EINVAL;
 }
 
-static int ad9467_read_raw(struct adi_axi_adc_conv *conv,
+static int ad9467_read_raw(struct iio_dev *indio_dev,
 			   struct iio_chan_spec const *chan,
 			   int *val, int *val2, long m)
 {
-	struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+	struct ad9467_state *st = iio_priv(indio_dev);
 
 	switch (m) {
 	case IIO_CHAN_INFO_SCALE:
-		return ad9467_get_scale(conv, val, val2);
+		return ad9467_get_scale(st, val, val2);
 	case IIO_CHAN_INFO_SAMP_FREQ:
 		*val = clk_get_rate(st->clk);
 
@@ -344,17 +339,17 @@
 	}
 }
 
-static int ad9467_write_raw(struct adi_axi_adc_conv *conv,
+static int ad9467_write_raw(struct iio_dev *indio_dev,
 			    struct iio_chan_spec const *chan,
 			    int val, int val2, long mask)
 {
-	const struct adi_axi_adc_chip_info *info = conv->chip_info;
-	struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+	struct ad9467_state *st = iio_priv(indio_dev);
+	const struct ad9467_chip_info *info = st->info;
 	long r_clk;
 
 	switch (mask) {
 	case IIO_CHAN_INFO_SCALE:
-		return ad9467_set_scale(conv, val, val2);
+		return ad9467_set_scale(st, val, val2);
 	case IIO_CHAN_INFO_SAMP_FREQ:
 		r_clk = clk_round_rate(st->clk, val);
 		if (r_clk < 0 || r_clk > info->max_rate) {
@@ -369,13 +364,13 @@
 	}
 }
 
-static int ad9467_read_avail(struct adi_axi_adc_conv *conv,
+static int ad9467_read_avail(struct iio_dev *indio_dev,
 			     struct iio_chan_spec const *chan,
 			     const int **vals, int *type, int *length,
 			     long mask)
 {
-	const struct adi_axi_adc_chip_info *info = conv->chip_info;
-	struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+	struct ad9467_state *st = iio_priv(indio_dev);
+	const struct ad9467_chip_info *info = st->info;
 
 	switch (mask) {
 	case IIO_CHAN_INFO_SCALE:
@@ -389,6 +384,33 @@
 	}
 }
 
+static int ad9467_update_scan_mode(struct iio_dev *indio_dev,
+				   const unsigned long *scan_mask)
+{
+	struct ad9467_state *st = iio_priv(indio_dev);
+	unsigned int c;
+	int ret;
+
+	for (c = 0; c < st->info->num_channels; c++) {
+		if (test_bit(c, scan_mask))
+			ret = iio_backend_chan_enable(st->back, c);
+		else
+			ret = iio_backend_chan_disable(st->back, c);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static const struct iio_info ad9467_info = {
+	.read_raw = ad9467_read_raw,
+	.write_raw = ad9467_write_raw,
+	.update_scan_mode = ad9467_update_scan_mode,
+	.debugfs_reg_access = ad9467_reg_access,
+	.read_avail = ad9467_read_avail,
+};
+
 static int ad9467_outputmode_set(struct spi_device *spi, unsigned int mode)
 {
 	int ret;
@@ -401,10 +423,9 @@
 				AN877_ADC_TRANSFER_SYNC);
 }
 
-static int ad9467_scale_fill(struct adi_axi_adc_conv *conv)
+static int ad9467_scale_fill(struct ad9467_state *st)
 {
-	const struct adi_axi_adc_chip_info *info = conv->chip_info;
-	struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+	const struct ad9467_chip_info *info = st->info;
 	unsigned int i, val1, val2;
 
 	st->scales = devm_kmalloc_array(&st->spi->dev, info->num_scales,
@@ -413,7 +434,7 @@
 		return -ENOMEM;
 
 	for (i = 0; i < info->num_scales; i++) {
-		__ad9467_get_scale(conv, i, &val1, &val2);
+		__ad9467_get_scale(st, i, &val1, &val2);
 		st->scales[i][0] = val1;
 		st->scales[i][1] = val2;
 	}
@@ -421,11 +442,27 @@
 	return 0;
 }
 
-static int ad9467_preenable_setup(struct adi_axi_adc_conv *conv)
+static int ad9467_setup(struct ad9467_state *st)
 {
-	struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+	struct iio_backend_data_fmt data = {
+		.sign_extend = true,
+		.enable = true,
+	};
+	unsigned int c, mode;
+	int ret;
+
+	mode = st->info->default_output_mode | AN877_ADC_OUTPUT_MODE_TWOS_COMPLEMENT;
+	ret = ad9467_outputmode_set(st->spi, mode);
+	if (ret)
+		return ret;
 
-	return ad9467_outputmode_set(st->spi, st->output_mode);
+	for (c = 0; c < st->info->num_channels; c++) {
+		ret = iio_backend_data_format_set(st->back, c, &data);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
 }
 
 static int ad9467_reset(struct device *dev)
@@ -443,25 +480,65 @@
 	return 0;
 }
 
+static int ad9467_iio_backend_get(struct ad9467_state *st)
+{
+	struct device *dev = &st->spi->dev;
+	struct device_node *__back;
+
+	st->back = devm_iio_backend_get(dev, NULL);
+	if (!IS_ERR(st->back))
+		return 0;
+	/* If not found, don't error out as we might have legacy DT property */
+	if (PTR_ERR(st->back) != -ENOENT)
+		return PTR_ERR(st->back);
+
+	/*
+	 * if we don't get the backend using the normal API's, use the legacy
+	 * 'adi,adc-dev' property. So we get all nodes with that property, and
+	 * look for the one pointing at us. Then we directly lookup that fwnode
+	 * on the backend list of registered devices. This is done so we don't
+	 * make io-backends mandatory which would break DT ABI.
+	 */
+	for_each_node_with_property(__back, "adi,adc-dev") {
+		struct device_node *__me;
+
+		__me = of_parse_phandle(__back, "adi,adc-dev", 0);
+		if (!__me)
+			continue;
+
+		if (!device_match_of_node(dev, __me)) {
+			of_node_put(__me);
+			continue;
+		}
+
+		of_node_put(__me);
+		st->back = __devm_iio_backend_get_from_fwnode_lookup(dev,
+								     of_fwnode_handle(__back));
+		of_node_put(__back);
+		return PTR_ERR_OR_ZERO(st->back);
+	}
+
+	return -ENODEV;
+}
+
 static int ad9467_probe(struct spi_device *spi)
 {
-	const struct ad9467_chip_info *info;
-	struct adi_axi_adc_conv *conv;
+	struct iio_dev *indio_dev;
 	struct ad9467_state *st;
 	unsigned int id;
 	int ret;
 
-	info = spi_get_device_match_data(spi);
-	if (!info)
-		return -ENODEV;
-
-	conv = devm_adi_axi_adc_conv_register(&spi->dev, sizeof(*st));
-	if (IS_ERR(conv))
-		return PTR_ERR(conv);
+	indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
+	if (!indio_dev)
+		return -ENOMEM;
 
-	st = adi_axi_adc_conv_priv(conv);
+	st = iio_priv(indio_dev);
 	st->spi = spi;
 
+	st->info = spi_get_device_match_data(spi);
+	if (!st->info)
+		return -ENODEV;
+
 	st->clk = devm_clk_get_enabled(&spi->dev, "adc-clk");
 	if (IS_ERR(st->clk))
 		return PTR_ERR(st->clk);
@@ -475,29 +552,39 @@
 	if (ret)
 		return ret;
 
-	conv->chip_info = &info->axi_adc_info;
-
-	ret = ad9467_scale_fill(conv);
+	ret = ad9467_scale_fill(st);
 	if (ret)
 		return ret;
 
 	id = ad9467_spi_read(spi, AN877_ADC_REG_CHIP_ID);
-	if (id != conv->chip_info->id) {
+	if (id != st->info->id) {
 		dev_err(&spi->dev, "Mismatch CHIP_ID, got 0x%X, expected 0x%X\n",
-			id, conv->chip_info->id);
+			id, st->info->id);
 		return -ENODEV;
 	}
 
-	conv->reg_access = ad9467_reg_access;
-	conv->write_raw = ad9467_write_raw;
-	conv->read_raw = ad9467_read_raw;
-	conv->read_avail = ad9467_read_avail;
-	conv->preenable_setup = ad9467_preenable_setup;
+	indio_dev->name = st->info->name;
+	indio_dev->channels = st->info->channels;
+	indio_dev->num_channels = st->info->num_channels;
+	indio_dev->info = &ad9467_info;
 
-	st->output_mode = info->default_output_mode |
-			  AN877_ADC_OUTPUT_MODE_TWOS_COMPLEMENT;
+	ret = ad9467_iio_backend_get(st);
+	if (ret)
+		return ret;
 
-	return 0;
+	ret = devm_iio_backend_request_buffer(&spi->dev, st->back, indio_dev);
+	if (ret)
+		return ret;
+
+	ret = devm_iio_backend_enable(&spi->dev, st->back);
+	if (ret)
+		return ret;
+
+	ret = ad9467_setup(st);
+	if (ret)
+		return ret;
+
+	return devm_iio_device_register(&spi->dev, indio_dev);
 }
 
 static const struct of_device_id ad9467_of_match[] = {
@@ -529,4 +616,4 @@
 MODULE_AUTHOR("Michael Hennerich <michael.hennerich@analog.com>");
 MODULE_DESCRIPTION("Analog Devices AD9467 ADC driver");
 MODULE_LICENSE("GPL v2");
-MODULE_IMPORT_NS(IIO_ADI_AXI);
+MODULE_IMPORT_NS(IIO_BACKEND);
--- linux-qcom-6.8.0.orig/drivers/iio/adc/adi-axi-adc.c
+++ linux-qcom-6.8.0/drivers/iio/adc/adi-axi-adc.c
@@ -8,6 +8,7 @@
 
 #include <linux/bitfield.h>
 #include <linux/clk.h>
+#include <linux/err.h>
 #include <linux/io.h>
 #include <linux/delay.h>
 #include <linux/module.h>
@@ -17,13 +18,12 @@
 #include <linux/regmap.h>
 #include <linux/slab.h>
 
-#include <linux/iio/iio.h>
-#include <linux/iio/sysfs.h>
-#include <linux/iio/buffer.h>
-#include <linux/iio/buffer-dmaengine.h>
-
 #include <linux/fpga/adi-axi-common.h>
-#include <linux/iio/adc/adi-axi-adc.h>
+
+#include <linux/iio/backend.h>
+#include <linux/iio/buffer-dmaengine.h>
+#include <linux/iio/buffer.h>
+#include <linux/iio/iio.h>
 
 /*
  * Register definitions:
@@ -44,6 +44,7 @@
 #define   ADI_AXI_REG_CHAN_CTRL_PN_SEL_OWR	BIT(10)
 #define   ADI_AXI_REG_CHAN_CTRL_IQCOR_EN	BIT(9)
 #define   ADI_AXI_REG_CHAN_CTRL_DCFILT_EN	BIT(8)
+#define   ADI_AXI_REG_CHAN_CTRL_FMT_MASK	GENMASK(6, 4)
 #define   ADI_AXI_REG_CHAN_CTRL_FMT_SIGNEXT	BIT(6)
 #define   ADI_AXI_REG_CHAN_CTRL_FMT_TYPE	BIT(5)
 #define   ADI_AXI_REG_CHAN_CTRL_FMT_EN		BIT(4)
@@ -55,286 +56,100 @@
 	 ADI_AXI_REG_CHAN_CTRL_FMT_EN |		\
 	 ADI_AXI_REG_CHAN_CTRL_ENABLE)
 
-struct adi_axi_adc_core_info {
-	unsigned int				version;
-};
-
 struct adi_axi_adc_state {
-	struct mutex				lock;
-
-	struct adi_axi_adc_client		*client;
 	struct regmap				*regmap;
-};
-
-struct adi_axi_adc_client {
-	struct list_head			entry;
-	struct adi_axi_adc_conv			conv;
-	struct adi_axi_adc_state		*state;
 	struct device				*dev;
-	const struct adi_axi_adc_core_info	*info;
 };
 
-static LIST_HEAD(registered_clients);
-static DEFINE_MUTEX(registered_clients_lock);
-
-static struct adi_axi_adc_client *conv_to_client(struct adi_axi_adc_conv *conv)
+static int axi_adc_enable(struct iio_backend *back)
 {
-	return container_of(conv, struct adi_axi_adc_client, conv);
-}
-
-void *adi_axi_adc_conv_priv(struct adi_axi_adc_conv *conv)
-{
-	struct adi_axi_adc_client *cl = conv_to_client(conv);
-
-	return (char *)cl + ALIGN(sizeof(struct adi_axi_adc_client),
-				  IIO_DMA_MINALIGN);
-}
-EXPORT_SYMBOL_NS_GPL(adi_axi_adc_conv_priv, IIO_ADI_AXI);
-
-static int adi_axi_adc_config_dma_buffer(struct device *dev,
-					 struct iio_dev *indio_dev)
-{
-	const char *dma_name;
-
-	if (!device_property_present(dev, "dmas"))
-		return 0;
-
-	if (device_property_read_string(dev, "dma-names", &dma_name))
-		dma_name = "rx";
-
-	return devm_iio_dmaengine_buffer_setup(indio_dev->dev.parent,
-					       indio_dev, dma_name);
-}
-
-static int adi_axi_adc_read_raw(struct iio_dev *indio_dev,
-				struct iio_chan_spec const *chan,
-				int *val, int *val2, long mask)
-{
-	struct adi_axi_adc_state *st = iio_priv(indio_dev);
-	struct adi_axi_adc_conv *conv = &st->client->conv;
-
-	if (!conv->read_raw)
-		return -EOPNOTSUPP;
-
-	return conv->read_raw(conv, chan, val, val2, mask);
-}
-
-static int adi_axi_adc_write_raw(struct iio_dev *indio_dev,
-				 struct iio_chan_spec const *chan,
-				 int val, int val2, long mask)
-{
-	struct adi_axi_adc_state *st = iio_priv(indio_dev);
-	struct adi_axi_adc_conv *conv = &st->client->conv;
-
-	if (!conv->write_raw)
-		return -EOPNOTSUPP;
-
-	return conv->write_raw(conv, chan, val, val2, mask);
-}
-
-static int adi_axi_adc_read_avail(struct iio_dev *indio_dev,
-				  struct iio_chan_spec const *chan,
-				  const int **vals, int *type, int *length,
-				  long mask)
-{
-	struct adi_axi_adc_state *st = iio_priv(indio_dev);
-	struct adi_axi_adc_conv *conv = &st->client->conv;
-
-	if (!conv->read_avail)
-		return -EOPNOTSUPP;
-
-	return conv->read_avail(conv, chan, vals, type, length, mask);
-}
-
-static int adi_axi_adc_update_scan_mode(struct iio_dev *indio_dev,
-					const unsigned long *scan_mask)
-{
-	struct adi_axi_adc_state *st = iio_priv(indio_dev);
-	struct adi_axi_adc_conv *conv = &st->client->conv;
-	unsigned int i;
+	struct adi_axi_adc_state *st = iio_backend_get_priv(back);
 	int ret;
 
-	for (i = 0; i < conv->chip_info->num_channels; i++) {
-		if (test_bit(i, scan_mask))
-			ret = regmap_set_bits(st->regmap,
-					      ADI_AXI_REG_CHAN_CTRL(i),
-					      ADI_AXI_REG_CHAN_CTRL_ENABLE);
-		else
-			ret = regmap_clear_bits(st->regmap,
-						ADI_AXI_REG_CHAN_CTRL(i),
-						ADI_AXI_REG_CHAN_CTRL_ENABLE);
-		if (ret)
-			return ret;
-	}
+	ret = regmap_set_bits(st->regmap, ADI_AXI_REG_RSTN,
+			      ADI_AXI_REG_RSTN_MMCM_RSTN);
+	if (ret)
+		return ret;
 
-	return 0;
+	fsleep(10000);
+	return regmap_set_bits(st->regmap, ADI_AXI_REG_RSTN,
+			       ADI_AXI_REG_RSTN_RSTN | ADI_AXI_REG_RSTN_MMCM_RSTN);
 }
 
-static struct adi_axi_adc_conv *adi_axi_adc_conv_register(struct device *dev,
-							  size_t sizeof_priv)
+static void axi_adc_disable(struct iio_backend *back)
 {
-	struct adi_axi_adc_client *cl;
-	size_t alloc_size;
-
-	alloc_size = ALIGN(sizeof(struct adi_axi_adc_client), IIO_DMA_MINALIGN);
-	if (sizeof_priv)
-		alloc_size += ALIGN(sizeof_priv, IIO_DMA_MINALIGN);
-
-	cl = kzalloc(alloc_size, GFP_KERNEL);
-	if (!cl)
-		return ERR_PTR(-ENOMEM);
-
-	mutex_lock(&registered_clients_lock);
-
-	cl->dev = get_device(dev);
-
-	list_add_tail(&cl->entry, &registered_clients);
+	struct adi_axi_adc_state *st = iio_backend_get_priv(back);
 
-	mutex_unlock(&registered_clients_lock);
-
-	return &cl->conv;
+	regmap_write(st->regmap, ADI_AXI_REG_RSTN, 0);
 }
 
-static void adi_axi_adc_conv_unregister(struct adi_axi_adc_conv *conv)
+static int axi_adc_data_format_set(struct iio_backend *back, unsigned int chan,
+				   const struct iio_backend_data_fmt *data)
 {
-	struct adi_axi_adc_client *cl = conv_to_client(conv);
-
-	mutex_lock(&registered_clients_lock);
+	struct adi_axi_adc_state *st = iio_backend_get_priv(back);
+	u32 val;
 
-	list_del(&cl->entry);
-	put_device(cl->dev);
+	if (!data->enable)
+		return regmap_clear_bits(st->regmap,
+					 ADI_AXI_REG_CHAN_CTRL(chan),
+					 ADI_AXI_REG_CHAN_CTRL_FMT_EN);
 
-	mutex_unlock(&registered_clients_lock);
+	val = FIELD_PREP(ADI_AXI_REG_CHAN_CTRL_FMT_EN, true);
+	if (data->sign_extend)
+		val |= FIELD_PREP(ADI_AXI_REG_CHAN_CTRL_FMT_SIGNEXT, true);
+	if (data->type == IIO_BACKEND_OFFSET_BINARY)
+		val |= FIELD_PREP(ADI_AXI_REG_CHAN_CTRL_FMT_TYPE, true);
 
-	kfree(cl);
+	return regmap_update_bits(st->regmap, ADI_AXI_REG_CHAN_CTRL(chan),
+				  ADI_AXI_REG_CHAN_CTRL_FMT_MASK, val);
 }
 
-static void devm_adi_axi_adc_conv_release(void *conv)
+static int axi_adc_chan_enable(struct iio_backend *back, unsigned int chan)
 {
-	adi_axi_adc_conv_unregister(conv);
-}
-
-struct adi_axi_adc_conv *devm_adi_axi_adc_conv_register(struct device *dev,
-							size_t sizeof_priv)
-{
-	struct adi_axi_adc_conv *conv;
-	int ret;
-
-	conv = adi_axi_adc_conv_register(dev, sizeof_priv);
-	if (IS_ERR(conv))
-		return conv;
+	struct adi_axi_adc_state *st = iio_backend_get_priv(back);
 
-	ret = devm_add_action_or_reset(dev, devm_adi_axi_adc_conv_release,
-				       conv);
-	if (ret)
-		return ERR_PTR(ret);
-
-	return conv;
+	return regmap_set_bits(st->regmap, ADI_AXI_REG_CHAN_CTRL(chan),
+			       ADI_AXI_REG_CHAN_CTRL_ENABLE);
 }
-EXPORT_SYMBOL_NS_GPL(devm_adi_axi_adc_conv_register, IIO_ADI_AXI);
-
-static const struct iio_info adi_axi_adc_info = {
-	.read_raw = &adi_axi_adc_read_raw,
-	.write_raw = &adi_axi_adc_write_raw,
-	.update_scan_mode = &adi_axi_adc_update_scan_mode,
-	.read_avail = &adi_axi_adc_read_avail,
-};
-
-static const struct adi_axi_adc_core_info adi_axi_adc_10_0_a_info = {
-	.version = ADI_AXI_PCORE_VER(10, 0, 'a'),
-};
 
-static struct adi_axi_adc_client *adi_axi_adc_attach_client(struct device *dev)
+static int axi_adc_chan_disable(struct iio_backend *back, unsigned int chan)
 {
-	const struct adi_axi_adc_core_info *info;
-	struct adi_axi_adc_client *cl;
-	struct device_node *cln;
-
-	info = of_device_get_match_data(dev);
-	if (!info)
-		return ERR_PTR(-ENODEV);
-
-	cln = of_parse_phandle(dev->of_node, "adi,adc-dev", 0);
-	if (!cln) {
-		dev_err(dev, "No 'adi,adc-dev' node defined\n");
-		return ERR_PTR(-ENODEV);
-	}
-
-	mutex_lock(&registered_clients_lock);
-
-	list_for_each_entry(cl, &registered_clients, entry) {
-		if (!cl->dev)
-			continue;
-
-		if (cl->dev->of_node != cln)
-			continue;
-
-		if (!try_module_get(cl->dev->driver->owner)) {
-			mutex_unlock(&registered_clients_lock);
-			of_node_put(cln);
-			return ERR_PTR(-ENODEV);
-		}
-
-		get_device(cl->dev);
-		cl->info = info;
-		mutex_unlock(&registered_clients_lock);
-		of_node_put(cln);
-		return cl;
-	}
+	struct adi_axi_adc_state *st = iio_backend_get_priv(back);
 
-	mutex_unlock(&registered_clients_lock);
-	of_node_put(cln);
-
-	return ERR_PTR(-EPROBE_DEFER);
+	return regmap_clear_bits(st->regmap, ADI_AXI_REG_CHAN_CTRL(chan),
+				 ADI_AXI_REG_CHAN_CTRL_ENABLE);
 }
 
-static int adi_axi_adc_setup_channels(struct device *dev,
-				      struct adi_axi_adc_state *st)
+static struct iio_buffer *axi_adc_request_buffer(struct iio_backend *back,
+						 struct iio_dev *indio_dev)
 {
-	struct adi_axi_adc_conv *conv = &st->client->conv;
-	int i, ret;
+	struct adi_axi_adc_state *st = iio_backend_get_priv(back);
+	struct iio_buffer *buffer;
+	const char *dma_name;
+	int ret;
 
-	if (conv->preenable_setup) {
-		ret = conv->preenable_setup(conv);
-		if (ret)
-			return ret;
-	}
+	if (device_property_read_string(st->dev, "dma-names", &dma_name))
+		dma_name = "rx";
 
-	for (i = 0; i < conv->chip_info->num_channels; i++) {
-		ret = regmap_write(st->regmap, ADI_AXI_REG_CHAN_CTRL(i),
-				   ADI_AXI_REG_CHAN_CTRL_DEFAULTS);
-		if (ret)
-			return ret;
+	buffer = iio_dmaengine_buffer_alloc(st->dev, dma_name);
+	if (IS_ERR(buffer)) {
+		dev_err(st->dev, "Could not get DMA buffer, %ld\n",
+			PTR_ERR(buffer));
+		return ERR_CAST(buffer);
 	}
 
-	return 0;
-}
-
-static int axi_adc_reset(struct adi_axi_adc_state *st)
-{
-	int ret;
-
-	ret = regmap_write(st->regmap, ADI_AXI_REG_RSTN, 0);
+	indio_dev->modes |= INDIO_BUFFER_HARDWARE;
+	ret = iio_device_attach_buffer(indio_dev, buffer);
 	if (ret)
-		return ret;
-
-	mdelay(10);
-	ret = regmap_write(st->regmap, ADI_AXI_REG_RSTN,
-			   ADI_AXI_REG_RSTN_MMCM_RSTN);
-	if (ret)
-		return ret;
+		return ERR_PTR(ret);
 
-	mdelay(10);
-	return regmap_write(st->regmap, ADI_AXI_REG_RSTN,
-			    ADI_AXI_REG_RSTN_RSTN | ADI_AXI_REG_RSTN_MMCM_RSTN);
+	return buffer;
 }
 
-static void adi_axi_adc_cleanup(void *data)
+static void axi_adc_free_buffer(struct iio_backend *back,
+				struct iio_buffer *buffer)
 {
-	struct adi_axi_adc_client *cl = data;
-
-	put_device(cl->dev);
-	module_put(cl->dev->driver->owner);
+	iio_dmaengine_buffer_free(buffer);
 }
 
 static const struct regmap_config axi_adc_regmap_config = {
@@ -344,45 +159,52 @@
 	.max_register = 0x0800,
 };
 
+static const struct iio_backend_ops adi_axi_adc_generic = {
+	.enable = axi_adc_enable,
+	.disable = axi_adc_disable,
+	.data_format_set = axi_adc_data_format_set,
+	.chan_enable = axi_adc_chan_enable,
+	.chan_disable = axi_adc_chan_disable,
+	.request_buffer = axi_adc_request_buffer,
+	.free_buffer = axi_adc_free_buffer,
+};
+
 static int adi_axi_adc_probe(struct platform_device *pdev)
 {
-	struct adi_axi_adc_conv *conv;
-	struct iio_dev *indio_dev;
-	struct adi_axi_adc_client *cl;
+	const unsigned int *expected_ver;
 	struct adi_axi_adc_state *st;
 	void __iomem *base;
 	unsigned int ver;
+	struct clk *clk;
 	int ret;
 
-	cl = adi_axi_adc_attach_client(&pdev->dev);
-	if (IS_ERR(cl))
-		return PTR_ERR(cl);
-
-	ret = devm_add_action_or_reset(&pdev->dev, adi_axi_adc_cleanup, cl);
-	if (ret)
-		return ret;
-
-	indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*st));
-	if (indio_dev == NULL)
+	st = devm_kzalloc(&pdev->dev, sizeof(*st), GFP_KERNEL);
+	if (!st)
 		return -ENOMEM;
 
-	st = iio_priv(indio_dev);
-	st->client = cl;
-	cl->state = st;
-	mutex_init(&st->lock);
-
 	base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(base))
 		return PTR_ERR(base);
 
+	st->dev = &pdev->dev;
 	st->regmap = devm_regmap_init_mmio(&pdev->dev, base,
 					   &axi_adc_regmap_config);
 	if (IS_ERR(st->regmap))
 		return PTR_ERR(st->regmap);
 
-	conv = &st->client->conv;
+	expected_ver = device_get_match_data(&pdev->dev);
+	if (!expected_ver)
+		return -ENODEV;
 
-	ret = axi_adc_reset(st);
+	clk = devm_clk_get_enabled(&pdev->dev, NULL);
+	if (IS_ERR(clk))
+		return PTR_ERR(clk);
+
+	/*
+	 * Force disable the core. Up to the frontend to enable us. And we can
+	 * still read/write registers...
+	 */
+	ret = regmap_write(st->regmap, ADI_AXI_REG_RSTN, 0);
 	if (ret)
 		return ret;
 
@@ -390,33 +212,19 @@
 	if (ret)
 		return ret;
 
-	if (cl->info->version > ver) {
+	if (ADI_AXI_PCORE_VER_MAJOR(ver) != ADI_AXI_PCORE_VER_MAJOR(*expected_ver)) {
 		dev_err(&pdev->dev,
-			"IP core version is too old. Expected %d.%.2d.%c, Reported %d.%.2d.%c\n",
-			ADI_AXI_PCORE_VER_MAJOR(cl->info->version),
-			ADI_AXI_PCORE_VER_MINOR(cl->info->version),
-			ADI_AXI_PCORE_VER_PATCH(cl->info->version),
+			"Major version mismatch. Expected %d.%.2d.%c, Reported %d.%.2d.%c\n",
+			ADI_AXI_PCORE_VER_MAJOR(*expected_ver),
+			ADI_AXI_PCORE_VER_MINOR(*expected_ver),
+			ADI_AXI_PCORE_VER_PATCH(*expected_ver),
 			ADI_AXI_PCORE_VER_MAJOR(ver),
 			ADI_AXI_PCORE_VER_MINOR(ver),
 			ADI_AXI_PCORE_VER_PATCH(ver));
 		return -ENODEV;
 	}
 
-	indio_dev->info = &adi_axi_adc_info;
-	indio_dev->name = "adi-axi-adc";
-	indio_dev->modes = INDIO_DIRECT_MODE;
-	indio_dev->num_channels = conv->chip_info->num_channels;
-	indio_dev->channels = conv->chip_info->channels;
-
-	ret = adi_axi_adc_config_dma_buffer(&pdev->dev, indio_dev);
-	if (ret)
-		return ret;
-
-	ret = adi_axi_adc_setup_channels(&pdev->dev, st);
-	if (ret)
-		return ret;
-
-	ret = devm_iio_device_register(&pdev->dev, indio_dev);
+	ret = devm_iio_backend_register(&pdev->dev, &adi_axi_adc_generic, st);
 	if (ret)
 		return ret;
 
@@ -428,6 +236,8 @@
 	return 0;
 }
 
+static unsigned int adi_axi_adc_10_0_a_info = ADI_AXI_PCORE_VER(10, 0, 'a');
+
 /* Match table for of_platform binding */
 static const struct of_device_id adi_axi_adc_of_match[] = {
 	{ .compatible = "adi,axi-adc-10.0.a", .data = &adi_axi_adc_10_0_a_info },
@@ -447,3 +257,5 @@
 MODULE_AUTHOR("Michael Hennerich <michael.hennerich@analog.com>");
 MODULE_DESCRIPTION("Analog Devices Generic AXI ADC IP core driver");
 MODULE_LICENSE("GPL v2");
+MODULE_IMPORT_NS(IIO_DMAENGINE_BUFFER);
+MODULE_IMPORT_NS(IIO_BACKEND);
--- linux-qcom-6.8.0.orig/drivers/iio/adc/at91_adc.c
+++ linux-qcom-6.8.0/drivers/iio/adc/at91_adc.c
@@ -984,7 +984,7 @@
 	return ret;
 
 err:
-	input_free_device(st->ts_input);
+	input_free_device(input);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/iio/adc/qcom-spmi-adc5-gen3.c
+++ linux-qcom-6.8.0/drivers/iio/adc/qcom-spmi-adc5-gen3.c
@@ -0,0 +1,1198 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <asm/unaligned.h>
+#include <linux/bitfield.h>
+#include <linux/bitops.h>
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/iio/iio.h>
+#include <linux/iio/adc/qcom-vadc-common.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/log2.h>
+#include <linux/math64.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/platform_device.h>
+#include <linux/property.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+#include <linux/thermal.h>
+
+#include <dt-bindings/iio/qcom,spmi-vadc.h>
+
+#define ADC5_GEN3_HS				0x45
+#define ADC5_GEN3_HS_BUSY			BIT(7)
+#define ADC5_GEN3_HS_READY			BIT(0)
+
+#define ADC5_GEN3_STATUS1			0x46
+#define ADC5_GEN3_STATUS1_CONV_FAULT		BIT(7)
+#define ADC5_GEN3_STATUS1_THR_CROSS		BIT(6)
+#define ADC5_GEN3_STATUS1_EOC			BIT(0)
+
+#define ADC5_GEN3_TM_EN_STS			0x47
+#define ADC5_GEN3_TM_HIGH_STS			0x48
+#define ADC5_GEN3_TM_LOW_STS			0x49
+
+#define ADC5_GEN3_EOC_STS			0x4a
+#define ADC5_GEN3_EOC_CHAN_0			BIT(0)
+
+#define ADC5_GEN3_EOC_CLR			0x4b
+#define ADC5_GEN3_TM_HIGH_STS_CLR		0x4c
+#define ADC5_GEN3_TM_LOW_STS_CLR		0x4d
+#define ADC5_GEN3_CONV_ERR_CLR			0x4e
+#define ADC5_GEN3_CONV_ERR_CLR_REQ		BIT(0)
+
+#define ADC5_GEN3_SID				0x4f
+#define ADC5_GEN3_SID_MASK			GENMASK(3, 0)
+
+#define ADC5_GEN3_PERPH_CH			0x50
+#define ADC5_GEN3_CHAN_CONV_REQ			BIT(7)
+
+#define ADC5_GEN3_TIMER_SEL			0x51
+#define ADC5_GEN3_TIME_IMMEDIATE		0x1
+
+#define ADC5_GEN3_DIG_PARAM			0x52
+#define ADC5_GEN3_DIG_PARAM_CAL_SEL_MASK	GENMASK(5, 4)
+#define ADC5_GEN3_DIG_PARAM_DEC_RATIO_SEL_MASK	GENMASK(3, 2)
+
+#define ADC5_GEN3_FAST_AVG			0x53
+#define ADC5_GEN3_FAST_AVG_CTL_EN		BIT(7)
+#define ADC5_GEN3_FAST_AVG_CTL_SAMPLES_MASK	GENMASK(2, 0)
+
+#define ADC5_GEN3_ADC_CH_SEL_CTL		0x54
+#define ADC5_GEN3_DELAY_CTL			0x55
+#define ADC5_GEN3_HW_SETTLE_DELAY_MASK		GENMASK(3, 0)
+
+#define ADC5_GEN3_CH_EN				0x56
+#define ADC5_GEN3_HIGH_THR_INT_EN		BIT(1)
+#define ADC5_GEN3_LOW_THR_INT_EN		BIT(0)
+
+#define ADC5_GEN3_LOW_THR0			0x57
+#define ADC5_GEN3_LOW_THR1			0x58
+#define ADC5_GEN3_HIGH_THR0			0x59
+#define ADC5_GEN3_HIGH_THR1			0x5a
+
+#define ADC5_GEN3_CH_DATA0(channel)	(0x5c + (channel) * 2)
+#define ADC5_GEN3_CH_DATA1(channel)	(0x5d + (channel) * 2)
+
+#define ADC5_GEN3_CONV_REQ			0xe5
+#define ADC5_GEN3_CONV_REQ_REQ			BIT(0)
+
+#define ADC5_GEN3_VIRTUAL_SID_MASK			GENMASK(15, 8)
+#define ADC5_GEN3_CHANNEL_MASK			GENMASK(7, 0)
+#define V_CHAN(x)		\
+	(FIELD_PREP(ADC5_GEN3_VIRTUAL_SID_MASK, (x).sid) | (x).channel)	\
+
+enum adc5_cal_method {
+	ADC5_NO_CAL = 0,
+	ADC5_RATIOMETRIC_CAL,
+	ADC5_ABSOLUTE_CAL
+};
+
+enum adc5_time_select {
+	MEAS_INT_DISABLE = 0,
+	MEAS_INT_IMMEDIATE,
+	MEAS_INT_50MS,
+	MEAS_INT_100MS,
+	MEAS_INT_1S,
+	MEAS_INT_NONE,
+};
+
+struct adc5_sdam_data {
+	u16			base_addr;
+	const char		*irq_name;
+	int			irq;
+};
+
+/**
+ * struct adc5_channel_prop - ADC channel property.
+ * @channel: channel number, refer to the channel list.
+ * @cal_method: calibration method.
+ * @decimation: sampling rate supported for the channel.
+ * @sid: slave id of PMIC owning the channel.
+ * @prescale: channel scaling performed on the input signal.
+ * @hw_settle_time: the time between AMUX being configured and the
+ *	start of conversion.
+ * @avg_samples: ability to provide single result from the ADC
+ *	that is an average of multiple measurements.
+ * @sdam_index: Index for which SDAM this channel is on.
+ * @scale_fn_type: Represents the scaling function to convert voltage
+ *	physical units desired by the client for the channel.
+ * @label: Channel name used in device tree.
+ * @chip: pointer to top-level ADC device structure.
+ * @adc_tm: indicates if the channel is used for TM measurements.
+ * @tm_chan_index: TM channel number used (ranging from 1-7).
+ * @timer: time period of recurring TM measurement.
+ * @tzd: pointer to thermal device corresponding to TM channel.
+ * @high_thr_en: TM high threshold crossing detection enabled.
+ * @low_thr_en: TM low threshold crossing detection enabled.
+ * @last_temp: last temperature that caused threshold violation,
+ *	or a thermal TM channel.
+ * @last_temp_set: indicates if last_temp is stored.
+ */
+struct adc5_channel_prop {
+	unsigned int			channel;
+	enum adc5_cal_method		cal_method;
+	unsigned int			decimation;
+	unsigned int			sid;
+	unsigned int			prescale;
+	unsigned int			hw_settle_time;
+	unsigned int			avg_samples;
+	unsigned int			sdam_index;
+
+	enum vadc_scale_fn_type		scale_fn_type;
+	const char			*label;
+
+	struct adc5_chip		*chip;
+	/* TM(thermal monitoring related) properties */
+	bool				adc_tm;
+	unsigned int			tm_chan_index;
+	unsigned int			timer;
+	struct thermal_zone_device	*tzd;
+	bool				high_thr_en;
+	bool				low_thr_en;
+	int				last_temp;
+	bool				last_temp_set;
+};
+
+/**
+ * struct adc5_chip - ADC private structure.
+ * @regmap: SPMI ADC5 Gen3 peripheral register map field.
+ * @dev: SPMI ADC5 Gen3 device.
+ * @base: pointer to array of ADC peripheral base and interrupt.
+ * @num_sdams: number of SDAMs (Shared Direct Access Memory Module) being used.
+ * @nchannels: number of ADC channels.
+ * @chan_props: array of ADC channel properties.
+ * @iio_chans: array of IIO channels specification.
+ * @complete: ADC result notification after interrupt is received.
+ * @lock: ADC lock for access to the peripheral, to prevent concurrent
+ * requests from multiple clients.
+ * @data: software configuration data.
+ * @n_tm_channels: number of ADC channels used for TM measurements.
+ * @tm_handler_work: scheduled work for handling TM threshold violation.
+ */
+struct adc5_chip {
+	struct regmap			*regmap;
+	struct device			*dev;
+	struct adc5_sdam_data		*base;
+	unsigned int			num_sdams;
+	unsigned int			nchannels;
+	struct adc5_channel_prop	*chan_props;
+	struct iio_chan_spec		*iio_chans;
+	struct completion		complete;
+	struct mutex			lock;
+	const struct adc5_data		*data;
+	/* TM properties */
+	unsigned int			n_tm_channels;
+	struct work_struct		tm_handler_work;
+};
+
+static int adc5_gen3_read(struct adc5_chip *adc, unsigned int sdam_index,
+				u16 offset, u8 *data, int len)
+{
+	return regmap_bulk_read(adc->regmap, adc->base[sdam_index].base_addr + offset, data, len);
+}
+
+static int adc5_gen3_write(struct adc5_chip *adc, unsigned int sdam_index,
+				u16 offset, u8 *data, int len)
+{
+	return regmap_bulk_write(adc->regmap, adc->base[sdam_index].base_addr + offset, data, len);
+}
+
+static int adc5_gen3_read_voltage_data(struct adc5_chip *adc, u16 *data, u8 sdam_index)
+{
+	int ret;
+	u8 rslt[2];
+
+	ret = adc5_gen3_read(adc, sdam_index, ADC5_GEN3_CH_DATA0(0), rslt, 2);
+	if (ret)
+		return ret;
+
+	*data = get_unaligned_le16(rslt);
+
+	if (*data == ADC5_USR_DATA_CHECK) {
+		dev_err(adc->dev, "Invalid data:%#x\n", *data);
+		return -EINVAL;
+	}
+
+	dev_dbg(adc->dev, "voltage raw code:%#x\n", *data);
+
+	return 0;
+}
+
+static void adc5_gen3_update_dig_param(struct adc5_chip *adc,
+			struct adc5_channel_prop *prop, u8 *data)
+{
+	/* Update calibration select and decimation ratio select*/
+	*data &= ~(ADC5_GEN3_DIG_PARAM_CAL_SEL_MASK | ADC5_GEN3_DIG_PARAM_DEC_RATIO_SEL_MASK);
+	*data |= FIELD_PREP(ADC5_GEN3_DIG_PARAM_CAL_SEL_MASK, prop->cal_method);
+	*data |= FIELD_PREP(ADC5_GEN3_DIG_PARAM_DEC_RATIO_SEL_MASK, prop->decimation);
+}
+
+# define ADC5_GEN3_READ_CONFIG_REGS 7
+
+static int adc5_gen3_configure(struct adc5_chip *adc,
+			struct adc5_channel_prop *prop)
+{
+	u8 sdam_index = prop->sdam_index;
+	u8 conv_req = 0;
+	u8 buf[ADC5_GEN3_READ_CONFIG_REGS];
+	int ret;
+
+	/* Reserve channel 0 of first SDAM for immediate conversions */
+	if (prop->adc_tm)
+		sdam_index = 0;
+
+	ret = adc5_gen3_read(adc, sdam_index, ADC5_GEN3_SID, buf, sizeof(buf));
+	if (ret)
+		return ret;
+
+	/* Write SID */
+	buf[0] = FIELD_PREP(ADC5_GEN3_SID_MASK, prop->sid);
+
+	/*
+	 * Use channel 0 by default for immediate conversion and
+	 * to indicate there is an actual conversion request
+	 */
+	buf[1] = ADC5_GEN3_CHAN_CONV_REQ | 0;
+
+	buf[2] = ADC5_GEN3_TIME_IMMEDIATE;
+
+	/* Digital param selection */
+	adc5_gen3_update_dig_param(adc, prop, &buf[3]);
+
+	/* Update fast average sample value */
+	buf[4] &= ~ADC5_GEN3_FAST_AVG_CTL_SAMPLES_MASK;
+	buf[4] |= prop->avg_samples | ADC5_GEN3_FAST_AVG_CTL_EN;
+
+	/* Select ADC channel */
+	buf[5] = prop->channel;
+
+	/* Select HW settle delay for channel */
+	buf[6] = FIELD_PREP(ADC5_GEN3_HW_SETTLE_DELAY_MASK, prop->hw_settle_time);
+
+	reinit_completion(&adc->complete);
+
+	ret = adc5_gen3_write(adc, sdam_index, ADC5_GEN3_SID, buf, sizeof(buf));
+	if (ret)
+		return ret;
+
+	conv_req = ADC5_GEN3_CONV_REQ_REQ;
+	return adc5_gen3_write(adc, sdam_index, ADC5_GEN3_CONV_REQ, &conv_req, 1);
+}
+
+/**
+ * Worst case delay from PBS in readying handshake bit
+ * can be up to 15ms, when PBS is busy running other
+ * simultaneous transactions, while in the best case, it is
+ * already ready at this point. Assigning polling delay and
+ * retry count accordingly.
+ */
+
+#define ADC5_GEN3_HS_DELAY_MIN_US		100
+#define ADC5_GEN3_HS_DELAY_MAX_US		110
+#define ADC5_GEN3_HS_RETRY_COUNT		150
+
+static int adc5_gen3_poll_wait_hs(struct adc5_chip *adc,
+				unsigned int sdam_index)
+{
+	u8 conv_req = ADC5_GEN3_CONV_REQ_REQ;
+	u8 status = 0;
+	int ret, count;
+
+	for (count = 0; count < ADC5_GEN3_HS_RETRY_COUNT; count++) {
+		ret = adc5_gen3_read(adc, sdam_index, ADC5_GEN3_HS, &status, 1);
+		if (ret)
+			return ret;
+
+		if (status == ADC5_GEN3_HS_READY) {
+			ret = adc5_gen3_read(adc, sdam_index, ADC5_GEN3_CONV_REQ,
+					&conv_req, 1);
+			if (ret)
+				return ret;
+
+			if (!conv_req)
+				return 0;
+		}
+
+		usleep_range(ADC5_GEN3_HS_DELAY_MIN_US,
+			ADC5_GEN3_HS_DELAY_MAX_US);
+	}
+
+	dev_err(adc->dev, "Setting HS ready bit timed out, status:%#x\n", status);
+	return -ETIMEDOUT;
+}
+
+/**
+ * Worst case delay from PBS for conversion time can be
+ * up to 500ms, when PBS has timed out twice, once for
+ * the initial attempt and once for a retry of the same
+ * transaction.
+ */
+
+#define ADC5_GEN3_CONV_TIMEOUT_MS	501
+
+static int adc5_gen3_do_conversion(struct adc5_chip *adc,
+			struct adc5_channel_prop *prop,
+			u16 *data_volt)
+{
+	u8 val, sdam_index = prop->sdam_index;
+	unsigned long rc;
+	int ret;
+
+	/* Reserve channel 0 of first SDAM for immediate conversions */
+	if (prop->adc_tm)
+		sdam_index = 0;
+
+	mutex_lock(&adc->lock);
+	ret = adc5_gen3_poll_wait_hs(adc, 0);
+	if (ret)
+		goto unlock;
+
+	ret = adc5_gen3_configure(adc, prop);
+	if (ret) {
+		dev_err(adc->dev, "ADC configure failed with %d\n", ret);
+		goto unlock;
+	}
+
+	/* No support for polling mode at present*/
+	rc = wait_for_completion_timeout(&adc->complete,
+					msecs_to_jiffies(ADC5_GEN3_CONV_TIMEOUT_MS));
+	if (!rc) {
+		dev_err(adc->dev, "Reading ADC channel %s timed out\n",
+			prop->label);
+		ret = -ETIMEDOUT;
+		goto unlock;
+	}
+
+	ret = adc5_gen3_read_voltage_data(adc, data_volt, sdam_index);
+	if (ret)
+		goto unlock;
+
+	val = BIT(0);
+	ret = adc5_gen3_write(adc, sdam_index, ADC5_GEN3_EOC_CLR, &val, 1);
+	if (ret)
+		goto unlock;
+
+	/* To indicate conversion request is only to clear a status */
+	val = 0;
+	ret = adc5_gen3_write(adc, sdam_index, ADC5_GEN3_PERPH_CH, &val, 1);
+	if (ret)
+		goto unlock;
+
+	val = ADC5_GEN3_CONV_REQ_REQ;
+	ret = adc5_gen3_write(adc, sdam_index, ADC5_GEN3_CONV_REQ, &val, 1);
+
+unlock:
+	mutex_unlock(&adc->lock);
+
+	return ret;
+}
+
+static int get_sdam_from_irq(struct adc5_chip *adc, int irq)
+{
+	int i;
+
+	for (i = 0; i < adc->num_sdams; i++) {
+		if (adc->base[i].irq == irq)
+			return i;
+	}
+	return -ENOENT;
+}
+
+static irqreturn_t adc5_gen3_isr(int irq, void *dev_id)
+{
+	struct adc5_chip *adc = dev_id;
+	u8 status, tm_status[2], eoc_status, val;
+	int ret, sdam_num;
+
+	sdam_num = get_sdam_from_irq(adc, irq);
+	if (sdam_num < 0) {
+		dev_err(adc->dev, "adc irq %d not associated with an sdam\n", irq);
+		return IRQ_HANDLED;
+	}
+
+	ret = adc5_gen3_read(adc, sdam_num, ADC5_GEN3_STATUS1, &status, 1);
+	if (ret) {
+		dev_err(adc->dev, "adc read status1 failed with %d\n", ret);
+		return IRQ_HANDLED;
+	}
+
+	ret = adc5_gen3_read(adc, sdam_num, ADC5_GEN3_EOC_STS, &eoc_status, 1);
+	if (ret) {
+		dev_err(adc->dev, "adc read eoc status failed with %d\n", ret);
+		return IRQ_HANDLED;
+	}
+
+	if (status & ADC5_GEN3_STATUS1_CONV_FAULT) {
+		dev_err_ratelimited(adc->dev, "Unexpected conversion fault, status:%#x, eoc_status:%#x\n",
+				status, eoc_status);
+		val = ADC5_GEN3_CONV_ERR_CLR_REQ;
+		ret = adc5_gen3_write(adc, sdam_num, ADC5_GEN3_CONV_ERR_CLR, &val, 1);
+		if (ret < 0)
+			return IRQ_HANDLED;
+
+		/* To indicate conversion request is only to clear a status */
+		val = 0;
+		ret = adc5_gen3_write(adc, sdam_num, ADC5_GEN3_PERPH_CH, &val, 1);
+		if (ret < 0)
+			return IRQ_HANDLED;
+
+		val = ADC5_GEN3_CONV_REQ_REQ;
+		ret = adc5_gen3_write(adc, sdam_num, ADC5_GEN3_CONV_REQ, &val, 1);
+
+		return IRQ_HANDLED;
+	}
+
+	/* CHAN0 is the preconfigured channel for immediate conversion */
+	if (eoc_status & ADC5_GEN3_EOC_CHAN_0)
+		complete(&adc->complete);
+
+	ret = adc5_gen3_read(adc, sdam_num, ADC5_GEN3_TM_HIGH_STS, tm_status, 2);
+	if (ret) {
+		dev_err(adc->dev, "adc read TM status failed with %d\n", ret);
+		return IRQ_HANDLED;
+	}
+
+	if (tm_status[0] || tm_status[1])
+		schedule_work(&adc->tm_handler_work);
+
+	dev_dbg(adc->dev, "Interrupt status:%#x, EOC status:%#x, high:%#x, low:%#x\n",
+			status, eoc_status, tm_status[0], tm_status[1]);
+
+	return IRQ_HANDLED;
+}
+
+static void tm_handler_work(struct work_struct *work)
+{
+	struct adc5_chip *adc = container_of(work, struct adc5_chip, tm_handler_work);
+	struct adc5_channel_prop *chan_prop;
+	u8 tm_status[2] = {0};
+	u8 buf[16] = {0};
+	u8 val;
+	int ret, i, sdam_index = -1;
+
+	for (i = 0; i < adc->nchannels; i++) {
+		bool upper_set = false, lower_set = false;
+		int temp, offset;
+		u16 code = 0;
+
+		chan_prop = &adc->chan_props[i];
+		offset = chan_prop->tm_chan_index;
+
+		if (!chan_prop->adc_tm)
+			continue;
+
+		mutex_lock(&adc->lock);
+		if (chan_prop->sdam_index != sdam_index) {
+			sdam_index = chan_prop->sdam_index;
+			ret = adc5_gen3_read(adc, sdam_index, ADC5_GEN3_TM_HIGH_STS,
+					tm_status, 2);
+			if (ret) {
+				dev_err(adc->dev, "adc read TM status failed with %d\n", ret);
+				goto out;
+			}
+
+			ret = adc5_gen3_write(adc, sdam_index, ADC5_GEN3_TM_HIGH_STS_CLR,
+					tm_status, 2);
+			if (ret) {
+				dev_err(adc->dev, "adc write TM status failed with %d\n", ret);
+				goto out;
+			}
+
+			/* To indicate conversion request is only to clear a status */
+			val = 0;
+			ret = adc5_gen3_write(adc, sdam_index, ADC5_GEN3_PERPH_CH, &val, 1);
+			if (ret) {
+				dev_err(adc->dev, "adc write status clear conv_req failed with %d\n",
+						ret);
+				goto out;
+			}
+
+			val = ADC5_GEN3_CONV_REQ_REQ;
+			ret = adc5_gen3_write(adc, sdam_index, ADC5_GEN3_CONV_REQ, &val, 1);
+			if (ret) {
+				dev_err(adc->dev, "adc write conv_req failed with %d\n", ret);
+				goto out;
+			}
+
+			ret = adc5_gen3_read(adc, sdam_index, ADC5_GEN3_CH_DATA0(0), buf,
+					sizeof(buf));
+			if (ret < 0) {
+				dev_err(adc->dev, "adc read data failed with %d\n", ret);
+				goto out;
+			}
+		}
+
+		if ((tm_status[0] & BIT(offset)) && (chan_prop->high_thr_en))
+			upper_set = true;
+
+		if ((tm_status[1] & BIT(offset)) && (chan_prop->low_thr_en))
+			lower_set = true;
+
+		mutex_unlock(&adc->lock);
+
+		if (!(upper_set || lower_set))
+			continue;
+
+		code = get_unaligned_le16(&buf[2 * offset]);
+		pr_debug("ADC_TM threshold code:%#x\n", code);
+
+		ret = qcom_adc5_hw_scale(chan_prop->scale_fn_type,
+			chan_prop->prescale, adc->data, code, &temp);
+		if (ret) {
+			dev_err(adc->dev, "Invalid temperature reading, ret = %d, code=%#x\n",
+					ret, code);
+			continue;
+		}
+
+		chan_prop->last_temp = temp;
+		chan_prop->last_temp_set = true;
+		thermal_zone_device_update(chan_prop->tzd, THERMAL_TRIP_VIOLATED);
+	}
+
+	return;
+
+out:
+	mutex_unlock(&adc->lock);
+}
+
+static int adc5_gen3_fwnode_xlate(struct iio_dev *indio_dev,
+				const struct fwnode_reference_args *iiospec)
+{
+	struct adc5_chip *adc = iio_priv(indio_dev);
+	int i, v_channel;
+
+	for (i = 0; i < adc->nchannels; i++) {
+		v_channel = V_CHAN(adc->chan_props[i]);
+		if (v_channel == iiospec->args[0])
+			return i;
+	}
+
+	return -ENOENT;
+}
+
+static int adc5_gen3_read_raw(struct iio_dev *indio_dev,
+			 struct iio_chan_spec const *chan, int *val, int *val2,
+			 long mask)
+{
+	struct adc5_chip *adc = iio_priv(indio_dev);
+	struct adc5_channel_prop *prop;
+	u16 adc_code_volt;
+	int ret;
+
+	prop = &adc->chan_props[chan->address];
+
+	switch (mask) {
+	case IIO_CHAN_INFO_PROCESSED:
+		ret = adc5_gen3_do_conversion(adc, prop,
+					&adc_code_volt);
+		if (ret)
+			return ret;
+
+		ret = qcom_adc5_hw_scale(prop->scale_fn_type,
+			prop->prescale, adc->data,
+			adc_code_volt, val);
+		if (ret)
+			return ret;
+
+		return IIO_VAL_INT;
+	case IIO_CHAN_INFO_RAW:
+		ret = adc5_gen3_do_conversion(adc, prop,
+					&adc_code_volt);
+		if (ret)
+			return ret;
+		*val = (int)adc_code_volt;
+		return IIO_VAL_INT;
+	default:
+		return -EINVAL;
+	}
+}
+
+static int adc5_gen3_read_label(struct iio_dev *indio_dev,
+			const struct iio_chan_spec *chan, char *label)
+{
+	struct adc5_chip *adc = iio_priv(indio_dev);
+	struct adc5_channel_prop *prop;
+
+	prop = &adc->chan_props[chan->address];
+	return snprintf(label, PAGE_SIZE, "%s\n", prop->label);
+}
+
+static const struct iio_info adc5_gen3_info = {
+	.read_raw = adc5_gen3_read_raw,
+	.read_label = adc5_gen3_read_label,
+	.fwnode_xlate = adc5_gen3_fwnode_xlate,
+};
+
+static int adc_tm_gen3_get_temp(struct thermal_zone_device *tz, int *temp)
+{
+	struct adc5_channel_prop *prop = tz->devdata;
+	struct adc5_chip *adc;
+	u16 adc_code_volt;
+	int ret;
+
+	if (!prop || !prop->chip)
+		return -EINVAL;
+
+	adc = prop->chip;
+
+	if (prop->last_temp_set) {
+		pr_debug("last_temp: %d\n", prop->last_temp);
+		prop->last_temp_set = false;
+		*temp = prop->last_temp;
+		return 0;
+	}
+
+	ret = adc5_gen3_do_conversion(adc, prop, &adc_code_volt);
+	if (ret < 0)
+		return ret;
+
+	return qcom_adc5_hw_scale(prop->scale_fn_type,
+		prop->prescale, adc->data,
+		adc_code_volt, temp);
+}
+
+static int _adc_tm5_gen3_disable_channel(struct adc5_channel_prop *prop)
+{
+	struct adc5_chip *adc = prop->chip;
+	int ret;
+	u8 val;
+
+	prop->high_thr_en = false;
+	prop->low_thr_en = false;
+
+	val = MEAS_INT_DISABLE;
+	ret = adc5_gen3_write(adc, prop->sdam_index, ADC5_GEN3_TIMER_SEL, &val, 1);
+	if (ret)
+		return ret;
+
+	/* To indicate there is an actual conversion request */
+	val = ADC5_GEN3_CHAN_CONV_REQ | prop->tm_chan_index;
+	ret = adc5_gen3_write(adc, prop->sdam_index, ADC5_GEN3_PERPH_CH, &val, 1);
+	if (ret)
+		return ret;
+
+	val = ADC5_GEN3_CONV_REQ_REQ;
+	return adc5_gen3_write(adc, prop->sdam_index, ADC5_GEN3_CONV_REQ, &val, 1);
+}
+
+static int adc_tm5_gen3_disable_channel(struct adc5_channel_prop *prop)
+{
+	return _adc_tm5_gen3_disable_channel(prop);
+}
+
+# define ADC_TM5_GEN3_CONFIG_REGS 12
+
+static int adc_tm5_gen3_configure(struct adc5_channel_prop *prop,
+					int low_temp, int high_temp)
+{
+	struct adc5_chip *adc = prop->chip;
+	u8 conv_req = 0, buf[ADC_TM5_GEN3_CONFIG_REGS];
+	u16 adc_code;
+	int ret;
+
+	ret = adc5_gen3_poll_wait_hs(adc, prop->sdam_index);
+	if (ret < 0)
+		return ret;
+
+	ret = adc5_gen3_read(adc, prop->sdam_index, ADC5_GEN3_SID, buf, sizeof(buf));
+	if (ret < 0)
+		return ret;
+
+	/* Write SID */
+	buf[0] = FIELD_PREP(ADC5_GEN3_SID_MASK, prop->sid);
+
+	/*
+	 * Select TM channel and indicate there is an actual
+	 * conversion request
+	 */
+	buf[1] = ADC5_GEN3_CHAN_CONV_REQ | prop->tm_chan_index;
+
+	buf[2] = prop->timer;
+
+	/* Digital param selection */
+	adc5_gen3_update_dig_param(adc, prop, &buf[3]);
+
+	/* Update fast average sample value */
+	buf[4] &= ~ADC5_GEN3_FAST_AVG_CTL_SAMPLES_MASK;
+	buf[4] |= prop->avg_samples | ADC5_GEN3_FAST_AVG_CTL_EN;
+
+	/* Select ADC channel */
+	buf[5] = prop->channel;
+
+	/* Select HW settle delay for channel */
+	buf[6] = FIELD_PREP(ADC5_GEN3_HW_SETTLE_DELAY_MASK, prop->hw_settle_time);
+
+	/* High temperature corresponds to low voltage threshold */
+	if (high_temp != INT_MAX) {
+		prop->low_thr_en = true;
+		adc_code = qcom_adc_tm5_gen2_temp_res_scale(high_temp);
+		put_unaligned_le16(adc_code, &buf[8]);
+	} else {
+		prop->low_thr_en = false;
+	}
+
+	/* Low temperature corresponds to high voltage threshold */
+	if (low_temp != -INT_MAX) {
+		prop->high_thr_en = true;
+		adc_code = qcom_adc_tm5_gen2_temp_res_scale(low_temp);
+		put_unaligned_le16(adc_code, &buf[10]);
+	} else {
+		prop->high_thr_en = false;
+	}
+
+	buf[7] = 0;
+	if (prop->high_thr_en)
+		buf[7] |= ADC5_GEN3_HIGH_THR_INT_EN;
+	if (prop->low_thr_en)
+		buf[7] |= ADC5_GEN3_LOW_THR_INT_EN;
+
+	ret = adc5_gen3_write(adc, prop->sdam_index, ADC5_GEN3_SID, buf, sizeof(buf));
+	if (ret < 0)
+		return ret;
+
+	conv_req = ADC5_GEN3_CONV_REQ_REQ;
+	return adc5_gen3_write(adc, prop->sdam_index, ADC5_GEN3_CONV_REQ, &conv_req, 1);
+}
+
+static int adc_tm5_gen3_set_trip_temp(struct thermal_zone_device *tz,
+					int low_temp, int high_temp)
+{
+	struct adc5_channel_prop *prop = tz->devdata;
+	struct adc5_chip *adc;
+	int ret;
+
+	if (!prop || !prop->chip)
+		return -EINVAL;
+
+	adc = prop->chip;
+
+	dev_dbg(adc->dev, "channel:%s, low_temp(mdegC):%d, high_temp(mdegC):%d\n",
+		prop->label, low_temp, high_temp);
+
+	mutex_lock(&adc->lock);
+	if (high_temp == INT_MAX && low_temp <= -INT_MAX)
+		ret = adc_tm5_gen3_disable_channel(prop);
+	else
+		ret = adc_tm5_gen3_configure(prop, low_temp, high_temp);
+	mutex_unlock(&adc->lock);
+
+	return ret;
+}
+
+static const struct thermal_zone_device_ops adc_tm_ops = {
+	.get_temp = adc_tm_gen3_get_temp,
+	.set_trips = adc_tm5_gen3_set_trip_temp,
+};
+
+static int adc_tm_register_tzd(struct adc5_chip *adc)
+{
+	unsigned int i, channel;
+	struct thermal_zone_device *tzd;
+
+	for (i = 0; i < adc->nchannels; i++) {
+		channel = V_CHAN(adc->chan_props[i]);
+
+		if (!adc->chan_props[i].adc_tm)
+			continue;
+		tzd = devm_thermal_of_zone_register(adc->dev, channel,
+			&adc->chan_props[i], &adc_tm_ops);
+
+		if (IS_ERR(tzd)) {
+			if (PTR_ERR(tzd) == -ENODEV) {
+				dev_warn(adc->dev, "thermal sensor on channel %d is not used\n",
+					 channel);
+				continue;
+			}
+
+			dev_err(adc->dev, "Error registering TZ zone:%ld for channel:%d\n",
+				PTR_ERR(tzd), adc->chan_props[i].channel);
+			return PTR_ERR(tzd);
+		}
+		adc->chan_props[i].tzd = tzd;
+	}
+
+	return 0;
+}
+
+static void adc5_gen3_disable(void *data)
+{
+	struct adc5_chip *adc = data;
+	int i;
+
+	if (adc->n_tm_channels)
+		cancel_work_sync(&adc->tm_handler_work);
+
+	for (i = 0; i < adc->num_sdams; i++)
+		free_irq(adc->base[i].irq, adc);
+
+	mutex_lock(&adc->lock);
+	/* Disable all available TM channels */
+	for (i = 0; i < adc->nchannels; i++) {
+		if (!adc->chan_props[i].adc_tm)
+			continue;
+		adc5_gen3_poll_wait_hs(adc, adc->chan_props[i].sdam_index);
+		_adc_tm5_gen3_disable_channel(&adc->chan_props[i]);
+	}
+
+	mutex_unlock(&adc->lock);
+}
+
+struct adc5_channels {
+	unsigned int prescale_index;
+	enum iio_chan_type type;
+	long info_mask;
+	enum vadc_scale_fn_type scale_fn_type;
+};
+
+/* In these definitions, _pre refers to an index into adc5_prescale_ratios. */
+#define ADC5_CHAN(_type, _mask, _pre, _scale)	\
+	{						\
+		.prescale_index = _pre,			\
+		.type = _type,				\
+		.info_mask = _mask,			\
+		.scale_fn_type = _scale,		\
+	},						\
+
+#define ADC5_CHAN_TEMP(_pre, _scale)		\
+	ADC5_CHAN(IIO_TEMP, BIT(IIO_CHAN_INFO_PROCESSED), _pre, _scale)	\
+
+#define ADC5_CHAN_VOLT(_pre, _scale)		\
+	ADC5_CHAN(IIO_VOLTAGE, BIT(IIO_CHAN_INFO_PROCESSED), _pre, _scale)	\
+
+#define ADC5_CHAN_CUR(_pre, _scale)		\
+	ADC5_CHAN(IIO_CURRENT, BIT(IIO_CHAN_INFO_PROCESSED), _pre, _scale)	\
+
+static const struct adc5_channels adc5_gen3_chans_pmic[ADC5_MAX_CHANNEL] = {
+	[ADC5_GEN3_OFFSET_REF]		= ADC5_CHAN_VOLT(0, SCALE_HW_CALIB_DEFAULT)
+	[ADC5_GEN3_1P25VREF]		= ADC5_CHAN_VOLT(0, SCALE_HW_CALIB_DEFAULT)
+	[ADC5_GEN3_VPH_PWR]		= ADC5_CHAN_VOLT(1, SCALE_HW_CALIB_DEFAULT)
+	[ADC5_GEN3_VBAT_SNS_QBG]	= ADC5_CHAN_VOLT(1, SCALE_HW_CALIB_DEFAULT)
+	[ADC5_GEN3_USB_SNS_V_16]	= ADC5_CHAN_TEMP(8, SCALE_HW_CALIB_DEFAULT)
+	[ADC5_GEN3_VIN_DIV16_MUX]	= ADC5_CHAN_TEMP(8, SCALE_HW_CALIB_DEFAULT)
+	[ADC5_GEN3_DIE_TEMP]		= ADC5_CHAN_TEMP(0,
+						SCALE_HW_CALIB_PMIC_THERM_PM7)
+	[ADC5_GEN3_TEMP_ALARM_LITE]	= ADC5_CHAN_TEMP(0,
+						SCALE_HW_CALIB_PMIC_THERM_PM7)
+	[ADC5_GEN3_AMUX1_THM_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+	[ADC5_GEN3_AMUX2_THM_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+	[ADC5_GEN3_AMUX3_THM_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+	[ADC5_GEN3_AMUX4_THM_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+	[ADC5_GEN3_AMUX5_THM_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+	[ADC5_GEN3_AMUX6_THM_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+	[ADC5_GEN3_AMUX1_GPIO_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+	[ADC5_GEN3_AMUX2_GPIO_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+	[ADC5_GEN3_AMUX3_GPIO_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+	[ADC5_GEN3_AMUX4_GPIO_100K_PU]	= ADC5_CHAN_TEMP(0,
+					SCALE_HW_CALIB_THERM_100K_PU_PM7)
+};
+
+static int adc5_gen3_get_fw_channel_data(struct adc5_chip *adc,
+				    struct adc5_channel_prop *prop,
+				    struct fwnode_handle *fwnode,
+				    const struct adc5_data *data)
+{
+	const char *name = fwnode_get_name(fwnode);
+	const char *channel_name;
+	struct device *dev = adc->dev;
+	u32 chan, value, varr[2], sid = 0;
+	int ret, val;
+
+	ret = fwnode_property_read_u32(fwnode, "reg", &chan);
+	if (ret < 0)
+		return dev_err_probe(dev, ret, "invalid channel number %s\n", name);
+
+	/*
+	 * Value read from "reg" is virtual channel number
+	 * virtual channel number = sid << 8 | channel number
+	 */
+
+	sid = FIELD_GET(ADC5_GEN3_VIRTUAL_SID_MASK, chan);
+	chan = FIELD_GET(ADC5_GEN3_CHANNEL_MASK, chan);
+
+	if (chan > ADC5_OFFSET_EXT2)
+		return dev_err_probe(dev, -EINVAL, "%s invalid channel number %d\n", name, chan);
+
+	prop->channel = chan;
+	prop->sid = sid;
+
+	ret = fwnode_property_read_string(fwnode, "label", &channel_name);
+	if (ret)
+		channel_name = name;
+	prop->label = channel_name;
+
+	prop->decimation = ADC5_DECIMATION_DEFAULT;
+	ret = fwnode_property_read_u32(fwnode, "qcom,decimation", &value);
+	if (!ret) {
+		ret = qcom_adc5_decimation_from_dt(value, data->decimation);
+		if (ret < 0)
+			return dev_err_probe(dev, ret, "%#x invalid decimation %d\n",
+				chan, value);
+		prop->decimation = ret;
+	}
+
+	prop->prescale = adc->data->adc_chans[prop->channel].prescale_index;
+	ret = fwnode_property_read_u32_array(fwnode, "qcom,pre-scaling", varr, 2);
+	if (!ret) {
+		ret = qcom_adc5_prescaling_from_dt(varr[0], varr[1]);
+		if (ret < 0)
+			return dev_err_probe(dev, ret, "%#x invalid pre-scaling <%d %d>\n",
+				chan, varr[0], varr[1]);
+		prop->prescale = ret;
+	}
+
+	prop->hw_settle_time = VADC_DEF_HW_SETTLE_TIME;
+	ret = fwnode_property_read_u32(fwnode, "qcom,hw-settle-time", &value);
+	if (!ret) {
+		ret = qcom_adc5_hw_settle_time_from_dt(value,
+						data->hw_settle_1);
+		if (ret < 0)
+			return dev_err_probe(dev, ret, "%#x invalid hw-settle-time %d us\n",
+				chan, value);
+		prop->hw_settle_time = ret;
+	}
+
+	prop->avg_samples = VADC_DEF_AVG_SAMPLES;
+	ret = fwnode_property_read_u32(fwnode, "qcom,avg-samples", &value);
+	if (!ret) {
+		ret = qcom_adc5_avg_samples_from_dt(value);
+		if (ret < 0)
+			return dev_err_probe(dev, ret, "%#x invalid avg-samples %d\n",
+				chan, value);
+		prop->avg_samples = ret;
+	}
+
+	if (fwnode_property_read_bool(fwnode, "qcom,ratiometric"))
+		prop->cal_method = ADC5_RATIOMETRIC_CAL;
+	else
+		prop->cal_method = ADC5_ABSOLUTE_CAL;
+
+	prop->timer = MEAS_INT_IMMEDIATE;
+
+	prop->adc_tm = fwnode_property_read_bool(fwnode, "qcom,adc-tm");
+
+	if (prop->adc_tm) {
+		adc->n_tm_channels++;
+		if (adc->n_tm_channels > ((adc->num_sdams * 8) - 1))
+			return dev_err_probe(adc->dev, -EINVAL,
+				"Number of TM nodes %u greater than channels supported:%u\n",
+				adc->n_tm_channels, (adc->num_sdams * 8) - 1);
+
+		val = adc->n_tm_channels / 8;
+		prop->sdam_index = val;
+		prop->tm_chan_index = adc->n_tm_channels - (8*val);
+
+		prop->timer = MEAS_INT_1S;
+	}
+
+	return 0;
+}
+
+static const struct adc5_data adc5_gen3_data_pmic = {
+	.full_scale_code_volt = 0x70e4,
+	.adc_chans = adc5_gen3_chans_pmic,
+	.info = &adc5_gen3_info,
+	.decimation = (unsigned int [ADC5_DECIMATION_SAMPLES_MAX])
+				{85, 340, 1360},
+	.hw_settle_1 = (unsigned int [VADC_HW_SETTLE_SAMPLES_MAX])
+				{15, 100, 200, 300, 400, 500, 600, 700,
+				1000, 2000, 4000, 8000, 16000, 32000,
+				64000, 128000},
+};
+
+static const struct of_device_id adc5_match_table[] = {
+	{
+		.compatible = "qcom,spmi-adc5-gen3",
+		.data = &adc5_gen3_data_pmic,
+	},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, adc5_match_table);
+
+static int adc5_get_fw_data(struct adc5_chip *adc)
+{
+	const struct adc5_channels *adc_chan;
+	struct iio_chan_spec *iio_chan;
+	struct adc5_channel_prop *chan_props;
+	struct fwnode_handle *child;
+	unsigned int index = 0;
+	int ret;
+
+	adc->nchannels = device_get_child_node_count(adc->dev);
+	if (!adc->nchannels)
+		return -EINVAL;
+
+	adc->iio_chans = devm_kcalloc(adc->dev, adc->nchannels,
+				       sizeof(*adc->iio_chans), GFP_KERNEL);
+	if (!adc->iio_chans)
+		return -ENOMEM;
+
+	adc->chan_props = devm_kcalloc(adc->dev, adc->nchannels,
+					sizeof(*adc->chan_props), GFP_KERNEL);
+	if (!adc->chan_props)
+		return -ENOMEM;
+
+	chan_props = adc->chan_props;
+	adc->n_tm_channels = 0;
+	iio_chan = adc->iio_chans;
+	adc->data = device_get_match_data(adc->dev);
+	if (!adc->data)
+		adc->data = &adc5_gen3_data_pmic;
+
+	device_for_each_child_node(adc->dev, child) {
+		ret = adc5_gen3_get_fw_channel_data(adc, chan_props, child, adc->data);
+		if (ret < 0) {
+			fwnode_handle_put(child);
+			return ret;
+		}
+
+		chan_props->chip = adc;
+		chan_props->scale_fn_type =
+			adc->data->adc_chans[chan_props->channel].scale_fn_type;
+		adc_chan = &adc->data->adc_chans[chan_props->channel];
+		iio_chan->channel = V_CHAN(*chan_props);
+		iio_chan->info_mask_separate = adc_chan->info_mask;
+		iio_chan->type = adc_chan->type;
+		iio_chan->address = index;
+		iio_chan->indexed = 1;
+		iio_chan++;
+		chan_props++;
+		index++;
+	}
+
+	return 0;
+}
+
+static int adc5_gen3_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct iio_dev *indio_dev;
+	struct adc5_chip *adc;
+	struct regmap *regmap;
+	int ret, i;
+	u32 *reg;
+
+	regmap = dev_get_regmap(dev->parent, NULL);
+	if (!regmap)
+		return -ENODEV;
+
+	indio_dev = devm_iio_device_alloc(dev, sizeof(*adc));
+	if (!indio_dev)
+		return -ENOMEM;
+
+	adc = iio_priv(indio_dev);
+	adc->regmap = regmap;
+	adc->dev = dev;
+
+	ret = device_property_count_u32(dev, "reg");
+	if (ret < 0)
+		return ret;
+
+	adc->num_sdams = ret;
+
+	reg = kcalloc(adc->num_sdams, sizeof(u32), GFP_KERNEL);
+	if (!reg)
+		return -ENOMEM;
+
+	ret = device_property_read_u32_array(dev, "reg", reg, adc->num_sdams);
+	if (ret)
+		return dev_err_probe(dev, ret, "Failed to read reg property, ret = %d\n", ret);
+
+	adc->base = devm_kcalloc(dev, adc->num_sdams, sizeof(*adc->base), GFP_KERNEL);
+	if (!adc->base)
+		return -ENOMEM;
+
+	platform_set_drvdata(pdev, indio_dev);
+	init_completion(&adc->complete);
+	mutex_init(&adc->lock);
+
+	for (i = 0; i < adc->num_sdams; i++) {
+		adc->base[i].base_addr = reg[i];
+
+		adc->base[i].irq_name = devm_kasprintf(dev, GFP_KERNEL, "adc-sdam%d", i);
+		if (!adc->base[i].irq_name) {
+			kfree(reg);
+			ret = -ENOMEM;
+			goto err_irq;
+		}
+
+		ret = platform_get_irq_byname(pdev, adc->base[i].irq_name);
+		if (ret < 0) {
+			kfree(reg);
+			dev_err(dev, "Getting IRQ %d by name failed, ret = %d\n",
+					adc->base[i].irq, ret);
+			goto err_irq;
+		}
+		adc->base[i].irq = ret;
+
+		ret = request_irq(adc->base[i].irq, adc5_gen3_isr, 0, adc->base[i].irq_name, adc);
+		if (ret < 0) {
+			kfree(reg);
+			dev_err(dev, "Failed to request SDAM%d irq, ret = %d\n", i, ret);
+			goto err_irq;
+		}
+	}
+	kfree(reg);
+
+	ret = devm_add_action(dev, adc5_gen3_disable, adc);
+	if (ret < 0) {
+		dev_err(dev, "failed to register adc disablement devm action, %d\n", ret);
+		goto err_irq;
+	}
+
+	ret = adc5_get_fw_data(adc);
+	if (ret < 0) {
+		dev_err(dev, "adc get dt data failed, ret = %d\n", ret);
+		goto err_irq;
+	}
+
+	ret = adc_tm_register_tzd(adc);
+	if (ret < 0)
+		goto err_irq;
+
+	if (adc->n_tm_channels)
+		INIT_WORK(&adc->tm_handler_work, tm_handler_work);
+
+	indio_dev->name = pdev->name;
+	indio_dev->modes = INDIO_DIRECT_MODE;
+	indio_dev->info = &adc5_gen3_info;
+	indio_dev->channels = adc->iio_chans;
+	indio_dev->num_channels = adc->nchannels;
+
+	ret = devm_iio_device_register(dev, indio_dev);
+	if (!ret)
+		return 0;
+
+err_irq:
+	for (i = 0; i < adc->num_sdams; i++)
+		free_irq(adc->base[i].irq, adc);
+
+	return ret;
+}
+
+static struct platform_driver adc5_gen3_driver = {
+	.driver = {
+		.name = "qcom-spmi-adc5-gen3",
+		.of_match_table = adc5_match_table,
+	},
+	.probe = adc5_gen3_probe,
+};
+module_platform_driver(adc5_gen3_driver);
+
+MODULE_DESCRIPTION("Qualcomm Technologies Inc. PMIC5 Gen3 ADC driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/iio/adc/rockchip_saradc.c
+++ linux-qcom-6.8.0/drivers/iio/adc/rockchip_saradc.c
@@ -52,7 +52,7 @@
 #define SARADC2_START			BIT(4)
 #define SARADC2_SINGLE_MODE		BIT(5)
 
-#define SARADC2_CONV_CHANNELS GENMASK(15, 0)
+#define SARADC2_CONV_CHANNELS GENMASK(3, 0)
 
 struct rockchip_saradc;
 
@@ -102,12 +102,12 @@
 	writel_relaxed(0xc, info->regs + SARADC_T_DAS_SOC);
 	writel_relaxed(0x20, info->regs + SARADC_T_PD_SOC);
 	val = FIELD_PREP(SARADC2_EN_END_INT, 1);
-	val |= val << 16;
+	val |= SARADC2_EN_END_INT << 16;
 	writel_relaxed(val, info->regs + SARADC2_END_INT_EN);
 	val = FIELD_PREP(SARADC2_START, 1) |
 	      FIELD_PREP(SARADC2_SINGLE_MODE, 1) |
 	      FIELD_PREP(SARADC2_CONV_CHANNELS, chn);
-	val |= val << 16;
+	val |= (SARADC2_START | SARADC2_SINGLE_MODE | SARADC2_CONV_CHANNELS) << 16;
 	writel(val, info->regs + SARADC2_CONV_CON);
 }
 
@@ -368,6 +368,8 @@
 	int ret;
 	int i, j = 0;
 
+	memset(&data, 0, sizeof(data));
+
 	mutex_lock(&info->lock);
 
 	for_each_set_bit(i, i_dev->active_scan_mask, i_dev->masklength) {
--- linux-qcom-6.8.0.orig/drivers/iio/adc/stm32-adc.c
+++ linux-qcom-6.8.0/drivers/iio/adc/stm32-adc.c
@@ -2234,6 +2234,7 @@
 			if (vin[0] != val || vin[1] >= adc_info->max_channels) {
 				dev_err(&indio_dev->dev, "Invalid channel in%d-in%d\n",
 					vin[0], vin[1]);
+				ret = -EINVAL;
 				goto err;
 			}
 		} else if (ret != -EINVAL) {
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ti-ads124s08.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ti-ads124s08.c
@@ -183,9 +183,9 @@
 	struct ads124s_private *priv = iio_priv(indio_dev);
 
 	if (priv->reset_gpio) {
-		gpiod_set_value(priv->reset_gpio, 0);
+		gpiod_set_value_cansleep(priv->reset_gpio, 0);
 		udelay(200);
-		gpiod_set_value(priv->reset_gpio, 1);
+		gpiod_set_value_cansleep(priv->reset_gpio, 1);
 	} else {
 		return ads124s_write_cmd(indio_dev, ADS124S08_CMD_RESET);
 	}
--- linux-qcom-6.8.0.orig/drivers/iio/adc/ti-ads8688.c
+++ linux-qcom-6.8.0/drivers/iio/adc/ti-ads8688.c
@@ -382,7 +382,7 @@
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	/* Ensure naturally aligned timestamp */
-	u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)] __aligned(8);
+	u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)] __aligned(8) = { };
 	int i, j = 0;
 
 	for (i = 0; i < indio_dev->masklength; i++) {
--- linux-qcom-6.8.0.orig/drivers/iio/adc/xilinx-ams.c
+++ linux-qcom-6.8.0/drivers/iio/adc/xilinx-ams.c
@@ -414,8 +414,12 @@
 
 	/* Run calibration of PS & PL as part of the sequence */
 	scan_mask = BIT(0) | BIT(AMS_PS_SEQ_MAX);
-	for (i = 0; i < indio_dev->num_channels; i++)
-		scan_mask |= BIT_ULL(indio_dev->channels[i].scan_index);
+	for (i = 0; i < indio_dev->num_channels; i++) {
+		const struct iio_chan_spec *chan = &indio_dev->channels[i];
+
+		if (chan->scan_index < AMS_CTRL_SEQ_BASE)
+			scan_mask |= BIT_ULL(chan->scan_index);
+	}
 
 	if (ams->ps_base) {
 		/* put sysmon in a soft reset to change the sequence */
--- linux-qcom-6.8.0.orig/drivers/iio/amplifiers/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/amplifiers/Kconfig
@@ -27,6 +27,7 @@
 config ADA4250
 	tristate "Analog Devices ADA4250 Instrumentation Amplifier"
 	depends on SPI
+	select REGMAP_SPI
 	help
 	  Say yes here to build support for Analog Devices ADA4250
 	  SPI Amplifier's support. The driver provides direct access via
--- linux-qcom-6.8.0.orig/drivers/iio/buffer/industrialio-buffer-dmaengine.c
+++ linux-qcom-6.8.0/drivers/iio/buffer/industrialio-buffer-dmaengine.c
@@ -159,7 +159,7 @@
  * Once done using the buffer iio_dmaengine_buffer_free() should be used to
  * release it.
  */
-static struct iio_buffer *iio_dmaengine_buffer_alloc(struct device *dev,
+struct iio_buffer *iio_dmaengine_buffer_alloc(struct device *dev,
 	const char *channel)
 {
 	struct dmaengine_buffer *dmaengine_buffer;
@@ -180,7 +180,7 @@
 
 	ret = dma_get_slave_caps(chan, &caps);
 	if (ret < 0)
-		goto err_free;
+		goto err_release;
 
 	/* Needs to be aligned to the maximum of the minimums */
 	if (caps.src_addr_widths)
@@ -206,10 +206,13 @@
 
 	return &dmaengine_buffer->queue.buffer;
 
+err_release:
+	dma_release_channel(chan);
 err_free:
 	kfree(dmaengine_buffer);
 	return ERR_PTR(ret);
 }
+EXPORT_SYMBOL_NS_GPL(iio_dmaengine_buffer_alloc, IIO_DMAENGINE_BUFFER);
 
 /**
  * iio_dmaengine_buffer_free() - Free dmaengine buffer
@@ -217,7 +220,7 @@
  *
  * Frees a buffer previously allocated with iio_dmaengine_buffer_alloc().
  */
-static void iio_dmaengine_buffer_free(struct iio_buffer *buffer)
+void iio_dmaengine_buffer_free(struct iio_buffer *buffer)
 {
 	struct dmaengine_buffer *dmaengine_buffer =
 		iio_buffer_to_dmaengine_buffer(buffer);
@@ -227,6 +230,7 @@
 
 	iio_buffer_put(buffer);
 }
+EXPORT_SYMBOL_NS_GPL(iio_dmaengine_buffer_free, IIO_DMAENGINE_BUFFER);
 
 static void __devm_iio_dmaengine_buffer_free(void *buffer)
 {
@@ -288,7 +292,7 @@
 
 	return iio_device_attach_buffer(indio_dev, buffer);
 }
-EXPORT_SYMBOL_GPL(devm_iio_dmaengine_buffer_setup);
+EXPORT_SYMBOL_NS_GPL(devm_iio_dmaengine_buffer_setup, IIO_DMAENGINE_BUFFER);
 
 MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
 MODULE_DESCRIPTION("DMA buffer for the IIO framework");
--- linux-qcom-6.8.0.orig/drivers/iio/chemical/bme680.h
+++ linux-qcom-6.8.0/drivers/iio/chemical/bme680.h
@@ -54,7 +54,9 @@
 #define   BME680_NB_CONV_MASK			GENMASK(3, 0)
 
 #define BME680_REG_MEAS_STAT_0			0x1D
+#define   BME680_NEW_DATA_BIT			BIT(7)
 #define   BME680_GAS_MEAS_BIT			BIT(6)
+#define   BME680_MEAS_BIT			BIT(5)
 
 /* Calibration Parameters */
 #define BME680_T2_LSB_REG	0x8A
--- linux-qcom-6.8.0.orig/drivers/iio/chemical/bme680_core.c
+++ linux-qcom-6.8.0/drivers/iio/chemical/bme680_core.c
@@ -10,6 +10,8 @@
  */
 #include <linux/acpi.h>
 #include <linux/bitfield.h>
+#include <linux/cleanup.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/module.h>
 #include <linux/log2.h>
@@ -38,7 +40,7 @@
 	s8  par_h3;
 	s8  par_h4;
 	s8  par_h5;
-	s8  par_h6;
+	u8  par_h6;
 	s8  par_h7;
 	s8  par_gh1;
 	s16 par_gh2;
@@ -51,6 +53,7 @@
 struct bme680_data {
 	struct regmap *regmap;
 	struct bme680_calib bme680;
+	struct mutex lock; /* Protect multiple serial R/W ops to device. */
 	u8 oversampling_temp;
 	u8 oversampling_press;
 	u8 oversampling_humid;
@@ -342,10 +345,10 @@
 	if (!calib->par_t2)
 		bme680_read_calib(data, calib);
 
-	var1 = (adc_temp >> 3) - (calib->par_t1 << 1);
+	var1 = (adc_temp >> 3) - ((s32)calib->par_t1 << 1);
 	var2 = (var1 * calib->par_t2) >> 11;
 	var3 = ((var1 >> 1) * (var1 >> 1)) >> 12;
-	var3 = (var3 * (calib->par_t3 << 4)) >> 14;
+	var3 = (var3 * ((s32)calib->par_t3 << 4)) >> 14;
 	data->t_fine = var2 + var3;
 	calc_temp = (data->t_fine * 5 + 128) >> 8;
 
@@ -368,9 +371,9 @@
 	var1 = (data->t_fine >> 1) - 64000;
 	var2 = ((((var1 >> 2) * (var1 >> 2)) >> 11) * calib->par_p6) >> 2;
 	var2 = var2 + (var1 * calib->par_p5 << 1);
-	var2 = (var2 >> 2) + (calib->par_p4 << 16);
+	var2 = (var2 >> 2) + ((s32)calib->par_p4 << 16);
 	var1 = (((((var1 >> 2) * (var1 >> 2)) >> 13) *
-			(calib->par_p3 << 5)) >> 3) +
+			((s32)calib->par_p3 << 5)) >> 3) +
 			((calib->par_p2 * var1) >> 1);
 	var1 = var1 >> 18;
 	var1 = ((32768 + var1) * calib->par_p1) >> 15;
@@ -388,7 +391,7 @@
 	var3 = ((press_comp >> 8) * (press_comp >> 8) *
 			(press_comp >> 8) * calib->par_p10) >> 17;
 
-	press_comp += (var1 + var2 + var3 + (calib->par_p7 << 7)) >> 4;
+	press_comp += (var1 + var2 + var3 + ((s32)calib->par_p7 << 7)) >> 4;
 
 	return press_comp;
 }
@@ -414,7 +417,7 @@
 		 (((temp_scaled * ((temp_scaled * calib->par_h5) / 100))
 		   >> 6) / 100) + (1 << 14))) >> 10;
 	var3 = var1 * var2;
-	var4 = calib->par_h6 << 7;
+	var4 = (s32)calib->par_h6 << 7;
 	var4 = (var4 + ((temp_scaled * calib->par_h7) / 100)) >> 4;
 	var5 = ((var3 >> 14) * (var3 >> 14)) >> 10;
 	var6 = (var4 * var5) >> 1;
@@ -532,6 +535,43 @@
 	return ilog2(val) + 1;
 }
 
+/*
+ * Taken from Bosch BME680 API:
+ * https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x.c#L490
+ */
+static int bme680_wait_for_eoc(struct bme680_data *data)
+{
+	struct device *dev = regmap_get_device(data->regmap);
+	unsigned int check;
+	int ret;
+	/*
+	 * (Sum of oversampling ratios * time per oversampling) +
+	 * TPH measurement + gas measurement + wait transition from forced mode
+	 * + heater duration
+	 */
+	int wait_eoc_us = ((data->oversampling_temp + data->oversampling_press +
+			   data->oversampling_humid) * 1936) + (477 * 4) +
+			   (477 * 5) + 1000 + (data->heater_dur * 1000);
+
+	usleep_range(wait_eoc_us, wait_eoc_us + 100);
+
+	ret = regmap_read(data->regmap, BME680_REG_MEAS_STAT_0, &check);
+	if (ret) {
+		dev_err(dev, "failed to read measurement status register.\n");
+		return ret;
+	}
+	if (check & BME680_MEAS_BIT) {
+		dev_err(dev, "Device measurement cycle incomplete.\n");
+		return -EBUSY;
+	}
+	if (!(check & BME680_NEW_DATA_BIT)) {
+		dev_err(dev, "No new data available from the device.\n");
+		return -ENODATA;
+	}
+
+	return 0;
+}
+
 static int bme680_chip_config(struct bme680_data *data)
 {
 	struct device *dev = regmap_get_device(data->regmap);
@@ -622,6 +662,10 @@
 	if (ret < 0)
 		return ret;
 
+	ret = bme680_wait_for_eoc(data);
+	if (ret)
+		return ret;
+
 	ret = regmap_bulk_read(data->regmap, BME680_REG_TEMP_MSB,
 			       &tmp, 3);
 	if (ret < 0) {
@@ -678,7 +722,7 @@
 	}
 
 	*val = bme680_compensate_press(data, adc_press);
-	*val2 = 100;
+	*val2 = 1000;
 	return IIO_VAL_FRACTIONAL;
 }
 
@@ -738,6 +782,10 @@
 	if (ret < 0)
 		return ret;
 
+	ret = bme680_wait_for_eoc(data);
+	if (ret)
+		return ret;
+
 	ret = regmap_read(data->regmap, BME680_REG_MEAS_STAT_0, &check);
 	if (check & BME680_GAS_MEAS_BIT) {
 		dev_err(dev, "gas measurement incomplete\n");
@@ -781,6 +829,8 @@
 {
 	struct bme680_data *data = iio_priv(indio_dev);
 
+	guard(mutex)(&data->lock);
+
 	switch (mask) {
 	case IIO_CHAN_INFO_PROCESSED:
 		switch (chan->type) {
@@ -825,6 +875,8 @@
 {
 	struct bme680_data *data = iio_priv(indio_dev);
 
+	guard(mutex)(&data->lock);
+
 	if (val2 != 0)
 		return -EINVAL;
 
@@ -921,6 +973,7 @@
 		name = bme680_match_acpi_device(dev);
 
 	data = iio_priv(indio_dev);
+	mutex_init(&data->lock);
 	dev_set_drvdata(dev, indio_dev);
 	data->regmap = regmap;
 	indio_dev->name = name;
--- linux-qcom-6.8.0.orig/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ linux-qcom-6.8.0/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -32,7 +32,7 @@
 	latency = integer * 1000 + fract / 1000;
 	ret = hid_sensor_set_report_latency(attrb, latency);
 	if (ret < 0)
-		return len;
+		return ret;
 
 	attrb->latency_ms = hid_sensor_get_report_latency(attrb);
 
--- linux-qcom-6.8.0.orig/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
+++ linux-qcom-6.8.0/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
@@ -60,11 +60,19 @@
 int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts,
 				     uint32_t period, bool fifo)
 {
+	uint32_t mult;
+
 	/* when FIFO is on, prevent odr change if one is already pending */
 	if (fifo && ts->new_mult != 0)
 		return -EAGAIN;
 
-	ts->new_mult = period / ts->chip.clock_period;
+	mult = period / ts->chip.clock_period;
+	if (mult != ts->mult)
+		ts->new_mult = mult;
+
+	/* When FIFO is off, directly apply the new ODR */
+	if (!fifo)
+		inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
 
 	return 0;
 }
@@ -101,6 +109,9 @@
 
 static void inv_align_timestamp_it(struct inv_sensors_timestamp *ts)
 {
+	const int64_t period_min = ts->min_period * ts->mult;
+	const int64_t period_max = ts->max_period * ts->mult;
+	int64_t add_max, sub_max;
 	int64_t delta, jitter;
 	int64_t adjust;
 
@@ -108,11 +119,13 @@
 	delta = ts->it.lo - ts->timestamp;
 
 	/* adjust timestamp while respecting jitter */
+	add_max = period_max - (int64_t)ts->period;
+	sub_max = period_min - (int64_t)ts->period;
 	jitter = INV_SENSORS_TIMESTAMP_JITTER((int64_t)ts->period, ts->chip.jitter);
 	if (delta > jitter)
-		adjust = jitter;
+		adjust = add_max;
 	else if (delta < -jitter)
-		adjust = -jitter;
+		adjust = sub_max;
 	else
 		adjust = 0;
 
--- linux-qcom-6.8.0.orig/drivers/iio/dac/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/dac/Kconfig
@@ -9,6 +9,8 @@
 config AD3552R
 	tristate "Analog Devices AD3552R DAC driver"
 	depends on SPI_MASTER
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 	help
 	  Say yes here to build support for Analog Devices AD3552R
 	  Digital to Analog Converter.
@@ -214,6 +216,8 @@
 config AD5766
 	tristate "Analog Devices AD5766/AD5767 DAC driver"
 	depends on SPI_MASTER
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 	help
 	  Say yes here to build support for Analog Devices AD5766, AD5767
 	  Digital to Analog Converter.
@@ -224,6 +228,7 @@
 config AD5770R
 	tristate "Analog Devices AD5770R IDAC driver"
 	depends on SPI_MASTER
+	select REGMAP_SPI
 	help
 	  Say yes here to build support for Analog Devices AD5770R Digital to
 	  Analog Converter.
@@ -315,6 +320,7 @@
 config LTC1660
 	tristate "Linear Technology LTC1660/LTC1665 DAC SPI driver"
 	depends on SPI
+	select REGMAP_SPI
 	help
 	  Say yes here to build support for Linear Technology
 	  LTC1660 and LTC1665 Digital to Analog Converters.
@@ -434,6 +440,7 @@
 
 config STM32_DAC_CORE
 	tristate
+	select REGMAP_MMIO
 
 config TI_DAC082S085
 	tristate "Texas Instruments 8/10/12-bit 2/4-channel DAC driver"
--- linux-qcom-6.8.0.orig/drivers/iio/dac/ad5592r-base.c
+++ linux-qcom-6.8.0/drivers/iio/dac/ad5592r-base.c
@@ -415,7 +415,7 @@
 			s64 tmp = *val * (3767897513LL / 25LL);
 			*val = div_s64_rem(tmp, 1000000000LL, val2);
 
-			return IIO_VAL_INT_PLUS_MICRO;
+			return IIO_VAL_INT_PLUS_NANO;
 		}
 
 		mutex_lock(&st->lock);
--- linux-qcom-6.8.0.orig/drivers/iio/dummy/iio_simple_dummy_buffer.c
+++ linux-qcom-6.8.0/drivers/iio/dummy/iio_simple_dummy_buffer.c
@@ -48,7 +48,7 @@
 	int i = 0, j;
 	u16 *data;
 
-	data = kmalloc(indio_dev->scan_bytes, GFP_KERNEL);
+	data = kzalloc(indio_dev->scan_bytes, GFP_KERNEL);
 	if (!data)
 		goto done;
 
--- linux-qcom-6.8.0.orig/drivers/iio/frequency/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/frequency/Kconfig
@@ -53,6 +53,7 @@
 config ADF4377
 	tristate "Analog Devices ADF4377 Microwave Wideband Synthesizer"
 	depends on SPI && COMMON_CLK
+	select REGMAP_SPI
 	help
 	  Say yes here to build support for Analog Devices ADF4377 Microwave
 	  Wideband Synthesizer.
@@ -81,25 +82,26 @@
 	  module will be called admv1014.
 
 config ADMV4420
-       tristate "Analog Devices ADMV4420 K Band Downconverter"
-       depends on SPI
-       help
-         Say yes here to build support for Analog Devices K Band
-         Downconverter with integrated Fractional-N PLL and VCO.
+	tristate "Analog Devices ADMV4420 K Band Downconverter"
+	depends on SPI
+	select REGMAP_SPI
+	help
+	  Say yes here to build support for Analog Devices K Band
+	  Downconverter with integrated Fractional-N PLL and VCO.
 
-         To compile this driver as a module, choose M here: the
-         module will be called admv4420.
+	  To compile this driver as a module, choose M here: the
+	  module will be called admv4420.
 
 config ADRF6780
-        tristate "Analog Devices ADRF6780 Microwave Upconverter"
-        depends on SPI
-        depends on COMMON_CLK
-        help
-          Say yes here to build support for Analog Devices ADRF6780
-          5.9 GHz to 23.6 GHz, Wideband, Microwave Upconverter.
+	tristate "Analog Devices ADRF6780 Microwave Upconverter"
+	depends on SPI
+	depends on COMMON_CLK
+	help
+	  Say yes here to build support for Analog Devices ADRF6780
+	  5.9 GHz to 23.6 GHz, Wideband, Microwave Upconverter.
 
-          To compile this driver as a module, choose M here: the
-          module will be called adrf6780.
+	  To compile this driver as a module, choose M here: the
+	  module will be called adrf6780.
 
 endmenu
 endmenu
--- linux-qcom-6.8.0.orig/drivers/iio/frequency/adrf6780.c
+++ linux-qcom-6.8.0/drivers/iio/frequency/adrf6780.c
@@ -9,7 +9,6 @@
 #include <linux/bits.h>
 #include <linux/clk.h>
 #include <linux/clkdev.h>
-#include <linux/clk-provider.h>
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/iio/iio.h>
--- linux-qcom-6.8.0.orig/drivers/iio/gyro/fxas21002c_core.c
+++ linux-qcom-6.8.0/drivers/iio/gyro/fxas21002c_core.c
@@ -730,14 +730,21 @@
 	int ret;
 
 	mutex_lock(&data->lock);
+	ret = fxas21002c_pm_get(data);
+	if (ret < 0)
+		goto out_unlock;
+
 	ret = regmap_bulk_read(data->regmap, FXAS21002C_REG_OUT_X_MSB,
 			       data->buffer, CHANNEL_SCAN_MAX * sizeof(s16));
 	if (ret < 0)
-		goto out_unlock;
+		goto out_pm_put;
 
 	iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
 					   data->timestamp);
 
+out_pm_put:
+	fxas21002c_pm_put(data);
+
 out_unlock:
 	mutex_unlock(&data->lock);
 
--- linux-qcom-6.8.0.orig/drivers/iio/imu/adis16475.c
+++ linux-qcom-6.8.0/drivers/iio/imu/adis16475.c
@@ -1289,6 +1289,7 @@
 	struct device *dev = &st->adis.spi->dev;
 	const struct adis16475_sync *sync;
 	u32 sync_mode;
+	u16 val;
 
 	/* default to internal clk */
 	st->clk_freq = st->info->int_clk * 1000;
@@ -1350,8 +1351,9 @@
 	 * I'm keeping this for simplicity and avoiding extra variables
 	 * in chip_info.
 	 */
+	val = ADIS16475_SYNC_MODE(sync->sync_mode);
 	ret = __adis_update_bits(&st->adis, ADIS16475_REG_MSG_CTRL,
-				 ADIS16475_SYNC_MODE_MASK, sync->sync_mode);
+				 ADIS16475_SYNC_MODE_MASK, val);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/iio/imu/bmi323/bmi323_core.c
+++ linux-qcom-6.8.0/drivers/iio/imu/bmi323/bmi323_core.c
@@ -1391,7 +1391,7 @@
 				       &data->buffer.channels,
 				       ARRAY_SIZE(data->buffer.channels));
 		if (ret)
-			return IRQ_NONE;
+			goto out;
 	} else {
 		for_each_set_bit(bit, indio_dev->active_scan_mask,
 				 BMI323_CHAN_MAX) {
@@ -1400,13 +1400,14 @@
 					      &data->buffer.channels[index++],
 					      BMI323_BYTES_PER_SAMPLE);
 			if (ret)
-				return IRQ_NONE;
+				goto out;
 		}
 	}
 
 	iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
 					   iio_get_time_ns(indio_dev));
 
+out:
 	iio_trigger_notify_done(indio_dev->trig);
 
 	return IRQ_HANDLED;
--- linux-qcom-6.8.0.orig/drivers/iio/imu/inv_icm42600/inv_icm42600.h
+++ linux-qcom-6.8.0/drivers/iio/imu/inv_icm42600/inv_icm42600.h
@@ -362,6 +362,7 @@
 typedef int (*inv_icm42600_bus_setup)(struct inv_icm42600_state *);
 
 extern const struct regmap_config inv_icm42600_regmap_config;
+extern const struct regmap_config inv_icm42600_spi_regmap_config;
 extern const struct dev_pm_ops inv_icm42600_pm_ops;
 
 const struct iio_mount_matrix *
--- linux-qcom-6.8.0.orig/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ linux-qcom-6.8.0/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -99,7 +99,6 @@
 					       const unsigned long *scan_mask)
 {
 	struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
-	struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
 	struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
 	unsigned int fifo_en = 0;
 	unsigned int sleep_temp = 0;
@@ -127,12 +126,7 @@
 	}
 
 	/* update data FIFO write */
-	inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
 	ret = inv_icm42600_buffer_set_fifo_en(st, fifo_en | st->fifo.en);
-	if (ret)
-		goto out_unlock;
-
-	ret = inv_icm42600_buffer_update_watermark(st);
 
 out_unlock:
 	mutex_unlock(&st->lock);
--- linux-qcom-6.8.0.orig/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
+++ linux-qcom-6.8.0/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
@@ -17,6 +17,7 @@
 #include <linux/regmap.h>
 
 #include <linux/iio/iio.h>
+#include <linux/iio/common/inv_sensors_timestamp.h>
 
 #include "inv_icm42600.h"
 #include "inv_icm42600_buffer.h"
@@ -34,15 +35,74 @@
 	},
 };
 
+static const struct regmap_range inv_icm42600_regmap_volatile_yes_ranges[] = {
+	/* Sensor data registers */
+	regmap_reg_range(0x001D, 0x002A),
+	/* INT status, FIFO, APEX data */
+	regmap_reg_range(0x002D, 0x0038),
+	/* Signal path reset */
+	regmap_reg_range(0x004B, 0x004B),
+	/* FIFO lost packets */
+	regmap_reg_range(0x006C, 0x006D),
+	/* Timestamp value */
+	regmap_reg_range(0x1062, 0x1064),
+};
+
+static const struct regmap_range inv_icm42600_regmap_volatile_no_ranges[] = {
+	regmap_reg_range(0x0000, 0x001C),
+	regmap_reg_range(0x006E, 0x1061),
+	regmap_reg_range(0x1065, 0x4FFF),
+};
+
+static const struct regmap_access_table inv_icm42600_regmap_volatile_accesses[] = {
+	{
+		.yes_ranges = inv_icm42600_regmap_volatile_yes_ranges,
+		.n_yes_ranges = ARRAY_SIZE(inv_icm42600_regmap_volatile_yes_ranges),
+		.no_ranges = inv_icm42600_regmap_volatile_no_ranges,
+		.n_no_ranges = ARRAY_SIZE(inv_icm42600_regmap_volatile_no_ranges),
+	},
+};
+
+static const struct regmap_range inv_icm42600_regmap_rd_noinc_no_ranges[] = {
+	regmap_reg_range(0x0000, INV_ICM42600_REG_FIFO_DATA - 1),
+	regmap_reg_range(INV_ICM42600_REG_FIFO_DATA + 1, 0x4FFF),
+};
+
+static const struct regmap_access_table inv_icm42600_regmap_rd_noinc_accesses[] = {
+	{
+		.no_ranges = inv_icm42600_regmap_rd_noinc_no_ranges,
+		.n_no_ranges = ARRAY_SIZE(inv_icm42600_regmap_rd_noinc_no_ranges),
+	},
+};
+
 const struct regmap_config inv_icm42600_regmap_config = {
+	.name = "inv_icm42600",
 	.reg_bits = 8,
 	.val_bits = 8,
 	.max_register = 0x4FFF,
 	.ranges = inv_icm42600_regmap_ranges,
 	.num_ranges = ARRAY_SIZE(inv_icm42600_regmap_ranges),
+	.volatile_table = inv_icm42600_regmap_volatile_accesses,
+	.rd_noinc_table = inv_icm42600_regmap_rd_noinc_accesses,
+	.cache_type = REGCACHE_RBTREE,
 };
 EXPORT_SYMBOL_NS_GPL(inv_icm42600_regmap_config, IIO_ICM42600);
 
+/* define specific regmap for SPI not supporting burst write */
+const struct regmap_config inv_icm42600_spi_regmap_config = {
+	.name = "inv_icm42600",
+	.reg_bits = 8,
+	.val_bits = 8,
+	.max_register = 0x4FFF,
+	.ranges = inv_icm42600_regmap_ranges,
+	.num_ranges = ARRAY_SIZE(inv_icm42600_regmap_ranges),
+	.volatile_table = inv_icm42600_regmap_volatile_accesses,
+	.rd_noinc_table = inv_icm42600_regmap_rd_noinc_accesses,
+	.cache_type = REGCACHE_RBTREE,
+	.use_single_write = true,
+};
+EXPORT_SYMBOL_NS_GPL(inv_icm42600_spi_regmap_config, IIO_ICM42600);
+
 struct inv_icm42600_hw {
 	uint8_t whoami;
 	const char *name;
@@ -725,6 +785,8 @@
 static int inv_icm42600_resume(struct device *dev)
 {
 	struct inv_icm42600_state *st = dev_get_drvdata(dev);
+	struct inv_sensors_timestamp *gyro_ts = iio_priv(st->indio_gyro);
+	struct inv_sensors_timestamp *accel_ts = iio_priv(st->indio_accel);
 	int ret;
 
 	mutex_lock(&st->lock);
@@ -745,9 +807,12 @@
 		goto out_unlock;
 
 	/* restore FIFO data streaming */
-	if (st->fifo.on)
+	if (st->fifo.on) {
+		inv_sensors_timestamp_reset(gyro_ts);
+		inv_sensors_timestamp_reset(accel_ts);
 		ret = regmap_write(st->map, INV_ICM42600_REG_FIFO_CONFIG,
 				   INV_ICM42600_FIFO_CONFIG_STREAM);
+	}
 
 out_unlock:
 	mutex_unlock(&st->lock);
--- linux-qcom-6.8.0.orig/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ linux-qcom-6.8.0/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -99,7 +99,6 @@
 					      const unsigned long *scan_mask)
 {
 	struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
-	struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
 	struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
 	unsigned int fifo_en = 0;
 	unsigned int sleep_gyro = 0;
@@ -127,12 +126,7 @@
 	}
 
 	/* update data FIFO write */
-	inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
 	ret = inv_icm42600_buffer_set_fifo_en(st, fifo_en | st->fifo.en);
-	if (ret)
-		goto out_unlock;
-
-	ret = inv_icm42600_buffer_update_watermark(st);
 
 out_unlock:
 	mutex_unlock(&st->lock);
--- linux-qcom-6.8.0.orig/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c
+++ linux-qcom-6.8.0/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c
@@ -59,7 +59,8 @@
 		return -EINVAL;
 	chip = (uintptr_t)match;
 
-	regmap = devm_regmap_init_spi(spi, &inv_icm42600_regmap_config);
+	/* use SPI specific regmap */
+	regmap = devm_regmap_init_spi(spi, &inv_icm42600_spi_regmap_config);
 	if (IS_ERR(regmap))
 		return PTR_ERR(regmap);
 
--- linux-qcom-6.8.0.orig/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
+++ linux-qcom-6.8.0/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
@@ -111,7 +111,6 @@
 	if (enable) {
 		/* reset timestamping */
 		inv_sensors_timestamp_reset(&st->timestamp);
-		inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0);
 		/* reset FIFO */
 		d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST;
 		ret = regmap_write(st->map, st->reg->user_ctrl, d);
--- linux-qcom-6.8.0.orig/drivers/iio/imu/kmx61.c
+++ linux-qcom-6.8.0/drivers/iio/imu/kmx61.c
@@ -1192,7 +1192,7 @@
 	struct kmx61_data *data = kmx61_get_data(indio_dev);
 	int bit, ret, i = 0;
 	u8 base;
-	s16 buffer[8];
+	s16 buffer[8] = { };
 
 	if (indio_dev == data->acc_indio_dev)
 		base = KMX61_ACC_XOUT_L;
--- linux-qcom-6.8.0.orig/drivers/iio/industrialio-backend.c
+++ linux-qcom-6.8.0/drivers/iio/industrialio-backend.c
@@ -0,0 +1,418 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Framework to handle complex IIO aggregate devices.
+ *
+ * The typical architecture is to have one device as the frontend device which
+ * can be "linked" against one or multiple backend devices. All the IIO and
+ * userspace interface is expected to be registers/managed by the frontend
+ * device which will callback into the backends when needed (to get/set some
+ * configuration that it does not directly control).
+ *
+ *                                           -------------------------------------------------------
+ * ------------------                        | ------------         ------------      -------  FPGA|
+ * |     ADC        |------------------------| | ADC CORE |---------| DMA CORE |------| RAM |      |
+ * | (Frontend/IIO) | Serial Data (eg: LVDS) | |(backend) |---------|          |------|     |      |
+ * |                |------------------------| ------------         ------------      -------      |
+ * ------------------                        -------------------------------------------------------
+ *
+ * The framework interface is pretty simple:
+ *   - Backends should register themselves with devm_iio_backend_register()
+ *   - Frontend devices should get backends with devm_iio_backend_get()
+ *
+ * Also to note that the primary target for this framework are converters like
+ * ADC/DACs so iio_backend_ops will have some operations typical of converter
+ * devices. On top of that, this is "generic" for all IIO which means any kind
+ * of device can make use of the framework. That said, If the iio_backend_ops
+ * struct begins to grow out of control, we can always refactor things so that
+ * the industrialio-backend.c is only left with the really generic stuff. Then,
+ * we can build on top of it depending on the needs.
+ *
+ * Copyright (C) 2023-2024 Analog Devices Inc.
+ */
+#define dev_fmt(fmt) "iio-backend: " fmt
+
+#include <linux/cleanup.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/property.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+
+#include <linux/iio/backend.h>
+
+struct iio_backend {
+	struct list_head entry;
+	const struct iio_backend_ops *ops;
+	struct device *dev;
+	struct module *owner;
+	void *priv;
+};
+
+/*
+ * Helper struct for requesting buffers. This ensures that we have all data
+ * that we need to free the buffer in a device managed action.
+ */
+struct iio_backend_buffer_pair {
+	struct iio_backend *back;
+	struct iio_buffer *buffer;
+};
+
+static LIST_HEAD(iio_back_list);
+static DEFINE_MUTEX(iio_back_lock);
+
+/*
+ * Helper macros to call backend ops. Makes sure the option is supported.
+ */
+#define iio_backend_check_op(back, op) ({ \
+	struct iio_backend *____back = back;				\
+	int ____ret = 0;						\
+									\
+	if (!____back->ops->op)						\
+		____ret = -EOPNOTSUPP;					\
+									\
+	____ret;							\
+})
+
+#define iio_backend_op_call(back, op, args...) ({		\
+	struct iio_backend *__back = back;			\
+	int __ret;						\
+								\
+	__ret = iio_backend_check_op(__back, op);		\
+	if (!__ret)						\
+		__ret = __back->ops->op(__back, ##args);	\
+								\
+	__ret;							\
+})
+
+#define iio_backend_ptr_op_call(back, op, args...) ({		\
+	struct iio_backend *__back = back;			\
+	void *ptr_err;						\
+	int __ret;						\
+								\
+	__ret = iio_backend_check_op(__back, op);		\
+	if (__ret)						\
+		ptr_err = ERR_PTR(__ret);			\
+	else							\
+		ptr_err = __back->ops->op(__back, ##args);	\
+								\
+	ptr_err;						\
+})
+
+#define iio_backend_void_op_call(back, op, args...) {		\
+	struct iio_backend *__back = back;			\
+	int __ret;						\
+								\
+	__ret = iio_backend_check_op(__back, op);		\
+	if (!__ret)						\
+		__back->ops->op(__back, ##args);		\
+}
+
+/**
+ * iio_backend_chan_enable - Enable a backend channel
+ * @back:	Backend device
+ * @chan:	Channel number
+ *
+ * RETURNS:
+ * 0 on success, negative error number on failure.
+ */
+int iio_backend_chan_enable(struct iio_backend *back, unsigned int chan)
+{
+	return iio_backend_op_call(back, chan_enable, chan);
+}
+EXPORT_SYMBOL_NS_GPL(iio_backend_chan_enable, IIO_BACKEND);
+
+/**
+ * iio_backend_chan_disable - Disable a backend channel
+ * @back:	Backend device
+ * @chan:	Channel number
+ *
+ * RETURNS:
+ * 0 on success, negative error number on failure.
+ */
+int iio_backend_chan_disable(struct iio_backend *back, unsigned int chan)
+{
+	return iio_backend_op_call(back, chan_disable, chan);
+}
+EXPORT_SYMBOL_NS_GPL(iio_backend_chan_disable, IIO_BACKEND);
+
+static void __iio_backend_disable(void *back)
+{
+	iio_backend_void_op_call(back, disable);
+}
+
+/**
+ * devm_iio_backend_enable - Device managed backend enable
+ * @dev:	Consumer device for the backend
+ * @back:	Backend device
+ *
+ * RETURNS:
+ * 0 on success, negative error number on failure.
+ */
+int devm_iio_backend_enable(struct device *dev, struct iio_backend *back)
+{
+	int ret;
+
+	ret = iio_backend_op_call(back, enable);
+	if (ret)
+		return ret;
+
+	return devm_add_action_or_reset(dev, __iio_backend_disable, back);
+}
+EXPORT_SYMBOL_NS_GPL(devm_iio_backend_enable, IIO_BACKEND);
+
+/**
+ * iio_backend_data_format_set - Configure the channel data format
+ * @back:	Backend device
+ * @chan:	Channel number
+ * @data:	Data format
+ *
+ * Properly configure a channel with respect to the expected data format. A
+ * @struct iio_backend_data_fmt must be passed with the settings.
+ *
+ * RETURNS:
+ * 0 on success, negative error number on failure.
+ */
+int iio_backend_data_format_set(struct iio_backend *back, unsigned int chan,
+				const struct iio_backend_data_fmt *data)
+{
+	if (!data || data->type >= IIO_BACKEND_DATA_TYPE_MAX)
+		return -EINVAL;
+
+	return iio_backend_op_call(back, data_format_set, chan, data);
+}
+EXPORT_SYMBOL_NS_GPL(iio_backend_data_format_set, IIO_BACKEND);
+
+static void iio_backend_free_buffer(void *arg)
+{
+	struct iio_backend_buffer_pair *pair = arg;
+
+	iio_backend_void_op_call(pair->back, free_buffer, pair->buffer);
+}
+
+/**
+ * devm_iio_backend_request_buffer - Device managed buffer request
+ * @dev:	Consumer device for the backend
+ * @back:	Backend device
+ * @indio_dev:	IIO device
+ *
+ * Request an IIO buffer from the backend. The type of the buffer (typically
+ * INDIO_BUFFER_HARDWARE) is up to the backend to decide. This is because,
+ * normally, the backend dictates what kind of buffering we can get.
+ *
+ * The backend .free_buffer() hooks is automatically called on @dev detach.
+ *
+ * RETURNS:
+ * 0 on success, negative error number on failure.
+ */
+int devm_iio_backend_request_buffer(struct device *dev,
+				    struct iio_backend *back,
+				    struct iio_dev *indio_dev)
+{
+	struct iio_backend_buffer_pair *pair;
+	struct iio_buffer *buffer;
+
+	pair = devm_kzalloc(dev, sizeof(*pair), GFP_KERNEL);
+	if (!pair)
+		return -ENOMEM;
+
+	buffer = iio_backend_ptr_op_call(back, request_buffer, indio_dev);
+	if (IS_ERR(buffer))
+		return PTR_ERR(buffer);
+
+	/* weak reference should be all what we need */
+	pair->back = back;
+	pair->buffer = buffer;
+
+	return devm_add_action_or_reset(dev, iio_backend_free_buffer, pair);
+}
+EXPORT_SYMBOL_NS_GPL(devm_iio_backend_request_buffer, IIO_BACKEND);
+
+static void iio_backend_release(void *arg)
+{
+	struct iio_backend *back = arg;
+
+	module_put(back->owner);
+}
+
+static int __devm_iio_backend_get(struct device *dev, struct iio_backend *back)
+{
+	struct device_link *link;
+	int ret;
+
+	/*
+	 * Make sure the provider cannot be unloaded before the consumer module.
+	 * Note that device_links would still guarantee that nothing is
+	 * accessible (and breaks) but this makes it explicit that the consumer
+	 * module must be also unloaded.
+	 */
+	if (!try_module_get(back->owner))
+		return dev_err_probe(dev, -ENODEV,
+				     "Cannot get module reference\n");
+
+	ret = devm_add_action_or_reset(dev, iio_backend_release, back);
+	if (ret)
+		return ret;
+
+	link = device_link_add(dev, back->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
+	if (!link)
+		return dev_err_probe(dev, -EINVAL,
+				     "Could not link to supplier(%s)\n",
+				     dev_name(back->dev));
+
+	dev_dbg(dev, "Found backend(%s) device\n", dev_name(back->dev));
+
+	return 0;
+}
+
+/**
+ * devm_iio_backend_get - Device managed backend device get
+ * @dev:	Consumer device for the backend
+ * @name:	Backend name
+ *
+ * Get's the backend associated with @dev.
+ *
+ * RETURNS:
+ * A backend pointer, negative error pointer otherwise.
+ */
+struct iio_backend *devm_iio_backend_get(struct device *dev, const char *name)
+{
+	struct fwnode_handle *fwnode;
+	struct iio_backend *back;
+	unsigned int index;
+	int ret;
+
+	if (name) {
+		ret = device_property_match_string(dev, "io-backend-names",
+						   name);
+		if (ret < 0)
+			return ERR_PTR(ret);
+		index = ret;
+	} else {
+		index = 0;
+	}
+
+	fwnode = fwnode_find_reference(dev_fwnode(dev), "io-backends", index);
+	if (IS_ERR(fwnode)) {
+		dev_err_probe(dev, PTR_ERR(fwnode),
+			      "Cannot get Firmware reference\n");
+		return ERR_CAST(fwnode);
+	}
+
+	guard(mutex)(&iio_back_lock);
+	list_for_each_entry(back, &iio_back_list, entry) {
+		if (!device_match_fwnode(back->dev, fwnode))
+			continue;
+
+		fwnode_handle_put(fwnode);
+		ret = __devm_iio_backend_get(dev, back);
+		if (ret)
+			return ERR_PTR(ret);
+
+		return back;
+	}
+
+	fwnode_handle_put(fwnode);
+	return ERR_PTR(-EPROBE_DEFER);
+}
+EXPORT_SYMBOL_NS_GPL(devm_iio_backend_get, IIO_BACKEND);
+
+/**
+ * __devm_iio_backend_get_from_fwnode_lookup - Device managed fwnode backend device get
+ * @dev:	Consumer device for the backend
+ * @fwnode:	Firmware node of the backend device
+ *
+ * Search the backend list for a device matching @fwnode.
+ * This API should not be used and it's only present for preventing the first
+ * user of this framework to break it's DT ABI.
+ *
+ * RETURNS:
+ * A backend pointer, negative error pointer otherwise.
+ */
+struct iio_backend *
+__devm_iio_backend_get_from_fwnode_lookup(struct device *dev,
+					  struct fwnode_handle *fwnode)
+{
+	struct iio_backend *back;
+	int ret;
+
+	guard(mutex)(&iio_back_lock);
+	list_for_each_entry(back, &iio_back_list, entry) {
+		if (!device_match_fwnode(back->dev, fwnode))
+			continue;
+
+		ret = __devm_iio_backend_get(dev, back);
+		if (ret)
+			return ERR_PTR(ret);
+
+		return back;
+	}
+
+	return ERR_PTR(-EPROBE_DEFER);
+}
+EXPORT_SYMBOL_NS_GPL(__devm_iio_backend_get_from_fwnode_lookup, IIO_BACKEND);
+
+/**
+ * iio_backend_get_priv - Get driver private data
+ * @back:	Backend device
+ */
+void *iio_backend_get_priv(const struct iio_backend *back)
+{
+	return back->priv;
+}
+EXPORT_SYMBOL_NS_GPL(iio_backend_get_priv, IIO_BACKEND);
+
+static void iio_backend_unregister(void *arg)
+{
+	struct iio_backend *back = arg;
+
+	guard(mutex)(&iio_back_lock);
+	list_del(&back->entry);
+}
+
+/**
+ * devm_iio_backend_register - Device managed backend device register
+ * @dev:	Backend device being registered
+ * @ops:	Backend ops
+ * @priv:	Device private data
+ *
+ * @ops is mandatory. Not providing it results in -EINVAL.
+ *
+ * RETURNS:
+ * 0 on success, negative error number on failure.
+ */
+int devm_iio_backend_register(struct device *dev,
+			      const struct iio_backend_ops *ops, void *priv)
+{
+	struct iio_backend *back;
+
+	if (!ops)
+		return dev_err_probe(dev, -EINVAL, "No backend ops given\n");
+
+	/*
+	 * Through device_links, we guarantee that a frontend device cannot be
+	 * bound/exist if the backend driver is not around. Hence, we can bind
+	 * the backend object lifetime with the device being passed since
+	 * removing it will tear the frontend/consumer down.
+	 */
+	back = devm_kzalloc(dev, sizeof(*back), GFP_KERNEL);
+	if (!back)
+		return -ENOMEM;
+
+	back->ops = ops;
+	back->owner = dev->driver->owner;
+	back->dev = dev;
+	back->priv = priv;
+	scoped_guard(mutex, &iio_back_lock)
+		list_add(&back->entry, &iio_back_list);
+
+	return devm_add_action_or_reset(dev, iio_backend_unregister, back);
+}
+EXPORT_SYMBOL_NS_GPL(devm_iio_backend_register, IIO_BACKEND);
+
+MODULE_AUTHOR("Nuno Sa <nuno.sa@analog.com>");
+MODULE_DESCRIPTION("Framework to handle complex IIO aggregate devices");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/iio/industrialio-core.c
+++ linux-qcom-6.8.0/drivers/iio/industrialio-core.c
@@ -759,9 +759,11 @@
 							INDIO_MAX_RAW_ELEMENTS,
 							vals, &val_len,
 							this_attr->address);
-	else
+	else if (indio_dev->info->read_raw)
 		ret = indio_dev->info->read_raw(indio_dev, this_attr->c,
 				    &vals[0], &vals[1], this_attr->address);
+	else
+		return -EINVAL;
 
 	if (ret < 0)
 		return ret;
@@ -843,6 +845,9 @@
 	int length;
 	int type;
 
+	if (!indio_dev->info->read_avail)
+		return -EINVAL;
+
 	ret = indio_dev->info->read_avail(indio_dev, this_attr->c,
 					  &vals, &type, &length,
 					  this_attr->address);
@@ -1656,8 +1661,10 @@
 		return NULL;
 
 	indio_dev = &iio_dev_opaque->indio_dev;
-	indio_dev->priv = (char *)iio_dev_opaque +
-		ALIGN(sizeof(struct iio_dev_opaque), IIO_DMA_MINALIGN);
+
+	if (sizeof_priv)
+		indio_dev->priv = (char *)iio_dev_opaque +
+			ALIGN(sizeof(*iio_dev_opaque), IIO_DMA_MINALIGN);
 
 	indio_dev->dev.parent = parent;
 	indio_dev->dev.type = &iio_device_type;
--- linux-qcom-6.8.0.orig/drivers/iio/industrialio-event.c
+++ linux-qcom-6.8.0/drivers/iio/industrialio-event.c
@@ -285,6 +285,9 @@
 	if (ret < 0)
 		return ret;
 
+	if (!indio_dev->info->write_event_config)
+		return -EINVAL;
+
 	ret = indio_dev->info->write_event_config(indio_dev,
 		this_attr->c, iio_ev_attr_type(this_attr),
 		iio_ev_attr_dir(this_attr), val);
@@ -300,6 +303,9 @@
 	struct iio_dev_attr *this_attr = to_iio_dev_attr(attr);
 	int val;
 
+	if (!indio_dev->info->read_event_config)
+		return -EINVAL;
+
 	val = indio_dev->info->read_event_config(indio_dev,
 		this_attr->c, iio_ev_attr_type(this_attr),
 		iio_ev_attr_dir(this_attr));
@@ -318,6 +324,9 @@
 	int val, val2, val_arr[2];
 	int ret;
 
+	if (!indio_dev->info->read_event_value)
+		return -EINVAL;
+
 	ret = indio_dev->info->read_event_value(indio_dev,
 		this_attr->c, iio_ev_attr_type(this_attr),
 		iio_ev_attr_dir(this_attr), iio_ev_attr_info(this_attr),
--- linux-qcom-6.8.0.orig/drivers/iio/industrialio-gts-helper.c
+++ linux-qcom-6.8.0/drivers/iio/industrialio-gts-helper.c
@@ -34,24 +34,11 @@
 static int iio_gts_get_gain(const u64 max, const u64 scale)
 {
 	u64 full = max;
-	int tmp = 1;
 
 	if (scale > full || !scale)
 		return -EINVAL;
 
-	if (U64_MAX - full < scale) {
-		/* Risk of overflow */
-		if (full - scale < scale)
-			return 1;
-
-		full -= scale;
-		tmp++;
-	}
-
-	while (full > scale * (u64)tmp)
-		tmp++;
-
-	return tmp;
+	return div64_u64(full, scale);
 }
 
 /**
@@ -180,7 +167,7 @@
 
 static int gain_to_scaletables(struct iio_gts *gts, int **gains, int **scales)
 {
-	int ret, i, j, new_idx, time_idx;
+	int i, j, new_idx, time_idx, ret = 0;
 	int *all_gains;
 	size_t gain_bytes;
 
@@ -218,7 +205,7 @@
 	memcpy(all_gains, gains[time_idx], gain_bytes);
 	new_idx = gts->num_hwgain;
 
-	while (time_idx--) {
+	while (time_idx-- > 0) {
 		for (j = 0; j < gts->num_hwgain; j++) {
 			int candidate = gains[time_idx][j];
 			int chk;
@@ -320,13 +307,15 @@
 	if (ret)
 		goto err_free_out;
 
+	for (i = 0; i < gts->num_itime; i++)
+		kfree(per_time_gains[i]);
 	kfree(per_time_gains);
 	gts->per_time_avail_scale_tables = per_time_scales;
 
 	return 0;
 
 err_free_out:
-	for (i--; i; i--) {
+	for (i--; i >= 0; i--) {
 		kfree(per_time_scales[i]);
 		kfree(per_time_gains[i]);
 	}
@@ -375,17 +364,20 @@
 	for (i = gts->num_itime - 1; i >= 0; i--) {
 		int new = gts->itime_table[i].time_us;
 
-		if (times[idx] < new) {
+		if (idx == 0 || times[idx - 1] < new) {
 			times[idx++] = new;
 			continue;
 		}
 
-		for (j = 0; j <= idx; j++) {
+		for (j = 0; j < idx; j++) {
+			if (times[j] == new)
+				break;
 			if (times[j] > new) {
 				memmove(&times[j + 1], &times[j],
 					(idx - j) * sizeof(int));
 				times[j] = new;
 				idx++;
+				break;
 			}
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/iio/industrialio-trigger.c
+++ linux-qcom-6.8.0/drivers/iio/industrialio-trigger.c
@@ -322,7 +322,7 @@
 	 * this is the case if the IIO device and the trigger device share the
 	 * same parent device.
 	 */
-	if (iio_validate_own_trigger(pf->indio_dev, trig))
+	if (!iio_validate_own_trigger(pf->indio_dev, trig))
 		trig->attached_own_device = true;
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/iio/inkern.c
+++ linux-qcom-6.8.0/drivers/iio/inkern.c
@@ -277,7 +277,7 @@
 			return ERR_PTR(-ENODEV);
 		}
 
-		chan = __fwnode_iio_channel_get_by_name(fwnode, name);
+		chan = __fwnode_iio_channel_get_by_name(parent, name);
 		if (!IS_ERR(chan) || PTR_ERR(chan) != -ENODEV) {
 			fwnode_handle_put(parent);
  			return chan;
@@ -514,7 +514,7 @@
 	return chans;
 
 error_free_chans:
-	for (i = 0; i < nummaps; i++)
+	for (i = 0; i < mapind; i++)
 		iio_device_put(chans[i].indio_dev);
 	kfree(chans);
 error_ret:
@@ -562,6 +562,7 @@
 static int iio_channel_read(struct iio_channel *chan, int *val, int *val2,
 			    enum iio_chan_info_enum info)
 {
+	const struct iio_info *iio_info = chan->indio_dev->info;
 	int unused;
 	int vals[INDIO_MAX_RAW_ELEMENTS];
 	int ret;
@@ -573,15 +574,18 @@
 	if (!iio_channel_has_info(chan->channel, info))
 		return -EINVAL;
 
-	if (chan->indio_dev->info->read_raw_multi) {
-		ret = chan->indio_dev->info->read_raw_multi(chan->indio_dev,
-					chan->channel, INDIO_MAX_RAW_ELEMENTS,
-					vals, &val_len, info);
+	if (iio_info->read_raw_multi) {
+		ret = iio_info->read_raw_multi(chan->indio_dev,
+					       chan->channel,
+					       INDIO_MAX_RAW_ELEMENTS,
+					       vals, &val_len, info);
 		*val = vals[0];
 		*val2 = vals[1];
+	} else if (iio_info->read_raw) {
+		ret = iio_info->read_raw(chan->indio_dev,
+					 chan->channel, val, val2, info);
 	} else {
-		ret = chan->indio_dev->info->read_raw(chan->indio_dev,
-					chan->channel, val, val2, info);
+		return -EINVAL;
 	}
 
 	return ret;
@@ -676,17 +680,17 @@
 		break;
 	case IIO_VAL_INT_PLUS_MICRO:
 		if (scale_val2 < 0)
-			*processed = -raw64 * scale_val;
+			*processed = -raw64 * scale_val * scale;
 		else
-			*processed = raw64 * scale_val;
+			*processed = raw64 * scale_val * scale;
 		*processed += div_s64(raw64 * (s64)scale_val2 * scale,
 				      1000000LL);
 		break;
 	case IIO_VAL_INT_PLUS_NANO:
 		if (scale_val2 < 0)
-			*processed = -raw64 * scale_val;
+			*processed = -raw64 * scale_val * scale;
 		else
-			*processed = raw64 * scale_val;
+			*processed = raw64 * scale_val * scale;
 		*processed += div_s64(raw64 * (s64)scale_val2 * scale,
 				      1000000000LL);
 		break;
@@ -801,11 +805,15 @@
 				  const int **vals, int *type, int *length,
 				  enum iio_chan_info_enum info)
 {
+	const struct iio_info *iio_info = chan->indio_dev->info;
+
 	if (!iio_channel_has_available(chan->channel, info))
 		return -EINVAL;
 
-	return chan->indio_dev->info->read_avail(chan->indio_dev, chan->channel,
-						 vals, type, length, info);
+	if (iio_info->read_avail)
+		return iio_info->read_avail(chan->indio_dev, chan->channel,
+					    vals, type, length, info);
+	return -EINVAL;
 }
 
 int iio_read_avail_channel_attribute(struct iio_channel *chan,
@@ -995,8 +1003,12 @@
 static int iio_channel_write(struct iio_channel *chan, int val, int val2,
 			     enum iio_chan_info_enum info)
 {
-	return chan->indio_dev->info->write_raw(chan->indio_dev,
-						chan->channel, val, val2, info);
+	const struct iio_info *iio_info = chan->indio_dev->info;
+
+	if (iio_info->write_raw)
+		return iio_info->write_raw(chan->indio_dev,
+					   chan->channel, val, val2, info);
+	return -EINVAL;
 }
 
 int iio_write_channel_attribute(struct iio_channel *chan, int val, int val2,
--- linux-qcom-6.8.0.orig/drivers/iio/light/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/light/Kconfig
@@ -309,6 +309,8 @@
 	depends on I2C
 	select REGMAP_I2C
 	select IIO_GTS_HELPER
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 	help
 	  Enable support for the ROHM BU27008 color sensor.
 	  The ROHM BU27008 is a sensor with 5 photodiodes (red, green,
--- linux-qcom-6.8.0.orig/drivers/iio/light/al3010.c
+++ linux-qcom-6.8.0/drivers/iio/light/al3010.c
@@ -87,7 +87,12 @@
 	int ret;
 
 	ret = al3010_set_pwr(data->client, true);
+	if (ret < 0)
+		return ret;
 
+	ret = devm_add_action_or_reset(&data->client->dev,
+				       al3010_set_pwr_off,
+				       data);
 	if (ret < 0)
 		return ret;
 
@@ -190,12 +195,6 @@
 		return ret;
 	}
 
-	ret = devm_add_action_or_reset(&client->dev,
-					al3010_set_pwr_off,
-					data);
-	if (ret < 0)
-		return ret;
-
 	return devm_iio_device_register(&client->dev, indio_dev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/iio/light/ltr501.c
+++ linux-qcom-6.8.0/drivers/iio/light/ltr501.c
@@ -1612,6 +1612,8 @@
 	{ "LTER0501", ltr501 },
 	{ "LTER0559", ltr559 },
 	{ "LTER0301", ltr301 },
+	/* https://www.catalog.update.microsoft.com/Search.aspx?q=lter0303 */
+	{ "LTER0303", ltr303 },
 	{ },
 };
 MODULE_DEVICE_TABLE(acpi, ltr_acpi_match);
--- linux-qcom-6.8.0.orig/drivers/iio/light/opt3001.c
+++ linux-qcom-6.8.0/drivers/iio/light/opt3001.c
@@ -139,6 +139,10 @@
 		.val2 = 400000,
 	},
 	{
+		.val = 41932,
+		.val2 = 800000,
+	},
+	{
 		.val = 83865,
 		.val2 = 600000,
 	},
--- linux-qcom-6.8.0.orig/drivers/iio/light/vcnl4035.c
+++ linux-qcom-6.8.0/drivers/iio/light/vcnl4035.c
@@ -105,7 +105,7 @@
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct vcnl4035_data *data = iio_priv(indio_dev);
 	/* Ensure naturally aligned timestamp */
-	u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)]  __aligned(8);
+	u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)]  __aligned(8) = { };
 	int ret;
 
 	ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer);
--- linux-qcom-6.8.0.orig/drivers/iio/light/veml6030.c
+++ linux-qcom-6.8.0/drivers/iio/light/veml6030.c
@@ -99,9 +99,8 @@
 static ssize_t in_illuminance_period_available_show(struct device *dev,
 				struct device_attribute *attr, char *buf)
 {
+	struct veml6030_data *data = iio_priv(dev_to_iio_dev(dev));
 	int ret, reg, x;
-	struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
-	struct veml6030_data *data = iio_priv(indio_dev);
 
 	ret = regmap_read(data->regmap, VEML6030_REG_ALS_CONF, &reg);
 	if (ret) {
@@ -523,7 +522,7 @@
 			}
 			if (mask == IIO_CHAN_INFO_PROCESSED) {
 				*val = (reg * data->cur_resolution) / 10000;
-				*val2 = (reg * data->cur_resolution) % 10000;
+				*val2 = (reg * data->cur_resolution) % 10000 * 100;
 				return IIO_VAL_INT_PLUS_MICRO;
 			}
 			*val = reg;
@@ -780,7 +779,7 @@
 
 	/* Cache currently active measurement parameters */
 	data->cur_gain = 3;
-	data->cur_resolution = 4608;
+	data->cur_resolution = 5376;
 	data->cur_integration_time = 3;
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/iio/magnetometer/ak8975.c
+++ linux-qcom-6.8.0/drivers/iio/magnetometer/ak8975.c
@@ -692,22 +692,8 @@
 	if (ret < 0)
 		return ret;
 
-	/* This will be executed only for non-interrupt based waiting case */
-	if (ret & data->def->ctrl_masks[ST1_DRDY]) {
-		ret = i2c_smbus_read_byte_data(client,
-					       data->def->ctrl_regs[ST2]);
-		if (ret < 0) {
-			dev_err(&client->dev, "Error in reading ST2\n");
-			return ret;
-		}
-		if (ret & (data->def->ctrl_masks[ST2_DERR] |
-			   data->def->ctrl_masks[ST2_HOFL])) {
-			dev_err(&client->dev, "ST2 status error 0x%x\n", ret);
-			return -EINVAL;
-		}
-	}
-
-	return 0;
+	/* Return with zero if the data is ready. */
+	return !data->def->ctrl_regs[ST1_DRDY];
 }
 
 /* Retrieve raw flux value for one of the x, y, or z axis.  */
@@ -734,6 +720,20 @@
 	if (ret < 0)
 		goto exit;
 
+	/* Read out ST2 for release lock on measurment data. */
+	ret = i2c_smbus_read_byte_data(client, data->def->ctrl_regs[ST2]);
+	if (ret < 0) {
+		dev_err(&client->dev, "Error in reading ST2\n");
+		goto exit;
+	}
+
+	if (ret & (data->def->ctrl_masks[ST2_DERR] |
+		   data->def->ctrl_masks[ST2_HOFL])) {
+		dev_err(&client->dev, "ST2 status error 0x%x\n", ret);
+		ret = -EINVAL;
+		goto exit;
+	}
+
 	mutex_unlock(&data->lock);
 
 	pm_runtime_mark_last_busy(&data->client->dev);
@@ -1081,7 +1081,6 @@
 	{ .compatible = "asahi-kasei,ak09912", .data = &ak_def_array[AK09912] },
 	{ .compatible = "ak09912", .data = &ak_def_array[AK09912] },
 	{ .compatible = "asahi-kasei,ak09916", .data = &ak_def_array[AK09916] },
-	{ .compatible = "ak09916", .data = &ak_def_array[AK09916] },
 	{}
 };
 MODULE_DEVICE_TABLE(of, ak8975_of_match);
--- linux-qcom-6.8.0.orig/drivers/iio/magnetometer/yamaha-yas530.c
+++ linux-qcom-6.8.0/drivers/iio/magnetometer/yamaha-yas530.c
@@ -372,6 +372,7 @@
 	u8 data[8];
 	u16 xy1y2[3];
 	s32 h[3], s[3];
+	int half_range = BIT(13);
 	int i, ret;
 
 	mutex_lock(&yas5xx->lock);
@@ -406,13 +407,13 @@
 	/* The second version of YAS537 needs to include calibration coefficients */
 	if (yas5xx->version == YAS537_VERSION_1) {
 		for (i = 0; i < 3; i++)
-			s[i] = xy1y2[i] - BIT(13);
-		h[0] = (c->k *   (128 * s[0] + c->a2 * s[1] + c->a3 * s[2])) / BIT(13);
-		h[1] = (c->k * (c->a4 * s[0] + c->a5 * s[1] + c->a6 * s[2])) / BIT(13);
-		h[2] = (c->k * (c->a7 * s[0] + c->a8 * s[1] + c->a9 * s[2])) / BIT(13);
+			s[i] = xy1y2[i] - half_range;
+		h[0] = (c->k *   (128 * s[0] + c->a2 * s[1] + c->a3 * s[2])) / half_range;
+		h[1] = (c->k * (c->a4 * s[0] + c->a5 * s[1] + c->a6 * s[2])) / half_range;
+		h[2] = (c->k * (c->a7 * s[0] + c->a8 * s[1] + c->a9 * s[2])) / half_range;
 		for (i = 0; i < 3; i++) {
-			clamp_val(h[i], -BIT(13), BIT(13) - 1);
-			xy1y2[i] = h[i] + BIT(13);
+			h[i] = clamp(h[i], -half_range, half_range - 1);
+			xy1y2[i] = h[i] + half_range;
 		}
 	}
 
--- linux-qcom-6.8.0.orig/drivers/iio/pressure/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/pressure/Kconfig
@@ -19,6 +19,9 @@
 config ROHM_BM1390
 	tristate "ROHM BM1390GLV-Z pressure sensor driver"
 	depends on I2C
+	select REGMAP_I2C
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 	help
 	  Support for the ROHM BM1390 pressure sensor. The BM1390GLV-Z
 	  can measure pressures ranging from 300 hPa to 1300 hPa with
--- linux-qcom-6.8.0.orig/drivers/iio/pressure/bmp280-core.c
+++ linux-qcom-6.8.0/drivers/iio/pressure/bmp280-core.c
@@ -52,7 +52,6 @@
  */
 enum { AC1, AC2, AC3, AC4, AC5, AC6, B1, B2, MB, MC, MD };
 
-
 enum bmp380_odr {
 	BMP380_ODR_200HZ,
 	BMP380_ODR_100HZ,
@@ -181,18 +180,19 @@
 	struct bmp280_calib *calib = &data->calib.bmp280;
 	int ret;
 
-
 	/* Read temperature and pressure calibration values. */
 	ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_TEMP_START,
-			       data->bmp280_cal_buf, sizeof(data->bmp280_cal_buf));
+			       data->bmp280_cal_buf,
+			       sizeof(data->bmp280_cal_buf));
 	if (ret < 0) {
 		dev_err(data->dev,
-			"failed to read temperature and pressure calibration parameters\n");
+			"failed to read calibration parameters\n");
 		return ret;
 	}
 
-	/* Toss the temperature and pressure calibration data into the entropy pool */
-	add_device_randomness(data->bmp280_cal_buf, sizeof(data->bmp280_cal_buf));
+	/* Toss calibration data into the entropy pool */
+	add_device_randomness(data->bmp280_cal_buf,
+			      sizeof(data->bmp280_cal_buf));
 
 	/* Parse temperature calibration values. */
 	calib->T1 = le16_to_cpu(data->bmp280_cal_buf[T1]);
@@ -223,7 +223,7 @@
 	/* Load shared calibration params with bmp280 first */
 	ret = bmp280_read_calib(data);
 	if  (ret < 0) {
-		dev_err(dev, "failed to read common bmp280 calibration parameters\n");
+		dev_err(dev, "failed to read calibration parameters\n");
 		return ret;
 	}
 
@@ -235,14 +235,14 @@
 	 * Humidity data is only available on BME280.
 	 */
 
-	ret = regmap_read(data->regmap, BMP280_REG_COMP_H1, &tmp);
+	ret = regmap_read(data->regmap, BME280_REG_COMP_H1, &tmp);
 	if (ret < 0) {
 		dev_err(dev, "failed to read H1 comp value\n");
 		return ret;
 	}
 	calib->H1 = tmp;
 
-	ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_H2,
+	ret = regmap_bulk_read(data->regmap, BME280_REG_COMP_H2,
 			       &data->le16, sizeof(data->le16));
 	if (ret < 0) {
 		dev_err(dev, "failed to read H2 comp value\n");
@@ -250,14 +250,14 @@
 	}
 	calib->H2 = sign_extend32(le16_to_cpu(data->le16), 15);
 
-	ret = regmap_read(data->regmap, BMP280_REG_COMP_H3, &tmp);
+	ret = regmap_read(data->regmap, BME280_REG_COMP_H3, &tmp);
 	if (ret < 0) {
 		dev_err(dev, "failed to read H3 comp value\n");
 		return ret;
 	}
 	calib->H3 = tmp;
 
-	ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_H4,
+	ret = regmap_bulk_read(data->regmap, BME280_REG_COMP_H4,
 			       &data->be16, sizeof(data->be16));
 	if (ret < 0) {
 		dev_err(dev, "failed to read H4 comp value\n");
@@ -266,15 +266,15 @@
 	calib->H4 = sign_extend32(((be16_to_cpu(data->be16) >> 4) & 0xff0) |
 				  (be16_to_cpu(data->be16) & 0xf), 11);
 
-	ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_H5,
+	ret = regmap_bulk_read(data->regmap, BME280_REG_COMP_H5,
 			       &data->le16, sizeof(data->le16));
 	if (ret < 0) {
 		dev_err(dev, "failed to read H5 comp value\n");
 		return ret;
 	}
-	calib->H5 = sign_extend32(FIELD_GET(BMP280_COMP_H5_MASK, le16_to_cpu(data->le16)), 11);
+	calib->H5 = sign_extend32(FIELD_GET(BME280_COMP_H5_MASK, le16_to_cpu(data->le16)), 11);
 
-	ret = regmap_read(data->regmap, BMP280_REG_COMP_H6, &tmp);
+	ret = regmap_read(data->regmap, BME280_REG_COMP_H6, &tmp);
 	if (ret < 0) {
 		dev_err(dev, "failed to read H6 comp value\n");
 		return ret;
@@ -283,13 +283,14 @@
 
 	return 0;
 }
+
 /*
  * Returns humidity in percent, resolution is 0.01 percent. Output value of
  * "47445" represents 47445/1024 = 46.333 %RH.
  *
  * Taken from BME280 datasheet, Section 4.2.3, "Compensation formula".
  */
-static u32 bmp280_compensate_humidity(struct bmp280_data *data,
+static u32 bme280_compensate_humidity(struct bmp280_data *data,
 				      s32 adc_humidity)
 {
 	struct bmp280_calib *calib = &data->calib.bmp280;
@@ -305,7 +306,7 @@
 	var = clamp_val(var, 0, 419430400);
 
 	return var >> 12;
-};
+}
 
 /*
  * Returns temperature in DegC, resolution is 0.01 DegC.  Output value of
@@ -429,7 +430,7 @@
 	return IIO_VAL_FRACTIONAL;
 }
 
-static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2)
+static int bme280_read_humid(struct bmp280_data *data, int *val, int *val2)
 {
 	u32 comp_humidity;
 	s32 adc_humidity;
@@ -440,7 +441,7 @@
 	if (ret < 0)
 		return ret;
 
-	ret = regmap_bulk_read(data->regmap, BMP280_REG_HUMIDITY_MSB,
+	ret = regmap_bulk_read(data->regmap, BME280_REG_HUMIDITY_MSB,
 			       &data->be16, sizeof(data->be16));
 	if (ret < 0) {
 		dev_err(data->dev, "failed to read humidity\n");
@@ -453,7 +454,7 @@
 		dev_err(data->dev, "reading humidity skipped\n");
 		return -EIO;
 	}
-	comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
+	comp_humidity = bme280_compensate_humidity(data, adc_humidity);
 
 	*val = comp_humidity * 1000 / 1024;
 
@@ -537,8 +538,8 @@
 	return ret;
 }
 
-static int bmp280_write_oversampling_ratio_humid(struct bmp280_data *data,
-					       int val)
+static int bme280_write_oversampling_ratio_humid(struct bmp280_data *data,
+						 int val)
 {
 	const int *avail = data->chip_info->oversampling_humid_avail;
 	const int n = data->chip_info->num_oversampling_humid_avail;
@@ -563,7 +564,7 @@
 }
 
 static int bmp280_write_oversampling_ratio_temp(struct bmp280_data *data,
-					       int val)
+						int val)
 {
 	const int *avail = data->chip_info->oversampling_temp_avail;
 	const int n = data->chip_info->num_oversampling_temp_avail;
@@ -588,7 +589,7 @@
 }
 
 static int bmp280_write_oversampling_ratio_press(struct bmp280_data *data,
-					       int val)
+						 int val)
 {
 	const int *avail = data->chip_info->oversampling_press_avail;
 	const int n = data->chip_info->num_oversampling_press_avail;
@@ -681,7 +682,7 @@
 		mutex_lock(&data->lock);
 		switch (chan->type) {
 		case IIO_HUMIDITYRELATIVE:
-			ret = bmp280_write_oversampling_ratio_humid(data, val);
+			ret = bme280_write_oversampling_ratio_humid(data, val);
 			break;
 		case IIO_PRESSURE:
 			ret = bmp280_write_oversampling_ratio_press(data, val);
@@ -772,13 +773,12 @@
 	int ret;
 
 	ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS,
-				 BMP280_OSRS_TEMP_MASK |
-				 BMP280_OSRS_PRESS_MASK |
-				 BMP280_MODE_MASK,
-				 osrs | BMP280_MODE_NORMAL);
+				BMP280_OSRS_TEMP_MASK |
+				BMP280_OSRS_PRESS_MASK |
+				BMP280_MODE_MASK,
+				osrs | BMP280_MODE_NORMAL);
 	if (ret < 0) {
-		dev_err(data->dev,
-			"failed to write ctrl_meas register\n");
+		dev_err(data->dev, "failed to write ctrl_meas register\n");
 		return ret;
 	}
 
@@ -786,8 +786,7 @@
 				 BMP280_FILTER_MASK,
 				 BMP280_FILTER_4X);
 	if (ret < 0) {
-		dev_err(data->dev,
-			"failed to write config register\n");
+		dev_err(data->dev, "failed to write config register\n");
 		return ret;
 	}
 
@@ -833,16 +832,15 @@
 
 static int bme280_chip_config(struct bmp280_data *data)
 {
-	u8 osrs = FIELD_PREP(BMP280_OSRS_HUMIDITY_MASK, data->oversampling_humid + 1);
+	u8 osrs = FIELD_PREP(BME280_OSRS_HUMIDITY_MASK, data->oversampling_humid + 1);
 	int ret;
 
 	/*
 	 * Oversampling of humidity must be set before oversampling of
 	 * temperature/pressure is set to become effective.
 	 */
-	ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_HUMIDITY,
-				  BMP280_OSRS_HUMIDITY_MASK, osrs);
-
+	ret = regmap_update_bits(data->regmap, BME280_REG_CTRL_HUMIDITY,
+				 BME280_OSRS_HUMIDITY_MASK, osrs);
 	if (ret < 0)
 		return ret;
 
@@ -855,7 +853,7 @@
 	.id_reg = BMP280_REG_ID,
 	.chip_id = bme280_chip_ids,
 	.num_chip_id = ARRAY_SIZE(bme280_chip_ids),
-	.regmap_config = &bmp280_regmap_config,
+	.regmap_config = &bme280_regmap_config,
 	.start_up_time = 2000,
 	.channels = bmp280_channels,
 	.num_channels = 3,
@@ -870,12 +868,12 @@
 
 	.oversampling_humid_avail = bmp280_oversampling_avail,
 	.num_oversampling_humid_avail = ARRAY_SIZE(bmp280_oversampling_avail),
-	.oversampling_humid_default = BMP280_OSRS_HUMIDITY_16X - 1,
+	.oversampling_humid_default = BME280_OSRS_HUMIDITY_16X - 1,
 
 	.chip_config = bme280_chip_config,
 	.read_temp = bmp280_read_temp,
 	.read_press = bmp280_read_press,
-	.read_humid = bmp280_read_humid,
+	.read_humid = bme280_read_humid,
 	.read_calib = bme280_read_calib,
 };
 EXPORT_SYMBOL_NS(bme280_chip_info, IIO_BMP280);
@@ -926,8 +924,8 @@
 }
 
 /*
- * Returns temperature in Celsius degrees, resolution is 0.01º C. Output value of
- * "5123" equals 51.2º C. t_fine carries fine temperature as global value.
+ * Returns temperature in Celsius degrees, resolution is 0.01º C. Output value
+ * of "5123" equals 51.2º C. t_fine carries fine temperature as global value.
  *
  * Taken from datasheet, Section Appendix 9, "Compensation formula" and repo
  * https://github.com/BoschSensortec/BMP3-Sensor-API.
@@ -1069,7 +1067,8 @@
 
 	/* Read temperature and pressure calibration data */
 	ret = regmap_bulk_read(data->regmap, BMP380_REG_CALIB_TEMP_START,
-			       data->bmp380_cal_buf, sizeof(data->bmp380_cal_buf));
+			       data->bmp380_cal_buf,
+			       sizeof(data->bmp380_cal_buf));
 	if (ret) {
 		dev_err(data->dev,
 			"failed to read temperature calibration parameters\n");
@@ -1077,7 +1076,8 @@
 	}
 
 	/* Toss the temperature calibration data into the entropy pool */
-	add_device_randomness(data->bmp380_cal_buf, sizeof(data->bmp380_cal_buf));
+	add_device_randomness(data->bmp380_cal_buf,
+			      sizeof(data->bmp380_cal_buf));
 
 	/* Parse calibration values */
 	calib->T1 = get_unaligned_le16(&data->bmp380_cal_buf[BMP380_T1]);
@@ -1159,7 +1159,8 @@
 
 	/* Configure output data rate */
 	ret = regmap_update_bits_check(data->regmap, BMP380_REG_ODR,
-				       BMP380_ODRS_MASK, data->sampling_freq, &aux);
+				       BMP380_ODRS_MASK, data->sampling_freq,
+				       &aux);
 	if (ret) {
 		dev_err(data->dev, "failed to write ODR selection register\n");
 		return ret;
@@ -1178,12 +1179,13 @@
 
 	if (change) {
 		/*
-		 * The configurations errors are detected on the fly during a measurement
-		 * cycle. If the sampling frequency is too low, it's faster to reset
-		 * the measurement loop than wait until the next measurement is due.
+		 * The configurations errors are detected on the fly during a
+		 * measurement cycle. If the sampling frequency is too low, it's
+		 * faster to reset the measurement loop than wait until the next
+		 * measurement is due.
 		 *
-		 * Resets sensor measurement loop toggling between sleep and normal
-		 * operating modes.
+		 * Resets sensor measurement loop toggling between sleep and
+		 * normal operating modes.
 		 */
 		ret = regmap_write_bits(data->regmap, BMP380_REG_POWER_CONTROL,
 					BMP380_MODE_MASK,
@@ -1201,22 +1203,22 @@
 			return ret;
 		}
 		/*
-		 * Waits for measurement before checking configuration error flag.
-		 * Selected longest measure time indicated in section 3.9.1
-		 * in the datasheet.
+		 * Waits for measurement before checking configuration error
+		 * flag. Selected longest measurement time, calculated from
+		 * formula in datasheet section 3.9.2 with an offset of ~+15%
+		 * as it seen as well in table 3.9.1.
 		 */
-		msleep(80);
+		msleep(150);
 
 		/* Check config error flag */
 		ret = regmap_read(data->regmap, BMP380_REG_ERROR, &tmp);
 		if (ret) {
-			dev_err(data->dev,
-				"failed to read error register\n");
+			dev_err(data->dev, "failed to read error register\n");
 			return ret;
 		}
 		if (tmp & BMP380_ERR_CONF_MASK) {
 			dev_warn(data->dev,
-				"sensor flagged configuration as incompatible\n");
+				 "sensor flagged configuration as incompatible\n");
 			return -EINVAL;
 		}
 	}
@@ -1233,6 +1235,7 @@
 	.chip_id = bmp380_chip_ids,
 	.num_chip_id = ARRAY_SIZE(bmp380_chip_ids),
 	.regmap_config = &bmp380_regmap_config,
+	.spi_read_extra_byte = true,
 	.start_up_time = 2000,
 	.channels = bmp380_channels,
 	.num_channels = 2,
@@ -1316,9 +1319,11 @@
 	}
 
 	/* Start NVM operation sequence */
-	ret = regmap_write(data->regmap, BMP580_REG_CMD, BMP580_CMD_NVM_OP_SEQ_0);
+	ret = regmap_write(data->regmap, BMP580_REG_CMD,
+			   BMP580_CMD_NVM_OP_SEQ_0);
 	if (ret) {
-		dev_err(data->dev, "failed to send nvm operation's first sequence\n");
+		dev_err(data->dev,
+			"failed to send nvm operation's first sequence\n");
 		return ret;
 	}
 	if (is_write) {
@@ -1326,7 +1331,8 @@
 		ret = regmap_write(data->regmap, BMP580_REG_CMD,
 				   BMP580_CMD_NVM_WRITE_SEQ_1);
 		if (ret) {
-			dev_err(data->dev, "failed to send nvm write sequence\n");
+			dev_err(data->dev,
+				"failed to send nvm write sequence\n");
 			return ret;
 		}
 		/* Datasheet says on 4.8.1.2 it takes approximately 10ms */
@@ -1337,7 +1343,8 @@
 		ret = regmap_write(data->regmap, BMP580_REG_CMD,
 				   BMP580_CMD_NVM_READ_SEQ_1);
 		if (ret) {
-			dev_err(data->dev, "failed to send nvm read sequence\n");
+			dev_err(data->dev,
+				"failed to send nvm read sequence\n");
 			return ret;
 		}
 		/* Datasheet says on 4.8.1.1 it takes approximately 200us */
@@ -1393,12 +1400,12 @@
 
 	/*
 	 * Temperature is returned in Celsius degrees in fractional
-	 * form down 2^16. We rescale by x1000 to return milli Celsius
-	 * to respect IIO ABI.
+	 * form down 2^16. We rescale by x1000 to return millidegrees
+	 * Celsius to respect IIO ABI.
 	 */
-	*val = raw_temp * 1000;
-	*val2 = 16;
-	return IIO_VAL_FRACTIONAL_LOG2;
+	raw_temp = sign_extend32(raw_temp, 23);
+	*val = ((s64)raw_temp * 1000) / (1 << 16);
+	return IIO_VAL_INT;
 }
 
 static int bmp580_read_press(struct bmp280_data *data, int *val, int *val2)
@@ -1500,8 +1507,8 @@
 		if (ret)
 			goto exit;
 
-		ret = regmap_bulk_read(data->regmap, BMP580_REG_NVM_DATA_LSB, &data->le16,
-				       sizeof(data->le16));
+		ret = regmap_bulk_read(data->regmap, BMP580_REG_NVM_DATA_LSB,
+				       &data->le16, sizeof(data->le16));
 		if (ret) {
 			dev_err(data->dev, "error reading nvm data regs\n");
 			goto exit;
@@ -1545,7 +1552,8 @@
 	while (bytes >= sizeof(*buf)) {
 		addr = bmp580_nvmem_addrs[offset / sizeof(*buf)];
 
-		ret = regmap_write(data->regmap, BMP580_REG_NVM_ADDR, BMP580_NVM_PROG_EN |
+		ret = regmap_write(data->regmap, BMP580_REG_NVM_ADDR,
+				   BMP580_NVM_PROG_EN |
 				   FIELD_PREP(BMP580_NVM_ROW_ADDR_MASK, addr));
 		if (ret) {
 			dev_err(data->dev, "error writing nvm address\n");
@@ -1553,8 +1561,8 @@
 		}
 		data->le16 = cpu_to_le16(*buf++);
 
-		ret = regmap_bulk_write(data->regmap, BMP580_REG_NVM_DATA_LSB, &data->le16,
-					sizeof(data->le16));
+		ret = regmap_bulk_write(data->regmap, BMP580_REG_NVM_DATA_LSB,
+					&data->le16, sizeof(data->le16));
 		if (ret) {
 			dev_err(data->dev, "error writing LSB NVM data regs\n");
 			goto exit;
@@ -1661,7 +1669,8 @@
 		  BMP580_OSR_PRESS_EN;
 
 	ret = regmap_update_bits_check(data->regmap, BMP580_REG_OSR_CONFIG,
-				       BMP580_OSR_TEMP_MASK | BMP580_OSR_PRESS_MASK |
+				       BMP580_OSR_TEMP_MASK |
+				       BMP580_OSR_PRESS_MASK |
 				       BMP580_OSR_PRESS_EN,
 				       reg_val, &aux);
 	if (ret) {
@@ -1712,7 +1721,8 @@
 		 */
 		ret = regmap_read(data->regmap, BMP580_REG_EFF_OSR, &tmp);
 		if (ret) {
-			dev_err(data->dev, "error reading effective OSR register\n");
+			dev_err(data->dev,
+				"error reading effective OSR register\n");
 			return ret;
 		}
 		if (!(tmp & BMP580_EFF_OSR_VALID_ODR)) {
@@ -1847,7 +1857,8 @@
 	}
 
 	/* Toss the calibration data into the entropy pool */
-	add_device_randomness(data->bmp180_cal_buf, sizeof(data->bmp180_cal_buf));
+	add_device_randomness(data->bmp180_cal_buf,
+			      sizeof(data->bmp180_cal_buf));
 
 	calib->AC1 = be16_to_cpu(data->bmp180_cal_buf[AC1]);
 	calib->AC2 = be16_to_cpu(data->bmp180_cal_buf[AC2]);
@@ -1962,8 +1973,7 @@
 	return p + ((x1 + x2 + 3791) >> 4);
 }
 
-static int bmp180_read_press(struct bmp280_data *data,
-			     int *val, int *val2)
+static int bmp180_read_press(struct bmp280_data *data, int *val, int *val2)
 {
 	u32 comp_press;
 	s32 adc_press;
@@ -2240,6 +2250,7 @@
 	ret = regulator_bulk_enable(BMP280_NUM_SUPPLIES, data->supplies);
 	if (ret)
 		return ret;
+
 	usleep_range(data->start_up_time, data->start_up_time + 100);
 	return data->chip_info->chip_config(data);
 }
--- linux-qcom-6.8.0.orig/drivers/iio/pressure/bmp280-regmap.c
+++ linux-qcom-6.8.0/drivers/iio/pressure/bmp280-regmap.c
@@ -41,11 +41,23 @@
 };
 EXPORT_SYMBOL_NS(bmp180_regmap_config, IIO_BMP280);
 
+static bool bme280_is_writeable_reg(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case BMP280_REG_CONFIG:
+	case BME280_REG_CTRL_HUMIDITY:
+	case BMP280_REG_CTRL_MEAS:
+	case BMP280_REG_RESET:
+		return true;
+	default:
+		return false;
+	}
+}
+
 static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg)
 {
 	switch (reg) {
 	case BMP280_REG_CONFIG:
-	case BMP280_REG_CTRL_HUMIDITY:
 	case BMP280_REG_CTRL_MEAS:
 	case BMP280_REG_RESET:
 		return true;
@@ -57,8 +69,6 @@
 static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg)
 {
 	switch (reg) {
-	case BMP280_REG_HUMIDITY_LSB:
-	case BMP280_REG_HUMIDITY_MSB:
 	case BMP280_REG_TEMP_XLSB:
 	case BMP280_REG_TEMP_LSB:
 	case BMP280_REG_TEMP_MSB:
@@ -72,6 +82,23 @@
 	}
 }
 
+static bool bme280_is_volatile_reg(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case BME280_REG_HUMIDITY_LSB:
+	case BME280_REG_HUMIDITY_MSB:
+	case BMP280_REG_TEMP_XLSB:
+	case BMP280_REG_TEMP_LSB:
+	case BMP280_REG_TEMP_MSB:
+	case BMP280_REG_PRESS_XLSB:
+	case BMP280_REG_PRESS_LSB:
+	case BMP280_REG_PRESS_MSB:
+	case BMP280_REG_STATUS:
+		return true;
+	default:
+		return false;
+	}
+}
 static bool bmp380_is_writeable_reg(struct device *dev, unsigned int reg)
 {
 	switch (reg) {
@@ -167,7 +194,7 @@
 	.reg_bits = 8,
 	.val_bits = 8,
 
-	.max_register = BMP280_REG_HUMIDITY_LSB,
+	.max_register = BMP280_REG_TEMP_XLSB,
 	.cache_type = REGCACHE_RBTREE,
 
 	.writeable_reg = bmp280_is_writeable_reg,
@@ -175,6 +202,18 @@
 };
 EXPORT_SYMBOL_NS(bmp280_regmap_config, IIO_BMP280);
 
+const struct regmap_config bme280_regmap_config = {
+	.reg_bits = 8,
+	.val_bits = 8,
+
+	.max_register = BME280_REG_HUMIDITY_LSB,
+	.cache_type = REGCACHE_RBTREE,
+
+	.writeable_reg = bme280_is_writeable_reg,
+	.volatile_reg = bme280_is_volatile_reg,
+};
+EXPORT_SYMBOL_NS(bme280_regmap_config, IIO_BMP280);
+
 const struct regmap_config bmp380_regmap_config = {
 	.reg_bits = 8,
 	.val_bits = 8,
--- linux-qcom-6.8.0.orig/drivers/iio/pressure/bmp280-spi.c
+++ linux-qcom-6.8.0/drivers/iio/pressure/bmp280-spi.c
@@ -13,7 +13,7 @@
 #include "bmp280.h"
 
 static int bmp280_regmap_spi_write(void *context, const void *data,
-                                   size_t count)
+				   size_t count)
 {
 	struct spi_device *spi = to_spi_device(context);
 	u8 buf[2];
@@ -29,7 +29,7 @@
 }
 
 static int bmp280_regmap_spi_read(void *context, const void *reg,
-                                  size_t reg_size, void *val, size_t val_size)
+				  size_t reg_size, void *val, size_t val_size)
 {
 	struct spi_device *spi = to_spi_device(context);
 
@@ -96,15 +96,10 @@
 
 	chip_info = spi_get_device_match_data(spi);
 
-	switch (chip_info->chip_id[0]) {
-	case BMP380_CHIP_ID:
-	case BMP390_CHIP_ID:
+	if (chip_info->spi_read_extra_byte)
 		bmp_regmap_bus = &bmp380_regmap_bus;
-		break;
-	default:
+	else
 		bmp_regmap_bus = &bmp280_regmap_bus;
-		break;
-	}
 
 	regmap = devm_regmap_init(&spi->dev,
 				  bmp_regmap_bus,
@@ -127,7 +122,7 @@
 	{ .compatible = "bosch,bmp180", .data = &bmp180_chip_info },
 	{ .compatible = "bosch,bmp181", .data = &bmp180_chip_info },
 	{ .compatible = "bosch,bmp280", .data = &bmp280_chip_info },
-	{ .compatible = "bosch,bme280", .data = &bmp280_chip_info },
+	{ .compatible = "bosch,bme280", .data = &bme280_chip_info },
 	{ .compatible = "bosch,bmp380", .data = &bmp380_chip_info },
 	{ .compatible = "bosch,bmp580", .data = &bmp580_chip_info },
 	{ },
@@ -139,7 +134,7 @@
 	{ "bmp180", (kernel_ulong_t)&bmp180_chip_info },
 	{ "bmp181", (kernel_ulong_t)&bmp180_chip_info },
 	{ "bmp280", (kernel_ulong_t)&bmp280_chip_info },
-	{ "bme280", (kernel_ulong_t)&bmp280_chip_info },
+	{ "bme280", (kernel_ulong_t)&bme280_chip_info },
 	{ "bmp380", (kernel_ulong_t)&bmp380_chip_info },
 	{ "bmp580", (kernel_ulong_t)&bmp580_chip_info },
 	{ }
--- linux-qcom-6.8.0.orig/drivers/iio/pressure/bmp280.h
+++ linux-qcom-6.8.0/drivers/iio/pressure/bmp280.h
@@ -192,8 +192,6 @@
 #define BMP380_PRESS_SKIPPED		0x800000
 
 /* BMP280 specific registers */
-#define BMP280_REG_HUMIDITY_LSB		0xFE
-#define BMP280_REG_HUMIDITY_MSB		0xFD
 #define BMP280_REG_TEMP_XLSB		0xFC
 #define BMP280_REG_TEMP_LSB		0xFB
 #define BMP280_REG_TEMP_MSB		0xFA
@@ -207,15 +205,6 @@
 #define BMP280_REG_CONFIG		0xF5
 #define BMP280_REG_CTRL_MEAS		0xF4
 #define BMP280_REG_STATUS		0xF3
-#define BMP280_REG_CTRL_HUMIDITY	0xF2
-
-/* Due to non linear mapping, and data sizes we can't do a bulk read */
-#define BMP280_REG_COMP_H1		0xA1
-#define BMP280_REG_COMP_H2		0xE1
-#define BMP280_REG_COMP_H3		0xE3
-#define BMP280_REG_COMP_H4		0xE4
-#define BMP280_REG_COMP_H5		0xE5
-#define BMP280_REG_COMP_H6		0xE7
 
 #define BMP280_REG_COMP_TEMP_START	0x88
 #define BMP280_COMP_TEMP_REG_COUNT	6
@@ -223,8 +212,6 @@
 #define BMP280_REG_COMP_PRESS_START	0x8E
 #define BMP280_COMP_PRESS_REG_COUNT	18
 
-#define BMP280_COMP_H5_MASK		GENMASK(15, 4)
-
 #define BMP280_CONTIGUOUS_CALIB_REGS	(BMP280_COMP_TEMP_REG_COUNT + \
 					 BMP280_COMP_PRESS_REG_COUNT)
 
@@ -235,14 +222,6 @@
 #define BMP280_FILTER_8X		3
 #define BMP280_FILTER_16X		4
 
-#define BMP280_OSRS_HUMIDITY_MASK	GENMASK(2, 0)
-#define BMP280_OSRS_HUMIDITY_SKIP	0
-#define BMP280_OSRS_HUMIDITY_1X		1
-#define BMP280_OSRS_HUMIDITY_2X		2
-#define BMP280_OSRS_HUMIDITY_4X		3
-#define BMP280_OSRS_HUMIDITY_8X		4
-#define BMP280_OSRS_HUMIDITY_16X	5
-
 #define BMP280_OSRS_TEMP_MASK		GENMASK(7, 5)
 #define BMP280_OSRS_TEMP_SKIP		0
 #define BMP280_OSRS_TEMP_1X		1
@@ -264,6 +243,30 @@
 #define BMP280_MODE_FORCED		1
 #define BMP280_MODE_NORMAL		3
 
+/* BME280 specific registers */
+#define BME280_REG_HUMIDITY_LSB		0xFE
+#define BME280_REG_HUMIDITY_MSB		0xFD
+
+#define BME280_REG_CTRL_HUMIDITY	0xF2
+
+/* Due to non linear mapping, and data sizes we can't do a bulk read */
+#define BME280_REG_COMP_H1		0xA1
+#define BME280_REG_COMP_H2		0xE1
+#define BME280_REG_COMP_H3		0xE3
+#define BME280_REG_COMP_H4		0xE4
+#define BME280_REG_COMP_H5		0xE5
+#define BME280_REG_COMP_H6		0xE7
+
+#define BME280_COMP_H5_MASK		GENMASK(15, 4)
+
+#define BME280_OSRS_HUMIDITY_MASK	GENMASK(2, 0)
+#define BME280_OSRS_HUMIDITY_SKIP	0
+#define BME280_OSRS_HUMIDITY_1X		1
+#define BME280_OSRS_HUMIDITY_2X		2
+#define BME280_OSRS_HUMIDITY_4X		3
+#define BME280_OSRS_HUMIDITY_8X		4
+#define BME280_OSRS_HUMIDITY_16X	5
+
 /* BMP180 specific registers */
 #define BMP180_REG_OUT_XLSB		0xF8
 #define BMP180_REG_OUT_LSB		0xF7
@@ -423,6 +426,7 @@
 	int num_chip_id;
 
 	const struct regmap_config *regmap_config;
+	bool spi_read_extra_byte;
 
 	const struct iio_chan_spec *channels;
 	int num_channels;
@@ -466,6 +470,7 @@
 /* Regmap configurations */
 extern const struct regmap_config bmp180_regmap_config;
 extern const struct regmap_config bmp280_regmap_config;
+extern const struct regmap_config bme280_regmap_config;
 extern const struct regmap_config bmp380_regmap_config;
 extern const struct regmap_config bmp580_regmap_config;
 
--- linux-qcom-6.8.0.orig/drivers/iio/pressure/dps310.c
+++ linux-qcom-6.8.0/drivers/iio/pressure/dps310.c
@@ -730,7 +730,7 @@
 	}
 }
 
-static int dps310_calculate_temp(struct dps310_data *data)
+static int dps310_calculate_temp(struct dps310_data *data, int *val)
 {
 	s64 c0;
 	s64 t;
@@ -746,7 +746,9 @@
 	t = c0 + ((s64)data->temp_raw * (s64)data->c1);
 
 	/* Convert to milliCelsius and scale the temperature */
-	return (int)div_s64(t * 1000LL, kt);
+	*val = (int)div_s64(t * 1000LL, kt);
+
+	return 0;
 }
 
 static int dps310_read_temp(struct dps310_data *data, int *val, int *val2,
@@ -768,11 +770,10 @@
 		if (rc)
 			return rc;
 
-		rc = dps310_calculate_temp(data);
-		if (rc < 0)
+		rc = dps310_calculate_temp(data, val);
+		if (rc)
 			return rc;
 
-		*val = rc;
 		return IIO_VAL_INT;
 
 	case IIO_CHAN_INFO_OVERSAMPLING_RATIO:
--- linux-qcom-6.8.0.orig/drivers/iio/pressure/mprls0025pa.c
+++ linux-qcom-6.8.0/drivers/iio/pressure/mprls0025pa.c
@@ -323,6 +323,7 @@
 	struct iio_dev *indio_dev;
 	struct device *dev = &client->dev;
 	s64 scale, offset;
+	u32 func;
 
 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_READ_BYTE))
 		return dev_err_probe(dev, -EOPNOTSUPP,
@@ -362,10 +363,11 @@
 			return dev_err_probe(dev, ret,
 				"honeywell,pmax-pascal could not be read\n");
 		ret = device_property_read_u32(dev,
-				"honeywell,transfer-function", &data->function);
+				"honeywell,transfer-function", &func);
 		if (ret)
 			return dev_err_probe(dev, ret,
 				"honeywell,transfer-function could not be read\n");
+		data->function = func - 1;
 		if (data->function > MPR_FUNCTION_C)
 			return dev_err_probe(dev, -EINVAL,
 				"honeywell,transfer-function %d invalid\n",
--- linux-qcom-6.8.0.orig/drivers/iio/pressure/zpa2326.c
+++ linux-qcom-6.8.0/drivers/iio/pressure/zpa2326.c
@@ -586,6 +586,8 @@
 	}   sample;
 	int err;
 
+	memset(&sample, 0, sizeof(sample));
+
 	if (test_bit(0, indio_dev->active_scan_mask)) {
 		/* Get current pressure from hardware FIFO. */
 		err = zpa2326_dequeue_pressure(indio_dev, &sample.pressure);
--- linux-qcom-6.8.0.orig/drivers/iio/proximity/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/proximity/Kconfig
@@ -72,6 +72,8 @@
 config MB1232
 	tristate "MaxSonar I2CXL family ultrasonic sensors"
 	depends on I2C
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 	help
 	  Say Y to build a driver for the ultrasonic sensors I2CXL of
 	  MaxBotix which have an i2c interface. It can be used to measure
--- linux-qcom-6.8.0.orig/drivers/iio/resolver/Kconfig
+++ linux-qcom-6.8.0/drivers/iio/resolver/Kconfig
@@ -31,6 +31,9 @@
 	depends on SPI
 	depends on COMMON_CLK
 	depends on GPIOLIB || COMPILE_TEST
+	select REGMAP
+	select IIO_BUFFER
+	select IIO_TRIGGERED_BUFFER
 	help
 	  Say yes here to build support for Analog Devices spi resolver
 	  to digital converters, ad2s1210, provides direct access via sysfs.
--- linux-qcom-6.8.0.orig/drivers/iio/temperature/mcp9600.c
+++ linux-qcom-6.8.0/drivers/iio/temperature/mcp9600.c
@@ -52,7 +52,8 @@
 
 	if (ret < 0)
 		return ret;
-	*val = ret;
+
+	*val = sign_extend32(ret, 15);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/iio/temperature/mlx90635.c
+++ linux-qcom-6.8.0/drivers/iio/temperature/mlx90635.c
@@ -947,9 +947,9 @@
 				     "failed to allocate regmap\n");
 
 	regmap_ee = devm_regmap_init_i2c(client, &mlx90635_regmap_ee);
-	if (IS_ERR(regmap))
-		return dev_err_probe(&client->dev, PTR_ERR(regmap),
-				     "failed to allocate regmap\n");
+	if (IS_ERR(regmap_ee))
+		return dev_err_probe(&client->dev, PTR_ERR(regmap_ee),
+				     "failed to allocate EEPROM regmap\n");
 
 	mlx90635 = iio_priv(indio_dev);
 	i2c_set_clientdata(client, indio_dev);
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/addr.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/addr.c
@@ -348,16 +348,10 @@
 
 static bool has_gateway(const struct dst_entry *dst, sa_family_t family)
 {
-	struct rtable *rt;
-	struct rt6_info *rt6;
+	if (family == AF_INET)
+		return dst_rtable(dst)->rt_uses_gateway;
 
-	if (family == AF_INET) {
-		rt = container_of(dst, struct rtable, dst);
-		return rt->rt_uses_gateway;
-	}
-
-	rt6 = container_of(dst, struct rt6_info, dst);
-	return rt6->rt6i_flags & RTF_GATEWAY;
+	return dst_rt6_info(dst)->rt6i_flags & RTF_GATEWAY;
 }
 
 static int fetch_ha(const struct dst_entry *dst, struct rdma_dev_addr *dev_addr,
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/cache.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/cache.c
@@ -794,7 +794,6 @@
 static void release_gid_table(struct ib_device *device,
 			      struct ib_gid_table *table)
 {
-	bool leak = false;
 	int i;
 
 	if (!table)
@@ -803,15 +802,12 @@
 	for (i = 0; i < table->sz; i++) {
 		if (is_gid_entry_free(table->data_vec[i]))
 			continue;
-		if (kref_read(&table->data_vec[i]->kref) > 1) {
-			dev_err(&device->dev,
-				"GID entry ref leak for index %d ref=%u\n", i,
-				kref_read(&table->data_vec[i]->kref));
-			leak = true;
-		}
+
+		WARN_ONCE(true,
+			  "GID entry ref leak for dev %s index %d ref=%u\n",
+			  dev_name(&device->dev), i,
+			  kref_read(&table->data_vec[i]->kref));
 	}
-	if (leak)
-		return;
 
 	mutex_destroy(&table->lock);
 	kfree(table->data_vec);
@@ -1644,8 +1640,10 @@
 
 	rdma_for_each_port (device, p) {
 		err = ib_cache_update(device, p, true, true, true);
-		if (err)
+		if (err) {
+			gid_table_cleanup_one(device);
 			return err;
+		}
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/cm.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/cm.c
@@ -34,6 +34,7 @@
 MODULE_DESCRIPTION("InfiniBand CM");
 MODULE_LICENSE("Dual BSD/GPL");
 
+#define CM_DESTROY_ID_WAIT_TIMEOUT 10000 /* msecs */
 static const char * const ibcm_rej_reason_strs[] = {
 	[IB_CM_REJ_NO_QP]			= "no QP",
 	[IB_CM_REJ_NO_EEC]			= "no EEC",
@@ -1025,13 +1026,26 @@
 	}
 }
 
+static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
+						enum ib_cm_state old_state)
+{
+	struct cm_id_private *cm_id_priv;
+
+	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+	pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+	       cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+}
+
 static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
 {
 	struct cm_id_private *cm_id_priv;
+	enum ib_cm_state old_state;
 	struct cm_work *work;
+	int ret;
 
 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
 	spin_lock_irq(&cm_id_priv->lock);
+	old_state = cm_id->state;
 retest:
 	switch (cm_id->state) {
 	case IB_CM_LISTEN:
@@ -1135,7 +1149,14 @@
 
 	xa_erase(&cm.local_id_table, cm_local_id(cm_id->local_id));
 	cm_deref_id(cm_id_priv);
-	wait_for_completion(&cm_id_priv->comp);
+	do {
+		ret = wait_for_completion_timeout(&cm_id_priv->comp,
+						  msecs_to_jiffies(
+						  CM_DESTROY_ID_WAIT_TIMEOUT));
+		if (!ret) /* timeout happened */
+			cm_destroy_id_wait_timeout(cm_id, old_state);
+	} while (!ret);
+
 	while ((work = cm_dequeue_work(cm_id_priv)) != NULL)
 		cm_free_work(work);
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/cma.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/cma.c
@@ -690,6 +690,7 @@
 	int bound_if_index = dev_addr->bound_dev_if;
 	int dev_type = dev_addr->dev_type;
 	struct net_device *ndev = NULL;
+	struct net_device *pdev = NULL;
 
 	if (!rdma_dev_access_netns(device, id_priv->id.route.addr.dev_addr.net))
 		goto out;
@@ -714,9 +715,26 @@
 
 		rcu_read_lock();
 		ndev = rcu_dereference(sgid_attr->ndev);
+		if (ndev->ifindex != bound_if_index) {
+			pdev = dev_get_by_index_rcu(dev_addr->net, bound_if_index);
+			if (pdev) {
+				if (is_vlan_dev(pdev)) {
+					pdev = vlan_dev_real_dev(pdev);
+					if (ndev->ifindex == pdev->ifindex)
+						bound_if_index = pdev->ifindex;
+				}
+				if (is_vlan_dev(ndev)) {
+					pdev = vlan_dev_real_dev(ndev);
+					if (bound_if_index == pdev->ifindex)
+						bound_if_index = ndev->ifindex;
+				}
+			}
+		}
 		if (!net_eq(dev_net(ndev), dev_addr->net) ||
-		    ndev->ifindex != bound_if_index)
+		    ndev->ifindex != bound_if_index) {
+			rdma_put_gid_attr(sgid_attr);
 			sgid_attr = ERR_PTR(-ENODEV);
+		}
 		rcu_read_unlock();
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/device.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/device.c
@@ -1730,7 +1730,7 @@
 {
 	int ret;
 
-	down_write(&clients_rwsem);
+	lockdep_assert_held(&clients_rwsem);
 	/*
 	 * The add/remove callbacks must be called in FIFO/LIFO order. To
 	 * achieve this we assign client_ids so they are sorted in
@@ -1739,14 +1739,11 @@
 	client->client_id = highest_client_id;
 	ret = xa_insert(&clients, client->client_id, client, GFP_KERNEL);
 	if (ret)
-		goto out;
+		return ret;
 
 	highest_client_id++;
 	xa_set_mark(&clients, client->client_id, CLIENT_REGISTERED);
-
-out:
-	up_write(&clients_rwsem);
-	return ret;
+	return 0;
 }
 
 static void remove_client_id(struct ib_client *client)
@@ -1776,25 +1773,35 @@
 {
 	struct ib_device *device;
 	unsigned long index;
+	bool need_unreg = false;
 	int ret;
 
 	refcount_set(&client->uses, 1);
 	init_completion(&client->uses_zero);
+
+	/*
+	 * The devices_rwsem is held in write mode to ensure that a racing
+	 * ib_register_device() sees a consisent view of clients and devices.
+	 */
+	down_write(&devices_rwsem);
+	down_write(&clients_rwsem);
 	ret = assign_client_id(client);
 	if (ret)
-		return ret;
+		goto out;
 
-	down_read(&devices_rwsem);
+	need_unreg = true;
 	xa_for_each_marked (&devices, index, device, DEVICE_REGISTERED) {
 		ret = add_client_context(device, client);
-		if (ret) {
-			up_read(&devices_rwsem);
-			ib_unregister_client(client);
-			return ret;
-		}
+		if (ret)
+			goto out;
 	}
-	up_read(&devices_rwsem);
-	return 0;
+	ret = 0;
+out:
+	up_write(&clients_rwsem);
+	up_write(&devices_rwsem);
+	if (need_unreg && ret)
+		ib_unregister_client(client);
+	return ret;
 }
 EXPORT_SYMBOL(ib_register_client);
 
@@ -2139,6 +2146,9 @@
 	unsigned long flags;
 	int ret;
 
+	if (!rdma_is_port_valid(ib_dev, port))
+		return -EINVAL;
+
 	/*
 	 * Drivers wish to call this before ib_register_driver, so we have to
 	 * setup the port data early.
@@ -2147,9 +2157,6 @@
 	if (ret)
 		return ret;
 
-	if (!rdma_is_port_valid(ib_dev, port))
-		return -EINVAL;
-
 	pdata = &ib_dev->port_data[port];
 	spin_lock_irqsave(&pdata->netdev_lock, flags);
 	old_ndev = rcu_dereference_protected(
@@ -2159,17 +2166,12 @@
 		return 0;
 	}
 
-	if (old_ndev)
-		netdev_tracker_free(ndev, &pdata->netdev_tracker);
-	if (ndev)
-		netdev_hold(ndev, &pdata->netdev_tracker, GFP_ATOMIC);
 	rcu_assign_pointer(pdata->netdev, ndev);
+	netdev_put(old_ndev, &pdata->netdev_tracker);
+	netdev_hold(ndev, &pdata->netdev_tracker, GFP_ATOMIC);
 	spin_unlock_irqrestore(&pdata->netdev_lock, flags);
 
 	add_ndev_hash(pdata);
-	if (old_ndev)
-		__dev_put(old_ndev);
-
 	return 0;
 }
 EXPORT_SYMBOL(ib_device_set_netdev);
@@ -2228,8 +2230,7 @@
 		spin_lock(&pdata->netdev_lock);
 		res = rcu_dereference_protected(
 			pdata->netdev, lockdep_is_held(&pdata->netdev_lock));
-		if (res)
-			dev_hold(res);
+		dev_hold(res);
 		spin_unlock(&pdata->netdev_lock);
 	}
 
@@ -2304,9 +2305,7 @@
 
 			if (filter(ib_dev, port, idev, filter_cookie))
 				cb(ib_dev, port, idev, cookie);
-
-			if (idev)
-				dev_put(idev);
+			dev_put(idev);
 		}
 }
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/iwcm.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/iwcm.c
@@ -368,8 +368,10 @@
  *
  * Clean up all resources associated with the connection and release
  * the initial reference taken by iw_create_cm_id.
+ *
+ * Returns true if and only if the last cm_id_priv reference has been dropped.
  */
-static void destroy_cm_id(struct iw_cm_id *cm_id)
+static bool destroy_cm_id(struct iw_cm_id *cm_id)
 {
 	struct iwcm_id_private *cm_id_priv;
 	struct ib_qp *qp;
@@ -439,7 +441,7 @@
 		iwpm_remove_mapping(&cm_id->local_addr, RDMA_NL_IWCM);
 	}
 
-	(void)iwcm_deref_id(cm_id_priv);
+	return iwcm_deref_id(cm_id_priv);
 }
 
 /*
@@ -450,7 +452,8 @@
  */
 void iw_destroy_cm_id(struct iw_cm_id *cm_id)
 {
-	destroy_cm_id(cm_id);
+	if (!destroy_cm_id(cm_id))
+		flush_workqueue(iwcm_wq);
 }
 EXPORT_SYMBOL(iw_destroy_cm_id);
 
@@ -1034,7 +1037,7 @@
 		if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) {
 			ret = process_event(cm_id_priv, &levent);
 			if (ret)
-				destroy_cm_id(&cm_id_priv->id);
+				WARN_ON_ONCE(destroy_cm_id(&cm_id_priv->id));
 		} else
 			pr_debug("dropping event %d\n", levent.event);
 		if (iwcm_deref_id(cm_id_priv))
@@ -1187,7 +1190,7 @@
 	if (ret)
 		return ret;
 
-	iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", 0);
+	iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", WQ_MEM_RECLAIM);
 	if (!iwcm_wq)
 		goto err_alloc;
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/lag.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/lag.c
@@ -93,8 +93,7 @@
 	slave = netdev_get_xmit_slave(master, skb,
 				      !!(device->lag_flags &
 					 RDMA_LAG_FLAGS_HASH_ALL_SLAVES));
-	if (slave)
-		dev_hold(slave);
+	dev_hold(slave);
 	rcu_read_unlock();
 	kfree_skb(skb);
 	return slave;
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/mad.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/mad.c
@@ -2616,14 +2616,16 @@
 
 static void timeout_sends(struct work_struct *work)
 {
+	struct ib_mad_send_wr_private *mad_send_wr, *n;
 	struct ib_mad_agent_private *mad_agent_priv;
-	struct ib_mad_send_wr_private *mad_send_wr;
 	struct ib_mad_send_wc mad_send_wc;
+	struct list_head local_list;
 	unsigned long flags, delay;
 
 	mad_agent_priv = container_of(work, struct ib_mad_agent_private,
 				      timed_work.work);
 	mad_send_wc.vendor_err = 0;
+	INIT_LIST_HEAD(&local_list);
 
 	spin_lock_irqsave(&mad_agent_priv->lock, flags);
 	while (!list_empty(&mad_agent_priv->wait_list)) {
@@ -2641,13 +2643,16 @@
 			break;
 		}
 
-		list_del(&mad_send_wr->agent_list);
+		list_del_init(&mad_send_wr->agent_list);
 		if (mad_send_wr->status == IB_WC_SUCCESS &&
 		    !retry_send(mad_send_wr))
 			continue;
 
-		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
+		list_add_tail(&mad_send_wr->agent_list, &local_list);
+	}
+	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 
+	list_for_each_entry_safe(mad_send_wr, n, &local_list, agent_list) {
 		if (mad_send_wr->status == IB_WC_SUCCESS)
 			mad_send_wc.status = IB_WC_RESP_TIMEOUT_ERR;
 		else
@@ -2655,11 +2660,8 @@
 		mad_send_wc.send_buf = &mad_send_wr->send_buf;
 		mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
 						   &mad_send_wc);
-
 		deref_mad_agent(mad_agent_priv);
-		spin_lock_irqsave(&mad_agent_priv->lock, flags);
 	}
-	spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/restrack.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/restrack.c
@@ -37,22 +37,6 @@
 	return 0;
 }
 
-static const char *type2str(enum rdma_restrack_type type)
-{
-	static const char * const names[RDMA_RESTRACK_MAX] = {
-		[RDMA_RESTRACK_PD] = "PD",
-		[RDMA_RESTRACK_CQ] = "CQ",
-		[RDMA_RESTRACK_QP] = "QP",
-		[RDMA_RESTRACK_CM_ID] = "CM_ID",
-		[RDMA_RESTRACK_MR] = "MR",
-		[RDMA_RESTRACK_CTX] = "CTX",
-		[RDMA_RESTRACK_COUNTER] = "COUNTER",
-		[RDMA_RESTRACK_SRQ] = "SRQ",
-	};
-
-	return names[type];
-};
-
 /**
  * rdma_restrack_clean() - clean resource tracking
  * @dev:  IB device
@@ -60,47 +44,14 @@
 void rdma_restrack_clean(struct ib_device *dev)
 {
 	struct rdma_restrack_root *rt = dev->res;
-	struct rdma_restrack_entry *e;
-	char buf[TASK_COMM_LEN];
-	bool found = false;
-	const char *owner;
 	int i;
 
 	for (i = 0 ; i < RDMA_RESTRACK_MAX; i++) {
 		struct xarray *xa = &dev->res[i].xa;
 
-		if (!xa_empty(xa)) {
-			unsigned long index;
-
-			if (!found) {
-				pr_err("restrack: %s", CUT_HERE);
-				dev_err(&dev->dev, "BUG: RESTRACK detected leak of resources\n");
-			}
-			xa_for_each(xa, index, e) {
-				if (rdma_is_kernel_res(e)) {
-					owner = e->kern_name;
-				} else {
-					/*
-					 * There is no need to call get_task_struct here,
-					 * because we can be here only if there are more
-					 * get_task_struct() call than put_task_struct().
-					 */
-					get_task_comm(buf, e->task);
-					owner = buf;
-				}
-
-				pr_err("restrack: %s %s object allocated by %s is not freed\n",
-				       rdma_is_kernel_res(e) ? "Kernel" :
-							       "User",
-				       type2str(e->type), owner);
-			}
-			found = true;
-		}
+		WARN_ON(!xa_empty(xa));
 		xa_destroy(xa);
 	}
-	if (found)
-		pr_err("restrack: %s", CUT_HERE);
-
 	kfree(rt);
 }
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/roce_gid_mgmt.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/roce_gid_mgmt.c
@@ -601,8 +601,7 @@
 
 	rcu_read_lock();
 	master_ndev = netdev_master_upper_dev_get_rcu(rdma_ndev);
-	if (master_ndev)
-		dev_hold(master_ndev);
+	dev_hold(master_ndev);
 	rcu_read_unlock();
 
 	if (master_ndev) {
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/user_mad.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/user_mad.c
@@ -63,6 +63,8 @@
 MODULE_DESCRIPTION("InfiniBand userspace MAD packet access");
 MODULE_LICENSE("Dual BSD/GPL");
 
+#define MAX_UMAD_RECV_LIST_SIZE 200000
+
 enum {
 	IB_UMAD_MAX_PORTS  = RDMA_MAX_PORTS,
 	IB_UMAD_MAX_AGENTS = 32,
@@ -113,6 +115,7 @@
 	struct mutex		mutex;
 	struct ib_umad_port    *port;
 	struct list_head	recv_list;
+	atomic_t		recv_list_size;
 	struct list_head	send_list;
 	struct list_head	port_list;
 	spinlock_t		send_lock;
@@ -180,24 +183,28 @@
 	return file->agents_dead ? NULL : file->agent[id];
 }
 
-static int queue_packet(struct ib_umad_file *file,
-			struct ib_mad_agent *agent,
-			struct ib_umad_packet *packet)
+static int queue_packet(struct ib_umad_file *file, struct ib_mad_agent *agent,
+			struct ib_umad_packet *packet, bool is_recv_mad)
 {
 	int ret = 1;
 
 	mutex_lock(&file->mutex);
 
+	if (is_recv_mad &&
+	    atomic_read(&file->recv_list_size) > MAX_UMAD_RECV_LIST_SIZE)
+		goto unlock;
+
 	for (packet->mad.hdr.id = 0;
 	     packet->mad.hdr.id < IB_UMAD_MAX_AGENTS;
 	     packet->mad.hdr.id++)
 		if (agent == __get_agent(file, packet->mad.hdr.id)) {
 			list_add_tail(&packet->list, &file->recv_list);
+			atomic_inc(&file->recv_list_size);
 			wake_up_interruptible(&file->recv_wait);
 			ret = 0;
 			break;
 		}
-
+unlock:
 	mutex_unlock(&file->mutex);
 
 	return ret;
@@ -224,7 +231,7 @@
 	if (send_wc->status == IB_WC_RESP_TIMEOUT_ERR) {
 		packet->length = IB_MGMT_MAD_HDR;
 		packet->mad.hdr.status = ETIMEDOUT;
-		if (!queue_packet(file, agent, packet))
+		if (!queue_packet(file, agent, packet, false))
 			return;
 	}
 	kfree(packet);
@@ -284,7 +291,7 @@
 		rdma_destroy_ah_attr(&ah_attr);
 	}
 
-	if (queue_packet(file, agent, packet))
+	if (queue_packet(file, agent, packet, true))
 		goto err2;
 	return;
 
@@ -409,6 +416,7 @@
 
 	packet = list_entry(file->recv_list.next, struct ib_umad_packet, list);
 	list_del(&packet->list);
+	atomic_dec(&file->recv_list_size);
 
 	mutex_unlock(&file->mutex);
 
@@ -421,6 +429,7 @@
 		/* Requeue packet */
 		mutex_lock(&file->mutex);
 		list_add(&packet->list, &file->recv_list);
+		atomic_inc(&file->recv_list_size);
 		mutex_unlock(&file->mutex);
 	} else {
 		if (packet->recv_wc)
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/uverbs.h
+++ linux-qcom-6.8.0/drivers/infiniband/core/uverbs.h
@@ -160,6 +160,8 @@
 	struct page *disassociate_page;
 
 	struct xarray		idr;
+
+	struct mutex disassociation_lock;
 };
 
 struct ib_uverbs_event {
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/uverbs_cmd.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/uverbs_cmd.c
@@ -161,7 +161,7 @@
 {
 	const void __user *res = iter->cur;
 
-	if (iter->cur + len > iter->end)
+	if (len > iter->end - iter->cur)
 		return (void __force __user *)ERR_PTR(-ENOSPC);
 	iter->cur += len;
 	return res;
@@ -2010,11 +2010,13 @@
 	ret = uverbs_request_start(attrs, &iter, &cmd, sizeof(cmd));
 	if (ret)
 		return ret;
-	wqes = uverbs_request_next_ptr(&iter, cmd.wqe_size * cmd.wr_count);
+	wqes = uverbs_request_next_ptr(&iter, size_mul(cmd.wqe_size,
+						       cmd.wr_count));
 	if (IS_ERR(wqes))
 		return PTR_ERR(wqes);
-	sgls = uverbs_request_next_ptr(
-		&iter, cmd.sge_count * sizeof(struct ib_uverbs_sge));
+	sgls = uverbs_request_next_ptr(&iter,
+				       size_mul(cmd.sge_count,
+						sizeof(struct ib_uverbs_sge)));
 	if (IS_ERR(sgls))
 		return PTR_ERR(sgls);
 	ret = uverbs_request_finish(&iter);
@@ -2200,11 +2202,11 @@
 	if (wqe_size < sizeof(struct ib_uverbs_recv_wr))
 		return ERR_PTR(-EINVAL);
 
-	wqes = uverbs_request_next_ptr(iter, wqe_size * wr_count);
+	wqes = uverbs_request_next_ptr(iter, size_mul(wqe_size, wr_count));
 	if (IS_ERR(wqes))
 		return ERR_CAST(wqes);
-	sgls = uverbs_request_next_ptr(
-		iter, sge_count * sizeof(struct ib_uverbs_sge));
+	sgls = uverbs_request_next_ptr(iter, size_mul(sge_count,
+						      sizeof(struct ib_uverbs_sge)));
 	if (IS_ERR(sgls))
 		return ERR_CAST(sgls);
 	ret = uverbs_request_finish(iter);
--- linux-qcom-6.8.0.orig/drivers/infiniband/core/uverbs_main.c
+++ linux-qcom-6.8.0/drivers/infiniband/core/uverbs_main.c
@@ -76,6 +76,7 @@
 static DEFINE_IDA(uverbs_ida);
 static int ib_uverbs_add_one(struct ib_device *device);
 static void ib_uverbs_remove_one(struct ib_device *device, void *client_data);
+static struct ib_client uverbs_client;
 
 static char *uverbs_devnode(const struct device *dev, umode_t *mode)
 {
@@ -217,6 +218,7 @@
 
 	if (file->disassociate_page)
 		__free_pages(file->disassociate_page, 0);
+	mutex_destroy(&file->disassociation_lock);
 	mutex_destroy(&file->umap_lock);
 	mutex_destroy(&file->ucontext_lock);
 	kfree(file);
@@ -700,8 +702,13 @@
 		ret = PTR_ERR(ucontext);
 		goto out;
 	}
+
+	mutex_lock(&file->disassociation_lock);
+
 	vma->vm_ops = &rdma_umap_ops;
 	ret = ucontext->device->ops.mmap(ucontext, vma);
+
+	mutex_unlock(&file->disassociation_lock);
 out:
 	srcu_read_unlock(&file->device->disassociate_srcu, srcu_key);
 	return ret;
@@ -723,6 +730,8 @@
 	/* We are racing with disassociation */
 	if (!down_read_trylock(&ufile->hw_destroy_rwsem))
 		goto out_zap;
+	mutex_lock(&ufile->disassociation_lock);
+
 	/*
 	 * Disassociation already completed, the VMA should already be zapped.
 	 */
@@ -734,10 +743,12 @@
 		goto out_unlock;
 	rdma_umap_priv_init(priv, vma, opriv->entry);
 
+	mutex_unlock(&ufile->disassociation_lock);
 	up_read(&ufile->hw_destroy_rwsem);
 	return;
 
 out_unlock:
+	mutex_unlock(&ufile->disassociation_lock);
 	up_read(&ufile->hw_destroy_rwsem);
 out_zap:
 	/*
@@ -821,7 +832,7 @@
 {
 	struct rdma_umap_priv *priv, *next_priv;
 
-	lockdep_assert_held(&ufile->hw_destroy_rwsem);
+	mutex_lock(&ufile->disassociation_lock);
 
 	while (1) {
 		struct mm_struct *mm = NULL;
@@ -847,8 +858,10 @@
 			break;
 		}
 		mutex_unlock(&ufile->umap_lock);
-		if (!mm)
+		if (!mm) {
+			mutex_unlock(&ufile->disassociation_lock);
 			return;
+		}
 
 		/*
 		 * The umap_lock is nested under mmap_lock since it used within
@@ -878,7 +891,31 @@
 		mmap_read_unlock(mm);
 		mmput(mm);
 	}
+
+	mutex_unlock(&ufile->disassociation_lock);
+}
+
+/**
+ * rdma_user_mmap_disassociate() - Revoke mmaps for a device
+ * @device: device to revoke
+ *
+ * This function should be called by drivers that need to disable mmaps for the
+ * device, for instance because it is going to be reset.
+ */
+void rdma_user_mmap_disassociate(struct ib_device *device)
+{
+	struct ib_uverbs_device *uverbs_dev =
+		ib_get_client_data(device, &uverbs_client);
+	struct ib_uverbs_file *ufile;
+
+	mutex_lock(&uverbs_dev->lists_mutex);
+	list_for_each_entry(ufile, &uverbs_dev->uverbs_file_list, list) {
+		if (ufile->ucontext)
+			uverbs_user_mmap_disassociate(ufile);
+	}
+	mutex_unlock(&uverbs_dev->lists_mutex);
 }
+EXPORT_SYMBOL(rdma_user_mmap_disassociate);
 
 /*
  * ib_uverbs_open() does not need the BKL:
@@ -949,6 +986,8 @@
 	mutex_init(&file->umap_lock);
 	INIT_LIST_HEAD(&file->umaps);
 
+	mutex_init(&file->disassociation_lock);
+
 	filp->private_data = file;
 	list_add_tail(&file->list, &dev->uverbs_file_list);
 	mutex_unlock(&dev->lists_mutex);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -107,8 +107,6 @@
 	struct	bnxt_re_sqp_entries *sqp_tbl;
 };
 
-#define BNXT_RE_MIN_MSIX		2
-#define BNXT_RE_MAX_MSIX		9
 #define BNXT_RE_AEQ_IDX			0
 #define BNXT_RE_NQ_IDX			1
 #define BNXT_RE_GEN_P5_MAX_VF		64
@@ -168,7 +166,7 @@
 	struct bnxt_qplib_rcfw		rcfw;
 
 	/* NQ */
-	struct bnxt_qplib_nq		nq[BNXT_RE_MAX_MSIX];
+	struct bnxt_qplib_nq		nq[BNXT_MAX_ROCE_MSIX];
 
 	/* Device Resources */
 	struct bnxt_qplib_dev_attr	dev_attr;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/hw_counters.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/hw_counters.c
@@ -366,7 +366,7 @@
 				goto done;
 			}
 		}
-		if (rdev->pacing.dbr_pacing)
+		if (rdev->pacing.dbr_pacing && bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx))
 			bnxt_re_copy_db_pacing_stats(rdev, stats);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -148,7 +148,7 @@
 
 	ib_attr->vendor_id = rdev->en_dev->pdev->vendor;
 	ib_attr->vendor_part_id = rdev->en_dev->pdev->device;
-	ib_attr->hw_ver = rdev->en_dev->pdev->subsystem_device;
+	ib_attr->hw_ver = rdev->en_dev->pdev->revision;
 	ib_attr->max_qp = dev_attr->max_qp;
 	ib_attr->max_qp_wr = dev_attr->max_qp_wqes;
 	ib_attr->device_cap_flags =
@@ -994,23 +994,22 @@
 	align = sizeof(struct sq_send_hdr);
 	ilsize = ALIGN(init_attr->cap.max_inline_data, align);
 
-	sq->wqe_size = bnxt_re_get_wqe_size(ilsize, sq->max_sge);
-	if (sq->wqe_size > bnxt_re_get_swqe_size(dev_attr->max_qp_sges))
-		return -EINVAL;
-	/* For gen p4 and gen p5 backward compatibility mode
-	 * wqe size is fixed to 128 bytes
+	/* For gen p4 and gen p5 fixed wqe compatibility mode
+	 * wqe size is fixed to 128 bytes - ie 6 SGEs
 	 */
-	if (sq->wqe_size < bnxt_re_get_swqe_size(dev_attr->max_qp_sges) &&
-			qplqp->wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC)
-		sq->wqe_size = bnxt_re_get_swqe_size(dev_attr->max_qp_sges);
+	if (qplqp->wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC) {
+		sq->wqe_size = bnxt_re_get_swqe_size(BNXT_STATIC_MAX_SGE);
+		sq->max_sge = BNXT_STATIC_MAX_SGE;
+	} else {
+		sq->wqe_size = bnxt_re_get_wqe_size(ilsize, sq->max_sge);
+		if (sq->wqe_size > bnxt_re_get_swqe_size(dev_attr->max_qp_sges))
+			return -EINVAL;
+	}
 
 	if (init_attr->cap.max_inline_data) {
 		qplqp->max_inline_data = sq->wqe_size -
 			sizeof(struct sq_send_hdr);
 		init_attr->cap.max_inline_data = qplqp->max_inline_data;
-		if (qplqp->wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC)
-			sq->max_sge = qplqp->max_inline_data /
-				sizeof(struct sq_sge);
 	}
 
 	return 0;
@@ -1156,6 +1155,7 @@
 	/* Shadow QP SQ depth should be same as QP1 RQ depth */
 	qp->qplib_qp.sq.wqe_size = bnxt_re_get_wqe_size(0, 6);
 	qp->qplib_qp.sq.max_wqe = qp1_qp->rq.max_wqe;
+	qp->qplib_qp.sq.max_sw_wqe = qp1_qp->rq.max_wqe;
 	qp->qplib_qp.sq.max_sge = 2;
 	/* Q full delta can be 1 since it is internal QP */
 	qp->qplib_qp.sq.q_full_delta = 1;
@@ -1167,6 +1167,7 @@
 
 	qp->qplib_qp.rq.wqe_size = bnxt_re_get_rwqe_size(6);
 	qp->qplib_qp.rq.max_wqe = qp1_qp->rq.max_wqe;
+	qp->qplib_qp.rq.max_sw_wqe = qp1_qp->rq.max_wqe;
 	qp->qplib_qp.rq.max_sge = qp1_qp->rq.max_sge;
 	/* Q full delta can be 1 since it is internal QP */
 	qp->qplib_qp.rq.q_full_delta = 1;
@@ -1228,6 +1229,7 @@
 		 */
 		entries = bnxt_re_init_depth(init_attr->cap.max_recv_wr + 1, uctx);
 		rq->max_wqe = min_t(u32, entries, dev_attr->max_qp_wqes + 1);
+		rq->max_sw_wqe = rq->max_wqe;
 		rq->q_full_delta = 0;
 		rq->sg_info.pgsize = PAGE_SIZE;
 		rq->sg_info.pgshft = PAGE_SHIFT;
@@ -1287,6 +1289,7 @@
 		0 : BNXT_QPLIB_RESERVED_QP_WRS;
 	entries = bnxt_re_init_depth(entries + diff + 1, uctx);
 	sq->max_wqe = min_t(u32, entries, dev_attr->max_qp_wqes + diff + 1);
+	sq->max_sw_wqe = bnxt_qplib_get_depth(sq, qplqp->wqe_mode, true);
 	sq->q_full_delta = diff + 1;
 	/*
 	 * Reserving one slot for Phantom WQE. Application can
@@ -2057,18 +2060,20 @@
 		}
 	}
 
-	if (qp_attr_mask & IB_QP_PATH_MTU) {
-		qp->qplib_qp.modify_flags |=
-				CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
-		qp->qplib_qp.path_mtu = __from_ib_mtu(qp_attr->path_mtu);
-		qp->qplib_qp.mtu = ib_mtu_enum_to_int(qp_attr->path_mtu);
-	} else if (qp_attr->qp_state == IB_QPS_RTR) {
-		qp->qplib_qp.modify_flags |=
-			CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
-		qp->qplib_qp.path_mtu =
-			__from_ib_mtu(iboe_get_mtu(rdev->netdev->mtu));
-		qp->qplib_qp.mtu =
-			ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu));
+	if (qp_attr->qp_state == IB_QPS_RTR) {
+		enum ib_mtu qpmtu;
+
+		qpmtu = iboe_get_mtu(rdev->netdev->mtu);
+		if (qp_attr_mask & IB_QP_PATH_MTU) {
+			if (ib_mtu_enum_to_int(qp_attr->path_mtu) >
+			    ib_mtu_enum_to_int(qpmtu))
+				return -EINVAL;
+			qpmtu = qp_attr->path_mtu;
+		}
+
+		qp->qplib_qp.modify_flags |= CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
+		qp->qplib_qp.path_mtu = __from_ib_mtu(qpmtu);
+		qp->qplib_qp.mtu = ib_mtu_enum_to_int(qpmtu);
 	}
 
 	if (qp_attr_mask & IB_QP_TIMEOUT) {
@@ -2155,6 +2160,7 @@
 			entries = bnxt_re_init_depth(qp_attr->cap.max_recv_wr, uctx);
 			qp->qplib_qp.rq.max_wqe =
 				min_t(u32, entries, dev_attr->max_qp_wqes + 1);
+			qp->qplib_qp.rq.max_sw_wqe = qp->qplib_qp.rq.max_wqe;
 			qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe -
 						       qp_attr->cap.max_recv_wr;
 			qp->qplib_qp.rq.max_sge = qp_attr->cap.max_recv_sge;
@@ -2216,6 +2222,7 @@
 	qp_attr->retry_cnt = qplib_qp->retry_cnt;
 	qp_attr->rnr_retry = qplib_qp->rnr_retry;
 	qp_attr->min_rnr_timer = qplib_qp->min_rnr_timer;
+	qp_attr->port_num = __to_ib_port_num(qplib_qp->port_id);
 	qp_attr->rq_psn = qplib_qp->rq.psn;
 	qp_attr->max_rd_atomic = qplib_qp->max_rd_atomic;
 	qp_attr->sq_psn = qplib_qp->sq.psn;
@@ -2479,7 +2486,7 @@
 		break;
 	case IB_WR_SEND_WITH_IMM:
 		wqe->type = BNXT_QPLIB_SWQE_TYPE_SEND_WITH_IMM;
-		wqe->send.imm_data = wr->ex.imm_data;
+		wqe->send.imm_data = be32_to_cpu(wr->ex.imm_data);
 		break;
 	case IB_WR_SEND_WITH_INV:
 		wqe->type = BNXT_QPLIB_SWQE_TYPE_SEND_WITH_INV;
@@ -2509,7 +2516,7 @@
 		break;
 	case IB_WR_RDMA_WRITE_WITH_IMM:
 		wqe->type = BNXT_QPLIB_SWQE_TYPE_RDMA_WRITE_WITH_IMM;
-		wqe->rdma.imm_data = wr->ex.imm_data;
+		wqe->rdma.imm_data = be32_to_cpu(wr->ex.imm_data);
 		break;
 	case IB_WR_RDMA_READ:
 		wqe->type = BNXT_QPLIB_SWQE_TYPE_RDMA_READ;
@@ -2712,7 +2719,8 @@
 		wr = wr->next;
 	}
 	bnxt_qplib_post_send_db(&qp->qplib_qp);
-	bnxt_ud_qp_hw_stall_workaround(qp);
+	if (!bnxt_qplib_is_chip_gen_p5_p7(qp->rdev->chip_ctx))
+		bnxt_ud_qp_hw_stall_workaround(qp);
 	spin_unlock_irqrestore(&qp->sq_lock, flags);
 	return rc;
 }
@@ -2824,7 +2832,8 @@
 		wr = wr->next;
 	}
 	bnxt_qplib_post_send_db(&qp->qplib_qp);
-	bnxt_ud_qp_hw_stall_workaround(qp);
+	if (!bnxt_qplib_is_chip_gen_p5_p7(qp->rdev->chip_ctx))
+		bnxt_ud_qp_hw_stall_workaround(qp);
 	spin_unlock_irqrestore(&qp->sq_lock, flags);
 
 	return rc;
@@ -3581,7 +3590,7 @@
 	wc->byte_len = orig_cqe->length;
 	wc->qp = &gsi_qp->ib_qp;
 
-	wc->ex.imm_data = orig_cqe->immdata;
+	wc->ex.imm_data = cpu_to_be32(orig_cqe->immdata);
 	wc->src_qp = orig_cqe->src_qp;
 	memcpy(wc->smac, orig_cqe->smac, ETH_ALEN);
 	if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) {
@@ -3726,7 +3735,10 @@
 				 (unsigned long)(cqe->qp_handle),
 				 struct bnxt_re_qp, qplib_qp);
 			wc->qp = &qp->ib_qp;
-			wc->ex.imm_data = cqe->immdata;
+			if (cqe->flags & CQ_RES_RC_FLAGS_IMM)
+				wc->ex.imm_data = cpu_to_be32(cqe->immdata);
+			else
+				wc->ex.invalidate_rkey = cqe->invrkey;
 			wc->src_qp = cqe->src_qp;
 			memcpy(wc->smac, cqe->smac, ETH_ALEN);
 			wc->port_num = 1;
@@ -4186,9 +4198,6 @@
 	resp.cqe_sz = sizeof(struct cq_base);
 	resp.max_cqd = dev_attr->max_cq_wqes;
 
-	resp.comp_mask |= BNXT_RE_UCNTX_CMASK_HAVE_MODE;
-	resp.mode = rdev->chip_ctx->modes.wqe_mode;
-
 	if (rdev->chip_ctx->modes.db_push)
 		resp.comp_mask |= BNXT_RE_UCNTX_CMASK_WC_DPI_ENABLED;
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -77,6 +77,7 @@
 	struct bnxt_qplib_srq	qplib_srq;
 	struct ib_umem		*umem;
 	spinlock_t		lock;		/* protect srq */
+	void			*uctx_srq_page;
 };
 
 struct bnxt_re_qp {
@@ -248,6 +249,10 @@
 int bnxt_re_mmap(struct ib_ucontext *context, struct vm_area_struct *vma);
 void bnxt_re_mmap_free(struct rdma_user_mmap_entry *rdma_entry);
 
+static inline u32 __to_ib_port_num(u16 port_id)
+{
+	return (u32)port_id + 1;
+}
 
 unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp);
 void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp, unsigned long flags);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/main.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/main.c
@@ -129,13 +129,13 @@
 	}
 }
 
-static void bnxt_re_set_drv_mode(struct bnxt_re_dev *rdev, u8 mode)
+static void bnxt_re_set_drv_mode(struct bnxt_re_dev *rdev)
 {
 	struct bnxt_qplib_chip_ctx *cctx;
 
 	cctx = rdev->chip_ctx;
-	cctx->modes.wqe_mode = bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx) ?
-			       mode : BNXT_QPLIB_WQE_MODE_STATIC;
+	cctx->modes.wqe_mode = bnxt_qplib_is_chip_gen_p7(rdev->chip_ctx) ?
+			       BNXT_QPLIB_WQE_MODE_VARIABLE : BNXT_QPLIB_WQE_MODE_STATIC;
 	if (bnxt_re_hwrm_qcaps(rdev))
 		dev_err(rdev_to_dev(rdev),
 			"Failed to query hwrm qcaps\n");
@@ -158,7 +158,7 @@
 	kfree(chip_ctx);
 }
 
-static int bnxt_re_setup_chip_ctx(struct bnxt_re_dev *rdev, u8 wqe_mode)
+static int bnxt_re_setup_chip_ctx(struct bnxt_re_dev *rdev)
 {
 	struct bnxt_qplib_chip_ctx *chip_ctx;
 	struct bnxt_en_dev *en_dev;
@@ -180,12 +180,15 @@
 	rdev->qplib_res.dattr = &rdev->dev_attr;
 	rdev->qplib_res.is_vf = BNXT_EN_VF(en_dev);
 
-	bnxt_re_set_drv_mode(rdev, wqe_mode);
+	bnxt_re_set_drv_mode(rdev);
 
 	bnxt_re_set_db_offset(rdev);
 	rc = bnxt_qplib_map_db_bar(&rdev->qplib_res);
-	if (rc)
+	if (rc) {
+		kfree(rdev->chip_ctx);
+		rdev->chip_ctx = NULL;
 		return rc;
+	}
 
 	if (bnxt_qplib_determine_atomics(en_dev->pdev))
 		ibdev_info(&rdev->ibdev,
@@ -482,6 +485,8 @@
 static void __wait_for_fifo_occupancy_below_th(struct bnxt_re_dev *rdev)
 {
 	u32 read_val, fifo_occup;
+	struct bnxt_qplib_db_pacing_data *pacing_data = rdev->qplib_res.pacing_data;
+	u32 retry_fifo_check = 1000;
 
 	/* loop shouldn't run infintely as the occupancy usually goes
 	 * below pacing algo threshold as soon as pacing kicks in.
@@ -497,6 +502,14 @@
 
 		if (fifo_occup < rdev->qplib_res.pacing_data->pacing_th)
 			break;
+		if (!retry_fifo_check--) {
+			dev_info_once(rdev_to_dev(rdev),
+				      "%s: fifo_occup = 0x%xfifo_max_depth = 0x%x pacing_th = 0x%x\n",
+				      __func__, fifo_occup, pacing_data->fifo_max_depth,
+					pacing_data->pacing_th);
+			break;
+		}
+
 	}
 }
 
@@ -975,12 +988,15 @@
 static int bnxt_re_handle_qp_async_event(struct creq_qp_event *qp_event,
 					 struct bnxt_re_qp *qp)
 {
-	struct bnxt_re_srq *srq = container_of(qp->qplib_qp.srq, struct bnxt_re_srq,
-					       qplib_srq);
 	struct creq_qp_error_notification *err_event;
+	struct bnxt_re_srq *srq = NULL;
 	struct ib_event event = {};
 	unsigned int flags;
 
+	if (qp->qplib_qp.srq)
+		srq =  container_of(qp->qplib_qp.srq, struct bnxt_re_srq,
+				    qplib_srq);
+
 	if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR &&
 	    rdma_is_kernel_res(&qp->ib_qp.res)) {
 		flags = bnxt_re_lock_cqs(qp);
@@ -1208,15 +1224,9 @@
 {
 	struct bnxt_re_cq *cq = container_of(handle, struct bnxt_re_cq,
 					     qplib_cq);
-	u32 *cq_ptr;
 
-	if (cq->ib_cq.comp_handler) {
-		if (cq->uctx_cq_page) {
-			cq_ptr = (u32 *)cq->uctx_cq_page;
-			*cq_ptr = cq->qplib_cq.toggle;
-		}
+	if (cq->ib_cq.comp_handler)
 		(*cq->ib_cq.comp_handler)(&cq->ib_cq, cq->ib_cq.cq_context);
-	}
 
 	return 0;
 }
@@ -1384,11 +1394,8 @@
 
 static void bnxt_re_dev_stop(struct bnxt_re_dev *rdev)
 {
-	int mask = IB_QP_STATE;
-	struct ib_qp_attr qp_attr;
 	struct bnxt_re_qp *qp;
 
-	qp_attr.qp_state = IB_QPS_ERR;
 	mutex_lock(&rdev->qp_lock);
 	list_for_each_entry(qp, &rdev->qp_list, list) {
 		/* Modify the state of all QPs except QP1/Shadow QP */
@@ -1396,12 +1403,9 @@
 			if (qp->qplib_qp.state !=
 			    CMDQ_MODIFY_QP_NEW_STATE_RESET &&
 			    qp->qplib_qp.state !=
-			    CMDQ_MODIFY_QP_NEW_STATE_ERR) {
+			    CMDQ_MODIFY_QP_NEW_STATE_ERR)
 				bnxt_re_dispatch_event(&rdev->ibdev, &qp->ib_qp,
 						       1, IB_EVENT_QP_FATAL);
-				bnxt_re_modify_qp(&qp->ib_qp, &qp_attr, mask,
-						  NULL);
-			}
 		}
 	}
 	mutex_unlock(&rdev->qp_lock);
@@ -1586,7 +1590,7 @@
 	schedule_delayed_work(&rdev->worker, msecs_to_jiffies(30000));
 }
 
-static int bnxt_re_dev_init(struct bnxt_re_dev *rdev, u8 wqe_mode)
+static int bnxt_re_dev_init(struct bnxt_re_dev *rdev)
 {
 	struct bnxt_re_ring_attr rattr = {};
 	struct bnxt_qplib_creq_ctx *creq;
@@ -1604,7 +1608,7 @@
 	}
 	set_bit(BNXT_RE_FLAG_NETDEV_REGISTERED, &rdev->flags);
 
-	rc = bnxt_re_setup_chip_ctx(rdev, wqe_mode);
+	rc = bnxt_re_setup_chip_ctx(rdev);
 	if (rc) {
 		bnxt_unregister_dev(rdev->en_dev);
 		clear_bit(BNXT_RE_FLAG_NETDEV_REGISTERED, &rdev->flags);
@@ -1756,7 +1760,7 @@
 	return rc;
 }
 
-static int bnxt_re_add_device(struct auxiliary_device *adev, u8 wqe_mode)
+static int bnxt_re_add_device(struct auxiliary_device *adev)
 {
 	struct bnxt_aux_priv *aux_priv =
 		container_of(adev, struct bnxt_aux_priv, aux_dev);
@@ -1773,7 +1777,7 @@
 		goto exit;
 	}
 
-	rc = bnxt_re_dev_init(rdev, wqe_mode);
+	rc = bnxt_re_dev_init(rdev);
 	if (rc)
 		goto re_dev_dealloc;
 
@@ -1903,7 +1907,8 @@
 	int rc;
 
 	mutex_lock(&bnxt_re_mutex);
-	rc = bnxt_re_add_device(adev, BNXT_QPLIB_WQE_MODE_STATIC);
+
+	rc = bnxt_re_add_device(adev);
 	if (rc) {
 		mutex_unlock(&bnxt_re_mutex);
 		return rc;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -54,6 +54,10 @@
 #include "qplib_rcfw.h"
 #include "qplib_sp.h"
 #include "qplib_fp.h"
+#include <rdma/ib_addr.h>
+#include "bnxt_ulp.h"
+#include "bnxt_re.h"
+#include "ib_verbs.h"
 
 static void __clean_cq(struct bnxt_qplib_cq *cq, u64 qp);
 
@@ -323,6 +327,7 @@
 		case NQ_BASE_TYPE_CQ_NOTIFICATION:
 		{
 			struct nq_cn *nqcne = (struct nq_cn *)nqe;
+			struct bnxt_re_cq *cq_p;
 
 			q_handle = le32_to_cpu(nqcne->cq_handle_low);
 			q_handle |= (u64)le32_to_cpu(nqcne->cq_handle_high)
@@ -333,6 +338,10 @@
 			cq->toggle = (le16_to_cpu(nqe->info10_type) &
 					NQ_CN_TOGGLE_MASK) >> NQ_CN_TOGGLE_SFT;
 			cq->dbinfo.toggle = cq->toggle;
+			cq_p = container_of(cq, struct bnxt_re_cq, qplib_cq);
+			if (cq_p->uctx_cq_page)
+				*((u32 *)cq_p->uctx_cq_page) = cq->toggle;
+
 			bnxt_qplib_armen_db(&cq->dbinfo,
 					    DBC_DBC_TYPE_CQ_ARMENA);
 			spin_lock_bh(&cq->compl_lock);
@@ -347,6 +356,7 @@
 		case NQ_BASE_TYPE_SRQ_EVENT:
 		{
 			struct bnxt_qplib_srq *srq;
+			struct bnxt_re_srq *srq_p;
 			struct nq_srq_event *nqsrqe =
 						(struct nq_srq_event *)nqe;
 
@@ -354,6 +364,12 @@
 			q_handle |= (u64)le32_to_cpu(nqsrqe->srq_handle_high)
 				     << 32;
 			srq = (struct bnxt_qplib_srq *)q_handle;
+			srq->toggle = (le16_to_cpu(nqe->info10_type) & NQ_CN_TOGGLE_MASK)
+				      >> NQ_CN_TOGGLE_SFT;
+			srq->dbinfo.toggle = srq->toggle;
+			srq_p = container_of(srq, struct bnxt_re_srq, qplib_srq);
+			if (srq_p->uctx_srq_page)
+				*((u32 *)srq_p->uctx_srq_page) = srq->toggle;
 			bnxt_qplib_armen_db(&srq->dbinfo,
 					    DBC_DBC_TYPE_SRQ_ARMENA);
 			if (nq->srqn_handler(nq,
@@ -642,13 +658,6 @@
 	rc = bnxt_qplib_alloc_init_hwq(&srq->hwq, &hwq_attr);
 	if (rc)
 		return rc;
-
-	srq->swq = kcalloc(srq->hwq.max_elements, sizeof(*srq->swq),
-			   GFP_KERNEL);
-	if (!srq->swq) {
-		rc = -ENOMEM;
-		goto fail;
-	}
 	srq->dbinfo.flags = 0;
 	bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req,
 				 CMDQ_BASE_OPCODE_CREATE_SRQ,
@@ -677,9 +686,17 @@
 	spin_lock_init(&srq->lock);
 	srq->start_idx = 0;
 	srq->last_idx = srq->hwq.max_elements - 1;
-	for (idx = 0; idx < srq->hwq.max_elements; idx++)
-		srq->swq[idx].next_idx = idx + 1;
-	srq->swq[srq->last_idx].next_idx = -1;
+	if (!srq->hwq.is_user) {
+		srq->swq = kcalloc(srq->hwq.max_elements, sizeof(*srq->swq),
+				   GFP_KERNEL);
+		if (!srq->swq) {
+			rc = -ENOMEM;
+			goto fail;
+		}
+		for (idx = 0; idx < srq->hwq.max_elements; idx++)
+			srq->swq[idx].next_idx = idx + 1;
+		srq->swq[srq->last_idx].next_idx = -1;
+	}
 
 	srq->id = le32_to_cpu(resp.xid);
 	srq->dbinfo.hwq = &srq->hwq;
@@ -809,13 +826,13 @@
 {
 	int indx;
 
-	que->swq = kcalloc(que->max_wqe, sizeof(*que->swq), GFP_KERNEL);
+	que->swq = kcalloc(que->max_sw_wqe, sizeof(*que->swq), GFP_KERNEL);
 	if (!que->swq)
 		return -ENOMEM;
 
 	que->swq_start = 0;
-	que->swq_last = que->max_wqe - 1;
-	for (indx = 0; indx < que->max_wqe; indx++)
+	que->swq_last = que->max_sw_wqe - 1;
+	for (indx = 0; indx < que->max_sw_wqe; indx++)
 		que->swq[indx].next_idx = indx + 1;
 	que->swq[que->swq_last].next_idx = 0; /* Make it circular */
 	que->swq_last = 0;
@@ -851,7 +868,7 @@
 	hwq_attr.res = res;
 	hwq_attr.sginfo = &sq->sg_info;
 	hwq_attr.stride = sizeof(struct sq_sge);
-	hwq_attr.depth = bnxt_qplib_get_depth(sq);
+	hwq_attr.depth = bnxt_qplib_get_depth(sq, qp->wqe_mode, false);
 	hwq_attr.type = HWQ_TYPE_QUEUE;
 	rc = bnxt_qplib_alloc_init_hwq(&sq->hwq, &hwq_attr);
 	if (rc)
@@ -879,7 +896,7 @@
 		hwq_attr.res = res;
 		hwq_attr.sginfo = &rq->sg_info;
 		hwq_attr.stride = sizeof(struct sq_sge);
-		hwq_attr.depth = bnxt_qplib_get_depth(rq);
+		hwq_attr.depth = bnxt_qplib_get_depth(rq, qp->wqe_mode, false);
 		hwq_attr.type = HWQ_TYPE_QUEUE;
 		rc = bnxt_qplib_alloc_init_hwq(&rq->hwq, &hwq_attr);
 		if (rc)
@@ -983,9 +1000,7 @@
 	u32 tbl_indx;
 	u16 nsge;
 
-	if (res->dattr)
-		qp->dev_cap_flags = res->dattr->dev_cap_flags;
-
+	qp->is_host_msn_tbl = _is_host_msn_table(res->dattr->dev_cap_flags2);
 	sq->dbinfo.flags = 0;
 	bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req,
 				 CMDQ_BASE_OPCODE_CREATE_QP,
@@ -1002,7 +1017,7 @@
 			 sizeof(struct sq_psn_search_ext) :
 			 sizeof(struct sq_psn_search);
 
-		if (BNXT_RE_HW_RETX(qp->dev_cap_flags)) {
+		if (qp->is_host_msn_tbl) {
 			psn_sz = sizeof(struct sq_msn_search);
 			qp->msn = 0;
 		}
@@ -1011,12 +1026,18 @@
 	hwq_attr.res = res;
 	hwq_attr.sginfo = &sq->sg_info;
 	hwq_attr.stride = sizeof(struct sq_sge);
-	hwq_attr.depth = bnxt_qplib_get_depth(sq);
+	hwq_attr.depth = bnxt_qplib_get_depth(sq, qp->wqe_mode, true);
 	hwq_attr.aux_stride = psn_sz;
-	hwq_attr.aux_depth = bnxt_qplib_set_sq_size(sq, qp->wqe_mode);
+	hwq_attr.aux_depth = psn_sz ? bnxt_qplib_set_sq_size(sq, qp->wqe_mode)
+				    : 0;
 	/* Update msn tbl size */
-	if (BNXT_RE_HW_RETX(qp->dev_cap_flags) && psn_sz) {
-		hwq_attr.aux_depth = roundup_pow_of_two(bnxt_qplib_set_sq_size(sq, qp->wqe_mode));
+	if (qp->is_host_msn_tbl && psn_sz) {
+		if (qp->wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC)
+			hwq_attr.aux_depth =
+				roundup_pow_of_two(bnxt_qplib_set_sq_size(sq, qp->wqe_mode));
+		else
+			hwq_attr.aux_depth =
+				roundup_pow_of_two(bnxt_qplib_set_sq_size(sq, qp->wqe_mode)) / 2;
 		qp->msn_tbl_sz = hwq_attr.aux_depth;
 		qp->msn = 0;
 	}
@@ -1026,13 +1047,14 @@
 	if (rc)
 		return rc;
 
-	rc = bnxt_qplib_alloc_init_swq(sq);
-	if (rc)
-		goto fail_sq;
-
-	if (psn_sz)
-		bnxt_qplib_init_psn_ptr(qp, psn_sz);
+	if (!sq->hwq.is_user) {
+		rc = bnxt_qplib_alloc_init_swq(sq);
+		if (rc)
+			goto fail_sq;
 
+		if (psn_sz)
+			bnxt_qplib_init_psn_ptr(qp, psn_sz);
+	}
 	req.sq_size = cpu_to_le32(bnxt_qplib_set_sq_size(sq, qp->wqe_mode));
 	pbl = &sq->hwq.pbl[PBL_LVL_0];
 	req.sq_pbl = cpu_to_le64(pbl->pg_map_arr[0]);
@@ -1051,16 +1073,18 @@
 		hwq_attr.res = res;
 		hwq_attr.sginfo = &rq->sg_info;
 		hwq_attr.stride = sizeof(struct sq_sge);
-		hwq_attr.depth = bnxt_qplib_get_depth(rq);
+		hwq_attr.depth = bnxt_qplib_get_depth(rq, qp->wqe_mode, false);
 		hwq_attr.aux_stride = 0;
 		hwq_attr.aux_depth = 0;
 		hwq_attr.type = HWQ_TYPE_QUEUE;
 		rc = bnxt_qplib_alloc_init_hwq(&rq->hwq, &hwq_attr);
 		if (rc)
 			goto sq_swq;
-		rc = bnxt_qplib_alloc_init_swq(rq);
-		if (rc)
-			goto fail_rq;
+		if (!rq->hwq.is_user) {
+			rc = bnxt_qplib_alloc_init_swq(rq);
+			if (rc)
+				goto fail_rq;
+		}
 
 		req.rq_size = cpu_to_le32(rq->max_wqe);
 		pbl = &rq->hwq.pbl[PBL_LVL_0];
@@ -1156,9 +1180,11 @@
 		rq->dbinfo.db = qp->dpi->dbr;
 		rq->dbinfo.max_slot = bnxt_qplib_set_rq_max_slot(rq->wqe_size);
 	}
+	spin_lock_bh(&rcfw->tbl_lock);
 	tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw);
 	rcfw->qp_tbl[tbl_indx].qp_id = qp->id;
 	rcfw->qp_tbl[tbl_indx].qp_handle = (void *)qp;
+	spin_unlock_bh(&rcfw->tbl_lock);
 
 	return 0;
 fail:
@@ -1453,6 +1479,7 @@
 	qp->dest_qpn = le32_to_cpu(sb->dest_qp_id);
 	memcpy(qp->smac, sb->src_mac, 6);
 	qp->vlan_id = le16_to_cpu(sb->vlan_pcp_vlan_dei_vlan_id);
+	qp->port_id = le16_to_cpu(sb->port_id);
 bail:
 	dma_free_coherent(&rcfw->pdev->dev, sbuf.size,
 			  sbuf.sb, sbuf.dma_addr);
@@ -1515,9 +1542,11 @@
 	u32 tbl_indx;
 	int rc;
 
+	spin_lock_bh(&rcfw->tbl_lock);
 	tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw);
 	rcfw->qp_tbl[tbl_indx].qp_id = BNXT_QPLIB_QP_ID_INVALID;
 	rcfw->qp_tbl[tbl_indx].qp_handle = NULL;
+	spin_unlock_bh(&rcfw->tbl_lock);
 
 	bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req,
 				 CMDQ_BASE_OPCODE_DESTROY_QP,
@@ -1528,8 +1557,10 @@
 				sizeof(resp), 0);
 	rc = bnxt_qplib_rcfw_send_message(rcfw, &msg);
 	if (rc) {
+		spin_lock_bh(&rcfw->tbl_lock);
 		rcfw->qp_tbl[tbl_indx].qp_id = qp->id;
 		rcfw->qp_tbl[tbl_indx].qp_handle = qp;
+		spin_unlock_bh(&rcfw->tbl_lock);
 		return rc;
 	}
 
@@ -1636,7 +1667,7 @@
 	if (!swq->psn_search)
 		return;
 	/* Handle MSN differently on cap flags  */
-	if (BNXT_RE_HW_RETX(qp->dev_cap_flags)) {
+	if (qp->is_host_msn_tbl) {
 		bnxt_qplib_fill_msn_search(qp, wqe, swq);
 		return;
 	}
@@ -1818,7 +1849,7 @@
 	}
 
 	swq = bnxt_qplib_get_swqe(sq, &wqe_idx);
-	bnxt_qplib_pull_psn_buff(qp, sq, swq, BNXT_RE_HW_RETX(qp->dev_cap_flags));
+	bnxt_qplib_pull_psn_buff(qp, sq, swq, qp->is_host_msn_tbl);
 
 	idx = 0;
 	swq->slot_idx = hwq->prod;
@@ -2008,7 +2039,7 @@
 		rc = -EINVAL;
 		goto done;
 	}
-	if (!BNXT_RE_HW_RETX(qp->dev_cap_flags) || msn_update) {
+	if (!qp->is_host_msn_tbl || msn_update) {
 		swq->next_psn = sq->psn & BTH_PSN_MASK;
 		bnxt_qplib_fill_psn_search(qp, wqe, swq);
 	}
@@ -2491,7 +2522,7 @@
 	}
 	sq = &qp->sq;
 
-	cqe_sq_cons = le16_to_cpu(hwcqe->sq_cons_idx) % sq->max_wqe;
+	cqe_sq_cons = le16_to_cpu(hwcqe->sq_cons_idx) % sq->max_sw_wqe;
 	if (qp->sq.flushed) {
 		dev_dbg(&cq->hwq.pdev->dev,
 			"%s: QP in Flush QP = %p\n", __func__, qp);
@@ -2534,10 +2565,12 @@
 			bnxt_qplib_add_flush_qp(qp);
 		} else {
 			/* Before we complete, do WA 9060 */
-			if (do_wa9060(qp, cq, cq_cons, sq->swq_last,
-				      cqe_sq_cons)) {
-				*lib_qp = qp;
-				goto out;
+			if (!bnxt_qplib_is_chip_gen_p5_p7(qp->cctx)) {
+				if (do_wa9060(qp, cq, cq_cons, sq->swq_last,
+					      cqe_sq_cons)) {
+					*lib_qp = qp;
+					goto out;
+				}
 			}
 			if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
 				cqe->status = CQ_REQ_STATUS_OK;
@@ -2881,7 +2914,7 @@
 	cqe_cons = le16_to_cpu(hwcqe->sq_cons_idx);
 	if (cqe_cons == 0xFFFF)
 		goto do_rq;
-	cqe_cons %= sq->max_wqe;
+	cqe_cons %= sq->max_sw_wqe;
 
 	if (qp->sq.flushed) {
 		dev_dbg(&cq->hwq.pdev->dev,
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -105,6 +105,7 @@
 	struct bnxt_qplib_sg_info	sg_info;
 	u16				eventq_hw_ring_id;
 	spinlock_t			lock; /* protect SRQE link list */
+	u8				toggle;
 };
 
 struct bnxt_qplib_sge {
@@ -113,7 +114,6 @@
 	u32				size;
 };
 
-#define BNXT_QPLIB_QP_MAX_SGL	6
 struct bnxt_qplib_swq {
 	u64				wr_id;
 	int				next_idx;
@@ -153,7 +153,7 @@
 #define BNXT_QPLIB_SWQE_FLAGS_UC_FENCE			BIT(2)
 #define BNXT_QPLIB_SWQE_FLAGS_SOLICIT_EVENT		BIT(3)
 #define BNXT_QPLIB_SWQE_FLAGS_INLINE			BIT(4)
-	struct bnxt_qplib_sge		sg_list[BNXT_QPLIB_QP_MAX_SGL];
+	struct bnxt_qplib_sge		sg_list[BNXT_VAR_MAX_SGE];
 	int				num_sge;
 	/* Max inline data is 96 bytes */
 	u32				inline_len;
@@ -164,12 +164,12 @@
 		/* Send, with imm, inval key */
 		struct {
 			union {
-				__be32	imm_data;
+				u32	imm_data;
 				u32	inv_key;
 			};
 			u32		q_key;
 			u32		dst_qp;
-			u16		avid;
+			u32		avid;
 		} send;
 
 		/* Send Raw Ethernet and QP1 */
@@ -182,7 +182,7 @@
 		/* RDMA write, with imm, read */
 		struct {
 			union {
-				__be32	imm_data;
+				u32	imm_data;
 				u32	inv_key;
 			};
 			u64		remote_va;
@@ -251,6 +251,7 @@
 	struct bnxt_qplib_db_info	dbinfo;
 	struct bnxt_qplib_sg_info	sg_info;
 	u32				max_wqe;
+	u32				max_sw_wqe;
 	u16				wqe_size;
 	u16				q_full_delta;
 	u16				max_sge;
@@ -297,6 +298,7 @@
 	u32				dest_qpn;
 	u8				smac[6];
 	u16				vlan_id;
+	u16				port_id;
 	u8				nw_type;
 	struct bnxt_qplib_ah		ah;
 
@@ -340,7 +342,7 @@
 	struct list_head		rq_flush;
 	u32				msn;
 	u32				msn_tbl_sz;
-	u16				dev_cap_flags;
+	bool				is_host_msn_tbl;
 };
 
 #define BNXT_QPLIB_MAX_CQE_ENTRY_SIZE	sizeof(struct cq_base)
@@ -389,7 +391,7 @@
 	u16				cfa_meta;
 	u64				wr_id;
 	union {
-		__be32			immdata;
+		u32			immdata;
 		u32			invrkey;
 	};
 	u64				qp_handle;
@@ -586,15 +588,22 @@
 	que->swq_start = que->swq[idx].next_idx;
 }
 
-static inline u32 bnxt_qplib_get_depth(struct bnxt_qplib_q *que)
+static inline u32 bnxt_qplib_get_depth(struct bnxt_qplib_q *que, u8 wqe_mode, bool is_sq)
 {
-	return (que->wqe_size * que->max_wqe) / sizeof(struct sq_sge);
+	u32 slots;
+
+	/* Queue depth is the number of slots. */
+	slots = (que->wqe_size * que->max_wqe) / sizeof(struct sq_sge);
+	/* For variable WQE mode, need to align the slots to 256 */
+	if (wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE && is_sq)
+		slots = ALIGN(slots, BNXT_VAR_MAX_SLOT_ALIGN);
+	return slots;
 }
 
 static inline u32 bnxt_qplib_set_sq_size(struct bnxt_qplib_q *que, u8 wqe_mode)
 {
 	return (wqe_mode == BNXT_QPLIB_WQE_MODE_STATIC) ?
-		que->max_wqe : bnxt_qplib_get_depth(que);
+		que->max_wqe : bnxt_qplib_get_depth(que, wqe_mode, true);
 }
 
 static inline u32 bnxt_qplib_set_sq_max_slot(u8 wqe_mode)
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -290,7 +290,6 @@
 	struct bnxt_qplib_hwq *hwq;
 	u32 sw_prod, cmdq_prod;
 	struct pci_dev *pdev;
-	unsigned long flags;
 	u16 cookie;
 	u8 *preq;
 
@@ -301,7 +300,7 @@
 	/* Cmdq are in 16-byte units, each request can consume 1 or more
 	 * cmdqe
 	 */
-	spin_lock_irqsave(&hwq->lock, flags);
+	spin_lock_bh(&hwq->lock);
 	required_slots = bnxt_qplib_get_cmd_slots(msg->req);
 	free_slots = HWQ_FREE_SLOTS(hwq);
 	cookie = cmdq->seq_num & RCFW_MAX_COOKIE_VALUE;
@@ -311,7 +310,7 @@
 		dev_info_ratelimited(&pdev->dev,
 				     "CMDQ is full req/free %d/%d!",
 				     required_slots, free_slots);
-		spin_unlock_irqrestore(&hwq->lock, flags);
+		spin_unlock_bh(&hwq->lock);
 		return -EAGAIN;
 	}
 	if (msg->block)
@@ -367,7 +366,7 @@
 	wmb();
 	writel(cmdq_prod, cmdq->cmdq_mbox.prod);
 	writel(RCFW_CMDQ_TRIG_VAL, cmdq->cmdq_mbox.db);
-	spin_unlock_irqrestore(&hwq->lock, flags);
+	spin_unlock_bh(&hwq->lock);
 	/* Return the CREQ response pointer */
 	return 0;
 }
@@ -425,7 +424,8 @@
 
 	/* Prevent posting if f/w is not in a state to process */
 	if (test_bit(ERR_DEVICE_DETACHED, &rcfw->cmdq.flags))
-		return bnxt_qplib_map_rc(opcode);
+		return -ENXIO;
+
 	if (test_bit(FIRMWARE_STALL_DETECTED, &cmdq->flags))
 		return -ETIMEDOUT;
 
@@ -486,7 +486,6 @@
 {
 	struct creq_qp_event *evnt = (struct creq_qp_event *)msg->resp;
 	struct bnxt_qplib_crsqe *crsqe;
-	unsigned long flags;
 	u16 cookie;
 	int rc;
 	u8 opcode;
@@ -495,7 +494,7 @@
 
 	rc = __send_message_basic_sanity(rcfw, msg, opcode);
 	if (rc)
-		return rc;
+		return rc == -ENXIO ? bnxt_qplib_map_rc(opcode) : rc;
 
 	rc = __send_message(rcfw, msg, opcode);
 	if (rc)
@@ -512,12 +511,12 @@
 		rc = __poll_for_resp(rcfw, cookie);
 
 	if (rc) {
-		spin_lock_irqsave(&rcfw->cmdq.hwq.lock, flags);
+		spin_lock_bh(&rcfw->cmdq.hwq.lock);
 		crsqe = &rcfw->crsqe_tbl[cookie];
 		crsqe->is_waiter_alive = false;
 		if (rc == -ENODEV)
 			set_bit(FIRMWARE_STALL_DETECTED, &rcfw->cmdq.flags);
-		spin_unlock_irqrestore(&rcfw->cmdq.hwq.lock, flags);
+		spin_unlock_bh(&rcfw->cmdq.hwq.lock);
 		return -ETIMEDOUT;
 	}
 
@@ -525,7 +524,7 @@
 		/* failed with status */
 		dev_err(&rcfw->pdev->dev, "cmdq[%#x]=%#x status %#x\n",
 			cookie, opcode, evnt->status);
-		rc = -EFAULT;
+		rc = -EIO;
 	}
 
 	return rc;
@@ -628,7 +627,6 @@
 	u16 cookie, blocked = 0;
 	bool is_waiter_alive;
 	struct pci_dev *pdev;
-	unsigned long flags;
 	u32 wait_cmds = 0;
 	int rc = 0;
 
@@ -637,17 +635,21 @@
 	case CREQ_QP_EVENT_EVENT_QP_ERROR_NOTIFICATION:
 		err_event = (struct creq_qp_error_notification *)qp_event;
 		qp_id = le32_to_cpu(err_event->xid);
+		spin_lock(&rcfw->tbl_lock);
 		tbl_indx = map_qp_id_to_tbl_indx(qp_id, rcfw);
 		qp = rcfw->qp_tbl[tbl_indx].qp_handle;
+		if (!qp) {
+			spin_unlock(&rcfw->tbl_lock);
+			break;
+		}
+		bnxt_qplib_mark_qp_error(qp);
+		rc = rcfw->creq.aeq_handler(rcfw, qp_event, qp);
+		spin_unlock(&rcfw->tbl_lock);
 		dev_dbg(&pdev->dev, "Received QP error notification\n");
 		dev_dbg(&pdev->dev,
 			"qpid 0x%x, req_err=0x%x, resp_err=0x%x\n",
 			qp_id, err_event->req_err_state_reason,
 			err_event->res_err_state_reason);
-		if (!qp)
-			break;
-		bnxt_qplib_mark_qp_error(qp);
-		rc = rcfw->creq.aeq_handler(rcfw, qp_event, qp);
 		break;
 	default:
 		/*
@@ -659,8 +661,7 @@
 		 *
 		 */
 
-		spin_lock_irqsave_nested(&hwq->lock, flags,
-					 SINGLE_DEPTH_NESTING);
+		spin_lock_nested(&hwq->lock, SINGLE_DEPTH_NESTING);
 		cookie = le16_to_cpu(qp_event->cookie);
 		blocked = cookie & RCFW_CMD_IS_BLOCKING;
 		cookie &= RCFW_MAX_COOKIE_VALUE;
@@ -672,7 +673,7 @@
 			dev_info(&pdev->dev,
 				 "rcfw timedout: cookie = %#x, free_slots = %d",
 				 cookie, crsqe->free_slots);
-			spin_unlock_irqrestore(&hwq->lock, flags);
+			spin_unlock(&hwq->lock);
 			return rc;
 		}
 
@@ -720,7 +721,7 @@
 			__destroy_timedout_ah(rcfw,
 					      (struct creq_create_ah_resp *)
 					      qp_event);
-		spin_unlock_irqrestore(&hwq->lock, flags);
+		spin_unlock(&hwq->lock);
 	}
 	*num_wait += wait_cmds;
 	return rc;
@@ -734,12 +735,11 @@
 	u32 type, budget = CREQ_ENTRY_POLL_BUDGET;
 	struct bnxt_qplib_hwq *hwq = &creq->hwq;
 	struct creq_base *creqe;
-	unsigned long flags;
 	u32 num_wakeup = 0;
 	u32 hw_polled = 0;
 
 	/* Service the CREQ until budget is over */
-	spin_lock_irqsave(&hwq->lock, flags);
+	spin_lock_bh(&hwq->lock);
 	while (budget > 0) {
 		creqe = bnxt_qplib_get_qe(hwq, hwq->cons, NULL);
 		if (!CREQ_CMP_VALID(creqe, creq->creq_db.dbinfo.flags))
@@ -782,7 +782,7 @@
 	if (hw_polled)
 		bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo,
 				      rcfw->res->cctx, true);
-	spin_unlock_irqrestore(&hwq->lock, flags);
+	spin_unlock_bh(&hwq->lock);
 	if (num_wakeup)
 		wake_up_nr(&rcfw->cmdq.waitq, num_wakeup);
 }
@@ -978,6 +978,7 @@
 			       GFP_KERNEL);
 	if (!rcfw->qp_tbl)
 		goto fail;
+	spin_lock_init(&rcfw->tbl_lock);
 
 	rcfw->max_timeout = res->cctx->hwrm_cmd_max_timeout;
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -224,6 +224,8 @@
 	struct bnxt_qplib_crsqe		*crsqe_tbl;
 	int qp_tbl_size;
 	struct bnxt_qplib_qp_node *qp_tbl;
+	/* To synchronize the qp-handle hash table */
+	spinlock_t			tbl_lock;
 	u64 oos_prev;
 	u32 init_oos_stats;
 	u32 cmdq_depth;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/qplib_res.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/qplib_res.c
@@ -244,6 +244,8 @@
 			sginfo.pgsize = npde * pg_size;
 			sginfo.npages = 1;
 			rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_0], &sginfo);
+			if (rc)
+				goto fail;
 
 			/* Alloc PBL pages */
 			sginfo.npages = npbl;
@@ -255,22 +257,9 @@
 			dst_virt_ptr =
 				(dma_addr_t **)hwq->pbl[PBL_LVL_0].pg_arr;
 			src_phys_ptr = hwq->pbl[PBL_LVL_1].pg_map_arr;
-			if (hwq_attr->type == HWQ_TYPE_MR) {
-			/* For MR it is expected that we supply only 1 contigous
-			 * page i.e only 1 entry in the PDL that will contain
-			 * all the PBLs for the user supplied memory region
-			 */
-				for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count;
-				     i++)
-					dst_virt_ptr[0][i] = src_phys_ptr[i] |
-						flag;
-			} else {
-				for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count;
-				     i++)
-					dst_virt_ptr[PTR_PG(i)][PTR_IDX(i)] =
-						src_phys_ptr[i] |
-						PTU_PDE_VALID;
-			}
+			for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; i++)
+				dst_virt_ptr[0][i] = src_phys_ptr[i] | flag;
+
 			/* Alloc or init PTEs */
 			rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_2],
 					 hwq_attr->sginfo);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/qplib_res.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/qplib_res.h
@@ -554,6 +554,12 @@
 
 #define BNXT_RE_HW_RETX(a) _is_hw_retx_supported((a))
 
+static inline bool _is_host_msn_table(u16 dev_cap_ext_flags2)
+{
+	return (dev_cap_ext_flags2 & CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_MASK) ==
+		CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_HOST_MSN_TABLE;
+}
+
 static inline u8 bnxt_qplib_dbr_pacing_en(struct bnxt_qplib_chip_ctx *cctx)
 {
 	return cctx->modes.dbr_pacing;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -95,11 +95,13 @@
 	struct bnxt_qplib_cmdqmsg msg = {};
 	struct creq_query_func_resp_sb *sb;
 	struct bnxt_qplib_rcfw_sbuf sbuf;
+	struct bnxt_qplib_chip_ctx *cctx;
 	struct cmdq_query_func req = {};
 	u8 *tqm_alloc;
 	int i, rc;
 	u32 temp;
 
+	cctx = rcfw->res->cctx;
 	bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req,
 				 CMDQ_BASE_OPCODE_QUERY_FUNC,
 				 sizeof(req));
@@ -127,16 +129,25 @@
 	attr->max_qp_init_rd_atom =
 		sb->max_qp_init_rd_atom > BNXT_QPLIB_MAX_OUT_RD_ATOM ?
 		BNXT_QPLIB_MAX_OUT_RD_ATOM : sb->max_qp_init_rd_atom;
-	attr->max_qp_wqes = le16_to_cpu(sb->max_qp_wr);
-	/*
-	 * 128 WQEs needs to be reserved for the HW (8916). Prevent
-	 * reporting the max number
-	 */
-	attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS + 1;
-	attr->max_qp_sges = bnxt_qplib_is_chip_gen_p5_p7(rcfw->res->cctx) ?
-			    6 : sb->max_sge;
+	attr->max_qp_wqes = le16_to_cpu(sb->max_qp_wr) - 1;
+	if (!bnxt_qplib_is_chip_gen_p5_p7(rcfw->res->cctx)) {
+		/*
+		 * 128 WQEs needs to be reserved for the HW (8916). Prevent
+		 * reporting the max number on legacy devices
+		 */
+		attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS + 1;
+	}
+
+	/* Adjust for max_qp_wqes for variable wqe */
+	if (cctx->modes.wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE)
+		attr->max_qp_wqes = BNXT_VAR_MAX_WQE - 1;
+
+	attr->max_qp_sges = cctx->modes.wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE ?
+			    min_t(u32, sb->max_sge_var_wqe, BNXT_VAR_MAX_SGE) : 6;
 	attr->max_cq = le32_to_cpu(sb->max_cq);
 	attr->max_cq_wqes = le32_to_cpu(sb->max_cqe);
+	if (!bnxt_qplib_is_chip_gen_p7(rcfw->res->cctx))
+		attr->max_cq_wqes = min_t(u32, BNXT_QPLIB_MAX_CQ_WQES, attr->max_cq_wqes);
 	attr->max_cq_sges = attr->max_qp_sges;
 	attr->max_mr = le32_to_cpu(sb->max_mr);
 	attr->max_mw = le32_to_cpu(sb->max_mw);
@@ -154,8 +165,16 @@
 	if (!bnxt_qplib_is_chip_gen_p7(rcfw->res->cctx))
 		attr->l2_db_size = (sb->l2_db_space_size + 1) *
 				    (0x01 << RCFW_DBR_BASE_PAGE_SHIFT);
-	attr->max_sgid = BNXT_QPLIB_NUM_GIDS_SUPPORTED;
+	/*
+	 * Read the max gid supported by HW.
+	 * For each entry in HW  GID in HW table, we consume 2
+	 * GID entries in the kernel GID table.  So max_gid reported
+	 * to stack can be up to twice the value reported by the HW, up to 256 gids.
+	 */
+	attr->max_sgid = le32_to_cpu(sb->max_gid);
+	attr->max_sgid = min_t(u32, BNXT_QPLIB_NUM_GIDS_SUPPORTED, 2 * attr->max_sgid);
 	attr->dev_cap_flags = le16_to_cpu(sb->dev_cap_flags);
+	attr->dev_cap_flags2 = le16_to_cpu(sb->dev_cap_ext_flags_2);
 
 	bnxt_qplib_query_version(rcfw, attr->fw_ver);
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/qplib_sp.h
@@ -40,6 +40,7 @@
 #ifndef __BNXT_QPLIB_SP_H__
 #define __BNXT_QPLIB_SP_H__
 
+#include <rdma/bnxt_re-abi.h>
 #define BNXT_QPLIB_RESERVED_QP_WRS	128
 
 struct bnxt_qplib_dev_attr {
@@ -55,6 +56,7 @@
 	u32				max_qp_wqes;
 	u32				max_qp_sges;
 	u32				max_cq;
+#define BNXT_QPLIB_MAX_CQ_WQES          0xfffff
 	u32				max_cq_wqes;
 	u32				max_cq_sges;
 	u32				max_mr;
@@ -72,6 +74,7 @@
 	u8				tqm_alloc_reqs[MAX_TQM_ALLOC_REQ];
 	bool				is_atomic;
 	u16                             dev_cap_flags;
+	u16                             dev_cap_flags2;
 	u32                             max_dpi;
 };
 
@@ -350,4 +353,11 @@
 int bnxt_qplib_modify_cc(struct bnxt_qplib_res *res,
 			 struct bnxt_qplib_cc_param *cc_param);
 
+#define BNXT_VAR_MAX_WQE       4352
+#define BNXT_VAR_MAX_SLOT_ALIGN 256
+#define BNXT_VAR_MAX_SGE        13
+#define BNXT_RE_MAX_RQ_WQES     65536
+
+#define BNXT_STATIC_MAX_SGE	6
+
 #endif /* __BNXT_QPLIB_SP_H__*/
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/bnxt_re/roce_hsi.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/bnxt_re/roce_hsi.h
@@ -2157,8 +2157,36 @@
 	__le32	tqm_alloc_reqs[12];
 	__le32	max_dpi;
 	u8	max_sge_var_wqe;
-	u8	reserved_8;
+	u8	dev_cap_ext_flags;
+	#define CREQ_QUERY_FUNC_RESP_SB_ATOMIC_OPS_NOT_SUPPORTED         0x1UL
+	#define CREQ_QUERY_FUNC_RESP_SB_DRV_VERSION_RGTR_SUPPORTED       0x2UL
+	#define CREQ_QUERY_FUNC_RESP_SB_CREATE_QP_BATCH_SUPPORTED        0x4UL
+	#define CREQ_QUERY_FUNC_RESP_SB_DESTROY_QP_BATCH_SUPPORTED       0x8UL
+	#define CREQ_QUERY_FUNC_RESP_SB_ROCE_STATS_EXT_CTX_SUPPORTED     0x10UL
+	#define CREQ_QUERY_FUNC_RESP_SB_CREATE_SRQ_SGE_SUPPORTED         0x20UL
+	#define CREQ_QUERY_FUNC_RESP_SB_FIXED_SIZE_WQE_DISABLED          0x40UL
+	#define CREQ_QUERY_FUNC_RESP_SB_DCN_SUPPORTED                    0x80UL
 	__le16	max_inline_data_var_wqe;
+	__le32	start_qid;
+	u8	max_msn_table_size;
+	u8	reserved8_1;
+	__le16	dev_cap_ext_flags_2;
+	#define CREQ_QUERY_FUNC_RESP_SB_OPTIMIZE_MODIFY_QP_SUPPORTED             0x1UL
+	#define CREQ_QUERY_FUNC_RESP_SB_CHANGE_UDP_SRC_PORT_WQE_SUPPORTED        0x2UL
+	#define CREQ_QUERY_FUNC_RESP_SB_CQ_COALESCING_SUPPORTED                  0x4UL
+	#define CREQ_QUERY_FUNC_RESP_SB_MEMORY_REGION_RO_SUPPORTED               0x8UL
+	#define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_MASK          0x30UL
+	#define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_SFT           4
+	#define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_HOST_PSN_TABLE  (0x0UL << 4)
+	#define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_HOST_MSN_TABLE  (0x1UL << 4)
+	#define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_IQM_MSN_TABLE   (0x2UL << 4)
+	#define CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_LAST	\
+			CREQ_QUERY_FUNC_RESP_SB_REQ_RETRANSMISSION_SUPPORT_IQM_MSN_TABLE
+	__le16	max_xp_qp_size;
+	__le16	create_qp_batch_size;
+	__le16	destroy_qp_batch_size;
+	__le16	reserved16;
+	__le64	reserved64;
 };
 
 /* cmdq_set_func_resources (size:448b/56B) */
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/cxgb4/cm.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/cxgb4/cm.c
@@ -1222,6 +1222,8 @@
 	int ret;
 
 	ep = lookup_atid(t, atid);
+	if (!ep)
+		return -EINVAL;
 
 	pr_debug("ep %p tid %u snd_isn %u rcv_isn %u\n", ep, tid,
 		 be32_to_cpu(req->snd_isn), be32_to_cpu(req->rcv_isn));
@@ -2084,7 +2086,7 @@
 	err = -ENOMEM;
 	if (n->dev->flags & IFF_LOOPBACK) {
 		if (iptype == 4)
-			pdev = ip_dev_find(&init_net, *(__be32 *)peer_ip);
+			pdev = __ip_dev_find(&init_net, *(__be32 *)peer_ip, false);
 		else if (IS_ENABLED(CONFIG_IPV6))
 			for_each_netdev(&init_net, pdev) {
 				if (ipv6_chk_addr(&init_net,
@@ -2099,12 +2101,12 @@
 			err = -ENODEV;
 			goto out;
 		}
+		if (is_vlan_dev(pdev))
+			pdev = vlan_dev_real_dev(pdev);
 		ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
 					n, pdev, rt_tos2priority(tos));
-		if (!ep->l2t) {
-			dev_put(pdev);
+		if (!ep->l2t)
 			goto out;
-		}
 		ep->mtu = pdev->mtu;
 		ep->tx_chan = cxgb4_port_chan(pdev);
 		ep->smac_idx = ((struct port_info *)netdev_priv(pdev))->smt_idx;
@@ -2117,7 +2119,6 @@
 		ep->rss_qid = cdev->rdev.lldi.rxq_ids[
 			cxgb4_port_idx(pdev) * step];
 		set_tcp_window(ep, (struct port_info *)netdev_priv(pdev));
-		dev_put(pdev);
 	} else {
 		pdev = get_real_dev(n->dev);
 		ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
@@ -2279,6 +2280,9 @@
 	int ret = 0;
 
 	ep = lookup_atid(t, atid);
+	if (!ep)
+		return -EINVAL;
+
 	la = (struct sockaddr_in *)&ep->com.local_addr;
 	ra = (struct sockaddr_in *)&ep->com.remote_addr;
 	la6 = (struct sockaddr_in6 *)&ep->com.local_addr;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/cxgb4/provider.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/cxgb4/provider.c
@@ -474,6 +474,7 @@
 	.fill_res_cq_entry = c4iw_fill_res_cq_entry,
 	.fill_res_cm_id_entry = c4iw_fill_res_cm_id_entry,
 	.fill_res_mr_entry = c4iw_fill_res_mr_entry,
+	.fill_res_qp_entry = c4iw_fill_res_qp_entry,
 	.get_dev_fw_str = get_dev_fw_str,
 	.get_dma_mr = c4iw_get_dma_mr,
 	.get_hw_stats = c4iw_get_mib,
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/efa/efa_com.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/efa/efa_com.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
 /*
- * Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All rights reserved.
+ * Copyright 2018-2024 Amazon.com, Inc. or its affiliates. All rights reserved.
  */
 
 #include "efa_com.h"
@@ -406,8 +406,8 @@
 	return comp_ctx;
 }
 
-static void efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aq,
-						   struct efa_admin_acq_entry *cqe)
+static int efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aq,
+						  struct efa_admin_acq_entry *cqe)
 {
 	struct efa_comp_ctx *comp_ctx;
 	u16 cmd_id;
@@ -416,11 +416,11 @@
 			 EFA_ADMIN_ACQ_COMMON_DESC_COMMAND_ID);
 
 	comp_ctx = efa_com_get_comp_ctx(aq, cmd_id, false);
-	if (!comp_ctx) {
+	if (comp_ctx->status != EFA_CMD_SUBMITTED) {
 		ibdev_err(aq->efa_dev,
-			  "comp_ctx is NULL. Changing the admin queue running state\n");
-		clear_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state);
-		return;
+			  "Received completion with unexpected command id[%d], sq producer: %d, sq consumer: %d, cq consumer: %d\n",
+			  cmd_id, aq->sq.pc, aq->sq.cc, aq->cq.cc);
+		return -EINVAL;
 	}
 
 	comp_ctx->status = EFA_CMD_COMPLETED;
@@ -428,14 +428,17 @@
 
 	if (!test_bit(EFA_AQ_STATE_POLLING_BIT, &aq->state))
 		complete(&comp_ctx->wait_event);
+
+	return 0;
 }
 
 static void efa_com_handle_admin_completion(struct efa_com_admin_queue *aq)
 {
 	struct efa_admin_acq_entry *cqe;
 	u16 queue_size_mask;
-	u16 comp_num = 0;
+	u16 comp_cmds = 0;
 	u8 phase;
+	int err;
 	u16 ci;
 
 	queue_size_mask = aq->depth - 1;
@@ -453,10 +456,12 @@
 		 * phase bit was validated
 		 */
 		dma_rmb();
-		efa_com_handle_single_admin_completion(aq, cqe);
+		err = efa_com_handle_single_admin_completion(aq, cqe);
+		if (!err)
+			comp_cmds++;
 
+		aq->cq.cc++;
 		ci++;
-		comp_num++;
 		if (ci == aq->depth) {
 			ci = 0;
 			phase = !phase;
@@ -465,10 +470,9 @@
 		cqe = &aq->cq.entries[ci];
 	}
 
-	aq->cq.cc += comp_num;
 	aq->cq.phase = phase;
-	aq->sq.cc += comp_num;
-	atomic64_add(comp_num, &aq->stats.completed_cmd);
+	aq->sq.cc += comp_cmds;
+	atomic64_add(comp_cmds, &aq->stats.completed_cmd);
 }
 
 static int efa_com_comp_status_to_errno(u8 comp_status)
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -1540,11 +1540,31 @@
 	return ret;
 }
 
+static enum ib_qp_state query_qp_state(struct erdma_qp *qp)
+{
+	switch (qp->attrs.state) {
+	case ERDMA_QP_STATE_IDLE:
+		return IB_QPS_INIT;
+	case ERDMA_QP_STATE_RTR:
+		return IB_QPS_RTR;
+	case ERDMA_QP_STATE_RTS:
+		return IB_QPS_RTS;
+	case ERDMA_QP_STATE_CLOSING:
+		return IB_QPS_ERR;
+	case ERDMA_QP_STATE_TERMINATE:
+		return IB_QPS_ERR;
+	case ERDMA_QP_STATE_ERROR:
+		return IB_QPS_ERR;
+	default:
+		return IB_QPS_ERR;
+	}
+}
+
 int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
 		   int qp_attr_mask, struct ib_qp_init_attr *qp_init_attr)
 {
-	struct erdma_qp *qp;
 	struct erdma_dev *dev;
+	struct erdma_qp *qp;
 
 	if (ibqp && qp_attr && qp_init_attr) {
 		qp = to_eqp(ibqp);
@@ -1571,6 +1591,9 @@
 
 	qp_init_attr->cap = qp_attr->cap;
 
+	qp_attr->qp_state = query_qp_state(qp);
+	qp_attr->cur_qp_state = query_qp_state(qp);
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -62,8 +62,10 @@
 	int ret = 0;
 	u32 max_sl;
 
-	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 && udata)
-		return -EOPNOTSUPP;
+	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 && udata) {
+		ret = -EOPNOTSUPP;
+		goto err_out;
+	}
 
 	ah->av.port = rdma_ah_get_port_num(ah_attr);
 	ah->av.gid_index = grh->sgid_index;
@@ -82,7 +84,8 @@
 		ibdev_err_ratelimited(&hr_dev->ib_dev,
 				      "failed to set sl, sl (%u) shouldn't be larger than %u.\n",
 				      ah->av.sl, max_sl);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_out;
 	}
 
 	memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_alloc.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_alloc.c
@@ -153,8 +153,7 @@
 	return total;
 }
 
-int hns_roce_get_umem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs,
-			   int buf_cnt, struct ib_umem *umem,
+int hns_roce_get_umem_bufs(dma_addr_t *bufs, int buf_cnt, struct ib_umem *umem,
 			   unsigned int page_shift)
 {
 	struct ib_block_iter biter;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_cq.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_cq.c
@@ -133,14 +133,12 @@
 	struct hns_roce_cq_table *cq_table = &hr_dev->cq_table;
 	struct ib_device *ibdev = &hr_dev->ib_dev;
 	u64 mtts[MTT_MIN_COUNT] = {};
-	dma_addr_t dma_handle;
 	int ret;
 
-	ret = hns_roce_mtr_find(hr_dev, &hr_cq->mtr, 0, mtts, ARRAY_SIZE(mtts),
-				&dma_handle);
-	if (!ret) {
+	ret = hns_roce_mtr_find(hr_dev, &hr_cq->mtr, 0, mtts, ARRAY_SIZE(mtts));
+	if (ret) {
 		ibdev_err(ibdev, "failed to find CQ mtr, ret = %d.\n", ret);
-		return -EINVAL;
+		return ret;
 	}
 
 	/* Get CQC memory HEM(Hardware Entry Memory) table */
@@ -151,20 +149,21 @@
 		return ret;
 	}
 
-	ret = xa_err(xa_store(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL));
+	ret = xa_err(xa_store_irq(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL));
 	if (ret) {
 		ibdev_err(ibdev, "failed to xa_store CQ, ret = %d.\n", ret);
 		goto err_put;
 	}
 
-	ret = hns_roce_create_cqc(hr_dev, hr_cq, mtts, dma_handle);
+	ret = hns_roce_create_cqc(hr_dev, hr_cq, mtts,
+				  hns_roce_get_mtr_ba(&hr_cq->mtr));
 	if (ret)
 		goto err_xa;
 
 	return 0;
 
 err_xa:
-	xa_erase(&cq_table->array, hr_cq->cqn);
+	xa_erase_irq(&cq_table->array, hr_cq->cqn);
 err_put:
 	hns_roce_table_put(hr_dev, &cq_table->table, hr_cq->cqn);
 
@@ -180,10 +179,10 @@
 	ret = hns_roce_destroy_hw_ctx(hr_dev, HNS_ROCE_CMD_DESTROY_CQC,
 				      hr_cq->cqn);
 	if (ret)
-		dev_err(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n", ret,
-			hr_cq->cqn);
+		dev_err_ratelimited(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n",
+				    ret, hr_cq->cqn);
 
-	xa_erase(&cq_table->array, hr_cq->cqn);
+	xa_erase_irq(&cq_table->array, hr_cq->cqn);
 
 	/* Waiting interrupt process procedure carried out */
 	synchronize_irq(hr_dev->eq_table.eq[hr_cq->vector].irq);
@@ -477,13 +476,6 @@
 	struct ib_event event;
 	struct ib_cq *ibcq;
 
-	hr_cq = xa_load(&hr_dev->cq_table.array,
-			cqn & (hr_dev->caps.num_cqs - 1));
-	if (!hr_cq) {
-		dev_warn(dev, "async event for bogus CQ 0x%06x\n", cqn);
-		return;
-	}
-
 	if (event_type != HNS_ROCE_EVENT_TYPE_CQ_ID_INVALID &&
 	    event_type != HNS_ROCE_EVENT_TYPE_CQ_ACCESS_ERROR &&
 	    event_type != HNS_ROCE_EVENT_TYPE_CQ_OVERFLOW) {
@@ -492,7 +484,16 @@
 		return;
 	}
 
-	refcount_inc(&hr_cq->refcount);
+	xa_lock(&hr_dev->cq_table.array);
+	hr_cq = xa_load(&hr_dev->cq_table.array,
+			cqn & (hr_dev->caps.num_cqs - 1));
+	if (hr_cq)
+		refcount_inc(&hr_cq->refcount);
+	xa_unlock(&hr_dev->cq_table.array);
+	if (!hr_cq) {
+		dev_warn(dev, "async event for bogus CQ 0x%06x\n", cqn);
+		return;
+	}
 
 	ibcq = &hr_cq->ib_cq;
 	if (ibcq->event_handler) {
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_debugfs.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_debugfs.c
@@ -5,6 +5,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/device.h>
+#include <linux/pci.h>
 
 #include "hns_roce_device.h"
 
@@ -86,7 +87,7 @@
 {
 	struct hns_roce_dev_debugfs *dbgfs = &hr_dev->dbgfs;
 
-	dbgfs->root = debugfs_create_dir(dev_name(&hr_dev->ib_dev.dev),
+	dbgfs->root = debugfs_create_dir(pci_name(hr_dev->pci_dev),
 					 hns_roce_dbgfs_root);
 
 	create_sw_stat_debugfs(hr_dev, dbgfs->root);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_device.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_device.h
@@ -83,6 +83,7 @@
 #define MR_TYPE_DMA				0x03
 
 #define HNS_ROCE_FRMR_MAX_PA			512
+#define HNS_ROCE_FRMR_ALIGN_SIZE		128
 
 #define PKEY_ID					0xffff
 #define NODE_DESC_SIZE				64
@@ -91,6 +92,8 @@
 /* Configure to HW for PAGE_SIZE larger than 4KB */
 #define PG_SHIFT_OFFSET				(PAGE_SHIFT - 12)
 
+#define ATOMIC_WR_LEN				8
+
 #define HNS_ROCE_IDX_QUE_ENTRY_SZ		4
 #define SRQ_DB_REG				0x230
 
@@ -183,6 +186,9 @@
 #define HNS_HW_PAGE_SHIFT			12
 #define HNS_HW_PAGE_SIZE			(1 << HNS_HW_PAGE_SHIFT)
 
+#define HNS_HW_MAX_PAGE_SHIFT			27
+#define HNS_HW_MAX_PAGE_SIZE			(1 << HNS_HW_MAX_PAGE_SHIFT)
+
 struct hns_roce_uar {
 	u64		pfn;
 	unsigned long	index;
@@ -471,12 +477,6 @@
 	u32 next; /* Next ID to allocate. */
 };
 
-struct hns_roce_idx_table {
-	u32 *spare_idx;
-	u32 head;
-	u32 tail;
-};
-
 struct hns_roce_qp_table {
 	struct hns_roce_hem_table	qp_table;
 	struct hns_roce_hem_table	irrl_table;
@@ -485,7 +485,7 @@
 	struct mutex			scc_mutex;
 	struct hns_roce_bank bank[HNS_ROCE_QP_BANK_NUM];
 	struct mutex bank_mutex;
-	struct hns_roce_idx_table	idx_table;
+	struct xarray			dip_xa;
 };
 
 struct hns_roce_cq_table {
@@ -575,6 +575,7 @@
 
 enum {
 	HNS_ROCE_FLUSH_FLAG = 0,
+	HNS_ROCE_STOP_FLUSH_FLAG = 1,
 };
 
 struct hns_roce_work {
@@ -585,6 +586,13 @@
 	u32 queue_num;
 };
 
+enum hns_roce_cong_type {
+	CONG_TYPE_DCQCN,
+	CONG_TYPE_LDCP,
+	CONG_TYPE_HC3,
+	CONG_TYPE_DIP,
+};
+
 struct hns_roce_qp {
 	struct ib_qp		ibqp;
 	struct hns_roce_wq	rq;
@@ -628,6 +636,9 @@
 	struct list_head	sq_node; /* all send qps are on a list */
 	struct hns_user_mmap_entry *dwqe_mmap_entry;
 	u32			config;
+	enum hns_roce_cong_type	cong_type;
+	spinlock_t flush_lock;
+	struct hns_roce_dip *dip;
 };
 
 struct hns_roce_ib_iboe {
@@ -699,13 +710,6 @@
 	struct hns_roce_eq	*eq;
 };
 
-enum cong_type {
-	CONG_TYPE_DCQCN,
-	CONG_TYPE_LDCP,
-	CONG_TYPE_HC3,
-	CONG_TYPE_DIP,
-};
-
 struct hns_roce_caps {
 	u64		fw_ver;
 	u8		num_ports;
@@ -835,7 +839,7 @@
 	u16		default_aeq_period;
 	u16		default_aeq_arm_st;
 	u16		default_ceq_arm_st;
-	enum cong_type	cong_type;
+	enum hns_roce_cong_type cong_type;
 };
 
 enum hns_roce_device_state {
@@ -912,8 +916,7 @@
 	int (*rereg_write_mtpt)(struct hns_roce_dev *hr_dev,
 				struct hns_roce_mr *mr, int flags,
 				void *mb_buf);
-	int (*frmr_write_mtpt)(struct hns_roce_dev *hr_dev, void *mb_buf,
-			       struct hns_roce_mr *mr);
+	int (*frmr_write_mtpt)(void *mb_buf, struct hns_roce_mr *mr);
 	int (*mw_write_mtpt)(void *mb_buf, struct hns_roce_mw *mw);
 	void (*write_cqc)(struct hns_roce_dev *hr_dev,
 			  struct hns_roce_cq *hr_cq, void *mb_buf, u64 *mtts,
@@ -957,8 +960,6 @@
 	enum hns_roce_device_state state;
 	struct list_head	qp_list; /* list of all qps on this dev */
 	spinlock_t		qp_list_lock; /* protect qp_list */
-	struct list_head	dip_list; /* list of all dest ips on this dev */
-	spinlock_t		dip_list_lock; /* protect dip_list */
 
 	struct list_head        pgdir_list;
 	struct mutex            pgdir_mutex;
@@ -1152,8 +1153,13 @@
 
 /* hns roce hw need current block and next block addr from mtt */
 #define MTT_MIN_COUNT	 2
+static inline dma_addr_t hns_roce_get_mtr_ba(struct hns_roce_mtr *mtr)
+{
+	return mtr->hem_cfg.root_ba;
+}
+
 int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
-		      u32 offset, u64 *mtt_buf, int mtt_max, u64 *base_addr);
+		      u32 offset, u64 *mtt_buf, int mtt_max);
 int hns_roce_mtr_create(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
 			struct hns_roce_buf_attr *buf_attr,
 			unsigned int page_shift, struct ib_udata *udata,
@@ -1211,7 +1217,7 @@
 int hns_roce_get_kmem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs,
 			   int buf_cnt, struct hns_roce_buf *buf,
 			   unsigned int page_shift);
-int hns_roce_get_umem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs,
+int hns_roce_get_umem_bufs(dma_addr_t *bufs,
 			   int buf_cnt, struct ib_umem *umem,
 			   unsigned int page_shift);
 
@@ -1259,6 +1265,7 @@
 void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type);
 void flush_cqe(struct hns_roce_dev *dev, struct hns_roce_qp *qp);
 void hns_roce_qp_event(struct hns_roce_dev *hr_dev, u32 qpn, int event_type);
+void hns_roce_flush_cqe(struct hns_roce_dev *hr_dev, u32 qpn);
 void hns_roce_srq_event(struct hns_roce_dev *hr_dev, u32 srqn, int event_type);
 void hns_roce_handle_device_err(struct hns_roce_dev *hr_dev);
 int hns_roce_init(struct hns_roce_dev *hr_dev);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -337,7 +337,7 @@
 			   struct hns_roce_hem_mhop *mhop,
 			   struct hns_roce_hem_index *index)
 {
-	struct ib_device *ibdev = &hr_dev->ib_dev;
+	struct device *dev = hr_dev->dev;
 	unsigned long mhop_obj = obj;
 	u32 l0_idx, l1_idx, l2_idx;
 	u32 chunk_ba_num;
@@ -368,14 +368,14 @@
 		index->buf = l0_idx;
 		break;
 	default:
-		ibdev_err(ibdev, "table %u not support mhop.hop_num = %u!\n",
-			  table->type, mhop->hop_num);
+		dev_err(dev, "table %u not support mhop.hop_num = %u!\n",
+			table->type, mhop->hop_num);
 		return -EINVAL;
 	}
 
 	if (unlikely(index->buf >= table->num_hem)) {
-		ibdev_err(ibdev, "table %u exceed hem limt idx %llu, max %lu!\n",
-			  table->type, index->buf, table->num_hem);
+		dev_err(dev, "table %u exceed hem limt idx %llu, max %lu!\n",
+			table->type, index->buf, table->num_hem);
 		return -EINVAL;
 	}
 
@@ -487,14 +487,14 @@
 			struct hns_roce_hem_mhop *mhop,
 			struct hns_roce_hem_index *index)
 {
-	struct ib_device *ibdev = &hr_dev->ib_dev;
+	struct device *dev = hr_dev->dev;
 	u32 step_idx;
 	int ret = 0;
 
 	if (index->inited & HEM_INDEX_L0) {
 		ret = hr_dev->hw->set_hem(hr_dev, table, obj, 0);
 		if (ret) {
-			ibdev_err(ibdev, "set HEM step 0 failed!\n");
+			dev_err(dev, "set HEM step 0 failed!\n");
 			goto out;
 		}
 	}
@@ -502,7 +502,7 @@
 	if (index->inited & HEM_INDEX_L1) {
 		ret = hr_dev->hw->set_hem(hr_dev, table, obj, 1);
 		if (ret) {
-			ibdev_err(ibdev, "set HEM step 1 failed!\n");
+			dev_err(dev, "set HEM step 1 failed!\n");
 			goto out;
 		}
 	}
@@ -514,7 +514,7 @@
 			step_idx = mhop->hop_num;
 		ret = hr_dev->hw->set_hem(hr_dev, table, obj, step_idx);
 		if (ret)
-			ibdev_err(ibdev, "set HEM step last failed!\n");
+			dev_err(dev, "set HEM step last failed!\n");
 	}
 out:
 	return ret;
@@ -524,14 +524,14 @@
 				   struct hns_roce_hem_table *table,
 				   unsigned long obj)
 {
-	struct ib_device *ibdev = &hr_dev->ib_dev;
 	struct hns_roce_hem_index index = {};
 	struct hns_roce_hem_mhop mhop = {};
+	struct device *dev = hr_dev->dev;
 	int ret;
 
 	ret = calc_hem_config(hr_dev, table, obj, &mhop, &index);
 	if (ret) {
-		ibdev_err(ibdev, "calc hem config failed!\n");
+		dev_err(dev, "calc hem config failed!\n");
 		return ret;
 	}
 
@@ -543,7 +543,7 @@
 
 	ret = alloc_mhop_hem(hr_dev, table, &mhop, &index);
 	if (ret) {
-		ibdev_err(ibdev, "alloc mhop hem failed!\n");
+		dev_err(dev, "alloc mhop hem failed!\n");
 		goto out;
 	}
 
@@ -551,7 +551,7 @@
 	if (table->type < HEM_TYPE_MTT) {
 		ret = set_mhop_hem(hr_dev, table, obj, &mhop, &index);
 		if (ret) {
-			ibdev_err(ibdev, "set HEM address to HW failed!\n");
+			dev_err(dev, "set HEM address to HW failed!\n");
 			goto err_alloc;
 		}
 	}
@@ -615,7 +615,7 @@
 			   struct hns_roce_hem_mhop *mhop,
 			   struct hns_roce_hem_index *index)
 {
-	struct ib_device *ibdev = &hr_dev->ib_dev;
+	struct device *dev = hr_dev->dev;
 	u32 hop_num = mhop->hop_num;
 	u32 chunk_ba_num;
 	u32 step_idx;
@@ -645,21 +645,21 @@
 
 		ret = hr_dev->hw->clear_hem(hr_dev, table, obj, step_idx);
 		if (ret)
-			ibdev_warn(ibdev, "failed to clear hop%u HEM, ret = %d.\n",
-				   hop_num, ret);
+			dev_warn(dev, "failed to clear hop%u HEM, ret = %d.\n",
+				 hop_num, ret);
 
 		if (index->inited & HEM_INDEX_L1) {
 			ret = hr_dev->hw->clear_hem(hr_dev, table, obj, 1);
 			if (ret)
-				ibdev_warn(ibdev, "failed to clear HEM step 1, ret = %d.\n",
-					   ret);
+				dev_warn(dev, "failed to clear HEM step 1, ret = %d.\n",
+					 ret);
 		}
 
 		if (index->inited & HEM_INDEX_L0) {
 			ret = hr_dev->hw->clear_hem(hr_dev, table, obj, 0);
 			if (ret)
-				ibdev_warn(ibdev, "failed to clear HEM step 0, ret = %d.\n",
-					   ret);
+				dev_warn(dev, "failed to clear HEM step 0, ret = %d.\n",
+					 ret);
 		}
 	}
 }
@@ -669,14 +669,14 @@
 				    unsigned long obj,
 				    int check_refcount)
 {
-	struct ib_device *ibdev = &hr_dev->ib_dev;
 	struct hns_roce_hem_index index = {};
 	struct hns_roce_hem_mhop mhop = {};
+	struct device *dev = hr_dev->dev;
 	int ret;
 
 	ret = calc_hem_config(hr_dev, table, obj, &mhop, &index);
 	if (ret) {
-		ibdev_err(ibdev, "calc hem config failed!\n");
+		dev_err(dev, "calc hem config failed!\n");
 		return;
 	}
 
@@ -712,8 +712,8 @@
 
 	ret = hr_dev->hw->clear_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT);
 	if (ret)
-		dev_warn(dev, "failed to clear HEM base address, ret = %d.\n",
-			 ret);
+		dev_warn_ratelimited(dev, "failed to clear HEM base address, ret = %d.\n",
+				     ret);
 
 	hns_roce_free_hem(hr_dev, table->hem[i]);
 	table->hem[i] = NULL;
@@ -986,6 +986,7 @@
 	size_t count; /* max ba numbers */
 	int start; /* start buf offset in this hem */
 	int end; /* end buf offset in this hem */
+	bool exist_bt;
 };
 
 /* All HEM items are linked in a tree structure */
@@ -1014,6 +1015,7 @@
 		}
 	}
 
+	hem->exist_bt = exist_bt;
 	hem->count = count;
 	hem->start = start;
 	hem->end = end;
@@ -1024,34 +1026,32 @@
 }
 
 static void hem_list_free_item(struct hns_roce_dev *hr_dev,
-			       struct hns_roce_hem_item *hem, bool exist_bt)
+			       struct hns_roce_hem_item *hem)
 {
-	if (exist_bt)
+	if (hem->exist_bt)
 		dma_free_coherent(hr_dev->dev, hem->count * BA_BYTE_LEN,
 				  hem->addr, hem->dma_addr);
 	kfree(hem);
 }
 
 static void hem_list_free_all(struct hns_roce_dev *hr_dev,
-			      struct list_head *head, bool exist_bt)
+			      struct list_head *head)
 {
 	struct hns_roce_hem_item *hem, *temp_hem;
 
 	list_for_each_entry_safe(hem, temp_hem, head, list) {
 		list_del(&hem->list);
-		hem_list_free_item(hr_dev, hem, exist_bt);
+		hem_list_free_item(hr_dev, hem);
 	}
 }
 
-static void hem_list_link_bt(struct hns_roce_dev *hr_dev, void *base_addr,
-			     u64 table_addr)
+static void hem_list_link_bt(void *base_addr, u64 table_addr)
 {
 	*(u64 *)(base_addr) = table_addr;
 }
 
 /* assign L0 table address to hem from root bt */
-static void hem_list_assign_bt(struct hns_roce_dev *hr_dev,
-			       struct hns_roce_hem_item *hem, void *cpu_addr,
+static void hem_list_assign_bt(struct hns_roce_hem_item *hem, void *cpu_addr,
 			       u64 phy_addr)
 {
 	hem->addr = cpu_addr;
@@ -1098,9 +1098,9 @@
  * @bt_level: base address table level
  * @unit: ba entries per bt page
  */
-static u32 hem_list_calc_ba_range(int hopnum, int bt_level, int unit)
+static u64 hem_list_calc_ba_range(int hopnum, int bt_level, int unit)
 {
-	u32 step;
+	u64 step;
 	int max;
 	int i;
 
@@ -1136,11 +1136,15 @@
 {
 	struct hns_roce_buf_region *r;
 	int total = 0;
-	int step;
+	u64 step;
 	int i;
 
 	for (i = 0; i < region_cnt; i++) {
 		r = (struct hns_roce_buf_region *)&regions[i];
+		/* when r->hopnum = 0, the region should not occupy root_ba. */
+		if (!r->hopnum)
+			continue;
+
 		if (r->hopnum > 1) {
 			step = hem_list_calc_ba_range(r->hopnum, 1, unit);
 			if (step > 0)
@@ -1167,7 +1171,7 @@
 	int ret = 0;
 	int max_ofs;
 	int level;
-	u32 step;
+	u64 step;
 	int end;
 
 	if (hopnum <= 1)
@@ -1191,10 +1195,12 @@
 
 	/* config L1 bt to last bt and link them to corresponding parent */
 	for (level = 1; level < hopnum; level++) {
-		cur = hem_list_search_item(&mid_bt[level], offset);
-		if (cur) {
-			hem_ptrs[level] = cur;
-			continue;
+		if (!hem_list_is_bottom_bt(hopnum, level)) {
+			cur = hem_list_search_item(&mid_bt[level], offset);
+			if (cur) {
+				hem_ptrs[level] = cur;
+				continue;
+			}
 		}
 
 		step = hem_list_calc_ba_range(hopnum, level, unit);
@@ -1204,7 +1210,7 @@
 		}
 
 		start_aligned = (distance / step) * step + r->offset;
-		end = min_t(int, start_aligned + step - 1, max_ofs);
+		end = min_t(u64, start_aligned + step - 1, max_ofs);
 		cur = hem_list_alloc_item(hr_dev, start_aligned, end, unit,
 					  true);
 		if (!cur) {
@@ -1220,8 +1226,7 @@
 		if (level > 1) {
 			pre = hem_ptrs[level - 1];
 			step = (cur->start - pre->start) / step * BA_BYTE_LEN;
-			hem_list_link_bt(hr_dev, pre->addr + step,
-					 cur->dma_addr);
+			hem_list_link_bt(pre->addr + step, cur->dma_addr);
 		}
 	}
 
@@ -1233,7 +1238,7 @@
 
 err_exit:
 	for (level = 1; level < hopnum; level++)
-		hem_list_free_all(hr_dev, &temp_list[level], true);
+		hem_list_free_all(hr_dev, &temp_list[level]);
 
 	return ret;
 }
@@ -1274,16 +1279,26 @@
 {
 	struct hns_roce_hem_item *hem;
 
+	/* This is on the has_mtt branch, if r->hopnum
+	 * is 0, there is no root_ba to reuse for the
+	 * region's fake hem, so a dma_alloc request is
+	 * necessary here.
+	 */
 	hem = hem_list_alloc_item(hr_dev, r->offset, r->offset + r->count - 1,
-				  r->count, false);
+				  r->count, !r->hopnum);
 	if (!hem)
 		return -ENOMEM;
 
-	hem_list_assign_bt(hr_dev, hem, cpu_base, phy_base);
+	/* The root_ba can be reused only when r->hopnum > 0. */
+	if (r->hopnum)
+		hem_list_assign_bt(hem, cpu_base, phy_base);
 	list_add(&hem->list, branch_head);
 	list_add(&hem->sibling, leaf_head);
 
-	return r->count;
+	/* If r->hopnum == 0, 0 is returned,
+	 * so that the root_bt entry is not occupied.
+	 */
+	return r->hopnum ? r->count : 0;
 }
 
 static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base,
@@ -1293,7 +1308,7 @@
 	struct hns_roce_hem_item *hem, *temp_hem;
 	int total = 0;
 	int offset;
-	int step;
+	u64 step;
 
 	step = hem_list_calc_ba_range(r->hopnum, 1, unit);
 	if (step < 1)
@@ -1302,7 +1317,7 @@
 	/* if exist mid bt, link L1 to L0 */
 	list_for_each_entry_safe(hem, temp_hem, branch_head, list) {
 		offset = (hem->start - r->offset) / step * BA_BYTE_LEN;
-		hem_list_link_bt(hr_dev, cpu_base + offset, hem->dma_addr);
+		hem_list_link_bt(cpu_base + offset, hem->dma_addr);
 		total++;
 	}
 
@@ -1327,7 +1342,7 @@
 		return -ENOMEM;
 
 	total = 0;
-	for (i = 0; i < region_cnt && total < max_ba_num; i++) {
+	for (i = 0; i < region_cnt && total <= max_ba_num; i++) {
 		r = &regions[i];
 		if (!r->count)
 			continue;
@@ -1393,9 +1408,9 @@
 			     region_cnt);
 	if (ret) {
 		for (i = 0; i < region_cnt; i++)
-			hem_list_free_all(hr_dev, &head.branch[i], false);
+			hem_list_free_all(hr_dev, &head.branch[i]);
 
-		hem_list_free_all(hr_dev, &head.root, true);
+		hem_list_free_all(hr_dev, &head.root);
 	}
 
 	return ret;
@@ -1458,10 +1473,9 @@
 
 	for (i = 0; i < HNS_ROCE_MAX_BT_REGION; i++)
 		for (j = 0; j < HNS_ROCE_MAX_BT_LEVEL; j++)
-			hem_list_free_all(hr_dev, &hem_list->mid_bt[i][j],
-					  j != 0);
+			hem_list_free_all(hr_dev, &hem_list->mid_bt[i][j]);
 
-	hem_list_free_all(hr_dev, &hem_list->root_bt, true);
+	hem_list_free_all(hr_dev, &hem_list->root_bt);
 	INIT_LIST_HEAD(&hem_list->btm_bt);
 	hem_list->root_ba = 0;
 }
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_hem.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_hem.h
@@ -61,16 +61,16 @@
 	 (sizeof(struct scatterlist) + sizeof(void *)))
 
 #define check_whether_bt_num_3(type, hop_num) \
-	(type < HEM_TYPE_MTT && hop_num == 2)
+	((type) < HEM_TYPE_MTT && (hop_num) == 2)
 
 #define check_whether_bt_num_2(type, hop_num) \
-	((type < HEM_TYPE_MTT && hop_num == 1) || \
-	(type >= HEM_TYPE_MTT && hop_num == 2))
+	(((type) < HEM_TYPE_MTT && (hop_num) == 1) || \
+	((type) >= HEM_TYPE_MTT && (hop_num) == 2))
 
 #define check_whether_bt_num_1(type, hop_num) \
-	((type < HEM_TYPE_MTT && hop_num == HNS_ROCE_HOP_NUM_0) || \
-	(type >= HEM_TYPE_MTT && hop_num == 1) || \
-	(type >= HEM_TYPE_MTT && hop_num == HNS_ROCE_HOP_NUM_0))
+	(((type) < HEM_TYPE_MTT && (hop_num) == HNS_ROCE_HOP_NUM_0) || \
+	((type) >= HEM_TYPE_MTT && (hop_num) == 1) || \
+	((type) >= HEM_TYPE_MTT && (hop_num) == HNS_ROCE_HOP_NUM_0))
 
 struct hns_roce_hem_chunk {
 	struct list_head	 list;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -372,19 +372,12 @@
 static int check_send_valid(struct hns_roce_dev *hr_dev,
 			    struct hns_roce_qp *hr_qp)
 {
-	struct ib_device *ibdev = &hr_dev->ib_dev;
-
 	if (unlikely(hr_qp->state == IB_QPS_RESET ||
 		     hr_qp->state == IB_QPS_INIT ||
-		     hr_qp->state == IB_QPS_RTR)) {
-		ibdev_err(ibdev, "failed to post WQE, QP state %u!\n",
-			  hr_qp->state);
+		     hr_qp->state == IB_QPS_RTR))
 		return -EINVAL;
-	} else if (unlikely(hr_dev->state >= HNS_ROCE_DEVICE_STATE_RST_DOWN)) {
-		ibdev_err(ibdev, "failed to post WQE, dev state %d!\n",
-			  hr_dev->state);
+	else if (unlikely(hr_dev->state >= HNS_ROCE_DEVICE_STATE_RST_DOWN))
 		return -EIO;
-	}
 
 	return 0;
 }
@@ -478,7 +471,7 @@
 	valid_num_sge = calc_wr_sge_num(wr, &msg_len);
 
 	ret = set_ud_opcode(ud_sq_wqe, wr);
-	if (WARN_ON(ret))
+	if (WARN_ON_ONCE(ret))
 		return ret;
 
 	ud_sq_wqe->msg_len = cpu_to_le32(msg_len);
@@ -582,10 +575,10 @@
 	rc_sq_wqe->msg_len = cpu_to_le32(msg_len);
 
 	ret = set_rc_opcode(hr_dev, rc_sq_wqe, wr);
-	if (WARN_ON(ret))
+	if (WARN_ON_ONCE(ret))
 		return ret;
 
-	hr_reg_write(rc_sq_wqe, RC_SEND_WQE_FENCE,
+	hr_reg_write(rc_sq_wqe, RC_SEND_WQE_SO,
 		     (wr->send_flags & IB_SEND_FENCE) ? 1 : 0);
 
 	hr_reg_write(rc_sq_wqe, RC_SEND_WQE_SE,
@@ -595,11 +588,16 @@
 		     (wr->send_flags & IB_SEND_SIGNALED) ? 1 : 0);
 
 	if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP ||
-	    wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD)
+	    wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) {
+		if (msg_len != ATOMIC_WR_LEN)
+			return -EINVAL;
 		set_atomic_seg(wr, rc_sq_wqe, valid_num_sge);
-	else if (wr->opcode != IB_WR_REG_MR)
+	} else if (wr->opcode != IB_WR_REG_MR) {
 		ret = set_rwqe_data_seg(&qp->ibqp, wr, rc_sq_wqe,
 					&curr_idx, valid_num_sge);
+		if (ret)
+			return ret;
+	}
 
 	/*
 	 * The pipeline can sequentially post all valid WQEs into WQ buffer,
@@ -675,6 +673,10 @@
 #define HNS_ROCE_SL_SHIFT 2
 	struct hns_roce_v2_rc_send_wqe *rc_sq_wqe = wqe;
 
+	if (unlikely(qp->state == IB_QPS_ERR)) {
+		flush_cqe(hr_dev, qp);
+		return;
+	}
 	/* All kinds of DirectWQE have the same header field layout */
 	hr_reg_enable(rc_sq_wqe, RC_SEND_WQE_FLAG);
 	hr_reg_write(rc_sq_wqe, RC_SEND_WQE_DB_SL_L, qp->sl);
@@ -1273,12 +1275,38 @@
 	return -EIO;
 }
 
+static u32 hns_roce_cmdq_tx_timeout(u16 opcode, u32 tx_timeout)
+{
+	static const struct hns_roce_cmdq_tx_timeout_map cmdq_tx_timeout[] = {
+		{HNS_ROCE_OPC_POST_MB, HNS_ROCE_OPC_POST_MB_TIMEOUT},
+	};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(cmdq_tx_timeout); i++)
+		if (cmdq_tx_timeout[i].opcode == opcode)
+			return cmdq_tx_timeout[i].tx_timeout;
+
+	return tx_timeout;
+}
+
+static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode)
+{
+	struct hns_roce_v2_priv *priv = hr_dev->priv;
+	u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout);
+	u32 timeout = 0;
+
+	do {
+		if (hns_roce_cmq_csq_done(hr_dev))
+			break;
+		udelay(1);
+	} while (++timeout < tx_timeout);
+}
+
 static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev,
 			       struct hns_roce_cmq_desc *desc, int num)
 {
 	struct hns_roce_v2_priv *priv = hr_dev->priv;
 	struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq;
-	u32 timeout = 0;
 	u16 desc_ret;
 	u32 tail;
 	int ret;
@@ -1299,12 +1327,7 @@
 
 	atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_CNT]);
 
-	do {
-		if (hns_roce_cmq_csq_done(hr_dev))
-			break;
-		udelay(1);
-	} while (++timeout < priv->cmq.tx_timeout);
-
+	hns_roce_wait_csq_done(hr_dev, le16_to_cpu(desc->opcode));
 	if (hns_roce_cmq_csq_done(hr_dev)) {
 		ret = 0;
 		for (i = 0; i < num; i++) {
@@ -1658,8 +1681,8 @@
 
 	for (i = 0; i < HNS_ROCE_HW_CNT_TOTAL && i < *num_counters; i++) {
 		bd_idx = i / CNT_PER_DESC;
-		if (!(desc[bd_idx].flag & HNS_ROCE_CMD_FLAG_NEXT) &&
-		    bd_idx != HNS_ROCE_HW_CNT_TOTAL / CNT_PER_DESC)
+		if (bd_idx != HNS_ROCE_HW_CNT_TOTAL / CNT_PER_DESC &&
+		    !(desc[bd_idx].flag & cpu_to_le16(HNS_ROCE_CMD_FLAG_NEXT)))
 			break;
 
 		cnt_data = (__le64 *)&desc[bd_idx].data[0];
@@ -2105,7 +2128,7 @@
 					 caps->gmv_bt_num *
 					 (HNS_HW_PAGE_SIZE / caps->gmv_entry_sz));
 
-		caps->gmv_entry_num = caps->gmv_bt_num * (PAGE_SIZE /
+		caps->gmv_entry_num = caps->gmv_bt_num * (HNS_HW_PAGE_SIZE /
 							  caps->gmv_entry_sz);
 	} else {
 		u32 func_num = max_t(u32, 1, hr_dev->func_num);
@@ -2460,14 +2483,16 @@
 static struct hns_roce_link_table *
 alloc_link_table_buf(struct hns_roce_dev *hr_dev)
 {
+	u16 total_sl = hr_dev->caps.sl_num * hr_dev->func_num;
 	struct hns_roce_v2_priv *priv = hr_dev->priv;
 	struct hns_roce_link_table *link_tbl;
 	u32 pg_shift, size, min_size;
 
 	link_tbl = &priv->ext_llm;
 	pg_shift = hr_dev->caps.llm_buf_pg_sz + PAGE_SHIFT;
-	size = hr_dev->caps.num_qps * HNS_ROCE_V2_EXT_LLM_ENTRY_SZ;
-	min_size = HNS_ROCE_EXT_LLM_MIN_PAGES(hr_dev->caps.sl_num) << pg_shift;
+	size = hr_dev->caps.num_qps * hr_dev->func_num *
+	       HNS_ROCE_V2_EXT_LLM_ENTRY_SZ;
+	min_size = HNS_ROCE_EXT_LLM_MIN_PAGES(total_sl) << pg_shift;
 
 	/* Alloc data table */
 	size = max(size, min_size);
@@ -2534,20 +2559,19 @@
 	free_link_table_buf(hr_dev, &priv->ext_llm);
 }
 
-static void free_dip_list(struct hns_roce_dev *hr_dev)
+static void free_dip_entry(struct hns_roce_dev *hr_dev)
 {
 	struct hns_roce_dip *hr_dip;
-	struct hns_roce_dip *tmp;
-	unsigned long flags;
+	unsigned long idx;
 
-	spin_lock_irqsave(&hr_dev->dip_list_lock, flags);
+	xa_lock(&hr_dev->qp_table.dip_xa);
 
-	list_for_each_entry_safe(hr_dip, tmp, &hr_dev->dip_list, node) {
-		list_del(&hr_dip->node);
+	xa_for_each(&hr_dev->qp_table.dip_xa, idx, hr_dip) {
+		__xa_erase(&hr_dev->qp_table.dip_xa, hr_dip->dip_idx);
 		kfree(hr_dip);
 	}
 
-	spin_unlock_irqrestore(&hr_dev->dip_list_lock, flags);
+	xa_unlock(&hr_dev->qp_table.dip_xa);
 }
 
 static struct ib_pd *free_mr_init_pd(struct hns_roce_dev *hr_dev)
@@ -2747,8 +2771,8 @@
 	ret = hr_dev->hw->modify_qp(&hr_qp->ibqp, attr, mask, IB_QPS_INIT,
 				    IB_QPS_INIT, NULL);
 	if (ret) {
-		ibdev_err(ibdev, "failed to modify qp to init, ret = %d.\n",
-			  ret);
+		ibdev_err_ratelimited(ibdev, "failed to modify qp to init, ret = %d.\n",
+				      ret);
 		return ret;
 	}
 
@@ -2942,13 +2966,16 @@
 
 static void hns_roce_v2_exit(struct hns_roce_dev *hr_dev)
 {
+	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08)
+		free_mr_exit(hr_dev);
+
 	hns_roce_function_clear(hr_dev);
 
 	if (!hr_dev->is_vf)
 		hns_roce_free_link_table(hr_dev);
 
 	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP09)
-		free_dip_list(hr_dev);
+		free_dip_entry(hr_dev);
 }
 
 static int hns_roce_mbox_post(struct hns_roce_dev *hr_dev,
@@ -3195,21 +3222,22 @@
 	u64 pages[HNS_ROCE_V2_MAX_INNER_MTPT_NUM] = { 0 };
 	struct ib_device *ibdev = &hr_dev->ib_dev;
 	dma_addr_t pbl_ba;
-	int i, count;
+	int ret;
+	int i;
 
-	count = hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, pages,
-				  min_t(int, ARRAY_SIZE(pages), mr->npages),
-				  &pbl_ba);
-	if (count < 1) {
-		ibdev_err(ibdev, "failed to find PBL mtr, count = %d.\n",
-			  count);
-		return -ENOBUFS;
+	ret = hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, pages,
+				min_t(int, ARRAY_SIZE(pages), mr->npages));
+	if (ret) {
+		ibdev_err(ibdev, "failed to find PBL mtr, ret = %d.\n", ret);
+		return ret;
 	}
 
 	/* Aligned to the hardware address access unit */
-	for (i = 0; i < count; i++)
+	for (i = 0; i < ARRAY_SIZE(pages); i++)
 		pages[i] >>= 6;
 
+	pbl_ba = hns_roce_get_mtr_ba(&mr->pbl_mtr);
+
 	mpt_entry->pbl_size = cpu_to_le32(mr->npages);
 	mpt_entry->pbl_ba_l = cpu_to_le32(pbl_ba >> 3);
 	hr_reg_write(mpt_entry, MPT_PBL_BA_H, upper_32_bits(pbl_ba >> 3));
@@ -3305,21 +3333,14 @@
 	return ret;
 }
 
-static int hns_roce_v2_frmr_write_mtpt(struct hns_roce_dev *hr_dev,
-				       void *mb_buf, struct hns_roce_mr *mr)
+static int hns_roce_v2_frmr_write_mtpt(void *mb_buf, struct hns_roce_mr *mr)
 {
-	struct ib_device *ibdev = &hr_dev->ib_dev;
+	dma_addr_t pbl_ba = hns_roce_get_mtr_ba(&mr->pbl_mtr);
 	struct hns_roce_v2_mpt_entry *mpt_entry;
-	dma_addr_t pbl_ba = 0;
 
 	mpt_entry = mb_buf;
 	memset(mpt_entry, 0, sizeof(*mpt_entry));
 
-	if (hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, NULL, 0, &pbl_ba) < 0) {
-		ibdev_err(ibdev, "failed to find frmr mtr.\n");
-		return -ENOBUFS;
-	}
-
 	hr_reg_write(mpt_entry, MPT_ST, V2_MPT_ST_FREE);
 	hr_reg_write(mpt_entry, MPT_PD, mr->pd);
 
@@ -3391,8 +3412,8 @@
 
 	ret = hns_roce_v2_post_send(&hr_qp->ibqp, send_wr, &bad_wr);
 	if (ret) {
-		ibdev_err(ibdev, "failed to post wqe for free mr, ret = %d.\n",
-			  ret);
+		ibdev_err_ratelimited(ibdev, "failed to post wqe for free mr, ret = %d.\n",
+				      ret);
 		return ret;
 	}
 
@@ -3431,9 +3452,9 @@
 
 		ret = free_mr_post_send_lp_wqe(hr_qp);
 		if (ret) {
-			ibdev_err(ibdev,
-				  "failed to send wqe (qp:0x%lx) for free mr, ret = %d.\n",
-				  hr_qp->qpn, ret);
+			ibdev_err_ratelimited(ibdev,
+					      "failed to send wqe (qp:0x%lx) for free mr, ret = %d.\n",
+					      hr_qp->qpn, ret);
 			break;
 		}
 
@@ -3444,16 +3465,16 @@
 	while (cqe_cnt) {
 		npolled = hns_roce_v2_poll_cq(&free_mr->rsv_cq->ib_cq, cqe_cnt, wc);
 		if (npolled < 0) {
-			ibdev_err(ibdev,
-				  "failed to poll cqe for free mr, remain %d cqe.\n",
-				  cqe_cnt);
+			ibdev_err_ratelimited(ibdev,
+					      "failed to poll cqe for free mr, remain %d cqe.\n",
+					      cqe_cnt);
 			goto out;
 		}
 
 		if (time_after(jiffies, end)) {
-			ibdev_err(ibdev,
-				  "failed to poll cqe for free mr and timeout, remain %d cqe.\n",
-				  cqe_cnt);
+			ibdev_err_ratelimited(ibdev,
+					      "failed to poll cqe for free mr and timeout, remain %d cqe.\n",
+					      cqe_cnt);
 			goto out;
 		}
 		cqe_cnt -= npolled;
@@ -3715,8 +3736,9 @@
 		   wc->status == IB_WC_WR_FLUSH_ERR))
 		return;
 
-	ibdev_err(&hr_dev->ib_dev, "error cqe status 0x%x:\n", cqe_status);
-	print_hex_dump(KERN_ERR, "", DUMP_PREFIX_NONE, 16, 4, cqe,
+	ibdev_err_ratelimited(&hr_dev->ib_dev, "error cqe status 0x%x:\n",
+			      cqe_status);
+	print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_NONE, 16, 4, cqe,
 		       cq->cqe_size, false);
 	wc->vendor_err = hr_reg_read(cqe, CQE_SUB_STATUS);
 
@@ -4226,8 +4248,7 @@
 }
 
 static void set_qpc_wqe_cnt(struct hns_roce_qp *hr_qp,
-			    struct hns_roce_v2_qp_context *context,
-			    struct hns_roce_v2_qp_context *qpc_mask)
+			    struct hns_roce_v2_qp_context *context)
 {
 	hr_reg_write(context, QPC_SGE_SHIFT,
 		     to_hr_hem_entries_shift(hr_qp->sge.sge_cnt,
@@ -4249,7 +4270,6 @@
 }
 
 static void modify_qp_reset_to_init(struct ib_qp *ibqp,
-				    const struct ib_qp_attr *attr,
 				    struct hns_roce_v2_qp_context *context,
 				    struct hns_roce_v2_qp_context *qpc_mask)
 {
@@ -4268,7 +4288,7 @@
 
 	hr_reg_write(context, QPC_RQWS, ilog2(hr_qp->rq.max_gs));
 
-	set_qpc_wqe_cnt(hr_qp, context, qpc_mask);
+	set_qpc_wqe_cnt(hr_qp, context);
 
 	/* No VLAN need to set 0xFFF */
 	hr_reg_write(context, QPC_VLAN_ID, 0xfff);
@@ -4309,7 +4329,6 @@
 }
 
 static void modify_qp_init_to_init(struct ib_qp *ibqp,
-				   const struct ib_qp_attr *attr,
 				   struct hns_roce_v2_qp_context *context,
 				   struct hns_roce_v2_qp_context *qpc_mask)
 {
@@ -4346,17 +4365,20 @@
 {
 	u64 mtts[MTT_MIN_COUNT] = { 0 };
 	u64 wqe_sge_ba;
-	int count;
+	int ret;
 
 	/* Search qp buf's mtts */
-	count = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, hr_qp->rq.offset, mtts,
-				  MTT_MIN_COUNT, &wqe_sge_ba);
-	if (hr_qp->rq.wqe_cnt && count < 1) {
+	ret = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, hr_qp->rq.offset, mtts,
+				MTT_MIN_COUNT);
+	if (hr_qp->rq.wqe_cnt && ret) {
 		ibdev_err(&hr_dev->ib_dev,
-			  "failed to find RQ WQE, QPN = 0x%lx.\n", hr_qp->qpn);
-		return -EINVAL;
+			  "failed to find QP(0x%lx) RQ WQE buf, ret = %d.\n",
+			  hr_qp->qpn, ret);
+		return ret;
 	}
 
+	wqe_sge_ba = hns_roce_get_mtr_ba(&hr_qp->mtr);
+
 	context->wqe_sge_ba = cpu_to_le32(wqe_sge_ba >> 3);
 	qpc_mask->wqe_sge_ba = 0;
 
@@ -4400,12 +4422,14 @@
 		     upper_32_bits(to_hr_hw_page_addr(mtts[0])));
 	hr_reg_clear(qpc_mask, QPC_RQ_CUR_BLK_ADDR_H);
 
-	context->rq_nxt_blk_addr = cpu_to_le32(to_hr_hw_page_addr(mtts[1]));
-	qpc_mask->rq_nxt_blk_addr = 0;
-
-	hr_reg_write(context, QPC_RQ_NXT_BLK_ADDR_H,
-		     upper_32_bits(to_hr_hw_page_addr(mtts[1])));
-	hr_reg_clear(qpc_mask, QPC_RQ_NXT_BLK_ADDR_H);
+	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) {
+		context->rq_nxt_blk_addr =
+				cpu_to_le32(to_hr_hw_page_addr(mtts[1]));
+		qpc_mask->rq_nxt_blk_addr = 0;
+		hr_reg_write(context, QPC_RQ_NXT_BLK_ADDR_H,
+			     upper_32_bits(to_hr_hw_page_addr(mtts[1])));
+		hr_reg_clear(qpc_mask, QPC_RQ_NXT_BLK_ADDR_H);
+	}
 
 	return 0;
 }
@@ -4418,23 +4442,23 @@
 	struct ib_device *ibdev = &hr_dev->ib_dev;
 	u64 sge_cur_blk = 0;
 	u64 sq_cur_blk = 0;
-	int count;
+	int ret;
 
 	/* search qp buf's mtts */
-	count = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, 0, &sq_cur_blk, 1, NULL);
-	if (count < 1) {
-		ibdev_err(ibdev, "failed to find QP(0x%lx) SQ buf.\n",
-			  hr_qp->qpn);
-		return -EINVAL;
+	ret = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, hr_qp->sq.offset,
+				&sq_cur_blk, 1);
+	if (ret) {
+		ibdev_err(ibdev, "failed to find QP(0x%lx) SQ WQE buf, ret = %d.\n",
+			  hr_qp->qpn, ret);
+		return ret;
 	}
 	if (hr_qp->sge.sge_cnt > 0) {
-		count = hns_roce_mtr_find(hr_dev, &hr_qp->mtr,
-					  hr_qp->sge.offset,
-					  &sge_cur_blk, 1, NULL);
-		if (count < 1) {
-			ibdev_err(ibdev, "failed to find QP(0x%lx) SGE buf.\n",
-				  hr_qp->qpn);
-			return -EINVAL;
+		ret = hns_roce_mtr_find(hr_dev, &hr_qp->mtr,
+					hr_qp->sge.offset, &sge_cur_blk, 1);
+		if (ret) {
+			ibdev_err(ibdev, "failed to find QP(0x%lx) SGE buf, ret = %d.\n",
+				  hr_qp->qpn, ret);
+			return ret;
 		}
 	}
 
@@ -4625,8 +4649,7 @@
 	return 0;
 }
 
-static int modify_qp_rtr_to_rts(struct ib_qp *ibqp,
-				const struct ib_qp_attr *attr, int attr_mask,
+static int modify_qp_rtr_to_rts(struct ib_qp *ibqp, int attr_mask,
 				struct hns_roce_v2_qp_context *context,
 				struct hns_roce_v2_qp_context *qpc_mask)
 {
@@ -4673,26 +4696,49 @@
 	return 0;
 }
 
+static int alloc_dip_entry(struct xarray *dip_xa, u32 qpn)
+{
+	struct hns_roce_dip *hr_dip;
+	int ret;
+
+	hr_dip = xa_load(dip_xa, qpn);
+	if (hr_dip)
+		return 0;
+
+	hr_dip = kzalloc(sizeof(*hr_dip), GFP_KERNEL);
+	if (!hr_dip)
+		return -ENOMEM;
+
+	ret = xa_err(xa_store(dip_xa, qpn, hr_dip, GFP_KERNEL));
+	if (ret)
+		kfree(hr_dip);
+
+	return ret;
+}
+
 static int get_dip_ctx_idx(struct ib_qp *ibqp, const struct ib_qp_attr *attr,
 			   u32 *dip_idx)
 {
 	const struct ib_global_route *grh = rdma_ah_read_grh(&attr->ah_attr);
 	struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
-	u32 *spare_idx = hr_dev->qp_table.idx_table.spare_idx;
-	u32 *head =  &hr_dev->qp_table.idx_table.head;
-	u32 *tail =  &hr_dev->qp_table.idx_table.tail;
+	struct xarray *dip_xa = &hr_dev->qp_table.dip_xa;
+	struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
 	struct hns_roce_dip *hr_dip;
-	unsigned long flags;
+	unsigned long idx;
 	int ret = 0;
 
-	spin_lock_irqsave(&hr_dev->dip_list_lock, flags);
+	ret = alloc_dip_entry(dip_xa, ibqp->qp_num);
+	if (ret)
+		return ret;
 
-	spare_idx[*tail] = ibqp->qp_num;
-	*tail = (*tail == hr_dev->caps.num_qps - 1) ? 0 : (*tail + 1);
+	xa_lock(dip_xa);
 
-	list_for_each_entry(hr_dip, &hr_dev->dip_list, node) {
-		if (!memcmp(grh->dgid.raw, hr_dip->dgid, 16)) {
+	xa_for_each(dip_xa, idx, hr_dip) {
+		if (hr_dip->qp_cnt &&
+		    !memcmp(grh->dgid.raw, hr_dip->dgid, 16)) {
 			*dip_idx = hr_dip->dip_idx;
+			hr_dip->qp_cnt++;
+			hr_qp->dip = hr_dip;
 			goto out;
 		}
 	}
@@ -4700,19 +4746,24 @@
 	/* If no dgid is found, a new dip and a mapping between dgid and
 	 * dip_idx will be created.
 	 */
-	hr_dip = kzalloc(sizeof(*hr_dip), GFP_ATOMIC);
-	if (!hr_dip) {
-		ret = -ENOMEM;
-		goto out;
+	xa_for_each(dip_xa, idx, hr_dip) {
+		if (hr_dip->qp_cnt)
+			continue;
+
+		*dip_idx = idx;
+		memcpy(hr_dip->dgid, grh->dgid.raw, sizeof(grh->dgid.raw));
+		hr_dip->dip_idx = idx;
+		hr_dip->qp_cnt++;
+		hr_qp->dip = hr_dip;
+		break;
 	}
 
-	memcpy(hr_dip->dgid, grh->dgid.raw, sizeof(grh->dgid.raw));
-	hr_dip->dip_idx = *dip_idx = spare_idx[*head];
-	*head = (*head == hr_dev->caps.num_qps - 1) ? 0 : (*head + 1);
-	list_add_tail(&hr_dip->node, &hr_dev->dip_list);
+	/* This should never happen. */
+	if (WARN_ON_ONCE(!hr_qp->dip))
+		ret = -ENOSPC;
 
 out:
-	spin_unlock_irqrestore(&hr_dev->dip_list_lock, flags);
+	xa_unlock(dip_xa);
 	return ret;
 }
 
@@ -4745,12 +4796,15 @@
 			   struct hns_roce_congestion_algorithm *cong_alg)
 {
 	struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
+	struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
 
-	if (ibqp->qp_type == IB_QPT_UD)
-		hr_dev->caps.cong_type = CONG_TYPE_DCQCN;
+	if (ibqp->qp_type == IB_QPT_UD || ibqp->qp_type == IB_QPT_GSI)
+		hr_qp->cong_type = CONG_TYPE_DCQCN;
+	else
+		hr_qp->cong_type = hr_dev->caps.cong_type;
 
 	/* different congestion types match different configurations */
-	switch (hr_dev->caps.cong_type) {
+	switch (hr_qp->cong_type) {
 	case CONG_TYPE_DCQCN:
 		cong_alg->alg_sel = CONG_DCQCN;
 		cong_alg->alg_sub_sel = UNSUPPORT_CONG_LEVEL;
@@ -4778,8 +4832,8 @@
 	default:
 		ibdev_warn(&hr_dev->ib_dev,
 			   "invalid type(%u) for congestion selection.\n",
-			   hr_dev->caps.cong_type);
-		hr_dev->caps.cong_type = CONG_TYPE_DCQCN;
+			   hr_qp->cong_type);
+		hr_qp->cong_type = CONG_TYPE_DCQCN;
 		cong_alg->alg_sel = CONG_DCQCN;
 		cong_alg->alg_sub_sel = UNSUPPORT_CONG_LEVEL;
 		cong_alg->dip_vld = DIP_INVALID;
@@ -4798,6 +4852,7 @@
 	struct hns_roce_congestion_algorithm cong_field;
 	struct ib_device *ibdev = ibqp->device;
 	struct hns_roce_dev *hr_dev = to_hr_dev(ibdev);
+	struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
 	u32 dip_idx = 0;
 	int ret;
 
@@ -4810,7 +4865,7 @@
 		return ret;
 
 	hr_reg_write(context, QPC_CONG_ALGO_TMPL_ID, hr_dev->cong_algo_tmpl_id +
-		     hr_dev->caps.cong_type * HNS_ROCE_CONG_SIZE);
+		     hr_qp->cong_type * HNS_ROCE_CONG_SIZE);
 	hr_reg_clear(qpc_mask, QPC_CONG_ALGO_TMPL_ID);
 	hr_reg_write(&context->ext, QPCEX_CONG_ALG_SEL, cong_field.alg_sel);
 	hr_reg_clear(&qpc_mask->ext, QPCEX_CONG_ALG_SEL);
@@ -4986,22 +5041,19 @@
 	struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
 	int ret = 0;
 
-	if (!check_qp_state(cur_state, new_state)) {
-		ibdev_err(&hr_dev->ib_dev, "Illegal state for QP!\n");
+	if (!check_qp_state(cur_state, new_state))
 		return -EINVAL;
-	}
 
 	if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
 		memset(qpc_mask, 0, hr_dev->caps.qpc_sz);
-		modify_qp_reset_to_init(ibqp, attr, context, qpc_mask);
+		modify_qp_reset_to_init(ibqp, context, qpc_mask);
 	} else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_INIT) {
-		modify_qp_init_to_init(ibqp, attr, context, qpc_mask);
+		modify_qp_init_to_init(ibqp, context, qpc_mask);
 	} else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_RTR) {
 		ret = modify_qp_init_to_rtr(ibqp, attr, attr_mask, context,
 					    qpc_mask, udata);
 	} else if (cur_state == IB_QPS_RTR && new_state == IB_QPS_RTS) {
-		ret = modify_qp_rtr_to_rts(ibqp, attr, attr_mask, context,
-					   qpc_mask);
+		ret = modify_qp_rtr_to_rts(ibqp, attr_mask, context, qpc_mask);
 	}
 
 	return ret;
@@ -5251,7 +5303,7 @@
 	/* SW pass context to HW */
 	ret = hns_roce_v2_qp_modify(hr_dev, context, qpc_mask, hr_qp);
 	if (ret) {
-		ibdev_err(ibdev, "failed to modify QP, ret = %d.\n", ret);
+		ibdev_err_ratelimited(ibdev, "failed to modify QP, ret = %d.\n", ret);
 		goto out;
 	}
 
@@ -5365,7 +5417,9 @@
 
 	ret = hns_roce_v2_query_qpc(hr_dev, hr_qp->qpn, &context);
 	if (ret) {
-		ibdev_err(ibdev, "failed to query QPC, ret = %d.\n", ret);
+		ibdev_err_ratelimited(ibdev,
+				      "failed to query QPC, ret = %d.\n",
+				      ret);
 		ret = -EINVAL;
 		goto out;
 	}
@@ -5373,7 +5427,7 @@
 	state = hr_reg_read(&context, QPC_QP_ST);
 	tmp_qp_state = to_ib_qp_st((enum hns_roce_v2_qp_state)state);
 	if (tmp_qp_state == -1) {
-		ibdev_err(ibdev, "Illegal ib_qp_state\n");
+		ibdev_err_ratelimited(ibdev, "Illegal ib_qp_state\n");
 		ret = -EINVAL;
 		goto out;
 	}
@@ -5466,9 +5520,9 @@
 		ret = hns_roce_v2_modify_qp(&hr_qp->ibqp, NULL, 0,
 					    hr_qp->state, IB_QPS_RESET, udata);
 		if (ret)
-			ibdev_err(ibdev,
-				  "failed to modify QP to RST, ret = %d.\n",
-				  ret);
+			ibdev_err_ratelimited(ibdev,
+					      "failed to modify QP to RST, ret = %d.\n",
+					      ret);
 	}
 
 	send_cq = hr_qp->ibqp.send_cq ? to_hr_cq(hr_qp->ibqp.send_cq) : NULL;
@@ -5496,17 +5550,44 @@
 	return ret;
 }
 
+static void put_dip_ctx_idx(struct hns_roce_dev *hr_dev,
+			    struct hns_roce_qp *hr_qp)
+{
+	struct hns_roce_dip *hr_dip = hr_qp->dip;
+
+	if (!hr_dip)
+		return;
+
+	xa_lock(&hr_dev->qp_table.dip_xa);
+
+	hr_dip->qp_cnt--;
+	if (!hr_dip->qp_cnt)
+		memset(hr_dip->dgid, 0, GID_LEN_V2);
+
+	xa_unlock(&hr_dev->qp_table.dip_xa);
+}
+
 int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
 {
 	struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
 	struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
+	unsigned long flags;
 	int ret;
 
+	/* Make sure flush_cqe() is completed */
+	spin_lock_irqsave(&hr_qp->flush_lock, flags);
+	set_bit(HNS_ROCE_STOP_FLUSH_FLAG, &hr_qp->flush_flag);
+	spin_unlock_irqrestore(&hr_qp->flush_lock, flags);
+	flush_work(&hr_qp->flush_work.work);
+
+	if (hr_qp->cong_type == CONG_TYPE_DIP)
+		put_dip_ctx_idx(hr_dev, hr_qp);
+
 	ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, udata);
 	if (ret)
-		ibdev_err(&hr_dev->ib_dev,
-			  "failed to destroy QP, QPN = 0x%06lx, ret = %d.\n",
-			  hr_qp->qpn, ret);
+		ibdev_err_ratelimited(&hr_dev->ib_dev,
+				      "failed to destroy QP, QPN = 0x%06lx, ret = %d.\n",
+				      hr_qp->qpn, ret);
 
 	hns_roce_qp_destroy(hr_dev, hr_qp, udata);
 
@@ -5581,18 +5662,20 @@
 	struct ib_device *ibdev = srq->ibsrq.device;
 	struct hns_roce_dev *hr_dev = to_hr_dev(ibdev);
 	u64 mtts_idx[MTT_MIN_COUNT] = {};
-	dma_addr_t dma_handle_idx = 0;
+	dma_addr_t dma_handle_idx;
 	int ret;
 
 	/* Get physical address of idx que buf */
 	ret = hns_roce_mtr_find(hr_dev, &idx_que->mtr, 0, mtts_idx,
-				ARRAY_SIZE(mtts_idx), &dma_handle_idx);
-	if (ret < 1) {
+				ARRAY_SIZE(mtts_idx));
+	if (ret) {
 		ibdev_err(ibdev, "failed to find mtr for SRQ idx, ret = %d.\n",
 			  ret);
-		return -ENOBUFS;
+		return ret;
 	}
 
+	dma_handle_idx = hns_roce_get_mtr_ba(&idx_que->mtr);
+
 	hr_reg_write(ctx, SRQC_IDX_HOP_NUM,
 		     to_hr_hem_hopnum(hr_dev->caps.idx_hop_num, srq->wqe_cnt));
 
@@ -5624,20 +5707,22 @@
 	struct hns_roce_dev *hr_dev = to_hr_dev(ibdev);
 	struct hns_roce_srq_context *ctx = mb_buf;
 	u64 mtts_wqe[MTT_MIN_COUNT] = {};
-	dma_addr_t dma_handle_wqe = 0;
+	dma_addr_t dma_handle_wqe;
 	int ret;
 
 	memset(ctx, 0, sizeof(*ctx));
 
 	/* Get the physical address of srq buf */
 	ret = hns_roce_mtr_find(hr_dev, &srq->buf_mtr, 0, mtts_wqe,
-				ARRAY_SIZE(mtts_wqe), &dma_handle_wqe);
-	if (ret < 1) {
+				ARRAY_SIZE(mtts_wqe));
+	if (ret) {
 		ibdev_err(ibdev, "failed to find mtr for SRQ WQE, ret = %d.\n",
 			  ret);
-		return -ENOBUFS;
+		return ret;
 	}
 
+	dma_handle_wqe = hns_roce_get_mtr_ba(&srq->buf_mtr);
+
 	hr_reg_write(ctx, SRQC_SRQ_ST, 1);
 	hr_reg_write_bool(ctx, SRQC_SRQ_TYPE,
 			  srq->ibsrq.srq_type == IB_SRQT_XRC);
@@ -5796,9 +5881,9 @@
 				HNS_ROCE_CMD_MODIFY_CQC, hr_cq->cqn);
 	hns_roce_free_cmd_mailbox(hr_dev, mailbox);
 	if (ret)
-		ibdev_err(&hr_dev->ib_dev,
-			  "failed to process cmd when modifying CQ, ret = %d.\n",
-			  ret);
+		ibdev_err_ratelimited(&hr_dev->ib_dev,
+				      "failed to process cmd when modifying CQ, ret = %d.\n",
+				      ret);
 
 err_out:
 	if (ret)
@@ -5822,9 +5907,9 @@
 	ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma,
 				HNS_ROCE_CMD_QUERY_CQC, cqn);
 	if (ret) {
-		ibdev_err(&hr_dev->ib_dev,
-			  "failed to process cmd when querying CQ, ret = %d.\n",
-			  ret);
+		ibdev_err_ratelimited(&hr_dev->ib_dev,
+				      "failed to process cmd when querying CQ, ret = %d.\n",
+				      ret);
 		goto err_mailbox;
 	}
 
@@ -5865,11 +5950,10 @@
 	return ret;
 }
 
-static void hns_roce_irq_work_handle(struct work_struct *work)
+static void dump_aeqe_log(struct hns_roce_work *irq_work)
 {
-	struct hns_roce_work *irq_work =
-				container_of(work, struct hns_roce_work, work);
-	struct ib_device *ibdev = &irq_work->hr_dev->ib_dev;
+	struct hns_roce_dev *hr_dev = irq_work->hr_dev;
+	struct ib_device *ibdev = &hr_dev->ib_dev;
 
 	switch (irq_work->event_type) {
 	case HNS_ROCE_EVENT_TYPE_PATH_MIG:
@@ -5913,6 +5997,8 @@
 	case HNS_ROCE_EVENT_TYPE_DB_OVERFLOW:
 		ibdev_warn(ibdev, "DB overflow.\n");
 		break;
+	case HNS_ROCE_EVENT_TYPE_MB:
+		break;
 	case HNS_ROCE_EVENT_TYPE_FLR:
 		ibdev_warn(ibdev, "function level reset.\n");
 		break;
@@ -5923,8 +6009,46 @@
 		ibdev_err(ibdev, "invalid xrceth error.\n");
 		break;
 	default:
+		ibdev_info(ibdev, "Undefined event %d.\n",
+			   irq_work->event_type);
 		break;
 	}
+}
+
+static void hns_roce_irq_work_handle(struct work_struct *work)
+{
+	struct hns_roce_work *irq_work =
+				container_of(work, struct hns_roce_work, work);
+	struct hns_roce_dev *hr_dev = irq_work->hr_dev;
+	int event_type = irq_work->event_type;
+	u32 queue_num = irq_work->queue_num;
+
+	switch (event_type) {
+	case HNS_ROCE_EVENT_TYPE_PATH_MIG:
+	case HNS_ROCE_EVENT_TYPE_PATH_MIG_FAILED:
+	case HNS_ROCE_EVENT_TYPE_COMM_EST:
+	case HNS_ROCE_EVENT_TYPE_SQ_DRAINED:
+	case HNS_ROCE_EVENT_TYPE_WQ_CATAS_ERROR:
+	case HNS_ROCE_EVENT_TYPE_SRQ_LAST_WQE_REACH:
+	case HNS_ROCE_EVENT_TYPE_INV_REQ_LOCAL_WQ_ERROR:
+	case HNS_ROCE_EVENT_TYPE_LOCAL_WQ_ACCESS_ERROR:
+	case HNS_ROCE_EVENT_TYPE_XRCD_VIOLATION:
+	case HNS_ROCE_EVENT_TYPE_INVALID_XRCETH:
+		hns_roce_qp_event(hr_dev, queue_num, event_type);
+		break;
+	case HNS_ROCE_EVENT_TYPE_SRQ_LIMIT_REACH:
+	case HNS_ROCE_EVENT_TYPE_SRQ_CATAS_ERROR:
+		hns_roce_srq_event(hr_dev, queue_num, event_type);
+		break;
+	case HNS_ROCE_EVENT_TYPE_CQ_ACCESS_ERROR:
+	case HNS_ROCE_EVENT_TYPE_CQ_OVERFLOW:
+		hns_roce_cq_event(hr_dev, queue_num, event_type);
+		break;
+	default:
+		break;
+	}
+
+	dump_aeqe_log(irq_work);
 
 	kfree(irq_work);
 }
@@ -5985,14 +6109,14 @@
 static irqreturn_t hns_roce_v2_aeq_int(struct hns_roce_dev *hr_dev,
 				       struct hns_roce_eq *eq)
 {
-	struct device *dev = hr_dev->dev;
 	struct hns_roce_aeqe *aeqe = next_aeqe_sw_v2(eq);
 	irqreturn_t aeqe_found = IRQ_NONE;
+	int num_aeqes = 0;
 	int event_type;
 	u32 queue_num;
 	int sub_type;
 
-	while (aeqe) {
+	while (aeqe && num_aeqes < HNS_AEQ_POLLING_BUDGET) {
 		/* Make sure we read AEQ entry after we have checked the
 		 * ownership bit
 		 */
@@ -6003,25 +6127,12 @@
 		queue_num = hr_reg_read(aeqe, AEQE_EVENT_QUEUE_NUM);
 
 		switch (event_type) {
-		case HNS_ROCE_EVENT_TYPE_PATH_MIG:
-		case HNS_ROCE_EVENT_TYPE_PATH_MIG_FAILED:
-		case HNS_ROCE_EVENT_TYPE_COMM_EST:
-		case HNS_ROCE_EVENT_TYPE_SQ_DRAINED:
 		case HNS_ROCE_EVENT_TYPE_WQ_CATAS_ERROR:
-		case HNS_ROCE_EVENT_TYPE_SRQ_LAST_WQE_REACH:
 		case HNS_ROCE_EVENT_TYPE_INV_REQ_LOCAL_WQ_ERROR:
 		case HNS_ROCE_EVENT_TYPE_LOCAL_WQ_ACCESS_ERROR:
 		case HNS_ROCE_EVENT_TYPE_XRCD_VIOLATION:
 		case HNS_ROCE_EVENT_TYPE_INVALID_XRCETH:
-			hns_roce_qp_event(hr_dev, queue_num, event_type);
-			break;
-		case HNS_ROCE_EVENT_TYPE_SRQ_LIMIT_REACH:
-		case HNS_ROCE_EVENT_TYPE_SRQ_CATAS_ERROR:
-			hns_roce_srq_event(hr_dev, queue_num, event_type);
-			break;
-		case HNS_ROCE_EVENT_TYPE_CQ_ACCESS_ERROR:
-		case HNS_ROCE_EVENT_TYPE_CQ_OVERFLOW:
-			hns_roce_cq_event(hr_dev, queue_num, event_type);
+			hns_roce_flush_cqe(hr_dev, queue_num);
 			break;
 		case HNS_ROCE_EVENT_TYPE_MB:
 			hns_roce_cmd_event(hr_dev,
@@ -6029,12 +6140,7 @@
 					aeqe->event.cmd.status,
 					le64_to_cpu(aeqe->event.cmd.out_param));
 			break;
-		case HNS_ROCE_EVENT_TYPE_DB_OVERFLOW:
-		case HNS_ROCE_EVENT_TYPE_FLR:
-			break;
 		default:
-			dev_err(dev, "unhandled event %d on EQ %d at idx %u.\n",
-				event_type, eq->eqn, eq->cons_index);
 			break;
 		}
 
@@ -6048,6 +6154,7 @@
 		hns_roce_v2_init_irq_work(hr_dev, eq, queue_num);
 
 		aeqe = next_aeqe_sw_v2(eq);
+		++num_aeqes;
 	}
 
 	update_eq_db(eq);
@@ -6118,6 +6225,7 @@
 	struct pci_dev *pdev = hr_dev->pci_dev;
 	struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev);
 	const struct hnae3_ae_ops *ops = ae_dev->ops;
+	enum hnae3_reset_type reset_type;
 	irqreturn_t int_work = IRQ_NONE;
 	u32 int_en;
 
@@ -6129,10 +6237,12 @@
 		roce_write(hr_dev, ROCEE_VF_ABN_INT_ST_REG,
 			   1 << HNS_ROCE_V2_VF_INT_ST_AEQ_OVERFLOW_S);
 
+		reset_type = hr_dev->is_vf ?
+			     HNAE3_VF_FUNC_RESET : HNAE3_FUNC_RESET;
+
 		/* Set reset level for reset_event() */
 		if (ops->set_default_reset_request)
-			ops->set_default_reset_request(ae_dev,
-						       HNAE3_FUNC_RESET);
+			ops->set_default_reset_request(ae_dev, reset_type);
 		if (ops->reset_event)
 			ops->reset_event(pdev, NULL);
 
@@ -6202,7 +6312,7 @@
 	    res_type == ECC_RESOURCE_SCCC)
 		return le64_to_cpu(*data);
 
-	return le64_to_cpu(*data) << PAGE_SHIFT;
+	return le64_to_cpu(*data) << HNS_HW_PAGE_SHIFT;
 }
 
 static int fmea_recover_others(struct hns_roce_dev *hr_dev, u32 res_type,
@@ -6316,9 +6426,16 @@
 	roce_write(hr_dev, ROCEE_VF_ABN_INT_CFG_REG, enable_flag);
 }
 
-static void hns_roce_v2_destroy_eqc(struct hns_roce_dev *hr_dev, u32 eqn)
+static void free_eq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq)
+{
+	hns_roce_mtr_destroy(hr_dev, &eq->mtr);
+}
+
+static void hns_roce_v2_destroy_eqc(struct hns_roce_dev *hr_dev,
+				    struct hns_roce_eq *eq)
 {
 	struct device *dev = hr_dev->dev;
+	int eqn = eq->eqn;
 	int ret;
 	u8 cmd;
 
@@ -6329,12 +6446,9 @@
 
 	ret = hns_roce_destroy_hw_ctx(hr_dev, cmd, eqn & HNS_ROCE_V2_EQN_M);
 	if (ret)
-		dev_err(dev, "[mailbox cmd] destroy eqc(%u) failed.\n", eqn);
-}
+		dev_err(dev, "[mailbox cmd] destroy eqc(%d) failed.\n", eqn);
 
-static void free_eq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq)
-{
-	hns_roce_mtr_destroy(hr_dev, &eq->mtr);
+	free_eq_buf(hr_dev, eq);
 }
 
 static void init_eq_config(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq)
@@ -6353,7 +6467,7 @@
 	u64 eqe_ba[MTT_MIN_COUNT] = { 0 };
 	struct hns_roce_eq_context *eqc;
 	u64 bt_ba = 0;
-	int count;
+	int ret;
 
 	eqc = mb_buf;
 	memset(eqc, 0, sizeof(struct hns_roce_eq_context));
@@ -6361,13 +6475,15 @@
 	init_eq_config(hr_dev, eq);
 
 	/* if not multi-hop, eqe buffer only use one trunk */
-	count = hns_roce_mtr_find(hr_dev, &eq->mtr, 0, eqe_ba, MTT_MIN_COUNT,
-				  &bt_ba);
-	if (count < 1) {
-		dev_err(hr_dev->dev, "failed to find EQE mtr\n");
-		return -ENOBUFS;
+	ret = hns_roce_mtr_find(hr_dev, &eq->mtr, 0, eqe_ba,
+				ARRAY_SIZE(eqe_ba));
+	if (ret) {
+		dev_err(hr_dev->dev, "failed to find EQE mtr, ret = %d\n", ret);
+		return ret;
 	}
 
+	bt_ba = hns_roce_get_mtr_ba(&eq->mtr);
+
 	hr_reg_write(eqc, EQC_EQ_ST, HNS_ROCE_V2_EQ_STATE_VALID);
 	hr_reg_write(eqc, EQC_EQE_HOP_NUM, eq->hop_num);
 	hr_reg_write(eqc, EQC_OVER_IGNORE, eq->over_ignore);
@@ -6572,6 +6688,9 @@
 	int ret;
 	int i;
 
+	if (hr_dev->caps.aeqe_depth < HNS_AEQ_POLLING_BUDGET)
+		return -EINVAL;
+
 	other_num = hr_dev->caps.num_other_vectors;
 	comp_num = hr_dev->caps.num_comp_vectors;
 	aeq_num = hr_dev->caps.num_aeq_vectors;
@@ -6641,7 +6760,7 @@
 
 err_create_eq_fail:
 	for (i -= 1; i >= 0; i--)
-		free_eq_buf(hr_dev, &eq_table->eq[i]);
+		hns_roce_v2_destroy_eqc(hr_dev, &eq_table->eq[i]);
 	kfree(eq_table->eq);
 
 	return ret;
@@ -6661,11 +6780,8 @@
 	__hns_roce_free_irq(hr_dev);
 	destroy_workqueue(hr_dev->irq_workq);
 
-	for (i = 0; i < eq_num; i++) {
-		hns_roce_v2_destroy_eqc(hr_dev, i);
-
-		free_eq_buf(hr_dev, &eq_table->eq[i]);
-	}
+	for (i = 0; i < eq_num; i++)
+		hns_roce_v2_destroy_eqc(hr_dev, &eq_table->eq[i]);
 
 	kfree(eq_table->eq);
 }
@@ -6831,9 +6947,6 @@
 	hr_dev->state = HNS_ROCE_DEVICE_STATE_UNINIT;
 	hns_roce_handle_device_err(hr_dev);
 
-	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08)
-		free_mr_exit(hr_dev);
-
 	hns_roce_exit(hr_dev);
 	kfree(hr_dev->priv);
 	ib_dealloc_device(&hr_dev->ib_dev);
@@ -6894,6 +7007,7 @@
 
 	handle->rinfo.instance_state = HNS_ROCE_STATE_NON_INIT;
 }
+
 static int hns_roce_hw_v2_reset_notify_down(struct hnae3_handle *handle)
 {
 	struct hns_roce_dev *hr_dev;
@@ -6912,6 +7026,9 @@
 
 	hr_dev->active = false;
 	hr_dev->dis_db = true;
+
+	rdma_user_mmap_disassociate(&hr_dev->ib_dev);
+
 	hr_dev->state = HNS_ROCE_DEVICE_STATE_RST_DOWN;
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
@@ -85,6 +85,11 @@
 
 #define HNS_ROCE_V2_TABLE_CHUNK_SIZE		(1 << 18)
 
+/* budget must be smaller than aeqe_depth to guarantee that we update
+ * the ci before we polled all the entries in the EQ.
+ */
+#define HNS_AEQ_POLLING_BUDGET 64
+
 enum {
 	HNS_ROCE_CMD_FLAG_IN = BIT(0),
 	HNS_ROCE_CMD_FLAG_OUT = BIT(1),
@@ -224,6 +229,12 @@
 	HNS_SWITCH_PARAMETER_CFG			= 0x1033,
 };
 
+#define HNS_ROCE_OPC_POST_MB_TIMEOUT 35000
+struct hns_roce_cmdq_tx_timeout_map {
+	u16 opcode;
+	u32 tx_timeout;
+};
+
 enum {
 	TYPE_CRQ,
 	TYPE_CSQ,
@@ -894,6 +905,7 @@
 #define RC_SEND_WQE_OWNER RC_SEND_WQE_FIELD_LOC(7, 7)
 #define RC_SEND_WQE_CQE RC_SEND_WQE_FIELD_LOC(8, 8)
 #define RC_SEND_WQE_FENCE RC_SEND_WQE_FIELD_LOC(9, 9)
+#define RC_SEND_WQE_SO RC_SEND_WQE_FIELD_LOC(10, 10)
 #define RC_SEND_WQE_SE RC_SEND_WQE_FIELD_LOC(11, 11)
 #define RC_SEND_WQE_INLINE RC_SEND_WQE_FIELD_LOC(12, 12)
 #define RC_SEND_WQE_WQE_INDEX RC_SEND_WQE_FIELD_LOC(30, 15)
@@ -1316,7 +1328,7 @@
 struct hns_roce_dip {
 	u8 dgid[GID_LEN_V2];
 	u32 dip_idx;
-	struct list_head node; /* all dips are on a list */
+	u32 qp_cnt;
 };
 
 struct fmea_ram_ecc {
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_main.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_main.c
@@ -37,6 +37,7 @@
 #include <rdma/ib_smi.h>
 #include <rdma/ib_user_verbs.h>
 #include <rdma/ib_cache.h>
+#include "hnae3.h"
 #include "hns_roce_common.h"
 #include "hns_roce_device.h"
 #include "hns_roce_hem.h"
@@ -448,6 +449,11 @@
 	pgprot_t prot;
 	int ret;
 
+	if (hr_dev->dis_db) {
+		atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_MMAP_ERR_CNT]);
+		return -EPERM;
+	}
+
 	rdma_entry = rdma_user_mmap_entry_get_pgoff(uctx, vma->vm_pgoff);
 	if (!rdma_entry) {
 		atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_MMAP_ERR_CNT]);
@@ -1099,8 +1105,6 @@
 
 	INIT_LIST_HEAD(&hr_dev->qp_list);
 	spin_lock_init(&hr_dev->qp_list_lock);
-	INIT_LIST_HEAD(&hr_dev->dip_list);
-	spin_lock_init(&hr_dev->dip_list_lock);
 
 	ret = hns_roce_register_device(hr_dev);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_mr.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_mr.c
@@ -130,8 +130,8 @@
 					      key_to_hw_index(mr->key) &
 					      (hr_dev->caps.num_mtpts - 1));
 		if (ret)
-			ibdev_warn(ibdev, "failed to destroy mpt, ret = %d.\n",
-				   ret);
+			ibdev_warn_ratelimited(ibdev, "failed to destroy mpt, ret = %d.\n",
+					       ret);
 	}
 
 	free_mr_pbl(hr_dev, mr);
@@ -154,7 +154,7 @@
 	if (mr->type != MR_TYPE_FRMR)
 		ret = hr_dev->hw->write_mtpt(hr_dev, mailbox->buf, mr);
 	else
-		ret = hr_dev->hw->frmr_write_mtpt(hr_dev, mailbox->buf, mr);
+		ret = hr_dev->hw->frmr_write_mtpt(mailbox->buf, mr);
 	if (ret) {
 		dev_err(dev, "failed to write mtpt, ret = %d.\n", ret);
 		goto err_page;
@@ -427,24 +427,30 @@
 }
 
 int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,
-		       unsigned int *sg_offset)
+		       unsigned int *sg_offset_p)
 {
+	unsigned int sg_offset = sg_offset_p ? *sg_offset_p : 0;
 	struct hns_roce_dev *hr_dev = to_hr_dev(ibmr->device);
 	struct ib_device *ibdev = &hr_dev->ib_dev;
 	struct hns_roce_mr *mr = to_hr_mr(ibmr);
 	struct hns_roce_mtr *mtr = &mr->pbl_mtr;
-	int ret = 0;
+	int ret, sg_num = 0;
+
+	if (!IS_ALIGNED(sg_offset, HNS_ROCE_FRMR_ALIGN_SIZE) ||
+	    ibmr->page_size < HNS_HW_PAGE_SIZE ||
+	    ibmr->page_size > HNS_HW_MAX_PAGE_SIZE)
+		return sg_num;
 
 	mr->npages = 0;
 	mr->page_list = kvcalloc(mr->pbl_mtr.hem_cfg.buf_pg_count,
 				 sizeof(dma_addr_t), GFP_KERNEL);
 	if (!mr->page_list)
-		return ret;
+		return sg_num;
 
-	ret = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, hns_roce_set_page);
-	if (ret < 1) {
+	sg_num = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset_p, hns_roce_set_page);
+	if (sg_num < 1) {
 		ibdev_err(ibdev, "failed to store sg pages %u %u, cnt = %d.\n",
-			  mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, ret);
+			  mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, sg_num);
 		goto err_page_list;
 	}
 
@@ -455,17 +461,16 @@
 	ret = hns_roce_mtr_map(hr_dev, mtr, mr->page_list, mr->npages);
 	if (ret) {
 		ibdev_err(ibdev, "failed to map sg mtr, ret = %d.\n", ret);
-		ret = 0;
+		sg_num = 0;
 	} else {
 		mr->pbl_mtr.hem_cfg.buf_pg_shift = (u32)ilog2(ibmr->page_size);
-		ret = mr->npages;
 	}
 
 err_page_list:
 	kvfree(mr->page_list);
 	mr->page_list = NULL;
 
-	return ret;
+	return sg_num;
 }
 
 static void hns_roce_mw_free(struct hns_roce_dev *hr_dev,
@@ -721,7 +726,7 @@
 		return -ENOMEM;
 
 	if (mtr->umem)
-		npage = hns_roce_get_umem_bufs(hr_dev, pages, page_count,
+		npage = hns_roce_get_umem_bufs(pages, page_count,
 					       mtr->umem, page_shift);
 	else
 		npage = hns_roce_get_kmem_bufs(hr_dev, pages, page_count,
@@ -774,11 +779,6 @@
 	for (i = 0, mapped_cnt = 0; i < mtr->hem_cfg.region_count &&
 	     mapped_cnt < page_cnt; i++) {
 		r = &mtr->hem_cfg.region[i];
-		/* if hopnum is 0, no need to map pages in this region */
-		if (!r->hopnum) {
-			mapped_cnt += r->count;
-			continue;
-		}
 
 		if (r->offset + r->count > page_cnt) {
 			ret = -EINVAL;
@@ -809,47 +809,53 @@
 	return ret;
 }
 
-int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
-		      u32 offset, u64 *mtt_buf, int mtt_max, u64 *base_addr)
+static int hns_roce_get_direct_addr_mtt(struct hns_roce_hem_cfg *cfg,
+					u32 start_index, u64 *mtt_buf,
+					int mtt_cnt)
 {
-	struct hns_roce_hem_cfg *cfg = &mtr->hem_cfg;
-	int mtt_count, left;
-	u32 start_index;
+	int mtt_count;
 	int total = 0;
-	__le64 *mtts;
 	u32 npage;
 	u64 addr;
 
-	if (!mtt_buf || mtt_max < 1)
-		goto done;
+	if (mtt_cnt > cfg->region_count)
+		return -EINVAL;
 
-	/* no mtt memory in direct mode, so just return the buffer address */
-	if (cfg->is_direct) {
-		start_index = offset >> HNS_HW_PAGE_SHIFT;
-		for (mtt_count = 0; mtt_count < cfg->region_count &&
-		     total < mtt_max; mtt_count++) {
-			npage = cfg->region[mtt_count].offset;
-			if (npage < start_index)
-				continue;
+	for (mtt_count = 0; mtt_count < cfg->region_count && total < mtt_cnt;
+	     mtt_count++) {
+		npage = cfg->region[mtt_count].offset;
+		if (npage < start_index)
+			continue;
 
-			addr = cfg->root_ba + (npage << HNS_HW_PAGE_SHIFT);
-			mtt_buf[total] = addr;
+		addr = cfg->root_ba + (npage << HNS_HW_PAGE_SHIFT);
+		mtt_buf[total] = addr;
 
-			total++;
-		}
-
-		goto done;
+		total++;
 	}
 
-	start_index = offset >> cfg->buf_pg_shift;
-	left = mtt_max;
+	if (!total)
+		return -ENOENT;
+
+	return 0;
+}
+
+static int hns_roce_get_mhop_mtt(struct hns_roce_dev *hr_dev,
+				 struct hns_roce_mtr *mtr, u32 start_index,
+				 u64 *mtt_buf, int mtt_cnt)
+{
+	int left = mtt_cnt;
+	int total = 0;
+	int mtt_count;
+	__le64 *mtts;
+	u32 npage;
+
 	while (left > 0) {
 		mtt_count = 0;
 		mtts = hns_roce_hem_list_find_mtt(hr_dev, &mtr->hem_list,
 						  start_index + total,
 						  &mtt_count);
 		if (!mtts || !mtt_count)
-			goto done;
+			break;
 
 		npage = min(mtt_count, left);
 		left -= npage;
@@ -857,11 +863,33 @@
 			mtt_buf[total++] = le64_to_cpu(mtts[mtt_count]);
 	}
 
-done:
-	if (base_addr)
-		*base_addr = cfg->root_ba;
+	if (!total)
+		return -ENOENT;
+
+	return 0;
+}
+
+int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
+		      u32 offset, u64 *mtt_buf, int mtt_max)
+{
+	struct hns_roce_hem_cfg *cfg = &mtr->hem_cfg;
+	u32 start_index;
+	int ret;
+
+	if (!mtt_buf || mtt_max < 1)
+		return -EINVAL;
 
-	return total;
+	/* no mtt memory in direct mode, so just return the buffer address */
+	if (cfg->is_direct) {
+		start_index = offset >> HNS_HW_PAGE_SHIFT;
+		ret = hns_roce_get_direct_addr_mtt(cfg, start_index,
+						   mtt_buf, mtt_max);
+	} else {
+		start_index = offset >> cfg->buf_pg_shift;
+		ret = hns_roce_get_mhop_mtt(hr_dev, mtr, start_index,
+					    mtt_buf, mtt_max);
+	}
+	return ret;
 }
 
 static int mtr_init_buf_cfg(struct hns_roce_dev *hr_dev,
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -39,6 +39,25 @@
 #include "hns_roce_device.h"
 #include "hns_roce_hem.h"
 
+static struct hns_roce_qp *hns_roce_qp_lookup(struct hns_roce_dev *hr_dev,
+					      u32 qpn)
+{
+	struct device *dev = hr_dev->dev;
+	struct hns_roce_qp *qp;
+	unsigned long flags;
+
+	xa_lock_irqsave(&hr_dev->qp_table_xa, flags);
+	qp = __hns_roce_qp_lookup(hr_dev, qpn);
+	if (qp)
+		refcount_inc(&qp->refcount);
+	xa_unlock_irqrestore(&hr_dev->qp_table_xa, flags);
+
+	if (!qp)
+		dev_warn(dev, "async event for bogus QP %08x\n", qpn);
+
+	return qp;
+}
+
 static void flush_work_handle(struct work_struct *work)
 {
 	struct hns_roce_work *flush_work = container_of(work,
@@ -71,11 +90,18 @@
 void init_flush_work(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
 {
 	struct hns_roce_work *flush_work = &hr_qp->flush_work;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hr_qp->flush_lock, flags);
+	/* Exit directly after destroy_qp() */
+	if (test_bit(HNS_ROCE_STOP_FLUSH_FLAG, &hr_qp->flush_flag)) {
+		spin_unlock_irqrestore(&hr_qp->flush_lock, flags);
+		return;
+	}
 
-	flush_work->hr_dev = hr_dev;
-	INIT_WORK(&flush_work->work, flush_work_handle);
 	refcount_inc(&hr_qp->refcount);
 	queue_work(hr_dev->irq_workq, &flush_work->work);
+	spin_unlock_irqrestore(&hr_qp->flush_lock, flags);
 }
 
 void flush_cqe(struct hns_roce_dev *dev, struct hns_roce_qp *qp)
@@ -95,31 +121,28 @@
 
 void hns_roce_qp_event(struct hns_roce_dev *hr_dev, u32 qpn, int event_type)
 {
-	struct device *dev = hr_dev->dev;
 	struct hns_roce_qp *qp;
 
-	xa_lock(&hr_dev->qp_table_xa);
-	qp = __hns_roce_qp_lookup(hr_dev, qpn);
-	if (qp)
-		refcount_inc(&qp->refcount);
-	xa_unlock(&hr_dev->qp_table_xa);
-
-	if (!qp) {
-		dev_warn(dev, "async event for bogus QP %08x\n", qpn);
+	qp = hns_roce_qp_lookup(hr_dev, qpn);
+	if (!qp)
 		return;
-	}
 
-	if (event_type == HNS_ROCE_EVENT_TYPE_WQ_CATAS_ERROR ||
-	    event_type == HNS_ROCE_EVENT_TYPE_INV_REQ_LOCAL_WQ_ERROR ||
-	    event_type == HNS_ROCE_EVENT_TYPE_LOCAL_WQ_ACCESS_ERROR ||
-	    event_type == HNS_ROCE_EVENT_TYPE_XRCD_VIOLATION ||
-	    event_type == HNS_ROCE_EVENT_TYPE_INVALID_XRCETH) {
-		qp->state = IB_QPS_ERR;
+	qp->event(qp, (enum hns_roce_event)event_type);
 
-		flush_cqe(hr_dev, qp);
-	}
+	if (refcount_dec_and_test(&qp->refcount))
+		complete(&qp->free);
+}
 
-	qp->event(qp, (enum hns_roce_event)event_type);
+void hns_roce_flush_cqe(struct hns_roce_dev *hr_dev, u32 qpn)
+{
+	struct hns_roce_qp *qp;
+
+	qp = hns_roce_qp_lookup(hr_dev, qpn);
+	if (!qp)
+		return;
+
+	qp->state = IB_QPS_ERR;
+	flush_cqe(hr_dev, qp);
 
 	if (refcount_dec_and_test(&qp->refcount))
 		complete(&qp->free);
@@ -531,13 +554,15 @@
 {
 	unsigned int inline_sge;
 
-	inline_sge = roundup_pow_of_two(max_inline_data) / HNS_ROCE_SGE_SIZE;
+	if (!max_inline_data)
+		return 0;
 
 	/*
 	 * if max_inline_data less than
 	 * HNS_ROCE_SGE_IN_WQE * HNS_ROCE_SGE_SIZE,
 	 * In addition to ud's mode, no need to extend sge.
 	 */
+	inline_sge = roundup_pow_of_two(max_inline_data) / HNS_ROCE_SGE_SIZE;
 	if (!is_ud_or_gsi && inline_sge <= HNS_ROCE_SGE_IN_WQE)
 		inline_sge = 0;
 
@@ -1057,11 +1082,11 @@
 }
 
 static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
-				     struct ib_pd *ib_pd,
 				     struct ib_qp_init_attr *init_attr,
 				     struct ib_udata *udata,
 				     struct hns_roce_qp *hr_qp)
 {
+	struct hns_roce_work *flush_work = &hr_qp->flush_work;
 	struct hns_roce_ib_create_qp_resp resp = {};
 	struct ib_device *ibdev = &hr_dev->ib_dev;
 	struct hns_roce_ib_create_qp ucmd = {};
@@ -1070,9 +1095,12 @@
 	mutex_init(&hr_qp->mutex);
 	spin_lock_init(&hr_qp->sq.lock);
 	spin_lock_init(&hr_qp->rq.lock);
+	spin_lock_init(&hr_qp->flush_lock);
 
 	hr_qp->state = IB_QPS_RESET;
 	hr_qp->flush_flag = 0;
+	flush_work->hr_dev = hr_dev;
+	INIT_WORK(&flush_work->work, flush_work_handle);
 
 	if (init_attr->create_flags)
 		return -EOPNOTSUPP;
@@ -1211,7 +1239,6 @@
 	struct ib_device *ibdev = qp->device;
 	struct hns_roce_dev *hr_dev = to_hr_dev(ibdev);
 	struct hns_roce_qp *hr_qp = to_hr_qp(qp);
-	struct ib_pd *pd = qp->pd;
 	int ret;
 
 	ret = check_qp_type(hr_dev, init_attr->qp_type, !!udata);
@@ -1226,7 +1253,7 @@
 		hr_qp->phy_port = hr_dev->iboe.phy_port[hr_qp->port];
 	}
 
-	ret = hns_roce_create_qp_common(hr_dev, pd, init_attr, udata, hr_qp);
+	ret = hns_roce_create_qp_common(hr_dev, init_attr, udata, hr_qp);
 	if (ret)
 		ibdev_err(ibdev, "create QP type 0x%x failed(%d)\n",
 			  init_attr->qp_type, ret);
@@ -1383,19 +1410,19 @@
 		__acquire(&send_cq->lock);
 		__acquire(&recv_cq->lock);
 	} else if (unlikely(send_cq != NULL && recv_cq == NULL)) {
-		spin_lock_irq(&send_cq->lock);
+		spin_lock(&send_cq->lock);
 		__acquire(&recv_cq->lock);
 	} else if (unlikely(send_cq == NULL && recv_cq != NULL)) {
-		spin_lock_irq(&recv_cq->lock);
+		spin_lock(&recv_cq->lock);
 		__acquire(&send_cq->lock);
 	} else if (send_cq == recv_cq) {
-		spin_lock_irq(&send_cq->lock);
+		spin_lock(&send_cq->lock);
 		__acquire(&recv_cq->lock);
 	} else if (send_cq->cqn < recv_cq->cqn) {
-		spin_lock_irq(&send_cq->lock);
+		spin_lock(&send_cq->lock);
 		spin_lock_nested(&recv_cq->lock, SINGLE_DEPTH_NESTING);
 	} else {
-		spin_lock_irq(&recv_cq->lock);
+		spin_lock(&recv_cq->lock);
 		spin_lock_nested(&send_cq->lock, SINGLE_DEPTH_NESTING);
 	}
 }
@@ -1415,13 +1442,13 @@
 		spin_unlock(&recv_cq->lock);
 	} else if (send_cq == recv_cq) {
 		__release(&recv_cq->lock);
-		spin_unlock_irq(&send_cq->lock);
+		spin_unlock(&send_cq->lock);
 	} else if (send_cq->cqn < recv_cq->cqn) {
 		spin_unlock(&recv_cq->lock);
-		spin_unlock_irq(&send_cq->lock);
+		spin_unlock(&send_cq->lock);
 	} else {
 		spin_unlock(&send_cq->lock);
-		spin_unlock_irq(&recv_cq->lock);
+		spin_unlock(&recv_cq->lock);
 	}
 }
 
@@ -1469,14 +1496,10 @@
 	unsigned int reserved_from_bot;
 	unsigned int i;
 
-	qp_table->idx_table.spare_idx = kcalloc(hr_dev->caps.num_qps,
-					sizeof(u32), GFP_KERNEL);
-	if (!qp_table->idx_table.spare_idx)
-		return -ENOMEM;
-
 	mutex_init(&qp_table->scc_mutex);
 	mutex_init(&qp_table->bank_mutex);
 	xa_init(&hr_dev->qp_table_xa);
+	xa_init(&qp_table->dip_xa);
 
 	reserved_from_bot = hr_dev->caps.reserved_qps;
 
@@ -1501,5 +1524,5 @@
 
 	for (i = 0; i < HNS_ROCE_QP_BANK_NUM; i++)
 		ida_destroy(&hr_dev->qp_table.bank[i].ida);
-	kfree(hr_dev->qp_table.idx_table.spare_idx);
+	xa_destroy(&hr_dev->qp_table.dip_xa);
 }
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/hns/hns_roce_srq.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/hns/hns_roce_srq.c
@@ -123,7 +123,7 @@
 		return ret;
 	}
 
-	ret = xa_err(xa_store(&srq_table->xa, srq->srqn, srq, GFP_KERNEL));
+	ret = xa_err(xa_store_irq(&srq_table->xa, srq->srqn, srq, GFP_KERNEL));
 	if (ret) {
 		ibdev_err(ibdev, "failed to store SRQC, ret = %d.\n", ret);
 		goto err_put;
@@ -136,7 +136,7 @@
 	return 0;
 
 err_xa:
-	xa_erase(&srq_table->xa, srq->srqn);
+	xa_erase_irq(&srq_table->xa, srq->srqn);
 err_put:
 	hns_roce_table_put(hr_dev, &srq_table->table, srq->srqn);
 
@@ -151,10 +151,10 @@
 	ret = hns_roce_destroy_hw_ctx(hr_dev, HNS_ROCE_CMD_DESTROY_SRQ,
 				      srq->srqn);
 	if (ret)
-		dev_err(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n",
-			ret, srq->srqn);
+		dev_err_ratelimited(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n",
+				    ret, srq->srqn);
 
-	xa_erase(&srq_table->xa, srq->srqn);
+	xa_erase_irq(&srq_table->xa, srq->srqn);
 
 	if (refcount_dec_and_test(&srq->refcount))
 		complete(&srq->free);
@@ -250,7 +250,7 @@
 	hns_roce_mtr_destroy(hr_dev, &srq->buf_mtr);
 }
 
-static int alloc_srq_wrid(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq)
+static int alloc_srq_wrid(struct hns_roce_srq *srq)
 {
 	srq->wrid = kvmalloc_array(srq->wqe_cnt, sizeof(u64), GFP_KERNEL);
 	if (!srq->wrid)
@@ -297,7 +297,7 @@
 
 	max_sge = proc_srq_sge(hr_dev, srq, !!udata);
 	if (attr->max_wr > hr_dev->caps.max_srq_wrs ||
-	    attr->max_sge > max_sge) {
+	    attr->max_sge > max_sge || !attr->max_sge) {
 		ibdev_err(&hr_dev->ib_dev,
 			  "invalid SRQ attr, depth = %u, sge = %u.\n",
 			  attr->max_wr, attr->max_sge);
@@ -366,7 +366,7 @@
 		goto err_idx;
 
 	if (!udata) {
-		ret = alloc_srq_wrid(hr_dev, srq);
+		ret = alloc_srq_wrid(srq);
 		if (ret)
 			goto err_wqe_buf;
 	}
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/irdma/cm.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/irdma/cm.c
@@ -3630,7 +3630,7 @@
 /**
  * irdma_accept - registered call for connection to be accepted
  * @cm_id: cm information for passive connection
- * @conn_param: accpet parameters
+ * @conn_param: accept parameters
  */
 int irdma_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 {
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/irdma/verbs.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/irdma/verbs.c
@@ -719,7 +719,6 @@
 		info->rq_pa + (ukinfo->rq_depth * IRDMA_QP_WQE_MIN_SIZE);
 	ukinfo->sq_size = ukinfo->sq_depth >> ukinfo->sq_shift;
 	ukinfo->rq_size = ukinfo->rq_depth >> ukinfo->rq_shift;
-	ukinfo->qp_id = iwqp->ibqp.qp_num;
 
 	iwqp->max_send_wr = (ukinfo->sq_depth - IRDMA_SQ_RSVD) >> ukinfo->sq_shift;
 	iwqp->max_recv_wr = (ukinfo->rq_depth - IRDMA_RQ_RSVD) >> ukinfo->rq_shift;
@@ -944,7 +943,7 @@
 	iwqp->host_ctx.size = IRDMA_QP_CTX_SIZE;
 
 	init_info.pd = &iwpd->sc_pd;
-	init_info.qp_uk_init_info.qp_id = iwqp->ibqp.qp_num;
+	init_info.qp_uk_init_info.qp_id = qp_num;
 	if (!rdma_protocol_roce(&iwdev->ibdev, 1))
 		init_info.qp_uk_init_info.first_sq_wq = 1;
 	iwqp->ctx_info.qp_compl_ctx = (uintptr_t)qp;
@@ -1348,7 +1347,7 @@
 		if (attr->max_dest_rd_atomic > dev->hw_attrs.max_hw_ird) {
 			ibdev_err(&iwdev->ibdev,
 				  "rd_atomic = %d, above max_hw_ird=%d\n",
-				   attr->max_rd_atomic,
+				   attr->max_dest_rd_atomic,
 				   dev->hw_attrs.max_hw_ird);
 			return -EINVAL;
 		}
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mana/cq.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mana/cq.c
@@ -16,7 +16,7 @@
 	int err;
 
 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
-	gc = mdev->gdma_dev->gdma_context;
+	gc = mdev_to_gc(mdev);
 
 	if (udata->inlen < sizeof(ucmd))
 		return -EINVAL;
@@ -39,37 +39,13 @@
 	}
 
 	cq->cqe = attr->cqe;
-	cq->umem = ib_umem_get(ibdev, ucmd.buf_addr, cq->cqe * COMP_ENTRY_SIZE,
-			       IB_ACCESS_LOCAL_WRITE);
-	if (IS_ERR(cq->umem)) {
-		err = PTR_ERR(cq->umem);
-		ibdev_dbg(ibdev, "Failed to get umem for create cq, err %d\n",
-			  err);
-		return err;
-	}
-
-	err = mana_ib_gd_create_dma_region(mdev, cq->umem, &cq->gdma_region);
+	err = mana_ib_create_queue(mdev, ucmd.buf_addr, cq->cqe * COMP_ENTRY_SIZE, &cq->queue);
 	if (err) {
-		ibdev_dbg(ibdev,
-			  "Failed to create dma region for create cq, %d\n",
-			  err);
-		goto err_release_umem;
+		ibdev_dbg(ibdev, "Failed to create queue for create cq, %d\n", err);
+		return err;
 	}
 
-	ibdev_dbg(ibdev,
-		  "mana_ib_gd_create_dma_region ret %d gdma_region 0x%llx\n",
-		  err, cq->gdma_region);
-
-	/*
-	 * The CQ ID is not known at this time. The ID is generated at create_qp
-	 */
-	cq->id = INVALID_QUEUE_ID;
-
 	return 0;
-
-err_release_umem:
-	ib_umem_release(cq->umem);
-	return err;
 }
 
 int mana_ib_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
@@ -78,32 +54,45 @@
 	struct ib_device *ibdev = ibcq->device;
 	struct mana_ib_dev *mdev;
 	struct gdma_context *gc;
-	int err;
 
 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
-	gc = mdev->gdma_dev->gdma_context;
+	gc = mdev_to_gc(mdev);
 
-	err = mana_ib_gd_destroy_dma_region(mdev, cq->gdma_region);
-	if (err) {
-		ibdev_dbg(ibdev,
-			  "Failed to destroy dma region, %d\n", err);
-		return err;
-	}
-
-	if (cq->id != INVALID_QUEUE_ID) {
-		kfree(gc->cq_table[cq->id]);
-		gc->cq_table[cq->id] = NULL;
+	if (cq->queue.id != INVALID_QUEUE_ID) {
+		kfree(gc->cq_table[cq->queue.id]);
+		gc->cq_table[cq->queue.id] = NULL;
 	}
 
-	ib_umem_release(cq->umem);
+	mana_ib_destroy_queue(mdev, &cq->queue);
 
 	return 0;
 }
 
-void mana_ib_cq_handler(void *ctx, struct gdma_queue *gdma_cq)
+static void mana_ib_cq_handler(void *ctx, struct gdma_queue *gdma_cq)
 {
 	struct mana_ib_cq *cq = ctx;
 
 	if (cq->ibcq.comp_handler)
 		cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
 }
+
+int mana_ib_install_cq_cb(struct mana_ib_dev *mdev, struct mana_ib_cq *cq)
+{
+	struct gdma_context *gc = mdev_to_gc(mdev);
+	struct gdma_queue *gdma_cq;
+
+	if (cq->queue.id >= gc->max_num_cqs)
+		return -EINVAL;
+	/* Create CQ table entry */
+	WARN_ON(gc->cq_table[cq->queue.id]);
+	gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
+	if (!gdma_cq)
+		return -ENOMEM;
+
+	gdma_cq->cq.context = cq;
+	gdma_cq->type = GDMA_CQ;
+	gdma_cq->cq.callback = mana_ib_cq_handler;
+	gdma_cq->id = cq->queue.id;
+	gc->cq_table[cq->queue.id] = gdma_cq;
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mana/device.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mana/device.c
@@ -51,6 +51,7 @@
 {
 	struct mana_adev *madev = container_of(adev, struct mana_adev, adev);
 	struct gdma_dev *mdev = madev->mdev;
+	struct net_device *upper_ndev;
 	struct mana_context *mc;
 	struct mana_ib_dev *dev;
 	int ret;
@@ -77,6 +78,20 @@
 	dev->ib_dev.num_comp_vectors = 1;
 	dev->ib_dev.dev.parent = mdev->gdma_context->dev;
 
+	rcu_read_lock(); /* required to get upper dev */
+	upper_ndev = netdev_master_upper_dev_get_rcu(mc->ports[0]);
+	if (!upper_ndev) {
+		rcu_read_unlock();
+		ibdev_err(&dev->ib_dev, "Failed to get master netdev");
+		goto free_ib_device;
+	}
+	ret = ib_device_set_netdev(&dev->ib_dev, upper_ndev, 1);
+	rcu_read_unlock();
+	if (ret) {
+		ibdev_err(&dev->ib_dev, "Failed to set ib netdev, ret %d", ret);
+		goto free_ib_device;
+	}
+
 	ret = mana_gd_register_device(&mdev->gdma_context->mana_ib);
 	if (ret) {
 		ibdev_err(&dev->ib_dev, "Failed to register device, ret %d",
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mana/main.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mana/main.c
@@ -8,13 +8,10 @@
 void mana_ib_uncfg_vport(struct mana_ib_dev *dev, struct mana_ib_pd *pd,
 			 u32 port)
 {
-	struct gdma_dev *gd = &dev->gdma_dev->gdma_context->mana;
 	struct mana_port_context *mpc;
 	struct net_device *ndev;
-	struct mana_context *mc;
 
-	mc = gd->driver_data;
-	ndev = mc->ports[port];
+	ndev = mana_ib_get_netdev(&dev->ib_dev, port);
 	mpc = netdev_priv(ndev);
 
 	mutex_lock(&pd->vport_mutex);
@@ -31,14 +28,11 @@
 int mana_ib_cfg_vport(struct mana_ib_dev *dev, u32 port, struct mana_ib_pd *pd,
 		      u32 doorbell_id)
 {
-	struct gdma_dev *mdev = &dev->gdma_dev->gdma_context->mana;
 	struct mana_port_context *mpc;
-	struct mana_context *mc;
 	struct net_device *ndev;
 	int err;
 
-	mc = mdev->driver_data;
-	ndev = mc->ports[port];
+	ndev = mana_ib_get_netdev(&dev->ib_dev, port);
 	mpc = netdev_priv(ndev);
 
 	mutex_lock(&pd->vport_mutex);
@@ -79,17 +73,17 @@
 	struct gdma_create_pd_req req = {};
 	enum gdma_pd_flags flags = 0;
 	struct mana_ib_dev *dev;
-	struct gdma_dev *mdev;
+	struct gdma_context *gc;
 	int err;
 
 	dev = container_of(ibdev, struct mana_ib_dev, ib_dev);
-	mdev = dev->gdma_dev;
+	gc = mdev_to_gc(dev);
 
 	mana_gd_init_req_hdr(&req.hdr, GDMA_CREATE_PD, sizeof(req),
 			     sizeof(resp));
 
 	req.flags = flags;
-	err = mana_gd_send_request(mdev->gdma_context, sizeof(req), &req,
+	err = mana_gd_send_request(gc, sizeof(req), &req,
 				   sizeof(resp), &resp);
 
 	if (err || resp.hdr.status) {
@@ -119,17 +113,17 @@
 	struct gdma_destory_pd_resp resp = {};
 	struct gdma_destroy_pd_req req = {};
 	struct mana_ib_dev *dev;
-	struct gdma_dev *mdev;
+	struct gdma_context *gc;
 	int err;
 
 	dev = container_of(ibdev, struct mana_ib_dev, ib_dev);
-	mdev = dev->gdma_dev;
+	gc = mdev_to_gc(dev);
 
 	mana_gd_init_req_hdr(&req.hdr, GDMA_DESTROY_PD, sizeof(req),
 			     sizeof(resp));
 
 	req.pd_handle = pd->pd_handle;
-	err = mana_gd_send_request(mdev->gdma_context, sizeof(req), &req,
+	err = mana_gd_send_request(gc, sizeof(req), &req,
 				   sizeof(resp), &resp);
 
 	if (err || resp.hdr.status) {
@@ -206,13 +200,11 @@
 	struct ib_device *ibdev = ibcontext->device;
 	struct mana_ib_dev *mdev;
 	struct gdma_context *gc;
-	struct gdma_dev *dev;
 	int doorbell_page;
 	int ret;
 
 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
-	dev = mdev->gdma_dev;
-	gc = dev->gdma_context;
+	gc = mdev_to_gc(mdev);
 
 	/* Allocate a doorbell page index */
 	ret = mana_gd_allocate_doorbell_page(gc, &doorbell_page);
@@ -238,13 +230,56 @@
 	int ret;
 
 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
-	gc = mdev->gdma_dev->gdma_context;
+	gc = mdev_to_gc(mdev);
 
 	ret = mana_gd_destroy_doorbell_page(gc, mana_ucontext->doorbell);
 	if (ret)
 		ibdev_dbg(ibdev, "Failed to destroy doorbell page %d\n", ret);
 }
 
+int mana_ib_create_queue(struct mana_ib_dev *mdev, u64 addr, u32 size,
+			 struct mana_ib_queue *queue)
+{
+	struct ib_umem *umem;
+	int err;
+
+	queue->umem = NULL;
+	queue->id = INVALID_QUEUE_ID;
+	queue->gdma_region = GDMA_INVALID_DMA_REGION;
+
+	umem = ib_umem_get(&mdev->ib_dev, addr, size, IB_ACCESS_LOCAL_WRITE);
+	if (IS_ERR(umem)) {
+		err = PTR_ERR(umem);
+		ibdev_dbg(&mdev->ib_dev, "Failed to get umem, %d\n", err);
+		return err;
+	}
+
+	err = mana_ib_create_zero_offset_dma_region(mdev, umem, &queue->gdma_region);
+	if (err) {
+		ibdev_dbg(&mdev->ib_dev, "Failed to create dma region, %d\n", err);
+		goto free_umem;
+	}
+	queue->umem = umem;
+
+	ibdev_dbg(&mdev->ib_dev,
+		  "create_dma_region ret %d gdma_region 0x%llx\n",
+		  err, queue->gdma_region);
+
+	return 0;
+free_umem:
+	ib_umem_release(umem);
+	return err;
+}
+
+void mana_ib_destroy_queue(struct mana_ib_dev *mdev, struct mana_ib_queue *queue)
+{
+	/* Ignore return code as there is not much we can do about it.
+	 * The error message is printed inside.
+	 */
+	mana_ib_gd_destroy_dma_region(mdev, queue->gdma_region);
+	ib_umem_release(queue->umem);
+}
+
 static int
 mana_ib_gd_first_dma_region(struct mana_ib_dev *dev,
 			    struct gdma_context *gc,
@@ -309,8 +344,8 @@
 	return 0;
 }
 
-int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
-				 mana_handle_t *gdma_region)
+static int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+					mana_handle_t *gdma_region, unsigned long page_sz)
 {
 	struct gdma_dma_region_add_pages_req *add_req = NULL;
 	size_t num_pages_processed = 0, num_pages_to_handle;
@@ -322,23 +357,14 @@
 	size_t max_pgs_create_cmd;
 	struct gdma_context *gc;
 	size_t num_pages_total;
-	struct gdma_dev *mdev;
-	unsigned long page_sz;
 	unsigned int tail = 0;
 	u64 *page_addr_list;
 	void *request_buf;
 	int err;
 
-	mdev = dev->gdma_dev;
-	gc = mdev->gdma_context;
+	gc = mdev_to_gc(dev);
 	hwc = gc->hwc.driver_data;
 
-	/* Hardware requires dma region to align to chosen page size */
-	page_sz = ib_umem_find_best_pgsz(umem, PAGE_SZ_BM, 0);
-	if (!page_sz) {
-		ibdev_dbg(&dev->ib_dev, "failed to find page size.\n");
-		return -ENOMEM;
-	}
 	num_pages_total = ib_umem_num_dma_blocks(umem, page_sz);
 
 	max_pgs_create_cmd =
@@ -358,8 +384,8 @@
 			     sizeof(struct gdma_create_dma_region_resp));
 
 	create_req->length = umem->length;
-	create_req->offset_in_page = umem->address & (page_sz - 1);
-	create_req->gdma_page_type = order_base_2(page_sz) - PAGE_SHIFT;
+	create_req->offset_in_page = ib_umem_dma_offset(umem, page_sz);
+	create_req->gdma_page_type = order_base_2(page_sz) - MANA_PAGE_SHIFT;
 	create_req->page_count = num_pages_total;
 
 	ibdev_dbg(&dev->ib_dev, "size_dma_region %lu num_pages_total %lu\n",
@@ -424,12 +450,39 @@
 	return err;
 }
 
+int mana_ib_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+			      mana_handle_t *gdma_region, u64 virt)
+{
+	unsigned long page_sz;
+
+	page_sz = ib_umem_find_best_pgsz(umem, PAGE_SZ_BM, virt);
+	if (!page_sz) {
+		ibdev_dbg(&dev->ib_dev, "Failed to find page size.\n");
+		return -EINVAL;
+	}
+
+	return mana_ib_gd_create_dma_region(dev, umem, gdma_region, page_sz);
+}
+
+int mana_ib_create_zero_offset_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+					  mana_handle_t *gdma_region)
+{
+	unsigned long page_sz;
+
+	/* Hardware requires dma region to align to chosen page size */
+	page_sz = ib_umem_find_best_pgoff(umem, PAGE_SZ_BM, 0);
+	if (!page_sz) {
+		ibdev_dbg(&dev->ib_dev, "Failed to find page size.\n");
+		return -EINVAL;
+	}
+
+	return mana_ib_gd_create_dma_region(dev, umem, gdma_region, page_sz);
+}
+
 int mana_ib_gd_destroy_dma_region(struct mana_ib_dev *dev, u64 gdma_region)
 {
-	struct gdma_dev *mdev = dev->gdma_dev;
-	struct gdma_context *gc;
+	struct gdma_context *gc = mdev_to_gc(dev);
 
-	gc = mdev->gdma_context;
 	ibdev_dbg(&dev->ib_dev, "destroy dma region 0x%llx\n", gdma_region);
 
 	return mana_gd_destroy_dma_region(gc, gdma_region);
@@ -447,7 +500,7 @@
 	int ret;
 
 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
-	gc = mdev->gdma_dev->gdma_context;
+	gc = mdev_to_gc(mdev);
 
 	if (vma->vm_pgoff != 0) {
 		ibdev_dbg(ibdev, "Unexpected vm_pgoff %lu\n", vma->vm_pgoff);
@@ -460,13 +513,13 @@
 	      PAGE_SHIFT;
 	prot = pgprot_writecombine(vma->vm_page_prot);
 
-	ret = rdma_user_mmap_io(ibcontext, vma, pfn, gc->db_page_size, prot,
+	ret = rdma_user_mmap_io(ibcontext, vma, pfn, PAGE_SIZE, prot,
 				NULL);
 	if (ret)
 		ibdev_dbg(ibdev, "can't rdma_user_mmap_io ret %d\n", ret);
 	else
-		ibdev_dbg(ibdev, "mapped I/O pfn 0x%llx page_size %u, ret %d\n",
-			  pfn, gc->db_page_size, ret);
+		ibdev_dbg(ibdev, "mapped I/O pfn 0x%llx page_size %lu, ret %d\n",
+			  pfn, PAGE_SIZE, ret);
 
 	return ret;
 }
@@ -474,11 +527,18 @@
 int mana_ib_get_port_immutable(struct ib_device *ibdev, u32 port_num,
 			       struct ib_port_immutable *immutable)
 {
-	/*
-	 * This version only support RAW_PACKET
-	 * other values need to be filled for other types
-	 */
+	struct ib_port_attr attr;
+	int err;
+
+	err = ib_query_port(ibdev, port_num, &attr);
+	if (err)
+		return err;
+
+	immutable->pkey_tbl_len = attr.pkey_tbl_len;
+	immutable->gid_tbl_len = attr.gid_tbl_len;
 	immutable->core_cap_flags = RDMA_CORE_PORT_RAW_PACKET;
+	if (port_num == 1)
+		immutable->core_cap_flags |= RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
 
 	return 0;
 }
@@ -531,7 +591,7 @@
 	req.hdr.resp.msg_version = GDMA_MESSAGE_V3;
 	req.hdr.dev_id = dev->gdma_dev->dev_id;
 
-	err = mana_gd_send_request(dev->gdma_dev->gdma_context, sizeof(req),
+	err = mana_gd_send_request(mdev_to_gc(dev), sizeof(req),
 				   &req, sizeof(resp), &resp);
 
 	if (err) {
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mana/mana_ib.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mana/mana_ib.h
@@ -45,6 +45,12 @@
 	u32 max_inline_data_size;
 };
 
+struct mana_ib_queue {
+	struct ib_umem *umem;
+	u64 gdma_region;
+	u64 id;
+};
+
 struct mana_ib_dev {
 	struct ib_device ib_dev;
 	struct gdma_dev *gdma_dev;
@@ -82,10 +88,8 @@
 
 struct mana_ib_cq {
 	struct ib_cq ibcq;
-	struct ib_umem *umem;
+	struct mana_ib_queue queue;
 	int cqe;
-	u64 gdma_region;
-	u64 id;
 	u32 comp_vector;
 };
 
@@ -142,12 +146,37 @@
 	u32 max_inline_data_size;
 }; /* HW Data */
 
-int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
-				 mana_handle_t *gdma_region);
+static inline struct gdma_context *mdev_to_gc(struct mana_ib_dev *mdev)
+{
+	return mdev->gdma_dev->gdma_context;
+}
+
+static inline struct net_device *mana_ib_get_netdev(struct ib_device *ibdev, u32 port)
+{
+	struct mana_ib_dev *mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
+	struct gdma_context *gc = mdev_to_gc(mdev);
+	struct mana_context *mc = gc->mana.driver_data;
+
+	if (port < 1 || port > mc->num_ports)
+		return NULL;
+	return mc->ports[port - 1];
+}
+
+int mana_ib_install_cq_cb(struct mana_ib_dev *mdev, struct mana_ib_cq *cq);
+
+int mana_ib_create_zero_offset_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+					  mana_handle_t *gdma_region);
+
+int mana_ib_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+			      mana_handle_t *gdma_region, u64 virt);
 
 int mana_ib_gd_destroy_dma_region(struct mana_ib_dev *dev,
 				  mana_handle_t gdma_region);
 
+int mana_ib_create_queue(struct mana_ib_dev *mdev, u64 addr, u32 size,
+			 struct mana_ib_queue *queue);
+void mana_ib_destroy_queue(struct mana_ib_dev *mdev, struct mana_ib_queue *queue);
+
 struct ib_wq *mana_ib_create_wq(struct ib_pd *pd,
 				struct ib_wq_init_attr *init_attr,
 				struct ib_udata *udata);
@@ -210,6 +239,4 @@
 void mana_ib_disassociate_ucontext(struct ib_ucontext *ibcontext);
 
 int mana_ib_gd_query_adapter_caps(struct mana_ib_dev *mdev);
-
-void mana_ib_cq_handler(void *ctx, struct gdma_queue *gdma_cq);
 #endif
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mana/mr.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mana/mr.c
@@ -30,12 +30,9 @@
 {
 	struct gdma_create_mr_response resp = {};
 	struct gdma_create_mr_request req = {};
-	struct gdma_dev *mdev = dev->gdma_dev;
-	struct gdma_context *gc;
+	struct gdma_context *gc = mdev_to_gc(dev);
 	int err;
 
-	gc = mdev->gdma_context;
-
 	mana_gd_init_req_hdr(&req.hdr, GDMA_CREATE_MR, sizeof(req),
 			     sizeof(resp));
 	req.pd_handle = mr_params->pd_handle;
@@ -77,12 +74,9 @@
 {
 	struct gdma_destroy_mr_response resp = {};
 	struct gdma_destroy_mr_request req = {};
-	struct gdma_dev *mdev = dev->gdma_dev;
-	struct gdma_context *gc;
+	struct gdma_context *gc = mdev_to_gc(dev);
 	int err;
 
-	gc = mdev->gdma_context;
-
 	mana_gd_init_req_hdr(&req.hdr, GDMA_DESTROY_MR, sizeof(req),
 			     sizeof(resp));
 
@@ -118,6 +112,7 @@
 		  "start 0x%llx, iova 0x%llx length 0x%llx access_flags 0x%x",
 		  start, iova, length, access_flags);
 
+	access_flags &= ~IB_ACCESS_OPTIONAL;
 	if (access_flags & ~VALID_MR_FLAGS)
 		return ERR_PTR(-EINVAL);
 
@@ -133,7 +128,7 @@
 		goto err_free;
 	}
 
-	err = mana_ib_gd_create_dma_region(dev, mr->umem, &dma_region_handle);
+	err = mana_ib_create_dma_region(dev, mr->umem, &dma_region_handle, iova);
 	if (err) {
 		ibdev_dbg(ibdev, "Failed create dma region for user-mr, %d\n",
 			  err);
@@ -141,7 +136,7 @@
 	}
 
 	ibdev_dbg(ibdev,
-		  "mana_ib_gd_create_dma_region ret %d gdma_region %llx\n", err,
+		  "create_dma_region ret %d gdma_region %llx\n", err,
 		  dma_region_handle);
 
 	mr_params.pd_handle = pd->pd_handle;
@@ -164,8 +159,7 @@
 	return &mr->ibmr;
 
 err_dma_region:
-	mana_gd_destroy_dma_region(dev->gdma_dev->gdma_context,
-				   dma_region_handle);
+	mana_gd_destroy_dma_region(mdev_to_gc(dev), dma_region_handle);
 
 err_umem:
 	ib_umem_release(mr->umem);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mana/qp.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mana/qp.c
@@ -17,12 +17,10 @@
 	struct mana_cfg_rx_steer_resp resp = {};
 	mana_handle_t *req_indir_tab;
 	struct gdma_context *gc;
-	struct gdma_dev *mdev;
 	u32 req_buf_size;
 	int i, err;
 
-	gc = dev->gdma_dev->gdma_context;
-	mdev = &gc->mana;
+	gc = mdev_to_gc(dev);
 
 	req_buf_size =
 		sizeof(*req) + sizeof(mana_handle_t) * MANA_INDIRECT_TABLE_SIZE;
@@ -39,7 +37,7 @@
 	req->rx_enable = 1;
 	req->update_default_rxobj = 1;
 	req->default_rxobj = default_rxobj;
-	req->hdr.dev_id = mdev->dev_id;
+	req->hdr.dev_id = gc->mana.dev_id;
 
 	/* If there are more than 1 entries in indirection table, enable RSS */
 	if (log_ind_tbl_size)
@@ -99,20 +97,17 @@
 	struct mana_ib_qp *qp = container_of(ibqp, struct mana_ib_qp, ibqp);
 	struct mana_ib_dev *mdev =
 		container_of(pd->device, struct mana_ib_dev, ib_dev);
+	struct gdma_context *gc = mdev_to_gc(mdev);
 	struct ib_rwq_ind_table *ind_tbl = attr->rwq_ind_tbl;
 	struct mana_ib_create_qp_rss_resp resp = {};
 	struct mana_ib_create_qp_rss ucmd = {};
 	struct gdma_queue **gdma_cq_allocated;
 	mana_handle_t *mana_ind_table;
 	struct mana_port_context *mpc;
-	struct gdma_queue *gdma_cq;
 	unsigned int ind_tbl_size;
-	struct mana_context *mc;
 	struct net_device *ndev;
-	struct gdma_context *gc;
 	struct mana_ib_cq *cq;
 	struct mana_ib_wq *wq;
-	struct gdma_dev *gd;
 	struct mana_eq *eq;
 	struct ib_cq *ibcq;
 	struct ib_wq *ibwq;
@@ -120,10 +115,6 @@
 	u32 port;
 	int ret;
 
-	gc = mdev->gdma_dev->gdma_context;
-	gd = &gc->mana;
-	mc = gd->driver_data;
-
 	if (!udata || udata->inlen < sizeof(ucmd))
 		return -EINVAL;
 
@@ -166,12 +157,12 @@
 
 	/* IB ports start with 1, MANA start with 0 */
 	port = ucmd.port;
-	if (port < 1 || port > mc->num_ports) {
+	ndev = mana_ib_get_netdev(pd->device, port);
+	if (!ndev) {
 		ibdev_dbg(&mdev->ib_dev, "Invalid port %u in creating qp\n",
 			  port);
 		return -EINVAL;
 	}
-	ndev = mc->ports[port - 1];
 	mpc = netdev_priv(ndev);
 
 	ibdev_dbg(&mdev->ib_dev, "rx_hash_function %d port %d\n",
@@ -206,10 +197,10 @@
 		wq_spec.gdma_region = wq->gdma_region;
 		wq_spec.queue_size = wq->wq_buf_size;
 
-		cq_spec.gdma_region = cq->gdma_region;
+		cq_spec.gdma_region = cq->queue.gdma_region;
 		cq_spec.queue_size = cq->cqe * COMP_ENTRY_SIZE;
 		cq_spec.modr_ctx_id = 0;
-		eq = &mc->eqs[cq->comp_vector % gc->max_num_queues];
+		eq = &mpc->ac->eqs[cq->comp_vector % gc->max_num_queues];
 		cq_spec.attached_eq = eq->eq->id;
 
 		ret = mana_create_wq_obj(mpc, mpc->port_handle, GDMA_RQ,
@@ -222,34 +213,26 @@
 
 		/* The GDMA regions are now owned by the WQ object */
 		wq->gdma_region = GDMA_INVALID_DMA_REGION;
-		cq->gdma_region = GDMA_INVALID_DMA_REGION;
+		cq->queue.gdma_region = GDMA_INVALID_DMA_REGION;
 
 		wq->id = wq_spec.queue_index;
-		cq->id = cq_spec.queue_index;
+		cq->queue.id = cq_spec.queue_index;
 
 		ibdev_dbg(&mdev->ib_dev,
 			  "ret %d rx_object 0x%llx wq id %llu cq id %llu\n",
-			  ret, wq->rx_object, wq->id, cq->id);
+			  ret, wq->rx_object, wq->id, cq->queue.id);
 
-		resp.entries[i].cqid = cq->id;
+		resp.entries[i].cqid = cq->queue.id;
 		resp.entries[i].wqid = wq->id;
 
 		mana_ind_table[i] = wq->rx_object;
 
 		/* Create CQ table entry */
-		WARN_ON(gc->cq_table[cq->id]);
-		gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
-		if (!gdma_cq) {
-			ret = -ENOMEM;
+		ret = mana_ib_install_cq_cb(mdev, cq);
+		if (ret)
 			goto fail;
-		}
-		gdma_cq_allocated[i] = gdma_cq;
 
-		gdma_cq->cq.context = cq;
-		gdma_cq->type = GDMA_CQ;
-		gdma_cq->cq.callback = mana_ib_cq_handler;
-		gdma_cq->id = cq->id;
-		gc->cq_table[cq->id] = gdma_cq;
+		gdma_cq_allocated[i] = gc->cq_table[cq->queue.id];
 	}
 	resp.num_entries = i;
 
@@ -281,7 +264,7 @@
 		wq = container_of(ibwq, struct mana_ib_wq, ibwq);
 		cq = container_of(ibcq, struct mana_ib_cq, ibcq);
 
-		gc->cq_table[cq->id] = NULL;
+		gc->cq_table[cq->queue.id] = NULL;
 		kfree(gdma_cq_allocated[i]);
 
 		mana_destroy_wq_obj(mpc, GDMA_RQ, wq->rx_object);
@@ -306,14 +289,13 @@
 	struct mana_ib_ucontext *mana_ucontext =
 		rdma_udata_to_drv_context(udata, struct mana_ib_ucontext,
 					  ibucontext);
-	struct gdma_dev *gd = &mdev->gdma_dev->gdma_context->mana;
+	struct gdma_context *gc = mdev_to_gc(mdev);
 	struct mana_ib_create_qp_resp resp = {};
 	struct mana_ib_create_qp ucmd = {};
 	struct gdma_queue *gdma_cq = NULL;
 	struct mana_obj_spec wq_spec = {};
 	struct mana_obj_spec cq_spec = {};
 	struct mana_port_context *mpc;
-	struct mana_context *mc;
 	struct net_device *ndev;
 	struct ib_umem *umem;
 	struct mana_eq *eq;
@@ -321,8 +303,6 @@
 	u32 port;
 	int err;
 
-	mc = gd->driver_data;
-
 	if (!mana_ucontext || udata->inlen < sizeof(ucmd))
 		return -EINVAL;
 
@@ -333,11 +313,6 @@
 		return err;
 	}
 
-	/* IB ports start with 1, MANA Ethernet ports start with 0 */
-	port = ucmd.port;
-	if (port < 1 || port > mc->num_ports)
-		return -EINVAL;
-
 	if (attr->cap.max_send_wr > mdev->adapter_caps.max_qp_wr) {
 		ibdev_dbg(&mdev->ib_dev,
 			  "Requested max_send_wr %d exceeding limit\n",
@@ -352,11 +327,17 @@
 		return -EINVAL;
 	}
 
-	ndev = mc->ports[port - 1];
+	port = ucmd.port;
+	ndev = mana_ib_get_netdev(ibpd->device, port);
+	if (!ndev) {
+		ibdev_dbg(&mdev->ib_dev, "Invalid port %u in creating qp\n",
+			  port);
+		return -EINVAL;
+	}
 	mpc = netdev_priv(ndev);
 	ibdev_dbg(&mdev->ib_dev, "port %u ndev %p mpc %p\n", port, ndev, mpc);
 
-	err = mana_ib_cfg_vport(mdev, port - 1, pd, mana_ucontext->doorbell);
+	err = mana_ib_cfg_vport(mdev, port, pd, mana_ucontext->doorbell);
 	if (err)
 		return -ENODEV;
 
@@ -376,8 +357,8 @@
 	}
 	qp->sq_umem = umem;
 
-	err = mana_ib_gd_create_dma_region(mdev, qp->sq_umem,
-					   &qp->sq_gdma_region);
+	err = mana_ib_create_zero_offset_dma_region(mdev, qp->sq_umem,
+						    &qp->sq_gdma_region);
 	if (err) {
 		ibdev_dbg(&mdev->ib_dev,
 			  "Failed to create dma region for create qp-raw, %d\n",
@@ -386,18 +367,18 @@
 	}
 
 	ibdev_dbg(&mdev->ib_dev,
-		  "mana_ib_gd_create_dma_region ret %d gdma_region 0x%llx\n",
+		  "create_dma_region ret %d gdma_region 0x%llx\n",
 		  err, qp->sq_gdma_region);
 
 	/* Create a WQ on the same port handle used by the Ethernet */
 	wq_spec.gdma_region = qp->sq_gdma_region;
 	wq_spec.queue_size = ucmd.sq_buf_size;
 
-	cq_spec.gdma_region = send_cq->gdma_region;
+	cq_spec.gdma_region = send_cq->queue.gdma_region;
 	cq_spec.queue_size = send_cq->cqe * COMP_ENTRY_SIZE;
 	cq_spec.modr_ctx_id = 0;
-	eq_vec = send_cq->comp_vector % gd->gdma_context->max_num_queues;
-	eq = &mc->eqs[eq_vec];
+	eq_vec = send_cq->comp_vector % gc->max_num_queues;
+	eq = &mpc->ac->eqs[eq_vec];
 	cq_spec.attached_eq = eq->eq->id;
 
 	err = mana_create_wq_obj(mpc, mpc->port_handle, GDMA_SQ, &wq_spec,
@@ -411,31 +392,22 @@
 
 	/* The GDMA regions are now owned by the WQ object */
 	qp->sq_gdma_region = GDMA_INVALID_DMA_REGION;
-	send_cq->gdma_region = GDMA_INVALID_DMA_REGION;
+	send_cq->queue.gdma_region = GDMA_INVALID_DMA_REGION;
 
 	qp->sq_id = wq_spec.queue_index;
-	send_cq->id = cq_spec.queue_index;
+	send_cq->queue.id = cq_spec.queue_index;
 
 	/* Create CQ table entry */
-	WARN_ON(gd->gdma_context->cq_table[send_cq->id]);
-	gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
-	if (!gdma_cq) {
-		err = -ENOMEM;
+	err = mana_ib_install_cq_cb(mdev, send_cq);
+	if (err)
 		goto err_destroy_wq_obj;
-	}
-
-	gdma_cq->cq.context = send_cq;
-	gdma_cq->type = GDMA_CQ;
-	gdma_cq->cq.callback = mana_ib_cq_handler;
-	gdma_cq->id = send_cq->id;
-	gd->gdma_context->cq_table[send_cq->id] = gdma_cq;
 
 	ibdev_dbg(&mdev->ib_dev,
 		  "ret %d qp->tx_object 0x%llx sq id %llu cq id %llu\n", err,
-		  qp->tx_object, qp->sq_id, send_cq->id);
+		  qp->tx_object, qp->sq_id, send_cq->queue.id);
 
 	resp.sqid = qp->sq_id;
-	resp.cqid = send_cq->id;
+	resp.cqid = send_cq->queue.id;
 	resp.tx_vp_offset = pd->tx_vp_offset;
 
 	err = ib_copy_to_udata(udata, &resp, sizeof(resp));
@@ -450,7 +422,7 @@
 
 err_release_gdma_cq:
 	kfree(gdma_cq);
-	gd->gdma_context->cq_table[send_cq->id] = NULL;
+	gc->cq_table[send_cq->queue.id] = NULL;
 
 err_destroy_wq_obj:
 	mana_destroy_wq_obj(mpc, GDMA_SQ, qp->tx_object);
@@ -462,7 +434,7 @@
 	ib_umem_release(umem);
 
 err_free_vport:
-	mana_ib_uncfg_vport(mdev, pd, port - 1);
+	mana_ib_uncfg_vport(mdev, pd, port);
 
 	return err;
 }
@@ -500,16 +472,13 @@
 {
 	struct mana_ib_dev *mdev =
 		container_of(qp->ibqp.device, struct mana_ib_dev, ib_dev);
-	struct gdma_dev *gd = &mdev->gdma_dev->gdma_context->mana;
 	struct mana_port_context *mpc;
-	struct mana_context *mc;
 	struct net_device *ndev;
 	struct mana_ib_wq *wq;
 	struct ib_wq *ibwq;
 	int i;
 
-	mc = gd->driver_data;
-	ndev = mc->ports[qp->port - 1];
+	ndev = mana_ib_get_netdev(qp->ibqp.device, qp->port);
 	mpc = netdev_priv(ndev);
 
 	for (i = 0; i < (1 << ind_tbl->log_ind_tbl_size); i++) {
@@ -527,15 +496,12 @@
 {
 	struct mana_ib_dev *mdev =
 		container_of(qp->ibqp.device, struct mana_ib_dev, ib_dev);
-	struct gdma_dev *gd = &mdev->gdma_dev->gdma_context->mana;
 	struct ib_pd *ibpd = qp->ibqp.pd;
 	struct mana_port_context *mpc;
-	struct mana_context *mc;
 	struct net_device *ndev;
 	struct mana_ib_pd *pd;
 
-	mc = gd->driver_data;
-	ndev = mc->ports[qp->port - 1];
+	ndev = mana_ib_get_netdev(qp->ibqp.device, qp->port);
 	mpc = netdev_priv(ndev);
 	pd = container_of(ibpd, struct mana_ib_pd, ibpd);
 
@@ -546,7 +512,7 @@
 		ib_umem_release(qp->sq_umem);
 	}
 
-	mana_ib_uncfg_vport(mdev, pd, qp->port - 1);
+	mana_ib_uncfg_vport(mdev, pd, qp->port);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mana/wq.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mana/wq.c
@@ -46,7 +46,7 @@
 	wq->wq_buf_size = ucmd.wq_buf_size;
 	wq->rx_object = INVALID_MANA_HANDLE;
 
-	err = mana_ib_gd_create_dma_region(mdev, wq->umem, &wq->gdma_region);
+	err = mana_ib_create_zero_offset_dma_region(mdev, wq->umem, &wq->gdma_region);
 	if (err) {
 		ibdev_dbg(&mdev->ib_dev,
 			  "Failed to create dma region for create wq, %d\n",
@@ -55,7 +55,7 @@
 	}
 
 	ibdev_dbg(&mdev->ib_dev,
-		  "mana_ib_gd_create_dma_region ret %d gdma_region 0x%llx\n",
+		  "create_dma_region ret %d gdma_region 0x%llx\n",
 		  err, wq->gdma_region);
 
 	/* WQ ID is returned at wq_create time, doesn't know the value yet */
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx4/alias_GUID.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx4/alias_GUID.c
@@ -829,7 +829,7 @@
 
 int mlx4_ib_init_alias_guid_service(struct mlx4_ib_dev *dev)
 {
-	char alias_wq_name[15];
+	char alias_wq_name[22];
 	int ret = 0;
 	int i, j;
 	union ib_gid gid;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx4/mad.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx4/mad.c
@@ -2158,7 +2158,7 @@
 				       struct mlx4_ib_demux_ctx *ctx,
 				       int port)
 {
-	char name[12];
+	char name[21];
 	int ret = 0;
 	int i;
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx5/mad.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx5/mad.c
@@ -188,7 +188,8 @@
 		mdev = dev->mdev;
 		mdev_port_num = 1;
 	}
-	if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1) {
+	if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1 &&
+	    !mlx5_core_mp_enabled(mdev)) {
 		/* set local port to one for Function-Per-Port HCA. */
 		mdev = dev->mdev;
 		mdev_port_num = 1;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx5/main.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx5/main.c
@@ -543,7 +543,7 @@
 	if (!ndev)
 		goto out;
 
-	if (dev->lag_active) {
+	if (mlx5_lag_is_roce(mdev) || mlx5_lag_is_sriov(mdev)) {
 		rcu_read_lock();
 		upper = netdev_master_upper_dev_get_rcu(ndev);
 		if (upper) {
@@ -2824,37 +2824,72 @@
 	}
 }
 
-static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev)
+int mlx5_ib_dev_res_cq_init(struct mlx5_ib_dev *dev)
 {
 	struct mlx5_ib_resources *devr = &dev->devr;
-	struct ib_srq_init_attr attr;
-	struct ib_device *ibdev;
 	struct ib_cq_init_attr cq_attr = {.cqe = 1};
-	int port;
+	struct ib_device *ibdev;
+	struct ib_pd *pd;
+	struct ib_cq *cq;
 	int ret = 0;
 
-	ibdev = &dev->ib_dev;
 
-	if (!MLX5_CAP_GEN(dev->mdev, xrc))
-		return -EOPNOTSUPP;
+	/*
+	 * devr->c0 is set once, never changed until device unload.
+	 * Avoid taking the mutex if initialization is already done.
+	 */
+	if (devr->c0)
+		return 0;
 
-	devr->p0 = ib_alloc_pd(ibdev, 0);
-	if (IS_ERR(devr->p0))
-		return PTR_ERR(devr->p0);
-
-	devr->c0 = ib_create_cq(ibdev, NULL, NULL, NULL, &cq_attr);
-	if (IS_ERR(devr->c0)) {
-		ret = PTR_ERR(devr->c0);
-		goto error1;
+	mutex_lock(&devr->cq_lock);
+	if (devr->c0)
+		goto unlock;
+
+	ibdev = &dev->ib_dev;
+	pd = ib_alloc_pd(ibdev, 0);
+	if (IS_ERR(pd)) {
+		ret = PTR_ERR(pd);
+		mlx5_ib_err(dev, "Couldn't allocate PD for res init, err=%d\n", ret);
+		goto unlock;
+	}
+
+	cq = ib_create_cq(ibdev, NULL, NULL, NULL, &cq_attr);
+	if (IS_ERR(cq)) {
+		ret = PTR_ERR(cq);
+		mlx5_ib_err(dev, "Couldn't create CQ for res init, err=%d\n", ret);
+		ib_dealloc_pd(pd);
+		goto unlock;
 	}
 
-	ret = mlx5_cmd_xrcd_alloc(dev->mdev, &devr->xrcdn0, 0);
-	if (ret)
-		goto error2;
+	devr->p0 = pd;
+	devr->c0 = cq;
 
-	ret = mlx5_cmd_xrcd_alloc(dev->mdev, &devr->xrcdn1, 0);
+unlock:
+	mutex_unlock(&devr->cq_lock);
+	return ret;
+}
+
+int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev)
+{
+	struct mlx5_ib_resources *devr = &dev->devr;
+	struct ib_srq_init_attr attr;
+	struct ib_srq *s0, *s1;
+	int ret = 0;
+
+	/*
+	 * devr->s1 is set once, never changed until device unload.
+	 * Avoid taking the mutex if initialization is already done.
+	 */
+	if (devr->s1)
+		return 0;
+
+	mutex_lock(&devr->srq_lock);
+	if (devr->s1)
+		goto unlock;
+
+	ret = mlx5_ib_dev_res_cq_init(dev);
 	if (ret)
-		goto error3;
+		goto unlock;
 
 	memset(&attr, 0, sizeof(attr));
 	attr.attr.max_sge = 1;
@@ -2862,10 +2897,11 @@
 	attr.srq_type = IB_SRQT_XRC;
 	attr.ext.cq = devr->c0;
 
-	devr->s0 = ib_create_srq(devr->p0, &attr);
-	if (IS_ERR(devr->s0)) {
-		ret = PTR_ERR(devr->s0);
-		goto err_create;
+	s0 = ib_create_srq(devr->p0, &attr);
+	if (IS_ERR(s0)) {
+		ret = PTR_ERR(s0);
+		mlx5_ib_err(dev, "Couldn't create SRQ 0 for res init, err=%d\n", ret);
+		goto unlock;
 	}
 
 	memset(&attr, 0, sizeof(attr));
@@ -2873,51 +2909,63 @@
 	attr.attr.max_wr = 1;
 	attr.srq_type = IB_SRQT_BASIC;
 
-	devr->s1 = ib_create_srq(devr->p0, &attr);
-	if (IS_ERR(devr->s1)) {
-		ret = PTR_ERR(devr->s1);
-		goto error6;
+	s1 = ib_create_srq(devr->p0, &attr);
+	if (IS_ERR(s1)) {
+		ret = PTR_ERR(s1);
+		mlx5_ib_err(dev, "Couldn't create SRQ 1 for res init, err=%d\n", ret);
+		ib_destroy_srq(s0);
 	}
 
-	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
-		INIT_WORK(&devr->ports[port].pkey_change_work,
-			  pkey_change_handler);
+	devr->s0 = s0;
+	devr->s1 = s1;
 
-	return 0;
-
-error6:
-	ib_destroy_srq(devr->s0);
-err_create:
-	mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn1, 0);
-error3:
-	mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn0, 0);
-error2:
-	ib_destroy_cq(devr->c0);
-error1:
-	ib_dealloc_pd(devr->p0);
+unlock:
+	mutex_unlock(&devr->srq_lock);
 	return ret;
 }
 
-static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev)
+static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev)
 {
 	struct mlx5_ib_resources *devr = &dev->devr;
-	int port;
+	int ret;
 
-	/*
-	 * Make sure no change P_Key work items are still executing.
-	 *
-	 * At this stage, the mlx5_ib_event should be unregistered
-	 * and it ensures that no new works are added.
-	 */
-	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
-		cancel_work_sync(&devr->ports[port].pkey_change_work);
+	if (!MLX5_CAP_GEN(dev->mdev, xrc))
+		return -EOPNOTSUPP;
 
-	ib_destroy_srq(devr->s1);
-	ib_destroy_srq(devr->s0);
+	ret = mlx5_cmd_xrcd_alloc(dev->mdev, &devr->xrcdn0, 0);
+	if (ret)
+		return ret;
+
+	ret = mlx5_cmd_xrcd_alloc(dev->mdev, &devr->xrcdn1, 0);
+	if (ret) {
+		mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn0, 0);
+		return ret;
+	}
+
+	mutex_init(&devr->cq_lock);
+	mutex_init(&devr->srq_lock);
+
+	return 0;
+}
+
+static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev)
+{
+	struct mlx5_ib_resources *devr = &dev->devr;
+
+	/* After s0/s1 init, they are not unset during the device lifetime. */
+	if (devr->s1) {
+		ib_destroy_srq(devr->s1);
+		ib_destroy_srq(devr->s0);
+	}
 	mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn1, 0);
 	mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn0, 0);
-	ib_destroy_cq(devr->c0);
-	ib_dealloc_pd(devr->p0);
+	/* After p0/c0 init, they are not unset during the device lifetime. */
+	if (devr->c0) {
+		ib_destroy_cq(devr->c0);
+		ib_dealloc_pd(devr->p0);
+	}
+	mutex_destroy(&devr->cq_lock);
+	mutex_destroy(&devr->srq_lock);
 }
 
 static u32 get_core_cap_flags(struct ib_device *ibdev,
@@ -3352,7 +3400,8 @@
 		list_for_each_entry(mpi, &mlx5_ib_unaffiliated_port_list,
 				    list) {
 			if (dev->sys_image_guid == mpi->sys_image_guid &&
-			    (mlx5_core_native_port_num(mpi->mdev) - 1) == i) {
+			    (mlx5_core_native_port_num(mpi->mdev) - 1) == i &&
+			    mlx5_core_same_coredev_type(dev->mdev, mpi->mdev)) {
 				bound = mlx5_ib_bind_slave_port(dev, mpi);
 			}
 
@@ -3760,10 +3809,10 @@
 	spin_lock_init(&dev->dm.lock);
 	dev->dm.dev = mdev;
 	return 0;
-err:
-	mlx5r_macsec_dealloc_gids(dev);
 err_mp:
 	mlx5_ib_cleanup_multiport_master(dev);
+err:
+	mlx5r_macsec_dealloc_gids(dev);
 	return err;
 }
 
@@ -4166,6 +4215,13 @@
 
 static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev)
 {
+	struct mlx5_ib_resources *devr = &dev->devr;
+	int port;
+
+	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
+		INIT_WORK(&devr->ports[port].pkey_change_work,
+			  pkey_change_handler);
+
 	dev->mdev_events.notifier_call = mlx5_ib_event;
 	mlx5_notifier_register(dev->mdev, &dev->mdev_events);
 
@@ -4176,8 +4232,14 @@
 
 static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev)
 {
+	struct mlx5_ib_resources *devr = &dev->devr;
+	int port;
+
 	mlx5r_macsec_event_unregister(dev);
 	mlx5_notifier_unregister(dev->mdev, &dev->mdev_events);
+
+	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
+		cancel_work_sync(&devr->ports[port].pkey_change_work);
 }
 
 void __mlx5_ib_remove(struct mlx5_ib_dev *dev,
@@ -4251,9 +4313,6 @@
 	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES,
 		     mlx5_ib_dev_res_init,
 		     mlx5_ib_dev_res_cleanup),
-	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER,
-		     mlx5_ib_stage_dev_notifier_init,
-		     mlx5_ib_stage_dev_notifier_cleanup),
 	STAGE_CREATE(MLX5_IB_STAGE_ODP,
 		     mlx5_ib_odp_init_one,
 		     mlx5_ib_odp_cleanup_one),
@@ -4278,6 +4337,9 @@
 	STAGE_CREATE(MLX5_IB_STAGE_IB_REG,
 		     mlx5_ib_stage_ib_reg_init,
 		     mlx5_ib_stage_ib_reg_cleanup),
+	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER,
+		     mlx5_ib_stage_dev_notifier_init,
+		     mlx5_ib_stage_dev_notifier_cleanup),
 	STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR,
 		     mlx5_ib_stage_post_ib_reg_umr_init,
 		     NULL),
@@ -4314,9 +4376,6 @@
 	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES,
 		     mlx5_ib_dev_res_init,
 		     mlx5_ib_dev_res_cleanup),
-	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER,
-		     mlx5_ib_stage_dev_notifier_init,
-		     mlx5_ib_stage_dev_notifier_cleanup),
 	STAGE_CREATE(MLX5_IB_STAGE_COUNTERS,
 		     mlx5_ib_counters_init,
 		     mlx5_ib_counters_cleanup),
@@ -4338,6 +4397,9 @@
 	STAGE_CREATE(MLX5_IB_STAGE_IB_REG,
 		     mlx5_ib_stage_ib_reg_init,
 		     mlx5_ib_stage_ib_reg_cleanup),
+	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER,
+		     mlx5_ib_stage_dev_notifier_init,
+		     mlx5_ib_stage_dev_notifier_cleanup),
 	STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR,
 		     mlx5_ib_stage_post_ib_reg_umr_init,
 		     NULL),
@@ -4373,7 +4435,8 @@
 
 	mutex_lock(&mlx5_ib_multiport_mutex);
 	list_for_each_entry(dev, &mlx5_ib_dev_list, ib_dev_list) {
-		if (dev->sys_image_guid == mpi->sys_image_guid)
+		if (dev->sys_image_guid == mpi->sys_image_guid &&
+		    mlx5_core_same_coredev_type(dev->mdev, mpi->mdev))
 			bound = mlx5_ib_bind_slave_port(dev, mpi);
 
 		if (bound) {
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx5/mem.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx5/mem.c
@@ -30,6 +30,7 @@
  * SOFTWARE.
  */
 
+#include <linux/io.h>
 #include <rdma/ib_umem_odp.h>
 #include "mlx5_ib.h"
 #include <linux/jiffies.h>
@@ -108,7 +109,6 @@
 	__be32 mmio_wqe[16] = {};
 	unsigned long flags;
 	unsigned int idx;
-	int i;
 
 	if (unlikely(dev->mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR))
 		return -EIO;
@@ -148,10 +148,8 @@
 	 * we hit doorbell
 	 */
 	wmb();
-	for (i = 0; i < 8; i++)
-		mlx5_write64(&mmio_wqe[i * 2],
-			     bf->bfreg->map + bf->offset + i * 8);
-	io_stop_wc();
+	__iowrite64_copy(bf->bfreg->map + bf->offset, mmio_wqe,
+			 sizeof(mmio_wqe) / 8);
 
 	bf->offset ^= bf->buf_size;
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -115,6 +115,19 @@
 		__mlx5_bit_sz(typ, page_offset_fld), 0, scale,                 \
 		page_offset_quantized)
 
+static inline unsigned long
+mlx5_umem_dmabuf_find_best_pgsz(struct ib_umem_dmabuf *umem_dmabuf)
+{
+	/*
+	 * mkeys used for dmabuf are fixed at PAGE_SIZE because we must be able
+	 * to hold any sgl after a move operation. Ideally the mkc page size
+	 * could be changed at runtime to be optimal, but right now the driver
+	 * cannot do that.
+	 */
+	return ib_umem_find_best_pgsz(&umem_dmabuf->umem, PAGE_SIZE,
+				      umem_dmabuf->umem.iova);
+}
+
 enum {
 	MLX5_IB_MMAP_OFFSET_START = 9,
 	MLX5_IB_MMAP_OFFSET_END = 255,
@@ -643,9 +656,10 @@
 	unsigned int ndescs;
 	struct wait_queue_head wait;
 	refcount_t usecount;
-	/* User Mkey must hold either a rb_key or a cache_ent. */
+	/* Cacheable user Mkey must hold either a rb_key or a cache_ent. */
 	struct mlx5r_cache_rb_key rb_key;
 	struct mlx5_cache_ent *cache_ent;
+	u8 cacheable : 1;
 };
 
 #define MLX5_IB_MTT_PRESENT (MLX5_IB_MTT_READ | MLX5_IB_MTT_WRITE)
@@ -781,6 +795,7 @@
 	u8 is_tmp:1;
 	u8 disabled:1;
 	u8 fill_to_high_water:1;
+	u8 tmp_cleanup_scheduled:1;
 
 	/*
 	 * - limit is the low water mark for stored mkeys, 2* limit is the
@@ -812,7 +827,6 @@
 	struct mutex		rb_lock;
 	struct dentry		*fs_root;
 	unsigned long		last_add;
-	struct delayed_work	remove_ent_dwork;
 };
 
 struct mlx5_ib_port_resources {
@@ -822,11 +836,13 @@
 
 struct mlx5_ib_resources {
 	struct ib_cq	*c0;
+	struct mutex cq_lock;
 	u32 xrcdn0;
 	u32 xrcdn1;
 	struct ib_pd	*p0;
 	struct ib_srq	*s0;
 	struct ib_srq	*s1;
+	struct mutex srq_lock;
 	struct mlx5_ib_port_resources ports[2];
 };
 
@@ -954,7 +970,6 @@
 	MLX5_IB_STAGE_QP,
 	MLX5_IB_STAGE_SRQ,
 	MLX5_IB_STAGE_DEVICE_RESOURCES,
-	MLX5_IB_STAGE_DEVICE_NOTIFIER,
 	MLX5_IB_STAGE_ODP,
 	MLX5_IB_STAGE_COUNTERS,
 	MLX5_IB_STAGE_CONG_DEBUGFS,
@@ -963,6 +978,7 @@
 	MLX5_IB_STAGE_PRE_IB_REG_UMR,
 	MLX5_IB_STAGE_WHITELIST_UID,
 	MLX5_IB_STAGE_IB_REG,
+	MLX5_IB_STAGE_DEVICE_NOTIFIER,
 	MLX5_IB_STAGE_POST_IB_REG_UMR,
 	MLX5_IB_STAGE_DELAY_DROP,
 	MLX5_IB_STAGE_RESTRACK,
@@ -1272,6 +1288,8 @@
 		struct mlx5_user_mmap_entry, rdma_entry);
 }
 
+int mlx5_ib_dev_res_cq_init(struct mlx5_ib_dev *dev);
+int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev);
 int mlx5_ib_db_map_user(struct mlx5_ib_ucontext *context, unsigned long virt,
 			struct mlx5_db *db);
 void mlx5_ib_db_unmap_user(struct mlx5_ib_ucontext *context, struct mlx5_db *db);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx5/mr.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx5/mr.c
@@ -48,6 +48,7 @@
 	MAX_PENDING_REG_MR = 8,
 };
 
+#define MLX5_MR_CACHE_PERSISTENT_ENTRY_MIN_DESCS 4
 #define MLX5_UMR_ALIGN 2048
 
 static void
@@ -211,9 +212,9 @@
 
 	spin_lock_irqsave(&ent->mkeys_queue.lock, flags);
 	push_mkey_locked(ent, mkey_out->mkey);
+	ent->pending--;
 	/* If we are doing fill_to_high_water then keep going. */
 	queue_adjust_cache_locked(ent);
-	ent->pending--;
 	spin_unlock_irqrestore(&ent->mkeys_queue.lock, flags);
 	kfree(mkey_out);
 }
@@ -246,6 +247,7 @@
 	MLX5_SET(mkc, mkc, access_mode_1_0, ent->rb_key.access_mode & 0x3);
 	MLX5_SET(mkc, mkc, access_mode_4_2,
 		(ent->rb_key.access_mode >> 2) & 0x7);
+	MLX5_SET(mkc, mkc, ma_translation_mode, !!ent->rb_key.ats);
 
 	MLX5_SET(mkc, mkc, translations_octword_size,
 		 get_mkc_octo_size(ent->rb_key.access_mode,
@@ -526,6 +528,21 @@
 	}
 }
 
+static void clean_keys(struct mlx5_ib_dev *dev, struct mlx5_cache_ent *ent)
+{
+	u32 mkey;
+
+	spin_lock_irq(&ent->mkeys_queue.lock);
+	while (ent->mkeys_queue.ci) {
+		mkey = pop_mkey_locked(ent);
+		spin_unlock_irq(&ent->mkeys_queue.lock);
+		mlx5_core_destroy_mkey(dev->mdev, mkey);
+		spin_lock_irq(&ent->mkeys_queue.lock);
+	}
+	ent->tmp_cleanup_scheduled = false;
+	spin_unlock_irq(&ent->mkeys_queue.lock);
+}
+
 static void __cache_work_func(struct mlx5_cache_ent *ent)
 {
 	struct mlx5_ib_dev *dev = ent->dev;
@@ -597,7 +614,11 @@
 	struct mlx5_cache_ent *ent;
 
 	ent = container_of(work, struct mlx5_cache_ent, dwork.work);
-	__cache_work_func(ent);
+	/* temp entries are never filled, only cleaned */
+	if (ent->is_tmp)
+		clean_keys(ent->dev, ent);
+	else
+		__cache_work_func(ent);
 }
 
 static int cache_ent_key_cmp(struct mlx5r_cache_rb_key key1,
@@ -641,10 +662,8 @@
 			new = &((*new)->rb_left);
 		if (cmp < 0)
 			new = &((*new)->rb_right);
-		if (cmp == 0) {
-			mutex_unlock(&cache->rb_lock);
+		if (cmp == 0)
 			return -EEXIST;
-		}
 	}
 
 	/* Add new node and rebalance tree. */
@@ -660,6 +679,7 @@
 {
 	struct rb_node *node = dev->cache.rb_root.rb_node;
 	struct mlx5_cache_ent *cur, *smallest = NULL;
+	u64 ndescs_limit;
 	int cmp;
 
 	/*
@@ -678,10 +698,18 @@
 			return cur;
 	}
 
+	/*
+	 * Limit the usage of mkeys larger than twice the required size while
+	 * also allowing the usage of smallest cache entry for small MRs.
+	 */
+	ndescs_limit = max_t(u64, rb_key.ndescs * 2,
+			     MLX5_MR_CACHE_PERSISTENT_ENTRY_MIN_DESCS);
+
 	return (smallest &&
 		smallest->rb_key.access_mode == rb_key.access_mode &&
 		smallest->rb_key.access_flags == rb_key.access_flags &&
-		smallest->rb_key.ats == rb_key.ats) ?
+		smallest->rb_key.ats == rb_key.ats &&
+		smallest->rb_key.ndescs <= ndescs_limit) ?
 		       smallest :
 		       NULL;
 }
@@ -719,6 +747,8 @@
 	}
 	mr->mmkey.cache_ent = ent;
 	mr->mmkey.type = MLX5_MKEY_MR;
+	mr->mmkey.rb_key = ent->rb_key;
+	mr->mmkey.cacheable = true;
 	init_waitqueue_head(&mr->mmkey.wait);
 	return mr;
 }
@@ -764,21 +794,6 @@
 	return _mlx5_mr_cache_alloc(dev, ent, access_flags);
 }
 
-static void clean_keys(struct mlx5_ib_dev *dev, struct mlx5_cache_ent *ent)
-{
-	u32 mkey;
-
-	cancel_delayed_work(&ent->dwork);
-	spin_lock_irq(&ent->mkeys_queue.lock);
-	while (ent->mkeys_queue.ci) {
-		mkey = pop_mkey_locked(ent);
-		spin_unlock_irq(&ent->mkeys_queue.lock);
-		mlx5_core_destroy_mkey(dev->mdev, mkey);
-		spin_lock_irq(&ent->mkeys_queue.lock);
-	}
-	spin_unlock_irq(&ent->mkeys_queue.lock);
-}
-
 static void mlx5_mkey_cache_debugfs_cleanup(struct mlx5_ib_dev *dev)
 {
 	if (!mlx5_debugfs_root || dev->is_rep)
@@ -891,10 +906,6 @@
 			ent->limit = 0;
 
 		mlx5_mkey_cache_debugfs_add_ent(dev, ent);
-	} else {
-		mod_delayed_work(ent->dev->cache.wq,
-				 &ent->dev->cache.remove_ent_dwork,
-				 msecs_to_jiffies(30 * 1000));
 	}
 
 	return ent;
@@ -905,35 +916,6 @@
 	return ERR_PTR(ret);
 }
 
-static void remove_ent_work_func(struct work_struct *work)
-{
-	struct mlx5_mkey_cache *cache;
-	struct mlx5_cache_ent *ent;
-	struct rb_node *cur;
-
-	cache = container_of(work, struct mlx5_mkey_cache,
-			     remove_ent_dwork.work);
-	mutex_lock(&cache->rb_lock);
-	cur = rb_last(&cache->rb_root);
-	while (cur) {
-		ent = rb_entry(cur, struct mlx5_cache_ent, node);
-		cur = rb_prev(cur);
-		mutex_unlock(&cache->rb_lock);
-
-		spin_lock_irq(&ent->mkeys_queue.lock);
-		if (!ent->is_tmp) {
-			spin_unlock_irq(&ent->mkeys_queue.lock);
-			mutex_lock(&cache->rb_lock);
-			continue;
-		}
-		spin_unlock_irq(&ent->mkeys_queue.lock);
-
-		clean_keys(ent->dev, ent);
-		mutex_lock(&cache->rb_lock);
-	}
-	mutex_unlock(&cache->rb_lock);
-}
-
 int mlx5_mkey_cache_init(struct mlx5_ib_dev *dev)
 {
 	struct mlx5_mkey_cache *cache = &dev->cache;
@@ -949,7 +931,6 @@
 	mutex_init(&dev->slow_path_mutex);
 	mutex_init(&dev->cache.rb_lock);
 	dev->cache.rb_root = RB_ROOT;
-	INIT_DELAYED_WORK(&dev->cache.remove_ent_dwork, remove_ent_work_func);
 	cache->wq = alloc_ordered_workqueue("mkey_cache", WQ_MEM_RECLAIM);
 	if (!cache->wq) {
 		mlx5_ib_warn(dev, "failed to create work queue\n");
@@ -961,7 +942,7 @@
 	mlx5_mkey_cache_debugfs_init(dev);
 	mutex_lock(&cache->rb_lock);
 	for (i = 0; i <= mkey_cache_max_order(dev); i++) {
-		rb_key.ndescs = 1 << (i + 2);
+		rb_key.ndescs = MLX5_MR_CACHE_PERSISTENT_ENTRY_MIN_DESCS << i;
 		ent = mlx5r_cache_create_ent_locked(dev, rb_key, true);
 		if (IS_ERR(ent)) {
 			ret = PTR_ERR(ent);
@@ -1000,7 +981,6 @@
 		return;
 
 	mutex_lock(&dev->cache.rb_lock);
-	cancel_delayed_work(&dev->cache.remove_ent_dwork);
 	for (node = rb_first(root); node; node = rb_next(node)) {
 		ent = rb_entry(node, struct mlx5_cache_ent, node);
 		spin_lock_irq(&ent->mkeys_queue.lock);
@@ -1158,6 +1138,7 @@
 		if (IS_ERR(mr))
 			return mr;
 		mr->mmkey.rb_key = rb_key;
+		mr->mmkey.cacheable = true;
 		return mr;
 	}
 
@@ -1570,7 +1551,8 @@
 	unsigned int diffs = current_access_flags ^ target_access_flags;
 
 	if (diffs & ~(IB_ACCESS_LOCAL_WRITE | IB_ACCESS_REMOTE_WRITE |
-		      IB_ACCESS_REMOTE_READ | IB_ACCESS_RELAXED_ORDERING))
+		      IB_ACCESS_REMOTE_READ | IB_ACCESS_RELAXED_ORDERING |
+		      IB_ACCESS_REMOTE_ATOMIC))
 		return false;
 	return mlx5r_umr_can_reconfig(dev, current_access_flags,
 				      target_access_flags);
@@ -1835,6 +1817,33 @@
 	return ret;
 }
 
+static int mlx5_revoke_mr(struct mlx5_ib_mr *mr)
+{
+	struct mlx5_ib_dev *dev = to_mdev(mr->ibmr.device);
+	struct mlx5_cache_ent *ent = mr->mmkey.cache_ent;
+
+	if (mr->mmkey.cacheable && !mlx5r_umr_revoke_mr(mr) && !cache_ent_find_and_store(dev, mr)) {
+		ent = mr->mmkey.cache_ent;
+		/* upon storing to a clean temp entry - schedule its cleanup */
+		spin_lock_irq(&ent->mkeys_queue.lock);
+		if (ent->is_tmp && !ent->tmp_cleanup_scheduled) {
+			mod_delayed_work(ent->dev->cache.wq, &ent->dwork,
+					 msecs_to_jiffies(30 * 1000));
+			ent->tmp_cleanup_scheduled = true;
+		}
+		spin_unlock_irq(&ent->mkeys_queue.lock);
+		return 0;
+	}
+
+	if (ent) {
+		spin_lock_irq(&ent->mkeys_queue.lock);
+		ent->in_use--;
+		mr->mmkey.cache_ent = NULL;
+		spin_unlock_irq(&ent->mkeys_queue.lock);
+	}
+	return destroy_mkey(dev, mr);
+}
+
 int mlx5_ib_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
 {
 	struct mlx5_ib_mr *mr = to_mmr(ibmr);
@@ -1880,16 +1889,9 @@
 	}
 
 	/* Stop DMA */
-	if (mr->umem && mlx5r_umr_can_load_pas(dev, mr->umem->length))
-		if (mlx5r_umr_revoke_mr(mr) ||
-		    cache_ent_find_and_store(dev, mr))
-			mr->mmkey.cache_ent = NULL;
-
-	if (!mr->mmkey.cache_ent) {
-		rc = destroy_mkey(to_mdev(mr->ibmr.device), mr);
-		if (rc)
-			return rc;
-	}
+	rc = mlx5_revoke_mr(mr);
+	if (rc)
+		return rc;
 
 	if (mr->umem) {
 		bool is_odp = is_odp_mr(mr);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx5/odp.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx5/odp.c
@@ -705,10 +705,8 @@
 		return err;
 	}
 
-	page_size = mlx5_umem_find_best_pgsz(&umem_dmabuf->umem, mkc,
-					     log_page_size, 0,
-					     umem_dmabuf->umem.iova);
-	if (unlikely(page_size < PAGE_SIZE)) {
+	page_size = mlx5_umem_dmabuf_find_best_pgsz(umem_dmabuf);
+	if (!page_size) {
 		ib_umem_dmabuf_unmap_pages(umem_dmabuf);
 		err = -EINVAL;
 	} else {
@@ -735,24 +733,31 @@
  *  >0: Number of pages mapped
  */
 static int pagefault_mr(struct mlx5_ib_mr *mr, u64 io_virt, size_t bcnt,
-			u32 *bytes_mapped, u32 flags)
+			u32 *bytes_mapped, u32 flags, bool permissive_fault)
 {
 	struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem);
 
-	if (unlikely(io_virt < mr->ibmr.iova))
+	if (unlikely(io_virt < mr->ibmr.iova) && !permissive_fault)
 		return -EFAULT;
 
 	if (mr->umem->is_dmabuf)
 		return pagefault_dmabuf_mr(mr, bcnt, bytes_mapped, flags);
 
 	if (!odp->is_implicit_odp) {
+		u64 offset = io_virt < mr->ibmr.iova ? 0 : io_virt - mr->ibmr.iova;
 		u64 user_va;
 
-		if (check_add_overflow(io_virt - mr->ibmr.iova,
-				       (u64)odp->umem.address, &user_va))
+		if (check_add_overflow(offset, (u64)odp->umem.address,
+				       &user_va))
 			return -EFAULT;
-		if (unlikely(user_va >= ib_umem_end(odp) ||
-			     ib_umem_end(odp) - user_va < bcnt))
+
+		if (permissive_fault) {
+			if (user_va < ib_umem_start(odp))
+				user_va = ib_umem_start(odp);
+			if ((user_va + bcnt) > ib_umem_end(odp))
+				bcnt = ib_umem_end(odp) - user_va;
+		} else if (unlikely(user_va >= ib_umem_end(odp) ||
+				    ib_umem_end(odp) - user_va < bcnt))
 			return -EFAULT;
 		return pagefault_real_mr(mr, odp, user_va, bcnt, bytes_mapped,
 					 flags);
@@ -859,7 +864,7 @@
 	case MLX5_MKEY_MR:
 		mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
 
-		ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0);
+		ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0, false);
 		if (ret < 0)
 			goto end;
 
@@ -1712,7 +1717,7 @@
 	for (i = 0; i < work->num_sge; ++i) {
 		ret = pagefault_mr(work->frags[i].mr, work->frags[i].io_virt,
 				   work->frags[i].length, &bytes_mapped,
-				   work->pf_flags);
+				   work->pf_flags, false);
 		if (ret <= 0)
 			continue;
 		mlx5_update_odp_stats(work->frags[i].mr, prefetch, ret);
@@ -1763,7 +1768,7 @@
 		if (IS_ERR(mr))
 			return PTR_ERR(mr);
 		ret = pagefault_mr(mr, sg_list[i].addr, sg_list[i].length,
-				   &bytes_mapped, pf_flags);
+				   &bytes_mapped, pf_flags, false);
 		if (ret < 0) {
 			mlx5r_deref_odp_mkey(&mr->mmkey);
 			return ret;
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx5/qp.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx5/qp.c
@@ -3247,6 +3247,10 @@
 	enum ib_qp_type type;
 	int err;
 
+	err = mlx5_ib_dev_res_srq_init(dev);
+	if (err)
+		return err;
+
 	err = check_qp_type(dev, attr, &type);
 	if (err)
 		return err;
@@ -4272,14 +4276,14 @@
 		MLX5_SET(qpc, qpc, retry_count, attr->retry_cnt);
 
 	if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC && attr->max_rd_atomic)
-		MLX5_SET(qpc, qpc, log_sra_max, ilog2(attr->max_rd_atomic));
+		MLX5_SET(qpc, qpc, log_sra_max, fls(attr->max_rd_atomic - 1));
 
 	if (attr_mask & IB_QP_SQ_PSN)
 		MLX5_SET(qpc, qpc, next_send_psn, attr->sq_psn);
 
 	if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC && attr->max_dest_rd_atomic)
 		MLX5_SET(qpc, qpc, log_rra_max,
-			 ilog2(attr->max_dest_rd_atomic));
+			 fls(attr->max_dest_rd_atomic - 1));
 
 	if (attr_mask & (IB_QP_ACCESS_FLAGS | IB_QP_MAX_DEST_RD_ATOMIC)) {
 		err = set_qpc_atomic_flags(qp, attr, attr_mask, qpc);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/mlx5/srq.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/mlx5/srq.c
@@ -199,20 +199,27 @@
 	int err;
 	struct mlx5_srq_attr in = {};
 	__u32 max_srq_wqes = 1 << MLX5_CAP_GEN(dev->mdev, log_max_srq_sz);
+	__u32 max_sge_sz =  MLX5_CAP_GEN(dev->mdev, max_wqe_sz_rq) /
+			    sizeof(struct mlx5_wqe_data_seg);
 
 	if (init_attr->srq_type != IB_SRQT_BASIC &&
 	    init_attr->srq_type != IB_SRQT_XRC &&
 	    init_attr->srq_type != IB_SRQT_TM)
 		return -EOPNOTSUPP;
 
-	/* Sanity check SRQ size before proceeding */
-	if (init_attr->attr.max_wr >= max_srq_wqes) {
-		mlx5_ib_dbg(dev, "max_wr %d, cap %d\n",
-			    init_attr->attr.max_wr,
-			    max_srq_wqes);
+	/* Sanity check SRQ and sge size before proceeding */
+	if (init_attr->attr.max_wr >= max_srq_wqes ||
+	    init_attr->attr.max_sge > max_sge_sz) {
+		mlx5_ib_dbg(dev, "max_wr %d,wr_cap %d,max_sge %d, sge_cap:%d\n",
+			    init_attr->attr.max_wr, max_srq_wqes,
+			    init_attr->attr.max_sge, max_sge_sz);
 		return -EINVAL;
 	}
 
+	err = mlx5_ib_dev_res_cq_init(dev);
+	if (err)
+		return err;
+
 	mutex_init(&srq->mutex);
 	spin_lock_init(&srq->lock);
 	srq->msrq.max    = roundup_pow_of_two(init_attr->attr.max_wr + 1);
--- linux-qcom-6.8.0.orig/drivers/infiniband/hw/qib/qib_fs.c
+++ linux-qcom-6.8.0/drivers/infiniband/hw/qib/qib_fs.c
@@ -439,6 +439,7 @@
 		return PTR_ERR(dir);
 	}
 	simple_recursive_removal(dir, NULL);
+	dput(dir);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/sw/rxe/rxe.c
+++ linux-qcom-6.8.0/drivers/infiniband/sw/rxe/rxe.c
@@ -33,6 +33,8 @@
 
 	if (rxe->tfm)
 		crypto_free_shash(rxe->tfm);
+
+	mutex_destroy(&rxe->usdev_lock);
 }
 
 /* initialize rxe device parameters */
--- linux-qcom-6.8.0.orig/drivers/infiniband/sw/rxe/rxe_comp.c
+++ linux-qcom-6.8.0/drivers/infiniband/sw/rxe/rxe_comp.c
@@ -131,12 +131,12 @@
 {
 	int must_sched;
 
-	skb_queue_tail(&qp->resp_pkts, skb);
-
-	must_sched = skb_queue_len(&qp->resp_pkts) > 1;
+	must_sched = skb_queue_len(&qp->resp_pkts) > 0;
 	if (must_sched != 0)
 		rxe_counter_inc(SKB_TO_PKT(skb)->rxe, RXE_CNT_COMPLETER_SCHED);
 
+	skb_queue_tail(&qp->resp_pkts, skb);
+
 	if (must_sched)
 		rxe_sched_task(&qp->comp.task);
 	else
--- linux-qcom-6.8.0.orig/drivers/infiniband/sw/rxe/rxe_net.c
+++ linux-qcom-6.8.0/drivers/infiniband/sw/rxe/rxe_net.c
@@ -366,18 +366,10 @@
 	rxe_get(pkt->qp);
 	atomic_inc(&pkt->qp->skb_out);
 
-	if (skb->protocol == htons(ETH_P_IP)) {
+	if (skb->protocol == htons(ETH_P_IP))
 		err = ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
-	} else if (skb->protocol == htons(ETH_P_IPV6)) {
+	else
 		err = ip6_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
-	} else {
-		rxe_dbg_qp(pkt->qp, "Unknown layer 3 protocol: %d\n",
-				skb->protocol);
-		atomic_dec(&pkt->qp->skb_out);
-		rxe_put(pkt->qp);
-		kfree_skb(skb);
-		return -EINVAL;
-	}
 
 	if (unlikely(net_xmit_eval(err))) {
 		rxe_dbg_qp(pkt->qp, "error sending packet: %d\n", err);
--- linux-qcom-6.8.0.orig/drivers/infiniband/sw/rxe/rxe_qp.c
+++ linux-qcom-6.8.0/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -781,6 +781,7 @@
 	 * Yield the processor
 	 */
 	spin_lock_irqsave(&qp->state_lock, flags);
+	attr->cur_qp_state = qp_state(qp);
 	if (qp->attr.sq_draining) {
 		spin_unlock_irqrestore(&qp->state_lock, flags);
 		cond_resched();
--- linux-qcom-6.8.0.orig/drivers/infiniband/sw/rxe/rxe_req.c
+++ linux-qcom-6.8.0/drivers/infiniband/sw/rxe/rxe_req.c
@@ -424,7 +424,7 @@
 	int			paylen;
 	int			solicited;
 	u32			qp_num;
-	int			ack_req;
+	int			ack_req = 0;
 
 	/* length from start of bth to end of icrc */
 	paylen = rxe_opcode[opcode].length + payload + pad + RXE_ICRC_SIZE;
@@ -445,8 +445,9 @@
 	qp_num = (pkt->mask & RXE_DETH_MASK) ? ibwr->wr.ud.remote_qpn :
 					 qp->attr.dest_qp_num;
 
-	ack_req = ((pkt->mask & RXE_END_MASK) ||
-		(qp->req.noack_pkts++ > RXE_MAX_PKT_PER_ACK));
+	if (qp_type(qp) != IB_QPT_UD && qp_type(qp) != IB_QPT_UC)
+		ack_req = ((pkt->mask & RXE_END_MASK) ||
+			   (qp->req.noack_pkts++ > RXE_MAX_PKT_PER_ACK));
 	if (ack_req)
 		qp->req.noack_pkts = 0;
 
@@ -692,10 +693,12 @@
 	if (unlikely(qp_state(qp) == IB_QPS_ERR)) {
 		wqe = __req_next_wqe(qp);
 		spin_unlock_irqrestore(&qp->state_lock, flags);
-		if (wqe)
+		if (wqe) {
+			wqe->status = IB_WC_WR_FLUSH_ERR;
 			goto err;
-		else
+		} else {
 			goto exit;
+		}
 	}
 
 	if (unlikely(qp_state(qp) == IB_QPS_RESET)) {
--- linux-qcom-6.8.0.orig/drivers/infiniband/sw/rxe/rxe_resp.c
+++ linux-qcom-6.8.0/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -354,6 +354,19 @@
 	 * receive buffer later. For rmda operations additional
 	 * length checks are performed in check_rkey.
 	 */
+	if ((qp_type(qp) == IB_QPT_GSI) || (qp_type(qp) == IB_QPT_UD)) {
+		unsigned int payload = payload_size(pkt);
+		unsigned int recv_buffer_len = 0;
+		int i;
+
+		for (i = 0; i < qp->resp.wqe->dma.num_sge; i++)
+			recv_buffer_len += qp->resp.wqe->dma.sge[i].length;
+		if (payload + 40 > recv_buffer_len) {
+			rxe_dbg_qp(qp, "The receive buffer is too small for this UD packet.\n");
+			return RESPST_ERR_LENGTH;
+		}
+	}
+
 	if (pkt->mask & RXE_PAYLOAD_MASK && ((qp_type(qp) == IB_QPT_RC) ||
 					     (qp_type(qp) == IB_QPT_UC))) {
 		unsigned int mtu = qp->mtu;
--- linux-qcom-6.8.0.orig/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ linux-qcom-6.8.0/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -812,7 +812,7 @@
 	int i;
 
 	for (i = 0; i < ibwr->num_sge; i++, sge++) {
-		memcpy(p, ib_virt_dma_to_page(sge->addr), sge->length);
+		memcpy(p, ib_virt_dma_to_ptr(sge->addr), sge->length);
 		p += sge->length;
 	}
 }
@@ -888,6 +888,7 @@
 {
 	int err = 0;
 	unsigned long flags;
+	int good = 0;
 
 	spin_lock_irqsave(&qp->sq.sq_lock, flags);
 	while (ibwr) {
@@ -895,12 +896,15 @@
 		if (err) {
 			*bad_wr = ibwr;
 			break;
+		} else {
+			good++;
 		}
 		ibwr = ibwr->next;
 	}
 	spin_unlock_irqrestore(&qp->sq.sq_lock, flags);
 
-	if (!err)
+	/* kickoff processing of any posted wqes */
+	if (good)
 		rxe_sched_task(&qp->req.task);
 
 	spin_lock_irqsave(&qp->state_lock, flags);
--- linux-qcom-6.8.0.orig/drivers/infiniband/sw/siw/siw_qp_tx.c
+++ linux-qcom-6.8.0/drivers/infiniband/sw/siw/siw_qp_tx.c
@@ -331,6 +331,8 @@
 			msg.msg_flags &= ~MSG_MORE;
 
 		tcp_rate_check_app_limited(sk);
+		if (!sendpage_ok(page[i]))
+			msg.msg_flags &= ~MSG_SPLICE_PAGES;
 		bvec_set_page(&bvec, page[i], bytes, offset);
 		iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);
 
--- linux-qcom-6.8.0.orig/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ linux-qcom-6.8.0/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -184,8 +184,12 @@
 
 	ppriv = ipoib_priv(pdev);
 
-	snprintf(intf_name, sizeof(intf_name), "%s.%04x",
-		 ppriv->dev->name, pkey);
+	/* If you increase IFNAMSIZ, update snprintf below
+	 * to allow longer names.
+	 */
+	BUILD_BUG_ON(IFNAMSIZ != 16);
+	snprintf(intf_name, sizeof(intf_name), "%.10s.%04x", ppriv->dev->name,
+		 pkey);
 
 	ndev = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
 	if (IS_ERR(ndev)) {
--- linux-qcom-6.8.0.orig/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+++ linux-qcom-6.8.0/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
@@ -133,7 +133,7 @@
 
 	/* distinguish "mi" and "min-latency" with length */
 	len = strnlen(buf, NAME_MAX);
-	if (buf[len - 1] == '\n')
+	if (len && buf[len - 1] == '\n')
 		len--;
 
 	if (!strncasecmp(buf, "round-robin", 11) ||
--- linux-qcom-6.8.0.orig/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ linux-qcom-6.8.0/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -626,6 +626,7 @@
 		 */
 		if (WARN_ON(wc->wr_cqe->done != rtrs_clt_rdma_done))
 			return;
+		clt_path->s.hb_missed_cnt = 0;
 		rtrs_from_imm(be32_to_cpu(wc->ex.imm_data),
 			       &imm_type, &imm_payload);
 		if (imm_type == RTRS_IO_RSP_IMM ||
@@ -643,7 +644,6 @@
 				return  rtrs_clt_recv_done(con, wc);
 		} else if (imm_type == RTRS_HB_ACK_IMM) {
 			WARN_ON(con->c.cid);
-			clt_path->s.hb_missed_cnt = 0;
 			clt_path->s.hb_cur_latency =
 				ktime_sub(ktime_get(), clt_path->s.hb_last_sent);
 			if (clt_path->flags & RTRS_MSG_NEW_RKEY_F)
@@ -670,6 +670,7 @@
 		/*
 		 * Key invalidations from server side
 		 */
+		clt_path->s.hb_missed_cnt = 0;
 		WARN_ON(!(wc->wc_flags & IB_WC_WITH_INVALIDATE ||
 			  wc->wc_flags & IB_WC_WITH_IMM));
 		WARN_ON(wc->wr_cqe->done != rtrs_clt_rdma_done);
@@ -2346,6 +2347,12 @@
 		if (err)
 			goto destroy;
 	}
+
+	/*
+	 * Set the cid to con_num - 1, since if we fail later, we want to stay in bounds.
+	 */
+	cid = clt_path->s.con_num - 1;
+
 	err = alloc_path_reqs(clt_path);
 	if (err)
 		goto destroy;
--- linux-qcom-6.8.0.orig/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+++ linux-qcom-6.8.0/drivers/infiniband/ulp/rtrs/rtrs-srv.c
@@ -346,6 +346,7 @@
 	struct rtrs_srv_mr *srv_mr;
 	bool need_inval = false;
 	enum ib_send_flags flags;
+	struct ib_sge list;
 	u32 imm;
 	int err;
 
@@ -398,7 +399,6 @@
 	imm = rtrs_to_io_rsp_imm(id->msg_id, errno, need_inval);
 	imm_wr.wr.next = NULL;
 	if (always_invalidate) {
-		struct ib_sge list;
 		struct rtrs_msg_rkey_rsp *msg;
 
 		srv_mr = &srv_path->mrs[id->msg_id];
@@ -931,12 +931,11 @@
 	if (err)
 		goto close;
 
-out:
 	rtrs_iu_free(iu, srv_path->s.dev->ib_dev, 1);
 	return;
 close:
+	rtrs_iu_free(iu, srv_path->s.dev->ib_dev, 1);
 	close_path(srv_path);
-	goto out;
 }
 
 static int post_recv_info_req(struct rtrs_srv_con *con)
@@ -987,6 +986,16 @@
 			q_size = SERVICE_CON_QUEUE_DEPTH;
 		else
 			q_size = srv->queue_depth;
+		if (srv_path->state != RTRS_SRV_CONNECTING) {
+			rtrs_err(s, "Path state invalid. state %s\n",
+				 rtrs_srv_state_str(srv_path->state));
+			return -EIO;
+		}
+
+		if (!srv_path->s.con[cid]) {
+			rtrs_err(s, "Conn not set for %d\n", cid);
+			return -EIO;
+		}
 
 		err = post_recv_io(to_srv_con(srv_path->s.con[cid]), q_size);
 		if (err) {
@@ -1229,6 +1238,7 @@
 		 */
 		if (WARN_ON(wc->wr_cqe != &io_comp_cqe))
 			return;
+		srv_path->s.hb_missed_cnt = 0;
 		err = rtrs_post_recv_empty(&con->c, &io_comp_cqe);
 		if (err) {
 			rtrs_err(s, "rtrs_post_recv(), err: %d\n", err);
--- linux-qcom-6.8.0.orig/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ linux-qcom-6.8.0/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -68,6 +68,8 @@
 static u64 srpt_service_guid;
 static DEFINE_SPINLOCK(srpt_dev_lock);	/* Protects srpt_dev_list. */
 static LIST_HEAD(srpt_dev_list);	/* List of srpt_device structures. */
+static DEFINE_MUTEX(srpt_mc_mutex);	/* Protects srpt_memory_caches. */
+static DEFINE_XARRAY(srpt_memory_caches); /* See also srpt_memory_cache_entry */
 
 static unsigned srp_max_req_size = DEFAULT_MAX_REQ_SIZE;
 module_param(srp_max_req_size, int, 0444);
@@ -105,6 +107,63 @@
 static void srpt_send_done(struct ib_cq *cq, struct ib_wc *wc);
 static void srpt_process_wait_list(struct srpt_rdma_ch *ch);
 
+/* Type of the entries in srpt_memory_caches. */
+struct srpt_memory_cache_entry {
+	refcount_t ref;
+	struct kmem_cache *c;
+};
+
+static struct kmem_cache *srpt_cache_get(unsigned int object_size)
+{
+	struct srpt_memory_cache_entry *e;
+	char name[32];
+	void *res;
+
+	guard(mutex)(&srpt_mc_mutex);
+	e = xa_load(&srpt_memory_caches, object_size);
+	if (e) {
+		refcount_inc(&e->ref);
+		return e->c;
+	}
+	snprintf(name, sizeof(name), "srpt-%u", object_size);
+	e = kmalloc(sizeof(*e), GFP_KERNEL);
+	if (!e)
+		return NULL;
+	refcount_set(&e->ref, 1);
+	e->c = kmem_cache_create(name, object_size, /*align=*/512, 0, NULL);
+	if (!e->c)
+		goto free_entry;
+	res = xa_store(&srpt_memory_caches, object_size, e, GFP_KERNEL);
+	if (xa_is_err(res))
+		goto destroy_cache;
+	return e->c;
+
+destroy_cache:
+	kmem_cache_destroy(e->c);
+
+free_entry:
+	kfree(e);
+	return NULL;
+}
+
+static void srpt_cache_put(struct kmem_cache *c)
+{
+	struct srpt_memory_cache_entry *e = NULL;
+	unsigned long object_size;
+
+	guard(mutex)(&srpt_mc_mutex);
+	xa_for_each(&srpt_memory_caches, object_size, e)
+		if (e->c == c)
+			break;
+	if (WARN_ON_ONCE(!e))
+		return;
+	if (!refcount_dec_and_test(&e->ref))
+		return;
+	WARN_ON_ONCE(xa_erase(&srpt_memory_caches, object_size) != e);
+	kmem_cache_destroy(e->c);
+	kfree(e);
+}
+
 /*
  * The only allowed channel state changes are those that change the channel
  * state into a state with a higher numerical value. Hence the new > prev test.
@@ -2119,13 +2178,13 @@
 			     ch->sport->sdev, ch->rq_size,
 			     ch->rsp_buf_cache, DMA_TO_DEVICE);
 
-	kmem_cache_destroy(ch->rsp_buf_cache);
+	srpt_cache_put(ch->rsp_buf_cache);
 
 	srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_recv_ring,
 			     sdev, ch->rq_size,
 			     ch->req_buf_cache, DMA_FROM_DEVICE);
 
-	kmem_cache_destroy(ch->req_buf_cache);
+	srpt_cache_put(ch->req_buf_cache);
 
 	kref_put(&ch->kref, srpt_free_ch);
 }
@@ -2245,8 +2304,7 @@
 	INIT_LIST_HEAD(&ch->cmd_wait_list);
 	ch->max_rsp_size = ch->sport->port_attrib.srp_max_rsp_size;
 
-	ch->rsp_buf_cache = kmem_cache_create("srpt-rsp-buf", ch->max_rsp_size,
-					      512, 0, NULL);
+	ch->rsp_buf_cache = srpt_cache_get(ch->max_rsp_size);
 	if (!ch->rsp_buf_cache)
 		goto free_ch;
 
@@ -2280,8 +2338,7 @@
 		alignment_offset = round_up(imm_data_offset, 512) -
 			imm_data_offset;
 		req_sz = alignment_offset + imm_data_offset + srp_max_req_size;
-		ch->req_buf_cache = kmem_cache_create("srpt-req-buf", req_sz,
-						      512, 0, NULL);
+		ch->req_buf_cache = srpt_cache_get(req_sz);
 		if (!ch->req_buf_cache)
 			goto free_rsp_ring;
 
@@ -2478,7 +2535,7 @@
 			     ch->req_buf_cache, DMA_FROM_DEVICE);
 
 free_recv_cache:
-	kmem_cache_destroy(ch->req_buf_cache);
+	srpt_cache_put(ch->req_buf_cache);
 
 free_rsp_ring:
 	srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring,
@@ -2486,7 +2543,7 @@
 			     ch->rsp_buf_cache, DMA_TO_DEVICE);
 
 free_rsp_cache:
-	kmem_cache_destroy(ch->rsp_buf_cache);
+	srpt_cache_put(ch->rsp_buf_cache);
 
 free_ch:
 	if (rdma_cm_id)
@@ -3055,7 +3112,7 @@
 	srpt_free_ioctx_ring((struct srpt_ioctx **)sdev->ioctx_ring, sdev,
 			     sdev->srq_size, sdev->req_buf_cache,
 			     DMA_FROM_DEVICE);
-	kmem_cache_destroy(sdev->req_buf_cache);
+	srpt_cache_put(sdev->req_buf_cache);
 	sdev->srq = NULL;
 }
 
@@ -3082,8 +3139,7 @@
 	pr_debug("create SRQ #wr= %d max_allow=%d dev= %s\n", sdev->srq_size,
 		 sdev->device->attrs.max_srq_wr, dev_name(&device->dev));
 
-	sdev->req_buf_cache = kmem_cache_create("srpt-srq-req-buf",
-						srp_max_req_size, 0, 0, NULL);
+	sdev->req_buf_cache = srpt_cache_get(srp_max_req_size);
 	if (!sdev->req_buf_cache)
 		goto free_srq;
 
@@ -3105,7 +3161,7 @@
 	return 0;
 
 free_cache:
-	kmem_cache_destroy(sdev->req_buf_cache);
+	srpt_cache_put(sdev->req_buf_cache);
 
 free_srq:
 	ib_destroy_srq(srq);
@@ -3209,7 +3265,6 @@
 
 	INIT_IB_EVENT_HANDLER(&sdev->event_handler, sdev->device,
 			      srpt_event_handler);
-	ib_register_event_handler(&sdev->event_handler);
 
 	for (i = 1; i <= sdev->device->phys_port_cnt; i++) {
 		sport = &sdev->port[i - 1];
@@ -3232,6 +3287,7 @@
 		}
 	}
 
+	ib_register_event_handler(&sdev->event_handler);
 	spin_lock(&srpt_dev_lock);
 	list_add_tail(&sdev->list, &srpt_dev_list);
 	spin_unlock(&srpt_dev_lock);
@@ -3242,7 +3298,6 @@
 
 err_port:
 	srpt_unregister_mad_agent(sdev, i);
-	ib_unregister_event_handler(&sdev->event_handler);
 err_cm:
 	if (sdev->cm_id)
 		ib_destroy_cm_id(sdev->cm_id);
--- linux-qcom-6.8.0.orig/drivers/input/ff-core.c
+++ linux-qcom-6.8.0/drivers/input/ff-core.c
@@ -9,8 +9,10 @@
 /* #define DEBUG */
 
 #include <linux/input.h>
+#include <linux/limits.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/overflow.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 
@@ -315,9 +317,8 @@
 		return -EINVAL;
 	}
 
-	ff_dev_size = sizeof(struct ff_device) +
-				max_effects * sizeof(struct file *);
-	if (ff_dev_size < max_effects) /* overflow */
+	ff_dev_size = struct_size(ff, effect_owners, max_effects);
+	if (ff_dev_size == SIZE_MAX) /* overflow */
 		return -EINVAL;
 
 	ff = kzalloc(ff_dev_size, GFP_KERNEL);
--- linux-qcom-6.8.0.orig/drivers/input/input-mt.c
+++ linux-qcom-6.8.0/drivers/input/input-mt.c
@@ -46,6 +46,9 @@
 		return 0;
 	if (mt)
 		return mt->num_slots != num_slots ? -EINVAL : 0;
+	/* Arbitrary limit for avoiding too large memory allocation. */
+	if (num_slots > 1024)
+		return -EINVAL;
 
 	mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL);
 	if (!mt)
--- linux-qcom-6.8.0.orig/drivers/input/input.c
+++ linux-qcom-6.8.0/drivers/input/input.c
@@ -1378,19 +1378,19 @@
 				     char name, const unsigned long *bm,
 				     unsigned int min_bit, unsigned int max_bit)
 {
-	int len = 0, i;
+	int bit = min_bit;
+	int len = 0;
 
 	len += snprintf(buf, max(size, 0), "%c", name);
-	for (i = min_bit; i < max_bit; i++)
-		if (bm[BIT_WORD(i)] & BIT_MASK(i))
-			len += snprintf(buf + len, max(size - len, 0), "%X,", i);
+	for_each_set_bit_from(bit, bm, max_bit)
+		len += snprintf(buf + len, max(size - len, 0), "%X,", bit);
 	return len;
 }
 
-static int input_print_modalias(char *buf, int size, const struct input_dev *id,
-				int add_cr)
+static int input_print_modalias_parts(char *buf, int size, int full_len,
+				      const struct input_dev *id)
 {
-	int len;
+	int len, klen, remainder, space;
 
 	len = snprintf(buf, max(size, 0),
 		       "input:b%04Xv%04Xp%04Xe%04X-",
@@ -1399,8 +1399,48 @@
 
 	len += input_print_modalias_bits(buf + len, size - len,
 				'e', id->evbit, 0, EV_MAX);
-	len += input_print_modalias_bits(buf + len, size - len,
+
+	/*
+	 * Calculate the remaining space in the buffer making sure we
+	 * have place for the terminating 0.
+	 */
+	space = max(size - (len + 1), 0);
+
+	klen = input_print_modalias_bits(buf + len, size - len,
 				'k', id->keybit, KEY_MIN_INTERESTING, KEY_MAX);
+	len += klen;
+
+	/*
+	 * If we have more data than we can fit in the buffer, check
+	 * if we can trim key data to fit in the rest. We will indicate
+	 * that key data is incomplete by adding "+" sign at the end, like
+	 * this: * "k1,2,3,45,+,".
+	 *
+	 * Note that we shortest key info (if present) is "k+," so we
+	 * can only try to trim if key data is longer than that.
+	 */
+	if (full_len && size < full_len + 1 && klen > 3) {
+		remainder = full_len - len;
+		/*
+		 * We can only trim if we have space for the remainder
+		 * and also for at least "k+," which is 3 more characters.
+		 */
+		if (remainder <= space - 3) {
+			/*
+			 * We are guaranteed to have 'k' in the buffer, so
+			 * we need at least 3 additional bytes for storing
+			 * "+," in addition to the remainder.
+			 */
+			for (int i = size - 1 - remainder - 3; i >= 0; i--) {
+				if (buf[i] == 'k' || buf[i] == ',') {
+					strcpy(buf + i + 1, "+,");
+					len = i + 3; /* Not counting '\0' */
+					break;
+				}
+			}
+		}
+	}
+
 	len += input_print_modalias_bits(buf + len, size - len,
 				'r', id->relbit, 0, REL_MAX);
 	len += input_print_modalias_bits(buf + len, size - len,
@@ -1416,12 +1456,25 @@
 	len += input_print_modalias_bits(buf + len, size - len,
 				'w', id->swbit, 0, SW_MAX);
 
-	if (add_cr)
-		len += snprintf(buf + len, max(size - len, 0), "\n");
-
 	return len;
 }
 
+static int input_print_modalias(char *buf, int size, const struct input_dev *id)
+{
+	int full_len;
+
+	/*
+	 * Printing is done in 2 passes: first one figures out total length
+	 * needed for the modalias string, second one will try to trim key
+	 * data in case when buffer is too small for the entire modalias.
+	 * If the buffer is too small regardless, it will fill as much as it
+	 * can (without trimming key data) into the buffer and leave it to
+	 * the caller to figure out what to do with the result.
+	 */
+	full_len = input_print_modalias_parts(NULL, 0, 0, id);
+	return input_print_modalias_parts(buf, size, full_len, id);
+}
+
 static ssize_t input_dev_show_modalias(struct device *dev,
 				       struct device_attribute *attr,
 				       char *buf)
@@ -1429,7 +1482,9 @@
 	struct input_dev *id = to_input_dev(dev);
 	ssize_t len;
 
-	len = input_print_modalias(buf, PAGE_SIZE, id, 1);
+	len = input_print_modalias(buf, PAGE_SIZE, id);
+	if (len < PAGE_SIZE - 2)
+		len += snprintf(buf + len, PAGE_SIZE - len, "\n");
 
 	return min_t(int, len, PAGE_SIZE);
 }
@@ -1641,6 +1696,23 @@
 	return 0;
 }
 
+/*
+ * This is a pretty gross hack. When building uevent data the driver core
+ * may try adding more environment variables to kobj_uevent_env without
+ * telling us, so we have no idea how much of the buffer we can use to
+ * avoid overflows/-ENOMEM elsewhere. To work around this let's artificially
+ * reduce amount of memory we will use for the modalias environment variable.
+ *
+ * The potential additions are:
+ *
+ * SEQNUM=18446744073709551615 - (%llu - 28 bytes)
+ * HOME=/ (6 bytes)
+ * PATH=/sbin:/bin:/usr/sbin:/usr/bin (34 bytes)
+ *
+ * 68 bytes total. Allow extra buffer - 96 bytes
+ */
+#define UEVENT_ENV_EXTRA_LEN	96
+
 static int input_add_uevent_modalias_var(struct kobj_uevent_env *env,
 					 const struct input_dev *dev)
 {
@@ -1650,9 +1722,11 @@
 		return -ENOMEM;
 
 	len = input_print_modalias(&env->buf[env->buflen - 1],
-				   sizeof(env->buf) - env->buflen,
-				   dev, 0);
-	if (len >= (sizeof(env->buf) - env->buflen))
+				   (int)sizeof(env->buf) - env->buflen -
+					UEVENT_ENV_EXTRA_LEN,
+				   dev);
+	if (len >= ((int)sizeof(env->buf) - env->buflen -
+					UEVENT_ENV_EXTRA_LEN))
 		return -ENOMEM;
 
 	env->buflen += len;
--- linux-qcom-6.8.0.orig/drivers/input/joystick/xpad.c
+++ linux-qcom-6.8.0/drivers/input/joystick/xpad.c
@@ -127,6 +127,7 @@
 	u8 mapping;
 	u8 xtype;
 } xpad_device[] = {
+	/* Please keep this list sorted by vendor and product ID. */
 	{ 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 },
 	{ 0x03eb, 0xff01, "Wooting One (Legacy)", 0, XTYPE_XBOX360 },
 	{ 0x03eb, 0xff02, "Wooting Two (Legacy)", 0, XTYPE_XBOX360 },
@@ -149,12 +150,13 @@
 	{ 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 },
 	{ 0x045e, 0x028f, "Microsoft X-Box 360 pad v2", 0, XTYPE_XBOX360 },
 	{ 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
+	{ 0x045e, 0x02a9, "Xbox 360 Wireless Receiver (Unofficial)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
 	{ 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE },
 	{ 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE },
 	{ 0x045e, 0x02e3, "Microsoft X-Box One Elite pad", MAP_PADDLES, XTYPE_XBOXONE },
-	{ 0x045e, 0x0b00, "Microsoft X-Box One Elite 2 pad", MAP_PADDLES, XTYPE_XBOXONE },
 	{ 0x045e, 0x02ea, "Microsoft X-Box One S pad", 0, XTYPE_XBOXONE },
 	{ 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
+	{ 0x045e, 0x0b00, "Microsoft X-Box One Elite 2 pad", MAP_PADDLES, XTYPE_XBOXONE },
 	{ 0x045e, 0x0b0a, "Microsoft X-Box Adaptive Controller", MAP_PROFILE_BUTTON, XTYPE_XBOXONE },
 	{ 0x045e, 0x0b12, "Microsoft Xbox Series S|X Controller", MAP_SELECT_BUTTON, XTYPE_XBOXONE },
 	{ 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 },
@@ -207,6 +209,8 @@
 	{ 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 },
 	{ 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 },
 	{ 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 },
+	{ 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", 0, XTYPE_XBOXONE },
+	{ 0x0b05, 0x1abb, "ASUS ROG RAIKIRI PRO", 0, XTYPE_XBOXONE },
 	{ 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX },
 	{ 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX },
 	{ 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX },
@@ -215,6 +219,7 @@
 	{ 0x0c12, 0x8810, "Zeroplus Xbox Controller", 0, XTYPE_XBOX },
 	{ 0x0c12, 0x9902, "HAMA VibraX - *FAULTY HARDWARE*", 0, XTYPE_XBOX },
 	{ 0x0d2f, 0x0002, "Andamiro Pump It Up pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
+	{ 0x0db0, 0x1901, "Micro Star International Xbox360 Controller for Windows", 0, XTYPE_XBOX360 },
 	{ 0x0e4c, 0x1097, "Radica Gamester Controller", 0, XTYPE_XBOX },
 	{ 0x0e4c, 0x1103, "Radica Gamester Reflex", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX },
 	{ 0x0e4c, 0x2390, "Radica Games Jtech Controller", 0, XTYPE_XBOX },
@@ -301,6 +306,7 @@
 	{ 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 },
 	{ 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 },
 	{ 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 },
+	{ 0x1a86, 0xe310, "QH Electronics Controller", 0, XTYPE_XBOX360 },
 	{ 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 },
 	{ 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
@@ -340,7 +346,6 @@
 	{ 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
 	{ 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE },
 	{ 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
-	{ 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
 	{ 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 },
 	{ 0x24c6, 0x5303, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
@@ -355,9 +360,9 @@
 	{ 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x24c6, 0x5503, "Hori Fighting Edge", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 },
-	{ 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 },
 	{ 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+	{ 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE },
 	{ 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE },
 	{ 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
@@ -366,15 +371,22 @@
 	{ 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 },
 	{ 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
 	{ 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 },
+	{ 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE },
+	{ 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE },
 	{ 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE },
-	{ 0x2dc8, 0x3106, "8BitDo Pro 2 Wired Controller", 0, XTYPE_XBOX360 },
+	{ 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 },
+	{ 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 },
+	{ 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
 	{ 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 },
 	{ 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 },
 	{ 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 },
 	{ 0x31e3, 0x1220, "Wooting Two HE", 0, XTYPE_XBOX360 },
+	{ 0x31e3, 0x1230, "Wooting Two HE (ARM)", 0, XTYPE_XBOX360 },
 	{ 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 },
 	{ 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 },
 	{ 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 },
+	{ 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE },
+	{ 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE },
 	{ 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
 	{ 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
 	{ 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
@@ -465,6 +477,10 @@
 	{ XPAD_XBOXONE_VENDOR_PROTOCOL((vend), 208) }
 
 static const struct usb_device_id xpad_table[] = {
+	/*
+	 * Please keep this list sorted by vendor ID. Note that there are 2
+	 * macros - XPAD_XBOX360_VENDOR and XPAD_XBOXONE_VENDOR.
+	 */
 	{ USB_INTERFACE_INFO('X', 'B', 0) },	/* Xbox USB-IF not-approved class */
 	XPAD_XBOX360_VENDOR(0x0079),		/* GPD Win 2 controller */
 	XPAD_XBOX360_VENDOR(0x03eb),		/* Wooting Keyboards (Legacy) */
@@ -480,7 +496,9 @@
 	{ USB_DEVICE(0x0738, 0x4540) },		/* Mad Catz Beat Pad */
 	XPAD_XBOXONE_VENDOR(0x0738),		/* Mad Catz FightStick TE 2 */
 	XPAD_XBOX360_VENDOR(0x07ff),		/* Mad Catz Gamepad */
+	XPAD_XBOXONE_VENDOR(0x0b05),		/* ASUS controllers */
 	XPAD_XBOX360_VENDOR(0x0c12),		/* Zeroplus X-Box 360 controllers */
+	XPAD_XBOX360_VENDOR(0x0db0),		/* Micro Star International X-Box 360 controllers */
 	XPAD_XBOX360_VENDOR(0x0e6f),		/* 0x0e6f Xbox 360 controllers */
 	XPAD_XBOXONE_VENDOR(0x0e6f),		/* 0x0e6f Xbox One controllers */
 	XPAD_XBOX360_VENDOR(0x0f0d),		/* Hori controllers */
@@ -500,6 +518,7 @@
 	XPAD_XBOX360_VENDOR(0x1689),		/* Razer Onza */
 	XPAD_XBOX360_VENDOR(0x17ef),		/* Lenovo */
 	XPAD_XBOX360_VENDOR(0x1949),		/* Amazon controllers */
+	XPAD_XBOX360_VENDOR(0x1a86),		/* QH Electronics */
 	XPAD_XBOX360_VENDOR(0x1bad),		/* Harmonix Rock Band guitar and drums */
 	XPAD_XBOX360_VENDOR(0x20d6),		/* PowerA controllers */
 	XPAD_XBOXONE_VENDOR(0x20d6),		/* PowerA controllers */
@@ -507,6 +526,7 @@
 	XPAD_XBOXONE_VENDOR(0x24c6),		/* PowerA controllers */
 	XPAD_XBOX360_VENDOR(0x2563),		/* OneXPlayer Gamepad */
 	XPAD_XBOX360_VENDOR(0x260d),		/* Dareu H101 */
+       XPAD_XBOXONE_VENDOR(0x294b),            /* Snakebyte */
 	XPAD_XBOX360_VENDOR(0x2c22),		/* Qanba Controllers */
 	XPAD_XBOX360_VENDOR(0x2dc8),            /* 8BitDo Pro 2 Wired Controller */
 	XPAD_XBOXONE_VENDOR(0x2dc8),		/* 8BitDo Pro 2 Wired Controller for Xbox */
@@ -514,6 +534,7 @@
 	XPAD_XBOX360_VENDOR(0x2f24),		/* GameSir controllers */
 	XPAD_XBOX360_VENDOR(0x31e3),		/* Wooting Keyboards */
 	XPAD_XBOX360_VENDOR(0x3285),		/* Nacon GC-100 */
+	XPAD_XBOXONE_VENDOR(0x3285),		/* Nacon Evol-X */
 	XPAD_XBOX360_VENDOR(0x3537),		/* GameSir Controllers */
 	XPAD_XBOXONE_VENDOR(0x3537),		/* GameSir Controllers */
 	{ }
--- linux-qcom-6.8.0.orig/drivers/input/keyboard/adp5588-keys.c
+++ linux-qcom-6.8.0/drivers/input/keyboard/adp5588-keys.c
@@ -627,7 +627,7 @@
 
 	for (i = 0; i < KEYP_MAX_EVENT; i++) {
 		ret = adp5588_read(client, KEY_EVENTA);
-		if (ret)
+		if (ret < 0)
 			return ret;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/input/keyboard/adp5589-keys.c
+++ linux-qcom-6.8.0/drivers/input/keyboard/adp5589-keys.c
@@ -391,10 +391,17 @@
 	struct adp5589_kpad *kpad = gpiochip_get_data(chip);
 	unsigned int bank = kpad->var->bank(kpad->gpiomap[off]);
 	unsigned int bit = kpad->var->bit(kpad->gpiomap[off]);
+	int val;
 
-	return !!(adp5589_read(kpad->client,
-			       kpad->var->reg(ADP5589_GPI_STATUS_A) + bank) &
-			       bit);
+	mutex_lock(&kpad->gpio_lock);
+	if (kpad->dir[bank] & bit)
+		val = kpad->dat_out[bank];
+	else
+		val = adp5589_read(kpad->client,
+				   kpad->var->reg(ADP5589_GPI_STATUS_A) + bank);
+	mutex_unlock(&kpad->gpio_lock);
+
+	return !!(val & bit);
 }
 
 static void adp5589_gpio_set_value(struct gpio_chip *chip,
@@ -936,10 +943,9 @@
 
 static void adp5589_clear_config(void *data)
 {
-	struct i2c_client *client = data;
-	struct adp5589_kpad *kpad = i2c_get_clientdata(client);
+	struct adp5589_kpad *kpad = data;
 
-	adp5589_write(client, kpad->var->reg(ADP5589_GENERAL_CFG), 0);
+	adp5589_write(kpad->client, kpad->var->reg(ADP5589_GENERAL_CFG), 0);
 }
 
 static int adp5589_probe(struct i2c_client *client)
@@ -983,7 +989,7 @@
 	}
 
 	error = devm_add_action_or_reset(&client->dev, adp5589_clear_config,
-					 client);
+					 kpad);
 	if (error)
 		return error;
 
@@ -1010,8 +1016,6 @@
 	if (error)
 		return error;
 
-	i2c_set_clientdata(client, kpad);
-
 	dev_info(&client->dev, "Rev.%d keypad, irq %d\n", revid, client->irq);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/input/keyboard/atkbd.c
+++ linux-qcom-6.8.0/drivers/input/keyboard/atkbd.c
@@ -89,7 +89,7 @@
 	  0, 46, 45, 32, 18,  5,  4, 95,  0, 57, 47, 33, 20, 19,  6,183,
 	  0, 49, 48, 35, 34, 21,  7,184,  0,  0, 50, 36, 22,  8,  9,185,
 	  0, 51, 37, 23, 24, 11, 10,  0,  0, 52, 53, 38, 39, 25, 12,  0,
-	  0, 89, 40,  0, 26, 13,  0,  0, 58, 54, 28, 27,  0, 43,  0, 85,
+	  0, 89, 40,  0, 26, 13,  0,193, 58, 54, 28, 27,  0, 43,  0, 85,
 	  0, 86, 91, 90, 92,  0, 14, 94,  0, 79,124, 75, 71,121,  0,  0,
 	 82, 83, 80, 76, 77, 72,  1, 69, 87, 78, 81, 74, 55, 73, 70, 99,
 
--- linux-qcom-6.8.0.orig/drivers/input/keyboard/qt1050.c
+++ linux-qcom-6.8.0/drivers/input/keyboard/qt1050.c
@@ -226,7 +226,12 @@
 	int err;
 
 	/* Read Chip ID */
-	regmap_read(ts->regmap, QT1050_CHIP_ID, &val);
+	err = regmap_read(ts->regmap, QT1050_CHIP_ID, &val);
+	if (err) {
+		dev_err(&ts->client->dev, "Failed to read chip ID: %d\n", err);
+		return false;
+	}
+
 	if (val != QT1050_CHIP_ID_VER) {
 		dev_err(&ts->client->dev, "ID %d not supported\n", val);
 		return false;
--- linux-qcom-6.8.0.orig/drivers/input/misc/ims-pcu.c
+++ linux-qcom-6.8.0/drivers/input/misc/ims-pcu.c
@@ -42,8 +42,8 @@
 #define IMS_PCU_PART_NUMBER_LEN		15
 #define IMS_PCU_SERIAL_NUMBER_LEN	8
 #define IMS_PCU_DOM_LEN			8
-#define IMS_PCU_FW_VERSION_LEN		(9 + 1)
-#define IMS_PCU_BL_VERSION_LEN		(9 + 1)
+#define IMS_PCU_FW_VERSION_LEN		16
+#define IMS_PCU_BL_VERSION_LEN		16
 #define IMS_PCU_BL_RESET_REASON_LEN	(2 + 1)
 
 #define IMS_PCU_PCU_B_DEVICE_ID		5
--- linux-qcom-6.8.0.orig/drivers/input/misc/iqs7222.c
+++ linux-qcom-6.8.0/drivers/input/misc/iqs7222.c
@@ -622,6 +622,118 @@
 	},
 	{
 		.prod_num = IQS7222_PROD_NUM_D,
+		.fw_major = 1,
+		.fw_minor = 2,
+		.touch_link = 1770,
+		.allow_offset = 9,
+		.event_offset = 10,
+		.comms_offset = 11,
+		.reg_grps = {
+			[IQS7222_REG_GRP_STAT] = {
+				.base = IQS7222_SYS_STATUS,
+				.num_row = 1,
+				.num_col = 7,
+			},
+			[IQS7222_REG_GRP_CYCLE] = {
+				.base = 0x8000,
+				.num_row = 7,
+				.num_col = 2,
+			},
+			[IQS7222_REG_GRP_GLBL] = {
+				.base = 0x8700,
+				.num_row = 1,
+				.num_col = 3,
+			},
+			[IQS7222_REG_GRP_BTN] = {
+				.base = 0x9000,
+				.num_row = 14,
+				.num_col = 3,
+			},
+			[IQS7222_REG_GRP_CHAN] = {
+				.base = 0xA000,
+				.num_row = 14,
+				.num_col = 4,
+			},
+			[IQS7222_REG_GRP_FILT] = {
+				.base = 0xAE00,
+				.num_row = 1,
+				.num_col = 2,
+			},
+			[IQS7222_REG_GRP_TPAD] = {
+				.base = 0xB000,
+				.num_row = 1,
+				.num_col = 24,
+			},
+			[IQS7222_REG_GRP_GPIO] = {
+				.base = 0xC000,
+				.num_row = 3,
+				.num_col = 3,
+			},
+			[IQS7222_REG_GRP_SYS] = {
+				.base = IQS7222_SYS_SETUP,
+				.num_row = 1,
+				.num_col = 12,
+			},
+		},
+	},
+	{
+		.prod_num = IQS7222_PROD_NUM_D,
+		.fw_major = 1,
+		.fw_minor = 1,
+		.touch_link = 1774,
+		.allow_offset = 9,
+		.event_offset = 10,
+		.comms_offset = 11,
+		.reg_grps = {
+			[IQS7222_REG_GRP_STAT] = {
+				.base = IQS7222_SYS_STATUS,
+				.num_row = 1,
+				.num_col = 7,
+			},
+			[IQS7222_REG_GRP_CYCLE] = {
+				.base = 0x8000,
+				.num_row = 7,
+				.num_col = 2,
+			},
+			[IQS7222_REG_GRP_GLBL] = {
+				.base = 0x8700,
+				.num_row = 1,
+				.num_col = 3,
+			},
+			[IQS7222_REG_GRP_BTN] = {
+				.base = 0x9000,
+				.num_row = 14,
+				.num_col = 3,
+			},
+			[IQS7222_REG_GRP_CHAN] = {
+				.base = 0xA000,
+				.num_row = 14,
+				.num_col = 4,
+			},
+			[IQS7222_REG_GRP_FILT] = {
+				.base = 0xAE00,
+				.num_row = 1,
+				.num_col = 2,
+			},
+			[IQS7222_REG_GRP_TPAD] = {
+				.base = 0xB000,
+				.num_row = 1,
+				.num_col = 24,
+			},
+			[IQS7222_REG_GRP_GPIO] = {
+				.base = 0xC000,
+				.num_row = 3,
+				.num_col = 3,
+			},
+			[IQS7222_REG_GRP_SYS] = {
+				.base = IQS7222_SYS_SETUP,
+				.num_row = 1,
+				.num_col = 12,
+			},
+		},
+	},
+	{
+		.prod_num = IQS7222_PROD_NUM_D,
 		.fw_major = 0,
 		.fw_minor = 37,
 		.touch_link = 1770,
--- linux-qcom-6.8.0.orig/drivers/input/misc/pm8xxx-vibrator.c
+++ linux-qcom-6.8.0/drivers/input/misc/pm8xxx-vibrator.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2010-2011, Code Aurora Forum. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/errno.h>
@@ -11,36 +12,61 @@
 #include <linux/regmap.h>
 #include <linux/slab.h>
 
+#define SSBI_VIB_DRV_REG		0x4A
+#define SSBI_VIB_DRV_EN_MANUAL_MASK	GENMASK(7, 2)
+#define SSBI_VIB_DRV_LEVEL_MASK		GENMASK(7, 3)
+#define SSBI_VIB_DRV_SHIFT		3
+
+#define SPMI_VIB_DRV_REG		0x41
+#define SPMI_VIB_DRV_LEVEL_MASK		GENMASK(4, 0)
+#define SPMI_VIB_DRV_SHIFT		0
+
+#define SPMI_VIB_GEN2_DRV_REG		0x40
+#define SPMI_VIB_GEN2_DRV_MASK		GENMASK(7, 0)
+#define SPMI_VIB_GEN2_DRV_SHIFT		0
+#define SPMI_VIB_GEN2_DRV2_REG		0x41
+#define SPMI_VIB_GEN2_DRV2_MASK		GENMASK(3, 0)
+#define SPMI_VIB_GEN2_DRV2_SHIFT	8
+
+#define SPMI_VIB_EN_REG			0x46
+#define SPMI_VIB_EN_BIT			BIT(7)
+
 #define VIB_MAX_LEVEL_mV	(3100)
 #define VIB_MIN_LEVEL_mV	(1200)
-#define VIB_MAX_LEVELS		(VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV)
+#define VIB_PER_STEP_mV		(100)
+#define VIB_MAX_LEVELS		(VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV + VIB_PER_STEP_mV)
 
 #define MAX_FF_SPEED		0xff
 
-struct pm8xxx_regs {
-	unsigned int enable_addr;
-	unsigned int enable_mask;
-
-	unsigned int drv_addr;
-	unsigned int drv_mask;
-	unsigned int drv_shift;
-	unsigned int drv_en_manual_mask;
-};
-
-static const struct pm8xxx_regs pm8058_regs = {
-	.drv_addr = 0x4A,
-	.drv_mask = 0xf8,
-	.drv_shift = 3,
-	.drv_en_manual_mask = 0xfc,
-};
-
-static struct pm8xxx_regs pm8916_regs = {
-	.enable_addr = 0xc046,
-	.enable_mask = BIT(7),
-	.drv_addr = 0xc041,
-	.drv_mask = 0x1F,
-	.drv_shift = 0,
-	.drv_en_manual_mask = 0,
+enum vib_hw_type {
+	SSBI_VIB,
+	SPMI_VIB,
+	SPMI_VIB_GEN2
+};
+
+struct pm8xxx_vib_data {
+	enum vib_hw_type	hw_type;
+	unsigned int		enable_addr;
+	unsigned int		drv_addr;
+	unsigned int		drv2_addr;
+};
+
+static const struct pm8xxx_vib_data ssbi_vib_data = {
+	.hw_type	= SSBI_VIB,
+	.drv_addr	= SSBI_VIB_DRV_REG,
+};
+
+static const struct pm8xxx_vib_data spmi_vib_data = {
+	.hw_type	= SPMI_VIB,
+	.enable_addr	= SPMI_VIB_EN_REG,
+	.drv_addr	= SPMI_VIB_DRV_REG,
+};
+
+static const struct pm8xxx_vib_data spmi_vib_gen2_data = {
+	.hw_type	= SPMI_VIB_GEN2,
+	.enable_addr	= SPMI_VIB_EN_REG,
+	.drv_addr	= SPMI_VIB_GEN2_DRV_REG,
+	.drv2_addr	= SPMI_VIB_GEN2_DRV2_REG,
 };
 
 /**
@@ -48,7 +74,8 @@
  * @vib_input_dev: input device supporting force feedback
  * @work: work structure to set the vibration parameters
  * @regmap: regmap for register read/write
- * @regs: registers' info
+ * @data: vibrator HW info
+ * @reg_base: the register base of the module
  * @speed: speed of vibration set from userland
  * @active: state of vibrator
  * @level: level of vibration to set in the chip
@@ -58,7 +85,8 @@
 	struct input_dev *vib_input_dev;
 	struct work_struct work;
 	struct regmap *regmap;
-	const struct pm8xxx_regs *regs;
+	const struct pm8xxx_vib_data *data;
+	unsigned int reg_base;
 	int speed;
 	int level;
 	bool active;
@@ -74,24 +102,55 @@
 {
 	int rc;
 	unsigned int val = vib->reg_vib_drv;
-	const struct pm8xxx_regs *regs = vib->regs;
+	u32 mask, shift;
+
+	switch (vib->data->hw_type) {
+	case SSBI_VIB:
+		mask = SSBI_VIB_DRV_LEVEL_MASK;
+		shift = SSBI_VIB_DRV_SHIFT;
+		break;
+	case SPMI_VIB:
+		mask = SPMI_VIB_DRV_LEVEL_MASK;
+		shift = SPMI_VIB_DRV_SHIFT;
+		break;
+	case SPMI_VIB_GEN2:
+		mask = SPMI_VIB_GEN2_DRV_MASK;
+		shift = SPMI_VIB_GEN2_DRV_SHIFT;
+		break;
+	default:
+		return -EINVAL;
+	}
 
 	if (on)
-		val |= (vib->level << regs->drv_shift) & regs->drv_mask;
+		val |= (vib->level << shift) & mask;
 	else
-		val &= ~regs->drv_mask;
+		val &= ~mask;
 
-	rc = regmap_write(vib->regmap, regs->drv_addr, val);
+	rc = regmap_update_bits(vib->regmap, vib->reg_base + vib->data->drv_addr, mask, val);
 	if (rc < 0)
 		return rc;
 
 	vib->reg_vib_drv = val;
 
-	if (regs->enable_mask)
-		rc = regmap_update_bits(vib->regmap, regs->enable_addr,
-					regs->enable_mask, on ? ~0 : 0);
+	if (vib->data->hw_type == SPMI_VIB_GEN2) {
+		mask = SPMI_VIB_GEN2_DRV2_MASK;
+		shift = SPMI_VIB_GEN2_DRV2_SHIFT;
+		if (on)
+			val = (vib->level >> shift) & mask;
+		else
+			val = 0;
+		rc = regmap_update_bits(vib->regmap,
+				vib->reg_base + vib->data->drv2_addr, mask, val);
+		if (rc < 0)
+			return rc;
+	}
+
+	if (vib->data->hw_type == SSBI_VIB)
+		return 0;
 
-	return rc;
+	mask = SPMI_VIB_EN_BIT;
+	val = on ? SPMI_VIB_EN_BIT : 0;
+	return regmap_update_bits(vib->regmap, vib->reg_base + vib->data->enable_addr, mask, val);
 }
 
 /**
@@ -101,13 +160,6 @@
 static void pm8xxx_work_handler(struct work_struct *work)
 {
 	struct pm8xxx_vib *vib = container_of(work, struct pm8xxx_vib, work);
-	const struct pm8xxx_regs *regs = vib->regs;
-	int rc;
-	unsigned int val;
-
-	rc = regmap_read(vib->regmap, regs->drv_addr, &val);
-	if (rc < 0)
-		return;
 
 	/*
 	 * pmic vibrator supports voltage ranges from 1.2 to 3.1V, so
@@ -117,10 +169,13 @@
 		vib->active = true;
 		vib->level = ((VIB_MAX_LEVELS * vib->speed) / MAX_FF_SPEED) +
 						VIB_MIN_LEVEL_mV;
-		vib->level /= 100;
+		if (vib->data->hw_type != SPMI_VIB_GEN2)
+			vib->level /= VIB_PER_STEP_mV;
 	} else {
 		vib->active = false;
-		vib->level = VIB_MIN_LEVEL_mV / 100;
+		vib->level = VIB_MIN_LEVEL_mV;
+		if (vib->data->hw_type != SPMI_VIB_GEN2)
+			vib->level /= VIB_PER_STEP_mV;
 	}
 
 	pm8xxx_vib_set(vib, vib->active);
@@ -167,9 +222,9 @@
 {
 	struct pm8xxx_vib *vib;
 	struct input_dev *input_dev;
+	const struct pm8xxx_vib_data *data;
 	int error;
-	unsigned int val;
-	const struct pm8xxx_regs *regs;
+	unsigned int val, reg_base;
 
 	vib = devm_kzalloc(&pdev->dev, sizeof(*vib), GFP_KERNEL);
 	if (!vib)
@@ -186,19 +241,33 @@
 	INIT_WORK(&vib->work, pm8xxx_work_handler);
 	vib->vib_input_dev = input_dev;
 
-	regs = of_device_get_match_data(&pdev->dev);
+	data = of_device_get_match_data(&pdev->dev);
+	if (!data)
+		return -EINVAL;
+
+	if (data->hw_type != SSBI_VIB) {
+		error = fwnode_property_read_u32(pdev->dev.fwnode, "reg", &reg_base);
+		if (error < 0) {
+			dev_err(&pdev->dev, "Failed to read reg address, rc=%d\n", error);
+			return error;
+		}
 
-	/* operate in manual mode */
-	error = regmap_read(vib->regmap, regs->drv_addr, &val);
-	if (error < 0)
-		return error;
+		vib->reg_base += reg_base;
+	}
 
-	val &= regs->drv_en_manual_mask;
-	error = regmap_write(vib->regmap, regs->drv_addr, val);
+	error = regmap_read(vib->regmap, vib->reg_base + data->drv_addr, &val);
 	if (error < 0)
 		return error;
 
-	vib->regs = regs;
+	/* operate in manual mode */
+	if (data->hw_type == SSBI_VIB) {
+		val &= SSBI_VIB_DRV_EN_MANUAL_MASK;
+		error = regmap_write(vib->regmap, vib->reg_base + data->drv_addr, val);
+		if (error < 0)
+			return error;
+	}
+
+	vib->data = data;
 	vib->reg_vib_drv = val;
 
 	input_dev->name = "pm8xxx_vib_ffmemless";
@@ -238,9 +307,10 @@
 static DEFINE_SIMPLE_DEV_PM_OPS(pm8xxx_vib_pm_ops, pm8xxx_vib_suspend, NULL);
 
 static const struct of_device_id pm8xxx_vib_id_table[] = {
-	{ .compatible = "qcom,pm8058-vib", .data = &pm8058_regs },
-	{ .compatible = "qcom,pm8921-vib", .data = &pm8058_regs },
-	{ .compatible = "qcom,pm8916-vib", .data = &pm8916_regs },
+	{ .compatible = "qcom,pm8058-vib", .data = &ssbi_vib_data },
+	{ .compatible = "qcom,pm8921-vib", .data = &ssbi_vib_data },
+	{ .compatible = "qcom,pm8916-vib", .data = &spmi_vib_data },
+	{ .compatible = "qcom,pmi632-vib", .data = &spmi_vib_gen2_data },
 	{ }
 };
 MODULE_DEVICE_TABLE(of, pm8xxx_vib_id_table);
--- linux-qcom-6.8.0.orig/drivers/input/misc/uinput.c
+++ linux-qcom-6.8.0/drivers/input/misc/uinput.c
@@ -417,6 +417,20 @@
 		return -EINVAL;
 	}
 
+	/*
+	 * Limit number of contacts to a reasonable value (100). This
+	 * ensures that we need less than 2 pages for struct input_mt
+	 * (we are not using in-kernel slot assignment so not going to
+	 * allocate memory for the "red" table), and we should have no
+	 * trouble getting this much memory.
+	 */
+	if (code == ABS_MT_SLOT && max > 99) {
+		printk(KERN_DEBUG
+		       "%s: unreasonably large number of slots requested: %d\n",
+		       UINPUT_NAME, max);
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/input/mouse/amimouse.c
+++ linux-qcom-6.8.0/drivers/input/mouse/amimouse.c
@@ -132,7 +132,13 @@
 	input_unregister_device(dev);
 }
 
-static struct platform_driver amimouse_driver = {
+/*
+ * amimouse_remove() lives in .exit.text. For drivers registered via
+ * module_platform_driver_probe() this is ok because they cannot get unbound at
+ * runtime. So mark the driver struct with __refdata to prevent modpost
+ * triggering a section mismatch warning.
+ */
+static struct platform_driver amimouse_driver __refdata = {
 	.remove_new = __exit_p(amimouse_remove),
 	.driver   = {
 		.name	= "amiga-mouse",
--- linux-qcom-6.8.0.orig/drivers/input/mouse/cyapa.c
+++ linux-qcom-6.8.0/drivers/input/mouse/cyapa.c
@@ -1347,10 +1347,16 @@
 	u8 power_mode;
 	int error;
 
-	error = mutex_lock_interruptible(&cyapa->state_sync_lock);
+	error = mutex_lock_interruptible(&cyapa->input->mutex);
 	if (error)
 		return error;
 
+	error = mutex_lock_interruptible(&cyapa->state_sync_lock);
+	if (error) {
+		mutex_unlock(&cyapa->input->mutex);
+		return error;
+	}
+
 	/*
 	 * Runtime PM is enable only when device is in operational mode and
 	 * users in use, so need check it before disable it to
@@ -1385,6 +1391,8 @@
 		cyapa->irq_wake = (enable_irq_wake(client->irq) == 0);
 
 	mutex_unlock(&cyapa->state_sync_lock);
+	mutex_unlock(&cyapa->input->mutex);
+
 	return 0;
 }
 
@@ -1394,6 +1402,7 @@
 	struct cyapa *cyapa = i2c_get_clientdata(client);
 	int error;
 
+	mutex_lock(&cyapa->input->mutex);
 	mutex_lock(&cyapa->state_sync_lock);
 
 	if (device_may_wakeup(dev) && cyapa->irq_wake) {
@@ -1412,6 +1421,7 @@
 	enable_irq(client->irq);
 
 	mutex_unlock(&cyapa->state_sync_lock);
+	mutex_unlock(&cyapa->input->mutex);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/input/mouse/cypress_ps2.c
+++ linux-qcom-6.8.0/drivers/input/mouse/cypress_ps2.c
@@ -387,7 +387,9 @@
 	if (ret < 0)
 		return ret;
 
+#if ( CYPRESS_SIMULATED_MT != 1 )
 	__set_bit(INPUT_PROP_SEMI_MT, input->propbit);
+#endif
 
 	input_abs_set_res(input, ABS_X, cytp->tp_res_x);
 	input_abs_set_res(input, ABS_Y, cytp->tp_res_y);
@@ -473,6 +475,22 @@
 			((packet[5] & 0x0f) << 8) | packet[7];
 		if (cytp->mode & CYTP_BIT_ABS_PRESSURE)
 			report_data->contacts[1].z = report_data->contacts[0].z;
+#if ( CYPRESS_SIMULATED_MT == 1 )
+		/* simulate contact positions for >2 fingers */
+		if ( report_data->contact_cnt >= 3 ) {
+			int i;
+			for ( i=1; i<report_data->contact_cnt; i++ ) {
+			    report_data->contacts[i].x =
+					    report_data->contacts[0].x
+					    + 100*(i)*((i%2)?-1:1);
+			    report_data->contacts[i].y =
+					    report_data->contacts[0].y;
+			    if (cytp->mode & CYTP_BIT_ABS_PRESSURE)
+				    report_data->contacts[i].z =
+					    report_data->contacts[0].z;
+			}
+		}
+#endif
 	}
 
 	report_data->left = (header_byte & BTN_LEFT_BIT) ? 1 : 0;
--- linux-qcom-6.8.0.orig/drivers/input/mouse/cypress_ps2.h
+++ linux-qcom-6.8.0/drivers/input/mouse/cypress_ps2.h
@@ -131,7 +131,18 @@
 #define RESP_REMOTE_BIT     0x40
 #define RESP_SMBUS_BIT      0x80
 
-#define CYTP_MAX_MT_SLOTS 2
+/*
+ * CYPRESS_SIMULATED_MT
+ *   set to 1 for simulated multitouch (up to 5 contact points)
+ *   set to 0 for SEMI_MT (only 2 corner points, and count of fingers)
+ */
+#define CYPRESS_SIMULATED_MT 1
+
+#if ( CYPRESS_SIMULATED_MT == 1 )
+# define CYTP_MAX_MT_SLOTS 5
+#else
+# define CYTP_MAX_MT_SLOTS 2
+#endif
 
 struct cytp_contact {
 	int x;
--- linux-qcom-6.8.0.orig/drivers/input/mouse/elan_i2c_core.c
+++ linux-qcom-6.8.0/drivers/input/mouse/elan_i2c_core.c
@@ -1356,6 +1356,8 @@
 	}
 
 err:
+	if (ret)
+		enable_irq(client->irq);
 	mutex_unlock(&data->sysfs_mutex);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/input/mouse/elantech.c
+++ linux-qcom-6.8.0/drivers/input/mouse/elantech.c
@@ -1477,15 +1477,46 @@
 }
 
 /*
+ * Some hw_version 4 models fail to properly activate absolute mode on
+ * resume without going through disable/enable cycle.
+ */
+static const struct dmi_system_id elantech_needs_reenable[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+	{
+		/* Lenovo N24 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "81AF"),
+		},
+	},
+#endif
+	{ }
+};
+
+/*
  * Put the touchpad back into absolute mode when reconnecting
  */
 static int elantech_reconnect(struct psmouse *psmouse)
 {
+	int err;
+
 	psmouse_reset(psmouse);
 
 	if (elantech_detect(psmouse, 0))
 		return -1;
 
+	if (dmi_check_system(elantech_needs_reenable)) {
+		err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_DISABLE);
+		if (err)
+			psmouse_warn(psmouse, "failed to deactivate mouse on %s: %d\n",
+				     psmouse->ps2dev.serio->phys, err);
+
+		err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_ENABLE);
+		if (err)
+			psmouse_warn(psmouse, "failed to reactivate mouse on %s: %d\n",
+				     psmouse->ps2dev.serio->phys, err);
+	}
+
 	if (elantech_set_absolute_mode(psmouse)) {
 		psmouse_err(psmouse,
 			    "failed to put touchpad back into absolute mode.\n");
--- linux-qcom-6.8.0.orig/drivers/input/mouse/synaptics.c
+++ linux-qcom-6.8.0/drivers/input/mouse/synaptics.c
@@ -189,6 +189,7 @@
 	"LEN2054", /* E480 */
 	"LEN2055", /* E580 */
 	"LEN2068", /* T14 Gen 1 */
+	"SYN3015", /* HP EliteBook 840 G2 */
 	"SYN3052", /* HP EliteBook 840 G4 */
 	"SYN3221", /* HP 15-ay000 */
 	"SYN323d", /* HP Spectre X360 13-w013dx */
--- linux-qcom-6.8.0.orig/drivers/input/mouse/vmmouse.c
+++ linux-qcom-6.8.0/drivers/input/mouse/vmmouse.c
@@ -21,19 +21,16 @@
 #include "psmouse.h"
 #include "vmmouse.h"
 
-#define VMMOUSE_PROTO_MAGIC			0x564D5868U
-
 /*
  * Main commands supported by the vmmouse hypervisor port.
  */
-#define VMMOUSE_PROTO_CMD_GETVERSION		10
-#define VMMOUSE_PROTO_CMD_ABSPOINTER_DATA	39
-#define VMMOUSE_PROTO_CMD_ABSPOINTER_STATUS	40
-#define VMMOUSE_PROTO_CMD_ABSPOINTER_COMMAND	41
-#define VMMOUSE_PROTO_CMD_ABSPOINTER_RESTRICT   86
+#define VMWARE_CMD_ABSPOINTER_DATA	39
+#define VMWARE_CMD_ABSPOINTER_STATUS	40
+#define VMWARE_CMD_ABSPOINTER_COMMAND	41
+#define VMWARE_CMD_ABSPOINTER_RESTRICT	86
 
 /*
- * Subcommands for VMMOUSE_PROTO_CMD_ABSPOINTER_COMMAND
+ * Subcommands for VMWARE_CMD_ABSPOINTER_COMMAND
  */
 #define VMMOUSE_CMD_ENABLE			0x45414552U
 #define VMMOUSE_CMD_DISABLE			0x000000f5U
@@ -76,28 +73,6 @@
 	char dev_name[128];
 };
 
-/*
- * Hypervisor-specific bi-directional communication channel
- * implementing the vmmouse protocol. Should never execute on
- * bare metal hardware.
- */
-#define VMMOUSE_CMD(cmd, in1, out1, out2, out3, out4)	\
-({							\
-	unsigned long __dummy1, __dummy2;		\
-	__asm__ __volatile__ (VMWARE_HYPERCALL :	\
-		"=a"(out1),				\
-		"=b"(out2),				\
-		"=c"(out3),				\
-		"=d"(out4),				\
-		"=S"(__dummy1),				\
-		"=D"(__dummy2) :			\
-		"a"(VMMOUSE_PROTO_MAGIC),		\
-		"b"(in1),				\
-		"c"(VMMOUSE_PROTO_CMD_##cmd),		\
-		"d"(0) :			        \
-		"memory");		                \
-})
-
 /**
  * vmmouse_report_button - report button state on the correct input device
  *
@@ -145,14 +120,12 @@
 	struct input_dev *abs_dev = priv->abs_dev;
 	struct input_dev *pref_dev;
 	u32 status, x, y, z;
-	u32 dummy1, dummy2, dummy3;
 	unsigned int queue_length;
 	unsigned int count = 255;
 
 	while (count--) {
 		/* See if we have motion data. */
-		VMMOUSE_CMD(ABSPOINTER_STATUS, 0,
-			    status, dummy1, dummy2, dummy3);
+		status = vmware_hypercall1(VMWARE_CMD_ABSPOINTER_STATUS, 0);
 		if ((status & VMMOUSE_ERROR) == VMMOUSE_ERROR) {
 			psmouse_err(psmouse, "failed to fetch status data\n");
 			/*
@@ -172,7 +145,8 @@
 		}
 
 		/* Now get it */
-		VMMOUSE_CMD(ABSPOINTER_DATA, 4, status, x, y, z);
+		status = vmware_hypercall4(VMWARE_CMD_ABSPOINTER_DATA, 4,
+					   &x, &y, &z);
 
 		/*
 		 * And report what we've got. Prefer to report button
@@ -247,14 +221,10 @@
 static void vmmouse_disable(struct psmouse *psmouse)
 {
 	u32 status;
-	u32 dummy1, dummy2, dummy3, dummy4;
-
-	VMMOUSE_CMD(ABSPOINTER_COMMAND, VMMOUSE_CMD_DISABLE,
-		    dummy1, dummy2, dummy3, dummy4);
 
-	VMMOUSE_CMD(ABSPOINTER_STATUS, 0,
-		    status, dummy1, dummy2, dummy3);
+	vmware_hypercall1(VMWARE_CMD_ABSPOINTER_COMMAND, VMMOUSE_CMD_DISABLE);
 
+	status = vmware_hypercall1(VMWARE_CMD_ABSPOINTER_STATUS, 0);
 	if ((status & VMMOUSE_ERROR) != VMMOUSE_ERROR)
 		psmouse_warn(psmouse, "failed to disable vmmouse device\n");
 }
@@ -271,26 +241,24 @@
 static int vmmouse_enable(struct psmouse *psmouse)
 {
 	u32 status, version;
-	u32 dummy1, dummy2, dummy3, dummy4;
 
 	/*
 	 * Try enabling the device. If successful, we should be able to
 	 * read valid version ID back from it.
 	 */
-	VMMOUSE_CMD(ABSPOINTER_COMMAND, VMMOUSE_CMD_ENABLE,
-		    dummy1, dummy2, dummy3, dummy4);
+	vmware_hypercall1(VMWARE_CMD_ABSPOINTER_COMMAND, VMMOUSE_CMD_ENABLE);
 
 	/*
 	 * See if version ID can be retrieved.
 	 */
-	VMMOUSE_CMD(ABSPOINTER_STATUS, 0, status, dummy1, dummy2, dummy3);
+	status = vmware_hypercall1(VMWARE_CMD_ABSPOINTER_STATUS, 0);
 	if ((status & 0x0000ffff) == 0) {
 		psmouse_dbg(psmouse, "empty flags - assuming no device\n");
 		return -ENXIO;
 	}
 
-	VMMOUSE_CMD(ABSPOINTER_DATA, 1 /* single item */,
-		    version, dummy1, dummy2, dummy3);
+	version = vmware_hypercall1(VMWARE_CMD_ABSPOINTER_DATA,
+				    1 /* single item */);
 	if (version != VMMOUSE_VERSION_ID) {
 		psmouse_dbg(psmouse, "Unexpected version value: %u vs %u\n",
 			    (unsigned) version, VMMOUSE_VERSION_ID);
@@ -301,11 +269,11 @@
 	/*
 	 * Restrict ioport access, if possible.
 	 */
-	VMMOUSE_CMD(ABSPOINTER_RESTRICT, VMMOUSE_RESTRICT_CPL0,
-		    dummy1, dummy2, dummy3, dummy4);
+	vmware_hypercall1(VMWARE_CMD_ABSPOINTER_RESTRICT,
+			  VMMOUSE_RESTRICT_CPL0);
 
-	VMMOUSE_CMD(ABSPOINTER_COMMAND, VMMOUSE_CMD_REQUEST_ABSOLUTE,
-		    dummy1, dummy2, dummy3, dummy4);
+	vmware_hypercall1(VMWARE_CMD_ABSPOINTER_COMMAND,
+			  VMMOUSE_CMD_REQUEST_ABSOLUTE);
 
 	return 0;
 }
@@ -342,7 +310,7 @@
  */
 int vmmouse_detect(struct psmouse *psmouse, bool set_properties)
 {
-	u32 response, version, dummy1, dummy2;
+	u32 response, version, type;
 
 	if (!vmmouse_check_hypervisor()) {
 		psmouse_dbg(psmouse,
@@ -351,9 +319,9 @@
 	}
 
 	/* Check if the device is present */
-	response = ~VMMOUSE_PROTO_MAGIC;
-	VMMOUSE_CMD(GETVERSION, 0, version, response, dummy1, dummy2);
-	if (response != VMMOUSE_PROTO_MAGIC || version == 0xffffffffU)
+	response = ~VMWARE_HYPERVISOR_MAGIC;
+	version = vmware_hypercall3(VMWARE_CMD_GETVERSION, 0, &response, &type);
+	if (response != VMWARE_HYPERVISOR_MAGIC || version == 0xffffffffU)
 		return -ENXIO;
 
 	if (set_properties) {
--- linux-qcom-6.8.0.orig/drivers/input/rmi4/rmi_driver.c
+++ linux-qcom-6.8.0/drivers/input/rmi4/rmi_driver.c
@@ -1196,7 +1196,11 @@
 		}
 		rmi_driver_set_input_params(rmi_dev, data->input);
 		data->input->phys = devm_kasprintf(dev, GFP_KERNEL,
-						"%s/input0", dev_name(dev));
+						   "%s/input0", dev_name(dev));
+		if (!data->input->phys) {
+			retval = -ENOMEM;
+			goto err;
+		}
 	}
 
 	retval = rmi_init_functions(data);
--- linux-qcom-6.8.0.orig/drivers/input/serio/i8042-acpipnpio.h
+++ linux-qcom-6.8.0/drivers/input/serio/i8042-acpipnpio.h
@@ -76,13 +76,14 @@
 #define SERIO_QUIRK_PROBE_DEFER		BIT(5)
 #define SERIO_QUIRK_RESET_ALWAYS	BIT(6)
 #define SERIO_QUIRK_RESET_NEVER		BIT(7)
-#define SERIO_QUIRK_DIECT		BIT(8)
+#define SERIO_QUIRK_DIRECT		BIT(8)
 #define SERIO_QUIRK_DUMBKBD		BIT(9)
 #define SERIO_QUIRK_NOLOOP		BIT(10)
 #define SERIO_QUIRK_NOTIMEOUT		BIT(11)
 #define SERIO_QUIRK_KBDRESET		BIT(12)
 #define SERIO_QUIRK_DRITEK		BIT(13)
 #define SERIO_QUIRK_NOPNP		BIT(14)
+#define SERIO_QUIRK_FORCENORESTORE	BIT(15)
 
 /* Quirk table for different mainboards. Options similar or identical to i8042
  * module parameters.
@@ -627,6 +628,15 @@
 		.driver_data = (void *)(SERIO_QUIRK_NOMUX)
 	},
 	{
+		/* Fujitsu Lifebook E756 */
+		/* https://bugzilla.suse.com/show_bug.cgi?id=1229056 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E756"),
+		},
+		.driver_data = (void *)(SERIO_QUIRK_NOMUX)
+	},
+	{
 		/* Fujitsu Lifebook E5411 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU CLIENT COMPUTING LIMITED"),
@@ -1111,6 +1121,43 @@
 		.driver_data = (void *)(SERIO_QUIRK_NOLOOP)
 	},
 	/*
+	 * Some TongFang barebones have touchpad and/or keyboard issues after
+	 * suspend fixable with nomux + reset + noloop + nopnp. Luckily, none of
+	 * them have an external PS/2 port so this can safely be set for all of
+	 * them.
+	 * TongFang barebones come with board_vendor and/or system_vendor set to
+	 * a different value for each individual reseller. The only somewhat
+	 * universal way to identify them is by board_name.
+	 */
+	{
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GM6XGxX"),
+		},
+		.driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+					SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"),
+		},
+		.driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+					SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"),
+		},
+		.driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+					SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"),
+		},
+		.driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+					SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+	},
+	/*
 	 * A lot of modern Clevo barebones have touchpad and/or keyboard issues
 	 * after suspend fixable with nomux + reset + noloop + nopnp. Luckily,
 	 * none of them have an external PS/2 port so this can safely be set for
@@ -1149,18 +1196,10 @@
 					SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
 	},
 	{
-		/*
-		 * Setting SERIO_QUIRK_NOMUX or SERIO_QUIRK_RESET_ALWAYS makes
-		 * the keyboard very laggy for ~5 seconds after boot and
-		 * sometimes also after resume.
-		 * However both are required for the keyboard to not fail
-		 * completely sometimes after boot or resume.
-		 */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_NAME, "N150CU"),
 		},
-		.driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
-					SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+		.driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
 	},
 	{
 		.matches = {
@@ -1332,6 +1371,20 @@
 		.driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
 					SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
 	},
+	{
+		/*
+		 * The Ayaneo Kun is a handheld device where some the buttons
+		 * are handled by an AT keyboard. The keyboard is usually
+		 * detected as raw, but sometimes, usually after a cold boot,
+		 * it is detected as translated. Make sure that the keyboard
+		 * is always in raw mode.
+		 */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"),
+			DMI_MATCH(DMI_BOARD_NAME, "KUN"),
+		},
+		.driver_data = (void *)(SERIO_QUIRK_DIRECT)
+	},
 	{ }
 };
 
@@ -1655,7 +1708,7 @@
 		if (quirks & SERIO_QUIRK_RESET_NEVER)
 			i8042_reset = I8042_RESET_NEVER;
 	}
-	if (quirks & SERIO_QUIRK_DIECT)
+	if (quirks & SERIO_QUIRK_DIRECT)
 		i8042_direct = true;
 	if (quirks & SERIO_QUIRK_DUMBKBD)
 		i8042_dumbkbd = true;
@@ -1671,6 +1724,8 @@
 	if (quirks & SERIO_QUIRK_NOPNP)
 		i8042_nopnp = true;
 #endif
+	if (quirks & SERIO_QUIRK_FORCENORESTORE)
+		i8042_forcenorestore = true;
 }
 #else
 static inline void i8042_check_quirks(void) {}
@@ -1704,7 +1759,7 @@
 
 	i8042_check_quirks();
 
-	pr_debug("Active quirks (empty means none):%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
+	pr_debug("Active quirks (empty means none):%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
 		i8042_nokbd ? " nokbd" : "",
 		i8042_noaux ? " noaux" : "",
 		i8042_nomux ? " nomux" : "",
@@ -1724,10 +1779,11 @@
 		"",
 #endif
 #ifdef CONFIG_PNP
-		i8042_nopnp ? " nopnp" : "");
+		i8042_nopnp ? " nopnp" : "",
 #else
-		"");
+		"",
 #endif
+		i8042_forcenorestore ? " forcenorestore" : "");
 
 	retval = i8042_pnp_init();
 	if (retval)
--- linux-qcom-6.8.0.orig/drivers/input/serio/i8042.c
+++ linux-qcom-6.8.0/drivers/input/serio/i8042.c
@@ -22,6 +22,7 @@
 #include <linux/slab.h>
 #include <linux/suspend.h>
 #include <linux/property.h>
+#include <linux/dmi.h>
 
 #include <asm/io.h>
 
@@ -115,6 +116,10 @@
 MODULE_PARM_DESC(nopnp, "Do not use PNP to detect controller settings");
 #endif
 
+static bool i8042_forcenorestore;
+module_param_named(forcenorestore, i8042_forcenorestore, bool, 0);
+MODULE_PARM_DESC(forcenorestore, "Force no restore on s3 resume, copying s2idle behaviour");
+
 #define DEBUG
 #ifdef DEBUG
 static bool i8042_debug;
@@ -178,6 +183,24 @@
 static bool (*i8042_platform_filter)(unsigned char data, unsigned char str,
 				     struct serio *serio);
 
+static int __init i8042_set_noaux(const struct dmi_system_id *dmi)
+{
+	i8042_noaux = true;
+	return 1;
+}
+
+static const struct dmi_system_id i8042_quirks[] = {
+	{
+		.callback = i8042_set_noaux,
+		.ident = "Dell laptop",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Precision 5550"),
+		},
+	},
+	{},
+};
+
 void i8042_lock_chip(void)
 {
 	mutex_lock(&i8042_mutex);
@@ -621,7 +644,7 @@
 	if (i8042_command(&i8042_ctr, I8042_CMD_CTL_WCTR)) {
 		i8042_ctr &= ~I8042_CTR_KBDINT;
 		i8042_ctr |= I8042_CTR_KBDDIS;
-		pr_err("Failed to enable KBD port\n");
+		pr_info("Failed to enable KBD port\n");
 		return -EIO;
 	}
 
@@ -640,7 +663,7 @@
 	if (i8042_command(&i8042_ctr, I8042_CMD_CTL_WCTR)) {
 		i8042_ctr &= ~I8042_CTR_AUXINT;
 		i8042_ctr |= I8042_CTR_AUXDIS;
-		pr_err("Failed to enable AUX port\n");
+		pr_info("Failed to enable AUX port\n");
 		return -EIO;
 	}
 
@@ -732,7 +755,7 @@
 	i8042_ctr &= ~I8042_CTR_AUXINT;
 
 	if (i8042_command(&i8042_ctr, I8042_CMD_CTL_WCTR)) {
-		pr_err("Failed to disable AUX port, can't use MUX\n");
+		pr_info("Failed to disable AUX port, can't use MUX\n");
 		return -EIO;
 	}
 
@@ -947,25 +970,28 @@
 {
 	unsigned char param;
 	int i = 0;
+	int ret;
 
 	/*
 	 * We try this 5 times; on some really fragile systems this does not
 	 * take the first time...
 	 */
-	do {
+	while (i++ < 5) {
 
-		if (i8042_command(&param, I8042_CMD_CTL_TEST)) {
-			pr_err("i8042 controller selftest timeout\n");
-			return -ENODEV;
-		}
-
-		if (param == I8042_RET_CTL_TEST)
+		ret = i8042_command(&param, I8042_CMD_CTL_TEST);
+		if (ret)
+			pr_info("i8042 controller selftest timeout (%d/5)\n", i);
+		else if (param == I8042_RET_CTL_TEST)
 			return 0;
+		else
+			dbg("i8042 controller selftest: %#x != %#x\n",
+			    param, I8042_RET_CTL_TEST);
 
-		dbg("i8042 controller selftest: %#x != %#x\n",
-		    param, I8042_RET_CTL_TEST);
 		msleep(50);
-	} while (i++ < 5);
+	}
+
+	if (ret)
+		return -ENODEV;
 
 #ifdef CONFIG_X86
 	/*
@@ -977,7 +1003,7 @@
 	pr_info("giving up on controller selftest, continuing anyway...\n");
 	return 0;
 #else
-	pr_err("i8042 controller selftest failed\n");
+	pr_info("i8042 controller selftest failed\n");
 	return -EIO;
 #endif
 }
@@ -1232,7 +1258,7 @@
 {
 	int i;
 
-	if (pm_suspend_via_firmware())
+	if (!i8042_forcenorestore && pm_suspend_via_firmware())
 		i8042_controller_reset(true);
 
 	/* Set up serio interrupts for system wakeup. */
@@ -1248,7 +1274,7 @@
 
 static int i8042_pm_resume_noirq(struct device *dev)
 {
-	if (!pm_resume_via_firmware())
+	if (i8042_forcenorestore || !pm_resume_via_firmware())
 		i8042_interrupt(0, NULL);
 
 	return 0;
@@ -1271,7 +1297,7 @@
 	 * not restore the controller state to whatever it had been at boot
 	 * time, so we do not need to do anything.
 	 */
-	if (!pm_suspend_via_firmware())
+	if (i8042_forcenorestore || !pm_suspend_via_firmware())
 		return 0;
 
 	/*
@@ -1558,6 +1584,8 @@
 		i8042_dritek_enable();
 #endif
 
+	dmi_check_system(i8042_quirks);
+
 	if (!i8042_noaux) {
 		error = i8042_setup_aux();
 		if (error && error != -ENODEV && error != -EBUSY)
--- linux-qcom-6.8.0.orig/drivers/input/serio/ioc3kbd.c
+++ linux-qcom-6.8.0/drivers/input/serio/ioc3kbd.c
@@ -200,9 +200,16 @@
 	serio_unregister_port(d->aux);
 }
 
+static const struct platform_device_id ioc3kbd_id_table[] = {
+	{ "ioc3-kbd", },
+	{ }
+};
+MODULE_DEVICE_TABLE(platform, ioc3kbd_id_table);
+
 static struct platform_driver ioc3kbd_driver = {
 	.probe          = ioc3kbd_probe,
 	.remove_new     = ioc3kbd_remove,
+	.id_table	= ioc3kbd_id_table,
 	.driver = {
 		.name = "ioc3-kbd",
 	},
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/Kconfig
+++ linux-qcom-6.8.0/drivers/input/touchscreen/Kconfig
@@ -416,6 +416,37 @@
 	  To compile this driver as a module, choose M here: the
 	  module will be called goodix.
 
+config TOUCHSCREEN_GOODIX_BERLIN_CORE
+	tristate
+
+config TOUCHSCREEN_GOODIX_BERLIN_I2C
+	tristate "Goodix Berlin I2C touchscreen"
+	depends on I2C
+	select REGMAP_I2C
+	select TOUCHSCREEN_GOODIX_BERLIN_CORE
+	help
+	  Say Y here if you have a Goodix Berlin IC connected to
+	  your system via I2C.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called goodix_berlin_i2c.
+
+config TOUCHSCREEN_GOODIX_BERLIN_SPI
+	tristate "Goodix Berlin SPI touchscreen"
+	depends on SPI_MASTER
+	select REGMAP
+	select TOUCHSCREEN_GOODIX_BERLIN_CORE
+	help
+	  Say Y here if you have a Goodix Berlin IC connected to
+	  your system via SPI.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called goodix_berlin_spi.
+
 config TOUCHSCREEN_HIDEEP
 	tristate "HiDeep Touch IC"
 	depends on I2C
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/Makefile
+++ linux-qcom-6.8.0/drivers/input/touchscreen/Makefile
@@ -47,6 +47,9 @@
 obj-$(CONFIG_TOUCHSCREEN_EXC3000)	+= exc3000.o
 obj-$(CONFIG_TOUCHSCREEN_FUJITSU)	+= fujitsu_ts.o
 obj-$(CONFIG_TOUCHSCREEN_GOODIX)	+= goodix_ts.o
+obj-$(CONFIG_TOUCHSCREEN_GOODIX_BERLIN_CORE)	+= goodix_berlin_core.o
+obj-$(CONFIG_TOUCHSCREEN_GOODIX_BERLIN_I2C)	+= goodix_berlin_i2c.o
+obj-$(CONFIG_TOUCHSCREEN_GOODIX_BERLIN_SPI)	+= goodix_berlin_spi.o
 obj-$(CONFIG_TOUCHSCREEN_HIDEEP)	+= hideep.o
 obj-$(CONFIG_TOUCHSCREEN_HYNITRON_CSTXXX)	+= hynitron_cstxxx.o
 obj-$(CONFIG_TOUCHSCREEN_ILI210X)	+= ili210x.o
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/ads7846.c
+++ linux-qcom-6.8.0/drivers/input/touchscreen/ads7846.c
@@ -805,7 +805,7 @@
 		m = &ts->msg[msg_idx];
 		error = spi_sync(ts->spi, m);
 		if (error) {
-			dev_err(&ts->spi->dev, "spi_sync --> %d\n", error);
+			dev_err_ratelimited(&ts->spi->dev, "spi_sync --> %d\n", error);
 			packet->ignore = true;
 			return;
 		}
@@ -1111,6 +1111,16 @@
 };
 MODULE_DEVICE_TABLE(of, ads7846_dt_ids);
 
+static const struct spi_device_id ads7846_spi_ids[] = {
+	{ "tsc2046", 7846 },
+	{ "ads7843", 7843 },
+	{ "ads7845", 7845 },
+	{ "ads7846", 7846 },
+	{ "ads7873", 7873 },
+	{ },
+};
+MODULE_DEVICE_TABLE(spi, ads7846_spi_ids);
+
 static const struct ads7846_platform_data *ads7846_get_props(struct device *dev)
 {
 	struct ads7846_platform_data *pdata;
@@ -1386,10 +1396,10 @@
 	},
 	.probe		= ads7846_probe,
 	.remove		= ads7846_remove,
+	.id_table	= ads7846_spi_ids,
 };
 
 module_spi_driver(ads7846_driver);
 
 MODULE_DESCRIPTION("ADS7846 TouchScreen Driver");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("spi:ads7846");
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/edt-ft5x06.c
+++ linux-qcom-6.8.0/drivers/input/touchscreen/edt-ft5x06.c
@@ -1121,6 +1121,14 @@
 	}
 }
 
+static void edt_ft5x06_exit_regmap(void *arg)
+{
+	struct edt_ft5x06_ts_data *data = arg;
+
+	if (!IS_ERR_OR_NULL(data->regmap))
+		regmap_exit(data->regmap);
+}
+
 static void edt_ft5x06_disable_regulators(void *arg)
 {
 	struct edt_ft5x06_ts_data *data = arg;
@@ -1154,6 +1162,16 @@
 		return PTR_ERR(tsdata->regmap);
 	}
 
+	/*
+	 * We are not using devm_regmap_init_i2c() and instead install a
+	 * custom action because we may replace regmap with M06-specific one
+	 * and we need to make sure that it will not be released too early.
+	 */
+	error = devm_add_action_or_reset(&client->dev, edt_ft5x06_exit_regmap,
+					 tsdata);
+	if (error)
+		return error;
+
 	chip_data = device_get_match_data(&client->dev);
 	if (!chip_data)
 		chip_data = (const struct edt_i2c_chip_data *)id->driver_data;
@@ -1347,7 +1365,6 @@
 	struct edt_ft5x06_ts_data *tsdata = i2c_get_clientdata(client);
 
 	edt_ft5x06_ts_teardown_debugfs(tsdata);
-	regmap_exit(tsdata->regmap);
 }
 
 static int edt_ft5x06_ts_suspend(struct device *dev)
@@ -1462,6 +1479,10 @@
 	.max_support_points = 5,
 };
 
+static const struct edt_i2c_chip_data edt_ft5452_data = {
+	.max_support_points = 5,
+};
+
 static const struct edt_i2c_chip_data edt_ft5506_data = {
 	.max_support_points = 10,
 };
@@ -1470,12 +1491,23 @@
 	.max_support_points = 2,
 };
 
+static const struct edt_i2c_chip_data edt_ft8201_data = {
+	.max_support_points = 10,
+};
+
+static const struct edt_i2c_chip_data edt_ft8719_data = {
+	.max_support_points = 10,
+};
+
 static const struct i2c_device_id edt_ft5x06_ts_id[] = {
 	{ .name = "edt-ft5x06", .driver_data = (long)&edt_ft5x06_data },
 	{ .name = "edt-ft5506", .driver_data = (long)&edt_ft5506_data },
 	{ .name = "ev-ft5726", .driver_data = (long)&edt_ft5506_data },
+	{ .name = "ft5452", .driver_data = (long)&edt_ft5452_data },
 	/* Note no edt- prefix for compatibility with the ft6236.c driver */
 	{ .name = "ft6236", .driver_data = (long)&edt_ft6236_data },
+	{ .name = "ft8201", .driver_data = (long)&edt_ft8201_data },
+	{ .name = "ft8719", .driver_data = (long)&edt_ft8719_data },
 	{ /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(i2c, edt_ft5x06_ts_id);
@@ -1486,8 +1518,11 @@
 	{ .compatible = "edt,edt-ft5406", .data = &edt_ft5x06_data },
 	{ .compatible = "edt,edt-ft5506", .data = &edt_ft5506_data },
 	{ .compatible = "evervision,ev-ft5726", .data = &edt_ft5506_data },
+	{ .compatible = "focaltech,ft5452", .data = &edt_ft5452_data },
 	/* Note focaltech vendor prefix for compatibility with ft6236.c */
 	{ .compatible = "focaltech,ft6236", .data = &edt_ft6236_data },
+	{ .compatible = "focaltech,ft8201", .data = &edt_ft8201_data },
+	{ .compatible = "focaltech,ft8719", .data = &edt_ft8719_data },
 	{ /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, edt_ft5x06_of_match);
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/goodix_berlin.h
+++ linux-qcom-6.8.0/drivers/input/touchscreen/goodix_berlin.h
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Goodix Touchscreen Driver
+ * Copyright (C) 2020 - 2021 Goodix, Inc.
+ * Copyright (C) 2023 Linaro Ltd.
+ *
+ * Based on goodix_berlin_berlin driver.
+ */
+
+#ifndef __GOODIX_BERLIN_H_
+#define __GOODIX_BERLIN_H_
+
+#include <linux/pm.h>
+
+struct device;
+struct input_id;
+struct regmap;
+
+int goodix_berlin_probe(struct device *dev, int irq, const struct input_id *id,
+			struct regmap *regmap);
+
+extern const struct dev_pm_ops goodix_berlin_pm_ops;
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/goodix_berlin_core.c
+++ linux-qcom-6.8.0/drivers/input/touchscreen/goodix_berlin_core.c
@@ -0,0 +1,755 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Goodix "Berlin" Touchscreen IC driver
+ * Copyright (C) 2020 - 2021 Goodix, Inc.
+ * Copyright (C) 2023 Linaro Ltd.
+ *
+ * Based on goodix_ts_berlin driver.
+ *
+ * This driver is distinct from goodix.c since hardware interface
+ * is different enough to require a new driver.
+ * None of the register address or data structure are close enough
+ * to the previous generations.
+ *
+ * Currently the driver only handles Multitouch events with already
+ * programmed firmware and "config" for "Revision D" Berlin IC.
+ *
+ * Support is missing for:
+ * - ESD Management
+ * - Firmware update/flashing
+ * - "Config" update/flashing
+ * - Stylus Events
+ * - Gesture Events
+ * - Support for older revisions (A & B)
+ */
+
+#include <linux/bitfield.h>
+#include <linux/gpio/consumer.h>
+#include <linux/input.h>
+#include <linux/input/mt.h>
+#include <linux/input/touchscreen.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+#include <linux/sizes.h>
+#include <asm/unaligned.h>
+
+#include "goodix_berlin.h"
+
+#define GOODIX_BERLIN_MAX_TOUCH			10
+
+#define GOODIX_BERLIN_NORMAL_RESET_DELAY_MS	100
+
+#define GOODIX_BERLIN_TOUCH_EVENT		BIT(7)
+#define GOODIX_BERLIN_REQUEST_EVENT		BIT(6)
+#define GOODIX_BERLIN_TOUCH_COUNT_MASK		GENMASK(3, 0)
+
+#define GOODIX_BERLIN_REQUEST_CODE_RESET	3
+
+#define GOODIX_BERLIN_POINT_TYPE_MASK		GENMASK(3, 0)
+#define GOODIX_BERLIN_POINT_TYPE_STYLUS_HOVER	1
+#define GOODIX_BERLIN_POINT_TYPE_STYLUS		3
+
+#define GOODIX_BERLIN_TOUCH_ID_MASK		GENMASK(7, 4)
+
+#define GOODIX_BERLIN_DEV_CONFIRM_VAL		0xAA
+#define GOODIX_BERLIN_BOOTOPTION_ADDR		0x10000
+#define GOODIX_BERLIN_FW_VERSION_INFO_ADDR	0x10014
+
+#define GOODIX_BERLIN_IC_INFO_MAX_LEN		SZ_1K
+#define GOODIX_BERLIN_IC_INFO_ADDR		0x10070
+
+#define GOODIX_BERLIN_CHECKSUM_SIZE		sizeof(u16)
+
+struct goodix_berlin_fw_version {
+	u8 rom_pid[6];
+	u8 rom_vid[3];
+	u8 rom_vid_reserved;
+	u8 patch_pid[8];
+	u8 patch_vid[4];
+	u8 patch_vid_reserved;
+	u8 sensor_id;
+	u8 reserved[2];
+	__le16 checksum;
+};
+
+struct goodix_berlin_ic_info_version {
+	u8 info_customer_id;
+	u8 info_version_id;
+	u8 ic_die_id;
+	u8 ic_version_id;
+	__le32 config_id;
+	u8 config_version;
+	u8 frame_data_customer_id;
+	u8 frame_data_version_id;
+	u8 touch_data_customer_id;
+	u8 touch_data_version_id;
+	u8 reserved[3];
+} __packed;
+
+struct goodix_berlin_ic_info_feature {
+	__le16 freqhop_feature;
+	__le16 calibration_feature;
+	__le16 gesture_feature;
+	__le16 side_touch_feature;
+	__le16 stylus_feature;
+} __packed;
+
+struct goodix_berlin_ic_info_misc {
+	__le32 cmd_addr;
+	__le16 cmd_max_len;
+	__le32 cmd_reply_addr;
+	__le16 cmd_reply_len;
+	__le32 fw_state_addr;
+	__le16 fw_state_len;
+	__le32 fw_buffer_addr;
+	__le16 fw_buffer_max_len;
+	__le32 frame_data_addr;
+	__le16 frame_data_head_len;
+	__le16 fw_attr_len;
+	__le16 fw_log_len;
+	u8 pack_max_num;
+	u8 pack_compress_version;
+	__le16 stylus_struct_len;
+	__le16 mutual_struct_len;
+	__le16 self_struct_len;
+	__le16 noise_struct_len;
+	__le32 touch_data_addr;
+	__le16 touch_data_head_len;
+	__le16 point_struct_len;
+	__le16 reserved1;
+	__le16 reserved2;
+	__le32 mutual_rawdata_addr;
+	__le32 mutual_diffdata_addr;
+	__le32 mutual_refdata_addr;
+	__le32 self_rawdata_addr;
+	__le32 self_diffdata_addr;
+	__le32 self_refdata_addr;
+	__le32 iq_rawdata_addr;
+	__le32 iq_refdata_addr;
+	__le32 im_rawdata_addr;
+	__le16 im_readata_len;
+	__le32 noise_rawdata_addr;
+	__le16 noise_rawdata_len;
+	__le32 stylus_rawdata_addr;
+	__le16 stylus_rawdata_len;
+	__le32 noise_data_addr;
+	__le32 esd_addr;
+} __packed;
+
+struct goodix_berlin_touch {
+	u8 status;
+	u8 reserved;
+	__le16 x;
+	__le16 y;
+	__le16 w;
+};
+#define GOODIX_BERLIN_TOUCH_SIZE	sizeof(struct goodix_berlin_touch)
+
+struct goodix_berlin_header {
+	u8 status;
+	u8 reserved1;
+	u8 request_type;
+	u8 reserved2[3];
+	__le16 checksum;
+};
+#define GOODIX_BERLIN_HEADER_SIZE	sizeof(struct goodix_berlin_header)
+
+struct goodix_berlin_event {
+	struct goodix_berlin_header hdr;
+	/* The data below is u16/__le16 aligned */
+	u8 data[GOODIX_BERLIN_TOUCH_SIZE * GOODIX_BERLIN_MAX_TOUCH +
+		GOODIX_BERLIN_CHECKSUM_SIZE];
+};
+
+struct goodix_berlin_core {
+	struct device *dev;
+	struct regmap *regmap;
+	struct regulator *avdd;
+	struct regulator *iovdd;
+	struct gpio_desc *reset_gpio;
+	struct touchscreen_properties props;
+	struct goodix_berlin_fw_version fw_version;
+	struct input_dev *input_dev;
+	int irq;
+
+	/* Runtime parameters extracted from IC_INFO buffer  */
+	u32 touch_data_addr;
+
+	struct goodix_berlin_event event;
+};
+
+static bool goodix_berlin_checksum_valid(const u8 *data, int size)
+{
+	u32 cal_checksum = 0;
+	u16 r_checksum;
+	int i;
+
+	if (size < GOODIX_BERLIN_CHECKSUM_SIZE)
+		return false;
+
+	for (i = 0; i < size - GOODIX_BERLIN_CHECKSUM_SIZE; i++)
+		cal_checksum += data[i];
+
+	r_checksum = get_unaligned_le16(&data[i]);
+
+	return (u16)cal_checksum == r_checksum;
+}
+
+static bool goodix_berlin_is_dummy_data(struct goodix_berlin_core *cd,
+					const u8 *data, int size)
+{
+	int i;
+
+	/*
+	 * If the device is missing or doesn't respond the buffer
+	 * could be filled with bus default line state, 0x00 or 0xff,
+	 * so declare success the first time we encounter neither.
+	 */
+	for (i = 0; i < size; i++)
+		if (data[i] > 0 && data[i] < 0xff)
+			return false;
+
+	return true;
+}
+
+static int goodix_berlin_dev_confirm(struct goodix_berlin_core *cd)
+{
+	u8 tx_buf[8], rx_buf[8];
+	int retry = 3;
+	int error;
+
+	memset(tx_buf, GOODIX_BERLIN_DEV_CONFIRM_VAL, sizeof(tx_buf));
+	while (retry--) {
+		error = regmap_raw_write(cd->regmap,
+					 GOODIX_BERLIN_BOOTOPTION_ADDR,
+					 tx_buf, sizeof(tx_buf));
+		if (error)
+			return error;
+
+		error = regmap_raw_read(cd->regmap,
+					GOODIX_BERLIN_BOOTOPTION_ADDR,
+					rx_buf, sizeof(rx_buf));
+		if (error)
+			return error;
+
+		if (!memcmp(tx_buf, rx_buf, sizeof(tx_buf)))
+			return 0;
+
+		usleep_range(5000, 5100);
+	}
+
+	dev_err(cd->dev, "device confirm failed, rx_buf: %*ph\n",
+		(int)sizeof(rx_buf), rx_buf);
+
+	return -EINVAL;
+}
+
+static int goodix_berlin_power_on(struct goodix_berlin_core *cd)
+{
+	int error;
+
+	error = regulator_enable(cd->iovdd);
+	if (error) {
+		dev_err(cd->dev, "Failed to enable iovdd: %d\n", error);
+		return error;
+	}
+
+	/* Vendor waits 3ms for IOVDD to settle */
+	usleep_range(3000, 3100);
+
+	error = regulator_enable(cd->avdd);
+	if (error) {
+		dev_err(cd->dev, "Failed to enable avdd: %d\n", error);
+		goto err_iovdd_disable;
+	}
+
+	/* Vendor waits 15ms for IOVDD to settle */
+	usleep_range(15000, 15100);
+
+	gpiod_set_value_cansleep(cd->reset_gpio, 0);
+
+	/* Vendor waits 4ms for Firmware to initialize */
+	usleep_range(4000, 4100);
+
+	error = goodix_berlin_dev_confirm(cd);
+	if (error)
+		goto err_dev_reset;
+
+	/* Vendor waits 100ms for Firmware to fully boot */
+	msleep(GOODIX_BERLIN_NORMAL_RESET_DELAY_MS);
+
+	return 0;
+
+err_dev_reset:
+	gpiod_set_value_cansleep(cd->reset_gpio, 1);
+	regulator_disable(cd->avdd);
+err_iovdd_disable:
+	regulator_disable(cd->iovdd);
+	return error;
+}
+
+static void goodix_berlin_power_off(struct goodix_berlin_core *cd)
+{
+	gpiod_set_value_cansleep(cd->reset_gpio, 1);
+	regulator_disable(cd->avdd);
+	regulator_disable(cd->iovdd);
+}
+
+static int goodix_berlin_read_version(struct goodix_berlin_core *cd)
+{
+	int error;
+
+	error = regmap_raw_read(cd->regmap, GOODIX_BERLIN_FW_VERSION_INFO_ADDR,
+				&cd->fw_version, sizeof(cd->fw_version));
+	if (error) {
+		dev_err(cd->dev, "error reading fw version, %d\n", error);
+		return error;
+	}
+
+	if (!goodix_berlin_checksum_valid((u8 *)&cd->fw_version,
+					  sizeof(cd->fw_version))) {
+		dev_err(cd->dev, "invalid fw version: checksum error\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/* Only extract necessary data for runtime */
+static int goodix_berlin_parse_ic_info(struct goodix_berlin_core *cd,
+				       const u8 *data, u16 length)
+{
+	struct goodix_berlin_ic_info_misc *misc;
+	unsigned int offset = 0;
+
+	offset += sizeof(__le16); /* length */
+	offset += sizeof(struct goodix_berlin_ic_info_version);
+	offset += sizeof(struct goodix_berlin_ic_info_feature);
+
+	/* IC_INFO Parameters, variable width structure */
+	offset += 4 * sizeof(u8); /* drv_num, sen_num, button_num, force_num */
+	if (offset >= length)
+		goto invalid_offset;
+
+#define ADVANCE_LE16_PARAMS()				\
+	do {						\
+		u8 param_num = data[offset++];		\
+		offset += param_num * sizeof(__le16);	\
+		if (offset >= length)			\
+			goto invalid_offset;		\
+	} while (0)
+	ADVANCE_LE16_PARAMS(); /* active_scan_rate_num */
+	ADVANCE_LE16_PARAMS(); /* mutual_freq_num*/
+	ADVANCE_LE16_PARAMS(); /* self_tx_freq_num */
+	ADVANCE_LE16_PARAMS(); /* self_rx_freq_num */
+	ADVANCE_LE16_PARAMS(); /* stylus_freq_num */
+#undef ADVANCE_LE16_PARAMS
+
+	misc = (struct goodix_berlin_ic_info_misc *)&data[offset];
+	cd->touch_data_addr = le32_to_cpu(misc->touch_data_addr);
+
+	return 0;
+
+invalid_offset:
+	dev_err(cd->dev, "ic_info length is invalid (offset %d length %d)\n",
+		offset, length);
+	return -EINVAL;
+}
+
+static int goodix_berlin_get_ic_info(struct goodix_berlin_core *cd)
+{
+	u8 *afe_data __free(kfree) = NULL;
+	__le16 length_raw;
+	u16 length;
+	int error;
+
+	afe_data = kzalloc(GOODIX_BERLIN_IC_INFO_MAX_LEN, GFP_KERNEL);
+	if (!afe_data)
+		return -ENOMEM;
+
+	error = regmap_raw_read(cd->regmap, GOODIX_BERLIN_IC_INFO_ADDR,
+				&length_raw, sizeof(length_raw));
+	if (error) {
+		dev_err(cd->dev, "failed get ic info length, %d\n", error);
+		return error;
+	}
+
+	length = le16_to_cpu(length_raw);
+	if (length >= GOODIX_BERLIN_IC_INFO_MAX_LEN) {
+		dev_err(cd->dev, "invalid ic info length %d\n", length);
+		return -EINVAL;
+	}
+
+	error = regmap_raw_read(cd->regmap, GOODIX_BERLIN_IC_INFO_ADDR,
+				afe_data, length);
+	if (error) {
+		dev_err(cd->dev, "failed get ic info data, %d\n", error);
+		return error;
+	}
+
+	/* check whether the data is valid (ex. bus default values) */
+	if (goodix_berlin_is_dummy_data(cd, afe_data, length)) {
+		dev_err(cd->dev, "fw info data invalid\n");
+		return -EINVAL;
+	}
+
+	if (!goodix_berlin_checksum_valid(afe_data, length)) {
+		dev_err(cd->dev, "fw info checksum error\n");
+		return -EINVAL;
+	}
+
+	error = goodix_berlin_parse_ic_info(cd, afe_data, length);
+	if (error)
+		return error;
+
+	/* check some key info */
+	if (!cd->touch_data_addr) {
+		dev_err(cd->dev, "touch_data_addr is null\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int goodix_berlin_get_remaining_contacts(struct goodix_berlin_core *cd,
+						int n)
+{
+	size_t offset = 2 * GOODIX_BERLIN_TOUCH_SIZE +
+				GOODIX_BERLIN_CHECKSUM_SIZE;
+	u32 addr = cd->touch_data_addr + GOODIX_BERLIN_HEADER_SIZE + offset;
+	int error;
+
+	error = regmap_raw_read(cd->regmap, addr,
+				&cd->event.data[offset],
+				(n - 2) * GOODIX_BERLIN_TOUCH_SIZE);
+	if (error) {
+		dev_err_ratelimited(cd->dev, "failed to get touch data, %d\n",
+				    error);
+		return error;
+	}
+
+	return 0;
+}
+
+static void goodix_berlin_report_state(struct goodix_berlin_core *cd, int n)
+{
+	struct goodix_berlin_touch *touch_data =
+			(struct goodix_berlin_touch *)cd->event.data;
+	struct goodix_berlin_touch *t;
+	int i;
+	u8 type, id;
+
+	for (i = 0; i < n; i++) {
+		t = &touch_data[i];
+
+		type = FIELD_GET(GOODIX_BERLIN_POINT_TYPE_MASK, t->status);
+		if (type == GOODIX_BERLIN_POINT_TYPE_STYLUS ||
+		    type == GOODIX_BERLIN_POINT_TYPE_STYLUS_HOVER) {
+			dev_warn_once(cd->dev, "Stylus event type not handled\n");
+			continue;
+		}
+
+		id = FIELD_GET(GOODIX_BERLIN_TOUCH_ID_MASK, t->status);
+		if (id >= GOODIX_BERLIN_MAX_TOUCH) {
+			dev_warn_ratelimited(cd->dev, "invalid finger id %d\n", id);
+			continue;
+		}
+
+		input_mt_slot(cd->input_dev, id);
+		input_mt_report_slot_state(cd->input_dev, MT_TOOL_FINGER, true);
+
+		touchscreen_report_pos(cd->input_dev, &cd->props,
+				       __le16_to_cpu(t->x), __le16_to_cpu(t->y),
+				       true);
+		input_report_abs(cd->input_dev, ABS_MT_TOUCH_MAJOR,
+				 __le16_to_cpu(t->w));
+	}
+
+	input_mt_sync_frame(cd->input_dev);
+	input_sync(cd->input_dev);
+}
+
+static void goodix_berlin_touch_handler(struct goodix_berlin_core *cd)
+{
+	u8 touch_num;
+	int error;
+
+	touch_num = FIELD_GET(GOODIX_BERLIN_TOUCH_COUNT_MASK,
+			      cd->event.hdr.request_type);
+	if (touch_num > GOODIX_BERLIN_MAX_TOUCH) {
+		dev_warn(cd->dev, "invalid touch num %d\n", touch_num);
+		return;
+	}
+
+	if (touch_num > 2) {
+		/* read additional contact data if more than 2 touch events */
+		error = goodix_berlin_get_remaining_contacts(cd, touch_num);
+		if (error)
+			return;
+	}
+
+	if (touch_num) {
+		int len = touch_num * GOODIX_BERLIN_TOUCH_SIZE +
+			  GOODIX_BERLIN_CHECKSUM_SIZE;
+		if (!goodix_berlin_checksum_valid(cd->event.data, len)) {
+			dev_err(cd->dev, "touch data checksum error: %*ph\n",
+				len, cd->event.data);
+			return;
+		}
+	}
+
+	goodix_berlin_report_state(cd, touch_num);
+}
+
+static int goodix_berlin_request_handle_reset(struct goodix_berlin_core *cd)
+{
+	gpiod_set_value_cansleep(cd->reset_gpio, 1);
+	usleep_range(2000, 2100);
+	gpiod_set_value_cansleep(cd->reset_gpio, 0);
+
+	msleep(GOODIX_BERLIN_NORMAL_RESET_DELAY_MS);
+
+	return 0;
+}
+
+static irqreturn_t goodix_berlin_irq(int irq, void *data)
+{
+	struct goodix_berlin_core *cd = data;
+	int error;
+
+	/*
+	 * First, read buffer with space for 2 touch events:
+	 * - GOODIX_BERLIN_HEADER_SIZE = 8 bytes
+	 * - GOODIX_BERLIN_TOUCH_SIZE * 2 = 16 bytes
+	 * - GOODIX_BERLIN_CHECKLSUM_SIZE = 2 bytes
+	 * For a total of 26 bytes.
+	 *
+	 * If only a single finger is reported, we will read 8 bytes more than
+	 * needed:
+	 * - bytes 0-7:   Header (GOODIX_BERLIN_HEADER_SIZE)
+	 * - bytes 8-15:  Finger 0 Data
+	 * - bytes 24-25: Checksum
+	 * - bytes 18-25: Unused 8 bytes
+	 *
+	 * If 2 fingers are reported, we would have read the exact needed
+	 * amount of data and checksum would be at the end of the buffer:
+	 * - bytes 0-7:   Header (GOODIX_BERLIN_HEADER_SIZE)
+	 * - bytes 8-15:  Finger 0 Bytes 0-7
+	 * - bytes 16-23: Finger 1 Bytes 0-7
+	 * - bytes 24-25: Checksum
+	 *
+	 * If more than 2 fingers were reported, the "Checksum" bytes would
+	 * in fact contain part of the next finger data, and then
+	 * goodix_berlin_get_remaining_contacts() would complete the buffer
+	 * with the missing bytes, including the trailing checksum.
+	 * For example, if 3 fingers are reported, then we would do:
+	 * Read 1:
+	 * - bytes 0-7:   Header (GOODIX_BERLIN_HEADER_SIZE)
+	 * - bytes 8-15:  Finger 0 Bytes 0-7
+	 * - bytes 16-23: Finger 1 Bytes 0-7
+	 * - bytes 24-25: Finger 2 Bytes 0-1
+	 * Read 2 (with length of (3 - 2) * 8 = 8 bytes):
+	 * - bytes 26-31: Finger 2 Bytes 2-7
+	 * - bytes 32-33: Checksum
+	 */
+	error = regmap_raw_read(cd->regmap, cd->touch_data_addr,
+				&cd->event,
+				GOODIX_BERLIN_HEADER_SIZE +
+					2 * GOODIX_BERLIN_TOUCH_SIZE +
+					GOODIX_BERLIN_CHECKSUM_SIZE);
+	if (error) {
+		dev_warn_ratelimited(cd->dev,
+				     "failed get event head data: %d\n", error);
+		goto out;
+	}
+
+	if (cd->event.hdr.status == 0)
+		goto out;
+
+	if (!goodix_berlin_checksum_valid((u8 *)&cd->event.hdr,
+					  GOODIX_BERLIN_HEADER_SIZE)) {
+		dev_warn_ratelimited(cd->dev,
+				     "touch head checksum error: %*ph\n",
+				     (int)GOODIX_BERLIN_HEADER_SIZE,
+				     &cd->event.hdr);
+		goto out_clear;
+	}
+
+	if (cd->event.hdr.status & GOODIX_BERLIN_TOUCH_EVENT)
+		goodix_berlin_touch_handler(cd);
+
+	if (cd->event.hdr.status & GOODIX_BERLIN_REQUEST_EVENT) {
+		switch (cd->event.hdr.request_type) {
+		case GOODIX_BERLIN_REQUEST_CODE_RESET:
+			if (cd->reset_gpio)
+				goodix_berlin_request_handle_reset(cd);
+			break;
+
+		default:
+			dev_warn(cd->dev, "unsupported request code 0x%x\n",
+				 cd->event.hdr.request_type);
+		}
+	}
+
+
+out_clear:
+	/* Clear up status field */
+	regmap_write(cd->regmap, cd->touch_data_addr, 0);
+
+out:
+	return IRQ_HANDLED;
+}
+
+static int goodix_berlin_input_dev_config(struct goodix_berlin_core *cd,
+					  const struct input_id *id)
+{
+	struct input_dev *input_dev;
+	int error;
+
+	input_dev = devm_input_allocate_device(cd->dev);
+	if (!input_dev)
+		return -ENOMEM;
+
+	cd->input_dev = input_dev;
+	input_set_drvdata(input_dev, cd);
+
+	input_dev->name = "Goodix Berlin Capacitive TouchScreen";
+	input_dev->phys = "input/ts";
+
+	input_dev->id = *id;
+
+	input_set_abs_params(cd->input_dev, ABS_MT_POSITION_X,
+			     0, SZ_64K - 1, 0, 0);
+	input_set_abs_params(cd->input_dev, ABS_MT_POSITION_Y,
+			     0, SZ_64K - 1, 0, 0);
+	input_set_abs_params(cd->input_dev, ABS_MT_TOUCH_MAJOR, 0, 255, 0, 0);
+
+	touchscreen_parse_properties(cd->input_dev, true, &cd->props);
+
+	error = input_mt_init_slots(cd->input_dev, GOODIX_BERLIN_MAX_TOUCH,
+				    INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED);
+	if (error)
+		return error;
+
+	error = input_register_device(cd->input_dev);
+	if (error)
+		return error;
+
+	return 0;
+}
+
+static int goodix_berlin_suspend(struct device *dev)
+{
+	struct goodix_berlin_core *cd = dev_get_drvdata(dev);
+
+	disable_irq(cd->irq);
+	goodix_berlin_power_off(cd);
+
+	return 0;
+}
+
+static int goodix_berlin_resume(struct device *dev)
+{
+	struct goodix_berlin_core *cd = dev_get_drvdata(dev);
+	int error;
+
+	error = goodix_berlin_power_on(cd);
+	if (error)
+		return error;
+
+	enable_irq(cd->irq);
+
+	return 0;
+}
+
+EXPORT_GPL_SIMPLE_DEV_PM_OPS(goodix_berlin_pm_ops,
+			     goodix_berlin_suspend, goodix_berlin_resume);
+
+static void goodix_berlin_power_off_act(void *data)
+{
+	struct goodix_berlin_core *cd = data;
+
+	goodix_berlin_power_off(cd);
+}
+
+int goodix_berlin_probe(struct device *dev, int irq, const struct input_id *id,
+			struct regmap *regmap)
+{
+	struct goodix_berlin_core *cd;
+	int error;
+
+	if (irq <= 0) {
+		dev_err(dev, "Missing interrupt number\n");
+		return -EINVAL;
+	}
+
+	cd = devm_kzalloc(dev, sizeof(*cd), GFP_KERNEL);
+	if (!cd)
+		return -ENOMEM;
+
+	cd->dev = dev;
+	cd->regmap = regmap;
+	cd->irq = irq;
+
+	cd->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+	if (IS_ERR(cd->reset_gpio))
+		return dev_err_probe(dev, PTR_ERR(cd->reset_gpio),
+				     "Failed to request reset gpio\n");
+
+	cd->avdd = devm_regulator_get(dev, "avdd");
+	if (IS_ERR(cd->avdd))
+		return dev_err_probe(dev, PTR_ERR(cd->avdd),
+				     "Failed to request avdd regulator\n");
+
+	cd->iovdd = devm_regulator_get(dev, "iovdd");
+	if (IS_ERR(cd->iovdd))
+		return dev_err_probe(dev, PTR_ERR(cd->iovdd),
+				     "Failed to request iovdd regulator\n");
+
+	error = goodix_berlin_power_on(cd);
+	if (error) {
+		dev_err(dev, "failed power on");
+		return error;
+	}
+
+	error = devm_add_action_or_reset(dev, goodix_berlin_power_off_act, cd);
+	if (error)
+		return error;
+
+	error = goodix_berlin_read_version(cd);
+	if (error) {
+		dev_err(dev, "failed to get version info");
+		return error;
+	}
+
+	error = goodix_berlin_get_ic_info(cd);
+	if (error) {
+		dev_err(dev, "invalid ic info, abort");
+		return error;
+	}
+
+	error = goodix_berlin_input_dev_config(cd, id);
+	if (error) {
+		dev_err(dev, "failed set input device");
+		return error;
+	}
+
+	error = devm_request_threaded_irq(dev, cd->irq, NULL, goodix_berlin_irq,
+					  IRQF_ONESHOT, "goodix-berlin", cd);
+	if (error) {
+		dev_err(dev, "request threaded irq failed: %d\n", error);
+		return error;
+	}
+
+	dev_set_drvdata(dev, cd);
+
+	dev_dbg(dev, "Goodix Berlin %s Touchscreen Controller",
+		cd->fw_version.patch_pid);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(goodix_berlin_probe);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Goodix Berlin Core Touchscreen driver");
+MODULE_AUTHOR("Neil Armstrong <neil.armstrong@linaro.org>");
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/goodix_berlin_i2c.c
+++ linux-qcom-6.8.0/drivers/input/touchscreen/goodix_berlin_i2c.c
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Goodix Berlin Touchscreen Driver
+ *
+ * Copyright (C) 2020 - 2021 Goodix, Inc.
+ * Copyright (C) 2023 Linaro Ltd.
+ *
+ * Based on goodix_ts_berlin driver.
+ */
+#include <linux/i2c.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/regmap.h>
+#include <linux/input.h>
+
+#include "goodix_berlin.h"
+
+#define I2C_MAX_TRANSFER_SIZE		256
+
+static const struct regmap_config goodix_berlin_i2c_regmap_conf = {
+	.reg_bits = 32,
+	.val_bits = 8,
+	.max_raw_read = I2C_MAX_TRANSFER_SIZE,
+	.max_raw_write = I2C_MAX_TRANSFER_SIZE,
+};
+
+/* vendor & product left unassigned here, should probably be updated from fw info */
+static const struct input_id goodix_berlin_i2c_input_id = {
+	.bustype = BUS_I2C,
+};
+
+static int goodix_berlin_i2c_probe(struct i2c_client *client)
+{
+	struct regmap *regmap;
+	int error;
+
+	regmap = devm_regmap_init_i2c(client, &goodix_berlin_i2c_regmap_conf);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	error = goodix_berlin_probe(&client->dev, client->irq,
+				    &goodix_berlin_i2c_input_id, regmap);
+	if (error)
+		return error;
+
+	return 0;
+}
+
+static const struct i2c_device_id goodix_berlin_i2c_id[] = {
+	{ "gt9916", 0 },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(i2c, goodix_berlin_i2c_id);
+
+static const struct of_device_id goodix_berlin_i2c_of_match[] = {
+	{ .compatible = "goodix,gt9916", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, goodix_berlin_i2c_of_match);
+
+static struct i2c_driver goodix_berlin_i2c_driver = {
+	.driver = {
+		.name = "goodix-berlin-i2c",
+		.of_match_table = goodix_berlin_i2c_of_match,
+		.pm = pm_sleep_ptr(&goodix_berlin_pm_ops),
+	},
+	.probe = goodix_berlin_i2c_probe,
+	.id_table = goodix_berlin_i2c_id,
+};
+module_i2c_driver(goodix_berlin_i2c_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Goodix Berlin I2C Touchscreen driver");
+MODULE_AUTHOR("Neil Armstrong <neil.armstrong@linaro.org>");
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/goodix_berlin_spi.c
+++ linux-qcom-6.8.0/drivers/input/touchscreen/goodix_berlin_spi.c
@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Goodix Berlin Touchscreen Driver
+ *
+ * Copyright (C) 2020 - 2021 Goodix, Inc.
+ * Copyright (C) 2023 Linaro Ltd.
+ *
+ * Based on goodix_ts_berlin driver.
+ */
+#include <asm/unaligned.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/regmap.h>
+#include <linux/spi/spi.h>
+#include <linux/input.h>
+
+#include "goodix_berlin.h"
+
+#define GOODIX_BERLIN_SPI_TRANS_PREFIX_LEN	1
+#define GOODIX_BERLIN_REGISTER_WIDTH		4
+#define GOODIX_BERLIN_SPI_READ_DUMMY_LEN	3
+#define GOODIX_BERLIN_SPI_READ_PREFIX_LEN	(GOODIX_BERLIN_SPI_TRANS_PREFIX_LEN + \
+						 GOODIX_BERLIN_REGISTER_WIDTH + \
+						 GOODIX_BERLIN_SPI_READ_DUMMY_LEN)
+#define GOODIX_BERLIN_SPI_WRITE_PREFIX_LEN	(GOODIX_BERLIN_SPI_TRANS_PREFIX_LEN + \
+						 GOODIX_BERLIN_REGISTER_WIDTH)
+
+#define GOODIX_BERLIN_SPI_WRITE_FLAG		0xF0
+#define GOODIX_BERLIN_SPI_READ_FLAG		0xF1
+
+static int goodix_berlin_spi_read(void *context, const void *reg_buf,
+				  size_t reg_size, void *val_buf,
+				  size_t val_size)
+{
+	struct spi_device *spi = context;
+	struct spi_transfer xfers;
+	struct spi_message spi_msg;
+	const u32 *reg = reg_buf; /* reg is stored as native u32 at start of buffer */
+	u8 *buf;
+	int error;
+
+	if (reg_size != GOODIX_BERLIN_REGISTER_WIDTH)
+		return -EINVAL;
+
+	buf = kzalloc(GOODIX_BERLIN_SPI_READ_PREFIX_LEN + val_size, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	spi_message_init(&spi_msg);
+	memset(&xfers, 0, sizeof(xfers));
+
+	/* buffer format: 0xF1 + addr(4bytes) + dummy(3bytes) + data */
+	buf[0] = GOODIX_BERLIN_SPI_READ_FLAG;
+	put_unaligned_be32(*reg, buf + GOODIX_BERLIN_SPI_TRANS_PREFIX_LEN);
+	memset(buf + GOODIX_BERLIN_SPI_TRANS_PREFIX_LEN + GOODIX_BERLIN_REGISTER_WIDTH,
+	       0xff, GOODIX_BERLIN_SPI_READ_DUMMY_LEN);
+
+	xfers.tx_buf = buf;
+	xfers.rx_buf = buf;
+	xfers.len = GOODIX_BERLIN_SPI_READ_PREFIX_LEN + val_size;
+	xfers.cs_change = 0;
+	spi_message_add_tail(&xfers, &spi_msg);
+
+	error = spi_sync(spi, &spi_msg);
+	if (error < 0)
+		dev_err(&spi->dev, "spi transfer error, %d", error);
+	else
+		memcpy(val_buf, buf + GOODIX_BERLIN_SPI_READ_PREFIX_LEN, val_size);
+
+	kfree(buf);
+	return error;
+}
+
+static int goodix_berlin_spi_write(void *context, const void *data,
+				   size_t count)
+{
+	unsigned int len = count - GOODIX_BERLIN_REGISTER_WIDTH;
+	struct spi_device *spi = context;
+	struct spi_transfer xfers;
+	struct spi_message spi_msg;
+	const u32 *reg = data; /* reg is stored as native u32 at start of buffer */
+	u8 *buf;
+	int error;
+
+	buf = kzalloc(GOODIX_BERLIN_SPI_WRITE_PREFIX_LEN + len, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	spi_message_init(&spi_msg);
+	memset(&xfers, 0, sizeof(xfers));
+
+	buf[0] = GOODIX_BERLIN_SPI_WRITE_FLAG;
+	put_unaligned_be32(*reg, buf + GOODIX_BERLIN_SPI_TRANS_PREFIX_LEN);
+	memcpy(buf + GOODIX_BERLIN_SPI_WRITE_PREFIX_LEN,
+	       data + GOODIX_BERLIN_REGISTER_WIDTH, len);
+
+	xfers.tx_buf = buf;
+	xfers.len = GOODIX_BERLIN_SPI_WRITE_PREFIX_LEN + len;
+	xfers.cs_change = 0;
+	spi_message_add_tail(&xfers, &spi_msg);
+
+	error = spi_sync(spi, &spi_msg);
+	if (error < 0)
+		dev_err(&spi->dev, "spi transfer error, %d", error);
+
+	kfree(buf);
+	return error;
+}
+
+static const struct regmap_config goodix_berlin_spi_regmap_conf = {
+	.reg_bits = 32,
+	.val_bits = 8,
+	.read = goodix_berlin_spi_read,
+	.write = goodix_berlin_spi_write,
+};
+
+/* vendor & product left unassigned here, should probably be updated from fw info */
+static const struct input_id goodix_berlin_spi_input_id = {
+	.bustype = BUS_SPI,
+};
+
+static int goodix_berlin_spi_probe(struct spi_device *spi)
+{
+	struct regmap_config regmap_config;
+	struct regmap *regmap;
+	size_t max_size;
+	int error = 0;
+
+	spi->mode = SPI_MODE_0;
+	spi->bits_per_word = 8;
+	error = spi_setup(spi);
+	if (error)
+		return error;
+
+	max_size = spi_max_transfer_size(spi);
+
+	regmap_config = goodix_berlin_spi_regmap_conf;
+	regmap_config.max_raw_read = max_size - GOODIX_BERLIN_SPI_READ_PREFIX_LEN;
+	regmap_config.max_raw_write = max_size - GOODIX_BERLIN_SPI_WRITE_PREFIX_LEN;
+
+	regmap = devm_regmap_init(&spi->dev, NULL, spi, &regmap_config);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	error = goodix_berlin_probe(&spi->dev, spi->irq,
+				    &goodix_berlin_spi_input_id, regmap);
+	if (error)
+		return error;
+
+	return 0;
+}
+
+static const struct spi_device_id goodix_berlin_spi_ids[] = {
+	{ "gt9916" },
+	{ },
+};
+MODULE_DEVICE_TABLE(spi, goodix_berlin_spi_ids);
+
+static const struct of_device_id goodix_berlin_spi_of_match[] = {
+	{ .compatible = "goodix,gt9916", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, goodix_berlin_spi_of_match);
+
+static struct spi_driver goodix_berlin_spi_driver = {
+	.driver = {
+		.name = "goodix-berlin-spi",
+		.of_match_table = goodix_berlin_spi_of_match,
+		.pm = pm_sleep_ptr(&goodix_berlin_pm_ops),
+	},
+	.probe = goodix_berlin_spi_probe,
+	.id_table = goodix_berlin_spi_ids,
+};
+module_spi_driver(goodix_berlin_spi_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Goodix Berlin SPI Touchscreen driver");
+MODULE_AUTHOR("Neil Armstrong <neil.armstrong@linaro.org>");
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/ili210x.c
+++ linux-qcom-6.8.0/drivers/input/touchscreen/ili210x.c
@@ -261,8 +261,8 @@
 	if (!error && data[0] == 2) {
 		error = i2c_master_recv(client, data + ILI251X_DATA_SIZE1,
 					ILI251X_DATA_SIZE2);
-		if (error >= 0 && error != ILI251X_DATA_SIZE2)
-			error = -EIO;
+		if (error >= 0)
+			error = error == ILI251X_DATA_SIZE2 ? 0 : -EIO;
 	}
 
 	return error;
@@ -597,7 +597,7 @@
 	 * once, copy them all into this buffer at the right locations, and then
 	 * do all operations on this linear buffer.
 	 */
-	fw_buf = kzalloc(SZ_64K, GFP_KERNEL);
+	fw_buf = kvmalloc(SZ_64K, GFP_KERNEL);
 	if (!fw_buf)
 		return -ENOMEM;
 
@@ -627,7 +627,7 @@
 	return 0;
 
 err_big:
-	kfree(fw_buf);
+	kvfree(fw_buf);
 	return error;
 }
 
@@ -870,7 +870,7 @@
 	ili210x_hardware_reset(priv->reset_gpio);
 	dev_dbg(dev, "Firmware update ended, error=%i\n", error);
 	enable_irq(client->irq);
-	kfree(fwbuf);
+	kvfree(fwbuf);
 	return error;
 }
 
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/ilitek_ts_i2c.c
+++ linux-qcom-6.8.0/drivers/input/touchscreen/ilitek_ts_i2c.c
@@ -37,6 +37,8 @@
 #define ILITEK_TP_CMD_GET_MCU_VER			0x61
 #define ILITEK_TP_CMD_GET_IC_MODE			0xC0
 
+#define ILITEK_TP_I2C_REPORT_ID				0x48
+
 #define REPORT_COUNT_ADDRESS				61
 #define ILITEK_SUPPORT_MAX_POINT			40
 
@@ -160,15 +162,19 @@
 	error = ilitek_i2c_write_and_read(ts, NULL, 0, 0, buf, 64);
 	if (error) {
 		dev_err(dev, "get touch info failed, err:%d\n", error);
-		goto err_sync_frame;
+		return error;
+	}
+
+	if (buf[0] != ILITEK_TP_I2C_REPORT_ID) {
+		dev_err(dev, "get touch info failed. Wrong id: 0x%02X\n", buf[0]);
+		return -EINVAL;
 	}
 
 	report_max_point = buf[REPORT_COUNT_ADDRESS];
 	if (report_max_point > ts->max_tp) {
 		dev_err(dev, "FW report max point:%d > panel info. max:%d\n",
 			report_max_point, ts->max_tp);
-		error = -EINVAL;
-		goto err_sync_frame;
+		return -EINVAL;
 	}
 
 	count = DIV_ROUND_UP(report_max_point, packet_max_point);
@@ -178,7 +184,7 @@
 		if (error) {
 			dev_err(dev, "get touch info. failed, cnt:%d, err:%d\n",
 				count, error);
-			goto err_sync_frame;
+			return error;
 		}
 	}
 
@@ -203,10 +209,10 @@
 		ilitek_touch_down(ts, id, x, y);
 	}
 
-err_sync_frame:
 	input_mt_sync_frame(input);
 	input_sync(input);
-	return error;
+
+	return 0;
 }
 
 /* APIs of cmds for ILITEK Touch IC */
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/imagis.c
+++ linux-qcom-6.8.0/drivers/input/touchscreen/imagis.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
+#include <linux/bitfield.h>
 #include <linux/bits.h>
 #include <linux/delay.h>
 #include <linux/i2c.h>
@@ -23,12 +24,9 @@
 #define IST3038C_I2C_RETRY_COUNT	3
 #define IST3038C_MAX_FINGER_NUM		10
 #define IST3038C_X_MASK			GENMASK(23, 12)
-#define IST3038C_X_SHIFT		12
 #define IST3038C_Y_MASK			GENMASK(11, 0)
 #define IST3038C_AREA_MASK		GENMASK(27, 24)
-#define IST3038C_AREA_SHIFT		24
 #define IST3038C_FINGER_COUNT_MASK	GENMASK(15, 12)
-#define IST3038C_FINGER_COUNT_SHIFT	12
 #define IST3038C_FINGER_STATUS_MASK	GENMASK(9, 0)
 
 struct imagis_ts {
@@ -92,8 +90,7 @@
 		goto out;
 	}
 
-	finger_count = (intr_message & IST3038C_FINGER_COUNT_MASK) >>
-				IST3038C_FINGER_COUNT_SHIFT;
+	finger_count = FIELD_GET(IST3038C_FINGER_COUNT_MASK, intr_message);
 	if (finger_count > IST3038C_MAX_FINGER_NUM) {
 		dev_err(&ts->client->dev,
 			"finger count %d is more than maximum supported\n",
@@ -101,7 +98,7 @@
 		goto out;
 	}
 
-	finger_pressed = intr_message & IST3038C_FINGER_STATUS_MASK;
+	finger_pressed = FIELD_GET(IST3038C_FINGER_STATUS_MASK, intr_message);
 
 	for (i = 0; i < finger_count; i++) {
 		error = imagis_i2c_read_reg(ts,
@@ -118,12 +115,11 @@
 		input_mt_report_slot_state(ts->input_dev, MT_TOOL_FINGER,
 					   finger_pressed & BIT(i));
 		touchscreen_report_pos(ts->input_dev, &ts->prop,
-				       (finger_status & IST3038C_X_MASK) >>
-						IST3038C_X_SHIFT,
-				       finger_status & IST3038C_Y_MASK, 1);
+				       FIELD_GET(IST3038C_X_MASK, finger_status),
+				       FIELD_GET(IST3038C_Y_MASK, finger_status),
+				       true);
 		input_report_abs(ts->input_dev, ABS_MT_TOUCH_MAJOR,
-				 (finger_status & IST3038C_AREA_MASK) >>
-					IST3038C_AREA_SHIFT);
+				 FIELD_GET(IST3038C_AREA_MASK, finger_status));
 	}
 
 	input_mt_sync_frame(ts->input_dev);
@@ -210,7 +206,7 @@
 
 	input_set_capability(input_dev, EV_ABS, ABS_MT_POSITION_X);
 	input_set_capability(input_dev, EV_ABS, ABS_MT_POSITION_Y);
-	input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR, 0, 255, 0, 0);
+	input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR, 0, 16, 0, 0);
 
 	touchscreen_parse_properties(input_dev, true, &ts->prop);
 	if (!ts->prop.max_x || !ts->prop.max_y) {
--- linux-qcom-6.8.0.orig/drivers/input/touchscreen/silead.c
+++ linux-qcom-6.8.0/drivers/input/touchscreen/silead.c
@@ -71,7 +71,6 @@
 	struct regulator_bulk_data regulators[2];
 	char fw_name[64];
 	struct touchscreen_properties prop;
-	u32 max_fingers;
 	u32 chip_id;
 	struct input_mt_pos pos[SILEAD_MAX_FINGERS];
 	int slots[SILEAD_MAX_FINGERS];
@@ -136,7 +135,7 @@
 	touchscreen_parse_properties(data->input, true, &data->prop);
 	silead_apply_efi_fw_min_max(data);
 
-	input_mt_init_slots(data->input, data->max_fingers,
+	input_mt_init_slots(data->input, SILEAD_MAX_FINGERS,
 			    INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED |
 			    INPUT_MT_TRACK);
 
@@ -256,10 +255,10 @@
 		return;
 	}
 
-	if (buf[0] > data->max_fingers) {
+	if (buf[0] > SILEAD_MAX_FINGERS) {
 		dev_warn(dev, "More touches reported then supported %d > %d\n",
-			 buf[0], data->max_fingers);
-		buf[0] = data->max_fingers;
+			 buf[0], SILEAD_MAX_FINGERS);
+		buf[0] = SILEAD_MAX_FINGERS;
 	}
 
 	if (silead_ts_handle_pen_data(data, buf))
@@ -315,7 +314,6 @@
 
 static int silead_ts_init(struct i2c_client *client)
 {
-	struct silead_ts_data *data = i2c_get_clientdata(client);
 	int error;
 
 	error = i2c_smbus_write_byte_data(client, SILEAD_REG_RESET,
@@ -325,7 +323,7 @@
 	usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX);
 
 	error = i2c_smbus_write_byte_data(client, SILEAD_REG_TOUCH_NR,
-					data->max_fingers);
+					  SILEAD_MAX_FINGERS);
 	if (error)
 		goto i2c_write_err;
 	usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX);
@@ -591,13 +589,6 @@
 	const char *str;
 	int error;
 
-	error = device_property_read_u32(dev, "silead,max-fingers",
-					 &data->max_fingers);
-	if (error) {
-		dev_dbg(dev, "Max fingers read error %d\n", error);
-		data->max_fingers = 5; /* Most devices handle up-to 5 fingers */
-	}
-
 	error = device_property_read_string(dev, "firmware-name", &str);
 	if (!error)
 		snprintf(data->fw_name, sizeof(data->fw_name),
--- linux-qcom-6.8.0.orig/drivers/interconnect/core.c
+++ linux-qcom-6.8.0/drivers/interconnect/core.c
@@ -176,6 +176,8 @@
 
 	path->num_nodes = num_nodes;
 
+	mutex_lock(&icc_bw_lock);
+
 	for (i = num_nodes - 1; i >= 0; i--) {
 		node->provider->users++;
 		hlist_add_head(&path->reqs[i].req_node, &node->req_list);
@@ -186,6 +188,8 @@
 		node = node->reverse;
 	}
 
+	mutex_unlock(&icc_bw_lock);
+
 	return path;
 }
 
@@ -792,12 +796,16 @@
 		pr_err("%s: error (%d)\n", __func__, ret);
 
 	mutex_lock(&icc_lock);
+	mutex_lock(&icc_bw_lock);
+
 	for (i = 0; i < path->num_nodes; i++) {
 		node = path->reqs[i].node;
 		hlist_del(&path->reqs[i].req_node);
 		if (!WARN_ON(!node->provider->users))
 			node->provider->users--;
 	}
+
+	mutex_unlock(&icc_bw_lock);
 	mutex_unlock(&icc_lock);
 
 	kfree_const(path->name);
--- linux-qcom-6.8.0.orig/drivers/interconnect/icc-clk.c
+++ linux-qcom-6.8.0/drivers/interconnect/icc-clk.c
@@ -87,6 +87,7 @@
 	onecell = devm_kzalloc(dev, struct_size(onecell, nodes, 2 * num_clocks), GFP_KERNEL);
 	if (!onecell)
 		return ERR_PTR(-ENOMEM);
+	onecell->num_nodes = 2 * num_clocks;
 
 	qp = devm_kzalloc(dev, struct_size(qp, clocks, num_clocks), GFP_KERNEL);
 	if (!qp)
@@ -133,8 +134,6 @@
 		onecell->nodes[j++] = node;
 	}
 
-	onecell->num_nodes = j;
-
 	ret = icc_provider_register(provider);
 	if (ret)
 		goto err;
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/Kconfig
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/Kconfig
@@ -69,6 +69,26 @@
 	  This is a driver for the Qualcomm Network-on-Chip on qcs404-based
 	  platforms.
 
+config INTERCONNECT_QCOM_QCS615
+	tristate "Qualcomm QCS615 interconnect driver"
+	depends on INTERCONNECT_QCOM_RPMH_POSSIBLE
+	select INTERCONNECT_QCOM_RPMH
+	select INTERCONNECT_QCOM_BCM_VOTER
+	help
+	  This is a driver for the Qualcomm Network-on-Chip on qcs615-based
+	  platforms.
+
+config INTERCONNECT_QCOM_QCS8300
+	tristate "Qualcomm QCS8300 interconnect driver"
+	depends on INTERCONNECT_QCOM_RPMH_POSSIBLE
+	select INTERCONNECT_QCOM_RPMH
+	select INTERCONNECT_QCOM_BCM_VOTER
+	help
+	  This is a driver for the Qualcomm Technologies, Inc. Network-on-Chip
+	  on QCS8300-based platforms. The interconnect provider collects and
+	  aggreagates the cosumer bandwidth requests to satisfy constraints
+	  placed on Network-on-Chip performance states.
+
 config INTERCONNECT_QCOM_QDU1000
 	tristate "Qualcomm QDU1000/QRU1000 interconnect driver"
 	depends on INTERCONNECT_QCOM_RPMH_POSSIBLE
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/Makefile
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/Makefile
@@ -11,6 +11,8 @@
 icc-osm-l3-objs				:= osm-l3.o
 qnoc-qcm2290-objs			:= qcm2290.o
 qnoc-qcs404-objs			:= qcs404.o
+qnoc-qcs615-objs			:= qcs615.o
+qnoc-qcs8300-objs			:= qcs8300.o
 qnoc-qdu1000-objs			:= qdu1000.o
 icc-rpmh-obj				:= icc-rpmh.o
 qnoc-sa8775p-objs			:= sa8775p.o
@@ -43,6 +45,8 @@
 obj-$(CONFIG_INTERCONNECT_QCOM_OSM_L3) += icc-osm-l3.o
 obj-$(CONFIG_INTERCONNECT_QCOM_QCM2290) += qnoc-qcm2290.o
 obj-$(CONFIG_INTERCONNECT_QCOM_QCS404) += qnoc-qcs404.o
+obj-$(CONFIG_INTERCONNECT_QCOM_QCS615) += qnoc-qcs615.o
+obj-$(CONFIG_INTERCONNECT_QCOM_QCS8300) += qnoc-qcs8300.o
 obj-$(CONFIG_INTERCONNECT_QCOM_QDU1000) += qnoc-qdu1000.o
 obj-$(CONFIG_INTERCONNECT_QCOM_RPMH) += icc-rpmh.o
 obj-$(CONFIG_INTERCONNECT_QCOM_SA8775P) += qnoc-sa8775p.o
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/bcm-voter.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/bcm-voter.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <asm/div64.h>
@@ -62,6 +63,7 @@
 static void bcm_aggregate_mask(struct qcom_icc_bcm *bcm)
 {
 	struct qcom_icc_node *node;
+	bool perf_mode[QCOM_ICC_NUM_BUCKETS] = {0};
 	int bucket, i;
 
 	for (bucket = 0; bucket < QCOM_ICC_NUM_BUCKETS; bucket++) {
@@ -70,11 +72,16 @@
 
 		for (i = 0; i < bcm->num_nodes; i++) {
 			node = bcm->nodes[i];
+			perf_mode[bucket] |= node->perf_mode[bucket];
 
 			/* If any vote in this bucket exists, keep the BCM enabled */
 			if (node->sum_avg[bucket] || node->max_peak[bucket]) {
 				bcm->vote_x[bucket] = 0;
 				bcm->vote_y[bucket] = bcm->enable_mask;
+
+				if (perf_mode[bucket])
+					bcm->vote_y[bucket] |= bcm->perf_mode_mask;
+
 				break;
 			}
 		}
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/icc-rpmh.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/icc-rpmh.c
@@ -1,8 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
+#include <linux/clk.h>
 #include <linux/interconnect.h>
 #include <linux/interconnect-provider.h>
 #include <linux/module.h>
@@ -14,6 +16,43 @@
 #include "icc-common.h"
 #include "icc-rpmh.h"
 
+/* QNOC QoS */
+#define QOSGEN_MAINCTL_LO(p, qp)	(0x8 + (p->offsets[qp]))
+#define QOS_SLV_URG_MSG_EN_SHFT		3
+#define QOS_DFLT_PRIO_MASK		0x7
+#define QOS_DFLT_PRIO_SHFT		4
+#define QOS_DISABLE_SHIFT		24
+
+/**
+ * qcom_icc_set_qos - initialize static QoS configurations
+ * @node: qcom icc node to operate on
+ */
+static void qcom_icc_set_qos(struct qcom_icc_node *node)
+{
+	struct qcom_icc_qosbox *qos = node->qosbox;
+	int port;
+
+	if (!node->regmap)
+		return;
+
+	if (!qos)
+		return;
+
+	for (port = 0; port < qos->num_ports; port++) {
+		regmap_update_bits(node->regmap, QOSGEN_MAINCTL_LO(qos, port),
+				   BIT(QOS_DISABLE_SHIFT),
+				   qos->prio_fwd_disable << QOS_DISABLE_SHIFT);
+
+		regmap_update_bits(node->regmap, QOSGEN_MAINCTL_LO(qos, port),
+				   QOS_DFLT_PRIO_MASK << QOS_DFLT_PRIO_SHFT,
+				   qos->prio << QOS_DFLT_PRIO_SHFT);
+
+		regmap_update_bits(node->regmap, QOSGEN_MAINCTL_LO(qos, port),
+				   BIT(QOS_SLV_URG_MSG_EN_SHFT),
+				   qos->urg_fwd << QOS_SLV_URG_MSG_EN_SHFT);
+	}
+}
+
 /**
  * qcom_icc_pre_aggregate - cleans up stale values from prior icc_set
  * @node: icc node to operate on
@@ -30,6 +69,7 @@
 	for (i = 0; i < QCOM_ICC_NUM_BUCKETS; i++) {
 		qn->sum_avg[i] = 0;
 		qn->max_peak[i] = 0;
+		qn->perf_mode[i] = false;
 	}
 
 	for (i = 0; i < qn->num_bcms; i++)
@@ -61,6 +101,8 @@
 		if (tag & BIT(i)) {
 			qn->sum_avg[i] += avg_bw;
 			qn->max_peak[i] = max_t(u32, qn->max_peak[i], peak_bw);
+			if (tag & QCOM_ICC_TAG_PERF_MODE && (avg_bw || peak_bw))
+				qn->perf_mode[i] = true;
 		}
 
 		if (node->init_avg || node->init_peak) {
@@ -159,6 +201,113 @@
 }
 EXPORT_SYMBOL_GPL(qcom_icc_bcm_init);
 
+static bool bcm_needs_qos_proxy(struct qcom_icc_bcm *bcm)
+{
+	int i;
+
+	for (i = 0; i < bcm->num_nodes; i++)
+		if (bcm->nodes[i]->qosbox)
+			return true;
+
+	return false;
+}
+
+static int enable_qos_deps(struct qcom_icc_provider *qp)
+{
+	struct qcom_icc_bcm *bcm;
+	bool keepalive;
+	int ret, i;
+
+	for (i = 0; i < qp->num_bcms; i++) {
+		bcm = qp->bcms[i];
+		if (bcm_needs_qos_proxy(bcm)) {
+			keepalive = bcm->keepalive;
+			bcm->keepalive = true;
+
+			qcom_icc_bcm_voter_add(qp->voter, bcm);
+			ret = qcom_icc_bcm_voter_commit(qp->voter);
+
+			bcm->keepalive = keepalive;
+
+			if (ret) {
+				dev_err(qp->dev, "failed to vote BW to %s for QoS\n",
+					bcm->name);
+				return ret;
+			}
+		}
+	}
+
+	ret = clk_bulk_prepare_enable(qp->num_clks, qp->clks);
+	if (ret) {
+		dev_err(qp->dev, "failed to enable clocks for QoS\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+static void disable_qos_deps(struct qcom_icc_provider *qp)
+{
+	struct qcom_icc_bcm *bcm;
+	int i;
+
+	clk_bulk_disable_unprepare(qp->num_clks, qp->clks);
+
+	for (i = 0; i < qp->num_bcms; i++) {
+		bcm = qp->bcms[i];
+		if (bcm_needs_qos_proxy(bcm)) {
+			qcom_icc_bcm_voter_add(qp->voter, bcm);
+			qcom_icc_bcm_voter_commit(qp->voter);
+		}
+	}
+}
+
+int qcom_icc_rpmh_configure_qos(struct qcom_icc_provider *qp)
+{
+	struct qcom_icc_node *qnode;
+	size_t i;
+	int ret;
+
+	ret = enable_qos_deps(qp);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < qp->num_nodes; i++) {
+		qnode = qp->nodes[i];
+		if (!qnode)
+			continue;
+
+		if (qnode->qosbox)
+			qcom_icc_set_qos(qnode);
+	}
+
+	disable_qos_deps(qp);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_icc_rpmh_configure_qos);
+
+static struct regmap *qcom_icc_rpmh_map(struct platform_device *pdev,
+					const struct qcom_icc_desc *desc)
+{
+	void __iomem *base;
+	struct resource *res;
+	struct device *dev = &pdev->dev;
+
+	if (!desc->config)
+		return NULL;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res)
+		return NULL;
+
+	base = devm_ioremap(dev, res->start, resource_size(res));
+	if (IS_ERR(base))
+		return ERR_CAST(base);
+
+	return devm_regmap_init_mmio(dev, base, desc->config);
+}
+
 int qcom_icc_rpmh_probe(struct platform_device *pdev)
 {
 	const struct qcom_icc_desc *desc;
@@ -199,12 +348,22 @@
 
 	qp->dev = dev;
 	qp->bcms = desc->bcms;
+	qp->nodes = desc->nodes;
 	qp->num_bcms = desc->num_bcms;
+	qp->num_nodes = desc->num_nodes;
 
 	qp->voter = of_bcm_voter_get(qp->dev, NULL);
 	if (IS_ERR(qp->voter))
 		return PTR_ERR(qp->voter);
 
+	qp->regmap = qcom_icc_rpmh_map(pdev, desc);
+	if (IS_ERR(qp->regmap))
+		return PTR_ERR(qp->regmap);
+
+	qp->num_clks = devm_clk_bulk_get_all(qp->dev, &qp->clks);
+	if (qp->num_clks < 0)
+		return qp->num_clks;
+
 	for (i = 0; i < qp->num_bcms; i++)
 		qcom_icc_bcm_init(qp->bcms[i], dev);
 
@@ -213,6 +372,8 @@
 		if (!qn)
 			continue;
 
+		qn->regmap = dev_get_regmap(qp->dev, NULL);
+
 		node = icc_node_create(qn->id);
 		if (IS_ERR(node)) {
 			ret = PTR_ERR(node);
@@ -229,6 +390,10 @@
 		data->nodes[i] = node;
 	}
 
+	ret = qcom_icc_rpmh_configure_qos(qp);
+	if (ret)
+		goto err_remove_nodes;
+
 	ret = icc_provider_register(provider);
 	if (ret)
 		goto err_remove_nodes;
@@ -247,6 +412,7 @@
 err_deregister_provider:
 	icc_provider_deregister(provider);
 err_remove_nodes:
+	clk_bulk_put_all(qp->num_clks, qp->clks);
 	icc_nodes_remove(provider);
 
 	return ret;
@@ -258,6 +424,7 @@
 	struct qcom_icc_provider *qp = platform_get_drvdata(pdev);
 
 	icc_provider_deregister(&qp->provider);
+	clk_bulk_put_all(qp->num_clks, qp->clks);
 	icc_nodes_remove(&qp->provider);
 }
 EXPORT_SYMBOL_GPL(qcom_icc_rpmh_remove);
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/icc-rpmh.h
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/icc-rpmh.h
@@ -1,12 +1,14 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef __DRIVERS_INTERCONNECT_QCOM_ICC_RPMH_H__
 #define __DRIVERS_INTERCONNECT_QCOM_ICC_RPMH_H__
 
 #include <dt-bindings/interconnect/qcom,icc.h>
+#include <linux/regmap.h>
 
 #define to_qcom_provider(_provider) \
 	container_of(_provider, struct qcom_icc_provider, provider)
@@ -18,6 +20,11 @@
  * @bcms: list of bcms that maps to the provider
  * @num_bcms: number of @bcms
  * @voter: bcm voter targeted by this provider
+ * @nodes: list of icc nodes that maps to the provider
+ * @num_nodes: number of @nodes
+ * @regmap: used for NOC registers access
+ * @clks : clks required for register access
+ * @num_clks: number of @clks
  */
 struct qcom_icc_provider {
 	struct icc_provider provider;
@@ -25,6 +32,11 @@
 	struct qcom_icc_bcm * const *bcms;
 	size_t num_bcms;
 	struct bcm_voter *voter;
+	struct qcom_icc_node * const *nodes;
+	size_t num_nodes;
+	struct regmap *regmap;
+	struct clk_bulk_data *clks;
+	int num_clks;
 };
 
 /**
@@ -41,6 +53,23 @@
 	u8 reserved;
 };
 
+/**
+ * struct qcom_icc_qosbox - Qualcomm Technologies, Inc specific QoS config
+ * @prio: priority value assigned to requests on the node
+ * @urg_fwd: if set, master priority is used for requests.
+ * @prio_fwd_disable: if set, master priority is ignored and NOCs default priority is used.
+ * @num_ports: number of @ports
+ * @offsets: qos register offsets
+ */
+
+struct qcom_icc_qosbox {
+	u32 prio;
+	u32 urg_fwd;
+	bool prio_fwd_disable;
+	u32 num_ports;
+	u32 offsets[];
+};
+
 #define MAX_LINKS		128
 #define MAX_BCMS		64
 #define MAX_BCM_PER_NODE	3
@@ -56,8 +85,11 @@
  * @buswidth: width of the interconnect between a node and the bus
  * @sum_avg: current sum aggregate value of all avg bw requests
  * @max_peak: current max aggregate value of all peak bw requests
+ * @perf_mode: current OR aggregate value of all QCOM_ICC_TAG_PERF_MODE votes
  * @bcms: list of bcms associated with this logical node
  * @num_bcms: num of @bcms
+ * @regmap: used for NOC registers access
+ * @qosbox: qos config data associated with node
  */
 struct qcom_icc_node {
 	const char *name;
@@ -68,8 +100,11 @@
 	u16 buswidth;
 	u64 sum_avg[QCOM_ICC_NUM_BUCKETS];
 	u64 max_peak[QCOM_ICC_NUM_BUCKETS];
+	bool perf_mode[QCOM_ICC_NUM_BUCKETS];
 	struct qcom_icc_bcm *bcms[MAX_BCM_PER_NODE];
 	size_t num_bcms;
+	struct regmap *regmap;
+	struct qcom_icc_qosbox *qosbox;
 };
 
 /**
@@ -82,6 +117,7 @@
  * @vote_y: aggregated threshold values, represents peak_bw when @type is bw bcm
  * @vote_scale: scaling factor for vote_x and vote_y
  * @enable_mask: optional mask to send as vote instead of vote_x/vote_y
+ * @perf_mode_mask: mask to OR with enable_mask when QCOM_ICC_TAG_PERF_MODE is set
  * @dirty: flag used to indicate whether the bcm needs to be committed
  * @keepalive: flag used to indicate whether a keepalive is required
  * @aux_data: auxiliary data used when calculating threshold values and
@@ -99,6 +135,7 @@
 	u64 vote_y[QCOM_ICC_NUM_BUCKETS];
 	u64 vote_scale;
 	u32 enable_mask;
+	u32 perf_mode_mask;
 	bool dirty;
 	bool keepalive;
 	struct bcm_db aux_data;
@@ -114,6 +151,7 @@
 };
 
 struct qcom_icc_desc {
+	const struct regmap_config *config;
 	struct qcom_icc_node * const *nodes;
 	size_t num_nodes;
 	struct qcom_icc_bcm * const *bcms;
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/osm-l3.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/osm-l3.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/args.h>
@@ -74,6 +75,11 @@
 	OSM_L3_SLAVE_NODE,
 };
 
+enum {
+	EPSS_L3_CL1_MASTER_NODE = 20000,
+	EPSS_L3_CL1_SLAVE_NODE,
+};
+
 #define DEFINE_QNODE(_name, _id, _buswidth, ...)			\
 	static const struct qcom_osm_l3_node _name = {			\
 		.name = #_name,						\
@@ -99,6 +105,14 @@
 	[SLAVE_EPSS_L3_SHARED] = &epss_l3_slave,
 };
 
+DEFINE_QNODE(epss_l3_cl1_master, EPSS_L3_CL1_MASTER_NODE, 32, EPSS_L3_CL1_SLAVE_NODE);
+DEFINE_QNODE(epss_l3_cl1_slave, EPSS_L3_CL1_SLAVE_NODE, 32);
+
+static const struct qcom_osm_l3_node * const epss_l3_cl1_nodes[] = {
+	[MASTER_EPSS_L3_APPS] = &epss_l3_cl1_master,
+	[SLAVE_EPSS_L3_SHARED] = &epss_l3_cl1_slave,
+};
+
 static const struct qcom_osm_l3_desc osm_l3 = {
 	.nodes = osm_l3_nodes,
 	.num_nodes = ARRAY_SIZE(osm_l3_nodes),
@@ -115,6 +129,14 @@
 	.reg_perf_state = EPSS_REG_PERF_STATE,
 };
 
+static const struct qcom_osm_l3_desc epss_l3_cl1_perf_state = {
+	.nodes = epss_l3_cl1_nodes,
+	.num_nodes = ARRAY_SIZE(epss_l3_cl1_nodes),
+	.lut_row_size = EPSS_LUT_ROW_SIZE,
+	.reg_freq_lut = EPSS_REG_FREQ_LUT,
+	.reg_perf_state = EPSS_REG_PERF_STATE,
+};
+
 static const struct qcom_osm_l3_desc epss_l3_l3_vote = {
 	.nodes = epss_l3_nodes,
 	.num_nodes = ARRAY_SIZE(epss_l3_nodes),
@@ -284,6 +306,8 @@
 	{ .compatible = "qcom,sm8150-osm-l3", .data = &osm_l3 },
 	{ .compatible = "qcom,sc8180x-osm-l3", .data = &osm_l3 },
 	{ .compatible = "qcom,sm8250-epss-l3", .data = &epss_l3_perf_state },
+	{ .compatible = "qcom,sa8775p-epss-l3-cl0", .data = &epss_l3_perf_state },
+	{ .compatible = "qcom,sa8775p-epss-l3-cl1", .data = &epss_l3_cl1_perf_state },
 	{ }
 };
 MODULE_DEVICE_TABLE(of, osm_l3_of_match);
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/qcm2290.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/qcm2290.c
@@ -164,9 +164,9 @@
 	.name = "mas_snoc_bimc",
 	.buswidth = 16,
 	.qos.ap_owned = true,
-	.qos.qos_port = 2,
+	.qos.qos_port = 6,
 	.qos.qos_mode = NOC_QOS_MODE_BYPASS,
-	.mas_rpm_id = 164,
+	.mas_rpm_id = 3,
 	.slv_rpm_id = -1,
 	.num_links = ARRAY_SIZE(mas_snoc_bimc_links),
 	.links = mas_snoc_bimc_links,
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/qcs615.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/qcs615.c
@@ -0,0 +1,1563 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+#include <linux/device.h>
+#include <linux/interconnect.h>
+#include <linux/interconnect-provider.h>
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <dt-bindings/interconnect/qcom,qcs615-rpmh.h>
+
+#include "bcm-voter.h"
+#include "icc-rpmh.h"
+#include "qcs615.h"
+
+static struct qcom_icc_node qhm_a1noc_cfg = {
+	.name = "qhm_a1noc_cfg",
+	.id = QCS615_MASTER_A1NOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_SERVICE_A2NOC },
+};
+
+static struct qcom_icc_node qhm_qdss_bam = {
+	.name = "qhm_qdss_bam",
+	.id = QCS615_MASTER_QDSS_BAM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qhm_qspi = {
+	.name = "qhm_qspi",
+	.id = QCS615_MASTER_QSPI,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qhm_qup0 = {
+	.name = "qhm_qup0",
+	.id = QCS615_MASTER_QUP_0,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qhm_qup1 = {
+	.name = "qhm_qup1",
+	.id = QCS615_MASTER_BLSP_1,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qnm_cnoc = {
+	.name = "qnm_cnoc",
+	.id = QCS615_MASTER_CNOC_A2NOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qxm_crypto = {
+	.name = "qxm_crypto",
+	.id = QCS615_MASTER_CRYPTO,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qxm_ipa = {
+	.name = "qxm_ipa",
+	.id = QCS615_MASTER_IPA,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_LPASS_SNOC },
+};
+
+static struct qcom_icc_node xm_emac_avb = {
+	.name = "xm_emac_avb",
+	.id = QCS615_MASTER_EMAC_EVB,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_pcie = {
+	.name = "xm_pcie",
+	.id = QCS615_MASTER_PCIE,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_ANOC_PCIE_SNOC },
+};
+
+static struct qcom_icc_node xm_qdss_etr = {
+	.name = "xm_qdss_etr",
+	.id = QCS615_MASTER_QDSS_ETR,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_sdc1 = {
+	.name = "xm_sdc1",
+	.id = QCS615_MASTER_SDCC_1,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_sdc2 = {
+	.name = "xm_sdc2",
+	.id = QCS615_MASTER_SDCC_2,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_ufs_mem = {
+	.name = "xm_ufs_mem",
+	.id = QCS615_MASTER_UFS_MEM,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_usb2 = {
+	.name = "xm_usb2",
+	.id = QCS615_MASTER_USB2,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_usb3_0 = {
+	.name = "xm_usb3_0",
+	.id = QCS615_MASTER_USB3_0,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qxm_camnoc_hf0_uncomp = {
+	.name = "qxm_camnoc_hf0_uncomp",
+	.id = QCS615_MASTER_CAMNOC_HF0_UNCOMP,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_CAMNOC_UNCOMP },
+};
+
+static struct qcom_icc_node qxm_camnoc_hf1_uncomp = {
+	.name = "qxm_camnoc_hf1_uncomp",
+	.id = QCS615_MASTER_CAMNOC_HF1_UNCOMP,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_CAMNOC_UNCOMP },
+};
+
+static struct qcom_icc_node qxm_camnoc_sf_uncomp = {
+	.name = "qxm_camnoc_sf_uncomp",
+	.id = QCS615_MASTER_CAMNOC_SF_UNCOMP,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_CAMNOC_UNCOMP },
+};
+
+static struct qcom_icc_node qhm_spdm = {
+	.name = "qhm_spdm",
+	.id = QCS615_MASTER_SPDM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_CNOC_A2NOC },
+};
+
+static struct qcom_icc_node qnm_snoc = {
+	.name = "qnm_snoc",
+	.id = QCS615_MASTER_SNOC_CNOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 39,
+	.links = { QCS615_SLAVE_A1NOC_CFG, QCS615_SLAVE_AHB2PHY_EAST,
+		   QCS615_SLAVE_AHB2PHY_WEST, QCS615_SLAVE_AOP,
+		   QCS615_SLAVE_AOSS, QCS615_SLAVE_CAMERA_CFG,
+		   QCS615_SLAVE_CLK_CTL, QCS615_SLAVE_RBCPR_CX_CFG,
+		   QCS615_SLAVE_RBCPR_MX_CFG, QCS615_SLAVE_CRYPTO_0_CFG,
+		   QCS615_SLAVE_CNOC_DDRSS, QCS615_SLAVE_DISPLAY_CFG,
+		   QCS615_SLAVE_EMAC_AVB_CFG, QCS615_SLAVE_GLM,
+		   QCS615_SLAVE_GFX3D_CFG, QCS615_SLAVE_IMEM_CFG,
+		   QCS615_SLAVE_IPA_CFG, QCS615_SLAVE_CNOC_MNOC_CFG,
+		   QCS615_SLAVE_PCIE_CFG, QCS615_SLAVE_PIMEM_CFG,
+		   QCS615_SLAVE_PRNG, QCS615_SLAVE_QDSS_CFG,
+		   QCS615_SLAVE_QSPI, QCS615_SLAVE_QUP_0,
+		   QCS615_SLAVE_QUP_1, QCS615_SLAVE_SDCC_1,
+		   QCS615_SLAVE_SDCC_2, QCS615_SLAVE_SNOC_CFG,
+		   QCS615_SLAVE_SPDM_WRAPPER, QCS615_SLAVE_TCSR,
+		   QCS615_SLAVE_TLMM_EAST, QCS615_SLAVE_TLMM_SOUTH,
+		   QCS615_SLAVE_TLMM_WEST, QCS615_SLAVE_UFS_MEM_CFG,
+		   QCS615_SLAVE_USB2, QCS615_SLAVE_USB3,
+		   QCS615_SLAVE_VENUS_CFG, QCS615_SLAVE_VSENSE_CTRL_CFG,
+		   QCS615_SLAVE_SERVICE_CNOC },
+};
+
+static struct qcom_icc_node xm_qdss_dap = {
+	.name = "xm_qdss_dap",
+	.id = QCS615_MASTER_QDSS_DAP,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 40,
+	.links = { QCS615_SLAVE_A1NOC_CFG, QCS615_SLAVE_AHB2PHY_EAST,
+		   QCS615_SLAVE_AHB2PHY_WEST, QCS615_SLAVE_AOP,
+		   QCS615_SLAVE_AOSS, QCS615_SLAVE_CAMERA_CFG,
+		   QCS615_SLAVE_CLK_CTL, QCS615_SLAVE_RBCPR_CX_CFG,
+		   QCS615_SLAVE_RBCPR_MX_CFG, QCS615_SLAVE_CRYPTO_0_CFG,
+		   QCS615_SLAVE_CNOC_DDRSS, QCS615_SLAVE_DISPLAY_CFG,
+		   QCS615_SLAVE_EMAC_AVB_CFG, QCS615_SLAVE_GLM,
+		   QCS615_SLAVE_GFX3D_CFG, QCS615_SLAVE_IMEM_CFG,
+		   QCS615_SLAVE_IPA_CFG, QCS615_SLAVE_CNOC_MNOC_CFG,
+		   QCS615_SLAVE_PCIE_CFG, QCS615_SLAVE_PIMEM_CFG,
+		   QCS615_SLAVE_PRNG, QCS615_SLAVE_QDSS_CFG,
+		   QCS615_SLAVE_QSPI, QCS615_SLAVE_QUP_0,
+		   QCS615_SLAVE_QUP_1, QCS615_SLAVE_SDCC_1,
+		   QCS615_SLAVE_SDCC_2, QCS615_SLAVE_SNOC_CFG,
+		   QCS615_SLAVE_SPDM_WRAPPER, QCS615_SLAVE_TCSR,
+		   QCS615_SLAVE_TLMM_EAST, QCS615_SLAVE_TLMM_SOUTH,
+		   QCS615_SLAVE_TLMM_WEST, QCS615_SLAVE_UFS_MEM_CFG,
+		   QCS615_SLAVE_USB2, QCS615_SLAVE_USB3,
+		   QCS615_SLAVE_VENUS_CFG, QCS615_SLAVE_VSENSE_CTRL_CFG,
+		   QCS615_SLAVE_CNOC_A2NOC, QCS615_SLAVE_SERVICE_CNOC },
+};
+
+static struct qcom_icc_node qhm_cnoc = {
+	.name = "qhm_cnoc",
+	.id = QCS615_MASTER_CNOC_DC_NOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 2,
+	.links = { QCS615_SLAVE_DC_NOC_GEMNOC, QCS615_SLAVE_LLCC_CFG },
+};
+
+static struct qcom_icc_node acm_apps = {
+	.name = "acm_apps",
+	.id = QCS615_MASTER_APPSS_PROC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 3,
+	.links = { QCS615_SLAVE_GEM_NOC_SNOC, QCS615_SLAVE_LLCC,
+		   QCS615_SLAVE_MEM_NOC_PCIE_SNOC },
+};
+
+static struct qcom_icc_node acm_gpu_tcu = {
+	.name = "acm_gpu_tcu",
+	.id = QCS615_MASTER_GPU_TCU,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 2,
+	.links = { QCS615_SLAVE_GEM_NOC_SNOC, QCS615_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node acm_sys_tcu = {
+	.name = "acm_sys_tcu",
+	.id = QCS615_MASTER_SYS_TCU,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 2,
+	.links = { QCS615_SLAVE_GEM_NOC_SNOC, QCS615_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qhm_gemnoc_cfg = {
+	.name = "qhm_gemnoc_cfg",
+	.id = QCS615_MASTER_GEM_NOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 2,
+	.links = { QCS615_SLAVE_MSS_PROC_MS_MPU_CFG, QCS615_SLAVE_SERVICE_GEM_NOC },
+};
+
+static struct qcom_icc_node qnm_gpu = {
+	.name = "qnm_gpu",
+	.id = QCS615_MASTER_GFX3D,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 2,
+	.links = { QCS615_SLAVE_GEM_NOC_SNOC, QCS615_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qnm_mnoc_hf = {
+	.name = "qnm_mnoc_hf",
+	.id = QCS615_MASTER_MNOC_HF_MEM_NOC,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qnm_mnoc_sf = {
+	.name = "qnm_mnoc_sf",
+	.id = QCS615_MASTER_MNOC_SF_MEM_NOC,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 2,
+	.links = { QCS615_SLAVE_GEM_NOC_SNOC, QCS615_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qnm_snoc_gc = {
+	.name = "qnm_snoc_gc",
+	.id = QCS615_MASTER_SNOC_GC_MEM_NOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qnm_snoc_sf = {
+	.name = "qnm_snoc_sf",
+	.id = QCS615_MASTER_SNOC_SF_MEM_NOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node ipa_core_master = {
+	.name = "ipa_core_master",
+	.id = QCS615_MASTER_IPA_CORE,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_IPA_CORE },
+};
+
+static struct qcom_icc_node llcc_mc = {
+	.name = "llcc_mc",
+	.id = QCS615_MASTER_LLCC,
+	.channels = 2,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_EBI1 },
+};
+
+static struct qcom_icc_node qhm_mnoc_cfg = {
+	.name = "qhm_mnoc_cfg",
+	.id = QCS615_MASTER_CNOC_MNOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_SERVICE_MNOC },
+};
+
+static struct qcom_icc_node qxm_camnoc_hf0 = {
+	.name = "qxm_camnoc_hf0",
+	.id = QCS615_MASTER_CAMNOC_HF0,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_MNOC_HF_MEM_NOC },
+};
+
+static struct qcom_icc_node qxm_camnoc_hf1 = {
+	.name = "qxm_camnoc_hf1",
+	.id = QCS615_MASTER_CAMNOC_HF1,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_MNOC_HF_MEM_NOC },
+};
+
+static struct qcom_icc_node qxm_camnoc_sf = {
+	.name = "qxm_camnoc_sf",
+	.id = QCS615_MASTER_CAMNOC_SF,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qxm_mdp0 = {
+	.name = "qxm_mdp0",
+	.id = QCS615_MASTER_MDP0,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_MNOC_HF_MEM_NOC },
+};
+
+static struct qcom_icc_node qxm_rot = {
+	.name = "qxm_rot",
+	.id = QCS615_MASTER_ROTATOR,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qxm_venus0 = {
+	.name = "qxm_venus0",
+	.id = QCS615_MASTER_VIDEO_P0,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qxm_venus_arm9 = {
+	.name = "qxm_venus_arm9",
+	.id = QCS615_MASTER_VIDEO_PROC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qhm_snoc_cfg = {
+	.name = "qhm_snoc_cfg",
+	.id = QCS615_MASTER_SNOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_SERVICE_SNOC },
+};
+
+static struct qcom_icc_node qnm_aggre1_noc = {
+	.name = "qnm_aggre1_noc",
+	.id = QCS615_MASTER_A1NOC_SNOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 8,
+	.links = { QCS615_SLAVE_APPSS, QCS615_SLAVE_SNOC_CNOC,
+		   QCS615_SLAVE_SNOC_GEM_NOC_SF, QCS615_SLAVE_IMEM,
+		   QCS615_SLAVE_PIMEM, QCS615_SLAVE_PCIE_0,
+		   QCS615_SLAVE_QDSS_STM, QCS615_SLAVE_TCU },
+};
+
+static struct qcom_icc_node qnm_gemnoc = {
+	.name = "qnm_gemnoc",
+	.id = QCS615_MASTER_GEM_NOC_SNOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 6,
+	.links = { QCS615_SLAVE_APPSS, QCS615_SLAVE_SNOC_CNOC,
+		   QCS615_SLAVE_IMEM, QCS615_SLAVE_PIMEM,
+		   QCS615_SLAVE_QDSS_STM, QCS615_SLAVE_TCU },
+};
+
+static struct qcom_icc_node qnm_gemnoc_pcie = {
+	.name = "qnm_gemnoc_pcie",
+	.id = QCS615_MASTER_GEM_NOC_PCIE_SNOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_SLAVE_PCIE_0 },
+};
+
+static struct qcom_icc_node qnm_lpass_anoc = {
+	.name = "qnm_lpass_anoc",
+	.id = QCS615_MASTER_LPASS_ANOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 7,
+	.links = { QCS615_SLAVE_APPSS, QCS615_SLAVE_SNOC_CNOC,
+		   QCS615_SLAVE_SNOC_GEM_NOC_SF, QCS615_SLAVE_IMEM,
+		   QCS615_SLAVE_PIMEM, QCS615_SLAVE_PCIE_0,
+		   QCS615_SLAVE_QDSS_STM },
+};
+
+static struct qcom_icc_node qnm_pcie_anoc = {
+	.name = "qnm_pcie_anoc",
+	.id = QCS615_MASTER_ANOC_PCIE_SNOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 5,
+	.links = { QCS615_SLAVE_APPSS, QCS615_SLAVE_SNOC_CNOC,
+		   QCS615_SLAVE_SNOC_GEM_NOC_SF, QCS615_SLAVE_IMEM,
+		   QCS615_SLAVE_QDSS_STM },
+};
+
+static struct qcom_icc_node qxm_pimem = {
+	.name = "qxm_pimem",
+	.id = QCS615_MASTER_PIMEM,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 2,
+	.links = { QCS615_SLAVE_SNOC_MEM_NOC_GC, QCS615_SLAVE_IMEM },
+};
+
+static struct qcom_icc_node xm_gic = {
+	.name = "xm_gic",
+	.id = QCS615_MASTER_GIC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 2,
+	.links = { QCS615_SLAVE_SNOC_MEM_NOC_GC, QCS615_SLAVE_IMEM },
+};
+
+static struct qcom_icc_node qns_a1noc_snoc = {
+	.name = "qns_a1noc_snoc",
+	.id = QCS615_SLAVE_A1NOC_SNOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS615_MASTER_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qns_lpass_snoc = {
+	.name = "qns_lpass_snoc",
+	.id = QCS615_SLAVE_LPASS_SNOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_MASTER_LPASS_ANOC },
+};
+
+static struct qcom_icc_node qns_pcie_snoc = {
+	.name = "qns_pcie_snoc",
+	.id = QCS615_SLAVE_ANOC_PCIE_SNOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_MASTER_ANOC_PCIE_SNOC },
+};
+
+static struct qcom_icc_node srvc_aggre2_noc = {
+	.name = "srvc_aggre2_noc",
+	.id = QCS615_SLAVE_SERVICE_A2NOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_camnoc_uncomp = {
+	.name = "qns_camnoc_uncomp",
+	.id = QCS615_SLAVE_CAMNOC_UNCOMP,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_a1_noc_cfg = {
+	.name = "qhs_a1_noc_cfg",
+	.id = QCS615_SLAVE_A1NOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_MASTER_A1NOC_CFG },
+};
+
+static struct qcom_icc_node qhs_ahb2phy_east = {
+	.name = "qhs_ahb2phy_east",
+	.id = QCS615_SLAVE_AHB2PHY_EAST,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_ahb2phy_west = {
+	.name = "qhs_ahb2phy_west",
+	.id = QCS615_SLAVE_AHB2PHY_WEST,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_aop = {
+	.name = "qhs_aop",
+	.id = QCS615_SLAVE_AOP,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_aoss = {
+	.name = "qhs_aoss",
+	.id = QCS615_SLAVE_AOSS,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_camera_cfg = {
+	.name = "qhs_camera_cfg",
+	.id = QCS615_SLAVE_CAMERA_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_clk_ctl = {
+	.name = "qhs_clk_ctl",
+	.id = QCS615_SLAVE_CLK_CTL,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_cpr_cx = {
+	.name = "qhs_cpr_cx",
+	.id = QCS615_SLAVE_RBCPR_CX_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_cpr_mx = {
+	.name = "qhs_cpr_mx",
+	.id = QCS615_SLAVE_RBCPR_MX_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_crypto0_cfg = {
+	.name = "qhs_crypto0_cfg",
+	.id = QCS615_SLAVE_CRYPTO_0_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_ddrss_cfg = {
+	.name = "qhs_ddrss_cfg",
+	.id = QCS615_SLAVE_CNOC_DDRSS,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_MASTER_CNOC_DC_NOC },
+};
+
+static struct qcom_icc_node qhs_display_cfg = {
+	.name = "qhs_display_cfg",
+	.id = QCS615_SLAVE_DISPLAY_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_emac_avb_cfg = {
+	.name = "qhs_emac_avb_cfg",
+	.id = QCS615_SLAVE_EMAC_AVB_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_glm = {
+	.name = "qhs_glm",
+	.id = QCS615_SLAVE_GLM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_gpuss_cfg = {
+	.name = "qhs_gpuss_cfg",
+	.id = QCS615_SLAVE_GFX3D_CFG,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_imem_cfg = {
+	.name = "qhs_imem_cfg",
+	.id = QCS615_SLAVE_IMEM_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_ipa = {
+	.name = "qhs_ipa",
+	.id = QCS615_SLAVE_IPA_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_mnoc_cfg = {
+	.name = "qhs_mnoc_cfg",
+	.id = QCS615_SLAVE_CNOC_MNOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_MASTER_CNOC_MNOC_CFG },
+};
+
+static struct qcom_icc_node qhs_pcie_config = {
+	.name = "qhs_pcie_config",
+	.id = QCS615_SLAVE_PCIE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_pimem_cfg = {
+	.name = "qhs_pimem_cfg",
+	.id = QCS615_SLAVE_PIMEM_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_prng = {
+	.name = "qhs_prng",
+	.id = QCS615_SLAVE_PRNG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qdss_cfg = {
+	.name = "qhs_qdss_cfg",
+	.id = QCS615_SLAVE_QDSS_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qspi = {
+	.name = "qhs_qspi",
+	.id = QCS615_SLAVE_QSPI,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qup0 = {
+	.name = "qhs_qup0",
+	.id = QCS615_SLAVE_QUP_0,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qup1 = {
+	.name = "qhs_qup1",
+	.id = QCS615_SLAVE_QUP_1,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_sdc1 = {
+	.name = "qhs_sdc1",
+	.id = QCS615_SLAVE_SDCC_1,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_sdc2 = {
+	.name = "qhs_sdc2",
+	.id = QCS615_SLAVE_SDCC_2,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_snoc_cfg = {
+	.name = "qhs_snoc_cfg",
+	.id = QCS615_SLAVE_SNOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_MASTER_SNOC_CFG },
+};
+
+static struct qcom_icc_node qhs_spdm = {
+	.name = "qhs_spdm",
+	.id = QCS615_SLAVE_SPDM_WRAPPER,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_tcsr = {
+	.name = "qhs_tcsr",
+	.id = QCS615_SLAVE_TCSR,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_tlmm_east = {
+	.name = "qhs_tlmm_east",
+	.id = QCS615_SLAVE_TLMM_EAST,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_tlmm_south = {
+	.name = "qhs_tlmm_south",
+	.id = QCS615_SLAVE_TLMM_SOUTH,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_tlmm_west = {
+	.name = "qhs_tlmm_west",
+	.id = QCS615_SLAVE_TLMM_WEST,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_ufs_mem_cfg = {
+	.name = "qhs_ufs_mem_cfg",
+	.id = QCS615_SLAVE_UFS_MEM_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_usb2 = {
+	.name = "qhs_usb2",
+	.id = QCS615_SLAVE_USB2,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_usb3 = {
+	.name = "qhs_usb3",
+	.id = QCS615_SLAVE_USB3,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_venus_cfg = {
+	.name = "qhs_venus_cfg",
+	.id = QCS615_SLAVE_VENUS_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_vsense_ctrl_cfg = {
+	.name = "qhs_vsense_ctrl_cfg",
+	.id = QCS615_SLAVE_VSENSE_CTRL_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_cnoc_a2noc = {
+	.name = "qns_cnoc_a2noc",
+	.id = QCS615_SLAVE_CNOC_A2NOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_MASTER_CNOC_A2NOC },
+};
+
+static struct qcom_icc_node srvc_cnoc = {
+	.name = "srvc_cnoc",
+	.id = QCS615_SLAVE_SERVICE_CNOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_dc_noc_gemnoc = {
+	.name = "qhs_dc_noc_gemnoc",
+	.id = QCS615_SLAVE_DC_NOC_GEMNOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS615_MASTER_GEM_NOC_CFG },
+};
+
+static struct qcom_icc_node qhs_llcc = {
+	.name = "qhs_llcc",
+	.id = QCS615_SLAVE_LLCC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_mdsp_ms_mpu_cfg = {
+	.name = "qhs_mdsp_ms_mpu_cfg",
+	.id = QCS615_SLAVE_MSS_PROC_MS_MPU_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_gem_noc_snoc = {
+	.name = "qns_gem_noc_snoc",
+	.id = QCS615_SLAVE_GEM_NOC_SNOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_MASTER_GEM_NOC_SNOC },
+};
+
+static struct qcom_icc_node qns_llcc = {
+	.name = "qns_llcc",
+	.id = QCS615_SLAVE_LLCC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS615_MASTER_LLCC },
+};
+
+static struct qcom_icc_node qns_sys_pcie = {
+	.name = "qns_sys_pcie",
+	.id = QCS615_SLAVE_MEM_NOC_PCIE_SNOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_MASTER_GEM_NOC_PCIE_SNOC },
+};
+
+static struct qcom_icc_node srvc_gemnoc = {
+	.name = "srvc_gemnoc",
+	.id = QCS615_SLAVE_SERVICE_GEM_NOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node ipa_core_slave = {
+	.name = "ipa_core_slave",
+	.id = QCS615_SLAVE_IPA_CORE,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node ebi = {
+	.name = "ebi",
+	.id = QCS615_SLAVE_EBI1,
+	.channels = 2,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns2_mem_noc = {
+	.name = "qns2_mem_noc",
+	.id = QCS615_SLAVE_MNOC_SF_MEM_NOC,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_MASTER_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qns_mem_noc_hf = {
+	.name = "qns_mem_noc_hf",
+	.id = QCS615_SLAVE_MNOC_HF_MEM_NOC,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS615_MASTER_MNOC_HF_MEM_NOC },
+};
+
+static struct qcom_icc_node srvc_mnoc = {
+	.name = "srvc_mnoc",
+	.id = QCS615_SLAVE_SERVICE_MNOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_apss = {
+	.name = "qhs_apss",
+	.id = QCS615_SLAVE_APPSS,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_cnoc = {
+	.name = "qns_cnoc",
+	.id = QCS615_SLAVE_SNOC_CNOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_MASTER_SNOC_CNOC },
+};
+
+static struct qcom_icc_node qns_gemnoc_sf = {
+	.name = "qns_gemnoc_sf",
+	.id = QCS615_SLAVE_SNOC_GEM_NOC_SF,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS615_MASTER_SNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qns_memnoc_gc = {
+	.name = "qns_memnoc_gc",
+	.id = QCS615_SLAVE_SNOC_MEM_NOC_GC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS615_MASTER_SNOC_GC_MEM_NOC },
+};
+
+static struct qcom_icc_node qxs_imem = {
+	.name = "qxs_imem",
+	.id = QCS615_SLAVE_IMEM,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qxs_pimem = {
+	.name = "qxs_pimem",
+	.id = QCS615_SLAVE_PIMEM,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node srvc_snoc = {
+	.name = "srvc_snoc",
+	.id = QCS615_SLAVE_SERVICE_SNOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node xs_pcie = {
+	.name = "xs_pcie",
+	.id = QCS615_SLAVE_PCIE_0,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node xs_qdss_stm = {
+	.name = "xs_qdss_stm",
+	.id = QCS615_SLAVE_QDSS_STM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node xs_sys_tcu_cfg = {
+	.name = "xs_sys_tcu_cfg",
+	.id = QCS615_SLAVE_TCU,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_bcm bcm_acv = {
+	.name = "ACV",
+	.num_nodes = 1,
+	.nodes = { &ebi },
+};
+
+static struct qcom_icc_bcm bcm_ce0 = {
+	.name = "CE0",
+	.num_nodes = 1,
+	.nodes = { &qxm_crypto },
+};
+
+static struct qcom_icc_bcm bcm_cn0 = {
+	.name = "CN0",
+	.keepalive = true,
+	.num_nodes = 37,
+	.nodes = { &qhm_spdm, &qnm_snoc,
+		   &qhs_a1_noc_cfg, &qhs_aop,
+		   &qhs_aoss, &qhs_camera_cfg,
+		   &qhs_clk_ctl, &qhs_cpr_cx,
+		   &qhs_cpr_mx, &qhs_crypto0_cfg,
+		   &qhs_ddrss_cfg, &qhs_display_cfg,
+		   &qhs_emac_avb_cfg, &qhs_glm,
+		   &qhs_gpuss_cfg, &qhs_imem_cfg,
+		   &qhs_ipa, &qhs_mnoc_cfg,
+		   &qhs_pcie_config, &qhs_pimem_cfg,
+		   &qhs_prng, &qhs_qdss_cfg,
+		   &qhs_qup0, &qhs_qup1,
+		   &qhs_snoc_cfg, &qhs_spdm,
+		   &qhs_tcsr, &qhs_tlmm_east,
+		   &qhs_tlmm_south, &qhs_tlmm_west,
+		   &qhs_ufs_mem_cfg, &qhs_usb2,
+		   &qhs_usb3, &qhs_venus_cfg,
+		   &qhs_vsense_ctrl_cfg, &qns_cnoc_a2noc,
+		   &srvc_cnoc },
+};
+
+static struct qcom_icc_bcm bcm_cn1 = {
+	.name = "CN1",
+	.num_nodes = 8,
+	.nodes = { &qhm_qspi, &xm_sdc1,
+		   &xm_sdc2, &qhs_ahb2phy_east,
+		   &qhs_ahb2phy_west, &qhs_qspi,
+		   &qhs_sdc1, &qhs_sdc2 },
+};
+
+static struct qcom_icc_bcm bcm_ip0 = {
+	.name = "IP0",
+	.num_nodes = 1,
+	.nodes = { &ipa_core_slave },
+};
+
+static struct qcom_icc_bcm bcm_mc0 = {
+	.name = "MC0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &ebi },
+};
+
+static struct qcom_icc_bcm bcm_mm0 = {
+	.name = "MM0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qns_mem_noc_hf },
+};
+
+static struct qcom_icc_bcm bcm_mm1 = {
+	.name = "MM1",
+	.num_nodes = 7,
+	.nodes = { &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp,
+		   &qxm_camnoc_sf_uncomp, &qxm_camnoc_hf0,
+		   &qxm_camnoc_hf1, &qxm_mdp0,
+		   &qxm_rot },
+};
+
+static struct qcom_icc_bcm bcm_mm2 = {
+	.name = "MM2",
+	.num_nodes = 2,
+	.nodes = { &qxm_camnoc_sf, &qns2_mem_noc },
+};
+
+static struct qcom_icc_bcm bcm_mm3 = {
+	.name = "MM3",
+	.num_nodes = 2,
+	.nodes = { &qxm_venus0, &qxm_venus_arm9 },
+};
+
+static struct qcom_icc_bcm bcm_qup0 = {
+	.name = "QUP0",
+	.keepalive = true,
+	.vote_scale = 1,
+	.num_nodes = 2,
+	.nodes = { &qhm_qup0, &qhm_qup1 },
+};
+
+static struct qcom_icc_bcm bcm_sh0 = {
+	.name = "SH0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qns_llcc },
+};
+
+static struct qcom_icc_bcm bcm_sh2 = {
+	.name = "SH2",
+	.num_nodes = 1,
+	.nodes = { &acm_apps },
+};
+
+static struct qcom_icc_bcm bcm_sh3 = {
+	.name = "SH3",
+	.num_nodes = 1,
+	.nodes = { &qns_gem_noc_snoc },
+};
+
+static struct qcom_icc_bcm bcm_sn0 = {
+	.name = "SN0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qns_gemnoc_sf },
+};
+
+static struct qcom_icc_bcm bcm_sn1 = {
+	.name = "SN1",
+	.num_nodes = 1,
+	.nodes = { &qxs_imem },
+};
+
+static struct qcom_icc_bcm bcm_sn2 = {
+	.name = "SN2",
+	.num_nodes = 1,
+	.nodes = { &qns_memnoc_gc },
+};
+
+static struct qcom_icc_bcm bcm_sn3 = {
+	.name = "SN3",
+	.num_nodes = 2,
+	.nodes = { &srvc_aggre2_noc, &qns_cnoc },
+};
+
+static struct qcom_icc_bcm bcm_sn4 = {
+	.name = "SN4",
+	.num_nodes = 1,
+	.nodes = { &qxs_pimem },
+};
+
+static struct qcom_icc_bcm bcm_sn5 = {
+	.name = "SN5",
+	.num_nodes = 1,
+	.nodes = { &xs_qdss_stm },
+};
+
+static struct qcom_icc_bcm bcm_sn8 = {
+	.name = "SN8",
+	.num_nodes = 2,
+	.nodes = { &qnm_gemnoc_pcie, &xs_pcie },
+};
+
+static struct qcom_icc_bcm bcm_sn9 = {
+	.name = "SN9",
+	.num_nodes = 1,
+	.nodes = { &qnm_aggre1_noc },
+};
+
+static struct qcom_icc_bcm bcm_sn12 = {
+	.name = "SN12",
+	.num_nodes = 2,
+	.nodes = { &qxm_pimem, &xm_gic },
+};
+
+static struct qcom_icc_bcm bcm_sn13 = {
+	.name = "SN13",
+	.num_nodes = 1,
+	.nodes = { &qnm_lpass_anoc },
+};
+
+static struct qcom_icc_bcm bcm_sn14 = {
+	.name = "SN14",
+	.num_nodes = 1,
+	.nodes = { &qns_pcie_snoc },
+};
+
+static struct qcom_icc_bcm bcm_sn15 = {
+	.name = "SN15",
+	.num_nodes = 1,
+	.nodes = { &qnm_gemnoc },
+};
+
+static struct qcom_icc_bcm * const aggre1_noc_bcms[] = {
+	&bcm_ce0,
+	&bcm_cn1,
+	&bcm_qup0,
+	&bcm_sn3,
+	&bcm_sn14,
+	&bcm_ip0,
+};
+
+static struct qcom_icc_node * const aggre1_noc_nodes[] = {
+	[MASTER_A1NOC_CFG] = &qhm_a1noc_cfg,
+	[MASTER_QDSS_BAM] = &qhm_qdss_bam,
+	[MASTER_QSPI] = &qhm_qspi,
+	[MASTER_QUP_0] = &qhm_qup0,
+	[MASTER_BLSP_1] = &qhm_qup1,
+	[MASTER_CNOC_A2NOC] = &qnm_cnoc,
+	[MASTER_CRYPTO] = &qxm_crypto,
+	[MASTER_IPA] = &qxm_ipa,
+	[MASTER_EMAC_EVB] = &xm_emac_avb,
+	[MASTER_PCIE] = &xm_pcie,
+	[MASTER_QDSS_ETR] = &xm_qdss_etr,
+	[MASTER_SDCC_1] = &xm_sdc1,
+	[MASTER_SDCC_2] = &xm_sdc2,
+	[MASTER_UFS_MEM] = &xm_ufs_mem,
+	[MASTER_USB2] = &xm_usb2,
+	[MASTER_USB3_0] = &xm_usb3_0,
+	[SLAVE_A1NOC_SNOC] = &qns_a1noc_snoc,
+	[SLAVE_LPASS_SNOC] = &qns_lpass_snoc,
+	[SLAVE_ANOC_PCIE_SNOC] = &qns_pcie_snoc,
+	[SLAVE_SERVICE_A2NOC] = &srvc_aggre2_noc,
+};
+
+static const struct qcom_icc_desc qcs615_aggre1_noc = {
+	.nodes = aggre1_noc_nodes,
+	.num_nodes = ARRAY_SIZE(aggre1_noc_nodes),
+	.bcms = aggre1_noc_bcms,
+	.num_bcms = ARRAY_SIZE(aggre1_noc_bcms),
+};
+
+static struct qcom_icc_bcm * const camnoc_virt_bcms[] = {
+	&bcm_mm1,
+};
+
+static struct qcom_icc_node * const camnoc_virt_nodes[] = {
+	[MASTER_CAMNOC_HF0_UNCOMP] = &qxm_camnoc_hf0_uncomp,
+	[MASTER_CAMNOC_HF1_UNCOMP] = &qxm_camnoc_hf1_uncomp,
+	[MASTER_CAMNOC_SF_UNCOMP] = &qxm_camnoc_sf_uncomp,
+	[SLAVE_CAMNOC_UNCOMP] = &qns_camnoc_uncomp,
+};
+
+static const struct qcom_icc_desc qcs615_camnoc_virt = {
+	.nodes = camnoc_virt_nodes,
+	.num_nodes = ARRAY_SIZE(camnoc_virt_nodes),
+	.bcms = camnoc_virt_bcms,
+	.num_bcms = ARRAY_SIZE(camnoc_virt_bcms),
+};
+
+static struct qcom_icc_bcm * const config_noc_bcms[] = {
+	&bcm_cn0,
+	&bcm_cn1,
+};
+
+static struct qcom_icc_node * const config_noc_nodes[] = {
+	[MASTER_SPDM] = &qhm_spdm,
+	[MASTER_SNOC_CNOC] = &qnm_snoc,
+	[MASTER_QDSS_DAP] = &xm_qdss_dap,
+	[SLAVE_A1NOC_CFG] = &qhs_a1_noc_cfg,
+	[SLAVE_AHB2PHY_EAST] = &qhs_ahb2phy_east,
+	[SLAVE_AHB2PHY_WEST] = &qhs_ahb2phy_west,
+	[SLAVE_AOP] = &qhs_aop,
+	[SLAVE_AOSS] = &qhs_aoss,
+	[SLAVE_CAMERA_CFG] = &qhs_camera_cfg,
+	[SLAVE_CLK_CTL] = &qhs_clk_ctl,
+	[SLAVE_RBCPR_CX_CFG] = &qhs_cpr_cx,
+	[SLAVE_RBCPR_MX_CFG] = &qhs_cpr_mx,
+	[SLAVE_CRYPTO_0_CFG] = &qhs_crypto0_cfg,
+	[SLAVE_CNOC_DDRSS] = &qhs_ddrss_cfg,
+	[SLAVE_DISPLAY_CFG] = &qhs_display_cfg,
+	[SLAVE_EMAC_AVB_CFG] = &qhs_emac_avb_cfg,
+	[SLAVE_GLM] = &qhs_glm,
+	[SLAVE_GFX3D_CFG] = &qhs_gpuss_cfg,
+	[SLAVE_IMEM_CFG] = &qhs_imem_cfg,
+	[SLAVE_IPA_CFG] = &qhs_ipa,
+	[SLAVE_CNOC_MNOC_CFG] = &qhs_mnoc_cfg,
+	[SLAVE_PCIE_CFG] = &qhs_pcie_config,
+	[SLAVE_PIMEM_CFG] = &qhs_pimem_cfg,
+	[SLAVE_PRNG] = &qhs_prng,
+	[SLAVE_QDSS_CFG] = &qhs_qdss_cfg,
+	[SLAVE_QSPI] = &qhs_qspi,
+	[SLAVE_QUP_0] = &qhs_qup0,
+	[SLAVE_QUP_1] = &qhs_qup1,
+	[SLAVE_SDCC_1] = &qhs_sdc1,
+	[SLAVE_SDCC_2] = &qhs_sdc2,
+	[SLAVE_SNOC_CFG] = &qhs_snoc_cfg,
+	[SLAVE_SPDM_WRAPPER] = &qhs_spdm,
+	[SLAVE_TCSR] = &qhs_tcsr,
+	[SLAVE_TLMM_EAST] = &qhs_tlmm_east,
+	[SLAVE_TLMM_SOUTH] = &qhs_tlmm_south,
+	[SLAVE_TLMM_WEST] = &qhs_tlmm_west,
+	[SLAVE_UFS_MEM_CFG] = &qhs_ufs_mem_cfg,
+	[SLAVE_USB2] = &qhs_usb2,
+	[SLAVE_USB3] = &qhs_usb3,
+	[SLAVE_VENUS_CFG] = &qhs_venus_cfg,
+	[SLAVE_VSENSE_CTRL_CFG] = &qhs_vsense_ctrl_cfg,
+	[SLAVE_CNOC_A2NOC] = &qns_cnoc_a2noc,
+	[SLAVE_SERVICE_CNOC] = &srvc_cnoc,
+};
+
+static const struct qcom_icc_desc qcs615_config_noc = {
+	.nodes = config_noc_nodes,
+	.num_nodes = ARRAY_SIZE(config_noc_nodes),
+	.bcms = config_noc_bcms,
+	.num_bcms = ARRAY_SIZE(config_noc_bcms),
+};
+
+static struct qcom_icc_node * const dc_noc_nodes[] = {
+	[MASTER_CNOC_DC_NOC] = &qhm_cnoc,
+	[SLAVE_DC_NOC_GEMNOC] = &qhs_dc_noc_gemnoc,
+	[SLAVE_LLCC_CFG] = &qhs_llcc,
+};
+
+static const struct qcom_icc_desc qcs615_dc_noc = {
+	.nodes = dc_noc_nodes,
+	.num_nodes = ARRAY_SIZE(dc_noc_nodes),
+};
+
+static struct qcom_icc_bcm * const gem_noc_bcms[] = {
+	&bcm_sh0,
+	&bcm_sh2,
+	&bcm_sh3,
+	&bcm_mm1,
+};
+
+static struct qcom_icc_node * const gem_noc_nodes[] = {
+	[MASTER_APPSS_PROC] = &acm_apps,
+	[MASTER_GPU_TCU] = &acm_gpu_tcu,
+	[MASTER_SYS_TCU] = &acm_sys_tcu,
+	[MASTER_GEM_NOC_CFG] = &qhm_gemnoc_cfg,
+	[MASTER_GFX3D] = &qnm_gpu,
+	[MASTER_MNOC_HF_MEM_NOC] = &qnm_mnoc_hf,
+	[MASTER_MNOC_SF_MEM_NOC] = &qnm_mnoc_sf,
+	[MASTER_SNOC_GC_MEM_NOC] = &qnm_snoc_gc,
+	[MASTER_SNOC_SF_MEM_NOC] = &qnm_snoc_sf,
+	[SLAVE_MSS_PROC_MS_MPU_CFG] = &qhs_mdsp_ms_mpu_cfg,
+	[SLAVE_GEM_NOC_SNOC] = &qns_gem_noc_snoc,
+	[SLAVE_LLCC] = &qns_llcc,
+	[SLAVE_MEM_NOC_PCIE_SNOC] = &qns_sys_pcie,
+	[SLAVE_SERVICE_GEM_NOC] = &srvc_gemnoc,
+};
+
+static const struct qcom_icc_desc qcs615_gem_noc = {
+	.nodes = gem_noc_nodes,
+	.num_nodes = ARRAY_SIZE(gem_noc_nodes),
+	.bcms = gem_noc_bcms,
+	.num_bcms = ARRAY_SIZE(gem_noc_bcms),
+};
+
+static struct qcom_icc_bcm * const ipa_virt_bcms[] = {
+	&bcm_ip0,
+};
+
+static struct qcom_icc_node * const ipa_virt_nodes[] = {
+	[MASTER_IPA_CORE] = &ipa_core_master,
+	[SLAVE_IPA_CORE] = &ipa_core_slave,
+};
+
+static const struct qcom_icc_desc qcs615_ipa_virt = {
+	.nodes = ipa_virt_nodes,
+	.num_nodes = ARRAY_SIZE(ipa_virt_nodes),
+	.bcms = ipa_virt_bcms,
+	.num_bcms = ARRAY_SIZE(ipa_virt_bcms),
+};
+
+static struct qcom_icc_bcm * const mc_virt_bcms[] = {
+	&bcm_acv,
+	&bcm_mc0,
+};
+
+static struct qcom_icc_node * const mc_virt_nodes[] = {
+	[MASTER_LLCC] = &llcc_mc,
+	[SLAVE_EBI1] = &ebi,
+};
+
+static const struct qcom_icc_desc qcs615_mc_virt = {
+	.nodes = mc_virt_nodes,
+	.num_nodes = ARRAY_SIZE(mc_virt_nodes),
+	.bcms = mc_virt_bcms,
+	.num_bcms = ARRAY_SIZE(mc_virt_bcms),
+};
+
+static struct qcom_icc_bcm * const mmss_noc_bcms[] = {
+	&bcm_mm0,
+	&bcm_mm1,
+	&bcm_mm2,
+	&bcm_mm3,
+};
+
+static struct qcom_icc_node * const mmss_noc_nodes[] = {
+	[MASTER_CNOC_MNOC_CFG] = &qhm_mnoc_cfg,
+	[MASTER_CAMNOC_HF0] = &qxm_camnoc_hf0,
+	[MASTER_CAMNOC_HF1] = &qxm_camnoc_hf1,
+	[MASTER_CAMNOC_SF] = &qxm_camnoc_sf,
+	[MASTER_MDP0] = &qxm_mdp0,
+	[MASTER_ROTATOR] = &qxm_rot,
+	[MASTER_VIDEO_P0] = &qxm_venus0,
+	[MASTER_VIDEO_PROC] = &qxm_venus_arm9,
+	[SLAVE_MNOC_SF_MEM_NOC] = &qns2_mem_noc,
+	[SLAVE_MNOC_HF_MEM_NOC] = &qns_mem_noc_hf,
+	[SLAVE_SERVICE_MNOC] = &srvc_mnoc,
+};
+
+static const struct qcom_icc_desc qcs615_mmss_noc = {
+	.nodes = mmss_noc_nodes,
+	.num_nodes = ARRAY_SIZE(mmss_noc_nodes),
+	.bcms = mmss_noc_bcms,
+	.num_bcms = ARRAY_SIZE(mmss_noc_bcms),
+};
+
+static struct qcom_icc_bcm * const system_noc_bcms[] = {
+	&bcm_sn0,
+	&bcm_sn1,
+	&bcm_sn2,
+	&bcm_sn3,
+	&bcm_sn4,
+	&bcm_sn5,
+	&bcm_sn8,
+	&bcm_sn9,
+	&bcm_sn12,
+	&bcm_sn13,
+	&bcm_sn15,
+};
+
+static struct qcom_icc_node * const system_noc_nodes[] = {
+	[MASTER_SNOC_CFG] = &qhm_snoc_cfg,
+	[MASTER_A1NOC_SNOC] = &qnm_aggre1_noc,
+	[MASTER_GEM_NOC_SNOC] = &qnm_gemnoc,
+	[MASTER_GEM_NOC_PCIE_SNOC] = &qnm_gemnoc_pcie,
+	[MASTER_LPASS_ANOC] = &qnm_lpass_anoc,
+	[MASTER_ANOC_PCIE_SNOC] = &qnm_pcie_anoc,
+	[MASTER_PIMEM] = &qxm_pimem,
+	[MASTER_GIC] = &xm_gic,
+	[SLAVE_APPSS] = &qhs_apss,
+	[SLAVE_SNOC_CNOC] = &qns_cnoc,
+	[SLAVE_SNOC_GEM_NOC_SF] = &qns_gemnoc_sf,
+	[SLAVE_SNOC_MEM_NOC_GC] = &qns_memnoc_gc,
+	[SLAVE_IMEM] = &qxs_imem,
+	[SLAVE_PIMEM] = &qxs_pimem,
+	[SLAVE_SERVICE_SNOC] = &srvc_snoc,
+	[SLAVE_PCIE_0] = &xs_pcie,
+	[SLAVE_QDSS_STM] = &xs_qdss_stm,
+	[SLAVE_TCU] = &xs_sys_tcu_cfg,
+};
+
+static const struct qcom_icc_desc qcs615_system_noc = {
+	.nodes = system_noc_nodes,
+	.num_nodes = ARRAY_SIZE(system_noc_nodes),
+	.bcms = system_noc_bcms,
+	.num_bcms = ARRAY_SIZE(system_noc_bcms),
+};
+
+static const struct of_device_id qnoc_of_match[] = {
+	{ .compatible = "qcom,qcs615-aggre1-noc",
+	  .data = &qcs615_aggre1_noc},
+	{ .compatible = "qcom,qcs615-camnoc-virt",
+	  .data = &qcs615_camnoc_virt},
+	{ .compatible = "qcom,qcs615-config-noc",
+	  .data = &qcs615_config_noc},
+	{ .compatible = "qcom,qcs615-dc-noc",
+	  .data = &qcs615_dc_noc},
+	{ .compatible = "qcom,qcs615-gem-noc",
+	  .data = &qcs615_gem_noc},
+	{ .compatible = "qcom,qcs615-ipa-virt",
+	  .data = &qcs615_ipa_virt},
+	{ .compatible = "qcom,qcs615-mc-virt",
+	  .data = &qcs615_mc_virt},
+	{ .compatible = "qcom,qcs615-mmss-noc",
+	  .data = &qcs615_mmss_noc},
+	{ .compatible = "qcom,qcs615-system-noc",
+	  .data = &qcs615_system_noc},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, qnoc_of_match);
+
+static struct platform_driver qnoc_driver = {
+	.probe = qcom_icc_rpmh_probe,
+	.remove_new = qcom_icc_rpmh_remove,
+	.driver = {
+		.name = "qnoc-qcs615",
+		.of_match_table = qnoc_of_match,
+		.sync_state = icc_sync_state,
+	},
+};
+
+static int __init qnoc_driver_init(void)
+{
+	return platform_driver_register(&qnoc_driver);
+}
+core_initcall(qnoc_driver_init);
+
+static void __exit qnoc_driver_exit(void)
+{
+	platform_driver_unregister(&qnoc_driver);
+}
+module_exit(qnoc_driver_exit);
+
+MODULE_DESCRIPTION("qcs615 NoC driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/qcs615.h
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/qcs615.h
@@ -0,0 +1,128 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __DRIVERS_INTERCONNECT_QCOM_QCS615_H
+#define __DRIVERS_INTERCONNECT_QCOM_QCS615_H
+
+#define QCS615_MASTER_A1NOC_CFG				1
+#define QCS615_MASTER_A1NOC_SNOC			2
+#define QCS615_MASTER_ANOC_PCIE_SNOC			3
+#define QCS615_MASTER_APPSS_PROC			4
+#define QCS615_MASTER_BLSP_1				5
+#define QCS615_MASTER_CAMNOC_HF0			6
+#define QCS615_MASTER_CAMNOC_HF0_UNCOMP			7
+#define QCS615_MASTER_CAMNOC_HF1			8
+#define QCS615_MASTER_CAMNOC_HF1_UNCOMP			9
+#define QCS615_MASTER_CAMNOC_SF				10
+#define QCS615_MASTER_CAMNOC_SF_UNCOMP			11
+#define QCS615_MASTER_CNOC_A2NOC			12
+#define QCS615_MASTER_CNOC_DC_NOC			13
+#define QCS615_MASTER_CNOC_MNOC_CFG			14
+#define QCS615_MASTER_CRYPTO				15
+#define QCS615_MASTER_EMAC_EVB				16
+#define QCS615_MASTER_GEM_NOC_CFG			17
+#define QCS615_MASTER_GEM_NOC_PCIE_SNOC			18
+#define QCS615_MASTER_GEM_NOC_SNOC			19
+#define QCS615_MASTER_GFX3D				20
+#define QCS615_MASTER_GIC				21
+#define QCS615_MASTER_GPU_TCU				22
+#define QCS615_MASTER_IPA				23
+#define QCS615_MASTER_IPA_CORE				24
+#define QCS615_MASTER_LLCC				25
+#define QCS615_MASTER_LPASS_ANOC			26
+#define QCS615_MASTER_MDP0				27
+#define QCS615_MASTER_MNOC_HF_MEM_NOC			28
+#define QCS615_MASTER_MNOC_SF_MEM_NOC			29
+#define QCS615_MASTER_PCIE				30
+#define QCS615_MASTER_PIMEM				31
+#define QCS615_MASTER_QDSS_BAM				32
+#define QCS615_MASTER_QDSS_DAP				33
+#define QCS615_MASTER_QDSS_ETR				34
+#define QCS615_MASTER_QSPI				35
+#define QCS615_MASTER_QUP_0				36
+#define QCS615_MASTER_ROTATOR				37
+#define QCS615_MASTER_SDCC_1				38
+#define QCS615_MASTER_SDCC_2				39
+#define QCS615_MASTER_SNOC_CFG				40
+#define QCS615_MASTER_SNOC_CNOC				41
+#define QCS615_MASTER_SNOC_GC_MEM_NOC			42
+#define QCS615_MASTER_SNOC_SF_MEM_NOC			43
+#define QCS615_MASTER_SPDM				44
+#define QCS615_MASTER_SYS_TCU				45
+#define QCS615_MASTER_UFS_MEM				46
+#define QCS615_MASTER_USB2				47
+#define QCS615_MASTER_USB3_0				48
+#define QCS615_MASTER_VIDEO_P0				49
+#define QCS615_MASTER_VIDEO_PROC			50
+#define QCS615_SLAVE_A1NOC_CFG				51
+#define QCS615_SLAVE_A1NOC_SNOC				52
+#define QCS615_SLAVE_AHB2PHY_EAST			53
+#define QCS615_SLAVE_AHB2PHY_WEST			54
+#define QCS615_SLAVE_ANOC_PCIE_SNOC			55
+#define QCS615_SLAVE_AOP				56
+#define QCS615_SLAVE_AOSS				57
+#define QCS615_SLAVE_APPSS				58
+#define QCS615_SLAVE_CAMERA_CFG				59
+#define QCS615_SLAVE_CAMNOC_UNCOMP			60
+#define QCS615_SLAVE_CLK_CTL				61
+#define QCS615_SLAVE_CNOC_A2NOC				62
+#define QCS615_SLAVE_CNOC_DDRSS				63
+#define QCS615_SLAVE_CNOC_MNOC_CFG			64
+#define QCS615_SLAVE_CRYPTO_0_CFG			65
+#define QCS615_SLAVE_DC_NOC_GEMNOC			66
+#define QCS615_SLAVE_DISPLAY_CFG			67
+#define QCS615_SLAVE_EBI1				68
+#define QCS615_SLAVE_EMAC_AVB_CFG			69
+#define QCS615_SLAVE_GEM_NOC_SNOC			70
+#define QCS615_SLAVE_GFX3D_CFG				71
+#define QCS615_SLAVE_GLM				72
+#define QCS615_SLAVE_IMEM				73
+#define QCS615_SLAVE_IMEM_CFG				74
+#define QCS615_SLAVE_IPA_CFG				75
+#define QCS615_SLAVE_IPA_CORE				76
+#define QCS615_SLAVE_LLCC				77
+#define QCS615_SLAVE_LLCC_CFG				78
+#define QCS615_SLAVE_LPASS_SNOC				79
+#define QCS615_SLAVE_MEM_NOC_PCIE_SNOC			80
+#define QCS615_SLAVE_MNOC_HF_MEM_NOC			81
+#define QCS615_SLAVE_MNOC_SF_MEM_NOC			82
+#define QCS615_SLAVE_MSS_PROC_MS_MPU_CFG		83
+#define QCS615_SLAVE_PCIE_0				84
+#define QCS615_SLAVE_PCIE_CFG				85
+#define QCS615_SLAVE_PIMEM				86
+#define QCS615_SLAVE_PIMEM_CFG				87
+#define QCS615_SLAVE_PRNG				88
+#define QCS615_SLAVE_QDSS_CFG				89
+#define QCS615_SLAVE_QDSS_STM				90
+#define QCS615_SLAVE_QSPI				91
+#define QCS615_SLAVE_QUP_0				92
+#define QCS615_SLAVE_QUP_1				93
+#define QCS615_SLAVE_RBCPR_CX_CFG			94
+#define QCS615_SLAVE_RBCPR_MX_CFG			95
+#define QCS615_SLAVE_SDCC_1				96
+#define QCS615_SLAVE_SDCC_2				97
+#define QCS615_SLAVE_SERVICE_A2NOC			98
+#define QCS615_SLAVE_SERVICE_CNOC			99
+#define QCS615_SLAVE_SERVICE_GEM_NOC			100
+#define QCS615_SLAVE_SERVICE_MNOC			101
+#define QCS615_SLAVE_SERVICE_SNOC			102
+#define QCS615_SLAVE_SNOC_CFG				103
+#define QCS615_SLAVE_SNOC_CNOC				104
+#define QCS615_SLAVE_SNOC_GEM_NOC_SF			105
+#define QCS615_SLAVE_SNOC_MEM_NOC_GC			106
+#define QCS615_SLAVE_SPDM_WRAPPER			107
+#define QCS615_SLAVE_TCSR				108
+#define QCS615_SLAVE_TCU				109
+#define QCS615_SLAVE_TLMM_EAST				110
+#define QCS615_SLAVE_TLMM_SOUTH				111
+#define QCS615_SLAVE_TLMM_WEST				112
+#define QCS615_SLAVE_UFS_MEM_CFG			113
+#define QCS615_SLAVE_USB2				114
+#define QCS615_SLAVE_USB3				115
+#define QCS615_SLAVE_VENUS_CFG				116
+#define QCS615_SLAVE_VSENSE_CTRL_CFG			117
+
+#endif
+
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/qcs8300.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/qcs8300.c
@@ -0,0 +1,2088 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+#include <linux/device.h>
+#include <linux/interconnect.h>
+#include <linux/interconnect-provider.h>
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <dt-bindings/interconnect/qcom,qcs8300-rpmh.h>
+
+#include "bcm-voter.h"
+#include "icc-rpmh.h"
+#include "qcs8300.h"
+
+static struct qcom_icc_node qxm_qup3 = {
+	.name = "qxm_qup3",
+	.id = QCS8300_MASTER_QUP_3,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_emac_0 = {
+	.name = "xm_emac_0",
+	.id = QCS8300_MASTER_EMAC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_sdc1 = {
+	.name = "xm_sdc1",
+	.id = QCS8300_MASTER_SDC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_ufs_mem = {
+	.name = "xm_ufs_mem",
+	.id = QCS8300_MASTER_UFS_MEM,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_usb2_2 = {
+	.name = "xm_usb2_2",
+	.id = QCS8300_MASTER_USB2,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_usb3_0 = {
+	.name = "xm_usb3_0",
+	.id = QCS8300_MASTER_USB3_0,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qhm_qdss_bam = {
+	.name = "qhm_qdss_bam",
+	.id = QCS8300_MASTER_QDSS_BAM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node qhm_qup0 = {
+	.name = "qhm_qup0",
+	.id = QCS8300_MASTER_QUP_0,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node qhm_qup1 = {
+	.name = "qhm_qup1",
+	.id = QCS8300_MASTER_QUP_1,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node qnm_cnoc_datapath = {
+	.name = "qnm_cnoc_datapath",
+	.id = QCS8300_MASTER_CNOC_A2NOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node qxm_crypto_0 = {
+	.name = "qxm_crypto_0",
+	.id = QCS8300_MASTER_CRYPTO_CORE0,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node qxm_crypto_1 = {
+	.name = "qxm_crypto_1",
+	.id = QCS8300_MASTER_CRYPTO_CORE1,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node qxm_ipa = {
+	.name = "qxm_ipa",
+	.id = QCS8300_MASTER_IPA,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_qdss_etr_0 = {
+	.name = "xm_qdss_etr_0",
+	.id = QCS8300_MASTER_QDSS_ETR_0,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node xm_qdss_etr_1 = {
+	.name = "xm_qdss_etr_1",
+	.id = QCS8300_MASTER_QDSS_ETR_1,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node qup0_core_master = {
+	.name = "qup0_core_master",
+	.id = QCS8300_MASTER_QUP_CORE_0,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_QUP_CORE_0 },
+};
+
+static struct qcom_icc_node qup1_core_master = {
+	.name = "qup1_core_master",
+	.id = QCS8300_MASTER_QUP_CORE_1,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_QUP_CORE_1 },
+};
+
+static struct qcom_icc_node qup3_core_master = {
+	.name = "qup3_core_master",
+	.id = QCS8300_MASTER_QUP_CORE_3,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_QUP_CORE_3 },
+};
+
+static struct qcom_icc_node qnm_gemnoc_cnoc = {
+	.name = "qnm_gemnoc_cnoc",
+	.id = QCS8300_MASTER_GEM_NOC_CNOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 71,
+	.links = { QCS8300_SLAVE_AHB2PHY_2, QCS8300_SLAVE_AHB2PHY_3,
+			   QCS8300_SLAVE_ANOC_THROTTLE_CFG, QCS8300_SLAVE_AOSS,
+			   QCS8300_SLAVE_APPSS, QCS8300_SLAVE_BOOT_ROM,
+			   QCS8300_SLAVE_CAMERA_CFG, QCS8300_SLAVE_CAMERA_NRT_THROTTLE_CFG,
+			   QCS8300_SLAVE_CAMERA_RT_THROTTLE_CFG, QCS8300_SLAVE_CLK_CTL,
+			   QCS8300_SLAVE_CDSP_CFG, QCS8300_SLAVE_RBCPR_CX_CFG,
+			   QCS8300_SLAVE_RBCPR_MMCX_CFG, QCS8300_SLAVE_RBCPR_MX_CFG,
+			   QCS8300_SLAVE_CPR_NSPCX, QCS8300_SLAVE_CPR_NSPHMX,
+			   QCS8300_SLAVE_CRYPTO_0_CFG, QCS8300_SLAVE_CX_RDPM,
+			   QCS8300_SLAVE_DISPLAY_CFG, QCS8300_SLAVE_DISPLAY_RT_THROTTLE_CFG,
+			   QCS8300_SLAVE_EMAC_CFG, QCS8300_SLAVE_GP_DSP0_CFG,
+			   QCS8300_SLAVE_GPDSP0_THROTTLE_CFG, QCS8300_SLAVE_GPU_TCU_THROTTLE_CFG,
+			   QCS8300_SLAVE_GFX3D_CFG, QCS8300_SLAVE_HWKM,
+			   QCS8300_SLAVE_IMEM_CFG, QCS8300_SLAVE_IPA_CFG,
+			   QCS8300_SLAVE_IPC_ROUTER_CFG, QCS8300_SLAVE_LPASS,
+			   QCS8300_SLAVE_LPASS_THROTTLE_CFG, QCS8300_SLAVE_MX_RDPM,
+			   QCS8300_SLAVE_MXC_RDPM, QCS8300_SLAVE_PCIE_0_CFG,
+			   QCS8300_SLAVE_PCIE_1_CFG, QCS8300_SLAVE_PCIE_TCU_THROTTLE_CFG,
+			   QCS8300_SLAVE_PCIE_THROTTLE_CFG, QCS8300_SLAVE_PDM,
+			   QCS8300_SLAVE_PIMEM_CFG, QCS8300_SLAVE_PKA_WRAPPER_CFG,
+			   QCS8300_SLAVE_QDSS_CFG, QCS8300_SLAVE_QM_CFG,
+			   QCS8300_SLAVE_QM_MPU_CFG, QCS8300_SLAVE_QUP_0,
+			   QCS8300_SLAVE_QUP_1, QCS8300_SLAVE_QUP_3,
+			   QCS8300_SLAVE_SAIL_THROTTLE_CFG, QCS8300_SLAVE_SDC1,
+			   QCS8300_SLAVE_SECURITY, QCS8300_SLAVE_SNOC_THROTTLE_CFG,
+			   QCS8300_SLAVE_TCSR, QCS8300_SLAVE_TLMM,
+			   QCS8300_SLAVE_TSC_CFG, QCS8300_SLAVE_UFS_MEM_CFG,
+			   QCS8300_SLAVE_USB2, QCS8300_SLAVE_USB3_0,
+			   QCS8300_SLAVE_VENUS_CFG, QCS8300_SLAVE_VENUS_CVP_THROTTLE_CFG,
+			   QCS8300_SLAVE_VENUS_V_CPU_THROTTLE_CFG,
+			   QCS8300_SLAVE_VENUS_VCODEC_THROTTLE_CFG,
+			   QCS8300_SLAVE_DDRSS_CFG, QCS8300_SLAVE_GPDSP_NOC_CFG,
+			   QCS8300_SLAVE_CNOC_MNOC_HF_CFG, QCS8300_SLAVE_CNOC_MNOC_SF_CFG,
+			   QCS8300_SLAVE_PCIE_ANOC_CFG, QCS8300_SLAVE_SNOC_CFG,
+			   QCS8300_SLAVE_BOOT_IMEM, QCS8300_SLAVE_IMEM,
+			   QCS8300_SLAVE_PIMEM, QCS8300_SLAVE_QDSS_STM,
+			   QCS8300_SLAVE_TCU },
+};
+
+static struct qcom_icc_node qnm_gemnoc_pcie = {
+	.name = "qnm_gemnoc_pcie",
+	.id = QCS8300_MASTER_GEM_NOC_PCIE_SNOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_PCIE_0, QCS8300_SLAVE_PCIE_1 },
+};
+
+static struct qcom_icc_node qnm_cnoc_dc_noc = {
+	.name = "qnm_cnoc_dc_noc",
+	.id = QCS8300_MASTER_CNOC_DC_NOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_LLCC_CFG, QCS8300_SLAVE_GEM_NOC_CFG },
+};
+
+static struct qcom_icc_node alm_gpu_tcu = {
+	.name = "alm_gpu_tcu",
+	.id = QCS8300_MASTER_GPU_TCU,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node alm_pcie_tcu = {
+	.name = "alm_pcie_tcu",
+	.id = QCS8300_MASTER_PCIE_TCU,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node alm_sys_tcu = {
+	.name = "alm_sys_tcu",
+	.id = QCS8300_MASTER_SYS_TCU,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node chm_apps = {
+	.name = "chm_apps",
+	.id = QCS8300_MASTER_APPSS_PROC,
+	.channels = 4,
+	.buswidth = 32,
+	.num_links = 3,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC,
+			   QCS8300_SLAVE_GEM_NOC_PCIE_CNOC },
+};
+
+static struct qcom_icc_node qnm_cmpnoc0 = {
+	.name = "qnm_cmpnoc0",
+	.id = QCS8300_MASTER_COMPUTE_NOC,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qnm_gemnoc_cfg = {
+	.name = "qnm_gemnoc_cfg",
+	.id = QCS8300_MASTER_GEM_NOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 4,
+	.links = { QCS8300_SLAVE_SERVICE_GEM_NOC_1, QCS8300_SLAVE_SERVICE_GEM_NOC_2,
+		   QCS8300_SLAVE_SERVICE_GEM_NOC, QCS8300_SLAVE_SERVICE_GEM_NOC2 },
+};
+
+static struct qcom_icc_node qnm_gpdsp_sail = {
+	.name = "qnm_gpdsp_sail",
+	.id = QCS8300_MASTER_GPDSP_SAIL,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qnm_gpu = {
+	.name = "qnm_gpu",
+	.id = QCS8300_MASTER_GFX3D,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qnm_mnoc_hf = {
+	.name = "qnm_mnoc_hf",
+	.id = QCS8300_MASTER_MNOC_HF_MEM_NOC,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_LLCC, QCS8300_SLAVE_GEM_NOC_PCIE_CNOC },
+};
+
+static struct qcom_icc_node qnm_mnoc_sf = {
+	.name = "qnm_mnoc_sf",
+	.id = QCS8300_MASTER_MNOC_SF_MEM_NOC,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 3,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC,
+		   QCS8300_SLAVE_GEM_NOC_PCIE_CNOC },
+};
+
+static struct qcom_icc_node qnm_pcie = {
+	.name = "qnm_pcie",
+	.id = QCS8300_MASTER_ANOC_PCIE_GEM_NOC,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qnm_snoc_gc = {
+	.name = "qnm_snoc_gc",
+	.id = QCS8300_MASTER_SNOC_GC_MEM_NOC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_LLCC },
+};
+
+static struct qcom_icc_node qnm_snoc_sf = {
+	.name = "qnm_snoc_sf",
+	.id = QCS8300_MASTER_SNOC_SF_MEM_NOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 3,
+	.links = { QCS8300_SLAVE_GEM_NOC_CNOC, QCS8300_SLAVE_LLCC,
+		   QCS8300_SLAVE_GEM_NOC_PCIE_CNOC },
+};
+
+static struct qcom_icc_node qnm_sailss_md0 = {
+	.name = "qnm_sailss_md0",
+	.id = QCS8300_MASTER_SAILSS_MD0,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_GP_DSP_SAIL_NOC },
+};
+
+static struct qcom_icc_node qxm_dsp0 = {
+	.name = "qxm_dsp0",
+	.id = QCS8300_MASTER_DSP0,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_GP_DSP_SAIL_NOC },
+};
+
+static struct qcom_icc_node qhm_config_noc = {
+	.name = "qhm_config_noc",
+	.id = QCS8300_MASTER_CNOC_LPASS_AG_NOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 6,
+	.links = { QCS8300_SLAVE_LPASS_CORE_CFG, QCS8300_SLAVE_LPASS_LPI_CFG,
+		   QCS8300_SLAVE_LPASS_MPU_CFG, QCS8300_SLAVE_LPASS_TOP_CFG,
+		   QCS8300_SLAVE_SERVICES_LPASS_AML_NOC, QCS8300_SLAVE_SERVICE_LPASS_AG_NOC },
+};
+
+static struct qcom_icc_node qxm_lpass_dsp = {
+	.name = "qxm_lpass_dsp",
+	.id = QCS8300_MASTER_LPASS_PROC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 4,
+	.links = { QCS8300_SLAVE_LPASS_TOP_CFG, QCS8300_SLAVE_LPASS_SNOC,
+		   QCS8300_SLAVE_SERVICES_LPASS_AML_NOC, QCS8300_SLAVE_SERVICE_LPASS_AG_NOC },
+};
+
+static struct qcom_icc_node llcc_mc = {
+	.name = "llcc_mc",
+	.id = QCS8300_MASTER_LLCC,
+	.channels = 8,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_EBI1 },
+};
+
+static struct qcom_icc_node qnm_camnoc_hf = {
+	.name = "qnm_camnoc_hf",
+	.id = QCS8300_MASTER_CAMNOC_HF,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_MNOC_HF_MEM_NOC },
+};
+
+static struct qcom_icc_node qnm_camnoc_icp = {
+	.name = "qnm_camnoc_icp",
+	.id = QCS8300_MASTER_CAMNOC_ICP,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qnm_camnoc_sf = {
+	.name = "qnm_camnoc_sf",
+	.id = QCS8300_MASTER_CAMNOC_SF,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qnm_mdp0_0 = {
+	.name = "qnm_mdp0_0",
+	.id = QCS8300_MASTER_MDP0,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_MNOC_HF_MEM_NOC },
+};
+
+static struct qcom_icc_node qnm_mdp0_1 = {
+	.name = "qnm_mdp0_1",
+	.id = QCS8300_MASTER_MDP1,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_MNOC_HF_MEM_NOC },
+};
+
+static struct qcom_icc_node qnm_mnoc_hf_cfg = {
+	.name = "qnm_mnoc_hf_cfg",
+	.id = QCS8300_MASTER_CNOC_MNOC_HF_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SERVICE_MNOC_HF },
+};
+
+static struct qcom_icc_node qnm_mnoc_sf_cfg = {
+	.name = "qnm_mnoc_sf_cfg",
+	.id = QCS8300_MASTER_CNOC_MNOC_SF_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SERVICE_MNOC_SF },
+};
+
+static struct qcom_icc_node qnm_video0 = {
+	.name = "qnm_video0",
+	.id = QCS8300_MASTER_VIDEO_P0,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qnm_video_cvp = {
+	.name = "qnm_video_cvp",
+	.id = QCS8300_MASTER_VIDEO_PROC,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qnm_video_v_cpu = {
+	.name = "qnm_video_v_cpu",
+	.id = QCS8300_MASTER_VIDEO_V_PROC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node qhm_nsp_noc_config = {
+	.name = "qhm_nsp_noc_config",
+	.id = QCS8300_MASTER_CDSP_NOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SERVICE_NSP_NOC },
+};
+
+static struct qcom_icc_node qxm_nsp = {
+	.name = "qxm_nsp",
+	.id = QCS8300_MASTER_CDSP_PROC,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 2,
+	.links = { QCS8300_SLAVE_HCP_A, QCS8300_SLAVE_CDSP_MEM_NOC },
+};
+
+static struct qcom_icc_node xm_pcie3_0 = {
+	.name = "xm_pcie3_0",
+	.id = QCS8300_MASTER_PCIE_0,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_ANOC_PCIE_GEM_NOC },
+};
+
+static struct qcom_icc_node xm_pcie3_1 = {
+	.name = "xm_pcie3_1",
+	.id = QCS8300_MASTER_PCIE_1,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_ANOC_PCIE_GEM_NOC },
+};
+
+static struct qcom_icc_node qhm_gic = {
+	.name = "qhm_gic",
+	.id = QCS8300_MASTER_GIC_AHB,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SNOC_GEM_NOC_SF },
+};
+
+static struct qcom_icc_node qnm_aggre1_noc = {
+	.name = "qnm_aggre1_noc",
+	.id = QCS8300_MASTER_A1NOC_SNOC,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SNOC_GEM_NOC_SF },
+};
+
+static struct qcom_icc_node qnm_aggre2_noc = {
+	.name = "qnm_aggre2_noc",
+	.id = QCS8300_MASTER_A2NOC_SNOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SNOC_GEM_NOC_SF },
+};
+
+static struct qcom_icc_node qnm_lpass_noc = {
+	.name = "qnm_lpass_noc",
+	.id = QCS8300_MASTER_LPASS_ANOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SNOC_GEM_NOC_SF },
+};
+
+static struct qcom_icc_node qnm_snoc_cfg = {
+	.name = "qnm_snoc_cfg",
+	.id = QCS8300_MASTER_SNOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SERVICE_SNOC },
+};
+
+static struct qcom_icc_node qxm_pimem = {
+	.name = "qxm_pimem",
+	.id = QCS8300_MASTER_PIMEM,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SNOC_GEM_NOC_GC },
+};
+
+static struct qcom_icc_node xm_gic = {
+	.name = "xm_gic",
+	.id = QCS8300_MASTER_GIC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_SLAVE_SNOC_GEM_NOC_GC },
+};
+
+static struct qcom_icc_node qns_a1noc_snoc = {
+	.name = "qns_a1noc_snoc",
+	.id = QCS8300_SLAVE_A1NOC_SNOC,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_A1NOC_SNOC },
+};
+
+static struct qcom_icc_node qns_a2noc_snoc = {
+	.name = "qns_a2noc_snoc",
+	.id = QCS8300_SLAVE_A2NOC_SNOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_A2NOC_SNOC },
+};
+
+static struct qcom_icc_node qup0_core_slave = {
+	.name = "qup0_core_slave",
+	.id = QCS8300_SLAVE_QUP_CORE_0,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qup1_core_slave = {
+	.name = "qup1_core_slave",
+	.id = QCS8300_SLAVE_QUP_CORE_1,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qup3_core_slave = {
+	.name = "qup3_core_slave",
+	.id = QCS8300_SLAVE_QUP_CORE_3,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_ahb2phy2 = {
+	.name = "qhs_ahb2phy2",
+	.id = QCS8300_SLAVE_AHB2PHY_2,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_ahb2phy3 = {
+	.name = "qhs_ahb2phy3",
+	.id = QCS8300_SLAVE_AHB2PHY_3,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_anoc_throttle_cfg = {
+	.name = "qhs_anoc_throttle_cfg",
+	.id = QCS8300_SLAVE_ANOC_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_aoss = {
+	.name = "qhs_aoss",
+	.id = QCS8300_SLAVE_AOSS,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_apss = {
+	.name = "qhs_apss",
+	.id = QCS8300_SLAVE_APPSS,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_boot_rom = {
+	.name = "qhs_boot_rom",
+	.id = QCS8300_SLAVE_BOOT_ROM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_camera_cfg = {
+	.name = "qhs_camera_cfg",
+	.id = QCS8300_SLAVE_CAMERA_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_camera_nrt_throttle_cfg = {
+	.name = "qhs_camera_nrt_throttle_cfg",
+	.id = QCS8300_SLAVE_CAMERA_NRT_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_camera_rt_throttle_cfg = {
+	.name = "qhs_camera_rt_throttle_cfg",
+	.id = QCS8300_SLAVE_CAMERA_RT_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_clk_ctl = {
+	.name = "qhs_clk_ctl",
+	.id = QCS8300_SLAVE_CLK_CTL,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_compute0_cfg = {
+	.name = "qhs_compute0_cfg",
+	.id = QCS8300_SLAVE_CDSP_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_CDSP_NOC_CFG },
+};
+
+static struct qcom_icc_node qhs_cpr_cx = {
+	.name = "qhs_cpr_cx",
+	.id = QCS8300_SLAVE_RBCPR_CX_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_cpr_mmcx = {
+	.name = "qhs_cpr_mmcx",
+	.id = QCS8300_SLAVE_RBCPR_MMCX_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_cpr_mx = {
+	.name = "qhs_cpr_mx",
+	.id = QCS8300_SLAVE_RBCPR_MX_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_cpr_nspcx = {
+	.name = "qhs_cpr_nspcx",
+	.id = QCS8300_SLAVE_CPR_NSPCX,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_cpr_nsphmx = {
+	.name = "qhs_cpr_nsphmx",
+	.id = QCS8300_SLAVE_CPR_NSPHMX,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_crypto0_cfg = {
+	.name = "qhs_crypto0_cfg",
+	.id = QCS8300_SLAVE_CRYPTO_0_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_cx_rdpm = {
+	.name = "qhs_cx_rdpm",
+	.id = QCS8300_SLAVE_CX_RDPM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_display0_cfg = {
+	.name = "qhs_display0_cfg",
+	.id = QCS8300_SLAVE_DISPLAY_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_display0_rt_throttle_cfg = {
+	.name = "qhs_display0_rt_throttle_cfg",
+	.id = QCS8300_SLAVE_DISPLAY_RT_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_emac0_cfg = {
+	.name = "qhs_emac0_cfg",
+	.id = QCS8300_SLAVE_EMAC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_gp_dsp0_cfg = {
+	.name = "qhs_gp_dsp0_cfg",
+	.id = QCS8300_SLAVE_GP_DSP0_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_gpdsp0_throttle_cfg = {
+	.name = "qhs_gpdsp0_throttle_cfg",
+	.id = QCS8300_SLAVE_GPDSP0_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_gpu_tcu_throttle_cfg = {
+	.name = "qhs_gpu_tcu_throttle_cfg",
+	.id = QCS8300_SLAVE_GPU_TCU_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_gpuss_cfg = {
+	.name = "qhs_gpuss_cfg",
+	.id = QCS8300_SLAVE_GFX3D_CFG,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_hwkm = {
+	.name = "qhs_hwkm",
+	.id = QCS8300_SLAVE_HWKM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_imem_cfg = {
+	.name = "qhs_imem_cfg",
+	.id = QCS8300_SLAVE_IMEM_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_ipa = {
+	.name = "qhs_ipa",
+	.id = QCS8300_SLAVE_IPA_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_ipc_router = {
+	.name = "qhs_ipc_router",
+	.id = QCS8300_SLAVE_IPC_ROUTER_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_lpass_cfg = {
+	.name = "qhs_lpass_cfg",
+	.id = QCS8300_SLAVE_LPASS,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_CNOC_LPASS_AG_NOC },
+};
+
+static struct qcom_icc_node qhs_lpass_throttle_cfg = {
+	.name = "qhs_lpass_throttle_cfg",
+	.id = QCS8300_SLAVE_LPASS_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_mx_rdpm = {
+	.name = "qhs_mx_rdpm",
+	.id = QCS8300_SLAVE_MX_RDPM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_mxc_rdpm = {
+	.name = "qhs_mxc_rdpm",
+	.id = QCS8300_SLAVE_MXC_RDPM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_pcie0_cfg = {
+	.name = "qhs_pcie0_cfg",
+	.id = QCS8300_SLAVE_PCIE_0_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_pcie1_cfg = {
+	.name = "qhs_pcie1_cfg",
+	.id = QCS8300_SLAVE_PCIE_1_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_pcie_tcu_throttle_cfg = {
+	.name = "qhs_pcie_tcu_throttle_cfg",
+	.id = QCS8300_SLAVE_PCIE_TCU_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_pcie_throttle_cfg = {
+	.name = "qhs_pcie_throttle_cfg",
+	.id = QCS8300_SLAVE_PCIE_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_pdm = {
+	.name = "qhs_pdm",
+	.id = QCS8300_SLAVE_PDM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_pimem_cfg = {
+	.name = "qhs_pimem_cfg",
+	.id = QCS8300_SLAVE_PIMEM_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_pke_wrapper_cfg = {
+	.name = "qhs_pke_wrapper_cfg",
+	.id = QCS8300_SLAVE_PKA_WRAPPER_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qdss_cfg = {
+	.name = "qhs_qdss_cfg",
+	.id = QCS8300_SLAVE_QDSS_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qm_cfg = {
+	.name = "qhs_qm_cfg",
+	.id = QCS8300_SLAVE_QM_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qm_mpu_cfg = {
+	.name = "qhs_qm_mpu_cfg",
+	.id = QCS8300_SLAVE_QM_MPU_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qup0 = {
+	.name = "qhs_qup0",
+	.id = QCS8300_SLAVE_QUP_0,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qup1 = {
+	.name = "qhs_qup1",
+	.id = QCS8300_SLAVE_QUP_1,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_qup3 = {
+	.name = "qhs_qup3",
+	.id = QCS8300_SLAVE_QUP_3,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_sail_throttle_cfg = {
+	.name = "qhs_sail_throttle_cfg",
+	.id = QCS8300_SLAVE_SAIL_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_sdc1 = {
+	.name = "qhs_sdc1",
+	.id = QCS8300_SLAVE_SDC1,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_security = {
+	.name = "qhs_security",
+	.id = QCS8300_SLAVE_SECURITY,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_snoc_throttle_cfg = {
+	.name = "qhs_snoc_throttle_cfg",
+	.id = QCS8300_SLAVE_SNOC_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_tcsr = {
+	.name = "qhs_tcsr",
+	.id = QCS8300_SLAVE_TCSR,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_tlmm = {
+	.name = "qhs_tlmm",
+	.id = QCS8300_SLAVE_TLMM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_tsc_cfg = {
+	.name = "qhs_tsc_cfg",
+	.id = QCS8300_SLAVE_TSC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_ufs_mem_cfg = {
+	.name = "qhs_ufs_mem_cfg",
+	.id = QCS8300_SLAVE_UFS_MEM_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_usb2_0 = {
+	.name = "qhs_usb2_0",
+	.id = QCS8300_SLAVE_USB2,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_usb3_0 = {
+	.name = "qhs_usb3_0",
+	.id = QCS8300_SLAVE_USB3_0,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_venus_cfg = {
+	.name = "qhs_venus_cfg",
+	.id = QCS8300_SLAVE_VENUS_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_venus_cvp_throttle_cfg = {
+	.name = "qhs_venus_cvp_throttle_cfg",
+	.id = QCS8300_SLAVE_VENUS_CVP_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_venus_v_cpu_throttle_cfg = {
+	.name = "qhs_venus_v_cpu_throttle_cfg",
+	.id = QCS8300_SLAVE_VENUS_V_CPU_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_venus_vcodec_throttle_cfg = {
+	.name = "qhs_venus_vcodec_throttle_cfg",
+	.id = QCS8300_SLAVE_VENUS_VCODEC_THROTTLE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_ddrss_cfg = {
+	.name = "qns_ddrss_cfg",
+	.id = QCS8300_SLAVE_DDRSS_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_CNOC_DC_NOC },
+};
+
+static struct qcom_icc_node qns_gpdsp_noc_cfg = {
+	.name = "qns_gpdsp_noc_cfg",
+	.id = QCS8300_SLAVE_GPDSP_NOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_mnoc_hf_cfg = {
+	.name = "qns_mnoc_hf_cfg",
+	.id = QCS8300_SLAVE_CNOC_MNOC_HF_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_CNOC_MNOC_HF_CFG },
+};
+
+static struct qcom_icc_node qns_mnoc_sf_cfg = {
+	.name = "qns_mnoc_sf_cfg",
+	.id = QCS8300_SLAVE_CNOC_MNOC_SF_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_CNOC_MNOC_SF_CFG },
+};
+
+static struct qcom_icc_node qns_pcie_anoc_cfg = {
+	.name = "qns_pcie_anoc_cfg",
+	.id = QCS8300_SLAVE_PCIE_ANOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_snoc_cfg = {
+	.name = "qns_snoc_cfg",
+	.id = QCS8300_SLAVE_SNOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_SNOC_CFG },
+};
+
+static struct qcom_icc_node qxs_boot_imem = {
+	.name = "qxs_boot_imem",
+	.id = QCS8300_SLAVE_BOOT_IMEM,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qxs_imem = {
+	.name = "qxs_imem",
+	.id = QCS8300_SLAVE_IMEM,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qxs_pimem = {
+	.name = "qxs_pimem",
+	.id = QCS8300_SLAVE_PIMEM,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node xs_pcie_0 = {
+	.name = "xs_pcie_0",
+	.id = QCS8300_SLAVE_PCIE_0,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node xs_pcie_1 = {
+	.name = "xs_pcie_1",
+	.id = QCS8300_SLAVE_PCIE_1,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node xs_qdss_stm = {
+	.name = "xs_qdss_stm",
+	.id = QCS8300_SLAVE_QDSS_STM,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node xs_sys_tcu_cfg = {
+	.name = "xs_sys_tcu_cfg",
+	.id = QCS8300_SLAVE_TCU,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_llcc = {
+	.name = "qhs_llcc",
+	.id = QCS8300_SLAVE_LLCC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_gemnoc = {
+	.name = "qns_gemnoc",
+	.id = QCS8300_SLAVE_GEM_NOC_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_GEM_NOC_CFG },
+};
+
+static struct qcom_icc_node qns_gem_noc_cnoc = {
+	.name = "qns_gem_noc_cnoc",
+	.id = QCS8300_SLAVE_GEM_NOC_CNOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_GEM_NOC_CNOC },
+};
+
+static struct qcom_icc_node qns_llcc = {
+	.name = "qns_llcc",
+	.id = QCS8300_SLAVE_LLCC,
+	.channels = 4,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_LLCC },
+};
+
+static struct qcom_icc_node qns_pcie = {
+	.name = "qns_pcie",
+	.id = QCS8300_SLAVE_GEM_NOC_PCIE_CNOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_GEM_NOC_PCIE_SNOC },
+};
+
+static struct qcom_icc_node srvc_even_gemnoc = {
+	.name = "srvc_even_gemnoc",
+	.id = QCS8300_SLAVE_SERVICE_GEM_NOC_1,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node srvc_odd_gemnoc = {
+	.name = "srvc_odd_gemnoc",
+	.id = QCS8300_SLAVE_SERVICE_GEM_NOC_2,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node srvc_sys_gemnoc = {
+	.name = "srvc_sys_gemnoc",
+	.id = QCS8300_SLAVE_SERVICE_GEM_NOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node srvc_sys_gemnoc_2 = {
+	.name = "srvc_sys_gemnoc_2",
+	.id = QCS8300_SLAVE_SERVICE_GEM_NOC2,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_gp_dsp_sail_noc = {
+	.name = "qns_gp_dsp_sail_noc",
+	.id = QCS8300_SLAVE_GP_DSP_SAIL_NOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_GPDSP_SAIL },
+};
+
+static struct qcom_icc_node qhs_lpass_core = {
+	.name = "qhs_lpass_core",
+	.id = QCS8300_SLAVE_LPASS_CORE_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_lpass_lpi = {
+	.name = "qhs_lpass_lpi",
+	.id = QCS8300_SLAVE_LPASS_LPI_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_lpass_mpu = {
+	.name = "qhs_lpass_mpu",
+	.id = QCS8300_SLAVE_LPASS_MPU_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qhs_lpass_top = {
+	.name = "qhs_lpass_top",
+	.id = QCS8300_SLAVE_LPASS_TOP_CFG,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_sysnoc = {
+	.name = "qns_sysnoc",
+	.id = QCS8300_SLAVE_LPASS_SNOC,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_LPASS_ANOC },
+};
+
+static struct qcom_icc_node srvc_niu_aml_noc = {
+	.name = "srvc_niu_aml_noc",
+	.id = QCS8300_SLAVE_SERVICES_LPASS_AML_NOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node srvc_niu_lpass_agnoc = {
+	.name = "srvc_niu_lpass_agnoc",
+	.id = QCS8300_SLAVE_SERVICE_LPASS_AG_NOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node ebi = {
+	.name = "ebi",
+	.id = QCS8300_SLAVE_EBI1,
+	.channels = 8,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_mem_noc_hf = {
+	.name = "qns_mem_noc_hf",
+	.id = QCS8300_SLAVE_MNOC_HF_MEM_NOC,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_MNOC_HF_MEM_NOC },
+};
+
+static struct qcom_icc_node qns_mem_noc_sf = {
+	.name = "qns_mem_noc_sf",
+	.id = QCS8300_SLAVE_MNOC_SF_MEM_NOC,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_MNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node srvc_mnoc_hf = {
+	.name = "srvc_mnoc_hf",
+	.id = QCS8300_SLAVE_SERVICE_MNOC_HF,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node srvc_mnoc_sf = {
+	.name = "srvc_mnoc_sf",
+	.id = QCS8300_SLAVE_SERVICE_MNOC_SF,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_hcp = {
+	.name = "qns_hcp",
+	.id = QCS8300_SLAVE_HCP_A,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_nsp_gemnoc = {
+	.name = "qns_nsp_gemnoc",
+	.id = QCS8300_SLAVE_CDSP_MEM_NOC,
+	.channels = 2,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_COMPUTE_NOC },
+};
+
+static struct qcom_icc_node service_nsp_noc = {
+	.name = "service_nsp_noc",
+	.id = QCS8300_SLAVE_SERVICE_NSP_NOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_node qns_pcie_mem_noc = {
+	.name = "qns_pcie_mem_noc",
+	.id = QCS8300_SLAVE_ANOC_PCIE_GEM_NOC,
+	.channels = 1,
+	.buswidth = 32,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_ANOC_PCIE_GEM_NOC },
+};
+
+static struct qcom_icc_node qns_gemnoc_gc = {
+	.name = "qns_gemnoc_gc",
+	.id = QCS8300_SLAVE_SNOC_GEM_NOC_GC,
+	.channels = 1,
+	.buswidth = 8,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_SNOC_GC_MEM_NOC },
+};
+
+static struct qcom_icc_node qns_gemnoc_sf = {
+	.name = "qns_gemnoc_sf",
+	.id = QCS8300_SLAVE_SNOC_GEM_NOC_SF,
+	.channels = 1,
+	.buswidth = 16,
+	.num_links = 1,
+	.links = { QCS8300_MASTER_SNOC_SF_MEM_NOC },
+};
+
+static struct qcom_icc_node srvc_snoc = {
+	.name = "srvc_snoc",
+	.id = QCS8300_SLAVE_SERVICE_SNOC,
+	.channels = 1,
+	.buswidth = 4,
+	.num_links = 0,
+};
+
+static struct qcom_icc_bcm bcm_acv = {
+	.name = "ACV",
+	.enable_mask = BIT(3),
+	.num_nodes = 1,
+	.nodes = { &ebi },
+};
+
+static struct qcom_icc_bcm bcm_ce0 = {
+	.name = "CE0",
+	.num_nodes = 2,
+	.nodes = { &qxm_crypto_0, &qxm_crypto_1 },
+};
+
+static struct qcom_icc_bcm bcm_cn0 = {
+	.name = "CN0",
+	.keepalive = true,
+	.num_nodes = 2,
+	.nodes = { &qnm_gemnoc_cnoc, &qnm_gemnoc_pcie },
+};
+
+static struct qcom_icc_bcm bcm_cn1 = {
+	.name = "CN1",
+	.num_nodes = 66,
+	.nodes = { &qhs_ahb2phy2, &qhs_ahb2phy3,
+		   &qhs_anoc_throttle_cfg, &qhs_aoss,
+		   &qhs_apss, &qhs_boot_rom,
+		   &qhs_camera_cfg, &qhs_camera_nrt_throttle_cfg,
+		   &qhs_camera_rt_throttle_cfg, &qhs_clk_ctl,
+		   &qhs_compute0_cfg, &qhs_cpr_cx,
+		   &qhs_cpr_mmcx, &qhs_cpr_mx,
+		   &qhs_cpr_nspcx, &qhs_cpr_nsphmx,
+		   &qhs_crypto0_cfg, &qhs_cx_rdpm,
+		   &qhs_display0_cfg, &qhs_display0_rt_throttle_cfg,
+		   &qhs_emac0_cfg, &qhs_gp_dsp0_cfg,
+		   &qhs_gpdsp0_throttle_cfg, &qhs_gpu_tcu_throttle_cfg,
+		   &qhs_gpuss_cfg, &qhs_hwkm,
+		   &qhs_imem_cfg, &qhs_ipa,
+		   &qhs_ipc_router, &qhs_lpass_cfg,
+		   &qhs_lpass_throttle_cfg, &qhs_mx_rdpm,
+		   &qhs_mxc_rdpm, &qhs_pcie0_cfg,
+		   &qhs_pcie1_cfg, &qhs_pcie_tcu_throttle_cfg,
+		   &qhs_pcie_throttle_cfg, &qhs_pdm,
+		   &qhs_pimem_cfg, &qhs_pke_wrapper_cfg,
+		   &qhs_qdss_cfg, &qhs_qm_cfg,
+		   &qhs_qm_mpu_cfg, &qhs_sail_throttle_cfg,
+		   &qhs_sdc1, &qhs_security,
+		   &qhs_snoc_throttle_cfg, &qhs_tcsr,
+		   &qhs_tlmm, &qhs_tsc_cfg,
+		   &qhs_ufs_mem_cfg, &qhs_usb2_0,
+		   &qhs_usb3_0, &qhs_venus_cfg,
+		   &qhs_venus_cvp_throttle_cfg, &qhs_venus_v_cpu_throttle_cfg,
+		   &qhs_venus_vcodec_throttle_cfg, &qns_ddrss_cfg,
+		   &qns_gpdsp_noc_cfg, &qns_mnoc_hf_cfg,
+		   &qns_mnoc_sf_cfg, &qns_pcie_anoc_cfg,
+		   &qns_snoc_cfg, &qxs_boot_imem,
+		   &qxs_imem, &xs_sys_tcu_cfg },
+};
+
+static struct qcom_icc_bcm bcm_cn2 = {
+	.name = "CN2",
+	.num_nodes = 3,
+	.nodes = { &qhs_qup0, &qhs_qup1,
+		   &qhs_qup3 },
+};
+
+static struct qcom_icc_bcm bcm_cn3 = {
+	.name = "CN3",
+	.num_nodes = 2,
+	.nodes = { &xs_pcie_0, &xs_pcie_1 },
+};
+
+static struct qcom_icc_bcm bcm_gna0 = {
+	.name = "GNA0",
+	.num_nodes = 1,
+	.nodes = { &qxm_dsp0 },
+};
+
+static struct qcom_icc_bcm bcm_mc0 = {
+	.name = "MC0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &ebi },
+};
+
+static struct qcom_icc_bcm bcm_mm0 = {
+	.name = "MM0",
+	.keepalive = true,
+	.num_nodes = 4,
+	.nodes = { &qnm_camnoc_hf, &qnm_mdp0_0,
+		   &qnm_mdp0_1, &qns_mem_noc_hf },
+};
+
+static struct qcom_icc_bcm bcm_mm1 = {
+	.name = "MM1",
+	.num_nodes = 6,
+	.nodes = { &qnm_camnoc_icp, &qnm_camnoc_sf,
+		   &qnm_video0, &qnm_video_cvp,
+		   &qnm_video_v_cpu, &qns_mem_noc_sf },
+};
+
+static struct qcom_icc_bcm bcm_nsa0 = {
+	.name = "NSA0",
+	.num_nodes = 2,
+	.nodes = { &qns_hcp, &qns_nsp_gemnoc },
+};
+
+static struct qcom_icc_bcm bcm_nsa1 = {
+	.name = "NSA1",
+	.num_nodes = 1,
+	.nodes = { &qxm_nsp },
+};
+
+static struct qcom_icc_bcm bcm_pci0 = {
+	.name = "PCI0",
+	.num_nodes = 1,
+	.nodes = { &qns_pcie_mem_noc },
+};
+
+static struct qcom_icc_bcm bcm_qup0 = {
+	.name = "QUP0",
+	.vote_scale = 1,
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qup0_core_slave },
+};
+
+static struct qcom_icc_bcm bcm_qup1 = {
+	.name = "QUP1",
+	.vote_scale = 1,
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qup1_core_slave },
+};
+
+static struct qcom_icc_bcm bcm_qup2 = {
+	.name = "QUP2",
+	.vote_scale = 1,
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qup3_core_slave },
+};
+
+static struct qcom_icc_bcm bcm_sh0 = {
+	.name = "SH0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qns_llcc },
+};
+
+static struct qcom_icc_bcm bcm_sh2 = {
+	.name = "SH2",
+	.num_nodes = 1,
+	.nodes = { &chm_apps },
+};
+
+static struct qcom_icc_bcm bcm_sn0 = {
+	.name = "SN0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qns_gemnoc_sf },
+};
+
+static struct qcom_icc_bcm bcm_sn1 = {
+	.name = "SN1",
+	.num_nodes = 1,
+	.nodes = { &qns_gemnoc_gc },
+};
+
+static struct qcom_icc_bcm bcm_sn2 = {
+	.name = "SN2",
+	.num_nodes = 1,
+	.nodes = { &qxs_pimem },
+};
+
+static struct qcom_icc_bcm bcm_sn3 = {
+	.name = "SN3",
+	.num_nodes = 2,
+	.nodes = { &qns_a1noc_snoc, &qnm_aggre1_noc },
+};
+
+static struct qcom_icc_bcm bcm_sn4 = {
+	.name = "SN4",
+	.num_nodes = 2,
+	.nodes = { &qns_a2noc_snoc, &qnm_aggre2_noc },
+};
+
+static struct qcom_icc_bcm bcm_sn9 = {
+	.name = "SN9",
+	.num_nodes = 2,
+	.nodes = { &qns_sysnoc, &qnm_lpass_noc },
+};
+
+static struct qcom_icc_bcm bcm_sn10 = {
+	.name = "SN10",
+	.num_nodes = 1,
+	.nodes = { &xs_qdss_stm },
+};
+
+static struct qcom_icc_bcm * const aggre1_noc_bcms[] = {
+	&bcm_sn3,
+};
+
+static struct qcom_icc_node * const aggre1_noc_nodes[] = {
+	[MASTER_QUP_3] = &qxm_qup3,
+	[MASTER_EMAC] = &xm_emac_0,
+	[MASTER_SDC] = &xm_sdc1,
+	[MASTER_UFS_MEM] = &xm_ufs_mem,
+	[MASTER_USB2] = &xm_usb2_2,
+	[MASTER_USB3_0] = &xm_usb3_0,
+	[SLAVE_A1NOC_SNOC] = &qns_a1noc_snoc,
+};
+
+static const struct qcom_icc_desc qcs8300_aggre1_noc = {
+	.nodes = aggre1_noc_nodes,
+	.num_nodes = ARRAY_SIZE(aggre1_noc_nodes),
+	.bcms = aggre1_noc_bcms,
+	.num_bcms = ARRAY_SIZE(aggre1_noc_bcms),
+};
+
+static struct qcom_icc_bcm * const aggre2_noc_bcms[] = {
+	&bcm_ce0,
+	&bcm_sn4,
+};
+
+static struct qcom_icc_node * const aggre2_noc_nodes[] = {
+	[MASTER_QDSS_BAM] = &qhm_qdss_bam,
+	[MASTER_QUP_0] = &qhm_qup0,
+	[MASTER_QUP_1] = &qhm_qup1,
+	[MASTER_CNOC_A2NOC] = &qnm_cnoc_datapath,
+	[MASTER_CRYPTO_CORE0] = &qxm_crypto_0,
+	[MASTER_CRYPTO_CORE1] = &qxm_crypto_1,
+	[MASTER_IPA] = &qxm_ipa,
+	[MASTER_QDSS_ETR_0] = &xm_qdss_etr_0,
+	[MASTER_QDSS_ETR_1] = &xm_qdss_etr_1,
+	[SLAVE_A2NOC_SNOC] = &qns_a2noc_snoc,
+};
+
+static const struct qcom_icc_desc qcs8300_aggre2_noc = {
+	.nodes = aggre2_noc_nodes,
+	.num_nodes = ARRAY_SIZE(aggre2_noc_nodes),
+	.bcms = aggre2_noc_bcms,
+	.num_bcms = ARRAY_SIZE(aggre2_noc_bcms),
+};
+
+static struct qcom_icc_bcm * const clk_virt_bcms[] = {
+	&bcm_qup0,
+	&bcm_qup1,
+	&bcm_qup2,
+};
+
+static struct qcom_icc_node * const clk_virt_nodes[] = {
+	[MASTER_QUP_CORE_0] = &qup0_core_master,
+	[MASTER_QUP_CORE_1] = &qup1_core_master,
+	[MASTER_QUP_CORE_3] = &qup3_core_master,
+	[SLAVE_QUP_CORE_0] = &qup0_core_slave,
+	[SLAVE_QUP_CORE_1] = &qup1_core_slave,
+	[SLAVE_QUP_CORE_3] = &qup3_core_slave,
+};
+
+static const struct qcom_icc_desc qcs8300_clk_virt = {
+	.nodes = clk_virt_nodes,
+	.num_nodes = ARRAY_SIZE(clk_virt_nodes),
+	.bcms = clk_virt_bcms,
+	.num_bcms = ARRAY_SIZE(clk_virt_bcms),
+};
+
+static struct qcom_icc_bcm * const config_noc_bcms[] = {
+	&bcm_cn0,
+	&bcm_cn1,
+	&bcm_cn2,
+	&bcm_cn3,
+	&bcm_sn2,
+	&bcm_sn10,
+};
+
+static struct qcom_icc_node * const config_noc_nodes[] = {
+	[MASTER_GEM_NOC_CNOC] = &qnm_gemnoc_cnoc,
+	[MASTER_GEM_NOC_PCIE_SNOC] = &qnm_gemnoc_pcie,
+	[SLAVE_AHB2PHY_2] = &qhs_ahb2phy2,
+	[SLAVE_AHB2PHY_3] = &qhs_ahb2phy3,
+	[SLAVE_ANOC_THROTTLE_CFG] = &qhs_anoc_throttle_cfg,
+	[SLAVE_AOSS] = &qhs_aoss,
+	[SLAVE_APPSS] = &qhs_apss,
+	[SLAVE_BOOT_ROM] = &qhs_boot_rom,
+	[SLAVE_CAMERA_CFG] = &qhs_camera_cfg,
+	[SLAVE_CAMERA_NRT_THROTTLE_CFG] = &qhs_camera_nrt_throttle_cfg,
+	[SLAVE_CAMERA_RT_THROTTLE_CFG] = &qhs_camera_rt_throttle_cfg,
+	[SLAVE_CLK_CTL] = &qhs_clk_ctl,
+	[SLAVE_CDSP_CFG] = &qhs_compute0_cfg,
+	[SLAVE_RBCPR_CX_CFG] = &qhs_cpr_cx,
+	[SLAVE_RBCPR_MMCX_CFG] = &qhs_cpr_mmcx,
+	[SLAVE_RBCPR_MX_CFG] = &qhs_cpr_mx,
+	[SLAVE_CPR_NSPCX] = &qhs_cpr_nspcx,
+	[SLAVE_CPR_NSPHMX] = &qhs_cpr_nsphmx,
+	[SLAVE_CRYPTO_0_CFG] = &qhs_crypto0_cfg,
+	[SLAVE_CX_RDPM] = &qhs_cx_rdpm,
+	[SLAVE_DISPLAY_CFG] = &qhs_display0_cfg,
+	[SLAVE_DISPLAY_RT_THROTTLE_CFG] = &qhs_display0_rt_throttle_cfg,
+	[SLAVE_EMAC_CFG] = &qhs_emac0_cfg,
+	[SLAVE_GP_DSP0_CFG] = &qhs_gp_dsp0_cfg,
+	[SLAVE_GPDSP0_THROTTLE_CFG] = &qhs_gpdsp0_throttle_cfg,
+	[SLAVE_GPU_TCU_THROTTLE_CFG] = &qhs_gpu_tcu_throttle_cfg,
+	[SLAVE_GFX3D_CFG] = &qhs_gpuss_cfg,
+	[SLAVE_HWKM] = &qhs_hwkm,
+	[SLAVE_IMEM_CFG] = &qhs_imem_cfg,
+	[SLAVE_IPA_CFG] = &qhs_ipa,
+	[SLAVE_IPC_ROUTER_CFG] = &qhs_ipc_router,
+	[SLAVE_LPASS] = &qhs_lpass_cfg,
+	[SLAVE_LPASS_THROTTLE_CFG] = &qhs_lpass_throttle_cfg,
+	[SLAVE_MX_RDPM] = &qhs_mx_rdpm,
+	[SLAVE_MXC_RDPM] = &qhs_mxc_rdpm,
+	[SLAVE_PCIE_0_CFG] = &qhs_pcie0_cfg,
+	[SLAVE_PCIE_1_CFG] = &qhs_pcie1_cfg,
+	[SLAVE_PCIE_TCU_THROTTLE_CFG] = &qhs_pcie_tcu_throttle_cfg,
+	[SLAVE_PCIE_THROTTLE_CFG] = &qhs_pcie_throttle_cfg,
+	[SLAVE_PDM] = &qhs_pdm,
+	[SLAVE_PIMEM_CFG] = &qhs_pimem_cfg,
+	[SLAVE_PKA_WRAPPER_CFG] = &qhs_pke_wrapper_cfg,
+	[SLAVE_QDSS_CFG] = &qhs_qdss_cfg,
+	[SLAVE_QM_CFG] = &qhs_qm_cfg,
+	[SLAVE_QM_MPU_CFG] = &qhs_qm_mpu_cfg,
+	[SLAVE_QUP_0] = &qhs_qup0,
+	[SLAVE_QUP_1] = &qhs_qup1,
+	[SLAVE_QUP_3] = &qhs_qup3,
+	[SLAVE_SAIL_THROTTLE_CFG] = &qhs_sail_throttle_cfg,
+	[SLAVE_SDC1] = &qhs_sdc1,
+	[SLAVE_SECURITY] = &qhs_security,
+	[SLAVE_SNOC_THROTTLE_CFG] = &qhs_snoc_throttle_cfg,
+	[SLAVE_TCSR] = &qhs_tcsr,
+	[SLAVE_TLMM] = &qhs_tlmm,
+	[SLAVE_TSC_CFG] = &qhs_tsc_cfg,
+	[SLAVE_UFS_MEM_CFG] = &qhs_ufs_mem_cfg,
+	[SLAVE_USB2] = &qhs_usb2_0,
+	[SLAVE_USB3_0] = &qhs_usb3_0,
+	[SLAVE_VENUS_CFG] = &qhs_venus_cfg,
+	[SLAVE_VENUS_CVP_THROTTLE_CFG] = &qhs_venus_cvp_throttle_cfg,
+	[SLAVE_VENUS_V_CPU_THROTTLE_CFG] = &qhs_venus_v_cpu_throttle_cfg,
+	[SLAVE_VENUS_VCODEC_THROTTLE_CFG] = &qhs_venus_vcodec_throttle_cfg,
+	[SLAVE_DDRSS_CFG] = &qns_ddrss_cfg,
+	[SLAVE_GPDSP_NOC_CFG] = &qns_gpdsp_noc_cfg,
+	[SLAVE_CNOC_MNOC_HF_CFG] = &qns_mnoc_hf_cfg,
+	[SLAVE_CNOC_MNOC_SF_CFG] = &qns_mnoc_sf_cfg,
+	[SLAVE_PCIE_ANOC_CFG] = &qns_pcie_anoc_cfg,
+	[SLAVE_SNOC_CFG] = &qns_snoc_cfg,
+	[SLAVE_BOOT_IMEM] = &qxs_boot_imem,
+	[SLAVE_IMEM] = &qxs_imem,
+	[SLAVE_PIMEM] = &qxs_pimem,
+	[SLAVE_PCIE_0] = &xs_pcie_0,
+	[SLAVE_PCIE_1] = &xs_pcie_1,
+	[SLAVE_QDSS_STM] = &xs_qdss_stm,
+	[SLAVE_TCU] = &xs_sys_tcu_cfg,
+};
+
+static const struct qcom_icc_desc qcs8300_config_noc = {
+	.nodes = config_noc_nodes,
+	.num_nodes = ARRAY_SIZE(config_noc_nodes),
+	.bcms = config_noc_bcms,
+	.num_bcms = ARRAY_SIZE(config_noc_bcms),
+};
+
+static struct qcom_icc_node * const dc_noc_nodes[] = {
+	[MASTER_CNOC_DC_NOC] = &qnm_cnoc_dc_noc,
+	[SLAVE_LLCC_CFG] = &qhs_llcc,
+	[SLAVE_GEM_NOC_CFG] = &qns_gemnoc,
+};
+
+static const struct qcom_icc_desc qcs8300_dc_noc = {
+	.nodes = dc_noc_nodes,
+	.num_nodes = ARRAY_SIZE(dc_noc_nodes),
+};
+
+static struct qcom_icc_bcm * const gem_noc_bcms[] = {
+	&bcm_sh0,
+	&bcm_sh2,
+};
+
+static struct qcom_icc_node * const gem_noc_nodes[] = {
+	[MASTER_GPU_TCU] = &alm_gpu_tcu,
+	[MASTER_PCIE_TCU] = &alm_pcie_tcu,
+	[MASTER_SYS_TCU] = &alm_sys_tcu,
+	[MASTER_APPSS_PROC] = &chm_apps,
+	[MASTER_COMPUTE_NOC] = &qnm_cmpnoc0,
+	[MASTER_GEM_NOC_CFG] = &qnm_gemnoc_cfg,
+	[MASTER_GPDSP_SAIL] = &qnm_gpdsp_sail,
+	[MASTER_GFX3D] = &qnm_gpu,
+	[MASTER_MNOC_HF_MEM_NOC] = &qnm_mnoc_hf,
+	[MASTER_MNOC_SF_MEM_NOC] = &qnm_mnoc_sf,
+	[MASTER_ANOC_PCIE_GEM_NOC] = &qnm_pcie,
+	[MASTER_SNOC_GC_MEM_NOC] = &qnm_snoc_gc,
+	[MASTER_SNOC_SF_MEM_NOC] = &qnm_snoc_sf,
+	[SLAVE_GEM_NOC_CNOC] = &qns_gem_noc_cnoc,
+	[SLAVE_LLCC] = &qns_llcc,
+	[SLAVE_GEM_NOC_PCIE_CNOC] = &qns_pcie,
+	[SLAVE_SERVICE_GEM_NOC_1] = &srvc_even_gemnoc,
+	[SLAVE_SERVICE_GEM_NOC_2] = &srvc_odd_gemnoc,
+	[SLAVE_SERVICE_GEM_NOC] = &srvc_sys_gemnoc,
+	[SLAVE_SERVICE_GEM_NOC2] = &srvc_sys_gemnoc_2,
+};
+
+static const struct qcom_icc_desc qcs8300_gem_noc = {
+	.nodes = gem_noc_nodes,
+	.num_nodes = ARRAY_SIZE(gem_noc_nodes),
+	.bcms = gem_noc_bcms,
+	.num_bcms = ARRAY_SIZE(gem_noc_bcms),
+};
+
+static struct qcom_icc_bcm * const gpdsp_anoc_bcms[] = {
+	&bcm_gna0,
+};
+
+static struct qcom_icc_node * const gpdsp_anoc_nodes[] = {
+	[MASTER_SAILSS_MD0] = &qnm_sailss_md0,
+	[MASTER_DSP0] = &qxm_dsp0,
+	[SLAVE_GP_DSP_SAIL_NOC] = &qns_gp_dsp_sail_noc,
+};
+
+static const struct qcom_icc_desc qcs8300_gpdsp_anoc = {
+	.nodes = gpdsp_anoc_nodes,
+	.num_nodes = ARRAY_SIZE(gpdsp_anoc_nodes),
+	.bcms = gpdsp_anoc_bcms,
+	.num_bcms = ARRAY_SIZE(gpdsp_anoc_bcms),
+};
+
+static struct qcom_icc_bcm * const lpass_ag_noc_bcms[] = {
+	&bcm_sn9,
+};
+
+static struct qcom_icc_node * const lpass_ag_noc_nodes[] = {
+	[MASTER_CNOC_LPASS_AG_NOC] = &qhm_config_noc,
+	[MASTER_LPASS_PROC] = &qxm_lpass_dsp,
+	[SLAVE_LPASS_CORE_CFG] = &qhs_lpass_core,
+	[SLAVE_LPASS_LPI_CFG] = &qhs_lpass_lpi,
+	[SLAVE_LPASS_MPU_CFG] = &qhs_lpass_mpu,
+	[SLAVE_LPASS_TOP_CFG] = &qhs_lpass_top,
+	[SLAVE_LPASS_SNOC] = &qns_sysnoc,
+	[SLAVE_SERVICES_LPASS_AML_NOC] = &srvc_niu_aml_noc,
+	[SLAVE_SERVICE_LPASS_AG_NOC] = &srvc_niu_lpass_agnoc,
+};
+
+static const struct qcom_icc_desc qcs8300_lpass_ag_noc = {
+	.nodes = lpass_ag_noc_nodes,
+	.num_nodes = ARRAY_SIZE(lpass_ag_noc_nodes),
+	.bcms = lpass_ag_noc_bcms,
+	.num_bcms = ARRAY_SIZE(lpass_ag_noc_bcms),
+};
+
+static struct qcom_icc_bcm * const mc_virt_bcms[] = {
+	&bcm_acv,
+	&bcm_mc0,
+};
+
+static struct qcom_icc_node * const mc_virt_nodes[] = {
+	[MASTER_LLCC] = &llcc_mc,
+	[SLAVE_EBI1] = &ebi,
+};
+
+static const struct qcom_icc_desc qcs8300_mc_virt = {
+	.nodes = mc_virt_nodes,
+	.num_nodes = ARRAY_SIZE(mc_virt_nodes),
+	.bcms = mc_virt_bcms,
+	.num_bcms = ARRAY_SIZE(mc_virt_bcms),
+};
+
+static struct qcom_icc_bcm * const mmss_noc_bcms[] = {
+	&bcm_mm0,
+	&bcm_mm1,
+};
+
+static struct qcom_icc_node * const mmss_noc_nodes[] = {
+	[MASTER_CAMNOC_HF] = &qnm_camnoc_hf,
+	[MASTER_CAMNOC_ICP] = &qnm_camnoc_icp,
+	[MASTER_CAMNOC_SF] = &qnm_camnoc_sf,
+	[MASTER_MDP0] = &qnm_mdp0_0,
+	[MASTER_MDP1] = &qnm_mdp0_1,
+	[MASTER_CNOC_MNOC_HF_CFG] = &qnm_mnoc_hf_cfg,
+	[MASTER_CNOC_MNOC_SF_CFG] = &qnm_mnoc_sf_cfg,
+	[MASTER_VIDEO_P0] = &qnm_video0,
+	[MASTER_VIDEO_PROC] = &qnm_video_cvp,
+	[MASTER_VIDEO_V_PROC] = &qnm_video_v_cpu,
+	[SLAVE_MNOC_HF_MEM_NOC] = &qns_mem_noc_hf,
+	[SLAVE_MNOC_SF_MEM_NOC] = &qns_mem_noc_sf,
+	[SLAVE_SERVICE_MNOC_HF] = &srvc_mnoc_hf,
+	[SLAVE_SERVICE_MNOC_SF] = &srvc_mnoc_sf,
+};
+
+static const struct qcom_icc_desc qcs8300_mmss_noc = {
+	.nodes = mmss_noc_nodes,
+	.num_nodes = ARRAY_SIZE(mmss_noc_nodes),
+	.bcms = mmss_noc_bcms,
+	.num_bcms = ARRAY_SIZE(mmss_noc_bcms),
+};
+
+static struct qcom_icc_bcm * const nspa_noc_bcms[] = {
+	&bcm_nsa0,
+	&bcm_nsa1,
+};
+
+static struct qcom_icc_node * const nspa_noc_nodes[] = {
+	[MASTER_CDSP_NOC_CFG] = &qhm_nsp_noc_config,
+	[MASTER_CDSP_PROC] = &qxm_nsp,
+	[SLAVE_HCP_A] = &qns_hcp,
+	[SLAVE_CDSP_MEM_NOC] = &qns_nsp_gemnoc,
+	[SLAVE_SERVICE_NSP_NOC] = &service_nsp_noc,
+};
+
+static const struct qcom_icc_desc qcs8300_nspa_noc = {
+	.nodes = nspa_noc_nodes,
+	.num_nodes = ARRAY_SIZE(nspa_noc_nodes),
+	.bcms = nspa_noc_bcms,
+	.num_bcms = ARRAY_SIZE(nspa_noc_bcms),
+};
+
+static struct qcom_icc_bcm * const pcie_anoc_bcms[] = {
+	&bcm_pci0,
+};
+
+static struct qcom_icc_node * const pcie_anoc_nodes[] = {
+	[MASTER_PCIE_0] = &xm_pcie3_0,
+	[MASTER_PCIE_1] = &xm_pcie3_1,
+	[SLAVE_ANOC_PCIE_GEM_NOC] = &qns_pcie_mem_noc,
+};
+
+static const struct qcom_icc_desc qcs8300_pcie_anoc = {
+	.nodes = pcie_anoc_nodes,
+	.num_nodes = ARRAY_SIZE(pcie_anoc_nodes),
+	.bcms = pcie_anoc_bcms,
+	.num_bcms = ARRAY_SIZE(pcie_anoc_bcms),
+};
+
+static struct qcom_icc_bcm * const system_noc_bcms[] = {
+	&bcm_sn0,
+	&bcm_sn1,
+	&bcm_sn3,
+	&bcm_sn4,
+	&bcm_sn9,
+};
+
+static struct qcom_icc_node * const system_noc_nodes[] = {
+	[MASTER_GIC_AHB] = &qhm_gic,
+	[MASTER_A1NOC_SNOC] = &qnm_aggre1_noc,
+	[MASTER_A2NOC_SNOC] = &qnm_aggre2_noc,
+	[MASTER_LPASS_ANOC] = &qnm_lpass_noc,
+	[MASTER_SNOC_CFG] = &qnm_snoc_cfg,
+	[MASTER_PIMEM] = &qxm_pimem,
+	[MASTER_GIC] = &xm_gic,
+	[SLAVE_SNOC_GEM_NOC_GC] = &qns_gemnoc_gc,
+	[SLAVE_SNOC_GEM_NOC_SF] = &qns_gemnoc_sf,
+	[SLAVE_SERVICE_SNOC] = &srvc_snoc,
+};
+
+static const struct qcom_icc_desc qcs8300_system_noc = {
+	.nodes = system_noc_nodes,
+	.num_nodes = ARRAY_SIZE(system_noc_nodes),
+	.bcms = system_noc_bcms,
+	.num_bcms = ARRAY_SIZE(system_noc_bcms),
+};
+
+static const struct of_device_id qnoc_of_match[] = {
+	{ .compatible = "qcom,qcs8300-aggre1-noc",
+	  .data = &qcs8300_aggre1_noc},
+	{ .compatible = "qcom,qcs8300-aggre2-noc",
+	  .data = &qcs8300_aggre2_noc},
+	{ .compatible = "qcom,qcs8300-clk-virt",
+	  .data = &qcs8300_clk_virt},
+	{ .compatible = "qcom,qcs8300-config-noc",
+	  .data = &qcs8300_config_noc},
+	{ .compatible = "qcom,qcs8300-dc-noc",
+	  .data = &qcs8300_dc_noc},
+	{ .compatible = "qcom,qcs8300-gem-noc",
+	  .data = &qcs8300_gem_noc},
+	{ .compatible = "qcom,qcs8300-gpdsp-anoc",
+	  .data = &qcs8300_gpdsp_anoc},
+	{ .compatible = "qcom,qcs8300-lpass-ag-noc",
+	  .data = &qcs8300_lpass_ag_noc},
+	{ .compatible = "qcom,qcs8300-mc-virt",
+	  .data = &qcs8300_mc_virt},
+	{ .compatible = "qcom,qcs8300-mmss-noc",
+	  .data = &qcs8300_mmss_noc},
+	{ .compatible = "qcom,qcs8300-nspa-noc",
+	  .data = &qcs8300_nspa_noc},
+	{ .compatible = "qcom,qcs8300-pcie-anoc",
+	  .data = &qcs8300_pcie_anoc},
+	{ .compatible = "qcom,qcs8300-system-noc",
+	  .data = &qcs8300_system_noc},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, qnoc_of_match);
+
+static struct platform_driver qnoc_driver = {
+	.probe = qcom_icc_rpmh_probe,
+	.remove_new = qcom_icc_rpmh_remove,
+	.driver = {
+		.name = "qnoc-qcs8300",
+		.of_match_table = qnoc_of_match,
+		.sync_state = icc_sync_state,
+	},
+};
+
+static int __init qnoc_driver_init(void)
+{
+	return platform_driver_register(&qnoc_driver);
+}
+core_initcall(qnoc_driver_init);
+
+static void __exit qnoc_driver_exit(void)
+{
+	platform_driver_unregister(&qnoc_driver);
+}
+module_exit(qnoc_driver_exit);
+
+MODULE_DESCRIPTION("QCS8300 NoC driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/qcs8300.h
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/qcs8300.h
@@ -0,0 +1,177 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __DRIVERS_INTERCONNECT_QCOM_QCS8300_H
+#define __DRIVERS_INTERCONNECT_QCOM_QCS8300_H
+
+#define QCS8300_MASTER_GPU_TCU				0
+#define QCS8300_MASTER_PCIE_TCU				1
+#define QCS8300_MASTER_SYS_TCU				2
+#define QCS8300_MASTER_APPSS_PROC			3
+#define QCS8300_MASTER_LLCC				4
+#define QCS8300_MASTER_CNOC_LPASS_AG_NOC		5
+#define QCS8300_MASTER_GIC_AHB				6
+#define QCS8300_MASTER_CDSP_NOC_CFG			7
+#define QCS8300_MASTER_QDSS_BAM				8
+#define QCS8300_MASTER_QUP_0				9
+#define QCS8300_MASTER_QUP_1				10
+#define QCS8300_MASTER_A1NOC_SNOC			11
+#define QCS8300_MASTER_A2NOC_SNOC			12
+#define QCS8300_MASTER_CAMNOC_HF			13
+#define QCS8300_MASTER_CAMNOC_ICP			14
+#define QCS8300_MASTER_CAMNOC_SF			15
+#define QCS8300_MASTER_COMPUTE_NOC			16
+#define QCS8300_MASTER_CNOC_A2NOC			17
+#define QCS8300_MASTER_CNOC_DC_NOC			18
+#define QCS8300_MASTER_GEM_NOC_CFG			19
+#define QCS8300_MASTER_GEM_NOC_CNOC			20
+#define QCS8300_MASTER_GEM_NOC_PCIE_SNOC		21
+#define QCS8300_MASTER_GPDSP_SAIL			22
+#define QCS8300_MASTER_GFX3D				23
+#define QCS8300_MASTER_LPASS_ANOC			24
+#define QCS8300_MASTER_MDP0				25
+#define QCS8300_MASTER_MDP1				26
+#define QCS8300_MASTER_MNOC_HF_MEM_NOC			27
+#define QCS8300_MASTER_CNOC_MNOC_HF_CFG			28
+#define QCS8300_MASTER_MNOC_SF_MEM_NOC			29
+#define QCS8300_MASTER_CNOC_MNOC_SF_CFG			30
+#define QCS8300_MASTER_ANOC_PCIE_GEM_NOC		31
+#define QCS8300_MASTER_SAILSS_MD0			32
+#define QCS8300_MASTER_SNOC_CFG				33
+#define QCS8300_MASTER_SNOC_GC_MEM_NOC			34
+#define QCS8300_MASTER_SNOC_SF_MEM_NOC			35
+#define QCS8300_MASTER_VIDEO_P0				36
+#define QCS8300_MASTER_VIDEO_PROC			37
+#define QCS8300_MASTER_VIDEO_V_PROC			38
+#define QCS8300_MASTER_QUP_CORE_0			39
+#define QCS8300_MASTER_QUP_CORE_1			40
+#define QCS8300_MASTER_QUP_CORE_3			41
+#define QCS8300_MASTER_CRYPTO_CORE0			42
+#define QCS8300_MASTER_CRYPTO_CORE1			43
+#define QCS8300_MASTER_DSP0				44
+#define QCS8300_MASTER_IPA				45
+#define QCS8300_MASTER_LPASS_PROC			46
+#define QCS8300_MASTER_CDSP_PROC			47
+#define QCS8300_MASTER_PIMEM				48
+#define QCS8300_MASTER_QUP_3				49
+#define QCS8300_MASTER_EMAC				50
+#define QCS8300_MASTER_GIC				51
+#define QCS8300_MASTER_PCIE_0				52
+#define QCS8300_MASTER_PCIE_1				53
+#define QCS8300_MASTER_QDSS_ETR_0			54
+#define QCS8300_MASTER_QDSS_ETR_1			55
+#define QCS8300_MASTER_SDC				56
+#define QCS8300_MASTER_UFS_MEM				57
+#define QCS8300_MASTER_USB2				58
+#define QCS8300_MASTER_USB3_0				59
+#define QCS8300_SLAVE_EBI1				60
+#define QCS8300_SLAVE_AHB2PHY_2				61
+#define QCS8300_SLAVE_AHB2PHY_3				62
+#define QCS8300_SLAVE_ANOC_THROTTLE_CFG			63
+#define QCS8300_SLAVE_AOSS				64
+#define QCS8300_SLAVE_APPSS				65
+#define QCS8300_SLAVE_BOOT_ROM				66
+#define QCS8300_SLAVE_CAMERA_CFG			67
+#define QCS8300_SLAVE_CAMERA_NRT_THROTTLE_CFG		68
+#define QCS8300_SLAVE_CAMERA_RT_THROTTLE_CFG		69
+#define QCS8300_SLAVE_CLK_CTL				70
+#define QCS8300_SLAVE_CDSP_CFG				71
+#define QCS8300_SLAVE_RBCPR_CX_CFG			72
+#define QCS8300_SLAVE_RBCPR_MMCX_CFG			73
+#define QCS8300_SLAVE_RBCPR_MX_CFG			74
+#define QCS8300_SLAVE_CPR_NSPCX				75
+#define QCS8300_SLAVE_CPR_NSPHMX			76
+#define QCS8300_SLAVE_CRYPTO_0_CFG			77
+#define QCS8300_SLAVE_CX_RDPM				78
+#define QCS8300_SLAVE_DISPLAY_CFG			79
+#define QCS8300_SLAVE_DISPLAY_RT_THROTTLE_CFG		80
+#define QCS8300_SLAVE_EMAC_CFG				81
+#define QCS8300_SLAVE_GP_DSP0_CFG			82
+#define QCS8300_SLAVE_GPDSP0_THROTTLE_CFG		83
+#define QCS8300_SLAVE_GPU_TCU_THROTTLE_CFG		84
+#define QCS8300_SLAVE_GFX3D_CFG				85
+#define QCS8300_SLAVE_HWKM				86
+#define QCS8300_SLAVE_IMEM_CFG				87
+#define QCS8300_SLAVE_IPA_CFG				88
+#define QCS8300_SLAVE_IPC_ROUTER_CFG			89
+#define QCS8300_SLAVE_LLCC_CFG				90
+#define QCS8300_SLAVE_LPASS				91
+#define QCS8300_SLAVE_LPASS_CORE_CFG			92
+#define QCS8300_SLAVE_LPASS_LPI_CFG			93
+#define QCS8300_SLAVE_LPASS_MPU_CFG			94
+#define QCS8300_SLAVE_LPASS_THROTTLE_CFG		95
+#define QCS8300_SLAVE_LPASS_TOP_CFG			96
+#define QCS8300_SLAVE_MX_RDPM				97
+#define QCS8300_SLAVE_MXC_RDPM				98
+#define QCS8300_SLAVE_PCIE_0_CFG			99
+#define QCS8300_SLAVE_PCIE_1_CFG			100
+#define QCS8300_SLAVE_PCIE_TCU_THROTTLE_CFG		101
+#define QCS8300_SLAVE_PCIE_THROTTLE_CFG			102
+#define QCS8300_SLAVE_PDM				103
+#define QCS8300_SLAVE_PIMEM_CFG				104
+#define QCS8300_SLAVE_PKA_WRAPPER_CFG			105
+#define QCS8300_SLAVE_QDSS_CFG				106
+#define QCS8300_SLAVE_QM_CFG				107
+#define QCS8300_SLAVE_QM_MPU_CFG			108
+#define QCS8300_SLAVE_QUP_0				109
+#define QCS8300_SLAVE_QUP_1				110
+#define QCS8300_SLAVE_QUP_3				111
+#define QCS8300_SLAVE_SAIL_THROTTLE_CFG			112
+#define QCS8300_SLAVE_SDC1				113
+#define QCS8300_SLAVE_SECURITY				114
+#define QCS8300_SLAVE_SNOC_THROTTLE_CFG			115
+#define QCS8300_SLAVE_TCSR				116
+#define QCS8300_SLAVE_TLMM				117
+#define QCS8300_SLAVE_TSC_CFG				118
+#define QCS8300_SLAVE_UFS_MEM_CFG			119
+#define QCS8300_SLAVE_USB2				120
+#define QCS8300_SLAVE_USB3_0				121
+#define QCS8300_SLAVE_VENUS_CFG				122
+#define QCS8300_SLAVE_VENUS_CVP_THROTTLE_CFG		123
+#define QCS8300_SLAVE_VENUS_V_CPU_THROTTLE_CFG		124
+#define QCS8300_SLAVE_VENUS_VCODEC_THROTTLE_CFG		125
+#define QCS8300_SLAVE_A1NOC_SNOC			126
+#define QCS8300_SLAVE_A2NOC_SNOC			127
+#define QCS8300_SLAVE_DDRSS_CFG				128
+#define QCS8300_SLAVE_GEM_NOC_CNOC			129
+#define QCS8300_SLAVE_GEM_NOC_CFG			130
+#define QCS8300_SLAVE_SNOC_GEM_NOC_GC			131
+#define QCS8300_SLAVE_SNOC_GEM_NOC_SF			132
+#define QCS8300_SLAVE_GP_DSP_SAIL_NOC			133
+#define QCS8300_SLAVE_GPDSP_NOC_CFG			134
+#define QCS8300_SLAVE_HCP_A				135
+#define QCS8300_SLAVE_LLCC				136
+#define QCS8300_SLAVE_MNOC_HF_MEM_NOC			137
+#define QCS8300_SLAVE_MNOC_SF_MEM_NOC			138
+#define QCS8300_SLAVE_CNOC_MNOC_HF_CFG			139
+#define QCS8300_SLAVE_CNOC_MNOC_SF_CFG			140
+#define QCS8300_SLAVE_CDSP_MEM_NOC			141
+#define QCS8300_SLAVE_GEM_NOC_PCIE_CNOC			142
+#define QCS8300_SLAVE_PCIE_ANOC_CFG			143
+#define QCS8300_SLAVE_ANOC_PCIE_GEM_NOC			144
+#define QCS8300_SLAVE_SNOC_CFG				145
+#define QCS8300_SLAVE_LPASS_SNOC			146
+#define QCS8300_SLAVE_QUP_CORE_0			147
+#define QCS8300_SLAVE_QUP_CORE_1			148
+#define QCS8300_SLAVE_QUP_CORE_3			149
+#define QCS8300_SLAVE_BOOT_IMEM				150
+#define QCS8300_SLAVE_IMEM				151
+#define QCS8300_SLAVE_PIMEM				152
+#define QCS8300_SLAVE_SERVICE_NSP_NOC			153
+#define QCS8300_SLAVE_SERVICE_GEM_NOC_1			154
+#define QCS8300_SLAVE_SERVICE_MNOC_HF			155
+#define QCS8300_SLAVE_SERVICE_MNOC_SF			156
+#define QCS8300_SLAVE_SERVICES_LPASS_AML_NOC		157
+#define QCS8300_SLAVE_SERVICE_LPASS_AG_NOC		158
+#define QCS8300_SLAVE_SERVICE_GEM_NOC_2			159
+#define QCS8300_SLAVE_SERVICE_SNOC			160
+#define QCS8300_SLAVE_SERVICE_GEM_NOC			161
+#define QCS8300_SLAVE_SERVICE_GEM_NOC2			162
+#define QCS8300_SLAVE_PCIE_0				163
+#define QCS8300_SLAVE_PCIE_1				164
+#define QCS8300_SLAVE_QDSS_STM				165
+#define QCS8300_SLAVE_TCU				166
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/sa8775p.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/sa8775p.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  * Copyright (c) 2023, Linaro Limited
  */
 
@@ -209,173 +209,351 @@
 #define SA8775P_SLAVE_QDSS_STM				632
 #define SA8775P_SLAVE_TCU				633
 
+static const struct regmap_config icc_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+};
+
+static struct qcom_icc_qosbox qxm_qup3_qos = {
+	.num_ports = 1,
+	.offsets = { 0x11000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qxm_qup3 = {
 	.name = "qxm_qup3",
 	.id = SA8775P_MASTER_QUP_3,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_qup3_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_emac_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x12000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_emac_0 = {
 	.name = "xm_emac_0",
 	.id = SA8775P_MASTER_EMAC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_emac_0_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_emac_1_qos = {
+	.num_ports = 1,
+	.offsets = { 0x13000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_emac_1 = {
 	.name = "xm_emac_1",
 	.id = SA8775P_MASTER_EMAC_1,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_emac_1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_sdc1_qos = {
+	.num_ports = 1,
+	.offsets = { 0x14000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_sdc1 = {
 	.name = "xm_sdc1",
 	.id = SA8775P_MASTER_SDC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_sdc1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_ufs_mem_qos = {
+	.num_ports = 1,
+	.offsets = { 0x15000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
+
 static struct qcom_icc_node xm_ufs_mem = {
 	.name = "xm_ufs_mem",
 	.id = SA8775P_MASTER_UFS_MEM,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_ufs_mem_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_usb2_2_qos = {
+	.num_ports = 1,
+	.offsets = { 0x16000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_usb2_2 = {
 	.name = "xm_usb2_2",
 	.id = SA8775P_MASTER_USB2,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_usb2_2_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_usb3_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x17000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_usb3_0 = {
 	.name = "xm_usb3_0",
 	.id = SA8775P_MASTER_USB3_0,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_usb3_0_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_usb3_1_qos = {
+	.num_ports = 1,
+	.offsets = { 0x18000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_usb3_1 = {
 	.name = "xm_usb3_1",
 	.id = SA8775P_MASTER_USB3_1,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_usb3_1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qdss_bam_qos = {
+	.num_ports = 1,
+	.offsets = { 0x14000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qhm_qdss_bam = {
 	.name = "qhm_qdss_bam",
 	.id = SA8775P_MASTER_QDSS_BAM,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qdss_bam_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qup0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x17000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qhm_qup0 = {
 	.name = "qhm_qup0",
 	.id = SA8775P_MASTER_QUP_0,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qup0_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qup1_qos = {
+	.num_ports = 1,
+	.offsets = { 0x12000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qhm_qup1 = {
 	.name = "qhm_qup1",
 	.id = SA8775P_MASTER_QUP_1,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qup1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qup2_qos = {
+	.num_ports = 1,
+	.offsets = { 0x15000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qhm_qup2 = {
 	.name = "qhm_qup2",
 	.id = SA8775P_MASTER_QUP_2,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qup2_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qnm_cnoc_datapath_qos = {
+	.num_ports = 1,
+	.offsets = { 0x16000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qnm_cnoc_datapath = {
 	.name = "qnm_cnoc_datapath",
 	.id = SA8775P_MASTER_CNOC_A2NOC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_cnoc_datapath_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qxm_crypto_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x18000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qxm_crypto_0 = {
 	.name = "qxm_crypto_0",
 	.id = SA8775P_MASTER_CRYPTO_CORE0,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_crypto_0_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qxm_crypto_1_qos = {
+	.num_ports = 1,
+	.offsets = { 0x1a000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qxm_crypto_1 = {
 	.name = "qxm_crypto_1",
 	.id = SA8775P_MASTER_CRYPTO_CORE1,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_crypto_1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qxm_ipa_qos = {
+	.num_ports = 1,
+	.offsets = { 0x11000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qxm_ipa = {
 	.name = "qxm_ipa",
 	.id = SA8775P_MASTER_IPA,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_ipa_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_qdss_etr_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x13000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_qdss_etr_0 = {
 	.name = "xm_qdss_etr_0",
 	.id = SA8775P_MASTER_QDSS_ETR_0,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_qdss_etr_0_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_qdss_etr_1_qos = {
+	.num_ports = 1,
+	.offsets = { 0x19000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_qdss_etr_1 = {
 	.name = "xm_qdss_etr_1",
 	.id = SA8775P_MASTER_QDSS_ETR_1,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_qdss_etr_1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_ufs_card_qos = {
+	.num_ports = 1,
+	.offsets = { 0x1b000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_ufs_card = {
 	.name = "xm_ufs_card",
 	.id = SA8775P_MASTER_UFS_CARD,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_ufs_card_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_A2NOC_SNOC },
 };
@@ -529,33 +707,60 @@
 	},
 };
 
+static struct qcom_icc_qosbox alm_gpu_tcu_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb4000 },
+	.prio_fwd_disable = 1,
+	.prio = 1,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node alm_gpu_tcu = {
 	.name = "alm_gpu_tcu",
 	.id = SA8775P_MASTER_GPU_TCU,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &alm_gpu_tcu_qos,
 	.num_links = 2,
 	.links = { SA8775P_SLAVE_GEM_NOC_CNOC,
 		   SA8775P_SLAVE_LLCC
 	},
 };
 
+static struct qcom_icc_qosbox alm_pcie_tcu_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb5000 },
+	.prio_fwd_disable = 1,
+	.prio = 3,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node alm_pcie_tcu = {
 	.name = "alm_pcie_tcu",
 	.id = SA8775P_MASTER_PCIE_TCU,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &alm_pcie_tcu_qos,
 	.num_links = 2,
 	.links = { SA8775P_SLAVE_GEM_NOC_CNOC,
 		   SA8775P_SLAVE_LLCC
 	},
 };
 
+static struct qcom_icc_qosbox alm_sys_tcu_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb6000 },
+	.prio_fwd_disable = 1,
+	.prio = 6,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node alm_sys_tcu = {
 	.name = "alm_sys_tcu",
 	.id = SA8775P_MASTER_SYS_TCU,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &alm_sys_tcu_qos,
 	.num_links = 2,
 	.links = { SA8775P_SLAVE_GEM_NOC_CNOC,
 		   SA8775P_SLAVE_LLCC
@@ -574,22 +779,40 @@
 	},
 };
 
+static struct qcom_icc_qosbox qnm_cmpnoc0_qos = {
+	.num_ports = 2,
+	.offsets = { 0xf3000, 0xf4000 },
+	.prio_fwd_disable = 1,
+	.prio = 0,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qnm_cmpnoc0 = {
 	.name = "qnm_cmpnoc0",
 	.id = SA8775P_MASTER_COMPUTE_NOC,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_cmpnoc0_qos,
 	.num_links = 2,
 	.links = { SA8775P_SLAVE_GEM_NOC_CNOC,
 		   SA8775P_SLAVE_LLCC
 	},
 };
 
+static struct qcom_icc_qosbox qnm_cmpnoc1_qos = {
+	.num_ports = 2,
+	.offsets = { 0xf5000, 0xf6000 },
+	.prio_fwd_disable = 1,
+	.prio = 0,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qnm_cmpnoc1 = {
 	.name = "qnm_cmpnoc1",
 	.id = SA8775P_MASTER_COMPUTE_NOC_1,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_cmpnoc1_qos,
 	.num_links = 2,
 	.links = { SA8775P_SLAVE_GEM_NOC_CNOC,
 		   SA8775P_SLAVE_LLCC
@@ -620,33 +843,60 @@
 	},
 };
 
+static struct qcom_icc_qosbox qnm_gpu_qos = {
+	.num_ports = 2,
+	.offsets = { 0xed000, 0xee000 },
+	.prio_fwd_disable = 1,
+	.prio = 0,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qnm_gpu = {
 	.name = "qnm_gpu",
 	.id = SA8775P_MASTER_GFX3D,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_gpu_qos,
 	.num_links = 2,
 	.links = { SA8775P_SLAVE_GEM_NOC_CNOC,
 		   SA8775P_SLAVE_LLCC
 	},
 };
 
+static struct qcom_icc_qosbox qnm_mnoc_hf_qos = {
+	.num_ports = 2,
+	.offsets = { 0xef000, 0xf0000 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_mnoc_hf = {
 	.name = "qnm_mnoc_hf",
 	.id = SA8775P_MASTER_MNOC_HF_MEM_NOC,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_mnoc_hf_qos,
 	.num_links = 2,
 	.links = { SA8775P_SLAVE_LLCC,
 		   SA8775P_SLAVE_GEM_NOC_PCIE_CNOC
 	},
 };
 
+static struct qcom_icc_qosbox qnm_mnoc_sf_qos = {
+	.num_ports = 2,
+	.offsets = { 0xf1000, 0xf2000 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_mnoc_sf = {
 	.name = "qnm_mnoc_sf",
 	.id = SA8775P_MASTER_MNOC_SF_MEM_NOC,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_mnoc_sf_qos,
 	.num_links = 3,
 	.links = { SA8775P_SLAVE_GEM_NOC_CNOC,
 		   SA8775P_SLAVE_LLCC,
@@ -654,31 +904,58 @@
 	},
 };
 
+static struct qcom_icc_qosbox qnm_pcie_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb8000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qnm_pcie = {
 	.name = "qnm_pcie",
 	.id = SA8775P_MASTER_ANOC_PCIE_GEM_NOC,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_pcie_qos,
 	.num_links = 2,
 	.links = { SA8775P_SLAVE_GEM_NOC_CNOC,
 		   SA8775P_SLAVE_LLCC
 	},
 };
 
+static struct qcom_icc_qosbox qnm_snoc_gc_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb9000 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_snoc_gc = {
 	.name = "qnm_snoc_gc",
 	.id = SA8775P_MASTER_SNOC_GC_MEM_NOC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_snoc_gc_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_snoc_sf_qos = {
+	.num_ports = 1,
+	.offsets = { 0xba000 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_snoc_sf = {
 	.name = "qnm_snoc_sf",
 	.id = SA8775P_MASTER_SNOC_SF_MEM_NOC,
 	.channels = 1,
 	.buswidth = 16,
+	.qosbox = &qnm_snoc_sf_qos,
 	.num_links = 3,
 	.links = { SA8775P_SLAVE_GEM_NOC_CNOC,
 		   SA8775P_SLAVE_LLCC,
@@ -740,65 +1017,128 @@
 	.links = { SA8775P_SLAVE_EBI1 },
 };
 
+static struct qcom_icc_qosbox qnm_camnoc_hf_qos = {
+	.num_ports = 1,
+	.offsets = { 0xa000 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_camnoc_hf = {
 	.name = "qnm_camnoc_hf",
 	.id = SA8775P_MASTER_CAMNOC_HF,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_camnoc_hf_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_HF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_camnoc_icp_qos = {
+	.num_ports = 1,
+	.offsets = { 0x2a000 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_camnoc_icp = {
 	.name = "qnm_camnoc_icp",
 	.id = SA8775P_MASTER_CAMNOC_ICP,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_camnoc_icp_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_camnoc_sf_qos = {
+	.num_ports = 1,
+	.offsets = { 0x2a080 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_camnoc_sf = {
 	.name = "qnm_camnoc_sf",
 	.id = SA8775P_MASTER_CAMNOC_SF,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_camnoc_sf_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_mdp0_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0xa080 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_mdp0_0 = {
 	.name = "qnm_mdp0_0",
 	.id = SA8775P_MASTER_MDP0,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_mdp0_0_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_HF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_mdp0_1_qos = {
+	.num_ports = 1,
+	.offsets = { 0xa180 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_mdp0_1 = {
 	.name = "qnm_mdp0_1",
 	.id = SA8775P_MASTER_MDP1,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_mdp0_1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_HF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_mdp1_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0xa100 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_mdp1_0 = {
 	.name = "qnm_mdp1_0",
 	.id = SA8775P_MASTER_MDP_CORE1_0,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_mdp1_0_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_HF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_mdp1_1_qos = {
+	.num_ports = 1,
+	.offsets = { 0xa200 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_mdp1_1 = {
 	.name = "qnm_mdp1_1",
 	.id = SA8775P_MASTER_MDP_CORE1_1,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_mdp1_1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_HF_MEM_NOC },
 };
@@ -821,38 +1161,74 @@
 	.links = { SA8775P_SLAVE_SERVICE_MNOC_SF },
 };
 
+static struct qcom_icc_qosbox qnm_video0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x2a100 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_video0 = {
 	.name = "qnm_video0",
 	.id = SA8775P_MASTER_VIDEO_P0,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_video0_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_video1_qos = {
+	.num_ports = 1,
+	.offsets = { 0x2a180 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_video1 = {
 	.name = "qnm_video1",
 	.id = SA8775P_MASTER_VIDEO_P1,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_video1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_video_cvp_qos = {
+	.num_ports = 1,
+	.offsets = { 0x2a200 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_video_cvp = {
 	.name = "qnm_video_cvp",
 	.id = SA8775P_MASTER_VIDEO_PROC,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_video_cvp_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_video_v_cpu_qos = {
+	.num_ports = 1,
+	.offsets = { 0x2a280 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_video_v_cpu = {
 	.name = "qnm_video_v_cpu",
 	.id = SA8775P_MASTER_VIDEO_V_PROC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_video_v_cpu_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_MNOC_SF_MEM_NOC },
 };
@@ -893,29 +1269,56 @@
 	.links = { SA8775P_SLAVE_HCP_B, SLAVE_CDSPB_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox xm_pcie3_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_pcie3_0 = {
 	.name = "xm_pcie3_0",
 	.id = SA8775P_MASTER_PCIE_0,
 	.channels = 1,
 	.buswidth = 16,
+	.qosbox = &xm_pcie3_0_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_ANOC_PCIE_GEM_NOC },
 };
 
+static struct qcom_icc_qosbox xm_pcie3_1_qos = {
+	.num_ports = 1,
+	.offsets = { 0xc000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_pcie3_1 = {
 	.name = "xm_pcie3_1",
 	.id = SA8775P_MASTER_PCIE_1,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &xm_pcie3_1_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_ANOC_PCIE_GEM_NOC },
 };
 
+static struct qcom_icc_qosbox qhm_gic_qos = {
+	.num_ports = 1,
+	.offsets = { 0x14000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qhm_gic = {
 	.name = "qhm_gic",
 	.id = SA8775P_MASTER_GIC_AHB,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_gic_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_SNOC_GEM_NOC_SF },
 };
@@ -938,11 +1341,20 @@
 	.links = { SA8775P_SLAVE_SNOC_GEM_NOC_SF },
 };
 
+static struct qcom_icc_qosbox qnm_lpass_noc_qos = {
+	.num_ports = 1,
+	.offsets = { 0x12000 },
+	.prio_fwd_disable = 0,
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_lpass_noc = {
 	.name = "qnm_lpass_noc",
 	.id = SA8775P_MASTER_LPASS_ANOC,
 	.channels = 1,
 	.buswidth = 16,
+	.qosbox = &qnm_lpass_noc_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_SNOC_GEM_NOC_SF },
 };
@@ -956,20 +1368,38 @@
 	.links = { SA8775P_SLAVE_SERVICE_SNOC },
 };
 
+static struct qcom_icc_qosbox qxm_pimem_qos = {
+	.num_ports = 1,
+	.offsets = { 0x13000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qxm_pimem = {
 	.name = "qxm_pimem",
 	.id = SA8775P_MASTER_PIMEM,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_pimem_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_SNOC_GEM_NOC_GC },
 };
 
+static struct qcom_icc_qosbox xm_gic_qos = {
+	.num_ports = 1,
+	.offsets = { 0x15000 },
+	.prio_fwd_disable = 1,
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_gic = {
 	.name = "xm_gic",
 	.id = SA8775P_MASTER_GIC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_gic_qos,
 	.num_links = 1,
 	.links = { SA8775P_SLAVE_SNOC_GEM_NOC_GC },
 };
@@ -2109,6 +2539,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_aggre1_noc = {
+	.config = &icc_regmap_config,
 	.nodes = aggre1_noc_nodes,
 	.num_nodes = ARRAY_SIZE(aggre1_noc_nodes),
 	.bcms = aggre1_noc_bcms,
@@ -2136,6 +2567,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_aggre2_noc = {
+	.config = &icc_regmap_config,
 	.nodes = aggre2_noc_nodes,
 	.num_nodes = ARRAY_SIZE(aggre2_noc_nodes),
 	.bcms = aggre2_noc_bcms,
@@ -2265,6 +2697,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_config_noc = {
+	.config = &icc_regmap_config,
 	.nodes = config_noc_nodes,
 	.num_nodes = ARRAY_SIZE(config_noc_nodes),
 	.bcms = config_noc_bcms,
@@ -2281,6 +2714,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_dc_noc = {
+	.config = &icc_regmap_config,
 	.nodes = dc_noc_nodes,
 	.num_nodes = ARRAY_SIZE(dc_noc_nodes),
 	.bcms = dc_noc_bcms,
@@ -2317,6 +2751,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_gem_noc = {
+	.config = &icc_regmap_config,
 	.nodes = gem_noc_nodes,
 	.num_nodes = ARRAY_SIZE(gem_noc_nodes),
 	.bcms = gem_noc_bcms,
@@ -2335,6 +2770,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_gpdsp_anoc = {
+	.config = &icc_regmap_config,
 	.nodes = gpdsp_anoc_nodes,
 	.num_nodes = ARRAY_SIZE(gpdsp_anoc_nodes),
 	.bcms = gpdsp_anoc_bcms,
@@ -2358,6 +2794,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_lpass_ag_noc = {
+	.config = &icc_regmap_config,
 	.nodes = lpass_ag_noc_nodes,
 	.num_nodes = ARRAY_SIZE(lpass_ag_noc_nodes),
 	.bcms = lpass_ag_noc_bcms,
@@ -2407,6 +2844,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_mmss_noc = {
+	.config = &icc_regmap_config,
 	.nodes = mmss_noc_nodes,
 	.num_nodes = ARRAY_SIZE(mmss_noc_nodes),
 	.bcms = mmss_noc_bcms,
@@ -2427,6 +2865,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_nspa_noc = {
+	.config = &icc_regmap_config,
 	.nodes = nspa_noc_nodes,
 	.num_nodes = ARRAY_SIZE(nspa_noc_nodes),
 	.bcms = nspa_noc_bcms,
@@ -2447,6 +2886,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_nspb_noc = {
+	.config = &icc_regmap_config,
 	.nodes = nspb_noc_nodes,
 	.num_nodes = ARRAY_SIZE(nspb_noc_nodes),
 	.bcms = nspb_noc_bcms,
@@ -2464,6 +2904,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_pcie_anoc = {
+	.config = &icc_regmap_config,
 	.nodes = pcie_anoc_nodes,
 	.num_nodes = ARRAY_SIZE(pcie_anoc_nodes),
 	.bcms = pcie_anoc_bcms,
@@ -2492,6 +2933,7 @@
 };
 
 static const struct qcom_icc_desc sa8775p_system_noc = {
+	.config = &icc_regmap_config,
 	.nodes = system_noc_nodes,
 	.num_nodes = ARRAY_SIZE(system_noc_nodes),
 	.bcms = system_noc_bcms,
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/sc7280.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/sc7280.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
- *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/device.h>
@@ -16,29 +16,59 @@
 #include "icc-rpmh.h"
 #include "sc7280.h"
 
+static const struct regmap_config icc_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+};
+
+static struct qcom_icc_qosbox qhm_qspi_qos = {
+	.num_ports = 1,
+	.offsets = { 0x7000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qhm_qspi = {
 	.name = "qhm_qspi",
 	.id = SC7280_MASTER_QSPI_0,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qspi_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qup0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x11000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qhm_qup0 = {
 	.name = "qhm_qup0",
 	.id = SC7280_MASTER_QUP_0,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qup0_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qup1_qos = {
+	.num_ports = 1,
+	.offsets = { 0x8000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qhm_qup1 = {
 	.name = "qhm_qup1",
 	.id = SC7280_MASTER_QUP_1,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qup1_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A1NOC_SNOC },
 };
@@ -52,38 +82,70 @@
 	.links = { SC7280_SLAVE_SERVICE_A1NOC },
 };
 
+static struct qcom_icc_qosbox xm_sdc1_qos = {
+	.num_ports = 1,
+	.offsets = { 0xc000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_sdc1 = {
 	.name = "xm_sdc1",
 	.id = SC7280_MASTER_SDCC_1,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_sdc1_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_sdc2_qos = {
+	.num_ports = 1,
+	.offsets = { 0xe000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_sdc2 = {
 	.name = "xm_sdc2",
 	.id = SC7280_MASTER_SDCC_2,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_sdc2_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_sdc4_qos = {
+	.num_ports = 1,
+	.offsets = { 0x9000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_sdc4 = {
 	.name = "xm_sdc4",
 	.id = SC7280_MASTER_SDCC_4,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_sdc4_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_ufs_mem_qos = {
+	.num_ports = 1,
+	.offsets = { 0xa000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_ufs_mem = {
 	.name = "xm_ufs_mem",
 	.id = SC7280_MASTER_UFS_MEM,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_ufs_mem_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A1NOC_SNOC },
 };
@@ -97,20 +159,36 @@
 	.links = { SC7280_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_usb3_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_usb3_0 = {
 	.name = "xm_usb3_0",
 	.id = SC7280_MASTER_USB3_0,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_usb3_0_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qdss_bam_qos = {
+	.num_ports = 1,
+	.offsets = { 0x18000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qhm_qdss_bam = {
 	.name = "qhm_qdss_bam",
 	.id = SC7280_MASTER_QDSS_BAM,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qdss_bam_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A2NOC_SNOC },
 };
@@ -124,29 +202,53 @@
 	.links = { SC7280_SLAVE_SERVICE_A2NOC },
 };
 
+static struct qcom_icc_qosbox qnm_cnoc_datapath_qos = {
+	.num_ports = 1,
+	.offsets = { 0x1c000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qnm_cnoc_datapath = {
 	.name = "qnm_cnoc_datapath",
 	.id = SC7280_MASTER_CNOC_A2NOC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_cnoc_datapath_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qxm_crypto_qos = {
+	.num_ports = 1,
+	.offsets = { 0x1d000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qxm_crypto = {
 	.name = "qxm_crypto",
 	.id = SC7280_MASTER_CRYPTO,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_crypto_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qxm_ipa_qos = {
+	.num_ports = 1,
+	.offsets = { 0x10000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qxm_ipa = {
 	.name = "qxm_ipa",
 	.id = SC7280_MASTER_IPA,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_ipa_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A2NOC_SNOC },
 };
@@ -168,11 +270,19 @@
 	.links = { SC7280_SLAVE_ANOC_PCIE_GEM_NOC },
 };
 
+static struct qcom_icc_qosbox xm_qdss_etr_qos = {
+	.num_ports = 1,
+	.offsets = { 0x15000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_qdss_etr = {
 	.name = "xm_qdss_etr",
 	.id = SC7280_MASTER_QDSS_ETR,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_qdss_etr_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_A2NOC_SNOC },
 };
@@ -300,20 +410,36 @@
 	.links = { SC7280_SLAVE_LLCC_CFG, SC7280_SLAVE_GEM_NOC_CFG },
 };
 
+static struct qcom_icc_qosbox alm_gpu_tcu_qos = {
+	.num_ports = 1,
+	.offsets = { 0xd7000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node alm_gpu_tcu = {
 	.name = "alm_gpu_tcu",
 	.id = SC7280_MASTER_GPU_TCU,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &alm_gpu_tcu_qos,
 	.num_links = 2,
 	.links = { SC7280_SLAVE_GEM_NOC_CNOC, SC7280_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox alm_sys_tcu_qos = {
+	.num_ports = 1,
+	.offsets = { 0xd6000 },
+	.prio = 6,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node alm_sys_tcu = {
 	.name = "alm_sys_tcu",
 	.id = SC7280_MASTER_SYS_TCU,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &alm_sys_tcu_qos,
 	.num_links = 2,
 	.links = { SC7280_SLAVE_GEM_NOC_CNOC, SC7280_SLAVE_LLCC },
 };
@@ -328,11 +454,19 @@
 		   SC7280_SLAVE_MEM_NOC_PCIE_SNOC },
 };
 
+static struct qcom_icc_qosbox qnm_cmpnoc_qos = {
+	.num_ports = 2,
+	.offsets = { 0x21000, 0x61000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_cmpnoc = {
 	.name = "qnm_cmpnoc",
 	.id = SC7280_MASTER_COMPUTE_NOC,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_cmpnoc_qos,
 	.num_links = 2,
 	.links = { SC7280_SLAVE_GEM_NOC_CNOC, SC7280_SLAVE_LLCC },
 };
@@ -348,29 +482,53 @@
 		   SC7280_SLAVE_SERVICE_GEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_gpu_qos = {
+	.num_ports = 2,
+	.offsets = { 0x22000, 0x62000 },
+	.prio = 0,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qnm_gpu = {
 	.name = "qnm_gpu",
 	.id = SC7280_MASTER_GFX3D,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_gpu_qos,
 	.num_links = 2,
 	.links = { SC7280_SLAVE_GEM_NOC_CNOC, SC7280_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_mnoc_hf_qos = {
+	.num_ports = 2,
+	.offsets = { 0x23000, 0x63000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_mnoc_hf = {
 	.name = "qnm_mnoc_hf",
 	.id = SC7280_MASTER_MNOC_HF_MEM_NOC,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_mnoc_hf_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_mnoc_sf_qos = {
+	.num_ports = 1,
+	.offsets = { 0xcf000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_mnoc_sf = {
 	.name = "qnm_mnoc_sf",
 	.id = SC7280_MASTER_MNOC_SF_MEM_NOC,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_mnoc_sf_qos,
 	.num_links = 2,
 	.links = { SC7280_SLAVE_GEM_NOC_CNOC, SC7280_SLAVE_LLCC },
 };
@@ -384,20 +542,36 @@
 	.links = { SC7280_SLAVE_GEM_NOC_CNOC, SC7280_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_snoc_gc_qos = {
+	.num_ports = 1,
+	.offsets = { 0xd3000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_snoc_gc = {
 	.name = "qnm_snoc_gc",
 	.id = SC7280_MASTER_SNOC_GC_MEM_NOC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_snoc_gc_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_snoc_sf_qos = {
+	.num_ports = 1,
+	.offsets = { 0xd4000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_snoc_sf = {
 	.name = "qnm_snoc_sf",
 	.id = SC7280_MASTER_SNOC_SF_MEM_NOC,
 	.channels = 1,
 	.buswidth = 16,
+	.qosbox = &qnm_snoc_sf_qos,
 	.num_links = 3,
 	.links = { SC7280_SLAVE_GEM_NOC_CNOC, SC7280_SLAVE_LLCC,
 		   SC7280_SLAVE_MEM_NOC_PCIE_SNOC },
@@ -432,56 +606,104 @@
 	.links = { SC7280_SLAVE_SERVICE_MNOC },
 };
 
+static struct qcom_icc_qosbox qnm_video0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x14000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_video0 = {
 	.name = "qnm_video0",
 	.id = SC7280_MASTER_VIDEO_P0,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_video0_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_video_cpu_qos = {
+	.num_ports = 1,
+	.offsets = { 0x15000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qnm_video_cpu = {
 	.name = "qnm_video_cpu",
 	.id = SC7280_MASTER_VIDEO_PROC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_video_cpu_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qxm_camnoc_hf_qos = {
+	.num_ports = 2,
+	.offsets = { 0x10000, 0x10180 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qxm_camnoc_hf = {
 	.name = "qxm_camnoc_hf",
 	.id = SC7280_MASTER_CAMNOC_HF,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qxm_camnoc_hf_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_MNOC_HF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qxm_camnoc_icp_qos = {
+	.num_ports = 1,
+	.offsets = { 0x11000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qxm_camnoc_icp = {
 	.name = "qxm_camnoc_icp",
 	.id = SC7280_MASTER_CAMNOC_ICP,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_camnoc_icp_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qxm_camnoc_sf_qos = {
+	.num_ports = 1,
+	.offsets = { 0x12000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qxm_camnoc_sf = {
 	.name = "qxm_camnoc_sf",
 	.id = SC7280_MASTER_CAMNOC_SF,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qxm_camnoc_sf_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qxm_mdp0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x16000 },
+	.prio = 0,
+	.urg_fwd = 1,
+};
+
 static struct qcom_icc_node qxm_mdp0 = {
 	.name = "qxm_mdp0",
 	.id = SC7280_MASTER_MDP0,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qxm_mdp0_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_MNOC_HF_MEM_NOC },
 };
@@ -531,20 +753,36 @@
 	.links = { SC7280_SLAVE_SERVICE_SNOC },
 };
 
+static struct qcom_icc_qosbox qxm_pimem_qos = {
+	.num_ports = 1,
+	.offsets = { 0x8000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node qxm_pimem = {
 	.name = "qxm_pimem",
 	.id = SC7280_MASTER_PIMEM,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_pimem_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_SNOC_GEM_NOC_GC },
 };
 
+static struct qcom_icc_qosbox xm_gic_qos = {
+	.num_ports = 1,
+	.offsets = { 0xa000 },
+	.prio = 2,
+	.urg_fwd = 0,
+};
+
 static struct qcom_icc_node xm_gic = {
 	.name = "xm_gic",
 	.id = SC7280_MASTER_GIC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_gic_qos,
 	.num_links = 1,
 	.links = { SC7280_SLAVE_SNOC_GEM_NOC_GC },
 };
@@ -1503,6 +1741,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_aggre1_noc = {
+	.config = &icc_regmap_config,
 	.nodes = aggre1_noc_nodes,
 	.num_nodes = ARRAY_SIZE(aggre1_noc_nodes),
 	.bcms = aggre1_noc_bcms,
@@ -1525,6 +1764,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_aggre2_noc = {
+	.config = &icc_regmap_config,
 	.nodes = aggre2_noc_nodes,
 	.num_nodes = ARRAY_SIZE(aggre2_noc_nodes),
 	.bcms = aggre2_noc_bcms,
@@ -1606,6 +1846,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_cnoc2 = {
+	.config = &icc_regmap_config,
 	.nodes = cnoc2_nodes,
 	.num_nodes = ARRAY_SIZE(cnoc2_nodes),
 	.bcms = cnoc2_bcms,
@@ -1638,6 +1879,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_cnoc3 = {
+	.config = &icc_regmap_config,
 	.nodes = cnoc3_nodes,
 	.num_nodes = ARRAY_SIZE(cnoc3_nodes),
 	.bcms = cnoc3_bcms,
@@ -1654,6 +1896,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_dc_noc = {
+	.config = &icc_regmap_config,
 	.nodes = dc_noc_nodes,
 	.num_nodes = ARRAY_SIZE(dc_noc_nodes),
 	.bcms = dc_noc_bcms,
@@ -1690,6 +1933,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_gem_noc = {
+	.config = &icc_regmap_config,
 	.nodes = gem_noc_nodes,
 	.num_nodes = ARRAY_SIZE(gem_noc_nodes),
 	.bcms = gem_noc_bcms,
@@ -1710,6 +1954,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_lpass_ag_noc = {
+	.config = &icc_regmap_config,
 	.nodes = lpass_ag_noc_nodes,
 	.num_nodes = ARRAY_SIZE(lpass_ag_noc_nodes),
 	.bcms = lpass_ag_noc_bcms,
@@ -1727,6 +1972,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_mc_virt = {
+	.config = &icc_regmap_config,
 	.nodes = mc_virt_nodes,
 	.num_nodes = ARRAY_SIZE(mc_virt_nodes),
 	.bcms = mc_virt_bcms,
@@ -1754,6 +2000,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_mmss_noc = {
+	.config = &icc_regmap_config,
 	.nodes = mmss_noc_nodes,
 	.num_nodes = ARRAY_SIZE(mmss_noc_nodes),
 	.bcms = mmss_noc_bcms,
@@ -1773,6 +2020,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_nsp_noc = {
+	.config = &icc_regmap_config,
 	.nodes = nsp_noc_nodes,
 	.num_nodes = ARRAY_SIZE(nsp_noc_nodes),
 	.bcms = nsp_noc_bcms,
@@ -1798,6 +2046,7 @@
 };
 
 static const struct qcom_icc_desc sc7280_system_noc = {
+	.config = &icc_regmap_config,
 	.nodes = system_noc_nodes,
 	.num_nodes = ARRAY_SIZE(system_noc_nodes),
 	.bcms = system_noc_bcms,
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/sm8350.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/sm8350.c
@@ -1965,6 +1965,7 @@
 	.driver = {
 		.name = "qnoc-sm8350",
 		.of_match_table = qnoc_of_match,
+		.sync_state = icc_sync_state,
 	},
 };
 module_platform_driver(qnoc_driver);
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/sm8550.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/sm8550.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  * Copyright (c) 2022, Linaro Limited
  *
  */
@@ -20,83 +20,170 @@
 #include "icc-rpmh.h"
 #include "sm8550.h"
 
+static const struct regmap_config icc_regmap_config = {
+	.reg_bits = 32,
+	.reg_stride = 4,
+	.val_bits = 32,
+};
+
+static struct qcom_icc_qosbox qhm_qspi_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qhm_qspi = {
 	.name = "qhm_qspi",
 	.id = SM8550_MASTER_QSPI_0,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qspi_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qup1_qos = {
+	.num_ports = 1,
+	.offsets = { 0xc000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qhm_qup1 = {
 	.name = "qhm_qup1",
 	.id = SM8550_MASTER_QUP_1,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qup1_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_sdc4_qos = {
+	.num_ports = 1,
+	.offsets = { 0xd000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node xm_sdc4 = {
 	.name = "xm_sdc4",
 	.id = SM8550_MASTER_SDCC_4,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_sdc4_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_ufs_mem_qos = {
+	.num_ports = 1,
+	.offsets = { 0xe000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node xm_ufs_mem = {
 	.name = "xm_ufs_mem",
 	.id = SM8550_MASTER_UFS_MEM,
 	.channels = 1,
 	.buswidth = 16,
+	.qosbox = &xm_ufs_mem_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_usb3_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0xf000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node xm_usb3_0 = {
 	.name = "xm_usb3_0",
 	.id = SM8550_MASTER_USB3_0,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_usb3_0_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A1NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qdss_bam_qos = {
+	.num_ports = 1,
+	.offsets = { 0x12000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qhm_qdss_bam = {
 	.name = "qhm_qdss_bam",
 	.id = SM8550_MASTER_QDSS_BAM,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qdss_bam_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qhm_qup2_qos = {
+	.num_ports = 1,
+	.offsets = { 0x13000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qhm_qup2 = {
 	.name = "qhm_qup2",
 	.id = SM8550_MASTER_QUP_2,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_qup2_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qxm_crypto_qos = {
+	.num_ports = 1,
+	.offsets = { 0x15000 },
+	.prio = 2,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qxm_crypto = {
 	.name = "qxm_crypto",
 	.id = SM8550_MASTER_CRYPTO,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_crypto_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox qxm_ipa_qos = {
+	.num_ports = 1,
+	.offsets = { 0x16000 },
+	.prio = 2,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qxm_ipa = {
 	.name = "qxm_ipa",
 	.id = SM8550_MASTER_IPA,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qxm_ipa_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A2NOC_SNOC },
 };
@@ -110,29 +197,56 @@
 	.links = { SM8550_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_qdss_etr_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0x17000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node xm_qdss_etr_0 = {
 	.name = "xm_qdss_etr_0",
 	.id = SM8550_MASTER_QDSS_ETR,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_qdss_etr_0_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_qdss_etr_1_qos = {
+	.num_ports = 1,
+	.offsets = { 0x18000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node xm_qdss_etr_1 = {
 	.name = "xm_qdss_etr_1",
 	.id = SM8550_MASTER_QDSS_ETR_1,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_qdss_etr_1_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A2NOC_SNOC },
 };
 
+static struct qcom_icc_qosbox xm_sdc2_qos = {
+	.num_ports = 1,
+	.offsets = { 0x19000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node xm_sdc2 = {
 	.name = "xm_sdc2",
 	.id = SM8550_MASTER_SDCC_2,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_sdc2_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_A2NOC_SNOC },
 };
@@ -214,20 +328,38 @@
 	.links = { SM8550_SLAVE_PCIE_0, SM8550_SLAVE_PCIE_1 },
 };
 
+static struct qcom_icc_qosbox alm_gpu_tcu_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb1000 },
+	.prio = 1,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node alm_gpu_tcu = {
 	.name = "alm_gpu_tcu",
 	.id = SM8550_MASTER_GPU_TCU,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &alm_gpu_tcu_qos,
 	.num_links = 2,
 	.links = { SM8550_SLAVE_GEM_NOC_CNOC, SM8550_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox alm_sys_tcu_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb3000 },
+	.prio = 6,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node alm_sys_tcu = {
 	.name = "alm_sys_tcu",
 	.id = SM8550_MASTER_SYS_TCU,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &alm_sys_tcu_qos,
 	.num_links = 2,
 	.links = { SM8550_SLAVE_GEM_NOC_CNOC, SM8550_SLAVE_LLCC },
 };
@@ -242,20 +374,38 @@
 		   SM8550_SLAVE_MEM_NOC_PCIE_SNOC },
 };
 
+static struct qcom_icc_qosbox qnm_gpu_qos = {
+	.num_ports = 2,
+	.offsets = { 0x31000, 0x71000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qnm_gpu = {
 	.name = "qnm_gpu",
 	.id = SM8550_MASTER_GFX3D,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_gpu_qos,
 	.num_links = 2,
 	.links = { SM8550_SLAVE_GEM_NOC_CNOC, SM8550_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_lpass_gemnoc_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb5000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_lpass_gemnoc = {
 	.name = "qnm_lpass_gemnoc",
 	.id = SM8550_MASTER_LPASS_GEM_NOC,
 	.channels = 1,
 	.buswidth = 16,
+	.qosbox = &qnm_lpass_gemnoc_qos,
 	.num_links = 3,
 	.links = { SM8550_SLAVE_GEM_NOC_CNOC, SM8550_SLAVE_LLCC,
 		   SM8550_SLAVE_MEM_NOC_PCIE_SNOC },
@@ -271,56 +421,110 @@
 		   SM8550_SLAVE_MEM_NOC_PCIE_SNOC },
 };
 
+static struct qcom_icc_qosbox qnm_mnoc_hf_qos = {
+	.num_ports = 2,
+	.offsets = { 0x33000, 0x73000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_mnoc_hf = {
 	.name = "qnm_mnoc_hf",
 	.id = SM8550_MASTER_MNOC_HF_MEM_NOC,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_mnoc_hf_qos,
 	.num_links = 2,
 	.links = { SM8550_SLAVE_GEM_NOC_CNOC, SM8550_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_mnoc_sf_qos = {
+	.num_ports = 2,
+	.offsets = { 0x35000, 0x75000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_mnoc_sf = {
 	.name = "qnm_mnoc_sf",
 	.id = SM8550_MASTER_MNOC_SF_MEM_NOC,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_mnoc_sf_qos,
 	.num_links = 2,
 	.links = { SM8550_SLAVE_GEM_NOC_CNOC, SM8550_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_nsp_gemnoc_qos = {
+	.num_ports = 2,
+	.offsets = { 0x37000, 0x77000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qnm_nsp_gemnoc = {
 	.name = "qnm_nsp_gemnoc",
 	.id = SM8550_MASTER_COMPUTE_NOC,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_nsp_gemnoc_qos,
 	.num_links = 2,
 	.links = { SM8550_SLAVE_GEM_NOC_CNOC, SM8550_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_pcie_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb7000 },
+	.prio = 2,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_pcie = {
 	.name = "qnm_pcie",
 	.id = SM8550_MASTER_ANOC_PCIE_GEM_NOC,
 	.channels = 1,
 	.buswidth = 16,
+	.qosbox = &qnm_pcie_qos,
 	.num_links = 2,
 	.links = { SM8550_SLAVE_GEM_NOC_CNOC, SM8550_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_snoc_gc_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb9000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_snoc_gc = {
 	.name = "qnm_snoc_gc",
 	.id = SM8550_MASTER_SNOC_GC_MEM_NOC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_snoc_gc_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_LLCC },
 };
 
+static struct qcom_icc_qosbox qnm_snoc_sf_qos = {
+	.num_ports = 1,
+	.offsets = { 0xbb000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_snoc_sf = {
 	.name = "qnm_snoc_sf",
 	.id = SM8550_MASTER_SNOC_SF_MEM_NOC,
 	.channels = 1,
 	.buswidth = 16,
+	.qosbox = &qnm_snoc_sf_qos,
 	.num_links = 3,
 	.links = { SM8550_SLAVE_GEM_NOC_CNOC, SM8550_SLAVE_LLCC,
 		   SM8550_SLAVE_MEM_NOC_PCIE_SNOC },
@@ -362,38 +566,74 @@
 	.links = { SM8550_SLAVE_EBI1 },
 };
 
+static struct qcom_icc_qosbox qnm_camnoc_hf_qos = {
+	.num_ports = 2,
+	.offsets = { 0x28000, 0x29000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_camnoc_hf = {
 	.name = "qnm_camnoc_hf",
 	.id = SM8550_MASTER_CAMNOC_HF,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_camnoc_hf_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_MNOC_HF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_camnoc_icp_qos = {
+	.num_ports = 1,
+	.offsets = { 0x2a000 },
+	.prio = 4,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qnm_camnoc_icp = {
 	.name = "qnm_camnoc_icp",
 	.id = SM8550_MASTER_CAMNOC_ICP,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_camnoc_icp_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_camnoc_sf_qos = {
+	.num_ports = 2,
+	.offsets = { 0x2b000, 0x2c000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_camnoc_sf = {
 	.name = "qnm_camnoc_sf",
 	.id = SM8550_MASTER_CAMNOC_SF,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_camnoc_sf_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_mdp_qos = {
+	.num_ports = 2,
+	.offsets = { 0x2d000, 0x2e000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_mdp = {
 	.name = "qnm_mdp",
 	.id = SM8550_MASTER_MDP,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_mdp_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_MNOC_HF_MEM_NOC },
 };
@@ -407,38 +647,74 @@
 	.links = { SM8550_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_video_qos = {
+	.num_ports = 2,
+	.offsets = { 0x30000, 0x31000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_video = {
 	.name = "qnm_video",
 	.id = SM8550_MASTER_VIDEO,
 	.channels = 2,
 	.buswidth = 32,
+	.qosbox = &qnm_video_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_video_cv_cpu_qos = {
+	.num_ports = 1,
+	.offsets = { 0x32000 },
+	.prio = 4,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qnm_video_cv_cpu = {
 	.name = "qnm_video_cv_cpu",
 	.id = SM8550_MASTER_VIDEO_CV_PROC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_video_cv_cpu_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_video_cvp_qos = {
+	.num_ports = 1,
+	.offsets = { 0x33000 },
+	.prio = 0,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 0,
+};
+
 static struct qcom_icc_node qnm_video_cvp = {
 	.name = "qnm_video_cvp",
 	.id = SM8550_MASTER_VIDEO_PROC,
 	.channels = 1,
 	.buswidth = 32,
+	.qosbox = &qnm_video_cvp_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_MNOC_SF_MEM_NOC },
 };
 
+static struct qcom_icc_qosbox qnm_video_v_cpu_qos = {
+	.num_ports = 1,
+	.offsets = { 0x34000 },
+	.prio = 4,
+	.urg_fwd = 1,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qnm_video_v_cpu = {
 	.name = "qnm_video_v_cpu",
 	.id = SM8550_MASTER_VIDEO_V_PROC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &qnm_video_v_cpu_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_MNOC_SF_MEM_NOC },
 };
@@ -470,29 +746,56 @@
 	.links = { SM8550_SLAVE_SERVICE_PCIE_ANOC },
 };
 
+static struct qcom_icc_qosbox xm_pcie3_0_qos = {
+	.num_ports = 1,
+	.offsets = { 0xb000 },
+	.prio = 3,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node xm_pcie3_0 = {
 	.name = "xm_pcie3_0",
 	.id = SM8550_MASTER_PCIE_0,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_pcie3_0_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_ANOC_PCIE_GEM_NOC },
 };
 
+static struct qcom_icc_qosbox xm_pcie3_1_qos = {
+	.num_ports = 1,
+	.offsets = { 0xc000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node xm_pcie3_1 = {
 	.name = "xm_pcie3_1",
 	.id = SM8550_MASTER_PCIE_1,
 	.channels = 1,
 	.buswidth = 16,
+	.qosbox = &xm_pcie3_1_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_ANOC_PCIE_GEM_NOC },
 };
 
+static struct qcom_icc_qosbox qhm_gic_qos = {
+	.num_ports = 1,
+	.offsets = { 0x1c000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node qhm_gic = {
 	.name = "qhm_gic",
 	.id = SM8550_MASTER_GIC_AHB,
 	.channels = 1,
 	.buswidth = 4,
+	.qosbox = &qhm_gic_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_SNOC_GEM_NOC_SF },
 };
@@ -515,11 +818,20 @@
 	.links = { SM8550_SLAVE_SNOC_GEM_NOC_SF },
 };
 
+static struct qcom_icc_qosbox xm_gic_qos = {
+	.num_ports = 1,
+	.offsets = { 0x1d000 },
+	.prio = 2,
+	.urg_fwd = 0,
+	.prio_fwd_disable = 1,
+};
+
 static struct qcom_icc_node xm_gic = {
 	.name = "xm_gic",
 	.id = SM8550_MASTER_GIC,
 	.channels = 1,
 	.buswidth = 8,
+	.qosbox = &xm_gic_qos,
 	.num_links = 1,
 	.links = { SM8550_SLAVE_SNOC_GEM_NOC_GC },
 };
@@ -1476,6 +1788,7 @@
 static struct qcom_icc_bcm bcm_acv = {
 	.name = "ACV",
 	.enable_mask = 0x8,
+	.perf_mode_mask = 0x2,
 	.num_nodes = 1,
 	.nodes = { &ebi },
 };
@@ -1642,6 +1955,7 @@
 static struct qcom_icc_bcm bcm_acv_disp = {
 	.name = "ACV",
 	.enable_mask = 0x1,
+	.perf_mode_mask = 0x2,
 	.num_nodes = 1,
 	.nodes = { &ebi_disp },
 };
@@ -1807,6 +2121,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_aggre1_noc = {
+	.config = &icc_regmap_config,
 	.nodes = aggre1_noc_nodes,
 	.num_nodes = ARRAY_SIZE(aggre1_noc_nodes),
 	.bcms = aggre1_noc_bcms,
@@ -1830,6 +2145,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_aggre2_noc = {
+	.config = &icc_regmap_config,
 	.nodes = aggre2_noc_nodes,
 	.num_nodes = ARRAY_SIZE(aggre2_noc_nodes),
 	.bcms = aggre2_noc_bcms,
@@ -1852,6 +2168,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_clk_virt = {
+	.config = &icc_regmap_config,
 	.nodes = clk_virt_nodes,
 	.num_nodes = ARRAY_SIZE(clk_virt_nodes),
 	.bcms = clk_virt_bcms,
@@ -1912,6 +2229,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_config_noc = {
+	.config = &icc_regmap_config,
 	.nodes = config_noc_nodes,
 	.num_nodes = ARRAY_SIZE(config_noc_nodes),
 	.bcms = config_noc_bcms,
@@ -1936,6 +2254,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_cnoc_main = {
+	.config = &icc_regmap_config,
 	.nodes = cnoc_main_nodes,
 	.num_nodes = ARRAY_SIZE(cnoc_main_nodes),
 	.bcms = cnoc_main_bcms,
@@ -1989,6 +2308,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_gem_noc = {
+	.config = &icc_regmap_config,
 	.nodes = gem_noc_nodes,
 	.num_nodes = ARRAY_SIZE(gem_noc_nodes),
 	.bcms = gem_noc_bcms,
@@ -2004,6 +2324,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_lpass_ag_noc = {
+	.config = &icc_regmap_config,
 	.nodes = lpass_ag_noc_nodes,
 	.num_nodes = ARRAY_SIZE(lpass_ag_noc_nodes),
 	.bcms = lpass_ag_noc_bcms,
@@ -2020,6 +2341,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_lpass_lpiaon_noc = {
+	.config = &icc_regmap_config,
 	.nodes = lpass_lpiaon_noc_nodes,
 	.num_nodes = ARRAY_SIZE(lpass_lpiaon_noc_nodes),
 	.bcms = lpass_lpiaon_noc_bcms,
@@ -2035,6 +2357,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_lpass_lpicx_noc = {
+	.config = &icc_regmap_config,
 	.nodes = lpass_lpicx_noc_nodes,
 	.num_nodes = ARRAY_SIZE(lpass_lpicx_noc_nodes),
 	.bcms = lpass_lpicx_noc_bcms,
@@ -2068,6 +2391,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_mc_virt = {
+	.config = &icc_regmap_config,
 	.nodes = mc_virt_nodes,
 	.num_nodes = ARRAY_SIZE(mc_virt_nodes),
 	.bcms = mc_virt_bcms,
@@ -2120,6 +2444,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_mmss_noc = {
+	.config = &icc_regmap_config,
 	.nodes = mmss_noc_nodes,
 	.num_nodes = ARRAY_SIZE(mmss_noc_nodes),
 	.bcms = mmss_noc_bcms,
@@ -2136,6 +2461,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_nsp_noc = {
+	.config = &icc_regmap_config,
 	.nodes = nsp_noc_nodes,
 	.num_nodes = ARRAY_SIZE(nsp_noc_nodes),
 	.bcms = nsp_noc_bcms,
@@ -2155,6 +2481,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_pcie_anoc = {
+	.config = &icc_regmap_config,
 	.nodes = pcie_anoc_nodes,
 	.num_nodes = ARRAY_SIZE(pcie_anoc_nodes),
 	.bcms = pcie_anoc_bcms,
@@ -2178,6 +2505,7 @@
 };
 
 static const struct qcom_icc_desc sm8550_system_noc = {
+	.config = &icc_regmap_config,
 	.nodes = system_noc_nodes,
 	.num_nodes = ARRAY_SIZE(system_noc_nodes),
 	.bcms = system_noc_bcms,
--- linux-qcom-6.8.0.orig/drivers/interconnect/qcom/x1e80100.c
+++ linux-qcom-6.8.0/drivers/interconnect/qcom/x1e80100.c
@@ -116,15 +116,6 @@
 	.links = { X1E80100_SLAVE_A2NOC_SNOC },
 };
 
-static struct qcom_icc_node ddr_perf_mode_master = {
-	.name = "ddr_perf_mode_master",
-	.id = X1E80100_MASTER_DDR_PERF_MODE,
-	.channels = 1,
-	.buswidth = 4,
-	.num_links = 1,
-	.links = { X1E80100_SLAVE_DDR_PERF_MODE },
-};
-
 static struct qcom_icc_node qup0_core_master = {
 	.name = "qup0_core_master",
 	.id = X1E80100_MASTER_QUP_CORE_0,
@@ -832,14 +823,6 @@
 	.links = { X1E80100_MASTER_A2NOC_SNOC },
 };
 
-static struct qcom_icc_node ddr_perf_mode_slave = {
-	.name = "ddr_perf_mode_slave",
-	.id = X1E80100_SLAVE_DDR_PERF_MODE,
-	.channels = 1,
-	.buswidth = 4,
-	.num_links = 0,
-};
-
 static struct qcom_icc_node qup0_core_slave = {
 	.name = "qup0_core_slave",
 	.id = X1E80100_SLAVE_QUP_CORE_0,
@@ -1591,12 +1574,6 @@
 	.nodes = { &ebi },
 };
 
-static struct qcom_icc_bcm bcm_acv_perf = {
-	.name = "ACV_PERF",
-	.num_nodes = 1,
-	.nodes = { &ddr_perf_mode_slave },
-};
-
 static struct qcom_icc_bcm bcm_ce0 = {
 	.name = "CE0",
 	.num_nodes = 1,
@@ -1863,18 +1840,15 @@
 };
 
 static struct qcom_icc_bcm * const clk_virt_bcms[] = {
-	&bcm_acv_perf,
 	&bcm_qup0,
 	&bcm_qup1,
 	&bcm_qup2,
 };
 
 static struct qcom_icc_node * const clk_virt_nodes[] = {
-	[MASTER_DDR_PERF_MODE] = &ddr_perf_mode_master,
 	[MASTER_QUP_CORE_0] = &qup0_core_master,
 	[MASTER_QUP_CORE_1] = &qup1_core_master,
 	[MASTER_QUP_CORE_2] = &qup2_core_master,
-	[SLAVE_DDR_PERF_MODE] = &ddr_perf_mode_slave,
 	[SLAVE_QUP_CORE_0] = &qup0_core_slave,
 	[SLAVE_QUP_CORE_1] = &qup1_core_slave,
 	[SLAVE_QUP_CORE_2] = &qup2_core_slave,
--- linux-qcom-6.8.0.orig/drivers/iommu/Kconfig
+++ linux-qcom-6.8.0/drivers/iommu/Kconfig
@@ -196,7 +196,7 @@
 config IRQ_REMAP
 	bool "Support for Interrupt Remapping"
 	depends on X86_64 && X86_IO_APIC && PCI_MSI && ACPI
-	select DMAR_TABLE
+	select DMAR_TABLE if INTEL_IOMMU
 	help
 	  Supports Interrupt remapping for IO-APIC and MSI devices.
 	  To use x2apic mode in the CPU's which support x2APIC enhancements or
@@ -371,6 +371,15 @@
 	  When running on a Qualcomm platform that has the custom variant
 	  of the ARM SMMU, this needs to be built into the SMMU driver.
 
+config ARM_SMMU_QCOM_TBU
+	bool "Qualcomm Technologies, Inc. TBU driver"
+	depends on ARM_SMMU_QCOM
+	help
+	  The SMMU on Qualcomm Technologies, Inc. platform may include a
+	  Translation Buffer Units (TBUs) for each master. Enabling support
+	  for these will allow operating the TBUs to help debugging context
+	  faults.
+
 config ARM_SMMU_QCOM_DEBUG
 	bool "ARM SMMU QCOM implementation defined debug support"
 	depends on ARM_SMMU_QCOM
--- linux-qcom-6.8.0.orig/drivers/iommu/amd/amd_iommu_types.h
+++ linux-qcom-6.8.0/drivers/iommu/amd/amd_iommu_types.h
@@ -549,6 +549,11 @@
 	u64			*pgd;		/* v2 pgtable pgd pointer */
 };
 
+enum protection_domain_mode {
+	PD_MODE_V1 = 1,
+	PD_MODE_V2,
+};
+
 /*
  * This structure contains generic data for  IOMMU protection domains
  * independent of their use.
@@ -564,6 +569,7 @@
 	int nid;		/* Node ID */
 	u64 *gcr3_tbl;		/* Guest CR3 table */
 	unsigned long flags;	/* flags to find out type of domain */
+	enum protection_domain_mode pd_mode; /* Track page table type */
 	bool dirty_tracking;	/* dirty tracking is enabled in the domain */
 	unsigned dev_cnt;	/* devices assigned to this domain */
 	unsigned dev_iommu[MAX_IOMMUS]; /* per-IOMMU reference count */
--- linux-qcom-6.8.0.orig/drivers/iommu/amd/init.c
+++ linux-qcom-6.8.0/drivers/iommu/amd/init.c
@@ -1677,8 +1677,17 @@
 	}
 }
 
+static void __init free_sysfs(struct amd_iommu *iommu)
+{
+	if (iommu->iommu.dev) {
+		iommu_device_unregister(&iommu->iommu);
+		iommu_device_sysfs_remove(&iommu->iommu);
+	}
+}
+
 static void __init free_iommu_one(struct amd_iommu *iommu)
 {
+	free_sysfs(iommu);
 	free_cwwb_sem(iommu);
 	free_command_buffer(iommu);
 	free_event_buffer(iommu);
@@ -2068,6 +2077,9 @@
 	/* Prevent binding other PCI device drivers to IOMMU devices */
 	iommu->dev->match_driver = false;
 
+	/* ACPI _PRT won't have an IRQ for IOMMU */
+	iommu->dev->irq_managed = 1;
+
 	pci_read_config_dword(iommu->dev, cap_ptr + MMIO_CAP_HDR_OFFSET,
 			      &iommu->cap);
 
@@ -2769,6 +2781,7 @@
 	iommu_enable_command_buffer(iommu);
 	iommu_enable_event_buffer(iommu);
 	iommu_set_exclusion_range(iommu);
+	iommu_enable_gt(iommu);
 	iommu_enable_ga(iommu);
 	iommu_enable_xt(iommu);
 	iommu_enable_irtcachedis(iommu);
--- linux-qcom-6.8.0.orig/drivers/iommu/amd/io_pgtable.c
+++ linux-qcom-6.8.0/drivers/iommu/amd/io_pgtable.c
@@ -573,23 +573,24 @@
 	       pgtable->mode > PAGE_MODE_6_LEVEL);
 
 	free_sub_pt(pgtable->root, pgtable->mode, &freelist);
+	put_pages_list(&freelist);
 
 	/* Update data structure */
 	amd_iommu_domain_clr_pt_root(dom);
-
-	/* Make changes visible to IOMMUs */
-	amd_iommu_domain_update(dom);
-
-	put_pages_list(&freelist);
 }
 
 static struct io_pgtable *v1_alloc_pgtable(struct io_pgtable_cfg *cfg, void *cookie)
 {
 	struct amd_io_pgtable *pgtable = io_pgtable_cfg_to_data(cfg);
 
-	cfg->pgsize_bitmap  = AMD_IOMMU_PGSIZES,
-	cfg->ias            = IOMMU_IN_ADDR_BIT_SIZE,
-	cfg->oas            = IOMMU_OUT_ADDR_BIT_SIZE,
+	pgtable->root = (void *) get_zeroed_page(GFP_KERNEL);
+	if (!pgtable->root)
+		return NULL;
+	pgtable->mode = PAGE_MODE_3_LEVEL;
+
+	cfg->pgsize_bitmap  = AMD_IOMMU_PGSIZES;
+	cfg->ias            = IOMMU_IN_ADDR_BIT_SIZE;
+	cfg->oas            = IOMMU_OUT_ADDR_BIT_SIZE;
 	cfg->tlb            = &v1_flush_ops;
 
 	pgtable->iop.ops.map_pages    = iommu_v1_map_pages;
--- linux-qcom-6.8.0.orig/drivers/iommu/amd/io_pgtable_v2.c
+++ linux-qcom-6.8.0/drivers/iommu/amd/io_pgtable_v2.c
@@ -50,7 +50,7 @@
 	u64 prot;
 
 	prot = IOMMU_PAGE_PRESENT | IOMMU_PAGE_RW | IOMMU_PAGE_USER;
-	prot |= IOMMU_PAGE_ACCESS | IOMMU_PAGE_DIRTY;
+	prot |= IOMMU_PAGE_ACCESS;
 
 	return (iommu_virt_to_phys(page) | prot);
 }
@@ -270,8 +270,13 @@
 	}
 
 out:
-	if (updated)
+	if (updated) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&pdom->lock, flags);
 		amd_iommu_domain_flush_pages(pdom, o_iova, size);
+		spin_unlock_irqrestore(&pdom->lock, flags);
+	}
 
 	if (mapped)
 		*mapped += mapped_size;
@@ -374,7 +379,7 @@
 	int ret;
 	int ias = IOMMU_IN_ADDR_BIT_SIZE;
 
-	pgtable->pgd = alloc_pgtable_page(pdom->nid, GFP_ATOMIC);
+	pgtable->pgd = alloc_pgtable_page(pdom->nid, GFP_KERNEL);
 	if (!pgtable->pgd)
 		return NULL;
 
--- linux-qcom-6.8.0.orig/drivers/iommu/amd/iommu.c
+++ linux-qcom-6.8.0/drivers/iommu/amd/iommu.c
@@ -55,8 +55,6 @@
 #define HT_RANGE_START		(0xfd00000000ULL)
 #define HT_RANGE_END		(0xffffffffffULL)
 
-#define DEFAULT_PGTABLE_LEVEL	PAGE_MODE_3_LEVEL
-
 static DEFINE_SPINLOCK(pd_bitmap_lock);
 
 LIST_HEAD(ioapic_map);
@@ -2067,56 +2065,25 @@
 	if (!domain)
 		return;
 
+	WARN_ON(!list_empty(&domain->dev_list));
+
 	if (domain->iop.pgtbl_cfg.tlb)
 		free_io_pgtable_ops(&domain->iop.iop.ops);
 
 	if (domain->flags & PD_IOMMUV2_MASK)
 		free_gcr3_table(domain);
 
-	if (domain->iop.root)
-		free_page((unsigned long)domain->iop.root);
-
 	if (domain->id)
 		domain_id_free(domain->id);
 
 	kfree(domain);
 }
 
-static int protection_domain_init_v1(struct protection_domain *domain, int mode)
-{
-	u64 *pt_root = NULL;
-
-	BUG_ON(mode < PAGE_MODE_NONE || mode > PAGE_MODE_6_LEVEL);
-
-	if (mode != PAGE_MODE_NONE) {
-		pt_root = (void *)get_zeroed_page(GFP_KERNEL);
-		if (!pt_root)
-			return -ENOMEM;
-	}
-
-	amd_iommu_domain_set_pgtable(domain, pt_root, mode);
-
-	return 0;
-}
-
-static int protection_domain_init_v2(struct protection_domain *domain)
-{
-	domain->flags |= PD_GIOV_MASK;
-
-	domain->domain.pgsize_bitmap = AMD_IOMMU_PGSIZES_V2;
-
-	if (setup_gcr3_table(domain, 1))
-		return -ENOMEM;
-
-	return 0;
-}
-
 static struct protection_domain *protection_domain_alloc(unsigned int type)
 {
 	struct io_pgtable_ops *pgtbl_ops;
 	struct protection_domain *domain;
 	int pgtable;
-	int ret;
 
 	domain = kzalloc(sizeof(*domain), GFP_KERNEL);
 	if (!domain)
@@ -2150,18 +2117,18 @@
 
 	switch (pgtable) {
 	case AMD_IOMMU_V1:
-		ret = protection_domain_init_v1(domain, DEFAULT_PGTABLE_LEVEL);
+		domain->pd_mode = PD_MODE_V1;
 		break;
 	case AMD_IOMMU_V2:
-		ret = protection_domain_init_v2(domain);
+		domain->flags |= PD_GIOV_MASK;
+		domain->pd_mode = PD_MODE_V2;
+
+		if (setup_gcr3_table(domain, 1))
+			goto out_err;
 		break;
 	default:
-		ret = -EINVAL;
-		break;
-	}
-
-	if (ret)
 		goto out_err;
+	}
 
 	pgtbl_ops = alloc_io_pgtable_ops(pgtable, &domain->iop.pgtbl_cfg, domain);
 	if (!pgtbl_ops)
@@ -2217,10 +2184,10 @@
 	domain->domain.geometry.aperture_start = 0;
 	domain->domain.geometry.aperture_end   = dma_max_address();
 	domain->domain.geometry.force_aperture = true;
+	domain->domain.pgsize_bitmap = domain->iop.iop.cfg.pgsize_bitmap;
 
 	if (iommu) {
 		domain->domain.type = type;
-		domain->domain.pgsize_bitmap = iommu->iommu.ops->pgsize_bitmap;
 		domain->domain.ops = iommu->iommu.ops->default_domain_ops;
 
 		if (dirty_tracking)
@@ -2593,6 +2560,10 @@
 	if (!dev_data)
 		return 0;
 
+	/* Always use DMA domain for untrusted device */
+	if (dev_is_pci(dev) && to_pci_dev(dev)->untrusted)
+		return IOMMU_DOMAIN_DMA;
+
 	/*
 	 * Do not identity map IOMMUv2 capable devices when:
 	 *  - memory encryption is active, because some of those devices
@@ -2630,7 +2601,6 @@
 	.device_group = amd_iommu_device_group,
 	.get_resv_regions = amd_iommu_get_resv_regions,
 	.is_attach_deferred = amd_iommu_is_attach_deferred,
-	.pgsize_bitmap	= AMD_IOMMU_PGSIZES,
 	.def_domain_type = amd_iommu_def_domain_type,
 	.default_domain_ops = &(const struct iommu_domain_ops) {
 		.attach_dev	= amd_iommu_attach_device,
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c
@@ -575,6 +575,9 @@
 	int ret = 0;
 	struct mm_struct *mm = domain->mm;
 
+	if (mm_get_enqcmd_pasid(mm) != id)
+		return -EINVAL;
+
 	mutex_lock(&sva_lock);
 	ret = __arm_smmu_sva_bind(dev, id, mm);
 	mutex_unlock(&sva_lock);
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -999,8 +999,8 @@
 {
 	size_t size = CTXDESC_L2_ENTRIES * (CTXDESC_CD_DWORDS << 3);
 
-	l1_desc->l2ptr = dmam_alloc_coherent(smmu->dev, size,
-					     &l1_desc->l2ptr_dma, GFP_KERNEL);
+	l1_desc->l2ptr = dma_alloc_coherent(smmu->dev, size,
+					    &l1_desc->l2ptr_dma, GFP_KERNEL);
 	if (!l1_desc->l2ptr) {
 		dev_warn(smmu->dev,
 			 "failed to allocate context descriptor table\n");
@@ -1151,17 +1151,17 @@
 		cd_table->num_l1_ents = DIV_ROUND_UP(max_contexts,
 						  CTXDESC_L2_ENTRIES);
 
-		cd_table->l1_desc = devm_kcalloc(smmu->dev, cd_table->num_l1_ents,
-					      sizeof(*cd_table->l1_desc),
-					      GFP_KERNEL);
+		cd_table->l1_desc = kcalloc(cd_table->num_l1_ents,
+					    sizeof(*cd_table->l1_desc),
+					    GFP_KERNEL);
 		if (!cd_table->l1_desc)
 			return -ENOMEM;
 
 		l1size = cd_table->num_l1_ents * (CTXDESC_L1_DESC_DWORDS << 3);
 	}
 
-	cd_table->cdtab = dmam_alloc_coherent(smmu->dev, l1size, &cd_table->cdtab_dma,
-					   GFP_KERNEL);
+	cd_table->cdtab = dma_alloc_coherent(smmu->dev, l1size,
+					     &cd_table->cdtab_dma, GFP_KERNEL);
 	if (!cd_table->cdtab) {
 		dev_warn(smmu->dev, "failed to allocate context descriptor\n");
 		ret = -ENOMEM;
@@ -1172,7 +1172,7 @@
 
 err_free_l1:
 	if (cd_table->l1_desc) {
-		devm_kfree(smmu->dev, cd_table->l1_desc);
+		kfree(cd_table->l1_desc);
 		cd_table->l1_desc = NULL;
 	}
 	return ret;
@@ -1192,21 +1192,18 @@
 			if (!cd_table->l1_desc[i].l2ptr)
 				continue;
 
-			dmam_free_coherent(smmu->dev, size,
-					   cd_table->l1_desc[i].l2ptr,
-					   cd_table->l1_desc[i].l2ptr_dma);
+			dma_free_coherent(smmu->dev, size,
+					  cd_table->l1_desc[i].l2ptr,
+					  cd_table->l1_desc[i].l2ptr_dma);
 		}
-		devm_kfree(smmu->dev, cd_table->l1_desc);
-		cd_table->l1_desc = NULL;
+		kfree(cd_table->l1_desc);
 
 		l1size = cd_table->num_l1_ents * (CTXDESC_L1_DESC_DWORDS << 3);
 	} else {
 		l1size = cd_table->num_l1_ents * (CTXDESC_CD_DWORDS << 3);
 	}
 
-	dmam_free_coherent(smmu->dev, l1size, cd_table->cdtab, cd_table->cdtab_dma);
-	cd_table->cdtab_dma = 0;
-	cd_table->cdtab = NULL;
+	dma_free_coherent(smmu->dev, l1size, cd_table->cdtab, cd_table->cdtab_dma);
 }
 
 bool arm_smmu_free_asid(struct arm_smmu_ctx_desc *cd)
@@ -2398,8 +2395,6 @@
 		return -EBUSY;
 	}
 
-	arm_smmu_detach_dev(master);
-
 	mutex_lock(&smmu_domain->init_mutex);
 
 	if (!smmu_domain->smmu) {
@@ -2414,6 +2409,16 @@
 	if (ret)
 		return ret;
 
+	/*
+	 * Prevent arm_smmu_share_asid() from trying to change the ASID
+	 * of either the old or new domain while we are working on it.
+	 * This allows the STE and the smmu_domain->devices list to
+	 * be inconsistent during this routine.
+	 */
+	mutex_lock(&arm_smmu_asid_lock);
+
+	arm_smmu_detach_dev(master);
+
 	master->domain = smmu_domain;
 
 	/*
@@ -2439,13 +2444,7 @@
 			}
 		}
 
-		/*
-		 * Prevent SVA from concurrently modifying the CD or writing to
-		 * the CD entry
-		 */
-		mutex_lock(&arm_smmu_asid_lock);
 		ret = arm_smmu_write_ctx_desc(master, IOMMU_NO_PASID, &smmu_domain->cd);
-		mutex_unlock(&arm_smmu_asid_lock);
 		if (ret) {
 			master->domain = NULL;
 			goto out_list_del;
@@ -2455,13 +2454,15 @@
 	arm_smmu_install_ste_for_dev(master);
 
 	arm_smmu_enable_ats(master);
-	return 0;
+	goto out_unlock;
 
 out_list_del:
 	spin_lock_irqsave(&smmu_domain->devices_lock, flags);
 	list_del(&master->domain_head);
 	spin_unlock_irqrestore(&smmu_domain->devices_lock, flags);
 
+out_unlock:
+	mutex_unlock(&arm_smmu_asid_lock);
 	return ret;
 }
 
@@ -3177,7 +3178,7 @@
 	smmu->priq.q.irq = msi_get_virq(dev, PRIQ_MSI_INDEX);
 
 	/* Add callback to free MSIs on teardown */
-	devm_add_action(dev, arm_smmu_free_msis, dev);
+	devm_add_action_or_reset(dev, arm_smmu_free_msis, dev);
 }
 
 static void arm_smmu_setup_unique_irqs(struct arm_smmu_device *smmu)
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu/Makefile
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu/Makefile
@@ -3,4 +3,5 @@
 obj-$(CONFIG_ARM_SMMU) += arm_smmu.o
 arm_smmu-objs += arm-smmu.o arm-smmu-impl.o arm-smmu-nvidia.o
 arm_smmu-$(CONFIG_ARM_SMMU_QCOM) += arm-smmu-qcom.o
+arm_smmu-$(CONFIG_ARM_SMMU_QCOM_TBU) += arm-smmu-qcom-tbu.o
 arm_smmu-$(CONFIG_ARM_SMMU_QCOM_DEBUG) += arm-smmu-qcom-debug.o
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu/arm-smmu-impl.c
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu/arm-smmu-impl.c
@@ -130,7 +130,7 @@
 
 	/*
 	 * Disable MMU-500's not-particularly-beneficial next-page
-	 * prefetcher for the sake of errata #841119 and #826419.
+	 * prefetcher for the sake of at least 5 known errata.
 	 */
 	for (i = 0; i < smmu->num_context_banks; ++i) {
 		reg = arm_smmu_cb_read(smmu, i, ARM_SMMU_CB_ACTLR);
@@ -138,7 +138,7 @@
 		arm_smmu_cb_write(smmu, i, ARM_SMMU_CB_ACTLR, reg);
 		reg = arm_smmu_cb_read(smmu, i, ARM_SMMU_CB_ACTLR);
 		if (reg & ARM_MMU500_ACTLR_CPRE)
-			dev_warn_once(smmu->dev, "Failed to disable prefetcher [errata #841119 and #826419], check ACR.CACHE_LOCK\n");
+			dev_warn_once(smmu->dev, "Failed to disable prefetcher for errata workarounds, check SACR.CACHE_LOCK\n");
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c
@@ -221,11 +221,9 @@
 	unsigned int inst;
 	irqreturn_t ret = IRQ_NONE;
 	struct arm_smmu_device *smmu;
-	struct iommu_domain *domain = dev;
-	struct arm_smmu_domain *smmu_domain;
+	struct arm_smmu_domain *smmu_domain = dev;
 	struct nvidia_smmu *nvidia;
 
-	smmu_domain = container_of(domain, struct arm_smmu_domain, domain);
 	smmu = smmu_domain->smmu;
 	nvidia = to_nvidia_smmu(smmu);
 
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu/arm-smmu-qcom-debug.c
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu/arm-smmu-qcom-debug.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022,2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/device.h>
@@ -22,7 +22,7 @@
 	if (__ratelimit(&rs)) {
 		dev_err(smmu->dev, "TLB sync timed out -- SMMU may be deadlocked\n");
 
-		cfg = qsmmu->cfg;
+		cfg = qsmmu->data->cfg;
 		if (!cfg)
 			return;
 
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu/arm-smmu-qcom-tbu.c
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu/arm-smmu-qcom-tbu.c
@@ -0,0 +1,507 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/interconnect.h>
+#include <linux/iopoll.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+
+#include "arm-smmu.h"
+#include "arm-smmu-qcom.h"
+
+#define TBU_DBG_TIMEOUT_US		100
+#define DEBUG_AXUSER_REG		0x30
+#define DEBUG_AXUSER_CDMID		GENMASK_ULL(43, 36)
+#define DEBUG_AXUSER_CDMID_VAL		0xff
+#define DEBUG_PAR_REG			0x28
+#define DEBUG_PAR_FAULT_VAL		BIT(0)
+#define DEBUG_PAR_PA			GENMASK_ULL(47, 12)
+#define DEBUG_SID_HALT_REG		0x0
+#define DEBUG_SID_HALT_VAL		BIT(16)
+#define DEBUG_SID_HALT_SID		GENMASK(9, 0)
+#define DEBUG_SR_HALT_ACK_REG		0x20
+#define DEBUG_SR_HALT_ACK_VAL		BIT(1)
+#define DEBUG_SR_ECATS_RUNNING_VAL	BIT(0)
+#define DEBUG_TXN_AXCACHE		GENMASK(5, 2)
+#define DEBUG_TXN_AXPROT		GENMASK(8, 6)
+#define DEBUG_TXN_AXPROT_PRIV		0x1
+#define DEBUG_TXN_AXPROT_NSEC		0x2
+#define DEBUG_TXN_TRIGG_REG		0x18
+#define DEBUG_TXN_TRIGGER		BIT(0)
+#define DEBUG_VA_ADDR_REG		0x8
+
+struct qsmmuv500_tbu {
+	struct device *dev;
+	struct arm_smmu_device *smmu;
+	u32 sid_range[2];
+	struct list_head list;
+	struct clk *clk;
+	struct icc_path	*path;
+	void __iomem *base;
+	spinlock_t halt_lock; /* multiple halt or resume can't execute concurrently */
+	int halt_count;
+};
+
+static DEFINE_SPINLOCK(atos_lock);
+
+static struct qcom_smmu *to_qcom_smmu(struct arm_smmu_device *smmu)
+{
+	return container_of(smmu, struct qcom_smmu, smmu);
+}
+
+static struct arm_smmu_domain *to_smmu_domain(struct iommu_domain *dom)
+{
+	return container_of(dom, struct arm_smmu_domain, domain);
+}
+
+static struct qsmmuv500_tbu *qsmmuv500_find_tbu(struct qcom_smmu *qsmmu, u32 sid)
+{
+	struct qsmmuv500_tbu *tbu = NULL;
+	u32 start, end;
+
+	mutex_lock(&qsmmu->tbu_list_lock);
+
+	if (!list_empty(&qsmmu->tbu_list)) {
+		list_for_each_entry(tbu, &qsmmu->tbu_list, list) {
+			start = tbu->sid_range[0];
+			end = start + tbu->sid_range[1];
+
+			if (start <= sid && sid < end)
+				break;
+		}
+	}
+
+	mutex_unlock(&qsmmu->tbu_list_lock);
+
+	return tbu;
+}
+
+static int qsmmuv500_tbu_halt(struct qsmmuv500_tbu *tbu, struct arm_smmu_domain *smmu_domain)
+{
+	struct arm_smmu_device *smmu = smmu_domain->smmu;
+	int ret = 0, idx = smmu_domain->cfg.cbndx;
+	unsigned long flags;
+	u32 val, fsr, status;
+
+	spin_lock_irqsave(&tbu->halt_lock, flags);
+	if (tbu->halt_count) {
+		tbu->halt_count++;
+		goto out;
+	}
+
+	val = readl_relaxed(tbu->base + DEBUG_SID_HALT_REG);
+	val |= DEBUG_SID_HALT_VAL;
+	writel_relaxed(val, tbu->base + DEBUG_SID_HALT_REG);
+
+	fsr = arm_smmu_cb_read(smmu, idx, ARM_SMMU_CB_FSR);
+	if ((fsr & ARM_SMMU_FSR_FAULT) && (fsr & ARM_SMMU_FSR_SS)) {
+		u32 sctlr_orig, sctlr;
+
+		/*
+		 * We are in a fault. Our request to halt the bus will not
+		 * complete until transactions in front of us (such as the fault
+		 * itself) have completed. Disable iommu faults and terminate
+		 * any existing transactions.
+		 */
+		sctlr_orig = arm_smmu_cb_read(smmu, idx, ARM_SMMU_CB_SCTLR);
+		sctlr = sctlr_orig & ~(ARM_SMMU_SCTLR_CFCFG | ARM_SMMU_SCTLR_CFIE);
+		arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_SCTLR, sctlr);
+		arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_FSR, fsr);
+		arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_RESUME, ARM_SMMU_RESUME_TERMINATE);
+		arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_SCTLR, sctlr_orig);
+	}
+
+	if (readl_poll_timeout_atomic(tbu->base + DEBUG_SR_HALT_ACK_REG, status,
+				      (status & DEBUG_SR_HALT_ACK_VAL),
+				      0, TBU_DBG_TIMEOUT_US)) {
+		dev_err(tbu->dev, "Timeout while trying to halt TBU!\n");
+		ret = -ETIMEDOUT;
+
+		val = readl_relaxed(tbu->base + DEBUG_SID_HALT_REG);
+		val &= ~DEBUG_SID_HALT_VAL;
+		writel_relaxed(val, tbu->base + DEBUG_SID_HALT_REG);
+
+		goto out;
+	}
+
+	tbu->halt_count = 1;
+
+out:
+	spin_unlock_irqrestore(&tbu->halt_lock, flags);
+	return ret;
+}
+
+static void qsmmuv500_tbu_resume(struct qsmmuv500_tbu *tbu)
+{
+	unsigned long flags;
+	u32 val;
+
+	spin_lock_irqsave(&tbu->halt_lock, flags);
+	if (!tbu->halt_count) {
+		WARN(1, "%s: halt_count is 0", dev_name(tbu->dev));
+		goto out;
+	}
+
+	if (tbu->halt_count > 1) {
+		tbu->halt_count--;
+		goto out;
+	}
+
+	val = readl_relaxed(tbu->base + DEBUG_SID_HALT_REG);
+	val &= ~DEBUG_SID_HALT_VAL;
+	writel_relaxed(val, tbu->base + DEBUG_SID_HALT_REG);
+
+	tbu->halt_count = 0;
+out:
+	spin_unlock_irqrestore(&tbu->halt_lock, flags);
+}
+
+static phys_addr_t qsmmuv500_tbu_trigger_atos(struct arm_smmu_domain *smmu_domain,
+					      struct qsmmuv500_tbu *tbu, dma_addr_t iova, u32 sid)
+{
+	bool atos_timedout = false;
+	phys_addr_t phys = 0;
+	ktime_t timeout;
+	u64 val;
+
+	/* Set address and stream-id */
+	val = readq_relaxed(tbu->base + DEBUG_SID_HALT_REG);
+	val &= ~DEBUG_SID_HALT_SID;
+	val |= FIELD_PREP(DEBUG_SID_HALT_SID, sid);
+	writeq_relaxed(val, tbu->base + DEBUG_SID_HALT_REG);
+	writeq_relaxed(iova, tbu->base + DEBUG_VA_ADDR_REG);
+	val = FIELD_PREP(DEBUG_AXUSER_CDMID, DEBUG_AXUSER_CDMID_VAL);
+	writeq_relaxed(val, tbu->base + DEBUG_AXUSER_REG);
+
+	/* Write-back read and write-allocate */
+	val = FIELD_PREP(DEBUG_TXN_AXCACHE, 0xf);
+
+	/* Non-secure access */
+	val |= FIELD_PREP(DEBUG_TXN_AXPROT, DEBUG_TXN_AXPROT_NSEC);
+
+	/* Priviledged access */
+	val |= FIELD_PREP(DEBUG_TXN_AXPROT, DEBUG_TXN_AXPROT_PRIV);
+
+	val |= DEBUG_TXN_TRIGGER;
+	writeq_relaxed(val, tbu->base + DEBUG_TXN_TRIGG_REG);
+
+	timeout = ktime_add_us(ktime_get(), TBU_DBG_TIMEOUT_US);
+	for (;;) {
+		val = readl_relaxed(tbu->base + DEBUG_SR_HALT_ACK_REG);
+		if (!(val & DEBUG_SR_ECATS_RUNNING_VAL))
+			break;
+		val = readl_relaxed(tbu->base + DEBUG_PAR_REG);
+		if (val & DEBUG_PAR_FAULT_VAL)
+			break;
+		if (ktime_compare(ktime_get(), timeout) > 0) {
+			atos_timedout = true;
+			break;
+		}
+	}
+
+	val = readq_relaxed(tbu->base + DEBUG_PAR_REG);
+	if (val & DEBUG_PAR_FAULT_VAL)
+		dev_err(tbu->dev, "ATOS generated a fault interrupt! PAR = %llx, SID=0x%x\n",
+			val, sid);
+	else if (atos_timedout)
+		dev_err_ratelimited(tbu->dev, "ATOS translation timed out!\n");
+	else
+		phys = FIELD_GET(DEBUG_PAR_PA, val);
+
+	/* Reset hardware */
+	writeq_relaxed(0, tbu->base + DEBUG_TXN_TRIGG_REG);
+	writeq_relaxed(0, tbu->base + DEBUG_VA_ADDR_REG);
+	val = readl_relaxed(tbu->base + DEBUG_SID_HALT_REG);
+	val &= ~DEBUG_SID_HALT_SID;
+	writel_relaxed(val, tbu->base + DEBUG_SID_HALT_REG);
+
+	return phys;
+}
+
+static phys_addr_t qsmmuv500_iova_to_phys(struct arm_smmu_domain *smmu_domain,
+					  dma_addr_t iova, u32 sid)
+{
+	struct arm_smmu_device *smmu = smmu_domain->smmu;
+	struct qcom_smmu *qsmmu = to_qcom_smmu(smmu);
+	int idx = smmu_domain->cfg.cbndx;
+	struct qsmmuv500_tbu *tbu;
+	u32 sctlr_orig, sctlr;
+	phys_addr_t phys = 0;
+	unsigned long flags;
+	int attempt = 0;
+	int ret;
+	u64 fsr;
+
+	tbu = qsmmuv500_find_tbu(qsmmu, sid);
+	if (!tbu)
+		return 0;
+
+	ret = icc_set_bw(tbu->path, 0, UINT_MAX);
+	if (ret)
+		return ret;
+
+	ret = clk_prepare_enable(tbu->clk);
+	if (ret)
+		goto disable_icc;
+
+	ret = qsmmuv500_tbu_halt(tbu, smmu_domain);
+	if (ret)
+		goto disable_clk;
+
+	/*
+	 * ATOS/ECATS can trigger the fault interrupt, so disable it temporarily
+	 * and check for an interrupt manually.
+	 */
+	sctlr_orig = arm_smmu_cb_read(smmu, idx, ARM_SMMU_CB_SCTLR);
+	sctlr = sctlr_orig & ~(ARM_SMMU_SCTLR_CFCFG | ARM_SMMU_SCTLR_CFIE);
+	arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_SCTLR, sctlr);
+
+	fsr = arm_smmu_cb_read(smmu, idx, ARM_SMMU_CB_FSR);
+	if (fsr & ARM_SMMU_FSR_FAULT) {
+		/* Clear pending interrupts */
+		arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_FSR, fsr);
+
+		/*
+		 * TBU halt takes care of resuming any stalled transcation.
+		 * Kept it here for completeness sake.
+		 */
+		if (fsr & ARM_SMMU_FSR_SS)
+			arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_RESUME,
+					  ARM_SMMU_RESUME_TERMINATE);
+	}
+
+	/* Only one concurrent atos operation */
+	spin_lock_irqsave(&atos_lock, flags);
+
+	/*
+	 * If the translation fails, attempt the lookup more time."
+	 */
+	do {
+		phys = qsmmuv500_tbu_trigger_atos(smmu_domain, tbu, iova, sid);
+
+		fsr = arm_smmu_cb_read(smmu, idx, ARM_SMMU_CB_FSR);
+		if (fsr & ARM_SMMU_FSR_FAULT) {
+			/* Clear pending interrupts */
+			arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_FSR, fsr);
+
+			if (fsr & ARM_SMMU_FSR_SS)
+				arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_RESUME,
+						  ARM_SMMU_RESUME_TERMINATE);
+		}
+	} while (!phys && attempt++ < 2);
+
+	arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_SCTLR, sctlr_orig);
+	spin_unlock_irqrestore(&atos_lock, flags);
+	qsmmuv500_tbu_resume(tbu);
+
+	/* Read to complete prior write transcations */
+	readl_relaxed(tbu->base + DEBUG_SR_HALT_ACK_REG);
+
+disable_clk:
+	clk_disable_unprepare(tbu->clk);
+disable_icc:
+	icc_set_bw(tbu->path, 0, 0);
+
+	return phys;
+}
+
+static phys_addr_t qcom_smmu_iova_to_phys_hard(struct iommu_domain *domain, dma_addr_t iova)
+{
+	struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
+	struct arm_smmu_device *smmu = smmu_domain->smmu;
+	int idx = smmu_domain->cfg.cbndx;
+	u32 frsynra;
+	u16 sid;
+
+	frsynra = arm_smmu_gr1_read(smmu, ARM_SMMU_GR1_CBFRSYNRA(idx));
+	sid = FIELD_GET(ARM_SMMU_CBFRSYNRA_SID, frsynra);
+
+	return qsmmuv500_iova_to_phys(smmu_domain, iova, sid);
+}
+
+static phys_addr_t qcom_smmu_verify_fault(struct iommu_domain *domain, dma_addr_t iova, u32 fsr)
+{
+	struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
+	struct io_pgtable *iop = io_pgtable_ops_to_pgtable(smmu_domain->pgtbl_ops);
+	struct arm_smmu_device *smmu = smmu_domain->smmu;
+	phys_addr_t phys_post_tlbiall;
+	phys_addr_t phys;
+
+	phys = qcom_smmu_iova_to_phys_hard(domain, iova);
+	io_pgtable_tlb_flush_all(iop);
+	phys_post_tlbiall = qcom_smmu_iova_to_phys_hard(domain, iova);
+
+	if (phys != phys_post_tlbiall) {
+		dev_err(smmu->dev,
+			"ATOS results differed across TLBIALL... (before: %pa after: %pa)\n",
+			&phys, &phys_post_tlbiall);
+	}
+
+	return (phys == 0 ? phys_post_tlbiall : phys);
+}
+
+irqreturn_t qcom_smmu_context_fault(int irq, void *dev)
+{
+	struct iommu_domain *domain = dev;
+	struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
+	struct io_pgtable_ops *ops = smmu_domain->pgtbl_ops;
+	struct arm_smmu_device *smmu = smmu_domain->smmu;
+	u32 fsr, fsynr, cbfrsynra, resume = 0;
+	int idx = smmu_domain->cfg.cbndx;
+	phys_addr_t phys_soft;
+	unsigned long iova;
+	int ret, tmp;
+
+	static DEFINE_RATELIMIT_STATE(_rs,
+				      DEFAULT_RATELIMIT_INTERVAL,
+				      DEFAULT_RATELIMIT_BURST);
+
+	fsr = arm_smmu_cb_read(smmu, idx, ARM_SMMU_CB_FSR);
+	if (!(fsr & ARM_SMMU_FSR_FAULT))
+		return IRQ_NONE;
+
+	fsynr = arm_smmu_cb_read(smmu, idx, ARM_SMMU_CB_FSYNR0);
+	iova = arm_smmu_cb_readq(smmu, idx, ARM_SMMU_CB_FAR);
+	cbfrsynra = arm_smmu_gr1_read(smmu, ARM_SMMU_GR1_CBFRSYNRA(idx));
+
+	phys_soft = ops->iova_to_phys(ops, iova);
+
+	tmp = report_iommu_fault(domain, NULL, iova,
+				 fsynr & ARM_SMMU_FSYNR0_WNR ?
+				 IOMMU_FAULT_WRITE : IOMMU_FAULT_READ);
+	if (!tmp || tmp == -EBUSY) {
+		dev_dbg(smmu->dev,
+			"Context fault handled by client: iova=0x%08lx, fsr=0x%x, fsynr=0x%x, cb=%d\n",
+			iova, fsr, fsynr, idx);
+		dev_dbg(smmu->dev, "soft iova-to-phys=%pa\n", &phys_soft);
+		ret = IRQ_HANDLED;
+		resume = ARM_SMMU_RESUME_TERMINATE;
+	} else {
+		phys_addr_t phys_atos = qcom_smmu_verify_fault(domain, iova, fsr);
+
+		if (__ratelimit(&_rs)) {
+			dev_err(smmu->dev,
+				"Unhandled context fault: fsr=0x%x, iova=0x%08lx, fsynr=0x%x, cbfrsynra=0x%x, cb=%d\n",
+				fsr, iova, fsynr, cbfrsynra, idx);
+			dev_err(smmu->dev,
+				"FSR    = %08x [%s%s%s%s%s%s%s%s%s], SID=0x%x\n",
+				fsr,
+				(fsr & 0x02) ? "TF " : "",
+				(fsr & 0x04) ? "AFF " : "",
+				(fsr & 0x08) ? "PF " : "",
+				(fsr & 0x10) ? "EF " : "",
+				(fsr & 0x20) ? "TLBMCF " : "",
+				(fsr & 0x40) ? "TLBLKF " : "",
+				(fsr & 0x80) ? "MHF " : "",
+				(fsr & 0x40000000) ? "SS " : "",
+				(fsr & 0x80000000) ? "MULTI " : "",
+				cbfrsynra);
+
+			dev_err(smmu->dev,
+				"soft iova-to-phys=%pa\n", &phys_soft);
+			if (!phys_soft)
+				dev_err(smmu->dev,
+					"SOFTWARE TABLE WALK FAILED! Looks like %s accessed an unmapped address!\n",
+					dev_name(smmu->dev));
+			if (phys_atos)
+				dev_err(smmu->dev, "hard iova-to-phys (ATOS)=%pa\n",
+					&phys_atos);
+			else
+				dev_err(smmu->dev, "hard iova-to-phys (ATOS) failed\n");
+		}
+		ret = IRQ_NONE;
+		resume = ARM_SMMU_RESUME_TERMINATE;
+	}
+
+	/*
+	 * If the client returns -EBUSY, do not clear FSR and do not RESUME
+	 * if stalled. This is required to keep the IOMMU client stalled on
+	 * the outstanding fault. This gives the client a chance to take any
+	 * debug action and then terminate the stalled transaction.
+	 * So, the sequence in case of stall on fault should be:
+	 * 1) Do not clear FSR or write to RESUME here
+	 * 2) Client takes any debug action
+	 * 3) Client terminates the stalled transaction and resumes the IOMMU
+	 * 4) Client clears FSR. The FSR should only be cleared after 3) and
+	 *    not before so that the fault remains outstanding. This ensures
+	 *    SCTLR.HUPCF has the desired effect if subsequent transactions also
+	 *    need to be terminated.
+	 */
+	if (tmp != -EBUSY) {
+		/* Clear the faulting FSR */
+		arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_FSR, fsr);
+
+		/* Retry or terminate any stalled transactions */
+		if (fsr & ARM_SMMU_FSR_SS)
+			arm_smmu_cb_write(smmu, idx, ARM_SMMU_CB_RESUME, resume);
+	}
+
+	return ret;
+}
+
+static int qsmmuv500_tbu_probe(struct platform_device *pdev)
+{
+	struct device_node *np = pdev->dev.of_node;
+	struct device *dev = &pdev->dev;
+	struct arm_smmu_device *smmu;
+	struct qsmmuv500_tbu *tbu;
+	struct qcom_smmu *qsmmu;
+	int ret;
+
+	smmu = dev_get_drvdata(dev->parent);
+	if (!smmu)
+		return -EPROBE_DEFER;
+
+	qsmmu = to_qcom_smmu(smmu);
+
+	tbu = devm_kzalloc(dev, sizeof(*tbu), GFP_KERNEL);
+	if (!tbu)
+		return -ENOMEM;
+
+	tbu->dev = dev;
+	INIT_LIST_HEAD(&tbu->list);
+	spin_lock_init(&tbu->halt_lock);
+
+	tbu->base = devm_of_iomap(dev, np, 0, NULL);
+	if (IS_ERR(tbu->base))
+		return PTR_ERR(tbu->base);
+
+	ret = of_property_read_u32_array(np, "qcom,stream-id-range", tbu->sid_range, 2);
+	if (ret) {
+		dev_err(dev, "The DT property 'qcom,stream-id-range' is mandatory\n");
+		return ret;
+	}
+
+	tbu->clk = devm_clk_get_optional(dev, NULL);
+	if (IS_ERR(tbu->clk))
+		return PTR_ERR(tbu->clk);
+
+	tbu->path = devm_of_icc_get(dev, NULL);
+	if (IS_ERR(tbu->path))
+		return PTR_ERR(tbu->path);
+
+	mutex_lock(&qsmmu->tbu_list_lock);
+	list_add_tail(&tbu->list, &qsmmu->tbu_list);
+	mutex_unlock(&qsmmu->tbu_list_lock);
+
+	dev_set_drvdata(dev, tbu);
+
+	return 0;
+}
+
+static const struct of_device_id qsmmuv500_tbu_of_match[] = {
+	{ .compatible = "qcom,qsmmuv500-tbu" },
+	{ }
+};
+
+static struct platform_driver qsmmuv500_tbu_driver = {
+	.driver = {
+		.name           = "qsmmuv500-tbu",
+		.of_match_table = qsmmuv500_tbu_of_match,
+	},
+	.probe = qsmmuv500_tbu_probe,
+};
+builtin_platform_driver(qsmmuv500_tbu_driver);
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -4,9 +4,11 @@
  */
 
 #include <linux/acpi.h>
+#include <linux/dev_printk.h>
 #include <linux/adreno-smmu-priv.h>
 #include <linux/delay.h>
 #include <linux/of_device.h>
+#include <linux/of_platform.h>
 #include <linux/firmware/qcom/qcom_scm.h>
 
 #include "arm-smmu.h"
@@ -14,11 +16,290 @@
 
 #define QCOM_DUMMY_VAL	-1
 
+struct actlr_config {
+	u16 sid;
+	u16 mask;
+	u32 actlr;
+};
+
+#define PREFETCH_DISABLE	0
+#define PREFETCH_SHALLOW	BIT(8)
+#define PREFETCH_DEEP		(BIT(9) | BIT(8))
+#define PREFETCH_DEEP_GFX	(BIT(9) | BIT(8) | BIT(5) | BIT(3))
+#define CPRE			BIT(1)		/* Enable context caching in the prefetch buffer */
+#define CMTLB			BIT(0)		/* Enable context caching in the macro TLB */
+
+static const struct actlr_config sc7280_apps_actlr_cfg[] = {
+	{ 0x0800, 0x24E1, PREFETCH_DISABLE | CMTLB },
+	{ 0x2000, 0x0163, PREFETCH_DISABLE | CMTLB },
+	{ 0x2080, 0x0461, PREFETCH_DISABLE | CMTLB },
+	{ 0x2100, 0x0161, PREFETCH_DISABLE | CMTLB },
+	{ 0x0900, 0x0407, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x2180, 0x0027, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1000, 0x07ff, PREFETCH_DEEP | CPRE | CMTLB },
+};
+
+static const struct actlr_config sc7280_gfx_actlr_cfg[] = {
+	{ 0x0000, 0x07ff, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+};
+
+static const struct actlr_config sa7255p_apps_actlr_cfg[] = {
+	{ 0x0800, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0801, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0802, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0803, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0840, 0x0480, PREFETCH_DISABLE | CMTLB },
+	{ 0x0860, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x2400, 0x0020, PREFETCH_DISABLE | CMTLB },
+	{ 0x2401, 0x0020, PREFETCH_DISABLE | CMTLB },
+	{ 0x2402, 0x0020, PREFETCH_DISABLE | CMTLB },
+	{ 0x2403, 0x0020, PREFETCH_DISABLE | CMTLB },
+	{ 0x1000, 0x0402, PREFETCH_DISABLE | CMTLB },
+	{ 0x1001, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0880, 0x0400, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x0881, 0x0404, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x0883, 0x0400, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x0884, 0x0400, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x0887, 0x0400, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1961, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1962, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1963, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1964, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1981, 0x0440, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1982, 0x0440, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1983, 0x0440, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1984, 0x0440, PREFETCH_DEEP | CPRE | CMTLB },
+};
+
+static const struct actlr_config sa7255p_gfx_actlr_cfg[] = {
+	{ 0x0000, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0001, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0002, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0004, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0005, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0007, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+};
+
+static const struct actlr_config sa8775p_apps_actlr_cfg[] = {
+	{ 0x0800, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0801, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0802, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0803, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0840, 0x0480, PREFETCH_DISABLE | CMTLB },
+	{ 0x0860, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x3400, 0x0020, PREFETCH_DISABLE | CMTLB },
+	{ 0x3401, 0x0020, PREFETCH_DISABLE | CMTLB },
+	{ 0x3402, 0x0020, PREFETCH_DISABLE | CMTLB },
+	{ 0x3403, 0x0020, PREFETCH_DISABLE | CMTLB },
+	{ 0x1000, 0x0402, PREFETCH_DISABLE | CMTLB },
+	{ 0x1001, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x1800, 0x0402, PREFETCH_DISABLE | CMTLB },
+	{ 0x1801, 0x0400, PREFETCH_DISABLE | CMTLB },
+	{ 0x0880, 0x0400, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x0881, 0x0404, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x0883, 0x0400, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x0884, 0x0400, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x0887, 0x0400, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x2141, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2142, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2143, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2144, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2145, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2146, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2147, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2148, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2149, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x214a, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x214b, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x214c, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x214d, 0x0420, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2181, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2182, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2183, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2184, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2185, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2186, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2187, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2188, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2189, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x218a, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x218b, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x218c, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x218d, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x21ed, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x25cd, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2941, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2942, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2943, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2944, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2945, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2946, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2947, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2948, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2949, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x294a, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x294b, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x294c, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x294d, 0x04a0, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2981, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2982, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2983, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2984, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2985, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2986, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2987, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2988, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x2989, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x298a, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x298b, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x298c, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x298d, 0x0400, PREFETCH_DEEP | CPRE | CMTLB },
+};
+
+static const struct actlr_config sa8775p_gfx_actlr_cfg[] = {
+	{ 0x0000, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0001, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0002, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0004, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0005, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+	{ 0x0007, 0x0c00, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+};
+
+static const struct actlr_config sm8550_apps_actlr_cfg[] = {
+	{ 0x18a0, 0x0000, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x18e0, 0x0000, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x0800, 0x0020, PREFETCH_DISABLE | CMTLB },
+	{ 0x1800, 0x00c0, PREFETCH_DISABLE | CMTLB },
+	{ 0x1820, 0x0000, PREFETCH_DISABLE | CMTLB },
+	{ 0x1860, 0x0000, PREFETCH_DISABLE | CMTLB },
+	{ 0x0c01, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c02, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c03, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c04, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c05, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c06, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c07, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c08, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c09, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c0c, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c0d, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c0e, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x0c0f, 0x0020, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1961, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1962, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1963, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1964, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1965, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1966, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1967, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1968, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1969, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x196c, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x196d, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x196e, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x196f, 0x0000, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19c1, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19c2, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19c3, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19c4, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19c5, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19c6, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19c7, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19c8, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19c9, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19cc, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19cd, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19ce, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x19cf, 0x0010, PREFETCH_DEEP | CPRE | CMTLB },
+	{ 0x1c00, 0x0002, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1c01, 0x0000, PREFETCH_DISABLE | CMTLB },
+	{ 0x1920, 0x0000, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1923, 0x0000, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1924, 0x0000, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1940, 0x0000, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1941, 0x0004, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1943, 0x0000, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1944, 0x0000, PREFETCH_SHALLOW | CPRE | CMTLB },
+	{ 0x1947, 0x0000, PREFETCH_SHALLOW | CPRE | CMTLB },
+};
+
+static const struct actlr_config sm8550_gfx_actlr_cfg[] = {
+	{ 0x0000, 0x03ff, PREFETCH_DEEP_GFX | CPRE | CMTLB },
+};
+
 static struct qcom_smmu *to_qcom_smmu(struct arm_smmu_device *smmu)
 {
 	return container_of(smmu, struct qcom_smmu, smmu);
 }
 
+static void *qcom_alloc_pages(void *cookie, size_t size, gfp_t gfp)
+{
+	struct page *p;
+	struct qcom_scm_vmperm perms[2];
+	u64 src  = BIT(QCOM_SCM_VMID_HLOS);
+	int ret;
+
+	struct arm_smmu_domain *domain = (void *)cookie;
+	/*
+	 * qcom_scm_assign_mem call during atomic allocation can sleep, Using GFP flags
+	 * to detect allocation path and return failure for atomic allocations.
+	 */
+	if (!gfpflags_allow_blocking(gfp)) {
+		dev_err(domain->smmu->dev,
+			"qcom_scm_assign_mem call are not allowed during atomic allocations\n");
+		return NULL;
+	}
+	p = alloc_page(gfp);
+	if (!p)
+		return NULL;
+
+	perms[0].vmid = QCOM_SCM_VMID_HLOS;
+	perms[0].perm = QCOM_SCM_PERM_RW;
+	perms[1].vmid = domain->secure_vmid;
+	perms[1].perm = QCOM_SCM_PERM_READ;
+	ret = qcom_scm_assign_mem(page_to_phys(p), PAGE_SIZE,
+				  &src, perms, 2);
+	if (ret < 0) {
+		dev_err(domain->smmu->dev,
+			"assign memory failed for vmid=%x ret=%d\n",
+			domain->secure_vmid, ret);
+		__free_page(p);
+		return NULL;
+	}
+
+	return page_address(p);
+}
+
+static void qcom_free_pages(void *cookie, void *pages, size_t size)
+{
+	struct qcom_scm_vmperm perms;
+	struct page *p;
+	u64 src;
+	int ret;
+
+	struct arm_smmu_domain *domain = (void *)cookie;
+
+	p = virt_to_page(pages);
+
+	perms.vmid = QCOM_SCM_VMID_HLOS;
+	perms.perm = QCOM_SCM_PERM_RWX;
+	src = BIT(domain->secure_vmid) | BIT(QCOM_SCM_VMID_HLOS);
+	ret = qcom_scm_assign_mem(page_to_phys(p), PAGE_SIZE,
+				  &src, &perms, 1);
+	/*
+	 * For assign failure scenario, it is not safe to use these pages by HLOS.
+	 * So returning from here instead of freeing the page.
+	 */
+	if (ret < 0) {
+		dev_err(domain->smmu->dev,
+			"assign memory failed to HLOS for vmid=%x ret=%d\n",
+			domain->secure_vmid, ret);
+		return;
+	}
+
+	__free_page(p);
+}
+
 static void qcom_smmu_tlb_sync(struct arm_smmu_device *smmu, int page,
 				int sync, int status)
 {
@@ -205,13 +486,60 @@
 	return true;
 }
 
+static void arm_smmu_set_actlr(struct device *dev, struct arm_smmu_device *smmu, int cbndx,
+		const struct actlr_config *actlrcfg, size_t actlrcfg_size)
+{
+	struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
+	struct arm_smmu_master_cfg *cfg = dev_iommu_priv_get(dev);
+	struct arm_smmu_smr *smr;
+	int i;
+	int j;
+	u16 id;
+	u16 mask;
+	int idx;
+
+	for (i = 0; i < actlrcfg_size; ++i) {
+		id = (actlrcfg + i)->sid;
+		mask = (actlrcfg + i)->mask;
+
+		for_each_cfg_sme(cfg, fwspec, j, idx) {
+			smr = &smmu->smrs[idx];
+			if (smr_is_subset(*smr, id, mask))
+				arm_smmu_cb_write(smmu, cbndx, ARM_SMMU_CB_ACTLR,
+						(actlrcfg + i)->actlr);
+		}
+	}
+}
+
 static int qcom_adreno_smmu_init_context(struct arm_smmu_domain *smmu_domain,
 		struct io_pgtable_cfg *pgtbl_cfg, struct device *dev)
 {
 	struct adreno_smmu_priv *priv;
+	struct arm_smmu_device *smmu = smmu_domain->smmu;
+	struct qcom_smmu *qsmmu = to_qcom_smmu(smmu);
+	const struct actlr_config *actlrcfg;
+	size_t actlrcfg_size;
+	int cbndx = smmu_domain->cfg.cbndx;
+	u32 val;
 
 	smmu_domain->cfg.flush_walk_prefer_tlbiasid = true;
 
+	/*
+	 * For those client where qcom,iommu-vmid is not defined, default arm-smmu pgtable
+	 * alloc/free handler will be used.
+	 */
+	if (of_property_read_u32(dev->of_node, "qcom,iommu-vmid", &val) == 0) {
+		smmu_domain->secure_vmid = val;
+		pgtbl_cfg->alloc = qcom_alloc_pages;
+		pgtbl_cfg->free = qcom_free_pages;
+	}
+
+	if (qsmmu->data->actlrcfg_gfx) {
+		actlrcfg = qsmmu->data->actlrcfg_gfx;
+		actlrcfg_size = qsmmu->data->actlrcfg_gfx_size;
+		arm_smmu_set_actlr(dev, smmu, cbndx, actlrcfg, actlrcfg_size);
+	}
+
 	/* Only enable split pagetables for the GPU device (SID 0) */
 	if (!qcom_adreno_smmu_is_gpu_device(dev))
 		return 0;
@@ -231,6 +559,8 @@
 	 */
 
 	priv = dev_get_drvdata(dev);
+	if (!priv)
+		return -ENODATA;
 	priv->cookie = smmu_domain;
 	priv->get_ttbr1_cfg = qcom_adreno_smmu_get_ttbr1_cfg;
 	priv->set_ttbr0_cfg = qcom_adreno_smmu_set_ttbr0_cfg;
@@ -266,8 +596,31 @@
 static int qcom_smmu_init_context(struct arm_smmu_domain *smmu_domain,
 		struct io_pgtable_cfg *pgtbl_cfg, struct device *dev)
 {
+	u32 val;
+	struct arm_smmu_device *smmu = smmu_domain->smmu;
+	struct qcom_smmu *qsmmu = to_qcom_smmu(smmu);
+	const struct actlr_config *actlrcfg;
+	size_t actlrcfg_size;
+	int cbndx = smmu_domain->cfg.cbndx;
+
+	if (qsmmu->data->actlrcfg) {
+		actlrcfg = qsmmu->data->actlrcfg;
+		actlrcfg_size = qsmmu->data->actlrcfg_size;
+		arm_smmu_set_actlr(dev, smmu, cbndx, actlrcfg, actlrcfg_size);
+	}
+
 	smmu_domain->cfg.flush_walk_prefer_tlbiasid = true;
 
+	/*
+	 * For those client where qcom,iommu-vmid is not defined, default arm-smmu pgtable
+	 * alloc/free handler will be used.
+	 */
+	if (of_property_read_u32(dev->of_node, "qcom,iommu-vmid", &val) == 0) {
+		smmu_domain->secure_vmid = val;
+		pgtbl_cfg->alloc = qcom_alloc_pages;
+		pgtbl_cfg->free = qcom_free_pages;
+	}
+
 	return 0;
 }
 
@@ -280,6 +633,20 @@
 	int i;
 
 	/*
+	 * MSM8998 LPASS SMMU reports 13 context banks, but accessing
+	 * the last context bank crashes the system.
+	 */
+	if (of_device_is_compatible(smmu->dev->of_node, "qcom,msm8998-smmu-v2") &&
+	    smmu->num_context_banks == 13) {
+		smmu->num_context_banks = 12;
+	} else if (of_device_is_compatible(smmu->dev->of_node, "qcom,sdm630-smmu-v2")) {
+		if (smmu->num_context_banks == 21) /* SDM630 / SDM660 A2NOC SMMU */
+			smmu->num_context_banks = 7;
+		else if (smmu->num_context_banks == 14) /* SDM630 / SDM660 LPASS SMMU */
+			smmu->num_context_banks = 13;
+	}
+
+	/*
 	 * Some platforms support more than the Arm SMMU architected maximum of
 	 * 128 stream matching groups. For unknown reasons, the additional
 	 * groups don't exhibit the same behavior as the architected registers,
@@ -335,6 +702,19 @@
 	return 0;
 }
 
+static int qcom_adreno_smmuv2_cfg_probe(struct arm_smmu_device *smmu)
+{
+	/* Support for 16K pages is advertised on some SoCs, but it doesn't seem to work */
+	smmu->features &= ~ARM_SMMU_FEAT_FMT_AARCH64_16K;
+
+	/* TZ protects several last context banks, hide them from Linux */
+	if (of_device_is_compatible(smmu->dev->of_node, "qcom,sdm630-smmu-v2") &&
+	    smmu->num_context_banks == 5)
+		smmu->num_context_banks = 2;
+
+	return 0;
+}
+
 static void qcom_smmu_write_s2cr(struct arm_smmu_device *smmu, int idx)
 {
 	struct arm_smmu_s2cr *s2cr = smmu->s2crs + idx;
@@ -378,11 +758,28 @@
 	return match ? IOMMU_DOMAIN_IDENTITY : 0;
 }
 
+static int qcom_smmu500_reset(struct arm_smmu_device *smmu)
+{
+	int i;
+	u32 reg;
+
+	arm_mmu500_reset(smmu);
+
+	/* Re-enable context caching after reset */
+	for (i = 0; i < smmu->num_context_banks; ++i) {
+		reg = arm_smmu_cb_read(smmu, i, ARM_SMMU_CB_ACTLR);
+		reg |= CPRE;
+		arm_smmu_cb_write(smmu, i, ARM_SMMU_CB_ACTLR, reg);
+	}
+
+	return 0;
+}
+
 static int qcom_sdm845_smmu500_reset(struct arm_smmu_device *smmu)
 {
 	int ret;
 
-	arm_mmu500_reset(smmu);
+	qcom_smmu500_reset(smmu);
 
 	/*
 	 * To address performance degradation in non-real time clients,
@@ -409,9 +806,13 @@
 	.init_context = qcom_smmu_init_context,
 	.cfg_probe = qcom_smmu_cfg_probe,
 	.def_domain_type = qcom_smmu_def_domain_type,
-	.reset = arm_mmu500_reset,
+	.reset = qcom_smmu500_reset,
 	.write_s2cr = qcom_smmu_write_s2cr,
 	.tlb_sync = qcom_smmu_tlb_sync,
+#ifdef CONFIG_ARM_SMMU_QCOM_TBU
+	.context_fault = qcom_smmu_context_fault,
+	.context_fault_needs_threaded_irq = true,
+#endif
 };
 
 static const struct arm_smmu_impl sdm845_smmu_500_impl = {
@@ -421,10 +822,15 @@
 	.reset = qcom_sdm845_smmu500_reset,
 	.write_s2cr = qcom_smmu_write_s2cr,
 	.tlb_sync = qcom_smmu_tlb_sync,
+#ifdef CONFIG_ARM_SMMU_QCOM_TBU
+	.context_fault = qcom_smmu_context_fault,
+	.context_fault_needs_threaded_irq = true,
+#endif
 };
 
 static const struct arm_smmu_impl qcom_adreno_smmu_v2_impl = {
 	.init_context = qcom_adreno_smmu_init_context,
+	.cfg_probe = qcom_adreno_smmuv2_cfg_probe,
 	.def_domain_type = qcom_smmu_def_domain_type,
 	.alloc_context_bank = qcom_adreno_smmu_alloc_context_bank,
 	.write_sctlr = qcom_adreno_smmu_write_sctlr,
@@ -434,10 +840,14 @@
 static const struct arm_smmu_impl qcom_adreno_smmu_500_impl = {
 	.init_context = qcom_adreno_smmu_init_context,
 	.def_domain_type = qcom_smmu_def_domain_type,
-	.reset = arm_mmu500_reset,
+	.reset = qcom_smmu500_reset,
 	.alloc_context_bank = qcom_adreno_smmu_alloc_context_bank,
 	.write_sctlr = qcom_adreno_smmu_write_sctlr,
 	.tlb_sync = qcom_smmu_tlb_sync,
+#ifdef CONFIG_ARM_SMMU_QCOM_TBU
+	.context_fault = qcom_smmu_context_fault,
+	.context_fault_needs_threaded_irq = true,
+#endif
 };
 
 static struct arm_smmu_device *qcom_smmu_create(struct arm_smmu_device *smmu,
@@ -446,6 +856,7 @@
 	const struct device_node *np = smmu->dev->of_node;
 	const struct arm_smmu_impl *impl;
 	struct qcom_smmu *qsmmu;
+	int ret;
 
 	if (!data)
 		return ERR_PTR(-EINVAL);
@@ -465,11 +876,17 @@
 	qsmmu = devm_krealloc(smmu->dev, smmu, sizeof(*qsmmu), GFP_KERNEL);
 	if (!qsmmu)
 		return ERR_PTR(-ENOMEM);
+	smmu = &qsmmu->smmu;
 
 	qsmmu->smmu.impl = impl;
-	qsmmu->cfg = data->cfg;
+	qsmmu->data = data;
+
+	INIT_LIST_HEAD(&qsmmu->tbu_list);
+	ret = devm_of_platform_populate(smmu->dev);
+	if (ret)
+		return ERR_PTR(ret);
 
-	return &qsmmu->smmu;
+	return smmu;
 }
 
 /* Implementation Defined Register Space 0 register offsets */
@@ -506,6 +923,46 @@
 	/* Also no debug configuration. */
 };
 
+static const struct qcom_smmu_match_data sc7280_smmu_500_impl0_data = {
+	.impl = &qcom_smmu_500_impl,
+	.adreno_impl = &qcom_adreno_smmu_500_impl,
+	.cfg = &qcom_smmu_impl0_cfg,
+	.actlrcfg = sc7280_apps_actlr_cfg,
+	.actlrcfg_size = ARRAY_SIZE(sc7280_apps_actlr_cfg),
+	.actlrcfg_gfx = sc7280_gfx_actlr_cfg,
+	.actlrcfg_gfx_size = ARRAY_SIZE(sc7280_gfx_actlr_cfg),
+};
+
+static const struct qcom_smmu_match_data sa7255p_smmu_500_impl0_data = {
+	.impl = &qcom_smmu_500_impl,
+	.adreno_impl = &qcom_adreno_smmu_500_impl,
+	.cfg = &qcom_smmu_impl0_cfg,
+	.actlrcfg = sa7255p_apps_actlr_cfg,
+	.actlrcfg_size = ARRAY_SIZE(sa7255p_apps_actlr_cfg),
+	.actlrcfg_gfx = sa7255p_gfx_actlr_cfg,
+	.actlrcfg_gfx_size = ARRAY_SIZE(sa7255p_gfx_actlr_cfg),
+};
+
+static const struct qcom_smmu_match_data sa8775p_smmu_500_impl0_data = {
+	.impl = &qcom_smmu_500_impl,
+	.adreno_impl = &qcom_adreno_smmu_500_impl,
+	.cfg = &qcom_smmu_impl0_cfg,
+	.actlrcfg = sa8775p_apps_actlr_cfg,
+	.actlrcfg_size = ARRAY_SIZE(sa8775p_apps_actlr_cfg),
+	.actlrcfg_gfx = sa8775p_gfx_actlr_cfg,
+	.actlrcfg_gfx_size = ARRAY_SIZE(sa8775p_gfx_actlr_cfg),
+};
+
+static const struct qcom_smmu_match_data sm8550_smmu_500_impl0_data = {
+	.impl = &qcom_smmu_500_impl,
+	.adreno_impl = &qcom_adreno_smmu_500_impl,
+	.cfg = &qcom_smmu_impl0_cfg,
+	.actlrcfg = sm8550_apps_actlr_cfg,
+	.actlrcfg_size = ARRAY_SIZE(sm8550_apps_actlr_cfg),
+	.actlrcfg_gfx = sm8550_gfx_actlr_cfg,
+	.actlrcfg_gfx_size = ARRAY_SIZE(sm8550_gfx_actlr_cfg),
+};
+
 static const struct qcom_smmu_match_data qcom_smmu_500_impl0_data = {
 	.impl = &qcom_smmu_500_impl,
 	.adreno_impl = &qcom_adreno_smmu_500_impl,
@@ -523,7 +980,10 @@
 	{ .compatible = "qcom,qdu1000-smmu-500", .data = &qcom_smmu_500_impl0_data  },
 	{ .compatible = "qcom,sc7180-smmu-500", .data = &qcom_smmu_500_impl0_data },
 	{ .compatible = "qcom,sc7180-smmu-v2", .data = &qcom_smmu_v2_data },
-	{ .compatible = "qcom,sc7280-smmu-500", .data = &qcom_smmu_500_impl0_data },
+	{ .compatible = "qcom,sc7280-smmu-500", .data = &sc7280_smmu_500_impl0_data },
+	{ .compatible = "qcom,sa7255p-smmu-500", .data = &sa7255p_smmu_500_impl0_data },
+	{ .compatible = "qcom,sa8255p-smmu-500", .data = &sa8775p_smmu_500_impl0_data },
+	{ .compatible = "qcom,sa8775p-smmu-500", .data = &sa8775p_smmu_500_impl0_data },
 	{ .compatible = "qcom,sc8180x-smmu-500", .data = &qcom_smmu_500_impl0_data },
 	{ .compatible = "qcom,sc8280xp-smmu-500", .data = &qcom_smmu_500_impl0_data },
 	{ .compatible = "qcom,sdm630-smmu-v2", .data = &qcom_smmu_v2_data },
@@ -540,6 +1000,7 @@
 	{ .compatible = "qcom,sm8250-smmu-500", .data = &qcom_smmu_500_impl0_data },
 	{ .compatible = "qcom,sm8350-smmu-500", .data = &qcom_smmu_500_impl0_data },
 	{ .compatible = "qcom,sm8450-smmu-500", .data = &qcom_smmu_500_impl0_data },
+	{ .compatible = "qcom,sm8550-smmu-500", .data = &sm8550_smmu_500_impl0_data },
 	{ .compatible = "qcom,smmu-500", .data = &qcom_smmu_500_impl0_data },
 	{ }
 };
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.h
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef _ARM_SMMU_QCOM_H
@@ -8,10 +8,12 @@
 
 struct qcom_smmu {
 	struct arm_smmu_device smmu;
-	const struct qcom_smmu_config *cfg;
+	const struct qcom_smmu_match_data *data;
 	bool bypass_quirk;
 	u8 bypass_cbndx;
 	u32 stall_enabled;
+	struct mutex tbu_list_lock;  /* protects tbu_list */
+	struct list_head tbu_list;
 };
 
 enum qcom_smmu_impl_reg_offset {
@@ -25,11 +27,17 @@
 };
 
 struct qcom_smmu_match_data {
+	const struct actlr_config *actlrcfg;
+	size_t actlrcfg_size;
+	const struct actlr_config *actlrcfg_gfx;
+	size_t actlrcfg_gfx_size;
 	const struct qcom_smmu_config *cfg;
 	const struct arm_smmu_impl *impl;
 	const struct arm_smmu_impl *adreno_impl;
 };
 
+irqreturn_t qcom_smmu_context_fault(int irq, void *dev);
+
 #ifdef CONFIG_ARM_SMMU_QCOM_DEBUG
 void qcom_smmu_tlb_sync_debug(struct arm_smmu_device *smmu);
 #else
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu/arm-smmu.c
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu/arm-smmu.c
@@ -806,8 +806,16 @@
 	else
 		context_fault = arm_smmu_context_fault;
 
-	ret = devm_request_irq(smmu->dev, irq, context_fault, IRQF_SHARED,
-			       "arm-smmu-context-fault", smmu_domain);
+	if (smmu->impl && smmu->impl->context_fault_needs_threaded_irq)
+		ret = devm_request_threaded_irq(smmu->dev, irq, NULL,
+						context_fault,
+						IRQF_ONESHOT | IRQF_SHARED,
+						"arm-smmu-context-fault",
+						smmu_domain);
+	else
+		ret = devm_request_irq(smmu->dev, irq, context_fault,
+				       IRQF_SHARED, "arm-smmu-context-fault", smmu_domain);
+
 	if (ret < 0) {
 		dev_err(smmu->dev, "failed to request context IRQ %d (%u)\n",
 			cfg->irptndx, irq);
@@ -999,9 +1007,10 @@
 		 * expect simply identical entries for this case, but there's
 		 * no harm in accommodating the generalisation.
 		 */
-		if ((mask & smrs[i].mask) == mask &&
-		    !((id ^ smrs[i].id) & ~smrs[i].mask))
+
+		if (smr_is_subset(smrs[i], id, mask))
 			return i;
+
 		/*
 		 * If the new entry has any other overlap with an existing one,
 		 * though, then there always exists at least one stream ID
@@ -1394,6 +1403,17 @@
 			goto out_free;
 	} else {
 		smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode);
+
+		/*
+		 * Defer probe if the relevant SMMU instance hasn't finished
+		 * probing yet. This is a fragile hack and we'd ideally
+		 * avoid this race in the core code. Until that's ironed
+		 * out, however, this is the most pragmatic option on the
+		 * table.
+		 */
+		if (!smmu)
+			return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER,
+						"smmu dev has not bound yet\n"));
 	}
 
 	ret = -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/iommu/arm/arm-smmu/arm-smmu.h
+++ linux-qcom-6.8.0/drivers/iommu/arm/arm-smmu/arm-smmu.h
@@ -136,6 +136,7 @@
 #define ARM_SMMU_CBAR_VMID		GENMASK(7, 0)
 
 #define ARM_SMMU_GR1_CBFRSYNRA(n)	(0x400 + ((n) << 2))
+#define ARM_SMMU_CBFRSYNRA_SID		GENMASK(15, 0)
 
 #define ARM_SMMU_GR1_CBA2R(n)		(0x800 + ((n) << 2))
 #define ARM_SMMU_CBA2R_VMID16		GENMASK(31, 16)
@@ -238,6 +239,7 @@
 #define ARM_SMMU_CB_ATSR		0x8f0
 #define ARM_SMMU_ATSR_ACTIVE		BIT(0)
 
+#define ARM_SMMU_RESUME_TERMINATE	BIT(0)
 
 /* Maximum number of context banks per SMMU */
 #define ARM_SMMU_MAX_CBS		128
@@ -373,6 +375,14 @@
 	struct mutex			init_mutex; /* Protects smmu pointer */
 	spinlock_t			cb_lock; /* Serialises ATS1* ops and TLB syncs */
 	struct iommu_domain		domain;
+	/*
+	 * Use to store parse vmid value for those clients which want HLOS
+	 * to share pgtable to different entity(VMID).
+	 * Fix Me: Ideally this should be implemented on arm-smmu vendor implementation
+	 * driver, but as per current design of arm_smmu_domain_alloc there is no way
+	 * to call implementation callbacks.
+	 */
+	u32				secure_vmid;
 };
 
 struct arm_smmu_master_cfg {
@@ -436,6 +446,7 @@
 	int (*def_domain_type)(struct device *dev);
 	irqreturn_t (*global_fault)(int irq, void *dev);
 	irqreturn_t (*context_fault)(int irq, void *dev);
+	bool context_fault_needs_threaded_irq;
 	int (*alloc_context_bank)(struct arm_smmu_domain *smmu_domain,
 				  struct arm_smmu_device *smmu,
 				  struct device *dev, int start);
@@ -500,6 +511,11 @@
 		writeq_relaxed(val, arm_smmu_page(smmu, page) + offset);
 }
 
+static inline bool smr_is_subset(struct arm_smmu_smr smrs, u16 id, u16 mask)
+{
+	return (mask & smrs.mask) == mask && !((id ^ smrs.id) & ~smrs.mask);
+}
+
 #define ARM_SMMU_GR0		0
 #define ARM_SMMU_GR1		1
 #define ARM_SMMU_CB(s, n)	((s)->numpage + (n))
--- linux-qcom-6.8.0.orig/drivers/iommu/dma-iommu.c
+++ linux-qcom-6.8.0/drivers/iommu/dma-iommu.c
@@ -1706,6 +1706,14 @@
 	return iova_rcache_range();
 }
 
+static size_t iommu_dma_max_mapping_size(struct device *dev)
+{
+	if (dev_is_untrusted(dev))
+		return swiotlb_max_mapping_size(dev);
+
+	return SIZE_MAX;
+}
+
 static const struct dma_map_ops iommu_dma_ops = {
 	.flags			= DMA_F_PCI_P2PDMA_SUPPORTED,
 	.alloc			= iommu_dma_alloc,
@@ -1728,6 +1736,7 @@
 	.unmap_resource		= iommu_dma_unmap_resource,
 	.get_merge_boundary	= iommu_dma_get_merge_boundary,
 	.opt_mapping_size	= iommu_dma_opt_mapping_size,
+	.max_mapping_size       = iommu_dma_max_mapping_size,
 };
 
 /*
--- linux-qcom-6.8.0.orig/drivers/iommu/intel/Makefile
+++ linux-qcom-6.8.0/drivers/iommu/intel/Makefile
@@ -5,5 +5,7 @@
 obj-$(CONFIG_DMAR_PERF) += perf.o
 obj-$(CONFIG_INTEL_IOMMU_DEBUGFS) += debugfs.o
 obj-$(CONFIG_INTEL_IOMMU_SVM) += svm.o
+ifdef CONFIG_INTEL_IOMMU
 obj-$(CONFIG_IRQ_REMAP) += irq_remapping.o
+endif
 obj-$(CONFIG_INTEL_IOMMU_PERF_EVENTS) += perfmon.o
--- linux-qcom-6.8.0.orig/drivers/iommu/intel/dmar.c
+++ linux-qcom-6.8.0/drivers/iommu/intel/dmar.c
@@ -1095,7 +1095,9 @@
 	iommu->agaw = agaw;
 	iommu->msagaw = msagaw;
 	iommu->segment = drhd->segment;
-
+	iommu->device_rbtree = RB_ROOT;
+	spin_lock_init(&iommu->device_rbtree_lock);
+	mutex_init(&iommu->iopf_lock);
 	iommu->node = NUMA_NO_NODE;
 
 	ver = readl(iommu->reg + DMAR_VER_REG);
@@ -1202,9 +1204,7 @@
  */
 static inline void reclaim_free_desc(struct q_inval *qi)
 {
-	while (qi->desc_status[qi->free_tail] == QI_DONE ||
-	       qi->desc_status[qi->free_tail] == QI_ABORT) {
-		qi->desc_status[qi->free_tail] = QI_FREE;
+	while (qi->desc_status[qi->free_tail] == QI_FREE && qi->free_tail != qi->free_head) {
 		qi->free_tail = (qi->free_tail + 1) % QI_LENGTH;
 		qi->free_cnt++;
 	}
@@ -1271,6 +1271,8 @@
 {
 	u32 fault;
 	int head, tail;
+	struct device *dev;
+	u64 iqe_err, ite_sid;
 	struct q_inval *qi = iommu->qi;
 	int shift = qi_shift(iommu);
 
@@ -1315,6 +1317,13 @@
 		tail = readl(iommu->reg + DMAR_IQT_REG);
 		tail = ((tail >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
 
+		/*
+		 * SID field is valid only when the ITE field is Set in FSTS_REG
+		 * see Intel VT-d spec r4.1, section 11.4.9.9
+		 */
+		iqe_err = dmar_readq(iommu->reg + DMAR_IQER_REG);
+		ite_sid = DMAR_IQER_REG_ITESID(iqe_err);
+
 		writel(DMA_FSTS_ITE, iommu->reg + DMAR_FSTS_REG);
 		pr_info("Invalidation Time-out Error (ITE) cleared\n");
 
@@ -1324,6 +1333,19 @@
 			head = (head - 2 + QI_LENGTH) % QI_LENGTH;
 		} while (head != tail);
 
+		/*
+		 * If device was released or isn't present, no need to retry
+		 * the ATS invalidate request anymore.
+		 *
+		 * 0 value of ite_sid means old VT-d device, no ite_sid value.
+		 * see Intel VT-d spec r4.1, section 11.4.9.9
+		 */
+		if (ite_sid) {
+			dev = device_rbtree_find(iommu, ite_sid);
+			if (!dev || !dev_is_pci(dev) ||
+			    !pci_device_is_present(to_pci_dev(dev)))
+				return -ETIMEDOUT;
+		}
 		if (qi->desc_status[wait_index] == QI_ABORT)
 			return -EAGAIN;
 	}
@@ -1422,7 +1444,7 @@
 	 */
 	writel(qi->free_head << shift, iommu->reg + DMAR_IQT_REG);
 
-	while (qi->desc_status[wait_index] != QI_DONE) {
+	while (READ_ONCE(qi->desc_status[wait_index]) != QI_DONE) {
 		/*
 		 * We will leave the interrupts disabled, to prevent interrupt
 		 * context to queue another cmd while a cmd is already submitted
@@ -1439,8 +1461,16 @@
 		raw_spin_lock(&qi->q_lock);
 	}
 
-	for (i = 0; i < count; i++)
-		qi->desc_status[(index + i) % QI_LENGTH] = QI_DONE;
+	/*
+	 * The reclaim code can free descriptors from multiple submissions
+	 * starting from the tail of the queue. When count == 0, the
+	 * status of the standalone wait descriptor at the tail of the queue
+	 * must be set to QI_FREE to allow the reclaim code to proceed.
+	 * It is also possible that descriptors from one of the previous
+	 * submissions has to be reclaimed by a subsequent submission.
+	 */
+	for (i = 0; i <= count; i++)
+		qi->desc_status[(index + i) % QI_LENGTH] = QI_FREE;
 
 	reclaim_free_desc(qi);
 	raw_spin_unlock_irqrestore(&qi->q_lock, flags);
--- linux-qcom-6.8.0.orig/drivers/iommu/intel/iommu.c
+++ linux-qcom-6.8.0/drivers/iommu/intel/iommu.c
@@ -38,6 +38,14 @@
 #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
 #define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
 #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
+#define IS_INTEL_IPU(pdev) ((pdev)->vendor == PCI_VENDOR_ID_INTEL &&	\
+			   ((pdev)->device == 0xa75d ||		\
+			    (pdev)->device == 0x9a19 ||		\
+			    (pdev)->device == 0x9a39 ||		\
+			    (pdev)->device == 0x7d19 ||		\
+			    (pdev)->device == 0x4e19 ||		\
+			    (pdev)->device == 0x465d ||		\
+			    (pdev)->device == 0x1919))
 #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
 
 #define IOAPIC_RANGE_START	(0xfee00000)
@@ -97,6 +105,81 @@
 	return re->hi & VTD_PAGE_MASK;
 }
 
+static int device_rid_cmp_key(const void *key, const struct rb_node *node)
+{
+	struct device_domain_info *info =
+		rb_entry(node, struct device_domain_info, node);
+	const u16 *rid_lhs = key;
+
+	if (*rid_lhs < PCI_DEVID(info->bus, info->devfn))
+		return -1;
+
+	if (*rid_lhs > PCI_DEVID(info->bus, info->devfn))
+		return 1;
+
+	return 0;
+}
+
+static int device_rid_cmp(struct rb_node *lhs, const struct rb_node *rhs)
+{
+	struct device_domain_info *info =
+		rb_entry(lhs, struct device_domain_info, node);
+	u16 key = PCI_DEVID(info->bus, info->devfn);
+
+	return device_rid_cmp_key(&key, rhs);
+}
+
+/*
+ * Looks up an IOMMU-probed device using its source ID.
+ *
+ * Returns the pointer to the device if there is a match. Otherwise,
+ * returns NULL.
+ *
+ * Note that this helper doesn't guarantee that the device won't be
+ * released by the iommu subsystem after being returned. The caller
+ * should use its own synchronization mechanism to avoid the device
+ * being released during its use if its possibly the case.
+ */
+struct device *device_rbtree_find(struct intel_iommu *iommu, u16 rid)
+{
+	struct device_domain_info *info = NULL;
+	struct rb_node *node;
+	unsigned long flags;
+
+	spin_lock_irqsave(&iommu->device_rbtree_lock, flags);
+	node = rb_find(&rid, &iommu->device_rbtree, device_rid_cmp_key);
+	if (node)
+		info = rb_entry(node, struct device_domain_info, node);
+	spin_unlock_irqrestore(&iommu->device_rbtree_lock, flags);
+
+	return info ? info->dev : NULL;
+}
+
+static int device_rbtree_insert(struct intel_iommu *iommu,
+				struct device_domain_info *info)
+{
+	struct rb_node *curr;
+	unsigned long flags;
+
+	spin_lock_irqsave(&iommu->device_rbtree_lock, flags);
+	curr = rb_find_add(&info->node, &iommu->device_rbtree, device_rid_cmp);
+	spin_unlock_irqrestore(&iommu->device_rbtree_lock, flags);
+	if (WARN_ON(curr))
+		return -EEXIST;
+
+	return 0;
+}
+
+static void device_rbtree_remove(struct device_domain_info *info)
+{
+	struct intel_iommu *iommu = info->iommu;
+	unsigned long flags;
+
+	spin_lock_irqsave(&iommu->device_rbtree_lock, flags);
+	rb_erase(&info->node, &iommu->device_rbtree);
+	spin_unlock_irqrestore(&iommu->device_rbtree_lock, flags);
+}
+
 /*
  * This domain is a statically identity mapping domain.
  *	1. This domain creats a static 1:1 mapping to all usable memory.
@@ -148,12 +231,14 @@
 EXPORT_SYMBOL_GPL(intel_iommu_enabled);
 
 static int dmar_map_gfx = 1;
+static int dmar_map_ipu = 1;
 static int intel_iommu_superpage = 1;
 static int iommu_identity_mapping;
 static int iommu_skip_te_disable;
 
 #define IDENTMAP_GFX		2
 #define IDENTMAP_AZALIA		4
+#define IDENTMAP_IPU		8
 
 const struct iommu_ops intel_iommu_ops;
 static const struct iommu_dirty_ops intel_dirty_ops;
@@ -669,14 +754,15 @@
 	while (1) {
 		offset = pfn_level_offset(pfn, level);
 		pte = &parent[offset];
-		if (!pte || (dma_pte_superpage(pte) || !dma_pte_present(pte))) {
-			pr_info("PTE not present at level %d\n", level);
-			break;
-		}
 
 		pr_info("pte level: %d, pte value: 0x%016llx\n", level, pte->val);
 
-		if (level == 1)
+		if (!dma_pte_present(pte)) {
+			pr_info("page table not present at level %d\n", level - 1);
+			break;
+		}
+
+		if (level == 1 || dma_pte_superpage(pte))
 			break;
 
 		parent = phys_to_virt(dma_pte_addr(pte));
@@ -699,11 +785,11 @@
 	pr_info("Dump %s table entries for IOVA 0x%llx\n", iommu->name, addr);
 
 	/* root entry dump */
-	rt_entry = &iommu->root_entry[bus];
-	if (!rt_entry) {
-		pr_info("root table entry is not present\n");
+	if (!iommu->root_entry) {
+		pr_info("root table is not present\n");
 		return;
 	}
+	rt_entry = &iommu->root_entry[bus];
 
 	if (sm_supported(iommu))
 		pr_info("scalable mode root entry: hi 0x%016llx, low 0x%016llx\n",
@@ -714,7 +800,7 @@
 	/* context entry dump */
 	ctx_entry = iommu_context_addr(iommu, bus, devfn, 0);
 	if (!ctx_entry) {
-		pr_info("context table entry is not present\n");
+		pr_info("context table is not present\n");
 		return;
 	}
 
@@ -723,17 +809,23 @@
 
 	/* legacy mode does not require PASID entries */
 	if (!sm_supported(iommu)) {
+		if (!context_present(ctx_entry)) {
+			pr_info("legacy mode page table is not present\n");
+			return;
+		}
 		level = agaw_to_level(ctx_entry->hi & 7);
 		pgtable = phys_to_virt(ctx_entry->lo & VTD_PAGE_MASK);
 		goto pgtable_walk;
 	}
 
-	/* get the pointer to pasid directory entry */
-	dir = phys_to_virt(ctx_entry->lo & VTD_PAGE_MASK);
-	if (!dir) {
-		pr_info("pasid directory entry is not present\n");
+	if (!context_present(ctx_entry)) {
+		pr_info("pasid directory table is not present\n");
 		return;
 	}
+
+	/* get the pointer to pasid directory entry */
+	dir = phys_to_virt(ctx_entry->lo & VTD_PAGE_MASK);
+
 	/* For request-without-pasid, get the pasid from context entry */
 	if (intel_iommu_sm && pasid == IOMMU_PASID_INVALID)
 		pasid = IOMMU_NO_PASID;
@@ -745,7 +837,7 @@
 	/* get the pointer to the pasid table entry */
 	entries = get_pasid_table_from_pde(pde);
 	if (!entries) {
-		pr_info("pasid table entry is not present\n");
+		pr_info("pasid table is not present\n");
 		return;
 	}
 	index = pasid & PASID_PTE_MASK;
@@ -753,6 +845,11 @@
 	for (i = 0; i < ARRAY_SIZE(pte->val); i++)
 		pr_info("pasid table entry[%d]: 0x%016llx\n", i, pte->val[i]);
 
+	if (!pasid_pte_is_present(pte)) {
+		pr_info("scalable mode page table is not present\n");
+		return;
+	}
+
 	if (pasid_pte_get_pgtt(pte) == PASID_ENTRY_PGTT_FL_ONLY) {
 		level = pte->val[2] & BIT_ULL(2) ? 5 : 4;
 		pgtable = phys_to_virt(pte->val[2] & VTD_PAGE_MASK);
@@ -801,7 +898,7 @@
 			domain_flush_cache(domain, tmp_page, VTD_PAGE_SIZE);
 			pteval = ((uint64_t)virt_to_dma_pfn(tmp_page) << VTD_PAGE_SHIFT) | DMA_PTE_READ | DMA_PTE_WRITE;
 			if (domain->use_first_level)
-				pteval |= DMA_FL_PTE_XD | DMA_FL_PTE_US | DMA_FL_PTE_ACCESS;
+				pteval |= DMA_FL_PTE_US | DMA_FL_PTE_ACCESS;
 
 			if (cmpxchg64(&pte->val, 0ULL, pteval))
 				/* Someone else set it while we were thinking; use theirs. */
@@ -1596,10 +1693,10 @@
 	 * entry for first-level or pass-through translation modes should
 	 * be programmed with a domain id different from those used for
 	 * second-level or nested translation. We reserve a domain id for
-	 * this purpose.
+	 * this purpose. This domain id is also used for identity domain
+	 * in legacy mode.
 	 */
-	if (sm_supported(iommu))
-		set_bit(FLPT_DEFAULT_DID, iommu->domain_ids);
+	set_bit(FLPT_DEFAULT_DID, iommu->domain_ids);
 
 	return 0;
 }
@@ -2071,7 +2168,7 @@
 	attr = prot & (DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP);
 	attr |= DMA_FL_PTE_PRESENT;
 	if (domain->use_first_level) {
-		attr |= DMA_FL_PTE_XD | DMA_FL_PTE_US | DMA_FL_PTE_ACCESS;
+		attr |= DMA_FL_PTE_US | DMA_FL_PTE_ACCESS;
 		if (prot & DMA_PTE_WRITE)
 			attr |= DMA_FL_PTE_DIRTY;
 	}
@@ -2283,7 +2380,7 @@
 		for_each_mem_pfn_range(i, nid, &start_pfn, &end_pfn, NULL) {
 			ret = iommu_domain_identity_map(si_domain,
 					mm_to_dma_pfn_start(start_pfn),
-					mm_to_dma_pfn_end(end_pfn));
+					mm_to_dma_pfn_end(end_pfn-1));
 			if (ret)
 				return ret;
 		}
@@ -2412,6 +2509,9 @@
 
 		if ((iommu_identity_mapping & IDENTMAP_GFX) && IS_GFX_DEVICE(pdev))
 			return IOMMU_DOMAIN_IDENTITY;
+
+		if ((iommu_identity_mapping & IDENTMAP_IPU) && IS_INTEL_IPU(pdev))
+			return IOMMU_DOMAIN_IDENTITY;
 	}
 
 	return 0;
@@ -2719,6 +2819,9 @@
 	if (!dmar_map_gfx)
 		iommu_identity_mapping |= IDENTMAP_GFX;
 
+	if (!dmar_map_ipu)
+		iommu_identity_mapping |= IDENTMAP_IPU;
+
 	check_tylersburg_isoch();
 
 	ret = si_domain_init(hw_pass_through);
@@ -3792,37 +3895,15 @@
  */
 static void domain_context_clear(struct device_domain_info *info)
 {
-	if (!dev_is_pci(info->dev))
+	if (!dev_is_pci(info->dev)) {
 		domain_context_clear_one(info, info->bus, info->devfn);
+		return;
+	}
 
 	pci_for_each_dma_alias(to_pci_dev(info->dev),
 			       &domain_context_clear_one_cb, info);
 }
 
-static void dmar_remove_one_dev_info(struct device *dev)
-{
-	struct device_domain_info *info = dev_iommu_priv_get(dev);
-	struct dmar_domain *domain = info->domain;
-	struct intel_iommu *iommu = info->iommu;
-	unsigned long flags;
-
-	if (!dev_is_real_dma_subdevice(info->dev)) {
-		if (dev_is_pci(info->dev) && sm_supported(iommu))
-			intel_pasid_tear_down_entry(iommu, info->dev,
-					IOMMU_NO_PASID, false);
-
-		iommu_disable_pci_caps(info);
-		domain_context_clear(info);
-	}
-
-	spin_lock_irqsave(&domain->lock, flags);
-	list_del(&info->link);
-	spin_unlock_irqrestore(&domain->lock, flags);
-
-	domain_detach_iommu(domain, iommu);
-	info->domain = NULL;
-}
-
 /*
  * Clear the page table pointer in context or pasid table entries so that
  * all DMA requests without PASID from the device are blocked. If the page
@@ -4330,26 +4411,45 @@
 	}
 
 	dev_iommu_priv_set(dev, info);
+	if (pdev && pci_ats_supported(pdev)) {
+		ret = device_rbtree_insert(iommu, info);
+		if (ret)
+			goto free;
+	}
 
 	if (sm_supported(iommu) && !dev_is_real_dma_subdevice(dev)) {
 		ret = intel_pasid_alloc_table(dev);
 		if (ret) {
 			dev_err(dev, "PASID table allocation failed\n");
-			kfree(info);
-			return ERR_PTR(ret);
+			goto clear_rbtree;
 		}
 	}
 
 	intel_iommu_debugfs_create_dev(info);
 
 	return &iommu->iommu;
+clear_rbtree:
+	device_rbtree_remove(info);
+free:
+	kfree(info);
+
+	return ERR_PTR(ret);
 }
 
 static void intel_iommu_release_device(struct device *dev)
 {
 	struct device_domain_info *info = dev_iommu_priv_get(dev);
+	struct intel_iommu *iommu = info->iommu;
+
+	mutex_lock(&iommu->iopf_lock);
+	if (dev_is_pci(dev) && pci_ats_supported(to_pci_dev(dev)))
+		device_rbtree_remove(info);
+	mutex_unlock(&iommu->iopf_lock);
+
+	if (sm_supported(iommu) && !dev_is_real_dma_subdevice(dev) &&
+	    !context_copied(iommu, info->bus, info->devfn))
+		intel_pasid_teardown_sm_context(dev);
 
-	dmar_remove_one_dev_info(dev);
 	intel_pasid_free_table(dev);
 	intel_iommu_debugfs_remove_dev(info);
 	kfree(info);
@@ -4855,6 +4955,7 @@
 
 const struct iommu_ops intel_iommu_ops = {
 	.blocked_domain		= &blocking_domain,
+	.release_domain		= &blocking_domain,
 	.capable		= intel_iommu_capable,
 	.hw_info		= intel_iommu_hw_info,
 	.domain_alloc		= intel_iommu_domain_alloc,
@@ -4896,6 +4997,18 @@
 	dmar_map_gfx = 0;
 }
 
+static void quirk_iommu_ipu(struct pci_dev *dev)
+{
+	if (!IS_INTEL_IPU(dev))
+		return;
+
+	if (risky_device(dev))
+		return;
+
+	pci_info(dev, "Passthrough IOMMU for integrated Intel IPU\n");
+	dmar_map_ipu = 0;
+}
+
 /* G4x/GM45 integrated gfx dmar support is totally busted. */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_igfx);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_igfx);
@@ -4931,6 +5044,77 @@
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163A, quirk_iommu_igfx);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx);
 
+/* SKL */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1906, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1913, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x190E, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1915, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1902, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x190A, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x190B, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1917, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1916, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1921, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x191E, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1912, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x191A, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x191B, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x191D, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1923, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1926, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1927, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x192A, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x192B, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x192D, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1932, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x193A, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x193B, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x193D, quirk_iommu_igfx);
+
+/* KBL */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5902, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5906, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5908, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x590A, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x590B, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x590E, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5912, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5913, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5915, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5916, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5917, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x591A, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x591B, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x591D, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x591E, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5921, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5923, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5926, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5927, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x593B, quirk_iommu_igfx);
+
+/* CML */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9B21, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BA2, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BA4, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BA5, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BA8, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BAA, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BAC, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BC2, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BC4, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BC5, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BC6, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BC8, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BE6, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BF6, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9B41, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BCA, quirk_iommu_igfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9BCC, quirk_iommu_igfx);
+
+/* disable IPU dmar support */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_iommu_ipu);
+
 static void quirk_iommu_rwbf(struct pci_dev *dev)
 {
 	if (risky_device(dev))
--- linux-qcom-6.8.0.orig/drivers/iommu/intel/iommu.h
+++ linux-qcom-6.8.0/drivers/iommu/intel/iommu.h
@@ -47,7 +47,6 @@
 #define DMA_FL_PTE_US		BIT_ULL(2)
 #define DMA_FL_PTE_ACCESS	BIT_ULL(5)
 #define DMA_FL_PTE_DIRTY	BIT_ULL(6)
-#define DMA_FL_PTE_XD		BIT_ULL(63)
 
 #define DMA_SL_PTE_DIRTY_BIT	9
 #define DMA_SL_PTE_DIRTY	BIT_ULL(DMA_SL_PTE_DIRTY_BIT)
@@ -719,9 +718,16 @@
 #endif
 	struct iopf_queue *iopf_queue;
 	unsigned char iopfq_name[16];
+	/* Synchronization between fault report and iommu device release. */
+	struct mutex iopf_lock;
 	struct q_inval  *qi;            /* Queued invalidation info */
 	u32 iommu_state[MAX_SR_DMAR_REGS]; /* Store iommu states between suspend and resume.*/
 
+	/* rb tree for all probed devices */
+	struct rb_root device_rbtree;
+	/* protect the device_rbtree */
+	spinlock_t device_rbtree_lock;
+
 #ifdef CONFIG_IRQ_REMAP
 	struct ir_table *ir_table;	/* Interrupt remapping info */
 	struct irq_domain *ir_domain;
@@ -755,6 +761,8 @@
 	struct intel_iommu *iommu; /* IOMMU used by this device */
 	struct dmar_domain *domain; /* pointer to domain */
 	struct pasid_table *pasid_table; /* pasid table */
+	/* device tracking node(lookup by PCI RID) */
+	struct rb_node node;
 #ifdef CONFIG_INTEL_IOMMU_DEBUGFS
 	struct dentry *debugfs_dentry; /* pointer to device directory dentry */
 #endif
@@ -813,11 +821,10 @@
 static inline u64 dma_pte_addr(struct dma_pte *pte)
 {
 #ifdef CONFIG_64BIT
-	return pte->val & VTD_PAGE_MASK & (~DMA_FL_PTE_XD);
+	return pte->val & VTD_PAGE_MASK;
 #else
 	/* Must have a full atomic 64-bit read */
-	return  __cmpxchg64(&pte->val, 0ULL, 0ULL) &
-			VTD_PAGE_MASK & (~DMA_FL_PTE_XD);
+	return  __cmpxchg64(&pte->val, 0ULL, 0ULL) & VTD_PAGE_MASK;
 #endif
 }
 
@@ -1081,6 +1088,7 @@
 void iommu_flush_write_buffer(struct intel_iommu *iommu);
 struct iommu_domain *intel_nested_domain_alloc(struct iommu_domain *parent,
 					       const struct iommu_user_data *user_data);
+struct device *device_rbtree_find(struct intel_iommu *iommu, u16 rid);
 
 #ifdef CONFIG_INTEL_IOMMU_SVM
 void intel_svm_check(struct intel_iommu *iommu);
--- linux-qcom-6.8.0.orig/drivers/iommu/intel/pasid.c
+++ linux-qcom-6.8.0/drivers/iommu/intel/pasid.c
@@ -214,6 +214,9 @@
 	if (!info || !info->ats_enabled)
 		return;
 
+	if (pci_dev_is_disconnected(to_pci_dev(dev)))
+		return;
+
 	sid = info->bus << 8 | info->devfn;
 	qdep = info->ats_qdep;
 	pfsid = info->pfsid;
@@ -258,9 +261,7 @@
 	else
 		iommu->flush.flush_iotlb(iommu, did, 0, 0, DMA_TLB_DSI_FLUSH);
 
-	/* Device IOTLB doesn't need to be flushed in caching mode. */
-	if (!cap_caching_mode(iommu->cap))
-		devtlb_invalidation_with_pasid(iommu, dev, pasid);
+	devtlb_invalidation_with_pasid(iommu, dev, pasid);
 }
 
 /*
@@ -330,7 +331,6 @@
 	pasid_set_domain_id(pte, did);
 	pasid_set_address_width(pte, iommu->agaw);
 	pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap));
-	pasid_set_nxe(pte);
 
 	/* Setup Present and PASID Granular Transfer Type: */
 	pasid_set_translation_type(pte, PASID_ENTRY_PGTT_FL_ONLY);
@@ -488,9 +488,7 @@
 
 	iommu->flush.flush_iotlb(iommu, did, 0, 0, DMA_TLB_DSI_FLUSH);
 
-	/* Device IOTLB doesn't need to be flushed in caching mode. */
-	if (!cap_caching_mode(iommu->cap))
-		devtlb_invalidation_with_pasid(iommu, dev, pasid);
+	devtlb_invalidation_with_pasid(iommu, dev, pasid);
 
 	return 0;
 }
@@ -567,9 +565,7 @@
 	pasid_cache_invalidation_with_pasid(iommu, did, pasid);
 	qi_flush_piotlb(iommu, did, pasid, 0, -1, 0);
 
-	/* Device IOTLB doesn't need to be flushed in caching mode. */
-	if (!cap_caching_mode(iommu->cap))
-		devtlb_invalidation_with_pasid(iommu, dev, pasid);
+	devtlb_invalidation_with_pasid(iommu, dev, pasid);
 }
 
 /**
@@ -667,3 +663,67 @@
 
 	return 0;
 }
+
+/*
+ * Interfaces to setup or teardown a pasid table to the scalable-mode
+ * context table entry:
+ */
+
+static void device_pasid_table_teardown(struct device *dev, u8 bus, u8 devfn)
+{
+	struct device_domain_info *info = dev_iommu_priv_get(dev);
+	struct intel_iommu *iommu = info->iommu;
+	struct context_entry *context;
+
+	spin_lock(&iommu->lock);
+	context = iommu_context_addr(iommu, bus, devfn, false);
+	if (!context) {
+		spin_unlock(&iommu->lock);
+		return;
+	}
+
+	context_clear_entry(context);
+	__iommu_flush_cache(iommu, context, sizeof(*context));
+	spin_unlock(&iommu->lock);
+
+	/*
+	 * Cache invalidation for changes to a scalable-mode context table
+	 * entry.
+	 *
+	 * Section 6.5.3.3 of the VT-d spec:
+	 * - Device-selective context-cache invalidation;
+	 * - Domain-selective PASID-cache invalidation to affected domains
+	 *   (can be skipped if all PASID entries were not-present);
+	 * - Domain-selective IOTLB invalidation to affected domains;
+	 * - Global Device-TLB invalidation to affected functions.
+	 *
+	 * The iommu has been parked in the blocking state. All domains have
+	 * been detached from the device or PASID. The PASID and IOTLB caches
+	 * have been invalidated during the domain detach path.
+	 */
+	iommu->flush.flush_context(iommu, 0, PCI_DEVID(bus, devfn),
+				   DMA_CCMD_MASK_NOBIT, DMA_CCMD_DEVICE_INVL);
+	devtlb_invalidation_with_pasid(iommu, dev, IOMMU_NO_PASID);
+}
+
+static int pci_pasid_table_teardown(struct pci_dev *pdev, u16 alias, void *data)
+{
+	struct device *dev = data;
+
+	if (dev == &pdev->dev)
+		device_pasid_table_teardown(dev, PCI_BUS_NUM(alias), alias & 0xff);
+
+	return 0;
+}
+
+void intel_pasid_teardown_sm_context(struct device *dev)
+{
+	struct device_domain_info *info = dev_iommu_priv_get(dev);
+
+	if (!dev_is_pci(dev)) {
+		device_pasid_table_teardown(dev, info->bus, info->devfn);
+		return;
+	}
+
+	pci_for_each_dma_alias(to_pci_dev(dev), pci_pasid_table_teardown, dev);
+}
--- linux-qcom-6.8.0.orig/drivers/iommu/intel/pasid.h
+++ linux-qcom-6.8.0/drivers/iommu/intel/pasid.h
@@ -248,16 +248,6 @@
 }
 
 /*
- * Setup No Execute Enable bit (Bit 133) of a scalable mode PASID
- * entry. It is required when XD bit of the first level page table
- * entry is about to be set.
- */
-static inline void pasid_set_nxe(struct pasid_entry *pe)
-{
-	pasid_set_bits(&pe->val[2], 1 << 5, 1 << 5);
-}
-
-/*
  * Setup the Page Snoop (PGSNP) field (Bit 88) of a scalable mode
  * PASID entry.
  */
@@ -318,4 +308,5 @@
 				 bool fault_ignore);
 void intel_pasid_setup_page_snoop_control(struct intel_iommu *iommu,
 					  struct device *dev, u32 pasid);
+void intel_pasid_teardown_sm_context(struct device *dev);
 #endif /* __INTEL_PASID_H */
--- linux-qcom-6.8.0.orig/drivers/iommu/intel/perfmon.c
+++ linux-qcom-6.8.0/drivers/iommu/intel/perfmon.c
@@ -438,7 +438,7 @@
 	iommu_pmu_set_filter(domain, event->attr.config1,
 			     IOMMU_PMU_FILTER_DOMAIN, idx,
 			     event->attr.config1);
-	iommu_pmu_set_filter(pasid, event->attr.config1,
+	iommu_pmu_set_filter(pasid, event->attr.config2,
 			     IOMMU_PMU_FILTER_PASID, idx,
 			     event->attr.config1);
 	iommu_pmu_set_filter(ats, event->attr.config2,
--- linux-qcom-6.8.0.orig/drivers/iommu/intel/svm.c
+++ linux-qcom-6.8.0/drivers/iommu/intel/svm.c
@@ -67,7 +67,7 @@
 	struct page *pages;
 	int irq, ret;
 
-	pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, PRQ_ORDER);
+	pages = alloc_pages_node(iommu->node, GFP_KERNEL | __GFP_ZERO, PRQ_ORDER);
 	if (!pages) {
 		pr_warn("IOMMU: %s: Failed to allocate page request queue\n",
 			iommu->name);
@@ -650,7 +650,7 @@
 	struct intel_iommu *iommu = d;
 	struct page_req_dsc *req;
 	int head, tail, handled;
-	struct pci_dev *pdev;
+	struct device *dev;
 	u64 address;
 
 	/*
@@ -696,23 +696,24 @@
 		if (unlikely(req->lpig && !req->rd_req && !req->wr_req))
 			goto prq_advance;
 
-		pdev = pci_get_domain_bus_and_slot(iommu->segment,
-						   PCI_BUS_NUM(req->rid),
-						   req->rid & 0xff);
 		/*
 		 * If prq is to be handled outside iommu driver via receiver of
 		 * the fault notifiers, we skip the page response here.
 		 */
-		if (!pdev)
+		mutex_lock(&iommu->iopf_lock);
+		dev = device_rbtree_find(iommu, req->rid);
+		if (!dev) {
+			mutex_unlock(&iommu->iopf_lock);
 			goto bad_req;
+		}
 
-		if (intel_svm_prq_report(iommu, &pdev->dev, req))
+		if (intel_svm_prq_report(iommu, dev, req))
 			handle_bad_prq_event(iommu, req, QI_RESP_INVALID);
 		else
-			trace_prq_report(iommu, &pdev->dev, req->qw_0, req->qw_1,
+			trace_prq_report(iommu, dev, req->qw_0, req->qw_1,
 					 req->priv_data[0], req->priv_data[1],
 					 iommu->prq_seq_number++);
-		pci_dev_put(pdev);
+		mutex_unlock(&iommu->iopf_lock);
 prq_advance:
 		head = (head + sizeof(*req)) & PRQ_RING_MASK;
 	}
--- linux-qcom-6.8.0.orig/drivers/iommu/io-pgtable-arm-v7s.c
+++ linux-qcom-6.8.0/drivers/iommu/io-pgtable-arm-v7s.c
@@ -552,9 +552,8 @@
 		    paddr >= (1ULL << data->iop.cfg.oas)))
 		return -ERANGE;
 
-	/* If no access, then nothing to do */
 	if (!(prot & (IOMMU_READ | IOMMU_WRITE)))
-		return 0;
+		return -EINVAL;
 
 	while (pgcount--) {
 		ret = __arm_v7s_map(data, iova, paddr, pgsize, prot, 1, data->pgd,
--- linux-qcom-6.8.0.orig/drivers/iommu/io-pgtable-arm.c
+++ linux-qcom-6.8.0/drivers/iommu/io-pgtable-arm.c
@@ -180,6 +180,18 @@
 	return (paddr | (paddr << (48 - 12))) & (ARM_LPAE_PTE_ADDR_MASK << 4);
 }
 
+/*
+ * Convert an index returned by ARM_LPAE_PGD_IDX(), which can point into
+ * a concatenated PGD, into the maximum number of entries that can be
+ * mapped in the same table page.
+ */
+static inline int arm_lpae_max_entries(int i, struct arm_lpae_io_pgtable *data)
+{
+	int ptes_per_table = ARM_LPAE_PTES_PER_TABLE(data);
+
+	return ptes_per_table - (i & (ptes_per_table - 1));
+}
+
 static bool selftest_running = false;
 
 static dma_addr_t __arm_lpae_dma_addr(void *pages)
@@ -375,7 +387,7 @@
 
 	/* If we can install a leaf entry at this level, then do so */
 	if (size == block_size) {
-		max_entries = ARM_LPAE_PTES_PER_TABLE(data) - map_idx_start;
+		max_entries = arm_lpae_max_entries(map_idx_start, data);
 		num_entries = min_t(int, pgcount, max_entries);
 		ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, num_entries, ptep);
 		if (!ret)
@@ -498,9 +510,8 @@
 	if (WARN_ON(iaext || paddr >> cfg->oas))
 		return -ERANGE;
 
-	/* If no access, then nothing to do */
 	if (!(iommu_prot & (IOMMU_READ | IOMMU_WRITE)))
-		return 0;
+		return -EINVAL;
 
 	prot = arm_lpae_prot_to_pte(data, iommu_prot);
 	ret = __arm_lpae_map(data, iova, paddr, pgsize, pgcount, prot, lvl,
@@ -576,7 +587,7 @@
 
 	if (size == split_sz) {
 		unmap_idx_start = ARM_LPAE_LVL_IDX(iova, lvl, data);
-		max_entries = ptes_per_table - unmap_idx_start;
+		max_entries = arm_lpae_max_entries(unmap_idx_start, data);
 		num_entries = min_t(int, pgcount, max_entries);
 	}
 
@@ -634,7 +645,7 @@
 
 	/* If the size matches this level, we're in the right place */
 	if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) {
-		max_entries = ARM_LPAE_PTES_PER_TABLE(data) - unmap_idx_start;
+		max_entries = arm_lpae_max_entries(unmap_idx_start, data);
 		num_entries = min_t(int, pgcount, max_entries);
 
 		while (i < num_entries) {
--- linux-qcom-6.8.0.orig/drivers/iommu/io-pgtable-dart.c
+++ linux-qcom-6.8.0/drivers/iommu/io-pgtable-dart.c
@@ -250,9 +250,8 @@
 	if (WARN_ON(paddr >> cfg->oas))
 		return -ERANGE;
 
-	/* If no access, then nothing to do */
 	if (!(iommu_prot & (IOMMU_READ | IOMMU_WRITE)))
-		return 0;
+		return -EINVAL;
 
 	tbl = dart_get_table(data, iova);
 
--- linux-qcom-6.8.0.orig/drivers/iommu/iommu.c
+++ linux-qcom-6.8.0/drivers/iommu/iommu.c
@@ -463,13 +463,24 @@
 
 	/*
 	 * release_device() must stop using any attached domain on the device.
-	 * If there are still other devices in the group they are not effected
+	 * If there are still other devices in the group, they are not affected
 	 * by this callback.
 	 *
-	 * The IOMMU driver must set the device to either an identity or
-	 * blocking translation and stop using any domain pointer, as it is
-	 * going to be freed.
+	 * If the iommu driver provides release_domain, the core code ensures
+	 * that domain is attached prior to calling release_device. Drivers can
+	 * use this to enforce a translation on the idle iommu. Typically, the
+	 * global static blocked_domain is a good choice.
+	 *
+	 * Otherwise, the iommu driver must set the device to either an identity
+	 * or a blocking translation in release_device() and stop using any
+	 * domain pointer, as it is going to be freed.
+	 *
+	 * Regardless, if a delayed attach never occurred, then the release
+	 * should still avoid touching any hardware configuration either.
 	 */
+	if (!dev->iommu->attach_deferred && ops->release_domain)
+		ops->release_domain->ops->attach_dev(ops->release_domain, dev);
+
 	if (ops->release_device)
 		ops->release_device(dev);
 
@@ -3499,15 +3510,26 @@
 static int __iommu_set_group_pasid(struct iommu_domain *domain,
 				   struct iommu_group *group, ioasid_t pasid)
 {
-	struct group_device *device;
-	int ret = 0;
+	struct group_device *device, *last_gdev;
+	int ret;
 
 	for_each_group_device(group, device) {
 		ret = domain->ops->set_dev_pasid(domain, device->dev, pasid);
 		if (ret)
-			break;
+			goto err_revert;
 	}
 
+	return 0;
+
+err_revert:
+	last_gdev = device;
+	for_each_group_device(group, device) {
+		const struct iommu_ops *ops = dev_iommu_ops(device->dev);
+
+		if (device == last_gdev)
+			break;
+		ops->remove_dev_pasid(device->dev, pasid);
+	}
 	return ret;
 }
 
@@ -3536,6 +3558,7 @@
 {
 	/* Caller must be a probed driver on dev */
 	struct iommu_group *group = dev->iommu_group;
+	struct group_device *device;
 	void *curr;
 	int ret;
 
@@ -3545,10 +3568,18 @@
 	if (!group)
 		return -ENODEV;
 
-	if (!dev_has_iommu(dev) || dev_iommu_ops(dev) != domain->owner)
+	if (!dev_has_iommu(dev) || dev_iommu_ops(dev) != domain->owner ||
+	    pasid == IOMMU_NO_PASID)
 		return -EINVAL;
 
 	mutex_lock(&group->mutex);
+	for_each_group_device(group, device) {
+		if (pasid >= device->dev->iommu->max_pasids) {
+			ret = -EINVAL;
+			goto out_unlock;
+		}
+	}
+
 	curr = xa_cmpxchg(&group->pasid_array, pasid, NULL, domain, GFP_KERNEL);
 	if (curr) {
 		ret = xa_err(curr) ? : -EBUSY;
@@ -3556,10 +3587,8 @@
 	}
 
 	ret = __iommu_set_group_pasid(domain, group, pasid);
-	if (ret) {
-		__iommu_remove_group_pasid(group, pasid);
+	if (ret)
 		xa_erase(&group->pasid_array, pasid);
-	}
 out_unlock:
 	mutex_unlock(&group->mutex);
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/iommu/iommufd/Kconfig
+++ linux-qcom-6.8.0/drivers/iommu/iommufd/Kconfig
@@ -37,6 +37,7 @@
 	depends on DEBUG_KERNEL
 	depends on FAULT_INJECTION
 	depends on RUNTIME_TESTING_MENU
+	select IOMMUFD_DRIVER
 	default n
 	help
 	  This is dangerous, do not enable unless running
--- linux-qcom-6.8.0.orig/drivers/iommu/iommufd/device.c
+++ linux-qcom-6.8.0/drivers/iommu/iommufd/device.c
@@ -525,7 +525,7 @@
 err_unresv:
 	if (hwpt_is_paging(hwpt))
 		iommufd_group_remove_reserved_iova(igroup,
-						   to_hwpt_paging(old_hwpt));
+						   to_hwpt_paging(hwpt));
 err_unlock:
 	mutex_unlock(&idev->igroup->lock);
 	return ERR_PTR(rc);
--- linux-qcom-6.8.0.orig/drivers/iommu/iommufd/hw_pagetable.c
+++ linux-qcom-6.8.0/drivers/iommu/iommufd/hw_pagetable.c
@@ -215,7 +215,8 @@
 
 	if (flags || !user_data->len || !ops->domain_alloc_user)
 		return ERR_PTR(-EOPNOTSUPP);
-	if (parent->auto_domain || !parent->nest_parent)
+	if (parent->auto_domain || !parent->nest_parent ||
+	    parent->common.domain->owner != ops)
 		return ERR_PTR(-EINVAL);
 
 	hwpt_nested = __iommufd_object_alloc(
@@ -236,7 +237,8 @@
 	}
 	hwpt->domain->owner = ops;
 
-	if (WARN_ON_ONCE(hwpt->domain->type != IOMMU_DOMAIN_NESTED)) {
+	if (WARN_ON_ONCE(hwpt->domain->type != IOMMU_DOMAIN_NESTED ||
+			 !hwpt->domain->ops->cache_invalidate_user)) {
 		rc = -EINVAL;
 		goto out_abort;
 	}
--- linux-qcom-6.8.0.orig/drivers/iommu/iommufd/io_pagetable.c
+++ linux-qcom-6.8.0/drivers/iommu/iommufd/io_pagetable.c
@@ -112,6 +112,7 @@
 	unsigned long page_offset = uptr % PAGE_SIZE;
 	struct interval_tree_double_span_iter used_span;
 	struct interval_tree_span_iter allowed_span;
+	unsigned long max_alignment = PAGE_SIZE;
 	unsigned long iova_alignment;
 
 	lockdep_assert_held(&iopt->iova_rwsem);
@@ -131,6 +132,13 @@
 				       roundup_pow_of_two(length),
 				       1UL << __ffs64(uptr));
 
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+	max_alignment = HPAGE_SIZE;
+#endif
+	/* Protect against ALIGN() overflow */
+	if (iova_alignment >= max_alignment)
+		iova_alignment = max_alignment;
+
 	if (iova_alignment < iopt->iova_alignment)
 		return -EINVAL;
 
--- linux-qcom-6.8.0.orig/drivers/iommu/iommufd/ioas.c
+++ linux-qcom-6.8.0/drivers/iommu/iommufd/ioas.c
@@ -213,6 +213,10 @@
 	if (cmd->iova >= ULONG_MAX || cmd->length >= ULONG_MAX)
 		return -EOVERFLOW;
 
+	if (!(cmd->flags &
+	      (IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE)))
+		return -EINVAL;
+
 	ioas = iommufd_get_ioas(ucmd->ictx, cmd->ioas_id);
 	if (IS_ERR(ioas))
 		return PTR_ERR(ioas);
@@ -253,6 +257,10 @@
 	    cmd->dst_iova >= ULONG_MAX)
 		return -EOVERFLOW;
 
+	if (!(cmd->flags &
+	      (IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE)))
+		return -EINVAL;
+
 	src_ioas = iommufd_get_ioas(ucmd->ictx, cmd->src_ioas_id);
 	if (IS_ERR(src_ioas))
 		return PTR_ERR(src_ioas);
--- linux-qcom-6.8.0.orig/drivers/iommu/iommufd/iova_bitmap.c
+++ linux-qcom-6.8.0/drivers/iommu/iommufd/iova_bitmap.c
@@ -384,8 +384,6 @@
 	bitmap->mapped_base_index += count;
 
 	iova_bitmap_put(bitmap);
-	if (iova_bitmap_done(bitmap))
-		return 0;
 
 	/* Iterate, set and skip any bits requested for next iteration */
 	if (bitmap->set_ahead_length) {
@@ -396,6 +394,9 @@
 			return ret;
 	}
 
+	if (iova_bitmap_done(bitmap))
+		return 0;
+
 	/* When advancing the index we pin the next set of bitmap pages */
 	return iova_bitmap_get(bitmap);
 }
--- linux-qcom-6.8.0.orig/drivers/iommu/iommufd/selftest.c
+++ linux-qcom-6.8.0/drivers/iommu/iommufd/selftest.c
@@ -1313,7 +1313,7 @@
 			      unsigned long page_size, void __user *uptr,
 			      u32 flags)
 {
-	unsigned long bitmap_size, i, max;
+	unsigned long i, max;
 	struct iommu_test_cmd *cmd = ucmd->cmd;
 	struct iommufd_hw_pagetable *hwpt;
 	struct mock_iommu_domain *mock;
@@ -1334,15 +1334,14 @@
 	}
 
 	max = length / page_size;
-	bitmap_size = max / BITS_PER_BYTE;
-
-	tmp = kvzalloc(bitmap_size, GFP_KERNEL_ACCOUNT);
+	tmp = kvzalloc(DIV_ROUND_UP(max, BITS_PER_LONG) * sizeof(unsigned long),
+		       GFP_KERNEL_ACCOUNT);
 	if (!tmp) {
 		rc = -ENOMEM;
 		goto out_put;
 	}
 
-	if (copy_from_user(tmp, uptr, bitmap_size)) {
+	if (copy_from_user(tmp, uptr,DIV_ROUND_UP(max, BITS_PER_BYTE))) {
 		rc = -EFAULT;
 		goto out_free;
 	}
--- linux-qcom-6.8.0.orig/drivers/iommu/irq_remapping.c
+++ linux-qcom-6.8.0/drivers/iommu/irq_remapping.c
@@ -99,7 +99,8 @@
 	if (disable_irq_remap)
 		return -ENOSYS;
 
-	if (intel_irq_remap_ops.prepare() == 0)
+	if (IS_ENABLED(CONFIG_INTEL_IOMMU) &&
+	    intel_irq_remap_ops.prepare() == 0)
 		remap_ops = &intel_irq_remap_ops;
 	else if (IS_ENABLED(CONFIG_AMD_IOMMU) &&
 		 amd_iommu_irq_ops.prepare() == 0)
--- linux-qcom-6.8.0.orig/drivers/iommu/mtk_iommu.c
+++ linux-qcom-6.8.0/drivers/iommu/mtk_iommu.c
@@ -1789,6 +1789,7 @@
 	{ .compatible = "mediatek,mt8365-m4u", .data = &mt8365_data},
 	{}
 };
+MODULE_DEVICE_TABLE(of, mtk_iommu_of_ids);
 
 static struct platform_driver mtk_iommu_driver = {
 	.probe	= mtk_iommu_probe,
--- linux-qcom-6.8.0.orig/drivers/iommu/mtk_iommu_v1.c
+++ linux-qcom-6.8.0/drivers/iommu/mtk_iommu_v1.c
@@ -599,6 +599,7 @@
 	{ .compatible = "mediatek,mt2701-m4u", },
 	{}
 };
+MODULE_DEVICE_TABLE(of, mtk_iommu_v1_of_ids);
 
 static const struct component_master_ops mtk_iommu_v1_com_ops = {
 	.bind		= mtk_iommu_v1_bind,
--- linux-qcom-6.8.0.orig/drivers/iommu/s390-iommu.c
+++ linux-qcom-6.8.0/drivers/iommu/s390-iommu.c
@@ -33,6 +33,8 @@
 	struct rcu_head		rcu;
 };
 
+static struct iommu_domain blocking_domain;
+
 static inline unsigned int calc_rtx(dma_addr_t ptr)
 {
 	return ((unsigned long)ptr >> ZPCI_RT_SHIFT) & ZPCI_INDEX_MASK;
@@ -369,20 +371,36 @@
 	call_rcu(&s390_domain->rcu, s390_iommu_rcu_free_domain);
 }
 
-static void s390_iommu_detach_device(struct iommu_domain *domain,
-				     struct device *dev)
+static void zdev_s390_domain_update(struct zpci_dev *zdev,
+				    struct iommu_domain *domain)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&zdev->dom_lock, flags);
+	zdev->s390_domain = domain;
+	spin_unlock_irqrestore(&zdev->dom_lock, flags);
+}
+
+static int blocking_domain_attach_device(struct iommu_domain *domain,
+					 struct device *dev)
 {
-	struct s390_domain *s390_domain = to_s390_domain(domain);
 	struct zpci_dev *zdev = to_zpci_dev(dev);
+	struct s390_domain *s390_domain;
 	unsigned long flags;
 
+	if (zdev->s390_domain->type == IOMMU_DOMAIN_BLOCKED)
+		return 0;
+
+	s390_domain = to_s390_domain(zdev->s390_domain);
 	spin_lock_irqsave(&s390_domain->list_lock, flags);
 	list_del_rcu(&zdev->iommu_list);
 	spin_unlock_irqrestore(&s390_domain->list_lock, flags);
 
 	zpci_unregister_ioat(zdev, 0);
-	zdev->s390_domain = NULL;
 	zdev->dma_table = NULL;
+	zdev_s390_domain_update(zdev, domain);
+
+	return 0;
 }
 
 static int s390_iommu_attach_device(struct iommu_domain *domain,
@@ -401,20 +419,15 @@
 		domain->geometry.aperture_end < zdev->start_dma))
 		return -EINVAL;
 
-	if (zdev->s390_domain)
-		s390_iommu_detach_device(&zdev->s390_domain->domain, dev);
+	blocking_domain_attach_device(&blocking_domain, dev);
 
+	/* If we fail now DMA remains blocked via blocking domain */
 	cc = zpci_register_ioat(zdev, 0, zdev->start_dma, zdev->end_dma,
 				virt_to_phys(s390_domain->dma_table), &status);
-	/*
-	 * If the device is undergoing error recovery the reset code
-	 * will re-establish the new domain.
-	 */
 	if (cc && status != ZPCI_PCI_ST_FUNC_NOT_AVAIL)
 		return -EIO;
-
 	zdev->dma_table = s390_domain->dma_table;
-	zdev->s390_domain = s390_domain;
+	zdev_s390_domain_update(zdev, domain);
 
 	spin_lock_irqsave(&s390_domain->list_lock, flags);
 	list_add_rcu(&zdev->iommu_list, &s390_domain->devices);
@@ -466,19 +479,11 @@
 	if (zdev->tlb_refresh)
 		dev->iommu->shadow_on_flush = 1;
 
-	return &zdev->iommu_dev;
-}
+	/* Start with DMA blocked */
+	spin_lock_init(&zdev->dom_lock);
+	zdev_s390_domain_update(zdev, &blocking_domain);
 
-static void s390_iommu_release_device(struct device *dev)
-{
-	struct zpci_dev *zdev = to_zpci_dev(dev);
-
-	/*
-	 * release_device is expected to detach any domain currently attached
-	 * to the device, but keep it attached to other devices in the group.
-	 */
-	if (zdev)
-		s390_iommu_detach_device(&zdev->s390_domain->domain, dev);
+	return &zdev->iommu_dev;
 }
 
 static int zpci_refresh_all(struct zpci_dev *zdev)
@@ -702,9 +707,15 @@
 
 struct zpci_iommu_ctrs *zpci_get_iommu_ctrs(struct zpci_dev *zdev)
 {
-	if (!zdev || !zdev->s390_domain)
+	struct s390_domain *s390_domain;
+
+	lockdep_assert_held(&zdev->dom_lock);
+
+	if (zdev->s390_domain->type == IOMMU_DOMAIN_BLOCKED)
 		return NULL;
-	return &zdev->s390_domain->ctrs;
+
+	s390_domain = to_s390_domain(zdev->s390_domain);
+	return &s390_domain->ctrs;
 }
 
 int zpci_init_iommu(struct zpci_dev *zdev)
@@ -781,12 +792,20 @@
 }
 subsys_initcall(s390_iommu_init);
 
+static struct iommu_domain blocking_domain = {
+	.type = IOMMU_DOMAIN_BLOCKED,
+	.ops = &(const struct iommu_domain_ops) {
+		.attach_dev	= blocking_domain_attach_device,
+	}
+};
+
 static const struct iommu_ops s390_iommu_ops = {
+	.blocked_domain		= &blocking_domain,
+	.release_domain		= &blocking_domain,
 	.capable = s390_iommu_capable,
 	.domain_alloc_paging = s390_domain_alloc_paging,
 	.probe_device = s390_iommu_probe_device,
 	.probe_finalize = s390_iommu_probe_finalize,
-	.release_device = s390_iommu_release_device,
 	.device_group = generic_device_group,
 	.pgsize_bitmap = SZ_4K,
 	.get_resv_regions = s390_iommu_get_resv_regions,
--- linux-qcom-6.8.0.orig/drivers/iommu/sprd-iommu.c
+++ linux-qcom-6.8.0/drivers/iommu/sprd-iommu.c
@@ -232,8 +232,8 @@
 
 	pgt_size = sprd_iommu_pgt_size(&dom->domain);
 	dma_free_coherent(dom->sdev->dev, pgt_size, dom->pgt_va, dom->pgt_pa);
-	dom->sdev = NULL;
 	sprd_iommu_hw_en(dom->sdev, false);
+	dom->sdev = NULL;
 }
 
 static void sprd_iommu_domain_free(struct iommu_domain *domain)
--- linux-qcom-6.8.0.orig/drivers/iommu/sun50i-iommu.c
+++ linux-qcom-6.8.0/drivers/iommu/sun50i-iommu.c
@@ -450,6 +450,7 @@
 		    IOMMU_TLB_PREFETCH_MASTER_ENABLE(3) |
 		    IOMMU_TLB_PREFETCH_MASTER_ENABLE(4) |
 		    IOMMU_TLB_PREFETCH_MASTER_ENABLE(5));
+	iommu_write(iommu, IOMMU_BYPASS_REG, 0);
 	iommu_write(iommu, IOMMU_INT_ENABLE_REG, IOMMU_INT_MASK);
 	iommu_write(iommu, IOMMU_DM_AUT_CTRL_REG(SUN50I_IOMMU_ACI_NONE),
 		    IOMMU_DM_AUT_CTRL_RD_UNAVAIL(SUN50I_IOMMU_ACI_NONE, 0) |
--- linux-qcom-6.8.0.orig/drivers/irqchip/Kconfig
+++ linux-qcom-6.8.0/drivers/irqchip/Kconfig
@@ -557,7 +557,7 @@
 	bool
 	select GENERIC_IRQ_CHIP
 	select IRQ_DOMAIN
-	select GENERIC_IRQ_EFFECTIVE_AFF_MASK
+	select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP
 	select LOONGSON_HTVEC
 	select LOONGSON_LIOINTC
 	select LOONGSON_EIOINTC
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-alpine-msi.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-alpine-msi.c
@@ -165,7 +165,7 @@
 	return 0;
 
 err_sgi:
-	irq_domain_free_irqs_parent(domain, virq, i - 1);
+	irq_domain_free_irqs_parent(domain, virq, i);
 	alpine_msix_free_sgi(priv, sgi, nr_irqs);
 	return err;
 }
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-armada-370-xp.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-armada-370-xp.c
@@ -566,6 +566,10 @@
 static int armada_370_xp_mpic_irq_map(struct irq_domain *h,
 				      unsigned int virq, irq_hw_number_t hw)
 {
+	/* IRQs 0 and 1 cannot be mapped, they are handled internally */
+	if (hw <= 1)
+		return -EINVAL;
+
 	armada_370_xp_irq_mask(irq_get_irq_data(virq));
 	if (!is_percpu_irq(hw))
 		writel(hw, per_cpu_int_base +
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-gic-v2m.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-gic-v2m.c
@@ -438,12 +438,12 @@
 
 		ret = gicv2m_init_one(&child->fwnode, spi_start, nr_spis,
 				      &res, 0);
-		if (ret) {
-			of_node_put(child);
+		if (ret)
 			break;
-		}
 	}
 
+	if (ret && child)
+		of_node_put(child);
 	if (!ret)
 		ret = gicv2m_allocate_domains(parent);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-gic-v3-its.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-gic-v3-its.c
@@ -43,6 +43,7 @@
 #define ITS_FLAGS_WORKAROUND_CAVIUM_22375	(1ULL << 1)
 #define ITS_FLAGS_WORKAROUND_CAVIUM_23144	(1ULL << 2)
 #define ITS_FLAGS_FORCE_NON_SHAREABLE		(1ULL << 3)
+#define ITS_FLAGS_WORKAROUND_HISILICON_162100801	(1ULL << 4)
 
 #define RD_LOCAL_LPI_ENABLED                    BIT(0)
 #define RD_LOCAL_PENDTABLE_PREALLOCATED         BIT(1)
@@ -61,6 +62,8 @@
 
 #define LPI_PROP_DEFAULT_PRIO	GICD_INT_DEF_PRI
 
+static struct its_node *find_4_1_its(void);
+
 /*
  * Collection structure - just an ID, and a redistributor address to
  * ping. We use one per CPU as a bag of interrupts assigned to this
@@ -786,6 +789,7 @@
 					   struct its_cmd_block *cmd,
 					   struct its_cmd_desc *desc)
 {
+	struct its_vpe *vpe = valid_vpe(its, desc->its_vmapp_cmd.vpe);
 	unsigned long vpt_addr, vconf_addr;
 	u64 target;
 	bool alloc;
@@ -795,9 +799,14 @@
 	its_encode_valid(cmd, desc->its_vmapp_cmd.valid);
 
 	if (!desc->its_vmapp_cmd.valid) {
+		alloc = !atomic_dec_return(&desc->its_vmapp_cmd.vpe->vmapp_count);
 		if (is_v4_1(its)) {
-			alloc = !atomic_dec_return(&desc->its_vmapp_cmd.vpe->vmapp_count);
 			its_encode_alloc(cmd, alloc);
+			/*
+			 * Unmapping a VPE is self-synchronizing on GICv4.1,
+			 * no need to issue a VSYNC.
+			 */
+			vpe = NULL;
 		}
 
 		goto out;
@@ -810,13 +819,13 @@
 	its_encode_vpt_addr(cmd, vpt_addr);
 	its_encode_vpt_size(cmd, LPI_NRBITS - 1);
 
+	alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count);
+
 	if (!is_v4_1(its))
 		goto out;
 
 	vconf_addr = virt_to_phys(page_address(desc->its_vmapp_cmd.vpe->its_vm->vprop_page));
 
-	alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count);
-
 	its_encode_alloc(cmd, alloc);
 
 	/*
@@ -832,7 +841,7 @@
 out:
 	its_fixup_cmd(cmd);
 
-	return valid_vpe(its, desc->its_vmapp_cmd.vpe);
+	return vpe;
 }
 
 static struct its_vpe *its_build_vmapti_cmd(struct its_node *its,
@@ -1840,28 +1849,22 @@
 {
 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
 	u32 event = its_get_event_id(d);
-	int ret = 0;
 
 	if (!info->map)
 		return -EINVAL;
 
-	raw_spin_lock(&its_dev->event_map.vlpi_lock);
-
 	if (!its_dev->event_map.vm) {
 		struct its_vlpi_map *maps;
 
 		maps = kcalloc(its_dev->event_map.nr_lpis, sizeof(*maps),
 			       GFP_ATOMIC);
-		if (!maps) {
-			ret = -ENOMEM;
-			goto out;
-		}
+		if (!maps)
+			return -ENOMEM;
 
 		its_dev->event_map.vm = info->map->vm;
 		its_dev->event_map.vlpi_maps = maps;
 	} else if (its_dev->event_map.vm != info->map->vm) {
-		ret = -EINVAL;
-		goto out;
+		return -EINVAL;
 	}
 
 	/* Get our private copy of the mapping information */
@@ -1893,46 +1896,32 @@
 		its_dev->event_map.nr_vlpis++;
 	}
 
-out:
-	raw_spin_unlock(&its_dev->event_map.vlpi_lock);
-	return ret;
+	return 0;
 }
 
 static int its_vlpi_get(struct irq_data *d, struct its_cmd_info *info)
 {
 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
 	struct its_vlpi_map *map;
-	int ret = 0;
-
-	raw_spin_lock(&its_dev->event_map.vlpi_lock);
 
 	map = get_vlpi_map(d);
 
-	if (!its_dev->event_map.vm || !map) {
-		ret = -EINVAL;
-		goto out;
-	}
+	if (!its_dev->event_map.vm || !map)
+		return -EINVAL;
 
 	/* Copy our mapping information to the incoming request */
 	*info->map = *map;
 
-out:
-	raw_spin_unlock(&its_dev->event_map.vlpi_lock);
-	return ret;
+	return 0;
 }
 
 static int its_vlpi_unmap(struct irq_data *d)
 {
 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
 	u32 event = its_get_event_id(d);
-	int ret = 0;
 
-	raw_spin_lock(&its_dev->event_map.vlpi_lock);
-
-	if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d)) {
-		ret = -EINVAL;
-		goto out;
-	}
+	if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d))
+		return -EINVAL;
 
 	/* Drop the virtual mapping */
 	its_send_discard(its_dev, event);
@@ -1956,9 +1945,7 @@
 		kfree(its_dev->event_map.vlpi_maps);
 	}
 
-out:
-	raw_spin_unlock(&its_dev->event_map.vlpi_lock);
-	return ret;
+	return 0;
 }
 
 static int its_vlpi_prop_update(struct irq_data *d, struct its_cmd_info *info)
@@ -1986,6 +1973,8 @@
 	if (!is_v4(its_dev->its))
 		return -EINVAL;
 
+	guard(raw_spinlock)(&its_dev->event_map.vlpi_lock);
+
 	/* Unmap request? */
 	if (!info)
 		return its_vlpi_unmap(d);
@@ -3821,14 +3810,36 @@
 	raw_spin_unlock_irqrestore(&vpe_proxy.lock, flags);
 }
 
+static void its_vpe_4_1_invall_locked(int cpu, struct its_vpe *vpe)
+{
+	void __iomem *rdbase;
+	u64 val;
+
+	val  = GICR_INVALLR_V;
+	val |= FIELD_PREP(GICR_INVALLR_VPEID, vpe->vpe_id);
+
+	guard(raw_spinlock)(&gic_data_rdist_cpu(cpu)->rd_lock);
+	rdbase = per_cpu_ptr(gic_rdists->rdist, cpu)->rd_base;
+	gic_write_lpir(val, rdbase + GICR_INVALLR);
+	wait_for_syncr(rdbase);
+}
+
 static int its_vpe_set_affinity(struct irq_data *d,
 				const struct cpumask *mask_val,
 				bool force)
 {
 	struct its_vpe *vpe = irq_data_get_irq_chip_data(d);
-	struct cpumask common, *table_mask;
+	unsigned int from, cpu = nr_cpu_ids;
+	struct cpumask *table_mask;
+	struct its_node *its;
 	unsigned long flags;
-	int from, cpu;
+
+	/*
+	 * Check if we're racing against a VPE being destroyed, for
+	 * which we don't want to allow a VMOVP.
+	 */
+	if (!atomic_read(&vpe->vmapp_count))
+		return -EINVAL;
 
 	/*
 	 * Changing affinity is mega expensive, so let's be as lazy as
@@ -3850,10 +3861,15 @@
 	 * If we are offered another CPU in the same GICv4.1 ITS
 	 * affinity, pick this one. Otherwise, any CPU will do.
 	 */
-	if (table_mask && cpumask_and(&common, mask_val, table_mask))
-		cpu = cpumask_test_cpu(from, &common) ? from : cpumask_first(&common);
-	else
+	if (table_mask)
+		cpu = cpumask_any_and(mask_val, table_mask);
+	if (cpu < nr_cpu_ids) {
+		if (cpumask_test_cpu(from, mask_val) &&
+		    cpumask_test_cpu(from, table_mask))
+			cpu = from;
+	} else {
 		cpu = cpumask_first(mask_val);
+	}
 
 	if (from == cpu)
 		goto out;
@@ -3861,6 +3877,11 @@
 	vpe->col_idx = cpu;
 
 	its_send_vmovp(vpe);
+
+	its = find_4_1_its();
+	if (its && its->flags & ITS_FLAGS_WORKAROUND_HISILICON_162100801)
+		its_vpe_4_1_invall_locked(cpu, vpe);
+
 	its_vpe_db_proxy_move(vpe, from, cpu);
 
 out:
@@ -4163,22 +4184,12 @@
 
 static void its_vpe_4_1_invall(struct its_vpe *vpe)
 {
-	void __iomem *rdbase;
 	unsigned long flags;
-	u64 val;
 	int cpu;
 
-	val  = GICR_INVALLR_V;
-	val |= FIELD_PREP(GICR_INVALLR_VPEID, vpe->vpe_id);
-
 	/* Target the redistributor this vPE is currently known on */
 	cpu = vpe_to_cpuid_lock(vpe, &flags);
-	raw_spin_lock(&gic_data_rdist_cpu(cpu)->rd_lock);
-	rdbase = per_cpu_ptr(gic_rdists->rdist, cpu)->rd_base;
-	gic_write_lpir(val, rdbase + GICR_INVALLR);
-
-	wait_for_syncr(rdbase);
-	raw_spin_unlock(&gic_data_rdist_cpu(cpu)->rd_lock);
+	its_vpe_4_1_invall_locked(cpu, vpe);
 	vpe_to_cpuid_unlock(vpe, flags);
 }
 
@@ -4470,9 +4481,8 @@
 	raw_spin_lock_init(&vpe->vpe_lock);
 	vpe->vpe_id = vpe_id;
 	vpe->vpt_page = vpt_page;
-	if (gic_rdists->has_rvpeid)
-		atomic_set(&vpe->vmapp_count, 0);
-	else
+	atomic_set(&vpe->vmapp_count, 0);
+	if (!gic_rdists->has_rvpeid)
 		vpe->vpe_proxy_event = -1;
 
 	return 0;
@@ -4521,8 +4531,6 @@
 	struct page *vprop_page;
 	int base, nr_ids, i, err = 0;
 
-	BUG_ON(!vm);
-
 	bitmap = its_lpi_alloc(roundup_pow_of_two(nr_irqs), &base, &nr_ids);
 	if (!bitmap)
 		return -ENOMEM;
@@ -4561,13 +4569,8 @@
 		irqd_set_resend_when_in_progress(irq_get_irq_data(virq + i));
 	}
 
-	if (err) {
-		if (i > 0)
-			its_vpe_irq_domain_free(domain, virq, i);
-
-		its_lpi_free(bitmap, base, nr_ids);
-		its_free_prop_table(vprop_page);
-	}
+	if (err)
+		its_vpe_irq_domain_free(domain, virq, i);
 
 	return err;
 }
@@ -4779,6 +4782,14 @@
 	return true;
 }
 
+static bool __maybe_unused its_enable_quirk_hip09_162100801(void *data)
+{
+	struct its_node *its = data;
+
+	its->flags |= ITS_FLAGS_WORKAROUND_HISILICON_162100801;
+	return true;
+}
+
 static const struct gic_quirk its_quirks[] = {
 #ifdef CONFIG_CAVIUM_ERRATUM_22375
 	{
@@ -4825,6 +4836,14 @@
 		.init	= its_enable_quirk_hip07_161600802,
 	},
 #endif
+#ifdef CONFIG_HISILICON_ERRATUM_162100801
+	{
+		.desc	= "ITS: Hip09 erratum 162100801",
+		.iidr	= 0x00051736,
+		.mask	= 0xffffffff,
+		.init	= its_enable_quirk_hip09_162100801,
+	},
+#endif
 #ifdef CONFIG_ROCKCHIP_ERRATUM_3588001
 	{
 		.desc   = "ITS: Rockchip erratum RK3588001",
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-gic-v3.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-gic-v3.c
@@ -463,6 +463,13 @@
 	}
 
 	gic_poke_irq(d, reg);
+
+	/*
+	 * Force read-back to guarantee that the active state has taken
+	 * effect, and won't race with a guest-driven deactivation.
+	 */
+	if (reg == GICD_ISACTIVER)
+		gic_peek_irq(d, reg);
 	return 0;
 }
 
@@ -1464,7 +1471,7 @@
 static int gic_cpu_pm_notifier(struct notifier_block *self,
 			       unsigned long cmd, void *v)
 {
-	if (cmd == CPU_PM_EXIT) {
+	if (cmd == CPU_PM_EXIT || cmd == CPU_PM_ENTER_FAILED) {
 		if (gic_dist_security_disabled())
 			gic_enable_redist(true);
 		gic_cpu_sys_reg_init();
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-gic.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-gic.c
@@ -64,7 +64,7 @@
 
 union gic_base {
 	void __iomem *common_base;
-	void __percpu * __iomem *percpu_base;
+	void __iomem * __percpu *percpu_base;
 };
 
 struct gic_chip_data {
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-imx-irqsteer.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-imx-irqsteer.c
@@ -36,6 +36,7 @@
 	int			channel;
 	struct irq_domain	*domain;
 	u32			*saved_reg;
+	struct device		*dev;
 };
 
 static int imx_irqsteer_get_reg_index(struct irqsteer_data *data,
@@ -72,10 +73,26 @@
 	raw_spin_unlock_irqrestore(&data->lock, flags);
 }
 
+static void imx_irqsteer_irq_bus_lock(struct irq_data *d)
+{
+	struct irqsteer_data *data = d->chip_data;
+
+	pm_runtime_get_sync(data->dev);
+}
+
+static void imx_irqsteer_irq_bus_sync_unlock(struct irq_data *d)
+{
+	struct irqsteer_data *data = d->chip_data;
+
+	pm_runtime_put_autosuspend(data->dev);
+}
+
 static const struct irq_chip imx_irqsteer_irq_chip = {
-	.name		= "irqsteer",
-	.irq_mask	= imx_irqsteer_irq_mask,
-	.irq_unmask	= imx_irqsteer_irq_unmask,
+	.name			= "irqsteer",
+	.irq_mask		= imx_irqsteer_irq_mask,
+	.irq_unmask		= imx_irqsteer_irq_unmask,
+	.irq_bus_lock		= imx_irqsteer_irq_bus_lock,
+	.irq_bus_sync_unlock	= imx_irqsteer_irq_bus_sync_unlock,
 };
 
 static int imx_irqsteer_irq_map(struct irq_domain *h, unsigned int irq,
@@ -150,6 +167,7 @@
 	if (!data)
 		return -ENOMEM;
 
+	data->dev = &pdev->dev;
 	data->regs = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(data->regs)) {
 		dev_err(&pdev->dev, "failed to initialize reg\n");
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-loongarch-cpu.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-loongarch-cpu.c
@@ -18,11 +18,13 @@
 
 static u32 lpic_gsi_to_irq(u32 gsi)
 {
+	int irq = 0;
+
 	/* Only pch irqdomain transferring is required for LoongArch. */
 	if (gsi >= GSI_MIN_PCH_IRQ && gsi <= GSI_MAX_PCH_IRQ)
-		return acpi_register_gsi(NULL, gsi, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_HIGH);
+		irq = acpi_register_gsi(NULL, gsi, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_HIGH);
 
-	return 0;
+	return (irq > 0) ? irq : 0;
 }
 
 static struct fwnode_handle *lpic_get_gsi_domain_id(u32 gsi)
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-loongson-eiointc.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-loongson-eiointc.c
@@ -15,6 +15,7 @@
 #include <linux/irqchip/chained_irq.h>
 #include <linux/kernel.h>
 #include <linux/syscore_ops.h>
+#include <asm/numa.h>
 
 #define EIOINTC_REG_NODEMAP	0x14a0
 #define EIOINTC_REG_IPMAP	0x14c0
@@ -349,7 +350,7 @@
 	int node;
 
 	if (cpu_has_flatmode)
-		node = cpu_to_node(eiointc_priv[nr_pics - 1]->node * CORES_PER_EIO_NODE);
+		node = early_cpu_to_node(eiointc_priv[nr_pics - 1]->node * CORES_PER_EIO_NODE);
 	else
 		node = eiointc_priv[nr_pics - 1]->node;
 
@@ -441,7 +442,7 @@
 		goto out_free_handle;
 
 	if (cpu_has_flatmode)
-		node = cpu_to_node(acpi_eiointc->node * CORES_PER_EIO_NODE);
+		node = early_cpu_to_node(acpi_eiointc->node * CORES_PER_EIO_NODE);
 	else
 		node = acpi_eiointc->node;
 	acpi_set_vec_parent(node, priv->eiointc_domain, pch_group);
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-loongson-liointc.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-loongson-liointc.c
@@ -28,7 +28,7 @@
 
 #define LIOINTC_INTC_CHIP_START	0x20
 
-#define LIOINTC_REG_INTC_STATUS	(LIOINTC_INTC_CHIP_START + 0x20)
+#define LIOINTC_REG_INTC_STATUS(core)	(LIOINTC_INTC_CHIP_START + 0x20 + (core) * 8)
 #define LIOINTC_REG_INTC_EN_STATUS	(LIOINTC_INTC_CHIP_START + 0x04)
 #define LIOINTC_REG_INTC_ENABLE	(LIOINTC_INTC_CHIP_START + 0x08)
 #define LIOINTC_REG_INTC_DISABLE	(LIOINTC_INTC_CHIP_START + 0x0c)
@@ -217,7 +217,7 @@
 		goto out_free_priv;
 
 	for (i = 0; i < LIOINTC_NUM_CORES; i++)
-		priv->core_isr[i] = base + LIOINTC_REG_INTC_STATUS;
+		priv->core_isr[i] = base + LIOINTC_REG_INTC_STATUS(i);
 
 	for (i = 0; i < LIOINTC_NUM_PARENT; i++)
 		priv->handler[i].parent_int_map = parent_int_map[i];
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-loongson-pch-msi.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-loongson-pch-msi.c
@@ -136,7 +136,7 @@
 
 err_hwirq:
 	pch_msi_free_hwirq(priv, hwirq, nr_irqs);
-	irq_domain_free_irqs_parent(domain, virq, i - 1);
+	irq_domain_free_irqs_parent(domain, virq, i);
 
 	return err;
 }
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-mbigen.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-mbigen.c
@@ -64,6 +64,20 @@
 	void __iomem		*base;
 };
 
+static inline unsigned int get_mbigen_node_offset(unsigned int nid)
+{
+	unsigned int offset = nid * MBIGEN_NODE_OFFSET;
+
+	/*
+	 * To avoid touched clear register in unexpected way, we need to directly
+	 * skip clear register when access to more than 10 mbigen nodes.
+	 */
+	if (nid >= (REG_MBIGEN_CLEAR_OFFSET / MBIGEN_NODE_OFFSET))
+		offset += MBIGEN_NODE_OFFSET;
+
+	return offset;
+}
+
 static inline unsigned int get_mbigen_vec_reg(irq_hw_number_t hwirq)
 {
 	unsigned int nid, pin;
@@ -72,8 +86,7 @@
 	nid = hwirq / IRQS_PER_MBIGEN_NODE + 1;
 	pin = hwirq % IRQS_PER_MBIGEN_NODE;
 
-	return pin * 4 + nid * MBIGEN_NODE_OFFSET
-			+ REG_MBIGEN_VEC_OFFSET;
+	return pin * 4 + get_mbigen_node_offset(nid) + REG_MBIGEN_VEC_OFFSET;
 }
 
 static inline void get_mbigen_type_reg(irq_hw_number_t hwirq,
@@ -88,8 +101,7 @@
 	*mask = 1 << (irq_ofst % 32);
 	ofst = irq_ofst / 32 * 4;
 
-	*addr = ofst + nid * MBIGEN_NODE_OFFSET
-		+ REG_MBIGEN_TYPE_OFFSET;
+	*addr = ofst + get_mbigen_node_offset(nid) + REG_MBIGEN_TYPE_OFFSET;
 }
 
 static inline void get_mbigen_clear_reg(irq_hw_number_t hwirq,
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-meson-gpio.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-meson-gpio.c
@@ -173,7 +173,7 @@
 	void __iomem *base;
 	u32 channel_irqs[MAX_NUM_CHANNEL];
 	DECLARE_BITMAP(channel_map, MAX_NUM_CHANNEL);
-	spinlock_t lock;
+	raw_spinlock_t lock;
 };
 
 static void meson_gpio_irq_update_bits(struct meson_gpio_irq_controller *ctl,
@@ -182,14 +182,14 @@
 	unsigned long flags;
 	u32 tmp;
 
-	spin_lock_irqsave(&ctl->lock, flags);
+	raw_spin_lock_irqsave(&ctl->lock, flags);
 
 	tmp = readl_relaxed(ctl->base + reg);
 	tmp &= ~mask;
 	tmp |= val;
 	writel_relaxed(tmp, ctl->base + reg);
 
-	spin_unlock_irqrestore(&ctl->lock, flags);
+	raw_spin_unlock_irqrestore(&ctl->lock, flags);
 }
 
 static void meson_gpio_irq_init_dummy(struct meson_gpio_irq_controller *ctl)
@@ -239,12 +239,12 @@
 	unsigned long flags;
 	unsigned int idx;
 
-	spin_lock_irqsave(&ctl->lock, flags);
+	raw_spin_lock_irqsave(&ctl->lock, flags);
 
 	/* Find a free channel */
 	idx = find_first_zero_bit(ctl->channel_map, ctl->params->nr_channels);
 	if (idx >= ctl->params->nr_channels) {
-		spin_unlock_irqrestore(&ctl->lock, flags);
+		raw_spin_unlock_irqrestore(&ctl->lock, flags);
 		pr_err("No channel available\n");
 		return -ENOSPC;
 	}
@@ -252,7 +252,7 @@
 	/* Mark the channel as used */
 	set_bit(idx, ctl->channel_map);
 
-	spin_unlock_irqrestore(&ctl->lock, flags);
+	raw_spin_unlock_irqrestore(&ctl->lock, flags);
 
 	/*
 	 * Setup the mux of the channel to route the signal of the pad
@@ -562,7 +562,7 @@
 	if (!ctl)
 		return -ENOMEM;
 
-	spin_lock_init(&ctl->lock);
+	raw_spin_lock_init(&ctl->lock);
 
 	ctl->base = of_iomap(node, 0);
 	if (!ctl->base) {
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-mscc-ocelot.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-mscc-ocelot.c
@@ -37,7 +37,7 @@
 	.reg_off_ena_clr	= 0x1c,
 	.reg_off_ena_set	= 0x20,
 	.reg_off_ident		= 0x38,
-	.reg_off_trigger	= 0x5c,
+	.reg_off_trigger	= 0x4,
 	.n_irq			= 24,
 };
 
@@ -70,7 +70,7 @@
 	.reg_off_ena_clr	= 0x1c,
 	.reg_off_ena_set	= 0x20,
 	.reg_off_ident		= 0x38,
-	.reg_off_trigger	= 0x5c,
+	.reg_off_trigger	= 0x4,
 	.n_irq			= 29,
 };
 
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-renesas-rzg2l.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-renesas-rzg2l.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/bitfield.h>
+#include <linux/cleanup.h>
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/io.h>
@@ -85,10 +86,9 @@
 	return data->domain->host_data;
 }
 
-static void rzg2l_irq_eoi(struct irq_data *d)
+static void rzg2l_clear_irq_int(struct rzg2l_irqc_priv *priv, unsigned int hwirq)
 {
-	unsigned int hw_irq = irqd_to_hwirq(d) - IRQC_IRQ_START;
-	struct rzg2l_irqc_priv *priv = irq_data_to_priv(d);
+	unsigned int hw_irq = hwirq - IRQC_IRQ_START;
 	u32 bit = BIT(hw_irq);
 	u32 iitsr, iscr;
 
@@ -99,20 +99,30 @@
 	 * ISCR can only be cleared if the type is falling-edge, rising-edge or
 	 * falling/rising-edge.
 	 */
-	if ((iscr & bit) && (iitsr & IITSR_IITSEL_MASK(hw_irq)))
+	if ((iscr & bit) && (iitsr & IITSR_IITSEL_MASK(hw_irq))) {
 		writel_relaxed(iscr & ~bit, priv->base + ISCR);
+		/*
+		 * Enforce that the posted write is flushed to prevent that the
+		 * just handled interrupt is raised again.
+		 */
+		readl_relaxed(priv->base + ISCR);
+	}
 }
 
-static void rzg2l_tint_eoi(struct irq_data *d)
+static void rzg2l_clear_tint_int(struct rzg2l_irqc_priv *priv, unsigned int hwirq)
 {
-	unsigned int hw_irq = irqd_to_hwirq(d) - IRQC_TINT_START;
-	struct rzg2l_irqc_priv *priv = irq_data_to_priv(d);
-	u32 bit = BIT(hw_irq);
+	u32 bit = BIT(hwirq - IRQC_TINT_START);
 	u32 reg;
 
 	reg = readl_relaxed(priv->base + TSCR);
-	if (reg & bit)
+	if (reg & bit) {
 		writel_relaxed(reg & ~bit, priv->base + TSCR);
+		/*
+		 * Enforce that the posted write is flushed to prevent that the
+		 * just handled interrupt is raised again.
+		 */
+		readl_relaxed(priv->base + TSCR);
+	}
 }
 
 static void rzg2l_irqc_eoi(struct irq_data *d)
@@ -122,9 +132,9 @@
 
 	raw_spin_lock(&priv->lock);
 	if (hw_irq >= IRQC_IRQ_START && hw_irq <= IRQC_IRQ_COUNT)
-		rzg2l_irq_eoi(d);
+		rzg2l_clear_irq_int(priv, hw_irq);
 	else if (hw_irq >= IRQC_TINT_START && hw_irq < IRQC_NUM_IRQ)
-		rzg2l_tint_eoi(d);
+		rzg2l_clear_tint_int(priv, hw_irq);
 	raw_spin_unlock(&priv->lock);
 	irq_chip_eoi_parent(d);
 }
@@ -142,7 +152,7 @@
 
 		raw_spin_lock(&priv->lock);
 		reg = readl_relaxed(priv->base + TSSR(tssr_index));
-		reg &= ~(TSSEL_MASK << TSSEL_SHIFT(tssr_offset));
+		reg &= ~(TIEN << TSSEL_SHIFT(tssr_offset));
 		writel_relaxed(reg, priv->base + TSSR(tssr_index));
 		raw_spin_unlock(&priv->lock);
 	}
@@ -154,7 +164,6 @@
 	unsigned int hw_irq = irqd_to_hwirq(d);
 
 	if (hw_irq >= IRQC_TINT_START && hw_irq < IRQC_NUM_IRQ) {
-		unsigned long tint = (uintptr_t)irq_data_get_irq_chip_data(d);
 		struct rzg2l_irqc_priv *priv = irq_data_to_priv(d);
 		u32 offset = hw_irq - IRQC_TINT_START;
 		u32 tssr_offset = TSSR_OFFSET(offset);
@@ -163,7 +172,7 @@
 
 		raw_spin_lock(&priv->lock);
 		reg = readl_relaxed(priv->base + TSSR(tssr_index));
-		reg |= (TIEN | tint) << TSSEL_SHIFT(tssr_offset);
+		reg |= TIEN << TSSEL_SHIFT(tssr_offset);
 		writel_relaxed(reg, priv->base + TSSR(tssr_index));
 		raw_spin_unlock(&priv->lock);
 	}
@@ -172,8 +181,10 @@
 
 static int rzg2l_irq_set_type(struct irq_data *d, unsigned int type)
 {
-	unsigned int hw_irq = irqd_to_hwirq(d) - IRQC_IRQ_START;
 	struct rzg2l_irqc_priv *priv = irq_data_to_priv(d);
+	unsigned int hwirq = irqd_to_hwirq(d);
+	u32 iitseln = hwirq - IRQC_IRQ_START;
+	bool clear_irq_int = false;
 	u16 sense, tmp;
 
 	switch (type & IRQ_TYPE_SENSE_MASK) {
@@ -183,14 +194,17 @@
 
 	case IRQ_TYPE_EDGE_FALLING:
 		sense = IITSR_IITSEL_EDGE_FALLING;
+		clear_irq_int = true;
 		break;
 
 	case IRQ_TYPE_EDGE_RISING:
 		sense = IITSR_IITSEL_EDGE_RISING;
+		clear_irq_int = true;
 		break;
 
 	case IRQ_TYPE_EDGE_BOTH:
 		sense = IITSR_IITSEL_EDGE_BOTH;
+		clear_irq_int = true;
 		break;
 
 	default:
@@ -199,21 +213,40 @@
 
 	raw_spin_lock(&priv->lock);
 	tmp = readl_relaxed(priv->base + IITSR);
-	tmp &= ~IITSR_IITSEL_MASK(hw_irq);
-	tmp |= IITSR_IITSEL(hw_irq, sense);
+	tmp &= ~IITSR_IITSEL_MASK(iitseln);
+	tmp |= IITSR_IITSEL(iitseln, sense);
+	if (clear_irq_int)
+		rzg2l_clear_irq_int(priv, hwirq);
 	writel_relaxed(tmp, priv->base + IITSR);
 	raw_spin_unlock(&priv->lock);
 
 	return 0;
 }
 
+static u32 rzg2l_disable_tint_and_set_tint_source(struct irq_data *d, struct rzg2l_irqc_priv *priv,
+						  u32 reg, u32 tssr_offset, u8 tssr_index)
+{
+	u32 tint = (u32)(uintptr_t)irq_data_get_irq_chip_data(d);
+	u32 tien = reg & (TIEN << TSSEL_SHIFT(tssr_offset));
+
+	/* Clear the relevant byte in reg */
+	reg &= ~(TSSEL_MASK << TSSEL_SHIFT(tssr_offset));
+	/* Set TINT and leave TIEN clear */
+	reg |= tint << TSSEL_SHIFT(tssr_offset);
+	writel_relaxed(reg, priv->base + TSSR(tssr_index));
+
+	return reg | tien;
+}
+
 static int rzg2l_tint_set_edge(struct irq_data *d, unsigned int type)
 {
 	struct rzg2l_irqc_priv *priv = irq_data_to_priv(d);
 	unsigned int hwirq = irqd_to_hwirq(d);
 	u32 titseln = hwirq - IRQC_TINT_START;
+	u32 tssr_offset = TSSR_OFFSET(titseln);
+	u8 tssr_index = TSSR_INDEX(titseln);
 	u8 index, sense;
-	u32 reg;
+	u32 reg, tssr;
 
 	switch (type & IRQ_TYPE_SENSE_MASK) {
 	case IRQ_TYPE_EDGE_RISING:
@@ -235,10 +268,14 @@
 	}
 
 	raw_spin_lock(&priv->lock);
+	tssr = readl_relaxed(priv->base + TSSR(tssr_index));
+	tssr = rzg2l_disable_tint_and_set_tint_source(d, priv, tssr, tssr_offset, tssr_index);
 	reg = readl_relaxed(priv->base + TITSR(index));
 	reg &= ~(IRQ_MASK << (titseln * TITSEL_WIDTH));
 	reg |= sense << (titseln * TITSEL_WIDTH);
 	writel_relaxed(reg, priv->base + TITSR(index));
+	rzg2l_clear_tint_int(priv, hwirq);
+	writel_relaxed(tssr, priv->base + TSSR(tssr_index));
 	raw_spin_unlock(&priv->lock);
 
 	return 0;
@@ -373,12 +410,12 @@
 
 static int rzg2l_irqc_init(struct device_node *node, struct device_node *parent)
 {
+	struct platform_device *pdev = of_find_device_by_node(node);
+	struct device *dev __free(put_device) = pdev ? &pdev->dev : NULL;
 	struct irq_domain *irq_domain, *parent_domain;
-	struct platform_device *pdev;
 	struct reset_control *resetn;
 	int ret;
 
-	pdev = of_find_device_by_node(node);
 	if (!pdev)
 		return -ENODEV;
 
@@ -432,6 +469,17 @@
 
 	register_syscore_ops(&rzg2l_irqc_syscore_ops);
 
+	/*
+	 * Prevent the cleanup function from invoking put_device by assigning
+	 * NULL to dev.
+	 *
+	 * make coccicheck will complain about missing put_device calls, but
+	 * those are false positives, as dev will be automatically "put" via
+	 * __free_put_device on the failing path.
+	 * On the successful path we don't actually want to "put" dev.
+	 */
+	dev = NULL;
+
 	return 0;
 
 pm_put:
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-riscv-intc.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-riscv-intc.c
@@ -17,17 +17,19 @@
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/smp.h>
+#include <linux/soc/andes/irq.h>
 
 static struct irq_domain *intc_domain;
+static unsigned int riscv_intc_nr_irqs __ro_after_init = BITS_PER_LONG;
+static unsigned int riscv_intc_custom_base __ro_after_init = BITS_PER_LONG;
+static unsigned int riscv_intc_custom_nr_irqs __ro_after_init;
 
 static asmlinkage void riscv_intc_irq(struct pt_regs *regs)
 {
 	unsigned long cause = regs->cause & ~CAUSE_IRQ_FLAG;
 
-	if (unlikely(cause >= BITS_PER_LONG))
-		panic("unexpected interrupt cause");
-
-	generic_handle_domain_irq(intc_domain, cause);
+	if (generic_handle_domain_irq(intc_domain, cause))
+		pr_warn_ratelimited("Failed to handle interrupt (cause: %ld)\n", cause);
 }
 
 /*
@@ -47,6 +49,31 @@
 	csr_set(CSR_IE, BIT(d->hwirq));
 }
 
+static void andes_intc_irq_mask(struct irq_data *d)
+{
+	/*
+	 * Andes specific S-mode local interrupt causes (hwirq)
+	 * are defined as (256 + n) and controlled by n-th bit
+	 * of SLIE.
+	 */
+	unsigned int mask = BIT(d->hwirq % BITS_PER_LONG);
+
+	if (d->hwirq < ANDES_SLI_CAUSE_BASE)
+		csr_clear(CSR_IE, mask);
+	else
+		csr_clear(ANDES_CSR_SLIE, mask);
+}
+
+static void andes_intc_irq_unmask(struct irq_data *d)
+{
+	unsigned int mask = BIT(d->hwirq % BITS_PER_LONG);
+
+	if (d->hwirq < ANDES_SLI_CAUSE_BASE)
+		csr_set(CSR_IE, mask);
+	else
+		csr_set(ANDES_CSR_SLIE, mask);
+}
+
 static void riscv_intc_irq_eoi(struct irq_data *d)
 {
 	/*
@@ -70,12 +97,21 @@
 	.irq_eoi = riscv_intc_irq_eoi,
 };
 
+static struct irq_chip andes_intc_chip = {
+	.name		= "RISC-V INTC",
+	.irq_mask	= andes_intc_irq_mask,
+	.irq_unmask	= andes_intc_irq_unmask,
+	.irq_eoi	= riscv_intc_irq_eoi,
+};
+
 static int riscv_intc_domain_map(struct irq_domain *d, unsigned int irq,
 				 irq_hw_number_t hwirq)
 {
+	struct irq_chip *chip = d->host_data;
+
 	irq_set_percpu_devid(irq);
-	irq_domain_set_info(d, irq, hwirq, &riscv_intc_chip, d->host_data,
-			    handle_percpu_devid_irq, NULL, NULL);
+	irq_domain_set_info(d, irq, hwirq, chip, NULL, handle_percpu_devid_irq,
+			    NULL, NULL);
 
 	return 0;
 }
@@ -93,6 +129,14 @@
 	if (ret)
 		return ret;
 
+	/*
+	 * Only allow hwirq for which we have corresponding standard or
+	 * custom interrupt enable register.
+	 */
+	if ((hwirq >= riscv_intc_nr_irqs && hwirq < riscv_intc_custom_base) ||
+	    (hwirq >= riscv_intc_custom_base + riscv_intc_custom_nr_irqs))
+		return -EINVAL;
+
 	for (i = 0; i < nr_irqs; i++) {
 		ret = riscv_intc_domain_map(domain, virq + i, hwirq + i);
 		if (ret)
@@ -113,12 +157,12 @@
 	return intc_domain->fwnode;
 }
 
-static int __init riscv_intc_init_common(struct fwnode_handle *fn)
+static int __init riscv_intc_init_common(struct fwnode_handle *fn,
+					 struct irq_chip *chip)
 {
 	int rc;
 
-	intc_domain = irq_domain_create_linear(fn, BITS_PER_LONG,
-					       &riscv_intc_domain_ops, NULL);
+	intc_domain = irq_domain_create_tree(fn, &riscv_intc_domain_ops, chip);
 	if (!intc_domain) {
 		pr_err("unable to add IRQ domain\n");
 		return -ENXIO;
@@ -132,7 +176,11 @@
 
 	riscv_set_intc_hwnode_fn(riscv_intc_hwnode);
 
-	pr_info("%d local interrupts mapped\n", BITS_PER_LONG);
+	pr_info("%d local interrupts mapped\n", riscv_intc_nr_irqs);
+	if (riscv_intc_custom_nr_irqs) {
+		pr_info("%d custom local interrupts mapped\n",
+			riscv_intc_custom_nr_irqs);
+	}
 
 	return 0;
 }
@@ -140,8 +188,9 @@
 static int __init riscv_intc_init(struct device_node *node,
 				  struct device_node *parent)
 {
-	int rc;
+	struct irq_chip *chip = &riscv_intc_chip;
 	unsigned long hartid;
+	int rc;
 
 	rc = riscv_of_parent_hartid(node, &hartid);
 	if (rc < 0) {
@@ -166,18 +215,26 @@
 		return 0;
 	}
 
-	return riscv_intc_init_common(of_node_to_fwnode(node));
+	if (of_device_is_compatible(node, "andestech,cpu-intc")) {
+		riscv_intc_custom_base = ANDES_SLI_CAUSE_BASE;
+		riscv_intc_custom_nr_irqs = ANDES_RV_IRQ_LAST;
+		chip = &andes_intc_chip;
+	}
+
+	return riscv_intc_init_common(of_node_to_fwnode(node), chip);
 }
 
 IRQCHIP_DECLARE(riscv, "riscv,cpu-intc", riscv_intc_init);
+IRQCHIP_DECLARE(andes, "andestech,cpu-intc", riscv_intc_init);
 
 #ifdef CONFIG_ACPI
 
 static int __init riscv_intc_acpi_init(union acpi_subtable_headers *header,
 				       const unsigned long end)
 {
-	struct fwnode_handle *fn;
 	struct acpi_madt_rintc *rintc;
+	struct fwnode_handle *fn;
+	int rc;
 
 	rintc = (struct acpi_madt_rintc *)header;
 
@@ -196,7 +253,11 @@
 		return -ENOMEM;
 	}
 
-	return riscv_intc_init_common(fn);
+	rc = riscv_intc_init_common(fn, &riscv_intc_chip);
+	if (rc)
+		irq_domain_free_fwnode(fn);
+
+	return rc;
 }
 
 IRQCHIP_ACPI_DECLARE(riscv_intc, ACPI_MADT_TYPE_RINTC, NULL,
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-sifive-plic.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-sifive-plic.c
@@ -120,16 +120,6 @@
 	}
 }
 
-static void plic_irq_enable(struct irq_data *d)
-{
-	plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
-}
-
-static void plic_irq_disable(struct irq_data *d)
-{
-	plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
-}
-
 static void plic_irq_unmask(struct irq_data *d)
 {
 	struct plic_priv *priv = irq_data_get_irq_chip_data(d);
@@ -144,6 +134,17 @@
 	writel(0, priv->regs + PRIORITY_BASE + d->hwirq * PRIORITY_PER_ID);
 }
 
+static void plic_irq_enable(struct irq_data *d)
+{
+	plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+	plic_irq_unmask(d);
+}
+
+static void plic_irq_disable(struct irq_data *d)
+{
+	plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+}
+
 static void plic_irq_eoi(struct irq_data *d)
 {
 	struct plic_handler *handler = this_cpu_ptr(&plic_handlers);
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-sunxi-nmi.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-sunxi-nmi.c
@@ -186,7 +186,8 @@
 	gc->chip_types[0].chip.irq_unmask	= irq_gc_mask_set_bit;
 	gc->chip_types[0].chip.irq_eoi		= irq_gc_ack_set_bit;
 	gc->chip_types[0].chip.irq_set_type	= sunxi_sc_nmi_set_type;
-	gc->chip_types[0].chip.flags		= IRQCHIP_EOI_THREADED | IRQCHIP_EOI_IF_HANDLED;
+	gc->chip_types[0].chip.flags		= IRQCHIP_EOI_THREADED | IRQCHIP_EOI_IF_HANDLED |
+						  IRQCHIP_SKIP_SET_WAKE;
 	gc->chip_types[0].regs.ack		= reg_offs->pend;
 	gc->chip_types[0].regs.mask		= reg_offs->enable;
 	gc->chip_types[0].regs.type		= reg_offs->ctrl;
--- linux-qcom-6.8.0.orig/drivers/irqchip/irq-xilinx-intc.c
+++ linux-qcom-6.8.0/drivers/irqchip/irq-xilinx-intc.c
@@ -189,7 +189,7 @@
 		irqc->intr_mask = 0;
 	}
 
-	if (irqc->intr_mask >> irqc->nr_irq)
+	if ((u64)irqc->intr_mask >> irqc->nr_irq)
 		pr_warn("irq-xilinx: mismatch in kind-of-intr param\n");
 
 	pr_info("irq-xilinx: %pOF: num_irq=%d, edge=0x%x\n",
--- linux-qcom-6.8.0.orig/drivers/irqchip/irqchip.c
+++ linux-qcom-6.8.0/drivers/irqchip/irqchip.c
@@ -35,11 +35,10 @@
 int platform_irqchip_probe(struct platform_device *pdev)
 {
 	struct device_node *np = pdev->dev.of_node;
-	struct device_node *par_np = of_irq_find_parent(np);
+	struct device_node *par_np __free(device_node) = of_irq_find_parent(np);
 	of_irq_init_cb_t irq_init_cb = of_device_get_match_data(&pdev->dev);
 
 	if (!irq_init_cb) {
-		of_node_put(par_np);
 		return -EINVAL;
 	}
 
@@ -55,7 +54,6 @@
 	 * interrupt controller can check for specific domains as necessary.
 	 */
 	if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) {
-		of_node_put(par_np);
 		return -EPROBE_DEFER;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ linux-qcom-6.8.0/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -1900,7 +1900,7 @@
 static void
 hfcmulti_tx(struct hfc_multi *hc, int ch)
 {
-	int i, ii, temp, len = 0;
+	int i, ii, temp, tmp_len, len = 0;
 	int Zspace, z1, z2; /* must be int for calculation */
 	int Fspace, f1, f2;
 	u_char *d;
@@ -2121,14 +2121,15 @@
 		HFC_wait_nodebug(hc);
 	}
 
+	tmp_len = (*sp)->len;
 	dev_kfree_skb(*sp);
 	/* check for next frame */
 	if (bch && get_next_bframe(bch)) {
-		len = (*sp)->len;
+		len = tmp_len;
 		goto next_frame;
 	}
 	if (dch && get_next_dframe(dch)) {
-		len = (*sp)->len;
+		len = tmp_len;
 		goto next_frame;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/isdn/mISDN/socket.c
+++ linux-qcom-6.8.0/drivers/isdn/mISDN/socket.c
@@ -401,23 +401,23 @@
 }
 
 static int data_sock_setsockopt(struct socket *sock, int level, int optname,
-				sockptr_t optval, unsigned int len)
+				sockptr_t optval, unsigned int optlen)
 {
 	struct sock *sk = sock->sk;
 	int err = 0, opt = 0;
 
 	if (*debug & DEBUG_SOCKET)
 		printk(KERN_DEBUG "%s(%p, %d, %x, optval, %d)\n", __func__, sock,
-		       level, optname, len);
+		       level, optname, optlen);
 
 	lock_sock(sk);
 
 	switch (optname) {
 	case MISDN_TIME_STAMP:
-		if (copy_from_sockptr(&opt, optval, sizeof(int))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt),
+					     optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			_pms(sk)->cmask |= MISDN_TIME_STAMP;
--- linux-qcom-6.8.0.orig/drivers/leds/Kconfig
+++ linux-qcom-6.8.0/drivers/leds/Kconfig
@@ -59,6 +59,18 @@
 	  This option enables support for on-chip LED drivers found on Marvell
 	  Semiconductor 88PM8606 PMIC.
 
+config LEDS_AAEON
+	tristate "AAEON LED driver"
+	depends on X86
+	depends on UBUNTU_ODM_DRIVERS
+	select MFD_AAEON
+	help
+	  This led driver adds support for LED brightness control on Single
+	  Board Computers produced by AAEON.
+
+	  This driver leverages the ASUS WMI interface to access device
+	  resources.
+
 config LEDS_AN30259A
 	tristate "LED support for Panasonic AN30259A"
 	depends on LEDS_CLASS && I2C && OF
@@ -410,7 +422,6 @@
 	depends on OF
 	depends on I2C
 	select FW_LOADER
-	select FW_LOADER_USER_HELPER
 	help
 	  This option supports common operations for LP5521/5523/55231/5562/8501
 	  devices.
--- linux-qcom-6.8.0.orig/drivers/leds/Makefile
+++ linux-qcom-6.8.0/drivers/leds/Makefile
@@ -9,6 +9,7 @@
 
 # LED Platform Drivers (keep this sorted, M-| sort)
 obj-$(CONFIG_LEDS_88PM860X)		+= leds-88pm860x.o
+obj-$(CONFIG_LEDS_AAEON)		+= leds-aaeon.o
 obj-$(CONFIG_LEDS_ACER_A500)		+= leds-acer-a500.o
 obj-$(CONFIG_LEDS_ADP5520)		+= leds-adp5520.o
 obj-$(CONFIG_LEDS_AN30259A)		+= leds-an30259a.o
--- linux-qcom-6.8.0.orig/drivers/leds/flash/leds-mt6360.c
+++ linux-qcom-6.8.0/drivers/leds/flash/leds-mt6360.c
@@ -633,14 +633,17 @@
 
 			ret = fwnode_property_read_u32(child, "reg", &reg);
 			if (ret || reg > MT6360_LED_ISNK3 ||
-			    priv->leds_active & BIT(reg))
+			    priv->leds_active & BIT(reg)) {
+				fwnode_handle_put(child);
 				return -EINVAL;
+			}
 
 			ret = fwnode_property_read_u32(child, "color", &color);
 			if (ret) {
 				dev_err(priv->dev,
 					"led %d, no color specified\n",
 					led->led_no);
+				fwnode_handle_put(child);
 				return ret;
 			}
 
@@ -771,7 +774,6 @@
 static int mt6360_led_probe(struct platform_device *pdev)
 {
 	struct mt6360_priv *priv;
-	struct fwnode_handle *child;
 	size_t count;
 	int i = 0, ret;
 
@@ -798,7 +800,7 @@
 		return -ENODEV;
 	}
 
-	device_for_each_child_node(&pdev->dev, child) {
+	device_for_each_child_node_scoped(&pdev->dev, child) {
 		struct mt6360_led *led = priv->leds + i;
 		struct led_init_data init_data = { .fwnode = child, };
 		u32 reg, led_color;
--- linux-qcom-6.8.0.orig/drivers/leds/flash/leds-qcom-flash.c
+++ linux-qcom-6.8.0/drivers/leds/flash/leds-qcom-flash.c
@@ -505,6 +505,7 @@
 	struct qcom_flash_data *flash_data = led->flash_data;
 	struct v4l2_flash_config v4l2_cfg = { 0 };
 	struct led_flash_setting *intensity = &v4l2_cfg.intensity;
+	struct v4l2_flash *v4l2_flash;
 
 	if (!(led->flash.led_cdev.flags & LED_DEV_CAP_FLASH))
 		return 0;
@@ -523,9 +524,12 @@
 				LED_FAULT_OVER_TEMPERATURE |
 				LED_FAULT_TIMEOUT;
 
-	flash_data->v4l2_flash[flash_data->leds_count] =
-		v4l2_flash_init(dev, fwnode, &led->flash, &qcom_v4l2_flash_ops, &v4l2_cfg);
-	return PTR_ERR_OR_ZERO(flash_data->v4l2_flash);
+	v4l2_flash = v4l2_flash_init(dev, fwnode, &led->flash, &qcom_v4l2_flash_ops, &v4l2_cfg);
+	if (IS_ERR(v4l2_flash))
+		return PTR_ERR(v4l2_flash);
+
+	flash_data->v4l2_flash[flash_data->leds_count] = v4l2_flash;
+	return 0;
 }
 # else
 static int
--- linux-qcom-6.8.0.orig/drivers/leds/flash/leds-sgm3140.c
+++ linux-qcom-6.8.0/drivers/leds/flash/leds-sgm3140.c
@@ -114,8 +114,11 @@
 				"failed to enable regulator: %d\n", ret);
 			return ret;
 		}
+		gpiod_set_value_cansleep(priv->flash_gpio, 0);
 		gpiod_set_value_cansleep(priv->enable_gpio, 1);
 	} else {
+		del_timer_sync(&priv->powerdown_timer);
+		gpiod_set_value_cansleep(priv->flash_gpio, 0);
 		gpiod_set_value_cansleep(priv->enable_gpio, 0);
 		ret = regulator_disable(priv->vin_regulator);
 		if (ret) {
--- linux-qcom-6.8.0.orig/drivers/leds/led-class.c
+++ linux-qcom-6.8.0/drivers/leds/led-class.c
@@ -29,11 +29,14 @@
 		struct device_attribute *attr, char *buf)
 {
 	struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	unsigned int brightness;
 
-	/* no lock needed for this */
+	mutex_lock(&led_cdev->led_access);
 	led_update_brightness(led_cdev);
+	brightness = led_cdev->brightness;
+	mutex_unlock(&led_cdev->led_access);
 
-	return sprintf(buf, "%u\n", led_cdev->brightness);
+	return sprintf(buf, "%u\n", brightness);
 }
 
 static ssize_t brightness_store(struct device *dev,
@@ -70,8 +73,13 @@
 		struct device_attribute *attr, char *buf)
 {
 	struct led_classdev *led_cdev = dev_get_drvdata(dev);
+	unsigned int max_brightness;
+
+	mutex_lock(&led_cdev->led_access);
+	max_brightness = led_cdev->max_brightness;
+	mutex_unlock(&led_cdev->led_access);
 
-	return sprintf(buf, "%u\n", led_cdev->max_brightness);
+	return sprintf(buf, "%u\n", max_brightness);
 }
 static DEVICE_ATTR_RO(max_brightness);
 
@@ -258,7 +266,6 @@
 
 	led_dev = class_find_device_by_of_node(&leds_class, led_node);
 	of_node_put(led_node);
-	put_device(led_dev);
 
 	return led_module_get(led_dev);
 }
--- linux-qcom-6.8.0.orig/drivers/leds/led-triggers.c
+++ linux-qcom-6.8.0/drivers/leds/led-triggers.c
@@ -179,9 +179,9 @@
 
 		cancel_work_sync(&led_cdev->set_brightness_work);
 		led_stop_software_blink(led_cdev);
+		device_remove_groups(led_cdev->dev, led_cdev->trigger->groups);
 		if (led_cdev->trigger->deactivate)
 			led_cdev->trigger->deactivate(led_cdev);
-		device_remove_groups(led_cdev->dev, led_cdev->trigger->groups);
 		led_cdev->trigger = NULL;
 		led_cdev->trigger_data = NULL;
 		led_cdev->activated = false;
@@ -194,11 +194,24 @@
 		spin_unlock(&trig->leddev_list_lock);
 		led_cdev->trigger = trig;
 
+		/*
+		 * If "set brightness to 0" is pending in workqueue,
+		 * we don't want that to be reordered after ->activate()
+		 */
+		flush_work(&led_cdev->set_brightness_work);
+
+		/*
+		 * Some activate() calls use led_trigger_event() to initialize
+		 * the brightness of the LED for which the trigger is being set.
+		 * Ensure the led_cdev is visible on trig->led_cdevs for this.
+		 */
+		synchronize_rcu();
+
+		ret = 0;
 		if (trig->activate)
 			ret = trig->activate(led_cdev);
 		else
-			ret = 0;
-
+			led_set_brightness(led_cdev, trig->brightness);
 		if (ret)
 			goto err_activate;
 
@@ -373,6 +386,8 @@
 	if (!trig)
 		return;
 
+	trig->brightness = brightness;
+
 	rcu_read_lock();
 	list_for_each_entry_rcu(led_cdev, &trig->led_cdevs, trig_list)
 		led_set_brightness(led_cdev, brightness);
--- linux-qcom-6.8.0.orig/drivers/leds/leds-aaeon.c
+++ linux-qcom-6.8.0/drivers/leds/leds-aaeon.c
@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * AAEON LED driver
+ *
+ * Copyright (c) 2021, AAEON Ltd.
+ *
+ * Author: Kunyang Fan <kunyang_fan@aaeon.com.tw>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/acpi.h>
+#include <linux/bitops.h>
+#include <linux/leds.h>
+#include <linux/module.h>
+#include <linux/platform_data/x86/asus-wmi.h>
+#include <linux/platform_device.h>
+
+#define DRVNAME "led_aaeon"
+#define ASUS_NB_WMI_EVENT_GUID   "0B3CBB35-E3C2-45ED-91C2-4C5A6D195D1C"
+#define AAEON_WMI_MGMT_GUID      "97845ED0-4E6D-11DE-8A39-0800200C9A66"
+
+#define GET_LED_NUMBER_ID        0x00060000
+#define GET_LED_METHOD_ID        0x00060001
+#define SET_LED_METHOD_ID        0x00060002
+#define GET_LED_NUMBER_METHOD_ID 0x10
+
+
+struct aaeon_led_data {
+	int id;
+	struct led_classdev cdev;
+};
+
+static int aaeon_led_get_number(void)
+{
+	int err, retval;
+
+	err = asus_wmi_evaluate_method(GET_LED_NUMBER_ID,
+				       GET_LED_NUMBER_METHOD_ID,
+				       0, &retval);
+	if (err)
+		return err;
+
+	return retval;
+}
+
+static enum led_brightness aaeon_led_brightness_get(struct led_classdev
+						      *cdev)
+{
+	int err, brightness;
+	struct aaeon_led_data *led =
+			container_of(cdev, struct aaeon_led_data, cdev);
+	u32 arg0;
+
+	arg0 = (u32)(led->id & 0xF);
+	err = asus_wmi_evaluate_method(GET_LED_METHOD_ID, arg0, 0, &brightness);
+	if (err)
+		return err;
+
+	return brightness;
+};
+
+static void aaeon_led_brightness_set(struct led_classdev *cdev,
+				       enum led_brightness brightness)
+{
+	int err, retval;
+	struct aaeon_led_data *led =
+			container_of(cdev, struct aaeon_led_data, cdev);
+	u32 arg0;
+
+	arg0 = (u32)(led->id & 0xF);
+	if (brightness != LED_OFF)
+		arg0 |= BIT(16);
+
+	err = asus_wmi_evaluate_method(SET_LED_METHOD_ID, arg0, 0, &retval);
+};
+
+static int __init aaeon_add_led_device(struct platform_device *pdev,
+					   int id)
+{
+	struct aaeon_led_data *led;
+
+	led = devm_kzalloc(&pdev->dev, sizeof(struct aaeon_led_data), GFP_KERNEL);
+	if (!led)
+		return -ENOMEM;
+
+	led->id = id;
+	led->cdev.brightness_get = aaeon_led_brightness_get;
+	led->cdev.brightness_set = aaeon_led_brightness_set;
+	led->cdev.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "led:%d:", id);
+
+	if (!led->cdev.name)
+		return -ENOMEM;
+
+	return devm_led_classdev_register(&pdev->dev, &led->cdev);
+}
+
+static int aaeon_led_probe(struct platform_device *pdev)
+{
+	int err = -ENODEV, i;
+	int led_number = 0;
+
+	pr_debug("aaeon led device probe!\n");
+	/* Prevent other drivers adding this platfom device */
+	if (!wmi_has_guid(AAEON_WMI_MGMT_GUID)) {
+		pr_debug("AAEON Management GUID not found\n");
+		return -ENODEV;
+	}
+
+	/* Query the number of led devices board support */
+	led_number = aaeon_led_get_number();
+
+	/*
+	 * If the number is 0 or can't get the number of leds,
+	 * no need to register any led device node.
+	 */
+	if (led_number <= 0)
+		return -ENODEV;
+
+	for (i = 0; i < led_number; i++) {
+		err = aaeon_add_led_device(pdev, i);
+		if (err)
+			break;
+	}
+
+	return err;
+}
+
+static struct platform_driver aaeon_led_driver = {
+	.driver = {
+		.name = "leds-aaeon",
+	},
+};
+
+module_platform_driver_probe(aaeon_led_driver, aaeon_led_probe);
+
+MODULE_ALIAS("platform:leds-aaeon");
+MODULE_DESCRIPTION("AAEON LED Driver");
+MODULE_AUTHOR("Kunyang Fan <kunyang_fan@asus.com>");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/drivers/leds/leds-an30259a.c
+++ linux-qcom-6.8.0/drivers/leds/leds-an30259a.c
@@ -283,7 +283,10 @@
 	if (err < 0)
 		return err;
 
-	mutex_init(&chip->mutex);
+	err = devm_mutex_init(&client->dev, &chip->mutex);
+	if (err)
+		return err;
+
 	chip->client = client;
 	i2c_set_clientdata(client, chip);
 
@@ -317,17 +320,9 @@
 	return 0;
 
 exit:
-	mutex_destroy(&chip->mutex);
 	return err;
 }
 
-static void an30259a_remove(struct i2c_client *client)
-{
-	struct an30259a *chip = i2c_get_clientdata(client);
-
-	mutex_destroy(&chip->mutex);
-}
-
 static const struct of_device_id an30259a_match_table[] = {
 	{ .compatible = "panasonic,an30259a", },
 	{ /* sentinel */ },
@@ -347,7 +342,6 @@
 		.of_match_table = an30259a_match_table,
 	},
 	.probe = an30259a_probe,
-	.remove = an30259a_remove,
 	.id_table = an30259a_id,
 };
 
--- linux-qcom-6.8.0.orig/drivers/leds/leds-aw2013.c
+++ linux-qcom-6.8.0/drivers/leds/leds-aw2013.c
@@ -405,6 +405,7 @@
 			       chip->regulators);
 
 error:
+	mutex_unlock(&chip->mutex);
 	mutex_destroy(&chip->mutex);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/leds/leds-bd2606mvv.c
+++ linux-qcom-6.8.0/drivers/leds/leds-bd2606mvv.c
@@ -69,16 +69,14 @@
 
 static int bd2606mvv_probe(struct i2c_client *client)
 {
-	struct fwnode_handle *np, *child;
 	struct device *dev = &client->dev;
 	struct bd2606mvv_priv *priv;
 	struct fwnode_handle *led_fwnodes[BD2606_MAX_LEDS] = { 0 };
 	int active_pairs[BD2606_MAX_LEDS / 2] = { 0 };
 	int err, reg;
-	int i;
+	int i, j;
 
-	np = dev_fwnode(dev);
-	if (!np)
+	if (!dev_fwnode(dev))
 		return -ENODEV;
 
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -94,20 +92,18 @@
 
 	i2c_set_clientdata(client, priv);
 
-	fwnode_for_each_available_child_node(np, child) {
+	device_for_each_child_node_scoped(dev, child) {
 		struct bd2606mvv_led *led;
 
 		err = fwnode_property_read_u32(child, "reg", &reg);
-		if (err) {
-			fwnode_handle_put(child);
+		if (err)
 			return err;
-		}
-		if (reg < 0 || reg >= BD2606_MAX_LEDS || led_fwnodes[reg]) {
-			fwnode_handle_put(child);
+
+		if (reg < 0 || reg >= BD2606_MAX_LEDS || led_fwnodes[reg])
 			return -EINVAL;
-		}
+
 		led = &priv->leds[reg];
-		led_fwnodes[reg] = child;
+		led_fwnodes[reg] = fwnode_handle_get(child);
 		active_pairs[reg / 2]++;
 		led->priv = priv;
 		led->led_no = reg;
@@ -130,7 +126,8 @@
 						     &priv->leds[i].ldev,
 						     &init_data);
 		if (err < 0) {
-			fwnode_handle_put(child);
+			for (j = i; j < BD2606_MAX_LEDS; j++)
+				fwnode_handle_put(led_fwnodes[j]);
 			return dev_err_probe(dev, err,
 					     "couldn't register LED %s\n",
 					     priv->leds[i].ldev.name);
--- linux-qcom-6.8.0.orig/drivers/leds/leds-gpio.c
+++ linux-qcom-6.8.0/drivers/leds/leds-gpio.c
@@ -150,7 +150,7 @@
 {
 	struct fwnode_handle *child;
 	struct gpio_leds_priv *priv;
-	int count, ret;
+	int count, used, ret;
 
 	count = device_get_child_node_count(dev);
 	if (!count)
@@ -159,9 +159,11 @@
 	priv = devm_kzalloc(dev, struct_size(priv, leds, count), GFP_KERNEL);
 	if (!priv)
 		return ERR_PTR(-ENOMEM);
+	priv->num_leds = count;
+	used = 0;
 
 	device_for_each_child_node(dev, child) {
-		struct gpio_led_data *led_dat = &priv->leds[priv->num_leds];
+		struct gpio_led_data *led_dat = &priv->leds[used];
 		struct gpio_led led = {};
 
 		/*
@@ -197,8 +199,9 @@
 		/* Set gpiod label to match the corresponding LED name. */
 		gpiod_set_consumer_name(led_dat->gpiod,
 					led_dat->cdev.dev->kobj.name);
-		priv->num_leds++;
+		used++;
 	}
+	priv->num_leds = used;
 
 	return priv;
 }
--- linux-qcom-6.8.0.orig/drivers/leds/leds-lp55xx-common.c
+++ linux-qcom-6.8.0/drivers/leds/leds-lp55xx-common.c
@@ -580,9 +580,6 @@
 	if (ret)
 		return ret;
 
-	if (*chan_nr < 0 || *chan_nr > cfg->max_channel)
-		return -EINVAL;
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/leds/leds-max5970.c
+++ linux-qcom-6.8.0/drivers/leds/leds-max5970.c
@@ -45,7 +45,7 @@
 
 static int max5970_led_probe(struct platform_device *pdev)
 {
-	struct fwnode_handle *led_node, *child;
+	struct fwnode_handle *child;
 	struct device *dev = &pdev->dev;
 	struct regmap *regmap;
 	struct max5970_led *ddata;
@@ -55,7 +55,8 @@
 	if (!regmap)
 		return -ENODEV;
 
-	led_node = device_get_named_child_node(dev->parent, "leds");
+	struct fwnode_handle *led_node __free(fwnode_handle) =
+		device_get_named_child_node(dev->parent, "leds");
 	if (!led_node)
 		return -ENODEV;
 
--- linux-qcom-6.8.0.orig/drivers/leds/leds-mlxreg.c
+++ linux-qcom-6.8.0/drivers/leds/leds-mlxreg.c
@@ -257,6 +257,7 @@
 {
 	struct mlxreg_core_platform_data *led_pdata;
 	struct mlxreg_led_priv_data *priv;
+	int err;
 
 	led_pdata = dev_get_platdata(&pdev->dev);
 	if (!led_pdata) {
@@ -268,26 +269,21 @@
 	if (!priv)
 		return -ENOMEM;
 
-	mutex_init(&priv->access_lock);
+	err = devm_mutex_init(&pdev->dev, &priv->access_lock);
+	if (err)
+		return err;
+
 	priv->pdev = pdev;
 	priv->pdata = led_pdata;
 
 	return mlxreg_led_config(priv);
 }
 
-static void mlxreg_led_remove(struct platform_device *pdev)
-{
-	struct mlxreg_led_priv_data *priv = dev_get_drvdata(&pdev->dev);
-
-	mutex_destroy(&priv->access_lock);
-}
-
 static struct platform_driver mlxreg_led_driver = {
 	.driver = {
 	    .name = "leds-mlxreg",
 	},
 	.probe = mlxreg_led_probe,
-	.remove_new = mlxreg_led_remove,
 };
 
 module_platform_driver(mlxreg_led_driver);
--- linux-qcom-6.8.0.orig/drivers/leds/leds-pca995x.c
+++ linux-qcom-6.8.0/drivers/leds/leds-pca995x.c
@@ -19,10 +19,6 @@
 #define PCA995X_MODE1			0x00
 #define PCA995X_MODE2			0x01
 #define PCA995X_LEDOUT0			0x02
-#define PCA9955B_PWM0			0x08
-#define PCA9952_PWM0			0x0A
-#define PCA9952_IREFALL			0x43
-#define PCA9955B_IREFALL		0x45
 
 /* Auto-increment disabled. Normal mode */
 #define PCA995X_MODE1_CFG		0x00
@@ -34,17 +30,38 @@
 #define PCA995X_LDRX_MASK		0x3
 #define PCA995X_LDRX_BITS		2
 
-#define PCA995X_MAX_OUTPUTS		16
+#define PCA995X_MAX_OUTPUTS		24
 #define PCA995X_OUTPUTS_PER_REG		4
 
 #define PCA995X_IREFALL_FULL_CFG	0xFF
 #define PCA995X_IREFALL_HALF_CFG	(PCA995X_IREFALL_FULL_CFG / 2)
 
-#define PCA995X_TYPE_NON_B		0
-#define PCA995X_TYPE_B			1
-
 #define ldev_to_led(c)	container_of(c, struct pca995x_led, ldev)
 
+struct pca995x_chipdef {
+	unsigned int num_leds;
+	u8 pwm_base;
+	u8 irefall;
+};
+
+static const struct pca995x_chipdef pca9952_chipdef = {
+	.num_leds	= 16,
+	.pwm_base	= 0x0a,
+	.irefall	= 0x43,
+};
+
+static const struct pca995x_chipdef pca9955b_chipdef = {
+	.num_leds	= 16,
+	.pwm_base	= 0x08,
+	.irefall	= 0x45,
+};
+
+static const struct pca995x_chipdef pca9956b_chipdef = {
+	.num_leds	= 24,
+	.pwm_base	= 0x0a,
+	.irefall	= 0x40,
+};
+
 struct pca995x_led {
 	unsigned int led_no;
 	struct led_classdev ldev;
@@ -54,7 +71,7 @@
 struct pca995x_chip {
 	struct regmap *regmap;
 	struct pca995x_led leds[PCA995X_MAX_OUTPUTS];
-	int btype;
+	const struct pca995x_chipdef *chipdef;
 };
 
 static int pca995x_brightness_set(struct led_classdev *led_cdev,
@@ -62,10 +79,11 @@
 {
 	struct pca995x_led *led = ldev_to_led(led_cdev);
 	struct pca995x_chip *chip = led->chip;
+	const struct pca995x_chipdef *chipdef = chip->chipdef;
 	u8 ledout_addr, pwmout_addr;
 	int shift, ret;
 
-	pwmout_addr = (chip->btype ? PCA9955B_PWM0 : PCA9952_PWM0) + led->led_no;
+	pwmout_addr = chipdef->pwm_base + led->led_no;
 	ledout_addr = PCA995X_LEDOUT0 + (led->led_no / PCA995X_OUTPUTS_PER_REG);
 	shift = PCA995X_LDRX_BITS * (led->led_no % PCA995X_OUTPUTS_PER_REG);
 
@@ -102,43 +120,38 @@
 static int pca995x_probe(struct i2c_client *client)
 {
 	struct fwnode_handle *led_fwnodes[PCA995X_MAX_OUTPUTS] = { 0 };
-	struct fwnode_handle *np, *child;
 	struct device *dev = &client->dev;
+	const struct pca995x_chipdef *chipdef;
 	struct pca995x_chip *chip;
 	struct pca995x_led *led;
-	int i, btype, reg, ret;
+	int i, j, reg, ret;
 
-	btype = (unsigned long)device_get_match_data(&client->dev);
+	chipdef = device_get_match_data(&client->dev);
 
-	np = dev_fwnode(dev);
-	if (!np)
+	if (!dev_fwnode(dev))
 		return -ENODEV;
 
 	chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL);
 	if (!chip)
 		return -ENOMEM;
 
-	chip->btype = btype;
+	chip->chipdef = chipdef;
 	chip->regmap = devm_regmap_init_i2c(client, &pca995x_regmap);
 	if (IS_ERR(chip->regmap))
 		return PTR_ERR(chip->regmap);
 
 	i2c_set_clientdata(client, chip);
 
-	fwnode_for_each_available_child_node(np, child) {
+	device_for_each_child_node_scoped(dev, child) {
 		ret = fwnode_property_read_u32(child, "reg", &reg);
-		if (ret) {
-			fwnode_handle_put(child);
+		if (ret)
 			return ret;
-		}
 
-		if (reg < 0 || reg >= PCA995X_MAX_OUTPUTS || led_fwnodes[reg]) {
-			fwnode_handle_put(child);
+		if (reg < 0 || reg >= PCA995X_MAX_OUTPUTS || led_fwnodes[reg])
 			return -EINVAL;
-		}
 
 		led = &chip->leds[reg];
-		led_fwnodes[reg] = child;
+		led_fwnodes[reg] = fwnode_handle_get(child);
 		led->chip = chip;
 		led->led_no = reg;
 		led->ldev.brightness_set_blocking = pca995x_brightness_set;
@@ -157,7 +170,8 @@
 						     &chip->leds[i].ldev,
 						     &init_data);
 		if (ret < 0) {
-			fwnode_handle_put(child);
+			for (j = i; j < PCA995X_MAX_OUTPUTS; j++)
+				fwnode_handle_put(led_fwnodes[j]);
 			return dev_err_probe(dev, ret,
 					     "Could not register LED %s\n",
 					     chip->leds[i].ldev.name);
@@ -170,21 +184,21 @@
 		return ret;
 
 	/* IREF Output current value for all LEDn outputs */
-	return regmap_write(chip->regmap,
-			    btype ? PCA9955B_IREFALL : PCA9952_IREFALL,
-			    PCA995X_IREFALL_HALF_CFG);
+	return regmap_write(chip->regmap, chipdef->irefall, PCA995X_IREFALL_HALF_CFG);
 }
 
 static const struct i2c_device_id pca995x_id[] = {
-	{ "pca9952", .driver_data = (kernel_ulong_t)PCA995X_TYPE_NON_B },
-	{ "pca9955b", .driver_data = (kernel_ulong_t)PCA995X_TYPE_B },
+	{ "pca9952", .driver_data = (kernel_ulong_t)&pca9952_chipdef },
+	{ "pca9955b", .driver_data = (kernel_ulong_t)&pca9955b_chipdef },
+	{ "pca9956b", .driver_data = (kernel_ulong_t)&pca9956b_chipdef },
 	{}
 };
 MODULE_DEVICE_TABLE(i2c, pca995x_id);
 
 static const struct of_device_id pca995x_of_match[] = {
-	{ .compatible = "nxp,pca9952",  .data = (void *)PCA995X_TYPE_NON_B },
-	{ .compatible = "nxp,pca9955b", .data = (void *)PCA995X_TYPE_B },
+	{ .compatible = "nxp,pca9952", .data = &pca9952_chipdef },
+	{ .compatible = "nxp,pca9955b", . data = &pca9955b_chipdef },
+	{ .compatible = "nxp,pca9956b", .data = &pca9956b_chipdef },
 	{},
 };
 MODULE_DEVICE_TABLE(of, pca995x_of_match);
--- linux-qcom-6.8.0.orig/drivers/leds/leds-pwm.c
+++ linux-qcom-6.8.0/drivers/leds/leds-pwm.c
@@ -53,7 +53,13 @@
 		duty = led_dat->pwmstate.period - duty;
 
 	led_dat->pwmstate.duty_cycle = duty;
-	led_dat->pwmstate.enabled = true;
+	/*
+	 * Disabling a PWM doesn't guarantee that it emits the inactive level.
+	 * So keep it on. Only for suspending the PWM should be disabled because
+	 * otherwise it refuses to suspend. The possible downside is that the
+	 * LED might stay (or even go) on.
+	 */
+	led_dat->pwmstate.enabled = !(led_cdev->flags & LED_SUSPENDED);
 	return pwm_apply_might_sleep(led_dat->pwm, &led_dat->pwmstate);
 }
 
--- linux-qcom-6.8.0.orig/drivers/leds/leds-spi-byte.c
+++ linux-qcom-6.8.0/drivers/leds/leds-spi-byte.c
@@ -91,7 +91,6 @@
 		dev_err(dev, "Device must have exactly one LED sub-node.");
 		return -EINVAL;
 	}
-	child = of_get_next_available_child(dev_of_node(dev), NULL);
 
 	led = devm_kzalloc(dev, sizeof(*led), GFP_KERNEL);
 	if (!led)
@@ -107,11 +106,13 @@
 	led->ldev.max_brightness = led->cdef->max_value - led->cdef->off_value;
 	led->ldev.brightness_set_blocking = spi_byte_brightness_set_blocking;
 
+	child = of_get_next_available_child(dev_of_node(dev), NULL);
 	state = of_get_property(child, "default-state", NULL);
 	if (state) {
 		if (!strcmp(state, "on")) {
 			led->ldev.brightness = led->ldev.max_brightness;
 		} else if (strcmp(state, "off")) {
+			of_node_put(child);
 			/* all other cases except "off" */
 			dev_err(dev, "default-state can only be 'on' or 'off'");
 			return -EINVAL;
@@ -122,9 +123,12 @@
 
 	ret = devm_led_classdev_register(&spi->dev, &led->ldev);
 	if (ret) {
+		of_node_put(child);
 		mutex_destroy(&led->mutex);
 		return ret;
 	}
+
+	of_node_put(child);
 	spi_set_drvdata(spi, led);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/leds/leds-ss4200.c
+++ linux-qcom-6.8.0/drivers/leds/leds-ss4200.c
@@ -356,8 +356,10 @@
 
 	nas_gpio_pci_dev = dev;
 	status = pci_read_config_dword(dev, PMBASE, &g_pm_io_base);
-	if (status)
+	if (status) {
+		status = pcibios_err_to_errno(status);
 		goto out;
+	}
 	g_pm_io_base &= 0x00000ff80;
 
 	status = pci_read_config_dword(dev, GPIO_CTRL, &gc);
@@ -369,8 +371,9 @@
 	}
 
 	status = pci_read_config_dword(dev, GPIO_BASE, &nas_gpio_io_base);
-	if (0 > status) {
+	if (status) {
 		dev_info(&dev->dev, "Unable to read GPIOBASE.\n");
+		status = pcibios_err_to_errno(status);
 		goto out;
 	}
 	dev_dbg(&dev->dev, ": GPIOBASE = 0x%08x\n", nas_gpio_io_base);
--- linux-qcom-6.8.0.orig/drivers/leds/trigger/ledtrig-netdev.c
+++ linux-qcom-6.8.0/drivers/leds/trigger/ledtrig-netdev.c
@@ -504,12 +504,12 @@
 	trigger_data->duplex = DUPLEX_UNKNOWN;
 	switch (evt) {
 	case NETDEV_CHANGENAME:
-		get_device_state(trigger_data);
-		fallthrough;
 	case NETDEV_REGISTER:
 		dev_put(trigger_data->net_dev);
 		dev_hold(dev);
 		trigger_data->net_dev = dev;
+		if (evt == NETDEV_CHANGENAME)
+			get_device_state(trigger_data);
 		break;
 	case NETDEV_UNREGISTER:
 		dev_put(trigger_data->net_dev);
--- linux-qcom-6.8.0.orig/drivers/leds/trigger/ledtrig-timer.c
+++ linux-qcom-6.8.0/drivers/leds/trigger/ledtrig-timer.c
@@ -110,11 +110,6 @@
 		led_cdev->flags &= ~LED_INIT_DEFAULT_TRIGGER;
 	}
 
-	/*
-	 * If "set brightness to 0" is pending in workqueue, we don't
-	 * want that to be reordered after blink_set()
-	 */
-	flush_work(&led_cdev->set_brightness_work);
 	led_blink_set(led_cdev, &led_cdev->blink_delay_on,
 		      &led_cdev->blink_delay_off);
 
--- linux-qcom-6.8.0.orig/drivers/macintosh/therm_windtunnel.c
+++ linux-qcom-6.8.0/drivers/macintosh/therm_windtunnel.c
@@ -551,7 +551,7 @@
 	platform_driver_unregister( &therm_of_driver );
 
 	if( x.of_dev )
-		of_device_unregister( x.of_dev );
+		of_platform_device_destroy(&x.of_dev->dev, NULL);
 }
 
 module_init(g4fan_init);
--- linux-qcom-6.8.0.orig/drivers/macintosh/via-macii.c
+++ linux-qcom-6.8.0/drivers/macintosh/via-macii.c
@@ -140,24 +140,19 @@
 /* Initialize the driver */
 static int macii_init(void)
 {
-	unsigned long flags;
 	int err;
 
-	local_irq_save(flags);
-
 	err = macii_init_via();
 	if (err)
-		goto out;
+		return err;
 
 	err = request_irq(IRQ_MAC_ADB, macii_interrupt, 0, "ADB",
 			  macii_interrupt);
 	if (err)
-		goto out;
+		return err;
 
 	macii_state = idle;
-out:
-	local_irq_restore(flags);
-	return err;
+	return 0;
 }
 
 /* initialize the hardware */
--- linux-qcom-6.8.0.orig/drivers/mailbox/Kconfig
+++ linux-qcom-6.8.0/drivers/mailbox/Kconfig
@@ -273,6 +273,14 @@
 	  to send message between application processors and MCU. Say Y here if
 	  you want to build the Spreatrum mailbox controller driver.
 
+config QCOM_CPUCP_MBOX
+	tristate "Qualcomm Technologies, Inc. CPUCP mailbox driver"
+	depends on ARCH_QCOM || (COMPILE_TEST && 64BIT)
+	help
+	  Qualcomm Technologies, Inc. CPUSS Control Processor (CPUCP) mailbox
+	  controller driver enables communication between AP and CPUCP. Say
+	  Y here if you want to build this driver.
+
 config QCOM_IPCC
 	tristate "Qualcomm Technologies, Inc. IPCC driver"
 	depends on ARCH_QCOM || COMPILE_TEST
--- linux-qcom-6.8.0.orig/drivers/mailbox/Makefile
+++ linux-qcom-6.8.0/drivers/mailbox/Makefile
@@ -55,8 +55,12 @@
 
 obj-$(CONFIG_ZYNQMP_IPI_MBOX)	+= zynqmp-ipi-mailbox.o
 
+obj-$(CONFIG_GUNYAH)		+= gunyah-msgq.o
+
 obj-$(CONFIG_SUN6I_MSGBOX)	+= sun6i-msgbox.o
 
 obj-$(CONFIG_SPRD_MBOX)		+= sprd-mailbox.o
 
+obj-$(CONFIG_QCOM_CPUCP_MBOX)	+= qcom-cpucp-mbox.o
+
 obj-$(CONFIG_QCOM_IPCC)		+= qcom-ipcc.o
--- linux-qcom-6.8.0.orig/drivers/mailbox/arm_mhuv2.c
+++ linux-qcom-6.8.0/drivers/mailbox/arm_mhuv2.c
@@ -500,7 +500,7 @@
 static struct mbox_chan *get_irq_chan_comb(struct mhuv2 *mhu, u32 __iomem *reg)
 {
 	struct mbox_chan *chans = mhu->mbox.chans;
-	int channel = 0, i, offset = 0, windows, protocol, ch_wn;
+	int channel = 0, i, j, offset = 0, windows, protocol, ch_wn;
 	u32 stat;
 
 	for (i = 0; i < MHUV2_CMB_INT_ST_REG_CNT; i++) {
@@ -510,9 +510,9 @@
 
 		ch_wn = i * MHUV2_STAT_BITS + __builtin_ctz(stat);
 
-		for (i = 0; i < mhu->length; i += 2) {
-			protocol = mhu->protocols[i];
-			windows = mhu->protocols[i + 1];
+		for (j = 0; j < mhu->length; j += 2) {
+			protocol = mhu->protocols[j];
+			windows = mhu->protocols[j + 1];
 
 			if (ch_wn >= offset + windows) {
 				if (protocol == DOORBELL)
--- linux-qcom-6.8.0.orig/drivers/mailbox/bcm2835-mailbox.c
+++ linux-qcom-6.8.0/drivers/mailbox/bcm2835-mailbox.c
@@ -145,7 +145,8 @@
 	spin_lock_init(&mbox->lock);
 
 	ret = devm_request_irq(dev, irq_of_parse_and_map(dev->of_node, 0),
-			       bcm2835_mbox_irq, 0, dev_name(dev), mbox);
+			       bcm2835_mbox_irq, IRQF_NO_SUSPEND, dev_name(dev),
+			       mbox);
 	if (ret) {
 		dev_err(dev, "Failed to register a mailbox IRQ handler: %d\n",
 			ret);
--- linux-qcom-6.8.0.orig/drivers/mailbox/gunyah-msgq.c
+++ linux-qcom-6.8.0/drivers/mailbox/gunyah-msgq.c
@@ -0,0 +1,219 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/mailbox_controller.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/gunyah.h>
+#include <linux/printk.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/wait.h>
+
+#define mbox_chan_to_msgq(chan) (container_of(chan->mbox, struct gh_msgq, mbox))
+
+static irqreturn_t gh_msgq_rx_irq_handler(int irq, void *data)
+{
+	struct gh_msgq *msgq = data;
+	struct gh_msgq_rx_data rx_data;
+	enum gh_error gh_error;
+	bool ready = true;
+
+	while (ready) {
+		gh_error = gh_hypercall_msgq_recv(msgq->rx_ghrsc->capid,
+				&rx_data.data, sizeof(rx_data.data),
+				&rx_data.length, &ready);
+		if (gh_error != GH_ERROR_OK) {
+			if (gh_error != GH_ERROR_MSGQUEUE_EMPTY)
+				dev_warn(msgq->mbox.dev, "Failed to receive data: %d\n", gh_error);
+			break;
+		}
+		if (likely(gh_msgq_chan(msgq)->cl))
+			mbox_chan_received_data(gh_msgq_chan(msgq), &rx_data);
+	}
+
+	return IRQ_HANDLED;
+}
+
+/* Fired when message queue transitions from "full" to "space available" to send messages */
+static irqreturn_t gh_msgq_tx_irq_handler(int irq, void *data)
+{
+	struct gh_msgq *msgq = data;
+
+	mbox_chan_txdone(gh_msgq_chan(msgq), 0);
+
+	return IRQ_HANDLED;
+}
+
+/* Fired after sending message and hypercall told us there was more space available. */
+static void gh_msgq_txdone_tasklet(struct tasklet_struct *tasklet)
+{
+	struct gh_msgq *msgq = container_of(tasklet, struct gh_msgq, txdone_tasklet);
+
+	mbox_chan_txdone(gh_msgq_chan(msgq), msgq->last_ret);
+}
+
+static int gh_msgq_send_data(struct mbox_chan *chan, void *data)
+{
+	struct gh_msgq *msgq = mbox_chan_to_msgq(chan);
+	struct gh_msgq_tx_data *msgq_data = data;
+	u64 tx_flags = 0;
+	enum gh_error gh_error;
+	bool ready;
+
+	if (!msgq->tx_ghrsc)
+		return -EOPNOTSUPP;
+
+	if (msgq_data->push)
+		tx_flags |= GH_HYPERCALL_MSGQ_TX_FLAGS_PUSH;
+
+	gh_error = gh_hypercall_msgq_send(msgq->tx_ghrsc->capid, msgq_data->length, msgq_data->data,
+						tx_flags, &ready);
+
+	/**
+	 * unlikely because Linux tracks state of msgq and should not try to
+	 * send message when msgq is full.
+	 */
+	if (unlikely(gh_error == GH_ERROR_MSGQUEUE_FULL))
+		return -EAGAIN;
+
+	/**
+	 * Propagate all other errors to client. If we return error to mailbox
+	 * framework, then no other messages can be sent and nobody will know
+	 * to retry this message.
+	 */
+	msgq->last_ret = gh_error_remap(gh_error);
+
+	/**
+	 * This message was successfully sent, but message queue isn't ready to
+	 * accept more messages because it's now full. Mailbox framework
+	 * requires that we only report that message was transmitted when
+	 * we're ready to transmit another message. We'll get that in the form
+	 * of tx IRQ once the other side starts to drain the msgq.
+	 */
+	if (gh_error == GH_ERROR_OK) {
+		if (!ready)
+			return 0;
+	} else {
+		dev_err(msgq->mbox.dev, "Failed to send data: %d (%d)\n", gh_error, msgq->last_ret);
+	}
+
+	/**
+	 * We can send more messages. Mailbox framework requires that tx done
+	 * happens asynchronously to sending the message. Gunyah message queues
+	 * tell us right away on the hypercall return whether we can send more
+	 * messages. To work around this, defer the txdone to a tasklet.
+	 */
+	tasklet_schedule(&msgq->txdone_tasklet);
+
+	return 0;
+}
+
+static struct mbox_chan_ops gh_msgq_ops = {
+	.send_data = gh_msgq_send_data,
+};
+
+/**
+ * gh_msgq_init() - Initialize a Gunyah message queue with an mbox_client
+ * @parent: device parent used for the mailbox controller
+ * @msgq: Pointer to the gh_msgq to initialize
+ * @cl: A mailbox client to bind to the mailbox channel that the message queue creates
+ * @tx_ghrsc: optional, the transmission side of the message queue
+ * @rx_ghrsc: optional, the receiving side of the message queue
+ *
+ * At least one of tx_ghrsc and rx_ghrsc must be not NULL. Most message queue use cases come with
+ * a pair of message queues to facilitate bidirectional communication. When tx_ghrsc is set,
+ * the client can send messages with mbox_send_message(gh_msgq_chan(msgq), msg). When rx_ghrsc
+ * is set, the mbox_client must register an .rx_callback() and the message queue driver will
+ * deliver all available messages upon receiving the RX ready interrupt. The messages should be
+ * consumed or copied by the client right away as the gh_msgq_rx_data will be replaced/destroyed
+ * after the callback.
+ *
+ * Returns - 0 on success, negative otherwise
+ */
+int gh_msgq_init(struct device *parent, struct gh_msgq *msgq, struct mbox_client *cl,
+		 struct gh_resource *tx_ghrsc, struct gh_resource *rx_ghrsc)
+{
+	int ret;
+
+	/* Must have at least a tx_ghrsc or rx_ghrsc and that they are the right device types */
+	if ((!tx_ghrsc && !rx_ghrsc) ||
+	    (tx_ghrsc && tx_ghrsc->type != GH_RESOURCE_TYPE_MSGQ_TX) ||
+	    (rx_ghrsc && rx_ghrsc->type != GH_RESOURCE_TYPE_MSGQ_RX))
+		return -EINVAL;
+
+	msgq->mbox.dev = parent;
+	msgq->mbox.ops = &gh_msgq_ops;
+	msgq->mbox.num_chans = 1;
+	msgq->mbox.txdone_irq = true;
+	msgq->mbox.chans = &msgq->mbox_chan;
+
+	ret = mbox_controller_register(&msgq->mbox);
+	if (ret)
+		return ret;
+
+	ret = mbox_bind_client(gh_msgq_chan(msgq), cl);
+	if (ret)
+		goto err_mbox;
+
+	if (tx_ghrsc) {
+		msgq->tx_ghrsc = tx_ghrsc;
+
+		ret = request_irq(msgq->tx_ghrsc->irq, gh_msgq_tx_irq_handler, 0, "gh_msgq_tx",
+				msgq);
+		if (ret)
+			goto err_tx_ghrsc;
+
+		enable_irq_wake(msgq->tx_ghrsc->irq);
+
+		tasklet_setup(&msgq->txdone_tasklet, gh_msgq_txdone_tasklet);
+	}
+
+	if (rx_ghrsc) {
+		msgq->rx_ghrsc = rx_ghrsc;
+
+		ret = request_threaded_irq(msgq->rx_ghrsc->irq, NULL, gh_msgq_rx_irq_handler,
+						IRQF_ONESHOT, "gh_msgq_rx", msgq);
+		if (ret)
+			goto err_tx_irq;
+
+		enable_irq_wake(msgq->rx_ghrsc->irq);
+	}
+
+	return 0;
+err_tx_irq:
+	if (msgq->tx_ghrsc)
+		free_irq(msgq->tx_ghrsc->irq, msgq);
+
+	msgq->rx_ghrsc = NULL;
+err_tx_ghrsc:
+	msgq->tx_ghrsc = NULL;
+err_mbox:
+	mbox_controller_unregister(&msgq->mbox);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(gh_msgq_init);
+
+void gh_msgq_remove(struct gh_msgq *msgq)
+{
+	mbox_free_channel(gh_msgq_chan(msgq));
+
+	if (msgq->rx_ghrsc)
+		free_irq(msgq->rx_ghrsc->irq, msgq);
+
+	if (msgq->tx_ghrsc) {
+		tasklet_kill(&msgq->txdone_tasklet);
+		free_irq(msgq->tx_ghrsc->irq, msgq);
+	}
+
+	mbox_controller_unregister(&msgq->mbox);
+
+	msgq->rx_ghrsc = NULL;
+	msgq->tx_ghrsc = NULL;
+}
+EXPORT_SYMBOL_GPL(gh_msgq_remove);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Gunyah Message Queue Driver");
--- linux-qcom-6.8.0.orig/drivers/mailbox/imx-mailbox.c
+++ linux-qcom-6.8.0/drivers/mailbox/imx-mailbox.c
@@ -219,6 +219,8 @@
 			     void *data)
 {
 	u32 *arg = data;
+	u32 val;
+	int ret;
 
 	switch (cp->type) {
 	case IMX_MU_TYPE_TX:
@@ -230,7 +232,13 @@
 		tasklet_schedule(&cp->txdb_tasklet);
 		break;
 	case IMX_MU_TYPE_TXDB_V2:
-		imx_mu_xcr_rmw(priv, IMX_MU_GCR, IMX_MU_xCR_GIRn(priv->dcfg->type, cp->idx), 0);
+		imx_mu_write(priv, IMX_MU_xCR_GIRn(priv->dcfg->type, cp->idx),
+			     priv->dcfg->xCR[IMX_MU_GCR]);
+		ret = readl_poll_timeout(priv->base + priv->dcfg->xCR[IMX_MU_GCR], val,
+					 !(val & IMX_MU_xCR_GIRn(priv->dcfg->type, cp->idx)),
+					 0, 1000);
+		if (ret)
+			dev_warn_ratelimited(priv->dev, "channel type: %d failure\n", cp->type);
 		break;
 	default:
 		dev_warn_ratelimited(priv->dev, "Send data on wrong channel type: %d\n", cp->type);
--- linux-qcom-6.8.0.orig/drivers/mailbox/mtk-cmdq-mailbox.c
+++ linux-qcom-6.8.0/drivers/mailbox/mtk-cmdq-mailbox.c
@@ -465,7 +465,7 @@
 	struct cmdq_task *task, *tmp;
 	unsigned long flags;
 
-	WARN_ON(pm_runtime_get_sync(cmdq->mbox.dev));
+	WARN_ON(pm_runtime_get_sync(cmdq->mbox.dev) < 0);
 
 	spin_lock_irqsave(&thread->chan->lock, flags);
 	if (list_empty(&thread->task_busy_list))
@@ -662,12 +662,6 @@
 		cmdq->mbox.chans[i].con_priv = (void *)&cmdq->thread[i];
 	}
 
-	err = devm_mbox_controller_register(dev, &cmdq->mbox);
-	if (err < 0) {
-		dev_err(dev, "failed to register mailbox: %d\n", err);
-		return err;
-	}
-
 	platform_set_drvdata(pdev, cmdq);
 
 	WARN_ON(clk_bulk_prepare(cmdq->pdata->gce_num, cmdq->clocks));
@@ -695,6 +689,12 @@
 	pm_runtime_set_autosuspend_delay(dev, CMDQ_MBOX_AUTOSUSPEND_DELAY_MS);
 	pm_runtime_use_autosuspend(dev);
 
+	err = devm_mbox_controller_register(dev, &cmdq->mbox);
+	if (err < 0) {
+		dev_err(dev, "failed to register mailbox: %d\n", err);
+		return err;
+	}
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/mailbox/pcc.c
+++ linux-qcom-6.8.0/drivers/mailbox/pcc.c
@@ -269,6 +269,35 @@
 	return !!val;
 }
 
+static void check_and_ack(struct pcc_chan_info *pchan, struct mbox_chan *chan)
+{
+	struct acpi_pcct_ext_pcc_shared_memory pcc_hdr;
+
+	if (pchan->type != ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE)
+		return;
+	/* If the memory region has not been mapped, we cannot
+	 * determine if we need to send the message, but we still
+	 * need to set the cmd_update flag before returning.
+	 */
+	if (pchan->chan.shmem == NULL) {
+		pcc_chan_reg_read_modify_write(&pchan->cmd_update);
+		return;
+	}
+	memcpy_fromio(&pcc_hdr, pchan->chan.shmem,
+		      sizeof(struct acpi_pcct_ext_pcc_shared_memory));
+	/*
+	 * The PCC slave subspace channel needs to set the command complete bit
+	 * after processing message. If the PCC_ACK_FLAG is set, it should also
+	 * ring the doorbell.
+	 *
+	 * The PCC master subspace channel clears chan_in_use to free channel.
+	 */
+	if (le32_to_cpup(&pcc_hdr.flags) & PCC_ACK_FLAG_MASK)
+		pcc_send_data(chan, NULL);
+	else
+		pcc_chan_reg_read_modify_write(&pchan->cmd_update);
+}
+
 /**
  * pcc_mbox_irq - PCC mailbox interrupt handler
  * @irq:	interrupt number
@@ -306,14 +335,7 @@
 
 	mbox_chan_received_data(chan, NULL);
 
-	/*
-	 * The PCC slave subspace channel needs to set the command complete bit
-	 * and ring doorbell after processing message.
-	 *
-	 * The PCC master subspace channel clears chan_in_use to free channel.
-	 */
-	if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE)
-		pcc_send_data(chan, NULL);
+	check_and_ack(pchan, chan);
 	pchan->chan_in_use = false;
 
 	return IRQ_HANDLED;
@@ -365,14 +387,37 @@
 void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan)
 {
 	struct mbox_chan *chan = pchan->mchan;
+	struct pcc_chan_info *pchan_info;
+	struct pcc_mbox_chan *pcc_mbox_chan;
 
 	if (!chan || !chan->cl)
 		return;
+	pchan_info = chan->con_priv;
+	pcc_mbox_chan = &pchan_info->chan;
+	if (pcc_mbox_chan->shmem) {
+		iounmap(pcc_mbox_chan->shmem);
+		pcc_mbox_chan->shmem = NULL;
+	}
 
 	mbox_free_channel(chan);
 }
 EXPORT_SYMBOL_GPL(pcc_mbox_free_channel);
 
+int pcc_mbox_ioremap(struct mbox_chan *chan)
+{
+	struct pcc_chan_info *pchan_info;
+	struct pcc_mbox_chan *pcc_mbox_chan;
+
+	if (!chan || !chan->cl)
+		return -1;
+	pchan_info = chan->con_priv;
+	pcc_mbox_chan = &pchan_info->chan;
+	pcc_mbox_chan->shmem = ioremap(pcc_mbox_chan->shmem_base_addr,
+				       pcc_mbox_chan->shmem_size);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(pcc_mbox_ioremap);
+
 /**
  * pcc_send_data - Called from Mailbox Controller code. Used
  *		here only to ring the channel doorbell. The PCC client
--- linux-qcom-6.8.0.orig/drivers/mailbox/qcom-cpucp-mbox.c
+++ linux-qcom-6.8.0/drivers/mailbox/qcom-cpucp-mbox.c
@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/bitops.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/irqdomain.h>
+#include <linux/mailbox_controller.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#define APSS_CPUCP_IPC_CHAN_SUPPORTED		3
+#define APSS_CPUCP_MBOX_CMD_OFF			0x4
+
+/* Tx Registers */
+#define APSS_CPUCP_TX_MBOX_CMD(i)		(0x100 + ((i) * 8))
+
+/* Rx Registers */
+#define APSS_CPUCP_RX_MBOX_CMD(i)		(0x100 + ((i) * 8))
+#define APSS_CPUCP_RX_MBOX_MAP			0x4000
+#define APSS_CPUCP_RX_MBOX_STAT			0x4400
+#define APSS_CPUCP_RX_MBOX_CLEAR		0x4800
+#define APSS_CPUCP_RX_MBOX_EN			0x4c00
+#define APSS_CPUCP_RX_MBOX_CMD_MASK		GENMASK_ULL(63, 0)
+
+/**
+ * struct qcom_cpucp_mbox - Holder for the mailbox driver
+ * @chans:			The mailbox channel
+ * @mbox:			The mailbox controller
+ * @tx_base:			Base address of the CPUCP tx registers
+ * @rx_base:			Base address of the CPUCP rx registers
+ */
+struct qcom_cpucp_mbox {
+	struct mbox_chan chans[APSS_CPUCP_IPC_CHAN_SUPPORTED];
+	struct mbox_controller mbox;
+	void __iomem *tx_base;
+	void __iomem *rx_base;
+};
+
+static inline int channel_number(struct mbox_chan *chan)
+{
+	return chan - chan->mbox->chans;
+}
+
+static irqreturn_t qcom_cpucp_mbox_irq_fn(int irq, void *data)
+{
+	struct qcom_cpucp_mbox *cpucp = data;
+	u64 status;
+	int i;
+
+	status = readq(cpucp->rx_base + APSS_CPUCP_RX_MBOX_STAT);
+
+	for_each_set_bit(i, (unsigned long *)&status, APSS_CPUCP_IPC_CHAN_SUPPORTED) {
+		u32 val = readl(cpucp->rx_base + APSS_CPUCP_RX_MBOX_CMD(i) + APSS_CPUCP_MBOX_CMD_OFF);
+		struct mbox_chan *chan = &cpucp->chans[i];
+		unsigned long flags;
+
+		/* Provide mutual exclusion with changes to chan->cl */
+		spin_lock_irqsave(&chan->lock, flags);
+		if (chan->cl)
+			mbox_chan_received_data(chan, &val);
+		writeq(BIT(i), cpucp->rx_base + APSS_CPUCP_RX_MBOX_CLEAR);
+		spin_unlock_irqrestore(&chan->lock, flags);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int qcom_cpucp_mbox_startup(struct mbox_chan *chan)
+{
+	struct qcom_cpucp_mbox *cpucp = container_of(chan->mbox, struct qcom_cpucp_mbox, mbox);
+	unsigned long chan_id = channel_number(chan);
+	u64 val;
+
+	val = readq(cpucp->rx_base + APSS_CPUCP_RX_MBOX_EN);
+	val |= BIT(chan_id);
+	writeq(val, cpucp->rx_base + APSS_CPUCP_RX_MBOX_EN);
+
+	return 0;
+}
+
+static void qcom_cpucp_mbox_shutdown(struct mbox_chan *chan)
+{
+	struct qcom_cpucp_mbox *cpucp = container_of(chan->mbox, struct qcom_cpucp_mbox, mbox);
+	unsigned long chan_id = channel_number(chan);
+	u64 val;
+
+	val = readq(cpucp->rx_base + APSS_CPUCP_RX_MBOX_EN);
+	val &= ~BIT(chan_id);
+	writeq(val, cpucp->rx_base + APSS_CPUCP_RX_MBOX_EN);
+}
+
+static int qcom_cpucp_mbox_send_data(struct mbox_chan *chan, void *data)
+{
+	struct qcom_cpucp_mbox *cpucp = container_of(chan->mbox, struct qcom_cpucp_mbox, mbox);
+	unsigned long chan_id = channel_number(chan);
+	u32 *val = data;
+
+	writel(*val, cpucp->tx_base + APSS_CPUCP_TX_MBOX_CMD(chan_id) + APSS_CPUCP_MBOX_CMD_OFF);
+
+	return 0;
+}
+
+static const struct mbox_chan_ops qcom_cpucp_mbox_chan_ops = {
+	.startup = qcom_cpucp_mbox_startup,
+	.send_data = qcom_cpucp_mbox_send_data,
+	.shutdown = qcom_cpucp_mbox_shutdown
+};
+
+static int qcom_cpucp_mbox_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct qcom_cpucp_mbox *cpucp;
+	struct mbox_controller *mbox;
+	int irq, ret;
+
+	cpucp = devm_kzalloc(dev, sizeof(*cpucp), GFP_KERNEL);
+	if (!cpucp)
+		return -ENOMEM;
+
+	cpucp->rx_base = devm_of_iomap(dev, dev->of_node, 0, NULL);
+	if (IS_ERR(cpucp->rx_base))
+		return PTR_ERR(cpucp->rx_base);
+
+	cpucp->tx_base = devm_of_iomap(dev, dev->of_node, 1, NULL);
+	if (IS_ERR(cpucp->tx_base))
+		return PTR_ERR(cpucp->tx_base);
+
+	writeq(0, cpucp->rx_base + APSS_CPUCP_RX_MBOX_EN);
+	writeq(0, cpucp->rx_base + APSS_CPUCP_RX_MBOX_CLEAR);
+	writeq(0, cpucp->rx_base + APSS_CPUCP_RX_MBOX_MAP);
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return irq;
+
+	ret = devm_request_irq(dev, irq, qcom_cpucp_mbox_irq_fn,
+			       IRQF_TRIGGER_HIGH, "apss_cpucp_mbox", cpucp);
+	if (ret < 0)
+		return dev_err_probe(dev, ret, "Failed to register irq: %d\n", irq);
+
+	writeq(APSS_CPUCP_RX_MBOX_CMD_MASK, cpucp->rx_base + APSS_CPUCP_RX_MBOX_MAP);
+
+	mbox = &cpucp->mbox;
+	mbox->dev = dev;
+	mbox->num_chans = APSS_CPUCP_IPC_CHAN_SUPPORTED;
+	mbox->chans = cpucp->chans;
+	mbox->ops = &qcom_cpucp_mbox_chan_ops;
+
+	ret = devm_mbox_controller_register(dev, mbox);
+	if (ret)
+		return dev_err_probe(dev, ret, "Failed to create mailbox\n");
+
+	return 0;
+}
+
+static const struct of_device_id qcom_cpucp_mbox_of_match[] = {
+	{ .compatible = "qcom,x1e80100-cpucp-mbox" },
+	{}
+};
+MODULE_DEVICE_TABLE(of, qcom_cpucp_mbox_of_match);
+
+static struct platform_driver qcom_cpucp_mbox_driver = {
+	.probe = qcom_cpucp_mbox_probe,
+	.driver = {
+		.name = "qcom_cpucp_mbox",
+		.of_match_table = qcom_cpucp_mbox_of_match,
+	},
+};
+
+static int __init qcom_cpucp_mbox_init(void)
+{
+	return platform_driver_register(&qcom_cpucp_mbox_driver);
+}
+core_initcall(qcom_cpucp_mbox_init);
+
+static void __exit qcom_cpucp_mbox_exit(void)
+{
+	platform_driver_unregister(&qcom_cpucp_mbox_driver);
+}
+module_exit(qcom_cpucp_mbox_exit);
+
+MODULE_DESCRIPTION("QTI CPUCP MBOX Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/mailbox/rockchip-mailbox.c
+++ linux-qcom-6.8.0/drivers/mailbox/rockchip-mailbox.c
@@ -159,7 +159,7 @@
 	{ .compatible = "rockchip,rk3368-mailbox", .data = &rk3368_drv_data},
 	{ },
 };
-MODULE_DEVICE_TABLE(of, rockchp_mbox_of_match);
+MODULE_DEVICE_TABLE(of, rockchip_mbox_of_match);
 
 static int rockchip_mbox_probe(struct platform_device *pdev)
 {
--- linux-qcom-6.8.0.orig/drivers/md/bcache/bset.c
+++ linux-qcom-6.8.0/drivers/md/bcache/bset.c
@@ -54,7 +54,7 @@
 int __bch_count_data(struct btree_keys *b)
 {
 	unsigned int ret = 0;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	struct bkey *k;
 
 	if (b->ops->is_extents)
@@ -67,7 +67,7 @@
 {
 	va_list args;
 	struct bkey *k, *p = NULL;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	const char *err;
 
 	for_each_key(b, k, &iter) {
@@ -879,7 +879,7 @@
 	unsigned int status = BTREE_INSERT_STATUS_NO_INSERT;
 	struct bset *i = bset_tree_last(b)->data;
 	struct bkey *m, *prev = NULL;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	struct bkey preceding_key_on_stack = ZERO_KEY;
 	struct bkey *preceding_key_p = &preceding_key_on_stack;
 
@@ -895,9 +895,9 @@
 	else
 		preceding_key(k, &preceding_key_p);
 
-	m = bch_btree_iter_init(b, &iter, preceding_key_p);
+	m = bch_btree_iter_stack_init(b, &iter, preceding_key_p);
 
-	if (b->ops->insert_fixup(b, k, &iter, replace_key))
+	if (b->ops->insert_fixup(b, k, &iter.iter, replace_key))
 		return status;
 
 	status = BTREE_INSERT_STATUS_INSERT;
@@ -1100,33 +1100,33 @@
 				 btree_iter_cmp));
 }
 
-static struct bkey *__bch_btree_iter_init(struct btree_keys *b,
-					  struct btree_iter *iter,
-					  struct bkey *search,
-					  struct bset_tree *start)
+static struct bkey *__bch_btree_iter_stack_init(struct btree_keys *b,
+						struct btree_iter_stack *iter,
+						struct bkey *search,
+						struct bset_tree *start)
 {
 	struct bkey *ret = NULL;
 
-	iter->size = ARRAY_SIZE(iter->data);
-	iter->used = 0;
+	iter->iter.size = ARRAY_SIZE(iter->stack_data);
+	iter->iter.used = 0;
 
 #ifdef CONFIG_BCACHE_DEBUG
-	iter->b = b;
+	iter->iter.b = b;
 #endif
 
 	for (; start <= bset_tree_last(b); start++) {
 		ret = bch_bset_search(b, start, search);
-		bch_btree_iter_push(iter, ret, bset_bkey_last(start->data));
+		bch_btree_iter_push(&iter->iter, ret, bset_bkey_last(start->data));
 	}
 
 	return ret;
 }
 
-struct bkey *bch_btree_iter_init(struct btree_keys *b,
-				 struct btree_iter *iter,
+struct bkey *bch_btree_iter_stack_init(struct btree_keys *b,
+				 struct btree_iter_stack *iter,
 				 struct bkey *search)
 {
-	return __bch_btree_iter_init(b, iter, search, b->set);
+	return __bch_btree_iter_stack_init(b, iter, search, b->set);
 }
 
 static inline struct bkey *__bch_btree_iter_next(struct btree_iter *iter,
@@ -1293,10 +1293,10 @@
 			    struct bset_sort_state *state)
 {
 	size_t order = b->page_order, keys = 0;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	int oldsize = bch_count_data(b);
 
-	__bch_btree_iter_init(b, &iter, NULL, &b->set[start]);
+	__bch_btree_iter_stack_init(b, &iter, NULL, &b->set[start]);
 
 	if (start) {
 		unsigned int i;
@@ -1307,7 +1307,7 @@
 		order = get_order(__set_bytes(b->set->data, keys));
 	}
 
-	__btree_sort(b, &iter, start, order, false, state);
+	__btree_sort(b, &iter.iter, start, order, false, state);
 
 	EBUG_ON(oldsize >= 0 && bch_count_data(b) != oldsize);
 }
@@ -1323,11 +1323,11 @@
 			 struct bset_sort_state *state)
 {
 	uint64_t start_time = local_clock();
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 
-	bch_btree_iter_init(b, &iter, NULL);
+	bch_btree_iter_stack_init(b, &iter, NULL);
 
-	btree_mergesort(b, new->set->data, &iter, false, true);
+	btree_mergesort(b, new->set->data, &iter.iter, false, true);
 
 	bch_time_stats_update(&state->time, start_time);
 
--- linux-qcom-6.8.0.orig/drivers/md/bcache/bset.h
+++ linux-qcom-6.8.0/drivers/md/bcache/bset.h
@@ -321,7 +321,14 @@
 #endif
 	struct btree_iter_set {
 		struct bkey *k, *end;
-	} data[MAX_BSETS];
+	} data[];
+};
+
+/* Fixed-size btree_iter that can be allocated on the stack */
+
+struct btree_iter_stack {
+	struct btree_iter iter;
+	struct btree_iter_set stack_data[MAX_BSETS];
 };
 
 typedef bool (*ptr_filter_fn)(struct btree_keys *b, const struct bkey *k);
@@ -333,9 +340,9 @@
 
 void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k,
 			 struct bkey *end);
-struct bkey *bch_btree_iter_init(struct btree_keys *b,
-				 struct btree_iter *iter,
-				 struct bkey *search);
+struct bkey *bch_btree_iter_stack_init(struct btree_keys *b,
+				       struct btree_iter_stack *iter,
+				       struct bkey *search);
 
 struct bkey *__bch_bset_search(struct btree_keys *b, struct bset_tree *t,
 			       const struct bkey *search);
@@ -350,13 +357,14 @@
 	return search ? __bch_bset_search(b, t, search) : t->data->start;
 }
 
-#define for_each_key_filter(b, k, iter, filter)				\
-	for (bch_btree_iter_init((b), (iter), NULL);			\
-	     ((k) = bch_btree_iter_next_filter((iter), (b), filter));)
-
-#define for_each_key(b, k, iter)					\
-	for (bch_btree_iter_init((b), (iter), NULL);			\
-	     ((k) = bch_btree_iter_next(iter));)
+#define for_each_key_filter(b, k, stack_iter, filter)                      \
+	for (bch_btree_iter_stack_init((b), (stack_iter), NULL);           \
+	     ((k) = bch_btree_iter_next_filter(&((stack_iter)->iter), (b), \
+					       filter));)
+
+#define for_each_key(b, k, stack_iter)                           \
+	for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \
+	     ((k) = bch_btree_iter_next(&((stack_iter)->iter)));)
 
 /* Sorting */
 
--- linux-qcom-6.8.0.orig/drivers/md/bcache/btree.c
+++ linux-qcom-6.8.0/drivers/md/bcache/btree.c
@@ -1309,7 +1309,7 @@
 	uint8_t stale = 0;
 	unsigned int keys = 0, good_keys = 0;
 	struct bkey *k;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	struct bset_tree *t;
 
 	gc->nodes++;
@@ -1570,7 +1570,7 @@
 static unsigned int btree_gc_count_keys(struct btree *b)
 {
 	struct bkey *k;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	unsigned int ret = 0;
 
 	for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad)
@@ -1611,17 +1611,18 @@
 	int ret = 0;
 	bool should_rewrite;
 	struct bkey *k;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	struct gc_merge_info r[GC_MERGE_NODES];
 	struct gc_merge_info *i, *last = r + ARRAY_SIZE(r) - 1;
 
-	bch_btree_iter_init(&b->keys, &iter, &b->c->gc_done);
+	bch_btree_iter_stack_init(&b->keys, &iter, &b->c->gc_done);
 
 	for (i = r; i < r + ARRAY_SIZE(r); i++)
 		i->b = ERR_PTR(-EINTR);
 
 	while (1) {
-		k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad);
+		k = bch_btree_iter_next_filter(&iter.iter, &b->keys,
+					       bch_ptr_bad);
 		if (k) {
 			r->b = bch_btree_node_get(b->c, op, k, b->level - 1,
 						  true, b);
@@ -1911,7 +1912,7 @@
 {
 	int ret = 0;
 	struct bkey *k, *p = NULL;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 
 	for_each_key_filter(&b->keys, k, &iter, bch_ptr_invalid)
 		bch_initial_mark_key(b->c, b->level, k);
@@ -1919,10 +1920,10 @@
 	bch_initial_mark_key(b->c, b->level + 1, &b->key);
 
 	if (b->level) {
-		bch_btree_iter_init(&b->keys, &iter, NULL);
+		bch_btree_iter_stack_init(&b->keys, &iter, NULL);
 
 		do {
-			k = bch_btree_iter_next_filter(&iter, &b->keys,
+			k = bch_btree_iter_next_filter(&iter.iter, &b->keys,
 						       bch_ptr_bad);
 			if (k) {
 				btree_node_prefetch(b, k);
@@ -1950,7 +1951,7 @@
 	struct btree_check_info *info = arg;
 	struct btree_check_state *check_state = info->state;
 	struct cache_set *c = check_state->c;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	struct bkey *k, *p;
 	int cur_idx, prev_idx, skip_nr;
 
@@ -1959,8 +1960,8 @@
 	ret = 0;
 
 	/* root node keys are checked before thread created */
-	bch_btree_iter_init(&c->root->keys, &iter, NULL);
-	k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad);
+	bch_btree_iter_stack_init(&c->root->keys, &iter, NULL);
+	k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad);
 	BUG_ON(!k);
 
 	p = k;
@@ -1978,7 +1979,7 @@
 		skip_nr = cur_idx - prev_idx;
 
 		while (skip_nr) {
-			k = bch_btree_iter_next_filter(&iter,
+			k = bch_btree_iter_next_filter(&iter.iter,
 						       &c->root->keys,
 						       bch_ptr_bad);
 			if (k)
@@ -2051,7 +2052,7 @@
 	int ret = 0;
 	int i;
 	struct bkey *k = NULL;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	struct btree_check_state check_state;
 
 	/* check and mark root node keys */
@@ -2547,11 +2548,11 @@
 
 	if (b->level) {
 		struct bkey *k;
-		struct btree_iter iter;
+		struct btree_iter_stack iter;
 
-		bch_btree_iter_init(&b->keys, &iter, from);
+		bch_btree_iter_stack_init(&b->keys, &iter, from);
 
-		while ((k = bch_btree_iter_next_filter(&iter, &b->keys,
+		while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys,
 						       bch_ptr_bad))) {
 			ret = bcache_btree(map_nodes_recurse, k, b,
 				    op, from, fn, flags);
@@ -2580,11 +2581,12 @@
 {
 	int ret = MAP_CONTINUE;
 	struct bkey *k;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 
-	bch_btree_iter_init(&b->keys, &iter, from);
+	bch_btree_iter_stack_init(&b->keys, &iter, from);
 
-	while ((k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad))) {
+	while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys,
+					       bch_ptr_bad))) {
 		ret = !b->level
 			? fn(op, b, k)
 			: bcache_btree(map_keys_recurse, k,
--- linux-qcom-6.8.0.orig/drivers/md/bcache/super.c
+++ linux-qcom-6.8.0/drivers/md/bcache/super.c
@@ -1724,7 +1724,7 @@
 	if (!IS_ERR_OR_NULL(c->gc_thread))
 		kthread_stop(c->gc_thread);
 
-	if (!IS_ERR(c->root))
+	if (!IS_ERR_OR_NULL(c->root))
 		list_add(&c->root->list, &c->btree_cache);
 
 	/*
@@ -1913,8 +1913,9 @@
 	INIT_LIST_HEAD(&c->btree_cache_freed);
 	INIT_LIST_HEAD(&c->data_buckets);
 
-	iter_size = ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size + 1) *
-		sizeof(struct btree_iter_set);
+	iter_size = sizeof(struct btree_iter) +
+		    ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size) *
+			    sizeof(struct btree_iter_set);
 
 	c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL);
 	if (!c->devices)
--- linux-qcom-6.8.0.orig/drivers/md/bcache/sysfs.c
+++ linux-qcom-6.8.0/drivers/md/bcache/sysfs.c
@@ -660,7 +660,7 @@
 	unsigned int bytes = 0;
 	struct bkey *k;
 	struct btree *b;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 
 	goto lock_root;
 
--- linux-qcom-6.8.0.orig/drivers/md/bcache/writeback.c
+++ linux-qcom-6.8.0/drivers/md/bcache/writeback.c
@@ -908,15 +908,15 @@
 	struct dirty_init_thrd_info *info = arg;
 	struct bch_dirty_init_state *state = info->state;
 	struct cache_set *c = state->c;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	struct bkey *k, *p;
 	int cur_idx, prev_idx, skip_nr;
 
 	k = p = NULL;
 	prev_idx = 0;
 
-	bch_btree_iter_init(&c->root->keys, &iter, NULL);
-	k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad);
+	bch_btree_iter_stack_init(&c->root->keys, &iter, NULL);
+	k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad);
 	BUG_ON(!k);
 
 	p = k;
@@ -930,7 +930,7 @@
 		skip_nr = cur_idx - prev_idx;
 
 		while (skip_nr) {
-			k = bch_btree_iter_next_filter(&iter,
+			k = bch_btree_iter_next_filter(&iter.iter,
 						       &c->root->keys,
 						       bch_ptr_bad);
 			if (k)
@@ -979,7 +979,7 @@
 	int i;
 	struct btree *b = NULL;
 	struct bkey *k = NULL;
-	struct btree_iter iter;
+	struct btree_iter_stack iter;
 	struct sectors_dirty_init op;
 	struct cache_set *c = d->c;
 	struct bch_dirty_init_state state;
--- linux-qcom-6.8.0.orig/drivers/md/dm-bufio.c
+++ linux-qcom-6.8.0/drivers/md/dm-bufio.c
@@ -1315,7 +1315,7 @@
 		io_req.mem.ptr.vma = (char *)b->data + offset;
 	}
 
-	r = dm_io(&io_req, 1, &region, NULL);
+	r = dm_io(&io_req, 1, &region, NULL, IOPRIO_DEFAULT);
 	if (unlikely(r))
 		b->end_io(b, errno_to_blk_status(r));
 }
@@ -2167,7 +2167,7 @@
 	if (WARN_ON_ONCE(dm_bufio_in_request()))
 		return -EINVAL;
 
-	return dm_io(&io_req, 1, &io_reg, NULL);
+	return dm_io(&io_req, 1, &io_reg, NULL, IOPRIO_DEFAULT);
 }
 EXPORT_SYMBOL_GPL(dm_bufio_issue_flush);
 
@@ -2191,7 +2191,7 @@
 	if (WARN_ON_ONCE(dm_bufio_in_request()))
 		return -EINVAL; /* discards are optional */
 
-	return dm_io(&io_req, 1, &io_reg, NULL);
+	return dm_io(&io_req, 1, &io_reg, NULL, IOPRIO_DEFAULT);
 }
 EXPORT_SYMBOL_GPL(dm_bufio_issue_discard);
 
--- linux-qcom-6.8.0.orig/drivers/md/dm-cache-target.c
+++ linux-qcom-6.8.0/drivers/md/dm-cache-target.c
@@ -1909,16 +1909,13 @@
  * This function gets called on the error paths of the constructor, so we
  * have to cope with a partially initialised struct.
  */
-static void destroy(struct cache *cache)
+static void __destroy(struct cache *cache)
 {
-	unsigned int i;
-
 	mempool_exit(&cache->migration_pool);
 
 	if (cache->prison)
 		dm_bio_prison_destroy_v2(cache->prison);
 
-	cancel_delayed_work_sync(&cache->waker);
 	if (cache->wq)
 		destroy_workqueue(cache->wq);
 
@@ -1946,13 +1943,22 @@
 	if (cache->policy)
 		dm_cache_policy_destroy(cache->policy);
 
+	bioset_exit(&cache->bs);
+
+	kfree(cache);
+}
+
+static void destroy(struct cache *cache)
+{
+	unsigned int i;
+
+	cancel_delayed_work_sync(&cache->waker);
+
 	for (i = 0; i < cache->nr_ctr_args ; i++)
 		kfree(cache->ctr_args[i]);
 	kfree(cache->ctr_args);
 
-	bioset_exit(&cache->bs);
-
-	kfree(cache);
+	__destroy(cache);
 }
 
 static void cache_dtr(struct dm_target *ti)
@@ -2007,7 +2013,6 @@
 	sector_t cache_sectors;
 
 	struct dm_dev *origin_dev;
-	sector_t origin_sectors;
 
 	uint32_t block_size;
 
@@ -2088,6 +2093,7 @@
 static int parse_origin_dev(struct cache_args *ca, struct dm_arg_set *as,
 			    char **error)
 {
+	sector_t origin_sectors;
 	int r;
 
 	if (!at_least_one_arg(as, error))
@@ -2100,8 +2106,8 @@
 		return r;
 	}
 
-	ca->origin_sectors = get_dev_size(ca->origin_dev);
-	if (ca->ti->len > ca->origin_sectors) {
+	origin_sectors = get_dev_size(ca->origin_dev);
+	if (ca->ti->len > origin_sectors) {
 		*error = "Device size larger than cached device";
 		return -EINVAL;
 	}
@@ -2411,7 +2417,7 @@
 
 	ca->metadata_dev = ca->origin_dev = ca->cache_dev = NULL;
 
-	origin_blocks = cache->origin_sectors = ca->origin_sectors;
+	origin_blocks = cache->origin_sectors = ti->len;
 	origin_blocks = block_div(origin_blocks, ca->block_size);
 	cache->origin_blocks = to_oblock(origin_blocks);
 
@@ -2565,7 +2571,7 @@
 	*result = cache;
 	return 0;
 bad:
-	destroy(cache);
+	__destroy(cache);
 	return r;
 }
 
@@ -2616,7 +2622,7 @@
 
 	r = copy_ctr_args(cache, argc - 3, (const char **)argv + 3);
 	if (r) {
-		destroy(cache);
+		__destroy(cache);
 		goto out;
 	}
 
@@ -2899,19 +2905,19 @@
 static bool can_resize(struct cache *cache, dm_cblock_t new_size)
 {
 	if (from_cblock(new_size) > from_cblock(cache->cache_size)) {
-		if (cache->sized) {
-			DMERR("%s: unable to extend cache due to missing cache table reload",
-			      cache_device_name(cache));
-			return false;
-		}
+		DMERR("%s: unable to extend cache due to missing cache table reload",
+		      cache_device_name(cache));
+		return false;
 	}
 
 	/*
 	 * We can't drop a dirty block when shrinking the cache.
 	 */
-	while (from_cblock(new_size) < from_cblock(cache->cache_size)) {
-		new_size = to_cblock(from_cblock(new_size) + 1);
-		if (is_dirty(cache, new_size)) {
+	if (cache->loaded_mappings) {
+		new_size = to_cblock(find_next_bit(cache->dirty_bitset,
+						   from_cblock(cache->cache_size),
+						   from_cblock(new_size)));
+		if (new_size != cache->cache_size) {
 			DMERR("%s: unable to shrink cache; cache block %llu is dirty",
 			      cache_device_name(cache),
 			      (unsigned long long) from_cblock(new_size));
@@ -2947,20 +2953,15 @@
 	/*
 	 * Check to see if the cache has resized.
 	 */
-	if (!cache->sized) {
-		r = resize_cache_dev(cache, csize);
-		if (r)
-			return r;
-
-		cache->sized = true;
-
-	} else if (csize != cache->cache_size) {
+	if (!cache->sized || csize != cache->cache_size) {
 		if (!can_resize(cache, csize))
 			return -EINVAL;
 
 		r = resize_cache_dev(cache, csize);
 		if (r)
 			return r;
+
+		cache->sized = true;
 	}
 
 	if (!cache->loaded_mappings) {
--- linux-qcom-6.8.0.orig/drivers/md/dm-clone-metadata.c
+++ linux-qcom-6.8.0/drivers/md/dm-clone-metadata.c
@@ -465,11 +465,6 @@
 
 /*---------------------------------------------------------------------------*/
 
-static size_t bitmap_size(unsigned long nr_bits)
-{
-	return BITS_TO_LONGS(nr_bits) * sizeof(long);
-}
-
 static int __dirty_map_init(struct dirty_map *dmap, unsigned long nr_words,
 			    unsigned long nr_regions)
 {
--- linux-qcom-6.8.0.orig/drivers/md/dm-delay.c
+++ linux-qcom-6.8.0/drivers/md/dm-delay.c
@@ -154,8 +154,10 @@
 {
 	struct delay_c *dc = ti->private;
 
-	if (dc->kdelayd_wq)
+	if (dc->kdelayd_wq) {
+		timer_shutdown_sync(&dc->delay_timer);
 		destroy_workqueue(dc->kdelayd_wq);
+	}
 
 	if (dc->read.dev)
 		dm_put_device(ti, dc->read.dev);
@@ -240,19 +242,18 @@
 		ret = delay_class_ctr(ti, &dc->flush, argv);
 		if (ret)
 			goto bad;
-		max_delay = max(max_delay, dc->write.delay);
-		max_delay = max(max_delay, dc->flush.delay);
 		goto out;
 	}
 
 	ret = delay_class_ctr(ti, &dc->write, argv + 3);
 	if (ret)
 		goto bad;
+	max_delay = max(max_delay, dc->write.delay);
+
 	if (argc == 6) {
 		ret = delay_class_ctr(ti, &dc->flush, argv + 3);
 		if (ret)
 			goto bad;
-		max_delay = max(max_delay, dc->flush.delay);
 		goto out;
 	}
 
@@ -267,8 +268,7 @@
 		 * In case of small requested delays, use kthread instead of
 		 * timers and workqueue to achieve better latency.
 		 */
-		dc->worker = kthread_create(&flush_worker_fn, dc,
-					    "dm-delay-flush-worker");
+		dc->worker = kthread_run(&flush_worker_fn, dc, "dm-delay-flush-worker");
 		if (IS_ERR(dc->worker)) {
 			ret = PTR_ERR(dc->worker);
 			dc->worker = NULL;
@@ -335,7 +335,7 @@
 	mutex_unlock(&delayed_bios_lock);
 
 	if (!delay_is_fast(dc))
-		del_timer_sync(&dc->delay_timer);
+		timer_delete(&dc->delay_timer);
 	flush_delayed_bios(dc, true);
 }
 
--- linux-qcom-6.8.0.orig/drivers/md/dm-ebs-target.c
+++ linux-qcom-6.8.0/drivers/md/dm-ebs-target.c
@@ -442,7 +442,7 @@
 static struct target_type ebs_target = {
 	.name		 = "ebs",
 	.version	 = {1, 0, 1},
-	.features	 = DM_TARGET_PASSES_INTEGRITY,
+	.features	 = 0,
 	.module		 = THIS_MODULE,
 	.ctr		 = ebs_ctr,
 	.dtr		 = ebs_dtr,
--- linux-qcom-6.8.0.orig/drivers/md/dm-init.c
+++ linux-qcom-6.8.0/drivers/md/dm-init.c
@@ -212,8 +212,10 @@
 	strscpy(dev->dmi.uuid, field[1], sizeof(dev->dmi.uuid));
 	/* minor */
 	if (strlen(field[2])) {
-		if (kstrtoull(field[2], 0, &dev->dmi.dev))
+		if (kstrtoull(field[2], 0, &dev->dmi.dev) ||
+		    dev->dmi.dev >= (1 << MINORBITS))
 			return ERR_PTR(-EINVAL);
+		dev->dmi.dev = huge_encode_dev((dev_t)dev->dmi.dev);
 		dev->dmi.flags |= DM_PERSISTENT_DEV_FLAG;
 	}
 	/* flags */
--- linux-qcom-6.8.0.orig/drivers/md/dm-integrity.c
+++ linux-qcom-6.8.0/drivers/md/dm-integrity.c
@@ -555,7 +555,7 @@
 		}
 	}
 
-	r = dm_io(&io_req, 1, &io_loc, NULL);
+	r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
 	if (unlikely(r))
 		return r;
 
@@ -1073,7 +1073,7 @@
 	io_loc.sector = ic->start + SB_SECTORS + sector;
 	io_loc.count = n_sectors;
 
-	r = dm_io(&io_req, 1, &io_loc, NULL);
+	r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
 	if (unlikely(r)) {
 		dm_integrity_io_error(ic, (opf & REQ_OP_MASK) == REQ_OP_READ ?
 				      "reading journal" : "writing journal", r);
@@ -1190,7 +1190,7 @@
 	io_loc.sector = target;
 	io_loc.count = n_sectors;
 
-	r = dm_io(&io_req, 1, &io_loc, NULL);
+	r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
 	if (unlikely(r)) {
 		WARN_ONCE(1, "asynchronous dm_io failed: %d", r);
 		fn(-1UL, data);
@@ -1519,7 +1519,7 @@
 		fr.io_reg.count = 0,
 		fr.ic = ic;
 		init_completion(&fr.comp);
-		r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL);
+		r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL, IOPRIO_DEFAULT);
 		BUG_ON(r);
 	}
 
@@ -1699,7 +1699,6 @@
 	struct bio_vec bv;
 	sector_t sector, logical_sector, area, offset;
 	struct page *page;
-	void *buffer;
 
 	get_area_and_offset(ic, dio->range.logical_sector, &area, &offset);
 	dio->metadata_block = get_metadata_sector_and_offset(ic, area, offset,
@@ -1708,13 +1707,14 @@
 	logical_sector = dio->range.logical_sector;
 
 	page = mempool_alloc(&ic->recheck_pool, GFP_NOIO);
-	buffer = page_to_virt(page);
 
 	__bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) {
 		unsigned pos = 0;
 
 		do {
+			sector_t alignment;
 			char *mem;
+			char *buffer = page_to_virt(page);
 			int r;
 			struct dm_io_request io_req;
 			struct dm_io_region io_loc;
@@ -1727,7 +1727,15 @@
 			io_loc.sector = sector;
 			io_loc.count = ic->sectors_per_block;
 
-			r = dm_io(&io_req, 1, &io_loc, NULL);
+			/* Align the bio to logical block size */
+			alignment = dio->range.logical_sector | bio_sectors(bio) | (PAGE_SIZE >> SECTOR_SHIFT);
+			alignment &= -alignment;
+			io_loc.sector = round_down(io_loc.sector, alignment);
+			io_loc.count += sector - io_loc.sector;
+			buffer += (sector - io_loc.sector) << SECTOR_SHIFT;
+			io_loc.count = round_up(io_loc.count, alignment);
+
+			r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
 			if (unlikely(r)) {
 				dio->bi_status = errno_to_blk_status(r);
 				goto free_ret;
@@ -1848,12 +1856,12 @@
 			r = dm_integrity_rw_tag(ic, checksums, &dio->metadata_block, &dio->metadata_offset,
 						checksums_ptr - checksums, dio->op == REQ_OP_READ ? TAG_CMP : TAG_WRITE);
 			if (unlikely(r)) {
+				if (likely(checksums != checksums_onstack))
+					kfree(checksums);
 				if (r > 0) {
-					integrity_recheck(dio, checksums);
+					integrity_recheck(dio, checksums_onstack);
 					goto skip_io;
 				}
-				if (likely(checksums != checksums_onstack))
-					kfree(checksums);
 				goto error;
 			}
 
@@ -2165,6 +2173,7 @@
 	struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
 	unsigned int journal_section, journal_entry;
 	unsigned int journal_read_pos;
+	sector_t recalc_sector;
 	struct completion read_comp;
 	bool discard_retried = false;
 	bool need_sync_io = ic->internal_hash && dio->op == REQ_OP_READ;
@@ -2305,6 +2314,7 @@
 			goto lock_retry;
 		}
 	}
+	recalc_sector = le64_to_cpu(ic->sb->recalc_sector);
 	spin_unlock_irq(&ic->endio_wait.lock);
 
 	if (unlikely(journal_read_pos != NOT_FOUND)) {
@@ -2359,7 +2369,7 @@
 	if (need_sync_io) {
 		wait_for_completion_io(&read_comp);
 		if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING) &&
-		    dio->range.logical_sector + dio->range.n_sectors > le64_to_cpu(ic->sb->recalc_sector))
+		    dio->range.logical_sector + dio->range.n_sectors > recalc_sector)
 			goto skip_check;
 		if (ic->mode == 'B') {
 			if (!block_bitmap_op(ic, ic->recalc_bitmap, dio->range.logical_sector,
@@ -2806,7 +2816,7 @@
 	io_loc.sector = get_data_sector(ic, area, offset);
 	io_loc.count = n_sectors;
 
-	r = dm_io(&io_req, 1, &io_loc, NULL);
+	r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
 	if (unlikely(r)) {
 		dm_integrity_io_error(ic, "reading data", r);
 		goto err;
@@ -3484,6 +3494,7 @@
 		limits->physical_block_size = ic->sectors_per_block << SECTOR_SHIFT;
 		blk_limits_io_min(limits, ic->sectors_per_block << SECTOR_SHIFT);
 		limits->dma_alignment = limits->logical_block_size - 1;
+		limits->discard_granularity = ic->sectors_per_block << SECTOR_SHIFT;
 	}
 }
 
@@ -4213,7 +4224,7 @@
 		} else if (sscanf(opt_string, "sectors_per_bit:%llu%c", &llval, &dummy) == 1) {
 			log2_sectors_per_bitmap_bit = !llval ? 0 : __ilog2_u64(llval);
 		} else if (sscanf(opt_string, "bitmap_flush_interval:%u%c", &val, &dummy) == 1) {
-			if (val >= (uint64_t)UINT_MAX * 1000 / HZ) {
+			if ((uint64_t)val >= (uint64_t)UINT_MAX * 1000 / HZ) {
 				r = -EINVAL;
 				ti->error = "Invalid bitmap_flush_interval argument";
 				goto bad;
--- linux-qcom-6.8.0.orig/drivers/md/dm-io.c
+++ linux-qcom-6.8.0/drivers/md/dm-io.c
@@ -305,7 +305,7 @@
  */
 static void do_region(const blk_opf_t opf, unsigned int region,
 		      struct dm_io_region *where, struct dpages *dp,
-		      struct io *io)
+		      struct io *io, unsigned short ioprio)
 {
 	struct bio *bio;
 	struct page *page;
@@ -354,6 +354,7 @@
 				       &io->client->bios);
 		bio->bi_iter.bi_sector = where->sector + (where->count - remaining);
 		bio->bi_end_io = endio;
+		bio->bi_ioprio = ioprio;
 		store_io_and_region_in_bio(bio, io, region);
 
 		if (op == REQ_OP_DISCARD || op == REQ_OP_WRITE_ZEROES) {
@@ -383,7 +384,7 @@
 
 static void dispatch_io(blk_opf_t opf, unsigned int num_regions,
 			struct dm_io_region *where, struct dpages *dp,
-			struct io *io, int sync)
+			struct io *io, int sync, unsigned short ioprio)
 {
 	int i;
 	struct dpages old_pages = *dp;
@@ -400,7 +401,7 @@
 	for (i = 0; i < num_regions; i++) {
 		*dp = old_pages;
 		if (where[i].count || (opf & REQ_PREFLUSH))
-			do_region(opf, i, where + i, dp, io);
+			do_region(opf, i, where + i, dp, io, ioprio);
 	}
 
 	/*
@@ -425,7 +426,7 @@
 
 static int sync_io(struct dm_io_client *client, unsigned int num_regions,
 		   struct dm_io_region *where, blk_opf_t opf, struct dpages *dp,
-		   unsigned long *error_bits)
+		   unsigned long *error_bits, unsigned short ioprio)
 {
 	struct io *io;
 	struct sync_io sio;
@@ -447,7 +448,7 @@
 	io->vma_invalidate_address = dp->vma_invalidate_address;
 	io->vma_invalidate_size = dp->vma_invalidate_size;
 
-	dispatch_io(opf, num_regions, where, dp, io, 1);
+	dispatch_io(opf, num_regions, where, dp, io, 1, ioprio);
 
 	wait_for_completion_io(&sio.wait);
 
@@ -459,7 +460,8 @@
 
 static int async_io(struct dm_io_client *client, unsigned int num_regions,
 		    struct dm_io_region *where, blk_opf_t opf,
-		    struct dpages *dp, io_notify_fn fn, void *context)
+		    struct dpages *dp, io_notify_fn fn, void *context,
+		    unsigned short ioprio)
 {
 	struct io *io;
 
@@ -479,7 +481,7 @@
 	io->vma_invalidate_address = dp->vma_invalidate_address;
 	io->vma_invalidate_size = dp->vma_invalidate_size;
 
-	dispatch_io(opf, num_regions, where, dp, io, 0);
+	dispatch_io(opf, num_regions, where, dp, io, 0, ioprio);
 	return 0;
 }
 
@@ -521,7 +523,8 @@
 }
 
 int dm_io(struct dm_io_request *io_req, unsigned int num_regions,
-	  struct dm_io_region *where, unsigned long *sync_error_bits)
+	  struct dm_io_region *where, unsigned long *sync_error_bits,
+	  unsigned short ioprio)
 {
 	int r;
 	struct dpages dp;
@@ -532,11 +535,11 @@
 
 	if (!io_req->notify.fn)
 		return sync_io(io_req->client, num_regions, where,
-			       io_req->bi_opf, &dp, sync_error_bits);
+			       io_req->bi_opf, &dp, sync_error_bits, ioprio);
 
 	return async_io(io_req->client, num_regions, where,
 			io_req->bi_opf, &dp, io_req->notify.fn,
-			io_req->notify.context);
+			io_req->notify.context, ioprio);
 }
 EXPORT_SYMBOL(dm_io);
 
--- linux-qcom-6.8.0.orig/drivers/md/dm-ioctl.c
+++ linux-qcom-6.8.0/drivers/md/dm-ioctl.c
@@ -1181,8 +1181,26 @@
 			suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
 		if (param->flags & DM_NOFLUSH_FLAG)
 			suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
-		if (!dm_suspended_md(md))
-			dm_suspend(md, suspend_flags);
+		if (!dm_suspended_md(md)) {
+			r = dm_suspend(md, suspend_flags);
+			if (r) {
+				down_write(&_hash_lock);
+				hc = dm_get_mdptr(md);
+				if (hc && !hc->new_map) {
+					hc->new_map = new_map;
+					new_map = NULL;
+				} else {
+					r = -ENXIO;
+				}
+				up_write(&_hash_lock);
+				if (new_map) {
+					dm_sync_table(md);
+					dm_table_destroy(new_map);
+				}
+				dm_put(md);
+				return r;
+			}
+		}
 
 		old_size = dm_get_size(md);
 		old_map = dm_swap_table(md, new_map);
--- linux-qcom-6.8.0.orig/drivers/md/dm-kcopyd.c
+++ linux-qcom-6.8.0/drivers/md/dm-kcopyd.c
@@ -578,9 +578,9 @@
 	io_job_start(job->kc->throttle);
 
 	if (job->op == REQ_OP_READ)
-		r = dm_io(&io_req, 1, &job->source, NULL);
+		r = dm_io(&io_req, 1, &job->source, NULL, IOPRIO_DEFAULT);
 	else
-		r = dm_io(&io_req, job->num_dests, job->dests, NULL);
+		r = dm_io(&io_req, job->num_dests, job->dests, NULL, IOPRIO_DEFAULT);
 
 	return r;
 }
--- linux-qcom-6.8.0.orig/drivers/md/dm-log.c
+++ linux-qcom-6.8.0/drivers/md/dm-log.c
@@ -300,7 +300,7 @@
 {
 	lc->io_req.bi_opf = op;
 
-	return dm_io(&lc->io_req, 1, &lc->header_location, NULL);
+	return dm_io(&lc->io_req, 1, &lc->header_location, NULL, IOPRIO_DEFAULT);
 }
 
 static int flush_header(struct log_c *lc)
@@ -313,7 +313,7 @@
 
 	lc->io_req.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
 
-	return dm_io(&lc->io_req, 1, &null_location, NULL);
+	return dm_io(&lc->io_req, 1, &null_location, NULL, IOPRIO_DEFAULT);
 }
 
 static int read_header(struct log_c *log)
--- linux-qcom-6.8.0.orig/drivers/md/dm-raid.c
+++ linux-qcom-6.8.0/drivers/md/dm-raid.c
@@ -213,6 +213,7 @@
 #define RT_FLAG_RS_IN_SYNC		6
 #define RT_FLAG_RS_RESYNCING		7
 #define RT_FLAG_RS_GROW			8
+#define RT_FLAG_RS_FROZEN		9
 
 /* Array elements of 64 bit needed for rebuild/failed disk bits */
 #define DISKS_ARRAY_ELEMS ((MAX_RAID_DEVICES + (sizeof(uint64_t) * 8 - 1)) / sizeof(uint64_t) / 8)
@@ -3240,11 +3241,12 @@
 	rs->md.ro = 1;
 	rs->md.in_sync = 1;
 
-	/* Keep array frozen until resume. */
-	set_bit(MD_RECOVERY_FROZEN, &rs->md.recovery);
-
 	/* Has to be held on running the array */
 	mddev_suspend_and_lock_nointr(&rs->md);
+
+	/* Keep array frozen until resume. */
+	md_frozen_sync_thread(&rs->md);
+
 	r = md_run(&rs->md);
 	rs->md.in_sync = 0; /* Assume already marked dirty */
 	if (r) {
@@ -3329,17 +3331,18 @@
 	struct mddev *mddev = &rs->md;
 
 	/*
-	 * If we're reshaping to add disk(s)), ti->len and
+	 * If we're reshaping to add disk(s), ti->len and
 	 * mddev->array_sectors will differ during the process
 	 * (ti->len > mddev->array_sectors), so we have to requeue
 	 * bios with addresses > mddev->array_sectors here or
 	 * there will occur accesses past EOD of the component
 	 * data images thus erroring the raid set.
 	 */
-	if (unlikely(bio_end_sector(bio) > mddev->array_sectors))
+	if (unlikely(bio_has_data(bio) && bio_end_sector(bio) > mddev->array_sectors))
 		return DM_MAPIO_REQUEUE;
 
-	md_handle_request(mddev, bio);
+	if (unlikely(!md_handle_request(mddev, bio)))
+		return DM_MAPIO_REQUEUE;
 
 	return DM_MAPIO_SUBMITTED;
 }
@@ -3718,21 +3721,33 @@
 {
 	struct raid_set *rs = ti->private;
 	struct mddev *mddev = &rs->md;
+	int ret = 0;
 
 	if (!mddev->pers || !mddev->pers->sync_request)
 		return -EINVAL;
 
-	if (!strcasecmp(argv[0], "frozen"))
-		set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
-	else
-		clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+	if (test_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags) ||
+	    test_bit(RT_FLAG_RS_FROZEN, &rs->runtime_flags))
+		return -EBUSY;
 
-	if (!strcasecmp(argv[0], "idle") || !strcasecmp(argv[0], "frozen")) {
-		if (mddev->sync_thread) {
-			set_bit(MD_RECOVERY_INTR, &mddev->recovery);
-			md_reap_sync_thread(mddev);
-		}
-	} else if (decipher_sync_action(mddev, mddev->recovery) != st_idle)
+	if (!strcasecmp(argv[0], "frozen")) {
+		ret = mddev_lock(mddev);
+		if (ret)
+			return ret;
+
+		md_frozen_sync_thread(mddev);
+		mddev_unlock(mddev);
+	} else if (!strcasecmp(argv[0], "idle")) {
+		ret = mddev_lock(mddev);
+		if (ret)
+			return ret;
+
+		md_idle_sync_thread(mddev);
+		mddev_unlock(mddev);
+	}
+
+	clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+	if (decipher_sync_action(mddev, mddev->recovery) != st_idle)
 		return -EBUSY;
 	else if (!strcasecmp(argv[0], "resync"))
 		; /* MD_RECOVERY_NEEDED set below */
@@ -3791,15 +3806,46 @@
 	blk_limits_io_opt(limits, chunk_size_bytes * mddev_data_stripes(rs));
 }
 
+static void raid_presuspend(struct dm_target *ti)
+{
+	struct raid_set *rs = ti->private;
+	struct mddev *mddev = &rs->md;
+
+	/*
+	 * From now on, disallow raid_message() to change sync_thread until
+	 * resume, raid_postsuspend() is too late.
+	 */
+	set_bit(RT_FLAG_RS_FROZEN, &rs->runtime_flags);
+
+	if (!reshape_interrupted(mddev))
+		return;
+
+	/*
+	 * For raid456, if reshape is interrupted, IO across reshape position
+	 * will never make progress, while caller will wait for IO to be done.
+	 * Inform raid456 to handle those IO to prevent deadlock.
+	 */
+	if (mddev->pers && mddev->pers->prepare_suspend)
+		mddev->pers->prepare_suspend(mddev);
+}
+
+static void raid_presuspend_undo(struct dm_target *ti)
+{
+	struct raid_set *rs = ti->private;
+
+	clear_bit(RT_FLAG_RS_FROZEN, &rs->runtime_flags);
+}
+
 static void raid_postsuspend(struct dm_target *ti)
 {
 	struct raid_set *rs = ti->private;
 
 	if (!test_and_set_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags)) {
-		/* Writes have to be stopped before suspending to avoid deadlocks. */
-		if (!test_bit(MD_RECOVERY_FROZEN, &rs->md.recovery))
-			md_stop_writes(&rs->md);
-
+		/*
+		 * sync_thread must be stopped during suspend, and writes have
+		 * to be stopped before suspending to avoid deadlocks.
+		 */
+		md_stop_writes(&rs->md);
 		mddev_suspend(&rs->md, false);
 	}
 }
@@ -4012,8 +4058,6 @@
 	}
 
 	/* Check for any resize/reshape on @rs and adjust/initiate */
-	/* Be prepared for mddev_resume() in raid_resume() */
-	set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
 	if (mddev->recovery_cp && mddev->recovery_cp < MaxSector) {
 		set_bit(MD_RECOVERY_REQUESTED, &mddev->recovery);
 		mddev->resync_min = mddev->recovery_cp;
@@ -4047,7 +4091,9 @@
 		 * Take this opportunity to check whether any failed
 		 * devices are reachable again.
 		 */
+		mddev_lock_nointr(mddev);
 		attempt_restore_of_faulty_devices(rs);
+		mddev_unlock(mddev);
 	}
 
 	if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags)) {
@@ -4056,9 +4102,13 @@
 			rs_set_capacity(rs);
 
 		mddev_lock_nointr(mddev);
-		clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+		WARN_ON_ONCE(!test_bit(MD_RECOVERY_FROZEN, &mddev->recovery));
+		WARN_ON_ONCE(rcu_dereference_protected(mddev->sync_thread,
+						       lockdep_is_held(&mddev->reconfig_mutex)));
+		clear_bit(RT_FLAG_RS_FROZEN, &rs->runtime_flags);
 		mddev->ro = 0;
 		mddev->in_sync = 0;
+		md_unfrozen_sync_thread(mddev);
 		mddev_unlock_and_resume(mddev);
 	}
 }
@@ -4074,6 +4124,8 @@
 	.message = raid_message,
 	.iterate_devices = raid_iterate_devices,
 	.io_hints = raid_io_hints,
+	.presuspend = raid_presuspend,
+	.presuspend_undo = raid_presuspend_undo,
 	.postsuspend = raid_postsuspend,
 	.preresume = raid_preresume,
 	.resume = raid_resume,
--- linux-qcom-6.8.0.orig/drivers/md/dm-raid1.c
+++ linux-qcom-6.8.0/drivers/md/dm-raid1.c
@@ -278,7 +278,7 @@
 	}
 
 	error_bits = -1;
-	dm_io(&io_req, ms->nr_mirrors, io, &error_bits);
+	dm_io(&io_req, ms->nr_mirrors, io, &error_bits, IOPRIO_DEFAULT);
 	if (unlikely(error_bits != 0)) {
 		for (i = 0; i < ms->nr_mirrors; i++)
 			if (test_bit(i, &error_bits))
@@ -554,7 +554,7 @@
 
 	map_region(&io, m, bio);
 	bio_set_m(bio, m);
-	BUG_ON(dm_io(&io_req, 1, &io, NULL));
+	BUG_ON(dm_io(&io_req, 1, &io, NULL, IOPRIO_DEFAULT));
 }
 
 static inline int region_in_sync(struct mirror_set *ms, region_t region,
@@ -681,7 +681,7 @@
 	 */
 	bio_set_m(bio, get_default_mirror(ms));
 
-	BUG_ON(dm_io(&io_req, ms->nr_mirrors, io, NULL));
+	BUG_ON(dm_io(&io_req, ms->nr_mirrors, io, NULL, IOPRIO_DEFAULT));
 }
 
 static void do_writes(struct mirror_set *ms, struct bio_list *writes)
--- linux-qcom-6.8.0.orig/drivers/md/dm-rq.c
+++ linux-qcom-6.8.0/drivers/md/dm-rq.c
@@ -496,8 +496,10 @@
 
 		map = dm_get_live_table(md, &srcu_idx);
 		if (unlikely(!map)) {
+			DMERR_LIMIT("%s: mapping table unavailable, erroring io",
+				    dm_device_name(md));
 			dm_put_live_table(md, srcu_idx);
-			return BLK_STS_RESOURCE;
+			return BLK_STS_IOERR;
 		}
 		ti = dm_table_find_target(map, 0);
 		dm_put_live_table(md, srcu_idx);
--- linux-qcom-6.8.0.orig/drivers/md/dm-snap-persistent.c
+++ linux-qcom-6.8.0/drivers/md/dm-snap-persistent.c
@@ -223,7 +223,7 @@
 {
 	struct mdata_req *req = container_of(work, struct mdata_req, work);
 
-	req->result = dm_io(req->io_req, 1, req->where, NULL);
+	req->result = dm_io(req->io_req, 1, req->where, NULL, IOPRIO_DEFAULT);
 }
 
 /*
@@ -247,7 +247,7 @@
 	struct mdata_req req;
 
 	if (!metadata)
-		return dm_io(&io_req, 1, &where, NULL);
+		return dm_io(&io_req, 1, &where, NULL, IOPRIO_DEFAULT);
 
 	req.where = &where;
 	req.io_req = &io_req;
--- linux-qcom-6.8.0.orig/drivers/md/dm-snap.c
+++ linux-qcom-6.8.0/drivers/md/dm-snap.c
@@ -684,8 +684,10 @@
 	for (i = 0; i < size; i++) {
 		slot = et->table + i;
 
-		hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list)
+		hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) {
 			kmem_cache_free(mem, ex);
+			cond_resched();
+		}
 	}
 
 	kvfree(et->table);
--- linux-qcom-6.8.0.orig/drivers/md/dm-table.c
+++ linux-qcom-6.8.0/drivers/md/dm-table.c
@@ -1315,6 +1315,7 @@
 	profile->max_dun_bytes_supported = UINT_MAX;
 	memset(profile->modes_supported, 0xFF,
 	       sizeof(profile->modes_supported));
+	profile->key_types_supported = ~0;
 
 	for (i = 0; i < t->num_targets; i++) {
 		struct dm_target *ti = dm_table_get_target(t, i);
--- linux-qcom-6.8.0.orig/drivers/md/dm-thin.c
+++ linux-qcom-6.8.0/drivers/md/dm-thin.c
@@ -2334,10 +2334,9 @@
 	struct thin_c *tc = NULL;
 
 	rcu_read_lock();
-	if (!list_empty(&pool->active_thins)) {
-		tc = list_entry_rcu(pool->active_thins.next, struct thin_c, list);
+	tc = list_first_or_null_rcu(&pool->active_thins, struct thin_c, list);
+	if (tc)
 		thin_get(tc);
-	}
 	rcu_read_unlock();
 
 	return tc;
@@ -2486,6 +2485,7 @@
 	init_completion(&pw->complete);
 	queue_work(pool->wq, &pw->worker);
 	wait_for_completion(&pw->complete);
+	destroy_work_on_stack(&pw->worker);
 }
 
 /*----------------------------------------------------------------*/
--- linux-qcom-6.8.0.orig/drivers/md/dm-unstripe.c
+++ linux-qcom-6.8.0/drivers/md/dm-unstripe.c
@@ -85,8 +85,8 @@
 	}
 	uc->physical_start = start;
 
-	uc->unstripe_offset = uc->unstripe * uc->chunk_size;
-	uc->unstripe_width = (uc->stripes - 1) * uc->chunk_size;
+	uc->unstripe_offset = (sector_t)uc->unstripe * uc->chunk_size;
+	uc->unstripe_width = (sector_t)(uc->stripes - 1) * uc->chunk_size;
 	uc->chunk_shift = is_power_of_2(uc->chunk_size) ? fls(uc->chunk_size) - 1 : 0;
 
 	tmp_len = ti->len;
--- linux-qcom-6.8.0.orig/drivers/md/dm-verity-fec.c
+++ linux-qcom-6.8.0/drivers/md/dm-verity-fec.c
@@ -60,14 +60,19 @@
  * to the data block. Caller is responsible for releasing buf.
  */
 static u8 *fec_read_parity(struct dm_verity *v, u64 rsb, int index,
-			   unsigned int *offset, struct dm_buffer **buf)
+			   unsigned int *offset, unsigned int par_buf_offset,
+			  struct dm_buffer **buf)
 {
 	u64 position, block, rem;
 	u8 *res;
 
+	/* We have already part of parity bytes read, skip to the next block */
+	if (par_buf_offset)
+		index++;
+
 	position = (index + rsb) * v->fec->roots;
 	block = div64_u64_rem(position, v->fec->io_size, &rem);
-	*offset = (unsigned int)rem;
+	*offset = par_buf_offset ? 0 : (unsigned int)rem;
 
 	res = dm_bufio_read(v->fec->bufio, block, buf);
 	if (IS_ERR(res)) {
@@ -127,10 +132,11 @@
 {
 	int r, corrected = 0, res;
 	struct dm_buffer *buf;
-	unsigned int n, i, offset;
-	u8 *par, *block;
+	unsigned int n, i, offset, par_buf_offset = 0;
+	u8 *par, *block, par_buf[DM_VERITY_FEC_RSM - DM_VERITY_FEC_MIN_RSN];
 
-	par = fec_read_parity(v, rsb, block_offset, &offset, &buf);
+	par = fec_read_parity(v, rsb, block_offset, &offset,
+			      par_buf_offset, &buf);
 	if (IS_ERR(par))
 		return PTR_ERR(par);
 
@@ -140,7 +146,8 @@
 	 */
 	fec_for_each_buffer_rs_block(fio, n, i) {
 		block = fec_buffer_rs_block(v, fio, n, i);
-		res = fec_decode_rs8(v, fio, block, &par[offset], neras);
+		memcpy(&par_buf[par_buf_offset], &par[offset], v->fec->roots - par_buf_offset);
+		res = fec_decode_rs8(v, fio, block, par_buf, neras);
 		if (res < 0) {
 			r = res;
 			goto error;
@@ -153,12 +160,21 @@
 		if (block_offset >= 1 << v->data_dev_block_bits)
 			goto done;
 
-		/* read the next block when we run out of parity bytes */
-		offset += v->fec->roots;
+		/* Read the next block when we run out of parity bytes */
+		offset += (v->fec->roots - par_buf_offset);
+		/* Check if parity bytes are split between blocks */
+		if (offset < v->fec->io_size && (offset + v->fec->roots) > v->fec->io_size) {
+			par_buf_offset = v->fec->io_size - offset;
+			memcpy(par_buf, &par[offset], par_buf_offset);
+			offset += par_buf_offset;
+		} else
+			par_buf_offset = 0;
+
 		if (offset >= v->fec->io_size) {
 			dm_bufio_release(buf);
 
-			par = fec_read_parity(v, rsb, block_offset, &offset, &buf);
+			par = fec_read_parity(v, rsb, block_offset, &offset,
+					      par_buf_offset, &buf);
 			if (IS_ERR(par))
 				return PTR_ERR(par);
 		}
@@ -743,10 +759,7 @@
 		return -E2BIG;
 	}
 
-	if ((f->roots << SECTOR_SHIFT) & ((1 << v->data_dev_block_bits) - 1))
-		f->io_size = 1 << v->data_dev_block_bits;
-	else
-		f->io_size = v->fec->roots << SECTOR_SHIFT;
+	f->io_size = 1 << v->data_dev_block_bits;
 
 	f->bufio = dm_bufio_client_create(f->dev->bdev,
 					  f->io_size,
--- linux-qcom-6.8.0.orig/drivers/md/dm-verity-target.c
+++ linux-qcom-6.8.0/drivers/md/dm-verity-target.c
@@ -511,7 +511,7 @@
 	io_loc.bdev = v->data_dev->bdev;
 	io_loc.sector = cur_block << (v->data_dev_block_bits - SECTOR_SHIFT);
 	io_loc.count = 1 << (v->data_dev_block_bits - SECTOR_SHIFT);
-	r = dm_io(&io_req, 1, &io_loc, NULL);
+	r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
 	if (unlikely(r))
 		goto free_ret;
 
@@ -1512,14 +1512,6 @@
 }
 
 /*
- * Check whether a DM target is a verity target.
- */
-bool dm_is_verity_target(struct dm_target *ti)
-{
-	return ti->type->module == THIS_MODULE;
-}
-
-/*
  * Get the verity mode (error behavior) of a verity target.
  *
  * Returns the verity mode of the target, or -EINVAL if 'ti' is not a verity
@@ -1572,6 +1564,14 @@
 };
 module_dm(verity);
 
+/*
+ * Check whether a DM target is a verity target.
+ */
+bool dm_is_verity_target(struct dm_target *ti)
+{
+	return ti->type == &verity_target;
+}
+
 MODULE_AUTHOR("Mikulas Patocka <mpatocka@redhat.com>");
 MODULE_AUTHOR("Mandeep Baines <msb@chromium.org>");
 MODULE_AUTHOR("Will Drewry <wad@chromium.org>");
--- linux-qcom-6.8.0.orig/drivers/md/dm-writecache.c
+++ linux-qcom-6.8.0/drivers/md/dm-writecache.c
@@ -531,7 +531,7 @@
 		req.notify.context = &endio;
 
 		/* writing via async dm-io (implied by notify.fn above) won't return an error */
-		(void) dm_io(&req, 1, &region, NULL);
+		(void) dm_io(&req, 1, &region, NULL, IOPRIO_DEFAULT);
 		i = j;
 	}
 
@@ -568,7 +568,7 @@
 	req.notify.fn = NULL;
 	req.notify.context = NULL;
 
-	r = dm_io(&req, 1, &region, NULL);
+	r = dm_io(&req, 1, &region, NULL, IOPRIO_DEFAULT);
 	if (unlikely(r))
 		writecache_error(wc, r, "error writing superblock");
 }
@@ -596,7 +596,7 @@
 	req.client = wc->dm_io;
 	req.notify.fn = NULL;
 
-	r = dm_io(&req, 1, &region, NULL);
+	r = dm_io(&req, 1, &region, NULL, IOPRIO_DEFAULT);
 	if (unlikely(r))
 		writecache_error(wc, r, "error flushing metadata: %d", r);
 }
@@ -990,7 +990,7 @@
 	req.client = wc->dm_io;
 	req.notify.fn = NULL;
 
-	return dm_io(&req, 1, &region, NULL);
+	return dm_io(&req, 1, &region, NULL, IOPRIO_DEFAULT);
 }
 
 static void writecache_resume(struct dm_target *ti)
--- linux-qcom-6.8.0.orig/drivers/md/dm.c
+++ linux-qcom-6.8.0/drivers/md/dm.c
@@ -1844,10 +1844,15 @@
 	struct dm_table *map;
 
 	map = dm_get_live_table(md, &srcu_idx);
+	if (unlikely(!map)) {
+		DMERR_LIMIT("%s: mapping table unavailable, erroring io",
+			    dm_device_name(md));
+		bio_io_error(bio);
+		goto out;
+	}
 
-	/* If suspended, or map not yet available, queue this IO for later */
-	if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags)) ||
-	    unlikely(!map)) {
+	/* If suspended, queue this IO for later */
+	if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags))) {
 		if (bio->bi_opf & REQ_NOWAIT)
 			bio_wouldblock_error(bio);
 		else if (bio->bi_opf & REQ_RAHEAD)
@@ -2558,7 +2563,7 @@
 			break;
 
 		if (signal_pending_state(task_state, current)) {
-			r = -EINTR;
+			r = -ERESTARTSYS;
 			break;
 		}
 
@@ -2583,7 +2588,7 @@
 			break;
 
 		if (signal_pending_state(task_state, current)) {
-			r = -EINTR;
+			r = -ERESTARTSYS;
 			break;
 		}
 
@@ -2945,6 +2950,9 @@
 
 static void __dm_internal_resume(struct mapped_device *md)
 {
+	int r;
+	struct dm_table *map;
+
 	BUG_ON(!md->internal_suspend_count);
 
 	if (--md->internal_suspend_count)
@@ -2953,12 +2961,23 @@
 	if (dm_suspended_md(md))
 		goto done; /* resume from nested suspend */
 
-	/*
-	 * NOTE: existing callers don't need to call dm_table_resume_targets
-	 * (which may fail -- so best to avoid it for now by passing NULL map)
-	 */
-	(void) __dm_resume(md, NULL);
-
+	map = rcu_dereference_protected(md->map, lockdep_is_held(&md->suspend_lock));
+	r = __dm_resume(md, map);
+	if (r) {
+		/*
+		 * If a preresume method of some target failed, we are in a
+		 * tricky situation. We can't return an error to the caller. We
+		 * can't fake success because then the "resume" and
+		 * "postsuspend" methods would not be paired correctly, and it
+		 * would break various targets, for example it would cause list
+		 * corruption in the "origin" target.
+		 *
+		 * So, we fake normal suspend here, to make sure that the
+		 * "resume" and "postsuspend" methods will be paired correctly.
+		 */
+		DMERR("Preresume method failed: %d", r);
+		set_bit(DMF_SUSPENDED, &md->flags);
+	}
 done:
 	clear_bit(DMF_SUSPENDED_INTERNALLY, &md->flags);
 	smp_mb__after_atomic();
--- linux-qcom-6.8.0.orig/drivers/md/md-bitmap.c
+++ linux-qcom-6.8.0/drivers/md/md-bitmap.c
@@ -227,6 +227,8 @@
 	struct block_device *bdev;
 	struct mddev *mddev = bitmap->mddev;
 	struct bitmap_storage *store = &bitmap->storage;
+	unsigned int bitmap_limit = (bitmap->storage.file_pages - pg_index) <<
+		PAGE_SHIFT;
 	loff_t sboff, offset = mddev->bitmap_info.offset;
 	sector_t ps = pg_index * PAGE_SIZE / SECTOR_SIZE;
 	unsigned int size = PAGE_SIZE;
@@ -234,7 +236,8 @@
 	sector_t doff;
 
 	bdev = (rdev->meta_bdev) ? rdev->meta_bdev : rdev->bdev;
-	if (pg_index == store->file_pages - 1) {
+	/* we compare length (page numbers), not page offset. */
+	if ((pg_index - store->sb_index) == store->file_pages - 1) {
 		unsigned int last_page_size = store->bytes & (PAGE_SIZE - 1);
 
 		if (last_page_size == 0)
@@ -268,11 +271,9 @@
 		if (size == 0)
 			/* bitmap runs in to data */
 			return -EINVAL;
-	} else {
-		/* DATA METADATA BITMAP - no problems */
 	}
 
-	md_super_write(mddev, rdev, sboff + ps, (int) size, page);
+	md_super_write(mddev, rdev, sboff + ps, (int)min(size, bitmap_limit), page);
 	return 0;
 }
 
@@ -438,8 +439,8 @@
 	struct page *page = store->filemap[pg_index];
 
 	if (mddev_is_clustered(bitmap->mddev)) {
-		pg_index += bitmap->cluster_slot *
-			DIV_ROUND_UP(store->bytes, PAGE_SIZE);
+		/* go to node bitmap area starting point */
+		pg_index += store->sb_index;
 	}
 
 	if (store->file)
@@ -952,6 +953,7 @@
 	unsigned long index = file_page_index(store, chunk);
 	unsigned long node_offset = 0;
 
+	index += store->sb_index;
 	if (mddev_is_clustered(bitmap->mddev))
 		node_offset = bitmap->cluster_slot * store->file_pages;
 
@@ -982,6 +984,7 @@
 	unsigned long index = file_page_index(store, chunk);
 	unsigned long node_offset = 0;
 
+	index += store->sb_index;
 	if (mddev_is_clustered(bitmap->mddev))
 		node_offset = bitmap->cluster_slot * store->file_pages;
 
@@ -1086,6 +1089,7 @@
 
 	queue_work(md_bitmap_wq, &unplug_work.work);
 	wait_for_completion(&done);
+	destroy_work_on_stack(&unplug_work.work);
 }
 EXPORT_SYMBOL(md_bitmap_unplug_async);
 
@@ -1424,7 +1428,7 @@
 	sector_t chunk = offset >> bitmap->chunkshift;
 	unsigned long page = chunk >> PAGE_COUNTER_SHIFT;
 	unsigned long pageoff = (chunk & PAGE_COUNTER_MASK) << COUNTER_BYTE_SHIFT;
-	sector_t csize;
+	sector_t csize = ((sector_t)1) << bitmap->chunkshift;
 	int err;
 
 	if (page >= bitmap->pages) {
@@ -1433,6 +1437,7 @@
 		 * End-of-device while looking for a whole page or
 		 * user set a huge number to sysfs bitmap_set_bits.
 		 */
+		*blocks = csize - (offset & (csize - 1));
 		return NULL;
 	}
 	err = md_bitmap_checkpage(bitmap, page, create, 0);
@@ -1441,8 +1446,7 @@
 	    bitmap->bp[page].map == NULL)
 		csize = ((sector_t)1) << (bitmap->chunkshift +
 					  PAGE_COUNTER_SHIFT);
-	else
-		csize = ((sector_t)1) << bitmap->chunkshift;
+
 	*blocks = csize - (offset & (csize - 1));
 
 	if (err < 0)
--- linux-qcom-6.8.0.orig/drivers/md/md-cluster.c
+++ linux-qcom-6.8.0/drivers/md/md-cluster.c
@@ -15,6 +15,7 @@
 
 #define LVB_SIZE	64
 #define NEW_DEV_TIMEOUT 5000
+#define WAIT_DLM_LOCK_TIMEOUT (30 * HZ)
 
 struct dlm_lock_resource {
 	dlm_lockspace_t *ls;
@@ -130,8 +131,13 @@
 			0, sync_ast, res, res->bast);
 	if (ret)
 		return ret;
-	wait_event(res->sync_locking, res->sync_locking_done);
+	ret = wait_event_timeout(res->sync_locking, res->sync_locking_done,
+				WAIT_DLM_LOCK_TIMEOUT);
 	res->sync_locking_done = false;
+	if (!ret) {
+		pr_err("locking DLM '%s' timeout!\n", res->name);
+		return -EBUSY;
+	}
 	if (res->lksb.sb_status == 0)
 		res->mode = mode;
 	return res->lksb.sb_status;
@@ -743,7 +749,7 @@
  */
 static int __sendmsg(struct md_cluster_info *cinfo, struct cluster_msg *cmsg)
 {
-	int error;
+	int error, unlock_error;
 	int slot = cinfo->slot_number - 1;
 
 	cmsg->slot = cpu_to_le32(slot);
@@ -751,7 +757,7 @@
 	error = dlm_lock_sync(cinfo->message_lockres, DLM_LOCK_EX);
 	if (error) {
 		pr_err("md-cluster: failed to get EX on MESSAGE (%d)\n", error);
-		goto failed_message;
+		return error;
 	}
 
 	memcpy(cinfo->message_lockres->lksb.sb_lvbptr, (void *)cmsg,
@@ -781,14 +787,10 @@
 	}
 
 failed_ack:
-	error = dlm_unlock_sync(cinfo->message_lockres);
-	if (unlikely(error != 0)) {
+	while ((unlock_error = dlm_unlock_sync(cinfo->message_lockres)))
 		pr_err("md-cluster: failed convert to NL on MESSAGE(%d)\n",
-			error);
-		/* in case the message can't be released due to some reason */
-		goto failed_ack;
-	}
-failed_message:
+			unlock_error);
+
 	return error;
 }
 
--- linux-qcom-6.8.0.orig/drivers/md/md.c
+++ linux-qcom-6.8.0/drivers/md/md.c
@@ -99,18 +99,6 @@
 static void export_rdev(struct md_rdev *rdev, struct mddev *mddev);
 static void md_wakeup_thread_directly(struct md_thread __rcu *thread);
 
-enum md_ro_state {
-	MD_RDWR,
-	MD_RDONLY,
-	MD_AUTO_READ,
-	MD_MAX_STATE
-};
-
-static bool md_is_rdwr(struct mddev *mddev)
-{
-	return (mddev->ro == MD_RDWR);
-}
-
 /*
  * Default number of read corrections we'll attempt on an rdev
  * before ejecting it from the array. We divide the read error
@@ -378,7 +366,7 @@
 	return true;
 }
 
-void md_handle_request(struct mddev *mddev, struct bio *bio)
+bool md_handle_request(struct mddev *mddev, struct bio *bio)
 {
 check_suspended:
 	if (is_suspended(mddev, bio)) {
@@ -386,7 +374,7 @@
 		/* Bail out if REQ_NOWAIT is set for the bio */
 		if (bio->bi_opf & REQ_NOWAIT) {
 			bio_wouldblock_error(bio);
-			return;
+			return true;
 		}
 		for (;;) {
 			prepare_to_wait(&mddev->sb_wait, &__wait,
@@ -402,10 +390,13 @@
 
 	if (!mddev->pers->make_request(mddev, bio)) {
 		percpu_ref_put(&mddev->active_io);
+		if (!mddev->gendisk && mddev->pers->prepare_suspend)
+			return false;
 		goto check_suspended;
 	}
 
 	percpu_ref_put(&mddev->active_io);
+	return true;
 }
 EXPORT_SYMBOL(md_handle_request);
 
@@ -489,7 +480,6 @@
 	 */
 	WRITE_ONCE(mddev->suspended, mddev->suspended + 1);
 
-	del_timer_sync(&mddev->safemode_timer);
 	/* restrict memory reclaim I/O during raid array is suspend */
 	mddev->noio_flag = memalloc_noio_save();
 
@@ -542,13 +532,9 @@
 
 	rdev_dec_pending(rdev, mddev);
 
-	if (atomic_dec_and_test(&mddev->flush_pending)) {
-		/* The pair is percpu_ref_get() from md_flush_request() */
-		percpu_ref_put(&mddev->active_io);
-
+	if (atomic_dec_and_test(&mddev->flush_pending))
 		/* The pre-request flush has finished */
 		queue_work(md_wq, &mddev->flush_work);
-	}
 }
 
 static void md_submit_flush_data(struct work_struct *ws);
@@ -579,12 +565,8 @@
 			rcu_read_lock();
 		}
 	rcu_read_unlock();
-	if (atomic_dec_and_test(&mddev->flush_pending)) {
-		/* The pair is percpu_ref_get() from md_flush_request() */
-		percpu_ref_put(&mddev->active_io);
-
+	if (atomic_dec_and_test(&mddev->flush_pending))
 		queue_work(md_wq, &mddev->flush_work);
-	}
 }
 
 static void md_submit_flush_data(struct work_struct *ws)
@@ -609,8 +591,20 @@
 		bio_endio(bio);
 	} else {
 		bio->bi_opf &= ~REQ_PREFLUSH;
-		md_handle_request(mddev, bio);
+
+		/*
+		 * make_requst() will never return error here, it only
+		 * returns error in raid5_make_request() by dm-raid.
+		 * Since dm always splits data and flush operation into
+		 * two separate io, io size of flush submitted by dm
+		 * always is 0, make_request() will not be called here.
+		 */
+		if (WARN_ON_ONCE(!mddev->pers->make_request(mddev, bio)))
+			bio_io_error(bio);;
 	}
+
+	/* The pair is percpu_ref_get() from md_flush_request() */
+	percpu_ref_put(&mddev->active_io);
 }
 
 /*
@@ -2566,6 +2560,7 @@
  fail:
 	pr_warn("md: failed to register dev-%s for %s\n",
 		b, mdname(mddev));
+	mddev_destroy_serial_pool(mddev, rdev);
 	return err;
 }
 
@@ -4919,6 +4914,35 @@
 		mddev_lock_nointr(mddev);
 }
 
+void md_idle_sync_thread(struct mddev *mddev)
+{
+	lockdep_assert_held(&mddev->reconfig_mutex);
+
+	clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+	stop_sync_thread(mddev, true, true);
+}
+EXPORT_SYMBOL_GPL(md_idle_sync_thread);
+
+void md_frozen_sync_thread(struct mddev *mddev)
+{
+	lockdep_assert_held(&mddev->reconfig_mutex);
+
+	set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+	stop_sync_thread(mddev, true, false);
+}
+EXPORT_SYMBOL_GPL(md_frozen_sync_thread);
+
+void md_unfrozen_sync_thread(struct mddev *mddev)
+{
+	lockdep_assert_held(&mddev->reconfig_mutex);
+
+	clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+	set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+	md_wakeup_thread(mddev->thread);
+	sysfs_notify_dirent_safe(mddev->sysfs_action);
+}
+EXPORT_SYMBOL_GPL(md_unfrozen_sync_thread);
+
 static void idle_sync_thread(struct mddev *mddev)
 {
 	mutex_lock(&mddev->sync_mutex);
@@ -6038,7 +6062,10 @@
 			pr_warn("True protection against single-disk failure might be compromised.\n");
 	}
 
-	mddev->recovery = 0;
+	/* dm-raid expect sync_thread to be frozen until resume */
+	if (mddev->gendisk)
+		mddev->recovery = 0;
+
 	/* may be over-ridden by personality */
 	mddev->resync_max_sectors = mddev->dev_sectors;
 
@@ -6278,7 +6305,15 @@
 	mddev->persistent = 0;
 	mddev->level = LEVEL_NONE;
 	mddev->clevel[0] = 0;
-	mddev->flags = 0;
+	/*
+	 * Don't clear MD_CLOSING, or mddev can be opened again.
+	 * 'hold_active != 0' means mddev is still in the creation
+	 * process and will be used later.
+	 */
+	if (mddev->hold_active)
+		mddev->flags = 0;
+	else
+		mddev->flags &= BIT_ULL_MASK(MD_CLOSING);
 	mddev->sb_flags = 0;
 	mddev->ro = MD_RDWR;
 	mddev->metadata_type[0] = 0;
@@ -6315,7 +6350,6 @@
 
 static void __md_stop_writes(struct mddev *mddev)
 {
-	stop_sync_thread(mddev, true, false);
 	del_timer_sync(&mddev->safemode_timer);
 
 	if (mddev->pers && mddev->pers->quiesce) {
@@ -6340,6 +6374,8 @@
 void md_stop_writes(struct mddev *mddev)
 {
 	mddev_lock_nointr(mddev);
+	set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+	stop_sync_thread(mddev, true, false);
 	__md_stop_writes(mddev);
 	mddev_unlock(mddev);
 }
@@ -7624,7 +7660,6 @@
 	int err = 0;
 	void __user *argp = (void __user *)arg;
 	struct mddev *mddev = NULL;
-	bool did_set_md_closing = false;
 
 	if (!md_ioctl_valid(cmd))
 		return -ENOTTY;
@@ -7656,11 +7691,6 @@
 
 	mddev = bdev->bd_disk->private_data;
 
-	if (!mddev) {
-		BUG();
-		goto out;
-	}
-
 	/* Some actions do not requires the mutex */
 	switch (cmd) {
 	case GET_ARRAY_INFO:
@@ -7687,12 +7717,6 @@
 
 	}
 
-	if (cmd == HOT_REMOVE_DISK)
-		/* need to ensure recovery thread has run */
-		wait_event_interruptible_timeout(mddev->sb_wait,
-						 !test_bit(MD_RECOVERY_NEEDED,
-							   &mddev->recovery),
-						 msecs_to_jiffies(5000));
 	if (cmd == STOP_ARRAY || cmd == STOP_ARRAY_RO) {
 		/* Need to flush page cache, and ensure no-one else opens
 		 * and writes
@@ -7708,7 +7732,6 @@
 			err = -EBUSY;
 			goto out;
 		}
-		did_set_md_closing = true;
 		mutex_unlock(&mddev->open_mutex);
 		sync_blockdev(bdev);
 	}
@@ -7850,7 +7873,7 @@
 				     mddev_unlock(mddev);
 
 out:
-	if(did_set_md_closing)
+	if (cmd == STOP_ARRAY_RO || (err && cmd == STOP_ARRAY))
 		clear_bit(MD_CLOSING, &mddev->flags);
 	return err;
 }
@@ -8591,17 +8614,16 @@
  * A return value of 'false' means that the write wasn't recorded
  * and cannot proceed as the array is being suspend.
  */
-bool md_write_start(struct mddev *mddev, struct bio *bi)
+void md_write_start(struct mddev *mddev, struct bio *bi)
 {
 	int did_change = 0;
 
 	if (bio_data_dir(bi) != WRITE)
-		return true;
+		return;
 
 	BUG_ON(mddev->ro == MD_RDONLY);
 	if (mddev->ro == MD_AUTO_READ) {
 		/* need to switch to read/write */
-		flush_work(&mddev->sync_work);
 		mddev->ro = MD_RDWR;
 		set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
 		md_wakeup_thread(mddev->thread);
@@ -8629,15 +8651,9 @@
 	if (did_change)
 		sysfs_notify_dirent_safe(mddev->sysfs_state);
 	if (!mddev->has_superblocks)
-		return true;
+		return;
 	wait_event(mddev->sb_wait,
-		   !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags) ||
-		   is_md_suspended(mddev));
-	if (test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)) {
-		percpu_ref_put(&mddev->writes_pending);
-		return false;
-	}
-	return true;
+		   !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags));
 }
 EXPORT_SYMBOL(md_write_start);
 
@@ -8737,6 +8753,23 @@
 }
 EXPORT_SYMBOL_GPL(md_account_bio);
 
+void md_free_cloned_bio(struct bio *bio)
+{
+	struct md_io_clone *md_io_clone = bio->bi_private;
+	struct bio *orig_bio = md_io_clone->orig_bio;
+	struct mddev *mddev = md_io_clone->mddev;
+
+	if (bio->bi_status && !orig_bio->bi_status)
+		orig_bio->bi_status = bio->bi_status;
+
+	if (md_io_clone->start_time)
+		bio_end_io_acct(orig_bio, md_io_clone->start_time);
+
+	bio_put(bio);
+	percpu_ref_put(&mddev->active_io);
+}
+EXPORT_SYMBOL_GPL(md_free_cloned_bio);
+
 /* md_allow_write(mddev)
  * Calling this ensures that the array is marked 'active' so that writes
  * may proceed without blocking.  It is important to call this before
@@ -9270,9 +9303,14 @@
 {
 	struct md_rdev *rdev;
 
-	rdev_for_each(rdev, mddev)
-		if (rdev_removeable(rdev) || rdev_addable(rdev))
+	rcu_read_lock();
+	rdev_for_each_rcu(rdev, mddev) {
+		if (rdev_removeable(rdev) || rdev_addable(rdev)) {
+			rcu_read_unlock();
 			return true;
+		}
+	}
+	rcu_read_unlock();
 	return false;
 }
 
--- linux-qcom-6.8.0.orig/drivers/md/md.h
+++ linux-qcom-6.8.0/drivers/md/md.h
@@ -207,6 +207,7 @@
 				 * check if there is collision between raid1
 				 * serial bios.
 				 */
+	Nonrot,			/* non-rotational device (SSD) */
 };
 
 static inline int is_badblock(struct md_rdev *rdev, sector_t s, int sectors,
@@ -558,6 +559,37 @@
 	MD_RESYNCING_REMOTE,	/* remote node is running resync thread */
 };
 
+enum md_ro_state {
+	MD_RDWR,
+	MD_RDONLY,
+	MD_AUTO_READ,
+	MD_MAX_STATE
+};
+
+static inline bool md_is_rdwr(struct mddev *mddev)
+{
+	return (mddev->ro == MD_RDWR);
+}
+
+static inline bool reshape_interrupted(struct mddev *mddev)
+{
+	/* reshape never start */
+	if (mddev->reshape_position == MaxSector)
+		return false;
+
+	/* interrupted */
+	if (!test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+		return true;
+
+	/* running reshape will be interrupted soon. */
+	if (test_bit(MD_RECOVERY_WAIT, &mddev->recovery) ||
+	    test_bit(MD_RECOVERY_INTR, &mddev->recovery) ||
+	    test_bit(MD_RECOVERY_FROZEN, &mddev->recovery))
+		return true;
+
+	return false;
+}
+
 static inline int __must_check mddev_lock(struct mddev *mddev)
 {
 	return mutex_lock_interruptible(&mddev->reconfig_mutex);
@@ -617,6 +649,7 @@
 	int (*start_reshape) (struct mddev *mddev);
 	void (*finish_reshape) (struct mddev *mddev);
 	void (*update_reshape_pos) (struct mddev *mddev);
+	void (*prepare_suspend) (struct mddev *mddev);
 	/* quiesce suspends or resumes internal processing.
 	 * 1 - stop new actions and wait for action io to complete
 	 * 0 - return to normal behaviour
@@ -741,7 +774,7 @@
 extern void md_wakeup_thread(struct md_thread __rcu *thread);
 extern void md_check_recovery(struct mddev *mddev);
 extern void md_reap_sync_thread(struct mddev *mddev);
-extern bool md_write_start(struct mddev *mddev, struct bio *bi);
+extern void md_write_start(struct mddev *mddev, struct bio *bi);
 extern void md_write_inc(struct mddev *mddev, struct bio *bi);
 extern void md_write_end(struct mddev *mddev);
 extern void md_done_sync(struct mddev *mddev, int blocks, int ok);
@@ -750,6 +783,7 @@
 void md_submit_discard_bio(struct mddev *mddev, struct md_rdev *rdev,
 			struct bio *bio, sector_t start, sector_t size);
 void md_account_bio(struct mddev *mddev, struct bio **bio);
+void md_free_cloned_bio(struct bio *bio);
 
 extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio);
 extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev,
@@ -778,9 +812,12 @@
 extern int md_rdev_init(struct md_rdev *rdev);
 extern void md_rdev_clear(struct md_rdev *rdev);
 
-extern void md_handle_request(struct mddev *mddev, struct bio *bio);
+extern bool md_handle_request(struct mddev *mddev, struct bio *bio);
 extern int mddev_suspend(struct mddev *mddev, bool interruptible);
 extern void mddev_resume(struct mddev *mddev);
+extern void md_idle_sync_thread(struct mddev *mddev);
+extern void md_frozen_sync_thread(struct mddev *mddev);
+extern void md_unfrozen_sync_thread(struct mddev *mddev);
 
 extern void md_reload_sb(struct mddev *mddev, int raid_disk);
 extern void md_update_sb(struct mddev *mddev, int force);
--- linux-qcom-6.8.0.orig/drivers/md/persistent-data/dm-array.c
+++ linux-qcom-6.8.0/drivers/md/persistent-data/dm-array.c
@@ -917,23 +917,27 @@
 	if (c->block)
 		unlock_ablock(c->info, c->block);
 
-	c->block = NULL;
-	c->ab = NULL;
 	c->index = 0;
 
 	r = dm_btree_cursor_get_value(&c->cursor, &key, &value_le);
 	if (r) {
 		DMERR("dm_btree_cursor_get_value failed");
-		dm_btree_cursor_end(&c->cursor);
+		goto out;
 
 	} else {
 		r = get_ablock(c->info, le64_to_cpu(value_le), &c->block, &c->ab);
 		if (r) {
 			DMERR("get_ablock failed");
-			dm_btree_cursor_end(&c->cursor);
+			goto out;
 		}
 	}
 
+	return 0;
+
+out:
+	dm_btree_cursor_end(&c->cursor);
+	c->block = NULL;
+	c->ab = NULL;
 	return r;
 }
 
@@ -956,10 +960,10 @@
 
 void dm_array_cursor_end(struct dm_array_cursor *c)
 {
-	if (c->block) {
+	if (c->block)
 		unlock_ablock(c->info, c->block);
-		dm_btree_cursor_end(&c->cursor);
-	}
+
+	dm_btree_cursor_end(&c->cursor);
 }
 EXPORT_SYMBOL_GPL(dm_array_cursor_end);
 
@@ -999,6 +1003,7 @@
 		}
 
 		count -= remaining;
+		c->index += (remaining - 1);
 		r = dm_array_cursor_next(c);
 
 	} while (!r);
--- linux-qcom-6.8.0.orig/drivers/md/persistent-data/dm-space-map-common.c
+++ linux-qcom-6.8.0/drivers/md/persistent-data/dm-space-map-common.c
@@ -51,7 +51,7 @@
 					       block_size - sizeof(__le32),
 					       INDEX_CSUM_XOR));
 	if (csum_disk != mi_le->csum) {
-		DMERR_LIMIT("i%s failed: csum %u != wanted %u", __func__,
+		DMERR_LIMIT("%s failed: csum %u != wanted %u", __func__,
 			    le32_to_cpu(csum_disk), le32_to_cpu(mi_le->csum));
 		return -EILSEQ;
 	}
--- linux-qcom-6.8.0.orig/drivers/md/persistent-data/dm-space-map-metadata.c
+++ linux-qcom-6.8.0/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -277,7 +277,7 @@
 {
 	struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
 
-	kfree(smm);
+	kvfree(smm);
 }
 
 static int sm_metadata_get_nr_blocks(struct dm_space_map *sm, dm_block_t *count)
@@ -772,7 +772,7 @@
 {
 	struct sm_metadata *smm;
 
-	smm = kmalloc(sizeof(*smm), GFP_KERNEL);
+	smm = kvmalloc(sizeof(*smm), GFP_KERNEL);
 	if (!smm)
 		return ERR_PTR(-ENOMEM);
 
--- linux-qcom-6.8.0.orig/drivers/md/raid0.c
+++ linux-qcom-6.8.0/drivers/md/raid0.c
@@ -263,11 +263,12 @@
 		   default_layout == RAID0_ALT_MULTIZONE_LAYOUT) {
 		conf->layout = default_layout;
 	} else {
-		pr_err("md/raid0:%s: cannot assemble multi-zone RAID0 with default_layout setting\n",
-		       mdname(mddev));
-		pr_err("md/raid0: please set raid0.default_layout to 1 or 2\n");
-		err = -EOPNOTSUPP;
-		goto abort;
+		conf->layout = RAID0_ALT_MULTIZONE_LAYOUT;
+		pr_warn("md/raid0:%s: !!! DEFAULTING TO ALTERNATE LAYOUT !!!\n",
+			mdname(mddev));
+		pr_warn("md/raid0: Please set raid0.default_layout to 1 or 2\n");
+		pr_warn("md/raid0: Read the following page for more information:\n");
+		pr_warn("md/raid0: https://wiki.ubuntu.com/Kernel/Raid0LayoutMigration\n");
 	}
 
 	if (conf->layout == RAID0_ORIG_LAYOUT) {
@@ -365,18 +366,13 @@
 	return array_sectors;
 }
 
-static void free_conf(struct mddev *mddev, struct r0conf *conf)
-{
-	kfree(conf->strip_zone);
-	kfree(conf->devlist);
-	kfree(conf);
-}
-
 static void raid0_free(struct mddev *mddev, void *priv)
 {
 	struct r0conf *conf = priv;
 
-	free_conf(mddev, conf);
+	kfree(conf->strip_zone);
+	kfree(conf->devlist);
+	kfree(conf);
 }
 
 static int raid0_run(struct mddev *mddev)
@@ -424,11 +420,7 @@
 
 	dump_zones(mddev);
 
-	ret = md_integrity_register(mddev);
-	if (ret)
-		free_conf(mddev, conf);
-
-	return ret;
+	return md_integrity_register(mddev);
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/md/raid1.c
+++ linux-qcom-6.8.0/drivers/md/raid1.c
@@ -601,14 +601,12 @@
 	const sector_t this_sector = r1_bio->sector;
 	int sectors;
 	int best_good_sectors;
-	int best_disk, best_dist_disk, best_pending_disk;
-	int has_nonrot_disk;
+	int best_disk, best_dist_disk, best_pending_disk, sequential_disk;
 	int disk;
 	sector_t best_dist;
 	unsigned int min_pending;
 	struct md_rdev *rdev;
 	int choose_first;
-	int choose_next_idle;
 
 	/*
 	 * Check if we can balance. We can balance on the whole
@@ -619,12 +617,11 @@
 	sectors = r1_bio->sectors;
 	best_disk = -1;
 	best_dist_disk = -1;
+	sequential_disk = -1;
 	best_dist = MaxSector;
 	best_pending_disk = -1;
 	min_pending = UINT_MAX;
 	best_good_sectors = 0;
-	has_nonrot_disk = 0;
-	choose_next_idle = 0;
 	clear_bit(R1BIO_FailFast, &r1_bio->state);
 
 	if ((conf->mddev->recovery_cp < this_sector + sectors) ||
@@ -640,7 +637,6 @@
 		sector_t first_bad;
 		int bad_sectors;
 		unsigned int pending;
-		bool nonrot;
 
 		rdev = conf->mirrors[disk].rdev;
 		if (r1_bio->bios[disk] == IO_BLOCKED
@@ -706,8 +702,6 @@
 			/* At least two disks to choose from so failfast is OK */
 			set_bit(R1BIO_FailFast, &r1_bio->state);
 
-		nonrot = bdev_nonrot(rdev->bdev);
-		has_nonrot_disk |= nonrot;
 		pending = atomic_read(&rdev->nr_pending);
 		dist = abs(this_sector - conf->mirrors[disk].head_position);
 		if (choose_first) {
@@ -720,7 +714,6 @@
 			int opt_iosize = bdev_io_opt(rdev->bdev) >> 9;
 			struct raid1_info *mirror = &conf->mirrors[disk];
 
-			best_disk = disk;
 			/*
 			 * If buffered sequential IO size exceeds optimal
 			 * iosize, check if there is idle disk. If yes, choose
@@ -734,20 +727,27 @@
 			 * small, but not a big deal since when the second disk
 			 * starts IO, the first disk is likely still busy.
 			 */
-			if (nonrot && opt_iosize > 0 &&
+			if (test_bit(Nonrot, &rdev->flags) && opt_iosize > 0 &&
 			    mirror->seq_start != MaxSector &&
 			    mirror->next_seq_sect > opt_iosize &&
 			    mirror->next_seq_sect - opt_iosize >=
 			    mirror->seq_start) {
-				choose_next_idle = 1;
-				continue;
+				/*
+				 * Add 'pending' to avoid choosing this disk if
+				 * there is other idle disk.
+				 */
+				pending++;
+				/*
+				 * If there is no other idle disk, this disk
+				 * will be chosen.
+				 */
+				sequential_disk = disk;
+			} else {
+				best_disk = disk;
+				break;
 			}
-			break;
 		}
 
-		if (choose_next_idle)
-			continue;
-
 		if (min_pending > pending) {
 			min_pending = pending;
 			best_pending_disk = disk;
@@ -760,13 +760,20 @@
 	}
 
 	/*
+	 * sequential IO size exceeds optimal iosize, however, there is no other
+	 * idle disk, so choose the sequential disk.
+	 */
+	if (best_disk == -1 && min_pending != 0)
+		best_disk = sequential_disk;
+
+	/*
 	 * If all disks are rotational, choose the closest disk. If any disk is
 	 * non-rotational, choose the disk with less pending request even the
 	 * disk is rotational, which might/might not be optimal for raids with
 	 * mixed ratation/non-rotational disks depending on workload.
 	 */
 	if (best_disk == -1) {
-		if (has_nonrot_disk || min_pending == 0)
+		if (READ_ONCE(conf->nonrot_disks) || min_pending == 0)
 			best_disk = best_pending_disk;
 		else
 			best_disk = best_dist_disk;
@@ -1467,7 +1474,7 @@
 		for (j = 0; j < i; j++)
 			if (r1_bio->bios[j])
 				rdev_dec_pending(conf->mirrors[j].rdev, mddev);
-		free_r1bio(r1_bio);
+		mempool_free(r1_bio, &conf->r1bio_pool);
 		allow_barrier(conf, bio->bi_iter.bi_sector);
 
 		if (bio->bi_opf & REQ_NOWAIT) {
@@ -1598,8 +1605,7 @@
 	if (bio_data_dir(bio) == READ)
 		raid1_read_request(mddev, bio, sectors, NULL);
 	else {
-		if (!md_write_start(mddev,bio))
-			return false;
+		md_write_start(mddev,bio);
 		raid1_write_request(mddev, bio, sectors);
 	}
 	return true;
@@ -1760,6 +1766,52 @@
 	return count;
 }
 
+static bool raid1_add_conf(struct r1conf *conf, struct md_rdev *rdev, int disk,
+			   bool replacement)
+{
+	struct raid1_info *info = conf->mirrors + disk;
+
+	if (replacement)
+		info += conf->raid_disks;
+
+	if (info->rdev)
+		return false;
+
+	if (bdev_nonrot(rdev->bdev)) {
+		set_bit(Nonrot, &rdev->flags);
+		WRITE_ONCE(conf->nonrot_disks, conf->nonrot_disks + 1);
+	}
+
+	rdev->raid_disk = disk;
+	info->head_position = 0;
+	info->seq_start = MaxSector;
+	WRITE_ONCE(info->rdev, rdev);
+
+	return true;
+}
+
+static bool raid1_remove_conf(struct r1conf *conf, int disk)
+{
+	struct raid1_info *info = conf->mirrors + disk;
+	struct md_rdev *rdev = info->rdev;
+
+	if (!rdev || test_bit(In_sync, &rdev->flags) ||
+	    atomic_read(&rdev->nr_pending))
+		return false;
+
+	/* Only remove non-faulty devices if recovery is not possible. */
+	if (!test_bit(Faulty, &rdev->flags) &&
+	    rdev->mddev->recovery_disabled != conf->recovery_disabled &&
+	    rdev->mddev->degraded < conf->raid_disks)
+		return false;
+
+	if (test_and_clear_bit(Nonrot, &rdev->flags))
+		WRITE_ONCE(conf->nonrot_disks, conf->nonrot_disks - 1);
+
+	WRITE_ONCE(info->rdev, NULL);
+	return true;
+}
+
 static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 {
 	struct r1conf *conf = mddev->private;
@@ -1795,15 +1847,13 @@
 				disk_stack_limits(mddev->gendisk, rdev->bdev,
 						  rdev->data_offset << 9);
 
-			p->head_position = 0;
-			rdev->raid_disk = mirror;
+			raid1_add_conf(conf, rdev, mirror, false);
 			err = 0;
 			/* As all devices are equivalent, we don't need a full recovery
 			 * if this was recently any drive of the array
 			 */
 			if (rdev->saved_raid_disk < 0)
 				conf->fullsync = 1;
-			WRITE_ONCE(p->rdev, rdev);
 			break;
 		}
 		if (test_bit(WantReplacement, &p->rdev->flags) &&
@@ -1813,13 +1863,11 @@
 
 	if (err && repl_slot >= 0) {
 		/* Add this device as a replacement */
-		p = conf->mirrors + repl_slot;
 		clear_bit(In_sync, &rdev->flags);
 		set_bit(Replacement, &rdev->flags);
-		rdev->raid_disk = repl_slot;
+		raid1_add_conf(conf, rdev, repl_slot, true);
 		err = 0;
 		conf->fullsync = 1;
-		WRITE_ONCE(p[conf->raid_disks].rdev, rdev);
 	}
 
 	print_conf(conf);
@@ -1836,27 +1884,20 @@
 	if (unlikely(number >= conf->raid_disks))
 		goto abort;
 
-	if (rdev != p->rdev)
-		p = conf->mirrors + conf->raid_disks + number;
+	if (rdev != p->rdev) {
+		number += conf->raid_disks;
+		p = conf->mirrors + number;
+	}
 
 	print_conf(conf);
 	if (rdev == p->rdev) {
-		if (test_bit(In_sync, &rdev->flags) ||
-		    atomic_read(&rdev->nr_pending)) {
-			err = -EBUSY;
-			goto abort;
-		}
-		/* Only remove non-faulty devices if recovery
-		 * is not possible.
-		 */
-		if (!test_bit(Faulty, &rdev->flags) &&
-		    mddev->recovery_disabled != conf->recovery_disabled &&
-		    mddev->degraded < conf->raid_disks) {
+		if (!raid1_remove_conf(conf, number)) {
 			err = -EBUSY;
 			goto abort;
 		}
-		WRITE_ONCE(p->rdev, NULL);
-		if (conf->mirrors[conf->raid_disks + number].rdev) {
+
+		if (number < conf->raid_disks &&
+		    conf->mirrors[conf->raid_disks + number].rdev) {
 			/* We just removed a device that is being replaced.
 			 * Move down the replacement.  We drain all IO before
 			 * doing this to avoid confusion.
@@ -3006,23 +3047,17 @@
 
 	err = -EINVAL;
 	spin_lock_init(&conf->device_lock);
+	conf->raid_disks = mddev->raid_disks;
 	rdev_for_each(rdev, mddev) {
 		int disk_idx = rdev->raid_disk;
-		if (disk_idx >= mddev->raid_disks
-		    || disk_idx < 0)
+
+		if (disk_idx >= conf->raid_disks || disk_idx < 0)
 			continue;
-		if (test_bit(Replacement, &rdev->flags))
-			disk = conf->mirrors + mddev->raid_disks + disk_idx;
-		else
-			disk = conf->mirrors + disk_idx;
 
-		if (disk->rdev)
+		if (!raid1_add_conf(conf, rdev, disk_idx,
+				    test_bit(Replacement, &rdev->flags)))
 			goto abort;
-		disk->rdev = rdev;
-		disk->head_position = 0;
-		disk->seq_start = MaxSector;
 	}
-	conf->raid_disks = mddev->raid_disks;
 	conf->mddev = mddev;
 	INIT_LIST_HEAD(&conf->retry_list);
 	INIT_LIST_HEAD(&conf->bio_end_io_list);
@@ -3086,7 +3121,6 @@
 	return ERR_PTR(err);
 }
 
-static void raid1_free(struct mddev *mddev, void *priv);
 static int raid1_run(struct mddev *mddev)
 {
 	struct r1conf *conf;
@@ -3139,8 +3173,7 @@
 	 */
 	if (conf->raid_disks - mddev->degraded < 1) {
 		md_unregister_thread(mddev, &conf->thread);
-		ret = -EINVAL;
-		goto abort;
+		return -EINVAL;
 	}
 
 	if (conf->raid_disks - mddev->degraded == 1)
@@ -3164,14 +3197,8 @@
 	md_set_array_sectors(mddev, raid1_size(mddev, 0, 0));
 
 	ret = md_integrity_register(mddev);
-	if (ret) {
+	if (ret)
 		md_unregister_thread(mddev, &mddev->thread);
-		goto abort;
-	}
-	return 0;
-
-abort:
-	raid1_free(mddev, conf);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/md/raid1.h
+++ linux-qcom-6.8.0/drivers/md/raid1.h
@@ -71,6 +71,7 @@
 						 * allow for replacements.
 						 */
 	int			raid_disks;
+	int			nonrot_disks;
 
 	spinlock_t		device_lock;
 
--- linux-qcom-6.8.0.orig/drivers/md/raid10.c
+++ linux-qcom-6.8.0/drivers/md/raid10.c
@@ -1861,8 +1861,7 @@
 	    && md_flush_request(mddev, bio))
 		return true;
 
-	if (!md_write_start(mddev, bio))
-		return false;
+	md_write_start(mddev, bio);
 
 	if (unlikely(bio_op(bio) == REQ_OP_DISCARD))
 		if (!raid10_handle_discard(mddev, bio))
--- linux-qcom-6.8.0.orig/drivers/md/raid5.c
+++ linux-qcom-6.8.0/drivers/md/raid5.c
@@ -155,7 +155,7 @@
 	return slot;
 }
 
-static void print_raid5_conf (struct r5conf *conf);
+static void print_raid5_conf(struct r5conf *conf);
 
 static int stripe_operations_active(struct stripe_head *sh)
 {
@@ -760,6 +760,7 @@
 	STRIPE_RETRY,
 	STRIPE_SCHEDULE_AND_RETRY,
 	STRIPE_FAIL,
+	STRIPE_WAIT_RESHAPE,
 };
 
 struct stripe_request_ctx {
@@ -2412,7 +2413,7 @@
 	atomic_inc(&conf->active_stripes);
 
 	raid5_release_stripe(sh);
-	conf->max_nr_stripes++;
+	WRITE_ONCE(conf->max_nr_stripes, conf->max_nr_stripes + 1);
 	return 1;
 }
 
@@ -2707,7 +2708,7 @@
 	shrink_buffers(sh);
 	free_stripe(conf->slab_cache, sh);
 	atomic_dec(&conf->active_stripes);
-	conf->max_nr_stripes--;
+	WRITE_ONCE(conf->max_nr_stripes, conf->max_nr_stripes - 1);
 	return 1;
 }
 
@@ -5915,6 +5916,39 @@
 	return ret;
 }
 
+enum reshape_loc {
+	LOC_NO_RESHAPE,
+	LOC_AHEAD_OF_RESHAPE,
+	LOC_INSIDE_RESHAPE,
+	LOC_BEHIND_RESHAPE,
+};
+
+static enum reshape_loc get_reshape_loc(struct mddev *mddev,
+		struct r5conf *conf, sector_t logical_sector)
+{
+	sector_t reshape_progress, reshape_safe;
+	/*
+	 * Spinlock is needed as reshape_progress may be
+	 * 64bit on a 32bit platform, and so it might be
+	 * possible to see a half-updated value
+	 * Of course reshape_progress could change after
+	 * the lock is dropped, so once we get a reference
+	 * to the stripe that we think it is, we will have
+	 * to check again.
+	 */
+	spin_lock_irq(&conf->device_lock);
+	reshape_progress = conf->reshape_progress;
+	reshape_safe = conf->reshape_safe;
+	spin_unlock_irq(&conf->device_lock);
+	if (reshape_progress == MaxSector)
+		return LOC_NO_RESHAPE;
+	if (ahead_of_reshape(mddev, logical_sector, reshape_progress))
+		return LOC_AHEAD_OF_RESHAPE;
+	if (ahead_of_reshape(mddev, logical_sector, reshape_safe))
+		return LOC_INSIDE_RESHAPE;
+	return LOC_BEHIND_RESHAPE;
+}
+
 static enum stripe_result make_stripe_request(struct mddev *mddev,
 		struct r5conf *conf, struct stripe_request_ctx *ctx,
 		sector_t logical_sector, struct bio *bi)
@@ -5929,27 +5963,14 @@
 	seq = read_seqcount_begin(&conf->gen_lock);
 
 	if (unlikely(conf->reshape_progress != MaxSector)) {
-		/*
-		 * Spinlock is needed as reshape_progress may be
-		 * 64bit on a 32bit platform, and so it might be
-		 * possible to see a half-updated value
-		 * Of course reshape_progress could change after
-		 * the lock is dropped, so once we get a reference
-		 * to the stripe that we think it is, we will have
-		 * to check again.
-		 */
-		spin_lock_irq(&conf->device_lock);
-		if (ahead_of_reshape(mddev, logical_sector,
-				     conf->reshape_progress)) {
-			previous = 1;
-		} else {
-			if (ahead_of_reshape(mddev, logical_sector,
-					     conf->reshape_safe)) {
-				spin_unlock_irq(&conf->device_lock);
-				return STRIPE_SCHEDULE_AND_RETRY;
-			}
+		enum reshape_loc loc = get_reshape_loc(mddev, conf,
+						       logical_sector);
+		if (loc == LOC_INSIDE_RESHAPE) {
+			ret = STRIPE_SCHEDULE_AND_RETRY;
+			goto out;
 		}
-		spin_unlock_irq(&conf->device_lock);
+		if (loc == LOC_AHEAD_OF_RESHAPE)
+			previous = 1;
 	}
 
 	new_sector = raid5_compute_sector(conf, logical_sector, previous,
@@ -6025,6 +6046,12 @@
 
 out_release:
 	raid5_release_stripe(sh);
+out:
+	if (ret == STRIPE_SCHEDULE_AND_RETRY && reshape_interrupted(mddev)) {
+		bi->bi_status = BLK_STS_RESOURCE;
+		ret = STRIPE_WAIT_RESHAPE;
+		pr_err_ratelimited("dm-raid456: io across reshape position while reshape can't make progress");
+	}
 	return ret;
 }
 
@@ -6087,8 +6114,7 @@
 		ctx.do_flush = bi->bi_opf & REQ_PREFLUSH;
 	}
 
-	if (!md_write_start(mddev, bi))
-		return false;
+	md_write_start(mddev, bi);
 	/*
 	 * If array is degraded, better not do chunk aligned read because
 	 * later we might have to read it again in order to reconstruct
@@ -6122,8 +6148,7 @@
 	/* Bail out if conflicts with reshape and REQ_NOWAIT is set */
 	if ((bi->bi_opf & REQ_NOWAIT) &&
 	    (conf->reshape_progress != MaxSector) &&
-	    !ahead_of_reshape(mddev, logical_sector, conf->reshape_progress) &&
-	    ahead_of_reshape(mddev, logical_sector, conf->reshape_safe)) {
+	    get_reshape_loc(mddev, conf, logical_sector) == LOC_INSIDE_RESHAPE) {
 		bio_wouldblock_error(bi);
 		if (rw == WRITE)
 			md_write_end(mddev);
@@ -6146,7 +6171,7 @@
 	while (1) {
 		res = make_stripe_request(mddev, conf, &ctx, logical_sector,
 					  bi);
-		if (res == STRIPE_FAIL)
+		if (res == STRIPE_FAIL || res == STRIPE_WAIT_RESHAPE)
 			break;
 
 		if (res == STRIPE_RETRY)
@@ -6184,6 +6209,11 @@
 
 	if (rw == WRITE)
 		md_write_end(mddev);
+	if (res == STRIPE_WAIT_RESHAPE) {
+		md_free_cloned_bio(bi);
+		return false;
+	}
+
 	bio_endio(bi);
 	return true;
 }
@@ -6259,7 +6289,9 @@
 	safepos = conf->reshape_safe;
 	sector_div(safepos, data_disks);
 	if (mddev->reshape_backwards) {
-		BUG_ON(writepos < reshape_sectors);
+		if (WARN_ON(writepos < reshape_sectors))
+			return MaxSector;
+
 		writepos -= reshape_sectors;
 		readpos += reshape_sectors;
 		safepos += reshape_sectors;
@@ -6277,14 +6309,18 @@
 	 * to set 'stripe_addr' which is where we will write to.
 	 */
 	if (mddev->reshape_backwards) {
-		BUG_ON(conf->reshape_progress == 0);
+		if (WARN_ON(conf->reshape_progress == 0))
+			return MaxSector;
+
 		stripe_addr = writepos;
-		BUG_ON((mddev->dev_sectors &
-			~((sector_t)reshape_sectors - 1))
-		       - reshape_sectors - stripe_addr
-		       != sector_nr);
+		if (WARN_ON((mddev->dev_sectors &
+		    ~((sector_t)reshape_sectors - 1)) -
+		    reshape_sectors - stripe_addr != sector_nr))
+			return MaxSector;
 	} else {
-		BUG_ON(writepos != sector_nr + reshape_sectors);
+		if (WARN_ON(writepos != sector_nr + reshape_sectors))
+			return MaxSector;
+
 		stripe_addr = sector_nr;
 	}
 
@@ -6737,6 +6773,9 @@
 		int batch_size, released;
 		unsigned int offset;
 
+		if (test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags))
+			break;
+
 		released = release_stripe_list(conf, conf->temp_inactive_list);
 		if (released)
 			clear_bit(R5_DID_ALLOC, &conf->cache_state);
@@ -6820,7 +6859,7 @@
 	if (size <= 16 || size > 32768)
 		return -EINVAL;
 
-	conf->min_nr_stripes = size;
+	WRITE_ONCE(conf->min_nr_stripes, size);
 	mutex_lock(&conf->cache_size_mutex);
 	while (size < conf->max_nr_stripes &&
 	       drop_one_stripe(conf))
@@ -6832,7 +6871,7 @@
 	mutex_lock(&conf->cache_size_mutex);
 	while (size > conf->max_nr_stripes)
 		if (!grow_one_stripe(conf, GFP_KERNEL)) {
-			conf->min_nr_stripes = conf->max_nr_stripes;
+			WRITE_ONCE(conf->min_nr_stripes, conf->max_nr_stripes);
 			result = -ENOMEM;
 			break;
 		}
@@ -7150,6 +7189,8 @@
 	err = mddev_suspend_and_lock(mddev);
 	if (err)
 		return err;
+	raid5_quiesce(mddev, true);
+
 	conf = mddev->private;
 	if (!conf)
 		err = -ENODEV;
@@ -7171,6 +7212,8 @@
 			kfree(old_groups);
 		}
 	}
+
+	raid5_quiesce(mddev, false);
 	mddev_unlock_and_resume(mddev);
 
 	return err ?: len;
@@ -7390,11 +7433,13 @@
 				       struct shrink_control *sc)
 {
 	struct r5conf *conf = shrink->private_data;
+	int max_stripes = READ_ONCE(conf->max_nr_stripes);
+	int min_stripes = READ_ONCE(conf->min_nr_stripes);
 
-	if (conf->max_nr_stripes < conf->min_nr_stripes)
+	if (max_stripes < min_stripes)
 		/* unlikely, but not impossible */
 		return 0;
-	return conf->max_nr_stripes - conf->min_nr_stripes;
+	return max_stripes - min_stripes;
 }
 
 static struct r5conf *setup_conf(struct mddev *mddev)
@@ -7563,11 +7608,11 @@
 		if (test_bit(Replacement, &rdev->flags)) {
 			if (disk->replacement)
 				goto abort;
-			RCU_INIT_POINTER(disk->replacement, rdev);
+			disk->replacement = rdev;
 		} else {
 			if (disk->rdev)
 				goto abort;
-			RCU_INIT_POINTER(disk->rdev, rdev);
+			disk->rdev = rdev;
 		}
 
 		if (test_bit(In_sync, &rdev->flags)) {
@@ -8049,7 +8094,7 @@
 	seq_printf (seq, "]");
 }
 
-static void print_raid5_conf (struct r5conf *conf)
+static void print_raid5_conf(struct r5conf *conf)
 {
 	struct md_rdev *rdev;
 	int i;
@@ -8063,15 +8108,13 @@
 	       conf->raid_disks,
 	       conf->raid_disks - conf->mddev->degraded);
 
-	rcu_read_lock();
 	for (i = 0; i < conf->raid_disks; i++) {
-		rdev = rcu_dereference(conf->disks[i].rdev);
+		rdev = conf->disks[i].rdev;
 		if (rdev)
 			pr_debug(" disk %d, o:%d, dev:%pg\n",
 			       i, !test_bit(Faulty, &rdev->flags),
 			       rdev->bdev);
 	}
-	rcu_read_unlock();
 }
 
 static int raid5_spare_active(struct mddev *mddev)
@@ -8909,6 +8952,18 @@
 	return r5l_start(conf->log);
 }
 
+/*
+ * This is only used for dm-raid456, caller already frozen sync_thread, hence
+ * if rehsape is still in progress, io that is waiting for reshape can never be
+ * done now, hence wake up and handle those IO.
+ */
+static void raid5_prepare_suspend(struct mddev *mddev)
+{
+	struct r5conf *conf = mddev->private;
+
+	wake_up(&conf->wait_for_overlap);
+}
+
 static struct md_personality raid6_personality =
 {
 	.name		= "raid6",
@@ -8932,6 +8987,7 @@
 	.quiesce	= raid5_quiesce,
 	.takeover	= raid6_takeover,
 	.change_consistency_policy = raid5_change_consistency_policy,
+	.prepare_suspend = raid5_prepare_suspend,
 };
 static struct md_personality raid5_personality =
 {
@@ -8956,6 +9012,7 @@
 	.quiesce	= raid5_quiesce,
 	.takeover	= raid5_takeover,
 	.change_consistency_policy = raid5_change_consistency_policy,
+	.prepare_suspend = raid5_prepare_suspend,
 };
 
 static struct md_personality raid4_personality =
@@ -8981,6 +9038,7 @@
 	.quiesce	= raid5_quiesce,
 	.takeover	= raid4_takeover,
 	.change_consistency_policy = raid5_change_consistency_policy,
+	.prepare_suspend = raid5_prepare_suspend,
 };
 
 static int __init raid5_init(void)
--- linux-qcom-6.8.0.orig/drivers/media/cec/core/cec-adap.c
+++ linux-qcom-6.8.0/drivers/media/cec/core/cec-adap.c
@@ -490,6 +490,15 @@
 			goto unlock;
 		}
 
+		if (adap->transmit_in_progress &&
+		    adap->transmit_in_progress_aborted) {
+			if (adap->transmitting)
+				cec_data_cancel(adap->transmitting,
+						CEC_TX_STATUS_ABORTED, 0);
+			adap->transmit_in_progress = false;
+			adap->transmit_in_progress_aborted = false;
+			goto unlock;
+		}
 		if (adap->transmit_in_progress && timeout) {
 			/*
 			 * If we timeout, then log that. Normally this does
@@ -771,6 +780,7 @@
 {
 	struct cec_data *data;
 	bool is_raw = msg_is_raw(msg);
+	int err;
 
 	if (adap->devnode.unregistered)
 		return -ENODEV;
@@ -935,11 +945,13 @@
 	 * Release the lock and wait, retake the lock afterwards.
 	 */
 	mutex_unlock(&adap->lock);
-	wait_for_completion_killable(&data->c);
-	if (!data->completed)
-		cancel_delayed_work_sync(&data->work);
+	err = wait_for_completion_killable(&data->c);
+	cancel_delayed_work_sync(&data->work);
 	mutex_lock(&adap->lock);
 
+	if (err)
+		adap->transmit_in_progress_aborted = true;
+
 	/* Cancel the transmit if it was interrupted */
 	if (!data->completed) {
 		if (data->msg.tx_status & CEC_TX_STATUS_OK)
@@ -1151,20 +1163,6 @@
 	if (valid_la && min_len) {
 		/* These messages have special length requirements */
 		switch (cmd) {
-		case CEC_MSG_TIMER_STATUS:
-			if (msg->msg[2] & 0x10) {
-				switch (msg->msg[2] & 0xf) {
-				case CEC_OP_PROG_INFO_NOT_ENOUGH_SPACE:
-				case CEC_OP_PROG_INFO_MIGHT_NOT_BE_ENOUGH_SPACE:
-					if (msg->len < 5)
-						valid_la = false;
-					break;
-				}
-			} else if ((msg->msg[2] & 0xf) == CEC_OP_PROG_ERROR_DUPLICATE) {
-				if (msg->len < 5)
-					valid_la = false;
-			}
-			break;
 		case CEC_MSG_RECORD_ON:
 			switch (msg->msg[2]) {
 			case CEC_OP_RECORD_SRC_OWN:
@@ -1589,9 +1587,12 @@
  */
 static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
 {
-	if (WARN_ON(adap->is_configuring || adap->is_configured))
+	if (WARN_ON(adap->is_claiming_log_addrs ||
+		    adap->is_configuring || adap->is_configured))
 		return;
 
+	adap->is_claiming_log_addrs = true;
+
 	init_completion(&adap->config_completion);
 
 	/* Ready to kick off the thread */
@@ -1606,6 +1607,7 @@
 		wait_for_completion(&adap->config_completion);
 		mutex_lock(&adap->lock);
 	}
+	adap->is_claiming_log_addrs = false;
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/media/cec/core/cec-api.c
+++ linux-qcom-6.8.0/drivers/media/cec/core/cec-api.c
@@ -178,7 +178,7 @@
 			   CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU |
 			   CEC_LOG_ADDRS_FL_CDC_ONLY;
 	mutex_lock(&adap->lock);
-	if (!adap->is_configuring &&
+	if (!adap->is_claiming_log_addrs && !adap->is_configuring &&
 	    (!log_addrs.num_log_addrs || !adap->is_configured) &&
 	    !cec_is_busy(adap, fh)) {
 		err = __cec_s_log_addrs(adap, &log_addrs, block);
@@ -664,6 +664,8 @@
 		list_del_init(&data->xfer_list);
 	}
 	mutex_unlock(&adap->lock);
+
+	mutex_lock(&fh->lock);
 	while (!list_empty(&fh->msgs)) {
 		struct cec_msg_entry *entry =
 			list_first_entry(&fh->msgs, struct cec_msg_entry, list);
@@ -681,6 +683,7 @@
 			kfree(entry);
 		}
 	}
+	mutex_unlock(&fh->lock);
 	kfree(fh);
 
 	cec_put_device(devnode);
--- linux-qcom-6.8.0.orig/drivers/media/cec/usb/pulse8/pulse8-cec.c
+++ linux-qcom-6.8.0/drivers/media/cec/usb/pulse8/pulse8-cec.c
@@ -685,7 +685,7 @@
 	err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 4);
 	if (err)
 		return err;
-	date = (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];
+	date = ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];
 	dev_info(pulse8->dev, "Firmware build date %ptT\n", &date);
 
 	dev_dbg(pulse8->dev, "Persistent config:\n");
--- linux-qcom-6.8.0.orig/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+++ linux-qcom-6.8.0/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
@@ -113,6 +113,7 @@
 {
 	unsigned pat;
 	unsigned plane;
+	int ret = 0;
 
 	tpg->max_line_width = max_w;
 	for (pat = 0; pat < TPG_MAX_PAT_LINES; pat++) {
@@ -121,14 +122,18 @@
 
 			tpg->lines[pat][plane] =
 				vzalloc(array3_size(max_w, 2, pixelsz));
-			if (!tpg->lines[pat][plane])
-				return -ENOMEM;
+			if (!tpg->lines[pat][plane]) {
+				ret = -ENOMEM;
+				goto free_lines;
+			}
 			if (plane == 0)
 				continue;
 			tpg->downsampled_lines[pat][plane] =
 				vzalloc(array3_size(max_w, 2, pixelsz));
-			if (!tpg->downsampled_lines[pat][plane])
-				return -ENOMEM;
+			if (!tpg->downsampled_lines[pat][plane]) {
+				ret = -ENOMEM;
+				goto free_lines;
+			}
 		}
 	}
 	for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
@@ -136,18 +141,45 @@
 
 		tpg->contrast_line[plane] =
 			vzalloc(array_size(pixelsz, max_w));
-		if (!tpg->contrast_line[plane])
-			return -ENOMEM;
+		if (!tpg->contrast_line[plane]) {
+			ret = -ENOMEM;
+			goto free_contrast_line;
+		}
 		tpg->black_line[plane] =
 			vzalloc(array_size(pixelsz, max_w));
-		if (!tpg->black_line[plane])
-			return -ENOMEM;
+		if (!tpg->black_line[plane]) {
+			ret = -ENOMEM;
+			goto free_contrast_line;
+		}
 		tpg->random_line[plane] =
 			vzalloc(array3_size(max_w, 2, pixelsz));
-		if (!tpg->random_line[plane])
-			return -ENOMEM;
+		if (!tpg->random_line[plane]) {
+			ret = -ENOMEM;
+			goto free_contrast_line;
+		}
 	}
 	return 0;
+
+free_contrast_line:
+	for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
+		vfree(tpg->contrast_line[plane]);
+		vfree(tpg->black_line[plane]);
+		vfree(tpg->random_line[plane]);
+		tpg->contrast_line[plane] = NULL;
+		tpg->black_line[plane] = NULL;
+		tpg->random_line[plane] = NULL;
+	}
+free_lines:
+	for (pat = 0; pat < TPG_MAX_PAT_LINES; pat++)
+		for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
+			vfree(tpg->lines[pat][plane]);
+			tpg->lines[pat][plane] = NULL;
+			if (plane == 0)
+				continue;
+			vfree(tpg->downsampled_lines[pat][plane]);
+			tpg->downsampled_lines[pat][plane] = NULL;
+		}
+	return ret;
 }
 EXPORT_SYMBOL_GPL(tpg_alloc);
 
@@ -1763,6 +1795,9 @@
 	unsigned p;
 	unsigned x;
 
+	if (WARN_ON_ONCE(!tpg->src_width || !tpg->scaled_width))
+		return;
+
 	switch (tpg->pattern) {
 	case TPG_PAT_GREEN:
 		contrast = TPG_COLOR_100_RED;
--- linux-qcom-6.8.0.orig/drivers/media/common/videobuf2/videobuf2-core.c
+++ linux-qcom-6.8.0/drivers/media/common/videobuf2/videobuf2-core.c
@@ -312,6 +312,10 @@
 	p->mem_priv = NULL;
 	p->dbuf = NULL;
 	p->dbuf_mapped = 0;
+	p->bytesused = 0;
+	p->length = 0;
+	p->m.fd = 0;
+	p->data_offset = 0;
 }
 
 /*
@@ -1378,10 +1382,6 @@
 
 		/* Release previously acquired memory if present */
 		__vb2_plane_dmabuf_put(vb, &vb->planes[plane]);
-		vb->planes[plane].bytesused = 0;
-		vb->planes[plane].length = 0;
-		vb->planes[plane].m.fd = 0;
-		vb->planes[plane].data_offset = 0;
 
 		/* Acquire each plane's memory */
 		mem_priv = call_ptr_memop(attach_dmabuf,
--- linux-qcom-6.8.0.orig/drivers/media/dvb-core/dvb_frontend.c
+++ linux-qcom-6.8.0/drivers/media/dvb-core/dvb_frontend.c
@@ -443,8 +443,8 @@
 
 		default:
 			fepriv->auto_step++;
-			fepriv->auto_sub_step = -1; /* it'll be incremented to 0 in a moment */
-			break;
+			fepriv->auto_sub_step = 0;
+			continue;
 		}
 
 		if (!ready) fepriv->auto_sub_step++;
@@ -2168,7 +2168,8 @@
 		if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
 			return -EINVAL;
 
-		tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp));
+		tvp = memdup_array_user(compat_ptr(tvps->props),
+					tvps->num, sizeof(*tvp));
 		if (IS_ERR(tvp))
 			return PTR_ERR(tvp);
 
@@ -2199,7 +2200,8 @@
 		if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
 			return -EINVAL;
 
-		tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp));
+		tvp = memdup_array_user(compat_ptr(tvps->props),
+					tvps->num, sizeof(*tvp));
 		if (IS_ERR(tvp))
 			return PTR_ERR(tvp);
 
@@ -2379,7 +2381,8 @@
 	if (!tvps->num || tvps->num > DTV_IOCTL_MAX_MSGS)
 		return -EINVAL;
 
-	tvp = memdup_user((void __user *)tvps->props, tvps->num * sizeof(*tvp));
+	tvp = memdup_array_user((void __user *)tvps->props,
+				tvps->num, sizeof(*tvp));
 	if (IS_ERR(tvp))
 		return PTR_ERR(tvp);
 
@@ -2457,7 +2460,8 @@
 		if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
 			return -EINVAL;
 
-		tvp = memdup_user((void __user *)tvps->props, tvps->num * sizeof(*tvp));
+		tvp = memdup_array_user((void __user *)tvps->props,
+					tvps->num, sizeof(*tvp));
 		if (IS_ERR(tvp))
 			return PTR_ERR(tvp);
 
--- linux-qcom-6.8.0.orig/drivers/media/dvb-core/dvb_vb2.c
+++ linux-qcom-6.8.0/drivers/media/dvb-core/dvb_vb2.c
@@ -366,9 +366,15 @@
 int dvb_vb2_expbuf(struct dvb_vb2_ctx *ctx, struct dmx_exportbuffer *exp)
 {
 	struct vb2_queue *q = &ctx->vb_q;
+	struct vb2_buffer *vb2 = vb2_get_buffer(q, exp->index);
 	int ret;
 
-	ret = vb2_core_expbuf(&ctx->vb_q, &exp->fd, q->type, q->bufs[exp->index],
+	if (!vb2) {
+		dprintk(1, "[%s] invalid buffer index\n", ctx->name);
+		return -EINVAL;
+	}
+
+	ret = vb2_core_expbuf(&ctx->vb_q, &exp->fd, q->type, vb2,
 			      0, exp->flags);
 	if (ret) {
 		dprintk(1, "[%s] index=%d errno=%d\n", ctx->name,
--- linux-qcom-6.8.0.orig/drivers/media/dvb-core/dvbdev.c
+++ linux-qcom-6.8.0/drivers/media/dvb-core/dvbdev.c
@@ -86,10 +86,15 @@
 static int dvb_device_open(struct inode *inode, struct file *file)
 {
 	struct dvb_device *dvbdev;
+	unsigned int minor = iminor(inode);
+
+	if (minor >= MAX_DVB_MINORS)
+		return -ENODEV;
 
 	mutex_lock(&dvbdev_mutex);
 	down_read(&minor_rwsem);
-	dvbdev = dvb_minors[iminor(inode)];
+
+	dvbdev = dvb_minors[minor];
 
 	if (dvbdev && dvbdev->fops) {
 		int err = 0;
@@ -490,6 +495,7 @@
 		dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL);
 		if (!dvbdevfops) {
 			kfree(dvbdev);
+			*pdvbdev = NULL;
 			mutex_unlock(&dvbdev_register_lock);
 			return -ENOMEM;
 		}
@@ -498,6 +504,7 @@
 		if (!new_node) {
 			kfree(dvbdevfops);
 			kfree(dvbdev);
+			*pdvbdev = NULL;
 			mutex_unlock(&dvbdev_register_lock);
 			return -ENOMEM;
 		}
@@ -523,7 +530,10 @@
 	for (minor = 0; minor < MAX_DVB_MINORS; minor++)
 		if (!dvb_minors[minor])
 			break;
-	if (minor == MAX_DVB_MINORS) {
+#else
+	minor = nums2minor(adap->num, type, id);
+#endif
+	if (minor >= MAX_DVB_MINORS) {
 		if (new_node) {
 			list_del(&new_node->list_head);
 			kfree(dvbdevfops);
@@ -531,13 +541,12 @@
 		}
 		list_del(&dvbdev->list_head);
 		kfree(dvbdev);
+		*pdvbdev = NULL;
 		up_write(&minor_rwsem);
 		mutex_unlock(&dvbdev_register_lock);
 		return -EINVAL;
 	}
-#else
-	minor = nums2minor(adap->num, type, id);
-#endif
+
 	dvbdev->minor = minor;
 	dvb_minors[minor] = dvb_device_get(dvbdev);
 	up_write(&minor_rwsem);
@@ -553,6 +562,7 @@
 		dvb_media_device_free(dvbdev);
 		list_del(&dvbdev->list_head);
 		kfree(dvbdev);
+		*pdvbdev = NULL;
 		mutex_unlock(&dvbdev_register_lock);
 		return ret;
 	}
@@ -571,6 +581,7 @@
 		dvb_media_device_free(dvbdev);
 		list_del(&dvbdev->list_head);
 		kfree(dvbdev);
+		*pdvbdev = NULL;
 		mutex_unlock(&dvbdev_register_lock);
 		return PTR_ERR(clsdev);
 	}
@@ -951,7 +962,7 @@
 		 int (*func)(struct file *file,
 			     unsigned int cmd, void *arg))
 {
-	char    sbuf[128];
+	char    sbuf[128] = {};
 	void    *mbuf = NULL;
 	void    *parg = NULL;
 	int     err  = -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/as102_fe_types.h
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/as102_fe_types.h
@@ -174,6 +174,6 @@
 	uint32_t addr;
 	/* register mode access */
 	uint8_t mode;
-};
+} __packed;
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/cx24116.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/cx24116.c
@@ -741,6 +741,7 @@
 {
 	struct cx24116_state *state = fe->demodulator_priv;
 	u8 snr_reading;
+	int ret;
 	static const u32 snr_tab[] = { /* 10 x Table (rounded up) */
 		0x00000, 0x0199A, 0x03333, 0x04ccD, 0x06667,
 		0x08000, 0x0999A, 0x0b333, 0x0cccD, 0x0e667,
@@ -749,7 +750,11 @@
 
 	dprintk("%s()\n", __func__);
 
-	snr_reading = cx24116_readreg(state, CX24116_REG_QUALITY0);
+	ret = cx24116_readreg(state, CX24116_REG_QUALITY0);
+	if (ret  < 0)
+		return ret;
+
+	snr_reading = ret;
 
 	if (snr_reading >= 0xa0 /* 100% */)
 		*snr = 0xffff;
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/dib3000mb.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/dib3000mb.c
@@ -51,7 +51,7 @@
 static int dib3000_read_reg(struct dib3000_state *state, u16 reg)
 {
 	u8 wb[] = { ((reg >> 8) | 0x80) & 0xff, reg & 0xff };
-	u8 rb[2];
+	u8 rb[2] = {};
 	struct i2c_msg msg[] = {
 		{ .addr = state->config.demod_address, .flags = 0,        .buf = wb, .len = 2 },
 		{ .addr = state->config.demod_address, .flags = I2C_M_RD, .buf = rb, .len = 2 },
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/lgdt3306a.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/lgdt3306a.c
@@ -2176,6 +2176,11 @@
 	struct dvb_frontend *fe;
 	int ret;
 
+	if (!client->dev.platform_data) {
+		dev_err(&client->dev, "platform data is mandatory\n");
+		return -EINVAL;
+	}
+
 	config = kmemdup(client->dev.platform_data,
 			 sizeof(struct lgdt3306a_config), GFP_KERNEL);
 	if (config == NULL) {
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/mxl5xx.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/mxl5xx.c
@@ -1381,57 +1381,57 @@
 	u32 nco_count_min = 0;
 	u32 clk_type = 0;
 
-	struct MXL_REG_FIELD_T xpt_sync_polarity[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_sync_polarity[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700010, 8, 1}, {0x90700010, 9, 1},
 		{0x90700010, 10, 1}, {0x90700010, 11, 1},
 		{0x90700010, 12, 1}, {0x90700010, 13, 1},
 		{0x90700010, 14, 1}, {0x90700010, 15, 1} };
-	struct MXL_REG_FIELD_T xpt_clock_polarity[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_clock_polarity[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700010, 16, 1}, {0x90700010, 17, 1},
 		{0x90700010, 18, 1}, {0x90700010, 19, 1},
 		{0x90700010, 20, 1}, {0x90700010, 21, 1},
 		{0x90700010, 22, 1}, {0x90700010, 23, 1} };
-	struct MXL_REG_FIELD_T xpt_valid_polarity[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_valid_polarity[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700014, 0, 1}, {0x90700014, 1, 1},
 		{0x90700014, 2, 1}, {0x90700014, 3, 1},
 		{0x90700014, 4, 1}, {0x90700014, 5, 1},
 		{0x90700014, 6, 1}, {0x90700014, 7, 1} };
-	struct MXL_REG_FIELD_T xpt_ts_clock_phase[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_ts_clock_phase[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700018, 0, 3}, {0x90700018, 4, 3},
 		{0x90700018, 8, 3}, {0x90700018, 12, 3},
 		{0x90700018, 16, 3}, {0x90700018, 20, 3},
 		{0x90700018, 24, 3}, {0x90700018, 28, 3} };
-	struct MXL_REG_FIELD_T xpt_lsb_first[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_lsb_first[MXL_HYDRA_DEMOD_MAX] = {
 		{0x9070000C, 16, 1}, {0x9070000C, 17, 1},
 		{0x9070000C, 18, 1}, {0x9070000C, 19, 1},
 		{0x9070000C, 20, 1}, {0x9070000C, 21, 1},
 		{0x9070000C, 22, 1}, {0x9070000C, 23, 1} };
-	struct MXL_REG_FIELD_T xpt_sync_byte[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_sync_byte[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700010, 0, 1}, {0x90700010, 1, 1},
 		{0x90700010, 2, 1}, {0x90700010, 3, 1},
 		{0x90700010, 4, 1}, {0x90700010, 5, 1},
 		{0x90700010, 6, 1}, {0x90700010, 7, 1} };
-	struct MXL_REG_FIELD_T xpt_enable_output[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_enable_output[MXL_HYDRA_DEMOD_MAX] = {
 		{0x9070000C, 0, 1}, {0x9070000C, 1, 1},
 		{0x9070000C, 2, 1}, {0x9070000C, 3, 1},
 		{0x9070000C, 4, 1}, {0x9070000C, 5, 1},
 		{0x9070000C, 6, 1}, {0x9070000C, 7, 1} };
-	struct MXL_REG_FIELD_T xpt_err_replace_sync[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_err_replace_sync[MXL_HYDRA_DEMOD_MAX] = {
 		{0x9070000C, 24, 1}, {0x9070000C, 25, 1},
 		{0x9070000C, 26, 1}, {0x9070000C, 27, 1},
 		{0x9070000C, 28, 1}, {0x9070000C, 29, 1},
 		{0x9070000C, 30, 1}, {0x9070000C, 31, 1} };
-	struct MXL_REG_FIELD_T xpt_err_replace_valid[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_err_replace_valid[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700014, 8, 1}, {0x90700014, 9, 1},
 		{0x90700014, 10, 1}, {0x90700014, 11, 1},
 		{0x90700014, 12, 1}, {0x90700014, 13, 1},
 		{0x90700014, 14, 1}, {0x90700014, 15, 1} };
-	struct MXL_REG_FIELD_T xpt_continuous_clock[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_continuous_clock[MXL_HYDRA_DEMOD_MAX] = {
 		{0x907001D4, 0, 1}, {0x907001D4, 1, 1},
 		{0x907001D4, 2, 1}, {0x907001D4, 3, 1},
 		{0x907001D4, 4, 1}, {0x907001D4, 5, 1},
 		{0x907001D4, 6, 1}, {0x907001D4, 7, 1} };
-	struct MXL_REG_FIELD_T xpt_nco_clock_rate[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_nco_clock_rate[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700044, 16, 80}, {0x90700044, 16, 81},
 		{0x90700044, 16, 82}, {0x90700044, 16, 83},
 		{0x90700044, 16, 84}, {0x90700044, 16, 85},
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/rtl2830.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/rtl2830.c
@@ -609,7 +609,7 @@
 		index, pid, onoff);
 
 	/* skip invalid PIDs (0x2000) */
-	if (pid > 0x1fff || index > 32)
+	if (pid > 0x1fff || index >= 32)
 		return 0;
 
 	if (onoff)
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/rtl2832.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/rtl2832.c
@@ -983,7 +983,7 @@
 		index, pid, onoff, dev->slave_ts);
 
 	/* skip invalid PIDs (0x2000) */
-	if (pid > 0x1fff || index > 32)
+	if (pid > 0x1fff || index >= 32)
 		return 0;
 
 	if (onoff)
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/stb0899_algo.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/stb0899_algo.c
@@ -269,7 +269,7 @@
 
 	short int derot_freq = 0, last_derot_freq = 0, derot_limit, next_loop = 3;
 	int index = 0;
-	u8 cfr[2];
+	u8 cfr[2] = {0};
 	u8 reg;
 
 	internal->status = NOCARRIER;
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/stv0367.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/stv0367.c
@@ -118,50 +118,32 @@
 	}
 };
 
-static
-int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
+static noinline_for_stack
+int stv0367_writereg(struct stv0367_state *state, u16 reg, u8 data)
 {
-	u8 buf[MAX_XFER_SIZE];
+	u8 buf[3] = { MSB(reg), LSB(reg), data };
 	struct i2c_msg msg = {
 		.addr = state->config->demod_address,
 		.flags = 0,
 		.buf = buf,
-		.len = len + 2
+		.len = 3,
 	};
 	int ret;
 
-	if (2 + len > sizeof(buf)) {
-		printk(KERN_WARNING
-		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
-		       KBUILD_MODNAME, reg, len);
-		return -EINVAL;
-	}
-
-
-	buf[0] = MSB(reg);
-	buf[1] = LSB(reg);
-	memcpy(buf + 2, data, len);
-
 	if (i2cdebug)
 		printk(KERN_DEBUG "%s: [%02x] %02x: %02x\n", __func__,
-			state->config->demod_address, reg, buf[2]);
+			state->config->demod_address, reg, data);
 
 	ret = i2c_transfer(state->i2c, &msg, 1);
 	if (ret != 1)
 		printk(KERN_ERR "%s: i2c write error! ([%02x] %02x: %02x)\n",
-			__func__, state->config->demod_address, reg, buf[2]);
+			__func__, state->config->demod_address, reg, data);
 
 	return (ret != 1) ? -EREMOTEIO : 0;
 }
 
-static int stv0367_writereg(struct stv0367_state *state, u16 reg, u8 data)
-{
-	u8 tmp = data; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */
-
-	return stv0367_writeregs(state, reg, &tmp, 1);
-}
-
-static u8 stv0367_readreg(struct stv0367_state *state, u16 reg)
+static noinline_for_stack
+u8 stv0367_readreg(struct stv0367_state *state, u16 reg)
 {
 	u8 b0[] = { 0, 0 };
 	u8 b1[] = { 0 };
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/tda10048.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/tda10048.c
@@ -410,6 +410,7 @@
 	struct tda10048_config *config = &state->config;
 	int i;
 	u32 if_freq_khz;
+	u64 sample_freq;
 
 	dprintk(1, "%s(bw = %d)\n", __func__, bw);
 
@@ -451,9 +452,11 @@
 	dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor);
 
 	/* Calculate the sample frequency */
-	state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45);
-	state->sample_freq /= (state->pll_nfactor + 1);
-	state->sample_freq /= (state->pll_pfactor + 4);
+	sample_freq = state->xtal_hz;
+	sample_freq *= state->pll_mfactor + 45;
+	do_div(sample_freq, state->pll_nfactor + 1);
+	do_div(sample_freq, state->pll_pfactor + 4);
+	state->sample_freq = sample_freq;
 	dprintk(1, "- sample_freq = %d\n", state->sample_freq);
 
 	/* Update the I/F */
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/tda18271c2dd.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/tda18271c2dd.c
@@ -328,7 +328,7 @@
 
 	OscFreq = (u64) freq * (u64) Div;
 	OscFreq *= (u64) 16384;
-	do_div(OscFreq, (u64)16000000);
+	do_div(OscFreq, 16000000);
 	MainDiv = OscFreq;
 
 	state->m_Regs[MPD] = PostDiv & 0x77;
@@ -352,7 +352,7 @@
 	OscFreq = (u64)freq * (u64)Div;
 	/* CalDiv = u32( OscFreq * 16384 / 16000000 ); */
 	OscFreq *= (u64)16384;
-	do_div(OscFreq, (u64)16000000);
+	do_div(OscFreq, 16000000);
 	CalDiv = OscFreq;
 
 	state->m_Regs[CPD] = PostDiv;
--- linux-qcom-6.8.0.orig/drivers/media/dvb-frontends/ts2020.c
+++ linux-qcom-6.8.0/drivers/media/dvb-frontends/ts2020.c
@@ -553,13 +553,19 @@
 static int ts2020_probe(struct i2c_client *client)
 {
 	struct ts2020_config *pdata = client->dev.platform_data;
-	struct dvb_frontend *fe = pdata->fe;
+	struct dvb_frontend *fe;
 	struct ts2020_priv *dev;
 	int ret;
 	u8 u8tmp;
 	unsigned int utmp;
 	char *chip_str;
 
+	if (!pdata) {
+		dev_err(&client->dev, "platform data is mandatory\n");
+		return -EINVAL;
+	}
+
+	fe = pdata->fe;
 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
 	if (!dev) {
 		ret = -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/media/i2c/Kconfig
+++ linux-qcom-6.8.0/drivers/media/i2c/Kconfig
@@ -675,6 +675,7 @@
 	tristate "THine THP7312 support"
 	depends on I2C
 	select FW_LOADER
+	select FW_UPLOAD
 	select MEDIA_CONTROLLER
 	select V4L2_CCI_I2C
 	select V4L2_FWNODE
--- linux-qcom-6.8.0.orig/drivers/media/i2c/adv7604.c
+++ linux-qcom-6.8.0/drivers/media/i2c/adv7604.c
@@ -1405,12 +1405,13 @@
 	if (v4l2_detect_cvt(stdi->lcf + 1, hfreq, stdi->lcvs, 0,
 			(stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
 			(stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
-			false, timings))
+			false, adv76xx_get_dv_timings_cap(sd, -1), timings))
 		return 0;
 	if (v4l2_detect_gtf(stdi->lcf + 1, hfreq, stdi->lcvs,
 			(stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
 			(stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
-			false, state->aspect_ratio, timings))
+			false, state->aspect_ratio,
+			adv76xx_get_dv_timings_cap(sd, -1), timings))
 		return 0;
 
 	v4l2_dbg(2, debug, sd,
@@ -2519,10 +2520,10 @@
 	const struct adv76xx_chip_info *info = state->info;
 	struct v4l2_dv_timings timings;
 	struct stdi_readback stdi;
-	u8 reg_io_0x02 = io_read(sd, 0x02);
+	int ret;
+	u8 reg_io_0x02;
 	u8 edid_enabled;
 	u8 cable_det;
-
 	static const char * const csc_coeff_sel_rb[16] = {
 		"bypassed", "YPbPr601 -> RGB", "reserved", "YPbPr709 -> RGB",
 		"reserved", "RGB -> YPbPr601", "reserved", "RGB -> YPbPr709",
@@ -2621,13 +2622,21 @@
 	v4l2_info(sd, "-----Color space-----\n");
 	v4l2_info(sd, "RGB quantization range ctrl: %s\n",
 			rgb_quantization_range_txt[state->rgb_quantization_range]);
-	v4l2_info(sd, "Input color space: %s\n",
-			input_color_space_txt[reg_io_0x02 >> 4]);
-	v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n",
-			(reg_io_0x02 & 0x02) ? "RGB" : "YCbCr",
-			(((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ?
-				"(16-235)" : "(0-255)",
-			(reg_io_0x02 & 0x08) ? "enabled" : "disabled");
+
+	ret = io_read(sd, 0x02);
+	if (ret < 0) {
+		v4l2_info(sd, "Can't read Input/Output color space\n");
+	} else {
+		reg_io_0x02 = ret;
+
+		v4l2_info(sd, "Input color space: %s\n",
+				input_color_space_txt[reg_io_0x02 >> 4]);
+		v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n",
+				(reg_io_0x02 & 0x02) ? "RGB" : "YCbCr",
+				(((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ?
+					"(16-235)" : "(0-255)",
+				(reg_io_0x02 & 0x08) ? "enabled" : "disabled");
+	}
 	v4l2_info(sd, "Color space conversion: %s\n",
 			csc_coeff_sel_rb[cp_read(sd, info->cp_csc) >> 4]);
 
--- linux-qcom-6.8.0.orig/drivers/media/i2c/adv7842.c
+++ linux-qcom-6.8.0/drivers/media/i2c/adv7842.c
@@ -1431,14 +1431,15 @@
 	}
 
 	if (v4l2_detect_cvt(stdi->lcf + 1, hfreq, stdi->lcvs, 0,
-			(stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
-			(stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
-			false, timings))
+			    (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
+			    (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
+			    false, adv7842_get_dv_timings_cap(sd), timings))
 		return 0;
 	if (v4l2_detect_gtf(stdi->lcf + 1, hfreq, stdi->lcvs,
-			(stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
-			(stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
-			false, state->aspect_ratio, timings))
+			    (stdi->hs_pol == '+' ? V4L2_DV_HSYNC_POS_POL : 0) |
+			    (stdi->vs_pol == '+' ? V4L2_DV_VSYNC_POS_POL : 0),
+			    false, state->aspect_ratio,
+			    adv7842_get_dv_timings_cap(sd), timings))
 		return 0;
 
 	v4l2_dbg(2, debug, sd,
--- linux-qcom-6.8.0.orig/drivers/media/i2c/alvium-csi2.c
+++ linux-qcom-6.8.0/drivers/media/i2c/alvium-csi2.c
@@ -2002,7 +2002,7 @@
 	int val;
 
 	switch (ctrl->id) {
-	case V4L2_CID_GAIN:
+	case V4L2_CID_ANALOGUE_GAIN:
 		val = alvium_get_gain(alvium);
 		if (val < 0)
 			return val;
@@ -2034,7 +2034,7 @@
 		return 0;
 
 	switch (ctrl->id) {
-	case V4L2_CID_GAIN:
+	case V4L2_CID_ANALOGUE_GAIN:
 		ret = alvium_set_ctrl_gain(alvium, ctrl->val);
 		break;
 	case V4L2_CID_AUTOGAIN:
@@ -2163,7 +2163,7 @@
 
 	if (alvium->avail_ft.gain) {
 		ctrls->gain = v4l2_ctrl_new_std(hdl, ops,
-						V4L2_CID_GAIN,
+						V4L2_CID_ANALOGUE_GAIN,
 						alvium->min_gain,
 						alvium->max_gain,
 						alvium->inc_gain,
--- linux-qcom-6.8.0.orig/drivers/media/i2c/ar0521.c
+++ linux-qcom-6.8.0/drivers/media/i2c/ar0521.c
@@ -255,10 +255,10 @@
 			continue; /* Minimum value */
 		if (new_mult > 254)
 			break; /* Maximum, larger pre won't work either */
-		if (sensor->extclk_freq * (u64)new_mult < AR0521_PLL_MIN *
+		if (sensor->extclk_freq * (u64)new_mult < (u64)AR0521_PLL_MIN *
 		    new_pre)
 			continue;
-		if (sensor->extclk_freq * (u64)new_mult > AR0521_PLL_MAX *
+		if (sensor->extclk_freq * (u64)new_mult > (u64)AR0521_PLL_MAX *
 		    new_pre)
 			break; /* Larger pre won't work either */
 		new_pll = div64_round_up(sensor->extclk_freq * (u64)new_mult,
@@ -844,7 +844,8 @@
 	clk_disable_unprepare(sensor->extclk);
 
 	if (sensor->reset_gpio)
-		gpiod_set_value(sensor->reset_gpio, 1); /* assert RESET signal */
+		/* assert RESET signal */
+		gpiod_set_value_cansleep(sensor->reset_gpio, 1);
 
 	for (i = ARRAY_SIZE(ar0521_supply_names) - 1; i >= 0; i--) {
 		if (sensor->supplies[i])
@@ -878,7 +879,7 @@
 
 	if (sensor->reset_gpio)
 		/* deassert RESET signal */
-		gpiod_set_value(sensor->reset_gpio, 0);
+		gpiod_set_value_cansleep(sensor->reset_gpio, 0);
 	usleep_range(4500, 5000); /* min 45000 clocks */
 
 	for (cnt = 0; cnt < ARRAY_SIZE(initial_regs); cnt++) {
--- linux-qcom-6.8.0.orig/drivers/media/i2c/ccs/ccs-core.c
+++ linux-qcom-6.8.0/drivers/media/i2c/ccs/ccs-core.c
@@ -674,7 +674,7 @@
 		break;
 	}
 
-	pm_status = pm_runtime_get_if_active(&client->dev, true);
+	pm_status = pm_runtime_get_if_active(&client->dev);
 	if (!pm_status)
 		return 0;
 
--- linux-qcom-6.8.0.orig/drivers/media/i2c/ds90ub960.c
+++ linux-qcom-6.8.0/drivers/media/i2c/ds90ub960.c
@@ -1286,7 +1286,7 @@
 
 	clk_delay += v & UB960_IR_RX_ANA_STROBE_SET_CLK_DELAY_MASK;
 
-	ub960_rxport_read(priv, nport, UB960_RR_SFILTER_STS_1, &v);
+	ret = ub960_rxport_read(priv, nport, UB960_RR_SFILTER_STS_1, &v);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/media/i2c/dw9768.c
+++ linux-qcom-6.8.0/drivers/media/i2c/dw9768.c
@@ -476,10 +476,9 @@
 	 * to be powered on in an ACPI system. Similarly for power off in
 	 * remove.
 	 */
-	pm_runtime_enable(dev);
 	full_power = (is_acpi_node(dev_fwnode(dev)) &&
 		      acpi_dev_state_d0(dev)) ||
-		     (is_of_node(dev_fwnode(dev)) && !pm_runtime_enabled(dev));
+		     (is_of_node(dev_fwnode(dev)) && !IS_ENABLED(CONFIG_PM));
 	if (full_power) {
 		ret = dw9768_runtime_resume(dev);
 		if (ret < 0) {
@@ -489,6 +488,7 @@
 		pm_runtime_set_active(dev);
 	}
 
+	pm_runtime_enable(dev);
 	ret = v4l2_async_register_subdev(&dw9768->sd);
 	if (ret < 0) {
 		dev_err(dev, "failed to register V4L2 subdev: %d", ret);
@@ -500,12 +500,12 @@
 	return 0;
 
 err_power_off:
+	pm_runtime_disable(dev);
 	if (full_power) {
 		dw9768_runtime_suspend(dev);
 		pm_runtime_set_suspended(dev);
 	}
 err_clean_entity:
-	pm_runtime_disable(dev);
 	media_entity_cleanup(&dw9768->sd.entity);
 err_free_handler:
 	v4l2_ctrl_handler_free(&dw9768->ctrls);
@@ -522,12 +522,12 @@
 	v4l2_async_unregister_subdev(&dw9768->sd);
 	v4l2_ctrl_handler_free(&dw9768->ctrls);
 	media_entity_cleanup(&dw9768->sd.entity);
+	pm_runtime_disable(dev);
 	if ((is_acpi_node(dev_fwnode(dev)) && acpi_dev_state_d0(dev)) ||
-	    (is_of_node(dev_fwnode(dev)) && !pm_runtime_enabled(dev))) {
+	    (is_of_node(dev_fwnode(dev)) && !IS_ENABLED(CONFIG_PM))) {
 		dw9768_runtime_suspend(dev);
 		pm_runtime_set_suspended(dev);
 	}
-	pm_runtime_disable(dev);
 }
 
 static const struct of_device_id dw9768_of_table[] = {
--- linux-qcom-6.8.0.orig/drivers/media/i2c/et8ek8/et8ek8_driver.c
+++ linux-qcom-6.8.0/drivers/media/i2c/et8ek8/et8ek8_driver.c
@@ -1475,7 +1475,7 @@
 	return ret;
 }
 
-static void __exit et8ek8_remove(struct i2c_client *client)
+static void et8ek8_remove(struct i2c_client *client)
 {
 	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
 	struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev);
@@ -1517,7 +1517,7 @@
 		.of_match_table	= et8ek8_of_table,
 	},
 	.probe		= et8ek8_probe,
-	.remove		= __exit_p(et8ek8_remove),
+	.remove		= et8ek8_remove,
 	.id_table	= et8ek8_id_table,
 };
 
--- linux-qcom-6.8.0.orig/drivers/media/i2c/hi846.c
+++ linux-qcom-6.8.0/drivers/media/i2c/hi846.c
@@ -1851,7 +1851,7 @@
 		mutex_lock(&hi846->mutex);
 		switch (sel->which) {
 		case V4L2_SUBDEV_FORMAT_TRY:
-			v4l2_subdev_state_get_crop(sd_state, sel->pad);
+			sel->r = *v4l2_subdev_state_get_crop(sd_state, sel->pad);
 			break;
 		case V4L2_SUBDEV_FORMAT_ACTIVE:
 			sel->r = hi846->cur_mode->crop;
--- linux-qcom-6.8.0.orig/drivers/media/i2c/imx219.c
+++ linux-qcom-6.8.0/drivers/media/i2c/imx219.c
@@ -162,8 +162,8 @@
 	{ IMX219_REG_MODE_SELECT, 0x00 },	/* Mode Select */
 
 	/* To Access Addresses 3000-5fff, send the following commands */
-	{ CCI_REG8(0x30eb), 0x0c },
 	{ CCI_REG8(0x30eb), 0x05 },
+	{ CCI_REG8(0x30eb), 0x0c },
 	{ CCI_REG8(0x300a), 0xff },
 	{ CCI_REG8(0x300b), 0xff },
 	{ CCI_REG8(0x30eb), 0x05 },
--- linux-qcom-6.8.0.orig/drivers/media/i2c/imx290.c
+++ linux-qcom-6.8.0/drivers/media/i2c/imx290.c
@@ -150,10 +150,10 @@
 
 #define IMX290_PIXEL_ARRAY_WIDTH			1945
 #define IMX290_PIXEL_ARRAY_HEIGHT			1097
-#define IMX920_PIXEL_ARRAY_MARGIN_LEFT			12
-#define IMX920_PIXEL_ARRAY_MARGIN_RIGHT			13
-#define IMX920_PIXEL_ARRAY_MARGIN_TOP			8
-#define IMX920_PIXEL_ARRAY_MARGIN_BOTTOM		9
+#define IMX290_PIXEL_ARRAY_MARGIN_LEFT			12
+#define IMX290_PIXEL_ARRAY_MARGIN_RIGHT			13
+#define IMX290_PIXEL_ARRAY_MARGIN_TOP			8
+#define IMX290_PIXEL_ARRAY_MARGIN_BOTTOM		9
 #define IMX290_PIXEL_ARRAY_RECORDING_WIDTH		1920
 #define IMX290_PIXEL_ARRAY_RECORDING_HEIGHT		1080
 
@@ -1161,10 +1161,10 @@
 		 * The sensor moves the readout by 1 pixel based on flips to
 		 * keep the Bayer order the same.
 		 */
-		sel->r.top = IMX920_PIXEL_ARRAY_MARGIN_TOP
+		sel->r.top = IMX290_PIXEL_ARRAY_MARGIN_TOP
 			   + (IMX290_PIXEL_ARRAY_RECORDING_HEIGHT - format->height) / 2
 			   + imx290->vflip->val;
-		sel->r.left = IMX920_PIXEL_ARRAY_MARGIN_LEFT
+		sel->r.left = IMX290_PIXEL_ARRAY_MARGIN_LEFT
 			    + (IMX290_PIXEL_ARRAY_RECORDING_WIDTH - format->width) / 2
 			    + imx290->hflip->val;
 		sel->r.width = format->width;
@@ -1183,8 +1183,8 @@
 		return 0;
 
 	case V4L2_SEL_TGT_CROP_DEFAULT:
-		sel->r.top = IMX920_PIXEL_ARRAY_MARGIN_TOP;
-		sel->r.left = IMX920_PIXEL_ARRAY_MARGIN_LEFT;
+		sel->r.top = IMX290_PIXEL_ARRAY_MARGIN_TOP;
+		sel->r.left = IMX290_PIXEL_ARRAY_MARGIN_LEFT;
 		sel->r.width = IMX290_PIXEL_ARRAY_RECORDING_WIDTH;
 		sel->r.height = IMX290_PIXEL_ARRAY_RECORDING_HEIGHT;
 
--- linux-qcom-6.8.0.orig/drivers/media/i2c/imx335.c
+++ linux-qcom-6.8.0/drivers/media/i2c/imx335.c
@@ -889,7 +889,7 @@
 
 	/* Request optional reset pin */
 	imx335->reset_gpio = devm_gpiod_get_optional(imx335->dev, "reset",
-						     GPIOD_OUT_LOW);
+						     GPIOD_OUT_HIGH);
 	if (IS_ERR(imx335->reset_gpio)) {
 		dev_err(imx335->dev, "failed to get reset gpio %ld\n",
 			PTR_ERR(imx335->reset_gpio));
@@ -1004,8 +1004,7 @@
 
 	usleep_range(500, 550); /* Tlow */
 
-	/* Set XCLR */
-	gpiod_set_value_cansleep(imx335->reset_gpio, 1);
+	gpiod_set_value_cansleep(imx335->reset_gpio, 0);
 
 	ret = clk_prepare_enable(imx335->inclk);
 	if (ret) {
@@ -1018,7 +1017,7 @@
 	return 0;
 
 error_reset:
-	gpiod_set_value_cansleep(imx335->reset_gpio, 0);
+	gpiod_set_value_cansleep(imx335->reset_gpio, 1);
 	regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies);
 
 	return ret;
@@ -1035,7 +1034,7 @@
 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
 	struct imx335 *imx335 = to_imx335(sd);
 
-	gpiod_set_value_cansleep(imx335->reset_gpio, 0);
+	gpiod_set_value_cansleep(imx335->reset_gpio, 1);
 	clk_disable_unprepare(imx335->inclk);
 	regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies);
 
--- linux-qcom-6.8.0.orig/drivers/media/i2c/imx412.c
+++ linux-qcom-6.8.0/drivers/media/i2c/imx412.c
@@ -542,14 +542,13 @@
  */
 static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain)
 {
-	u32 lpfr, shutter;
+	u32 lpfr;
 	int ret;
 
 	lpfr = imx412->vblank + imx412->cur_mode->height;
-	shutter = lpfr - exposure;
 
-	dev_dbg(imx412->dev, "Set exp %u, analog gain %u, shutter %u, lpfr %u",
-		exposure, gain, shutter, lpfr);
+	dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u",
+		exposure, gain, lpfr);
 
 	ret = imx412_write_reg(imx412, IMX412_REG_HOLD, 1, 1);
 	if (ret)
@@ -559,7 +558,7 @@
 	if (ret)
 		goto error_release_group_hold;
 
-	ret = imx412_write_reg(imx412, IMX412_REG_EXPOSURE_CIT, 2, shutter);
+	ret = imx412_write_reg(imx412, IMX412_REG_EXPOSURE_CIT, 2, exposure);
 	if (ret)
 		goto error_release_group_hold;
 
--- linux-qcom-6.8.0.orig/drivers/media/i2c/ov2680.c
+++ linux-qcom-6.8.0/drivers/media/i2c/ov2680.c
@@ -1116,25 +1116,24 @@
 	sensor->pixel_rate = sensor->link_freq[0] * 2;
 	do_div(sensor->pixel_rate, 10);
 
-	/* Verify bus cfg */
-	if (bus_cfg.bus.mipi_csi2.num_data_lanes != 1) {
-		ret = dev_err_probe(dev, -EINVAL,
-				    "only a 1-lane CSI2 config is supported");
-		goto out_free_bus_cfg;
+	if (!bus_cfg.nr_of_link_frequencies) {
+		dev_warn(dev, "Consider passing 'link-frequencies' in DT\n");
+		goto skip_link_freq_validation;
 	}
 
 	for (i = 0; i < bus_cfg.nr_of_link_frequencies; i++)
 		if (bus_cfg.link_frequencies[i] == sensor->link_freq[0])
 			break;
 
-	if (bus_cfg.nr_of_link_frequencies == 0 ||
-	    bus_cfg.nr_of_link_frequencies == i) {
+	if (bus_cfg.nr_of_link_frequencies == i) {
 		ret = dev_err_probe(dev, -EINVAL,
 				    "supported link freq %lld not found\n",
 				    sensor->link_freq[0]);
 		goto out_free_bus_cfg;
 	}
 
+skip_link_freq_validation:
+	ret = 0;
 out_free_bus_cfg:
 	v4l2_fwnode_endpoint_free(&bus_cfg);
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/media/i2c/ov2740.c
+++ linux-qcom-6.8.0/drivers/media/i2c/ov2740.c
@@ -768,14 +768,15 @@
 	cur_mode = ov2740->cur_mode;
 	size = ARRAY_SIZE(link_freq_menu_items);
 
-	ov2740->link_freq = v4l2_ctrl_new_int_menu(ctrl_hdlr, &ov2740_ctrl_ops,
-						   V4L2_CID_LINK_FREQ,
-						   size - 1, 0,
-						   link_freq_menu_items);
+	ov2740->link_freq =
+		v4l2_ctrl_new_int_menu(ctrl_hdlr, &ov2740_ctrl_ops,
+				       V4L2_CID_LINK_FREQ, size - 1,
+				       ov2740->supported_modes->link_freq_index,
+				       link_freq_menu_items);
 	if (ov2740->link_freq)
 		ov2740->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
 
-	pixel_rate = to_pixel_rate(OV2740_LINK_FREQ_360MHZ_INDEX);
+	pixel_rate = to_pixel_rate(ov2740->supported_modes->link_freq_index);
 	ov2740->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &ov2740_ctrl_ops,
 					       V4L2_CID_PIXEL_RATE, 0,
 					       pixel_rate, 1, pixel_rate);
--- linux-qcom-6.8.0.orig/drivers/media/i2c/ov5647.c
+++ linux-qcom-6.8.0/drivers/media/i2c/ov5647.c
@@ -1360,24 +1360,21 @@
 	struct v4l2_fwnode_endpoint bus_cfg = {
 		.bus_type = V4L2_MBUS_CSI2_DPHY,
 	};
-	struct device_node *ep;
+	struct device_node *ep __free(device_node) =
+		of_graph_get_endpoint_by_regs(np, 0, -1);
 	int ret;
 
-	ep = of_graph_get_next_endpoint(np, NULL);
 	if (!ep)
 		return -EINVAL;
 
 	ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep), &bus_cfg);
 	if (ret)
-		goto out;
+		return ret;
 
 	sensor->clock_ncont = bus_cfg.bus.mipi_csi2.flags &
 			      V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK;
 
-out:
-	of_node_put(ep);
-
-	return ret;
+	return 0;
 }
 
 static int ov5647_probe(struct i2c_client *client)
--- linux-qcom-6.8.0.orig/drivers/media/i2c/ov5675.c
+++ linux-qcom-6.8.0/drivers/media/i2c/ov5675.c
@@ -972,12 +972,10 @@
 
 static int ov5675_power_off(struct device *dev)
 {
-	/* 512 xvclk cycles after the last SCCB transation or MIPI frame end */
-	u32 delay_us = DIV_ROUND_UP(512, OV5675_XVCLK_19_2 / 1000 / 1000);
 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
 	struct ov5675 *ov5675 = to_ov5675(sd);
 
-	usleep_range(delay_us, delay_us * 2);
+	usleep_range(90, 100);
 
 	clk_disable_unprepare(ov5675->xvclk);
 	gpiod_set_value_cansleep(ov5675->reset_gpio, 1);
@@ -988,7 +986,6 @@
 
 static int ov5675_power_on(struct device *dev)
 {
-	u32 delay_us = DIV_ROUND_UP(8192, OV5675_XVCLK_19_2 / 1000 / 1000);
 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
 	struct ov5675 *ov5675 = to_ov5675(sd);
 	int ret;
@@ -1014,8 +1011,11 @@
 
 	gpiod_set_value_cansleep(ov5675->reset_gpio, 0);
 
-	/* 8192 xvclk cycles prior to the first SCCB transation */
-	usleep_range(delay_us, delay_us * 2);
+	/* Worst case quiesence gap is 1.365 milliseconds @ 6MHz XVCLK
+	 * Add an additional threshold grace period to ensure reset
+	 * completion before initiating our first I2C transaction.
+	 */
+	usleep_range(1500, 1600);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/media/i2c/ov64a40.c
+++ linux-qcom-6.8.0/drivers/media/i2c/ov64a40.c
@@ -3287,7 +3287,7 @@
 					 exp_max, 1, exp_val);
 	}
 
-	pm_status = pm_runtime_get_if_active(ov64a40->dev, true);
+	pm_status = pm_runtime_get_if_active(ov64a40->dev);
 	if (!pm_status)
 		return 0;
 
--- linux-qcom-6.8.0.orig/drivers/media/i2c/st-mipid02.c
+++ linux-qcom-6.8.0/drivers/media/i2c/st-mipid02.c
@@ -326,7 +326,7 @@
 	}
 
 	dev_dbg(&client->dev, "detect link_freq = %lld Hz", link_freq);
-	do_div(ui_4, link_freq);
+	ui_4 = div64_u64(ui_4, link_freq);
 	bridge->r.clk_lane_reg1 |= ui_4 << 2;
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/media/i2c/tc358743.c
+++ linux-qcom-6.8.0/drivers/media/i2c/tc358743.c
@@ -2091,9 +2091,6 @@
 	state->mbus_fmt_code = MEDIA_BUS_FMT_RGB888_1X24;
 
 	sd->dev = &client->dev;
-	err = v4l2_async_register_subdev(sd);
-	if (err < 0)
-		goto err_hdl;
 
 	mutex_init(&state->confctl_mutex);
 
@@ -2151,6 +2148,10 @@
 	if (err)
 		goto err_work_queues;
 
+	err = v4l2_async_register_subdev(sd);
+	if (err < 0)
+		goto err_work_queues;
+
 	v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
 		  client->addr << 1, client->adapter->name);
 
@@ -2158,8 +2159,10 @@
 
 err_work_queues:
 	cec_unregister_adapter(state->cec_adap);
-	if (!state->i2c_client->irq)
+	if (!state->i2c_client->irq) {
+		del_timer(&state->timer);
 		flush_work(&state->work_i2c_poll);
+	}
 	cancel_delayed_work(&state->delayed_work_enable_hotplug);
 	mutex_destroy(&state->confctl_mutex);
 err_hdl:
--- linux-qcom-6.8.0.orig/drivers/media/i2c/tc358746.c
+++ linux-qcom-6.8.0/drivers/media/i2c/tc358746.c
@@ -844,8 +844,7 @@
 			continue;
 
 		tmp = fout * p * postdiv;
-		do_div(tmp, fin);
-		mul = tmp;
+		mul = div64_ul(tmp, fin);
 		if (mul > 511)
 			continue;
 
--- linux-qcom-6.8.0.orig/drivers/media/i2c/thp7312.c
+++ linux-qcom-6.8.0/drivers/media/i2c/thp7312.c
@@ -1052,7 +1052,7 @@
 	if (ctrl->flags & V4L2_CTRL_FLAG_INACTIVE)
 		return -EINVAL;
 
-	if (!pm_runtime_get_if_active(thp7312->dev, true))
+	if (!pm_runtime_get_if_active(thp7312->dev))
 		return 0;
 
 	switch (ctrl->id) {
--- linux-qcom-6.8.0.orig/drivers/media/mc/mc-devnode.c
+++ linux-qcom-6.8.0/drivers/media/mc/mc-devnode.c
@@ -246,15 +246,14 @@
 	kobject_set_name(&devnode->cdev.kobj, "media%d", devnode->minor);
 
 	/* Part 3: Add the media and char device */
+	set_bit(MEDIA_FLAG_REGISTERED, &devnode->flags);
 	ret = cdev_device_add(&devnode->cdev, &devnode->dev);
 	if (ret < 0) {
+		clear_bit(MEDIA_FLAG_REGISTERED, &devnode->flags);
 		pr_err("%s: cdev_device_add failed\n", __func__);
 		goto cdev_add_error;
 	}
 
-	/* Part 4: Activate this minor. The char device can now be used. */
-	set_bit(MEDIA_FLAG_REGISTERED, &devnode->flags);
-
 	return 0;
 
 cdev_add_error:
--- linux-qcom-6.8.0.orig/drivers/media/mc/mc-entity.c
+++ linux-qcom-6.8.0/drivers/media/mc/mc-entity.c
@@ -535,14 +535,15 @@
 
 /*
  * Move the top entry link cursor to the next link. If all links of the entry
- * have been visited, pop the entry itself.
+ * have been visited, pop the entry itself. Return true if the entry has been
+ * popped.
  */
-static void media_pipeline_walk_pop(struct media_pipeline_walk *walk)
+static bool media_pipeline_walk_pop(struct media_pipeline_walk *walk)
 {
 	struct media_pipeline_walk_entry *entry;
 
 	if (WARN_ON(walk->stack.top < 0))
-		return;
+		return false;
 
 	entry = media_pipeline_walk_top(walk);
 
@@ -552,7 +553,7 @@
 			walk->stack.top);
 
 		walk->stack.top--;
-		return;
+		return true;
 	}
 
 	entry->links = entry->links->next;
@@ -560,6 +561,8 @@
 	dev_dbg(walk->mdev->dev,
 		"media pipeline: moved entry %u to next link\n",
 		walk->stack.top);
+
+	return false;
 }
 
 /* Free all memory allocated while walking the pipeline. */
@@ -605,30 +608,30 @@
 					    struct media_pipeline_walk *walk)
 {
 	struct media_pipeline_walk_entry *entry = media_pipeline_walk_top(walk);
-	struct media_pad *pad;
+	struct media_pad *origin;
 	struct media_link *link;
 	struct media_pad *local;
 	struct media_pad *remote;
+	bool last_link;
 	int ret;
 
-	pad = entry->pad;
+	origin = entry->pad;
 	link = list_entry(entry->links, typeof(*link), list);
-	media_pipeline_walk_pop(walk);
+	last_link = media_pipeline_walk_pop(walk);
+
+	if ((link->flags & MEDIA_LNK_FL_LINK_TYPE) != MEDIA_LNK_FL_DATA_LINK) {
+		dev_dbg(walk->mdev->dev,
+			"media pipeline: skipping link (not data-link)\n");
+		return 0;
+	}
 
 	dev_dbg(walk->mdev->dev,
 		"media pipeline: exploring link '%s':%u -> '%s':%u\n",
 		link->source->entity->name, link->source->index,
 		link->sink->entity->name, link->sink->index);
 
-	/* Skip links that are not enabled. */
-	if (!(link->flags & MEDIA_LNK_FL_ENABLED)) {
-		dev_dbg(walk->mdev->dev,
-			"media pipeline: skipping link (disabled)\n");
-		return 0;
-	}
-
 	/* Get the local pad and remote pad. */
-	if (link->source->entity == pad->entity) {
+	if (link->source->entity == origin->entity) {
 		local = link->source;
 		remote = link->sink;
 	} else {
@@ -640,25 +643,64 @@
 	 * Skip links that originate from a different pad than the incoming pad
 	 * that is not connected internally in the entity to the incoming pad.
 	 */
-	if (pad != local &&
-	    !media_entity_has_pad_interdep(pad->entity, pad->index, local->index)) {
+	if (origin != local &&
+	    !media_entity_has_pad_interdep(origin->entity, origin->index,
+					   local->index)) {
 		dev_dbg(walk->mdev->dev,
 			"media pipeline: skipping link (no route)\n");
-		return 0;
+		goto done;
 	}
 
 	/*
-	 * Add the local and remote pads of the link to the pipeline and push
-	 * them to the stack, if they're not already present.
+	 * Add the local pad of the link to the pipeline and push it to the
+	 * stack, if not already present.
 	 */
 	ret = media_pipeline_add_pad(pipe, walk, local);
 	if (ret)
 		return ret;
 
+	/* Similarly, add the remote pad, but only if the link is enabled. */
+	if (!(link->flags & MEDIA_LNK_FL_ENABLED)) {
+		dev_dbg(walk->mdev->dev,
+			"media pipeline: skipping link (disabled)\n");
+		goto done;
+	}
+
 	ret = media_pipeline_add_pad(pipe, walk, remote);
 	if (ret)
 		return ret;
 
+done:
+	/*
+	 * If we're done iterating over links, iterate over pads of the entity.
+	 * This is necessary to discover pads that are not connected with any
+	 * link. Those are dead ends from a pipeline exploration point of view,
+	 * but are still part of the pipeline and need to be added to enable
+	 * proper validation.
+	 */
+	if (!last_link)
+		return 0;
+
+	dev_dbg(walk->mdev->dev,
+		"media pipeline: adding unconnected pads of '%s'\n",
+		local->entity->name);
+
+	media_entity_for_each_pad(origin->entity, local) {
+		/*
+		 * Skip the origin pad (already handled), pad that have links
+		 * (already discovered through iterating over links) and pads
+		 * not internally connected.
+		 */
+		if (origin == local || !local->num_links ||
+		    !media_entity_has_pad_interdep(origin->entity, origin->index,
+						   local->index))
+			continue;
+
+		ret = media_pipeline_add_pad(pipe, walk, local);
+		if (ret)
+			return ret;
+	}
+
 	return 0;
 }
 
@@ -770,7 +812,6 @@
 		struct media_pad *pad = ppad->pad;
 		struct media_entity *entity = pad->entity;
 		bool has_enabled_link = false;
-		bool has_link = false;
 		struct media_link *link;
 
 		dev_dbg(mdev->dev, "Validating pad '%s':%u\n", pad->entity->name,
@@ -800,7 +841,6 @@
 			/* Record if the pad has links and enabled links. */
 			if (link->flags & MEDIA_LNK_FL_ENABLED)
 				has_enabled_link = true;
-			has_link = true;
 
 			/*
 			 * Validate the link if it's enabled and has the
@@ -838,7 +878,7 @@
 		 * 3. If the pad has the MEDIA_PAD_FL_MUST_CONNECT flag set,
 		 * ensure that it has either no link or an enabled link.
 		 */
-		if ((pad->flags & MEDIA_PAD_FL_MUST_CONNECT) && has_link &&
+		if ((pad->flags & MEDIA_PAD_FL_MUST_CONNECT) &&
 		    !has_enabled_link) {
 			dev_dbg(mdev->dev,
 				"Pad '%s':%u must be connected by an enabled link\n",
@@ -1038,6 +1078,9 @@
 
 	/* Remove the reverse links for a data link. */
 	if ((link->flags & MEDIA_LNK_FL_LINK_TYPE) == MEDIA_LNK_FL_DATA_LINK) {
+		link->source->num_links--;
+		link->sink->num_links--;
+
 		if (link->source->entity == entity)
 			remote = link->sink->entity;
 		else
@@ -1092,6 +1135,11 @@
 	struct media_link *link;
 	struct media_link *backlink;
 
+	if (flags & MEDIA_LNK_FL_LINK_TYPE)
+		return -EINVAL;
+
+	flags |= MEDIA_LNK_FL_DATA_LINK;
+
 	if (WARN_ON(!source || !sink) ||
 	    WARN_ON(source_pad >= source->num_pads) ||
 	    WARN_ON(sink_pad >= sink->num_pads))
@@ -1107,7 +1155,7 @@
 
 	link->source = &source->pads[source_pad];
 	link->sink = &sink->pads[sink_pad];
-	link->flags = flags & ~MEDIA_LNK_FL_INTERFACE_LINK;
+	link->flags = flags;
 
 	/* Initialize graph object embedded at the new link */
 	media_gobj_create(source->graph_obj.mdev, MEDIA_GRAPH_LINK,
@@ -1138,6 +1186,9 @@
 	sink->num_links++;
 	source->num_links++;
 
+	link->source->num_links++;
+	link->sink->num_links++;
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(media_create_pad_link);
--- linux-qcom-6.8.0.orig/drivers/media/pci/cx23885/cx23885-video.c
+++ linux-qcom-6.8.0/drivers/media/pci/cx23885/cx23885-video.c
@@ -1354,6 +1354,10 @@
 	/* register Video device */
 	dev->video_dev = cx23885_vdev_init(dev, dev->pci,
 		&cx23885_video_template, "video");
+	if (!dev->video_dev) {
+		err = -ENOMEM;
+		goto fail_unreg;
+	}
 	dev->video_dev->queue = &dev->vb2_vidq;
 	dev->video_dev->device_caps = V4L2_CAP_READWRITE | V4L2_CAP_STREAMING |
 				      V4L2_CAP_AUDIO | V4L2_CAP_VIDEO_CAPTURE;
@@ -1382,6 +1386,10 @@
 	/* register VBI device */
 	dev->vbi_dev = cx23885_vdev_init(dev, dev->pci,
 		&cx23885_vbi_template, "vbi");
+	if (!dev->vbi_dev) {
+		err = -ENOMEM;
+		goto fail_unreg;
+	}
 	dev->vbi_dev->queue = &dev->vb2_vbiq;
 	dev->vbi_dev->device_caps = V4L2_CAP_READWRITE | V4L2_CAP_STREAMING |
 				    V4L2_CAP_AUDIO | V4L2_CAP_VBI_CAPTURE;
--- linux-qcom-6.8.0.orig/drivers/media/pci/intel/ipu-bridge.c
+++ linux-qcom-6.8.0/drivers/media/pci/intel/ipu-bridge.c
@@ -14,6 +14,8 @@
 #include <media/ipu-bridge.h>
 #include <media/v4l2-fwnode.h>
 
+#define ADEV_DEV(adev) ACPI_PTR(&((adev)->dev))
+
 /*
  * 92335fcf-3203-4472-af93-7b4453ac29da
  *
@@ -58,8 +60,27 @@
 	IPU_SENSOR_CONFIG("INT3537", 1, 437000000),
 	/* Omnivision ov13b10 */
 	IPU_SENSOR_CONFIG("OVTIDB10", 1, 560000000),
+	IPU_SENSOR_CONFIG("OVTI13B1", 1, 560000000),
 	/* GalaxyCore GC0310 */
 	IPU_SENSOR_CONFIG("INT0310", 0),
+	/* Omnivision ov01a10 */
+	IPU_SENSOR_CONFIG("OVTI01A0", 1, 400000000),
+	/* Omnivision ov08x40 */
+	IPU_SENSOR_CONFIG("OVTI08F4", 1, 400000000),
+	/* Himax hm11b1 */
+	IPU_SENSOR_CONFIG("HIMX11B1", 1, 384000000),
+	/* Himax hm2170 */
+	IPU_SENSOR_CONFIG("HIMX2170", 1, 384000000),
+	/* Himax hm2172 */
+	IPU_SENSOR_CONFIG("HIMX2172", 1, 384000000),
+	/* Omnivision ov01a1s */
+	IPU_SENSOR_CONFIG("OVTI01AS", 1, 400000000),
+	/* Omnivision ov02c10 */
+	IPU_SENSOR_CONFIG("OVTI02C1", 1, 400000000),
+	/* Omnivision ov02e10 */
+	IPU_SENSOR_CONFIG("OVTI02E1", 1, 360000000),
+	/* Omnivision ov08a10 */
+	IPU_SENSOR_CONFIG("OVTI08A1", 1, 500000000),
 };
 
 static const struct ipu_property_names prop_names = {
@@ -84,6 +105,7 @@
 	"lc898212axb",
 };
 
+#if IS_ENABLED(CONFIG_ACPI)
 /*
  * Used to figure out IVSC acpi device by ipu_bridge_get_ivsc_acpi_dev()
  * instead of device and driver match to probe IVSC device.
@@ -97,13 +119,13 @@
 
 static struct acpi_device *ipu_bridge_get_ivsc_acpi_dev(struct acpi_device *adev)
 {
-	acpi_handle handle = acpi_device_handle(adev);
-	struct acpi_device *consumer, *ivsc_adev;
 	unsigned int i;
 
 	for (i = 0; i < ARRAY_SIZE(ivsc_acpi_ids); i++) {
 		const struct acpi_device_id *acpi_id = &ivsc_acpi_ids[i];
+		struct acpi_device *consumer, *ivsc_adev;
 
+		acpi_handle handle = acpi_device_handle(adev);
 		for_each_acpi_dev_match(ivsc_adev, acpi_id->id, NULL, -1)
 			/* camera sensor depends on IVSC in DSDT if exist */
 			for_each_acpi_consumer_dev(ivsc_adev, consumer)
@@ -115,6 +137,12 @@
 
 	return NULL;
 }
+#else
+static struct acpi_device *ipu_bridge_get_ivsc_acpi_dev(struct acpi_device *adev)
+{
+	return NULL;
+}
+#endif
 
 static int ipu_bridge_match_ivsc_dev(struct device *dev, const void *adev)
 {
@@ -160,7 +188,7 @@
 		csi_dev = ipu_bridge_get_ivsc_csi_dev(adev);
 		if (!csi_dev) {
 			acpi_dev_put(adev);
-			dev_err(&adev->dev, "Failed to find MEI CSI dev\n");
+			dev_err(ADEV_DEV(adev), "Failed to find MEI CSI dev\n");
 			return -ENODEV;
 		}
 
@@ -179,24 +207,25 @@
 	acpi_status status;
 	int ret = 0;
 
-	status = acpi_evaluate_object(adev->handle, id, NULL, &buffer);
+	status = acpi_evaluate_object(ACPI_PTR(adev->handle),
+				      id, NULL, &buffer);
 	if (ACPI_FAILURE(status))
 		return -ENODEV;
 
 	obj = buffer.pointer;
 	if (!obj) {
-		dev_err(&adev->dev, "Couldn't locate ACPI buffer\n");
+		dev_err(ADEV_DEV(adev), "Couldn't locate ACPI buffer\n");
 		return -ENODEV;
 	}
 
 	if (obj->type != ACPI_TYPE_BUFFER) {
-		dev_err(&adev->dev, "Not an ACPI buffer\n");
+		dev_err(ADEV_DEV(adev), "Not an ACPI buffer\n");
 		ret = -ENODEV;
 		goto out_free_buff;
 	}
 
 	if (obj->buffer.length > size) {
-		dev_err(&adev->dev, "Given buffer is too small\n");
+		dev_err(ADEV_DEV(adev), "Given buffer is too small\n");
 		ret = -EINVAL;
 		goto out_free_buff;
 	}
@@ -217,7 +246,7 @@
 	case IPU_SENSOR_ROTATION_INVERTED:
 		return 180;
 	default:
-		dev_warn(&adev->dev,
+		dev_warn(ADEV_DEV(adev),
 			 "Unknown rotation %d. Assume 0 degree rotation\n",
 			 ssdb->degree);
 		return 0;
@@ -227,12 +256,14 @@
 static enum v4l2_fwnode_orientation ipu_bridge_parse_orientation(struct acpi_device *adev)
 {
 	enum v4l2_fwnode_orientation orientation;
-	struct acpi_pld_info *pld;
-	acpi_status status;
+	struct acpi_pld_info *pld = NULL;
+	acpi_status status = AE_ERROR;
 
+#if IS_ENABLED(CONFIG_ACPI)
 	status = acpi_get_physical_device_location(adev->handle, &pld);
+#endif
 	if (ACPI_FAILURE(status)) {
-		dev_warn(&adev->dev, "_PLD call failed, using default orientation\n");
+		dev_warn(ADEV_DEV(adev), "_PLD call failed, using default orientation\n");
 		return V4L2_FWNODE_ORIENTATION_EXTERNAL;
 	}
 
@@ -250,7 +281,8 @@
 		orientation = V4L2_FWNODE_ORIENTATION_EXTERNAL;
 		break;
 	default:
-		dev_warn(&adev->dev, "Unknown _PLD panel val %d\n", pld->panel);
+		dev_warn(ADEV_DEV(adev), "Unknown _PLD panel val %d\n",
+			 pld->panel);
 		orientation = V4L2_FWNODE_ORIENTATION_EXTERNAL;
 		break;
 	}
@@ -269,12 +301,12 @@
 		return ret;
 
 	if (ssdb.vcmtype > ARRAY_SIZE(ipu_vcm_types)) {
-		dev_warn(&adev->dev, "Unknown VCM type %d\n", ssdb.vcmtype);
+		dev_warn(ADEV_DEV(adev), "Unknown VCM type %d\n", ssdb.vcmtype);
 		ssdb.vcmtype = 0;
 	}
 
 	if (ssdb.lanes > IPU_MAX_LANES) {
-		dev_err(&adev->dev, "Number of lanes in SSDB is invalid\n");
+		dev_err(ADEV_DEV(adev), "Number of lanes in SSDB is invalid\n");
 		return -EINVAL;
 	}
 
@@ -462,8 +494,14 @@
 						sensor->ipu_properties);
 
 	if (sensor->csi_dev) {
+		const char *device_hid = "";
+
+#if IS_ENABLED(CONFIG_ACPI)
+		device_hid = acpi_device_hid(sensor->ivsc_adev);
+#endif
+
 		snprintf(sensor->ivsc_name, sizeof(sensor->ivsc_name), "%s-%u",
-			 acpi_device_hid(sensor->ivsc_adev), sensor->link);
+			 device_hid, sensor->link);
 
 		nodes[SWNODE_IVSC_HID] = NODE_SENSOR(sensor->ivsc_name,
 						     sensor->ivsc_properties);
@@ -628,11 +666,15 @@
 {
 	struct fwnode_handle *fwnode, *primary;
 	struct ipu_sensor *sensor;
-	struct acpi_device *adev;
+	struct acpi_device *adev = NULL;
 	int ret;
 
+#if IS_ENABLED(CONFIG_ACPI)
 	for_each_acpi_dev_match(adev, cfg->hid, NULL, -1) {
-		if (!adev->status.enabled)
+#else
+	while (true) {
+#endif
+		if (!ACPI_PTR(adev->status.enabled))
 			continue;
 
 		if (bridge->n_sensors >= IPU_MAX_PORTS) {
@@ -668,7 +710,7 @@
 			goto err_free_swnodes;
 		}
 
-		sensor->adev = acpi_dev_get(adev);
+		sensor->adev = ACPI_PTR(acpi_dev_get(adev));
 
 		primary = acpi_fwnode_handle(adev);
 		primary->secondary = fwnode;
@@ -724,11 +766,16 @@
 	unsigned int i;
 
 	for (i = 0; i < ARRAY_SIZE(ipu_supported_sensors); i++) {
+#if IS_ENABLED(CONFIG_ACPI)
 		const struct ipu_sensor_config *cfg =
 			&ipu_supported_sensors[i];
 
 		for_each_acpi_dev_match(sensor_adev, cfg->hid, NULL, -1) {
-			if (!sensor_adev->status.enabled)
+#else
+		while (true) {
+			sensor_adev = NULL;
+#endif
+			if (!ACPI_PTR(sensor_adev->status.enabled))
 				continue;
 
 			adev = ipu_bridge_get_ivsc_acpi_dev(sensor_adev);
--- linux-qcom-6.8.0.orig/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ linux-qcom-6.8.0/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1789,11 +1789,6 @@
 
 	v4l2_async_nf_init(&cio2->notifier, &cio2->v4l2_dev);
 
-	/* Register notifier for subdevices we care */
-	r = cio2_parse_firmware(cio2);
-	if (r)
-		goto fail_clean_notifier;
-
 	r = devm_request_irq(dev, pci_dev->irq, cio2_irq, IRQF_SHARED,
 			     CIO2_NAME, cio2);
 	if (r) {
@@ -1801,6 +1796,11 @@
 		goto fail_clean_notifier;
 	}
 
+	/* Register notifier for subdevices we care */
+	r = cio2_parse_firmware(cio2);
+	if (r)
+		goto fail_clean_notifier;
+
 	pm_runtime_put_noidle(dev);
 	pm_runtime_allow(dev);
 
--- linux-qcom-6.8.0.orig/drivers/media/pci/intel/ivsc/mei_csi.c
+++ linux-qcom-6.8.0/drivers/media/pci/intel/ivsc/mei_csi.c
@@ -71,8 +71,8 @@
 };
 
 enum csi_pads {
-	CSI_PAD_SOURCE,
 	CSI_PAD_SINK,
+	CSI_PAD_SOURCE,
 	CSI_NUM_PADS
 };
 
@@ -123,6 +123,8 @@
 	struct v4l2_ctrl_handler ctrl_handler;
 	struct v4l2_ctrl *freq_ctrl;
 	struct v4l2_ctrl *privacy_ctrl;
+	/* lock for v4l2 controls */
+	struct mutex ctrl_lock;
 	unsigned int remote_pad;
 	/* start streaming or not */
 	int streaming;
@@ -134,9 +136,6 @@
 	u32 nr_of_lanes;
 	/* frequency of the CSI-2 link */
 	u64 link_freq;
-
-	/* privacy status */
-	enum ivsc_privacy_status status;
 };
 
 static const struct v4l2_mbus_framefmt mei_csi_format_mbus_default = {
@@ -188,7 +187,11 @@
 
 	/* command response status */
 	ret = csi->cmd_response.status;
-	if (ret) {
+	if (ret == -1) {
+		/* notify privacy on instead of reporting error */
+		ret = 0;
+		v4l2_ctrl_s_ctrl(csi->privacy_ctrl, 1);
+	} else if (ret) {
 		ret = -EINVAL;
 		goto out;
 	}
@@ -263,10 +266,9 @@
 
 	switch (notif.cmd_id) {
 	case CSI_PRIVACY_NOTIF:
-		if (notif.cont.cont < CSI_PRIVACY_MAX) {
-			csi->status = notif.cont.cont;
-			v4l2_ctrl_s_ctrl(csi->privacy_ctrl, csi->status);
-		}
+		if (notif.cont.cont < CSI_PRIVACY_MAX)
+			v4l2_ctrl_s_ctrl(csi->privacy_ctrl,
+					 notif.cont.cont == CSI_PRIVACY_ON);
 		break;
 	case CSI_SET_OWNER:
 	case CSI_SET_CONF:
@@ -587,7 +589,7 @@
 	csi->remote_pad = pad;
 
 	return media_create_pad_link(&subdev->entity, pad,
-				     &csi->subdev.entity, 1,
+				     &csi->subdev.entity, CSI_PAD_SINK,
 				     MEDIA_LNK_FL_ENABLED |
 				     MEDIA_LNK_FL_IMMUTABLE);
 }
@@ -611,11 +613,13 @@
 	u32 max;
 	int ret;
 
+	mutex_init(&csi->ctrl_lock);
+
 	ret = v4l2_ctrl_handler_init(&csi->ctrl_handler, 2);
 	if (ret)
 		return ret;
 
-	csi->ctrl_handler.lock = &csi->lock;
+	csi->ctrl_handler.lock = &csi->ctrl_lock;
 
 	max = ARRAY_SIZE(link_freq_menu_items) - 1;
 	csi->freq_ctrl = v4l2_ctrl_new_int_menu(&csi->ctrl_handler,
@@ -794,6 +798,7 @@
 
 err_ctrl_handler:
 	v4l2_ctrl_handler_free(&csi->ctrl_handler);
+	mutex_destroy(&csi->ctrl_lock);
 	v4l2_async_nf_unregister(&csi->notifier);
 	v4l2_async_nf_cleanup(&csi->notifier);
 
@@ -813,6 +818,7 @@
 	v4l2_async_nf_unregister(&csi->notifier);
 	v4l2_async_nf_cleanup(&csi->notifier);
 	v4l2_ctrl_handler_free(&csi->ctrl_handler);
+	mutex_destroy(&csi->ctrl_lock);
 	v4l2_async_unregister_subdev(&csi->subdev);
 	v4l2_subdev_cleanup(&csi->subdev);
 	media_entity_cleanup(&csi->subdev.entity);
--- linux-qcom-6.8.0.orig/drivers/media/pci/ivtv/ivtv-udma.c
+++ linux-qcom-6.8.0/drivers/media/pci/ivtv/ivtv-udma.c
@@ -131,6 +131,8 @@
 
 	/* Fill SG List with new values */
 	if (ivtv_udma_fill_sg_list(dma, &user_dma, 0) < 0) {
+		IVTV_DEBUG_WARN("%s: could not allocate bounce buffers for highmem userspace buffers\n",
+				__func__);
 		unpin_user_pages(dma->map, dma->page_count);
 		dma->page_count = 0;
 		return -ENOMEM;
@@ -139,6 +141,12 @@
 	/* Map SG List */
 	dma->SG_length = dma_map_sg(&itv->pdev->dev, dma->SGlist,
 				    dma->page_count, DMA_TO_DEVICE);
+	if (!dma->SG_length) {
+		IVTV_DEBUG_WARN("%s: DMA map error, SG_length is 0\n", __func__);
+		unpin_user_pages(dma->map, dma->page_count);
+		dma->page_count = 0;
+		return -EINVAL;
+	}
 
 	/* Fill SG Array with new values */
 	ivtv_udma_fill_sg_array (dma, ivtv_dest_addr, 0, -1);
--- linux-qcom-6.8.0.orig/drivers/media/pci/ivtv/ivtv-yuv.c
+++ linux-qcom-6.8.0/drivers/media/pci/ivtv/ivtv-yuv.c
@@ -114,6 +114,12 @@
 	}
 	dma->SG_length = dma_map_sg(&itv->pdev->dev, dma->SGlist,
 				    dma->page_count, DMA_TO_DEVICE);
+	if (!dma->SG_length) {
+		IVTV_DEBUG_WARN("%s: DMA map error, SG_length is 0\n", __func__);
+		unpin_user_pages(dma->map, dma->page_count);
+		dma->page_count = 0;
+		return -EINVAL;
+	}
 
 	/* Fill SG Array with new values */
 	ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size);
--- linux-qcom-6.8.0.orig/drivers/media/pci/ivtv/ivtvfb.c
+++ linux-qcom-6.8.0/drivers/media/pci/ivtv/ivtvfb.c
@@ -281,10 +281,10 @@
 	/* Map User DMA */
 	if (ivtv_udma_setup(itv, ivtv_dest_addr, userbuf, size_in_bytes) <= 0) {
 		mutex_unlock(&itv->udma.lock);
-		IVTVFB_WARN("ivtvfb_prep_dec_dma_to_device, Error with pin_user_pages: %d bytes, %d pages returned\n",
-			       size_in_bytes, itv->udma.page_count);
+		IVTVFB_WARN("%s, Error in ivtv_udma_setup: %d bytes, %d pages returned\n",
+			       __func__, size_in_bytes, itv->udma.page_count);
 
-		/* pin_user_pages must have failed completely */
+		/* pin_user_pages or DMA must have failed completely */
 		return -EIO;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/media/pci/mgb4/mgb4_cmt.c
+++ linux-qcom-6.8.0/drivers/media/pci/mgb4/mgb4_cmt.c
@@ -12,6 +12,7 @@
 
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/nospec.h>
 #include "mgb4_core.h"
 #include "mgb4_cmt.h"
 
@@ -227,6 +228,8 @@
 	u32 config;
 	size_t i;
 
+	freq_range = array_index_nospec(freq_range, ARRAY_SIZE(cmt_vals_in));
+
 	addr = cmt_addrs_in[vindev->config->id];
 	reg_set = cmt_vals_in[freq_range];
 
--- linux-qcom-6.8.0.orig/drivers/media/pci/mgb4/mgb4_core.c
+++ linux-qcom-6.8.0/drivers/media/pci/mgb4/mgb4_core.c
@@ -642,9 +642,6 @@
 	struct mgb4_dev *mgbdev = pci_get_drvdata(pdev);
 	int i;
 
-#ifdef CONFIG_DEBUG_FS
-	debugfs_remove_recursive(mgbdev->debugfs);
-#endif
 #if IS_REACHABLE(CONFIG_HWMON)
 	hwmon_device_unregister(mgbdev->hwmon_dev);
 #endif
@@ -659,6 +656,10 @@
 		if (mgbdev->vin[i])
 			mgb4_vin_free(mgbdev->vin[i]);
 
+#ifdef CONFIG_DEBUG_FS
+	debugfs_remove_recursive(mgbdev->debugfs);
+#endif
+
 	device_remove_groups(&mgbdev->pdev->dev, mgb4_pci_groups);
 	free_spi(mgbdev);
 	free_i2c(mgbdev);
--- linux-qcom-6.8.0.orig/drivers/media/pci/ngene/ngene-core.c
+++ linux-qcom-6.8.0/drivers/media/pci/ngene/ngene-core.c
@@ -1488,7 +1488,9 @@
 	}
 
 	if (dev->ci.en && (io & NGENE_IO_TSOUT)) {
-		dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1);
+		ret = dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1);
+		if (ret != 0)
+			goto err;
 		set_transfer(chan, 1);
 		chan->dev->channel[2].DataFormatFlags = DF_SWAP32;
 		set_transfer(&chan->dev->channel[2], 1);
--- linux-qcom-6.8.0.orig/drivers/media/pci/saa7134/saa7134-dvb.c
+++ linux-qcom-6.8.0/drivers/media/pci/saa7134/saa7134-dvb.c
@@ -466,7 +466,9 @@
 	/* switch the board to analog mode */
 	if (fe->ops.i2c_gate_ctrl)
 		fe->ops.i2c_gate_ctrl(fe, 1);
-	i2c_transfer(&dev->i2c_adap, &analog_msg, 1);
+	if (i2c_transfer(&dev->i2c_adap, &analog_msg, 1) != 1)
+		return -EIO;
+
 	return 0;
 }
 
@@ -1018,7 +1020,9 @@
 	else
 		wbuf[1] = rbuf & 0xef;
 	msg[0].len = 2;
-	i2c_transfer(&dev->i2c_adap, msg, 1);
+	if (i2c_transfer(&dev->i2c_adap, msg, 1) != 1)
+		return -EIO;
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/media/pci/sta2x11/sta2x11_vip.c
+++ linux-qcom-6.8.0/drivers/media/pci/sta2x11/sta2x11_vip.c
@@ -757,7 +757,7 @@
 /**
  * vip_irq - interrupt routine
  * @irq: Number of interrupt ( not used, correct number is assumed )
- * @vip: local data structure containing all information
+ * @data: local data structure containing all information
  *
  * check for both frame interrupts set ( top and bottom ).
  * check FIFO overflow, but limit number of log messages after open.
@@ -767,8 +767,9 @@
  *
  * IRQ_HANDLED, interrupt done.
  */
-static irqreturn_t vip_irq(int irq, struct sta2x11_vip *vip)
+static irqreturn_t vip_irq(int irq, void *data)
 {
+	struct sta2x11_vip *vip = data;
 	unsigned int status;
 
 	status = reg_read(vip, DVP_ITS);
@@ -1053,9 +1054,7 @@
 
 	spin_lock_init(&vip->slock);
 
-	ret = request_irq(pdev->irq,
-			  (irq_handler_t) vip_irq,
-			  IRQF_SHARED, KBUILD_MODNAME, vip);
+	ret = request_irq(pdev->irq, vip_irq, IRQF_SHARED, KBUILD_MODNAME, vip);
 	if (ret) {
 		dev_err(&pdev->dev, "request_irq failed\n");
 		ret = -ENODEV;
--- linux-qcom-6.8.0.orig/drivers/media/pci/ttpci/budget-av.c
+++ linux-qcom-6.8.0/drivers/media/pci/ttpci/budget-av.c
@@ -1463,7 +1463,8 @@
 		budget_av->has_saa7113 = 1;
 		err = saa7146_vv_init(dev, &vv_data);
 		if (err != 0) {
-			/* fixme: proper cleanup here */
+			ttpci_budget_deinit(&budget_av->budget);
+			kfree(budget_av);
 			ERR("cannot init vv subsystem\n");
 			return err;
 		}
@@ -1472,9 +1473,10 @@
 		vv_data.vid_ops.vidioc_s_input = vidioc_s_input;
 
 		if ((err = saa7146_register_device(&budget_av->vd, dev, "knc1", VFL_TYPE_VIDEO))) {
-			/* fixme: proper cleanup here */
-			ERR("cannot register capture v4l2 device\n");
 			saa7146_vv_release(dev);
+			ttpci_budget_deinit(&budget_av->budget);
+			kfree(budget_av);
+			ERR("cannot register capture v4l2 device\n");
 			return err;
 		}
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/allegro-dvt/allegro-core.c
+++ linux-qcom-6.8.0/drivers/media/platform/allegro-dvt/allegro-core.c
@@ -1509,8 +1509,10 @@
 		INIT_LIST_HEAD(&buffer->head);
 
 		err = allegro_alloc_buffer(dev, buffer, size);
-		if (err)
+		if (err) {
+			kfree(buffer);
 			goto err;
+		}
 		list_add(&buffer->head, list);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/amphion/vdec.c
+++ linux-qcom-6.8.0/drivers/media/platform/amphion/vdec.c
@@ -195,7 +195,6 @@
 	struct vdec_t *vdec = inst->priv;
 	int ret = 0;
 
-	vpu_inst_lock(inst);
 	switch (ctrl->id) {
 	case V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE:
 		vdec->params.display_delay_enable = ctrl->val;
@@ -207,7 +206,6 @@
 		ret = -EINVAL;
 		break;
 	}
-	vpu_inst_unlock(inst);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/amphion/venc.c
+++ linux-qcom-6.8.0/drivers/media/platform/amphion/venc.c
@@ -518,7 +518,6 @@
 	struct venc_t *venc = inst->priv;
 	int ret = 0;
 
-	vpu_inst_lock(inst);
 	switch (ctrl->id) {
 	case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
 		venc->params.profile = ctrl->val;
@@ -579,7 +578,6 @@
 		ret = -EINVAL;
 		break;
 	}
-	vpu_inst_unlock(inst);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/amphion/vpu_drv.c
+++ linux-qcom-6.8.0/drivers/media/platform/amphion/vpu_drv.c
@@ -151,8 +151,8 @@
 	media_device_cleanup(&vpu->mdev);
 	v4l2_device_unregister(&vpu->v4l2_dev);
 err_vpu_deinit:
-	pm_runtime_set_suspended(dev);
 	pm_runtime_disable(dev);
+	pm_runtime_set_suspended(dev);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/amphion/vpu_v4l2.c
+++ linux-qcom-6.8.0/drivers/media/platform/amphion/vpu_v4l2.c
@@ -825,6 +825,7 @@
 		vfd->fops = vdec_get_fops();
 		vfd->ioctl_ops = vdec_get_ioctl_ops();
 	}
+	video_set_drvdata(vfd, vpu);
 
 	ret = video_register_device(vfd, VFL_TYPE_VIDEO, -1);
 	if (ret) {
@@ -832,7 +833,6 @@
 		v4l2_m2m_release(func->m2m_dev);
 		return ret;
 	}
-	video_set_drvdata(vfd, vpu);
 	func->vfd = vfd;
 
 	ret = v4l2_m2m_register_media_controller(func->m2m_dev, func->vfd, func->function);
--- linux-qcom-6.8.0.orig/drivers/media/platform/cadence/cdns-csi2rx.c
+++ linux-qcom-6.8.0/drivers/media/platform/cadence/cdns-csi2rx.c
@@ -235,10 +235,6 @@
 
 	writel(reg, csi2rx->base + CSI2RX_STATIC_CFG_REG);
 
-	ret = v4l2_subdev_call(csi2rx->source_subdev, video, s_stream, true);
-	if (ret)
-		goto err_disable_pclk;
-
 	/* Enable DPHY clk and data lanes. */
 	if (csi2rx->dphy) {
 		reg = CSI2RX_DPHY_CL_EN | CSI2RX_DPHY_CL_RST;
@@ -248,6 +244,13 @@
 		}
 
 		writel(reg, csi2rx->base + CSI2RX_DPHY_LANE_CTRL_REG);
+
+		ret = csi2rx_configure_ext_dphy(csi2rx);
+		if (ret) {
+			dev_err(csi2rx->dev,
+				"Failed to configure external DPHY: %d\n", ret);
+			goto err_disable_pclk;
+		}
 	}
 
 	/*
@@ -287,14 +290,9 @@
 
 	reset_control_deassert(csi2rx->sys_rst);
 
-	if (csi2rx->dphy) {
-		ret = csi2rx_configure_ext_dphy(csi2rx);
-		if (ret) {
-			dev_err(csi2rx->dev,
-				"Failed to configure external DPHY: %d\n", ret);
-			goto err_disable_sysclk;
-		}
-	}
+	ret = v4l2_subdev_call(csi2rx->source_subdev, video, s_stream, true);
+	if (ret)
+		goto err_disable_sysclk;
 
 	clk_disable_unprepare(csi2rx->p_clk);
 
@@ -308,6 +306,10 @@
 		clk_disable_unprepare(csi2rx->pixel_clk[i - 1]);
 	}
 
+	if (csi2rx->dphy) {
+		writel(0, csi2rx->base + CSI2RX_DPHY_LANE_CTRL_REG);
+		phy_power_off(csi2rx->dphy);
+	}
 err_disable_pclk:
 	clk_disable_unprepare(csi2rx->p_clk);
 
@@ -468,7 +470,7 @@
 	struct csi2rx_priv *csi2rx = v4l2_subdev_to_csi2rx(subdev);
 
 	csi2rx->source_pad = media_entity_get_fwnode_pad(&s_subdev->entity,
-							 s_subdev->fwnode,
+							 asd->match.fwnode,
 							 MEDIA_PAD_FL_SOURCE);
 	if (csi2rx->source_pad < 0) {
 		dev_err(csi2rx->dev, "Couldn't find output pad for subdev %s\n",
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1293,6 +1293,11 @@
 	return 0;
 }
 
+static void mtk_jpeg_destroy_workqueue(void *data)
+{
+	destroy_workqueue(data);
+}
+
 static int mtk_jpeg_probe(struct platform_device *pdev)
 {
 	struct mtk_jpeg_dev *jpeg;
@@ -1337,6 +1342,11 @@
 							  | WQ_FREEZABLE);
 		if (!jpeg->workqueue)
 			return -EINVAL;
+		ret = devm_add_action_or_reset(&pdev->dev,
+					       mtk_jpeg_destroy_workqueue,
+					       jpeg->workqueue);
+		if (ret)
+			return ret;
 	}
 
 	ret = v4l2_device_register(&pdev->dev, &jpeg->v4l2_dev);
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
@@ -578,11 +578,6 @@
 	return 0;
 }
 
-static void mtk_jpegdec_destroy_workqueue(void *data)
-{
-	destroy_workqueue(data);
-}
-
 static int mtk_jpegdec_hw_probe(struct platform_device *pdev)
 {
 	struct mtk_jpegdec_clk *jpegdec_clk;
@@ -606,12 +601,6 @@
 	dev->plat_dev = pdev;
 	dev->dev = &pdev->dev;
 
-	ret = devm_add_action_or_reset(&pdev->dev,
-				       mtk_jpegdec_destroy_workqueue,
-				       master_dev->workqueue);
-	if (ret)
-		return ret;
-
 	spin_lock_init(&dev->hw_lock);
 	dev->hw_state = MTK_JPEG_HW_IDLE;
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/mdp/mtk_mdp_vpu.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/mdp/mtk_mdp_vpu.c
@@ -26,7 +26,7 @@
 	vpu->inst_addr = msg->vpu_inst_addr;
 }
 
-static void mtk_mdp_vpu_ipi_handler(const void *data, unsigned int len,
+static void mtk_mdp_vpu_ipi_handler(void *data, unsigned int len,
 				    void *priv)
 {
 	const struct mdp_ipi_comm_ack *msg = data;
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
@@ -79,6 +79,8 @@
 	}
 
 	fw = devm_kzalloc(&plat_dev->dev, sizeof(*fw), GFP_KERNEL);
+	if (!fw)
+		return ERR_PTR(-ENOMEM);
 	fw->type = SCP;
 	fw->ops = &mtk_vcodec_rproc_msg;
 	fw->scp = scp;
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
@@ -29,15 +29,7 @@
 					   mtk_vcodec_ipi_handler handler,
 					   const char *name, void *priv)
 {
-	/*
-	 * The handler we receive takes a void * as its first argument. We
-	 * cannot change this because it needs to be passed down to the rproc
-	 * subsystem when SCP is used. VPU takes a const argument, which is
-	 * more constrained, so the conversion below is safe.
-	 */
-	ipi_handler_t handler_const = (ipi_handler_t)handler;
-
-	return vpu_ipi_register(fw->pdev, id, handler_const, name, priv);
+	return vpu_ipi_register(fw->pdev, id, handler, name, priv);
 }
 
 static int mtk_vcodec_vpu_ipi_send(struct mtk_vcodec_fw *fw, int id, void *buf,
@@ -58,12 +50,12 @@
 
 	dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
 
-	mutex_lock(&dev->dev_mutex);
+	mutex_lock(&dev->dev_ctx_lock);
 	list_for_each_entry(ctx, &dev->ctx_list, list) {
 		ctx->state = MTK_STATE_ABORT;
 		mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
 	}
-	mutex_unlock(&dev->dev_mutex);
+	mutex_unlock(&dev->dev_ctx_lock);
 }
 
 static void mtk_vcodec_vpu_reset_enc_handler(void *priv)
@@ -73,12 +65,12 @@
 
 	dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
 
-	mutex_lock(&dev->dev_mutex);
+	mutex_lock(&dev->dev_ctx_lock);
 	list_for_each_entry(ctx, &dev->ctx_list, list) {
 		ctx->state = MTK_STATE_ABORT;
 		mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
 	}
-	mutex_unlock(&dev->dev_mutex);
+	mutex_unlock(&dev->dev_ctx_lock);
 }
 
 static const struct mtk_vcodec_fw_ops mtk_vcodec_vpu_msg = {
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
@@ -268,7 +268,9 @@
 
 	ctx->dev->vdec_pdata->init_vdec_params(ctx);
 
+	mutex_lock(&dev->dev_ctx_lock);
 	list_add(&ctx->list, &dev->ctx_list);
+	mutex_unlock(&dev->dev_ctx_lock);
 	mtk_vcodec_dbgfs_create(ctx);
 
 	mutex_unlock(&dev->dev_mutex);
@@ -311,7 +313,9 @@
 	v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
 
 	mtk_vcodec_dbgfs_remove(dev, ctx->id);
+	mutex_lock(&dev->dev_ctx_lock);
 	list_del_init(&ctx->list);
+	mutex_unlock(&dev->dev_ctx_lock);
 	kfree(ctx);
 	mutex_unlock(&dev->dev_mutex);
 	return 0;
@@ -404,6 +408,7 @@
 	for (i = 0; i < MTK_VDEC_HW_MAX; i++)
 		mutex_init(&dev->dec_mutex[i]);
 	mutex_init(&dev->dev_mutex);
+	mutex_init(&dev->dev_ctx_lock);
 	spin_lock_init(&dev->irqlock);
 
 	snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
@@ -241,6 +241,7 @@
  *
  * @dec_mutex: decoder hardware lock
  * @dev_mutex: video_device lock
+ * @dev_ctx_lock: the lock of context list
  * @decode_workqueue: decode work queue
  *
  * @irqlock: protect data access by irq handler and work thread
@@ -282,6 +283,7 @@
 	/* decoder hardware mutex lock */
 	struct mutex dec_mutex[MTK_VDEC_HW_MAX];
 	struct mutex dev_mutex;
+	struct mutex dev_ctx_lock;
 	struct workqueue_struct *decode_workqueue;
 
 	spinlock_t irqlock;
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c
@@ -1023,18 +1023,26 @@
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(instance->mv); i++)
-		mtk_vcodec_mem_free(ctx, &instance->mv[i]);
+		if (instance->mv[i].va)
+			mtk_vcodec_mem_free(ctx, &instance->mv[i]);
 
 	for (i = 0; i < ARRAY_SIZE(instance->seg); i++)
-		mtk_vcodec_mem_free(ctx, &instance->seg[i]);
+		if (instance->seg[i].va)
+			mtk_vcodec_mem_free(ctx, &instance->seg[i]);
 
 	for (i = 0; i < ARRAY_SIZE(instance->cdf); i++)
-		mtk_vcodec_mem_free(ctx, &instance->cdf[i]);
+		if (instance->cdf[i].va)
+			mtk_vcodec_mem_free(ctx, &instance->cdf[i]);
 
-	mtk_vcodec_mem_free(ctx, &instance->tile);
-	mtk_vcodec_mem_free(ctx, &instance->cdf_temp);
-	mtk_vcodec_mem_free(ctx, &instance->cdf_table);
-	mtk_vcodec_mem_free(ctx, &instance->iq_table);
+
+	if (instance->tile.va)
+		mtk_vcodec_mem_free(ctx, &instance->tile);
+	if (instance->cdf_temp.va)
+		mtk_vcodec_mem_free(ctx, &instance->cdf_temp);
+	if (instance->cdf_table.va)
+		mtk_vcodec_mem_free(ctx, &instance->cdf_table);
+	if (instance->iq_table.va)
+		mtk_vcodec_mem_free(ctx, &instance->iq_table);
 
 	instance->level = AV1_RES_NONE;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c
@@ -347,11 +347,16 @@
 		return vpu_dec_reset(vpu);
 
 	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
+	if (!fb) {
+		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
+		return -ENOMEM;
+	}
+
 	src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
 	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
 
-	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
-	c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
+	y_fb_dma = fb->base_y.dma_addr;
+	c_fb_dma = fb->base_c.dma_addr;
 
 	mtk_vdec_debug(inst->ctx, "+ [%d] FB y_dma=%llx c_dma=%llx va=%p",
 		       inst->num_nalu, y_fb_dma, c_fb_dma, fb);
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c
@@ -724,11 +724,16 @@
 		return vpu_dec_reset(vpu);
 
 	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
+	if (!fb) {
+		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
+		return -ENOMEM;
+	}
+
 	src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
 	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
 
-	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
-	c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
+	y_fb_dma = fb->base_y.dma_addr;
+	c_fb_dma = fb->base_c.dma_addr;
 	mtk_vdec_debug(inst->ctx, "[h264-dec] [%d] y_dma=%llx c_dma=%llx",
 		       inst->ctx->decoded_frame_cnt, y_fb_dma, c_fb_dma);
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
@@ -869,7 +869,6 @@
 	inst->vpu.codec_type = ctx->current_codec;
 	inst->vpu.capture_type = ctx->capture_fourcc;
 
-	ctx->drv_handle = inst;
 	err = vpu_dec_init(&inst->vpu);
 	if (err) {
 		mtk_vdec_err(ctx, "vdec_hevc init err=%d", err);
@@ -898,6 +897,7 @@
 	mtk_vdec_debug(ctx, "lat hevc instance >> %p, codec_type = 0x%x",
 		       inst, inst->vpu.codec_type);
 
+	ctx->drv_handle = inst;
 	return 0;
 error_free_inst:
 	kfree(inst);
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c
@@ -335,14 +335,18 @@
 	src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
 
 	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
-	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
+	if (!fb) {
+		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
+		return -ENOMEM;
+	}
 
-	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
+	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
+	y_fb_dma = fb->base_y.dma_addr;
 	if (inst->ctx->q_data[MTK_Q_DATA_DST].fmt->num_planes == 1)
 		c_fb_dma = y_fb_dma +
 			inst->ctx->picinfo.buf_w * inst->ctx->picinfo.buf_h;
 	else
-		c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
+		c_fb_dma = fb->base_c.dma_addr;
 
 	inst->vsi->dec.bs_dma = (u64)bs->dma_addr;
 	inst->vsi->dec.bs_sz = bs->size;
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
@@ -77,12 +77,14 @@
 	struct mtk_vcodec_dec_ctx *ctx;
 	int ret = false;
 
+	mutex_lock(&dec_dev->dev_ctx_lock);
 	list_for_each_entry(ctx, &dec_dev->ctx_list, list) {
 		if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
 			ret = true;
 			break;
 		}
 	}
+	mutex_unlock(&dec_dev->dev_ctx_lock);
 
 	return ret;
 }
@@ -231,6 +233,12 @@
 	mtk_vdec_debug(vpu->ctx, "vdec_inst=%p", vpu);
 
 	err = vcodec_vpu_send_msg(vpu, (void *)&msg, sizeof(msg));
+
+	if (IS_ERR_OR_NULL(vpu->vsi)) {
+		mtk_vdec_err(vpu->ctx, "invalid vdec vsi, status=%d", err);
+		return -EINVAL;
+	}
+
 	mtk_vdec_debug(vpu->ctx, "- ret=%d", err);
 	return err;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
@@ -177,7 +177,9 @@
 	mtk_v4l2_venc_dbg(2, ctx, "Create instance [%d]@%p m2m_ctx=%p ",
 			  ctx->id, ctx, ctx->m2m_ctx);
 
+	mutex_lock(&dev->dev_ctx_lock);
 	list_add(&ctx->list, &dev->ctx_list);
+	mutex_unlock(&dev->dev_ctx_lock);
 
 	mutex_unlock(&dev->dev_mutex);
 	mtk_v4l2_venc_dbg(0, ctx, "%s encoder [%d]", dev_name(&dev->plat_dev->dev),
@@ -212,7 +214,9 @@
 	v4l2_fh_exit(&ctx->fh);
 	v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
 
+	mutex_lock(&dev->dev_ctx_lock);
 	list_del_init(&ctx->list);
+	mutex_unlock(&dev->dev_ctx_lock);
 	kfree(ctx);
 	mutex_unlock(&dev->dev_mutex);
 	return 0;
@@ -294,6 +298,7 @@
 
 	mutex_init(&dev->enc_mutex);
 	mutex_init(&dev->dev_mutex);
+	mutex_init(&dev->dev_ctx_lock);
 	spin_lock_init(&dev->irqlock);
 
 	snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
@@ -178,6 +178,7 @@
  *
  * @enc_mutex: encoder hardware lock.
  * @dev_mutex: video_device lock
+ * @dev_ctx_lock: the lock of context list
  * @encode_workqueue: encode work queue
  *
  * @enc_irq: h264 encoder irq resource
@@ -205,6 +206,7 @@
 	/* encoder hardware mutex lock */
 	struct mutex enc_mutex;
 	struct mutex dev_mutex;
+	struct mutex dev_ctx_lock;
 	struct workqueue_struct *encode_workqueue;
 
 	int enc_irq;
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c
@@ -58,13 +58,15 @@
 	return 0;
 }
 
-void mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm)
+int mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm)
 {
 	int ret;
 
 	ret = pm_runtime_resume_and_get(pm->dev);
 	if (ret)
 		dev_err(pm->dev, "pm_runtime_resume_and_get fail: %d", ret);
+
+	return ret;
 }
 
 void mtk_vcodec_enc_pw_off(struct mtk_vcodec_pm *pm)
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h
@@ -10,7 +10,7 @@
 #include "mtk_vcodec_enc_drv.h"
 
 int mtk_vcodec_init_enc_clk(struct mtk_vcodec_enc_dev *dev);
-void mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm);
+int mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm);
 void mtk_vcodec_enc_pw_off(struct mtk_vcodec_pm *pm);
 void mtk_vcodec_enc_clock_on(struct mtk_vcodec_pm *pm);
 void mtk_vcodec_enc_clock_off(struct mtk_vcodec_pm *pm);
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c
@@ -301,11 +301,12 @@
 	 * other buffers need to be freed by AP.
 	 */
 	for (i = 0; i < VENC_H264_VPU_WORK_BUF_MAX; i++) {
-		if (i != VENC_H264_VPU_WORK_BUF_SKIP_FRAME)
+		if (i != VENC_H264_VPU_WORK_BUF_SKIP_FRAME && inst->work_bufs[i].va)
 			mtk_vcodec_mem_free(inst->ctx, &inst->work_bufs[i]);
 	}
 
-	mtk_vcodec_mem_free(inst->ctx, &inst->pps_buf);
+	if (inst->pps_buf.va)
+		mtk_vcodec_mem_free(inst->ctx, &inst->pps_buf);
 }
 
 static int h264_enc_alloc_work_buf(struct venc_h264_inst *inst, bool is_34bit)
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c
@@ -64,7 +64,9 @@
 	ctx->dev->curr_ctx = ctx;
 	spin_unlock_irqrestore(&ctx->dev->irqlock, flags);
 
-	mtk_vcodec_enc_pw_on(&ctx->dev->pm);
+	ret = mtk_vcodec_enc_pw_on(&ctx->dev->pm);
+	if (ret)
+		goto venc_if_encode_pw_on_err;
 	mtk_vcodec_enc_clock_on(&ctx->dev->pm);
 	ret = ctx->enc_if->encode(ctx->drv_handle, opt, frm_buf,
 				  bs_buf, result);
@@ -75,6 +77,7 @@
 	ctx->dev->curr_ctx = NULL;
 	spin_unlock_irqrestore(&ctx->dev->irqlock, flags);
 
+venc_if_encode_pw_on_err:
 	mtk_venc_unlock(ctx);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
@@ -47,12 +47,14 @@
 	struct mtk_vcodec_enc_ctx *ctx;
 	int ret = false;
 
+	mutex_lock(&enc_dev->dev_ctx_lock);
 	list_for_each_entry(ctx, &enc_dev->ctx_list, list) {
 		if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
 			ret = true;
 			break;
 		}
 	}
+	mutex_unlock(&enc_dev->dev_ctx_lock);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vpu/mtk_vpu.c
@@ -635,7 +635,7 @@
 }
 EXPORT_SYMBOL_GPL(vpu_load_firmware);
 
-static void vpu_init_ipi_handler(const void *data, unsigned int len, void *priv)
+static void vpu_init_ipi_handler(void *data, unsigned int len, void *priv)
 {
 	struct mtk_vpu *vpu = priv;
 	const struct vpu_run *run = data;
--- linux-qcom-6.8.0.orig/drivers/media/platform/mediatek/vpu/mtk_vpu.h
+++ linux-qcom-6.8.0/drivers/media/platform/mediatek/vpu/mtk_vpu.h
@@ -17,7 +17,7 @@
  * VPU interfaces with other blocks by share memory and interrupt.
  */
 
-typedef void (*ipi_handler_t) (const void *data,
+typedef void (*ipi_handler_t) (void *data,
 			       unsigned int len,
 			       void *priv);
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ linux-qcom-6.8.0/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -1632,6 +1632,9 @@
 	dev_dbg(ctx->mxc_jpeg->dev, "Start streaming ctx=%p", ctx);
 	q_data->sequence = 0;
 
+	if (V4L2_TYPE_IS_CAPTURE(q->type))
+		ctx->need_initial_source_change_evt = false;
+
 	ret = pm_runtime_resume_and_get(ctx->mxc_jpeg->dev);
 	if (ret < 0) {
 		dev_err(ctx->mxc_jpeg->dev, "Failed to power up jpeg\n");
@@ -2671,9 +2674,12 @@
 	int i;
 
 	for (i = 0; i < jpeg->num_domains; i++) {
-		if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i]))
+		if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) &&
+		    !pm_runtime_suspended(jpeg->pd_dev[i]))
+			pm_runtime_force_suspend(jpeg->pd_dev[i]);
+		if (!IS_ERR_OR_NULL(jpeg->pd_link[i]))
 			device_link_del(jpeg->pd_link[i]);
-		if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i]))
+		if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]))
 			dev_pm_domain_detach(jpeg->pd_dev[i], true);
 		jpeg->pd_dev[i] = NULL;
 		jpeg->pd_link[i] = NULL;
@@ -2834,6 +2840,7 @@
 	jpeg->dec_vdev->vfl_dir = VFL_DIR_M2M;
 	jpeg->dec_vdev->device_caps = V4L2_CAP_STREAMING |
 					V4L2_CAP_VIDEO_M2M_MPLANE;
+	video_set_drvdata(jpeg->dec_vdev, jpeg);
 	if (mode == MXC_JPEG_ENCODE) {
 		v4l2_disable_ioctl(jpeg->dec_vdev, VIDIOC_DECODER_CMD);
 		v4l2_disable_ioctl(jpeg->dec_vdev, VIDIOC_TRY_DECODER_CMD);
@@ -2846,7 +2853,6 @@
 		dev_err(dev, "failed to register video device\n");
 		goto err_vdev_register;
 	}
-	video_set_drvdata(jpeg->dec_vdev, jpeg);
 	if (mode == MXC_JPEG_ENCODE)
 		v4l2_info(&jpeg->v4l2_dev,
 			  "encoder device registered as /dev/video%d (%d,%d)\n",
--- linux-qcom-6.8.0.orig/drivers/media/platform/nxp/imx-pxp.c
+++ linux-qcom-6.8.0/drivers/media/platform/nxp/imx-pxp.c
@@ -1805,6 +1805,9 @@
 		return PTR_ERR(mmio);
 	dev->regmap = devm_regmap_init_mmio(&pdev->dev, mmio,
 					    &pxp_regmap_config);
+	if (IS_ERR(dev->regmap))
+		return dev_err_probe(&pdev->dev, PTR_ERR(dev->regmap),
+				     "Failed to init regmap\n");
 
 	irq = platform_get_irq(pdev, 0);
 	if (irq < 0)
--- linux-qcom-6.8.0.orig/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
+++ linux-qcom-6.8.0/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
@@ -161,7 +161,6 @@
 
 	pad = media_pad_remote_pad_first(&xbar->pads[sink_pad]);
 	sd = media_entity_to_v4l2_subdev(pad->entity);
-
 	if (!sd) {
 		dev_dbg(xbar->isi->dev,
 			"no entity connected to crossbar input %u\n",
@@ -469,7 +468,8 @@
 	}
 
 	for (i = 0; i < xbar->num_sinks; ++i)
-		xbar->pads[i].flags = MEDIA_PAD_FL_SINK;
+		xbar->pads[i].flags = MEDIA_PAD_FL_SINK
+				    | MEDIA_PAD_FL_MUST_CONNECT;
 	for (i = 0; i < xbar->num_sources; ++i)
 		xbar->pads[i + xbar->num_sinks].flags = MEDIA_PAD_FL_SOURCE;
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/Kconfig
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/Kconfig
@@ -4,3 +4,4 @@
 
 source "drivers/media/platform/qcom/camss/Kconfig"
 source "drivers/media/platform/qcom/venus/Kconfig"
+source "drivers/media/platform/qcom/iris/Kconfig"
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/Makefile
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/Makefile
@@ -1,3 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0-only
 obj-y += camss/
 obj-y += venus/
+obj-y += iris/
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/Makefile
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/Makefile
@@ -7,6 +7,7 @@
 		camss-csid-4-1.o \
 		camss-csid-4-7.o \
 		camss-csid-gen2.o \
+		camss-csid-gen3.o \
 		camss-csiphy-2ph-1-0.o \
 		camss-csiphy-3ph-1-0.o \
 		camss-csiphy.o \
@@ -14,10 +15,14 @@
 		camss-vfe-4-1.o \
 		camss-vfe-4-7.o \
 		camss-vfe-4-8.o \
-		camss-vfe-170.o \
+		camss-vfe-17x.o \
 		camss-vfe-480.o \
+		camss-vfe-690.o \
 		camss-vfe-gen1.o \
 		camss-vfe.o \
 		camss-video.o \
+		camss-format.o \
+		camss-tpg.o \
+		camss-tpg-gen1.o
 
 obj-$(CONFIG_VIDEO_QCOM_CAMSS) += qcom-camss.o
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csid-4-1.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csid-4-1.c
@@ -45,128 +45,6 @@
 #define CAMSS_CSID_TG_DT_n_CGG_1(n)	(0x0b0 + 0xc * (n))
 #define CAMSS_CSID_TG_DT_n_CGG_2(n)	(0x0b4 + 0xc * (n))
 
-static const struct csid_format csid_formats[] = {
-	{
-		MEDIA_BUS_FMT_UYVY8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_VYUY8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_YUYV8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_YVYU8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_Y10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-};
-
 static void csid_configure_stream(struct csid_device *csid, u8 enable)
 {
 	struct csid_testgen_config *tg = &csid->testgen;
@@ -174,7 +52,7 @@
 
 	if (enable) {
 		struct v4l2_mbus_framefmt *input_format;
-		const struct csid_format *format;
+		const struct csid_format_info *format;
 		u8 vc = 0; /* Virtual Channel 0 */
 		u8 cid = vc * 4; /* id of Virtual Channel and Data Type set */
 		u8 dt_shift;
@@ -184,7 +62,8 @@
 			u32 num_lines, num_bytes_per_line;
 
 			input_format = &csid->fmt[MSM_CSID_PAD_SRC];
-			format = csid_get_fmt_entry(csid->formats, csid->nformats,
+			format = csid_get_fmt_entry(csid->res->formats->formats,
+						    csid->res->formats->nformats,
 						    input_format->code);
 			num_bytes_per_line = input_format->width * format->bpp * format->spp / 8;
 			num_lines = input_format->height;
@@ -211,7 +90,8 @@
 			struct csid_phy_config *phy = &csid->phy;
 
 			input_format = &csid->fmt[MSM_CSID_PAD_SINK];
-			format = csid_get_fmt_entry(csid->formats, csid->nformats,
+			format = csid_get_fmt_entry(csid->res->formats->formats,
+						    csid->res->formats->nformats,
 						    input_format->code);
 
 			val = phy->lane_cnt - 1;
@@ -311,8 +191,6 @@
 
 static void csid_subdev_init(struct csid_device *csid)
 {
-	csid->formats = csid_formats;
-	csid->nformats = ARRAY_SIZE(csid_formats);
 	csid->testgen.modes = csid_testgen_modes;
 	csid->testgen.nmodes = CSID_PAYLOAD_MODE_NUM_SUPPORTED_GEN1;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csid-4-7.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csid-4-7.c
@@ -44,156 +44,6 @@
 #define CAMSS_CSID_TG_DT_n_CGG_1(n)	(0x0b8 + 0xc * (n))
 #define CAMSS_CSID_TG_DT_n_CGG_2(n)	(0x0bc + 0xc * (n))
 
-static const struct csid_format csid_formats[] = {
-	{
-		MEDIA_BUS_FMT_UYVY8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_VYUY8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_YUYV8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_YVYU8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR14_1X14,
-		DATA_TYPE_RAW_14BIT,
-		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
-		14,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG14_1X14,
-		DATA_TYPE_RAW_14BIT,
-		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
-		14,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG14_1X14,
-		DATA_TYPE_RAW_14BIT,
-		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
-		14,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB14_1X14,
-		DATA_TYPE_RAW_14BIT,
-		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
-		14,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_Y10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-};
-
 static void csid_configure_stream(struct csid_device *csid, u8 enable)
 {
 	struct csid_testgen_config *tg = &csid->testgen;
@@ -203,7 +53,7 @@
 
 	if (enable) {
 		struct v4l2_mbus_framefmt *input_format;
-		const struct csid_format *format;
+		const struct csid_format_info *format;
 		u8 vc = 0; /* Virtual Channel 0 */
 		u8 cid = vc * 4; /* id of Virtual Channel and Data Type set */
 		u8 dt_shift;
@@ -213,7 +63,8 @@
 			u32 num_bytes_per_line, num_lines;
 
 			input_format = &csid->fmt[MSM_CSID_PAD_SRC];
-			format = csid_get_fmt_entry(csid->formats, csid->nformats,
+			format = csid_get_fmt_entry(csid->res->formats->formats,
+						    csid->res->formats->nformats,
 						    input_format->code);
 			num_bytes_per_line = input_format->width * format->bpp * format->spp / 8;
 			num_lines = input_format->height;
@@ -240,7 +91,8 @@
 			struct csid_phy_config *phy = &csid->phy;
 
 			input_format = &csid->fmt[MSM_CSID_PAD_SINK];
-			format = csid_get_fmt_entry(csid->formats, csid->nformats,
+			format = csid_get_fmt_entry(csid->res->formats->formats,
+						    csid->res->formats->nformats,
 						    input_format->code);
 
 			val = phy->lane_cnt - 1;
@@ -387,8 +239,6 @@
 
 static void csid_subdev_init(struct csid_device *csid)
 {
-	csid->formats = csid_formats;
-	csid->nformats = ARRAY_SIZE(csid_formats);
 	csid->testgen.modes = csid_testgen_modes;
 	csid->testgen.nmodes = CSID_PAYLOAD_MODE_NUM_SUPPORTED_GEN1;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csid-gen2.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csid-gen2.c
@@ -21,6 +21,7 @@
  * interface support. As a result of that it has an
  * alternate register layout.
  */
+#define IS_LITE		(csid->res->is_lite)
 
 #define CSID_HW_VERSION		0x0
 #define		HW_VERSION_STEPPING	0
@@ -176,284 +177,18 @@
 #define		TPG_COLOR_BOX_CFG_MODE		0
 #define		TPG_COLOR_BOX_PATTERN_SEL	2
 
-static const struct csid_format csid_formats[] = {
-	{
-		MEDIA_BUS_FMT_UYVY8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_VYUY8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_YUYV8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_YVYU8_1X16,
-		DATA_TYPE_YUV422_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		2,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_Y8_1X8,
-		DATA_TYPE_RAW_8BIT,
-		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
-		8,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_Y10_1X10,
-		DATA_TYPE_RAW_10BIT,
-		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
-		10,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB12_1X12,
-		DATA_TYPE_RAW_12BIT,
-		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
-		12,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SBGGR14_1X14,
-		DATA_TYPE_RAW_14BIT,
-		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
-		14,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGBRG14_1X14,
-		DATA_TYPE_RAW_14BIT,
-		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
-		14,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SGRBG14_1X14,
-		DATA_TYPE_RAW_14BIT,
-		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
-		14,
-		1,
-	},
-	{
-		MEDIA_BUS_FMT_SRGGB14_1X14,
-		DATA_TYPE_RAW_14BIT,
-		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
-		14,
-		1,
-	},
-};
-
-static void __csid_configure_stream(struct csid_device *csid, u8 enable, u8 vc)
+static void __csid_configure_rx(struct csid_device *csid,
+				struct csid_phy_config *phy, int vc)
 {
-	struct csid_testgen_config *tg = &csid->testgen;
-	u32 val;
-	u32 phy_sel = 0;
 	u8 lane_cnt = csid->phy.lane_cnt;
-	/* Source pads matching RDI channels on hardware. Pad 1 -> RDI0, Pad 2 -> RDI1, etc. */
-	struct v4l2_mbus_framefmt *input_format = &csid->fmt[MSM_CSID_PAD_FIRST_SRC + vc];
-	const struct csid_format *format = csid_get_fmt_entry(csid->formats, csid->nformats,
-							      input_format->code);
+	int val;
 
 	if (!lane_cnt)
 		lane_cnt = 4;
 
-	if (!tg->enabled)
-		phy_sel = csid->phy.csiphy_id;
-
-	if (enable) {
-		/*
-		 * DT_ID is a two bit bitfield that is concatenated with
-		 * the four least significant bits of the five bit VC
-		 * bitfield to generate an internal CID value.
-		 *
-		 * CSID_RDI_CFG0(vc)
-		 * DT_ID : 28:27
-		 * VC    : 26:22
-		 * DT    : 21:16
-		 *
-		 * CID   : VC 3:0 << 2 | DT_ID 1:0
-		 */
-		u8 dt_id = vc & 0x03;
-
-		if (tg->enabled) {
-			/* configure one DT, infinite frames */
-			val = vc << TPG_VC_CFG0_VC_NUM;
-			val |= INTELEAVING_MODE_ONE_SHOT << TPG_VC_CFG0_LINE_INTERLEAVING_MODE;
-			val |= 0 << TPG_VC_CFG0_NUM_FRAMES;
-			writel_relaxed(val, csid->base + CSID_TPG_VC_CFG0);
-
-			val = 0x740 << TPG_VC_CFG1_H_BLANKING_COUNT;
-			val |= 0x3ff << TPG_VC_CFG1_V_BLANKING_COUNT;
-			writel_relaxed(val, csid->base + CSID_TPG_VC_CFG1);
-
-			writel_relaxed(0x12345678, csid->base + CSID_TPG_LFSR_SEED);
-
-			val = (input_format->height & 0x1fff) << TPG_DT_n_CFG_0_FRAME_HEIGHT;
-			val |= (input_format->width & 0x1fff) << TPG_DT_n_CFG_0_FRAME_WIDTH;
-			writel_relaxed(val, csid->base + CSID_TPG_DT_n_CFG_0(0));
-
-			val = format->data_type << TPG_DT_n_CFG_1_DATA_TYPE;
-			writel_relaxed(val, csid->base + CSID_TPG_DT_n_CFG_1(0));
-
-			val = (tg->mode - 1) << TPG_DT_n_CFG_2_PAYLOAD_MODE;
-			val |= 0xBE << TPG_DT_n_CFG_2_USER_SPECIFIED_PAYLOAD;
-			val |= format->decode_format << TPG_DT_n_CFG_2_ENCODE_FORMAT;
-			writel_relaxed(val, csid->base + CSID_TPG_DT_n_CFG_2(0));
-
-			writel_relaxed(0, csid->base + CSID_TPG_COLOR_BARS_CFG);
-
-			writel_relaxed(0, csid->base + CSID_TPG_COLOR_BOX_CFG);
-		}
-
-		val = 1 << RDI_CFG0_BYTE_CNTR_EN;
-		val |= 1 << RDI_CFG0_FORMAT_MEASURE_EN;
-		val |= 1 << RDI_CFG0_TIMESTAMP_EN;
-		/* note: for non-RDI path, this should be format->decode_format */
-		val |= DECODE_FORMAT_PAYLOAD_ONLY << RDI_CFG0_DECODE_FORMAT;
-		val |= format->data_type << RDI_CFG0_DATA_TYPE;
-		val |= vc << RDI_CFG0_VIRTUAL_CHANNEL;
-		val |= dt_id << RDI_CFG0_DT_ID;
-		writel_relaxed(val, csid->base + CSID_RDI_CFG0(vc));
-
-		/* CSID_TIMESTAMP_STB_POST_IRQ */
-		val = 2 << RDI_CFG1_TIMESTAMP_STB_SEL;
-		writel_relaxed(val, csid->base + CSID_RDI_CFG1(vc));
-
-		val = 1;
-		writel_relaxed(val, csid->base + CSID_RDI_FRM_DROP_PERIOD(vc));
-
-		val = 0;
-		writel_relaxed(val, csid->base + CSID_RDI_FRM_DROP_PATTERN(vc));
-
-		val = 1;
-		writel_relaxed(val, csid->base + CSID_RDI_IRQ_SUBSAMPLE_PERIOD(vc));
-
-		val = 0;
-		writel_relaxed(val, csid->base + CSID_RDI_IRQ_SUBSAMPLE_PATTERN(vc));
-
-		val = 1;
-		writel_relaxed(val, csid->base + CSID_RDI_RPP_PIX_DROP_PERIOD(vc));
-
-		val = 0;
-		writel_relaxed(val, csid->base + CSID_RDI_RPP_PIX_DROP_PATTERN(vc));
-
-		val = 1;
-		writel_relaxed(val, csid->base + CSID_RDI_RPP_LINE_DROP_PERIOD(vc));
-
-		val = 0;
-		writel_relaxed(val, csid->base + CSID_RDI_RPP_LINE_DROP_PATTERN(vc));
-
-		val = 0;
-		writel_relaxed(val, csid->base + CSID_RDI_CTRL(vc));
-
-		val = readl_relaxed(csid->base + CSID_RDI_CFG0(vc));
-		val |=  1 << RDI_CFG0_ENABLE;
-		writel_relaxed(val, csid->base + CSID_RDI_CFG0(vc));
-	}
-
-	if (tg->enabled) {
-		val = enable << TPG_CTRL_TEST_EN;
-		val |= 1 << TPG_CTRL_FS_PKT_EN;
-		val |= 1 << TPG_CTRL_FE_PKT_EN;
-		val |= (lane_cnt - 1) << TPG_CTRL_NUM_ACTIVE_LANES;
-		val |= 0x64 << TPG_CTRL_CYCLES_BETWEEN_PKTS;
-		val |= 0xA << TPG_CTRL_NUM_TRAIL_BYTES;
-		writel_relaxed(val, csid->base + CSID_TPG_CTRL);
-	}
-
 	val = (lane_cnt - 1) << CSI2_RX_CFG0_NUM_ACTIVE_LANES;
-	val |= csid->phy.lane_assign << CSI2_RX_CFG0_DL0_INPUT_SEL;
-	val |= phy_sel << CSI2_RX_CFG0_PHY_NUM_SEL;
+	val |= phy->lane_assign << CSI2_RX_CFG0_DL0_INPUT_SEL;
+	val |= phy->csiphy_id << CSI2_RX_CFG0_PHY_NUM_SEL;
 	writel_relaxed(val, csid->base + CSID_CSI2_RX_CFG0);
 
 	val = 1 << CSI2_RX_CFG1_PACKET_ECC_CORRECTION_EN;
@@ -461,21 +196,152 @@
 		val |= 1 << CSI2_RX_CFG1_VC_MODE;
 	val |= 1 << CSI2_RX_CFG1_MISR_EN;
 	writel_relaxed(val, csid->base + CSID_CSI2_RX_CFG1);
+}
+
+static void __csid_ctrl_rdi(struct csid_device *csid, int enable, u8 rdi)
+{
+	int val;
 
 	if (enable)
 		val = HALT_CMD_RESUME_AT_FRAME_BOUNDARY << RDI_CTRL_HALT_CMD;
 	else
 		val = HALT_CMD_HALT_AT_FRAME_BOUNDARY << RDI_CTRL_HALT_CMD;
+	writel_relaxed(val, csid->base + CSID_RDI_CTRL(rdi));
+}
+
+static void __csid_configure_testgen(struct csid_device *csid, u8 enable, u8 vc)
+{
+	struct csid_testgen_config *tg = &csid->testgen;
+	struct v4l2_mbus_framefmt *input_format = &csid->fmt[MSM_CSID_PAD_FIRST_SRC + vc];
+	const struct csid_format_info *format = csid_get_fmt_entry(csid->res->formats->formats,
+								   csid->res->formats->nformats,
+								   input_format->code);
+	u8 lane_cnt = csid->phy.lane_cnt;
+	u32 val;
+
+	if (!lane_cnt)
+		lane_cnt = 4;
+
+	/* configure one DT, infinite frames */
+	val = vc << TPG_VC_CFG0_VC_NUM;
+	val |= INTELEAVING_MODE_ONE_SHOT << TPG_VC_CFG0_LINE_INTERLEAVING_MODE;
+	val |= 0 << TPG_VC_CFG0_NUM_FRAMES;
+	writel_relaxed(val, csid->base + CSID_TPG_VC_CFG0);
+
+	val = 0x740 << TPG_VC_CFG1_H_BLANKING_COUNT;
+	val |= 0x3ff << TPG_VC_CFG1_V_BLANKING_COUNT;
+	writel_relaxed(val, csid->base + CSID_TPG_VC_CFG1);
+
+	writel_relaxed(0x12345678, csid->base + CSID_TPG_LFSR_SEED);
+
+	val = (input_format->height & 0x1fff) << TPG_DT_n_CFG_0_FRAME_HEIGHT;
+	val |= (input_format->width & 0x1fff) << TPG_DT_n_CFG_0_FRAME_WIDTH;
+	writel_relaxed(val, csid->base + CSID_TPG_DT_n_CFG_0(0));
+
+	val = format->data_type << TPG_DT_n_CFG_1_DATA_TYPE;
+	writel_relaxed(val, csid->base + CSID_TPG_DT_n_CFG_1(0));
+
+	val = (tg->mode - 1) << TPG_DT_n_CFG_2_PAYLOAD_MODE;
+	val |= 0xBE << TPG_DT_n_CFG_2_USER_SPECIFIED_PAYLOAD;
+	val |= format->decode_format << TPG_DT_n_CFG_2_ENCODE_FORMAT;
+	writel_relaxed(val, csid->base + CSID_TPG_DT_n_CFG_2(0));
+
+	writel_relaxed(0, csid->base + CSID_TPG_COLOR_BARS_CFG);
+
+	writel_relaxed(0, csid->base + CSID_TPG_COLOR_BOX_CFG);
+
+	val = enable << TPG_CTRL_TEST_EN;
+	val |= 1 << TPG_CTRL_FS_PKT_EN;
+	val |= 1 << TPG_CTRL_FE_PKT_EN;
+	val |= (lane_cnt - 1) << TPG_CTRL_NUM_ACTIVE_LANES;
+	val |= 0x64 << TPG_CTRL_CYCLES_BETWEEN_PKTS;
+	val |= 0xA << TPG_CTRL_NUM_TRAIL_BYTES;
+	writel_relaxed(val, csid->base + CSID_TPG_CTRL);
+}
+
+static void __csid_configure_rdi_stream(struct csid_device *csid, u8 enable, u8 vc)
+{
+	/* Source pads matching RDI channels on hardware. Pad 1 -> RDI0, Pad 2 -> RDI1, etc. */
+	struct v4l2_mbus_framefmt *input_format = &csid->fmt[MSM_CSID_PAD_FIRST_SRC + vc];
+	const struct csid_format_info *format = csid_get_fmt_entry(csid->res->formats->formats,
+								   csid->res->formats->nformats,
+								   input_format->code);
+	u32 val;
+
+	/*
+	 * DT_ID is a two bit bitfield that is concatenated with
+	 * the four least significant bits of the five bit VC
+	 * bitfield to generate an internal CID value.
+	 *
+	 * CSID_RDI_CFG0(vc)
+	 * DT_ID : 28:27
+	 * VC    : 26:22
+	 * DT    : 21:16
+	 *
+	 * CID   : VC 3:0 << 2 | DT_ID 1:0
+	 */
+	u8 dt_id = vc & 0x03;
+
+	val = 1 << RDI_CFG0_BYTE_CNTR_EN;
+	val |= 1 << RDI_CFG0_FORMAT_MEASURE_EN;
+	val |= 1 << RDI_CFG0_TIMESTAMP_EN;
+	/* note: for non-RDI path, this should be format->decode_format */
+	val |= DECODE_FORMAT_PAYLOAD_ONLY << RDI_CFG0_DECODE_FORMAT;
+	val |= format->data_type << RDI_CFG0_DATA_TYPE;
+	val |= vc << RDI_CFG0_VIRTUAL_CHANNEL;
+	val |= dt_id << RDI_CFG0_DT_ID;
+	writel_relaxed(val, csid->base + CSID_RDI_CFG0(vc));
+
+	/* CSID_TIMESTAMP_STB_POST_IRQ */
+	val = 2 << RDI_CFG1_TIMESTAMP_STB_SEL;
+	writel_relaxed(val, csid->base + CSID_RDI_CFG1(vc));
+
+	val = 1;
+	writel_relaxed(val, csid->base + CSID_RDI_FRM_DROP_PERIOD(vc));
+
+	val = 0;
+	writel_relaxed(val, csid->base + CSID_RDI_FRM_DROP_PATTERN(vc));
+
+	val = 1;
+	writel_relaxed(val, csid->base + CSID_RDI_IRQ_SUBSAMPLE_PERIOD(vc));
+
+	val = 0;
+	writel_relaxed(val, csid->base + CSID_RDI_IRQ_SUBSAMPLE_PATTERN(vc));
+
+	val = 1;
+	writel_relaxed(val, csid->base + CSID_RDI_RPP_PIX_DROP_PERIOD(vc));
+
+	val = 0;
+	writel_relaxed(val, csid->base + CSID_RDI_RPP_PIX_DROP_PATTERN(vc));
+
+	val = 1;
+	writel_relaxed(val, csid->base + CSID_RDI_RPP_LINE_DROP_PERIOD(vc));
+
+	val = 0;
+	writel_relaxed(val, csid->base + CSID_RDI_RPP_LINE_DROP_PATTERN(vc));
+
+	val = 0;
 	writel_relaxed(val, csid->base + CSID_RDI_CTRL(vc));
+
+	val = readl_relaxed(csid->base + CSID_RDI_CFG0(vc));
+	val |=  enable << RDI_CFG0_ENABLE;
+	writel_relaxed(val, csid->base + CSID_RDI_CFG0(vc));
 }
 
 static void csid_configure_stream(struct csid_device *csid, u8 enable)
 {
+	struct csid_testgen_config *tg = &csid->testgen;
 	u8 i;
 	/* Loop through all enabled VCs and configure stream for each */
 	for (i = 0; i < MSM_CSID_MAX_SRC_STREAMS; i++)
-		if (csid->phy.en_vc & BIT(i))
-			__csid_configure_stream(csid, enable, i);
+		if (csid->phy.en_vc & BIT(i)) {
+			if (tg->enabled)
+				__csid_configure_testgen(csid, enable, i);
+
+			__csid_configure_rdi_stream(csid, enable, i);
+			__csid_configure_rx(csid, &csid->phy, i);
+			__csid_ctrl_rdi(csid, enable, i);
+		}
 }
 
 static int csid_configure_testgen_pattern(struct csid_device *csid, s32 val)
@@ -612,8 +478,6 @@
 
 static void csid_subdev_init(struct csid_device *csid)
 {
-	csid->formats = csid_formats;
-	csid->nformats = ARRAY_SIZE(csid_formats);
 	csid->testgen.modes = csid_testgen_modes;
 	csid->testgen.nmodes = CSID_PAYLOAD_MODE_NUM_SUPPORTED_GEN2;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csid-gen3.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csid-gen3.c
@@ -0,0 +1,430 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * camss-csid-gen3.c
+ *
+ * Qualcomm MSM Camera Subsystem - CSID (CSI Decoder) Module
+ *
+ * Copyright (C) 2020 Linaro Ltd.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/of.h>
+
+#include "camss.h"
+#include "camss-csid.h"
+#include "camss-csid-gen3.h"
+
+#define CSID_HW_VERSION                 0x0
+#define HW_VERSION_STEPPING             0x0
+#define HW_VERSION_REVISION             0x10
+#define HW_VERSION_GENERATION           0x1C
+
+#define CSID_TOP_IO_PATH_CFG0(csid)	(0x4 * (csid))
+#define		OUTPUT_IFE_EN			0x100
+#define		INTERNAL_CSID			1
+
+#define CSID_RST_CFG			0xC
+#define		RST_MODE			0
+#define		RST_LOCATION			4
+
+#define CSID_RST_CMD			0x10
+#define		SELECT_HW_RST			0
+#define		SELECT_SW_RST			1
+#define		SELECT_IRQ_RST			2
+
+#define CSID_CSI2_RX_IRQ_STATUS		0x9C
+#define CSID_CSI2_RX_IRQ_MASK		0xA0
+#define CSID_CSI2_RX_IRQ_CLEAR		0xA4
+#define CSID_CSI2_RX_IRQ_SET		0xA8
+
+#define CSID_CSI2_RDIN_IRQ_STATUS(rdi)	(0xEC + 0x10 * (rdi))
+
+#define CSID_CSI2_RDIN_IRQ_CLEAR(rdi)	(0xF4 + 0x10 * (rdi))
+#define CSID_CSI2_RDIN_IRQ_SET(rdi)	(0xF8 + 0x10 * (rdi))
+
+#define CSID_TOP_IRQ_STATUS		0x7C
+#define		 TOP_IRQ_STATUS_RESET_DONE	0
+
+#define CSID_TOP_IRQ_MASK		0x80
+#define CSID_TOP_IRQ_CLEAR		0x84
+#define CSID_TOP_IRQ_SET		0x88
+
+#define CSID_IRQ_CMD			0x14
+#define		IRQ_CMD_CLEAR			0
+#define		IRQ_CMD_SET			4
+
+#define CSID_REG_UPDATE_CMD		0x18
+
+#define CSID_BUF_DONE_IRQ_STATUS	0x8C
+#define		BUF_DONE_IRQ_STATUS_RDI_OFFSET	(csid_is_lite(csid) ? 1 : 13)
+#define CSID_BUF_DONE_IRQ_MASK		0x90
+#define CSID_BUF_DONE_IRQ_CLEAR		0x94
+#define CSID_BUF_DONE_IRQ_SET		0x98
+
+#define CSID_RDI0_IRQ_MASK	0xF0
+
+#define CSID_CSI2_RX_CFG0		0x200
+#define		CSI2_RX_CFG0_NUM_ACTIVE_LANES	0
+#define		CSI2_RX_CFG0_VC_MODE		3
+#define		CSI2_RX_CFG0_DL0_INPUT_SEL	4
+#define		CSI2_RX_CFG0_PHY_NUM_SEL	20
+#define		CSI2_RX_CFG0_PHY_SEL_BASE_IDX	1
+#define		CSI2_RX_CFG0_TPG_NUM_EN		27
+#define		CSI2_RX_CFG0_TPG_NUM_SEL	28
+
+#define CSID_CSI2_RX_CFG1		0x204
+#define		CSI2_RX_CFG1_ECC_CORRECTION_EN	0
+
+#define CSID_RDI_CFG0(rdi)	(csid_is_lite(csid) ? (0x300 + 0x100 * (rdi)) :\
+					(0x500 + 0x100 * (rdi)))
+#define		RDI_CFG0_DECODE_FORMAT		12
+#define		RDI_CFG0_DT			16
+#define		RDI_CFG0_VC			22
+#define		RDI_CFG0_DT_ID			27
+#define		RDI_CFG0_EN			31
+
+#define CSID_RDI_CTRL(rdi)	(csid_is_lite(csid) ? (0x304 + 0x100 * (rdi)) :\
+					(0x504 + 0x100 * (rdi)))
+#define		RDI_CTRL_START_CMD		0
+
+#define CSID_RDI_CFG1(rdi)	(csid_is_lite(csid) ? (0x310 + 0x100 * (rdi)) :\
+					(0x510 + 0x100 * (rdi)))
+#define		RDI_CFG1_DROP_H_EN		5
+#define		RDI_CFG1_DROP_V_EN		6
+#define		RDI_CFG1_CROP_H_EN		7
+#define		RDI_CFG1_CROP_V_EN		8
+#define		RDI_CFG1_PACKING_FORMAT		15
+
+#define CSID_RDI_IRQ_SUBSAMPLE_PATTERN(rdi)	(0x548 + 0x100 * (rdi))
+#define CSID_RDI_IRQ_SUBSAMPLE_PERIOD(rdi)	(0x54C + 0x100 * (rdi))
+
+#define REG_UPDATE_RDI			reg_update_rdi
+
+static inline int reg_update_rdi(struct csid_device *csid, int n)
+{
+	return BIT(n + 4) + BIT(20 + n);
+}
+
+/*
+ * csid_hw_version - CSID hardware version query
+ * @csid: CSID device
+ *
+ * Return HW version or error
+ */
+static u32 csid_hw_version(struct csid_device *csid)
+{
+	u32 hw_version;
+	u32 hw_gen;
+	u32 hw_rev;
+	u32 hw_step;
+
+	hw_version = readl_relaxed(csid->base + CSID_HW_VERSION);
+	hw_gen = (hw_version >> HW_VERSION_GENERATION) & 0xF;
+	hw_rev = (hw_version >> HW_VERSION_REVISION) & 0xFFF;
+	hw_step = (hw_version >> HW_VERSION_STEPPING) & 0xFFFF;
+	dev_info(csid->camss->dev, "CSID:%d HW Version = %u.%u.%u\n",
+		csid->id, hw_gen, hw_rev, hw_step);
+
+	return hw_version;
+}
+
+/*
+ * csid_src_pad_code - Pick an output/src format based on the input/sink format
+ * @csid: CSID device
+ * @sink_code: The sink format of the input
+ * @match_format_idx: Request preferred index, as defined by subdevice csid
+ *                    format. Set @match_code to 0 if used.
+ * @match_code: Request preferred code, set @match_format_idx to 0 if used
+ *
+ * Return 0 on failure or src format code otherwise
+ */
+static u32 csid_src_pad_code(struct csid_device *csid, u32 sink_code,
+		      unsigned int match_format_idx, u32 match_code)
+{
+	if (csid->camss->res->version == CAMSS_8x16) {
+		if (match_format_idx > 0)
+			return 0;
+
+		return sink_code;
+	}
+
+	switch (sink_code) {
+	case MEDIA_BUS_FMT_SBGGR10_1X10:
+	{
+		u32 src_code[] = {
+			MEDIA_BUS_FMT_SBGGR10_1X10,
+			MEDIA_BUS_FMT_SBGGR10_2X8_PADHI_LE,
+		};
+
+		return csid_find_code(src_code, ARRAY_SIZE(src_code),
+				      match_format_idx, match_code);
+	}
+	case MEDIA_BUS_FMT_Y10_1X10:
+	{
+		u32 src_code[] = {
+			MEDIA_BUS_FMT_Y10_1X10,
+			MEDIA_BUS_FMT_Y10_2X8_PADHI_LE,
+		};
+
+		return csid_find_code(src_code, ARRAY_SIZE(src_code),
+				      match_format_idx, match_code);
+	}
+	default:
+		if (match_format_idx > 0)
+			return 0;
+
+		return sink_code;
+	}
+}
+
+static void __csid_configure_rx(struct csid_device *csid,
+				struct csid_phy_config *phy, int vc)
+{
+	int val;
+	struct camss *camss;
+	struct tpg_device *tpg;
+
+	camss = csid->camss;
+	val = (phy->lane_cnt - 1) << CSI2_RX_CFG0_NUM_ACTIVE_LANES;
+	val |= phy->lane_assign << CSI2_RX_CFG0_DL0_INPUT_SEL;
+	val |= (phy->csiphy_id + CSI2_RX_CFG0_PHY_SEL_BASE_IDX) << CSI2_RX_CFG0_PHY_NUM_SEL;
+	if (vc > 3)
+		val |= 1 << CSI2_RX_CFG0_VC_MODE;
+
+	if (camss->tpg) {
+		tpg = &camss->tpg[phy->csiphy_id];
+
+		if (tpg->testgen.mode > 0) {
+			val |= (phy->csiphy_id + 1) << CSI2_RX_CFG0_TPG_NUM_SEL;
+			val |= 1 << CSI2_RX_CFG0_TPG_NUM_EN;
+		} else {
+			val |= 0 << CSI2_RX_CFG0_TPG_NUM_SEL;
+			val |= 0 << CSI2_RX_CFG0_TPG_NUM_EN;
+		}
+	}
+
+	writel(val, csid->base + CSID_CSI2_RX_CFG0);
+
+	val = 1 << CSI2_RX_CFG1_ECC_CORRECTION_EN;
+	writel(val, csid->base + CSID_CSI2_RX_CFG1);
+}
+
+static void __csid_ctrl_rdi(struct csid_device *csid, int enable, u8 rdi)
+{
+	int val = 0;
+
+	if (enable)
+		val = 1 << RDI_CTRL_START_CMD;
+
+	writel(val, csid->base + CSID_RDI_CTRL(rdi));
+}
+
+static void __csid_configure_top(struct csid_device *csid)
+{
+	u32 val;
+
+	/* csid lite doesn't need to configure top register */
+	if (csid->res->is_lite)
+		return;
+
+	/* CSID top is a new function.
+	 * CSID can connect to VFE & SFE(Sensor Front End).
+	 * This connection is controlled by CSID top.
+	 * Only enable VFE path in current driver.
+	 */
+	val = OUTPUT_IFE_EN | INTERNAL_CSID;
+	writel(val, csid->camss->csid_top_base + CSID_TOP_IO_PATH_CFG0(csid->id));
+}
+
+static void __csid_configure_rdi_stream(struct csid_device *csid, u8 enable, u8 vc)
+{
+	u32 val;
+	u8 lane_cnt = csid->phy.lane_cnt;
+	/* Source pads matching RDI channels on hardware. Pad 1 -> RDI0, Pad 2 -> RDI1, etc. */
+	struct v4l2_mbus_framefmt *input_format = &csid->fmt[MSM_CSID_PAD_FIRST_SRC + vc];
+	const struct csid_format_info *format = csid_get_fmt_entry(csid->res->formats->formats,
+								   csid->res->formats->nformats,
+								   input_format->code);
+	if (!lane_cnt)
+		lane_cnt = 4;
+
+	/*
+	 * DT_ID is a two bit bitfield that is concatenated with
+	 * the four least significant bits of the five bit VC
+	 * bitfield to generate an internal CID value.
+	 *
+	 * CSID_RDI_CFG0(vc)
+	 * DT_ID : 28:27
+	 * VC    : 26:22
+	 * DT    : 21:16
+	 *
+	 * CID   : VC 3:0 << 2 | DT_ID 1:0
+	 */
+	u8 dt_id = vc & 0x03;
+
+	/* note: for non-RDI path, this should be format->decode_format */
+	val = DECODE_FORMAT_PAYLOAD_ONLY << RDI_CFG0_DECODE_FORMAT;
+	val |= vc << RDI_CFG0_VC;
+	val |= format->data_type << RDI_CFG0_DT;
+	val |= dt_id << RDI_CFG0_DT_ID;
+
+	writel(val, csid->base + CSID_RDI_CFG0(vc));
+
+	val = readl(csid->base + CSID_RDI_CFG1(vc));
+	val |= 1 << RDI_CFG1_PACKING_FORMAT;
+	val |= 1 << RDI_CFG1_DROP_H_EN;
+	val |= 1 << RDI_CFG1_DROP_V_EN;
+	val |= 1 << RDI_CFG1_CROP_H_EN;
+	val |= 1 << RDI_CFG1_CROP_V_EN;
+
+	writel(val, csid->base + CSID_RDI_CFG1(vc));
+
+	val = 0;
+	writel(val, csid->base + CSID_RDI_CTRL(vc));
+
+	val = readl(csid->base + CSID_RDI_CFG0(vc));
+
+	if (enable)
+		val |= 1 << RDI_CFG0_EN;
+	writel(val, csid->base + CSID_RDI_CFG0(vc));
+}
+
+static void csid_configure_stream(struct csid_device *csid, u8 enable)
+{
+	u8 i;
+
+	/* Loop through all enabled VCs and configure stream for each */
+	for (i = 0; i < MSM_CSID_MAX_SRC_STREAMS; i++)
+		if (csid->phy.en_vc & BIT(i)) {
+			if (!csid->res->is_lite)
+				__csid_configure_top(csid);
+			__csid_configure_rdi_stream(csid, enable, i);
+			__csid_configure_rx(csid, &csid->phy, i);
+			__csid_ctrl_rdi(csid, enable, i);
+		}
+}
+
+/*
+ * csid_isr - CSID module interrupt service routine
+ * @irq: Interrupt line
+ * @dev: CSID device
+ *
+ * Return IRQ_HANDLED on success
+ */
+static irqreturn_t csid_isr(int irq, void *dev)
+{
+	struct csid_device *csid = dev;
+	struct vfe_device *vfe = csid->camss->vfe;
+	u32 rx_irq_status, val, buf_done_val;
+	u8 reset_done;
+	int i;
+
+	val = readl(csid->base + CSID_TOP_IRQ_STATUS);
+	writel(val, csid->base + CSID_TOP_IRQ_CLEAR);
+	reset_done = val & BIT(TOP_IRQ_STATUS_RESET_DONE);
+
+	val = readl(csid->base + CSID_CSI2_RX_IRQ_STATUS);
+	rx_irq_status = val;
+	writel(val, csid->base + CSID_CSI2_RX_IRQ_CLEAR);
+
+	buf_done_val = readl(csid->base + CSID_BUF_DONE_IRQ_STATUS);
+	writel(buf_done_val, csid->base + CSID_BUF_DONE_IRQ_CLEAR);
+
+	/* Read and clear IRQ status for each enabled RDI channel */
+	for (i = 0; i < MSM_CSID_MAX_SRC_STREAMS; i++)
+		if (csid->phy.en_vc & BIT(i)) {
+			val = readl(csid->base + CSID_CSI2_RDIN_IRQ_STATUS(i));
+			writel(val, csid->base + CSID_CSI2_RDIN_IRQ_CLEAR(i));
+
+			if (buf_done_val & BIT(BUF_DONE_IRQ_STATUS_RDI_OFFSET + i)) {
+				/* For Titan 690, Buf Done IRQ&REG has been moved to CSID from VFE.
+				 * Once CSID received Buf Done, need notify this event to VFE.
+				 * Trigger VFE to handle Buf Done process.
+				 */
+				camss_buf_done(csid->camss, csid->id, i);
+			}
+		}
+
+	val = 1 << IRQ_CMD_CLEAR;
+	writel(val, csid->base + CSID_IRQ_CMD);
+
+	if (reset_done)
+		complete(&csid->reset_complete);
+
+	return IRQ_HANDLED;
+}
+
+/*
+ * csid_reset - Trigger reset on CSID module and wait to complete
+ * @csid: CSID device
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int csid_reset(struct csid_device *csid)
+{
+	unsigned long time;
+	u32 val;
+	int i;
+
+	reinit_completion(&csid->reset_complete);
+
+	writel(1, csid->base + CSID_TOP_IRQ_CLEAR);
+	writel(1, csid->base + CSID_IRQ_CMD);
+
+	/* preserve registers */
+	val = (0x1 << RST_LOCATION) | (0x1 << RST_MODE);
+	writel(val, csid->base + CSID_RST_CFG);
+
+	val = (0x1 << SELECT_SW_RST) | (0x1 << SELECT_IRQ_RST);
+	writel(val, csid->base + CSID_RST_CMD);
+
+	time = wait_for_completion_timeout(&csid->reset_complete,
+		   msecs_to_jiffies(CSID_RESET_TIMEOUT_MS));
+	if (!time) {
+		dev_err(csid->camss->dev, "CSID reset timeout\n");
+		return -EIO;
+	}
+
+	/* Buf done mask */
+	for (i = 0; i < MSM_CSID_MAX_SRC_STREAMS; i++)
+		if (csid->phy.en_vc & BIT(i)) {
+			writel(BIT(BUF_DONE_IRQ_STATUS_RDI_OFFSET + i),
+						csid->base + CSID_BUF_DONE_IRQ_CLEAR);
+			writel(0x1 << IRQ_CMD_CLEAR, csid->base + CSID_IRQ_CMD);
+			writel(BIT(BUF_DONE_IRQ_STATUS_RDI_OFFSET + i),
+						csid->base + CSID_BUF_DONE_IRQ_MASK);
+		}
+
+	return 0;
+}
+
+static void csid_subdev_reg_update(struct csid_device *csid, int port_id, bool is_clear)
+{
+	if (is_clear) {
+		csid->reg_update &= ~REG_UPDATE_RDI(csid, port_id);
+	} else {
+		csid->reg_update |= REG_UPDATE_RDI(csid, port_id);
+		writel(csid->reg_update, csid->base + CSID_REG_UPDATE_CMD);
+	}
+}
+
+static void csid_subdev_init(struct csid_device *csid)
+{
+	/* nop */
+}
+
+const struct csid_hw_ops csid_ops_gen3 = {
+	/* No testgen pattern hw in csid gen3 HW */
+	.configure_testgen_pattern = NULL,
+	.configure_stream = csid_configure_stream,
+	.hw_version = csid_hw_version,
+	.isr = csid_isr,
+	.reset = csid_reset,
+	.src_pad_code = csid_src_pad_code,
+	.subdev_init = csid_subdev_init,
+	.reg_update = csid_subdev_reg_update,
+};
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csid-gen3.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csid-gen3.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * camss-csid-gen3.h
+ *
+ * Qualcomm MSM Camera Subsystem - CSID (CSI Decoder) Module Generation 3
+ *
+ * Copyright (C) 2021 Linaro Ltd.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef QC_MSM_CAMSS_CSID_GEN3_H
+#define QC_MSM_CAMSS_CSID_GEN3_H
+
+#define DECODE_FORMAT_UNCOMPRESSED_8_BIT	0x1
+#define DECODE_FORMAT_UNCOMPRESSED_10_BIT	0x2
+#define DECODE_FORMAT_UNCOMPRESSED_12_BIT	0x3
+#define DECODE_FORMAT_UNCOMPRESSED_14_BIT	0x4
+#define DECODE_FORMAT_UNCOMPRESSED_16_BIT	0x5
+#define DECODE_FORMAT_UNCOMPRESSED_20_BIT	0x6
+#define DECODE_FORMAT_UNCOMPRESSED_24_BIT	0x7
+#define DECODE_FORMAT_PAYLOAD_ONLY		0xf
+
+
+#define PLAIN_FORMAT_PLAIN8	0x0 /* supports DPCM, UNCOMPRESSED_6/8_BIT */
+#define PLAIN_FORMAT_PLAIN16	0x1 /* supports DPCM, UNCOMPRESSED_10/16_BIT */
+#define PLAIN_FORMAT_PLAIN32	0x2 /* supports UNCOMPRESSED_20_BIT */
+
+#endif /* QC_MSM_CAMSS_CSID_GEN3_H */
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csid.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csid.c
@@ -14,6 +14,7 @@
 #include <linux/kernel.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
+#include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
 #include <linux/regulator/consumer.h>
 #include <media/media-entity.h>
@@ -45,6 +46,450 @@
 	NULL
 };
 
+static const struct csid_format_info formats_4_1[] = {
+	{
+		MEDIA_BUS_FMT_UYVY8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_VYUY8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_YUYV8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_YVYU8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_Y10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+};
+
+static const struct csid_format_info formats_4_7[] = {
+	{
+		MEDIA_BUS_FMT_UYVY8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_VYUY8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_YUYV8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_YVYU8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR14_1X14,
+		DATA_TYPE_RAW_14BIT,
+		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
+		14,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG14_1X14,
+		DATA_TYPE_RAW_14BIT,
+		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
+		14,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG14_1X14,
+		DATA_TYPE_RAW_14BIT,
+		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
+		14,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB14_1X14,
+		DATA_TYPE_RAW_14BIT,
+		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
+		14,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_Y10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+};
+
+static const struct csid_format_info formats_gen2[] = {
+	{
+		MEDIA_BUS_FMT_UYVY8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_VYUY8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_YUYV8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_YVYU8_1X16,
+		DATA_TYPE_YUV422_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		2,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_Y8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		DECODE_FORMAT_UNCOMPRESSED_8_BIT,
+		8,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_Y10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		DECODE_FORMAT_UNCOMPRESSED_10_BIT,
+		10,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		DECODE_FORMAT_UNCOMPRESSED_12_BIT,
+		12,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR14_1X14,
+		DATA_TYPE_RAW_14BIT,
+		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
+		14,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG14_1X14,
+		DATA_TYPE_RAW_14BIT,
+		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
+		14,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG14_1X14,
+		DATA_TYPE_RAW_14BIT,
+		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
+		14,
+		1,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB14_1X14,
+		DATA_TYPE_RAW_14BIT,
+		DECODE_FORMAT_UNCOMPRESSED_14_BIT,
+		14,
+		1,
+	},
+};
+
+const struct csid_formats csid_formats_4_1 = {
+	.nformats = ARRAY_SIZE(formats_4_1),
+	.formats = formats_4_1
+};
+
+const struct csid_formats csid_formats_4_7 = {
+	.nformats = ARRAY_SIZE(formats_4_7),
+	.formats = formats_4_7
+};
+
+const struct csid_formats csid_formats_gen2 = {
+	.nformats = ARRAY_SIZE(formats_gen2),
+	.formats = formats_gen2
+};
+
 u32 csid_find_code(u32 *codes, unsigned int ncodes,
 		   unsigned int match_format_idx, u32 match_code)
 {
@@ -65,9 +510,9 @@
 	return codes[0];
 }
 
-const struct csid_format *csid_get_fmt_entry(const struct csid_format *formats,
-					     unsigned int nformats,
-					     u32 code)
+const struct csid_format_info *csid_get_fmt_entry(const struct csid_format_info *formats,
+						  unsigned int nformats,
+						  u32 code)
 {
 	unsigned int i;
 
@@ -87,12 +532,12 @@
 static int csid_set_clock_rates(struct csid_device *csid)
 {
 	struct device *dev = csid->camss->dev;
-	const struct csid_format *fmt;
+	const struct csid_format_info *fmt;
 	s64 link_freq;
 	int i, j;
 	int ret;
 
-	fmt = csid_get_fmt_entry(csid->formats, csid->nformats,
+	fmt = csid_get_fmt_entry(csid->res->formats->formats, csid->res->formats->nformats,
 				 csid->fmt[MSM_CSIPHY_PAD_SINK].code);
 	link_freq = camss_get_link_freq(&csid->subdev.entity, fmt->bpp,
 					csid->phy.lane_cnt);
@@ -158,7 +603,6 @@
 	struct csid_device *csid = v4l2_get_subdevdata(sd);
 	struct camss *camss = csid->camss;
 	struct device *dev = camss->dev;
-	struct vfe_device *vfe = &camss->vfe[csid->id];
 	int ret = 0;
 
 	if (on) {
@@ -167,10 +611,11 @@
 		 * switching on the CSID. Do so unconditionally, as there is no
 		 * drawback in following the same powering order on older SoCs.
 		 */
-		ret = vfe_get(vfe);
+		ret = csid->res->parent_dev_ops->get(camss, csid->id);
 		if (ret < 0)
 			return ret;
 
+		dev_pm_genpd_set_performance_state(dev, RPMP_PERF_STATE_NOM);
 		ret = pm_runtime_resume_and_get(dev);
 		if (ret < 0)
 			return ret;
@@ -202,7 +647,7 @@
 
 		enable_irq(csid->irq);
 
-		ret = csid->ops->reset(csid);
+		ret = csid->res->hw_ops->reset(csid);
 		if (ret < 0) {
 			disable_irq(csid->irq);
 			camss_disable_clocks(csid->nclocks, csid->clock);
@@ -212,14 +657,14 @@
 			return ret;
 		}
 
-		csid->ops->hw_version(csid);
+		csid->res->hw_ops->hw_version(csid);
 	} else {
 		disable_irq(csid->irq);
 		camss_disable_clocks(csid->nclocks, csid->clock);
 		regulator_bulk_disable(csid->num_supplies,
 				       csid->supplies);
 		pm_runtime_put_sync(dev);
-		vfe_put(vfe);
+		csid->res->parent_dev_ops->put(camss, csid->id);
 	}
 
 	return ret;
@@ -253,7 +698,7 @@
 	}
 
 	if (csid->phy.need_vc_update) {
-		csid->ops->configure_stream(csid, enable);
+		csid->res->hw_ops->configure_stream(csid, enable);
 		csid->phy.need_vc_update = false;
 	}
 
@@ -301,12 +746,12 @@
 	case MSM_CSID_PAD_SINK:
 		/* Set format on sink pad */
 
-		for (i = 0; i < csid->nformats; i++)
-			if (fmt->code == csid->formats[i].code)
+		for (i = 0; i < csid->res->formats->nformats; i++)
+			if (fmt->code == csid->res->formats->formats[i].code)
 				break;
 
 		/* If not found, use UYVY as default */
-		if (i >= csid->nformats)
+		if (i >= csid->res->formats->nformats)
 			fmt->code = MEDIA_BUS_FMT_UYVY8_1X16;
 
 		fmt->width = clamp_t(u32, fmt->width, 1, 8191);
@@ -318,24 +763,24 @@
 		break;
 
 	case MSM_CSID_PAD_SRC:
-		if (csid->testgen_mode->cur.val == 0) {
+		if (!csid->testgen_mode || csid->testgen_mode->cur.val == 0) {
 			/* Test generator is disabled, */
 			/* keep pad formats in sync */
 			u32 code = fmt->code;
 
 			*fmt = *__csid_get_format(csid, sd_state,
 						      MSM_CSID_PAD_SINK, which);
-			fmt->code = csid->ops->src_pad_code(csid, fmt->code, 0, code);
+			fmt->code = csid->res->hw_ops->src_pad_code(csid, fmt->code, 0, code);
 		} else {
 			/* Test generator is enabled, set format on source */
 			/* pad to allow test generator usage */
 
-			for (i = 0; i < csid->nformats; i++)
-				if (csid->formats[i].code == fmt->code)
+			for (i = 0; i < csid->res->formats->nformats; i++)
+				if (csid->res->formats->formats[i].code == fmt->code)
 					break;
 
 			/* If not found, use UYVY as default */
-			if (i >= csid->nformats)
+			if (i >= csid->res->formats->nformats)
 				fmt->code = MEDIA_BUS_FMT_UYVY8_1X16;
 
 			fmt->width = clamp_t(u32, fmt->width, 1, 8191);
@@ -363,27 +808,27 @@
 	struct csid_device *csid = v4l2_get_subdevdata(sd);
 
 	if (code->pad == MSM_CSID_PAD_SINK) {
-		if (code->index >= csid->nformats)
+		if (code->index >= csid->res->formats->nformats)
 			return -EINVAL;
 
-		code->code = csid->formats[code->index].code;
+		code->code = csid->res->formats->formats[code->index].code;
 	} else {
-		if (csid->testgen_mode->cur.val == 0) {
+		if (!csid->testgen_mode || csid->testgen_mode->cur.val == 0) {
 			struct v4l2_mbus_framefmt *sink_fmt;
 
 			sink_fmt = __csid_get_format(csid, sd_state,
 						     MSM_CSID_PAD_SINK,
 						     code->which);
 
-			code->code = csid->ops->src_pad_code(csid, sink_fmt->code,
-						       code->index, 0);
+			code->code = csid->res->hw_ops->src_pad_code(csid, sink_fmt->code,
+								     code->index, 0);
 			if (!code->code)
 				return -EINVAL;
 		} else {
-			if (code->index >= csid->nformats)
+			if (code->index >= csid->res->formats->nformats)
 				return -EINVAL;
 
-			code->code = csid->formats[code->index].code;
+			code->code = csid->res->formats->formats[code->index].code;
 		}
 	}
 
@@ -522,6 +967,7 @@
 static int csid_set_test_pattern(struct csid_device *csid, s32 value)
 {
 	struct csid_testgen_config *tg = &csid->testgen;
+	const struct csid_hw_ops *hw_ops = csid->res->hw_ops;
 
 	/* If CSID is linked to CSIPHY, do not allow to enable test generator */
 	if (value && media_pad_remote_pad_first(&csid->pads[MSM_CSID_PAD_SINK]))
@@ -529,7 +975,7 @@
 
 	tg->enabled = !!value;
 
-	return csid->ops->configure_testgen_pattern(csid, value);
+	return csid->res->hw_ops->configure_testgen_pattern(csid, value);
 }
 
 /*
@@ -575,25 +1021,44 @@
 
 	csid->camss = camss;
 	csid->id = id;
-	csid->ops = res->ops;
+	csid->res = &res->csid;
 
-	csid->ops->subdev_init(csid);
+	if (dev_WARN_ONCE(dev, !csid->res->parent_dev_ops,
+			  "Error: CSID depends on VFE/IFE device ops!\n")) {
+		return -EINVAL;
+	}
 
-	/* Memory */
+	csid->res->hw_ops->subdev_init(csid);
 
+	/* Memory */
 	if (camss->res->version == CAMSS_8250) {
 		/* for titan 480, CSID registers are inside the VFE region,
 		 * between the VFE "top" and "bus" registers. this requires
 		 * VFE to be initialized before CSID
 		 */
 		if (id >= 2) /* VFE/CSID lite */
-			csid->base = camss->vfe[id].base + VFE_480_LITE_CSID_OFFSET;
+			csid->base = csid->res->parent_dev_ops->get_base_address(camss, id)
+				+ VFE_480_LITE_CSID_OFFSET;
 		else
-			csid->base = camss->vfe[id].base + VFE_480_CSID_OFFSET;
+			csid->base = csid->res->parent_dev_ops->get_base_address(camss, id)
+				 + VFE_480_CSID_OFFSET;
 	} else {
 		csid->base = devm_platform_ioremap_resource_byname(pdev, res->reg[0]);
 		if (IS_ERR(csid->base))
 			return PTR_ERR(csid->base);
+
+		/* CSID "top" is a new function in new version HW,
+		 * CSID can connect to VFE & SFE(Sensor Front End).
+		 * this connection is controlled by CSID "top" registers.
+		 * There is only one CSID "top" region for all CSIDs.
+		 */
+		if (!csid_is_lite(csid) && res->reg[1] && !camss->csid_top_base) {
+			camss->csid_top_base =
+				devm_platform_ioremap_resource_byname(pdev, res->reg[1]);
+
+			if (IS_ERR(camss->csid_top_base))
+				return PTR_ERR(camss->csid_top_base);
+		}
 	}
 
 	/* Interrupt */
@@ -605,7 +1070,7 @@
 	csid->irq = ret;
 	snprintf(csid->irq_name, sizeof(csid->irq_name), "%s_%s%d",
 		 dev_name(dev), MSM_CSID_NAME, csid->id);
-	ret = devm_request_irq(dev, csid->irq, csid->ops->isr,
+	ret = devm_request_irq(dev, csid->irq, csid->res->hw_ops->isr,
 			       IRQF_TRIGGER_RISING | IRQF_NO_AUTOEN,
 			       csid->irq_name, csid);
 	if (ret < 0) {
@@ -695,6 +1160,23 @@
 }
 
 /*
+ * csid_get_csiphy_tpg_lane_assign - Calculate lane assign by tpg lane num
+ * @num - tpg lane num
+ *
+ * Return lane assign
+ */
+static u32 csid_get_csiphy_tpg_lane_assign(int num)
+{
+	u32 lane_assign = 0;
+	int i;
+
+	for (i = (num - 1); i >= 0; i--)
+		lane_assign |= i << (i * 4);
+
+	return lane_assign;
+}
+
+/*
  * csid_get_lane_assign - Calculate CSI2 lane assign configuration parameter
  * @lane_cfg - CSI2 lane configuration
  *
@@ -734,28 +1216,37 @@
 		struct csid_device *csid;
 		struct csiphy_device *csiphy;
 		struct csiphy_lanes_cfg *lane_cfg;
+		struct tpg_device *tpg;
 
 		sd = media_entity_to_v4l2_subdev(entity);
 		csid = v4l2_get_subdevdata(sd);
 
 		/* If test generator is enabled */
 		/* do not allow a link from CSIPHY to CSID */
-		if (csid->testgen_mode->cur.val != 0)
+		if (csid->testgen_mode && csid->testgen_mode->cur.val != 0)
 			return -EBUSY;
 
 		sd = media_entity_to_v4l2_subdev(remote->entity);
-		csiphy = v4l2_get_subdevdata(sd);
+		if (strnstr(sd->name, MSM_TPG_NAME, strlen(MSM_TPG_NAME))) {
+			tpg = v4l2_get_subdevdata(sd);
+
+			csid->phy.lane_cnt = tpg->res->lane_cnt;
+			csid->phy.csiphy_id = tpg->id;
+			csid->phy.lane_assign = csid_get_csiphy_tpg_lane_assign(csid->phy.lane_cnt);
+		} else {
+			csiphy = v4l2_get_subdevdata(sd);
 
-		/* If a sensor is not linked to CSIPHY */
-		/* do no allow a link from CSIPHY to CSID */
-		if (!csiphy->cfg.csi2)
-			return -EPERM;
-
-		csid->phy.csiphy_id = csiphy->id;
-
-		lane_cfg = &csiphy->cfg.csi2->lane_cfg;
-		csid->phy.lane_cnt = lane_cfg->num_data;
-		csid->phy.lane_assign = csid_get_lane_assign(lane_cfg);
+			/* If a sensor is not linked to CSIPHY */
+			/* do no allow a link from CSIPHY to CSID */
+			if (!csiphy->cfg.csi2)
+				return -EPERM;
+
+			csid->phy.csiphy_id = csiphy->id;
+
+			lane_cfg = &csiphy->cfg.csi2->lane_cfg;
+			csid->phy.lane_cnt = lane_cfg->num_data;
+			csid->phy.lane_assign = csid_get_lane_assign(lane_cfg);
+		}
 	}
 	/* Decide which virtual channels to enable based on which source pads are enabled */
 	if (local->flags & MEDIA_PAD_FL_SOURCE) {
@@ -839,15 +1330,16 @@
 		return ret;
 	}
 
-	csid->testgen_mode = v4l2_ctrl_new_std_menu_items(&csid->ctrls,
+	if (csid->res->hw_ops->configure_testgen_pattern) {
+		csid->testgen_mode = v4l2_ctrl_new_std_menu_items(&csid->ctrls,
 				&csid_ctrl_ops, V4L2_CID_TEST_PATTERN,
 				csid->testgen.nmodes, 0, 0,
 				csid->testgen.modes);
-
-	if (csid->ctrls.error) {
-		dev_err(dev, "Failed to init ctrl: %d\n", csid->ctrls.error);
-		ret = csid->ctrls.error;
-		goto free_ctrl;
+		if (csid->ctrls.error) {
+			dev_err(dev, "Failed to init ctrl: %d\n", csid->ctrls.error);
+			ret = csid->ctrls.error;
+			goto free_ctrl;
+		}
 	}
 
 	csid->subdev.ctrl_handler = &csid->ctrls;
@@ -899,5 +1391,5 @@
 
 inline bool csid_is_lite(struct csid_device *csid)
 {
-	return csid->camss->res->csid_res[csid->id].is_lite;
+	return csid->camss->res->csid_res[csid->id].csid.is_lite;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csid.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csid.h
@@ -67,7 +67,7 @@
 	CSID_PAYLOAD_MODE_NUM_SUPPORTED_GEN2 = 9, /* excluding disabled */
 };
 
-struct csid_format {
+struct csid_format_info {
 	u32 code;
 	u8 data_type;
 	u8 decode_format;
@@ -75,6 +75,11 @@
 	u8 spp; /* bus samples per pixel */
 };
 
+struct csid_formats {
+	unsigned int nformats;
+	const struct csid_format_info *formats;
+};
+
 struct csid_testgen_config {
 	enum csid_testgen_mode mode;
 	const char * const*modes;
@@ -147,6 +152,21 @@
 	 * @csid: CSID device
 	 */
 	void (*subdev_init)(struct csid_device *csid);
+
+	/*
+	 * reg_update - receive message from other sub device
+	 * @csid: CSID device
+	 * @port_id: Port id
+	 * @is_clear: Indicate if it is clearing reg update or setting reg update
+	 */
+	void (*reg_update)(struct csid_device *csid, int port_id, bool is_clear);
+};
+
+struct csid_subdev_resources {
+	bool is_lite;
+	const struct csid_hw_ops *hw_ops;
+	const struct parent_dev_ops *parent_dev_ops;
+	const struct csid_formats *formats;
 };
 
 struct csid_device {
@@ -156,8 +176,8 @@
 	struct media_pad pads[MSM_CSID_PADS_NUM];
 	void __iomem *base;
 	u32 irq;
+	u32 reg_update;
 	char irq_name[30];
-	struct camss_clock *clock;
 	int nclocks;
 	struct regulator_bulk_data *supplies;
 	int num_supplies;
@@ -167,9 +187,8 @@
 	struct v4l2_mbus_framefmt fmt[MSM_CSID_PADS_NUM];
 	struct v4l2_ctrl_handler ctrls;
 	struct v4l2_ctrl *testgen_mode;
-	const struct csid_format *formats;
-	unsigned int nformats;
-	const struct csid_hw_ops *ops;
+	const struct csid_subdev_resources *res;
+	struct camss_clock *clock;
 };
 
 struct camss_subdev_resources;
@@ -188,16 +207,16 @@
 		   unsigned int match_format_idx, u32 match_code);
 
 /*
- * csid_get_fmt_entry - Find csid_format entry with matching format code
- * @formats: Array of format csid_format entries
+ * csid_get_fmt_entry - Find csid_format_info entry with matching format code
+ * @formats: Array of format csid_format_info entries
  * @nformats: Length of @nformats array
  * @code: Desired format code
  *
  * Return formats[0] on failure to find code
  */
-const struct csid_format *csid_get_fmt_entry(const struct csid_format *formats,
-					     unsigned int nformats,
-					     u32 code);
+const struct csid_format_info *csid_get_fmt_entry(const struct csid_format_info *formats,
+						  unsigned int nformats,
+						  u32 code);
 
 int msm_csid_subdev_init(struct camss *camss, struct csid_device *csid,
 			 const struct camss_subdev_resources *res, u8 id);
@@ -211,9 +230,14 @@
 
 extern const char * const csid_testgen_modes[];
 
+extern const struct csid_formats csid_formats_4_1;
+extern const struct csid_formats csid_formats_4_7;
+extern const struct csid_formats csid_formats_gen2;
+
 extern const struct csid_hw_ops csid_ops_4_1;
 extern const struct csid_hw_ops csid_ops_4_7;
 extern const struct csid_hw_ops csid_ops_gen2;
+extern const struct csid_hw_ops csid_ops_gen3;
 
 /*
  * csid_is_lite - Check if CSID is CSID lite.
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
@@ -148,6 +148,91 @@
 	},
 };
 
+/* GEN2 1.1 2PH */
+static const struct
+csiphy_reg_t lane_regs_sc8280xp[5][14] = {
+	{
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x90, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x000C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0760, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0764, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x90, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x020C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x90, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x040C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x90, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0660, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0664, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
 /* GEN2 1.2.1 2PH */
 static const struct
 csiphy_reg_t lane_regs_sm8250[5][20] = {
@@ -420,14 +505,22 @@
 	u32 val;
 
 	switch (csiphy->camss->res->version) {
-	case CAMSS_845:
-		r = &lane_regs_sdm845[0][0];
-		array_size = ARRAY_SIZE(lane_regs_sdm845[0]);
+	case CAMSS_7280:
+		r = &lane_regs_sm8250[0][0];
+		array_size = ARRAY_SIZE(lane_regs_sm8250[0]);
 		break;
 	case CAMSS_8250:
 		r = &lane_regs_sm8250[0][0];
 		array_size = ARRAY_SIZE(lane_regs_sm8250[0]);
 		break;
+	case CAMSS_8280XP:
+		r = &lane_regs_sc8280xp[0][0];
+		array_size = ARRAY_SIZE(lane_regs_sc8280xp[0]);
+		break;
+	case CAMSS_845:
+		r = &lane_regs_sdm845[0][0];
+		array_size = ARRAY_SIZE(lane_regs_sdm845[0]);
+		break;
 	default:
 		WARN(1, "unknown cspi version\n");
 		return;
@@ -463,13 +556,27 @@
 	return lane_mask;
 }
 
+static bool csiphy_is_gen2(u32 version)
+{
+	bool ret = false;
+
+	switch (version) {
+	case CAMSS_7280:
+	case CAMSS_8250:
+	case CAMSS_8280XP:
+	case CAMSS_845:
+		ret = true;
+		break;
+	}
+
+	return ret;
+}
+
 static void csiphy_lanes_enable(struct csiphy_device *csiphy,
 				struct csiphy_config *cfg,
 				s64 link_freq, u8 lane_mask)
 {
 	struct csiphy_lanes_cfg *c = &cfg->csi2->lane_cfg;
-	bool is_gen2 = (csiphy->camss->res->version == CAMSS_845 ||
-			csiphy->camss->res->version == CAMSS_8250);
 	u8 settle_cnt;
 	u8 val;
 	int i;
@@ -491,7 +598,7 @@
 	val = 0x00;
 	writel_relaxed(val, csiphy->base + CSIPHY_3PH_CMN_CSI_COMMON_CTRLn(0));
 
-	if (is_gen2)
+	if (csiphy_is_gen2(csiphy->camss->res->version))
 		csiphy_gen2_config_lanes(csiphy, settle_cnt);
 	else
 		csiphy_gen1_config_lanes(csiphy, cfg, settle_cnt);
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csiphy.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csiphy.c
@@ -24,12 +24,7 @@
 
 #define MSM_CSIPHY_NAME "msm_csiphy"
 
-struct csiphy_format {
-	u32 code;
-	u8 bpp;
-};
-
-static const struct csiphy_format csiphy_formats_8x16[] = {
+static const struct csiphy_format_info formats_8x16[] = {
 	{ MEDIA_BUS_FMT_UYVY8_1X16, 8 },
 	{ MEDIA_BUS_FMT_VYUY8_1X16, 8 },
 	{ MEDIA_BUS_FMT_YUYV8_1X16, 8 },
@@ -49,7 +44,7 @@
 	{ MEDIA_BUS_FMT_Y10_1X10, 10 },
 };
 
-static const struct csiphy_format csiphy_formats_8x96[] = {
+static const struct csiphy_format_info formats_8x96[] = {
 	{ MEDIA_BUS_FMT_UYVY8_1X16, 8 },
 	{ MEDIA_BUS_FMT_VYUY8_1X16, 8 },
 	{ MEDIA_BUS_FMT_YUYV8_1X16, 8 },
@@ -73,7 +68,7 @@
 	{ MEDIA_BUS_FMT_Y10_1X10, 10 },
 };
 
-static const struct csiphy_format csiphy_formats_sdm845[] = {
+static const struct csiphy_format_info formats_sdm845[] = {
 	{ MEDIA_BUS_FMT_UYVY8_1X16, 8 },
 	{ MEDIA_BUS_FMT_VYUY8_1X16, 8 },
 	{ MEDIA_BUS_FMT_YUYV8_1X16, 8 },
@@ -98,6 +93,31 @@
 	{ MEDIA_BUS_FMT_Y10_1X10, 10 },
 };
 
+const struct csiphy_formats csiphy_formats_8x16 = {
+	.nformats = ARRAY_SIZE(formats_8x16),
+	.formats = formats_8x16
+};
+
+const struct csiphy_formats csiphy_formats_8x96 = {
+	.nformats = ARRAY_SIZE(formats_8x96),
+	.formats = formats_8x96
+};
+
+const struct csiphy_formats csiphy_formats_sa8775p = {
+	.nformats = ARRAY_SIZE(formats_sdm845),
+	.formats = formats_sdm845
+};
+
+const struct csiphy_formats csiphy_formats_sdm845 = {
+	.nformats = ARRAY_SIZE(formats_sdm845),
+	.formats = formats_sdm845
+};
+
+const struct csiphy_formats csiphy_formats_sc7280 = {
+	.nformats = ARRAY_SIZE(formats_sdm845),
+	.formats = formats_sdm845
+};
+
 /*
  * csiphy_get_bpp - map media bus format to bits per pixel
  * @formats: supported media bus formats array
@@ -106,7 +126,7 @@
  *
  * Return number of bits per pixel
  */
-static u8 csiphy_get_bpp(const struct csiphy_format *formats,
+static u8 csiphy_get_bpp(const struct csiphy_format_info *formats,
 			 unsigned int nformats, u32 code)
 {
 	unsigned int i;
@@ -131,7 +151,7 @@
 	int i, j;
 	int ret;
 
-	u8 bpp = csiphy_get_bpp(csiphy->formats, csiphy->nformats,
+	u8 bpp = csiphy_get_bpp(csiphy->res->formats->formats, csiphy->res->formats->nformats,
 				csiphy->fmt[MSM_CSIPHY_PAD_SINK].code);
 	u8 num_lanes = csiphy->cfg.csi2->lane_cfg.num_data;
 
@@ -216,9 +236,9 @@
 
 		enable_irq(csiphy->irq);
 
-		csiphy->ops->reset(csiphy);
+		csiphy->res->hw_ops->reset(csiphy);
 
-		csiphy->ops->hw_version_read(csiphy, dev);
+		csiphy->res->hw_ops->hw_version_read(csiphy, dev);
 	} else {
 		disable_irq(csiphy->irq);
 
@@ -243,8 +263,8 @@
 {
 	struct csiphy_config *cfg = &csiphy->cfg;
 	s64 link_freq;
-	u8 lane_mask = csiphy->ops->get_lane_mask(&cfg->csi2->lane_cfg);
-	u8 bpp = csiphy_get_bpp(csiphy->formats, csiphy->nformats,
+	u8 lane_mask = csiphy->res->hw_ops->get_lane_mask(&cfg->csi2->lane_cfg);
+	u8 bpp = csiphy_get_bpp(csiphy->res->formats->formats, csiphy->res->formats->nformats,
 				csiphy->fmt[MSM_CSIPHY_PAD_SINK].code);
 	u8 num_lanes = csiphy->cfg.csi2->lane_cfg.num_data;
 	u8 val;
@@ -272,7 +292,7 @@
 		wmb();
 	}
 
-	csiphy->ops->lanes_enable(csiphy, cfg, link_freq, lane_mask);
+	csiphy->res->hw_ops->lanes_enable(csiphy, cfg, link_freq, lane_mask);
 
 	return 0;
 }
@@ -285,7 +305,7 @@
  */
 static void csiphy_stream_off(struct csiphy_device *csiphy)
 {
-	csiphy->ops->lanes_disable(csiphy, &csiphy->cfg);
+	csiphy->res->hw_ops->lanes_disable(csiphy, &csiphy->cfg);
 }
 
 
@@ -350,12 +370,12 @@
 	case MSM_CSIPHY_PAD_SINK:
 		/* Set format on sink pad */
 
-		for (i = 0; i < csiphy->nformats; i++)
-			if (fmt->code == csiphy->formats[i].code)
+		for (i = 0; i < csiphy->res->formats->nformats; i++)
+			if (fmt->code == csiphy->res->formats->formats[i].code)
 				break;
 
 		/* If not found, use UYVY as default */
-		if (i >= csiphy->nformats)
+		if (i >= csiphy->res->formats->nformats)
 			fmt->code = MEDIA_BUS_FMT_UYVY8_1X16;
 
 		fmt->width = clamp_t(u32, fmt->width, 1, 8191);
@@ -392,10 +412,10 @@
 	struct v4l2_mbus_framefmt *format;
 
 	if (code->pad == MSM_CSIPHY_PAD_SINK) {
-		if (code->index >= csiphy->nformats)
+		if (code->index >= csiphy->res->formats->nformats)
 			return -EINVAL;
 
-		code->code = csiphy->formats[code->index].code;
+		code->code = csiphy->res->formats->formats[code->index].code;
 	} else {
 		if (code->index > 0)
 			return -EINVAL;
@@ -564,24 +584,7 @@
 	csiphy->camss = camss;
 	csiphy->id = id;
 	csiphy->cfg.combo_mode = 0;
-	csiphy->ops = res->ops;
-
-	switch (camss->res->version) {
-	case CAMSS_8x16:
-		csiphy->formats = csiphy_formats_8x16;
-		csiphy->nformats = ARRAY_SIZE(csiphy_formats_8x16);
-		break;
-	case CAMSS_8x96:
-	case CAMSS_660:
-		csiphy->formats = csiphy_formats_8x96;
-		csiphy->nformats = ARRAY_SIZE(csiphy_formats_8x96);
-		break;
-	case CAMSS_845:
-	case CAMSS_8250:
-		csiphy->formats = csiphy_formats_sdm845;
-		csiphy->nformats = ARRAY_SIZE(csiphy_formats_sdm845);
-		break;
-	}
+	csiphy->res = &res->csiphy;
 
 	/* Memory */
 
@@ -609,7 +612,7 @@
 	snprintf(csiphy->irq_name, sizeof(csiphy->irq_name), "%s_%s%d",
 		 dev_name(dev), MSM_CSIPHY_NAME, csiphy->id);
 
-	ret = devm_request_irq(dev, csiphy->irq, csiphy->ops->isr,
+	ret = devm_request_irq(dev, csiphy->irq, csiphy->res->hw_ops->isr,
 			       IRQF_TRIGGER_RISING | IRQF_NO_AUTOEN,
 			       csiphy->irq_name, csiphy);
 	if (ret < 0) {
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-csiphy.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-csiphy.h
@@ -42,6 +42,16 @@
 	struct csiphy_csi2_cfg *csi2;
 };
 
+struct csiphy_format_info {
+	u32 code;
+	u8 bpp;
+};
+
+struct csiphy_formats {
+	unsigned int nformats;
+	const struct csiphy_format_info *formats;
+};
+
 struct csiphy_device;
 
 struct csiphy_hw_ops {
@@ -63,6 +73,11 @@
 	irqreturn_t (*isr)(int irq, void *dev);
 };
 
+struct csiphy_subdev_resources {
+	const struct csiphy_hw_ops *hw_ops;
+	const struct csiphy_formats *formats;
+};
+
 struct csiphy_device {
 	struct camss *camss;
 	u8 id;
@@ -78,9 +93,7 @@
 	u32 timer_clk_rate;
 	struct csiphy_config cfg;
 	struct v4l2_mbus_framefmt fmt[MSM_CSIPHY_PADS_NUM];
-	const struct csiphy_hw_ops *ops;
-	const struct csiphy_format *formats;
-	unsigned int nformats;
+	const struct csiphy_subdev_resources *res;
 };
 
 struct camss_subdev_resources;
@@ -94,6 +107,12 @@
 
 void msm_csiphy_unregister_entity(struct csiphy_device *csiphy);
 
+extern const struct csiphy_formats csiphy_formats_8x16;
+extern const struct csiphy_formats csiphy_formats_8x96;
+extern const struct csiphy_formats csiphy_formats_sa8775p;
+extern const struct csiphy_formats csiphy_formats_sdm845;
+extern const struct csiphy_formats csiphy_formats_sc7280;
+
 extern const struct csiphy_hw_ops csiphy_ops_2ph_1_0;
 extern const struct csiphy_hw_ops csiphy_ops_3ph_1_0;
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-format.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-format.c
@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * camss-format.c
+ *
+ * Qualcomm MSM Camera Subsystem - Format helpers
+ *
+ * Copyright (c) 2023, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Technologies, Inc.
+ */
+#include <linux/bug.h>
+#include <linux/errno.h>
+
+#include "camss-format.h"
+
+/*
+ * camss_format_get_bpp - Map media bus format to bits per pixel
+ * @formats: supported media bus formats array
+ * @nformats: size of @formats array
+ * @code: media bus format code
+ *
+ * Return number of bits per pixel
+ */
+u8 camss_format_get_bpp(const struct camss_format_info *formats, unsigned int nformats, u32 code)
+{
+	unsigned int i;
+
+	for (i = 0; i < nformats; i++)
+		if (code == formats[i].code)
+			return formats[i].mbus_bpp;
+
+	WARN(1, "Unknown format\n");
+
+	return formats[0].mbus_bpp;
+}
+
+/*
+ * camss_format_find_code - Find a format code in an array
+ * @code: a pointer to media bus format codes array
+ * @n_code: size of @code array
+ * @index: index of code in the array
+ * @req_code: required code
+ *
+ * Return media bus format code
+ */
+u32 camss_format_find_code(u32 *code, unsigned int n_code, unsigned int index, u32 req_code)
+{
+	unsigned int i;
+
+	if (!req_code && index >= n_code)
+		return 0;
+
+	for (i = 0; i < n_code; i++) {
+		if (req_code) {
+			if (req_code == code[i])
+				return req_code;
+		} else {
+			if (i == index)
+				return code[i];
+		}
+	}
+
+	return code[0];
+}
+
+/*
+ * camss_format_find_format - Find a format in an array
+ * @code: media bus format code
+ * @pixelformat: V4L2 pixel format FCC identifier
+ * @formats: a pointer to formats array
+ * @nformats: size of @formats array
+ *
+ * Return index of a format or a negative error code otherwise
+ */
+int camss_format_find_format(u32 code, u32 pixelformat, const struct camss_format_info *formats,
+			     unsigned int nformats)
+{
+	unsigned int i;
+
+	for (i = 0; i < nformats; i++) {
+		if (formats[i].code == code &&
+		    formats[i].pixelformat == pixelformat)
+			return i;
+	}
+
+	for (i = 0; i < nformats; i++) {
+		if (formats[i].code == code)
+			return i;
+	}
+
+	return -EINVAL;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-format.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-format.h
@@ -0,0 +1,62 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * camss-format.h
+ *
+ * Qualcomm MSM Camera Subsystem - Format helpers
+ *
+ * Copyright (c) 2023, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Technologies, Inc.
+ */
+#ifndef __CAMSS_FORMAT_H__
+#define __CAMSS_FORMAT_H__
+
+#include <linux/types.h>
+
+#define PER_PLANE_DATA(plane, h_fract_num, h_fract_den, v_fract_num, v_fract_den, _bpp)         \
+	.hsub[(plane)].numerator	= (h_fract_num),                                        \
+	.hsub[(plane)].denominator	= (h_fract_den),                                        \
+	.vsub[(plane)].numerator	= (v_fract_num),                                        \
+	.vsub[(plane)].denominator	= (v_fract_den),                                        \
+	.bpp[(plane)]			= (_bpp)
+
+/*
+ * struct fract - Represents a fraction
+ * @numerator: Store the numerator part of the fraction
+ * @denominator: Store the denominator part of the fraction
+ */
+struct fract {
+	u8 numerator;
+	u8 denominator;
+};
+
+/*
+ * struct camss_format_info - ISP media bus format information
+ * @code: V4L2 media bus format code
+ * @mbus_bpp: Media bus bits per pixel
+ * @pixelformat: V4L2 pixel format FCC identifier
+ * @planes: Number of planes
+ * @hsub: Horizontal subsampling (for each plane)
+ * @vsub: Vertical subsampling (for each plane)
+ * @bpp: Bits per pixel when stored in memory (for each plane)
+ */
+struct camss_format_info {
+	u32 code;
+	u32 mbus_bpp;
+	u32 pixelformat;
+	u8 planes;
+	struct fract hsub[3];
+	struct fract vsub[3];
+	unsigned int bpp[3];
+};
+
+struct camss_formats {
+	unsigned int nformats;
+	const struct camss_format_info *formats;
+};
+
+u8 camss_format_get_bpp(const struct camss_format_info *formats, unsigned int nformats, u32 code);
+u32 camss_format_find_code(u32 *code, unsigned int n_code, unsigned int index, u32 req_code);
+int camss_format_find_format(u32 code, u32 pixelformat, const struct camss_format_info *formats,
+			     unsigned int nformats);
+
+#endif /* __CAMSS_FORMAT_H__ */
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-tpg-gen1.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-tpg-gen1.c
@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * camss-tpg-gen1.c
+ *
+ * Qualcomm MSM Camera Subsystem - TPG (Test Patter Generator) Module
+ *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/completion.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/of.h>
+
+#include "camss-tpg.h"
+#include "camss.h"
+
+#define TPG_HW_VERSION		0x0
+#define		HW_VERSION_STEPPING		0
+#define		HW_VERSION_REVISION		16
+#define		HW_VERSION_GENERATION		28
+
+#define TPG_HW_STATUS		0x4
+
+#define TPG_VC_n_GAIN_CFG(n)	(0x60 + (n) * 0x60)
+
+#define TPG_CTRL	0x64
+#define		TPG_CTRL_TEST_EN		0
+#define		TPG_CTRL_PHY_SEL		3
+#define		TPG_CTRL_NUM_ACTIVE_LANES	4
+#define		TPG_CTRL_VC_DT_PATTERN_ID	6
+#define		TPG_CTRL_OVERLAP_SHDR_EN	10
+#define		TPG_CTRL_NUM_ACTIVE_VC		30
+#define			NUM_ACTIVE_VC_0_ENABLED		0
+#define			NUM_ACTIVE_VC_0_1_ENABLED	1
+#define			NUM_ACTIVE_VC_0_1_2_ENABLED	2
+#define			NUM_ACTIVE_VC_0_1_3_ENABLED	3
+
+#define TPG_VC_n_CFG0(n)	(0x68 + (n) * 0x60)
+#define		TPG_VC_n_CFG0_VC_NUM		0
+#define		TPG_VC_n_CFG0_NUM_ACTIVE_DT	8
+#define			NUM_ACTIVE_SLOTS_0_ENABLED		0
+#define			NUM_ACTIVE_SLOTS_0_1_ENABLED		1
+#define			NUM_ACTIVE_SLOTS_0_1_2_ENABLED		2
+#define			NUM_ACTIVE_SLOTS_0_1_3_ENABLED		3
+#define		TPG_VC_n_CFG0_NUM_BATCH		12
+#define		TPG_VC_n_CFG0_NUM_FRAMES	16
+
+#define TPG_VC_n_LSFR_SEED(n)		(0x6C + (n) * 0x60)
+
+#define TPG_VC_n_HBI_CFG(n)		(0x70 + (n) * 0x60)
+
+#define TPG_VC_n_VBI_CFG(n)		(0x74 + (n) * 0x60)
+
+#define TPG_VC_n_COLOR_BARS_CFG(n)		(0x78 + (n) * 0x60)
+#define		TPG_VC_n_COLOR_BARS_CFG_PIX_PATTERN		0
+#define		TPG_VC_n_COLOR_BARS_CFG_QCFA_EN			3
+#define		TPG_VC_n_COLOR_BARS_CFG_SPLIT_EN		4
+#define		TPG_VC_n_COLOR_BARS_CFG_NOISE_EN		5
+#define		TPG_VC_n_COLOR_BARS_CFG_ROTATE_PERIOD		8
+#define		TPG_VC_n_COLOR_BARS_CFG_XCFA_EN			16
+#define		TPG_VC_n_COLOR_BARS_CFG_SIZE_X			24
+#define		TPG_VC_n_COLOR_BARS_CFG_SIZE_Y			28
+
+#define TPG_VC_m_DT_n_CFG_0(m, n)	(0x7C + (m) * 0x60 + (n) * 0xC)
+#define		TPG_VC_m_DT_n_CFG_0_FRAME_HEIGHT	0
+#define		TPG_VC_m_DT_n_CFG_0_FRAME_WIDTH		16
+
+#define TPG_VC_m_DT_n_CFG_1(m, n)	(0x80 + (m) * 0x60 + (n) * 0xC)
+#define		TPG_VC_m_DT_n_CFG_1_DATA_TYPE		0
+#define		TPG_VC_m_DT_n_CFG_1_ECC_XOR_MASK	8
+#define		TPG_VC_m_DT_n_CFG_1_CRC_XOR_MASK	16
+
+#define TPG_VC_m_DT_n_CFG_2(m, n)	(0x84 + (m) * 0x60 + (n) * 0xC)
+#define		TPG_VC_m_DT_n_CFG_2_PAYLOAD_MODE		0
+#define		TPG_VC_m_DT_n_CFG_2_USER_SPECIFIED_PAYLOAD	4
+#define		TPG_VC_m_DT_n_CFG_2_ENCODE_FORMAT		28
+
+#define TPG_VC_n_COLOR_BAR_CFA_COLOR0(n)	(0xB0 + (n) * 0x60)
+#define TPG_VC_n_COLOR_BAR_CFA_COLOR1(n)	(0xB4 + (n) * 0x60)
+#define TPG_VC_n_COLOR_BAR_CFA_COLOR2(n)	(0xB8 + (n) * 0x60)
+#define TPG_VC_n_COLOR_BAR_CFA_COLOR3(n)	(0xBC + (n) * 0x60)
+
+/* Line offset between VC(n) and VC(n-1), n form 1 to 3 */
+#define TPG_VC_n_SHDR_CFG	(0x84 + (n) * 0x60)
+
+#define TPG_TOP_IRQ_STATUS	0x1E0
+#define TPG_TOP_IRQ_MASK	0x1E4
+#define TPG_TOP_IRQ_CLEAR	0x1E8
+#define TPG_TOP_IRQ_SET		0x1EC
+#define TPG_IRQ_CMD		0x1F0
+#define TPG_CLEAR		0x1F4
+
+static int tpg_stream_on(struct tpg_device *tpg)
+{
+	struct tpg_testgen_config *tg = &tpg->testgen;
+	struct v4l2_mbus_framefmt *input_format;
+	const struct tpg_format_info *format;
+	u8 lane_cnt = tpg->res->lane_cnt;
+	u8 i;
+	u8 dt_cnt = 0;
+	u32 val;
+
+	/* Loop through all enabled VCs and configure stream for each */
+	for (i = 0; i < tpg->res->vc_cnt; i++) {
+		input_format = &tpg->fmt[MSM_TPG_PAD_SRC + i];
+		format = tpg_get_fmt_entry(tpg->res->formats->formats,
+					   tpg->res->formats->nformats,
+					   input_format->code);
+
+		val = (input_format->height & 0xffff) << TPG_VC_m_DT_n_CFG_0_FRAME_HEIGHT;
+		val |= (input_format->width & 0xffff) << TPG_VC_m_DT_n_CFG_0_FRAME_WIDTH;
+		writel_relaxed(val, tpg->base + TPG_VC_m_DT_n_CFG_0(i, dt_cnt));
+
+		val = format->data_type << TPG_VC_m_DT_n_CFG_1_DATA_TYPE;
+		writel_relaxed(val, tpg->base + TPG_VC_m_DT_n_CFG_1(i, dt_cnt));
+
+		val = (tg->mode - 1) << TPG_VC_m_DT_n_CFG_2_PAYLOAD_MODE;
+		val |= 0xBE << TPG_VC_m_DT_n_CFG_2_USER_SPECIFIED_PAYLOAD;
+		val |= format->encode_format << TPG_VC_m_DT_n_CFG_2_ENCODE_FORMAT;
+		writel_relaxed(val, tpg->base + TPG_VC_m_DT_n_CFG_2(i, dt_cnt));
+
+		writel_relaxed(0xA00, tpg->base + TPG_VC_n_COLOR_BARS_CFG(i));
+
+		writel_relaxed(0x4701, tpg->base + TPG_VC_n_HBI_CFG(i));
+		writel_relaxed(0x438, tpg->base + TPG_VC_n_VBI_CFG(i));
+
+		writel_relaxed(0x12345678, tpg->base + TPG_VC_n_LSFR_SEED(i));
+
+		/* configure one DT, infinite frames */
+		val = i << TPG_VC_n_CFG0_VC_NUM;
+		val |= 0 << TPG_VC_n_CFG0_NUM_FRAMES;
+		writel_relaxed(val, tpg->base + TPG_VC_n_CFG0(i));
+	}
+
+	writel_relaxed(1, tpg->base + TPG_TOP_IRQ_MASK);
+
+	val = 1 << TPG_CTRL_TEST_EN;
+	val |= 0 << TPG_CTRL_PHY_SEL;
+	val |= (lane_cnt - 1) << TPG_CTRL_NUM_ACTIVE_LANES;
+	val |= 0 << TPG_CTRL_VC_DT_PATTERN_ID;
+	val |= (tpg->res->vc_cnt - 1) << TPG_CTRL_NUM_ACTIVE_VC;
+	writel_relaxed(val, tpg->base + TPG_CTRL);
+
+	return 0;
+}
+
+static void tpg_stream_off(struct tpg_device *tpg)
+{
+	writel_relaxed(0, tpg->base + TPG_CTRL);
+	writel_relaxed(0, tpg->base + TPG_TOP_IRQ_MASK);
+	writel_relaxed(1, tpg->base + TPG_TOP_IRQ_CLEAR);
+	writel_relaxed(1, tpg->base + TPG_IRQ_CMD);
+	writel_relaxed(1, tpg->base + TPG_CLEAR);
+}
+
+static void tpg_configure_stream(struct tpg_device *tpg, u8 enable)
+{
+	if (enable)
+		tpg_stream_on(tpg);
+	else
+		tpg_stream_off(tpg);
+}
+
+static int tpg_configure_testgen_pattern(struct tpg_device *tpg, s32 val)
+{
+	if (val > 0 && val <= TPG_PAYLOAD_MODE_COLOR_BARS)
+		tpg->testgen.mode = val;
+
+	return 0;
+}
+
+/*
+ * tpg_hw_version - tpg hardware version query
+ * @tpg: tpg device
+ *
+ * Return HW version or error
+ */
+static u32 tpg_hw_version(struct tpg_device *tpg)
+{
+	u32 hw_version;
+	u32 hw_gen;
+	u32 hw_rev;
+	u32 hw_step;
+
+	hw_version = readl_relaxed(tpg->base + TPG_HW_VERSION);
+	hw_gen = (hw_version >> HW_VERSION_GENERATION) & 0xF;
+	hw_rev = (hw_version >> HW_VERSION_REVISION) & 0xFFF;
+	hw_step = (hw_version >> HW_VERSION_STEPPING) & 0xFFFF;
+	dev_dbg(tpg->camss->dev, "tpg HW Version = %u.%u.%u\n",
+		hw_gen, hw_rev, hw_step);
+
+	return hw_version;
+}
+
+/*
+ * tpg_isr - tpg module interrupt service routine
+ * @irq: Interrupt line
+ * @dev: tpg device
+ *
+ * Return IRQ_HANDLED on success
+ */
+static irqreturn_t tpg_isr(int irq, void *dev)
+{
+	struct tpg_device *tpg = dev;
+	u32 val;
+
+	val = readl_relaxed(tpg->base + TPG_TOP_IRQ_STATUS);
+	writel_relaxed(val, tpg->base + TPG_TOP_IRQ_CLEAR);
+	writel_relaxed(1, tpg->base + TPG_IRQ_CMD);
+
+	return IRQ_HANDLED;
+}
+
+/*
+ * tpg_reset - Trigger reset on tpg module and wait to complete
+ * @tpg: tpg device
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int tpg_reset(struct tpg_device *tpg)
+{
+	writel_relaxed(0, tpg->base + TPG_CTRL);
+	writel_relaxed(0, tpg->base + TPG_TOP_IRQ_MASK);
+	writel_relaxed(1, tpg->base + TPG_TOP_IRQ_CLEAR);
+	writel_relaxed(1, tpg->base + TPG_IRQ_CMD);
+	writel_relaxed(1, tpg->base + TPG_CLEAR);
+
+	return 0;
+}
+
+static void tpg_subdev_init(struct tpg_device *tpg)
+{
+	tpg->testgen.modes = testgen_payload_modes;
+	tpg->testgen.nmodes = TPG_PAYLOAD_MODE_DISABLED;
+}
+
+const struct tpg_hw_ops tpg_ops_gen1 = {
+	.configure_stream = tpg_configure_stream,
+	.configure_testgen_pattern = tpg_configure_testgen_pattern,
+	.hw_version = tpg_hw_version,
+	.isr = tpg_isr,
+	.reset = tpg_reset,
+	.subdev_init = tpg_subdev_init,
+};
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-tpg.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-tpg.c
@@ -0,0 +1,738 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * camss-tpg.c
+ *
+ * Qualcomm MSM Camera Subsystem - TPG Module
+ *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <media/media-entity.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-subdev.h>
+
+#include "camss-tpg.h"
+#include "camss.h"
+
+const char * const testgen_payload_modes[] = {
+	"Disabled",
+	"Incrementing",
+	"Alternating 0x55/0xAA",
+	NULL,
+	NULL,
+	"Pseudo-random Data",
+	"User Specified",
+	NULL,
+	NULL,
+	"Color bars",
+	NULL
+};
+
+static const struct tpg_format_info formats_gen1[] = {
+	{
+		MEDIA_BUS_FMT_SBGGR8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_8_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_8_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_8_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_8_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_10_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_10_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_10_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_10_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SBGGR12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_12_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SGBRG12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_12_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SGRBG12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_12_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_SRGGB12_1X12,
+		DATA_TYPE_RAW_12BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_12_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_Y8_1X8,
+		DATA_TYPE_RAW_8BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_8_BIT,
+	},
+	{
+		MEDIA_BUS_FMT_Y10_1X10,
+		DATA_TYPE_RAW_10BIT,
+		ENCODE_FORMAT_UNCOMPRESSED_10_BIT,
+	},
+};
+
+const struct tpg_formats tpg_formats_gen1 = {
+	.nformats = ARRAY_SIZE(formats_gen1),
+	.formats = formats_gen1
+};
+
+
+const struct tpg_format_info *tpg_get_fmt_entry(const struct tpg_format_info *formats,
+						unsigned int nformats,
+						u32 code)
+{
+	unsigned int i;
+
+	for (i = 0; i < nformats; i++)
+		if (code == formats[i].code)
+			return &formats[i];
+
+	WARN(1, "Unknown format\n");
+
+	return &formats[0];
+}
+
+/*
+ * tpg_set_clock_rates - Calculate and set clock rates on tpg module
+ * @tpg: tpg device
+ */
+static int tpg_set_clock_rates(struct tpg_device *tpg)
+{
+	struct device *dev = tpg->camss->dev;
+	int i, j;
+	int ret;
+
+	for (i = 0; i < tpg->nclocks; i++) {
+		struct camss_clock *clock = &tpg->clock[i];
+		u64 min_rate = 0;
+		long round_rate;
+
+		camss_add_clock_margin(&min_rate);
+
+		for (j = 0; j < clock->nfreqs; j++)
+			if (min_rate < clock->freq[j])
+				break;
+
+		if (j == clock->nfreqs) {
+			dev_err(dev,
+				"clock is too high for TPG\n");
+			return -EINVAL;
+		}
+
+		/* if clock is not available */
+		/* set highest possible tpg clock rate */
+		if (min_rate == 0)
+			j = clock->nfreqs - 1;
+
+		round_rate = clk_round_rate(clock->clk, clock->freq[j]);
+		if (round_rate < 0) {
+			dev_err(dev, "clk round rate failed: %ld\n",
+				round_rate);
+			return -EINVAL;
+		}
+
+		tpg->timer_clk_rate = round_rate;
+
+		ret = clk_set_rate(clock->clk, tpg->timer_clk_rate);
+		if (ret < 0) {
+			dev_err(dev, "clk set rate failed: %d\n", ret);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * tpg_set_power - Power on/off tpg module
+ * @sd: tpg V4L2 subdevice
+ * @on: Requested power state
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int tpg_set_power(struct v4l2_subdev *sd, int on)
+{
+	struct tpg_device *tpg = v4l2_get_subdevdata(sd);
+	struct device *dev = tpg->camss->dev;
+
+	if (on) {
+		int ret;
+
+		ret = pm_runtime_resume_and_get(dev);
+		if (ret < 0)
+			return ret;
+
+		ret = tpg_set_clock_rates(tpg);
+		if (ret < 0) {
+			pm_runtime_put_sync(dev);
+			return ret;
+		}
+
+		ret = camss_enable_clocks(tpg->nclocks, tpg->clock, dev);
+		if (ret < 0) {
+			pm_runtime_put_sync(dev);
+			return ret;
+		}
+
+		enable_irq(tpg->irq);
+
+		tpg->res->hw_ops->reset(tpg);
+
+		tpg->res->hw_ops->hw_version(tpg);
+	} else {
+		disable_irq(tpg->irq);
+
+		camss_disable_clocks(tpg->nclocks, tpg->clock);
+
+		pm_runtime_put_sync(dev);
+	}
+
+	return 0;
+}
+
+
+/*
+ * tpg_set_stream - Enable/disable streaming on tpg module
+ * @sd: tpg V4L2 subdevice
+ * @enable: Requested streaming state
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int tpg_set_stream(struct v4l2_subdev *sd, int enable)
+{
+	struct tpg_device *tpg = v4l2_get_subdevdata(sd);
+	int ret = 0;
+
+	if (enable) {
+		ret = v4l2_ctrl_handler_setup(&tpg->ctrls);
+		if (ret < 0) {
+			dev_err(tpg->camss->dev,
+				"could not sync v4l2 controls: %d\n", ret);
+			return ret;
+		}
+	}
+
+	tpg->res->hw_ops->configure_stream(tpg, enable);
+
+	return 0;
+}
+
+/*
+ * __tpg_get_format - Get pointer to format structure
+ * @tpg: tpg device
+ * @cfg: V4L2 subdev pad configuration
+ * @pad: pad from which format is requested
+ * @which: TRY or ACTIVE format
+ *
+ * Return pointer to TRY or ACTIVE format structure
+ */
+static struct v4l2_mbus_framefmt *
+__tpg_get_format(struct tpg_device *tpg,
+		 struct v4l2_subdev_state *sd_state,
+		 unsigned int pad,
+		 enum v4l2_subdev_format_whence which)
+{
+	if (which == V4L2_SUBDEV_FORMAT_TRY)
+		return v4l2_subdev_state_get_format(sd_state, pad);
+
+	return &tpg->fmt[pad];
+}
+
+/*
+ * tpg_try_format - Handle try format by pad subdev method
+ * @tpg: tpg device
+ * @cfg: V4L2 subdev pad configuration
+ * @pad: pad on which format is requested
+ * @fmt: pointer to v4l2 format structure
+ * @which: wanted subdev format
+ */
+static void tpg_try_format(struct tpg_device *tpg,
+			   struct v4l2_subdev_state *sd_state,
+			   unsigned int pad,
+			   struct v4l2_mbus_framefmt *fmt,
+			   enum v4l2_subdev_format_whence which)
+{
+	unsigned int i;
+
+	switch (pad) {
+	case MSM_TPG_PAD_SINK:
+		/* Test generator is enabled, set format on source */
+		/* pad to allow test generator usage */
+
+		for (i = 0; i < tpg->res->formats->nformats; i++)
+			if (tpg->res->formats->formats[i].code == fmt->code)
+				break;
+
+		/* If not found, use SBGGR8 as default */
+		if (i >= tpg->res->formats->nformats)
+			fmt->code = MEDIA_BUS_FMT_SBGGR8_1X8;
+
+		fmt->width = clamp_t(u32, fmt->width, 1, 8191);
+		fmt->height = clamp_t(u32, fmt->height, 1, 8191);
+
+		fmt->field = V4L2_FIELD_NONE;
+		fmt->colorspace = V4L2_COLORSPACE_SRGB;
+
+		break;
+	case MSM_TPG_PAD_SRC:
+		/* Set and return a format same as sink pad */
+
+		*fmt = *__tpg_get_format(tpg, sd_state,
+					    MSM_TPG_PAD_SINK,
+					    which);
+
+		break;
+	}
+}
+
+/*
+ * tpg_enum_mbus_code - Handle format enumeration
+ * @sd: tpg V4L2 subdevice
+ * @cfg: V4L2 subdev pad configuration
+ * @code: pointer to v4l2_subdev_mbus_code_enum structure
+ * return -EINVAL or zero on success
+ */
+static int tpg_enum_mbus_code(struct v4l2_subdev *sd,
+			      struct v4l2_subdev_state *sd_state,
+			      struct v4l2_subdev_mbus_code_enum *code)
+{
+	struct tpg_device *tpg = v4l2_get_subdevdata(sd);
+	struct v4l2_mbus_framefmt *format;
+
+	if (code->pad == MSM_TPG_PAD_SINK) {
+		if (code->index >= tpg->res->formats->nformats)
+			return -EINVAL;
+
+		code->code = tpg->res->formats->formats[code->index].code;
+	} else {
+		if (code->index > 0)
+			return -EINVAL;
+
+		format = __tpg_get_format(tpg, sd_state,
+					     MSM_TPG_PAD_SINK,
+					     code->which);
+
+		code->code = format->code;
+	}
+
+	return 0;
+}
+
+/*
+ * tpg_enum_frame_size - Handle frame size enumeration
+ * @sd: tpg V4L2 subdevice
+ * @cfg: V4L2 subdev pad configuration
+ * @fse: pointer to v4l2_subdev_frame_size_enum structure
+ * return -EINVAL or zero on success
+ */
+static int tpg_enum_frame_size(struct v4l2_subdev *sd,
+			       struct v4l2_subdev_state *sd_state,
+			       struct v4l2_subdev_frame_size_enum *fse)
+{
+	struct tpg_device *tpg = v4l2_get_subdevdata(sd);
+	struct v4l2_mbus_framefmt format;
+
+	if (fse->index != 0)
+		return -EINVAL;
+
+	format.code = fse->code;
+	format.width = 1;
+	format.height = 1;
+	tpg_try_format(tpg, sd_state, fse->pad, &format, fse->which);
+	fse->min_width = format.width;
+	fse->min_height = format.height;
+
+	if (format.code != fse->code)
+		return -EINVAL;
+
+	format.code = fse->code;
+	format.width = -1;
+	format.height = -1;
+	tpg_try_format(tpg, sd_state, fse->pad, &format, fse->which);
+	fse->max_width = format.width;
+	fse->max_height = format.height;
+
+	return 0;
+}
+
+/*
+ * tpg_get_format - Handle get format by pads subdev method
+ * @sd: tpg V4L2 subdevice
+ * @cfg: V4L2 subdev pad configuration
+ * @fmt: pointer to v4l2 subdev format structure
+ *
+ * Return -EINVAL or zero on success
+ */
+static int tpg_get_format(struct v4l2_subdev *sd,
+			  struct v4l2_subdev_state *sd_state,
+			  struct v4l2_subdev_format *fmt)
+{
+	struct tpg_device *tpg = v4l2_get_subdevdata(sd);
+	struct v4l2_mbus_framefmt *format;
+
+	format = __tpg_get_format(tpg, sd_state, fmt->pad, fmt->which);
+	if (format == NULL)
+		return -EINVAL;
+
+	fmt->format = *format;
+
+	return 0;
+}
+
+/*
+ * tpg_set_format - Handle set format by pads subdev method
+ * @sd: tpg V4L2 subdevice
+ * @cfg: V4L2 subdev pad configuration
+ * @fmt: pointer to v4l2 subdev format structure
+ *
+ * Return -EINVAL or zero on success
+ */
+static int tpg_set_format(struct v4l2_subdev *sd,
+			  struct v4l2_subdev_state *sd_state,
+			  struct v4l2_subdev_format *fmt)
+{
+	struct tpg_device *tpg = v4l2_get_subdevdata(sd);
+	struct v4l2_mbus_framefmt *format;
+
+	format = __tpg_get_format(tpg, sd_state, fmt->pad, fmt->which);
+	if (format == NULL)
+		return -EINVAL;
+
+	tpg_try_format(tpg, sd_state, fmt->pad, &fmt->format,
+			  fmt->which);
+	*format = fmt->format;
+
+	if (fmt->pad == MSM_TPG_PAD_SINK) {
+		format = __tpg_get_format(tpg, sd_state,
+					     MSM_TPG_PAD_SRC,
+					     fmt->which);
+
+		*format = fmt->format;
+		tpg_try_format(tpg, sd_state, MSM_TPG_PAD_SRC,
+				  format,
+				  fmt->which);
+	}
+	return 0;
+}
+
+/*
+ * tpg_init_formats - Initialize formats on all pads
+ * @sd: tpg V4L2 subdevice
+ * @fh: V4L2 subdev file handle
+ *
+ * Initialize all pad formats with default values.
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int tpg_init_formats(struct v4l2_subdev *sd,
+			    struct v4l2_subdev_fh *fh)
+{
+	struct v4l2_subdev_format format = {
+		.pad = MSM_TPG_PAD_SINK,
+		.which = fh ? V4L2_SUBDEV_FORMAT_TRY :
+			      V4L2_SUBDEV_FORMAT_ACTIVE,
+		.format = {
+			.code = MEDIA_BUS_FMT_SBGGR8_1X8,
+			.width = 1920,
+			.height = 1080
+		}
+	};
+
+	return tpg_set_format(sd, fh ? fh->state : NULL, &format);
+}
+
+/*
+ * tpg_set_test_pattern - Set test generator's pattern mode
+ * @tpg: TPG device
+ * @value: desired test pattern mode
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int tpg_set_test_pattern(struct tpg_device *tpg, s32 value)
+{
+	return tpg->res->hw_ops->configure_testgen_pattern(tpg, value);
+}
+
+/*
+ * tpg_s_ctrl - Handle set control subdev method
+ * @ctrl: pointer to v4l2 control structure
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int tpg_s_ctrl(struct v4l2_ctrl *ctrl)
+{
+	struct tpg_device *tpg = container_of(ctrl->handler,
+					      struct tpg_device, ctrls);
+	int ret = -EINVAL;
+
+	switch (ctrl->id) {
+	case V4L2_CID_TEST_PATTERN:
+		ret = tpg_set_test_pattern(tpg, ctrl->val);
+		break;
+	}
+
+	return ret;
+}
+
+static const struct v4l2_ctrl_ops tpg_ctrl_ops = {
+	.s_ctrl = tpg_s_ctrl,
+};
+
+/*
+ * msm_tpg_subdev_init - Initialize tpg device structure and resources
+ * @tpg: tpg device
+ * @res: tpg module resources table
+ * @id: tpg module id
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+int msm_tpg_subdev_init(struct camss *camss,
+			struct tpg_device *tpg,
+			const struct camss_subdev_resources *res, u8 id)
+{
+	struct device *dev = camss->dev;
+	struct platform_device *pdev = to_platform_device(dev);
+	int i, j;
+	int ret;
+
+	tpg->camss = camss;
+	tpg->id = id;
+	tpg->res = &res->tpg;
+	tpg->res->hw_ops->subdev_init(tpg);
+
+	/* Memory */
+	tpg->base = devm_platform_ioremap_resource_byname(pdev, res->reg[0]);
+	if (IS_ERR(tpg->base))
+		return PTR_ERR(tpg->base);
+
+	/* Interrupt */
+	ret = platform_get_irq_byname(pdev, res->interrupt[0]);
+	if (ret < 0)
+		return ret;
+
+	tpg->irq = ret;
+	snprintf(tpg->irq_name, sizeof(tpg->irq_name), "%s_%s%d",
+		 dev_name(dev), MSM_TPG_NAME, tpg->id);
+
+	ret = devm_request_irq(dev, tpg->irq, tpg->res->hw_ops->isr,
+			       IRQF_TRIGGER_RISING | IRQF_NO_AUTOEN,
+			       tpg->irq_name, tpg);
+	if (ret < 0) {
+		dev_err(dev, "request_irq failed: %d\n", ret);
+		return ret;
+	}
+
+	/* Clocks */
+	tpg->nclocks = 0;
+	while (res->clock[tpg->nclocks])
+		tpg->nclocks++;
+
+	tpg->clock = devm_kcalloc(dev,
+				  tpg->nclocks, sizeof(*tpg->clock),
+				  GFP_KERNEL);
+	if (!tpg->clock)
+		return -ENOMEM;
+
+	for (i = 0; i < tpg->nclocks; i++) {
+		struct camss_clock *clock = &tpg->clock[i];
+
+		clock->clk = devm_clk_get(dev, res->clock[i]);
+		if (IS_ERR(clock->clk))
+			return PTR_ERR(clock->clk);
+
+		clock->name = res->clock[i];
+
+		clock->nfreqs = 0;
+		while (res->clock_rate[i][clock->nfreqs])
+			clock->nfreqs++;
+
+		if (!clock->nfreqs) {
+			clock->freq = NULL;
+			continue;
+		}
+
+		clock->freq = devm_kcalloc(dev,
+					   clock->nfreqs,
+					   sizeof(*clock->freq),
+					   GFP_KERNEL);
+		if (!clock->freq)
+			return -ENOMEM;
+
+		for (j = 0; j < clock->nfreqs; j++)
+			clock->freq[j] = res->clock_rate[i][j];
+	}
+
+	return 0;
+}
+
+/*
+ * tpg_link_setup - Setup tpg connections
+ * @entity: Pointer to media entity structure
+ * @local: Pointer to local pad
+ * @remote: Pointer to remote pad
+ * @flags: Link flags
+ *
+ * Rreturn 0 on success
+ */
+static int tpg_link_setup(struct media_entity *entity,
+			  const struct media_pad *local,
+			  const struct media_pad *remote, u32 flags)
+{
+	if (flags & MEDIA_LNK_FL_ENABLED)
+		if (media_pad_remote_pad_first(local))
+			return -EBUSY;
+
+	return 0;
+}
+
+static const struct v4l2_subdev_core_ops tpg_core_ops = {
+	.s_power = tpg_set_power,
+};
+
+static const struct v4l2_subdev_video_ops tpg_video_ops = {
+	.s_stream = tpg_set_stream,
+};
+
+static const struct v4l2_subdev_pad_ops tpg_pad_ops = {
+	.enum_mbus_code = tpg_enum_mbus_code,
+	.enum_frame_size = tpg_enum_frame_size,
+	.get_fmt = tpg_get_format,
+	.set_fmt = tpg_set_format,
+};
+
+static const struct v4l2_subdev_ops tpg_v4l2_ops = {
+	.core = &tpg_core_ops,
+	.video = &tpg_video_ops,
+	.pad = &tpg_pad_ops,
+};
+
+static const struct v4l2_subdev_internal_ops tpg_v4l2_internal_ops = {
+	.open = tpg_init_formats,
+};
+
+static const struct media_entity_operations tpg_media_ops = {
+	.link_setup = tpg_link_setup,
+	.link_validate = v4l2_subdev_link_validate,
+};
+
+/*
+ * msm_tpg_register_entity - Register subdev node for tpg module
+ * @tpg: tpg device
+ * @v4l2_dev: V4L2 device
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+int msm_tpg_register_entity(struct tpg_device *tpg,
+			    struct v4l2_device *v4l2_dev)
+{
+	struct v4l2_subdev *sd = &tpg->subdev;
+	struct media_pad *pads = tpg->pads;
+	struct device *dev = tpg->camss->dev;
+	int ret;
+
+	v4l2_subdev_init(sd, &tpg_v4l2_ops);
+	sd->internal_ops = &tpg_v4l2_internal_ops;
+	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE |
+		     V4L2_SUBDEV_FL_HAS_EVENTS;
+	snprintf(sd->name, ARRAY_SIZE(sd->name), "%s%d",
+		 MSM_TPG_NAME, tpg->id);
+	v4l2_set_subdevdata(sd, tpg);
+
+	ret = v4l2_ctrl_handler_init(&tpg->ctrls, 1);
+	if (ret < 0) {
+		dev_err(dev, "Failed to init ctrl handler: %d\n", ret);
+		return ret;
+	}
+
+	tpg->testgen_mode = v4l2_ctrl_new_std_menu_items(&tpg->ctrls,
+							 &tpg_ctrl_ops, V4L2_CID_TEST_PATTERN,
+							 TPG_PAYLOAD_MODE_COLOR_BARS, 0, 0,
+							 tpg->testgen.modes);
+
+	if (tpg->ctrls.error) {
+		dev_err(dev, "Failed to init ctrl: %d\n", tpg->ctrls.error);
+		ret = tpg->ctrls.error;
+		goto free_ctrl;
+	}
+
+	tpg->subdev.ctrl_handler = &tpg->ctrls;
+
+	ret = tpg_init_formats(sd, NULL);
+	if (ret < 0) {
+		dev_err(dev, "Failed to init format: %d\n", ret);
+		goto free_ctrl;
+	}
+
+	pads[MSM_TPG_PAD_SINK].flags = MEDIA_PAD_FL_SINK;
+	pads[MSM_TPG_PAD_SRC].flags = MEDIA_PAD_FL_SOURCE;
+
+	sd->entity.function = MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER;
+	sd->entity.ops = &tpg_media_ops;
+	ret = media_entity_pads_init(&sd->entity, MSM_TPG_PADS_NUM, pads);
+	if (ret < 0) {
+		dev_err(dev, "Failed to init media entity: %d\n", ret);
+		goto free_ctrl;
+	}
+
+	ret = v4l2_device_register_subdev(v4l2_dev, sd);
+	if (ret < 0) {
+		dev_err(dev, "Failed to register subdev: %d\n", ret);
+		media_entity_cleanup(&sd->entity);
+		goto free_ctrl;
+	}
+
+	return 0;
+
+free_ctrl:
+	v4l2_ctrl_handler_free(&tpg->ctrls);
+
+	return ret;
+}
+
+/*
+ * msm_tpg_unregister_entity - Unregister tpg module subdev node
+ * @tpg: tpg device
+ */
+void msm_tpg_unregister_entity(struct tpg_device *tpg)
+{
+	v4l2_device_unregister_subdev(&tpg->subdev);
+	media_entity_cleanup(&tpg->subdev.entity);
+	v4l2_ctrl_handler_free(&tpg->ctrls);
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-tpg.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-tpg.h
@@ -0,0 +1,130 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * camss-tpg.h
+ *
+ * Qualcomm MSM Camera Subsystem - TPG Module
+ *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef QC_MSM_CAMSS_TPG_H
+#define QC_MSM_CAMSS_TPG_H
+
+#include <linux/clk.h>
+#include <linux/interrupt.h>
+#include <media/media-entity.h>
+#include <media/v4l2-ctrls.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-mediabus.h>
+#include <media/v4l2-subdev.h>
+
+#define MSM_TPG_PAD_SINK 0
+#define MSM_TPG_PAD_SRC 1
+#define MSM_TPG_PADS_NUM 2
+
+#define DATA_TYPE_RAW_8BIT		0x2a
+#define DATA_TYPE_RAW_10BIT		0x2b
+#define DATA_TYPE_RAW_12BIT		0x2c
+
+#define ENCODE_FORMAT_UNCOMPRESSED_8_BIT	0x1
+#define ENCODE_FORMAT_UNCOMPRESSED_10_BIT	0x2
+#define ENCODE_FORMAT_UNCOMPRESSED_12_BIT	0x3
+#define ENCODE_FORMAT_UNCOMPRESSED_14_BIT	0x4
+#define ENCODE_FORMAT_UNCOMPRESSED_16_BIT	0x5
+#define ENCODE_FORMAT_UNCOMPRESSED_20_BIT	0x6
+#define ENCODE_FORMAT_UNCOMPRESSED_24_BIT	0x7
+
+#define MSM_TPG_NAME "msm_tpg"
+
+enum tpg_testgen_mode {
+	TPG_PAYLOAD_MODE_DISABLED = 0,
+	TPG_PAYLOAD_MODE_INCREMENTING = 1,
+	TPG_PAYLOAD_MODE_ALTERNATING_55_AA = 2,
+	TPG_PAYLOAD_MODE_RANDOM = 5,
+	TPG_PAYLOAD_MODE_USER_SPECIFIED = 6,
+	TPG_PAYLOAD_MODE_COLOR_BARS = 9,
+};
+
+struct tpg_testgen_config {
+	enum tpg_testgen_mode mode;
+	const char * const*modes;
+	u8 nmodes;
+};
+
+struct tpg_format_info {
+	u32 code;
+	u8 data_type;
+	u8 encode_format;
+};
+
+struct tpg_formats {
+	unsigned int nformats;
+	const struct tpg_format_info *formats;
+};
+
+struct tpg_device;
+
+struct tpg_hw_ops {
+
+	void (*configure_stream)(struct tpg_device *tpg, u8 enable);
+
+	int (*configure_testgen_pattern)(struct tpg_device *tpg, s32 val);
+
+	u32 (*hw_version)(struct tpg_device *tpg);
+
+	irqreturn_t (*isr)(int irq, void *dev);
+
+	int (*reset)(struct tpg_device *tpg);
+
+	void (*subdev_init)(struct tpg_device *tpg);
+};
+
+struct tpg_subdev_resources {
+	u8 lane_cnt;
+	u8 vc_cnt;
+	const struct tpg_formats *formats;
+	const struct tpg_hw_ops *hw_ops;
+};
+
+struct tpg_device {
+	struct camss *camss;
+	u8 id;
+	struct v4l2_subdev subdev;
+	struct media_pad pads[MSM_TPG_PADS_NUM];
+	void __iomem *base;
+	void __iomem *base_clk_mux;
+	u32 irq;
+	char irq_name[30];
+	struct camss_clock *clock;
+	int nclocks;
+	u32 timer_clk_rate;
+	struct tpg_testgen_config testgen;
+	struct v4l2_mbus_framefmt fmt[MSM_TPG_PADS_NUM];
+	struct v4l2_ctrl_handler ctrls;
+	struct v4l2_ctrl *testgen_mode;
+	const struct tpg_subdev_resources *res;
+	const struct tpg_format *formats;
+	unsigned int nformats;
+};
+
+struct camss_subdev_resources;
+
+const struct tpg_format_info *tpg_get_fmt_entry(const struct tpg_format_info *formats,
+						unsigned int nformats,
+						u32 code);
+
+int msm_tpg_subdev_init(struct camss *camss,
+			struct tpg_device *tpg,
+			const struct camss_subdev_resources *res, u8 id);
+
+int msm_tpg_register_entity(struct tpg_device *tpg,
+			    struct v4l2_device *v4l2_dev);
+
+void msm_tpg_unregister_entity(struct tpg_device *tpg);
+
+extern const char * const testgen_payload_modes[];
+
+extern const struct tpg_formats tpg_formats_gen1;
+
+extern const struct tpg_hw_ops tpg_ops_gen1;
+
+#endif /* QC_MSM_CAMSS_TPG_H */
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-vfe-17x.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-vfe-17x.c
@@ -0,0 +1,699 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * camss-vfe-170.c
+ *
+ * Qualcomm MSM Camera Subsystem - VFE (Video Front End) Module v170
+ *
+ * Copyright (C) 2020-2021 Linaro Ltd.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/iopoll.h>
+
+#include "camss.h"
+#include "camss-vfe.h"
+
+#define VFE_HW_VERSION				(0x000)
+
+#define VFE_GLOBAL_RESET_CMD			(0x018)
+#define		GLOBAL_RESET_CMD_CORE		BIT(0)
+#define		GLOBAL_RESET_CMD_CAMIF		BIT(1)
+#define		GLOBAL_RESET_CMD_BUS		BIT(2)
+#define		GLOBAL_RESET_CMD_BUS_BDG	BIT(3)
+#define		GLOBAL_RESET_CMD_REGISTER	BIT(4)
+#define		GLOBAL_RESET_CMD_PM		BIT(5)
+#define		GLOBAL_RESET_CMD_BUS_MISR	BIT(6)
+#define		GLOBAL_RESET_CMD_TESTGEN	BIT(7)
+#define		GLOBAL_RESET_CMD_DSP		BIT(8)
+#define		GLOBAL_RESET_CMD_IDLE_CGC	BIT(9)
+#define		GLOBAL_RESET_CMD_RDI0		BIT(10)
+#define		GLOBAL_RESET_CMD_RDI1		BIT(11)
+#define		GLOBAL_RESET_CMD_RDI2		BIT(12)
+#define		GLOBAL_RESET_CMD_RDI3		BIT(13)
+#define		GLOBAL_RESET_CMD_VFE_DOMAIN	BIT(30)
+#define		GLOBAL_RESET_CMD_RESET_BYPASS	BIT(31)
+
+#define VFE_CORE_CFG				(0x050)
+#define		CFG_PIXEL_PATTERN_YCBYCR	(0x4)
+#define		CFG_PIXEL_PATTERN_YCRYCB	(0x5)
+#define		CFG_PIXEL_PATTERN_CBYCRY	(0x6)
+#define		CFG_PIXEL_PATTERN_CRYCBY	(0x7)
+#define		CFG_COMPOSITE_REG_UPDATE_EN	BIT(4)
+
+#define VFE_IRQ_CMD				(0x058)
+#define		CMD_GLOBAL_CLEAR		BIT(0)
+
+#define VFE_IRQ_MASK_0					(0x05c)
+#define		MASK_0_CAMIF_SOF			BIT(0)
+#define		MASK_0_CAMIF_EOF			BIT(1)
+#define		MASK_0_RDI_REG_UPDATE(n)		BIT((n) + 5)
+#define		MASK_0_IMAGE_MASTER_n_PING_PONG(n)	BIT((n) + 8)
+#define		MASK_0_IMAGE_COMPOSITE_DONE_n(n)	BIT((n) + 25)
+#define		MASK_0_RESET_ACK			BIT(31)
+
+#define VFE_IRQ_MASK_1					(0x060)
+#define		MASK_1_CAMIF_ERROR			BIT(0)
+#define		MASK_1_VIOLATION			BIT(7)
+#define		MASK_1_BUS_BDG_HALT_ACK			BIT(8)
+#define		MASK_1_IMAGE_MASTER_n_BUS_OVERFLOW(n)	BIT((n) + 9)
+#define		MASK_1_RDI_SOF(n)			BIT((n) + 29)
+
+#define VFE_IRQ_CLEAR_0					(0x064)
+#define VFE_IRQ_CLEAR_1					(0x068)
+
+#define VFE_IRQ_STATUS_0				(0x06c)
+#define		STATUS_0_CAMIF_SOF			BIT(0)
+#define		STATUS_0_RDI_REG_UPDATE(n)		BIT((n) + 5)
+#define		STATUS_0_IMAGE_MASTER_PING_PONG(n)	BIT((n) + 8)
+#define		STATUS_0_IMAGE_COMPOSITE_DONE(n)	BIT((n) + 25)
+#define		STATUS_0_RESET_ACK			BIT(31)
+
+#define VFE_IRQ_STATUS_1				(0x070)
+#define		STATUS_1_VIOLATION			BIT(7)
+#define		STATUS_1_BUS_BDG_HALT_ACK		BIT(8)
+#define		STATUS_1_RDI_SOF(n)			BIT((n) + 27)
+
+#define VFE_VIOLATION_STATUS			(0x07c)
+
+#define VFE_CAMIF_CMD				(0x478)
+#define		CMD_CLEAR_CAMIF_STATUS		BIT(2)
+
+#define VFE_CAMIF_CFG				(0x47c)
+#define		CFG_VSYNC_SYNC_EDGE		(0)
+#define			VSYNC_ACTIVE_HIGH	(0)
+#define			VSYNC_ACTIVE_LOW	(1)
+#define		CFG_HSYNC_SYNC_EDGE		(1)
+#define			HSYNC_ACTIVE_HIGH	(0)
+#define			HSYNC_ACTIVE_LOW	(1)
+#define		CFG_VFE_SUBSAMPLE_ENABLE	BIT(4)
+#define		CFG_BUS_SUBSAMPLE_ENABLE	BIT(5)
+#define		CFG_VFE_OUTPUT_EN		BIT(6)
+#define		CFG_BUS_OUTPUT_EN		BIT(7)
+#define		CFG_BINNING_EN			BIT(9)
+#define		CFG_FRAME_BASED_EN		BIT(10)
+#define		CFG_RAW_CROP_EN			BIT(22)
+
+#define VFE_REG_UPDATE_CMD			(0x4ac)
+#define		REG_UPDATE_RDI(n)		BIT(1 + (n))
+
+#define VFE_BUS_IRQ_MASK(n)		(0x2044 + (n) * 4)
+#define VFE_BUS_IRQ_CLEAR(n)		(0x2050 + (n) * 4)
+#define VFE_BUS_IRQ_STATUS(n)		(0x205c + (n) * 4)
+#define		STATUS0_COMP_RESET_DONE		BIT(0)
+#define		STATUS0_COMP_REG_UPDATE0_DONE	BIT(1)
+#define		STATUS0_COMP_REG_UPDATE1_DONE	BIT(2)
+#define		STATUS0_COMP_REG_UPDATE2_DONE	BIT(3)
+#define		STATUS0_COMP_REG_UPDATE3_DONE	BIT(4)
+#define		STATUS0_COMP_REG_UPDATE_DONE(n)	BIT((n) + 1)
+#define		STATUS0_COMP0_BUF_DONE		BIT(5)
+#define		STATUS0_COMP1_BUF_DONE		BIT(6)
+#define		STATUS0_COMP2_BUF_DONE		BIT(7)
+#define		STATUS0_COMP3_BUF_DONE		BIT(8)
+#define		STATUS0_COMP4_BUF_DONE		BIT(9)
+#define		STATUS0_COMP5_BUF_DONE		BIT(10)
+#define		STATUS0_COMP_BUF_DONE(n)	BIT((n) + 5)
+#define		STATUS0_COMP_ERROR		BIT(11)
+#define		STATUS0_COMP_OVERWRITE		BIT(12)
+#define		STATUS0_OVERFLOW		BIT(13)
+#define		STATUS0_VIOLATION		BIT(14)
+/* WM_CLIENT_BUF_DONE defined for buffers 0:19 */
+#define		STATUS1_WM_CLIENT_BUF_DONE(n)		BIT(n)
+#define		STATUS1_EARLY_DONE			BIT(24)
+#define		STATUS2_DUAL_COMP0_BUF_DONE		BIT(0)
+#define		STATUS2_DUAL_COMP1_BUF_DONE		BIT(1)
+#define		STATUS2_DUAL_COMP2_BUF_DONE		BIT(2)
+#define		STATUS2_DUAL_COMP3_BUF_DONE		BIT(3)
+#define		STATUS2_DUAL_COMP4_BUF_DONE		BIT(4)
+#define		STATUS2_DUAL_COMP5_BUF_DONE		BIT(5)
+#define		STATUS2_DUAL_COMP_BUF_DONE(n)		BIT(n)
+#define		STATUS2_DUAL_COMP_ERROR			BIT(6)
+#define		STATUS2_DUAL_COMP_OVERWRITE		BIT(7)
+
+#define VFE_BUS_IRQ_CLEAR_GLOBAL		(0x2068)
+
+#define VFE_BUS_WM_DEBUG_STATUS_CFG		(0x226c)
+#define		DEBUG_STATUS_CFG_STATUS0(n)	BIT(n)
+#define		DEBUG_STATUS_CFG_STATUS1(n)	BIT(8 + (n))
+
+#define VFE_BUS_WM_ADDR_SYNC_FRAME_HEADER	(0x2080)
+
+#define VFE_BUS_WM_ADDR_SYNC_NO_SYNC		(0x2084)
+#define		BUS_VER2_MAX_CLIENTS (24)
+#define		WM_ADDR_NO_SYNC_DEFAULT_VAL \
+				((1 << BUS_VER2_MAX_CLIENTS) - 1)
+
+#define VFE_BUS_WM_CGC_OVERRIDE			(0x200c)
+#define		WM_CGC_OVERRIDE_ALL		(0xFFFFF)
+
+#define VFE_BUS_WM_TEST_BUS_CTRL		(0x211c)
+
+#define VFE_BUS_WM_STATUS0(n)			(0x2200 + (n) * 0x100)
+#define VFE_BUS_WM_STATUS1(n)			(0x2204 + (n) * 0x100)
+#define VFE_BUS_WM_CFG(n)			(0x2208 + (n) * 0x100)
+#define		WM_CFG_EN			(0)
+#define		WM_CFG_MODE			(1)
+#define			MODE_QCOM_PLAIN	(0)
+#define			MODE_MIPI_RAW	(1)
+#define		WM_CFG_VIRTUALFRAME		(2)
+#define VFE_BUS_WM_HEADER_ADDR(n)		(0x220c + (n) * 0x100)
+#define VFE_BUS_WM_HEADER_CFG(n)		(0x2210 + (n) * 0x100)
+#define VFE_BUS_WM_IMAGE_ADDR(n)		(0x2214 + (n) * 0x100)
+#define VFE_BUS_WM_IMAGE_ADDR_OFFSET(n)		(0x2218 + (n) * 0x100)
+#define VFE_BUS_WM_BUFFER_WIDTH_CFG(n)		(0x221c + (n) * 0x100)
+#define		WM_BUFFER_DEFAULT_WIDTH		(0xFF01)
+
+#define VFE_BUS_WM_BUFFER_HEIGHT_CFG(n)		(0x2220 + (n) * 0x100)
+#define VFE_BUS_WM_PACKER_CFG(n)		(0x2224 + (n) * 0x100)
+
+#define VFE_BUS_WM_STRIDE(n)			(0x2228 + (n) * 0x100)
+#define		WM_STRIDE_DEFAULT_STRIDE	(0xFF01)
+
+#define VFE_BUS_WM_IRQ_SUBSAMPLE_PERIOD(n)	(0x2248 + (n) * 0x100)
+#define VFE_BUS_WM_IRQ_SUBSAMPLE_PATTERN(n)	(0x224c + (n) * 0x100)
+#define VFE_BUS_WM_FRAMEDROP_PERIOD(n)		(0x2250 + (n) * 0x100)
+#define VFE_BUS_WM_FRAMEDROP_PATTERN(n)		(0x2254 + (n) * 0x100)
+#define VFE_BUS_WM_FRAME_INC(n)			(0x2258 + (n) * 0x100)
+#define VFE_BUS_WM_BURST_LIMIT(n)		(0x225c + (n) * 0x100)
+
+static u32 vfe_hw_version(struct vfe_device *vfe)
+{
+	u32 hw_version = readl_relaxed(vfe->base + VFE_HW_VERSION);
+
+	u32 gen = (hw_version >> 28) & 0xF;
+	u32 rev = (hw_version >> 16) & 0xFFF;
+	u32 step = hw_version & 0xFFFF;
+
+	dev_dbg(vfe->camss->dev, "VFE HW Version = %u.%u.%u\n",
+		gen, rev, step);
+
+	return hw_version;
+}
+
+static inline void vfe_reg_set(struct vfe_device *vfe, u32 reg, u32 set_bits)
+{
+	u32 bits = readl_relaxed(vfe->base + reg);
+
+	writel_relaxed(bits | set_bits, vfe->base + reg);
+}
+
+static void vfe_global_reset(struct vfe_device *vfe)
+{
+	u32 reset_bits = GLOBAL_RESET_CMD_CORE		|
+			 GLOBAL_RESET_CMD_CAMIF		|
+			 GLOBAL_RESET_CMD_BUS		|
+			 GLOBAL_RESET_CMD_BUS_BDG	|
+			 GLOBAL_RESET_CMD_REGISTER	|
+			 GLOBAL_RESET_CMD_TESTGEN	|
+			 GLOBAL_RESET_CMD_DSP		|
+			 GLOBAL_RESET_CMD_IDLE_CGC	|
+			 GLOBAL_RESET_CMD_RDI0		|
+			 GLOBAL_RESET_CMD_RDI1		|
+			 GLOBAL_RESET_CMD_RDI2		|
+			 GLOBAL_RESET_CMD_RDI3;
+
+	writel_relaxed(BIT(31), vfe->base + VFE_IRQ_MASK_0);
+
+	/* Make sure IRQ mask has been written before resetting */
+	wmb();
+
+	writel_relaxed(reset_bits, vfe->base + VFE_GLOBAL_RESET_CMD);
+}
+
+static void vfe_wm_start(struct vfe_device *vfe, u8 wm, struct vfe_line *line)
+{
+	u32 val;
+
+	/*Set Debug Registers*/
+	val = DEBUG_STATUS_CFG_STATUS0(1) |
+	      DEBUG_STATUS_CFG_STATUS0(7);
+	writel_relaxed(val, vfe->base + VFE_BUS_WM_DEBUG_STATUS_CFG);
+
+	/* BUS_WM_INPUT_IF_ADDR_SYNC_FRAME_HEADER */
+	writel_relaxed(0, vfe->base + VFE_BUS_WM_ADDR_SYNC_FRAME_HEADER);
+
+	/* no clock gating at bus input */
+	val = WM_CGC_OVERRIDE_ALL;
+	writel_relaxed(val, vfe->base + VFE_BUS_WM_CGC_OVERRIDE);
+
+	writel_relaxed(0x0, vfe->base + VFE_BUS_WM_TEST_BUS_CTRL);
+
+	/* if addr_no_sync has default value then config the addr no sync reg */
+	val = WM_ADDR_NO_SYNC_DEFAULT_VAL;
+	writel_relaxed(val, vfe->base + VFE_BUS_WM_ADDR_SYNC_NO_SYNC);
+
+	writel_relaxed(0xf, vfe->base + VFE_BUS_WM_BURST_LIMIT(wm));
+
+	val = WM_BUFFER_DEFAULT_WIDTH;
+	writel_relaxed(val, vfe->base + VFE_BUS_WM_BUFFER_WIDTH_CFG(wm));
+
+	val = 0;
+	writel_relaxed(val, vfe->base + VFE_BUS_WM_BUFFER_HEIGHT_CFG(wm));
+
+	val = 0;
+	writel_relaxed(val, vfe->base + VFE_BUS_WM_PACKER_CFG(wm)); // XXX 1 for PLAIN8?
+
+	/* Configure stride for RDIs */
+	val = WM_STRIDE_DEFAULT_STRIDE;
+	writel_relaxed(val, vfe->base + VFE_BUS_WM_STRIDE(wm));
+
+	/* Enable WM */
+	val = 1 << WM_CFG_EN |
+	      MODE_MIPI_RAW << WM_CFG_MODE;
+	writel_relaxed(val, vfe->base + VFE_BUS_WM_CFG(wm));
+}
+
+static void vfe_wm_stop(struct vfe_device *vfe, u8 wm)
+{
+	/* Disable WM */
+	writel_relaxed(0, vfe->base + VFE_BUS_WM_CFG(wm));
+}
+
+static void vfe_wm_update(struct vfe_device *vfe, u8 wm, u32 addr,
+			  struct vfe_line *line)
+{
+	struct v4l2_pix_format_mplane *pix =
+		&line->video_out.active_fmt.fmt.pix_mp;
+	u32 stride = pix->plane_fmt[0].bytesperline;
+
+	writel_relaxed(addr, vfe->base + VFE_BUS_WM_IMAGE_ADDR(wm));
+	writel_relaxed(stride * pix->height, vfe->base + VFE_BUS_WM_FRAME_INC(wm));
+}
+
+static void vfe_reg_update(struct vfe_device *vfe, enum vfe_line_id line_id)
+{
+	vfe->reg_update |= REG_UPDATE_RDI(line_id);
+
+	/* Enforce ordering between previous reg writes and reg update */
+	wmb();
+
+	writel_relaxed(vfe->reg_update, vfe->base + VFE_REG_UPDATE_CMD);
+
+	/* Enforce ordering between reg update and subsequent reg writes */
+	wmb();
+}
+
+static inline void vfe_reg_update_clear(struct vfe_device *vfe,
+					enum vfe_line_id line_id)
+{
+	vfe->reg_update &= ~REG_UPDATE_RDI(line_id);
+}
+
+static void vfe_enable_irq_common(struct vfe_device *vfe)
+{
+	vfe_reg_set(vfe, VFE_IRQ_MASK_0, ~0u);
+	vfe_reg_set(vfe, VFE_IRQ_MASK_1, ~0u);
+
+	writel_relaxed(~0u, vfe->base + VFE_BUS_IRQ_MASK(0));
+	writel_relaxed(~0u, vfe->base + VFE_BUS_IRQ_MASK(1));
+	writel_relaxed(~0u, vfe->base + VFE_BUS_IRQ_MASK(2));
+}
+
+static void vfe_isr_halt_ack(struct vfe_device *vfe)
+{
+	complete(&vfe->halt_complete);
+}
+
+static void vfe_isr_read(struct vfe_device *vfe, u32 *status0, u32 *status1)
+{
+	*status0 = readl_relaxed(vfe->base + VFE_IRQ_STATUS_0);
+	*status1 = readl_relaxed(vfe->base + VFE_IRQ_STATUS_1);
+
+	writel_relaxed(*status0, vfe->base + VFE_IRQ_CLEAR_0);
+	writel_relaxed(*status1, vfe->base + VFE_IRQ_CLEAR_1);
+
+	/* Enforce ordering between IRQ Clear and Global IRQ Clear */
+	wmb();
+	writel_relaxed(CMD_GLOBAL_CLEAR, vfe->base + VFE_IRQ_CMD);
+}
+
+static void vfe_violation_read(struct vfe_device *vfe)
+{
+	u32 violation = readl_relaxed(vfe->base + VFE_VIOLATION_STATUS);
+
+	pr_err_ratelimited("VFE: violation = 0x%08x\n", violation);
+}
+
+/*
+ * vfe_isr - VFE module interrupt handler
+ * @irq: Interrupt line
+ * @dev: VFE device
+ *
+ * Return IRQ_HANDLED on success
+ */
+static irqreturn_t vfe_isr(int irq, void *dev)
+{
+	struct vfe_device *vfe = dev;
+	u32 status0, status1, vfe_bus_status[VFE_LINE_NUM_MAX];
+	int i, wm;
+
+	status0 = readl_relaxed(vfe->base + VFE_IRQ_STATUS_0);
+	status1 = readl_relaxed(vfe->base + VFE_IRQ_STATUS_1);
+
+	writel_relaxed(status0, vfe->base + VFE_IRQ_CLEAR_0);
+	writel_relaxed(status1, vfe->base + VFE_IRQ_CLEAR_1);
+
+	for (i = VFE_LINE_RDI0; i < vfe->res->line_num; i++) {
+		vfe_bus_status[i] = readl_relaxed(vfe->base + VFE_BUS_IRQ_STATUS(i));
+		writel_relaxed(vfe_bus_status[i], vfe->base + VFE_BUS_IRQ_CLEAR(i));
+	}
+
+	/* Enforce ordering between IRQ reading and interpretation */
+	wmb();
+
+	writel_relaxed(CMD_GLOBAL_CLEAR, vfe->base + VFE_IRQ_CMD);
+	writel_relaxed(1, vfe->base + VFE_BUS_IRQ_CLEAR_GLOBAL);
+
+	if (status0 & STATUS_0_RESET_ACK)
+		vfe->isr_ops.reset_ack(vfe);
+
+	for (i = VFE_LINE_RDI0; i < vfe->res->line_num; i++)
+		if (status0 & STATUS_0_RDI_REG_UPDATE(i))
+			vfe->isr_ops.reg_update(vfe, i);
+
+	for (i = VFE_LINE_RDI0; i < vfe->res->line_num; i++)
+		if (status0 & STATUS_1_RDI_SOF(i))
+			vfe->isr_ops.sof(vfe, i);
+
+	for (i = 0; i < MSM_VFE_COMPOSITE_IRQ_NUM; i++)
+		if (vfe_bus_status[0] & STATUS0_COMP_BUF_DONE(i))
+			vfe->isr_ops.comp_done(vfe, i);
+
+	for (wm = 0; wm < MSM_VFE_IMAGE_MASTERS_NUM; wm++)
+		if (status0 & BIT(9))
+			if (vfe_bus_status[1] & STATUS1_WM_CLIENT_BUF_DONE(wm))
+				vfe->isr_ops.wm_done(vfe, wm);
+
+	return IRQ_HANDLED;
+}
+
+/*
+ * vfe_halt - Trigger halt on VFE module and wait to complete
+ * @vfe: VFE device
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int vfe_halt(struct vfe_device *vfe)
+{
+	/* rely on vfe_disable_output() to stop the VFE */
+	return 0;
+}
+
+static int vfe_get_output(struct vfe_line *line)
+{
+	struct vfe_device *vfe = to_vfe(line);
+	struct vfe_output *output;
+	unsigned long flags;
+	int wm_idx;
+
+	spin_lock_irqsave(&vfe->output_lock, flags);
+
+	output = &line->output;
+	if (output->state > VFE_OUTPUT_RESERVED) {
+		dev_err(vfe->camss->dev, "Output is running\n");
+		goto error;
+	}
+
+	output->wm_num = 1;
+
+	wm_idx = vfe_reserve_wm(vfe, line->id);
+	if (wm_idx < 0) {
+		dev_err(vfe->camss->dev, "Can not reserve wm\n");
+		goto error_get_wm;
+	}
+	output->wm_idx[0] = wm_idx;
+
+	output->drop_update_idx = 0;
+
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+
+	return 0;
+
+error_get_wm:
+	vfe_release_wm(vfe, output->wm_idx[0]);
+	output->state = VFE_OUTPUT_OFF;
+error:
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+
+	return -EINVAL;
+}
+
+static int vfe_enable_output(struct vfe_line *line)
+{
+	struct vfe_device *vfe = to_vfe(line);
+	struct vfe_output *output = &line->output;
+	const struct vfe_hw_ops *ops = vfe->res->hw_ops;
+	struct media_entity *sensor;
+	unsigned long flags;
+	unsigned int frame_skip = 0;
+	unsigned int i;
+
+	sensor = camss_find_sensor(&line->subdev.entity);
+	if (sensor) {
+		struct v4l2_subdev *subdev = media_entity_to_v4l2_subdev(sensor);
+
+		v4l2_subdev_call(subdev, sensor, g_skip_frames, &frame_skip);
+		/* Max frame skip is 29 frames */
+		if (frame_skip > VFE_FRAME_DROP_VAL - 1)
+			frame_skip = VFE_FRAME_DROP_VAL - 1;
+	}
+
+	spin_lock_irqsave(&vfe->output_lock, flags);
+
+	ops->reg_update_clear(vfe, line->id);
+
+	if (output->state > VFE_OUTPUT_RESERVED) {
+		dev_err(vfe->camss->dev, "Output is not in reserved state %d\n",
+			output->state);
+		spin_unlock_irqrestore(&vfe->output_lock, flags);
+		return -EINVAL;
+	}
+
+	WARN_ON(output->gen2.active_num);
+
+	output->state = VFE_OUTPUT_ON;
+
+	output->sequence = 0;
+	output->wait_reg_update = 0;
+	reinit_completion(&output->reg_update);
+
+	vfe_wm_start(vfe, output->wm_idx[0], line);
+
+	for (i = 0; i < 2; i++) {
+		output->buf[i] = vfe_buf_get_pending(output);
+		if (!output->buf[i])
+			break;
+		output->gen2.active_num++;
+		vfe_wm_update(vfe, output->wm_idx[0], output->buf[i]->addr[0], line);
+	}
+
+	ops->reg_update(vfe, line->id);
+
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+
+	return 0;
+}
+
+/*
+ * vfe_enable - Enable streaming on VFE line
+ * @line: VFE line
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int vfe_enable(struct vfe_line *line)
+{
+	struct vfe_device *vfe = to_vfe(line);
+	int ret;
+
+	mutex_lock(&vfe->stream_lock);
+
+	if (!vfe->stream_count)
+		vfe_enable_irq_common(vfe);
+
+	vfe->stream_count++;
+
+	mutex_unlock(&vfe->stream_lock);
+
+	ret = vfe_get_output(line);
+	if (ret < 0)
+		goto error_get_output;
+
+	ret = vfe_enable_output(line);
+	if (ret < 0)
+		goto error_enable_output;
+
+	vfe->was_streaming = 1;
+
+	return 0;
+
+error_enable_output:
+	vfe_put_output(line);
+
+error_get_output:
+	mutex_lock(&vfe->stream_lock);
+
+	vfe->stream_count--;
+
+	mutex_unlock(&vfe->stream_lock);
+
+	return ret;
+}
+
+/*
+ * vfe_isr_sof - Process start of frame interrupt
+ * @vfe: VFE Device
+ * @line_id: VFE line
+ */
+static void vfe_isr_sof(struct vfe_device *vfe, enum vfe_line_id line_id)
+{
+	/* nop */
+}
+
+/*
+ * vfe_isr_reg_update - Process reg update interrupt
+ * @vfe: VFE Device
+ * @line_id: VFE line
+ */
+static void vfe_isr_reg_update(struct vfe_device *vfe, enum vfe_line_id line_id)
+{
+	struct vfe_output *output;
+	unsigned long flags;
+
+	spin_lock_irqsave(&vfe->output_lock, flags);
+	vfe->res->hw_ops->reg_update_clear(vfe, line_id);
+
+	output = &vfe->line[line_id].output;
+
+	if (output->wait_reg_update) {
+		output->wait_reg_update = 0;
+		complete(&output->reg_update);
+	}
+
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+}
+
+/*
+ * vfe_isr_wm_done - Process write master done interrupt
+ * @vfe: VFE Device
+ * @wm: Write master id
+ */
+static void vfe_isr_wm_done(struct vfe_device *vfe, u8 wm)
+{
+	struct vfe_line *line = &vfe->line[vfe->wm_output_map[wm]];
+	struct camss_buffer *ready_buf;
+	struct vfe_output *output;
+	unsigned long flags;
+	u32 index;
+	u64 ts = ktime_get_ns();
+
+	spin_lock_irqsave(&vfe->output_lock, flags);
+
+	if (vfe->wm_output_map[wm] == VFE_LINE_NONE) {
+		dev_err_ratelimited(vfe->camss->dev,
+				    "Received wm done for unmapped index\n");
+		goto out_unlock;
+	}
+	output = &vfe->line[vfe->wm_output_map[wm]].output;
+
+	ready_buf = output->buf[0];
+	if (!ready_buf) {
+		dev_err_ratelimited(vfe->camss->dev,
+				    "Missing ready buf %d!\n", output->state);
+		goto out_unlock;
+	}
+
+	ready_buf->vb.vb2_buf.timestamp = ts;
+	ready_buf->vb.sequence = output->sequence++;
+
+	index = 0;
+	output->buf[0] = output->buf[1];
+	if (output->buf[0])
+		index = 1;
+
+	output->buf[index] = vfe_buf_get_pending(output);
+
+	if (output->buf[index])
+		vfe_wm_update(vfe, output->wm_idx[0], output->buf[index]->addr[0], line);
+	else
+		output->gen2.active_num--;
+
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+
+	vb2_buffer_done(&ready_buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
+
+	return;
+
+out_unlock:
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+}
+
+/*
+ * vfe_queue_buffer - Add empty buffer
+ * @vid: Video device structure
+ * @buf: Buffer to be enqueued
+ *
+ * Add an empty buffer - depending on the current number of buffers it will be
+ * put in pending buffer queue or directly given to the hardware to be filled.
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int vfe_queue_buffer(struct camss_video *vid,
+			    struct camss_buffer *buf)
+{
+	struct vfe_line *line = container_of(vid, struct vfe_line, video_out);
+	struct vfe_device *vfe = to_vfe(line);
+	struct vfe_output *output;
+	unsigned long flags;
+
+	output = &line->output;
+
+	spin_lock_irqsave(&vfe->output_lock, flags);
+
+	if (output->state == VFE_OUTPUT_ON && output->gen2.active_num < 2) {
+		output->buf[output->gen2.active_num++] = buf;
+		vfe_wm_update(vfe, output->wm_idx[0], buf->addr[0], line);
+	} else {
+		vfe_buf_add_pending(output, buf);
+	}
+
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+
+	return 0;
+}
+
+static const struct vfe_isr_ops vfe_isr_ops_170 = {
+	.reset_ack = vfe_isr_reset_ack,
+	.halt_ack = vfe_isr_halt_ack,
+	.reg_update = vfe_isr_reg_update,
+	.sof = vfe_isr_sof,
+	.comp_done = vfe_isr_comp_done,
+	.wm_done = vfe_isr_wm_done,
+};
+
+static const struct camss_video_ops vfe_video_ops_170 = {
+	.queue_buffer = vfe_queue_buffer,
+	.flush_buffers = vfe_flush_buffers,
+};
+
+static void vfe_subdev_init(struct device *dev, struct vfe_device *vfe)
+{
+	vfe->isr_ops = vfe_isr_ops_170;
+	vfe->video_ops = vfe_video_ops_170;
+}
+
+const struct vfe_hw_ops vfe_ops_170 = {
+	.global_reset = vfe_global_reset,
+	.hw_version = vfe_hw_version,
+	.isr_read = vfe_isr_read,
+	.isr = vfe_isr,
+	.pm_domain_off = vfe_pm_domain_off,
+	.pm_domain_on = vfe_pm_domain_on,
+	.reg_update_clear = vfe_reg_update_clear,
+	.reg_update = vfe_reg_update,
+	.subdev_init = vfe_subdev_init,
+	.vfe_disable = vfe_disable,
+	.vfe_enable = vfe_enable,
+	.vfe_halt = vfe_halt,
+	.violation_read = vfe_violation_read,
+	.vfe_wm_stop = vfe_wm_stop,
+};
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-vfe-4-1.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-vfe-4-1.c
@@ -892,7 +892,7 @@
 	u32 value0, value1;
 	int i, j;
 
-	vfe->ops->isr_read(vfe, &value0, &value1);
+	vfe->res->hw_ops->isr_read(vfe, &value0, &value1);
 
 	dev_dbg(vfe->camss->dev, "VFE: status0 = 0x%08x, status1 = 0x%08x\n",
 		value0, value1);
@@ -901,7 +901,7 @@
 		vfe->isr_ops.reset_ack(vfe);
 
 	if (value1 & VFE_0_IRQ_STATUS_1_VIOLATION)
-		vfe->ops->violation_read(vfe);
+		vfe->res->hw_ops->violation_read(vfe);
 
 	if (value1 & VFE_0_IRQ_STATUS_1_BUS_BDG_HALT_ACK)
 		vfe->isr_ops.halt_ack(vfe);
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-vfe-4-7.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-vfe-4-7.c
@@ -1050,7 +1050,7 @@
 	u32 value0, value1;
 	int i, j;
 
-	vfe->ops->isr_read(vfe, &value0, &value1);
+	vfe->res->hw_ops->isr_read(vfe, &value0, &value1);
 
 	dev_dbg(vfe->camss->dev, "VFE: status0 = 0x%08x, status1 = 0x%08x\n",
 		value0, value1);
@@ -1059,12 +1059,12 @@
 		vfe->isr_ops.reset_ack(vfe);
 
 	if (value1 & VFE_0_IRQ_STATUS_1_VIOLATION)
-		vfe->ops->violation_read(vfe);
+		vfe->res->hw_ops->violation_read(vfe);
 
 	if (value1 & VFE_0_IRQ_STATUS_1_BUS_BDG_HALT_ACK)
 		vfe->isr_ops.halt_ack(vfe);
 
-	for (i = VFE_LINE_RDI0; i < vfe->line_num; i++)
+	for (i = VFE_LINE_RDI0; i < vfe->res->line_num; i++)
 		if (value0 & VFE_0_IRQ_STATUS_0_line_n_REG_UPDATE(i))
 			vfe->isr_ops.reg_update(vfe, i);
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-vfe-4-8.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-vfe-4-8.c
@@ -980,7 +980,7 @@
 	u32 value0, value1;
 	int i, j;
 
-	vfe->ops->isr_read(vfe, &value0, &value1);
+	vfe->res->hw_ops->isr_read(vfe, &value0, &value1);
 
 	dev_dbg(vfe->camss->dev, "VFE: status0 = 0x%08x, status1 = 0x%08x\n",
 		value0, value1);
@@ -989,12 +989,12 @@
 		vfe->isr_ops.reset_ack(vfe);
 
 	if (value1 & VFE_0_IRQ_STATUS_1_VIOLATION)
-		vfe->ops->violation_read(vfe);
+		vfe->res->hw_ops->violation_read(vfe);
 
 	if (value1 & VFE_0_IRQ_STATUS_1_BUS_BDG_HALT_ACK)
 		vfe->isr_ops.halt_ack(vfe);
 
-	for (i = VFE_LINE_RDI0; i < vfe->line_num; i++)
+	for (i = VFE_LINE_RDI0; i < vfe->res->line_num; i++)
 		if (value0 & VFE_0_IRQ_STATUS_0_line_n_REG_UPDATE(i))
 			vfe->isr_ops.reg_update(vfe, i);
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-vfe-480.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-vfe-480.c
@@ -15,6 +15,9 @@
 #include "camss.h"
 #include "camss-vfe.h"
 
+/* VFE 2/3 are lite and have a different register layout */
+#define IS_LITE		(vfe->res->is_lite)
+
 #define VFE_HW_VERSION			(0x00)
 
 #define VFE_GLOBAL_RESET_CMD		(vfe_is_lite(vfe) ? 0x0c : 0x1c)
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-vfe-690.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-vfe-690.c
@@ -0,0 +1,410 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * camss-vfe-690.c
+ *
+ * Qualcomm MSM Camera Subsystem - VFE (Video Front End) Module v690 (SA8755P)
+ *
+ * Copyright (C) 2020-2021 Linaro Ltd.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/iopoll.h>
+
+#include "camss.h"
+#include "camss-vfe.h"
+
+#define VFE_HW_VERSION                  (0x0)
+#define HW_VERSION_STEPPING		(0x0)
+#define HW_VERSION_REVISION		(0x10)
+#define HW_VERSION_GENERATION		(0x1C)
+#define VFE_TOP_CORE_CFG		(0x24)
+
+#define BUS_REG_BASE			(vfe_is_lite(vfe) ? 0x480 : 0x400)
+
+#define VFE_BUS_WM_CGC_OVERRIDE		(BUS_REG_BASE + 0x08)
+#define	WM_CGC_OVERRIDE_ALL		(0x7FFFFFF)
+
+#define VFE_BUS_WM_TEST_BUS_CTRL	(BUS_REG_BASE + 0xFC)
+
+#define VFE_BUS_WM_CFG(n)		(BUS_REG_BASE + 0x200 + (n) * 0x100)
+#define		WM_CFG_EN			BIT(0)
+#define		WM_CFG_MODE			BIT(16)
+#define VFE_BUS_WM_IMAGE_ADDR(n)	(BUS_REG_BASE + 0x204 + (n) * 0x100)
+#define VFE_BUS_WM_FRAME_INCR(n)	(BUS_REG_BASE + 0x208 + (n) * 0x100)
+#define VFE_BUS_WM_IMAGE_CFG_0(n)	(BUS_REG_BASE + 0x20c + (n) * 0x100)
+#define		WM_IMAGE_CFG_0_DEFAULT_WIDTH	(0xFFFF)
+#define		WM_IMAGE_CFG_0_DEFAULT_HEIGHT	(0xFFFF)
+#define VFE_BUS_WM_IMAGE_CFG_1(n)	(BUS_REG_BASE + 0x210 + (n) * 0x100)
+#define VFE_BUS_WM_IMAGE_CFG_2(n)	(BUS_REG_BASE + 0x214 + (n) * 0x100)
+#define		WM_IMAGE_CFG_2_DEFAULT_STRIDE	(0xFFFF)
+#define VFE_BUS_WM_PACKER_CFG(n)	(BUS_REG_BASE + 0x218 + (n) * 0x100)
+#define VFE_BUS_WM_HEADER_ADDR(n)	(BUS_REG_BASE + 0x220 + (n) * 0x100)
+#define VFE_BUS_WM_HEADER_INCR(n)	(BUS_REG_BASE + 0x224 + (n) * 0x100)
+#define VFE_BUS_WM_HEADER_CFG(n)	(BUS_REG_BASE + 0x228 + (n) * 0x100)
+
+#define VFE_BUS_WM_IRQ_SUBSAMPLE_PERIOD(n)	(BUS_REG_BASE + 0x230 + (n) * 0x100)
+#define VFE_BUS_WM_IRQ_SUBSAMPLE_PATTERN(n)	(BUS_REG_BASE + 0x234 + (n) * 0x100)
+#define VFE_BUS_WM_FRAMEDROP_PERIOD(n)		(BUS_REG_BASE + 0x238 + (n) * 0x100)
+#define VFE_BUS_WM_FRAMEDROP_PATTERN(n)		(BUS_REG_BASE + 0x23c + (n) * 0x100)
+
+#define VFE_BUS_WM_MMU_PREFETCH_CFG(n)		(BUS_REG_BASE + 0x260 + (n) * 0x100)
+#define VFE_BUS_WM_MMU_PREFETCH_MAX_OFFSET(n)	(BUS_REG_BASE + 0x264 + (n) * 0x100)
+#define VFE_BUS_WM_SYSTEM_CACHE_CFG(n)		(BUS_REG_BASE + 0x268 + (n) * 0x100)
+
+#define VFE_BUS_WM_STATUS_DEBUG_CFG(n)		(BUS_REG_BASE + 0x280 + (n) * 0x100)
+
+/* for titan 690, each bus client is hardcoded to a specific path */
+#define RDI_WM(n)			((vfe_is_lite(vfe) ? 0x0 : 0x10) + (n))
+
+static void vfe_wm_start(struct vfe_device *vfe, u8 wm, struct vfe_line *line)
+{
+	struct v4l2_pix_format_mplane *pix =
+		&line->video_out.active_fmt.fmt.pix_mp;
+
+	wm = RDI_WM(wm);
+
+	writel(WM_CGC_OVERRIDE_ALL, vfe->base + VFE_BUS_WM_CGC_OVERRIDE);
+	/* no clock gating at bus input */
+	writel(0x0, vfe->base + VFE_BUS_WM_TEST_BUS_CTRL);
+
+	writel(ALIGN(pix->plane_fmt[0].bytesperline, 16) * pix->height,
+	       vfe->base + VFE_BUS_WM_FRAME_INCR(wm));
+	writel(WM_IMAGE_CFG_0_DEFAULT_WIDTH & 0xFFFF,
+	       vfe->base + VFE_BUS_WM_IMAGE_CFG_0(wm));
+	writel(WM_IMAGE_CFG_2_DEFAULT_STRIDE,
+	       vfe->base + VFE_BUS_WM_IMAGE_CFG_2(wm));
+
+	writel(0x0, vfe->base + VFE_BUS_WM_PACKER_CFG(wm));
+
+	/* TOP CORE CFG */
+	writel(0x600000, vfe->base + VFE_TOP_CORE_CFG);
+
+	/* Enable WM in frame based mode */
+	writel(WM_CFG_EN | WM_CFG_MODE, vfe->base + VFE_BUS_WM_CFG(wm));
+}
+
+static void vfe_wm_stop(struct vfe_device *vfe, u8 wm)
+{
+	wm = RDI_WM(wm); /* map to actual WM used (from wm=RDI index) */
+	writel(0, vfe->base + VFE_BUS_WM_CFG(wm));
+}
+
+static void vfe_wm_update(struct vfe_device *vfe, u8 wm, u32 addr,
+			  struct vfe_line *line)
+{
+	wm = RDI_WM(wm); /* map to actual WM used (from wm=RDI index) */
+	writel(addr, vfe->base + VFE_BUS_WM_IMAGE_ADDR(wm));
+}
+
+static void vfe_reg_update(struct vfe_device *vfe, enum vfe_line_id line_id)
+{
+	int port_id = line_id;
+
+	/* RUP(register update) registers has beem moved to CSID in Titan 690.
+	 * Notify the event of trigger RUP.
+	 */
+	camss_reg_update(vfe->camss, vfe->id, port_id, false);
+}
+
+static inline void vfe_reg_update_clear(struct vfe_device *vfe,
+					enum vfe_line_id line_id)
+{
+	int port_id = line_id;
+
+	/* RUP(register update) registers has beem moved to CSID in Titan 690.
+	 * Notify the event of trigger RUP clear.
+	 */
+	camss_reg_update(vfe->camss, vfe->id, port_id, true);
+}
+
+
+/*
+ * vfe_hw_version - Process write master done interrupt
+ * @vfe: VFE Device
+ *
+ * Return vfe hw version
+ */
+static u32 vfe_hw_version(struct vfe_device *vfe)
+{
+	u32 hw_version = readl_relaxed(vfe->base + VFE_HW_VERSION);
+
+	u32 gen = (hw_version >> HW_VERSION_GENERATION) & 0xF;
+	u32 rev = (hw_version >> HW_VERSION_REVISION) & 0xFFF;
+	u32 step = (hw_version >> HW_VERSION_STEPPING) & 0xFFFF;
+
+	dev_info(vfe->camss->dev, "VFE:%d HW Version = %u.%u.%u\n",
+		 vfe->id, gen, rev, step);
+
+	return hw_version;
+}
+
+/*
+ * vfe_buf_done - Process write master done interrupt
+ * @vfe: VFE Device
+ * @wm: Write master id
+ */
+static void vfe_buf_done(struct vfe_device *vfe, int wm)
+{
+	struct vfe_line *line = &vfe->line[vfe->wm_output_map[wm]];
+	struct camss_buffer *ready_buf;
+	struct vfe_output *output;
+	unsigned long flags;
+	u32 index;
+	u64 ts = ktime_get_ns();
+
+	spin_lock_irqsave(&vfe->output_lock, flags);
+
+	if (vfe->wm_output_map[wm] == VFE_LINE_NONE) {
+		dev_err_ratelimited(vfe->camss->dev,
+				    "Received wm done for unmapped index\n");
+		goto out_unlock;
+	}
+	output = &vfe->line[vfe->wm_output_map[wm]].output;
+
+	ready_buf = output->buf[0];
+	if (!ready_buf) {
+		dev_err_ratelimited(vfe->camss->dev,
+				    "Missing ready buf %d!\n", output->state);
+		goto out_unlock;
+	}
+
+	ready_buf->vb.vb2_buf.timestamp = ts;
+	ready_buf->vb.sequence = output->sequence++;
+
+	index = 0;
+	output->buf[0] = output->buf[1];
+	if (output->buf[0])
+		index = 1;
+
+	output->buf[index] = vfe_buf_get_pending(output);
+
+	if (output->buf[index]) {
+		vfe->res->hw_ops->vfe_wm_update(vfe, output->wm_idx[0],
+						output->buf[index]->addr[0],
+						line);
+		vfe->res->hw_ops->reg_update(vfe, line->id);
+	} else
+		output->gen2.active_num--;
+
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+
+	vb2_buffer_done(&ready_buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
+
+	return;
+
+out_unlock:
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+}
+
+static int vfe_enable_output_v2(struct vfe_line *line)
+{
+	struct vfe_device *vfe = to_vfe(line);
+	struct vfe_output *output = &line->output;
+	const struct vfe_hw_ops *ops = vfe->res->hw_ops;
+	struct media_entity *sensor;
+	unsigned long flags;
+	unsigned int frame_skip = 0;
+	unsigned int i;
+
+	sensor = camss_find_sensor(&line->subdev.entity);
+	if (sensor) {
+		struct v4l2_subdev *subdev = media_entity_to_v4l2_subdev(sensor);
+
+		v4l2_subdev_call(subdev, sensor, g_skip_frames, &frame_skip);
+		/* Max frame skip is 29 frames */
+		if (frame_skip > VFE_FRAME_DROP_VAL - 1)
+			frame_skip = VFE_FRAME_DROP_VAL - 1;
+	}
+
+	spin_lock_irqsave(&vfe->output_lock, flags);
+
+	ops->reg_update_clear(vfe, line->id);
+
+	if (output->state > VFE_OUTPUT_RESERVED) {
+		dev_err(vfe->camss->dev,
+			"Output is not in reserved state %d\n",
+			output->state);
+		spin_unlock_irqrestore(&vfe->output_lock, flags);
+		return -EINVAL;
+	}
+
+	WARN_ON(output->gen2.active_num);
+
+	output->state = VFE_OUTPUT_ON;
+
+	output->sequence = 0;
+	output->wait_reg_update = 0;
+	reinit_completion(&output->reg_update);
+
+	ops->vfe_wm_start(vfe, output->wm_idx[0], line);
+
+	for (i = 0; i < 2; i++) {
+		output->buf[i] = vfe_buf_get_pending(output);
+		if (!output->buf[i])
+			break;
+		output->gen2.active_num++;
+		ops->vfe_wm_update(vfe, output->wm_idx[0],
+				   output->buf[i]->addr[0], line);
+		ops->reg_update(vfe, line->id);
+	}
+
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+
+	return 0;
+}
+
+/*
+ * vfe_queue_buffer_v2 - Add empty buffer
+ * @vid: Video device structure
+ * @buf: Buffer to be enqueued
+ *
+ * Add an empty buffer - depending on the current number of buffers it will be
+ * put in pending buffer queue or directly given to the hardware to be filled.
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int vfe_queue_buffer_v2(struct camss_video *vid,
+			struct camss_buffer *buf)
+{
+	struct vfe_line *line = container_of(vid, struct vfe_line, video_out);
+	struct vfe_device *vfe = to_vfe(line);
+	struct vfe_output *output;
+	unsigned long flags;
+
+	output = &line->output;
+
+	spin_lock_irqsave(&vfe->output_lock, flags);
+
+	if (output->state == VFE_OUTPUT_ON &&
+		output->gen2.active_num < 2) {
+		output->buf[output->gen2.active_num++] = buf;
+		vfe->res->hw_ops->vfe_wm_update(vfe, output->wm_idx[0],
+						buf->addr[0], line);
+		vfe->res->hw_ops->reg_update(vfe, line->id);
+	} else {
+		vfe_buf_add_pending(output, buf);
+	}
+
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+
+	return 0;
+}
+
+/*
+ * vfe_get_output_v2 - Get vfe output port for corresponding VFE line
+ * @line: VFE line
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int vfe_get_output_v2(struct vfe_line *line)
+{
+	struct vfe_device *vfe = to_vfe(line);
+	struct vfe_output *output;
+	unsigned long flags;
+
+	spin_lock_irqsave(&vfe->output_lock, flags);
+
+	output = &line->output;
+	if (output->state > VFE_OUTPUT_RESERVED) {
+		dev_err(vfe->camss->dev, "Output is running\n");
+		goto error;
+	}
+
+	output->wm_num = 1;
+
+	/* Correspondence between VFE line number and WM number.
+	 * line 0 -> RDI 0, line 1 -> RDI1, line 2 -> RDI2, line 3 -> PIX/RDI3
+	 * Note this 1:1 mapping will not work for PIX streams.
+	 */
+	output->wm_idx[0] = line->id;
+	vfe->wm_output_map[line->id] = line->id;
+
+	output->drop_update_idx = 0;
+
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+
+	return 0;
+
+error:
+	spin_unlock_irqrestore(&vfe->output_lock, flags);
+	output->state = VFE_OUTPUT_OFF;
+
+	return -EINVAL;
+}
+
+/*
+ * vfe_enable_v2 - Enable streaming on VFE line
+ * @line: VFE line
+ *
+ * Return 0 on success or a negative error code otherwise
+ */
+static int vfe_enable_v2(struct vfe_line *line)
+{
+	struct vfe_device *vfe = to_vfe(line);
+	int ret;
+
+	mutex_lock(&vfe->stream_lock);
+
+	if (vfe->res->hw_ops->enable_irq_common)
+		vfe->res->hw_ops->enable_irq_common(vfe);
+
+	vfe->stream_count++;
+
+	mutex_unlock(&vfe->stream_lock);
+
+	ret = vfe_get_output_v2(line);
+	if (ret < 0)
+		goto error_get_output;
+
+	ret = vfe_enable_output_v2(line);
+	if (ret < 0)
+		goto error_enable_output;
+
+	vfe->was_streaming = 1;
+
+	return 0;
+
+error_enable_output:
+	vfe_put_output(line);
+
+error_get_output:
+	mutex_lock(&vfe->stream_lock);
+
+	vfe->stream_count--;
+
+	mutex_unlock(&vfe->stream_lock);
+
+	return ret;
+}
+
+
+static const struct camss_video_ops vfe_video_ops_690 = {
+	.queue_buffer = vfe_queue_buffer_v2,
+	.flush_buffers = vfe_flush_buffers,
+};
+
+static void vfe_subdev_init(struct device *dev, struct vfe_device *vfe)
+{
+	vfe->video_ops = vfe_video_ops_690;
+}
+
+const struct vfe_hw_ops vfe_ops_690 = {
+	.enable_irq_common = NULL,
+	.global_reset = NULL,
+	.hw_version = vfe_hw_version,
+	.isr = NULL,
+	.pm_domain_off = vfe_pm_domain_off,
+	.pm_domain_on = vfe_pm_domain_on,
+	.reg_update = vfe_reg_update,
+	.reg_update_clear = vfe_reg_update_clear,
+	.subdev_init = vfe_subdev_init,
+	.vfe_disable = vfe_disable,
+	.vfe_enable = vfe_enable_v2,
+	.vfe_halt = NULL,
+	.vfe_wm_start = vfe_wm_start,
+	.vfe_wm_stop = vfe_wm_stop,
+	.vfe_buf_done = vfe_buf_done,
+	.vfe_wm_update = vfe_wm_update,
+};
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-vfe-gen1.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-vfe-gen1.c
@@ -37,7 +37,7 @@
 {
 	struct vfe_device *vfe = to_vfe(line);
 	struct vfe_output *output = &line->output;
-	const struct vfe_hw_ops *ops = vfe->ops;
+	const struct vfe_hw_ops *ops = vfe->res->hw_ops;
 	unsigned long flags;
 	unsigned long time;
 	unsigned int i;
@@ -162,14 +162,14 @@
 		vfe->ops_gen1->wm_set_framedrop_pattern(vfe, output->wm_idx[i], drop_pattern);
 	}
 
-	vfe->ops->reg_update(vfe, container_of(output, struct vfe_line, output)->id);
+	vfe->res->hw_ops->reg_update(vfe, container_of(output, struct vfe_line, output)->id);
 }
 
 static int vfe_enable_output(struct vfe_line *line)
 {
 	struct vfe_device *vfe = to_vfe(line);
 	struct vfe_output *output = &line->output;
-	const struct vfe_hw_ops *ops = vfe->ops;
+	const struct vfe_hw_ops *ops = vfe->res->hw_ops;
 	struct media_entity *sensor;
 	unsigned long flags;
 	unsigned int frame_skip = 0;
@@ -545,7 +545,7 @@
 	unsigned long flags;
 
 	spin_lock_irqsave(&vfe->output_lock, flags);
-	vfe->ops->reg_update_clear(vfe, line_id);
+	vfe->res->hw_ops->reg_update_clear(vfe, line_id);
 
 	output = &line->output;
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-vfe.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -32,139 +32,251 @@
 
 #define SCALER_RATIO_MAX 16
 
-struct vfe_format {
-	u32 code;
-	u8 bpp;
+static const struct camss_format_info formats_rdi_8x16[] = {
+	{ MEDIA_BUS_FMT_UYVY8_1X16, 8, V4L2_PIX_FMT_UYVY, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_VYUY8_1X16, 8, V4L2_PIX_FMT_VYUY, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_YUYV8_1X16, 8, V4L2_PIX_FMT_YUYV, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_YVYU8_1X16, 8, V4L2_PIX_FMT_YVYU, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_SBGGR8_1X8, 8, V4L2_PIX_FMT_SBGGR8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SGBRG8_1X8, 8, V4L2_PIX_FMT_SGBRG8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SGRBG8_1X8, 8, V4L2_PIX_FMT_SGRBG8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SRGGB8_1X8, 8, V4L2_PIX_FMT_SRGGB8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SBGGR10_1X10, 10, V4L2_PIX_FMT_SBGGR10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SGBRG10_1X10, 10, V4L2_PIX_FMT_SGBRG10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SGRBG10_1X10, 10, V4L2_PIX_FMT_SGRBG10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10, V4L2_PIX_FMT_SRGGB10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SBGGR12_1X12, 12, V4L2_PIX_FMT_SBGGR12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SGBRG12_1X12, 12, V4L2_PIX_FMT_SGBRG12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SGRBG12_1X12, 12, V4L2_PIX_FMT_SGRBG12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12, V4L2_PIX_FMT_SRGGB12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_Y10_1X10, 10, V4L2_PIX_FMT_Y10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
 };
 
-static const struct vfe_format formats_rdi_8x16[] = {
-	{ MEDIA_BUS_FMT_UYVY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, 8 },
-	{ MEDIA_BUS_FMT_SBGGR8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SGBRG8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SGRBG8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SRGGB8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SBGGR10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SGBRG10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SGRBG10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SBGGR12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SGBRG12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SGRBG12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12 },
-	{ MEDIA_BUS_FMT_Y10_1X10, 10 },
+static const struct camss_format_info formats_rdi_8x96[] = {
+	{ MEDIA_BUS_FMT_UYVY8_1X16, 8, V4L2_PIX_FMT_UYVY, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_VYUY8_1X16, 8, V4L2_PIX_FMT_VYUY, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_YUYV8_1X16, 8, V4L2_PIX_FMT_YUYV, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_YVYU8_1X16, 8, V4L2_PIX_FMT_YVYU, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_SBGGR8_1X8, 8, V4L2_PIX_FMT_SBGGR8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SGBRG8_1X8, 8, V4L2_PIX_FMT_SGBRG8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SGRBG8_1X8, 8, V4L2_PIX_FMT_SGRBG8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SRGGB8_1X8, 8, V4L2_PIX_FMT_SRGGB8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SBGGR10_1X10, 10, V4L2_PIX_FMT_SBGGR10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SGBRG10_1X10, 10, V4L2_PIX_FMT_SGBRG10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SGRBG10_1X10, 10, V4L2_PIX_FMT_SGRBG10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10, V4L2_PIX_FMT_SRGGB10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SBGGR10_2X8_PADHI_LE, 16, V4L2_PIX_FMT_SBGGR10, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_SBGGR12_1X12, 12, V4L2_PIX_FMT_SBGGR12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SGBRG12_1X12, 12, V4L2_PIX_FMT_SGBRG12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SGRBG12_1X12, 12, V4L2_PIX_FMT_SGRBG12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12, V4L2_PIX_FMT_SRGGB12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SBGGR14_1X14, 14, V4L2_PIX_FMT_SBGGR14P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 14) },
+	{ MEDIA_BUS_FMT_SGBRG14_1X14, 14, V4L2_PIX_FMT_SGBRG14P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 14) },
+	{ MEDIA_BUS_FMT_SGRBG14_1X14, 14, V4L2_PIX_FMT_SGRBG14P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 14) },
+	{ MEDIA_BUS_FMT_SRGGB14_1X14, 14, V4L2_PIX_FMT_SRGGB14P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 14) },
+	{ MEDIA_BUS_FMT_Y10_1X10, 10, V4L2_PIX_FMT_Y10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_Y10_2X8_PADHI_LE, 16, V4L2_PIX_FMT_Y10, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
 };
 
-static const struct vfe_format formats_pix_8x16[] = {
-	{ MEDIA_BUS_FMT_UYVY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, 8 },
+static const struct camss_format_info formats_rdi_845[] = {
+	{ MEDIA_BUS_FMT_UYVY8_1X16, 8, V4L2_PIX_FMT_UYVY, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_VYUY8_1X16, 8, V4L2_PIX_FMT_VYUY, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_YUYV8_1X16, 8, V4L2_PIX_FMT_YUYV, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_YVYU8_1X16, 8, V4L2_PIX_FMT_YVYU, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_SBGGR8_1X8, 8, V4L2_PIX_FMT_SBGGR8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SGBRG8_1X8, 8, V4L2_PIX_FMT_SGBRG8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SGRBG8_1X8, 8, V4L2_PIX_FMT_SGRBG8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SRGGB8_1X8, 8, V4L2_PIX_FMT_SRGGB8, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_SBGGR10_1X10, 10, V4L2_PIX_FMT_SBGGR10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SGBRG10_1X10, 10, V4L2_PIX_FMT_SGBRG10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SGRBG10_1X10, 10, V4L2_PIX_FMT_SGRBG10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10, V4L2_PIX_FMT_SRGGB10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_SBGGR10_2X8_PADHI_LE, 16, V4L2_PIX_FMT_SBGGR10, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_SBGGR12_1X12, 12, V4L2_PIX_FMT_SBGGR12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SGBRG12_1X12, 12, V4L2_PIX_FMT_SGBRG12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SGRBG12_1X12, 12, V4L2_PIX_FMT_SGRBG12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12, V4L2_PIX_FMT_SRGGB12P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 12) },
+	{ MEDIA_BUS_FMT_SBGGR14_1X14, 14, V4L2_PIX_FMT_SBGGR14P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 14) },
+	{ MEDIA_BUS_FMT_SGBRG14_1X14, 14, V4L2_PIX_FMT_SGBRG14P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 14) },
+	{ MEDIA_BUS_FMT_SGRBG14_1X14, 14, V4L2_PIX_FMT_SGRBG14P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 14) },
+	{ MEDIA_BUS_FMT_SRGGB14_1X14, 14, V4L2_PIX_FMT_SRGGB14P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 14) },
+	{ MEDIA_BUS_FMT_Y8_1X8, 8, V4L2_PIX_FMT_GREY, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 8) },
+	{ MEDIA_BUS_FMT_Y10_1X10, 10, V4L2_PIX_FMT_Y10P, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 10) },
+	{ MEDIA_BUS_FMT_Y10_2X8_PADHI_LE, 16, V4L2_PIX_FMT_Y10, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
 };
 
-static const struct vfe_format formats_rdi_8x96[] = {
-	{ MEDIA_BUS_FMT_UYVY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, 8 },
-	{ MEDIA_BUS_FMT_SBGGR8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SGBRG8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SGRBG8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SRGGB8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SBGGR10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SGBRG10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SGRBG10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SBGGR10_2X8_PADHI_LE, 16 },
-	{ MEDIA_BUS_FMT_SBGGR12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SGBRG12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SGRBG12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SBGGR14_1X14, 14 },
-	{ MEDIA_BUS_FMT_SGBRG14_1X14, 14 },
-	{ MEDIA_BUS_FMT_SGRBG14_1X14, 14 },
-	{ MEDIA_BUS_FMT_SRGGB14_1X14, 14 },
-	{ MEDIA_BUS_FMT_Y10_1X10, 10 },
-	{ MEDIA_BUS_FMT_Y10_2X8_PADHI_LE, 16 },
+static const struct camss_format_info formats_pix_8x16[] = {
+	{ MEDIA_BUS_FMT_YUYV8_1_5X8, 8, V4L2_PIX_FMT_NV12, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_YVYU8_1_5X8, 8, V4L2_PIX_FMT_NV12, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_UYVY8_1_5X8, 8, V4L2_PIX_FMT_NV12, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_VYUY8_1_5X8, 8, V4L2_PIX_FMT_NV12, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_YUYV8_1_5X8, 8, V4L2_PIX_FMT_NV21, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_YVYU8_1_5X8, 8, V4L2_PIX_FMT_NV21, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_UYVY8_1_5X8, 8, V4L2_PIX_FMT_NV21, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_VYUY8_1_5X8, 8, V4L2_PIX_FMT_NV21, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_YUYV8_1X16, 8, V4L2_PIX_FMT_NV16, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_YVYU8_1X16, 8, V4L2_PIX_FMT_NV16, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_UYVY8_1X16, 8, V4L2_PIX_FMT_NV16, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_VYUY8_1X16, 8, V4L2_PIX_FMT_NV16, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_YUYV8_1X16, 8, V4L2_PIX_FMT_NV61, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_YVYU8_1X16, 8, V4L2_PIX_FMT_NV61, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_UYVY8_1X16, 8, V4L2_PIX_FMT_NV61, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_VYUY8_1X16, 8, V4L2_PIX_FMT_NV61, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
 };
 
-static const struct vfe_format formats_pix_8x96[] = {
-	{ MEDIA_BUS_FMT_UYVY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, 8 },
+static const struct camss_format_info formats_pix_8x96[] = {
+	{ MEDIA_BUS_FMT_YUYV8_1_5X8, 8, V4L2_PIX_FMT_NV12, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_YVYU8_1_5X8, 8, V4L2_PIX_FMT_NV12, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_UYVY8_1_5X8, 8, V4L2_PIX_FMT_NV12, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_VYUY8_1_5X8, 8, V4L2_PIX_FMT_NV12, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_YUYV8_1_5X8, 8, V4L2_PIX_FMT_NV21, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_YVYU8_1_5X8, 8, V4L2_PIX_FMT_NV21, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_UYVY8_1_5X8, 8, V4L2_PIX_FMT_NV21, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_VYUY8_1_5X8, 8, V4L2_PIX_FMT_NV21, 1,
+	  PER_PLANE_DATA(0, 1, 1, 2, 3, 8) },
+	{ MEDIA_BUS_FMT_YUYV8_1X16, 8, V4L2_PIX_FMT_NV16, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_YVYU8_1X16, 8, V4L2_PIX_FMT_NV16, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_UYVY8_1X16, 8, V4L2_PIX_FMT_NV16, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_VYUY8_1X16, 8, V4L2_PIX_FMT_NV16, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_YUYV8_1X16, 8, V4L2_PIX_FMT_NV61, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_YVYU8_1X16, 8, V4L2_PIX_FMT_NV61, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_UYVY8_1X16, 8, V4L2_PIX_FMT_NV61, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_VYUY8_1X16, 8, V4L2_PIX_FMT_NV61, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 2, 8) },
+	{ MEDIA_BUS_FMT_UYVY8_1X16, 8, V4L2_PIX_FMT_UYVY, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_VYUY8_1X16, 8, V4L2_PIX_FMT_VYUY, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_YUYV8_1X16, 8, V4L2_PIX_FMT_YUYV, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
+	{ MEDIA_BUS_FMT_YVYU8_1X16, 8, V4L2_PIX_FMT_YVYU, 1,
+	  PER_PLANE_DATA(0, 1, 1, 1, 1, 16) },
 };
 
-static const struct vfe_format formats_rdi_845[] = {
-	{ MEDIA_BUS_FMT_UYVY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, 8 },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, 8 },
-	{ MEDIA_BUS_FMT_SBGGR8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SGBRG8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SGRBG8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SRGGB8_1X8, 8 },
-	{ MEDIA_BUS_FMT_SBGGR10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SGBRG10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SGRBG10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SRGGB10_1X10, 10 },
-	{ MEDIA_BUS_FMT_SBGGR10_2X8_PADHI_LE, 16 },
-	{ MEDIA_BUS_FMT_SBGGR12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SGBRG12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SGRBG12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SRGGB12_1X12, 12 },
-	{ MEDIA_BUS_FMT_SBGGR14_1X14, 14 },
-	{ MEDIA_BUS_FMT_SGBRG14_1X14, 14 },
-	{ MEDIA_BUS_FMT_SGRBG14_1X14, 14 },
-	{ MEDIA_BUS_FMT_SRGGB14_1X14, 14 },
-	{ MEDIA_BUS_FMT_Y8_1X8, 8 },
-	{ MEDIA_BUS_FMT_Y10_1X10, 10 },
-	{ MEDIA_BUS_FMT_Y10_2X8_PADHI_LE, 16 },
+const struct camss_formats vfe_formats_rdi_8x16 = {
+	.nformats = ARRAY_SIZE(formats_rdi_8x16),
+	.formats = formats_rdi_8x16
 };
 
-/*
- * vfe_get_bpp - map media bus format to bits per pixel
- * @formats: supported media bus formats array
- * @nformats: size of @formats array
- * @code: media bus format code
- *
- * Return number of bits per pixel
- */
-static u8 vfe_get_bpp(const struct vfe_format *formats,
-		      unsigned int nformats, u32 code)
-{
-	unsigned int i;
-
-	for (i = 0; i < nformats; i++)
-		if (code == formats[i].code)
-			return formats[i].bpp;
-
-	WARN(1, "Unknown format\n");
-
-	return formats[0].bpp;
-}
+const struct camss_formats vfe_formats_pix_8x16 = {
+	.nformats = ARRAY_SIZE(formats_pix_8x16),
+	.formats = formats_pix_8x16
+};
 
-static u32 vfe_find_code(u32 *code, unsigned int n_code,
-			 unsigned int index, u32 req_code)
-{
-	int i;
+const struct camss_formats vfe_formats_rdi_8x96 = {
+	.nformats = ARRAY_SIZE(formats_rdi_8x96),
+	.formats = formats_rdi_8x96
+};
 
-	if (!req_code && (index >= n_code))
-		return 0;
+const struct camss_formats vfe_formats_pix_8x96 = {
+	.nformats = ARRAY_SIZE(formats_pix_8x96),
+	.formats = formats_pix_8x96
+};
 
-	for (i = 0; i < n_code; i++)
-		if (req_code) {
-			if (req_code == code[i])
-				return req_code;
-		} else {
-			if (i == index)
-				return code[i];
-		}
+const struct camss_formats vfe_formats_rdi_845 = {
+	.nformats = ARRAY_SIZE(formats_rdi_845),
+	.formats = formats_rdi_845
+};
 
-	return code[0];
-}
+/* TODO: Replace with pix formats */
+const struct camss_formats vfe_formats_pix_845 = {
+	.nformats = ARRAY_SIZE(formats_rdi_845),
+	.formats = formats_rdi_845
+};
 
 static u32 vfe_src_pad_code(struct vfe_line *line, u32 sink_code,
 			    unsigned int index, u32 src_req_code)
@@ -181,8 +293,8 @@
 				MEDIA_BUS_FMT_YUYV8_1_5X8,
 			};
 
-			return vfe_find_code(src_code, ARRAY_SIZE(src_code),
-					     index, src_req_code);
+			return camss_format_find_code(src_code, ARRAY_SIZE(src_code),
+						      index, src_req_code);
 		}
 		case MEDIA_BUS_FMT_YVYU8_1X16:
 		{
@@ -191,8 +303,8 @@
 				MEDIA_BUS_FMT_YVYU8_1_5X8,
 			};
 
-			return vfe_find_code(src_code, ARRAY_SIZE(src_code),
-					     index, src_req_code);
+			return camss_format_find_code(src_code, ARRAY_SIZE(src_code),
+						      index, src_req_code);
 		}
 		case MEDIA_BUS_FMT_UYVY8_1X16:
 		{
@@ -201,8 +313,8 @@
 				MEDIA_BUS_FMT_UYVY8_1_5X8,
 			};
 
-			return vfe_find_code(src_code, ARRAY_SIZE(src_code),
-					     index, src_req_code);
+			return camss_format_find_code(src_code, ARRAY_SIZE(src_code),
+						      index, src_req_code);
 		}
 		case MEDIA_BUS_FMT_VYUY8_1X16:
 		{
@@ -211,8 +323,8 @@
 				MEDIA_BUS_FMT_VYUY8_1_5X8,
 			};
 
-			return vfe_find_code(src_code, ARRAY_SIZE(src_code),
-					     index, src_req_code);
+			return camss_format_find_code(src_code, ARRAY_SIZE(src_code),
+						      index, src_req_code);
 		}
 		default:
 			if (index > 0)
@@ -221,10 +333,14 @@
 			return sink_code;
 		}
 		break;
-	case CAMSS_8x96:
 	case CAMSS_660:
-	case CAMSS_845:
+	case CAMSS_7280:
+	case CAMSS_8x96:
 	case CAMSS_8250:
+	case CAMSS_8280XP:
+	case CAMSS_845:
+	case CAMSS_8775P:
+	case CAMSS_8300:
 		switch (sink_code) {
 		case MEDIA_BUS_FMT_YUYV8_1X16:
 		{
@@ -236,8 +352,8 @@
 				MEDIA_BUS_FMT_YUYV8_1_5X8,
 			};
 
-			return vfe_find_code(src_code, ARRAY_SIZE(src_code),
-					     index, src_req_code);
+			return camss_format_find_code(src_code, ARRAY_SIZE(src_code),
+						      index, src_req_code);
 		}
 		case MEDIA_BUS_FMT_YVYU8_1X16:
 		{
@@ -249,8 +365,8 @@
 				MEDIA_BUS_FMT_YVYU8_1_5X8,
 			};
 
-			return vfe_find_code(src_code, ARRAY_SIZE(src_code),
-					     index, src_req_code);
+			return camss_format_find_code(src_code, ARRAY_SIZE(src_code),
+						      index, src_req_code);
 		}
 		case MEDIA_BUS_FMT_UYVY8_1X16:
 		{
@@ -262,8 +378,8 @@
 				MEDIA_BUS_FMT_UYVY8_1_5X8,
 			};
 
-			return vfe_find_code(src_code, ARRAY_SIZE(src_code),
-					     index, src_req_code);
+			return camss_format_find_code(src_code, ARRAY_SIZE(src_code),
+						      index, src_req_code);
 		}
 		case MEDIA_BUS_FMT_VYUY8_1X16:
 		{
@@ -275,8 +391,8 @@
 				MEDIA_BUS_FMT_VYUY8_1_5X8,
 			};
 
-			return vfe_find_code(src_code, ARRAY_SIZE(src_code),
-					     index, src_req_code);
+			return camss_format_find_code(src_code, ARRAY_SIZE(src_code),
+						      index, src_req_code);
 		}
 		default:
 			if (index > 0)
@@ -293,15 +409,17 @@
 {
 	unsigned long time;
 
-	reinit_completion(&vfe->reset_complete);
+	if (vfe->res->hw_ops->global_reset) {
+		reinit_completion(&vfe->reset_complete);
 
-	vfe->ops->global_reset(vfe);
+		vfe->res->hw_ops->global_reset(vfe);
 
-	time = wait_for_completion_timeout(&vfe->reset_complete,
-		msecs_to_jiffies(VFE_RESET_TIMEOUT_MS));
-	if (!time) {
-		dev_err(vfe->camss->dev, "VFE reset timeout\n");
-		return -EIO;
+		time = wait_for_completion_timeout(&vfe->reset_complete,
+			msecs_to_jiffies(VFE_RESET_TIMEOUT_MS));
+		if (!time) {
+			dev_err(vfe->camss->dev, "VFE reset timeout\n");
+			return -EIO;
+		}
 	}
 
 	return 0;
@@ -311,7 +429,7 @@
 {
 	int i;
 
-	for (i = 0; i < vfe->line_num; i++) {
+	for (i = 0; i < vfe->res->line_num; i++) {
 		struct vfe_output *output = &vfe->line[i].output;
 
 		output->state = VFE_OUTPUT_OFF;
@@ -420,7 +538,7 @@
 
 	spin_lock_irqsave(&vfe->output_lock, flags);
 	for (i = 0; i < output->wm_num; i++)
-		vfe->ops->vfe_wm_stop(vfe, output->wm_idx[i]);
+		vfe->res->hw_ops->vfe_wm_stop(vfe, output->wm_idx[i]);
 	output->gen2.active_num = 0;
 	spin_unlock_irqrestore(&vfe->output_lock, flags);
 
@@ -520,7 +638,8 @@
 
 	return (!strcmp(clock->name, vfe_name) ||
 		!strcmp(clock->name, vfe_lite_name) ||
-		!strcmp(clock->name, "vfe_lite"));
+		!strcmp(clock->name, "vfe_lite") ||
+		!strcmp(clock->name, "camnoc_axi"));
 }
 
 /*
@@ -536,7 +655,7 @@
 	int i, j;
 	int ret;
 
-	for (i = VFE_LINE_RDI0; i < vfe->line_num; i++) {
+	for (i = VFE_LINE_RDI0; i < vfe->res->line_num; i++) {
 		ret = camss_get_pixel_clock(&vfe->line[i].subdev.entity,
 					    &pixel_clock[i]);
 		if (ret)
@@ -550,7 +669,7 @@
 			u64 min_rate = 0;
 			long rate;
 
-			for (j = VFE_LINE_RDI0; j < vfe->line_num; j++) {
+			for (j = VFE_LINE_RDI0; j < vfe->res->line_num; j++) {
 				u32 tmp;
 				u8 bpp;
 
@@ -559,9 +678,9 @@
 				} else {
 					struct vfe_line *l = &vfe->line[j];
 
-					bpp = vfe_get_bpp(l->formats,
-						l->nformats,
-						l->fmt[MSM_VFE_PAD_SINK].code);
+					bpp = camss_format_get_bpp(l->formats,
+								   l->nformats,
+								   l->fmt[MSM_VFE_PAD_SINK].code);
 					tmp = pixel_clock[j] * bpp / 64;
 				}
 
@@ -617,7 +736,7 @@
 	int i, j;
 	int ret;
 
-	for (i = VFE_LINE_RDI0; i < vfe->line_num; i++) {
+	for (i = VFE_LINE_RDI0; i < vfe->res->line_num; i++) {
 		ret = camss_get_pixel_clock(&vfe->line[i].subdev.entity,
 					    &pixel_clock[i]);
 		if (ret)
@@ -631,7 +750,7 @@
 			u64 min_rate = 0;
 			unsigned long rate;
 
-			for (j = VFE_LINE_RDI0; j < vfe->line_num; j++) {
+			for (j = VFE_LINE_RDI0; j < vfe->res->line_num; j++) {
 				u32 tmp;
 				u8 bpp;
 
@@ -640,9 +759,9 @@
 				} else {
 					struct vfe_line *l = &vfe->line[j];
 
-					bpp = vfe_get_bpp(l->formats,
-						l->nformats,
-						l->fmt[MSM_VFE_PAD_SINK].code);
+					bpp = camss_format_get_bpp(l->formats,
+								   l->nformats,
+								   l->fmt[MSM_VFE_PAD_SINK].code);
 					tmp = pixel_clock[j] * bpp / 64;
 				}
 
@@ -674,10 +793,11 @@
 	mutex_lock(&vfe->power_lock);
 
 	if (vfe->power_count == 0) {
-		ret = vfe->ops->pm_domain_on(vfe);
+		ret = vfe->res->hw_ops->pm_domain_on(vfe);
 		if (ret < 0)
 			goto error_pm_domain;
 
+		dev_pm_genpd_set_performance_state(vfe->camss->dev, RPMP_PERF_STATE_NOM);
 		ret = pm_runtime_resume_and_get(vfe->camss->dev);
 		if (ret < 0)
 			goto error_domain_off;
@@ -699,7 +819,7 @@
 
 		vfe_init_outputs(vfe);
 
-		vfe->ops->hw_version(vfe);
+		vfe->res->hw_ops->hw_version(vfe);
 	} else {
 		ret = vfe_check_clock_rates(vfe);
 		if (ret < 0)
@@ -717,7 +837,7 @@
 error_pm_runtime_get:
 	pm_runtime_put_sync(vfe->camss->dev);
 error_domain_off:
-	vfe->ops->pm_domain_off(vfe);
+	vfe->res->hw_ops->pm_domain_off(vfe);
 
 error_pm_domain:
 	mutex_unlock(&vfe->power_lock);
@@ -739,11 +859,12 @@
 	} else if (vfe->power_count == 1) {
 		if (vfe->was_streaming) {
 			vfe->was_streaming = 0;
-			vfe->ops->vfe_halt(vfe);
+			if (vfe->res->hw_ops->vfe_halt)
+				vfe->res->hw_ops->vfe_halt(vfe);
 		}
 		camss_disable_clocks(vfe->nclocks, vfe->clock);
 		pm_runtime_put_sync(vfe->camss->dev);
-		vfe->ops->pm_domain_off(vfe);
+		vfe->res->hw_ops->pm_domain_off(vfe);
 	}
 
 	vfe->power_count--;
@@ -833,12 +954,12 @@
 
 	if (enable) {
 		line->output.state = VFE_OUTPUT_RESERVED;
-		ret = vfe->ops->vfe_enable(line);
+		ret = vfe->res->hw_ops->vfe_enable(line);
 		if (ret < 0)
 			dev_err(vfe->camss->dev,
 				"Failed to enable vfe outputs\n");
 	} else {
-		ret = vfe->ops->vfe_disable(line);
+		ret = vfe->res->hw_ops->vfe_disable(line);
 		if (ret < 0)
 			dev_err(vfe->camss->dev,
 				"Failed to disable vfe outputs\n");
@@ -1375,23 +1496,24 @@
 	int i, j;
 	int ret;
 
-	vfe->ops = res->ops;
-
-	if (!res->line_num)
+	if (!res->vfe.line_num)
 		return -EINVAL;
 
+	vfe->res = &res->vfe;
+	vfe->res->hw_ops->subdev_init(dev, vfe);
+
 	/* Power domain */
 
-	if (res->pd_name) {
+	if (res->vfe.pd_name) {
 		vfe->genpd = dev_pm_domain_attach_by_name(camss->dev,
-							  res->pd_name);
+							  res->vfe.pd_name);
 		if (IS_ERR(vfe->genpd)) {
 			ret = PTR_ERR(vfe->genpd);
 			return ret;
 		}
 	}
 
-	if (!vfe->genpd && res->has_pd) {
+	if (!vfe->genpd && res->vfe.has_pd) {
 		/*
 		 * Legacy magic index.
 		 * Requires
@@ -1408,9 +1530,6 @@
 			return PTR_ERR(vfe->genpd);
 	}
 
-	vfe->line_num = res->line_num;
-	vfe->ops->subdev_init(dev, vfe);
-
 	/* Memory */
 
 	vfe->base = devm_platform_ioremap_resource_byname(pdev, res->reg[0]);
@@ -1428,11 +1547,13 @@
 	vfe->irq = ret;
 	snprintf(vfe->irq_name, sizeof(vfe->irq_name), "%s_%s%d",
 		 dev_name(dev), MSM_VFE_NAME, id);
-	ret = devm_request_irq(dev, vfe->irq, vfe->ops->isr,
-			       IRQF_TRIGGER_RISING, vfe->irq_name, vfe);
-	if (ret < 0) {
-		dev_err(dev, "request_irq failed: %d\n", ret);
-		return ret;
+	if (vfe->res->hw_ops->isr) {
+		ret = devm_request_irq(dev, vfe->irq, vfe->res->hw_ops->isr,
+				       IRQF_TRIGGER_RISING, vfe->irq_name, vfe);
+		if (ret < 0) {
+			dev_err(dev, "request_irq failed: %d\n", ret);
+			return ret;
+		}
 	}
 
 	/* Clocks */
@@ -1487,7 +1608,7 @@
 	vfe->id = id;
 	vfe->reg_update = 0;
 
-	for (i = VFE_LINE_RDI0; i < vfe->line_num; i++) {
+	for (i = VFE_LINE_RDI0; i < vfe->res->line_num; i++) {
 		struct vfe_line *l = &vfe->line[i];
 
 		l->video_out.type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
@@ -1496,31 +1617,12 @@
 		init_completion(&l->output.sof);
 		init_completion(&l->output.reg_update);
 
-		switch (camss->res->version) {
-		case CAMSS_8x16:
-			if (i == VFE_LINE_PIX) {
-				l->formats = formats_pix_8x16;
-				l->nformats = ARRAY_SIZE(formats_pix_8x16);
-			} else {
-				l->formats = formats_rdi_8x16;
-				l->nformats = ARRAY_SIZE(formats_rdi_8x16);
-			}
-			break;
-		case CAMSS_8x96:
-		case CAMSS_660:
-			if (i == VFE_LINE_PIX) {
-				l->formats = formats_pix_8x96;
-				l->nformats = ARRAY_SIZE(formats_pix_8x96);
-			} else {
-				l->formats = formats_rdi_8x96;
-				l->nformats = ARRAY_SIZE(formats_rdi_8x96);
-			}
-			break;
-		case CAMSS_845:
-		case CAMSS_8250:
-			l->formats = formats_rdi_845;
-			l->nformats = ARRAY_SIZE(formats_rdi_845);
-			break;
+		if (i == VFE_LINE_PIX) {
+			l->nformats = res->vfe.formats_pix->nformats;
+			l->formats = res->vfe.formats_pix->formats;
+		} else {
+			l->nformats = res->vfe.formats_rdi->nformats;
+			l->formats = res->vfe.formats_rdi->formats;
 		}
 	}
 
@@ -1595,6 +1697,26 @@
 	.link_validate = v4l2_subdev_link_validate,
 };
 
+static int vfe_bpl_align(struct vfe_device *vfe)
+{
+	int ret = 8;
+
+	switch (vfe->camss->res->version) {
+	case CAMSS_7280:
+	case CAMSS_8250:
+	case CAMSS_8280XP:
+	case CAMSS_845:
+	case CAMSS_8775P:
+	case CAMSS_8300:
+		ret = 16;
+		break;
+	default:
+		break;
+	}
+
+	return ret;
+}
+
 /*
  * msm_vfe_register_entities - Register subdev node for VFE module
  * @vfe: VFE device
@@ -1617,7 +1739,7 @@
 	int ret;
 	int i;
 
-	for (i = 0; i < vfe->line_num; i++) {
+	for (i = 0; i < vfe->res->line_num; i++) {
 		char name[32];
 
 		sd = &vfe->line[i].subdev;
@@ -1661,20 +1783,19 @@
 		}
 
 		video_out->ops = &vfe->video_ops;
-		if (vfe->camss->res->version == CAMSS_845 ||
-		    vfe->camss->res->version == CAMSS_8250)
-			video_out->bpl_alignment = 16;
-		else
-			video_out->bpl_alignment = 8;
+		video_out->bpl_alignment = vfe_bpl_align(vfe);
 		video_out->line_based = 0;
 		if (i == VFE_LINE_PIX) {
 			video_out->bpl_alignment = 16;
 			video_out->line_based = 1;
 		}
+
+		video_out->nformats = vfe->line[i].nformats;
+		video_out->formats = vfe->line[i].formats;
+
 		snprintf(name, ARRAY_SIZE(name), "%s%d_%s%d",
 			 MSM_VFE_NAME, vfe->id, "video", i);
-		ret = msm_video_register(video_out, v4l2_dev, name,
-					 i == VFE_LINE_PIX ? 1 : 0);
+		ret = msm_video_register(video_out, v4l2_dev, name);
 		if (ret < 0) {
 			dev_err(dev, "Failed to register video node: %d\n",
 				ret);
@@ -1728,7 +1849,7 @@
 	mutex_destroy(&vfe->power_lock);
 	mutex_destroy(&vfe->stream_lock);
 
-	for (i = 0; i < vfe->line_num; i++) {
+	for (i = 0; i < vfe->res->line_num; i++) {
 		struct v4l2_subdev *sd = &vfe->line[i].subdev;
 		struct camss_video *video_out = &vfe->line[i].video_out;
 
@@ -1740,5 +1861,5 @@
 
 bool vfe_is_lite(struct vfe_device *vfe)
 {
-	return vfe->camss->res->vfe_res[vfe->id].is_lite;
+	return vfe->camss->res->vfe_res[vfe->id].vfe.is_lite;
 }
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-vfe.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-vfe.h
@@ -92,7 +92,7 @@
 	struct v4l2_rect crop;
 	struct camss_video video_out;
 	struct vfe_output output;
-	const struct vfe_format *formats;
+	const struct camss_format_info *formats;
 	unsigned int nformats;
 };
 
@@ -114,7 +114,12 @@
 	int (*vfe_enable)(struct vfe_line *line);
 	int (*vfe_halt)(struct vfe_device *vfe);
 	void (*violation_read)(struct vfe_device *vfe);
+	void (*vfe_wm_start)(struct vfe_device *vfe, u8 wm,
+			     struct vfe_line *line);
 	void (*vfe_wm_stop)(struct vfe_device *vfe, u8 wm);
+	void (*vfe_buf_done)(struct vfe_device *vfe, int port_id);
+	void (*vfe_wm_update)(struct vfe_device *vfe, u8 wm, u32 addr,
+			      struct vfe_line *line);
 };
 
 struct vfe_isr_ops {
@@ -126,6 +131,16 @@
 	void (*wm_done)(struct vfe_device *vfe, u8 wm);
 };
 
+struct vfe_subdev_resources {
+	bool is_lite;
+	u8 line_num;
+	bool has_pd;
+	char *pd_name;
+	const struct vfe_hw_ops *hw_ops;
+	const struct camss_formats *formats_rdi;
+	const struct camss_formats *formats_pix;
+};
+
 struct vfe_device {
 	struct camss *camss;
 	u8 id;
@@ -143,10 +158,9 @@
 	spinlock_t output_lock;
 	enum vfe_line_id wm_output_map[MSM_VFE_IMAGE_MASTERS_NUM];
 	struct vfe_line line[VFE_LINE_NUM_MAX];
-	u8 line_num;
 	u32 reg_update;
 	u8 was_streaming;
-	const struct vfe_hw_ops *ops;
+	const struct vfe_subdev_resources *res;
 	const struct vfe_hw_ops_gen1 *ops_gen1;
 	struct vfe_isr_ops isr_ops;
 	struct camss_video_ops video_ops;
@@ -217,11 +231,19 @@
  */
 int vfe_pm_domain_on(struct vfe_device *vfe);
 
+extern const struct camss_formats vfe_formats_rdi_8x16;
+extern const struct camss_formats vfe_formats_pix_8x16;
+extern const struct camss_formats vfe_formats_rdi_8x96;
+extern const struct camss_formats vfe_formats_pix_8x96;
+extern const struct camss_formats vfe_formats_rdi_845;
+extern const struct camss_formats vfe_formats_pix_845;
+
 extern const struct vfe_hw_ops vfe_ops_4_1;
 extern const struct vfe_hw_ops vfe_ops_4_7;
 extern const struct vfe_hw_ops vfe_ops_4_8;
 extern const struct vfe_hw_ops vfe_ops_170;
 extern const struct vfe_hw_ops vfe_ops_480;
+extern const struct vfe_hw_ops vfe_ops_690;
 
 int vfe_get(struct vfe_device *vfe);
 void vfe_put(struct vfe_device *vfe);
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-video.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-video.c
@@ -24,269 +24,10 @@
 #define CAMSS_FRAME_MAX_HEIGHT_RDI	8191
 #define CAMSS_FRAME_MAX_HEIGHT_PIX	4096
 
-struct fract {
-	u8 numerator;
-	u8 denominator;
-};
-
-/*
- * struct camss_format_info - ISP media bus format information
- * @code: V4L2 media bus format code
- * @pixelformat: V4L2 pixel format FCC identifier
- * @planes: Number of planes
- * @hsub: Horizontal subsampling (for each plane)
- * @vsub: Vertical subsampling (for each plane)
- * @bpp: Bits per pixel when stored in memory (for each plane)
- */
-struct camss_format_info {
-	u32 code;
-	u32 pixelformat;
-	u8 planes;
-	struct fract hsub[3];
-	struct fract vsub[3];
-	unsigned int bpp[3];
-};
-
-static const struct camss_format_info formats_rdi_8x16[] = {
-	{ MEDIA_BUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_UYVY, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, V4L2_PIX_FMT_VYUY, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_YUYV, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, V4L2_PIX_FMT_YVYU, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_SBGGR8_1X8, V4L2_PIX_FMT_SBGGR8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SGBRG8_1X8, V4L2_PIX_FMT_SGBRG8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SGRBG8_1X8, V4L2_PIX_FMT_SGRBG8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SRGGB8_1X8, V4L2_PIX_FMT_SRGGB8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SBGGR10_1X10, V4L2_PIX_FMT_SBGGR10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SGBRG10_1X10, V4L2_PIX_FMT_SGBRG10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SRGGB10_1X10, V4L2_PIX_FMT_SRGGB10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SBGGR12_1X12, V4L2_PIX_FMT_SBGGR12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SGBRG12_1X12, V4L2_PIX_FMT_SGBRG12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SGRBG12_1X12, V4L2_PIX_FMT_SGRBG12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SRGGB12_1X12, V4L2_PIX_FMT_SRGGB12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_Y10_1X10, V4L2_PIX_FMT_Y10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-};
-
-static const struct camss_format_info formats_rdi_8x96[] = {
-	{ MEDIA_BUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_UYVY, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, V4L2_PIX_FMT_VYUY, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_YUYV, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, V4L2_PIX_FMT_YVYU, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_SBGGR8_1X8, V4L2_PIX_FMT_SBGGR8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SGBRG8_1X8, V4L2_PIX_FMT_SGBRG8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SGRBG8_1X8, V4L2_PIX_FMT_SGRBG8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SRGGB8_1X8, V4L2_PIX_FMT_SRGGB8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SBGGR10_1X10, V4L2_PIX_FMT_SBGGR10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SGBRG10_1X10, V4L2_PIX_FMT_SGBRG10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SRGGB10_1X10, V4L2_PIX_FMT_SRGGB10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SBGGR10_2X8_PADHI_LE, V4L2_PIX_FMT_SBGGR10, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_SBGGR12_1X12, V4L2_PIX_FMT_SBGGR12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SGBRG12_1X12, V4L2_PIX_FMT_SGBRG12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SGRBG12_1X12, V4L2_PIX_FMT_SGRBG12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SRGGB12_1X12, V4L2_PIX_FMT_SRGGB12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SBGGR14_1X14, V4L2_PIX_FMT_SBGGR14P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 14 } },
-	{ MEDIA_BUS_FMT_SGBRG14_1X14, V4L2_PIX_FMT_SGBRG14P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 14 } },
-	{ MEDIA_BUS_FMT_SGRBG14_1X14, V4L2_PIX_FMT_SGRBG14P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 14 } },
-	{ MEDIA_BUS_FMT_SRGGB14_1X14, V4L2_PIX_FMT_SRGGB14P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 14 } },
-	{ MEDIA_BUS_FMT_Y10_1X10, V4L2_PIX_FMT_Y10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_Y10_2X8_PADHI_LE, V4L2_PIX_FMT_Y10, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-};
-
-static const struct camss_format_info formats_rdi_845[] = {
-	{ MEDIA_BUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_UYVY, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, V4L2_PIX_FMT_VYUY, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_YUYV, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, V4L2_PIX_FMT_YVYU, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_SBGGR8_1X8, V4L2_PIX_FMT_SBGGR8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SGBRG8_1X8, V4L2_PIX_FMT_SGBRG8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SGRBG8_1X8, V4L2_PIX_FMT_SGRBG8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SRGGB8_1X8, V4L2_PIX_FMT_SRGGB8, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_SBGGR10_1X10, V4L2_PIX_FMT_SBGGR10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SGBRG10_1X10, V4L2_PIX_FMT_SGBRG10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SRGGB10_1X10, V4L2_PIX_FMT_SRGGB10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_SBGGR10_2X8_PADHI_LE, V4L2_PIX_FMT_SBGGR10, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_SBGGR12_1X12, V4L2_PIX_FMT_SBGGR12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SGBRG12_1X12, V4L2_PIX_FMT_SGBRG12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SGRBG12_1X12, V4L2_PIX_FMT_SGRBG12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SRGGB12_1X12, V4L2_PIX_FMT_SRGGB12P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 12 } },
-	{ MEDIA_BUS_FMT_SBGGR14_1X14, V4L2_PIX_FMT_SBGGR14P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 14 } },
-	{ MEDIA_BUS_FMT_SGBRG14_1X14, V4L2_PIX_FMT_SGBRG14P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 14 } },
-	{ MEDIA_BUS_FMT_SGRBG14_1X14, V4L2_PIX_FMT_SGRBG14P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 14 } },
-	{ MEDIA_BUS_FMT_SRGGB14_1X14, V4L2_PIX_FMT_SRGGB14P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 14 } },
-	{ MEDIA_BUS_FMT_Y8_1X8, V4L2_PIX_FMT_GREY, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 8 } },
-	{ MEDIA_BUS_FMT_Y10_1X10, V4L2_PIX_FMT_Y10P, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 10 } },
-	{ MEDIA_BUS_FMT_Y10_2X8_PADHI_LE, V4L2_PIX_FMT_Y10, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-};
-
-static const struct camss_format_info formats_pix_8x16[] = {
-	{ MEDIA_BUS_FMT_YUYV8_1_5X8, V4L2_PIX_FMT_NV12, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YVYU8_1_5X8, V4L2_PIX_FMT_NV12, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_UYVY8_1_5X8, V4L2_PIX_FMT_NV12, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_VYUY8_1_5X8, V4L2_PIX_FMT_NV12, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YUYV8_1_5X8, V4L2_PIX_FMT_NV21, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YVYU8_1_5X8, V4L2_PIX_FMT_NV21, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_UYVY8_1_5X8, V4L2_PIX_FMT_NV21, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_VYUY8_1_5X8, V4L2_PIX_FMT_NV21, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_NV16, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, V4L2_PIX_FMT_NV16, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_NV16, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, V4L2_PIX_FMT_NV16, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_NV61, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, V4L2_PIX_FMT_NV61, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_NV61, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, V4L2_PIX_FMT_NV61, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-};
-
-static const struct camss_format_info formats_pix_8x96[] = {
-	{ MEDIA_BUS_FMT_YUYV8_1_5X8, V4L2_PIX_FMT_NV12, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YVYU8_1_5X8, V4L2_PIX_FMT_NV12, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_UYVY8_1_5X8, V4L2_PIX_FMT_NV12, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_VYUY8_1_5X8, V4L2_PIX_FMT_NV12, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YUYV8_1_5X8, V4L2_PIX_FMT_NV21, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YVYU8_1_5X8, V4L2_PIX_FMT_NV21, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_UYVY8_1_5X8, V4L2_PIX_FMT_NV21, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_VYUY8_1_5X8, V4L2_PIX_FMT_NV21, 1,
-	  { { 1, 1 } }, { { 2, 3 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_NV16, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, V4L2_PIX_FMT_NV16, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_NV16, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, V4L2_PIX_FMT_NV16, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_NV61, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, V4L2_PIX_FMT_NV61, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_NV61, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, V4L2_PIX_FMT_NV61, 1,
-	  { { 1, 1 } }, { { 1, 2 } }, { 8 } },
-	{ MEDIA_BUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_UYVY, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_VYUY8_1X16, V4L2_PIX_FMT_VYUY, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_YUYV, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-	{ MEDIA_BUS_FMT_YVYU8_1X16, V4L2_PIX_FMT_YVYU, 1,
-	  { { 1, 1 } }, { { 1, 1 } }, { 16 } },
-};
-
 /* -----------------------------------------------------------------------------
  * Helper functions
  */
 
-static int video_find_format(u32 code, u32 pixelformat,
-			     const struct camss_format_info *formats,
-			     unsigned int nformats)
-{
-	int i;
-
-	for (i = 0; i < nformats; i++) {
-		if (formats[i].code == code &&
-		    formats[i].pixelformat == pixelformat)
-			return i;
-	}
-
-	for (i = 0; i < nformats; i++)
-		if (formats[i].code == code)
-			return i;
-
-	WARN_ON(1);
-
-	return -EINVAL;
-}
-
 /*
  * video_mbus_to_pix_mp - Convert v4l2_mbus_framefmt to v4l2_pix_format_mplane
  * @mbus: v4l2_mbus_framefmt format (input)
@@ -359,9 +100,8 @@
 	if (ret)
 		return ret;
 
-	ret = video_find_format(fmt.format.code,
-				format->fmt.pix_mp.pixelformat,
-				video->formats, video->nformats);
+	ret = camss_format_find_format(fmt.format.code, format->fmt.pix_mp.pixelformat,
+				       video->formats, video->nformats);
 	if (ret < 0)
 		return ret;
 
@@ -557,12 +297,6 @@
 
 		ret = v4l2_subdev_call(subdev, video, s_stream, 0);
 
-		if (entity->use_count > 1) {
-			/* Don't stop if other instances of the pipeline are still running */
-			dev_dbg(video->camss->dev, "Video pipeline still used, don't stop streaming.\n");
-			return;
-		}
-
 		if (ret) {
 			dev_err(video->camss->dev, "Video pipeline stop failed: %d\n", ret);
 			return;
@@ -969,7 +703,7 @@
  */
 
 int msm_video_register(struct camss_video *video, struct v4l2_device *v4l2_dev,
-		       const char *name, int is_pix)
+		       const char *name)
 {
 	struct media_pad *pad = &video->pad;
 	struct video_device *vdev;
@@ -1006,33 +740,6 @@
 
 	mutex_init(&video->lock);
 
-	switch (video->camss->res->version) {
-	case CAMSS_8x16:
-		if (is_pix) {
-			video->formats = formats_pix_8x16;
-			video->nformats = ARRAY_SIZE(formats_pix_8x16);
-		} else {
-			video->formats = formats_rdi_8x16;
-			video->nformats = ARRAY_SIZE(formats_rdi_8x16);
-		}
-		break;
-	case CAMSS_8x96:
-	case CAMSS_660:
-		if (is_pix) {
-			video->formats = formats_pix_8x96;
-			video->nformats = ARRAY_SIZE(formats_pix_8x96);
-		} else {
-			video->formats = formats_rdi_8x96;
-			video->nformats = ARRAY_SIZE(formats_rdi_8x96);
-		}
-		break;
-	case CAMSS_845:
-	case CAMSS_8250:
-		video->formats = formats_rdi_845;
-		video->nformats = ARRAY_SIZE(formats_rdi_845);
-		break;
-	}
-
 	ret = msm_video_init_format(video);
 	if (ret < 0) {
 		dev_err(v4l2_dev->dev, "Failed to init format: %d\n", ret);
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss-video.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss-video.h
@@ -33,8 +33,6 @@
 			     enum vb2_buffer_state state);
 };
 
-struct camss_format_info;
-
 struct camss_video {
 	struct camss *camss;
 	struct vb2_queue vb2_q;
@@ -53,7 +51,7 @@
 };
 
 int msm_video_register(struct camss_video *video, struct v4l2_device *v4l2_dev,
-		       const char *name, int is_pix);
+		       const char *name);
 
 void msm_video_unregister(struct camss_video *video);
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss.c
@@ -18,6 +18,7 @@
 #include <linux/of_graph.h>
 #include <linux/pm_runtime.h>
 #include <linux/pm_domain.h>
+#include <linux/pm_opp.h>
 #include <linux/slab.h>
 #include <linux/videodev2.h>
 
@@ -32,6 +33,8 @@
 #define CAMSS_CLOCK_MARGIN_NUMERATOR 105
 #define CAMSS_CLOCK_MARGIN_DENOMINATOR 100
 
+static const struct parent_dev_ops vfe_parent_dev_ops;
+
 static const struct camss_subdev_resources csiphy_res_8x16[] = {
 	/* CSIPHY0 */
 	{
@@ -43,7 +46,10 @@
 				{ 100000000, 200000000 } },
 		.reg = { "csiphy0", "csiphy0_clk_mux" },
 		.interrupt = { "csiphy0" },
-		.ops = &csiphy_ops_2ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_2ph_1_0,
+			.formats = &csiphy_formats_8x16
+		}
 	},
 
 	/* CSIPHY1 */
@@ -56,7 +62,10 @@
 				{ 100000000, 200000000 } },
 		.reg = { "csiphy1", "csiphy1_clk_mux" },
 		.interrupt = { "csiphy1" },
-		.ops = &csiphy_ops_2ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_2ph_1_0,
+			.formats = &csiphy_formats_8x16
+		}
 	}
 };
 
@@ -76,7 +85,11 @@
 				{ 0 } },
 		.reg = { "csid0" },
 		.interrupt = { "csid0" },
-		.ops = &csid_ops_4_1,
+		.csid = {
+			.hw_ops = &csid_ops_4_1,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_1
+		}
 	},
 
 	/* CSID1 */
@@ -94,7 +107,11 @@
 				{ 0 } },
 		.reg = { "csid1" },
 		.interrupt = { "csid1" },
-		.ops = &csid_ops_4_1,
+		.csid = {
+			.hw_ops = &csid_ops_4_1,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_1
+		}
 	},
 };
 
@@ -105,8 +122,7 @@
 		   "csi1", "csi1_pix", "csi1_rdi" },
 	.clock_for_reset = { "vfe0", "csi_vfe0" },
 	.reg = { "ispif", "csi_clk_mux" },
-	.interrupt = { "ispif" }
-
+	.interrupt = { "ispif" },
 };
 
 static const struct camss_subdev_resources vfe_res_8x16[] = {
@@ -128,8 +144,12 @@
 				{ 0 } },
 		.reg = { "vfe0" },
 		.interrupt = { "vfe0" },
-		.line_num = 3,
-		.ops = &vfe_ops_4_1
+		.vfe = {
+			.line_num = 3,
+			.hw_ops = &vfe_ops_4_1,
+			.formats_rdi = &vfe_formats_rdi_8x16,
+			.formats_pix = &vfe_formats_pix_8x16
+		}
 	}
 };
 
@@ -144,7 +164,10 @@
 				{ 100000000, 200000000, 266666667 } },
 		.reg = { "csiphy0", "csiphy0_clk_mux" },
 		.interrupt = { "csiphy0" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_8x96
+		}
 	},
 
 	/* CSIPHY1 */
@@ -157,7 +180,10 @@
 				{ 100000000, 200000000, 266666667 } },
 		.reg = { "csiphy1", "csiphy1_clk_mux" },
 		.interrupt = { "csiphy1" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_8x96
+		}
 	},
 
 	/* CSIPHY2 */
@@ -170,7 +196,10 @@
 				{ 100000000, 200000000, 266666667 } },
 		.reg = { "csiphy2", "csiphy2_clk_mux" },
 		.interrupt = { "csiphy2" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_8x96
+		}
 	}
 };
 
@@ -190,7 +219,11 @@
 				{ 0 } },
 		.reg = { "csid0" },
 		.interrupt = { "csid0" },
-		.ops = &csid_ops_4_7,
+		.csid = {
+			.hw_ops = &csid_ops_4_7,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_7
+		}
 	},
 
 	/* CSID1 */
@@ -208,7 +241,11 @@
 				{ 0 } },
 		.reg = { "csid1" },
 		.interrupt = { "csid1" },
-		.ops = &csid_ops_4_7,
+		.csid = {
+			.hw_ops = &csid_ops_4_7,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_7
+		}
 	},
 
 	/* CSID2 */
@@ -226,7 +263,11 @@
 				{ 0 } },
 		.reg = { "csid2" },
 		.interrupt = { "csid2" },
-		.ops = &csid_ops_4_7,
+		.csid = {
+			.hw_ops = &csid_ops_4_7,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_7
+		}
 	},
 
 	/* CSID3 */
@@ -244,7 +285,11 @@
 				{ 0 } },
 		.reg = { "csid3" },
 		.interrupt = { "csid3" },
-		.ops = &csid_ops_4_7,
+		.csid = {
+			.hw_ops = &csid_ops_4_7,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_7
+		}
 	}
 };
 
@@ -257,7 +302,7 @@
 		   "csi3", "csi3_pix", "csi3_rdi" },
 	.clock_for_reset = { "vfe0", "csi_vfe0", "vfe1", "csi_vfe1" },
 	.reg = { "ispif", "csi_clk_mux" },
-	.interrupt = { "ispif" }
+	.interrupt = { "ispif" },
 };
 
 static const struct camss_subdev_resources vfe_res_8x96[] = {
@@ -277,9 +322,13 @@
 				{ 0 } },
 		.reg = { "vfe0" },
 		.interrupt = { "vfe0" },
-		.line_num = 3,
-		.has_pd = true,
-		.ops = &vfe_ops_4_7
+		.vfe = {
+			.line_num = 3,
+			.has_pd = true,
+			.hw_ops = &vfe_ops_4_7,
+			.formats_rdi = &vfe_formats_rdi_8x96,
+			.formats_pix = &vfe_formats_pix_8x96
+		}
 	},
 
 	/* VFE1 */
@@ -298,9 +347,13 @@
 				{ 0 } },
 		.reg = { "vfe1" },
 		.interrupt = { "vfe1" },
-		.line_num = 3,
-		.has_pd = true,
-		.ops = &vfe_ops_4_7
+		.vfe = {
+			.line_num = 3,
+			.has_pd = true,
+			.hw_ops = &vfe_ops_4_7,
+			.formats_rdi = &vfe_formats_rdi_8x96,
+			.formats_pix = &vfe_formats_pix_8x96
+		}
 	}
 };
 
@@ -317,7 +370,10 @@
 				{ 0 } },
 		.reg = { "csiphy0", "csiphy0_clk_mux" },
 		.interrupt = { "csiphy0" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_8x96
+		}
 	},
 
 	/* CSIPHY1 */
@@ -332,7 +388,10 @@
 				{ 0 } },
 		.reg = { "csiphy1", "csiphy1_clk_mux" },
 		.interrupt = { "csiphy1" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_8x96
+		}
 	},
 
 	/* CSIPHY2 */
@@ -347,7 +406,10 @@
 				{ 0 } },
 		.reg = { "csiphy2", "csiphy2_clk_mux" },
 		.interrupt = { "csiphy2" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_8x96
+		}
 	}
 };
 
@@ -370,7 +432,11 @@
 				{ 0 } },
 		.reg = { "csid0" },
 		.interrupt = { "csid0" },
-		.ops = &csid_ops_4_7,
+		.csid = {
+			.hw_ops = &csid_ops_4_7,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_7
+		}
 	},
 
 	/* CSID1 */
@@ -391,7 +457,11 @@
 				{ 0 } },
 		.reg = { "csid1" },
 		.interrupt = { "csid1" },
-		.ops = &csid_ops_4_7,
+		.csid = {
+			.hw_ops = &csid_ops_4_7,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_7
+		}
 	},
 
 	/* CSID2 */
@@ -412,7 +482,11 @@
 				{ 0 } },
 		.reg = { "csid2" },
 		.interrupt = { "csid2" },
-		.ops = &csid_ops_4_7,
+		.csid = {
+			.hw_ops = &csid_ops_4_7,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_7
+		}
 	},
 
 	/* CSID3 */
@@ -433,7 +507,11 @@
 				{ 0 } },
 		.reg = { "csid3" },
 		.interrupt = { "csid3" },
-		.ops = &csid_ops_4_7,
+		.csid = {
+			.hw_ops = &csid_ops_4_7,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_4_7
+		}
 	}
 };
 
@@ -446,7 +524,7 @@
 		   "csi3", "csi3_pix", "csi3_rdi" },
 	.clock_for_reset = { "vfe0", "csi_vfe0", "vfe1", "csi_vfe1" },
 	.reg = { "ispif", "csi_clk_mux" },
-	.interrupt = { "ispif" }
+	.interrupt = { "ispif" },
 };
 
 static const struct camss_subdev_resources vfe_res_660[] = {
@@ -469,9 +547,13 @@
 				{ 0 } },
 		.reg = { "vfe0" },
 		.interrupt = { "vfe0" },
-		.line_num = 3,
-		.has_pd = true,
-		.ops = &vfe_ops_4_8
+		.vfe = {
+			.line_num = 3,
+			.has_pd = true,
+			.hw_ops = &vfe_ops_4_8,
+			.formats_rdi = &vfe_formats_rdi_8x96,
+			.formats_pix = &vfe_formats_pix_8x96
+		}
 	},
 
 	/* VFE1 */
@@ -493,9 +575,13 @@
 				{ 0 } },
 		.reg = { "vfe1" },
 		.interrupt = { "vfe1" },
-		.line_num = 3,
-		.has_pd = true,
-		.ops = &vfe_ops_4_8
+		.vfe = {
+			.line_num = 3,
+			.has_pd = true,
+			.hw_ops = &vfe_ops_4_8,
+			.formats_rdi = &vfe_formats_rdi_8x96,
+			.formats_pix = &vfe_formats_pix_8x96
+		}
 	}
 };
 
@@ -516,7 +602,10 @@
 				{ 19200000, 240000000, 269333333 } },
 		.reg = { "csiphy0" },
 		.interrupt = { "csiphy0" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	},
 
 	/* CSIPHY1 */
@@ -535,7 +624,10 @@
 				{ 19200000, 240000000, 269333333 } },
 		.reg = { "csiphy1" },
 		.interrupt = { "csiphy1" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	},
 
 	/* CSIPHY2 */
@@ -554,7 +646,10 @@
 				{ 19200000, 240000000, 269333333 } },
 		.reg = { "csiphy2" },
 		.interrupt = { "csiphy2" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	},
 
 	/* CSIPHY3 */
@@ -573,7 +668,10 @@
 				{ 19200000, 240000000, 269333333 } },
 		.reg = { "csiphy3" },
 		.interrupt = { "csiphy3" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	}
 };
 
@@ -596,7 +694,11 @@
 				{ 384000000 } },
 		.reg = { "csid0" },
 		.interrupt = { "csid0" },
-		.ops = &csid_ops_gen2
+		.csid = {
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
 	},
 
 	/* CSID1 */
@@ -617,7 +719,11 @@
 				{ 384000000 } },
 		.reg = { "csid1" },
 		.interrupt = { "csid1" },
-		.ops = &csid_ops_gen2
+		.csid = {
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
 	},
 
 	/* CSID2 */
@@ -638,8 +744,12 @@
 				{ 384000000 } },
 		.reg = { "csid2" },
 		.interrupt = { "csid2" },
-		.is_lite = true,
-		.ops = &csid_ops_gen2
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
 	}
 };
 
@@ -662,9 +772,13 @@
 				{ 384000000 } },
 		.reg = { "vfe0" },
 		.interrupt = { "vfe0" },
-		.line_num = 4,
-		.has_pd = true,
-		.ops = &vfe_ops_170
+		.vfe = {
+			.line_num = 4,
+			.has_pd = true,
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
 	},
 
 	/* VFE1 */
@@ -685,9 +799,13 @@
 				{ 384000000 } },
 		.reg = { "vfe1" },
 		.interrupt = { "vfe1" },
-		.line_num = 4,
-		.has_pd = true,
-		.ops = &vfe_ops_170
+		.vfe = {
+			.line_num = 4,
+			.has_pd = true,
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
 	},
 
 	/* VFE-lite */
@@ -707,9 +825,13 @@
 				{ 384000000 } },
 		.reg = { "vfe_lite" },
 		.interrupt = { "vfe_lite" },
-		.is_lite = true,
-		.line_num = 4,
-		.ops = &vfe_ops_170
+		.vfe = {
+			.is_lite = true,
+			.line_num = 4,
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
 	}
 };
 
@@ -722,7 +844,10 @@
 				{ 300000000 } },
 		.reg = { "csiphy0" },
 		.interrupt = { "csiphy0" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	},
 	/* CSIPHY1 */
 	{
@@ -732,7 +857,10 @@
 				{ 300000000 } },
 		.reg = { "csiphy1" },
 		.interrupt = { "csiphy1" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	},
 	/* CSIPHY2 */
 	{
@@ -742,7 +870,10 @@
 				{ 300000000 } },
 		.reg = { "csiphy2" },
 		.interrupt = { "csiphy2" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	},
 	/* CSIPHY3 */
 	{
@@ -752,7 +883,10 @@
 				{ 300000000 } },
 		.reg = { "csiphy3" },
 		.interrupt = { "csiphy3" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	},
 	/* CSIPHY4 */
 	{
@@ -762,7 +896,10 @@
 				{ 300000000 } },
 		.reg = { "csiphy4" },
 		.interrupt = { "csiphy4" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	},
 	/* CSIPHY5 */
 	{
@@ -772,7 +909,10 @@
 				{ 300000000 } },
 		.reg = { "csiphy5" },
 		.interrupt = { "csiphy5" },
-		.ops = &csiphy_ops_3ph_1_0
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
 	}
 };
 
@@ -788,7 +928,11 @@
 				{ 0 } },
 		.reg = { "csid0" },
 		.interrupt = { "csid0" },
-		.ops = &csid_ops_gen2
+		.csid = {
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
 	},
 	/* CSID1 */
 	{
@@ -801,7 +945,11 @@
 				{ 0 } },
 		.reg = { "csid1" },
 		.interrupt = { "csid1" },
-		.ops = &csid_ops_gen2
+		.csid = {
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
 	},
 	/* CSID2 */
 	{
@@ -813,8 +961,12 @@
 				{ 0 } },
 		.reg = { "csid2" },
 		.interrupt = { "csid2" },
-		.is_lite = true,
-		.ops = &csid_ops_gen2
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
 	},
 	/* CSID3 */
 	{
@@ -826,8 +978,12 @@
 				{ 0 } },
 		.reg = { "csid3" },
 		.interrupt = { "csid3" },
-		.is_lite = true,
-		.ops = &csid_ops_gen2
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
 	}
 };
 
@@ -849,10 +1005,14 @@
 				{ 0 } },
 		.reg = { "vfe0" },
 		.interrupt = { "vfe0" },
-		.pd_name = "ife0",
-		.line_num = 3,
-		.has_pd = true,
-		.ops = &vfe_ops_480
+		.vfe = {
+			.line_num = 3,
+			.has_pd = true,
+			.pd_name = "ife0",
+			.hw_ops = &vfe_ops_480,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
 	},
 	/* VFE1 */
 	{
@@ -871,10 +1031,14 @@
 				{ 0 } },
 		.reg = { "vfe1" },
 		.interrupt = { "vfe1" },
-		.pd_name = "ife1",
-		.line_num = 3,
-		.has_pd = true,
-		.ops = &vfe_ops_480
+		.vfe = {
+			.line_num = 3,
+			.has_pd = true,
+			.pd_name = "ife1",
+			.hw_ops = &vfe_ops_480,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
 	},
 	/* VFE2 (lite) */
 	{
@@ -892,9 +1056,13 @@
 				{ 0 } },
 		.reg = { "vfe_lite0" },
 		.interrupt = { "vfe_lite0" },
-		.is_lite = true,
-		.line_num = 4,
-		.ops = &vfe_ops_480
+		.vfe = {
+			.is_lite = true,
+			.line_num = 4,
+			.hw_ops = &vfe_ops_480,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
 	},
 	/* VFE3 (lite) */
 	{
@@ -912,9 +1080,13 @@
 				{ 0 } },
 		.reg = { "vfe_lite1" },
 		.interrupt = { "vfe_lite1" },
-		.is_lite = true,
-		.line_num = 4,
-		.ops = &vfe_ops_480
+		.vfe = {
+			.is_lite = true,
+			.line_num = 4,
+			.hw_ops = &vfe_ops_480,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
 	},
 };
 
@@ -941,6 +1113,1603 @@
 	},
 };
 
+static const struct camss_subdev_resources csiphy_res_sc8280xp[] = {
+	/* CSIPHY0 */
+	{
+		.regulators = {},
+		.clock = { "csiphy0", "csiphy0_timer" },
+		.clock_rate = { { 400000000 },
+				{ 300000000 } },
+		.reg = { "csiphy0" },
+		.interrupt = { "csiphy0" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
+	},
+	/* CSIPHY1 */
+	{
+		.regulators = {},
+		.clock = { "csiphy1", "csiphy1_timer" },
+		.clock_rate = { { 400000000 },
+				{ 300000000 } },
+		.reg = { "csiphy1" },
+		.interrupt = { "csiphy1" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
+	},
+	/* CSIPHY2 */
+	{
+		.regulators = {},
+		.clock = { "csiphy2", "csiphy2_timer" },
+		.clock_rate = { { 400000000 },
+				{ 300000000 } },
+		.reg = { "csiphy2" },
+		.interrupt = { "csiphy2" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
+	},
+	/* CSIPHY3 */
+	{
+		.regulators = {},
+		.clock = { "csiphy3", "csiphy3_timer" },
+		.clock_rate = { { 400000000 },
+				{ 300000000 } },
+		.reg = { "csiphy3" },
+		.interrupt = { "csiphy3" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sdm845
+		}
+	},
+};
+
+static const struct camss_subdev_resources csid_res_sc8280xp[] = {
+	/* CSID0 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+		.clock = { "vfe0_csid", "vfe0_cphy_rx", "vfe0", "vfe0_axi" },
+		.clock_rate = { { 400000000, 480000000, 600000000 },
+				{ 0 },
+				{ 0 },
+				{ 0 } },
+		.reg = { "csid0" },
+		.interrupt = { "csid0" },
+		.csid = {
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID1 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+		.clock = { "vfe1_csid", "vfe1_cphy_rx", "vfe1", "vfe1_axi" },
+		.clock_rate = { { 400000000, 480000000, 600000000 },
+				{ 0 },
+				{ 0 },
+				{ 0 } },
+		.reg = { "csid1" },
+		.interrupt = { "csid1" },
+		.csid = {
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID2 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+		.clock = { "vfe2_csid", "vfe2_cphy_rx", "vfe2", "vfe2_axi" },
+		.clock_rate = { { 400000000, 480000000, 600000000 },
+				{ 0 },
+				{ 0 },
+				{ 0 } },
+		.reg = { "csid2" },
+		.interrupt = { "csid2" },
+		.csid = {
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID3 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+		.clock = { "vfe3_csid", "vfe3_cphy_rx", "vfe3", "vfe3_axi" },
+		.clock_rate = { { 400000000, 480000000, 600000000 },
+				{ 0 },
+				{ 0 },
+				{ 0 } },
+		.reg = { "csid3" },
+		.interrupt = { "csid3" },
+		.csid = {
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID_LITE0 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+		.clock = { "vfe_lite0_csid", "vfe_lite0_cphy_rx", "vfe_lite0" },
+		.clock_rate = { { 400000000, 480000000, 600000000 },
+				{ 0 },
+				{ 0 }, },
+		.reg = { "csid0_lite" },
+		.interrupt = { "csid0_lite" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID_LITE1 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+		.clock = { "vfe_lite1_csid", "vfe_lite1_cphy_rx", "vfe_lite1" },
+		.clock_rate = { { 400000000, 480000000, 600000000 },
+				{ 0 },
+				{ 0 }, },
+		.reg = { "csid1_lite" },
+		.interrupt = { "csid1_lite" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID_LITE2 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+		.clock = { "vfe_lite2_csid", "vfe_lite2_cphy_rx", "vfe_lite2" },
+		.clock_rate = { { 400000000, 480000000, 600000000 },
+				{ 0 },
+				{ 0 }, },
+		.reg = { "csid2_lite" },
+		.interrupt = { "csid2_lite" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID_LITE3 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+		.clock = { "vfe_lite3_csid", "vfe_lite3_cphy_rx", "vfe_lite3" },
+		.clock_rate = { { 400000000, 480000000, 600000000 },
+				{ 0 },
+				{ 0 }, },
+		.reg = { "csid3_lite" },
+		.interrupt = { "csid3_lite" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	}
+};
+
+static const struct camss_subdev_resources vfe_res_sc8280xp[] = {
+	/* VFE0 */
+	{
+		.regulators = {},
+		.clock = { "gcc_axi_hf", "gcc_axi_sf", "cpas_ahb", "camnoc_axi", "vfe0", "vfe0_axi" },
+		.clock_rate = { { 0 },
+				{ 0 },
+				{ 19200000, 80000000},
+				{ 19200000, 150000000, 266666667, 320000000, 400000000, 480000000 },
+				{ 400000000, 558000000, 637000000, 760000000 },
+				{ 0 }, },
+		.reg = { "vfe0" },
+		.interrupt = { "vfe0" },
+		.vfe = {
+			.line_num = 4,
+			.pd_name = "ife0",
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE1 */
+	{
+		.regulators = {},
+		.clock = { "gcc_axi_hf", "gcc_axi_sf", "cpas_ahb", "camnoc_axi", "vfe1", "vfe1_axi" },
+		.clock_rate = { { 0 },
+				{ 0 },
+				{ 19200000, 80000000},
+				{ 19200000, 150000000, 266666667, 320000000, 400000000, 480000000 },
+				{ 400000000, 558000000, 637000000, 760000000 },
+				{ 0 }, },
+		.reg = { "vfe1" },
+		.interrupt = { "vfe1" },
+		.vfe = {
+			.line_num = 4,
+			.pd_name = "ife1",
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE2 */
+	{
+		.regulators = {},
+		.clock = { "gcc_axi_hf", "gcc_axi_sf", "cpas_ahb", "camnoc_axi", "vfe2", "vfe2_axi" },
+		.clock_rate = { { 0 },
+				{ 0 },
+				{ 19200000, 80000000},
+				{ 19200000, 150000000, 266666667, 320000000, 400000000, 480000000 },
+				{ 400000000, 558000000, 637000000, 760000000 },
+				{ 0 }, },
+		.reg = { "vfe2" },
+		.interrupt = { "vfe2" },
+		.vfe = {
+			.line_num = 4,
+			.pd_name = "ife2",
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE3 */
+	{
+		.regulators = {},
+		.clock = { "gcc_axi_hf", "gcc_axi_sf", "cpas_ahb", "camnoc_axi", "vfe3", "vfe3_axi" },
+		.clock_rate = { { 0 },
+				{ 0 },
+				{ 19200000, 80000000},
+				{ 19200000, 150000000, 266666667, 320000000, 400000000, 480000000 },
+				{ 400000000, 558000000, 637000000, 760000000 },
+				{ 0 }, },
+		.reg = { "vfe3" },
+		.interrupt = { "vfe3" },
+		.vfe = {
+			.line_num = 4,
+			.pd_name = "ife3",
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE_LITE_0 */
+	{
+		.regulators = {},
+		.clock = { "gcc_axi_hf", "gcc_axi_sf", "cpas_ahb", "camnoc_axi", "vfe_lite0" },
+		.clock_rate = { { 0 },
+				{ 0 },
+				{ 19200000, 80000000},
+				{ 19200000, 150000000, 266666667, 320000000, 400000000, 480000000 },
+				{ 320000000, 400000000, 480000000, 600000000 }, },
+		.reg = { "vfe_lite0" },
+		.interrupt = { "vfe_lite0" },
+		.vfe = {
+			.is_lite = true,
+			.line_num = 4,
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE_LITE_1 */
+	{
+		.regulators = {},
+		.clock = { "gcc_axi_hf", "gcc_axi_sf", "cpas_ahb", "camnoc_axi", "vfe_lite1" },
+		.clock_rate = { { 0 },
+				{ 0 },
+				{ 19200000, 80000000},
+				{ 19200000, 150000000, 266666667, 320000000, 400000000, 480000000 },
+				{ 320000000, 400000000, 480000000, 600000000 }, },
+		.reg = { "vfe_lite1" },
+		.interrupt = { "vfe_lite1" },
+		.vfe = {
+			.is_lite = true,
+			.line_num = 4,
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE_LITE_2 */
+	{
+		.regulators = {},
+		.clock = { "gcc_axi_hf", "gcc_axi_sf", "cpas_ahb", "camnoc_axi", "vfe_lite2" },
+		.clock_rate = { { 0 },
+				{ 0 },
+				{ 19200000, 80000000},
+				{ 19200000, 150000000, 266666667, 320000000, 400000000, 480000000 },
+				{ 320000000, 400000000, 480000000, 600000000, }, },
+		.reg = { "vfe_lite2" },
+		.interrupt = { "vfe_lite2" },
+		.vfe = {
+			.is_lite = true,
+			.line_num = 4,
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE_LITE_3 */
+	{
+		.regulators = {},
+		.clock = { "gcc_axi_hf", "gcc_axi_sf", "cpas_ahb", "camnoc_axi", "vfe_lite3" },
+		.clock_rate = { { 0 },
+				{ 0 },
+				{ 19200000, 80000000},
+				{ 19200000, 150000000, 266666667, 320000000, 400000000, 480000000 },
+				{ 320000000, 400000000, 480000000, 600000000 }, },
+		.reg = { "vfe_lite3" },
+		.interrupt = { "vfe_lite3" },
+		.vfe = {
+			.is_lite = true,
+			.line_num = 4,
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+};
+
+static const struct resources_icc icc_res_sc8280xp[] = {
+	{
+		.name = "cam_ahb",
+		.icc_bw_tbl.avg = 150000,
+		.icc_bw_tbl.peak = 300000,
+	},
+	{
+		.name = "cam_hf_mnoc",
+		.icc_bw_tbl.avg = 2097152,
+		.icc_bw_tbl.peak = 2097152,
+	},
+	{
+		.name = "cam_sf_mnoc",
+		.icc_bw_tbl.avg = 2097152,
+		.icc_bw_tbl.peak = 2097152,
+	},
+	{
+		.name = "cam_sf_icp_mnoc",
+		.icc_bw_tbl.avg = 2097152,
+		.icc_bw_tbl.peak = 2097152,
+	},
+};
+
+static const struct camss_subdev_resources csiphy_res_7280[] = {
+	/* CSIPHY0 */
+	{
+		.regulators = {},
+		.clock = { "csiphy0", "csiphy0_timer"},
+		.clock_rate = {
+			{ 300000000 },
+			{ 300000000 }
+		},
+		.reg = { "csiphy0" },
+		.interrupt = { "csiphy0" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sc7280
+		}
+	},
+	/* CSIPHY1 */
+	{
+		.regulators = {},
+		.clock = { "csiphy1", "csiphy1_timer"},
+		.clock_rate = {
+			{ 300000000 },
+			{ 300000000 }
+		},
+		.reg = { "csiphy1" },
+		.interrupt = { "csiphy1" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sc7280
+		}
+	},
+	/* CSIPHY2 */
+	{
+		.regulators = {},
+		.clock = { "csiphy2", "csiphy2_timer"},
+		.clock_rate = {
+			{ 300000000 },
+			{ 300000000 }
+		},
+		.reg = { "csiphy2" },
+		.interrupt = { "csiphy2" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sc7280
+		}
+	},
+	/* CSIPHY3 */
+	{
+		.regulators = {},
+		.clock = { "csiphy3", "csiphy3_timer"},
+		.clock_rate = {
+			{ 300000000 },
+			{ 300000000 }
+		},
+		.reg = { "csiphy3" },
+		.interrupt = { "csiphy3" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sc7280
+		}
+	},
+	/* CSIPHY4 */
+	{
+		.regulators = {},
+		.clock = { "csiphy4", "csiphy4_timer"},
+		.clock_rate = {
+			{ 300000000 },
+			{ 300000000 }
+		},
+		.reg = { "csiphy4" },
+		.interrupt = { "csiphy4" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sc7280
+		}
+	},
+};
+
+static const struct camss_subdev_resources csid_res_7280[] = {
+	/* CSID0 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "csi0", "vfe0_cphy_rx", "vfe0", "soc_ahb"},
+		.clock_rate = {
+			{ 300000000, 0, 380000000, 0},
+			{ 400000000, 0, 510000000, 0},
+			{ 400000000, 0, 637000000, 0},
+			{ 400000000, 0, 760000000, 0}
+		},
+
+		.reg = { "csid0" },
+		.interrupt = { "csid0" },
+		.csid = {
+			.is_lite = false,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID1 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "csi1", "vfe1_cphy_rx", "vfe1", "soc_ahb"},
+		.clock_rate = {
+			{ 300000000, 0, 380000000, 0},
+			{ 400000000, 0, 510000000, 0},
+			{ 400000000, 0, 637000000, 0},
+			{ 400000000, 0, 760000000, 0}
+		},
+
+		.reg = { "csid1" },
+		.interrupt = { "csid1" },
+		.csid = {
+			.is_lite = false,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID2 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "csi2", "vfe2_cphy_rx", "vfe2", "soc_ahb"},
+		.clock_rate = {
+			{ 300000000, 0, 380000000, 0},
+			{ 400000000, 0, 510000000, 0},
+			{ 400000000, 0, 637000000, 0},
+			{ 400000000, 0, 760000000, 0}
+		},
+
+		.reg = { "csid2" },
+		.interrupt = { "csid2" },
+		.csid = {
+			.is_lite = false,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID3 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "csi3", "vfe0_lite_cphy_rx", "vfe0_lite", "soc_ahb"},
+		.clock_rate = {
+			{ 300000000, 0, 320000000, 0},
+			{ 400000000, 0, 400000000, 0},
+			{ 400000000, 0, 480000000, 0},
+			{ 400000000, 0, 600000000, 0}
+		},
+
+		.reg = { "csid_lite0" },
+		.interrupt = { "csid_lite0" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID4 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "csi3", "vfe0_lite_cphy_rx", "vfe0_lite", "soc_ahb"},
+		.clock_rate = {
+			{ 300000000, 0, 320000000, 0},
+			{ 400000000, 0, 400000000, 0},
+			{ 400000000, 0, 480000000, 0},
+			{ 400000000, 0, 600000000, 0}
+		},
+
+		.reg = { "csid_lite1" },
+		.interrupt = { "csid_lite1" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen2,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+};
+
+static const struct camss_subdev_resources vfe_res_7280[] = {
+	/* VFE0 */
+	{
+		.regulators = {},
+
+		.clock = { "vfe0", "vfe0_axi", "soc_ahb",
+			   "cpas_ahb", "camnoc_axi",
+			   "gcc_camera_axi"},
+		.clock_rate = {
+			{ 380000000, 0, 80000000, 0, 150000000, 0},
+			{ 510000000, 0, 80000000, 0, 240000000, 0},
+			{ 637000000, 0, 80000000, 0, 320000000, 0},
+			{ 760000000, 0, 80000000, 0, 400000000, 0},
+			{ 760000000, 0, 80000000, 0, 480000000, 0},
+		},
+
+		.reg = { "vfe0" },
+		.interrupt = { "vfe0" },
+		.vfe = {
+			.line_num = 3,
+			.is_lite = false,
+			.has_pd = true,
+			.pd_name = "ife0",
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE1 */
+	{
+		.regulators = {},
+
+		.clock = { "vfe1", "vfe1_axi", "soc_ahb",
+			   "cpas_ahb", "camnoc_axi",
+			   "gcc_camera_axi"},
+		.clock_rate = {
+			{ 380000000, 0, 80000000, 0, 150000000, 0},
+			{ 510000000, 0, 80000000, 0, 240000000, 0},
+			{ 637000000, 0, 80000000, 0, 320000000, 0},
+			{ 760000000, 0, 80000000, 0, 400000000, 0},
+			{ 760000000, 0, 80000000, 0, 480000000, 0},
+		},
+
+		.reg = { "vfe1" },
+		.interrupt = { "vfe1" },
+		.vfe = {
+			.line_num = 3,
+			.is_lite = false,
+			.has_pd = true,
+			.pd_name = "ife1",
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE2 */
+	{
+		.regulators = {},
+
+		.clock = { "vfe2", "vfe2_axi", "soc_ahb",
+			   "cpas_ahb", "camnoc_axi",
+			   "gcc_camera_axi"},
+		.clock_rate = {
+			{ 380000000, 0, 80000000, 0, 150000000, 0},
+			{ 510000000, 0, 80000000, 0, 240000000, 0},
+			{ 637000000, 0, 80000000, 0, 320000000, 0},
+			{ 760000000, 0, 80000000, 0, 400000000, 0},
+			{ 760000000, 0, 80000000, 0, 480000000, 0},
+		},
+
+		.reg = { "vfe2" },
+		.interrupt = { "vfe2" },
+		.vfe = {
+			.line_num = 3,
+			.is_lite = false,
+			.hw_ops = &vfe_ops_170,
+			.has_pd = true,
+			.pd_name = "ife2",
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE3 (lite) */
+	{
+		.clock = { "vfe0_lite", "soc_ahb", "cpas_ahb",
+			   "camnoc_axi", "gcc_camera_axi"},
+		.clock_rate = {
+			{ 320000000, 80000000, 0, 150000000, 0},
+			{ 400000000, 80000000, 0, 240000000, 0},
+			{ 480000000, 80000000, 0, 320000000, 0},
+			{ 600000000, 80000000, 0, 400000000, 0},
+		},
+
+		.regulators = {},
+		.reg = { "vfe_lite0" },
+		.interrupt = { "vfe_lite0" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE4 (lite) */
+	{
+		.clock = { "vfe1_lite", "soc_ahb", "cpas_ahb",
+			   "camnoc_axi", "gcc_camera_axi"},
+		.clock_rate = {
+			{ 320000000, 80000000, 0, 150000000, 0},
+			{ 400000000, 80000000, 0, 240000000, 0},
+			{ 480000000, 80000000, 0, 320000000, 0},
+			{ 600000000, 80000000, 0, 400000000, 0},
+		},
+
+		.regulators = {},
+		.reg = { "vfe_lite1" },
+		.interrupt = { "vfe_lite1" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_170,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+};
+
+static const struct resources_icc icc_res_sc7280[] = {
+	{
+		.name = "ahb",
+		.icc_bw_tbl.avg = 38400,
+		.icc_bw_tbl.peak = 76800,
+	},
+	{
+		.name = "hf_0",
+		.icc_bw_tbl.avg = 2097152,
+		.icc_bw_tbl.peak = 2097152,
+	},
+};
+
+static const struct camss_subdev_resources csiphy_res_8300[] = {
+	/* CSIPHY0 */
+	{
+		.regulators = {},
+		.clock = { "csid_csiphy_rx", "csiphy0", "csiphy0_timer"},
+		.clock_rate = {
+			{ 400000000, 0, 400000000}
+		},
+		.reg = { "csiphy0" },
+		.interrupt = { "csiphy0" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sa8775p
+		}
+	},
+	/* CSIPHY1 */
+	{
+		.regulators = {},
+		.clock = { "csid_csiphy_rx", "csiphy1", "csiphy1_timer"},
+		.clock_rate = {
+			{ 400000000, 0, 400000000}
+		},
+		.reg = { "csiphy1" },
+		.interrupt = { "csiphy1" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sa8775p
+		}
+	},
+	/* CSIPHY2 */
+	{
+		.regulators = {},
+		.clock = { "csid_csiphy_rx", "csiphy2", "csiphy2_timer"},
+		.clock_rate = {
+			{ 400000000, 0, 400000000}
+		},
+		.reg = { "csiphy2" },
+		.interrupt = { "csiphy2" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sa8775p
+		}
+	},
+};
+
+static const struct camss_subdev_resources tpg_res_8300[] = {
+	/* TPG0 */
+	{
+		.regulators = {  },
+		.clock = { "cphy_rx_clk" },
+		.clock_rate = { { 400000000 } },
+		.reg = { "tpg0" },
+		.interrupt = { "tpg0" },
+		.tpg = {
+			.lane_cnt = 4,
+			.vc_cnt = 1,
+			.formats = &tpg_formats_gen1,
+			.hw_ops = &tpg_ops_gen1
+		}
+	},
+
+	/* TPG1 */
+	{
+		.regulators = {  },
+		.clock = { "cphy_rx_clk" },
+		.clock_rate = { { 400000000 } },
+		.reg = { "tpg1" },
+		.interrupt = { "tpg1" },
+		.tpg = {
+			.lane_cnt = 4,
+			.vc_cnt = 1,
+			.formats = &tpg_formats_gen1,
+			.hw_ops = &tpg_ops_gen1
+		}
+	},
+
+	/* TPG2 */
+	{
+		.regulators = {  },
+		.clock = { "cphy_rx_clk" },
+		.clock_rate = { { 400000000 } },
+		.reg = { "tpg2" },
+		.interrupt = { "tpg2" },
+		.tpg = {
+			.lane_cnt = 4,
+			.vc_cnt = 1,
+			.formats = &tpg_formats_gen1,
+			.hw_ops = &tpg_ops_gen1
+		}
+	},
+};
+
+static const struct camss_subdev_resources csid_res_8300[] = {
+	/* CSID0 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "csid", "csid_csiphy_rx"},
+		.clock_rate = {
+			{ 400000000, 400000000},
+			{ 400000000, 400000000}
+		},
+
+		.reg = { "csid0" },
+		.interrupt = { "csid0", "csid_top" },
+		.csid = {
+			.is_lite = false,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID1 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "csid", "csid_csiphy_rx"},
+		.clock_rate = {
+			{ 400000000, 400000000},
+			{ 400000000, 400000000}
+		},
+
+		.reg = { "csid1", "csid_top" },
+		.interrupt = { "csid1" },
+		.csid = {
+			.is_lite = false,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+
+	/* CSID2 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite0" },
+		.interrupt = { "csid-lite0" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID3 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite1" },
+		.interrupt = { "csid-lite1" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID4 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite2" },
+		.interrupt = { "csid-lite2" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID5 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite3" },
+		.interrupt = { "csid-lite3" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID6 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite4" },
+		.interrupt = { "csid-lite4" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+};
+
+static const struct camss_subdev_resources vfe_res_8300[] = {
+	/* VFE0 */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe0", "vfe0", "vfe0_fast_ahb",
+			   "cpas_ahb", "gcc_camera_ahb", "gcc_axi_hf", "gcc_axi_sf",
+			   "core_ahb", "cpas_fast_ahb_clk", "camnoc_axi",
+			   "icp_ahb"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 480000000, 480000000, 480000000, 480000000 },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 0, 0, 0, 80000000 },
+			{ 37500000, 75000000, 75000000, 75000000 },
+			{ 403200000, 533000000, 600000000, 600000000 },
+			{ 403200000, 533000000, 600000000, 600000000 },
+			{ 0, 0, 0, 80000000 },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 0 },
+		},
+
+		.reg = { "vfe0" },
+		.interrupt = { "vfe0" },
+		.vfe = {
+			.line_num = 3,
+			.is_lite = false,
+			.has_pd = false,
+			.pd_name = NULL,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE1 */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe1", "vfe1", "vfe1_fast_ahb",
+			   "cpas_ahb", "gcc_camera_ahb", "gcc_axi_hf", "gcc_axi_sf",
+			   "core_ahb", "cpas_fast_ahb_clk", "camnoc_axi",
+			   "icp_ahb"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 480000000, 480000000, 480000000, 480000000 },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 0, 0, 0, 80000000 },
+			{ 37500000, 75000000, 75000000, 75000000 },
+			{ 403200000, 533000000, 600000000, 600000000 },
+			{ 403200000, 533000000, 600000000, 600000000 },
+			{ 0, 0, 0, 80000000 },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 0 },
+		},
+
+		.reg = { "vfe1" },
+		.interrupt = { "vfe1" },
+		.vfe = {
+			.line_num = 3,
+			.is_lite = false,
+			.has_pd = false,
+			.pd_name = NULL,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+
+	/* VFE2 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite0" },
+		.interrupt = { "vfe-lite0" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE3 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite1" },
+		.interrupt = { "vfe-lite1" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE4 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite2" },
+		.interrupt = { "vfe-lite2" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE5 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite3" },
+		.interrupt = { "vfe-lite3" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE6 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite4" },
+		.interrupt = { "vfe-lite4" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+};
+
+static const struct resources_icc icc_res_qcs8300[] = {
+	{
+		.name = "ahb",
+		.icc_bw_tbl.avg = 38400,
+		.icc_bw_tbl.peak = 76800,
+	},
+	{
+		.name = "hf_0",
+		.icc_bw_tbl.avg = 2097152,
+		.icc_bw_tbl.peak = 2097152,
+	},
+};
+
+static const struct camss_subdev_resources csiphy_res_8775p[] = {
+	/* CSIPHY0 */
+	{
+		.regulators = {},
+		.clock = { "csid_csiphy_rx", "csiphy0", "csiphy0_timer"},
+		.clock_rate = {
+			{ 400000000, 0, 400000000}
+		},
+		.reg = { "csiphy0" },
+		.interrupt = { "csiphy0" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sa8775p
+		}
+	},
+	/* CSIPHY1 */
+	{
+		.regulators = {},
+		.clock = { "csid_csiphy_rx", "csiphy1", "csiphy1_timer"},
+		.clock_rate = {
+			{ 400000000, 0, 400000000}
+		},
+		.reg = { "csiphy1" },
+		.interrupt = { "csiphy1" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sa8775p
+		}
+	},
+	/* CSIPHY2 */
+	{
+		.regulators = {},
+		.clock = { "csid_csiphy_rx", "csiphy2", "csiphy2_timer"},
+		.clock_rate = {
+			{ 400000000, 0, 400000000}
+		},
+		.reg = { "csiphy2" },
+		.interrupt = { "csiphy2" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sa8775p
+		}
+	},
+	/* CSIPHY3 */
+	{
+		.regulators = {},
+		.clock = { "csid_csiphy_rx", "csiphy3", "csiphy3_timer"},
+		.clock_rate = {
+			{ 400000000, 0, 400000000}
+		},
+		.reg = { "csiphy3" },
+		.interrupt = { "csiphy3" },
+		.csiphy = {
+			.hw_ops = &csiphy_ops_3ph_1_0,
+			.formats = &csiphy_formats_sa8775p
+		}
+	},
+};
+
+static const struct camss_subdev_resources tpg_res_8775p[] = {
+	/* TPG0 */
+	{
+		.regulators = {  },
+		.clock = { "cphy_rx_clk" },
+		.clock_rate = { { 400000000 } },
+		.reg = { "tpg0" },
+		.interrupt = { "tpg0" },
+		.tpg = {
+			.lane_cnt = 4,
+			.vc_cnt = 1,
+			.formats = &tpg_formats_gen1,
+			.hw_ops = &tpg_ops_gen1
+		}
+	},
+
+	/* TPG1 */
+	{
+		.regulators = {  },
+		.clock = { "cphy_rx_clk" },
+		.clock_rate = { { 400000000 } },
+		.reg = { "tpg1" },
+		.interrupt = { "tpg1" },
+		.tpg = {
+			.lane_cnt = 4,
+			.vc_cnt = 1,
+			.formats = &tpg_formats_gen1,
+			.hw_ops = &tpg_ops_gen1
+		}
+	},
+
+	/* TPG2 */
+	{
+		.regulators = {  },
+		.clock = { "cphy_rx_clk" },
+		.clock_rate = { { 400000000 } },
+		.reg = { "tpg2" },
+		.interrupt = { "tpg2" },
+		.tpg = {
+			.lane_cnt = 4,
+			.vc_cnt = 1,
+			.formats = &tpg_formats_gen1,
+			.hw_ops = &tpg_ops_gen1
+		}
+	},
+};
+
+static const struct camss_subdev_resources csid_res_8775p[] = {
+	/* CSID0 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "csid", "csid_csiphy_rx"},
+		.clock_rate = {
+			{ 400000000, 400000000},
+			{ 400000000, 400000000}
+		},
+
+		.reg = { "csid0" },
+		.interrupt = { "csid0", "csid_top" },
+		.csid = {
+			.is_lite = false,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID1 */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "csid", "csid_csiphy_rx"},
+		.clock_rate = {
+			{ 400000000, 400000000},
+			{ 400000000, 400000000}
+		},
+
+		.reg = { "csid1", "csid_top" },
+		.interrupt = { "csid1" },
+		.csid = {
+			.is_lite = false,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+
+	/* CSID2 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite0" },
+		.interrupt = { "csid-lite0" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID3 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite1" },
+		.interrupt = { "csid-lite1" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID4 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite2" },
+		.interrupt = { "csid-lite2" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID5 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite3" },
+		.interrupt = { "csid-lite3" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+	/* CSID6 (lite) */
+	{
+		.regulators = { "vdda-phy", "vdda-pll" },
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 400000000, 400000000, 0},
+			{ 0, 0, 400000000, 480000000, 0}
+		},
+
+		.reg = { "csid_lite4" },
+		.interrupt = { "csid-lite4" },
+		.csid = {
+			.is_lite = true,
+			.hw_ops = &csid_ops_gen3,
+			.parent_dev_ops = &vfe_parent_dev_ops,
+			.formats = &csid_formats_gen2
+		}
+	},
+};
+
+static const struct camss_subdev_resources vfe_res_8775p[] = {
+	/* VFE0 */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe0", "vfe0", "vfe0_fast_ahb",
+			   "cpas_ahb", "gcc_camera_ahb", "gcc_axi_hf", "gcc_axi_sf",
+			   "core_ahb", "cpas_fast_ahb_clk", "camnoc_axi",
+			   "icp_ahb"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 480000000, 480000000, 480000000, 480000000 },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 0, 0, 0, 80000000 },
+			{ 37500000, 75000000, 75000000, 75000000 },
+			{ 403200000, 533000000, 600000000, 600000000 },
+			{ 403200000, 533000000, 600000000, 600000000 },
+			{ 0, 0, 0, 80000000 },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 0 },
+		},
+
+		.reg = { "vfe0" },
+		.interrupt = { "vfe0" },
+		.vfe = {
+			.line_num = 3,
+			.is_lite = false,
+			.has_pd = false,
+			.pd_name = NULL,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE1 */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe1", "vfe1", "vfe1_fast_ahb",
+			   "cpas_ahb", "gcc_camera_ahb", "gcc_axi_hf", "gcc_axi_sf",
+			   "core_ahb", "cpas_fast_ahb_clk", "camnoc_axi",
+			   "icp_ahb"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 480000000, 480000000, 480000000, 480000000 },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 0, 0, 0, 80000000 },
+			{ 37500000, 75000000, 75000000, 75000000 },
+			{ 403200000, 533000000, 600000000, 600000000 },
+			{ 403200000, 533000000, 600000000, 600000000 },
+			{ 0, 0, 0, 80000000 },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 0 },
+		},
+
+		.reg = { "vfe1" },
+		.interrupt = { "vfe1" },
+		.vfe = {
+			.line_num = 3,
+			.is_lite = false,
+			.has_pd = false,
+			.pd_name = NULL,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+
+	/* VFE2 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite0" },
+		.interrupt = { "vfe-lite0" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE3 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite1" },
+		.interrupt = { "vfe-lite1" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE4 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite2" },
+		.interrupt = { "vfe-lite2" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE5 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite3" },
+		.interrupt = { "vfe-lite3" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+	/* VFE6 (lite) */
+	{
+		.regulators = {},
+
+		.clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+			   "vfe_lite"},
+		.clock_rate = {
+			{ 0, 0, 0, 0  },
+			{ 300000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 400000000, 400000000, 400000000, 400000000 },
+			{ 480000000, 600000000, 600000000, 600000000 },
+		},
+		.reg = { "vfe_lite4" },
+		.interrupt = { "vfe-lite4" },
+		.vfe = {
+			.line_num = 4,
+			.is_lite = true,
+			.hw_ops = &vfe_ops_690,
+			.formats_rdi = &vfe_formats_rdi_845,
+			.formats_pix = &vfe_formats_pix_845
+		}
+	},
+};
+
+static const struct resources_icc icc_res_sa8775p[] = {
+	{
+		.name = "ahb",
+		.icc_bw_tbl.avg = 38400,
+		.icc_bw_tbl.peak = 76800,
+	},
+	{
+		.name = "hf_0",
+		.icc_bw_tbl.avg = 2097152,
+		.icc_bw_tbl.peak = 2097152,
+	},
+};
+
 /*
  * camss_add_clock_margin - Add margin to clock frequency rate
  * @rate: Clock frequency rate
@@ -1083,7 +2852,7 @@
 	if (id < camss->res->vfe_num) {
 		struct vfe_device *vfe = &camss->vfe[id];
 
-		ret = vfe->ops->pm_domain_on(vfe);
+		ret = vfe->res->hw_ops->pm_domain_on(vfe);
 	}
 
 	return ret;
@@ -1094,10 +2863,72 @@
 	if (id < camss->res->vfe_num) {
 		struct vfe_device *vfe = &camss->vfe[id];
 
-		vfe->ops->pm_domain_off(vfe);
+		vfe->res->hw_ops->pm_domain_off(vfe);
 	}
 }
 
+void camss_reg_update(struct camss *camss, int hw_id, int port_id, bool is_clear)
+{
+	struct csid_device *csid;
+
+	if (hw_id < camss->res->csid_num) {
+		csid = &(camss->csid[hw_id]);
+		csid->res->hw_ops->reg_update(csid, port_id, is_clear);
+	}
+}
+
+void camss_buf_done(struct camss *camss, int hw_id, int port_id)
+{
+	struct vfe_device *vfe;
+
+	if (hw_id < camss->res->vfe_num) {
+		vfe = &(camss->vfe[hw_id]);
+		vfe->res->hw_ops->vfe_buf_done(vfe, port_id);
+	}
+}
+
+static int vfe_parent_dev_ops_get(struct camss *camss, int id)
+{
+	int ret = -EINVAL;
+
+	if (id < camss->res->vfe_num) {
+		struct vfe_device *vfe = &camss->vfe[id];
+
+		ret = vfe_get(vfe);
+	}
+
+	return ret;
+}
+
+static int vfe_parent_dev_ops_put(struct camss *camss, int id)
+{
+	if (id < camss->res->vfe_num) {
+		struct vfe_device *vfe = &camss->vfe[id];
+
+		vfe_put(vfe);
+	}
+
+	return 0;
+}
+
+static void __iomem
+*vfe_parent_dev_ops_get_base_address(struct camss *camss, int id)
+{
+	if (id < camss->res->vfe_num) {
+		struct vfe_device *vfe = &camss->vfe[id];
+
+		return vfe->base;
+	}
+
+	return NULL;
+}
+
+static const struct parent_dev_ops vfe_parent_dev_ops = {
+	.get = vfe_parent_dev_ops_get,
+	.put = vfe_parent_dev_ops_put,
+	.get_base_address = vfe_parent_dev_ops_get_base_address
+};
+
 /*
  * camss_of_parse_endpoint_node - Parse port endpoint node
  * @dev: Device
@@ -1114,8 +2945,11 @@
 	struct v4l2_mbus_config_mipi_csi2 *mipi_csi2;
 	struct v4l2_fwnode_endpoint vep = { { 0 } };
 	unsigned int i;
+	int ret;
 
-	v4l2_fwnode_endpoint_parse(of_fwnode_handle(node), &vep);
+	ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(node), &vep);
+	if (ret)
+		return ret;
 
 	csd->interface.csiphy_id = vep.base.port;
 
@@ -1240,76 +3074,135 @@
 		return ret;
 	}
 
+	if (camss->tpg) {
+		for (i = 0; i < camss->res->tpg_num; i++) {
+			ret = msm_tpg_subdev_init(camss, &camss->tpg[i],
+						  &res->tpg_res[i], i);
+			if (ret < 0) {
+				dev_err(camss->dev,
+					"Failed to init tpg%d sub-device: %d\n",
+					i, ret);
+				return ret;
+			}
+		}
+	}
+
 	return 0;
 }
 
 /*
- * camss_register_entities - Register subdev nodes and create links
+ * camss_link_entities_tpg - Register subdev nodes and create links
  * @camss: CAMSS device
  *
  * Return 0 on success or a negative error code on failure
  */
-static int camss_register_entities(struct camss *camss)
+static int camss_link_entities_tpg(struct camss *camss)
 {
-	int i, j, k;
+	int i, j;
 	int ret;
 
-	for (i = 0; i < camss->res->csiphy_num; i++) {
-		ret = msm_csiphy_register_entity(&camss->csiphy[i],
-						 &camss->v4l2_dev);
-		if (ret < 0) {
-			dev_err(camss->dev,
-				"Failed to register csiphy%d entity: %d\n",
-				i, ret);
-			goto err_reg_csiphy;
+	for (i = 0; i < camss->res->tpg_num; i++) {
+		for (j = 0; j < camss->res->csid_num; j++) {
+			ret = media_create_pad_link(&camss->tpg[i].subdev.entity,
+						    MSM_TPG_PAD_SRC,
+						    &camss->csid[j].subdev.entity,
+						    MSM_CSID_PAD_SINK,
+						    0);
+			if (ret < 0) {
+				dev_err(camss->dev,
+					"Failed to link %s->%s entities: %d\n",
+					camss->tpg[i].subdev.entity.name,
+					camss->csid[j].subdev.entity.name,
+					ret);
+				return ret;
+			}
 		}
 	}
+	return 0;
+}
 
-	for (i = 0; i < camss->res->csid_num; i++) {
-		ret = msm_csid_register_entity(&camss->csid[i],
-					       &camss->v4l2_dev);
-		if (ret < 0) {
-			dev_err(camss->dev,
-				"Failed to register csid%d entity: %d\n",
-				i, ret);
-			goto err_reg_csid;
-		}
-	}
+/*
+ * camss_link_entities_v2 - Register subdev nodes and create links
+ * @camss: CAMSS device
+ *
+ * Return 0 on success or a negative error code on failure
+ */
+static int camss_link_entities_v2(struct camss *camss)
+{
+	int i, j;
+	int ret;
 
-	ret = msm_ispif_register_entities(camss->ispif,
-					  &camss->v4l2_dev);
-	if (ret < 0) {
-		dev_err(camss->dev, "Failed to register ispif entities: %d\n",
-		ret);
-		goto err_reg_ispif;
+	for (i = 0; i < camss->res->csiphy_num; i++) {
+		for (j = 0; j < camss->res->csid_num; j++) {
+			ret = media_create_pad_link(&camss->csiphy[i].subdev.entity,
+						    MSM_CSIPHY_PAD_SRC,
+						    &camss->csid[j].subdev.entity,
+						    MSM_CSID_PAD_SINK,
+						    0);
+			if (ret < 0) {
+				dev_err(camss->dev,
+					"Failed to link %s->%s entities: %d\n",
+					camss->csiphy[i].subdev.entity.name,
+					camss->csid[j].subdev.entity.name,
+					ret);
+				return ret;
+			}
+		}
 	}
 
-	for (i = 0; i < camss->res->vfe_num; i++) {
-		ret = msm_vfe_register_entities(&camss->vfe[i],
-						&camss->v4l2_dev);
-		if (ret < 0) {
-			dev_err(camss->dev,
-				"Failed to register vfe%d entities: %d\n",
-				i, ret);
-			goto err_reg_vfe;
+	for (i = 0; i < camss->res->csid_num; i++)
+		for (j = 0; j < camss->vfe[i].res->line_num; j++) {
+			struct v4l2_subdev *csid = &camss->csid[i].subdev;
+			struct v4l2_subdev *vfe = &camss->vfe[i].line[j].subdev;
+
+			ret = media_create_pad_link(&csid->entity,
+						    MSM_CSID_PAD_FIRST_SRC + j,
+						    &vfe->entity,
+						    MSM_VFE_PAD_SINK,
+						    0);
+			if (ret < 0) {
+				dev_err(camss->dev,
+					"Failed to link %s->%s entities: %d\n",
+					csid->entity.name,
+					vfe->entity.name,
+					ret);
+				return ret;
+			}
 		}
+	return 0;
+}
+
+/*
+ * camss_link_entities - Register subdev nodes and create links
+ * @camss: CAMSS device
+ *
+ * Return 0 on success or a negative error code on failure
+ */
+static int camss_link_entities(struct camss *camss)
+{
+	int i, j, k;
+	int ret;
+
+	if (camss->tpg) {
+		ret = camss_link_entities_tpg(camss);
+		if (ret < 0)
+			return ret;
 	}
 
 	for (i = 0; i < camss->res->csiphy_num; i++) {
 		for (j = 0; j < camss->res->csid_num; j++) {
-			ret = media_create_pad_link(
-				&camss->csiphy[i].subdev.entity,
-				MSM_CSIPHY_PAD_SRC,
-				&camss->csid[j].subdev.entity,
-				MSM_CSID_PAD_SINK,
-				0);
+			ret = media_create_pad_link(&camss->csiphy[i].subdev.entity,
+						    MSM_CSIPHY_PAD_SRC,
+						    &camss->csid[j].subdev.entity,
+						    MSM_CSID_PAD_SINK,
+						    0);
 			if (ret < 0) {
 				dev_err(camss->dev,
 					"Failed to link %s->%s entities: %d\n",
 					camss->csiphy[i].subdev.entity.name,
 					camss->csid[j].subdev.entity.name,
 					ret);
-				goto err_link;
+				return ret;
 			}
 		}
 	}
@@ -1317,26 +3210,25 @@
 	if (camss->ispif) {
 		for (i = 0; i < camss->res->csid_num; i++) {
 			for (j = 0; j < camss->ispif->line_num; j++) {
-				ret = media_create_pad_link(
-					&camss->csid[i].subdev.entity,
-					MSM_CSID_PAD_SRC,
-					&camss->ispif->line[j].subdev.entity,
-					MSM_ISPIF_PAD_SINK,
-					0);
+				ret = media_create_pad_link(&camss->csid[i].subdev.entity,
+							    MSM_CSID_PAD_SRC,
+							    &camss->ispif->line[j].subdev.entity,
+							    MSM_ISPIF_PAD_SINK,
+							    0);
 				if (ret < 0) {
 					dev_err(camss->dev,
 						"Failed to link %s->%s entities: %d\n",
 						camss->csid[i].subdev.entity.name,
 						camss->ispif->line[j].subdev.entity.name,
 						ret);
-					goto err_link;
+					return ret;
 				}
 			}
 		}
 
 		for (i = 0; i < camss->ispif->line_num; i++)
 			for (k = 0; k < camss->res->vfe_num; k++)
-				for (j = 0; j < camss->vfe[k].line_num; j++) {
+				for (j = 0; j < camss->vfe[k].res->line_num; j++) {
 					struct v4l2_subdev *ispif = &camss->ispif->line[i].subdev;
 					struct v4l2_subdev *vfe = &camss->vfe[k].line[j].subdev;
 
@@ -1351,13 +3243,13 @@
 							ispif->entity.name,
 							vfe->entity.name,
 							ret);
-						goto err_link;
+						return ret;
 					}
 				}
 	} else {
 		for (i = 0; i < camss->res->csid_num; i++)
 			for (k = 0; k < camss->res->vfe_num; k++)
-				for (j = 0; j < camss->vfe[k].line_num; j++) {
+				for (j = 0; j < camss->vfe[k].res->line_num; j++) {
 					struct v4l2_subdev *csid = &camss->csid[i].subdev;
 					struct v4l2_subdev *vfe = &camss->vfe[k].line[j].subdev;
 
@@ -1372,15 +3264,80 @@
 							csid->entity.name,
 							vfe->entity.name,
 							ret);
-						goto err_link;
+						return ret;
 					}
 				}
 	}
 
 	return 0;
+}
+
+/*
+ * camss_register_entities - Register subdev nodes and create links
+ * @camss: CAMSS device
+ *
+ * Return 0 on success or a negative error code on failure
+ */
+static int camss_register_entities(struct camss *camss)
+{
+	int i;
+	int ret;
+
+	if (camss->tpg) {
+		for (i = 0; i < camss->res->tpg_num; i++) {
+			ret = msm_tpg_register_entity(&camss->tpg[i],
+						      &camss->v4l2_dev);
+			if (ret < 0) {
+				dev_err(camss->dev,
+					"Failed to register tpg%d entity: %d\n",
+					i, ret);
+				goto err_reg_tpg;
+			}
+		}
+	}
+
+	for (i = 0; i < camss->res->csiphy_num; i++) {
+		ret = msm_csiphy_register_entity(&camss->csiphy[i],
+						 &camss->v4l2_dev);
+		if (ret < 0) {
+			dev_err(camss->dev,
+				"Failed to register csiphy%d entity: %d\n",
+				i, ret);
+			goto err_reg_csiphy;
+		}
+	}
+
+	for (i = 0; i < camss->res->csid_num; i++) {
+		ret = msm_csid_register_entity(&camss->csid[i],
+					       &camss->v4l2_dev);
+		if (ret < 0) {
+			dev_err(camss->dev,
+				"Failed to register csid%d entity: %d\n",
+				i, ret);
+			goto err_reg_csid;
+		}
+	}
+
+	ret = msm_ispif_register_entities(camss->ispif,
+					  &camss->v4l2_dev);
+	if (ret < 0) {
+		dev_err(camss->dev, "Failed to register ispif entities: %d\n", ret);
+		goto err_reg_ispif;
+	}
+
+	for (i = 0; i < camss->res->vfe_num; i++) {
+		ret = msm_vfe_register_entities(&camss->vfe[i],
+						&camss->v4l2_dev);
+		if (ret < 0) {
+			dev_err(camss->dev,
+				"Failed to register vfe%d entities: %d\n",
+				i, ret);
+			goto err_reg_vfe;
+		}
+	}
+
+	return 0;
 
-err_link:
-	i = camss->res->vfe_num;
 err_reg_vfe:
 	for (i--; i >= 0; i--)
 		msm_vfe_unregister_entities(&camss->vfe[i]);
@@ -1398,6 +3355,11 @@
 	for (i--; i >= 0; i--)
 		msm_csiphy_unregister_entity(&camss->csiphy[i]);
 
+	i = camss->res->tpg_num;
+err_reg_tpg:
+	for (i--; i >= 0; i--)
+		msm_tpg_unregister_entity(&camss->tpg[i]);
+
 	return ret;
 }
 
@@ -1410,6 +3372,8 @@
 static void camss_unregister_entities(struct camss *camss)
 {
 	unsigned int i;
+	for (i = 0; i < camss->res->tpg_num; i++)
+		msm_tpg_unregister_entity(&camss->tpg[i]);
 
 	for (i = 0; i < camss->res->csiphy_num; i++)
 		msm_csiphy_unregister_entity(&camss->csiphy[i]);
@@ -1518,7 +3482,7 @@
 
 	/* count the # of VFEs which have flagged power-domain */
 	for (vfepd_num = i = 0; i < camss->res->vfe_num; i++) {
-		if (res->vfe_res[i].has_pd)
+		if (res->vfe_res[i].vfe.has_pd)
 			vfepd_num++;
 	}
 
@@ -1537,10 +3501,8 @@
 	if (camss->res->pd_name) {
 		camss->genpd = dev_pm_domain_attach_by_name(camss->dev,
 							    camss->res->pd_name);
-		if (IS_ERR(camss->genpd)) {
-			ret = PTR_ERR(camss->genpd);
-			goto fail_pm;
-		}
+		if (IS_ERR(camss->genpd))
+			return PTR_ERR(camss->genpd);
 	}
 
 	if (!camss->genpd) {
@@ -1550,22 +3512,35 @@
 		 */
 		camss->genpd = dev_pm_domain_attach_by_id(camss->dev,
 							  camss->genpd_num - 1);
+		if (IS_ERR(camss->genpd))
+			return PTR_ERR(camss->genpd);
 	}
-	if (IS_ERR_OR_NULL(camss->genpd)) {
-		if (!camss->genpd)
-			ret = -ENODEV;
-		else
-			ret = PTR_ERR(camss->genpd);
-		goto fail_pm;
+
+	if (!camss->genpd)
+		return -ENODEV;
+
+	ret = devm_pm_opp_set_clkname(camss->dev, "vfe0");
+	if (ret) {
+		dev_err(dev, "devm_pm_opp_set_clkname failed %d\n", ret);
+		return ret;
 	}
+
 	camss->genpd_link = device_link_add(camss->dev, camss->genpd,
 					    DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME |
 					    DL_FLAG_RPM_ACTIVE);
 	if (!camss->genpd_link) {
+		dev_err(dev, "device_link_add failed %d\n", ret);
 		ret = -EINVAL;
 		goto fail_pm;
 	}
 
+	ret = devm_pm_opp_of_add_table(camss->dev);
+	if (ret) {
+		dev_err(dev, "devm_pm_opp_of_add_table failed %d\n", ret);
+		device_link_del(camss->genpd_link);
+		goto fail_pm;
+	}
+
 	return 0;
 
 fail_pm:
@@ -1640,6 +3615,14 @@
 	if (!camss->csiphy)
 		return -ENOMEM;
 
+	if (camss->res->version == CAMSS_8775P ||
+	    camss->res->version == CAMSS_8300) {
+		camss->tpg = devm_kcalloc(dev, camss->res->tpg_num,
+					  sizeof(*camss->tpg), GFP_KERNEL);
+		if (!camss->tpg)
+			return -ENOMEM;
+	}
+
 	camss->csid = devm_kcalloc(dev, camss->res->csid_num, sizeof(*camss->csid),
 				   GFP_KERNEL);
 	if (!camss->csid)
@@ -1690,6 +3673,8 @@
 
 	v4l2_async_nf_init(&camss->notifier, &camss->v4l2_dev);
 
+	pm_runtime_enable(dev);
+
 	num_subdevs = camss_of_parse_ports(camss);
 	if (num_subdevs < 0) {
 		ret = num_subdevs;
@@ -1700,6 +3685,10 @@
 	if (ret < 0)
 		goto err_v4l2_device_unregister;
 
+	ret = camss->res->link_entities(camss);
+	if (ret < 0)
+		goto err_register_subdevs;
+
 	if (num_subdevs) {
 		camss->notifier.ops = &camss_subdev_notifier_ops;
 
@@ -1726,8 +3715,6 @@
 		}
 	}
 
-	pm_runtime_enable(dev);
-
 	return 0;
 
 err_register_subdevs:
@@ -1735,6 +3722,7 @@
 err_v4l2_device_unregister:
 	v4l2_device_unregister(&camss->v4l2_dev);
 	v4l2_async_nf_cleanup(&camss->notifier);
+	pm_runtime_disable(dev);
 err_genpd_cleanup:
 	camss_genpd_cleanup(camss);
 
@@ -1779,6 +3767,7 @@
 	.csiphy_num = ARRAY_SIZE(csiphy_res_8x16),
 	.csid_num = ARRAY_SIZE(csid_res_8x16),
 	.vfe_num = ARRAY_SIZE(vfe_res_8x16),
+	.link_entities = camss_link_entities
 };
 
 static const struct camss_resources msm8996_resources = {
@@ -1790,6 +3779,7 @@
 	.csiphy_num = ARRAY_SIZE(csiphy_res_8x96),
 	.csid_num = ARRAY_SIZE(csid_res_8x96),
 	.vfe_num = ARRAY_SIZE(vfe_res_8x96),
+	.link_entities = camss_link_entities
 };
 
 static const struct camss_resources sdm660_resources = {
@@ -1801,6 +3791,7 @@
 	.csiphy_num = ARRAY_SIZE(csiphy_res_660),
 	.csid_num = ARRAY_SIZE(csid_res_660),
 	.vfe_num = ARRAY_SIZE(vfe_res_660),
+	.link_entities = camss_link_entities
 };
 
 static const struct camss_resources sdm845_resources = {
@@ -1811,6 +3802,7 @@
 	.csiphy_num = ARRAY_SIZE(csiphy_res_845),
 	.csid_num = ARRAY_SIZE(csid_res_845),
 	.vfe_num = ARRAY_SIZE(vfe_res_845),
+	.link_entities = camss_link_entities
 };
 
 static const struct camss_resources sm8250_resources = {
@@ -1824,11 +3816,77 @@
 	.csiphy_num = ARRAY_SIZE(csiphy_res_8250),
 	.csid_num = ARRAY_SIZE(csid_res_8250),
 	.vfe_num = ARRAY_SIZE(vfe_res_8250),
+	.link_entities = camss_link_entities
+};
+
+static const struct camss_resources sc8280xp_resources = {
+	.version = CAMSS_8280XP,
+	.pd_name = "top",
+	.csiphy_res = csiphy_res_sc8280xp,
+	.csid_res = csid_res_sc8280xp,
+	.ispif_res = NULL,
+	.vfe_res = vfe_res_sc8280xp,
+	.icc_res = icc_res_sc8280xp,
+	.icc_path_num = ARRAY_SIZE(icc_res_sc8280xp),
+	.csiphy_num = ARRAY_SIZE(csiphy_res_sc8280xp),
+	.csid_num = ARRAY_SIZE(csid_res_sc8280xp),
+	.vfe_num = ARRAY_SIZE(vfe_res_sc8280xp),
+	.link_entities = camss_link_entities_v2
+};
+
+static const struct camss_resources sc7280_resources = {
+	.version = CAMSS_7280,
+	.pd_name = "top",
+	.csiphy_res = csiphy_res_7280,
+	.csid_res = csid_res_7280,
+	.vfe_res = vfe_res_7280,
+	.icc_res = icc_res_sc7280,
+	.icc_path_num = ARRAY_SIZE(icc_res_sc7280),
+	.csiphy_num = ARRAY_SIZE(csiphy_res_7280),
+	.csid_num = ARRAY_SIZE(csid_res_7280),
+	.vfe_num = ARRAY_SIZE(vfe_res_7280),
+	.link_entities = camss_link_entities
+};
+
+static const struct camss_resources sa8775p_resources = {
+	.version = CAMSS_8775P,
+	.pd_name = "top",
+	.csiphy_res = csiphy_res_8775p,
+	.tpg_res = tpg_res_8775p,
+	.csid_res = csid_res_8775p,
+	.vfe_res = vfe_res_8775p,
+	.icc_res = icc_res_sa8775p,
+	.icc_path_num = ARRAY_SIZE(icc_res_sa8775p),
+	.csiphy_num = ARRAY_SIZE(csiphy_res_8775p),
+	.tpg_num = ARRAY_SIZE(tpg_res_8775p),
+	.csid_num = ARRAY_SIZE(csid_res_8775p),
+	.vfe_num = ARRAY_SIZE(vfe_res_8775p),
+	.link_entities = camss_link_entities
+};
+
+static const struct camss_resources qcs8300_resources = {
+	.version = CAMSS_8300,
+	.pd_name = "top",
+	.csiphy_res = csiphy_res_8300,
+	.tpg_res = tpg_res_8300,
+	.csid_res = csid_res_8300,
+	.vfe_res = vfe_res_8300,
+	.icc_res = icc_res_qcs8300,
+	.icc_path_num = ARRAY_SIZE(icc_res_qcs8300),
+	.csiphy_num = ARRAY_SIZE(csiphy_res_8300),
+	.tpg_num = ARRAY_SIZE(tpg_res_8300),
+	.csid_num = ARRAY_SIZE(csid_res_8300),
+	.vfe_num = ARRAY_SIZE(vfe_res_8300),
+	.link_entities = camss_link_entities
 };
 
 static const struct of_device_id camss_dt_match[] = {
 	{ .compatible = "qcom,msm8916-camss", .data = &msm8916_resources },
 	{ .compatible = "qcom,msm8996-camss", .data = &msm8996_resources },
+	{ .compatible = "qcom,qcs8300-camss", .data = &qcs8300_resources },
+	{ .compatible = "qcom,sa8775p-camss", .data = &sa8775p_resources },
+	{ .compatible = "qcom,sc7280-camss", .data = &sc7280_resources },
+	{ .compatible = "qcom,sc8280xp-camss", .data = &sc8280xp_resources },
 	{ .compatible = "qcom,sdm660-camss", .data = &sdm660_resources },
 	{ .compatible = "qcom,sdm845-camss", .data = &sdm845_resources },
 	{ .compatible = "qcom,sm8250-camss", .data = &sm8250_resources },
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/camss/camss.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/camss/camss.h
@@ -20,8 +20,10 @@
 
 #include "camss-csid.h"
 #include "camss-csiphy.h"
+#include "camss-tpg.h"
 #include "camss-ispif.h"
 #include "camss-vfe.h"
+#include "camss-format.h"
 
 #define to_camss(ptr_module)	\
 	container_of(ptr_module, struct camss, ptr_module)
@@ -40,6 +42,7 @@
 	(to_camss_index(ptr_module, index)->dev)
 
 #define CAMSS_RES_MAX 17
+#define RPMP_PERF_STATE_NOM 256
 
 struct camss_subdev_resources {
 	char *regulators[CAMSS_RES_MAX];
@@ -48,11 +51,12 @@
 	u32 clock_rate[CAMSS_RES_MAX][CAMSS_RES_MAX];
 	char *reg[CAMSS_RES_MAX];
 	char *interrupt[CAMSS_RES_MAX];
-	char *pd_name;
-	u8 line_num;
-	bool has_pd;
-	bool is_lite;
-	const void *ops;
+	union {
+		struct csiphy_subdev_resources csiphy;
+		struct tpg_subdev_resources tpg;
+		struct csid_subdev_resources csid;
+		struct vfe_subdev_resources vfe;
+	};
 };
 
 struct icc_bw_tbl {
@@ -75,8 +79,12 @@
 	CAMSS_8x16,
 	CAMSS_8x96,
 	CAMSS_660,
+	CAMSS_7280,
 	CAMSS_845,
 	CAMSS_8250,
+	CAMSS_8280XP,
+	CAMSS_8775P,
+	CAMSS_8300,
 };
 
 enum icc_count {
@@ -88,14 +96,17 @@
 	enum camss_version version;
 	const char *pd_name;
 	const struct camss_subdev_resources *csiphy_res;
+	const struct camss_subdev_resources *tpg_res;
 	const struct camss_subdev_resources *csid_res;
 	const struct camss_subdev_resources *ispif_res;
 	const struct camss_subdev_resources *vfe_res;
 	const struct resources_icc *icc_res;
 	const unsigned int icc_path_num;
 	const unsigned int csiphy_num;
+	const unsigned int tpg_num;
 	const unsigned int csid_num;
 	const unsigned int vfe_num;
+	int (*link_entities)(struct camss *camss);
 };
 
 struct camss {
@@ -104,6 +115,7 @@
 	struct media_device media_dev;
 	struct device *dev;
 	struct csiphy_device *csiphy;
+	struct tpg_device *tpg;
 	struct csid_device *csid;
 	struct ispif_device *ispif;
 	struct vfe_device *vfe;
@@ -113,6 +125,7 @@
 	struct device_link *genpd_link;
 	struct icc_path *icc_path[ICC_SM8250_COUNT];
 	const struct camss_resources *res;
+	void __iomem *csid_top_base;
 };
 
 struct camss_camera_interface {
@@ -132,6 +145,12 @@
 	u32 nfreqs;
 };
 
+struct parent_dev_ops {
+	int (*get)(struct camss *camss, int id);
+	int (*put)(struct camss *camss, int id);
+	void __iomem *(*get_base_address)(struct camss *camss, int id);
+};
+
 void camss_add_clock_margin(u64 *rate);
 int camss_enable_clocks(int nclocks, struct camss_clock *clock,
 			struct device *dev);
@@ -142,6 +161,10 @@
 int camss_get_pixel_clock(struct media_entity *entity, u64 *pixel_clock);
 int camss_pm_domain_on(struct camss *camss, int id);
 void camss_pm_domain_off(struct camss *camss, int id);
+int camss_vfe_get(struct camss *camss, int id);
+void camss_vfe_put(struct camss *camss, int id);
 void camss_delete(struct camss *camss);
-
+void camss_buf_done(struct camss *camss, int hw_id, int port_id);
+void camss_reg_update(struct camss *camss, int hw_id,
+			int port_id, bool is_clear);
 #endif /* QC_MSM_CAMSS_H */
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/Kconfig
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/Kconfig
@@ -0,0 +1,15 @@
+config VIDEO_QCOM_IRIS
+        tristate "Qualcomm Iris V4L2 encoder/decoder driver"
+        depends on V4L_MEM2MEM_DRIVERS
+        depends on VIDEO_DEV && QCOM_SMEM
+        depends on (ARCH_QCOM && IOMMU_DMA) || COMPILE_TEST
+        select QCOM_MDT_LOADER if ARCH_QCOM
+        select QCOM_SCM
+        select VIDEOBUF2_DMA_CONTIG
+        select V4L2_MEM2MEM_DEV
+        select DMABUF_HEAPS
+        help
+          This is a V4L2 driver for Qualcomm Iris video accelerator
+          hardware. It accelerates encoding and decoding operations
+          on various Qualcomm SoCs.
+          To compile this driver as a module choose m here.
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/Makefile
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/Makefile
@@ -0,0 +1,30 @@
+iris-objs += iris_probe.o \
+             iris_core.o \
+             iris_vidc.o \
+             iris_vb2.o \
+             iris_vdec.o \
+             iris_venc.o \
+             iris_state.o \
+             iris_ctrls.o \
+             iris_helpers.o \
+             iris_hfi.o \
+             iris_hfi_response.o \
+             iris_hfi_queue.o \
+             iris_hfi_packet.o \
+             iris_buffer.o \
+             iris_power.o \
+             resources.o \
+             firmware.o \
+             memory.o \
+             vpu_common.o \
+             vpu_iris3.o \
+             vpu_iris3_buffer.o \
+             vpu_iris3_power.o \
+             vpu_iris2.o \
+             vpu_iris2_buffer.o \
+             vpu_iris2_power.o \
+             platform_common.o \
+             platform_sm8550.o \
+             platform_qcm6490.o
+
+obj-$(CONFIG_VIDEO_QCOM_IRIS) += iris.o
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/firmware.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/firmware.c
@@ -0,0 +1,162 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/firmware.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/of_address.h>
+#include <linux/soc/qcom/mdt_loader.h>
+
+#include "firmware.h"
+#include "iris_core.h"
+
+#define MAX_FIRMWARE_NAME_SIZE	128
+
+struct tzbsp_memprot {
+	u32 cp_start;
+	u32 cp_size;
+	u32 cp_nonpixel_start;
+	u32 cp_nonpixel_size;
+};
+
+static int __protect_cp_mem(struct iris_core *core)
+{
+	struct tzbsp_memprot memprot;
+	int ret;
+
+	memprot.cp_start = core->cap[CP_START].value;
+	memprot.cp_size = core->cap[CP_SIZE].value;
+	memprot.cp_nonpixel_start = core->cap[CP_NONPIXEL_START].value;
+	memprot.cp_nonpixel_size = core->cap[CP_NONPIXEL_SIZE].value;
+
+	ret = qcom_scm_mem_protect_video_var(memprot.cp_start,
+					     memprot.cp_size,
+					     memprot.cp_nonpixel_start,
+					     memprot.cp_nonpixel_size);
+	if (ret)
+		dev_err(core->dev, "Failed to protect memory(%d)\n", ret);
+
+	return ret;
+}
+
+static int __load_fw_to_memory(struct iris_core *core,
+			       const char *fw_name)
+{
+	char firmware_name[MAX_FIRMWARE_NAME_SIZE] = { 0 };
+	const struct firmware *firmware = NULL;
+	struct device_node *node = NULL;
+	struct resource res = { 0 };
+	phys_addr_t mem_phys = 0;
+	void *mem_virt = NULL;
+	size_t res_size = 0;
+	ssize_t fw_size = 0;
+	struct device *dev;
+	int pas_id = 0;
+	int ret;
+
+	if (!fw_name || !(*fw_name) || !core)
+		return -EINVAL;
+
+	dev = core->dev;
+
+	if (strlen(fw_name) >= MAX_FIRMWARE_NAME_SIZE - 4)
+		return -EINVAL;
+
+	scnprintf(firmware_name, ARRAY_SIZE(firmware_name), "%s.mbn", fw_name);
+
+	pas_id = core->platform_data->pas_id;
+
+	node = of_parse_phandle(dev->of_node, "memory-region", 0);
+	if (!node)
+		return -EINVAL;
+
+	ret = of_address_to_resource(node, 0, &res);
+	if (ret)
+		goto err_put_node;
+
+	mem_phys = res.start;
+	res_size = (size_t)resource_size(&res);
+
+	ret = request_firmware(&firmware, firmware_name, dev);
+	if (ret) {
+		dev_err(core->dev, "%s: failed to request fw \"%s\", error %d\n",
+			__func__, firmware_name, ret);
+		goto err_put_node;
+	}
+
+	fw_size = qcom_mdt_get_size(firmware);
+	if (fw_size < 0 || res_size < (size_t)fw_size) {
+		ret = -EINVAL;
+		dev_err(core->dev, "%s: out of bound fw image fw size: %ld, res_size: %lu\n",
+			__func__, fw_size, res_size);
+		goto err_release_fw;
+	}
+
+	mem_virt = memremap(mem_phys, res_size, MEMREMAP_WC);
+	if (!mem_virt) {
+		dev_err(core->dev, "%s: failed to remap fw memory phys %pa[p]\n",
+			__func__, &mem_phys);
+		goto err_release_fw;
+	}
+
+	ret = qcom_mdt_load(dev, firmware, firmware_name,
+			    pas_id, mem_virt, mem_phys, res_size, NULL);
+	if (ret) {
+		dev_err(core->dev, "%s: error %d loading fw \"%s\"\n",
+			__func__, ret, firmware_name);
+		goto err_mem_unmap;
+	}
+	ret = qcom_scm_pas_auth_and_reset(pas_id);
+	if (ret) {
+		dev_err(core->dev, "%s: error %d authenticating fw \"%s\"\n",
+			__func__, ret, firmware_name);
+		goto err_mem_unmap;
+	}
+
+	return ret;
+
+err_mem_unmap:
+	memunmap(mem_virt);
+err_release_fw:
+	release_firmware(firmware);
+err_put_node:
+	of_node_put(node);
+	return ret;
+}
+
+int iris_fw_load(struct iris_core *core)
+{
+	int ret;
+
+	ret = __load_fw_to_memory(core, core->platform_data->fwname);
+	if (ret) {
+		dev_err(core->dev, "%s: firmware download failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	ret = __protect_cp_mem(core);
+	if (ret) {
+		dev_err(core->dev, "%s: protect memory failed\n", __func__);
+		qcom_scm_pas_shutdown(core->platform_data->pas_id);
+		return ret;
+	}
+
+	return ret;
+}
+
+int iris_fw_unload(struct iris_core *core)
+{
+	int ret;
+
+	ret = qcom_scm_pas_shutdown(core->platform_data->pas_id);
+	if (ret)
+		dev_err(core->dev, "%s: Firmware unload failed with ret %d\n", __func__, ret);
+
+	return ret;
+}
+
+int iris_set_hw_state(struct iris_core *core, bool resume)
+{
+	return qcom_scm_set_remote_state(resume, 0);
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/firmware.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/firmware.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _FIRMWARE_H_
+#define _FIRMWARE_H_
+
+#include "iris_core.h"
+
+int iris_fw_load(struct iris_core *core);
+int iris_fw_unload(struct iris_core *core);
+int iris_set_hw_state(struct iris_core *core, bool resume);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/hfi_defines.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/hfi_defines.h
@@ -0,0 +1,388 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _HFI_DEFINES_H_
+#define _HFI_DEFINES_H_
+
+#include <linux/types.h>
+
+#define HFI_VIDEO_ARCH_LX			0x1
+
+#define HFI_CMD_BEGIN				0x01000000
+#define HFI_CMD_INIT				0x01000001
+#define HFI_CMD_POWER_COLLAPSE			0x01000002
+#define HFI_CMD_OPEN				0x01000003
+#define HFI_CMD_CLOSE				0x01000004
+#define HFI_CMD_START				0x01000005
+#define HFI_CMD_STOP				0x01000006
+#define HFI_CMD_DRAIN				0x01000007
+#define HFI_CMD_RESUME				0x01000008
+#define HFI_CMD_BUFFER				0x01000009
+#define HFI_CMD_PAUSE				0x01000011
+
+#define HFI_PROP_IMAGE_VERSION			0x03000001
+
+#define HFI_PROP_UBWC_MAX_CHANNELS		0x03000003
+#define HFI_PROP_UBWC_MAL_LENGTH		0x03000004
+#define HFI_PROP_UBWC_HBB			0x03000005
+#define HFI_PROP_UBWC_BANK_SWZL_LEVEL1		0x03000006
+#define HFI_PROP_UBWC_BANK_SWZL_LEVEL2		0x03000007
+#define HFI_PROP_UBWC_BANK_SWZL_LEVEL3		0x03000008
+#define HFI_PROP_UBWC_BANK_SPREADING		0x03000009
+
+enum hfi_property_mode_type {
+	HFI_MODE_NONE					= 0x00000000,
+	HFI_MODE_PORT_SETTINGS_CHANGE			= 0x00000001,
+	HFI_MODE_PROPERTY				= 0x00000002,
+};
+
+#define HFI_CMD_SUBSCRIBE_MODE			0x0100000B
+#define HFI_CMD_SETTINGS_CHANGE			0x0100000C
+#define HFI_CMD_END				0x01FFFFFF
+
+#define HFI_BITMASK_BITSTREAM_WIDTH		0xffff0000
+#define HFI_BITMASK_BITSTREAM_HEIGHT		0x0000ffff
+
+#define HFI_LEVEL_NONE				0xFFFFFFFF
+
+#define HFI_BITMASK_FRAME_MBS_ONLY_FLAG		0x00000001
+
+#define HFI_TRUE				0x00000001
+
+#define HFI_FALSE				0x00000000
+
+#define HFI_PROP_BEGIN				0x03000000
+
+#define HFI_PROP_IMAGE_VERSION			0x03000001
+
+#define HFI_PROP_INTRA_FRAME_POWER_COLLAPSE	0x03000002
+
+enum hfi_codec_type {
+	HFI_CODEC_DECODE_AVC	= 1,
+	HFI_CODEC_ENCODE_AVC	= 2,
+	HFI_CODEC_DECODE_HEVC	= 3,
+	HFI_CODEC_ENCODE_HEVC	= 4,
+	HFI_CODEC_DECODE_VP9	= 5,
+};
+
+#define HFI_PROP_CODEC				0x03000100
+
+enum hfi_color_format {
+	HFI_COLOR_FMT_OPAQUE		= 0,
+	HFI_COLOR_FMT_NV12		= 1,
+	HFI_COLOR_FMT_NV12_UBWC		= 2,
+	HFI_COLOR_FMT_P010		= 3,
+	HFI_COLOR_FMT_TP10_UBWC		= 4,
+	HFI_COLOR_FMT_RGBA8888		= 5,
+	HFI_COLOR_FMT_RGBA8888_UBWC	= 6,
+};
+
+#define HFI_PROP_COLOR_FORMAT			0x03000101
+
+#define HFI_PROP_BITSTREAM_RESOLUTION		0x03000103
+
+#define HFI_PROP_LINEAR_STRIDE_SCANLINE		0x03000104
+
+#define HFI_PROP_CROP_OFFSETS			0x03000105
+
+#define HFI_PROP_PROFILE			0x03000107
+
+#define HFI_PROP_LEVEL				0x03000108
+
+#define HFI_PROP_TIER				0x03000109
+
+#define HFI_PROP_STAGE				0x0300010a
+
+#define HFI_PROP_PIPE				0x0300010b
+
+#define HFI_PROP_FRAME_RATE			0x0300010c
+
+#define HFI_PROP_LUMA_CHROMA_BIT_DEPTH		0x0300010f
+
+#define HFI_PROP_CODED_FRAMES			0x03000120
+
+#define HFI_PROP_CABAC_SESSION			0x03000121
+
+#define HFI_PROP_8X8_TRANSFORM			0x03000122
+
+#define HFI_PROP_BUFFER_HOST_MAX_COUNT		0x03000123
+
+#define HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT	0x03000124
+
+#define HFI_PROP_PIC_ORDER_CNT_TYPE		0x03000128
+
+enum hfi_syncframe_request_mode {
+	HFI_SYNC_FRAME_REQUEST_WITHOUT_SEQ_HDR		= 0x00000001,
+	HFI_SYNC_FRAME_REQUEST_WITH_PREFIX_SEQ_HDR	= 0x00000002,
+};
+
+enum hfi_rate_control {
+	HFI_RC_VBR_CFR		= 0x00000000,
+	HFI_RC_CBR_CFR		= 0x00000001,
+	HFI_RC_CQ		= 0x00000002,
+	HFI_RC_OFF		= 0x00000003,
+	HFI_RC_CBR_VFR		= 0x00000004,
+	HFI_RC_LOSSLESS		= 0x00000005,
+	HFI_RC_MBR              = 0x00000006,
+};
+
+#define HFI_PROP_RATE_CONTROL			0x0300012a
+
+#define HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL                  0x0300012b
+
+#define HFI_PROP_QP_PACKED			0x0300012e
+
+#define HFI_PROP_MIN_QP_PACKED			0x0300012f
+
+#define HFI_PROP_MAX_QP_PACKED			0x03000130
+
+enum hfi_layer_enc_type {
+	HFI_HIER_P_SLIDING_WINDOW	= 0x1,
+	HFI_HIER_P_HYBRID_LTR		= 0x2,
+	HFI_HIER_B			= 0x3,
+};
+
+#define HFI_PROP_IR_RANDOM_PERIOD		0x03000131
+
+#define HFI_PROP_MULTI_SLICE_MB_COUNT		0x03000132
+
+#define HFI_PROP_MULTI_SLICE_BYTES_COUNT	0x03000133
+
+#define HFI_PROP_LTR_COUNT			0x03000134
+
+#define HFI_PROP_LTR_MARK			0x03000135
+
+#define HFI_PROP_LTR_USE			0x03000136
+
+#define HFI_PROP_LAYER_ENCODING_TYPE		0x03000138
+
+#define HFI_PROP_LAYER_COUNT			0x03000139
+
+#define HFI_PROP_TOTAL_BITRATE			0x0300013b
+
+#define HFI_PROP_BITRATE_LAYER1			0x0300013c
+
+#define HFI_PROP_BITRATE_LAYER2			0x0300013d
+
+#define HFI_PROP_BITRATE_LAYER3			0x0300013e
+
+#define HFI_PROP_BITRATE_LAYER4			0x0300013f
+
+#define HFI_PROP_BITRATE_LAYER5			0x03000140
+
+#define HFI_PROP_BITRATE_LAYER6			0x03000141
+
+#define HFI_PROP_BASELAYER_PRIORITYID		0x03000142
+
+#define HFI_PROP_REQUEST_SYNC_FRAME		0x03000145
+
+#define HFI_PROP_MAX_GOP_FRAMES			0x03000146
+
+#define HFI_PROP_MAX_B_FRAMES			0x03000147
+
+#define HFI_PROP_QUALITY_MODE			0x03000148
+
+enum hfi_seq_header_mode {
+	HFI_SEQ_HEADER_SEPERATE_FRAME		= 0x00000001,
+	HFI_SEQ_HEADER_JOINED_WITH_1ST_FRAME	= 0x00000002,
+	HFI_SEQ_HEADER_PREFIX_WITH_SYNC_FRAME	= 0x00000004,
+	HFI_SEQ_HEADER_METADATA			= 0x00000008,
+};
+
+#define HFI_PROP_SEQ_HEADER_MODE		0x03000149
+
+enum hfi_rotation {
+	HFI_ROTATION_NONE	= 0x00000000,
+	HFI_ROTATION_90		= 0x00000001,
+	HFI_ROTATION_180	= 0x00000002,
+	HFI_ROTATION_270	= 0x00000003,
+};
+
+#define HFI_PROP_ROTATION			0x0300014b
+
+enum hfi_flip {
+	HFI_DISABLE_FLIP	= 0x00000000,
+	HFI_HORIZONTAL_FLIP	= 0x00000001,
+	HFI_VERTICAL_FLIP	= 0x00000002,
+};
+
+#define HFI_PROP_FLIP				0x0300014c
+
+enum hfi_color_primaries {
+	HFI_PRIMARIES_RESERVED		= 0,
+	HFI_PRIMARIES_BT709		= 1,
+	HFI_PRIMARIES_UNSPECIFIED	= 2,
+	HFI_PRIMARIES_BT470_SYSTEM_M	= 4,
+	HFI_PRIMARIES_BT470_SYSTEM_BG	= 5,
+	HFI_PRIMARIES_BT601_525		= 6,
+	HFI_PRIMARIES_SMPTE_ST240M	= 7,
+	HFI_PRIMARIES_GENERIC_FILM	= 8,
+	HFI_PRIMARIES_BT2020		= 9,
+	HFI_PRIMARIES_SMPTE_ST428_1	= 10,
+	HFI_PRIMARIES_SMPTE_RP431_2	= 11,
+	HFI_PRIMARIES_SMPTE_EG431_1	= 12,
+	HFI_PRIMARIES_SMPTE_EBU_TECH	= 22,
+};
+
+enum hfi_transfer_characteristics {
+	HFI_TRANSFER_RESERVED		= 0,
+	HFI_TRANSFER_BT709		= 1,
+	HFI_TRANSFER_UNSPECIFIED	= 2,
+	HFI_TRANSFER_BT470_SYSTEM_M	= 4,
+	HFI_TRANSFER_BT470_SYSTEM_BG	= 5,
+	HFI_TRANSFER_BT601_525_OR_625	= 6,
+	HFI_TRANSFER_SMPTE_ST240M	= 7,
+	HFI_TRANSFER_LINEAR		= 8,
+	HFI_TRANSFER_LOG_100_1		= 9,
+	HFI_TRANSFER_LOG_SQRT		= 10,
+	HFI_TRANSFER_XVYCC		= 11,
+	HFI_TRANSFER_BT1361_0		= 12,
+	HFI_TRANSFER_SRGB_SYCC		= 13,
+	HFI_TRANSFER_BT2020_14		= 14,
+	HFI_TRANSFER_BT2020_15		= 15,
+	HFI_TRANSFER_SMPTE_ST2084_PQ	= 16,
+	HFI_TRANSFER_SMPTE_ST428_1	= 17,
+	HFI_TRANSFER_BT2100_2_HLG	= 18,
+};
+
+enum hfi_matrix_coefficients {
+	HFI_MATRIX_COEFF_SRGB_SMPTE_ST428_1		= 0,
+	HFI_MATRIX_COEFF_BT709				= 1,
+	HFI_MATRIX_COEFF_UNSPECIFIED			= 2,
+	HFI_MATRIX_COEFF_RESERVED			= 3,
+	HFI_MATRIX_COEFF_FCC_TITLE_47			= 4,
+	HFI_MATRIX_COEFF_BT470_SYS_BG_OR_BT601_625	= 5,
+	HFI_MATRIX_COEFF_BT601_525_BT1358_525_OR_625	= 6,
+	HFI_MATRIX_COEFF_SMPTE_ST240			= 7,
+	HFI_MATRIX_COEFF_YCGCO				= 8,
+	HFI_MATRIX_COEFF_BT2020_NON_CONSTANT		= 9,
+	HFI_MATRIX_COEFF_BT2020_CONSTANT		= 10,
+	HFI_MATRIX_COEFF_SMPTE_ST2085			= 11,
+	HFI_MATRIX_COEFF_SMPTE_CHROM_DERV_NON_CONSTANT	= 12,
+	HFI_MATRIX_COEFF_SMPTE_CHROM_DERV_CONSTANT	= 13,
+	HFI_MATRIX_COEFF_BT2100				= 14,
+};
+
+#define HFI_PROP_SIGNAL_COLOR_INFO		0x03000155
+
+#define HFI_PROP_DECODE_ORDER_OUTPUT		0x0300015b
+
+enum hfi_picture_type {
+	HFI_PICTURE_IDR	= 0x00000001,
+	HFI_PICTURE_P	= 0x00000002,
+	HFI_PICTURE_B	= 0x00000004,
+	HFI_PICTURE_I	= 0x00000008,
+	HFI_PICTURE_CRA	= 0x00000010,
+	HFI_PICTURE_BLA	= 0x00000020,
+};
+
+#define HFI_PROP_PICTURE_TYPE			0x03000162
+
+#define HFI_PROP_DEC_DEFAULT_HEADER		0x03000168
+
+#define HFI_PROP_DEC_START_FROM_RAP_FRAME	0x03000169
+
+#define HFI_PROP_NO_OUTPUT			0x0300016a
+
+#define HFI_PROP_BUFFER_MARK			0x0300016c
+
+#define HFI_PROP_RAW_RESOLUTION			0x03000178
+
+#define HFI_PROP_DPB_LIST			0x0300017A
+
+#define HFI_PROP_TOTAL_PEAK_BITRATE		0x0300017C
+
+#define HFI_PROP_MAINTAIN_MIN_QUALITY		0x0300017D
+
+#define HFI_PROP_IR_CYCLIC_PERIOD		0x0300017E
+
+#define HFI_PROP_UBWC_STRIDE_SCANLINE		0x03000190
+
+#define HFI_PROP_COMV_BUFFER_COUNT		0x03000193
+
+#define HFI_PROP_END				0x03FFFFFF
+
+#define HFI_SESSION_ERROR_BEGIN			0x04000000
+
+#define HFI_ERROR_UNKNOWN_SESSION		0x04000001
+
+#define HFI_ERROR_MAX_SESSIONS			0x04000002
+
+#define HFI_ERROR_FATAL				0x04000003
+
+#define HFI_ERROR_INVALID_STATE			0x04000004
+
+#define HFI_ERROR_INSUFFICIENT_RESOURCES	0x04000005
+
+#define HFI_ERROR_BUFFER_NOT_SET		0x04000006
+
+#define HFI_SESSION_ERROR_END			0x04FFFFFF
+
+#define HFI_SYSTEM_ERROR_BEGIN			0x05000000
+
+#define HFI_SYS_ERROR_WD_TIMEOUT		0x05000001
+
+#define HFI_SYSTEM_ERROR_END			0x05FFFFFF
+
+#define HFI_INFORMATION_BEGIN			0x06000000
+
+#define HFI_INFO_UNSUPPORTED			0x06000001
+
+#define HFI_INFO_DATA_CORRUPT			0x06000002
+
+#define HFI_INFO_BUFFER_OVERFLOW		0x06000004
+
+#define HFI_INFO_HFI_FLAG_DRAIN_LAST		0x06000006
+
+#define HFI_INFO_HFI_FLAG_PSC_LAST		0x06000007
+
+#define HFI_INFORMATION_END			0x06FFFFFF
+
+struct hfi_debug_header {
+	u32 size;
+	u32 debug_level;
+	u32 reserved[2];
+};
+
+enum hfi_buffer_type {
+	HFI_BUFFER_BITSTREAM		= 0x00000001,
+	HFI_BUFFER_RAW			= 0x00000002,
+	HFI_BUFFER_METADATA		= 0x00000003,
+	HFI_BUFFER_SUBCACHE		= 0x00000004,
+	HFI_BUFFER_PARTIAL_DATA		= 0x00000005,
+	HFI_BUFFER_DPB			= 0x00000006,
+	HFI_BUFFER_BIN			= 0x00000007,
+	HFI_BUFFER_LINE			= 0x00000008,
+	HFI_BUFFER_ARP			= 0x00000009,
+	HFI_BUFFER_COMV			= 0x0000000A,
+	HFI_BUFFER_NON_COMV		= 0x0000000B,
+	HFI_BUFFER_PERSIST		= 0x0000000C,
+	HFI_BUFFER_VPSS			= 0x0000000D,
+};
+
+enum hfi_buffer_host_flags {
+	HFI_BUF_HOST_FLAG_NONE			= 0x00000000,
+	HFI_BUF_HOST_FLAG_RELEASE		= 0x00000001,
+	HFI_BUF_HOST_FLAG_READONLY		= 0x00000010,
+	HFI_BUF_HOST_FLAG_CODEC_CONFIG		= 0x00000100,
+	HFI_BUF_HOST_FLAGS_CB_NON_SECURE	= 0x00000200,
+};
+
+enum hfi_buffer_firmware_flags {
+	HFI_BUF_FW_FLAG_NONE		= 0x00000000,
+	HFI_BUF_FW_FLAG_RELEASE_DONE	= 0x00000001,
+	HFI_BUF_FW_FLAG_READONLY	= 0x00000010,
+	HFI_BUF_FW_FLAG_LAST		= 0x10000000,
+	HFI_BUF_FW_FLAG_PSC_LAST	= 0x20000000,
+};
+
+enum hfi_hevc_profile_type {
+	HFI_H265_PROFILE_MAIN			= 0,
+	HFI_H265_PROFILE_MAIN_STILL_PICTURE	= 1,
+	HFI_H265_PROFILE_MAIN_10		= 2,
+	HFI_H265_PROFILE_MAIN_10_STILL_PICTURE	= 3,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_buffer.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_buffer.c
@@ -0,0 +1,863 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_buffer.h"
+#include "iris_helpers.h"
+#include "iris_hfi.h"
+#include "hfi_defines.h"
+#include "iris_hfi_packet.h"
+#include "iris_instance.h"
+#include "memory.h"
+#include "vpu_iris3_buffer.h"
+
+static const u32 dec_ip_int_buf_type[] = {
+	BUF_BIN,
+	BUF_COMV,
+	BUF_NON_COMV,
+	BUF_LINE,
+};
+
+static const u32 dec_op_int_buf_type[] = {
+	BUF_DPB,
+};
+
+static const u32 enc_ip_int_buf_type[] = {
+	BUF_VPSS,
+};
+
+static const u32 enc_op_int_buf_type[] = {
+	BUF_BIN,
+	BUF_COMV,
+	BUF_NON_COMV,
+	BUF_LINE,
+	BUF_DPB,
+};
+
+static u32 video_buffer_size(u32 colorformat,
+			     u32 pix_width,
+			     u32 pix_height)
+{
+	u32 size = 0;
+	u32 y_plane, uv_plane, y_stride,
+		uv_stride, y_sclines, uv_sclines;
+	u32 y_ubwc_plane = 0, uv_ubwc_plane = 0;
+	u32 y_meta_stride = 0, y_meta_scanlines = 0;
+	u32 uv_meta_stride = 0, uv_meta_scanlines = 0;
+	u32 y_meta_plane = 0, uv_meta_plane = 0;
+
+	if (!pix_width || !pix_height)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case V4L2_PIX_FMT_NV12:
+		y_stride = ALIGN(pix_width, 128);
+		uv_stride = ALIGN(pix_width, 128);
+		y_sclines = ALIGN(pix_height, 32);
+		uv_sclines = ALIGN((pix_height + 1) >> 1, 16);
+		y_plane = y_stride * y_sclines;
+		uv_plane = uv_stride * uv_sclines;
+		size = y_plane + uv_plane;
+		break;
+	case V4L2_PIX_FMT_QC08C:
+		y_stride = ALIGN(pix_width, 128);
+		uv_stride = ALIGN(pix_width, 128);
+		y_sclines = ALIGN(pix_height, 32);
+		uv_sclines = ALIGN((pix_height + 1) >> 1, 32);
+		y_meta_stride = ALIGN(DIV_ROUND_UP(pix_width, 32), 64);
+		uv_meta_stride = ALIGN(DIV_ROUND_UP((pix_width + 1) >> 1, 16), 64);
+		y_ubwc_plane =
+			ALIGN(y_stride * y_sclines, 4096);
+		uv_ubwc_plane =
+			ALIGN(uv_stride * uv_sclines, 4096);
+		y_meta_scanlines =
+			ALIGN(DIV_ROUND_UP(pix_height, 8), 16);
+		y_meta_plane =
+			ALIGN(y_meta_stride * y_meta_scanlines, 4096);
+		uv_meta_scanlines =
+			ALIGN(DIV_ROUND_UP((pix_height + 1) >> 1, 8), 16);
+		uv_meta_plane =
+			ALIGN(uv_meta_stride * uv_meta_scanlines, 4096);
+		size = (y_ubwc_plane + uv_ubwc_plane + y_meta_plane +
+			uv_meta_plane);
+		break;
+	case V4L2_PIX_FMT_QC10C:
+		y_stride =
+			ALIGN(ALIGN(pix_width, 192) * 4 / 3, 256);
+		uv_stride =
+			ALIGN(ALIGN(pix_width, 192) * 4 / 3, 256);
+		y_sclines =
+			ALIGN(pix_height, 16);
+		uv_sclines =
+			ALIGN((pix_height + 1) >> 1, 16);
+		y_ubwc_plane =
+			ALIGN(y_stride * y_sclines, 4096);
+		uv_ubwc_plane =
+			ALIGN(uv_stride * uv_sclines, 4096);
+		y_meta_stride =
+			ALIGN(DIV_ROUND_UP(pix_width, 48), 64);
+		y_meta_scanlines =
+			ALIGN(DIV_ROUND_UP(pix_height, 4), 16);
+		y_meta_plane =
+			ALIGN(y_meta_stride * y_meta_scanlines, 4096);
+		uv_meta_stride =
+			ALIGN(DIV_ROUND_UP((pix_width + 1) >> 1, 24), 64);
+		uv_meta_scanlines =
+			ALIGN(DIV_ROUND_UP((pix_height + 1) >> 1, 4), 16);
+		uv_meta_plane =
+			ALIGN(uv_meta_stride * uv_meta_scanlines, 4096);
+
+		size = y_ubwc_plane + uv_ubwc_plane + y_meta_plane +
+			uv_meta_plane;
+		break;
+	default:
+		break;
+	}
+
+invalid_input:
+
+	return ALIGN(size, 4096);
+}
+
+static int input_min_count(struct iris_inst *inst)
+{
+	u32 input_min_count = 0;
+	u32 total_hb_layer = 0;
+
+	if (inst->domain == DECODER) {
+		input_min_count = MIN_BUFFERS;
+	} else if (inst->domain == ENCODER) {
+		total_hb_layer = is_hierb_type_requested(inst) ?
+			inst->cap[ENH_LAYER_COUNT].value + 1 : 0;
+		if (inst->codec == H264 &&
+		    !inst->cap[LAYER_ENABLE].value) {
+			total_hb_layer = 0;
+		}
+		input_min_count =
+			hfi_iris3_enc_min_input_buf_count(total_hb_layer);
+	} else {
+		return 0;
+	}
+
+	return input_min_count;
+}
+
+static int output_min_count(struct iris_inst *inst)
+{
+	int output_min_count;
+
+	if (inst->domain != DECODER && inst->domain != ENCODER)
+		return 0;
+
+	if (inst->domain == ENCODER)
+		return MIN_BUFFERS;
+
+	/* fw_min_count > 0 indicates reconfig event has already arrived */
+	if (inst->fw_min_count) {
+		if (is_split_mode_enabled(inst) && inst->codec == VP9)
+			return min_t(u32, 4, inst->fw_min_count);
+		else
+			return inst->fw_min_count;
+	}
+
+	switch (inst->codec) {
+	case H264:
+	case HEVC:
+		output_min_count = 4;
+		break;
+	case VP9:
+		output_min_count = 9;
+		break;
+	default:
+		output_min_count = 4;
+		break;
+	}
+
+	return output_min_count;
+}
+
+int update_buffer_count(struct iris_inst *inst, u32 plane)
+{
+	switch (plane) {
+	case INPUT_MPLANE:
+		inst->buffers.input.min_count = input_min_count(inst);
+		if (inst->buffers.input.actual_count < inst->buffers.input.min_count)
+			inst->buffers.input.actual_count = inst->buffers.input.min_count;
+
+		break;
+	case OUTPUT_MPLANE:
+		if (!inst->vb2q_src->streaming)
+			inst->buffers.output.min_count = output_min_count(inst);
+		if (inst->buffers.output.actual_count < inst->buffers.output.min_count)
+			inst->buffers.output.actual_count = inst->buffers.output.min_count;
+
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static u32 internal_buffer_count(struct iris_inst *inst,
+				 enum iris_buffer_type buffer_type)
+{
+	u32 count = 0;
+
+	if (inst->domain == ENCODER)
+		return 1;
+
+	if (inst->domain == DECODER) {
+		if (buffer_type == BUF_BIN || buffer_type == BUF_LINE ||
+		    buffer_type == BUF_PERSIST) {
+			count = 1;
+		} else if (buffer_type == BUF_COMV || buffer_type == BUF_NON_COMV) {
+			if (inst->codec == H264 || inst->codec == HEVC)
+				count = 1;
+			else
+				count = 0;
+		} else {
+			count = 0;
+		}
+	}
+
+	return count;
+}
+
+static int dpb_count(struct iris_inst *inst)
+{
+	int count = 0;
+
+	if (inst->domain == ENCODER)
+		return get_recon_buf_count(inst);
+
+	if (is_split_mode_enabled(inst)) {
+		count = inst->fw_min_count ?
+			inst->fw_min_count : inst->buffers.output.min_count;
+	}
+
+	return count;
+}
+
+int iris_get_buf_min_count(struct iris_inst *inst,
+			   enum iris_buffer_type buffer_type)
+{
+	switch (buffer_type) {
+	case BUF_INPUT:
+		return input_min_count(inst);
+	case BUF_OUTPUT:
+		return output_min_count(inst);
+	case BUF_BIN:
+	case BUF_COMV:
+	case BUF_NON_COMV:
+	case BUF_LINE:
+	case BUF_PERSIST:
+	case BUF_ARP:
+		return internal_buffer_count(inst, buffer_type);
+	case BUF_DPB:
+		return dpb_count(inst);
+	default:
+		return 0;
+	}
+}
+
+static u32 dec_input_buffer_size(struct iris_inst *inst)
+{
+	u32 base_res_mbs = NUM_MBS_4k;
+	u32 frame_size, num_mbs;
+	struct v4l2_format *f;
+	u32 div_factor = 1;
+	u32 codec;
+
+	f = inst->fmt_src;
+	codec = f->fmt.pix_mp.pixelformat;
+
+	num_mbs = get_mbpf(inst);
+	if (num_mbs > NUM_MBS_4k) {
+		div_factor = 4;
+		base_res_mbs = inst->cap[MBPF].value;
+	} else {
+		base_res_mbs = NUM_MBS_4k;
+		if (codec == V4L2_PIX_FMT_VP9)
+			div_factor = 1;
+		else
+			div_factor = 2;
+	}
+
+	frame_size = base_res_mbs * MB_IN_PIXEL * 3 / 2 / div_factor;
+
+	 /* multiply by 10/8 (1.25) to get size for 10 bit case */
+	if (codec == V4L2_PIX_FMT_VP9 || codec == V4L2_PIX_FMT_HEVC)
+		frame_size = frame_size + (frame_size >> 2);
+
+	return ALIGN(frame_size, SZ_4K);
+}
+
+static u32 dec_output_buffer_size(struct iris_inst *inst)
+{
+	struct v4l2_format *f;
+	u32 size;
+
+	f = inst->fmt_dst;
+
+	size = video_buffer_size(f->fmt.pix_mp.pixelformat, f->fmt.pix_mp.width,
+				 f->fmt.pix_mp.height);
+	return size;
+}
+
+static u32 enc_input_buffer_size(struct iris_inst *inst)
+{
+	struct v4l2_format *f;
+	u32 size;
+
+	f = inst->fmt_src;
+
+	size = video_buffer_size(f->fmt.pix_mp.pixelformat, f->fmt.pix_mp.width,
+				 f->fmt.pix_mp.height);
+	return size;
+}
+
+int iris_get_buffer_size(struct iris_inst *inst,
+			 enum iris_buffer_type buffer_type)
+{
+	if (inst->domain == DECODER) {
+		switch (buffer_type) {
+		case BUF_INPUT:
+			return dec_input_buffer_size(inst);
+		case BUF_OUTPUT:
+			return dec_output_buffer_size(inst);
+		default:
+			break;
+		}
+	} else if (inst->domain == ENCODER) {
+		switch (buffer_type) {
+		case BUF_INPUT:
+			return enc_input_buffer_size(inst);
+		case BUF_OUTPUT:
+			return enc_output_buffer_size_iris3(inst);
+		default:
+			break;
+		}
+	}
+
+	return 0;
+}
+
+struct iris_buffers *iris_get_buffer_list(struct iris_inst *inst,
+					  enum iris_buffer_type buffer_type)
+{
+	switch (buffer_type) {
+	case BUF_INPUT:
+		return &inst->buffers.input;
+	case BUF_OUTPUT:
+		return &inst->buffers.output;
+	case BUF_READ_ONLY:
+		return &inst->buffers.read_only;
+	case BUF_BIN:
+		return &inst->buffers.bin;
+	case BUF_ARP:
+		return &inst->buffers.arp;
+	case BUF_COMV:
+		return &inst->buffers.comv;
+	case BUF_NON_COMV:
+		return &inst->buffers.non_comv;
+	case BUF_LINE:
+		return &inst->buffers.line;
+	case BUF_DPB:
+		return &inst->buffers.dpb;
+	case BUF_PERSIST:
+		return &inst->buffers.persist;
+	case BUF_VPSS:
+		return &inst->buffers.vpss;
+	default:
+		return NULL;
+	}
+}
+
+int iris_allocate_buffers(struct iris_inst *inst,
+			  enum iris_buffer_type buf_type,
+			  u32 num_buffers)
+{
+	struct iris_buffer *buf = NULL;
+	struct iris_buffers *buffers;
+	int idx = 0;
+
+	buffers = iris_get_buffer_list(inst, buf_type);
+	if (!buffers)
+		return -EINVAL;
+
+	for (idx = 0; idx < num_buffers; idx++) {
+		buf = iris_get_buffer_from_pool(inst);
+		if (!buf)
+			return -EINVAL;
+
+		INIT_LIST_HEAD(&buf->list);
+		list_add_tail(&buf->list, &buffers->list);
+		buf->type = buf_type;
+		buf->index = idx;
+	}
+
+	return 0;
+}
+
+int iris_free_buffers(struct iris_inst *inst,
+		      enum iris_buffer_type buf_type)
+{
+	struct iris_buffer *buf, *dummy;
+	struct iris_buffers *buffers;
+
+	buffers = iris_get_buffer_list(inst, buf_type);
+	if (!buffers)
+		return -EINVAL;
+
+	list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+		list_del_init(&buf->list);
+		iris_return_buffer_to_pool(inst, buf);
+	}
+
+	return 0;
+}
+
+static int iris_get_internal_buf_info(struct iris_inst *inst,
+				      enum iris_buffer_type buffer_type)
+{
+	struct iris_buffers *buffers;
+	struct iris_core *core;
+	u32 buf_count;
+	u32 buf_size;
+
+	core = inst->core;
+
+	buf_size = call_session_op(core, int_buf_size,
+				   inst, buffer_type);
+
+	buf_count = iris_get_buf_min_count(inst, buffer_type);
+
+	buffers = iris_get_buffer_list(inst, buffer_type);
+	if (!buffers)
+		return -EINVAL;
+
+	if (buf_size && buf_size <= buffers->size &&
+	    buf_count && buf_count <= buffers->min_count) {
+		buffers->reuse = true;
+	} else {
+		buffers->reuse = false;
+		buffers->size = buf_size;
+		buffers->min_count = buf_count;
+	}
+
+	return 0;
+}
+
+int iris_get_internal_buffers(struct iris_inst *inst,
+			      u32 plane)
+{
+	int ret = 0;
+	u32 i = 0;
+
+	if (inst->domain == DECODER) {
+		if (plane == INPUT_MPLANE) {
+			for (i = 0; i < ARRAY_SIZE(dec_ip_int_buf_type); i++) {
+				ret = iris_get_internal_buf_info(inst, dec_ip_int_buf_type[i]);
+				if (ret)
+					return ret;
+			}
+		} else {
+			return iris_get_internal_buf_info(inst, BUF_DPB);
+		}
+	} else if (inst->domain == ENCODER) {
+		if (plane == INPUT_MPLANE) {
+			for (i = 0; i < ARRAY_SIZE(enc_ip_int_buf_type); i++) {
+				ret = iris_get_internal_buf_info(inst, enc_ip_int_buf_type[i]);
+				if (ret)
+					return ret;
+			}
+		} else {
+			for (i = 0; i < ARRAY_SIZE(enc_op_int_buf_type); i++) {
+				ret = iris_get_internal_buf_info(inst, enc_op_int_buf_type[i]);
+				if (ret)
+					return ret;
+			}
+		}
+	}
+
+	return ret;
+}
+
+static int iris_create_internal_buffer(struct iris_inst *inst,
+				       enum iris_buffer_type buffer_type, u32 index)
+{
+	struct iris_buffers *buffers;
+	struct iris_buffer *buffer;
+	struct iris_core *core;
+
+	core = inst->core;
+
+	buffers = iris_get_buffer_list(inst, buffer_type);
+	if (!buffers)
+		return -EINVAL;
+
+	if (!buffers->size)
+		return 0;
+
+	buffer = iris_get_buffer_from_pool(inst);
+	if (!buffer)
+		return -ENOMEM;
+
+	INIT_LIST_HEAD(&buffer->list);
+	buffer->type = buffer_type;
+	buffer->index = index;
+	buffer->buffer_size = buffers->size;
+	buffer->dma_attrs = DMA_ATTR_WRITE_COMBINE | DMA_ATTR_NO_KERNEL_MAPPING;
+	list_add_tail(&buffer->list, &buffers->list);
+
+	buffer->kvaddr = dma_alloc_attrs(core->dev, buffer->buffer_size,
+					 &buffer->device_addr, GFP_KERNEL, buffer->dma_attrs);
+
+	if (!buffer->kvaddr)
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int iris_create_internal_buffers(struct iris_inst *inst,
+					enum iris_buffer_type buffer_type)
+{
+	struct iris_buffers *buffers;
+	int ret = 0;
+	int i;
+
+	buffers = iris_get_buffer_list(inst, buffer_type);
+	if (!buffers)
+		return -EINVAL;
+
+	if (buffers->reuse)
+		return 0;
+
+	for (i = 0; i < buffers->min_count; i++) {
+		ret = iris_create_internal_buffer(inst, buffer_type, i);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+int iris_create_input_internal_buffers(struct iris_inst *inst)
+{
+	int ret = 0;
+	u32 i = 0;
+
+	if (inst->domain == DECODER) {
+		for (i = 0; i < ARRAY_SIZE(dec_ip_int_buf_type); i++) {
+			ret = iris_create_internal_buffers(inst, dec_ip_int_buf_type[i]);
+			if (ret)
+				return ret;
+		}
+	} else if (inst->domain == ENCODER) {
+		for (i = 0; i < ARRAY_SIZE(enc_ip_int_buf_type); i++) {
+			ret = iris_create_internal_buffers(inst, enc_ip_int_buf_type[i]);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+int iris_create_output_internal_buffers(struct iris_inst *inst)
+{
+	int ret = 0;
+	u32 i = 0;
+
+	if (inst->domain == DECODER) {
+		return iris_create_internal_buffers(inst, BUF_DPB);
+	} else if (inst->domain == ENCODER) {
+		for (i = 0; i < ARRAY_SIZE(enc_op_int_buf_type); i++) {
+			ret = iris_create_internal_buffers(inst, enc_op_int_buf_type[i]);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+static int set_num_comv(struct iris_inst *inst)
+{
+	u32 num_comv;
+
+	num_comv = inst->cap[NUM_COMV].value;
+
+	return iris_hfi_set_property(inst,
+					HFI_PROP_COMV_BUFFER_COUNT,
+					HFI_HOST_FLAGS_NONE,
+					HFI_PORT_BITSTREAM,
+					HFI_PAYLOAD_U32,
+					&num_comv,
+					sizeof(u32));
+}
+
+static int iris_queue_internal_buffers(struct iris_inst *inst,
+				       enum iris_buffer_type buffer_type)
+{
+	struct iris_buffer *buffer, *dummy;
+	struct iris_buffers *buffers;
+	int ret = 0;
+
+	if (inst->domain == DECODER && buffer_type == BUF_COMV) {
+		ret = set_num_comv(inst);
+		if (ret)
+			return ret;
+	}
+
+	buffers = iris_get_buffer_list(inst, buffer_type);
+	if (!buffers)
+		return -EINVAL;
+
+	list_for_each_entry_safe(buffer, dummy, &buffers->list, list) {
+		if (buffer->attr & BUF_ATTR_PENDING_RELEASE)
+			continue;
+		if (buffer->attr & BUF_ATTR_QUEUED)
+			continue;
+		ret = iris_hfi_queue_buffer(inst, buffer);
+		if (ret)
+			return ret;
+		buffer->attr |= BUF_ATTR_QUEUED;
+	}
+
+	return ret;
+}
+
+int iris_queue_input_internal_buffers(struct iris_inst *inst)
+{
+	int ret = 0;
+	u32 i;
+
+	if (inst->domain == DECODER) {
+		for (i = 0; i < ARRAY_SIZE(dec_ip_int_buf_type); i++) {
+			ret = iris_queue_internal_buffers(inst, dec_ip_int_buf_type[i]);
+			if (ret)
+				return ret;
+		}
+	} else if (inst->domain == ENCODER) {
+		for (i = 0; i < ARRAY_SIZE(enc_ip_int_buf_type); i++) {
+			ret = iris_queue_internal_buffers(inst, enc_ip_int_buf_type[i]);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+int iris_queue_output_internal_buffers(struct iris_inst *inst)
+{
+	int ret = 0;
+	u32 i = 0;
+
+	if (inst->domain == DECODER) {
+		return iris_queue_internal_buffers(inst, BUF_DPB);
+	} else if (inst->domain == ENCODER) {
+		for (i = 0; i < ARRAY_SIZE(enc_op_int_buf_type); i++) {
+			ret = iris_queue_internal_buffers(inst, enc_op_int_buf_type[i]);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+int iris_destroy_internal_buffer(struct iris_inst *inst,
+				 struct iris_buffer *buffer)
+{
+	struct iris_buffer *buf, *dummy;
+	struct iris_buffers *buffers;
+	struct iris_core *core;
+
+	core = inst->core;
+
+	buffers = iris_get_buffer_list(inst, buffer->type);
+	if (!buffers)
+		return -EINVAL;
+
+	list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+		if (buf->device_addr == buffer->device_addr) {
+			list_del(&buf->list);
+			dma_free_attrs(core->dev, buf->buffer_size, buf->kvaddr,
+				       buf->device_addr, buf->dma_attrs);
+			buf->kvaddr = NULL;
+			buf->device_addr = 0;
+			iris_return_buffer_to_pool(inst, buf);
+			break;
+		}
+	}
+
+	return 0;
+}
+
+int iris_destroy_internal_buffers(struct iris_inst *inst,
+				  u32 plane)
+{
+	struct iris_buffer *buf, *dummy;
+	struct iris_buffers *buffers;
+	const u32 *internal_buf_type = NULL;
+	int ret = 0;
+	u32 i, len = 0;
+
+	if (inst->domain == DECODER) {
+		if (plane == INPUT_MPLANE) {
+			internal_buf_type = dec_ip_int_buf_type;
+			len = ARRAY_SIZE(dec_ip_int_buf_type);
+		} else {
+			internal_buf_type = dec_op_int_buf_type;
+			len = ARRAY_SIZE(dec_op_int_buf_type);
+		}
+	} else if (inst->domain == ENCODER) {
+		if (plane == INPUT_MPLANE) {
+			internal_buf_type = enc_ip_int_buf_type;
+			len = ARRAY_SIZE(enc_ip_int_buf_type);
+		} else {
+			internal_buf_type = enc_op_int_buf_type;
+			len = ARRAY_SIZE(enc_op_int_buf_type);
+		}
+	}
+
+	for (i = 0; i < len; i++) {
+		buffers = iris_get_buffer_list(inst, internal_buf_type[i]);
+		if (!buffers)
+			return -EINVAL;
+
+		if (buffers->reuse)
+			continue;
+
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+			ret = iris_destroy_internal_buffer(inst, buf);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+static int iris_release_internal_buffers(struct iris_inst *inst,
+					 enum iris_buffer_type buffer_type)
+{
+	struct iris_buffer *buffer, *dummy;
+	struct iris_buffers *buffers;
+	int ret = 0;
+
+	buffers = iris_get_buffer_list(inst, buffer_type);
+	if (!buffers)
+		return -EINVAL;
+
+	if (buffers->reuse)
+		return 0;
+
+	list_for_each_entry_safe(buffer, dummy, &buffers->list, list) {
+		if (buffer->attr & BUF_ATTR_PENDING_RELEASE)
+			continue;
+		if (!(buffer->attr & BUF_ATTR_QUEUED))
+			continue;
+		ret = iris_hfi_release_buffer(inst, buffer);
+		if (ret)
+			return ret;
+		buffer->attr |= BUF_ATTR_PENDING_RELEASE;
+	}
+
+	return ret;
+}
+
+static int iris_release_input_internal_buffers(struct iris_inst *inst)
+{
+	int ret = 0;
+	u32 i = 0;
+
+	if (inst->domain == DECODER) {
+		for (i = 0; i < ARRAY_SIZE(dec_ip_int_buf_type); i++) {
+			ret = iris_release_internal_buffers(inst, dec_ip_int_buf_type[i]);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+int iris_alloc_and_queue_session_int_bufs(struct iris_inst *inst,
+					  enum iris_buffer_type buffer_type)
+{
+	int ret;
+
+	if (buffer_type != BUF_ARP && buffer_type != BUF_PERSIST)
+		return -EINVAL;
+
+	ret = iris_get_internal_buf_info(inst, buffer_type);
+	if (ret)
+		return ret;
+
+	ret = iris_create_internal_buffers(inst, buffer_type);
+	if (ret)
+		return ret;
+
+	ret = iris_queue_internal_buffers(inst, buffer_type);
+
+	return ret;
+}
+
+int iris_alloc_and_queue_input_int_bufs(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = iris_get_internal_buffers(inst, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = iris_release_input_internal_buffers(inst);
+	if (ret)
+		return ret;
+
+	ret = iris_create_input_internal_buffers(inst);
+	if (ret)
+		return ret;
+
+	ret = iris_queue_input_internal_buffers(inst);
+
+	return ret;
+}
+
+int iris_alloc_and_queue_additional_dpb_buffers(struct iris_inst *inst)
+{
+	struct iris_buffers *buffers;
+	struct iris_buffer *buffer;
+	int cur_min_count = 0;
+	int ret;
+	int i;
+
+	ret = iris_get_internal_buf_info(inst, BUF_DPB);
+	if (ret)
+		return ret;
+
+	buffers = iris_get_buffer_list(inst, BUF_DPB);
+	if (!buffers)
+		return -EINVAL;
+
+	list_for_each_entry(buffer, &buffers->list, list)
+		cur_min_count++;
+
+	if (cur_min_count >= buffers->min_count)
+		return 0;
+
+	for (i = cur_min_count; i < buffers->min_count; i++) {
+		ret = iris_create_internal_buffers(inst, BUF_DPB);
+		if (ret)
+			return ret;
+	}
+
+	ret = iris_queue_internal_buffers(inst, BUF_DPB);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_buffer.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_buffer.h
@@ -0,0 +1,65 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_BUFFER_H_
+#define _IRIS_BUFFER_H_
+
+#define MIN_BUFFERS  4
+
+#include "iris_common.h"
+
+struct iris_inst;
+
+struct iris_buffers {
+	struct list_head	list; // list of "struct iris_buffer"
+	u32			min_count;
+	u32			actual_count;
+	u32			size;
+	bool			reuse;
+};
+
+struct iris_buffers_info {
+	struct iris_buffers	input;
+	struct iris_buffers	output;
+	struct iris_buffers	read_only;
+	struct iris_buffers	bin;
+	struct iris_buffers	arp;
+	struct iris_buffers	comv;
+	struct iris_buffers	non_comv;
+	struct iris_buffers	line;
+	struct iris_buffers	dpb;
+	struct iris_buffers	persist;
+	struct iris_buffers	vpss;
+};
+
+int update_buffer_count(struct iris_inst *inst, u32 plane);
+int iris_get_buf_min_count(struct iris_inst *inst,
+			   enum iris_buffer_type buffer_type);
+int iris_get_buffer_size(struct iris_inst *inst,
+			 enum iris_buffer_type buffer_type);
+struct iris_buffers *iris_get_buffer_list(struct iris_inst *inst,
+					  enum iris_buffer_type buffer_type);
+int iris_allocate_buffers(struct iris_inst *inst,
+			  enum iris_buffer_type buf_type,
+			  u32 num_buffers);
+int iris_free_buffers(struct iris_inst *inst,
+		      enum iris_buffer_type buf_type);
+
+int iris_get_internal_buffers(struct iris_inst *inst,
+			      u32 plane);
+int iris_create_input_internal_buffers(struct iris_inst *inst);
+int iris_create_output_internal_buffers(struct iris_inst *inst);
+int iris_queue_input_internal_buffers(struct iris_inst *inst);
+int iris_queue_output_internal_buffers(struct iris_inst *inst);
+int iris_destroy_internal_buffer(struct iris_inst *inst,
+				 struct iris_buffer *buffer);
+int iris_destroy_internal_buffers(struct iris_inst *inst,
+				  u32 plane);
+int iris_alloc_and_queue_session_int_bufs(struct iris_inst *inst,
+					  enum iris_buffer_type buffer_type);
+int iris_alloc_and_queue_input_int_bufs(struct iris_inst *inst);
+int iris_alloc_and_queue_additional_dpb_buffers(struct iris_inst *inst);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_common.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_common.h
@@ -0,0 +1,148 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _IRIS_COMMON_H_
+#define _IRIS_COMMON_H_
+
+#include <media/v4l2-dev.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-event.h>
+#include <media/videobuf2-v4l2.h>
+
+struct iris_inst;
+
+#define INPUT_MPLANE V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE
+#define OUTPUT_MPLANE V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE
+#define DEFAULT_WIDTH 320
+#define DEFAULT_HEIGHT 240
+#define DEFAULT_BSE_VPP_DELAY    2
+#define IRIS_VERSION_LENGTH   128
+
+#define MAX_EVENTS   30
+
+#define MB_IN_PIXEL (16 * 16)
+
+#define NUM_MBS_4k (((4096 + 15) >> 4) * ((2304 + 15) >> 4))
+
+#define MAX_DPB_COUNT 32
+
+#define MAX_DPB_LIST_ARRAY_SIZE (16 * 4)
+#define MAX_DPB_LIST_PAYLOAD_SIZE (16 * 4 * 4)
+
+#define INPUT_TIMER_LIST_SIZE 30
+
+#define CABAC_MAX_BITRATE 160000000
+
+#define CAVLC_MAX_BITRATE 220000000
+
+enum domain_type {
+	ENCODER	= BIT(0),
+	DECODER	= BIT(1),
+};
+
+enum codec_type {
+	H264	= BIT(0),
+	HEVC	= BIT(1),
+	VP9	= BIT(2),
+};
+
+enum colorformat_type {
+	FMT_NONE	= 0,
+	FMT_NV12C	= BIT(0),
+	FMT_NV12	= BIT(1),
+	FMT_TP10C	= BIT(2),
+};
+
+struct rect_desc {
+	u32 left;
+	u32 top;
+	u32 width;
+	u32 height;
+};
+
+enum signal_session_response {
+	SIGNAL_CMD_STOP_INPUT = 0,
+	SIGNAL_CMD_STOP_OUTPUT,
+	SIGNAL_CMD_CLOSE,
+	MAX_SIGNAL,
+};
+
+enum iris_buffer_type {
+	BUF_NONE,
+	BUF_INPUT,
+	BUF_OUTPUT,
+	BUF_READ_ONLY,
+	BUF_BIN,
+	BUF_ARP,
+	BUF_COMV,
+	BUF_NON_COMV,
+	BUF_LINE,
+	BUF_DPB,
+	BUF_PERSIST,
+	BUF_VPSS,
+};
+
+enum iris_buffer_flags {
+	BUF_FLAG_KEYFRAME	= 0x00000008,
+	BUF_FLAG_PFRAME		= 0x00000010,
+	BUF_FLAG_BFRAME		= 0x00000020,
+	BUF_FLAG_ERROR		= 0x00000040,
+	BUF_FLAG_LAST		= 0x00100000,
+};
+
+enum iris_buffer_attributes {
+	BUF_ATTR_DEFERRED		= BIT(0),
+	BUF_ATTR_READ_ONLY		= BIT(1),
+	BUF_ATTR_PENDING_RELEASE	= BIT(2),
+	BUF_ATTR_QUEUED			= BIT(3),
+	BUF_ATTR_DEQUEUED		= BIT(4),
+	BUF_ATTR_BUFFER_DONE		= BIT(5),
+};
+
+struct iris_buffer {
+	struct list_head		list;
+	struct iris_inst		*inst;
+	enum iris_buffer_type		type;
+	u32				index;
+	int				fd;
+	u32				buffer_size;
+	u32				data_offset;
+	u32				data_size;
+	u64				device_addr;
+	void				*kvaddr;
+	unsigned long			dma_attrs;
+	u32				flags;
+	u64				timestamp;
+	enum iris_buffer_attributes	attr;
+	void				*dmabuf;
+	struct sg_table			*sg_table;
+	struct dma_buf_attachment	*attach;
+};
+
+struct subscription_params {
+	u32	bitstream_resolution;
+	u32	crop_offsets[2];
+	u32	bit_depth;
+	u32	coded_frames;
+	u32	fw_min_count;
+	u32	pic_order_cnt;
+	u32	color_info;
+	u32	profile;
+	u32	level;
+	u32	tier;
+};
+
+struct iris_hfi_frame_info {
+	u32	picture_type;
+	u32	no_output;
+	u32	data_corrupt;
+	u32	overflow;
+};
+
+struct iris_input_timer {
+	struct list_head	list;
+	u64			time_us;
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_core.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_core.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+
+#include "iris_core.h"
+#include "iris_helpers.h"
+#include "iris_hfi.h"
+#include "iris_state.h"
+
+int iris_core_deinit_locked(struct iris_core *core)
+{
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return ret;
+
+	if (core->state == IRIS_CORE_DEINIT)
+		return 0;
+
+	iris_hfi_core_deinit(core);
+
+	iris_change_core_state(core, IRIS_CORE_DEINIT);
+
+	return ret;
+}
+
+int iris_core_deinit(struct iris_core *core)
+{
+	int ret;
+
+	mutex_lock(&core->lock);
+	ret = iris_core_deinit_locked(core);
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_core_init(struct iris_core *core)
+{
+	int ret = 0;
+
+	mutex_lock(&core->lock);
+	if (core_in_valid_state(core)) {
+		goto unlock;
+	} else if (core->state == IRIS_CORE_ERROR) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (iris_change_core_state(core, IRIS_CORE_INIT_WAIT))
+		iris_change_core_state(core, IRIS_CORE_ERROR);
+
+	ret = iris_hfi_core_init(core);
+	if (ret) {
+		iris_change_core_state(core, IRIS_CORE_ERROR);
+		dev_err(core->dev, "%s: core init failed\n", __func__);
+		iris_core_deinit_locked(core);
+		goto unlock;
+	}
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_core_init_wait(struct iris_core *core)
+{
+	const int interval = 10;
+	int max_tries, count = 0, ret = 0;
+
+	mutex_lock(&core->lock);
+	if (!core_in_valid_state(core)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (core->state == IRIS_CORE_INIT)
+		goto unlock;
+
+	max_tries = core->cap[HW_RESPONSE_TIMEOUT].value / interval;
+	while (count < max_tries) {
+		if (core->state != IRIS_CORE_INIT_WAIT)
+			break;
+		msleep(interval);
+		count++;
+	}
+
+	if (core->state == IRIS_CORE_INIT) {
+		ret = 0;
+		goto unlock;
+	} else {
+		iris_change_core_state(core, IRIS_CORE_ERROR);
+		iris_core_deinit_locked(core);
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_core.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_core.h
@@ -0,0 +1,127 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_CORE_H_
+#define _IRIS_CORE_H_
+
+#include <linux/types.h>
+#include <media/v4l2-device.h>
+
+#include "iris_hfi_queue.h"
+#include "iris_state.h"
+#include "platform_common.h"
+#include "resources.h"
+#include "vpu_common.h"
+
+/**
+ * struct iris_core - holds core parameters valid for all instances
+ *
+ * @dev: reference to device structure
+ * @reg_base: IO memory base address
+ * @irq: iris irq
+ * @v4l2_dev: a holder for v4l2 device structure
+ * @vdev_dec: iris video device structure for decoder
+ * @vdev_enc: iris video device structure for encoder
+ * @v4l2_file_ops: iris v4l2 file ops
+ * @v4l2_ioctl_ops_dec: iris v4l2 ioctl ops for decoder
+ * @v4l2_ioctl_ops_enc: iris v4l2 ioctl ops for encoder
+ * @bus_tbl: table of iris buses
+ * @bus_count: count of iris buses
+ * @power_domain_tbl: table of iris power domains
+ * @pd_count: count of iris power domains
+ * @clock_tbl: table of iris clocks
+ * @clk_count: count of iris clocks
+ * @reset_tbl: table of iris reset clocks
+ * @reset_count: count of iris reset clocks
+ * @vb2_ops: iris vb2 ops
+ * @vb2_mem_ops: iris vb2 memory ops
+ * @state: current state of core
+ * @iface_q_table: Interface queue table memory
+ * @command_queue: shared interface queue to send commands to firmware
+ * @message_queue: shared interface queue to receive responses from firmware
+ * @debug_queue: shared interface queue to receive debug info from firmware
+ * @sfr: SFR register memory
+ * @lock: a lock for this strucure
+ * @packet: pointer to packet from driver to fw
+ * @packet_size: size of packet
+ * @response_packet: a pointer to response packet from fw to driver
+ * @sys_init_id: id of sys init packet
+ * @header_id: id of packet header
+ * @packet_id: id of packet
+ * @vpu_ops: a pointer to vpu ops
+ * @session_ops: a pointer to session level ops
+ * @enc_codecs_count: supported codec count for encoder
+ * @dec_codecs_count: supported codec count for decoder
+ * @platform_data: a structure for platform data
+ * @cap: an array for supported core capabilities
+ * @inst_caps: a pointer to supported instance capabilities
+ * @instances: a list_head of all instances
+ * @intr_status: interrupt status
+ * @spur_count: counter for spurious interrupt
+ * @reg_count: counter for interrupts
+ * @fw_version: firmware version
+ * @skip_pc_count: a counter to retry power collapse
+ * @power_enabled: a boolean to check if power is on or off
+ * @power: a structure for clock and bw information
+ * @num_pending_requests: a reference counter for calling pm operations
+ */
+
+struct iris_core {
+	struct device				*dev;
+	void __iomem				*reg_base;
+	int					irq;
+	struct v4l2_device			v4l2_dev;
+	struct video_device			*vdev_dec;
+	struct video_device			*vdev_enc;
+	const struct v4l2_file_operations	*v4l2_file_ops;
+	const struct v4l2_ioctl_ops		*v4l2_ioctl_ops_dec;
+	const struct v4l2_ioctl_ops		*v4l2_ioctl_ops_enc;
+	struct bus_info				*bus_tbl;
+	u32					bus_count;
+	struct power_domain_info		*power_domain_tbl;
+	u32					pd_count;
+	struct clock_info			*clock_tbl;
+	u32					clk_count;
+	struct reset_info			*reset_tbl;
+	u32					reset_count;
+	const struct vb2_ops			*vb2_ops;
+	struct vb2_mem_ops			*vb2_mem_ops;
+	enum iris_core_state			state;
+	struct mem_desc				iface_q_table;
+	struct iface_q_info			command_queue;
+	struct iface_q_info			message_queue;
+	struct iface_q_info			debug_queue;
+	struct mem_desc				sfr;
+	struct mutex				lock; /* lock for core structure */
+	u8					*packet;
+	u32					packet_size;
+	u8					*response_packet;
+	u32					sys_init_id;
+	u32					header_id;
+	u32					packet_id;
+	const struct vpu_ops			*vpu_ops;
+	const struct vpu_session_ops		*session_ops;
+	u32					dec_codecs_count;
+	u32					enc_codecs_count;
+	struct platform_data			*platform_data;
+	struct plat_core_cap			cap[CORE_CAP_MAX + 1];
+	struct plat_inst_caps			*inst_caps;
+	struct list_head			instances;
+	u32					intr_status;
+	u32					spur_count;
+	u32					reg_count;
+	char					fw_version[IRIS_VERSION_LENGTH];
+	u32					skip_pc_count;
+	bool					power_enabled;
+	struct iris_core_power			power;
+	s32					num_pending_requests;
+};
+
+int iris_core_init(struct iris_core *core);
+int iris_core_init_wait(struct iris_core *core);
+int iris_core_deinit(struct iris_core *core);
+int iris_core_deinit_locked(struct iris_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_ctrls.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_ctrls.c
@@ -0,0 +1,1793 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/vmalloc.h>
+#include <linux/types.h>
+#include <linux/list.h>
+
+#include "platform_common.h"
+#include "iris_helpers.h"
+#include "iris_hfi_packet.h"
+#include "iris_hfi.h"
+#include "iris_ctrls.h"
+
+#define MIN_CAPTURE_BUFFERS 4
+#define MIN_OUTPUT_BUFFERS 4
+
+static inline bool is_all_childrens_visited(struct plat_inst_cap *cap,
+					    bool lookup[INST_CAP_MAX])
+{
+	bool found = true;
+	int i;
+
+	for (i = 0; i < MAX_NUM_CHILD; i++) {
+		if (cap->children[i] == INST_CAP_NONE)
+			continue;
+
+		if (!lookup[cap->children[i]]) {
+			found = false;
+			break;
+		}
+	}
+
+	return found;
+}
+
+static bool is_valid_cap_id(enum plat_inst_cap_type cap_id)
+{
+	return cap_id > INST_CAP_NONE && cap_id < INST_CAP_MAX;
+}
+
+static enum plat_inst_cap_type get_cap_id(struct iris_inst *inst, u32 id)
+{
+	enum plat_inst_cap_type iter = INST_CAP_NONE;
+	enum plat_inst_cap_type cap_id = INST_CAP_NONE;
+
+	do {
+		if (inst->cap[iter].v4l2_id == id) {
+			cap_id = inst->cap[iter].cap_id;
+			break;
+		}
+		iter++;
+	} while (iter < INST_CAP_MAX);
+
+	return cap_id;
+}
+
+static int add_node_list(struct list_head *list, enum plat_inst_cap_type cap_id)
+{
+	struct cap_entry *entry = NULL;
+
+	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+	if (!entry)
+		return -ENOMEM;
+
+	INIT_LIST_HEAD(&entry->list);
+	entry->cap_id = cap_id;
+	list_add(&entry->list, list);
+
+	return 0;
+}
+
+static int add_children(struct list_head *list,
+			struct iris_inst *inst,
+			enum plat_inst_cap_type cap_id)
+{
+	struct plat_inst_cap *cap;
+	int i, ret = 0;
+
+	cap = &inst->cap[cap_id];
+
+	for (i = 0; i < MAX_NUM_CHILD; i++) {
+		if (!cap->children[i])
+			break;
+
+		if (!is_valid_cap_id(cap->children[i]))
+			continue;
+
+		ret = add_node_list(list, cap->children[i]);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+static int adjust_cap(struct iris_inst *inst,
+		      enum plat_inst_cap_type cap_id,
+		      struct v4l2_ctrl *ctrl)
+{
+	struct plat_inst_cap *cap;
+
+	cap = &inst->cap[cap_id];
+	if (!inst->cap[cap_id].cap_id)
+		return 0;
+
+	if (!cap->adjust) {
+		if (ctrl)
+			inst->cap[cap_id].value = ctrl->val;
+		return 0;
+	}
+
+	return cap->adjust(inst, ctrl);
+}
+
+static int set_cap(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	struct plat_inst_cap *cap;
+
+	cap = &inst->cap[cap_id];
+	if (!inst->cap[cap_id].cap_id)
+		return 0;
+
+	if (!cap->set)
+		return 0;
+
+	return cap->set(inst, cap_id);
+}
+
+static int adjust_dynamic_property(struct iris_inst *inst,
+				   enum plat_inst_cap_type cap_id,
+				   struct v4l2_ctrl *ctrl,
+				   struct list_head *firmware_list,
+				   struct list_head *children_list,
+				   bool cap_present[INST_CAP_MAX])
+{
+	struct cap_entry *entry = NULL, *temp = NULL;
+	struct plat_inst_cap *cap;
+	s32 prev_value;
+	int ret;
+
+	cap = &inst->cap[0];
+
+	if (!(cap[cap_id].flags & CAP_FLAG_DYNAMIC_ALLOWED))
+		return -EBUSY;
+
+	prev_value = cap[cap_id].value;
+	ret = adjust_cap(inst, cap_id, ctrl);
+	if (ret)
+		return ret;
+
+	ret = add_node_list(firmware_list, cap_id);
+	if (ret)
+		return ret;
+	cap_present[cap->cap_id] = true;
+
+	if (cap[cap_id].value == prev_value)
+		return 0;
+
+	ret = add_children(children_list, inst, cap_id);
+	if (ret)
+		return ret;
+
+	list_for_each_entry_safe(entry, temp, children_list, list) {
+		if (!cap[entry->cap_id].adjust) {
+			list_del_init(&entry->list);
+			kfree(entry);
+			continue;
+		}
+
+		prev_value = cap[entry->cap_id].value;
+		ret = adjust_cap(inst, entry->cap_id, NULL);
+		if (ret)
+			return ret;
+
+		if (cap[entry->cap_id].value != prev_value) {
+			if (!cap_present[cap->cap_id]) {
+				ret = add_node_list(firmware_list, cap_id);
+				if (ret)
+					return ret;
+				cap_present[cap->cap_id] = true;
+			}
+
+			ret = add_children(children_list, inst, entry->cap_id);
+			if (ret)
+				return ret;
+		}
+
+		list_del_init(&entry->list);
+		kfree(entry);
+	}
+
+	if (!list_empty(children_list))
+		return -EINVAL;
+
+	return ret;
+}
+
+static int set_dynamic_property(struct iris_inst *inst,
+				struct list_head *firmware_list)
+{
+	struct cap_entry *entry = NULL, *temp = NULL;
+	struct plat_inst_cap *cap;
+	int ret = 0;
+
+	list_for_each_entry_safe(entry, temp, firmware_list, list) {
+		cap = &inst->cap[entry->cap_id];
+		if (cap->set) {
+			ret = cap->set(inst, entry->cap_id);
+			if (ret)
+				return -EINVAL;
+		}
+		list_del_init(&entry->list);
+		kfree(entry);
+	}
+
+	return ret;
+}
+
+static int iris_op_g_volatile_ctrl(struct v4l2_ctrl *ctrl)
+{
+	enum plat_inst_cap_type cap_id;
+	struct iris_inst *inst = NULL;
+	int ret = 0;
+
+	inst = container_of(ctrl->handler, struct iris_inst, ctrl_handler);
+	switch (ctrl->id) {
+	case V4L2_CID_MIN_BUFFERS_FOR_CAPTURE:
+		ctrl->val = inst->buffers.output.min_count;
+		break;
+	case V4L2_CID_MIN_BUFFERS_FOR_OUTPUT:
+		ctrl->val = inst->buffers.input.min_count;
+		break;
+	default:
+		cap_id = get_cap_id(inst, ctrl->id);
+		if (is_valid_cap_id(cap_id))
+			ctrl->val = inst->cap[cap_id].value;
+		else
+			ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+static int iris_op_s_ctrl(struct v4l2_ctrl *ctrl)
+{
+	struct cap_entry *entry = NULL, *temp = NULL;
+	struct list_head children_list, firmware_list;
+	struct ctrl_data *priv_ctrl_data;
+	enum plat_inst_cap_type cap_id;
+	bool cap_present[INST_CAP_MAX];
+	struct plat_inst_cap *cap;
+	struct iris_inst *inst;
+	int ret = 0;
+
+	priv_ctrl_data = ctrl->priv ? ctrl->priv : NULL;
+	if (priv_ctrl_data && priv_ctrl_data->skip_s_ctrl)
+		return 0;
+
+	inst = container_of(ctrl->handler, struct iris_inst, ctrl_handler);
+	cap = &inst->cap[0];
+
+	INIT_LIST_HEAD(&firmware_list);
+	INIT_LIST_HEAD(&children_list);
+	memset(&cap_present, 0, sizeof(cap_present));
+
+	cap_id = get_cap_id(inst, ctrl->id);
+	if (!is_valid_cap_id(cap_id))
+		return -EINVAL;
+
+	if (!allow_s_ctrl(inst, cap_id))
+		return -EBUSY;
+
+	cap[cap_id].flags |= CAP_FLAG_CLIENT_SET;
+
+	if ((inst->domain == ENCODER && !inst->vb2q_dst->streaming) ||
+	    (inst->domain == DECODER && !inst->vb2q_src->streaming)) {
+		inst->cap[cap_id].value = ctrl->val;
+	} else {
+		ret = adjust_dynamic_property(inst, cap_id, ctrl,
+					      &firmware_list, &children_list,
+					      cap_present);
+		if (ret)
+			goto free_list;
+
+		ret = set_dynamic_property(inst, &firmware_list);
+	}
+
+free_list:
+	list_for_each_entry_safe(entry, temp, &children_list, list) {
+		list_del_init(&entry->list);
+		kfree(entry);
+	}
+
+	list_for_each_entry_safe(entry, temp, &firmware_list, list) {
+		list_del_init(&entry->list);
+		kfree(entry);
+	}
+
+	return ret;
+}
+
+static const struct v4l2_ctrl_ops ctrl_ops = {
+	.s_ctrl = iris_op_s_ctrl,
+	.g_volatile_ctrl = iris_op_g_volatile_ctrl,
+};
+
+int ctrls_init(struct iris_inst *inst, bool init)
+{
+	int num_ctrls = 0, ctrl_idx = 0;
+	u64 codecs_count, step_or_mask;
+	struct plat_inst_cap *cap;
+	struct iris_core *core;
+	int idx = 0;
+	int ret = 0;
+
+	core = inst->core;
+	cap = &inst->cap[0];
+
+	for (idx = 0; idx < INST_CAP_MAX; idx++) {
+		if (cap[idx].v4l2_id)
+			num_ctrls++;
+	}
+	if (!num_ctrls)
+		return -EINVAL;
+
+	if (init) {
+		codecs_count = inst->domain == ENCODER ?
+			core->enc_codecs_count :
+			core->dec_codecs_count;
+		ret = v4l2_ctrl_handler_init(&inst->ctrl_handler,
+					     INST_CAP_MAX * codecs_count);
+		if (ret)
+			return ret;
+	}
+
+	for (idx = 0; idx < INST_CAP_MAX; idx++) {
+		struct v4l2_ctrl *ctrl;
+
+		if (!cap[idx].v4l2_id)
+			continue;
+
+		if (ctrl_idx >= num_ctrls) {
+			ret = -EINVAL;
+			goto error;
+		}
+
+		if (!init) {
+			struct ctrl_data ctrl_priv_data;
+
+			ctrl = v4l2_ctrl_find(&inst->ctrl_handler, cap[idx].v4l2_id);
+			if (ctrl) {
+				step_or_mask = (cap[idx].flags & CAP_FLAG_MENU) ?
+					~(cap[idx].step_or_mask) :
+					cap[idx].step_or_mask;
+				memset(&ctrl_priv_data, 0, sizeof(ctrl_priv_data));
+				ctrl_priv_data.skip_s_ctrl = true;
+				ctrl->priv = &ctrl_priv_data;
+				v4l2_ctrl_modify_range(ctrl,
+						       cap[idx].min,
+						       cap[idx].max,
+						       step_or_mask,
+						       cap[idx].value);
+				ctrl->priv = NULL;
+				continue;
+			}
+		}
+
+		if (cap[idx].flags & CAP_FLAG_MENU) {
+			ctrl = v4l2_ctrl_new_std_menu(&inst->ctrl_handler,
+						      &ctrl_ops,
+						      cap[idx].v4l2_id,
+						      cap[idx].max,
+						      ~(cap[idx].step_or_mask),
+						      cap[idx].value);
+		} else {
+			ctrl = v4l2_ctrl_new_std(&inst->ctrl_handler,
+						 &ctrl_ops,
+						 cap[idx].v4l2_id,
+						 cap[idx].min,
+						 cap[idx].max,
+						 cap[idx].step_or_mask,
+						 cap[idx].value);
+		}
+		if (!ctrl) {
+			ret = -EINVAL;
+			goto error;
+		}
+
+		ret = inst->ctrl_handler.error;
+		if (ret)
+			goto error;
+
+		if ((cap[idx].flags & CAP_FLAG_VOLATILE) ||
+		    (ctrl->id == V4L2_CID_MIN_BUFFERS_FOR_CAPTURE ||
+		     ctrl->id == V4L2_CID_MIN_BUFFERS_FOR_OUTPUT))
+			ctrl->flags |= V4L2_CTRL_FLAG_VOLATILE;
+
+		ctrl->flags |= V4L2_CTRL_FLAG_EXECUTE_ON_WRITE;
+		ctrl_idx++;
+	}
+	inst->num_ctrls = num_ctrls;
+
+	return 0;
+error:
+	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+
+	return ret;
+}
+
+int iris_init_core_caps(struct iris_core *core)
+{
+	struct plat_core_cap *core_platform_data;
+	int i, num_core_caps;
+
+	core_platform_data = core->platform_data->core_data;
+	if (!core_platform_data)
+		return -EINVAL;
+
+	num_core_caps = core->platform_data->core_data_size;
+
+	for (i = 0; i < num_core_caps && i < CORE_CAP_MAX; i++) {
+		core->cap[core_platform_data[i].type].type = core_platform_data[i].type;
+		core->cap[core_platform_data[i].type].value = core_platform_data[i].value;
+	}
+
+	return 0;
+}
+
+static int update_inst_capability(struct plat_inst_cap *in,
+				  struct plat_inst_caps *capability)
+{
+	if (!in || !capability)
+		return -EINVAL;
+
+	if (in->cap_id >= INST_CAP_MAX)
+		return -EINVAL;
+
+	capability->cap[in->cap_id].cap_id = in->cap_id;
+	capability->cap[in->cap_id].min = in->min;
+	capability->cap[in->cap_id].max = in->max;
+	capability->cap[in->cap_id].step_or_mask = in->step_or_mask;
+	capability->cap[in->cap_id].value = in->value;
+	capability->cap[in->cap_id].flags = in->flags;
+	capability->cap[in->cap_id].v4l2_id = in->v4l2_id;
+	capability->cap[in->cap_id].hfi_id = in->hfi_id;
+	memcpy(capability->cap[in->cap_id].children, in->children,
+	       sizeof(capability->cap[in->cap_id].children));
+	capability->cap[in->cap_id].adjust = in->adjust;
+	capability->cap[in->cap_id].set = in->set;
+
+	return 0;
+}
+
+int iris_init_instance_caps(struct iris_core *core)
+{
+	struct plat_inst_cap *inst_plat_cap_data = NULL;
+	u8 enc_codecs_count = 0, dec_codecs_count = 0;
+	u32 enc_valid_codecs, dec_valid_codecs;
+	int i, j, check_bit = 0;
+	u8 codecs_count = 0;
+	int num_inst_cap;
+	int ret = 0;
+
+	inst_plat_cap_data = core->platform_data->inst_cap_data;
+	if (!inst_plat_cap_data)
+		return -EINVAL;
+
+	enc_valid_codecs = core->cap[ENC_CODECS].value;
+	enc_codecs_count = hweight32(enc_valid_codecs);
+	core->enc_codecs_count = enc_codecs_count;
+
+	dec_valid_codecs = core->cap[DEC_CODECS].value;
+	dec_codecs_count = hweight32(dec_valid_codecs);
+	core->dec_codecs_count = dec_codecs_count;
+
+	codecs_count = enc_codecs_count + dec_codecs_count;
+	core->inst_caps = devm_kzalloc(core->dev,
+				       codecs_count * sizeof(struct plat_inst_caps),
+				       GFP_KERNEL);
+	if (!core->inst_caps)
+		return -ENOMEM;
+
+	for (i = 0; i < enc_codecs_count; i++) {
+		while (check_bit < (sizeof(enc_valid_codecs) * 8)) {
+			if (enc_valid_codecs & BIT(check_bit)) {
+				core->inst_caps[i].domain = ENCODER;
+				core->inst_caps[i].codec = enc_valid_codecs &
+						BIT(check_bit);
+				check_bit++;
+				break;
+			}
+			check_bit++;
+		}
+	}
+
+	check_bit = 0;
+
+	for (; i < codecs_count; i++) {
+		while (check_bit < (sizeof(dec_valid_codecs) * 8)) {
+			if (dec_valid_codecs & BIT(check_bit)) {
+				core->inst_caps[i].domain = DECODER;
+				core->inst_caps[i].codec = dec_valid_codecs &
+						BIT(check_bit);
+				check_bit++;
+				break;
+			}
+			check_bit++;
+		}
+	}
+
+	num_inst_cap = core->platform_data->inst_cap_data_size;
+
+	for (i = 0; i < num_inst_cap; i++) {
+		for (j = 0; j < codecs_count; j++) {
+			if ((inst_plat_cap_data[i].domain & core->inst_caps[j].domain) &&
+			    (inst_plat_cap_data[i].codec & core->inst_caps[j].codec)) {
+				ret = update_inst_capability(&inst_plat_cap_data[i],
+							     &core->inst_caps[j]);
+				if (ret)
+					return ret;
+			}
+		}
+	}
+
+	return ret;
+}
+
+int get_inst_capability(struct iris_inst *inst)
+{
+	struct iris_core *core;
+	u32 codecs_count = 0;
+	int i;
+
+	core = inst->core;
+
+	codecs_count = core->enc_codecs_count + core->dec_codecs_count;
+
+	for (i = 0; i < codecs_count; i++) {
+		if (core->inst_caps[i].domain == inst->domain &&
+			core->inst_caps[i].codec == inst->codec) {
+			memcpy(&inst->cap[0], &core->inst_caps[i].cap[0],
+			       (INST_CAP_MAX + 1) * sizeof(struct plat_inst_cap));
+		}
+	}
+
+	return 0;
+}
+
+int prepare_dependency_list(struct iris_inst *inst)
+{
+	struct cap_entry *entry = NULL, *temp = NULL;
+	struct plat_inst_cap *cap, *temp_cap;
+	int caps_to_prepare, pending_list_counter,
+		pending_at_start = 0;
+	struct list_head prepared_list, pending_list;
+	bool is_prepared[INST_CAP_MAX];
+	bool is_pending[INST_CAP_MAX];
+	int i, ret = 0;
+
+	cap = &inst->cap[0];
+
+	if (!list_empty(&inst->caps_list))
+		return 0;
+
+	INIT_LIST_HEAD(&prepared_list);
+	INIT_LIST_HEAD(&pending_list);
+	memset(&is_prepared, 0, sizeof(is_prepared));
+	memset(&is_pending, 0, sizeof(is_pending));
+
+	for (i = 1; i < INST_CAP_MAX; i++) {
+		temp_cap = &cap[i];
+		if (!is_valid_cap_id(temp_cap->cap_id))
+			continue;
+
+		if (!temp_cap->children[0]) {
+			if (!is_prepared[temp_cap->cap_id]) {
+				ret = add_node_list(&prepared_list, temp_cap->cap_id);
+				if (ret)
+					goto free_list;
+				is_prepared[temp_cap->cap_id] = true;
+			}
+		} else {
+			if (!is_pending[temp_cap->cap_id]) {
+				ret = add_node_list(&pending_list, temp_cap->cap_id);
+				if (ret)
+					goto free_list;
+				is_pending[temp_cap->cap_id] = true;
+			}
+		}
+	}
+
+	list_for_each_entry(entry, &pending_list, list)
+		pending_at_start++;
+
+	caps_to_prepare = pending_at_start;
+	pending_list_counter = pending_at_start;
+
+	list_for_each_entry_safe(entry, temp, &pending_list, list) {
+		list_del_init(&entry->list);
+		is_pending[entry->cap_id] = false;
+		pending_list_counter--;
+		temp_cap = &cap[entry->cap_id];
+
+		if (is_all_childrens_visited(temp_cap, is_prepared)) {
+			list_add(&entry->list, &prepared_list);
+			is_prepared[entry->cap_id] = true;
+			caps_to_prepare--;
+		} else {
+			list_add_tail(&entry->list, &pending_list);
+			is_pending[entry->cap_id] = true;
+		}
+
+		if (!pending_list_counter) {
+			if (pending_at_start == caps_to_prepare) {
+				ret = -EINVAL;
+				goto free_list;
+			}
+			pending_at_start = caps_to_prepare;
+			pending_list_counter = caps_to_prepare;
+		}
+	}
+
+	if (!list_empty(&pending_list)) {
+		ret = -EINVAL;
+		goto free_list;
+	}
+
+	list_replace_init(&prepared_list, &inst->caps_list);
+
+free_list:
+	list_for_each_entry_safe(entry, temp, &pending_list, list) {
+		list_del_init(&entry->list);
+		kfree(entry);
+	}
+	list_for_each_entry_safe(entry, temp, &prepared_list, list) {
+		list_del_init(&entry->list);
+		kfree(entry);
+	}
+
+	return ret;
+}
+
+static inline bool is_layer_bitrate_set(struct iris_inst *inst)
+{
+	u32 layer_br_caps[6] = {L0_BR, L1_BR, L2_BR, L3_BR, L4_BR, L5_BR};
+	u32 cap_id = 0, i, enh_layer_count;
+
+	enh_layer_count = inst->cap[ENH_LAYER_COUNT].value;
+
+	for (i = 0; i <= enh_layer_count; i++) {
+		if (i >= ARRAY_SIZE(layer_br_caps))
+			break;
+
+		cap_id = layer_br_caps[i];
+		if (!(inst->cap[cap_id].flags & CAP_FLAG_CLIENT_SET))
+			return false;
+	}
+
+	return true;
+}
+
+static inline u32 get_cumulative_bitrate(struct iris_inst *inst)
+{
+	u32 layer_br_caps[6] = {L0_BR, L1_BR, L2_BR, L3_BR, L4_BR, L5_BR};
+	u32 cumulative_br = 0;
+	s32 enh_layer_count;
+	u32 cap_id = 0;
+	int i;
+
+	enh_layer_count = inst->cap[ENH_LAYER_COUNT].value;
+
+	for (i = 0; i <= enh_layer_count; i++) {
+		if (i >= ARRAY_SIZE(layer_br_caps))
+			break;
+		cap_id = layer_br_caps[i];
+		cumulative_br += inst->cap[cap_id].value;
+	}
+
+	return cumulative_br;
+}
+
+int set_u32_enum(struct iris_inst *inst,
+		 enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_value = inst->cap[cap_id].value;
+	u32 hfi_id = inst->cap[cap_id].hfi_id;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32_ENUM,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_u32(struct iris_inst *inst,
+	    enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_value = inst->cap[cap_id].value;
+	u32 hfi_id = inst->cap[cap_id].hfi_id;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_q16(struct iris_inst *inst,
+	    enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_value = inst->cap[cap_id].value;
+	u32 hfi_id = inst->cap[cap_id].hfi_id;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_Q16,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_stage(struct iris_inst *inst,
+	      enum plat_inst_cap_type cap_id)
+{
+	struct v4l2_format *inp_f;
+	u32 work_mode = STAGE_2;
+	u32 width, height;
+	u32 hfi_id;
+
+	hfi_id = inst->cap[cap_id].hfi_id;
+
+	if (inst->domain == DECODER) {
+		inp_f = inst->fmt_src;
+		height = inp_f->fmt.pix_mp.height;
+		width = inp_f->fmt.pix_mp.width;
+		if (res_is_less_than(width, height, 1280, 720))
+			work_mode = STAGE_1;
+	} else if (inst->domain == ENCODER) {
+		if (inst->cap[SLICE_MODE].value ==
+		    V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES)
+			work_mode = STAGE_1;
+
+		if (inst->hfi_rc_type == HFI_RC_CBR_CFR ||
+		    inst->hfi_rc_type == HFI_RC_CBR_VFR)
+			work_mode = STAGE_1;
+
+		if (!inst->cap[GOP_SIZE].value)
+			work_mode = STAGE_2;
+	}
+
+	inst->cap[cap_id].value = work_mode;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32,
+				     &work_mode, sizeof(u32));
+}
+
+int set_pipe(struct iris_inst *inst,
+	     enum plat_inst_cap_type cap_id)
+{
+	u32 work_route, hfi_id;
+
+	work_route = inst->cap[cap_id].value;
+	hfi_id = inst->cap[cap_id].hfi_id;
+
+	if (inst->domain == ENCODER) {
+		if (inst->cap[SLICE_MODE].value ==
+		    V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES)
+			work_route = PIPE_1;
+	}
+
+	inst->cap[cap_id].value = work_route;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32,
+				     &work_route, sizeof(u32));
+}
+
+int set_level(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_value = inst->cap[cap_id].value;
+	u32 hfi_id = inst->cap[cap_id].hfi_id;
+
+	if (!(inst->cap[cap_id].flags & CAP_FLAG_CLIENT_SET))
+		hfi_value = HFI_LEVEL_NONE;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+					 get_port_info(inst, cap_id),
+					 HFI_PAYLOAD_U32_ENUM,
+					 &hfi_value, sizeof(u32));
+}
+
+int decide_quality_mode(struct iris_inst *inst)
+{
+	u32 fps, mbpf, mbps, max_hq_mbpf, max_hq_mbps;
+	u32 mode = POWER_SAVE_MODE;
+	struct iris_core *core;
+
+	if (inst->domain != ENCODER)
+		return 0;
+
+	mbpf = NUM_MBS_PER_FRAME(inst->crop.height, inst->crop.width);
+	fps = max3(inst->cap[QUEUED_RATE].value >> 16,
+		   inst->cap[FRAME_RATE].value >> 16,
+		   inst->cap[OPERATING_RATE].value >> 16);
+	mbps = mbpf * fps;
+	core = inst->core;
+	max_hq_mbpf = core->cap[MAX_MBPF_HQ].value;
+	max_hq_mbps = core->cap[MAX_MBPS_HQ].value;
+
+	if (mbpf <= max_hq_mbpf && mbps <= max_hq_mbps)
+		mode = MAX_QUALITY_MODE;
+
+	inst->cap[QUALITY_MODE].value = mode;
+
+	return mode;
+}
+
+int set_req_sync_frame(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_id, hfi_val;
+	s32 prepend_sps_pps;
+
+	prepend_sps_pps = inst->cap[PREPEND_SPSPPS_TO_IDR].value;
+	hfi_id = inst->cap[cap_id].hfi_id;
+
+	if (prepend_sps_pps)
+		hfi_val = HFI_SYNC_FRAME_REQUEST_WITH_PREFIX_SEQ_HDR;
+	else
+		hfi_val = HFI_SYNC_FRAME_REQUEST_WITHOUT_SEQ_HDR;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32_ENUM,
+				     &hfi_val, sizeof(u32));
+}
+
+int set_flip(struct iris_inst *inst,
+	     enum plat_inst_cap_type cap_id)
+{
+	u32 hflip, vflip, ret = 0;
+
+	u32 hfi_value = HFI_DISABLE_FLIP;
+	u32 hfi_id = inst->cap[cap_id].hfi_id;
+
+	hflip = inst->cap[HFLIP].value;
+	vflip = inst->cap[VFLIP].value;
+
+	if (hflip)
+		hfi_value |= HFI_HORIZONTAL_FLIP;
+
+	if (vflip)
+		hfi_value |= HFI_VERTICAL_FLIP;
+
+	if (inst->vb2q_dst->streaming) {
+		if (hfi_value != HFI_DISABLE_FLIP) {
+			ret = set_req_sync_frame(inst, REQUEST_I_FRAME);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32_ENUM,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_rotation(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_id, hfi_val;
+
+	hfi_id = inst->cap[cap_id].hfi_id;
+	v4l2_to_hfi_enum(inst, cap_id, &hfi_val);
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32,
+				     &hfi_val, sizeof(u32));
+}
+
+int set_header_mode(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 header_mode, hfi_id, hfi_val;
+	s32 prepend_sps_pps;
+
+	prepend_sps_pps = inst->cap[PREPEND_SPSPPS_TO_IDR].value;
+	header_mode = inst->cap[cap_id].value;
+	hfi_id = inst->cap[cap_id].hfi_id;
+
+	if (prepend_sps_pps)
+		hfi_val = HFI_SEQ_HEADER_PREFIX_WITH_SYNC_FRAME;
+	else if (header_mode == V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME)
+		hfi_val = HFI_SEQ_HEADER_JOINED_WITH_1ST_FRAME;
+	else
+		hfi_val = HFI_SEQ_HEADER_SEPERATE_FRAME;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32_ENUM,
+				     &hfi_val, sizeof(u32));
+}
+
+int set_gop_size(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_value, hfi_id;
+
+	if (inst->vb2q_dst->streaming) {
+		if (inst->hfi_layer_type == HFI_HIER_B)
+			return 0;
+	}
+
+	hfi_value = inst->cap[GOP_SIZE].value;
+	hfi_id = inst->cap[cap_id].hfi_id;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_bitrate(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_id, hfi_val;
+
+	if (inst->cap[BIT_RATE].flags & CAP_FLAG_CLIENT_SET)
+		goto set_total_bitrate;
+
+	if (inst->vb2q_dst->streaming)
+		return 0;
+
+set_total_bitrate:
+	hfi_id = inst->cap[cap_id].hfi_id;
+	hfi_val = inst->cap[cap_id].value;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32,
+				     &hfi_val, sizeof(u32));
+}
+
+int set_layer_bitrate(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_value = 0;
+	u32 hfi_id;
+
+	if (!inst->vb2q_dst->streaming)
+		return 0;
+
+	if (inst->cap[BIT_RATE].flags & CAP_FLAG_CLIENT_SET)
+		return 0;
+
+	if (!inst->cap[ENH_LAYER_COUNT].max ||
+	    !is_layer_bitrate_set(inst))
+		return 0;
+
+	hfi_value = inst->cap[BIT_RATE].value;
+	hfi_id = inst->cap[BIT_RATE].hfi_id;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_peak_bitrate(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_id, hfi_val;
+	s32 rc_mode;
+
+	hfi_id = inst->cap[cap_id].hfi_id;
+	hfi_val = inst->cap[cap_id].value;
+
+	rc_mode = inst->cap[BITRATE_MODE].value;
+	if (rc_mode != V4L2_MPEG_VIDEO_BITRATE_MODE_CBR)
+		return 0;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32,
+				     &hfi_val, sizeof(u32));
+}
+
+int set_bitrate_mode(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_value, hfi_id;
+
+	hfi_id = inst->cap[cap_id].hfi_id;
+	hfi_value = inst->hfi_rc_type;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+			get_port_info(inst, cap_id),
+			HFI_PAYLOAD_U32_ENUM,
+			&hfi_value, sizeof(u32));
+}
+
+int set_use_and_mark_ltr(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_id, hfi_val;
+
+	hfi_id = inst->cap[cap_id].hfi_id;
+	hfi_val = inst->cap[cap_id].value;
+
+	if (!inst->cap[LTR_COUNT].value ||
+	    inst->cap[cap_id].value == INVALID_DEFAULT_MARK_OR_USE_LTR)
+		return 0;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_U32,
+				     &hfi_val, sizeof(u32));
+}
+
+int set_ir_period(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_id = 0, hfi_val;
+
+	hfi_val = inst->cap[cap_id].value;
+
+	if (inst->cap[IR_TYPE].value ==
+	    V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM) {
+		hfi_id = HFI_PROP_IR_RANDOM_PERIOD;
+	} else if (inst->cap[IR_TYPE].value ==
+		   V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC) {
+		hfi_id = HFI_PROP_IR_CYCLIC_PERIOD;
+	}
+
+	return iris_hfi_set_ir_period(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				      get_port_info(inst, cap_id),
+				      HFI_PAYLOAD_U32,
+				      &hfi_val, sizeof(u32));
+}
+
+int set_min_qp(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	s32 i_frame_qp = 0, p_frame_qp = 0, b_frame_qp = 0, min_qp_enable = 0;
+	u32 i_qp_enable = 0, p_qp_enable = 0, b_qp_enable = 0;
+	u32 client_qp_enable = 0, hfi_value = 0;
+	u32 hfi_id;
+
+	if (inst->cap[MIN_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+		min_qp_enable = 1;
+
+	if (min_qp_enable ||
+	    (inst->cap[I_FRAME_MIN_QP].flags & CAP_FLAG_CLIENT_SET))
+		i_qp_enable = 1;
+	if (min_qp_enable ||
+	    (inst->cap[P_FRAME_MIN_QP].flags & CAP_FLAG_CLIENT_SET))
+		p_qp_enable = 1;
+	if (min_qp_enable ||
+	    (inst->cap[B_FRAME_MIN_QP].flags & CAP_FLAG_CLIENT_SET))
+		b_qp_enable = 1;
+
+	client_qp_enable = i_qp_enable | p_qp_enable << 1 | b_qp_enable << 2;
+	if (!client_qp_enable)
+		return 0;
+
+	i_frame_qp = max(inst->cap[I_FRAME_MIN_QP].value, inst->cap[MIN_FRAME_QP].value);
+	p_frame_qp = max(inst->cap[P_FRAME_MIN_QP].value, inst->cap[MIN_FRAME_QP].value);
+	b_frame_qp = max(inst->cap[B_FRAME_MIN_QP].value, inst->cap[MIN_FRAME_QP].value);
+
+	hfi_id = inst->cap[cap_id].hfi_id;
+	hfi_value = i_frame_qp | p_frame_qp << 8 | b_frame_qp << 16 |
+		client_qp_enable << 24;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_32_PACKED,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_max_qp(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	s32 i_frame_qp = 0, p_frame_qp = 0, b_frame_qp = 0, max_qp_enable = 0;
+	u32 i_qp_enable = 0, p_qp_enable = 0, b_qp_enable = 0;
+	u32 client_qp_enable = 0, hfi_value = 0;
+	u32 hfi_id;
+
+	if (inst->cap[MAX_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+		max_qp_enable = 1;
+
+	if (max_qp_enable ||
+	    (inst->cap[I_FRAME_MAX_QP].flags & CAP_FLAG_CLIENT_SET))
+		i_qp_enable = 1;
+	if (max_qp_enable ||
+	    (inst->cap[P_FRAME_MAX_QP].flags & CAP_FLAG_CLIENT_SET))
+		p_qp_enable = 1;
+	if (max_qp_enable ||
+	    (inst->cap[B_FRAME_MAX_QP].flags & CAP_FLAG_CLIENT_SET))
+		b_qp_enable = 1;
+
+	client_qp_enable = i_qp_enable | p_qp_enable << 1 | b_qp_enable << 2;
+	if (!client_qp_enable)
+		return 0;
+
+	i_frame_qp = min(inst->cap[I_FRAME_MAX_QP].value, inst->cap[MAX_FRAME_QP].value);
+	p_frame_qp = min(inst->cap[P_FRAME_MAX_QP].value, inst->cap[MAX_FRAME_QP].value);
+	b_frame_qp = min(inst->cap[B_FRAME_MAX_QP].value, inst->cap[MAX_FRAME_QP].value);
+
+	hfi_id = inst->cap[cap_id].hfi_id;
+	hfi_value = i_frame_qp | p_frame_qp << 8 | b_frame_qp << 16 |
+		client_qp_enable << 24;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_32_PACKED,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_frame_qp(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 i_qp_enable = 0, p_qp_enable = 0, b_qp_enable = 0;
+	u32 client_qp_enable = 0, hfi_value = 0;
+	s32 i_frame_qp = 0, p_frame_qp = 0, b_frame_qp = 0;
+	s32 rc_type = -1;
+	u32 hfi_id;
+
+	rc_type = inst->hfi_rc_type;
+	if (inst->vb2q_dst->streaming) {
+		if (rc_type != HFI_RC_OFF)
+			return 0;
+	}
+
+	if (rc_type == HFI_RC_OFF) {
+		i_qp_enable = 1;
+		p_qp_enable = 1;
+		b_qp_enable = 1;
+	} else {
+		if (inst->cap[I_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+			i_qp_enable = 1;
+		if (inst->cap[P_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+			p_qp_enable = 1;
+		if (inst->cap[B_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+			b_qp_enable = 1;
+	}
+
+	client_qp_enable = i_qp_enable | p_qp_enable << 1 | b_qp_enable << 2;
+	if (!client_qp_enable)
+		return 0;
+
+	i_frame_qp = inst->cap[I_FRAME_QP].value;
+	p_frame_qp = inst->cap[P_FRAME_QP].value;
+	b_frame_qp = inst->cap[B_FRAME_QP].value;
+
+	hfi_id = inst->cap[cap_id].hfi_id;
+	hfi_value = i_frame_qp | p_frame_qp << 8 | b_frame_qp << 16 |
+		client_qp_enable << 24;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, cap_id),
+				     HFI_PAYLOAD_32_PACKED,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_layer_count_and_type(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_layer_count, hfi_layer_type = 0;
+	int ret, hfi_id;
+
+	if (!inst->vb2q_dst->streaming) {
+		hfi_layer_type = inst->hfi_layer_type;
+		hfi_id = inst->cap[LAYER_TYPE].hfi_id;
+
+		ret = iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+					    get_port_info(inst, LAYER_TYPE),
+					    HFI_PAYLOAD_U32_ENUM,
+					    &hfi_layer_type, sizeof(u32));
+		if (ret)
+			return ret;
+	} else {
+		if (inst->hfi_layer_type == HFI_HIER_B)
+			return 0;
+	}
+
+	hfi_id = inst->cap[ENH_LAYER_COUNT].hfi_id;
+	hfi_layer_count = inst->cap[ENH_LAYER_COUNT].value + 1;
+
+	ret = iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				    get_port_info(inst, ENH_LAYER_COUNT),
+				    HFI_PAYLOAD_U32,
+				    &hfi_layer_count, sizeof(u32));
+
+	return ret;
+}
+
+int set_slice_count(struct iris_inst *inst, enum plat_inst_cap_type cap_id)
+{
+	u32 hfi_value = 0, set_cap_id = 0, hfi_id;
+	s32 slice_mode = -1;
+
+	slice_mode = inst->cap[SLICE_MODE].value;
+
+	if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE)
+		return 0;
+
+	if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) {
+		hfi_value = (inst->codec == HEVC) ?
+			(inst->cap[SLICE_MAX_MB].value + 3) / 4 :
+			inst->cap[SLICE_MAX_MB].value;
+		set_cap_id = SLICE_MAX_MB;
+	} else if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES) {
+		hfi_value = inst->cap[SLICE_MAX_BYTES].value;
+		set_cap_id = SLICE_MAX_BYTES;
+	}
+
+	hfi_id = inst->cap[set_cap_id].hfi_id;
+
+	return iris_hfi_set_property(inst, hfi_id, HFI_HOST_FLAGS_NONE,
+				     get_port_info(inst, set_cap_id),
+				     HFI_PAYLOAD_U32,
+				     &hfi_value, sizeof(u32));
+}
+
+int set_v4l2_properties(struct iris_inst *inst)
+{
+	struct cap_entry *entry = NULL, *temp = NULL;
+	int ret = 0;
+
+	list_for_each_entry_safe(entry, temp, &inst->caps_list, list) {
+		ret = set_cap(inst, entry->cap_id);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+int adjust_v4l2_properties(struct iris_inst *inst)
+{
+	struct cap_entry *entry = NULL, *temp = NULL;
+	int ret = 0;
+
+	list_for_each_entry_safe(entry, temp, &inst->caps_list, list) {
+		ret = adjust_cap(inst, entry->cap_id, NULL);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+int adjust_output_order(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 display_delay = -1, display_delay_enable = -1;
+	u32 adjusted_value;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->cap[OUTPUT_ORDER].value;
+
+	display_delay = inst->cap[DISPLAY_DELAY].value;
+	display_delay_enable = inst->cap[DISPLAY_DELAY_ENABLE].value;
+
+	if (display_delay_enable && !display_delay)
+		adjusted_value = 1;
+
+	inst->cap[OUTPUT_ORDER].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_profile(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	u32 adjusted_value;
+	s32 pix_fmt = -1;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[PROFILE].value;
+
+	pix_fmt = inst->cap[PIX_FMTS].value;
+
+	if (pix_fmt == FMT_TP10C)
+		adjusted_value = V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10;
+	else
+		adjusted_value = V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN;
+
+	inst->cap[PROFILE].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_bitrate(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	u32 layer_br_caps[6] = {L0_BR, L1_BR, L2_BR, L3_BR, L4_BR, L5_BR};
+	u32 adjusted_value, cumulative_bitrate, cap_id, cap_val, i;
+	s32 layer_count, max_bitrate = 0, entropy_mode;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[BIT_RATE].value;
+
+	if (inst->cap[BIT_RATE].flags & CAP_FLAG_CLIENT_SET) {
+		inst->cap[BIT_RATE].value = adjusted_value;
+		return 0;
+	}
+
+	entropy_mode = inst->cap[ENTROPY_MODE].value;
+
+	if (inst->codec == HEVC)
+		max_bitrate = CABAC_MAX_BITRATE;
+
+	if (inst->codec == H264) {
+		if (entropy_mode == V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC)
+			max_bitrate = CABAC_MAX_BITRATE;
+		else
+			max_bitrate = CAVLC_MAX_BITRATE;
+	}
+
+	if (inst->cap[BIT_RATE].value > max_bitrate)
+		inst->cap[BIT_RATE].value = max_bitrate;
+
+	layer_count = inst->cap[ENH_LAYER_COUNT].value;
+	if (!layer_count)
+		return 0;
+
+	if (!is_layer_bitrate_set(inst))
+		return 0;
+
+	cumulative_bitrate = get_cumulative_bitrate(inst);
+
+	if (cumulative_bitrate > max_bitrate) {
+		u32 decrement_in_value = 0;
+		u32 decrement_in_percent = ((cumulative_bitrate - max_bitrate) * 100) /
+				max_bitrate;
+
+		cumulative_bitrate = 0;
+		for (i = 0; i <= layer_count; i++) {
+			if (i >= ARRAY_SIZE(layer_br_caps))
+				break;
+			cap_id = layer_br_caps[i];
+			cap_val = inst->cap[cap_id].value;
+			decrement_in_value = (cap_val * decrement_in_percent) / 100;
+			cumulative_bitrate += (cap_val - decrement_in_value);
+			inst->cap[cap_id].value = cap_val - decrement_in_value;
+		}
+		inst->cap[BIT_RATE].value = cumulative_bitrate;
+	}
+
+	return 0;
+}
+
+int adjust_layer_bitrate(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	u32 old_br = 0, new_br = 0, exceeded_br = 0;
+	u32 client_set_cap_id = INST_CAP_NONE;
+	u32 cumulative_bitrate = 0;
+	s32 max_bitrate;
+
+	if (!ctrl)
+		return 0;
+
+	if (inst->cap[BIT_RATE].flags & CAP_FLAG_CLIENT_SET ||
+	    !inst->vb2q_dst->streaming)
+		return 0;
+
+	if (!inst->cap[ENH_LAYER_COUNT].max)
+		return -EINVAL;
+
+	if (!is_layer_bitrate_set(inst))
+		return 0;
+
+	client_set_cap_id = get_cap_id(inst, ctrl->id);
+	if (!is_valid_cap_id(client_set_cap_id))
+		return -EINVAL;
+
+	cumulative_bitrate = get_cumulative_bitrate(inst);
+	max_bitrate = inst->cap[BIT_RATE].max;
+	old_br = inst->cap[client_set_cap_id].value;
+	new_br = ctrl->val;
+
+	if ((cumulative_bitrate - old_br + new_br) > max_bitrate) {
+		exceeded_br = (cumulative_bitrate - old_br + new_br) - max_bitrate;
+		new_br = ctrl->val - exceeded_br;
+	}
+	inst->cap[client_set_cap_id].value = new_br;
+
+	inst->cap[BIT_RATE].value = get_cumulative_bitrate(inst);
+
+	return 0;
+}
+
+int adjust_peak_bitrate(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	u32 adjusted_value;
+	s32 rc_mode, bitrate;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[PEAK_BITRATE].value;
+
+	rc_mode = inst->cap[BITRATE_MODE].value;
+
+	if (rc_mode != V4L2_MPEG_VIDEO_BITRATE_MODE_CBR)
+		return 0;
+
+	bitrate = inst->cap[BIT_RATE].value;
+
+	if (inst->cap[PEAK_BITRATE].flags & CAP_FLAG_CLIENT_SET) {
+		if (adjusted_value < bitrate)
+			adjusted_value = bitrate;
+	} else {
+		adjusted_value = inst->cap[BIT_RATE].value;
+	}
+
+	inst->cap[PEAK_BITRATE].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_bitrate_mode(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 frame_rc, bitrate_mode, frame_skip;
+
+	bitrate_mode = inst->cap[BITRATE_MODE].value;
+	frame_rc = inst->cap[FRAME_RC_ENABLE].value;
+	frame_skip = inst->cap[FRAME_SKIP_MODE].value;
+
+	if (!frame_rc) {
+		inst->hfi_rc_type = HFI_RC_OFF;
+		return 0;
+	}
+
+	if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) {
+		inst->hfi_rc_type = HFI_RC_VBR_CFR;
+	} else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_CBR) {
+		if (frame_skip)
+			inst->hfi_rc_type = HFI_RC_CBR_VFR;
+		else
+			inst->hfi_rc_type = HFI_RC_CBR_CFR;
+	} else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_CQ) {
+		inst->hfi_rc_type = HFI_RC_CQ;
+	} else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_MBR) {
+		inst->hfi_rc_type = HFI_RC_MBR;
+	}
+
+	return 0;
+}
+
+int adjust_gop_size(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, enh_layer_count;
+	u32 min_gop_size, num_subgops;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[GOP_SIZE].value;
+
+	enh_layer_count = inst->cap[ENH_LAYER_COUNT].value;
+
+	if (!enh_layer_count)
+		goto exit;
+
+	/*
+	 * Layer encoding needs GOP size to be multiple of subgop size
+	 * And subgop size is 2 ^ number of enhancement layers.
+	 */
+	min_gop_size = 1 << enh_layer_count;
+	num_subgops = (adjusted_value + (min_gop_size >> 1)) / min_gop_size;
+	if (num_subgops)
+		adjusted_value = num_subgops * min_gop_size;
+	else
+		adjusted_value = min_gop_size;
+
+exit:
+	inst->cap[GOP_SIZE].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_b_frame(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, enh_layer_count = -1;
+	const u32 max_bframe_size = inst->cap[B_FRAME].max;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[B_FRAME].value;
+
+	enh_layer_count = inst->cap[ENH_LAYER_COUNT].value;
+
+	if (!enh_layer_count || inst->hfi_layer_type != HFI_HIER_B) {
+		adjusted_value = 0;
+		goto exit;
+	}
+
+	adjusted_value = (1 << enh_layer_count) - 1;
+
+	if (adjusted_value > max_bframe_size)
+		adjusted_value = max_bframe_size;
+
+exit:
+	inst->cap[B_FRAME].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_ltr_count(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, rc_mode, pix_fmt;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[LTR_COUNT].value;
+
+	rc_mode = inst->cap[BITRATE_MODE].value;
+
+	if (rc_mode != V4L2_MPEG_VIDEO_BITRATE_MODE_CBR &&
+	    inst->hfi_rc_type != HFI_RC_OFF)
+		adjusted_value = 0;
+
+	pix_fmt = inst->cap[PIX_FMTS].value;
+	if (is_10bit_colorformat(pix_fmt))
+		adjusted_value = 0;
+
+	inst->cap[LTR_COUNT].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_use_ltr(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, ltr_count;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[USE_LTR].value;
+
+	ltr_count = inst->cap[LTR_COUNT].value;
+	if (!ltr_count)
+		return 0;
+
+	/*
+	 * USE_LTR is bitmask value, hence should be
+	 * > 0 and <= (2 ^ LTR_COUNT) - 1
+	 */
+	if (adjusted_value <= 0 ||
+	    adjusted_value > (1 << ltr_count) - 1)
+		return 0;
+
+	inst->cap[USE_LTR].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_mark_ltr(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, ltr_count;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[MARK_LTR].value;
+
+	ltr_count = inst->cap[LTR_COUNT].value;
+	if (!ltr_count)
+		return 0;
+
+	if (adjusted_value < 0 || adjusted_value > ltr_count - 1)
+		return 0;
+
+	inst->cap[MARK_LTR].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_ir_period(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, pix_fmt, rc_mode;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[IR_PERIOD].value;
+
+	pix_fmt = inst->cap[PIX_FMTS].value;
+	if (is_10bit_colorformat(pix_fmt))
+		adjusted_value = 0;
+
+	rc_mode = inst->cap[BITRATE_MODE].value;
+	if (rc_mode != V4L2_MPEG_VIDEO_BITRATE_MODE_CBR)
+		adjusted_value = 0;
+
+	inst->cap[IR_PERIOD].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_min_quality(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, pix_fmt, rc_mode, layer_count;
+	u32 width, height, frame_rate;
+	struct v4l2_format *f;
+
+	if (inst->vb2q_dst->streaming)
+		return 0;
+
+	adjusted_value = MAX_SUPPORTED_MIN_QUALITY;
+
+	rc_mode = inst->cap[BITRATE_MODE].value;
+	if (rc_mode != V4L2_MPEG_VIDEO_BITRATE_MODE_VBR)
+		adjusted_value = 0;
+
+	layer_count = inst->cap[ENH_LAYER_COUNT].value;
+	if (layer_count && inst->hfi_layer_type != HFI_HIER_B)
+		adjusted_value = 0;
+
+	pix_fmt = inst->cap[PIX_FMTS].value;
+	if (is_10bit_colorformat(pix_fmt))
+		adjusted_value = 0;
+
+	frame_rate = inst->cap[FRAME_RATE].value >> 16;
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (!res_is_less_than(width, height, 1920, 1080))
+		adjusted_value = 0;
+
+	if (frame_rate > 60)
+		adjusted_value = 0;
+
+	inst->cap[MIN_QUALITY].value = adjusted_value;
+
+	return 0;
+}
+
+static int adjust_static_layer_count_and_type(struct iris_inst *inst, s32 layer_count)
+{
+	bool hb_requested = false;
+	s32 max_enh_count = 0;
+
+	if (!layer_count)
+		goto exit;
+
+	if (inst->hfi_rc_type == HFI_RC_CQ) {
+		layer_count = 0;
+		goto exit;
+	}
+
+	if (inst->codec == H264) {
+		if (!inst->cap[LAYER_ENABLE].value) {
+			layer_count = 0;
+			goto exit;
+		}
+		hb_requested = inst->cap[LAYER_TYPE].value ==
+				V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B;
+	} else if (inst->codec == HEVC) {
+		hb_requested = inst->cap[LAYER_TYPE].value ==
+				V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B;
+	}
+
+	if (hb_requested && inst->hfi_rc_type != HFI_RC_VBR_CFR) {
+		layer_count = 0;
+		goto exit;
+	}
+
+	inst->hfi_layer_type = hb_requested ? HFI_HIER_B :
+		(inst->codec == H264 && inst->hfi_rc_type == HFI_RC_VBR_CFR) ?
+		HFI_HIER_P_HYBRID_LTR : HFI_HIER_P_SLIDING_WINDOW;
+
+	max_enh_count = inst->hfi_layer_type == HFI_HIER_B ? MAX_ENH_LAYER_HB :
+		inst->hfi_layer_type == HFI_HIER_P_HYBRID_LTR ? MAX_AVC_ENH_LAYER_HYBRID_HP :
+		inst->hfi_layer_type == HFI_HIER_P_SLIDING_WINDOW ?
+		(inst->codec == H264 ? MAX_AVC_ENH_LAYER_SLIDING_WINDOW :
+		 (inst->codec == HEVC && inst->hfi_rc_type == HFI_RC_VBR_CFR) ?
+		 MAX_HEVC_VBR_ENH_LAYER_SLIDING_WINDOW :
+		 MAX_HEVC_NON_VBR_ENH_LAYER_SLIDING_WINDOW) :
+		layer_count;
+
+	layer_count = min(layer_count, max_enh_count);
+
+exit:
+	inst->cap[ENH_LAYER_COUNT].value = layer_count;
+	inst->cap[ENH_LAYER_COUNT].max = layer_count;
+
+	return 0;
+}
+
+int adjust_layer_count(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 client_layer_count;
+	int ret = 0;
+
+	client_layer_count = ctrl ? ctrl->val : inst->cap[ENH_LAYER_COUNT].value;
+
+	if (!inst->vb2q_dst->streaming) {
+		ret = adjust_static_layer_count_and_type(inst, client_layer_count);
+		if (ret)
+			return ret;
+	} else {
+		if (inst->hfi_rc_type == HFI_RC_CBR_CFR ||
+		    inst->hfi_rc_type == HFI_RC_CBR_VFR)
+			return ret;
+
+		if (inst->hfi_layer_type == HFI_HIER_P_HYBRID_LTR ||
+		    inst->hfi_layer_type == HFI_HIER_P_SLIDING_WINDOW)
+			inst->cap[ENH_LAYER_COUNT].value =
+				min(client_layer_count, inst->cap[ENH_LAYER_COUNT].max);
+	}
+
+	return ret;
+}
+
+int adjust_entropy_mode(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	s32 profile = -1;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[ENTROPY_MODE].value;
+
+	profile = inst->cap[PROFILE].value;
+	if (profile == V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE ||
+	    profile == V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE)
+		adjusted_value = V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC;
+
+	inst->cap[ENTROPY_MODE].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_slice_count(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, rc_type = -1, slice_mode, enh_layer_count = 0;
+	u32 slice_val, mbpf = 0, mbps = 0, max_mbpf = 0, max_mbps = 0, bitrate = 0;
+	u32 update_cap, max_avg_slicesize, output_width, output_height;
+	u32 min_width, min_height, max_width, max_height, fps;
+
+	slice_mode = ctrl ? ctrl->val : inst->cap[SLICE_MODE].value;
+	if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE)
+		return 0;
+
+	bitrate = inst->cap[BIT_RATE].value;
+	enh_layer_count = inst->cap[ENH_LAYER_COUNT].value;
+	if (enh_layer_count && is_layer_bitrate_set(inst))
+		bitrate = get_cumulative_bitrate(inst);
+
+	rc_type = inst->hfi_rc_type;
+	fps = inst->cap[FRAME_RATE].value >> 16;
+	if (fps > MAX_SLICES_FRAME_RATE ||
+	    (rc_type != HFI_RC_OFF && rc_type != HFI_RC_CBR_CFR &&
+	     rc_type != HFI_RC_CBR_VFR)) {
+		adjusted_value = V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE;
+		update_cap = SLICE_MODE;
+		goto exit;
+	}
+
+	output_width = inst->fmt_dst->fmt.pix_mp.width;
+	output_height = inst->fmt_dst->fmt.pix_mp.height;
+
+	max_width = (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) ?
+		MAX_MB_SLICE_WIDTH : MAX_BYTES_SLICE_WIDTH;
+	max_height = (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) ?
+		MAX_MB_SLICE_HEIGHT : MAX_BYTES_SLICE_HEIGHT;
+	min_width = (inst->codec == HEVC) ?
+		MIN_HEVC_SLICE_WIDTH : MIN_AVC_SLICE_WIDTH;
+	min_height = MIN_SLICE_HEIGHT;
+
+	if (output_width < min_width || output_height < min_height ||
+	    output_width > max_width || output_height > max_width) {
+		adjusted_value = V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE;
+		update_cap = SLICE_MODE;
+		goto exit;
+	}
+
+	mbpf = NUM_MBS_PER_FRAME(output_height, output_width);
+	mbps = mbpf * fps;
+	max_mbpf = NUM_MBS_PER_FRAME(max_height, max_width);
+	max_mbps = max_mbpf * MAX_SLICES_FRAME_RATE;
+
+	if (mbpf > max_mbpf || mbps > max_mbps) {
+		adjusted_value = V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE;
+		update_cap = SLICE_MODE;
+		goto exit;
+	}
+
+	if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) {
+		update_cap = SLICE_MAX_MB;
+		slice_val = inst->cap[SLICE_MAX_MB].value;
+		slice_val = max(slice_val, mbpf / MAX_SLICES_PER_FRAME);
+	} else {
+		slice_val = inst->cap[SLICE_MAX_BYTES].value;
+		update_cap = SLICE_MAX_BYTES;
+		if (rc_type != HFI_RC_OFF) {
+			max_avg_slicesize =
+				((bitrate / fps) / 8) / MAX_SLICES_PER_FRAME;
+			slice_val = max(slice_val, max_avg_slicesize);
+		}
+	}
+	adjusted_value = slice_val;
+
+exit:
+	inst->cap[update_cap].value = adjusted_value;
+
+	return 0;
+}
+
+int adjust_transform_8x8(struct iris_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	s32 profile = -1;
+
+	adjusted_value = ctrl ? ctrl->val : inst->cap[TRANSFORM_8X8].value;
+
+	profile = inst->cap[PROFILE].value;
+	if (profile != V4L2_MPEG_VIDEO_H264_PROFILE_HIGH &&
+	    profile != V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH)
+		adjusted_value = 0;
+
+	inst->cap[TRANSFORM_8X8].value = adjusted_value;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_ctrls.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_ctrls.h
@@ -0,0 +1,72 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_CTRLS_H_
+#define _IRIS_CTRLS_H_
+
+#include "iris_instance.h"
+
+struct cap_entry {
+	struct list_head list;
+	enum plat_inst_cap_type cap_id;
+};
+
+struct ctrl_data {
+	bool skip_s_ctrl;
+};
+
+int set_u32_enum(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_stage(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_pipe(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_u32(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int adjust_output_order(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_profile(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int vidc_ctrl_handler_deinit(struct iris_inst *inst);
+int prepare_dependency_list(struct iris_inst *inst);
+int iris_init_instance_caps(struct iris_core *core);
+int iris_init_core_caps(struct iris_core *core);
+int get_inst_capability(struct iris_inst *inst);
+int set_v4l2_properties(struct iris_inst *inst);
+int adjust_v4l2_properties(struct iris_inst *inst);
+int ctrls_init(struct iris_inst *inst, bool init);
+int set_q16(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_level(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int decide_quality_mode(struct iris_inst *inst);
+int set_req_sync_frame(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_flip(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_rotation(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_header_mode(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_gop_size(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_bitrate(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_layer_bitrate(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_peak_bitrate(struct iris_inst *inst,
+		     enum plat_inst_cap_type cap_id);
+int set_bitrate_mode(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_use_and_mark_ltr(struct iris_inst *inst,
+			 enum plat_inst_cap_type cap_id);
+int set_ir_period(struct iris_inst *inst,
+		  enum plat_inst_cap_type cap_id);
+int set_min_qp(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_max_qp(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_frame_qp(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_layer_count_and_type(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int set_slice_count(struct iris_inst *inst, enum plat_inst_cap_type cap_id);
+int adjust_bitrate(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_layer_bitrate(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_peak_bitrate(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_bitrate_mode(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_gop_size(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_b_frame(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_ltr_count(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_use_ltr(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_mark_ltr(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_ir_period(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_min_quality(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_layer_count(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_entropy_mode(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_slice_count(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+int adjust_transform_8x8(struct iris_inst *inst, struct v4l2_ctrl *ctrl);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_helpers.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_helpers.c
@@ -0,0 +1,1153 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/pm_runtime.h>
+
+#include "hfi_defines.h"
+#include "iris_core.h"
+#include "iris_ctrls.h"
+#include "iris_helpers.h"
+#include "iris_hfi.h"
+#include "iris_hfi_packet.h"
+#include "iris_instance.h"
+#include "iris_power.h"
+#include "iris_vidc.h"
+#include "memory.h"
+
+int check_core_lock(struct iris_core *core)
+{
+	bool fatal = !mutex_is_locked(&core->lock);
+
+	WARN_ON(fatal);
+
+	return fatal ? -EINVAL : 0;
+}
+
+bool res_is_less_than(u32 width, u32 height,
+		      u32 ref_width, u32 ref_height)
+{
+	u32 num_mbs = NUM_MBS_PER_FRAME(height, width);
+	u32 max_side = max(ref_width, ref_height);
+
+	if (num_mbs < NUM_MBS_PER_FRAME(ref_height, ref_width) &&
+	    width < max_side &&
+	    height < max_side)
+		return true;
+
+	return false;
+}
+
+u32 get_port_info(struct iris_inst *inst,
+		  enum plat_inst_cap_type cap_id)
+{
+	if (inst->cap[cap_id].flags & CAP_FLAG_INPUT_PORT &&
+	    inst->cap[cap_id].flags & CAP_FLAG_OUTPUT_PORT) {
+		if (inst->vb2q_dst->streaming)
+			return get_hfi_port(inst, INPUT_MPLANE);
+		else
+			return get_hfi_port(inst, OUTPUT_MPLANE);
+	}
+
+	if (inst->cap[cap_id].flags & CAP_FLAG_INPUT_PORT)
+		return get_hfi_port(inst, INPUT_MPLANE);
+	else if (inst->cap[cap_id].flags & CAP_FLAG_OUTPUT_PORT)
+		return get_hfi_port(inst, OUTPUT_MPLANE);
+	else
+		return HFI_PORT_NONE;
+}
+
+enum iris_buffer_type v4l2_type_to_driver(u32 type)
+{
+	switch (type) {
+	case INPUT_MPLANE:
+		return BUF_INPUT;
+	case OUTPUT_MPLANE:
+		return BUF_OUTPUT;
+	default:
+		return 0;
+	}
+}
+
+u32 v4l2_type_from_driver(enum iris_buffer_type buffer_type)
+{
+	switch (buffer_type) {
+	case BUF_INPUT:
+		return INPUT_MPLANE;
+	case BUF_OUTPUT:
+		return OUTPUT_MPLANE;
+	default:
+		return 0;
+	}
+}
+
+void v4l2_to_hfi_enum(struct iris_inst *inst,
+		      enum plat_inst_cap_type cap_id, u32 *value)
+{
+	switch (cap_id) {
+	case ROTATION:
+		switch (inst->cap[cap_id].value) {
+		case 0:
+			*value = HFI_ROTATION_NONE;
+			break;
+		case 90:
+			*value = HFI_ROTATION_90;
+			break;
+		case 180:
+			*value = HFI_ROTATION_180;
+			break;
+		case 270:
+			*value = HFI_ROTATION_270;
+			break;
+		default:
+			*value = HFI_ROTATION_NONE;
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+}
+
+int get_mbpf(struct iris_inst *inst)
+{
+	int height = 0, width = 0;
+	struct v4l2_format *inp_f;
+
+	if (inst->domain == DECODER) {
+		inp_f = inst->fmt_src;
+		width = max(inp_f->fmt.pix_mp.width, inst->crop.width);
+		height = max(inp_f->fmt.pix_mp.height, inst->crop.height);
+	} else if (inst->domain == ENCODER) {
+		width = inst->crop.width;
+		height = inst->crop.height;
+	}
+
+	return NUM_MBS_PER_FRAME(height, width);
+}
+
+inline bool is_linear_colorformat(u32 colorformat)
+{
+	return colorformat == V4L2_PIX_FMT_NV12;
+}
+
+bool is_split_mode_enabled(struct iris_inst *inst)
+{
+	if (inst->domain != DECODER)
+		return false;
+
+	if (is_linear_colorformat(inst->fmt_dst->fmt.pix_mp.pixelformat))
+		return true;
+
+	return false;
+}
+
+inline bool is_10bit_colorformat(enum colorformat_type colorformat)
+{
+	return colorformat == FMT_TP10C;
+}
+
+inline bool is_8bit_colorformat(enum colorformat_type colorformat)
+{
+	return colorformat == FMT_NV12 ||
+		colorformat == FMT_NV12C;
+}
+
+inline bool is_scaling_enabled(struct iris_inst *inst)
+{
+	return inst->crop.left != inst->compose.left ||
+		inst->crop.top != inst->compose.top ||
+		inst->crop.width != inst->compose.width ||
+		inst->crop.height != inst->compose.height;
+}
+
+inline bool is_hierb_type_requested(struct iris_inst *inst)
+{
+	return (inst->codec == H264 &&
+		inst->cap[LAYER_TYPE].value ==
+				V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B) ||
+		(inst->codec == HEVC &&
+		inst->cap[LAYER_TYPE].value ==
+				V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B);
+}
+
+u32 v4l2_codec_from_driver(struct iris_inst *inst, enum codec_type codec)
+{
+	const struct codec_info *codec_info;
+	struct iris_core *core;
+	u32 v4l2_codec = 0;
+	u32 i, size;
+
+	core = inst->core;
+	codec_info = core->platform_data->format_data->codec_info;
+	size = core->platform_data->format_data->codec_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (codec_info[i].codec == codec)
+			return codec_info[i].v4l2_codec;
+	}
+
+	return v4l2_codec;
+}
+
+enum codec_type v4l2_codec_to_driver(struct iris_inst *inst, u32 v4l2_codec)
+{
+	const struct codec_info *codec_info;
+	enum codec_type codec = 0;
+	struct iris_core *core;
+	u32 i, size;
+
+	core = inst->core;
+	codec_info = core->platform_data->format_data->codec_info;
+	size = core->platform_data->format_data->codec_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (codec_info[i].v4l2_codec == v4l2_codec)
+			return codec_info[i].codec;
+	}
+
+	return codec;
+}
+
+u32 v4l2_colorformat_from_driver(struct iris_inst *inst, enum colorformat_type colorformat)
+{
+	const struct color_format_info *color_format_info;
+	u32 v4l2_colorformat = 0;
+	struct iris_core *core;
+	u32 i, size;
+
+	core = inst->core;
+	color_format_info = core->platform_data->format_data->color_format_info;
+	size = core->platform_data->format_data->color_format_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (color_format_info[i].color_format == colorformat)
+			return color_format_info[i].v4l2_color_format;
+	}
+
+	return v4l2_colorformat;
+}
+
+enum colorformat_type v4l2_colorformat_to_driver(struct iris_inst *inst, u32 v4l2_colorformat)
+{
+	const struct color_format_info *color_format_info;
+	enum colorformat_type colorformat = 0;
+	struct iris_core *core;
+	u32 i, size;
+
+	core = inst->core;
+	color_format_info = core->platform_data->format_data->color_format_info;
+	size = core->platform_data->format_data->color_format_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (color_format_info[i].v4l2_color_format == v4l2_colorformat)
+			return color_format_info[i].color_format;
+	}
+
+	return colorformat;
+}
+
+struct vb2_queue *get_vb2q(struct iris_inst *inst, u32 type)
+{
+	struct vb2_queue *vb2q = NULL;
+
+	switch (type) {
+	case INPUT_MPLANE:
+		vb2q = inst->vb2q_src;
+		break;
+	case OUTPUT_MPLANE:
+		vb2q = inst->vb2q_dst;
+		break;
+	default:
+		return NULL;
+	}
+
+	return vb2q;
+}
+
+static int process_inst_timeout(struct iris_inst *inst)
+{
+	struct iris_inst *instance;
+	struct iris_core *core;
+	bool found = false;
+	int ret = 0;
+
+	core = inst->core;
+
+	mutex_lock(&core->lock);
+	list_for_each_entry(instance, &core->instances, list) {
+		if (instance == inst) {
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	iris_change_core_state(core, IRIS_CORE_ERROR);
+
+	iris_core_deinit_locked(core);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int close_session(struct iris_inst *inst)
+{
+	u32 hw_response_timeout_val;
+	bool wait_for_response;
+	struct iris_core *core;
+	int ret;
+
+	core = inst->core;
+	hw_response_timeout_val = core->cap[HW_RESPONSE_TIMEOUT].value;
+	wait_for_response = true;
+	ret = iris_hfi_session_close(inst);
+	if (ret)
+		wait_for_response = false;
+
+	kfree(inst->packet);
+	inst->packet = NULL;
+
+	if (wait_for_response) {
+		mutex_unlock(&inst->lock);
+		ret = wait_for_completion_timeout(&inst->completions[SIGNAL_CMD_CLOSE],
+						  msecs_to_jiffies(hw_response_timeout_val));
+		if (!ret) {
+			ret = -ETIMEDOUT;
+			process_inst_timeout(inst);
+		}
+		mutex_lock(&inst->lock);
+	}
+
+	return ret;
+}
+
+int check_core_mbps_mbpf(struct iris_inst *inst)
+{
+	u32 mbpf = 0, mbps = 0, total_mbpf = 0, total_mbps = 0;
+	struct iris_core *core;
+	struct iris_inst *instance;
+	u32 fps;
+
+	core = inst->core;
+
+	mutex_lock(&core->lock);
+	list_for_each_entry(instance, &core->instances, list) {
+		fps = max3(inst->cap[QUEUED_RATE].value >> 16,
+			   inst->cap[FRAME_RATE].value >> 16,
+			   inst->cap[OPERATING_RATE].value >> 16);
+		mbpf = get_mbpf(inst);
+		mbps = mbpf * fps;
+		total_mbpf += mbpf;
+		total_mbps += mbps;
+	}
+	mutex_unlock(&core->lock);
+
+	if (total_mbps > core->cap[MAX_MBPS].value ||
+	    total_mbpf > core->cap[MAX_MBPF].value)
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int check_inst_mbpf(struct iris_inst *inst)
+{
+	u32 mbpf = 0, max_mbpf = 0;
+
+	max_mbpf = inst->cap[MBPF].max;
+	mbpf = get_mbpf(inst);
+	if (mbpf > max_mbpf)
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int check_resolution_supported(struct iris_inst *inst)
+{
+	u32 width = 0, height = 0, min_width, min_height,
+		max_width, max_height;
+
+	if (inst->domain == DECODER) {
+		width = inst->fmt_src->fmt.pix_mp.width;
+		height = inst->fmt_src->fmt.pix_mp.height;
+	} else if (inst->domain == ENCODER) {
+		width = inst->crop.width;
+		height = inst->crop.height;
+	}
+
+	min_width = inst->cap[FRAME_WIDTH].min;
+	max_width = inst->cap[FRAME_WIDTH].max;
+	min_height = inst->cap[FRAME_HEIGHT].min;
+	max_height = inst->cap[FRAME_HEIGHT].max;
+
+	if (inst->domain == DECODER || inst->domain == ENCODER) {
+		if (!(min_width <= width && width <= max_width) ||
+		    !(min_height <= height && height <= max_height))
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int check_max_sessions(struct iris_inst *inst)
+{
+	struct iris_core *core;
+	u32 num_sessions = 0;
+	struct iris_inst *i;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+	list_for_each_entry(i, &core->instances, list) {
+		num_sessions++;
+	}
+	mutex_unlock(&core->lock);
+
+	if (num_sessions > core->cap[MAX_SESSION_COUNT].value)
+		return -ENOMEM;
+
+	return 0;
+}
+
+int check_session_supported(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = check_core_mbps_mbpf(inst);
+	if (ret)
+		goto exit;
+
+	ret = check_inst_mbpf(inst);
+	if (ret)
+		goto exit;
+
+	ret = check_resolution_supported(inst);
+	if (ret)
+		goto exit;
+
+	ret = check_max_sessions(inst);
+	if (ret)
+		goto exit;
+
+	return ret;
+exit:
+	dev_err(inst->core->dev, "current session not supported(%d)\n", ret);
+
+	return ret;
+}
+
+int signal_session_msg_receipt(struct iris_inst *inst,
+			       enum signal_session_response cmd)
+{
+	if (cmd < MAX_SIGNAL)
+		complete(&inst->completions[cmd]);
+
+	return 0;
+}
+
+struct iris_inst *to_instance(struct iris_core *core, u32 session_id)
+{
+	struct iris_inst *inst = NULL;
+
+	mutex_lock(&core->lock);
+	list_for_each_entry(inst, &core->instances, list) {
+		if (inst->session_id == session_id) {
+			mutex_unlock(&core->lock);
+			return inst;
+		}
+	}
+	mutex_unlock(&core->lock);
+
+	return NULL;
+}
+
+static int kill_session(struct iris_inst *inst)
+{
+	if (!inst->session_id)
+		return 0;
+
+	close_session(inst);
+	iris_inst_change_state(inst, IRIS_INST_ERROR);
+
+	return 0;
+}
+
+struct iris_buffer *get_driver_buf(struct iris_inst *inst, u32 plane, u32 index)
+{
+	struct iris_buffer *iter = NULL;
+	struct iris_buffer *buf = NULL;
+	enum iris_buffer_type buf_type;
+	struct iris_buffers *buffers;
+
+	bool found = false;
+
+	buf_type = v4l2_type_to_driver(plane);
+	if (!buf_type)
+		return NULL;
+
+	buffers = iris_get_buffer_list(inst, buf_type);
+	if (!buffers)
+		return NULL;
+
+	list_for_each_entry(iter, &buffers->list, list) {
+		if (iter->index == index) {
+			found = true;
+			buf = iter;
+			break;
+		}
+	}
+
+	if (!found)
+		return NULL;
+
+	return buf;
+}
+
+static void process_requeued_readonly_buffers(struct iris_inst *inst,
+					      struct iris_buffer *buf)
+{
+	struct iris_buffer *ro_buf, *dummy;
+
+	list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+		if (ro_buf->device_addr != buf->device_addr)
+			continue;
+		if (ro_buf->attr & BUF_ATTR_READ_ONLY &&
+		    !(ro_buf->attr & BUF_ATTR_PENDING_RELEASE)) {
+			buf->attr |= BUF_ATTR_READ_ONLY;
+
+			list_del_init(&ro_buf->list);
+			iris_return_buffer_to_pool(inst, ro_buf);
+			break;
+		}
+	}
+}
+
+int queue_buffer(struct iris_inst *inst, struct iris_buffer *buf)
+{
+	int ret;
+
+	if (inst->domain == DECODER && buf->type == BUF_OUTPUT)
+		process_requeued_readonly_buffers(inst, buf);
+
+	ret = iris_hfi_queue_buffer(inst, buf);
+	if (ret)
+		return ret;
+
+	buf->attr &= ~BUF_ATTR_DEFERRED;
+	buf->attr |= BUF_ATTR_QUEUED;
+
+	return ret;
+}
+
+int queue_deferred_buffers(struct iris_inst *inst, enum iris_buffer_type buf_type)
+{
+	struct iris_buffers *buffers;
+	struct iris_buffer *buf;
+	int ret = 0;
+
+	buffers = iris_get_buffer_list(inst, buf_type);
+	if (!buffers)
+		return -EINVAL;
+
+	iris_scale_power(inst);
+
+	list_for_each_entry(buf, &buffers->list, list) {
+		if (!(buf->attr & BUF_ATTR_DEFERRED))
+			continue;
+		ret = queue_buffer(inst, buf);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+int iris_release_nonref_buffers(struct iris_inst *inst)
+{
+	u32 fw_ro_count = 0, nonref_ro_count = 0;
+	struct iris_buffer *ro_buf;
+	bool found = false;
+	int ret = 0;
+	int i = 0;
+
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		if (!(ro_buf->attr & BUF_ATTR_READ_ONLY))
+			continue;
+		if (ro_buf->attr & BUF_ATTR_PENDING_RELEASE)
+			continue;
+		fw_ro_count++;
+	}
+
+	if (fw_ro_count <= MAX_DPB_COUNT)
+		return 0;
+
+	/*
+	 * Mark the read only buffers present in read_only list as
+	 * non-reference if it's not part of dpb_list_payload.
+	 * dpb_list_payload details:
+	 * payload[0-1]           : 64 bits base_address of DPB-1
+	 * payload[2]             : 32 bits addr_offset  of DPB-1
+	 * payload[3]             : 32 bits data_offset  of DPB-1
+	 */
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		found = false;
+		if (!(ro_buf->attr & BUF_ATTR_READ_ONLY))
+			continue;
+		if (ro_buf->attr & BUF_ATTR_PENDING_RELEASE)
+			continue;
+		for (i = 0; (i + 3) < MAX_DPB_LIST_ARRAY_SIZE; i = i + 4) {
+			if (ro_buf->device_addr == inst->dpb_list_payload[i] &&
+			    ro_buf->data_offset == inst->dpb_list_payload[i + 3]) {
+				found = true;
+				break;
+			}
+		}
+		if (!found)
+			nonref_ro_count++;
+	}
+
+	if (nonref_ro_count <= inst->buffers.output.min_count)
+		return 0;
+
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		found = false;
+		if (!(ro_buf->attr & BUF_ATTR_READ_ONLY))
+			continue;
+		if (ro_buf->attr & BUF_ATTR_PENDING_RELEASE)
+			continue;
+		for (i = 0; (i + 3) < MAX_DPB_LIST_ARRAY_SIZE; i = i + 4) {
+			if (ro_buf->device_addr == inst->dpb_list_payload[i] &&
+			    ro_buf->data_offset == inst->dpb_list_payload[i + 3]) {
+				found = true;
+				break;
+			}
+		}
+		if (!found) {
+			ro_buf->attr |= BUF_ATTR_PENDING_RELEASE;
+			ret = iris_hfi_release_buffer(inst, ro_buf);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+int iris_vb2_buffer_done(struct iris_inst *inst,
+			 struct iris_buffer *buf)
+{
+	struct vb2_v4l2_buffer *vbuf;
+	struct vb2_queue *q = NULL;
+	struct vb2_buffer *iter;
+	struct vb2_buffer *vb2;
+	int type, state;
+	bool found;
+
+	type = v4l2_type_from_driver(buf->type);
+	if (!type)
+		return -EINVAL;
+
+	if (type == INPUT_MPLANE)
+		q = inst->vb2q_src;
+	else if (type == OUTPUT_MPLANE)
+		q = inst->vb2q_dst;
+	if (!q || !q->streaming)
+		return -EINVAL;
+
+	found = false;
+	list_for_each_entry(iter, &q->queued_list, queued_entry) {
+		if (iter->state != VB2_BUF_STATE_ACTIVE)
+			continue;
+		if (iter->index == buf->index) {
+			found = true;
+			vb2 = iter;
+			break;
+		}
+	}
+	if (!found)
+		return -EINVAL;
+
+	if (buf->flags & BUF_FLAG_ERROR)
+		state = VB2_BUF_STATE_ERROR;
+	else
+		state = VB2_BUF_STATE_DONE;
+
+	vbuf = to_vb2_v4l2_buffer(vb2);
+	vbuf->flags = buf->flags;
+	vb2->timestamp = buf->timestamp;
+	vb2->planes[0].bytesused = buf->data_size + vb2->planes[0].data_offset;
+	vb2_buffer_done(vb2, state);
+
+	return 0;
+}
+
+static int iris_flush_deferred_buffers(struct iris_inst *inst,
+				       enum iris_buffer_type type)
+{
+	struct iris_buffer *buf, *dummy;
+	struct iris_buffers *buffers;
+
+	buffers = iris_get_buffer_list(inst, type);
+	if (!buffers)
+		return -EINVAL;
+
+	list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+		if (buf->attr & BUF_ATTR_DEFERRED) {
+			if (!(buf->attr & BUF_ATTR_BUFFER_DONE)) {
+				buf->attr |= BUF_ATTR_BUFFER_DONE;
+				buf->data_size = 0;
+				iris_vb2_buffer_done(inst, buf);
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int iris_flush_read_only_buffers(struct iris_inst *inst,
+					enum iris_buffer_type type)
+{
+	struct iris_buffer *ro_buf, *dummy;
+
+	if (inst->domain != DECODER || type != BUF_OUTPUT)
+		return 0;
+
+	list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+		if (ro_buf->attr & BUF_ATTR_READ_ONLY)
+			continue;
+		if (ro_buf->attach && ro_buf->sg_table)
+			dma_buf_unmap_attachment(ro_buf->attach, ro_buf->sg_table,
+						 DMA_BIDIRECTIONAL);
+		if (ro_buf->attach && ro_buf->dmabuf)
+			dma_buf_detach(ro_buf->dmabuf, ro_buf->attach);
+		ro_buf->attach = NULL;
+		ro_buf->sg_table = NULL;
+		ro_buf->dmabuf = NULL;
+		ro_buf->device_addr = 0x0;
+		list_del_init(&ro_buf->list);
+		iris_return_buffer_to_pool(inst, ro_buf);
+	}
+
+	return 0;
+}
+
+void iris_destroy_buffers(struct iris_inst *inst)
+{
+	struct iris_buffer *buf, *dummy;
+	struct iris_buffers *buffers;
+
+	static const enum iris_buffer_type ext_buf_types[] = {
+		BUF_INPUT,
+		BUF_OUTPUT,
+	};
+	static const enum iris_buffer_type internal_buf_types[] = {
+		BUF_BIN,
+		BUF_COMV,
+		BUF_NON_COMV,
+		BUF_LINE,
+		BUF_DPB,
+		BUF_PERSIST,
+	};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(internal_buf_types); i++) {
+		buffers = iris_get_buffer_list(inst, internal_buf_types[i]);
+		if (!buffers)
+			continue;
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list)
+			iris_destroy_internal_buffer(inst, buf);
+	}
+
+	list_for_each_entry_safe(buf, dummy, &inst->buffers.read_only.list, list) {
+		if (buf->attach && buf->sg_table)
+			dma_buf_unmap_attachment(buf->attach, buf->sg_table, DMA_BIDIRECTIONAL);
+		if (buf->attach && buf->dmabuf)
+			dma_buf_detach(buf->dmabuf, buf->attach);
+		list_del_init(&buf->list);
+		iris_return_buffer_to_pool(inst, buf);
+	}
+
+	for (i = 0; i < ARRAY_SIZE(ext_buf_types); i++) {
+		buffers = iris_get_buffer_list(inst, ext_buf_types[i]);
+		if (!buffers)
+			continue;
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+			if (buf->attach && buf->sg_table)
+				dma_buf_unmap_attachment(buf->attach, buf->sg_table,
+							 DMA_BIDIRECTIONAL);
+			if (buf->attach && buf->dmabuf)
+				dma_buf_detach(buf->dmabuf, buf->attach);
+			list_del_init(&buf->list);
+			iris_return_buffer_to_pool(inst, buf);
+		}
+	}
+
+	iris_mem_pool_deinit(inst);
+}
+
+static int get_num_queued_buffers(struct iris_inst *inst,
+				  enum iris_buffer_type type)
+{
+	struct iris_buffers *buffers;
+	struct iris_buffer *vbuf;
+	int count = 0;
+
+	if (type == BUF_INPUT)
+		buffers = &inst->buffers.input;
+	else if (type == BUF_OUTPUT)
+		buffers = &inst->buffers.output;
+	else
+		return count;
+
+	list_for_each_entry(vbuf, &buffers->list, list) {
+		if (vbuf->type != type)
+			continue;
+		if (!(vbuf->attr & BUF_ATTR_QUEUED))
+			continue;
+		count++;
+	}
+
+	return count;
+}
+
+int session_streamoff(struct iris_inst *inst, u32 plane)
+{
+	enum signal_session_response signal_type;
+	enum iris_buffer_type buffer_type;
+	u32 hw_response_timeout_val;
+	struct iris_core *core;
+	int count = 0;
+	int ret;
+
+	if (plane == INPUT_MPLANE) {
+		signal_type = SIGNAL_CMD_STOP_INPUT;
+		buffer_type = BUF_INPUT;
+	} else if (plane == OUTPUT_MPLANE) {
+		signal_type = SIGNAL_CMD_STOP_OUTPUT;
+		buffer_type = BUF_OUTPUT;
+	} else {
+		return -EINVAL;
+	}
+
+	ret = iris_hfi_stop(inst, plane);
+	if (ret)
+		goto error;
+
+	core = inst->core;
+	hw_response_timeout_val = core->cap[HW_RESPONSE_TIMEOUT].value;
+	mutex_unlock(&inst->lock);
+	ret = wait_for_completion_timeout(&inst->completions[signal_type],
+					  msecs_to_jiffies(hw_response_timeout_val));
+	if (!ret) {
+		ret = -ETIMEDOUT;
+		process_inst_timeout(inst);
+	} else {
+		ret = 0;
+	}
+	mutex_lock(&inst->lock);
+
+	if (ret)
+		goto error;
+
+	if (plane == INPUT_MPLANE)
+		iris_flush_input_timer(inst);
+
+	/* no more queued buffers after streamoff */
+	count = get_num_queued_buffers(inst, buffer_type);
+	if (count) {
+		ret = -EINVAL;
+		goto error;
+	}
+
+	ret = iris_inst_state_change_streamoff(inst, plane);
+	if (ret)
+		goto error;
+
+	iris_flush_deferred_buffers(inst, buffer_type);
+	iris_flush_read_only_buffers(inst, buffer_type);
+	return 0;
+
+error:
+	kill_session(inst);
+	iris_flush_deferred_buffers(inst, buffer_type);
+	iris_flush_read_only_buffers(inst, buffer_type);
+
+	return ret;
+}
+
+int process_resume(struct iris_inst *inst)
+{
+	enum iris_inst_sub_state clear_sub_state = IRIS_INST_SUB_NONE;
+	int ret;
+
+	if (inst->sub_state & IRIS_INST_SUB_DRC &&
+	    inst->sub_state & IRIS_INST_SUB_DRC_LAST) {
+		clear_sub_state = IRIS_INST_SUB_DRC | IRIS_INST_SUB_DRC_LAST;
+
+		if (inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE) {
+			ret = iris_hfi_resume(inst, INPUT_MPLANE, HFI_CMD_SETTINGS_CHANGE);
+			if (ret)
+				return ret;
+			clear_sub_state |= IRIS_INST_SUB_INPUT_PAUSE;
+		}
+		if (inst->sub_state & IRIS_INST_SUB_OUTPUT_PAUSE) {
+			ret = iris_hfi_resume(inst, OUTPUT_MPLANE, HFI_CMD_SETTINGS_CHANGE);
+			if (ret)
+				return ret;
+			clear_sub_state |= IRIS_INST_SUB_OUTPUT_PAUSE;
+		}
+	} else if (inst->sub_state & IRIS_INST_SUB_DRAIN &&
+		   inst->sub_state & IRIS_INST_SUB_DRAIN_LAST) {
+		clear_sub_state = IRIS_INST_SUB_DRAIN | IRIS_INST_SUB_DRAIN_LAST;
+		if (inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE) {
+			ret = iris_hfi_resume(inst, INPUT_MPLANE, HFI_CMD_DRAIN);
+			if (ret)
+				return ret;
+			clear_sub_state |= IRIS_INST_SUB_INPUT_PAUSE;
+		}
+		if (inst->sub_state & IRIS_INST_SUB_OUTPUT_PAUSE) {
+			ret = iris_hfi_resume(inst, OUTPUT_MPLANE, HFI_CMD_DRAIN);
+			if (ret)
+				return ret;
+			clear_sub_state |= IRIS_INST_SUB_OUTPUT_PAUSE;
+		}
+	}
+
+	ret = iris_inst_change_sub_state(inst, clear_sub_state, 0);
+
+	return ret;
+}
+
+int codec_change(struct iris_inst *inst, u32 v4l2_codec)
+{
+	bool session_init = false;
+	int ret;
+
+	if (!inst->codec)
+		session_init = true;
+
+	if (inst->codec &&
+	    ((inst->domain == DECODER && inst->fmt_src->fmt.pix_mp.pixelformat == v4l2_codec) ||
+	     (inst->domain == ENCODER && inst->fmt_dst->fmt.pix_mp.pixelformat == v4l2_codec)))
+		return 0;
+
+	inst->codec = v4l2_codec_to_driver(inst, v4l2_codec);
+	if (!inst->codec)
+		return -EINVAL;
+
+	if (inst->domain == DECODER)
+		inst->fmt_src->fmt.pix_mp.pixelformat = v4l2_codec;
+	else if (inst->domain == ENCODER)
+		inst->fmt_dst->fmt.pix_mp.pixelformat = v4l2_codec;
+
+	ret = get_inst_capability(inst);
+	if (ret)
+		return ret;
+
+	ret = ctrls_init(inst, session_init);
+	if (ret)
+		return ret;
+
+	ret = update_buffer_count(inst, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = update_buffer_count(inst, OUTPUT_MPLANE);
+
+	return ret;
+}
+
+int process_streamon_input(struct iris_inst *inst)
+{
+	enum iris_inst_sub_state set_sub_state = IRIS_INST_SUB_NONE;
+	int ret;
+
+	iris_scale_power(inst);
+
+	ret = iris_hfi_start(inst, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	if (inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE) {
+		ret = iris_inst_change_sub_state(inst, IRIS_INST_SUB_INPUT_PAUSE, 0);
+		if (ret)
+			return ret;
+	}
+
+	if (inst->sub_state & IRIS_INST_SUB_DRC ||
+	    inst->sub_state & IRIS_INST_SUB_DRAIN) {
+		if (!(inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE)) {
+			ret = iris_hfi_pause(inst, INPUT_MPLANE);
+			if (ret)
+				return ret;
+			set_sub_state = IRIS_INST_SUB_INPUT_PAUSE;
+		}
+	}
+
+	ret = iris_inst_state_change_streamon(inst, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = iris_inst_change_sub_state(inst, 0, set_sub_state);
+
+	return ret;
+}
+
+int process_streamon_output(struct iris_inst *inst)
+{
+	enum iris_inst_sub_state clear_sub_state = IRIS_INST_SUB_NONE;
+	bool drain_pending = false;
+	bool drc_pending = false;
+	int ret;
+
+	iris_scale_power(inst);
+
+	drc_pending = inst->sub_state & IRIS_INST_SUB_DRC &&
+	    inst->sub_state & IRIS_INST_SUB_DRC_LAST;
+
+	drain_pending = inst->sub_state & IRIS_INST_SUB_DRAIN &&
+		inst->sub_state & IRIS_INST_SUB_DRAIN_LAST;
+
+	if (drc_pending) {
+		clear_sub_state = IRIS_INST_SUB_DRC | IRIS_INST_SUB_DRC_LAST;
+	} else if (drain_pending) {
+		clear_sub_state = IRIS_INST_SUB_DRAIN_LAST | IRIS_INST_SUB_DRAIN;
+	}
+
+	if (inst->domain == DECODER && inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE) {
+		ret = iris_alloc_and_queue_input_int_bufs(inst);
+		if (ret)
+			return ret;
+		ret = set_stage(inst, STAGE);
+		if (ret)
+			return ret;
+		ret = set_pipe(inst, PIPE);
+		if (ret)
+			return ret;
+	}
+
+	if ((inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE) &&
+		(inst->state == IRIS_INST_INPUT_STREAMING)) {
+		if (!drain_pending) {
+			ret = iris_hfi_resume(inst, INPUT_MPLANE, HFI_CMD_SETTINGS_CHANGE);
+			if (ret)
+				return ret;
+		} else {
+			ret = iris_hfi_resume(inst, INPUT_MPLANE, HFI_CMD_DRAIN);
+			if (ret)
+				return ret;
+		}
+		clear_sub_state |= IRIS_INST_SUB_INPUT_PAUSE;
+	}
+
+	ret = iris_hfi_start(inst, OUTPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	if (inst->sub_state & IRIS_INST_SUB_OUTPUT_PAUSE)
+		clear_sub_state |= IRIS_INST_SUB_OUTPUT_PAUSE;
+
+	ret = iris_inst_state_change_streamon(inst, OUTPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = iris_inst_change_sub_state(inst, clear_sub_state, 0);
+
+	return ret;
+}
+
+int vb2_buffer_to_driver(struct vb2_buffer *vb2, struct iris_buffer *buf)
+{
+	struct vb2_v4l2_buffer *vbuf;
+
+	if (!vb2 || !buf)
+		return -EINVAL;
+
+	vbuf = to_vb2_v4l2_buffer(vb2);
+
+	buf->fd = vb2->planes[0].m.fd;
+	buf->data_offset = vb2->planes[0].data_offset;
+	buf->data_size = vb2->planes[0].bytesused - vb2->planes[0].data_offset;
+	buf->buffer_size = vb2->planes[0].length;
+	buf->timestamp = vb2->timestamp;
+	buf->flags = vbuf->flags;
+	buf->attr = 0;
+
+	return 0;
+}
+
+int iris_pm_get(struct iris_core *core)
+{
+	int ret = 0;
+
+	mutex_lock(&core->lock);
+	if (core->num_pending_requests++ == 0)
+		ret = pm_runtime_resume_and_get(core->dev);
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_pm_put(struct iris_core *core, bool autosuspend)
+{
+	int ret = 0;
+
+	mutex_lock(&core->lock);
+
+	if (--core->num_pending_requests == 0) {
+		if (autosuspend) {
+			pm_runtime_mark_last_busy(core->dev);
+			ret = pm_runtime_put_autosuspend(core->dev);
+		} else {
+			ret = pm_runtime_put_sync(core->dev);
+		}
+	}
+	if (ret > 0)
+		ret = 0;
+
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_pm_get_put(struct iris_core *core)
+{
+	int ret = 0;
+
+	mutex_lock(&core->lock);
+
+	if (pm_runtime_suspended(core->dev)) {
+		if (core->num_pending_requests++ == 0) {
+			ret = pm_runtime_resume_and_get(core->dev);
+			if (ret < 0)
+				goto error;
+		}
+
+		if (--core->num_pending_requests == 0)
+			ret = pm_runtime_put_autosuspend(core->dev);
+	}
+	if (ret > 0)
+		ret = 0;
+
+error:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+void iris_pm_touch(struct iris_core *core)
+{
+	mutex_lock(&core->lock);
+	iris_pm_touch_unlocked(core);
+	mutex_unlock(&core->lock);
+}
+
+void iris_pm_touch_unlocked(struct iris_core *core)
+{
+	pm_runtime_mark_last_busy(core->dev);
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_helpers.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_helpers.h
@@ -0,0 +1,70 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_HELPERS_H_
+#define _IRIS_HELPERS_H_
+
+#include <linux/align.h>
+#include <linux/types.h>
+
+#include "iris_instance.h"
+#include "iris_buffer.h"
+#include "iris_instance.h"
+#include "platform_common.h"
+
+#define NUM_MBS_PER_FRAME(__height, __width) \
+	((ALIGN(__height, 16) / 16) * (ALIGN(__width, 16) / 16))
+
+int check_core_lock(struct iris_core *core);
+bool res_is_less_than(u32 width, u32 height,
+		      u32 ref_width, u32 ref_height);
+u32 get_port_info(struct iris_inst *inst,
+		  enum plat_inst_cap_type cap_id);
+enum iris_buffer_type v4l2_type_to_driver(u32 type);
+u32 v4l2_type_from_driver(enum iris_buffer_type buffer_type);
+void v4l2_to_hfi_enum(struct iris_inst *inst,
+		      enum plat_inst_cap_type cap_id, u32 *value);
+int get_mbpf(struct iris_inst *inst);
+int close_session(struct iris_inst *inst);
+
+bool is_linear_colorformat(u32 colorformat);
+bool is_10bit_colorformat(enum colorformat_type colorformat);
+bool is_8bit_colorformat(enum colorformat_type colorformat);
+bool is_scaling_enabled(struct iris_inst *inst);
+bool is_split_mode_enabled(struct iris_inst *inst);
+bool is_hierb_type_requested(struct iris_inst *inst);
+int signal_session_msg_receipt(struct iris_inst *inst,
+			       enum signal_session_response cmd);
+struct iris_inst *to_instance(struct iris_core *core, u32 session_id);
+
+u32 v4l2_codec_from_driver(struct iris_inst *inst, enum codec_type codec);
+enum codec_type v4l2_codec_to_driver(struct iris_inst *inst, u32 v4l2_codec);
+u32 v4l2_colorformat_from_driver(struct iris_inst *inst, enum colorformat_type colorformat);
+enum colorformat_type v4l2_colorformat_to_driver(struct iris_inst *inst, u32 v4l2_colorformat);
+struct vb2_queue *get_vb2q(struct iris_inst *inst, u32 type);
+int check_core_mbps_mbpf(struct iris_inst *inst);
+int check_session_supported(struct iris_inst *inst);
+
+struct iris_buffer *get_driver_buf(struct iris_inst *inst, u32 plane, u32 index);
+int queue_buffer(struct iris_inst *inst, struct iris_buffer *buf);
+int queue_deferred_buffers(struct iris_inst *inst, enum iris_buffer_type buf_type);
+int iris_vb2_buffer_done(struct iris_inst *inst,
+			 struct iris_buffer *buf);
+int iris_release_nonref_buffers(struct iris_inst *inst);
+void iris_destroy_buffers(struct iris_inst *inst);
+int session_streamoff(struct iris_inst *inst, u32 plane);
+int process_resume(struct iris_inst *inst);
+int codec_change(struct iris_inst *inst, u32 v4l2_codec);
+int process_streamon_input(struct iris_inst *inst);
+int process_streamon_output(struct iris_inst *inst);
+int vb2_buffer_to_driver(struct vb2_buffer *vb2,
+			 struct iris_buffer *buf);
+int iris_pm_get(struct iris_core *core);
+int iris_pm_put(struct iris_core *core, bool autosuspend);
+int iris_pm_get_put(struct iris_core *core);
+void iris_pm_touch(struct iris_core *core);
+void iris_pm_touch_unlocked(struct iris_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_hfi.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_hfi.c
@@ -0,0 +1,884 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "firmware.h"
+#include "hfi_defines.h"
+#include "iris_helpers.h"
+#include "iris_hfi.h"
+#include "iris_hfi_packet.h"
+#include "iris_hfi_response.h"
+#include "iris_helpers.h"
+#include "vpu_common.h"
+
+static bool __valdiate_session(struct iris_core *core,
+			       struct iris_inst *inst)
+{
+	struct iris_inst *temp;
+	bool valid = false;
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return false;
+
+	list_for_each_entry(temp, &core->instances, list) {
+		if (temp == inst) {
+			valid = true;
+			break;
+		}
+	}
+
+	return valid;
+}
+
+static int iris_power_off(struct iris_core *core)
+{
+	int ret;
+
+	if (!core->power_enabled)
+		return 0;
+
+	ret = call_vpu_op(core, power_off, core);
+	if (ret) {
+		dev_err(core->dev, "Failed to power off, err: %d\n", ret);
+		return ret;
+	}
+	core->power_enabled = false;
+
+	return ret;
+}
+
+static int iris_power_on(struct iris_core *core)
+{
+	int ret;
+
+	if (core->power_enabled)
+		return 0;
+
+	ret = call_vpu_op(core, power_on, core);
+	if (ret) {
+		dev_err(core->dev, "Failed to power on, err: %d\n", ret);
+		return ret;
+	}
+
+	core->power_enabled = true;
+
+	return ret;
+}
+
+static int sys_init(struct iris_core *core)
+{
+	int ret;
+
+	ret = hfi_packet_sys_init(core, core->packet, core->packet_size);
+	if (ret)
+		return ret;
+
+	ret = iris_hfi_queue_cmd_write(core, core->packet);
+
+	return ret;
+}
+
+static int sys_image_version(struct iris_core *core)
+{
+	int ret;
+
+	ret = hfi_packet_image_version(core, core->packet, core->packet_size);
+	if (ret)
+		return ret;
+
+	ret = iris_hfi_queue_cmd_write(core, core->packet);
+
+	return ret;
+}
+
+static int cache_operation_qbuf(struct iris_buffer *buffer)
+{
+	int ret = 0;
+
+	if (buffer->type == BUF_INPUT && buffer->dmabuf) {
+		ret = dma_buf_begin_cpu_access(buffer->dmabuf, DMA_TO_DEVICE);
+		if (ret)
+			return ret;
+
+		ret = dma_buf_end_cpu_access(buffer->dmabuf, DMA_FROM_DEVICE);
+		if (ret)
+			return ret;
+	} else if (buffer->type == BUF_OUTPUT && buffer->dmabuf) {
+		ret = dma_buf_begin_cpu_access(buffer->dmabuf, DMA_FROM_DEVICE);
+		if (ret)
+			return ret;
+
+		ret = dma_buf_end_cpu_access(buffer->dmabuf, DMA_FROM_DEVICE);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+int iris_hfi_core_init(struct iris_core *core)
+{
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return ret;
+
+	ret = iris_hfi_queue_init(core);
+	if (ret)
+		goto error;
+
+	ret = iris_power_on(core);
+	if (ret)
+		goto error;
+
+	ret = iris_fw_load(core);
+	if (ret)
+		goto error_power_off;
+
+	ret = call_vpu_op(core, boot_firmware, core);
+	if (ret)
+		goto error_power_off;
+
+	ret = sys_init(core);
+	if (ret)
+		goto error_power_off;
+
+	ret = sys_image_version(core);
+	if (ret)
+		goto error_power_off;
+
+	return ret;
+
+error_power_off:
+	iris_power_off(core);
+error:
+	dev_err(core->dev, "%s(): failed\n", __func__);
+
+	return ret;
+}
+
+int iris_hfi_core_deinit(struct iris_core *core)
+{
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return ret;
+
+	if (core->state == IRIS_CORE_DEINIT)
+		return 0;
+
+	iris_fw_unload(core);
+	iris_power_off(core);
+
+	return ret;
+}
+
+int iris_hfi_session_open(struct iris_inst *inst)
+{
+	struct iris_core *core;
+	int ret;
+
+	inst->packet_size = 4096;
+	inst->packet = kzalloc(inst->packet_size, GFP_KERNEL);
+	if (!inst->packet)
+		return -ENOMEM;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto fail_free_packet;
+	}
+
+	ret = hfi_packet_session_command(inst,
+					 HFI_CMD_OPEN,
+					 HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+					 HFI_HOST_FLAGS_INTR_REQUIRED,
+					 HFI_PORT_NONE,
+					 0,
+					 HFI_PAYLOAD_U32,
+					 &inst->session_id,
+					 sizeof(u32));
+	if (ret)
+		goto fail_free_packet;
+
+	ret = iris_hfi_queue_cmd_write(core, inst->packet);
+	if (ret)
+		goto fail_free_packet;
+
+	mutex_unlock(&core->lock);
+
+	return ret;
+
+fail_free_packet:
+	kfree(inst->packet);
+	inst->packet = NULL;
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_session_close(struct iris_inst *inst)
+{
+	struct iris_core *core;
+	int ret;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	ret = hfi_packet_session_command(inst,
+					 HFI_CMD_CLOSE,
+					 (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+					 HFI_HOST_FLAGS_INTR_REQUIRED |
+					 HFI_HOST_FLAGS_NON_DISCARDABLE),
+					 HFI_PORT_NONE,
+					 inst->session_id,
+					 HFI_PAYLOAD_NONE,
+					 NULL,
+					 0);
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_session_set_codec(struct iris_inst *inst)
+{
+	struct iris_core *core;
+	int ret;
+	u32 codec;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	codec = get_hfi_codec(inst);
+	ret = hfi_packet_session_property(inst,
+					  HFI_PROP_CODEC,
+					  HFI_HOST_FLAGS_NONE,
+					  HFI_PORT_NONE,
+					  HFI_PAYLOAD_U32_ENUM,
+					  &codec,
+					  sizeof(u32));
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_session_set_default_header(struct iris_inst *inst)
+{
+	struct iris_core *core;
+	u32 default_header = false;
+	int ret;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	default_header = inst->cap[DEFAULT_HEADER].value;
+	ret = hfi_packet_session_property(inst,
+					  HFI_PROP_DEC_DEFAULT_HEADER,
+					  HFI_HOST_FLAGS_NONE,
+					  get_hfi_port(inst, INPUT_MPLANE),
+					  HFI_PAYLOAD_U32,
+					  &default_header,
+					  sizeof(u32));
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_start(struct iris_inst *inst, u32 plane)
+{
+	struct iris_core *core;
+	int ret = 0;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (plane != INPUT_MPLANE && plane != OUTPUT_MPLANE)
+		goto unlock;
+
+	ret = hfi_packet_session_command(inst,
+					 HFI_CMD_START,
+					 (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+					 HFI_HOST_FLAGS_INTR_REQUIRED),
+					 get_hfi_port(inst, plane),
+					 inst->session_id,
+					 HFI_PAYLOAD_NONE,
+					 NULL,
+					 0);
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_stop(struct iris_inst *inst, u32 plane)
+{
+	struct iris_core *core;
+	int ret = 0;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (plane != INPUT_MPLANE && plane != OUTPUT_MPLANE)
+		goto unlock;
+
+	ret = hfi_packet_session_command(inst,
+					 HFI_CMD_STOP,
+					 (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+					 HFI_HOST_FLAGS_INTR_REQUIRED |
+					 HFI_HOST_FLAGS_NON_DISCARDABLE),
+					 get_hfi_port(inst, plane),
+					 inst->session_id,
+					 HFI_PAYLOAD_NONE,
+					 NULL,
+					 0);
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_session_subscribe_mode(struct iris_inst *inst,
+				    u32 cmd, u32 plane, u32 payload_type,
+				    void *payload, u32 payload_size)
+{
+	struct iris_core *core;
+	int ret;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	ret = hfi_packet_session_command(inst,
+					 cmd,
+					 (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+					 HFI_HOST_FLAGS_INTR_REQUIRED),
+					 get_hfi_port(inst, plane),
+					 inst->session_id,
+					 payload_type,
+					 payload,
+					 payload_size);
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_pause(struct iris_inst *inst, u32 plane)
+{
+	struct iris_core *core;
+	int ret = 0;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (plane != INPUT_MPLANE && plane != OUTPUT_MPLANE)
+		goto unlock;
+
+	ret = hfi_packet_session_command(inst,
+					 HFI_CMD_PAUSE,
+					 (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+					 HFI_HOST_FLAGS_INTR_REQUIRED),
+					 get_hfi_port(inst, plane),
+					 inst->session_id,
+					 HFI_PAYLOAD_NONE,
+					 NULL,
+					 0);
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_resume(struct iris_inst *inst, u32 plane, u32 payload)
+{
+	struct iris_core *core;
+	int ret = 0;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (plane != INPUT_MPLANE && plane != OUTPUT_MPLANE)
+		goto unlock;
+
+	ret = hfi_packet_session_command(inst,
+					 HFI_CMD_RESUME,
+					 (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+					 HFI_HOST_FLAGS_INTR_REQUIRED),
+					 get_hfi_port(inst, plane),
+					 inst->session_id,
+					 HFI_PAYLOAD_U32,
+					 &payload,
+					 sizeof(u32));
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_drain(struct iris_inst *inst, u32 plane)
+{
+	struct iris_core *core;
+	int ret = 0;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (plane != INPUT_MPLANE)
+		goto unlock;
+
+	ret = hfi_packet_session_command(inst,
+					 HFI_CMD_DRAIN,
+					 (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+					 HFI_HOST_FLAGS_INTR_REQUIRED |
+					 HFI_HOST_FLAGS_NON_DISCARDABLE),
+					 get_hfi_port(inst, plane),
+					 inst->session_id,
+					 HFI_PAYLOAD_NONE,
+					 NULL,
+					 0);
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+irqreturn_t iris_hfi_isr(int irq, void *data)
+{
+	disable_irq_nosync(irq);
+
+	return IRQ_WAKE_THREAD;
+}
+
+irqreturn_t iris_hfi_isr_handler(int irq, void *data)
+{
+	struct iris_core *core = data;
+	int ret;
+
+	if (!core)
+		return IRQ_NONE;
+
+	iris_pm_touch(core);
+	ret = iris_pm_get(core);
+	if (ret)
+		goto exit;
+
+	mutex_lock(&core->lock);
+	call_vpu_op(core, clear_interrupt, core);
+	mutex_unlock(&core->lock);
+
+	__response_handler(core);
+
+	iris_pm_put(core, true);
+
+exit:
+	if (!call_vpu_op(core, watchdog, core, core->intr_status))
+		enable_irq(irq);
+
+	return IRQ_HANDLED;
+}
+
+int iris_hfi_set_property(struct iris_inst *inst,
+			  u32 packet_type, u32 flag, u32 plane, u32 payload_type,
+			  void *payload, u32 payload_size)
+{
+	struct iris_core *core;
+	int ret;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	ret = hfi_packet_session_property(inst,
+					  packet_type,
+					  flag,
+					  plane,
+					  payload_type,
+					  payload,
+					  payload_size);
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_set_ir_period(struct iris_inst *inst,
+			   u32 packet_type, u32 flag, u32 plane, u32 payload_type,
+			   void *payload, u32 payload_size)
+{
+	u32 sync_frame_req = 0;
+	struct iris_core *core;
+	int ret;
+
+	core = inst->core;
+
+	mutex_lock(&core->lock);
+
+	ret = hfi_create_header(inst->packet, inst->packet_size,
+				inst->session_id, core->header_id++);
+	if (ret)
+		goto exit;
+
+	if (!inst->ir_enabled) {
+		inst->ir_enabled = ((*(u32 *)payload > 0) ? true : false);
+		if (inst->ir_enabled && inst->vb2q_dst->streaming) {
+			sync_frame_req = HFI_SYNC_FRAME_REQUEST_WITH_PREFIX_SEQ_HDR;
+			ret = hfi_create_packet(inst->packet, inst->packet_size,
+						HFI_PROP_REQUEST_SYNC_FRAME,
+						HFI_HOST_FLAGS_NONE,
+						HFI_PAYLOAD_U32_ENUM,
+						HFI_PORT_BITSTREAM,
+						core->packet_id++,
+						&sync_frame_req,
+						sizeof(u32));
+			if (ret)
+				goto exit;
+		}
+	}
+
+	ret = hfi_create_packet(inst->packet, inst->packet_size,
+				packet_type,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_U32,
+				plane,
+				core->packet_id++,
+				payload,
+				sizeof(u32));
+	if (ret)
+		goto exit;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+exit:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_queue_buffer(struct iris_inst *inst,
+			  struct iris_buffer *buffer)
+{
+	struct hfi_buffer hfi_buffer;
+	struct iris_core *core;
+	int ret;
+
+	if (!inst->packet)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	ret = get_hfi_buffer(inst, buffer, &hfi_buffer);
+	if (ret)
+		goto unlock;
+
+	ret = cache_operation_qbuf(buffer);
+	if (ret)
+		goto unlock;
+
+	ret = hfi_packet_session_command(inst,
+					 HFI_CMD_BUFFER,
+					 HFI_HOST_FLAGS_INTR_REQUIRED,
+					 get_hfi_port_from_buffer_type(inst, buffer->type),
+					 inst->session_id,
+					 HFI_PAYLOAD_STRUCTURE,
+					 &hfi_buffer,
+					 sizeof(hfi_buffer));
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int iris_hfi_release_buffer(struct iris_inst *inst,
+			    struct iris_buffer *buffer)
+{
+	struct hfi_buffer hfi_buffer;
+	struct iris_core *core;
+	int ret;
+
+	if (!inst->packet || !buffer)
+		return -EINVAL;
+
+	core = inst->core;
+	mutex_lock(&core->lock);
+
+	if (!__valdiate_session(core, inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	ret = get_hfi_buffer(inst, buffer, &hfi_buffer);
+	if (ret)
+		goto unlock;
+
+	hfi_buffer.flags |= HFI_BUF_HOST_FLAG_RELEASE;
+
+	ret = hfi_packet_session_command(inst,
+					 HFI_CMD_BUFFER,
+					 (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+					 HFI_HOST_FLAGS_INTR_REQUIRED),
+					 get_hfi_port_from_buffer_type(inst, buffer->type),
+					 inst->session_id,
+					 HFI_PAYLOAD_STRUCTURE,
+					 &hfi_buffer,
+					 sizeof(hfi_buffer));
+	if (ret)
+		goto unlock;
+
+	ret = iris_hfi_queue_cmd_write(inst->core, inst->packet);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+int prepare_pc(struct iris_core *core)
+{
+	int ret;
+
+	ret = hfi_packet_sys_pc_prep(core, core->packet, core->packet_size);
+	if (ret)
+		goto err_pc_prep;
+
+	ret = iris_hfi_queue_cmd_write(core, core->packet);
+	if (ret)
+		goto err_pc_prep;
+
+	return ret;
+
+err_pc_prep:
+	dev_err(core->dev, "Failed to prepare venus for power off\n");
+
+	return ret;
+}
+
+int iris_hfi_pm_suspend(struct iris_core *core)
+{
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return ret;
+
+	if (!core_in_valid_state(core))
+		return -EINVAL;
+
+	if (!core->power_enabled)
+		return 0;
+
+	if (core->skip_pc_count >= MAX_PC_SKIP_COUNT) {
+		dev_err(core->dev, "Failed to PC for %d times\n", core->skip_pc_count);
+		core->skip_pc_count = 0;
+		iris_change_core_state(core, IRIS_CORE_ERROR);
+		iris_core_deinit_locked(core);
+		return -EINVAL;
+	}
+
+	iris_flush_debug_queue(core, core->packet, core->packet_size);
+
+	ret = call_vpu_op(core, prepare_pc, core);
+	if (ret) {
+		core->skip_pc_count++;
+		iris_pm_touch_unlocked(core);
+		return -EAGAIN;
+	}
+
+	ret = iris_set_hw_state(core, false);
+	if (ret)
+		return ret;
+
+	ret = iris_power_off(core);
+	if (ret)
+		return ret;
+
+	core->skip_pc_count = 0;
+
+	return ret;
+}
+
+int iris_hfi_pm_resume(struct iris_core *core)
+{
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return ret;
+
+	if (!core_in_valid_state(core))
+		return -EINVAL;
+
+	if (core->power_enabled)
+		return 0;
+
+	ret = iris_power_on(core);
+	if (ret)
+		goto error;
+
+	ret = iris_set_hw_state(core, true);
+	if (ret)
+		goto err_power_off;
+
+	ret = call_vpu_op(core, boot_firmware, core);
+	if (ret)
+		goto err_suspend_hw;
+
+	ret = hfi_packet_sys_interframe_powercollapse(core, core->packet, core->packet_size);
+	if (ret)
+		goto err_suspend_hw;
+
+	ret = iris_hfi_queue_cmd_write(core, core->packet);
+	if (ret)
+		goto err_suspend_hw;
+
+	return ret;
+
+err_suspend_hw:
+	iris_set_hw_state(core, false);
+err_power_off:
+	iris_power_off(core);
+error:
+	dev_err(core->dev, "Failed to Resume\n");
+
+	return -EBUSY;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_hfi.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_hfi.h
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_HFI_H_
+#define _IRIS_HFI_H_
+
+#include "iris_instance.h"
+#include "iris_core.h"
+
+#define MAX_PC_SKIP_COUNT 10
+
+int iris_hfi_core_init(struct iris_core *core);
+int iris_hfi_core_deinit(struct iris_core *core);
+int iris_hfi_session_open(struct iris_inst *inst);
+int iris_hfi_session_close(struct iris_inst *inst);
+int iris_hfi_session_subscribe_mode(struct iris_inst *inst,
+				    u32 cmd, u32 plane, u32 payload_type,
+				    void *payload, u32 payload_size);
+int iris_hfi_set_property(struct iris_inst *inst,
+			  u32 packet_type, u32 flag, u32 plane, u32 payload_type,
+			  void *payload, u32 payload_size);
+
+int iris_hfi_session_set_codec(struct iris_inst *inst);
+int iris_hfi_session_set_default_header(struct iris_inst *inst);
+
+int iris_hfi_start(struct iris_inst *inst, u32 plane);
+int iris_hfi_stop(struct iris_inst *inst, u32 plane);
+int iris_hfi_drain(struct iris_inst *inst, u32 plane);
+int iris_hfi_pause(struct iris_inst *inst, u32 plane);
+int iris_hfi_resume(struct iris_inst *inst, u32 plane, u32 cmd);
+int iris_hfi_queue_buffer(struct iris_inst *inst,
+			  struct iris_buffer *buffer);
+int iris_hfi_release_buffer(struct iris_inst *inst,
+			    struct iris_buffer *buffer);
+int iris_hfi_pm_suspend(struct iris_core *core);
+int iris_hfi_pm_resume(struct iris_core *core);
+int prepare_pc(struct iris_core *core);
+
+irqreturn_t iris_hfi_isr(int irq, void *data);
+irqreturn_t iris_hfi_isr_handler(int irq, void *data);
+int iris_hfi_set_ir_period(struct iris_inst *inst,
+			   u32 packet_type, u32 flag, u32 plane, u32 payload_type,
+			   void *payload, u32 payload_size);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_hfi_packet.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_hfi_packet.c
@@ -0,0 +1,726 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_common.h"
+#include "iris_core.h"
+#include "iris_helpers.h"
+#include "iris_hfi_packet.h"
+#include "hfi_defines.h"
+
+u32 get_hfi_port_from_buffer_type(struct iris_inst *inst, enum iris_buffer_type buffer_type)
+{
+	u32 hfi_port = HFI_PORT_NONE;
+
+	if (inst->domain == DECODER) {
+		switch (buffer_type) {
+		case BUF_INPUT:
+		case BUF_BIN:
+		case BUF_COMV:
+		case BUF_NON_COMV:
+		case BUF_LINE:
+			hfi_port = HFI_PORT_BITSTREAM;
+			break;
+		case BUF_OUTPUT:
+		case BUF_DPB:
+			hfi_port = HFI_PORT_RAW;
+			break;
+		case BUF_PERSIST:
+			hfi_port = HFI_PORT_NONE;
+			break;
+		default:
+			break;
+		}
+	} else if (inst->domain == ENCODER) {
+		switch (buffer_type) {
+		case BUF_INPUT:
+		case BUF_VPSS:
+			hfi_port = HFI_PORT_RAW;
+			break;
+		case BUF_OUTPUT:
+		case BUF_BIN:
+		case BUF_COMV:
+		case BUF_NON_COMV:
+		case BUF_LINE:
+		case BUF_DPB:
+			hfi_port = HFI_PORT_BITSTREAM;
+			break;
+		case BUF_ARP:
+			hfi_port = HFI_PORT_NONE;
+			break;
+		default:
+			break;
+		}
+	}
+
+	return hfi_port;
+}
+
+u32 get_hfi_port(struct iris_inst *inst, u32 plane)
+{
+	u32 hfi_port = HFI_PORT_NONE;
+
+	if (inst->domain == DECODER) {
+		switch (plane) {
+		case INPUT_MPLANE:
+			hfi_port = HFI_PORT_BITSTREAM;
+			break;
+		case OUTPUT_MPLANE:
+			hfi_port = HFI_PORT_RAW;
+			break;
+		default:
+			break;
+		}
+	} else if (inst->domain == ENCODER) {
+		switch (plane) {
+		case INPUT_MPLANE:
+			hfi_port = HFI_PORT_RAW;
+			break;
+		case OUTPUT_MPLANE:
+			hfi_port = HFI_PORT_BITSTREAM;
+			break;
+		default:
+			break;
+		}
+	}
+
+	return hfi_port;
+}
+
+static u32 hfi_buf_type_from_driver(enum domain_type domain, enum iris_buffer_type buffer_type)
+{
+	switch (buffer_type) {
+	case BUF_INPUT:
+		if (domain == DECODER)
+			return HFI_BUFFER_BITSTREAM;
+		else
+			return HFI_BUFFER_RAW;
+	case BUF_OUTPUT:
+		if (domain == DECODER)
+			return HFI_BUFFER_RAW;
+		else
+			return HFI_BUFFER_BITSTREAM;
+	case BUF_BIN:
+		return HFI_BUFFER_BIN;
+	case BUF_ARP:
+		return HFI_BUFFER_ARP;
+	case BUF_COMV:
+		return HFI_BUFFER_COMV;
+	case BUF_NON_COMV:
+		return HFI_BUFFER_NON_COMV;
+	case BUF_LINE:
+		return HFI_BUFFER_LINE;
+	case BUF_DPB:
+		return HFI_BUFFER_DPB;
+	case BUF_PERSIST:
+		return HFI_BUFFER_PERSIST;
+	default:
+		return 0;
+	}
+}
+
+u32 hfi_buf_type_to_driver(enum domain_type domain, enum hfi_buffer_type buf_type)
+{
+	switch (buf_type) {
+	case HFI_BUFFER_BITSTREAM:
+		if (domain == DECODER)
+			return BUF_INPUT;
+		else
+			return BUF_OUTPUT;
+	case HFI_BUFFER_RAW:
+		if (domain == DECODER)
+			return BUF_OUTPUT;
+		else
+			return BUF_INPUT;
+	case HFI_BUFFER_BIN:
+		return BUF_BIN;
+	case HFI_BUFFER_ARP:
+		return BUF_ARP;
+	case HFI_BUFFER_COMV:
+		return BUF_COMV;
+	case HFI_BUFFER_NON_COMV:
+		return BUF_NON_COMV;
+	case HFI_BUFFER_LINE:
+		return BUF_LINE;
+	case HFI_BUFFER_DPB:
+		return BUF_DPB;
+	case HFI_BUFFER_PERSIST:
+		return BUF_PERSIST;
+	case HFI_BUFFER_VPSS:
+		return BUF_VPSS;
+	default:
+		return 0;
+	}
+}
+
+u32 get_hfi_codec(struct iris_inst *inst)
+{
+	switch (inst->codec) {
+	case H264:
+		if (inst->domain == ENCODER)
+			return HFI_CODEC_ENCODE_AVC;
+		else
+			return HFI_CODEC_DECODE_AVC;
+	case HEVC:
+		if (inst->domain == ENCODER)
+			return HFI_CODEC_ENCODE_HEVC;
+		else
+			return HFI_CODEC_DECODE_HEVC;
+	case VP9:
+		return HFI_CODEC_DECODE_VP9;
+	default:
+		return 0;
+	}
+}
+
+u32 get_hfi_colorformat(u32 colorformat)
+{
+	u32 hfi_colorformat = HFI_COLOR_FMT_NV12_UBWC;
+
+	switch (colorformat) {
+	case V4L2_PIX_FMT_NV12:
+		hfi_colorformat = HFI_COLOR_FMT_NV12;
+		break;
+	case V4L2_PIX_FMT_QC08C:
+		hfi_colorformat = HFI_COLOR_FMT_NV12_UBWC;
+		break;
+	case V4L2_PIX_FMT_QC10C:
+		hfi_colorformat = HFI_COLOR_FMT_TP10_UBWC;
+		break;
+	default:
+		break;
+	}
+
+	return hfi_colorformat;
+}
+
+u32 get_hfi_color_primaries(u32 primaries)
+{
+	u32 hfi_primaries = HFI_PRIMARIES_RESERVED;
+
+	switch (primaries) {
+	case V4L2_COLORSPACE_DEFAULT:
+		hfi_primaries = HFI_PRIMARIES_RESERVED;
+		break;
+	case V4L2_COLORSPACE_REC709:
+		hfi_primaries = HFI_PRIMARIES_BT709;
+		break;
+	case V4L2_COLORSPACE_470_SYSTEM_M:
+		hfi_primaries = HFI_PRIMARIES_BT470_SYSTEM_M;
+		break;
+	case V4L2_COLORSPACE_470_SYSTEM_BG:
+		hfi_primaries = HFI_PRIMARIES_BT470_SYSTEM_BG;
+		break;
+	case V4L2_COLORSPACE_SMPTE170M:
+		hfi_primaries = HFI_PRIMARIES_BT601_525;
+		break;
+	case V4L2_COLORSPACE_SMPTE240M:
+		hfi_primaries = HFI_PRIMARIES_SMPTE_ST240M;
+		break;
+	case V4L2_COLORSPACE_BT2020:
+		hfi_primaries = HFI_PRIMARIES_BT2020;
+		break;
+	case V4L2_COLORSPACE_DCI_P3:
+		hfi_primaries = HFI_PRIMARIES_SMPTE_RP431_2;
+		break;
+	default:
+		break;
+	}
+
+	return hfi_primaries;
+}
+
+u32 get_hfi_transer_char(u32 characterstics)
+{
+	u32 hfi_characterstics = HFI_TRANSFER_RESERVED;
+
+	switch (characterstics) {
+	case V4L2_XFER_FUNC_DEFAULT:
+		hfi_characterstics = HFI_TRANSFER_RESERVED;
+		break;
+	case V4L2_XFER_FUNC_709:
+		hfi_characterstics = HFI_TRANSFER_BT709;
+		break;
+	case V4L2_XFER_FUNC_SMPTE240M:
+		hfi_characterstics = HFI_TRANSFER_SMPTE_ST240M;
+		break;
+	case V4L2_XFER_FUNC_SRGB:
+		hfi_characterstics = HFI_TRANSFER_SRGB_SYCC;
+		break;
+	case V4L2_XFER_FUNC_SMPTE2084:
+		hfi_characterstics = HFI_TRANSFER_SMPTE_ST2084_PQ;
+		break;
+	default:
+		break;
+	}
+
+	return hfi_characterstics;
+}
+
+u32 get_hfi_matrix_coefficients(u32 coefficients)
+{
+	u32 hfi_coefficients = HFI_MATRIX_COEFF_RESERVED;
+
+	switch (coefficients) {
+	case V4L2_YCBCR_ENC_DEFAULT:
+		hfi_coefficients = HFI_MATRIX_COEFF_RESERVED;
+		break;
+	case V4L2_YCBCR_ENC_709:
+		hfi_coefficients = HFI_MATRIX_COEFF_BT709;
+		break;
+	case V4L2_YCBCR_ENC_XV709:
+		hfi_coefficients = HFI_MATRIX_COEFF_BT709;
+		break;
+	case V4L2_YCBCR_ENC_XV601:
+		hfi_coefficients = HFI_MATRIX_COEFF_BT470_SYS_BG_OR_BT601_625;
+		break;
+	case V4L2_YCBCR_ENC_601:
+		hfi_coefficients = HFI_MATRIX_COEFF_BT601_525_BT1358_525_OR_625;
+		break;
+	case V4L2_YCBCR_ENC_SMPTE240M:
+		hfi_coefficients = HFI_MATRIX_COEFF_SMPTE_ST240;
+		break;
+	case V4L2_YCBCR_ENC_BT2020:
+		hfi_coefficients = HFI_MATRIX_COEFF_BT2020_NON_CONSTANT;
+		break;
+	case V4L2_YCBCR_ENC_BT2020_CONST_LUM:
+		hfi_coefficients = HFI_MATRIX_COEFF_BT2020_CONSTANT;
+		break;
+	default:
+		break;
+	}
+
+	return hfi_coefficients;
+}
+
+u32 get_v4l2_color_primaries(u32 hfi_primaries)
+{
+	u32 primaries = V4L2_COLORSPACE_DEFAULT;
+
+	switch (hfi_primaries) {
+	case HFI_PRIMARIES_RESERVED:
+		primaries = V4L2_COLORSPACE_DEFAULT;
+		break;
+	case HFI_PRIMARIES_BT709:
+		primaries = V4L2_COLORSPACE_REC709;
+		break;
+	case HFI_PRIMARIES_BT470_SYSTEM_M:
+		primaries = V4L2_COLORSPACE_470_SYSTEM_M;
+		break;
+	case HFI_PRIMARIES_BT470_SYSTEM_BG:
+		primaries = V4L2_COLORSPACE_470_SYSTEM_BG;
+		break;
+	case HFI_PRIMARIES_BT601_525:
+		primaries = V4L2_COLORSPACE_SMPTE170M;
+		break;
+	case HFI_PRIMARIES_SMPTE_ST240M:
+		primaries = V4L2_COLORSPACE_SMPTE240M;
+		break;
+	case HFI_PRIMARIES_BT2020:
+		primaries = V4L2_COLORSPACE_BT2020;
+		break;
+	case V4L2_COLORSPACE_DCI_P3:
+		primaries = HFI_PRIMARIES_SMPTE_RP431_2;
+		break;
+	default:
+		break;
+	}
+
+	return primaries;
+}
+
+u32 get_v4l2_transer_char(u32 hfi_characterstics)
+{
+	u32 characterstics = V4L2_XFER_FUNC_DEFAULT;
+
+	switch (hfi_characterstics) {
+	case HFI_TRANSFER_RESERVED:
+		characterstics = V4L2_XFER_FUNC_DEFAULT;
+		break;
+	case HFI_TRANSFER_BT709:
+		characterstics = V4L2_XFER_FUNC_709;
+		break;
+	case HFI_TRANSFER_SMPTE_ST240M:
+		characterstics = V4L2_XFER_FUNC_SMPTE240M;
+		break;
+	case HFI_TRANSFER_SRGB_SYCC:
+		characterstics = V4L2_XFER_FUNC_SRGB;
+		break;
+	case HFI_TRANSFER_SMPTE_ST2084_PQ:
+		characterstics = V4L2_XFER_FUNC_SMPTE2084;
+		break;
+	default:
+		break;
+	}
+
+	return characterstics;
+}
+
+u32 get_v4l2_matrix_coefficients(u32 hfi_coefficients)
+{
+	u32 coefficients = V4L2_YCBCR_ENC_DEFAULT;
+
+	switch (hfi_coefficients) {
+	case HFI_MATRIX_COEFF_RESERVED:
+		coefficients = V4L2_YCBCR_ENC_DEFAULT;
+		break;
+	case HFI_MATRIX_COEFF_BT709:
+		coefficients = V4L2_YCBCR_ENC_709;
+		break;
+	case HFI_MATRIX_COEFF_BT470_SYS_BG_OR_BT601_625:
+		coefficients = V4L2_YCBCR_ENC_XV601;
+		break;
+	case HFI_MATRIX_COEFF_BT601_525_BT1358_525_OR_625:
+		coefficients = V4L2_YCBCR_ENC_601;
+		break;
+	case HFI_MATRIX_COEFF_SMPTE_ST240:
+		coefficients = V4L2_YCBCR_ENC_SMPTE240M;
+		break;
+	case HFI_MATRIX_COEFF_BT2020_NON_CONSTANT:
+		coefficients = V4L2_YCBCR_ENC_BT2020;
+		break;
+	case HFI_MATRIX_COEFF_BT2020_CONSTANT:
+		coefficients = V4L2_YCBCR_ENC_BT2020_CONST_LUM;
+		break;
+	default:
+		break;
+	}
+
+	return coefficients;
+}
+
+int get_hfi_buffer(struct iris_inst *inst,
+		   struct iris_buffer *buffer, struct hfi_buffer *buf)
+{
+	memset(buf, 0, sizeof(struct hfi_buffer));
+	buf->type = hfi_buf_type_from_driver(inst->domain, buffer->type);
+	buf->index = buffer->index;
+	buf->base_address = buffer->device_addr;
+	buf->addr_offset = 0;
+	buf->buffer_size = buffer->buffer_size;
+	/*
+	 * for decoder input buffers, firmware (BSE HW) needs 256 aligned
+	 * buffer size otherwise it will truncate or ignore the data after 256
+	 * aligned size which may lead to error concealment
+	 */
+	if (inst->domain == DECODER && buffer->type == BUF_INPUT)
+		buf->buffer_size = ALIGN(buffer->buffer_size, 256);
+	buf->data_offset = buffer->data_offset;
+	buf->data_size = buffer->data_size;
+	if (buffer->attr & BUF_ATTR_READ_ONLY)
+		buf->flags |= HFI_BUF_HOST_FLAG_READONLY;
+	if (buffer->attr & BUF_ATTR_PENDING_RELEASE)
+		buf->flags |= HFI_BUF_HOST_FLAG_RELEASE;
+	buf->flags |= HFI_BUF_HOST_FLAGS_CB_NON_SECURE;
+	buf->timestamp = buffer->timestamp;
+
+	return 0;
+}
+
+int hfi_create_header(u8 *packet, u32 packet_size, u32 session_id,
+		      u32 header_id)
+{
+	struct hfi_header *hdr = (struct hfi_header *)packet;
+
+	if (!packet || packet_size < sizeof(*hdr))
+		return -EINVAL;
+
+	memset(hdr, 0, sizeof(*hdr));
+
+	hdr->size = sizeof(*hdr);
+	hdr->session_id = session_id;
+	hdr->header_id = header_id;
+	hdr->num_packets = 0;
+
+	return 0;
+}
+
+int hfi_create_packet(u8 *packet, u32 packet_size, u32 pkt_type,
+		      u32 pkt_flags, u32 payload_type, u32 port,
+		      u32 packet_id, void *payload, u32 payload_size)
+{
+	struct hfi_header *hdr;
+	struct hfi_packet *pkt;
+	u32 pkt_size;
+
+	if (!packet)
+		return -EINVAL;
+
+	hdr = (struct hfi_header *)packet;
+	if (hdr->size < sizeof(*hdr))
+		return -EINVAL;
+
+	pkt = (struct hfi_packet *)(packet + hdr->size);
+	pkt_size = sizeof(*pkt) + payload_size;
+	if (packet_size < hdr->size  + pkt_size)
+		return -EINVAL;
+
+	memset(pkt, 0, pkt_size);
+	pkt->size = pkt_size;
+	pkt->type = pkt_type;
+	pkt->flags = pkt_flags;
+	pkt->payload_info = payload_type;
+	pkt->port = port;
+	pkt->packet_id = packet_id;
+	if (payload_size)
+		memcpy((u8 *)pkt + sizeof(*pkt),
+		       payload, payload_size);
+
+	hdr->num_packets++;
+	hdr->size += pkt->size;
+
+	return 0;
+}
+
+int hfi_packet_sys_init(struct iris_core *core,
+			u8 *pkt, u32 pkt_size)
+{
+	u32 payload = 0;
+	int ret;
+
+	ret = hfi_create_header(pkt, pkt_size,
+				0,
+				core->header_id++);
+	if (ret)
+		goto error;
+
+	payload = HFI_VIDEO_ARCH_LX;
+	core->sys_init_id = core->packet_id++;
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_CMD_INIT,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED |
+				HFI_HOST_FLAGS_NON_DISCARDABLE),
+				HFI_PAYLOAD_U32,
+				HFI_PORT_NONE,
+				core->sys_init_id,
+				&payload,
+				sizeof(u32));
+	if (ret)
+		goto error;
+
+	payload = core->platform_data->ubwc_config->max_channels;
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_PROP_UBWC_MAX_CHANNELS,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_U32,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				&payload,
+				sizeof(u32));
+	if (ret)
+		goto error;
+
+	payload = core->platform_data->ubwc_config->mal_length;
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_PROP_UBWC_MAL_LENGTH,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_U32,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				&payload,
+				sizeof(u32));
+	if (ret)
+		goto error;
+
+	payload = core->platform_data->ubwc_config->highest_bank_bit;
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_PROP_UBWC_HBB,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_U32,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				&payload,
+				sizeof(u32));
+	if (ret)
+		goto error;
+
+	payload = core->platform_data->ubwc_config->bank_swzl_level;
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_PROP_UBWC_BANK_SWZL_LEVEL1,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_U32,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				&payload,
+				sizeof(u32));
+	if (ret)
+		goto error;
+
+	payload = core->platform_data->ubwc_config->bank_swz2_level;
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_PROP_UBWC_BANK_SWZL_LEVEL2,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_U32,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				&payload,
+				sizeof(u32));
+	if (ret)
+		goto error;
+
+	payload = core->platform_data->ubwc_config->bank_swz3_level;
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_PROP_UBWC_BANK_SWZL_LEVEL3,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_U32,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				&payload,
+				sizeof(u32));
+	if (ret)
+		goto error;
+
+	payload = core->platform_data->ubwc_config->bank_spreading;
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_PROP_UBWC_BANK_SPREADING,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_U32,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				&payload,
+				sizeof(u32));
+	if (ret)
+		goto error;
+
+	return ret;
+
+error:
+	dev_err(core->dev, "%s: create sys init packet failed\n", __func__);
+
+	return ret;
+}
+
+int hfi_packet_image_version(struct iris_core *core,
+			     u8 *pkt, u32 pkt_size)
+{
+	int ret;
+
+	ret = hfi_create_header(pkt, pkt_size,
+				0,
+				core->header_id++);
+	if (ret)
+		goto error;
+
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_PROP_IMAGE_VERSION,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED |
+				HFI_HOST_FLAGS_GET_PROPERTY),
+				HFI_PAYLOAD_NONE,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				NULL, 0);
+	if (ret)
+		goto error;
+
+	return ret;
+
+error:
+	dev_err(core->dev, "%s: create image version packet failed\n", __func__);
+
+	return ret;
+}
+
+int hfi_packet_session_command(struct iris_inst *inst, u32 pkt_type,
+			       u32 flags, u32 port, u32 session_id,
+			       u32 payload_type, void *payload,
+			       u32 payload_size)
+{
+	struct iris_core *core;
+	int ret;
+
+	core = inst->core;
+
+	ret = hfi_create_header(inst->packet, inst->packet_size,
+				session_id, core->header_id++);
+	if (ret)
+		return ret;
+
+	ret = hfi_create_packet(inst->packet,
+				inst->packet_size,
+				pkt_type,
+				flags,
+				payload_type,
+				port,
+				core->packet_id++,
+				payload,
+				payload_size);
+
+	return ret;
+}
+
+int hfi_packet_session_property(struct iris_inst *inst,
+				u32 pkt_type, u32 flags, u32 port,
+				u32 payload_type, void *payload, u32 payload_size)
+{
+	struct iris_core *core;
+	int ret;
+
+	core = inst->core;
+
+	ret = hfi_create_header(inst->packet, inst->packet_size,
+				inst->session_id, core->header_id++);
+	if (ret)
+		return ret;
+
+	ret = hfi_create_packet(inst->packet, inst->packet_size,
+				pkt_type,
+				flags,
+				payload_type,
+				port,
+				core->packet_id++,
+				payload,
+				payload_size);
+
+	return ret;
+}
+
+int hfi_packet_sys_interframe_powercollapse(struct iris_core *core,
+					    u8 *pkt, u32 pkt_size)
+{
+	u32 payload = 0;
+	int ret;
+
+	ret = hfi_create_header(pkt, pkt_size,
+				0 /*session_id*/,
+				core->header_id++);
+	if (ret)
+		return ret;
+
+	payload = HFI_TRUE;
+
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_PROP_INTRA_FRAME_POWER_COLLAPSE,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_U32,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				&payload,
+				sizeof(u32));
+
+	return ret;
+}
+
+int hfi_packet_sys_pc_prep(struct iris_core *core,
+			   u8 *pkt, u32 pkt_size)
+{
+	int ret;
+
+	ret = hfi_create_header(pkt, pkt_size,
+				0 /*session_id*/,
+				core->header_id++);
+	if (ret)
+		return ret;
+
+	ret = hfi_create_packet(pkt, pkt_size,
+				HFI_CMD_POWER_COLLAPSE,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PAYLOAD_NONE,
+				HFI_PORT_NONE,
+				core->packet_id++,
+				NULL, 0);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_hfi_packet.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_hfi_packet.h
@@ -0,0 +1,118 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_HFI_PACKET_H_
+#define _IRIS_HFI_PACKET_H_
+
+#include "hfi_defines.h"
+#include "iris_core.h"
+#include "iris_instance.h"
+
+struct hfi_header {
+	u32 size;
+	u32 session_id;
+	u32 header_id;
+	u32 reserved[4];
+	u32 num_packets;
+};
+
+struct hfi_packet {
+	u32 size;
+	u32 type;
+	u32 flags;
+	u32 payload_info;
+	u32 port;
+	u32 packet_id;
+	u32 reserved[2];
+};
+
+struct hfi_buffer {
+	u32 type;
+	u32 index;
+	u64 base_address;
+	u32 addr_offset;
+	u32 buffer_size;
+	u32 data_offset;
+	u32 data_size;
+	u64 timestamp;
+	u32 flags;
+	u32 reserved[5];
+};
+
+enum hfi_packet_host_flags {
+	HFI_HOST_FLAGS_NONE			= 0x00000000,
+	HFI_HOST_FLAGS_INTR_REQUIRED		= 0x00000001,
+	HFI_HOST_FLAGS_RESPONSE_REQUIRED	= 0x00000002,
+	HFI_HOST_FLAGS_NON_DISCARDABLE		= 0x00000004,
+	HFI_HOST_FLAGS_GET_PROPERTY		= 0x00000008,
+};
+
+enum hfi_packet_firmware_flags {
+	HFI_FW_FLAGS_NONE		= 0x00000000,
+	HFI_FW_FLAGS_SUCCESS		= 0x00000001,
+	HFI_FW_FLAGS_INFORMATION	= 0x00000002,
+	HFI_FW_FLAGS_SESSION_ERROR	= 0x00000004,
+	HFI_FW_FLAGS_SYSTEM_ERROR	= 0x00000008,
+};
+
+enum hfi_packet_payload_info {
+	HFI_PAYLOAD_NONE	= 0x00000000,
+	HFI_PAYLOAD_U32		= 0x00000001,
+	HFI_PAYLOAD_S32		= 0x00000002,
+	HFI_PAYLOAD_U64		= 0x00000003,
+	HFI_PAYLOAD_S64		= 0x00000004,
+	HFI_PAYLOAD_STRUCTURE	= 0x00000005,
+	HFI_PAYLOAD_BLOB	= 0x00000006,
+	HFI_PAYLOAD_STRING	= 0x00000007,
+	HFI_PAYLOAD_Q16		= 0x00000008,
+	HFI_PAYLOAD_U32_ENUM	= 0x00000009,
+	HFI_PAYLOAD_32_PACKED	= 0x0000000a,
+	HFI_PAYLOAD_U32_ARRAY	= 0x0000000b,
+	HFI_PAYLOAD_S32_ARRAY	= 0x0000000c,
+	HFI_PAYLOAD_64_PACKED	= 0x0000000d,
+};
+
+enum hfi_packet_port_type {
+	HFI_PORT_NONE		= 0x00000000,
+	HFI_PORT_BITSTREAM	= 0x00000001,
+	HFI_PORT_RAW		= 0x00000002,
+};
+
+u32 get_hfi_port_from_buffer_type(struct iris_inst *inst, enum iris_buffer_type buffer_type);
+u32 get_hfi_port(struct iris_inst *inst, u32 plane);
+u32 get_hfi_colorformat(u32 colorformat);
+u32 get_hfi_codec(struct iris_inst *inst);
+u32 get_hfi_color_primaries(u32 primaries);
+u32 get_hfi_transer_char(u32 characterstics);
+u32 get_hfi_matrix_coefficients(u32 coefficients);
+u32 get_v4l2_color_primaries(u32 hfi_primaries);
+u32 get_v4l2_transer_char(u32 hfi_characterstics);
+u32 get_v4l2_matrix_coefficients(u32 hfi_coefficients);
+u32 hfi_buf_type_to_driver(enum domain_type domain, enum hfi_buffer_type buf_type);
+int get_hfi_buffer(struct iris_inst *inst,
+		   struct iris_buffer *buffer, struct hfi_buffer *buf);
+
+int hfi_packet_sys_init(struct iris_core *core,
+			u8 *pkt, u32 pkt_size);
+int hfi_packet_image_version(struct iris_core *core,
+			     u8 *pkt, u32 pkt_size);
+int hfi_packet_session_command(struct iris_inst *inst, u32 pkt_type,
+			       u32 flags, u32 port, u32 session_id,
+			       u32 payload_type, void *payload,
+			       u32 payload_size);
+int hfi_packet_session_property(struct iris_inst *inst,
+				u32 pkt_type, u32 flags, u32 port,
+				u32 payload_type, void *payload, u32 payload_size);
+int hfi_packet_sys_interframe_powercollapse(struct iris_core *core,
+					    u8 *pkt, u32 pkt_size);
+int hfi_packet_sys_pc_prep(struct iris_core *core,
+			   u8 *pkt, u32 pkt_size);
+int hfi_create_header(u8 *packet, u32 packet_size, u32 session_id,
+		      u32 header_id);
+int hfi_create_packet(u8 *packet, u32 packet_size, u32 pkt_type,
+		      u32 pkt_flags, u32 payload_type, u32 port,
+		      u32 packet_id, void *payload, u32 payload_size);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_hfi_queue.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_hfi_queue.c
@@ -0,0 +1,355 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "hfi_defines.h"
+#include "iris_core.h"
+#include "iris_helpers.h"
+#include "iris_hfi_packet.h"
+#include "iris_hfi_queue.h"
+
+static void __set_queue_hdr_defaults(struct hfi_queue_header *q_hdr)
+{
+	q_hdr->qhdr_status = 0x1;
+	q_hdr->qhdr_type = IFACEQ_DFLT_QHDR;
+	q_hdr->qhdr_q_size = IFACEQ_QUEUE_SIZE / 4;
+	q_hdr->qhdr_pkt_size = 0;
+	q_hdr->qhdr_rx_wm = 0x1;
+	q_hdr->qhdr_tx_wm = 0x1;
+	q_hdr->qhdr_rx_req = 0x1;
+	q_hdr->qhdr_tx_req = 0x0;
+	q_hdr->qhdr_rx_irq_status = 0x0;
+	q_hdr->qhdr_tx_irq_status = 0x0;
+	q_hdr->qhdr_read_idx = 0x0;
+	q_hdr->qhdr_write_idx = 0x0;
+}
+
+static int __write_queue(struct iface_q_info *qinfo, void *packet)
+{
+	u32 empty_space, read_idx, write_idx, new_write_idx;
+	struct hfi_queue_header *queue;
+	struct hfi_header *header;
+	u32 packet_size, residue;
+	u32 *write_ptr;
+
+	queue = qinfo->qhdr;
+	if (!queue)
+		return -EINVAL;
+
+	header = packet;
+	packet_size = header->size;
+
+	if (!packet_size || packet_size > qinfo->q_array.size)
+		return -EINVAL;
+
+	read_idx = queue->qhdr_read_idx * sizeof(u32);
+	write_idx = queue->qhdr_write_idx * sizeof(u32);
+
+	empty_space = (write_idx >=  read_idx) ?
+		(qinfo->q_array.size - (write_idx -  read_idx)) :
+		(read_idx - write_idx);
+	if (empty_space <= packet_size) {
+		queue->qhdr_tx_req = 1;
+		return -ENOSPC;
+	}
+
+	queue->qhdr_tx_req =  0;
+
+	new_write_idx = write_idx + packet_size;
+	write_ptr = (u32 *)((u8 *)qinfo->q_array.kernel_vaddr + write_idx);
+
+	if (write_ptr < (u32 *)qinfo->q_array.kernel_vaddr ||
+	    write_ptr > (u32 *)(qinfo->q_array.kernel_vaddr +
+	    qinfo->q_array.size))
+		return -EINVAL;
+
+	if (new_write_idx < qinfo->q_array.size) {
+		memcpy(write_ptr, packet, packet_size);
+	} else {
+		residue = new_write_idx - qinfo->q_array.size;
+		memcpy(write_ptr, packet, (packet_size - residue));
+		memcpy(qinfo->q_array.kernel_vaddr,
+		       packet + (packet_size - residue), residue);
+		new_write_idx = residue;
+	}
+
+	/* Make sure packet is written before updating the write index */
+	mb();
+	queue->qhdr_write_idx = new_write_idx / sizeof(u32);
+
+	/* Make sure write index is updated before an interrupt is raised */
+	mb();
+
+	return 0;
+}
+
+static int __read_queue(struct iface_q_info *qinfo, void *packet)
+{
+	u32 read_idx, write_idx, new_read_idx;
+	struct hfi_queue_header *queue;
+	u32 receive_request = 0;
+	u32 packet_size, residue;
+	u32 *read_ptr;
+	int ret = 0;
+
+	/* Make sure data is valid before reading it */
+	mb();
+	queue = qinfo->qhdr;
+	if (!queue)
+		return -EINVAL;
+
+	if (queue->qhdr_type & IFACEQ_MSGQ_ID)
+		receive_request = 1;
+
+	read_idx = queue->qhdr_read_idx * sizeof(u32);
+	write_idx = queue->qhdr_write_idx * sizeof(u32);
+
+	if (read_idx == write_idx) {
+		queue->qhdr_rx_req = receive_request;
+		/* Ensure qhdr is updated in main memory */
+		mb();
+		return -ENODATA;
+	}
+
+	read_ptr = (u32 *)(qinfo->q_array.kernel_vaddr + read_idx);
+	if (read_ptr < (u32 *)qinfo->q_array.kernel_vaddr ||
+	    read_ptr > (u32 *)(qinfo->q_array.kernel_vaddr +
+	    qinfo->q_array.size - sizeof(*read_ptr)))
+		return -ENODATA;
+
+	packet_size = *read_ptr;
+	if (!packet_size)
+		return -EINVAL;
+
+	new_read_idx = read_idx + packet_size;
+	if (packet_size <= IFACEQ_CORE_PKT_SIZE &&
+	    read_idx <= qinfo->q_array.size) {
+		if (new_read_idx < qinfo->q_array.size) {
+			memcpy(packet, read_ptr, packet_size);
+		} else {
+			residue = new_read_idx - qinfo->q_array.size;
+			memcpy(packet, read_ptr, (packet_size - residue));
+			memcpy((packet + (packet_size - residue)),
+			       qinfo->q_array.kernel_vaddr, residue);
+			new_read_idx = residue;
+		}
+	} else {
+		new_read_idx = write_idx;
+		ret = -EBADMSG;
+	}
+
+	queue->qhdr_rx_req = receive_request;
+
+	queue->qhdr_read_idx = new_read_idx / sizeof(u32);
+	/* Ensure qhdr is updated in main memory */
+	mb();
+
+	return ret;
+}
+
+int iris_hfi_queue_cmd_write(struct iris_core *core, void *pkt)
+{
+	struct iface_q_info *q_info;
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return ret;
+
+	if (!core_in_valid_state(core))
+		return -EINVAL;
+
+	q_info = &core->command_queue;
+	if (!q_info || !q_info->q_array.kernel_vaddr || !pkt) {
+		dev_err(core->dev, "cannot write to shared CMD Q's\n");
+		return -ENODATA;
+	}
+
+	if (!__write_queue(q_info, pkt)) {
+		call_vpu_op(core, raise_interrupt, core);
+	} else {
+		dev_err(core->dev, "queue full\n");
+		return -ENODATA;
+	}
+
+	return ret;
+}
+
+int iris_hfi_queue_msg_read(struct iris_core *core, void *pkt)
+{
+	struct iface_q_info *q_info;
+
+	if (!core_in_valid_state(core))
+		return -EINVAL;
+
+	q_info = &core->message_queue;
+	if (!q_info || !q_info->q_array.kernel_vaddr || !pkt) {
+		dev_err(core->dev, "cannot read from shared MSG Q's\n");
+		return -ENODATA;
+	}
+
+	if (__read_queue(q_info, pkt))
+		return -ENODATA;
+
+	return 0;
+}
+
+int iris_hfi_queue_dbg_read(struct iris_core *core, void *pkt)
+{
+	struct iface_q_info *q_info;
+
+	q_info = &core->debug_queue;
+	if (!q_info || !q_info->q_array.kernel_vaddr || !pkt) {
+		dev_err(core->dev, "cannot read from shared DBG Q's\n");
+		return -ENODATA;
+	}
+
+	if (__read_queue(q_info, pkt))
+		return -ENODATA;
+
+	return 0;
+}
+
+static void iris_hfi_set_queue_header(struct iris_core *core, u32 queue_id,
+				      struct iface_q_info *iface_q)
+{
+	__set_queue_hdr_defaults(iface_q->qhdr);
+	iface_q->qhdr->qhdr_start_addr = iface_q->q_array.device_addr;
+	iface_q->qhdr->qhdr_type |= queue_id;
+
+	/*
+	 * Set receive request to zero on debug queue as there is no
+	 * need of interrupt from video hardware for debug messages
+	 */
+	if (queue_id == IFACEQ_DBGQ_ID)
+		iface_q->qhdr->qhdr_rx_req = 0;
+}
+
+static void __queue_init(struct iris_core *core, u32 queue_id, struct iface_q_info *iface_q)
+{
+	unsigned int offset = 0;
+
+	offset = core->iface_q_table.size + (queue_id * IFACEQ_QUEUE_SIZE);
+	iface_q->q_array.device_addr = core->iface_q_table.device_addr + offset;
+	iface_q->q_array.kernel_vaddr =
+			(void *)((char *)core->iface_q_table.kernel_vaddr + offset);
+	iface_q->q_array.size = IFACEQ_QUEUE_SIZE;
+	iface_q->qhdr =
+		IFACEQ_GET_QHDR_START_ADDR(core->iface_q_table.kernel_vaddr, queue_id);
+
+	iris_hfi_set_queue_header(core, queue_id, iface_q);
+}
+
+int iris_hfi_queue_init(struct iris_core *core)
+{
+	struct hfi_queue_table_header *q_tbl_hdr;
+
+	if (core->iface_q_table.kernel_vaddr) {
+		iris_hfi_set_queue_header(core, IFACEQ_CMDQ_ID, &core->command_queue);
+		iris_hfi_set_queue_header(core, IFACEQ_MSGQ_ID, &core->message_queue);
+		iris_hfi_set_queue_header(core, IFACEQ_DBGQ_ID, &core->debug_queue);
+		return 0;
+	}
+
+	core->iface_q_table.kernel_vaddr = dma_alloc_attrs(core->dev, ALIGNED_QUEUE_SIZE,
+							   &core->iface_q_table.device_addr,
+							   GFP_KERNEL, DMA_ATTR_WRITE_COMBINE);
+	if (!core->iface_q_table.kernel_vaddr) {
+		dev_err(core->dev, "%s: queues alloc and map failed\n", __func__);
+		return -ENOMEM;
+	}
+	core->iface_q_table.size = IFACEQ_TABLE_SIZE;
+
+	__queue_init(core, IFACEQ_CMDQ_ID, &core->command_queue);
+	__queue_init(core, IFACEQ_MSGQ_ID, &core->message_queue);
+	__queue_init(core, IFACEQ_DBGQ_ID, &core->debug_queue);
+
+	q_tbl_hdr = (struct hfi_queue_table_header *)
+			core->iface_q_table.kernel_vaddr;
+	q_tbl_hdr->qtbl_version = 0;
+	q_tbl_hdr->device_addr = (void *)core;
+	strscpy(q_tbl_hdr->name, "iris-hfi-queues", sizeof(q_tbl_hdr->name));
+	q_tbl_hdr->qtbl_size = IFACEQ_TABLE_SIZE;
+	q_tbl_hdr->qtbl_qhdr0_offset = sizeof(*q_tbl_hdr);
+	q_tbl_hdr->qtbl_qhdr_size = sizeof(struct hfi_queue_header);
+	q_tbl_hdr->qtbl_num_q = IFACEQ_NUMQ;
+	q_tbl_hdr->qtbl_num_active_q = IFACEQ_NUMQ;
+
+	core->sfr.kernel_vaddr = dma_alloc_attrs(core->dev, ALIGNED_SFR_SIZE,
+						 &core->sfr.device_addr,
+						 GFP_KERNEL, DMA_ATTR_WRITE_COMBINE);
+	if (!core->sfr.kernel_vaddr) {
+		dev_err(core->dev, "%s: sfr alloc and map failed\n", __func__);
+		return -ENOMEM;
+	}
+	core->sfr.size = ALIGNED_SFR_SIZE;
+	 /* Write sfr size in first word to be used by firmware */
+	*((u32 *)core->sfr.kernel_vaddr) = core->sfr.size;
+
+	return 0;
+}
+
+static void __queue_deinit(struct iface_q_info *iface_q)
+{
+	iface_q->qhdr = NULL;
+	iface_q->q_array.kernel_vaddr = NULL;
+	iface_q->q_array.device_addr = 0;
+}
+
+void iris_hfi_queue_deinit(struct iris_core *core)
+{
+	if (!core->iface_q_table.kernel_vaddr)
+		return;
+
+	dma_free_attrs(core->dev, core->iface_q_table.size, core->iface_q_table.kernel_vaddr,
+		       core->iface_q_table.device_addr, core->iface_q_table.attrs);
+
+	dma_free_attrs(core->dev, core->sfr.size, core->sfr.kernel_vaddr,
+		       core->sfr.device_addr, core->sfr.attrs);
+
+	__queue_deinit(&core->command_queue);
+	__queue_deinit(&core->message_queue);
+	__queue_deinit(&core->debug_queue);
+
+	core->iface_q_table.kernel_vaddr = NULL;
+	core->iface_q_table.device_addr = 0;
+
+	core->sfr.kernel_vaddr = NULL;
+	core->sfr.device_addr = 0;
+}
+
+void iris_flush_debug_queue(struct iris_core *core,
+			    u8 *packet, u32 packet_size)
+{
+	struct hfi_debug_header *pkt;
+	bool local_packet = false;
+	u8 *log;
+
+	if (!packet || !packet_size) {
+		packet = kzalloc(IFACEQ_CORE_PKT_SIZE, GFP_KERNEL);
+		if (!packet)
+			return;
+
+		packet_size = IFACEQ_CORE_PKT_SIZE;
+
+		local_packet = true;
+	}
+
+	while (!iris_hfi_queue_dbg_read(core, packet)) {
+		pkt = (struct hfi_debug_header *)packet;
+
+		if (pkt->size < sizeof(*pkt))
+			continue;
+
+		if (pkt->size >= packet_size)
+			continue;
+
+		packet[pkt->size] = '\0';
+		log = (u8 *)packet + sizeof(*pkt) + 1;
+		dev_dbg(core->dev, "%s", log);
+	}
+
+	if (local_packet)
+		kfree(packet);
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_hfi_queue.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_hfi_queue.h
@@ -0,0 +1,105 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_HFI_QUEUE_H_
+#define _IRIS_HFI_QUEUE_H_
+
+struct iris_core;
+
+/*
+ * Shared queues are used for communication between driver and firmware.
+ * There are 3 types of queues:
+ * Command queue - driver to write any command to firmware.
+ * Message queue - firmware to send any response to driver.
+ * Debug queue - firmware to write debug message.
+ */
+
+/* Host-firmware shared queue ids */
+enum iris_iface_queue {
+	IFACEQ_CMDQ_ID	= 0,
+	IFACEQ_MSGQ_ID,
+	IFACEQ_DBGQ_ID,
+	IFACEQ_NUMQ, /* not an index */
+};
+
+#define IFACEQ_MAX_BUF_COUNT		50
+/*
+ * Max session supported are 16.
+ * this value is used to calcualte the size of
+ * individual shared queue.
+ */
+#define IFACE_MAX_PARALLEL_CLNTS	16
+#define IFACEQ_DFLT_QHDR		0x01010000
+
+#define IFACEQ_MAX_PKT_SIZE		1024
+#define IFACEQ_CORE_PKT_SIZE	(1024 * 4)
+
+struct hfi_queue_table_header {
+	u32 qtbl_version;
+	u32 qtbl_size;
+	u32 qtbl_qhdr0_offset;
+	u32 qtbl_qhdr_size;
+	u32 qtbl_num_q;
+	u32 qtbl_num_active_q;
+	void *device_addr;
+	char name[256];
+};
+
+struct hfi_queue_header {
+	u32 qhdr_status;
+	u32 qhdr_start_addr;
+	u32 qhdr_type;
+	u32 qhdr_q_size;
+	u32 qhdr_pkt_size;
+	u32 qhdr_pkt_drop_cnt;
+	u32 qhdr_rx_wm;
+	u32 qhdr_tx_wm;
+	u32 qhdr_rx_req;
+	u32 qhdr_tx_req;
+	u32 qhdr_rx_irq_status;
+	u32 qhdr_tx_irq_status;
+	u32 qhdr_read_idx;
+	u32 qhdr_write_idx;
+};
+
+#define IFACEQ_TABLE_SIZE	(sizeof(struct hfi_queue_table_header) + \
+			sizeof(struct hfi_queue_header) * IFACEQ_NUMQ)
+
+#define IFACEQ_QUEUE_SIZE	(IFACEQ_MAX_PKT_SIZE *  \
+	IFACEQ_MAX_BUF_COUNT * IFACE_MAX_PARALLEL_CLNTS)
+
+#define IFACEQ_GET_QHDR_START_ADDR(ptr, i)     \
+	((void *)(((ptr) + sizeof(struct hfi_queue_table_header)) + \
+		((i) * sizeof(struct hfi_queue_header))))
+
+#define SFR_SIZE	SZ_4K
+#define QUEUE_SIZE	(IFACEQ_TABLE_SIZE + \
+			(IFACEQ_QUEUE_SIZE * IFACEQ_NUMQ))
+
+#define ALIGNED_SFR_SIZE	ALIGN(SFR_SIZE, SZ_4K)
+#define ALIGNED_QUEUE_SIZE	ALIGN(QUEUE_SIZE, SZ_4K)
+#define SHARED_QSIZE		ALIGN(ALIGNED_SFR_SIZE + ALIGNED_QUEUE_SIZE, SZ_1M)
+
+struct mem_desc {
+	dma_addr_t		device_addr;
+	void			*kernel_vaddr;
+	u32				size;
+	unsigned long	attrs;
+};
+
+struct iface_q_info {
+	struct hfi_queue_header *qhdr;
+	struct mem_desc q_array;
+};
+
+int iris_hfi_queue_init(struct iris_core *core);
+void iris_hfi_queue_deinit(struct iris_core *core);
+int iris_hfi_queue_cmd_write(struct iris_core *core, void *pkt);
+int iris_hfi_queue_msg_read(struct iris_core *core, void *pkt);
+int iris_hfi_queue_dbg_read(struct iris_core *core, void *pkt);
+void iris_flush_debug_queue(struct iris_core *core,
+			    u8 *packet, u32 packet_size);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_hfi_response.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_hfi_response.c
@@ -0,0 +1,1061 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "hfi_defines.h"
+#include "iris_buffer.h"
+#include "iris_helpers.h"
+#include "iris_hfi_packet.h"
+#include "iris_hfi_queue.h"
+#include "iris_hfi_response.h"
+#include "iris_vdec.h"
+#include "memory.h"
+
+struct iris_core_hfi_range {
+	u32 begin;
+	u32 end;
+	int (*handle)(struct iris_core *core, struct hfi_packet *pkt);
+};
+
+struct iris_inst_hfi_range {
+	u32 begin;
+	u32 end;
+	int (*handle)(struct iris_inst *inst, struct hfi_packet *pkt);
+};
+
+struct iris_hfi_buffer_handle {
+	enum hfi_buffer_type type;
+	int (*handle)(struct iris_inst *inst, struct hfi_buffer *buffer);
+};
+
+struct iris_hfi_packet_handle {
+	enum hfi_buffer_type type;
+	int (*handle)(struct iris_inst *inst, struct hfi_packet *pkt);
+};
+
+static void print_sfr_message(struct iris_core *core)
+{
+	struct sfr_buffer *vsfr = NULL;
+	u32 vsfr_size = 0;
+	void *p = NULL;
+
+	vsfr = (struct sfr_buffer *)core->sfr.kernel_vaddr;
+	if (vsfr) {
+		if (vsfr->bufsize != core->sfr.size)
+			return;
+		vsfr_size = vsfr->bufsize - sizeof(u32);
+		p = memchr(vsfr->rg_data, '\0', vsfr_size);
+	/* SFR isn't guaranteed to be NULL terminated */
+		if (!p)
+			vsfr->rg_data[vsfr_size - 1] = '\0';
+
+		dev_err(core->dev, "SFR Message from FW: %s\n", vsfr->rg_data);
+	}
+}
+
+static bool is_valid_hfi_buffer_type(u32 buffer_type)
+{
+	if (buffer_type != HFI_BUFFER_BITSTREAM &&
+	    buffer_type != HFI_BUFFER_RAW &&
+	    buffer_type != HFI_BUFFER_BIN &&
+	    buffer_type != HFI_BUFFER_ARP &&
+	    buffer_type != HFI_BUFFER_COMV &&
+	    buffer_type != HFI_BUFFER_NON_COMV &&
+	    buffer_type != HFI_BUFFER_LINE &&
+	    buffer_type != HFI_BUFFER_DPB &&
+	    buffer_type != HFI_BUFFER_PERSIST &&
+	    buffer_type != HFI_BUFFER_VPSS) {
+		return false;
+	}
+
+	return true;
+}
+
+static bool is_valid_hfi_port(u32 port, u32 buffer_type)
+{
+	if (port == HFI_PORT_NONE &&
+	    buffer_type != HFI_BUFFER_ARP &&
+		buffer_type != HFI_BUFFER_PERSIST)
+		return false;
+
+	if (port != HFI_PORT_BITSTREAM && port != HFI_PORT_RAW)
+		return false;
+
+	return true;
+}
+
+static void cache_operation_dqbuf(struct iris_buffer *buf)
+{
+	if  (buf->type == BUF_OUTPUT && buf->dmabuf) {
+		dma_buf_begin_cpu_access(buf->dmabuf, DMA_FROM_DEVICE);
+		dma_buf_end_cpu_access(buf->dmabuf, DMA_FROM_DEVICE);
+	}
+}
+
+static int get_driver_buffer_flags(struct iris_inst *inst, u32 hfi_flags)
+{
+	u32 driver_flags = 0;
+
+	if (inst->hfi_frame_info.picture_type & HFI_PICTURE_IDR)
+		driver_flags |= BUF_FLAG_KEYFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_P)
+		driver_flags |= BUF_FLAG_PFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_B)
+		driver_flags |= BUF_FLAG_BFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_I)
+		driver_flags |= BUF_FLAG_KEYFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_CRA)
+		driver_flags |= BUF_FLAG_KEYFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_BLA)
+		driver_flags |= BUF_FLAG_KEYFRAME;
+
+	if (inst->hfi_frame_info.data_corrupt)
+		driver_flags |= BUF_FLAG_ERROR;
+
+	if (inst->hfi_frame_info.overflow)
+		driver_flags |= BUF_FLAG_ERROR;
+
+	if ((inst->domain == ENCODER && (hfi_flags & HFI_BUF_FW_FLAG_LAST)) ||
+	    (inst->domain == DECODER && (hfi_flags & HFI_BUF_FW_FLAG_LAST ||
+					 hfi_flags & HFI_BUF_FW_FLAG_PSC_LAST)))
+		driver_flags |= BUF_FLAG_LAST;
+
+	return driver_flags;
+}
+
+static bool validate_packet_payload(struct hfi_packet *pkt)
+{
+	u32 payload_size = 0;
+
+	switch (pkt->payload_info) {
+	case HFI_PAYLOAD_U32:
+	case HFI_PAYLOAD_S32:
+	case HFI_PAYLOAD_Q16:
+	case HFI_PAYLOAD_U32_ENUM:
+	case HFI_PAYLOAD_32_PACKED:
+		payload_size = 4;
+		break;
+	case HFI_PAYLOAD_U64:
+	case HFI_PAYLOAD_S64:
+	case HFI_PAYLOAD_64_PACKED:
+		payload_size = 8;
+		break;
+	case HFI_PAYLOAD_STRUCTURE:
+		if (pkt->type == HFI_CMD_BUFFER)
+			payload_size = sizeof(struct hfi_buffer);
+		break;
+	default:
+		payload_size = 0;
+		break;
+	}
+
+	if (pkt->size < sizeof(struct hfi_packet) + payload_size)
+		return false;
+
+	return true;
+}
+
+static int validate_packet(u8 *response_pkt, u8 *core_resp_pkt, u32 core_resp_pkt_size)
+{
+	u32 response_pkt_size = 0;
+	u8 *response_limit;
+
+	if (!response_pkt || !core_resp_pkt || !core_resp_pkt_size)
+		return -EINVAL;
+
+	response_limit = core_resp_pkt + core_resp_pkt_size;
+
+	if (response_pkt < core_resp_pkt || response_pkt > response_limit)
+		return -EINVAL;
+
+	response_pkt_size = *(u32 *)response_pkt;
+	if (!response_pkt_size)
+		return -EINVAL;
+
+	if (response_pkt_size < sizeof(struct hfi_packet))
+		return -EINVAL;
+
+	if (response_pkt + response_pkt_size > response_limit)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int validate_hdr_packet(struct iris_core *core, struct hfi_header *hdr)
+{
+	struct hfi_packet *packet;
+	int i, ret = 0;
+	u8 *pkt;
+
+	if (hdr->size < sizeof(*hdr) + sizeof(*packet))
+		return -EINVAL;
+
+	pkt = (u8 *)((u8 *)hdr + sizeof(*hdr));
+
+	for (i = 0; i < hdr->num_packets; i++) {
+		packet = (struct hfi_packet *)pkt;
+		ret = validate_packet(pkt, core->response_packet, core->packet_size);
+		if (ret)
+			return ret;
+
+		pkt += packet->size;
+	}
+
+	return ret;
+}
+
+static int handle_session_info(struct iris_inst *inst,
+			       struct hfi_packet *pkt)
+{
+	struct iris_core *core;
+	int ret = 0;
+	char *info;
+
+	core = inst->core;
+
+	switch (pkt->type) {
+	case HFI_INFO_UNSUPPORTED:
+		info = "unsupported";
+		break;
+	case HFI_INFO_DATA_CORRUPT:
+		info = "data corrupt";
+		inst->hfi_frame_info.data_corrupt = 1;
+		break;
+	case HFI_INFO_BUFFER_OVERFLOW:
+		info = "buffer overflow";
+		inst->hfi_frame_info.overflow = 1;
+		break;
+	case HFI_INFO_HFI_FLAG_DRAIN_LAST:
+		info = "drain last flag";
+		ret = iris_inst_sub_state_change_drain_last(inst);
+		break;
+	case HFI_INFO_HFI_FLAG_PSC_LAST:
+		info = "drc last flag";
+		ret = iris_inst_sub_state_change_drc_last(inst);
+		break;
+	default:
+		info = "unknown";
+		break;
+	}
+
+	dev_dbg(core->dev, "session info received %#x: %s\n",
+		pkt->type, info);
+
+	return ret;
+}
+
+static int handle_session_error(struct iris_inst *inst,
+				struct hfi_packet *pkt)
+{
+	struct iris_core *core;
+	char *error;
+
+	core = inst->core;
+
+	switch (pkt->type) {
+	case HFI_ERROR_MAX_SESSIONS:
+		error = "exceeded max sessions";
+		break;
+	case HFI_ERROR_UNKNOWN_SESSION:
+		error = "unknown session id";
+		break;
+	case HFI_ERROR_INVALID_STATE:
+		error = "invalid operation for current state";
+		break;
+	case HFI_ERROR_INSUFFICIENT_RESOURCES:
+		error = "insufficient resources";
+		break;
+	case HFI_ERROR_BUFFER_NOT_SET:
+		error = "internal buffers not set";
+		break;
+	case HFI_ERROR_FATAL:
+		error = "fatal error";
+		break;
+	default:
+		error = "unknown";
+		break;
+	}
+
+	dev_err(core->dev, "session error received %#x: %s\n",
+		pkt->type, error);
+	iris_inst_change_state(inst, IRIS_INST_ERROR);
+
+	return 0;
+}
+
+static int handle_system_error(struct iris_core *core,
+			       struct hfi_packet *pkt)
+{
+	print_sfr_message(core);
+
+	iris_core_deinit(core);
+
+	return 0;
+}
+
+static int handle_system_init(struct iris_core *core,
+			      struct hfi_packet *pkt)
+{
+	if (!(pkt->flags & HFI_FW_FLAGS_SUCCESS))
+		return 0;
+
+	mutex_lock(&core->lock);
+	if (pkt->packet_id != core->sys_init_id)
+		goto unlock;
+
+	iris_change_core_state(core, IRIS_CORE_INIT);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return 0;
+}
+
+static int handle_session_close(struct iris_inst *inst,
+				struct hfi_packet *pkt)
+{
+	signal_session_msg_receipt(inst, SIGNAL_CMD_CLOSE);
+
+	return 0;
+}
+
+static int handle_read_only_buffer(struct iris_inst *inst,
+				   struct iris_buffer *buf)
+{
+	struct iris_buffer *ro_buf, *iter = NULL;
+	bool found = false;
+
+	if (inst->domain != DECODER && inst->domain != ENCODER)
+		return 0;
+
+	list_for_each_entry(iter, &inst->buffers.read_only.list, list) {
+		if (iter->device_addr == buf->device_addr) {
+			found = true;
+			ro_buf = iter;
+			break;
+		}
+	}
+
+	if (!found) {
+		ro_buf = iris_get_buffer_from_pool(inst);
+		if (!ro_buf)
+			return -ENOMEM;
+		ro_buf->index = -1;
+		ro_buf->inst = inst;
+		ro_buf->type = buf->type;
+		ro_buf->fd = buf->fd;
+		ro_buf->dmabuf = buf->dmabuf;
+		ro_buf->device_addr = buf->device_addr;
+		ro_buf->data_offset = buf->data_offset;
+		INIT_LIST_HEAD(&ro_buf->list);
+		list_add_tail(&ro_buf->list, &inst->buffers.read_only.list);
+	}
+	ro_buf->attr |= BUF_ATTR_READ_ONLY;
+
+	return 0;
+}
+
+static int handle_non_read_only_buffer(struct iris_inst *inst,
+				       struct hfi_buffer *buffer)
+{
+	struct iris_buffer *ro_buf;
+
+	if (inst->domain != DECODER && inst->domain != ENCODER)
+		return 0;
+
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		if (ro_buf->device_addr == buffer->base_address) {
+			ro_buf->attr &= ~BUF_ATTR_READ_ONLY;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int handle_release_output_buffer(struct iris_inst *inst,
+					struct hfi_buffer *buffer)
+{
+	struct iris_buffer *buf, *iter;
+	bool found = false;
+
+	list_for_each_entry(iter, &inst->buffers.read_only.list, list) {
+		if (iter->device_addr == buffer->base_address &&
+		    iter->attr & BUF_ATTR_PENDING_RELEASE) {
+			found = true;
+			buf = iter;
+			break;
+		}
+	}
+	if (!found)
+		return -EINVAL;
+
+	buf->attr &= ~BUF_ATTR_READ_ONLY;
+	buf->attr &= ~BUF_ATTR_PENDING_RELEASE;
+
+	return 0;
+}
+
+static int handle_input_buffer(struct iris_inst *inst,
+			       struct hfi_buffer *buffer)
+{
+	struct iris_buffers *buffers;
+	struct iris_buffer *buf, *iter;
+	bool found;
+
+	buffers = iris_get_buffer_list(inst, BUF_INPUT);
+	if (!buffers)
+		return -EINVAL;
+
+	found = false;
+	list_for_each_entry(iter, &buffers->list, list) {
+		if (iter->index == buffer->index) {
+			found = true;
+			buf = iter;
+			break;
+		}
+	}
+	if (!found)
+		return -EINVAL;
+
+	if (!(buf->attr & BUF_ATTR_QUEUED))
+		return 0;
+
+	buf->data_size = buffer->data_size;
+	buf->attr &= ~BUF_ATTR_QUEUED;
+	buf->attr |= BUF_ATTR_DEQUEUED;
+
+	buf->flags = get_driver_buffer_flags(inst, buffer->flags);
+
+	return 0;
+}
+
+static int handle_output_buffer(struct iris_inst *inst,
+				struct hfi_buffer *hfi_buffer)
+{
+	struct iris_buffer *buf, *iter;
+	struct iris_buffers *buffers;
+	bool found, fatal = false;
+	int ret = 0;
+
+	if (hfi_buffer->flags & HFI_BUF_FW_FLAG_LAST) {
+		ret = iris_inst_sub_state_change_drain_last(inst);
+		if (ret)
+			return ret;
+	}
+
+	if (inst->domain == DECODER) {
+		if (hfi_buffer->flags & HFI_BUF_FW_FLAG_RELEASE_DONE)
+			return handle_release_output_buffer(inst, hfi_buffer);
+
+		if (hfi_buffer->flags & HFI_BUF_FW_FLAG_PSC_LAST) {
+			ret = iris_inst_sub_state_change_drc_last(inst);
+			if (ret)
+				return ret;
+		}
+
+		if (!(hfi_buffer->flags & HFI_BUF_FW_FLAG_READONLY))
+			ret = handle_non_read_only_buffer(inst, hfi_buffer);
+	}
+
+	buffers = iris_get_buffer_list(inst, BUF_OUTPUT);
+	if (!buffers)
+		return -EINVAL;
+
+	found = false;
+	list_for_each_entry(iter, &buffers->list, list) {
+		if (!(iter->attr & BUF_ATTR_QUEUED))
+			continue;
+
+		if (inst->domain == DECODER)
+			found = (iter->index == hfi_buffer->index &&
+				 iter->device_addr == hfi_buffer->base_address &&
+				 iter->data_offset == hfi_buffer->data_offset);
+		else
+			found = iter->index == hfi_buffer->index;
+
+		if (found) {
+			buf = iter;
+			break;
+		}
+	}
+	if (!found)
+		return 0;
+
+	buf->data_offset = hfi_buffer->data_offset;
+	buf->data_size = hfi_buffer->data_size;
+	buf->timestamp = hfi_buffer->timestamp;
+
+	buf->attr &= ~BUF_ATTR_QUEUED;
+	buf->attr |= BUF_ATTR_DEQUEUED;
+
+	if (inst->domain == ENCODER) {
+		if (inst->hfi_frame_info.data_corrupt)
+			fatal = true;
+		if (inst->hfi_frame_info.overflow) {
+			if (!hfi_buffer->data_size && inst->hfi_rc_type == HFI_RC_CBR_CFR)
+				fatal = true;
+		}
+		if (fatal)
+			iris_inst_change_state(inst, IRIS_INST_ERROR);
+	}
+
+	if (inst->domain == DECODER) {
+		if (inst->buffers.dpb.size && hfi_buffer->flags & HFI_BUF_FW_FLAG_READONLY)
+			iris_inst_change_state(inst, IRIS_INST_ERROR);
+
+		if (hfi_buffer->flags & HFI_BUF_FW_FLAG_READONLY) {
+			buf->attr |= BUF_ATTR_READ_ONLY;
+			ret = handle_read_only_buffer(inst, buf);
+		} else {
+			buf->attr &= ~BUF_ATTR_READ_ONLY;
+		}
+	}
+
+	buf->flags = get_driver_buffer_flags(inst, hfi_buffer->flags);
+
+	return ret;
+}
+
+static int handle_dequeue_buffers(struct iris_inst *inst)
+{
+	struct iris_buffers *buffers;
+	struct iris_buffer *dummy;
+	struct iris_buffer *buf;
+	int ret = 0;
+	int i;
+	static const enum iris_buffer_type buffer_type[] = {
+		BUF_INPUT,
+		BUF_OUTPUT,
+	};
+
+	for (i = 0; i < ARRAY_SIZE(buffer_type); i++) {
+		buffers = iris_get_buffer_list(inst, buffer_type[i]);
+		if (!buffers)
+			return -EINVAL;
+
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+			if (buf->attr & BUF_ATTR_DEQUEUED) {
+				buf->attr &= ~BUF_ATTR_DEQUEUED;
+				if (!(buf->attr & BUF_ATTR_BUFFER_DONE)) {
+					buf->attr |= BUF_ATTR_BUFFER_DONE;
+
+					cache_operation_dqbuf(buf);
+
+					ret = iris_vb2_buffer_done(inst, buf);
+					if (ret)
+						ret = 0;
+				}
+			}
+		}
+	}
+
+	return ret;
+}
+
+static int handle_release_internal_buffer(struct iris_inst *inst,
+					  struct hfi_buffer *buffer)
+{
+	struct iris_buffers *buffers;
+	struct iris_buffer *buf, *iter;
+	int ret = 0;
+	bool found;
+
+	buffers = iris_get_buffer_list(inst, hfi_buf_type_to_driver(inst->domain, buffer->type));
+	if (!buffers)
+		return -EINVAL;
+
+	found = false;
+	list_for_each_entry(iter, &buffers->list, list) {
+		if (iter->device_addr == buffer->base_address) {
+			found = true;
+			buf = iter;
+			break;
+		}
+	}
+	if (!found)
+		return -EINVAL;
+
+	buf->attr &= ~BUF_ATTR_QUEUED;
+
+	if (buf->attr & BUF_ATTR_PENDING_RELEASE)
+		ret = iris_destroy_internal_buffer(inst, buf);
+
+	return ret;
+}
+
+static int handle_session_stop(struct iris_inst *inst,
+			       struct hfi_packet *pkt)
+{
+	int ret = 0;
+	enum signal_session_response signal_type = -1;
+
+	if (inst->domain == DECODER) {
+		if (pkt->port == HFI_PORT_RAW) {
+			signal_type = SIGNAL_CMD_STOP_OUTPUT;
+			ret = iris_inst_sub_state_change_pause(inst, OUTPUT_MPLANE);
+		} else if (pkt->port == HFI_PORT_BITSTREAM) {
+			signal_type = SIGNAL_CMD_STOP_INPUT;
+			ret = iris_inst_sub_state_change_pause(inst, INPUT_MPLANE);
+		}
+	} else if (inst->domain == ENCODER) {
+		if (pkt->port == HFI_PORT_RAW) {
+			signal_type = SIGNAL_CMD_STOP_INPUT;
+			ret = iris_inst_sub_state_change_pause(inst, INPUT_MPLANE);
+		} else if (pkt->port == HFI_PORT_BITSTREAM) {
+			signal_type = SIGNAL_CMD_STOP_OUTPUT;
+			ret = iris_inst_sub_state_change_pause(inst, OUTPUT_MPLANE);
+		}
+	}
+
+	if (signal_type != -1)
+		signal_session_msg_receipt(inst, signal_type);
+
+	return ret;
+}
+
+static int handle_session_buffer(struct iris_inst *inst,
+				 struct hfi_packet *pkt)
+{
+	struct hfi_buffer *buffer;
+	u32 hfi_handle_size = 0;
+	int i, ret = 0;
+	const struct iris_hfi_buffer_handle *hfi_handle_arr = NULL;
+	static const struct iris_hfi_buffer_handle dec_input_hfi_handle[] = {
+		{HFI_BUFFER_BITSTREAM,      handle_input_buffer               },
+		{HFI_BUFFER_BIN,            handle_release_internal_buffer    },
+		{HFI_BUFFER_COMV,           handle_release_internal_buffer    },
+		{HFI_BUFFER_NON_COMV,       handle_release_internal_buffer    },
+		{HFI_BUFFER_LINE,           handle_release_internal_buffer    },
+		{HFI_BUFFER_PERSIST,        handle_release_internal_buffer    },
+	};
+	static const struct iris_hfi_buffer_handle dec_output_hfi_handle[] = {
+		{HFI_BUFFER_RAW,            handle_output_buffer              },
+		{HFI_BUFFER_DPB,            handle_release_internal_buffer    },
+	};
+	static const struct iris_hfi_buffer_handle enc_input_hfi_handle[] = {
+		{HFI_BUFFER_RAW,            handle_input_buffer               },
+		{HFI_BUFFER_VPSS,           handle_release_internal_buffer    },
+	};
+	static const struct iris_hfi_buffer_handle enc_output_hfi_handle[] = {
+		{HFI_BUFFER_BITSTREAM,      handle_output_buffer              },
+		{HFI_BUFFER_BIN,            handle_release_internal_buffer    },
+		{HFI_BUFFER_COMV,           handle_release_internal_buffer    },
+		{HFI_BUFFER_NON_COMV,       handle_release_internal_buffer    },
+		{HFI_BUFFER_LINE,           handle_release_internal_buffer    },
+		{HFI_BUFFER_ARP,            handle_release_internal_buffer    },
+		{HFI_BUFFER_DPB,            handle_release_internal_buffer    },
+	};
+
+
+	if (pkt->payload_info == HFI_PAYLOAD_NONE)
+		return 0;
+
+	if (!validate_packet_payload(pkt)) {
+		iris_inst_change_state(inst, IRIS_INST_ERROR);
+		return 0;
+	}
+
+	buffer = (struct hfi_buffer *)((u8 *)pkt + sizeof(*pkt));
+	if (!is_valid_hfi_buffer_type(buffer->type))
+		return 0;
+
+	if (!is_valid_hfi_port(pkt->port, buffer->type))
+		return 0;
+
+	if (inst->domain == DECODER) {
+		if (pkt->port == HFI_PORT_BITSTREAM) {
+			hfi_handle_size = ARRAY_SIZE(dec_input_hfi_handle);
+			hfi_handle_arr = dec_input_hfi_handle;
+		} else if (pkt->port == HFI_PORT_RAW) {
+			hfi_handle_size = ARRAY_SIZE(dec_output_hfi_handle);
+			hfi_handle_arr = dec_output_hfi_handle;
+		}
+	} else if (inst->domain == ENCODER) {
+		if (pkt->port == HFI_PORT_RAW) {
+			hfi_handle_size = ARRAY_SIZE(enc_input_hfi_handle);
+			hfi_handle_arr = enc_input_hfi_handle;
+		} else if (pkt->port == HFI_PORT_BITSTREAM) {
+			hfi_handle_size = ARRAY_SIZE(enc_output_hfi_handle);
+			hfi_handle_arr = enc_output_hfi_handle;
+		}
+	}
+
+	if (!hfi_handle_arr || !hfi_handle_size)
+		return -EINVAL;
+
+	for (i = 0; i < hfi_handle_size; i++) {
+		if (hfi_handle_arr[i].type == buffer->type) {
+			ret = hfi_handle_arr[i].handle(inst, buffer);
+			if (ret)
+				return ret;
+			break;
+		}
+	}
+
+	if (i == hfi_handle_size)
+		return -EINVAL;
+
+	return ret;
+}
+
+static int handle_session_drain(struct iris_inst *inst,
+				struct hfi_packet *pkt)
+{
+	int ret = 0;
+
+	if (inst->sub_state & IRIS_INST_SUB_DRAIN)
+		ret = iris_inst_change_sub_state(inst, 0, IRIS_INST_SUB_INPUT_PAUSE);
+
+	return ret;
+}
+
+static int handle_src_change(struct iris_inst *inst,
+			     struct hfi_packet *pkt)
+{
+	int ret;
+
+	if (pkt->port != HFI_PORT_BITSTREAM)
+		return 0;
+
+	ret = iris_inst_sub_state_change_drc(inst);
+	if (ret)
+		return ret;
+
+	ret = vdec_src_change(inst);
+
+	return ret;
+}
+
+static int handle_session_command(struct iris_inst *inst,
+				  struct hfi_packet *pkt)
+{
+	int i, ret = 0;
+	static const struct iris_hfi_packet_handle hfi_pkt_handle[] = {
+		{HFI_CMD_OPEN,              NULL                    },
+		{HFI_CMD_CLOSE,             handle_session_close    },
+		{HFI_CMD_START,             NULL                    },
+		{HFI_CMD_STOP,              handle_session_stop     },
+		{HFI_CMD_DRAIN,             handle_session_drain    },
+		{HFI_CMD_BUFFER,            handle_session_buffer   },
+		{HFI_CMD_SETTINGS_CHANGE,   handle_src_change       },
+		{HFI_CMD_SUBSCRIBE_MODE,    NULL                    },
+		{HFI_CMD_PAUSE,             NULL                    },
+		{HFI_CMD_RESUME,            NULL                    },
+	};
+
+	for (i = 0; i < ARRAY_SIZE(hfi_pkt_handle); i++) {
+		if (hfi_pkt_handle[i].type == pkt->type) {
+			if (hfi_pkt_handle[i].handle) {
+				ret = hfi_pkt_handle[i].handle(inst, pkt);
+				if (ret)
+					return ret;
+			}
+			break;
+		}
+	}
+
+	if (i == ARRAY_SIZE(hfi_pkt_handle))
+		return -EINVAL;
+
+	return ret;
+}
+
+static int handle_dpb_list_property(struct iris_inst *inst,
+				    struct hfi_packet *pkt)
+{
+	u8 *payload_start;
+	u32 payload_size;
+
+	if (inst->domain != DECODER)
+		return -EINVAL;
+
+	payload_size = pkt->size - sizeof(*pkt);
+	payload_start = (u8 *)((u8 *)pkt + sizeof(*pkt));
+	memset(inst->dpb_list_payload, 0, MAX_DPB_LIST_ARRAY_SIZE);
+
+	if (payload_size > MAX_DPB_LIST_PAYLOAD_SIZE) {
+		iris_inst_change_state(inst, IRIS_INST_ERROR);
+		return -EINVAL;
+	}
+
+	memcpy(inst->dpb_list_payload, payload_start, payload_size);
+
+	return 0;
+}
+
+static int handle_session_property(struct iris_inst *inst,
+				   struct hfi_packet *pkt)
+{
+	u32 *payload_ptr = NULL;
+	int ret = 0;
+
+	if (pkt->flags & HFI_FW_FLAGS_INFORMATION)
+		return 0;
+
+	payload_ptr = (u32 *)((u8 *)pkt + sizeof(*pkt));
+	if (!payload_ptr)
+		return -EINVAL;
+
+	switch (pkt->type) {
+	case HFI_PROP_BITSTREAM_RESOLUTION:
+		inst->src_subcr_params.bitstream_resolution = payload_ptr[0];
+		break;
+	case HFI_PROP_CROP_OFFSETS:
+		inst->src_subcr_params.crop_offsets[0] = payload_ptr[0];
+		inst->src_subcr_params.crop_offsets[1] = payload_ptr[1];
+		break;
+	case HFI_PROP_LUMA_CHROMA_BIT_DEPTH:
+		inst->src_subcr_params.bit_depth = payload_ptr[0];
+		break;
+	case HFI_PROP_CODED_FRAMES:
+		inst->src_subcr_params.coded_frames = payload_ptr[0];
+		break;
+	case HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT:
+		inst->src_subcr_params.fw_min_count = payload_ptr[0];
+		break;
+	case HFI_PROP_PIC_ORDER_CNT_TYPE:
+		inst->src_subcr_params.pic_order_cnt = payload_ptr[0];
+		break;
+	case HFI_PROP_SIGNAL_COLOR_INFO:
+		inst->src_subcr_params.color_info = payload_ptr[0];
+		break;
+	case HFI_PROP_PROFILE:
+		inst->src_subcr_params.profile = payload_ptr[0];
+		break;
+	case HFI_PROP_LEVEL:
+		inst->src_subcr_params.level = payload_ptr[0];
+		break;
+	case HFI_PROP_TIER:
+		inst->src_subcr_params.tier = payload_ptr[0];
+		break;
+	case HFI_PROP_PICTURE_TYPE:
+		inst->hfi_frame_info.picture_type = payload_ptr[0];
+		if (inst->hfi_frame_info.picture_type & HFI_PICTURE_B)
+			inst->has_bframe = true;
+		if (inst->hfi_frame_info.picture_type & HFI_PICTURE_IDR)
+			inst->iframe = true;
+		else
+			inst->iframe = false;
+		break;
+	case HFI_PROP_CABAC_SESSION:
+		if (payload_ptr[0] == 1)
+			inst->cap[ENTROPY_MODE].value = V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC;
+		else
+			inst->cap[ENTROPY_MODE].value = V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC;
+		break;
+	case HFI_PROP_DPB_LIST:
+		ret = handle_dpb_list_property(inst, pkt);
+		if (ret)
+			break;
+		break;
+	case HFI_PROP_NO_OUTPUT:
+		inst->hfi_frame_info.no_output = 1;
+		break;
+	case HFI_PROP_QUALITY_MODE:
+	case HFI_PROP_STAGE:
+	case HFI_PROP_PIPE:
+		break;
+	default:
+		break;
+	}
+
+	return ret;
+}
+
+static int handle_image_version_property(struct iris_core *core,
+					 struct hfi_packet *pkt)
+{
+	u8 *str_image_version;
+	u32 req_bytes;
+	u32 i = 0;
+
+	req_bytes = pkt->size - sizeof(*pkt);
+	if (req_bytes < IRIS_VERSION_LENGTH - 1)
+		return -EINVAL;
+
+	str_image_version = (u8 *)pkt + sizeof(*pkt);
+
+	for (i = 0; i < IRIS_VERSION_LENGTH - 1; i++) {
+		if (str_image_version[i] != '\0')
+			core->fw_version[i] = str_image_version[i];
+		else
+			core->fw_version[i] = ' ';
+	}
+	core->fw_version[i] = '\0';
+
+	return 0;
+}
+
+static int handle_system_property(struct iris_core *core,
+				  struct hfi_packet *pkt)
+{
+	int ret = 0;
+
+	switch (pkt->type) {
+	case HFI_PROP_IMAGE_VERSION:
+		ret = handle_image_version_property(core, pkt);
+		break;
+	default:
+		break;
+	}
+
+	return ret;
+}
+
+static int handle_system_response(struct iris_core *core,
+				  struct hfi_header *hdr)
+{
+	struct hfi_packet *packet;
+	u8 *pkt, *start_pkt;
+	int ret = 0;
+	int i, j;
+	static const struct iris_core_hfi_range be[] = {
+		{HFI_SYSTEM_ERROR_BEGIN,   HFI_SYSTEM_ERROR_END,   handle_system_error     },
+		{HFI_PROP_BEGIN,           HFI_PROP_END,           handle_system_property  },
+		{HFI_CMD_BEGIN,            HFI_CMD_END,            handle_system_init      },
+	};
+
+	start_pkt = (u8 *)((u8 *)hdr + sizeof(*hdr));
+	for (i = 0; i < ARRAY_SIZE(be); i++) {
+		pkt = start_pkt;
+		for (j = 0; j < hdr->num_packets; j++) {
+			packet = (struct hfi_packet *)pkt;
+			if (packet->flags & HFI_FW_FLAGS_SYSTEM_ERROR) {
+				ret = handle_system_error(core, packet);
+				return ret;
+			}
+
+			if (packet->type > be[i].begin && packet->type < be[i].end) {
+				ret = be[i].handle(core, packet);
+				if (ret)
+					return ret;
+
+				if (packet->type >  HFI_SYSTEM_ERROR_BEGIN &&
+				    packet->type < HFI_SYSTEM_ERROR_END)
+					return 0;
+			}
+			pkt += packet->size;
+		}
+	}
+
+	return ret;
+}
+
+static int handle_session_response(struct iris_core *core,
+				   struct hfi_header *hdr)
+{
+	struct hfi_packet *packet;
+	struct iris_inst *inst;
+	bool dequeue = false;
+	u8 *pkt, *start_pkt;
+	int ret = 0;
+	int i, j;
+	static const struct iris_inst_hfi_range be[] = {
+		{HFI_SESSION_ERROR_BEGIN,  HFI_SESSION_ERROR_END,  handle_session_error    },
+		{HFI_INFORMATION_BEGIN,    HFI_INFORMATION_END,    handle_session_info     },
+		{HFI_PROP_BEGIN,           HFI_PROP_END,           handle_session_property },
+		{HFI_CMD_BEGIN,            HFI_CMD_END,            handle_session_command  },
+	};
+
+	inst = to_instance(core, hdr->session_id);
+	if (!inst)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	memset(&inst->hfi_frame_info, 0, sizeof(struct iris_hfi_frame_info));
+
+	pkt = (u8 *)((u8 *)hdr + sizeof(*hdr));
+	for (i = 0; i < hdr->num_packets; i++) {
+		packet = (struct hfi_packet *)pkt;
+		if (packet->type == HFI_CMD_SETTINGS_CHANGE) {
+			if (packet->port == HFI_PORT_BITSTREAM) {
+				vdec_init_src_change_param(inst);
+				break;
+			}
+		}
+		pkt += packet->size;
+	}
+
+	start_pkt = (u8 *)((u8 *)hdr + sizeof(*hdr));
+	for (i = 0; i < ARRAY_SIZE(be); i++) {
+		pkt = start_pkt;
+		for (j = 0; j < hdr->num_packets; j++) {
+			packet = (struct hfi_packet *)pkt;
+			if (packet->flags & HFI_FW_FLAGS_SESSION_ERROR)
+				handle_session_error(inst, packet);
+
+			if (packet->type > be[i].begin && packet->type < be[i].end) {
+				dequeue |= (packet->type == HFI_CMD_BUFFER);
+				ret = be[i].handle(inst, packet);
+				if (ret)
+					iris_inst_change_state(inst, IRIS_INST_ERROR);
+			}
+			pkt += packet->size;
+		}
+	}
+
+	if (dequeue) {
+		ret = handle_dequeue_buffers(inst);
+		if (ret)
+			goto unlock;
+	}
+
+	memset(&inst->hfi_frame_info, 0, sizeof(struct iris_hfi_frame_info));
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int handle_response(struct iris_core *core, void *response)
+{
+	struct hfi_header *hdr;
+	int ret;
+
+	iris_pm_touch(core);
+
+	hdr = (struct hfi_header *)response;
+	ret = validate_hdr_packet(core, hdr);
+	if (ret)
+		return handle_system_error(core, NULL);
+
+	if (!hdr->session_id)
+		return handle_system_response(core, hdr);
+	else
+		return handle_session_response(core, hdr);
+
+	return ret;
+}
+
+int __response_handler(struct iris_core *core)
+{
+	int ret = 0;
+
+	if (call_vpu_op(core, watchdog, core, core->intr_status)) {
+		struct hfi_packet pkt = {.type = HFI_SYS_ERROR_WD_TIMEOUT};
+
+		mutex_lock(&core->lock);
+		iris_change_core_state(core, IRIS_CORE_ERROR);
+		dev_err(core->dev, "%s: CPU WD error received\n", __func__);
+		mutex_unlock(&core->lock);
+
+		return handle_system_error(core, &pkt);
+	}
+
+	memset(core->response_packet, 0, core->packet_size);
+	while (!iris_hfi_queue_msg_read(core, core->response_packet)) {
+		ret = handle_response(core, core->response_packet);
+		if (ret)
+			continue;
+		if (core->state != IRIS_CORE_INIT)
+			break;
+		memset(core->response_packet, 0, core->packet_size);
+	}
+
+	iris_flush_debug_queue(core, core->response_packet, core->packet_size);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_hfi_response.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_hfi_response.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_HFI_RESPONSE_H_
+#define _IRIS_HFI_RESPONSE_H_
+
+#include "iris_core.h"
+
+struct sfr_buffer {
+	u32 bufsize;
+	u8 rg_data[];
+};
+
+int __response_handler(struct iris_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_instance.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_instance.h
@@ -0,0 +1,112 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_INSTANCE_H_
+#define _IRIS_INSTANCE_H_
+
+#include <media/v4l2-ctrls.h>
+
+#include "hfi_defines.h"
+#include "iris_buffer.h"
+#include "iris_common.h"
+#include "iris_core.h"
+#include "iris_common.h"
+#include "platform_common.h"
+
+/**
+ * struct iris_inst - holds per video instance parameters
+ *
+ * @list: used for attach an instance to the core
+ * @core: pointer to core structure
+ * @session_id: id of current video session
+ * @vb2q_src: source vb2 queue
+ * @vb2q_dst: destination vb2 queue
+ * @ctx_q_lock: lock to serialize queues related ioctls
+ * @lock: lock to seralise forward and reverse threads
+ * @fh: reference of v4l2 file handler
+ * @fmt_src: structure of v4l2_format for source
+ * @fmt_dst: structure of v4l2_format for destination
+ * @ctrl_handler: reference of v4l2 ctrl handler
+ * @crop: structure of crop info
+ * @compose: structure of compose info
+ * @packet: HFI packet
+ * @packet_size: HFI packet size
+ * @completions: structure of signal completions
+ * @cap: array of supported instance capabilities
+ * @num_ctrls: supported number of controls
+ * @caps_list: list head of capability
+ * @codec: codec type
+ * @domain: domain type: encoder or decoder
+ * @mem_pool: pointer to memory pool of buffers
+ * @buffers: structure of buffer info
+ * @fw_min_count: minimnum count of buffers needed by fw
+ * @state: instance state
+ * @sub_state: instance sub state
+ * @ipsc_properties_set: boolean to set ipsc properties to fw
+ * @opsc_properties_set: boolean to set opsc properties to fw
+ * @hfi_frame_info: structure of frame info
+ * @src_subcr_params: subscription params to fw on input port
+ * @dst_subcr_params: subscription params to fw on output port
+ * @dpb_list_payload: array of dpb buffers
+ * @once_per_session_set: boolean to set once per session property
+ * @max_rate: max input rate
+ * @max_input_data_size: max size of input data
+ * @power: structure of power info
+ * @bus_data: structure of bus data
+ * @input_timer_list: list head of input timer
+ * @ir_enabled: boolean for intra refresh
+ * @hfi_rc_type: rate control type
+ * @hfi_layer_type: type of HFI layer encoding
+ * @has_bframe: boolean to set if bitstream contains B frame
+ * @iframe: boolean to set if bitstream contains I frame
+ */
+
+struct iris_inst {
+	struct list_head		list;
+	struct iris_core		*core;
+	u32				session_id;
+	struct vb2_queue		*vb2q_src;
+	struct vb2_queue		*vb2q_dst;
+	struct mutex			ctx_q_lock;/* lock to serialize queues related ioctls */
+	struct mutex			lock;
+	struct v4l2_fh			fh;
+	struct v4l2_format		*fmt_src;
+	struct v4l2_format		*fmt_dst;
+	struct v4l2_ctrl_handler	ctrl_handler;
+	struct rect_desc		crop;
+	struct rect_desc		compose;
+	void				*packet;
+	u32				packet_size;
+	struct completion		completions[MAX_SIGNAL];
+	struct plat_inst_cap		cap[INST_CAP_MAX + 1];
+	u32				num_ctrls;
+	struct list_head		caps_list;
+	enum codec_type			codec;
+	enum domain_type		domain;
+	struct iris_mem_pool		*mem_pool;
+	struct iris_buffers_info	buffers;
+	u32				fw_min_count;
+	enum iris_inst_state		state;
+	enum iris_inst_sub_state	sub_state;
+	bool				ipsc_properties_set;
+	bool				opsc_properties_set;
+	struct iris_hfi_frame_info	hfi_frame_info;
+	struct subscription_params	src_subcr_params;
+	struct subscription_params	dst_subcr_params;
+	u32				dpb_list_payload[MAX_DPB_LIST_ARRAY_SIZE];
+	bool				once_per_session_set;
+	u32				max_rate;
+	u32				max_input_data_size;
+	struct iris_inst_power		power;
+	struct bus_vote_data		bus_data;
+	struct list_head		input_timer_list;
+	bool				ir_enabled;
+	u32				hfi_rc_type;
+	u32				hfi_layer_type;
+	bool				has_bframe;
+	bool				iframe;
+};
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_power.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_power.c
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_power.h"
+#include "iris_helpers.h"
+#include "resources.h"
+
+static int iris_set_buses(struct iris_inst *inst)
+{
+	struct iris_inst *instance;
+	struct iris_core *core;
+	u64 total_bw_ddr = 0;
+	int ret;
+
+	core = inst->core;
+
+	mutex_lock(&core->lock);
+	list_for_each_entry(instance, &core->instances, list) {
+		if (!instance->max_input_data_size)
+			continue;
+
+		total_bw_ddr += instance->power.bus_bw;
+	}
+
+	ret = vote_buses(core, total_bw_ddr);
+
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+static int iris_vote_buses(struct iris_inst *inst)
+{
+	struct v4l2_format *out_f, *inp_f;
+	struct bus_vote_data *vote_data;
+	struct iris_core *core;
+
+	core = inst->core;
+
+	vote_data = &inst->bus_data;
+
+	out_f = inst->fmt_dst;
+	inp_f = inst->fmt_src;
+
+	vote_data->width = inp_f->fmt.pix_mp.width;
+	vote_data->height = inp_f->fmt.pix_mp.height;
+	vote_data->fps = inst->max_rate;
+
+	if (inst->domain == ENCODER) {
+		vote_data->color_formats[0] =
+			v4l2_colorformat_to_driver(inst, inst->fmt_src->fmt.pix_mp.pixelformat);
+	} else if (inst->domain == DECODER) {
+		if (is_linear_colorformat(out_f->fmt.pix_mp.pixelformat)) {
+			vote_data->color_formats[0] = V4L2_PIX_FMT_NV12;
+			vote_data->color_formats[1] = out_f->fmt.pix_mp.pixelformat;
+		} else {
+			vote_data->color_formats[0] = out_f->fmt.pix_mp.pixelformat;
+		}
+	}
+
+	call_session_op(core, calc_bw, inst, vote_data);
+
+	inst->power.bus_bw = vote_data->bus_bw;
+
+	return iris_set_buses(inst);
+}
+
+static int iris_set_clocks(struct iris_inst *inst)
+{
+	struct iris_inst *instance;
+	struct iris_core *core;
+	int ret = 0;
+	u64 freq;
+
+	core = inst->core;
+
+	mutex_lock(&core->lock);
+
+	freq = 0;
+	list_for_each_entry(instance, &core->instances, list) {
+		if (!instance->max_input_data_size)
+			continue;
+
+		freq += instance->power.min_freq;
+	}
+
+	core->power.clk_freq = freq;
+
+	ret = opp_set_rate(core, freq);
+
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+static int iris_scale_clocks(struct iris_inst *inst)
+{
+	struct iris_buffer *vbuf;
+	struct iris_core *core;
+	u32 data_size = 0;
+
+	core = inst->core;
+
+	list_for_each_entry(vbuf, &inst->buffers.input.list, list)
+		data_size = max(data_size, vbuf->data_size);
+
+	inst->max_input_data_size = data_size;
+
+	if (inst->domain == ENCODER) {
+		inst->max_rate = max((inst->cap[OPERATING_RATE].value >> 16),
+			(inst->cap[FRAME_RATE].value >> 16));
+	} else if (inst->domain == DECODER) {
+		inst->max_rate = inst->cap[QUEUED_RATE].value >> 16;
+	}
+
+	if (!inst->max_input_data_size)
+		return 0;
+
+	inst->power.min_freq = call_session_op(core, calc_freq, inst,
+					       inst->max_input_data_size);
+	iris_set_clocks(inst);
+
+	return 0;
+}
+
+int iris_scale_power(struct iris_inst *inst)
+{
+	iris_scale_clocks(inst);
+	iris_vote_buses(inst);
+
+	return 0;
+}
+
+int iris_update_input_rate(struct iris_inst *inst, u64 time_us)
+{
+	struct iris_input_timer *prev_timer = NULL;
+	struct iris_input_timer *input_timer;
+	u64 input_timer_sum_us = 0;
+	u64 counter = 0;
+
+	input_timer = kzalloc(sizeof(*input_timer), GFP_KERNEL);
+	if (!input_timer)
+		return -ENOMEM;
+
+	input_timer->time_us = time_us;
+	INIT_LIST_HEAD(&input_timer->list);
+	list_add_tail(&input_timer->list, &inst->input_timer_list);
+	list_for_each_entry(input_timer, &inst->input_timer_list, list) {
+		if (prev_timer) {
+			input_timer_sum_us += input_timer->time_us - prev_timer->time_us;
+			counter++;
+		}
+		prev_timer = input_timer;
+	}
+
+	if (input_timer_sum_us && counter >= INPUT_TIMER_LIST_SIZE)
+		inst->cap[QUEUED_RATE].value =
+			(s32)(DIV64_U64_ROUND_CLOSEST(counter * 1000000,
+				input_timer_sum_us) << 16);
+
+	if (counter >= INPUT_TIMER_LIST_SIZE) {
+		input_timer = list_first_entry(&inst->input_timer_list,
+					       struct iris_input_timer, list);
+		list_del_init(&input_timer->list);
+		kfree(input_timer);
+	}
+
+	return 0;
+}
+
+int iris_flush_input_timer(struct iris_inst *inst)
+{
+	struct iris_input_timer *input_timer, *dummy_timer;
+
+	list_for_each_entry_safe(input_timer, dummy_timer, &inst->input_timer_list, list) {
+		list_del_init(&input_timer->list);
+		kfree(input_timer);
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_power.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_power.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_POWER_H_
+#define _IRIS_POWER_H_
+
+#include "iris_instance.h"
+
+int iris_scale_power(struct iris_inst *inst);
+int iris_update_input_rate(struct iris_inst *inst, u64 time_us);
+int iris_flush_input_timer(struct iris_inst *inst);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_probe.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_probe.c
@@ -0,0 +1,367 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+
+#include "iris_core.h"
+#include "iris_ctrls.h"
+#include "iris_helpers.h"
+#include "iris_hfi.h"
+#include "iris_hfi_queue.h"
+#include "iris_vidc.h"
+#include "resources.h"
+
+static int init_iris_isr(struct iris_core *core)
+{
+	int ret;
+
+	ret = devm_request_threaded_irq(core->dev, core->irq, iris_hfi_isr,
+					iris_hfi_isr_handler, IRQF_TRIGGER_HIGH, "iris", core);
+	if (ret) {
+		dev_err(core->dev, "%s: Failed to allocate iris IRQ\n", __func__);
+		return ret;
+	}
+	disable_irq_nosync(core->irq);
+
+	return ret;
+}
+
+static void iris_unregister_video_device(struct iris_core *core, enum domain_type type)
+{
+	if (type == DECODER)
+		video_unregister_device(core->vdev_dec);
+	else if (type == ENCODER)
+		video_unregister_device(core->vdev_enc);
+}
+
+static int iris_register_video_device(struct iris_core *core, enum domain_type type)
+{
+	struct video_device *vdev;
+	int ret = 0;
+
+	vdev = video_device_alloc();
+	if (!vdev)
+		return -ENOMEM;
+
+	vdev->release = video_device_release;
+	vdev->fops = core->v4l2_file_ops;
+	vdev->vfl_dir = VFL_DIR_M2M;
+	vdev->v4l2_dev = &core->v4l2_dev;
+	vdev->device_caps = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING;
+
+	if (type == DECODER) {
+		strscpy(vdev->name, "qcom-iris-decoder", sizeof(vdev->name));
+		vdev->ioctl_ops = core->v4l2_ioctl_ops_dec;
+
+		ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
+		if (ret)
+			goto err_vdev_release;
+
+		core->vdev_dec = vdev;
+	} else if (type == ENCODER) {
+		strscpy(vdev->name, "qcom-iris-encoder", sizeof(vdev->name));
+		vdev->ioctl_ops = core->v4l2_ioctl_ops_enc;
+
+		ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
+		if (ret)
+			goto err_vdev_release;
+
+		core->vdev_enc = vdev;
+	}
+
+	video_set_drvdata(vdev, core);
+
+	return ret;
+
+err_vdev_release:
+	video_device_release(vdev);
+
+	return ret;
+}
+
+static void iris_remove(struct platform_device *pdev)
+{
+	struct iris_core *core;
+
+	core = platform_get_drvdata(pdev);
+	if (!core)
+		return;
+
+	iris_pm_get(core);
+
+	iris_core_deinit(core);
+	iris_hfi_queue_deinit(core);
+
+	iris_unregister_video_device(core, DECODER);
+
+	iris_unregister_video_device(core, ENCODER);
+
+	v4l2_device_unregister(&core->v4l2_dev);
+
+	iris_pm_put(core, false);
+
+	mutex_destroy(&core->lock);
+	core->state = IRIS_CORE_DEINIT;
+}
+
+static int iris_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct iris_core *core;
+	u64 dma_mask;
+	int ret;
+
+	core = devm_kzalloc(&pdev->dev, sizeof(*core), GFP_KERNEL);
+	if (!core)
+		return -ENOMEM;
+	core->dev = dev;
+
+	core->state = IRIS_CORE_DEINIT;
+	mutex_init(&core->lock);
+
+	core->packet_size = IFACEQ_CORE_PKT_SIZE;
+	core->packet = devm_kzalloc(core->dev, core->packet_size, GFP_KERNEL);
+	if (!core->packet)
+		return -ENOMEM;
+
+	core->response_packet = devm_kzalloc(core->dev, core->packet_size, GFP_KERNEL);
+	if (!core->response_packet)
+		return -ENOMEM;
+
+	INIT_LIST_HEAD(&core->instances);
+
+	core->reg_base = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(core->reg_base))
+		return PTR_ERR(core->reg_base);
+
+	core->irq = platform_get_irq(pdev, 0);
+	if (core->irq < 0)
+		return core->irq;
+
+	pm_runtime_set_autosuspend_delay(core->dev, AUTOSUSPEND_DELAY_VALUE);
+	pm_runtime_use_autosuspend(core->dev);
+	ret = devm_pm_runtime_enable(core->dev);
+	if (ret) {
+		dev_err(core->dev, "failed to enable runtime pm\n");
+		goto err_runtime_disable;
+	}
+
+	ret = init_iris_isr(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret,
+			      "%s: Failed to init isr with %d\n", __func__, ret);
+		goto err_runtime_disable;
+	}
+
+	ret = init_platform(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret,
+			      "%s: init platform failed with %d\n", __func__, ret);
+		goto err_runtime_disable;
+	}
+
+	ret = init_vpu(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret,
+			      "%s: init vpu failed with %d\n", __func__, ret);
+		goto err_runtime_disable;
+	}
+
+	ret = init_ops(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret,
+			      "%s: init ops failed with %d\n", __func__, ret);
+		goto err_runtime_disable;
+	}
+
+	ret = init_resources(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret,
+			      "%s: init resource failed with %d\n", __func__, ret);
+		goto err_runtime_disable;
+	}
+
+	ret = iris_init_core_caps(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret,
+			      "%s: init core caps failed with %d\n", __func__, ret);
+		goto err_runtime_disable;
+	}
+
+	ret = iris_init_instance_caps(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret,
+			      "%s: init inst caps failed with %d\n", __func__, ret);
+		goto err_runtime_disable;
+	}
+
+	ret = v4l2_device_register(dev, &core->v4l2_dev);
+	if (ret)
+		goto err_runtime_disable;
+
+	ret = iris_register_video_device(core, DECODER);
+	if (ret)
+		goto err_v4l2_unreg;
+
+	ret = iris_register_video_device(core, ENCODER);
+	if (ret)
+		goto err_vdev_unreg_dec;
+
+	platform_set_drvdata(pdev, core);
+
+	dma_mask = core->cap[DMA_MASK].value;
+
+	ret = dma_set_mask_and_coherent(dev, dma_mask);
+	if (ret)
+		goto err_vdev_unreg_enc;
+
+	dma_set_max_seg_size(&pdev->dev, (unsigned int)DMA_BIT_MASK(32));
+	dma_set_seg_boundary(&pdev->dev, (unsigned long)DMA_BIT_MASK(64));
+
+	ret = iris_hfi_queue_init(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret,
+			      "%s: interface queues init failed\n", __func__);
+		goto err_vdev_unreg_enc;
+	}
+
+	ret = iris_pm_get(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret, "%s: failed to get runtime pm\n", __func__);
+		goto err_queue_deinit;
+	}
+
+	ret = iris_core_init(core);
+	if (ret) {
+		dev_err_probe(core->dev, ret, "%s: core init failed\n", __func__);
+		goto err_queue_deinit;
+	}
+
+	ret = iris_pm_put(core, false);
+	if (ret) {
+		pm_runtime_get_noresume(core->dev);
+		dev_err_probe(core->dev, ret, "%s: failed to put runtime pm\n", __func__);
+		goto err_core_deinit;
+	}
+
+	return ret;
+
+err_core_deinit:
+	iris_core_deinit(core);
+err_queue_deinit:
+	iris_hfi_queue_deinit(core);
+err_vdev_unreg_enc:
+	iris_unregister_video_device(core, ENCODER);
+err_vdev_unreg_dec:
+	iris_unregister_video_device(core, DECODER);
+err_v4l2_unreg:
+	v4l2_device_unregister(&core->v4l2_dev);
+err_runtime_disable:
+	pm_runtime_put_noidle(core->dev);
+	pm_runtime_set_suspended(core->dev);
+
+	return ret;
+}
+
+static int iris_pm_suspend(struct device *dev)
+{
+	struct iris_core *core;
+	int ret;
+
+	if (!dev || !dev->driver)
+		return 0;
+
+	core = dev_get_drvdata(dev);
+
+	mutex_lock(&core->lock);
+
+	if (core->num_pending_requests > 0) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (!core_in_valid_state(core)) {
+		ret = 0;
+		goto unlock;
+	}
+
+	if (!core->power_enabled) {
+		ret = 0;
+		goto unlock;
+	}
+
+	ret = iris_hfi_pm_suspend(core);
+
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+static int iris_pm_resume(struct device *dev)
+{
+	struct iris_core *core;
+	int ret;
+
+	if (!dev || !dev->driver)
+		return 0;
+
+	core = dev_get_drvdata(dev);
+
+	if (!core_in_valid_state(core)) {
+		ret = 0;
+		goto exit;
+	}
+
+	if (core->power_enabled) {
+		ret = 0;
+		goto exit;
+	}
+
+	ret = iris_hfi_pm_resume(core);
+
+	iris_pm_touch_unlocked(core);
+
+exit:
+
+	return ret;
+}
+
+static const struct dev_pm_ops iris_pm_ops = {
+	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+				pm_runtime_force_resume)
+	SET_RUNTIME_PM_OPS(iris_pm_suspend, iris_pm_resume, NULL)
+};
+
+static const struct of_device_id iris_dt_match[] = {
+	{
+		.compatible = "qcom,sm8550-iris",
+		.data = &sm8550_data,
+	},
+	{
+		.compatible = "qcom,qcm6490-iris",
+		.data = &qcm6490_data,
+	},
+	{ },
+};
+MODULE_DEVICE_TABLE(of, iris_dt_match);
+
+static struct platform_driver qcom_iris_driver = {
+	.probe = iris_probe,
+	.remove_new = iris_remove,
+	.driver = {
+		.name = "qcom-iris",
+		.of_match_table = iris_dt_match,
+		.pm = &iris_pm_ops,
+	},
+};
+
+module_platform_driver(qcom_iris_driver);
+MODULE_IMPORT_NS(DMA_BUF);
+MODULE_DESCRIPTION("Qualcomm Iris video driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_state.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_state.c
@@ -0,0 +1,453 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_core.h"
+#include "iris_helpers.h"
+#include "iris_state.h"
+
+#define IRIS_STATE(name)[IRIS_CORE_##name] = "CORE_"#name
+
+static const char * const core_state_names[] = {
+	IRIS_STATE(DEINIT),
+	IRIS_STATE(INIT_WAIT),
+	IRIS_STATE(INIT),
+	IRIS_STATE(ERROR),
+};
+
+#undef IRIS_STATE
+
+bool core_in_valid_state(struct iris_core *core)
+{
+	return core->state == IRIS_CORE_INIT ||
+		core->state == IRIS_CORE_INIT_WAIT;
+}
+
+static const char *core_state_name(enum iris_core_state state)
+{
+	if ((unsigned int)state < ARRAY_SIZE(core_state_names))
+		return core_state_names[state];
+
+	return "UNKNOWN_STATE";
+}
+
+static bool iris_allow_core_state_change(struct iris_core *core,
+					 enum iris_core_state req_state)
+{
+	if (core->state == IRIS_CORE_DEINIT)
+		return req_state == IRIS_CORE_INIT_WAIT || req_state == IRIS_CORE_ERROR;
+	else if (core->state == IRIS_CORE_INIT_WAIT)
+		return req_state == IRIS_CORE_INIT || req_state == IRIS_CORE_ERROR;
+	else if (core->state == IRIS_CORE_INIT)
+		return req_state == IRIS_CORE_DEINIT || req_state == IRIS_CORE_ERROR;
+	else if (core->state == IRIS_CORE_ERROR)
+		return req_state == IRIS_CORE_DEINIT;
+
+	dev_warn(core->dev, "core state change %s -> %s is not allowed\n",
+		 core_state_name(core->state), core_state_name(req_state));
+
+	return false;
+}
+
+int iris_change_core_state(struct iris_core *core,
+			   enum iris_core_state request_state)
+{
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return ret;
+
+	if (core->state == request_state)
+		return 0;
+
+	if (!iris_allow_core_state_change(core, request_state))
+		return -EINVAL;
+
+	core->state = request_state;
+
+	return ret;
+}
+
+struct iris_inst_state_change_allow {
+	enum iris_inst_state        from;
+	enum iris_inst_state        to;
+	enum state_change           allow;
+};
+
+static enum state_change iris_allow_inst_state_change(struct iris_inst *inst,
+						      enum iris_inst_state req_state)
+{
+	enum state_change allow = STATE_CHANGE_ALLOW;
+	int cnt;
+	static struct iris_inst_state_change_allow state[] = {
+		/* from, to, allow */
+		{IRIS_INST_OPEN,             IRIS_INST_OPEN,               STATE_CHANGE_IGNORE    },
+		{IRIS_INST_OPEN,             IRIS_INST_INPUT_STREAMING,    STATE_CHANGE_ALLOW     },
+		{IRIS_INST_OPEN,             IRIS_INST_OUTPUT_STREAMING,   STATE_CHANGE_ALLOW     },
+		{IRIS_INST_OPEN,             IRIS_INST_STREAMING,          STATE_CHANGE_DISALLOW  },
+		{IRIS_INST_OPEN,             IRIS_INST_CLOSE,              STATE_CHANGE_ALLOW     },
+		{IRIS_INST_OPEN,             IRIS_INST_ERROR,              STATE_CHANGE_ALLOW     },
+
+		{IRIS_INST_INPUT_STREAMING,  IRIS_INST_OPEN,               STATE_CHANGE_ALLOW     },
+		{IRIS_INST_INPUT_STREAMING,  IRIS_INST_INPUT_STREAMING,    STATE_CHANGE_IGNORE    },
+		{IRIS_INST_INPUT_STREAMING,  IRIS_INST_OUTPUT_STREAMING,   STATE_CHANGE_DISALLOW  },
+		{IRIS_INST_INPUT_STREAMING,  IRIS_INST_STREAMING,          STATE_CHANGE_ALLOW     },
+		{IRIS_INST_INPUT_STREAMING,  IRIS_INST_CLOSE,              STATE_CHANGE_ALLOW     },
+		{IRIS_INST_INPUT_STREAMING,  IRIS_INST_ERROR,              STATE_CHANGE_ALLOW     },
+
+		{IRIS_INST_OUTPUT_STREAMING, IRIS_INST_OPEN,               STATE_CHANGE_ALLOW     },
+		{IRIS_INST_OUTPUT_STREAMING, IRIS_INST_INPUT_STREAMING,    STATE_CHANGE_DISALLOW  },
+		{IRIS_INST_OUTPUT_STREAMING, IRIS_INST_OUTPUT_STREAMING,   STATE_CHANGE_IGNORE    },
+		{IRIS_INST_OUTPUT_STREAMING, IRIS_INST_STREAMING,          STATE_CHANGE_ALLOW     },
+		{IRIS_INST_OUTPUT_STREAMING, IRIS_INST_CLOSE,              STATE_CHANGE_ALLOW     },
+		{IRIS_INST_OUTPUT_STREAMING, IRIS_INST_ERROR,              STATE_CHANGE_ALLOW     },
+
+		{IRIS_INST_STREAMING,        IRIS_INST_OPEN,               STATE_CHANGE_DISALLOW  },
+		{IRIS_INST_STREAMING,        IRIS_INST_INPUT_STREAMING,    STATE_CHANGE_ALLOW     },
+		{IRIS_INST_STREAMING,        IRIS_INST_OUTPUT_STREAMING,   STATE_CHANGE_ALLOW     },
+		{IRIS_INST_STREAMING,        IRIS_INST_STREAMING,          STATE_CHANGE_IGNORE    },
+		{IRIS_INST_STREAMING,        IRIS_INST_CLOSE,              STATE_CHANGE_ALLOW     },
+		{IRIS_INST_STREAMING,        IRIS_INST_ERROR,              STATE_CHANGE_ALLOW     },
+
+		{IRIS_INST_CLOSE,            IRIS_INST_OPEN,               STATE_CHANGE_DISALLOW  },
+		{IRIS_INST_CLOSE,            IRIS_INST_INPUT_STREAMING,    STATE_CHANGE_DISALLOW  },
+		{IRIS_INST_CLOSE,            IRIS_INST_OUTPUT_STREAMING,   STATE_CHANGE_DISALLOW  },
+		{IRIS_INST_CLOSE,            IRIS_INST_STREAMING,          STATE_CHANGE_DISALLOW  },
+		{IRIS_INST_CLOSE,            IRIS_INST_CLOSE,              STATE_CHANGE_IGNORE    },
+		{IRIS_INST_CLOSE,            IRIS_INST_ERROR,              STATE_CHANGE_IGNORE    },
+
+		{IRIS_INST_ERROR,            IRIS_INST_OPEN,               STATE_CHANGE_IGNORE    },
+		{IRIS_INST_ERROR,            IRIS_INST_INPUT_STREAMING,    STATE_CHANGE_IGNORE    },
+		{IRIS_INST_ERROR,            IRIS_INST_OUTPUT_STREAMING,   STATE_CHANGE_IGNORE    },
+		{IRIS_INST_ERROR,            IRIS_INST_STREAMING,          STATE_CHANGE_IGNORE    },
+		{IRIS_INST_ERROR,            IRIS_INST_CLOSE,              STATE_CHANGE_IGNORE    },
+		{IRIS_INST_ERROR,            IRIS_INST_ERROR,              STATE_CHANGE_IGNORE    },
+	};
+
+	for (cnt = 0; cnt < ARRAY_SIZE(state); cnt++) {
+		if (state[cnt].from == inst->state && state[cnt].to == req_state) {
+			allow = state[cnt].allow;
+			break;
+		}
+	}
+
+	return allow;
+}
+
+int iris_inst_change_state(struct iris_inst *inst,
+			   enum iris_inst_state request_state)
+{
+	enum state_change allow;
+
+	if (IS_SESSION_ERROR(inst))
+		return 0;
+
+	if (inst->state == request_state)
+		return 0;
+
+	allow = iris_allow_inst_state_change(inst, request_state);
+	if (allow != STATE_CHANGE_ALLOW)
+		return (allow == STATE_CHANGE_DISALLOW ? -EINVAL : 0);
+
+	inst->state = request_state;
+
+	return 0;
+}
+
+bool allow_s_fmt(struct iris_inst *inst, u32 type)
+{
+	return (inst->state == IRIS_INST_OPEN) ||
+		(type == OUTPUT_MPLANE && inst->state == IRIS_INST_INPUT_STREAMING) ||
+		(type == INPUT_MPLANE && inst->state == IRIS_INST_OUTPUT_STREAMING);
+}
+
+bool allow_reqbufs(struct iris_inst *inst, u32 type)
+{
+	return (inst->state == IRIS_INST_OPEN) ||
+		(type == OUTPUT_MPLANE && inst->state == IRIS_INST_INPUT_STREAMING) ||
+		(type == INPUT_MPLANE && inst->state == IRIS_INST_OUTPUT_STREAMING);
+}
+
+bool allow_qbuf(struct iris_inst *inst, u32 type)
+{
+	return (type == INPUT_MPLANE && inst->state == IRIS_INST_INPUT_STREAMING) ||
+		(type == INPUT_MPLANE && inst->state == IRIS_INST_STREAMING) ||
+		(type == OUTPUT_MPLANE && inst->state == IRIS_INST_OUTPUT_STREAMING) ||
+		(type == OUTPUT_MPLANE && inst->state == IRIS_INST_STREAMING);
+}
+
+bool allow_streamon(struct iris_inst *inst, u32 type)
+{
+	return (type == INPUT_MPLANE && inst->state == IRIS_INST_OPEN) ||
+		(type == INPUT_MPLANE && inst->state == IRIS_INST_OUTPUT_STREAMING) ||
+		(type == OUTPUT_MPLANE && inst->state == IRIS_INST_OPEN) ||
+		(type == OUTPUT_MPLANE && inst->state == IRIS_INST_INPUT_STREAMING);
+}
+
+bool allow_streamoff(struct iris_inst *inst, u32 type)
+{
+	return (type == INPUT_MPLANE && inst->state == IRIS_INST_INPUT_STREAMING) ||
+		(type == INPUT_MPLANE && inst->state == IRIS_INST_STREAMING) ||
+		(type == OUTPUT_MPLANE && inst->state == IRIS_INST_OUTPUT_STREAMING) ||
+		(type == OUTPUT_MPLANE && inst->state == IRIS_INST_STREAMING);
+}
+
+bool allow_s_ctrl(struct iris_inst *inst, u32 cap_id)
+{
+	return ((inst->state == IRIS_INST_OPEN) ||
+		((inst->cap[cap_id].flags & CAP_FLAG_DYNAMIC_ALLOWED) &&
+		 ((inst->state == IRIS_INST_INPUT_STREAMING && inst->domain == DECODER) ||
+		  (inst->state == IRIS_INST_OUTPUT_STREAMING && inst->domain == ENCODER) ||
+		  (inst->state == IRIS_INST_STREAMING))));
+}
+
+int iris_inst_state_change_streamon(struct iris_inst *inst, u32 plane)
+{
+	enum iris_inst_state new_state = IRIS_INST_ERROR;
+
+	if (plane == INPUT_MPLANE) {
+		if (inst->state == IRIS_INST_OPEN)
+			new_state = IRIS_INST_INPUT_STREAMING;
+		else if (inst->state == IRIS_INST_OUTPUT_STREAMING)
+			new_state = IRIS_INST_STREAMING;
+	} else if (plane == OUTPUT_MPLANE) {
+		if (inst->state == IRIS_INST_OPEN)
+			new_state = IRIS_INST_OUTPUT_STREAMING;
+		else if (inst->state == IRIS_INST_INPUT_STREAMING)
+			new_state = IRIS_INST_STREAMING;
+	}
+
+	return iris_inst_change_state(inst, new_state);
+}
+
+int iris_inst_state_change_streamoff(struct iris_inst *inst, u32 plane)
+{
+	enum iris_inst_state new_state = IRIS_INST_ERROR;
+
+	if (plane == INPUT_MPLANE) {
+		if (inst->state == IRIS_INST_INPUT_STREAMING)
+			new_state = IRIS_INST_OPEN;
+		else if (inst->state == IRIS_INST_STREAMING)
+			new_state = IRIS_INST_OUTPUT_STREAMING;
+	} else if (plane == OUTPUT_MPLANE) {
+		if (inst->state == IRIS_INST_OUTPUT_STREAMING)
+			new_state = IRIS_INST_OPEN;
+		else if (inst->state == IRIS_INST_STREAMING)
+			new_state = IRIS_INST_INPUT_STREAMING;
+	}
+
+	return iris_inst_change_state(inst, new_state);
+}
+
+struct iris_inst_sub_state_change_allow {
+	enum iris_inst_state state;
+	enum state_change allow;
+	u32 sub_state_mask;
+};
+
+static int iris_inst_allow_sub_state(struct iris_inst *inst, enum iris_inst_sub_state sub_state)
+{
+	int i;
+	static struct iris_inst_sub_state_change_allow sub_state_allow[] = {
+		{IRIS_INST_OPEN,              STATE_CHANGE_DISALLOW,    IRIS_INST_SUB_DRC         |
+									IRIS_INST_SUB_DRAIN       |
+									IRIS_INST_SUB_DRC_LAST    |
+									IRIS_INST_SUB_DRAIN_LAST  |
+									IRIS_INST_SUB_INPUT_PAUSE |
+									IRIS_INST_SUB_OUTPUT_PAUSE},
+
+		{IRIS_INST_INPUT_STREAMING,   STATE_CHANGE_DISALLOW,    IRIS_INST_SUB_DRC_LAST    |
+									IRIS_INST_SUB_DRAIN_LAST  |
+									IRIS_INST_SUB_OUTPUT_PAUSE},
+
+		{IRIS_INST_INPUT_STREAMING,   STATE_CHANGE_ALLOW,       IRIS_INST_SUB_DRC         |
+									IRIS_INST_SUB_DRAIN       |
+									IRIS_INST_SUB_INPUT_PAUSE },
+
+		{IRIS_INST_OUTPUT_STREAMING,  STATE_CHANGE_DISALLOW,    IRIS_INST_SUB_DRC         |
+									IRIS_INST_SUB_DRAIN       |
+									IRIS_INST_SUB_INPUT_PAUSE },
+
+		{IRIS_INST_OUTPUT_STREAMING,  STATE_CHANGE_ALLOW,       IRIS_INST_SUB_DRC_LAST    |
+									IRIS_INST_SUB_DRAIN_LAST  |
+									IRIS_INST_SUB_OUTPUT_PAUSE},
+
+		{IRIS_INST_STREAMING,         STATE_CHANGE_ALLOW,       IRIS_INST_SUB_DRC         |
+									IRIS_INST_SUB_DRAIN       |
+									IRIS_INST_SUB_DRC_LAST    |
+									IRIS_INST_SUB_DRAIN_LAST  |
+									IRIS_INST_SUB_INPUT_PAUSE |
+									IRIS_INST_SUB_OUTPUT_PAUSE},
+
+		{IRIS_INST_CLOSE,             STATE_CHANGE_ALLOW,       IRIS_INST_SUB_DRC         |
+									IRIS_INST_SUB_DRAIN       |
+									IRIS_INST_SUB_DRC_LAST    |
+									IRIS_INST_SUB_DRAIN_LAST  |
+									IRIS_INST_SUB_INPUT_PAUSE |
+									IRIS_INST_SUB_OUTPUT_PAUSE},
+
+		{IRIS_INST_ERROR,             STATE_CHANGE_ALLOW,       IRIS_INST_SUB_DRC         |
+									IRIS_INST_SUB_DRAIN       |
+									IRIS_INST_SUB_DRC_LAST    |
+									IRIS_INST_SUB_DRAIN_LAST  |
+									IRIS_INST_SUB_INPUT_PAUSE |
+									IRIS_INST_SUB_OUTPUT_PAUSE},
+	};
+
+	if (!sub_state)
+		return 0;
+
+	for (i = 0; i < ARRAY_SIZE(sub_state_allow); i++) {
+		if (sub_state_allow[i].state != inst->state)
+			continue;
+
+		if (sub_state_allow[i].allow == STATE_CHANGE_DISALLOW)
+			if (sub_state_allow[i].sub_state_mask & sub_state) {
+				dev_dbg(inst->core->dev, "state %d with disallowed sub state %x\n",
+					inst->state, sub_state);
+				return -EINVAL;
+			}
+
+		if (sub_state_allow[i].allow == STATE_CHANGE_ALLOW) {
+			if ((sub_state_allow[i].sub_state_mask & sub_state) != sub_state)
+				return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+int iris_inst_change_sub_state(struct iris_inst *inst,
+			       enum iris_inst_sub_state clear_sub_state,
+			       enum iris_inst_sub_state set_sub_state)
+{
+	enum iris_inst_sub_state prev_sub_state;
+	int ret;
+
+	if (IS_SESSION_ERROR(inst))
+		return 0;
+
+	if (!clear_sub_state && !set_sub_state)
+		return 0;
+
+	if ((clear_sub_state & set_sub_state) ||
+	    set_sub_state > IRIS_INST_MAX_SUB_STATE_VALUE ||
+	    clear_sub_state > IRIS_INST_MAX_SUB_STATE_VALUE)
+		return -EINVAL;
+
+	prev_sub_state = inst->sub_state;
+
+	ret = iris_inst_allow_sub_state(inst, set_sub_state);
+	if (ret)
+		return ret;
+
+	inst->sub_state |= set_sub_state;
+	inst->sub_state &= ~clear_sub_state;
+
+	if (inst->sub_state != prev_sub_state)
+		dev_dbg(inst->core->dev, "state %d and sub state changed to %x\n",
+			inst->sub_state, inst->sub_state);
+
+	return 0;
+}
+
+int iris_inst_sub_state_change_drc(struct iris_inst *inst)
+{
+	enum iris_inst_sub_state set_sub_state = 0;
+
+	if (inst->sub_state & IRIS_INST_SUB_DRC)
+		return STATE_CHANGE_DISALLOW;
+
+	if (inst->state == IRIS_INST_INPUT_STREAMING ||
+	    inst->state == IRIS_INST_OPEN)
+		set_sub_state = IRIS_INST_SUB_INPUT_PAUSE;
+	else
+		set_sub_state = IRIS_INST_SUB_DRC | IRIS_INST_SUB_INPUT_PAUSE;
+
+	return iris_inst_change_sub_state(inst, 0, set_sub_state);
+}
+
+int iris_inst_sub_state_change_drain_last(struct iris_inst *inst)
+{
+	enum iris_inst_sub_state set_sub_state = IRIS_INST_SUB_NONE;
+
+	if (inst->sub_state & IRIS_INST_SUB_DRAIN_LAST)
+		return STATE_CHANGE_DISALLOW;
+
+	if (!(inst->sub_state & IRIS_INST_SUB_DRAIN) ||
+	    !(inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE))
+		return STATE_CHANGE_DISALLOW;
+
+	set_sub_state = IRIS_INST_SUB_DRAIN_LAST | IRIS_INST_SUB_OUTPUT_PAUSE;
+
+	return iris_inst_change_sub_state(inst, 0, set_sub_state);
+}
+
+int iris_inst_sub_state_change_drc_last(struct iris_inst *inst)
+{
+	enum iris_inst_sub_state set_sub_state = IRIS_INST_SUB_NONE;
+
+	if (inst->sub_state & IRIS_INST_SUB_DRC_LAST)
+		return STATE_CHANGE_DISALLOW;
+
+	if (!(inst->sub_state & IRIS_INST_SUB_DRC) ||
+	    !(inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE))
+		return STATE_CHANGE_DISALLOW;
+
+	set_sub_state = IRIS_INST_SUB_DRC_LAST | IRIS_INST_SUB_OUTPUT_PAUSE;
+
+	return iris_inst_change_sub_state(inst, 0, set_sub_state);
+}
+
+int iris_inst_sub_state_change_pause(struct iris_inst *inst, u32 plane)
+{
+	enum iris_inst_sub_state set_sub_state = IRIS_INST_SUB_NONE;
+
+	if (plane == INPUT_MPLANE) {
+		if (inst->sub_state & IRIS_INST_SUB_DRC &&
+		    !(inst->sub_state & IRIS_INST_SUB_DRC_LAST))
+			return STATE_CHANGE_DISALLOW;
+
+		if (inst->sub_state & IRIS_INST_SUB_DRAIN &&
+		    !(inst->sub_state & IRIS_INST_SUB_DRAIN_LAST))
+			return STATE_CHANGE_DISALLOW;
+
+		set_sub_state = IRIS_INST_SUB_INPUT_PAUSE;
+	} else {
+		set_sub_state = IRIS_INST_SUB_OUTPUT_PAUSE;
+	}
+
+	return iris_inst_change_sub_state(inst, 0, set_sub_state);
+}
+
+bool is_drc_pending(struct iris_inst *inst)
+{
+	return inst->sub_state & IRIS_INST_SUB_DRC &&
+		inst->sub_state & IRIS_INST_SUB_DRC_LAST;
+}
+
+bool is_drain_pending(struct iris_inst *inst)
+{
+	return inst->sub_state & IRIS_INST_SUB_DRAIN &&
+		inst->sub_state & IRIS_INST_SUB_DRAIN_LAST;
+}
+
+bool allow_cmd(struct iris_inst *inst, u32 cmd)
+{
+	if (cmd == V4L2_DEC_CMD_START) {
+		if (inst->state == IRIS_INST_INPUT_STREAMING ||
+		    inst->state == IRIS_INST_OUTPUT_STREAMING ||
+		    inst->state == IRIS_INST_STREAMING)
+			if (is_drc_pending(inst) || is_drain_pending(inst))
+				return true;
+	} else if (cmd == V4L2_DEC_CMD_STOP) {
+		if (inst->state == IRIS_INST_INPUT_STREAMING ||
+		    inst->state == IRIS_INST_STREAMING)
+			if (inst->sub_state != IRIS_INST_SUB_DRAIN)
+				return true;
+	}
+
+	return false;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_state.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_state.h
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_STATE_H_
+#define _IRIS_STATE_H_
+
+struct iris_core;
+struct iris_inst;
+
+enum iris_core_state {
+	IRIS_CORE_DEINIT,
+	IRIS_CORE_INIT_WAIT,
+	IRIS_CORE_INIT,
+	IRIS_CORE_ERROR,
+};
+
+enum iris_inst_state {
+	IRIS_INST_OPEN,
+	IRIS_INST_INPUT_STREAMING,
+	IRIS_INST_OUTPUT_STREAMING,
+	IRIS_INST_STREAMING,
+	IRIS_INST_CLOSE,
+	IRIS_INST_ERROR,
+};
+
+#define IRIS_INST_SUB_NONE		0
+#define IRIS_INST_SUB_STATES		6
+#define IRIS_INST_MAX_SUB_STATE_VALUE	((1 << IRIS_INST_SUB_STATES) - 1)
+
+enum iris_inst_sub_state {
+	IRIS_INST_SUB_DRAIN		= BIT(0),
+	IRIS_INST_SUB_DRC		= BIT(1),
+	IRIS_INST_SUB_DRAIN_LAST	= BIT(2),
+	IRIS_INST_SUB_DRC_LAST		= BIT(3),
+	IRIS_INST_SUB_INPUT_PAUSE	= BIT(4),
+	IRIS_INST_SUB_OUTPUT_PAUSE	= BIT(5),
+};
+
+enum state_change {
+	STATE_CHANGE_ALLOW,
+	STATE_CHANGE_DISALLOW,
+	STATE_CHANGE_IGNORE,
+};
+
+#define IS_SESSION_ERROR(inst) \
+((inst)->state == IRIS_INST_ERROR)
+
+bool core_in_valid_state(struct iris_core *core);
+int iris_change_core_state(struct iris_core *core,
+			   enum iris_core_state request_state);
+
+int iris_inst_change_state(struct iris_inst *inst,
+			   enum iris_inst_state request_state);
+int iris_inst_change_sub_state(struct iris_inst *inst,
+			       enum iris_inst_sub_state clear_sub_state,
+			       enum iris_inst_sub_state set_sub_state);
+
+bool allow_s_fmt(struct iris_inst *inst, u32 type);
+bool allow_reqbufs(struct iris_inst *inst, u32 type);
+bool allow_qbuf(struct iris_inst *inst, u32 type);
+bool allow_streamon(struct iris_inst *inst, u32 type);
+bool allow_streamoff(struct iris_inst *inst, u32 type);
+bool allow_s_ctrl(struct iris_inst *inst, u32 cap_id);
+
+int iris_inst_state_change_streamon(struct iris_inst *inst, u32 plane);
+int iris_inst_state_change_streamoff(struct iris_inst *inst, u32 plane);
+
+int iris_inst_sub_state_change_drc(struct iris_inst *inst);
+int iris_inst_sub_state_change_drain_last(struct iris_inst *inst);
+int iris_inst_sub_state_change_drc_last(struct iris_inst *inst);
+int iris_inst_sub_state_change_pause(struct iris_inst *inst, u32 plane);
+bool is_drc_pending(struct iris_inst *inst);
+bool is_drain_pending(struct iris_inst *inst);
+bool allow_cmd(struct iris_inst *inst, u32 cmd);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_vb2.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_vb2.c
@@ -0,0 +1,457 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_buffer.h"
+#include "iris_ctrls.h"
+#include "iris_core.h"
+#include "iris_ctrls.h"
+#include "iris_helpers.h"
+#include "iris_hfi.h"
+#include "iris_instance.h"
+#include "iris_power.h"
+#include "iris_vb2.h"
+#include "iris_vdec.h"
+#include "iris_venc.h"
+
+int iris_vb2_queue_setup(struct vb2_queue *q,
+			 unsigned int *num_buffers, unsigned int *num_planes,
+			 unsigned int sizes[], struct device *alloc_devs[])
+{
+	enum iris_buffer_type buffer_type = 0;
+	struct iris_buffers *buffers;
+	struct iris_inst *inst;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	int ret;
+
+	if (!q || !num_buffers || !num_planes || !sizes)
+		return -EINVAL;
+
+	inst = vb2_get_drv_priv(q);
+	if (!inst || !inst->core)
+		return -EINVAL;
+
+	core = inst->core;
+
+	if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
+		f = inst->fmt_src;
+	else
+		f = inst->fmt_dst;
+
+	if (inst->state == IRIS_INST_STREAMING)
+		return -EINVAL;
+
+	if (*num_planes) {
+		if (*num_planes != f->fmt.pix_mp.num_planes ||
+		    sizes[0] < f->fmt.pix_mp.plane_fmt[0].sizeimage)
+			return -EINVAL;
+	}
+
+	buffer_type = v4l2_type_to_driver(q->type);
+	if (!buffer_type)
+		return -EINVAL;
+
+	if (list_empty(&inst->caps_list)) {
+		ret = prepare_dependency_list(inst);
+		if (ret)
+			return ret;
+	}
+
+	if ((inst->domain == DECODER && q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) ||
+	    (inst->domain == ENCODER && q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) {
+		ret = adjust_v4l2_properties(inst);
+		if (ret)
+			return ret;
+	}
+
+	ret = check_session_supported(inst);
+	if (ret)
+		return ret;
+
+	ret = iris_free_buffers(inst, buffer_type);
+	if (ret)
+		return ret;
+
+	buffers = iris_get_buffer_list(inst, buffer_type);
+	if (!buffers)
+		return -EINVAL;
+
+	buffers->min_count = iris_get_buf_min_count(inst, buffer_type);
+	if (*num_buffers < buffers->min_count)
+		*num_buffers = buffers->min_count;
+	buffers->actual_count = *num_buffers;
+	*num_planes = 1;
+
+	buffers->size = iris_get_buffer_size(inst, buffer_type);
+
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = buffers->size;
+	sizes[0] = f->fmt.pix_mp.plane_fmt[0].sizeimage;
+
+	ret = iris_allocate_buffers(inst, buffer_type, *num_buffers);
+
+	q->dev = core->dev;
+
+	return ret;
+}
+
+int iris_vb2_start_streaming(struct vb2_queue *q, unsigned int count)
+{
+	enum iris_buffer_type buf_type;
+	struct iris_inst *inst;
+	int ret = 0;
+
+	if (!q)
+		return -EINVAL;
+
+	inst = vb2_get_drv_priv(q);
+	if (!inst || !inst->core)
+		return -EINVAL;
+
+	if (q->type != INPUT_MPLANE && q->type != OUTPUT_MPLANE) {
+		ret = -EINVAL;
+		goto error;
+	}
+
+	if (inst->domain != DECODER && inst->domain != ENCODER) {
+		ret = -EINVAL;
+		goto error;
+	}
+
+	ret = iris_pm_get(inst->core);
+	if (ret)
+		goto error;
+
+	if (!inst->once_per_session_set) {
+		inst->once_per_session_set = true;
+		ret = iris_hfi_session_set_codec(inst);
+		if (ret)
+			goto err_pm_get;
+
+		if (inst->domain == ENCODER)  {
+			ret = iris_alloc_and_queue_session_int_bufs(inst, BUF_ARP);
+			if (ret)
+				goto err_pm_get;
+		} else if (inst->domain == DECODER) {
+			ret = iris_hfi_session_set_default_header(inst);
+			if (ret)
+				goto err_pm_get;
+
+			ret = iris_alloc_and_queue_session_int_bufs(inst, BUF_PERSIST);
+			if (ret)
+				goto err_pm_get;
+		}
+	}
+
+	iris_scale_power(inst);
+
+	if (q->type == INPUT_MPLANE) {
+		if (inst->domain == DECODER)
+			ret = vdec_streamon_input(inst);
+		else if (inst->domain == ENCODER)
+			ret = venc_streamon_input(inst);
+	} else if (q->type == OUTPUT_MPLANE) {
+		if (inst->domain == DECODER)
+			ret = vdec_streamon_output(inst);
+		else if (inst->domain == ENCODER)
+			ret = venc_streamon_output(inst);
+	}
+	if (ret)
+		goto err_pm_get;
+
+	buf_type = v4l2_type_to_driver(q->type);
+	if (!buf_type) {
+		ret = -EINVAL;
+		goto err_pm_get;
+	}
+
+	ret = queue_deferred_buffers(inst, buf_type);
+	if (ret)
+		goto err_pm_get;
+
+	ret = iris_pm_put(inst->core, true);
+	if (ret)
+		goto error;
+
+	return ret;
+
+err_pm_get:
+	iris_pm_put(inst->core, false);
+error:
+	iris_inst_change_state(inst, IRIS_INST_ERROR);
+
+	return ret;
+}
+
+void iris_vb2_stop_streaming(struct vb2_queue *q)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	if (!q)
+		return;
+
+	inst = vb2_get_drv_priv(q);
+	if (!inst)
+		return;
+
+	if (q->type != INPUT_MPLANE && q->type != OUTPUT_MPLANE)
+		goto error;
+
+	if (inst->domain != DECODER && inst->domain != ENCODER) {
+		ret = -EINVAL;
+		goto error;
+	}
+
+	ret = iris_pm_get_put(inst->core);
+	if (ret)
+		goto error;
+
+	if (q->type == INPUT_MPLANE)
+		ret = session_streamoff(inst, INPUT_MPLANE);
+	else if (q->type == OUTPUT_MPLANE)
+		ret = session_streamoff(inst, OUTPUT_MPLANE);
+
+	if (ret)
+		goto error;
+
+	return;
+
+error:
+	iris_inst_change_state(inst, IRIS_INST_ERROR);
+}
+
+void iris_vb2_buf_queue(struct vb2_buffer *vb2)
+{
+	u64 ktime_ns = ktime_get_ns();
+	struct iris_core *core;
+	struct iris_inst *inst;
+	int ret;
+
+	inst = vb2_get_drv_priv(vb2->vb2_queue);
+	if (!inst || !inst->core)
+		return;
+
+	core = inst->core;
+
+	if (!vb2->planes[0].bytesused && vb2->type == INPUT_MPLANE) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	if (vb2->type == INPUT_MPLANE) {
+		ret = iris_update_input_rate(inst, div_u64(ktime_ns, 1000));
+		if (ret)
+			goto exit;
+	}
+
+	ret = iris_pm_get_put(core);
+	if (ret)
+		goto exit;
+
+	if (inst->domain == DECODER)
+		ret = vdec_qbuf(inst, vb2);
+	else if (inst->domain == ENCODER)
+		ret = venc_qbuf(inst, vb2);
+
+exit:
+	if (ret) {
+		iris_inst_change_state(inst, IRIS_INST_ERROR);
+		vb2_buffer_done(vb2, VB2_BUF_STATE_ERROR);
+	}
+}
+
+void *iris_vb2_attach_dmabuf(struct vb2_buffer *vb, struct device *dev,
+			     struct dma_buf *dbuf, unsigned long size)
+{
+	struct iris_buffer *ro_buf, *dummy;
+	enum iris_buffer_type buf_type;
+	struct iris_buffers *buffers;
+	struct iris_buffer *iter;
+	struct iris_buffer *buf;
+	struct iris_inst *inst;
+	bool found = false;
+
+	if (!vb || !dev || !dbuf || !vb->vb2_queue)
+		return ERR_PTR(-EINVAL);
+
+	inst = vb->vb2_queue->drv_priv;
+
+	buf_type = v4l2_type_to_driver(vb->type);
+
+	buffers = iris_get_buffer_list(inst, buf_type);
+	if (!buffers)
+		return NULL;
+
+	list_for_each_entry(iter, &buffers->list, list) {
+		if (iter->index == vb->index) {
+			found = true;
+			buf = iter;
+			break;
+		}
+	}
+
+	if (!found)
+		return NULL;
+
+	buf->inst = inst;
+	buf->dmabuf = dbuf;
+
+	if (inst->domain == DECODER && buf->type == BUF_OUTPUT) {
+		list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+			if (ro_buf->dmabuf != buf->dmabuf)
+				continue;
+			buf->attach = ro_buf->attach;
+			ro_buf->attach = NULL;
+			return buf;
+		}
+	}
+
+	buf->attach = dma_buf_attach(dbuf, dev);
+	if (IS_ERR(buf->attach)) {
+		buf->attach = NULL;
+		return NULL;
+	}
+
+	return buf;
+}
+
+int iris_vb2_map_dmabuf(void *buf_priv)
+{
+	struct iris_buffer *ro_buf, *dummy;
+	struct iris_buffer *buf = buf_priv;
+	struct iris_core *core;
+	struct iris_inst *inst;
+
+	if (!buf || !buf->inst)
+		return -EINVAL;
+
+	inst = buf->inst;
+	core = inst->core;
+
+	if (!buf->attach) {
+		dev_err(core->dev, "trying to map a non attached buffer\n");
+		return -EINVAL;
+	}
+
+	if (inst->domain == DECODER && buf->type == BUF_OUTPUT) {
+		list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+			if (ro_buf->dmabuf != buf->dmabuf)
+				continue;
+			buf->sg_table = ro_buf->sg_table;
+			buf->device_addr = ro_buf->device_addr;
+			ro_buf->sg_table = NULL;
+			return 0;
+		}
+	}
+
+	buf->sg_table = dma_buf_map_attachment(buf->attach, DMA_BIDIRECTIONAL);
+	if (IS_ERR(buf->sg_table))
+		return -EINVAL;
+
+	if (!buf->sg_table->sgl) {
+		dma_buf_unmap_attachment(buf->attach, buf->sg_table, DMA_BIDIRECTIONAL);
+		buf->sg_table = NULL;
+		return -EINVAL;
+	}
+
+	buf->device_addr = sg_dma_address(buf->sg_table->sgl);
+
+	return 0;
+}
+
+void iris_vb2_unmap_dmabuf(void *buf_priv)
+{
+	struct iris_buffer *ro_buf, *dummy;
+	struct iris_buffer *buf = buf_priv;
+	struct iris_core *core;
+	struct iris_inst *inst;
+
+	if (!buf || !buf->inst)
+		return;
+
+	inst = buf->inst;
+	core = inst->core;
+
+	if (!buf->attach) {
+		dev_err(core->dev, "trying to unmap a non attached buffer\n");
+		return;
+	}
+
+	if (!buf->sg_table) {
+		dev_err(core->dev, "dmabuf buffer is already unmapped\n");
+		return;
+	}
+
+	if (inst->domain == DECODER && buf->type == BUF_OUTPUT) {
+		list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+			if (ro_buf->dmabuf != buf->dmabuf)
+				continue;
+			ro_buf->sg_table = buf->sg_table;
+			buf->sg_table = NULL;
+			buf->device_addr = 0x0;
+			return;
+		}
+	}
+
+	if (buf->attach && buf->sg_table) {
+		dma_buf_unmap_attachment(buf->attach, buf->sg_table, DMA_BIDIRECTIONAL);
+		buf->sg_table = NULL;
+		buf->device_addr = 0x0;
+	}
+}
+
+void iris_vb2_detach_dmabuf(void *buf_priv)
+{
+	struct iris_buffer *ro_buf, *dummy;
+	struct iris_buffer *buf = buf_priv;
+	struct iris_core *core;
+	struct iris_inst *inst;
+
+	if (!buf || !buf->inst)
+		return;
+
+	inst = buf->inst;
+	core = inst->core;
+
+	if (buf->sg_table) {
+		dev_err(core->dev, "trying to detach an unmapped buffer\n");
+		dma_buf_unmap_attachment(buf->attach, buf->sg_table, DMA_BIDIRECTIONAL);
+		buf->sg_table = NULL;
+	}
+
+	if (inst->domain == DECODER && buf->type == BUF_OUTPUT) {
+		list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+			if (ro_buf->dmabuf != buf->dmabuf)
+				continue;
+			ro_buf->attach = buf->attach;
+			buf->attach = NULL;
+			goto exit;
+		}
+	}
+
+	if (buf->attach && buf->dmabuf) {
+		dma_buf_detach(buf->dmabuf, buf->attach);
+		buf->attach = NULL;
+	}
+
+exit:
+	buf->dmabuf = NULL;
+	buf->inst = NULL;
+}
+
+void *iris_vb2_alloc(struct vb2_buffer *vb, struct device *dev,
+		     unsigned long size)
+{
+	return (void *)0xdeadbeef;
+}
+
+void iris_vb2_put(void *buf_priv)
+{
+}
+
+int iris_vb2_mmap(void *buf_priv, struct vm_area_struct *vma)
+{
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_vb2.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_vb2.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_VB2_H_
+#define _IRIS_VB2_H_
+
+#include <media/videobuf2-v4l2.h>
+
+int iris_vb2_queue_setup(struct vb2_queue *q,
+			 unsigned int *num_buffers, unsigned int *num_planes,
+			 unsigned int sizes[], struct device *alloc_devs[]);
+int iris_vb2_start_streaming(struct vb2_queue *q, unsigned int count);
+void iris_vb2_stop_streaming(struct vb2_queue *q);
+void iris_vb2_buf_queue(struct vb2_buffer *vb2);
+
+/* vb2_mem_ops */
+void *iris_vb2_alloc(struct vb2_buffer *vb, struct device *dev, unsigned long size);
+void *iris_vb2_attach_dmabuf(struct vb2_buffer *vb, struct device *dev, struct dma_buf *dbuf,
+			     unsigned long size);
+void iris_vb2_put(void *buf_priv);
+int iris_vb2_mmap(void *buf_priv, struct vm_area_struct *vma);
+void iris_vb2_detach_dmabuf(void *buf_priv);
+int iris_vb2_map_dmabuf(void *buf_priv);
+void iris_vb2_unmap_dmabuf(void *buf_priv);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_vdec.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_vdec.c
@@ -0,0 +1,1211 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <media/v4l2-event.h>
+
+#include "hfi_defines.h"
+#include "iris_buffer.h"
+#include "iris_common.h"
+#include "iris_ctrls.h"
+#include "iris_helpers.h"
+#include "iris_hfi.h"
+#include "iris_hfi_packet.h"
+#include "iris_power.h"
+#include "iris_vdec.h"
+
+#define UNSPECIFIED_COLOR_FORMAT 5
+
+struct vdec_prop_type_handle {
+	u32 type;
+	int (*handle)(struct iris_inst *inst);
+};
+
+int vdec_inst_init(struct iris_inst *inst)
+{
+	struct v4l2_format *f;
+	int ret;
+
+	inst->fmt_src  = kzalloc(sizeof(*inst->fmt_src), GFP_KERNEL);
+	inst->fmt_dst  = kzalloc(sizeof(*inst->fmt_dst), GFP_KERNEL);
+	inst->vb2q_src = kzalloc(sizeof(*inst->vb2q_src), GFP_KERNEL);
+	inst->vb2q_dst = kzalloc(sizeof(*inst->vb2q_dst), GFP_KERNEL);
+
+	f = inst->fmt_src;
+	f->type = INPUT_MPLANE;
+	f->fmt.pix_mp.width = DEFAULT_WIDTH;
+	f->fmt.pix_mp.height = DEFAULT_HEIGHT;
+	f->fmt.pix_mp.pixelformat = V4L2_PIX_FMT_H264;
+	f->fmt.pix_mp.num_planes = 1;
+	f->fmt.pix_mp.plane_fmt[0].bytesperline = 0;
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = iris_get_buffer_size(inst, BUF_INPUT);
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+
+	f = inst->fmt_dst;
+	f->type = OUTPUT_MPLANE;
+	f->fmt.pix_mp.pixelformat = V4L2_PIX_FMT_QC08C;
+	f->fmt.pix_mp.width = ALIGN(DEFAULT_WIDTH, 128);
+	f->fmt.pix_mp.height = ALIGN(DEFAULT_HEIGHT, 32);
+	f->fmt.pix_mp.num_planes = 1;
+	f->fmt.pix_mp.plane_fmt[0].bytesperline = ALIGN(DEFAULT_WIDTH, 128);
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = iris_get_buffer_size(inst, BUF_OUTPUT);
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	f->fmt.pix_mp.colorspace = V4L2_COLORSPACE_DEFAULT;
+	f->fmt.pix_mp.xfer_func = V4L2_XFER_FUNC_DEFAULT;
+	f->fmt.pix_mp.ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+	f->fmt.pix_mp.quantization = V4L2_QUANTIZATION_DEFAULT;
+	inst->buffers.output.min_count = iris_get_buf_min_count(inst, BUF_OUTPUT);
+	inst->buffers.output.actual_count = inst->buffers.output.min_count;
+	inst->buffers.output.size = f->fmt.pix_mp.plane_fmt[0].sizeimage;
+	inst->fw_min_count = 0;
+
+	ret = codec_change(inst, inst->fmt_src->fmt.pix_mp.pixelformat);
+
+	return ret;
+}
+
+void vdec_inst_deinit(struct iris_inst *inst)
+{
+	kfree(inst->fmt_dst);
+	kfree(inst->fmt_src);
+}
+
+static int vdec_check_colorformat_supported(struct iris_inst *inst,
+					    enum colorformat_type colorformat)
+{
+	bool supported = true;
+
+	if (!inst->vb2q_src->streaming)
+		return true;
+
+	if (inst->cap[BIT_DEPTH].value == BIT_DEPTH_8 &&
+	    !is_8bit_colorformat(colorformat))
+		supported = false;
+	if (inst->cap[BIT_DEPTH].value == BIT_DEPTH_10 &&
+	    !is_10bit_colorformat(colorformat))
+		supported = false;
+	if (inst->cap[CODED_FRAMES].value == CODED_FRAMES_INTERLACE)
+		supported = false;
+
+	return supported;
+}
+
+int vdec_enum_fmt(struct iris_inst *inst, struct v4l2_fmtdesc *f)
+{
+	struct iris_core *core;
+	u32 array[32] = {0};
+	u32 i = 0;
+
+	if (f->index >= ARRAY_SIZE(array))
+		return -EINVAL;
+
+	core = inst->core;
+	if (f->type == INPUT_MPLANE) {
+		u32 codecs = core->cap[DEC_CODECS].value;
+		u32 codecs_count = hweight32(codecs);
+		u32 idx = 0;
+
+		for (i = 0; i <= codecs_count; i++) {
+			if (codecs & BIT(i)) {
+				if (idx >= ARRAY_SIZE(array))
+					break;
+				array[idx] = codecs & BIT(i);
+				idx++;
+			}
+		}
+		if (!array[f->index])
+			return -EINVAL;
+		f->pixelformat = v4l2_codec_from_driver(inst, array[f->index]);
+		f->flags = V4L2_FMT_FLAG_COMPRESSED | V4L2_FMT_FLAG_DYN_RESOLUTION;
+		strscpy(f->description, "codec", sizeof(f->description));
+	} else if (f->type == OUTPUT_MPLANE) {
+		u32 formats = inst->cap[PIX_FMTS].step_or_mask;
+		u32 idx = 0;
+
+		for (i = 0; i <= 31; i++) {
+			if (formats & BIT(i)) {
+				if (idx >= ARRAY_SIZE(array))
+					break;
+				if (vdec_check_colorformat_supported(inst, formats & BIT(i))) {
+					array[idx] = formats & BIT(i);
+					idx++;
+				}
+			}
+		}
+		if (!array[f->index])
+			return -EINVAL;
+		f->pixelformat = v4l2_colorformat_from_driver(inst, array[f->index]);
+		strscpy(f->description, "colorformat", sizeof(f->description));
+	}
+
+	if (!f->pixelformat)
+		return -EINVAL;
+
+	memset(f->reserved, 0, sizeof(f->reserved));
+
+	return 0;
+}
+
+int vdec_try_fmt(struct iris_inst *inst, struct v4l2_format *f)
+{
+	struct v4l2_pix_format_mplane *pixmp = &f->fmt.pix_mp;
+	struct v4l2_format *f_inst;
+	u32 pix_fmt;
+
+	memset(pixmp->reserved, 0, sizeof(pixmp->reserved));
+	if (f->type == INPUT_MPLANE) {
+		pix_fmt = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat);
+		if (!pix_fmt) {
+			f_inst = inst->fmt_src;
+			f->fmt.pix_mp.width = f_inst->fmt.pix_mp.width;
+			f->fmt.pix_mp.height = f_inst->fmt.pix_mp.height;
+			f->fmt.pix_mp.pixelformat = f_inst->fmt.pix_mp.pixelformat;
+			pix_fmt = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat);
+		}
+	} else if (f->type == OUTPUT_MPLANE) {
+		pix_fmt = v4l2_colorformat_to_driver(inst, f->fmt.pix_mp.pixelformat);
+		if (!pix_fmt) {
+			f_inst = inst->fmt_dst;
+			f->fmt.pix_mp.pixelformat = f_inst->fmt.pix_mp.pixelformat;
+			f->fmt.pix_mp.width = f_inst->fmt.pix_mp.width;
+			f->fmt.pix_mp.height = f_inst->fmt.pix_mp.height;
+		}
+		if (inst->vb2q_src->streaming) {
+			f_inst = inst->fmt_src;
+			f->fmt.pix_mp.height = f_inst->fmt.pix_mp.height;
+			f->fmt.pix_mp.width = f_inst->fmt.pix_mp.width;
+		}
+	} else {
+		return -EINVAL;
+	}
+
+	if (pixmp->field == V4L2_FIELD_ANY)
+		pixmp->field = V4L2_FIELD_NONE;
+
+	pixmp->num_planes = 1;
+
+	return 0;
+}
+
+int vdec_s_fmt(struct iris_inst *inst, struct v4l2_format *f)
+{
+	struct v4l2_format *fmt, *output_fmt;
+	enum colorformat_type colorformat;
+	u32 codec_align, stride = 0;
+	int ret = 0;
+
+	vdec_try_fmt(inst, f);
+
+	if (f->type == INPUT_MPLANE) {
+		if (inst->fmt_src->fmt.pix_mp.pixelformat !=
+			f->fmt.pix_mp.pixelformat) {
+			ret = codec_change(inst, f->fmt.pix_mp.pixelformat);
+			if (ret)
+				return ret;
+		}
+
+		fmt = inst->fmt_src;
+		fmt->type = INPUT_MPLANE;
+
+		codec_align = inst->fmt_src->fmt.pix_mp.pixelformat ==
+			V4L2_PIX_FMT_HEVC ? 32 : 16;
+		fmt->fmt.pix_mp.width = ALIGN(f->fmt.pix_mp.width, codec_align);
+		fmt->fmt.pix_mp.height = ALIGN(f->fmt.pix_mp.height, codec_align);
+		fmt->fmt.pix_mp.num_planes = 1;
+		fmt->fmt.pix_mp.plane_fmt[0].bytesperline = 0;
+		fmt->fmt.pix_mp.plane_fmt[0].sizeimage = iris_get_buffer_size(inst, BUF_INPUT);
+		inst->buffers.input.min_count = iris_get_buf_min_count(inst, BUF_INPUT);
+		if (inst->buffers.input.actual_count <
+			inst->buffers.input.min_count) {
+			inst->buffers.input.actual_count =
+				inst->buffers.input.min_count;
+		}
+		inst->buffers.input.size =
+			fmt->fmt.pix_mp.plane_fmt[0].sizeimage;
+
+		fmt->fmt.pix_mp.colorspace = f->fmt.pix_mp.colorspace;
+		fmt->fmt.pix_mp.xfer_func = f->fmt.pix_mp.xfer_func;
+		fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+		fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization;
+
+		output_fmt = inst->fmt_dst;
+		output_fmt->fmt.pix_mp.colorspace = f->fmt.pix_mp.colorspace;
+		output_fmt->fmt.pix_mp.xfer_func = f->fmt.pix_mp.xfer_func;
+		output_fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+		output_fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization;
+
+		inst->crop.left = 0;
+		inst->crop.top = 0;
+		inst->crop.width = f->fmt.pix_mp.width;
+		inst->crop.height = f->fmt.pix_mp.height;
+	} else if (f->type == OUTPUT_MPLANE) {
+		fmt = inst->fmt_dst;
+		fmt->type = OUTPUT_MPLANE;
+		if (inst->vb2q_src->streaming) {
+			f->fmt.pix_mp.height = inst->fmt_src->fmt.pix_mp.height;
+			f->fmt.pix_mp.width = inst->fmt_src->fmt.pix_mp.width;
+		}
+		fmt->fmt.pix_mp.pixelformat = f->fmt.pix_mp.pixelformat;
+		codec_align = f->fmt.pix_mp.pixelformat == V4L2_PIX_FMT_QC10C ? 192 : 128;
+		fmt->fmt.pix_mp.width = ALIGN(f->fmt.pix_mp.width, codec_align);
+		codec_align = f->fmt.pix_mp.pixelformat == V4L2_PIX_FMT_QC10C ? 16 : 32;
+		fmt->fmt.pix_mp.height = ALIGN(f->fmt.pix_mp.height, codec_align);
+		fmt->fmt.pix_mp.num_planes = 1;
+		if (f->fmt.pix_mp.pixelformat == V4L2_PIX_FMT_QC10C) {
+			stride = ALIGN(f->fmt.pix_mp.width, 192);
+			fmt->fmt.pix_mp.plane_fmt[0].bytesperline = ALIGN(stride * 4 / 3, 256);
+		} else {
+			fmt->fmt.pix_mp.plane_fmt[0].bytesperline = ALIGN(f->fmt.pix_mp.width, 128);
+		}
+		fmt->fmt.pix_mp.plane_fmt[0].sizeimage = iris_get_buffer_size(inst, BUF_OUTPUT);
+
+		if (!inst->vb2q_src->streaming)
+			inst->buffers.output.min_count = iris_get_buf_min_count(inst, BUF_OUTPUT);
+		if (inst->buffers.output.actual_count <
+			inst->buffers.output.min_count) {
+			inst->buffers.output.actual_count =
+				inst->buffers.output.min_count;
+		}
+
+		colorformat = v4l2_colorformat_to_driver(inst, fmt->fmt.pix_mp.pixelformat);
+		inst->buffers.output.size =
+			fmt->fmt.pix_mp.plane_fmt[0].sizeimage;
+		inst->cap[PIX_FMTS].value = colorformat;
+
+		if (!inst->vb2q_src->streaming) {
+			inst->crop.top = 0;
+			inst->crop.left = 0;
+			inst->crop.width = f->fmt.pix_mp.width;
+			inst->crop.height = f->fmt.pix_mp.height;
+		}
+	} else {
+		return -EINVAL;
+	}
+	memcpy(f, fmt, sizeof(*fmt));
+
+	return ret;
+}
+
+int vdec_subscribe_event(struct iris_inst *inst, const struct v4l2_event_subscription *sub)
+{
+	int ret = 0;
+
+	switch (sub->type) {
+	case V4L2_EVENT_EOS:
+		ret = v4l2_event_subscribe(&inst->fh, sub, MAX_EVENTS, NULL);
+		break;
+	case V4L2_EVENT_SOURCE_CHANGE:
+		ret = v4l2_src_change_event_subscribe(&inst->fh, sub);
+		break;
+	case V4L2_EVENT_CTRL:
+		ret = v4l2_ctrl_subscribe_event(&inst->fh, sub);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+static int vdec_subscribe_property(struct iris_inst *inst, u32 plane)
+{
+	const u32 *subcribe_prop = NULL;
+	u32 subscribe_prop_size = 0;
+	struct iris_core *core;
+	u32 payload[32] = {0};
+	u32 i;
+
+	core = inst->core;
+
+	payload[0] = HFI_MODE_PROPERTY;
+
+	if (plane == INPUT_MPLANE) {
+		subscribe_prop_size = core->platform_data->dec_input_prop_size;
+		subcribe_prop = core->platform_data->dec_input_prop;
+	} else if (plane == OUTPUT_MPLANE) {
+		if (inst->codec == H264) {
+			subscribe_prop_size = core->platform_data->dec_output_prop_size_avc;
+			subcribe_prop = core->platform_data->dec_output_prop_avc;
+		} else if (inst->codec == HEVC) {
+			subscribe_prop_size = core->platform_data->dec_output_prop_size_hevc;
+			subcribe_prop = core->platform_data->dec_output_prop_hevc;
+		} else if (inst->codec == VP9) {
+			subscribe_prop_size = core->platform_data->dec_output_prop_size_vp9;
+			subcribe_prop = core->platform_data->dec_output_prop_vp9;
+		} else {
+			return -EINVAL;
+		}
+	} else {
+		return -EINVAL;
+	}
+
+	for (i = 0; i < subscribe_prop_size; i++)
+		payload[i + 1] = subcribe_prop[i];
+
+	return iris_hfi_session_subscribe_mode(inst,
+					HFI_CMD_SUBSCRIBE_MODE,
+					plane,
+					HFI_PAYLOAD_U32_ARRAY,
+					&payload[0],
+					(subscribe_prop_size + 1) * sizeof(u32));
+}
+
+static int vdec_set_bitstream_resolution(struct iris_inst *inst)
+{
+	u32 resolution;
+
+	resolution = inst->fmt_src->fmt.pix_mp.width << 16 |
+		inst->fmt_src->fmt.pix_mp.height;
+	inst->src_subcr_params.bitstream_resolution = resolution;
+
+	return iris_hfi_set_property(inst,
+					HFI_PROP_BITSTREAM_RESOLUTION,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, INPUT_MPLANE),
+					HFI_PAYLOAD_U32,
+					&resolution,
+					sizeof(u32));
+}
+
+static int vdec_set_crop_offsets(struct iris_inst *inst)
+{
+	u32 left_offset, top_offset, right_offset, bottom_offset;
+	u32 payload[2] = {0};
+
+	left_offset = inst->crop.left;
+	top_offset = inst->crop.top;
+	right_offset = (inst->fmt_src->fmt.pix_mp.width -
+		inst->crop.width);
+	bottom_offset = (inst->fmt_src->fmt.pix_mp.height -
+		inst->crop.height);
+
+	payload[0] = left_offset << 16 | top_offset;
+	payload[1] = right_offset << 16 | bottom_offset;
+	inst->src_subcr_params.crop_offsets[0] = payload[0];
+	inst->src_subcr_params.crop_offsets[1] = payload[1];
+
+	return iris_hfi_set_property(inst,
+					HFI_PROP_CROP_OFFSETS,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, INPUT_MPLANE),
+					HFI_PAYLOAD_64_PACKED,
+					&payload,
+					sizeof(u64));
+}
+
+static int vdec_set_bit_depth(struct iris_inst *inst)
+{
+	u32 bitdepth = 8 << 16 | 8;
+	u32 pix_fmt;
+
+	pix_fmt = inst->fmt_dst->fmt.pix_mp.pixelformat;
+	if (is_10bit_colorformat(pix_fmt))
+		bitdepth = 10 << 16 | 10;
+
+	inst->src_subcr_params.bit_depth = bitdepth;
+	inst->cap[BIT_DEPTH].value = bitdepth;
+
+	return iris_hfi_set_property(inst,
+					HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, INPUT_MPLANE),
+					HFI_PAYLOAD_U32,
+					&bitdepth,
+					sizeof(u32));
+}
+
+static int vdec_set_coded_frames(struct iris_inst *inst)
+{
+	u32 coded_frames = 0;
+
+	if (inst->cap[CODED_FRAMES].value == CODED_FRAMES_PROGRESSIVE)
+		coded_frames = HFI_BITMASK_FRAME_MBS_ONLY_FLAG;
+	inst->src_subcr_params.coded_frames = coded_frames;
+
+	return iris_hfi_set_property(inst,
+					HFI_PROP_CODED_FRAMES,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, INPUT_MPLANE),
+					HFI_PAYLOAD_U32,
+					&coded_frames,
+					sizeof(u32));
+}
+
+static int vdec_set_min_output_count(struct iris_inst *inst)
+{
+	u32 min_output;
+
+	min_output = inst->buffers.output.min_count;
+	inst->src_subcr_params.fw_min_count = min_output;
+
+	return iris_hfi_set_property(inst,
+					HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, INPUT_MPLANE),
+					HFI_PAYLOAD_U32,
+					&min_output,
+					sizeof(u32));
+}
+
+static int vdec_set_picture_order_count(struct iris_inst *inst)
+{
+	u32 poc = 0;
+
+	inst->src_subcr_params.pic_order_cnt = poc;
+
+	return iris_hfi_set_property(inst,
+					HFI_PROP_PIC_ORDER_CNT_TYPE,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, INPUT_MPLANE),
+					HFI_PAYLOAD_U32,
+					&poc,
+					sizeof(u32));
+}
+
+static int vdec_set_colorspace(struct iris_inst *inst)
+{
+	u32 video_signal_type_present_flag = 0, color_info = 0;
+	u32 matrix_coeff = HFI_MATRIX_COEFF_RESERVED;
+	u32 video_format = UNSPECIFIED_COLOR_FORMAT;
+	struct v4l2_pix_format_mplane *pixmp = NULL;
+	u32 full_range = V4L2_QUANTIZATION_DEFAULT;
+	u32 transfer_char = HFI_TRANSFER_RESERVED;
+	u32 colour_description_present_flag = 0;
+	u32 primaries = HFI_PRIMARIES_RESERVED;
+
+	int ret;
+
+	if (inst->codec == VP9)
+		return 0;
+
+	pixmp = &inst->fmt_src->fmt.pix_mp;
+	if (pixmp->colorspace != V4L2_COLORSPACE_DEFAULT ||
+	    pixmp->ycbcr_enc != V4L2_YCBCR_ENC_DEFAULT ||
+	    pixmp->xfer_func != V4L2_XFER_FUNC_DEFAULT) {
+		colour_description_present_flag = 1;
+		video_signal_type_present_flag = 1;
+		primaries = get_hfi_color_primaries(pixmp->colorspace);
+		matrix_coeff = get_hfi_matrix_coefficients(pixmp->ycbcr_enc);
+		transfer_char = get_hfi_transer_char(pixmp->xfer_func);
+	}
+
+	if (pixmp->quantization != V4L2_QUANTIZATION_DEFAULT) {
+		video_signal_type_present_flag = 1;
+		full_range = pixmp->quantization ==
+			V4L2_QUANTIZATION_FULL_RANGE ? 1 : 0;
+	}
+
+	color_info = (matrix_coeff & 0xFF) |
+		((transfer_char << 8) & 0xFF00) |
+		((primaries << 16) & 0xFF0000) |
+		((colour_description_present_flag << 24) & 0x1000000) |
+		((full_range << 25) & 0x2000000) |
+		((video_format << 26) & 0x1C000000) |
+		((video_signal_type_present_flag << 29) & 0x20000000);
+
+	inst->src_subcr_params.color_info = color_info;
+
+	ret = iris_hfi_set_property(inst,
+				    HFI_PROP_SIGNAL_COLOR_INFO,
+				    HFI_HOST_FLAGS_NONE,
+				    get_hfi_port(inst, INPUT_MPLANE),
+				    HFI_PAYLOAD_32_PACKED,
+				    &color_info,
+				    sizeof(u32));
+
+	return ret;
+}
+
+static int vdec_set_profile(struct iris_inst *inst)
+{
+	u32 profile;
+
+	profile = inst->cap[PROFILE].value;
+	inst->src_subcr_params.profile = profile;
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_PROFILE,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, INPUT_MPLANE),
+				     HFI_PAYLOAD_U32_ENUM,
+				     &profile,
+				     sizeof(u32));
+}
+
+static int vdec_set_level(struct iris_inst *inst)
+{
+	u32 level;
+
+	level = inst->cap[LEVEL].value;
+	inst->src_subcr_params.level = level;
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_LEVEL,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, INPUT_MPLANE),
+				     HFI_PAYLOAD_U32_ENUM,
+				     &level,
+				     sizeof(u32));
+}
+
+static int vdec_set_tier(struct iris_inst *inst)
+{
+	u32 tier;
+
+	tier = inst->cap[HEVC_TIER].value;
+	inst->src_subcr_params.tier = tier;
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_TIER,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, INPUT_MPLANE),
+				     HFI_PAYLOAD_U32_ENUM,
+				     &tier,
+				     sizeof(u32));
+}
+
+static int vdec_subscribe_src_change_param(struct iris_inst *inst)
+{
+	const u32 *src_change_param;
+	u32 src_change_param_size;
+	struct iris_core *core;
+	u32 payload[32] = {0};
+	int ret;
+	u32 i, j;
+
+	static const struct vdec_prop_type_handle prop_type_handle_arr[] = {
+		{HFI_PROP_BITSTREAM_RESOLUTION,          vdec_set_bitstream_resolution   },
+		{HFI_PROP_CROP_OFFSETS,                  vdec_set_crop_offsets           },
+		{HFI_PROP_LUMA_CHROMA_BIT_DEPTH,         vdec_set_bit_depth              },
+		{HFI_PROP_CODED_FRAMES,                  vdec_set_coded_frames           },
+		{HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,    vdec_set_min_output_count       },
+		{HFI_PROP_PIC_ORDER_CNT_TYPE,            vdec_set_picture_order_count    },
+		{HFI_PROP_SIGNAL_COLOR_INFO,             vdec_set_colorspace             },
+		{HFI_PROP_PROFILE,                       vdec_set_profile                },
+		{HFI_PROP_LEVEL,                         vdec_set_level                  },
+		{HFI_PROP_TIER,                          vdec_set_tier                   },
+	};
+
+	core = inst->core;
+
+	payload[0] = HFI_MODE_PORT_SETTINGS_CHANGE;
+	if (inst->codec == H264) {
+		src_change_param_size = core->platform_data->avc_subscribe_param_size;
+		src_change_param = core->platform_data->avc_subscribe_param;
+	} else if (inst->codec == HEVC) {
+		src_change_param_size = core->platform_data->hevc_subscribe_param_size;
+		src_change_param = core->platform_data->hevc_subscribe_param;
+	} else if (inst->codec == VP9) {
+		src_change_param_size = core->platform_data->vp9_subscribe_param_size;
+		src_change_param = core->platform_data->vp9_subscribe_param;
+	} else {
+		src_change_param = NULL;
+		return -EINVAL;
+	}
+
+	if (!src_change_param || !src_change_param_size)
+		return -EINVAL;
+
+	for (i = 0; i < src_change_param_size; i++)
+		payload[i + 1] = src_change_param[i];
+
+	ret = iris_hfi_session_subscribe_mode(inst,
+					      HFI_CMD_SUBSCRIBE_MODE,
+					      INPUT_MPLANE,
+					      HFI_PAYLOAD_U32_ARRAY,
+					      &payload[0],
+					      ((src_change_param_size + 1) * sizeof(u32)));
+	if (ret)
+		return ret;
+
+	for (i = 0; i < src_change_param_size; i++) {
+		for (j = 0; j < ARRAY_SIZE(prop_type_handle_arr); j++) {
+			if (prop_type_handle_arr[j].type == src_change_param[i]) {
+				ret = prop_type_handle_arr[j].handle(inst);
+				if (ret)
+					return ret;
+				break;
+			}
+		}
+	}
+
+	return ret;
+}
+
+int vdec_init_src_change_param(struct iris_inst *inst)
+{
+	u32 left_offset, top_offset, right_offset, bottom_offset;
+	struct v4l2_pix_format_mplane *pixmp_ip, *pixmp_op;
+	u32 primaries, matrix_coeff, transfer_char;
+	struct subscription_params *subsc_params;
+	u32 colour_description_present_flag = 0;
+	u32 video_signal_type_present_flag = 0;
+	u32 full_range = 0, video_format = 0;
+
+	subsc_params = &inst->src_subcr_params;
+	pixmp_ip = &inst->fmt_src->fmt.pix_mp;
+	pixmp_op = &inst->fmt_dst->fmt.pix_mp;
+
+	subsc_params->bitstream_resolution =
+		pixmp_ip->width << 16 | pixmp_ip->height;
+
+	left_offset = inst->crop.left;
+	top_offset = inst->crop.top;
+	right_offset = (pixmp_ip->width - inst->crop.width);
+	bottom_offset = (pixmp_ip->height - inst->crop.height);
+	subsc_params->crop_offsets[0] =
+			left_offset << 16 | top_offset;
+	subsc_params->crop_offsets[1] =
+			right_offset << 16 | bottom_offset;
+
+	subsc_params->fw_min_count = inst->buffers.output.min_count;
+
+	primaries = get_hfi_color_primaries(pixmp_op->colorspace);
+	matrix_coeff = get_hfi_matrix_coefficients(pixmp_op->ycbcr_enc);
+	transfer_char = get_hfi_transer_char(pixmp_op->xfer_func);
+	full_range = pixmp_op->quantization == V4L2_QUANTIZATION_FULL_RANGE ? 1 : 0;
+	subsc_params->color_info =
+		(matrix_coeff & 0xFF) |
+		((transfer_char << 8) & 0xFF00) |
+		((primaries << 16) & 0xFF0000) |
+		((colour_description_present_flag << 24) & 0x1000000) |
+		((full_range << 25) & 0x2000000) |
+		((video_format << 26) & 0x1C000000) |
+		((video_signal_type_present_flag << 29) & 0x20000000);
+
+	subsc_params->profile = inst->cap[PROFILE].value;
+	subsc_params->level = inst->cap[LEVEL].value;
+	subsc_params->tier = inst->cap[HEVC_TIER].value;
+	subsc_params->pic_order_cnt = inst->cap[POC].value;
+	subsc_params->bit_depth = inst->cap[BIT_DEPTH].value;
+	if (inst->cap[CODED_FRAMES].value ==
+			CODED_FRAMES_PROGRESSIVE)
+		subsc_params->coded_frames = HFI_BITMASK_FRAME_MBS_ONLY_FLAG;
+	else
+		subsc_params->coded_frames = 0;
+
+	return 0;
+}
+
+static int vdec_read_input_subcr_params(struct iris_inst *inst)
+{
+	struct v4l2_pix_format_mplane *pixmp_ip, *pixmp_op;
+	u32 primaries, matrix_coeff, transfer_char;
+	struct subscription_params subsc_params;
+	u32 colour_description_present_flag = 0;
+	u32 video_signal_type_present_flag = 0;
+	u32 full_range = 0;
+	u32 width, height;
+
+	subsc_params = inst->src_subcr_params;
+	pixmp_ip = &inst->fmt_src->fmt.pix_mp;
+	pixmp_op = &inst->fmt_dst->fmt.pix_mp;
+	width = (subsc_params.bitstream_resolution &
+		HFI_BITMASK_BITSTREAM_WIDTH) >> 16;
+	height = subsc_params.bitstream_resolution &
+		HFI_BITMASK_BITSTREAM_HEIGHT;
+
+	pixmp_ip->width = width;
+	pixmp_ip->height = height;
+
+	pixmp_op->width = pixmp_op->pixelformat == V4L2_PIX_FMT_QC10C ?
+		ALIGN(width, 192) : ALIGN(width, 128);
+	pixmp_op->height = pixmp_op->pixelformat == V4L2_PIX_FMT_QC10C ?
+		ALIGN(height, 16) : ALIGN(height, 32);
+	pixmp_op->plane_fmt[0].bytesperline =
+		pixmp_op->pixelformat == V4L2_PIX_FMT_QC10C ?
+		ALIGN(ALIGN(width, 192) * 4 / 3, 256) :
+		ALIGN(width, 128);
+	pixmp_op->plane_fmt[0].sizeimage = iris_get_buffer_size(inst, BUF_OUTPUT);
+
+	matrix_coeff = subsc_params.color_info & 0xFF;
+	transfer_char = (subsc_params.color_info & 0xFF00) >> 8;
+	primaries = (subsc_params.color_info & 0xFF0000) >> 16;
+	colour_description_present_flag =
+		(subsc_params.color_info & 0x1000000) >> 24;
+	full_range = (subsc_params.color_info & 0x2000000) >> 25;
+	video_signal_type_present_flag =
+		(subsc_params.color_info & 0x20000000) >> 29;
+
+	pixmp_op->colorspace = V4L2_COLORSPACE_DEFAULT;
+	pixmp_op->xfer_func = V4L2_XFER_FUNC_DEFAULT;
+	pixmp_op->ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+	pixmp_op->quantization = V4L2_QUANTIZATION_DEFAULT;
+
+	if (video_signal_type_present_flag) {
+		pixmp_op->quantization =
+			full_range ?
+			V4L2_QUANTIZATION_FULL_RANGE :
+			V4L2_QUANTIZATION_LIM_RANGE;
+		if (colour_description_present_flag) {
+			pixmp_op->colorspace =
+				get_v4l2_color_primaries(primaries);
+			pixmp_op->xfer_func =
+				get_v4l2_transer_char(transfer_char);
+			pixmp_op->ycbcr_enc =
+				get_v4l2_matrix_coefficients(matrix_coeff);
+		}
+	}
+
+	pixmp_ip->colorspace = pixmp_op->colorspace;
+	pixmp_ip->xfer_func = pixmp_op->xfer_func;
+	pixmp_ip->ycbcr_enc = pixmp_op->ycbcr_enc;
+	pixmp_ip->quantization = pixmp_op->quantization;
+
+	inst->crop.top = subsc_params.crop_offsets[0] & 0xFFFF;
+	inst->crop.left = (subsc_params.crop_offsets[0] >> 16) & 0xFFFF;
+	inst->crop.height = pixmp_ip->height -
+		(subsc_params.crop_offsets[1] & 0xFFFF) - inst->crop.top;
+	inst->crop.width = pixmp_ip->width -
+		((subsc_params.crop_offsets[1] >> 16) & 0xFFFF) - inst->crop.left;
+
+	inst->cap[PROFILE].value = subsc_params.profile;
+	inst->cap[LEVEL].value = subsc_params.level;
+	inst->cap[HEVC_TIER].value = subsc_params.tier;
+	inst->cap[POC].value = subsc_params.pic_order_cnt;
+
+	if (subsc_params.bit_depth == BIT_DEPTH_8)
+		inst->cap[BIT_DEPTH].value = BIT_DEPTH_8;
+	else
+		inst->cap[BIT_DEPTH].value = BIT_DEPTH_10;
+
+	if (subsc_params.coded_frames & HFI_BITMASK_FRAME_MBS_ONLY_FLAG)
+		inst->cap[CODED_FRAMES].value = CODED_FRAMES_PROGRESSIVE;
+	else
+		inst->cap[CODED_FRAMES].value = CODED_FRAMES_INTERLACE;
+
+	inst->fw_min_count = subsc_params.fw_min_count;
+	inst->buffers.output.min_count = iris_get_buf_min_count(inst, BUF_OUTPUT);
+
+	return 0;
+}
+
+int vdec_src_change(struct iris_inst *inst)
+{
+	struct v4l2_event event = {0};
+	u32 ret;
+
+	if (!inst->vb2q_src->streaming)
+		return 0;
+
+	ret = vdec_read_input_subcr_params(inst);
+	if (ret)
+		return ret;
+
+	event.type = V4L2_EVENT_SOURCE_CHANGE;
+	event.u.src_change.changes = V4L2_EVENT_SRC_CH_RESOLUTION;
+	v4l2_event_queue_fh(&inst->fh, &event);
+
+	return ret;
+}
+
+static int vdec_set_colorformat(struct iris_inst *inst)
+{
+	u32 hfi_colorformat;
+	u32 pixelformat;
+
+	pixelformat = inst->fmt_dst->fmt.pix_mp.pixelformat;
+	hfi_colorformat = get_hfi_colorformat(pixelformat);
+
+	return iris_hfi_set_property(inst,
+					 HFI_PROP_COLOR_FORMAT,
+					 HFI_HOST_FLAGS_NONE,
+					 get_hfi_port(inst, OUTPUT_MPLANE),
+					 HFI_PAYLOAD_U32,
+					 &hfi_colorformat,
+					 sizeof(u32));
+}
+
+static int vdec_set_linear_stride_scanline(struct iris_inst *inst)
+{
+	u32 stride_y, scanline_y, stride_uv, scanline_uv;
+	u32 pixelformat;
+	u32 payload[2];
+
+	pixelformat = inst->fmt_dst->fmt.pix_mp.pixelformat;
+
+	if (!is_linear_colorformat(pixelformat))
+		return 0;
+
+	stride_y = inst->fmt_dst->fmt.pix_mp.width;
+	scanline_y = inst->fmt_dst->fmt.pix_mp.height;
+	stride_uv = stride_y;
+	scanline_uv = scanline_y / 2;
+
+	payload[0] = stride_y << 16 | scanline_y;
+	payload[1] = stride_uv << 16 | scanline_uv;
+
+	return iris_hfi_set_property(inst,
+					 HFI_PROP_LINEAR_STRIDE_SCANLINE,
+					 HFI_HOST_FLAGS_NONE,
+					 get_hfi_port(inst, OUTPUT_MPLANE),
+					 HFI_PAYLOAD_U64,
+					 &payload,
+					 sizeof(u64));
+}
+
+static int vdec_set_ubwc_stride_scanline(struct iris_inst *inst)
+{
+	u32 meta_stride_y, meta_scanline_y, meta_stride_uv, meta_scanline_uv;
+	u32 stride_y, scanline_y, stride_uv, scanline_uv;
+	u32 pix_fmt, width, height;
+	u32 payload[4];
+
+	pix_fmt = inst->fmt_dst->fmt.pix_mp.pixelformat;
+	width = inst->fmt_dst->fmt.pix_mp.width;
+	height = inst->fmt_dst->fmt.pix_mp.height;
+
+	if (is_linear_colorformat(pix_fmt))
+		return 0;
+
+	if (pix_fmt == V4L2_PIX_FMT_QC08C) {
+		stride_y = ALIGN(width, 128);
+		scanline_y = ALIGN(height, 32);
+		stride_uv = ALIGN(width, 128);
+		scanline_uv = ALIGN((height + 1) >> 1, 32);
+		meta_stride_y = ALIGN(DIV_ROUND_UP(width, 32), 64);
+		meta_scanline_y = ALIGN(DIV_ROUND_UP(height, 8), 16);
+		meta_stride_uv = ALIGN(DIV_ROUND_UP((width + 1) >> 1, 16), 64);
+		meta_scanline_uv = ALIGN(DIV_ROUND_UP((height + 1) >> 1, 8), 16);
+	} else {
+		stride_y = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
+		scanline_y = ALIGN(height, 16);
+		stride_uv = ALIGN(ALIGN(width, 192) * 4 / 3, 256);
+		scanline_uv = ALIGN((height + 1) >> 1, 16);
+		meta_stride_y = ALIGN(DIV_ROUND_UP(width, 48), 64);
+		meta_scanline_y = ALIGN(DIV_ROUND_UP(height, 4), 16);
+		meta_stride_uv = ALIGN(DIV_ROUND_UP((width + 1) >> 1, 24), 64);
+		meta_scanline_uv = ALIGN(DIV_ROUND_UP((height + 1) >> 1, 4), 16);
+	}
+
+	payload[0] = stride_y << 16 | scanline_y;
+	payload[1] = stride_uv << 16 | scanline_uv;
+	payload[2] = meta_stride_y << 16 | meta_scanline_y;
+	payload[3] = meta_stride_uv << 16 | meta_scanline_uv;
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_UBWC_STRIDE_SCANLINE,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, OUTPUT_MPLANE),
+				     HFI_PAYLOAD_U32_ARRAY,
+				     &payload[0],
+				     sizeof(u32) * 4);
+}
+
+static int vdec_set_output_property(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = vdec_set_colorformat(inst);
+	if (ret)
+		return ret;
+
+	ret = vdec_set_linear_stride_scanline(inst);
+	if (ret)
+		return ret;
+
+	return vdec_set_ubwc_stride_scanline(inst);
+}
+
+static int vdec_subscribe_dst_change_param(struct iris_inst *inst)
+{
+	u32 prop_type, payload_size, payload_type;
+	struct subscription_params subsc_params;
+	const u32 *dst_change_param = NULL;
+	u32 dst_change_param_size = 0;
+	struct iris_core *core;
+	u32 payload[32] = {0};
+	int ret;
+	u32 i;
+
+	core = inst->core;
+
+	payload[0] = HFI_MODE_PORT_SETTINGS_CHANGE;
+	if (inst->codec == H264) {
+		dst_change_param_size = core->platform_data->avc_subscribe_param_size;
+		dst_change_param = core->platform_data->avc_subscribe_param;
+	} else if (inst->codec == HEVC) {
+		dst_change_param_size = core->platform_data->hevc_subscribe_param_size;
+		dst_change_param = core->platform_data->hevc_subscribe_param;
+	} else if (inst->codec == VP9) {
+		dst_change_param_size = core->platform_data->vp9_subscribe_param_size;
+		dst_change_param = core->platform_data->vp9_subscribe_param;
+	} else {
+		dst_change_param = NULL;
+		return -EINVAL;
+	}
+
+	if (!dst_change_param || !dst_change_param_size)
+		return -EINVAL;
+
+	payload[0] = HFI_MODE_PORT_SETTINGS_CHANGE;
+	for (i = 0; i < dst_change_param_size; i++)
+		payload[i + 1] = dst_change_param[i];
+
+	ret = iris_hfi_session_subscribe_mode(inst,
+					      HFI_CMD_SUBSCRIBE_MODE,
+					      OUTPUT_MPLANE,
+					      HFI_PAYLOAD_U32_ARRAY,
+					      &payload[0],
+					      ((dst_change_param_size + 1) * sizeof(u32)));
+	if (ret)
+		return ret;
+
+	subsc_params = inst->dst_subcr_params;
+	for (i = 0; i < dst_change_param_size; i++) {
+		payload[0] = 0;
+		payload[1] = 0;
+		payload_size = 0;
+		payload_type = 0;
+		prop_type = dst_change_param[i];
+		switch (prop_type) {
+		case HFI_PROP_BITSTREAM_RESOLUTION:
+			payload[0] = subsc_params.bitstream_resolution;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_CROP_OFFSETS:
+			payload[0] = subsc_params.crop_offsets[0];
+			payload[1] = subsc_params.crop_offsets[1];
+			payload_size = sizeof(u64);
+			payload_type = HFI_PAYLOAD_64_PACKED;
+			break;
+		case HFI_PROP_LUMA_CHROMA_BIT_DEPTH:
+			payload[0] = subsc_params.bit_depth;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_CODED_FRAMES:
+			payload[0] = subsc_params.coded_frames;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT:
+			payload[0] = subsc_params.fw_min_count;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_PIC_ORDER_CNT_TYPE:
+			payload[0] = subsc_params.pic_order_cnt;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_SIGNAL_COLOR_INFO:
+			payload[0] = subsc_params.color_info;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_PROFILE:
+			payload[0] = subsc_params.profile;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_LEVEL:
+			payload[0] = subsc_params.level;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_TIER:
+			payload[0] = subsc_params.tier;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		default:
+			prop_type = 0;
+			ret = -EINVAL;
+			break;
+		}
+		if (prop_type) {
+			ret = iris_hfi_set_property(inst,
+						    prop_type,
+						    HFI_HOST_FLAGS_NONE,
+						    get_hfi_port(inst, OUTPUT_MPLANE),
+						    payload_type,
+						    &payload,
+						    payload_size);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+int vdec_streamon_input(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = check_session_supported(inst);
+	if (ret)
+		return ret;
+
+	ret = set_v4l2_properties(inst);
+	if (ret)
+		return ret;
+
+	ret = iris_get_internal_buffers(inst, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = iris_destroy_internal_buffers(inst, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = iris_create_input_internal_buffers(inst);
+	if (ret)
+		return ret;
+
+	ret = iris_queue_input_internal_buffers(inst);
+	if (ret)
+		return ret;
+
+	if (!inst->ipsc_properties_set) {
+		ret = vdec_subscribe_src_change_param(inst);
+		if (ret)
+			return ret;
+		inst->ipsc_properties_set = true;
+	}
+
+	ret = vdec_subscribe_property(inst, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = process_streamon_input(inst);
+	if (ret)
+		return ret;
+
+	return ret;
+}
+
+int vdec_streamon_output(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = check_session_supported(inst);
+	if (ret)
+		return ret;
+
+	ret = vdec_set_output_property(inst);
+	if (ret)
+		goto error;
+
+	if (!inst->opsc_properties_set) {
+		memcpy(&inst->dst_subcr_params,
+		       &inst->src_subcr_params,
+		       sizeof(inst->src_subcr_params));
+		ret = vdec_subscribe_dst_change_param(inst);
+		if (ret)
+			goto error;
+		inst->opsc_properties_set = true;
+	}
+
+	ret = vdec_subscribe_property(inst, OUTPUT_MPLANE);
+	if (ret)
+		goto error;
+
+	ret = iris_get_internal_buffers(inst, OUTPUT_MPLANE);
+	if (ret)
+		goto error;
+
+	ret = iris_destroy_internal_buffers(inst, OUTPUT_MPLANE);
+	if (ret)
+		goto error;
+
+	ret = iris_create_output_internal_buffers(inst);
+	if (ret)
+		goto error;
+
+	ret = process_streamon_output(inst);
+	if (ret)
+		goto error;
+
+	ret = iris_queue_output_internal_buffers(inst);
+	if (ret)
+		goto error;
+
+	return ret;
+
+error:
+	session_streamoff(inst, OUTPUT_MPLANE);
+
+	return ret;
+}
+
+int vdec_qbuf(struct iris_inst *inst, struct vb2_buffer *vb2)
+{
+	struct iris_buffer *buf = NULL;
+	int ret;
+
+	buf = get_driver_buf(inst, vb2->type, vb2->index);
+	if (!buf)
+		return -EINVAL;
+
+	ret = vb2_buffer_to_driver(vb2, buf);
+	if (ret)
+		return ret;
+
+	if (!allow_qbuf(inst, vb2->type)) {
+		buf->attr |= BUF_ATTR_DEFERRED;
+		return 0;
+	}
+
+	iris_scale_power(inst);
+
+	ret = queue_buffer(inst, buf);
+	if (ret)
+		return ret;
+
+	if (vb2->type == OUTPUT_MPLANE)
+		ret = iris_release_nonref_buffers(inst);
+
+	return ret;
+}
+
+int vdec_start_cmd(struct iris_inst *inst)
+{
+	int ret;
+
+	vb2_clear_last_buffer_dequeued(inst->vb2q_dst);
+
+	if (inst->sub_state & IRIS_INST_SUB_DRC &&
+	    inst->sub_state & IRIS_INST_SUB_DRC_LAST &&
+	    inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE) {
+		ret = iris_alloc_and_queue_input_int_bufs(inst);
+		if (ret)
+			return ret;
+
+		ret = set_stage(inst, STAGE);
+		if (ret)
+			return ret;
+
+		ret = set_pipe(inst, PIPE);
+		if (ret)
+			return ret;
+	}
+
+	ret = iris_alloc_and_queue_additional_dpb_buffers(inst);
+	if (ret)
+		return ret;
+
+	ret = queue_deferred_buffers(inst, BUF_OUTPUT);
+	if (ret)
+		return ret;
+
+	ret = process_resume(inst);
+
+	return ret;
+}
+
+int vdec_stop_cmd(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = iris_hfi_drain(inst, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = iris_inst_change_sub_state(inst, 0, IRIS_INST_SUB_DRAIN);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_vdec.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_vdec.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_VDEC_H_
+#define _IRIS_VDEC_H_
+
+#include "iris_instance.h"
+
+int vdec_inst_init(struct iris_inst *inst);
+void vdec_inst_deinit(struct iris_inst *inst);
+int vdec_enum_fmt(struct iris_inst *inst, struct v4l2_fmtdesc *f);
+int vdec_try_fmt(struct iris_inst *inst, struct v4l2_format *f);
+int vdec_s_fmt(struct iris_inst *inst, struct v4l2_format *f);
+int vdec_subscribe_event(struct iris_inst *inst, const struct v4l2_event_subscription *sub);
+int vdec_init_src_change_param(struct iris_inst *inst);
+int vdec_src_change(struct iris_inst *inst);
+int vdec_streamon_input(struct iris_inst *inst);
+int vdec_streamon_output(struct iris_inst *inst);
+int vdec_qbuf(struct iris_inst *inst, struct vb2_buffer *vb2);
+int vdec_start_cmd(struct iris_inst *inst);
+int vdec_stop_cmd(struct iris_inst *inst);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_venc.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_venc.c
@@ -0,0 +1,947 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "hfi_defines.h"
+#include "iris_buffer.h"
+#include "iris_common.h"
+#include "iris_ctrls.h"
+#include "iris_helpers.h"
+#include "iris_hfi.h"
+#include "iris_hfi_packet.h"
+#include "iris_power.h"
+#include "iris_venc.h"
+
+#define SCALE_FACTOR 8
+#define UNSPECIFIED_COLOR_FORMAT 5
+
+static const u32 enc_input_properties[] = {
+	HFI_PROP_NO_OUTPUT,
+};
+
+static const u32 enc_output_properties[] = {
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_BUFFER_MARK,
+};
+
+struct venc_prop_type_handle {
+	u32 type;
+	int (*handle)(struct iris_inst *inst);
+};
+
+int venc_inst_init(struct iris_inst *inst)
+{
+	struct v4l2_format *f;
+	int ret;
+
+	inst->fmt_src = kzalloc(sizeof(*inst->fmt_src), GFP_KERNEL);
+	if (!inst->fmt_src)
+		return -ENOMEM;
+
+	inst->fmt_dst  = kzalloc(sizeof(*inst->fmt_dst), GFP_KERNEL);
+	if (!inst->fmt_dst)
+		return -ENOMEM;
+
+	inst->vb2q_src = kzalloc(sizeof(*inst->vb2q_src), GFP_KERNEL);
+	if (!inst->vb2q_src)
+		return -ENOMEM;
+
+	inst->vb2q_dst = kzalloc(sizeof(*inst->vb2q_dst), GFP_KERNEL);
+	if (!inst->vb2q_dst)
+		return -ENOMEM;
+
+	f = inst->fmt_dst;
+	f->type = OUTPUT_MPLANE;
+	f->fmt.pix_mp.width = DEFAULT_WIDTH;
+	f->fmt.pix_mp.height = DEFAULT_HEIGHT;
+	f->fmt.pix_mp.pixelformat = V4L2_PIX_FMT_H264;
+	f->fmt.pix_mp.num_planes = 1;
+	f->fmt.pix_mp.plane_fmt[0].bytesperline = 0;
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = iris_get_buffer_size(inst, BUF_OUTPUT);
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	f->fmt.pix_mp.colorspace = V4L2_COLORSPACE_DEFAULT;
+	f->fmt.pix_mp.xfer_func = V4L2_XFER_FUNC_DEFAULT;
+	f->fmt.pix_mp.ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+	f->fmt.pix_mp.quantization = V4L2_QUANTIZATION_DEFAULT;
+	inst->buffers.output.min_count = iris_get_buf_min_count(inst, BUF_OUTPUT);
+	inst->buffers.output.actual_count = inst->buffers.output.min_count;
+	inst->buffers.output.size = f->fmt.pix_mp.plane_fmt[0].sizeimage;
+
+	inst->crop.left = 0;
+	inst->crop.top = 0;
+	inst->crop.width = f->fmt.pix_mp.width;
+	inst->crop.height = f->fmt.pix_mp.height;
+
+	inst->compose.left = 0;
+	inst->compose.top = 0;
+	inst->compose.width = f->fmt.pix_mp.width;
+	inst->compose.height = f->fmt.pix_mp.height;
+
+	f = inst->fmt_src;
+	f->type = INPUT_MPLANE;
+	f->fmt.pix_mp.pixelformat = V4L2_PIX_FMT_QC08C;
+	f->fmt.pix_mp.width = DEFAULT_WIDTH;
+	f->fmt.pix_mp.height = DEFAULT_HEIGHT;
+	f->fmt.pix_mp.num_planes = 1;
+	f->fmt.pix_mp.plane_fmt[0].bytesperline = ALIGN(DEFAULT_WIDTH, 128);
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = iris_get_buffer_size(inst, BUF_INPUT);
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	f->fmt.pix_mp.colorspace = V4L2_COLORSPACE_DEFAULT;
+	f->fmt.pix_mp.xfer_func = V4L2_XFER_FUNC_DEFAULT;
+	f->fmt.pix_mp.ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+	f->fmt.pix_mp.quantization = V4L2_QUANTIZATION_DEFAULT;
+	inst->buffers.input.min_count = iris_get_buf_min_count(inst, BUF_INPUT);
+	inst->buffers.input.actual_count = inst->buffers.input.min_count;
+	inst->buffers.input.size = f->fmt.pix_mp.plane_fmt[0].sizeimage;
+
+	inst->hfi_rc_type = HFI_RC_VBR_CFR;
+	inst->hfi_layer_type = HFI_HIER_P_SLIDING_WINDOW;
+
+	ret = codec_change(inst, inst->fmt_dst->fmt.pix_mp.pixelformat);
+
+	return ret;
+}
+
+void venc_inst_deinit(struct iris_inst *inst)
+{
+	kfree(inst->fmt_dst);
+	kfree(inst->fmt_src);
+}
+
+int venc_enum_fmt(struct iris_inst *inst, struct v4l2_fmtdesc *f)
+{
+	struct iris_core *core;
+	u32 array[32] = {0};
+	u32 i = 0;
+
+	core = inst->core;
+
+	if (f->type == OUTPUT_MPLANE) {
+		u32 codecs = core->cap[ENC_CODECS].value;
+		u32 idx = 0;
+
+		for (i = 0; i <= 31; i++) {
+			if (codecs & BIT(i)) {
+				if (idx >= ARRAY_SIZE(array))
+					break;
+				array[idx] = codecs & BIT(i);
+				idx++;
+			}
+		}
+		if (!array[f->index])
+			return -EINVAL;
+		f->pixelformat = v4l2_codec_from_driver(inst, array[f->index]);
+		if (!f->pixelformat)
+			return -EINVAL;
+		f->flags = V4L2_FMT_FLAG_COMPRESSED;
+		strscpy(f->description, "codec", sizeof(f->description));
+	} else if (f->type == INPUT_MPLANE) {
+		u32 formats = inst->cap[PIX_FMTS].step_or_mask;
+		u32 idx = 0;
+
+		for (i = 0; i <= 31; i++) {
+			if (formats & BIT(i)) {
+				if (idx >= ARRAY_SIZE(array))
+					break;
+				array[idx] = formats & BIT(i);
+				idx++;
+			}
+		}
+		if (!array[f->index])
+			return -EINVAL;
+		f->pixelformat = v4l2_colorformat_from_driver(inst, array[f->index]);
+		if (!f->pixelformat)
+			return -EINVAL;
+		strscpy(f->description, "colorformat", sizeof(f->description));
+	}
+
+	memset(f->reserved, 0, sizeof(f->reserved));
+
+	return 0;
+}
+
+int venc_try_fmt(struct iris_inst *inst, struct v4l2_format *f)
+{
+	struct v4l2_pix_format_mplane *pixmp = &f->fmt.pix_mp;
+	u32 pix_fmt;
+
+	memset(pixmp->reserved, 0, sizeof(pixmp->reserved));
+
+	if (f->type == INPUT_MPLANE) {
+		pix_fmt = v4l2_colorformat_to_driver(inst, f->fmt.pix_mp.pixelformat);
+		if (!pix_fmt) {
+			f->fmt.pix_mp.pixelformat = inst->fmt_src->fmt.pix_mp.pixelformat;
+			f->fmt.pix_mp.width = inst->fmt_src->fmt.pix_mp.width;
+			f->fmt.pix_mp.height = inst->fmt_src->fmt.pix_mp.height;
+		}
+	} else if (f->type == OUTPUT_MPLANE) {
+		pix_fmt = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat);
+		if (!pix_fmt) {
+			f->fmt.pix_mp.width = inst->fmt_dst->fmt.pix_mp.width;
+			f->fmt.pix_mp.height = inst->fmt_dst->fmt.pix_mp.height;
+			f->fmt.pix_mp.pixelformat = inst->fmt_dst->fmt.pix_mp.pixelformat;
+		}
+	} else {
+		return -EINVAL;
+	}
+
+	if (pixmp->field == V4L2_FIELD_ANY)
+		pixmp->field = V4L2_FIELD_NONE;
+	pixmp->num_planes = 1;
+
+	return 0;
+}
+
+static int venc_s_fmt_output(struct iris_inst *inst, struct v4l2_format *f)
+{
+	struct v4l2_format *fmt;
+	enum codec_type codec;
+	u32 codec_align;
+	u32 width, height;
+	int ret = 0;
+
+	venc_try_fmt(inst, f);
+
+	fmt = inst->fmt_dst;
+	if (fmt->fmt.pix_mp.pixelformat != f->fmt.pix_mp.pixelformat) {
+		ret = codec_change(inst, f->fmt.pix_mp.pixelformat);
+		if (ret)
+			return ret;
+	}
+	fmt->type = OUTPUT_MPLANE;
+
+	codec = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat);
+
+	codec_align = (codec == HEVC) ? 32 : 16;
+	width = inst->compose.width;
+	height = inst->compose.height;
+	if (inst->cap[ROTATION].value == 90 || inst->cap[ROTATION].value == 270) {
+		width = inst->compose.height;
+		height = inst->compose.width;
+	}
+	fmt->fmt.pix_mp.width = ALIGN(width, codec_align);
+	fmt->fmt.pix_mp.height = ALIGN(height, codec_align);
+	fmt->fmt.pix_mp.num_planes = 1;
+	fmt->fmt.pix_mp.plane_fmt[0].bytesperline = 0;
+	fmt->fmt.pix_mp.plane_fmt[0].sizeimage =
+		iris_get_buffer_size(inst, BUF_OUTPUT);
+	if (f->fmt.pix_mp.colorspace != V4L2_COLORSPACE_DEFAULT &&
+	    f->fmt.pix_mp.colorspace != V4L2_COLORSPACE_REC709)
+		f->fmt.pix_mp.colorspace = V4L2_COLORSPACE_DEFAULT;
+	fmt->fmt.pix_mp.colorspace = f->fmt.pix_mp.colorspace;
+	fmt->fmt.pix_mp.xfer_func = f->fmt.pix_mp.xfer_func;
+	fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+	fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization;
+	inst->buffers.output.min_count = iris_get_buf_min_count(inst, BUF_OUTPUT);
+	if (inst->buffers.output.actual_count <
+		inst->buffers.output.min_count) {
+		inst->buffers.output.actual_count =
+			inst->buffers.output.min_count;
+	}
+	inst->buffers.output.size =
+		fmt->fmt.pix_mp.plane_fmt[0].sizeimage;
+
+	memcpy(f, fmt, sizeof(struct v4l2_format));
+
+	return ret;
+}
+
+static int venc_s_fmt_input(struct iris_inst *inst, struct v4l2_format *f)
+{
+	u32 pix_fmt, width, height, size, bytesperline;
+	struct v4l2_format *fmt, *output_fmt;
+	int ret = 0;
+
+	venc_try_fmt(inst, f);
+
+	pix_fmt = v4l2_colorformat_to_driver(inst, f->fmt.pix_mp.pixelformat);
+	inst->cap[PIX_FMTS].value = pix_fmt;
+
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	bytesperline = pix_fmt == FMT_TP10C ?
+		ALIGN(ALIGN(f->fmt.pix_mp.width, 192) * 4 / 3, 256) :
+		ALIGN(f->fmt.pix_mp.width, 128);
+
+	fmt = inst->fmt_src;
+	fmt->type = INPUT_MPLANE;
+	fmt->fmt.pix_mp.width = width;
+	fmt->fmt.pix_mp.height = height;
+	fmt->fmt.pix_mp.num_planes = 1;
+	fmt->fmt.pix_mp.pixelformat = f->fmt.pix_mp.pixelformat;
+	fmt->fmt.pix_mp.plane_fmt[0].bytesperline = bytesperline;
+	size = iris_get_buffer_size(inst, BUF_INPUT);
+	fmt->fmt.pix_mp.plane_fmt[0].sizeimage = size;
+	fmt->fmt.pix_mp.colorspace = f->fmt.pix_mp.colorspace;
+	fmt->fmt.pix_mp.xfer_func = f->fmt.pix_mp.xfer_func;
+	fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+	fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization;
+
+	output_fmt = inst->fmt_dst;
+	output_fmt->fmt.pix_mp.colorspace = fmt->fmt.pix_mp.colorspace;
+	output_fmt->fmt.pix_mp.xfer_func = fmt->fmt.pix_mp.xfer_func;
+	output_fmt->fmt.pix_mp.ycbcr_enc = fmt->fmt.pix_mp.ycbcr_enc;
+	output_fmt->fmt.pix_mp.quantization = fmt->fmt.pix_mp.quantization;
+
+	inst->buffers.input.min_count = iris_get_buf_min_count(inst, BUF_INPUT);
+	if (inst->buffers.input.actual_count <
+	    inst->buffers.input.min_count) {
+		inst->buffers.input.actual_count =
+			inst->buffers.input.min_count;
+	}
+	inst->buffers.input.size = size;
+
+	if (f->fmt.pix_mp.width != inst->crop.width ||
+	    f->fmt.pix_mp.height != inst->crop.height) {
+		inst->crop.top = 0;
+		inst->crop.left = 0;
+		inst->crop.width = f->fmt.pix_mp.width;
+		inst->crop.height = f->fmt.pix_mp.height;
+
+		inst->compose.top = 0;
+		inst->compose.left = 0;
+		inst->compose.width = f->fmt.pix_mp.width;
+		inst->compose.height = f->fmt.pix_mp.height;
+
+		ret = venc_s_fmt_output(inst, output_fmt);
+		if (ret)
+			return ret;
+	}
+
+	memcpy(f, fmt, sizeof(struct v4l2_format));
+
+	return ret;
+}
+
+int venc_s_fmt(struct iris_inst *inst, struct v4l2_format *f)
+{
+	int ret;
+
+	if (f->type == INPUT_MPLANE)
+		ret = venc_s_fmt_input(inst, f);
+	else if (f->type == OUTPUT_MPLANE)
+		ret = venc_s_fmt_output(inst, f);
+	else
+		ret = -EINVAL;
+
+	return ret;
+}
+
+int venc_s_selection(struct iris_inst *inst, struct v4l2_selection *s)
+{
+	struct v4l2_format *output_fmt;
+	int ret;
+
+	if (s->type != INPUT_MPLANE && s->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+		return -EINVAL;
+
+	switch (s->target) {
+	case V4L2_SEL_TGT_CROP:
+		if (s->r.left || s->r.top) {
+			s->r.left = 0;
+			s->r.top = 0;
+		}
+		if (s->r.width > inst->fmt_src->fmt.pix_mp.width)
+			s->r.width = inst->fmt_src->fmt.pix_mp.width;
+
+		if (s->r.height > inst->fmt_src->fmt.pix_mp.height)
+			s->r.height = inst->fmt_src->fmt.pix_mp.height;
+
+		inst->crop.left = s->r.left;
+		inst->crop.top = s->r.top;
+		inst->crop.width = s->r.width;
+		inst->crop.height = s->r.height;
+		inst->compose.left = inst->crop.left;
+		inst->compose.top = inst->crop.top;
+		inst->compose.width = inst->crop.width;
+		inst->compose.height = inst->crop.height;
+		output_fmt = inst->fmt_dst;
+		ret = venc_s_fmt_output(inst, output_fmt);
+		if (ret)
+			return ret;
+		break;
+	case V4L2_SEL_TGT_COMPOSE:
+		if (s->r.left < inst->crop.left)
+			s->r.left = inst->crop.left;
+
+		if (s->r.top < inst->crop.top)
+			s->r.top = inst->crop.top;
+
+		if (s->r.width > inst->crop.width)
+			s->r.width = inst->crop.width;
+
+		if (s->r.height > inst->crop.height)
+			s->r.height = inst->crop.height;
+		inst->compose.left = s->r.left;
+		inst->compose.top = s->r.top;
+		inst->compose.width = s->r.width;
+		inst->compose.height = s->r.height;
+
+		output_fmt = inst->fmt_dst;
+		ret = venc_s_fmt_output(inst, output_fmt);
+		if (ret)
+			return ret;
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	return ret;
+}
+
+int venc_s_param(struct iris_inst *inst, struct v4l2_streamparm *s_parm)
+{
+	struct v4l2_fract *timeperframe = NULL;
+	u32 q16_rate, max_rate, default_rate;
+	u64 us_per_frame = 0, input_rate = 0;
+	bool is_frame_rate = false;
+	int ret = 0;
+
+	if (s_parm->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		timeperframe = &s_parm->parm.output.timeperframe;
+		max_rate = inst->cap[OPERATING_RATE].max >> 16;
+		default_rate = inst->cap[OPERATING_RATE].value >> 16;
+		s_parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
+	} else {
+		timeperframe = &s_parm->parm.capture.timeperframe;
+		is_frame_rate = true;
+		max_rate = inst->cap[FRAME_RATE].max >> 16;
+		default_rate = inst->cap[FRAME_RATE].value >> 16;
+		s_parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME;
+	}
+
+	if (!timeperframe->denominator || !timeperframe->numerator) {
+		if (!timeperframe->numerator)
+			timeperframe->numerator = 1;
+		if (!timeperframe->denominator)
+			timeperframe->denominator = default_rate;
+	}
+
+	us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC;
+	us_per_frame = div64_u64(us_per_frame, timeperframe->denominator);
+
+	if (!us_per_frame) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	input_rate = (u64)USEC_PER_SEC;
+	input_rate = div64_u64(input_rate, us_per_frame);
+
+	q16_rate = (u32)input_rate << 16;
+	if (is_frame_rate)
+		inst->cap[FRAME_RATE].value = q16_rate;
+	else
+		inst->cap[OPERATING_RATE].value = q16_rate;
+
+	if ((s_parm->type == INPUT_MPLANE && inst->vb2q_src->streaming) ||
+	    (s_parm->type == OUTPUT_MPLANE && inst->vb2q_dst->streaming)) {
+		ret = check_core_mbps_mbpf(inst);
+		if (ret)
+			goto reset_rate;
+		ret = input_rate > max_rate;
+		if (ret) {
+			ret = -ENOMEM;
+			goto reset_rate;
+		}
+	}
+
+	if (is_frame_rate)
+		inst->cap[FRAME_RATE].flags |= CAP_FLAG_CLIENT_SET;
+	else
+		inst->cap[OPERATING_RATE].flags |= CAP_FLAG_CLIENT_SET;
+
+	if (inst->vb2q_dst->streaming) {
+		ret = iris_hfi_set_property(inst,
+					    HFI_PROP_FRAME_RATE,
+					    HFI_HOST_FLAGS_NONE,
+					    HFI_PORT_BITSTREAM,
+					    HFI_PAYLOAD_Q16,
+					    &q16_rate,
+					    sizeof(u32));
+		if (ret)
+			goto exit;
+	}
+
+	return ret;
+
+reset_rate:
+	if (ret) {
+		if (is_frame_rate)
+			inst->cap[FRAME_RATE].value = default_rate << 16;
+		else
+			inst->cap[OPERATING_RATE].value = default_rate << 16;
+	}
+exit:
+	return ret;
+}
+
+int venc_g_param(struct iris_inst *inst, struct v4l2_streamparm *s_parm)
+{
+	struct v4l2_fract *timeperframe = NULL;
+
+	if (s_parm->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		timeperframe = &s_parm->parm.output.timeperframe;
+		timeperframe->numerator = 1;
+		timeperframe->denominator =
+			inst->cap[OPERATING_RATE].value >> 16;
+		s_parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
+	} else {
+		timeperframe = &s_parm->parm.capture.timeperframe;
+		timeperframe->numerator = 1;
+		timeperframe->denominator =
+			inst->cap[FRAME_RATE].value >> 16;
+		s_parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME;
+	}
+
+	return 0;
+}
+
+int venc_subscribe_event(struct iris_inst *inst,
+			 const struct v4l2_event_subscription *sub)
+{
+	int ret;
+
+	switch (sub->type) {
+	case V4L2_EVENT_EOS:
+		ret = v4l2_event_subscribe(&inst->fh, sub, MAX_EVENTS, NULL);
+		break;
+	case V4L2_EVENT_CTRL:
+		ret = v4l2_ctrl_subscribe_event(&inst->fh, sub);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+int venc_start_cmd(struct iris_inst *inst)
+{
+	vb2_clear_last_buffer_dequeued(inst->vb2q_dst);
+
+	return process_resume(inst);
+}
+
+int venc_stop_cmd(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = iris_hfi_drain(inst, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = iris_inst_change_sub_state(inst, 0, IRIS_INST_SUB_DRAIN);
+
+	iris_scale_power(inst);
+
+	return ret;
+}
+
+int venc_qbuf(struct iris_inst *inst, struct vb2_buffer *vb2)
+{
+	struct iris_buffer *buf = NULL;
+	int ret;
+
+	buf = get_driver_buf(inst, vb2->type, vb2->index);
+	if (!buf)
+		return -EINVAL;
+
+	ret = vb2_buffer_to_driver(vb2, buf);
+	if (ret)
+		return ret;
+
+	if (!allow_qbuf(inst, vb2->type)) {
+		buf->attr |= BUF_ATTR_DEFERRED;
+		return 0;
+	}
+
+	iris_scale_power(inst);
+
+	return queue_buffer(inst, buf);
+}
+
+static int check_scaling_supported(struct iris_inst *inst)
+{
+	u32 iwidth, owidth, iheight, oheight;
+
+	if (!(inst->crop.left != inst->compose.left ||
+	      inst->crop.top != inst->compose.top ||
+	      inst->crop.width != inst->compose.width ||
+	      inst->crop.height != inst->compose.height))
+		return 0;
+
+	iwidth = inst->crop.width;
+	iheight = inst->crop.height;
+	owidth = inst->compose.width;
+	oheight = inst->compose.height;
+
+	if (owidth > iwidth || oheight > iheight)
+		return -EINVAL;
+
+	if (iwidth > owidth * SCALE_FACTOR || iheight > oheight * SCALE_FACTOR)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int venc_set_colorformat(struct iris_inst *inst)
+{
+	u32 hfi_colorformat;
+	u32 pixelformat;
+
+	pixelformat = inst->fmt_src->fmt.pix_mp.pixelformat;
+	hfi_colorformat = get_hfi_colorformat(pixelformat);
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_COLOR_FORMAT,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, INPUT_MPLANE),
+				     HFI_PAYLOAD_U32_ENUM,
+				     &hfi_colorformat,
+				     sizeof(u32));
+}
+
+static int venc_set_stride_scanline(struct iris_inst *inst)
+{
+	u32 color_format, stride_y, scanline_y;
+	u32 stride_uv = 0, scanline_uv = 0;
+	u32 payload[2];
+
+	color_format = inst->cap[PIX_FMTS].value;
+	if (!is_linear_colorformat(color_format))
+		return 0;
+
+	stride_y = color_format == FMT_TP10C ?
+		ALIGN(inst->fmt_src->fmt.pix_mp.width, 192) :
+		ALIGN(inst->fmt_src->fmt.pix_mp.width, 128);
+	scanline_y = color_format == FMT_TP10C ?
+		ALIGN(inst->fmt_src->fmt.pix_mp.height, 16) :
+		ALIGN(inst->fmt_src->fmt.pix_mp.height, 32);
+
+	if (color_format == FMT_NV12) {
+		stride_uv = stride_y;
+		scanline_uv = scanline_y / 2;
+	}
+
+	payload[0] = stride_y << 16 | scanline_y;
+	payload[1] = stride_uv << 16 | scanline_uv;
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_LINEAR_STRIDE_SCANLINE,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, INPUT_MPLANE),
+				     HFI_PAYLOAD_64_PACKED,
+				     &payload,
+				     sizeof(u64));
+}
+
+static int venc_set_raw_resolution(struct iris_inst *inst)
+{
+	u32 resolution;
+
+	resolution = (inst->fmt_src->fmt.pix_mp.width << 16) |
+		inst->fmt_src->fmt.pix_mp.height;
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_RAW_RESOLUTION,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, INPUT_MPLANE),
+				     HFI_PAYLOAD_32_PACKED,
+				     &resolution,
+				     sizeof(u32));
+}
+
+static int venc_set_bitstream_resolution(struct iris_inst *inst)
+{
+	u32 resolution;
+
+	resolution = (inst->fmt_dst->fmt.pix_mp.width << 16) |
+		inst->fmt_dst->fmt.pix_mp.height;
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_BITSTREAM_RESOLUTION,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, OUTPUT_MPLANE),
+				     HFI_PAYLOAD_32_PACKED,
+				     &resolution,
+				     sizeof(u32));
+}
+
+static int venc_set_inp_crop_offsets(struct iris_inst *inst)
+{
+	u32 left_offset, top_offset, right_offset, bottom_offset;
+	u32 crop[2] = {0};
+	u32 width, height;
+
+	left_offset = inst->crop.left;
+	top_offset = inst->crop.top;
+	width = inst->crop.width;
+	height = inst->crop.height;
+
+	right_offset = (inst->fmt_src->fmt.pix_mp.width - width);
+	bottom_offset = (inst->fmt_src->fmt.pix_mp.height - height);
+
+	crop[0] = left_offset << 16 | top_offset;
+	crop[1] = right_offset << 16 | bottom_offset;
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_CROP_OFFSETS,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, INPUT_MPLANE),
+				     HFI_PAYLOAD_64_PACKED,
+				     &crop,
+				     sizeof(u64));
+}
+
+static int venc_set_out_crop_offsets(struct iris_inst *inst)
+{
+	u32 left_offset, top_offset, right_offset, bottom_offset;
+	u32 crop[2] = {0};
+	u32 width, height;
+
+	left_offset = inst->compose.left;
+	top_offset = inst->compose.top;
+	width = inst->compose.width;
+	height = inst->compose.height;
+	if (inst->cap[ROTATION].value == 90 || inst->cap[ROTATION].value == 270) {
+		width = inst->compose.height;
+		height = inst->compose.width;
+	}
+
+	right_offset = (inst->fmt_dst->fmt.pix_mp.width - width);
+	bottom_offset = (inst->fmt_dst->fmt.pix_mp.height - height);
+
+	crop[0] = left_offset << 16 | top_offset;
+	crop[1] = right_offset << 16 | bottom_offset;
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_CROP_OFFSETS,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, OUTPUT_MPLANE),
+				     HFI_PAYLOAD_64_PACKED,
+				     &crop,
+				     sizeof(u64));
+}
+
+static int venc_set_colorspace(struct iris_inst *inst)
+{
+	u32 video_signal_type_present_flag = 0, payload = 0;
+	u32 matrix_coeff = HFI_MATRIX_COEFF_RESERVED;
+	u32 video_format = UNSPECIFIED_COLOR_FORMAT;
+	struct v4l2_pix_format_mplane *pixmp = NULL;
+	u32 transfer_char = HFI_TRANSFER_RESERVED;
+	u32 colour_description_present_flag = 0;
+	u32 primaries = HFI_PRIMARIES_RESERVED;
+	u32 full_range = 0;
+
+	pixmp = &inst->fmt_src->fmt.pix_mp;
+	if (pixmp->colorspace != V4L2_COLORSPACE_DEFAULT ||
+	    pixmp->ycbcr_enc != V4L2_YCBCR_ENC_DEFAULT ||
+	    pixmp->xfer_func != V4L2_XFER_FUNC_DEFAULT) {
+		colour_description_present_flag = 1;
+		video_signal_type_present_flag = 1;
+		primaries = get_hfi_color_primaries(pixmp->colorspace);
+		matrix_coeff = get_hfi_matrix_coefficients(pixmp->ycbcr_enc);
+		transfer_char = get_hfi_transer_char(pixmp->xfer_func);
+	}
+
+	if (pixmp->quantization != V4L2_QUANTIZATION_DEFAULT) {
+		video_signal_type_present_flag = 1;
+		full_range = pixmp->quantization ==
+			V4L2_QUANTIZATION_FULL_RANGE ? 1 : 0;
+	}
+
+	payload = (matrix_coeff & 0xFF) |
+		((transfer_char << 8) & 0xFF00) |
+		((primaries << 16) & 0xFF0000) |
+		((colour_description_present_flag << 24) & 0x1000000) |
+		((full_range << 25) & 0x2000000) |
+		((video_format << 26) & 0x1C000000) |
+		((video_signal_type_present_flag << 29) & 0x20000000);
+
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_SIGNAL_COLOR_INFO,
+				     HFI_HOST_FLAGS_NONE,
+				     get_hfi_port(inst, INPUT_MPLANE),
+				     HFI_PAYLOAD_32_PACKED,
+				     &payload,
+				     sizeof(u32));
+}
+
+static int venc_set_quality_mode(struct iris_inst *inst)
+{
+	u32 mode;
+
+	mode = decide_quality_mode(inst);
+	return iris_hfi_set_property(inst,
+				     HFI_PROP_QUALITY_MODE,
+				     HFI_HOST_FLAGS_NONE,
+				     HFI_PORT_BITSTREAM,
+				     HFI_PAYLOAD_U32_ENUM,
+				     &mode,
+				     sizeof(u32));
+}
+
+static int venc_set_input_properties(struct iris_inst *inst)
+{
+	int j, ret;
+	static const struct venc_prop_type_handle prop_type_handle_arr[] = {
+		{HFI_PROP_COLOR_FORMAT,               venc_set_colorformat                 },
+		{HFI_PROP_RAW_RESOLUTION,             venc_set_raw_resolution              },
+		{HFI_PROP_CROP_OFFSETS,               venc_set_inp_crop_offsets            },
+		{HFI_PROP_LINEAR_STRIDE_SCANLINE,     venc_set_stride_scanline             },
+		{HFI_PROP_SIGNAL_COLOR_INFO,          venc_set_colorspace                  },
+	};
+
+	for (j = 0; j < ARRAY_SIZE(prop_type_handle_arr); j++) {
+		ret = prop_type_handle_arr[j].handle(inst);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+static int venc_property_subscription(struct iris_inst *inst, u32 plane)
+{
+	u32 payload[32] = {0};
+	u32 payload_size = 0;
+	u32 i;
+
+	payload[0] = HFI_MODE_PROPERTY;
+	if (plane == INPUT_MPLANE) {
+		for (i = 0; i < ARRAY_SIZE(enc_input_properties); i++)
+			payload[i + 1] = enc_input_properties[i];
+		payload_size = (ARRAY_SIZE(enc_input_properties) + 1) *
+				sizeof(u32);
+	} else if (plane == OUTPUT_MPLANE) {
+		for (i = 0; i < ARRAY_SIZE(enc_output_properties); i++)
+			payload[i + 1] = enc_output_properties[i];
+		payload_size = (ARRAY_SIZE(enc_output_properties) + 1) *
+				sizeof(u32);
+	} else {
+		return -EINVAL;
+	}
+
+	return iris_hfi_session_subscribe_mode(inst,
+					       HFI_CMD_SUBSCRIBE_MODE,
+					       plane,
+					       HFI_PAYLOAD_U32_ARRAY,
+					       &payload[0],
+					       payload_size);
+}
+
+int venc_streamon_input(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = check_session_supported(inst);
+	if (ret)
+		goto error;
+
+	ret = check_scaling_supported(inst);
+	if (ret)
+		goto error;
+
+	ret = venc_set_input_properties(inst);
+	if (ret)
+		goto error;
+
+	ret = iris_get_internal_buffers(inst, INPUT_MPLANE);
+	if (ret)
+		goto error;
+
+	ret = iris_destroy_internal_buffers(inst, INPUT_MPLANE);
+	if (ret)
+		goto error;
+
+	ret = iris_create_input_internal_buffers(inst);
+	if (ret)
+		goto error;
+
+	ret = iris_queue_input_internal_buffers(inst);
+	if (ret)
+		goto error;
+
+	ret = venc_property_subscription(inst, INPUT_MPLANE);
+	if (ret)
+		goto error;
+
+	ret = process_streamon_input(inst);
+	if (ret)
+		goto error;
+
+	return ret;
+
+error:
+	return ret;
+}
+
+static int venc_set_output_properties(struct iris_inst *inst)
+{
+	int j, ret;
+	static const struct venc_prop_type_handle prop_type_handle_arr[] = {
+		{HFI_PROP_BITSTREAM_RESOLUTION,       venc_set_bitstream_resolution    },
+		{HFI_PROP_CROP_OFFSETS,               venc_set_out_crop_offsets        },
+	};
+
+	for (j = 0; j < ARRAY_SIZE(prop_type_handle_arr); j++) {
+		ret = prop_type_handle_arr[j].handle(inst);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+int venc_streamon_output(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = venc_set_output_properties(inst);
+	if (ret)
+		goto error;
+
+	ret = set_v4l2_properties(inst);
+	if (ret)
+		goto error;
+
+	ret = venc_set_quality_mode(inst);
+	if (ret)
+		goto error;
+
+	ret = iris_get_internal_buffers(inst, OUTPUT_MPLANE);
+	if (ret)
+		goto error;
+
+	ret = iris_destroy_internal_buffers(inst, OUTPUT_MPLANE);
+	if (ret)
+		goto error;
+
+	ret = iris_create_output_internal_buffers(inst);
+	if (ret)
+		goto error;
+
+	ret = iris_queue_output_internal_buffers(inst);
+	if (ret)
+		goto error;
+
+	ret = venc_property_subscription(inst, OUTPUT_MPLANE);
+	if (ret)
+		goto error;
+
+	ret = process_streamon_output(inst);
+	if (ret)
+		goto error;
+
+	return ret;
+
+error:
+	session_streamoff(inst, OUTPUT_MPLANE);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_venc.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_venc.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_VENC_H_
+#define _IRIS_VENC_H_
+
+#include "iris_instance.h"
+
+int venc_inst_init(struct iris_inst *inst);
+void venc_inst_deinit(struct iris_inst *inst);
+int venc_enum_fmt(struct iris_inst *inst, struct v4l2_fmtdesc *f);
+int venc_try_fmt(struct iris_inst *inst, struct v4l2_format *f);
+int venc_s_fmt(struct iris_inst *inst, struct v4l2_format *f);
+int venc_s_selection(struct iris_inst *inst, struct v4l2_selection *s);
+int venc_s_param(struct iris_inst *inst, struct v4l2_streamparm *s_parm);
+int venc_g_param(struct iris_inst *inst, struct v4l2_streamparm *s_parm);
+int venc_subscribe_event(struct iris_inst *inst,
+			 const struct v4l2_event_subscription *sub);
+int venc_start_cmd(struct iris_inst *inst);
+int venc_stop_cmd(struct iris_inst *inst);
+int venc_qbuf(struct iris_inst *inst, struct vb2_buffer *vb2);
+int venc_streamon_input(struct iris_inst *inst);
+int venc_streamon_output(struct iris_inst *inst);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_vidc.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -0,0 +1,1429 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/videodev2.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+
+#include "iris_buffer.h"
+#include "iris_common.h"
+#include "iris_ctrls.h"
+#include "iris_helpers.h"
+#include "iris_hfi.h"
+#include "iris_instance.h"
+#include "iris_power.h"
+#include "iris_vdec.h"
+#include "iris_venc.h"
+#include "iris_vidc.h"
+#include "iris_vb2.h"
+#include "memory.h"
+
+#define VIDC_DRV_NAME "iris_driver"
+#define VIDC_BUS_NAME "platform:iris_bus"
+
+static int vidc_v4l2_fh_init(struct iris_inst *inst)
+{
+	struct iris_core *core;
+
+	core = inst->core;
+
+	if (inst->fh.vdev)
+		return -EINVAL;
+
+	if (inst->domain == ENCODER)
+		v4l2_fh_init(&inst->fh, core->vdev_enc);
+	else if (inst->domain == DECODER)
+		v4l2_fh_init(&inst->fh, core->vdev_dec);
+
+	inst->fh.ctrl_handler = &inst->ctrl_handler;
+	v4l2_fh_add(&inst->fh);
+
+	return 0;
+}
+
+static int vidc_v4l2_fh_deinit(struct iris_inst *inst)
+{
+	if (!inst->fh.vdev)
+		return 0;
+
+	v4l2_fh_del(&inst->fh);
+	inst->fh.ctrl_handler = NULL;
+	v4l2_fh_exit(&inst->fh);
+
+	return 0;
+}
+
+static int vb2q_init(struct iris_inst *inst,
+		     struct vb2_queue *q, enum v4l2_buf_type type)
+{
+	struct iris_core *core;
+
+	core = inst->core;
+
+	q->lock = &inst->ctx_q_lock;
+	q->type = type;
+	q->io_modes = VB2_MMAP | VB2_DMABUF;
+	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
+	q->ops = core->vb2_ops;
+	q->mem_ops = core->vb2_mem_ops;
+	q->drv_priv = inst;
+	q->copy_timestamp = 1;
+	q->min_queued_buffers = 0;
+	return vb2_queue_init(q);
+}
+
+static int vidc_vb2_queue_init(struct iris_inst *inst)
+{
+	int ret;
+
+	ret = vb2q_init(inst, inst->vb2q_src, INPUT_MPLANE);
+	if (ret)
+		return ret;
+
+	ret = vb2q_init(inst, inst->vb2q_dst, OUTPUT_MPLANE);
+	if (ret)
+		goto fail_vb2q_src_deinit;
+
+	return ret;
+
+fail_vb2q_src_deinit:
+	vb2_queue_release(inst->vb2q_src);
+
+	return ret;
+}
+
+static int vidc_vb2_queue_deinit(struct iris_inst *inst)
+{
+	vb2_queue_release(inst->vb2q_src);
+	kfree(inst->vb2q_src);
+	inst->vb2q_src = NULL;
+
+	vb2_queue_release(inst->vb2q_dst);
+	kfree(inst->vb2q_dst);
+	inst->vb2q_dst = NULL;
+
+	return 0;
+}
+
+static int vidc_add_session(struct iris_inst *inst)
+{
+	struct iris_core *core;
+	struct iris_inst *i;
+	u32 count = 0;
+	int ret = 0;
+
+	core = inst->core;
+
+	mutex_lock(&core->lock);
+	if (core->state != IRIS_CORE_INIT) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+	list_for_each_entry(i, &core->instances, list)
+		count++;
+
+	if (count < core->cap[MAX_SESSION_COUNT].value)
+		list_add_tail(&inst->list, &core->instances);
+	else
+		ret = -EAGAIN;
+unlock:
+	mutex_unlock(&core->lock);
+
+	return ret;
+}
+
+static int vidc_remove_session(struct iris_inst *inst)
+{
+	struct iris_inst *i, *temp;
+	struct iris_core *core;
+
+	core = inst->core;
+
+	mutex_lock(&core->lock);
+	list_for_each_entry_safe(i, temp, &core->instances, list) {
+		if (i->session_id == inst->session_id) {
+			list_del_init(&i->list);
+			break;
+		}
+	}
+	mutex_unlock(&core->lock);
+
+	return 0;
+}
+
+static struct iris_inst *get_vidc_inst(struct file *filp, void *fh)
+{
+	if (!filp || !filp->private_data)
+		return NULL;
+
+	return container_of(filp->private_data,
+					struct iris_inst, fh);
+}
+
+int vidc_open(struct file *filp)
+{
+	struct iris_core *core = video_drvdata(filp);
+	struct iris_inst *inst = NULL;
+	struct video_device *vdev;
+	u32 session_type = 0;
+	int i = 0;
+	int ret;
+
+	vdev = video_devdata(filp);
+	if (strcmp(vdev->name, "qcom-iris-decoder") == 0)
+		session_type = DECODER;
+	else if (strcmp(vdev->name, "qcom-iris-encoder") == 0)
+		session_type = ENCODER;
+
+	if (session_type != DECODER && session_type != ENCODER)
+		return -EINVAL;
+
+	ret = iris_pm_get(core);
+	if (ret)
+		return ret;
+
+	ret = iris_core_init(core);
+	if (ret)
+		goto fail_pm_put;
+
+	ret = iris_core_init_wait(core);
+	if (ret)
+		goto fail_pm_put;
+
+	inst = kzalloc(sizeof(*inst), GFP_KERNEL);
+	if (!inst) {
+		ret = -ENOMEM;
+		goto fail_pm_put;
+	}
+
+	inst->core = core;
+	inst->domain = session_type;
+	inst->session_id = hash32_ptr(inst);
+	inst->ipsc_properties_set = false;
+	inst->opsc_properties_set = false;
+	inst->has_bframe = false;
+	inst->iframe = false;
+	iris_inst_change_state(inst, IRIS_INST_OPEN);
+	mutex_init(&inst->lock);
+	mutex_init(&inst->ctx_q_lock);
+
+	ret = vidc_add_session(inst);
+	if (ret)
+		goto fail_free_inst;
+
+	ret = iris_mem_pool_init(inst);
+	if (ret)
+		goto fail_remove_session;
+
+	INIT_LIST_HEAD(&inst->buffers.input.list);
+	INIT_LIST_HEAD(&inst->buffers.output.list);
+	INIT_LIST_HEAD(&inst->buffers.read_only.list);
+	INIT_LIST_HEAD(&inst->buffers.bin.list);
+	INIT_LIST_HEAD(&inst->buffers.arp.list);
+	INIT_LIST_HEAD(&inst->buffers.comv.list);
+	INIT_LIST_HEAD(&inst->buffers.non_comv.list);
+	INIT_LIST_HEAD(&inst->buffers.line.list);
+	INIT_LIST_HEAD(&inst->buffers.dpb.list);
+	INIT_LIST_HEAD(&inst->buffers.persist.list);
+	INIT_LIST_HEAD(&inst->buffers.vpss.list);
+	INIT_LIST_HEAD(&inst->caps_list);
+	INIT_LIST_HEAD(&inst->input_timer_list);
+	for (i = 0; i < MAX_SIGNAL; i++)
+		init_completion(&inst->completions[i]);
+
+	ret = vidc_v4l2_fh_init(inst);
+	if (ret)
+		goto fail_mem_pool_deinit;
+
+	if (inst->domain == DECODER)
+		ret = vdec_inst_init(inst);
+	else if (inst->domain == ENCODER)
+		ret = venc_inst_init(inst);
+	if (ret)
+		goto fail_fh_deinit;
+
+	ret = vidc_vb2_queue_init(inst);
+	if (ret)
+		goto fail_inst_deinit;
+
+	iris_scale_power(inst);
+
+	ret = iris_hfi_session_open(inst);
+	if (ret) {
+		dev_err(core->dev, "%s: session open failed\n", __func__);
+		goto fail_core_deinit;
+	}
+
+	iris_pm_put(core, true);
+
+	filp->private_data = &inst->fh;
+
+	return 0;
+
+fail_core_deinit:
+	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+	iris_core_deinit(core);
+	vidc_vb2_queue_deinit(inst);
+fail_inst_deinit:
+	if (inst->domain == DECODER)
+		vdec_inst_deinit(inst);
+	else if (inst->domain == ENCODER)
+		venc_inst_deinit(inst);
+fail_fh_deinit:
+	vidc_v4l2_fh_deinit(inst);
+fail_mem_pool_deinit:
+	iris_mem_pool_deinit(inst);
+fail_remove_session:
+	vidc_remove_session(inst);
+fail_free_inst:
+	mutex_destroy(&inst->ctx_q_lock);
+	mutex_destroy(&inst->lock);
+	kfree(inst);
+fail_pm_put:
+	iris_pm_put(core, false);
+
+	return ret;
+}
+
+int vidc_close(struct file *filp)
+{
+	struct iris_inst *inst;
+	struct iris_core *core;
+
+	inst = get_vidc_inst(filp, NULL);
+	if (!inst)
+		return -EINVAL;
+
+	core = inst->core;
+
+	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+	if (inst->domain == DECODER)
+		vdec_inst_deinit(inst);
+	else if (inst->domain == ENCODER)
+		venc_inst_deinit(inst);
+
+	mutex_lock(&inst->lock);
+	iris_pm_get(core);
+	close_session(inst);
+	iris_inst_change_state(inst, IRIS_INST_CLOSE);
+	vidc_vb2_queue_deinit(inst);
+	vidc_v4l2_fh_deinit(inst);
+	iris_destroy_buffers(inst);
+	vidc_remove_session(inst);
+	iris_pm_put(core, false);
+	mutex_unlock(&inst->lock);
+	mutex_destroy(&inst->ctx_q_lock);
+	mutex_destroy(&inst->lock);
+	kfree(inst);
+	filp->private_data = NULL;
+
+	return 0;
+}
+
+static __poll_t get_poll_flags(struct iris_inst *inst, u32 plane)
+{
+	struct vb2_buffer *vb = NULL;
+	struct vb2_queue *q = NULL;
+	unsigned long flags = 0;
+	__poll_t poll = 0;
+
+	if (plane == INPUT_MPLANE)
+		q = inst->vb2q_src;
+	else if (plane == OUTPUT_MPLANE)
+		q = inst->vb2q_dst;
+
+	if (!q)
+		return EPOLLERR;
+
+	spin_lock_irqsave(&q->done_lock, flags);
+	if (!list_empty(&q->done_list))
+		vb = list_first_entry(&q->done_list, struct vb2_buffer,
+				      done_entry);
+	if (vb && (vb->state == VB2_BUF_STATE_DONE ||
+		   vb->state == VB2_BUF_STATE_ERROR)) {
+		if (plane == OUTPUT_MPLANE)
+			poll |= EPOLLIN | EPOLLRDNORM;
+		else if (plane == INPUT_MPLANE)
+			poll |= EPOLLOUT | EPOLLWRNORM;
+	}
+	spin_unlock_irqrestore(&q->done_lock, flags);
+
+	return poll;
+}
+
+static __poll_t vidc_poll(struct file *filp, struct poll_table_struct *pt)
+{
+	struct iris_inst *inst;
+	__poll_t poll = 0;
+
+	inst = get_vidc_inst(filp, NULL);
+	if (!inst)
+		return EPOLLERR;
+
+	if (IS_SESSION_ERROR(inst))
+		return EPOLLERR;
+
+	poll_wait(filp, &inst->fh.wait, pt);
+	poll_wait(filp, &inst->vb2q_src->done_wq, pt);
+	poll_wait(filp, &inst->vb2q_dst->done_wq, pt);
+
+	if (v4l2_event_pending(&inst->fh))
+		poll |= EPOLLPRI;
+
+	poll |= get_poll_flags(inst, INPUT_MPLANE);
+	poll |= get_poll_flags(inst, OUTPUT_MPLANE);
+
+	return poll;
+}
+
+static int vidc_enum_fmt(struct file *filp, void *fh, struct v4l2_fmtdesc *f)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (inst->domain == DECODER)
+		ret = vdec_enum_fmt(inst, f);
+	else if (inst->domain == ENCODER)
+		ret = venc_enum_fmt(inst, f);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_try_fmt(struct file *filp, void *fh, struct v4l2_format *f)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (!allow_s_fmt(inst, f->type)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (inst->domain == DECODER)
+		ret = vdec_try_fmt(inst, f);
+	else if (inst->domain == ENCODER)
+		ret = venc_try_fmt(inst, f);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_s_fmt(struct file *filp, void *fh, struct v4l2_format *f)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (!allow_s_fmt(inst, f->type)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (inst->domain == DECODER)
+		ret = vdec_s_fmt(inst, f);
+	else if (inst->domain == ENCODER)
+		ret = venc_s_fmt(inst, f);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_g_fmt(struct file *filp, void *fh, struct v4l2_format *f)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (f->type == INPUT_MPLANE)
+		memcpy(f, inst->fmt_src, sizeof(*f));
+	else if (f->type == OUTPUT_MPLANE)
+		memcpy(f, inst->fmt_dst, sizeof(*f));
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_enum_framesizes(struct file *filp, void *fh,
+				struct v4l2_frmsizeenum *fsize)
+{
+	enum colorformat_type colorfmt;
+	struct iris_inst *inst;
+	enum codec_type codec;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !fsize)
+		return -EINVAL;
+
+	if (fsize->index)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	codec = v4l2_codec_to_driver(inst, fsize->pixel_format);
+	if (!codec) {
+		colorfmt = v4l2_colorformat_to_driver(inst, fsize->pixel_format);
+		if (colorfmt == FMT_NONE) {
+			ret = -EINVAL;
+			goto unlock;
+		}
+	}
+
+	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
+	fsize->stepwise.min_width = inst->cap[FRAME_WIDTH].min;
+	fsize->stepwise.max_width = inst->cap[FRAME_WIDTH].max;
+	fsize->stepwise.step_width = inst->cap[FRAME_WIDTH].step_or_mask;
+	fsize->stepwise.min_height = inst->cap[FRAME_HEIGHT].min;
+	fsize->stepwise.max_height = inst->cap[FRAME_HEIGHT].max;
+	fsize->stepwise.step_height = inst->cap[FRAME_HEIGHT].step_or_mask;
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_enum_frameintervals(struct file *filp, void *fh,
+				    struct v4l2_frmivalenum *fival)
+
+{
+	enum colorformat_type colorfmt;
+	struct iris_inst *inst;
+	struct iris_core *core;
+	u32 fps, mbpf;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !fival)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (inst->domain == DECODER) {
+		ret = -ENOTTY;
+		goto unlock;
+	}
+
+	core = inst->core;
+
+	if (fival->index) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	colorfmt = v4l2_colorformat_to_driver(inst, fival->pixel_format);
+	if (colorfmt == FMT_NONE) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (fival->width > inst->cap[FRAME_WIDTH].max ||
+	    fival->width < inst->cap[FRAME_WIDTH].min ||
+	    fival->height > inst->cap[FRAME_HEIGHT].max ||
+	    fival->height < inst->cap[FRAME_HEIGHT].min) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	mbpf = NUM_MBS_PER_FRAME(fival->height, fival->width);
+	fps = core->cap[MAX_MBPS].value / mbpf;
+
+	fival->type = V4L2_FRMIVAL_TYPE_STEPWISE;
+	fival->stepwise.min.numerator = 1;
+	fival->stepwise.min.denominator = 1;
+
+	fival->stepwise.max.numerator = 1;
+	fival->stepwise.max.denominator =
+			min_t(u32, fps, inst->cap[FRAME_RATE].max);
+	fival->stepwise.step.numerator = 1;
+	fival->stepwise.step.denominator = inst->cap[FRAME_RATE].max;
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_reqbufs(struct file *filp, void *fh, struct v4l2_requestbuffers *b)
+{
+	struct vb2_queue *vb2q = NULL;
+	struct iris_inst *inst;
+	int ret;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !b)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (!allow_reqbufs(inst, b->type)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	vb2q = get_vb2q(inst, b->type);
+	if (!vb2q) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	ret = vb2_reqbufs(vb2q, b);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_querybuf(struct file *filp, void *fh, struct v4l2_buffer *b)
+{
+	struct vb2_queue *vb2q = NULL;
+	struct iris_inst *inst;
+	int ret;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !b)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	vb2q = get_vb2q(inst, b->type);
+	if (!vb2q) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	ret = vb2_querybuf(vb2q, b);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_create_bufs(struct file *filp, void *fh, struct v4l2_create_buffers *b)
+{
+	struct iris_inst *inst;
+	struct vb2_queue *vb2q;
+	struct v4l2_format *f;
+	int ret;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !b)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	f = &b->format;
+	vb2q = get_vb2q(inst, f->type);
+	if (!vb2q) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	ret = vb2_create_bufs(vb2q, b);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_prepare_buf(struct file *filp, void *fh, struct v4l2_buffer *b)
+{
+	struct video_device *vdev;
+	struct iris_inst *inst;
+	struct vb2_queue *vb2q;
+	int ret;
+
+	inst = get_vidc_inst(filp, fh);
+	vdev = video_devdata(filp);
+	if (!inst || !vdev || !vdev->v4l2_dev->mdev)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	vb2q = get_vb2q(inst, b->type);
+	if (!vb2q) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	ret = vb2_prepare_buf(vb2q, vdev->v4l2_dev->mdev, b);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_qbuf(struct file *filp, void *fh, struct v4l2_buffer *b)
+{
+	struct video_device *vdev;
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	vdev = video_devdata(filp);
+	if (!inst || !b)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (b->type == INPUT_MPLANE)
+		ret = vb2_qbuf(inst->vb2q_src, vdev->v4l2_dev->mdev, b);
+	else if (b->type == OUTPUT_MPLANE)
+		ret = vb2_qbuf(inst->vb2q_dst, vdev->v4l2_dev->mdev, b);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_dqbuf(struct file *filp, void *fh, struct v4l2_buffer *b)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !b)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (b->type == INPUT_MPLANE)
+		ret = vb2_dqbuf(inst->vb2q_src, b, true);
+	else if (b->type == OUTPUT_MPLANE)
+		ret = vb2_dqbuf(inst->vb2q_dst, b, true);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_streamon(struct file *filp, void *fh, enum v4l2_buf_type type)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (!allow_streamon(inst, type)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (type == INPUT_MPLANE)
+		ret = vb2_streamon(inst->vb2q_src, type);
+	else if (type == OUTPUT_MPLANE)
+		ret = vb2_streamon(inst->vb2q_dst, type);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_streamoff(struct file *filp, void *fh, enum v4l2_buf_type type)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (!allow_streamoff(inst, type)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (type == INPUT_MPLANE)
+		ret = vb2_streamoff(inst->vb2q_src, type);
+	else if (type == OUTPUT_MPLANE)
+		ret = vb2_streamoff(inst->vb2q_dst, type);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_querycap(struct file *filp, void *fh, struct v4l2_capability *cap)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	strscpy(cap->driver, VIDC_DRV_NAME, sizeof(cap->driver));
+	strscpy(cap->bus_info, VIDC_BUS_NAME, sizeof(cap->bus_info));
+	memset(cap->reserved, 0, sizeof(cap->reserved));
+
+	if (inst->domain == DECODER)
+		strscpy(cap->card, "iris_decoder", sizeof(cap->card));
+	else if (inst->domain == ENCODER)
+		strscpy(cap->card, "iris_encoder", sizeof(cap->card));
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_queryctrl(struct file *filp, void *fh, struct v4l2_queryctrl *q_ctrl)
+{
+	struct v4l2_ctrl *ctrl;
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !q_ctrl)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	ctrl = v4l2_ctrl_find(&inst->ctrl_handler, q_ctrl->id);
+	if (!ctrl) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	q_ctrl->minimum = ctrl->minimum;
+	q_ctrl->maximum = ctrl->maximum;
+	q_ctrl->default_value = ctrl->default_value;
+	q_ctrl->flags = 0;
+	q_ctrl->step = ctrl->step;
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_querymenu(struct file *filp, void *fh, struct v4l2_querymenu *qmenu)
+{
+	struct v4l2_ctrl *ctrl;
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !qmenu)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	ctrl = v4l2_ctrl_find(&inst->ctrl_handler, qmenu->id);
+	if (!ctrl) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (ctrl->type != V4L2_CTRL_TYPE_MENU) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (qmenu->index < ctrl->minimum || qmenu->index > ctrl->maximum) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (ctrl->menu_skip_mask & (1 << qmenu->index)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_subscribe_event(struct v4l2_fh *fh, const struct v4l2_event_subscription *sub)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = container_of(fh, struct iris_inst, fh);
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (inst->domain == DECODER)
+		ret = vdec_subscribe_event(inst, sub);
+	else if (inst->domain == ENCODER)
+		ret = venc_subscribe_event(inst, sub);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_unsubscribe_event(struct v4l2_fh *fh, const struct v4l2_event_subscription *sub)
+{
+	struct iris_inst *inst;
+	int ret;
+
+	inst = container_of(fh, struct iris_inst, fh);
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	ret = v4l2_event_unsubscribe(&inst->fh, sub);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_g_selection(struct file *filp, void *fh, struct v4l2_selection *s)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !s)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (s->type != OUTPUT_MPLANE && s->type != V4L2_BUF_TYPE_VIDEO_CAPTURE &&
+	    inst->domain == DECODER) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (s->type != INPUT_MPLANE && s->type != V4L2_BUF_TYPE_VIDEO_OUTPUT &&
+	    inst->domain == ENCODER) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (inst->domain == DECODER) {
+		switch (s->target) {
+		case V4L2_SEL_TGT_CROP_BOUNDS:
+		case V4L2_SEL_TGT_CROP_DEFAULT:
+		case V4L2_SEL_TGT_CROP:
+		case V4L2_SEL_TGT_COMPOSE_BOUNDS:
+		case V4L2_SEL_TGT_COMPOSE_PADDED:
+		case V4L2_SEL_TGT_COMPOSE_DEFAULT:
+		case V4L2_SEL_TGT_COMPOSE:
+			s->r.left = inst->crop.left;
+			s->r.top = inst->crop.top;
+			s->r.width = inst->crop.width;
+			s->r.height = inst->crop.height;
+			break;
+		default:
+			ret = -EINVAL;
+			break;
+		}
+	} else if (inst->domain == ENCODER) {
+		switch (s->target) {
+		case V4L2_SEL_TGT_CROP_BOUNDS:
+		case V4L2_SEL_TGT_CROP_DEFAULT:
+		case V4L2_SEL_TGT_CROP:
+			s->r.left = inst->crop.left;
+			s->r.top = inst->crop.top;
+			s->r.width = inst->crop.width;
+			s->r.height = inst->crop.height;
+			break;
+		case V4L2_SEL_TGT_COMPOSE_BOUNDS:
+		case V4L2_SEL_TGT_COMPOSE_PADDED:
+		case V4L2_SEL_TGT_COMPOSE_DEFAULT:
+		case V4L2_SEL_TGT_COMPOSE:
+			s->r.left = inst->compose.left;
+			s->r.top = inst->compose.top;
+			s->r.width = inst->compose.width;
+			s->r.height = inst->compose.height;
+			break;
+		default:
+			ret = -EINVAL;
+			break;
+		}
+	}
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_s_selection(struct file *filp, void *fh, struct v4l2_selection *s)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !s)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+	if (inst->domain == DECODER) {
+		ret = -EINVAL;
+		goto unlock;
+	} else if (inst->domain == ENCODER) {
+		ret = venc_s_selection(inst, s);
+	}
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_s_parm(struct file *filp, void *fh, struct v4l2_streamparm *a)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !a)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE &&
+	    a->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (inst->domain == ENCODER)
+		ret = venc_s_param(inst, a);
+	else
+		ret = -EINVAL;
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_g_parm(struct file *filp, void *fh, struct v4l2_streamparm *a)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !a)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE &&
+	    a->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (inst->domain == ENCODER)
+		ret = venc_g_param(inst, a);
+	else
+		ret = -EINVAL;
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_try_dec_cmd(struct file *filp, void *fh,
+			    struct v4l2_decoder_cmd *dec)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !dec)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (dec->cmd != V4L2_DEC_CMD_STOP && dec->cmd != V4L2_DEC_CMD_START) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+	dec->flags = 0;
+	if (dec->cmd == V4L2_DEC_CMD_STOP) {
+		dec->stop.pts = 0;
+	} else if (dec->cmd == V4L2_DEC_CMD_START) {
+		dec->start.speed = 0;
+		dec->start.format = V4L2_DEC_START_FMT_NONE;
+	}
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_try_enc_cmd(struct file *filp, void *fh,
+			    struct v4l2_encoder_cmd *enc)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !enc)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (inst->domain != ENCODER) {
+		ret = -ENOTTY;
+		goto unlock;
+	}
+
+	if (enc->cmd != V4L2_ENC_CMD_STOP && enc->cmd != V4L2_ENC_CMD_START) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+	enc->flags = 0;
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_dec_cmd(struct file *filp, void *fh,
+			struct v4l2_decoder_cmd *dec)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !dec)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (dec->cmd != V4L2_DEC_CMD_START &&
+	    dec->cmd != V4L2_DEC_CMD_STOP) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (inst->state == IRIS_INST_OPEN)
+		goto unlock;
+
+	if (!allow_cmd(inst, dec->cmd)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	ret = iris_pm_get(inst->core);
+	if (ret)
+		goto unlock;
+
+	if (dec->cmd == V4L2_DEC_CMD_START)
+		ret = vdec_start_cmd(inst);
+	else if (dec->cmd == V4L2_DEC_CMD_STOP)
+		ret = vdec_stop_cmd(inst);
+
+	iris_pm_put(inst->core, true);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static int vidc_enc_cmd(struct file *filp, void *fh,
+			struct v4l2_encoder_cmd *enc)
+{
+	struct iris_inst *inst;
+	int ret = 0;
+
+	inst = get_vidc_inst(filp, fh);
+	if (!inst || !enc)
+		return -EINVAL;
+
+	mutex_lock(&inst->lock);
+	if (IS_SESSION_ERROR(inst)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	if (inst->domain != ENCODER) {
+		ret = -ENOTTY;
+		goto unlock;
+	}
+
+	if (enc->cmd != V4L2_ENC_CMD_START &&
+	    enc->cmd != V4L2_ENC_CMD_STOP) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	if (enc->cmd == V4L2_ENC_CMD_STOP && inst->state == IRIS_INST_OPEN) {
+		ret = 0;
+		goto unlock;
+	}
+
+	if (!allow_cmd(inst, enc->cmd)) {
+		ret = -EBUSY;
+		goto unlock;
+	}
+
+	ret = iris_pm_get(inst->core);
+	if (ret)
+		goto unlock;
+
+	if (enc->cmd == V4L2_ENC_CMD_START)
+		ret = venc_start_cmd(inst);
+	else if (enc->cmd == V4L2_ENC_CMD_STOP)
+		ret = venc_stop_cmd(inst);
+
+	iris_pm_put(inst->core, true);
+
+unlock:
+	mutex_unlock(&inst->lock);
+
+	return ret;
+}
+
+static struct v4l2_file_operations v4l2_file_ops = {
+	.owner                          = THIS_MODULE,
+	.open                           = vidc_open,
+	.release                        = vidc_close,
+	.unlocked_ioctl                 = video_ioctl2,
+	.poll                           = vidc_poll,
+};
+
+static const struct vb2_ops iris_vb2_ops = {
+	.queue_setup                    = iris_vb2_queue_setup,
+	.start_streaming                = iris_vb2_start_streaming,
+	.stop_streaming                 = iris_vb2_stop_streaming,
+	.buf_queue                      = iris_vb2_buf_queue,
+};
+
+static struct vb2_mem_ops iris_vb2_mem_ops = {
+	.alloc                          = iris_vb2_alloc,
+	.put                            = iris_vb2_put,
+	.mmap                           = iris_vb2_mmap,
+	.attach_dmabuf                  = iris_vb2_attach_dmabuf,
+	.detach_dmabuf                  = iris_vb2_detach_dmabuf,
+	.map_dmabuf                     = iris_vb2_map_dmabuf,
+	.unmap_dmabuf                   = iris_vb2_unmap_dmabuf,
+};
+
+static const struct v4l2_ioctl_ops v4l2_ioctl_ops_dec = {
+	.vidioc_enum_fmt_vid_cap        = vidc_enum_fmt,
+	.vidioc_enum_fmt_vid_out        = vidc_enum_fmt,
+	.vidioc_try_fmt_vid_cap_mplane  = vidc_try_fmt,
+	.vidioc_try_fmt_vid_out_mplane  = vidc_try_fmt,
+	.vidioc_s_fmt_vid_cap_mplane    = vidc_s_fmt,
+	.vidioc_s_fmt_vid_out_mplane    = vidc_s_fmt,
+	.vidioc_g_fmt_vid_cap_mplane    = vidc_g_fmt,
+	.vidioc_g_fmt_vid_out_mplane    = vidc_g_fmt,
+	.vidioc_enum_framesizes         = vidc_enum_framesizes,
+	.vidioc_reqbufs                 = vidc_reqbufs,
+	.vidioc_querybuf                = vidc_querybuf,
+	.vidioc_create_bufs             = vidc_create_bufs,
+	.vidioc_prepare_buf             = vidc_prepare_buf,
+	.vidioc_qbuf                    = vidc_qbuf,
+	.vidioc_dqbuf                   = vidc_dqbuf,
+	.vidioc_streamon                = vidc_streamon,
+	.vidioc_streamoff               = vidc_streamoff,
+	.vidioc_querycap                = vidc_querycap,
+	.vidioc_queryctrl               = vidc_queryctrl,
+	.vidioc_querymenu               = vidc_querymenu,
+	.vidioc_subscribe_event         = vidc_subscribe_event,
+	.vidioc_unsubscribe_event       = vidc_unsubscribe_event,
+	.vidioc_g_selection             = vidc_g_selection,
+	.vidioc_try_decoder_cmd         = vidc_try_dec_cmd,
+	.vidioc_decoder_cmd             = vidc_dec_cmd,
+};
+
+static const struct v4l2_ioctl_ops v4l2_ioctl_ops_enc = {
+	.vidioc_enum_fmt_vid_cap        = vidc_enum_fmt,
+	.vidioc_enum_fmt_vid_out        = vidc_enum_fmt,
+	.vidioc_try_fmt_vid_cap_mplane  = vidc_try_fmt,
+	.vidioc_try_fmt_vid_out_mplane  = vidc_try_fmt,
+	.vidioc_s_fmt_vid_cap_mplane    = vidc_s_fmt,
+	.vidioc_s_fmt_vid_out_mplane    = vidc_s_fmt,
+	.vidioc_g_fmt_vid_cap_mplane    = vidc_g_fmt,
+	.vidioc_g_fmt_vid_out_mplane    = vidc_g_fmt,
+	.vidioc_enum_framesizes         = vidc_enum_framesizes,
+	.vidioc_enum_frameintervals     = vidc_enum_frameintervals,
+	.vidioc_reqbufs                 = vidc_reqbufs,
+	.vidioc_querybuf                = vidc_querybuf,
+	.vidioc_create_bufs             = vidc_create_bufs,
+	.vidioc_prepare_buf             = vidc_prepare_buf,
+	.vidioc_qbuf                    = vidc_qbuf,
+	.vidioc_dqbuf                   = vidc_dqbuf,
+	.vidioc_streamon                = vidc_streamon,
+	.vidioc_streamoff               = vidc_streamoff,
+	.vidioc_querycap                = vidc_querycap,
+	.vidioc_queryctrl               = vidc_queryctrl,
+	.vidioc_querymenu               = vidc_querymenu,
+	.vidioc_subscribe_event         = vidc_subscribe_event,
+	.vidioc_unsubscribe_event       = vidc_unsubscribe_event,
+	.vidioc_g_selection             = vidc_g_selection,
+	.vidioc_s_selection             = vidc_s_selection,
+	.vidioc_s_parm                  = vidc_s_parm,
+	.vidioc_g_parm                  = vidc_g_parm,
+	.vidioc_try_encoder_cmd         = vidc_try_enc_cmd,
+	.vidioc_encoder_cmd             = vidc_enc_cmd,
+};
+
+int init_ops(struct iris_core *core)
+{
+	core->v4l2_file_ops = &v4l2_file_ops;
+	core->vb2_ops = &iris_vb2_ops;
+	core->vb2_mem_ops = &iris_vb2_mem_ops;
+	core->v4l2_ioctl_ops_dec = &v4l2_ioctl_ops_dec;
+	core->v4l2_ioctl_ops_enc = &v4l2_ioctl_ops_enc;
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/iris_vidc.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/iris_vidc.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _IRIS_VIDC_H_
+#define _IRIS_VIDC_H_
+
+#include "iris_core.h"
+
+int init_ops(struct iris_core *core);
+int vidc_open(struct file *filp);
+int vidc_close(struct file *filp);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/memory.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/memory.c
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "memory.h"
+#include "iris_common.h"
+#include "iris_instance.h"
+
+void *iris_get_buffer_from_pool(struct iris_inst *inst)
+{
+	struct iris_mem_pool_header *hdr = NULL;
+	struct iris_mem_pool *pool;
+
+	pool = inst->mem_pool;
+
+	if (!list_empty(&pool->free_hdr_list)) {
+		hdr = list_first_entry(&pool->free_hdr_list, struct iris_mem_pool_header, list);
+		list_move_tail(&hdr->list, &pool->busy_hdr_list);
+
+		memset((char *)hdr->buf, 0, pool->size);
+		/* Catch double-free request */
+		hdr->busy = true;
+
+		return hdr->buf;
+	}
+
+	hdr = kzalloc(pool->size + sizeof(*hdr), GFP_KERNEL);
+	if (!hdr)
+		return NULL;
+
+	INIT_LIST_HEAD(&hdr->list);
+	hdr->busy = true;
+	hdr->buf = (void *)(hdr + 1);
+	list_add_tail(&hdr->list, &pool->busy_hdr_list);
+
+	return hdr->buf;
+}
+
+void iris_return_buffer_to_pool(struct iris_inst *inst, void *vidc_buf)
+{
+	struct iris_mem_pool_header *hdr;
+	struct iris_mem_pool *pool;
+
+	if (!vidc_buf)
+		return;
+
+	hdr = (struct iris_mem_pool_header *)vidc_buf - 1;
+
+	if (hdr->buf != vidc_buf)
+		return;
+
+	pool = inst->mem_pool;
+
+	/* Catch double-free request */
+	if (!hdr->busy)
+		return;
+	hdr->busy = false;
+
+	list_move_tail(&hdr->list, &pool->free_hdr_list);
+}
+
+int iris_mem_pool_init(struct iris_inst *inst)
+{
+	inst->mem_pool = devm_kzalloc(inst->core->dev, sizeof(struct iris_mem_pool),
+				      GFP_KERNEL);
+
+	if (!inst->mem_pool)
+		return -ENOMEM;
+
+	inst->mem_pool->size = sizeof(struct iris_buffer);
+	INIT_LIST_HEAD(&inst->mem_pool->free_hdr_list);
+	INIT_LIST_HEAD(&inst->mem_pool->busy_hdr_list);
+
+	return 0;
+}
+
+void iris_mem_pool_deinit(struct iris_inst *inst)
+{
+	struct iris_mem_pool_header *hdr, *dummy;
+	struct iris_mem_pool *pool;
+
+	pool = inst->mem_pool;
+
+	list_for_each_entry_safe(hdr, dummy, &pool->free_hdr_list, list) {
+		list_del(&hdr->list);
+		kfree(hdr);
+	}
+
+	list_for_each_entry_safe(hdr, dummy, &pool->busy_hdr_list, list) {
+		list_del(&hdr->list);
+		kfree(hdr);
+	}
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/memory.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/memory.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MEMORY_H_
+#define _MEMORY_H_
+
+#include "iris_core.h"
+
+struct iris_inst;
+
+struct iris_mem_pool_header {
+	struct list_head	list;
+	bool			busy;
+	void			*buf;
+};
+
+struct iris_mem_pool {
+	u32			size;
+	struct list_head	free_hdr_list; /* list of struct iris_mem_pool_header */
+	struct list_head	busy_hdr_list; /* list of struct iris_mem_pool_header */
+};
+
+int iris_mem_pool_init(struct iris_inst *inst);
+void iris_mem_pool_deinit(struct iris_inst *inst);
+void *iris_get_buffer_from_pool(struct iris_inst *inst);
+void iris_return_buffer_to_pool(struct iris_inst *inst, void *vidc_buf);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/platform_common.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/platform_common.c
@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+
+#include "iris_core.h"
+#include "platform_common.h"
+
+int init_platform(struct iris_core *core)
+{
+	struct platform_data *platform = NULL;
+
+	platform = devm_kzalloc(core->dev, sizeof(*platform),
+				GFP_KERNEL);
+	if (!platform)
+		return -ENOMEM;
+
+	core->platform_data = platform;
+
+	core->platform_data = (struct platform_data *)of_device_get_match_data(core->dev);
+	if (!core->platform_data)
+		return -ENODEV;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/platform_common.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/platform_common.h
@@ -0,0 +1,324 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _PLATFORM_COMMON_H_
+#define _PLATFORM_COMMON_H_
+
+#include <linux/bits.h>
+#include <media/v4l2-ctrls.h>
+
+#include "iris_common.h"
+
+struct iris_core;
+struct iris_inst;
+
+#define HW_RESPONSE_TIMEOUT_VALUE     (1000)
+#define AUTOSUSPEND_DELAY_VALUE       (HW_RESPONSE_TIMEOUT_VALUE + 500)
+
+#define BIT_DEPTH_8 (8 << 16 | 8)
+#define BIT_DEPTH_10 (10 << 16 | 10)
+
+#define CODED_FRAMES_PROGRESSIVE			0x0
+#define CODED_FRAMES_INTERLACE				0x1
+#define MAX_NUM_CHILD					10
+#define MAX_ENH_LAYER_HB				3
+#define MAX_HEVC_VBR_ENH_LAYER_SLIDING_WINDOW		5
+#define MAX_HEVC_NON_VBR_ENH_LAYER_SLIDING_WINDOW	3
+#define MAX_AVC_ENH_LAYER_SLIDING_WINDOW		3
+#define MAX_AVC_ENH_LAYER_HYBRID_HP			5
+#define MAX_SLICES_FRAME_RATE				60
+#define MAX_MB_SLICE_WIDTH				4096
+#define MAX_MB_SLICE_HEIGHT				2160
+#define MAX_BYTES_SLICE_WIDTH				1920
+#define MAX_BYTES_SLICE_HEIGHT				1088
+#define MIN_HEVC_SLICE_WIDTH				384
+#define MIN_AVC_SLICE_WIDTH				192
+#define MIN_SLICE_HEIGHT				128
+#define MAX_SLICES_PER_FRAME				128
+#define MIN_QP_8BIT					1
+#define MIN_SLICE_BYTE_SIZE				512
+#define MAX_SLICE_BYTE_SIZE				((MAX_BITRATE) >> 3)
+#define MAX_SLICE_MB_SIZE				(((4096 + 15) >> 4) * ((2304 + 15) >> 4))
+#define INVALID_DEFAULT_MARK_OR_USE_LTR			-1
+#define MAX_SUPPORTED_MIN_QUALITY			70
+#define DEFAULT_MAX_HOST_BUF_COUNT			64
+#define DEFAULT_MAX_HOST_BURST_BUF_COUNT		256
+
+#define UBWC_CONFIG(mc, ml, hbb, bs1, bs2, bs3, bsp) \
+{	                                                 \
+	.max_channels = mc,                              \
+	.mal_length = ml,                                \
+	.highest_bank_bit = hbb,                         \
+	.bank_swzl_level = bs1,                          \
+	.bank_swz2_level = bs2,                          \
+	.bank_swz3_level = bs3,                          \
+	.bank_spreading = bsp,                           \
+}
+
+enum stage_type {
+	STAGE_NONE = 0,
+	STAGE_1 = 1,
+	STAGE_2 = 2,
+};
+
+enum pipe_type {
+	PIPE_NONE = 0,
+	PIPE_1 = 1,
+	PIPE_2 = 2,
+	PIPE_4 = 4,
+};
+
+enum quality_mode {
+	MAX_QUALITY_MODE = 0x1,
+	POWER_SAVE_MODE = 0x2,
+};
+
+extern struct platform_data qcm6490_data;
+extern struct platform_data sm8550_data;
+
+struct bw_info {
+	u32 mbs_per_sec;
+	u32 bw_ddr;
+	u32 bw_ddr_10bit;
+};
+
+struct reg_preset_info {
+	u32              reg;
+	u32              value;
+	u32              mask;
+};
+
+struct iris_core_power {
+	u64 clk_freq;
+	u64 bus_bw;
+};
+
+struct ubwc_config_data {
+	u32	max_channels;
+	u32	mal_length;
+	u32	highest_bank_bit;
+	u32	bank_swzl_level;
+	u32	bank_swz2_level;
+	u32	bank_swz3_level;
+	u32	bank_spreading;
+};
+
+struct bus_vote_data {
+	u32 color_formats[2];
+	int height, width;
+	u32 fps;
+	u64 bus_bw;
+};
+
+struct iris_inst_power {
+	u64 min_freq;
+	u32 bus_bw;
+};
+
+enum plat_core_cap_type {
+	CORE_CAP_NONE = 0,
+	DEC_CODECS,
+	ENC_CODECS,
+	MAX_SESSION_COUNT,
+	MAX_MBPF,
+	MAX_MBPS,
+	MAX_MBPF_HQ,
+	MAX_MBPS_HQ,
+	MAX_MBPF_B_FRAME,
+	MAX_MBPS_B_FRAME,
+	MAX_ENH_LAYER_COUNT,
+	NUM_VPP_PIPE,
+	FW_UNLOAD,
+	FW_UNLOAD_DELAY,
+	HW_RESPONSE_TIMEOUT,
+	NON_FATAL_FAULTS,
+	DMA_MASK,
+	CP_START,
+	CP_SIZE,
+	CP_NONPIXEL_START,
+	CP_NONPIXEL_SIZE,
+	CORE_CAP_MAX,
+};
+
+struct plat_core_cap {
+	enum plat_core_cap_type type;
+	u32 value;
+};
+
+enum plat_inst_cap_type {
+	INST_CAP_NONE = 0,
+	FRAME_WIDTH,
+	FRAME_HEIGHT,
+	PIX_FMTS,
+	MBPF,
+	QUEUED_RATE,
+	FRAME_RATE,
+	OPERATING_RATE,
+	MB_CYCLES_VSP,
+	MB_CYCLES_VPP,
+	MB_CYCLES_LP,
+	MB_CYCLES_FW,
+	MB_CYCLES_FW_VPP,
+	NUM_COMV,
+	ENTROPY_MODE,
+	BASELAYER_PRIORITY,
+	IR_TYPE,
+	PROFILE,
+	LEVEL,
+	HEVC_TIER,
+	DISPLAY_DELAY_ENABLE,
+	DISPLAY_DELAY,
+	OUTPUT_ORDER,
+	INPUT_BUF_HOST_MAX_COUNT,
+	STAGE,
+	PIPE,
+	QUALITY_MODE,
+	POC,
+	CODED_FRAMES,
+	BIT_DEPTH,
+	DEFAULT_HEADER,
+	RAP_FRAME,
+	MIN_FRAME_QP,
+	MAX_FRAME_QP,
+	B_FRAME,
+	I_FRAME_QP,
+	P_FRAME_QP,
+	B_FRAME_QP,
+	BIT_RATE,
+	PEAK_BITRATE,
+	BITRATE_MODE,
+	FRAME_SKIP_MODE,
+	FRAME_RC_ENABLE,
+	GOP_SIZE,
+	MIN_QUALITY,
+	TIME_DELTA_BASED_RC,
+	IR_PERIOD,
+	LTR_COUNT,
+	USE_LTR,
+	MARK_LTR,
+	I_FRAME_MIN_QP,
+	P_FRAME_MIN_QP,
+	B_FRAME_MIN_QP,
+	I_FRAME_MAX_QP,
+	P_FRAME_MAX_QP,
+	B_FRAME_MAX_QP,
+	LAYER_TYPE,
+	LAYER_ENABLE,
+	L0_BR,
+	L1_BR,
+	L2_BR,
+	L3_BR,
+	L4_BR,
+	L5_BR,
+	ENH_LAYER_COUNT,
+	TRANSFORM_8X8,
+	SLICE_MODE,
+	SLICE_MAX_MB,
+	SLICE_MAX_BYTES,
+	HFLIP,
+	VFLIP,
+	ROTATION,
+	HEADER_MODE,
+	PREPEND_SPSPPS_TO_IDR,
+	REQUEST_I_FRAME,
+	INST_CAP_MAX,
+};
+
+enum plat_inst_cap_flags {
+	CAP_FLAG_NONE			= 0,
+	CAP_FLAG_DYNAMIC_ALLOWED	= BIT(0),
+	CAP_FLAG_MENU			= BIT(1),
+	CAP_FLAG_INPUT_PORT		= BIT(2),
+	CAP_FLAG_OUTPUT_PORT		= BIT(3),
+	CAP_FLAG_CLIENT_SET		= BIT(4),
+	CAP_FLAG_BITMASK		= BIT(5),
+	CAP_FLAG_VOLATILE		= BIT(6),
+};
+
+struct plat_inst_cap {
+	enum plat_inst_cap_type cap_id;
+	enum domain_type domain;
+	enum codec_type codec;
+	s32 min;
+	s32 max;
+	u32 step_or_mask;
+	s32 value;
+	u32 v4l2_id;
+	u32 hfi_id;
+	enum plat_inst_cap_flags flags;
+	enum plat_inst_cap_type children[MAX_NUM_CHILD];
+	int (*adjust)(struct iris_inst *inst,
+		      struct v4l2_ctrl *ctrl);
+	int (*set)(struct iris_inst *inst,
+		   enum plat_inst_cap_type cap_id);
+};
+
+struct plat_inst_caps {
+	enum codec_type codec;
+	enum domain_type domain;
+	struct plat_inst_cap cap[INST_CAP_MAX + 1];
+};
+
+struct codec_info {
+	u32 v4l2_codec;
+	enum codec_type codec;
+};
+
+struct color_format_info {
+	u32 v4l2_color_format;
+	enum colorformat_type color_format;
+};
+
+struct format_capability {
+	struct codec_info *codec_info;
+	u32 codec_info_size;
+	struct color_format_info *color_format_info;
+	u32 color_format_info_size;
+};
+
+struct platform_data {
+	const struct bus_info *bus_tbl;
+	unsigned int bus_tbl_size;
+	const struct bw_info *bw_tbl_enc;
+	unsigned int bw_tbl_enc_size;
+	const struct bw_info *bw_tbl_dec;
+	unsigned int bw_tbl_dec_size;
+	const char * const *pd_tbl;
+	unsigned int pd_tbl_size;
+	const char * const *opp_pd_tbl;
+	unsigned int opp_pd_tbl_size;
+	const struct clock_info *clk_tbl;
+	unsigned int clk_tbl_size;
+	const char * const *clk_rst_tbl;
+	unsigned int clk_rst_tbl_size;
+	const struct reg_preset_info *reg_prst_tbl;
+	unsigned int reg_prst_tbl_size;
+	struct ubwc_config_data *ubwc_config;
+	struct format_capability *format_data;
+	const char *fwname;
+	u32 pas_id;
+	struct plat_core_cap *core_data;
+	u32 core_data_size;
+	struct plat_inst_cap *inst_cap_data;
+	u32 inst_cap_data_size;
+	const u32 *avc_subscribe_param;
+	unsigned int avc_subscribe_param_size;
+	const u32 *hevc_subscribe_param;
+	unsigned int hevc_subscribe_param_size;
+	const u32 *vp9_subscribe_param;
+	unsigned int vp9_subscribe_param_size;
+	const u32 *dec_input_prop;
+	unsigned int dec_input_prop_size;
+	const u32 *dec_output_prop_avc;
+	unsigned int dec_output_prop_size_avc;
+	const u32 *dec_output_prop_hevc;
+	unsigned int dec_output_prop_size_hevc;
+	const u32 *dec_output_prop_vp9;
+	unsigned int dec_output_prop_size_vp9;
+};
+
+int init_platform(struct iris_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/platform_qcm6490.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/platform_qcm6490.c
@@ -0,0 +1,1165 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/clock/qcom,gcc-sc7280.h>
+#include <dt-bindings/clock/qcom,videocc-sc7280.h>
+
+#include <media/v4l2-ctrls.h>
+
+#include "hfi_defines.h"
+#include "iris_ctrls.h"
+#include "platform_common.h"
+#include "resources.h"
+
+#define CODECS_ALL	(H264 | HEVC | VP9)
+#define ENC		ENCODER
+#define DEC		DECODER
+
+#define DEFAULT_FPS                 30
+#define MINIMUM_FPS                 1
+#define MAXIMUM_ENCODE_FPS          240
+#define MAX_BITRATE                 100000000
+#define DEFAULT_BITRATE             20000000
+#define MAX_LTR_FRAME_COUNT         2
+#define MAX_BASE_LAYER_PRIORITY_ID  63
+#define MAX_QP                      51
+#define DEFAULT_QP                  20
+
+static struct codec_info codec_data_qcm6490[] = {
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_H264,
+		.codec  = H264,
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_HEVC,
+		.codec  = HEVC,
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_VP9,
+		.codec  = VP9,
+	},
+};
+
+static struct color_format_info color_format_data_qcm6490[] = {
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_NV12,
+		.color_format = FMT_NV12,
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_QC08C,
+		.color_format = FMT_NV12C,
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_QC10C,
+		.color_format = FMT_TP10C,
+	},
+};
+
+static struct plat_core_cap core_data_qcm6490[] = {
+	{DEC_CODECS, H264 | HEVC | VP9},
+	{ENC_CODECS, H264 | HEVC},
+	{MAX_SESSION_COUNT, 16},
+	{MAX_MBPF, 77522}, /* ((4096x2176)/256) x 2 + (1920x1088)/256 */
+	{MAX_MBPS, 2088960}, /* max_load 4096x2176@60fps */
+	{NUM_VPP_PIPE, 1},
+	{HW_RESPONSE_TIMEOUT, HW_RESPONSE_TIMEOUT_VALUE},
+	{DMA_MASK, 0xe0000000 - 1},
+	{CP_START, 0},
+	{CP_SIZE, 0x25800000},
+	{CP_NONPIXEL_START, 0x01000000},
+	{CP_NONPIXEL_SIZE, 0x24800000},
+	{MAX_MBPF_HQ, 8160}, /* ((1920x1088)/256) */
+	{MAX_MBPS_HQ, 244800}, /* ((1920x1088)/256)@30fps */
+};
+
+static struct plat_inst_cap instance_cap_data_qcm6490[] = {
+	{FRAME_WIDTH, DEC, CODECS_ALL, 96, 4096, 1, 1920},
+
+	{FRAME_WIDTH, ENC, CODECS_ALL, 128, 4096, 1, 1920},
+
+	{FRAME_HEIGHT, DEC, CODECS_ALL, 96, 4096, 1, 1080},
+
+	{FRAME_HEIGHT, ENC, CODECS_ALL, 128, 4096, 1, 1080},
+
+	{PIX_FMTS, DEC, H264,
+		FMT_NV12,
+		FMT_NV12C,
+		FMT_NV12 | FMT_NV12C,
+		FMT_NV12C},
+
+	{PIX_FMTS, ENC, H264,
+		FMT_NV12,
+		FMT_NV12C,
+		FMT_NV12 | FMT_NV12C,
+		FMT_NV12C,
+		0, 0,
+		CAP_FLAG_NONE},
+
+	{PIX_FMTS, DEC, HEVC,
+		FMT_NV12,
+		FMT_TP10C,
+		FMT_NV12 | FMT_NV12C | FMT_TP10C,
+		FMT_NV12C,
+		0, 0,
+		CAP_FLAG_NONE,
+		{PROFILE}},
+
+	{PIX_FMTS, ENC, HEVC,
+		FMT_NV12,
+		FMT_TP10C,
+		FMT_NV12 | FMT_NV12C | FMT_TP10C,
+		FMT_NV12C,
+		0, 0,
+		CAP_FLAG_NONE,
+		{PROFILE, MIN_QUALITY, IR_PERIOD, LTR_COUNT}},
+
+	{PIX_FMTS, DEC, VP9,
+		FMT_NV12,
+		FMT_TP10C,
+		FMT_NV12 | FMT_NV12C | FMT_TP10C,
+		FMT_NV12C},
+
+	/* (4096 * 2176) / 256 */
+	{MBPF, DEC, CODECS_ALL, 36, 34816, 1, 34816},
+
+	/* (4096 * 2176) / 256 */
+	{MBPF, ENC, CODECS_ALL, 64, 34816, 1, 34816},
+
+	{QUEUED_RATE, DEC, CODECS_ALL,
+		(MINIMUM_FPS << 16), INT_MAX,
+		1, (DEFAULT_FPS << 16)},
+
+	{FRAME_RATE, ENC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_ENCODE_FPS << 16),
+		1, (DEFAULT_FPS << 16),
+		0,
+		HFI_PROP_FRAME_RATE,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_q16},
+
+	{OPERATING_RATE, ENC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_ENCODE_FPS << 16),
+		1, (DEFAULT_FPS << 16)},
+
+	{MB_CYCLES_VSP, DEC, CODECS_ALL, 25, 25, 1, 25},
+
+	{MB_CYCLES_VSP, DEC, VP9, 60, 60, 1, 60},
+
+	{MB_CYCLES_VSP, ENC, CODECS_ALL, 25, 25, 1, 25},
+
+	{MB_CYCLES_VPP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+	{MB_CYCLES_VPP, ENC, CODECS_ALL, 675, 675, 1, 675},
+
+	{MB_CYCLES_LP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+	{MB_CYCLES_LP, ENC, CODECS_ALL, 320, 320, 1, 320},
+
+	{MB_CYCLES_FW, ENC | DEC, CODECS_ALL, 436000, 436000, 1, 436000},
+
+	{MB_CYCLES_FW_VPP, ENC | DEC, CODECS_ALL, 166667, 166667, 1, 166667},
+
+	{NUM_COMV, DEC, CODECS_ALL,
+		0, INT_MAX, 1, 0},
+
+	{PROFILE, DEC, H264,
+		V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+		V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH,
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH),
+		V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{PROFILE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+		V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH,
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH),
+		V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{ENTROPY_MODE, TRANSFORM_8X8},
+		NULL,
+		set_u32_enum},
+
+	{PROFILE, ENC | DEC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10,
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_STILL_PICTURE) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10),
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+		V4L2_CID_MPEG_VIDEO_HEVC_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		adjust_profile,
+		set_u32_enum},
+
+	{PROFILE, DEC, VP9,
+		V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+		V4L2_MPEG_VIDEO_VP9_PROFILE_2,
+		BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_2),
+		V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+		V4L2_CID_MPEG_VIDEO_VP9_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{LEVEL, DEC, H264,
+		V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_H264_LEVEL_5_2,
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_2),
+		V4L2_MPEG_VIDEO_H264_LEVEL_5_2,
+		V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{LEVEL, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_H264_LEVEL_5_1,
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1),
+		V4L2_MPEG_VIDEO_H264_LEVEL_5_1,
+		V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_level},
+
+	{LEVEL, DEC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1),
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1,
+		V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{LEVEL, ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_5,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5),
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_5,
+		V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_level},
+
+	{LEVEL, DEC, VP9,
+		V4L2_MPEG_VIDEO_VP9_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_VP9_LEVEL_5_1,
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_1),
+		V4L2_MPEG_VIDEO_VP9_LEVEL_5_1,
+		V4L2_CID_MPEG_VIDEO_VP9_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{HEVC_TIER, DEC | ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+		V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+		BIT(V4L2_MPEG_VIDEO_HEVC_TIER_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_TIER_HIGH),
+		V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+		V4L2_CID_MPEG_VIDEO_HEVC_TIER,
+		HFI_PROP_TIER,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{HFLIP, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_HFLIP,
+		HFI_PROP_FLIP,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_flip},
+
+	{VFLIP, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_VFLIP,
+		HFI_PROP_FLIP,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_flip},
+
+	{ROTATION, ENC, CODECS_ALL,
+		0, 270, 90, 0,
+		V4L2_CID_ROTATE,
+		HFI_PROP_ROTATION,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_rotation},
+
+	{HEADER_MODE, ENC, CODECS_ALL,
+		V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE,
+		V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+		BIT(V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE) |
+		BIT(V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME),
+		V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+		V4L2_CID_MPEG_VIDEO_HEADER_MODE,
+		HFI_PROP_SEQ_HEADER_MODE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_header_mode},
+
+	{PREPEND_SPSPPS_TO_IDR, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_PREPEND_SPSPPS_TO_IDR},
+
+	{REQUEST_I_FRAME, ENC, H264 | HEVC,
+		0, 0, 0, 0,
+		V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
+		HFI_PROP_REQUEST_SYNC_FRAME,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_req_sync_frame},
+
+	{BIT_RATE, ENC, H264 | HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_BITRATE,
+		HFI_PROP_TOTAL_BITRATE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{PEAK_BITRATE, L0_BR},
+		adjust_bitrate,
+		set_bitrate},
+
+	{PEAK_BITRATE, ENC, H264 | HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_BITRATE_PEAK,
+		HFI_PROP_TOTAL_PEAK_BITRATE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_peak_bitrate,
+		set_peak_bitrate},
+
+	{BITRATE_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_MBR,
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_MBR),
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+		HFI_PROP_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{LTR_COUNT, IR_PERIOD, I_FRAME_QP, P_FRAME_QP,
+		 B_FRAME_QP, ENH_LAYER_COUNT, BIT_RATE,
+		 MIN_QUALITY, PEAK_BITRATE, SLICE_MODE},
+		adjust_bitrate_mode,
+		set_bitrate_mode},
+
+	{FRAME_SKIP_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT,
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED) |
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_LEVEL_LIMIT) |
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT),
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+		V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{FRAME_RC_ENABLE, ENC, H264 | HEVC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_FRAME_RC_ENABLE},
+
+	{GOP_SIZE, ENC, CODECS_ALL,
+		0, INT_MAX, 1, 2 * DEFAULT_FPS - 1,
+		V4L2_CID_MPEG_VIDEO_GOP_SIZE,
+		HFI_PROP_MAX_GOP_FRAMES,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_gop_size,
+		set_gop_size},
+
+	{B_FRAME, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_B_FRAMES,
+		HFI_PROP_MAX_B_FRAMES,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		adjust_b_frame,
+		set_u32},
+
+	{LTR_COUNT, ENC, H264 | HEVC,
+		0, MAX_LTR_FRAME_COUNT, 1, 0,
+		V4L2_CID_MPEG_VIDEO_LTR_COUNT,
+		HFI_PROP_LTR_COUNT,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		adjust_ltr_count,
+		set_u32},
+
+	{USE_LTR, ENC, H264 | HEVC,
+		0,
+		((1 << MAX_LTR_FRAME_COUNT) - 1),
+		0, 0,
+		V4L2_CID_MPEG_VIDEO_USE_LTR_FRAMES,
+		HFI_PROP_LTR_USE,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_use_ltr,
+		set_use_and_mark_ltr},
+
+	{MARK_LTR, ENC, H264 | HEVC,
+		INVALID_DEFAULT_MARK_OR_USE_LTR,
+		(MAX_LTR_FRAME_COUNT - 1),
+		1, INVALID_DEFAULT_MARK_OR_USE_LTR,
+		V4L2_CID_MPEG_VIDEO_FRAME_LTR_INDEX,
+		HFI_PROP_LTR_MARK,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_mark_ltr,
+		set_use_and_mark_ltr},
+
+	{BASELAYER_PRIORITY, ENC, H264,
+		0, MAX_BASE_LAYER_PRIORITY_ID, 1, 0,
+		V4L2_CID_MPEG_VIDEO_BASELAYER_PRIORITY_ID,
+		HFI_PROP_BASELAYER_PRIORITYID,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{IR_TYPE, ENC, H264 | HEVC,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC,
+		BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM) |
+		BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC),
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{IR_PERIOD, ENC, H264 | HEVC,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD,
+		0,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_ir_period,
+		set_ir_period},
+
+	{MIN_QUALITY, ENC, H264 | HEVC,
+		0, MAX_SUPPORTED_MIN_QUALITY, 70, MAX_SUPPORTED_MIN_QUALITY,
+		0,
+		HFI_PROP_MAINTAIN_MIN_QUALITY,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		adjust_min_quality,
+		set_u32},
+
+	{TIME_DELTA_BASED_RC, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_u32},
+
+	{MIN_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_MIN_QP,
+		HFI_PROP_MIN_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_min_qp},
+
+	{MIN_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_MIN_QP,
+		HFI_PROP_MIN_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_min_qp},
+
+	{MAX_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
+		HFI_PROP_MAX_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_max_qp},
+
+	{MAX_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_MAX_QP,
+		HFI_PROP_MAX_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_max_qp},
+
+	{I_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MIN_QP},
+
+	{I_FRAME_MIN_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MIN_QP},
+
+	{P_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MIN_QP},
+
+	{P_FRAME_MIN_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MIN_QP},
+
+	{B_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MIN_QP},
+
+	{B_FRAME_MIN_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MIN_QP},
+
+	{I_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MAX_QP},
+
+	{I_FRAME_MAX_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MAX_QP},
+
+	{P_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MAX_QP},
+
+	{P_FRAME_MAX_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MAX_QP},
+
+	{B_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MAX_QP},
+
+	{B_FRAME_MAX_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MAX_QP},
+
+	{I_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{I_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{P_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{P_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{B_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{B_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{LAYER_TYPE, ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B,
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+		BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P),
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_TYPE,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{LTR_COUNT}},
+
+	{LAYER_TYPE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B,
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+		BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B) |
+		BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P),
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_TYPE,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{LTR_COUNT}},
+
+	{LAYER_ENABLE, ENC, H264,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{LAYER_ENABLE, ENC, HEVC,
+		0, 1, 1, 0,
+		0,
+		0,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{ENH_LAYER_COUNT, ENC, HEVC,
+		0, 5, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_LAYER,
+		HFI_PROP_LAYER_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{GOP_SIZE, B_FRAME, BIT_RATE, MIN_QUALITY, SLICE_MODE,
+		 LTR_COUNT},
+		adjust_layer_count,
+		set_layer_count_and_type},
+
+	{ENH_LAYER_COUNT, ENC, H264,
+		0, 5, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_LAYER,
+		HFI_PROP_LAYER_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{GOP_SIZE, B_FRAME, BIT_RATE, MIN_QUALITY, SLICE_MODE,
+		 LTR_COUNT},
+		adjust_layer_count,
+		set_layer_count_and_type},
+
+	{L0_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L0_BR,
+		HFI_PROP_BITRATE_LAYER1,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L1_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L0_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L0_BR,
+		HFI_PROP_BITRATE_LAYER1,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L1_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L1_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L1_BR,
+		HFI_PROP_BITRATE_LAYER2,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L2_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L1_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L1_BR,
+		HFI_PROP_BITRATE_LAYER2,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L2_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L2_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L2_BR,
+		HFI_PROP_BITRATE_LAYER3,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L3_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L2_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L2_BR,
+		HFI_PROP_BITRATE_LAYER3,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L3_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L3_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L3_BR,
+		HFI_PROP_BITRATE_LAYER4,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L4_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L3_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L3_BR,
+		HFI_PROP_BITRATE_LAYER4,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L4_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L4_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L4_BR,
+		HFI_PROP_BITRATE_LAYER5,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L5_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L4_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L4_BR,
+		HFI_PROP_BITRATE_LAYER5,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L5_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L5_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L5_BR,
+		HFI_PROP_BITRATE_LAYER6,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L5_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L5_BR,
+		HFI_PROP_BITRATE_LAYER6,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{ENTROPY_MODE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) |
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC),
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		V4L2_CID_MPEG_VIDEO_H264_ENTROPY_MODE,
+		HFI_PROP_CABAC_SESSION,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{BIT_RATE},
+		adjust_entropy_mode,
+		set_u32},
+
+	{SLICE_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES,
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE) |
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) |
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES),
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{STAGE},
+		adjust_slice_count,
+		set_slice_count},
+
+	{SLICE_MAX_BYTES, ENC, H264 | HEVC,
+		MIN_SLICE_BYTE_SIZE, MAX_SLICE_BYTE_SIZE,
+		1, MIN_SLICE_BYTE_SIZE,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_BYTES,
+		HFI_PROP_MULTI_SLICE_BYTES_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{SLICE_MAX_MB, ENC, H264 | HEVC,
+		1, MAX_SLICE_MB_SIZE, 1, 1,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_MB,
+		HFI_PROP_MULTI_SLICE_MB_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{TRANSFORM_8X8, ENC, H264,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM,
+		HFI_PROP_8X8_TRANSFORM,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		adjust_transform_8x8,
+		set_u32},
+
+	{DISPLAY_DELAY_ENABLE, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT,
+		{OUTPUT_ORDER},
+		NULL,
+		NULL},
+
+	{DISPLAY_DELAY, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT,
+		{OUTPUT_ORDER},
+		NULL,
+		NULL},
+
+	{OUTPUT_ORDER, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT,
+		{0},
+		adjust_output_order,
+		set_u32},
+
+	{INPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		DEFAULT_MAX_HOST_BUF_COUNT, DEFAULT_MAX_HOST_BURST_BUF_COUNT,
+		1, DEFAULT_MAX_HOST_BUF_COUNT,
+		0,
+		HFI_PROP_BUFFER_HOST_MAX_COUNT,
+		CAP_FLAG_INPUT_PORT,
+		{0},
+		NULL,
+		set_u32},
+
+	{STAGE, ENC | DEC, CODECS_ALL,
+		STAGE_1,
+		STAGE_2, 1,
+		STAGE_2,
+		0,
+		HFI_PROP_STAGE,
+		CAP_FLAG_NONE,
+		{0},
+		NULL,
+		set_stage},
+
+	{PIPE, ENC | DEC, CODECS_ALL,
+		PIPE_1,
+		PIPE_1, 1,
+		PIPE_1,
+		0,
+		HFI_PROP_PIPE,
+		CAP_FLAG_NONE,
+		{0},
+		NULL,
+		set_pipe},
+
+	{QUALITY_MODE, ENC, CODECS_ALL,
+		MAX_QUALITY_MODE,
+		POWER_SAVE_MODE, 1,
+		POWER_SAVE_MODE},
+
+	{POC, DEC, H264, 0, 2, 1, 1,
+		0,
+		HFI_PROP_PIC_ORDER_CNT_TYPE},
+
+	{CODED_FRAMES, DEC, H264 | HEVC,
+		CODED_FRAMES_PROGRESSIVE, CODED_FRAMES_PROGRESSIVE,
+		0, CODED_FRAMES_PROGRESSIVE,
+		0,
+		HFI_PROP_CODED_FRAMES},
+
+	{BIT_DEPTH, DEC, CODECS_ALL, BIT_DEPTH_8, BIT_DEPTH_10, 1, BIT_DEPTH_8,
+		0,
+		HFI_PROP_LUMA_CHROMA_BIT_DEPTH},
+
+	{DEFAULT_HEADER, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_DEC_DEFAULT_HEADER},
+
+	{RAP_FRAME, DEC, CODECS_ALL,
+		0, 1, 1, 1,
+		0,
+		HFI_PROP_DEC_START_FROM_RAP_FRAME,
+		CAP_FLAG_INPUT_PORT,
+		{0},
+		NULL,
+		set_u32},
+};
+
+static const struct bus_info qcm6490_bus_table[] = {
+		{ NULL, "iris-cnoc", 1000, 1000    },
+		{ NULL, "iris-ddr",  1000, 8000000 },
+};
+
+static const struct clock_info qcm6490_clk_table[] = {
+		{ NULL, "core",              VIDEO_CC_MVSC_CORE_CLK,     1 },
+		{ NULL, "bus",               VIDEO_CC_MVSC_CTL_AXI_CLK,  0 },
+		{ NULL, "iface",             VIDEO_CC_VENUS_AHB_CLK,     0 },
+		{ NULL, "vcodec_bus",        VIDEO_CC_MVS0_AXI_CLK,      0 },
+		{ NULL, "vcodec_core",       VIDEO_CC_MVS0_CORE_CLK,     1 },
+};
+
+static const char * const qcm6490_pd_table[] = { "venus", "vcodec0", NULL };
+
+static const char * const qcm6490_opp_pd_table[] = {"cx", NULL };
+
+static const struct bw_info qcm6490_bw_table_enc[] = {
+	{  972000,  808000, 1350000 },	/* 3840x2160@30 */
+	{  489600,  547000,  732000 },	/* 1920x1080@60 */
+	{  244800,  283000,  375000 },	/* 1920x1080@30 */
+};
+
+static const struct bw_info qcm6490_bw_table_dec[] = {
+	{ 2073600, 2266000, 4317000 },	/* 4096x2160@60 */
+	{ 1036800, 1156000, 2181000 },	/* 4096x2160@30 */
+	{  489600,  731000,  998000 },	/* 1920x1080@60 */
+	{  244800,  376000,  534000 },	/* 1920x1080@30 */
+};
+
+static const struct reg_preset_info qcm6490_reg_preset_table[] = {
+	{ 0xB0088, 0x0, 0x11 },
+};
+
+static struct ubwc_config_data ubwc_config_qcm6490[] = {
+	UBWC_CONFIG(8, 32, 15, 0, 1, 1, 1),
+};
+
+static struct format_capability format_data_qcm6490 = {
+	.codec_info = codec_data_qcm6490,
+	.codec_info_size = ARRAY_SIZE(codec_data_qcm6490),
+	.color_format_info = color_format_data_qcm6490,
+	.color_format_info_size = ARRAY_SIZE(color_format_data_qcm6490),
+};
+
+static const u32 qcm6490_vdec_src_change_param_avc[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_CODED_FRAMES,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PIC_ORDER_CNT_TYPE,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+};
+
+static const u32 qcm6490_vdec_src_change_param_hevc[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_TIER,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+};
+
+static const u32 qcm6490_vdec_src_change_param_vp9[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+};
+
+static const u32 qcm6490_vdec_input_properties[] = {
+	HFI_PROP_NO_OUTPUT,
+};
+
+static const u32 qcm6490_vdec_output_properties_avc[] = {
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+	HFI_PROP_CABAC_SESSION,
+};
+
+static const u32 qcm6490_vdec_output_properties_hevc[] = {
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+};
+
+static const u32 qcm6490_vdec_output_properties_vp9[] = {
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+};
+
+struct platform_data qcm6490_data = {
+	.bus_tbl = qcm6490_bus_table,
+	.bus_tbl_size = ARRAY_SIZE(qcm6490_bus_table),
+	.clk_tbl = qcm6490_clk_table,
+	.clk_tbl_size = ARRAY_SIZE(qcm6490_clk_table),
+	.clk_rst_tbl = NULL,
+	.clk_rst_tbl_size = 0,
+
+	.bw_tbl_enc = qcm6490_bw_table_enc,
+	.bw_tbl_enc_size = ARRAY_SIZE(qcm6490_bw_table_enc),
+	.bw_tbl_dec = qcm6490_bw_table_dec,
+	.bw_tbl_dec_size = ARRAY_SIZE(qcm6490_bw_table_dec),
+
+	.pd_tbl = qcm6490_pd_table,
+	.pd_tbl_size = ARRAY_SIZE(qcm6490_pd_table),
+	.opp_pd_tbl = qcm6490_opp_pd_table,
+	.opp_pd_tbl_size = ARRAY_SIZE(qcm6490_opp_pd_table),
+
+	.reg_prst_tbl = qcm6490_reg_preset_table,
+	.reg_prst_tbl_size = ARRAY_SIZE(qcm6490_reg_preset_table),
+	.fwname = "qcom/vpu-2.0/vpu20_1v",
+	.pas_id = 9,
+
+	.core_data = core_data_qcm6490,
+	.core_data_size = ARRAY_SIZE(core_data_qcm6490),
+	.inst_cap_data = instance_cap_data_qcm6490,
+	.inst_cap_data_size = ARRAY_SIZE(instance_cap_data_qcm6490),
+	.ubwc_config = ubwc_config_qcm6490,
+	.format_data = &format_data_qcm6490,
+
+	.avc_subscribe_param =
+		qcm6490_vdec_src_change_param_avc,
+	.avc_subscribe_param_size =
+		ARRAY_SIZE(qcm6490_vdec_src_change_param_avc),
+	.hevc_subscribe_param =
+		qcm6490_vdec_src_change_param_hevc,
+	.hevc_subscribe_param_size =
+		ARRAY_SIZE(qcm6490_vdec_src_change_param_hevc),
+	.vp9_subscribe_param =
+		qcm6490_vdec_src_change_param_vp9,
+	.vp9_subscribe_param_size =
+		ARRAY_SIZE(qcm6490_vdec_src_change_param_vp9),
+	.dec_input_prop = qcm6490_vdec_input_properties,
+	.dec_input_prop_size = ARRAY_SIZE(qcm6490_vdec_input_properties),
+	.dec_output_prop_avc = qcm6490_vdec_output_properties_avc,
+	.dec_output_prop_size_avc = ARRAY_SIZE(qcm6490_vdec_output_properties_avc),
+	.dec_output_prop_hevc = qcm6490_vdec_output_properties_hevc,
+	.dec_output_prop_size_hevc = ARRAY_SIZE(qcm6490_vdec_output_properties_hevc),
+	.dec_output_prop_vp9 = qcm6490_vdec_output_properties_vp9,
+	.dec_output_prop_size_vp9 = ARRAY_SIZE(qcm6490_vdec_output_properties_vp9),
+};
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/platform_sm8550.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/platform_sm8550.c
@@ -0,0 +1,1195 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/clock/qcom,sm8550-gcc.h>
+#include <dt-bindings/clock/qcom,sm8450-videocc.h>
+
+#include <media/v4l2-ctrls.h>
+
+#include "hfi_defines.h"
+#include "iris_ctrls.h"
+#include "platform_common.h"
+#include "resources.h"
+
+#define CODECS_ALL	(H264 | HEVC | VP9)
+#define ENC		ENCODER
+#define DEC		DECODER
+
+#define DEFAULT_FPS			30
+#define MINIMUM_FPS			1
+#define MAXIMUM_FPS			480
+#define MAX_BITRATE			245000000
+#define DEFAULT_BITRATE			20000000
+#define MAX_LTR_FRAME_COUNT		2
+#define MAX_BASE_LAYER_PRIORITY_ID	63
+#define MAX_QP				51
+#define DEFAULT_QP			20
+
+static struct codec_info codec_data_sm8550[] = {
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_H264,
+		.codec  = H264,
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_HEVC,
+		.codec  = HEVC,
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_VP9,
+		.codec  = VP9,
+	},
+};
+
+static struct color_format_info color_format_data_sm8550[] = {
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_NV12,
+		.color_format = FMT_NV12,
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_QC08C,
+		.color_format = FMT_NV12C,
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_QC10C,
+		.color_format = FMT_TP10C,
+	},
+};
+
+static struct plat_core_cap core_data_sm8550[] = {
+	{DEC_CODECS, H264 | HEVC | VP9},
+	{ENC_CODECS, H264 | HEVC},
+	{MAX_SESSION_COUNT, 16},
+	{MAX_MBPF, 278528}, /* ((8192x4352)/256) * 2 */
+	{MAX_MBPS, 7833600}, /* max_load 7680x4320@60fps */
+	{NUM_VPP_PIPE, 4},
+	{HW_RESPONSE_TIMEOUT, HW_RESPONSE_TIMEOUT_VALUE},
+	{DMA_MASK, GENMASK(31, 29) - 1},
+	{CP_START, 0},
+	{CP_SIZE, 0x25800000},
+	{CP_NONPIXEL_START, 0x01000000},
+	{CP_NONPIXEL_SIZE, 0x24800000},
+	{MAX_MBPF_HQ, 8160}, /* ((1920x1088)/256) */
+	{MAX_MBPS_HQ, 489600}, /* ((1920x1088)/256)@60fps */
+};
+
+static struct plat_inst_cap instance_cap_data_sm8550[] = {
+	{FRAME_WIDTH, DEC, CODECS_ALL, 96, 8192, 1, 1920},
+
+	{FRAME_WIDTH, DEC, VP9, 96, 4096, 1, 1920},
+
+	{FRAME_WIDTH, ENC, CODECS_ALL, 128, 8192, 1, 1920},
+
+	{FRAME_WIDTH, ENC, HEVC, 96, 8192, 1, 1920},
+
+	{FRAME_HEIGHT, DEC, CODECS_ALL, 96, 8192, 1, 1080},
+
+	{FRAME_HEIGHT, DEC, VP9, 96, 4096, 1, 1080},
+
+	{FRAME_HEIGHT, ENC, CODECS_ALL, 128, 8192, 1, 1080},
+
+	{FRAME_HEIGHT, ENC, HEVC, 96, 8192, 1, 1080},
+
+	{PIX_FMTS, DEC, H264,
+		FMT_NV12,
+		FMT_NV12C,
+		FMT_NV12 | FMT_NV12C,
+		FMT_NV12C},
+
+	{PIX_FMTS, ENC, H264,
+		FMT_NV12,
+		FMT_NV12C,
+		FMT_NV12 | FMT_NV12C,
+		FMT_NV12C,
+		0, 0,
+		CAP_FLAG_NONE},
+
+	{PIX_FMTS, DEC, HEVC,
+		FMT_NV12,
+		FMT_TP10C,
+		FMT_NV12 | FMT_NV12C | FMT_TP10C,
+		FMT_NV12C,
+		0, 0,
+		CAP_FLAG_NONE,
+		{PROFILE}},
+
+	{PIX_FMTS, ENC, HEVC,
+		FMT_NV12,
+		FMT_TP10C,
+		FMT_NV12 | FMT_NV12C | FMT_TP10C,
+		FMT_NV12C,
+		0, 0,
+		CAP_FLAG_NONE,
+		{PROFILE, MIN_QUALITY, IR_PERIOD, LTR_COUNT}},
+
+	{PIX_FMTS, DEC, VP9,
+		FMT_NV12,
+		FMT_TP10C,
+		FMT_NV12 | FMT_NV12C | FMT_TP10C,
+		FMT_NV12C},
+
+	{MBPF, DEC, CODECS_ALL, 36, 138240, 1, 138240},
+
+	/* (4096 * 2304) / 256 */
+	{MBPF, DEC, VP9, 36, 36864, 1, 36864},
+
+	/* (8192 * 4320) / 256 */
+	{MBPF, ENC, CODECS_ALL, 64, 138240, 1, 138240},
+
+	{MBPF, ENC, HEVC, 36, 138240, 1, 138240},
+
+	{QUEUED_RATE, DEC | ENC, CODECS_ALL,
+		(MINIMUM_FPS << 16), INT_MAX,
+		1, (DEFAULT_FPS << 16)},
+
+	{FRAME_RATE, ENC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_FPS << 16),
+		1, (DEFAULT_FPS << 16),
+		0,
+		HFI_PROP_FRAME_RATE,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_q16},
+
+	{OPERATING_RATE, ENC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_FPS << 16),
+		1, (DEFAULT_FPS << 16)},
+
+	{MB_CYCLES_VSP, DEC, CODECS_ALL, 25, 25, 1, 25},
+
+	{MB_CYCLES_VSP, DEC, VP9, 60, 60, 1, 60},
+
+	{MB_CYCLES_VSP, ENC, CODECS_ALL, 25, 25, 1, 25},
+
+	{MB_CYCLES_VPP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+	{MB_CYCLES_VPP, ENC, CODECS_ALL, 675, 675, 1, 675},
+
+	{MB_CYCLES_LP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+	{MB_CYCLES_LP, ENC, CODECS_ALL, 320, 320, 1, 320},
+
+	{MB_CYCLES_FW, DEC | ENC, CODECS_ALL, 489583, 489583, 1, 489583},
+
+	{MB_CYCLES_FW_VPP, DEC, CODECS_ALL, 66234, 66234, 1, 66234},
+
+	{MB_CYCLES_FW_VPP, ENC, CODECS_ALL, 48405, 48405, 1, 48405},
+
+	{NUM_COMV, DEC, CODECS_ALL,
+		0, INT_MAX, 1, 0},
+
+	{PROFILE, DEC, H264,
+		V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+		V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH,
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH),
+		V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{PROFILE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+		V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH,
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH),
+		V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{ENTROPY_MODE, TRANSFORM_8X8},
+		NULL,
+		set_u32_enum},
+
+	{PROFILE, ENC | DEC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10,
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_STILL_PICTURE) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10),
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+		V4L2_CID_MPEG_VIDEO_HEVC_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		adjust_profile,
+		set_u32_enum},
+
+	{PROFILE, DEC, VP9,
+		V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+		V4L2_MPEG_VIDEO_VP9_PROFILE_2,
+		BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_2),
+		V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+		V4L2_CID_MPEG_VIDEO_VP9_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{LEVEL, DEC, H264,
+		V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_H264_LEVEL_6_2,
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_2),
+		V4L2_MPEG_VIDEO_H264_LEVEL_6_1,
+		V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{LEVEL, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_H264_LEVEL_6_0,
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_0),
+		V4L2_MPEG_VIDEO_H264_LEVEL_5_0,
+		V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_level},
+
+	{LEVEL, DEC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2),
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_6_1,
+		V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{LEVEL, ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2),
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_5,
+		V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_level},
+
+	{LEVEL, DEC, VP9,
+		V4L2_MPEG_VIDEO_VP9_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_VP9_LEVEL_6_0,
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_6_0),
+		V4L2_MPEG_VIDEO_VP9_LEVEL_6_0,
+		V4L2_CID_MPEG_VIDEO_VP9_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{HEVC_TIER, DEC | ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+		V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+		BIT(V4L2_MPEG_VIDEO_HEVC_TIER_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_TIER_HIGH),
+		V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+		V4L2_CID_MPEG_VIDEO_HEVC_TIER,
+		HFI_PROP_TIER,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_u32_enum},
+
+	{HFLIP, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_HFLIP,
+		HFI_PROP_FLIP,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_flip},
+
+	{VFLIP, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_VFLIP,
+		HFI_PROP_FLIP,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_flip},
+
+	{ROTATION, ENC, CODECS_ALL,
+		0, 270, 90, 0,
+		V4L2_CID_ROTATE,
+		HFI_PROP_ROTATION,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_rotation},
+
+	{HEADER_MODE, ENC, CODECS_ALL,
+		V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE,
+		V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+		BIT(V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE) |
+		BIT(V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME),
+		V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+		V4L2_CID_MPEG_VIDEO_HEADER_MODE,
+		HFI_PROP_SEQ_HEADER_MODE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{0},
+		NULL,
+		set_header_mode},
+
+	{PREPEND_SPSPPS_TO_IDR, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_PREPEND_SPSPPS_TO_IDR},
+
+	{REQUEST_I_FRAME, ENC, H264 | HEVC,
+		0, 0, 0, 0,
+		V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
+		HFI_PROP_REQUEST_SYNC_FRAME,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_req_sync_frame},
+
+	{BIT_RATE, ENC, H264 | HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_BITRATE,
+		HFI_PROP_TOTAL_BITRATE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{PEAK_BITRATE, L0_BR},
+		adjust_bitrate,
+		set_bitrate},
+
+	{PEAK_BITRATE, ENC, H264 | HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_BITRATE_PEAK,
+		HFI_PROP_TOTAL_PEAK_BITRATE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_peak_bitrate,
+		set_peak_bitrate},
+
+	{BITRATE_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_CBR,
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CBR),
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+		HFI_PROP_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{LTR_COUNT, IR_PERIOD, I_FRAME_QP, P_FRAME_QP,
+		 B_FRAME_QP, ENH_LAYER_COUNT, BIT_RATE,
+		 MIN_QUALITY, PEAK_BITRATE, SLICE_MODE},
+		adjust_bitrate_mode,
+		set_bitrate_mode},
+
+	{FRAME_SKIP_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT,
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED) |
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_LEVEL_LIMIT) |
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT),
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+		V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{FRAME_RC_ENABLE, ENC, H264 | HEVC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_FRAME_RC_ENABLE},
+
+	{GOP_SIZE, ENC, CODECS_ALL,
+		0, INT_MAX, 1, 2 * DEFAULT_FPS - 1,
+		V4L2_CID_MPEG_VIDEO_GOP_SIZE,
+		HFI_PROP_MAX_GOP_FRAMES,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_gop_size,
+		set_gop_size},
+
+	{B_FRAME, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_B_FRAMES,
+		HFI_PROP_MAX_B_FRAMES,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		adjust_b_frame,
+		set_u32},
+
+	{LTR_COUNT, ENC, H264 | HEVC,
+		0, MAX_LTR_FRAME_COUNT, 1, 0,
+		V4L2_CID_MPEG_VIDEO_LTR_COUNT,
+		HFI_PROP_LTR_COUNT,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		adjust_ltr_count,
+		set_u32},
+
+	{USE_LTR, ENC, H264 | HEVC,
+		0,
+		((1 << MAX_LTR_FRAME_COUNT) - 1),
+		0, 0,
+		V4L2_CID_MPEG_VIDEO_USE_LTR_FRAMES,
+		HFI_PROP_LTR_USE,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_use_ltr,
+		set_use_and_mark_ltr},
+
+	{MARK_LTR, ENC, H264 | HEVC,
+		INVALID_DEFAULT_MARK_OR_USE_LTR,
+		(MAX_LTR_FRAME_COUNT - 1),
+		1, INVALID_DEFAULT_MARK_OR_USE_LTR,
+		V4L2_CID_MPEG_VIDEO_FRAME_LTR_INDEX,
+		HFI_PROP_LTR_MARK,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_mark_ltr,
+		set_use_and_mark_ltr},
+
+	{BASELAYER_PRIORITY, ENC, H264,
+		0, MAX_BASE_LAYER_PRIORITY_ID, 1, 0,
+		V4L2_CID_MPEG_VIDEO_BASELAYER_PRIORITY_ID,
+		HFI_PROP_BASELAYER_PRIORITYID,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{IR_TYPE, ENC, H264 | HEVC,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC,
+		BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM) |
+		BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC),
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{IR_PERIOD, ENC, H264 | HEVC,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD,
+		0,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_ir_period,
+		set_ir_period},
+
+	{MIN_QUALITY, ENC, H264 | HEVC,
+		0, MAX_SUPPORTED_MIN_QUALITY, 70, MAX_SUPPORTED_MIN_QUALITY,
+		0,
+		HFI_PROP_MAINTAIN_MIN_QUALITY,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		adjust_min_quality,
+		set_u32},
+
+	{TIME_DELTA_BASED_RC, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_u32},
+
+	{MIN_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_MIN_QP,
+		HFI_PROP_MIN_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_min_qp},
+
+	{MIN_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_MIN_QP,
+		HFI_PROP_MIN_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_min_qp},
+
+	{MAX_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
+		HFI_PROP_MAX_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_max_qp},
+
+	{MAX_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_MAX_QP,
+		HFI_PROP_MAX_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		NULL,
+		set_max_qp},
+
+	{I_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MIN_QP},
+
+	{I_FRAME_MIN_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MIN_QP},
+
+	{P_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MIN_QP},
+
+	{P_FRAME_MIN_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MIN_QP},
+
+	{B_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MIN_QP},
+
+	{B_FRAME_MIN_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MIN_QP},
+
+	{I_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MAX_QP},
+
+	{I_FRAME_MAX_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MAX_QP},
+
+	{P_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MAX_QP},
+
+	{P_FRAME_MAX_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MAX_QP},
+
+	{B_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MAX_QP},
+
+	{B_FRAME_MAX_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MAX_QP},
+
+	{I_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{I_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{P_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{P_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{B_FRAME_QP, ENC, HEVC,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{B_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		NULL,
+		set_frame_qp},
+
+	{LAYER_TYPE, ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B,
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+		BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P),
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_TYPE,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{LTR_COUNT}},
+
+	{LAYER_TYPE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B,
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+		BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B) |
+		BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P),
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_TYPE,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{LTR_COUNT}},
+
+	{LAYER_ENABLE, ENC, H264,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{LAYER_ENABLE, ENC, HEVC,
+		0, 1, 1, 0,
+		0,
+		0,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{ENH_LAYER_COUNT, ENC, HEVC,
+		0, 5, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_LAYER,
+		HFI_PROP_LAYER_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{GOP_SIZE, B_FRAME, BIT_RATE, MIN_QUALITY, SLICE_MODE,
+		 LTR_COUNT},
+		adjust_layer_count,
+		set_layer_count_and_type},
+
+	{ENH_LAYER_COUNT, ENC, H264,
+		0, 5, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_LAYER,
+		HFI_PROP_LAYER_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{GOP_SIZE, B_FRAME, BIT_RATE, MIN_QUALITY, SLICE_MODE,
+		 LTR_COUNT},
+		adjust_layer_count,
+		set_layer_count_and_type},
+
+	{L0_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L0_BR,
+		HFI_PROP_BITRATE_LAYER1,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L1_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L0_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L0_BR,
+		HFI_PROP_BITRATE_LAYER1,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L1_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L1_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L1_BR,
+		HFI_PROP_BITRATE_LAYER2,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L2_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L1_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L1_BR,
+		HFI_PROP_BITRATE_LAYER2,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L2_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L2_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L2_BR,
+		HFI_PROP_BITRATE_LAYER3,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L3_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L2_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L2_BR,
+		HFI_PROP_BITRATE_LAYER3,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L3_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L3_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L3_BR,
+		HFI_PROP_BITRATE_LAYER4,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L4_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L3_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L3_BR,
+		HFI_PROP_BITRATE_LAYER4,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L4_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L4_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L4_BR,
+		HFI_PROP_BITRATE_LAYER5,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L5_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L4_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L4_BR,
+		HFI_PROP_BITRATE_LAYER5,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{L5_BR},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L5_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L5_BR,
+		HFI_PROP_BITRATE_LAYER6,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{L5_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L5_BR,
+		HFI_PROP_BITRATE_LAYER6,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED,
+		{0},
+		adjust_layer_bitrate,
+		set_layer_bitrate},
+
+	{ENTROPY_MODE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) |
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC),
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		V4L2_CID_MPEG_VIDEO_H264_ENTROPY_MODE,
+		HFI_PROP_CABAC_SESSION,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{BIT_RATE},
+		adjust_entropy_mode,
+		set_u32},
+
+	{SLICE_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES,
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE) |
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) |
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES),
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU,
+		{STAGE},
+		adjust_slice_count,
+		set_slice_count},
+
+	{SLICE_MAX_BYTES, ENC, H264 | HEVC,
+		MIN_SLICE_BYTE_SIZE, MAX_SLICE_BYTE_SIZE,
+		1, MIN_SLICE_BYTE_SIZE,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_BYTES,
+		HFI_PROP_MULTI_SLICE_BYTES_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{SLICE_MAX_MB, ENC, H264 | HEVC,
+		1, MAX_SLICE_MB_SIZE, 1, 1,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_MB,
+		HFI_PROP_MULTI_SLICE_MB_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{TRANSFORM_8X8, ENC, H264,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM,
+		HFI_PROP_8X8_TRANSFORM,
+		CAP_FLAG_OUTPUT_PORT,
+		{0},
+		adjust_transform_8x8,
+		set_u32},
+
+	{DISPLAY_DELAY_ENABLE, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT,
+		{OUTPUT_ORDER},
+		NULL,
+		NULL},
+
+	{DISPLAY_DELAY, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT,
+		{OUTPUT_ORDER},
+		NULL,
+		NULL},
+
+	{OUTPUT_ORDER, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT,
+		{0},
+		adjust_output_order,
+		set_u32},
+
+	{INPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		DEFAULT_MAX_HOST_BUF_COUNT, DEFAULT_MAX_HOST_BURST_BUF_COUNT,
+		1, DEFAULT_MAX_HOST_BUF_COUNT,
+		0,
+		HFI_PROP_BUFFER_HOST_MAX_COUNT,
+		CAP_FLAG_INPUT_PORT,
+		{0},
+		NULL,
+		set_u32},
+
+	{STAGE, ENC | DEC, CODECS_ALL,
+		STAGE_1,
+		STAGE_2, 1,
+		STAGE_2,
+		0,
+		HFI_PROP_STAGE,
+		CAP_FLAG_NONE,
+		{0},
+		NULL,
+		set_stage},
+
+	{PIPE, ENC | DEC, CODECS_ALL,
+		PIPE_1,
+		PIPE_4, 1,
+		PIPE_4,
+		0,
+		HFI_PROP_PIPE,
+		CAP_FLAG_NONE,
+		{0},
+		NULL,
+		set_pipe},
+
+	{QUALITY_MODE, ENC, CODECS_ALL,
+		MAX_QUALITY_MODE,
+		POWER_SAVE_MODE, 1,
+		POWER_SAVE_MODE},
+
+	{POC, DEC, H264, 0, 2, 1, 1,
+		0,
+		HFI_PROP_PIC_ORDER_CNT_TYPE},
+
+	{CODED_FRAMES, DEC, H264 | HEVC,
+		CODED_FRAMES_PROGRESSIVE, CODED_FRAMES_PROGRESSIVE,
+		0, CODED_FRAMES_PROGRESSIVE,
+		0,
+		HFI_PROP_CODED_FRAMES},
+
+	{BIT_DEPTH, DEC, CODECS_ALL, BIT_DEPTH_8, BIT_DEPTH_10, 1, BIT_DEPTH_8,
+		0,
+		HFI_PROP_LUMA_CHROMA_BIT_DEPTH},
+
+	{DEFAULT_HEADER, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_DEC_DEFAULT_HEADER},
+
+	{RAP_FRAME, DEC, CODECS_ALL,
+		0, 1, 1, 1,
+		0,
+		HFI_PROP_DEC_START_FROM_RAP_FRAME,
+		CAP_FLAG_INPUT_PORT,
+		{0},
+		NULL,
+		set_u32},
+};
+
+static const struct bus_info sm8550_bus_table[] = {
+	{ NULL, "iris-cnoc", 1000, 1000     },
+	{ NULL, "iris-ddr",  1000, 15000000 },
+};
+
+static const struct clock_info sm8550_clk_table[] = {
+	{ NULL, "gcc_video_axi0", GCC_VIDEO_AXI0_CLK, 0 },
+	{ NULL, "core_clk",       VIDEO_CC_MVS0C_CLK, 0 },
+	{ NULL, "vcodec_core",    VIDEO_CC_MVS0_CLK,  1 },
+};
+
+static const char * const sm8550_clk_reset_table[] = { "video_axi_reset", NULL };
+
+static const char * const sm8550_pd_table[] = { "iris-ctl", "vcodec", NULL };
+
+static const char * const sm8550_opp_pd_table[] = { "mxc", "mmcx", NULL };
+
+static const struct bw_info sm8550_bw_table_enc[] = {
+	{ 1944000, 1491000, 2693000 },	/* 3840x2160@60 */
+	{  972000,  765000, 1366000 },	/* 3840x2160@30 */
+	{  489600,  557000, 780000 },	/* 1920x1080@60 */
+	{  244800,  288000, 399000 },	/* 1920x1080@30 */
+};
+
+static const struct bw_info sm8550_bw_table_dec[] = {
+	{ 2073600, 1608000, 2742000 },	/* 4096x2160@60 */
+	{ 1036800,  826000, 1393000 },	/* 4096x2160@30 */
+	{  489600,  567000,  723000 },	/* 1920x1080@60 */
+	{  244800,  294000,  372000 },	/* 1920x1080@30 */
+};
+
+static const struct reg_preset_info sm8550_reg_preset_table[] = {
+	{ 0xB0088, 0x0, 0x11 },
+};
+
+static struct ubwc_config_data ubwc_config_sm8550[] = {
+	UBWC_CONFIG(8, 32, 16, 0, 1, 1, 1),
+};
+
+static struct format_capability format_data_sm8550 = {
+	.codec_info = codec_data_sm8550,
+	.codec_info_size = ARRAY_SIZE(codec_data_sm8550),
+	.color_format_info = color_format_data_sm8550,
+	.color_format_info_size = ARRAY_SIZE(color_format_data_sm8550),
+};
+
+static const u32 sm8550_vdec_src_change_param_avc[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_CODED_FRAMES,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PIC_ORDER_CNT_TYPE,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+};
+
+static const u32 sm8550_vdec_src_change_param_hevc[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_TIER,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+};
+
+static const u32 sm8550_vdec_src_change_param_vp9[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+};
+
+static const u32 sm8550_vdec_input_properties[] = {
+	HFI_PROP_NO_OUTPUT,
+};
+
+static const u32 sm8550_vdec_output_properties_avc[] = {
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+	HFI_PROP_CABAC_SESSION,
+};
+
+static const u32 sm8550_vdec_output_properties_hevc[] = {
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+};
+
+static const u32 sm8550_vdec_output_properties_vp9[] = {
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+};
+
+struct platform_data sm8550_data = {
+	.bus_tbl = sm8550_bus_table,
+	.bus_tbl_size = ARRAY_SIZE(sm8550_bus_table),
+	.clk_tbl = sm8550_clk_table,
+	.clk_tbl_size = ARRAY_SIZE(sm8550_clk_table),
+	.clk_rst_tbl = sm8550_clk_reset_table,
+	.clk_rst_tbl_size = ARRAY_SIZE(sm8550_clk_reset_table),
+
+	.bw_tbl_enc = sm8550_bw_table_enc,
+	.bw_tbl_enc_size = ARRAY_SIZE(sm8550_bw_table_enc),
+	.bw_tbl_dec = sm8550_bw_table_dec,
+	.bw_tbl_dec_size = ARRAY_SIZE(sm8550_bw_table_dec),
+
+	.pd_tbl = sm8550_pd_table,
+	.pd_tbl_size = ARRAY_SIZE(sm8550_pd_table),
+	.opp_pd_tbl = sm8550_opp_pd_table,
+	.opp_pd_tbl_size = ARRAY_SIZE(sm8550_opp_pd_table),
+
+	.reg_prst_tbl = sm8550_reg_preset_table,
+	.reg_prst_tbl_size = ARRAY_SIZE(sm8550_reg_preset_table),
+	.fwname = "qcom/vpu-3.0/vpu30_4v",
+	.pas_id = 9,
+
+	.core_data = core_data_sm8550,
+	.core_data_size = ARRAY_SIZE(core_data_sm8550),
+	.inst_cap_data = instance_cap_data_sm8550,
+	.inst_cap_data_size = ARRAY_SIZE(instance_cap_data_sm8550),
+	.ubwc_config = ubwc_config_sm8550,
+	.format_data = &format_data_sm8550,
+
+	.avc_subscribe_param =
+		sm8550_vdec_src_change_param_avc,
+	.avc_subscribe_param_size =
+		ARRAY_SIZE(sm8550_vdec_src_change_param_avc),
+	.hevc_subscribe_param =
+		sm8550_vdec_src_change_param_hevc,
+	.hevc_subscribe_param_size =
+		ARRAY_SIZE(sm8550_vdec_src_change_param_hevc),
+	.vp9_subscribe_param =
+		sm8550_vdec_src_change_param_vp9,
+	.vp9_subscribe_param_size =
+		ARRAY_SIZE(sm8550_vdec_src_change_param_vp9),
+	.dec_input_prop = sm8550_vdec_input_properties,
+	.dec_input_prop_size = ARRAY_SIZE(sm8550_vdec_input_properties),
+	.dec_output_prop_avc = sm8550_vdec_output_properties_avc,
+	.dec_output_prop_size_avc = ARRAY_SIZE(sm8550_vdec_output_properties_avc),
+	.dec_output_prop_hevc = sm8550_vdec_output_properties_hevc,
+	.dec_output_prop_size_hevc = ARRAY_SIZE(sm8550_vdec_output_properties_hevc),
+	.dec_output_prop_vp9 = sm8550_vdec_output_properties_vp9,
+	.dec_output_prop_size_vp9 = ARRAY_SIZE(sm8550_vdec_output_properties_vp9),
+};
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/resources.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/resources.c
@@ -0,0 +1,517 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+#include <linux/interconnect.h>
+#include <linux/pm_domain.h>
+#include <linux/pm_opp.h>
+#include <linux/pm_runtime.h>
+#include <linux/reset.h>
+#include <linux/sort.h>
+
+#include "iris_core.h"
+#include "platform_common.h"
+#include "resources.h"
+
+#define BW_THRESHOLD 50000
+
+static void iris_pd_release(void *res)
+{
+	struct device *pd = (struct device *)res;
+
+	dev_pm_domain_detach(pd, true);
+}
+
+static int iris_pd_get(struct iris_core *core, struct power_domain_info *pdinfo)
+{
+	int ret;
+
+	pdinfo->genpd_dev = dev_pm_domain_attach_by_name(core->dev, pdinfo->name);
+	if (IS_ERR_OR_NULL(pdinfo->genpd_dev))
+		ret = PTR_ERR(pdinfo->genpd_dev) ? : -ENODATA;
+
+	ret = devm_add_action_or_reset(core->dev, iris_pd_release, (void *)pdinfo->genpd_dev);
+	if (ret)
+		return ret;
+
+	return ret;
+}
+
+static void iris_opp_dl_release(void *res)
+{
+	struct device_link *link = (struct device_link *)res;
+
+	device_link_del(link);
+}
+
+static int iris_opp_dl_get(struct device *dev, struct device *supplier)
+{
+	u32 flag = DL_FLAG_RPM_ACTIVE | DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS;
+	struct device_link *link = NULL;
+	int ret;
+
+	link = device_link_add(dev, supplier, flag);
+	if (!link)
+		return -EINVAL;
+
+	ret = devm_add_action_or_reset(dev, iris_opp_dl_release, (void *)link);
+
+	return ret;
+}
+
+int opp_set_rate(struct iris_core *core, u64 freq)
+{
+	unsigned long opp_freq = 0;
+	struct dev_pm_opp *opp;
+	int ret;
+
+	opp_freq = freq;
+
+	opp = dev_pm_opp_find_freq_ceil(core->dev, &opp_freq);
+	if (IS_ERR(opp)) {
+		opp = dev_pm_opp_find_freq_floor(core->dev, &opp_freq);
+		if (IS_ERR(opp)) {
+			dev_err(core->dev,
+				"unable to find freq %lld in opp table\n", freq);
+			return -EINVAL;
+		}
+	}
+	dev_pm_opp_put(opp);
+
+	ret = dev_pm_opp_set_rate(core->dev, opp_freq);
+	if (ret) {
+		dev_err(core->dev, "failed to set rate\n");
+		return ret;
+	}
+
+	return ret;
+}
+
+static int init_bus(struct iris_core *core)
+{
+	const struct bus_info *bus_tbl;
+	struct bus_info *binfo = NULL;
+	u32 i = 0;
+
+	bus_tbl = core->platform_data->bus_tbl;
+
+	core->bus_count = core->platform_data->bus_tbl_size;
+	core->bus_tbl = devm_kzalloc(core->dev,
+				     sizeof(struct bus_info) * core->bus_count,
+				     GFP_KERNEL);
+	if (!core->bus_tbl)
+		return -ENOMEM;
+
+	for (i = 0; i < core->bus_count; i++) {
+		binfo = &core->bus_tbl[i];
+		binfo->name = bus_tbl[i].name;
+		binfo->bw_min_kbps = bus_tbl[i].bw_min_kbps;
+		binfo->bw_max_kbps = bus_tbl[i].bw_max_kbps;
+		binfo->icc = devm_of_icc_get(core->dev, binfo->name);
+		if (IS_ERR(binfo->icc)) {
+			dev_err(core->dev,
+				"%s: failed to get bus: %s\n", __func__, binfo->name);
+			return PTR_ERR(binfo->icc);
+		}
+	}
+
+	return 0;
+}
+
+static int init_power_domains(struct iris_core *core)
+{
+	struct power_domain_info *pdinfo = NULL;
+	const char * const *opp_pd_tbl;
+	const char * const *pd_tbl;
+	struct device **opp_vdevs = NULL;
+	u32 opp_pd_cnt, i;
+	int ret;
+
+	pd_tbl = core->platform_data->pd_tbl;
+
+	core->pd_count = core->platform_data->pd_tbl_size;
+	core->power_domain_tbl = devm_kzalloc(core->dev,
+					      sizeof(struct power_domain_info) * core->pd_count,
+					      GFP_KERNEL);
+	if (!core->power_domain_tbl)
+		return -ENOMEM;
+
+	for (i = 0; i < (core->pd_count - 1); i++) {
+		pdinfo = &core->power_domain_tbl[i];
+		pdinfo->name = pd_tbl[i];
+		ret = iris_pd_get(core, pdinfo);
+		if (ret) {
+			dev_err(core->dev,
+				"%s: failed to get pd: %s\n", __func__, pdinfo->name);
+			return ret;
+		}
+	}
+
+	opp_pd_tbl = core->platform_data->opp_pd_tbl;
+	opp_pd_cnt = core->platform_data->opp_pd_tbl_size;
+
+	ret = devm_pm_opp_attach_genpd(core->dev, opp_pd_tbl, &opp_vdevs);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < (opp_pd_cnt - 1) ; i++) {
+		ret = iris_opp_dl_get(core->dev, opp_vdevs[i]);
+		if (ret) {
+			dev_err(core->dev, "%s: failed to create dl: %s\n",
+				__func__, dev_name(opp_vdevs[i]));
+			return ret;
+		}
+	}
+
+	ret = devm_pm_opp_set_clkname(core->dev, "vcodec_core");
+	if (ret)
+		return ret;
+
+	ret = devm_pm_opp_of_add_table(core->dev);
+	if (ret) {
+		dev_err(core->dev, "%s: failed to add opp table\n", __func__);
+		return ret;
+	}
+
+	return ret;
+}
+
+int enable_power_domains(struct iris_core *core, const char *name)
+{
+	struct power_domain_info *pdinfo = NULL;
+	int ret;
+	u32 i;
+
+	ret = opp_set_rate(core, ULONG_MAX);
+	if (ret)
+		return ret;
+
+	core->pd_count = core->platform_data->pd_tbl_size;
+	for (i = 0; i < (core->pd_count - 1); i++) {
+		pdinfo = &core->power_domain_tbl[i];
+		if (strcmp(pdinfo->name, name))
+			continue;
+		ret = pm_runtime_get_sync(pdinfo->genpd_dev);
+		if (ret < 0)
+			return ret;
+	}
+
+	ret = opp_set_rate(core, ULONG_MAX);
+	if (ret)
+		return ret;
+
+	return ret;
+}
+
+int disable_power_domains(struct iris_core *core, const char *name)
+{
+	struct power_domain_info *pdinfo = NULL;
+	int ret;
+	u32 i;
+
+	ret = opp_set_rate(core, 0);
+	if (ret)
+		return ret;
+
+	core->pd_count = core->platform_data->pd_tbl_size;
+	for (i = 0; i < (core->pd_count - 1); i++) {
+		pdinfo = &core->power_domain_tbl[i];
+		if (strcmp(pdinfo->name, name))
+			continue;
+		ret = pm_runtime_put_sync(pdinfo->genpd_dev);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+static int init_clocks(struct iris_core *core)
+{
+	const struct clock_info *clk_tbl;
+	struct clock_info *cinfo = NULL;
+	u32 i;
+
+	clk_tbl = core->platform_data->clk_tbl;
+
+	core->clk_count = core->platform_data->clk_tbl_size;
+	core->clock_tbl = devm_kzalloc(core->dev,
+				       sizeof(struct clock_info) * core->clk_count,
+				       GFP_KERNEL);
+	if (!core->clock_tbl)
+		return -ENOMEM;
+
+	for (i = 0; i < core->clk_count; i++) {
+		cinfo = &core->clock_tbl[i];
+		cinfo->name = clk_tbl[i].name;
+		cinfo->clk_id = clk_tbl[i].clk_id;
+		cinfo->has_scaling = clk_tbl[i].has_scaling;
+		cinfo->clk = devm_clk_get(core->dev, cinfo->name);
+		if (IS_ERR(cinfo->clk)) {
+			dev_err(core->dev,
+				"%s: failed to get clock: %s\n", __func__, cinfo->name);
+			return PTR_ERR(cinfo->clk);
+		}
+	}
+
+	return 0;
+}
+
+static int init_reset_clocks(struct iris_core *core)
+{
+	struct reset_info *rinfo = NULL;
+	const char * const *rst_tbl;
+	u32 i = 0;
+
+	rst_tbl = core->platform_data->clk_rst_tbl;
+
+	if (!rst_tbl) {
+		dev_info(core->dev, "no reset clocks found\n");
+		return 0;
+	}
+
+	core->reset_count = core->platform_data->clk_rst_tbl_size;
+	core->reset_tbl = devm_kzalloc(core->dev,
+				       sizeof(struct reset_info) * core->reset_count,
+				       GFP_KERNEL);
+	if (!core->reset_tbl)
+		return -ENOMEM;
+
+	for (i = 0; i < (core->reset_count - 1); i++) {
+		rinfo = &core->reset_tbl[i];
+		rinfo->name = rst_tbl[i];
+		rinfo->rst = devm_reset_control_get(core->dev, rinfo->name);
+		if (IS_ERR(rinfo->rst)) {
+			dev_err(core->dev,
+				"%s: failed to get reset clock: %s\n", __func__, rinfo->name);
+			return PTR_ERR(rinfo->rst);
+		}
+	}
+
+	return 0;
+}
+
+int unvote_buses(struct iris_core *core)
+{
+	struct bus_info *bus = NULL;
+	int ret = 0;
+	u32 i;
+
+	core->power.bus_bw = 0;
+	core->bus_count = core->platform_data->bus_tbl_size;
+
+	for (i = 0; i < core->bus_count; i++) {
+		bus = &core->bus_tbl[i];
+		if (!bus->icc)
+			return -EINVAL;
+
+		ret = icc_set_bw(bus->icc, 0, 0);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+int vote_buses(struct iris_core *core, unsigned long bus_bw)
+{
+	unsigned long bw_kbps = 0, bw_prev = 0;
+	struct bus_info *bus = NULL;
+	int ret = 0;
+	u32 i;
+
+	core->bus_count = core->platform_data->bus_tbl_size;
+
+	for (i = 0; i < core->bus_count; i++) {
+		bus = &core->bus_tbl[i];
+		if (bus && bus->icc) {
+			if (!strcmp(bus->name, "iris-ddr")) {
+				bw_kbps = bus_bw;
+				bw_prev = core->power.bus_bw;
+			} else {
+				bw_kbps = bus->bw_max_kbps;
+				bw_prev = core->power.bus_bw ?
+						bw_kbps : 0;
+			}
+
+			bw_kbps = clamp_t(typeof(bw_kbps), bw_kbps,
+					  bus->bw_min_kbps, bus->bw_max_kbps);
+
+			if (abs(bw_kbps - bw_prev) < BW_THRESHOLD && bw_prev)
+				continue;
+
+			ret = icc_set_bw(bus->icc, bw_kbps, 0);
+			if (ret)
+				return ret;
+
+			if (!strcmp(bus->name, "iris-ddr"))
+				core->power.bus_bw = bw_kbps;
+		}
+	}
+
+	return ret;
+}
+
+static int deassert_reset_control(struct iris_core *core)
+{
+	struct reset_info *rcinfo = NULL;
+	int ret = 0;
+	u32 i;
+
+	core->reset_count = core->platform_data->clk_rst_tbl_size;
+
+	if (!core->reset_count)
+		return ret;
+
+	for (i = 0; i < (core->reset_count - 1); i++) {
+		rcinfo = &core->reset_tbl[i];
+		ret = reset_control_deassert(rcinfo->rst);
+		if (ret) {
+			dev_err(core->dev, "deassert reset control failed. ret = %d\n", ret);
+			continue;
+		}
+	}
+
+	return ret;
+}
+
+static int assert_reset_control(struct iris_core *core)
+{
+	struct reset_info *rcinfo = NULL;
+	int ret = 0, cnt = 0;
+	u32 i;
+
+	core->reset_count = core->platform_data->clk_rst_tbl_size;
+
+	if (!core->reset_count)
+		return ret;
+
+	for (i = 0; i < (core->reset_count - 1); i++) {
+		rcinfo = &core->reset_tbl[i];
+		if (!rcinfo->rst)
+			return -EINVAL;
+
+		ret = reset_control_assert(rcinfo->rst);
+		if (ret) {
+			dev_err(core->dev, "failed to assert reset control %s, ret = %d\n",
+				rcinfo->name, ret);
+			goto deassert_reset_control;
+		}
+		cnt++;
+
+		usleep_range(1000, 1100);
+	}
+
+	return ret;
+deassert_reset_control:
+	for (i = 0; i < cnt; i++) {
+		rcinfo = &core->reset_tbl[i];
+		reset_control_deassert(rcinfo->rst);
+	}
+
+	return ret;
+}
+
+int reset_ahb2axi_bridge(struct iris_core *core)
+{
+	int ret;
+
+	ret = assert_reset_control(core);
+	if (ret)
+		return ret;
+
+	ret = deassert_reset_control(core);
+
+	return ret;
+}
+
+int disable_unprepare_clock(struct iris_core *core, const char *clk_name)
+{
+	struct clock_info *cl;
+	bool found = false;
+	u32 i;
+
+	core->clk_count = core->platform_data->clk_tbl_size;
+
+	for (i = 0; i < core->clk_count; i++) {
+		cl = &core->clock_tbl[i];
+		if (!cl->clk)
+			return -EINVAL;
+
+		if (strcmp(cl->name, clk_name))
+			continue;
+
+		found = true;
+		clk_disable_unprepare(cl->clk);
+		cl->prev = 0;
+		break;
+	}
+
+	if (!found)
+		return -EINVAL;
+
+	return 0;
+}
+
+int prepare_enable_clock(struct iris_core *core, const char *clk_name)
+{
+	struct clock_info *cl;
+	bool found = false;
+	int ret = 0;
+	u32 i;
+
+	core->clk_count = core->platform_data->clk_tbl_size;
+
+	for (i = 0; i < core->clk_count; i++) {
+		cl = &core->clock_tbl[i];
+		if (!cl->clk)
+			return -EINVAL;
+
+		if (strcmp(cl->name, clk_name))
+			continue;
+
+		found = true;
+
+		ret = clk_prepare_enable(cl->clk);
+		if (ret) {
+			dev_err(core->dev, "failed to enable clock %s\n", cl->name);
+			return ret;
+		}
+
+		if (!__clk_is_enabled(cl->clk)) {
+			clk_disable_unprepare(cl->clk);
+			return -EINVAL;
+		}
+		break;
+	}
+
+	if (!found)
+		return -EINVAL;
+
+	return ret;
+}
+
+int init_resources(struct iris_core *core)
+{
+	int ret;
+
+	ret = init_bus(core);
+	if (ret)
+		return ret;
+
+	ret = init_power_domains(core);
+	if (ret)
+		return ret;
+
+	ret = init_clocks(core);
+	if (ret)
+		return ret;
+
+	ret = init_reset_clocks(core);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/resources.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/resources.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _RESOURCES_H_
+#define _RESOURCES_H_
+
+struct bus_info {
+	struct icc_path		*icc;
+	const char		*name;
+	u32			bw_min_kbps;
+	u32			bw_max_kbps;
+};
+
+struct power_domain_info {
+	struct device	*genpd_dev;
+	const char	*name;
+};
+
+struct clock_info {
+	struct clk	*clk;
+	const char	*name;
+	u32		clk_id;
+	bool		has_scaling;
+	u64		prev;
+};
+
+struct reset_info {
+	struct reset_control	*rst;
+	const char		*name;
+};
+
+int enable_power_domains(struct iris_core *core, const char *name);
+int disable_power_domains(struct iris_core *core, const char *name);
+int unvote_buses(struct iris_core *core);
+int vote_buses(struct iris_core *core, unsigned long bus_bw);
+int reset_ahb2axi_bridge(struct iris_core *core);
+int opp_set_rate(struct iris_core *core, u64 freq);
+int disable_unprepare_clock(struct iris_core *core, const char *clk_name);
+int prepare_enable_clock(struct iris_core *core, const char *clk_name);
+int init_resources(struct iris_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_common.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_common.c
@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+
+#include "vpu_iris2.h"
+#include "vpu_iris3.h"
+#include "iris_core.h"
+#include "iris_helpers.h"
+#include "vpu_common.h"
+
+int write_register(struct iris_core *core, u32 reg, u32 value)
+{
+	void __iomem *base_addr;
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return ret;
+
+	if (!core->power_enabled)
+		return -EINVAL;
+
+	base_addr = core->reg_base;
+	base_addr += reg;
+	writel_relaxed(value, base_addr);
+
+	/* Make sure value is written into the register */
+	wmb();
+
+	return ret;
+}
+
+int write_register_masked(struct iris_core *core, u32 reg, u32 value, u32 mask)
+{
+	void __iomem *base_addr;
+	u32 prev_val, new_val;
+	int ret;
+
+	ret = check_core_lock(core);
+	if (ret)
+		return ret;
+
+	if (!core->power_enabled)
+		return -EINVAL;
+
+	base_addr = core->reg_base;
+	base_addr += reg;
+
+	prev_val = readl_relaxed(base_addr);
+	/*
+	 * Memory barrier to ensure register read is correct
+	 */
+	rmb();
+
+	new_val = (prev_val & ~mask) | (value & mask);
+
+	writel_relaxed(new_val, base_addr);
+	/*
+	 * Memory barrier to make sure value is written into the register.
+	 */
+	wmb();
+
+	return ret;
+}
+
+int read_register(struct iris_core *core, u32 reg, u32 *value)
+{
+	void __iomem *base_addr;
+
+	if (!core->power_enabled)
+		return -EINVAL;
+
+	base_addr = core->reg_base;
+
+	*value = readl_relaxed(base_addr + reg);
+
+	/* Make sure value is read correctly from the register */
+	rmb();
+
+	return 0;
+}
+
+int read_register_with_poll_timeout(struct iris_core *core, u32 reg,
+				    u32 mask, u32 exp_val, u32 sleep_us,
+				    u32 timeout_us)
+{
+	void __iomem *base_addr;
+	u32 val = 0;
+	int ret;
+
+	if (!core->power_enabled)
+		return -EINVAL;
+
+	base_addr = core->reg_base;
+
+	ret = readl_relaxed_poll_timeout(base_addr + reg, val, ((val & mask) == exp_val),
+					 sleep_us, timeout_us);
+	/*
+	 * Memory barrier to make sure value is read correctly from the
+	 * register.
+	 */
+	rmb();
+
+	return ret;
+}
+
+int set_preset_registers(struct iris_core *core)
+{
+	const struct reg_preset_info *reg_prst;
+	unsigned int prst_count;
+	int cnt, ret = 0;
+
+	reg_prst = core->platform_data->reg_prst_tbl;
+	prst_count = core->platform_data->reg_prst_tbl_size;
+
+	if (!reg_prst || !prst_count)
+		return 0;
+
+	for (cnt = 0; cnt < prst_count; cnt++) {
+		ret = write_register_masked(core, reg_prst[cnt].reg,
+					    reg_prst[cnt].value, reg_prst[cnt].mask);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+static const struct compat_handle compat_handle[] = {
+	{
+		.compat                  = "qcom,sm8550-iris",
+		.init                    = init_iris3,
+	},
+	{
+		.compat                  = "qcom,qcm6490-iris",
+		.init                    = init_iris2,
+	},
+};
+
+int init_vpu(struct iris_core *core)
+{
+	struct device *dev = NULL;
+	int i, ret = 0;
+
+	dev = core->dev;
+
+	for (i = 0; i < ARRAY_SIZE(compat_handle); i++) {
+		if (of_device_is_compatible(dev->of_node, compat_handle[i].compat)) {
+			ret = compat_handle[i].init(core);
+			if (ret)
+				return ret;
+			break;
+		}
+	}
+
+	if (i == ARRAY_SIZE(compat_handle))
+		return -EINVAL;
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_common.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_common.h
@@ -0,0 +1,52 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _VPU_COMMON_H_
+#define _VPU_COMMON_H_
+
+#include <linux/types.h>
+
+struct iris_core;
+
+#define call_vpu_op(d, op, ...)			\
+	(((d) && (d)->vpu_ops && (d)->vpu_ops->op) ? \
+	((d)->vpu_ops->op(__VA_ARGS__)) : 0)
+
+struct compat_handle {
+	const char *compat;
+	int (*init)(struct iris_core *core);
+};
+
+struct vpu_ops {
+	int (*boot_firmware)(struct iris_core *core);
+	int (*raise_interrupt)(struct iris_core *core);
+	int (*clear_interrupt)(struct iris_core *core);
+	int (*watchdog)(struct iris_core *core, u32 intr_status);
+	int (*power_on)(struct iris_core *core);
+	int (*power_off)(struct iris_core *core);
+	int (*prepare_pc)(struct iris_core *core);
+};
+
+#define call_session_op(c, op, ...)			\
+	(((c) && (c)->session_ops && (c)->session_ops->op) ? \
+	((c)->session_ops->op(__VA_ARGS__)) : 0)
+
+struct vpu_session_ops {
+	int (*int_buf_size)(struct iris_inst *inst, enum iris_buffer_type type);
+	u64 (*calc_freq)(struct iris_inst *inst, u32 data_size);
+	int (*calc_bw)(struct iris_inst *inst, struct bus_vote_data *data);
+};
+
+int init_vpu(struct iris_core *core);
+
+int write_register(struct iris_core *core, u32 reg, u32 value);
+int write_register_masked(struct iris_core *core, u32 reg, u32 value, u32 mask);
+int read_register(struct iris_core *core, u32 reg, u32 *value);
+int read_register_with_poll_timeout(struct iris_core *core, u32 reg,
+				    u32 mask, u32 exp_val, u32 sleep_us,
+				    u32 timeout_us);
+int set_preset_registers(struct iris_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris2.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris2.c
@@ -0,0 +1,604 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/iopoll.h>
+
+#include "iris_hfi.h"
+#include "vpu_iris2.h"
+#include "vpu_iris2_buffer.h"
+#include "vpu_iris2_power.h"
+
+#define VIDEO_ARCH_LX 1
+
+#define VCODEC_BASE_OFFS_IRIS2                 0x00000000
+#define AON_MVP_NOC_RESET                      0x0001F000
+#define CPU_BASE_OFFS_IRIS2                    0x000A0000
+#define AON_BASE_OFFS                          0x000E0000
+#define CPU_CS_BASE_OFFS_IRIS2                 (CPU_BASE_OFFS_IRIS2)
+#define CPU_IC_BASE_OFFS_IRIS2                 (CPU_BASE_OFFS_IRIS2)
+
+#define CPU_CS_A2HSOFTINTCLR_IRIS2             (CPU_CS_BASE_OFFS_IRIS2 + 0x1C)
+#define CPU_CS_VCICMDARG0_IRIS2                (CPU_CS_BASE_OFFS_IRIS2 + 0x24)
+#define CPU_CS_VCICMDARG1_IRIS2                (CPU_CS_BASE_OFFS_IRIS2 + 0x28)
+/* HFI_CTRL_INIT */
+#define CPU_CS_SCIACMD_IRIS2                   (CPU_CS_BASE_OFFS_IRIS2 + 0x48)
+/* HFI_CTRL_STATUS */
+#define CPU_CS_SCIACMDARG0_IRIS2               (CPU_CS_BASE_OFFS_IRIS2 + 0x4C)
+
+/* HFI_QTBL_INFO */
+#define CPU_CS_SCIACMDARG1_IRIS2               (CPU_CS_BASE_OFFS_IRIS2 + 0x50)
+
+/* HFI_QTBL_ADDR */
+#define CPU_CS_SCIACMDARG2_IRIS2               (CPU_CS_BASE_OFFS_IRIS2 + 0x54)
+
+/* SFR_ADDR */
+#define CPU_CS_SCIBCMD_IRIS2                   (CPU_CS_BASE_OFFS_IRIS2 + 0x5C)
+#define CPU_CS_SCIBCMDARG0_IRIS2               (CPU_CS_BASE_OFFS_IRIS2 + 0x60)
+
+/* UC_REGION_ADDR */
+#define CPU_CS_SCIBARG1_IRIS2                  (CPU_CS_BASE_OFFS_IRIS2 + 0x64)
+
+/* UC_REGION_ADDR */
+#define CPU_CS_SCIBARG2_IRIS2                  (CPU_CS_BASE_OFFS_IRIS2 + 0x68)
+#define CPU_CS_H2XSOFTINTEN_IRIS2              (CPU_CS_BASE_OFFS_IRIS2 + 0x148)
+#define CPU_CS_AHB_BRIDGE_SYNC_RESET           (CPU_CS_BASE_OFFS_IRIS2 + 0x160)
+#define CPU_CS_X2RPMH_IRIS2                    (CPU_CS_BASE_OFFS_IRIS2 + 0x168)
+
+#define CPU_IC_SOFTINT_IRIS2                   (CPU_IC_BASE_OFFS_IRIS2 + 0x150)
+#define CPU_IC_SOFTINT_H2A_SHFT_IRIS2          0x0
+
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_INIT_IDLE_MSG_BMSK_IRIS2     0x40000000
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_ERROR_STATUS_BMSK_IRIS2      0xfe
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_PC_READY_IRIS2               0x100
+
+#define AON_WRAPPER_MVP_NOC_RESET_REQ          (AON_MVP_NOC_RESET + 0x000)
+#define AON_WRAPPER_MVP_NOC_RESET_ACK          (AON_MVP_NOC_RESET + 0x004)
+
+#define WRAPPER_BASE_OFFS_IRIS2                0x000B0000
+#define WRAPPER_CORE_POWER_STATUS              (WRAPPER_BASE_OFFS_IRIS2 + 0x80)
+#define WRAPPER_INTR_STATUS_IRIS2              (WRAPPER_BASE_OFFS_IRIS2 + 0x0C)
+#define WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS2   0x8
+#define WRAPPER_INTR_STATUS_A2H_BMSK_IRIS2     0x4
+
+#define WRAPPER_INTR_MASK_IRIS2                (WRAPPER_BASE_OFFS_IRIS2 + 0x10)
+#define WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS2     0x8
+#define WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS2    0x4
+
+#define WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS2 (WRAPPER_BASE_OFFS_IRIS2 + 0x54)
+#define WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS2  (WRAPPER_BASE_OFFS_IRIS2 + 0x58)
+#define WRAPPER_CORE_CLOCK_CONFIG_IRIS2        (WRAPPER_BASE_OFFS_IRIS2 + 0x88)
+
+#define WRAPPER_TZ_BASE_OFFS                   0x000C0000
+#define WRAPPER_TZ_CPU_STATUS                  (WRAPPER_TZ_BASE_OFFS + 0x10)
+
+#define CTRL_INIT_IRIS2                        CPU_CS_SCIACMD_IRIS2
+#define CTRL_STATUS_IRIS2                      CPU_CS_SCIACMDARG0_IRIS2
+#define CTRL_ERROR_STATUS__M_IRIS2             CPU_CS_SCIACMDARG0_HFI_CTRL_ERROR_STATUS_BMSK_IRIS2
+#define CTRL_INIT_IDLE_MSG_BMSK_IRIS2          CPU_CS_SCIACMDARG0_HFI_CTRL_INIT_IDLE_MSG_BMSK_IRIS2
+#define CTRL_STATUS_PC_READY_IRIS2             CPU_CS_SCIACMDARG0_HFI_CTRL_PC_READY_IRIS2
+
+#define QTBL_INFO_IRIS2                        CPU_CS_SCIACMDARG1_IRIS2
+#define QTBL_ADDR_IRIS2                        CPU_CS_SCIACMDARG2_IRIS2
+#define SFR_ADDR_IRIS2                         CPU_CS_SCIBCMD_IRIS2
+#define UC_REGION_ADDR_IRIS2                   CPU_CS_SCIBARG1_IRIS2
+#define UC_REGION_SIZE_IRIS2                   CPU_CS_SCIBARG2_IRIS2
+#define WRAPPER_CORE_POWER_STATUS              0xB0080
+#define WRAPPER_CORE_POWER_CONTROL             0xB0084
+
+#define VCODEC_SS_IDLE_STATUSN                 (VCODEC_BASE_OFFS_IRIS2 + 0x70)
+
+static int interrupt_init_iris2(struct iris_core *core)
+{
+	u32 mask_val;
+	int ret;
+
+	ret = read_register(core, WRAPPER_INTR_MASK_IRIS2, &mask_val);
+	if (ret)
+		return ret;
+
+	mask_val &= ~(WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS2 |
+			WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS2);
+	ret = write_register(core, WRAPPER_INTR_MASK_IRIS2, mask_val);
+
+	return ret;
+}
+
+static int setup_ucregion_memory_map_iris2(struct iris_core *core)
+{
+	int ret;
+	u32 value;
+
+	value = (u32)core->iface_q_table.device_addr;
+	ret = write_register(core, UC_REGION_ADDR_IRIS2, value);
+	if (ret)
+		return ret;
+
+	value = SHARED_QSIZE;
+	ret = write_register(core, UC_REGION_SIZE_IRIS2, value);
+	if (ret)
+		return ret;
+
+	value = (u32)core->iface_q_table.device_addr;
+	ret = write_register(core, QTBL_ADDR_IRIS2, value);
+	if (ret)
+		return ret;
+
+	ret = write_register(core, QTBL_INFO_IRIS2, 0x01);
+	if (ret)
+		return ret;
+
+	value = (u32)((u64)core->iface_q_table.kernel_vaddr);
+	ret = write_register(core, CPU_CS_VCICMDARG0_IRIS2, value);
+	if (ret)
+		return ret;
+
+	value = (u32)((u64)core->iface_q_table.kernel_vaddr >> 32);
+	ret = write_register(core, CPU_CS_VCICMDARG1_IRIS2, value);
+	if (ret)
+		return ret;
+
+	if (core->sfr.device_addr) {
+		value = (u32)core->sfr.device_addr + VIDEO_ARCH_LX;
+		ret = write_register(core, SFR_ADDR_IRIS2, value);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+static int switch_vcodec_gdsc_mode(struct iris_core *core, bool sw_mode)
+{
+	void __iomem *base_addr;
+	u32 val = 0;
+	int ret;
+
+	base_addr = core->reg_base;
+
+	if (sw_mode) {
+		writel_relaxed(0, base_addr + WRAPPER_CORE_POWER_CONTROL);
+		ret = readl_relaxed_poll_timeout(base_addr + WRAPPER_CORE_POWER_STATUS, val,
+						 val & BIT(1), 1, 200);
+		if (ret)
+			return ret;
+	} else {
+		writel_relaxed(1, base_addr + WRAPPER_CORE_POWER_CONTROL);
+		ret = readl_relaxed_poll_timeout(base_addr + WRAPPER_CORE_POWER_STATUS, val,
+						 !(val & BIT(1)), 1, 200);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int boot_firmware_iris2(struct iris_core *core)
+{
+	u32 ctrl_init = 0, ctrl_status = 0, count = 0, max_tries = 1000;
+	int ret;
+
+	ret = setup_ucregion_memory_map_iris2(core);
+	if (ret)
+		return ret;
+
+	ctrl_init = BIT(0);
+
+	ret = write_register(core, CTRL_INIT_IRIS2, ctrl_init);
+	if (ret)
+		return ret;
+
+	while (!ctrl_status && count < max_tries) {
+		ret = read_register(core, CTRL_STATUS_IRIS2, &ctrl_status);
+		if (ret)
+			return ret;
+
+		if ((ctrl_status & CTRL_ERROR_STATUS__M_IRIS2) == 0x4) {
+			dev_err(core->dev, "invalid setting for UC_REGION\n");
+			break;
+		}
+
+		usleep_range(50, 100);
+		count++;
+	}
+
+	if (count >= max_tries) {
+		dev_err(core->dev, "Error booting up vidc firmware\n");
+		return -ETIME;
+	}
+
+	ret = write_register(core, CPU_CS_H2XSOFTINTEN_IRIS2, 0x1);
+	if (ret)
+		return ret;
+
+	ret = write_register(core, CPU_CS_X2RPMH_IRIS2, 0x0);
+
+	return ret;
+}
+
+static int raise_interrupt_iris2(struct iris_core *core)
+{
+	return write_register(core, CPU_IC_SOFTINT_IRIS2, 1 << CPU_IC_SOFTINT_H2A_SHFT_IRIS2);
+}
+
+static int clear_interrupt_iris2(struct iris_core *core)
+{
+	u32 intr_status = 0, mask = 0;
+	int ret;
+
+	ret = read_register(core, WRAPPER_INTR_STATUS_IRIS2, &intr_status);
+	if (ret)
+		return ret;
+
+	mask = (WRAPPER_INTR_STATUS_A2H_BMSK_IRIS2 |
+		WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS2 |
+		CTRL_INIT_IDLE_MSG_BMSK_IRIS2);
+
+	if (intr_status & mask) {
+		core->intr_status |= intr_status;
+		core->reg_count++;
+	} else {
+		core->spur_count++;
+	}
+
+	ret = write_register(core, CPU_CS_A2HSOFTINTCLR_IRIS2, 1);
+
+	return ret;
+}
+
+static int watchdog_iris2(struct iris_core *core, u32 intr_status)
+{
+	if (intr_status & WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS2) {
+		dev_err(core->dev, "%s: received watchdog interrupt\n", __func__);
+		return -ETIME;
+	}
+
+	return 0;
+}
+
+static bool is_iris2_hw_power_collapsed(struct iris_core *core)
+{
+	u32 value = 0, pwr_status = 0;
+	int ret;
+
+	ret = read_register(core, WRAPPER_CORE_POWER_STATUS, &value);
+	if (ret)
+		return false;
+
+	pwr_status = value & BIT(1);
+
+	return pwr_status ? false : true;
+}
+
+static int power_off_iris2_hardware(struct iris_core *core)
+{
+	u32 value = 0;
+	int ret, i;
+
+	if (is_iris2_hw_power_collapsed(core))
+		goto disable_power;
+
+	dev_err(core->dev, "Video hw is power ON\n");
+
+	ret = read_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS2, &value);
+	if (ret)
+		goto disable_power;
+
+	if (value) {
+		ret = write_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS2, 0);
+		if (ret)
+			goto disable_power;
+	}
+
+	for (i = 0; i < core->cap[NUM_VPP_PIPE].value; i++) {
+		ret = read_register_with_poll_timeout(core, VCODEC_SS_IDLE_STATUSN + 4 * i,
+						      0x400000, 0x400000, 2000, 20000);
+	}
+
+	ret = write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x3);
+	if (ret)
+		goto disable_power;
+	ret = write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x2);
+	if (ret)
+		goto disable_power;
+	ret = write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x0);
+	if (ret)
+		goto disable_power;
+
+disable_power:
+	ret = disable_power_domains(core, "vcodec0");
+	if (ret) {
+		dev_err(core->dev, "disable power domain vcodec failed\n");
+		ret = 0;
+	}
+
+	disable_unprepare_clock(core, "vcodec_bus");
+	if (ret) {
+		dev_err(core->dev, "disable unprepare vcodec_bus failed\n");
+		ret = 0;
+	}
+
+	disable_unprepare_clock(core, "vcodec_core");
+	if (ret) {
+		dev_err(core->dev, "disable unprepare vcodec_core failed\n");
+		ret = 0;
+	}
+
+	return ret;
+}
+
+static int power_off_iris2_controller(struct iris_core *core)
+{
+	int ret;
+
+	ret = write_register(core, CPU_CS_X2RPMH_IRIS2, 0x3);
+	if (ret)
+		goto disable_power;
+
+	ret = write_register(core, WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS2, 0x7);
+	if (ret)
+		goto disable_power;
+
+	ret = read_register_with_poll_timeout(core, WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS2,
+					      0x7, 0x7, 200, 2000);
+
+	ret = write_register(core, WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS2, 0x0);
+	if (ret)
+		goto disable_power;
+
+	ret = read_register_with_poll_timeout(core, WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS2,
+					      0xffffffff, 0x0, 200, 2000);
+
+disable_power:
+	ret = disable_unprepare_clock(core, "core");
+	if (ret) {
+		dev_err(core->dev, "disable unprepare core_clk failed\n");
+		ret = 0;
+	}
+
+	ret = disable_unprepare_clock(core, "iface");
+	if (ret) {
+		dev_err(core->dev, "disable unprepare iface failed\n");
+		ret = 0;
+	}
+
+	ret = disable_unprepare_clock(core, "bus");
+	if (ret) {
+		dev_err(core->dev, "disable unprepare bus failed\n");
+		ret = 0;
+	}
+
+	reset_ahb2axi_bridge(core);
+
+	ret = disable_power_domains(core, "venus");
+
+	if (ret) {
+		dev_err(core->dev, "%s: disable power domain venus failed\n", __func__);
+		ret = 0;
+	}
+
+	return ret;
+}
+
+static int power_off_iris2(struct iris_core *core)
+{
+	if (!core->power_enabled)
+		return 0;
+
+	opp_set_rate(core, 0);
+	power_off_iris2_hardware(core);
+	power_off_iris2_controller(core);
+	unvote_buses(core);
+
+	if (!call_vpu_op(core, watchdog, core, core->intr_status))
+		disable_irq_nosync(core->irq);
+
+	core->power_enabled = false;
+
+	return 0;
+}
+
+static int power_on_iris2_controller(struct iris_core *core)
+{
+	int ret;
+
+	ret = enable_power_domains(core, "venus");
+	if (ret)
+		return ret;
+
+	ret = reset_ahb2axi_bridge(core);
+	if (ret)
+		goto err_disable_power;
+
+	ret = prepare_enable_clock(core, "bus");
+	if (ret)
+		goto err_disable_power;
+
+	ret = prepare_enable_clock(core, "iface");
+	if (ret)
+		goto err_disable_bus;
+
+	ret = prepare_enable_clock(core, "core");
+	if (ret)
+		goto err_disable_iface;
+
+	return ret;
+
+err_disable_iface:
+	disable_unprepare_clock(core, "iface");
+err_disable_bus:
+	disable_unprepare_clock(core, "bus");
+err_disable_power:
+	disable_power_domains(core, "venus");
+
+	return ret;
+}
+
+static int power_on_iris2_hardware(struct iris_core *core)
+{
+	int ret;
+
+	ret = enable_power_domains(core, "vcodec0");
+	if (ret)
+		return ret;
+
+	ret = switch_vcodec_gdsc_mode(core, true);
+	if (ret)
+		goto err_disable_power;
+
+	ret = prepare_enable_clock(core, "vcodec_bus");
+	if (ret)
+		goto err_gdsc_switch;
+
+	ret = prepare_enable_clock(core, "vcodec_core");
+	if (ret)
+		goto err_disable_bus;
+
+	ret = switch_vcodec_gdsc_mode(core, false);
+	if (ret)
+		goto err_disable_clock;
+
+	return ret;
+
+err_disable_clock:
+	disable_unprepare_clock(core, "vcodec_core");
+err_disable_bus:
+	disable_unprepare_clock(core, "vcodec_bus");
+err_gdsc_switch:
+	switch_vcodec_gdsc_mode(core, false);
+err_disable_power:
+	disable_power_domains(core, "vcodec0");
+
+	return ret;
+}
+
+static int power_on_iris2(struct iris_core *core)
+{
+	u32 freq = 0;
+	int ret;
+
+	if (core->power_enabled)
+		return 0;
+
+	if (!core_in_valid_state(core))
+		return -EINVAL;
+
+	ret = vote_buses(core, INT_MAX);
+	if (ret)
+		goto err;
+
+	ret = power_on_iris2_controller(core);
+	if (ret)
+		goto err_unvote_bus;
+
+	ret = power_on_iris2_hardware(core);
+	if (ret)
+		goto err_power_off_ctrl;
+
+	core->power_enabled = true;
+
+	freq = core->power.clk_freq ? core->power.clk_freq :
+				      (u32)ULONG_MAX;
+
+	opp_set_rate(core, freq);
+
+	set_preset_registers(core);
+
+	interrupt_init_iris2(core);
+	core->intr_status = 0;
+	enable_irq(core->irq);
+
+	return ret;
+
+err_power_off_ctrl:
+	power_off_iris2_controller(core);
+err_unvote_bus:
+	unvote_buses(core);
+err:
+	core->power_enabled = false;
+
+	return ret;
+}
+
+static int prepare_pc_iris2(struct iris_core *core)
+{
+	u32 wfi_status = 0, idle_status = 0, pc_ready = 0;
+	u32 ctrl_status = 0;
+	int ret;
+
+	ret = read_register(core, CTRL_STATUS_IRIS2, &ctrl_status);
+	if (ret)
+		return ret;
+
+	pc_ready = ctrl_status & CTRL_STATUS_PC_READY_IRIS2;
+	idle_status = ctrl_status & BIT(30);
+
+	if (pc_ready)
+		return 0;
+
+	ret = read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (ret)
+		return ret;
+
+	wfi_status &= BIT(0);
+	if (!wfi_status || !idle_status)
+		goto skip_power_off;
+
+	ret = prepare_pc(core);
+	if (ret)
+		goto skip_power_off;
+
+	ret = read_register_with_poll_timeout(core, CTRL_STATUS_IRIS2,
+					      CTRL_STATUS_PC_READY_IRIS2,
+					      CTRL_STATUS_PC_READY_IRIS2, 250, 2500);
+	if (ret)
+		goto skip_power_off;
+
+	ret = read_register_with_poll_timeout(core, WRAPPER_TZ_CPU_STATUS,
+					      BIT(0), 0x1, 250, 2500);
+	if (ret)
+		goto skip_power_off;
+
+	return ret;
+
+skip_power_off:
+	ret = read_register(core, CTRL_STATUS_IRIS2, &ctrl_status);
+	if (ret)
+		return ret;
+
+	ret = read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (ret)
+		return ret;
+
+	wfi_status &= BIT(0);
+	dev_err(core->dev, "Skip PC, wfi=%#x, idle=%#x, pcr=%#x, ctrl=%#x)\n",
+		wfi_status, idle_status, pc_ready, ctrl_status);
+
+	return -EAGAIN;
+}
+
+static const struct vpu_ops iris2_ops = {
+	.boot_firmware = boot_firmware_iris2,
+	.raise_interrupt = raise_interrupt_iris2,
+	.clear_interrupt = clear_interrupt_iris2,
+	.watchdog = watchdog_iris2,
+	.power_on = power_on_iris2,
+	.power_off = power_off_iris2,
+	.prepare_pc = prepare_pc_iris2,
+};
+
+static const struct vpu_session_ops iris2_session_ops = {
+	.int_buf_size = iris_int_buf_size_iris2,
+	.calc_freq = iris_calc_freq_iris2,
+	.calc_bw = iris_calc_bw_iris2,
+};
+
+int init_iris2(struct iris_core *core)
+{
+	core->vpu_ops = &iris2_ops;
+	core->session_ops = &iris2_session_ops;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris2.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris2.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _VPU_IRIS2_H_
+#define _VPU_IRIS2_H_
+
+#include "iris_core.h"
+
+int init_iris2(struct iris_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris2_buffer.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris2_buffer.c
@@ -0,0 +1,423 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_core.h"
+#include "iris_helpers.h"
+#include "iris_instance.h"
+#include "vpu_iris2_buffer.h"
+
+static u32 dec_bin_size_iris2(struct iris_inst *inst)
+{
+	u32 width, height, num_vpp_pipes;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+
+	f = inst->fmt_src;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_bin_h264d(width, height, DEFAULT_BSE_VPP_DELAY, num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_bin_h265d(width, height, DEFAULT_BSE_VPP_DELAY, num_vpp_pipes);
+	else if (inst->codec == VP9)
+		size = hfi_buffer_bin_vp9d(width, height,
+					   num_vpp_pipes);
+	return size;
+}
+
+static u32 dec_comv_size_iris2(struct iris_inst *inst)
+{
+	u32 width, height, num_comv;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	f = inst->fmt_src;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	num_comv = inst->buffers.output.min_count;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_comv_h264d(width, height, num_comv);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_comv_h265d(width, height, num_comv);
+
+	inst->cap[NUM_COMV].value = num_comv;
+
+	return size;
+}
+
+static u32 dec_non_comv_size_iris2(struct iris_inst *inst)
+{
+	u32 width, height, num_vpp_pipes;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+
+	f = inst->fmt_src;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_non_comv_h264d(width, height, num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_non_comv_h265d(width, height, num_vpp_pipes);
+
+	return size;
+}
+
+static u32 dec_line_size_iris2(struct iris_inst *inst)
+{
+	u32 width, height, out_min_count, num_vpp_pipes;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+	bool is_opb;
+
+	core = inst->core;
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+
+	is_opb = true;
+
+	f = inst->fmt_src;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	out_min_count = inst->buffers.output.min_count;
+	if (inst->codec == H264)
+		size = hfi_buffer_line_h264d(width, height, is_opb,
+					     num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_line_h265d(width, height, is_opb,
+					     num_vpp_pipes);
+	else if (inst->codec == VP9)
+		size = hfi_buffer_line_vp9d(width, height, out_min_count,
+					    is_opb, num_vpp_pipes);
+	return size;
+}
+
+static u32 dec_persist_size_iris2(struct iris_inst *inst)
+{
+	u32 size = 0;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_persist_h264d(0);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_persist_h265d(0);
+	else if (inst->codec == VP9)
+		size = hfi_buffer_persist_vp9d();
+
+	return size;
+}
+
+static u32 dec_dpb_size_iris2(struct iris_inst *inst)
+{
+	struct v4l2_format *f;
+	u32 width, height;
+	u32 color_fmt;
+	u32 size = 0;
+
+	f = inst->fmt_dst;
+	color_fmt = f->fmt.pix_mp.pixelformat;
+	if (!is_linear_colorformat(color_fmt))
+		return size;
+
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (color_fmt == V4L2_PIX_FMT_NV12 ||
+	    color_fmt == V4L2_PIX_FMT_QC08C) {
+		size =
+		hfi_nv12_ubwc_il_calc_buf_size_v2(width, height,
+						  ALIGN(width, 128),
+						  ALIGN(height, 32),
+						  ALIGN(width, 128),
+						  ALIGN((height + 1) >> 1, 32),
+						  ALIGN(DIV_ROUND_UP(width, 32), 64),
+						  ALIGN(DIV_ROUND_UP(height, 8), 16),
+						  ALIGN(DIV_ROUND_UP((width + 1) >> 1, 16), 64),
+						  ALIGN(DIV_ROUND_UP((height + 1) >> 1, 8), 16));
+	} else if (color_fmt == V4L2_PIX_FMT_QC10C) {
+		size =
+		hfi_yuv420_tp10_ubwc_calc_buf_size(ALIGN(ALIGN(width, 192) * 4 / 3, 256),
+						   ALIGN(height, 16),
+						   ALIGN(ALIGN(width, 192) * 4 / 3, 256),
+						   ALIGN((height + 1) >> 1, 16),
+						   ALIGN(DIV_ROUND_UP(width, 48), 64),
+						   ALIGN(DIV_ROUND_UP(height, 4), 16),
+						   ALIGN(DIV_ROUND_UP((width + 1) >> 1, 24), 64),
+						   ALIGN(DIV_ROUND_UP((height + 1) >> 1, 4), 16));
+	}
+
+	return size;
+}
+
+static u32 enc_bin_size_iris2(struct iris_inst *inst)
+{
+	u32 width, height, num_vpp_pipes, stage, profile;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+	stage = inst->cap[STAGE].value;
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	profile = inst->cap[PROFILE].value;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_bin_h264e(inst->hfi_rc_type, width, height,
+					    stage, num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_bin_h265e(inst->hfi_rc_type, width, height,
+					    stage, num_vpp_pipes);
+
+	return size;
+}
+
+u32 get_recon_buf_count_iris2(struct iris_inst *inst)
+{
+	s32 n_bframe, ltr_count, hp_layers = 0, hb_layers = 0;
+	bool is_hybrid_hp = false;
+	u32 num_buf_recon = 0;
+	u32 hfi_codec = 0;
+
+	n_bframe = inst->cap[B_FRAME].value;
+	ltr_count = inst->cap[LTR_COUNT].value;
+
+	if (inst->hfi_layer_type == HFI_HIER_B) {
+		hb_layers = inst->cap[ENH_LAYER_COUNT].value + 1;
+	} else {
+		hp_layers = inst->cap[ENH_LAYER_COUNT].value + 1;
+		if (inst->hfi_layer_type == HFI_HIER_P_HYBRID_LTR)
+			is_hybrid_hp = true;
+	}
+
+	if (inst->codec == H264)
+		hfi_codec = HFI_CODEC_ENCODE_AVC;
+	else if (inst->codec == HEVC)
+		hfi_codec = HFI_CODEC_ENCODE_HEVC;
+
+	num_buf_recon = hfi_iris2_enc_recon_buf_count(n_bframe, ltr_count,
+						      hp_layers, hb_layers,
+						      is_hybrid_hp, hfi_codec);
+
+	return num_buf_recon;
+}
+
+static u32 enc_comv_size_iris2(struct iris_inst *inst)
+{
+	u32 width, height, num_recon = 0;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	num_recon = get_recon_buf_count_iris2(inst);
+	if (inst->codec == H264)
+		size = hfi_buffer_comv_h264e(width, height, num_recon);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_comv_h265e(width, height, num_recon);
+
+	return size;
+}
+
+static u32 enc_non_comv_size_iris2(struct iris_inst *inst)
+{
+	u32 width, height, num_vpp_pipes;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_non_comv_h264e(width, height, num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_non_comv_h265e(width, height, num_vpp_pipes);
+
+	return size;
+}
+
+static u32 enc_line_size_iris2(struct iris_inst *inst)
+{
+	u32 width, height, pixfmt, num_vpp_pipes;
+	struct iris_core *core;
+	bool is_tenbit = false;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+	pixfmt = inst->cap[PIX_FMTS].value;
+
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	is_tenbit = (pixfmt == FMT_TP10C);
+
+	if (inst->codec == H264)
+		size = hfi_buffer_line_h264e(width, height, is_tenbit, num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_line_h265e(width, height, is_tenbit, num_vpp_pipes);
+
+	return size;
+}
+
+static u32 enc_dpb_size_iris2(struct iris_inst *inst)
+{
+	u32 width, height, pixfmt;
+	struct v4l2_format *f;
+	bool is_tenbit;
+	u32 size = 0;
+
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	pixfmt = inst->cap[PIX_FMTS].value;
+	is_tenbit = (pixfmt == FMT_TP10C);
+
+	if (inst->codec == H264)
+		size = hfi_buffer_dpb_h264e(width, height);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_dpb_h265e(width, height, is_tenbit);
+
+	return size;
+}
+
+static u32 enc_arp_size_iris2(struct iris_inst *inst)
+{
+	u32 size = 0;
+
+	HFI_BUFFER_ARP_ENC(size);
+
+	return size;
+}
+
+static u32 enc_vpss_size_iris2(struct iris_inst *inst)
+{
+	bool ds_enable = false, is_tenbit = false;
+	struct v4l2_format *f;
+	u32 width, height;
+	u32 size = 0;
+
+	ds_enable = is_scaling_enabled(inst);
+
+	f = inst->fmt_dst;
+	if (inst->cap[ROTATION].value == 90 ||
+	    inst->cap[ROTATION].value == 270) {
+		width = f->fmt.pix_mp.height;
+		height = f->fmt.pix_mp.width;
+	} else {
+		width = f->fmt.pix_mp.width;
+		height = f->fmt.pix_mp.height;
+	}
+
+	f = inst->fmt_src;
+	is_tenbit = is_10bit_colorformat(f->fmt.pix_mp.pixelformat);
+
+	size = hfi_buffer_vpss_enc(width, height, ds_enable, 0, is_tenbit);
+
+	return size;
+}
+
+u32 enc_output_buffer_size_iris2(struct iris_inst *inst)
+{
+	u32 hfi_rc_type = HFI_RC_VBR_CFR;
+	enum codec_type codec;
+	int bitrate_mode, frame_rc;
+	bool is_ten_bit = false;
+	struct v4l2_format *f;
+	u32 frame_size;
+
+	f = inst->fmt_dst;
+	codec = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat);
+	if (codec == HEVC)
+		is_ten_bit = true;
+
+	bitrate_mode = inst->cap[BITRATE_MODE].value;
+	frame_rc = inst->cap[FRAME_RC_ENABLE].value;
+	if (!frame_rc)
+		hfi_rc_type = HFI_RC_OFF;
+	else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_CQ)
+		hfi_rc_type = HFI_RC_CQ;
+
+	frame_size = hfi_buffer_bitstream_enc_iris2(f->fmt.pix_mp.width,
+						    f->fmt.pix_mp.height,
+						    hfi_rc_type, is_ten_bit);
+
+	return frame_size;
+}
+
+struct iris_buf_type_handle {
+	enum iris_buffer_type type;
+	u32 (*handle)(struct iris_inst *inst);
+};
+
+int iris_int_buf_size_iris2(struct iris_inst *inst,
+			    enum iris_buffer_type buffer_type)
+{
+	const struct iris_buf_type_handle *buf_type_handle_arr = NULL;
+	u32 size = 0, buf_type_handle_size = 0;
+	int i;
+
+	static const struct iris_buf_type_handle dec_internal_buf_type_handle[] = {
+		{BUF_BIN,             dec_bin_size_iris2          },
+		{BUF_COMV,            dec_comv_size_iris2         },
+		{BUF_NON_COMV,        dec_non_comv_size_iris2     },
+		{BUF_LINE,            dec_line_size_iris2         },
+		{BUF_PERSIST,         dec_persist_size_iris2      },
+		{BUF_DPB,             dec_dpb_size_iris2          },
+	};
+	static const struct iris_buf_type_handle enc_internal_buf_type_handle[] = {
+		{BUF_BIN,             enc_bin_size_iris2          },
+		{BUF_COMV,            enc_comv_size_iris2         },
+		{BUF_NON_COMV,        enc_non_comv_size_iris2     },
+		{BUF_LINE,            enc_line_size_iris2         },
+		{BUF_DPB,             enc_dpb_size_iris2          },
+		{BUF_ARP,             enc_arp_size_iris2          },
+		{BUF_VPSS,            enc_vpss_size_iris2         },
+	};
+
+	if (inst->domain == DECODER) {
+		buf_type_handle_size = ARRAY_SIZE(dec_internal_buf_type_handle);
+		buf_type_handle_arr = dec_internal_buf_type_handle;
+	} else if (inst->domain == ENCODER) {
+		buf_type_handle_size = ARRAY_SIZE(enc_internal_buf_type_handle);
+		buf_type_handle_arr = enc_internal_buf_type_handle;
+	}
+
+	if (!buf_type_handle_arr || !buf_type_handle_size)
+		return size;
+
+	for (i = 0; i < buf_type_handle_size; i++) {
+		if (buf_type_handle_arr[i].type == buffer_type) {
+			size = buf_type_handle_arr[i].handle(inst);
+			break;
+		}
+	}
+
+	return size;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris2_buffer.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris2_buffer.h
@@ -0,0 +1,1494 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _VPU_IRIS2_BUFFER_H_
+#define _VPU_IRIS2_BUFFER_H_
+
+#include <linux/types.h>
+#include <linux/minmax.h>
+#include <linux/align.h>
+
+#include "iris_instance.h"
+
+#define DMA_ALIGNMENT 256
+
+#define BUFFER_ALIGNMENT_4096_BYTES 4096
+#define BUFFER_ALIGNMENT_512_BYTES 512
+#define BUFFER_ALIGNMENT_256_BYTES 256
+#define BUFFER_ALIGNMENT_128_BYTES 128
+#define BUFFER_ALIGNMENT_64_BYTES 64
+#define BUFFER_ALIGNMENT_32_BYTES 32
+#define BUFFER_ALIGNMENT_16_BYTES 16
+
+#define HFI_ALIGNMENT_4096 (4096)
+
+#define HFI_COL_FMT_NV12C_Y_TILE_HEIGHT (8)
+#define HFI_COL_FMT_NV12C_Y_TILE_WIDTH (32)
+#define HFI_COL_FMT_NV12C_UV_TILE_HEIGHT (8)
+#define HFI_COL_FMT_NV12C_UV_TILE_WIDTH (16)
+#define HFI_COL_FMT_TP10C_Y_TILE_HEIGHT (4)
+#define HFI_COL_FMT_TP10C_Y_TILE_WIDTH (48)
+
+#define NUM_HW_PIC_BUF 32
+#define SIZE_HW_PIC(size_per_buf) (NUM_HW_PIC_BUF * (size_per_buf))
+
+#define MAX_TILE_COLUMNS 32
+
+#define LCU_MAX_SIZE_PELS 64
+#define LCU_MIN_SIZE_PELS 16
+
+#define HDR10_HIST_EXTRADATA_SIZE (4 * 1024)
+
+#define BIN_BUFFER_THRESHOLD (1280 * 736)
+
+#define VPP_CMD_MAX_SIZE (BIT(20))
+
+#define H264D_MAX_SLICE 1800
+
+#define SIZE_H264D_BUFTAB_T (256)
+#define SIZE_H264D_HW_PIC_T (BIT(11))
+#define SIZE_H264D_BSE_CMD_PER_BUF (32 * 4)
+#define SIZE_H264D_VPP_CMD_PER_BUF (512)
+
+#define NUM_SLIST_BUF_H264 (256 + 32)
+#define SIZE_SLIST_BUF_H264 (512)
+#define H264_DISPLAY_BUF_SIZE (3328)
+#define H264_NUM_FRM_INFO (66)
+
+#define H265_NUM_TILE_COL 32
+#define H265_NUM_TILE_ROW 128
+#define H265_NUM_TILE (H265_NUM_TILE_ROW * H265_NUM_TILE_COL + 1)
+#define SIZE_H265D_BSE_CMD_PER_BUF (16 * sizeof(u32))
+
+#define NUM_SLIST_BUF_H265 (80 + 20)
+#define SIZE_SLIST_BUF_H265 (BIT(10))
+#define H265_DISPLAY_BUF_SIZE (3072)
+#define H265_NUM_FRM_INFO (48)
+
+#define VP9_NUM_FRAME_INFO_BUF 32
+#define VP9_NUM_PROBABILITY_TABLE_BUF (VP9_NUM_FRAME_INFO_BUF + 4)
+#define VP9_PROB_TABLE_SIZE (3840)
+#define VP9_FRAME_INFO_BUF_SIZE (6144)
+
+#define VP9_UDC_HEADER_BUF_SIZE (3 * 128)
+#define MAX_SUPERFRAME_HEADER_LEN (34)
+#define CCE_TILE_OFFSET_SIZE ALIGN(32 * 4 * 4, BUFFER_ALIGNMENT_32_BYTES)
+
+#define SIZE_SEI_USERDATA (4096)
+#define SIZE_DOLBY_RPU_METADATA (41 * 1024)
+
+#define H264_CABAC_HDR_RATIO_HD_TOT 1
+#define H264_CABAC_RES_RATIO_HD_TOT 3
+
+#define H265D_MAX_SLICE 1200
+#define SIZE_H265D_HW_PIC_T SIZE_H264D_HW_PIC_T
+#define H265_CABAC_HDR_RATIO_HD_TOT 2
+#define H265_CABAC_RES_RATIO_HD_TOT 2
+#define SIZE_H265D_VPP_CMD_PER_BUF (256)
+
+#define VPX_DECODER_FRAME_CONCURENCY_LVL (2)
+#define VPX_DECODER_FRAME_BIN_HDR_BUDGET 1
+#define VPX_DECODER_FRAME_BIN_RES_BUDGET 3
+#define VPX_DECODER_FRAME_BIN_DENOMINATOR 2
+
+#define VPX_DECODER_FRAME_BIN_RES_BUDGET_RATIO (3 / 2)
+
+#define MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE 64
+
+#define MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE (128 / 8)
+
+#define MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE (64 * 2 * 3)
+#define MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE 640
+
+#define HFI_BUFFER_ARP_ENC(size) (size = 204800)
+
+#define HFI_MAX_COL_FRAME 6
+#define HFI_VENUS_WIDTH_ALIGNMENT 128
+#define HFI_VENUS_HEIGHT_ALIGNMENT 32
+#define VENUS_METADATA_STRIDE_MULTIPLE 64
+#define VENUS_METADATA_HEIGHT_MULTIPLE 16
+
+#ifndef SYSTEM_LAL_TILE10
+#define SYSTEM_LAL_TILE10 192
+#endif
+
+#define SIZE_SLICE_CMD_BUFFER (ALIGN(20480, BUFFER_ALIGNMENT_256_BYTES))
+#define SIZE_SPS_PPS_SLICE_HDR (2048 + 4096)
+
+#define SIZE_BSE_SLICE_CMD_BUF ((((8192 << 2) + 7) & (~7)) * 3)
+#define SIZE_LAMBDA_LUT (256 * 11)
+
+#define HFI_WORKMODE_1 1
+#define HFI_WORKMODE_2 2
+
+static inline
+u32 size_h264d_hw_bin_buffer(u32 frame_width, u32 frame_height,
+			     u32 delay, u32 num_vpp_pipes)
+{
+	u32 size_yuv, size_bin_hdr, size_bin_res;
+
+	size_yuv = ((frame_width * frame_height) <= BIN_BUFFER_THRESHOLD) ?
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) :
+			((frame_width * frame_height * 3) >> 1);
+	size_bin_hdr = size_yuv * H264_CABAC_HDR_RATIO_HD_TOT;
+	size_bin_res = size_yuv * H264_CABAC_RES_RATIO_HD_TOT;
+	size_bin_hdr = size_bin_hdr * (((((u32)(delay)) & 31) / 10) + 2) / 2;
+	size_bin_res = size_bin_res * (((((u32)(delay)) & 31) / 10) + 2) / 2;
+	size_bin_hdr = ALIGN(size_bin_hdr / num_vpp_pipes,
+			     DMA_ALIGNMENT) * num_vpp_pipes;
+	size_bin_res = ALIGN(size_bin_res / num_vpp_pipes,
+			     DMA_ALIGNMENT) * num_vpp_pipes;
+
+	return size_bin_hdr + size_bin_res;
+}
+
+static inline
+u32 hfi_buffer_bin_h264d(u32 frame_width, u32 frame_height,
+			 u32 delay, u32 num_vpp_pipes)
+{
+	u32 n_aligned_w, n_aligned_h;
+
+	n_aligned_w =
+		ALIGN(frame_width, BUFFER_ALIGNMENT_16_BYTES);
+	n_aligned_h =
+		ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES);
+
+	return size_h264d_hw_bin_buffer(n_aligned_w, n_aligned_h,
+					delay, num_vpp_pipes);
+}
+
+static inline
+u32 size_h265d_hw_bin_buffer(u32 frame_width, u32 frame_height,
+			     u32 delay, u32 num_vpp_pipes)
+{
+	u32 size_yuv, size_bin_hdr, size_bin_res;
+
+	size_yuv = ((frame_width * frame_height) <= BIN_BUFFER_THRESHOLD) ?
+		((BIN_BUFFER_THRESHOLD * 3) >> 1) :
+		((frame_width * frame_height * 3) >> 1);
+	size_bin_hdr = size_yuv * H265_CABAC_HDR_RATIO_HD_TOT;
+	size_bin_res = size_yuv * H265_CABAC_RES_RATIO_HD_TOT;
+	size_bin_hdr = size_bin_hdr *
+		(((((u32)(delay)) & 31) / 10) + 2) / 2;
+	size_bin_res = size_bin_res *
+		(((((u32)(delay)) & 31) / 10) + 2) / 2;
+	size_bin_hdr = ALIGN(size_bin_hdr / num_vpp_pipes, DMA_ALIGNMENT) *
+			num_vpp_pipes;
+	size_bin_res = ALIGN(size_bin_res / num_vpp_pipes, DMA_ALIGNMENT) *
+			num_vpp_pipes;
+
+	return size_bin_hdr + size_bin_res;
+}
+
+static inline
+u32 hfi_buffer_bin_h265d(u32 frame_width, u32 frame_height,
+			 u32 delay, u32 num_vpp_pipes)
+{
+	u32 n_aligned_w, n_aligned_h;
+
+	n_aligned_w = ALIGN(frame_width, BUFFER_ALIGNMENT_16_BYTES);
+	n_aligned_h = ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES);
+	return size_h265d_hw_bin_buffer(n_aligned_w, n_aligned_h,
+					delay, num_vpp_pipes);
+}
+
+static inline
+u32 hfi_buffer_bin_vp9d(u32 frame_width, u32 frame_height,
+			u32 num_vpp_pipes)
+{
+	u32 _size_yuv, _size;
+
+	_size_yuv = ALIGN(frame_width, BUFFER_ALIGNMENT_16_BYTES) *
+		ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES) * 3 / 2;
+	_size = ALIGN(((max_t(u32, _size_yuv, ((BIN_BUFFER_THRESHOLD * 3) >> 1)) *
+			VPX_DECODER_FRAME_BIN_HDR_BUDGET / VPX_DECODER_FRAME_BIN_DENOMINATOR *
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes),
+		      DMA_ALIGNMENT) +
+		ALIGN(((max_t(u32, _size_yuv, ((BIN_BUFFER_THRESHOLD * 3) >> 1)) *
+			VPX_DECODER_FRAME_BIN_RES_BUDGET / VPX_DECODER_FRAME_BIN_DENOMINATOR *
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes),
+		      DMA_ALIGNMENT);
+
+	return _size * num_vpp_pipes;
+}
+
+static inline
+u32 hfi_buffer_comv_h264d(u32 frame_width, u32 frame_height,
+			  u32 _yuv_bufcount_min)
+{
+	u32 frame_width_in_mbs = ((frame_width + 15) >> 4);
+	u32 frame_height_in_mbs = ((frame_height + 15) >> 4);
+	u32 col_mv_aligned_width = (frame_width_in_mbs << 7);
+	u32 col_zero_aligned_width = (frame_width_in_mbs << 2);
+	u32 col_zero_size = 0, size_colloc = 0;
+
+	col_mv_aligned_width =
+		ALIGN(col_mv_aligned_width, BUFFER_ALIGNMENT_16_BYTES);
+	col_zero_aligned_width =
+		ALIGN(col_zero_aligned_width, BUFFER_ALIGNMENT_16_BYTES);
+	col_zero_size = col_zero_aligned_width *
+			((frame_height_in_mbs + 1) >> 1);
+	col_zero_size =
+		ALIGN(col_zero_size, BUFFER_ALIGNMENT_64_BYTES);
+	col_zero_size <<= 1;
+	col_zero_size =
+		ALIGN(col_zero_size, BUFFER_ALIGNMENT_512_BYTES);
+	size_colloc = col_mv_aligned_width *
+			((frame_height_in_mbs + 1) >> 1);
+	size_colloc =
+		ALIGN(size_colloc, BUFFER_ALIGNMENT_64_BYTES);
+	size_colloc <<= 1;
+	size_colloc =
+		ALIGN(size_colloc, BUFFER_ALIGNMENT_512_BYTES);
+	size_colloc += (col_zero_size + SIZE_H264D_BUFTAB_T * 2);
+
+	return (size_colloc * (_yuv_bufcount_min)) +
+		BUFFER_ALIGNMENT_512_BYTES;
+}
+
+static inline
+u32 hfi_buffer_comv_h265d(u32 frame_width, u32 frame_height,
+			  u32 _yuv_bufcount_min)
+{
+	u32 _size;
+
+	_size = ALIGN(((((frame_width + 15) >> 4) *
+		       ((frame_height + 15) >> 4)) << 8),
+		     BUFFER_ALIGNMENT_512_BYTES);
+	_size *= _yuv_bufcount_min;
+	_size += BUFFER_ALIGNMENT_512_BYTES;
+
+	return _size;
+}
+
+static inline
+u32 size_h264d_bse_cmd_buf(u32 frame_width, u32 frame_height)
+{
+	u32 _height = ALIGN(frame_height,
+			    BUFFER_ALIGNMENT_32_BYTES);
+	return min_t(u32, (((_height + 15) >> 4) * 3 * 4), H264D_MAX_SLICE) *
+		SIZE_H264D_BSE_CMD_PER_BUF;
+}
+
+static inline
+u32 size_h264d_vpp_cmd_buf(u32 frame_width, u32 frame_height)
+{
+	u32 _size, _height;
+
+	_height = ALIGN(frame_height, BUFFER_ALIGNMENT_32_BYTES);
+	_size = min_t(u32, (((_height + 15) >> 4) * 3 * 4), H264D_MAX_SLICE) *
+			SIZE_H264D_VPP_CMD_PER_BUF;
+
+	if (_size > VPP_CMD_MAX_SIZE)
+		_size = VPP_CMD_MAX_SIZE;
+
+	return _size;
+}
+
+static inline
+u32 hfi_buffer_non_comv_h264d(u32 frame_width, u32 frame_height,
+			      u32 num_vpp_pipes)
+{
+	u32 _size_bse, _size_vpp, _size;
+
+	_size_bse = size_h264d_bse_cmd_buf(frame_width, frame_height);
+	_size_vpp = size_h264d_vpp_cmd_buf(frame_width, frame_height);
+	_size = ALIGN(_size_bse, DMA_ALIGNMENT) +
+		ALIGN(_size_vpp, DMA_ALIGNMENT) +
+		ALIGN(SIZE_HW_PIC(SIZE_H264D_HW_PIC_T), DMA_ALIGNMENT);
+
+	return ALIGN(_size, DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_h265d_bse_cmd_buf(u32 frame_width, u32 frame_height)
+{
+	u32 _size;
+
+	_size = ALIGN(((ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS) *
+		      (ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS)) *
+		     NUM_HW_PIC_BUF, DMA_ALIGNMENT);
+	_size = min_t(u32, _size, H265D_MAX_SLICE + 1);
+	_size = 2 * _size * SIZE_H265D_BSE_CMD_PER_BUF;
+
+	return _size;
+}
+
+static inline
+u32 size_h265d_vpp_cmd_buf(u32 frame_width, u32 frame_height)
+{
+	u32 _size;
+
+	_size = ALIGN(((ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS) *
+		      (ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS)) *
+		     NUM_HW_PIC_BUF, DMA_ALIGNMENT);
+	_size = min_t(u32, _size, H265D_MAX_SLICE + 1);
+	_size = ALIGN(_size, 4);
+	_size = 2 * _size * SIZE_H265D_VPP_CMD_PER_BUF;
+	if (_size > VPP_CMD_MAX_SIZE)
+		_size = VPP_CMD_MAX_SIZE;
+
+	return _size;
+}
+
+static inline
+u32 hfi_buffer_non_comv_h265d(u32 frame_width, u32 frame_height,
+			      u32 num_vpp_pipes)
+{
+	u32 _size_bse, _size_vpp, _size;
+
+	_size_bse = size_h265d_bse_cmd_buf(frame_width, frame_height);
+	_size_vpp = size_h265d_vpp_cmd_buf(frame_width, frame_height);
+	_size = ALIGN(_size_bse, DMA_ALIGNMENT) +
+		ALIGN(_size_vpp, DMA_ALIGNMENT) +
+		ALIGN(NUM_HW_PIC_BUF * 20 * 22 * 4, DMA_ALIGNMENT) +
+		ALIGN(2 * sizeof(u16) *
+		      (ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS) *
+		      (ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS),
+		      DMA_ALIGNMENT) +
+		ALIGN(SIZE_HW_PIC(SIZE_H265D_HW_PIC_T),
+		      DMA_ALIGNMENT) +
+		HDR10_HIST_EXTRADATA_SIZE;
+
+	return ALIGN(_size, DMA_ALIGNMENT);
+}
+
+static inline u32 size_h264d_lb_fe_top_data(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE * ALIGN(frame_width, 16) * 3;
+}
+
+static inline u32 size_h264d_lb_fe_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_fe_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_se_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_se_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_pe_top_data(u32 frame_width, u32 frame_height)
+{
+	return MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE *  ((frame_width + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_vsp_top(u32 frame_width, u32 frame_height)
+{
+	return (((frame_width + 15) >> 4) << 7);
+}
+
+static inline u32 size_h264d_lb_recon_dma_metadata_wr(u32 frame_width, u32 frame_height)
+{
+	return ALIGN(frame_height, 16) * 32;
+}
+
+static inline u32 size_h264d_qp(u32 frame_width, u32 frame_height)
+{
+	return ((frame_width + 63) >> 6) * ((frame_height + 63) >> 6) * 128;
+}
+
+static inline
+u32 size_vpss_lb(u32 frame_width, u32 frame_height, u32 num_vpp_pipes)
+{
+	u32 vpss_4tap_left_buffer_size = 0, vpss_div2_left_buffer_size = 0;
+	u32 vpss_4tap_top_buffer_size = 0, vpss_div2_top_buffer_size = 0;
+	u32 opb_lb_wr_llb_y_buffer_size, opb_lb_wr_llb_uv_buffer_size;
+	u32 opb_wr_top_line_chroma_buffer_size;
+	u32 opb_wr_top_line_luma_buffer_size;
+	u32 macrotiling_size = 32, size;
+
+	opb_wr_top_line_luma_buffer_size =
+		ALIGN(frame_width, macrotiling_size) /
+		macrotiling_size * 256;
+	opb_wr_top_line_luma_buffer_size =
+		ALIGN(opb_wr_top_line_luma_buffer_size, DMA_ALIGNMENT) +
+		(MAX_TILE_COLUMNS - 1) * 256;
+	opb_wr_top_line_luma_buffer_size =
+		max_t(u32, opb_wr_top_line_luma_buffer_size,
+		      (32 * ALIGN(frame_height, 8)));
+	opb_wr_top_line_chroma_buffer_size =
+		opb_wr_top_line_luma_buffer_size;
+	opb_lb_wr_llb_uv_buffer_size =
+		ALIGN((ALIGN(frame_height, 8) / (4 / 2)) * 64,
+		      BUFFER_ALIGNMENT_32_BYTES);
+	opb_lb_wr_llb_y_buffer_size =
+		ALIGN((ALIGN(frame_height, 8) / (4 / 2)) * 64,
+		      BUFFER_ALIGNMENT_32_BYTES);
+	size = num_vpp_pipes * 2 *
+		(vpss_4tap_top_buffer_size + vpss_div2_top_buffer_size) +
+		2 * (vpss_4tap_left_buffer_size + vpss_div2_left_buffer_size) +
+		opb_wr_top_line_luma_buffer_size +
+		opb_wr_top_line_chroma_buffer_size +
+		opb_lb_wr_llb_uv_buffer_size +
+		opb_lb_wr_llb_y_buffer_size;
+
+	return size;
+}
+
+static inline
+u32 hfi_buffer_line_h264d(u32 frame_width, u32 frame_height,
+			  bool is_opb, u32 num_vpp_pipes)
+{
+	u32 vpss_lb_size = 0;
+	u32 _size;
+
+	_size = ALIGN(size_h264d_lb_fe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_fe_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_fe_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h264d_lb_se_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_se_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h264d_lb_pe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_vsp_top(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_recon_dma_metadata_wr(frame_width, frame_height),
+		      DMA_ALIGNMENT) * 2 +
+		ALIGN(size_h264d_qp(frame_width, frame_height),
+		      DMA_ALIGNMENT);
+	_size = ALIGN(_size, DMA_ALIGNMENT);
+	if (is_opb)
+		vpss_lb_size = size_vpss_lb(frame_width, frame_height,
+					    num_vpp_pipes);
+
+	_size = ALIGN((_size + vpss_lb_size),
+		      DMA_ALIGNMENT);
+
+	return _size;
+}
+
+static inline
+u32 size_h265d_lb_fe_top_data(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE *
+		(ALIGN(frame_width, 64) + 8) * 2;
+}
+
+static inline
+u32 size_h265d_lb_fe_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE *
+		(ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS);
+}
+
+static inline
+u32 size_h265d_lb_fe_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE *
+		(ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS);
+}
+
+static inline
+u32 size_h265d_lb_se_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return (LCU_MAX_SIZE_PELS / 8 * (128 / 8)) * ((frame_width + 15) >> 4);
+}
+
+static inline
+u32 size_h265d_lb_se_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return max_t(u32, ((frame_height + 16 - 1) / 8) *
+		     MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,
+		     max_t(u32, ((frame_height + 32 - 1) / 8) *
+			   MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE,
+			   ((frame_height + 64 - 1) / 8) *
+			   MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE));
+}
+
+static inline
+u32 size_h265d_lb_pe_top_data(u32 frame_width, u32 frame_height)
+{
+	return MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE *
+		(ALIGN(frame_width, LCU_MIN_SIZE_PELS) / LCU_MIN_SIZE_PELS);
+}
+
+static inline
+u32 size_h265d_lb_vsp_top(u32 frame_width, u32 frame_height)
+{
+	return ((frame_width + 63) >> 6) * 128;
+}
+
+static inline
+u32 size_h265d_lb_vsp_left(u32 frame_width, u32 frame_height)
+{
+	return ((frame_height + 63) >> 6) * 128;
+}
+
+static inline
+u32 size_h265d_lb_recon_dma_metadata_wr(u32 frame_width, u32 frame_height)
+{
+	return size_h264d_lb_recon_dma_metadata_wr(frame_width, frame_height);
+}
+
+static inline
+u32 size_h265d_qp(u32 frame_width, u32 frame_height)
+{
+	return size_h264d_qp(frame_width, frame_height);
+}
+
+static inline
+u32 hfi_buffer_line_h265d(u32 frame_width, u32 frame_height,
+			  bool is_opb, u32 num_vpp_pipes)
+{
+	u32 vpss_lb_size = 0, _size;
+
+	_size = ALIGN(size_h265d_lb_fe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_fe_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_fe_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h265d_lb_se_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h265d_lb_se_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_pe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_vsp_top(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_vsp_left(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h265d_lb_recon_dma_metadata_wr(frame_width, frame_height),
+		      DMA_ALIGNMENT) * 4 +
+		ALIGN(size_h265d_qp(frame_width, frame_height),
+		      DMA_ALIGNMENT);
+	if (is_opb)
+		vpss_lb_size = size_vpss_lb(frame_width, frame_height, num_vpp_pipes);
+
+	return ALIGN((_size + vpss_lb_size), DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_vpxd_lb_fe_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return max_t(u32, ((frame_height + 15) >> 4) * MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,
+		     max_t(u32, ((frame_height + 31) >> 5) * MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE,
+			   ((frame_height + 63) >> 6) * MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE));
+}
+
+static inline
+u32 size_vpxd_lb_fe_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return ((ALIGN(frame_width, 64) + 8) * 10 * 2);
+}
+
+static inline
+u32 size_vpxd_lb_se_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return ((frame_width + 15) >> 4) * MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE;
+}
+
+static inline
+u32 size_vpxd_lb_se_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return max_t(u32, ((frame_height + 15) >> 4) * MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,
+		     max_t(u32, ((frame_height + 31) >> 5) * MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE,
+			   ((frame_height + 63) >> 6) * MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE));
+}
+
+static inline
+u32 size_vpxd_lb_recon_dma_metadata_wr(u32 frame_width, u32 frame_height)
+{
+	return ALIGN((ALIGN(frame_height, 8) / (4 / 2)) * 64,
+		     BUFFER_ALIGNMENT_32_BYTES);
+}
+
+static inline
+u32 size_mp2d_lb_fe_top_data(u32 frame_width, u32 frame_height)
+{
+	return ((ALIGN(frame_width, 16) + 8) * 10 * 2);
+}
+
+static inline
+u32 size_vp9d_lb_fe_top_data(u32 frame_width, u32 frame_height)
+{
+	return (ALIGN(ALIGN(frame_width, 8), 64) + 8) * 10 * 2;
+}
+
+static inline
+u32 size_vp9d_lb_pe_top_data(u32 frame_width, u32 frame_height)
+{
+	return ((ALIGN(ALIGN(frame_width, 8), 64) >> 6) * 176);
+}
+
+static inline
+u32 size_vp9d_lb_vsp_top(u32 frame_width, u32 frame_height)
+{
+	return (((ALIGN(ALIGN(frame_width, 8), 64) >> 6) * 64 * 8) + 256);
+}
+
+static inline u32 hfi_iris2_vp9d_comv_size(void)
+{
+	return (((8192 + 63) >> 6) * ((4320 + 63) >> 6) * 8 * 8 * 2 * 8);
+}
+
+static inline
+u32 size_vp9d_qp(u32 frame_width, u32 frame_height)
+{
+	return size_h264d_qp(frame_width, frame_height);
+}
+
+static inline
+u32 hfi_iris2_vp9d_lb_size(u32 frame_width, u32 frame_height,
+			   u32 num_vpp_pipes)
+{
+	return ALIGN(size_vpxd_lb_fe_left_ctrl(frame_width, frame_height),
+		     DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_vpxd_lb_se_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_vp9d_lb_vsp_top(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_vpxd_lb_fe_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		2 * ALIGN(size_vpxd_lb_recon_dma_metadata_wr(frame_width, frame_height),
+			  DMA_ALIGNMENT) +
+		ALIGN(size_vpxd_lb_se_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_vp9d_lb_pe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_vp9d_lb_fe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_vp9d_qp(frame_width, frame_height),
+		      DMA_ALIGNMENT);
+}
+
+static inline
+u32 hfi_buffer_line_vp9d(u32 frame_width, u32 frame_height,
+			 u32 _yuv_bufcount_min, bool is_opb,
+			 u32 num_vpp_pipes)
+{
+	u32 vpss_lb_size = 0;
+	u32 _lb_size = 0;
+
+	_lb_size = hfi_iris2_vp9d_lb_size(frame_width, frame_height,
+					  num_vpp_pipes);
+
+	if (is_opb)
+		vpss_lb_size = size_vpss_lb(frame_width, frame_height,
+					    num_vpp_pipes);
+
+	return _lb_size + vpss_lb_size;
+}
+
+static inline u32 hfi_buffer_persist_h264d(u32 rpu_enabled)
+{
+	return ALIGN(SIZE_SLIST_BUF_H264 * NUM_SLIST_BUF_H264 +
+		    NUM_HW_PIC_BUF * SIZE_SEI_USERDATA,
+		    DMA_ALIGNMENT);
+}
+
+static inline
+u32 hfi_buffer_persist_h265d(u32 rpu_enabled)
+{
+	return ALIGN(SIZE_SLIST_BUF_H265 * NUM_SLIST_BUF_H265 +
+		      H265_NUM_TILE * sizeof(u32) +
+		      NUM_HW_PIC_BUF * SIZE_SEI_USERDATA,
+		     DMA_ALIGNMENT);
+}
+
+static inline u32 hfi_buffer_persist_vp9d(void)
+{
+	return ALIGN(VP9_NUM_PROBABILITY_TABLE_BUF * VP9_PROB_TABLE_SIZE,
+		     DMA_ALIGNMENT) +
+		ALIGN(hfi_iris2_vp9d_comv_size(), DMA_ALIGNMENT) +
+		ALIGN(MAX_SUPERFRAME_HEADER_LEN, DMA_ALIGNMENT) +
+		ALIGN(VP9_UDC_HEADER_BUF_SIZE, DMA_ALIGNMENT) +
+		ALIGN(VP9_NUM_FRAME_INFO_BUF * CCE_TILE_OFFSET_SIZE,
+		      DMA_ALIGNMENT) +
+		HDR10_HIST_EXTRADATA_SIZE;
+}
+
+static inline
+u32 hfi_nv12_ubwc_il_calc_y_buf_size(u32 frame_width, u32 frame_height,
+				     u32 stride_multiple,
+				     u32 min_buf_height_multiple)
+{
+	u32 stride, buf_height;
+
+	stride = ALIGN(frame_width, stride_multiple);
+	buf_height = ALIGN(frame_height, min_buf_height_multiple);
+
+	return ALIGN(stride * buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_nv12_ubwc_il_calc_uv_buf_size(u32 frame_width, u32 frame_height,
+				      u32 stride_multiple,
+				      u32 min_buf_height_multiple)
+{
+	u32 uv_stride, uv_buf_height;
+
+	uv_stride = ALIGN(frame_width, stride_multiple);
+	uv_buf_height = ALIGN(((frame_height + 1) >> 1),
+			      min_buf_height_multiple);
+
+	return ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_ubwc_calc_metadata_plane_stride(u32 frame_width,
+					u32 metadata_stride_multiple,
+					u32 tile_width_in_pels)
+{
+	return ALIGN(((frame_width + (tile_width_in_pels - 1)) / tile_width_in_pels),
+		     metadata_stride_multiple);
+}
+
+static inline
+u32 hfi_ubwc_metadata_plane_bufheight(u32 frame_height,
+				      u32 metadata_height_multiple,
+				      u32 tile_height_in_pels)
+{
+	return ALIGN(((frame_height + (tile_height_in_pels - 1)) / tile_height_in_pels),
+		     metadata_height_multiple);
+}
+
+static inline
+u32 hfi_ubwc_uv_metadata_plane_stride(u32 frame_width,
+				      u32 metadata_stride_multiple,
+				      u32 tile_width_in_pels)
+{
+	return ALIGN(((((frame_width + 1) >> 1) + tile_width_in_pels - 1) /
+		      tile_width_in_pels), metadata_stride_multiple);
+}
+
+static inline
+u32 hfi_ubwc_uv_metadata_plane_bufheight(u32 frame_height,
+					 u32 metadata_height_multiple,
+					 u32 tile_height_in_pels)
+{
+	return ALIGN(((((frame_height + 1) >> 1) + tile_height_in_pels - 1) /
+		      tile_height_in_pels), metadata_height_multiple);
+}
+
+static inline
+u32 hfi_ubwc_metadata_plane_buffer_size(u32 _metadata_tride, u32 _metadata_buf_height)
+{
+	return ALIGN(_metadata_tride * _metadata_buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_nv12_ubwc_il_calc_buf_size_v2(u32 frame_width,
+				      u32 frame_height,
+				      u32 y_stride_multiple,
+				      u32 y_buffer_height_multiple,
+				      u32 uv_stride_multiple,
+				      u32 uv_buffer_height_multiple,
+				      u32 y_metadata_stride_multiple,
+				      u32 y_metadata_buffer_height_multiple,
+				      u32 uv_metadata_stride_multiple,
+				      u32 uv_metadata_buffer_height_multiple)
+{
+	u32 y_buf_size, uv_buf_size, y_meta_size, uv_meta_size;
+	u32 half_height = (frame_height + 1) >> 1;
+	u32 stride, _height;
+
+	y_buf_size =
+		hfi_nv12_ubwc_il_calc_y_buf_size(frame_width, half_height,
+						 y_stride_multiple,
+						 y_buffer_height_multiple);
+	uv_buf_size =
+		hfi_nv12_ubwc_il_calc_uv_buf_size(frame_width, half_height,
+						  uv_stride_multiple,
+						  uv_buffer_height_multiple);
+	stride =
+		hfi_ubwc_calc_metadata_plane_stride(frame_width,
+						    y_metadata_stride_multiple,
+						    HFI_COL_FMT_NV12C_Y_TILE_WIDTH);
+	_height =
+		hfi_ubwc_metadata_plane_bufheight(half_height,
+						  y_metadata_buffer_height_multiple,
+						  HFI_COL_FMT_NV12C_Y_TILE_HEIGHT);
+	y_meta_size = hfi_ubwc_metadata_plane_buffer_size(stride, _height);
+	stride =
+		hfi_ubwc_uv_metadata_plane_stride(frame_width,
+						  uv_metadata_stride_multiple,
+						  HFI_COL_FMT_NV12C_UV_TILE_WIDTH);
+	_height =
+		hfi_ubwc_uv_metadata_plane_bufheight(half_height,
+						     uv_metadata_buffer_height_multiple,
+						     HFI_COL_FMT_NV12C_UV_TILE_HEIGHT);
+	uv_meta_size = hfi_ubwc_metadata_plane_buffer_size(stride, _height);
+
+	return (y_buf_size + uv_buf_size + y_meta_size + uv_meta_size) << 1;
+}
+
+static inline
+u32 hfi_yuv420_tp10_ubwc_calc_y_buf_size(u32 y_stride,
+					 u32 y_buf_height)
+{
+	return ALIGN(y_stride * y_buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_yuv420_tp10_ubwc_calc_uv_buf_size(u32 uv_stride,
+					  u32 uv_buf_height)
+{
+	return ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_yuv420_tp10_ubwc_calc_buf_size(u32 y_stride, u32 y_buf_height,
+				       u32 uv_stride, u32 uv_buf_height,
+				       u32 y_md_stride, u32 y_md_height,
+				       u32 uv_md_stride, u32 uv_md_height)
+{
+	u32 y_data_size, uv_data_size, y_md_size, uv_md_size;
+
+	y_data_size = hfi_yuv420_tp10_ubwc_calc_y_buf_size(y_stride, y_buf_height);
+	uv_data_size = hfi_yuv420_tp10_ubwc_calc_uv_buf_size(uv_stride, uv_buf_height);
+	y_md_size = hfi_ubwc_metadata_plane_buffer_size(y_md_stride, y_md_height);
+	uv_md_size = hfi_ubwc_metadata_plane_buffer_size(uv_md_stride, uv_md_height);
+
+	return y_data_size + uv_data_size + y_md_size + uv_md_size;
+}
+
+int iris_int_buf_size_iris2(struct iris_inst *inst,
+			    enum iris_buffer_type buffer_type);
+
+static inline
+u32 hfi_buffer_bitstream_enc_iris2(u32 frame_width, u32 frame_height,
+				   u32 rc_type, bool is_ten_bit)
+{
+	u32 aligned_width, aligned_height, bitstream_size;
+
+	aligned_width = ALIGN(frame_width, 32);
+	aligned_height = ALIGN(frame_height, 32);
+	bitstream_size = aligned_width * aligned_height * 3;
+
+	if (aligned_width * aligned_height > (4096 * 2176))
+		bitstream_size = (bitstream_size >> 3);
+	else if (bitstream_size > (1280 * 720))
+		bitstream_size = (bitstream_size >> 2);
+	else
+		bitstream_size = (bitstream_size << 1);
+
+	if ((rc_type == HFI_RC_CQ || rc_type == HFI_RC_OFF))
+		bitstream_size = (bitstream_size << 1);
+
+	if (is_ten_bit)
+		bitstream_size = (bitstream_size) + (bitstream_size >> 2);
+
+	return ALIGN(bitstream_size, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_iris2_enc_recon_buf_count(s32 n_bframe, s32 ltr_count,
+				  s32 _total_hp_layers,
+				  s32 _total_hb_layers,
+				  bool hybrid_hp,
+				  u32 codec_standard)
+{
+	u32 num_ref = 1;
+
+	if (n_bframe)
+		num_ref = 2;
+
+	if (_total_hp_layers > 1) {
+		if (hybrid_hp)
+			num_ref = (_total_hp_layers + 1) >> 1;
+		else if (codec_standard == HFI_CODEC_ENCODE_HEVC)
+			num_ref = (_total_hp_layers + 1) >> 1;
+		else if (codec_standard == HFI_CODEC_ENCODE_AVC &&
+			 _total_hp_layers < 4)
+			num_ref = (_total_hp_layers - 1);
+		else
+			num_ref = _total_hp_layers;
+	}
+
+	if (ltr_count)
+		num_ref = num_ref + ltr_count;
+
+	if (_total_hb_layers > 1) {
+		if (codec_standard == HFI_CODEC_ENCODE_HEVC)
+			num_ref = (_total_hb_layers);
+		else if (codec_standard == HFI_CODEC_ENCODE_AVC)
+			num_ref = (1 << (_total_hb_layers - 2)) + 1;
+	}
+
+	return num_ref + 1;
+}
+
+static inline
+u32 size_bin_bitstream_enc(u32 rc_type, u32 frame_width, u32 frame_height,
+			   u32 work_mode, u32 lcu_size)
+{
+	u32 size_aligned_width = 0, size_aligned_height = 0;
+	u32 bitstream_size_eval = 0;
+
+	size_aligned_width = ALIGN((frame_width), lcu_size);
+	size_aligned_height = ALIGN((frame_height), lcu_size);
+	if (work_mode == HFI_WORKMODE_2) {
+		if (rc_type == HFI_RC_CQ || rc_type == HFI_RC_OFF) {
+			bitstream_size_eval = (((size_aligned_width) *
+						(size_aligned_height) * 3) >> 1);
+		} else {
+			bitstream_size_eval = ((size_aligned_width) *
+					       (size_aligned_height) * 3);
+			if ((size_aligned_width * size_aligned_height) > (4096 * 2176))
+				bitstream_size_eval >>= 3;
+			else if ((size_aligned_width * size_aligned_height) > (480 * 320))
+				bitstream_size_eval >>= 2;
+
+			if (lcu_size == 32)
+				bitstream_size_eval = (bitstream_size_eval * 5 >> 2);
+		}
+	} else {
+		bitstream_size_eval = size_aligned_width * size_aligned_height * 3;
+	}
+
+	return ALIGN(bitstream_size_eval, BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_enc_single_pipe(u32 rc_type, u32 bitbin_size, u32 num_vpp_pipes,
+			 u32 frame_width, u32 frame_height, u32 lcu_size)
+{
+	u32 size_single_pipe_eval = 0, sao_bin_buffer_size = 0;
+	u32 size_aligned_width = 0, size_aligned_height = 0;
+	u32 _padded_bin_sz = 0;
+
+	size_aligned_width = ALIGN((frame_width), lcu_size);
+	size_aligned_height = ALIGN((frame_height), lcu_size);
+	if ((size_aligned_width * size_aligned_height) > (3840 * 2160))
+		size_single_pipe_eval = (bitbin_size / num_vpp_pipes);
+	else if (num_vpp_pipes > 2)
+		size_single_pipe_eval = bitbin_size / 2;
+	else
+		size_single_pipe_eval = bitbin_size;
+
+	sao_bin_buffer_size =
+		(64 * ((((frame_width) + BUFFER_ALIGNMENT_32_BYTES) *
+			((frame_height) + BUFFER_ALIGNMENT_32_BYTES)) >> 10)) + 384;
+	_padded_bin_sz = ALIGN(size_single_pipe_eval, BUFFER_ALIGNMENT_256_BYTES);
+	size_single_pipe_eval = sao_bin_buffer_size + _padded_bin_sz;
+	size_single_pipe_eval = ALIGN(size_single_pipe_eval, BUFFER_ALIGNMENT_256_BYTES);
+
+	return size_single_pipe_eval;
+}
+
+static inline
+u32 hfi_buffer_bin_enc(u32 rc_type, u32 frame_width, u32 frame_height, u32 lcu_size,
+		       u32 work_mode, u32 num_vpp_pipes)
+{
+	u32 bitstream_size = 0, total_bitbin_buffers = 0;
+	u32 size_single_pipe = 0, bitbin_size = 0;
+	u32 _size = 0;
+
+	bitstream_size = size_bin_bitstream_enc(rc_type, frame_width,
+						frame_height, work_mode,
+						lcu_size);
+
+	if (work_mode == HFI_WORKMODE_2) {
+		total_bitbin_buffers = 3;
+		bitbin_size = bitstream_size * 17 / 10;
+		bitbin_size = ALIGN(bitbin_size, DMA_ALIGNMENT);
+	} else if ((lcu_size == 16) || (num_vpp_pipes > 1)) {
+		total_bitbin_buffers = 1;
+		bitbin_size = bitstream_size;
+	}
+
+	if (total_bitbin_buffers > 0) {
+		size_single_pipe = size_enc_single_pipe(rc_type, bitbin_size,
+							num_vpp_pipes, frame_width,
+							frame_height, lcu_size);
+		bitbin_size = size_single_pipe * num_vpp_pipes;
+		_size = ALIGN(bitbin_size, BUFFER_ALIGNMENT_256_BYTES) *
+			      total_bitbin_buffers + 512;
+	} else {
+		/* Avoid 512 Bytes allocation in case of 1Pipe HEVC Direct Mode*/
+		_size = 0;
+	}
+
+	return _size;
+}
+
+static inline
+u32 hfi_buffer_bin_h264e(u32 rc_type, u32 frame_width, u32 frame_height,
+			 u32 work_mode, u32 num_vpp_pipes)
+{
+	return hfi_buffer_bin_enc(rc_type, frame_width, frame_height, 16,
+				  work_mode, num_vpp_pipes);
+}
+
+static inline
+u32 hfi_buffer_bin_h265e(u32 rc_type, u32 frame_width, u32 frame_height,
+			 u32 work_mode, u32 num_vpp_pipes)
+{
+	return hfi_buffer_bin_enc(rc_type, frame_width, frame_height, 32,
+				  work_mode, num_vpp_pipes);
+}
+
+static inline
+u32 size_enc_slice_info_buf(u32 num_lcu_in_frame)
+{
+	return ALIGN((256 + (num_lcu_in_frame << 4)), DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_line_buf_ctrl(u32 frame_width_coded)
+{
+	return ALIGN(frame_width_coded, DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_line_buf_ctrl_id2(u32 frame_width_coded)
+{
+	return ALIGN(frame_width_coded, DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_linebuff_data(bool is_ten_bit, u32 frame_width_coded)
+{
+	u32 _size = 0;
+
+	_size = is_ten_bit ?
+		(((((10 * (frame_width_coded) + 1024) + (DMA_ALIGNMENT - 1)) &
+		   (~(DMA_ALIGNMENT - 1))) * 1) +
+		 (((((10 * (frame_width_coded) + 1024) >> 1) + (DMA_ALIGNMENT - 1)) &
+		   (~(DMA_ALIGNMENT - 1))) * 2)) :
+		(((((8 * (frame_width_coded) + 1024) + (DMA_ALIGNMENT - 1)) &
+		   (~(DMA_ALIGNMENT - 1))) * 1) +
+		 (((((8 * (frame_width_coded) + 1024) >> 1) + (DMA_ALIGNMENT - 1)) &
+		   (~(DMA_ALIGNMENT - 1))) * 2));
+
+	return _size;
+}
+
+static inline
+u32 size_left_linebuff_ctrl(u32 standard, u32 frame_height_coded,
+			    u32 num_vpp_pipes_enc)
+{
+	u32 _size = 0;
+
+	_size = standard == HFI_CODEC_ENCODE_HEVC ?
+		(((frame_height_coded) +
+		 (BUFFER_ALIGNMENT_32_BYTES)) / BUFFER_ALIGNMENT_32_BYTES * 4 * 16) :
+		(((frame_height_coded) + 15) / 16 * 5 * 16);
+
+	if ((num_vpp_pipes_enc) > 1) {
+		_size += BUFFER_ALIGNMENT_512_BYTES;
+		_size = ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) *
+			num_vpp_pipes_enc;
+	}
+
+	return ALIGN(_size, BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_left_linebuff_recon_pix(bool is_ten_bit, u32 frame_height_coded,
+				 u32 num_vpp_pipes_enc)
+{
+	return (((is_ten_bit + 1) * 2 * (frame_height_coded) + BUFFER_ALIGNMENT_256_BYTES) +
+		(BUFFER_ALIGNMENT_256_BYTES << (num_vpp_pipes_enc - 1)) - 1) &
+		(~((BUFFER_ALIGNMENT_256_BYTES << (num_vpp_pipes_enc - 1)) - 1)) * 1;
+}
+
+static inline
+u32 size_top_linebuff_ctrl_fe(u32 frame_width_coded, u32 standard)
+{
+	u32 _size = 0;
+
+	_size = standard == HFI_CODEC_ENCODE_HEVC ?
+		(64 * ((frame_width_coded) >> 5)) :
+		(BUFFER_ALIGNMENT_256_BYTES + 16 * ((frame_width_coded) >> 4));
+
+	return ALIGN(_size, BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_left_linebuff_ctrl_fe(u32 frame_height_coded, u32 num_vpp_pipes_enc)
+{
+	return (((BUFFER_ALIGNMENT_256_BYTES + 64 * ((frame_height_coded) >> 4)) +
+		 (BUFFER_ALIGNMENT_256_BYTES << (num_vpp_pipes_enc - 1)) - 1) &
+		 (~((BUFFER_ALIGNMENT_256_BYTES << (num_vpp_pipes_enc - 1)) - 1)) * 1) *
+		num_vpp_pipes_enc;
+}
+
+static inline
+u32 size_left_linebuff_metadata_recon_y(u32 frame_height_coded,
+					bool is_ten_bit,
+					u32 num_vpp_pipes_enc)
+{
+	u32 _size = 0;
+
+	_size = ((DMA_ALIGNMENT + 64 * ((frame_height_coded) /
+		  (8 * (is_ten_bit ? 4 : 8)))));
+	_size = ALIGN(_size, DMA_ALIGNMENT);
+
+	return (_size * num_vpp_pipes_enc);
+}
+
+static inline
+u32 size_left_linebuff_metadata_recon_uv(u32 frame_height_coded,
+					 bool is_ten_bit,
+					 u32 num_vpp_pipes_enc)
+{
+	u32 _size = 0;
+
+	_size = ((DMA_ALIGNMENT + 64 * ((frame_height_coded) /
+		  (4 * (is_ten_bit ? 4 : 8)))));
+	_size = ALIGN(_size, DMA_ALIGNMENT);
+
+	return (_size * num_vpp_pipes_enc);
+}
+
+static inline
+u32 size_linebuff_recon_pix(bool is_ten_bit, u32 frame_width_coded)
+{
+	return ALIGN(((is_ten_bit ? 3 : 2) * (frame_width_coded)),
+		     DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_frame_rc_buf_size(u32 standard, u32 frame_height_coded,
+			   u32 num_vpp_pipes_enc)
+{
+	u32 _size = 0;
+
+	_size = (standard == HFI_CODEC_ENCODE_HEVC) ?
+		(256 + 16 * (14 + ((((frame_height_coded) >> 5) + 7) >> 3))) :
+		(256 + 16 * (14 + ((((frame_height_coded) >> 4) + 7) >> 3)));
+	_size *= 11;
+	if (num_vpp_pipes_enc > 1)
+		_size = ALIGN(_size, BUFFER_ALIGNMENT_256_BYTES) * num_vpp_pipes_enc;
+
+	return ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) * HFI_MAX_COL_FRAME;
+}
+
+static inline u32 enc_bitcnt_buf_size(u32 num_lcu_in_frame)
+{
+	return ALIGN((256 + (4 * (num_lcu_in_frame))), DMA_ALIGNMENT);
+}
+
+static inline u32 enc_bitmap_buf_size(u32 num_lcu_in_frame)
+{
+	return ALIGN((256 + ((num_lcu_in_frame) >> 3)), DMA_ALIGNMENT);
+}
+
+static inline u32 size_line_buf_sde(u32 frame_width_coded)
+{
+	return ALIGN((256 + (16 * ((frame_width_coded) >> 4))), DMA_ALIGNMENT);
+}
+
+static inline u32 size_override_buf(u32 num_lcumb)
+{
+	return ALIGN(((16 * (((num_lcumb) + 7) >> 3))), DMA_ALIGNMENT) * 2;
+}
+
+static inline u32 size_ir_buf(u32 num_lcu_in_frame)
+{
+	return ALIGN((((((num_lcu_in_frame) << 1) + 7) & (~7)) * 3), DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_vpss_line_buf(u32 num_vpp_pipes_enc, u32 frame_height_coded,
+		       u32 frame_width_coded)
+{
+	return ALIGN(((((((8192) >> 2) << 5) * (num_vpp_pipes_enc)) + 64) +
+		      (((((max_t(u32, (frame_width_coded),
+				 (frame_height_coded)) + 3) >> 2) << 5) + 256) * 16)),
+		     DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_top_line_buf_first_stg_sao(u32 frame_width_coded)
+{
+	return ALIGN((16 * ((frame_width_coded) >> 5)), DMA_ALIGNMENT);
+}
+
+static inline
+u32 hfi_buffer_line_enc(u32 frame_width, u32 frame_height, bool is_ten_bit,
+			u32 num_vpp_pipes_enc, u32 lcu_size, u32 standard)
+{
+	u32 line_buff_data_size = 0, left_line_buff_ctrl_size = 0;
+	u32 frame_width_coded = 0, frame_height_coded = 0;
+	u32 left_line_buff_metadata_recon__uv__size = 0;
+	u32 left_line_buff_metadata_recon__y__size = 0;
+	u32 width_in_lcus = 0, height_in_lcus = 0;
+	u32 left_line_buff_recon_pix_size = 0;
+	u32 top_line_buff_ctrl_fe_size = 0;
+	u32 line_buff_recon_pix_size = 0;
+
+	width_in_lcus = ((frame_width) + (lcu_size) - 1) / (lcu_size);
+	height_in_lcus = ((frame_height) + (lcu_size) - 1) / (lcu_size);
+	frame_width_coded = width_in_lcus * (lcu_size);
+	frame_height_coded = height_in_lcus * (lcu_size);
+	line_buff_data_size = size_linebuff_data(is_ten_bit, frame_width_coded);
+	left_line_buff_ctrl_size =
+		size_left_linebuff_ctrl(standard, frame_height_coded, num_vpp_pipes_enc);
+	left_line_buff_recon_pix_size =
+		size_left_linebuff_recon_pix(is_ten_bit, frame_height_coded,
+					     num_vpp_pipes_enc);
+	top_line_buff_ctrl_fe_size =
+		size_top_linebuff_ctrl_fe(frame_width_coded, standard);
+	left_line_buff_metadata_recon__y__size =
+		size_left_linebuff_metadata_recon_y(frame_height_coded, is_ten_bit,
+						    num_vpp_pipes_enc);
+	left_line_buff_metadata_recon__uv__size =
+		size_left_linebuff_metadata_recon_uv(frame_height_coded, is_ten_bit,
+						     num_vpp_pipes_enc);
+	line_buff_recon_pix_size = size_linebuff_recon_pix(is_ten_bit, frame_width_coded);
+
+	return size_line_buf_ctrl(frame_width_coded) +
+		size_line_buf_ctrl_id2(frame_width_coded) +
+		line_buff_data_size +
+		left_line_buff_ctrl_size +
+		left_line_buff_recon_pix_size +
+		top_line_buff_ctrl_fe_size +
+		left_line_buff_metadata_recon__y__size +
+		left_line_buff_metadata_recon__uv__size +
+		line_buff_recon_pix_size +
+		size_left_linebuff_ctrl_fe(frame_height_coded,
+					   num_vpp_pipes_enc) +
+		size_line_buf_sde(frame_width_coded) +
+		size_vpss_line_buf(num_vpp_pipes_enc, frame_height_coded,
+				   frame_width_coded) +
+		size_top_line_buf_first_stg_sao(frame_width_coded);
+}
+
+static inline
+u32 hfi_buffer_line_h264e(u32 frame_width, u32 frame_height, bool is_ten_bit,
+			  u32 num_vpp_pipes)
+{
+	return hfi_buffer_line_enc(frame_width, frame_height, 0,
+				   num_vpp_pipes, 16,
+				   HFI_CODEC_ENCODE_AVC);
+}
+
+static inline
+u32 hfi_buffer_line_h265e(u32 frame_width, u32 frame_height, bool is_ten_bit,
+			  u32 num_vpp_pipes)
+{
+	return hfi_buffer_line_enc(frame_width, frame_height,
+				   is_ten_bit, num_vpp_pipes, 32,
+				   HFI_CODEC_ENCODE_HEVC);
+}
+
+static inline
+u32 hfi_buffer_comv_enc(u32 frame_width, u32 frame_height, u32 lcu_size,
+			u32 num_recon, u32 standard)
+{
+	u32 width_in_lcus, height_in_lcus, num_lcu_in_frame;
+	u32 size_colloc_mv = 0, size_colloc_rc = 0;
+	u32 mb_height = ((frame_height) + 15) >> 4;
+	u32 mb_width = ((frame_width) + 15) >> 4;
+
+	width_in_lcus = ((frame_width) + (lcu_size) - 1) / (lcu_size);
+	height_in_lcus = ((frame_height) + (lcu_size) - 1) / (lcu_size);
+	num_lcu_in_frame = width_in_lcus * height_in_lcus;
+	size_colloc_mv = (standard == HFI_CODEC_ENCODE_HEVC) ?
+		(16 * ((num_lcu_in_frame << 2) + BUFFER_ALIGNMENT_32_BYTES)) :
+		(3 * 16 * (width_in_lcus * height_in_lcus + BUFFER_ALIGNMENT_32_BYTES));
+	size_colloc_mv = ALIGN(size_colloc_mv, BUFFER_ALIGNMENT_256_BYTES) * num_recon;
+	size_colloc_rc = (((mb_width + 7) >> 3) * 16 * 2 * mb_height);
+	size_colloc_rc = ALIGN(size_colloc_rc, BUFFER_ALIGNMENT_256_BYTES) * HFI_MAX_COL_FRAME;
+
+	return size_colloc_mv + size_colloc_rc;
+}
+
+static inline
+u32 hfi_buffer_comv_h264e(u32 frame_width, u32 frame_height, u32 num_recon)
+{
+	return hfi_buffer_comv_enc(frame_width, frame_height, 16,
+				   num_recon, HFI_CODEC_ENCODE_AVC);
+}
+
+static inline
+u32 hfi_buffer_comv_h265e(u32 frame_width, u32 frame_height, u32 num_recon)
+{
+	return hfi_buffer_comv_enc(frame_width, frame_height, 32,
+				   num_recon, HFI_CODEC_ENCODE_HEVC);
+}
+
+static inline
+u32 hfi_buffer_non_comv_enc(u32 frame_width, u32 frame_height,
+			    u32 num_vpp_pipes_enc, u32 lcu_size, u32 standard)
+{
+	u32 frame_width_coded = 0, frame_height_coded = 0;
+	u32 width_in_lcus = 0, height_in_lcus = 0;
+	u32 num_lcu_in_frame = 0, num_lcumb = 0;
+	u32 frame_rc_buf_size = 0;
+
+	width_in_lcus = ((frame_width) + (lcu_size) - 1) / (lcu_size);
+	height_in_lcus = ((frame_height) + (lcu_size) - 1) / (lcu_size);
+	num_lcu_in_frame = width_in_lcus * height_in_lcus;
+	frame_width_coded = width_in_lcus * (lcu_size);
+	frame_height_coded = height_in_lcus * (lcu_size);
+	num_lcumb = (frame_height_coded / lcu_size) *
+		((frame_width_coded + lcu_size * 8) / lcu_size);
+	frame_rc_buf_size =
+		size_frame_rc_buf_size(standard, frame_height_coded,
+				       num_vpp_pipes_enc);
+	return size_enc_slice_info_buf(num_lcu_in_frame) +
+		   SIZE_SLICE_CMD_BUFFER +
+		   SIZE_SPS_PPS_SLICE_HDR +
+		   frame_rc_buf_size +
+		   enc_bitcnt_buf_size(num_lcu_in_frame) +
+		   enc_bitmap_buf_size(num_lcu_in_frame) +
+		   SIZE_BSE_SLICE_CMD_BUF +
+		   SIZE_LAMBDA_LUT +
+		   size_override_buf(num_lcumb) +
+		   size_ir_buf(num_lcu_in_frame);
+}
+
+static inline
+u32 hfi_buffer_non_comv_h264e(u32 frame_width, u32 frame_height,
+			      u32 num_vpp_pipes_enc)
+{
+	return hfi_buffer_non_comv_enc(frame_width, frame_height,
+				       num_vpp_pipes_enc, 16,
+				       HFI_CODEC_ENCODE_AVC);
+}
+
+static inline
+u32 hfi_buffer_non_comv_h265e(u32 frame_width, u32 frame_height,
+			      u32 num_vpp_pipes_enc)
+{
+	return hfi_buffer_non_comv_enc(frame_width, frame_height,
+				       num_vpp_pipes_enc, 32,
+				       HFI_CODEC_ENCODE_HEVC);
+}
+
+static inline
+u32 size_enc_ref_buffer(u32 frame_width, u32 frame_height)
+{
+	u32 u_buffer_width = 0, u_buffer_height = 0;
+	u32 u_chroma_buffer_height = 0;
+
+	u_buffer_height = ALIGN(frame_height, HFI_VENUS_HEIGHT_ALIGNMENT);
+	u_chroma_buffer_height = frame_height >> 1;
+	u_chroma_buffer_height = ALIGN(u_chroma_buffer_height, HFI_VENUS_HEIGHT_ALIGNMENT);
+	u_buffer_width = ALIGN(frame_width, HFI_VENUS_WIDTH_ALIGNMENT);
+
+	return (u_buffer_height + u_chroma_buffer_height) * u_buffer_width;
+}
+
+static inline
+u32 size_enc_ten_bit_ref_buffer(u32 frame_width, u32 frame_height)
+{
+	u32 ref_buf_height = 0, ref_luma_stride_in_bytes = 0;
+	u32 chroma_size = 0, ref_buf_size = 0;
+	u32 u_ref_stride = 0, luma_size = 0;
+	u32 ref_chrm_height_in_bytes = 0;
+
+	ref_buf_height = (frame_height + (HFI_VENUS_HEIGHT_ALIGNMENT - 1)) &
+			(~(HFI_VENUS_HEIGHT_ALIGNMENT - 1));
+	ref_luma_stride_in_bytes = ((frame_width + SYSTEM_LAL_TILE10 - 1) / SYSTEM_LAL_TILE10) *
+		SYSTEM_LAL_TILE10;
+	u_ref_stride = 4 * (ref_luma_stride_in_bytes / 3);
+	u_ref_stride = (u_ref_stride + (BUFFER_ALIGNMENT_128_BYTES - 1)) &
+		(~(BUFFER_ALIGNMENT_128_BYTES - 1));
+	luma_size = ref_buf_height * u_ref_stride;
+	ref_chrm_height_in_bytes = (((frame_height + 1) >> 1) + (BUFFER_ALIGNMENT_32_BYTES - 1)) &
+		(~(BUFFER_ALIGNMENT_32_BYTES - 1));
+	chroma_size = u_ref_stride * ref_chrm_height_in_bytes;
+	luma_size = (luma_size + (BUFFER_ALIGNMENT_4096_BYTES - 1)) &
+		(~(BUFFER_ALIGNMENT_4096_BYTES - 1));
+	chroma_size = (chroma_size + (BUFFER_ALIGNMENT_4096_BYTES - 1)) &
+		(~(BUFFER_ALIGNMENT_4096_BYTES - 1));
+	ref_buf_size = luma_size + chroma_size;
+
+	return ref_buf_size;
+}
+
+static inline
+u32 hfi_buffer_dpb_enc(u32 frame_width, u32 frame_height, bool is_ten_bit)
+{
+	u32 metadata_stride, metadata_buf_height, meta_size_y, meta_size_c;
+	u32 ten_bit_ref_buf_size = 0, ref_buf_size = 0;
+	u32 _size = 0;
+
+	if (!is_ten_bit) {
+		ref_buf_size = size_enc_ref_buffer(frame_width, frame_height);
+		metadata_stride =
+			hfi_ubwc_calc_metadata_plane_stride(frame_width, 64,
+							    HFI_COL_FMT_NV12C_Y_TILE_WIDTH);
+		metadata_buf_height =
+			hfi_ubwc_metadata_plane_bufheight(frame_height, 16,
+							  HFI_COL_FMT_NV12C_Y_TILE_HEIGHT);
+		meta_size_y =
+			hfi_ubwc_metadata_plane_buffer_size(metadata_stride, metadata_buf_height);
+		meta_size_c =
+			hfi_ubwc_metadata_plane_buffer_size(metadata_stride, metadata_buf_height);
+		_size = ref_buf_size + meta_size_y + meta_size_c;
+	} else {
+		ten_bit_ref_buf_size = size_enc_ten_bit_ref_buffer(frame_width, frame_height);
+		metadata_stride =
+			hfi_ubwc_calc_metadata_plane_stride(frame_width,
+							    VENUS_METADATA_STRIDE_MULTIPLE,
+							    HFI_COL_FMT_TP10C_Y_TILE_WIDTH);
+		metadata_buf_height =
+			hfi_ubwc_metadata_plane_bufheight(frame_height,
+							  VENUS_METADATA_HEIGHT_MULTIPLE,
+							  HFI_COL_FMT_TP10C_Y_TILE_HEIGHT);
+		meta_size_y =
+			hfi_ubwc_metadata_plane_buffer_size(metadata_stride, metadata_buf_height);
+		meta_size_c =
+			hfi_ubwc_metadata_plane_buffer_size(metadata_stride, metadata_buf_height);
+		_size = ten_bit_ref_buf_size + meta_size_y + meta_size_c;
+	}
+
+	return _size;
+}
+
+static inline
+u32 hfi_buffer_dpb_h264e(u32 frame_width, u32 frame_height)
+{
+	return hfi_buffer_dpb_enc(frame_width, frame_height, 0);
+}
+
+static inline
+u32 hfi_buffer_dpb_h265e(u32 frame_width, u32 frame_height, bool is_ten_bit)
+{
+	return hfi_buffer_dpb_enc(frame_width, frame_height, is_ten_bit);
+}
+
+static inline
+u32 hfi_buffer_vpss_enc(u32 dswidth, u32 dsheight, bool ds_enable,
+			u32 blur, bool is_ten_bit)
+{
+	u32 vpss_size = 0;
+
+	if (ds_enable || blur)
+		vpss_size = hfi_buffer_dpb_enc(dswidth, dsheight, is_ten_bit);
+
+	return vpss_size;
+}
+
+static inline
+u32 hfi_iris2_enc_min_input_buf_count(u32 totalhblayers)
+{
+	u32 numinput = 3;
+
+	if (totalhblayers >= 2)
+		numinput = (1 << (totalhblayers - 1)) + 2;
+
+	return numinput;
+}
+
+u32 enc_output_buffer_size_iris3(struct iris_inst *inst);
+u32 get_recon_buf_count_iris2(struct iris_inst *inst);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris2_power.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris2_power.c
@@ -0,0 +1,150 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_core.h"
+#include "iris_instance.h"
+#include "iris_helpers.h"
+#include "platform_common.h"
+#include "vpu_iris2_power.h"
+
+u64 iris_calc_freq_iris2(struct iris_inst *inst, u32 data_size)
+{
+	u32 operating_rate, vsp_factor_num = 1, vsp_factor_den = 1;
+	u64 vsp_cycles = 0, vpp_cycles = 0, fw_cycles = 0;
+	u64 fw_vpp_cycles = 0, bitrate = 0, freq = 0;
+	u32 vpp_cycles_per_mb, mbs_per_second;
+	u32 base_cycles = 0, fps, mbpf;
+	u32 height = 0, width = 0;
+	struct v4l2_format *inp_f;
+
+	inp_f = inst->fmt_src;
+	width = max(inp_f->fmt.pix_mp.width, inst->crop.width);
+	height = max(inp_f->fmt.pix_mp.height, inst->crop.height);
+
+	mbpf = NUM_MBS_PER_FRAME(height, width);
+	fps = inst->max_rate;
+	mbs_per_second = mbpf * fps;
+
+	fw_cycles = fps * inst->cap[MB_CYCLES_FW].value;
+	fw_vpp_cycles = fps * inst->cap[MB_CYCLES_FW_VPP].value;
+
+	if (inst->domain == ENCODER) {
+		vpp_cycles_per_mb =
+			inst->cap[QUALITY_MODE].value == POWER_SAVE_MODE ?
+			inst->cap[MB_CYCLES_LP].value :
+			inst->cap[MB_CYCLES_VPP].value;
+
+		vpp_cycles = mbs_per_second * vpp_cycles_per_mb / inst->cap[PIPE].value;
+
+		if (inst->cap[B_FRAME].value > 1)
+			vpp_cycles += (vpp_cycles / 4) + (vpp_cycles / 8);
+		else if (inst->cap[B_FRAME].value)
+			vpp_cycles += vpp_cycles / 4;
+
+		vpp_cycles += max(div_u64(vpp_cycles, 20), fw_vpp_cycles);
+		if (inst->cap[PIPE].value > 1)
+			vpp_cycles += div_u64(vpp_cycles, 100);
+
+		operating_rate = inst->cap[OPERATING_RATE].value >> 16;
+		if (operating_rate > (inst->cap[FRAME_RATE].value >> 16) &&
+		    (inst->cap[FRAME_RATE].value >> 16)) {
+			vsp_factor_num = operating_rate;
+			vsp_factor_den = inst->cap[FRAME_RATE].value >> 16;
+		}
+		vsp_cycles = div_u64(((u64)inst->cap[BIT_RATE].value * vsp_factor_num),
+				     vsp_factor_den);
+
+		base_cycles = inst->cap[MB_CYCLES_VSP].value;
+		if (inst->cap[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			vsp_cycles = div_u64(vsp_cycles * 135, 100);
+		} else {
+			base_cycles = 0;
+			vsp_cycles = div_u64(vsp_cycles, 2);
+		}
+		vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+		if (inst->cap[STAGE].value == STAGE_1)
+			vsp_cycles = vsp_cycles * 3;
+
+		vsp_cycles += mbs_per_second * base_cycles;
+	} else if (inst->domain == DECODER) {
+		vpp_cycles = mbs_per_second * inst->cap[MB_CYCLES_VPP].value /
+			inst->cap[PIPE].value;
+		vpp_cycles += max(vpp_cycles / 20, fw_vpp_cycles);
+
+		if (inst->cap[PIPE].value > 1)
+			vpp_cycles += div_u64(vpp_cycles * 59, 1000);
+
+		base_cycles = inst->has_bframe ?
+			80 : inst->cap[MB_CYCLES_VSP].value;
+
+		bitrate = fps * data_size * 8;
+		vsp_cycles = bitrate;
+
+		if (inst->codec == VP9) {
+			vsp_cycles = div_u64(vsp_cycles * 170, 100);
+		} else if (inst->cap[ENTROPY_MODE].value ==
+				V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			vsp_cycles = div_u64(vsp_cycles * 135, 100);
+		} else {
+			base_cycles = 0;
+			vsp_cycles = div_u64(vsp_cycles, 2);
+		}
+		vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+		if (inst->cap[STAGE].value == STAGE_1)
+			vsp_cycles = vsp_cycles * 3;
+
+		vsp_cycles += mbs_per_second * base_cycles;
+	}
+
+	freq = max3(vpp_cycles, vsp_cycles, fw_cycles);
+
+	return freq;
+}
+
+int iris_calc_bw_iris2(struct iris_inst *inst, struct bus_vote_data *data)
+{
+	const struct bw_info *bw_tbl = NULL;
+	unsigned int num_rows = 0;
+	unsigned int i, mbs, mbps;
+	struct iris_core *core;
+
+	if (!data)
+		return 0;
+
+	core = inst->core;
+
+	mbs = (ALIGN(data->height, 16) / 16) * (ALIGN(data->width, 16) / 16);
+	mbps = mbs * data->fps;
+	if (mbps == 0)
+		return 0;
+
+	if (inst->domain == DECODER) {
+		bw_tbl = core->platform_data->bw_tbl_dec;
+		num_rows = core->platform_data->bw_tbl_dec_size;
+	} else if (inst->domain == ENCODER) {
+		bw_tbl = core->platform_data->bw_tbl_enc;
+		num_rows = core->platform_data->bw_tbl_enc_size;
+	}
+
+	if (!bw_tbl || num_rows == 0)
+		return 0;
+
+	for (i = 0; i < num_rows; i++) {
+		if (i != 0 && mbps > bw_tbl[i].mbs_per_sec)
+			break;
+
+		if (is_10bit_colorformat(data->color_formats[0]))
+			data->bus_bw = bw_tbl[i].bw_ddr_10bit;
+		else
+			data->bus_bw = bw_tbl[i].bw_ddr;
+	}
+
+	dev_dbg(core->dev, "bus_bw %llu\n", data->bus_bw);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris2_power.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris2_power.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_VPU_IRIS2_POWER_H__
+#define __H_VPU_IRIS2_POWER_H__
+
+u64 iris_calc_freq_iris2(struct iris_inst *inst, u32 data_size);
+int iris_calc_bw_iris2(struct iris_inst *inst,
+		       struct bus_vote_data *vote_data);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris3.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris3.c
@@ -0,0 +1,572 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+
+#include "iris_hfi.h"
+#include "vpu_iris3.h"
+#include "vpu_iris3_buffer.h"
+#include "vpu_iris3_power.h"
+
+#define VIDEO_ARCH_LX 1
+
+#define VCODEC_BASE_OFFS_IRIS3                 0x00000000
+#define AON_MVP_NOC_RESET                      0x0001F000
+#define CPU_BASE_OFFS_IRIS3                    0x000A0000
+#define AON_BASE_OFFS                          0x000E0000
+#define CPU_CS_BASE_OFFS_IRIS3                 (CPU_BASE_OFFS_IRIS3)
+#define CPU_IC_BASE_OFFS_IRIS3                 (CPU_BASE_OFFS_IRIS3)
+
+#define CPU_CS_A2HSOFTINTCLR_IRIS3             (CPU_CS_BASE_OFFS_IRIS3 + 0x1C)
+#define CPU_CS_VCICMDARG0_IRIS3                (CPU_CS_BASE_OFFS_IRIS3 + 0x24)
+#define CPU_CS_VCICMDARG1_IRIS3                (CPU_CS_BASE_OFFS_IRIS3 + 0x28)
+/* HFI_CTRL_INIT */
+#define CPU_CS_SCIACMD_IRIS3                   (CPU_CS_BASE_OFFS_IRIS3 + 0x48)
+/* HFI_CTRL_STATUS */
+#define CPU_CS_SCIACMDARG0_IRIS3               (CPU_CS_BASE_OFFS_IRIS3 + 0x4C)
+/* HFI_QTBL_INFO */
+#define CPU_CS_SCIACMDARG1_IRIS3               (CPU_CS_BASE_OFFS_IRIS3 + 0x50)
+/* HFI_QTBL_ADDR */
+#define CPU_CS_SCIACMDARG2_IRIS3               (CPU_CS_BASE_OFFS_IRIS3 + 0x54)
+/* SFR_ADDR */
+#define CPU_CS_SCIBCMD_IRIS3                   (CPU_CS_BASE_OFFS_IRIS3 + 0x5C)
+#define CPU_CS_SCIBCMDARG0_IRIS3               (CPU_CS_BASE_OFFS_IRIS3 + 0x60)
+/* UC_REGION_ADDR */
+#define CPU_CS_SCIBARG1_IRIS3                  (CPU_CS_BASE_OFFS_IRIS3 + 0x64)
+/* UC_REGION_ADDR */
+#define CPU_CS_SCIBARG2_IRIS3                  (CPU_CS_BASE_OFFS_IRIS3 + 0x68)
+#define CPU_CS_H2XSOFTINTEN_IRIS3              (CPU_CS_BASE_OFFS_IRIS3 + 0x148)
+#define CPU_CS_AHB_BRIDGE_SYNC_RESET           (CPU_CS_BASE_OFFS_IRIS3 + 0x160)
+#define CPU_CS_X2RPMH_IRIS3                    (CPU_CS_BASE_OFFS_IRIS3 + 0x168)
+
+#define CPU_IC_SOFTINT_IRIS3                   (CPU_IC_BASE_OFFS_IRIS3 + 0x150)
+#define CPU_IC_SOFTINT_H2A_SHFT_IRIS3          0x0
+
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_INIT_IDLE_MSG_BMSK_IRIS3     0x40000000
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_ERROR_STATUS_BMSK_IRIS3	     0xfe
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_PC_READY_IRIS3               0x100
+
+#define AON_WRAPPER_MVP_NOC_RESET_REQ          (AON_MVP_NOC_RESET + 0x000)
+#define AON_WRAPPER_MVP_NOC_RESET_ACK          (AON_MVP_NOC_RESET + 0x004)
+
+#define WRAPPER_BASE_OFFS_IRIS3                0x000B0000
+#define WRAPPER_INTR_STATUS_IRIS3              (WRAPPER_BASE_OFFS_IRIS3 + 0x0C)
+#define WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS3   0x8
+#define WRAPPER_INTR_STATUS_A2H_BMSK_IRIS3     0x4
+
+#define WRAPPER_INTR_MASK_IRIS3	               (WRAPPER_BASE_OFFS_IRIS3 + 0x10)
+#define WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS3     0x8
+#define WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS3    0x4
+
+#define WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS3 (WRAPPER_BASE_OFFS_IRIS3 + 0x54)
+#define WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS3  (WRAPPER_BASE_OFFS_IRIS3 + 0x58)
+#define WRAPPER_IRIS_CPU_NOC_LPI_CONTROL       (WRAPPER_BASE_OFFS_IRIS3 + 0x5C)
+#define WRAPPER_IRIS_CPU_NOC_LPI_STATUS	       (WRAPPER_BASE_OFFS_IRIS3 + 0x60)
+#define WRAPPER_CORE_POWER_STATUS              (WRAPPER_BASE_OFFS_IRIS3 + 0x80)
+#define WRAPPER_CORE_CLOCK_CONFIG_IRIS3        (WRAPPER_BASE_OFFS_IRIS3 + 0x88)
+
+#define WRAPPER_TZ_BASE_OFFS                   0x000C0000
+#define WRAPPER_TZ_CPU_STATUS                  (WRAPPER_TZ_BASE_OFFS + 0x10)
+#define WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG        (WRAPPER_TZ_BASE_OFFS + 0x14)
+#define WRAPPER_TZ_QNS4PDXFIFO_RESET           (WRAPPER_TZ_BASE_OFFS + 0x18)
+
+#define CTRL_INIT_IRIS3                        CPU_CS_SCIACMD_IRIS3
+#define CTRL_STATUS_IRIS3                      CPU_CS_SCIACMDARG0_IRIS3
+#define CTRL_ERROR_STATUS__M_IRIS3             CPU_CS_SCIACMDARG0_HFI_CTRL_ERROR_STATUS_BMSK_IRIS3
+#define CTRL_INIT_IDLE_MSG_BMSK_IRIS3          CPU_CS_SCIACMDARG0_HFI_CTRL_INIT_IDLE_MSG_BMSK_IRIS3
+#define CTRL_STATUS_PC_READY_IRIS3             CPU_CS_SCIACMDARG0_HFI_CTRL_PC_READY_IRIS3
+
+#define QTBL_INFO_IRIS3                        CPU_CS_SCIACMDARG1_IRIS3
+#define QTBL_ADDR_IRIS3                        CPU_CS_SCIACMDARG2_IRIS3
+#define SFR_ADDR_IRIS3                         CPU_CS_SCIBCMD_IRIS3
+#define UC_REGION_ADDR_IRIS3                   CPU_CS_SCIBARG1_IRIS3
+#define UC_REGION_SIZE_IRIS3                   CPU_CS_SCIBARG2_IRIS3
+
+#define AON_WRAPPER_MVP_NOC_LPI_CONTROL        (AON_BASE_OFFS)
+#define AON_WRAPPER_MVP_NOC_LPI_STATUS         (AON_BASE_OFFS + 0x4)
+
+#define VCODEC_SS_IDLE_STATUSN                 (VCODEC_BASE_OFFS_IRIS3 + 0x70)
+
+static int interrupt_init_iris3(struct iris_core *core)
+{
+	u32 mask_val;
+	int ret;
+
+	ret = read_register(core, WRAPPER_INTR_MASK_IRIS3, &mask_val);
+	if (ret)
+		return ret;
+
+	mask_val &= ~(WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS3 |
+		      WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS3);
+	ret = write_register(core, WRAPPER_INTR_MASK_IRIS3, mask_val);
+
+	return ret;
+}
+
+static int setup_ucregion_memory_map_iris3(struct iris_core *core)
+{
+	int ret;
+	u32 value;
+
+	value = (u32)core->iface_q_table.device_addr;
+	ret = write_register(core, UC_REGION_ADDR_IRIS3, value);
+	if (ret)
+		return ret;
+
+	value = SHARED_QSIZE;
+	ret = write_register(core, UC_REGION_SIZE_IRIS3, value);
+	if (ret)
+		return ret;
+
+	value = (u32)core->iface_q_table.device_addr;
+	ret = write_register(core, QTBL_ADDR_IRIS3, value);
+	if (ret)
+		return ret;
+
+	ret = write_register(core, QTBL_INFO_IRIS3, 0x01);
+	if (ret)
+		return ret;
+
+	value = (u32)((u64)core->iface_q_table.kernel_vaddr);
+	ret = write_register(core, CPU_CS_VCICMDARG0_IRIS3, value);
+	if (ret)
+		return ret;
+
+	value = (u32)((u64)core->iface_q_table.kernel_vaddr >> 32);
+	ret = write_register(core, CPU_CS_VCICMDARG1_IRIS3, value);
+	if (ret)
+		return ret;
+
+	if (core->sfr.device_addr) {
+		value = (u32)core->sfr.device_addr + VIDEO_ARCH_LX;
+		ret = write_register(core, SFR_ADDR_IRIS3, value);
+		if (ret)
+			return ret;
+	}
+
+	return ret;
+}
+
+static int boot_firmware_iris3(struct iris_core *core)
+{
+	u32 ctrl_init = 0, ctrl_status = 0, count = 0, max_tries = 1000;
+	int ret;
+
+	ret = setup_ucregion_memory_map_iris3(core);
+	if (ret)
+		return ret;
+
+	ctrl_init = BIT(0);
+
+	ret = write_register(core, CTRL_INIT_IRIS3, ctrl_init);
+	if (ret)
+		return ret;
+
+	while (!ctrl_status && count < max_tries) {
+		ret = read_register(core, CTRL_STATUS_IRIS3, &ctrl_status);
+		if (ret)
+			return ret;
+
+		if ((ctrl_status & CTRL_ERROR_STATUS__M_IRIS3) == 0x4) {
+			dev_err(core->dev, "invalid setting for UC_REGION\n");
+			break;
+		}
+
+		usleep_range(50, 100);
+		count++;
+	}
+
+	if (count >= max_tries) {
+		dev_err(core->dev, "Error booting up vidc firmware\n");
+		return -ETIME;
+	}
+
+	ret = write_register(core, CPU_CS_H2XSOFTINTEN_IRIS3, 0x1);
+	if (ret)
+		return ret;
+
+	ret = write_register(core, CPU_CS_X2RPMH_IRIS3, 0x0);
+
+	return ret;
+}
+
+static int raise_interrupt_iris3(struct iris_core *core)
+{
+	return write_register(core, CPU_IC_SOFTINT_IRIS3, 1 << CPU_IC_SOFTINT_H2A_SHFT_IRIS3);
+}
+
+static int clear_interrupt_iris3(struct iris_core *core)
+{
+	u32 intr_status = 0, mask = 0;
+	int ret;
+
+	ret = read_register(core, WRAPPER_INTR_STATUS_IRIS3, &intr_status);
+	if (ret)
+		return ret;
+
+	mask = (WRAPPER_INTR_STATUS_A2H_BMSK_IRIS3 |
+		WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS3 |
+		CTRL_INIT_IDLE_MSG_BMSK_IRIS3);
+
+	if (intr_status & mask) {
+		core->intr_status |= intr_status;
+		core->reg_count++;
+	} else {
+		core->spur_count++;
+	}
+
+	ret = write_register(core, CPU_CS_A2HSOFTINTCLR_IRIS3, 1);
+
+	return ret;
+}
+
+static int watchdog_iris3(struct iris_core *core, u32 intr_status)
+{
+	if (intr_status & WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS3) {
+		dev_err(core->dev, "%s: received watchdog interrupt\n", __func__);
+		return -ETIME;
+	}
+
+	return 0;
+}
+
+static bool is_iris3_hw_power_collapsed(struct iris_core *core)
+{
+	u32 value = 0, pwr_status = 0;
+	int ret;
+
+	ret = read_register(core, WRAPPER_CORE_POWER_STATUS, &value);
+	if (ret)
+		return false;
+
+	pwr_status = value & BIT(1);
+
+	return pwr_status ? false : true;
+}
+
+static int power_off_iris3_hardware(struct iris_core *core)
+{
+	u32 value = 0;
+	int ret, i;
+
+	if (is_iris3_hw_power_collapsed(core))
+		goto disable_power;
+
+	dev_err(core->dev, "Video hw is power ON\n");
+
+	ret = read_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS3, &value);
+	if (ret)
+		goto disable_power;
+
+	if (value) {
+		ret = write_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS3, 0);
+		if (ret)
+			goto disable_power;
+	}
+
+	for (i = 0; i < core->cap[NUM_VPP_PIPE].value; i++) {
+		ret = read_register_with_poll_timeout(core, VCODEC_SS_IDLE_STATUSN + 4 * i,
+						      0x400000, 0x400000, 2000, 20000);
+	}
+
+	ret = write_register(core, AON_WRAPPER_MVP_NOC_RESET_REQ, 0x3);
+	if (ret)
+		goto disable_power;
+
+	ret = read_register_with_poll_timeout(core, AON_WRAPPER_MVP_NOC_RESET_ACK,
+					      0x3, 0x3, 200, 2000);
+	ret = write_register(core, AON_WRAPPER_MVP_NOC_RESET_REQ, 0x0);
+	if (ret)
+		goto disable_power;
+
+	ret = read_register_with_poll_timeout(core, AON_WRAPPER_MVP_NOC_RESET_ACK,
+					      0x3, 0x0, 200, 2000);
+
+	ret = write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x3);
+	if (ret)
+		goto disable_power;
+	ret = write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x2);
+	if (ret)
+		goto disable_power;
+	ret = write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x0);
+	if (ret)
+		goto disable_power;
+
+disable_power:
+	ret = disable_power_domains(core, "vcodec");
+	if (ret) {
+		dev_err(core->dev, "disable power domain vcodec failed\n");
+		ret = 0;
+	}
+
+	disable_unprepare_clock(core, "vcodec_core");
+	if (ret) {
+		dev_err(core->dev, "disable unprepare vcodec_core failed\n");
+		ret = 0;
+	}
+
+	return ret;
+}
+
+static int power_off_iris3_controller(struct iris_core *core)
+{
+	int ret;
+
+	ret = write_register(core, CPU_CS_X2RPMH_IRIS3, 0x3);
+	if (ret)
+		goto disable_power;
+
+	ret = write_register_masked(core, AON_WRAPPER_MVP_NOC_LPI_CONTROL,
+				    0x1, BIT(0));
+	if (ret)
+		goto disable_power;
+
+	ret = read_register_with_poll_timeout(core, AON_WRAPPER_MVP_NOC_LPI_STATUS,
+					      0x1, 0x1, 200, 2000);
+
+	ret = write_register_masked(core, WRAPPER_IRIS_CPU_NOC_LPI_CONTROL,
+				    0x1, BIT(0));
+	if (ret)
+		goto disable_power;
+
+	ret = read_register_with_poll_timeout(core, WRAPPER_IRIS_CPU_NOC_LPI_STATUS,
+					      0x1, 0x1, 200, 2000);
+
+	ret = write_register(core, WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS3, 0x0);
+	if (ret)
+		goto disable_power;
+
+	ret = read_register_with_poll_timeout(core, WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS3,
+					      0xffffffff, 0x0, 200, 2000);
+
+	ret = write_register(core, WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG, 0x3);
+	if (ret)
+		goto disable_power;
+
+	ret = write_register(core, WRAPPER_TZ_QNS4PDXFIFO_RESET, 0x1);
+	if (ret)
+		goto disable_power;
+
+	ret = write_register(core, WRAPPER_TZ_QNS4PDXFIFO_RESET, 0x0);
+	if (ret)
+		goto disable_power;
+
+	ret = write_register(core, WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG, 0x0);
+	if (ret)
+		goto disable_power;
+
+disable_power:
+	disable_unprepare_clock(core, "core_clk");
+	if (ret) {
+		dev_err(core->dev, "disable unprepare core_clk failed\n");
+		ret = 0;
+	}
+
+	/* power down process */
+	ret = disable_power_domains(core, "iris-ctl");
+	if (ret) {
+		dev_err(core->dev, "disable power domain iris-ctl failed\n");
+		ret = 0;
+	}
+
+	return ret;
+}
+
+static int power_off_iris3(struct iris_core *core)
+{
+	if (!core->power_enabled)
+		return 0;
+
+	opp_set_rate(core, 0);
+	power_off_iris3_hardware(core);
+	power_off_iris3_controller(core);
+	unvote_buses(core);
+
+	if (!call_vpu_op(core, watchdog, core, core->intr_status))
+		disable_irq_nosync(core->irq);
+
+	core->power_enabled = false;
+
+	return 0;
+}
+
+static int power_on_iris3_controller(struct iris_core *core)
+{
+	int ret;
+
+	ret = enable_power_domains(core, "iris-ctl");
+	if (ret)
+		return ret;
+
+	ret = reset_ahb2axi_bridge(core);
+	if (ret)
+		goto err_disable_power;
+
+	ret = prepare_enable_clock(core, "gcc_video_axi0");
+	if (ret)
+		goto err_disable_power;
+
+	ret = prepare_enable_clock(core, "core_clk");
+	if (ret)
+		goto err_disable_clock;
+
+	return ret;
+
+err_disable_clock:
+	disable_unprepare_clock(core, "gcc_video_axi0");
+err_disable_power:
+	disable_power_domains(core, "iris-ctl");
+
+	return ret;
+}
+
+static int power_on_iris3_hardware(struct iris_core *core)
+{
+	int ret;
+
+	ret = enable_power_domains(core, "vcodec");
+	if (ret)
+		return ret;
+
+	ret = prepare_enable_clock(core, "vcodec_core");
+	if (ret)
+		goto err_disable_power;
+
+	return ret;
+
+err_disable_power:
+	disable_power_domains(core, "vcodec");
+
+	return ret;
+}
+
+static int power_on_iris3(struct iris_core *core)
+{
+	u32 freq = 0;
+	int ret;
+
+	if (core->power_enabled)
+		return 0;
+
+	if (!core_in_valid_state(core))
+		return -EINVAL;
+
+	ret = vote_buses(core, INT_MAX);
+	if (ret)
+		goto err;
+
+	ret = power_on_iris3_controller(core);
+	if (ret)
+		goto err_unvote_bus;
+
+	ret = power_on_iris3_hardware(core);
+	if (ret)
+		goto err_power_off_ctrl;
+
+	core->power_enabled = true;
+
+	freq = core->power.clk_freq ? core->power.clk_freq :
+				      (u32)ULONG_MAX;
+
+	opp_set_rate(core, freq);
+
+	set_preset_registers(core);
+
+	interrupt_init_iris3(core);
+	core->intr_status = 0;
+	enable_irq(core->irq);
+
+	return ret;
+
+err_power_off_ctrl:
+	power_off_iris3_controller(core);
+err_unvote_bus:
+	unvote_buses(core);
+err:
+	core->power_enabled = false;
+
+	return ret;
+}
+
+static int prepare_pc_iris3(struct iris_core *core)
+{
+	u32 wfi_status = 0, idle_status = 0, pc_ready = 0;
+	u32 ctrl_status = 0;
+	int ret;
+
+	ret = read_register(core, CTRL_STATUS_IRIS3, &ctrl_status);
+	if (ret)
+		return ret;
+
+	pc_ready = ctrl_status & CTRL_STATUS_PC_READY_IRIS3;
+	idle_status = ctrl_status & BIT(30);
+
+	if (pc_ready)
+		return 0;
+
+	ret = read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (ret)
+		return ret;
+
+	wfi_status &= BIT(0);
+	if (!wfi_status || !idle_status)
+		goto skip_power_off;
+
+	ret = prepare_pc(core);
+	if (ret)
+		goto skip_power_off;
+
+	ret = read_register_with_poll_timeout(core, CTRL_STATUS_IRIS3,
+					      CTRL_STATUS_PC_READY_IRIS3,
+					      CTRL_STATUS_PC_READY_IRIS3, 250, 2500);
+	if (ret)
+		goto skip_power_off;
+
+	ret = read_register_with_poll_timeout(core, WRAPPER_TZ_CPU_STATUS,
+					      BIT(0), 0x1, 250, 2500);
+	if (ret)
+		goto skip_power_off;
+
+	return ret;
+
+skip_power_off:
+	ret = read_register(core, CTRL_STATUS_IRIS3, &ctrl_status);
+	if (ret)
+		return ret;
+
+	ret = read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (ret)
+		return ret;
+
+	wfi_status &= BIT(0);
+	dev_err(core->dev, "Skip PC, wfi=%#x, idle=%#x, pcr=%#x, ctrl=%#x)\n",
+		wfi_status, idle_status, pc_ready, ctrl_status);
+
+	return -EAGAIN;
+}
+
+static const struct vpu_ops iris3_ops = {
+	.boot_firmware = boot_firmware_iris3,
+	.raise_interrupt = raise_interrupt_iris3,
+	.clear_interrupt = clear_interrupt_iris3,
+	.watchdog = watchdog_iris3,
+	.power_on = power_on_iris3,
+	.power_off = power_off_iris3,
+	.prepare_pc = prepare_pc_iris3,
+};
+
+static const struct vpu_session_ops iris3_session_ops = {
+	.int_buf_size = iris_int_buf_size_iris3,
+	.calc_freq = iris_calc_freq_iris3,
+	.calc_bw = iris_calc_bw_iris3,
+};
+
+int init_iris3(struct iris_core *core)
+{
+	core->vpu_ops = &iris3_ops;
+	core->session_ops = &iris3_session_ops;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris3.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris3.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _VPU_IRIS3_H_
+#define _VPU_IRIS3_H_
+
+#include "iris_core.h"
+
+int init_iris3(struct iris_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris3_buffer.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris3_buffer.c
@@ -0,0 +1,423 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_core.h"
+#include "iris_helpers.h"
+#include "iris_instance.h"
+#include "vpu_iris3_buffer.h"
+
+static u32 dec_bin_size_iris3(struct iris_inst *inst)
+{
+	u32 width, height, num_vpp_pipes;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+
+	f = inst->fmt_src;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_bin_h264d(width, height, num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_bin_h265d(width, height, num_vpp_pipes);
+	else if (inst->codec == VP9)
+		size = hfi_buffer_bin_vp9d(width, height,
+					   num_vpp_pipes);
+	return size;
+}
+
+static u32 dec_comv_size_iris3(struct iris_inst *inst)
+{
+	u32 width, height, num_comv;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	f = inst->fmt_src;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	num_comv = inst->buffers.output.min_count;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_comv_h264d(width, height, num_comv);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_comv_h265d(width, height, num_comv);
+
+	inst->cap[NUM_COMV].value = num_comv;
+
+	return size;
+}
+
+static u32 dec_non_comv_size_iris3(struct iris_inst *inst)
+{
+	u32 width, height, num_vpp_pipes;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+
+	f = inst->fmt_src;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_non_comv_h264d(width, height, num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_non_comv_h265d(width, height, num_vpp_pipes);
+
+	return size;
+}
+
+static u32 dec_line_size_iris3(struct iris_inst *inst)
+{
+	u32 width, height, out_min_count, num_vpp_pipes;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+	bool is_opb;
+
+	core = inst->core;
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+
+	is_opb = true;
+
+	f = inst->fmt_src;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	out_min_count = inst->buffers.output.min_count;
+	if (inst->codec == H264)
+		size = hfi_buffer_line_h264d(width, height, is_opb,
+					     num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_line_h265d(width, height, is_opb,
+					     num_vpp_pipes);
+	else if (inst->codec == VP9)
+		size = hfi_buffer_line_vp9d(width, height, out_min_count,
+					    is_opb, num_vpp_pipes);
+	return size;
+}
+
+static u32 dec_persist_size_iris3(struct iris_inst *inst)
+{
+	u32 size = 0;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_persist_h264d(0);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_persist_h265d(0);
+	else if (inst->codec == VP9)
+		size = hfi_buffer_persist_vp9d();
+
+	return size;
+}
+
+static u32 dec_dpb_size_iris3(struct iris_inst *inst)
+{
+	struct v4l2_format *f;
+	u32 width, height;
+	u32 color_fmt;
+	u32 size = 0;
+
+	f = inst->fmt_dst;
+	color_fmt = f->fmt.pix_mp.pixelformat;
+	if (!is_linear_colorformat(color_fmt))
+		return size;
+
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (color_fmt == V4L2_PIX_FMT_NV12 ||
+	    color_fmt == V4L2_PIX_FMT_QC08C) {
+		size =
+		hfi_nv12_ubwc_il_calc_buf_size_v2(width, height,
+						  ALIGN(width, 128),
+						  ALIGN(height, 32),
+						  ALIGN(width, 128),
+						  ALIGN((height + 1) >> 1, 32),
+						  ALIGN(DIV_ROUND_UP(width, 32), 64),
+						  ALIGN(DIV_ROUND_UP(height, 8), 16),
+						  ALIGN(DIV_ROUND_UP((width + 1) >> 1, 16), 64),
+						  ALIGN(DIV_ROUND_UP((height + 1) >> 1, 8), 16));
+	} else if (color_fmt == V4L2_PIX_FMT_QC10C) {
+		size =
+		hfi_yuv420_tp10_ubwc_calc_buf_size(ALIGN(ALIGN(width, 192) * 4 / 3, 256),
+						   ALIGN(height, 16),
+						   ALIGN(ALIGN(width, 192) * 4 / 3, 256),
+						   ALIGN((height + 1) >> 1, 16),
+						   ALIGN(DIV_ROUND_UP(width, 48), 64),
+						   ALIGN(DIV_ROUND_UP(height, 4), 16),
+						   ALIGN(DIV_ROUND_UP((width + 1) >> 1, 24), 64),
+						   ALIGN(DIV_ROUND_UP((height + 1) >> 1, 4), 16));
+	}
+
+	return size;
+}
+
+static u32 enc_bin_size_iris3(struct iris_inst *inst)
+{
+	u32 width, height, num_vpp_pipes, stage, profile;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+	stage = inst->cap[STAGE].value;
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	profile = inst->cap[PROFILE].value;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_bin_h264e(inst->hfi_rc_type, width, height,
+					    stage, num_vpp_pipes, profile);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_bin_h265e(inst->hfi_rc_type, width, height,
+					    stage, num_vpp_pipes, profile);
+
+	return size;
+}
+
+u32 get_recon_buf_count(struct iris_inst *inst)
+{
+	s32 n_bframe, ltr_count, hp_layers = 0, hb_layers = 0;
+	bool is_hybrid_hp = false;
+	u32 num_buf_recon = 0;
+	u32 hfi_codec = 0;
+
+	n_bframe = inst->cap[B_FRAME].value;
+	ltr_count = inst->cap[LTR_COUNT].value;
+
+	if (inst->hfi_layer_type == HFI_HIER_B) {
+		hb_layers = inst->cap[ENH_LAYER_COUNT].value + 1;
+	} else {
+		hp_layers = inst->cap[ENH_LAYER_COUNT].value + 1;
+		if (inst->hfi_layer_type == HFI_HIER_P_HYBRID_LTR)
+			is_hybrid_hp = true;
+	}
+
+	if (inst->codec == H264)
+		hfi_codec = HFI_CODEC_ENCODE_AVC;
+	else if (inst->codec == HEVC)
+		hfi_codec = HFI_CODEC_ENCODE_HEVC;
+
+	num_buf_recon = hfi_iris3_enc_recon_buf_count(n_bframe, ltr_count,
+						      hp_layers, hb_layers,
+						      is_hybrid_hp, hfi_codec);
+
+	return num_buf_recon;
+}
+
+static u32 enc_comv_size_iris3(struct iris_inst *inst)
+{
+	u32 width, height, num_recon = 0;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	num_recon = get_recon_buf_count(inst);
+	if (inst->codec == H264)
+		size = hfi_buffer_comv_h264e(width, height, num_recon);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_comv_h265e(width, height, num_recon);
+
+	return size;
+}
+
+static u32 enc_non_comv_size_iris3(struct iris_inst *inst)
+{
+	u32 width, height, num_vpp_pipes;
+	struct iris_core *core;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == H264)
+		size = hfi_buffer_non_comv_h264e(width, height, num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_non_comv_h265e(width, height, num_vpp_pipes);
+
+	return size;
+}
+
+static u32 enc_line_size_iris3(struct iris_inst *inst)
+{
+	u32 width, height, pixfmt, num_vpp_pipes;
+	struct iris_core *core;
+	bool is_tenbit = false;
+	struct v4l2_format *f;
+	u32 size = 0;
+
+	core = inst->core;
+	num_vpp_pipes = core->cap[NUM_VPP_PIPE].value;
+	pixfmt = inst->cap[PIX_FMTS].value;
+
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	is_tenbit = (pixfmt == FMT_TP10C);
+
+	if (inst->codec == H264)
+		size = hfi_buffer_line_h264e(width, height, is_tenbit, num_vpp_pipes);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_line_h265e(width, height, is_tenbit, num_vpp_pipes);
+
+	return size;
+}
+
+static u32 enc_dpb_size_iris3(struct iris_inst *inst)
+{
+	u32 width, height, pixfmt;
+	struct v4l2_format *f;
+	bool is_tenbit;
+	u32 size = 0;
+
+	f = inst->fmt_dst;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	pixfmt = inst->cap[PIX_FMTS].value;
+	is_tenbit = (pixfmt == FMT_TP10C);
+
+	if (inst->codec == H264)
+		size = hfi_buffer_dpb_h264e(width, height);
+	else if (inst->codec == HEVC)
+		size = hfi_buffer_dpb_h265e(width, height, is_tenbit);
+
+	return size;
+}
+
+static u32 enc_arp_size_iris3(struct iris_inst *inst)
+{
+	u32 size = 0;
+
+	HFI_BUFFER_ARP_ENC(size);
+
+	return size;
+}
+
+static u32 enc_vpss_size_iris3(struct iris_inst *inst)
+{
+	bool ds_enable = false, is_tenbit = false;
+	struct v4l2_format *f;
+	u32 width, height;
+	u32 size = 0;
+
+	ds_enable = is_scaling_enabled(inst);
+
+	f = inst->fmt_dst;
+	if (inst->cap[ROTATION].value == 90 ||
+	    inst->cap[ROTATION].value == 270) {
+		width = f->fmt.pix_mp.height;
+		height = f->fmt.pix_mp.width;
+	} else {
+		width = f->fmt.pix_mp.width;
+		height = f->fmt.pix_mp.height;
+	}
+
+	f = inst->fmt_src;
+	is_tenbit = is_10bit_colorformat(f->fmt.pix_mp.pixelformat);
+
+	size = hfi_buffer_vpss_enc(width, height, ds_enable, 0, is_tenbit);
+
+	return size;
+}
+
+u32 enc_output_buffer_size_iris3(struct iris_inst *inst)
+{
+	u32 hfi_rc_type = HFI_RC_VBR_CFR;
+	enum codec_type codec;
+	int bitrate_mode, frame_rc;
+	bool is_ten_bit = false;
+	struct v4l2_format *f;
+	u32 frame_size;
+
+	f = inst->fmt_dst;
+	codec = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat);
+	if (codec == HEVC)
+		is_ten_bit = true;
+
+	bitrate_mode = inst->cap[BITRATE_MODE].value;
+	frame_rc = inst->cap[FRAME_RC_ENABLE].value;
+	if (!frame_rc)
+		hfi_rc_type = HFI_RC_OFF;
+	else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_CQ)
+		hfi_rc_type = HFI_RC_CQ;
+
+	frame_size = hfi_buffer_bitstream_enc(f->fmt.pix_mp.width,
+					      f->fmt.pix_mp.height,
+					      hfi_rc_type, is_ten_bit);
+
+	return frame_size;
+}
+
+struct iris_buf_type_handle {
+	enum iris_buffer_type type;
+	u32 (*handle)(struct iris_inst *inst);
+};
+
+int iris_int_buf_size_iris3(struct iris_inst *inst,
+			    enum iris_buffer_type buffer_type)
+{
+	const struct iris_buf_type_handle *buf_type_handle_arr = NULL;
+	u32 size = 0, buf_type_handle_size = 0;
+	int i;
+
+	static const struct iris_buf_type_handle dec_internal_buf_type_handle[] = {
+		{BUF_BIN,             dec_bin_size_iris3          },
+		{BUF_COMV,            dec_comv_size_iris3         },
+		{BUF_NON_COMV,        dec_non_comv_size_iris3     },
+		{BUF_LINE,            dec_line_size_iris3         },
+		{BUF_PERSIST,         dec_persist_size_iris3      },
+		{BUF_DPB,             dec_dpb_size_iris3          },
+	};
+	static const struct iris_buf_type_handle enc_internal_buf_type_handle[] = {
+		{BUF_BIN,             enc_bin_size_iris3          },
+		{BUF_COMV,            enc_comv_size_iris3         },
+		{BUF_NON_COMV,        enc_non_comv_size_iris3     },
+		{BUF_LINE,            enc_line_size_iris3         },
+		{BUF_DPB,             enc_dpb_size_iris3          },
+		{BUF_ARP,             enc_arp_size_iris3          },
+		{BUF_VPSS,            enc_vpss_size_iris3         },
+	};
+
+	if (inst->domain == DECODER) {
+		buf_type_handle_size = ARRAY_SIZE(dec_internal_buf_type_handle);
+		buf_type_handle_arr = dec_internal_buf_type_handle;
+	} else if (inst->domain == ENCODER) {
+		buf_type_handle_size = ARRAY_SIZE(enc_internal_buf_type_handle);
+		buf_type_handle_arr = enc_internal_buf_type_handle;
+	}
+
+	if (!buf_type_handle_arr || !buf_type_handle_size)
+		return size;
+
+	for (i = 0; i < buf_type_handle_size; i++) {
+		if (buf_type_handle_arr[i].type == buffer_type) {
+			size = buf_type_handle_arr[i].handle(inst);
+			break;
+		}
+	}
+
+	return size;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris3_buffer.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris3_buffer.h
@@ -0,0 +1,1496 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _VPU_IRIS3_BUFFER_H_
+#define _VPU_IRIS3_BUFFER_H_
+
+#include <linux/types.h>
+#include <linux/minmax.h>
+#include <linux/align.h>
+
+#include "iris_instance.h"
+
+#define DMA_ALIGNMENT 256
+
+#define BUFFER_ALIGNMENT_4096_BYTES 4096
+#define BUFFER_ALIGNMENT_512_BYTES 512
+#define BUFFER_ALIGNMENT_256_BYTES 256
+#define BUFFER_ALIGNMENT_128_BYTES 128
+#define BUFFER_ALIGNMENT_64_BYTES 64
+#define BUFFER_ALIGNMENT_32_BYTES 32
+#define BUFFER_ALIGNMENT_16_BYTES 16
+
+#define HFI_ALIGNMENT_4096 (4096)
+
+#define HFI_COL_FMT_NV12C_Y_TILE_HEIGHT (8)
+#define HFI_COL_FMT_NV12C_Y_TILE_WIDTH (32)
+#define HFI_COL_FMT_NV12C_UV_TILE_HEIGHT (8)
+#define HFI_COL_FMT_NV12C_UV_TILE_WIDTH (16)
+#define HFI_COL_FMT_TP10C_Y_TILE_HEIGHT (4)
+#define HFI_COL_FMT_TP10C_Y_TILE_WIDTH (48)
+
+#define NUM_HW_PIC_BUF 32
+#define SIZE_HW_PIC(size_per_buf) (NUM_HW_PIC_BUF * (size_per_buf))
+
+#define MAX_TILE_COLUMNS 32
+
+#define LCU_MAX_SIZE_PELS 64
+#define LCU_MIN_SIZE_PELS 16
+
+#define HDR10_HIST_EXTRADATA_SIZE (4 * 1024)
+
+#define BIN_BUFFER_THRESHOLD (1280 * 736)
+
+#define VPP_CMD_MAX_SIZE (BIT(20))
+
+#define H264D_MAX_SLICE 1800
+
+#define SIZE_H264D_BUFTAB_T (256)
+#define SIZE_H264D_HW_PIC_T (BIT(11))
+#define SIZE_H264D_BSE_CMD_PER_BUF (32 * 4)
+#define SIZE_H264D_VPP_CMD_PER_BUF (512)
+
+#define NUM_SLIST_BUF_H264 (256 + 32)
+#define SIZE_SLIST_BUF_H264 (512)
+#define H264_DISPLAY_BUF_SIZE (3328)
+#define H264_NUM_FRM_INFO (66)
+
+#define H265_NUM_TILE_COL 32
+#define H265_NUM_TILE_ROW 128
+#define H265_NUM_TILE (H265_NUM_TILE_ROW * H265_NUM_TILE_COL + 1)
+#define SIZE_H265D_BSE_CMD_PER_BUF (16 * sizeof(u32))
+
+#define NUM_SLIST_BUF_H265 (80 + 20)
+#define SIZE_SLIST_BUF_H265 (BIT(10))
+#define H265_DISPLAY_BUF_SIZE (3072)
+#define H265_NUM_FRM_INFO (48)
+
+#define VP9_NUM_FRAME_INFO_BUF 32
+#define VP9_NUM_PROBABILITY_TABLE_BUF (VP9_NUM_FRAME_INFO_BUF + 4)
+#define VP9_PROB_TABLE_SIZE (3840)
+#define VP9_FRAME_INFO_BUF_SIZE (6144)
+
+#define VP9_UDC_HEADER_BUF_SIZE (3 * 128)
+#define MAX_SUPERFRAME_HEADER_LEN (34)
+#define CCE_TILE_OFFSET_SIZE ALIGN(32 * 4 * 4, BUFFER_ALIGNMENT_32_BYTES)
+
+#define SIZE_SEI_USERDATA (4096)
+#define SIZE_DOLBY_RPU_METADATA (41 * 1024)
+
+#define H264_CABAC_HDR_RATIO_HD_TOT 1
+#define H264_CABAC_RES_RATIO_HD_TOT 3
+
+#define H265D_MAX_SLICE 1200
+#define SIZE_H265D_HW_PIC_T SIZE_H264D_HW_PIC_T
+#define H265_CABAC_HDR_RATIO_HD_TOT 2
+#define H265_CABAC_RES_RATIO_HD_TOT 2
+#define SIZE_H265D_VPP_CMD_PER_BUF (256)
+
+#define VPX_DECODER_FRAME_CONCURENCY_LVL (2)
+#define VPX_DECODER_FRAME_BIN_HDR_BUDGET 1
+#define VPX_DECODER_FRAME_BIN_RES_BUDGET 3
+#define VPX_DECODER_FRAME_BIN_DENOMINATOR 2
+
+#define VPX_DECODER_FRAME_BIN_RES_BUDGET_RATIO (3 / 2)
+
+#define MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE 64
+
+#define MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE (128 / 8)
+
+#define MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE (64 * 2 * 3)
+#define MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE 640
+
+#define HFI_BUFFER_ARP_ENC(size) (size = 204800)
+
+#define HFI_MAX_COL_FRAME 6
+#define HFI_VENUS_WIDTH_ALIGNMENT 128
+#define HFI_VENUS_HEIGHT_ALIGNMENT 32
+#define VENUS_METADATA_STRIDE_MULTIPLE 64
+#define VENUS_METADATA_HEIGHT_MULTIPLE 16
+
+#ifndef SYSTEM_LAL_TILE10
+#define SYSTEM_LAL_TILE10 192
+#endif
+
+#define SIZE_SLICE_CMD_BUFFER (ALIGN(20480, BUFFER_ALIGNMENT_256_BYTES))
+#define SIZE_SPS_PPS_SLICE_HDR (2048 + 4096)
+
+#define SIZE_BSE_SLICE_CMD_BUF ((((8192 << 2) + 7) & (~7)) * 3)
+#define SIZE_LAMBDA_LUT (256 * 11)
+
+#define HFI_WORKMODE_1 1
+#define HFI_WORKMODE_2 2
+
+static inline
+u32 size_h264d_hw_bin_buffer(u32 frame_width, u32 frame_height,
+			     u32 num_vpp_pipes)
+{
+	u32 size_yuv, size_bin_hdr, size_bin_res;
+
+	size_yuv = ((frame_width * frame_height) <= BIN_BUFFER_THRESHOLD) ?
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) :
+			((frame_width * frame_height * 3) >> 1);
+	size_bin_hdr = size_yuv * H264_CABAC_HDR_RATIO_HD_TOT;
+	size_bin_res = size_yuv * H264_CABAC_RES_RATIO_HD_TOT;
+	size_bin_hdr = ALIGN(size_bin_hdr / num_vpp_pipes,
+			     DMA_ALIGNMENT) * num_vpp_pipes;
+	size_bin_res = ALIGN(size_bin_res / num_vpp_pipes,
+			     DMA_ALIGNMENT) * num_vpp_pipes;
+
+	return size_bin_hdr + size_bin_res;
+}
+
+static inline
+u32 hfi_buffer_bin_h264d(u32 frame_width, u32 frame_height,
+			 u32 num_vpp_pipes)
+{
+	u32 n_aligned_w, n_aligned_h;
+
+	n_aligned_w =
+		ALIGN(frame_width, BUFFER_ALIGNMENT_16_BYTES);
+	n_aligned_h =
+		ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES);
+
+	return size_h264d_hw_bin_buffer(n_aligned_w, n_aligned_h,
+					num_vpp_pipes);
+}
+
+static inline
+u32 size_h265d_hw_bin_buffer(u32 frame_width, u32 frame_height,
+			     u32 num_vpp_pipes)
+{
+	u32 size_yuv, size_bin_hdr, size_bin_res;
+
+	size_yuv = ((frame_width * frame_height) <= BIN_BUFFER_THRESHOLD) ?
+		((BIN_BUFFER_THRESHOLD * 3) >> 1) :
+		((frame_width * frame_height * 3) >> 1);
+	size_bin_hdr = size_yuv * H265_CABAC_HDR_RATIO_HD_TOT;
+	size_bin_res = size_yuv * H265_CABAC_RES_RATIO_HD_TOT;
+	size_bin_hdr = ALIGN(size_bin_hdr / num_vpp_pipes, DMA_ALIGNMENT) *
+			num_vpp_pipes;
+	size_bin_res = ALIGN(size_bin_res / num_vpp_pipes, DMA_ALIGNMENT) *
+			num_vpp_pipes;
+
+	return size_bin_hdr + size_bin_res;
+}
+
+static inline
+u32 hfi_buffer_bin_h265d(u32 frame_width, u32 frame_height,
+			 u32 num_vpp_pipes)
+{
+	u32 n_aligned_w, n_aligned_h;
+
+	n_aligned_w = ALIGN(frame_width, BUFFER_ALIGNMENT_16_BYTES);
+	n_aligned_h = ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES);
+	return size_h265d_hw_bin_buffer(n_aligned_w, n_aligned_h,
+					num_vpp_pipes);
+}
+
+static inline
+u32 hfi_buffer_bin_vp9d(u32 frame_width, u32 frame_height,
+			u32 num_vpp_pipes)
+{
+	u32 _size_yuv, _size;
+
+	_size_yuv = ALIGN(frame_width, BUFFER_ALIGNMENT_16_BYTES) *
+		ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES) * 3 / 2;
+	_size = ALIGN(((max_t(u32, _size_yuv, ((BIN_BUFFER_THRESHOLD * 3) >> 1)) *
+			VPX_DECODER_FRAME_BIN_HDR_BUDGET / VPX_DECODER_FRAME_BIN_DENOMINATOR *
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes),
+		      DMA_ALIGNMENT) +
+		ALIGN(((max_t(u32, _size_yuv, ((BIN_BUFFER_THRESHOLD * 3) >> 1)) *
+			VPX_DECODER_FRAME_BIN_RES_BUDGET / VPX_DECODER_FRAME_BIN_DENOMINATOR *
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes),
+		      DMA_ALIGNMENT);
+
+	return _size * num_vpp_pipes;
+}
+
+static inline
+u32 hfi_buffer_comv_h264d(u32 frame_width, u32 frame_height,
+			  u32 _comv_bufcount)
+{
+	u32 frame_width_in_mbs = ((frame_width + 15) >> 4);
+	u32 frame_height_in_mbs = ((frame_height + 15) >> 4);
+	u32 col_mv_aligned_width = (frame_width_in_mbs << 7);
+	u32 col_zero_aligned_width = (frame_width_in_mbs << 2);
+	u32 col_zero_size = 0, size_colloc = 0;
+
+	col_mv_aligned_width =
+		ALIGN(col_mv_aligned_width, BUFFER_ALIGNMENT_16_BYTES);
+	col_zero_aligned_width =
+		ALIGN(col_zero_aligned_width, BUFFER_ALIGNMENT_16_BYTES);
+	col_zero_size = col_zero_aligned_width *
+			((frame_height_in_mbs + 1) >> 1);
+	col_zero_size =
+		ALIGN(col_zero_size, BUFFER_ALIGNMENT_64_BYTES);
+	col_zero_size <<= 1;
+	col_zero_size =
+		ALIGN(col_zero_size, BUFFER_ALIGNMENT_512_BYTES);
+	size_colloc = col_mv_aligned_width *
+			((frame_height_in_mbs + 1) >> 1);
+	size_colloc =
+		ALIGN(size_colloc, BUFFER_ALIGNMENT_64_BYTES);
+	size_colloc <<= 1;
+	size_colloc =
+		ALIGN(size_colloc, BUFFER_ALIGNMENT_512_BYTES);
+	size_colloc += (col_zero_size + SIZE_H264D_BUFTAB_T * 2);
+
+	return (size_colloc * (_comv_bufcount)) +
+		BUFFER_ALIGNMENT_512_BYTES;
+}
+
+static inline
+u32 hfi_buffer_comv_h265d(u32 frame_width, u32 frame_height,
+			  u32 _comv_bufcount)
+{
+	u32 _size;
+
+	_size = ALIGN(((((frame_width + 15) >> 4) *
+		       ((frame_height + 15) >> 4)) << 8),
+		     BUFFER_ALIGNMENT_512_BYTES);
+	_size *= _comv_bufcount;
+	_size += BUFFER_ALIGNMENT_512_BYTES;
+
+	return _size;
+}
+
+static inline
+u32 size_h264d_bse_cmd_buf(u32 frame_width, u32 frame_height)
+{
+	u32 _height = ALIGN(frame_height,
+			    BUFFER_ALIGNMENT_32_BYTES);
+	return min_t(u32, (((_height + 15) >> 4) * 48), H264D_MAX_SLICE) *
+		SIZE_H264D_BSE_CMD_PER_BUF;
+}
+
+static inline
+u32 size_h264d_vpp_cmd_buf(u32 frame_width, u32 frame_height)
+{
+	u32 _size, _height;
+
+	_height = ALIGN(frame_height, BUFFER_ALIGNMENT_32_BYTES);
+	_size = min_t(u32, (((_height + 15) >> 4) * 48), H264D_MAX_SLICE) *
+			SIZE_H264D_VPP_CMD_PER_BUF;
+
+	if (_size > VPP_CMD_MAX_SIZE)
+		_size = VPP_CMD_MAX_SIZE;
+
+	return _size;
+}
+
+static inline
+u32 hfi_buffer_non_comv_h264d(u32 frame_width, u32 frame_height,
+			      u32 num_vpp_pipes)
+{
+	u32 _size_bse, _size_vpp, _size;
+
+	_size_bse = size_h264d_bse_cmd_buf(frame_width, frame_height);
+	_size_vpp = size_h264d_vpp_cmd_buf(frame_width, frame_height);
+	_size = ALIGN(_size_bse, DMA_ALIGNMENT) +
+		ALIGN(_size_vpp, DMA_ALIGNMENT) +
+		ALIGN(SIZE_HW_PIC(SIZE_H264D_HW_PIC_T), DMA_ALIGNMENT);
+
+	return ALIGN(_size, DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_h265d_bse_cmd_buf(u32 frame_width, u32 frame_height)
+{
+	u32 _size;
+
+	_size = ALIGN(((ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS) *
+		      (ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS)) *
+		     NUM_HW_PIC_BUF, DMA_ALIGNMENT);
+	_size = min_t(u32, _size, H265D_MAX_SLICE + 1);
+	_size = 2 * _size * SIZE_H265D_BSE_CMD_PER_BUF;
+
+	return _size;
+}
+
+static inline
+u32 size_h265d_vpp_cmd_buf(u32 frame_width, u32 frame_height)
+{
+	u32 _size;
+
+	_size = ALIGN(((ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS) *
+		      (ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS)) *
+		     NUM_HW_PIC_BUF, DMA_ALIGNMENT);
+	_size = min_t(u32, _size, H265D_MAX_SLICE + 1);
+	_size = ALIGN(_size, 4);
+	_size = 2 * _size * SIZE_H265D_VPP_CMD_PER_BUF;
+	if (_size > VPP_CMD_MAX_SIZE)
+		_size = VPP_CMD_MAX_SIZE;
+
+	return _size;
+}
+
+static inline
+u32 hfi_buffer_non_comv_h265d(u32 frame_width, u32 frame_height,
+			      u32 num_vpp_pipes)
+{
+	u32 _size_bse, _size_vpp, _size;
+
+	_size_bse = size_h265d_bse_cmd_buf(frame_width, frame_height);
+	_size_vpp = size_h265d_vpp_cmd_buf(frame_width, frame_height);
+	_size = ALIGN(_size_bse, DMA_ALIGNMENT) +
+		ALIGN(_size_vpp, DMA_ALIGNMENT) +
+		ALIGN(NUM_HW_PIC_BUF * 20 * 22 * 4, DMA_ALIGNMENT) +
+		ALIGN(2 * sizeof(u16) *
+		      (ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS) *
+		      (ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS),
+		      DMA_ALIGNMENT) +
+		ALIGN(SIZE_HW_PIC(SIZE_H265D_HW_PIC_T),
+		      DMA_ALIGNMENT) +
+		HDR10_HIST_EXTRADATA_SIZE;
+
+	return ALIGN(_size, DMA_ALIGNMENT);
+}
+
+static inline u32 size_h264d_lb_fe_top_data(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE * ALIGN(frame_width, 16) * 3;
+}
+
+static inline u32 size_h264d_lb_fe_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_fe_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_se_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_se_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_pe_top_data(u32 frame_width, u32 frame_height)
+{
+	return MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE *  ((frame_width + 15) >> 4);
+}
+
+static inline u32 size_h264d_lb_vsp_top(u32 frame_width, u32 frame_height)
+{
+	return (((frame_width + 15) >> 4) << 7);
+}
+
+static inline u32 size_h264d_lb_recon_dma_metadata_wr(u32 frame_width, u32 frame_height)
+{
+	return ALIGN(frame_height, 16) * 32;
+}
+
+static inline u32 size_h264d_qp(u32 frame_width, u32 frame_height)
+{
+	return ((frame_width + 63) >> 6) * ((frame_height + 63) >> 6) * 128;
+}
+
+static inline
+u32 size_vpss_lb(u32 frame_width, u32 frame_height, u32 num_vpp_pipes)
+{
+	u32 vpss_4tap_left_buffer_size = 0, vpss_div2_left_buffer_size = 0;
+	u32 vpss_4tap_top_buffer_size = 0, vpss_div2_top_buffer_size = 0;
+	u32 opb_lb_wr_llb_y_buffer_size, opb_lb_wr_llb_uv_buffer_size;
+	u32 opb_wr_top_line_chroma_buffer_size;
+	u32 opb_wr_top_line_luma_buffer_size;
+	u32 macrotiling_size = 32, size;
+
+	opb_wr_top_line_luma_buffer_size =
+		ALIGN(frame_width, macrotiling_size) /
+		macrotiling_size * 256;
+	opb_wr_top_line_luma_buffer_size =
+		ALIGN(opb_wr_top_line_luma_buffer_size, DMA_ALIGNMENT) +
+		(MAX_TILE_COLUMNS - 1) * 256;
+	opb_wr_top_line_luma_buffer_size =
+		max_t(u32, opb_wr_top_line_luma_buffer_size,
+		      (32 * ALIGN(frame_height, 8)));
+	opb_wr_top_line_chroma_buffer_size =
+		opb_wr_top_line_luma_buffer_size;
+	opb_lb_wr_llb_uv_buffer_size =
+		ALIGN((ALIGN(frame_height, 8) / (4 / 2)) * 64,
+		      BUFFER_ALIGNMENT_32_BYTES);
+	opb_lb_wr_llb_y_buffer_size =
+		ALIGN((ALIGN(frame_height, 8) / (4 / 2)) * 64,
+		      BUFFER_ALIGNMENT_32_BYTES);
+	size = num_vpp_pipes * 2 *
+		(vpss_4tap_top_buffer_size + vpss_div2_top_buffer_size) +
+		2 * (vpss_4tap_left_buffer_size + vpss_div2_left_buffer_size) +
+		opb_wr_top_line_luma_buffer_size +
+		opb_wr_top_line_chroma_buffer_size +
+		opb_lb_wr_llb_uv_buffer_size +
+		opb_lb_wr_llb_y_buffer_size;
+
+	return size;
+}
+
+static inline
+u32 hfi_buffer_line_h264d(u32 frame_width, u32 frame_height,
+			  bool is_opb, u32 num_vpp_pipes)
+{
+	u32 vpss_lb_size = 0;
+	u32 _size;
+
+	_size = ALIGN(size_h264d_lb_fe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_fe_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_fe_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h264d_lb_se_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_se_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h264d_lb_pe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_vsp_top(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h264d_lb_recon_dma_metadata_wr(frame_width, frame_height),
+		      DMA_ALIGNMENT) * 2 +
+		ALIGN(size_h264d_qp(frame_width, frame_height),
+		      DMA_ALIGNMENT);
+	_size = ALIGN(_size, DMA_ALIGNMENT);
+	if (is_opb)
+		vpss_lb_size = size_vpss_lb(frame_width, frame_height,
+					    num_vpp_pipes);
+
+	_size = ALIGN((_size + vpss_lb_size),
+		      DMA_ALIGNMENT);
+
+	return _size;
+}
+
+static inline
+u32 size_h265d_lb_fe_top_data(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE *
+		(ALIGN(frame_width, 64) + 8) * 2;
+}
+
+static inline
+u32 size_h265d_lb_fe_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE *
+		(ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS);
+}
+
+static inline
+u32 size_h265d_lb_fe_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE *
+		(ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS);
+}
+
+static inline
+u32 size_h265d_lb_se_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return (LCU_MAX_SIZE_PELS / 8 * (128 / 8)) * ((frame_width + 15) >> 4);
+}
+
+static inline
+u32 size_h265d_lb_se_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return max_t(u32, ((frame_height + 16 - 1) / 8) *
+		     MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,
+		     max_t(u32, ((frame_height + 32 - 1) / 8) *
+			   MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE,
+			   ((frame_height + 64 - 1) / 8) *
+			   MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE));
+}
+
+static inline
+u32 size_h265d_lb_pe_top_data(u32 frame_width, u32 frame_height)
+{
+	return MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE *
+		(ALIGN(frame_width, LCU_MIN_SIZE_PELS) / LCU_MIN_SIZE_PELS);
+}
+
+static inline
+u32 size_h265d_lb_vsp_top(u32 frame_width, u32 frame_height)
+{
+	return ((frame_width + 63) >> 6) * 128;
+}
+
+static inline
+u32 size_h265d_lb_vsp_left(u32 frame_width, u32 frame_height)
+{
+	return ((frame_height + 63) >> 6) * 128;
+}
+
+static inline
+u32 size_h265d_lb_recon_dma_metadata_wr(u32 frame_width, u32 frame_height)
+{
+	return size_h264d_lb_recon_dma_metadata_wr(frame_width, frame_height);
+}
+
+static inline
+u32 size_h265d_qp(u32 frame_width, u32 frame_height)
+{
+	return size_h264d_qp(frame_width, frame_height);
+}
+
+static inline
+u32 hfi_buffer_line_h265d(u32 frame_width, u32 frame_height,
+			  bool is_opb, u32 num_vpp_pipes)
+{
+	u32 vpss_lb_size = 0, _size;
+
+	_size = ALIGN(size_h265d_lb_fe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_fe_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_fe_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h265d_lb_se_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h265d_lb_se_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_pe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_vsp_top(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_h265d_lb_vsp_left(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_h265d_lb_recon_dma_metadata_wr(frame_width, frame_height),
+		      DMA_ALIGNMENT) * 4 +
+		ALIGN(size_h265d_qp(frame_width, frame_height),
+		      DMA_ALIGNMENT);
+	if (is_opb)
+		vpss_lb_size = size_vpss_lb(frame_width, frame_height, num_vpp_pipes);
+
+	return ALIGN((_size + vpss_lb_size), DMA_ALIGNMENT);
+}
+
+static inline
+u32 size_vpxd_lb_fe_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return max_t(u32, ((frame_height + 15) >> 4) * MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,
+		     max_t(u32, ((frame_height + 31) >> 5) * MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE,
+			   ((frame_height + 63) >> 6) * MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE));
+}
+
+static inline
+u32 size_vpxd_lb_fe_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return ((ALIGN(frame_width, 64) + 8) * 10 * 2);
+}
+
+static inline
+u32 size_vpxd_lb_se_top_ctrl(u32 frame_width, u32 frame_height)
+{
+	return ((frame_width + 15) >> 4) * MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE;
+}
+
+static inline
+u32 size_vpxd_lb_se_left_ctrl(u32 frame_width, u32 frame_height)
+{
+	return max_t(u32, ((frame_height + 15) >> 4) * MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,
+		     max_t(u32, ((frame_height + 31) >> 5) * MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE,
+			   ((frame_height + 63) >> 6) * MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE));
+}
+
+static inline
+u32 size_vpxd_lb_recon_dma_metadata_wr(u32 frame_width, u32 frame_height)
+{
+	return ALIGN((ALIGN(frame_height, 8) / (4 / 2)) * 64,
+		     BUFFER_ALIGNMENT_32_BYTES);
+}
+
+static inline
+u32 size_mp2d_lb_fe_top_data(u32 frame_width, u32 frame_height)
+{
+	return ((ALIGN(frame_width, 16) + 8) * 10 * 2);
+}
+
+static inline
+u32 size_vp9d_lb_fe_top_data(u32 frame_width, u32 frame_height)
+{
+	return (ALIGN(ALIGN(frame_width, 8), 64) + 8) * 10 * 2;
+}
+
+static inline
+u32 size_vp9d_lb_pe_top_data(u32 frame_width, u32 frame_height)
+{
+	return ((ALIGN(ALIGN(frame_width, 8), 64) >> 6) * 176);
+}
+
+static inline
+u32 size_vp9d_lb_vsp_top(u32 frame_width, u32 frame_height)
+{
+	return (((ALIGN(ALIGN(frame_width, 8), 64) >> 6) * 64 * 8) + 256);
+}
+
+static inline u32 hfi_iris3_vp9d_comv_size(void)
+{
+	return (((8192 + 63) >> 6) * ((4320 + 63) >> 6) * 8 * 8 * 2 * 8);
+}
+
+static inline
+u32 size_vp9d_qp(u32 frame_width, u32 frame_height)
+{
+	return size_h264d_qp(frame_width, frame_height);
+}
+
+static inline
+u32 hfi_iris3_vp9d_lb_size(u32 frame_width, u32 frame_height,
+			   u32 num_vpp_pipes)
+{
+	return ALIGN(size_vpxd_lb_fe_left_ctrl(frame_width, frame_height),
+		     DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_vpxd_lb_se_left_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) * num_vpp_pipes +
+		ALIGN(size_vp9d_lb_vsp_top(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_vpxd_lb_fe_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		2 * ALIGN(size_vpxd_lb_recon_dma_metadata_wr(frame_width, frame_height),
+			  DMA_ALIGNMENT) +
+		ALIGN(size_vpxd_lb_se_top_ctrl(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_vp9d_lb_pe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_vp9d_lb_fe_top_data(frame_width, frame_height),
+		      DMA_ALIGNMENT) +
+		ALIGN(size_vp9d_qp(frame_width, frame_height),
+		      DMA_ALIGNMENT);
+}
+
+static inline
+u32 hfi_buffer_line_vp9d(u32 frame_width, u32 frame_height,
+			 u32 _yuv_bufcount_min, bool is_opb,
+			 u32 num_vpp_pipes)
+{
+	u32 vpss_lb_size = 0;
+	u32 _lb_size = 0;
+
+	_lb_size = hfi_iris3_vp9d_lb_size(frame_width, frame_height,
+					  num_vpp_pipes);
+
+	if (is_opb)
+		vpss_lb_size = size_vpss_lb(frame_width, frame_height,
+					    num_vpp_pipes);
+
+	return _lb_size + vpss_lb_size;
+}
+
+static inline u32 hfi_buffer_persist_h264d(u32 rpu_enabled)
+{
+	return ALIGN(SIZE_SLIST_BUF_H264 * NUM_SLIST_BUF_H264 +
+		    H264_DISPLAY_BUF_SIZE * H264_NUM_FRM_INFO +
+		    NUM_HW_PIC_BUF * SIZE_SEI_USERDATA +
+		    (rpu_enabled) * NUM_HW_PIC_BUF * SIZE_DOLBY_RPU_METADATA,
+		    DMA_ALIGNMENT);
+}
+
+static inline
+u32 hfi_buffer_persist_h265d(u32 rpu_enabled)
+{
+	return ALIGN((SIZE_SLIST_BUF_H265 * NUM_SLIST_BUF_H265 +
+		      H265_NUM_FRM_INFO * H265_DISPLAY_BUF_SIZE +
+		      H265_NUM_TILE * sizeof(u32) +
+		      NUM_HW_PIC_BUF * SIZE_SEI_USERDATA +
+		      rpu_enabled * NUM_HW_PIC_BUF * SIZE_DOLBY_RPU_METADATA),
+		     DMA_ALIGNMENT);
+}
+
+static inline u32 hfi_buffer_persist_vp9d(void)
+{
+	return ALIGN(VP9_NUM_PROBABILITY_TABLE_BUF * VP9_PROB_TABLE_SIZE,
+		     DMA_ALIGNMENT) +
+		ALIGN(hfi_iris3_vp9d_comv_size(), DMA_ALIGNMENT) +
+		ALIGN(MAX_SUPERFRAME_HEADER_LEN, DMA_ALIGNMENT) +
+		ALIGN(VP9_UDC_HEADER_BUF_SIZE, DMA_ALIGNMENT) +
+		ALIGN(VP9_NUM_FRAME_INFO_BUF * CCE_TILE_OFFSET_SIZE,
+		      DMA_ALIGNMENT) +
+		ALIGN(VP9_NUM_FRAME_INFO_BUF * VP9_FRAME_INFO_BUF_SIZE,
+		      DMA_ALIGNMENT) +
+		HDR10_HIST_EXTRADATA_SIZE;
+}
+
+static inline
+u32 hfi_nv12_ubwc_il_calc_y_buf_size(u32 frame_width, u32 frame_height,
+				     u32 stride_multiple,
+				     u32 min_buf_height_multiple)
+{
+	u32 stride, buf_height;
+
+	stride = ALIGN(frame_width, stride_multiple);
+	buf_height = ALIGN(frame_height, min_buf_height_multiple);
+
+	return ALIGN(stride * buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_nv12_ubwc_il_calc_uv_buf_size(u32 frame_width, u32 frame_height,
+				      u32 stride_multiple,
+				      u32 min_buf_height_multiple)
+{
+	u32 uv_stride, uv_buf_height;
+
+	uv_stride = ALIGN(frame_width, stride_multiple);
+	uv_buf_height = ALIGN(((frame_height + 1) >> 1),
+			      min_buf_height_multiple);
+
+	return ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_ubwc_calc_metadata_plane_stride(u32 frame_width,
+					u32 metadata_stride_multiple,
+					u32 tile_width_in_pels)
+{
+	return ALIGN(((frame_width + (tile_width_in_pels - 1)) / tile_width_in_pels),
+		     metadata_stride_multiple);
+}
+
+static inline
+u32 hfi_ubwc_metadata_plane_bufheight(u32 frame_height,
+				      u32 metadata_height_multiple,
+				      u32 tile_height_in_pels)
+{
+	return ALIGN(((frame_height + (tile_height_in_pels - 1)) / tile_height_in_pels),
+		     metadata_height_multiple);
+}
+
+static inline
+u32 hfi_ubwc_uv_metadata_plane_stride(u32 frame_width,
+				      u32 metadata_stride_multiple,
+				      u32 tile_width_in_pels)
+{
+	return ALIGN(((((frame_width + 1) >> 1) + tile_width_in_pels - 1) /
+		      tile_width_in_pels), metadata_stride_multiple);
+}
+
+static inline
+u32 hfi_ubwc_uv_metadata_plane_bufheight(u32 frame_height,
+					 u32 metadata_height_multiple,
+					 u32 tile_height_in_pels)
+{
+	return ALIGN(((((frame_height + 1) >> 1) + tile_height_in_pels - 1) /
+		      tile_height_in_pels), metadata_height_multiple);
+}
+
+static inline
+u32 hfi_ubwc_metadata_plane_buffer_size(u32 _metadata_tride, u32 _metadata_buf_height)
+{
+	return ALIGN(_metadata_tride * _metadata_buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_nv12_ubwc_il_calc_buf_size_v2(u32 frame_width,
+				      u32 frame_height,
+				      u32 y_stride_multiple,
+				      u32 y_buffer_height_multiple,
+				      u32 uv_stride_multiple,
+				      u32 uv_buffer_height_multiple,
+				      u32 y_metadata_stride_multiple,
+				      u32 y_metadata_buffer_height_multiple,
+				      u32 uv_metadata_stride_multiple,
+				      u32 uv_metadata_buffer_height_multiple)
+{
+	u32 y_buf_size, uv_buf_size, y_meta_size, uv_meta_size;
+	u32 half_height = (frame_height + 1) >> 1;
+	u32 stride, _height;
+
+	y_buf_size =
+		hfi_nv12_ubwc_il_calc_y_buf_size(frame_width, half_height,
+						 y_stride_multiple,
+						 y_buffer_height_multiple);
+	uv_buf_size =
+		hfi_nv12_ubwc_il_calc_uv_buf_size(frame_width, half_height,
+						  uv_stride_multiple,
+						  uv_buffer_height_multiple);
+	stride =
+		hfi_ubwc_calc_metadata_plane_stride(frame_width,
+						    y_metadata_stride_multiple,
+						    HFI_COL_FMT_NV12C_Y_TILE_WIDTH);
+	_height =
+		hfi_ubwc_metadata_plane_bufheight(half_height,
+						  y_metadata_buffer_height_multiple,
+						  HFI_COL_FMT_NV12C_Y_TILE_HEIGHT);
+	y_meta_size = hfi_ubwc_metadata_plane_buffer_size(stride, _height);
+	stride =
+		hfi_ubwc_uv_metadata_plane_stride(frame_width,
+						  uv_metadata_stride_multiple,
+						  HFI_COL_FMT_NV12C_UV_TILE_WIDTH);
+	_height =
+		hfi_ubwc_uv_metadata_plane_bufheight(half_height,
+						     uv_metadata_buffer_height_multiple,
+						     HFI_COL_FMT_NV12C_UV_TILE_HEIGHT);
+	uv_meta_size = hfi_ubwc_metadata_plane_buffer_size(stride, _height);
+
+	return (y_buf_size + uv_buf_size + y_meta_size + uv_meta_size) << 1;
+}
+
+static inline
+u32 hfi_yuv420_tp10_ubwc_calc_y_buf_size(u32 y_stride,
+					 u32 y_buf_height)
+{
+	return ALIGN(y_stride * y_buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_yuv420_tp10_ubwc_calc_uv_buf_size(u32 uv_stride,
+					  u32 uv_buf_height)
+{
+	return ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_yuv420_tp10_ubwc_calc_buf_size(u32 y_stride, u32 y_buf_height,
+				       u32 uv_stride, u32 uv_buf_height,
+				       u32 y_md_stride, u32 y_md_height,
+				       u32 uv_md_stride, u32 uv_md_height)
+{
+	u32 y_data_size, uv_data_size, y_md_size, uv_md_size;
+
+	y_data_size = hfi_yuv420_tp10_ubwc_calc_y_buf_size(y_stride, y_buf_height);
+	uv_data_size = hfi_yuv420_tp10_ubwc_calc_uv_buf_size(uv_stride, uv_buf_height);
+	y_md_size = hfi_ubwc_metadata_plane_buffer_size(y_md_stride, y_md_height);
+	uv_md_size = hfi_ubwc_metadata_plane_buffer_size(uv_md_stride, uv_md_height);
+
+	return y_data_size + uv_data_size + y_md_size + uv_md_size;
+}
+
+int iris_int_buf_size_iris3(struct iris_inst *inst,
+			    enum iris_buffer_type buffer_type);
+
+static inline
+u32 hfi_buffer_bitstream_enc(u32 frame_width, u32 frame_height,
+			     u32 rc_type, bool is_ten_bit)
+{
+	u32 aligned_width, aligned_height, bitstream_size, yuv_size;
+
+	aligned_width = ALIGN(frame_width, 32);
+	aligned_height = ALIGN(frame_height, 32);
+	bitstream_size = aligned_width * aligned_height * 3;
+	yuv_size = (aligned_width * aligned_height * 3) >> 1;
+	if (aligned_width * aligned_height > (4096 * 2176))
+		/* bitstream_size = 0.25 * yuv_size; */
+		bitstream_size = (bitstream_size >> 3);
+	else if (aligned_width * aligned_height > (1280 * 720))
+		/* bitstream_size = 0.5 * yuv_size; */
+		bitstream_size = (bitstream_size >> 2);
+
+	if ((rc_type == HFI_RC_CQ || rc_type == HFI_RC_OFF) &&
+	    bitstream_size < yuv_size)
+		bitstream_size = (bitstream_size << 1);
+
+	if (is_ten_bit)
+		bitstream_size = (bitstream_size) + (bitstream_size >> 2);
+
+	return ALIGN(bitstream_size, HFI_ALIGNMENT_4096);
+}
+
+static inline
+u32 hfi_iris3_enc_recon_buf_count(s32 n_bframe, s32 ltr_count,
+				  s32 _total_hp_layers,
+				  s32 _total_hb_layers,
+				  bool hybrid_hp,
+				  u32 codec_standard)
+{
+	u32 num_ref = 1;
+
+	if (n_bframe)
+		num_ref = 2;
+
+	if (_total_hp_layers > 1) {
+		if (hybrid_hp)
+			num_ref = (_total_hp_layers + 1) >> 1;
+		else if (codec_standard == HFI_CODEC_ENCODE_HEVC)
+			num_ref = (_total_hp_layers + 1) >> 1;
+		else if (codec_standard == HFI_CODEC_ENCODE_AVC &&
+			 _total_hp_layers < 4)
+			num_ref = (_total_hp_layers - 1);
+		else
+			num_ref = _total_hp_layers;
+	}
+
+	if (ltr_count)
+		num_ref = num_ref + ltr_count;
+
+	if (_total_hb_layers > 1) {
+		if (codec_standard == HFI_CODEC_ENCODE_HEVC)
+			num_ref = (_total_hb_layers);
+		else if (codec_standard == HFI_CODEC_ENCODE_AVC)
+			num_ref = (1 << (_total_hb_layers - 2)) + 1;
+	}
+
+	return num_ref + 1;
+}
+
+static inline
+u32 size_bin_bitstream_enc(u32 rc_type, u32 frame_width, u32 frame_height,
+			   u32 work_mode, u32 lcu_size, u32 profile)
+{
+	u32 size_aligned_width = 0, size_aligned_height = 0;
+	u32 bitstream_size_eval = 0;
+
+	size_aligned_width = ALIGN((frame_width), lcu_size);
+	size_aligned_height = ALIGN((frame_height), lcu_size);
+	if (work_mode == HFI_WORKMODE_2) {
+		if (rc_type == HFI_RC_CQ || rc_type == HFI_RC_OFF) {
+			bitstream_size_eval = (((size_aligned_width) *
+						(size_aligned_height) * 3) >> 1);
+		} else {
+			bitstream_size_eval = ((size_aligned_width) *
+					       (size_aligned_height) * 3);
+			if ((size_aligned_width * size_aligned_height) > (4096 * 2176))
+				bitstream_size_eval >>= 3;
+			else if ((size_aligned_width * size_aligned_height) > (480 * 320))
+				bitstream_size_eval >>= 2;
+
+			if (profile == HFI_H265_PROFILE_MAIN_10 ||
+			    profile == HFI_H265_PROFILE_MAIN_10_STILL_PICTURE)
+				bitstream_size_eval = (bitstream_size_eval * 5 >> 2);
+		}
+	} else {
+		bitstream_size_eval = size_aligned_width * size_aligned_height * 3;
+	}
+
+	return ALIGN(bitstream_size_eval, BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_enc_single_pipe(u32 rc_type, u32 bitbin_size, u32 num_vpp_pipes,
+			 u32 frame_width, u32 frame_height, u32 lcu_size)
+{
+	u32 size_single_pipe_eval = 0, sao_bin_buffer_size = 0;
+	u32 size_aligned_width = 0, size_aligned_height = 0;
+	u32 _padded_bin_sz = 0;
+
+	size_aligned_width = ALIGN((frame_width), lcu_size);
+	size_aligned_height = ALIGN((frame_height), lcu_size);
+	if ((size_aligned_width * size_aligned_height) > (3840 * 2160))
+		size_single_pipe_eval = (bitbin_size / num_vpp_pipes);
+	else if (num_vpp_pipes > 2)
+		size_single_pipe_eval = bitbin_size / 2;
+	else
+		size_single_pipe_eval = bitbin_size;
+
+	sao_bin_buffer_size =
+		(64 * ((((frame_width) + BUFFER_ALIGNMENT_32_BYTES) *
+			((frame_height) + BUFFER_ALIGNMENT_32_BYTES)) >> 10)) + 384;
+	_padded_bin_sz = ALIGN(size_single_pipe_eval, BUFFER_ALIGNMENT_256_BYTES);
+	size_single_pipe_eval = sao_bin_buffer_size + _padded_bin_sz;
+	size_single_pipe_eval = ALIGN(size_single_pipe_eval, BUFFER_ALIGNMENT_256_BYTES);
+
+	return size_single_pipe_eval;
+}
+
+static inline
+u32 hfi_buffer_bin_enc(u32 rc_type, u32 frame_width, u32 frame_height, u32 lcu_size,
+		       u32 work_mode, u32 num_vpp_pipes, u32 profile)
+{
+	u32 bitstream_size = 0, total_bitbin_buffers = 0;
+	u32 size_single_pipe = 0, bitbin_size = 0;
+	u32 _size = 0;
+
+	bitstream_size = size_bin_bitstream_enc(rc_type, frame_width,
+						frame_height, work_mode,
+						lcu_size, profile);
+
+	if (work_mode == HFI_WORKMODE_2) {
+		total_bitbin_buffers = 3;
+		bitbin_size = bitstream_size * 12 / 10;
+		bitbin_size = ALIGN(bitbin_size, BUFFER_ALIGNMENT_256_BYTES);
+	} else if ((lcu_size == 16) || (num_vpp_pipes > 1)) {
+		total_bitbin_buffers = 1;
+		bitbin_size = bitstream_size;
+	}
+
+	if (total_bitbin_buffers > 0) {
+		size_single_pipe = size_enc_single_pipe(rc_type, bitbin_size,
+							num_vpp_pipes, frame_width,
+							frame_height, lcu_size);
+		bitbin_size = size_single_pipe * num_vpp_pipes;
+		_size = ALIGN(bitbin_size, BUFFER_ALIGNMENT_256_BYTES) *
+			      total_bitbin_buffers + 512;
+	} else {
+		/* Avoid 512 Bytes allocation in case of 1Pipe HEVC Direct Mode*/
+		_size = 0;
+	}
+
+	return _size;
+}
+
+static inline
+u32 hfi_buffer_bin_h264e(u32 rc_type, u32 frame_width, u32 frame_height,
+			 u32 work_mode, u32 num_vpp_pipes, u32 profile)
+{
+	return hfi_buffer_bin_enc(rc_type, frame_width, frame_height, 16,
+				  work_mode, num_vpp_pipes, profile);
+}
+
+static inline
+u32 hfi_buffer_bin_h265e(u32 rc_type, u32 frame_width, u32 frame_height,
+			 u32 work_mode, u32 num_vpp_pipes, u32 profile)
+{
+	return hfi_buffer_bin_enc(rc_type, frame_width, frame_height, 32,
+				  work_mode, num_vpp_pipes, profile);
+}
+
+static inline
+u32 size_enc_slice_info_buf(u32 num_lcu_in_frame)
+{
+	return ALIGN((256 + (num_lcu_in_frame << 4)), BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_line_buf_ctrl(u32 frame_width_coded)
+{
+	return ALIGN(frame_width_coded, BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_line_buf_ctrl_id2(u32 frame_width_coded)
+{
+	return ALIGN(frame_width_coded, BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_linebuff_data(bool is_ten_bit, u32 frame_width_coded)
+{
+	u32 _size = 0;
+
+	_size = is_ten_bit ?
+		(((((10 * (frame_width_coded) + 1024) + (BUFFER_ALIGNMENT_256_BYTES - 1)) &
+		   (~(BUFFER_ALIGNMENT_256_BYTES - 1))) * 1) +
+		 (((((10 * (frame_width_coded) + 1024) >> 1) + (BUFFER_ALIGNMENT_256_BYTES - 1)) &
+		   (~(BUFFER_ALIGNMENT_256_BYTES - 1))) * 2)) :
+		(((((8 * (frame_width_coded) + 1024) + (BUFFER_ALIGNMENT_256_BYTES - 1)) &
+		   (~(BUFFER_ALIGNMENT_256_BYTES - 1))) * 1) +
+		 (((((8 * (frame_width_coded) + 1024) >> 1) + (BUFFER_ALIGNMENT_256_BYTES - 1)) &
+		   (~(BUFFER_ALIGNMENT_256_BYTES - 1))) * 2));
+
+	return _size;
+}
+
+static inline
+u32 size_left_linebuff_ctrl(u32 standard, u32 frame_height_coded,
+			    u32 num_vpp_pipes_enc)
+{
+	u32 _size = 0;
+
+	_size = standard == HFI_CODEC_ENCODE_HEVC ?
+		(((frame_height_coded) +
+		 (BUFFER_ALIGNMENT_32_BYTES)) / BUFFER_ALIGNMENT_32_BYTES * 4 * 16) :
+		(((frame_height_coded) + 15) / 16 * 5 * 16);
+
+	if ((num_vpp_pipes_enc) > 1) {
+		_size += BUFFER_ALIGNMENT_512_BYTES;
+		_size = ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) *
+			num_vpp_pipes_enc;
+	}
+
+	return ALIGN(_size, BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_left_linebuff_recon_pix(bool is_ten_bit, u32 frame_height_coded,
+				 u32 num_vpp_pipes_enc)
+{
+	return (((is_ten_bit + 1) * 2 * (frame_height_coded) + BUFFER_ALIGNMENT_256_BYTES) +
+		(BUFFER_ALIGNMENT_256_BYTES << (num_vpp_pipes_enc - 1)) - 1) &
+		(~((BUFFER_ALIGNMENT_256_BYTES << (num_vpp_pipes_enc - 1)) - 1)) * 1;
+}
+
+static inline
+u32 size_top_linebuff_ctrl_fe(u32 frame_width_coded, u32 standard)
+{
+	u32 _size = 0;
+
+	_size = standard == HFI_CODEC_ENCODE_HEVC ?
+		(64 * ((frame_width_coded) >> 5)) :
+		(BUFFER_ALIGNMENT_256_BYTES + 16 * ((frame_width_coded) >> 4));
+
+	return ALIGN(_size, BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_left_linebuff_ctrl_fe(u32 frame_height_coded, u32 num_vpp_pipes_enc)
+{
+	return (((BUFFER_ALIGNMENT_256_BYTES + 64 * ((frame_height_coded) >> 4)) +
+		 (BUFFER_ALIGNMENT_256_BYTES << (num_vpp_pipes_enc - 1)) - 1) &
+		 (~((BUFFER_ALIGNMENT_256_BYTES << (num_vpp_pipes_enc - 1)) - 1)) * 1) *
+		num_vpp_pipes_enc;
+}
+
+static inline
+u32 size_left_linebuff_metadata_recon_y(u32 frame_height_coded,
+					bool is_ten_bit,
+					u32 num_vpp_pipes_enc)
+{
+	u32 _size = 0;
+
+	_size = ((BUFFER_ALIGNMENT_256_BYTES + 64 * ((frame_height_coded) /
+		  (8 * (is_ten_bit ? 4 : 8)))));
+	_size = ALIGN(_size, BUFFER_ALIGNMENT_256_BYTES);
+
+	return (_size * num_vpp_pipes_enc);
+}
+
+static inline
+u32 size_left_linebuff_metadata_recon_uv(u32 frame_height_coded,
+					 bool is_ten_bit,
+					 u32 num_vpp_pipes_enc)
+{
+	u32 _size = 0;
+
+	_size = ((BUFFER_ALIGNMENT_256_BYTES + 64 * ((frame_height_coded) /
+		  (4 * (is_ten_bit ? 4 : 8)))));
+	_size = ALIGN(_size, BUFFER_ALIGNMENT_256_BYTES);
+
+	return (_size * num_vpp_pipes_enc);
+}
+
+static inline
+u32 size_linebuff_recon_pix(bool is_ten_bit, u32 frame_width_coded)
+{
+	return ALIGN(((is_ten_bit ? 3 : 2) * (frame_width_coded)),
+		     BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_frame_rc_buf_size(u32 standard, u32 frame_height_coded,
+			   u32 num_vpp_pipes_enc)
+{
+	u32 _size = 0;
+
+	_size = (standard == HFI_CODEC_ENCODE_HEVC) ?
+		(256 + 16 * (14 + ((((frame_height_coded) >> 5) + 7) >> 3))) :
+		(256 + 16 * (14 + ((((frame_height_coded) >> 4) + 7) >> 3)));
+	_size *= 11;
+	if (num_vpp_pipes_enc > 1)
+		_size = ALIGN(_size, BUFFER_ALIGNMENT_256_BYTES) * num_vpp_pipes_enc;
+
+	return ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) * HFI_MAX_COL_FRAME;
+}
+
+static inline u32 enc_bitcnt_buf_size(u32 num_lcu_in_frame)
+{
+	return ALIGN((256 + (4 * (num_lcu_in_frame))), BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline u32 enc_bitmap_buf_size(u32 num_lcu_in_frame)
+{
+	return ALIGN((256 + ((num_lcu_in_frame) >> 3)), BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline u32 size_line_buf_sde(u32 frame_width_coded)
+{
+	return ALIGN((256 + (16 * ((frame_width_coded) >> 4))), BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline u32 size_override_buf(u32 num_lcumb)
+{
+	return ALIGN(((16 * (((num_lcumb) + 7) >> 3))), BUFFER_ALIGNMENT_256_BYTES) * 2;
+}
+
+static inline u32 size_ir_buf(u32 num_lcu_in_frame)
+{
+	return ALIGN((((((num_lcu_in_frame) << 1) + 7) & (~7)) * 3), BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_vpss_line_buf(u32 num_vpp_pipes_enc, u32 frame_height_coded,
+		       u32 frame_width_coded)
+{
+	return ALIGN(((((((8192) >> 2) << 5) * (num_vpp_pipes_enc)) + 64) +
+		      (((((max_t(u32, (frame_width_coded),
+				 (frame_height_coded)) + 3) >> 2) << 5) + 256) * 16)),
+		     BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 size_top_line_buf_first_stg_sao(u32 frame_width_coded)
+{
+	return ALIGN((16 * ((frame_width_coded) >> 5)), BUFFER_ALIGNMENT_256_BYTES);
+}
+
+static inline
+u32 hfi_buffer_line_enc(u32 frame_width, u32 frame_height, bool is_ten_bit,
+			u32 num_vpp_pipes_enc, u32 lcu_size, u32 standard)
+{
+	u32 line_buff_data_size = 0, left_line_buff_ctrl_size = 0;
+	u32 frame_width_coded = 0, frame_height_coded = 0;
+	u32 left_line_buff_metadata_recon__uv__size = 0;
+	u32 left_line_buff_metadata_recon__y__size = 0;
+	u32 width_in_lcus = 0, height_in_lcus = 0;
+	u32 left_line_buff_recon_pix_size = 0;
+	u32 top_line_buff_ctrl_fe_size = 0;
+	u32 line_buff_recon_pix_size = 0;
+
+	width_in_lcus = ((frame_width) + (lcu_size) - 1) / (lcu_size);
+	height_in_lcus = ((frame_height) + (lcu_size) - 1) / (lcu_size);
+	frame_width_coded = width_in_lcus * (lcu_size);
+	frame_height_coded = height_in_lcus * (lcu_size);
+	line_buff_data_size = size_linebuff_data(is_ten_bit, frame_width_coded);
+	left_line_buff_ctrl_size =
+		size_left_linebuff_ctrl(standard, frame_height_coded, num_vpp_pipes_enc);
+	left_line_buff_recon_pix_size =
+		size_left_linebuff_recon_pix(is_ten_bit, frame_height_coded,
+					     num_vpp_pipes_enc);
+	top_line_buff_ctrl_fe_size =
+		size_top_linebuff_ctrl_fe(frame_width_coded, standard);
+	left_line_buff_metadata_recon__y__size =
+		size_left_linebuff_metadata_recon_y(frame_height_coded, is_ten_bit,
+						    num_vpp_pipes_enc);
+	left_line_buff_metadata_recon__uv__size =
+		size_left_linebuff_metadata_recon_uv(frame_height_coded, is_ten_bit,
+						     num_vpp_pipes_enc);
+	line_buff_recon_pix_size = size_linebuff_recon_pix(is_ten_bit, frame_width_coded);
+
+	return size_line_buf_ctrl(frame_width_coded) +
+		size_line_buf_ctrl_id2(frame_width_coded) +
+		line_buff_data_size +
+		left_line_buff_ctrl_size +
+		left_line_buff_recon_pix_size +
+		top_line_buff_ctrl_fe_size +
+		left_line_buff_metadata_recon__y__size +
+		left_line_buff_metadata_recon__uv__size +
+		line_buff_recon_pix_size +
+		size_left_linebuff_ctrl_fe(frame_height_coded,
+					   num_vpp_pipes_enc) +
+		size_line_buf_sde(frame_width_coded) +
+		size_vpss_line_buf(num_vpp_pipes_enc, frame_height_coded,
+				   frame_width_coded) +
+		size_top_line_buf_first_stg_sao(frame_width_coded);
+}
+
+static inline
+u32 hfi_buffer_line_h264e(u32 frame_width, u32 frame_height, bool is_ten_bit,
+			  u32 num_vpp_pipes)
+{
+	return hfi_buffer_line_enc(frame_width, frame_height, 0,
+				   num_vpp_pipes, 16,
+				   HFI_CODEC_ENCODE_AVC);
+}
+
+static inline
+u32 hfi_buffer_line_h265e(u32 frame_width, u32 frame_height, bool is_ten_bit,
+			  u32 num_vpp_pipes)
+{
+	return hfi_buffer_line_enc(frame_width, frame_height,
+				   is_ten_bit, num_vpp_pipes, 32,
+				   HFI_CODEC_ENCODE_HEVC);
+}
+
+static inline
+u32 hfi_buffer_comv_enc(u32 frame_width, u32 frame_height, u32 lcu_size,
+			u32 num_recon, u32 standard)
+{
+	u32 width_in_lcus, height_in_lcus, num_lcu_in_frame;
+	u32 size_colloc_mv = 0, size_colloc_rc = 0;
+	u32 mb_height = ((frame_height) + 15) >> 4;
+	u32 mb_width = ((frame_width) + 15) >> 4;
+
+	width_in_lcus = ((frame_width) + (lcu_size) - 1) / (lcu_size);
+	height_in_lcus = ((frame_height) + (lcu_size) - 1) / (lcu_size);
+	num_lcu_in_frame = width_in_lcus * height_in_lcus;
+	size_colloc_mv = (standard == HFI_CODEC_ENCODE_HEVC) ?
+		(16 * ((num_lcu_in_frame << 2) + BUFFER_ALIGNMENT_32_BYTES)) :
+		(3 * 16 * (width_in_lcus * height_in_lcus + BUFFER_ALIGNMENT_32_BYTES));
+	size_colloc_mv = ALIGN(size_colloc_mv, BUFFER_ALIGNMENT_256_BYTES) * num_recon;
+	size_colloc_rc = (((mb_width + 7) >> 3) * 16 * 2 * mb_height);
+	size_colloc_rc = ALIGN(size_colloc_rc, BUFFER_ALIGNMENT_256_BYTES) * HFI_MAX_COL_FRAME;
+
+	return size_colloc_mv + size_colloc_rc;
+}
+
+static inline
+u32 hfi_buffer_comv_h264e(u32 frame_width, u32 frame_height, u32 num_recon)
+{
+	return hfi_buffer_comv_enc(frame_width, frame_height, 16,
+				   num_recon, HFI_CODEC_ENCODE_AVC);
+}
+
+static inline
+u32 hfi_buffer_comv_h265e(u32 frame_width, u32 frame_height, u32 num_recon)
+{
+	return hfi_buffer_comv_enc(frame_width, frame_height, 32,
+				   num_recon, HFI_CODEC_ENCODE_HEVC);
+}
+
+static inline
+u32 hfi_buffer_non_comv_enc(u32 frame_width, u32 frame_height,
+			    u32 num_vpp_pipes_enc, u32 lcu_size, u32 standard)
+{
+	u32 frame_width_coded = 0, frame_height_coded = 0;
+	u32 width_in_lcus = 0, height_in_lcus = 0;
+	u32 num_lcu_in_frame = 0, num_lcumb = 0;
+	u32 frame_rc_buf_size = 0;
+
+	width_in_lcus = ((frame_width) + (lcu_size) - 1) / (lcu_size);
+	height_in_lcus = ((frame_height) + (lcu_size) - 1) / (lcu_size);
+	num_lcu_in_frame = width_in_lcus * height_in_lcus;
+	frame_width_coded = width_in_lcus * (lcu_size);
+	frame_height_coded = height_in_lcus * (lcu_size);
+	num_lcumb = (frame_height_coded / lcu_size) *
+		((frame_width_coded + lcu_size * 8) / lcu_size);
+	frame_rc_buf_size =
+		size_frame_rc_buf_size(standard, frame_height_coded,
+				       num_vpp_pipes_enc);
+	return size_enc_slice_info_buf(num_lcu_in_frame) +
+		   SIZE_SLICE_CMD_BUFFER +
+		   SIZE_SPS_PPS_SLICE_HDR +
+		   frame_rc_buf_size +
+		   enc_bitcnt_buf_size(num_lcu_in_frame) +
+		   enc_bitmap_buf_size(num_lcu_in_frame) +
+		   SIZE_BSE_SLICE_CMD_BUF +
+		   SIZE_LAMBDA_LUT +
+		   size_override_buf(num_lcumb) +
+		   size_ir_buf(num_lcu_in_frame);
+}
+
+static inline
+u32 hfi_buffer_non_comv_h264e(u32 frame_width, u32 frame_height,
+			      u32 num_vpp_pipes_enc)
+{
+	return hfi_buffer_non_comv_enc(frame_width, frame_height,
+				       num_vpp_pipes_enc, 16,
+				       HFI_CODEC_ENCODE_AVC);
+}
+
+static inline
+u32 hfi_buffer_non_comv_h265e(u32 frame_width, u32 frame_height,
+			      u32 num_vpp_pipes_enc)
+{
+	return hfi_buffer_non_comv_enc(frame_width, frame_height,
+				       num_vpp_pipes_enc, 32,
+				       HFI_CODEC_ENCODE_HEVC);
+}
+
+static inline
+u32 size_enc_ref_buffer(u32 frame_width, u32 frame_height)
+{
+	u32 u_buffer_width = 0, u_buffer_height = 0;
+	u32 u_chroma_buffer_height = 0;
+
+	u_buffer_height = ALIGN(frame_height, HFI_VENUS_HEIGHT_ALIGNMENT);
+	u_chroma_buffer_height = frame_height >> 1;
+	u_chroma_buffer_height = ALIGN(u_chroma_buffer_height, HFI_VENUS_HEIGHT_ALIGNMENT);
+	u_buffer_width = ALIGN(frame_width, HFI_VENUS_WIDTH_ALIGNMENT);
+
+	return (u_buffer_height + u_chroma_buffer_height) * u_buffer_width;
+}
+
+static inline
+u32 size_enc_ten_bit_ref_buffer(u32 frame_width, u32 frame_height)
+{
+	u32 ref_buf_height = 0, ref_luma_stride_in_bytes = 0;
+	u32 chroma_size = 0, ref_buf_size = 0;
+	u32 u_ref_stride = 0, luma_size = 0;
+	u32 ref_chrm_height_in_bytes = 0;
+
+	ref_buf_height = (frame_height + (HFI_VENUS_HEIGHT_ALIGNMENT - 1)) &
+			(~(HFI_VENUS_HEIGHT_ALIGNMENT - 1));
+	ref_luma_stride_in_bytes = ((frame_width + SYSTEM_LAL_TILE10 - 1) / SYSTEM_LAL_TILE10) *
+		SYSTEM_LAL_TILE10;
+	u_ref_stride = 4 * (ref_luma_stride_in_bytes / 3);
+	u_ref_stride = (u_ref_stride + (BUFFER_ALIGNMENT_128_BYTES - 1)) &
+		(~(BUFFER_ALIGNMENT_128_BYTES - 1));
+	luma_size = ref_buf_height * u_ref_stride;
+	ref_chrm_height_in_bytes = (((frame_height + 1) >> 1) + (BUFFER_ALIGNMENT_32_BYTES - 1)) &
+		(~(BUFFER_ALIGNMENT_32_BYTES - 1));
+	chroma_size = u_ref_stride * ref_chrm_height_in_bytes;
+	luma_size = (luma_size + (BUFFER_ALIGNMENT_4096_BYTES - 1)) &
+		(~(BUFFER_ALIGNMENT_4096_BYTES - 1));
+	chroma_size = (chroma_size + (BUFFER_ALIGNMENT_4096_BYTES - 1)) &
+		(~(BUFFER_ALIGNMENT_4096_BYTES - 1));
+	ref_buf_size = luma_size + chroma_size;
+
+	return ref_buf_size;
+}
+
+static inline
+u32 hfi_buffer_dpb_enc(u32 frame_width, u32 frame_height, bool is_ten_bit)
+{
+	u32 metadata_stride, metadata_buf_height, meta_size_y, meta_size_c;
+	u32 ten_bit_ref_buf_size = 0, ref_buf_size = 0;
+	u32 _size = 0;
+
+	if (!is_ten_bit) {
+		ref_buf_size = size_enc_ref_buffer(frame_width, frame_height);
+		metadata_stride =
+			hfi_ubwc_calc_metadata_plane_stride(frame_width, 64,
+							    HFI_COL_FMT_NV12C_Y_TILE_WIDTH);
+		metadata_buf_height =
+			hfi_ubwc_metadata_plane_bufheight(frame_height, 16,
+							  HFI_COL_FMT_NV12C_Y_TILE_HEIGHT);
+		meta_size_y =
+			hfi_ubwc_metadata_plane_buffer_size(metadata_stride, metadata_buf_height);
+		meta_size_c =
+			hfi_ubwc_metadata_plane_buffer_size(metadata_stride, metadata_buf_height);
+		_size = ref_buf_size + meta_size_y + meta_size_c;
+	} else {
+		ten_bit_ref_buf_size = size_enc_ten_bit_ref_buffer(frame_width, frame_height);
+		metadata_stride =
+			hfi_ubwc_calc_metadata_plane_stride(frame_width,
+							    VENUS_METADATA_STRIDE_MULTIPLE,
+							    HFI_COL_FMT_TP10C_Y_TILE_WIDTH);
+		metadata_buf_height =
+			hfi_ubwc_metadata_plane_bufheight(frame_height,
+							  VENUS_METADATA_HEIGHT_MULTIPLE,
+							  HFI_COL_FMT_TP10C_Y_TILE_HEIGHT);
+		meta_size_y =
+			hfi_ubwc_metadata_plane_buffer_size(metadata_stride, metadata_buf_height);
+		meta_size_c =
+			hfi_ubwc_metadata_plane_buffer_size(metadata_stride, metadata_buf_height);
+		_size = ten_bit_ref_buf_size + meta_size_y + meta_size_c;
+	}
+
+	return _size;
+}
+
+static inline
+u32 hfi_buffer_dpb_h264e(u32 frame_width, u32 frame_height)
+{
+	return hfi_buffer_dpb_enc(frame_width, frame_height, 0);
+}
+
+static inline
+u32 hfi_buffer_dpb_h265e(u32 frame_width, u32 frame_height, bool is_ten_bit)
+{
+	return hfi_buffer_dpb_enc(frame_width, frame_height, is_ten_bit);
+}
+
+static inline
+u32 hfi_buffer_vpss_enc(u32 dswidth, u32 dsheight, bool ds_enable,
+			u32 blur, bool is_ten_bit)
+{
+	u32 vpss_size = 0;
+
+	if (ds_enable || blur)
+		vpss_size = hfi_buffer_dpb_enc(dswidth, dsheight, is_ten_bit);
+
+	return vpss_size;
+}
+
+static inline
+u32 hfi_iris3_enc_min_input_buf_count(u32 totalhblayers)
+{
+	u32 numinput = 3;
+
+	if (totalhblayers >= 2)
+		numinput = (1 << (totalhblayers - 1)) + 2;
+
+	return numinput;
+}
+
+u32 enc_output_buffer_size_iris3(struct iris_inst *inst);
+u32 get_recon_buf_count(struct iris_inst *inst);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris3_power.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris3_power.c
@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_core.h"
+#include "iris_instance.h"
+#include "iris_helpers.h"
+#include "platform_common.h"
+#include "vpu_iris3_power.h"
+
+u64 iris_calc_freq_iris3(struct iris_inst *inst, u32 data_size)
+{
+	u32 operating_rate, vsp_factor_num = 1, vsp_factor_den = 1;
+	u64 vsp_cycles = 0, vpp_cycles = 0, fw_cycles = 0;
+	u64 fw_vpp_cycles = 0, bitrate = 0, freq = 0;
+	u32 vpp_cycles_per_mb, mbs_per_second;
+	u32 base_cycles = 0, fps, mbpf;
+	u32 height = 0, width = 0;
+	struct v4l2_format *inp_f;
+
+	inp_f = inst->fmt_src;
+	width = max(inp_f->fmt.pix_mp.width, inst->crop.width);
+	height = max(inp_f->fmt.pix_mp.height, inst->crop.height);
+
+	mbpf = NUM_MBS_PER_FRAME(height, width);
+	fps = inst->max_rate;
+	mbs_per_second = mbpf * fps;
+
+	fw_cycles = fps * inst->cap[MB_CYCLES_FW].value;
+	fw_vpp_cycles = fps * inst->cap[MB_CYCLES_FW_VPP].value;
+
+	if (inst->domain == ENCODER) {
+		vpp_cycles_per_mb =
+			inst->cap[QUALITY_MODE].value == POWER_SAVE_MODE ?
+			inst->cap[MB_CYCLES_LP].value :
+			inst->cap[MB_CYCLES_VPP].value;
+
+		vpp_cycles = mbs_per_second * vpp_cycles_per_mb / inst->cap[PIPE].value;
+
+		if (inst->cap[B_FRAME].value > 1)
+			vpp_cycles += (vpp_cycles / 4) + (vpp_cycles / 8);
+		else if (inst->cap[B_FRAME].value)
+			vpp_cycles += vpp_cycles / 4;
+
+		vpp_cycles += max(div_u64(vpp_cycles, 20), fw_vpp_cycles);
+		if (inst->cap[PIPE].value > 1)
+			vpp_cycles += div_u64(vpp_cycles, 100);
+
+		operating_rate = inst->cap[OPERATING_RATE].value >> 16;
+		if (operating_rate > (inst->cap[FRAME_RATE].value >> 16) &&
+		    (inst->cap[FRAME_RATE].value >> 16)) {
+			vsp_factor_num = operating_rate;
+			vsp_factor_den = inst->cap[FRAME_RATE].value >> 16;
+		}
+		vsp_cycles = div_u64(((u64)inst->cap[BIT_RATE].value * vsp_factor_num),
+				     vsp_factor_den);
+
+		base_cycles = inst->cap[MB_CYCLES_VSP].value;
+		if (inst->cap[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			vsp_cycles = div_u64(vsp_cycles * 135, 100);
+		} else {
+			base_cycles = 0;
+			vsp_cycles = div_u64(vsp_cycles, 2);
+		}
+		vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+		if (inst->cap[STAGE].value == STAGE_1)
+			vsp_cycles = vsp_cycles * 3;
+
+		vsp_cycles += mbs_per_second * base_cycles;
+	} else if (inst->domain == DECODER) {
+		vpp_cycles = mbs_per_second * inst->cap[MB_CYCLES_VPP].value /
+			inst->cap[PIPE].value;
+		vpp_cycles += max(vpp_cycles / 20, fw_vpp_cycles);
+
+		if (inst->cap[PIPE].value > 1)
+			vpp_cycles += div_u64(vpp_cycles * 59, 1000);
+
+		base_cycles = inst->has_bframe ?
+			80 : inst->cap[MB_CYCLES_VSP].value;
+		bitrate = fps * data_size * 8;
+		vsp_cycles = bitrate;
+
+		if (inst->codec == VP9) {
+			vsp_cycles = div_u64(vsp_cycles * 170, 100);
+		} else if (inst->cap[ENTROPY_MODE].value ==
+				V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			vsp_cycles = div_u64(vsp_cycles * 135, 100);
+		} else {
+			base_cycles = 0;
+			vsp_cycles = div_u64(vsp_cycles, 2);
+		}
+		vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+		if (inst->cap[STAGE].value == STAGE_1)
+			vsp_cycles = vsp_cycles * 3;
+
+		vsp_cycles += mbs_per_second * base_cycles;
+
+		/* Add 25 percent extra for HEVC 10bit all intra use case */
+		if (inst->iframe && inst->codec == HEVC &&
+			is_10bit_colorformat(inst->fmt_dst->fmt.pix_mp.pixelformat))
+			vsp_cycles += div_u64(vsp_cycles * 25, 100);
+	}
+
+	freq = max3(vpp_cycles, vsp_cycles, fw_cycles);
+
+	return freq;
+}
+
+int iris_calc_bw_iris3(struct iris_inst *inst, struct bus_vote_data *data)
+{
+	const struct bw_info *bw_tbl = NULL;
+	unsigned int num_rows = 0;
+	unsigned int i, mbs, mbps;
+	struct iris_core *core;
+
+	if (!data)
+		return 0;
+
+	core = inst->core;
+
+	mbs = (ALIGN(data->height, 16) / 16) * (ALIGN(data->width, 16) / 16);
+	mbps = mbs * data->fps;
+	if (mbps == 0)
+		return 0;
+
+	if (inst->domain == DECODER) {
+		bw_tbl = core->platform_data->bw_tbl_dec;
+		num_rows = core->platform_data->bw_tbl_dec_size;
+	} else if (inst->domain == ENCODER) {
+		bw_tbl = core->platform_data->bw_tbl_enc;
+		num_rows = core->platform_data->bw_tbl_enc_size;
+	}
+
+	if (!bw_tbl || num_rows == 0)
+		return 0;
+
+	for (i = 0; i < num_rows; i++) {
+		if (i != 0 && mbps > bw_tbl[i].mbs_per_sec)
+			break;
+
+		if (is_10bit_colorformat(data->color_formats[0]))
+			data->bus_bw = bw_tbl[i].bw_ddr_10bit;
+		else
+			data->bus_bw = bw_tbl[i].bw_ddr;
+	}
+
+	dev_dbg(core->dev, "bus_bw %llu\n", data->bus_bw);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/iris/vpu_iris3_power.h
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/iris/vpu_iris3_power.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_VPU_IRIS3_POWER_H__
+#define __H_VPU_IRIS3_POWER_H__
+
+u64 iris_calc_freq_iris3(struct iris_inst *inst, u32 data_size);
+int iris_calc_bw_iris3(struct iris_inst *inst,
+		       struct bus_vote_data *vote_data);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/venus/core.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/venus/core.c
@@ -406,8 +406,8 @@
 	of_platform_depopulate(dev);
 err_runtime_disable:
 	pm_runtime_put_noidle(dev);
-	pm_runtime_set_suspended(dev);
 	pm_runtime_disable(dev);
+	pm_runtime_set_suspended(dev);
 	hfi_destroy(core);
 err_core_deinit:
 	hfi_core_deinit(core, false);
@@ -424,6 +424,7 @@
 	struct device *dev = core->dev;
 	int ret;
 
+	cancel_delayed_work_sync(&core->work);
 	ret = pm_runtime_get_sync(dev);
 	WARN_ON(ret < 0);
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/qcom/venus/vdec.c
+++ linux-qcom-6.8.0/drivers/media/platform/qcom/venus/vdec.c
@@ -1255,7 +1255,7 @@
 		break;
 	case VENUS_DEC_STATE_INIT:
 	case VENUS_DEC_STATE_CAPTURE_SETUP:
-		ret = hfi_session_flush(inst, HFI_FLUSH_INPUT, true);
+		ret = hfi_session_flush(inst, HFI_FLUSH_ALL, true);
 		break;
 	default:
 		break;
@@ -1747,6 +1747,7 @@
 
 	vdec_pm_get(inst);
 
+	cancel_work_sync(&inst->delayed_process_work);
 	v4l2_m2m_ctx_release(inst->m2m_ctx);
 	v4l2_m2m_release(inst->m2m_dev);
 	vdec_ctrl_deinit(inst);
--- linux-qcom-6.8.0.orig/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c
+++ linux-qcom-6.8.0/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c
@@ -1914,12 +1914,14 @@
 
 	ret = v4l2_async_register_subdev(&priv->subdev);
 	if (ret < 0)
-		goto error_async;
+		goto error_pm_runtime;
 
 	dev_info(priv->dev, "%d lanes found\n", priv->lanes);
 
 	return 0;
 
+error_pm_runtime:
+	pm_runtime_disable(&pdev->dev);
 error_async:
 	v4l2_async_nf_unregister(&priv->notifier);
 	v4l2_async_nf_cleanup(&priv->notifier);
@@ -1936,6 +1938,7 @@
 	v4l2_async_nf_unregister(&priv->notifier);
 	v4l2_async_nf_cleanup(&priv->notifier);
 	v4l2_async_unregister_subdev(&priv->subdev);
+	v4l2_subdev_cleanup(&priv->subdev);
 
 	pm_runtime_disable(&pdev->dev);
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
+++ linux-qcom-6.8.0/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
@@ -742,12 +742,22 @@
 	 */
 	switch (vin->mbus_code) {
 	case MEDIA_BUS_FMT_YUYV8_1X16:
-		/* BT.601/BT.1358 16bit YCbCr422 */
-		vnmc |= VNMC_INF_YUV16;
+		if (vin->is_csi)
+			/* YCbCr422 8-bit */
+			vnmc |= VNMC_INF_YUV8_BT601;
+		else
+			/* BT.601/BT.1358 16bit YCbCr422 */
+			vnmc |= VNMC_INF_YUV16;
 		input_is_yuv = true;
 		break;
 	case MEDIA_BUS_FMT_UYVY8_1X16:
-		vnmc |= VNMC_INF_YUV16 | VNMC_YCAL;
+		if (vin->is_csi)
+			/* YCbCr422 8-bit */
+			vnmc |= VNMC_INF_YUV8_BT601;
+		else
+			/* BT.601/BT.1358 16bit YCbCr422 */
+			vnmc |= VNMC_INF_YUV16;
+		vnmc |= VNMC_YCAL;
 		input_is_yuv = true;
 		break;
 	case MEDIA_BUS_FMT_UYVY8_2X8:
--- linux-qcom-6.8.0.orig/drivers/media/platform/renesas/rcar-vin/rcar-vin.h
+++ linux-qcom-6.8.0/drivers/media/platform/renesas/rcar-vin/rcar-vin.h
@@ -59,7 +59,7 @@
 
 #define RVIN_REMOTES_MAX \
 	(((unsigned int)RVIN_CSI_MAX) > ((unsigned int)RVIN_ISP_MAX) ? \
-	 RVIN_CSI_MAX : RVIN_ISP_MAX)
+	 (unsigned int)RVIN_CSI_MAX : (unsigned int)RVIN_ISP_MAX)
 
 /**
  * enum rvin_dma_state - DMA states
--- linux-qcom-6.8.0.orig/drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c
+++ linux-qcom-6.8.0/drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c
@@ -858,6 +858,7 @@
 	{ .compatible = "renesas,rzg2l-csi2", },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, rzg2l_csi2_of_table);
 
 static struct platform_driver rzg2l_csi2_pdrv = {
 	.remove_new = rzg2l_csi2_remove,
--- linux-qcom-6.8.0.orig/drivers/media/platform/renesas/vsp1/vsp1_histo.c
+++ linux-qcom-6.8.0/drivers/media/platform/renesas/vsp1/vsp1_histo.c
@@ -36,9 +36,8 @@
 vsp1_histogram_buffer_get(struct vsp1_histogram *histo)
 {
 	struct vsp1_histogram_buffer *buf = NULL;
-	unsigned long flags;
 
-	spin_lock_irqsave(&histo->irqlock, flags);
+	spin_lock(&histo->irqlock);
 
 	if (list_empty(&histo->irqqueue))
 		goto done;
@@ -49,7 +48,7 @@
 	histo->readout = true;
 
 done:
-	spin_unlock_irqrestore(&histo->irqlock, flags);
+	spin_unlock(&histo->irqlock);
 	return buf;
 }
 
@@ -58,7 +57,6 @@
 				    size_t size)
 {
 	struct vsp1_pipeline *pipe = histo->entity.pipe;
-	unsigned long flags;
 
 	/*
 	 * The pipeline pointer is guaranteed to be valid as this function is
@@ -70,10 +68,10 @@
 	vb2_set_plane_payload(&buf->buf.vb2_buf, 0, size);
 	vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE);
 
-	spin_lock_irqsave(&histo->irqlock, flags);
+	spin_lock(&histo->irqlock);
 	histo->readout = false;
 	wake_up(&histo->wait_queue);
-	spin_unlock_irqrestore(&histo->irqlock, flags);
+	spin_unlock(&histo->irqlock);
 }
 
 /* -----------------------------------------------------------------------------
@@ -124,11 +122,10 @@
 	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
 	struct vsp1_histogram *histo = vb2_get_drv_priv(vb->vb2_queue);
 	struct vsp1_histogram_buffer *buf = to_vsp1_histogram_buffer(vbuf);
-	unsigned long flags;
 
-	spin_lock_irqsave(&histo->irqlock, flags);
+	spin_lock_irq(&histo->irqlock);
 	list_add_tail(&buf->queue, &histo->irqqueue);
-	spin_unlock_irqrestore(&histo->irqlock, flags);
+	spin_unlock_irq(&histo->irqlock);
 }
 
 static int histo_start_streaming(struct vb2_queue *vq, unsigned int count)
@@ -140,9 +137,8 @@
 {
 	struct vsp1_histogram *histo = vb2_get_drv_priv(vq);
 	struct vsp1_histogram_buffer *buffer;
-	unsigned long flags;
 
-	spin_lock_irqsave(&histo->irqlock, flags);
+	spin_lock_irq(&histo->irqlock);
 
 	/* Remove all buffers from the IRQ queue. */
 	list_for_each_entry(buffer, &histo->irqqueue, queue)
@@ -152,7 +148,7 @@
 	/* Wait for the buffer being read out (if any) to complete. */
 	wait_event_lock_irq(histo->wait_queue, !histo->readout, histo->irqlock);
 
-	spin_unlock_irqrestore(&histo->irqlock, flags);
+	spin_unlock_irq(&histo->irqlock);
 }
 
 static const struct vb2_ops histo_video_queue_qops = {
--- linux-qcom-6.8.0.orig/drivers/media/platform/renesas/vsp1/vsp1_pipe.h
+++ linux-qcom-6.8.0/drivers/media/platform/renesas/vsp1/vsp1_pipe.h
@@ -73,7 +73,7 @@
  * @wpf: The WPF partition window configuration
  */
 struct vsp1_partition {
-	struct vsp1_partition_window rpf;
+	struct vsp1_partition_window rpf[VSP1_MAX_RPF];
 	struct vsp1_partition_window uds_sink;
 	struct vsp1_partition_window uds_source;
 	struct vsp1_partition_window sru;
--- linux-qcom-6.8.0.orig/drivers/media/platform/renesas/vsp1/vsp1_rpf.c
+++ linux-qcom-6.8.0/drivers/media/platform/renesas/vsp1/vsp1_rpf.c
@@ -315,8 +315,8 @@
 	 * 'width' need to be adjusted.
 	 */
 	if (pipe->partitions > 1) {
-		crop.width = pipe->partition->rpf.width;
-		crop.left += pipe->partition->rpf.left;
+		crop.width = pipe->partition->rpf[rpf->entity.index].width;
+		crop.left += pipe->partition->rpf[rpf->entity.index].left;
 	}
 
 	if (pipe->interlaced) {
@@ -371,7 +371,9 @@
 			  unsigned int partition_idx,
 			  struct vsp1_partition_window *window)
 {
-	partition->rpf = *window;
+	struct vsp1_rwpf *rpf = to_rwpf(&entity->subdev);
+
+	partition->rpf[rpf->entity.index] = *window;
 }
 
 static const struct vsp1_entity_operations rpf_entity_ops = {
--- linux-qcom-6.8.0.orig/drivers/media/platform/rockchip/rga/rga.c
+++ linux-qcom-6.8.0/drivers/media/platform/rockchip/rga/rga.c
@@ -98,7 +98,7 @@
 	src_vq->drv_priv = ctx;
 	src_vq->ops = &rga_qops;
 	src_vq->mem_ops = &vb2_dma_sg_memops;
-	dst_vq->gfp_flags = __GFP_DMA32;
+	src_vq->gfp_flags = __GFP_DMA32;
 	src_vq->buf_struct_size = sizeof(struct rga_vb_buffer);
 	src_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
 	src_vq->lock = &ctx->rga->mutex;
--- linux-qcom-6.8.0.orig/drivers/media/platform/samsung/exynos4-is/media-dev.h
+++ linux-qcom-6.8.0/drivers/media/platform/samsung/exynos4-is/media-dev.h
@@ -178,8 +178,9 @@
 #ifdef CONFIG_OF
 static inline bool fimc_md_is_isp_available(struct device_node *node)
 {
-	node = of_get_child_by_name(node, FIMC_IS_OF_NODE_NAME);
-	return node ? of_device_is_available(node) : false;
+	struct device_node *child __free(device_node) =
+		of_get_child_by_name(node, FIMC_IS_OF_NODE_NAME);
+	return child ? of_device_is_available(child) : false;
 }
 #else
 #define fimc_md_is_isp_available(node) (false)
--- linux-qcom-6.8.0.orig/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c
+++ linux-qcom-6.8.0/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c
@@ -775,11 +775,14 @@
 		(unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2;
 	jpeg_buffer.curr = 0;
 
-	word = 0;
-
 	if (get_word_be(&jpeg_buffer, &word))
 		return;
-	jpeg_buffer.size = (long)word - 2;
+
+	if (word < 2)
+		jpeg_buffer.size = 0;
+	else
+		jpeg_buffer.size = (long)word - 2;
+
 	jpeg_buffer.data += 2;
 	jpeg_buffer.curr = 0;
 
@@ -1058,6 +1061,7 @@
 	if (byte == -1)
 		return -1;
 	*word = (unsigned int)byte | temp;
+
 	return 0;
 }
 
@@ -1145,7 +1149,7 @@
 			if (get_word_be(&jpeg_buffer, &word))
 				break;
 			length = (long)word - 2;
-			if (!length)
+			if (length <= 0)
 				return false;
 			sof = jpeg_buffer.curr; /* after 0xffc0 */
 			sof_len = length;
@@ -1176,7 +1180,7 @@
 			if (get_word_be(&jpeg_buffer, &word))
 				break;
 			length = (long)word - 2;
-			if (!length)
+			if (length <= 0)
 				return false;
 			if (n_dqt >= S5P_JPEG_MAX_MARKER)
 				return false;
@@ -1189,7 +1193,7 @@
 			if (get_word_be(&jpeg_buffer, &word))
 				break;
 			length = (long)word - 2;
-			if (!length)
+			if (length <= 0)
 				return false;
 			if (n_dht >= S5P_JPEG_MAX_MARKER)
 				return false;
@@ -1214,6 +1218,7 @@
 			if (get_word_be(&jpeg_buffer, &word))
 				break;
 			length = (long)word - 2;
+			/* No need to check underflows as skip() does it  */
 			skip(&jpeg_buffer, length);
 			break;
 		}
--- linux-qcom-6.8.0.orig/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
+++ linux-qcom-6.8.0/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
@@ -202,8 +202,8 @@
 	return 0;
 
 err_init_entity:
-	while (i > 0)
-		dcmipp->pipe_cfg->ents[i - 1].release(dcmipp->entity[i - 1]);
+	while (i-- > 0)
+		dcmipp->pipe_cfg->ents[i].release(dcmipp->entity[i]);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
+++ linux-qcom-6.8.0/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
@@ -39,6 +39,10 @@
 	.link_validate = v4l2_subdev_link_validate,
 };
 
+static const struct media_entity_operations sun4i_csi_subdev_entity_ops = {
+	.link_validate = v4l2_subdev_link_validate,
+};
+
 static int sun4i_csi_notify_bound(struct v4l2_async_notifier *notifier,
 				  struct v4l2_subdev *subdev,
 				  struct v4l2_async_connection *asd)
@@ -214,6 +218,7 @@
 	subdev->internal_ops = &sun4i_csi_subdev_internal_ops;
 	subdev->flags = V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
 	subdev->entity.function = MEDIA_ENT_F_VID_IF_BRIDGE;
+	subdev->entity.ops = &sun4i_csi_subdev_entity_ops;
 	subdev->owner = THIS_MODULE;
 	snprintf(subdev->name, sizeof(subdev->name), "sun4i-csi-0");
 	v4l2_set_subdevdata(subdev, csi);
--- linux-qcom-6.8.0.orig/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig
+++ linux-qcom-6.8.0/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig
@@ -8,6 +8,7 @@
 	select VIDEO_V4L2_SUBDEV_API
 	select V4L2_FWNODE
 	select REGMAP_MMIO
+	select GENERIC_PHY
 	select GENERIC_PHY_MIPI_DPHY
 	help
 	   Support for the Allwinner A83T MIPI CSI-2 controller and D-PHY.
--- linux-qcom-6.8.0.orig/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+++ linux-qcom-6.8.0/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
@@ -66,6 +66,7 @@
 	struct vb2_v4l2_buffer *src, *dst;
 	unsigned int hstep, vstep;
 	dma_addr_t addr;
+	int i;
 
 	src = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
 	dst = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
@@ -160,6 +161,26 @@
 	deinterlace_write(dev, DEINTERLACE_CH1_HORZ_FACT, hstep);
 	deinterlace_write(dev, DEINTERLACE_CH1_VERT_FACT, vstep);
 
+	/* neutral filter coefficients */
+	deinterlace_set_bits(dev, DEINTERLACE_FRM_CTRL,
+			     DEINTERLACE_FRM_CTRL_COEF_ACCESS);
+	readl_poll_timeout(dev->base + DEINTERLACE_STATUS, val,
+			   val & DEINTERLACE_STATUS_COEF_STATUS, 2, 40);
+
+	for (i = 0; i < 32; i++) {
+		deinterlace_write(dev, DEINTERLACE_CH0_HORZ_COEF0 + i * 4,
+				  DEINTERLACE_IDENTITY_COEF);
+		deinterlace_write(dev, DEINTERLACE_CH0_VERT_COEF + i * 4,
+				  DEINTERLACE_IDENTITY_COEF);
+		deinterlace_write(dev, DEINTERLACE_CH1_HORZ_COEF0 + i * 4,
+				  DEINTERLACE_IDENTITY_COEF);
+		deinterlace_write(dev, DEINTERLACE_CH1_VERT_COEF + i * 4,
+				  DEINTERLACE_IDENTITY_COEF);
+	}
+
+	deinterlace_clr_set_bits(dev, DEINTERLACE_FRM_CTRL,
+				 DEINTERLACE_FRM_CTRL_COEF_ACCESS, 0);
+
 	deinterlace_clr_set_bits(dev, DEINTERLACE_FIELD_CTRL,
 				 DEINTERLACE_FIELD_CTRL_FIELD_CNT_MSK,
 				 DEINTERLACE_FIELD_CTRL_FIELD_CNT(ctx->field));
@@ -248,7 +269,6 @@
 static void deinterlace_init(struct deinterlace_dev *dev)
 {
 	u32 val;
-	int i;
 
 	deinterlace_write(dev, DEINTERLACE_BYPASS,
 			  DEINTERLACE_BYPASS_CSC);
@@ -284,27 +304,7 @@
 
 	deinterlace_clr_set_bits(dev, DEINTERLACE_CHROMA_DIFF,
 				 DEINTERLACE_CHROMA_DIFF_TH_MSK,
-				 DEINTERLACE_CHROMA_DIFF_TH(5));
-
-	/* neutral filter coefficients */
-	deinterlace_set_bits(dev, DEINTERLACE_FRM_CTRL,
-			     DEINTERLACE_FRM_CTRL_COEF_ACCESS);
-	readl_poll_timeout(dev->base + DEINTERLACE_STATUS, val,
-			   val & DEINTERLACE_STATUS_COEF_STATUS, 2, 40);
-
-	for (i = 0; i < 32; i++) {
-		deinterlace_write(dev, DEINTERLACE_CH0_HORZ_COEF0 + i * 4,
-				  DEINTERLACE_IDENTITY_COEF);
-		deinterlace_write(dev, DEINTERLACE_CH0_VERT_COEF + i * 4,
-				  DEINTERLACE_IDENTITY_COEF);
-		deinterlace_write(dev, DEINTERLACE_CH1_HORZ_COEF0 + i * 4,
-				  DEINTERLACE_IDENTITY_COEF);
-		deinterlace_write(dev, DEINTERLACE_CH1_VERT_COEF + i * 4,
-				  DEINTERLACE_IDENTITY_COEF);
-	}
-
-	deinterlace_clr_set_bits(dev, DEINTERLACE_FRM_CTRL,
-				 DEINTERLACE_FRM_CTRL_COEF_ACCESS, 0);
+				 DEINTERLACE_CHROMA_DIFF_TH(31));
 }
 
 static inline struct deinterlace_ctx *deinterlace_file2ctx(struct file *file)
@@ -929,11 +929,18 @@
 		return ret;
 	}
 
+	ret = reset_control_deassert(dev->rstc);
+	if (ret) {
+		dev_err(dev->dev, "Failed to apply reset\n");
+
+		goto err_exclusive_rate;
+	}
+
 	ret = clk_prepare_enable(dev->bus_clk);
 	if (ret) {
 		dev_err(dev->dev, "Failed to enable bus clock\n");
 
-		goto err_exclusive_rate;
+		goto err_rst;
 	}
 
 	ret = clk_prepare_enable(dev->mod_clk);
@@ -950,23 +957,16 @@
 		goto err_mod_clk;
 	}
 
-	ret = reset_control_deassert(dev->rstc);
-	if (ret) {
-		dev_err(dev->dev, "Failed to apply reset\n");
-
-		goto err_ram_clk;
-	}
-
 	deinterlace_init(dev);
 
 	return 0;
 
-err_ram_clk:
-	clk_disable_unprepare(dev->ram_clk);
 err_mod_clk:
 	clk_disable_unprepare(dev->mod_clk);
 err_bus_clk:
 	clk_disable_unprepare(dev->bus_clk);
+err_rst:
+	reset_control_assert(dev->rstc);
 err_exclusive_rate:
 	clk_rate_exclusive_put(dev->mod_clk);
 
@@ -977,11 +977,12 @@
 {
 	struct deinterlace_dev *dev = dev_get_drvdata(device);
 
-	reset_control_assert(dev->rstc);
-
 	clk_disable_unprepare(dev->ram_clk);
 	clk_disable_unprepare(dev->mod_clk);
 	clk_disable_unprepare(dev->bus_clk);
+
+	reset_control_assert(dev->rstc);
+
 	clk_rate_exclusive_put(dev->mod_clk);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
+++ linux-qcom-6.8.0/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
@@ -762,15 +762,14 @@
 			dev_warn(csi->dev,
 				 "Failed to drain DMA. Next frame might be bogus\n");
 
+		spin_lock_irqsave(&dma->lock, flags);
 		ret = ti_csi2rx_start_dma(csi, buf);
 		if (ret) {
-			dev_err(csi->dev, "Failed to start DMA: %d\n", ret);
-			spin_lock_irqsave(&dma->lock, flags);
 			vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
 			dma->state = TI_CSI2RX_DMA_IDLE;
 			spin_unlock_irqrestore(&dma->lock, flags);
+			dev_err(csi->dev, "Failed to start DMA: %d\n", ret);
 		} else {
-			spin_lock_irqsave(&dma->lock, flags);
 			list_add_tail(&buf->list, &dma->submitted);
 			spin_unlock_irqrestore(&dma->lock, flags);
 		}
--- linux-qcom-6.8.0.orig/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ linux-qcom-6.8.0/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -161,8 +161,7 @@
 		av1_dec->frame_refs[i].timestamp = timestamp;
 		av1_dec->frame_refs[i].frame_type = frame->frame_type;
 		av1_dec->frame_refs[i].order_hint = frame->order_hint;
-		if (!av1_dec->frame_refs[i].vb2_ref)
-			av1_dec->frame_refs[i].vb2_ref = hantro_get_dst_buf(ctx);
+		av1_dec->frame_refs[i].vb2_ref = hantro_get_dst_buf(ctx);
 
 		for (j = 0; j < V4L2_AV1_TOTAL_REFS_PER_FRAME; j++)
 			av1_dec->frame_refs[i].order_hints[j] = frame->order_hints[j];
--- linux-qcom-6.8.0.orig/drivers/media/radio/radio-shark2.c
+++ linux-qcom-6.8.0/drivers/media/radio/radio-shark2.c
@@ -62,7 +62,7 @@
 #ifdef SHARK_USE_LEDS
 	struct work_struct led_work;
 	struct led_classdev leds[NO_LEDS];
-	char led_names[NO_LEDS][32];
+	char led_names[NO_LEDS][64];
 	atomic_t brightness[NO_LEDS];
 	unsigned long brightness_new;
 #endif
--- linux-qcom-6.8.0.orig/drivers/media/radio/wl128x/fmdrv_common.c
+++ linux-qcom-6.8.0/drivers/media/radio/wl128x/fmdrv_common.c
@@ -466,11 +466,12 @@
 			   jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000);
 		return -ETIMEDOUT;
 	}
+	spin_lock_irqsave(&fmdev->resp_skb_lock, flags);
 	if (!fmdev->resp_skb) {
+		spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags);
 		fmerr("Response SKB is missing\n");
 		return -EFAULT;
 	}
-	spin_lock_irqsave(&fmdev->resp_skb_lock, flags);
 	skb = fmdev->resp_skb;
 	fmdev->resp_skb = NULL;
 	spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags);
--- linux-qcom-6.8.0.orig/drivers/media/rc/imon.c
+++ linux-qcom-6.8.0/drivers/media/rc/imon.c
@@ -1148,10 +1148,7 @@
 
 	memcpy(ictx->usb_tx_buf, &ir_proto_packet, sizeof(ir_proto_packet));
 
-	if (!mutex_is_locked(&ictx->lock)) {
-		unlock = true;
-		mutex_lock(&ictx->lock);
-	}
+	unlock = mutex_trylock(&ictx->lock);
 
 	retval = send_packet(ictx);
 	if (retval)
--- linux-qcom-6.8.0.orig/drivers/media/rc/lirc_dev.c
+++ linux-qcom-6.8.0/drivers/media/rc/lirc_dev.c
@@ -828,8 +828,10 @@
 		return ERR_PTR(-EINVAL);
 	}
 
-	if (write && !(f.file->f_mode & FMODE_WRITE))
+	if (write && !(f.file->f_mode & FMODE_WRITE)) {
+		fdput(f);
 		return ERR_PTR(-EPERM);
+	}
 
 	fh = f.file->private_data;
 	dev = fh->rc;
--- linux-qcom-6.8.0.orig/drivers/media/test-drivers/vivid/vivid-core.c
+++ linux-qcom-6.8.0/drivers/media/test-drivers/vivid/vivid-core.c
@@ -884,7 +884,7 @@
 	 * videobuf2-core.c to MAX_BUFFER_INDEX.
 	 */
 	if (buf_type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
-		q->max_num_buffers = 64;
+		q->max_num_buffers = MAX_VID_CAP_BUFFERS;
 	if (buf_type == V4L2_BUF_TYPE_SDR_CAPTURE)
 		q->max_num_buffers = 1024;
 	if (buf_type == V4L2_BUF_TYPE_VBI_CAPTURE)
--- linux-qcom-6.8.0.orig/drivers/media/test-drivers/vivid/vivid-core.h
+++ linux-qcom-6.8.0/drivers/media/test-drivers/vivid/vivid-core.h
@@ -26,6 +26,8 @@
 #define MAX_INPUTS 16
 /* The maximum number of outputs */
 #define MAX_OUTPUTS 16
+/* The maximum number of video capture buffers */
+#define MAX_VID_CAP_BUFFERS 64
 /* The maximum up or down scaling factor is 4 */
 #define MAX_ZOOM  4
 /* The maximum image width/height are set to 4K DMT */
@@ -377,7 +379,7 @@
 	/* video capture */
 	struct tpg_data			tpg;
 	unsigned			ms_vid_cap;
-	bool				must_blank[VIDEO_MAX_FRAME];
+	bool				must_blank[MAX_VID_CAP_BUFFERS];
 
 	const struct vivid_fmt		*fmt_cap;
 	struct v4l2_fract		timeperframe_vid_cap;
--- linux-qcom-6.8.0.orig/drivers/media/test-drivers/vivid/vivid-ctrls.c
+++ linux-qcom-6.8.0/drivers/media/test-drivers/vivid/vivid-ctrls.c
@@ -519,7 +519,7 @@
 		break;
 	case VIVID_CID_PERCENTAGE_FILL:
 		tpg_s_perc_fill(&dev->tpg, ctrl->val);
-		for (i = 0; i < VIDEO_MAX_FRAME; i++)
+		for (i = 0; i < MAX_VID_CAP_BUFFERS; i++)
 			dev->must_blank[i] = ctrl->val < 100;
 		break;
 	case VIVID_CID_INSERT_SAV:
--- linux-qcom-6.8.0.orig/drivers/media/test-drivers/vivid/vivid-vid-cap.c
+++ linux-qcom-6.8.0/drivers/media/test-drivers/vivid/vivid-vid-cap.c
@@ -106,8 +106,9 @@
 		if (*nplanes != buffers)
 			return -EINVAL;
 		for (p = 0; p < buffers; p++) {
-			if (sizes[p] < tpg_g_line_width(&dev->tpg, p) * h +
-						dev->fmt_cap->data_offset[p])
+			if (sizes[p] < tpg_g_line_width(&dev->tpg, p) * h /
+					dev->fmt_cap->vdownsampling[p] +
+					dev->fmt_cap->data_offset[p])
 				return -EINVAL;
 		}
 	} else {
@@ -215,7 +216,7 @@
 
 	dev->vid_cap_seq_count = 0;
 	dprintk(dev, 1, "%s\n", __func__);
-	for (i = 0; i < VIDEO_MAX_FRAME; i++)
+	for (i = 0; i < MAX_VID_CAP_BUFFERS; i++)
 		dev->must_blank[i] = tpg_g_perc_fill(&dev->tpg) < 100;
 	if (dev->start_streaming_error) {
 		dev->start_streaming_error = false;
@@ -1462,12 +1463,19 @@
 	h_freq = (u32)bt->pixelclock / total_h_pixel;
 
 	if (bt->standards == 0 || (bt->standards & V4L2_DV_BT_STD_CVT)) {
+		struct v4l2_dv_timings cvt = {};
+
 		if (v4l2_detect_cvt(total_v_lines, h_freq, bt->vsync, bt->width,
-				    bt->polarities, bt->interlaced, timings))
+				    bt->polarities, bt->interlaced,
+				    &vivid_dv_timings_cap, &cvt) &&
+		    cvt.bt.width == bt->width && cvt.bt.height == bt->height) {
+			*timings = cvt;
 			return true;
+		}
 	}
 
 	if (bt->standards == 0 || (bt->standards & V4L2_DV_BT_STD_GTF)) {
+		struct v4l2_dv_timings gtf = {};
 		struct v4l2_fract aspect_ratio;
 
 		find_aspect_ratio(bt->width, bt->height,
@@ -1475,8 +1483,12 @@
 				  &aspect_ratio.denominator);
 		if (v4l2_detect_gtf(total_v_lines, h_freq, bt->vsync,
 				    bt->polarities, bt->interlaced,
-				    aspect_ratio, timings))
+				    aspect_ratio, &vivid_dv_timings_cap,
+				    &gtf) &&
+		    gtf.bt.width == bt->width && gtf.bt.height == bt->height) {
+			*timings = gtf;
 			return true;
+		}
 	}
 	return false;
 }
@@ -1553,8 +1565,10 @@
 		return -EINVAL;
 	if (edid->blocks == 0) {
 		dev->edid_blocks = 0;
-		v4l2_ctrl_s_ctrl(dev->ctrl_tx_edid_present, 0);
-		v4l2_ctrl_s_ctrl(dev->ctrl_tx_hotplug, 0);
+		if (dev->num_outputs) {
+			v4l2_ctrl_s_ctrl(dev->ctrl_tx_edid_present, 0);
+			v4l2_ctrl_s_ctrl(dev->ctrl_tx_hotplug, 0);
+		}
 		phys_addr = CEC_PHYS_ADDR_INVALID;
 		goto set_phys_addr;
 	}
@@ -1578,8 +1592,10 @@
 			display_present |=
 				dev->display_present[i] << j++;
 
-	v4l2_ctrl_s_ctrl(dev->ctrl_tx_edid_present, display_present);
-	v4l2_ctrl_s_ctrl(dev->ctrl_tx_hotplug, display_present);
+	if (dev->num_outputs) {
+		v4l2_ctrl_s_ctrl(dev->ctrl_tx_edid_present, display_present);
+		v4l2_ctrl_s_ctrl(dev->ctrl_tx_hotplug, display_present);
+	}
 
 set_phys_addr:
 	/* TODO: a proper hotplug detect cycle should be emulated here */
--- linux-qcom-6.8.0.orig/drivers/media/test-drivers/vivid/vivid-vid-out.c
+++ linux-qcom-6.8.0/drivers/media/test-drivers/vivid/vivid-vid-out.c
@@ -63,14 +63,16 @@
 		if (sizes[0] < size)
 			return -EINVAL;
 		for (p = 1; p < planes; p++) {
-			if (sizes[p] < dev->bytesperline_out[p] * h +
-				       vfmt->data_offset[p])
+			if (sizes[p] < dev->bytesperline_out[p] * h /
+					vfmt->vdownsampling[p] +
+					vfmt->data_offset[p])
 				return -EINVAL;
 		}
 	} else {
 		for (p = 0; p < planes; p++)
-			sizes[p] = p ? dev->bytesperline_out[p] * h +
-				       vfmt->data_offset[p] : size;
+			sizes[p] = p ? dev->bytesperline_out[p] * h /
+					vfmt->vdownsampling[p] +
+					vfmt->data_offset[p] : size;
 	}
 
 	*nplanes = planes;
@@ -124,7 +126,7 @@
 
 	for (p = 0; p < planes; p++) {
 		if (p)
-			size = dev->bytesperline_out[p] * h;
+			size = dev->bytesperline_out[p] * h / vfmt->vdownsampling[p];
 		size += vb->planes[p].data_offset;
 
 		if (vb2_get_plane_payload(vb, p) < size) {
@@ -331,8 +333,8 @@
 	for (p = 0; p < mp->num_planes; p++) {
 		mp->plane_fmt[p].bytesperline = dev->bytesperline_out[p];
 		mp->plane_fmt[p].sizeimage =
-			mp->plane_fmt[p].bytesperline * mp->height +
-			fmt->data_offset[p];
+			mp->plane_fmt[p].bytesperline * mp->height /
+			fmt->vdownsampling[p] + fmt->data_offset[p];
 	}
 	for (p = fmt->buffers; p < fmt->planes; p++) {
 		unsigned stride = dev->bytesperline_out[p];
--- linux-qcom-6.8.0.orig/drivers/media/tuners/tuner-i2c.h
+++ linux-qcom-6.8.0/drivers/media/tuners/tuner-i2c.h
@@ -133,10 +133,8 @@
 	}								\
 	if (0 == __ret) {						\
 		state = kzalloc(sizeof(type), GFP_KERNEL);		\
-		if (!state) {						\
-			__ret = -ENOMEM;				\
+		if (NULL == state)					\
 			goto __fail;					\
-		}							\
 		state->i2c_props.addr = i2caddr;			\
 		state->i2c_props.adap = i2cadap;			\
 		state->i2c_props.name = devname;			\
--- linux-qcom-6.8.0.orig/drivers/media/tuners/xc2028.c
+++ linux-qcom-6.8.0/drivers/media/tuners/xc2028.c
@@ -1361,9 +1361,16 @@
 			     void *context)
 {
 	struct dvb_frontend *fe = context;
-	struct xc2028_data *priv = fe->tuner_priv;
+	struct xc2028_data *priv;
 	int rc;
 
+	if (!fe) {
+		pr_warn("xc2028: No frontend in %s\n", __func__);
+		return;
+	}
+
+	priv = fe->tuner_priv;
+
 	tuner_dbg("request_firmware_nowait(): %s\n", fw ? "OK" : "error");
 	if (!fw) {
 		tuner_err("Could not load firmware %s.\n", priv->fname);
--- linux-qcom-6.8.0.orig/drivers/media/tuners/xc4000.c
+++ linux-qcom-6.8.0/drivers/media/tuners/xc4000.c
@@ -1515,10 +1515,10 @@
 {
 	struct xc4000_priv *priv = fe->tuner_priv;
 
+	mutex_lock(&priv->lock);
 	*freq = priv->freq_hz + priv->freq_offset;
 
 	if (debug) {
-		mutex_lock(&priv->lock);
 		if ((priv->cur_fw.type
 		     & (BASE | FM | DTV6 | DTV7 | DTV78 | DTV8)) == BASE) {
 			u16	snr = 0;
@@ -1529,8 +1529,8 @@
 				return 0;
 			}
 		}
-		mutex_unlock(&priv->lock);
 	}
+	mutex_unlock(&priv->lock);
 
 	dprintk(1, "%s()\n", __func__);
 
--- linux-qcom-6.8.0.orig/drivers/media/usb/b2c2/flexcop-usb.c
+++ linux-qcom-6.8.0/drivers/media/usb/b2c2/flexcop-usb.c
@@ -179,7 +179,7 @@
 		flexcop_usb_request_t req, flexcop_usb_mem_page_t page_start,
 		u32 addr, int extended, u8 *buf, u32 len)
 {
-	int i, ret = 0;
+	int ret = 0;
 	u16 wMax;
 	u32 pagechunk = 0;
 
@@ -196,7 +196,7 @@
 	default:
 		return -EINVAL;
 	}
-	for (i = 0; i < len;) {
+	while (len) {
 		pagechunk =
 			wMax < bytes_left_to_read_on_page(addr, len) ?
 				wMax :
@@ -209,11 +209,12 @@
 			page_start + (addr / V8_MEMORY_PAGE_SIZE),
 			(addr & V8_MEMORY_PAGE_MASK) |
 				(V8_MEMORY_EXTENDED*extended),
-			&buf[i], pagechunk);
+			buf, pagechunk);
 
 		if (ret < 0)
 			return ret;
 		addr += pagechunk;
+		buf += pagechunk;
 		len -= pagechunk;
 	}
 	return 0;
@@ -515,7 +516,7 @@
 
 	alt = fc_usb->uintf->cur_altsetting;
 
-	if (alt->desc.bNumEndpoints < 1)
+	if (alt->desc.bNumEndpoints < 2)
 		return -ENODEV;
 	if (!usb_endpoint_is_isoc_in(&alt->endpoint[0].desc))
 		return -ENODEV;
--- linux-qcom-6.8.0.orig/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ linux-qcom-6.8.0/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -994,6 +994,8 @@
 
 /* table of devices that work with this driver */
 struct usb_device_id cx231xx_id_table[] = {
+	{USB_DEVICE(0x1D19, 0x6108),
+	.driver_info = CX231XX_BOARD_PV_XCAPTURE_USB},
 	{USB_DEVICE(0x1D19, 0x6109),
 	.driver_info = CX231XX_BOARD_PV_XCAPTURE_USB},
 	{USB_DEVICE(0x0572, 0x5A3C),
--- linux-qcom-6.8.0.orig/drivers/media/usb/dvb-usb/dib0700_devices.c
+++ linux-qcom-6.8.0/drivers/media/usb/dvb-usb/dib0700_devices.c
@@ -2412,7 +2412,12 @@
 
 	adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &stk9090m_config);
 
-	return adap->fe_adap[0].fe == NULL ?  -ENODEV : 0;
+	if (!adap->fe_adap[0].fe) {
+		release_firmware(state->frontend_firmware);
+		return -ENODEV;
+	}
+
+	return 0;
 }
 
 static int dib9090_tuner_attach(struct dvb_usb_adapter *adap)
@@ -2485,8 +2490,10 @@
 	dib9000_i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, 0x80);
 	adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &nim9090md_config[0]);
 
-	if (adap->fe_adap[0].fe == NULL)
+	if (!adap->fe_adap[0].fe) {
+		release_firmware(state->frontend_firmware);
 		return -ENODEV;
+	}
 
 	i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_3_4, 0);
 	dib9000_i2c_enumeration(i2c, 1, 0x12, 0x82);
@@ -2494,7 +2501,12 @@
 	fe_slave = dvb_attach(dib9000_attach, i2c, 0x82, &nim9090md_config[1]);
 	dib9000_set_slave_frontend(adap->fe_adap[0].fe, fe_slave);
 
-	return fe_slave == NULL ?  -ENODEV : 0;
+	if (!fe_slave) {
+		release_firmware(state->frontend_firmware);
+		return -ENODEV;
+	}
+
+	return 0;
 }
 
 static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap)
--- linux-qcom-6.8.0.orig/drivers/media/usb/dvb-usb/dw2102.c
+++ linux-qcom-6.8.0/drivers/media/usb/dvb-usb/dw2102.c
@@ -716,6 +716,7 @@
 {
 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
 	struct dw2102_state *state;
+	int j;
 
 	if (!d)
 		return -ENODEV;
@@ -729,11 +730,11 @@
 		return -EAGAIN;
 	}
 
-	switch (num) {
-	case 1:
-		switch (msg[0].addr) {
+	j = 0;
+	while (j < num) {
+		switch (msg[j].addr) {
 		case SU3000_STREAM_CTRL:
-			state->data[0] = msg[0].buf[0] + 0x36;
+			state->data[0] = msg[j].buf[0] + 0x36;
 			state->data[1] = 3;
 			state->data[2] = 0;
 			if (dvb_usb_generic_rw(d, state->data, 3,
@@ -745,61 +746,86 @@
 			if (dvb_usb_generic_rw(d, state->data, 1,
 					state->data, 2, 0) < 0)
 				err("i2c transfer failed.");
-			msg[0].buf[1] = state->data[0];
-			msg[0].buf[0] = state->data[1];
+			msg[j].buf[1] = state->data[0];
+			msg[j].buf[0] = state->data[1];
 			break;
 		default:
-			if (3 + msg[0].len > sizeof(state->data)) {
-				warn("i2c wr: len=%d is too big!\n",
-				     msg[0].len);
+			/* if the current write msg is followed by a another
+			 * read msg to/from the same address
+			 */
+			if ((j+1 < num) && (msg[j+1].flags & I2C_M_RD) &&
+			    (msg[j].addr == msg[j+1].addr)) {
+				/* join both i2c msgs to one usb read command */
+				if (4 + msg[j].len > sizeof(state->data)) {
+					warn("i2c combined wr/rd: write len=%d is too big!\n",
+					    msg[j].len);
+					num = -EOPNOTSUPP;
+					break;
+				}
+				if (1 + msg[j+1].len > sizeof(state->data)) {
+					warn("i2c combined wr/rd: read len=%d is too big!\n",
+					    msg[j+1].len);
+					num = -EOPNOTSUPP;
+					break;
+				}
+
+				state->data[0] = 0x09;
+				state->data[1] = msg[j].len;
+				state->data[2] = msg[j+1].len;
+				state->data[3] = msg[j].addr;
+				memcpy(&state->data[4], msg[j].buf, msg[j].len);
+
+				if (dvb_usb_generic_rw(d, state->data, msg[j].len + 4,
+					state->data, msg[j+1].len + 1, 0) < 0)
+					err("i2c transfer failed.");
+
+				memcpy(msg[j+1].buf, &state->data[1], msg[j+1].len);
+				j++;
+				break;
+			}
+
+			if (msg[j].flags & I2C_M_RD) {
+				/* single read */
+				if (4 + msg[j].len > sizeof(state->data)) {
+					warn("i2c rd: len=%d is too big!\n", msg[j].len);
+					num = -EOPNOTSUPP;
+					break;
+				}
+
+				state->data[0] = 0x09;
+				state->data[1] = 0;
+				state->data[2] = msg[j].len;
+				state->data[3] = msg[j].addr;
+				memcpy(&state->data[4], msg[j].buf, msg[j].len);
+
+				if (dvb_usb_generic_rw(d, state->data, 4,
+					state->data, msg[j].len + 1, 0) < 0)
+					err("i2c transfer failed.");
+
+				memcpy(msg[j].buf, &state->data[1], msg[j].len);
+				break;
+			}
+
+			/* single write */
+			if (3 + msg[j].len > sizeof(state->data)) {
+				warn("i2c wr: len=%d is too big!\n", msg[j].len);
 				num = -EOPNOTSUPP;
 				break;
 			}
 
-			/* always i2c write*/
 			state->data[0] = 0x08;
-			state->data[1] = msg[0].addr;
-			state->data[2] = msg[0].len;
+			state->data[1] = msg[j].addr;
+			state->data[2] = msg[j].len;
 
-			memcpy(&state->data[3], msg[0].buf, msg[0].len);
+			memcpy(&state->data[3], msg[j].buf, msg[j].len);
 
-			if (dvb_usb_generic_rw(d, state->data, msg[0].len + 3,
+			if (dvb_usb_generic_rw(d, state->data, msg[j].len + 3,
 						state->data, 1, 0) < 0)
 				err("i2c transfer failed.");
+		} // switch
+		j++;
 
-		}
-		break;
-	case 2:
-		/* always i2c read */
-		if (4 + msg[0].len > sizeof(state->data)) {
-			warn("i2c rd: len=%d is too big!\n",
-			     msg[0].len);
-			num = -EOPNOTSUPP;
-			break;
-		}
-		if (1 + msg[1].len > sizeof(state->data)) {
-			warn("i2c rd: len=%d is too big!\n",
-			     msg[1].len);
-			num = -EOPNOTSUPP;
-			break;
-		}
-
-		state->data[0] = 0x09;
-		state->data[1] = msg[0].len;
-		state->data[2] = msg[1].len;
-		state->data[3] = msg[0].addr;
-		memcpy(&state->data[4], msg[0].buf, msg[0].len);
-
-		if (dvb_usb_generic_rw(d, state->data, msg[0].len + 4,
-					state->data, msg[1].len + 1, 0) < 0)
-			err("i2c transfer failed.");
-
-		memcpy(msg[1].buf, &state->data[1], msg[1].len);
-		break;
-	default:
-		warn("more than 2 i2c messages at a time is not handled yet.");
-		break;
-	}
+	} // while
 	mutex_unlock(&d->data_mutex);
 	mutex_unlock(&d->i2c_mutex);
 	return num;
--- linux-qcom-6.8.0.orig/drivers/media/usb/em28xx/em28xx-cards.c
+++ linux-qcom-6.8.0/drivers/media/usb/em28xx/em28xx-cards.c
@@ -4094,6 +4094,10 @@
 	 * topology will likely change after the load of the em28xx subdrivers.
 	 */
 #ifdef CONFIG_MEDIA_CONTROLLER
+	/*
+	 * No need to check the return value, the device will still be
+	 * usable without media controller API.
+	 */
 	retval = media_device_register(dev->media_dev);
 #endif
 
--- linux-qcom-6.8.0.orig/drivers/media/usb/go7007/go7007-driver.c
+++ linux-qcom-6.8.0/drivers/media/usb/go7007/go7007-driver.c
@@ -80,7 +80,7 @@
 	const struct firmware *fw_entry;
 	char fw_name[] = "go7007/go7007fw.bin";
 	void *bounce;
-	int fw_len, rv = 0;
+	int fw_len;
 	u16 intr_val, intr_data;
 
 	if (go->boot_fw == NULL) {
@@ -109,9 +109,11 @@
 	    go7007_read_interrupt(go, &intr_val, &intr_data) < 0 ||
 			(intr_val & ~0x1) != 0x5a5a) {
 		v4l2_err(go, "error transferring firmware\n");
-		rv = -1;
+		kfree(go->boot_fw);
+		go->boot_fw = NULL;
+		return -1;
 	}
-	return rv;
+	return 0;
 }
 
 MODULE_FIRMWARE("go7007/go7007fw.bin");
--- linux-qcom-6.8.0.orig/drivers/media/usb/go7007/go7007-usb.c
+++ linux-qcom-6.8.0/drivers/media/usb/go7007/go7007-usb.c
@@ -1201,7 +1201,9 @@
 				u16 channel;
 
 				/* read channel number from GPIO[1:0] */
-				go7007_read_addr(go, 0x3c81, &channel);
+				if (go7007_read_addr(go, 0x3c81, &channel))
+					goto allocfail;
+
 				channel &= 0x3;
 				go->board_id = GO7007_BOARDID_ADLINK_MPG24;
 				usb->board = board = &board_adlink_mpg24;
--- linux-qcom-6.8.0.orig/drivers/media/usb/gspca/ov534.c
+++ linux-qcom-6.8.0/drivers/media/usb/gspca/ov534.c
@@ -847,7 +847,7 @@
 		r = rate_1;
 		i = ARRAY_SIZE(rate_1);
 	}
-	while (--i > 0) {
+	while (--i >= 0) {
 		if (sd->frame_rate >= r->fps)
 			break;
 		r++;
--- linux-qcom-6.8.0.orig/drivers/media/usb/pvrusb2/pvrusb2-context.c
+++ linux-qcom-6.8.0/drivers/media/usb/pvrusb2/pvrusb2-context.c
@@ -90,8 +90,10 @@
 }
 
 
-static void pvr2_context_notify(struct pvr2_context *mp)
+static void pvr2_context_notify(void *ptr)
 {
+	struct pvr2_context *mp = ptr;
+
 	pvr2_context_set_notify(mp,!0);
 }
 
@@ -106,9 +108,7 @@
 		pvr2_trace(PVR2_TRACE_CTXT,
 			   "pvr2_context %p (initialize)", mp);
 		/* Finish hardware initialization */
-		if (pvr2_hdw_initialize(mp->hdw,
-					(void (*)(void *))pvr2_context_notify,
-					mp)) {
+		if (pvr2_hdw_initialize(mp->hdw, pvr2_context_notify, mp)) {
 			mp->video_stream.stream =
 				pvr2_hdw_get_video_stream(mp->hdw);
 			/* Trigger interface initialization.  By doing this
@@ -267,9 +267,9 @@
 void pvr2_context_disconnect(struct pvr2_context *mp)
 {
 	pvr2_hdw_disconnect(mp->hdw);
-	mp->disconnect_flag = !0;
 	if (!pvr2_context_shutok())
 		pvr2_context_notify(mp);
+	mp->disconnect_flag = !0;
 }
 
 
--- linux-qcom-6.8.0.orig/drivers/media/usb/pvrusb2/pvrusb2-dvb.c
+++ linux-qcom-6.8.0/drivers/media/usb/pvrusb2/pvrusb2-dvb.c
@@ -88,8 +88,10 @@
 	return stat;
 }
 
-static void pvr2_dvb_notify(struct pvr2_dvb_adapter *adap)
+static void pvr2_dvb_notify(void *ptr)
 {
+	struct pvr2_dvb_adapter *adap = ptr;
+
 	wake_up(&adap->buffer_wait_data);
 }
 
@@ -149,7 +151,7 @@
 	}
 
 	pvr2_stream_set_callback(pvr->video_stream.stream,
-				 (pvr2_stream_callback) pvr2_dvb_notify, adap);
+				 pvr2_dvb_notify, adap);
 
 	ret = pvr2_stream_set_buffer_count(stream, PVR2_DVB_BUFFER_COUNT);
 	if (ret < 0) return ret;
--- linux-qcom-6.8.0.orig/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+++ linux-qcom-6.8.0/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
@@ -1033,8 +1033,10 @@
 }
 
 
-static void pvr2_v4l2_notify(struct pvr2_v4l2_fh *fhp)
+static void pvr2_v4l2_notify(void *ptr)
 {
+	struct pvr2_v4l2_fh *fhp = ptr;
+
 	wake_up(&fhp->wait_data);
 }
 
@@ -1067,7 +1069,7 @@
 
 	hdw = fh->channel.mc_head->hdw;
 	sp = fh->pdi->stream->stream;
-	pvr2_stream_set_callback(sp,(pvr2_stream_callback)pvr2_v4l2_notify,fh);
+	pvr2_stream_set_callback(sp, pvr2_v4l2_notify, fh);
 	pvr2_hdw_set_stream_type(hdw,fh->pdi->config);
 	if ((ret = pvr2_hdw_set_streaming(hdw,!0)) < 0) return ret;
 	return pvr2_ioread_set_enabled(fh->rhp,!0);
@@ -1198,11 +1200,6 @@
 		dip->minor_type = pvr2_v4l_type_video;
 		nr_ptr = video_nr;
 		caps |= V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_AUDIO;
-		if (!dip->stream) {
-			pr_err(KBUILD_MODNAME
-				": Failed to set up pvrusb2 v4l video dev due to missing stream instance\n");
-			return;
-		}
 		break;
 	case VFL_TYPE_VBI:
 		dip->config = pvr2_config_vbi;
--- linux-qcom-6.8.0.orig/drivers/media/usb/s2255/s2255drv.c
+++ linux-qcom-6.8.0/drivers/media/usb/s2255/s2255drv.c
@@ -247,7 +247,7 @@
 struct s2255_dev {
 	struct s2255_vc         vc[MAX_CHANNELS];
 	struct v4l2_device      v4l2_dev;
-	atomic_t                num_channels;
+	refcount_t		num_channels;
 	int			frames;
 	struct mutex		lock;	/* channels[].vdev.lock */
 	struct mutex		cmdlock; /* protects cmdbuf */
@@ -1550,11 +1550,11 @@
 		container_of(vdev, struct s2255_vc, vdev);
 
 	dprintk(dev, 4, "%s, chnls: %d\n", __func__,
-		atomic_read(&dev->num_channels));
+		refcount_read(&dev->num_channels));
 
 	v4l2_ctrl_handler_free(&vc->hdl);
 
-	if (atomic_dec_and_test(&dev->num_channels))
+	if (refcount_dec_and_test(&dev->num_channels))
 		s2255_destroy(dev);
 	return;
 }
@@ -1659,7 +1659,7 @@
 				"failed to register video device!\n");
 			break;
 		}
-		atomic_inc(&dev->num_channels);
+		refcount_inc(&dev->num_channels);
 		v4l2_info(&dev->v4l2_dev, "V4L2 device registered as %s\n",
 			  video_device_node_name(&vc->vdev));
 
@@ -1667,11 +1667,11 @@
 	pr_info("Sensoray 2255 V4L driver Revision: %s\n",
 		S2255_VERSION);
 	/* if no channels registered, return error and probe will fail*/
-	if (atomic_read(&dev->num_channels) == 0) {
+	if (refcount_read(&dev->num_channels) == 0) {
 		v4l2_device_unregister(&dev->v4l2_dev);
 		return ret;
 	}
-	if (atomic_read(&dev->num_channels) != MAX_CHANNELS)
+	if (refcount_read(&dev->num_channels) != MAX_CHANNELS)
 		pr_warn("s2255: Not all channels available.\n");
 	return 0;
 }
@@ -2220,7 +2220,7 @@
 		goto errorFWDATA1;
 	}
 
-	atomic_set(&dev->num_channels, 0);
+	refcount_set(&dev->num_channels, 0);
 	dev->pid = id->idProduct;
 	dev->fw_data = kzalloc(sizeof(struct s2255_fw), GFP_KERNEL);
 	if (!dev->fw_data)
@@ -2340,12 +2340,12 @@
 {
 	struct s2255_dev *dev = to_s2255_dev(usb_get_intfdata(interface));
 	int i;
-	int channels = atomic_read(&dev->num_channels);
+	int channels = refcount_read(&dev->num_channels);
 	mutex_lock(&dev->lock);
 	v4l2_device_disconnect(&dev->v4l2_dev);
 	mutex_unlock(&dev->lock);
 	/*see comments in the uvc_driver.c usb disconnect function */
-	atomic_inc(&dev->num_channels);
+	refcount_inc(&dev->num_channels);
 	/* unregister each video device. */
 	for (i = 0; i < channels; i++)
 		video_unregister_device(&dev->vc[i].vdev);
@@ -2358,7 +2358,7 @@
 		dev->vc[i].vidstatus_ready = 1;
 		wake_up(&dev->vc[i].wait_vidstatus);
 	}
-	if (atomic_dec_and_test(&dev->num_channels))
+	if (refcount_dec_and_test(&dev->num_channels))
 		s2255_destroy(dev);
 	dev_info(&interface->dev, "%s\n", __func__);
 }
--- linux-qcom-6.8.0.orig/drivers/media/usb/stk1160/stk1160-video.c
+++ linux-qcom-6.8.0/drivers/media/usb/stk1160/stk1160-video.c
@@ -99,7 +99,7 @@
 static inline
 void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
 {
-	int linesdone, lineoff, lencopy;
+	int linesdone, lineoff, lencopy, offset;
 	int bytesperline = dev->width * 2;
 	struct stk1160_buffer *buf = dev->isoc_ctl.buf;
 	u8 *dst = buf->mem;
@@ -139,8 +139,13 @@
 	 * Check if we have enough space left in the buffer.
 	 * In that case, we force loop exit after copy.
 	 */
-	if (lencopy > buf->bytesused - buf->length) {
-		lencopy = buf->bytesused - buf->length;
+	offset = dst - (u8 *)buf->mem;
+	if (offset > buf->length) {
+		dev_warn_ratelimited(dev->dev, "out of bounds offset\n");
+		return;
+	}
+	if (lencopy > buf->length - offset) {
+		lencopy = buf->length - offset;
 		remain = lencopy;
 	}
 
@@ -182,8 +187,13 @@
 		 * Check if we have enough space left in the buffer.
 		 * In that case, we force loop exit after copy.
 		 */
-		if (lencopy > buf->bytesused - buf->length) {
-			lencopy = buf->bytesused - buf->length;
+		offset = dst - (u8 *)buf->mem;
+		if (offset > buf->length) {
+			dev_warn_ratelimited(dev->dev, "offset out of bounds\n");
+			return;
+		}
+		if (lencopy > buf->length - offset) {
+			lencopy = buf->length - offset;
 			remain = lencopy;
 		}
 
--- linux-qcom-6.8.0.orig/drivers/media/usb/usbtv/usbtv-video.c
+++ linux-qcom-6.8.0/drivers/media/usb/usbtv/usbtv-video.c
@@ -963,15 +963,8 @@
 
 void usbtv_video_free(struct usbtv *usbtv)
 {
-	mutex_lock(&usbtv->vb2q_lock);
-	mutex_lock(&usbtv->v4l2_lock);
-
-	usbtv_stop(usbtv);
 	vb2_video_unregister_device(&usbtv->vdev);
 	v4l2_device_disconnect(&usbtv->v4l2_dev);
 
-	mutex_unlock(&usbtv->v4l2_lock);
-	mutex_unlock(&usbtv->vb2q_lock);
-
 	v4l2_device_put(&usbtv->v4l2_dev);
 }
--- linux-qcom-6.8.0.orig/drivers/media/usb/uvc/uvc_ctrl.c
+++ linux-qcom-6.8.0/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2029,7 +2029,13 @@
 	else
 		ret = uvc_query_ctrl(dev, UVC_GET_INFO, ctrl->entity->id,
 				     dev->intfnum, info->selector, data, 1);
-	if (!ret)
+
+	if (!ret) {
+		info->flags &= ~(UVC_CTRL_FLAG_GET_CUR |
+				 UVC_CTRL_FLAG_SET_CUR |
+				 UVC_CTRL_FLAG_AUTO_UPDATE |
+				 UVC_CTRL_FLAG_ASYNCHRONOUS);
+
 		info->flags |= (data[0] & UVC_CONTROL_CAP_GET ?
 				UVC_CTRL_FLAG_GET_CUR : 0)
 			    |  (data[0] & UVC_CONTROL_CAP_SET ?
@@ -2038,6 +2044,7 @@
 				UVC_CTRL_FLAG_AUTO_UPDATE : 0)
 			    |  (data[0] & UVC_CONTROL_CAP_ASYNCHRONOUS ?
 				UVC_CTRL_FLAG_ASYNCHRONOUS : 0);
+	}
 
 	kfree(data);
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/media/usb/uvc/uvc_driver.c
+++ linux-qcom-6.8.0/drivers/media/usb/uvc/uvc_driver.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/usb.h>
+#include <linux/usb/quirks.h>
 #include <linux/usb/uvc.h>
 #include <linux/videodev2.h>
 #include <linux/vmalloc.h>
@@ -370,7 +371,7 @@
 	 * Parse the frame descriptors. Only uncompressed, MJPEG and frame
 	 * based formats have frame descriptors.
 	 */
-	while (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
+	while (ftype && buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
 	       buffer[2] == ftype) {
 		unsigned int maxIntervalIndex;
 
@@ -686,16 +687,26 @@
 		goto error;
 	}
 
-	size = nformats * sizeof(*format) + nframes * sizeof(*frame)
+	/*
+	 * Allocate memory for the formats, the frames and the intervals,
+	 * plus any required padding to guarantee that everything has the
+	 * correct alignment.
+	 */
+	size = nformats * sizeof(*format);
+	size = ALIGN(size, __alignof__(*frame)) + nframes * sizeof(*frame);
+	size = ALIGN(size, __alignof__(*interval))
 	     + nintervals * sizeof(*interval);
+
 	format = kzalloc(size, GFP_KERNEL);
-	if (format == NULL) {
+	if (!format) {
 		ret = -ENOMEM;
 		goto error;
 	}
 
-	frame = (struct uvc_frame *)&format[nformats];
-	interval = (u32 *)&frame[nframes];
+	frame = (void *)format + nformats * sizeof(*format);
+	frame = PTR_ALIGN(frame, __alignof__(*frame));
+	interval = (void *)frame + nframes * sizeof(*frame);
+	interval = PTR_ALIGN(interval, __alignof__(*interval));
 
 	streaming->formats = format;
 	streaming->nformats = 0;
@@ -1908,11 +1919,41 @@
 	struct uvc_streaming *stream;
 
 	list_for_each_entry(stream, &dev->streams, list) {
+		/* Nothing to do here, continue. */
 		if (!video_is_registered(&stream->vdev))
 			continue;
 
+		/*
+		 * For stream->vdev we follow the same logic as:
+		 * vb2_video_unregister_device().
+		 */
+
+		/* 1. Take a reference to vdev */
+		get_device(&stream->vdev.dev);
+
+		/* 2. Ensure that no new ioctls can be called. */
 		video_unregister_device(&stream->vdev);
-		video_unregister_device(&stream->meta.vdev);
+
+		/* 3. Wait for old ioctls to finish. */
+		mutex_lock(&stream->mutex);
+
+		/* 4. Stop streaming. */
+		uvc_queue_release(&stream->queue);
+
+		mutex_unlock(&stream->mutex);
+
+		put_device(&stream->vdev.dev);
+
+		/*
+		 * For stream->meta.vdev we can directly call:
+		 * vb2_video_unregister_device().
+		 */
+		vb2_video_unregister_device(&stream->meta.vdev);
+
+		/*
+		 * Now both vdevs are not streaming and all the ioctls will
+		 * return -ENODEV.
+		 */
 
 		uvc_debugfs_cleanup_stream(stream);
 	}
@@ -2232,8 +2273,14 @@
 		goto error;
 	}
 
+	if (dev->quirks & UVC_QUIRK_NO_RESET_RESUME)
+		udev->quirks &= ~USB_QUIRK_RESET_RESUME;
+
+	if (!(dev->quirks & UVC_QUIRK_DISABLE_AUTOSUSPEND))
+		usb_enable_autosuspend(udev);
+
 	uvc_dbg(dev, PROBE, "UVC device initialized\n");
-	usb_enable_autosuspend(udev);
+
 	return 0;
 
 error:
@@ -2425,6 +2472,8 @@
  * The Logitech cameras listed below have their interface class set to
  * VENDOR_SPEC because they don't announce themselves as UVC devices, even
  * though they are compliant.
+ *
+ * Sort these by vendor/product ID.
  */
 static const struct usb_device_id uvc_ids[] = {
 	/* Quanta USB2.0 HD UVC Webcam */
@@ -2454,6 +2503,39 @@
 	  .bInterfaceSubClass	= 1,
 	  .bInterfaceProtocol	= UVC_PC_PROTOCOL_15,
 	  .driver_info		= (kernel_ulong_t)&uvc_ctrl_power_line_limited },
+	/* Quanta ACER HD User Facing */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x0408,
+	  .idProduct		= 0x4033,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= UVC_PC_PROTOCOL_15,
+	  .driver_info		= (kernel_ulong_t)&(const struct uvc_device_info){
+		.uvc_version = 0x010a,
+	  } },
+	/* Quanta ACER HD User Facing */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x0408,
+	  .idProduct		= 0x4033,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= UVC_PC_PROTOCOL_15,
+	  .driver_info		= (kernel_ulong_t)&(const struct uvc_device_info){
+		.uvc_version = 0x010a,
+	  } },
+	/* Quanta ACER HD User Facing */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x0408,
+	  .idProduct		= 0x4035,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= UVC_PC_PROTOCOL_15,
+	  .driver_info		= (kernel_ulong_t)&(const struct uvc_device_info){
+		.uvc_version = 0x010a,
+	  } },
 	/* LogiLink Wireless Webcam */
 	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
 				| USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2573,7 +2655,44 @@
 	  .bInterfaceClass	= USB_CLASS_VIDEO,
 	  .bInterfaceSubClass	= 1,
 	  .bInterfaceProtocol	= 0,
-	  .driver_info		= UVC_INFO_QUIRK(UVC_QUIRK_RESTORE_CTRLS_ON_INIT) },
+	  .driver_info		= UVC_INFO_QUIRK(UVC_QUIRK_RESTORE_CTRLS_ON_INIT
+					       | UVC_QUIRK_INVALID_DEVICE_SOF) },
+	/* Logitech HD Pro Webcam C922 */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x046d,
+	  .idProduct		= 0x085c,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= 0,
+	  .driver_info		= UVC_INFO_QUIRK(UVC_QUIRK_INVALID_DEVICE_SOF) },
+	/* Logitech Rally Bar Huddle */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x046d,
+	  .idProduct		= 0x087c,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= 0,
+	  .driver_info		= UVC_INFO_QUIRK(UVC_QUIRK_NO_RESET_RESUME) },
+	/* Logitech Rally Bar */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x046d,
+	  .idProduct		= 0x089b,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= 0,
+	  .driver_info		= UVC_INFO_QUIRK(UVC_QUIRK_NO_RESET_RESUME) },
+	/* Logitech Rally Bar Mini */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x046d,
+	  .idProduct		= 0x08d3,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= 0,
+	  .driver_info		= UVC_INFO_QUIRK(UVC_QUIRK_NO_RESET_RESUME) },
 	/* Chicony CNF7129 (Asus EEE 100HE) */
 	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
 				| USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2976,6 +3095,15 @@
 	  .bInterfaceProtocol	= 0,
 	  .driver_info		= UVC_INFO_QUIRK(UVC_QUIRK_PROBE_MINMAX
 					| UVC_QUIRK_IGNORE_SELECTOR_UNIT) },
+	/* NXP Semiconductors IR VIDEO */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x1fc9,
+	  .idProduct		= 0x009b,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= 0,
+	  .driver_info		= (kernel_ulong_t)&uvc_quirk_probe_minmax },
 	/* Oculus VR Positional Tracker DK2 */
 	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
 				| USB_DEVICE_ID_MATCH_INT_INFO,
@@ -3012,6 +3140,15 @@
 	  .bInterfaceSubClass	= 1,
 	  .bInterfaceProtocol	= UVC_PC_PROTOCOL_15,
 	  .driver_info		= (kernel_ulong_t)&uvc_ctrl_power_line_uvc11 },
+	/* Insta360 Link */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x2e1a,
+	  .idProduct		= 0x4c01,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= 0,
+	  .driver_info		= UVC_INFO_QUIRK(UVC_QUIRK_DISABLE_AUTOSUSPEND) },
 	/* Lenovo Integrated Camera */
 	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
 				| USB_DEVICE_ID_MATCH_INT_INFO,
@@ -3119,6 +3256,15 @@
 	  .bInterfaceClass	= USB_CLASS_VIDEO,
 	  .bInterfaceSubClass	= 1,
 	  .bInterfaceProtocol	= 0,
+	  .driver_info		= UVC_INFO_META(V4L2_META_FMT_D4XX) },
+	/* Intel D421 Depth Module */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x8086,
+	  .idProduct		= 0x1155,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= 0,
 	  .driver_info		= UVC_INFO_META(V4L2_META_FMT_D4XX) },
 	/* Generic USB Video Class */
 	{ USB_INTERFACE_INFO(USB_CLASS_VIDEO, 1, UVC_PC_PROTOCOL_UNDEFINED) },
--- linux-qcom-6.8.0.orig/drivers/media/usb/uvc/uvc_video.c
+++ linux-qcom-6.8.0/drivers/media/usb/uvc/uvc_video.c
@@ -214,13 +214,13 @@
 		 * Compute a bandwidth estimation by multiplying the frame
 		 * size by the number of video frames per second, divide the
 		 * result by the number of USB frames (or micro-frames for
-		 * high-speed devices) per second and add the UVC header size
-		 * (assumed to be 12 bytes long).
+		 * high- and super-speed devices) per second and add the UVC
+		 * header size (assumed to be 12 bytes long).
 		 */
 		bandwidth = frame->wWidth * frame->wHeight / 8 * format->bpp;
 		bandwidth *= 10000000 / interval + 1;
 		bandwidth /= 1000;
-		if (stream->dev->udev->speed == USB_SPEED_HIGH)
+		if (stream->dev->udev->speed >= USB_SPEED_HIGH)
 			bandwidth /= 8;
 		bandwidth += 12;
 
@@ -478,6 +478,7 @@
 	ktime_t time;
 	u16 host_sof;
 	u16 dev_sof;
+	u32 dev_stc;
 
 	switch (data[1] & (UVC_STREAM_PTS | UVC_STREAM_SCR)) {
 	case UVC_STREAM_PTS | UVC_STREAM_SCR:
@@ -526,9 +527,48 @@
 	if (dev_sof == stream->clock.last_sof)
 		return;
 
+	dev_stc = get_unaligned_le32(&data[header_size - 6]);
+
+	/*
+	 * STC (Source Time Clock) is the clock used by the camera. The UVC 1.5
+	 * standard states that it "must be captured when the first video data
+	 * of a video frame is put on the USB bus". This is generally understood
+	 * as requiring devices to clear the payload header's SCR bit before
+	 * the first packet containing video data.
+	 *
+	 * Most vendors follow that interpretation, but some (namely SunplusIT
+	 * on some devices) always set the `UVC_STREAM_SCR` bit, fill the SCR
+	 * field with 0's,and expect that the driver only processes the SCR if
+	 * there is data in the packet.
+	 *
+	 * Ignore all the hardware timestamp information if we haven't received
+	 * any data for this frame yet, the packet contains no data, and both
+	 * STC and SOF are zero. This heuristics should be safe on compliant
+	 * devices. This should be safe with compliant devices, as in the very
+	 * unlikely case where a UVC 1.1 device would send timing information
+	 * only before the first packet containing data, and both STC and SOF
+	 * happen to be zero for a particular frame, we would only miss one
+	 * clock sample from many and the clock recovery algorithm wouldn't
+	 * suffer from this condition.
+	 */
+	if (buf && buf->bytesused == 0 && len == header_size &&
+	    dev_stc == 0 && dev_sof == 0)
+		return;
+
 	stream->clock.last_sof = dev_sof;
 
 	host_sof = usb_get_current_frame_number(stream->dev->udev);
+
+	/*
+	 * On some devices, like the Logitech C922, the device SOF does not run
+	 * at a stable rate of 1kHz. For those devices use the host SOF instead.
+	 * In the tests performed so far, this improves the timestamp precision.
+	 * This is probably explained by a small packet handling jitter from the
+	 * host, but the exact reason hasn't been fully determined.
+	 */
+	if (stream->dev->quirks & UVC_QUIRK_INVALID_DEVICE_SOF)
+		dev_sof = host_sof;
+
 	time = uvc_video_get_time();
 
 	/*
@@ -564,7 +604,7 @@
 	spin_lock_irqsave(&stream->clock.lock, flags);
 
 	sample = &stream->clock.samples[stream->clock.head];
-	sample->dev_stc = get_unaligned_le32(&data[header_size - 6]);
+	sample->dev_stc = dev_stc;
 	sample->dev_sof = dev_sof;
 	sample->host_sof = host_sof;
 	sample->host_time = time;
@@ -709,11 +749,11 @@
 	unsigned long flags;
 	u64 timestamp;
 	u32 delta_stc;
-	u32 y1, y2;
+	u32 y1;
 	u32 x1, x2;
 	u32 mean;
 	u32 sof;
-	u64 y;
+	u64 y, y2;
 
 	if (!uvc_hw_timestamps_param)
 		return;
@@ -753,7 +793,7 @@
 	sof = y;
 
 	uvc_dbg(stream->dev, CLOCK,
-		"%s: PTS %u y %llu.%06llu SOF %u.%06llu (x1 %u x2 %u y1 %u y2 %u SOF offset %u)\n",
+		"%s: PTS %u y %llu.%06llu SOF %u.%06llu (x1 %u x2 %u y1 %u y2 %llu SOF offset %u)\n",
 		stream->dev->name, buf->pts,
 		y >> 16, div_u64((y & 0xffff) * 1000000, 65536),
 		sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536),
@@ -768,7 +808,7 @@
 		goto done;
 
 	y1 = NSEC_PER_SEC;
-	y2 = (u32)ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1;
+	y2 = ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1;
 
 	/*
 	 * Interpolated and host SOF timestamps can wrap around at slightly
@@ -789,7 +829,7 @@
 	timestamp = ktime_to_ns(first->host_time) + y - y1;
 
 	uvc_dbg(stream->dev, CLOCK,
-		"%s: SOF %u.%06llu y %llu ts %llu buf ts %llu (x1 %u/%u/%u x2 %u/%u/%u y1 %u y2 %u)\n",
+		"%s: SOF %u.%06llu y %llu ts %llu buf ts %llu (x1 %u/%u/%u x2 %u/%u/%u y1 %u y2 %llu)\n",
 		stream->dev->name,
 		sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536),
 		y, timestamp, vbuf->vb2_buf.timestamp,
--- linux-qcom-6.8.0.orig/drivers/media/usb/uvc/uvcvideo.h
+++ linux-qcom-6.8.0/drivers/media/usb/uvc/uvcvideo.h
@@ -73,6 +73,9 @@
 #define UVC_QUIRK_FORCE_Y8		0x00000800
 #define UVC_QUIRK_FORCE_BPP		0x00001000
 #define UVC_QUIRK_WAKE_AUTOSUSPEND	0x00002000
+#define UVC_QUIRK_NO_RESET_RESUME	0x00004000
+#define UVC_QUIRK_DISABLE_AUTOSUSPEND	0x00008000
+#define UVC_QUIRK_INVALID_DEVICE_SOF	0x00010000
 
 /* Format flags */
 #define UVC_FMT_FLAG_COMPRESSED		0x00000001
--- linux-qcom-6.8.0.orig/drivers/media/v4l2-core/v4l2-async.c
+++ linux-qcom-6.8.0/drivers/media/v4l2-core/v4l2-async.c
@@ -324,6 +324,9 @@
 	    sd->entity.function != MEDIA_ENT_F_FLASH)
 		return 0;
 
+	if (!n->sd)
+		return 0;
+
 	link = media_create_ancillary_link(&n->sd->entity, &sd->entity);
 
 #endif
@@ -563,6 +566,7 @@
 {
 	INIT_LIST_HEAD(&notifier->waiting_list);
 	INIT_LIST_HEAD(&notifier->done_list);
+	INIT_LIST_HEAD(&notifier->notifier_entry);
 	notifier->v4l2_dev = v4l2_dev;
 }
 EXPORT_SYMBOL(v4l2_async_nf_init);
@@ -572,6 +576,7 @@
 {
 	INIT_LIST_HEAD(&notifier->waiting_list);
 	INIT_LIST_HEAD(&notifier->done_list);
+	INIT_LIST_HEAD(&notifier->notifier_entry);
 	notifier->sd = sd;
 }
 EXPORT_SYMBOL_GPL(v4l2_async_subdev_nf_init);
@@ -618,16 +623,10 @@
 
 int v4l2_async_nf_register(struct v4l2_async_notifier *notifier)
 {
-	int ret;
-
 	if (WARN_ON(!notifier->v4l2_dev == !notifier->sd))
 		return -EINVAL;
 
-	ret = __v4l2_async_nf_register(notifier);
-	if (ret)
-		notifier->v4l2_dev = NULL;
-
-	return ret;
+	return __v4l2_async_nf_register(notifier);
 }
 EXPORT_SYMBOL(v4l2_async_nf_register);
 
@@ -639,7 +638,7 @@
 
 	v4l2_async_nf_unbind_all_subdevs(notifier);
 
-	list_del(&notifier->notifier_entry);
+	list_del_init(&notifier->notifier_entry);
 }
 
 void v4l2_async_nf_unregister(struct v4l2_async_notifier *notifier)
--- linux-qcom-6.8.0.orig/drivers/media/v4l2-core/v4l2-cci.c
+++ linux-qcom-6.8.0/drivers/media/v4l2-core/v4l2-cci.c
@@ -23,6 +23,15 @@
 	u8 buf[8];
 	int ret;
 
+	/*
+	 * TODO: Fix smatch. Assign *val to 0 here in order to avoid
+	 * failing a smatch check on caller when the caller proceeds to
+	 * read *val without initialising it on caller's side. *val is set
+	 * to a valid value whenever this function returns 0 but smatch
+	 * can't figure that out currently.
+	 */
+	*val = 0;
+
 	if (err && *err)
 		return *err;
 
@@ -32,7 +41,7 @@
 
 	ret = regmap_bulk_read(map, reg, buf, len);
 	if (ret) {
-		dev_err(regmap_get_device(map), "Error reading reg 0x%4x: %d\n",
+		dev_err(regmap_get_device(map), "Error reading reg 0x%04x: %d\n",
 			reg, ret);
 		goto out;
 	}
@@ -131,7 +140,7 @@
 
 	ret = regmap_bulk_write(map, reg, buf, len);
 	if (ret)
-		dev_err(regmap_get_device(map), "Error writing reg 0x%4x: %d\n",
+		dev_err(regmap_get_device(map), "Error writing reg 0x%04x: %d\n",
 			reg, ret);
 
 out:
--- linux-qcom-6.8.0.orig/drivers/media/v4l2-core/v4l2-ctrls-api.c
+++ linux-qcom-6.8.0/drivers/media/v4l2-core/v4l2-ctrls-api.c
@@ -753,9 +753,10 @@
 		for (i = 0; i < master->ncontrols; i++)
 			cur_to_new(master->cluster[i]);
 		ret = call_op(master, g_volatile_ctrl);
-		new_to_user(c, ctrl);
+		if (!ret)
+			ret = new_to_user(c, ctrl);
 	} else {
-		cur_to_user(c, ctrl);
+		ret = cur_to_user(c, ctrl);
 	}
 	v4l2_ctrl_unlock(master);
 	return ret;
@@ -770,7 +771,10 @@
 	if (!ctrl || !ctrl->is_int)
 		return -EINVAL;
 	ret = get_ctrl(ctrl, &c);
-	control->value = c.value;
+
+	if (!ret)
+		control->value = c.value;
+
 	return ret;
 }
 EXPORT_SYMBOL(v4l2_g_ctrl);
@@ -811,10 +815,11 @@
 	int ret;
 
 	v4l2_ctrl_lock(ctrl);
-	user_to_new(c, ctrl);
-	ret = set_ctrl(fh, ctrl, 0);
+	ret = user_to_new(c, ctrl);
+	if (!ret)
+		ret = set_ctrl(fh, ctrl, 0);
 	if (!ret)
-		cur_to_user(c, ctrl);
+		ret = cur_to_user(c, ctrl);
 	v4l2_ctrl_unlock(ctrl);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/media/v4l2-core/v4l2-ctrls-defs.c
+++ linux-qcom-6.8.0/drivers/media/v4l2-core/v4l2-ctrls-defs.c
@@ -154,6 +154,7 @@
 		"Variable Bitrate",
 		"Constant Bitrate",
 		"Constant Quality",
+		"Maximum Bitrate",
 		NULL
 	};
 	static const char * const mpeg_stream_type[] = {
--- linux-qcom-6.8.0.orig/drivers/media/v4l2-core/v4l2-dev.c
+++ linux-qcom-6.8.0/drivers/media/v4l2-core/v4l2-dev.c
@@ -1036,8 +1036,10 @@
 	vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor);
 	vdev->dev.parent = vdev->dev_parent;
 	dev_set_name(&vdev->dev, "%s%d", name_base, vdev->num);
+	mutex_lock(&videodev_lock);
 	ret = device_register(&vdev->dev);
 	if (ret < 0) {
+		mutex_unlock(&videodev_lock);
 		pr_err("%s: device_register failed\n", __func__);
 		goto cleanup;
 	}
@@ -1057,6 +1059,7 @@
 
 	/* Part 6: Activate this minor. The char device can now be used. */
 	set_bit(V4L2_FL_REGISTERED, &vdev->flags);
+	mutex_unlock(&videodev_lock);
 
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/media/v4l2-core/v4l2-dv-timings.c
+++ linux-qcom-6.8.0/drivers/media/v4l2-core/v4l2-dv-timings.c
@@ -481,25 +481,28 @@
  * @polarities - the horizontal and vertical polarities (same as struct
  *		v4l2_bt_timings polarities).
  * @interlaced - if this flag is true, it indicates interlaced format
- * @fmt - the resulting timings.
+ * @cap - the v4l2_dv_timings_cap capabilities.
+ * @timings - the resulting timings.
  *
  * This function will attempt to detect if the given values correspond to a
  * valid CVT format. If so, then it will return true, and fmt will be filled
  * in with the found CVT timings.
  */
-bool v4l2_detect_cvt(unsigned frame_height,
-		     unsigned hfreq,
-		     unsigned vsync,
-		     unsigned active_width,
+bool v4l2_detect_cvt(unsigned int frame_height,
+		     unsigned int hfreq,
+		     unsigned int vsync,
+		     unsigned int active_width,
 		     u32 polarities,
 		     bool interlaced,
-		     struct v4l2_dv_timings *fmt)
+		     const struct v4l2_dv_timings_cap *cap,
+		     struct v4l2_dv_timings *timings)
 {
-	int  v_fp, v_bp, h_fp, h_bp, hsync;
-	int  frame_width, image_height, image_width;
+	struct v4l2_dv_timings t = {};
+	int v_fp, v_bp, h_fp, h_bp, hsync;
+	int frame_width, image_height, image_width;
 	bool reduced_blanking;
 	bool rb_v2 = false;
-	unsigned pix_clk;
+	unsigned int pix_clk;
 
 	if (vsync < 4 || vsync > 8)
 		return false;
@@ -625,36 +628,39 @@
 		h_fp = h_blank - hsync - h_bp;
 	}
 
-	fmt->type = V4L2_DV_BT_656_1120;
-	fmt->bt.polarities = polarities;
-	fmt->bt.width = image_width;
-	fmt->bt.height = image_height;
-	fmt->bt.hfrontporch = h_fp;
-	fmt->bt.vfrontporch = v_fp;
-	fmt->bt.hsync = hsync;
-	fmt->bt.vsync = vsync;
-	fmt->bt.hbackporch = frame_width - image_width - h_fp - hsync;
+	t.type = V4L2_DV_BT_656_1120;
+	t.bt.polarities = polarities;
+	t.bt.width = image_width;
+	t.bt.height = image_height;
+	t.bt.hfrontporch = h_fp;
+	t.bt.vfrontporch = v_fp;
+	t.bt.hsync = hsync;
+	t.bt.vsync = vsync;
+	t.bt.hbackporch = frame_width - image_width - h_fp - hsync;
 
 	if (!interlaced) {
-		fmt->bt.vbackporch = frame_height - image_height - v_fp - vsync;
-		fmt->bt.interlaced = V4L2_DV_PROGRESSIVE;
+		t.bt.vbackporch = frame_height - image_height - v_fp - vsync;
+		t.bt.interlaced = V4L2_DV_PROGRESSIVE;
 	} else {
-		fmt->bt.vbackporch = (frame_height - image_height - 2 * v_fp -
+		t.bt.vbackporch = (frame_height - image_height - 2 * v_fp -
 				      2 * vsync) / 2;
-		fmt->bt.il_vbackporch = frame_height - image_height - 2 * v_fp -
-					2 * vsync - fmt->bt.vbackporch;
-		fmt->bt.il_vfrontporch = v_fp;
-		fmt->bt.il_vsync = vsync;
-		fmt->bt.flags |= V4L2_DV_FL_HALF_LINE;
-		fmt->bt.interlaced = V4L2_DV_INTERLACED;
+		t.bt.il_vbackporch = frame_height - image_height - 2 * v_fp -
+					2 * vsync - t.bt.vbackporch;
+		t.bt.il_vfrontporch = v_fp;
+		t.bt.il_vsync = vsync;
+		t.bt.flags |= V4L2_DV_FL_HALF_LINE;
+		t.bt.interlaced = V4L2_DV_INTERLACED;
 	}
 
-	fmt->bt.pixelclock = pix_clk;
-	fmt->bt.standards = V4L2_DV_BT_STD_CVT;
+	t.bt.pixelclock = pix_clk;
+	t.bt.standards = V4L2_DV_BT_STD_CVT;
 
 	if (reduced_blanking)
-		fmt->bt.flags |= V4L2_DV_FL_REDUCED_BLANKING;
+		t.bt.flags |= V4L2_DV_FL_REDUCED_BLANKING;
 
+	if (!v4l2_valid_dv_timings(&t, cap, NULL, NULL))
+		return false;
+	*timings = t;
 	return true;
 }
 EXPORT_SYMBOL_GPL(v4l2_detect_cvt);
@@ -699,22 +705,25 @@
  *		image height, so it has to be passed explicitly. Usually
  *		the native screen aspect ratio is used for this. If it
  *		is not filled in correctly, then 16:9 will be assumed.
- * @fmt - the resulting timings.
+ * @cap - the v4l2_dv_timings_cap capabilities.
+ * @timings - the resulting timings.
  *
  * This function will attempt to detect if the given values correspond to a
  * valid GTF format. If so, then it will return true, and fmt will be filled
  * in with the found GTF timings.
  */
-bool v4l2_detect_gtf(unsigned frame_height,
-		unsigned hfreq,
-		unsigned vsync,
-		u32 polarities,
-		bool interlaced,
-		struct v4l2_fract aspect,
-		struct v4l2_dv_timings *fmt)
+bool v4l2_detect_gtf(unsigned int frame_height,
+		     unsigned int hfreq,
+		     unsigned int vsync,
+		     u32 polarities,
+		     bool interlaced,
+		     struct v4l2_fract aspect,
+		     const struct v4l2_dv_timings_cap *cap,
+		     struct v4l2_dv_timings *timings)
 {
+	struct v4l2_dv_timings t = {};
 	int pix_clk;
-	int  v_fp, v_bp, h_fp, hsync;
+	int v_fp, v_bp, h_fp, hsync;
 	int frame_width, image_height, image_width;
 	bool default_gtf;
 	int h_blank;
@@ -783,36 +792,39 @@
 
 	h_fp = h_blank / 2 - hsync;
 
-	fmt->type = V4L2_DV_BT_656_1120;
-	fmt->bt.polarities = polarities;
-	fmt->bt.width = image_width;
-	fmt->bt.height = image_height;
-	fmt->bt.hfrontporch = h_fp;
-	fmt->bt.vfrontporch = v_fp;
-	fmt->bt.hsync = hsync;
-	fmt->bt.vsync = vsync;
-	fmt->bt.hbackporch = frame_width - image_width - h_fp - hsync;
+	t.type = V4L2_DV_BT_656_1120;
+	t.bt.polarities = polarities;
+	t.bt.width = image_width;
+	t.bt.height = image_height;
+	t.bt.hfrontporch = h_fp;
+	t.bt.vfrontporch = v_fp;
+	t.bt.hsync = hsync;
+	t.bt.vsync = vsync;
+	t.bt.hbackporch = frame_width - image_width - h_fp - hsync;
 
 	if (!interlaced) {
-		fmt->bt.vbackporch = frame_height - image_height - v_fp - vsync;
-		fmt->bt.interlaced = V4L2_DV_PROGRESSIVE;
+		t.bt.vbackporch = frame_height - image_height - v_fp - vsync;
+		t.bt.interlaced = V4L2_DV_PROGRESSIVE;
 	} else {
-		fmt->bt.vbackporch = (frame_height - image_height - 2 * v_fp -
+		t.bt.vbackporch = (frame_height - image_height - 2 * v_fp -
 				      2 * vsync) / 2;
-		fmt->bt.il_vbackporch = frame_height - image_height - 2 * v_fp -
-					2 * vsync - fmt->bt.vbackporch;
-		fmt->bt.il_vfrontporch = v_fp;
-		fmt->bt.il_vsync = vsync;
-		fmt->bt.flags |= V4L2_DV_FL_HALF_LINE;
-		fmt->bt.interlaced = V4L2_DV_INTERLACED;
+		t.bt.il_vbackporch = frame_height - image_height - 2 * v_fp -
+					2 * vsync - t.bt.vbackporch;
+		t.bt.il_vfrontporch = v_fp;
+		t.bt.il_vsync = vsync;
+		t.bt.flags |= V4L2_DV_FL_HALF_LINE;
+		t.bt.interlaced = V4L2_DV_INTERLACED;
 	}
 
-	fmt->bt.pixelclock = pix_clk;
-	fmt->bt.standards = V4L2_DV_BT_STD_GTF;
+	t.bt.pixelclock = pix_clk;
+	t.bt.standards = V4L2_DV_BT_STD_GTF;
 
 	if (!default_gtf)
-		fmt->bt.flags |= V4L2_DV_FL_REDUCED_BLANKING;
+		t.bt.flags |= V4L2_DV_FL_REDUCED_BLANKING;
 
+	if (!v4l2_valid_dv_timings(&t, cap, NULL, NULL))
+		return false;
+	*timings = t;
 	return true;
 }
 EXPORT_SYMBOL_GPL(v4l2_detect_gtf);
--- linux-qcom-6.8.0.orig/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ linux-qcom-6.8.0/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -1087,11 +1087,17 @@
 	entity->function = function;
 
 	ret = media_entity_pads_init(entity, num_pads, pads);
-	if (ret)
+	if (ret) {
+		kfree(entity->name);
+		entity->name = NULL;
 		return ret;
+	}
 	ret = media_device_register_entity(mdev, entity);
-	if (ret)
+	if (ret) {
+		kfree(entity->name);
+		entity->name = NULL;
 		return ret;
+	}
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/media/v4l2-core/v4l2-subdev.c
+++ linux-qcom-6.8.0/drivers/media/v4l2-core/v4l2-subdev.c
@@ -412,15 +412,6 @@
 	if (WARN_ON(!!sd->enabled_streams == !!enable))
 		return 0;
 
-#if IS_REACHABLE(CONFIG_LEDS_CLASS)
-	if (!IS_ERR_OR_NULL(sd->privacy_led)) {
-		if (enable)
-			led_set_brightness(sd->privacy_led,
-					   sd->privacy_led->max_brightness);
-		else
-			led_set_brightness(sd->privacy_led, 0);
-	}
-#endif
 	ret = sd->ops->video->s_stream(sd, enable);
 
 	if (!enable && ret < 0) {
@@ -428,9 +419,20 @@
 		ret = 0;
 	}
 
-	if (!ret)
+	if (!ret) {
 		sd->enabled_streams = enable ? BIT(0) : 0;
 
+#if IS_REACHABLE(CONFIG_LEDS_CLASS)
+		if (!IS_ERR_OR_NULL(sd->privacy_led)) {
+			if (enable)
+				led_set_brightness(sd->privacy_led,
+						   sd->privacy_led->max_brightness);
+			else
+				led_set_brightness(sd->privacy_led, 0);
+		}
+#endif
+	}
+
 	return ret;
 }
 
@@ -732,6 +734,7 @@
 		memset(&sel, 0, sizeof(sel));
 		sel.which = crop->which;
 		sel.pad = crop->pad;
+		sel.stream = crop->stream;
 		sel.target = V4L2_SEL_TGT_CROP;
 
 		rval = v4l2_subdev_call(
@@ -756,6 +759,7 @@
 		memset(&sel, 0, sizeof(sel));
 		sel.which = crop->which;
 		sel.pad = crop->pad;
+		sel.stream = crop->stream;
 		sel.target = V4L2_SEL_TGT_CROP;
 		sel.r = crop->rect;
 
--- linux-qcom-6.8.0.orig/drivers/memory/Kconfig
+++ linux-qcom-6.8.0/drivers/memory/Kconfig
@@ -167,7 +167,7 @@
 	  represents a coherency violation.
 
 config FSL_IFC
-	bool "Freescale IFC driver" if COMPILE_TEST
+	bool "Freescale IFC driver"
 	depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST
 	depends on HAS_IOMEM
 
--- linux-qcom-6.8.0.orig/drivers/memory/stm32-fmc2-ebi.c
+++ linux-qcom-6.8.0/drivers/memory/stm32-fmc2-ebi.c
@@ -181,8 +181,11 @@
 				    int cs)
 {
 	u32 bcr;
+	int ret;
 
-	regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	if (ret)
+		return ret;
 
 	if (bcr & FMC2_BCR_MTYP)
 		return 0;
@@ -195,8 +198,11 @@
 					int cs)
 {
 	u32 bcr, val = FIELD_PREP(FMC2_BCR_MTYP, FMC2_BCR_MTYP_NOR);
+	int ret;
 
-	regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	if (ret)
+		return ret;
 
 	if ((bcr & FMC2_BCR_MTYP) == val && bcr & FMC2_BCR_BURSTEN)
 		return 0;
@@ -209,8 +215,11 @@
 					   int cs)
 {
 	u32 bcr;
+	int ret;
 
-	regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	if (ret)
+		return ret;
 
 	if (bcr & FMC2_BCR_BURSTEN)
 		return 0;
@@ -223,8 +232,11 @@
 					    int cs)
 {
 	u32 bcr;
+	int ret;
 
-	regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	if (ret)
+		return ret;
 
 	if (!(bcr & FMC2_BCR_BURSTEN) || !(bcr & FMC2_BCR_CBURSTRW))
 		return 0;
@@ -237,8 +249,11 @@
 				       int cs)
 {
 	u32 bcr, val = FIELD_PREP(FMC2_BCR_MTYP, FMC2_BCR_MTYP_PSRAM);
+	int ret;
 
-	regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	if (ret)
+		return ret;
 
 	if ((bcr & FMC2_BCR_MTYP) == val && bcr & FMC2_BCR_BURSTEN)
 		return 0;
@@ -251,12 +266,18 @@
 					     int cs)
 {
 	u32 bcr, bxtr, val = FIELD_PREP(FMC2_BXTR_ACCMOD, FMC2_BXTR_EXTMOD_D);
+	int ret;
+
+	ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	if (ret)
+		return ret;
 
-	regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
 	if (prop->reg_type == FMC2_REG_BWTR)
-		regmap_read(ebi->regmap, FMC2_BWTR(cs), &bxtr);
+		ret = regmap_read(ebi->regmap, FMC2_BWTR(cs), &bxtr);
 	else
-		regmap_read(ebi->regmap, FMC2_BTR(cs), &bxtr);
+		ret = regmap_read(ebi->regmap, FMC2_BTR(cs), &bxtr);
+	if (ret)
+		return ret;
 
 	if ((!(bcr & FMC2_BCR_BURSTEN) || !(bcr & FMC2_BCR_CBURSTRW)) &&
 	    ((bxtr & FMC2_BXTR_ACCMOD) == val || bcr & FMC2_BCR_MUXEN))
@@ -270,12 +291,19 @@
 					   int cs)
 {
 	u32 bcr, bcr1;
+	int ret;
 
-	regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
-	if (cs)
-		regmap_read(ebi->regmap, FMC2_BCR1, &bcr1);
-	else
+	ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	if (ret)
+		return ret;
+
+	if (cs) {
+		ret = regmap_read(ebi->regmap, FMC2_BCR1, &bcr1);
+		if (ret)
+			return ret;
+	} else {
 		bcr1 = bcr;
+	}
 
 	if (bcr & FMC2_BCR_BURSTEN && (!cs || !(bcr1 & FMC2_BCR1_CCLKEN)))
 		return 0;
@@ -307,12 +335,18 @@
 {
 	u32 nb_clk_cycles = stm32_fmc2_ebi_ns_to_clock_cycles(ebi, cs, setup);
 	u32 bcr, btr, clk_period;
+	int ret;
+
+	ret = regmap_read(ebi->regmap, FMC2_BCR1, &bcr);
+	if (ret)
+		return ret;
 
-	regmap_read(ebi->regmap, FMC2_BCR1, &bcr);
 	if (bcr & FMC2_BCR1_CCLKEN || !cs)
-		regmap_read(ebi->regmap, FMC2_BTR1, &btr);
+		ret = regmap_read(ebi->regmap, FMC2_BTR1, &btr);
 	else
-		regmap_read(ebi->regmap, FMC2_BTR(cs), &btr);
+		ret = regmap_read(ebi->regmap, FMC2_BTR(cs), &btr);
+	if (ret)
+		return ret;
 
 	clk_period = FIELD_GET(FMC2_BTR_CLKDIV, btr) + 1;
 
@@ -571,11 +605,16 @@
 	if (ret)
 		return ret;
 
-	regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+	if (ret)
+		return ret;
+
 	if (prop->reg_type == FMC2_REG_BWTR)
-		regmap_read(ebi->regmap, FMC2_BWTR(cs), &bxtr);
+		ret = regmap_read(ebi->regmap, FMC2_BWTR(cs), &bxtr);
 	else
-		regmap_read(ebi->regmap, FMC2_BTR(cs), &bxtr);
+		ret = regmap_read(ebi->regmap, FMC2_BTR(cs), &bxtr);
+	if (ret)
+		return ret;
 
 	if ((bxtr & FMC2_BXTR_ACCMOD) == val || bcr & FMC2_BCR_MUXEN)
 		val = clamp_val(setup, 1, FMC2_BXTR_ADDSET_MAX);
@@ -693,11 +732,14 @@
 					    int cs, u32 setup)
 {
 	u32 old_val, new_val, pcscntr;
+	int ret;
 
 	if (setup < 1)
 		return 0;
 
-	regmap_read(ebi->regmap, FMC2_PCSCNTR, &pcscntr);
+	ret = regmap_read(ebi->regmap, FMC2_PCSCNTR, &pcscntr);
+	if (ret)
+		return ret;
 
 	/* Enable counter for the bank */
 	regmap_update_bits(ebi->regmap, FMC2_PCSCNTR,
@@ -944,17 +986,20 @@
 	regmap_update_bits(ebi->regmap, FMC2_BCR(cs), FMC2_BCR_MBKEN, 0);
 }
 
-static void stm32_fmc2_ebi_save_setup(struct stm32_fmc2_ebi *ebi)
+static int stm32_fmc2_ebi_save_setup(struct stm32_fmc2_ebi *ebi)
 {
 	unsigned int cs;
+	int ret;
 
 	for (cs = 0; cs < FMC2_MAX_EBI_CE; cs++) {
-		regmap_read(ebi->regmap, FMC2_BCR(cs), &ebi->bcr[cs]);
-		regmap_read(ebi->regmap, FMC2_BTR(cs), &ebi->btr[cs]);
-		regmap_read(ebi->regmap, FMC2_BWTR(cs), &ebi->bwtr[cs]);
+		ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &ebi->bcr[cs]);
+		ret |= regmap_read(ebi->regmap, FMC2_BTR(cs), &ebi->btr[cs]);
+		ret |= regmap_read(ebi->regmap, FMC2_BWTR(cs), &ebi->bwtr[cs]);
+		if (ret)
+			return ret;
 	}
 
-	regmap_read(ebi->regmap, FMC2_PCSCNTR, &ebi->pcscntr);
+	return regmap_read(ebi->regmap, FMC2_PCSCNTR, &ebi->pcscntr);
 }
 
 static void stm32_fmc2_ebi_set_setup(struct stm32_fmc2_ebi *ebi)
@@ -983,22 +1028,29 @@
 }
 
 /* NWAIT signal can not be connected to EBI controller and NAND controller */
-static bool stm32_fmc2_ebi_nwait_used_by_ctrls(struct stm32_fmc2_ebi *ebi)
+static int stm32_fmc2_ebi_nwait_used_by_ctrls(struct stm32_fmc2_ebi *ebi)
 {
+	struct device *dev = ebi->dev;
 	unsigned int cs;
 	u32 bcr;
+	int ret;
 
 	for (cs = 0; cs < FMC2_MAX_EBI_CE; cs++) {
 		if (!(ebi->bank_assigned & BIT(cs)))
 			continue;
 
-		regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+		ret = regmap_read(ebi->regmap, FMC2_BCR(cs), &bcr);
+		if (ret)
+			return ret;
+
 		if ((bcr & FMC2_BCR_WAITEN || bcr & FMC2_BCR_ASYNCWAIT) &&
-		    ebi->bank_assigned & BIT(FMC2_NAND))
-			return true;
+		    ebi->bank_assigned & BIT(FMC2_NAND)) {
+			dev_err(dev, "NWAIT signal connected to EBI and NAND controllers\n");
+			return -EINVAL;
+		}
 	}
 
-	return false;
+	return 0;
 }
 
 static void stm32_fmc2_ebi_enable(struct stm32_fmc2_ebi *ebi)
@@ -1085,10 +1137,9 @@
 		return -ENODEV;
 	}
 
-	if (stm32_fmc2_ebi_nwait_used_by_ctrls(ebi)) {
-		dev_err(dev, "NWAIT signal connected to EBI and NAND controllers\n");
-		return -EINVAL;
-	}
+	ret = stm32_fmc2_ebi_nwait_used_by_ctrls(ebi);
+	if (ret)
+		return ret;
 
 	stm32_fmc2_ebi_enable(ebi);
 
@@ -1133,7 +1184,10 @@
 	if (ret)
 		goto err_release;
 
-	stm32_fmc2_ebi_save_setup(ebi);
+	ret = stm32_fmc2_ebi_save_setup(ebi);
+	if (ret)
+		goto err_release;
+
 	platform_set_drvdata(pdev, ebi);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/memory/tegra/tegra186-emc.c
+++ linux-qcom-6.8.0/drivers/memory/tegra/tegra186-emc.c
@@ -35,11 +35,6 @@
 	struct icc_provider provider;
 };
 
-static inline struct tegra186_emc *to_tegra186_emc(struct icc_provider *provider)
-{
-	return container_of(provider, struct tegra186_emc, provider);
-}
-
 /*
  * debugfs interface
  *
--- linux-qcom-6.8.0.orig/drivers/memory/tegra/tegra234.c
+++ linux-qcom-6.8.0/drivers/memory/tegra/tegra234.c
@@ -121,7 +121,7 @@
 		},
 	}, {
 		.id = TEGRA234_MEMORY_CLIENT_DLA1RDB,
-		.name = "dla0rdb",
+		.name = "dla1rdb",
 		.sid = TEGRA234_SID_NVDLA1,
 		.regs = {
 			.sid = {
@@ -407,7 +407,7 @@
 		},
 	}, {
 		.id = TEGRA234_MEMORY_CLIENT_DLA1RDB1,
-		.name = "dla0rdb1",
+		.name = "dla1rdb1",
 		.sid = TEGRA234_SID_NVDLA1,
 		.regs = {
 			.sid = {
@@ -417,7 +417,7 @@
 		},
 	}, {
 		.id = TEGRA234_MEMORY_CLIENT_DLA1WRB,
-		.name = "dla0wrb",
+		.name = "dla1wrb",
 		.sid = TEGRA234_SID_NVDLA1,
 		.regs = {
 			.sid = {
@@ -699,7 +699,7 @@
 		},
 	}, {
 		.id = TEGRA234_MEMORY_CLIENT_DLA1RDA,
-		.name = "dla0rda",
+		.name = "dla1rda",
 		.sid = TEGRA234_SID_NVDLA1,
 		.regs = {
 			.sid = {
@@ -709,7 +709,7 @@
 		},
 	}, {
 		.id = TEGRA234_MEMORY_CLIENT_DLA1FALRDB,
-		.name = "dla0falrdb",
+		.name = "dla1falrdb",
 		.sid = TEGRA234_SID_NVDLA1,
 		.regs = {
 			.sid = {
@@ -719,7 +719,7 @@
 		},
 	}, {
 		.id = TEGRA234_MEMORY_CLIENT_DLA1WRA,
-		.name = "dla0wra",
+		.name = "dla1wra",
 		.sid = TEGRA234_SID_NVDLA1,
 		.regs = {
 			.sid = {
@@ -729,7 +729,7 @@
 		},
 	}, {
 		.id = TEGRA234_MEMORY_CLIENT_DLA1FALWRB,
-		.name = "dla0falwrb",
+		.name = "dla1falwrb",
 		.sid = TEGRA234_SID_NVDLA1,
 		.regs = {
 			.sid = {
@@ -917,7 +917,7 @@
 		},
 	}, {
 		.id = TEGRA234_MEMORY_CLIENT_DLA1RDA1,
-		.name = "dla0rda1",
+		.name = "dla1rda1",
 		.sid = TEGRA234_SID_NVDLA1,
 		.regs = {
 			.sid = {
--- linux-qcom-6.8.0.orig/drivers/message/fusion/mptsas.c
+++ linux-qcom-6.8.0/drivers/message/fusion/mptsas.c
@@ -4234,10 +4234,8 @@
 static void
 mptsas_reprobe_lun(struct scsi_device *sdev, void *data)
 {
-	int rc;
-
 	sdev->no_uld_attach = data ? 1 : 0;
-	rc = scsi_device_reprobe(sdev);
+	WARN_ON(scsi_device_reprobe(sdev));
 }
 
 static void
--- linux-qcom-6.8.0.orig/drivers/mfd/Kconfig
+++ linux-qcom-6.8.0/drivers/mfd/Kconfig
@@ -1107,6 +1107,17 @@
 	  Say yes here if you want to include support GPIO for pins on
 	  the PCF50633 chip.
 
+config MFD_I2C_PMIC
+	tristate "QTI I2C PMIC support"
+	depends on I2C && OF
+	select IRQ_DOMAIN
+	select REGMAP_I2C
+	help
+	 This enables support for controlling Qualcomm Technologies, Inc.
+	 PMICs over I2C. The driver controls interrupts, and provides register
+	 access for all of the device's peripherals.  Some QTI PMIC chips
+	 support communication over both I2C and SPMI.
+
 config MFD_PM8XXX
 	tristate "Qualcomm PM8xxx PMIC chips driver"
 	depends on (ARM || HEXAGON || COMPILE_TEST)
@@ -1773,6 +1784,7 @@
 	bool "TI TWL4030/TWL5030/TWL6030/TPS659x0 Support"
 	depends on I2C=y
 	select IRQ_DOMAIN
+	select MFD_CORE
 	select REGMAP_I2C
 	help
 	  Say yes here if you have TWL4030 / TWL6030 family chip on your board.
@@ -2218,6 +2230,18 @@
 	  under it in the device tree. Additional drivers must be enabled in
 	  order to use the functionality of the device.
 
+config MFD_AAEON
+	tristate "AAEON WMI MFD devices"
+	depends on ASUS_WMI
+	depends on UBUNTU_ODM_DRIVERS
+	help
+	  Say yes here to support mltiple IO devices on Single Board Computers
+	  produced by AAEON.
+
+	  This driver leverages the ASUS WMI interface to access device
+	  resources.
+
+
 menu "Multimedia Capabilities Port drivers"
 	depends on ARCH_SA1100
 
--- linux-qcom-6.8.0.orig/drivers/mfd/Makefile
+++ linux-qcom-6.8.0/drivers/mfd/Makefile
@@ -203,6 +203,7 @@
 
 obj-$(CONFIG_MFD_CS5535)	+= cs5535-mfd.o
 obj-$(CONFIG_MFD_OMAP_USB_HOST)	+= omap-usb-host.o omap-usb-tll.o
+obj-$(CONFIG_MFD_I2C_PMIC)      += qcom-i2c-pmic.o
 obj-$(CONFIG_MFD_PM8XXX) 	+= qcom-pm8xxx.o ssbi.o
 obj-$(CONFIG_MFD_QCOM_RPM)	+= qcom_rpm.o
 obj-$(CONFIG_MFD_SPMI_PMIC)	+= qcom-spmi-pmic.o
@@ -279,8 +280,7 @@
 
 obj-$(CONFIG_MFD_ATC260X)	+= atc260x-core.o
 obj-$(CONFIG_MFD_ATC260X_I2C)	+= atc260x-i2c.o
+obj-$(CONFIG_MFD_AAEON)		+= mfd-aaeon.o
 
-rsmu-i2c-objs			:= rsmu_core.o rsmu_i2c.o
-rsmu-spi-objs			:= rsmu_core.o rsmu_spi.o
-obj-$(CONFIG_MFD_RSMU_I2C)	+= rsmu-i2c.o
-obj-$(CONFIG_MFD_RSMU_SPI)	+= rsmu-spi.o
+obj-$(CONFIG_MFD_RSMU_I2C)	+= rsmu_i2c.o rsmu_core.o
+obj-$(CONFIG_MFD_RSMU_SPI)	+= rsmu_spi.o rsmu_core.o
--- linux-qcom-6.8.0.orig/drivers/mfd/altera-sysmgr.c
+++ linux-qcom-6.8.0/drivers/mfd/altera-sysmgr.c
@@ -109,7 +109,9 @@
 
 	dev = driver_find_device_by_of_node(&altr_sysmgr_driver.driver,
 					    (void *)sysmgr_np);
-	of_node_put(sysmgr_np);
+	if (property)
+		of_node_put(sysmgr_np);
+
 	if (!dev)
 		return ERR_PTR(-EPROBE_DEFER);
 
--- linux-qcom-6.8.0.orig/drivers/mfd/cs42l43.c
+++ linux-qcom-6.8.0/drivers/mfd/cs42l43.c
@@ -84,7 +84,7 @@
 	{ CS42L43_DRV_CTRL_5,				0x136C00C0 },
 	{ CS42L43_GPIO_CTRL1,				0x00000707 },
 	{ CS42L43_GPIO_CTRL2,				0x00000000 },
-	{ CS42L43_GPIO_FN_SEL,				0x00000000 },
+	{ CS42L43_GPIO_FN_SEL,				0x00000004 },
 	{ CS42L43_MCLK_SRC_SEL,				0x00000000 },
 	{ CS42L43_SAMPLE_RATE1,				0x00000003 },
 	{ CS42L43_SAMPLE_RATE2,				0x00000003 },
@@ -131,38 +131,38 @@
 	{ CS42L43_ASP_TX_CH4_CTRL,			0x00170091 },
 	{ CS42L43_ASP_TX_CH5_CTRL,			0x001700C1 },
 	{ CS42L43_ASP_TX_CH6_CTRL,			0x001700F1 },
-	{ CS42L43_ASPTX1_INPUT,				0x00800000 },
-	{ CS42L43_ASPTX2_INPUT,				0x00800000 },
-	{ CS42L43_ASPTX3_INPUT,				0x00800000 },
-	{ CS42L43_ASPTX4_INPUT,				0x00800000 },
-	{ CS42L43_ASPTX5_INPUT,				0x00800000 },
-	{ CS42L43_ASPTX6_INPUT,				0x00800000 },
-	{ CS42L43_SWIRE_DP1_CH1_INPUT,			0x00800000 },
-	{ CS42L43_SWIRE_DP1_CH2_INPUT,			0x00800000 },
-	{ CS42L43_SWIRE_DP1_CH3_INPUT,			0x00800000 },
-	{ CS42L43_SWIRE_DP1_CH4_INPUT,			0x00800000 },
-	{ CS42L43_SWIRE_DP2_CH1_INPUT,			0x00800000 },
-	{ CS42L43_SWIRE_DP2_CH2_INPUT,			0x00800000 },
-	{ CS42L43_SWIRE_DP3_CH1_INPUT,			0x00800000 },
-	{ CS42L43_SWIRE_DP3_CH2_INPUT,			0x00800000 },
-	{ CS42L43_SWIRE_DP4_CH1_INPUT,			0x00800000 },
-	{ CS42L43_SWIRE_DP4_CH2_INPUT,			0x00800000 },
-	{ CS42L43_ASRC_INT1_INPUT1,			0x00800000 },
-	{ CS42L43_ASRC_INT2_INPUT1,			0x00800000 },
-	{ CS42L43_ASRC_INT3_INPUT1,			0x00800000 },
-	{ CS42L43_ASRC_INT4_INPUT1,			0x00800000 },
-	{ CS42L43_ASRC_DEC1_INPUT1,			0x00800000 },
-	{ CS42L43_ASRC_DEC2_INPUT1,			0x00800000 },
-	{ CS42L43_ASRC_DEC3_INPUT1,			0x00800000 },
-	{ CS42L43_ASRC_DEC4_INPUT1,			0x00800000 },
-	{ CS42L43_ISRC1INT1_INPUT1,			0x00800000 },
-	{ CS42L43_ISRC1INT2_INPUT1,			0x00800000 },
-	{ CS42L43_ISRC1DEC1_INPUT1,			0x00800000 },
-	{ CS42L43_ISRC1DEC2_INPUT1,			0x00800000 },
-	{ CS42L43_ISRC2INT1_INPUT1,			0x00800000 },
-	{ CS42L43_ISRC2INT2_INPUT1,			0x00800000 },
-	{ CS42L43_ISRC2DEC1_INPUT1,			0x00800000 },
-	{ CS42L43_ISRC2DEC2_INPUT1,			0x00800000 },
+	{ CS42L43_ASPTX1_INPUT,				0x00000000 },
+	{ CS42L43_ASPTX2_INPUT,				0x00000000 },
+	{ CS42L43_ASPTX3_INPUT,				0x00000000 },
+	{ CS42L43_ASPTX4_INPUT,				0x00000000 },
+	{ CS42L43_ASPTX5_INPUT,				0x00000000 },
+	{ CS42L43_ASPTX6_INPUT,				0x00000000 },
+	{ CS42L43_SWIRE_DP1_CH1_INPUT,			0x00000000 },
+	{ CS42L43_SWIRE_DP1_CH2_INPUT,			0x00000000 },
+	{ CS42L43_SWIRE_DP1_CH3_INPUT,			0x00000000 },
+	{ CS42L43_SWIRE_DP1_CH4_INPUT,			0x00000000 },
+	{ CS42L43_SWIRE_DP2_CH1_INPUT,			0x00000000 },
+	{ CS42L43_SWIRE_DP2_CH2_INPUT,			0x00000000 },
+	{ CS42L43_SWIRE_DP3_CH1_INPUT,			0x00000000 },
+	{ CS42L43_SWIRE_DP3_CH2_INPUT,			0x00000000 },
+	{ CS42L43_SWIRE_DP4_CH1_INPUT,			0x00000000 },
+	{ CS42L43_SWIRE_DP4_CH2_INPUT,			0x00000000 },
+	{ CS42L43_ASRC_INT1_INPUT1,			0x00000000 },
+	{ CS42L43_ASRC_INT2_INPUT1,			0x00000000 },
+	{ CS42L43_ASRC_INT3_INPUT1,			0x00000000 },
+	{ CS42L43_ASRC_INT4_INPUT1,			0x00000000 },
+	{ CS42L43_ASRC_DEC1_INPUT1,			0x00000000 },
+	{ CS42L43_ASRC_DEC2_INPUT1,			0x00000000 },
+	{ CS42L43_ASRC_DEC3_INPUT1,			0x00000000 },
+	{ CS42L43_ASRC_DEC4_INPUT1,			0x00000000 },
+	{ CS42L43_ISRC1INT1_INPUT1,			0x00000000 },
+	{ CS42L43_ISRC1INT2_INPUT1,			0x00000000 },
+	{ CS42L43_ISRC1DEC1_INPUT1,			0x00000000 },
+	{ CS42L43_ISRC1DEC2_INPUT1,			0x00000000 },
+	{ CS42L43_ISRC2INT1_INPUT1,			0x00000000 },
+	{ CS42L43_ISRC2INT2_INPUT1,			0x00000000 },
+	{ CS42L43_ISRC2DEC1_INPUT1,			0x00000000 },
+	{ CS42L43_ISRC2DEC2_INPUT1,			0x00000000 },
 	{ CS42L43_EQ1MIX_INPUT1,			0x00800000 },
 	{ CS42L43_EQ1MIX_INPUT2,			0x00800000 },
 	{ CS42L43_EQ1MIX_INPUT3,			0x00800000 },
@@ -171,8 +171,8 @@
 	{ CS42L43_EQ2MIX_INPUT2,			0x00800000 },
 	{ CS42L43_EQ2MIX_INPUT3,			0x00800000 },
 	{ CS42L43_EQ2MIX_INPUT4,			0x00800000 },
-	{ CS42L43_SPDIF1_INPUT1,			0x00800000 },
-	{ CS42L43_SPDIF2_INPUT1,			0x00800000 },
+	{ CS42L43_SPDIF1_INPUT1,			0x00000000 },
+	{ CS42L43_SPDIF2_INPUT1,			0x00000000 },
 	{ CS42L43_AMP1MIX_INPUT1,			0x00800000 },
 	{ CS42L43_AMP1MIX_INPUT2,			0x00800000 },
 	{ CS42L43_AMP1MIX_INPUT3,			0x00800000 },
@@ -217,7 +217,7 @@
 	{ CS42L43_CTRL_REG,				0x00000006 },
 	{ CS42L43_FDIV_FRAC,				0x40000000 },
 	{ CS42L43_CAL_RATIO,				0x00000080 },
-	{ CS42L43_SPI_CLK_CONFIG1,			0x00000000 },
+	{ CS42L43_SPI_CLK_CONFIG1,			0x00000001 },
 	{ CS42L43_SPI_CONFIG1,				0x00000000 },
 	{ CS42L43_SPI_CONFIG2,				0x00000000 },
 	{ CS42L43_SPI_CONFIG3,				0x00000001 },
--- linux-qcom-6.8.0.orig/drivers/mfd/da9052-spi.c
+++ linux-qcom-6.8.0/drivers/mfd/da9052-spi.c
@@ -37,7 +37,7 @@
 	spi_set_drvdata(spi, da9052);
 
 	config = da9052_regmap_config;
-	config.read_flag_mask = 1;
+	config.write_flag_mask = 1;
 	config.reg_bits = 7;
 	config.pad_bits = 1;
 	config.val_bits = 8;
--- linux-qcom-6.8.0.orig/drivers/mfd/intel-lpss-pci.c
+++ linux-qcom-6.8.0/drivers/mfd/intel-lpss-pci.c
@@ -23,12 +23,22 @@
 
 #include "intel-lpss.h"
 
-/* Some DSDTs have an unused GEXP ACPI device conflicting with I2C4 resources */
-static const struct pci_device_id ignore_resource_conflicts_ids[] = {
-	/* Microsoft Surface Go (version 1) I2C4 */
-	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, 0x9d64, 0x152d, 0x1182), },
-	/* Microsoft Surface Go 2 I2C4 */
-	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, 0x9d64, 0x152d, 0x1237), },
+static const struct pci_device_id quirk_ids[] = {
+	{
+		/* Microsoft Surface Go (version 1) I2C4 */
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, 0x9d64, 0x152d, 0x1182),
+		.driver_data = QUIRK_IGNORE_RESOURCE_CONFLICTS,
+	},
+	{
+		/* Microsoft Surface Go 2 I2C4 */
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, 0x9d64, 0x152d, 0x1237),
+		.driver_data = QUIRK_IGNORE_RESOURCE_CONFLICTS,
+	},
+	{
+		/* Dell XPS 9530 (2023) */
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_INTEL, 0x51fb, 0x1028, 0x0beb),
+		.driver_data = QUIRK_CLOCK_DIVIDER_UNITY,
+	},
 	{ }
 };
 
@@ -36,6 +46,7 @@
 				const struct pci_device_id *id)
 {
 	const struct intel_lpss_platform_info *data = (void *)id->driver_data;
+	const struct pci_device_id *quirk_pci_info;
 	struct intel_lpss_platform_info *info;
 	int ret;
 
@@ -55,8 +66,9 @@
 	info->mem = pci_resource_n(pdev, 0);
 	info->irq = pci_irq_vector(pdev, 0);
 
-	if (pci_match_id(ignore_resource_conflicts_ids, pdev))
-		info->ignore_resource_conflicts = true;
+	quirk_pci_info = pci_match_id(quirk_ids, pdev);
+	if (quirk_pci_info)
+		info->quirks = quirk_pci_info->driver_data;
 
 	pdev->d3cold_delay = 0;
 
@@ -91,7 +103,7 @@
 	.properties = spt_spi_properties,
 };
 
-static const struct intel_lpss_platform_info spt_info = {
+static const struct intel_lpss_platform_info spt_spi_info = {
 	.clk_rate = 120000000,
 	.swnode = &spt_spi_node,
 };
@@ -136,7 +148,7 @@
 	.properties = bxt_spi_properties,
 };
 
-static const struct intel_lpss_platform_info bxt_info = {
+static const struct intel_lpss_platform_info bxt_spi_info = {
 	.clk_rate = 100000000,
 	.swnode = &bxt_spi_node,
 };
@@ -204,7 +216,7 @@
 	.properties = cnl_spi_properties,
 };
 
-static const struct intel_lpss_platform_info cnl_info = {
+static const struct intel_lpss_platform_info cnl_spi_info = {
 	.clk_rate = 120000000,
 	.swnode = &cnl_spi_node,
 };
@@ -228,7 +240,7 @@
 	.properties = tgl_spi_properties,
 };
 
-static const struct intel_lpss_platform_info tgl_info = {
+static const struct intel_lpss_platform_info tgl_spi_info = {
 	.clk_rate = 100000000,
 	.swnode = &tgl_spi_node,
 };
@@ -237,8 +249,8 @@
 	/* CML-LP */
 	{ PCI_VDEVICE(INTEL, 0x02a8), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x02a9), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x02aa), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0x02ab), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x02aa), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x02ab), (kernel_ulong_t)&cnl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x02c5), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x02c6), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x02c7), (kernel_ulong_t)&spt_uart_info },
@@ -246,18 +258,18 @@
 	{ PCI_VDEVICE(INTEL, 0x02e9), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x02ea), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x02eb), (kernel_ulong_t)&cnl_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x02fb), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x02fb), (kernel_ulong_t)&cnl_spi_info },
 	/* CML-H */
 	{ PCI_VDEVICE(INTEL, 0x06a8), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x06a9), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x06aa), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0x06ab), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x06aa), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x06ab), (kernel_ulong_t)&cnl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x06c7), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x06e8), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x06e9), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x06ea), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x06eb), (kernel_ulong_t)&cnl_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x06fb), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x06fb), (kernel_ulong_t)&cnl_spi_info },
 	/* BXT A-Step */
 	{ PCI_VDEVICE(INTEL, 0x0aac), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x0aae), (kernel_ulong_t)&bxt_i2c_info },
@@ -270,9 +282,9 @@
 	{ PCI_VDEVICE(INTEL, 0x0abc), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x0abe), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x0ac0), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x0ac2), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x0ac4), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x0ac6), (kernel_ulong_t)&bxt_info },
+	{ PCI_VDEVICE(INTEL, 0x0ac2), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x0ac4), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x0ac6), (kernel_ulong_t)&bxt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x0aee), (kernel_ulong_t)&bxt_uart_info },
 	/* BXT B-Step */
 	{ PCI_VDEVICE(INTEL, 0x1aac), (kernel_ulong_t)&bxt_i2c_info },
@@ -286,9 +298,9 @@
 	{ PCI_VDEVICE(INTEL, 0x1abc), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x1abe), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x1ac0), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x1ac2), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x1ac4), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info },
+	{ PCI_VDEVICE(INTEL, 0x1ac2), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x1ac4), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info },
 	/* EBG */
 	{ PCI_VDEVICE(INTEL, 0x1bad), (kernel_ulong_t)&bxt_uart_info },
@@ -305,15 +317,15 @@
 	{ PCI_VDEVICE(INTEL, 0x31bc), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x31be), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x31c0), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x31c2), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x31c4), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x31c6), (kernel_ulong_t)&bxt_info },
+	{ PCI_VDEVICE(INTEL, 0x31c2), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x31c4), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x31c6), (kernel_ulong_t)&bxt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x31ee), (kernel_ulong_t)&bxt_uart_info },
 	/* ICL-LP */
 	{ PCI_VDEVICE(INTEL, 0x34a8), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x34a9), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x34aa), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0x34ab), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x34aa), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x34ab), (kernel_ulong_t)&cnl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x34c5), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x34c6), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x34c7), (kernel_ulong_t)&spt_uart_info },
@@ -321,15 +333,15 @@
 	{ PCI_VDEVICE(INTEL, 0x34e9), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x34ea), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x34eb), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x34fb), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x34fb), (kernel_ulong_t)&cnl_spi_info },
 	/* ICL-N */
 	{ PCI_VDEVICE(INTEL, 0x38a8), (kernel_ulong_t)&spt_uart_info },
 	/* TGL-H */
 	{ PCI_VDEVICE(INTEL, 0x43a7), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x43a8), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x43a9), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x43aa), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x43ab), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x43aa), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x43ab), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x43ad), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x43ae), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x43d8), (kernel_ulong_t)&bxt_i2c_info },
@@ -338,14 +350,14 @@
 	{ PCI_VDEVICE(INTEL, 0x43e9), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x43ea), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x43eb), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x43fb), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x43fd), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x43fb), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x43fd), (kernel_ulong_t)&tgl_spi_info },
 	/* EHL */
 	{ PCI_VDEVICE(INTEL, 0x4b28), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x4b29), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x4b2a), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x4b2b), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x4b37), (kernel_ulong_t)&bxt_info },
+	{ PCI_VDEVICE(INTEL, 0x4b2a), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x4b2b), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x4b37), (kernel_ulong_t)&bxt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x4b44), (kernel_ulong_t)&ehl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x4b45), (kernel_ulong_t)&ehl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x4b4b), (kernel_ulong_t)&ehl_i2c_info },
@@ -358,8 +370,8 @@
 	/* JSL */
 	{ PCI_VDEVICE(INTEL, 0x4da8), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x4da9), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x4daa), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0x4dab), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x4daa), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x4dab), (kernel_ulong_t)&cnl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x4dc5), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x4dc6), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x4dc7), (kernel_ulong_t)&spt_uart_info },
@@ -367,12 +379,12 @@
 	{ PCI_VDEVICE(INTEL, 0x4de9), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x4dea), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x4deb), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x4dfb), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x4dfb), (kernel_ulong_t)&cnl_spi_info },
 	/* ADL-P */
 	{ PCI_VDEVICE(INTEL, 0x51a8), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x51a9), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x51aa), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x51ab), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x51aa), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x51ab), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x51c5), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x51c6), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x51c7), (kernel_ulong_t)&bxt_uart_info },
@@ -382,12 +394,12 @@
 	{ PCI_VDEVICE(INTEL, 0x51e9), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x51ea), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x51eb), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x51fb), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x51fb), (kernel_ulong_t)&tgl_spi_info },
 	/* ADL-M */
 	{ PCI_VDEVICE(INTEL, 0x54a8), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x54a9), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x54aa), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x54ab), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x54aa), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x54ab), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x54c5), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x54c6), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x54c7), (kernel_ulong_t)&bxt_uart_info },
@@ -395,7 +407,7 @@
 	{ PCI_VDEVICE(INTEL, 0x54e9), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x54ea), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x54eb), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x54fb), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x54fb), (kernel_ulong_t)&tgl_spi_info },
 	/* APL */
 	{ PCI_VDEVICE(INTEL, 0x5aac), (kernel_ulong_t)&apl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x5aae), (kernel_ulong_t)&apl_i2c_info },
@@ -408,46 +420,59 @@
 	{ PCI_VDEVICE(INTEL, 0x5abc), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x5abe), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x5ac0), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x5ac2), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_info },
-	{ PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_info },
+	{ PCI_VDEVICE(INTEL, 0x5ac2), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x5aee), (kernel_ulong_t)&bxt_uart_info },
+	/* ARL-H */
+	{ PCI_VDEVICE(INTEL, 0x7725), (kernel_ulong_t)&bxt_uart_info },
+	{ PCI_VDEVICE(INTEL, 0x7726), (kernel_ulong_t)&bxt_uart_info },
+	{ PCI_VDEVICE(INTEL, 0x7727), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7730), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7746), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7750), (kernel_ulong_t)&bxt_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x7751), (kernel_ulong_t)&bxt_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x7752), (kernel_ulong_t)&bxt_uart_info },
+	{ PCI_VDEVICE(INTEL, 0x7778), (kernel_ulong_t)&bxt_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x7779), (kernel_ulong_t)&bxt_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x777a), (kernel_ulong_t)&bxt_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x777b), (kernel_ulong_t)&bxt_i2c_info },
 	/* RPL-S */
 	{ PCI_VDEVICE(INTEL, 0x7a28), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x7a29), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x7a2a), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x7a2b), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x7a2a), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7a2b), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x7a4c), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7a4d), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7a4e), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7a4f), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7a5c), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x7a79), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x7a7b), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x7a79), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7a7b), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x7a7c), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7a7d), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7a7e), (kernel_ulong_t)&bxt_uart_info },
 	/* ADL-S */
 	{ PCI_VDEVICE(INTEL, 0x7aa8), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x7aa9), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x7aaa), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x7aab), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x7aaa), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7aab), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x7acc), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7acd), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7ace), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7acf), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7adc), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x7af9), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x7afb), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x7af9), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7afb), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x7afc), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7afd), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7afe), (kernel_ulong_t)&bxt_uart_info },
 	/* MTL-P */
 	{ PCI_VDEVICE(INTEL, 0x7e25), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x7e26), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x7e27), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x7e30), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x7e46), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x7e27), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7e30), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7e46), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x7e50), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7e51), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7e52), (kernel_ulong_t)&bxt_uart_info },
@@ -458,22 +483,22 @@
 	/* MTP-S */
 	{ PCI_VDEVICE(INTEL, 0x7f28), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x7f29), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x7f2a), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x7f2b), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x7f2a), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7f2b), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x7f4c), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7f4d), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7f4e), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7f4f), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7f5c), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x7f5d), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x7f5e), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0x7f5f), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0x7f5e), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x7f5f), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x7f7a), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x7f7b), (kernel_ulong_t)&bxt_i2c_info },
 	/* LKF */
 	{ PCI_VDEVICE(INTEL, 0x98a8), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x98a9), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x98aa), (kernel_ulong_t)&bxt_info },
+	{ PCI_VDEVICE(INTEL, 0x98aa), (kernel_ulong_t)&bxt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x98c5), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x98c6), (kernel_ulong_t)&bxt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x98c7), (kernel_ulong_t)&bxt_uart_info },
@@ -484,8 +509,8 @@
 	/* SPT-LP */
 	{ PCI_VDEVICE(INTEL, 0x9d27), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x9d28), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x9d29), (kernel_ulong_t)&spt_info },
-	{ PCI_VDEVICE(INTEL, 0x9d2a), (kernel_ulong_t)&spt_info },
+	{ PCI_VDEVICE(INTEL, 0x9d29), (kernel_ulong_t)&spt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x9d2a), (kernel_ulong_t)&spt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x9d60), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x9d61), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x9d62), (kernel_ulong_t)&spt_i2c_info },
@@ -496,8 +521,8 @@
 	/* CNL-LP */
 	{ PCI_VDEVICE(INTEL, 0x9da8), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x9da9), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0x9daa), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0x9dab), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x9daa), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0x9dab), (kernel_ulong_t)&cnl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0x9dc5), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x9dc6), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x9dc7), (kernel_ulong_t)&spt_uart_info },
@@ -505,12 +530,12 @@
 	{ PCI_VDEVICE(INTEL, 0x9de9), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x9dea), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x9deb), (kernel_ulong_t)&cnl_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x9dfb), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0x9dfb), (kernel_ulong_t)&cnl_spi_info },
 	/* TGL-LP */
 	{ PCI_VDEVICE(INTEL, 0xa0a8), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0xa0a9), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0xa0aa), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0xa0ab), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0xa0aa), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa0ab), (kernel_ulong_t)&cnl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0xa0c5), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa0c6), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa0c7), (kernel_ulong_t)&bxt_uart_info },
@@ -520,20 +545,20 @@
 	{ PCI_VDEVICE(INTEL, 0xa0db), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0xa0dc), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0xa0dd), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0xa0de), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0xa0df), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0xa0de), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa0df), (kernel_ulong_t)&cnl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0xa0e8), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa0e9), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa0ea), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa0eb), (kernel_ulong_t)&spt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0xa0fb), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0xa0fd), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0xa0fe), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0xa0fb), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa0fd), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa0fe), (kernel_ulong_t)&cnl_spi_info },
 	/* SPT-H */
 	{ PCI_VDEVICE(INTEL, 0xa127), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0xa128), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0xa129), (kernel_ulong_t)&spt_info },
-	{ PCI_VDEVICE(INTEL, 0xa12a), (kernel_ulong_t)&spt_info },
+	{ PCI_VDEVICE(INTEL, 0xa129), (kernel_ulong_t)&spt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa12a), (kernel_ulong_t)&spt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0xa160), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa161), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa162), (kernel_ulong_t)&spt_i2c_info },
@@ -541,8 +566,8 @@
 	/* KBL-H */
 	{ PCI_VDEVICE(INTEL, 0xa2a7), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0xa2a8), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0xa2a9), (kernel_ulong_t)&spt_info },
-	{ PCI_VDEVICE(INTEL, 0xa2aa), (kernel_ulong_t)&spt_info },
+	{ PCI_VDEVICE(INTEL, 0xa2a9), (kernel_ulong_t)&spt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa2aa), (kernel_ulong_t)&spt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0xa2e0), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa2e1), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa2e2), (kernel_ulong_t)&spt_i2c_info },
@@ -551,19 +576,19 @@
 	/* CNL-H */
 	{ PCI_VDEVICE(INTEL, 0xa328), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0xa329), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0xa32a), (kernel_ulong_t)&cnl_info },
-	{ PCI_VDEVICE(INTEL, 0xa32b), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0xa32a), (kernel_ulong_t)&cnl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa32b), (kernel_ulong_t)&cnl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0xa347), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0xa368), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa369), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa36a), (kernel_ulong_t)&cnl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa36b), (kernel_ulong_t)&cnl_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0xa37b), (kernel_ulong_t)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0xa37b), (kernel_ulong_t)&cnl_spi_info },
 	/* CML-V */
 	{ PCI_VDEVICE(INTEL, 0xa3a7), (kernel_ulong_t)&spt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0xa3a8), (kernel_ulong_t)&spt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0xa3a9), (kernel_ulong_t)&spt_info },
-	{ PCI_VDEVICE(INTEL, 0xa3aa), (kernel_ulong_t)&spt_info },
+	{ PCI_VDEVICE(INTEL, 0xa3a9), (kernel_ulong_t)&spt_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa3aa), (kernel_ulong_t)&spt_spi_info },
 	{ PCI_VDEVICE(INTEL, 0xa3e0), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa3e1), (kernel_ulong_t)&spt_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa3e2), (kernel_ulong_t)&spt_i2c_info },
@@ -572,9 +597,9 @@
 	/* LNL-M */
 	{ PCI_VDEVICE(INTEL, 0xa825), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0xa826), (kernel_ulong_t)&bxt_uart_info },
-	{ PCI_VDEVICE(INTEL, 0xa827), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0xa830), (kernel_ulong_t)&tgl_info },
-	{ PCI_VDEVICE(INTEL, 0xa846), (kernel_ulong_t)&tgl_info },
+	{ PCI_VDEVICE(INTEL, 0xa827), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa830), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xa846), (kernel_ulong_t)&tgl_spi_info },
 	{ PCI_VDEVICE(INTEL, 0xa850), (kernel_ulong_t)&ehl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa851), (kernel_ulong_t)&ehl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa852), (kernel_ulong_t)&bxt_uart_info },
@@ -582,6 +607,32 @@
 	{ PCI_VDEVICE(INTEL, 0xa879), (kernel_ulong_t)&ehl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa87a), (kernel_ulong_t)&ehl_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0xa87b), (kernel_ulong_t)&ehl_i2c_info },
+	/* PTL-H */
+	{ PCI_VDEVICE(INTEL, 0xe325), (kernel_ulong_t)&bxt_uart_info },
+	{ PCI_VDEVICE(INTEL, 0xe326), (kernel_ulong_t)&bxt_uart_info },
+	{ PCI_VDEVICE(INTEL, 0xe327), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xe330), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xe346), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xe350), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe351), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe352), (kernel_ulong_t)&bxt_uart_info },
+	{ PCI_VDEVICE(INTEL, 0xe378), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe379), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe37a), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe37b), (kernel_ulong_t)&ehl_i2c_info },
+	/* PTL-P */
+	{ PCI_VDEVICE(INTEL, 0xe425), (kernel_ulong_t)&bxt_uart_info },
+	{ PCI_VDEVICE(INTEL, 0xe426), (kernel_ulong_t)&bxt_uart_info },
+	{ PCI_VDEVICE(INTEL, 0xe427), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xe430), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xe446), (kernel_ulong_t)&tgl_spi_info },
+	{ PCI_VDEVICE(INTEL, 0xe450), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe451), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe452), (kernel_ulong_t)&bxt_uart_info },
+	{ PCI_VDEVICE(INTEL, 0xe478), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe479), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe47a), (kernel_ulong_t)&ehl_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0xe47b), (kernel_ulong_t)&ehl_i2c_info },
 	{ }
 };
 MODULE_DEVICE_TABLE(pci, intel_lpss_pci_ids);
--- linux-qcom-6.8.0.orig/drivers/mfd/intel-lpss.c
+++ linux-qcom-6.8.0/drivers/mfd/intel-lpss.c
@@ -300,6 +300,7 @@
 {
 	char name[32];
 	struct clk *tmp = *clk;
+	int ret;
 
 	snprintf(name, sizeof(name), "%s-enable", devname);
 	tmp = clk_register_gate(NULL, name, __clk_get_name(tmp), 0,
@@ -316,6 +317,12 @@
 		return PTR_ERR(tmp);
 	*clk = tmp;
 
+	if (lpss->info->quirks & QUIRK_CLOCK_DIVIDER_UNITY) {
+		ret = clk_set_rate(tmp, lpss->info->clk_rate);
+		if (ret)
+			return ret;
+	}
+
 	snprintf(name, sizeof(name), "%s-update", devname);
 	tmp = clk_register_gate(NULL, name, __clk_get_name(tmp),
 				CLK_SET_RATE_PARENT, lpss->priv, 31, 0, NULL);
@@ -412,7 +419,7 @@
 		return ret;
 
 	lpss->cell->swnode = info->swnode;
-	lpss->cell->ignore_resource_conflicts = info->ignore_resource_conflicts;
+	lpss->cell->ignore_resource_conflicts = info->quirks & QUIRK_IGNORE_RESOURCE_CONFLICTS;
 
 	intel_lpss_init_dev(lpss);
 
--- linux-qcom-6.8.0.orig/drivers/mfd/intel-lpss.h
+++ linux-qcom-6.8.0/drivers/mfd/intel-lpss.h
@@ -11,16 +11,28 @@
 #ifndef __MFD_INTEL_LPSS_H
 #define __MFD_INTEL_LPSS_H
 
+#include <linux/bits.h>
 #include <linux/pm.h>
 
+/*
+ * Some DSDTs have an unused GEXP ACPI device conflicting with I2C4 resources.
+ * Set to ignore resource conflicts with ACPI declared SystemMemory regions.
+ */
+#define QUIRK_IGNORE_RESOURCE_CONFLICTS BIT(0)
+/*
+ * Some devices have misconfigured clock divider due to a firmware bug.
+ * Set this to force the clock divider to 1:1 ratio.
+ */
+#define QUIRK_CLOCK_DIVIDER_UNITY		BIT(1)
+
 struct device;
 struct resource;
 struct software_node;
 
 struct intel_lpss_platform_info {
 	struct resource *mem;
-	bool ignore_resource_conflicts;
 	int irq;
+	unsigned int quirks;
 	unsigned long clk_rate;
 	const char *clk_con_id;
 	const struct software_node *swnode;
--- linux-qcom-6.8.0.orig/drivers/mfd/intel_soc_pmic_bxtwc.c
+++ linux-qcom-6.8.0/drivers/mfd/intel_soc_pmic_bxtwc.c
@@ -232,43 +232,54 @@
 
 static struct mfd_cell bxt_wc_dev[] = {
 	{
-		.name = "bxt_wcove_gpadc",
-		.num_resources = ARRAY_SIZE(adc_resources),
-		.resources = adc_resources,
-	},
-	{
 		.name = "bxt_wcove_thermal",
 		.num_resources = ARRAY_SIZE(thermal_resources),
 		.resources = thermal_resources,
 	},
 	{
-		.name = "bxt_wcove_usbc",
-		.num_resources = ARRAY_SIZE(usbc_resources),
-		.resources = usbc_resources,
+		.name = "bxt_wcove_gpio",
+		.num_resources = ARRAY_SIZE(gpio_resources),
+		.resources = gpio_resources,
 	},
 	{
-		.name = "bxt_wcove_ext_charger",
-		.num_resources = ARRAY_SIZE(charger_resources),
-		.resources = charger_resources,
+		.name = "bxt_wcove_region",
+	},
+};
+
+static const struct mfd_cell bxt_wc_tmu_dev[] = {
+	{
+		.name = "bxt_wcove_tmu",
+		.num_resources = ARRAY_SIZE(tmu_resources),
+		.resources = tmu_resources,
 	},
+};
+
+static const struct mfd_cell bxt_wc_bcu_dev[] = {
 	{
 		.name = "bxt_wcove_bcu",
 		.num_resources = ARRAY_SIZE(bcu_resources),
 		.resources = bcu_resources,
 	},
+};
+
+static const struct mfd_cell bxt_wc_adc_dev[] = {
 	{
-		.name = "bxt_wcove_tmu",
-		.num_resources = ARRAY_SIZE(tmu_resources),
-		.resources = tmu_resources,
+		.name = "bxt_wcove_gpadc",
+		.num_resources = ARRAY_SIZE(adc_resources),
+		.resources = adc_resources,
 	},
+};
 
+static struct mfd_cell bxt_wc_chgr_dev[] = {
 	{
-		.name = "bxt_wcove_gpio",
-		.num_resources = ARRAY_SIZE(gpio_resources),
-		.resources = gpio_resources,
+		.name = "bxt_wcove_usbc",
+		.num_resources = ARRAY_SIZE(usbc_resources),
+		.resources = usbc_resources,
 	},
 	{
-		.name = "bxt_wcove_region",
+		.name = "bxt_wcove_ext_charger",
+		.num_resources = ARRAY_SIZE(charger_resources),
+		.resources = charger_resources,
 	},
 };
 
@@ -426,6 +437,26 @@
 					0, chip, data);
 }
 
+static int bxtwc_add_chained_devices(struct intel_soc_pmic *pmic,
+				     const struct mfd_cell *cells, int n_devs,
+				     struct regmap_irq_chip_data *pdata,
+				     int pirq, int irq_flags,
+				     const struct regmap_irq_chip *chip,
+				     struct regmap_irq_chip_data **data)
+{
+	struct device *dev = pmic->dev;
+	struct irq_domain *domain;
+	int ret;
+
+	ret = bxtwc_add_chained_irq_chip(pmic, pdata, pirq, irq_flags, chip, data);
+	if (ret)
+		return dev_err_probe(dev, ret, "Failed to add %s IRQ chip\n", chip->name);
+
+	domain = regmap_irq_get_domain(*data);
+
+	return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, cells, n_devs, NULL, 0, domain);
+}
+
 static int bxtwc_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -467,6 +498,15 @@
 	if (ret)
 		return dev_err_probe(dev, ret, "Failed to add IRQ chip\n");
 
+	ret = bxtwc_add_chained_devices(pmic, bxt_wc_tmu_dev, ARRAY_SIZE(bxt_wc_tmu_dev),
+					pmic->irq_chip_data,
+					BXTWC_TMU_LVL1_IRQ,
+					IRQF_ONESHOT,
+					&bxtwc_regmap_irq_chip_tmu,
+					&pmic->irq_chip_data_tmu);
+	if (ret)
+		return ret;
+
 	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
 					 BXTWC_PWRBTN_LVL1_IRQ,
 					 IRQF_ONESHOT,
@@ -475,40 +515,32 @@
 	if (ret)
 		return dev_err_probe(dev, ret, "Failed to add PWRBTN IRQ chip\n");
 
-	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
-					 BXTWC_TMU_LVL1_IRQ,
-					 IRQF_ONESHOT,
-					 &bxtwc_regmap_irq_chip_tmu,
-					 &pmic->irq_chip_data_tmu);
-	if (ret)
-		return dev_err_probe(dev, ret, "Failed to add TMU IRQ chip\n");
-
-	/* Add chained IRQ handler for BCU IRQs */
-	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
-					 BXTWC_BCU_LVL1_IRQ,
-					 IRQF_ONESHOT,
-					 &bxtwc_regmap_irq_chip_bcu,
-					 &pmic->irq_chip_data_bcu);
+	ret = bxtwc_add_chained_devices(pmic, bxt_wc_bcu_dev, ARRAY_SIZE(bxt_wc_bcu_dev),
+					pmic->irq_chip_data,
+					BXTWC_BCU_LVL1_IRQ,
+					IRQF_ONESHOT,
+					&bxtwc_regmap_irq_chip_bcu,
+					&pmic->irq_chip_data_bcu);
 	if (ret)
-		return dev_err_probe(dev, ret, "Failed to add BUC IRQ chip\n");
+		return ret;
 
-	/* Add chained IRQ handler for ADC IRQs */
-	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
-					 BXTWC_ADC_LVL1_IRQ,
-					 IRQF_ONESHOT,
-					 &bxtwc_regmap_irq_chip_adc,
-					 &pmic->irq_chip_data_adc);
+	ret = bxtwc_add_chained_devices(pmic, bxt_wc_adc_dev, ARRAY_SIZE(bxt_wc_adc_dev),
+					pmic->irq_chip_data,
+					BXTWC_ADC_LVL1_IRQ,
+					IRQF_ONESHOT,
+					&bxtwc_regmap_irq_chip_adc,
+					&pmic->irq_chip_data_adc);
 	if (ret)
-		return dev_err_probe(dev, ret, "Failed to add ADC IRQ chip\n");
+		return ret;
 
-	/* Add chained IRQ handler for CHGR IRQs */
-	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
-					 BXTWC_CHGR_LVL1_IRQ,
-					 IRQF_ONESHOT,
-					 &bxtwc_regmap_irq_chip_chgr,
-					 &pmic->irq_chip_data_chgr);
+	ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev),
+					pmic->irq_chip_data,
+					BXTWC_CHGR_LVL1_IRQ,
+					IRQF_ONESHOT,
+					&bxtwc_regmap_irq_chip_chgr,
+					&pmic->irq_chip_data_chgr);
 	if (ret)
-		return dev_err_probe(dev, ret, "Failed to add CHGR IRQ chip\n");
+		return ret;
 
 	/* Add chained IRQ handler for CRIT IRQs */
 	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
--- linux-qcom-6.8.0.orig/drivers/mfd/intel_soc_pmic_chtwc.c
+++ linux-qcom-6.8.0/drivers/mfd/intel_soc_pmic_chtwc.c
@@ -178,7 +178,6 @@
 		.driver_data = (void *)(long)INTEL_CHT_WC_LENOVO_YT3_X90,
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
 			DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"),
 		},
 	},
--- linux-qcom-6.8.0.orig/drivers/mfd/mfd-aaeon.c
+++ linux-qcom-6.8.0/drivers/mfd/mfd-aaeon.c
@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * UP Board main platform driver and FPGA configuration support
+ *
+ * Copyright (c) 2021, AAEON Ltd.
+ *
+ * Author: Kunyang_Fan <knuyang_fan@aaeon.com.tw>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/acpi.h>
+#include <linux/gpio.h>
+#include <linux/kernel.h>
+#include <linux/mfd/core.h>
+#include <linux/module.h>
+#include <linux/platform_data/x86/asus-wmi.h>
+#include <linux/platform_device.h>
+#include <linux/leds.h>
+#include <linux/wmi.h>
+
+#define AAEON_WMI_MGMT_GUID      "97845ED0-4E6D-11DE-8A39-0800200C9A66"
+
+#define WMI_REPORT_CAPABILITY_METHOD	0x00000000
+#define MAX_BFPI_VERSION		255
+#define GET_REVISION_ID			0x00
+
+struct aaeon_wmi_priv {
+	const struct mfd_cell *cells;
+	size_t ncells;
+};
+
+static const struct mfd_cell aaeon_mfd_cells[] = {
+	{ .name = "gpio-aaeon" },
+	{ .name = "hwmon-aaeon"},
+	{ .name = "leds-aaeon"},
+	{ .name = "wdt-aaeon"},
+};
+
+static const struct aaeon_wmi_priv aaeon_wmi_priv_data = {
+	.cells = aaeon_mfd_cells,
+	.ncells = ARRAY_SIZE(aaeon_mfd_cells),
+};
+
+static int aaeon_wmi_check_device(void)
+{
+	int err;
+	int retval;
+
+	err = asus_wmi_evaluate_method(WMI_REPORT_CAPABILITY_METHOD, GET_REVISION_ID, 0,
+				       &retval);
+	if (err)
+		return -ENODEV;
+	if (retval < 3 || retval > MAX_BFPI_VERSION)
+		return -ENODEV;
+
+	return 0;
+}
+
+static int aaeon_wmi_probe(struct wmi_device *wdev, const void *context)
+{
+	struct aaeon_wmi_priv *priv;
+
+	if (!wmi_has_guid(AAEON_WMI_MGMT_GUID)) {
+		dev_info(&wdev->dev, "AAEON Management GUID not found\n");
+		return -ENODEV;
+	}
+
+	if (aaeon_wmi_check_device())
+		return -ENODEV;
+
+	priv = (struct aaeon_wmi_priv *)context;
+	dev_set_drvdata(&wdev->dev, priv);
+
+	return devm_mfd_add_devices(&wdev->dev, 0, priv->cells,
+				    priv->ncells, NULL, 0, NULL);
+}
+
+static const struct wmi_device_id aaeon_wmi_id_table[] = {
+	{ AAEON_WMI_MGMT_GUID, (void *)&aaeon_wmi_priv_data },
+	{}
+};
+
+static struct wmi_driver aaeon_wmi_driver = {
+	.driver = {
+		.name = "mfd-aaeon",
+	},
+	.id_table = aaeon_wmi_id_table,
+	.probe = aaeon_wmi_probe,
+};
+
+module_wmi_driver(aaeon_wmi_driver);
+
+MODULE_DEVICE_TABLE(wmi, aaeon_wmi_id_table);
+MODULE_AUTHOR("Kunyang Fan <kunyang_fan@aaeon.com.tw>");
+MODULE_DESCRIPTION("AAEON Board WMI driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/drivers/mfd/omap-usb-tll.c
+++ linux-qcom-6.8.0/drivers/mfd/omap-usb-tll.c
@@ -230,8 +230,7 @@
 		break;
 	}
 
-	tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]),
-			   GFP_KERNEL);
+	tll = devm_kzalloc(dev, struct_size(tll, ch_clk, nch), GFP_KERNEL);
 	if (!tll) {
 		pm_runtime_put_sync(dev);
 		pm_runtime_disable(dev);
--- linux-qcom-6.8.0.orig/drivers/mfd/qcom-i2c-pmic.c
+++ linux-qcom-6.8.0/drivers/mfd/qcom-i2c-pmic.c
@@ -0,0 +1,816 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2018, 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "I2C PMIC: %s: " fmt, __func__
+
+#include <linux/bitops.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/irqdomain.h>
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+
+#define I2C_INTR_STATUS_BASE	0x0550
+#define INT_RT_STS_OFFSET	0x10
+#define INT_SET_TYPE_OFFSET	0x11
+#define INT_POL_HIGH_OFFSET	0x12
+#define INT_POL_LOW_OFFSET	0x13
+#define INT_LATCHED_CLR_OFFSET	0x14
+#define INT_EN_SET_OFFSET	0x15
+#define INT_EN_CLR_OFFSET	0x16
+#define INT_LATCHED_STS_OFFSET	0x18
+#define INT_PENDING_STS_OFFSET	0x19
+#define INT_MID_SEL_OFFSET	0x1A
+#define INT_MID_SEL_MASK	GENMASK(1, 0)
+#define INT_PRIORITY_OFFSET	0x1B
+#define INT_PRIORITY_BIT	BIT(0)
+
+enum {
+	IRQ_SET_TYPE = 0,
+	IRQ_POL_HIGH,
+	IRQ_POL_LOW,
+	IRQ_LATCHED_CLR, /* not needed but makes life easy */
+	IRQ_EN_SET,
+	IRQ_MAX_REGS,
+};
+
+struct i2c_pmic_periph {
+	void		*data;
+	u16		addr;
+	u8		cached[IRQ_MAX_REGS];
+	u8		synced[IRQ_MAX_REGS];
+	u8		wake;
+	struct mutex	lock;
+};
+
+struct i2c_pmic {
+	struct device		*dev;
+	struct regmap		*regmap;
+	struct irq_domain	*domain;
+	struct i2c_pmic_periph	*periph;
+	struct pinctrl		*pinctrl;
+	struct mutex		irq_complete;
+	const char		*pinctrl_name;
+	int			num_periphs;
+	int			summary_irq;
+	bool			resume_completed;
+	bool			irq_waiting;
+	bool			toggle_stat;
+};
+
+static void i2c_pmic_irq_bus_lock(struct irq_data *d)
+{
+	struct i2c_pmic_periph *periph = irq_data_get_irq_chip_data(d);
+
+	mutex_lock(&periph->lock);
+}
+
+static void i2c_pmic_sync_type_polarity(struct i2c_pmic *chip,
+			       struct i2c_pmic_periph *periph)
+{
+	int rc;
+
+	/* did any irq type change? */
+	if (periph->cached[IRQ_SET_TYPE] ^ periph->synced[IRQ_SET_TYPE]) {
+		rc = regmap_write(chip->regmap,
+				  periph->addr | INT_SET_TYPE_OFFSET,
+				  periph->cached[IRQ_SET_TYPE]);
+		if (rc < 0) {
+			pr_err("Couldn't set periph 0x%04x irqs 0x%02x type rc=%d\n",
+				periph->addr, periph->cached[IRQ_SET_TYPE], rc);
+			return;
+		}
+
+		periph->synced[IRQ_SET_TYPE] = periph->cached[IRQ_SET_TYPE];
+	}
+
+	/* did any polarity high change? */
+	if (periph->cached[IRQ_POL_HIGH] ^ periph->synced[IRQ_POL_HIGH]) {
+		rc = regmap_write(chip->regmap,
+				  periph->addr | INT_POL_HIGH_OFFSET,
+				  periph->cached[IRQ_POL_HIGH]);
+		if (rc < 0) {
+			pr_err("Couldn't set periph 0x%04x irqs 0x%02x polarity high rc=%d\n",
+				periph->addr, periph->cached[IRQ_POL_HIGH], rc);
+			return;
+		}
+
+		periph->synced[IRQ_POL_HIGH] = periph->cached[IRQ_POL_HIGH];
+	}
+
+	/* did any polarity low change? */
+	if (periph->cached[IRQ_POL_LOW] ^ periph->synced[IRQ_POL_LOW]) {
+		rc = regmap_write(chip->regmap,
+				  periph->addr | INT_POL_LOW_OFFSET,
+				  periph->cached[IRQ_POL_LOW]);
+		if (rc < 0) {
+			pr_err("Couldn't set periph 0x%04x irqs 0x%02x polarity low rc=%d\n",
+				periph->addr, periph->cached[IRQ_POL_LOW], rc);
+			return;
+		}
+
+		periph->synced[IRQ_POL_LOW] = periph->cached[IRQ_POL_LOW];
+	}
+}
+
+static void i2c_pmic_sync_enable(struct i2c_pmic *chip,
+				 struct i2c_pmic_periph *periph)
+{
+	u8 en_set, en_clr;
+	int rc;
+
+	/* determine which irqs were enabled and which were disabled */
+	en_clr = periph->synced[IRQ_EN_SET] & ~periph->cached[IRQ_EN_SET];
+	en_set = ~periph->synced[IRQ_EN_SET] & periph->cached[IRQ_EN_SET];
+
+	/* were any irqs disabled? */
+	if (en_clr) {
+		rc = regmap_write(chip->regmap,
+				  periph->addr | INT_EN_CLR_OFFSET, en_clr);
+		if (rc < 0) {
+			pr_err("Couldn't disable periph 0x%04x irqs 0x%02x rc=%d\n",
+				periph->addr, en_clr, rc);
+			return;
+		}
+	}
+
+	/* were any irqs enabled? */
+	if (en_set) {
+		rc = regmap_write(chip->regmap,
+				  periph->addr | INT_EN_SET_OFFSET, en_set);
+		if (rc < 0) {
+			pr_err("Couldn't enable periph 0x%04x irqs 0x%02x rc=%d\n",
+				periph->addr, en_set, rc);
+			return;
+		}
+	}
+
+	/* irq enabled status was written to hardware */
+	periph->synced[IRQ_EN_SET] = periph->cached[IRQ_EN_SET];
+}
+
+static void i2c_pmic_irq_bus_sync_unlock(struct irq_data *d)
+{
+	struct i2c_pmic_periph *periph = irq_data_get_irq_chip_data(d);
+	struct i2c_pmic *chip = periph->data;
+
+	i2c_pmic_sync_type_polarity(chip, periph);
+	i2c_pmic_sync_enable(chip, periph);
+	mutex_unlock(&periph->lock);
+}
+
+static void i2c_pmic_irq_disable(struct irq_data *d)
+{
+	struct i2c_pmic_periph *periph = irq_data_get_irq_chip_data(d);
+
+	periph->cached[IRQ_EN_SET] &= ~d->hwirq & 0xFF;
+}
+
+static void i2c_pmic_irq_enable(struct irq_data *d)
+{
+	struct i2c_pmic_periph *periph = irq_data_get_irq_chip_data(d);
+
+	periph->cached[IRQ_EN_SET] |= d->hwirq & 0xFF;
+}
+
+static int i2c_pmic_irq_set_type(struct irq_data *d, unsigned int irq_type)
+{
+	struct i2c_pmic_periph *periph = irq_data_get_irq_chip_data(d);
+
+	switch (irq_type) {
+	case IRQ_TYPE_EDGE_RISING:
+		periph->cached[IRQ_SET_TYPE] |= d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_HIGH] |= d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_LOW] &= ~d->hwirq & 0xFF;
+		break;
+	case IRQ_TYPE_EDGE_FALLING:
+		periph->cached[IRQ_SET_TYPE] |= d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_HIGH] &= ~d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_LOW] |= d->hwirq & 0xFF;
+		break;
+	case IRQ_TYPE_EDGE_BOTH:
+		periph->cached[IRQ_SET_TYPE] |= d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_HIGH] |= d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_LOW] |= d->hwirq & 0xFF;
+		break;
+	case IRQ_TYPE_LEVEL_HIGH:
+		periph->cached[IRQ_SET_TYPE] &= ~d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_HIGH] |= d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_LOW] &= ~d->hwirq & 0xFF;
+		break;
+	case IRQ_TYPE_LEVEL_LOW:
+		periph->cached[IRQ_SET_TYPE] &= ~d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_HIGH] &= ~d->hwirq & 0xFF;
+		periph->cached[IRQ_POL_LOW] |= d->hwirq & 0xFF;
+		break;
+	default:
+		pr_err("irq type 0x%04x is not supported\n", irq_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int i2c_pmic_irq_set_wake(struct irq_data *d, unsigned int on)
+{
+	struct i2c_pmic_periph *periph = irq_data_get_irq_chip_data(d);
+
+	if (on)
+		periph->wake |= d->hwirq & 0xFF;
+	else
+		periph->wake &= ~d->hwirq & 0xFF;
+
+	return 0;
+}
+#else
+#define i2c_pmic_irq_set_wake NULL
+#endif
+
+static struct irq_chip i2c_pmic_irq_chip = {
+	.name			= "i2c_pmic_irq_chip",
+	.irq_bus_lock		= i2c_pmic_irq_bus_lock,
+	.irq_bus_sync_unlock	= i2c_pmic_irq_bus_sync_unlock,
+	.irq_disable		= i2c_pmic_irq_disable,
+	.irq_enable		= i2c_pmic_irq_enable,
+	.irq_set_type		= i2c_pmic_irq_set_type,
+	.irq_set_wake		= i2c_pmic_irq_set_wake,
+};
+
+static struct i2c_pmic_periph *i2c_pmic_find_periph(struct i2c_pmic *chip,
+						    irq_hw_number_t hwirq)
+{
+	int i;
+
+	for (i = 0; i < chip->num_periphs; i++)
+		if (chip->periph[i].addr == (hwirq & 0xFF00))
+			return &chip->periph[i];
+
+	pr_err_ratelimited("Couldn't find periph struct for hwirq 0x%04lx\n",
+			   hwirq);
+	return NULL;
+}
+
+static int i2c_pmic_domain_map(struct irq_domain *d, unsigned int virq,
+			irq_hw_number_t hwirq)
+{
+	struct i2c_pmic *chip = d->host_data;
+	struct i2c_pmic_periph *periph = i2c_pmic_find_periph(chip, hwirq);
+
+	if (!periph)
+		return -ENODEV;
+
+	irq_set_chip_data(virq, periph);
+	irq_set_chip_and_handler(virq, &i2c_pmic_irq_chip, handle_level_irq);
+	irq_set_nested_thread(virq, 1);
+	irq_set_noprobe(virq);
+	return 0;
+}
+
+static int i2c_pmic_domain_xlate(struct irq_domain *d,
+				 struct device_node *ctrlr, const u32 *intspec,
+				 unsigned int intsize, unsigned long *out_hwirq,
+				 unsigned int *out_type)
+{
+	if (intsize != 3)
+		return -EINVAL;
+
+	if (intspec[0] > 0xFF || intspec[1] > 0x7 ||
+					intspec[2] > IRQ_TYPE_SENSE_MASK)
+		return -EINVAL;
+
+	/*
+	 * Interrupt specifiers are triplets
+	 * <peripheral-address, irq-number, IRQ_TYPE_*>
+	 *
+	 * peripheral-address - The base address of the peripheral
+	 * irq-number	      - The zero based bit position of the peripheral's
+	 *			interrupt registers corresponding to the irq
+	 *			where the LSB is 0 and the MSB is 7
+	 * IRQ_TYPE_*	      - Please refer to linux/irq.h
+	 */
+	*out_hwirq = intspec[0] << 8 | BIT(intspec[1]);
+	*out_type = intspec[2] & IRQ_TYPE_SENSE_MASK;
+
+	return 0;
+}
+
+static const struct irq_domain_ops i2c_pmic_domain_ops = {
+	.map	= i2c_pmic_domain_map,
+	.xlate	= i2c_pmic_domain_xlate,
+};
+
+static void i2c_pmic_irq_ack_now(struct i2c_pmic *chip, u16 hwirq)
+{
+	int rc;
+
+	rc = regmap_write(chip->regmap,
+			  (hwirq & 0xFF00) | INT_LATCHED_CLR_OFFSET,
+			  hwirq & 0xFF);
+	if (rc < 0)
+		pr_err_ratelimited("Couldn't ack 0x%04x rc=%d\n", hwirq, rc);
+}
+
+static void i2c_pmic_irq_disable_now(struct i2c_pmic *chip, u16 hwirq)
+{
+	struct i2c_pmic_periph *periph = i2c_pmic_find_periph(chip, hwirq);
+	int rc;
+
+	if (!periph)
+		return;
+
+	mutex_lock(&periph->lock);
+	periph->cached[IRQ_EN_SET] &= ~hwirq & 0xFF;
+
+	rc = regmap_write(chip->regmap,
+			  (hwirq & 0xFF00) | INT_EN_CLR_OFFSET,
+			  hwirq & 0xFF);
+	if (rc < 0) {
+		pr_err_ratelimited("Couldn't disable irq 0x%04x rc=%d\n",
+				   hwirq, rc);
+		goto unlock;
+	}
+
+	periph->synced[IRQ_EN_SET] = periph->cached[IRQ_EN_SET];
+
+unlock:
+	mutex_unlock(&periph->lock);
+}
+
+static void i2c_pmic_periph_status_handler(struct i2c_pmic *chip,
+					   u16 periph_address, u8 periph_status)
+{
+	unsigned int hwirq, virq;
+	int i;
+
+	while (periph_status) {
+		i = ffs(periph_status) - 1;
+		periph_status &= ~BIT(i);
+		hwirq = periph_address | BIT(i);
+		virq = irq_find_mapping(chip->domain, hwirq);
+		if (virq == 0) {
+			pr_err_ratelimited("Couldn't find mapping; disabling 0x%04x\n",
+					   hwirq);
+			i2c_pmic_irq_disable_now(chip, hwirq);
+			continue;
+		}
+
+		handle_nested_irq(virq);
+		i2c_pmic_irq_ack_now(chip, hwirq);
+	}
+}
+
+static void i2c_pmic_summary_status_handler(struct i2c_pmic *chip,
+					    struct i2c_pmic_periph *periph,
+					    u8 summary_status)
+{
+	unsigned int periph_status;
+	int rc, i;
+
+	while (summary_status) {
+		i = ffs(summary_status) - 1;
+		summary_status &= ~BIT(i);
+
+		rc = regmap_read(chip->regmap,
+				 periph[i].addr | INT_LATCHED_STS_OFFSET,
+				 &periph_status);
+		if (rc < 0) {
+			pr_err_ratelimited("Couldn't read 0x%04x | INT_LATCHED_STS rc=%d\n",
+					   periph[i].addr, rc);
+			continue;
+		}
+
+		i2c_pmic_periph_status_handler(chip, periph[i].addr,
+					       periph_status);
+	}
+}
+
+static irqreturn_t i2c_pmic_irq_handler(int irq, void *dev_id)
+{
+	struct i2c_pmic *chip = dev_id;
+	struct i2c_pmic_periph *periph;
+	unsigned int summary_status;
+	int rc, i;
+
+	mutex_lock(&chip->irq_complete);
+	chip->irq_waiting = true;
+	if (!chip->resume_completed) {
+		pr_debug("IRQ triggered before device-resume\n");
+		disable_irq_nosync(irq);
+		mutex_unlock(&chip->irq_complete);
+		return IRQ_HANDLED;
+	}
+	chip->irq_waiting = false;
+
+	for (i = 0; i < DIV_ROUND_UP(chip->num_periphs, BITS_PER_BYTE); i++) {
+		rc = regmap_read(chip->regmap, I2C_INTR_STATUS_BASE + i,
+				&summary_status);
+		if (rc < 0) {
+			pr_err_ratelimited("Couldn't read I2C_INTR_STATUS%d rc=%d\n",
+					   i, rc);
+			continue;
+		}
+
+		if (summary_status == 0)
+			continue;
+
+		periph = &chip->periph[i * 8];
+		i2c_pmic_summary_status_handler(chip, periph, summary_status);
+	}
+
+	mutex_unlock(&chip->irq_complete);
+
+	return IRQ_HANDLED;
+}
+
+static int i2c_pmic_parse_dt(struct i2c_pmic *chip)
+{
+	struct device_node *node = chip->dev->of_node;
+	int rc, i;
+	u32 temp;
+
+	if (!node) {
+		pr_err("missing device tree\n");
+		return -EINVAL;
+	}
+
+	chip->num_periphs = of_property_count_u32_elems(node,
+							"qcom,periph-map");
+	if (chip->num_periphs < 0) {
+		pr_err("missing qcom,periph-map property rc=%d\n",
+			chip->num_periphs);
+		return chip->num_periphs;
+	}
+
+	if (chip->num_periphs == 0) {
+		pr_err("qcom,periph-map must contain at least one address\n");
+		return -EINVAL;
+	}
+
+	chip->periph = devm_kcalloc(chip->dev, chip->num_periphs,
+				     sizeof(*chip->periph), GFP_KERNEL);
+	if (!chip->periph)
+		return -ENOMEM;
+
+	for (i = 0; i < chip->num_periphs; i++) {
+		rc = of_property_read_u32_index(node, "qcom,periph-map",
+						i, &temp);
+		if (rc < 0) {
+			pr_err("Couldn't read qcom,periph-map[%d] rc=%d\n",
+			       i, rc);
+			return rc;
+		}
+
+		chip->periph[i].addr = (u16)(temp << 8);
+		chip->periph[i].data = chip;
+		mutex_init(&chip->periph[i].lock);
+	}
+
+	of_property_read_string(node, "pinctrl-names", &chip->pinctrl_name);
+
+	chip->toggle_stat = of_property_read_bool(node,
+				"qcom,enable-toggle-stat");
+
+	return rc;
+}
+
+#define MAX_I2C_RETRIES	3
+static int i2c_pmic_read(struct regmap *map, unsigned int reg, void *val,
+			size_t val_count)
+{
+	int rc, retries = 0;
+
+	do {
+		rc = regmap_bulk_read(map, reg, val, val_count);
+	} while (rc == -ENOTCONN && retries++ < MAX_I2C_RETRIES);
+
+	if (retries > 1)
+		pr_err("i2c_pmic_read failed for %d retries, rc = %d\n",
+			retries - 1, rc);
+
+	return rc;
+}
+
+static int i2c_pmic_determine_initial_status(struct i2c_pmic *chip)
+{
+	int rc, i;
+
+	for (i = 0; i < chip->num_periphs; i++) {
+		rc = i2c_pmic_read(chip->regmap,
+				chip->periph[i].addr | INT_SET_TYPE_OFFSET,
+				chip->periph[i].cached, IRQ_MAX_REGS);
+		if (rc < 0) {
+			pr_err("Couldn't read irq data rc=%d\n", rc);
+			return rc;
+		}
+
+		memcpy(chip->periph[i].synced, chip->periph[i].cached,
+		       IRQ_MAX_REGS * sizeof(*chip->periph[i].synced));
+	}
+
+	return 0;
+}
+
+#define INT_TEST_OFFSET			0xE0
+#define INT_TEST_MODE_EN_BIT		BIT(7)
+#define INT_TEST_VAL_OFFSET		0xE1
+#define INT_0_BIT			BIT(0)
+static int i2c_pmic_toggle_stat(struct i2c_pmic *chip)
+{
+	int rc = 0, i;
+
+	if (!chip->toggle_stat || !chip->num_periphs)
+		return 0;
+
+	rc = regmap_write(chip->regmap,
+				chip->periph[0].addr | INT_EN_SET_OFFSET,
+				INT_0_BIT);
+	if (rc < 0) {
+		pr_err("Couldn't write to int_en_set rc=%d\n", rc);
+		return rc;
+	}
+
+	rc = regmap_write(chip->regmap, chip->periph[0].addr | INT_TEST_OFFSET,
+				INT_TEST_MODE_EN_BIT);
+	if (rc < 0) {
+		pr_err("Couldn't write to int_test rc=%d\n", rc);
+		return rc;
+	}
+
+	for (i = 0; i < 5; i++) {
+		rc = regmap_write(chip->regmap,
+				chip->periph[0].addr | INT_TEST_VAL_OFFSET,
+				INT_0_BIT);
+		if (rc < 0) {
+			pr_err("Couldn't write to int_test_val rc=%d\n", rc);
+			goto exit;
+		}
+
+		usleep_range(5000, 5500);
+
+		rc = regmap_write(chip->regmap,
+				chip->periph[0].addr | INT_TEST_VAL_OFFSET,
+				0);
+		if (rc < 0) {
+			pr_err("Couldn't write to int_test_val rc=%d\n", rc);
+			goto exit;
+		}
+
+		rc = regmap_write(chip->regmap,
+				chip->periph[0].addr | INT_LATCHED_CLR_OFFSET,
+				INT_0_BIT);
+		if (rc < 0) {
+			pr_err("Couldn't write to int_latched_clr rc=%d\n", rc);
+			goto exit;
+		}
+
+		usleep_range(5000, 5500);
+	}
+exit:
+	regmap_write(chip->regmap, chip->periph[0].addr | INT_TEST_OFFSET, 0);
+	regmap_write(chip->regmap, chip->periph[0].addr | INT_EN_CLR_OFFSET,
+							INT_0_BIT);
+
+	return rc;
+}
+
+static struct regmap_config i2c_pmic_regmap_config = {
+	.reg_bits	= 16,
+	.val_bits	= 8,
+	.max_register	= 0xFFFF,
+};
+
+static int i2c_pmic_probe(struct i2c_client *client)
+{
+	struct i2c_pmic *chip;
+	int rc = 0;
+
+	chip = devm_kzalloc(&client->dev, sizeof(*chip), GFP_KERNEL);
+	if (!chip)
+		return -ENOMEM;
+
+	chip->dev = &client->dev;
+	chip->regmap = devm_regmap_init_i2c(client, &i2c_pmic_regmap_config);
+	if (!chip->regmap)
+		return -ENODEV;
+
+	i2c_set_clientdata(client, chip);
+	chip->summary_irq = -EINVAL;
+	if (!of_property_read_bool(chip->dev->of_node, "interrupt-controller"))
+		goto probe_children;
+
+	chip->domain = irq_domain_add_tree(client->dev.of_node,
+					   &i2c_pmic_domain_ops, chip);
+	if (!chip->domain) {
+		rc = -ENOMEM;
+		goto cleanup;
+	}
+
+	rc = i2c_pmic_parse_dt(chip);
+	if (rc < 0) {
+		pr_err("Couldn't parse device tree rc=%d\n", rc);
+		goto cleanup;
+	}
+
+	rc = i2c_pmic_determine_initial_status(chip);
+	if (rc < 0) {
+		pr_err("Couldn't determine initial status rc=%d\n", rc);
+		goto cleanup;
+	}
+
+	if (chip->pinctrl_name) {
+		chip->pinctrl = devm_pinctrl_get_select(chip->dev,
+							chip->pinctrl_name);
+		if (IS_ERR(chip->pinctrl)) {
+			pr_err("Couldn't select %s pinctrl rc=%ld\n",
+				chip->pinctrl_name, PTR_ERR(chip->pinctrl));
+			rc = PTR_ERR(chip->pinctrl);
+			goto cleanup;
+		}
+	}
+
+	chip->resume_completed = true;
+	mutex_init(&chip->irq_complete);
+
+	rc = i2c_pmic_toggle_stat(chip);
+	if (rc < 0) {
+		pr_err("Couldn't toggle stat rc=%d\n", rc);
+		goto cleanup;
+	}
+
+	rc = devm_request_threaded_irq(&client->dev, client->irq, NULL,
+				       i2c_pmic_irq_handler,
+				       IRQF_ONESHOT | IRQF_SHARED,
+				       "i2c_pmic_stat_irq", chip);
+	if (rc < 0) {
+		pr_err("Couldn't request irq %d rc=%d\n", client->irq, rc);
+		goto cleanup;
+	}
+
+	chip->summary_irq = client->irq;
+	enable_irq_wake(client->irq);
+
+probe_children:
+	of_platform_populate(chip->dev->of_node, NULL, NULL, chip->dev);
+	pr_info("I2C PMIC probe successful\n");
+	return rc;
+
+cleanup:
+	if (chip->domain)
+		irq_domain_remove(chip->domain);
+	i2c_set_clientdata(client, NULL);
+	return rc;
+}
+
+static void i2c_pmic_remove(struct i2c_client *client)
+{
+	struct i2c_pmic *chip = i2c_get_clientdata(client);
+
+	of_platform_depopulate(chip->dev);
+	if (chip->domain)
+		irq_domain_remove(chip->domain);
+	i2c_set_clientdata(client, NULL);
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int i2c_pmic_suspend_noirq(struct device *dev)
+{
+	struct i2c_pmic *chip = dev_get_drvdata(dev);
+
+	if (chip->irq_waiting) {
+		pr_err_ratelimited("Aborting suspend, an interrupt was detected while suspending\n");
+		return -EBUSY;
+	}
+	return 0;
+}
+
+static int i2c_pmic_suspend(struct device *dev)
+{
+	struct i2c_pmic *chip = dev_get_drvdata(dev);
+	struct i2c_pmic_periph *periph;
+	int rc = 0, i;
+
+	if (chip->summary_irq < 0)
+		return 0;
+
+	for (i = 0; i < chip->num_periphs; i++) {
+		periph = &chip->periph[i];
+
+		rc = regmap_write(chip->regmap,
+				  periph->addr | INT_EN_CLR_OFFSET, 0xFF);
+		if (rc < 0) {
+			pr_err_ratelimited("Couldn't clear 0x%04x irqs rc=%d\n",
+				periph->addr, rc);
+			continue;
+		}
+
+		rc = regmap_write(chip->regmap,
+				  periph->addr | INT_EN_SET_OFFSET,
+				  periph->wake);
+		if (rc < 0)
+			pr_err_ratelimited("Couldn't enable 0x%04x wake irqs 0x%02x rc=%d\n",
+			       periph->addr, periph->wake, rc);
+	}
+	if (!rc) {
+		mutex_lock(&chip->irq_complete);
+		chip->resume_completed = false;
+		mutex_unlock(&chip->irq_complete);
+	}
+
+	return rc;
+}
+
+static int i2c_pmic_resume(struct device *dev)
+{
+	struct i2c_pmic *chip = dev_get_drvdata(dev);
+	struct i2c_pmic_periph *periph;
+	int rc = 0, i;
+
+	if (chip->summary_irq < 0)
+		return 0;
+
+	for (i = 0; i < chip->num_periphs; i++) {
+		periph = &chip->periph[i];
+
+		rc = regmap_write(chip->regmap,
+				  periph->addr | INT_EN_CLR_OFFSET, 0xFF);
+		if (rc < 0) {
+			pr_err("Couldn't clear 0x%04x irqs rc=%d\n",
+				periph->addr, rc);
+			continue;
+		}
+
+		rc = regmap_write(chip->regmap,
+				  periph->addr | INT_EN_SET_OFFSET,
+				  periph->synced[IRQ_EN_SET]);
+		if (rc < 0)
+			pr_err("Couldn't restore 0x%04x synced irqs 0x%02x rc=%d\n",
+			       periph->addr, periph->synced[IRQ_EN_SET], rc);
+	}
+
+	mutex_lock(&chip->irq_complete);
+	chip->resume_completed = true;
+	if (chip->irq_waiting) {
+		mutex_unlock(&chip->irq_complete);
+		/* irq was pending, call the handler */
+		i2c_pmic_irq_handler(chip->summary_irq, chip);
+		enable_irq(chip->summary_irq);
+	} else {
+		mutex_unlock(&chip->irq_complete);
+	}
+
+	return rc;
+}
+#else
+static int i2c_pmic_suspend(struct device *dev)
+{
+	return 0;
+}
+static int i2c_pmic_resume(struct device *dev)
+{
+	return 0;
+}
+static int i2c_pmic_suspend_noirq(struct device *dev)
+{
+	return 0
+}
+#endif
+static const struct dev_pm_ops i2c_pmic_pm_ops = {
+	.suspend	= i2c_pmic_suspend,
+	.suspend_noirq	= i2c_pmic_suspend_noirq,
+	.resume		= i2c_pmic_resume,
+};
+
+static const struct of_device_id i2c_pmic_match_table[] = {
+	{ .compatible = "qcom,i2c-pmic", },
+	{ },
+};
+
+static const struct i2c_device_id i2c_pmic_id[] = {
+	{ "i2c-pmic", 0 },
+	{ },
+};
+MODULE_DEVICE_TABLE(i2c, i2c_pmic_id);
+
+static struct i2c_driver i2c_pmic_driver = {
+	.driver		= {
+		.name		= "i2c_pmic",
+		.pm		= &i2c_pmic_pm_ops,
+		.of_match_table	= i2c_pmic_match_table,
+	},
+	.probe		= i2c_pmic_probe,
+	.remove		= i2c_pmic_remove,
+	.id_table	= i2c_pmic_id,
+};
+
+module_i2c_driver(i2c_pmic_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("i2c:i2c_pmic");
--- linux-qcom-6.8.0.orig/drivers/mfd/rsmu_core.c
+++ linux-qcom-6.8.0/drivers/mfd/rsmu_core.c
@@ -78,11 +78,13 @@
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(rsmu_core_init);
 
 void rsmu_core_exit(struct rsmu_ddata *rsmu)
 {
 	mutex_destroy(&rsmu->lock);
 }
+EXPORT_SYMBOL_GPL(rsmu_core_exit);
 
 MODULE_DESCRIPTION("Renesas SMU core driver");
 MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/mfd/rt5033.c
+++ linux-qcom-6.8.0/drivers/mfd/rt5033.c
@@ -81,8 +81,8 @@
 	chip_rev = dev_id & RT5033_CHIP_REV_MASK;
 	dev_info(&i2c->dev, "Device found (rev. %d)\n", chip_rev);
 
-	ret = regmap_add_irq_chip(rt5033->regmap, rt5033->irq,
-			IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+	ret = devm_regmap_add_irq_chip(rt5033->dev, rt5033->regmap,
+			rt5033->irq, IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
 			0, &rt5033_irq_chip, &rt5033->irq_data);
 	if (ret) {
 		dev_err(&i2c->dev, "Failed to request IRQ %d: %d\n",
--- linux-qcom-6.8.0.orig/drivers/mfd/syscon.c
+++ linux-qcom-6.8.0/drivers/mfd/syscon.c
@@ -238,7 +238,9 @@
 		return ERR_PTR(-ENODEV);
 
 	regmap = syscon_node_to_regmap(syscon_np);
-	of_node_put(syscon_np);
+
+	if (property)
+		of_node_put(syscon_np);
 
 	return regmap;
 }
--- linux-qcom-6.8.0.orig/drivers/mfd/tps65010.c
+++ linux-qcom-6.8.0/drivers/mfd/tps65010.c
@@ -544,17 +544,13 @@
 	 */
 	if (client->irq > 0) {
 		status = request_irq(client->irq, tps65010_irq,
-				     IRQF_TRIGGER_FALLING, DRIVER_NAME, tps);
+				     IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
+				     DRIVER_NAME, tps);
 		if (status < 0) {
 			dev_dbg(&client->dev, "can't get IRQ %d, err %d\n",
 					client->irq, status);
 			return status;
 		}
-		/* annoying race here, ideally we'd have an option
-		 * to claim the irq now and enable it later.
-		 * FIXME genirq IRQF_NOAUTOEN now solves that ...
-		 */
-		disable_irq(client->irq);
 		set_bit(FLAG_IRQ_ENABLE, &tps->flags);
 	} else
 		dev_warn(&client->dev, "IRQ not configured!\n");
--- linux-qcom-6.8.0.orig/drivers/misc/Kconfig
+++ linux-qcom-6.8.0/drivers/misc/Kconfig
@@ -276,6 +276,14 @@
 	  to maintain PMIC register and RTC state in the absence of
 	  external power.
 
+config QCOM_DCC
+	tristate "Qualcomm Technologies, Inc. Data Capture and Compare (DCC) engine driver"
+	depends on ARCH_QCOM || COMPILE_TEST
+	help
+	  This option enables the driver for the Data Capture and Compare engine. DCC
+	  driver provides interfaces to configure DCC block and read back the captured
+	  data from the DCC's internal SRAM. The module name for this is qcom-dcc.
+
 config QCOM_FASTRPC
 	tristate "Qualcomm FastRPC"
 	depends on ARCH_QCOM || COMPILE_TEST
--- linux-qcom-6.8.0.orig/drivers/misc/Makefile
+++ linux-qcom-6.8.0/drivers/misc/Makefile
@@ -16,6 +16,7 @@
 obj-$(CONFIG_TIFM_7XX1)       	+= tifm_7xx1.o
 obj-$(CONFIG_PHANTOM)		+= phantom.o
 obj-$(CONFIG_QCOM_COINCELL)	+= qcom-coincell.o
+obj-$(CONFIG_QCOM_DCC)		+= qcom-dcc.o
 obj-$(CONFIG_QCOM_FASTRPC)	+= fastrpc.o
 obj-$(CONFIG_SENSORS_BH1770)	+= bh1770glc.o
 obj-$(CONFIG_SENSORS_APDS990X)	+= apds990x.o
--- linux-qcom-6.8.0.orig/drivers/misc/apds990x.c
+++ linux-qcom-6.8.0/drivers/misc/apds990x.c
@@ -1147,7 +1147,7 @@
 		err = chip->pdata->setup_resources();
 		if (err) {
 			err = -EINVAL;
-			goto fail3;
+			goto fail4;
 		}
 	}
 
@@ -1155,7 +1155,7 @@
 				apds990x_attribute_group);
 	if (err < 0) {
 		dev_err(&chip->client->dev, "Sysfs registration failed\n");
-		goto fail4;
+		goto fail5;
 	}
 
 	err = request_threaded_irq(client->irq, NULL,
@@ -1166,15 +1166,17 @@
 	if (err) {
 		dev_err(&client->dev, "could not get IRQ %d\n",
 			client->irq);
-		goto fail5;
+		goto fail6;
 	}
 	return err;
-fail5:
+fail6:
 	sysfs_remove_group(&chip->client->dev.kobj,
 			&apds990x_attribute_group[0]);
-fail4:
+fail5:
 	if (chip->pdata && chip->pdata->release_resources)
 		chip->pdata->release_resources();
+fail4:
+	pm_runtime_disable(&client->dev);
 fail3:
 	regulator_bulk_disable(ARRAY_SIZE(chip->regs), chip->regs);
 fail2:
--- linux-qcom-6.8.0.orig/drivers/misc/cardreader/rtsx_pcr.c
+++ linux-qcom-6.8.0/drivers/misc/cardreader/rtsx_pcr.c
@@ -1002,7 +1002,7 @@
 		} else {
 			pcr->card_removed |= SD_EXIST;
 			pcr->card_inserted &= ~SD_EXIST;
-			if (PCI_PID(pcr) == PID_5261) {
+			if ((PCI_PID(pcr) == PID_5261) || (PCI_PID(pcr) == PID_5264)) {
 				rtsx_pci_write_register(pcr, RTS5261_FW_STATUS,
 					RTS5261_EXPRESS_LINK_FAIL_MASK, 0);
 				pcr->extra_caps |= EXTRA_CAPS_SD_EXPRESS;
--- linux-qcom-6.8.0.orig/drivers/misc/eeprom/at24.c
+++ linux-qcom-6.8.0/drivers/misc/eeprom/at24.c
@@ -758,15 +758,6 @@
 	}
 	pm_runtime_enable(dev);
 
-	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
-	if (IS_ERR(at24->nvmem)) {
-		pm_runtime_disable(dev);
-		if (!pm_runtime_status_suspended(dev))
-			regulator_disable(at24->vcc_reg);
-		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
-				     "failed to register nvmem\n");
-	}
-
 	/*
 	 * Perform a one-byte test read to verify that the chip is functional,
 	 * unless powering on the device is to be avoided during probe (i.e.
@@ -782,6 +773,15 @@
 		}
 	}
 
+	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
+	if (IS_ERR(at24->nvmem)) {
+		pm_runtime_disable(dev);
+		if (!pm_runtime_status_suspended(dev))
+			regulator_disable(at24->vcc_reg);
+		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
+				     "failed to register nvmem\n");
+	}
+
 	/* If this a SPD EEPROM, probe for DDR3 thermal sensor */
 	if (cdata == &at24_data_spd)
 		at24_probe_temp_sensor(client);
--- linux-qcom-6.8.0.orig/drivers/misc/eeprom/digsy_mtc_eeprom.c
+++ linux-qcom-6.8.0/drivers/misc/eeprom/digsy_mtc_eeprom.c
@@ -42,7 +42,7 @@
 }
 
 struct eeprom_93xx46_platform_data digsy_mtc_eeprom_data = {
-	.flags		= EE_ADDR8,
+	.flags		= EE_ADDR8 | EE_SIZE1K,
 	.prepare	= digsy_mtc_op_prepare,
 	.finish		= digsy_mtc_op_finish,
 };
--- linux-qcom-6.8.0.orig/drivers/misc/eeprom/ee1004.c
+++ linux-qcom-6.8.0/drivers/misc/eeprom/ee1004.c
@@ -185,6 +185,8 @@
 static void ee1004_probe_temp_sensor(struct i2c_client *client)
 {
 	struct i2c_board_info info = { .type = "jc42" };
+	unsigned short addr = 0x18 | (client->addr & 7);
+	unsigned short addr_list[] = { addr, I2C_CLIENT_END };
 	u8 byte14;
 	int ret;
 
@@ -193,9 +195,7 @@
 	if (ret != 1 || !(byte14 & BIT(7)))
 		return;
 
-	info.addr = 0x18 | (client->addr & 7);
-
-	i2c_new_client_device(client->adapter, &info);
+	i2c_new_scanned_device(client->adapter, &info, addr_list, NULL);
 }
 
 static void ee1004_cleanup(int idx, struct ee1004_bus_data *bd)
--- linux-qcom-6.8.0.orig/drivers/misc/eeprom/eeprom_93cx6.c
+++ linux-qcom-6.8.0/drivers/misc/eeprom/eeprom_93cx6.c
@@ -186,6 +186,11 @@
 	eeprom_93cx6_write_bits(eeprom, command,
 		PCI_EEPROM_WIDTH_OPCODE + eeprom->width);
 
+	if (has_quirk_extra_read_cycle(eeprom)) {
+		eeprom_93cx6_pulse_high(eeprom);
+		eeprom_93cx6_pulse_low(eeprom);
+	}
+
 	/*
 	 * Read the requested 16 bits.
 	 */
@@ -252,6 +257,11 @@
 	eeprom_93cx6_write_bits(eeprom, command,
 		PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1);
 
+	if (has_quirk_extra_read_cycle(eeprom)) {
+		eeprom_93cx6_pulse_high(eeprom);
+		eeprom_93cx6_pulse_low(eeprom);
+	}
+
 	/*
 	 * Read the requested 8 bits.
 	 */
--- linux-qcom-6.8.0.orig/drivers/misc/fastrpc.c
+++ linux-qcom-6.8.0/drivers/misc/fastrpc.c
@@ -19,16 +19,22 @@
 #include <linux/rpmsg.h>
 #include <linux/scatterlist.h>
 #include <linux/slab.h>
+#include <linux/delay.h>
 #include <linux/firmware/qcom/qcom_scm.h>
 #include <uapi/misc/fastrpc.h>
 #include <linux/of_reserved_mem.h>
+#include <linux/soc/qcom/pdr.h>
+
+#define FASTRPC_IOCTL_INVOKEV2		_IOWR('R', 14, struct fastrpc_invoke_v2)
 
 #define ADSP_DOMAIN_ID (0)
 #define MDSP_DOMAIN_ID (1)
 #define SDSP_DOMAIN_ID (2)
 #define CDSP_DOMAIN_ID (3)
-#define FASTRPC_DEV_MAX		4 /* adsp, mdsp, slpi, cdsp*/
+#define CDSP1_DOMAIN_ID (4)
+#define FASTRPC_DEV_MAX		5 /* adsp, mdsp, slpi, cdsp, cdsp1 */
 #define FASTRPC_MAX_SESSIONS	14
+#define FASTRPC_MAX_SPD		4
 #define FASTRPC_MAX_VMIDS	16
 #define FASTRPC_ALIGN		128
 #define FASTRPC_MAX_FDLIST	16
@@ -37,8 +43,10 @@
 #define FASTRPC_CTX_MAX (256)
 #define FASTRPC_INIT_HANDLE	1
 #define FASTRPC_DSP_UTILITIES_HANDLE	2
-#define FASTRPC_CTXID_MASK (0xFF0)
-#define INIT_FILELEN_MAX (2 * 1024 * 1024)
+#define FASTRPC_MAX_STATIC_HANDLE (20)
+#define FASTRPC_CTXID_MASK (0xFF0000)
+#define FASTRPC_CLIENTID_MASK (16)
+#define INIT_FILELEN_MAX (5 * 1024 * 1024)
 #define INIT_FILE_NAMELEN_MAX (128)
 #define FASTRPC_DEVICE_NAME	"fastrpc"
 
@@ -98,6 +106,9 @@
 #define FASTRPC_RMID_INIT_MEM_MAP      10
 #define FASTRPC_RMID_INIT_MEM_UNMAP    11
 
+/* Fastrpc attribute for no mapping of fd  */
+#define FASTRPC_ATTR_NOMAP (16)
+
 /* Protection Domain(PD) ids */
 #define ROOT_PD		(0)
 #define USER_PD		(1)
@@ -105,8 +116,46 @@
 
 #define miscdev_to_fdevice(d) container_of(d, struct fastrpc_device, miscdev)
 
+#define AUDIO_PDR_SERVICE_LOCATION_CLIENT_NAME   "audio_pdr_adsp"
+#define AUDIO_PDR_ADSP_SERVICE_NAME              "avs/audio"
+#define ADSP_AUDIOPD_NAME                        "msm/adsp/audio_pd"
+
+#define SENSORS_PDR_ADSP_SERVICE_LOCATION_CLIENT_NAME   "sensors_pdr_adsp"
+#define SENSORS_PDR_ADSP_SERVICE_NAME              "tms/servreg"
+#define ADSP_SENSORPD_NAME                       "msm/adsp/sensor_pd"
+
+#define SENSORS_PDR_SLPI_SERVICE_LOCATION_CLIENT_NAME "sensors_pdr_slpi"
+#define SENSORS_PDR_SLPI_SERVICE_NAME            SENSORS_PDR_ADSP_SERVICE_NAME
+#define SLPI_SENSORPD_NAME                       "msm/slpi/sensor_pd"
+
+#define FASTRPC_KERNEL_PERF_LIST (PERF_KEY_MAX)
+#define FASTRPC_DSP_PERF_LIST 12
+
+/* Poll response number from remote processor for call completion */
+#define FASTRPC_POLL_RESPONSE (0xdecaf)
+/* timeout in us for polling until memory barrier */
+#define FASTRPC_POLL_TIME_MEM_UPDATE (500)
+
+/* Response types supported for RPC calls */
+enum fastrpc_response_flags {
+	/* normal job completion glink response */
+	NORMAL_RESPONSE = 0,
+	/* process updates poll memory instead of glink response */
+	POLL_MODE = 1,
+};
+
 static const char *domains[FASTRPC_DEV_MAX] = { "adsp", "mdsp",
-						"sdsp", "cdsp"};
+						"sdsp", "cdsp", "cdsp1" };
+
+struct fastrpc_invoke_v2 {
+	struct fastrpc_invoke inv;
+	__u64 crc;
+	__u64 perf_kernel;
+	__u64 perf_dsp;
+	__u64 poll_timeout;
+	__u32 reserved[18];
+};
+
 struct fastrpc_phy_page {
 	u64 addr;		/* physical address */
 	u64 size;		/* size of contiguous region */
@@ -196,6 +245,7 @@
 	struct dma_buf *dmabuf;
 	struct device *dev;
 	void *virt;
+	u32 flag;
 	u64 phys;
 	u64 size;
 	/* Lock for dma buf attachments */
@@ -228,6 +278,18 @@
 	struct kref refcount;
 };
 
+struct fastrpc_perf {
+	u64 count;
+	u64 flush;
+	u64 map;
+	u64 copy;
+	u64 link;
+	u64 getargs;
+	u64 putargs;
+	u64 invargs;
+	u64 invoke;
+};
+
 struct fastrpc_invoke_ctx {
 	int nscalars;
 	int nbufs;
@@ -236,12 +298,19 @@
 	int tgid;
 	u32 sc;
 	u32 *crc;
+	u64 *perf_kernel;
+	u64 *perf_dsp;
 	u64 ctxid;
 	u64 msg_sz;
+	/* Threads poll for specified timeout and fall back to glink wait */
+	u64 poll_timeout;
+	/* work done status flag */
+	bool is_work_done;
+	/* response flags from remote processor */
+	enum fastrpc_response_flags rsp_flags;
 	struct kref refcount;
 	struct list_head node; /* list of ctxs */
 	struct completion work;
-	struct work_struct put_work;
 	struct fastrpc_msg msg;
 	struct fastrpc_user *fl;
 	union fastrpc_remote_arg *rpra;
@@ -250,6 +319,7 @@
 	struct fastrpc_invoke_args *args;
 	struct fastrpc_buf_overlap *olaps;
 	struct fastrpc_channel_ctx *cctx;
+	struct fastrpc_perf *perf;
 };
 
 struct fastrpc_session_ctx {
@@ -257,6 +327,18 @@
 	int sid;
 	bool used;
 	bool valid;
+	struct mutex map_mutex;
+};
+
+struct fastrpc_static_pd {
+	char *servloc_name;
+	char *spdname;
+	void *pdrhandle;
+	u64 pdrcount;
+	u64 prevpdrcount;
+	atomic_t ispdup;
+	int domain;
+	struct fastrpc_channel_ctx *cctx;
 };
 
 struct fastrpc_channel_ctx {
@@ -266,17 +348,18 @@
 	struct qcom_scm_vmperm vmperms[FASTRPC_MAX_VMIDS];
 	struct rpmsg_device *rpdev;
 	struct fastrpc_session_ctx session[FASTRPC_MAX_SESSIONS];
+	struct fastrpc_static_pd spd[FASTRPC_MAX_SPD];
 	spinlock_t lock;
 	struct idr ctx_idr;
 	struct list_head users;
 	struct kref refcount;
 	/* Flag if dsp attributes are cached */
 	bool valid_attributes;
+	bool staticpd_status;
 	u32 dsp_attributes[FASTRPC_MAX_DSP_ATTRIBUTES];
 	struct fastrpc_device *secure_fdevice;
 	struct fastrpc_device *fdevice;
-	struct fastrpc_buf *remote_heap;
-	struct list_head invoke_interrupted_mmaps;
+	struct list_head rhmaps;
 	bool secure;
 	bool unsigned_support;
 	u64 dma_mask;
@@ -298,42 +381,100 @@
 	struct fastrpc_session_ctx *sctx;
 	struct fastrpc_buf *init_mem;
 
-	int tgid;
+	int client_id;
 	int pd;
 	bool is_secure_dev;
+	bool is_unsigned_pd;
+	char *servloc_name;
 	/* Lock for lists */
 	spinlock_t lock;
 	/* lock for allocations */
 	struct mutex mutex;
 };
 
+enum fastrpc_perfkeys {
+	PERF_COUNT = 0,
+	PERF_FLUSH = 1,
+	PERF_MAP = 2,
+	PERF_COPY = 3,
+	PERF_LINK = 4,
+	PERF_GETARGS = 5,
+	PERF_PUTARGS = 6,
+	PERF_INVARGS = 7,
+	PERF_INVOKE = 8,
+	PERF_KEY_MAX = 9,
+};
+
+#define PERF_END ((void)0)
+
+#define PERF(enb, cnt, ff) \
+	{\
+		struct timespec64 startT = {0};\
+		u64 *counter = cnt;\
+		if (enb && counter) {\
+			ktime_get_boottime_ts64(&startT);\
+		} \
+		ff ;\
+		if (enb && counter) {\
+			*counter += getnstimediff(&startT);\
+		} \
+	}
+
+#define GET_COUNTER(perf_ptr, offset)  \
+	(perf_ptr != NULL ?\
+		(((offset >= 0) && (offset < PERF_KEY_MAX)) ?\
+			(u64 *)(perf_ptr + offset)\
+				: (u64 *)NULL) : (u64 *)NULL)
+
+static inline int64_t getnstimediff(struct timespec64 *start)
+{
+	int64_t ns;
+	struct timespec64 ts, b;
+
+	ktime_get_boottime_ts64(&ts);
+	b = timespec64_sub(ts, *start);
+	ns = timespec64_to_ns(&b);
+	return ns;
+}
+
 static void fastrpc_free_map(struct kref *ref)
 {
 	struct fastrpc_map *map;
+	struct fastrpc_user *fl;
 
 	map = container_of(ref, struct fastrpc_map, refcount);
 
+	fl = map->fl;
+	if (!fl)
+		return;
+
 	if (map->table) {
 		if (map->attr & FASTRPC_ATTR_SECUREMAP) {
 			struct qcom_scm_vmperm perm;
-			int vmid = map->fl->cctx->vmperms[0].vmid;
+			int vmid = fl->cctx->vmperms[0].vmid;
 			u64 src_perms = BIT(QCOM_SCM_VMID_HLOS) | BIT(vmid);
 			int err = 0;
 
 			perm.vmid = QCOM_SCM_VMID_HLOS;
 			perm.perm = QCOM_SCM_PERM_RWX;
-			err = qcom_scm_assign_mem(map->phys, map->size,
+			err = qcom_scm_assign_mem(map->phys, map->len,
 				&src_perms, &perm, 1);
 			if (err) {
-				dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d",
-						map->phys, map->size, err);
+				dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n",
+						map->phys, map->len, err);
 				return;
 			}
 		}
+		mutex_lock(&fl->sctx->map_mutex);
+		if (!fl->sctx->dev) {
+			mutex_unlock(&fl->sctx->map_mutex);
+			return;
+		}
 		dma_buf_unmap_attachment_unlocked(map->attach, map->table,
 						  DMA_BIDIRECTIONAL);
 		dma_buf_detach(map->buf, map->attach);
 		dma_buf_put(map->buf);
+		mutex_unlock(&fl->sctx->map_mutex);
 	}
 
 	if (map->fl) {
@@ -362,7 +503,7 @@
 
 
 static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd,
-			    struct fastrpc_map **ppmap, bool take_ref)
+			u64 va, u64 len, struct fastrpc_map **ppmap, bool take_ref)
 {
 	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
@@ -370,7 +511,8 @@
 
 	spin_lock(&fl->lock);
 	list_for_each_entry(map, &fl->maps, node) {
-		if (map->fd != fd)
+		if (map->fd != fd || va < (u64)map->va ||
+				va + len > (u64)map->va + map->size)
 			continue;
 
 		if (take_ref) {
@@ -391,13 +533,26 @@
 	return ret;
 }
 
-static void fastrpc_buf_free(struct fastrpc_buf *buf)
+static void __fastrpc_buf_free(struct fastrpc_buf *buf)
 {
 	dma_free_coherent(buf->dev, buf->size, buf->virt,
 			  FASTRPC_PHYS(buf->phys));
 	kfree(buf);
 }
 
+static void fastrpc_buf_free(struct fastrpc_buf *buf)
+{
+	struct fastrpc_user *fl = buf->fl;
+
+	if (!fl)
+		return;
+
+	mutex_lock(&fl->sctx->map_mutex);
+	if (fl->sctx->dev)
+		__fastrpc_buf_free(buf);
+	mutex_unlock(&fl->sctx->map_mutex);
+}
+
 static int __fastrpc_buf_alloc(struct fastrpc_user *fl, struct device *dev,
 			     u64 size, struct fastrpc_buf **obuf)
 {
@@ -418,8 +573,11 @@
 	buf->dev = dev;
 	buf->raddr = 0;
 
-	buf->virt = dma_alloc_coherent(dev, buf->size, (dma_addr_t *)&buf->phys,
-				       GFP_KERNEL);
+	mutex_lock(&fl->sctx->map_mutex);
+	if (fl->sctx->dev)
+		buf->virt = dma_alloc_coherent(dev, buf->size, (dma_addr_t *)&buf->phys,
+						   GFP_KERNEL);
+	mutex_unlock(&fl->sctx->map_mutex);
 	if (!buf->virt) {
 		mutex_destroy(&buf->lock);
 		kfree(buf);
@@ -460,8 +618,11 @@
 static void fastrpc_channel_ctx_free(struct kref *ref)
 {
 	struct fastrpc_channel_ctx *cctx;
+	int i;
 
 	cctx = container_of(ref, struct fastrpc_channel_ctx, refcount);
+	for (i = 0; i < FASTRPC_MAX_SESSIONS; i++)
+		mutex_destroy(&cctx->session[i].map_mutex);
 
 	kfree(cctx);
 }
@@ -493,9 +654,10 @@
 		fastrpc_buf_free(ctx->buf);
 
 	spin_lock_irqsave(&cctx->lock, flags);
-	idr_remove(&cctx->ctx_idr, ctx->ctxid >> 4);
+	idr_remove(&cctx->ctx_idr, ctx->ctxid >> 16);
 	spin_unlock_irqrestore(&cctx->lock, flags);
 
+	kfree(ctx->perf);
 	kfree(ctx->maps);
 	kfree(ctx->olaps);
 	kfree(ctx);
@@ -503,24 +665,11 @@
 	fastrpc_channel_ctx_put(cctx);
 }
 
-static void fastrpc_context_get(struct fastrpc_invoke_ctx *ctx)
-{
-	kref_get(&ctx->refcount);
-}
-
 static void fastrpc_context_put(struct fastrpc_invoke_ctx *ctx)
 {
 	kref_put(&ctx->refcount, fastrpc_context_free);
 }
 
-static void fastrpc_context_put_wq(struct work_struct *work)
-{
-	struct fastrpc_invoke_ctx *ctx =
-			container_of(work, struct fastrpc_invoke_ctx, put_work);
-
-	fastrpc_context_put(ctx);
-}
-
 #define CMP(aa, bb) ((aa) == (bb) ? 0 : (aa) < (bb) ? -1 : 1)
 static int olaps_cmp(const void *a, const void *b)
 {
@@ -572,13 +721,15 @@
 
 static struct fastrpc_invoke_ctx *fastrpc_context_alloc(
 			struct fastrpc_user *user, u32 kernel, u32 sc,
-			struct fastrpc_invoke_args *args)
+			struct fastrpc_invoke_v2 *inv2)
 {
 	struct fastrpc_channel_ctx *cctx = user->cctx;
 	struct fastrpc_invoke_ctx *ctx = NULL;
+	struct fastrpc_invoke_args *args = NULL;
 	unsigned long flags;
 	int ret;
 
+	args = (struct fastrpc_invoke_args *)inv2->inv.args;
 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 	if (!ctx)
 		return ERR_PTR(-ENOMEM);
@@ -610,13 +761,23 @@
 	/* Released in fastrpc_context_put() */
 	fastrpc_channel_ctx_get(cctx);
 
+	ctx->crc = (u32 *)(uintptr_t)inv2->crc;
+	ctx->perf_dsp = (u64 *)(uintptr_t)inv2->perf_dsp;
+	ctx->perf_kernel = (u64 *)(uintptr_t)inv2->perf_kernel;
+	ctx->poll_timeout = (u64)inv2->poll_timeout;
+	if (ctx->perf_kernel) {
+		ctx->perf = kzalloc(sizeof(*(ctx->perf)), GFP_KERNEL);
+		if (!ctx->perf)
+			return ERR_PTR(-ENOMEM);
+	}
 	ctx->sc = sc;
 	ctx->retval = -1;
 	ctx->pid = current->pid;
-	ctx->tgid = user->tgid;
+	ctx->tgid = user->client_id;
 	ctx->cctx = cctx;
+	ctx->rsp_flags = NORMAL_RESPONSE;
+	ctx->is_work_done = false;
 	init_completion(&ctx->work);
-	INIT_WORK(&ctx->put_work, fastrpc_context_put_wq);
 
 	spin_lock(&user->lock);
 	list_add_tail(&ctx->node, &user->pending);
@@ -629,7 +790,7 @@
 		spin_unlock_irqrestore(&cctx->lock, flags);
 		goto err_idr;
 	}
-	ctx->ctxid = ret << 4;
+	ctx->ctxid = ret << 16;
 	spin_unlock_irqrestore(&cctx->lock, flags);
 
 	kref_init(&ctx->refcount);
@@ -752,14 +913,17 @@
 };
 
 static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
-			      u64 len, u32 attr, struct fastrpc_map **ppmap)
+				u64 va, u64 len, u32 attr,
+				struct fastrpc_map **ppmap, bool take_ref)
 {
 	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
 	struct sg_table *table;
-	int err = 0;
+	struct scatterlist *sgl = NULL;
+	struct device *dev = NULL;
+	int err = 0, sgl_index = 0;
 
-	if (!fastrpc_map_lookup(fl, fd, ppmap, true))
+	if (!fastrpc_map_lookup(fl, fd, va, len, ppmap, take_ref))
 		return 0;
 
 	map = kzalloc(sizeof(*map), GFP_KERNEL);
@@ -777,28 +941,46 @@
 		goto get_err;
 	}
 
-	map->attach = dma_buf_attach(map->buf, sess->dev);
+	if (attr & FASTRPC_ATTR_NOMAP)
+		dev = &fl->cctx->rpdev->dev;
+	else
+		dev = sess->dev;
+
+	mutex_lock(&fl->sctx->map_mutex);
+	if (!fl->sctx->dev) {
+		err = -ENODEV;
+		mutex_unlock(&fl->sctx->map_mutex);
+		goto attach_err;
+	}
+
+	map->attach = dma_buf_attach(map->buf, dev);
 	if (IS_ERR(map->attach)) {
-		dev_err(sess->dev, "Failed to attach dmabuf\n");
+		dev_err(dev, "Failed to attach dmabuf\n");
 		err = PTR_ERR(map->attach);
+		mutex_unlock(&fl->sctx->map_mutex);
 		goto attach_err;
 	}
 
 	table = dma_buf_map_attachment_unlocked(map->attach, DMA_BIDIRECTIONAL);
 	if (IS_ERR(table)) {
 		err = PTR_ERR(table);
+		mutex_unlock(&fl->sctx->map_mutex);
 		goto map_err;
 	}
 	map->table = table;
+	mutex_unlock(&fl->sctx->map_mutex);
 
 	if (attr & FASTRPC_ATTR_SECUREMAP) {
 		map->phys = sg_phys(map->table->sgl);
 	} else {
 		map->phys = sg_dma_address(map->table->sgl);
-		map->phys += ((u64)fl->sctx->sid << 32);
+		if (!(attr & FASTRPC_ATTR_NOMAP))
+			map->phys += ((u64)fl->sctx->sid << 32);
 	}
-	map->size = len;
-	map->va = sg_virt(map->table->sgl);
+	for_each_sg(map->table->sgl, sgl, map->table->nents,
+		sgl_index)
+		map->size += sg_dma_len(sgl);
+	map->va = (void *)(uintptr_t)va;
 	map->len = len;
 
 	if (attr & FASTRPC_ATTR_SECUREMAP) {
@@ -814,10 +996,10 @@
 		dst_perms[1].vmid = fl->cctx->vmperms[0].vmid;
 		dst_perms[1].perm = QCOM_SCM_PERM_RWX;
 		map->attr = attr;
-		err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2);
+		err = qcom_scm_assign_mem(map->phys, (u64)map->len, &src_perms, dst_perms, 2);
 		if (err) {
-			dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d",
-					map->phys, map->size, err);
+			dev_err(dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d\n",
+					map->phys, map->len, err);
 			goto map_err;
 		}
 	}
@@ -873,7 +1055,8 @@
 		sizeof(struct fastrpc_invoke_buf) +
 		sizeof(struct fastrpc_phy_page)) * ctx->nscalars +
 		sizeof(u64) * FASTRPC_MAX_FDLIST +
-		sizeof(u32) * FASTRPC_MAX_CRCLIST;
+		sizeof(u32) * FASTRPC_MAX_CRCLIST +
+		sizeof(u32) + sizeof(u64) * FASTRPC_DSP_PERF_LIST;
 
 	return size;
 }
@@ -905,13 +1088,17 @@
 	int i, err;
 
 	for (i = 0; i < ctx->nscalars; ++i) {
+		bool take_ref = true;
 
 		if (ctx->args[i].fd == 0 || ctx->args[i].fd == -1 ||
 		    ctx->args[i].length == 0)
 			continue;
 
+		if (i >= ctx->nbufs)
+			take_ref = false;
 		err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
-			 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
+			 (u64)ctx->args[i].ptr, ctx->args[i].length,
+			 ctx->args[i].attr, &ctx->maps[i], take_ref);
 		if (err) {
 			dev_err(dev, "Error Creating map %d\n", err);
 			return -EINVAL;
@@ -947,7 +1134,9 @@
 	metalen = fastrpc_get_meta_size(ctx);
 	pkt_size = fastrpc_get_payload_size(ctx, metalen);
 
+	PERF(ctx->perf_kernel, GET_COUNTER((u64 *)ctx->perf, PERF_MAP),
 	err = fastrpc_create_maps(ctx);
+	PERF_END);
 	if (err)
 		return err;
 
@@ -980,6 +1169,7 @@
 			continue;
 
 		if (ctx->maps[i]) {
+			PERF(ctx->perf_kernel, GET_COUNTER((u64 *)ctx->perf, PERF_MAP),
 			struct vm_area_struct *vma = NULL;
 
 			rpra[i].buf.pv = (u64) ctx->args[i].ptr;
@@ -988,7 +1178,7 @@
 			mmap_read_lock(current->mm);
 			vma = find_vma(current->mm, ctx->args[i].ptr);
 			if (vma)
-				pages[i].addr += ctx->args[i].ptr -
+				pages[i].addr += (ctx->args[i].ptr & PAGE_MASK) -
 						 vma->vm_start;
 			mmap_read_unlock(current->mm);
 
@@ -996,9 +1186,9 @@
 			pg_end = ((ctx->args[i].ptr + len - 1) & PAGE_MASK) >>
 				  PAGE_SHIFT;
 			pages[i].size = (pg_end - pg_start + 1) * PAGE_SIZE;
-
+			PERF_END);
 		} else {
-
+			PERF(ctx->perf_kernel, GET_COUNTER((u64 *)ctx->perf, PERF_COPY),
 			if (ctx->olaps[oix].offset == 0) {
 				rlen -= ALIGN(args, FASTRPC_ALIGN) - args;
 				args = ALIGN(args, FASTRPC_ALIGN);
@@ -1015,17 +1205,19 @@
 					(pkt_size - rlen);
 			pages[i].addr = pages[i].addr &	PAGE_MASK;
 
-			pg_start = (args & PAGE_MASK) >> PAGE_SHIFT;
-			pg_end = ((args + len - 1) & PAGE_MASK) >> PAGE_SHIFT;
+			pg_start = (rpra[i].buf.pv & PAGE_MASK) >> PAGE_SHIFT;
+			pg_end = ((rpra[i].buf.pv + len - 1) & PAGE_MASK) >> PAGE_SHIFT;
 			pages[i].size = (pg_end - pg_start + 1) * PAGE_SIZE;
 			args = args + mlen;
 			rlen -= mlen;
+			PERF_END);
 		}
 
 		if (i < inbufs && !ctx->maps[i]) {
 			void *dst = (void *)(uintptr_t)rpra[i].buf.pv;
 			void *src = (void *)(uintptr_t)ctx->args[i].ptr;
 
+			PERF(ctx->perf_kernel, GET_COUNTER((u64 *)ctx->perf, PERF_COPY),
 			if (!kernel) {
 				if (copy_from_user(dst, (void __user *)src,
 						   len)) {
@@ -1035,6 +1227,7 @@
 			} else {
 				memcpy(dst, src, len);
 			}
+			PERF_END);
 		}
 	}
 
@@ -1065,8 +1258,9 @@
 	struct fastrpc_map *mmap = NULL;
 	struct fastrpc_invoke_buf *list;
 	struct fastrpc_phy_page *pages;
-	u64 *fdlist;
-	int i, inbufs, outbufs, handles;
+	u64 *fdlist, *perf_dsp_list;
+	u32 *crclist, *poll;
+	int i, inbufs, outbufs, handles, perferr;
 
 	inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
 	outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
@@ -1074,6 +1268,9 @@
 	list = fastrpc_invoke_buf_start(rpra, ctx->nscalars);
 	pages = fastrpc_phy_page_start(list, ctx->nscalars);
 	fdlist = (uint64_t *)(pages + inbufs + outbufs + handles);
+	crclist = (u32 *)(fdlist + FASTRPC_MAX_FDLIST);
+	poll = (u32 *)(crclist + FASTRPC_MAX_CRCLIST);
+	perf_dsp_list = (u64 *)(poll + 1);
 
 	for (i = inbufs; i < ctx->nbufs; ++i) {
 		if (!ctx->maps[i]) {
@@ -1094,10 +1291,23 @@
 	for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
 		if (!fdlist[i])
 			break;
-		if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false))
+		if (!fastrpc_map_lookup(fl, (int)fdlist[i], 0, 0, &mmap, false))
 			fastrpc_map_put(mmap);
 	}
 
+	if (ctx->crc && crclist && rpra) {
+		if (copy_to_user((void __user *)ctx->crc, crclist,
+				FASTRPC_MAX_CRCLIST * sizeof(u32)))
+			return -EFAULT;
+	}
+
+	if (ctx->perf_dsp && perf_dsp_list) {
+		perferr = copy_to_user((void __user *)ctx->perf_dsp,
+				perf_dsp_list, FASTRPC_DSP_PERF_LIST * sizeof(u64));
+		if (perferr)
+			dev_info(fl->sctx->dev, "Warning: failed to copy perf data %d\n", perferr);
+	}
+
 	return 0;
 }
 
@@ -1111,7 +1321,7 @@
 	int ret;
 
 	cctx = fl->cctx;
-	msg->pid = fl->tgid;
+	msg->pid = fl->client_id;
 	msg->tid = current->pid;
 
 	if (kernel)
@@ -1122,66 +1332,200 @@
 	msg->sc = ctx->sc;
 	msg->addr = ctx->buf ? ctx->buf->phys : 0;
 	msg->size = roundup(ctx->msg_sz, PAGE_SIZE);
-	fastrpc_context_get(ctx);
 
-	ret = rpmsg_send(cctx->rpdev->ept, (void *)msg, sizeof(*msg));
+	if (cctx->rpdev == NULL)
+		return -EPIPE;
 
-	if (ret)
-		fastrpc_context_put(ctx);
+	ret = rpmsg_send(cctx->rpdev->ept, (void *)msg, sizeof(*msg));
 
 	return ret;
 
 }
 
-static int fastrpc_internal_invoke(struct fastrpc_user *fl,  u32 kernel,
-				   u32 handle, u32 sc,
-				   struct fastrpc_invoke_args *args)
+static int fastrpc_get_spd_session(struct fastrpc_channel_ctx *cctx,
+				char *servloc_name)
 {
-	struct fastrpc_invoke_ctx *ctx = NULL;
-	struct fastrpc_buf *buf, *b;
+	int i, session = -1;
 
+	for (i = 0; i < FASTRPC_MAX_SPD ; i++) {
+		if (!cctx->spd[i].servloc_name)
+			continue;
+		if (!strcmp(servloc_name, cctx->spd[i].servloc_name)) {
+			session = i;
+			break;
+		}
+	}
+
+	return session;
+}
+
+static void fastrpc_update_invoke_count(u32 handle, u64 *perf_counter,
+					struct timespec64 *invoket)
+{
+	/* update invoke count for dynamic handles */
+	u64 *invcount, *count;
+
+	if (handle <= FASTRPC_MAX_STATIC_HANDLE)
+		return;
+
+	invcount = GET_COUNTER(perf_counter, PERF_INVOKE);
+	if (invcount)
+		*invcount += getnstimediff(invoket);
+
+	count = GET_COUNTER(perf_counter, PERF_COUNT);
+	if (count)
+		*count++;
+}
+
+static int poll_for_remote_response(struct fastrpc_invoke_ctx *ctx, u64 timeout)
+{
+	int err = -EIO, i, j;
+	u32 sc = ctx->sc;
+	struct fastrpc_invoke_buf *list;
+	struct fastrpc_phy_page *pages;
+	u64 *fdlist = NULL;
+	u32 *crclist = NULL, *poll = NULL;
+	unsigned int inbufs, outbufs, handles;
+
+	/* calculate poll memory location */
+	inbufs = REMOTE_SCALARS_INBUFS(sc);
+	outbufs = REMOTE_SCALARS_OUTBUFS(sc);
+	handles = REMOTE_SCALARS_INHANDLES(sc) + REMOTE_SCALARS_OUTHANDLES(sc);
+	list = fastrpc_invoke_buf_start(ctx->rpra, ctx->nscalars);
+	pages = fastrpc_phy_page_start(list, ctx->nscalars);
+	fdlist = (u64 *)(pages + inbufs + outbufs + handles);
+	crclist = (u32 *)(fdlist + FASTRPC_MAX_FDLIST);
+	poll = (u32 *)(crclist + FASTRPC_MAX_CRCLIST);
+
+	/* poll on memory for DSP response. Return failure on timeout */
+	for (i = 0, j = 0; i < timeout; i++, j++) {
+		if (*poll == FASTRPC_POLL_RESPONSE) {
+			err = 0;
+			ctx->is_work_done = true;
+			ctx->retval = 0;
+			break;
+		}
+		if (j == FASTRPC_POLL_TIME_MEM_UPDATE) {
+			/* make sure that all poll memory writes by DSP are seen by CPU */
+			dma_rmb();
+			j = 0;
+		}
+		udelay(1);
+	}
+	return err;
+}
+
+static inline int fastrpc_wait_for_response(struct fastrpc_invoke_ctx *ctx,
+						u32 kernel)
+{
 	int err = 0;
 
+	if (kernel) {
+		if (!wait_for_completion_timeout(&ctx->work, 10 * HZ))
+			err = -ETIMEDOUT;
+	} else {
+		err = wait_for_completion_interruptible(&ctx->work);
+	}
+
+	return err;
+}
+
+static int fastrpc_wait_for_completion(struct fastrpc_invoke_ctx *ctx,
+										u32 kernel)
+{
+	int err;
+
+	do {
+		switch (ctx->rsp_flags) {
+		case NORMAL_RESPONSE:
+			err = fastrpc_wait_for_response(ctx, kernel);
+			if (err || ctx->is_work_done)
+				return err;
+			break;
+		case POLL_MODE:
+			err = poll_for_remote_response(ctx, ctx->poll_timeout);
+			/* If polling timed out, move to normal response mode */
+			if (err)
+				ctx->rsp_flags = NORMAL_RESPONSE;
+			break;
+		default:
+			err = -EBADR;
+			dev_dbg(ctx->fl->sctx->dev,
+				"unsupported response type:0x%x\n", ctx->rsp_flags);
+			break;
+		}
+	} while (!ctx->is_work_done);
+
+	return err;
+}
+
+static int fastrpc_internal_invoke(struct fastrpc_user *fl,
+			u32 kernel, struct fastrpc_invoke_v2 *inv2)
+{
+	struct fastrpc_invoke_ctx *ctx = NULL;
+	struct fastrpc_invoke inv;
+	u32 handle, sc;
+	int err = 0, perferr = 0;
+	struct timespec64 invoket = {0};
+
+	if (inv2->perf_kernel)
+		ktime_get_boottime_ts64(&invoket);
+
 	if (!fl->sctx)
 		return -EINVAL;
 
 	if (!fl->cctx->rpdev)
 		return -EPIPE;
 
+	inv = inv2->inv;
+	handle = inv.handle;
+	sc = inv.sc;
 	if (handle == FASTRPC_INIT_HANDLE && !kernel) {
 		dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n",  handle);
 		return -EPERM;
 	}
 
-	ctx = fastrpc_context_alloc(fl, kernel, sc, args);
+	ctx = fastrpc_context_alloc(fl, kernel, sc, inv2);
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
 
+	PERF(ctx->perf_kernel, GET_COUNTER((u64 *)ctx->perf, PERF_GETARGS),
 	err = fastrpc_get_args(kernel, ctx);
+	PERF_END);
 	if (err)
 		goto bail;
 
 	/* make sure that all CPU memory writes are seen by DSP */
 	dma_wmb();
+	PERF(ctx->perf_kernel, GET_COUNTER((u64 *)ctx->perf, PERF_LINK),
 	/* Send invoke buffer to remote dsp */
 	err = fastrpc_invoke_send(fl->sctx, ctx, kernel, handle);
+	PERF_END);
 	if (err)
 		goto bail;
 
-	if (kernel) {
-		if (!wait_for_completion_timeout(&ctx->work, 10 * HZ))
-			err = -ETIMEDOUT;
-	} else {
-		err = wait_for_completion_interruptible(&ctx->work);
-	}
+	if (ctx->poll_timeout != 0 && handle > FASTRPC_MAX_STATIC_HANDLE &&
+		fl->cctx->domain_id == CDSP_DOMAIN_ID &&
+		fl->pd == USER_PD)
+		ctx->rsp_flags = POLL_MODE;
 
+	err = fastrpc_wait_for_completion(ctx, kernel);
 	if (err)
 		goto bail;
 
+	if (!ctx->is_work_done) {
+		err = -ETIMEDOUT;
+		dev_dbg(fl->sctx->dev, "Invalid workdone state for handle 0x%x, sc 0x%x\n",
+			handle, sc);
+		goto bail;
+	}
+
 	/* make sure that all memory writes by DSP are seen by CPU */
 	dma_rmb();
+	PERF(ctx->perf_kernel, GET_COUNTER((u64 *)ctx->perf, PERF_PUTARGS),
 	/* populate all the output buffers with results */
 	err = fastrpc_put_args(ctx, kernel);
+	PERF_END);
 	if (err)
 		goto bail;
 
@@ -1192,6 +1536,17 @@
 
 bail:
 	if (err != -ERESTARTSYS && err != -ETIMEDOUT) {
+		if (ctx) {
+			if (ctx->perf_kernel && !err)
+				fastrpc_update_invoke_count(handle, (u64 *)ctx->perf, &invoket);
+			if (ctx->perf_kernel && ctx->perf) {
+				perferr = copy_to_user((void __user *)ctx->perf_kernel,
+						ctx->perf, FASTRPC_KERNEL_PERF_LIST * sizeof(u64));
+				if (perferr)
+					dev_info(fl->sctx->dev,
+						"Warning: failed to copy perf data %d\n", perferr);
+			}
+		}
 		/* We are done with this compute context */
 		spin_lock(&fl->lock);
 		list_del(&ctx->node);
@@ -1199,13 +1554,6 @@
 		fastrpc_context_put(ctx);
 	}
 
-	if (err == -ERESTARTSYS) {
-		list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
-			list_del(&buf->node);
-			list_add_tail(&buf->node, &fl->cctx->invoke_interrupted_mmaps);
-		}
-	}
-
 	if (err)
 		dev_dbg(fl->sctx->dev, "Error: Invoke Failed %d\n", err);
 
@@ -1230,20 +1578,81 @@
 	return false;
 }
 
+static int fastrpc_mmap_remove_ssr(struct fastrpc_channel_ctx *cctx)
+{
+	struct fastrpc_buf *buf, *b;
+	int err = 0;
+
+	list_for_each_entry_safe(buf, b, &cctx->rhmaps, node) {
+		if (cctx->vmcount) {
+			u64 src_perms = 0;
+			struct qcom_scm_vmperm dst_perms;
+			u32 i;
+
+			for (i = 0; i < cctx->vmcount; i++)
+				src_perms |= BIT(cctx->vmperms[i].vmid);
+
+			dst_perms.vmid = QCOM_SCM_VMID_HLOS;
+			dst_perms.perm = QCOM_SCM_PERM_RWX;
+			err = qcom_scm_assign_mem(buf->phys, (u64)buf->size,
+				&src_perms, &dst_perms, 1);
+			if (err) {
+				pr_err("%s: Failed to assign memory phys 0x%llx size 0x%llx err %d\n",
+					__func__, buf->phys, buf->size, err);
+				return err;
+			}
+		}
+		list_del(&buf->node);
+		__fastrpc_buf_free(buf);
+	}
+
+	return 0;
+}
+
+static int fastrpc_mmap_remove_pdr(struct fastrpc_user *fl)
+{
+	int err = 0, session = -1;
+
+	if (!fl)
+		return -EBADF;
+
+	session = fastrpc_get_spd_session(fl->cctx, fl->servloc_name);
+	if (session < 0)
+		return -EUSERS;
+
+	if (atomic_read(&fl->cctx->spd[session].ispdup) == 0)
+		return -ENOTCONN;
+
+	if (fl->cctx->spd[session].pdrcount !=
+		fl->cctx->spd[session].prevpdrcount) {
+		err = fastrpc_mmap_remove_ssr(fl->cctx);
+		if (err)
+			dev_info(&fl->cctx->rpdev->dev,
+				"failed to unmap remote heap (err %d)\n", err);
+		fl->cctx->spd[session].prevpdrcount =
+				fl->cctx->spd[session].pdrcount;
+	}
+
+	return err;
+}
+
 static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
 					      char __user *argp)
 {
 	struct fastrpc_init_create_static init;
 	struct fastrpc_invoke_args *args;
+	struct fastrpc_invoke_v2 ioctl = {0};
 	struct fastrpc_phy_page pages[1];
+	struct fastrpc_buf *buf = NULL;
+	u64 phys = 0, size = 0;
 	char *name;
 	int err;
+	bool scm_done = false;
 	struct {
 		int pgid;
 		u32 namelen;
 		u32 pageslen;
 	} inbuf;
-	u32 sc;
 
 	args = kcalloc(FASTRPC_CREATE_STATIC_PROCESS_NARGS, sizeof(*args), GFP_KERNEL);
 	if (!args)
@@ -1270,29 +1679,46 @@
 		goto err_name;
 	}
 
-	if (!fl->cctx->remote_heap) {
-		err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen,
-						&fl->cctx->remote_heap);
+	fl->servloc_name = AUDIO_PDR_SERVICE_LOCATION_CLIENT_NAME;
+
+	if (!strcmp(name, "audiopd")) {
+		/*
+		 * Remove any previous mappings in case process is trying
+		 * to reconnect after a PD restart on remote subsystem.
+		 */
+		err = fastrpc_mmap_remove_pdr(fl);
 		if (err)
 			goto err_name;
+	}
 
+	if (!fl->cctx->staticpd_status) {
+		err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, &buf);
+		if (err)
+			goto err_name;
+
+		phys = buf->phys;
+		size = buf->size;
 		/* Map if we have any heap VMIDs associated with this ADSP Static Process. */
 		if (fl->cctx->vmcount) {
 			u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
 
-			err = qcom_scm_assign_mem(fl->cctx->remote_heap->phys,
-							(u64)fl->cctx->remote_heap->size,
+			err = qcom_scm_assign_mem(phys, (u64)size,
 							&src_perms,
 							fl->cctx->vmperms, fl->cctx->vmcount);
 			if (err) {
 				dev_err(fl->sctx->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d",
-					fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err);
+					phys, size, err);
 				goto err_map;
 			}
+			scm_done = true;
 		}
+		fl->cctx->staticpd_status = true;
+		spin_lock(&fl->lock);
+		list_add_tail(&buf->node, &fl->cctx->rhmaps);
+		spin_unlock(&fl->lock);
 	}
 
-	inbuf.pgid = fl->tgid;
+	inbuf.pgid = fl->client_id;
 	inbuf.namelen = init.namelen;
 	inbuf.pageslen = 0;
 	fl->pd = USER_PD;
@@ -1305,25 +1731,26 @@
 	args[1].length = inbuf.namelen;
 	args[1].fd = -1;
 
-	pages[0].addr = fl->cctx->remote_heap->phys;
-	pages[0].size = fl->cctx->remote_heap->size;
+	pages[0].addr = phys;
+	pages[0].size = size;
 
 	args[2].ptr = (u64)(uintptr_t) pages;
 	args[2].length = sizeof(*pages);
 	args[2].fd = -1;
 
-	sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_STATIC, 3, 0);
-
-	err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE,
-				      sc, args);
+	ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+	ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_STATIC, 3, 0);
+	ioctl.inv.args = (u64)args;
+	err = fastrpc_internal_invoke(fl, true, &ioctl);
 	if (err)
 		goto err_invoke;
 
 	kfree(args);
+	kfree(name);
 
 	return 0;
 err_invoke:
-	if (fl->cctx->vmcount) {
+	if (fl->cctx->vmcount && scm_done) {
 		u64 src_perms = 0;
 		struct qcom_scm_vmperm dst_perms;
 		u32 i;
@@ -1333,15 +1760,18 @@
 
 		dst_perms.vmid = QCOM_SCM_VMID_HLOS;
 		dst_perms.perm = QCOM_SCM_PERM_RWX;
-		err = qcom_scm_assign_mem(fl->cctx->remote_heap->phys,
-						(u64)fl->cctx->remote_heap->size,
+		err = qcom_scm_assign_mem(phys, (u64)size,
 						&src_perms, &dst_perms, 1);
 		if (err)
 			dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d",
-				fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err);
+				phys, size, err);
 	}
 err_map:
-	fastrpc_buf_free(fl->cctx->remote_heap);
+	fl->cctx->staticpd_status = false;
+	spin_lock(&fl->lock);
+	list_del(&buf->node);
+	spin_unlock(&fl->lock);
+	__fastrpc_buf_free(buf);
 err_name:
 	kfree(name);
 err:
@@ -1355,6 +1785,7 @@
 {
 	struct fastrpc_init_create init;
 	struct fastrpc_invoke_args *args;
+	struct fastrpc_invoke_v2 ioctl = {0};
 	struct fastrpc_phy_page pages[1];
 	struct fastrpc_map *map = NULL;
 	struct fastrpc_buf *imem = NULL;
@@ -1368,8 +1799,6 @@
 		u32 attrs;
 		u32 siglen;
 	} inbuf;
-	u32 sc;
-	bool unsigned_module = false;
 
 	args = kcalloc(FASTRPC_CREATE_PROCESS_NARGS, sizeof(*args), GFP_KERNEL);
 	if (!args)
@@ -1381,9 +1810,9 @@
 	}
 
 	if (init.attrs & FASTRPC_MODE_UNSIGNED_MODULE)
-		unsigned_module = true;
+		fl->is_unsigned_pd = true;
 
-	if (is_session_rejected(fl, unsigned_module)) {
+	if (is_session_rejected(fl, fl->is_unsigned_pd)) {
 		err = -ECONNREFUSED;
 		goto err;
 	}
@@ -1393,7 +1822,7 @@
 		goto err;
 	}
 
-	inbuf.pgid = fl->tgid;
+	inbuf.pgid = fl->client_id;
 	inbuf.namelen = strlen(current->comm) + 1;
 	inbuf.filelen = init.filelen;
 	inbuf.pageslen = 1;
@@ -1402,7 +1831,8 @@
 	fl->pd = USER_PD;
 
 	if (init.filelen && init.filefd) {
-		err = fastrpc_map_create(fl, init.filefd, init.filelen, 0, &map);
+		err = fastrpc_map_create(fl, init.filefd, init.file,
+				init.filelen, 0, &map, true);
 		if (err)
 			goto err;
 	}
@@ -1442,16 +1872,17 @@
 	args[5].length = sizeof(inbuf.siglen);
 	args[5].fd = -1;
 
-	sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE, 4, 0);
+	ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+	ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE, 4, 0);
 	if (init.attrs)
-		sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_ATTR, 4, 0);
-
-	err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE,
-				      sc, args);
+		ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_ATTR, 4, 0);
+	ioctl.inv.args = (u64)args;
+	err = fastrpc_internal_invoke(fl, true, &ioctl);
 	if (err)
 		goto err_invoke;
 
 	kfree(args);
+	fastrpc_map_put(map);
 
 	return 0;
 
@@ -1467,8 +1898,9 @@
 }
 
 static struct fastrpc_session_ctx *fastrpc_session_alloc(
-					struct fastrpc_channel_ctx *cctx)
+					struct fastrpc_user *fl)
 {
+	struct fastrpc_channel_ctx *cctx = fl->cctx;
 	struct fastrpc_session_ctx *session = NULL;
 	unsigned long flags;
 	int i;
@@ -1478,6 +1910,7 @@
 		if (!cctx->session[i].used && cctx->session[i].valid) {
 			cctx->session[i].used = true;
 			session = &cctx->session[i];
+			fl->client_id = FASTRPC_CLIENTID_MASK | i;
 			break;
 		}
 	}
@@ -1499,17 +1932,18 @@
 static int fastrpc_release_current_dsp_process(struct fastrpc_user *fl)
 {
 	struct fastrpc_invoke_args args[1];
+	struct fastrpc_invoke_v2 ioctl = {0};
 	int tgid = 0;
-	u32 sc;
 
-	tgid = fl->tgid;
+	tgid = fl->client_id;
 	args[0].ptr = (u64)(uintptr_t) &tgid;
 	args[0].length = sizeof(tgid);
 	args[0].fd = -1;
-	sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_RELEASE, 1, 0);
 
-	return fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE,
-				       sc, &args[0]);
+	ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+	ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_RELEASE, 1, 0);
+	ioctl.inv.args = (u64)args;
+	return fastrpc_internal_invoke(fl, true, &ioctl);
 }
 
 static int fastrpc_device_release(struct inode *inode, struct file *file)
@@ -1563,6 +1997,9 @@
 	fdevice = miscdev_to_fdevice(filp->private_data);
 	cctx = fdevice->cctx;
 
+	if (!cctx->rpdev)
+		return -ENODEV;
+
 	fl = kzalloc(sizeof(*fl), GFP_KERNEL);
 	if (!fl)
 		return -ENOMEM;
@@ -1577,11 +2014,10 @@
 	INIT_LIST_HEAD(&fl->maps);
 	INIT_LIST_HEAD(&fl->mmaps);
 	INIT_LIST_HEAD(&fl->user);
-	fl->tgid = current->tgid;
 	fl->cctx = cctx;
 	fl->is_secure_dev = fdevice->secure;
 
-	fl->sctx = fastrpc_session_alloc(cctx);
+	fl->sctx = fastrpc_session_alloc(fl);
 	if (!fl->sctx) {
 		dev_err(&cctx->rpdev->dev, "No session available\n");
 		mutex_destroy(&fl->mutex);
@@ -1645,45 +2081,84 @@
 static int fastrpc_init_attach(struct fastrpc_user *fl, int pd)
 {
 	struct fastrpc_invoke_args args[1];
-	int tgid = fl->tgid;
-	u32 sc;
+	struct fastrpc_invoke_v2 ioctl = {0};
+	int tgid = fl->client_id;
 
 	args[0].ptr = (u64)(uintptr_t) &tgid;
 	args[0].length = sizeof(tgid);
 	args[0].fd = -1;
-	sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_ATTACH, 1, 0);
 	fl->pd = pd;
+	if (pd == SENSORS_PD) {
+		if (fl->cctx->domain_id == ADSP_DOMAIN_ID)
+			fl->servloc_name = SENSORS_PDR_ADSP_SERVICE_LOCATION_CLIENT_NAME;
+		else if (fl->cctx->domain_id == SDSP_DOMAIN_ID)
+			fl->servloc_name = SENSORS_PDR_SLPI_SERVICE_LOCATION_CLIENT_NAME;
+	}
 
-	return fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE,
-				       sc, &args[0]);
+	ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+	ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_ATTACH, 1, 0);
+	ioctl.inv.args = (u64)args;
+	return fastrpc_internal_invoke(fl, true, &ioctl);
 }
 
-static int fastrpc_invoke(struct fastrpc_user *fl, char __user *argp)
+static int fastrpc_copy_args(struct fastrpc_invoke *inv)
 {
 	struct fastrpc_invoke_args *args = NULL;
-	struct fastrpc_invoke inv;
 	u32 nscalars;
-	int err;
-
-	if (copy_from_user(&inv, argp, sizeof(inv)))
-		return -EFAULT;
 
 	/* nscalars is truncated here to max supported value */
-	nscalars = REMOTE_SCALARS_LENGTH(inv.sc);
+	nscalars = REMOTE_SCALARS_LENGTH(inv->sc);
 	if (nscalars) {
 		args = kcalloc(nscalars, sizeof(*args), GFP_KERNEL);
 		if (!args)
 			return -ENOMEM;
 
-		if (copy_from_user(args, (void __user *)(uintptr_t)inv.args,
+		if (copy_from_user(args, (void __user *)(uintptr_t)inv->args,
 				   nscalars * sizeof(*args))) {
 			kfree(args);
 			return -EFAULT;
 		}
 	}
+	inv->args = args;
 
-	err = fastrpc_internal_invoke(fl, false, inv.handle, inv.sc, args);
-	kfree(args);
+	return 0;
+}
+
+static int fastrpc_invoke(struct fastrpc_user *fl, char __user *argp)
+{
+	struct fastrpc_invoke_v2 ioctl = {0};
+	struct fastrpc_invoke inv;
+	u32 nscalars;
+	int err;
+
+	if (copy_from_user(&inv, argp, sizeof(inv)))
+		return -EFAULT;
+
+	err = fastrpc_copy_args(&inv);
+	if (err)
+		return err;
+
+	ioctl.inv = inv;
+	err = fastrpc_internal_invoke(fl, false, &ioctl);
+	kfree(inv.args);
+
+	return err;
+}
+
+static int fastrpc_invokev2(struct fastrpc_user *fl, char __user *argp)
+{
+	struct fastrpc_invoke_v2 inv2 = {0};
+	int err;
+
+	if (copy_from_user(&inv2, argp, sizeof(inv2)))
+		return -EFAULT;
+
+	err = fastrpc_copy_args(&inv2.inv);
+	if (err)
+		return err;
+
+	err = fastrpc_internal_invoke(fl, false, &inv2);
+	kfree(inv2.inv.args);
 
 	return err;
 }
@@ -1692,20 +2167,27 @@
 				     uint32_t dsp_attr_buf_len)
 {
 	struct fastrpc_invoke_args args[2] = { 0 };
+	struct fastrpc_invoke_v2 ioctl = {0};
 
-	/* Capability filled in userspace */
+	/*
+	 * Capability filled in userspace. This carries the information
+	 * about the remoteproc support which is fetched from the remoteproc
+	 * sysfs node by userspace.
+	 */
 	dsp_attr_buf[0] = 0;
+	dsp_attr_buf_len -= 1;
 
 	args[0].ptr = (u64)(uintptr_t)&dsp_attr_buf_len;
 	args[0].length = sizeof(dsp_attr_buf_len);
 	args[0].fd = -1;
 	args[1].ptr = (u64)(uintptr_t)&dsp_attr_buf[1];
-	args[1].length = dsp_attr_buf_len;
+	args[1].length = dsp_attr_buf_len * sizeof(u32);
 	args[1].fd = -1;
-	fl->pd = USER_PD;
 
-	return fastrpc_internal_invoke(fl, true, FASTRPC_DSP_UTILITIES_HANDLE,
-				       FASTRPC_SCALARS(0, 1, 1), args);
+	ioctl.inv.handle = FASTRPC_DSP_UTILITIES_HANDLE;
+	ioctl.inv.sc = FASTRPC_SCALARS(0, 1, 1);
+	ioctl.inv.args = (u64)args;
+	return fastrpc_internal_invoke(fl, true, &ioctl);
 }
 
 static int fastrpc_get_info_from_kernel(struct fastrpc_ioctl_capability *cap,
@@ -1730,7 +2212,7 @@
 	if (!dsp_attributes)
 		return -ENOMEM;
 
-	err = fastrpc_get_info_from_dsp(fl, dsp_attributes, FASTRPC_MAX_DSP_ATTRIBUTES_LEN);
+	err = fastrpc_get_info_from_dsp(fl, dsp_attributes, FASTRPC_MAX_DSP_ATTRIBUTES);
 	if (err == DSP_UNSUPPORTED_API) {
 		dev_info(&cctx->rpdev->dev,
 			 "Warning: DSP capabilities not supported on domain: %d\n", domain);
@@ -1783,7 +2265,7 @@
 	if (err)
 		return err;
 
-	if (copy_to_user(argp, &cap.capability, sizeof(cap.capability)))
+	if (copy_to_user(argp, &cap, sizeof(cap)))
 		return -EFAULT;
 
 	return 0;
@@ -1792,22 +2274,43 @@
 static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_buf *buf)
 {
 	struct fastrpc_invoke_args args[1] = { [0] = { 0 } };
+	struct fastrpc_invoke_v2 ioctl = {0};
 	struct fastrpc_munmap_req_msg req_msg;
 	struct device *dev = fl->sctx->dev;
 	int err;
-	u32 sc;
 
-	req_msg.pgid = fl->tgid;
+	req_msg.pgid = fl->client_id;
 	req_msg.size = buf->size;
 	req_msg.vaddr = buf->raddr;
 
 	args[0].ptr = (u64) (uintptr_t) &req_msg;
 	args[0].length = sizeof(req_msg);
 
-	sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MUNMAP, 1, 0);
-	err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc,
-				      &args[0]);
+	ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+	ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MUNMAP, 1, 0);
+	ioctl.inv.args = (u64)args;
+	err = fastrpc_internal_invoke(fl, true, &ioctl);
 	if (!err) {
+		if (buf->flag == ADSP_MMAP_REMOTE_HEAP_ADDR) {
+			if (fl->cctx->vmcount) {
+				u64 src_perms = 0;
+				struct qcom_scm_vmperm dst_perms;
+				u32 i;
+
+				for (i = 0; i < fl->cctx->vmcount; i++)
+					src_perms |= BIT(fl->cctx->vmperms[i].vmid);
+
+				dst_perms.vmid = QCOM_SCM_VMID_HLOS;
+				dst_perms.perm = QCOM_SCM_PERM_RWX;
+				err = qcom_scm_assign_mem(buf->phys, (u64)buf->size,
+								&src_perms, &dst_perms, 1);
+				if (err) {
+					dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n",
+						buf->phys, buf->size, err);
+					return err;
+				}
+			}
+		}
 		dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr);
 		spin_lock(&fl->lock);
 		list_del(&buf->node);
@@ -1824,7 +2327,12 @@
 {
 	struct fastrpc_buf *buf = NULL, *iter, *b;
 	struct fastrpc_req_munmap req;
+	struct fastrpc_munmap_req_msg req_msg;
+	struct fastrpc_map *map = NULL, *iterm, *m;
 	struct device *dev = fl->sctx->dev;
+	struct fastrpc_invoke_args args[1] = { [0] = { 0 } };
+	struct fastrpc_invoke_v2 ioctl = {0};
+	int err = 0;
 
 	if (copy_from_user(&req, argp, sizeof(req)))
 		return -EFAULT;
@@ -1838,113 +2346,209 @@
 	}
 	spin_unlock(&fl->lock);
 
-	if (!buf) {
-		dev_err(dev, "mmap\t\tpt 0x%09llx [len 0x%08llx] not in list\n",
-			req.vaddrout, req.size);
+	if (buf) {
+		err = fastrpc_req_munmap_impl(fl, buf);
+		return err;
+	}
+
+	spin_lock(&fl->lock);
+	list_for_each_entry_safe(iter, b, &fl->cctx->rhmaps, node) {
+		if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) {
+			buf = iter;
+			break;
+		}
+	}
+	spin_unlock(&fl->lock);
+	if (buf) {
+		err = fastrpc_req_munmap_impl(fl, buf);
+		return err;
+	}
+	spin_lock(&fl->lock);
+	list_for_each_entry_safe(iterm, m, &fl->maps, node) {
+		if (iterm->raddr == req.vaddrout) {
+			map = iterm;
+			break;
+		}
+	}
+	spin_unlock(&fl->lock);
+	if (!map) {
+		dev_err(dev, "map not in list\n");
 		return -EINVAL;
 	}
 
-	return fastrpc_req_munmap_impl(fl, buf);
+	req_msg.pgid = fl->client_id;
+	req_msg.size = map->len;
+	req_msg.vaddr = map->raddr;
+
+	args[0].ptr = (u64) (uintptr_t) &req_msg;
+	args[0].length = sizeof(req_msg);
+
+	ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+	ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MUNMAP, 1, 0);
+	ioctl.inv.args = (u64)args;
+	err = fastrpc_internal_invoke(fl, true, &ioctl);
+	if (err)
+		dev_err(dev, "unmmap\tpt fd = %d, 0x%09llx error\n",  map->fd, map->raddr);
+	else
+		fastrpc_map_put(map);
+
+	return err;
 }
 
 static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp)
 {
 	struct fastrpc_invoke_args args[3] = { [0 ... 2] = { 0 } };
+	struct fastrpc_invoke_v2 ioctl = {0};
 	struct fastrpc_buf *buf = NULL;
 	struct fastrpc_mmap_req_msg req_msg;
 	struct fastrpc_mmap_rsp_msg rsp_msg;
 	struct fastrpc_phy_page pages;
 	struct fastrpc_req_mmap req;
+	struct fastrpc_map *map = NULL;
 	struct device *dev = fl->sctx->dev;
 	int err;
-	u32 sc;
+	unsigned long flags;
 
 	if (copy_from_user(&req, argp, sizeof(req)))
 		return -EFAULT;
 
-	if (req.flags != ADSP_MMAP_ADD_PAGES && req.flags != ADSP_MMAP_REMOTE_HEAP_ADDR) {
-		dev_err(dev, "flag not supported 0x%x\n", req.flags);
+	if (req.flags == ADSP_MMAP_ADD_PAGES || req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
+		if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR && fl->is_unsigned_pd) {
+			dev_err(dev, "secure memory allocation is not supported in unsigned PD\n");
+			return -EINVAL;
+		}
+		if (req.vaddrin && !fl->is_unsigned_pd) {
+			dev_err(dev, "adding user allocated pages is not supported\n");
+			return -EINVAL;
+		}
 
-		return -EINVAL;
-	}
+		if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR)
+			err = fastrpc_remote_heap_alloc(fl, dev, req.size, &buf);
+		else
+			err = fastrpc_buf_alloc(fl, dev, req.size, &buf);
 
-	if (req.vaddrin) {
-		dev_err(dev, "adding user allocated pages is not supported\n");
-		return -EINVAL;
-	}
+		if (err) {
+			dev_err(dev, "failed to allocate buffer\n");
+			return err;
+		}
 
-	if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR)
-		err = fastrpc_remote_heap_alloc(fl, dev, req.size, &buf);
-	else
-		err = fastrpc_buf_alloc(fl, dev, req.size, &buf);
+		req_msg.pgid = fl->client_id;
+		req_msg.flags = req.flags;
+		req_msg.vaddr = req.vaddrin;
+		req_msg.num = sizeof(pages);
 
-	if (err) {
-		dev_err(dev, "failed to allocate buffer\n");
-		return err;
-	}
+		args[0].ptr = (u64) (uintptr_t) &req_msg;
+		args[0].length = sizeof(req_msg);
 
-	req_msg.pgid = fl->tgid;
-	req_msg.flags = req.flags;
-	req_msg.vaddr = req.vaddrin;
-	req_msg.num = sizeof(pages);
+		pages.addr = buf->phys;
+		pages.size = buf->size;
 
-	args[0].ptr = (u64) (uintptr_t) &req_msg;
-	args[0].length = sizeof(req_msg);
+		args[1].ptr = (u64) (uintptr_t) &pages;
+		args[1].length = sizeof(pages);
 
-	pages.addr = buf->phys;
-	pages.size = buf->size;
+		args[2].ptr = (u64) (uintptr_t) &rsp_msg;
+		args[2].length = sizeof(rsp_msg);
 
-	args[1].ptr = (u64) (uintptr_t) &pages;
-	args[1].length = sizeof(pages);
+		ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+		ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MMAP, 2, 1);
+		ioctl.inv.args = (u64)args;
+		err = fastrpc_internal_invoke(fl, true, &ioctl);
+		if (err) {
+			dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);
+			fastrpc_buf_free(buf);
+			return err;
+		}
 
-	args[2].ptr = (u64) (uintptr_t) &rsp_msg;
-	args[2].length = sizeof(rsp_msg);
+		/* update the buffer to be able to deallocate the memory on the DSP */
+		buf->raddr = (uintptr_t) rsp_msg.vaddr;
+		buf->flag = req.flags;
 
-	sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MMAP, 2, 1);
-	err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc,
-				      &args[0]);
-	if (err) {
-		dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);
-		goto err_invoke;
-	}
+		/* let the client know the address to use */
+		req.vaddrout = rsp_msg.vaddr;
 
-	/* update the buffer to be able to deallocate the memory on the DSP */
-	buf->raddr = (uintptr_t) rsp_msg.vaddr;
+		/* Add memory to static PD pool, protection thru hypervisor */
+		if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) {
+			u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
 
-	/* let the client know the address to use */
-	req.vaddrout = rsp_msg.vaddr;
+			err = qcom_scm_assign_mem(buf->phys, (u64)buf->size,
+				&src_perms, fl->cctx->vmperms, fl->cctx->vmcount);
+			if (err) {
+				dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n",
+						buf->phys, buf->size, err);
+				goto err_assign;
+			}
+		}
 
-	/* Add memory to static PD pool, protection thru hypervisor */
-	if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) {
-		u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
+		if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
+			spin_lock_irqsave(&fl->cctx->lock, flags);
+			list_add_tail(&buf->node, &fl->cctx->rhmaps);
+			spin_unlock_irqrestore(&fl->cctx->lock, flags);
+		} else {
+			spin_lock(&fl->lock);
+			list_add_tail(&buf->node, &fl->mmaps);
+			spin_unlock(&fl->lock);
+		}
 
-		err = qcom_scm_assign_mem(buf->phys, (u64)buf->size,
-			&src_perms, fl->cctx->vmperms, fl->cctx->vmcount);
-		if (err) {
-			dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d",
-					buf->phys, buf->size, err);
+		if (copy_to_user((void __user *)argp, &req, sizeof(req))) {
+			err = -EFAULT;
 			goto err_assign;
 		}
-	}
+	} else {
+		err = fastrpc_map_create(fl, req.fd, req.vaddrin, req.size,
+				0, &map, true);
+		if (err) {
+			dev_err(dev, "failed to map buffer, fd = %d\n", req.fd);
+			return err;
+		}
 
-	spin_lock(&fl->lock);
-	list_add_tail(&buf->node, &fl->mmaps);
-	spin_unlock(&fl->lock);
+		req_msg.pgid = fl->client_id;
+		req_msg.flags = req.flags;
+		req_msg.vaddr = req.vaddrin;
+		req_msg.num = sizeof(pages);
 
-	if (copy_to_user((void __user *)argp, &req, sizeof(req))) {
-		err = -EFAULT;
-		goto err_assign;
-	}
+		args[0].ptr = (u64) (uintptr_t) &req_msg;
+		args[0].length = sizeof(req_msg);
 
-	dev_dbg(dev, "mmap\t\tpt 0x%09lx OK [len 0x%08llx]\n",
-		buf->raddr, buf->size);
+		pages.addr = map->phys;
+		pages.size = map->len;
 
+		args[1].ptr = (u64) (uintptr_t) &pages;
+		args[1].length = sizeof(pages);
+
+		args[2].ptr = (u64) (uintptr_t) &rsp_msg;
+		args[2].length = sizeof(rsp_msg);
+
+		ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+		ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MMAP, 2, 1);
+		ioctl.inv.args = (u64)args;
+		err = fastrpc_internal_invoke(fl, true, &ioctl);
+		if (err) {
+			dev_err(dev, "mmap error (len 0x%08llx)\n", map->len);
+			goto err_invoke;
+		}
+
+		/* update the buffer to be able to deallocate the memory on the DSP */
+		map->raddr = (uintptr_t) rsp_msg.vaddr;
+
+		/* let the client know the address to use */
+		req.vaddrout = rsp_msg.vaddr;
+
+		if (copy_to_user((void __user *)argp, &req, sizeof(req))) {
+			err = -EFAULT;
+			goto err_assign;
+		}
+	}
 	return 0;
 
 err_assign:
-	fastrpc_req_munmap_impl(fl, buf);
+	if (req.flags != ADSP_MMAP_ADD_PAGES && req.flags != ADSP_MMAP_REMOTE_HEAP_ADDR)
+		fastrpc_map_put(map);
+	else
+		fastrpc_req_munmap_impl(fl, buf);
+
 err_invoke:
-	fastrpc_buf_free(buf);
+	if (map)
+		fastrpc_map_put(map);
 
 	return err;
 }
@@ -1952,10 +2556,10 @@
 static int fastrpc_req_mem_unmap_impl(struct fastrpc_user *fl, struct fastrpc_mem_unmap *req)
 {
 	struct fastrpc_invoke_args args[1] = { [0] = { 0 } };
+	struct fastrpc_invoke_v2 ioctl = {0};
 	struct fastrpc_map *map = NULL, *iter, *m;
 	struct fastrpc_mem_unmap_req_msg req_msg = { 0 };
 	int err = 0;
-	u32 sc;
 	struct device *dev = fl->sctx->dev;
 
 	spin_lock(&fl->lock);
@@ -1973,7 +2577,7 @@
 		return -EINVAL;
 	}
 
-	req_msg.pgid = fl->tgid;
+	req_msg.pgid = fl->client_id;
 	req_msg.len = map->len;
 	req_msg.vaddrin = map->raddr;
 	req_msg.fd = map->fd;
@@ -1981,9 +2585,10 @@
 	args[0].ptr = (u64) (uintptr_t) &req_msg;
 	args[0].length = sizeof(req_msg);
 
-	sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MEM_UNMAP, 1, 0);
-	err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc,
-				      &args[0]);
+	ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+	ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MEM_UNMAP, 1, 0);
+	ioctl.inv.args = (u64)args;
+	err = fastrpc_internal_invoke(fl, true, &ioctl);
 	if (err) {
 		dev_err(dev, "unmmap\tpt fd = %d, 0x%09llx error\n",  map->fd, map->raddr);
 		return err;
@@ -2006,6 +2611,7 @@
 static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp)
 {
 	struct fastrpc_invoke_args args[4] = { [0 ... 3] = { 0 } };
+	struct fastrpc_invoke_v2 ioctl = {0};
 	struct fastrpc_mem_map_req_msg req_msg = { 0 };
 	struct fastrpc_mmap_rsp_msg rsp_msg = { 0 };
 	struct fastrpc_mem_unmap req_unmap = { 0 };
@@ -2014,19 +2620,19 @@
 	struct device *dev = fl->sctx->dev;
 	struct fastrpc_map *map = NULL;
 	int err;
-	u32 sc;
 
 	if (copy_from_user(&req, argp, sizeof(req)))
 		return -EFAULT;
 
 	/* create SMMU mapping */
-	err = fastrpc_map_create(fl, req.fd, req.length, 0, &map);
+	err = fastrpc_map_create(fl, req.fd, req.vaddrin, req.length,
+			0, &map, true);
 	if (err) {
 		dev_err(dev, "failed to map buffer, fd = %d\n", req.fd);
 		return err;
 	}
 
-	req_msg.pgid = fl->tgid;
+	req_msg.pgid = fl->client_id;
 	req_msg.fd = req.fd;
 	req_msg.offset = req.offset;
 	req_msg.vaddrin = req.vaddrin;
@@ -2039,7 +2645,7 @@
 	args[0].length = sizeof(req_msg);
 
 	pages.addr = map->phys;
-	pages.size = map->size;
+	pages.size = map->len;
 
 	args[1].ptr = (u64) (uintptr_t) &pages;
 	args[1].length = sizeof(pages);
@@ -2050,11 +2656,13 @@
 	args[3].ptr = (u64) (uintptr_t) &rsp_msg;
 	args[3].length = sizeof(rsp_msg);
 
-	sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MEM_MAP, 3, 1);
-	err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc, &args[0]);
+	ioctl.inv.handle = FASTRPC_INIT_HANDLE;
+	ioctl.inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MEM_MAP, 3, 1);
+	ioctl.inv.args = (u64)args;
+	err = fastrpc_internal_invoke(fl, true, &ioctl);
 	if (err) {
 		dev_err(dev, "mem mmap error, fd %d, vaddr %llx, size %lld\n",
-			req.fd, req.vaddrin, map->size);
+			req.fd, req.vaddrin, map->len);
 		goto err_invoke;
 	}
 
@@ -2067,7 +2675,7 @@
 	if (copy_to_user((void __user *)argp, &req, sizeof(req))) {
 		/* unmap the memory and release the buffer */
 		req_unmap.vaddr = (uintptr_t) rsp_msg.vaddr;
-		req_unmap.length = map->size;
+		req_unmap.length = map->len;
 		fastrpc_req_mem_unmap_impl(fl, &req_unmap);
 		return -EFAULT;
 	}
@@ -2087,10 +2695,14 @@
 	char __user *argp = (char __user *)arg;
 	int err;
 
+	fastrpc_channel_ctx_get(fl->cctx);
 	switch (cmd) {
 	case FASTRPC_IOCTL_INVOKE:
 		err = fastrpc_invoke(fl, argp);
 		break;
+	case FASTRPC_IOCTL_INVOKEV2:
+		err = fastrpc_invokev2(fl, argp);
+		break;
 	case FASTRPC_IOCTL_INIT_ATTACH:
 		err = fastrpc_init_attach(fl, ROOT_PD);
 		break;
@@ -2110,7 +2722,9 @@
 		err = fastrpc_req_mmap(fl, argp);
 		break;
 	case FASTRPC_IOCTL_MUNMAP:
+		mutex_lock(&fl->mutex);
 		err = fastrpc_req_munmap(fl, argp);
+		mutex_unlock(&fl->mutex);
 		break;
 	case FASTRPC_IOCTL_MEM_MAP:
 		err = fastrpc_req_mem_map(fl, argp);
@@ -2125,10 +2739,76 @@
 		err = -ENOTTY;
 		break;
 	}
+	fastrpc_channel_ctx_put(fl->cctx);
 
 	return err;
 }
 
+static void fastrpc_notify_users(struct fastrpc_user *user)
+{
+	struct fastrpc_invoke_ctx *ctx;
+
+	spin_lock(&user->lock);
+	list_for_each_entry(ctx, &user->pending, node) {
+		ctx->retval = -EPIPE;
+		ctx->is_work_done = true;
+		complete(&ctx->work);
+	}
+	spin_unlock(&user->lock);
+}
+
+static void fastrpc_notify_pdr_drivers(struct fastrpc_channel_ctx *cctx,
+		char *servloc_name)
+{
+	struct fastrpc_user *fl;
+	unsigned long flags;
+
+	spin_lock_irqsave(&cctx->lock, flags);
+	list_for_each_entry(fl, &cctx->users, user) {
+		if (fl->servloc_name && !strcmp(servloc_name, fl->servloc_name))
+			fastrpc_notify_users(fl);
+	}
+	spin_unlock_irqrestore(&cctx->lock, flags);
+}
+
+static void fastrpc_pdr_cb(int state, char *service_path, void *priv)
+{
+	struct fastrpc_static_pd *spd = (struct fastrpc_static_pd *)priv;
+	unsigned long flags;
+
+	if (!spd)
+		return;
+
+	switch (state) {
+	case SERVREG_SERVICE_STATE_DOWN:
+		dev_info(&spd->cctx->rpdev->dev,
+			"%s: %s (%s) is down for PDR on %s\n",
+			__func__, spd->spdname,
+			spd->servloc_name,
+			domains[spd->domain]);
+		spin_lock_irqsave(&spd->cctx->lock, flags);
+		spd->pdrcount++;
+		atomic_set(&spd->ispdup, 0);
+		spin_unlock_irqrestore(&spd->cctx->lock, flags);
+		if (!strcmp(spd->servloc_name,
+				AUDIO_PDR_SERVICE_LOCATION_CLIENT_NAME))
+			spd->cctx->staticpd_status = false;
+
+		fastrpc_notify_pdr_drivers(spd->cctx, spd->servloc_name);
+		break;
+	case SERVREG_SERVICE_STATE_UP:
+		dev_info(&spd->cctx->rpdev->dev,
+			"%s: %s (%s) is up for PDR on %s\n",
+			__func__, spd->spdname,
+			spd->servloc_name,
+			domains[spd->domain]);
+		atomic_set(&spd->ispdup, 1);
+		break;
+	default:
+		break;
+	}
+}
+
 static const struct file_operations fastrpc_fops = {
 	.open = fastrpc_device_open,
 	.release = fastrpc_device_release,
@@ -2161,6 +2841,7 @@
 	sess->used = false;
 	sess->valid = true;
 	sess->dev = dev;
+	mutex_init(&sess->map_mutex);
 	dev_set_drvdata(dev, sess);
 
 	if (of_property_read_u32(dev->of_node, "reg", &sess->sid))
@@ -2174,6 +2855,7 @@
 				break;
 			dup_sess = &cctx->session[cctx->sesscount++];
 			memcpy(dup_sess, sess, sizeof(*dup_sess));
+			mutex_init(&dup_sess->map_mutex);
 		}
 	}
 	spin_unlock_irqrestore(&cctx->lock, flags);
@@ -2196,6 +2878,11 @@
 	spin_lock_irqsave(&cctx->lock, flags);
 	for (i = 0; i < FASTRPC_MAX_SESSIONS; i++) {
 		if (cctx->session[i].sid == sess->sid) {
+			spin_unlock_irqrestore(&cctx->lock, flags);
+			mutex_lock(&cctx->session[i].map_mutex);
+			cctx->session[i].dev = NULL;
+			mutex_unlock(&cctx->session[i].map_mutex);
+			spin_lock_irqsave(&cctx->lock, flags);
 			cctx->session[i].valid = false;
 			cctx->sesscount--;
 		}
@@ -2250,6 +2937,40 @@
 	return err;
 }
 
+static int fastrpc_setup_service_locator(struct fastrpc_channel_ctx *cctx, char *client_name,
+			char *service_name, char *service_path, int domain, int spd_session)
+{
+	int err = 0;
+	struct pdr_handle *handle = NULL;
+	struct pdr_service *service = NULL;
+
+	/* Register the service locator's callback function */
+	handle = pdr_handle_alloc(fastrpc_pdr_cb, &cctx->spd[spd_session]);
+	if (IS_ERR(handle)) {
+		err = PTR_ERR(handle);
+		goto bail;
+	}
+	cctx->spd[spd_session].domain = domain;
+	cctx->spd[spd_session].pdrhandle = handle;
+	cctx->spd[spd_session].servloc_name = client_name;
+	cctx->spd[spd_session].spdname = service_path;
+	cctx->spd[spd_session].cctx = cctx;
+	service = pdr_add_lookup(handle, service_name, service_path);
+	if (IS_ERR(service)) {
+		err = PTR_ERR(service);
+		goto bail;
+	}
+	pr_info("fastrpc: %s: pdr_add_lookup enabled for %s (%s, %s)\n",
+		__func__, service_name, client_name, service_path);
+
+bail:
+	if (err) {
+		pr_warn("fastrpc: %s: failed for %s (%s, %s)with err %d\n",
+				__func__, service_name, client_name, service_path, err);
+	}
+	return err;
+}
+
 static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev)
 {
 	struct device *rdev = &rpdev->dev;
@@ -2265,7 +2986,7 @@
 		return err;
 	}
 
-	for (i = 0; i <= CDSP_DOMAIN_ID; i++) {
+	for (i = 0; i < FASTRPC_DEV_MAX; i++) {
 		if (!strcmp(domains[i], domain)) {
 			domain_id = i;
 			break;
@@ -2306,13 +3027,14 @@
 	case ADSP_DOMAIN_ID:
 	case MDSP_DOMAIN_ID:
 	case SDSP_DOMAIN_ID:
-		/* Unsigned PD offloading is only supported on CDSP*/
+		/* Unsigned PD offloading is only supported on CDSP and CDSP1 */
 		data->unsigned_support = false;
 		err = fastrpc_device_register(rdev, data, secure_dsp, domains[domain_id]);
 		if (err)
 			goto fdev_error;
 		break;
 	case CDSP_DOMAIN_ID:
+	case CDSP1_DOMAIN_ID:
 		data->unsigned_support = true;
 		/* Create both device nodes so that we can allow both Signed and Unsigned PD */
 		err = fastrpc_device_register(rdev, data, true, domains[domain_id]);
@@ -2328,22 +3050,42 @@
 		goto fdev_error;
 	}
 
+	if (domain_id == ADSP_DOMAIN_ID) {
+		err = fastrpc_setup_service_locator(data, AUDIO_PDR_SERVICE_LOCATION_CLIENT_NAME,
+			AUDIO_PDR_ADSP_SERVICE_NAME, ADSP_AUDIOPD_NAME, domain_id, 0);
+		if (err)
+			return err;
+
+		err = fastrpc_setup_service_locator(data,
+			SENSORS_PDR_ADSP_SERVICE_LOCATION_CLIENT_NAME,
+			SENSORS_PDR_ADSP_SERVICE_NAME, ADSP_SENSORPD_NAME, domain_id, 1);
+		if (err)
+			return err;
+	} else if (domain_id == SDSP_DOMAIN_ID) {
+		err = fastrpc_setup_service_locator(data,
+			SENSORS_PDR_SLPI_SERVICE_LOCATION_CLIENT_NAME,
+			SENSORS_PDR_SLPI_SERVICE_NAME, SLPI_SENSORPD_NAME, domain_id, 0);
+		if (err)
+			return err;
+	}
+
 	kref_init(&data->refcount);
 
 	dev_set_drvdata(&rpdev->dev, data);
 	rdev->dma_mask = &data->dma_mask;
 	dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32));
 	INIT_LIST_HEAD(&data->users);
-	INIT_LIST_HEAD(&data->invoke_interrupted_mmaps);
+	INIT_LIST_HEAD(&data->rhmaps);
 	spin_lock_init(&data->lock);
 	idr_init(&data->ctx_idr);
 	data->domain_id = domain_id;
-	data->rpdev = rpdev;
 
 	err = of_platform_populate(rdev->of_node, NULL, NULL, rdev);
 	if (err)
 		goto populate_error;
 
+	data->rpdev = rpdev;
+
 	return 0;
 
 populate_error:
@@ -2357,46 +3099,35 @@
 	return err;
 }
 
-static void fastrpc_notify_users(struct fastrpc_user *user)
-{
-	struct fastrpc_invoke_ctx *ctx;
-
-	spin_lock(&user->lock);
-	list_for_each_entry(ctx, &user->pending, node) {
-		ctx->retval = -EPIPE;
-		complete(&ctx->work);
-	}
-	spin_unlock(&user->lock);
-}
-
 static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev)
 {
 	struct fastrpc_channel_ctx *cctx = dev_get_drvdata(&rpdev->dev);
-	struct fastrpc_buf *buf, *b;
 	struct fastrpc_user *user;
 	unsigned long flags;
 
 	/* No invocations past this point */
 	spin_lock_irqsave(&cctx->lock, flags);
 	cctx->rpdev = NULL;
+	cctx->staticpd_status = false;
 	list_for_each_entry(user, &cctx->users, user)
 		fastrpc_notify_users(user);
 	spin_unlock_irqrestore(&cctx->lock, flags);
 
+	if (cctx->domain_id == ADSP_DOMAIN_ID) {
+		pdr_handle_release(cctx->spd[0].pdrhandle);
+		pdr_handle_release(cctx->spd[1].pdrhandle);
+	} else if (cctx->domain_id == SDSP_DOMAIN_ID) {
+		pdr_handle_release(cctx->spd[0].pdrhandle);
+	}
+
 	if (cctx->fdevice)
 		misc_deregister(&cctx->fdevice->miscdev);
 
 	if (cctx->secure_fdevice)
 		misc_deregister(&cctx->secure_fdevice->miscdev);
 
-	list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node)
-		list_del(&buf->node);
-
-	if (cctx->remote_heap)
-		fastrpc_buf_free(cctx->remote_heap);
-
 	of_platform_depopulate(&rpdev->dev);
-
+	fastrpc_mmap_remove_ssr(cctx);
 	fastrpc_channel_ctx_put(cctx);
 }
 
@@ -2412,27 +3143,21 @@
 	if (len < sizeof(*rsp))
 		return -EINVAL;
 
-	ctxid = ((rsp->ctx & FASTRPC_CTXID_MASK) >> 4);
+	ctxid = ((rsp->ctx & FASTRPC_CTXID_MASK) >> 16);
 
 	spin_lock_irqsave(&cctx->lock, flags);
 	ctx = idr_find(&cctx->ctx_idr, ctxid);
 	spin_unlock_irqrestore(&cctx->lock, flags);
 
 	if (!ctx) {
-		dev_err(&rpdev->dev, "No context ID matches response\n");
-		return -ENOENT;
+		dev_dbg(&rpdev->dev, "No context ID matches response\n");
+		return 0;
 	}
 
 	ctx->retval = rsp->retval;
+	ctx->is_work_done = true;
 	complete(&ctx->work);
 
-	/*
-	 * The DMA buffer associated with the context cannot be freed in
-	 * interrupt context so schedule it through a worker thread to
-	 * avoid a kernel BUG.
-	 */
-	schedule_work(&ctx->put_work);
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/misc/lkdtm/Makefile
+++ linux-qcom-6.8.0/drivers/misc/lkdtm/Makefile
@@ -19,7 +19,7 @@
 KCSAN_SANITIZE_rodata.o			:= n
 KCOV_INSTRUMENT_rodata.o		:= n
 OBJECT_FILES_NON_STANDARD_rodata.o	:= y
-CFLAGS_REMOVE_rodata.o			+= $(CC_FLAGS_LTO) $(RETHUNK_CFLAGS)
+CFLAGS_REMOVE_rodata.o			+= $(CC_FLAGS_LTO) $(RETHUNK_CFLAGS) $(CC_FLAGS_CFI)
 
 OBJCOPYFLAGS :=
 OBJCOPYFLAGS_rodata_objcopy.o	:= \
--- linux-qcom-6.8.0.orig/drivers/misc/lkdtm/bugs.c
+++ linux-qcom-6.8.0/drivers/misc/lkdtm/bugs.c
@@ -415,8 +415,8 @@
 
 	pr_err("FAIL: survived access of invalid flexible array member index!\n");
 
-	if (!__has_attribute(__counted_by__))
-		pr_warn("This is expected since this %s was built a compiler supporting __counted_by\n",
+	if (!IS_ENABLED(CONFIG_CC_HAS_COUNTED_BY))
+		pr_warn("This is expected since this %s was built with a compiler that does not support __counted_by\n",
 			lkdtm_kernel_info);
 	else if (IS_ENABLED(CONFIG_UBSAN_BOUNDS))
 		pr_expected_config(CONFIG_UBSAN_TRAP);
--- linux-qcom-6.8.0.orig/drivers/misc/lkdtm/perms.c
+++ linux-qcom-6.8.0/drivers/misc/lkdtm/perms.c
@@ -61,7 +61,7 @@
 	return fdesc;
 }
 
-static noinline void execute_location(void *dst, bool write)
+static noinline __nocfi void execute_location(void *dst, bool write)
 {
 	void (*func)(void);
 	func_desc_t fdesc;
--- linux-qcom-6.8.0.orig/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
+++ linux-qcom-6.8.0/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
@@ -69,8 +69,10 @@
 
 	aux_bus->aux_device_wrapper[1] = kzalloc(sizeof(*aux_bus->aux_device_wrapper[1]),
 						 GFP_KERNEL);
-	if (!aux_bus->aux_device_wrapper[1])
-		return -ENOMEM;
+	if (!aux_bus->aux_device_wrapper[1]) {
+		retval =  -ENOMEM;
+		goto err_aux_dev_add_0;
+	}
 
 	retval = ida_alloc(&gp_client_ida, GFP_KERNEL);
 	if (retval < 0)
@@ -111,6 +113,7 @@
 
 err_aux_dev_add_1:
 	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
+	goto err_aux_dev_add_0;
 
 err_aux_dev_init_1:
 	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
@@ -120,6 +123,7 @@
 
 err_aux_dev_add_0:
 	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
+	goto err_ret;
 
 err_aux_dev_init_0:
 	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
@@ -127,6 +131,7 @@
 err_ida_alloc_0:
 	kfree(aux_bus->aux_device_wrapper[0]);
 
+err_ret:
 	return retval;
 }
 
--- linux-qcom-6.8.0.orig/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c
+++ linux-qcom-6.8.0/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c
@@ -148,7 +148,7 @@
 		pci1xxx_assign_bit(priv->reg_base, OPENDRAIN_OFFSET(offset), (offset % 32), true);
 		break;
 	default:
-		ret = -EOPNOTSUPP;
+		ret = -ENOTSUPP;
 		break;
 	}
 	spin_unlock_irqrestore(&priv->lock, flags);
@@ -277,7 +277,7 @@
 			writel(BIT(bit), priv->reg_base + INTR_STATUS_OFFSET(gpiobank));
 			spin_unlock_irqrestore(&priv->lock, flags);
 			irq = irq_find_mapping(gc->irq.domain, (bit + (gpiobank * 32)));
-			generic_handle_irq(irq);
+			handle_nested_irq(irq);
 		}
 	}
 	spin_lock_irqsave(&priv->lock, flags);
--- linux-qcom-6.8.0.orig/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c
+++ linux-qcom-6.8.0/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c
@@ -153,7 +153,6 @@
 
 		buf[byte] = readl(rb + MMAP_EEPROM_OFFSET(EEPROM_DATA_REG));
 	}
-	ret = byte;
 error:
 	release_sys_lock(priv);
 	return ret;
@@ -197,7 +196,6 @@
 			goto error;
 		}
 	}
-	ret = byte;
 error:
 	release_sys_lock(priv);
 	return ret;
@@ -258,7 +256,6 @@
 
 		buf[byte] = readl(rb + MMAP_OTP_OFFSET(OTP_RD_DATA_OFFSET));
 	}
-	ret = byte;
 error:
 	release_sys_lock(priv);
 	return ret;
@@ -315,7 +312,6 @@
 			goto error;
 		}
 	}
-	ret = byte;
 error:
 	release_sys_lock(priv);
 	return ret;
@@ -368,6 +364,7 @@
 	if (is_eeprom_responsive(priv)) {
 		priv->nvmem_config_eeprom.type = NVMEM_TYPE_EEPROM;
 		priv->nvmem_config_eeprom.name = EEPROM_NAME;
+		priv->nvmem_config_eeprom.id = NVMEM_DEVID_AUTO;
 		priv->nvmem_config_eeprom.dev = &aux_dev->dev;
 		priv->nvmem_config_eeprom.owner = THIS_MODULE;
 		priv->nvmem_config_eeprom.reg_read = pci1xxxx_eeprom_read;
@@ -387,6 +384,7 @@
 
 	priv->nvmem_config_otp.type = NVMEM_TYPE_OTP;
 	priv->nvmem_config_otp.name = OTP_NAME;
+	priv->nvmem_config_otp.id = NVMEM_DEVID_AUTO;
 	priv->nvmem_config_otp.dev = &aux_dev->dev;
 	priv->nvmem_config_otp.owner = THIS_MODULE;
 	priv->nvmem_config_otp.reg_read = pci1xxxx_otp_read;
--- linux-qcom-6.8.0.orig/drivers/misc/mei/client.c
+++ linux-qcom-6.8.0/drivers/misc/mei/client.c
@@ -321,7 +321,7 @@
 		return;
 
 	list_del(&cb->list);
-	kfree(cb->buf.data);
+	kvfree(cb->buf.data);
 	kfree(cb->ext_hdr);
 	kfree(cb);
 }
@@ -497,7 +497,7 @@
 	if (length == 0)
 		return cb;
 
-	cb->buf.data = kmalloc(roundup(length, MEI_SLOT_SIZE), GFP_KERNEL);
+	cb->buf.data = kvmalloc(roundup(length, MEI_SLOT_SIZE), GFP_KERNEL);
 	if (!cb->buf.data) {
 		mei_io_cb_free(cb);
 		return NULL;
--- linux-qcom-6.8.0.orig/drivers/misc/mei/hw-me-regs.h
+++ linux-qcom-6.8.0/drivers/misc/mei/hw-me-regs.h
@@ -115,6 +115,8 @@
 #define MEI_DEV_ID_ARL_S      0x7F68  /* Arrow Lake Point S */
 #define MEI_DEV_ID_ARL_H      0x7770  /* Arrow Lake Point H */
 
+#define MEI_DEV_ID_LNL_M      0xA870  /* Lunar Lake Point M */
+
 /*
  * MEI HW Section
  */
--- linux-qcom-6.8.0.orig/drivers/misc/mei/main.c
+++ linux-qcom-6.8.0/drivers/misc/mei/main.c
@@ -329,7 +329,7 @@
 	}
 
 	if (!mei_cl_is_connected(cl)) {
-		cl_err(dev, cl, "is not connected");
+		cl_dbg(dev, cl, "is not connected");
 		rets = -ENODEV;
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/drivers/misc/mei/pci-me.c
+++ linux-qcom-6.8.0/drivers/misc/mei/pci-me.c
@@ -24,6 +24,9 @@
 #include "hw-me-regs.h"
 #include "hw-me.h"
 
+static bool disable_msi;
+module_param(disable_msi, bool, 0);
+
 /* mei_pci_tbl - PCI Device ID Table */
 static const struct pci_device_id mei_me_pci_tbl[] = {
 	{MEI_PCI_DEVICE(MEI_DEV_ID_82946GZ, MEI_ME_ICH_CFG)},
@@ -116,12 +119,14 @@
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ADP_P, MEI_ME_PCH15_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ADP_N, MEI_ME_PCH15_CFG)},
 
-	{MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)},
+	{MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_SPS_CFG)},
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ARL_H, MEI_ME_PCH15_CFG)},
 
+	{MEI_PCI_DEVICE(MEI_DEV_ID_LNL_M, MEI_ME_PCH15_CFG)},
+
 	/* required last entry */
 	{0, }
 };
@@ -216,7 +221,8 @@
 	hw->mem_addr = pcim_iomap_table(pdev)[0];
 	hw->read_fws = mei_me_read_fws;
 
-	pci_enable_msi(pdev);
+	if (!disable_msi)
+		pci_enable_msi(pdev);
 
 	hw->irq = pdev->irq;
 
@@ -398,8 +404,10 @@
 	}
 
 	err = mei_restart(dev);
-	if (err)
+	if (err) {
+		free_irq(pdev->irq, dev);
 		return err;
+	}
 
 	/* Start timer if stopped in suspend */
 	schedule_delayed_work(&dev->timer_work, HZ);
--- linux-qcom-6.8.0.orig/drivers/misc/mei/platform-vsc.c
+++ linux-qcom-6.8.0/drivers/misc/mei/platform-vsc.c
@@ -28,8 +28,8 @@
 
 #define MEI_VSC_MAX_MSG_SIZE		512
 
-#define MEI_VSC_POLL_DELAY_US		(50 * USEC_PER_MSEC)
-#define MEI_VSC_POLL_TIMEOUT_US		(200 * USEC_PER_MSEC)
+#define MEI_VSC_POLL_DELAY_US		(100 * USEC_PER_MSEC)
+#define MEI_VSC_POLL_TIMEOUT_US		(400 * USEC_PER_MSEC)
 
 #define mei_dev_to_vsc_hw(dev)		((struct mei_vsc_hw *)((dev)->hw))
 
@@ -401,24 +401,30 @@
 
 static int mei_vsc_suspend(struct device *dev)
 {
-	struct mei_device *mei_dev = dev_get_drvdata(dev);
+	struct mei_device *mei_dev;
+	int ret = 0;
 
-	mei_stop(mei_dev);
+	mei_dev = dev_get_drvdata(dev);
+	if (!mei_dev)
+		return -ENODEV;
 
-	return 0;
+	mutex_lock(&mei_dev->device_lock);
+
+	if (!mei_write_is_idle(mei_dev))
+		ret = -EAGAIN;
+
+	mutex_unlock(&mei_dev->device_lock);
+
+	return ret;
 }
 
 static int mei_vsc_resume(struct device *dev)
 {
-	struct mei_device *mei_dev = dev_get_drvdata(dev);
-	int ret;
-
-	ret = mei_restart(mei_dev);
-	if (ret)
-		return ret;
+	struct mei_device *mei_dev;
 
-	/* start timer if stopped in suspend */
-	schedule_delayed_work(&mei_dev->timer_work, HZ);
+	mei_dev = dev_get_drvdata(dev);
+	if (!mei_dev)
+		return -ENODEV;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/misc/mei/vsc-fw-loader.c
+++ linux-qcom-6.8.0/drivers/misc/mei/vsc-fw-loader.c
@@ -252,7 +252,7 @@
 {
 	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER };
 	union acpi_object obj = {
-		.type = ACPI_TYPE_INTEGER,
+		.integer.type = ACPI_TYPE_INTEGER,
 		.integer.value = 1,
 	};
 	struct acpi_object_list arg_list = {
--- linux-qcom-6.8.0.orig/drivers/misc/mei/vsc-tp.c
+++ linux-qcom-6.8.0/drivers/misc/mei/vsc-tp.c
@@ -25,7 +25,8 @@
 #define VSC_TP_ROM_BOOTUP_DELAY_MS		10
 #define VSC_TP_ROM_XFER_POLL_TIMEOUT_US		(500 * USEC_PER_MSEC)
 #define VSC_TP_ROM_XFER_POLL_DELAY_US		(20 * USEC_PER_MSEC)
-#define VSC_TP_WAIT_FW_ASSERTED_TIMEOUT		(2 * HZ)
+#define VSC_TP_WAIT_FW_POLL_TIMEOUT		(2 * HZ)
+#define VSC_TP_WAIT_FW_POLL_DELAY_US		(20 * USEC_PER_MSEC)
 #define VSC_TP_MAX_XFER_COUNT			5
 
 #define VSC_TP_PACKET_SYNC			0x31
@@ -93,6 +94,27 @@
 	{}
 };
 
+static irqreturn_t vsc_tp_isr(int irq, void *data)
+{
+	struct vsc_tp *tp = data;
+
+	atomic_inc(&tp->assert_cnt);
+
+	wake_up(&tp->xfer_wait);
+
+	return IRQ_WAKE_THREAD;
+}
+
+static irqreturn_t vsc_tp_thread_isr(int irq, void *data)
+{
+	struct vsc_tp *tp = data;
+
+	if (tp->event_notify)
+		tp->event_notify(tp->event_notify_context);
+
+	return IRQ_HANDLED;
+}
+
 /* wakeup firmware and wait for response */
 static int vsc_tp_wakeup_request(struct vsc_tp *tp)
 {
@@ -101,13 +123,15 @@
 	gpiod_set_value_cansleep(tp->wakeupfw, 0);
 
 	ret = wait_event_timeout(tp->xfer_wait,
-				 atomic_read(&tp->assert_cnt) &&
-				 gpiod_get_value_cansleep(tp->wakeuphost),
-				 VSC_TP_WAIT_FW_ASSERTED_TIMEOUT);
+				 atomic_read(&tp->assert_cnt),
+				 VSC_TP_WAIT_FW_POLL_TIMEOUT);
 	if (!ret)
 		return -ETIMEDOUT;
 
-	return 0;
+	return read_poll_timeout(gpiod_get_value_cansleep, ret, ret,
+				 VSC_TP_WAIT_FW_POLL_DELAY_US,
+				 VSC_TP_WAIT_FW_POLL_TIMEOUT, false,
+				 tp->wakeuphost);
 }
 
 static void vsc_tp_wakeup_release(struct vsc_tp *tp)
@@ -307,12 +331,12 @@
 		return ret;
 	}
 
-	ret = vsc_tp_dev_xfer(tp, tp->tx_buf, tp->rx_buf, len);
+	ret = vsc_tp_dev_xfer(tp, tp->tx_buf, ibuf ? tp->rx_buf : ibuf, len);
 	if (ret)
 		return ret;
 
 	if (ibuf)
-		cpu_to_be32_array(ibuf, tp->rx_buf, words);
+		be32_to_cpu_array(ibuf, tp->rx_buf, words);
 
 	return ret;
 }
@@ -381,6 +405,37 @@
 EXPORT_SYMBOL_NS_GPL(vsc_tp_register_event_cb, VSC_TP);
 
 /**
+ * vsc_tp_request_irq - request irq for vsc_tp device
+ * @tp: vsc_tp device handle
+ */
+int vsc_tp_request_irq(struct vsc_tp *tp)
+{
+	struct spi_device *spi = tp->spi;
+	struct device *dev = &spi->dev;
+	int ret;
+
+	irq_set_status_flags(spi->irq, IRQ_DISABLE_UNLAZY);
+	ret = request_threaded_irq(spi->irq, vsc_tp_isr, vsc_tp_thread_isr,
+				   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+				   dev_name(dev), tp);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+EXPORT_SYMBOL_NS_GPL(vsc_tp_request_irq, VSC_TP);
+
+/**
+ * vsc_tp_free_irq - free irq for vsc_tp device
+ * @tp: vsc_tp device handle
+ */
+void vsc_tp_free_irq(struct vsc_tp *tp)
+{
+	free_irq(tp->spi->irq, tp);
+}
+EXPORT_SYMBOL_NS_GPL(vsc_tp_free_irq, VSC_TP);
+
+/**
  * vsc_tp_intr_synchronize - synchronize vsc_tp interrupt
  * @tp: vsc_tp device handle
  */
@@ -410,27 +465,6 @@
 }
 EXPORT_SYMBOL_NS_GPL(vsc_tp_intr_disable, VSC_TP);
 
-static irqreturn_t vsc_tp_isr(int irq, void *data)
-{
-	struct vsc_tp *tp = data;
-
-	atomic_inc(&tp->assert_cnt);
-
-	wake_up(&tp->xfer_wait);
-
-	return IRQ_WAKE_THREAD;
-}
-
-static irqreturn_t vsc_tp_thread_isr(int irq, void *data)
-{
-	struct vsc_tp *tp = data;
-
-	if (tp->event_notify)
-		tp->event_notify(tp->event_notify_context);
-
-	return IRQ_HANDLED;
-}
-
 static int vsc_tp_match_any(struct acpi_device *adev, void *data)
 {
 	struct acpi_device **__adev = data;
@@ -482,10 +516,9 @@
 	tp->spi = spi;
 
 	irq_set_status_flags(spi->irq, IRQ_DISABLE_UNLAZY);
-	ret = devm_request_threaded_irq(dev, spi->irq, vsc_tp_isr,
-					vsc_tp_thread_isr,
-					IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
-					dev_name(dev), tp);
+	ret = request_threaded_irq(spi->irq, vsc_tp_isr, vsc_tp_thread_isr,
+				   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+				   dev_name(dev), tp);
 	if (ret)
 		return ret;
 
@@ -519,6 +552,8 @@
 err_destroy_lock:
 	mutex_destroy(&tp->mutex);
 
+	free_irq(spi->irq, tp);
+
 	return ret;
 }
 
@@ -529,6 +564,21 @@
 	platform_device_unregister(tp->pdev);
 
 	mutex_destroy(&tp->mutex);
+
+	free_irq(spi->irq, tp);
+}
+
+static void vsc_tp_shutdown(struct spi_device *spi)
+{
+	struct vsc_tp *tp = spi_get_drvdata(spi);
+
+	platform_device_unregister(tp->pdev);
+
+	mutex_destroy(&tp->mutex);
+
+	vsc_tp_reset(tp);
+
+	free_irq(spi->irq, tp);
 }
 
 static const struct acpi_device_id vsc_tp_acpi_ids[] = {
@@ -543,6 +593,7 @@
 static struct spi_driver vsc_tp_driver = {
 	.probe = vsc_tp_probe,
 	.remove = vsc_tp_remove,
+	.shutdown = vsc_tp_shutdown,
 	.driver = {
 		.name = "vsc-tp",
 		.acpi_match_table = vsc_tp_acpi_ids,
--- linux-qcom-6.8.0.orig/drivers/misc/mei/vsc-tp.h
+++ linux-qcom-6.8.0/drivers/misc/mei/vsc-tp.h
@@ -37,6 +37,9 @@
 int vsc_tp_register_event_cb(struct vsc_tp *tp, vsc_tp_event_cb_t event_cb,
 			     void *context);
 
+int vsc_tp_request_irq(struct vsc_tp *tp);
+void vsc_tp_free_irq(struct vsc_tp *tp);
+
 void vsc_tp_intr_enable(struct vsc_tp *tp);
 void vsc_tp_intr_disable(struct vsc_tp *tp);
 void vsc_tp_intr_synchronize(struct vsc_tp *tp);
--- linux-qcom-6.8.0.orig/drivers/misc/pvpanic/pvpanic-pci.c
+++ linux-qcom-6.8.0/drivers/misc/pvpanic/pvpanic-pci.c
@@ -44,8 +44,6 @@
 	.name =         "pvpanic-pci",
 	.id_table =     pvpanic_pci_id_tbl,
 	.probe =        pvpanic_pci_probe,
-	.driver = {
-		.dev_groups = pvpanic_dev_groups,
-	},
+	.dev_groups =   pvpanic_dev_groups,
 };
 module_pci_driver(pvpanic_pci_driver);
--- linux-qcom-6.8.0.orig/drivers/misc/qcom-dcc.c
+++ linux-qcom-6.8.0/drivers/misc/qcom-dcc.c
@@ -0,0 +1,1561 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/*
+ * DCC(Data Capture and Compare) is a DMA engine designed for debugging
+ * purposes.
+ * In case of a system crash or manual software triggers by the user the
+ * DCC hardware stores the value at the register addresses which can be
+ * used for debugging purposes.
+ * The DCC driver provides the user with debugfs interface to configure the
+ * register addresses. The options that the DCC hardware provides include
+ * reading from registers, writing to registers, first reading and then
+ * writing to registers and looping through the values of the same
+ * register.
+ *
+ * In certain cases a register write needs to be executed for accessing the
+ * rest of the registers, also the user might want to record the changing
+ * values of a register with time for which he has the option to use the
+ * loop feature.
+ *
+ * The options mentioned above are exposed to the user by debugfs files
+ * once the driver is probed. The details and usage of this debugfs files
+ * are documented in Documentation/ABI/testing/debugfs-driver-dcc.
+ *
+ * As an example let us consider a couple of debug scenarios where DCC has
+ * been proved to be effective for debugging purposes:-
+ *
+ * i)TimeStamp Related Issue
+ *
+ * On SC7180, there was a coresight timestamp issue where it would
+ * occasionally be all 0 instead of proper timestamp values.
+ *
+ * Proper timestamp:
+ * Idx:3373; ID:10; I_TIMESTAMP : Timestamp.; Updated val =
+ * 0x13004d8f5b7aa; CC=0x9e
+ *
+ * Zero timestamp:
+ * Idx:3387; ID:10; I_TIMESTAMP : Timestamp.; Updated val = 0x0; CC=0xa2
+ *
+ * Now this is a non-fatal issue and doesn't need a system reset, but still
+ * needs to be rootcaused and fixed for those who do care about coresight
+ * etm traces.
+ * Since this is a timestamp issue, we would be looking for any timestamp
+ * related clocks and such.
+ *
+ * We get all the clk register details from IP documentation and configure
+ * it via DCC config debugfs node. Before that we set the current
+ * linked list.
+ *
+ * Program the linked list with the addresses
+ * echo R 0x10c004 > /sys/kernel/debug/qcom-dcc/../3/config
+ * echo R 0x10c008 > /sys/kernel/debug/qcom-dcc/../3/config
+ * echo R 0x10c00c > /sys/kernel/debug/qcom-dcc/../3/config
+ * echo R 0x10c010 > /sys/kernel/debug/qcom-dcc/../3/config
+ * ..... and so on for other timestamp related clk registers
+ *
+ * Other way of specifying is in "addr len" pair, in below case it
+ * specifies to capture 4 words starting 0x10C004
+ *
+ * echo R 0x10C004 4 > /sys/kernel/debug/qcom-dcc/../3/config
+ *
+ * Configuration can be saved to a file and reuse it later.
+ * cat /sys/kernel/debug/qcom-dcc/../3/config > config_3
+ * Post reboot, write the file to config.
+ * echo config_3 > /sys/kernel/debug/qcom-dcc/../3/config
+ *
+ * Enable DCC
+ * echo 1 > /sys/kernel/debug/qcom-dcc/../3/enable
+ *
+ * Run the timestamp test for working case
+ *
+ * Send SW trigger
+ * echo 1 > /sys/kernel/debug/qcom-dcc/../trigger
+ *
+ * Read SRAM
+ * cat /dev/dcc_sram > dcc_sram1.bin
+ *
+ * Run the timestamp test for non-working case
+ *
+ * Send SW trigger
+ * echo 1 > /sys/kernel/debug/qcom-dcc/../trigger
+ *
+ * Read SRAM
+ * cat /dev/dcc_sram > dcc_sram2.bin
+ *
+ * Get the parser from
+ * https://git.codelinaro.org/clo/le/platform/vendor/qcom-opensource/tools/-/tree/opensource-tools.lnx.1.0.r176-rel/dcc_parser
+ *
+ * Parse the SRAM bin
+ * python dcc_parser.py -s dcc_sram1.bin --v2 -o output/ python
+ * dcc_parser.py -s dcc_sram2.bin --v2 -o output/
+ *
+ * Sample parsed output of dcc_sram1.bin:
+ *
+ * <hwioDump version="1">
+ *        <timestamp>03/14/21</timestamp>
+ *            <generator>Linux DCC Parser</generator>
+ *                <chip name="None" version="None">
+ *                <register address="0x0010c004" value="0x80000000" />
+ *                <register address="0x0010c008" value="0x00000008" />
+ *                <register address="0x0010c00c" value="0x80004220" />
+ *                <register address="0x0010c010" value="0x80000000" />
+ *            </chip>
+ *    <next_ll_offset>next_ll_offset : 0x1c </next_ll_offset> </hwioDump>
+ *
+ * ii)NOC register errors
+ *
+ * A particular class of registers called NOC which are functional
+ * registers was reporting errors while logging the values.To trace these
+ * errors the DCC has been used effectively.
+ * The steps followed were similar to the ones mentioned above.
+ * In addition to NOC registers a few other dependent registers were
+ * configured in DCC to monitor it's values during a crash. A look at the
+ * dependent register values revealed that the crash was happening due to a
+ * secured access to one of these dependent registers.
+ * All these debugging activity and finding the root cause was achieved
+ * using DCC.
+ */
+
+#include <linux/bitfield.h>
+#include <linux/bitops.h>
+#include <linux/debugfs.h>
+#include <linux/delay.h>
+#include <linux/fs.h>
+#include <linux/io.h>
+#include <linux/iopoll.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#define STATUS_READY_TIMEOUT		5000  /* microseconds */
+
+/* DCC registers */
+#define DCC_HW_INFO			0x04
+#define DCC_LL_NUM_INFO			0x10
+#define DCC_LL_LOCK			0x00
+#define DCC_LL_CFG			0x04
+#define DCC_LL_BASE			0x08
+#define DCC_FD_BASE			0x0c
+#define DCC_LL_OFFSET                   0x80
+#define DCC_LL_TIMEOUT			0x10
+#define DCC_LL_INT_ENABLE		0x18
+#define DCC_LL_INT_STATUS		0x1c
+#define DCC_LL_SW_TRIGGER		0x2c
+#define DCC_LL_BUS_ACCESS_STATUS	0x30
+
+/* Default value used if a bit 6 in the HW_INFO register is set. */
+#define DCC_FIX_LOOP_OFFSET		16
+
+/* Mask to find version info from HW_Info register */
+#define DCC_VER_INFO_MASK		BIT(9)
+
+#define MAX_DCC_OFFSET			GENMASK(9, 2)
+#define MAX_DCC_LEN			GENMASK(6, 0)
+#define MAX_LOOP_CNT			GENMASK(7, 0)
+#define MAX_LOOP_ADDR			10
+
+#define DCC_ADDR_DESCRIPTOR		0x00
+#define DCC_ADDR_LIMIT			27
+#define DCC_WORD_SIZE			sizeof(u32)
+#define DCC_ADDR_RANGE_MASK		GENMASK(31, 4)
+#define DCC_LOOP_DESCRIPTOR		BIT(30)
+#define DCC_RD_MOD_WR_DESCRIPTOR	BIT(31)
+#define DCC_LINK_DESCRIPTOR		GENMASK(31, 30)
+#define DCC_STATUS_MASK			GENMASK(1, 0)
+#define DCC_LOCK_MASK			BIT(0)
+#define DCC_LOOP_OFFSET_MASK		BIT(6)
+#define DCC_TRIGGER_MASK		BIT(9)
+
+#define DCC_WRITE_MASK			BIT(15)
+#define DCC_WRITE_OFF_MASK		GENMASK(7, 0)
+#define DCC_WRITE_LEN_MASK		GENMASK(14, 8)
+
+#define DCC_READ_IND			0x00
+#define DCC_WRITE_IND			(BIT(28))
+
+#define DCC_AHB_IND			0x00
+#define DCC_APB_IND			BIT(29)
+
+#define DCC_MAX_LINK_LIST		8
+
+#define DCC_VER_MASK2			GENMASK(5, 0)
+
+#define DCC_SRAM_WORD_LENGTH		4
+
+#define DCC_RD_MOD_WR_ADDR              0xC105E
+
+#define MEM_MAP_VER1			0x1
+#define MEM_MAP_VER2			0x2
+#define MEM_MAP_VER3			0x3
+
+#define LINE_BUFFER_MAX_SZ		50
+enum dcc_descriptor_type {
+	DCC_READ_TYPE,
+	DCC_LOOP_TYPE,
+	DCC_READ_WRITE_TYPE,
+	DCC_WRITE_TYPE
+};
+
+/**
+ * struct dcc_config_entry - configuration information related to each dcc instruction
+ * @base:                    Base address of the register to be configured in dcc
+ * @offset:                  Offset to the base address to be configured in dcc
+ * @len:                     Length of the address in words of 4 bytes to be configured in dcc
+ * @loop_cnt:                The number of times to loop on the register address in case
+				of loop instructions
+ * @write_val:               The value to be written on the register address in case of
+				write instructions
+ * @mask:                    Mask corresponding to the value to be written in case of
+				write instructions
+ * @apb_bus:                 Type of bus to be used for the instruction, can be either
+				'apb' if 1 or 'ahb' if 0
+ * @desc_type:               Stores the type of dcc instruction
+ * @list:                    This is used to append this instruction to the list of
+				instructions
+ */
+struct dcc_config_entry {
+	u32				base;
+	u32				offset;
+	u32				len;
+	u32				loop_cnt;
+	u32				write_val;
+	u32				mask;
+	bool				apb_bus;
+	enum dcc_descriptor_type	desc_type;
+	struct list_head		list;
+};
+
+/**
+ * struct dcc_drvdata - configuration information related to a dcc device
+ * @base:		Base Address of the dcc device
+ * @dev:		The device attached to the driver data
+ * @mutex:		Lock to protect access and manipulation of dcc_drvdata
+ * @ram_base:		Base address for the SRAM dedicated for the dcc device
+ * @ram_size:		Total size of the SRAM dedicated for the dcc device
+ * @ram_offset:		Offset to the SRAM dedicated for dcc device
+ * @ram_cfg:		Used for address limit calculation for dcc
+ * @ram_start:		Starting address of DCC SRAM
+ * @mem_map_ver:        Memory map version of DCC hardware
+ * @sram_dev:		Miscellaneous device equivalent of dcc SRAM
+ * @cfg_head:		Points to the head of the linked list of addresses
+ * @dbg_dir:		The dcc debugfs directory under which all the debugfs files are placed
+ * @max_link_list:	Total number of linkedlists supported by the DCC configuration
+ * @loop_shift:		Loop offset bits range for the addresses
+ * @enable_bitmap:	Bitmap to capture the enabled status of each linked list of addresses
+ */
+struct dcc_drvdata {
+	void __iomem		*base;
+	void __iomem            *ram_base;
+	struct device		*dev;
+	/* Lock to protect access and manipulation of dcc_drvdata */
+	struct mutex		mutex;
+	size_t			ram_size;
+	u32			ram_offset;
+	unsigned int		ram_cfg;
+	unsigned int		ram_start;
+	u64			mem_map_ver;
+	struct miscdevice	sram_dev;
+	struct list_head	*cfg_head;
+	struct dentry		*dbg_dir;
+	size_t			max_link_list;
+	u8			loop_shift;
+	unsigned long		*enable_bitmap;
+	char			**temp_buff_ptr;
+};
+
+struct dcc_cfg_attr {
+	u32	addr;
+	u32	prev_addr;
+	u32	prev_off;
+	u32	link;
+	u32	sram_offset;
+};
+
+struct dcc_cfg_loop_attr {
+	u32	loop_cnt;
+	u32	loop_len;
+	u32	loop_off;
+	bool    loop_start;
+};
+
+static inline u32 dcc_status(int version)
+{
+	return version == 1 ? 0x0c : 0x1c;
+}
+
+static inline u32 dcc_list_offset(int version)
+{
+	if (version == 1)
+		return 0x1c;
+	else if (version == 2)
+		return 0x2c;
+	else
+		return 0x34;
+}
+
+static inline void dcc_list_writel(struct dcc_drvdata *drvdata,
+				   u32 val, u32 ll, u32 off)
+{
+	u32 offset = dcc_list_offset(drvdata->mem_map_ver) + off;
+
+	writel(val, drvdata->base + ll * DCC_LL_OFFSET + offset);
+}
+
+static inline u32 dcc_list_readl(struct dcc_drvdata *drvdata, u32 ll, u32 off)
+{
+	u32 offset = dcc_list_offset(drvdata->mem_map_ver) + off;
+
+	return readl(drvdata->base + ll * DCC_LL_OFFSET + offset);
+}
+
+static void dcc_sram_write_auto(struct dcc_drvdata *drvdata,
+				u32 val, u32 *off)
+{
+	/* If the overflow condition is met increment the offset
+	 * and return to indicate that overflow has occurred
+	 */
+	if (*off > drvdata->ram_size - 4) {
+		*off += 4;
+		return;
+	}
+
+	writel(val, drvdata->ram_base + *off);
+
+	*off += 4;
+}
+
+static int dcc_sw_trigger(struct dcc_drvdata *drvdata)
+{
+	void __iomem *addr;
+	int i;
+	u32 status;
+	u32 ll_cfg;
+	u32 tmp_ll_cfg;
+	u32 val;
+	int ret = 0;
+
+	mutex_lock(&drvdata->mutex);
+
+	for (i = 0; i < drvdata->max_link_list; i++) {
+		if (!test_bit(i, drvdata->enable_bitmap))
+			continue;
+		ll_cfg = dcc_list_readl(drvdata, i, DCC_LL_CFG);
+		if (drvdata->mem_map_ver == MEM_MAP_VER3)
+			tmp_ll_cfg = ll_cfg & ~BIT(8);
+		else
+			tmp_ll_cfg = ll_cfg & ~DCC_TRIGGER_MASK;
+
+		dcc_list_writel(drvdata, tmp_ll_cfg, i, DCC_LL_CFG);
+		dcc_list_writel(drvdata, 1, i, DCC_LL_SW_TRIGGER);
+		dcc_list_writel(drvdata, ll_cfg, i, DCC_LL_CFG);
+	}
+
+	addr = drvdata->base + dcc_status(drvdata->mem_map_ver);
+	if (readl_poll_timeout(addr, val, !FIELD_GET(DCC_STATUS_MASK, val),
+			       1, STATUS_READY_TIMEOUT)) {
+		dev_err(drvdata->dev, "DCC is busy after receiving sw trigger\n");
+		ret = -EBUSY;
+		goto out_unlock;
+	}
+
+	for (i = 0; i < drvdata->max_link_list; i++) {
+		if (!test_bit(i, drvdata->enable_bitmap))
+			continue;
+
+		status = dcc_list_readl(drvdata, i, DCC_LL_BUS_ACCESS_STATUS);
+		if (!status)
+			continue;
+
+		dev_err(drvdata->dev, "Read access error for list %d err: 0x%x\n",
+			i, status);
+		ll_cfg = dcc_list_readl(drvdata, i, DCC_LL_CFG);
+		if (drvdata->mem_map_ver == MEM_MAP_VER3)
+			tmp_ll_cfg = ll_cfg & ~BIT(8);
+		else
+			tmp_ll_cfg = ll_cfg & ~DCC_TRIGGER_MASK;
+
+		dcc_list_writel(drvdata, tmp_ll_cfg, i, DCC_LL_CFG);
+		dcc_list_writel(drvdata, DCC_STATUS_MASK, i, DCC_LL_BUS_ACCESS_STATUS);
+		dcc_list_writel(drvdata, ll_cfg, i, DCC_LL_CFG);
+		ret = -ENODATA;
+		break;
+	}
+
+out_unlock:
+	mutex_unlock(&drvdata->mutex);
+	return ret;
+}
+
+static void dcc_ll_cfg_reset_link(struct dcc_cfg_attr *cfg)
+{
+	cfg->addr = 0x00;
+	cfg->link = 0;
+	cfg->prev_off = 0;
+	cfg->prev_addr = cfg->addr;
+}
+
+static void dcc_emit_read_write(struct dcc_drvdata *drvdata,
+				struct dcc_config_entry *entry,
+				struct dcc_cfg_attr *cfg)
+{
+	if (cfg->link) {
+		/*
+		 * write new offset = 1 to continue
+		 * processing the list
+		 */
+
+		dcc_sram_write_auto(drvdata, cfg->link, &cfg->sram_offset);
+
+		/* Reset link and prev_off */
+		dcc_ll_cfg_reset_link(cfg);
+	}
+
+	cfg->addr = DCC_RD_MOD_WR_DESCRIPTOR;
+	dcc_sram_write_auto(drvdata, cfg->addr, &cfg->sram_offset);
+
+	dcc_sram_write_auto(drvdata, entry->mask, &cfg->sram_offset);
+
+	dcc_sram_write_auto(drvdata, entry->write_val, &cfg->sram_offset);
+
+	cfg->addr = 0;
+}
+
+static void dcc_emit_loop(struct dcc_drvdata *drvdata, struct dcc_config_entry *entry,
+			  struct dcc_cfg_attr *cfg,
+			  struct dcc_cfg_loop_attr *cfg_loop,
+			  u32 *total_len)
+{
+	int loop;
+
+	/* Check if we need to write link of prev entry */
+	if (cfg->link)
+		dcc_sram_write_auto(drvdata, cfg->link, &cfg->sram_offset);
+
+	if (cfg_loop->loop_start) {
+		loop = (cfg->sram_offset - cfg_loop->loop_off) / 4;
+		loop |= (cfg_loop->loop_cnt << drvdata->loop_shift) &
+				   GENMASK(DCC_ADDR_LIMIT, drvdata->loop_shift);
+		loop |= DCC_LOOP_DESCRIPTOR;
+		*total_len += (*total_len - cfg_loop->loop_len) * cfg_loop->loop_cnt;
+
+		dcc_sram_write_auto(drvdata, loop, &cfg->sram_offset);
+
+		cfg_loop->loop_start = false;
+		cfg_loop->loop_len = 0;
+		cfg_loop->loop_off = 0;
+	} else {
+		cfg_loop->loop_start = true;
+		cfg_loop->loop_cnt = entry->loop_cnt - 1;
+		cfg_loop->loop_len = *total_len;
+		cfg_loop->loop_off = cfg->sram_offset;
+	}
+
+	/* Reset link and prev_off */
+	dcc_ll_cfg_reset_link(cfg);
+}
+
+static void dcc_emit_write(struct dcc_drvdata *drvdata,
+			   struct dcc_config_entry *entry,
+			   struct dcc_cfg_attr *cfg)
+{
+	u32 off;
+
+	if (cfg->link) {
+		/*
+		 * write new offset = 1 to continue
+		 * processing the list
+		 */
+		dcc_sram_write_auto(drvdata, cfg->link, &cfg->sram_offset);
+
+		/* Reset link and prev_off */
+		cfg->addr = 0x00;
+		cfg->prev_off = 0;
+		cfg->prev_addr = cfg->addr;
+	}
+
+	off = entry->offset / 4;
+	/* write new offset-length pair to correct position */
+	cfg->link |= ((off & DCC_WRITE_OFF_MASK) | DCC_WRITE_MASK |
+		      FIELD_PREP(DCC_WRITE_LEN_MASK, entry->len));
+	cfg->link |= DCC_LINK_DESCRIPTOR;
+
+	/* Address type */
+	cfg->addr = (entry->base >> 4) & GENMASK(DCC_ADDR_LIMIT, 0);
+	if (entry->apb_bus)
+		cfg->addr |= DCC_ADDR_DESCRIPTOR | DCC_WRITE_IND | DCC_APB_IND;
+	else
+		cfg->addr |= DCC_ADDR_DESCRIPTOR | DCC_WRITE_IND | DCC_AHB_IND;
+	dcc_sram_write_auto(drvdata, cfg->addr, &cfg->sram_offset);
+
+	dcc_sram_write_auto(drvdata, cfg->link, &cfg->sram_offset);
+
+	dcc_sram_write_auto(drvdata, entry->write_val, &cfg->sram_offset);
+
+	cfg->addr = 0x00;
+	cfg->link = 0;
+}
+
+static int dcc_emit_read(struct dcc_drvdata *drvdata,
+			 struct dcc_config_entry *entry,
+			 struct dcc_cfg_attr *cfg,
+			 u32 *pos, u32 *total_len)
+{
+	u32 off;
+	u32 temp_off;
+
+	cfg->addr = (entry->base >> 4) & GENMASK(27, 0);
+
+	if (entry->apb_bus)
+		cfg->addr |= DCC_ADDR_DESCRIPTOR | DCC_READ_IND | DCC_APB_IND;
+	else
+		cfg->addr |= DCC_ADDR_DESCRIPTOR | DCC_READ_IND | DCC_AHB_IND;
+
+	off = entry->offset / 4;
+
+	*total_len += entry->len * 4;
+
+	if (!cfg->prev_addr || cfg->prev_addr != cfg->addr || cfg->prev_off > off) {
+		/* Check if we need to write prev link entry */
+		if (cfg->link)
+			dcc_sram_write_auto(drvdata, cfg->link, &cfg->sram_offset);
+		dev_dbg(drvdata->dev, "DCC: sram address 0x%x\n", cfg->sram_offset);
+
+		/* Write address */
+		dcc_sram_write_auto(drvdata, cfg->addr, &cfg->sram_offset);
+
+		/* Reset link and prev_off */
+		cfg->link = 0;
+		cfg->prev_off = 0;
+	}
+
+	if ((off - cfg->prev_off) > 0xff || entry->len > MAX_DCC_LEN) {
+		dev_err(drvdata->dev, "DCC: Programming error Base: 0x%x, offset 0x%x\n",
+			entry->base, entry->offset);
+		return -EINVAL;
+	}
+
+	if (cfg->link) {
+		/*
+		 * link already has one offset-length so new
+		 * offset-length needs to be placed at
+		 * bits [29:15]
+		 */
+		*pos = 15;
+
+		/* Clear bits [31:16] */
+		cfg->link &= GENMASK(14, 0);
+	} else {
+		/*
+		 * link is empty, so new offset-length needs
+		 * to be placed at bits [15:0]
+		 */
+		*pos = 0;
+		cfg->link = 1 << 15;
+	}
+
+	/* write new offset-length pair to correct position */
+	temp_off = (off - cfg->prev_off) & GENMASK(7, 0);
+	cfg->link |= (temp_off | ((entry->len << 8) & GENMASK(14, 8))) << *pos;
+
+	cfg->link |= DCC_LINK_DESCRIPTOR;
+
+	if (*pos) {
+		dcc_sram_write_auto(drvdata, cfg->link, &cfg->sram_offset);
+		cfg->link = 0;
+	}
+
+	cfg->prev_off  = off + entry->len - 1;
+	cfg->prev_addr = cfg->addr;
+	return 0;
+}
+
+static int dcc_emit_config(struct dcc_drvdata *drvdata, unsigned int curr_list)
+{
+	int ret;
+	u32 total_len, pos;
+	struct dcc_config_entry *entry;
+	struct dcc_cfg_attr cfg = {0};
+	struct dcc_cfg_loop_attr cfg_loop = {0};
+
+	cfg.sram_offset = drvdata->ram_cfg * 4;
+	total_len = 0;
+
+	list_for_each_entry(entry, &drvdata->cfg_head[curr_list], list) {
+		switch (entry->desc_type) {
+		case DCC_READ_WRITE_TYPE:
+			dcc_emit_read_write(drvdata, entry, &cfg);
+			break;
+
+		case DCC_LOOP_TYPE:
+			dcc_emit_loop(drvdata, entry, &cfg, &cfg_loop, &total_len);
+			break;
+
+		case DCC_WRITE_TYPE:
+			dcc_emit_write(drvdata, entry, &cfg);
+			break;
+
+		case DCC_READ_TYPE:
+			ret = dcc_emit_read(drvdata, entry, &cfg, &pos, &total_len);
+			if (ret)
+				goto err;
+			break;
+		}
+	}
+
+	if (cfg.link)
+		dcc_sram_write_auto(drvdata, cfg.link, &cfg.sram_offset);
+
+	if (cfg_loop.loop_start) {
+		dev_err(drvdata->dev, "DCC: Programming error: Loop unterminated\n");
+		ret = -EINVAL;
+		goto err;
+	}
+
+	/* Handling special case of list ending with a rd_mod_wr */
+	if (cfg.addr == DCC_RD_MOD_WR_DESCRIPTOR) {
+		cfg.addr = (DCC_RD_MOD_WR_ADDR) & GENMASK(27, 0);
+		cfg.addr |= DCC_ADDR_DESCRIPTOR;
+		dcc_sram_write_auto(drvdata, cfg.addr, &cfg.sram_offset);
+	}
+
+	/* Setting zero to indicate end of the list */
+	cfg.link = DCC_LINK_DESCRIPTOR;
+	dcc_sram_write_auto(drvdata, cfg.link, &cfg.sram_offset);
+
+	/* Check if sram offset exceeds the ram size */
+	if (cfg.sram_offset > drvdata->ram_size)
+		goto overstep;
+
+	/* Update ram_cfg and check if the data will overstep */
+	drvdata->ram_cfg = (cfg.sram_offset + total_len) / 4;
+
+	if (cfg.sram_offset + total_len > drvdata->ram_size) {
+		cfg.sram_offset += total_len;
+		goto overstep;
+	}
+
+	drvdata->ram_start = cfg.sram_offset / 4;
+	return 0;
+overstep:
+	ret = -EINVAL;
+	memset_io(drvdata->ram_base, 0, drvdata->ram_size);
+
+err:
+	return ret;
+}
+
+static bool dcc_valid_list(struct dcc_drvdata *drvdata, unsigned int curr_list)
+{
+	u32 lock_reg;
+
+	if (list_empty(&drvdata->cfg_head[curr_list]))
+		return false;
+
+	if (test_bit(curr_list, drvdata->enable_bitmap)) {
+		dev_err(drvdata->dev, "List %d is already enabled\n", curr_list);
+		return false;
+	}
+
+	lock_reg = dcc_list_readl(drvdata, curr_list, DCC_LL_LOCK);
+	if (lock_reg & DCC_LOCK_MASK) {
+		dev_err(drvdata->dev, "List %d is already locked\n", curr_list);
+		return false;
+	}
+
+	return true;
+}
+
+static bool is_dcc_enabled(struct dcc_drvdata *drvdata)
+{
+	int list;
+
+	for (list = 0; list < drvdata->max_link_list; list++)
+		if (test_bit(list, drvdata->enable_bitmap))
+			return true;
+
+	return false;
+}
+
+static int dcc_enable(struct dcc_drvdata *drvdata, unsigned int curr_list)
+{
+	int ret;
+	u32 ram_cfg_base;
+
+	mutex_lock(&drvdata->mutex);
+
+	if (!dcc_valid_list(drvdata, curr_list)) {
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
+	/* Fill dcc sram with the poison value.
+	 * This helps in understanding bus
+	 * hang from registers returning a zero
+	 */
+	if (!is_dcc_enabled(drvdata))
+		memset_io(drvdata->ram_base, 0xde, drvdata->ram_size);
+
+	/* 1. Take ownership of the list */
+	dcc_list_writel(drvdata, DCC_LOCK_MASK, curr_list, DCC_LL_LOCK);
+
+	/* 2. Program linked-list in the SRAM */
+	ram_cfg_base = drvdata->ram_cfg;
+	ret = dcc_emit_config(drvdata, curr_list);
+	if (ret) {
+		dcc_list_writel(drvdata, 0, curr_list, DCC_LL_LOCK);
+		goto out_unlock;
+	}
+
+	/* 3. Program DCC_RAM_CFG reg */
+	dcc_list_writel(drvdata, ram_cfg_base +
+			drvdata->ram_offset / 4, curr_list, DCC_LL_BASE);
+	dcc_list_writel(drvdata, drvdata->ram_start +
+			drvdata->ram_offset / 4, curr_list, DCC_FD_BASE);
+	dcc_list_writel(drvdata, 0xFFF, curr_list, DCC_LL_TIMEOUT);
+
+	/* 4. Clears interrupt status register */
+	dcc_list_writel(drvdata, 0, curr_list, DCC_LL_INT_ENABLE);
+	dcc_list_writel(drvdata, (BIT(0) | BIT(1) | BIT(2)),
+			curr_list, DCC_LL_INT_STATUS);
+
+	set_bit(curr_list, drvdata->enable_bitmap);
+
+	/* 5. Configure trigger */
+	if (drvdata->mem_map_ver == MEM_MAP_VER3)
+		dcc_list_writel(drvdata, BIT(8),
+				curr_list, DCC_LL_CFG);
+	else
+		dcc_list_writel(drvdata, DCC_TRIGGER_MASK,
+				curr_list, DCC_LL_CFG);
+
+out_unlock:
+	mutex_unlock(&drvdata->mutex);
+	return ret;
+}
+
+static void dcc_disable(struct dcc_drvdata *drvdata, int curr_list)
+{
+	mutex_lock(&drvdata->mutex);
+
+	if (!test_bit(curr_list, drvdata->enable_bitmap))
+		goto out_unlock;
+	dcc_list_writel(drvdata, 0, curr_list, DCC_LL_CFG);
+	dcc_list_writel(drvdata, 0, curr_list, DCC_LL_BASE);
+	dcc_list_writel(drvdata, 0, curr_list, DCC_FD_BASE);
+	dcc_list_writel(drvdata, 0, curr_list, DCC_LL_LOCK);
+	clear_bit(curr_list, drvdata->enable_bitmap);
+out_unlock:
+	mutex_unlock(&drvdata->mutex);
+}
+
+static u32 dcc_filp_curr_list(const struct file *filp)
+{
+	struct dentry *dentry = file_dentry(filp);
+	int curr_list, ret;
+
+	ret = kstrtoint(dentry->d_parent->d_name.name, 0, &curr_list);
+	if (ret)
+		return ret;
+
+	return curr_list;
+}
+
+static ssize_t enable_read(struct file *filp, char __user *userbuf,
+			   size_t count, loff_t *ppos)
+{
+	char *buf;
+	int curr_list = dcc_filp_curr_list(filp);
+	struct dcc_drvdata *drvdata = filp->private_data;
+
+	if (curr_list < 0)
+		return curr_list;
+
+	mutex_lock(&drvdata->mutex);
+	if (test_bit(curr_list, drvdata->enable_bitmap))
+		buf = "Y\n";
+	else
+		buf = "N\n";
+	mutex_unlock(&drvdata->mutex);
+
+	return simple_read_from_buffer(userbuf, count, ppos, buf, strlen(buf));
+}
+
+static ssize_t enable_write(struct file *filp, const char __user *userbuf,
+			    size_t count, loff_t *ppos)
+{
+	int ret = 0, curr_list;
+	bool val;
+	struct dcc_drvdata *drvdata = filp->private_data;
+
+	curr_list = dcc_filp_curr_list(filp);
+	if (curr_list < 0)
+		return curr_list;
+
+	ret = kstrtobool_from_user(userbuf, count, &val);
+	if (ret < 0)
+		return ret;
+
+	if (val) {
+		ret = dcc_enable(drvdata, curr_list);
+		if (ret)
+			return ret;
+	} else {
+		dcc_disable(drvdata, curr_list);
+	}
+
+	return count;
+}
+
+static const struct file_operations enable_fops = {
+	.read = enable_read,
+	.write = enable_write,
+	.open = simple_open,
+	.llseek = generic_file_llseek,
+};
+
+static ssize_t trigger_write(struct file *filp,
+			     const char __user *user_buf, size_t count,
+			     loff_t *ppos)
+{
+	int ret;
+	unsigned int val;
+	struct dcc_drvdata *drvdata = filp->private_data;
+
+	ret = kstrtouint_from_user(user_buf, count, 0, &val);
+	if (ret < 0)
+		return ret;
+
+	if (val != 1)
+		return -EINVAL;
+
+	ret = dcc_sw_trigger(drvdata);
+	if (ret < 0)
+		return ret;
+
+	return count;
+}
+
+static const struct file_operations trigger_fops = {
+	.write = trigger_write,
+	.open = simple_open,
+	.llseek = generic_file_llseek,
+};
+
+static int dcc_config_add(struct dcc_drvdata *drvdata, unsigned int addr,
+			  unsigned int len, bool apb_bus, int curr_list)
+{
+	int ret = 0;
+	struct dcc_config_entry *entry, *pentry;
+	unsigned int base, offset;
+
+	mutex_lock(&drvdata->mutex);
+
+	if (!len || len > drvdata->ram_size / DCC_WORD_SIZE) {
+		dev_err(drvdata->dev, "DCC: Invalid length\n");
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
+	base = addr & DCC_ADDR_RANGE_MASK;
+
+	if (!list_empty(&drvdata->cfg_head[curr_list])) {
+		pentry = list_last_entry(&drvdata->cfg_head[curr_list],
+					 struct dcc_config_entry, list);
+
+		if (pentry->desc_type == DCC_READ_TYPE &&
+		    addr >= (pentry->base + pentry->offset) &&
+		    addr <= (pentry->base + pentry->offset + MAX_DCC_OFFSET)) {
+			/* Re-use base address from last entry */
+			base = pentry->base;
+
+			if ((pentry->len * 4 + pentry->base + pentry->offset)
+					== addr) {
+				len += pentry->len;
+
+				if (len > MAX_DCC_LEN)
+					pentry->len = MAX_DCC_LEN;
+				else
+					pentry->len = len;
+
+				addr = pentry->base + pentry->offset +
+					pentry->len * 4;
+				len -= pentry->len;
+			}
+		}
+	}
+
+	offset = addr - base;
+
+	while (len) {
+		entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+		if (!entry) {
+			ret = -ENOMEM;
+			goto out_unlock;
+		}
+
+		entry->base = base;
+		entry->offset = offset;
+		entry->len = min_t(u32, len, MAX_DCC_LEN);
+		entry->desc_type = DCC_READ_TYPE;
+		entry->apb_bus = apb_bus;
+		INIT_LIST_HEAD(&entry->list);
+		list_add_tail(&entry->list,
+			      &drvdata->cfg_head[curr_list]);
+
+		len -= entry->len;
+		offset += MAX_DCC_LEN * 4;
+	}
+
+out_unlock:
+	mutex_unlock(&drvdata->mutex);
+	return ret;
+}
+
+static ssize_t dcc_config_add_read(struct dcc_drvdata *drvdata, char *buf, int curr_list)
+{
+	bool bus;
+	int len, nval;
+	unsigned int base;
+	char apb_bus[4];
+
+	nval = sscanf(buf, "%x %i %3s", &base, &len, apb_bus);
+	if (nval <= 0 || nval > 3)
+		return -EINVAL;
+
+	if (nval == 1) {
+		len = 1;
+		bus = false;
+	} else if (nval == 2) {
+		bus = false;
+	} else if (!strcmp("apb", apb_bus)) {
+		bus = true;
+	} else if (!strcmp("ahb", apb_bus)) {
+		bus = false;
+	} else {
+		return -EINVAL;
+	}
+
+	return dcc_config_add(drvdata, base, len, bus, curr_list);
+}
+
+static void dcc_config_reset(struct dcc_drvdata *drvdata)
+{
+	struct dcc_config_entry *entry, *temp;
+	int curr_list;
+
+	mutex_lock(&drvdata->mutex);
+
+	for (curr_list = 0; curr_list < drvdata->max_link_list; curr_list++) {
+		list_for_each_entry_safe(entry, temp,
+					 &drvdata->cfg_head[curr_list], list) {
+			list_del(&entry->list);
+		}
+	}
+	drvdata->ram_start = 0;
+	drvdata->ram_cfg = 0;
+	mutex_unlock(&drvdata->mutex);
+}
+
+static ssize_t config_reset_write(struct file *filp,
+				  const char __user *user_buf, size_t count,
+				  loff_t *ppos)
+{
+	unsigned int val;
+	int ret;
+	struct dcc_drvdata *drvdata = filp->private_data;
+
+	ret = kstrtouint_from_user(user_buf, count, 0, &val);
+	if (ret < 0)
+		return ret;
+
+	if (val)
+		dcc_config_reset(drvdata);
+
+	return count;
+}
+
+static const struct file_operations config_reset_fops = {
+	.write = config_reset_write,
+	.open = simple_open,
+	.llseek = generic_file_llseek,
+};
+
+static ssize_t ready_read(struct file *filp, char __user *userbuf,
+			  size_t count, loff_t *ppos)
+{
+	char *buf;
+	struct dcc_drvdata *drvdata = filp->private_data;
+
+	if (!is_dcc_enabled(drvdata))
+		return -EINVAL;
+
+	if (!FIELD_GET(BIT(1), readl(drvdata->base + dcc_status(drvdata->mem_map_ver))))
+		buf = "Y\n";
+	else
+		buf = "N\n";
+
+	return simple_read_from_buffer(userbuf, count, ppos, buf, strlen(buf) + 1);
+}
+
+static const struct file_operations ready_fops = {
+	.read = ready_read,
+	.open = simple_open,
+	.llseek = generic_file_llseek,
+};
+
+static ssize_t loop_offset_read(struct file *filp, char __user *userbuf,
+			  size_t count, loff_t *ppos)
+{
+	char buf[4];
+	struct dcc_drvdata *drvdata = filp->private_data;
+
+	snprintf(buf, sizeof(buf), "%d", drvdata->loop_shift);
+	return simple_read_from_buffer(userbuf, count, ppos, buf, strlen(buf) + 1);
+}
+
+static const struct file_operations loop_offset_fops = {
+	.read = loop_offset_read,
+	.open = simple_open,
+	.llseek = generic_file_llseek,
+};
+static int dcc_add_loop(struct dcc_drvdata *drvdata, unsigned long loop_cnt, int curr_list)
+{
+	struct dcc_config_entry *entry;
+
+	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+	if (!entry)
+		return -ENOMEM;
+
+	entry->loop_cnt = min_t(u32, loop_cnt, MAX_LOOP_CNT);
+	entry->desc_type = DCC_LOOP_TYPE;
+	INIT_LIST_HEAD(&entry->list);
+	list_add_tail(&entry->list, &drvdata->cfg_head[curr_list]);
+
+	return 0;
+}
+
+static ssize_t dcc_config_add_loop(struct dcc_drvdata *drvdata, char *buf, int curr_list)
+{
+	int ret, i = 0;
+	char *token, *input;
+	char delim[2] = " ";
+	unsigned int val[MAX_LOOP_ADDR];
+
+	input = buf;
+
+	while ((token = strsep(&input, delim)) && i < MAX_LOOP_ADDR) {
+		ret = kstrtouint(token, 0, &val[i++]);
+		if (ret)
+			return ret;
+	}
+
+	if (token) {
+		dev_err(drvdata->dev, "Max limit %u of loop address exceeded\n",
+			MAX_LOOP_ADDR);
+		return -EINVAL;
+	}
+
+	if (val[1] < 1 || val[1] > 8 || val[1] > (i - 2))
+		return -EINVAL;
+
+	ret = dcc_add_loop(drvdata, val[0], curr_list);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < val[1]; i++)
+		dcc_config_add(drvdata, val[i + 2], 1, false, curr_list);
+
+	return dcc_add_loop(drvdata, 1, curr_list);
+}
+
+static int dcc_rd_mod_wr_add(struct dcc_drvdata *drvdata, unsigned int mask,
+			     unsigned int val, int curr_list)
+{
+	int ret = 0;
+	struct dcc_config_entry *entry;
+
+	mutex_lock(&drvdata->mutex);
+
+	if (list_empty(&drvdata->cfg_head[curr_list])) {
+		dev_err(drvdata->dev, "DCC: No read address programmed\n");
+		ret = -EPERM;
+		goto out_unlock;
+	}
+
+	entry = devm_kzalloc(drvdata->dev, sizeof(*entry), GFP_KERNEL);
+	if (!entry) {
+		ret = -ENOMEM;
+		goto out_unlock;
+	}
+
+	entry->desc_type = DCC_READ_WRITE_TYPE;
+	entry->mask = mask;
+	entry->write_val = val;
+	list_add_tail(&entry->list, &drvdata->cfg_head[curr_list]);
+out_unlock:
+	mutex_unlock(&drvdata->mutex);
+	return ret;
+}
+
+static ssize_t dcc_config_add_read_write(struct dcc_drvdata *drvdata, char *buf, int curr_list)
+{
+	int ret;
+	int nval;
+	unsigned int addr, mask, val;
+
+	nval = sscanf(buf, "%x %x %x", &addr, &mask, &val);
+
+	if (nval <= 1 || nval > 3)
+		return -EINVAL;
+
+	ret = dcc_config_add(drvdata, addr, 1, false, curr_list);
+	if (ret)
+		return ret;
+
+	return dcc_rd_mod_wr_add(drvdata, mask, val, curr_list);
+}
+
+static int dcc_add_write(struct dcc_drvdata *drvdata, unsigned int addr,
+			 unsigned int write_val, int apb_bus, int curr_list)
+{
+	struct dcc_config_entry *entry;
+
+	entry = devm_kzalloc(drvdata->dev, sizeof(*entry), GFP_KERNEL);
+	if (!entry)
+		return -ENOMEM;
+
+	entry->desc_type = DCC_WRITE_TYPE;
+	entry->base = addr & GENMASK(31, 4);
+	entry->offset = addr - entry->base;
+	entry->write_val = write_val;
+	entry->len = 1;
+	entry->apb_bus = apb_bus;
+	list_add_tail(&entry->list, &drvdata->cfg_head[curr_list]);
+
+	return 0;
+}
+
+static ssize_t dcc_config_add_write(struct dcc_drvdata *drvdata, char *buf, int curr_list)
+{
+	bool bus;
+	int nval;
+	unsigned int addr, write_val;
+	char apb_bus[4];
+
+	nval = sscanf(buf, "%x %x %3s", &addr, &write_val, apb_bus);
+
+	if (nval <= 1 || nval > 3)
+		return -EINVAL;
+
+	if (nval == 2)
+		bus = false;
+
+	if (nval == 3) {
+		if (!strcmp("apb", apb_bus))
+			bus = true;
+		else if (!strcmp("ahb", apb_bus))
+			bus = false;
+		else
+			return -EINVAL;
+	}
+
+	return dcc_add_write(drvdata, addr, write_val, bus, curr_list);
+}
+
+static int config_show(struct seq_file *m, void *data)
+{
+	struct dcc_drvdata *drvdata = m->private;
+	struct dcc_config_entry *entry, *next_entry, *prev_entry, *loop_entry;
+	int index = 0, curr_list, i;
+	unsigned int loop_val[MAX_LOOP_ADDR];
+
+	curr_list = dcc_filp_curr_list(m->file);
+	if (curr_list < 0)
+		return curr_list;
+
+	mutex_lock(&drvdata->mutex);
+
+	list_for_each_entry(entry, &drvdata->cfg_head[curr_list], list) {
+		index++;
+		switch (entry->desc_type) {
+		case DCC_READ_WRITE_TYPE:
+			prev_entry = list_prev_entry(entry, list);
+			seq_printf(m, "RW 0x%x 0x%x 0x%x\n",
+				   prev_entry->base + prev_entry->offset,
+				   entry->mask,
+				   entry->write_val);
+			break;
+		case DCC_LOOP_TYPE:
+			loop_entry = entry;
+			loop_val[0] = loop_entry->loop_cnt;
+			loop_entry = list_next_entry(loop_entry, list);
+			for (i = 0; i < (MAX_LOOP_ADDR-2);
+					i++, loop_entry = list_next_entry(loop_entry, list)) {
+				if (loop_entry->desc_type == DCC_READ_TYPE) {
+					loop_val[i+2] = loop_entry->base + loop_entry->offset;
+				} else if (loop_entry->desc_type == DCC_LOOP_TYPE) {
+					loop_val[i+2] = loop_entry->loop_cnt;
+					loop_val[1] = i;
+					entry = loop_entry;
+					break;
+				}
+			}
+			seq_printf(m, "L 0x%x 0x%x", loop_val[0], loop_val[1]);
+			for (i = 0; i < loop_val[1]; i++)
+				seq_printf(m, " 0x%x", loop_val[i+2]);
+			seq_puts(m, "\n");
+			break;
+		case DCC_WRITE_TYPE:
+			seq_printf(m, "W 0x%x 0x%x %s\n",
+				   entry->base + entry->offset,
+				   entry->write_val,
+				   entry->apb_bus ? "apb":"ahb");
+			break;
+		case DCC_READ_TYPE:
+			if (entry->len == 1) {
+				next_entry = list_next_entry(entry, list);
+				if (next_entry && next_entry->desc_type == DCC_READ_WRITE_TYPE)
+					continue;
+			}
+			seq_printf(m, "R 0x%x 0x%x %s\n",
+				   entry->base + entry->offset,
+				   entry->len,
+				   entry->apb_bus ? "apb":"ahb");
+		}
+	}
+	mutex_unlock(&drvdata->mutex);
+	return 0;
+}
+
+static int config_open(struct inode *inode, struct file *file)
+{
+	struct dcc_drvdata *drvdata = inode->i_private;
+
+	return single_open(file, config_show, drvdata);
+}
+
+static ssize_t config_write(struct file *filp,
+			    const char __user *user_buf, size_t count,
+			    loff_t *ppos)
+{
+	int ret, curr_list;
+	char *token, *line;
+	char *buf, *bufp, *temp_buff;
+	char *delim = " ";
+	struct dcc_drvdata *drvdata = filp->f_inode->i_private;
+	ssize_t processed_len = 0;
+
+	if (count == 0)
+		return -EINVAL;
+	buf = kzalloc(count+1, GFP_KERNEL);
+	if (buf)
+		bufp = buf;
+	else
+		return -ENOMEM;
+
+	ret = copy_from_user(buf, user_buf, count);
+	if (ret)
+		goto err;
+
+	curr_list = dcc_filp_curr_list(filp);
+	if (curr_list < 0) {
+		ret = curr_list;
+		goto err;
+	}
+
+	while (bufp[0] != '\0') {
+		/* Parse line by line */
+		line = strsep(&bufp, "\n");
+		/* When one complete line could be parsed */
+		if (line && bufp) {
+			processed_len += strlen(line) + 1;
+			if (drvdata->temp_buff_ptr && drvdata->temp_buff_ptr[curr_list]) {
+				temp_buff = drvdata->temp_buff_ptr[curr_list];
+				/* Size of combined string must not be greater than
+				 * allowed line size.
+				 */
+				if (strlen(line) + strlen(temp_buff) + 1 > LINE_BUFFER_MAX_SZ) {
+					dev_err(drvdata->dev, "Invalid input\n");
+					ret = -EINVAL;
+					goto err;
+				}
+				strlcat(temp_buff, line, PAGE_SIZE);
+				line = temp_buff;
+				kfree(temp_buff);
+				drvdata->temp_buff_ptr[curr_list] = NULL;
+			}
+
+			token = strsep(&line, delim);
+
+			if (!strcmp("R", token)) {
+				ret = dcc_config_add_read(drvdata, line, curr_list);
+			} else if (!strcmp("W", token)) {
+				ret = dcc_config_add_write(drvdata, line, curr_list);
+			} else if (!strcmp("RW", token)) {
+				ret = dcc_config_add_read_write(drvdata, line, curr_list);
+			} else if (!strcmp("L", token)) {
+				ret = dcc_config_add_loop(drvdata, line, curr_list);
+			} else {
+				dev_err(drvdata->dev, "%s is not a correct input\n", token);
+				ret = -EINVAL;
+			}
+
+			if (ret)
+				goto err;
+		} else {
+			/* Save the incomplete line to a temporary buffer and rejoin it later */
+			if (!drvdata->temp_buff_ptr) {
+				drvdata->temp_buff_ptr = devm_kcalloc(drvdata->dev,
+									drvdata->max_link_list,
+									sizeof(char *),
+									GFP_KERNEL);
+				if (!drvdata->temp_buff_ptr) {
+					ret = -ENOMEM;
+					goto err;
+				}
+			}
+			drvdata->temp_buff_ptr[curr_list] = kzalloc(LINE_BUFFER_MAX_SZ,
+										GFP_KERNEL);
+			temp_buff = drvdata->temp_buff_ptr[curr_list];
+			if (!temp_buff) {
+				ret = -ENOMEM;
+				goto err;
+			}
+			if ((count - processed_len) >= LINE_BUFFER_MAX_SZ) {
+				dev_err(drvdata->dev, "Invalid input\n");
+				ret = -EINVAL;
+				goto err;
+			}
+			memcpy(temp_buff, line, count - processed_len);
+			temp_buff[count - processed_len + 1] = '\0';
+			processed_len += (strlen(temp_buff) + 1);
+			break;
+		}
+	}
+
+	kfree(buf);
+	return processed_len;
+
+err:
+	kfree(buf);
+	if (drvdata->temp_buff_ptr && drvdata->temp_buff_ptr[curr_list]) {
+		kfree(drvdata->temp_buff_ptr[curr_list]);
+		drvdata->temp_buff_ptr[curr_list] = NULL;
+	}
+	return ret;
+}
+
+static const struct file_operations config_fops = {
+	.open = config_open,
+	.read = seq_read,
+	.write = config_write,
+	.llseek = seq_lseek,
+	.release = single_release,
+};
+
+static void dcc_delete_debug_dir(struct dcc_drvdata *drvdata)
+{
+	 debugfs_remove_recursive(drvdata->dbg_dir);
+};
+
+static void dcc_create_debug_dir(struct dcc_drvdata *drvdata)
+{
+	int i;
+	char list_num[10];
+	struct dentry *dcc_dev, *list;
+	struct device *dev = drvdata->dev;
+
+	drvdata->dbg_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+	dcc_dev = debugfs_create_dir(dev_name(dev), drvdata->dbg_dir);
+
+	for (i = 0; i < drvdata->max_link_list; i++) {
+		snprintf(list_num, sizeof(list_num), "%d", i);
+		list = debugfs_create_dir(list_num, dcc_dev);
+		debugfs_create_file("enable", 0600, list, drvdata, &enable_fops);
+		debugfs_create_file("config", 0600, list, drvdata, &config_fops);
+	}
+
+	debugfs_create_file("trigger", 0200, drvdata->dbg_dir, drvdata, &trigger_fops);
+	debugfs_create_file("ready", 0400, drvdata->dbg_dir, drvdata, &ready_fops);
+	debugfs_create_file("config_reset", 0200, drvdata->dbg_dir, drvdata, &config_reset_fops);
+	debugfs_create_file("loop_offset", 0400, drvdata->dbg_dir, drvdata, &loop_offset_fops);
+}
+
+static ssize_t dcc_sram_read(struct file *file, char __user *data,
+			     size_t len, loff_t *ppos)
+{
+	unsigned char *buf;
+	struct dcc_drvdata *drvdata;
+
+	drvdata = container_of(file->private_data, struct dcc_drvdata,
+			       sram_dev);
+
+	/* EOF check */
+	if (*ppos >= drvdata->ram_size)
+		return 0;
+
+	if ((*ppos + len) > drvdata->ram_size)
+		len = (drvdata->ram_size - *ppos);
+
+	buf = kzalloc(len, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	memcpy_fromio(buf, drvdata->ram_base + *ppos, len);
+
+	if (copy_to_user(data, buf, len)) {
+		kfree(buf);
+		return -EFAULT;
+	}
+
+	*ppos += len;
+
+	kfree(buf);
+
+	return len;
+}
+
+static const struct file_operations dcc_sram_fops = {
+	.owner		= THIS_MODULE,
+	.read		= dcc_sram_read,
+	.llseek		= no_llseek,
+};
+
+static int dcc_sram_dev_init(struct dcc_drvdata *drvdata)
+{
+	drvdata->sram_dev.minor = MISC_DYNAMIC_MINOR;
+	drvdata->sram_dev.name = "dcc_sram";
+	drvdata->sram_dev.fops = &dcc_sram_fops;
+
+	return misc_register(&drvdata->sram_dev);
+}
+
+static void dcc_sram_dev_exit(struct dcc_drvdata *drvdata)
+{
+	misc_deregister(&drvdata->sram_dev);
+}
+
+static int dcc_probe(struct platform_device *pdev)
+{
+	u32 val;
+	int ret = 0, i;
+	struct device *dev = &pdev->dev;
+	struct dcc_drvdata *drvdata;
+	struct resource *res;
+
+	drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL);
+	if (!drvdata)
+		return -ENOMEM;
+
+	drvdata->dev = &pdev->dev;
+	platform_set_drvdata(pdev, drvdata);
+
+	drvdata->base = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(drvdata->base))
+		return PTR_ERR(drvdata->base);
+
+	drvdata->ram_base = devm_platform_get_and_ioremap_resource(pdev, 1, &res);
+	if (IS_ERR(drvdata->ram_base))
+		return PTR_ERR(drvdata->ram_base);
+
+	drvdata->ram_size = resource_size(res);
+	ret = of_property_read_u32(pdev->dev.of_node, "qcom,dcc-offset",
+				   &drvdata->ram_offset);
+	if (ret)
+		return -EINVAL;
+
+	drvdata->mem_map_ver = (u64)of_device_get_match_data(&pdev->dev);
+
+	switch (drvdata->mem_map_ver) {
+	case MEM_MAP_VER3:
+	case MEM_MAP_VER2:
+		drvdata->max_link_list = readl(drvdata->base + DCC_LL_NUM_INFO);
+		if (!drvdata->max_link_list)
+			return  -EINVAL;
+		break;
+	case MEM_MAP_VER1:
+		drvdata->max_link_list = DCC_MAX_LINK_LIST;
+		break;
+	default:
+		dev_err(drvdata->dev, "Unsupported memory map version.\n");
+		return -EINVAL;
+	}
+
+	val = readl(drvdata->base + DCC_HW_INFO);
+	/* Either set the fixed loop offset or calculate
+	 * it from the total number of words in dcc_sram.
+	 * Max consecutive addresses dcc can loop is
+	 * equivalent to the words in dcc_sram.
+	 */
+	if (val & DCC_LOOP_OFFSET_MASK)
+		drvdata->loop_shift = DCC_FIX_LOOP_OFFSET;
+	else
+		drvdata->loop_shift = get_bitmask_order((drvdata->ram_offset +
+					drvdata->ram_size) / DCC_SRAM_WORD_LENGTH - 1);
+
+	mutex_init(&drvdata->mutex);
+
+	drvdata->enable_bitmap = devm_kcalloc(dev, BITS_TO_LONGS(drvdata->max_link_list),
+					      sizeof(*drvdata->enable_bitmap), GFP_KERNEL);
+	if (!drvdata->enable_bitmap)
+		return -ENOMEM;
+
+	drvdata->cfg_head = devm_kcalloc(dev, drvdata->max_link_list,
+					 sizeof(*drvdata->cfg_head), GFP_KERNEL);
+	if (!drvdata->cfg_head)
+		return -ENOMEM;
+
+	for (i = 0; i < drvdata->max_link_list; i++)
+		INIT_LIST_HEAD(&drvdata->cfg_head[i]);
+
+	ret = dcc_sram_dev_init(drvdata);
+	if (ret) {
+		dev_err(drvdata->dev, "DCC: sram node not registered.\n");
+		return ret;
+	}
+
+	dcc_create_debug_dir(drvdata);
+
+	return 0;
+}
+
+static int dcc_remove(struct platform_device *pdev)
+{
+	struct dcc_drvdata *drvdata = platform_get_drvdata(pdev);
+
+	dcc_delete_debug_dir(drvdata);
+	dcc_sram_dev_exit(drvdata);
+	dcc_config_reset(drvdata);
+
+	return 0;
+}
+
+static const struct of_device_id dcc_match_table[] = {
+	{ .compatible = "qcom,dcc-v1", .data = (void *)MEM_MAP_VER1 },
+	{ .compatible = "qcom,dcc-v2", .data = (void *)MEM_MAP_VER2 },
+	{ .compatible = "qcom,dcc-v3", .data = (void *)MEM_MAP_VER3 },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, dcc_match_table);
+
+static struct platform_driver dcc_driver = {
+	.probe = dcc_probe,
+	.remove	= dcc_remove,
+	.driver	= {
+		.name = "qcom-dcc",
+		.of_match_table	= dcc_match_table,
+	},
+};
+
+module_platform_driver(dcc_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Qualcomm Technologies Inc. DCC driver");
--- linux-qcom-6.8.0.orig/drivers/misc/sgi-gru/grukservices.c
+++ linux-qcom-6.8.0/drivers/misc/sgi-gru/grukservices.c
@@ -258,7 +258,6 @@
 	int lcpu;
 
 	BUG_ON(dsr_bytes > GRU_NUM_KERNEL_DSR_BYTES);
-	preempt_disable();
 	bs = gru_lock_kernel_context(-1);
 	lcpu = uv_blade_processor_id();
 	*cb = bs->kernel_cb + lcpu * GRU_HANDLE_STRIDE;
@@ -272,7 +271,6 @@
 static void gru_free_cpu_resources(void *cb, void *dsr)
 {
 	gru_unlock_kernel_context(uv_numa_blade_id());
-	preempt_enable();
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/misc/sgi-gru/grumain.c
+++ linux-qcom-6.8.0/drivers/misc/sgi-gru/grumain.c
@@ -937,10 +937,8 @@
 
 again:
 	mutex_lock(&gts->ts_ctxlock);
-	preempt_disable();
 
 	if (gru_check_context_placement(gts)) {
-		preempt_enable();
 		mutex_unlock(&gts->ts_ctxlock);
 		gru_unload_context(gts, 1);
 		return VM_FAULT_NOPAGE;
@@ -949,7 +947,6 @@
 	if (!gts->ts_gru) {
 		STAT(load_user_context);
 		if (!gru_assign_gru_context(gts)) {
-			preempt_enable();
 			mutex_unlock(&gts->ts_ctxlock);
 			set_current_state(TASK_INTERRUPTIBLE);
 			schedule_timeout(GRU_ASSIGN_DELAY);  /* true hack ZZZ */
@@ -965,7 +962,6 @@
 				vma->vm_page_prot);
 	}
 
-	preempt_enable();
 	mutex_unlock(&gts->ts_ctxlock);
 
 	return VM_FAULT_NOPAGE;
--- linux-qcom-6.8.0.orig/drivers/misc/sgi-gru/grutlbpurge.c
+++ linux-qcom-6.8.0/drivers/misc/sgi-gru/grutlbpurge.c
@@ -65,7 +65,6 @@
 	struct gru_tlb_global_handle *tgh;
 	int n;
 
-	preempt_disable();
 	if (uv_numa_blade_id() == gru->gs_blade_id)
 		n = get_on_blade_tgh(gru);
 	else
@@ -79,7 +78,6 @@
 static void get_unlock_tgh_handle(struct gru_tlb_global_handle *tgh)
 {
 	unlock_tgh_handle(tgh);
-	preempt_enable();
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/misc/vmw_vmci/vmci_datagram.c
+++ linux-qcom-6.8.0/drivers/misc/vmw_vmci/vmci_datagram.c
@@ -234,7 +234,8 @@
 
 			dg_info->in_dg_host_queue = true;
 			dg_info->entry = dst_entry;
-			memcpy(&dg_info->msg, dg, dg_size);
+			dg_info->msg = *dg;
+			memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size);
 
 			INIT_WORK(&dg_info->work, dg_delayed_dispatch);
 			schedule_work(&dg_info->work);
@@ -377,7 +378,8 @@
 
 		dg_info->in_dg_host_queue = false;
 		dg_info->entry = dst_entry;
-		memcpy(&dg_info->msg, dg, VMCI_DG_SIZE(dg));
+		dg_info->msg = *dg;
+		memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size);
 
 		INIT_WORK(&dg_info->work, dg_delayed_dispatch);
 		schedule_work(&dg_info->work);
--- linux-qcom-6.8.0.orig/drivers/misc/vmw_vmci/vmci_event.c
+++ linux-qcom-6.8.0/drivers/misc/vmw_vmci/vmci_event.c
@@ -9,6 +9,7 @@
 #include <linux/vmw_vmci_api.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/nospec.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/rculist.h>
@@ -86,9 +87,12 @@
 {
 	struct vmci_subscription *cur;
 	struct list_head *subscriber_list;
+	u32 sanitized_event, max_vmci_event;
 
 	rcu_read_lock();
-	subscriber_list = &subscriber_array[event_msg->event_data.event];
+	max_vmci_event = ARRAY_SIZE(subscriber_array);
+	sanitized_event = array_index_nospec(event_msg->event_data.event, max_vmci_event);
+	subscriber_list = &subscriber_array[sanitized_event];
 	list_for_each_entry_rcu(cur, subscriber_list, node) {
 		cur->callback(cur->id, &event_msg->event_data,
 			      cur->callback_data);
--- linux-qcom-6.8.0.orig/drivers/misc/vmw_vmci/vmci_guest.c
+++ linux-qcom-6.8.0/drivers/misc/vmw_vmci/vmci_guest.c
@@ -625,7 +625,8 @@
 	if (!vmci_dev) {
 		dev_err(&pdev->dev,
 			"Can't allocate memory for VMCI device\n");
-		return -ENOMEM;
+		error = -ENOMEM;
+		goto err_unmap_mmio_base;
 	}
 
 	vmci_dev->dev = &pdev->dev;
@@ -642,7 +643,8 @@
 		if (!vmci_dev->tx_buffer) {
 			dev_err(&pdev->dev,
 				"Can't allocate memory for datagram tx buffer\n");
-			return -ENOMEM;
+			error = -ENOMEM;
+			goto err_unmap_mmio_base;
 		}
 
 		vmci_dev->data_buffer = dma_alloc_coherent(&pdev->dev, VMCI_DMA_DG_BUFFER_SIZE,
@@ -893,6 +895,10 @@
 err_free_data_buffers:
 	vmci_free_dg_buffers(vmci_dev);
 
+err_unmap_mmio_base:
+	if (mmio_base != NULL)
+		pci_iounmap(pdev, mmio_base);
+
 	/* The rest are managed resources and will be freed by PCI core */
 	return error;
 }
--- linux-qcom-6.8.0.orig/drivers/misc/vmw_vmci/vmci_resource.c
+++ linux-qcom-6.8.0/drivers/misc/vmw_vmci/vmci_resource.c
@@ -144,7 +144,8 @@
 	spin_lock(&vmci_resource_table.lock);
 
 	hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) {
-		if (vmci_handle_is_equal(r->handle, resource->handle)) {
+		if (vmci_handle_is_equal(r->handle, resource->handle) &&
+		    resource->type == r->type) {
 			hlist_del_init_rcu(&r->node);
 			break;
 		}
--- linux-qcom-6.8.0.orig/drivers/mmc/core/block.c
+++ linux-qcom-6.8.0/drivers/mmc/core/block.c
@@ -48,6 +48,7 @@
 #include <linux/mmc/sd.h>
 
 #include <linux/uaccess.h>
+#include <asm/unaligned.h>
 
 #include "queue.h"
 #include "block.h"
@@ -413,7 +414,7 @@
 	struct mmc_blk_ioc_data *idata;
 	int err;
 
-	idata = kmalloc(sizeof(*idata), GFP_KERNEL);
+	idata = kzalloc(sizeof(*idata), GFP_KERNEL);
 	if (!idata) {
 		err = -ENOMEM;
 		goto out;
@@ -488,7 +489,7 @@
 	if (idata->flags & MMC_BLK_IOC_DROP)
 		return 0;
 
-	if (idata->flags & MMC_BLK_IOC_SBC)
+	if (idata->flags & MMC_BLK_IOC_SBC && i > 0)
 		prev_idata = idatas[i - 1];
 
 	/*
@@ -874,10 +875,11 @@
 static int mmc_blk_part_switch_pre(struct mmc_card *card,
 				   unsigned int part_type)
 {
-	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB;
+	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK;
+	const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB;
 	int ret = 0;
 
-	if ((part_type & mask) == mask) {
+	if ((part_type & mask) == rpmb) {
 		if (card->ext_csd.cmdq_en) {
 			ret = mmc_cmdq_disable(card);
 			if (ret)
@@ -892,10 +894,11 @@
 static int mmc_blk_part_switch_post(struct mmc_card *card,
 				    unsigned int part_type)
 {
-	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB;
+	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK;
+	const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB;
 	int ret = 0;
 
-	if ((part_type & mask) == mask) {
+	if ((part_type & mask) == rpmb) {
 		mmc_retune_unpause(card->host);
 		if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
 			ret = mmc_cmdq_enable(card);
@@ -945,11 +948,12 @@
 	int err;
 	u32 result;
 	__be32 *blocks;
+	u8 resp_sz = mmc_card_ult_capacity(card) ? 8 : 4;
+	unsigned int noio_flag;
 
 	struct mmc_request mrq = {};
 	struct mmc_command cmd = {};
 	struct mmc_data data = {};
-
 	struct scatterlist sg;
 
 	err = mmc_app_cmd(card->host, card);
@@ -960,7 +964,7 @@
 	cmd.arg = 0;
 	cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
 
-	data.blksz = 4;
+	data.blksz = resp_sz;
 	data.blocks = 1;
 	data.flags = MMC_DATA_READ;
 	data.sg = &sg;
@@ -970,15 +974,29 @@
 	mrq.cmd = &cmd;
 	mrq.data = &data;
 
-	blocks = kmalloc(4, GFP_KERNEL);
+	noio_flag = memalloc_noio_save();
+	blocks = kmalloc(resp_sz, GFP_KERNEL);
+	memalloc_noio_restore(noio_flag);
 	if (!blocks)
 		return -ENOMEM;
 
-	sg_init_one(&sg, blocks, 4);
+	sg_init_one(&sg, blocks, resp_sz);
 
 	mmc_wait_for_req(card->host, &mrq);
 
-	result = ntohl(*blocks);
+	if (mmc_card_ult_capacity(card)) {
+		/*
+		 * Normally, ACMD22 returns the number of written sectors as
+		 * u32. SDUC, however, returns it as u64.  This is not a
+		 * superfluous requirement, because SDUC writes may exceed 2TB.
+		 * For Linux mmc however, the previously write operation could
+		 * not be more than the block layer limits, thus just make room
+		 * for a u64 and cast the response back to u32.
+		 */
+		result = clamp_val(get_unaligned_be64(blocks), 0, UINT_MAX);
+	} else {
+		result = ntohl(*blocks);
+	}
 	kfree(blocks);
 
 	if (cmd.error || data.error)
--- linux-qcom-6.8.0.orig/drivers/mmc/core/bus.c
+++ linux-qcom-6.8.0/drivers/mmc/core/bus.c
@@ -149,6 +149,8 @@
 	if (dev->driver && drv->shutdown)
 		drv->shutdown(card);
 
+	__mmc_stop_host(host);
+
 	if (host->bus_ops->shutdown) {
 		ret = host->bus_ops->shutdown(host);
 		if (ret)
@@ -321,7 +323,9 @@
 	case MMC_TYPE_SD:
 		type = "SD";
 		if (mmc_card_blockaddr(card)) {
-			if (mmc_card_ext_capacity(card))
+			if (mmc_card_ult_capacity(card))
+				type = "SDUC";
+			else if (mmc_card_ext_capacity(card))
 				type = "SDXC";
 			else
 				type = "SDHC";
--- linux-qcom-6.8.0.orig/drivers/mmc/core/card.h
+++ linux-qcom-6.8.0/drivers/mmc/core/card.h
@@ -23,6 +23,7 @@
 #define MMC_CARD_SDXC		(1<<3)		/* card is SDXC */
 #define MMC_CARD_REMOVED	(1<<4)		/* card has been removed */
 #define MMC_STATE_SUSPENDED	(1<<5)		/* card is suspended */
+#define MMC_CARD_SDUC		(1<<6)		/* card is SDUC */
 
 #define mmc_card_present(c)	((c)->state & MMC_STATE_PRESENT)
 #define mmc_card_readonly(c)	((c)->state & MMC_STATE_READONLY)
@@ -30,11 +31,13 @@
 #define mmc_card_ext_capacity(c) ((c)->state & MMC_CARD_SDXC)
 #define mmc_card_removed(c)	((c) && ((c)->state & MMC_CARD_REMOVED))
 #define mmc_card_suspended(c)	((c)->state & MMC_STATE_SUSPENDED)
+#define mmc_card_ult_capacity(c) ((c)->state & MMC_CARD_SDUC)
 
 #define mmc_card_set_present(c)	((c)->state |= MMC_STATE_PRESENT)
 #define mmc_card_set_readonly(c) ((c)->state |= MMC_STATE_READONLY)
 #define mmc_card_set_blockaddr(c) ((c)->state |= MMC_STATE_BLOCKADDR)
 #define mmc_card_set_ext_capacity(c) ((c)->state |= MMC_CARD_SDXC)
+#define mmc_card_set_ult_capacity(c) ((c)->state |= MMC_CARD_SDUC)
 #define mmc_card_set_removed(c) ((c)->state |= MMC_CARD_REMOVED)
 #define mmc_card_set_suspended(c) ((c)->state |= MMC_STATE_SUSPENDED)
 #define mmc_card_clr_suspended(c) ((c)->state &= ~MMC_STATE_SUSPENDED)
@@ -82,6 +85,7 @@
 #define CID_MANFID_SANDISK_SD   0x3
 #define CID_MANFID_ATP          0x9
 #define CID_MANFID_TOSHIBA      0x11
+#define CID_MANFID_GIGASTONE    0x12
 #define CID_MANFID_MICRON       0x13
 #define CID_MANFID_SAMSUNG      0x15
 #define CID_MANFID_APACER       0x27
@@ -284,4 +288,10 @@
 {
 	return c->quirks & MMC_QUIRK_BROKEN_CACHE_FLUSH;
 }
+
+static inline int mmc_card_broken_sd_poweroff_notify(const struct mmc_card *c)
+{
+	return c->quirks & MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY;
+}
+
 #endif
--- linux-qcom-6.8.0.orig/drivers/mmc/core/core.c
+++ linux-qcom-6.8.0/drivers/mmc/core/core.c
@@ -2296,6 +2296,9 @@
 
 void __mmc_stop_host(struct mmc_host *host)
 {
+	if (host->rescan_disable)
+		return;
+
 	if (host->slot.cd_irq >= 0) {
 		mmc_gpio_set_cd_wake(host, false);
 		disable_irq(host->slot.cd_irq);
--- linux-qcom-6.8.0.orig/drivers/mmc/core/mmc.c
+++ linux-qcom-6.8.0/drivers/mmc/core/mmc.c
@@ -51,20 +51,6 @@
 	35,	40,	45,	50,	55,	60,	70,	80,
 };
 
-#define UNSTUFF_BITS(resp,start,size)					\
-	({								\
-		const int __size = size;				\
-		const u32 __mask = (__size < 32 ? 1 << __size : 0) - 1;	\
-		const int __off = 3 - ((start) / 32);			\
-		const int __shft = (start) & 31;			\
-		u32 __res;						\
-									\
-		__res = resp[__off] >> __shft;				\
-		if (__size + __shft > 32)				\
-			__res |= resp[__off-1] << ((32 - __shft) % 32);	\
-		__res & __mask;						\
-	})
-
 /*
  * Given the decoded CSD structure, decode the raw CID to our CID structure.
  */
@@ -85,36 +71,36 @@
 	switch (card->csd.mmca_vsn) {
 	case 0: /* MMC v1.0 - v1.2 */
 	case 1: /* MMC v1.4 */
-		card->cid.manfid	= UNSTUFF_BITS(resp, 104, 24);
-		card->cid.prod_name[0]	= UNSTUFF_BITS(resp, 96, 8);
-		card->cid.prod_name[1]	= UNSTUFF_BITS(resp, 88, 8);
-		card->cid.prod_name[2]	= UNSTUFF_BITS(resp, 80, 8);
-		card->cid.prod_name[3]	= UNSTUFF_BITS(resp, 72, 8);
-		card->cid.prod_name[4]	= UNSTUFF_BITS(resp, 64, 8);
-		card->cid.prod_name[5]	= UNSTUFF_BITS(resp, 56, 8);
-		card->cid.prod_name[6]	= UNSTUFF_BITS(resp, 48, 8);
-		card->cid.hwrev		= UNSTUFF_BITS(resp, 44, 4);
-		card->cid.fwrev		= UNSTUFF_BITS(resp, 40, 4);
-		card->cid.serial	= UNSTUFF_BITS(resp, 16, 24);
-		card->cid.month		= UNSTUFF_BITS(resp, 12, 4);
-		card->cid.year		= UNSTUFF_BITS(resp, 8, 4) + 1997;
+		card->cid.manfid	= unstuff_bits(resp, 104, 24);
+		card->cid.prod_name[0]	= unstuff_bits(resp, 96, 8);
+		card->cid.prod_name[1]	= unstuff_bits(resp, 88, 8);
+		card->cid.prod_name[2]	= unstuff_bits(resp, 80, 8);
+		card->cid.prod_name[3]	= unstuff_bits(resp, 72, 8);
+		card->cid.prod_name[4]	= unstuff_bits(resp, 64, 8);
+		card->cid.prod_name[5]	= unstuff_bits(resp, 56, 8);
+		card->cid.prod_name[6]	= unstuff_bits(resp, 48, 8);
+		card->cid.hwrev		= unstuff_bits(resp, 44, 4);
+		card->cid.fwrev		= unstuff_bits(resp, 40, 4);
+		card->cid.serial	= unstuff_bits(resp, 16, 24);
+		card->cid.month		= unstuff_bits(resp, 12, 4);
+		card->cid.year		= unstuff_bits(resp, 8, 4) + 1997;
 		break;
 
 	case 2: /* MMC v2.0 - v2.2 */
 	case 3: /* MMC v3.1 - v3.3 */
 	case 4: /* MMC v4 */
-		card->cid.manfid	= UNSTUFF_BITS(resp, 120, 8);
-		card->cid.oemid		= UNSTUFF_BITS(resp, 104, 16);
-		card->cid.prod_name[0]	= UNSTUFF_BITS(resp, 96, 8);
-		card->cid.prod_name[1]	= UNSTUFF_BITS(resp, 88, 8);
-		card->cid.prod_name[2]	= UNSTUFF_BITS(resp, 80, 8);
-		card->cid.prod_name[3]	= UNSTUFF_BITS(resp, 72, 8);
-		card->cid.prod_name[4]	= UNSTUFF_BITS(resp, 64, 8);
-		card->cid.prod_name[5]	= UNSTUFF_BITS(resp, 56, 8);
-		card->cid.prv		= UNSTUFF_BITS(resp, 48, 8);
-		card->cid.serial	= UNSTUFF_BITS(resp, 16, 32);
-		card->cid.month		= UNSTUFF_BITS(resp, 12, 4);
-		card->cid.year		= UNSTUFF_BITS(resp, 8, 4) + 1997;
+		card->cid.manfid	= unstuff_bits(resp, 120, 8);
+		card->cid.oemid		= unstuff_bits(resp, 104, 16);
+		card->cid.prod_name[0]	= unstuff_bits(resp, 96, 8);
+		card->cid.prod_name[1]	= unstuff_bits(resp, 88, 8);
+		card->cid.prod_name[2]	= unstuff_bits(resp, 80, 8);
+		card->cid.prod_name[3]	= unstuff_bits(resp, 72, 8);
+		card->cid.prod_name[4]	= unstuff_bits(resp, 64, 8);
+		card->cid.prod_name[5]	= unstuff_bits(resp, 56, 8);
+		card->cid.prv		= unstuff_bits(resp, 48, 8);
+		card->cid.serial	= unstuff_bits(resp, 16, 32);
+		card->cid.month		= unstuff_bits(resp, 12, 4);
+		card->cid.year		= unstuff_bits(resp, 8, 4) + 1997;
 		break;
 
 	default:
@@ -161,43 +147,43 @@
 	 * v1.2 has extra information in bits 15, 11 and 10.
 	 * We also support eMMC v4.4 & v4.41.
 	 */
-	csd->structure = UNSTUFF_BITS(resp, 126, 2);
+	csd->structure = unstuff_bits(resp, 126, 2);
 	if (csd->structure == 0) {
 		pr_err("%s: unrecognised CSD structure version %d\n",
 			mmc_hostname(card->host), csd->structure);
 		return -EINVAL;
 	}
 
-	csd->mmca_vsn	 = UNSTUFF_BITS(resp, 122, 4);
-	m = UNSTUFF_BITS(resp, 115, 4);
-	e = UNSTUFF_BITS(resp, 112, 3);
+	csd->mmca_vsn	 = unstuff_bits(resp, 122, 4);
+	m = unstuff_bits(resp, 115, 4);
+	e = unstuff_bits(resp, 112, 3);
 	csd->taac_ns	 = (taac_exp[e] * taac_mant[m] + 9) / 10;
-	csd->taac_clks	 = UNSTUFF_BITS(resp, 104, 8) * 100;
+	csd->taac_clks	 = unstuff_bits(resp, 104, 8) * 100;
 
-	m = UNSTUFF_BITS(resp, 99, 4);
-	e = UNSTUFF_BITS(resp, 96, 3);
+	m = unstuff_bits(resp, 99, 4);
+	e = unstuff_bits(resp, 96, 3);
 	csd->max_dtr	  = tran_exp[e] * tran_mant[m];
-	csd->cmdclass	  = UNSTUFF_BITS(resp, 84, 12);
+	csd->cmdclass	  = unstuff_bits(resp, 84, 12);
 
-	e = UNSTUFF_BITS(resp, 47, 3);
-	m = UNSTUFF_BITS(resp, 62, 12);
+	e = unstuff_bits(resp, 47, 3);
+	m = unstuff_bits(resp, 62, 12);
 	csd->capacity	  = (1 + m) << (e + 2);
 
-	csd->read_blkbits = UNSTUFF_BITS(resp, 80, 4);
-	csd->read_partial = UNSTUFF_BITS(resp, 79, 1);
-	csd->write_misalign = UNSTUFF_BITS(resp, 78, 1);
-	csd->read_misalign = UNSTUFF_BITS(resp, 77, 1);
-	csd->dsr_imp = UNSTUFF_BITS(resp, 76, 1);
-	csd->r2w_factor = UNSTUFF_BITS(resp, 26, 3);
-	csd->write_blkbits = UNSTUFF_BITS(resp, 22, 4);
-	csd->write_partial = UNSTUFF_BITS(resp, 21, 1);
+	csd->read_blkbits = unstuff_bits(resp, 80, 4);
+	csd->read_partial = unstuff_bits(resp, 79, 1);
+	csd->write_misalign = unstuff_bits(resp, 78, 1);
+	csd->read_misalign = unstuff_bits(resp, 77, 1);
+	csd->dsr_imp = unstuff_bits(resp, 76, 1);
+	csd->r2w_factor = unstuff_bits(resp, 26, 3);
+	csd->write_blkbits = unstuff_bits(resp, 22, 4);
+	csd->write_partial = unstuff_bits(resp, 21, 1);
 
 	if (csd->write_blkbits >= 9) {
-		a = UNSTUFF_BITS(resp, 42, 5);
-		b = UNSTUFF_BITS(resp, 37, 5);
+		a = unstuff_bits(resp, 42, 5);
+		b = unstuff_bits(resp, 37, 5);
 		csd->erase_size = (a + 1) * (b + 1);
 		csd->erase_size <<= csd->write_blkbits - 9;
-		csd->wp_grp_size = UNSTUFF_BITS(resp, 32, 5);
+		csd->wp_grp_size = unstuff_bits(resp, 32, 5);
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/mmc/core/mmc_ops.h
+++ linux-qcom-6.8.0/drivers/mmc/core/mmc_ops.h
@@ -56,5 +56,19 @@
 int mmc_cmdq_disable(struct mmc_card *card);
 int mmc_sanitize(struct mmc_card *card, unsigned int timeout_ms);
 
+static inline u32 unstuff_bits(const u32 *resp, int start, int size)
+{
+	const int __size = size;
+	const u32 __mask = (__size < 32 ? 1 << __size : 0) - 1;
+	const int __off = 3 - (start / 32);
+	const int __shft = start & 31;
+	u32 __res = resp[__off] >> __shft;
+
+	if (__size + __shft > 32)
+		__res |= resp[__off - 1] << ((32 - __shft) % 32);
+
+	return __res & __mask;
+}
+
 #endif
 
--- linux-qcom-6.8.0.orig/drivers/mmc/core/mmc_test.c
+++ linux-qcom-6.8.0/drivers/mmc/core/mmc_test.c
@@ -3125,13 +3125,13 @@
 	test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL);
 #ifdef CONFIG_HIGHMEM
 	test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER);
+	if (!test->highmem) {
+		count = -ENOMEM;
+		goto free_test_buffer;
+	}
 #endif
 
-#ifdef CONFIG_HIGHMEM
-	if (test->buffer && test->highmem) {
-#else
 	if (test->buffer) {
-#endif
 		mutex_lock(&mmc_test_lock);
 		mmc_test_run(test, testcase);
 		mutex_unlock(&mmc_test_lock);
@@ -3139,6 +3139,7 @@
 
 #ifdef CONFIG_HIGHMEM
 	__free_pages(test->highmem, BUFFER_ORDER);
+free_test_buffer:
 #endif
 	kfree(test->buffer);
 	kfree(test);
--- linux-qcom-6.8.0.orig/drivers/mmc/core/quirks.h
+++ linux-qcom-6.8.0/drivers/mmc/core/quirks.h
@@ -15,6 +15,28 @@
 
 #include "card.h"
 
+static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = {
+	/*
+	 * Kingston Canvas Go! Plus microSD cards never finish SD cache flush.
+	 * This has so far only been observed on cards from 11/2019, while new
+	 * cards from 2023/05 do not exhibit this behavior.
+	 */
+	_FIXUP_EXT("SD64G", CID_MANFID_KINGSTON_SD, 0x5449, 2019, 11,
+		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
+		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
+
+	/*
+	 * GIGASTONE Gaming Plus microSD cards manufactured on 02/2022 never
+	 * clear Flush Cache bit and set Poweroff Notification Ready bit.
+	 */
+	_FIXUP_EXT("ASTC", CID_MANFID_GIGASTONE, 0x3456, 2022, 2,
+		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
+		   MMC_QUIRK_BROKEN_SD_CACHE | MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY,
+		   EXT_CSD_REV_ANY),
+
+	END_FIXUP
+};
+
 static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = {
 #define INAND_CMD38_ARG_EXT_CSD  113
 #define INAND_CMD38_ARG_ERASE    0x00
@@ -54,15 +76,6 @@
 		  MMC_QUIRK_BLK_NO_CMD23),
 
 	/*
-	 * Kingston Canvas Go! Plus microSD cards never finish SD cache flush.
-	 * This has so far only been observed on cards from 11/2019, while new
-	 * cards from 2023/05 do not exhibit this behavior.
-	 */
-	_FIXUP_EXT("SD64G", CID_MANFID_KINGSTON_SD, 0x5449, 2019, 11,
-		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
-		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
-
-	/*
 	 * Some SD cards lockup while using CMD23 multiblock transfers.
 	 */
 	MMC_FIXUP("AF SD", CID_MANFID_ATP, CID_OEMID_ANY, add_quirk_sd,
--- linux-qcom-6.8.0.orig/drivers/mmc/core/sd.c
+++ linux-qcom-6.8.0/drivers/mmc/core/sd.c
@@ -26,6 +26,7 @@
 #include "host.h"
 #include "bus.h"
 #include "mmc_ops.h"
+#include "quirks.h"
 #include "sd.h"
 #include "sd_ops.h"
 
@@ -55,20 +56,6 @@
 	SZ_16M / 512,	(SZ_16M + SZ_8M) / 512,	SZ_32M / 512,	SZ_64M / 512,
 };
 
-#define UNSTUFF_BITS(resp,start,size)					\
-	({								\
-		const int __size = size;				\
-		const u32 __mask = (__size < 32 ? 1 << __size : 0) - 1;	\
-		const int __off = 3 - ((start) / 32);			\
-		const int __shft = (start) & 31;			\
-		u32 __res;						\
-									\
-		__res = resp[__off] >> __shft;				\
-		if (__size + __shft > 32)				\
-			__res |= resp[__off-1] << ((32 - __shft) % 32);	\
-		__res & __mask;						\
-	})
-
 #define SD_POWEROFF_NOTIFY_TIMEOUT_MS 1000
 #define SD_WRITE_EXTR_SINGLE_TIMEOUT_MS 1000
 
@@ -94,18 +81,18 @@
 	 * SD doesn't currently have a version field so we will
 	 * have to assume we can parse this.
 	 */
-	card->cid.manfid		= UNSTUFF_BITS(resp, 120, 8);
-	card->cid.oemid			= UNSTUFF_BITS(resp, 104, 16);
-	card->cid.prod_name[0]		= UNSTUFF_BITS(resp, 96, 8);
-	card->cid.prod_name[1]		= UNSTUFF_BITS(resp, 88, 8);
-	card->cid.prod_name[2]		= UNSTUFF_BITS(resp, 80, 8);
-	card->cid.prod_name[3]		= UNSTUFF_BITS(resp, 72, 8);
-	card->cid.prod_name[4]		= UNSTUFF_BITS(resp, 64, 8);
-	card->cid.hwrev			= UNSTUFF_BITS(resp, 60, 4);
-	card->cid.fwrev			= UNSTUFF_BITS(resp, 56, 4);
-	card->cid.serial		= UNSTUFF_BITS(resp, 24, 32);
-	card->cid.year			= UNSTUFF_BITS(resp, 12, 8);
-	card->cid.month			= UNSTUFF_BITS(resp, 8, 4);
+	card->cid.manfid		= unstuff_bits(resp, 120, 8);
+	card->cid.oemid			= unstuff_bits(resp, 104, 16);
+	card->cid.prod_name[0]		= unstuff_bits(resp, 96, 8);
+	card->cid.prod_name[1]		= unstuff_bits(resp, 88, 8);
+	card->cid.prod_name[2]		= unstuff_bits(resp, 80, 8);
+	card->cid.prod_name[3]		= unstuff_bits(resp, 72, 8);
+	card->cid.prod_name[4]		= unstuff_bits(resp, 64, 8);
+	card->cid.hwrev			= unstuff_bits(resp, 60, 4);
+	card->cid.fwrev			= unstuff_bits(resp, 56, 4);
+	card->cid.serial		= unstuff_bits(resp, 24, 32);
+	card->cid.year			= unstuff_bits(resp, 12, 8);
+	card->cid.month			= unstuff_bits(resp, 8, 4);
 
 	card->cid.year += 2000; /* SD cards year offset */
 }
@@ -113,53 +100,54 @@
 /*
  * Given a 128-bit response, decode to our card CSD structure.
  */
-static int mmc_decode_csd(struct mmc_card *card)
+static int mmc_decode_csd(struct mmc_card *card, bool is_sduc)
 {
 	struct mmc_csd *csd = &card->csd;
 	unsigned int e, m, csd_struct;
 	u32 *resp = card->raw_csd;
 
-	csd_struct = UNSTUFF_BITS(resp, 126, 2);
+	csd_struct = unstuff_bits(resp, 126, 2);
 
 	switch (csd_struct) {
 	case 0:
-		m = UNSTUFF_BITS(resp, 115, 4);
-		e = UNSTUFF_BITS(resp, 112, 3);
+		m = unstuff_bits(resp, 115, 4);
+		e = unstuff_bits(resp, 112, 3);
 		csd->taac_ns	 = (taac_exp[e] * taac_mant[m] + 9) / 10;
-		csd->taac_clks	 = UNSTUFF_BITS(resp, 104, 8) * 100;
+		csd->taac_clks	 = unstuff_bits(resp, 104, 8) * 100;
 
-		m = UNSTUFF_BITS(resp, 99, 4);
-		e = UNSTUFF_BITS(resp, 96, 3);
+		m = unstuff_bits(resp, 99, 4);
+		e = unstuff_bits(resp, 96, 3);
 		csd->max_dtr	  = tran_exp[e] * tran_mant[m];
-		csd->cmdclass	  = UNSTUFF_BITS(resp, 84, 12);
+		csd->cmdclass	  = unstuff_bits(resp, 84, 12);
 
-		e = UNSTUFF_BITS(resp, 47, 3);
-		m = UNSTUFF_BITS(resp, 62, 12);
+		e = unstuff_bits(resp, 47, 3);
+		m = unstuff_bits(resp, 62, 12);
 		csd->capacity	  = (1 + m) << (e + 2);
 
-		csd->read_blkbits = UNSTUFF_BITS(resp, 80, 4);
-		csd->read_partial = UNSTUFF_BITS(resp, 79, 1);
-		csd->write_misalign = UNSTUFF_BITS(resp, 78, 1);
-		csd->read_misalign = UNSTUFF_BITS(resp, 77, 1);
-		csd->dsr_imp = UNSTUFF_BITS(resp, 76, 1);
-		csd->r2w_factor = UNSTUFF_BITS(resp, 26, 3);
-		csd->write_blkbits = UNSTUFF_BITS(resp, 22, 4);
-		csd->write_partial = UNSTUFF_BITS(resp, 21, 1);
+		csd->read_blkbits = unstuff_bits(resp, 80, 4);
+		csd->read_partial = unstuff_bits(resp, 79, 1);
+		csd->write_misalign = unstuff_bits(resp, 78, 1);
+		csd->read_misalign = unstuff_bits(resp, 77, 1);
+		csd->dsr_imp = unstuff_bits(resp, 76, 1);
+		csd->r2w_factor = unstuff_bits(resp, 26, 3);
+		csd->write_blkbits = unstuff_bits(resp, 22, 4);
+		csd->write_partial = unstuff_bits(resp, 21, 1);
 
-		if (UNSTUFF_BITS(resp, 46, 1)) {
+		if (unstuff_bits(resp, 46, 1)) {
 			csd->erase_size = 1;
 		} else if (csd->write_blkbits >= 9) {
-			csd->erase_size = UNSTUFF_BITS(resp, 39, 7) + 1;
+			csd->erase_size = unstuff_bits(resp, 39, 7) + 1;
 			csd->erase_size <<= csd->write_blkbits - 9;
 		}
 
-		if (UNSTUFF_BITS(resp, 13, 1))
+		if (unstuff_bits(resp, 13, 1))
 			mmc_card_set_readonly(card);
 		break;
 	case 1:
+	case 2:
 		/*
-		 * This is a block-addressed SDHC or SDXC card. Most
-		 * interesting fields are unused and have fixed
+		 * This is a block-addressed SDHC, SDXC or SDUC card.
+		 * Most interesting fields are unused and have fixed
 		 * values. To avoid getting tripped by buggy cards,
 		 * we assume those fixed values ourselves.
 		 */
@@ -168,18 +156,23 @@
 		csd->taac_ns	 = 0; /* Unused */
 		csd->taac_clks	 = 0; /* Unused */
 
-		m = UNSTUFF_BITS(resp, 99, 4);
-		e = UNSTUFF_BITS(resp, 96, 3);
+		m = unstuff_bits(resp, 99, 4);
+		e = unstuff_bits(resp, 96, 3);
 		csd->max_dtr	  = tran_exp[e] * tran_mant[m];
-		csd->cmdclass	  = UNSTUFF_BITS(resp, 84, 12);
-		csd->c_size	  = UNSTUFF_BITS(resp, 48, 22);
+		csd->cmdclass	  = unstuff_bits(resp, 84, 12);
 
-		/* SDXC cards have a minimum C_SIZE of 0x00FFFF */
-		if (csd->c_size >= 0xFFFF)
+		if (csd_struct == 1)
+			m = unstuff_bits(resp, 48, 22);
+		else
+			m = unstuff_bits(resp, 48, 28);
+		csd->c_size = m;
+
+		if (csd->c_size >= 0x400000 && is_sduc)
+			mmc_card_set_ult_capacity(card);
+		else if (csd->c_size >= 0xFFFF)
 			mmc_card_set_ext_capacity(card);
 
-		m = UNSTUFF_BITS(resp, 48, 22);
-		csd->capacity     = (1 + m) << 10;
+		csd->capacity     = (1 + (typeof(sector_t))m) << 10;
 
 		csd->read_blkbits = 9;
 		csd->read_partial = 0;
@@ -190,7 +183,7 @@
 		csd->write_partial = 0;
 		csd->erase_size = 1;
 
-		if (UNSTUFF_BITS(resp, 13, 1))
+		if (unstuff_bits(resp, 13, 1))
 			mmc_card_set_readonly(card);
 		break;
 	default:
@@ -216,33 +209,33 @@
 	resp[3] = card->raw_scr[1];
 	resp[2] = card->raw_scr[0];
 
-	scr_struct = UNSTUFF_BITS(resp, 60, 4);
+	scr_struct = unstuff_bits(resp, 60, 4);
 	if (scr_struct != 0) {
 		pr_err("%s: unrecognised SCR structure version %d\n",
 			mmc_hostname(card->host), scr_struct);
 		return -EINVAL;
 	}
 
-	scr->sda_vsn = UNSTUFF_BITS(resp, 56, 4);
-	scr->bus_widths = UNSTUFF_BITS(resp, 48, 4);
+	scr->sda_vsn = unstuff_bits(resp, 56, 4);
+	scr->bus_widths = unstuff_bits(resp, 48, 4);
 	if (scr->sda_vsn == SCR_SPEC_VER_2)
 		/* Check if Physical Layer Spec v3.0 is supported */
-		scr->sda_spec3 = UNSTUFF_BITS(resp, 47, 1);
+		scr->sda_spec3 = unstuff_bits(resp, 47, 1);
 
 	if (scr->sda_spec3) {
-		scr->sda_spec4 = UNSTUFF_BITS(resp, 42, 1);
-		scr->sda_specx = UNSTUFF_BITS(resp, 38, 4);
+		scr->sda_spec4 = unstuff_bits(resp, 42, 1);
+		scr->sda_specx = unstuff_bits(resp, 38, 4);
 	}
 
-	if (UNSTUFF_BITS(resp, 55, 1))
+	if (unstuff_bits(resp, 55, 1))
 		card->erased_byte = 0xFF;
 	else
 		card->erased_byte = 0x0;
 
 	if (scr->sda_spec4)
-		scr->cmds = UNSTUFF_BITS(resp, 32, 4);
+		scr->cmds = unstuff_bits(resp, 32, 4);
 	else if (scr->sda_spec3)
-		scr->cmds = UNSTUFF_BITS(resp, 32, 2);
+		scr->cmds = unstuff_bits(resp, 32, 2);
 
 	/* SD Spec says: any SD Card shall set at least bits 0 and 2 */
 	if (!(scr->bus_widths & SD_SCR_BUS_WIDTH_1) ||
@@ -288,17 +281,17 @@
 	kfree(raw_ssr);
 
 	/*
-	 * UNSTUFF_BITS only works with four u32s so we have to offset the
+	 * unstuff_bits only works with four u32s so we have to offset the
 	 * bitfield positions accordingly.
 	 */
-	au = UNSTUFF_BITS(card->raw_ssr, 428 - 384, 4);
+	au = unstuff_bits(card->raw_ssr, 428 - 384, 4);
 	if (au) {
 		if (au <= 9 || card->scr.sda_spec3) {
 			card->ssr.au = sd_au_size[au];
-			es = UNSTUFF_BITS(card->raw_ssr, 408 - 384, 16);
-			et = UNSTUFF_BITS(card->raw_ssr, 402 - 384, 6);
+			es = unstuff_bits(card->raw_ssr, 408 - 384, 16);
+			et = unstuff_bits(card->raw_ssr, 402 - 384, 6);
 			if (es && et) {
-				eo = UNSTUFF_BITS(card->raw_ssr, 400 - 384, 2);
+				eo = unstuff_bits(card->raw_ssr, 400 - 384, 2);
 				card->ssr.erase_timeout = (et * 1000) / es;
 				card->ssr.erase_offset = eo * 1000;
 			}
@@ -312,7 +305,7 @@
 	 * starting SD5.1 discard is supported if DISCARD_SUPPORT (b313) is set
 	 */
 	resp[3] = card->raw_ssr[6];
-	discard_support = UNSTUFF_BITS(resp, 313 - 288, 1);
+	discard_support = unstuff_bits(resp, 313 - 288, 1);
 	card->erase_arg = (card->scr.sda_specx && discard_support) ?
 			    SD_DISCARD_ARG : SD_ERASE_ARG;
 
@@ -886,7 +879,7 @@
 	return err;
 }
 
-int mmc_sd_get_csd(struct mmc_card *card)
+int mmc_sd_get_csd(struct mmc_card *card, bool is_sduc)
 {
 	int err;
 
@@ -897,7 +890,7 @@
 	if (err)
 		return err;
 
-	err = mmc_decode_csd(card);
+	err = mmc_decode_csd(card, is_sduc);
 	if (err)
 		return err;
 
@@ -1117,7 +1110,7 @@
 	card->ext_power.rev = reg_buf[0] & 0xf;
 
 	/* Power Off Notification support at bit 4. */
-	if (reg_buf[1] & BIT(4))
+	if ((reg_buf[1] & BIT(4)) && !mmc_card_broken_sd_poweroff_notify(card))
 		card->ext_power.feature_support |= SD_EXT_POWER_OFF_NOTIFY;
 
 	/* Power Sustenance support at bit 5. */
@@ -1452,7 +1445,7 @@
 	}
 
 	if (!oldcard) {
-		err = mmc_sd_get_csd(card);
+		err = mmc_sd_get_csd(card, false);
 		if (err)
 			goto free_card;
 
@@ -1475,6 +1468,9 @@
 			goto free_card;
 	}
 
+	/* Apply quirks prior to card setup */
+	mmc_fixup_device(card, mmc_sd_fixups);
+
 	err = mmc_sd_setup_card(host, card, oldcard != NULL);
 	if (err)
 		goto free_card;
--- linux-qcom-6.8.0.orig/drivers/mmc/core/sd.h
+++ linux-qcom-6.8.0/drivers/mmc/core/sd.h
@@ -10,7 +10,7 @@
 struct mmc_card;
 
 int mmc_sd_get_cid(struct mmc_host *host, u32 ocr, u32 *cid, u32 *rocr);
-int mmc_sd_get_csd(struct mmc_card *card);
+int mmc_sd_get_csd(struct mmc_card *card, bool is_sduc);
 void mmc_decode_cid(struct mmc_card *card);
 int mmc_sd_setup_card(struct mmc_host *host, struct mmc_card *card,
 	bool reinit);
--- linux-qcom-6.8.0.orig/drivers/mmc/core/sdio.c
+++ linux-qcom-6.8.0/drivers/mmc/core/sdio.c
@@ -769,7 +769,7 @@
 	 * Read CSD, before selecting the card
 	 */
 	if (!oldcard && mmc_card_sd_combo(card)) {
-		err = mmc_sd_get_csd(card);
+		err = mmc_sd_get_csd(card, false);
 		if (err)
 			goto remove;
 
--- linux-qcom-6.8.0.orig/drivers/mmc/core/slot-gpio.c
+++ linux-qcom-6.8.0/drivers/mmc/core/slot-gpio.c
@@ -221,6 +221,26 @@
 }
 EXPORT_SYMBOL(mmc_gpiod_request_cd);
 
+/**
+ * mmc_gpiod_set_cd_config - set config for card-detection GPIO
+ * @host: mmc host
+ * @config: Generic pinconf config (from pinconf_to_config_packed())
+ *
+ * This can be used by mmc host drivers to fixup a card-detection GPIO's config
+ * (e.g. set PIN_CONFIG_BIAS_PULL_UP) after acquiring the GPIO descriptor
+ * through mmc_gpiod_request_cd().
+ *
+ * Returns:
+ * 0 on success, or a negative errno value on error.
+ */
+int mmc_gpiod_set_cd_config(struct mmc_host *host, unsigned long config)
+{
+	struct mmc_gpio *ctx = host->slot.handler_priv;
+
+	return gpiod_set_config(ctx->cd_gpio, config);
+}
+EXPORT_SYMBOL(mmc_gpiod_set_cd_config);
+
 bool mmc_can_gpio_cd(struct mmc_host *host)
 {
 	struct mmc_gpio *ctx = host->slot.handler_priv;
--- linux-qcom-6.8.0.orig/drivers/mmc/host/cqhci-core.c
+++ linux-qcom-6.8.0/drivers/mmc/host/cqhci-core.c
@@ -612,7 +612,7 @@
 		cqhci_writel(cq_host, 0, CQHCI_CTL);
 		mmc->cqe_on = true;
 		pr_debug("%s: cqhci: CQE on\n", mmc_hostname(mmc));
-		if (cqhci_readl(cq_host, CQHCI_CTL) && CQHCI_HALT) {
+		if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT) {
 			pr_err("%s: cqhci: CQE failed to exit halt state\n",
 			       mmc_hostname(mmc));
 		}
--- linux-qcom-6.8.0.orig/drivers/mmc/host/cqhci-crypto.c
+++ linux-qcom-6.8.0/drivers/mmc/host/cqhci-crypto.c
@@ -32,6 +32,7 @@
 }
 
 static int cqhci_crypto_program_key(struct cqhci_host *cq_host,
+				    const struct blk_crypto_key *bkey,
 				    const union cqhci_crypto_cfg_entry *cfg,
 				    int slot)
 {
@@ -39,7 +40,7 @@
 	int i;
 
 	if (cq_host->ops->program_key)
-		return cq_host->ops->program_key(cq_host, cfg, slot);
+		return cq_host->ops->program_key(cq_host, bkey, cfg, slot);
 
 	/* Clear CFGE */
 	cqhci_writel(cq_host, 0, slot_offset + 16 * sizeof(cfg->reg_val[0]));
@@ -90,16 +91,18 @@
 	cfg.crypto_cap_idx = cap_idx;
 	cfg.config_enable = CQHCI_CRYPTO_CONFIGURATION_ENABLE;
 
-	if (ccap_array[cap_idx].algorithm_id == CQHCI_CRYPTO_ALG_AES_XTS) {
-		/* In XTS mode, the blk_crypto_key's size is already doubled */
-		memcpy(cfg.crypto_key, key->raw, key->size/2);
-		memcpy(cfg.crypto_key + CQHCI_CRYPTO_KEY_MAX_SIZE/2,
-		       key->raw + key->size/2, key->size/2);
-	} else {
-		memcpy(cfg.crypto_key, key->raw, key->size);
+	if (key->crypto_cfg.key_type != BLK_CRYPTO_KEY_TYPE_HW_WRAPPED) {
+		if (ccap_array[cap_idx].algorithm_id == CQHCI_CRYPTO_ALG_AES_XTS) {
+			/* In XTS mode, the blk_crypto_key's size is already doubled */
+			memcpy(cfg.crypto_key, key->raw, key->size/2);
+			memcpy(cfg.crypto_key + CQHCI_CRYPTO_KEY_MAX_SIZE/2,
+			       key->raw + key->size/2, key->size/2);
+		} else {
+			memcpy(cfg.crypto_key, key->raw, key->size);
+		}
 	}
 
-	err = cqhci_crypto_program_key(cq_host, &cfg, slot);
+	err = cqhci_crypto_program_key(cq_host, key, &cfg, slot);
 
 	memzero_explicit(&cfg, sizeof(cfg));
 	return err;
@@ -113,7 +116,7 @@
 	 */
 	union cqhci_crypto_cfg_entry cfg = {};
 
-	return cqhci_crypto_program_key(cq_host, &cfg, slot);
+	return cqhci_crypto_program_key(cq_host, NULL, &cfg, slot);
 }
 
 static int cqhci_crypto_keyslot_evict(struct blk_crypto_profile *profile,
@@ -125,6 +128,58 @@
 	return cqhci_crypto_clear_keyslot(cq_host, slot);
 }
 
+static int cqhci_crypto_derive_sw_secret(struct blk_crypto_profile *profile,
+					  const u8 wkey[], size_t wkey_size,
+					  u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE])
+{
+	struct cqhci_host *cq_host = cqhci_host_from_crypto_profile(profile);
+
+	if (cq_host->ops && cq_host->ops->derive_sw_secret)
+		return  cq_host->ops->derive_sw_secret(cq_host, wkey, wkey_size,
+						       sw_secret);
+
+	return -EOPNOTSUPP;
+}
+
+static int cqhci_crypto_generate_key(struct blk_crypto_profile *profile,
+				     u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct cqhci_host *cq_host = cqhci_host_from_crypto_profile(profile);
+
+	if (cq_host->ops && cq_host->ops->generate_key)
+		return  cq_host->ops->generate_key(cq_host, lt_key);
+
+	return -EOPNOTSUPP;
+}
+
+static int cqhci_crypto_prepare_key(struct blk_crypto_profile *profile,
+				    const u8 *lt_key, size_t lt_key_size,
+				    u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+
+	struct cqhci_host *cq_host = cqhci_host_from_crypto_profile(profile);
+
+	if (cq_host->ops && cq_host->ops->prepare_key)
+		return  cq_host->ops->prepare_key(cq_host, lt_key,
+						  lt_key_size, eph_key);
+
+	return -EOPNOTSUPP;
+}
+
+static int cqhci_crypto_import_key(struct blk_crypto_profile *profile,
+				   const u8 *imp_key, size_t imp_key_size,
+				   u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+
+	struct cqhci_host *cq_host = cqhci_host_from_crypto_profile(profile);
+
+	if (cq_host->ops && cq_host->ops->import_key)
+		return  cq_host->ops->import_key(cq_host, imp_key,
+						 imp_key_size, lt_key);
+
+	return -EOPNOTSUPP;
+}
+
 /*
  * The keyslot management operations for CQHCI crypto.
  *
@@ -136,6 +191,10 @@
 static const struct blk_crypto_ll_ops cqhci_crypto_ops = {
 	.keyslot_program	= cqhci_crypto_keyslot_program,
 	.keyslot_evict		= cqhci_crypto_keyslot_evict,
+	.derive_sw_secret	= cqhci_crypto_derive_sw_secret,
+	.generate_key		= cqhci_crypto_generate_key,
+	.prepare_key		= cqhci_crypto_prepare_key,
+	.import_key		= cqhci_crypto_import_key,
 };
 
 static enum blk_crypto_mode_num
@@ -210,6 +269,13 @@
 	/* Unfortunately, CQHCI crypto only supports 32 DUN bits. */
 	profile->max_dun_bytes_supported = 4;
 
+	if (cq_host->quirks & CQHCI_QUIRK_USES_WRAPPED_CRYPTO_KEYS)
+		profile->key_types_supported =
+			BLK_CRYPTO_KEY_TYPE_HW_WRAPPED;
+	else
+		profile->key_types_supported =
+			BLK_CRYPTO_KEY_TYPE_STANDARD;
+
 	/*
 	 * Cache all the crypto capabilities and advertise the supported crypto
 	 * modes and data unit sizes to the block layer.
--- linux-qcom-6.8.0.orig/drivers/mmc/host/cqhci.h
+++ linux-qcom-6.8.0/drivers/mmc/host/cqhci.h
@@ -12,6 +12,7 @@
 #include <linux/completion.h>
 #include <linux/wait.h>
 #include <linux/irqreturn.h>
+#include <linux/blk-crypto.h>
 #include <asm/io.h>
 
 /* registers */
@@ -240,6 +241,12 @@
 	u32 quirks;
 #define CQHCI_QUIRK_SHORT_TXFR_DESC_SZ	0x1
 
+	/*
+	 * This quirk indicates that EMMC will be using HW wrapped keys
+	 * when using inline encryption.
+	 */
+#define CQHCI_QUIRK_USES_WRAPPED_CRYPTO_KEYS	0x2
+
 	bool enabled;
 	bool halted;
 	bool init_done;
@@ -279,6 +286,11 @@
 #endif
 };
 
+/* @derive_sw_secret: derive sw secret from a wrapped key
+ * @generate_key: generate a storage key and return longterm wrapped key
+ * @prepare_key: unwrap longterm key and return ephemeral wrapped key
+ * @import_key: import sw storage key and return longterm wrapped key
+ */
 struct cqhci_host_ops {
 	void (*dumpregs)(struct mmc_host *mmc);
 	void (*write_l)(struct cqhci_host *host, u32 val, int reg);
@@ -291,7 +303,19 @@
 	void (*post_disable)(struct mmc_host *mmc);
 #ifdef CONFIG_MMC_CRYPTO
 	int (*program_key)(struct cqhci_host *cq_host,
+			   const struct blk_crypto_key *bkey,
 			   const union cqhci_crypto_cfg_entry *cfg, int slot);
+	int (*derive_sw_secret)(struct cqhci_host *cq_host, const u8 wkey[],
+				unsigned int wkey_size,
+				u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE]);
+	int (*generate_key)(struct cqhci_host *cq_host,
+			    u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+	int (*prepare_key)(struct cqhci_host *cq_host,
+			   const u8 *lt_key, size_t lt_key_size,
+			   u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+	int (*import_key)(struct cqhci_host *cq_host, const u8 *imp_key,
+			  size_t imp_key_size,
+			  u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
 #endif
 };
 
--- linux-qcom-6.8.0.orig/drivers/mmc/host/davinci_mmc.c
+++ linux-qcom-6.8.0/drivers/mmc/host/davinci_mmc.c
@@ -238,6 +238,9 @@
 	host->buffer_bytes_left -= n;
 	host->bytes_left -= n;
 
+	if (n > sgm->length)
+		n = sgm->length;
+
 	/* NOTE:  we never transfer more than rw_threshold bytes
 	 * to/from the fifo here; there's no I/O overlap.
 	 * This also assumes that access width( i.e. ACCWD) is 4 bytes
@@ -1344,7 +1347,7 @@
 	return ret;
 }
 
-static void __exit davinci_mmcsd_remove(struct platform_device *pdev)
+static void davinci_mmcsd_remove(struct platform_device *pdev)
 {
 	struct mmc_davinci_host *host = platform_get_drvdata(pdev);
 
@@ -1399,7 +1402,7 @@
 		.of_match_table = davinci_mmc_dt_ids,
 	},
 	.probe		= davinci_mmcsd_probe,
-	.remove_new	= __exit_p(davinci_mmcsd_remove),
+	.remove_new	= davinci_mmcsd_remove,
 	.id_table	= davinci_mmc_devtype,
 };
 
--- linux-qcom-6.8.0.orig/drivers/mmc/host/dw_mmc.c
+++ linux-qcom-6.8.0/drivers/mmc/host/dw_mmc.c
@@ -3294,6 +3294,10 @@
 	host->biu_clk = devm_clk_get(host->dev, "biu");
 	if (IS_ERR(host->biu_clk)) {
 		dev_dbg(host->dev, "biu clock not available\n");
+		ret = PTR_ERR(host->biu_clk);
+		if (ret == -EPROBE_DEFER)
+			return ret;
+
 	} else {
 		ret = clk_prepare_enable(host->biu_clk);
 		if (ret) {
@@ -3305,6 +3309,10 @@
 	host->ciu_clk = devm_clk_get(host->dev, "ciu");
 	if (IS_ERR(host->ciu_clk)) {
 		dev_dbg(host->dev, "ciu clock not available\n");
+		ret = PTR_ERR(host->ciu_clk);
+		if (ret == -EPROBE_DEFER)
+			goto err_clk_biu;
+
 		host->bus_hz = host->pdata->bus_hz;
 	} else {
 		ret = clk_prepare_enable(host->ciu_clk);
--- linux-qcom-6.8.0.orig/drivers/mmc/host/mmc_spi.c
+++ linux-qcom-6.8.0/drivers/mmc/host/mmc_spi.c
@@ -223,10 +223,6 @@
 	u8 	leftover = 0;
 	unsigned short rotator;
 	int 	i;
-	char	tag[32];
-
-	snprintf(tag, sizeof(tag), "  ... CMD%d response SPI_%s",
-		cmd->opcode, maptype(cmd));
 
 	/* Except for data block reads, the whole response will already
 	 * be stored in the scratch buffer.  It's somewhere after the
@@ -379,8 +375,9 @@
 	}
 
 	if (value < 0)
-		dev_dbg(&host->spi->dev, "%s: resp %04x %08x\n",
-			tag, cmd->resp[0], cmd->resp[1]);
+		dev_dbg(&host->spi->dev,
+			"  ... CMD%d response SPI_%s: resp %04x %08x\n",
+			cmd->opcode, maptype(cmd), cmd->resp[0], cmd->resp[1]);
 
 	/* disable chipselect on errors and some success cases */
 	if (value >= 0 && cs_on)
--- linux-qcom-6.8.0.orig/drivers/mmc/host/mtk-sd.c
+++ linux-qcom-6.8.0/drivers/mmc/host/mtk-sd.c
@@ -1231,7 +1231,7 @@
 	}
 
 	if (!sbc_error && !(events & MSDC_INT_CMDRDY)) {
-		if (events & MSDC_INT_CMDTMO ||
+		if ((events & MSDC_INT_CMDTMO && !host->hs400_tuning) ||
 		    (!mmc_op_tuning(cmd->opcode) && !host->hs400_tuning))
 			/*
 			 * should not clear fifo/interrupt as the tune data
@@ -1324,9 +1324,9 @@
 static void msdc_cmd_next(struct msdc_host *host,
 		struct mmc_request *mrq, struct mmc_command *cmd)
 {
-	if ((cmd->error &&
-	    !(cmd->error == -EILSEQ &&
-	      (mmc_op_tuning(cmd->opcode) || host->hs400_tuning))) ||
+	if ((cmd->error && !host->hs400_tuning &&
+	     !(cmd->error == -EILSEQ &&
+	     mmc_op_tuning(cmd->opcode))) ||
 	    (mrq->sbc && mrq->sbc->error))
 		msdc_request_done(host, mrq);
 	else if (cmd == mrq->sbc)
@@ -2738,20 +2738,18 @@
 	}
 
 	/* Allocate MMC host for this device */
-	mmc = mmc_alloc_host(sizeof(struct msdc_host), &pdev->dev);
+	mmc = devm_mmc_alloc_host(&pdev->dev, sizeof(struct msdc_host));
 	if (!mmc)
 		return -ENOMEM;
 
 	host = mmc_priv(mmc);
 	ret = mmc_of_parse(mmc);
 	if (ret)
-		goto host_free;
+		return ret;
 
 	host->base = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(host->base)) {
-		ret = PTR_ERR(host->base);
-		goto host_free;
-	}
+	if (IS_ERR(host->base))
+		return PTR_ERR(host->base);
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
 	if (res) {
@@ -2762,53 +2760,45 @@
 
 	ret = mmc_regulator_get_supply(mmc);
 	if (ret)
-		goto host_free;
+		return ret;
 
 	ret = msdc_of_clock_parse(pdev, host);
 	if (ret)
-		goto host_free;
+		return ret;
 
 	host->reset = devm_reset_control_get_optional_exclusive(&pdev->dev,
 								"hrst");
-	if (IS_ERR(host->reset)) {
-		ret = PTR_ERR(host->reset);
-		goto host_free;
-	}
+	if (IS_ERR(host->reset))
+		return PTR_ERR(host->reset);
 
 	/* only eMMC has crypto property */
 	if (!(mmc->caps2 & MMC_CAP2_NO_MMC)) {
 		host->crypto_clk = devm_clk_get_optional(&pdev->dev, "crypto");
 		if (IS_ERR(host->crypto_clk))
-			host->crypto_clk = NULL;
-		else
+			return PTR_ERR(host->crypto_clk);
+		else if (host->crypto_clk)
 			mmc->caps2 |= MMC_CAP2_CRYPTO;
 	}
 
 	host->irq = platform_get_irq(pdev, 0);
-	if (host->irq < 0) {
-		ret = host->irq;
-		goto host_free;
-	}
+	if (host->irq < 0)
+		return host->irq;
 
 	host->pinctrl = devm_pinctrl_get(&pdev->dev);
-	if (IS_ERR(host->pinctrl)) {
-		ret = PTR_ERR(host->pinctrl);
-		dev_err(&pdev->dev, "Cannot find pinctrl!\n");
-		goto host_free;
-	}
+	if (IS_ERR(host->pinctrl))
+		return dev_err_probe(&pdev->dev, PTR_ERR(host->pinctrl),
+				     "Cannot find pinctrl");
 
 	host->pins_default = pinctrl_lookup_state(host->pinctrl, "default");
 	if (IS_ERR(host->pins_default)) {
-		ret = PTR_ERR(host->pins_default);
 		dev_err(&pdev->dev, "Cannot find pinctrl default!\n");
-		goto host_free;
+		return PTR_ERR(host->pins_default);
 	}
 
 	host->pins_uhs = pinctrl_lookup_state(host->pinctrl, "state_uhs");
 	if (IS_ERR(host->pins_uhs)) {
-		ret = PTR_ERR(host->pins_uhs);
 		dev_err(&pdev->dev, "Cannot find pinctrl uhs!\n");
-		goto host_free;
+		return PTR_ERR(host->pins_uhs);
 	}
 
 	/* Support for SDIO eint irq ? */
@@ -2887,7 +2877,7 @@
 	ret = msdc_ungate_clock(host);
 	if (ret) {
 		dev_err(&pdev->dev, "Cannot ungate clocks!\n");
-		goto release_mem;
+		goto release_clk;
 	}
 	msdc_init_hw(host);
 
@@ -2897,14 +2887,14 @@
 					     GFP_KERNEL);
 		if (!host->cq_host) {
 			ret = -ENOMEM;
-			goto host_free;
+			goto release;
 		}
 		host->cq_host->caps |= CQHCI_TASK_DESC_SZ_128;
 		host->cq_host->mmio = host->base + 0x800;
 		host->cq_host->ops = &msdc_cmdq_ops;
 		ret = cqhci_init(host->cq_host, mmc, true);
 		if (ret)
-			goto host_free;
+			goto release;
 		mmc->max_segs = 128;
 		/* cqhci 16bit length */
 		/* 0 size, means 65536 so we don't have to -1 here */
@@ -2931,21 +2921,20 @@
 end:
 	pm_runtime_disable(host->dev);
 release:
-	platform_set_drvdata(pdev, NULL);
 	msdc_deinit_hw(host);
+release_clk:
 	msdc_gate_clock(host);
+	platform_set_drvdata(pdev, NULL);
 release_mem:
+	device_init_wakeup(&pdev->dev, false);
 	if (host->dma.gpd)
 		dma_free_coherent(&pdev->dev,
 			2 * sizeof(struct mt_gpdma_desc),
 			host->dma.gpd, host->dma.gpd_addr);
 	if (host->dma.bd)
 		dma_free_coherent(&pdev->dev,
-			MAX_BD_NUM * sizeof(struct mt_bdma_desc),
-			host->dma.bd, host->dma.bd_addr);
-host_free:
-	mmc_free_host(mmc);
-
+				  MAX_BD_NUM * sizeof(struct mt_bdma_desc),
+				  host->dma.bd, host->dma.bd_addr);
 	return ret;
 }
 
@@ -2970,9 +2959,8 @@
 			2 * sizeof(struct mt_gpdma_desc),
 			host->dma.gpd, host->dma.gpd_addr);
 	dma_free_coherent(&pdev->dev, MAX_BD_NUM * sizeof(struct mt_bdma_desc),
-			host->dma.bd, host->dma.bd_addr);
-
-	mmc_free_host(mmc);
+			  host->dma.bd, host->dma.bd_addr);
+	device_init_wakeup(&pdev->dev, false);
 }
 
 static void msdc_save_reg(struct msdc_host *host)
--- linux-qcom-6.8.0.orig/drivers/mmc/host/omap.c
+++ linux-qcom-6.8.0/drivers/mmc/host/omap.c
@@ -1119,10 +1119,25 @@
 
 	host = slot->host;
 
-	if (slot->vsd)
-		gpiod_set_value(slot->vsd, power_on);
-	if (slot->vio)
-		gpiod_set_value(slot->vio, power_on);
+	if (power_on) {
+		if (slot->vsd) {
+			gpiod_set_value(slot->vsd, power_on);
+			msleep(1);
+		}
+		if (slot->vio) {
+			gpiod_set_value(slot->vio, power_on);
+			msleep(1);
+		}
+	} else {
+		if (slot->vio) {
+			gpiod_set_value(slot->vio, power_on);
+			msleep(50);
+		}
+		if (slot->vsd) {
+			gpiod_set_value(slot->vsd, power_on);
+			msleep(50);
+		}
+	}
 
 	if (slot->pdata->set_power != NULL)
 		slot->pdata->set_power(mmc_dev(slot->mmc), slot->id, power_on,
@@ -1259,18 +1274,18 @@
 	slot->pdata = &host->pdata->slots[id];
 
 	/* Check for some optional GPIO controls */
-	slot->vsd = gpiod_get_index_optional(host->dev, "vsd",
-					     id, GPIOD_OUT_LOW);
+	slot->vsd = devm_gpiod_get_index_optional(host->dev, "vsd",
+						  id, GPIOD_OUT_LOW);
 	if (IS_ERR(slot->vsd))
 		return dev_err_probe(host->dev, PTR_ERR(slot->vsd),
 				     "error looking up VSD GPIO\n");
-	slot->vio = gpiod_get_index_optional(host->dev, "vio",
-					     id, GPIOD_OUT_LOW);
+	slot->vio = devm_gpiod_get_index_optional(host->dev, "vio",
+						  id, GPIOD_OUT_LOW);
 	if (IS_ERR(slot->vio))
 		return dev_err_probe(host->dev, PTR_ERR(slot->vio),
 				     "error looking up VIO GPIO\n");
-	slot->cover = gpiod_get_index_optional(host->dev, "cover",
-						id, GPIOD_IN);
+	slot->cover = devm_gpiod_get_index_optional(host->dev, "cover",
+						    id, GPIOD_IN);
 	if (IS_ERR(slot->cover))
 		return dev_err_probe(host->dev, PTR_ERR(slot->cover),
 				     "error looking up cover switch GPIO\n");
@@ -1384,13 +1399,6 @@
 	if (IS_ERR(host->virt_base))
 		return PTR_ERR(host->virt_base);
 
-	host->slot_switch = gpiod_get_optional(host->dev, "switch",
-					       GPIOD_OUT_LOW);
-	if (IS_ERR(host->slot_switch))
-		return dev_err_probe(host->dev, PTR_ERR(host->slot_switch),
-				     "error looking up slot switch GPIO\n");
-
-
 	INIT_WORK(&host->slot_release_work, mmc_omap_slot_release_work);
 	INIT_WORK(&host->send_stop_work, mmc_omap_send_stop_work);
 
@@ -1409,6 +1417,12 @@
 	host->dev = &pdev->dev;
 	platform_set_drvdata(pdev, host);
 
+	host->slot_switch = devm_gpiod_get_optional(host->dev, "switch",
+						    GPIOD_OUT_LOW);
+	if (IS_ERR(host->slot_switch))
+		return dev_err_probe(host->dev, PTR_ERR(host->slot_switch),
+				     "error looking up slot switch GPIO\n");
+
 	host->id = pdev->id;
 	host->irq = irq;
 	host->phys_base = res->start;
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-acpi.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-acpi.c
@@ -10,6 +10,7 @@
 #include <linux/export.h>
 #include <linux/module.h>
 #include <linux/device.h>
+#include <linux/pinctrl/pinconf-generic.h>
 #include <linux/platform_device.h>
 #include <linux/ioport.h>
 #include <linux/io.h>
@@ -80,6 +81,8 @@
 enum {
 	DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP			= BIT(0),
 	DMI_QUIRK_SD_NO_WRITE_PROTECT				= BIT(1),
+	DMI_QUIRK_SD_CD_ACTIVE_HIGH				= BIT(2),
+	DMI_QUIRK_SD_CD_ENABLE_PULL_UP				= BIT(3),
 };
 
 static inline void *sdhci_acpi_priv(struct sdhci_acpi_host *c)
@@ -719,9 +722,30 @@
 };
 MODULE_DEVICE_TABLE(acpi, sdhci_acpi_ids);
 
+/* Please keep this list sorted alphabetically */
 static const struct dmi_system_id sdhci_acpi_quirks[] = {
 	{
 		/*
+		 * The Acer Aspire Switch 10 (SW5-012) microSD slot always
+		 * reports the card being write-protected even though microSD
+		 * cards do not have a write-protect switch at all.
+		 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"),
+		},
+		.driver_data = (void *)DMI_QUIRK_SD_NO_WRITE_PROTECT,
+	},
+	{
+		/* Asus T100TA, needs pull-up for cd but DSDT GpioInt has NoPull set */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "T100TA"),
+		},
+		.driver_data = (void *)DMI_QUIRK_SD_CD_ENABLE_PULL_UP,
+	},
+	{
+		/*
 		 * The Lenovo Miix 320-10ICR has a bug in the _PS0 method of
 		 * the SHC1 ACPI device, this bug causes it to reprogram the
 		 * wrong LDO (DLDO3) to 1.8V if 1.8V modes are used and the
@@ -736,15 +760,23 @@
 	},
 	{
 		/*
-		 * The Acer Aspire Switch 10 (SW5-012) microSD slot always
-		 * reports the card being write-protected even though microSD
-		 * cards do not have a write-protect switch at all.
+		 * Lenovo Yoga Tablet 2 Pro 1380F/L (13" Android version) this
+		 * has broken WP reporting and an inverted CD signal.
+		 * Note this has more or less the same BIOS as the Lenovo Yoga
+		 * Tablet 2 830F/L or 1050F/L (8" and 10" Android), but unlike
+		 * the 830 / 1050 models which share the same mainboard this
+		 * model has a different mainboard and the inverted CD and
+		 * broken WP are unique to this board.
 		 */
 		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"),
+			DMI_MATCH(DMI_SYS_VENDOR, "Intel Corp."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "VALLEYVIEW C0 PLATFORM"),
+			DMI_MATCH(DMI_BOARD_NAME, "BYT-T FFD8"),
+			/* Full match so as to NOT match the 830/1050 BIOS */
+			DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21.X64.0005.R00.1504101516"),
 		},
-		.driver_data = (void *)DMI_QUIRK_SD_NO_WRITE_PROTECT,
+		.driver_data = (void *)(DMI_QUIRK_SD_NO_WRITE_PROTECT |
+					DMI_QUIRK_SD_CD_ACTIVE_HIGH),
 	},
 	{
 		/*
@@ -757,6 +789,17 @@
 		},
 		.driver_data = (void *)DMI_QUIRK_SD_NO_WRITE_PROTECT,
 	},
+	{
+		/*
+		 * The Toshiba WT10-A's microSD slot always reports the card being
+		 * write-protected.
+		 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "TOSHIBA WT10-A"),
+		},
+		.driver_data = (void *)DMI_QUIRK_SD_NO_WRITE_PROTECT,
+	},
 	{} /* Terminating entry */
 };
 
@@ -866,12 +909,18 @@
 	if (sdhci_acpi_flag(c, SDHCI_ACPI_SD_CD)) {
 		bool v = sdhci_acpi_flag(c, SDHCI_ACPI_SD_CD_OVERRIDE_LEVEL);
 
+		if (quirks & DMI_QUIRK_SD_CD_ACTIVE_HIGH)
+			host->mmc->caps2 |= MMC_CAP2_CD_ACTIVE_HIGH;
+
 		err = mmc_gpiod_request_cd(host->mmc, NULL, 0, v, 0);
 		if (err) {
 			if (err == -EPROBE_DEFER)
 				goto err_free;
 			dev_warn(dev, "failed to setup card detect gpio\n");
 			c->use_runtime_pm = false;
+		} else if (quirks & DMI_QUIRK_SD_CD_ENABLE_PULL_UP) {
+			mmc_gpiod_set_cd_config(host->mmc,
+						PIN_CONF_PACKED(PIN_CONFIG_BIAS_PULL_UP, 20000));
 		}
 
 		if (quirks & DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP)
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-brcmstb.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-brcmstb.c
@@ -24,6 +24,7 @@
 #define BRCMSTB_MATCH_FLAGS_NO_64BIT		BIT(0)
 #define BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT	BIT(1)
 #define BRCMSTB_MATCH_FLAGS_HAS_CLOCK_GATE	BIT(2)
+#define BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY	BIT(4)
 
 #define BRCMSTB_PRIV_FLAGS_HAS_CQE		BIT(0)
 #define BRCMSTB_PRIV_FLAGS_GATE_CLOCK		BIT(1)
@@ -384,6 +385,9 @@
 	if (match_priv->flags & BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT)
 		host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
 
+	if (!(match_priv->flags & BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY))
+		host->mmc_host_ops.card_busy = NULL;
+
 	/* Change the base clock frequency if the DT property exists */
 	if (device_property_read_u32(&pdev->dev, "clock-frequency",
 				     &priv->base_freq_hz) != 0)
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-esdhc-imx.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -235,6 +235,7 @@
 
 struct esdhc_soc_data {
 	u32 flags;
+	u32 quirks;
 };
 
 static const struct esdhc_soc_data esdhc_imx25_data = {
@@ -306,10 +307,12 @@
 			| ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200
 			| ESDHC_FLAG_PMQOS | ESDHC_FLAG_HS400
 			| ESDHC_FLAG_STATE_LOST_IN_LPMODE,
+	.quirks = SDHCI_QUIRK_NO_LED,
 };
 static struct esdhc_soc_data usdhc_imxrt1050_data = {
 	.flags = ESDHC_FLAG_USDHC | ESDHC_FLAG_STD_TUNING
 			| ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200,
+	.quirks = SDHCI_QUIRK_NO_LED,
 };
 
 static struct esdhc_soc_data usdhc_imx8qxp_data = {
@@ -318,6 +321,7 @@
 			| ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES
 			| ESDHC_FLAG_STATE_LOST_IN_LPMODE
 			| ESDHC_FLAG_CLK_RATE_LOST_IN_PM_RUNTIME,
+	.quirks = SDHCI_QUIRK_NO_LED,
 };
 
 static struct esdhc_soc_data usdhc_imx8mm_data = {
@@ -325,6 +329,7 @@
 			| ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200
 			| ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES
 			| ESDHC_FLAG_STATE_LOST_IN_LPMODE,
+	.quirks = SDHCI_QUIRK_NO_LED,
 };
 
 struct pltfm_imx_data {
@@ -1684,6 +1689,7 @@
 
 	imx_data->socdata = device_get_match_data(&pdev->dev);
 
+	host->quirks |= imx_data->socdata->quirks;
 	if (imx_data->socdata->flags & ESDHC_FLAG_PMQOS)
 		cpu_latency_qos_add_request(&imx_data->pm_qos_req, 0);
 
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-msm.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-msm.c
@@ -1829,6 +1829,9 @@
 	msm_host->ice = ice;
 	mmc->caps2 |= MMC_CAP2_CRYPTO;
 
+	if (qcom_ice_hwkm_supported(msm_host->ice))
+		cq_host->quirks |= CQHCI_QUIRK_USES_WRAPPED_CRYPTO_KEYS;
+
 	return 0;
 }
 
@@ -1859,6 +1862,7 @@
  * vendor-specific SCM calls for this; it doesn't support the standard way.
  */
 static int sdhci_msm_program_key(struct cqhci_host *cq_host,
+				 const struct blk_crypto_key *bkey,
 				 const union cqhci_crypto_cfg_entry *cfg,
 				 int slot)
 {
@@ -1866,6 +1870,10 @@
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
 	union cqhci_crypto_cap_entry cap;
+	u8 ice_key_size;
+
+	if (!(cfg->config_enable & CQHCI_CRYPTO_CONFIGURATION_ENABLE))
+		return qcom_ice_evict_key(msm_host->ice, slot);
 
 	/* Only AES-256-XTS has been tested so far. */
 	cap = cq_host->crypto_cap_array[cfg->crypto_cap_idx];
@@ -1873,16 +1881,63 @@
 		cap.key_size != CQHCI_CRYPTO_KEY_SIZE_256)
 		return -EINVAL;
 
-	if (cfg->config_enable & CQHCI_CRYPTO_CONFIGURATION_ENABLE)
-		return qcom_ice_program_key(msm_host->ice,
-					    QCOM_ICE_CRYPTO_ALG_AES_XTS,
-					    QCOM_ICE_CRYPTO_KEY_SIZE_256,
-					    cfg->crypto_key,
-					    cfg->data_unit_size, slot);
+	if (bkey->crypto_cfg.key_type == BLK_CRYPTO_KEY_TYPE_HW_WRAPPED)
+		ice_key_size = QCOM_ICE_CRYPTO_KEY_SIZE_WRAPPED;
 	else
-		return qcom_ice_evict_key(msm_host->ice, slot);
+		ice_key_size = QCOM_ICE_CRYPTO_KEY_SIZE_256;
+
+	return qcom_ice_program_key(msm_host->ice,
+				    QCOM_ICE_CRYPTO_ALG_AES_XTS,
+				    ice_key_size, bkey,
+				    cfg->data_unit_size, slot);
+}
+
+/*
+ * Derive a software secret from a hardware wrapped key. The key is unwrapped in
+ * hardware from trustzone and a software key/secret is then derived from it.
+ */
+static int sdhci_msm_ice_derive_sw_secret(struct cqhci_host *cq_host, const u8 wkey[],
+					  unsigned int wkey_size,
+					  u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE])
+{
+	struct sdhci_host *host = mmc_priv(cq_host->mmc);
+	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+
+	return qcom_ice_derive_sw_secret(msm_host->ice, wkey, wkey_size, sw_secret);
+}
+
+static int sdhci_msm_generate_key(struct cqhci_host *cq_host,
+				  u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct sdhci_host *host = mmc_priv(cq_host->mmc);
+	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+
+	return qcom_ice_generate_key(msm_host->ice, lt_key);
+}
+
+static int sdhci_msm_prepare_key(struct cqhci_host *cq_host,
+			  const u8 *lt_key, size_t lt_key_size,
+			  u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct sdhci_host *host = mmc_priv(cq_host->mmc);
+	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+
+	return qcom_ice_prepare_key(msm_host->ice, lt_key, lt_key_size, eph_key);
 }
 
+static int sdhci_msm_import_key(struct cqhci_host *cq_host,
+				const u8 *imp_key, size_t imp_key_size,
+				u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct sdhci_host *host = mmc_priv(cq_host->mmc);
+	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+
+	return qcom_ice_import_key(msm_host->ice, imp_key, imp_key_size, lt_key);
+}
 #else /* CONFIG_MMC_CRYPTO */
 
 static inline int sdhci_msm_ice_init(struct sdhci_msm_host *msm_host,
@@ -1989,6 +2044,10 @@
 	.disable	= sdhci_msm_cqe_disable,
 #ifdef CONFIG_MMC_CRYPTO
 	.program_key	= sdhci_msm_program_key,
+	.derive_sw_secret	= sdhci_msm_ice_derive_sw_secret,
+	.generate_key	= sdhci_msm_generate_key,
+	.prepare_key	= sdhci_msm_prepare_key,
+	.import_key	= sdhci_msm_import_key,
 #endif
 };
 
@@ -2626,6 +2685,7 @@
 		goto clk_disable;
 	}
 
+	msm_host->mmc->caps |= MMC_CAP_AGGRESSIVE_PM;
 	msm_host->mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_NEED_RSP_BUSY;
 
 	/* Set the timeout value to max possible */
@@ -2694,6 +2754,11 @@
 	struct sdhci_host *host = dev_get_drvdata(dev);
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	host->runtime_suspended = true;
+	spin_unlock_irqrestore(&host->lock, flags);
 
 	/* Drop the performance vote */
 	dev_pm_opp_set_rate(dev, 0);
@@ -2708,6 +2773,7 @@
 	struct sdhci_host *host = dev_get_drvdata(dev);
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+	unsigned long flags;
 	int ret;
 
 	ret = clk_bulk_prepare_enable(ARRAY_SIZE(msm_host->bulk_clks),
@@ -2726,7 +2792,15 @@
 
 	dev_pm_opp_set_rate(dev, msm_host->clk_rate);
 
-	return sdhci_msm_ice_resume(msm_host);
+	ret = sdhci_msm_ice_resume(msm_host);
+	if (ret)
+		return ret;
+
+	spin_lock_irqsave(&host->lock, flags);
+	host->runtime_suspended = false;
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	return ret;
 }
 
 static const struct dev_pm_ops sdhci_msm_pm_ops = {
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-of-aspeed.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-of-aspeed.c
@@ -510,6 +510,7 @@
 	{ .compatible = "aspeed,ast2600-sdhci", .data = &ast2600_sdhci_pdata, },
 	{ }
 };
+MODULE_DEVICE_TABLE(of, aspeed_sdhci_of_match);
 
 static struct platform_driver aspeed_sdhci_driver = {
 	.driver		= {
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-of-dwcmshc.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-of-dwcmshc.c
@@ -612,6 +612,7 @@
 
 	/* perform tuning */
 	sdhci_start_tuning(host);
+	host->tuning_loop_count = 128;
 	host->tuning_err = __sdhci_execute_tuning(host, opcode);
 	if (host->tuning_err) {
 		/* disable auto-tuning upon tuning error */
@@ -633,6 +634,14 @@
 
 	sdhci_reset(host, mask);
 
+	/* The T-Head 1520 SoC does not comply with the SDHCI specification
+	 * regarding the "Software Reset for CMD line should clear 'Command
+	 * Complete' in the Normal Interrupt Status Register." Clear the bit
+	 * here to compensate for this quirk.
+	 */
+	if (mask & SDHCI_RESET_CMD)
+		sdhci_writel(host, SDHCI_INT_RESPONSE, SDHCI_INT_STATUS);
+
 	if (priv->flags & FLAG_IO_FIXED_1V8) {
 		ctrl_2 = sdhci_readw(host, SDHCI_HOST_CONTROL2);
 		if (!(ctrl_2 & SDHCI_CTRL_VDD_180)) {
@@ -933,6 +942,17 @@
 	return err;
 }
 
+static void dwcmshc_disable_card_clk(struct sdhci_host *host)
+{
+	u16 ctrl;
+
+	ctrl = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
+	if (ctrl & SDHCI_CLOCK_CARD_EN) {
+		ctrl &= ~SDHCI_CLOCK_CARD_EN;
+		sdhci_writew(host, ctrl, SDHCI_CLOCK_CONTROL);
+	}
+}
+
 static void dwcmshc_remove(struct platform_device *pdev)
 {
 	struct sdhci_host *host = platform_get_drvdata(pdev);
@@ -940,8 +960,14 @@
 	struct dwcmshc_priv *priv = sdhci_pltfm_priv(pltfm_host);
 	struct rk35xx_priv *rk_priv = priv->priv;
 
+	pm_runtime_get_sync(&pdev->dev);
+	pm_runtime_disable(&pdev->dev);
+	pm_runtime_put_noidle(&pdev->dev);
+
 	sdhci_remove_host(host, 0);
 
+	dwcmshc_disable_card_clk(host);
+
 	clk_disable_unprepare(pltfm_host->clk);
 	clk_disable_unprepare(priv->bus_clk);
 	if (rk_priv)
@@ -1032,17 +1058,6 @@
 		sdhci_writew(host, ctrl, SDHCI_CLOCK_CONTROL);
 	}
 }
-
-static void dwcmshc_disable_card_clk(struct sdhci_host *host)
-{
-	u16 ctrl;
-
-	ctrl = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
-	if (ctrl & SDHCI_CLOCK_CARD_EN) {
-		ctrl &= ~SDHCI_CLOCK_CARD_EN;
-		sdhci_writew(host, ctrl, SDHCI_CLOCK_CONTROL);
-	}
-}
 
 static int dwcmshc_runtime_suspend(struct device *dev)
 {
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-omap.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-omap.c
@@ -1439,6 +1439,9 @@
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host);
 
+	if (host->tuning_mode != SDHCI_TUNING_MODE_3)
+		mmc_retune_needed(host->mmc);
+
 	if (omap_host->con != -EINVAL)
 		sdhci_runtime_suspend_host(host);
 
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-pci-core.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-pci-core.c
@@ -21,6 +21,7 @@
 #include <linux/io.h>
 #include <linux/iopoll.h>
 #include <linux/gpio.h>
+#include <linux/gpio/machine.h>
 #include <linux/pm_runtime.h>
 #include <linux/pm_qos.h>
 #include <linux/debugfs.h>
@@ -1235,6 +1236,29 @@
 	.priv_size	= sizeof(struct intel_host),
 };
 
+/* DMI quirks for devices with missing or broken CD GPIO info */
+static const struct gpiod_lookup_table vexia_edu_atla10_cd_gpios = {
+	.dev_id = "0000:00:12.0",
+	.table = {
+		GPIO_LOOKUP("INT33FC:00", 38, "cd", GPIO_ACTIVE_HIGH),
+		{ }
+	},
+};
+
+static const struct dmi_system_id sdhci_intel_byt_cd_gpio_override[] = {
+	{
+		/* Vexia Edu Atla 10 tablet 9V version */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
+			DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
+			/* Above strings are too generic, also match on BIOS date */
+			DMI_MATCH(DMI_BIOS_DATE, "08/25/2014"),
+		},
+		.driver_data = (void *)&vexia_edu_atla10_cd_gpios,
+	},
+	{ }
+};
+
 static const struct sdhci_pci_fixes sdhci_intel_byt_sd = {
 #ifdef CONFIG_PM_SLEEP
 	.resume		= byt_resume,
@@ -1253,6 +1277,7 @@
 	.add_host	= byt_add_host,
 	.remove_slot	= byt_remove_slot,
 	.ops		= &sdhci_intel_byt_ops,
+	.cd_gpio_override = sdhci_intel_byt_cd_gpio_override,
 	.priv_size	= sizeof(struct intel_host),
 };
 
@@ -1326,7 +1351,7 @@
 
 	ret = pci_read_config_byte(chip->pdev, 0xAE, &scratch);
 	if (ret)
-		return ret;
+		goto fail;
 
 	/*
 	 * Turn PMOS on [bit 0], set over current detection to 2.4 V
@@ -1337,7 +1362,10 @@
 	else
 		scratch &= ~0x47;
 
-	return pci_write_config_byte(chip->pdev, 0xAE, scratch);
+	ret = pci_write_config_byte(chip->pdev, 0xAE, scratch);
+
+fail:
+	return pcibios_err_to_errno(ret);
 }
 
 static int jmicron_probe(struct sdhci_pci_chip *chip)
@@ -2034,6 +2062,42 @@
  *                                                                           *
 \*****************************************************************************/
 
+static struct gpiod_lookup_table *sdhci_pci_add_gpio_lookup_table(
+	struct sdhci_pci_chip *chip)
+{
+	struct gpiod_lookup_table *cd_gpio_lookup_table;
+	const struct dmi_system_id *dmi_id = NULL;
+	size_t count;
+
+	if (chip->fixes && chip->fixes->cd_gpio_override)
+		dmi_id = dmi_first_match(chip->fixes->cd_gpio_override);
+
+	if (!dmi_id)
+		return NULL;
+
+	cd_gpio_lookup_table = dmi_id->driver_data;
+	for (count = 0; cd_gpio_lookup_table->table[count].key; count++)
+		;
+
+	cd_gpio_lookup_table = kmemdup(dmi_id->driver_data,
+				       /* count + 1 terminating entry */
+				       struct_size(cd_gpio_lookup_table, table, count + 1),
+				       GFP_KERNEL);
+	if (!cd_gpio_lookup_table)
+		return ERR_PTR(-ENOMEM);
+
+	gpiod_add_lookup_table(cd_gpio_lookup_table);
+	return cd_gpio_lookup_table;
+}
+
+static void sdhci_pci_remove_gpio_lookup_table(struct gpiod_lookup_table *lookup_table)
+{
+	if (lookup_table) {
+		gpiod_remove_lookup_table(lookup_table);
+		kfree(lookup_table);
+	}
+}
+
 static struct sdhci_pci_slot *sdhci_pci_probe_slot(
 	struct pci_dev *pdev, struct sdhci_pci_chip *chip, int first_bar,
 	int slotno)
@@ -2109,8 +2173,19 @@
 		device_init_wakeup(&pdev->dev, true);
 
 	if (slot->cd_idx >= 0) {
+		struct gpiod_lookup_table *cd_gpio_lookup_table;
+
+		cd_gpio_lookup_table = sdhci_pci_add_gpio_lookup_table(chip);
+		if (IS_ERR(cd_gpio_lookup_table)) {
+			ret = PTR_ERR(cd_gpio_lookup_table);
+			goto remove;
+		}
+
 		ret = mmc_gpiod_request_cd(host->mmc, "cd", slot->cd_idx,
 					   slot->cd_override_level, 0);
+
+		sdhci_pci_remove_gpio_lookup_table(cd_gpio_lookup_table);
+
 		if (ret && ret != -EPROBE_DEFER)
 			ret = mmc_gpiod_request_cd(host->mmc, NULL,
 						   slot->cd_idx,
@@ -2202,7 +2277,7 @@
 
 	ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &slots);
 	if (ret)
-		return ret;
+		return pcibios_err_to_errno(ret);
 
 	slots = PCI_SLOT_INFO_SLOTS(slots) + 1;
 	dev_dbg(&pdev->dev, "found %d slot(s)\n", slots);
@@ -2211,7 +2286,7 @@
 
 	ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &first_bar);
 	if (ret)
-		return ret;
+		return pcibios_err_to_errno(ret);
 
 	first_bar &= PCI_SLOT_INFO_FIRST_BAR_MASK;
 
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-pci-gli.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-pci-gli.c
@@ -902,28 +902,40 @@
 	gl9767_vhs_read(pdev);
 }
 
+static void gl9767_set_low_power_negotiation(struct pci_dev *pdev, bool enable)
+{
+	u32 value;
+
+	gl9767_vhs_write(pdev);
+
+	pci_read_config_dword(pdev, PCIE_GLI_9767_CFG, &value);
+	if (enable)
+		value &= ~PCIE_GLI_9767_CFG_LOW_PWR_OFF;
+	else
+		value |= PCIE_GLI_9767_CFG_LOW_PWR_OFF;
+	pci_write_config_dword(pdev, PCIE_GLI_9767_CFG, value);
+
+	gl9767_vhs_read(pdev);
+}
+
 static void sdhci_gl9767_set_clock(struct sdhci_host *host, unsigned int clock)
 {
 	struct sdhci_pci_slot *slot = sdhci_priv(host);
 	struct mmc_ios *ios = &host->mmc->ios;
 	struct pci_dev *pdev;
-	u32 value;
 	u16 clk;
 
 	pdev = slot->chip->pdev;
 	host->mmc->actual_clock = 0;
 
-	gl9767_vhs_write(pdev);
-
-	pci_read_config_dword(pdev, PCIE_GLI_9767_CFG, &value);
-	value |= PCIE_GLI_9767_CFG_LOW_PWR_OFF;
-	pci_write_config_dword(pdev, PCIE_GLI_9767_CFG, value);
-
+	gl9767_set_low_power_negotiation(pdev, false);
 	gl9767_disable_ssc_pll(pdev);
 	sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL);
 
-	if (clock == 0)
+	if (clock == 0) {
+		gl9767_set_low_power_negotiation(pdev, true);
 		return;
+	}
 
 	clk = sdhci_calc_clk(host, clock, &host->mmc->actual_clock);
 	if (clock == 200000000 && ios->timing == MMC_TIMING_UHS_SDR104) {
@@ -932,12 +944,7 @@
 	}
 
 	sdhci_enable_clk(host, clk);
-
-	pci_read_config_dword(pdev, PCIE_GLI_9767_CFG, &value);
-	value &= ~PCIE_GLI_9767_CFG_LOW_PWR_OFF;
-	pci_write_config_dword(pdev, PCIE_GLI_9767_CFG, value);
-
-	gl9767_vhs_read(pdev);
+	gl9767_set_low_power_negotiation(pdev, true);
 }
 
 static void gli_set_9767(struct sdhci_host *host)
@@ -1071,6 +1078,9 @@
 		sdhci_writew(host, value, SDHCI_CLOCK_CONTROL);
 	}
 
+	pci_read_config_dword(pdev, PCIE_GLI_9767_CFG, &value);
+	value &= ~PCIE_GLI_9767_CFG_LOW_PWR_OFF;
+	pci_write_config_dword(pdev, PCIE_GLI_9767_CFG, value);
 	gl9767_vhs_read(pdev);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-pci-o2micro.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-pci-o2micro.c
@@ -823,7 +823,7 @@
 		ret = pci_read_config_byte(chip->pdev,
 				O2_SD_LOCK_WP, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch &= 0x7f;
 		pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
 
@@ -834,7 +834,7 @@
 		ret = pci_read_config_byte(chip->pdev,
 				O2_SD_CLKREQ, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch |= 0x20;
 		pci_write_config_byte(chip->pdev, O2_SD_CLKREQ, scratch);
 
@@ -843,7 +843,7 @@
 		 */
 		ret = pci_read_config_byte(chip->pdev, O2_SD_CAPS, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch |= 0x01;
 		pci_write_config_byte(chip->pdev, O2_SD_CAPS, scratch);
 		pci_write_config_byte(chip->pdev, O2_SD_CAPS, 0x73);
@@ -856,7 +856,7 @@
 		ret = pci_read_config_byte(chip->pdev,
 				O2_SD_INF_MOD, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch |= 0x08;
 		pci_write_config_byte(chip->pdev, O2_SD_INF_MOD, scratch);
 
@@ -864,7 +864,7 @@
 		ret = pci_read_config_byte(chip->pdev,
 				O2_SD_LOCK_WP, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch |= 0x80;
 		pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
 		break;
@@ -875,7 +875,7 @@
 		ret = pci_read_config_byte(chip->pdev,
 				O2_SD_LOCK_WP, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 
 		scratch &= 0x7f;
 		pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
@@ -886,7 +886,7 @@
 						    O2_SD_FUNC_REG0,
 						    &scratch_32);
 			if (ret)
-				return ret;
+				goto read_fail;
 			scratch_32 = ((scratch_32 & 0xFF000000) >> 24);
 
 			/* Check Whether subId is 0x11 or 0x12 */
@@ -898,7 +898,7 @@
 							    O2_SD_FUNC_REG4,
 							    &scratch_32);
 				if (ret)
-					return ret;
+					goto read_fail;
 
 				/* Enable Base Clk setting change */
 				scratch_32 |= O2_SD_FREG4_ENABLE_CLK_SET;
@@ -921,7 +921,7 @@
 		ret = pci_read_config_dword(chip->pdev,
 					    O2_SD_CLK_SETTING, &scratch_32);
 		if (ret)
-			return ret;
+			goto read_fail;
 
 		scratch_32 &= ~(0xFF00);
 		scratch_32 |= 0x07E0C800;
@@ -931,14 +931,14 @@
 		ret = pci_read_config_dword(chip->pdev,
 					    O2_SD_CLKREQ, &scratch_32);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch_32 |= 0x3;
 		pci_write_config_dword(chip->pdev, O2_SD_CLKREQ, scratch_32);
 
 		ret = pci_read_config_dword(chip->pdev,
 					    O2_SD_PLL_SETTING, &scratch_32);
 		if (ret)
-			return ret;
+			goto read_fail;
 
 		scratch_32 &= ~(0x1F3F070E);
 		scratch_32 |= 0x18270106;
@@ -949,7 +949,7 @@
 		ret = pci_read_config_dword(chip->pdev,
 					    O2_SD_CAP_REG2, &scratch_32);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch_32 &= ~(0xE0);
 		pci_write_config_dword(chip->pdev,
 				       O2_SD_CAP_REG2, scratch_32);
@@ -961,7 +961,7 @@
 		ret = pci_read_config_byte(chip->pdev,
 					   O2_SD_LOCK_WP, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch |= 0x80;
 		pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
 		break;
@@ -971,7 +971,7 @@
 		ret = pci_read_config_byte(chip->pdev,
 				O2_SD_LOCK_WP, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 
 		scratch &= 0x7f;
 		pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
@@ -979,7 +979,7 @@
 		ret = pci_read_config_dword(chip->pdev,
 					    O2_SD_PLL_SETTING, &scratch_32);
 		if (ret)
-			return ret;
+			goto read_fail;
 
 		if ((scratch_32 & 0xff000000) == 0x01000000) {
 			scratch_32 &= 0x0000FFFF;
@@ -998,7 +998,7 @@
 						    O2_SD_FUNC_REG4,
 						    &scratch_32);
 			if (ret)
-				return ret;
+				goto read_fail;
 			scratch_32 |= (1 << 22);
 			pci_write_config_dword(chip->pdev,
 					       O2_SD_FUNC_REG4, scratch_32);
@@ -1017,7 +1017,7 @@
 		ret = pci_read_config_byte(chip->pdev,
 					   O2_SD_LOCK_WP, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch |= 0x80;
 		pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
 		break;
@@ -1028,7 +1028,7 @@
 		/* UnLock WP */
 		ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch &= 0x7f;
 		pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
 
@@ -1057,13 +1057,16 @@
 		/* Lock WP */
 		ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch);
 		if (ret)
-			return ret;
+			goto read_fail;
 		scratch |= 0x80;
 		pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
 		break;
 	}
 
 	return 0;
+
+read_fail:
+	return pcibios_err_to_errno(ret);
 }
 
 #ifdef CONFIG_PM_SLEEP
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-pci.h
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-pci.h
@@ -156,6 +156,7 @@
 #endif
 
 	const struct sdhci_ops	*ops;
+	const struct dmi_system_id *cd_gpio_override;
 	size_t			priv_size;
 };
 
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci-tegra.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci-tegra.c
@@ -1525,7 +1525,6 @@
 	.quirks = SDHCI_QUIRK_BROKEN_TIMEOUT_VAL |
 		  SDHCI_QUIRK_SINGLE_POWER_WRITE |
 		  SDHCI_QUIRK_NO_HISPD_BIT |
-		  SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC |
 		  SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
 	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
 		   SDHCI_QUIRK2_ISSUE_CMD_DAT_RESET_TOGETHER,
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci.c
@@ -2515,26 +2515,29 @@
 
 static int sdhci_check_ro(struct sdhci_host *host)
 {
-	unsigned long flags;
+	bool allow_invert = false;
 	int is_readonly;
 
-	spin_lock_irqsave(&host->lock, flags);
-
-	if (host->flags & SDHCI_DEVICE_DEAD)
+	if (host->flags & SDHCI_DEVICE_DEAD) {
 		is_readonly = 0;
-	else if (host->ops->get_ro)
+	} else if (host->ops->get_ro) {
 		is_readonly = host->ops->get_ro(host);
-	else if (mmc_can_gpio_ro(host->mmc))
+	} else if (mmc_can_gpio_ro(host->mmc)) {
 		is_readonly = mmc_gpio_get_ro(host->mmc);
-	else
+		/* Do not invert twice */
+		allow_invert = !(host->mmc->caps2 & MMC_CAP2_RO_ACTIVE_HIGH);
+	} else {
 		is_readonly = !(sdhci_readl(host, SDHCI_PRESENT_STATE)
 				& SDHCI_WRITE_PROTECT);
+		allow_invert = true;
+	}
 
-	spin_unlock_irqrestore(&host->lock, flags);
+	if (is_readonly >= 0 &&
+	    allow_invert &&
+	    (host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT))
+		is_readonly = !is_readonly;
 
-	/* This quirk needs to be replaced by a callback-function later */
-	return host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT ?
-		!is_readonly : is_readonly;
+	return is_readonly;
 }
 
 #define SAMPLE_COUNT	5
@@ -3439,12 +3442,18 @@
 		host->data->error = -EILSEQ;
 		if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))))
 			sdhci_err_stats_inc(host, DAT_CRC);
-	} else if ((intmask & SDHCI_INT_DATA_CRC) &&
+	} else if ((intmask & (SDHCI_INT_DATA_CRC | SDHCI_INT_TUNING_ERROR)) &&
 		SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))
 			!= MMC_BUS_TEST_R) {
 		host->data->error = -EILSEQ;
 		if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))))
 			sdhci_err_stats_inc(host, DAT_CRC);
+		if (intmask & SDHCI_INT_TUNING_ERROR) {
+			u16 ctrl2 = sdhci_readw(host, SDHCI_HOST_CONTROL2);
+
+			ctrl2 &= ~SDHCI_CTRL_TUNED_CLK;
+			sdhci_writew(host, ctrl2, SDHCI_HOST_CONTROL2);
+		}
 	} else if (intmask & SDHCI_INT_ADMA_ERROR) {
 		pr_err("%s: ADMA error: 0x%08x\n", mmc_hostname(host->mmc),
 		       intmask);
@@ -3979,7 +3988,7 @@
 	} else
 		*cmd_error = 0;
 
-	if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC)) {
+	if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC | SDHCI_INT_TUNING_ERROR)) {
 		*data_error = -EILSEQ;
 		if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))))
 			sdhci_err_stats_inc(host, DAT_CRC);
@@ -4718,6 +4727,21 @@
 		if (host->quirks & SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC) {
 			host->max_adma = 65532; /* 32-bit alignment */
 			mmc->max_seg_size = 65535;
+			/*
+			 * sdhci_adma_table_pre() expects to define 1 DMA
+			 * descriptor per segment, so the maximum segment size
+			 * is set accordingly. SDHCI allows up to 64KiB per DMA
+			 * descriptor (16-bit field), but some controllers do
+			 * not support "zero means 65536" reducing the maximum
+			 * for them to 65535. That is a problem if PAGE_SIZE is
+			 * 64KiB because the block layer does not support
+			 * max_seg_size < PAGE_SIZE, however
+			 * sdhci_adma_table_pre() has a workaround to handle
+			 * that case, and split the descriptor. Refer also
+			 * comment in sdhci_adma_table_pre().
+			 */
+			if (mmc->max_seg_size < PAGE_SIZE)
+				mmc->max_seg_size = PAGE_SIZE;
 		} else {
 			mmc->max_seg_size = 65536;
 		}
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci.h
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci.h
@@ -158,6 +158,7 @@
 #define  SDHCI_INT_BUS_POWER	0x00800000
 #define  SDHCI_INT_AUTO_CMD_ERR	0x01000000
 #define  SDHCI_INT_ADMA_ERROR	0x02000000
+#define  SDHCI_INT_TUNING_ERROR	0x04000000
 
 #define  SDHCI_INT_NORMAL_MASK	0x00007FFF
 #define  SDHCI_INT_ERROR_MASK	0xFFFF8000
@@ -169,7 +170,7 @@
 		SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
 		SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
 		SDHCI_INT_DATA_END_BIT | SDHCI_INT_ADMA_ERROR | \
-		SDHCI_INT_BLK_GAP)
+		SDHCI_INT_BLK_GAP | SDHCI_INT_TUNING_ERROR)
 #define SDHCI_INT_ALL_MASK	((unsigned int)-1)
 
 #define SDHCI_CQE_INT_ERR_MASK ( \
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sdhci_am654.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sdhci_am654.c
@@ -143,16 +143,24 @@
 	struct regmap *base;
 	int otap_del_sel[ARRAY_SIZE(td)];
 	int itap_del_sel[ARRAY_SIZE(td)];
+	u32 itap_del_ena[ARRAY_SIZE(td)];
 	int clkbuf_sel;
 	int trm_icp;
 	int drv_strength;
 	int strb_sel;
 	u32 flags;
 	u32 quirks;
+	bool dll_enable;
 
 #define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0)
 };
 
+struct window {
+	u8 start;
+	u8 end;
+	u8 length;
+};
+
 struct sdhci_am654_driver_data {
 	const struct sdhci_pltfm_data *pdata;
 	u32 flags;
@@ -232,11 +240,13 @@
 }
 
 static void sdhci_am654_write_itapdly(struct sdhci_am654_data *sdhci_am654,
-				      u32 itapdly)
+				      u32 itapdly, u32 enable)
 {
 	/* Set ITAPCHGWIN before writing to ITAPDLY */
 	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK,
 			   1 << ITAPCHGWIN_SHIFT);
+	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYENA_MASK,
+			   enable << ITAPDLYENA_SHIFT);
 	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYSEL_MASK,
 			   itapdly << ITAPDLYSEL_SHIFT);
 	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK, 0);
@@ -253,8 +263,8 @@
 	mask = SELDLYTXCLK_MASK | SELDLYRXCLK_MASK;
 	regmap_update_bits(sdhci_am654->base, PHY_CTRL5, mask, val);
 
-	sdhci_am654_write_itapdly(sdhci_am654,
-				  sdhci_am654->itap_del_sel[timing]);
+	sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing],
+				  sdhci_am654->itap_del_ena[timing]);
 }
 
 static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)
@@ -263,7 +273,6 @@
 	struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host);
 	unsigned char timing = host->mmc->ios.timing;
 	u32 otap_del_sel;
-	u32 otap_del_ena;
 	u32 mask, val;
 
 	regmap_update_bits(sdhci_am654->base, PHY_CTRL1, ENDLL_MASK, 0);
@@ -272,10 +281,9 @@
 
 	/* Setup DLL Output TAP delay */
 	otap_del_sel = sdhci_am654->otap_del_sel[timing];
-	otap_del_ena = (timing > MMC_TIMING_UHS_SDR25) ? 1 : 0;
 
 	mask = OTAPDLYENA_MASK | OTAPDLYSEL_MASK;
-	val = (otap_del_ena << OTAPDLYENA_SHIFT) |
+	val = (0x1 << OTAPDLYENA_SHIFT) |
 	      (otap_del_sel << OTAPDLYSEL_SHIFT);
 
 	/* Write to STRBSEL for HS400 speed mode */
@@ -290,10 +298,21 @@
 
 	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, mask, val);
 
-	if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ)
+	if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) {
 		sdhci_am654_setup_dll(host, clock);
-	else
+		sdhci_am654->dll_enable = true;
+
+		if (timing == MMC_TIMING_MMC_HS400) {
+			sdhci_am654->itap_del_ena[timing] = 0x1;
+			sdhci_am654->itap_del_sel[timing] = sdhci_am654->itap_del_sel[timing - 1];
+		}
+
+		sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing],
+					  sdhci_am654->itap_del_ena[timing]);
+	} else {
 		sdhci_am654_setup_delay_chain(sdhci_am654, timing);
+		sdhci_am654->dll_enable = false;
+	}
 
 	regmap_update_bits(sdhci_am654->base, PHY_CTRL5, CLKBUFSEL_MASK,
 			   sdhci_am654->clkbuf_sel);
@@ -306,6 +325,8 @@
 	struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host);
 	unsigned char timing = host->mmc->ios.timing;
 	u32 otap_del_sel;
+	u32 itap_del_ena;
+	u32 itap_del_sel;
 	u32 mask, val;
 
 	/* Setup DLL Output TAP delay */
@@ -314,8 +335,19 @@
 	mask = OTAPDLYENA_MASK | OTAPDLYSEL_MASK;
 	val = (0x1 << OTAPDLYENA_SHIFT) |
 	      (otap_del_sel << OTAPDLYSEL_SHIFT);
-	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, mask, val);
 
+	/* Setup Input TAP delay */
+	itap_del_ena = sdhci_am654->itap_del_ena[timing];
+	itap_del_sel = sdhci_am654->itap_del_sel[timing];
+
+	mask |= ITAPDLYENA_MASK | ITAPDLYSEL_MASK;
+	val |= (itap_del_ena << ITAPDLYENA_SHIFT) |
+	       (itap_del_sel << ITAPDLYSEL_SHIFT);
+
+	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK,
+			   1 << ITAPCHGWIN_SHIFT);
+	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, mask, val);
+	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK, 0);
 	regmap_update_bits(sdhci_am654->base, PHY_CTRL5, CLKBUFSEL_MASK,
 			   sdhci_am654->clkbuf_sel);
 
@@ -408,40 +440,105 @@
 	return 0;
 }
 
-#define ITAP_MAX	32
+#define ITAPDLY_LENGTH 32
+#define ITAPDLY_LAST_INDEX (ITAPDLY_LENGTH - 1)
+
+static u32 sdhci_am654_calculate_itap(struct sdhci_host *host, struct window
+			  *fail_window, u8 num_fails, bool circular_buffer)
+{
+	u8 itap = 0, start_fail = 0, end_fail = 0, pass_length = 0;
+	u8 first_fail_start = 0, last_fail_end = 0;
+	struct device *dev = mmc_dev(host->mmc);
+	struct window pass_window = {0, 0, 0};
+	int prev_fail_end = -1;
+	u8 i;
+
+	if (!num_fails)
+		return ITAPDLY_LAST_INDEX >> 1;
+
+	if (fail_window->length == ITAPDLY_LENGTH) {
+		dev_err(dev, "No passing ITAPDLY, return 0\n");
+		return 0;
+	}
+
+	first_fail_start = fail_window->start;
+	last_fail_end = fail_window[num_fails - 1].end;
+
+	for (i = 0; i < num_fails; i++) {
+		start_fail = fail_window[i].start;
+		end_fail = fail_window[i].end;
+		pass_length = start_fail - (prev_fail_end + 1);
+
+		if (pass_length > pass_window.length) {
+			pass_window.start = prev_fail_end + 1;
+			pass_window.length = pass_length;
+		}
+		prev_fail_end = end_fail;
+	}
+
+	if (!circular_buffer)
+		pass_length = ITAPDLY_LAST_INDEX - last_fail_end;
+	else
+		pass_length = ITAPDLY_LAST_INDEX - last_fail_end + first_fail_start;
+
+	if (pass_length > pass_window.length) {
+		pass_window.start = last_fail_end + 1;
+		pass_window.length = pass_length;
+	}
+
+	if (!circular_buffer)
+		itap = pass_window.start + (pass_window.length >> 1);
+	else
+		itap = (pass_window.start + (pass_window.length >> 1)) % ITAPDLY_LENGTH;
+
+	return (itap > ITAPDLY_LAST_INDEX) ? ITAPDLY_LAST_INDEX >> 1 : itap;
+}
+
 static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host,
 					       u32 opcode)
 {
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host);
-	int cur_val, prev_val = 1, fail_len = 0, pass_window = 0, pass_len;
-	u32 itap;
+	unsigned char timing = host->mmc->ios.timing;
+	struct window fail_window[ITAPDLY_LENGTH];
+	u8 curr_pass, itap;
+	u8 fail_index = 0;
+	u8 prev_pass = 1;
+
+	memset(fail_window, 0, sizeof(fail_window));
 
 	/* Enable ITAPDLY */
-	regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYENA_MASK,
-			   1 << ITAPDLYENA_SHIFT);
+	sdhci_am654->itap_del_ena[timing] = 0x1;
+
+	for (itap = 0; itap < ITAPDLY_LENGTH; itap++) {
+		sdhci_am654_write_itapdly(sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]);
+
+		curr_pass = !mmc_send_tuning(host->mmc, opcode, NULL);
 
-	for (itap = 0; itap < ITAP_MAX; itap++) {
-		sdhci_am654_write_itapdly(sdhci_am654, itap);
+		if (!curr_pass && prev_pass)
+			fail_window[fail_index].start = itap;
 
-		cur_val = !mmc_send_tuning(host->mmc, opcode, NULL);
-		if (cur_val && !prev_val)
-			pass_window = itap;
+		if (!curr_pass) {
+			fail_window[fail_index].end = itap;
+			fail_window[fail_index].length++;
+		}
 
-		if (!cur_val)
-			fail_len++;
+		if (curr_pass && !prev_pass)
+			fail_index++;
 
-		prev_val = cur_val;
+		prev_pass = curr_pass;
 	}
-	/*
-	 * Having determined the length of the failing window and start of
-	 * the passing window calculate the length of the passing window and
-	 * set the final value halfway through it considering the range as a
-	 * circular buffer
-	 */
-	pass_len = ITAP_MAX - fail_len;
-	itap = (pass_window + (pass_len >> 1)) % ITAP_MAX;
-	sdhci_am654_write_itapdly(sdhci_am654, itap);
+
+	if (fail_window[fail_index].length != 0)
+		fail_index++;
+
+	itap = sdhci_am654_calculate_itap(host, fail_window, fail_index,
+					  sdhci_am654->dll_enable);
+
+	sdhci_am654_write_itapdly(sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]);
+
+	/* Save ITAPDLY */
+	sdhci_am654->itap_del_sel[timing] = itap;
 
 	return 0;
 }
@@ -590,9 +687,12 @@
 				host->mmc->caps2 &= ~td[i].capability;
 		}
 
-		if (td[i].itap_binding)
-			device_property_read_u32(dev, td[i].itap_binding,
-						 &sdhci_am654->itap_del_sel[i]);
+		if (td[i].itap_binding) {
+			ret = device_property_read_u32(dev, td[i].itap_binding,
+						       &sdhci_am654->itap_del_sel[i]);
+			if (!ret)
+				sdhci_am654->itap_del_ena[i] = 0x1;
+		}
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/mmc/host/sunxi-mmc.c
+++ linux-qcom-6.8.0/drivers/mmc/host/sunxi-mmc.c
@@ -1191,10 +1191,9 @@
 	.needs_new_timings = true,
 };
 
-static const struct sunxi_mmc_cfg sun50i_a100_cfg = {
+static const struct sunxi_mmc_cfg sun50i_h616_cfg = {
 	.idma_des_size_bits = 16,
 	.idma_des_shift = 2,
-	.clk_delays = NULL,
 	.can_calibrate = true,
 	.mask_data0 = true,
 	.needs_new_timings = true,
@@ -1217,8 +1216,9 @@
 	{ .compatible = "allwinner,sun20i-d1-mmc", .data = &sun20i_d1_cfg },
 	{ .compatible = "allwinner,sun50i-a64-mmc", .data = &sun50i_a64_cfg },
 	{ .compatible = "allwinner,sun50i-a64-emmc", .data = &sun50i_a64_emmc_cfg },
-	{ .compatible = "allwinner,sun50i-a100-mmc", .data = &sun50i_a100_cfg },
+	{ .compatible = "allwinner,sun50i-a100-mmc", .data = &sun20i_d1_cfg },
 	{ .compatible = "allwinner,sun50i-a100-emmc", .data = &sun50i_a100_emmc_cfg },
+	{ .compatible = "allwinner,sun50i-h616-mmc", .data = &sun50i_h616_cfg },
 	{ /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, sunxi_mmc_of_match);
--- linux-qcom-6.8.0.orig/drivers/mmc/host/tmio_mmc_core.c
+++ linux-qcom-6.8.0/drivers/mmc/host/tmio_mmc_core.c
@@ -259,6 +259,8 @@
 	else
 		mrq->cmd->error = -ETIMEDOUT;
 
+	/* No new calls yet, but disallow concurrent tmio_mmc_done_work() */
+	host->mrq = ERR_PTR(-EBUSY);
 	host->cmd = NULL;
 	host->data = NULL;
 
--- linux-qcom-6.8.0.orig/drivers/mmc/host/wmt-sdmmc.c
+++ linux-qcom-6.8.0/drivers/mmc/host/wmt-sdmmc.c
@@ -883,7 +883,6 @@
 {
 	struct mmc_host *mmc;
 	struct wmt_mci_priv *priv;
-	struct resource *res;
 	u32 reg_tmp;
 
 	mmc = platform_get_drvdata(pdev);
@@ -911,9 +910,6 @@
 	clk_disable_unprepare(priv->clk_sdmmc);
 	clk_put(priv->clk_sdmmc);
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	release_mem_region(res->start, resource_size(res));
-
 	mmc_free_host(mmc);
 
 	dev_info(&pdev->dev, "WMT MCI device removed\n");
--- linux-qcom-6.8.0.orig/drivers/mtd/devices/powernv_flash.c
+++ linux-qcom-6.8.0/drivers/mtd/devices/powernv_flash.c
@@ -207,6 +207,9 @@
 	 * get them
 	 */
 	mtd->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFP", dev->of_node);
+	if (!mtd->name)
+		return -ENOMEM;
+
 	mtd->type = MTD_NORFLASH;
 	mtd->flags = MTD_WRITEABLE;
 	mtd->size = size;
--- linux-qcom-6.8.0.orig/drivers/mtd/devices/slram.c
+++ linux-qcom-6.8.0/drivers/mtd/devices/slram.c
@@ -296,10 +296,12 @@
 		T("slram: devname = %s\n", devname);
 		if ((!map) || (!(devstart = strsep(&map, ",")))) {
 			E("slram: No devicestart specified.\n");
+			break;
 		}
 		T("slram: devstart = %s\n", devstart);
 		if ((!map) || (!(devlength = strsep(&map, ",")))) {
 			E("slram: No devicelength / -end specified.\n");
+			break;
 		}
 		T("slram: devlength = %s\n", devlength);
 		if (parse_cmdline(devname, devstart, devlength) != 0) {
--- linux-qcom-6.8.0.orig/drivers/mtd/hyperbus/rpc-if.c
+++ linux-qcom-6.8.0/drivers/mtd/hyperbus/rpc-if.c
@@ -163,9 +163,16 @@
 	pm_runtime_disable(hyperbus->rpc.dev);
 }
 
+static const struct platform_device_id rpc_if_hyperflash_id_table[] = {
+	{ .name = "rpc-if-hyperflash" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(platform, rpc_if_hyperflash_id_table);
+
 static struct platform_driver rpcif_platform_driver = {
 	.probe	= rpcif_hb_probe,
 	.remove_new = rpcif_hb_remove,
+	.id_table = rpc_if_hyperflash_id_table,
 	.driver	= {
 		.name	= "rpc-if-hyperflash",
 	},
--- linux-qcom-6.8.0.orig/drivers/mtd/maps/physmap-core.c
+++ linux-qcom-6.8.0/drivers/mtd/maps/physmap-core.c
@@ -518,7 +518,7 @@
 		if (!info->maps[i].phys)
 			info->maps[i].phys = res->start;
 
-		info->win_order = get_bitmask_order(resource_size(res)) - 1;
+		info->win_order = fls64(resource_size(res)) - 1;
 		info->maps[i].size = BIT(info->win_order +
 					 (info->gpios ?
 					  info->gpios->ndescs : 0));
--- linux-qcom-6.8.0.orig/drivers/mtd/maps/sun_uflash.c
+++ linux-qcom-6.8.0/drivers/mtd/maps/sun_uflash.c
@@ -47,7 +47,7 @@
 	.bankwidth =	UFLASH_BUSWIDTH,
 };
 
-int uflash_devinit(struct platform_device *op, struct device_node *dp)
+static int uflash_devinit(struct platform_device *op, struct device_node *dp)
 {
 	struct uflash_dev *up;
 
--- linux-qcom-6.8.0.orig/drivers/mtd/mtdcore.c
+++ linux-qcom-6.8.0/drivers/mtd/mtdcore.c
@@ -900,7 +900,7 @@
 	config.name = compatible;
 	config.id = NVMEM_DEVID_AUTO;
 	config.owner = THIS_MODULE;
-	config.add_legacy_fixed_of_cells = true;
+	config.add_legacy_fixed_of_cells = !mtd_type_is_nand(mtd);
 	config.type = NVMEM_TYPE_OTP;
 	config.root_only = true;
 	config.ignore_wp = true;
@@ -956,8 +956,10 @@
 
 	if (mtd->_get_user_prot_info && mtd->_read_user_prot_reg) {
 		size = mtd_otp_size(mtd, true);
-		if (size < 0)
-			return size;
+		if (size < 0) {
+			err = size;
+			goto err;
+		}
 
 		if (size > 0) {
 			nvmem = mtd_otp_nvmem_register(mtd, "user-otp", size,
@@ -1012,6 +1014,9 @@
 
 err:
 	nvmem_unregister(mtd->otp_user_nvmem);
+	/* Don't report error if OTP is not supported. */
+	if (err == -EOPNOTSUPP)
+		return 0;
 	return dev_err_probe(dev, err, "Failed to register OTP NVMEM device\n");
 }
 
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/Kconfig
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/Kconfig
@@ -234,8 +234,7 @@
 	tristate "Freescale IFC NAND controller"
 	depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST
 	depends on HAS_IOMEM
-	select FSL_IFC
-	select MEMORY
+	depends on FSL_IFC
 	help
 	  Various Freescale chips e.g P1010, include a NAND Flash machine
 	  with built-in hardware ECC capabilities.
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/arasan-nand-controller.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/arasan-nand-controller.c
@@ -1410,8 +1410,8 @@
 	 * case, the "not" chosen CS is assigned to nfc->spare_cs and selected
 	 * whenever a GPIO CS must be asserted.
 	 */
-	if (nfc->cs_array && nfc->ncs > 2) {
-		if (!nfc->cs_array[0] && !nfc->cs_array[1]) {
+	if (nfc->cs_array) {
+		if (nfc->ncs > 2 && !nfc->cs_array[0] && !nfc->cs_array[1]) {
 			dev_err(nfc->dev,
 				"Assign a single native CS when using GPIOs\n");
 			return -EINVAL;
@@ -1479,8 +1479,15 @@
 
 static void anfc_remove(struct platform_device *pdev)
 {
+	int i;
 	struct arasan_nfc *nfc = platform_get_drvdata(pdev);
 
+	for (i = 0; i < nfc->ncs; i++) {
+		if (nfc->cs_array[i]) {
+			gpiod_put(nfc->cs_array[i]);
+		}
+	}
+
 	anfc_chips_cleanup(nfc);
 }
 
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/atmel/pmecc.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/atmel/pmecc.c
@@ -362,7 +362,7 @@
 	size = ALIGN(size, sizeof(s32));
 	size += (req->ecc.strength + 1) * sizeof(s32) * 3;
 
-	user = kzalloc(size, GFP_KERNEL);
+	user = devm_kzalloc(pmecc->dev, size, GFP_KERNEL);
 	if (!user)
 		return ERR_PTR(-ENOMEM);
 
@@ -380,10 +380,8 @@
 	user->delta = user->dmu + req->ecc.strength + 1;
 
 	gf_tables = atmel_pmecc_get_gf_tables(req);
-	if (IS_ERR(gf_tables)) {
-		kfree(user);
+	if (IS_ERR(gf_tables))
 		return ERR_CAST(gf_tables);
-	}
 
 	user->gf_tables = gf_tables;
 
@@ -408,12 +406,6 @@
 }
 EXPORT_SYMBOL_GPL(atmel_pmecc_create_user);
 
-void atmel_pmecc_destroy_user(struct atmel_pmecc_user *user)
-{
-	kfree(user);
-}
-EXPORT_SYMBOL_GPL(atmel_pmecc_destroy_user);
-
 static int get_strength(struct atmel_pmecc_user *user)
 {
 	const int *strengths = user->pmecc->caps->strengths;
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/atmel/pmecc.h
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/atmel/pmecc.h
@@ -55,8 +55,6 @@
 struct atmel_pmecc_user *
 atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
 			struct atmel_pmecc_user_req *req);
-void atmel_pmecc_destroy_user(struct atmel_pmecc_user *user);
-
 void atmel_pmecc_reset(struct atmel_pmecc *pmecc);
 int atmel_pmecc_enable(struct atmel_pmecc_user *user, int op);
 void atmel_pmecc_disable(struct atmel_pmecc_user *user);
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -625,7 +625,7 @@
 /* Only for v7.2 */
 #define	ACC_CONTROL_ECC_EXT_SHIFT		13
 
-static u8 brcmnand_status(struct brcmnand_host *host);
+static int brcmnand_status(struct brcmnand_host *host);
 
 static inline bool brcmnand_non_mmio_ops(struct brcmnand_controller *ctrl)
 {
@@ -1690,7 +1690,7 @@
 				 INTFC_FLASH_STATUS;
 }
 
-static u8 brcmnand_status(struct brcmnand_host *host)
+static int brcmnand_status(struct brcmnand_host *host)
 {
 	struct nand_chip *chip = &host->chip;
 	struct mtd_info *mtd = nand_to_mtd(chip);
@@ -1701,7 +1701,7 @@
 	return brcmnand_waitfunc(chip);
 }
 
-static u8 brcmnand_reset(struct brcmnand_host *host)
+static int brcmnand_reset(struct brcmnand_host *host)
 {
 	struct nand_chip *chip = &host->chip;
 
@@ -2433,7 +2433,11 @@
 
 	if (brcmnand_op_is_status(op)) {
 		status = op->instrs[1].ctx.data.buf.in;
-		*status = brcmnand_status(host);
+		ret = brcmnand_status(host);
+		if (ret < 0)
+			return ret;
+
+		*status = ret & 0xFF;
 
 		return 0;
 	}
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/diskonchip.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/diskonchip.c
@@ -53,7 +53,7 @@
 	0xe8000, 0xea000, 0xec000, 0xee000,
 #endif
 #endif
-	0xffffffff };
+};
 
 static struct mtd_info *doclist = NULL;
 
@@ -1098,7 +1098,7 @@
 		    (i == 0) && (ip->firstUnit > 0)) {
 			parts[0].name = " DiskOnChip IPL / Media Header partition";
 			parts[0].offset = 0;
-			parts[0].size = mtd->erasesize * ip->firstUnit;
+			parts[0].size = (uint64_t)mtd->erasesize * ip->firstUnit;
 			numparts = 1;
 		}
 
@@ -1554,7 +1554,7 @@
 		if (ret < 0)
 			return ret;
 	} else {
-		for (i = 0; (doc_locations[i] != 0xffffffff); i++) {
+		for (i = 0; i < ARRAY_SIZE(doc_locations); i++) {
 			doc_probe(doc_locations[i]);
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/lpc32xx_mlc.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/lpc32xx_mlc.c
@@ -303,8 +303,9 @@
 	return 0;
 }
 
-static irqreturn_t lpc3xxx_nand_irq(int irq, struct lpc32xx_nand_host *host)
+static irqreturn_t lpc3xxx_nand_irq(int irq, void *data)
 {
+	struct lpc32xx_nand_host *host = data;
 	uint8_t sr;
 
 	/* Clear interrupt flag by reading status */
@@ -780,7 +781,7 @@
 		goto release_dma_chan;
 	}
 
-	if (request_irq(host->irq, (irq_handler_t)&lpc3xxx_nand_irq,
+	if (request_irq(host->irq, &lpc3xxx_nand_irq,
 			IRQF_TRIGGER_HIGH, DRV_NAME, host)) {
 		dev_err(&pdev->dev, "Error requesting NAND IRQ\n");
 		res = -ENXIO;
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/meson_nand.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/meson_nand.c
@@ -63,7 +63,7 @@
 #define CMDRWGEN(cmd_dir, ran, bch, short_mode, page_size, pages)	\
 	(								\
 		(cmd_dir)			|			\
-		((ran) << 19)			|			\
+		(ran)				|			\
 		((bch) << 14)			|			\
 		((short_mode) << 13)		|			\
 		(((page_size) & 0x7f) << 6)	|			\
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/mtk_nand.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/mtk_nand.c
@@ -1429,16 +1429,32 @@
 	return 0;
 }
 
+static void mtk_nfc_nand_chips_cleanup(struct mtk_nfc *nfc)
+{
+	struct mtk_nfc_nand_chip *mtk_chip;
+	struct nand_chip *chip;
+	int ret;
+
+	while (!list_empty(&nfc->chips)) {
+		mtk_chip = list_first_entry(&nfc->chips,
+					    struct mtk_nfc_nand_chip, node);
+		chip = &mtk_chip->nand;
+		ret = mtd_device_unregister(nand_to_mtd(chip));
+		WARN_ON(ret);
+		nand_cleanup(chip);
+		list_del(&mtk_chip->node);
+	}
+}
+
 static int mtk_nfc_nand_chips_init(struct device *dev, struct mtk_nfc *nfc)
 {
 	struct device_node *np = dev->of_node;
-	struct device_node *nand_np;
 	int ret;
 
-	for_each_child_of_node(np, nand_np) {
+	for_each_child_of_node_scoped(np, nand_np) {
 		ret = mtk_nfc_nand_chip_init(dev, nfc, nand_np);
 		if (ret) {
-			of_node_put(nand_np);
+			mtk_nfc_nand_chips_cleanup(nfc);
 			return ret;
 		}
 	}
@@ -1570,20 +1586,8 @@
 static void mtk_nfc_remove(struct platform_device *pdev)
 {
 	struct mtk_nfc *nfc = platform_get_drvdata(pdev);
-	struct mtk_nfc_nand_chip *mtk_chip;
-	struct nand_chip *chip;
-	int ret;
-
-	while (!list_empty(&nfc->chips)) {
-		mtk_chip = list_first_entry(&nfc->chips,
-					    struct mtk_nfc_nand_chip, node);
-		chip = &mtk_chip->nand;
-		ret = mtd_device_unregister(nand_to_mtd(chip));
-		WARN_ON(ret);
-		nand_cleanup(chip);
-		list_del(&mtk_chip->node);
-	}
 
+	mtk_nfc_nand_chips_cleanup(nfc);
 	mtk_ecc_release(nfc->ecc);
 }
 
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/nand_base.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/nand_base.c
@@ -1093,28 +1093,32 @@
 				   unsigned int offset_in_page)
 {
 	struct mtd_info *mtd = nand_to_mtd(chip);
+	bool ident_stage = !mtd->writesize;
 
-	/* Make sure the offset is less than the actual page size. */
-	if (offset_in_page > mtd->writesize + mtd->oobsize)
-		return -EINVAL;
+	/* Bypass all checks during NAND identification */
+	if (likely(!ident_stage)) {
+		/* Make sure the offset is less than the actual page size. */
+		if (offset_in_page > mtd->writesize + mtd->oobsize)
+			return -EINVAL;
 
-	/*
-	 * On small page NANDs, there's a dedicated command to access the OOB
-	 * area, and the column address is relative to the start of the OOB
-	 * area, not the start of the page. Asjust the address accordingly.
-	 */
-	if (mtd->writesize <= 512 && offset_in_page >= mtd->writesize)
-		offset_in_page -= mtd->writesize;
+		/*
+		 * On small page NANDs, there's a dedicated command to access the OOB
+		 * area, and the column address is relative to the start of the OOB
+		 * area, not the start of the page. Asjust the address accordingly.
+		 */
+		if (mtd->writesize <= 512 && offset_in_page >= mtd->writesize)
+			offset_in_page -= mtd->writesize;
 
-	/*
-	 * The offset in page is expressed in bytes, if the NAND bus is 16-bit
-	 * wide, then it must be divided by 2.
-	 */
-	if (chip->options & NAND_BUSWIDTH_16) {
-		if (WARN_ON(offset_in_page % 2))
-			return -EINVAL;
+		/*
+		 * The offset in page is expressed in bytes, if the NAND bus is 16-bit
+		 * wide, then it must be divided by 2.
+		 */
+		if (chip->options & NAND_BUSWIDTH_16) {
+			if (WARN_ON(offset_in_page % 2))
+				return -EINVAL;
 
-		offset_in_page /= 2;
+			offset_in_page /= 2;
+		}
 	}
 
 	addrs[0] = offset_in_page;
@@ -1123,7 +1127,7 @@
 	 * Small page NANDs use 1 cycle for the columns, while large page NANDs
 	 * need 2
 	 */
-	if (mtd->writesize <= 512)
+	if (!ident_stage && mtd->writesize <= 512)
 		return 1;
 
 	addrs[1] = offset_in_page >> 8;
@@ -1211,21 +1215,36 @@
 	return nand_exec_op(chip, &op);
 }
 
+static unsigned int rawnand_last_page_of_lun(unsigned int pages_per_lun, unsigned int lun)
+{
+	/* lun is expected to be very small */
+	return (lun * pages_per_lun) + pages_per_lun - 1;
+}
+
 static void rawnand_cap_cont_reads(struct nand_chip *chip)
 {
 	struct nand_memory_organization *memorg;
-	unsigned int pages_per_lun, first_lun, last_lun;
+	unsigned int ppl, first_lun, last_lun;
 
 	memorg = nanddev_get_memorg(&chip->base);
-	pages_per_lun = memorg->pages_per_eraseblock * memorg->eraseblocks_per_lun;
-	first_lun = chip->cont_read.first_page / pages_per_lun;
-	last_lun = chip->cont_read.last_page / pages_per_lun;
+	ppl = memorg->pages_per_eraseblock * memorg->eraseblocks_per_lun;
+	first_lun = chip->cont_read.first_page / ppl;
+	last_lun = chip->cont_read.last_page / ppl;
 
 	/* Prevent sequential cache reads across LUN boundaries */
 	if (first_lun != last_lun)
-		chip->cont_read.pause_page = first_lun * pages_per_lun + pages_per_lun - 1;
+		chip->cont_read.pause_page = rawnand_last_page_of_lun(ppl, first_lun);
 	else
 		chip->cont_read.pause_page = chip->cont_read.last_page;
+
+	if (chip->cont_read.first_page == chip->cont_read.pause_page) {
+		chip->cont_read.first_page++;
+		chip->cont_read.pause_page = min(chip->cont_read.last_page,
+						 rawnand_last_page_of_lun(ppl, first_lun + 1));
+	}
+
+	if (chip->cont_read.first_page >= chip->cont_read.last_page)
+		chip->cont_read.ongoing = false;
 }
 
 static int nand_lp_exec_cont_read_page_op(struct nand_chip *chip, unsigned int page,
@@ -1292,12 +1311,11 @@
 	if (!chip->cont_read.ongoing)
 		return 0;
 
-	if (page == chip->cont_read.pause_page &&
-	    page != chip->cont_read.last_page) {
-		chip->cont_read.first_page = chip->cont_read.pause_page + 1;
-		rawnand_cap_cont_reads(chip);
-	} else if (page == chip->cont_read.last_page) {
+	if (page == chip->cont_read.last_page) {
 		chip->cont_read.ongoing = false;
+	} else if (page == chip->cont_read.pause_page) {
+		chip->cont_read.first_page++;
+		rawnand_cap_cont_reads(chip);
 	}
 
 	return 0;
@@ -1422,16 +1440,19 @@
 			       unsigned int len, bool force_8bit)
 {
 	struct mtd_info *mtd = nand_to_mtd(chip);
+	bool ident_stage = !mtd->writesize;
 
 	if (len && !buf)
 		return -EINVAL;
 
-	if (offset_in_page + len > mtd->writesize + mtd->oobsize)
-		return -EINVAL;
+	if (!ident_stage) {
+		if (offset_in_page + len > mtd->writesize + mtd->oobsize)
+			return -EINVAL;
 
-	/* Small page NANDs do not support column change. */
-	if (mtd->writesize <= 512)
-		return -ENOTSUPP;
+		/* Small page NANDs do not support column change. */
+		if (mtd->writesize <= 512)
+			return -ENOTSUPP;
+	}
 
 	if (nand_has_exec_op(chip)) {
 		const struct nand_interface_config *conf =
@@ -2159,7 +2180,7 @@
 int nand_read_data_op(struct nand_chip *chip, void *buf, unsigned int len,
 		      bool force_8bit, bool check_only)
 {
-	if (!len || !buf)
+	if (!len || (!check_only && !buf))
 		return -EINVAL;
 
 	if (nand_has_exec_op(chip)) {
@@ -3466,30 +3487,36 @@
 				      u32 readlen, int col)
 {
 	struct mtd_info *mtd = nand_to_mtd(chip);
-	unsigned int end_page, end_col;
+	unsigned int first_page, last_page;
 
 	chip->cont_read.ongoing = false;
 
 	if (!chip->controller->supported_op.cont_read)
 		return;
 
-	end_page = DIV_ROUND_UP(col + readlen, mtd->writesize);
-	end_col = (col + readlen) % mtd->writesize;
+	/*
+	 * Don't bother making any calculations if the length is too small.
+	 * Side effect: avoids possible integer underflows below.
+	 */
+	if (readlen < (2 * mtd->writesize))
+		return;
 
+	/* Derive the page where continuous read should start (the first full page read) */
+	first_page = page;
 	if (col)
-		page++;
-
-	if (end_col && end_page)
-		end_page--;
-
-	if (page + 1 > end_page)
-		return;
+		first_page++;
 
-	chip->cont_read.first_page = page;
-	chip->cont_read.last_page = end_page;
-	chip->cont_read.ongoing = true;
+	/* Derive the page where continuous read should stop (the last full page read) */
+	last_page = page + ((col + readlen) / mtd->writesize) - 1;
 
-	rawnand_cap_cont_reads(chip);
+	/* Configure and enable continuous read when suitable */
+	if (first_page < last_page) {
+		chip->cont_read.first_page = first_page;
+		chip->cont_read.last_page = last_page;
+		chip->cont_read.ongoing = true;
+		/* May reset the ongoing flag */
+		rawnand_cap_cont_reads(chip);
+	}
 }
 
 static void rawnand_cont_read_skip_first_page(struct nand_chip *chip, unsigned int page)
@@ -3498,10 +3525,7 @@
 		return;
 
 	chip->cont_read.first_page++;
-	if (chip->cont_read.first_page == chip->cont_read.pause_page)
-		chip->cont_read.first_page++;
-	if (chip->cont_read.first_page >= chip->cont_read.last_page)
-		chip->cont_read.ongoing = false;
+	rawnand_cap_cont_reads(chip);
 }
 
 /**
@@ -3577,7 +3601,8 @@
 	oob = ops->oobbuf;
 	oob_required = oob ? 1 : 0;
 
-	rawnand_enable_cont_reads(chip, page, readlen, col);
+	if (likely(ops->mode != MTD_OPS_RAW))
+		rawnand_enable_cont_reads(chip, page, readlen, col);
 
 	while (1) {
 		struct mtd_ecc_stats ecc_stats = mtd->ecc_stats;
@@ -5195,6 +5220,15 @@
 	if (!nand_has_exec_op(chip))
 		return;
 
+	/*
+	 * For now, continuous reads can only be used with the core page helpers.
+	 * This can be extended later.
+	 */
+	if (!(chip->ecc.read_page == nand_read_page_hwecc ||
+	      chip->ecc.read_page == nand_read_page_syndrome ||
+	      chip->ecc.read_page == nand_read_page_swecc))
+		return;
+
 	rawnand_check_cont_read_support(chip);
 }
 
@@ -6271,6 +6305,7 @@
 static int nand_scan_tail(struct nand_chip *chip)
 {
 	struct mtd_info *mtd = nand_to_mtd(chip);
+	struct nand_device *base = &chip->base;
 	struct nand_ecc_ctrl *ecc = &chip->ecc;
 	int ret, i;
 
@@ -6415,9 +6450,13 @@
 	if (!ecc->write_oob_raw)
 		ecc->write_oob_raw = ecc->write_oob;
 
-	/* propagate ecc info to mtd_info */
+	/* Propagate ECC info to the generic NAND and MTD layers */
 	mtd->ecc_strength = ecc->strength;
+	if (!base->ecc.ctx.conf.strength)
+		base->ecc.ctx.conf.strength = ecc->strength;
 	mtd->ecc_step_size = ecc->size;
+	if (!base->ecc.ctx.conf.step_size)
+		base->ecc.ctx.conf.step_size = ecc->size;
 
 	/*
 	 * Set the number of read / write steps for one page depending on ECC
@@ -6425,6 +6464,8 @@
 	 */
 	if (!ecc->steps)
 		ecc->steps = mtd->writesize / ecc->size;
+	if (!base->ecc.ctx.nsteps)
+		base->ecc.ctx.nsteps = ecc->steps;
 	if (ecc->steps * ecc->size != mtd->writesize) {
 		WARN(1, "Invalid ECC parameters\n");
 		ret = -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/nand_hynix.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/nand_hynix.c
@@ -402,7 +402,7 @@
 	if (ret)
 		pr_warn("failed to initialize read-retry infrastructure");
 
-	return 0;
+	return ret;
 }
 
 static void hynix_nand_extract_oobsize(struct nand_chip *chip,
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/qcom_nandc.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/qcom_nandc.c
@@ -2815,7 +2815,7 @@
 			      host->cfg0_raw & ~(7 << CW_PER_PAGE));
 		nandc_set_reg(chip, NAND_DEV0_CFG1, host->cfg1_raw);
 		instrs = 3;
-	} else {
+	} else if (q_op.cmd_reg != OP_RESET_DEVICE) {
 		return 0;
 	}
 
@@ -2830,9 +2830,8 @@
 	nandc_set_reg(chip, NAND_EXEC_CMD, 1);
 
 	write_reg_dma(nandc, NAND_FLASH_CMD, instrs, NAND_BAM_NEXT_SGL);
-	(q_op.cmd_reg == OP_BLOCK_ERASE) ? write_reg_dma(nandc, NAND_DEV0_CFG0,
-	2, NAND_BAM_NEXT_SGL) : read_reg_dma(nandc,
-	NAND_FLASH_STATUS, 1, NAND_BAM_NEXT_SGL);
+	if (q_op.cmd_reg == OP_BLOCK_ERASE)
+		write_reg_dma(nandc, NAND_DEV0_CFG0, 2, NAND_BAM_NEXT_SGL);
 
 	write_reg_dma(nandc, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL);
 	read_reg_dma(nandc, NAND_FLASH_STATUS, 1, NAND_BAM_NEXT_SGL);
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/raw/rockchip-nand-controller.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/raw/rockchip-nand-controller.c
@@ -420,13 +420,13 @@
 	u32 rate, tc2rw, trwpw, trw2c;
 	u32 temp;
 
-	if (target < 0)
-		return 0;
-
 	timings = nand_get_sdr_timings(conf);
 	if (IS_ERR(timings))
 		return -EOPNOTSUPP;
 
+	if (target < 0)
+		return 0;
+
 	if (IS_ERR(nfc->nfc_clk))
 		rate = clk_get_rate(nfc->ahb_clk);
 	else
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/spi/esmt.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/spi/esmt.c
@@ -104,7 +104,8 @@
 
 static const struct spinand_info esmt_c8_spinand_table[] = {
 	SPINAND_INFO("F50L1G41LB",
-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x01),
+		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x01, 0x7f,
+				0x7f, 0x7f),
 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
 		     NAND_ECCREQ(1, 512),
 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
@@ -113,7 +114,8 @@
 		     0,
 		     SPINAND_ECCINFO(&f50l1g41lb_ooblayout, NULL)),
 	SPINAND_INFO("F50D1G41LB",
-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x11),
+		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x11, 0x7f,
+				0x7f, 0x7f),
 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
 		     NAND_ECCREQ(1, 512),
 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
@@ -122,7 +124,8 @@
 		     0,
 		     SPINAND_ECCINFO(&f50l1g41lb_ooblayout, NULL)),
 	SPINAND_INFO("F50D2G41KA",
-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x51),
+		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x51, 0x7f,
+				0x7f, 0x7f),
 		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
 		     NAND_ECCREQ(8, 512),
 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
--- linux-qcom-6.8.0.orig/drivers/mtd/nand/spi/winbond.c
+++ linux-qcom-6.8.0/drivers/mtd/nand/spi/winbond.c
@@ -172,30 +172,30 @@
 	SPINAND_INFO("W25N01JW",
 		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xbc, 0x21),
 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
-		     NAND_ECCREQ(4, 512),
+		     NAND_ECCREQ(1, 512),
 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
 					      &write_cache_variants,
 					      &update_cache_variants),
 		     0,
-		     SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)),
+		     SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
 	SPINAND_INFO("W25N02JWZEIF",
 		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xbf, 0x22),
 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 2, 1),
-		     NAND_ECCREQ(4, 512),
+		     NAND_ECCREQ(1, 512),
 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
 					      &write_cache_variants,
 					      &update_cache_variants),
 		     0,
-		     SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)),
+		     SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
 	SPINAND_INFO("W25N512GW",
 		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x20),
 		     NAND_MEMORG(1, 2048, 64, 64, 512, 10, 1, 1, 1),
-		     NAND_ECCREQ(4, 512),
+		     NAND_ECCREQ(1, 512),
 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
 					      &write_cache_variants,
 					      &update_cache_variants),
 		     0,
-		     SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)),
+		     SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
 	SPINAND_INFO("W25N02KWZEIR",
 		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x22),
 		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
@@ -208,12 +208,12 @@
 	SPINAND_INFO("W25N01GWZEIG",
 		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x21),
 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
-		     NAND_ECCREQ(4, 512),
+		     NAND_ECCREQ(1, 512),
 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
 					      &write_cache_variants,
 					      &update_cache_variants),
 		     0,
-		     SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)),
+		     SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
 };
 
 static int winbond_spinand_init(struct spinand_device *spinand)
--- linux-qcom-6.8.0.orig/drivers/mtd/parsers/redboot.c
+++ linux-qcom-6.8.0/drivers/mtd/parsers/redboot.c
@@ -102,7 +102,7 @@
 			offset -= master->erasesize;
 		}
 	} else {
-		offset = directory * master->erasesize;
+		offset = (unsigned long) directory * master->erasesize;
 		while (mtd_block_isbad(master, offset)) {
 			offset += master->erasesize;
 			if (offset == master->size)
--- linux-qcom-6.8.0.orig/drivers/mtd/spi-nor/spansion.c
+++ linux-qcom-6.8.0/drivers/mtd/spi-nor/spansion.c
@@ -106,6 +106,7 @@
 	int ret;
 
 	if (nor->reg_proto == SNOR_PROTO_8_8_8_DTR) {
+		op.addr.nbytes = nor->addr_nbytes;
 		op.dummy.nbytes = params->rdsr_dummy;
 		op.data.nbytes = 2;
 	}
--- linux-qcom-6.8.0.orig/drivers/mtd/spi-nor/winbond.c
+++ linux-qcom-6.8.0/drivers/mtd/spi-nor/winbond.c
@@ -105,7 +105,9 @@
 	}, {
 		.id = SNOR_ID(0xef, 0x40, 0x18),
 		.name = "w25q128",
+		.size = SZ_16M,
 		.flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB,
+		.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
 	}, {
 		.id = SNOR_ID(0xef, 0x40, 0x19),
 		.name = "w25q256",
--- linux-qcom-6.8.0.orig/drivers/mtd/tests/Makefile
+++ linux-qcom-6.8.0/drivers/mtd/tests/Makefile
@@ -1,19 +1,19 @@
 # SPDX-License-Identifier: GPL-2.0
-obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o
-obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o
-obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o
-obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o
-obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o
-obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o
-obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o
-obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o
-obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o
+obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o mtd_test.o
+obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o mtd_test.o
+obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o mtd_test.o
+obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o mtd_test.o
+obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o mtd_test.o
+obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o mtd_test.o
+obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o mtd_test.o
+obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o mtd_test.o
+obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o mtd_test.o
 
-mtd_oobtest-objs := oobtest.o mtd_test.o
-mtd_pagetest-objs := pagetest.o mtd_test.o
-mtd_readtest-objs := readtest.o mtd_test.o
-mtd_speedtest-objs := speedtest.o mtd_test.o
-mtd_stresstest-objs := stresstest.o mtd_test.o
-mtd_subpagetest-objs := subpagetest.o mtd_test.o
-mtd_torturetest-objs := torturetest.o mtd_test.o
-mtd_nandbiterrs-objs := nandbiterrs.o mtd_test.o
+mtd_oobtest-objs := oobtest.o
+mtd_pagetest-objs := pagetest.o
+mtd_readtest-objs := readtest.o
+mtd_speedtest-objs := speedtest.o
+mtd_stresstest-objs := stresstest.o
+mtd_subpagetest-objs := subpagetest.o
+mtd_torturetest-objs := torturetest.o
+mtd_nandbiterrs-objs := nandbiterrs.o
--- linux-qcom-6.8.0.orig/drivers/mtd/tests/mtd_test.c
+++ linux-qcom-6.8.0/drivers/mtd/tests/mtd_test.c
@@ -25,6 +25,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(mtdtest_erase_eraseblock);
 
 static int is_block_bad(struct mtd_info *mtd, unsigned int ebnum)
 {
@@ -57,6 +58,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(mtdtest_scan_for_bad_eraseblocks);
 
 int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt,
 				unsigned int eb, int ebcnt)
@@ -75,6 +77,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(mtdtest_erase_good_eraseblocks);
 
 int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf)
 {
@@ -92,6 +95,7 @@
 
 	return err;
 }
+EXPORT_SYMBOL_GPL(mtdtest_read);
 
 int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size,
 		const void *buf)
@@ -107,3 +111,8 @@
 
 	return err;
 }
+EXPORT_SYMBOL_GPL(mtdtest_write);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("MTD function test helpers");
+MODULE_AUTHOR("Akinobu Mita");
--- linux-qcom-6.8.0.orig/drivers/mtd/ubi/attach.c
+++ linux-qcom-6.8.0/drivers/mtd/ubi/attach.c
@@ -1447,7 +1447,7 @@
 	return err;
 }
 
-static struct ubi_attach_info *alloc_ai(void)
+static struct ubi_attach_info *alloc_ai(const char *slab_name)
 {
 	struct ubi_attach_info *ai;
 
@@ -1461,7 +1461,7 @@
 	INIT_LIST_HEAD(&ai->alien);
 	INIT_LIST_HEAD(&ai->fastmap);
 	ai->volumes = RB_ROOT;
-	ai->aeb_slab_cache = kmem_cache_create("ubi_aeb_slab_cache",
+	ai->aeb_slab_cache = kmem_cache_create(slab_name,
 					       sizeof(struct ubi_ainf_peb),
 					       0, 0, NULL);
 	if (!ai->aeb_slab_cache) {
@@ -1491,7 +1491,7 @@
 
 	err = -ENOMEM;
 
-	scan_ai = alloc_ai();
+	scan_ai = alloc_ai("ubi_aeb_slab_cache_fastmap");
 	if (!scan_ai)
 		goto out;
 
@@ -1557,7 +1557,7 @@
 	int err;
 	struct ubi_attach_info *ai;
 
-	ai = alloc_ai();
+	ai = alloc_ai("ubi_aeb_slab_cache");
 	if (!ai)
 		return -ENOMEM;
 
@@ -1575,7 +1575,7 @@
 		if (err > 0 || mtd_is_eccerr(err)) {
 			if (err != UBI_NO_FASTMAP) {
 				destroy_ai(ai);
-				ai = alloc_ai();
+				ai = alloc_ai("ubi_aeb_slab_cache");
 				if (!ai)
 					return -ENOMEM;
 
@@ -1614,7 +1614,7 @@
 	if (ubi->fm && ubi_dbg_chk_fastmap(ubi)) {
 		struct ubi_attach_info *scan_ai;
 
-		scan_ai = alloc_ai();
+		scan_ai = alloc_ai("ubi_aeb_slab_cache_dbg_chk_fastmap");
 		if (!scan_ai) {
 			err = -ENOMEM;
 			goto out_wl;
--- linux-qcom-6.8.0.orig/drivers/mtd/ubi/eba.c
+++ linux-qcom-6.8.0/drivers/mtd/ubi/eba.c
@@ -1557,6 +1557,7 @@
 					  GFP_KERNEL);
 		if (!fm_eba[i]) {
 			ret = -ENOMEM;
+			kfree(scan_eba[i]);
 			goto out_free;
 		}
 
@@ -1592,7 +1593,7 @@
 	}
 
 out_free:
-	for (i = 0; i < num_volumes; i++) {
+	while (--i >= 0) {
 		if (!ubi->volumes[i])
 			continue;
 
--- linux-qcom-6.8.0.orig/drivers/mtd/ubi/fastmap-wl.c
+++ linux-qcom-6.8.0/drivers/mtd/ubi/fastmap-wl.c
@@ -346,14 +346,27 @@
  * WL sub-system.
  *
  * @ubi: UBI device description object
+ * @need_fill: whether to fill wear-leveling pool when no PEBs are found
  */
-static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi)
+static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi,
+					    bool need_fill)
 {
 	struct ubi_fm_pool *pool = &ubi->fm_wl_pool;
 	int pnum;
 
-	if (pool->used == pool->size)
+	if (pool->used == pool->size) {
+		if (need_fill && !ubi->fm_work_scheduled) {
+			/*
+			 * We cannot update the fastmap here because this
+			 * function is called in atomic context.
+			 * Let's fail here and refill/update it as soon as
+			 * possible.
+			 */
+			ubi->fm_work_scheduled = 1;
+			schedule_work(&ubi->fm_work);
+		}
 		return NULL;
+	}
 
 	pnum = pool->pebs[pool->used];
 	return ubi->lookuptbl[pnum];
@@ -375,7 +388,7 @@
 	if (!ubi->used.rb_node)
 		return false;
 
-	e = next_peb_for_wl(ubi);
+	e = next_peb_for_wl(ubi, false);
 	if (!e) {
 		if (!ubi->free.rb_node)
 			return false;
--- linux-qcom-6.8.0.orig/drivers/mtd/ubi/fastmap.c
+++ linux-qcom-6.8.0/drivers/mtd/ubi/fastmap.c
@@ -85,9 +85,10 @@
 		sizeof(struct ubi_fm_scan_pool) +
 		sizeof(struct ubi_fm_scan_pool) +
 		(ubi->peb_count * sizeof(struct ubi_fm_ec)) +
-		(sizeof(struct ubi_fm_eba) +
-		(ubi->peb_count * sizeof(__be32))) +
-		sizeof(struct ubi_fm_volhdr) * UBI_MAX_VOLUMES;
+		((sizeof(struct ubi_fm_eba) +
+		  sizeof(struct ubi_fm_volhdr)) *
+		 (UBI_MAX_VOLUMES + UBI_INT_VOL_COUNT)) +
+		(ubi->peb_count * sizeof(__be32));
 	return roundup(size, ubi->leb_size);
 }
 
--- linux-qcom-6.8.0.orig/drivers/mtd/ubi/vtbl.c
+++ linux-qcom-6.8.0/drivers/mtd/ubi/vtbl.c
@@ -791,6 +791,12 @@
 	 * The number of supported volumes is limited by the eraseblock size
 	 * and by the UBI_MAX_VOLUMES constant.
 	 */
+
+	if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) {
+		ubi_err(ubi, "LEB size too small for a volume record");
+		return -EINVAL;
+	}
+
 	ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE;
 	if (ubi->vtbl_slots > UBI_MAX_VOLUMES)
 		ubi->vtbl_slots = UBI_MAX_VOLUMES;
--- linux-qcom-6.8.0.orig/drivers/mtd/ubi/wl.c
+++ linux-qcom-6.8.0/drivers/mtd/ubi/wl.c
@@ -683,7 +683,7 @@
 	ubi_assert(!ubi->move_to_put);
 
 #ifdef CONFIG_MTD_UBI_FASTMAP
-	if (!next_peb_for_wl(ubi) ||
+	if (!next_peb_for_wl(ubi, true) ||
 #else
 	if (!ubi->free.rb_node ||
 #endif
@@ -846,7 +846,14 @@
 			goto out_not_moved;
 		}
 		if (err == MOVE_RETRY) {
-			scrubbing = 1;
+			/*
+			 * For source PEB:
+			 * 1. The scrubbing is set for scrub type PEB, it will
+			 *    be put back into ubi->scrub list.
+			 * 2. Non-scrub type PEB will be put back into ubi->used
+			 *    list.
+			 */
+			keep = 1;
 			dst_leb_clean = 1;
 			goto out_not_moved;
 		}
--- linux-qcom-6.8.0.orig/drivers/mtd/ubi/wl.h
+++ linux-qcom-6.8.0/drivers/mtd/ubi/wl.h
@@ -5,7 +5,8 @@
 static void update_fastmap_work_fn(struct work_struct *wrk);
 static struct ubi_wl_entry *find_anchor_wl_entry(struct rb_root *root);
 static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi);
-static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi);
+static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi,
+					    bool need_fill);
 static bool need_wear_leveling(struct ubi_device *ubi);
 static void ubi_fastmap_close(struct ubi_device *ubi);
 static inline void ubi_fastmap_init(struct ubi_device *ubi, int *count)
--- linux-qcom-6.8.0.orig/drivers/net/Kconfig
+++ linux-qcom-6.8.0/drivers/net/Kconfig
@@ -484,6 +484,15 @@
 	  QCOM based WWAN modems for IP or QMAP/rmnet protocol (like SDX55).
 	  Say Y or M.
 
+ config MHI_EP_NET
+	tristate "MHI Endpoint network driver"
+	depends on MHI_BUS_EP
+	help
+	  This is the network driver for MHI bus implementation in endpoint
+	  devices. It is used provide the network interface for QCOM modems
+	  such as SDX55.
+	  Say Y or M.
+
 endif # NET_CORE
 
 config SUNGEM_PHY
--- linux-qcom-6.8.0.orig/drivers/net/Makefile
+++ linux-qcom-6.8.0/drivers/net/Makefile
@@ -41,6 +41,7 @@
 obj-$(CONFIG_NET_VRF) += vrf.o
 obj-$(CONFIG_VSOCKMON) += vsockmon.o
 obj-$(CONFIG_MHI_NET) += mhi_net.o
+obj-$(CONFIG_MHI_EP_NET) += mhi_ep_net.o
 
 #
 # Networking Drivers
@@ -48,7 +49,9 @@
 obj-$(CONFIG_ARCNET) += arcnet/
 obj-$(CONFIG_CAIF) += caif/
 obj-$(CONFIG_CAN) += can/
-obj-$(CONFIG_NET_DSA) += dsa/
+ifdef CONFIG_NET_DSA
+obj-y += dsa/
+endif
 obj-$(CONFIG_ETHERNET) += ethernet/
 obj-$(CONFIG_FDDI) += fddi/
 obj-$(CONFIG_HIPPI) += hippi/
--- linux-qcom-6.8.0.orig/drivers/net/bareudp.c
+++ linux-qcom-6.8.0/drivers/net/bareudp.c
@@ -67,6 +67,7 @@
 	__be16 proto;
 	void *oiph;
 	int err;
+	int nh;
 
 	bareudp = rcu_dereference_sk_user_data(sk);
 	if (!bareudp)
@@ -82,7 +83,7 @@
 
 		if (skb_copy_bits(skb, BAREUDP_BASE_HLEN, &ipversion,
 				  sizeof(ipversion))) {
-			bareudp->dev->stats.rx_dropped++;
+			DEV_STATS_INC(bareudp->dev, rx_dropped);
 			goto drop;
 		}
 		ipversion >>= 4;
@@ -92,7 +93,7 @@
 		} else if (ipversion == 6 && bareudp->multi_proto_mode) {
 			proto = htons(ETH_P_IPV6);
 		} else {
-			bareudp->dev->stats.rx_dropped++;
+			DEV_STATS_INC(bareudp->dev, rx_dropped);
 			goto drop;
 		}
 	} else if (bareudp->ethertype == htons(ETH_P_MPLS_UC)) {
@@ -106,7 +107,7 @@
 				   ipv4_is_multicast(tunnel_hdr->daddr)) {
 				proto = htons(ETH_P_MPLS_MC);
 			} else {
-				bareudp->dev->stats.rx_dropped++;
+				DEV_STATS_INC(bareudp->dev, rx_dropped);
 				goto drop;
 			}
 		} else {
@@ -122,7 +123,7 @@
 				   (addr_type & IPV6_ADDR_MULTICAST)) {
 				proto = htons(ETH_P_MPLS_MC);
 			} else {
-				bareudp->dev->stats.rx_dropped++;
+				DEV_STATS_INC(bareudp->dev, rx_dropped);
 				goto drop;
 			}
 		}
@@ -134,20 +135,35 @@
 				 proto,
 				 !net_eq(bareudp->net,
 				 dev_net(bareudp->dev)))) {
-		bareudp->dev->stats.rx_dropped++;
+		DEV_STATS_INC(bareudp->dev, rx_dropped);
 		goto drop;
 	}
 	tun_dst = udp_tun_rx_dst(skb, family, TUNNEL_KEY, 0, 0);
 	if (!tun_dst) {
-		bareudp->dev->stats.rx_dropped++;
+		DEV_STATS_INC(bareudp->dev, rx_dropped);
 		goto drop;
 	}
 	skb_dst_set(skb, &tun_dst->dst);
 	skb->dev = bareudp->dev;
-	oiph = skb_network_header(skb);
-	skb_reset_network_header(skb);
 	skb_reset_mac_header(skb);
 
+	/* Save offset of outer header relative to skb->head,
+	 * because we are going to reset the network header to the inner header
+	 * and might change skb->head.
+	 */
+	nh = skb_network_header(skb) - skb->head;
+
+	skb_reset_network_header(skb);
+
+	if (!pskb_inet_may_pull(skb)) {
+		DEV_STATS_INC(bareudp->dev, rx_length_errors);
+		DEV_STATS_INC(bareudp->dev, rx_errors);
+		goto drop;
+	}
+
+	/* Get the outer header. */
+	oiph = skb->head + nh;
+
 	if (!ipv6_mod_enabled() || family == AF_INET)
 		err = IP_ECN_decapsulate(oiph, skb);
 	else
@@ -165,8 +181,8 @@
 						     &((struct ipv6hdr *)oiph)->saddr);
 		}
 		if (err > 1) {
-			++bareudp->dev->stats.rx_frame_errors;
-			++bareudp->dev->stats.rx_errors;
+			DEV_STATS_INC(bareudp->dev, rx_frame_errors);
+			DEV_STATS_INC(bareudp->dev, rx_errors);
 			goto drop;
 		}
 	}
@@ -303,6 +319,9 @@
 	__be32 saddr;
 	int err;
 
+	if (!skb_vlan_inet_prepare(skb, skb->protocol != htons(ETH_P_TEB)))
+		return -EINVAL;
+
 	if (!sock)
 		return -ESHUTDOWN;
 
@@ -368,6 +387,9 @@
 	__be16 sport;
 	int err;
 
+	if (!skb_vlan_inet_prepare(skb, skb->protocol != htons(ETH_P_TEB)))
+		return -EINVAL;
+
 	if (!sock)
 		return -ESHUTDOWN;
 
@@ -466,11 +488,11 @@
 	dev_kfree_skb(skb);
 
 	if (err == -ELOOP)
-		dev->stats.collisions++;
+		DEV_STATS_INC(dev, collisions);
 	else if (err == -ENETUNREACH)
-		dev->stats.tx_carrier_errors++;
+		DEV_STATS_INC(dev, tx_carrier_errors);
 
-	dev->stats.tx_errors++;
+	DEV_STATS_INC(dev, tx_errors);
 	return NETDEV_TX_OK;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/bonding/bond_main.c
+++ linux-qcom-6.8.0/drivers/net/bonding/bond_main.c
@@ -427,6 +427,8 @@
 			     struct netlink_ext_ack *extack)
 {
 	struct net_device *bond_dev = xs->xso.dev;
+	struct net_device *real_dev;
+	netdevice_tracker tracker;
 	struct bond_ipsec *ipsec;
 	struct bonding *bond;
 	struct slave *slave;
@@ -438,74 +440,80 @@
 	rcu_read_lock();
 	bond = netdev_priv(bond_dev);
 	slave = rcu_dereference(bond->curr_active_slave);
-	if (!slave) {
-		rcu_read_unlock();
-		return -ENODEV;
+	real_dev = slave ? slave->dev : NULL;
+	netdev_hold(real_dev, &tracker, GFP_ATOMIC);
+	rcu_read_unlock();
+	if (!real_dev) {
+		err = -ENODEV;
+		goto out;
 	}
 
-	if (!slave->dev->xfrmdev_ops ||
-	    !slave->dev->xfrmdev_ops->xdo_dev_state_add ||
-	    netif_is_bond_master(slave->dev)) {
+	if (!real_dev->xfrmdev_ops ||
+	    !real_dev->xfrmdev_ops->xdo_dev_state_add ||
+	    netif_is_bond_master(real_dev)) {
 		NL_SET_ERR_MSG_MOD(extack, "Slave does not support ipsec offload");
-		rcu_read_unlock();
-		return -EINVAL;
+		err = -EINVAL;
+		goto out;
 	}
 
-	ipsec = kmalloc(sizeof(*ipsec), GFP_ATOMIC);
+	ipsec = kmalloc(sizeof(*ipsec), GFP_KERNEL);
 	if (!ipsec) {
-		rcu_read_unlock();
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto out;
 	}
-	xs->xso.real_dev = slave->dev;
 
-	err = slave->dev->xfrmdev_ops->xdo_dev_state_add(xs, extack);
+	xs->xso.real_dev = real_dev;
+	err = real_dev->xfrmdev_ops->xdo_dev_state_add(xs, extack);
 	if (!err) {
 		ipsec->xs = xs;
 		INIT_LIST_HEAD(&ipsec->list);
-		spin_lock_bh(&bond->ipsec_lock);
+		mutex_lock(&bond->ipsec_lock);
 		list_add(&ipsec->list, &bond->ipsec_list);
-		spin_unlock_bh(&bond->ipsec_lock);
+		mutex_unlock(&bond->ipsec_lock);
 	} else {
 		kfree(ipsec);
 	}
-	rcu_read_unlock();
+out:
+	netdev_put(real_dev, &tracker);
 	return err;
 }
 
 static void bond_ipsec_add_sa_all(struct bonding *bond)
 {
 	struct net_device *bond_dev = bond->dev;
+	struct net_device *real_dev;
 	struct bond_ipsec *ipsec;
 	struct slave *slave;
 
-	rcu_read_lock();
-	slave = rcu_dereference(bond->curr_active_slave);
-	if (!slave)
-		goto out;
+	slave = rtnl_dereference(bond->curr_active_slave);
+	real_dev = slave ? slave->dev : NULL;
+	if (!real_dev)
+		return;
 
-	if (!slave->dev->xfrmdev_ops ||
-	    !slave->dev->xfrmdev_ops->xdo_dev_state_add ||
-	    netif_is_bond_master(slave->dev)) {
-		spin_lock_bh(&bond->ipsec_lock);
+	mutex_lock(&bond->ipsec_lock);
+	if (!real_dev->xfrmdev_ops ||
+	    !real_dev->xfrmdev_ops->xdo_dev_state_add ||
+	    netif_is_bond_master(real_dev)) {
 		if (!list_empty(&bond->ipsec_list))
-			slave_warn(bond_dev, slave->dev,
+			slave_warn(bond_dev, real_dev,
 				   "%s: no slave xdo_dev_state_add\n",
 				   __func__);
-		spin_unlock_bh(&bond->ipsec_lock);
 		goto out;
 	}
 
-	spin_lock_bh(&bond->ipsec_lock);
 	list_for_each_entry(ipsec, &bond->ipsec_list, list) {
-		ipsec->xs->xso.real_dev = slave->dev;
-		if (slave->dev->xfrmdev_ops->xdo_dev_state_add(ipsec->xs, NULL)) {
-			slave_warn(bond_dev, slave->dev, "%s: failed to add SA\n", __func__);
+		/* If new state is added before ipsec_lock acquired */
+		if (ipsec->xs->xso.real_dev == real_dev)
+			continue;
+
+		ipsec->xs->xso.real_dev = real_dev;
+		if (real_dev->xfrmdev_ops->xdo_dev_state_add(ipsec->xs, NULL)) {
+			slave_warn(bond_dev, real_dev, "%s: failed to add SA\n", __func__);
 			ipsec->xs->xso.real_dev = NULL;
 		}
 	}
-	spin_unlock_bh(&bond->ipsec_lock);
 out:
-	rcu_read_unlock();
+	mutex_unlock(&bond->ipsec_lock);
 }
 
 /**
@@ -515,6 +523,8 @@
 static void bond_ipsec_del_sa(struct xfrm_state *xs)
 {
 	struct net_device *bond_dev = xs->xso.dev;
+	struct net_device *real_dev;
+	netdevice_tracker tracker;
 	struct bond_ipsec *ipsec;
 	struct bonding *bond;
 	struct slave *slave;
@@ -525,6 +535,9 @@
 	rcu_read_lock();
 	bond = netdev_priv(bond_dev);
 	slave = rcu_dereference(bond->curr_active_slave);
+	real_dev = slave ? slave->dev : NULL;
+	netdev_hold(real_dev, &tracker, GFP_ATOMIC);
+	rcu_read_unlock();
 
 	if (!slave)
 		goto out;
@@ -532,18 +545,19 @@
 	if (!xs->xso.real_dev)
 		goto out;
 
-	WARN_ON(xs->xso.real_dev != slave->dev);
+	WARN_ON(xs->xso.real_dev != real_dev);
 
-	if (!slave->dev->xfrmdev_ops ||
-	    !slave->dev->xfrmdev_ops->xdo_dev_state_delete ||
-	    netif_is_bond_master(slave->dev)) {
-		slave_warn(bond_dev, slave->dev, "%s: no slave xdo_dev_state_delete\n", __func__);
+	if (!real_dev->xfrmdev_ops ||
+	    !real_dev->xfrmdev_ops->xdo_dev_state_delete ||
+	    netif_is_bond_master(real_dev)) {
+		slave_warn(bond_dev, real_dev, "%s: no slave xdo_dev_state_delete\n", __func__);
 		goto out;
 	}
 
-	slave->dev->xfrmdev_ops->xdo_dev_state_delete(xs);
+	real_dev->xfrmdev_ops->xdo_dev_state_delete(xs);
 out:
-	spin_lock_bh(&bond->ipsec_lock);
+	netdev_put(real_dev, &tracker);
+	mutex_lock(&bond->ipsec_lock);
 	list_for_each_entry(ipsec, &bond->ipsec_list, list) {
 		if (ipsec->xs == xs) {
 			list_del(&ipsec->list);
@@ -551,41 +565,72 @@
 			break;
 		}
 	}
-	spin_unlock_bh(&bond->ipsec_lock);
-	rcu_read_unlock();
+	mutex_unlock(&bond->ipsec_lock);
 }
 
 static void bond_ipsec_del_sa_all(struct bonding *bond)
 {
 	struct net_device *bond_dev = bond->dev;
+	struct net_device *real_dev;
 	struct bond_ipsec *ipsec;
 	struct slave *slave;
 
-	rcu_read_lock();
-	slave = rcu_dereference(bond->curr_active_slave);
-	if (!slave) {
-		rcu_read_unlock();
+	slave = rtnl_dereference(bond->curr_active_slave);
+	real_dev = slave ? slave->dev : NULL;
+	if (!real_dev)
 		return;
-	}
 
-	spin_lock_bh(&bond->ipsec_lock);
+	mutex_lock(&bond->ipsec_lock);
 	list_for_each_entry(ipsec, &bond->ipsec_list, list) {
 		if (!ipsec->xs->xso.real_dev)
 			continue;
 
-		if (!slave->dev->xfrmdev_ops ||
-		    !slave->dev->xfrmdev_ops->xdo_dev_state_delete ||
-		    netif_is_bond_master(slave->dev)) {
-			slave_warn(bond_dev, slave->dev,
+		if (!real_dev->xfrmdev_ops ||
+		    !real_dev->xfrmdev_ops->xdo_dev_state_delete ||
+		    netif_is_bond_master(real_dev)) {
+			slave_warn(bond_dev, real_dev,
 				   "%s: no slave xdo_dev_state_delete\n",
 				   __func__);
 		} else {
-			slave->dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs);
+			real_dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs);
+			if (real_dev->xfrmdev_ops->xdo_dev_state_free)
+				real_dev->xfrmdev_ops->xdo_dev_state_free(ipsec->xs);
 		}
-		ipsec->xs->xso.real_dev = NULL;
 	}
-	spin_unlock_bh(&bond->ipsec_lock);
+	mutex_unlock(&bond->ipsec_lock);
+}
+
+static void bond_ipsec_free_sa(struct xfrm_state *xs)
+{
+	struct net_device *bond_dev = xs->xso.dev;
+	struct net_device *real_dev;
+	netdevice_tracker tracker;
+	struct bonding *bond;
+	struct slave *slave;
+
+	if (!bond_dev)
+		return;
+
+	rcu_read_lock();
+	bond = netdev_priv(bond_dev);
+	slave = rcu_dereference(bond->curr_active_slave);
+	real_dev = slave ? slave->dev : NULL;
+	netdev_hold(real_dev, &tracker, GFP_ATOMIC);
 	rcu_read_unlock();
+
+	if (!slave)
+		goto out;
+
+	if (!xs->xso.real_dev)
+		goto out;
+
+	WARN_ON(xs->xso.real_dev != real_dev);
+
+	if (real_dev && real_dev->xfrmdev_ops &&
+	    real_dev->xfrmdev_ops->xdo_dev_state_free)
+		real_dev->xfrmdev_ops->xdo_dev_state_free(xs);
+out:
+	netdev_put(real_dev, &tracker);
 }
 
 /**
@@ -599,39 +644,36 @@
 	struct net_device *real_dev;
 	struct slave *curr_active;
 	struct bonding *bond;
-	int err;
+	bool ok = false;
 
 	bond = netdev_priv(bond_dev);
 	rcu_read_lock();
 	curr_active = rcu_dereference(bond->curr_active_slave);
+	if (!curr_active)
+		goto out;
 	real_dev = curr_active->dev;
 
-	if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) {
-		err = false;
+	if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP)
 		goto out;
-	}
 
-	if (!xs->xso.real_dev) {
-		err = false;
+	if (!xs->xso.real_dev)
 		goto out;
-	}
 
 	if (!real_dev->xfrmdev_ops ||
 	    !real_dev->xfrmdev_ops->xdo_dev_offload_ok ||
-	    netif_is_bond_master(real_dev)) {
-		err = false;
+	    netif_is_bond_master(real_dev))
 		goto out;
-	}
 
-	err = real_dev->xfrmdev_ops->xdo_dev_offload_ok(skb, xs);
+	ok = real_dev->xfrmdev_ops->xdo_dev_offload_ok(skb, xs);
 out:
 	rcu_read_unlock();
-	return err;
+	return ok;
 }
 
 static const struct xfrmdev_ops bond_xfrmdev_ops = {
 	.xdo_dev_state_add = bond_ipsec_add_sa,
 	.xdo_dev_state_delete = bond_ipsec_del_sa,
+	.xdo_dev_state_free = bond_ipsec_free_sa,
 	.xdo_dev_offload_ok = bond_ipsec_offload_ok,
 };
 #endif /* CONFIG_XFRM_OFFLOAD */
@@ -892,6 +934,8 @@
 
 		if (bond->dev->flags & IFF_UP)
 			bond_hw_addr_flush(bond->dev, old_active->dev);
+
+		bond_slave_ns_maddrs_add(bond, old_active);
 	}
 
 	if (new_active) {
@@ -908,6 +952,8 @@
 			dev_mc_sync(new_active->dev, bond->dev);
 			netif_addr_unlock_bh(bond->dev);
 		}
+
+		bond_slave_ns_maddrs_del(bond, new_active);
 	}
 }
 
@@ -1121,13 +1167,10 @@
 	return bestslave;
 }
 
+/* must be called in RCU critical section or with RTNL held */
 static bool bond_should_notify_peers(struct bonding *bond)
 {
-	struct slave *slave;
-
-	rcu_read_lock();
-	slave = rcu_dereference(bond->curr_active_slave);
-	rcu_read_unlock();
+	struct slave *slave = rcu_dereference_rtnl(bond->curr_active_slave);
 
 	if (!slave || !bond->send_peer_notif ||
 	    bond->send_peer_notif %
@@ -1403,9 +1446,7 @@
 	struct slave *slave;
 
 	mask = features;
-
-	features &= ~NETIF_F_ONE_FOR_ALL;
-	features |= NETIF_F_ALL_FOR_ALL;
+	features = netdev_base_features(features);
 
 	bond_for_each_slave(bond, slave, iter) {
 		features = netdev_increment_features(features,
@@ -1419,6 +1460,7 @@
 
 #define BOND_VLAN_FEATURES	(NETIF_F_HW_CSUM | NETIF_F_SG | \
 				 NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE | \
+				 NETIF_F_GSO_ENCAP_ALL | \
 				 NETIF_F_HIGHDMA | NETIF_F_LRO)
 
 #define BOND_ENC_FEATURES	(NETIF_F_HW_CSUM | NETIF_F_SG | \
@@ -1447,8 +1489,9 @@
 
 	if (!bond_has_slaves(bond))
 		goto done;
-	vlan_features &= NETIF_F_ALL_FOR_ALL;
-	mpls_features &= NETIF_F_ALL_FOR_ALL;
+
+	vlan_features = netdev_base_features(vlan_features);
+	mpls_features = netdev_base_features(mpls_features);
 
 	bond_for_each_slave(bond, slave, iter) {
 		vlan_features = netdev_increment_features(vlan_features,
@@ -2228,6 +2271,11 @@
 	bond_compute_features(bond);
 	bond_set_carrier(bond);
 
+	/* Needs to be called before bond_select_active_slave(), which will
+	 * remove the maddrs if the slave is selected as active slave.
+	 */
+	bond_slave_ns_maddrs_add(bond, new_slave);
+
 	if (bond_uses_primary(bond)) {
 		block_netpoll_tx();
 		bond_select_active_slave(bond);
@@ -2237,7 +2285,6 @@
 	if (bond_mode_can_use_xmit_hash(bond))
 		bond_update_slave_arr(bond, NULL);
 
-
 	if (!slave_dev->netdev_ops->ndo_bpf ||
 	    !slave_dev->netdev_ops->ndo_xdp_xmit) {
 		if (bond->xdp_prog) {
@@ -2435,6 +2482,12 @@
 	if (oldcurrent == slave)
 		bond_change_active_slave(bond, NULL);
 
+	/* Must be called after bond_change_active_slave () as the slave
+	 * might change from an active slave to a backup slave. Then it is
+	 * necessary to clear the maddrs on the backup slave.
+	 */
+	bond_slave_ns_maddrs_del(bond, slave);
+
 	if (bond_is_lb(bond)) {
 		/* Must be called only after the slave has been
 		 * detached from the list and the curr_active_slave
@@ -5495,9 +5548,9 @@
 		break;
 
 	default:
-		/* Should never happen. Mode guarded by bond_xdp_check() */
-		netdev_err(bond_dev, "Unknown bonding mode %d for xdp xmit\n", BOND_MODE(bond));
-		WARN_ON_ONCE(1);
+		if (net_ratelimit())
+			netdev_err(bond_dev, "Unknown bonding mode %d for xdp xmit\n",
+				   BOND_MODE(bond));
 		return NULL;
 	}
 
@@ -5771,6 +5824,9 @@
 	if (real_dev) {
 		ret = ethtool_get_ts_info_by_layer(real_dev, info);
 	} else {
+		info->phc_index = -1;
+		info->so_timestamping = SOF_TIMESTAMPING_RX_SOFTWARE |
+					SOF_TIMESTAMPING_SOFTWARE;
 		/* Check if all slaves support software tx timestamping */
 		rcu_read_lock();
 		bond_for_each_slave_rcu(bond, slave, iter) {
@@ -5880,7 +5936,7 @@
 	/* set up xfrm device ops (only supported in active-backup right now) */
 	bond_dev->xfrmdev_ops = &bond_xfrmdev_ops;
 	INIT_LIST_HEAD(&bond->ipsec_list);
-	spin_lock_init(&bond->ipsec_lock);
+	mutex_init(&bond->ipsec_lock);
 #endif /* CONFIG_XFRM_OFFLOAD */
 
 	/* don't acquire bond device's netif_tx_lock when transmitting */
@@ -5929,6 +5985,10 @@
 		__bond_release_one(bond_dev, slave->dev, true, true);
 	netdev_info(bond_dev, "Released all slaves\n");
 
+#ifdef CONFIG_XFRM_OFFLOAD
+	mutex_destroy(&bond->ipsec_lock);
+#endif /* CONFIG_XFRM_OFFLOAD */
+
 	bond_set_slave_arr(bond, NULL, NULL);
 
 	list_del(&bond->bond_list);
@@ -6459,16 +6519,16 @@
 	if (res)
 		goto out;
 
+	bond_create_debugfs();
+
 	res = register_pernet_subsys(&bond_net_ops);
 	if (res)
-		goto out;
+		goto err_net_ops;
 
 	res = bond_netlink_init();
 	if (res)
 		goto err_link;
 
-	bond_create_debugfs();
-
 	for (i = 0; i < max_bonds; i++) {
 		res = bond_create(&init_net, NULL);
 		if (res)
@@ -6483,10 +6543,11 @@
 out:
 	return res;
 err:
-	bond_destroy_debugfs();
 	bond_netlink_fini();
 err_link:
 	unregister_pernet_subsys(&bond_net_ops);
+err_net_ops:
+	bond_destroy_debugfs();
 	goto out;
 
 }
@@ -6495,11 +6556,11 @@
 {
 	unregister_netdevice_notifier(&bond_netdev_notifier);
 
-	bond_destroy_debugfs();
-
 	bond_netlink_fini();
 	unregister_pernet_subsys(&bond_net_ops);
 
+	bond_destroy_debugfs();
+
 #ifdef CONFIG_NET_POLL_CONTROLLER
 	/* Make sure we don't have an imbalance on our netpoll blocking */
 	WARN_ON(atomic_read(&netpoll_block_tx));
--- linux-qcom-6.8.0.orig/drivers/net/bonding/bond_options.c
+++ linux-qcom-6.8.0/drivers/net/bonding/bond_options.c
@@ -15,6 +15,7 @@
 #include <linux/sched/signal.h>
 
 #include <net/bonding.h>
+#include <net/ndisc.h>
 
 static int bond_option_active_slave_set(struct bonding *bond,
 					const struct bond_opt_value *newval);
@@ -920,7 +921,7 @@
 	/* check to see if we are clearing active */
 	if (!slave_dev) {
 		netdev_dbg(bond->dev, "Clearing current active slave\n");
-		RCU_INIT_POINTER(bond->curr_active_slave, NULL);
+		bond_change_active_slave(bond, NULL);
 		bond_select_active_slave(bond);
 	} else {
 		struct slave *old_active = rtnl_dereference(bond->curr_active_slave);
@@ -1198,9 +1199,9 @@
 	__be32 target;
 
 	if (newval->string) {
-		if (!in4_pton(newval->string+1, -1, (u8 *)&target, -1, NULL)) {
-			netdev_err(bond->dev, "invalid ARP target %pI4 specified\n",
-				   &target);
+		if (strlen(newval->string) < 1 ||
+		    !in4_pton(newval->string + 1, -1, (u8 *)&target, -1, NULL)) {
+			netdev_err(bond->dev, "invalid ARP target specified\n");
 			return ret;
 		}
 		if (newval->string[0] == '+')
@@ -1218,6 +1219,68 @@
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
+static bool slave_can_set_ns_maddr(const struct bonding *bond, struct slave *slave)
+{
+	return BOND_MODE(bond) == BOND_MODE_ACTIVEBACKUP &&
+	       !bond_is_active_slave(slave) &&
+	       slave->dev->flags & IFF_MULTICAST;
+}
+
+static void slave_set_ns_maddrs(struct bonding *bond, struct slave *slave, bool add)
+{
+	struct in6_addr *targets = bond->params.ns_targets;
+	char slot_maddr[MAX_ADDR_LEN];
+	int i;
+
+	if (!slave_can_set_ns_maddr(bond, slave))
+		return;
+
+	for (i = 0; i < BOND_MAX_NS_TARGETS; i++) {
+		if (ipv6_addr_any(&targets[i]))
+			break;
+
+		if (!ndisc_mc_map(&targets[i], slot_maddr, slave->dev, 0)) {
+			if (add)
+				dev_mc_add(slave->dev, slot_maddr);
+			else
+				dev_mc_del(slave->dev, slot_maddr);
+		}
+	}
+}
+
+void bond_slave_ns_maddrs_add(struct bonding *bond, struct slave *slave)
+{
+	if (!bond->params.arp_validate)
+		return;
+	slave_set_ns_maddrs(bond, slave, true);
+}
+
+void bond_slave_ns_maddrs_del(struct bonding *bond, struct slave *slave)
+{
+	if (!bond->params.arp_validate)
+		return;
+	slave_set_ns_maddrs(bond, slave, false);
+}
+
+static void slave_set_ns_maddr(struct bonding *bond, struct slave *slave,
+			       struct in6_addr *target, struct in6_addr *slot)
+{
+	char target_maddr[MAX_ADDR_LEN], slot_maddr[MAX_ADDR_LEN];
+
+	if (!bond->params.arp_validate || !slave_can_set_ns_maddr(bond, slave))
+		return;
+
+	/* remove the previous maddr from slave */
+	if (!ipv6_addr_any(slot) &&
+	    !ndisc_mc_map(slot, slot_maddr, slave->dev, 0))
+		dev_mc_del(slave->dev, slot_maddr);
+
+	/* add new maddr on slave if target is set */
+	if (!ipv6_addr_any(target) &&
+	    !ndisc_mc_map(target, target_maddr, slave->dev, 0))
+		dev_mc_add(slave->dev, target_maddr);
+}
+
 static void _bond_options_ns_ip6_target_set(struct bonding *bond, int slot,
 					    struct in6_addr *target,
 					    unsigned long last_rx)
@@ -1227,8 +1290,10 @@
 	struct slave *slave;
 
 	if (slot >= 0 && slot < BOND_MAX_NS_TARGETS) {
-		bond_for_each_slave(bond, slave, iter)
+		bond_for_each_slave(bond, slave, iter) {
 			slave->target_last_arp_rx[slot] = last_rx;
+			slave_set_ns_maddr(bond, slave, target, &targets[slot]);
+		}
 		targets[slot] = *target;
 	}
 }
@@ -1280,15 +1345,30 @@
 {
 	return -EPERM;
 }
+
+static void slave_set_ns_maddrs(struct bonding *bond, struct slave *slave, bool add) {}
+
+void bond_slave_ns_maddrs_add(struct bonding *bond, struct slave *slave) {}
+
+void bond_slave_ns_maddrs_del(struct bonding *bond, struct slave *slave) {}
 #endif
 
 static int bond_option_arp_validate_set(struct bonding *bond,
 					const struct bond_opt_value *newval)
 {
+	bool changed = !!bond->params.arp_validate != !!newval->value;
+	struct list_head *iter;
+	struct slave *slave;
+
 	netdev_dbg(bond->dev, "Setting arp_validate to %s (%llu)\n",
 		   newval->string, newval->value);
 	bond->params.arp_validate = newval->value;
 
+	if (changed) {
+		bond_for_each_slave(bond, slave, iter)
+			slave_set_ns_maddrs(bond, slave, !!bond->params.arp_validate);
+	}
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/can/c_can/c_can_main.c
+++ linux-qcom-6.8.0/drivers/net/can/c_can/c_can_main.c
@@ -1011,47 +1011,60 @@
 
 	/* common for all type of bus errors */
 	priv->can.can_stats.bus_error++;
-	stats->rx_errors++;
 
 	/* propagate the error condition to the CAN stack */
 	skb = alloc_can_err_skb(dev, &cf);
-	if (unlikely(!skb))
-		return 0;
 
 	/* check for 'last error code' which tells us the
 	 * type of the last error to occur on the CAN bus
 	 */
-	cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
+	if (likely(skb))
+		cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
 
 	switch (lec_type) {
 	case LEC_STUFF_ERROR:
 		netdev_dbg(dev, "stuff error\n");
-		cf->data[2] |= CAN_ERR_PROT_STUFF;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_STUFF;
+		stats->rx_errors++;
 		break;
 	case LEC_FORM_ERROR:
 		netdev_dbg(dev, "form error\n");
-		cf->data[2] |= CAN_ERR_PROT_FORM;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_FORM;
+		stats->rx_errors++;
 		break;
 	case LEC_ACK_ERROR:
 		netdev_dbg(dev, "ack error\n");
-		cf->data[3] = CAN_ERR_PROT_LOC_ACK;
+		if (likely(skb))
+			cf->data[3] = CAN_ERR_PROT_LOC_ACK;
+		stats->tx_errors++;
 		break;
 	case LEC_BIT1_ERROR:
 		netdev_dbg(dev, "bit1 error\n");
-		cf->data[2] |= CAN_ERR_PROT_BIT1;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_BIT1;
+		stats->tx_errors++;
 		break;
 	case LEC_BIT0_ERROR:
 		netdev_dbg(dev, "bit0 error\n");
-		cf->data[2] |= CAN_ERR_PROT_BIT0;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_BIT0;
+		stats->tx_errors++;
 		break;
 	case LEC_CRC_ERROR:
 		netdev_dbg(dev, "CRC error\n");
-		cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
+		if (likely(skb))
+			cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
+		stats->rx_errors++;
 		break;
 	default:
 		break;
 	}
 
+	if (unlikely(!skb))
+		return 0;
+
 	netif_receive_skb(skb);
 	return 1;
 }
--- linux-qcom-6.8.0.orig/drivers/net/can/dev/dev.c
+++ linux-qcom-6.8.0/drivers/net/can/dev/dev.c
@@ -471,7 +471,7 @@
 	else
 		set = 0;
 
-	gpiod_set_value(priv->termination_gpio, set);
+	gpiod_set_value_cansleep(priv->termination_gpio, set);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/can/dev/netlink.c
+++ linux-qcom-6.8.0/drivers/net/can/dev/netlink.c
@@ -65,15 +65,6 @@
 	if (!data)
 		return 0;
 
-	if (data[IFLA_CAN_BITTIMING]) {
-		struct can_bittiming bt;
-
-		memcpy(&bt, nla_data(data[IFLA_CAN_BITTIMING]), sizeof(bt));
-		err = can_validate_bittiming(&bt, extack);
-		if (err)
-			return err;
-	}
-
 	if (data[IFLA_CAN_CTRLMODE]) {
 		struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]);
 		u32 tdc_flags = cm->flags & CAN_CTRLMODE_TDC_MASK;
@@ -114,6 +105,15 @@
 		}
 	}
 
+	if (data[IFLA_CAN_BITTIMING]) {
+		struct can_bittiming bt;
+
+		memcpy(&bt, nla_data(data[IFLA_CAN_BITTIMING]), sizeof(bt));
+		err = can_validate_bittiming(&bt, extack);
+		if (err)
+			return err;
+	}
+
 	if (is_can_fd) {
 		if (!data[IFLA_CAN_BITTIMING] || !data[IFLA_CAN_DATA_BITTIMING])
 			return -EOPNOTSUPP;
@@ -195,48 +195,6 @@
 	/* We need synchronization with dev->stop() */
 	ASSERT_RTNL();
 
-	if (data[IFLA_CAN_BITTIMING]) {
-		struct can_bittiming bt;
-
-		/* Do not allow changing bittiming while running */
-		if (dev->flags & IFF_UP)
-			return -EBUSY;
-
-		/* Calculate bittiming parameters based on
-		 * bittiming_const if set, otherwise pass bitrate
-		 * directly via do_set_bitrate(). Bail out if neither
-		 * is given.
-		 */
-		if (!priv->bittiming_const && !priv->do_set_bittiming &&
-		    !priv->bitrate_const)
-			return -EOPNOTSUPP;
-
-		memcpy(&bt, nla_data(data[IFLA_CAN_BITTIMING]), sizeof(bt));
-		err = can_get_bittiming(dev, &bt,
-					priv->bittiming_const,
-					priv->bitrate_const,
-					priv->bitrate_const_cnt,
-					extack);
-		if (err)
-			return err;
-
-		if (priv->bitrate_max && bt.bitrate > priv->bitrate_max) {
-			NL_SET_ERR_MSG_FMT(extack,
-					   "arbitration bitrate %u bps surpasses transceiver capabilities of %u bps",
-					   bt.bitrate, priv->bitrate_max);
-			return -EINVAL;
-		}
-
-		memcpy(&priv->bittiming, &bt, sizeof(bt));
-
-		if (priv->do_set_bittiming) {
-			/* Finally, set the bit-timing registers */
-			err = priv->do_set_bittiming(dev);
-			if (err)
-				return err;
-		}
-	}
-
 	if (data[IFLA_CAN_CTRLMODE]) {
 		struct can_ctrlmode *cm;
 		u32 ctrlstatic;
@@ -284,6 +242,48 @@
 			priv->ctrlmode &= cm->flags | ~CAN_CTRLMODE_TDC_MASK;
 	}
 
+	if (data[IFLA_CAN_BITTIMING]) {
+		struct can_bittiming bt;
+
+		/* Do not allow changing bittiming while running */
+		if (dev->flags & IFF_UP)
+			return -EBUSY;
+
+		/* Calculate bittiming parameters based on
+		 * bittiming_const if set, otherwise pass bitrate
+		 * directly via do_set_bitrate(). Bail out if neither
+		 * is given.
+		 */
+		if (!priv->bittiming_const && !priv->do_set_bittiming &&
+		    !priv->bitrate_const)
+			return -EOPNOTSUPP;
+
+		memcpy(&bt, nla_data(data[IFLA_CAN_BITTIMING]), sizeof(bt));
+		err = can_get_bittiming(dev, &bt,
+					priv->bittiming_const,
+					priv->bitrate_const,
+					priv->bitrate_const_cnt,
+					extack);
+		if (err)
+			return err;
+
+		if (priv->bitrate_max && bt.bitrate > priv->bitrate_max) {
+			NL_SET_ERR_MSG_FMT(extack,
+					   "arbitration bitrate %u bps surpasses transceiver capabilities of %u bps",
+					   bt.bitrate, priv->bitrate_max);
+			return -EINVAL;
+		}
+
+		memcpy(&priv->bittiming, &bt, sizeof(bt));
+
+		if (priv->do_set_bittiming) {
+			/* Finally, set the bit-timing registers */
+			err = priv->do_set_bittiming(dev);
+			if (err)
+				return err;
+		}
+	}
+
 	if (data[IFLA_CAN_RESTART_MS]) {
 		/* Do not allow changing restart delay while running */
 		if (dev->flags & IFF_UP)
--- linux-qcom-6.8.0.orig/drivers/net/can/ifi_canfd/ifi_canfd.c
+++ linux-qcom-6.8.0/drivers/net/can/ifi_canfd/ifi_canfd.c
@@ -390,36 +390,55 @@
 		return 0;
 
 	priv->can.can_stats.bus_error++;
-	stats->rx_errors++;
 
 	/* Propagate the error condition to the CAN stack. */
 	skb = alloc_can_err_skb(ndev, &cf);
-	if (unlikely(!skb))
-		return 0;
 
 	/* Read the error counter register and check for new errors. */
-	cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
-
-	if (errctr & IFI_CANFD_ERROR_CTR_OVERLOAD_FIRST)
-		cf->data[2] |= CAN_ERR_PROT_OVERLOAD;
-
-	if (errctr & IFI_CANFD_ERROR_CTR_ACK_ERROR_FIRST)
-		cf->data[3] = CAN_ERR_PROT_LOC_ACK;
-
-	if (errctr & IFI_CANFD_ERROR_CTR_BIT0_ERROR_FIRST)
-		cf->data[2] |= CAN_ERR_PROT_BIT0;
-
-	if (errctr & IFI_CANFD_ERROR_CTR_BIT1_ERROR_FIRST)
-		cf->data[2] |= CAN_ERR_PROT_BIT1;
+	if (likely(skb))
+		cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
 
-	if (errctr & IFI_CANFD_ERROR_CTR_STUFF_ERROR_FIRST)
-		cf->data[2] |= CAN_ERR_PROT_STUFF;
-
-	if (errctr & IFI_CANFD_ERROR_CTR_CRC_ERROR_FIRST)
-		cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
-
-	if (errctr & IFI_CANFD_ERROR_CTR_FORM_ERROR_FIRST)
-		cf->data[2] |= CAN_ERR_PROT_FORM;
+	if (errctr & IFI_CANFD_ERROR_CTR_OVERLOAD_FIRST) {
+		stats->rx_errors++;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_OVERLOAD;
+	}
+
+	if (errctr & IFI_CANFD_ERROR_CTR_ACK_ERROR_FIRST) {
+		stats->tx_errors++;
+		if (likely(skb))
+			cf->data[3] = CAN_ERR_PROT_LOC_ACK;
+	}
+
+	if (errctr & IFI_CANFD_ERROR_CTR_BIT0_ERROR_FIRST) {
+		stats->tx_errors++;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_BIT0;
+	}
+
+	if (errctr & IFI_CANFD_ERROR_CTR_BIT1_ERROR_FIRST) {
+		stats->tx_errors++;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_BIT1;
+	}
+
+	if (errctr & IFI_CANFD_ERROR_CTR_STUFF_ERROR_FIRST) {
+		stats->rx_errors++;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_STUFF;
+	}
+
+	if (errctr & IFI_CANFD_ERROR_CTR_CRC_ERROR_FIRST) {
+		stats->rx_errors++;
+		if (likely(skb))
+			cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
+	}
+
+	if (errctr & IFI_CANFD_ERROR_CTR_FORM_ERROR_FIRST) {
+		stats->rx_errors++;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_FORM;
+	}
 
 	/* Reset the error counter, ack the IRQ and re-enable the counter. */
 	writel(IFI_CANFD_ERROR_CTR_ER_RESET, priv->base + IFI_CANFD_ERROR_CTR);
@@ -427,6 +446,9 @@
 	       priv->base + IFI_CANFD_INTERRUPT);
 	writel(IFI_CANFD_ERROR_CTR_ER_ENABLE, priv->base + IFI_CANFD_ERROR_CTR);
 
+	if (unlikely(!skb))
+		return 0;
+
 	netif_receive_skb(skb);
 
 	return 1;
--- linux-qcom-6.8.0.orig/drivers/net/can/kvaser_pciefd.c
+++ linux-qcom-6.8.0/drivers/net/can/kvaser_pciefd.c
@@ -1580,23 +1580,15 @@
 	return res;
 }
 
-static void kvaser_pciefd_receive_irq(struct kvaser_pciefd *pcie)
+static u32 kvaser_pciefd_receive_irq(struct kvaser_pciefd *pcie)
 {
 	u32 irq = ioread32(KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_IRQ_REG);
 
-	if (irq & KVASER_PCIEFD_SRB_IRQ_DPD0) {
+	if (irq & KVASER_PCIEFD_SRB_IRQ_DPD0)
 		kvaser_pciefd_read_buffer(pcie, 0);
-		/* Reset DMA buffer 0 */
-		iowrite32(KVASER_PCIEFD_SRB_CMD_RDB0,
-			  KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_CMD_REG);
-	}
 
-	if (irq & KVASER_PCIEFD_SRB_IRQ_DPD1) {
+	if (irq & KVASER_PCIEFD_SRB_IRQ_DPD1)
 		kvaser_pciefd_read_buffer(pcie, 1);
-		/* Reset DMA buffer 1 */
-		iowrite32(KVASER_PCIEFD_SRB_CMD_RDB1,
-			  KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_CMD_REG);
-	}
 
 	if (irq & KVASER_PCIEFD_SRB_IRQ_DOF0 ||
 	    irq & KVASER_PCIEFD_SRB_IRQ_DOF1 ||
@@ -1605,6 +1597,7 @@
 		dev_err(&pcie->pci->dev, "DMA IRQ error 0x%08X\n", irq);
 
 	iowrite32(irq, KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_IRQ_REG);
+	return irq;
 }
 
 static void kvaser_pciefd_transmit_irq(struct kvaser_pciefd_can *can)
@@ -1631,27 +1624,31 @@
 {
 	struct kvaser_pciefd *pcie = (struct kvaser_pciefd *)dev;
 	const struct kvaser_pciefd_irq_mask *irq_mask = pcie->driver_data->irq_mask;
-	u32 board_irq = ioread32(KVASER_PCIEFD_PCI_IRQ_ADDR(pcie));
+	u32 pci_irq = ioread32(KVASER_PCIEFD_PCI_IRQ_ADDR(pcie));
+	u32 srb_irq = 0;
+	u32 srb_release = 0;
 	int i;
 
-	if (!(board_irq & irq_mask->all))
+	if (!(pci_irq & irq_mask->all))
 		return IRQ_NONE;
 
-	if (board_irq & irq_mask->kcan_rx0)
-		kvaser_pciefd_receive_irq(pcie);
+	if (pci_irq & irq_mask->kcan_rx0)
+		srb_irq = kvaser_pciefd_receive_irq(pcie);
 
 	for (i = 0; i < pcie->nr_channels; i++) {
-		if (!pcie->can[i]) {
-			dev_err(&pcie->pci->dev,
-				"IRQ mask points to unallocated controller\n");
-			break;
-		}
-
-		/* Check that mask matches channel (i) IRQ mask */
-		if (board_irq & irq_mask->kcan_tx[i])
+		if (pci_irq & irq_mask->kcan_tx[i])
 			kvaser_pciefd_transmit_irq(pcie->can[i]);
 	}
 
+	if (srb_irq & KVASER_PCIEFD_SRB_IRQ_DPD0)
+		srb_release |= KVASER_PCIEFD_SRB_CMD_RDB0;
+
+	if (srb_irq & KVASER_PCIEFD_SRB_IRQ_DPD1)
+		srb_release |= KVASER_PCIEFD_SRB_CMD_RDB1;
+
+	if (srb_release)
+		iowrite32(srb_release, KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_CMD_REG);
+
 	return IRQ_HANDLED;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/can/m_can/m_can.c
+++ linux-qcom-6.8.0/drivers/net/can/m_can/m_can.c
@@ -418,6 +418,13 @@
 
 static inline void m_can_enable_all_interrupts(struct m_can_classdev *cdev)
 {
+	if (!cdev->net->irq) {
+		dev_dbg(cdev->dev, "Start hrtimer\n");
+		hrtimer_start(&cdev->hrtimer,
+			      ms_to_ktime(HRTIMER_POLL_INTERVAL_MS),
+			      HRTIMER_MODE_REL_PINNED);
+	}
+
 	/* Only interrupt line 0 is used in this driver */
 	m_can_write(cdev, M_CAN_ILE, ILE_EINT0);
 }
@@ -425,6 +432,11 @@
 static inline void m_can_disable_all_interrupts(struct m_can_classdev *cdev)
 {
 	m_can_write(cdev, M_CAN_ILE, 0x0);
+
+	if (!cdev->net->irq) {
+		dev_dbg(cdev->dev, "Stop hrtimer\n");
+		hrtimer_try_to_cancel(&cdev->hrtimer);
+	}
 }
 
 /* Retrieve internal timestamp counter from TSCV.TSC, and shift it to 32-bit
@@ -624,47 +636,60 @@
 	u32 timestamp = 0;
 
 	cdev->can.can_stats.bus_error++;
-	stats->rx_errors++;
 
 	/* propagate the error condition to the CAN stack */
 	skb = alloc_can_err_skb(dev, &cf);
-	if (unlikely(!skb))
-		return 0;
 
 	/* check for 'last error code' which tells us the
 	 * type of the last error to occur on the CAN bus
 	 */
-	cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
+	if (likely(skb))
+		cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
 
 	switch (lec_type) {
 	case LEC_STUFF_ERROR:
 		netdev_dbg(dev, "stuff error\n");
-		cf->data[2] |= CAN_ERR_PROT_STUFF;
+		stats->rx_errors++;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_STUFF;
 		break;
 	case LEC_FORM_ERROR:
 		netdev_dbg(dev, "form error\n");
-		cf->data[2] |= CAN_ERR_PROT_FORM;
+		stats->rx_errors++;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_FORM;
 		break;
 	case LEC_ACK_ERROR:
 		netdev_dbg(dev, "ack error\n");
-		cf->data[3] = CAN_ERR_PROT_LOC_ACK;
+		stats->tx_errors++;
+		if (likely(skb))
+			cf->data[3] = CAN_ERR_PROT_LOC_ACK;
 		break;
 	case LEC_BIT1_ERROR:
 		netdev_dbg(dev, "bit1 error\n");
-		cf->data[2] |= CAN_ERR_PROT_BIT1;
+		stats->tx_errors++;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_BIT1;
 		break;
 	case LEC_BIT0_ERROR:
 		netdev_dbg(dev, "bit0 error\n");
-		cf->data[2] |= CAN_ERR_PROT_BIT0;
+		stats->tx_errors++;
+		if (likely(skb))
+			cf->data[2] |= CAN_ERR_PROT_BIT0;
 		break;
 	case LEC_CRC_ERROR:
 		netdev_dbg(dev, "CRC error\n");
-		cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
+		stats->rx_errors++;
+		if (likely(skb))
+			cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
 		break;
 	default:
 		break;
 	}
 
+	if (unlikely(!skb))
+		return 0;
+
 	if (cdev->is_peripheral)
 		timestamp = m_can_get_timestamp(cdev);
 
@@ -965,22 +990,6 @@
 	return work_done;
 }
 
-static int m_can_rx_peripheral(struct net_device *dev, u32 irqstatus)
-{
-	struct m_can_classdev *cdev = netdev_priv(dev);
-	int work_done;
-
-	work_done = m_can_rx_handler(dev, NAPI_POLL_WEIGHT, irqstatus);
-
-	/* Don't re-enable interrupts if the driver had a fatal error
-	 * (e.g., FIFO read failure).
-	 */
-	if (work_done < 0)
-		m_can_disable_all_interrupts(cdev);
-
-	return work_done;
-}
-
 static int m_can_poll(struct napi_struct *napi, int quota)
 {
 	struct net_device *dev = napi->dev;
@@ -1073,21 +1082,38 @@
 	return err;
 }
 
-static irqreturn_t m_can_isr(int irq, void *dev_id)
+/* This interrupt handler is called either from the interrupt thread or a
+ * hrtimer. This has implications like cancelling a timer won't be possible
+ * blocking.
+ */
+static int m_can_interrupt_handler(struct m_can_classdev *cdev)
 {
-	struct net_device *dev = (struct net_device *)dev_id;
-	struct m_can_classdev *cdev = netdev_priv(dev);
-	u32 ir;
+	struct net_device *dev = cdev->net;
+	u32 ir = 0, ir_read;
+	int ret;
 
 	if (pm_runtime_suspended(cdev->dev))
 		return IRQ_NONE;
-	ir = m_can_read(cdev, M_CAN_IR);
+
+	/* The m_can controller signals its interrupt status as a level, but
+	 * depending in the integration the CPU may interpret the signal as
+	 * edge-triggered (for example with m_can_pci). For these
+	 * edge-triggered integrations, we must observe that IR is 0 at least
+	 * once to be sure that the next interrupt will generate an edge.
+	 */
+	while ((ir_read = m_can_read(cdev, M_CAN_IR)) != 0) {
+		ir |= ir_read;
+
+		/* ACK all irqs */
+		m_can_write(cdev, M_CAN_IR, ir);
+
+		if (!cdev->irq_edge_triggered)
+			break;
+	}
+
 	if (!ir)
 		return IRQ_NONE;
 
-	/* ACK all irqs */
-	m_can_write(cdev, M_CAN_IR, ir);
-
 	if (cdev->ops->clear_interrupts)
 		cdev->ops->clear_interrupts(cdev);
 
@@ -1101,8 +1127,10 @@
 		if (!cdev->is_peripheral) {
 			m_can_disable_all_interrupts(cdev);
 			napi_schedule(&cdev->napi);
-		} else if (m_can_rx_peripheral(dev, ir) < 0) {
-			goto out_fail;
+		} else {
+			ret = m_can_rx_handler(dev, NAPI_POLL_WEIGHT, ir);
+			if (ret < 0)
+				return ret;
 		}
 	}
 
@@ -1119,8 +1147,9 @@
 	} else  {
 		if (ir & IR_TEFN) {
 			/* New TX FIFO Element arrived */
-			if (m_can_echo_tx_event(dev) != 0)
-				goto out_fail;
+			ret = m_can_echo_tx_event(dev);
+			if (ret != 0)
+				return ret;
 
 			if (netif_queue_stopped(dev) &&
 			    !m_can_tx_fifo_full(cdev))
@@ -1132,10 +1161,21 @@
 		can_rx_offload_threaded_irq_finish(&cdev->offload);
 
 	return IRQ_HANDLED;
+}
 
-out_fail:
-	m_can_disable_all_interrupts(cdev);
-	return IRQ_HANDLED;
+static irqreturn_t m_can_isr(int irq, void *dev_id)
+{
+	struct net_device *dev = (struct net_device *)dev_id;
+	struct m_can_classdev *cdev = netdev_priv(dev);
+	int ret;
+
+	ret =  m_can_interrupt_handler(cdev);
+	if (ret < 0) {
+		m_can_disable_all_interrupts(cdev);
+		return IRQ_HANDLED;
+	}
+
+	return ret;
 }
 
 static const struct can_bittiming_const m_can_bittiming_const_30X = {
@@ -1417,12 +1457,6 @@
 
 	m_can_enable_all_interrupts(cdev);
 
-	if (!dev->irq) {
-		dev_dbg(cdev->dev, "Start hrtimer\n");
-		hrtimer_start(&cdev->hrtimer, ms_to_ktime(HRTIMER_POLL_INTERVAL_MS),
-			      HRTIMER_MODE_REL_PINNED);
-	}
-
 	return 0;
 }
 
@@ -1577,11 +1611,6 @@
 {
 	struct m_can_classdev *cdev = netdev_priv(dev);
 
-	if (!dev->irq) {
-		dev_dbg(cdev->dev, "Stop hrtimer\n");
-		hrtimer_cancel(&cdev->hrtimer);
-	}
-
 	/* disable all interrupts */
 	m_can_disable_all_interrupts(cdev);
 
@@ -1598,22 +1627,22 @@
 
 	netif_stop_queue(dev);
 
-	if (!cdev->is_peripheral)
-		napi_disable(&cdev->napi);
-
 	m_can_stop(dev);
-	m_can_clk_stop(cdev);
-	free_irq(dev->irq, dev);
+	if (dev->irq)
+		free_irq(dev->irq, dev);
 
 	if (cdev->is_peripheral) {
 		cdev->tx_skb = NULL;
 		destroy_workqueue(cdev->tx_wq);
 		cdev->tx_wq = NULL;
 		can_rx_offload_disable(&cdev->offload);
+	} else {
+		napi_disable(&cdev->napi);
 	}
 
 	close_candev(dev);
 
+	m_can_clk_stop(cdev);
 	phy_power_off(cdev->transceiver);
 
 	return 0;
@@ -1811,8 +1840,17 @@
 {
 	struct m_can_classdev *cdev = container_of(timer, struct
 						   m_can_classdev, hrtimer);
+	int ret;
 
-	m_can_isr(0, cdev->net);
+	if (cdev->can.state == CAN_STATE_BUS_OFF ||
+	    cdev->can.state == CAN_STATE_STOPPED)
+		return HRTIMER_NORESTART;
+
+	ret = m_can_interrupt_handler(cdev);
+
+	/* On error or if napi is scheduled to read, stop the timer */
+	if (ret < 0 || napi_is_scheduled(&cdev->napi))
+		return HRTIMER_NORESTART;
 
 	hrtimer_forward_now(timer, ms_to_ktime(HRTIMER_POLL_INTERVAL_MS));
 
@@ -1841,6 +1879,8 @@
 
 	if (cdev->is_peripheral)
 		can_rx_offload_enable(&cdev->offload);
+	else
+		napi_enable(&cdev->napi);
 
 	/* register interrupt handler */
 	if (cdev->is_peripheral) {
@@ -1870,21 +1910,23 @@
 	/* start the m_can controller */
 	err = m_can_start(dev);
 	if (err)
-		goto exit_irq_fail;
-
-	if (!cdev->is_peripheral)
-		napi_enable(&cdev->napi);
+		goto exit_start_fail;
 
 	netif_start_queue(dev);
 
 	return 0;
 
+exit_start_fail:
+	if (cdev->is_peripheral || dev->irq)
+		free_irq(dev->irq, dev);
 exit_irq_fail:
 	if (cdev->is_peripheral)
 		destroy_workqueue(cdev->tx_wq);
 out_wq_fail:
 	if (cdev->is_peripheral)
 		can_rx_offload_disable(&cdev->offload);
+	else
+		napi_disable(&cdev->napi);
 	close_candev(dev);
 exit_disable_clks:
 	m_can_clk_stop(cdev);
--- linux-qcom-6.8.0.orig/drivers/net/can/m_can/m_can.h
+++ linux-qcom-6.8.0/drivers/net/can/m_can/m_can.h
@@ -91,6 +91,7 @@
 
 	int pm_clock_support;
 	int is_peripheral;
+	bool irq_edge_triggered;
 
 	struct mram_cfg mcfg[MRAM_CFG_NUM];
 
--- linux-qcom-6.8.0.orig/drivers/net/can/m_can/m_can_pci.c
+++ linux-qcom-6.8.0/drivers/net/can/m_can/m_can_pci.c
@@ -126,6 +126,7 @@
 	mcan_class->net->irq = pci_irq_vector(pci, 0);
 	mcan_class->pm_clock_support = 1;
 	mcan_class->can.clock.freq = id->driver_data;
+	mcan_class->irq_edge_triggered = true;
 	mcan_class->ops = &m_can_pci_ops;
 
 	pci_set_drvdata(pci, mcan_class);
--- linux-qcom-6.8.0.orig/drivers/net/can/sja1000/sja1000.c
+++ linux-qcom-6.8.0/drivers/net/can/sja1000/sja1000.c
@@ -416,8 +416,6 @@
 	int ret = 0;
 
 	skb = alloc_can_err_skb(dev, &cf);
-	if (skb == NULL)
-		return -ENOMEM;
 
 	txerr = priv->read_reg(priv, SJA1000_TXERR);
 	rxerr = priv->read_reg(priv, SJA1000_RXERR);
@@ -425,8 +423,11 @@
 	if (isrc & IRQ_DOI) {
 		/* data overrun interrupt */
 		netdev_dbg(dev, "data overrun interrupt\n");
-		cf->can_id |= CAN_ERR_CRTL;
-		cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+		if (skb) {
+			cf->can_id |= CAN_ERR_CRTL;
+			cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+		}
+
 		stats->rx_over_errors++;
 		stats->rx_errors++;
 		sja1000_write_cmdreg(priv, CMD_CDO);	/* clear bit */
@@ -452,7 +453,7 @@
 		else
 			state = CAN_STATE_ERROR_ACTIVE;
 	}
-	if (state != CAN_STATE_BUS_OFF) {
+	if (state != CAN_STATE_BUS_OFF && skb) {
 		cf->can_id |= CAN_ERR_CNT;
 		cf->data[6] = txerr;
 		cf->data[7] = rxerr;
@@ -460,33 +461,38 @@
 	if (isrc & IRQ_BEI) {
 		/* bus error interrupt */
 		priv->can.can_stats.bus_error++;
-		stats->rx_errors++;
 
 		ecc = priv->read_reg(priv, SJA1000_ECC);
+		if (skb) {
+			cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
 
-		cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
+			/* set error type */
+			switch (ecc & ECC_MASK) {
+			case ECC_BIT:
+				cf->data[2] |= CAN_ERR_PROT_BIT;
+				break;
+			case ECC_FORM:
+				cf->data[2] |= CAN_ERR_PROT_FORM;
+				break;
+			case ECC_STUFF:
+				cf->data[2] |= CAN_ERR_PROT_STUFF;
+				break;
+			default:
+				break;
+			}
 
-		/* set error type */
-		switch (ecc & ECC_MASK) {
-		case ECC_BIT:
-			cf->data[2] |= CAN_ERR_PROT_BIT;
-			break;
-		case ECC_FORM:
-			cf->data[2] |= CAN_ERR_PROT_FORM;
-			break;
-		case ECC_STUFF:
-			cf->data[2] |= CAN_ERR_PROT_STUFF;
-			break;
-		default:
-			break;
+			/* set error location */
+			cf->data[3] = ecc & ECC_SEG;
 		}
 
-		/* set error location */
-		cf->data[3] = ecc & ECC_SEG;
-
 		/* Error occurred during transmission? */
-		if ((ecc & ECC_DIR) == 0)
-			cf->data[2] |= CAN_ERR_PROT_TX;
+		if ((ecc & ECC_DIR) == 0) {
+			stats->tx_errors++;
+			if (skb)
+				cf->data[2] |= CAN_ERR_PROT_TX;
+		} else {
+			stats->rx_errors++;
+		}
 	}
 	if (isrc & IRQ_EPI) {
 		/* error passive interrupt */
@@ -502,8 +508,10 @@
 		netdev_dbg(dev, "arbitration lost interrupt\n");
 		alc = priv->read_reg(priv, SJA1000_ALC);
 		priv->can.can_stats.arbitration_lost++;
-		cf->can_id |= CAN_ERR_LOSTARB;
-		cf->data[0] = alc & 0x1f;
+		if (skb) {
+			cf->can_id |= CAN_ERR_LOSTARB;
+			cf->data[0] = alc & 0x1f;
+		}
 	}
 
 	if (state != priv->can.state) {
@@ -516,6 +524,9 @@
 			can_bus_off(dev);
 	}
 
+	if (!skb)
+		return -ENOMEM;
+
 	netif_rx(skb);
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/hi311x.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/hi311x.c
@@ -671,9 +671,9 @@
 			tx_state = txerr >= rxerr ? new_state : 0;
 			rx_state = txerr <= rxerr ? new_state : 0;
 			can_change_state(net, cf, tx_state, rx_state);
-			netif_rx(skb);
 
 			if (new_state == CAN_STATE_BUS_OFF) {
+				netif_rx(skb);
 				can_bus_off(net);
 				if (priv->can.restart_ms == 0) {
 					priv->force_quit = 1;
@@ -684,6 +684,7 @@
 				cf->can_id |= CAN_ERR_CNT;
 				cf->data[6] = txerr;
 				cf->data[7] = rxerr;
+				netif_rx(skb);
 			}
 		}
 
@@ -696,27 +697,38 @@
 			/* Check for protocol errors */
 			if (eflag & HI3110_ERR_PROTOCOL_MASK) {
 				skb = alloc_can_err_skb(net, &cf);
-				if (!skb)
-					break;
+				if (skb)
+					cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
 
-				cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
 				priv->can.can_stats.bus_error++;
-				priv->net->stats.rx_errors++;
-				if (eflag & HI3110_ERR_BITERR)
-					cf->data[2] |= CAN_ERR_PROT_BIT;
-				else if (eflag & HI3110_ERR_FRMERR)
-					cf->data[2] |= CAN_ERR_PROT_FORM;
-				else if (eflag & HI3110_ERR_STUFERR)
-					cf->data[2] |= CAN_ERR_PROT_STUFF;
-				else if (eflag & HI3110_ERR_CRCERR)
-					cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ;
-				else if (eflag & HI3110_ERR_ACKERR)
-					cf->data[3] |= CAN_ERR_PROT_LOC_ACK;
+				if (eflag & HI3110_ERR_BITERR) {
+					priv->net->stats.tx_errors++;
+					if (skb)
+						cf->data[2] |= CAN_ERR_PROT_BIT;
+				} else if (eflag & HI3110_ERR_FRMERR) {
+					priv->net->stats.rx_errors++;
+					if (skb)
+						cf->data[2] |= CAN_ERR_PROT_FORM;
+				} else if (eflag & HI3110_ERR_STUFERR) {
+					priv->net->stats.rx_errors++;
+					if (skb)
+						cf->data[2] |= CAN_ERR_PROT_STUFF;
+				} else if (eflag & HI3110_ERR_CRCERR) {
+					priv->net->stats.rx_errors++;
+					if (skb)
+						cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ;
+				} else if (eflag & HI3110_ERR_ACKERR) {
+					priv->net->stats.tx_errors++;
+					if (skb)
+						cf->data[3] |= CAN_ERR_PROT_LOC_ACK;
+				}
 
-				cf->data[6] = hi3110_read(spi, HI3110_READ_TEC);
-				cf->data[7] = hi3110_read(spi, HI3110_READ_REC);
 				netdev_dbg(priv->net, "Bus Error\n");
-				netif_rx(skb);
+				if (skb) {
+					cf->data[6] = hi3110_read(spi, HI3110_READ_TEC);
+					cf->data[7] = hi3110_read(spi, HI3110_READ_REC);
+					netif_rx(skb);
+				}
 			}
 		}
 
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251x.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251x.c
@@ -753,7 +753,7 @@
 	int ret;
 
 	/* Force wakeup interrupt to wake device, but don't execute IST */
-	disable_irq(spi->irq);
+	disable_irq_nosync(spi->irq);
 	mcp251x_write_2regs(spi, CANINTE, CANINTE_WAKIE, CANINTF_WAKIF);
 
 	/* Wait for oscillator startup timer after wake up */
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
@@ -2,7 +2,7 @@
 //
 // mcp251xfd - Microchip MCP251xFD Family CAN controller driver
 //
-// Copyright (c) 2019, 2020, 2021 Pengutronix,
+// Copyright (c) 2019, 2020, 2021, 2023 Pengutronix,
 //               Marc Kleine-Budde <kernel@pengutronix.de>
 //
 // Based on:
@@ -153,6 +153,21 @@
 	return regulator_disable(priv->reg_vdd);
 }
 
+static int
+mcp251xfd_transceiver_mode(const struct mcp251xfd_priv *priv,
+			   const enum mcp251xfd_xceiver_mode mode)
+{
+	int val;
+
+	if (mode == MCP251XFD_XCVR_NORMAL_MODE)
+		val = MCP251XFD_REG_IOCON_PM0;
+	else if (mode == MCP251XFD_XCVR_STBY_MODE)
+		val = (MCP251XFD_REG_IOCON_TRIS0 | MCP251XFD_REG_IOCON_PM0 |
+		MCP251XFD_REG_IOCON_LAT0);
+
+	return regmap_write(priv->map_reg, MCP251XFD_REG_IOCON, val);
+}
+
 static inline int
 mcp251xfd_transceiver_enable(const struct mcp251xfd_priv *priv)
 {
@@ -744,6 +759,7 @@
 
 	mcp251xfd_chip_interrupts_disable(priv);
 	mcp251xfd_chip_rx_int_disable(priv);
+	mcp251xfd_timestamp_stop(priv);
 	mcp251xfd_chip_sleep(priv);
 }
 
@@ -763,6 +779,8 @@
 	if (err)
 		goto out_chip_stop;
 
+	mcp251xfd_timestamp_start(priv);
+
 	err = mcp251xfd_set_bittiming(priv);
 	if (err)
 		goto out_chip_stop;
@@ -791,7 +809,7 @@
 
 	return 0;
 
- out_chip_stop:
+out_chip_stop:
 	mcp251xfd_dump(priv);
 	mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED);
 
@@ -867,18 +885,18 @@
 
 static struct sk_buff *
 mcp251xfd_alloc_can_err_skb(struct mcp251xfd_priv *priv,
-			    struct can_frame **cf, u32 *timestamp)
+			    struct can_frame **cf, u32 *ts_raw)
 {
 	struct sk_buff *skb;
 	int err;
 
-	err = mcp251xfd_get_timestamp(priv, timestamp);
+	err = mcp251xfd_get_timestamp_raw(priv, ts_raw);
 	if (err)
 		return NULL;
 
 	skb = alloc_can_err_skb(priv->ndev, cf);
 	if (skb)
-		mcp251xfd_skb_set_timestamp(priv, skb, *timestamp);
+		mcp251xfd_skb_set_timestamp_raw(priv, skb, *ts_raw);
 
 	return skb;
 }
@@ -889,7 +907,7 @@
 	struct mcp251xfd_rx_ring *ring;
 	struct sk_buff *skb;
 	struct can_frame *cf;
-	u32 timestamp, rxovif;
+	u32 ts_raw, rxovif;
 	int err, i;
 
 	stats->rx_over_errors++;
@@ -924,14 +942,14 @@
 			return err;
 	}
 
-	skb = mcp251xfd_alloc_can_err_skb(priv, &cf, &timestamp);
+	skb = mcp251xfd_alloc_can_err_skb(priv, &cf, &ts_raw);
 	if (!skb)
 		return 0;
 
 	cf->can_id |= CAN_ERR_CRTL;
 	cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
 
-	err = can_rx_offload_queue_timestamp(&priv->offload, skb, timestamp);
+	err = can_rx_offload_queue_timestamp(&priv->offload, skb, ts_raw);
 	if (err)
 		stats->rx_fifo_errors++;
 
@@ -948,12 +966,12 @@
 static int mcp251xfd_handle_ivmif(struct mcp251xfd_priv *priv)
 {
 	struct net_device_stats *stats = &priv->ndev->stats;
-	u32 bdiag1, timestamp;
+	u32 bdiag1, ts_raw;
 	struct sk_buff *skb;
 	struct can_frame *cf = NULL;
 	int err;
 
-	err = mcp251xfd_get_timestamp(priv, &timestamp);
+	err = mcp251xfd_get_timestamp_raw(priv, &ts_raw);
 	if (err)
 		return err;
 
@@ -1035,8 +1053,8 @@
 	if (!cf)
 		return 0;
 
-	mcp251xfd_skb_set_timestamp(priv, skb, timestamp);
-	err = can_rx_offload_queue_timestamp(&priv->offload, skb, timestamp);
+	mcp251xfd_skb_set_timestamp_raw(priv, skb, ts_raw);
+	err = can_rx_offload_queue_timestamp(&priv->offload, skb, ts_raw);
 	if (err)
 		stats->rx_fifo_errors++;
 
@@ -1049,7 +1067,7 @@
 	struct sk_buff *skb;
 	struct can_frame *cf = NULL;
 	enum can_state new_state, rx_state, tx_state;
-	u32 trec, timestamp;
+	u32 trec, ts_raw;
 	int err;
 
 	err = regmap_read(priv->map_reg, MCP251XFD_REG_TREC, &trec);
@@ -1079,7 +1097,7 @@
 	/* The skb allocation might fail, but can_change_state()
 	 * handles cf == NULL.
 	 */
-	skb = mcp251xfd_alloc_can_err_skb(priv, &cf, &timestamp);
+	skb = mcp251xfd_alloc_can_err_skb(priv, &cf, &ts_raw);
 	can_change_state(priv->ndev, cf, tx_state, rx_state);
 
 	if (new_state == CAN_STATE_BUS_OFF) {
@@ -1110,7 +1128,7 @@
 		cf->data[7] = bec.rxerr;
 	}
 
-	err = can_rx_offload_queue_timestamp(&priv->offload, skb, timestamp);
+	err = can_rx_offload_queue_timestamp(&priv->offload, skb, ts_raw);
 	if (err)
 		stats->rx_fifo_errors++;
 
@@ -1576,7 +1594,7 @@
 		handled = IRQ_HANDLED;
 	} while (1);
 
- out_fail:
+out_fail:
 	can_rx_offload_threaded_irq_finish(&priv->offload);
 
 	netdev_err(priv->ndev, "IRQ handler returned %d (intf=0x%08x).\n",
@@ -1610,19 +1628,33 @@
 	if (err)
 		goto out_mcp251xfd_ring_free;
 
+	mcp251xfd_timestamp_init(priv);
+
 	err = mcp251xfd_chip_start(priv);
 	if (err)
 		goto out_transceiver_disable;
 
-	mcp251xfd_timestamp_init(priv);
+	err = mcp251xfd_transceiver_mode(priv, MCP251XFD_XCVR_NORMAL_MODE);
+	if (err)
+		goto out_transceiver_disable;
+
 	clear_bit(MCP251XFD_FLAGS_DOWN, priv->flags);
 	can_rx_offload_enable(&priv->offload);
 
+	priv->wq = alloc_ordered_workqueue("%s-mcp251xfd_wq",
+					   WQ_FREEZABLE | WQ_MEM_RECLAIM,
+					   dev_name(&spi->dev));
+	if (!priv->wq) {
+		err = -ENOMEM;
+		goto out_can_rx_offload_disable;
+	}
+	INIT_WORK(&priv->tx_work, mcp251xfd_tx_obj_write_sync);
+
 	err = request_threaded_irq(spi->irq, NULL, mcp251xfd_irq,
 				   IRQF_SHARED | IRQF_ONESHOT,
 				   dev_name(&spi->dev), priv);
 	if (err)
-		goto out_can_rx_offload_disable;
+		goto out_destroy_workqueue;
 
 	err = mcp251xfd_chip_interrupts_enable(priv);
 	if (err)
@@ -1632,20 +1664,21 @@
 
 	return 0;
 
- out_free_irq:
+out_free_irq:
 	free_irq(spi->irq, priv);
- out_can_rx_offload_disable:
+out_destroy_workqueue:
+	destroy_workqueue(priv->wq);
+out_can_rx_offload_disable:
 	can_rx_offload_disable(&priv->offload);
 	set_bit(MCP251XFD_FLAGS_DOWN, priv->flags);
-	mcp251xfd_timestamp_stop(priv);
- out_transceiver_disable:
+out_transceiver_disable:
 	mcp251xfd_transceiver_disable(priv);
- out_mcp251xfd_ring_free:
+out_mcp251xfd_ring_free:
 	mcp251xfd_ring_free(priv);
- out_pm_runtime_put:
+out_pm_runtime_put:
 	mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED);
 	pm_runtime_put(ndev->dev.parent);
- out_close_candev:
+out_close_candev:
 	close_candev(ndev);
 
 	return err;
@@ -1653,6 +1686,7 @@
 
 static int mcp251xfd_stop(struct net_device *ndev)
 {
+	int err;
 	struct mcp251xfd_priv *priv = netdev_priv(ndev);
 
 	netif_stop_queue(ndev);
@@ -1661,8 +1695,12 @@
 	hrtimer_cancel(&priv->tx_irq_timer);
 	mcp251xfd_chip_interrupts_disable(priv);
 	free_irq(ndev->irq, priv);
+	destroy_workqueue(priv->wq);
 	can_rx_offload_disable(&priv->offload);
-	mcp251xfd_timestamp_stop(priv);
+
+	err = mcp251xfd_transceiver_mode(priv, MCP251XFD_XCVR_STBY_MODE);
+	if (err)
+		return err;
 	mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED);
 	mcp251xfd_transceiver_disable(priv);
 	mcp251xfd_ring_free(priv);
@@ -1808,9 +1846,9 @@
 	*effective_speed_hz_slow = xfer[0].effective_speed_hz;
 	*effective_speed_hz_fast = xfer[1].effective_speed_hz;
 
- out_kfree_buf_tx:
+out_kfree_buf_tx:
 	kfree(buf_tx);
- out_kfree_buf_rx:
+out_kfree_buf_rx:
 	kfree(buf_rx);
 
 	return err;
@@ -1924,13 +1962,13 @@
 
 	return 0;
 
- out_unregister_candev:
+out_unregister_candev:
 	unregister_candev(ndev);
- out_chip_sleep:
+out_chip_sleep:
 	mcp251xfd_chip_sleep(priv);
- out_runtime_disable:
+out_runtime_disable:
 	pm_runtime_disable(ndev->dev.parent);
- out_runtime_put_noidle:
+out_runtime_put_noidle:
 	pm_runtime_put_noidle(ndev->dev.parent);
 	mcp251xfd_clks_and_vdd_disable(priv);
 
@@ -2150,9 +2188,9 @@
 
 	return 0;
 
- out_can_rx_offload_del:
+out_can_rx_offload_del:
 	can_rx_offload_del(&priv->offload);
- out_free_candev:
+out_free_candev:
 	spi->max_speed_hz = priv->spi_max_speed_hz_orig;
 
 	free_candev(ndev);
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c
@@ -94,7 +94,7 @@
 		kfree(buf);
 	}
 
- out:
+out:
 	mcp251xfd_dump_header(iter, MCP251XFD_DUMP_OBJECT_TYPE_REG, reg);
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd-ram.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd-ram.c
@@ -97,7 +97,16 @@
 	if (ring) {
 		u8 num_rx_coalesce = 0, num_tx_coalesce = 0;
 
-		num_rx = can_ram_rounddown_pow_of_two(config, &config->rx, 0, ring->rx_pending);
+		/* If the ring parameters have been configured in
+		 * CAN-CC mode, but and we are in CAN-FD mode now,
+		 * they might be to big. Use the default CAN-FD values
+		 * in this case.
+		 */
+		num_rx = ring->rx_pending;
+		if (num_rx > layout->max_rx)
+			num_rx = layout->default_rx;
+
+		num_rx = can_ram_rounddown_pow_of_two(config, &config->rx, 0, num_rx);
 
 		/* The ethtool doc says:
 		 * To disable coalescing, set usecs = 0 and max_frames = 1.
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c
@@ -397,7 +397,7 @@
 
 		return err;
 	}
- out:
+out:
 	memcpy(val_buf, buf_rx->data, val_len);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c
@@ -2,7 +2,7 @@
 //
 // mcp251xfd - Microchip MCP251xFD Family CAN controller driver
 //
-// Copyright (c) 2019, 2020, 2021 Pengutronix,
+// Copyright (c) 2019, 2020, 2021, 2024 Pengutronix,
 //               Marc Kleine-Budde <kernel@pengutronix.de>
 //
 // Based on:
@@ -206,6 +206,7 @@
 	int i, j;
 
 	mcp251xfd_for_each_rx_ring(priv, rx_ring, i) {
+		rx_ring->last_valid = timecounter_read(&priv->tc);
 		rx_ring->head = 0;
 		rx_ring->tail = 0;
 		rx_ring->base = *base;
@@ -289,7 +290,7 @@
 	const struct mcp251xfd_rx_ring *rx_ring;
 	u16 base = 0, ram_used;
 	u8 fifo_nr = 1;
-	int i;
+	int err = 0, i;
 
 	netdev_reset_queue(priv->ndev);
 
@@ -385,10 +386,18 @@
 		netdev_err(priv->ndev,
 			   "Error during ring configuration, using more RAM (%u bytes) than available (%u bytes).\n",
 			   ram_used, MCP251XFD_RAM_SIZE);
-		return -ENOMEM;
+		err = -ENOMEM;
+	}
+
+	if (priv->tx_obj_num_coalesce_irq &&
+	    priv->tx_obj_num_coalesce_irq * 2 != priv->tx->obj_num) {
+		netdev_err(priv->ndev,
+			   "Error during ring configuration, number of TEF coalescing buffers (%u) must be half of TEF buffers (%u).\n",
+			   priv->tx_obj_num_coalesce_irq, priv->tx->obj_num);
+		err = -EINVAL;
 	}
 
-	return 0;
+	return err;
 }
 
 void mcp251xfd_ring_free(struct mcp251xfd_priv *priv)
@@ -468,11 +477,27 @@
 
 	/* switching from CAN-2.0 to CAN-FD mode or vice versa */
 	if (fd_mode != test_bit(MCP251XFD_FLAGS_FD_MODE, priv->flags)) {
+		const struct ethtool_ringparam ring = {
+			.rx_pending = priv->rx_obj_num,
+			.tx_pending = priv->tx->obj_num,
+		};
+		const struct ethtool_coalesce ec = {
+			.rx_coalesce_usecs_irq = priv->rx_coalesce_usecs_irq,
+			.rx_max_coalesced_frames_irq = priv->rx_obj_num_coalesce_irq == 0 ?
+				1 : priv->rx_obj_num_coalesce_irq,
+			.tx_coalesce_usecs_irq = priv->tx_coalesce_usecs_irq,
+			.tx_max_coalesced_frames_irq = priv->tx_obj_num_coalesce_irq == 0 ?
+				1 : priv->tx_obj_num_coalesce_irq,
+		};
 		struct can_ram_layout layout;
 
-		can_ram_get_layout(&layout, &mcp251xfd_ram_config, NULL, NULL, fd_mode);
-		priv->rx_obj_num = layout.default_rx;
-		tx_ring->obj_num = layout.default_tx;
+		can_ram_get_layout(&layout, &mcp251xfd_ram_config, &ring, &ec, fd_mode);
+
+		priv->rx_obj_num = layout.cur_rx;
+		priv->rx_obj_num_coalesce_irq = layout.rx_coalesce;
+
+		tx_ring->obj_num = layout.cur_tx;
+		priv->tx_obj_num_coalesce_irq = layout.tx_coalesce;
 	}
 
 	if (fd_mode) {
@@ -485,6 +510,8 @@
 		clear_bit(MCP251XFD_FLAGS_FD_MODE, priv->flags);
 	}
 
+	tx_ring->obj_num_shift_to_u8 = BITS_PER_TYPE(tx_ring->obj_num) -
+		ilog2(tx_ring->obj_num);
 	tx_ring->obj_size = tx_obj_size;
 
 	rem = priv->rx_obj_num;
@@ -507,6 +534,8 @@
 		}
 
 		rx_ring->obj_num = rx_obj_num;
+		rx_ring->obj_num_shift_to_u8 = BITS_PER_TYPE(rx_ring->obj_num_shift_to_u8) -
+			ilog2(rx_obj_num);
 		rx_ring->obj_size = rx_obj_size;
 		priv->rx[i] = rx_ring;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd-rx.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd-rx.c
@@ -2,7 +2,7 @@
 //
 // mcp251xfd - Microchip MCP251xFD Family CAN controller driver
 //
-// Copyright (c) 2019, 2020, 2021 Pengutronix,
+// Copyright (c) 2019, 2020, 2021, 2023 Pengutronix,
 //               Marc Kleine-Budde <kernel@pengutronix.de>
 //
 // Based on:
@@ -16,23 +16,14 @@
 
 #include "mcp251xfd.h"
 
-static inline int
-mcp251xfd_rx_head_get_from_chip(const struct mcp251xfd_priv *priv,
-				const struct mcp251xfd_rx_ring *ring,
-				u8 *rx_head, bool *fifo_empty)
+static inline bool mcp251xfd_rx_fifo_sta_empty(const u32 fifo_sta)
 {
-	u32 fifo_sta;
-	int err;
-
-	err = regmap_read(priv->map_reg, MCP251XFD_REG_FIFOSTA(ring->fifo_nr),
-			  &fifo_sta);
-	if (err)
-		return err;
-
-	*rx_head = FIELD_GET(MCP251XFD_REG_FIFOSTA_FIFOCI_MASK, fifo_sta);
-	*fifo_empty = !(fifo_sta & MCP251XFD_REG_FIFOSTA_TFNRFNIF);
+	return !(fifo_sta & MCP251XFD_REG_FIFOSTA_TFNRFNIF);
+}
 
-	return 0;
+static inline bool mcp251xfd_rx_fifo_sta_full(const u32 fifo_sta)
+{
+	return fifo_sta & MCP251XFD_REG_FIFOSTA_TFERFFIF;
 }
 
 static inline int
@@ -80,29 +71,49 @@
 }
 
 static int
-mcp251xfd_rx_ring_update(const struct mcp251xfd_priv *priv,
-			 struct mcp251xfd_rx_ring *ring)
+mcp251xfd_get_rx_len(const struct mcp251xfd_priv *priv,
+		     const struct mcp251xfd_rx_ring *ring,
+		     u8 *len_p)
 {
-	u32 new_head;
-	u8 chip_rx_head;
-	bool fifo_empty;
+	const u8 shift = ring->obj_num_shift_to_u8;
+	u8 chip_head, tail, len;
+	u32 fifo_sta;
 	int err;
 
-	err = mcp251xfd_rx_head_get_from_chip(priv, ring, &chip_rx_head,
-					      &fifo_empty);
-	if (err || fifo_empty)
+	err = regmap_read(priv->map_reg, MCP251XFD_REG_FIFOSTA(ring->fifo_nr),
+			  &fifo_sta);
+	if (err)
 		return err;
 
-	/* chip_rx_head, is the next RX-Object filled by the HW.
-	 * The new RX head must be >= the old head.
+	if (mcp251xfd_rx_fifo_sta_empty(fifo_sta)) {
+		*len_p = 0;
+		return 0;
+	}
+
+	if (mcp251xfd_rx_fifo_sta_full(fifo_sta)) {
+		*len_p = ring->obj_num;
+		return 0;
+	}
+
+	chip_head = FIELD_GET(MCP251XFD_REG_FIFOSTA_FIFOCI_MASK, fifo_sta);
+
+	err =  mcp251xfd_check_rx_tail(priv, ring);
+	if (err)
+		return err;
+	tail = mcp251xfd_get_rx_tail(ring);
+
+	/* First shift to full u8. The subtraction works on signed
+	 * values, that keeps the difference steady around the u8
+	 * overflow. The right shift acts on len, which is an u8.
 	 */
-	new_head = round_down(ring->head, ring->obj_num) + chip_rx_head;
-	if (new_head <= ring->head)
-		new_head += ring->obj_num;
+	BUILD_BUG_ON(sizeof(ring->obj_num) != sizeof(chip_head));
+	BUILD_BUG_ON(sizeof(ring->obj_num) != sizeof(tail));
+	BUILD_BUG_ON(sizeof(ring->obj_num) != sizeof(len));
 
-	ring->head = new_head;
+	len = (chip_head << shift) - (tail << shift);
+	*len_p = len >> shift;
 
-	return mcp251xfd_check_rx_tail(priv, ring);
+	return 0;
 }
 
 static void
@@ -148,8 +159,6 @@
 
 	if (!(hw_rx_obj->flags & MCP251XFD_OBJ_FLAGS_RTR))
 		memcpy(cfd->data, hw_rx_obj->data, cfd->len);
-
-	mcp251xfd_skb_set_timestamp(priv, skb, hw_rx_obj->ts);
 }
 
 static int
@@ -160,8 +169,26 @@
 	struct net_device_stats *stats = &priv->ndev->stats;
 	struct sk_buff *skb;
 	struct canfd_frame *cfd;
+	u64 timestamp;
 	int err;
 
+	/* According to mcp2518fd erratum DS80000789E 6. the FIFOCI
+	 * bits of a FIFOSTA register, here the RX FIFO head index
+	 * might be corrupted and we might process past the RX FIFO's
+	 * head into old CAN frames.
+	 *
+	 * Compare the timestamp of currently processed CAN frame with
+	 * last valid frame received. Abort with -EBADMSG if an old
+	 * CAN frame is detected.
+	 */
+	timestamp = timecounter_cyc2time(&priv->tc, hw_rx_obj->ts);
+	if (timestamp <= ring->last_valid) {
+		stats->rx_fifo_errors++;
+
+		return -EBADMSG;
+	}
+	ring->last_valid = timestamp;
+
 	if (hw_rx_obj->flags & MCP251XFD_OBJ_FLAGS_FDF)
 		skb = alloc_canfd_skb(priv->ndev, &cfd);
 	else
@@ -172,6 +199,7 @@
 		return 0;
 	}
 
+	mcp251xfd_skb_set_timestamp(skb, timestamp);
 	mcp251xfd_hw_rx_obj_to_skb(priv, hw_rx_obj, skb);
 	err = can_rx_offload_queue_timestamp(&priv->offload, skb, hw_rx_obj->ts);
 	if (err)
@@ -198,51 +226,80 @@
 }
 
 static int
+mcp251xfd_handle_rxif_ring_uinc(const struct mcp251xfd_priv *priv,
+				struct mcp251xfd_rx_ring *ring,
+				u8 len)
+{
+	int offset;
+	int err;
+
+	if (!len)
+		return 0;
+
+	ring->head += len;
+
+	/* Increment the RX FIFO tail pointer 'len' times in a
+	 * single SPI message.
+	 *
+	 * Note:
+	 * Calculate offset, so that the SPI transfer ends on
+	 * the last message of the uinc_xfer array, which has
+	 * "cs_change == 0", to properly deactivate the chip
+	 * select.
+	 */
+	offset = ARRAY_SIZE(ring->uinc_xfer) - len;
+	err = spi_sync_transfer(priv->spi,
+				ring->uinc_xfer + offset, len);
+	if (err)
+		return err;
+
+	ring->tail += len;
+
+	return 0;
+}
+
+static int
 mcp251xfd_handle_rxif_ring(struct mcp251xfd_priv *priv,
 			   struct mcp251xfd_rx_ring *ring)
 {
 	struct mcp251xfd_hw_rx_obj_canfd *hw_rx_obj = ring->obj;
-	u8 rx_tail, len;
+	u8 rx_tail, len, l;
 	int err, i;
 
-	err = mcp251xfd_rx_ring_update(priv, ring);
+	err = mcp251xfd_get_rx_len(priv, ring, &len);
 	if (err)
 		return err;
 
-	while ((len = mcp251xfd_get_rx_linear_len(ring))) {
-		int offset;
-
+	while ((l = mcp251xfd_get_rx_linear_len(ring, len))) {
 		rx_tail = mcp251xfd_get_rx_tail(ring);
 
 		err = mcp251xfd_rx_obj_read(priv, ring, hw_rx_obj,
-					    rx_tail, len);
+					    rx_tail, l);
 		if (err)
 			return err;
 
-		for (i = 0; i < len; i++) {
+		for (i = 0; i < l; i++) {
 			err = mcp251xfd_handle_rxif_one(priv, ring,
 							(void *)hw_rx_obj +
 							i * ring->obj_size);
-			if (err)
+
+			/* -EBADMSG means we're affected by mcp2518fd
+			 * erratum DS80000789E 6., i.e. the timestamp
+			 * in the RX object is older that the last
+			 * valid received CAN frame. Don't process any
+			 * further and mark processed frames as good.
+			 */
+			if (err == -EBADMSG)
+				return mcp251xfd_handle_rxif_ring_uinc(priv, ring, i);
+			else if (err)
 				return err;
 		}
 
-		/* Increment the RX FIFO tail pointer 'len' times in a
-		 * single SPI message.
-		 *
-		 * Note:
-		 * Calculate offset, so that the SPI transfer ends on
-		 * the last message of the uinc_xfer array, which has
-		 * "cs_change == 0", to properly deactivate the chip
-		 * select.
-		 */
-		offset = ARRAY_SIZE(ring->uinc_xfer) - len;
-		err = spi_sync_transfer(priv->spi,
-					ring->uinc_xfer + offset, len);
+		err = mcp251xfd_handle_rxif_ring_uinc(priv, ring, l);
 		if (err)
 			return err;
 
-		ring->tail += len;
+		len -= l;
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c
@@ -2,7 +2,7 @@
 //
 // mcp251xfd - Microchip MCP251xFD Family CAN controller driver
 //
-// Copyright (c) 2019, 2020, 2021 Pengutronix,
+// Copyright (c) 2019, 2020, 2021, 2023 Pengutronix,
 //               Marc Kleine-Budde <kernel@pengutronix.de>
 //
 // Based on:
@@ -16,6 +16,16 @@
 
 #include "mcp251xfd.h"
 
+static inline bool mcp251xfd_tx_fifo_sta_empty(u32 fifo_sta)
+{
+	return fifo_sta & MCP251XFD_REG_FIFOSTA_TFERFFIF;
+}
+
+static inline bool mcp251xfd_tx_fifo_sta_less_than_half_full(u32 fifo_sta)
+{
+	return fifo_sta & MCP251XFD_REG_FIFOSTA_TFHRFHIF;
+}
+
 static inline int
 mcp251xfd_tef_tail_get_from_chip(const struct mcp251xfd_priv *priv,
 				 u8 *tef_tail)
@@ -56,60 +66,43 @@
 }
 
 static int
-mcp251xfd_handle_tefif_recover(const struct mcp251xfd_priv *priv, const u32 seq)
-{
-	const struct mcp251xfd_tx_ring *tx_ring = priv->tx;
-	u32 tef_sta;
-	int err;
-
-	err = regmap_read(priv->map_reg, MCP251XFD_REG_TEFSTA, &tef_sta);
-	if (err)
-		return err;
-
-	if (tef_sta & MCP251XFD_REG_TEFSTA_TEFOVIF) {
-		netdev_err(priv->ndev,
-			   "Transmit Event FIFO buffer overflow.\n");
-		return -ENOBUFS;
-	}
-
-	netdev_info(priv->ndev,
-		    "Transmit Event FIFO buffer %s. (seq=0x%08x, tef_tail=0x%08x, tef_head=0x%08x, tx_head=0x%08x).\n",
-		    tef_sta & MCP251XFD_REG_TEFSTA_TEFFIF ?
-		    "full" : tef_sta & MCP251XFD_REG_TEFSTA_TEFNEIF ?
-		    "not empty" : "empty",
-		    seq, priv->tef->tail, priv->tef->head, tx_ring->head);
-
-	/* The Sequence Number in the TEF doesn't match our tef_tail. */
-	return -EAGAIN;
-}
-
-static int
 mcp251xfd_handle_tefif_one(struct mcp251xfd_priv *priv,
 			   const struct mcp251xfd_hw_tef_obj *hw_tef_obj,
 			   unsigned int *frame_len_ptr)
 {
 	struct net_device_stats *stats = &priv->ndev->stats;
+	u32 seq, tef_tail_masked, tef_tail;
 	struct sk_buff *skb;
-	u32 seq, seq_masked, tef_tail_masked, tef_tail;
 
-	seq = FIELD_GET(MCP251XFD_OBJ_FLAGS_SEQ_MCP2518FD_MASK,
+	 /* Use the MCP2517FD mask on the MCP2518FD, too. We only
+	  * compare 7 bits, this is enough to detect old TEF objects.
+	  */
+	seq = FIELD_GET(MCP251XFD_OBJ_FLAGS_SEQ_MCP2517FD_MASK,
 			hw_tef_obj->flags);
-
-	/* Use the MCP2517FD mask on the MCP2518FD, too. We only
-	 * compare 7 bits, this should be enough to detect
-	 * net-yet-completed, i.e. old TEF objects.
-	 */
-	seq_masked = seq &
-		field_mask(MCP251XFD_OBJ_FLAGS_SEQ_MCP2517FD_MASK);
 	tef_tail_masked = priv->tef->tail &
 		field_mask(MCP251XFD_OBJ_FLAGS_SEQ_MCP2517FD_MASK);
-	if (seq_masked != tef_tail_masked)
-		return mcp251xfd_handle_tefif_recover(priv, seq);
+
+	/* According to mcp2518fd erratum DS80000789E 6. the FIFOCI
+	 * bits of a FIFOSTA register, here the TX FIFO tail index
+	 * might be corrupted and we might process past the TEF FIFO's
+	 * head into old CAN frames.
+	 *
+	 * Compare the sequence number of the currently processed CAN
+	 * frame with the expected sequence number. Abort with
+	 * -EBADMSG if an old CAN frame is detected.
+	 */
+	if (seq != tef_tail_masked) {
+		netdev_dbg(priv->ndev, "%s: chip=0x%02x ring=0x%02x\n", __func__,
+			   seq, tef_tail_masked);
+		stats->tx_fifo_errors++;
+
+		return -EBADMSG;
+	}
 
 	tef_tail = mcp251xfd_get_tef_tail(priv);
 	skb = priv->can.echo_skb[tef_tail];
 	if (skb)
-		mcp251xfd_skb_set_timestamp(priv, skb, hw_tef_obj->ts);
+		mcp251xfd_skb_set_timestamp_raw(priv, skb, hw_tef_obj->ts);
 	stats->tx_bytes +=
 		can_rx_offload_get_echo_skb_queue_timestamp(&priv->offload,
 							    tef_tail, hw_tef_obj->ts,
@@ -120,28 +113,70 @@
 	return 0;
 }
 
-static int mcp251xfd_tef_ring_update(struct mcp251xfd_priv *priv)
+static int
+mcp251xfd_get_tef_len(struct mcp251xfd_priv *priv, u8 *len_p)
 {
 	const struct mcp251xfd_tx_ring *tx_ring = priv->tx;
-	unsigned int new_head;
-	u8 chip_tx_tail;
+	const u8 shift = tx_ring->obj_num_shift_to_u8;
+	u8 chip_tx_tail, tail, len;
+	u32 fifo_sta;
 	int err;
 
-	err = mcp251xfd_tx_tail_get_from_chip(priv, &chip_tx_tail);
+	err = regmap_read(priv->map_reg, MCP251XFD_REG_FIFOSTA(priv->tx->fifo_nr),
+			  &fifo_sta);
 	if (err)
 		return err;
 
-	/* chip_tx_tail, is the next TX-Object send by the HW.
-	 * The new TEF head must be >= the old head, ...
+	/* If the chip says the TX-FIFO is empty, but there are no TX
+	 * buffers free in the ring, we assume all have been sent.
 	 */
-	new_head = round_down(priv->tef->head, tx_ring->obj_num) + chip_tx_tail;
-	if (new_head <= priv->tef->head)
-		new_head += tx_ring->obj_num;
+	if (mcp251xfd_tx_fifo_sta_empty(fifo_sta) &&
+	    mcp251xfd_get_tx_free(tx_ring) == 0) {
+		*len_p = tx_ring->obj_num;
+		return 0;
+	}
 
-	/* ... but it cannot exceed the TX head. */
-	priv->tef->head = min(new_head, tx_ring->head);
+	chip_tx_tail = FIELD_GET(MCP251XFD_REG_FIFOSTA_FIFOCI_MASK, fifo_sta);
 
-	return mcp251xfd_check_tef_tail(priv);
+	err =  mcp251xfd_check_tef_tail(priv);
+	if (err)
+		return err;
+	tail = mcp251xfd_get_tef_tail(priv);
+
+	/* First shift to full u8. The subtraction works on signed
+	 * values, that keeps the difference steady around the u8
+	 * overflow. The right shift acts on len, which is an u8.
+	 */
+	BUILD_BUG_ON(sizeof(tx_ring->obj_num) != sizeof(chip_tx_tail));
+	BUILD_BUG_ON(sizeof(tx_ring->obj_num) != sizeof(tail));
+	BUILD_BUG_ON(sizeof(tx_ring->obj_num) != sizeof(len));
+
+	len = (chip_tx_tail << shift) - (tail << shift);
+	len >>= shift;
+
+	/* According to mcp2518fd erratum DS80000789E 6. the FIFOCI
+	 * bits of a FIFOSTA register, here the TX-FIFO tail index
+	 * might be corrupted.
+	 *
+	 * However here it seems the bit indicating that the TX-FIFO
+	 * is empty (MCP251XFD_REG_FIFOSTA_TFERFFIF) is not correct
+	 * while the TX-FIFO tail index is.
+	 *
+	 * We assume the TX-FIFO is empty, i.e. all pending CAN frames
+	 * haven been send, if:
+	 * - Chip's head and tail index are equal (len == 0).
+	 * - The TX-FIFO is less than half full.
+	 *   (The TX-FIFO empty case has already been checked at the
+	 *    beginning of this function.)
+	 * - No free buffers in the TX ring.
+	 */
+	if (len == 0 && mcp251xfd_tx_fifo_sta_less_than_half_full(fifo_sta) &&
+	    mcp251xfd_get_tx_free(tx_ring) == 0)
+		len = tx_ring->obj_num;
+
+	*len_p = len;
+
+	return 0;
 }
 
 static inline int
@@ -182,13 +217,12 @@
 	u8 tef_tail, len, l;
 	int err, i;
 
-	err = mcp251xfd_tef_ring_update(priv);
+	err = mcp251xfd_get_tef_len(priv, &len);
 	if (err)
 		return err;
 
 	tef_tail = mcp251xfd_get_tef_tail(priv);
-	len = mcp251xfd_get_tef_len(priv);
-	l = mcp251xfd_get_tef_linear_len(priv);
+	l = mcp251xfd_get_tef_linear_len(priv, len);
 	err = mcp251xfd_tef_obj_read(priv, hw_tef_obj, tef_tail, l);
 	if (err)
 		return err;
@@ -203,12 +237,12 @@
 		unsigned int frame_len = 0;
 
 		err = mcp251xfd_handle_tefif_one(priv, &hw_tef_obj[i], &frame_len);
-		/* -EAGAIN means the Sequence Number in the TEF
-		 * doesn't match our tef_tail. This can happen if we
-		 * read the TEF objects too early. Leave loop let the
-		 * interrupt handler call us again.
+		/* -EBADMSG means we're affected by mcp2518fd erratum
+		 * DS80000789E 6., i.e. the Sequence Number in the TEF
+		 * doesn't match our tef_tail. Don't process any
+		 * further and mark processed frames as good.
 		 */
-		if (err == -EAGAIN)
+		if (err == -EBADMSG)
 			goto out_netif_wake_queue;
 		if (err)
 			return err;
@@ -216,13 +250,15 @@
 		total_frame_len += frame_len;
 	}
 
- out_netif_wake_queue:
+out_netif_wake_queue:
 	len = i;	/* number of handled goods TEFs */
 	if (len) {
 		struct mcp251xfd_tef_ring *ring = priv->tef;
 		struct mcp251xfd_tx_ring *tx_ring = priv->tx;
 		int offset;
 
+		ring->head += len;
+
 		/* Increment the TEF FIFO tail pointer 'len' times in
 		 * a single SPI message.
 		 *
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd-timestamp.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd-timestamp.c
@@ -2,7 +2,7 @@
 //
 // mcp251xfd - Microchip MCP251xFD Family CAN controller driver
 //
-// Copyright (c) 2021 Pengutronix,
+// Copyright (c) 2021, 2023 Pengutronix,
 //               Marc Kleine-Budde <kernel@pengutronix.de>
 //
 
@@ -11,20 +11,20 @@
 
 #include "mcp251xfd.h"
 
-static u64 mcp251xfd_timestamp_read(const struct cyclecounter *cc)
+static u64 mcp251xfd_timestamp_raw_read(const struct cyclecounter *cc)
 {
 	const struct mcp251xfd_priv *priv;
-	u32 timestamp = 0;
+	u32 ts_raw = 0;
 	int err;
 
 	priv = container_of(cc, struct mcp251xfd_priv, cc);
-	err = mcp251xfd_get_timestamp(priv, &timestamp);
+	err = mcp251xfd_get_timestamp_raw(priv, &ts_raw);
 	if (err)
 		netdev_err(priv->ndev,
 			   "Error %d while reading timestamp. HW timestamps may be inaccurate.",
 			   err);
 
-	return timestamp;
+	return ts_raw;
 }
 
 static void mcp251xfd_timestamp_work(struct work_struct *work)
@@ -39,28 +39,21 @@
 			      MCP251XFD_TIMESTAMP_WORK_DELAY_SEC * HZ);
 }
 
-void mcp251xfd_skb_set_timestamp(const struct mcp251xfd_priv *priv,
-				 struct sk_buff *skb, u32 timestamp)
-{
-	struct skb_shared_hwtstamps *hwtstamps = skb_hwtstamps(skb);
-	u64 ns;
-
-	ns = timecounter_cyc2time(&priv->tc, timestamp);
-	hwtstamps->hwtstamp = ns_to_ktime(ns);
-}
-
 void mcp251xfd_timestamp_init(struct mcp251xfd_priv *priv)
 {
 	struct cyclecounter *cc = &priv->cc;
 
-	cc->read = mcp251xfd_timestamp_read;
+	cc->read = mcp251xfd_timestamp_raw_read;
 	cc->mask = CYCLECOUNTER_MASK(32);
 	cc->shift = 1;
 	cc->mult = clocksource_hz2mult(priv->can.clock.freq, cc->shift);
 
-	timecounter_init(&priv->tc, &priv->cc, ktime_get_real_ns());
-
 	INIT_DELAYED_WORK(&priv->timestamp, mcp251xfd_timestamp_work);
+}
+
+void mcp251xfd_timestamp_start(struct mcp251xfd_priv *priv)
+{
+	timecounter_init(&priv->tc, &priv->cc, ktime_get_real_ns());
 	schedule_delayed_work(&priv->timestamp,
 			      MCP251XFD_TIMESTAMP_WORK_DELAY_SEC * HZ);
 }
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c
@@ -131,6 +131,39 @@
 	tx_obj->xfer[0].len = len;
 }
 
+static void mcp251xfd_tx_failure_drop(const struct mcp251xfd_priv *priv,
+				      struct mcp251xfd_tx_ring *tx_ring,
+				      int err)
+{
+	struct net_device *ndev = priv->ndev;
+	struct net_device_stats *stats = &ndev->stats;
+	unsigned int frame_len = 0;
+	u8 tx_head;
+
+	tx_ring->head--;
+	stats->tx_dropped++;
+	tx_head = mcp251xfd_get_tx_head(tx_ring);
+	can_free_echo_skb(ndev, tx_head, &frame_len);
+	netdev_completed_queue(ndev, 1, frame_len);
+	netif_wake_queue(ndev);
+
+	if (net_ratelimit())
+		netdev_err(priv->ndev, "ERROR in %s: %d\n", __func__, err);
+}
+
+void mcp251xfd_tx_obj_write_sync(struct work_struct *work)
+{
+	struct mcp251xfd_priv *priv = container_of(work, struct mcp251xfd_priv,
+						   tx_work);
+	struct mcp251xfd_tx_obj *tx_obj = priv->tx_work_obj;
+	struct mcp251xfd_tx_ring *tx_ring = priv->tx;
+	int err;
+
+	err = spi_sync(priv->spi, &tx_obj->msg);
+	if (err)
+		mcp251xfd_tx_failure_drop(priv, tx_ring, err);
+}
+
 static int mcp251xfd_tx_obj_write(const struct mcp251xfd_priv *priv,
 				  struct mcp251xfd_tx_obj *tx_obj)
 {
@@ -162,6 +195,11 @@
 	return false;
 }
 
+static bool mcp251xfd_work_busy(struct work_struct *work)
+{
+	return work_busy(work);
+}
+
 netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb,
 				 struct net_device *ndev)
 {
@@ -175,7 +213,8 @@
 	if (can_dev_dropped_skb(ndev, skb))
 		return NETDEV_TX_OK;
 
-	if (mcp251xfd_tx_busy(priv, tx_ring))
+	if (mcp251xfd_tx_busy(priv, tx_ring) ||
+	    mcp251xfd_work_busy(&priv->tx_work))
 		return NETDEV_TX_BUSY;
 
 	tx_obj = mcp251xfd_get_tx_obj_next(tx_ring);
@@ -193,13 +232,13 @@
 		netdev_sent_queue(priv->ndev, frame_len);
 
 	err = mcp251xfd_tx_obj_write(priv, tx_obj);
-	if (err)
-		goto out_err;
-
-	return NETDEV_TX_OK;
-
- out_err:
-	netdev_err(priv->ndev, "ERROR in %s: %d\n", __func__, err);
+	if (err == -EBUSY) {
+		netif_stop_queue(ndev);
+		priv->tx_work_obj = tx_obj;
+		queue_work(priv->wq, &priv->tx_work);
+	} else if (err) {
+		mcp251xfd_tx_failure_drop(priv, tx_ring, err);
+	}
 
 	return NETDEV_TX_OK;
 }
--- linux-qcom-6.8.0.orig/drivers/net/can/spi/mcp251xfd/mcp251xfd.h
+++ linux-qcom-6.8.0/drivers/net/can/spi/mcp251xfd/mcp251xfd.h
@@ -2,7 +2,7 @@
  *
  * mcp251xfd - Microchip MCP251xFD Family CAN controller driver
  *
- * Copyright (c) 2019, 2020, 2021 Pengutronix,
+ * Copyright (c) 2019, 2020, 2021, 2023 Pengutronix,
  *               Marc Kleine-Budde <kernel@pengutronix.de>
  * Copyright (c) 2019 Martin Sperl <kernel@martin.sperl.org>
  */
@@ -524,6 +524,7 @@
 
 	/* u8 obj_num equals tx_ring->obj_num */
 	/* u8 obj_size equals sizeof(struct mcp251xfd_hw_tef_obj) */
+	/* u8 obj_num_shift_to_u8 equals tx_ring->obj_num_shift_to_u8 */
 
 	union mcp251xfd_write_reg_buf irq_enable_buf;
 	struct spi_transfer irq_enable_xfer;
@@ -542,6 +543,7 @@
 	u8 nr;
 	u8 fifo_nr;
 	u8 obj_num;
+	u8 obj_num_shift_to_u8;
 	u8 obj_size;
 
 	struct mcp251xfd_tx_obj obj[MCP251XFD_TX_OBJ_NUM_MAX];
@@ -552,10 +554,14 @@
 	unsigned int head;
 	unsigned int tail;
 
+	/* timestamp of the last valid received CAN frame */
+	u64 last_valid;
+
 	u16 base;
 	u8 nr;
 	u8 fifo_nr;
 	u8 obj_num;
+	u8 obj_num_shift_to_u8;
 	u8 obj_size;
 
 	union mcp251xfd_write_reg_buf irq_enable_buf;
@@ -608,6 +614,12 @@
 	__MCP251XFD_FLAGS_SIZE__
 };
 
+enum mcp251xfd_xceiver_mode {
+	MCP251XFD_XCVR_NORMAL_MODE,
+	MCP251XFD_XCVR_STBY_MODE,
+	MCP251XFD_XCVR_MODE_NONE
+};
+
 struct mcp251xfd_priv {
 	struct can_priv can;
 	struct can_rx_offload offload;
@@ -633,6 +645,10 @@
 	struct mcp251xfd_rx_ring *rx[MCP251XFD_FIFO_RX_NUM];
 	struct mcp251xfd_tx_ring tx[MCP251XFD_FIFO_TX_NUM];
 
+	struct workqueue_struct *wq;
+	struct work_struct tx_work;
+	struct mcp251xfd_tx_obj *tx_work_obj;
+
 	DECLARE_BITMAP(flags, __MCP251XFD_FLAGS_SIZE__);
 
 	u8 rx_ring_num;
@@ -805,10 +821,27 @@
 	return data;
 }
 
-static inline int mcp251xfd_get_timestamp(const struct mcp251xfd_priv *priv,
-					  u32 *timestamp)
+static inline int mcp251xfd_get_timestamp_raw(const struct mcp251xfd_priv *priv,
+					      u32 *ts_raw)
+{
+	return regmap_read(priv->map_reg, MCP251XFD_REG_TBC, ts_raw);
+}
+
+static inline void mcp251xfd_skb_set_timestamp(struct sk_buff *skb, u64 ns)
+{
+	struct skb_shared_hwtstamps *hwtstamps = skb_hwtstamps(skb);
+
+	hwtstamps->hwtstamp = ns_to_ktime(ns);
+}
+
+static inline
+void mcp251xfd_skb_set_timestamp_raw(const struct mcp251xfd_priv *priv,
+				     struct sk_buff *skb, u32 ts_raw)
 {
-	return regmap_read(priv->map_reg, MCP251XFD_REG_TBC, timestamp);
+	u64 ns;
+
+	ns = timecounter_cyc2time(&priv->tc, ts_raw);
+	mcp251xfd_skb_set_timestamp(skb, ns);
 }
 
 static inline u16 mcp251xfd_get_tef_obj_addr(u8 n)
@@ -857,17 +890,8 @@
 	return priv->tef->tail & (priv->tx->obj_num - 1);
 }
 
-static inline u8 mcp251xfd_get_tef_len(const struct mcp251xfd_priv *priv)
+static inline u8 mcp251xfd_get_tef_linear_len(const struct mcp251xfd_priv *priv, u8 len)
 {
-	return priv->tef->head - priv->tef->tail;
-}
-
-static inline u8 mcp251xfd_get_tef_linear_len(const struct mcp251xfd_priv *priv)
-{
-	u8 len;
-
-	len = mcp251xfd_get_tef_len(priv);
-
 	return min_t(u8, len, priv->tx->obj_num - mcp251xfd_get_tef_tail(priv));
 }
 
@@ -910,18 +934,9 @@
 	return ring->tail & (ring->obj_num - 1);
 }
 
-static inline u8 mcp251xfd_get_rx_len(const struct mcp251xfd_rx_ring *ring)
-{
-	return ring->head - ring->tail;
-}
-
 static inline u8
-mcp251xfd_get_rx_linear_len(const struct mcp251xfd_rx_ring *ring)
+mcp251xfd_get_rx_linear_len(const struct mcp251xfd_rx_ring *ring, u8 len)
 {
-	u8 len;
-
-	len = mcp251xfd_get_rx_len(ring);
-
 	return min_t(u8, len, ring->obj_num - mcp251xfd_get_rx_tail(ring));
 }
 
@@ -947,11 +962,11 @@
 int mcp251xfd_ring_alloc(struct mcp251xfd_priv *priv);
 int mcp251xfd_handle_rxif(struct mcp251xfd_priv *priv);
 int mcp251xfd_handle_tefif(struct mcp251xfd_priv *priv);
-void mcp251xfd_skb_set_timestamp(const struct mcp251xfd_priv *priv,
-				 struct sk_buff *skb, u32 timestamp);
 void mcp251xfd_timestamp_init(struct mcp251xfd_priv *priv);
+void mcp251xfd_timestamp_start(struct mcp251xfd_priv *priv);
 void mcp251xfd_timestamp_stop(struct mcp251xfd_priv *priv);
 
+void mcp251xfd_tx_obj_write_sync(struct work_struct *work);
 netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb,
 				 struct net_device *ndev);
 
--- linux-qcom-6.8.0.orig/drivers/net/can/sun4i_can.c
+++ linux-qcom-6.8.0/drivers/net/can/sun4i_can.c
@@ -579,11 +579,9 @@
 		/* bus error interrupt */
 		netdev_dbg(dev, "bus error interrupt\n");
 		priv->can.can_stats.bus_error++;
-		stats->rx_errors++;
+		ecc = readl(priv->base + SUN4I_REG_STA_ADDR);
 
 		if (likely(skb)) {
-			ecc = readl(priv->base + SUN4I_REG_STA_ADDR);
-
 			cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
 
 			switch (ecc & SUN4I_STA_MASK_ERR) {
@@ -601,9 +599,15 @@
 					       >> 16;
 				break;
 			}
-			/* error occurred during transmission? */
-			if ((ecc & SUN4I_STA_ERR_DIR) == 0)
+		}
+
+		/* error occurred during transmission? */
+		if ((ecc & SUN4I_STA_ERR_DIR) == 0) {
+			if (likely(skb))
 				cf->data[2] |= CAN_ERR_PROT_TX;
+			stats->tx_errors++;
+		} else {
+			stats->rx_errors++;
 		}
 	}
 	if (isrc & SUN4I_INT_ERR_PASSIVE) {
@@ -629,10 +633,10 @@
 		tx_state = txerr >= rxerr ? state : 0;
 		rx_state = txerr <= rxerr ? state : 0;
 
-		if (likely(skb))
-			can_change_state(dev, cf, tx_state, rx_state);
-		else
-			priv->can.state = state;
+		/* The skb allocation might fail, but can_change_state()
+		 * handles cf == NULL.
+		 */
+		can_change_state(dev, cf, tx_state, rx_state);
 		if (state == CAN_STATE_BUS_OFF)
 			can_bus_off(dev);
 	}
--- linux-qcom-6.8.0.orig/drivers/net/can/usb/ems_usb.c
+++ linux-qcom-6.8.0/drivers/net/can/usb/ems_usb.c
@@ -335,15 +335,14 @@
 	struct net_device_stats *stats = &dev->netdev->stats;
 
 	skb = alloc_can_err_skb(dev->netdev, &cf);
-	if (skb == NULL)
-		return;
 
 	if (msg->type == CPC_MSG_TYPE_CAN_STATE) {
 		u8 state = msg->msg.can_state;
 
 		if (state & SJA1000_SR_BS) {
 			dev->can.state = CAN_STATE_BUS_OFF;
-			cf->can_id |= CAN_ERR_BUSOFF;
+			if (skb)
+				cf->can_id |= CAN_ERR_BUSOFF;
 
 			dev->can.can_stats.bus_off++;
 			can_bus_off(dev->netdev);
@@ -361,44 +360,53 @@
 
 		/* bus error interrupt */
 		dev->can.can_stats.bus_error++;
-		stats->rx_errors++;
 
-		cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
+		if (skb) {
+			cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
 
-		switch (ecc & SJA1000_ECC_MASK) {
-		case SJA1000_ECC_BIT:
-			cf->data[2] |= CAN_ERR_PROT_BIT;
-			break;
-		case SJA1000_ECC_FORM:
-			cf->data[2] |= CAN_ERR_PROT_FORM;
-			break;
-		case SJA1000_ECC_STUFF:
-			cf->data[2] |= CAN_ERR_PROT_STUFF;
-			break;
-		default:
-			cf->data[3] = ecc & SJA1000_ECC_SEG;
-			break;
+			switch (ecc & SJA1000_ECC_MASK) {
+			case SJA1000_ECC_BIT:
+				cf->data[2] |= CAN_ERR_PROT_BIT;
+				break;
+			case SJA1000_ECC_FORM:
+				cf->data[2] |= CAN_ERR_PROT_FORM;
+				break;
+			case SJA1000_ECC_STUFF:
+				cf->data[2] |= CAN_ERR_PROT_STUFF;
+				break;
+			default:
+				cf->data[3] = ecc & SJA1000_ECC_SEG;
+				break;
+			}
 		}
 
 		/* Error occurred during transmission? */
-		if ((ecc & SJA1000_ECC_DIR) == 0)
-			cf->data[2] |= CAN_ERR_PROT_TX;
+		if ((ecc & SJA1000_ECC_DIR) == 0) {
+			stats->tx_errors++;
+			if (skb)
+				cf->data[2] |= CAN_ERR_PROT_TX;
+		} else {
+			stats->rx_errors++;
+		}
 
-		if (dev->can.state == CAN_STATE_ERROR_WARNING ||
-		    dev->can.state == CAN_STATE_ERROR_PASSIVE) {
+		if (skb && (dev->can.state == CAN_STATE_ERROR_WARNING ||
+			    dev->can.state == CAN_STATE_ERROR_PASSIVE)) {
 			cf->can_id |= CAN_ERR_CRTL;
 			cf->data[1] = (txerr > rxerr) ?
 			    CAN_ERR_CRTL_TX_PASSIVE : CAN_ERR_CRTL_RX_PASSIVE;
 		}
 	} else if (msg->type == CPC_MSG_TYPE_OVERRUN) {
-		cf->can_id |= CAN_ERR_CRTL;
-		cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+		if (skb) {
+			cf->can_id |= CAN_ERR_CRTL;
+			cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+		}
 
 		stats->rx_over_errors++;
 		stats->rx_errors++;
 	}
 
-	netif_rx(skb);
+	if (skb)
+		netif_rx(skb);
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/net/can/usb/esd_usb.c
+++ linux-qcom-6.8.0/drivers/net/can/usb/esd_usb.c
@@ -3,7 +3,7 @@
  * CAN driver for esd electronics gmbh CAN-USB/2, CAN-USB/3 and CAN-USB/Micro
  *
  * Copyright (C) 2010-2012 esd electronic system design gmbh, Matthias Fuchs <socketcan@esd.eu>
- * Copyright (C) 2022-2023 esd electronics gmbh, Frank Jungclaus <frank.jungclaus@esd.eu>
+ * Copyright (C) 2022-2024 esd electronics gmbh, Frank Jungclaus <frank.jungclaus@esd.eu>
  */
 
 #include <linux/can.h>
@@ -1116,9 +1116,6 @@
 	if (priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)
 		flags |= ESD_USB_3_BAUDRATE_FLAG_LOM;
 
-	if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES)
-		flags |= ESD_USB_3_BAUDRATE_FLAG_TRS;
-
 	baud_x->nom.brp = cpu_to_le16(nom_bt->brp & (nom_btc->brp_max - 1));
 	baud_x->nom.sjw = cpu_to_le16(nom_bt->sjw & (nom_btc->sjw_max - 1));
 	baud_x->nom.tseg1 = cpu_to_le16((nom_bt->prop_seg + nom_bt->phase_seg1)
@@ -1219,7 +1216,6 @@
 	switch (le16_to_cpu(dev->udev->descriptor.idProduct)) {
 	case ESD_USB_CANUSB3_PRODUCT_ID:
 		priv->can.clock.freq = ESD_USB_3_CAN_CLOCK;
-		priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
 		priv->can.ctrlmode_supported |= CAN_CTRLMODE_FD;
 		priv->can.bittiming_const = &esd_usb_3_nom_bittiming_const;
 		priv->can.data_bittiming_const = &esd_usb_3_data_bittiming_const;
--- linux-qcom-6.8.0.orig/drivers/net/can/usb/f81604.c
+++ linux-qcom-6.8.0/drivers/net/can/usb/f81604.c
@@ -526,7 +526,6 @@
 		netdev_dbg(netdev, "bus error interrupt\n");
 
 		priv->can.can_stats.bus_error++;
-		stats->rx_errors++;
 
 		if (skb) {
 			cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
@@ -548,10 +547,15 @@
 
 			/* set error location */
 			cf->data[3] = data->ecc & F81604_SJA1000_ECC_SEG;
+		}
 
-			/* Error occurred during transmission? */
-			if ((data->ecc & F81604_SJA1000_ECC_DIR) == 0)
+		/* Error occurred during transmission? */
+		if ((data->ecc & F81604_SJA1000_ECC_DIR) == 0) {
+			stats->tx_errors++;
+			if (skb)
 				cf->data[2] |= CAN_ERR_PROT_TX;
+		} else {
+			stats->rx_errors++;
 		}
 
 		set_bit(F81604_CLEAR_ECC, &priv->clear_flags);
--- linux-qcom-6.8.0.orig/drivers/net/can/usb/gs_usb.c
+++ linux-qcom-6.8.0/drivers/net/can/usb/gs_usb.c
@@ -40,8 +40,8 @@
 #define USB_ABE_CANDEBUGGER_FD_VENDOR_ID 0x16d0
 #define USB_ABE_CANDEBUGGER_FD_PRODUCT_ID 0x10b8
 
-#define GS_USB_ENDPOINT_IN 1
-#define GS_USB_ENDPOINT_OUT 2
+#define USB_XYLANTA_SAINT3_VENDOR_ID 0x16d0
+#define USB_XYLANTA_SAINT3_PRODUCT_ID 0x0f30
 
 /* Timestamp 32 bit timer runs at 1 MHz (1 µs tick). Worker accounts
  * for timer overflow (will be after ~71 minutes)
@@ -333,6 +333,9 @@
 
 	unsigned int hf_size_rx;
 	u8 active_channels;
+
+	unsigned int pipe_in;
+	unsigned int pipe_out;
 };
 
 /* 'allocate' a tx context.
@@ -684,7 +687,7 @@
 
 resubmit_urb:
 	usb_fill_bulk_urb(urb, parent->udev,
-			  usb_rcvbulkpipe(parent->udev, GS_USB_ENDPOINT_IN),
+			  parent->pipe_in,
 			  hf, dev->parent->hf_size_rx,
 			  gs_usb_receive_bulk_callback, parent);
 
@@ -816,7 +819,7 @@
 	}
 
 	usb_fill_bulk_urb(urb, dev->udev,
-			  usb_sndbulkpipe(dev->udev, GS_USB_ENDPOINT_OUT),
+			  dev->parent->pipe_out,
 			  hf, dev->hf_size_tx,
 			  gs_usb_xmit_callback, txc);
 
@@ -922,8 +925,7 @@
 			/* fill, anchor, and submit rx urb */
 			usb_fill_bulk_urb(urb,
 					  dev->udev,
-					  usb_rcvbulkpipe(dev->udev,
-							  GS_USB_ENDPOINT_IN),
+					  dev->parent->pipe_in,
 					  buf,
 					  dev->parent->hf_size_rx,
 					  gs_usb_receive_bulk_callback, parent);
@@ -1410,6 +1412,7 @@
 			const struct usb_device_id *id)
 {
 	struct usb_device *udev = interface_to_usbdev(intf);
+	struct usb_endpoint_descriptor *ep_in, *ep_out;
 	struct gs_host_frame *hf;
 	struct gs_usb *parent;
 	struct gs_host_config hconf = {
@@ -1419,6 +1422,13 @@
 	unsigned int icount, i;
 	int rc;
 
+	rc = usb_find_common_endpoints(intf->cur_altsetting,
+				       &ep_in, &ep_out, NULL, NULL);
+	if (rc) {
+		dev_err(&intf->dev, "Required endpoints not found\n");
+		return rc;
+	}
+
 	/* send host config */
 	rc = usb_control_msg_send(udev, 0,
 				  GS_USB_BREQ_HOST_FORMAT,
@@ -1463,6 +1473,10 @@
 	usb_set_intfdata(intf, parent);
 	parent->udev = udev;
 
+	/* store the detected endpoints */
+	parent->pipe_in = usb_rcvbulkpipe(parent->udev, ep_in->bEndpointAddress);
+	parent->pipe_out = usb_sndbulkpipe(parent->udev, ep_out->bEndpointAddress);
+
 	for (i = 0; i < icount; i++) {
 		unsigned int hf_size_rx = 0;
 
@@ -1530,6 +1544,8 @@
 				      USB_CES_CANEXT_FD_PRODUCT_ID, 0) },
 	{ USB_DEVICE_INTERFACE_NUMBER(USB_ABE_CANDEBUGGER_FD_VENDOR_ID,
 				      USB_ABE_CANDEBUGGER_FD_PRODUCT_ID, 0) },
+	{ USB_DEVICE_INTERFACE_NUMBER(USB_XYLANTA_SAINT3_VENDOR_ID,
+				      USB_XYLANTA_SAINT3_PRODUCT_ID, 0) },
 	{} /* Terminating entry */
 };
 
--- linux-qcom-6.8.0.orig/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+++ linux-qcom-6.8.0/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
@@ -124,6 +124,7 @@
 
 static const struct kvaser_usb_driver_info kvaser_usb_driver_info_leafimx = {
 	.quirks = 0,
+	.family = KVASER_LEAF,
 	.ops = &kvaser_usb_leaf_dev_ops,
 };
 
@@ -291,7 +292,7 @@
 	}
 	usb_free_urb(urb);
 
-	return 0;
+	return err;
 }
 
 int kvaser_usb_can_rx_over_error(struct net_device *netdev)
--- linux-qcom-6.8.0.orig/drivers/net/dsa/b53/b53_common.c
+++ linux-qcom-6.8.0/drivers/net/dsa/b53/b53_common.c
@@ -27,6 +27,7 @@
 #include <linux/phylink.h>
 #include <linux/etherdevice.h>
 #include <linux/if_bridge.h>
+#include <linux/if_vlan.h>
 #include <net/dsa.h>
 
 #include "b53_regs.h"
@@ -224,6 +225,9 @@
 
 #define B53_MIBS_58XX_SIZE	ARRAY_SIZE(b53_mibs_58xx)
 
+#define B53_MAX_MTU_25		(1536 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN)
+#define B53_MAX_MTU		(9720 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN)
+
 static int b53_do_vlan_op(struct b53_device *dev, u8 op)
 {
 	unsigned int i;
@@ -2263,17 +2267,25 @@
 	bool allow_10_100;
 
 	if (is5325(dev) || is5365(dev))
-		return -EOPNOTSUPP;
+		return 0;
+
+	if (!dsa_is_cpu_port(ds, port))
+		return 0;
 
-	enable_jumbo = (mtu >= JMS_MIN_SIZE);
-	allow_10_100 = (dev->chip_id == BCM583XX_DEVICE_ID);
+	enable_jumbo = (mtu > ETH_DATA_LEN);
+	allow_10_100 = !is63xx(dev);
 
 	return b53_set_jumbo(dev, enable_jumbo, allow_10_100);
 }
 
 static int b53_get_max_mtu(struct dsa_switch *ds, int port)
 {
-	return JMS_MAX_SIZE;
+	struct b53_device *dev = ds->priv;
+
+	if (is5325(dev) || is5365(dev))
+		return B53_MAX_MTU_25;
+
+	return B53_MAX_MTU;
 }
 
 static const struct dsa_switch_ops b53_switch_ops = {
--- linux-qcom-6.8.0.orig/drivers/net/dsa/bcm_sf2.c
+++ linux-qcom-6.8.0/drivers/net/dsa/bcm_sf2.c
@@ -675,8 +675,10 @@
 			of_remove_property(child, prop);
 
 		phydev = of_phy_find_device(child);
-		if (phydev)
+		if (phydev) {
 			phy_device_remove(phydev);
+			phy_device_free(phydev);
+		}
 	}
 
 	err = mdiobus_register(priv->user_mii_bus);
--- linux-qcom-6.8.0.orig/drivers/net/dsa/lan9303-core.c
+++ linux-qcom-6.8.0/drivers/net/dsa/lan9303-core.c
@@ -6,6 +6,7 @@
 #include <linux/module.h>
 #include <linux/gpio/consumer.h>
 #include <linux/regmap.h>
+#include <linux/iopoll.h>
 #include <linux/mutex.h>
 #include <linux/mii.h>
 #include <linux/of.h>
@@ -839,6 +840,8 @@
 	if (!chip->reset_gpio)
 		return;
 
+	gpiod_set_value_cansleep(chip->reset_gpio, 1);
+
 	if (chip->reset_duration != 0)
 		msleep(chip->reset_duration);
 
@@ -864,8 +867,34 @@
 static int lan9303_check_device(struct lan9303 *chip)
 {
 	int ret;
+	int err;
 	u32 reg;
 
+	/* In I2C-managed configurations this polling loop will clash with
+	 * switch's reading of EEPROM right after reset and this behaviour is
+	 * not configurable. While lan9303_read() already has quite long retry
+	 * timeout, seems not all cases are being detected as arbitration error.
+	 *
+	 * According to datasheet, EEPROM loader has 30ms timeout (in case of
+	 * missing EEPROM).
+	 *
+	 * Loading of the largest supported EEPROM is expected to take at least
+	 * 5.9s.
+	 */
+	err = read_poll_timeout(lan9303_read, ret,
+				!ret && reg & LAN9303_HW_CFG_READY,
+				20000, 6000000, false,
+				chip->regmap, LAN9303_HW_CFG, &reg);
+	if (ret) {
+		dev_err(chip->dev, "failed to read HW_CFG reg: %pe\n",
+			ERR_PTR(ret));
+		return ret;
+	}
+	if (err) {
+		dev_err(chip->dev, "HW_CFG not ready: 0x%08x\n", reg);
+		return err;
+	}
+
 	ret = lan9303_read(chip->regmap, LAN9303_CHIP_REV, &reg);
 	if (ret) {
 		dev_err(chip->dev, "failed to read chip revision register: %d\n",
@@ -1048,31 +1077,31 @@
 	return ARRAY_SIZE(lan9303_mib);
 }
 
-static int lan9303_phy_read(struct dsa_switch *ds, int phy, int regnum)
+static int lan9303_phy_read(struct dsa_switch *ds, int port, int regnum)
 {
 	struct lan9303 *chip = ds->priv;
 	int phy_base = chip->phy_addr_base;
 
-	if (phy == phy_base)
+	if (port == 0)
 		return lan9303_virt_phy_reg_read(chip, regnum);
-	if (phy > phy_base + 2)
+	if (port > 2)
 		return -ENODEV;
 
-	return chip->ops->phy_read(chip, phy, regnum);
+	return chip->ops->phy_read(chip, phy_base + port, regnum);
 }
 
-static int lan9303_phy_write(struct dsa_switch *ds, int phy, int regnum,
+static int lan9303_phy_write(struct dsa_switch *ds, int port, int regnum,
 			     u16 val)
 {
 	struct lan9303 *chip = ds->priv;
 	int phy_base = chip->phy_addr_base;
 
-	if (phy == phy_base)
+	if (port == 0)
 		return lan9303_virt_phy_reg_write(chip, regnum, val);
-	if (phy > phy_base + 2)
+	if (port > 2)
 		return -ENODEV;
 
-	return chip->ops->phy_write(chip, phy, regnum, val);
+	return chip->ops->phy_write(chip, phy_base + port, regnum, val);
 }
 
 static int lan9303_port_enable(struct dsa_switch *ds, int port,
@@ -1100,7 +1129,7 @@
 	vlan_vid_del(dsa_port_to_conduit(dp), htons(ETH_P_8021Q), port);
 
 	lan9303_disable_processing_port(chip, port);
-	lan9303_phy_write(ds, chip->phy_addr_base + port, MII_BMCR, BMCR_PDOWN);
+	lan9303_phy_write(ds, port, MII_BMCR, BMCR_PDOWN);
 }
 
 static int lan9303_port_bridge_join(struct dsa_switch *ds, int port,
@@ -1355,8 +1384,6 @@
 
 static int lan9303_register_switch(struct lan9303 *chip)
 {
-	int base;
-
 	chip->ds = devm_kzalloc(chip->dev, sizeof(*chip->ds), GFP_KERNEL);
 	if (!chip->ds)
 		return -ENOMEM;
@@ -1365,8 +1392,7 @@
 	chip->ds->num_ports = LAN9303_NUM_PORTS;
 	chip->ds->priv = chip;
 	chip->ds->ops = &lan9303_switch_ops;
-	base = chip->phy_addr_base;
-	chip->ds->phys_mii_mask = GENMASK(LAN9303_NUM_PORTS - 1 + base, base);
+	chip->ds->phys_mii_mask = GENMASK(LAN9303_NUM_PORTS - 1, 0);
 
 	return dsa_register_switch(chip->ds);
 }
--- linux-qcom-6.8.0.orig/drivers/net/dsa/microchip/ksz9477.c
+++ linux-qcom-6.8.0/drivers/net/dsa/microchip/ksz9477.c
@@ -2,7 +2,7 @@
 /*
  * Microchip KSZ9477 switch driver main logic
  *
- * Copyright (C) 2017-2019 Microchip Technology Inc.
+ * Copyright (C) 2017-2024 Microchip Technology Inc.
  */
 
 #include <linux/kernel.h>
@@ -355,10 +355,8 @@
 			   SPI_AUTO_EDGE_DETECTION, 0);
 
 	/* default configuration */
-	ksz_read8(dev, REG_SW_LUE_CTRL_1, &data8);
-	data8 = SW_AGING_ENABLE | SW_LINK_AUTO_AGING |
-	      SW_SRC_ADDR_FILTER | SW_FLUSH_STP_TABLE | SW_FLUSH_MSTP_TABLE;
-	ksz_write8(dev, REG_SW_LUE_CTRL_1, data8);
+	ksz_write8(dev, REG_SW_LUE_CTRL_1,
+		   SW_AGING_ENABLE | SW_LINK_AUTO_AGING | SW_SRC_ADDR_FILTER);
 
 	/* disable interrupts */
 	ksz_write32(dev, REG_SW_INT_MASK__4, SWITCH_INT_MASK);
@@ -1099,26 +1097,51 @@
 int ksz9477_set_ageing_time(struct ksz_device *dev, unsigned int msecs)
 {
 	u32 secs = msecs / 1000;
-	u8 value;
-	u8 data;
+	u8 data, mult, value;
+	u32 max_val;
 	int ret;
 
-	value = FIELD_GET(SW_AGE_PERIOD_7_0_M, secs);
+#define MAX_TIMER_VAL	((1 << 8) - 1)
 
-	ret = ksz_write8(dev, REG_SW_LUE_CTRL_3, value);
-	if (ret < 0)
-		return ret;
+	/* The aging timer comprises a 3-bit multiplier and an 8-bit second
+	 * value.  Either of them cannot be zero.  The maximum timer is then
+	 * 7 * 255 = 1785 seconds.
+	 */
+	if (!secs)
+		secs = 1;
 
-	data = FIELD_GET(SW_AGE_PERIOD_10_8_M, secs);
+	/* Return error if too large. */
+	else if (secs > 7 * MAX_TIMER_VAL)
+		return -EINVAL;
 
 	ret = ksz_read8(dev, REG_SW_LUE_CTRL_0, &value);
 	if (ret < 0)
 		return ret;
 
-	value &= ~SW_AGE_CNT_M;
-	value |= FIELD_PREP(SW_AGE_CNT_M, data);
+	/* Check whether there is need to update the multiplier. */
+	mult = FIELD_GET(SW_AGE_CNT_M, value);
+	max_val = MAX_TIMER_VAL;
+	if (mult > 0) {
+		/* Try to use the same multiplier already in the register as
+		 * the hardware default uses multiplier 4 and 75 seconds for
+		 * 300 seconds.
+		 */
+		max_val = DIV_ROUND_UP(secs, mult);
+		if (max_val > MAX_TIMER_VAL || max_val * mult != secs)
+			max_val = MAX_TIMER_VAL;
+	}
 
-	return ksz_write8(dev, REG_SW_LUE_CTRL_0, value);
+	data = DIV_ROUND_UP(secs, max_val);
+	if (mult != data) {
+		value &= ~SW_AGE_CNT_M;
+		value |= FIELD_PREP(SW_AGE_CNT_M, data);
+		ret = ksz_write8(dev, REG_SW_LUE_CTRL_0, value);
+		if (ret < 0)
+			return ret;
+	}
+
+	value = DIV_ROUND_UP(secs, data);
+	return ksz_write8(dev, REG_SW_LUE_CTRL_3, value);
 }
 
 void ksz9477_port_queue_split(struct ksz_device *dev, int port)
@@ -1305,6 +1328,10 @@
 	/* Enable REG_SW_MTU__2 reg by setting SW_JUMBO_PACKET */
 	ksz_cfg(dev, REG_SW_MAC_CTRL_1, SW_JUMBO_PACKET, true);
 
+	/* Use collision based back pressure mode. */
+	ksz_cfg(dev, REG_SW_MAC_CTRL_1, SW_BACK_PRESSURE,
+		SW_BACK_PRESSURE_COLLISION);
+
 	/* Now we can configure default MTU value */
 	ret = regmap_update_bits(ksz_regmap_16(dev), REG_SW_MTU__2, REG_SW_MTU_MASK,
 				 VLAN_ETH_FRAME_LEN + ETH_FCS_LEN);
--- linux-qcom-6.8.0.orig/drivers/net/dsa/microchip/ksz9477_reg.h
+++ linux-qcom-6.8.0/drivers/net/dsa/microchip/ksz9477_reg.h
@@ -2,7 +2,7 @@
 /*
  * Microchip KSZ9477 register definitions
  *
- * Copyright (C) 2017-2018 Microchip Technology Inc.
+ * Copyright (C) 2017-2024 Microchip Technology Inc.
  */
 
 #ifndef __KSZ9477_REGS_H
@@ -170,8 +170,6 @@
 #define SW_VLAN_ENABLE			BIT(7)
 #define SW_DROP_INVALID_VID		BIT(6)
 #define SW_AGE_CNT_M			GENMASK(5, 3)
-#define SW_AGE_CNT_S			3
-#define SW_AGE_PERIOD_10_8_M		GENMASK(10, 8)
 #define SW_RESV_MCAST_ENABLE		BIT(2)
 #define SW_HASH_OPTION_M		0x03
 #define SW_HASH_OPTION_CRC		1
@@ -247,6 +245,7 @@
 #define REG_SW_MAC_CTRL_1		0x0331
 
 #define SW_BACK_PRESSURE		BIT(5)
+#define SW_BACK_PRESSURE_COLLISION	0
 #define FAIR_FLOW_CTRL			BIT(4)
 #define NO_EXC_COLLISION_DROP		BIT(3)
 #define SW_JUMBO_PACKET			BIT(2)
--- linux-qcom-6.8.0.orig/drivers/net/dsa/microchip/ksz_common.c
+++ linux-qcom-6.8.0/drivers/net/dsa/microchip/ksz_common.c
@@ -966,10 +966,9 @@
 	regmap_reg_range(0x1030, 0x1030),
 	regmap_reg_range(0x1100, 0x1115),
 	regmap_reg_range(0x111a, 0x111f),
-	regmap_reg_range(0x1122, 0x1127),
-	regmap_reg_range(0x112a, 0x112b),
-	regmap_reg_range(0x1136, 0x1139),
-	regmap_reg_range(0x113e, 0x113f),
+	regmap_reg_range(0x1120, 0x112b),
+	regmap_reg_range(0x1134, 0x113b),
+	regmap_reg_range(0x113c, 0x113f),
 	regmap_reg_range(0x1400, 0x1401),
 	regmap_reg_range(0x1403, 0x1403),
 	regmap_reg_range(0x1410, 0x1417),
@@ -996,10 +995,9 @@
 	regmap_reg_range(0x2030, 0x2030),
 	regmap_reg_range(0x2100, 0x2115),
 	regmap_reg_range(0x211a, 0x211f),
-	regmap_reg_range(0x2122, 0x2127),
-	regmap_reg_range(0x212a, 0x212b),
-	regmap_reg_range(0x2136, 0x2139),
-	regmap_reg_range(0x213e, 0x213f),
+	regmap_reg_range(0x2120, 0x212b),
+	regmap_reg_range(0x2134, 0x213b),
+	regmap_reg_range(0x213c, 0x213f),
 	regmap_reg_range(0x2400, 0x2401),
 	regmap_reg_range(0x2403, 0x2403),
 	regmap_reg_range(0x2410, 0x2417),
@@ -1026,10 +1024,9 @@
 	regmap_reg_range(0x3030, 0x3030),
 	regmap_reg_range(0x3100, 0x3115),
 	regmap_reg_range(0x311a, 0x311f),
-	regmap_reg_range(0x3122, 0x3127),
-	regmap_reg_range(0x312a, 0x312b),
-	regmap_reg_range(0x3136, 0x3139),
-	regmap_reg_range(0x313e, 0x313f),
+	regmap_reg_range(0x3120, 0x312b),
+	regmap_reg_range(0x3134, 0x313b),
+	regmap_reg_range(0x313c, 0x313f),
 	regmap_reg_range(0x3400, 0x3401),
 	regmap_reg_range(0x3403, 0x3403),
 	regmap_reg_range(0x3410, 0x3417),
@@ -1056,10 +1053,9 @@
 	regmap_reg_range(0x4030, 0x4030),
 	regmap_reg_range(0x4100, 0x4115),
 	regmap_reg_range(0x411a, 0x411f),
-	regmap_reg_range(0x4122, 0x4127),
-	regmap_reg_range(0x412a, 0x412b),
-	regmap_reg_range(0x4136, 0x4139),
-	regmap_reg_range(0x413e, 0x413f),
+	regmap_reg_range(0x4120, 0x412b),
+	regmap_reg_range(0x4134, 0x413b),
+	regmap_reg_range(0x413c, 0x413f),
 	regmap_reg_range(0x4400, 0x4401),
 	regmap_reg_range(0x4403, 0x4403),
 	regmap_reg_range(0x4410, 0x4417),
@@ -1086,10 +1082,9 @@
 	regmap_reg_range(0x5030, 0x5030),
 	regmap_reg_range(0x5100, 0x5115),
 	regmap_reg_range(0x511a, 0x511f),
-	regmap_reg_range(0x5122, 0x5127),
-	regmap_reg_range(0x512a, 0x512b),
-	regmap_reg_range(0x5136, 0x5139),
-	regmap_reg_range(0x513e, 0x513f),
+	regmap_reg_range(0x5120, 0x512b),
+	regmap_reg_range(0x5134, 0x513b),
+	regmap_reg_range(0x513c, 0x513f),
 	regmap_reg_range(0x5400, 0x5401),
 	regmap_reg_range(0x5403, 0x5403),
 	regmap_reg_range(0x5410, 0x5417),
@@ -1116,10 +1111,9 @@
 	regmap_reg_range(0x6030, 0x6030),
 	regmap_reg_range(0x6100, 0x6115),
 	regmap_reg_range(0x611a, 0x611f),
-	regmap_reg_range(0x6122, 0x6127),
-	regmap_reg_range(0x612a, 0x612b),
-	regmap_reg_range(0x6136, 0x6139),
-	regmap_reg_range(0x613e, 0x613f),
+	regmap_reg_range(0x6120, 0x612b),
+	regmap_reg_range(0x6134, 0x613b),
+	regmap_reg_range(0x613c, 0x613f),
 	regmap_reg_range(0x6300, 0x6301),
 	regmap_reg_range(0x6400, 0x6401),
 	regmap_reg_range(0x6403, 0x6403),
@@ -2055,7 +2049,7 @@
 	struct ksz_device *dev = kirq->dev;
 	int ret;
 
-	ret = ksz_write32(dev, kirq->reg_mask, kirq->masked);
+	ret = ksz_write8(dev, kirq->reg_mask, kirq->masked);
 	if (ret)
 		dev_err(dev->dev, "failed to change IRQ mask\n");
 
@@ -2185,6 +2179,8 @@
 	return ksz_irq_common_setup(dev, pirq);
 }
 
+static int ksz_parse_drive_strength(struct ksz_device *dev);
+
 static int ksz_setup(struct dsa_switch *ds)
 {
 	struct ksz_device *dev = ds->priv;
@@ -2206,6 +2202,10 @@
 		return ret;
 	}
 
+	ret = ksz_parse_drive_strength(dev);
+	if (ret)
+		return ret;
+
 	/* set broadcast storm protection 10% rate */
 	regmap_update_bits(ksz_regmap_16(dev), regs[S_BROADCAST_CTRL],
 			   BROADCAST_STORM_RATE,
@@ -2426,16 +2426,26 @@
 		if (!port)
 			return MICREL_KSZ8_P1_ERRATA;
 		break;
+	case KSZ8765_CHIP_ID:
+	case KSZ8794_CHIP_ID:
+	case KSZ8795_CHIP_ID:
+		/* KSZ879x/KSZ877x/KSZ876x Errata DS80000687C Module 2 */
 	case KSZ9477_CHIP_ID:
-		/* KSZ9477 Errata DS80000754C
-		 *
-		 * Module 4: Energy Efficient Ethernet (EEE) feature select must
-		 * be manually disabled
+		/* KSZ9477S Errata DS80000754A Module 4 */
+	case KSZ9567_CHIP_ID:
+		/* KSZ9567S Errata DS80000756A Module 4 */
+	case KSZ9896_CHIP_ID:
+		/* KSZ9896C Errata DS80000757A Module 3 */
+	case KSZ9897_CHIP_ID:
+		/* KSZ9897R Errata DS80000758C Module 4 */
+		/* Energy Efficient Ethernet (EEE) feature select must be manually disabled
 		 *   The EEE feature is enabled by default, but it is not fully
 		 *   operational. It must be manually disabled through register
 		 *   controls. If not disabled, the PHY ports can auto-negotiate
 		 *   to enable EEE, and this feature can cause link drops when
 		 *   linked to another device supporting EEE.
+		 *
+		 * The same item appears in the errata for all switches above.
 		 */
 		return MICREL_NO_EEE;
 	}
@@ -2962,7 +2972,7 @@
 		else
 			interface = PHY_INTERFACE_MODE_MII;
 	} else if (val == bitval[P_RMII_SEL]) {
-		interface = PHY_INTERFACE_MODE_RGMII;
+		interface = PHY_INTERFACE_MODE_RMII;
 	} else {
 		interface = PHY_INTERFACE_MODE_RGMII;
 		if (data8 & P_RGMII_ID_EG_ENABLE)
@@ -3596,6 +3606,11 @@
 		return -EBUSY;
 	}
 
+	/* Need to initialize variable as the code to fill in settings may
+	 * not be executed.
+	 */
+	wol.wolopts = 0;
+
 	ksz_get_wol(ds, dp->index, &wol);
 	if (wol.wolopts & WAKE_MAGIC) {
 		dev_err(ds->dev,
@@ -3750,6 +3765,13 @@
 		return -EOPNOTSUPP;
 	}
 
+	/* KSZ9477 can only perform HSR offloading for up to two ports */
+	if (hweight8(dev->hsr_ports) >= 2) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "Cannot offload more than two ports - using software HSR");
+		return -EOPNOTSUPP;
+	}
+
 	/* Self MAC address filtering, to avoid frames traversing
 	 * the HSR ring more than once.
 	 */
@@ -4242,10 +4264,6 @@
 	for (port_num = 0; port_num < dev->info->port_cnt; ++port_num)
 		dev->ports[port_num].interface = PHY_INTERFACE_MODE_NA;
 	if (dev->dev->of_node) {
-		ret = ksz_parse_drive_strength(dev);
-		if (ret)
-			return ret;
-
 		ret = of_get_phy_mode(dev->dev->of_node, &interface);
 		if (ret == 0)
 			dev->compat_interface = interface;
--- linux-qcom-6.8.0.orig/drivers/net/dsa/microchip/ksz_ptp.c
+++ linux-qcom-6.8.0/drivers/net/dsa/microchip/ksz_ptp.c
@@ -266,7 +266,6 @@
 	struct ksz_port *prt;
 	struct dsa_port *dp;
 	bool tag_en = false;
-	int ret;
 
 	dsa_switch_for_each_user_port(dp, dev->ds) {
 		prt = &dev->ports[dp->index];
@@ -277,9 +276,7 @@
 	}
 
 	if (tag_en) {
-		ret = ptp_schedule_worker(ptp_data->clock, 0);
-		if (ret)
-			return ret;
+		ptp_schedule_worker(ptp_data->clock, 0);
 	} else {
 		ptp_cancel_worker_sync(ptp_data->clock);
 	}
--- linux-qcom-6.8.0.orig/drivers/net/dsa/microchip/lan937x_main.c
+++ linux-qcom-6.8.0/drivers/net/dsa/microchip/lan937x_main.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Microchip LAN937X switch driver main logic
- * Copyright (C) 2019-2022 Microchip Technology Inc.
+ * Copyright (C) 2019-2024 Microchip Technology Inc.
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -257,10 +257,66 @@
 
 int lan937x_set_ageing_time(struct ksz_device *dev, unsigned int msecs)
 {
-	u32 secs = msecs / 1000;
-	u32 value;
+	u8 data, mult, value8;
+	bool in_msec = false;
+	u32 max_val, value;
+	u32 secs = msecs;
 	int ret;
 
+#define MAX_TIMER_VAL	((1 << 20) - 1)
+
+	/* The aging timer comprises a 3-bit multiplier and a 20-bit second
+	 * value.  Either of them cannot be zero.  The maximum timer is then
+	 * 7 * 1048575 = 7340025 seconds.  As this value is too large for
+	 * practical use it can be interpreted as microseconds, making the
+	 * maximum timer 7340 seconds with finer control.  This allows for
+	 * maximum 122 minutes compared to 29 minutes in KSZ9477 switch.
+	 */
+	if (msecs % 1000)
+		in_msec = true;
+	else
+		secs /= 1000;
+	if (!secs)
+		secs = 1;
+
+	/* Return error if too large. */
+	else if (secs > 7 * MAX_TIMER_VAL)
+		return -EINVAL;
+
+	/* Configure how to interpret the number value. */
+	ret = ksz_rmw8(dev, REG_SW_LUE_CTRL_2, SW_AGE_CNT_IN_MICROSEC,
+		       in_msec ? SW_AGE_CNT_IN_MICROSEC : 0);
+	if (ret < 0)
+		return ret;
+
+	ret = ksz_read8(dev, REG_SW_LUE_CTRL_0, &value8);
+	if (ret < 0)
+		return ret;
+
+	/* Check whether there is need to update the multiplier. */
+	mult = FIELD_GET(SW_AGE_CNT_M, value8);
+	max_val = MAX_TIMER_VAL;
+	if (mult > 0) {
+		/* Try to use the same multiplier already in the register as
+		 * the hardware default uses multiplier 4 and 75 seconds for
+		 * 300 seconds.
+		 */
+		max_val = DIV_ROUND_UP(secs, mult);
+		if (max_val > MAX_TIMER_VAL || max_val * mult != secs)
+			max_val = MAX_TIMER_VAL;
+	}
+
+	data = DIV_ROUND_UP(secs, max_val);
+	if (mult != data) {
+		value8 &= ~SW_AGE_CNT_M;
+		value8 |= FIELD_PREP(SW_AGE_CNT_M, data);
+		ret = ksz_write8(dev, REG_SW_LUE_CTRL_0, value8);
+		if (ret < 0)
+			return ret;
+	}
+
+	secs = DIV_ROUND_UP(secs, data);
+
 	value = FIELD_GET(SW_AGE_PERIOD_7_0_M, secs);
 
 	ret = ksz_write8(dev, REG_SW_AGE_PERIOD__1, value);
--- linux-qcom-6.8.0.orig/drivers/net/dsa/microchip/lan937x_reg.h
+++ linux-qcom-6.8.0/drivers/net/dsa/microchip/lan937x_reg.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /* Microchip LAN937X switch register definitions
- * Copyright (C) 2019-2021 Microchip Technology Inc.
+ * Copyright (C) 2019-2024 Microchip Technology Inc.
  */
 #ifndef __LAN937X_REG_H
 #define __LAN937X_REG_H
@@ -48,8 +48,7 @@
 
 #define SW_VLAN_ENABLE			BIT(7)
 #define SW_DROP_INVALID_VID		BIT(6)
-#define SW_AGE_CNT_M			0x7
-#define SW_AGE_CNT_S			3
+#define SW_AGE_CNT_M			GENMASK(5, 3)
 #define SW_RESV_MCAST_ENABLE		BIT(2)
 
 #define REG_SW_LUE_CTRL_1		0x0311
@@ -62,6 +61,10 @@
 #define SW_FAST_AGING			BIT(1)
 #define SW_LINK_AUTO_AGING		BIT(0)
 
+#define REG_SW_LUE_CTRL_2		0x0312
+
+#define SW_AGE_CNT_IN_MICROSEC		BIT(7)
+
 #define REG_SW_AGE_PERIOD__1		0x0313
 #define SW_AGE_PERIOD_7_0_M		GENMASK(7, 0)
 
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mt7530.c
+++ linux-qcom-6.8.0/drivers/net/dsa/mt7530.c
@@ -998,20 +998,217 @@
 	mutex_unlock(&priv->reg_mutex);
 }
 
+/* In Clause 5 of IEEE Std 802-2014, two sublayers of the data link layer (DLL)
+ * of the Open Systems Interconnection basic reference model (OSI/RM) are
+ * described; the medium access control (MAC) and logical link control (LLC)
+ * sublayers. The MAC sublayer is the one facing the physical layer.
+ *
+ * In 8.2 of IEEE Std 802.1Q-2022, the Bridge architecture is described. A
+ * Bridge component comprises a MAC Relay Entity for interconnecting the Ports
+ * of the Bridge, at least two Ports, and higher layer entities with at least a
+ * Spanning Tree Protocol Entity included.
+ *
+ * Each Bridge Port also functions as an end station and shall provide the MAC
+ * Service to an LLC Entity. Each instance of the MAC Service is provided to a
+ * distinct LLC Entity that supports protocol identification, multiplexing, and
+ * demultiplexing, for protocol data unit (PDU) transmission and reception by
+ * one or more higher layer entities.
+ *
+ * It is described in 8.13.9 of IEEE Std 802.1Q-2022 that in a Bridge, the LLC
+ * Entity associated with each Bridge Port is modeled as being directly
+ * connected to the attached Local Area Network (LAN).
+ *
+ * On the switch with CPU port architecture, CPU port functions as Management
+ * Port, and the Management Port functionality is provided by software which
+ * functions as an end station. Software is connected to an IEEE 802 LAN that is
+ * wholly contained within the system that incorporates the Bridge. Software
+ * provides access to the LLC Entity associated with each Bridge Port by the
+ * value of the source port field on the special tag on the frame received by
+ * software.
+ *
+ * We call frames that carry control information to determine the active
+ * topology and current extent of each Virtual Local Area Network (VLAN), i.e.,
+ * spanning tree or Shortest Path Bridging (SPB) and Multiple VLAN Registration
+ * Protocol Data Units (MVRPDUs), and frames from other link constrained
+ * protocols, such as Extensible Authentication Protocol over LAN (EAPOL) and
+ * Link Layer Discovery Protocol (LLDP), link-local frames. They are not
+ * forwarded by a Bridge. Permanently configured entries in the filtering
+ * database (FDB) ensure that such frames are discarded by the Forwarding
+ * Process. In 8.6.3 of IEEE Std 802.1Q-2022, this is described in detail:
+ *
+ * Each of the reserved MAC addresses specified in Table 8-1
+ * (01-80-C2-00-00-[00,01,02,03,04,05,06,07,08,09,0A,0B,0C,0D,0E,0F]) shall be
+ * permanently configured in the FDB in C-VLAN components and ERs.
+ *
+ * Each of the reserved MAC addresses specified in Table 8-2
+ * (01-80-C2-00-00-[01,02,03,04,05,06,07,08,09,0A,0E]) shall be permanently
+ * configured in the FDB in S-VLAN components.
+ *
+ * Each of the reserved MAC addresses specified in Table 8-3
+ * (01-80-C2-00-00-[01,02,04,0E]) shall be permanently configured in the FDB in
+ * TPMR components.
+ *
+ * The FDB entries for reserved MAC addresses shall specify filtering for all
+ * Bridge Ports and all VIDs. Management shall not provide the capability to
+ * modify or remove entries for reserved MAC addresses.
+ *
+ * The addresses in Table 8-1, Table 8-2, and Table 8-3 determine the scope of
+ * propagation of PDUs within a Bridged Network, as follows:
+ *
+ *   The Nearest Bridge group address (01-80-C2-00-00-0E) is an address that no
+ *   conformant Two-Port MAC Relay (TPMR) component, Service VLAN (S-VLAN)
+ *   component, Customer VLAN (C-VLAN) component, or MAC Bridge can forward.
+ *   PDUs transmitted using this destination address, or any other addresses
+ *   that appear in Table 8-1, Table 8-2, and Table 8-3
+ *   (01-80-C2-00-00-[00,01,02,03,04,05,06,07,08,09,0A,0B,0C,0D,0E,0F]), can
+ *   therefore travel no further than those stations that can be reached via a
+ *   single individual LAN from the originating station.
+ *
+ *   The Nearest non-TPMR Bridge group address (01-80-C2-00-00-03), is an
+ *   address that no conformant S-VLAN component, C-VLAN component, or MAC
+ *   Bridge can forward; however, this address is relayed by a TPMR component.
+ *   PDUs using this destination address, or any of the other addresses that
+ *   appear in both Table 8-1 and Table 8-2 but not in Table 8-3
+ *   (01-80-C2-00-00-[00,03,05,06,07,08,09,0A,0B,0C,0D,0F]), will be relayed by
+ *   any TPMRs but will propagate no further than the nearest S-VLAN component,
+ *   C-VLAN component, or MAC Bridge.
+ *
+ *   The Nearest Customer Bridge group address (01-80-C2-00-00-00) is an address
+ *   that no conformant C-VLAN component, MAC Bridge can forward; however, it is
+ *   relayed by TPMR components and S-VLAN components. PDUs using this
+ *   destination address, or any of the other addresses that appear in Table 8-1
+ *   but not in either Table 8-2 or Table 8-3 (01-80-C2-00-00-[00,0B,0C,0D,0F]),
+ *   will be relayed by TPMR components and S-VLAN components but will propagate
+ *   no further than the nearest C-VLAN component or MAC Bridge.
+ *
+ * Because the LLC Entity associated with each Bridge Port is provided via CPU
+ * port, we must not filter these frames but forward them to CPU port.
+ *
+ * In a Bridge, the transmission Port is majorly decided by ingress and egress
+ * rules, FDB, and spanning tree Port State functions of the Forwarding Process.
+ * For link-local frames, only CPU port should be designated as destination port
+ * in the FDB, and the other functions of the Forwarding Process must not
+ * interfere with the decision of the transmission Port. We call this process
+ * trapping frames to CPU port.
+ *
+ * Therefore, on the switch with CPU port architecture, link-local frames must
+ * be trapped to CPU port, and certain link-local frames received by a Port of a
+ * Bridge comprising a TPMR component or an S-VLAN component must be excluded
+ * from it.
+ *
+ * A Bridge of the switch with CPU port architecture cannot comprise a Two-Port
+ * MAC Relay (TPMR) component as a TPMR component supports only a subset of the
+ * functionality of a MAC Bridge. A Bridge comprising two Ports (Management Port
+ * doesn't count) of this architecture will either function as a standard MAC
+ * Bridge or a standard VLAN Bridge.
+ *
+ * Therefore, a Bridge of this architecture can only comprise S-VLAN components,
+ * C-VLAN components, or MAC Bridge components. Since there's no TPMR component,
+ * we don't need to relay PDUs using the destination addresses specified on the
+ * Nearest non-TPMR section, and the proportion of the Nearest Customer Bridge
+ * section where they must be relayed by TPMR components.
+ *
+ * One option to trap link-local frames to CPU port is to add static FDB entries
+ * with CPU port designated as destination port. However, because that
+ * Independent VLAN Learning (IVL) is being used on every VID, each entry only
+ * applies to a single VLAN Identifier (VID). For a Bridge comprising a MAC
+ * Bridge component or a C-VLAN component, there would have to be 16 times 4096
+ * entries. This switch intellectual property can only hold a maximum of 2048
+ * entries. Using this option, there also isn't a mechanism to prevent
+ * link-local frames from being discarded when the spanning tree Port State of
+ * the reception Port is discarding.
+ *
+ * The remaining option is to utilise the BPC, RGAC1, RGAC2, RGAC3, and RGAC4
+ * registers. Whilst this applies to every VID, it doesn't contain all of the
+ * reserved MAC addresses without affecting the remaining Standard Group MAC
+ * Addresses. The REV_UN frame tag utilised using the RGAC4 register covers the
+ * remaining 01-80-C2-00-00-[04,05,06,07,08,09,0A,0B,0C,0D,0F] destination
+ * addresses. It also includes the 01-80-C2-00-00-22 to 01-80-C2-00-00-FF
+ * destination addresses which may be relayed by MAC Bridges or VLAN Bridges.
+ * The latter option provides better but not complete conformance.
+ *
+ * This switch intellectual property also does not provide a mechanism to trap
+ * link-local frames with specific destination addresses to CPU port by Bridge,
+ * to conform to the filtering rules for the distinct Bridge components.
+ *
+ * Therefore, regardless of the type of the Bridge component, link-local frames
+ * with these destination addresses will be trapped to CPU port:
+ *
+ * 01-80-C2-00-00-[00,01,02,03,0E]
+ *
+ * In a Bridge comprising a MAC Bridge component or a C-VLAN component:
+ *
+ *   Link-local frames with these destination addresses won't be trapped to CPU
+ *   port which won't conform to IEEE Std 802.1Q-2022:
+ *
+ *   01-80-C2-00-00-[04,05,06,07,08,09,0A,0B,0C,0D,0F]
+ *
+ * In a Bridge comprising an S-VLAN component:
+ *
+ *   Link-local frames with these destination addresses will be trapped to CPU
+ *   port which won't conform to IEEE Std 802.1Q-2022:
+ *
+ *   01-80-C2-00-00-00
+ *
+ *   Link-local frames with these destination addresses won't be trapped to CPU
+ *   port which won't conform to IEEE Std 802.1Q-2022:
+ *
+ *   01-80-C2-00-00-[04,05,06,07,08,09,0A]
+ *
+ * To trap link-local frames to CPU port as conformant as this switch
+ * intellectual property can allow, link-local frames are made to be regarded as
+ * Bridge Protocol Data Units (BPDUs). This is because this switch intellectual
+ * property only lets the frames regarded as BPDUs bypass the spanning tree Port
+ * State function of the Forwarding Process.
+ *
+ * The only remaining interference is the ingress rules. When the reception Port
+ * has no PVID assigned on software, VLAN-untagged frames won't be allowed in.
+ * There doesn't seem to be a mechanism on the switch intellectual property to
+ * have link-local frames bypass this function of the Forwarding Process.
+ */
 static void
 mt753x_trap_frames(struct mt7530_priv *priv)
 {
-	/* Trap BPDUs to the CPU port(s) */
-	mt7530_rmw(priv, MT753X_BPC, MT753X_BPDU_PORT_FW_MASK,
-		   MT753X_BPDU_CPU_ONLY);
-
-	/* Trap 802.1X PAE frames to the CPU port(s) */
-	mt7530_rmw(priv, MT753X_BPC, MT753X_PAE_PORT_FW_MASK,
-		   MT753X_PAE_PORT_FW(MT753X_BPDU_CPU_ONLY));
-
-	/* Trap LLDP frames with :0E MAC DA to the CPU port(s) */
-	mt7530_rmw(priv, MT753X_RGAC2, MT753X_R0E_PORT_FW_MASK,
-		   MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY));
+	/* Trap 802.1X PAE frames and BPDUs to the CPU port(s) and egress them
+	 * VLAN-untagged.
+	 */
+	mt7530_rmw(priv, MT753X_BPC,
+		   MT753X_PAE_BPDU_FR | MT753X_PAE_EG_TAG_MASK |
+			   MT753X_PAE_PORT_FW_MASK | MT753X_BPDU_EG_TAG_MASK |
+			   MT753X_BPDU_PORT_FW_MASK,
+		   MT753X_PAE_BPDU_FR |
+			   MT753X_PAE_EG_TAG(MT7530_VLAN_EG_UNTAGGED) |
+			   MT753X_PAE_PORT_FW(MT753X_BPDU_CPU_ONLY) |
+			   MT753X_BPDU_EG_TAG(MT7530_VLAN_EG_UNTAGGED) |
+			   MT753X_BPDU_CPU_ONLY);
+
+	/* Trap frames with :01 and :02 MAC DAs to the CPU port(s) and egress
+	 * them VLAN-untagged.
+	 */
+	mt7530_rmw(priv, MT753X_RGAC1,
+		   MT753X_R02_BPDU_FR | MT753X_R02_EG_TAG_MASK |
+			   MT753X_R02_PORT_FW_MASK | MT753X_R01_BPDU_FR |
+			   MT753X_R01_EG_TAG_MASK | MT753X_R01_PORT_FW_MASK,
+		   MT753X_R02_BPDU_FR |
+			   MT753X_R02_EG_TAG(MT7530_VLAN_EG_UNTAGGED) |
+			   MT753X_R02_PORT_FW(MT753X_BPDU_CPU_ONLY) |
+			   MT753X_R01_BPDU_FR |
+			   MT753X_R01_EG_TAG(MT7530_VLAN_EG_UNTAGGED) |
+			   MT753X_BPDU_CPU_ONLY);
+
+	/* Trap frames with :03 and :0E MAC DAs to the CPU port(s) and egress
+	 * them VLAN-untagged.
+	 */
+	mt7530_rmw(priv, MT753X_RGAC2,
+		   MT753X_R0E_BPDU_FR | MT753X_R0E_EG_TAG_MASK |
+			   MT753X_R0E_PORT_FW_MASK | MT753X_R03_BPDU_FR |
+			   MT753X_R03_EG_TAG_MASK | MT753X_R03_PORT_FW_MASK,
+		   MT753X_R0E_BPDU_FR |
+			   MT753X_R0E_EG_TAG(MT7530_VLAN_EG_UNTAGGED) |
+			   MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY) |
+			   MT753X_R03_BPDU_FR |
+			   MT753X_R03_EG_TAG(MT7530_VLAN_EG_UNTAGGED) |
+			   MT753X_BPDU_CPU_ONLY);
 }
 
 static int
@@ -1750,14 +1947,16 @@
 
 static int mt753x_mirror_port_get(unsigned int id, u32 val)
 {
-	return (id == ID_MT7531) ? MT7531_MIRROR_PORT_GET(val) :
-				   MIRROR_PORT(val);
+	return (id == ID_MT7531 || id == ID_MT7988) ?
+		       MT7531_MIRROR_PORT_GET(val) :
+		       MIRROR_PORT(val);
 }
 
 static int mt753x_mirror_port_set(unsigned int id, u32 val)
 {
-	return (id == ID_MT7531) ? MT7531_MIRROR_PORT_SET(val) :
-				   MIRROR_PORT(val);
+	return (id == ID_MT7531 || id == ID_MT7988) ?
+		       MT7531_MIRROR_PORT_SET(val) :
+		       MIRROR_PORT(val);
 }
 
 static int mt753x_port_mirror_add(struct dsa_switch *ds, int port,
@@ -2243,11 +2442,11 @@
 	 */
 	if (priv->mcm) {
 		reset_control_assert(priv->rstc);
-		usleep_range(1000, 1100);
+		usleep_range(5000, 5100);
 		reset_control_deassert(priv->rstc);
 	} else {
 		gpiod_set_value_cansleep(priv->reset, 0);
-		usleep_range(1000, 1100);
+		usleep_range(5000, 5100);
 		gpiod_set_value_cansleep(priv->reset, 1);
 	}
 
@@ -2272,8 +2471,6 @@
 		     SYS_CTRL_PHY_RST | SYS_CTRL_SW_RST |
 		     SYS_CTRL_REG_RST);
 
-	mt7530_pll_setup(priv);
-
 	/* Lower Tx driving for TRGMII path */
 	for (i = 0; i < NUM_TRGMII_CTRL; i++)
 		mt7530_write(priv, MT7530_TRGMII_TD_ODT(i),
@@ -2291,6 +2488,9 @@
 
 	priv->p6_interface = PHY_INTERFACE_MODE_NA;
 
+	if ((val & HWTRAP_XTAL_MASK) == HWTRAP_XTAL_40MHZ)
+		mt7530_pll_setup(priv);
+
 	mt753x_trap_frames(priv);
 
 	/* Enable and reset MIB counters */
@@ -2320,6 +2520,9 @@
 			   PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT));
 	}
 
+	/* Allow mirroring frames received on the local port (monitor port). */
+	mt7530_set(priv, MT753X_AGC, LOCAL_EN);
+
 	/* Setup VLAN ID 0 for VLAN-unaware bridges */
 	ret = mt7530_setup_vlan0(priv);
 	if (ret)
@@ -2428,6 +2631,9 @@
 			   PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT));
 	}
 
+	/* Allow mirroring frames received on the local port (monitor port). */
+	mt7530_set(priv, MT753X_AGC, LOCAL_EN);
+
 	/* Flush the FDB table */
 	ret = mt7530_fdb_cmd(priv, MT7530_FDB_FLUSH, NULL);
 	if (ret < 0)
@@ -2449,11 +2655,11 @@
 	 */
 	if (priv->mcm) {
 		reset_control_assert(priv->rstc);
-		usleep_range(1000, 1100);
+		usleep_range(5000, 5100);
 		reset_control_deassert(priv->rstc);
 	} else {
 		gpiod_set_value_cansleep(priv->reset, 0);
-		usleep_range(1000, 1100);
+		usleep_range(5000, 5100);
 		gpiod_set_value_cansleep(priv->reset, 1);
 	}
 
@@ -2506,18 +2712,25 @@
 	priv->p5_interface = PHY_INTERFACE_MODE_NA;
 	priv->p6_interface = PHY_INTERFACE_MODE_NA;
 
-	/* Enable PHY core PLL, since phy_device has not yet been created
-	 * provided for phy_[read,write]_mmd_indirect is called, we provide
-	 * our own mt7531_ind_mmd_phy_[read,write] to complete this
-	 * function.
+	/* Enable Energy-Efficient Ethernet (EEE) and PHY core PLL, since
+	 * phy_device has not yet been created provided for
+	 * phy_[read,write]_mmd_indirect is called, we provide our own
+	 * mt7531_ind_mmd_phy_[read,write] to complete this function.
 	 */
 	val = mt7531_ind_c45_phy_read(priv, MT753X_CTRL_PHY_ADDR,
 				      MDIO_MMD_VEND2, CORE_PLL_GROUP4);
-	val |= MT7531_PHY_PLL_BYPASS_MODE;
+	val |= MT7531_RG_SYSPLL_DMY2 | MT7531_PHY_PLL_BYPASS_MODE;
 	val &= ~MT7531_PHY_PLL_OFF;
 	mt7531_ind_c45_phy_write(priv, MT753X_CTRL_PHY_ADDR, MDIO_MMD_VEND2,
 				 CORE_PLL_GROUP4, val);
 
+	/* Disable EEE advertisement on the switch PHYs. */
+	for (i = MT753X_CTRL_PHY_ADDR;
+	     i < MT753X_CTRL_PHY_ADDR + MT7530_NUM_PHYS; i++) {
+		mt7531_ind_c45_phy_write(priv, i, MDIO_MMD_AN, MDIO_AN_EEE_ADV,
+					 0);
+	}
+
 	mt7531_setup_common(ds);
 
 	/* Setup VLAN ID 0 for VLAN-unaware bridges */
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mt7530.h
+++ linux-qcom-6.8.0/drivers/net/dsa/mt7530.h
@@ -32,6 +32,10 @@
 #define SYSC_REG_RSTCTRL		0x34
 #define  RESET_MCM			BIT(2)
 
+/* Register for ARL global control */
+#define MT753X_AGC			0xc
+#define  LOCAL_EN			BIT(7)
+
 /* Registers to mac forward control for unknown frames */
 #define MT7530_MFC			0x10
 #define  BC_FFP(x)			(((x) & 0xff) << 24)
@@ -65,14 +69,38 @@
 
 /* Registers for BPDU and PAE frame control*/
 #define MT753X_BPC			0x24
-#define  MT753X_BPDU_PORT_FW_MASK	GENMASK(2, 0)
+#define  MT753X_PAE_BPDU_FR		BIT(25)
+#define  MT753X_PAE_EG_TAG_MASK		GENMASK(24, 22)
+#define  MT753X_PAE_EG_TAG(x)		FIELD_PREP(MT753X_PAE_EG_TAG_MASK, x)
 #define  MT753X_PAE_PORT_FW_MASK	GENMASK(18, 16)
 #define  MT753X_PAE_PORT_FW(x)		FIELD_PREP(MT753X_PAE_PORT_FW_MASK, x)
+#define  MT753X_BPDU_EG_TAG_MASK	GENMASK(8, 6)
+#define  MT753X_BPDU_EG_TAG(x)		FIELD_PREP(MT753X_BPDU_EG_TAG_MASK, x)
+#define  MT753X_BPDU_PORT_FW_MASK	GENMASK(2, 0)
+
+/* Register for :01 and :02 MAC DA frame control */
+#define MT753X_RGAC1			0x28
+#define  MT753X_R02_BPDU_FR		BIT(25)
+#define  MT753X_R02_EG_TAG_MASK		GENMASK(24, 22)
+#define  MT753X_R02_EG_TAG(x)		FIELD_PREP(MT753X_R02_EG_TAG_MASK, x)
+#define  MT753X_R02_PORT_FW_MASK	GENMASK(18, 16)
+#define  MT753X_R02_PORT_FW(x)		FIELD_PREP(MT753X_R02_PORT_FW_MASK, x)
+#define  MT753X_R01_BPDU_FR		BIT(9)
+#define  MT753X_R01_EG_TAG_MASK		GENMASK(8, 6)
+#define  MT753X_R01_EG_TAG(x)		FIELD_PREP(MT753X_R01_EG_TAG_MASK, x)
+#define  MT753X_R01_PORT_FW_MASK	GENMASK(2, 0)
 
 /* Register for :03 and :0E MAC DA frame control */
 #define MT753X_RGAC2			0x2c
+#define  MT753X_R0E_BPDU_FR		BIT(25)
+#define  MT753X_R0E_EG_TAG_MASK		GENMASK(24, 22)
+#define  MT753X_R0E_EG_TAG(x)		FIELD_PREP(MT753X_R0E_EG_TAG_MASK, x)
 #define  MT753X_R0E_PORT_FW_MASK	GENMASK(18, 16)
 #define  MT753X_R0E_PORT_FW(x)		FIELD_PREP(MT753X_R0E_PORT_FW_MASK, x)
+#define  MT753X_R03_BPDU_FR		BIT(9)
+#define  MT753X_R03_EG_TAG_MASK		GENMASK(8, 6)
+#define  MT753X_R03_EG_TAG(x)		FIELD_PREP(MT753X_R03_EG_TAG_MASK, x)
+#define  MT753X_R03_PORT_FW_MASK	GENMASK(2, 0)
 
 enum mt753x_bpdu_port_fw {
 	MT753X_BPDU_FOLLOW_MFC,
@@ -253,6 +281,7 @@
 enum mt7530_vlan_port_eg_tag {
 	MT7530_VLAN_EG_DISABLED = 0,
 	MT7530_VLAN_EG_CONSISTENT = 1,
+	MT7530_VLAN_EG_UNTAGGED = 4,
 };
 
 enum mt7530_vlan_port_attr {
@@ -605,6 +634,7 @@
 #define  RG_SYSPLL_DDSFBK_EN		BIT(12)
 #define  RG_SYSPLL_BIAS_EN		BIT(11)
 #define  RG_SYSPLL_BIAS_LPF_EN		BIT(10)
+#define  MT7531_RG_SYSPLL_DMY2		BIT(6)
 #define  MT7531_PHY_PLL_OFF		BIT(5)
 #define  MT7531_PHY_PLL_BYPASS_MODE	BIT(4)
 
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mv88e6xxx/chip.c
+++ linux-qcom-6.8.0/drivers/net/dsa/mv88e6xxx/chip.c
@@ -131,8 +131,8 @@
 {
 	struct mv88e6xxx_mdio_bus *mdio_bus;
 
-	mdio_bus = list_first_entry(&chip->mdios, struct mv88e6xxx_mdio_bus,
-				    list);
+	mdio_bus = list_first_entry_or_null(&chip->mdios,
+					    struct mv88e6xxx_mdio_bus, list);
 	if (!mdio_bus)
 		return NULL;
 
@@ -566,13 +566,61 @@
 		phy_interface_set_rgmii(supported);
 }
 
-static void mv88e6250_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,
-				       struct phylink_config *config)
+static void
+mv88e6250_setup_supported_interfaces(struct mv88e6xxx_chip *chip, int port,
+				     struct phylink_config *config)
 {
 	unsigned long *supported = config->supported_interfaces;
+	int err;
+	u16 reg;
 
-	/* Translate the default cmode */
-	mv88e6xxx_translate_cmode(chip->ports[port].cmode, supported);
+	err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, &reg);
+	if (err) {
+		dev_err(chip->dev, "p%d: failed to read port status\n", port);
+		return;
+	}
+
+	switch (reg & MV88E6250_PORT_STS_PORTMODE_MASK) {
+	case MV88E6250_PORT_STS_PORTMODE_MII_10_HALF_PHY:
+	case MV88E6250_PORT_STS_PORTMODE_MII_100_HALF_PHY:
+	case MV88E6250_PORT_STS_PORTMODE_MII_10_FULL_PHY:
+	case MV88E6250_PORT_STS_PORTMODE_MII_100_FULL_PHY:
+		__set_bit(PHY_INTERFACE_MODE_REVMII, supported);
+		break;
+
+	case MV88E6250_PORT_STS_PORTMODE_MII_HALF:
+	case MV88E6250_PORT_STS_PORTMODE_MII_FULL:
+		__set_bit(PHY_INTERFACE_MODE_MII, supported);
+		break;
+
+	case MV88E6250_PORT_STS_PORTMODE_MII_DUAL_100_RMII_FULL_PHY:
+	case MV88E6250_PORT_STS_PORTMODE_MII_200_RMII_FULL_PHY:
+	case MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_HALF_PHY:
+	case MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_FULL_PHY:
+		__set_bit(PHY_INTERFACE_MODE_REVRMII, supported);
+		break;
+
+	case MV88E6250_PORT_STS_PORTMODE_MII_DUAL_100_RMII_FULL:
+	case MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_FULL:
+		__set_bit(PHY_INTERFACE_MODE_RMII, supported);
+		break;
+
+	case MV88E6250_PORT_STS_PORTMODE_MII_100_RGMII:
+		__set_bit(PHY_INTERFACE_MODE_RGMII, supported);
+		break;
+
+	default:
+		dev_err(chip->dev,
+			"p%d: invalid port mode in status register: %04x\n",
+			port, reg);
+	}
+}
+
+static void mv88e6250_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,
+				       struct phylink_config *config)
+{
+	if (!mv88e6xxx_phy_is_internal(chip, port))
+		mv88e6250_setup_supported_interfaces(chip, port, config);
 
 	config->mac_capabilities = MAC_SYM_PAUSE | MAC_10 | MAC_100;
 }
@@ -649,6 +697,18 @@
 	}
 }
 
+static void mv88e632x_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,
+				       struct phylink_config *config)
+{
+	unsigned long *supported = config->supported_interfaces;
+
+	/* Translate the default cmode */
+	mv88e6xxx_translate_cmode(chip->ports[port].cmode, supported);
+
+	config->mac_capabilities = MAC_SYM_PAUSE | MAC_10 | MAC_100 |
+				   MAC_1000FD;
+}
+
 static void mv88e6341_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,
 				       struct phylink_config *config)
 {
@@ -3075,6 +3135,7 @@
 static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip)
 {
 	struct gpio_desc *gpiod = chip->reset;
+	int err;
 
 	/* If there is a GPIO connected to the reset pin, toggle it */
 	if (gpiod) {
@@ -3083,17 +3144,26 @@
 		 * mid-byte, causing the first EEPROM read after the reset
 		 * from the wrong location resulting in the switch booting
 		 * to wrong mode and inoperable.
+		 * For this reason, switch families with EEPROM support
+		 * generally wait for EEPROM loads to complete as their pre-
+		 * and post-reset handlers.
 		 */
-		if (chip->info->ops->get_eeprom)
-			mv88e6xxx_g2_eeprom_wait(chip);
+		if (chip->info->ops->hardware_reset_pre) {
+			err = chip->info->ops->hardware_reset_pre(chip);
+			if (err)
+				dev_err(chip->dev, "pre-reset error: %d\n", err);
+		}
 
 		gpiod_set_value_cansleep(gpiod, 1);
 		usleep_range(10000, 20000);
 		gpiod_set_value_cansleep(gpiod, 0);
 		usleep_range(10000, 20000);
 
-		if (chip->info->ops->get_eeprom)
-			mv88e6xxx_g2_eeprom_wait(chip);
+		if (chip->info->ops->hardware_reset_post) {
+			err = chip->info->ops->hardware_reset_post(chip);
+			if (err)
+				dev_err(chip->dev, "post-reset error: %d\n", err);
+		}
 	}
 }
 
@@ -3534,7 +3604,8 @@
 	mv88e6xxx_reg_lock(chip);
 	if (chip->info->ops->port_set_jumbo_size)
 		ret = chip->info->ops->port_set_jumbo_size(chip, port, new_mtu);
-	else if (chip->info->ops->set_max_frame_size)
+	else if (chip->info->ops->set_max_frame_size &&
+		 dsa_is_cpu_port(ds, port))
 		ret = chip->info->ops->set_max_frame_size(chip, new_mtu);
 	mv88e6xxx_reg_unlock(chip);
 
@@ -4320,6 +4391,8 @@
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu =  mv88e6390_g1_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6390_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -4510,6 +4583,8 @@
 	.watchdog_ops = &mv88e6097_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6352_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -4610,6 +4685,8 @@
 	.watchdog_ops = &mv88e6097_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6352_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -4704,6 +4781,8 @@
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6390_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -4762,6 +4841,8 @@
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6390_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -4818,6 +4899,8 @@
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6390_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -4877,6 +4960,8 @@
 	.watchdog_ops = &mv88e6097_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6352_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -4930,6 +5015,8 @@
 	.watchdog_ops = &mv88e6250_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6250_g1_wait_eeprom_done_prereset,
+	.hardware_reset_post = mv88e6xxx_g1_wait_eeprom_done,
 	.reset = mv88e6250_g1_reset,
 	.vtu_getnext = mv88e6185_g1_vtu_getnext,
 	.vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
@@ -4977,6 +5064,8 @@
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6390_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -5036,13 +5125,15 @@
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.vtu_getnext = mv88e6185_g1_vtu_getnext,
 	.vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
 	.gpio_ops = &mv88e6352_gpio_ops,
 	.avb_ops = &mv88e6352_avb_ops,
 	.ptp_ops = &mv88e6352_ptp_ops,
-	.phylink_get_caps = mv88e6185_phylink_get_caps,
+	.phylink_get_caps = mv88e632x_phylink_get_caps,
 };
 
 static const struct mv88e6xxx_ops mv88e6321_ops = {
@@ -5082,13 +5173,15 @@
 	.set_egress_port = mv88e6095_g1_set_egress_port,
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.vtu_getnext = mv88e6185_g1_vtu_getnext,
 	.vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
 	.gpio_ops = &mv88e6352_gpio_ops,
 	.avb_ops = &mv88e6352_avb_ops,
 	.ptp_ops = &mv88e6352_ptp_ops,
-	.phylink_get_caps = mv88e6185_phylink_get_caps,
+	.phylink_get_caps = mv88e632x_phylink_get_caps,
 };
 
 static const struct mv88e6xxx_ops mv88e6341_ops = {
@@ -5132,6 +5225,8 @@
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu =  mv88e6390_g1_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6390_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -5287,6 +5382,8 @@
 	.watchdog_ops = &mv88e6097_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6352_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -5349,6 +5446,8 @@
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6390_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -5411,6 +5510,8 @@
 	.watchdog_ops = &mv88e6390_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6390_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -5476,6 +5577,8 @@
 	.watchdog_ops = &mv88e6393x_watchdog_ops,
 	.mgmt_rsvd2cpu = mv88e6393x_port_mgmt_rsvd2cpu,
 	.pot_clear = mv88e6xxx_g2_pot_clear,
+	.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
+	.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
 	.reset = mv88e6352_g1_reset,
 	.rmu_disable = mv88e6390_g1_rmu_disable,
 	.atu_get_hash = mv88e6165_g1_atu_get_hash,
@@ -5500,8 +5603,12 @@
 		.family = MV88E6XXX_FAMILY_6250,
 		.name = "Marvell 88E6020",
 		.num_databases = 64,
-		.num_ports = 4,
+		/* Ports 2-4 are not routed to pins
+		 * => usable ports 0, 1, 5, 6
+		 */
+		.num_ports = 7,
 		.num_internal_phys = 2,
+		.invalid_port_mask = BIT(2) | BIT(3) | BIT(4),
 		.max_vid = 4095,
 		.port_base_addr = 0x8,
 		.phy_base_addr = 0x0,
@@ -5650,7 +5757,7 @@
 		.prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6141,
 		.family = MV88E6XXX_FAMILY_6341,
 		.name = "Marvell 88E6141",
-		.num_databases = 4096,
+		.num_databases = 256,
 		.num_macs = 2048,
 		.num_ports = 6,
 		.num_internal_phys = 5,
@@ -6109,7 +6216,7 @@
 		.prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6341,
 		.family = MV88E6XXX_FAMILY_6341,
 		.name = "Marvell 88E6341",
-		.num_databases = 4096,
+		.num_databases = 256,
 		.num_macs = 2048,
 		.num_internal_phys = 5,
 		.num_ports = 6,
@@ -6215,7 +6322,7 @@
 		.invalid_port_mask = BIT(1) | BIT(2) | BIT(8),
 		.num_internal_phys = 5,
 		.internal_phys_offset = 3,
-		.max_vid = 4095,
+		.max_vid = 8191,
 		.max_sid = 63,
 		.port_base_addr = 0x0,
 		.phy_base_addr = 0x0,
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mv88e6xxx/chip.h
+++ linux-qcom-6.8.0/drivers/net/dsa/mv88e6xxx/chip.h
@@ -206,6 +206,7 @@
 struct mv88e6xxx_avb_ops;
 struct mv88e6xxx_ptp_ops;
 struct mv88e6xxx_pcs_ops;
+struct mv88e6xxx_cc_coeffs;
 
 struct mv88e6xxx_irq {
 	u16 masked;
@@ -408,6 +409,7 @@
 	struct cyclecounter	tstamp_cc;
 	struct timecounter	tstamp_tc;
 	struct delayed_work	overflow_work;
+	const struct mv88e6xxx_cc_coeffs *cc_coeffs;
 
 	struct ptp_clock	*ptp_clock;
 	struct ptp_clock_info	ptp_clock_info;
@@ -487,6 +489,12 @@
 	int (*ppu_enable)(struct mv88e6xxx_chip *chip);
 	int (*ppu_disable)(struct mv88e6xxx_chip *chip);
 
+	/* Additional handlers to run before and after hard reset, to make sure
+	 * that the switch and EEPROM are in a good state.
+	 */
+	int (*hardware_reset_pre)(struct mv88e6xxx_chip *chip);
+	int (*hardware_reset_post)(struct mv88e6xxx_chip *chip);
+
 	/* Switch Software Reset */
 	int (*reset)(struct mv88e6xxx_chip *chip);
 
@@ -725,10 +733,6 @@
 	int arr1_sts_reg;
 	int dep_sts_reg;
 	u32 rx_filters;
-	u32 cc_shift;
-	u32 cc_mult;
-	u32 cc_mult_num;
-	u32 cc_mult_dem;
 };
 
 struct mv88e6xxx_pcs_ops {
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mv88e6xxx/global1.c
+++ linux-qcom-6.8.0/drivers/net/dsa/mv88e6xxx/global1.c
@@ -75,6 +75,95 @@
 	return mv88e6xxx_g1_wait_bit(chip, MV88E6XXX_G1_STS, bit, 1);
 }
 
+static int mv88e6250_g1_eeprom_reload(struct mv88e6xxx_chip *chip)
+{
+	/* MV88E6185_G1_CTL1_RELOAD_EEPROM is also valid for 88E6250 */
+	int bit = __bf_shf(MV88E6185_G1_CTL1_RELOAD_EEPROM);
+	u16 val;
+	int err;
+
+	err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &val);
+	if (err)
+		return err;
+
+	val |= MV88E6185_G1_CTL1_RELOAD_EEPROM;
+
+	err = mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, val);
+	if (err)
+		return err;
+
+	return mv88e6xxx_g1_wait_bit(chip, MV88E6XXX_G1_CTL1, bit, 0);
+}
+
+/* Returns 0 when done, -EBUSY when waiting, other negative codes on error */
+static int mv88e6xxx_g1_is_eeprom_done(struct mv88e6xxx_chip *chip)
+{
+	u16 val;
+	int err;
+
+	err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, &val);
+	if (err < 0) {
+		dev_err(chip->dev, "Error reading status");
+		return err;
+	}
+
+	/* If the switch is still resetting, it may not
+	 * respond on the bus, and so MDIO read returns
+	 * 0xffff. Differentiate between that, and waiting for
+	 * the EEPROM to be done by bit 0 being set.
+	 */
+	if (val == 0xffff || !(val & BIT(MV88E6XXX_G1_STS_IRQ_EEPROM_DONE)))
+		return -EBUSY;
+
+	return 0;
+}
+
+/* As the EEInt (EEPROM done) flag clears on read if the status register, this
+ * function must be called directly after a hard reset or EEPROM ReLoad request,
+ * or the done condition may have been missed
+ */
+int mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip)
+{
+	const unsigned long timeout = jiffies + 1 * HZ;
+	int ret;
+
+	/* Wait up to 1 second for the switch to finish reading the
+	 * EEPROM.
+	 */
+	while (time_before(jiffies, timeout)) {
+		ret = mv88e6xxx_g1_is_eeprom_done(chip);
+		if (ret != -EBUSY)
+			return ret;
+	}
+
+	dev_err(chip->dev, "Timeout waiting for EEPROM done");
+	return -ETIMEDOUT;
+}
+
+int mv88e6250_g1_wait_eeprom_done_prereset(struct mv88e6xxx_chip *chip)
+{
+	int ret;
+
+	ret = mv88e6xxx_g1_is_eeprom_done(chip);
+	if (ret != -EBUSY)
+		return ret;
+
+	/* Pre-reset, we don't know the state of the switch - when
+	 * mv88e6xxx_g1_is_eeprom_done() returns -EBUSY, that may be because
+	 * the switch is actually busy reading the EEPROM, or because
+	 * MV88E6XXX_G1_STS_IRQ_EEPROM_DONE has been cleared by an unrelated
+	 * status register read already.
+	 *
+	 * To account for the latter case, trigger another EEPROM reload for
+	 * another chance at seeing the done flag.
+	 */
+	ret = mv88e6250_g1_eeprom_reload(chip);
+	if (ret)
+		return ret;
+
+	return mv88e6xxx_g1_wait_eeprom_done(chip);
+}
+
 /* Offset 0x01: Switch MAC Address Register Bytes 0 & 1
  * Offset 0x02: Switch MAC Address Register Bytes 2 & 3
  * Offset 0x03: Switch MAC Address Register Bytes 4 & 5
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mv88e6xxx/global1.h
+++ linux-qcom-6.8.0/drivers/net/dsa/mv88e6xxx/global1.h
@@ -282,6 +282,8 @@
 int mv88e6185_g1_reset(struct mv88e6xxx_chip *chip);
 int mv88e6352_g1_reset(struct mv88e6xxx_chip *chip);
 int mv88e6250_g1_reset(struct mv88e6xxx_chip *chip);
+int mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip);
+int mv88e6250_g1_wait_eeprom_done_prereset(struct mv88e6xxx_chip *chip);
 
 int mv88e6185_g1_ppu_enable(struct mv88e6xxx_chip *chip);
 int mv88e6185_g1_ppu_disable(struct mv88e6xxx_chip *chip);
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mv88e6xxx/global1_atu.c
+++ linux-qcom-6.8.0/drivers/net/dsa/mv88e6xxx/global1_atu.c
@@ -457,7 +457,8 @@
 		trace_mv88e6xxx_atu_full_violation(chip->dev, spid,
 						   entry.portvec, entry.mac,
 						   fid);
-		chip->ports[spid].atu_full_violation++;
+		if (spid < ARRAY_SIZE(chip->ports))
+			chip->ports[spid].atu_full_violation++;
 	}
 
 	return IRQ_HANDLED;
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mv88e6xxx/port.c
+++ linux-qcom-6.8.0/drivers/net/dsa/mv88e6xxx/port.c
@@ -1713,6 +1713,7 @@
 	ptr = shift / 8;
 	shift %= 8;
 	mask >>= ptr * 8;
+	ptr <<= 8;
 
 	err = mv88e6393x_port_policy_read(chip, port, ptr, &reg);
 	if (err)
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mv88e6xxx/port.h
+++ linux-qcom-6.8.0/drivers/net/dsa/mv88e6xxx/port.h
@@ -25,10 +25,25 @@
 #define MV88E6250_PORT_STS_PORTMODE_PHY_100_HALF	0x0900
 #define MV88E6250_PORT_STS_PORTMODE_PHY_10_FULL		0x0a00
 #define MV88E6250_PORT_STS_PORTMODE_PHY_100_FULL	0x0b00
-#define MV88E6250_PORT_STS_PORTMODE_MII_10_HALF		0x0c00
-#define MV88E6250_PORT_STS_PORTMODE_MII_100_HALF	0x0d00
-#define MV88E6250_PORT_STS_PORTMODE_MII_10_FULL		0x0e00
-#define MV88E6250_PORT_STS_PORTMODE_MII_100_FULL	0x0f00
+/* - Modes with PHY suffix use output instead of input clock
+ * - Modes without RMII or RGMII use MII
+ * - Modes without speed do not have a fixed speed specified in the manual
+ *   ("DC to x MHz" - variable clock support?)
+ */
+#define MV88E6250_PORT_STS_PORTMODE_MII_DISABLED		0x0000
+#define MV88E6250_PORT_STS_PORTMODE_MII_100_RGMII		0x0100
+#define MV88E6250_PORT_STS_PORTMODE_MII_DUAL_100_RMII_FULL_PHY	0x0200
+#define MV88E6250_PORT_STS_PORTMODE_MII_200_RMII_FULL_PHY	0x0400
+#define MV88E6250_PORT_STS_PORTMODE_MII_DUAL_100_RMII_FULL	0x0600
+#define MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_FULL	0x0700
+#define MV88E6250_PORT_STS_PORTMODE_MII_HALF			0x0800
+#define MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_HALF_PHY	0x0900
+#define MV88E6250_PORT_STS_PORTMODE_MII_FULL			0x0a00
+#define MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_FULL_PHY	0x0b00
+#define MV88E6250_PORT_STS_PORTMODE_MII_10_HALF_PHY		0x0c00
+#define MV88E6250_PORT_STS_PORTMODE_MII_100_HALF_PHY		0x0d00
+#define MV88E6250_PORT_STS_PORTMODE_MII_10_FULL_PHY		0x0e00
+#define MV88E6250_PORT_STS_PORTMODE_MII_100_FULL_PHY		0x0f00
 #define MV88E6XXX_PORT_STS_LINK			0x0800
 #define MV88E6XXX_PORT_STS_DUPLEX		0x0400
 #define MV88E6XXX_PORT_STS_SPEED_MASK		0x0300
--- linux-qcom-6.8.0.orig/drivers/net/dsa/mv88e6xxx/ptp.c
+++ linux-qcom-6.8.0/drivers/net/dsa/mv88e6xxx/ptp.c
@@ -18,6 +18,13 @@
 
 #define MV88E6XXX_MAX_ADJ_PPB	1000000
 
+struct mv88e6xxx_cc_coeffs {
+	u32 cc_shift;
+	u32 cc_mult;
+	u32 cc_mult_num;
+	u32 cc_mult_dem;
+};
+
 /* Family MV88E6250:
  * Raw timestamps are in units of 10-ns clock periods.
  *
@@ -25,22 +32,43 @@
  * simplifies to
  * clkadj = scaled_ppm * 2^7 / 5^5
  */
-#define MV88E6250_CC_SHIFT	28
-#define MV88E6250_CC_MULT	(10 << MV88E6250_CC_SHIFT)
-#define MV88E6250_CC_MULT_NUM	(1 << 7)
-#define MV88E6250_CC_MULT_DEM	3125ULL
+#define MV88E6XXX_CC_10NS_SHIFT 28
+static const struct mv88e6xxx_cc_coeffs mv88e6xxx_cc_10ns_coeffs = {
+	.cc_shift = MV88E6XXX_CC_10NS_SHIFT,
+	.cc_mult = 10 << MV88E6XXX_CC_10NS_SHIFT,
+	.cc_mult_num = 1 << 7,
+	.cc_mult_dem = 3125ULL,
+};
 
-/* Other families:
+/* Other families except MV88E6393X in internal clock mode:
  * Raw timestamps are in units of 8-ns clock periods.
  *
  * clkadj = scaled_ppm * 8*2^28 / (10^6 * 2^16)
  * simplifies to
  * clkadj = scaled_ppm * 2^9 / 5^6
  */
-#define MV88E6XXX_CC_SHIFT	28
-#define MV88E6XXX_CC_MULT	(8 << MV88E6XXX_CC_SHIFT)
-#define MV88E6XXX_CC_MULT_NUM	(1 << 9)
-#define MV88E6XXX_CC_MULT_DEM	15625ULL
+#define MV88E6XXX_CC_8NS_SHIFT 28
+static const struct mv88e6xxx_cc_coeffs mv88e6xxx_cc_8ns_coeffs = {
+	.cc_shift = MV88E6XXX_CC_8NS_SHIFT,
+	.cc_mult = 8 << MV88E6XXX_CC_8NS_SHIFT,
+	.cc_mult_num = 1 << 9,
+	.cc_mult_dem = 15625ULL
+};
+
+/* Family MV88E6393X using internal clock:
+ * Raw timestamps are in units of 4-ns clock periods.
+ *
+ * clkadj = scaled_ppm * 4*2^28 / (10^6 * 2^16)
+ * simplifies to
+ * clkadj = scaled_ppm * 2^8 / 5^6
+ */
+#define MV88E6XXX_CC_4NS_SHIFT 28
+static const struct mv88e6xxx_cc_coeffs mv88e6xxx_cc_4ns_coeffs = {
+	.cc_shift = MV88E6XXX_CC_4NS_SHIFT,
+	.cc_mult = 4 << MV88E6XXX_CC_4NS_SHIFT,
+	.cc_mult_num = 1 << 8,
+	.cc_mult_dem = 15625ULL
+};
 
 #define TAI_EVENT_WORK_INTERVAL msecs_to_jiffies(100)
 
@@ -83,6 +111,33 @@
 	return chip->info->ops->gpio_ops->set_pctl(chip, pin, func);
 }
 
+static const struct mv88e6xxx_cc_coeffs *
+mv88e6xxx_cc_coeff_get(struct mv88e6xxx_chip *chip)
+{
+	u16 period_ps;
+	int err;
+
+	err = mv88e6xxx_tai_read(chip, MV88E6XXX_TAI_CLOCK_PERIOD, &period_ps, 1);
+	if (err) {
+		dev_err(chip->dev, "failed to read cycle counter period: %d\n",
+			err);
+		return ERR_PTR(err);
+	}
+
+	switch (period_ps) {
+	case 4000:
+		return &mv88e6xxx_cc_4ns_coeffs;
+	case 8000:
+		return &mv88e6xxx_cc_8ns_coeffs;
+	case 10000:
+		return &mv88e6xxx_cc_10ns_coeffs;
+	default:
+		dev_err(chip->dev, "unexpected cycle counter period of %u ps\n",
+			period_ps);
+		return ERR_PTR(-ENODEV);
+	}
+}
+
 static u64 mv88e6352_ptp_clock_read(const struct cyclecounter *cc)
 {
 	struct mv88e6xxx_chip *chip = cc_to_chip(cc);
@@ -204,7 +259,6 @@
 static int mv88e6xxx_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
 {
 	struct mv88e6xxx_chip *chip = ptp_to_chip(ptp);
-	const struct mv88e6xxx_ptp_ops *ptp_ops = chip->info->ops->ptp_ops;
 	int neg_adj = 0;
 	u32 diff, mult;
 	u64 adj;
@@ -214,10 +268,10 @@
 		scaled_ppm = -scaled_ppm;
 	}
 
-	mult = ptp_ops->cc_mult;
-	adj = ptp_ops->cc_mult_num;
+	mult = chip->cc_coeffs->cc_mult;
+	adj = chip->cc_coeffs->cc_mult_num;
 	adj *= scaled_ppm;
-	diff = div_u64(adj, ptp_ops->cc_mult_dem);
+	diff = div_u64(adj, chip->cc_coeffs->cc_mult_dem);
 
 	mv88e6xxx_reg_lock(chip);
 
@@ -364,10 +418,6 @@
 		(1 << HWTSTAMP_FILTER_PTP_V2_EVENT) |
 		(1 << HWTSTAMP_FILTER_PTP_V2_SYNC) |
 		(1 << HWTSTAMP_FILTER_PTP_V2_DELAY_REQ),
-	.cc_shift = MV88E6XXX_CC_SHIFT,
-	.cc_mult = MV88E6XXX_CC_MULT,
-	.cc_mult_num = MV88E6XXX_CC_MULT_NUM,
-	.cc_mult_dem = MV88E6XXX_CC_MULT_DEM,
 };
 
 const struct mv88e6xxx_ptp_ops mv88e6250_ptp_ops = {
@@ -391,10 +441,6 @@
 		(1 << HWTSTAMP_FILTER_PTP_V2_EVENT) |
 		(1 << HWTSTAMP_FILTER_PTP_V2_SYNC) |
 		(1 << HWTSTAMP_FILTER_PTP_V2_DELAY_REQ),
-	.cc_shift = MV88E6250_CC_SHIFT,
-	.cc_mult = MV88E6250_CC_MULT,
-	.cc_mult_num = MV88E6250_CC_MULT_NUM,
-	.cc_mult_dem = MV88E6250_CC_MULT_DEM,
 };
 
 const struct mv88e6xxx_ptp_ops mv88e6352_ptp_ops = {
@@ -418,10 +464,6 @@
 		(1 << HWTSTAMP_FILTER_PTP_V2_EVENT) |
 		(1 << HWTSTAMP_FILTER_PTP_V2_SYNC) |
 		(1 << HWTSTAMP_FILTER_PTP_V2_DELAY_REQ),
-	.cc_shift = MV88E6XXX_CC_SHIFT,
-	.cc_mult = MV88E6XXX_CC_MULT,
-	.cc_mult_num = MV88E6XXX_CC_MULT_NUM,
-	.cc_mult_dem = MV88E6XXX_CC_MULT_DEM,
 };
 
 const struct mv88e6xxx_ptp_ops mv88e6390_ptp_ops = {
@@ -446,10 +488,6 @@
 		(1 << HWTSTAMP_FILTER_PTP_V2_EVENT) |
 		(1 << HWTSTAMP_FILTER_PTP_V2_SYNC) |
 		(1 << HWTSTAMP_FILTER_PTP_V2_DELAY_REQ),
-	.cc_shift = MV88E6XXX_CC_SHIFT,
-	.cc_mult = MV88E6XXX_CC_MULT,
-	.cc_mult_num = MV88E6XXX_CC_MULT_NUM,
-	.cc_mult_dem = MV88E6XXX_CC_MULT_DEM,
 };
 
 static u64 mv88e6xxx_ptp_clock_read(const struct cyclecounter *cc)
@@ -462,10 +500,10 @@
 	return 0;
 }
 
-/* With a 125MHz input clock, the 32-bit timestamp counter overflows in ~34.3
+/* With a 250MHz input clock, the 32-bit timestamp counter overflows in ~17.2
  * seconds; this task forces periodic reads so that we don't miss any.
  */
-#define MV88E6XXX_TAI_OVERFLOW_PERIOD (HZ * 16)
+#define MV88E6XXX_TAI_OVERFLOW_PERIOD (HZ * 8)
 static void mv88e6xxx_ptp_overflow_check(struct work_struct *work)
 {
 	struct delayed_work *dw = to_delayed_work(work);
@@ -484,11 +522,15 @@
 	int i;
 
 	/* Set up the cycle counter */
+	chip->cc_coeffs = mv88e6xxx_cc_coeff_get(chip);
+	if (IS_ERR(chip->cc_coeffs))
+		return PTR_ERR(chip->cc_coeffs);
+
 	memset(&chip->tstamp_cc, 0, sizeof(chip->tstamp_cc));
 	chip->tstamp_cc.read	= mv88e6xxx_ptp_clock_read;
 	chip->tstamp_cc.mask	= CYCLECOUNTER_MASK(32);
-	chip->tstamp_cc.mult	= ptp_ops->cc_mult;
-	chip->tstamp_cc.shift	= ptp_ops->cc_shift;
+	chip->tstamp_cc.mult	= chip->cc_coeffs->cc_mult;
+	chip->tstamp_cc.shift	= chip->cc_coeffs->cc_shift;
 
 	timecounter_init(&chip->tstamp_tc, &chip->tstamp_cc,
 			 ktime_to_ns(ktime_get_real()));
--- linux-qcom-6.8.0.orig/drivers/net/dsa/ocelot/felix.c
+++ linux-qcom-6.8.0/drivers/net/dsa/ocelot/felix.c
@@ -528,7 +528,9 @@
 	 * so we need to be careful that there are no extra frames to be
 	 * dequeued over MMIO, since we would never know to discard them.
 	 */
+	ocelot_lock_xtr_grp_bh(ocelot, 0);
 	ocelot_drain_cpu_queue(ocelot, 0);
+	ocelot_unlock_xtr_grp_bh(ocelot, 0);
 
 	return 0;
 }
@@ -1504,6 +1506,8 @@
 	int port = xmit_work->dp->index;
 	int retries = 10;
 
+	ocelot_lock_inj_grp(ocelot, 0);
+
 	do {
 		if (ocelot_can_inject(ocelot, 0))
 			break;
@@ -1512,6 +1516,7 @@
 	} while (--retries);
 
 	if (!retries) {
+		ocelot_unlock_inj_grp(ocelot, 0);
 		dev_err(ocelot->dev, "port %d failed to inject skb\n",
 			port);
 		ocelot_port_purge_txtstamp_skb(ocelot, port, skb);
@@ -1521,6 +1526,8 @@
 
 	ocelot_port_inject_frame(ocelot, port, 0, rew_op, skb);
 
+	ocelot_unlock_inj_grp(ocelot, 0);
+
 	consume_skb(skb);
 	kfree(xmit_work);
 }
@@ -1671,6 +1678,8 @@
 	if (!felix->info->quirk_no_xtr_irq)
 		return false;
 
+	ocelot_lock_xtr_grp(ocelot, grp);
+
 	while (ocelot_read(ocelot, QS_XTR_DATA_PRESENT) & BIT(grp)) {
 		struct sk_buff *skb;
 		unsigned int type;
@@ -1707,6 +1716,8 @@
 		ocelot_drain_cpu_queue(ocelot, 0);
 	}
 
+	ocelot_unlock_xtr_grp(ocelot, grp);
+
 	return true;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/dsa/ocelot/felix_vsc9959.c
+++ linux-qcom-6.8.0/drivers/net/dsa/ocelot/felix_vsc9959.c
@@ -24,7 +24,7 @@
 #define VSC9959_NUM_PORTS		6
 
 #define VSC9959_TAS_GCL_ENTRY_MAX	63
-#define VSC9959_TAS_MIN_GATE_LEN_NS	33
+#define VSC9959_TAS_MIN_GATE_LEN_NS	35
 #define VSC9959_VCAP_POLICER_BASE	63
 #define VSC9959_VCAP_POLICER_MAX	383
 #define VSC9959_SWITCH_PCI_BAR		4
@@ -1056,11 +1056,15 @@
 	mdiobus_free(felix->imdio);
 }
 
-/* The switch considers any frame (regardless of size) as eligible for
- * transmission if the traffic class gate is open for at least 33 ns.
+/* The switch considers any frame (regardless of size) as eligible
+ * for transmission if the traffic class gate is open for at least
+ * VSC9959_TAS_MIN_GATE_LEN_NS.
+ *
  * Overruns are prevented by cropping an interval at the end of the gate time
- * slot for which egress scheduling is blocked, but we need to still keep 33 ns
- * available for one packet to be transmitted, otherwise the port tc will hang.
+ * slot for which egress scheduling is blocked, but we need to still keep
+ * VSC9959_TAS_MIN_GATE_LEN_NS available for one packet to be transmitted,
+ * otherwise the port tc will hang.
+ *
  * This function returns the size of a gate interval that remains available for
  * setting the guard band, after reserving the space for one egress frame.
  */
@@ -1303,7 +1307,8 @@
 			 * per-tc static guard band lengths, so it reduces the
 			 * useful gate interval length. Therefore, be careful
 			 * to calculate a guard band (and therefore max_sdu)
-			 * that still leaves 33 ns available in the time slot.
+			 * that still leaves VSC9959_TAS_MIN_GATE_LEN_NS
+			 * available in the time slot.
 			 */
 			max_sdu = div_u64(remaining_gate_len_ps, picos_per_byte);
 			/* A TC gate may be completely closed, which is a
@@ -1474,10 +1479,13 @@
 	/* Hardware errata -  Admin config could not be overwritten if
 	 * config is pending, need reset the TAS module
 	 */
-	val = ocelot_read(ocelot, QSYS_PARAM_STATUS_REG_8);
-	if (val & QSYS_PARAM_STATUS_REG_8_CONFIG_PENDING) {
-		ret = -EBUSY;
-		goto err_reset_tc;
+	val = ocelot_read_rix(ocelot, QSYS_TAG_CONFIG, port);
+	if (val & QSYS_TAG_CONFIG_ENABLE) {
+		val = ocelot_read(ocelot, QSYS_PARAM_STATUS_REG_8);
+		if (val & QSYS_PARAM_STATUS_REG_8_CONFIG_PENDING) {
+			ret = -EBUSY;
+			goto err_reset_tc;
+		}
 	}
 
 	ocelot_rmw_rix(ocelot,
--- linux-qcom-6.8.0.orig/drivers/net/dsa/qca/qca8k-8xxx.c
+++ linux-qcom-6.8.0/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -673,7 +673,7 @@
 	 * We therefore need to lock the MDIO bus onto which the switch is
 	 * connected.
 	 */
-	mutex_lock(&priv->bus->mdio_lock);
+	mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
 
 	/* Actually start the request:
 	 * 1. Send mdio master packet
@@ -954,7 +954,7 @@
 
 	mdio = of_get_child_by_name(dev->of_node, "mdio");
 	if (mdio && !of_device_is_available(mdio))
-		goto out;
+		goto out_put_node;
 
 	bus = devm_mdiobus_alloc(dev);
 	if (!bus) {
@@ -988,7 +988,6 @@
 
 out_put_node:
 	of_node_put(mdio);
-out:
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/dsa/qca/qca8k-leds.c
+++ linux-qcom-6.8.0/drivers/net/dsa/qca/qca8k-leds.c
@@ -431,8 +431,11 @@
 		init_data.devicename = kasprintf(GFP_KERNEL, "%s:0%d",
 						 priv->internal_mdio_bus->id,
 						 port_num);
-		if (!init_data.devicename)
+		if (!init_data.devicename) {
+			fwnode_handle_put(led);
+			fwnode_handle_put(leds);
 			return -ENOMEM;
+		}
 
 		ret = devm_led_classdev_register_ext(priv->dev, &port_led->cdev, &init_data);
 		if (ret)
@@ -441,6 +444,7 @@
 		kfree(init_data.devicename);
 	}
 
+	fwnode_handle_put(leds);
 	return 0;
 }
 
@@ -471,9 +475,13 @@
 		 * the correct port for LED setup.
 		 */
 		ret = qca8k_parse_port_leds(priv, port, qca8k_port_to_phy(port_num));
-		if (ret)
+		if (ret) {
+			fwnode_handle_put(port);
+			fwnode_handle_put(ports);
 			return ret;
+		}
 	}
 
+	fwnode_handle_put(ports);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/dsa/realtek/rtl8366rb.c
+++ linux-qcom-6.8.0/drivers/net/dsa/realtek/rtl8366rb.c
@@ -182,7 +182,12 @@
 #define RTL8366RB_LED_BLINKRATE_222MS		0x0004
 #define RTL8366RB_LED_BLINKRATE_446MS		0x0005
 
+/* LED trigger event for each group */
 #define RTL8366RB_LED_CTRL_REG			0x0431
+#define RTL8366RB_LED_CTRL_OFFSET(led_group)	\
+	(4 * (led_group))
+#define RTL8366RB_LED_CTRL_MASK(led_group)	\
+	(0xf << RTL8366RB_LED_CTRL_OFFSET(led_group))
 #define RTL8366RB_LED_OFF			0x0
 #define RTL8366RB_LED_DUP_COL			0x1
 #define RTL8366RB_LED_LINK_ACT			0x2
@@ -199,6 +204,11 @@
 #define RTL8366RB_LED_LINK_TX			0xd
 #define RTL8366RB_LED_MASTER			0xe
 #define RTL8366RB_LED_FORCE			0xf
+
+/* The RTL8366RB_LED_X_X registers are used to manually set the LED state only
+ * when the corresponding LED group in RTL8366RB_LED_CTRL_REG is
+ * RTL8366RB_LED_FORCE. Otherwise, it is ignored.
+ */
 #define RTL8366RB_LED_0_1_CTRL_REG		0x0432
 #define RTL8366RB_LED_1_OFFSET			6
 #define RTL8366RB_LED_2_3_CTRL_REG		0x0433
@@ -999,27 +1009,19 @@
 	if (priv->leds_disabled) {
 		/* Turn everything off */
 		regmap_update_bits(priv->map,
-				   RTL8366RB_LED_0_1_CTRL_REG,
-				   0x0FFF, 0);
-		regmap_update_bits(priv->map,
-				   RTL8366RB_LED_2_3_CTRL_REG,
-				   0x0FFF, 0);
-		regmap_update_bits(priv->map,
 				   RTL8366RB_INTERRUPT_CONTROL_REG,
 				   RTL8366RB_P4_RGMII_LED,
 				   0);
-		val = RTL8366RB_LED_OFF;
-	} else {
-		/* TODO: make this configurable per LED */
-		val = RTL8366RB_LED_FORCE;
-	}
-	for (i = 0; i < 4; i++) {
-		ret = regmap_update_bits(priv->map,
-					 RTL8366RB_LED_CTRL_REG,
-					 0xf << (i * 4),
-					 val << (i * 4));
-		if (ret)
-			return ret;
+
+		for (i = 0; i < RTL8366RB_NUM_LEDGROUPS; i++) {
+			val = RTL8366RB_LED_OFF << RTL8366RB_LED_CTRL_OFFSET(i);
+			ret = regmap_update_bits(priv->map,
+						 RTL8366RB_LED_CTRL_REG,
+						 RTL8366RB_LED_CTRL_MASK(i),
+						 val);
+			if (ret)
+				return ret;
+		}
 	}
 
 	ret = rtl8366_reset_vlan(priv);
@@ -1166,52 +1168,6 @@
 	}
 }
 
-static void rb8366rb_set_port_led(struct realtek_priv *priv,
-				  int port, bool enable)
-{
-	u16 val = enable ? 0x3f : 0;
-	int ret;
-
-	if (priv->leds_disabled)
-		return;
-
-	switch (port) {
-	case 0:
-		ret = regmap_update_bits(priv->map,
-					 RTL8366RB_LED_0_1_CTRL_REG,
-					 0x3F, val);
-		break;
-	case 1:
-		ret = regmap_update_bits(priv->map,
-					 RTL8366RB_LED_0_1_CTRL_REG,
-					 0x3F << RTL8366RB_LED_1_OFFSET,
-					 val << RTL8366RB_LED_1_OFFSET);
-		break;
-	case 2:
-		ret = regmap_update_bits(priv->map,
-					 RTL8366RB_LED_2_3_CTRL_REG,
-					 0x3F, val);
-		break;
-	case 3:
-		ret = regmap_update_bits(priv->map,
-					 RTL8366RB_LED_2_3_CTRL_REG,
-					 0x3F << RTL8366RB_LED_3_OFFSET,
-					 val << RTL8366RB_LED_3_OFFSET);
-		break;
-	case 4:
-		ret = regmap_update_bits(priv->map,
-					 RTL8366RB_INTERRUPT_CONTROL_REG,
-					 RTL8366RB_P4_RGMII_LED,
-					 enable ? RTL8366RB_P4_RGMII_LED : 0);
-		break;
-	default:
-		dev_err(priv->dev, "no LED for port %d\n", port);
-		return;
-	}
-	if (ret)
-		dev_err(priv->dev, "error updating LED on port %d\n", port);
-}
-
 static int
 rtl8366rb_port_enable(struct dsa_switch *ds, int port,
 		      struct phy_device *phy)
@@ -1225,7 +1181,6 @@
 	if (ret)
 		return ret;
 
-	rb8366rb_set_port_led(priv, port, true);
 	return 0;
 }
 
@@ -1240,8 +1195,6 @@
 				 BIT(port));
 	if (ret)
 		return;
-
-	rb8366rb_set_port_led(priv, port, false);
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/net/dsa/sja1105/sja1105_mdio.c
+++ linux-qcom-6.8.0/drivers/net/dsa/sja1105/sja1105_mdio.c
@@ -94,7 +94,7 @@
 	return tmp & 0xffff;
 }
 
-int sja1110_pcs_mdio_write_c45(struct mii_bus *bus, int phy, int reg, int mmd,
+int sja1110_pcs_mdio_write_c45(struct mii_bus *bus, int phy, int mmd, int reg,
 			       u16 val)
 {
 	struct sja1105_mdio_private *mdio_priv = bus->priv;
--- linux-qcom-6.8.0.orig/drivers/net/dsa/vitesse-vsc73xx-core.c
+++ linux-qcom-6.8.0/drivers/net/dsa/vitesse-vsc73xx-core.c
@@ -17,6 +17,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/device.h>
+#include <linux/iopoll.h>
 #include <linux/of.h>
 #include <linux/of_mdio.h>
 #include <linux/bitops.h>
@@ -33,10 +34,14 @@
 #define VSC73XX_BLOCK_ANALYZER	0x2 /* Only subblock 0 */
 #define VSC73XX_BLOCK_MII	0x3 /* Subblocks 0 and 1 */
 #define VSC73XX_BLOCK_MEMINIT	0x3 /* Only subblock 2 */
-#define VSC73XX_BLOCK_CAPTURE	0x4 /* Only subblock 2 */
+#define VSC73XX_BLOCK_CAPTURE	0x4 /* Subblocks 0-4, 6, 7 */
 #define VSC73XX_BLOCK_ARBITER	0x5 /* Only subblock 0 */
 #define VSC73XX_BLOCK_SYSTEM	0x7 /* Only subblock 0 */
 
+/* MII Block subblock */
+#define VSC73XX_BLOCK_MII_INTERNAL	0x0 /* Internal MDIO subblock */
+#define VSC73XX_BLOCK_MII_EXTERNAL	0x1 /* External MDIO subblock */
+
 #define CPU_PORT	6 /* CPU port */
 
 /* MAC Block registers */
@@ -195,6 +200,8 @@
 #define VSC73XX_MII_CMD		0x1
 #define VSC73XX_MII_DATA	0x2
 
+#define VSC73XX_MII_STAT_BUSY	BIT(3)
+
 /* Arbiter block 5 registers */
 #define VSC73XX_ARBEMPTY		0x0c
 #define VSC73XX_ARBDISC			0x0e
@@ -268,6 +275,10 @@
 #define IS_7398(a) ((a)->chipid == VSC73XX_CHIPID_ID_7398)
 #define IS_739X(a) (IS_7395(a) || IS_7398(a))
 
+#define VSC73XX_POLL_SLEEP_US		1000
+#define VSC73XX_MDIO_POLL_SLEEP_US	5
+#define VSC73XX_POLL_TIMEOUT_US		10000
+
 struct vsc73xx_counter {
 	u8 counter;
 	const char *name;
@@ -359,13 +370,19 @@
 		break;
 
 	case VSC73XX_BLOCK_MII:
-	case VSC73XX_BLOCK_CAPTURE:
 	case VSC73XX_BLOCK_ARBITER:
 		switch (subblock) {
 		case 0 ... 1:
 			return 1;
 		}
 		break;
+	case VSC73XX_BLOCK_CAPTURE:
+		switch (subblock) {
+		case 0 ... 4:
+		case 6 ... 7:
+			return 1;
+		}
+		break;
 	}
 
 	return 0;
@@ -483,6 +500,22 @@
 	return 0;
 }
 
+static int vsc73xx_mdio_busy_check(struct vsc73xx *vsc)
+{
+	int ret, err;
+	u32 val;
+
+	ret = read_poll_timeout(vsc73xx_read, err,
+				err < 0 || !(val & VSC73XX_MII_STAT_BUSY),
+				VSC73XX_MDIO_POLL_SLEEP_US,
+				VSC73XX_POLL_TIMEOUT_US, false, vsc,
+				VSC73XX_BLOCK_MII, VSC73XX_BLOCK_MII_INTERNAL,
+				VSC73XX_MII_STAT, &val);
+	if (ret)
+		return ret;
+	return err;
+}
+
 static int vsc73xx_phy_read(struct dsa_switch *ds, int phy, int regnum)
 {
 	struct vsc73xx *vsc = ds->priv;
@@ -490,12 +523,20 @@
 	u32 val;
 	int ret;
 
+	ret = vsc73xx_mdio_busy_check(vsc);
+	if (ret)
+		return ret;
+
 	/* Setting bit 26 means "read" */
 	cmd = BIT(26) | (phy << 21) | (regnum << 16);
 	ret = vsc73xx_write(vsc, VSC73XX_BLOCK_MII, 0, 1, cmd);
 	if (ret)
 		return ret;
-	msleep(2);
+
+	ret = vsc73xx_mdio_busy_check(vsc);
+	if (ret)
+		return ret;
+
 	ret = vsc73xx_read(vsc, VSC73XX_BLOCK_MII, 0, 2, &val);
 	if (ret)
 		return ret;
@@ -519,6 +560,10 @@
 	u32 cmd;
 	int ret;
 
+	ret = vsc73xx_mdio_busy_check(vsc);
+	if (ret)
+		return ret;
+
 	/* It was found through tedious experiments that this router
 	 * chip really hates to have it's PHYs reset. They
 	 * never recover if that happens: autonegotiation stops
@@ -530,7 +575,7 @@
 		return 0;
 	}
 
-	cmd = (phy << 21) | (regnum << 16);
+	cmd = (phy << 21) | (regnum << 16) | val;
 	ret = vsc73xx_write(vsc, VSC73XX_BLOCK_MII, 0, 1, cmd);
 	if (ret)
 		return ret;
@@ -779,7 +824,7 @@
 	 * after a PHY or the CPU port comes up or down.
 	 */
 	if (!phydev->link) {
-		int maxloop = 10;
+		int ret, err;
 
 		dev_dbg(vsc->dev, "port %d: went down\n",
 			port);
@@ -794,19 +839,17 @@
 				    VSC73XX_ARBDISC, BIT(port), BIT(port));
 
 		/* Wait until queue is empty */
-		vsc73xx_read(vsc, VSC73XX_BLOCK_ARBITER, 0,
-			     VSC73XX_ARBEMPTY, &val);
-		while (!(val & BIT(port))) {
-			msleep(1);
-			vsc73xx_read(vsc, VSC73XX_BLOCK_ARBITER, 0,
-				     VSC73XX_ARBEMPTY, &val);
-			if (--maxloop == 0) {
-				dev_err(vsc->dev,
-					"timeout waiting for block arbiter\n");
-				/* Continue anyway */
-				break;
-			}
-		}
+		ret = read_poll_timeout(vsc73xx_read, err,
+					err < 0 || (val & BIT(port)),
+					VSC73XX_POLL_SLEEP_US,
+					VSC73XX_POLL_TIMEOUT_US, false,
+					vsc, VSC73XX_BLOCK_ARBITER, 0,
+					VSC73XX_ARBEMPTY, &val);
+		if (ret)
+			dev_err(vsc->dev,
+				"timeout waiting for block arbiter\n");
+		else if (err < 0)
+			dev_err(vsc->dev, "error reading arbiter\n");
 
 		/* Put this port into reset */
 		vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port, VSC73XX_MAC_CFG,
--- linux-qcom-6.8.0.orig/drivers/net/dummy.c
+++ linux-qcom-6.8.0/drivers/net/dummy.c
@@ -71,6 +71,7 @@
 	if (!dev->lstats)
 		return -ENOMEM;
 
+	netdev_lockdep_set_classes(dev);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/adi/adin1110.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/adi/adin1110.c
@@ -318,11 +318,11 @@
 	 * from the  ADIN1110 frame header.
 	 */
 	if (frame_size < ADIN1110_FRAME_HEADER_LEN + ADIN1110_FEC_LEN)
-		return ret;
+		return -EINVAL;
 
 	round_len = adin1110_round_len(frame_size);
 	if (round_len < 0)
-		return ret;
+		return -EINVAL;
 
 	frame_size_no_fcs = frame_size - ADIN1110_FRAME_HEADER_LEN - ADIN1110_FEC_LEN;
 	memset(priv->data, 0, ADIN1110_RD_HEADER_LEN);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/aeroflex/greth.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/aeroflex/greth.c
@@ -484,7 +484,7 @@
 
 	if (unlikely(skb->len > MAX_FRAME_SIZE)) {
 		dev->stats.tx_errors++;
-		goto out;
+		goto len_error;
 	}
 
 	/* Save skb pointer. */
@@ -575,6 +575,7 @@
 map_error:
 	if (net_ratelimit())
 		dev_warn(greth->dev, "Could not create TX DMA mapping\n");
+len_error:
 	dev_kfree_skb(skb);
 out:
 	return err;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amazon/ena/ena_com.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -90,8 +90,7 @@
 	struct ena_com_admin_sq *sq = &admin_queue->sq;
 	u16 size = ADMIN_SQ_SIZE(admin_queue->q_depth);
 
-	sq->entries = dma_alloc_coherent(admin_queue->q_dmadev, size,
-					 &sq->dma_addr, GFP_KERNEL);
+	sq->entries = dma_alloc_coherent(admin_queue->q_dmadev, size, &sq->dma_addr, GFP_KERNEL);
 
 	if (!sq->entries) {
 		netdev_err(ena_dev->net_device, "Memory allocation failed\n");
@@ -113,8 +112,7 @@
 	struct ena_com_admin_cq *cq = &admin_queue->cq;
 	u16 size = ADMIN_CQ_SIZE(admin_queue->q_depth);
 
-	cq->entries = dma_alloc_coherent(admin_queue->q_dmadev, size,
-					 &cq->dma_addr, GFP_KERNEL);
+	cq->entries = dma_alloc_coherent(admin_queue->q_dmadev, size, &cq->dma_addr, GFP_KERNEL);
 
 	if (!cq->entries) {
 		netdev_err(ena_dev->net_device, "Memory allocation failed\n");
@@ -136,8 +134,7 @@
 
 	ena_dev->aenq.q_depth = ENA_ASYNC_QUEUE_DEPTH;
 	size = ADMIN_AENQ_SIZE(ENA_ASYNC_QUEUE_DEPTH);
-	aenq->entries = dma_alloc_coherent(ena_dev->dmadev, size,
-					   &aenq->dma_addr, GFP_KERNEL);
+	aenq->entries = dma_alloc_coherent(ena_dev->dmadev, size, &aenq->dma_addr, GFP_KERNEL);
 
 	if (!aenq->entries) {
 		netdev_err(ena_dev->net_device, "Memory allocation failed\n");
@@ -155,14 +152,13 @@
 
 	aenq_caps = 0;
 	aenq_caps |= ena_dev->aenq.q_depth & ENA_REGS_AENQ_CAPS_AENQ_DEPTH_MASK;
-	aenq_caps |= (sizeof(struct ena_admin_aenq_entry)
-		      << ENA_REGS_AENQ_CAPS_AENQ_ENTRY_SIZE_SHIFT) &
-		     ENA_REGS_AENQ_CAPS_AENQ_ENTRY_SIZE_MASK;
+	aenq_caps |=
+		(sizeof(struct ena_admin_aenq_entry) << ENA_REGS_AENQ_CAPS_AENQ_ENTRY_SIZE_SHIFT) &
+		ENA_REGS_AENQ_CAPS_AENQ_ENTRY_SIZE_MASK;
 	writel(aenq_caps, ena_dev->reg_bar + ENA_REGS_AENQ_CAPS_OFF);
 
 	if (unlikely(!aenq_handlers)) {
-		netdev_err(ena_dev->net_device,
-			   "AENQ handlers pointer is NULL\n");
+		netdev_err(ena_dev->net_device, "AENQ handlers pointer is NULL\n");
 		return -EINVAL;
 	}
 
@@ -189,14 +185,12 @@
 	}
 
 	if (unlikely(!admin_queue->comp_ctx)) {
-		netdev_err(admin_queue->ena_dev->net_device,
-			   "Completion context is NULL\n");
+		netdev_err(admin_queue->ena_dev->net_device, "Completion context is NULL\n");
 		return NULL;
 	}
 
 	if (unlikely(admin_queue->comp_ctx[command_id].occupied && capture)) {
-		netdev_err(admin_queue->ena_dev->net_device,
-			   "Completion context is occupied\n");
+		netdev_err(admin_queue->ena_dev->net_device, "Completion context is occupied\n");
 		return NULL;
 	}
 
@@ -226,8 +220,7 @@
 	/* In case of queue FULL */
 	cnt = (u16)atomic_read(&admin_queue->outstanding_cmds);
 	if (cnt >= admin_queue->q_depth) {
-		netdev_dbg(admin_queue->ena_dev->net_device,
-			   "Admin queue is full.\n");
+		netdev_dbg(admin_queue->ena_dev->net_device, "Admin queue is full.\n");
 		admin_queue->stats.out_of_space++;
 		return ERR_PTR(-ENOSPC);
 	}
@@ -274,8 +267,7 @@
 	struct ena_comp_ctx *comp_ctx;
 	u16 i;
 
-	admin_queue->comp_ctx =
-		devm_kzalloc(admin_queue->q_dmadev, size, GFP_KERNEL);
+	admin_queue->comp_ctx = devm_kzalloc(admin_queue->q_dmadev, size, GFP_KERNEL);
 	if (unlikely(!admin_queue->comp_ctx)) {
 		netdev_err(ena_dev->net_device, "Memory allocation failed\n");
 		return -ENOMEM;
@@ -320,7 +312,6 @@
 			      struct ena_com_io_sq *io_sq)
 {
 	size_t size;
-	int dev_node = 0;
 
 	memset(&io_sq->desc_addr, 0x0, sizeof(io_sq->desc_addr));
 
@@ -333,23 +324,17 @@
 	size = io_sq->desc_entry_size * io_sq->q_depth;
 
 	if (io_sq->mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_HOST) {
-		dev_node = dev_to_node(ena_dev->dmadev);
-		set_dev_node(ena_dev->dmadev, ctx->numa_node);
 		io_sq->desc_addr.virt_addr =
-			dma_alloc_coherent(ena_dev->dmadev, size,
-					   &io_sq->desc_addr.phys_addr,
+			dma_alloc_coherent(ena_dev->dmadev, size, &io_sq->desc_addr.phys_addr,
 					   GFP_KERNEL);
-		set_dev_node(ena_dev->dmadev, dev_node);
 		if (!io_sq->desc_addr.virt_addr) {
 			io_sq->desc_addr.virt_addr =
 				dma_alloc_coherent(ena_dev->dmadev, size,
-						   &io_sq->desc_addr.phys_addr,
-						   GFP_KERNEL);
+						   &io_sq->desc_addr.phys_addr, GFP_KERNEL);
 		}
 
 		if (!io_sq->desc_addr.virt_addr) {
-			netdev_err(ena_dev->net_device,
-				   "Memory allocation failed\n");
+			netdev_err(ena_dev->net_device, "Memory allocation failed\n");
 			return -ENOMEM;
 		}
 	}
@@ -362,21 +347,16 @@
 			ENA_COM_BOUNCE_BUFFER_CNTRL_CNT;
 		io_sq->bounce_buf_ctrl.next_to_use = 0;
 
-		size = io_sq->bounce_buf_ctrl.buffer_size *
+		size = (size_t)io_sq->bounce_buf_ctrl.buffer_size *
 			io_sq->bounce_buf_ctrl.buffers_num;
 
-		dev_node = dev_to_node(ena_dev->dmadev);
-		set_dev_node(ena_dev->dmadev, ctx->numa_node);
-		io_sq->bounce_buf_ctrl.base_buffer =
-			devm_kzalloc(ena_dev->dmadev, size, GFP_KERNEL);
-		set_dev_node(ena_dev->dmadev, dev_node);
+		io_sq->bounce_buf_ctrl.base_buffer = devm_kzalloc(ena_dev->dmadev, size, GFP_KERNEL);
 		if (!io_sq->bounce_buf_ctrl.base_buffer)
 			io_sq->bounce_buf_ctrl.base_buffer =
 				devm_kzalloc(ena_dev->dmadev, size, GFP_KERNEL);
 
 		if (!io_sq->bounce_buf_ctrl.base_buffer) {
-			netdev_err(ena_dev->net_device,
-				   "Bounce buffer memory allocation failed\n");
+			netdev_err(ena_dev->net_device, "Bounce buffer memory allocation failed\n");
 			return -ENOMEM;
 		}
 
@@ -410,7 +390,6 @@
 			      struct ena_com_io_cq *io_cq)
 {
 	size_t size;
-	int prev_node = 0;
 
 	memset(&io_cq->cdesc_addr, 0x0, sizeof(io_cq->cdesc_addr));
 
@@ -422,16 +401,11 @@
 
 	size = io_cq->cdesc_entry_size_in_bytes * io_cq->q_depth;
 
-	prev_node = dev_to_node(ena_dev->dmadev);
-	set_dev_node(ena_dev->dmadev, ctx->numa_node);
 	io_cq->cdesc_addr.virt_addr =
-		dma_alloc_coherent(ena_dev->dmadev, size,
-				   &io_cq->cdesc_addr.phys_addr, GFP_KERNEL);
-	set_dev_node(ena_dev->dmadev, prev_node);
+		dma_alloc_coherent(ena_dev->dmadev, size, &io_cq->cdesc_addr.phys_addr, GFP_KERNEL);
 	if (!io_cq->cdesc_addr.virt_addr) {
 		io_cq->cdesc_addr.virt_addr =
-			dma_alloc_coherent(ena_dev->dmadev, size,
-					   &io_cq->cdesc_addr.phys_addr,
+			dma_alloc_coherent(ena_dev->dmadev, size, &io_cq->cdesc_addr.phys_addr,
 					   GFP_KERNEL);
 	}
 
@@ -514,8 +488,8 @@
 					u8 comp_status)
 {
 	if (unlikely(comp_status != 0))
-		netdev_err(admin_queue->ena_dev->net_device,
-			   "Admin command failed[%u]\n", comp_status);
+		netdev_err(admin_queue->ena_dev->net_device, "Admin command failed[%u]\n",
+			   comp_status);
 
 	switch (comp_status) {
 	case ENA_ADMIN_SUCCESS:
@@ -580,8 +554,7 @@
 	}
 
 	if (unlikely(comp_ctx->status == ENA_CMD_ABORTED)) {
-		netdev_err(admin_queue->ena_dev->net_device,
-			   "Command was aborted\n");
+		netdev_err(admin_queue->ena_dev->net_device, "Command was aborted\n");
 		spin_lock_irqsave(&admin_queue->q_lock, flags);
 		admin_queue->stats.aborted_cmd++;
 		spin_unlock_irqrestore(&admin_queue->q_lock, flags);
@@ -589,8 +562,7 @@
 		goto err;
 	}
 
-	WARN(comp_ctx->status != ENA_CMD_COMPLETED, "Invalid comp status %d\n",
-	     comp_ctx->status);
+	WARN(comp_ctx->status != ENA_CMD_COMPLETED, "Invalid comp status %d\n", comp_ctx->status);
 
 	ret = ena_com_comp_status_to_errno(admin_queue, comp_ctx->comp_status);
 err:
@@ -634,8 +606,7 @@
 					    sizeof(resp));
 
 	if (unlikely(ret))
-		netdev_err(ena_dev->net_device,
-			   "Failed to set LLQ configurations: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to set LLQ configurations: %d\n", ret);
 
 	return ret;
 }
@@ -658,8 +629,7 @@
 			llq_default_cfg->llq_header_location;
 	} else {
 		netdev_err(ena_dev->net_device,
-			   "Invalid header location control, supported: 0x%x\n",
-			   supported_feat);
+			   "Invalid header location control, supported: 0x%x\n", supported_feat);
 		return -EINVAL;
 	}
 
@@ -681,8 +651,8 @@
 
 			netdev_err(ena_dev->net_device,
 				   "Default llq stride ctrl is not supported, performing fallback, default: 0x%x, supported: 0x%x, used: 0x%x\n",
-				   llq_default_cfg->llq_stride_ctrl,
-				   supported_feat, llq_info->desc_stride_ctrl);
+				   llq_default_cfg->llq_stride_ctrl, supported_feat,
+				   llq_info->desc_stride_ctrl);
 		}
 	} else {
 		llq_info->desc_stride_ctrl = 0;
@@ -704,8 +674,7 @@
 			llq_info->desc_list_entry_size = 256;
 		} else {
 			netdev_err(ena_dev->net_device,
-				   "Invalid entry_size_ctrl, supported: 0x%x\n",
-				   supported_feat);
+				   "Invalid entry_size_ctrl, supported: 0x%x\n", supported_feat);
 			return -EINVAL;
 		}
 
@@ -750,8 +719,8 @@
 
 		netdev_err(ena_dev->net_device,
 			   "Default llq num descs before header is not supported, performing fallback, default: 0x%x, supported: 0x%x, used: 0x%x\n",
-			   llq_default_cfg->llq_num_decs_before_header,
-			   supported_feat, llq_info->descs_num_before_header);
+			   llq_default_cfg->llq_num_decs_before_header, supported_feat,
+			   llq_info->descs_num_before_header);
 	}
 	/* Check for accelerated queue supported */
 	llq_accel_mode_get = llq_features->accel_mode.u.get;
@@ -767,8 +736,7 @@
 
 	rc = ena_com_set_llq(ena_dev);
 	if (rc)
-		netdev_err(ena_dev->net_device,
-			   "Cannot set LLQ configuration: %d\n", rc);
+		netdev_err(ena_dev->net_device, "Cannot set LLQ configuration: %d\n", rc);
 
 	return rc;
 }
@@ -780,8 +748,7 @@
 	int ret;
 
 	wait_for_completion_timeout(&comp_ctx->wait_event,
-				    usecs_to_jiffies(
-					    admin_queue->completion_timeout));
+				    usecs_to_jiffies(admin_queue->completion_timeout));
 
 	/* In case the command wasn't completed find out the root cause.
 	 * There might be 2 kinds of errors
@@ -797,8 +764,7 @@
 		if (comp_ctx->status == ENA_CMD_COMPLETED) {
 			netdev_err(admin_queue->ena_dev->net_device,
 				   "The ena device sent a completion but the driver didn't receive a MSI-X interrupt (cmd %d), autopolling mode is %s\n",
-				   comp_ctx->cmd_opcode,
-				   admin_queue->auto_polling ? "ON" : "OFF");
+				   comp_ctx->cmd_opcode, admin_queue->auto_polling ? "ON" : "OFF");
 			/* Check if fallback to polling is enabled */
 			if (admin_queue->auto_polling)
 				admin_queue->polling = true;
@@ -867,15 +833,13 @@
 	if (unlikely(i == timeout)) {
 		netdev_err(ena_dev->net_device,
 			   "Reading reg failed for timeout. expected: req id[%u] offset[%u] actual: req id[%u] offset[%u]\n",
-			   mmio_read->seq_num, offset, read_resp->req_id,
-			   read_resp->reg_off);
+			   mmio_read->seq_num, offset, read_resp->req_id, read_resp->reg_off);
 		ret = ENA_MMIO_READ_TIMEOUT;
 		goto err;
 	}
 
 	if (read_resp->reg_off != offset) {
-		netdev_err(ena_dev->net_device,
-			   "Read failure: wrong offset provided\n");
+		netdev_err(ena_dev->net_device, "Read failure: wrong offset provided\n");
 		ret = ENA_MMIO_READ_TIMEOUT;
 	} else {
 		ret = read_resp->reg_val;
@@ -934,8 +898,7 @@
 					    sizeof(destroy_resp));
 
 	if (unlikely(ret && (ret != -ENODEV)))
-		netdev_err(ena_dev->net_device,
-			   "Failed to destroy io sq error: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to destroy io sq error: %d\n", ret);
 
 	return ret;
 }
@@ -949,8 +912,7 @@
 	if (io_cq->cdesc_addr.virt_addr) {
 		size = io_cq->cdesc_entry_size_in_bytes * io_cq->q_depth;
 
-		dma_free_coherent(ena_dev->dmadev, size,
-				  io_cq->cdesc_addr.virt_addr,
+		dma_free_coherent(ena_dev->dmadev, size, io_cq->cdesc_addr.virt_addr,
 				  io_cq->cdesc_addr.phys_addr);
 
 		io_cq->cdesc_addr.virt_addr = NULL;
@@ -959,8 +921,7 @@
 	if (io_sq->desc_addr.virt_addr) {
 		size = io_sq->desc_entry_size * io_sq->q_depth;
 
-		dma_free_coherent(ena_dev->dmadev, size,
-				  io_sq->desc_addr.virt_addr,
+		dma_free_coherent(ena_dev->dmadev, size, io_sq->desc_addr.virt_addr,
 				  io_sq->desc_addr.phys_addr);
 
 		io_sq->desc_addr.virt_addr = NULL;
@@ -985,8 +946,7 @@
 		val = ena_com_reg_bar_read32(ena_dev, ENA_REGS_DEV_STS_OFF);
 
 		if (unlikely(val == ENA_MMIO_READ_TIMEOUT)) {
-			netdev_err(ena_dev->net_device,
-				   "Reg read timeout occurred\n");
+			netdev_err(ena_dev->net_device, "Reg read timeout occurred\n");
 			return -ETIME;
 		}
 
@@ -1026,8 +986,7 @@
 	int ret;
 
 	if (!ena_com_check_supported_feature_id(ena_dev, feature_id)) {
-		netdev_dbg(ena_dev->net_device, "Feature %d isn't supported\n",
-			   feature_id);
+		netdev_dbg(ena_dev->net_device, "Feature %d isn't supported\n", feature_id);
 		return -EOPNOTSUPP;
 	}
 
@@ -1064,8 +1023,7 @@
 
 	if (unlikely(ret))
 		netdev_err(ena_dev->net_device,
-			   "Failed to submit get_feature command %d error: %d\n",
-			   feature_id, ret);
+			   "Failed to submit get_feature command %d error: %d\n", feature_id, ret);
 
 	return ret;
 }
@@ -1104,13 +1062,11 @@
 {
 	struct ena_rss *rss = &ena_dev->rss;
 
-	if (!ena_com_check_supported_feature_id(ena_dev,
-						ENA_ADMIN_RSS_HASH_FUNCTION))
+	if (!ena_com_check_supported_feature_id(ena_dev, ENA_ADMIN_RSS_HASH_FUNCTION))
 		return -EOPNOTSUPP;
 
-	rss->hash_key =
-		dma_alloc_coherent(ena_dev->dmadev, sizeof(*rss->hash_key),
-				   &rss->hash_key_dma_addr, GFP_KERNEL);
+	rss->hash_key = dma_alloc_coherent(ena_dev->dmadev, sizeof(*rss->hash_key),
+					   &rss->hash_key_dma_addr, GFP_KERNEL);
 
 	if (unlikely(!rss->hash_key))
 		return -ENOMEM;
@@ -1123,8 +1079,8 @@
 	struct ena_rss *rss = &ena_dev->rss;
 
 	if (rss->hash_key)
-		dma_free_coherent(ena_dev->dmadev, sizeof(*rss->hash_key),
-				  rss->hash_key, rss->hash_key_dma_addr);
+		dma_free_coherent(ena_dev->dmadev, sizeof(*rss->hash_key), rss->hash_key,
+				  rss->hash_key_dma_addr);
 	rss->hash_key = NULL;
 }
 
@@ -1132,9 +1088,8 @@
 {
 	struct ena_rss *rss = &ena_dev->rss;
 
-	rss->hash_ctrl =
-		dma_alloc_coherent(ena_dev->dmadev, sizeof(*rss->hash_ctrl),
-				   &rss->hash_ctrl_dma_addr, GFP_KERNEL);
+	rss->hash_ctrl = dma_alloc_coherent(ena_dev->dmadev, sizeof(*rss->hash_ctrl),
+					    &rss->hash_ctrl_dma_addr, GFP_KERNEL);
 
 	if (unlikely(!rss->hash_ctrl))
 		return -ENOMEM;
@@ -1147,8 +1102,8 @@
 	struct ena_rss *rss = &ena_dev->rss;
 
 	if (rss->hash_ctrl)
-		dma_free_coherent(ena_dev->dmadev, sizeof(*rss->hash_ctrl),
-				  rss->hash_ctrl, rss->hash_ctrl_dma_addr);
+		dma_free_coherent(ena_dev->dmadev, sizeof(*rss->hash_ctrl), rss->hash_ctrl,
+				  rss->hash_ctrl_dma_addr);
 	rss->hash_ctrl = NULL;
 }
 
@@ -1177,15 +1132,13 @@
 	tbl_size = (1ULL << log_size) *
 		sizeof(struct ena_admin_rss_ind_table_entry);
 
-	rss->rss_ind_tbl =
-		dma_alloc_coherent(ena_dev->dmadev, tbl_size,
-				   &rss->rss_ind_tbl_dma_addr, GFP_KERNEL);
+	rss->rss_ind_tbl = dma_alloc_coherent(ena_dev->dmadev, tbl_size, &rss->rss_ind_tbl_dma_addr,
+					      GFP_KERNEL);
 	if (unlikely(!rss->rss_ind_tbl))
 		goto mem_err1;
 
 	tbl_size = (1ULL << log_size) * sizeof(u16);
-	rss->host_rss_ind_tbl =
-		devm_kzalloc(ena_dev->dmadev, tbl_size, GFP_KERNEL);
+	rss->host_rss_ind_tbl = devm_kzalloc(ena_dev->dmadev, tbl_size, GFP_KERNEL);
 	if (unlikely(!rss->host_rss_ind_tbl))
 		goto mem_err2;
 
@@ -1197,8 +1150,7 @@
 	tbl_size = (1ULL << log_size) *
 		sizeof(struct ena_admin_rss_ind_table_entry);
 
-	dma_free_coherent(ena_dev->dmadev, tbl_size, rss->rss_ind_tbl,
-			  rss->rss_ind_tbl_dma_addr);
+	dma_free_coherent(ena_dev->dmadev, tbl_size, rss->rss_ind_tbl, rss->rss_ind_tbl_dma_addr);
 	rss->rss_ind_tbl = NULL;
 mem_err1:
 	rss->tbl_log_size = 0;
@@ -1261,8 +1213,7 @@
 					   &create_cmd.sq_ba,
 					   io_sq->desc_addr.phys_addr);
 		if (unlikely(ret)) {
-			netdev_err(ena_dev->net_device,
-				   "Memory address set failed\n");
+			netdev_err(ena_dev->net_device, "Memory address set failed\n");
 			return ret;
 		}
 	}
@@ -1273,8 +1224,7 @@
 					    (struct ena_admin_acq_entry *)&cmd_completion,
 					    sizeof(cmd_completion));
 	if (unlikely(ret)) {
-		netdev_err(ena_dev->net_device,
-			   "Failed to create IO SQ. error: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to create IO SQ. error: %d\n", ret);
 		return ret;
 	}
 
@@ -1292,8 +1242,7 @@
 			cmd_completion.llq_descriptors_offset);
 	}
 
-	netdev_dbg(ena_dev->net_device, "Created sq[%u], depth[%u]\n",
-		   io_sq->idx, io_sq->q_depth);
+	netdev_dbg(ena_dev->net_device, "Created sq[%u], depth[%u]\n", io_sq->idx, io_sq->q_depth);
 
 	return ret;
 }
@@ -1420,8 +1369,7 @@
 					    (struct ena_admin_acq_entry *)&cmd_completion,
 					    sizeof(cmd_completion));
 	if (unlikely(ret)) {
-		netdev_err(ena_dev->net_device,
-			   "Failed to create IO CQ. error: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to create IO CQ. error: %d\n", ret);
 		return ret;
 	}
 
@@ -1440,8 +1388,7 @@
 			(u32 __iomem *)((uintptr_t)ena_dev->reg_bar +
 			cmd_completion.numa_node_register_offset);
 
-	netdev_dbg(ena_dev->net_device, "Created cq[%u], depth[%u]\n",
-		   io_cq->idx, io_cq->q_depth);
+	netdev_dbg(ena_dev->net_device, "Created cq[%u], depth[%u]\n", io_cq->idx, io_cq->q_depth);
 
 	return ret;
 }
@@ -1451,8 +1398,7 @@
 			    struct ena_com_io_cq **io_cq)
 {
 	if (qid >= ENA_TOTAL_NUM_QUEUES) {
-		netdev_err(ena_dev->net_device,
-			   "Invalid queue number %d but the max is %d\n", qid,
+		netdev_err(ena_dev->net_device, "Invalid queue number %d but the max is %d\n", qid,
 			   ENA_TOTAL_NUM_QUEUES);
 		return -EINVAL;
 	}
@@ -1492,8 +1438,7 @@
 	spin_lock_irqsave(&admin_queue->q_lock, flags);
 	while (atomic_read(&admin_queue->outstanding_cmds) != 0) {
 		spin_unlock_irqrestore(&admin_queue->q_lock, flags);
-		ena_delay_exponential_backoff_us(exp++,
-						 ena_dev->ena_min_poll_delay_us);
+		ena_delay_exponential_backoff_us(exp++, ena_dev->ena_min_poll_delay_us);
 		spin_lock_irqsave(&admin_queue->q_lock, flags);
 	}
 	spin_unlock_irqrestore(&admin_queue->q_lock, flags);
@@ -1519,8 +1464,7 @@
 					    sizeof(destroy_resp));
 
 	if (unlikely(ret && (ret != -ENODEV)))
-		netdev_err(ena_dev->net_device,
-			   "Failed to destroy IO CQ. error: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to destroy IO CQ. error: %d\n", ret);
 
 	return ret;
 }
@@ -1588,8 +1532,7 @@
 					    sizeof(resp));
 
 	if (unlikely(ret))
-		netdev_err(ena_dev->net_device,
-			   "Failed to config AENQ ret: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to config AENQ ret: %d\n", ret);
 
 	return ret;
 }
@@ -1610,8 +1553,7 @@
 	netdev_dbg(ena_dev->net_device, "ENA dma width: %d\n", width);
 
 	if ((width < 32) || width > ENA_MAX_PHYS_ADDR_SIZE_BITS) {
-		netdev_err(ena_dev->net_device, "DMA width illegal value: %d\n",
-			   width);
+		netdev_err(ena_dev->net_device, "DMA width illegal value: %d\n", width);
 		return -EINVAL;
 	}
 
@@ -1633,19 +1575,16 @@
 	ctrl_ver = ena_com_reg_bar_read32(ena_dev,
 					  ENA_REGS_CONTROLLER_VERSION_OFF);
 
-	if (unlikely((ver == ENA_MMIO_READ_TIMEOUT) ||
-		     (ctrl_ver == ENA_MMIO_READ_TIMEOUT))) {
+	if (unlikely((ver == ENA_MMIO_READ_TIMEOUT) || (ctrl_ver == ENA_MMIO_READ_TIMEOUT))) {
 		netdev_err(ena_dev->net_device, "Reg read timeout occurred\n");
 		return -ETIME;
 	}
 
 	dev_info(ena_dev->dmadev, "ENA device version: %d.%d\n",
-		 (ver & ENA_REGS_VERSION_MAJOR_VERSION_MASK) >>
-			 ENA_REGS_VERSION_MAJOR_VERSION_SHIFT,
+		 (ver & ENA_REGS_VERSION_MAJOR_VERSION_MASK) >> ENA_REGS_VERSION_MAJOR_VERSION_SHIFT,
 		 ver & ENA_REGS_VERSION_MINOR_VERSION_MASK);
 
-	dev_info(ena_dev->dmadev,
-		 "ENA controller version: %d.%d.%d implementation version %d\n",
+	dev_info(ena_dev->dmadev, "ENA controller version: %d.%d.%d implementation version %d\n",
 		 (ctrl_ver & ENA_REGS_CONTROLLER_VERSION_MAJOR_VERSION_MASK) >>
 			 ENA_REGS_CONTROLLER_VERSION_MAJOR_VERSION_SHIFT,
 		 (ctrl_ver & ENA_REGS_CONTROLLER_VERSION_MINOR_VERSION_MASK) >>
@@ -1694,20 +1633,17 @@
 
 	size = ADMIN_SQ_SIZE(admin_queue->q_depth);
 	if (sq->entries)
-		dma_free_coherent(ena_dev->dmadev, size, sq->entries,
-				  sq->dma_addr);
+		dma_free_coherent(ena_dev->dmadev, size, sq->entries, sq->dma_addr);
 	sq->entries = NULL;
 
 	size = ADMIN_CQ_SIZE(admin_queue->q_depth);
 	if (cq->entries)
-		dma_free_coherent(ena_dev->dmadev, size, cq->entries,
-				  cq->dma_addr);
+		dma_free_coherent(ena_dev->dmadev, size, cq->entries, cq->dma_addr);
 	cq->entries = NULL;
 
 	size = ADMIN_AENQ_SIZE(aenq->q_depth);
 	if (ena_dev->aenq.entries)
-		dma_free_coherent(ena_dev->dmadev, size, aenq->entries,
-				  aenq->dma_addr);
+		dma_free_coherent(ena_dev->dmadev, size, aenq->entries, aenq->dma_addr);
 	aenq->entries = NULL;
 }
 
@@ -1733,10 +1669,8 @@
 	struct ena_com_mmio_read *mmio_read = &ena_dev->mmio_read;
 
 	spin_lock_init(&mmio_read->lock);
-	mmio_read->read_resp =
-		dma_alloc_coherent(ena_dev->dmadev,
-				   sizeof(*mmio_read->read_resp),
-				   &mmio_read->read_resp_dma_addr, GFP_KERNEL);
+	mmio_read->read_resp = dma_alloc_coherent(ena_dev->dmadev, sizeof(*mmio_read->read_resp),
+						  &mmio_read->read_resp_dma_addr, GFP_KERNEL);
 	if (unlikely(!mmio_read->read_resp))
 		goto err;
 
@@ -1767,8 +1701,8 @@
 	writel(0x0, ena_dev->reg_bar + ENA_REGS_MMIO_RESP_LO_OFF);
 	writel(0x0, ena_dev->reg_bar + ENA_REGS_MMIO_RESP_HI_OFF);
 
-	dma_free_coherent(ena_dev->dmadev, sizeof(*mmio_read->read_resp),
-			  mmio_read->read_resp, mmio_read->read_resp_dma_addr);
+	dma_free_coherent(ena_dev->dmadev, sizeof(*mmio_read->read_resp), mmio_read->read_resp,
+			  mmio_read->read_resp_dma_addr);
 
 	mmio_read->read_resp = NULL;
 }
@@ -1800,8 +1734,7 @@
 	}
 
 	if (!(dev_sts & ENA_REGS_DEV_STS_READY_MASK)) {
-		netdev_err(ena_dev->net_device,
-			   "Device isn't ready, abort com init\n");
+		netdev_err(ena_dev->net_device, "Device isn't ready, abort com init\n");
 		return -ENODEV;
 	}
 
@@ -1878,8 +1811,7 @@
 	int ret;
 
 	if (ctx->qid >= ENA_TOTAL_NUM_QUEUES) {
-		netdev_err(ena_dev->net_device,
-			   "Qid (%d) is bigger than max num of queues (%d)\n",
+		netdev_err(ena_dev->net_device, "Qid (%d) is bigger than max num of queues (%d)\n",
 			   ctx->qid, ENA_TOTAL_NUM_QUEUES);
 		return -EINVAL;
 	}
@@ -1905,8 +1837,7 @@
 
 	if (ctx->direction == ENA_COM_IO_QUEUE_DIRECTION_TX)
 		/* header length is limited to 8 bits */
-		io_sq->tx_max_header_size =
-			min_t(u32, ena_dev->tx_max_header_size, SZ_256);
+		io_sq->tx_max_header_size = min_t(u32, ena_dev->tx_max_header_size, SZ_256);
 
 	ret = ena_com_init_io_sq(ena_dev, ctx, io_sq);
 	if (ret)
@@ -1938,8 +1869,7 @@
 	struct ena_com_io_cq *io_cq;
 
 	if (qid >= ENA_TOTAL_NUM_QUEUES) {
-		netdev_err(ena_dev->net_device,
-			   "Qid (%d) is bigger than max num of queues (%d)\n",
+		netdev_err(ena_dev->net_device, "Qid (%d) is bigger than max num of queues (%d)\n",
 			   qid, ENA_TOTAL_NUM_QUEUES);
 		return;
 	}
@@ -1983,8 +1913,7 @@
 		if (rc)
 			return rc;
 
-		if (get_resp.u.max_queue_ext.version !=
-		    ENA_FEATURE_MAX_QUEUE_EXT_VER)
+		if (get_resp.u.max_queue_ext.version != ENA_FEATURE_MAX_QUEUE_EXT_VER)
 			return -EINVAL;
 
 		memcpy(&get_feat_ctx->max_queue_ext, &get_resp.u.max_queue_ext,
@@ -2025,18 +1954,15 @@
 	rc = ena_com_get_feature(ena_dev, &get_resp, ENA_ADMIN_HW_HINTS, 0);
 
 	if (!rc)
-		memcpy(&get_feat_ctx->hw_hints, &get_resp.u.hw_hints,
-		       sizeof(get_resp.u.hw_hints));
+		memcpy(&get_feat_ctx->hw_hints, &get_resp.u.hw_hints, sizeof(get_resp.u.hw_hints));
 	else if (rc == -EOPNOTSUPP)
-		memset(&get_feat_ctx->hw_hints, 0x0,
-		       sizeof(get_feat_ctx->hw_hints));
+		memset(&get_feat_ctx->hw_hints, 0x0, sizeof(get_feat_ctx->hw_hints));
 	else
 		return rc;
 
 	rc = ena_com_get_feature(ena_dev, &get_resp, ENA_ADMIN_LLQ, 0);
 	if (!rc)
-		memcpy(&get_feat_ctx->llq, &get_resp.u.llq,
-		       sizeof(get_resp.u.llq));
+		memcpy(&get_feat_ctx->llq, &get_resp.u.llq, sizeof(get_resp.u.llq));
 	else if (rc == -EOPNOTSUPP)
 		memset(&get_feat_ctx->llq, 0x0, sizeof(get_feat_ctx->llq));
 	else
@@ -2084,8 +2010,7 @@
 	aenq_common = &aenq_e->aenq_common_desc;
 
 	/* Go over all the events */
-	while ((READ_ONCE(aenq_common->flags) &
-		ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) == phase) {
+	while ((READ_ONCE(aenq_common->flags) & ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) == phase) {
 		/* Make sure the phase bit (ownership) is as expected before
 		 * reading the rest of the descriptor.
 		 */
@@ -2094,8 +2019,7 @@
 		timestamp = (u64)aenq_common->timestamp_low |
 			((u64)aenq_common->timestamp_high << 32);
 
-		netdev_dbg(ena_dev->net_device,
-			   "AENQ! Group[%x] Syndrome[%x] timestamp: [%llus]\n",
+		netdev_dbg(ena_dev->net_device, "AENQ! Group[%x] Syndrome[%x] timestamp: [%llus]\n",
 			   aenq_common->group, aenq_common->syndrome, timestamp);
 
 		/* Handle specific event*/
@@ -2124,8 +2048,7 @@
 
 	/* write the aenq doorbell after all AENQ descriptors were read */
 	mb();
-	writel_relaxed((u32)aenq->head,
-		       ena_dev->reg_bar + ENA_REGS_AENQ_HEAD_DB_OFF);
+	writel_relaxed((u32)aenq->head, ena_dev->reg_bar + ENA_REGS_AENQ_HEAD_DB_OFF);
 }
 
 int ena_com_dev_reset(struct ena_com_dev *ena_dev,
@@ -2137,15 +2060,13 @@
 	stat = ena_com_reg_bar_read32(ena_dev, ENA_REGS_DEV_STS_OFF);
 	cap = ena_com_reg_bar_read32(ena_dev, ENA_REGS_CAPS_OFF);
 
-	if (unlikely((stat == ENA_MMIO_READ_TIMEOUT) ||
-		     (cap == ENA_MMIO_READ_TIMEOUT))) {
+	if (unlikely((stat == ENA_MMIO_READ_TIMEOUT) || (cap == ENA_MMIO_READ_TIMEOUT))) {
 		netdev_err(ena_dev->net_device, "Reg read32 timeout occurred\n");
 		return -ETIME;
 	}
 
 	if ((stat & ENA_REGS_DEV_STS_READY_MASK) == 0) {
-		netdev_err(ena_dev->net_device,
-			   "Device isn't ready, can't reset device\n");
+		netdev_err(ena_dev->net_device, "Device isn't ready, can't reset device\n");
 		return -EINVAL;
 	}
 
@@ -2168,8 +2089,7 @@
 	rc = wait_for_reset_state(ena_dev, timeout,
 				  ENA_REGS_DEV_STS_RESET_IN_PROGRESS_MASK);
 	if (rc != 0) {
-		netdev_err(ena_dev->net_device,
-			   "Reset indication didn't turn on\n");
+		netdev_err(ena_dev->net_device, "Reset indication didn't turn on\n");
 		return rc;
 	}
 
@@ -2177,8 +2097,7 @@
 	writel(0, ena_dev->reg_bar + ENA_REGS_DEV_CTL_OFF);
 	rc = wait_for_reset_state(ena_dev, timeout, 0);
 	if (rc != 0) {
-		netdev_err(ena_dev->net_device,
-			   "Reset indication didn't turn off\n");
+		netdev_err(ena_dev->net_device, "Reset indication didn't turn off\n");
 		return rc;
 	}
 
@@ -2215,8 +2134,7 @@
 					     sizeof(*get_resp));
 
 	if (unlikely(ret))
-		netdev_err(ena_dev->net_device,
-			   "Failed to get stats. error: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to get stats. error: %d\n", ret);
 
 	return ret;
 }
@@ -2228,8 +2146,7 @@
 	int ret;
 
 	if (!ena_com_get_cap(ena_dev, ENA_ADMIN_ENI_STATS)) {
-		netdev_err(ena_dev->net_device,
-			   "Capability %d isn't supported\n",
+		netdev_err(ena_dev->net_device, "Capability %d isn't supported\n",
 			   ENA_ADMIN_ENI_STATS);
 		return -EOPNOTSUPP;
 	}
@@ -2266,8 +2183,7 @@
 	int ret;
 
 	if (!ena_com_check_supported_feature_id(ena_dev, ENA_ADMIN_MTU)) {
-		netdev_dbg(ena_dev->net_device, "Feature %d isn't supported\n",
-			   ENA_ADMIN_MTU);
+		netdev_dbg(ena_dev->net_device, "Feature %d isn't supported\n", ENA_ADMIN_MTU);
 		return -EOPNOTSUPP;
 	}
 
@@ -2286,8 +2202,7 @@
 					    sizeof(resp));
 
 	if (unlikely(ret))
-		netdev_err(ena_dev->net_device,
-			   "Failed to set mtu %d. error: %d\n", mtu, ret);
+		netdev_err(ena_dev->net_device, "Failed to set mtu %d. error: %d\n", mtu, ret);
 
 	return ret;
 }
@@ -2301,8 +2216,7 @@
 	ret = ena_com_get_feature(ena_dev, &resp,
 				  ENA_ADMIN_STATELESS_OFFLOAD_CONFIG, 0);
 	if (unlikely(ret)) {
-		netdev_err(ena_dev->net_device,
-			   "Failed to get offload capabilities %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to get offload capabilities %d\n", ret);
 		return ret;
 	}
 
@@ -2320,8 +2234,7 @@
 	struct ena_admin_get_feat_resp get_resp;
 	int ret;
 
-	if (!ena_com_check_supported_feature_id(ena_dev,
-						ENA_ADMIN_RSS_HASH_FUNCTION)) {
+	if (!ena_com_check_supported_feature_id(ena_dev, ENA_ADMIN_RSS_HASH_FUNCTION)) {
 		netdev_dbg(ena_dev->net_device, "Feature %d isn't supported\n",
 			   ENA_ADMIN_RSS_HASH_FUNCTION);
 		return -EOPNOTSUPP;
@@ -2334,8 +2247,7 @@
 		return ret;
 
 	if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) {
-		netdev_err(ena_dev->net_device,
-			   "Func hash %d isn't supported by device, abort\n",
+		netdev_err(ena_dev->net_device, "Func hash %d isn't supported by device, abort\n",
 			   rss->hash_func);
 		return -EOPNOTSUPP;
 	}
@@ -2365,8 +2277,7 @@
 					    (struct ena_admin_acq_entry *)&resp,
 					    sizeof(resp));
 	if (unlikely(ret)) {
-		netdev_err(ena_dev->net_device,
-			   "Failed to set hash function %d. error: %d\n",
+		netdev_err(ena_dev->net_device, "Failed to set hash function %d. error: %d\n",
 			   rss->hash_func, ret);
 		return -EINVAL;
 	}
@@ -2398,16 +2309,15 @@
 		return rc;
 
 	if (!(BIT(func) & get_resp.u.flow_hash_func.supported_func)) {
-		netdev_err(ena_dev->net_device,
-			   "Flow hash function %d isn't supported\n", func);
+		netdev_err(ena_dev->net_device, "Flow hash function %d isn't supported\n", func);
 		return -EOPNOTSUPP;
 	}
 
 	if ((func == ENA_ADMIN_TOEPLITZ) && key) {
 		if (key_len != sizeof(hash_key->key)) {
 			netdev_err(ena_dev->net_device,
-				   "key len (%u) doesn't equal the supported size (%zu)\n",
-				   key_len, sizeof(hash_key->key));
+				   "key len (%u) doesn't equal the supported size (%zu)\n", key_len,
+				   sizeof(hash_key->key));
 			return -EINVAL;
 		}
 		memcpy(hash_key->key, key, key_len);
@@ -2495,8 +2405,7 @@
 	struct ena_admin_set_feat_resp resp;
 	int ret;
 
-	if (!ena_com_check_supported_feature_id(ena_dev,
-						ENA_ADMIN_RSS_HASH_INPUT)) {
+	if (!ena_com_check_supported_feature_id(ena_dev, ENA_ADMIN_RSS_HASH_INPUT)) {
 		netdev_dbg(ena_dev->net_device, "Feature %d isn't supported\n",
 			   ENA_ADMIN_RSS_HASH_INPUT);
 		return -EOPNOTSUPP;
@@ -2527,8 +2436,7 @@
 					    (struct ena_admin_acq_entry *)&resp,
 					    sizeof(resp));
 	if (unlikely(ret))
-		netdev_err(ena_dev->net_device,
-			   "Failed to set hash input. error: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to set hash input. error: %d\n", ret);
 
 	return ret;
 }
@@ -2605,8 +2513,7 @@
 	int rc;
 
 	if (proto >= ENA_ADMIN_RSS_PROTO_NUM) {
-		netdev_err(ena_dev->net_device, "Invalid proto num (%u)\n",
-			   proto);
+		netdev_err(ena_dev->net_device, "Invalid proto num (%u)\n", proto);
 		return -EINVAL;
 	}
 
@@ -2658,8 +2565,7 @@
 	struct ena_admin_set_feat_resp resp;
 	int ret;
 
-	if (!ena_com_check_supported_feature_id(
-		    ena_dev, ENA_ADMIN_RSS_INDIRECTION_TABLE_CONFIG)) {
+	if (!ena_com_check_supported_feature_id(ena_dev, ENA_ADMIN_RSS_INDIRECTION_TABLE_CONFIG)) {
 		netdev_dbg(ena_dev->net_device, "Feature %d isn't supported\n",
 			   ENA_ADMIN_RSS_INDIRECTION_TABLE_CONFIG);
 		return -EOPNOTSUPP;
@@ -2699,8 +2605,7 @@
 					    sizeof(resp));
 
 	if (unlikely(ret))
-		netdev_err(ena_dev->net_device,
-			   "Failed to set indirect table. error: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to set indirect table. error: %d\n", ret);
 
 	return ret;
 }
@@ -2779,9 +2684,8 @@
 {
 	struct ena_host_attribute *host_attr = &ena_dev->host_attr;
 
-	host_attr->host_info =
-		dma_alloc_coherent(ena_dev->dmadev, SZ_4K,
-				   &host_attr->host_info_dma_addr, GFP_KERNEL);
+	host_attr->host_info = dma_alloc_coherent(ena_dev->dmadev, SZ_4K,
+						  &host_attr->host_info_dma_addr, GFP_KERNEL);
 	if (unlikely(!host_attr->host_info))
 		return -ENOMEM;
 
@@ -2827,8 +2731,7 @@
 
 	if (host_attr->debug_area_virt_addr) {
 		dma_free_coherent(ena_dev->dmadev, host_attr->debug_area_size,
-				  host_attr->debug_area_virt_addr,
-				  host_attr->debug_area_dma_addr);
+				  host_attr->debug_area_virt_addr, host_attr->debug_area_dma_addr);
 		host_attr->debug_area_virt_addr = NULL;
 	}
 }
@@ -2877,8 +2780,7 @@
 					    sizeof(resp));
 
 	if (unlikely(ret))
-		netdev_err(ena_dev->net_device,
-			   "Failed to set host attributes: %d\n", ret);
+		netdev_err(ena_dev->net_device, "Failed to set host attributes: %d\n", ret);
 
 	return ret;
 }
@@ -2896,8 +2798,7 @@
 							  u32 *intr_moder_interval)
 {
 	if (!intr_delay_resolution) {
-		netdev_err(ena_dev->net_device,
-			   "Illegal interrupt delay granularity value\n");
+		netdev_err(ena_dev->net_device, "Illegal interrupt delay granularity value\n");
 		return -EFAULT;
 	}
 
@@ -2935,14 +2836,12 @@
 
 	if (rc) {
 		if (rc == -EOPNOTSUPP) {
-			netdev_dbg(ena_dev->net_device,
-				   "Feature %d isn't supported\n",
+			netdev_dbg(ena_dev->net_device, "Feature %d isn't supported\n",
 				   ENA_ADMIN_INTERRUPT_MODERATION);
 			rc = 0;
 		} else {
 			netdev_err(ena_dev->net_device,
-				   "Failed to get interrupt moderation admin cmd. rc: %d\n",
-				   rc);
+				   "Failed to get interrupt moderation admin cmd. rc: %d\n", rc);
 		}
 
 		/* no moderation supported, disable adaptive support */
@@ -2990,8 +2889,7 @@
 		(llq_info->descs_num_before_header * sizeof(struct ena_eth_io_tx_desc));
 
 	if (unlikely(ena_dev->tx_max_header_size == 0)) {
-		netdev_err(ena_dev->net_device,
-			   "The size of the LLQ entry is smaller than needed\n");
+		netdev_err(ena_dev->net_device, "The size of the LLQ entry is smaller than needed\n");
 		return -EINVAL;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amazon/ena/ena_com.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/amazon/ena/ena_com.h
@@ -46,7 +46,7 @@
 /*****************************************************************************/
 /* ENA adaptive interrupt moderation settings */
 
-#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 64
+#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 0
 #define ENA_INTR_INITIAL_RX_INTERVAL_USECS 0
 #define ENA_DEFAULT_INTR_DELAY_RESOLUTION 1
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amazon/ena/ena_eth_com.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amazon/ena/ena_eth_com.c
@@ -18,8 +18,7 @@
 	cdesc = (struct ena_eth_io_rx_cdesc_base *)(io_cq->cdesc_addr.virt_addr
 			+ (head_masked * io_cq->cdesc_entry_size_in_bytes));
 
-	desc_phase = (READ_ONCE(cdesc->status) &
-		      ENA_ETH_IO_RX_CDESC_BASE_PHASE_MASK) >>
+	desc_phase = (READ_ONCE(cdesc->status) & ENA_ETH_IO_RX_CDESC_BASE_PHASE_MASK) >>
 		     ENA_ETH_IO_RX_CDESC_BASE_PHASE_SHIFT;
 
 	if (desc_phase != expected_phase)
@@ -65,8 +64,8 @@
 
 		io_sq->entries_in_tx_burst_left--;
 		netdev_dbg(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
-			   "Decreasing entries_in_tx_burst_left of queue %d to %d\n",
-			   io_sq->qid, io_sq->entries_in_tx_burst_left);
+			   "Decreasing entries_in_tx_burst_left of queue %d to %d\n", io_sq->qid,
+			   io_sq->entries_in_tx_burst_left);
 	}
 
 	/* Make sure everything was written into the bounce buffer before
@@ -75,8 +74,8 @@
 	wmb();
 
 	/* The line is completed. Copy it to dev */
-	__iowrite64_copy(io_sq->desc_addr.pbuf_dev_addr + dst_offset,
-			 bounce_buffer, (llq_info->desc_list_entry_size) / 8);
+	__iowrite64_copy(io_sq->desc_addr.pbuf_dev_addr + dst_offset, bounce_buffer,
+			 (llq_info->desc_list_entry_size) / 8);
 
 	io_sq->tail++;
 
@@ -102,16 +101,14 @@
 	header_offset =
 		llq_info->descs_num_before_header * io_sq->desc_entry_size;
 
-	if (unlikely((header_offset + header_len) >
-		     llq_info->desc_list_entry_size)) {
+	if (unlikely((header_offset + header_len) > llq_info->desc_list_entry_size)) {
 		netdev_err(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
 			   "Trying to write header larger than llq entry can accommodate\n");
 		return -EFAULT;
 	}
 
 	if (unlikely(!bounce_buffer)) {
-		netdev_err(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
-			   "Bounce buffer is NULL\n");
+		netdev_err(ena_com_io_sq_to_ena_dev(io_sq)->net_device, "Bounce buffer is NULL\n");
 		return -EFAULT;
 	}
 
@@ -129,8 +126,7 @@
 	bounce_buffer = pkt_ctrl->curr_bounce_buf;
 
 	if (unlikely(!bounce_buffer)) {
-		netdev_err(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
-			   "Bounce buffer is NULL\n");
+		netdev_err(ena_com_io_sq_to_ena_dev(io_sq)->net_device, "Bounce buffer is NULL\n");
 		return NULL;
 	}
 
@@ -233,31 +229,43 @@
 		idx * io_cq->cdesc_entry_size_in_bytes);
 }
 
-static u16 ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq,
-					   u16 *first_cdesc_idx)
+static int ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq,
+				    u16 *first_cdesc_idx,
+				    u16 *num_descs)
 {
+	u16 count = io_cq->cur_rx_pkt_cdesc_count, head_masked;
 	struct ena_eth_io_rx_cdesc_base *cdesc;
-	u16 count = 0, head_masked;
 	u32 last = 0;
 
 	do {
+		u32 status;
+
 		cdesc = ena_com_get_next_rx_cdesc(io_cq);
 		if (!cdesc)
 			break;
+		status = READ_ONCE(cdesc->status);
 
 		ena_com_cq_inc_head(io_cq);
+		if (unlikely((status & ENA_ETH_IO_RX_CDESC_BASE_FIRST_MASK) >>
+		    ENA_ETH_IO_RX_CDESC_BASE_FIRST_SHIFT && count != 0)) {
+			struct ena_com_dev *dev = ena_com_io_cq_to_ena_dev(io_cq);
+
+			netdev_err(dev->net_device,
+				   "First bit is on in descriptor #%d on q_id: %d, req_id: %u\n",
+				   count, io_cq->qid, cdesc->req_id);
+			return -EFAULT;
+		}
 		count++;
-		last = (READ_ONCE(cdesc->status) &
-			ENA_ETH_IO_RX_CDESC_BASE_LAST_MASK) >>
-		       ENA_ETH_IO_RX_CDESC_BASE_LAST_SHIFT;
+		last = (status & ENA_ETH_IO_RX_CDESC_BASE_LAST_MASK) >>
+			ENA_ETH_IO_RX_CDESC_BASE_LAST_SHIFT;
 	} while (!last);
 
 	if (last) {
 		*first_cdesc_idx = io_cq->cur_rx_pkt_cdesc_start_idx;
-		count += io_cq->cur_rx_pkt_cdesc_count;
 
 		head_masked = io_cq->head & (io_cq->q_depth - 1);
 
+		*num_descs = count;
 		io_cq->cur_rx_pkt_cdesc_count = 0;
 		io_cq->cur_rx_pkt_cdesc_start_idx = head_masked;
 
@@ -265,11 +273,11 @@
 			   "ENA q_id: %d packets were completed. first desc idx %u descs# %d\n",
 			   io_cq->qid, *first_cdesc_idx, count);
 	} else {
-		io_cq->cur_rx_pkt_cdesc_count += count;
-		count = 0;
+		io_cq->cur_rx_pkt_cdesc_count = count;
+		*num_descs = 0;
 	}
 
-	return count;
+	return 0;
 }
 
 static int ena_com_create_meta(struct ena_com_io_sq *io_sq,
@@ -369,9 +377,8 @@
 
 	netdev_dbg(ena_com_io_cq_to_ena_dev(io_cq)->net_device,
 		   "l3_proto %d l4_proto %d l3_csum_err %d l4_csum_err %d hash %d frag %d cdesc_status %x\n",
-		   ena_rx_ctx->l3_proto, ena_rx_ctx->l4_proto,
-		   ena_rx_ctx->l3_csum_err, ena_rx_ctx->l4_csum_err,
-		   ena_rx_ctx->hash, ena_rx_ctx->frag, cdesc->status);
+		   ena_rx_ctx->l3_proto, ena_rx_ctx->l4_proto, ena_rx_ctx->l3_csum_err,
+		   ena_rx_ctx->l4_csum_err, ena_rx_ctx->hash, ena_rx_ctx->frag, cdesc->status);
 }
 
 /*****************************************************************************/
@@ -403,13 +410,12 @@
 
 	if (unlikely(header_len > io_sq->tx_max_header_size)) {
 		netdev_err(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
-			   "Header size is too large %d max header: %d\n",
-			   header_len, io_sq->tx_max_header_size);
+			   "Header size is too large %d max header: %d\n", header_len,
+			   io_sq->tx_max_header_size);
 		return -EINVAL;
 	}
 
-	if (unlikely(io_sq->mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV &&
-		     !buffer_to_push)) {
+	if (unlikely(io_sq->mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV && !buffer_to_push)) {
 		netdev_err(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
 			   "Push header wasn't provided in LLQ mode\n");
 		return -EINVAL;
@@ -546,23 +552,25 @@
 	u16 cdesc_idx = 0;
 	u16 nb_hw_desc;
 	u16 i = 0;
+	int rc;
 
 	WARN(io_cq->direction != ENA_COM_IO_QUEUE_DIRECTION_RX, "wrong Q type");
 
-	nb_hw_desc = ena_com_cdesc_rx_pkt_get(io_cq, &cdesc_idx);
+	rc = ena_com_cdesc_rx_pkt_get(io_cq, &cdesc_idx, &nb_hw_desc);
+	if (unlikely(rc != 0))
+		return -EFAULT;
+
 	if (nb_hw_desc == 0) {
 		ena_rx_ctx->descs = nb_hw_desc;
 		return 0;
 	}
 
 	netdev_dbg(ena_com_io_cq_to_ena_dev(io_cq)->net_device,
-		   "Fetch rx packet: queue %d completed desc: %d\n", io_cq->qid,
-		   nb_hw_desc);
+		   "Fetch rx packet: queue %d completed desc: %d\n", io_cq->qid, nb_hw_desc);
 
 	if (unlikely(nb_hw_desc > ena_rx_ctx->max_bufs)) {
 		netdev_err(ena_com_io_cq_to_ena_dev(io_cq)->net_device,
-			   "Too many RX cdescs (%d) > MAX(%d)\n", nb_hw_desc,
-			   ena_rx_ctx->max_bufs);
+			   "Too many RX cdescs (%d) > MAX(%d)\n", nb_hw_desc, ena_rx_ctx->max_bufs);
 		return -ENOSPC;
 	}
 
@@ -586,8 +594,8 @@
 	io_sq->next_to_comp += nb_hw_desc;
 
 	netdev_dbg(ena_com_io_cq_to_ena_dev(io_cq)->net_device,
-		   "[%s][QID#%d] Updating SQ head to: %d\n", __func__,
-		   io_sq->qid, io_sq->next_to_comp);
+		   "[%s][QID#%d] Updating SQ head to: %d\n", __func__, io_sq->qid,
+		   io_sq->next_to_comp);
 
 	/* Get rx flags from the last pkt */
 	ena_com_rx_set_flags(io_cq, ena_rx_ctx, cdesc);
@@ -624,8 +632,8 @@
 	desc->req_id = req_id;
 
 	netdev_dbg(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
-		   "[%s] Adding single RX desc, Queue: %u, req_id: %u\n",
-		   __func__, io_sq->qid, req_id);
+		   "[%s] Adding single RX desc, Queue: %u, req_id: %u\n", __func__, io_sq->qid,
+		   req_id);
 
 	desc->buff_addr_lo = (u32)ena_buf->paddr;
 	desc->buff_addr_hi =
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amazon/ena/ena_eth_com.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/amazon/ena/ena_eth_com.h
@@ -145,8 +145,8 @@
 	}
 
 	netdev_dbg(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
-		   "Queue: %d num_descs: %d num_entries_needed: %d\n",
-		   io_sq->qid, num_descs, num_entries_needed);
+		   "Queue: %d num_descs: %d num_entries_needed: %d\n", io_sq->qid, num_descs,
+		   num_entries_needed);
 
 	return num_entries_needed > io_sq->entries_in_tx_burst_left;
 }
@@ -157,15 +157,14 @@
 	u16 tail = io_sq->tail;
 
 	netdev_dbg(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
-		   "Write submission queue doorbell for queue: %d tail: %d\n",
-		   io_sq->qid, tail);
+		   "Write submission queue doorbell for queue: %d tail: %d\n", io_sq->qid, tail);
 
 	writel(tail, io_sq->db_addr);
 
 	if (is_llq_max_tx_burst_exists(io_sq)) {
 		netdev_dbg(ena_com_io_sq_to_ena_dev(io_sq)->net_device,
-			   "Reset available entries in tx burst for queue %d to %d\n",
-			   io_sq->qid, max_entries_in_tx_burst);
+			   "Reset available entries in tx burst for queue %d to %d\n", io_sq->qid,
+			   max_entries_in_tx_burst);
 		io_sq->entries_in_tx_burst_left = max_entries_in_tx_burst;
 	}
 
@@ -248,8 +247,8 @@
 
 	*req_id = READ_ONCE(cdesc->req_id);
 	if (unlikely(*req_id >= io_cq->q_depth)) {
-		netdev_err(ena_com_io_cq_to_ena_dev(io_cq)->net_device,
-			   "Invalid req id %d\n", cdesc->req_id);
+		netdev_err(ena_com_io_cq_to_ena_dev(io_cq)->net_device, "Invalid req id %d\n",
+			   cdesc->req_id);
 		return -EINVAL;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -116,11 +116,9 @@
 	if (unlikely(rc)) {
 		netif_err(adapter, tx_queued, adapter->netdev,
 			  "Failed to prepare tx bufs\n");
-		ena_increase_stat(&ring->tx_stats.prepare_ctx_err, 1,
-				  &ring->syncp);
+		ena_increase_stat(&ring->tx_stats.prepare_ctx_err, 1, &ring->syncp);
 		if (rc != -ENOMEM)
-			ena_reset_device(adapter,
-					 ENA_REGS_RESET_DRIVER_INVALID_STATE);
+			ena_reset_device(adapter, ENA_REGS_RESET_DRIVER_INVALID_STATE);
 		return rc;
 	}
 
@@ -485,8 +483,7 @@
 	 */
 	page = dev_alloc_page();
 	if (!page) {
-		ena_increase_stat(&rx_ring->rx_stats.page_alloc_fail, 1,
-				  &rx_ring->syncp);
+		ena_increase_stat(&rx_ring->rx_stats.page_alloc_fail, 1, &rx_ring->syncp);
 		return ERR_PTR(-ENOSPC);
 	}
 
@@ -545,8 +542,8 @@
 				    struct ena_rx_buffer *rx_info,
 				    unsigned long attrs)
 {
-	dma_unmap_page_attrs(rx_ring->dev, rx_info->dma_addr, ENA_PAGE_SIZE,
-			     DMA_BIDIRECTIONAL, attrs);
+	dma_unmap_page_attrs(rx_ring->dev, rx_info->dma_addr, ENA_PAGE_SIZE, DMA_BIDIRECTIONAL,
+			     attrs);
 }
 
 static void ena_free_rx_page(struct ena_ring *rx_ring,
@@ -696,8 +693,11 @@
 static void ena_free_tx_bufs(struct ena_ring *tx_ring)
 {
 	bool print_once = true;
+	bool is_xdp_ring;
 	u32 i;
 
+	is_xdp_ring = ENA_IS_XDP_INDEX(tx_ring->adapter, tx_ring->qid);
+
 	for (i = 0; i < tx_ring->ring_size; i++) {
 		struct ena_tx_buffer *tx_info = &tx_ring->tx_buffer_info[i];
 
@@ -717,10 +717,15 @@
 
 		ena_unmap_tx_buff(tx_ring, tx_info);
 
-		dev_kfree_skb_any(tx_info->skb);
+		if (is_xdp_ring)
+			xdp_return_frame(tx_info->xdpf);
+		else
+			dev_kfree_skb_any(tx_info->skb);
 	}
-	netdev_tx_reset_queue(netdev_get_tx_queue(tx_ring->netdev,
-						  tx_ring->qid));
+
+	if (!is_xdp_ring)
+		netdev_tx_reset_queue(netdev_get_tx_queue(tx_ring->netdev,
+							  tx_ring->qid));
 }
 
 static void ena_free_all_tx_bufs(struct ena_adapter *adapter)
@@ -819,8 +824,7 @@
 						&req_id);
 		if (rc) {
 			if (unlikely(rc == -EINVAL))
-				handle_invalid_req_id(tx_ring, req_id, NULL,
-						      false);
+				handle_invalid_req_id(tx_ring, req_id, NULL, false);
 			break;
 		}
 
@@ -1046,8 +1050,7 @@
 					DMA_FROM_DEVICE);
 
 		if (!reuse_rx_buf_page)
-			ena_unmap_rx_buff_attrs(rx_ring, rx_info,
-						DMA_ATTR_SKIP_CPU_SYNC);
+			ena_unmap_rx_buff_attrs(rx_ring, rx_info, DMA_ATTR_SKIP_CPU_SYNC);
 
 		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, rx_info->page,
 				page_offset + buf_offset, len, buf_len);
@@ -1320,9 +1323,10 @@
 	adapter = netdev_priv(rx_ring->netdev);
 
 	if (rc == -ENOSPC) {
-		ena_increase_stat(&rx_ring->rx_stats.bad_desc_num, 1,
-				  &rx_ring->syncp);
+		ena_increase_stat(&rx_ring->rx_stats.bad_desc_num, 1, &rx_ring->syncp);
 		ena_reset_device(adapter, ENA_REGS_RESET_TOO_MANY_RX_DESCS);
+	} else if (rc == -EFAULT) {
+		ena_reset_device(adapter, ENA_REGS_RESET_RX_DESCRIPTOR_MALFORMED);
 	} else {
 		ena_increase_stat(&rx_ring->rx_stats.bad_req_id, 1,
 				  &rx_ring->syncp);
@@ -1811,8 +1815,7 @@
 	if (!ena_dev->rss.tbl_log_size) {
 		rc = ena_rss_init_default(adapter);
 		if (rc && (rc != -EOPNOTSUPP)) {
-			netif_err(adapter, ifup, adapter->netdev,
-				  "Failed to init RSS rc: %d\n", rc);
+			netif_err(adapter, ifup, adapter->netdev, "Failed to init RSS rc: %d\n", rc);
 			return rc;
 		}
 	}
@@ -2670,22 +2673,6 @@
 	return NETDEV_TX_OK;
 }
 
-static u16 ena_select_queue(struct net_device *dev, struct sk_buff *skb,
-			    struct net_device *sb_dev)
-{
-	u16 qid;
-	/* we suspect that this is good for in--kernel network services that
-	 * want to loop incoming skb rx to tx in normal user generated traffic,
-	 * most probably we will not get to this
-	 */
-	if (skb_rx_queue_recorded(skb))
-		qid = skb_get_rx_queue(skb);
-	else
-		qid = netdev_pick_tx(dev, skb, NULL);
-
-	return qid;
-}
-
 static void ena_config_host_info(struct ena_com_dev *ena_dev, struct pci_dev *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -2764,8 +2751,7 @@
 	rc = ena_com_set_host_attributes(adapter->ena_dev);
 	if (rc) {
 		if (rc == -EOPNOTSUPP)
-			netif_warn(adapter, drv, adapter->netdev,
-				   "Cannot set host attributes\n");
+			netif_warn(adapter, drv, adapter->netdev, "Cannot set host attributes\n");
 		else
 			netif_err(adapter, drv, adapter->netdev,
 				  "Cannot set host attributes\n");
@@ -2863,7 +2849,6 @@
 	.ndo_open		= ena_open,
 	.ndo_stop		= ena_close,
 	.ndo_start_xmit		= ena_start_xmit,
-	.ndo_select_queue	= ena_select_queue,
 	.ndo_get_stats64	= ena_get_stats64,
 	.ndo_tx_timeout		= ena_tx_timeout,
 	.ndo_change_mtu		= ena_change_mtu,
@@ -3438,10 +3423,11 @@
 {
 	struct ena_ring *tx_ring;
 	struct ena_ring *rx_ring;
-	int i, budget, rc;
+	int qid, budget, rc;
 	int io_queue_count;
 
 	io_queue_count = adapter->xdp_num_queues + adapter->num_io_queues;
+
 	/* Make sure the driver doesn't turn the device in other process */
 	smp_rmb();
 
@@ -3454,27 +3440,29 @@
 	if (adapter->missing_tx_completion_to == ENA_HW_HINTS_NO_TIMEOUT)
 		return;
 
-	budget = ENA_MONITORED_TX_QUEUES;
+	budget = min_t(u32, io_queue_count, ENA_MONITORED_TX_QUEUES);
 
-	for (i = adapter->last_monitored_tx_qid; i < io_queue_count; i++) {
-		tx_ring = &adapter->tx_ring[i];
-		rx_ring = &adapter->rx_ring[i];
+	qid = adapter->last_monitored_tx_qid;
+
+	while (budget) {
+		qid = (qid + 1) % io_queue_count;
+
+		tx_ring = &adapter->tx_ring[qid];
+		rx_ring = &adapter->rx_ring[qid];
 
 		rc = check_missing_comp_in_tx_queue(adapter, tx_ring);
 		if (unlikely(rc))
 			return;
 
-		rc =  !ENA_IS_XDP_INDEX(adapter, i) ?
+		rc =  !ENA_IS_XDP_INDEX(adapter, qid) ?
 			check_for_rx_interrupt_queue(adapter, rx_ring) : 0;
 		if (unlikely(rc))
 			return;
 
 		budget--;
-		if (!budget)
-			break;
 	}
 
-	adapter->last_monitored_tx_qid = i % io_queue_count;
+	adapter->last_monitored_tx_qid = qid;
 }
 
 /* trigger napi schedule after 2 consecutive detections */
@@ -3762,8 +3750,8 @@
 		}
 	}
 
-	rc = ena_com_fill_hash_function(ena_dev, ENA_ADMIN_TOEPLITZ, NULL,
-					ENA_HASH_KEY_SIZE, 0xFFFFFFFF);
+	rc = ena_com_fill_hash_function(ena_dev, ENA_ADMIN_TOEPLITZ, NULL, ENA_HASH_KEY_SIZE,
+					0xFFFFFFFF);
 	if (unlikely(rc && (rc != -EOPNOTSUPP))) {
 		dev_err(dev, "Cannot fill hash function\n");
 		goto err_fill_indir;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amazon/ena/ena_regs_defs.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/amazon/ena/ena_regs_defs.h
@@ -21,6 +21,7 @@
 	ENA_REGS_RESET_USER_TRIGGER                 = 12,
 	ENA_REGS_RESET_GENERIC                      = 13,
 	ENA_REGS_RESET_MISS_INTERRUPT               = 14,
+	ENA_REGS_RESET_RX_DESCRIPTOR_MALFORMED	    = 16,
 };
 
 /* ena_registers offsets */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amazon/ena/ena_xdp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amazon/ena/ena_xdp.c
@@ -89,7 +89,7 @@
 
 	rc = ena_xdp_tx_map_frame(tx_ring, tx_info, xdpf, &ena_tx_ctx);
 	if (unlikely(rc))
-		return rc;
+		goto err;
 
 	ena_tx_ctx.req_id = req_id;
 
@@ -112,7 +112,9 @@
 
 error_unmap_dma:
 	ena_unmap_tx_buff(tx_ring, tx_info);
+err:
 	tx_info->xdpf = NULL;
+
 	return rc;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amd/mvme147.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amd/mvme147.c
@@ -105,10 +105,6 @@
 	macaddr[3] = address&0xff;
 	eth_hw_addr_set(dev, macaddr);
 
-	printk("%s: MVME147 at 0x%08lx, irq %d, Hardware Address %pM\n",
-	       dev->name, dev->base_addr, MVME147_LANCE_IRQ,
-	       dev->dev_addr);
-
 	lp = netdev_priv(dev);
 	lp->ram = __get_dma_pages(GFP_ATOMIC, 3);	/* 32K */
 	if (!lp->ram) {
@@ -138,6 +134,9 @@
 		return ERR_PTR(err);
 	}
 
+	netdev_info(dev, "MVME147 at 0x%08lx, irq %d, Hardware Address %pM\n",
+		    dev->base_addr, MVME147_LANCE_IRQ, dev->dev_addr);
+
 	return dev;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amd/pds_core/core.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amd/pds_core/core.c
@@ -595,6 +595,16 @@
 	pdsc_teardown(pdsc, PDSC_TEARDOWN_RECOVERY);
 }
 
+void pdsc_pci_reset_thread(struct work_struct *work)
+{
+	struct pdsc *pdsc = container_of(work, struct pdsc, pci_reset_work);
+	struct pci_dev *pdev = pdsc->pdev;
+
+	pci_dev_get(pdev);
+	pci_reset_function(pdev);
+	pci_dev_put(pdev);
+}
+
 static void pdsc_check_pci_health(struct pdsc *pdsc)
 {
 	u8 fw_status;
@@ -609,8 +619,8 @@
 	if (fw_status != PDS_RC_BAD_PCI)
 		return;
 
-	pdsc_reset_prepare(pdsc->pdev);
-	pdsc_reset_done(pdsc->pdev);
+	/* prevent deadlock between pdsc_reset_prepare and pdsc_health_thread */
+	queue_work(pdsc->wq, &pdsc->pci_reset_work);
 }
 
 void pdsc_health_thread(struct work_struct *work)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amd/pds_core/core.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/amd/pds_core/core.h
@@ -197,6 +197,7 @@
 	struct pdsc_qcq notifyqcq;
 	u64 last_eid;
 	struct pdsc_viftype *viftype_status;
+	struct work_struct pci_reset_work;
 };
 
 /** enum pds_core_dbell_bits - bitwise composition of dbell values.
@@ -283,9 +284,6 @@
 int pdsc_devcmd_reset(struct pdsc *pdsc);
 int pdsc_dev_init(struct pdsc *pdsc);
 
-void pdsc_reset_prepare(struct pci_dev *pdev);
-void pdsc_reset_done(struct pci_dev *pdev);
-
 int pdsc_intr_alloc(struct pdsc *pdsc, char *name,
 		    irq_handler_t handler, void *data);
 void pdsc_intr_free(struct pdsc *pdsc, int index);
@@ -315,5 +313,6 @@
 
 void pdsc_fw_down(struct pdsc *pdsc);
 void pdsc_fw_up(struct pdsc *pdsc);
+void pdsc_pci_reset_thread(struct work_struct *work);
 
 #endif /* _PDSC_H_ */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amd/pds_core/dev.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amd/pds_core/dev.c
@@ -229,6 +229,9 @@
 		.reset.opcode = PDS_CORE_CMD_RESET,
 	};
 
+	if (!pdsc_is_fw_running(pdsc))
+		return 0;
+
 	return pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amd/pds_core/devlink.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amd/pds_core/devlink.c
@@ -117,7 +117,7 @@
 	if (err && err != -EIO)
 		return err;
 
-	listlen = fw_list.num_fw_slots;
+	listlen = min(fw_list.num_fw_slots, ARRAY_SIZE(fw_list.fw_names));
 	for (i = 0; i < listlen; i++) {
 		if (i < ARRAY_SIZE(fw_slotnames))
 			strscpy(buf, fw_slotnames[i], sizeof(buf));
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amd/pds_core/main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amd/pds_core/main.c
@@ -238,6 +238,7 @@
 	snprintf(wq_name, sizeof(wq_name), "%s.%d", PDS_CORE_DRV_NAME, pdsc->uid);
 	pdsc->wq = create_singlethread_workqueue(wq_name);
 	INIT_WORK(&pdsc->health_work, pdsc_health_thread);
+	INIT_WORK(&pdsc->pci_reset_work, pdsc_pci_reset_thread);
 	timer_setup(&pdsc->wdtimer, pdsc_wdtimer_cb, 0);
 	pdsc->wdtimer_period = PDSC_WATCHDOG_SECS * HZ;
 
@@ -468,7 +469,7 @@
 	mod_timer(&pdsc->wdtimer, jiffies + 1);
 }
 
-void pdsc_reset_prepare(struct pci_dev *pdev)
+static void pdsc_reset_prepare(struct pci_dev *pdev)
 {
 	struct pdsc *pdsc = pci_get_drvdata(pdev);
 
@@ -477,10 +478,11 @@
 
 	pdsc_unmap_bars(pdsc);
 	pci_release_regions(pdev);
-	pci_disable_device(pdev);
+	if (pci_is_enabled(pdev))
+		pci_disable_device(pdev);
 }
 
-void pdsc_reset_done(struct pci_dev *pdev)
+static void pdsc_reset_done(struct pci_dev *pdev)
 {
 	struct pdsc *pdsc = pci_get_drvdata(pdev);
 	struct device *dev = pdsc->dev;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
@@ -923,7 +923,6 @@
 
 static bool xgbe_phy_finisar_phy_quirks(struct xgbe_prv_data *pdata)
 {
-	__ETHTOOL_DECLARE_LINK_MODE_MASK(supported) = { 0, };
 	struct xgbe_phy_data *phy_data = pdata->phy_data;
 	unsigned int phy_id = phy_data->phydev->phy_id;
 
@@ -945,14 +944,7 @@
 	phy_write(phy_data->phydev, 0x04, 0x0d01);
 	phy_write(phy_data->phydev, 0x00, 0x9140);
 
-	linkmode_set_bit_array(phy_10_100_features_array,
-			       ARRAY_SIZE(phy_10_100_features_array),
-			       supported);
-	linkmode_set_bit_array(phy_gbit_features_array,
-			       ARRAY_SIZE(phy_gbit_features_array),
-			       supported);
-
-	linkmode_copy(phy_data->phydev->supported, supported);
+	linkmode_copy(phy_data->phydev->supported, PHY_GBIT_FEATURES);
 
 	phy_support_asym_pause(phy_data->phydev);
 
@@ -964,7 +956,6 @@
 
 static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata)
 {
-	__ETHTOOL_DECLARE_LINK_MODE_MASK(supported) = { 0, };
 	struct xgbe_phy_data *phy_data = pdata->phy_data;
 	struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom;
 	unsigned int phy_id = phy_data->phydev->phy_id;
@@ -1028,13 +1019,7 @@
 	reg = phy_read(phy_data->phydev, 0x00);
 	phy_write(phy_data->phydev, 0x00, reg & ~0x00800);
 
-	linkmode_set_bit_array(phy_10_100_features_array,
-			       ARRAY_SIZE(phy_10_100_features_array),
-			       supported);
-	linkmode_set_bit_array(phy_gbit_features_array,
-			       ARRAY_SIZE(phy_gbit_features_array),
-			       supported);
-	linkmode_copy(phy_data->phydev->supported, supported);
+	linkmode_copy(phy_data->phydev->supported, PHY_GBIT_FEATURES);
 	phy_support_asym_pause(phy_data->phydev);
 
 	netif_dbg(pdata, drv, pdata->netdev,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
@@ -265,7 +265,7 @@
 		const int rx_stat_cnt = ARRAY_SIZE(aq_ethtool_queue_rx_stat_names);
 		const int tx_stat_cnt = ARRAY_SIZE(aq_ethtool_queue_tx_stat_names);
 		char tc_string[8];
-		int tc;
+		unsigned int tc;
 
 		memset(tc_string, 0, sizeof(tc_string));
 		memcpy(p, aq_ethtool_stat_names,
@@ -274,7 +274,7 @@
 
 		for (tc = 0; tc < cfg->tcs; tc++) {
 			if (cfg->is_qos)
-				snprintf(tc_string, 8, "TC%d ", tc);
+				snprintf(tc_string, 8, "TC%u ", tc);
 
 			for (i = 0; i < cfg->vecs; i++) {
 				for (si = 0; si < rx_stat_cnt; si++) {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/arc/emac_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/arc/emac_main.c
@@ -111,6 +111,7 @@
 {
 	struct arc_emac_priv *priv = netdev_priv(ndev);
 	struct net_device_stats *stats = &ndev->stats;
+	struct device *dev = ndev->dev.parent;
 	unsigned int i;
 
 	for (i = 0; i < TX_BD_NUM; i++) {
@@ -140,7 +141,7 @@
 			stats->tx_bytes += skb->len;
 		}
 
-		dma_unmap_single(&ndev->dev, dma_unmap_addr(tx_buff, addr),
+		dma_unmap_single(dev, dma_unmap_addr(tx_buff, addr),
 				 dma_unmap_len(tx_buff, len), DMA_TO_DEVICE);
 
 		/* return the sk_buff to system */
@@ -174,6 +175,7 @@
 static int arc_emac_rx(struct net_device *ndev, int budget)
 {
 	struct arc_emac_priv *priv = netdev_priv(ndev);
+	struct device *dev = ndev->dev.parent;
 	unsigned int work_done;
 
 	for (work_done = 0; work_done < budget; work_done++) {
@@ -223,9 +225,9 @@
 			continue;
 		}
 
-		addr = dma_map_single(&ndev->dev, (void *)skb->data,
+		addr = dma_map_single(dev, (void *)skb->data,
 				      EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
-		if (dma_mapping_error(&ndev->dev, addr)) {
+		if (dma_mapping_error(dev, addr)) {
 			if (net_ratelimit())
 				netdev_err(ndev, "cannot map dma buffer\n");
 			dev_kfree_skb(skb);
@@ -237,7 +239,7 @@
 		}
 
 		/* unmap previosly mapped skb */
-		dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
+		dma_unmap_single(dev, dma_unmap_addr(rx_buff, addr),
 				 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
 
 		pktlen = info & LEN_MASK;
@@ -423,6 +425,7 @@
 {
 	struct arc_emac_priv *priv = netdev_priv(ndev);
 	struct phy_device *phy_dev = ndev->phydev;
+	struct device *dev = ndev->dev.parent;
 	int i;
 
 	phy_dev->autoneg = AUTONEG_ENABLE;
@@ -445,9 +448,9 @@
 		if (unlikely(!rx_buff->skb))
 			return -ENOMEM;
 
-		addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
+		addr = dma_map_single(dev, (void *)rx_buff->skb->data,
 				      EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
-		if (dma_mapping_error(&ndev->dev, addr)) {
+		if (dma_mapping_error(dev, addr)) {
 			netdev_err(ndev, "cannot dma map\n");
 			dev_kfree_skb(rx_buff->skb);
 			return -ENOMEM;
@@ -548,6 +551,7 @@
 static void arc_free_tx_queue(struct net_device *ndev)
 {
 	struct arc_emac_priv *priv = netdev_priv(ndev);
+	struct device *dev = ndev->dev.parent;
 	unsigned int i;
 
 	for (i = 0; i < TX_BD_NUM; i++) {
@@ -555,7 +559,7 @@
 		struct buffer_state *tx_buff = &priv->tx_buff[i];
 
 		if (tx_buff->skb) {
-			dma_unmap_single(&ndev->dev,
+			dma_unmap_single(dev,
 					 dma_unmap_addr(tx_buff, addr),
 					 dma_unmap_len(tx_buff, len),
 					 DMA_TO_DEVICE);
@@ -579,6 +583,7 @@
 static void arc_free_rx_queue(struct net_device *ndev)
 {
 	struct arc_emac_priv *priv = netdev_priv(ndev);
+	struct device *dev = ndev->dev.parent;
 	unsigned int i;
 
 	for (i = 0; i < RX_BD_NUM; i++) {
@@ -586,7 +591,7 @@
 		struct buffer_state *rx_buff = &priv->rx_buff[i];
 
 		if (rx_buff->skb) {
-			dma_unmap_single(&ndev->dev,
+			dma_unmap_single(dev,
 					 dma_unmap_addr(rx_buff, addr),
 					 dma_unmap_len(rx_buff, len),
 					 DMA_FROM_DEVICE);
@@ -679,6 +684,7 @@
 	unsigned int len, *txbd_curr = &priv->txbd_curr;
 	struct net_device_stats *stats = &ndev->stats;
 	__le32 *info = &priv->txbd[*txbd_curr].info;
+	struct device *dev = ndev->dev.parent;
 	dma_addr_t addr;
 
 	if (skb_padto(skb, ETH_ZLEN))
@@ -692,10 +698,9 @@
 		return NETDEV_TX_BUSY;
 	}
 
-	addr = dma_map_single(&ndev->dev, (void *)skb->data, len,
-			      DMA_TO_DEVICE);
+	addr = dma_map_single(dev, (void *)skb->data, len, DMA_TO_DEVICE);
 
-	if (unlikely(dma_mapping_error(&ndev->dev, addr))) {
+	if (unlikely(dma_mapping_error(dev, addr))) {
 		stats->tx_dropped++;
 		stats->tx_errors++;
 		dev_kfree_skb_any(skb);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/arc/emac_mdio.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/arc/emac_mdio.c
@@ -133,6 +133,7 @@
 	struct arc_emac_mdio_bus_data *data = &priv->bus_data;
 	struct device_node *np = priv->dev->of_node;
 	const char *name = "Synopsys MII Bus";
+	struct device_node *mdio_node;
 	struct mii_bus *bus;
 	int error;
 
@@ -164,7 +165,13 @@
 
 	snprintf(bus->id, MII_BUS_ID_SIZE, "%s", bus->name);
 
-	error = of_mdiobus_register(bus, priv->dev->of_node);
+	/* Backwards compatibility for EMAC nodes without MDIO subnode. */
+	mdio_node = of_get_child_by_name(np, "mdio");
+	if (!mdio_node)
+		mdio_node = of_node_get(np);
+
+	error = of_mdiobus_register(bus, mdio_node);
+	of_node_put(mdio_node);
 	if (error) {
 		mdiobus_free(bus);
 		return dev_err_probe(priv->dev, error,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/asp2/bcmasp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/asp2/bcmasp.c
@@ -1306,6 +1306,7 @@
 			dev_err(dev, "Cannot create eth interface %d\n", i);
 			bcmasp_remove_intfs(priv);
 			of_node_put(intf_node);
+			ret = -ENOMEM;
 			goto of_put_exit;
 		}
 		list_add_tail(&intf->list, &priv->intfs);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
@@ -322,6 +322,7 @@
 			}
 			/* Rewind so we do not have a hole */
 			spb_index = intf->tx_spb_index;
+			dev_kfree_skb(skb);
 			return NETDEV_TX_OK;
 		}
 
@@ -391,7 +392,9 @@
 	umac_wl(intf, 0x0, UMC_CMD);
 	umac_wl(intf, UMC_CMD_SW_RESET, UMC_CMD);
 	usleep_range(10, 100);
-	umac_wl(intf, 0x0, UMC_CMD);
+	/* We hold the umac in reset and bring it out of
+	 * reset when phy link is up.
+	 */
 }
 
 static void umac_set_hw_addr(struct bcmasp_intf *intf,
@@ -411,6 +414,8 @@
 	u32 reg;
 
 	reg = umac_rl(intf, UMC_CMD);
+	if (reg & UMC_CMD_SW_RESET)
+		return;
 	if (enable)
 		reg |= mask;
 	else
@@ -429,13 +434,10 @@
 	umac_wl(intf, 0x800, UMC_FRM_LEN);
 	umac_wl(intf, 0xffff, UMC_PAUSE_CNTRL);
 	umac_wl(intf, 0x800, UMC_RX_MAX_PKT_SZ);
-	umac_enable_set(intf, UMC_CMD_PROMISC, 1);
 }
 
-static int bcmasp_tx_poll(struct napi_struct *napi, int budget)
+static int bcmasp_tx_reclaim(struct bcmasp_intf *intf)
 {
-	struct bcmasp_intf *intf =
-		container_of(napi, struct bcmasp_intf, tx_napi);
 	struct bcmasp_intf_stats64 *stats = &intf->stats64;
 	struct device *kdev = &intf->parent->pdev->dev;
 	unsigned long read, released = 0;
@@ -478,10 +480,16 @@
 							DESC_RING_COUNT);
 	}
 
-	/* Ensure all descriptors have been written to DRAM for the hardware
-	 * to see updated contents.
-	 */
-	wmb();
+	return released;
+}
+
+static int bcmasp_tx_poll(struct napi_struct *napi, int budget)
+{
+	struct bcmasp_intf *intf =
+		container_of(napi, struct bcmasp_intf, tx_napi);
+	int released = 0;
+
+	released = bcmasp_tx_reclaim(intf);
 
 	napi_complete(&intf->tx_napi);
 
@@ -656,6 +664,12 @@
 			UMC_CMD_HD_EN | UMC_CMD_RX_PAUSE_IGNORE |
 			UMC_CMD_TX_PAUSE_IGNORE);
 		reg |= cmd_bits;
+		if (reg & UMC_CMD_SW_RESET) {
+			reg &= ~UMC_CMD_SW_RESET;
+			umac_wl(intf, reg, UMC_CMD);
+			udelay(2);
+			reg |= UMC_CMD_TX_EN | UMC_CMD_RX_EN | UMC_CMD_PROMISC;
+		}
 		umac_wl(intf, reg, UMC_CMD);
 
 		intf->eee.eee_active = phy_init_eee(phydev, 0) >= 0;
@@ -787,6 +801,7 @@
 
 	intf->tx_spb_index = 0;
 	intf->tx_spb_clean_index = 0;
+	memset(intf->tx_cbs, 0, sizeof(struct bcmasp_tx_cb) * DESC_RING_COUNT);
 
 	netif_napi_add_tx(intf->ndev, &intf->tx_napi, bcmasp_tx_poll);
 
@@ -897,6 +912,8 @@
 	} while (timeout-- > 0);
 	tx_spb_dma_wl(intf, 0x0, TX_SPB_DMA_FIFO_CTRL);
 
+	bcmasp_tx_reclaim(intf);
+
 	umac_enable_set(intf, UMC_CMD_TX_EN, 0);
 
 	phy_stop(dev->phydev);
@@ -1063,9 +1080,6 @@
 
 	umac_init(intf);
 
-	/* Disable the UniMAC RX/TX */
-	umac_enable_set(intf, (UMC_CMD_RX_EN | UMC_CMD_TX_EN), 0);
-
 	umac_set_hw_addr(intf, dev->dev_addr);
 
 	intf->old_duplex = -1;
@@ -1085,9 +1099,6 @@
 
 	bcmasp_enable_rx(intf, 1);
 
-	/* Turn on UniMAC TX/RX */
-	umac_enable_set(intf, (UMC_CMD_RX_EN | UMC_CMD_TX_EN), 1);
-
 	intf->crc_fwd = !!(umac_rl(intf, UMC_CMD) & UMC_CMD_CRC_FWD);
 
 	bcmasp_netif_start(dev);
@@ -1324,7 +1335,14 @@
 	if (intf->wolopts & WAKE_FILTER)
 		bcmasp_netfilt_suspend(intf);
 
-	/* UniMAC receive needs to be turned on */
+	/* Bring UniMAC out of reset if needed and enable RX */
+	reg = umac_rl(intf, UMC_CMD);
+	if (reg & UMC_CMD_SW_RESET)
+		reg &= ~UMC_CMD_SW_RESET;
+
+	reg |= UMC_CMD_RX_EN | UMC_CMD_PROMISC;
+	umac_wl(intf, reg, UMC_CMD);
+
 	umac_enable_set(intf, UMC_CMD_RX_EN, 1);
 
 	if (intf->parent->wol_irq > 0) {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/b44.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/b44.c
@@ -2009,12 +2009,14 @@
 		bp->flags |= B44_FLAG_TX_PAUSE;
 	else
 		bp->flags &= ~B44_FLAG_TX_PAUSE;
-	if (bp->flags & B44_FLAG_PAUSE_AUTO) {
-		b44_halt(bp);
-		b44_init_rings(bp);
-		b44_init_hw(bp, B44_FULL_RESET);
-	} else {
-		__b44_set_flow_ctrl(bp, bp->flags);
+	if (netif_running(dev)) {
+		if (bp->flags & B44_FLAG_PAUSE_AUTO) {
+			b44_halt(bp);
+			b44_init_rings(bp);
+			b44_init_hw(bp, B44_FULL_RESET);
+		} else {
+			__b44_set_flow_ctrl(bp, bp->flags);
+		}
 	}
 	spin_unlock_irq(&bp->lock);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bcmsysport.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1359,6 +1359,7 @@
 		netif_err(priv, tx_err, dev, "DMA map failed at %p (len=%d)\n",
 			  skb->data, skb_len);
 		ret = NETDEV_TX_OK;
+		dev_kfree_skb_any(skb);
 		goto out;
 	}
 
@@ -1966,7 +1967,11 @@
 	unsigned int i;
 	int ret;
 
-	clk_prepare_enable(priv->clk);
+	ret = clk_prepare_enable(priv->clk);
+	if (ret) {
+		netdev_err(dev, "could not enable priv clock\n");
+		return ret;
+	}
 
 	/* Reset UniMAC */
 	umac_reset(priv);
@@ -2624,7 +2629,11 @@
 		goto err_deregister_notifier;
 	}
 
-	clk_prepare_enable(priv->clk);
+	ret = clk_prepare_enable(priv->clk);
+	if (ret) {
+		dev_err(&pdev->dev, "could not enable priv clock\n");
+		goto err_deregister_netdev;
+	}
 
 	priv->rev = topctrl_readl(priv, REV_CNTL) & REV_MASK;
 	dev_info(&pdev->dev,
@@ -2638,6 +2647,8 @@
 
 	return 0;
 
+err_deregister_netdev:
+	unregister_netdev(dev);
 err_deregister_notifier:
 	unregister_netdevice_notifier(&priv->netdev_notifier);
 err_deregister_fixed_link:
@@ -2807,7 +2818,12 @@
 	if (!netif_running(dev))
 		return 0;
 
-	clk_prepare_enable(priv->clk);
+	ret = clk_prepare_enable(priv->clk);
+	if (ret) {
+		netdev_err(dev, "could not enable priv clock\n");
+		return ret;
+	}
+
 	if (priv->wolopts)
 		clk_disable_unprepare(priv->wol_clk);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bgmac-platform.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bgmac-platform.c
@@ -171,6 +171,7 @@
 static int bgmac_probe(struct platform_device *pdev)
 {
 	struct device_node *np = pdev->dev.of_node;
+	struct device_node *phy_node;
 	struct bgmac *bgmac;
 	struct resource *regs;
 	int ret;
@@ -236,7 +237,9 @@
 	bgmac->cco_ctl_maskset = platform_bgmac_cco_ctl_maskset;
 	bgmac->get_bus_clock = platform_bgmac_get_bus_clock;
 	bgmac->cmn_maskset32 = platform_bgmac_cmn_maskset32;
-	if (of_parse_phandle(np, "phy-handle", 0)) {
+	phy_node = of_parse_phandle(np, "phy-handle", 0);
+	if (phy_node) {
+		of_node_put(phy_node);
 		bgmac->phy_connect = platform_phy_connect;
 	} else {
 		bgmac->phy_connect = bgmac_phy_connect_direct;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1262,7 +1262,7 @@
 
 struct bnx2x_fw_stats_req {
 	struct stats_query_header hdr;
-	struct stats_query_entry query[FP_SB_MAX_E1x+
+	struct stats_query_entry query[FP_SB_MAX_E2 +
 		BNX2X_FIRST_QUEUE_QUERY_IDX];
 };
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -147,10 +147,11 @@
 
 		phy_fw_ver[0] = '\0';
 		bnx2x_get_ext_phy_fw_version(&bp->link_params,
-					     phy_fw_ver, PHY_FW_VER_LEN);
-		strscpy(buf, bp->fw_ver, buf_len);
-		snprintf(buf + strlen(bp->fw_ver), 32 - strlen(bp->fw_ver),
-			 "bc %d.%d.%d%s%s",
+					     phy_fw_ver, sizeof(phy_fw_ver));
+		/* This may become truncated. */
+		scnprintf(buf, buf_len,
+			 "%sbc %d.%d.%d%s%s",
+			 bp->fw_ver,
 			 (bp->common.bc_ver & 0xff0000) >> 16,
 			 (bp->common.bc_ver & 0xff00) >> 8,
 			 (bp->common.bc_ver & 0xff),
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -1002,9 +1002,6 @@
 static inline void bnx2x_free_rx_mem_pool(struct bnx2x *bp,
 					  struct bnx2x_alloc_pool *pool)
 {
-	if (!pool->page)
-		return;
-
 	put_page(pool->page);
 
 	pool->page = NULL;
@@ -1015,6 +1012,9 @@
 {
 	int i;
 
+	if (!fp->page_pool.page)
+		return;
+
 	if (fp->mode == TPA_MODE_DISABLED)
 		return;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -1132,7 +1132,7 @@
 	}
 
 	memset(version, 0, sizeof(version));
-	bnx2x_fill_fw_str(bp, version, ETHTOOL_FWVERS_LEN);
+	bnx2x_fill_fw_str(bp, version, sizeof(version));
 	strlcat(info->fw_version, version, sizeof(info->fw_version));
 
 	strscpy(info->bus_info, pci_name(bp->pdev), sizeof(info->bus_info));
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -6163,8 +6163,8 @@
 
 static int bnx2x_null_format_ver(u32 spirom_ver, u8 *str, u16 *len)
 {
-	str[0] = '\0';
-	(*len)--;
+	if (*len)
+		str[0] = '\0';
 	return 0;
 }
 
@@ -6173,7 +6173,7 @@
 	u16 ret;
 
 	if (*len < 10) {
-		/* Need more than 10chars for this format */
+		/* Need more than 10 chars for this format */
 		bnx2x_null_format_ver(num, str, len);
 		return -EINVAL;
 	}
@@ -6188,8 +6188,8 @@
 {
 	u16 ret;
 
-	if (*len < 10) {
-		/* Need more than 10chars for this format */
+	if (*len < 9) {
+		/* Need more than 9 chars for this format */
 		bnx2x_null_format_ver(num, str, len);
 		return -EINVAL;
 	}
@@ -6208,7 +6208,7 @@
 	int status = 0;
 	u8 *ver_p = version;
 	u16 remain_len = len;
-	if (version == NULL || params == NULL)
+	if (version == NULL || params == NULL || len == 0)
 		return -EINVAL;
 	bp = params->bp;
 
@@ -11546,7 +11546,7 @@
 	str[2] = (spirom_ver & 0xFF0000) >> 16;
 	str[3] = (spirom_ver & 0xFF000000) >> 24;
 	str[4] = '\0';
-	*len -= 5;
+	*len -= 4;
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -687,9 +687,6 @@
 	return NETDEV_TX_OK;
 
 tx_dma_error:
-	if (BNXT_TX_PTP_IS_SET(lflags))
-		atomic_inc(&bp->ptp_cfg->tx_avail);
-
 	last_frag = i;
 
 	/* start back at beginning and unmap skb */
@@ -711,6 +708,8 @@
 tx_free:
 	dev_kfree_skb_any(skb);
 tx_kick_pending:
+	if (BNXT_TX_PTP_IS_SET(lflags))
+		atomic_inc(&bp->ptp_cfg->tx_avail);
 	if (txr->kick_pending)
 		bnxt_txr_db_kick(bp, txr, txr->tx_prod);
 	txr->tx_buf_ring[txr->tx_prod].skb = NULL;
@@ -1420,7 +1419,7 @@
 		if (TPA_START_IS_IPV6(tpa_start1))
 			tpa_info->gso_type = SKB_GSO_TCPV6;
 		/* RSS profiles 1 and 3 with extract code 0 for inner 4-tuple */
-		else if (cmp_type == CMP_TYPE_RX_L2_TPA_START_CMP &&
+		else if (!BNXT_CHIP_P4_PLUS(bp) &&
 			 TPA_START_HASH_TYPE(tpa_start) == 3)
 			tpa_info->gso_type = SKB_GSO_TCPV6;
 		tpa_info->rss_hash =
@@ -1735,7 +1734,7 @@
 		skb = bnxt_copy_skb(bnapi, data_ptr, len, mapping);
 		if (!skb) {
 			bnxt_abort_tpa(cpr, idx, agg_bufs);
-			cpr->sw_stats.rx.rx_oom_discards += 1;
+			cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1;
 			return NULL;
 		}
 	} else {
@@ -1745,7 +1744,7 @@
 		new_data = __bnxt_alloc_rx_frag(bp, &new_mapping, GFP_ATOMIC);
 		if (!new_data) {
 			bnxt_abort_tpa(cpr, idx, agg_bufs);
-			cpr->sw_stats.rx.rx_oom_discards += 1;
+			cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1;
 			return NULL;
 		}
 
@@ -1761,7 +1760,7 @@
 		if (!skb) {
 			skb_free_frag(data);
 			bnxt_abort_tpa(cpr, idx, agg_bufs);
-			cpr->sw_stats.rx.rx_oom_discards += 1;
+			cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1;
 			return NULL;
 		}
 		skb_reserve(skb, bp->rx_offset);
@@ -1772,7 +1771,7 @@
 		skb = bnxt_rx_agg_pages_skb(bp, cpr, skb, idx, agg_bufs, true);
 		if (!skb) {
 			/* Page reuse already handled by bnxt_rx_pages(). */
-			cpr->sw_stats.rx.rx_oom_discards += 1;
+			cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1;
 			return NULL;
 		}
 	}
@@ -2051,11 +2050,8 @@
 			u32 frag_len = bnxt_rx_agg_pages_xdp(bp, cpr, &xdp,
 							     cp_cons, agg_bufs,
 							     false);
-			if (!frag_len) {
-				cpr->sw_stats.rx.rx_oom_discards += 1;
-				rc = -ENOMEM;
-				goto next_rx;
-			}
+			if (!frag_len)
+				goto oom_next_rx;
 		}
 		xdp_active = true;
 	}
@@ -2078,9 +2074,7 @@
 				else
 					bnxt_xdp_buff_frags_free(rxr, &xdp);
 			}
-			cpr->sw_stats.rx.rx_oom_discards += 1;
-			rc = -ENOMEM;
-			goto next_rx;
+			goto oom_next_rx;
 		}
 	} else {
 		u32 payload;
@@ -2091,29 +2085,21 @@
 			payload = 0;
 		skb = bp->rx_skb_func(bp, rxr, cons, data, data_ptr, dma_addr,
 				      payload | len);
-		if (!skb) {
-			cpr->sw_stats.rx.rx_oom_discards += 1;
-			rc = -ENOMEM;
-			goto next_rx;
-		}
+		if (!skb)
+			goto oom_next_rx;
 	}
 
 	if (agg_bufs) {
 		if (!xdp_active) {
 			skb = bnxt_rx_agg_pages_skb(bp, cpr, skb, cp_cons, agg_bufs, false);
-			if (!skb) {
-				cpr->sw_stats.rx.rx_oom_discards += 1;
-				rc = -ENOMEM;
-				goto next_rx;
-			}
+			if (!skb)
+				goto oom_next_rx;
 		} else {
 			skb = bnxt_xdp_build_skb(bp, skb, agg_bufs, rxr->page_pool, &xdp, rxcmp1);
 			if (!skb) {
 				/* we should be able to free the old skb here */
 				bnxt_xdp_buff_frags_free(rxr, &xdp);
-				cpr->sw_stats.rx.rx_oom_discards += 1;
-				rc = -ENOMEM;
-				goto next_rx;
+				goto oom_next_rx;
 			}
 		}
 	}
@@ -2124,15 +2110,13 @@
 		if (cmp_type == CMP_TYPE_RX_L2_V3_CMP) {
 			type = bnxt_rss_ext_op(bp, rxcmp);
 		} else {
-			u32 hash_type = RX_CMP_HASH_TYPE(rxcmp);
+			u32 itypes = RX_CMP_ITYPES(rxcmp);
 
-			/* RSS profiles 1 and 3 with extract code 0 for inner
-			 * 4-tuple
-			 */
-			if (hash_type != 1 && hash_type != 3)
-				type = PKT_HASH_TYPE_L3;
-			else
+			if (itypes == RX_CMP_FLAGS_ITYPE_TCP ||
+			    itypes == RX_CMP_FLAGS_ITYPE_UDP)
 				type = PKT_HASH_TYPE_L4;
+			else
+				type = PKT_HASH_TYPE_L3;
 		}
 		skb_set_hash(skb, le32_to_cpu(rxcmp->rx_cmp_rss_hash), type);
 	}
@@ -2166,10 +2150,11 @@
 
 			if (!bnxt_get_rx_ts_p5(bp, &ts, cmpl_ts)) {
 				struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
+				unsigned long flags;
 
-				spin_lock_bh(&ptp->ptp_lock);
+				spin_lock_irqsave(&ptp->ptp_lock, flags);
 				ns = timecounter_cyc2time(&ptp->tc, ts);
-				spin_unlock_bh(&ptp->ptp_lock);
+				spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 				memset(skb_hwtstamps(skb), 0,
 				       sizeof(*skb_hwtstamps(skb)));
 				skb_hwtstamps(skb)->hwtstamp = ns_to_ktime(ns);
@@ -2191,6 +2176,11 @@
 	*raw_cons = tmp_raw_cons;
 
 	return rc;
+
+oom_next_rx:
+	cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1;
+	rc = -ENOMEM;
+	goto next_rx;
 }
 
 /* In netpoll mode, if we are using a combined completion ring, we need to
@@ -2237,7 +2227,7 @@
 	}
 	rc = bnxt_rx_pkt(bp, cpr, raw_cons, event);
 	if (rc && rc != -EBUSY)
-		cpr->sw_stats.rx.rx_netpoll_discards += 1;
+		cpr->bnapi->cp_ring.sw_stats.rx.rx_netpoll_discards += 1;
 	return rc;
 }
 
@@ -2661,17 +2651,18 @@
 		case ASYNC_EVENT_CMPL_PHC_UPDATE_EVENT_DATA1_FLAGS_PHC_RTC_UPDATE:
 			if (BNXT_PTP_USE_RTC(bp)) {
 				struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
+				unsigned long flags;
 				u64 ns;
 
 				if (!ptp)
 					goto async_event_process_exit;
 
-				spin_lock_bh(&ptp->ptp_lock);
+				spin_lock_irqsave(&ptp->ptp_lock, flags);
 				bnxt_ptp_update_current_time(bp);
 				ns = (((u64)BNXT_EVENT_PHC_RTC_UPDATE(data1) <<
 				       BNXT_PHC_BITS) | ptp->current_time);
 				bnxt_ptp_rtc_timecounter_init(ptp, ns);
-				spin_unlock_bh(&ptp->ptp_lock);
+				spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 			}
 			break;
 		}
@@ -4347,12 +4338,12 @@
 /* Changing allocation mode of RX rings.
  * TODO: Update when extending xdp_rxq_info to support allocation modes.
  */
-int bnxt_set_rx_skb_mode(struct bnxt *bp, bool page_mode)
+static void __bnxt_set_rx_skb_mode(struct bnxt *bp, bool page_mode)
 {
 	struct net_device *dev = bp->dev;
 
 	if (page_mode) {
-		bp->flags &= ~BNXT_FLAG_AGG_RINGS;
+		bp->flags &= ~(BNXT_FLAG_AGG_RINGS | BNXT_FLAG_NO_AGG_RINGS);
 		bp->flags |= BNXT_FLAG_RX_PAGE_MODE;
 
 		if (bp->xdp_prog->aux->xdp_has_frags)
@@ -4368,15 +4359,30 @@
 			bp->rx_skb_func = bnxt_rx_page_skb;
 		}
 		bp->rx_dir = DMA_BIDIRECTIONAL;
-		/* Disable LRO or GRO_HW */
-		netdev_update_features(dev);
 	} else {
 		dev->max_mtu = bp->max_mtu;
 		bp->flags &= ~BNXT_FLAG_RX_PAGE_MODE;
 		bp->rx_dir = DMA_FROM_DEVICE;
 		bp->rx_skb_func = bnxt_rx_skb;
 	}
-	return 0;
+}
+
+void bnxt_set_rx_skb_mode(struct bnxt *bp, bool page_mode)
+{
+	__bnxt_set_rx_skb_mode(bp, page_mode);
+
+	if (!page_mode) {
+		int rx, tx;
+
+		bnxt_get_max_rings(bp, &rx, &tx, true);
+		if (rx > 1) {
+			bp->flags &= ~BNXT_FLAG_NO_AGG_RINGS;
+			bp->dev->hw_features |= NETIF_F_LRO;
+		}
+	}
+
+	/* Update LRO and GRO_HW availability */
+	netdev_update_features(bp->dev);
 }
 
 static void bnxt_free_vnic_attributes(struct bnxt *bp)
@@ -8574,7 +8580,6 @@
 	struct hwrm_port_mac_ptp_qcfg_output *resp;
 	struct hwrm_port_mac_ptp_qcfg_input *req;
 	struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
-	bool phc_cfg;
 	u8 flags;
 	int rc;
 
@@ -8617,8 +8622,9 @@
 		rc = -ENODEV;
 		goto exit;
 	}
-	phc_cfg = (flags & PORT_MAC_PTP_QCFG_RESP_FLAGS_RTC_CONFIGURED) != 0;
-	rc = bnxt_ptp_init(bp, phc_cfg);
+	ptp->rtc_configured =
+		(flags & PORT_MAC_PTP_QCFG_RESP_FLAGS_RTC_CONFIGURED) != 0;
+	rc = bnxt_ptp_init(bp);
 	if (rc)
 		netdev_warn(bp->dev, "PTP initialization failed.\n");
 exit:
@@ -8906,7 +8912,7 @@
 					     BNXT_FW_HEALTH_WIN_BASE +
 					     BNXT_GRC_REG_CHIP_NUM);
 		}
-		if (!BNXT_CHIP_P5(bp))
+		if (!BNXT_CHIP_P5_PLUS(bp))
 			return;
 
 		status_loc = BNXT_GRC_REG_STATUS_P5 |
@@ -11526,6 +11532,8 @@
 	/* VF-reps may need to be re-opened after the PF is re-opened */
 	if (BNXT_PF(bp))
 		bnxt_vf_reps_open(bp);
+	if (bp->ptp_cfg)
+		atomic_set(&bp->ptp_cfg->tx_avail, BNXT_MAX_TX_TS);
 	bnxt_ptp_init_rtc(bp, true);
 	bnxt_ptp_cfg_tstamp_filters(bp);
 	return 0;
@@ -12774,6 +12782,16 @@
 	bnxt_rtnl_unlock_sp(bp);
 }
 
+static void bnxt_fw_fatal_close(struct bnxt *bp)
+{
+	bnxt_tx_disable(bp);
+	bnxt_disable_napi(bp);
+	bnxt_disable_int_sync(bp);
+	bnxt_free_irq(bp);
+	bnxt_clear_int_mode(bp);
+	pci_disable_device(bp->pdev);
+}
+
 static void bnxt_fw_reset_close(struct bnxt *bp)
 {
 	bnxt_ulp_stop(bp);
@@ -12787,12 +12805,7 @@
 		pci_read_config_word(bp->pdev, PCI_SUBSYSTEM_ID, &val);
 		if (val == 0xffff)
 			bp->fw_reset_min_dsecs = 0;
-		bnxt_tx_disable(bp);
-		bnxt_disable_napi(bp);
-		bnxt_disable_int_sync(bp);
-		bnxt_free_irq(bp);
-		bnxt_clear_int_mode(bp);
-		pci_disable_device(bp->pdev);
+		bnxt_fw_fatal_close(bp);
 	}
 	__bnxt_close_nic(bp, true, false);
 	bnxt_vf_reps_free(bp);
@@ -12835,9 +12848,11 @@
 		return;
 
 	if (ptp) {
-		spin_lock_bh(&ptp->ptp_lock);
+		unsigned long flags;
+
+		spin_lock_irqsave(&ptp->ptp_lock, flags);
 		set_bit(BNXT_STATE_IN_FW_RESET, &bp->state);
-		spin_unlock_bh(&ptp->ptp_lock);
+		spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 	} else {
 		set_bit(BNXT_STATE_IN_FW_RESET, &bp->state);
 	}
@@ -12900,9 +12915,11 @@
 		int n = 0, tmo;
 
 		if (ptp) {
-			spin_lock_bh(&ptp->ptp_lock);
+			unsigned long flags;
+
+			spin_lock_irqsave(&ptp->ptp_lock, flags);
 			set_bit(BNXT_STATE_IN_FW_RESET, &bp->state);
-			spin_unlock_bh(&ptp->ptp_lock);
+			spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 		} else {
 			set_bit(BNXT_STATE_IN_FW_RESET, &bp->state);
 		}
@@ -13783,6 +13800,14 @@
 		bnxt_close_nic(bp, true, false);
 
 	dev->mtu = new_mtu;
+
+	/* MTU change may change the AGG ring settings if an XDP multi-buffer
+	 * program is attached.  We need to set the AGG rings settings and
+	 * rx_skb_func accordingly.
+	 */
+	if (READ_ONCE(bp->xdp_prog))
+		bnxt_set_rx_skb_mode(bp, true);
+
 	bnxt_set_ring_params(bp);
 
 	if (netif_running(dev))
@@ -14828,7 +14853,7 @@
 		goto init_err_pci_clean;
 
 	bnxt_init_l2_fltr_tbl(bp);
-	bnxt_set_rx_skb_mode(bp, false);
+	__bnxt_set_rx_skb_mode(bp, false);
 	bnxt_set_tpa_flags(bp);
 	bnxt_set_ring_params(bp);
 	rc = bnxt_set_dflt_rings(bp, true);
@@ -14934,6 +14959,7 @@
 	if (netif_running(dev))
 		dev_close(dev);
 
+	bnxt_ptp_clear(bp);
 	bnxt_clear_int_mode(bp);
 	pci_disable_device(pdev);
 
@@ -14960,6 +14986,7 @@
 		rc = bnxt_close(dev);
 	}
 	bnxt_hwrm_func_drv_unrgtr(bp);
+	bnxt_ptp_clear(bp);
 	pci_disable_device(bp->pdev);
 	bnxt_free_ctx_mem(bp);
 	rtnl_unlock();
@@ -15001,6 +15028,10 @@
 		goto resume_exit;
 	}
 
+	if (bnxt_ptp_init(bp)) {
+		kfree(bp->ptp_cfg);
+		bp->ptp_cfg = NULL;
+	}
 	bnxt_get_wol_settings(bp);
 	if (netif_running(dev)) {
 		rc = bnxt_open(dev);
@@ -15038,6 +15069,7 @@
 {
 	struct net_device *netdev = pci_get_drvdata(pdev);
 	struct bnxt *bp = netdev_priv(netdev);
+	bool abort = false;
 
 	netdev_info(netdev, "PCI I/O error detected\n");
 
@@ -15046,16 +15078,27 @@
 
 	bnxt_ulp_stop(bp);
 
-	if (state == pci_channel_io_perm_failure) {
+	if (test_and_set_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) {
+		netdev_err(bp->dev, "Firmware reset already in progress\n");
+		abort = true;
+	}
+
+	if (abort || state == pci_channel_io_perm_failure) {
 		rtnl_unlock();
 		return PCI_ERS_RESULT_DISCONNECT;
 	}
 
-	if (state == pci_channel_io_frozen)
+	/* Link is not reliable anymore if state is pci_channel_io_frozen
+	 * so we disable bus master to prevent any potential bad DMAs before
+	 * freeing kernel memory.
+	 */
+	if (state == pci_channel_io_frozen) {
 		set_bit(BNXT_STATE_PCI_CHANNEL_IO_FROZEN, &bp->state);
+		bnxt_fw_fatal_close(bp);
+	}
 
 	if (netif_running(netdev))
-		bnxt_close(netdev);
+		__bnxt_close_nic(bp, true, true);
 
 	if (pci_is_enabled(pdev))
 		pci_disable_device(pdev);
@@ -15139,6 +15182,7 @@
 	}
 
 reset_exit:
+	clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state);
 	bnxt_clear_reservations(bp, true);
 	rtnl_unlock();
 
@@ -15162,8 +15206,12 @@
 	rtnl_lock();
 
 	err = bnxt_hwrm_func_qcaps(bp);
-	if (!err && netif_running(netdev))
-		err = bnxt_open(netdev);
+	if (!err) {
+		if (netif_running(netdev))
+			err = bnxt_open(netdev);
+		else
+			err = bnxt_reserve_rings(bp, true);
+	}
 
 	bnxt_ulp_start(bp, err);
 	if (!err) {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -241,6 +241,9 @@
 	(((le32_to_cpu((rxcmp)->rx_cmp_misc_v1) & RX_CMP_RSS_HASH_TYPE) >>\
 	  RX_CMP_RSS_HASH_TYPE_SHIFT) & RSS_PROFILE_ID_MASK)
 
+#define RX_CMP_ITYPES(rxcmp)					\
+	(le32_to_cpu((rxcmp)->rx_cmp_len_flags_type) & RX_CMP_FLAGS_ITYPES_MASK)
+
 #define RX_CMP_V3_HASH_TYPE_LEGACY(rxcmp)				\
 	((le32_to_cpu((rxcmp)->rx_cmp_misc_v1) & RX_CMP_V3_RSS_EXT_OP_LEGACY) >>\
 	 RX_CMP_V3_RSS_EXT_OP_LEGACY_SHIFT)
@@ -352,7 +355,7 @@
 	u32 rx_agg_cmp_opaque;
 	__le32 rx_agg_cmp_v;
 	#define RX_AGG_CMP_V					(1 << 0)
-	#define RX_AGG_CMP_AGG_ID				(0xffff << 16)
+	#define RX_AGG_CMP_AGG_ID				(0x0fff << 16)
 	 #define RX_AGG_CMP_AGG_ID_SHIFT			 16
 	__le32 rx_agg_cmp_unused;
 };
@@ -390,7 +393,7 @@
 	 #define RX_TPA_START_CMP_V3_RSS_HASH_TYPE_SHIFT	 7
 	#define RX_TPA_START_CMP_AGG_ID				(0x7f << 25)
 	 #define RX_TPA_START_CMP_AGG_ID_SHIFT			 25
-	#define RX_TPA_START_CMP_AGG_ID_P5			(0xffff << 16)
+	#define RX_TPA_START_CMP_AGG_ID_P5			(0x0fff << 16)
 	 #define RX_TPA_START_CMP_AGG_ID_SHIFT_P5		 16
 	#define RX_TPA_START_CMP_METADATA1			(0xf << 28)
 	 #define RX_TPA_START_CMP_METADATA1_SHIFT		 28
@@ -514,7 +517,7 @@
 	 #define RX_TPA_END_CMP_PAYLOAD_OFFSET_SHIFT		 16
 	#define RX_TPA_END_CMP_AGG_ID				(0x7f << 25)
 	 #define RX_TPA_END_CMP_AGG_ID_SHIFT			 25
-	#define RX_TPA_END_CMP_AGG_ID_P5			(0xffff << 16)
+	#define RX_TPA_END_CMP_AGG_ID_P5			(0x0fff << 16)
 	 #define RX_TPA_END_CMP_AGG_ID_SHIFT_P5			 16
 
 	__le32 rx_tpa_end_cmp_tsdelta;
@@ -1399,6 +1402,57 @@
 	atomic_t		refcnt;
 };
 
+/* Compat version of hwrm_port_phy_qcfg_output capped at 96 bytes.  The
+ * first 95 bytes are identical to hwrm_port_phy_qcfg_output in bnxt_hsi.h.
+ * The last valid byte in the compat version is different.
+ */
+struct hwrm_port_phy_qcfg_output_compat {
+	__le16	error_code;
+	__le16	req_type;
+	__le16	seq_id;
+	__le16	resp_len;
+	u8	link;
+	u8	active_fec_signal_mode;
+	__le16	link_speed;
+	u8	duplex_cfg;
+	u8	pause;
+	__le16	support_speeds;
+	__le16	force_link_speed;
+	u8	auto_mode;
+	u8	auto_pause;
+	__le16	auto_link_speed;
+	__le16	auto_link_speed_mask;
+	u8	wirespeed;
+	u8	lpbk;
+	u8	force_pause;
+	u8	module_status;
+	__le32	preemphasis;
+	u8	phy_maj;
+	u8	phy_min;
+	u8	phy_bld;
+	u8	phy_type;
+	u8	media_type;
+	u8	xcvr_pkg_type;
+	u8	eee_config_phy_addr;
+	u8	parallel_detect;
+	__le16	link_partner_adv_speeds;
+	u8	link_partner_adv_auto_mode;
+	u8	link_partner_adv_pause;
+	__le16	adv_eee_link_speed_mask;
+	__le16	link_partner_adv_eee_link_speed_mask;
+	__le32	xcvr_identifier_type_tx_lpi_timer;
+	__le16	fec_cfg;
+	u8	duplex_state;
+	u8	option_flags;
+	char	phy_vendor_name[16];
+	char	phy_vendor_partnumber[16];
+	__le16	support_pam4_speeds;
+	__le16	force_pam4_link_speed;
+	__le16	auto_pam4_link_speed_mask;
+	u8	link_partner_pam4_adv_speeds;
+	u8	valid;
+};
+
 struct bnxt_link_info {
 	u8			phy_type;
 	u8			media_type;
@@ -2640,7 +2694,7 @@
 u32 bnxt_fw_health_readl(struct bnxt *bp, int reg_idx);
 void bnxt_set_tpa_flags(struct bnxt *bp);
 void bnxt_set_ring_params(struct bnxt *);
-int bnxt_set_rx_skb_mode(struct bnxt *bp, bool page_mode);
+void bnxt_set_rx_skb_mode(struct bnxt *bp, bool page_mode);
 int bnxt_hwrm_func_drv_rgtr(struct bnxt *bp, unsigned long *bmap,
 			    int bmap_size, bool async_only);
 int bnxt_hwrm_func_drv_unrgtr(struct bnxt *bp);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -2482,19 +2482,24 @@
 	}
 
 	base->port = PORT_NONE;
-	if (link_info->media_type == PORT_PHY_QCFG_RESP_MEDIA_TYPE_TP) {
+	if (media == BNXT_MEDIA_TP) {
 		base->port = PORT_TP;
 		linkmode_set_bit(ETHTOOL_LINK_MODE_TP_BIT,
 				 lk_ksettings->link_modes.supported);
 		linkmode_set_bit(ETHTOOL_LINK_MODE_TP_BIT,
 				 lk_ksettings->link_modes.advertising);
+	} else if (media == BNXT_MEDIA_KR) {
+		linkmode_set_bit(ETHTOOL_LINK_MODE_Backplane_BIT,
+				 lk_ksettings->link_modes.supported);
+		linkmode_set_bit(ETHTOOL_LINK_MODE_Backplane_BIT,
+				 lk_ksettings->link_modes.advertising);
 	} else {
 		linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT,
 				 lk_ksettings->link_modes.supported);
 		linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT,
 				 lk_ksettings->link_modes.advertising);
 
-		if (link_info->media_type == PORT_PHY_QCFG_RESP_MEDIA_TYPE_DAC)
+		if (media == BNXT_MEDIA_CR)
 			base->port = PORT_DA;
 		else
 			base->port = PORT_FIBRE;
@@ -3803,7 +3808,7 @@
 
 	if (!bnxt_get_pkginfo(dev, buf, sizeof(buf))) {
 		len = strlen(bp->fw_ver_str);
-		snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len - 1,
+		snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len,
 			 "/pkg %s", buf);
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c
@@ -680,7 +680,7 @@
 			    req_type);
 	else if (rc && rc != HWRM_ERR_CODE_PF_UNAVAILABLE)
 		hwrm_err(bp, ctx, "hwrm req_type 0x%x seq id 0x%x error 0x%x\n",
-			 req_type, token->seq_id, rc);
+			 req_type, le16_to_cpu(ctx->req->seq_id), rc);
 	rc = __hwrm_to_stderr(rc);
 exit:
 	if (token)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
@@ -62,13 +62,14 @@
 	struct bnxt_ptp_cfg *ptp = container_of(ptp_info, struct bnxt_ptp_cfg,
 						ptp_info);
 	u64 ns = timespec64_to_ns(ts);
+	unsigned long flags;
 
 	if (BNXT_PTP_USE_RTC(ptp->bp))
 		return bnxt_ptp_cfg_settime(ptp->bp, ns);
 
-	spin_lock_bh(&ptp->ptp_lock);
+	spin_lock_irqsave(&ptp->ptp_lock, flags);
 	timecounter_init(&ptp->tc, &ptp->cc, ns);
-	spin_unlock_bh(&ptp->ptp_lock);
+	spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 	return 0;
 }
 
@@ -100,13 +101,14 @@
 static void bnxt_ptp_get_current_time(struct bnxt *bp)
 {
 	struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
+	unsigned long flags;
 
 	if (!ptp)
 		return;
-	spin_lock_bh(&ptp->ptp_lock);
+	spin_lock_irqsave(&ptp->ptp_lock, flags);
 	WRITE_ONCE(ptp->old_time, ptp->current_time);
 	bnxt_refclk_read(bp, NULL, &ptp->current_time);
-	spin_unlock_bh(&ptp->ptp_lock);
+	spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 }
 
 static int bnxt_hwrm_port_ts_query(struct bnxt *bp, u32 flags, u64 *ts)
@@ -142,17 +144,18 @@
 {
 	struct bnxt_ptp_cfg *ptp = container_of(ptp_info, struct bnxt_ptp_cfg,
 						ptp_info);
+	unsigned long flags;
 	u64 ns, cycles;
 	int rc;
 
-	spin_lock_bh(&ptp->ptp_lock);
+	spin_lock_irqsave(&ptp->ptp_lock, flags);
 	rc = bnxt_refclk_read(ptp->bp, sts, &cycles);
 	if (rc) {
-		spin_unlock_bh(&ptp->ptp_lock);
+		spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 		return rc;
 	}
 	ns = timecounter_cyc2time(&ptp->tc, cycles);
-	spin_unlock_bh(&ptp->ptp_lock);
+	spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 	*ts = ns_to_timespec64(ns);
 
 	return 0;
@@ -170,6 +173,7 @@
 static int bnxt_ptp_adjphc(struct bnxt_ptp_cfg *ptp, s64 delta)
 {
 	struct hwrm_port_mac_cfg_input *req;
+	unsigned long flags;
 	int rc;
 
 	rc = hwrm_req_init(ptp->bp, req, HWRM_PORT_MAC_CFG);
@@ -183,9 +187,9 @@
 	if (rc) {
 		netdev_err(ptp->bp->dev, "ptp adjphc failed. rc = %x\n", rc);
 	} else {
-		spin_lock_bh(&ptp->ptp_lock);
+		spin_lock_irqsave(&ptp->ptp_lock, flags);
 		bnxt_ptp_update_current_time(ptp->bp);
-		spin_unlock_bh(&ptp->ptp_lock);
+		spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 	}
 
 	return rc;
@@ -195,13 +199,14 @@
 {
 	struct bnxt_ptp_cfg *ptp = container_of(ptp_info, struct bnxt_ptp_cfg,
 						ptp_info);
+	unsigned long flags;
 
 	if (BNXT_PTP_USE_RTC(ptp->bp))
 		return bnxt_ptp_adjphc(ptp, delta);
 
-	spin_lock_bh(&ptp->ptp_lock);
+	spin_lock_irqsave(&ptp->ptp_lock, flags);
 	timecounter_adjtime(&ptp->tc, delta);
-	spin_unlock_bh(&ptp->ptp_lock);
+	spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 	return 0;
 }
 
@@ -229,14 +234,15 @@
 	struct bnxt_ptp_cfg *ptp = container_of(ptp_info, struct bnxt_ptp_cfg,
 						ptp_info);
 	struct bnxt *bp = ptp->bp;
+	unsigned long flags;
 
 	if (!BNXT_MH(bp))
 		return bnxt_ptp_adjfine_rtc(bp, scaled_ppm);
 
-	spin_lock_bh(&ptp->ptp_lock);
+	spin_lock_irqsave(&ptp->ptp_lock, flags);
 	timecounter_read(&ptp->tc);
 	ptp->cc.mult = adjust_by_scaled_ppm(ptp->cmult, scaled_ppm);
-	spin_unlock_bh(&ptp->ptp_lock);
+	spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 	return 0;
 }
 
@@ -244,12 +250,13 @@
 {
 	struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
 	struct ptp_clock_event event;
+	unsigned long flags;
 	u64 ns, pps_ts;
 
 	pps_ts = EVENT_PPS_TS(data2, data1);
-	spin_lock_bh(&ptp->ptp_lock);
+	spin_lock_irqsave(&ptp->ptp_lock, flags);
 	ns = timecounter_cyc2time(&ptp->tc, pps_ts);
-	spin_unlock_bh(&ptp->ptp_lock);
+	spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 
 	switch (EVENT_DATA2_PPS_EVENT_TYPE(data2)) {
 	case ASYNC_EVENT_CMPL_PPS_TIMESTAMP_EVENT_DATA2_EVENT_TYPE_INTERNAL:
@@ -386,16 +393,17 @@
 {
 	u64 cycles_now;
 	u64 nsec_now, nsec_delta;
+	unsigned long flags;
 	int rc;
 
-	spin_lock_bh(&ptp->ptp_lock);
+	spin_lock_irqsave(&ptp->ptp_lock, flags);
 	rc = bnxt_refclk_read(ptp->bp, NULL, &cycles_now);
 	if (rc) {
-		spin_unlock_bh(&ptp->ptp_lock);
+		spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 		return rc;
 	}
 	nsec_now = timecounter_cyc2time(&ptp->tc, cycles_now);
-	spin_unlock_bh(&ptp->ptp_lock);
+	spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 
 	nsec_delta = target_ns - nsec_now;
 	*cycles_delta = div64_u64(nsec_delta << ptp->cc.shift, ptp->cc.mult);
@@ -672,15 +680,16 @@
 {
 	struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
 	struct skb_shared_hwtstamps timestamp;
+	unsigned long flags;
 	u64 ts = 0, ns = 0;
 	int rc;
 
 	rc = bnxt_hwrm_port_ts_query(bp, PORT_TS_QUERY_REQ_FLAGS_PATH_TX, &ts);
 	if (!rc) {
 		memset(&timestamp, 0, sizeof(timestamp));
-		spin_lock_bh(&ptp->ptp_lock);
+		spin_lock_irqsave(&ptp->ptp_lock, flags);
 		ns = timecounter_cyc2time(&ptp->tc, ts);
-		spin_unlock_bh(&ptp->ptp_lock);
+		spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 		timestamp.hwtstamp = ns_to_ktime(ns);
 		skb_tstamp_tx(ptp->tx_skb, &timestamp);
 	} else {
@@ -699,6 +708,7 @@
 						ptp_info);
 	unsigned long now = jiffies;
 	struct bnxt *bp = ptp->bp;
+	unsigned long flags;
 
 	if (ptp->tx_skb)
 		bnxt_stamp_tx_skb(bp, ptp->tx_skb);
@@ -709,9 +719,9 @@
 	bnxt_ptp_get_current_time(bp);
 	ptp->next_period = now + HZ;
 	if (time_after_eq(now, ptp->next_overflow_check)) {
-		spin_lock_bh(&ptp->ptp_lock);
+		spin_lock_irqsave(&ptp->ptp_lock, flags);
 		timecounter_read(&ptp->tc);
-		spin_unlock_bh(&ptp->ptp_lock);
+		spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 		ptp->next_overflow_check = now + BNXT_PHC_OVERFLOW_PERIOD;
 	}
 	return HZ;
@@ -878,6 +888,7 @@
 int bnxt_ptp_init_rtc(struct bnxt *bp, bool phc_cfg)
 {
 	struct timespec64 tsp;
+	unsigned long flags;
 	u64 ns;
 	int rc;
 
@@ -895,9 +906,9 @@
 		if (rc)
 			return rc;
 	}
-	spin_lock_bh(&bp->ptp_cfg->ptp_lock);
+	spin_lock_irqsave(&bp->ptp_cfg->ptp_lock, flags);
 	bnxt_ptp_rtc_timecounter_init(bp->ptp_cfg, ns);
-	spin_unlock_bh(&bp->ptp_cfg->ptp_lock);
+	spin_unlock_irqrestore(&bp->ptp_cfg->ptp_lock, flags);
 
 	return 0;
 }
@@ -914,7 +925,7 @@
 	}
 }
 
-int bnxt_ptp_init(struct bnxt *bp, bool phc_cfg)
+int bnxt_ptp_init(struct bnxt *bp)
 {
 	struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
 	int rc;
@@ -936,7 +947,7 @@
 
 	if (BNXT_PTP_USE_RTC(bp)) {
 		bnxt_ptp_timecounter_init(bp, false);
-		rc = bnxt_ptp_init_rtc(bp, phc_cfg);
+		rc = bnxt_ptp_init_rtc(bp, ptp->rtc_configured);
 		if (rc)
 			goto out;
 	} else {
@@ -959,10 +970,12 @@
 		goto out;
 	}
 	if (BNXT_CHIP_P5(bp)) {
-		spin_lock_bh(&ptp->ptp_lock);
+		unsigned long flags;
+
+		spin_lock_irqsave(&ptp->ptp_lock, flags);
 		bnxt_refclk_read(bp, NULL, &ptp->current_time);
 		WRITE_ONCE(ptp->old_time, ptp->current_time);
-		spin_unlock_bh(&ptp->ptp_lock);
+		spin_unlock_irqrestore(&ptp->ptp_lock, flags);
 		ptp_schedule_worker(ptp->ptp_clock, 0);
 	}
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h
@@ -115,6 +115,7 @@
 					 BNXT_PTP_MSG_PDELAY_REQ |	\
 					 BNXT_PTP_MSG_PDELAY_RESP)
 	u8			tx_tstamp_en:1;
+	u8			rtc_configured:1;
 	int			rx_filter;
 	u32			tstamp_filters;
 
@@ -123,11 +124,13 @@
 };
 
 #if BITS_PER_LONG == 32
-#define BNXT_READ_TIME64(ptp, dst, src)		\
-do {						\
-	spin_lock_bh(&(ptp)->ptp_lock);		\
-	(dst) = (src);				\
-	spin_unlock_bh(&(ptp)->ptp_lock);	\
+#define BNXT_READ_TIME64(ptp, dst, src)				\
+do {								\
+	unsigned long flags;					\
+								\
+	spin_lock_irqsave(&(ptp)->ptp_lock, flags);		\
+	(dst) = (src);						\
+	spin_unlock_irqrestore(&(ptp)->ptp_lock, flags);	\
 } while (0)
 #else
 #define BNXT_READ_TIME64(ptp, dst, src)		\
@@ -145,6 +148,6 @@
 int bnxt_get_rx_ts_p5(struct bnxt *bp, u64 *ts, u32 pkt_ts);
 void bnxt_ptp_rtc_timecounter_init(struct bnxt_ptp_cfg *ptp, u64 ns);
 int bnxt_ptp_init_rtc(struct bnxt *bp, bool phc_cfg);
-int bnxt_ptp_init(struct bnxt *bp, bool phc_cfg);
+int bnxt_ptp_init(struct bnxt *bp);
 void bnxt_ptp_clear(struct bnxt *bp);
 #endif
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -950,8 +950,11 @@
 	struct hwrm_fwd_resp_input *req;
 	int rc;
 
-	if (BNXT_FWD_RESP_SIZE_ERR(msg_size))
+	if (BNXT_FWD_RESP_SIZE_ERR(msg_size)) {
+		netdev_warn_once(bp->dev, "HWRM fwd response too big (%d bytes)\n",
+				 msg_size);
 		return -EINVAL;
+	}
 
 	rc = hwrm_req_init(bp, req, HWRM_FWD_RESP);
 	if (!rc) {
@@ -1085,7 +1088,7 @@
 		rc = bnxt_hwrm_exec_fwd_resp(
 			bp, vf, sizeof(struct hwrm_port_phy_qcfg_input));
 	} else {
-		struct hwrm_port_phy_qcfg_output phy_qcfg_resp = {0};
+		struct hwrm_port_phy_qcfg_output_compat phy_qcfg_resp = {};
 		struct hwrm_port_phy_qcfg_input *phy_qcfg_req;
 
 		phy_qcfg_req =
@@ -1096,6 +1099,11 @@
 		mutex_unlock(&bp->link_lock);
 		phy_qcfg_resp.resp_len = cpu_to_le16(sizeof(phy_qcfg_resp));
 		phy_qcfg_resp.seq_id = phy_qcfg_req->seq_id;
+		/* New SPEEDS2 fields are beyond the legacy structure, so
+		 * clear the SPEEDS2_SUPPORTED flag.
+		 */
+		phy_qcfg_resp.option_flags &=
+			~PORT_PHY_QCAPS_RESP_FLAGS2_SPEEDS2_SUPPORTED;
 		phy_qcfg_resp.valid = 1;
 
 		if (vf->flags & BNXT_VF_LINK_UP) {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -156,7 +156,7 @@
 
 	rc = hwrm_req_replace(bp, req, fw_msg->msg, fw_msg->msg_len);
 	if (rc)
-		return rc;
+		goto drop_req;
 
 	hwrm_req_timeout(bp, req, fw_msg->timeout);
 	resp = hwrm_req_hold(bp, req);
@@ -168,6 +168,7 @@
 
 		memcpy(fw_msg->resp, resp, resp_len);
 	}
+drop_req:
 	hwrm_req_drop(bp, req);
 	return rc;
 }
@@ -210,6 +211,9 @@
 	if (err)
 		return;
 
+	if (edev->ulp_tbl->msix_requested)
+		bnxt_fill_msix_vecs(bp, edev->msix_entries);
+
 	if (aux_priv) {
 		struct auxiliary_device *adev;
 
@@ -392,12 +396,13 @@
 	if (!edev)
 		goto aux_dev_uninit;
 
+	aux_priv->edev = edev;
+
 	ulp = kzalloc(sizeof(*ulp), GFP_KERNEL);
 	if (!ulp)
 		goto aux_dev_uninit;
 
 	edev->ulp_tbl = ulp;
-	aux_priv->edev = edev;
 	bp->edev = edev;
 	bnxt_set_edev_info(edev, bp);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
@@ -297,11 +297,6 @@
 		 * redirect is coming from a frame received by the
 		 * bnxt_en driver.
 		 */
-		rx_buf = &rxr->rx_buf_ring[cons];
-		mapping = rx_buf->mapping - bp->rx_dma_offset;
-		dma_unmap_page_attrs(&pdev->dev, mapping,
-				     BNXT_RX_PAGE_SIZE, bp->rx_dir,
-				     DMA_ATTR_WEAK_ORDERING);
 
 		/* if we are unable to allocate a new buffer, abort and reuse */
 		if (bnxt_alloc_rx_data(bp, rxr, rxr->rx_prod, GFP_ATOMIC)) {
@@ -427,15 +422,8 @@
 		bnxt_set_rx_skb_mode(bp, true);
 		xdp_features_set_redirect_target(dev, true);
 	} else {
-		int rx, tx;
-
 		xdp_features_clear_redirect_target(dev);
 		bnxt_set_rx_skb_mode(bp, false);
-		bnxt_get_max_rings(bp, &rx, &tx, true);
-		if (rx > 1) {
-			bp->flags &= ~BNXT_FLAG_NO_AGG_RINGS;
-			bp->dev->hw_features |= NETIF_F_LRO;
-		}
 	}
 	bp->tx_nr_rings_xdp = tx_xdp;
 	bp->tx_nr_rings = bp->tx_nr_rings_per_tc * tc + tx_xdp;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2,7 +2,7 @@
 /*
  * Broadcom GENET (Gigabit Ethernet) controller driver
  *
- * Copyright (c) 2014-2020 Broadcom
+ * Copyright (c) 2014-2024 Broadcom
  */
 
 #define pr_fmt(fmt)				"bcmgenet: " fmt
@@ -2469,14 +2469,18 @@
 {
 	u32 reg;
 
+	spin_lock_bh(&priv->reg_lock);
 	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
-	if (reg & CMD_SW_RESET)
+	if (reg & CMD_SW_RESET) {
+		spin_unlock_bh(&priv->reg_lock);
 		return;
+	}
 	if (enable)
 		reg |= mask;
 	else
 		reg &= ~mask;
 	bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+	spin_unlock_bh(&priv->reg_lock);
 
 	/* UniMAC stops on a packet boundary, wait for a full-size packet
 	 * to be processed
@@ -2492,8 +2496,10 @@
 	udelay(10);
 
 	/* issue soft reset and disable MAC while updating its registers */
+	spin_lock_bh(&priv->reg_lock);
 	bcmgenet_umac_writel(priv, CMD_SW_RESET, UMAC_CMD);
 	udelay(2);
+	spin_unlock_bh(&priv->reg_lock);
 }
 
 static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
@@ -3282,7 +3288,7 @@
 }
 
 /* Returns a reusable dma control register value */
-static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)
+static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv, bool flush_rx)
 {
 	unsigned int i;
 	u32 reg;
@@ -3307,6 +3313,14 @@
 	udelay(10);
 	bcmgenet_umac_writel(priv, 0, UMAC_TX_FLUSH);
 
+	if (flush_rx) {
+		reg = bcmgenet_rbuf_ctrl_get(priv);
+		bcmgenet_rbuf_ctrl_set(priv, reg | BIT(0));
+		udelay(10);
+		bcmgenet_rbuf_ctrl_set(priv, reg);
+		udelay(10);
+	}
+
 	return dma_ctrl;
 }
 
@@ -3328,7 +3342,9 @@
 	struct bcmgenet_priv *priv = netdev_priv(dev);
 
 	/* Start the network engine */
+	netif_addr_lock_bh(dev);
 	bcmgenet_set_rx_mode(dev);
+	netif_addr_unlock_bh(dev);
 	bcmgenet_enable_rx_napi(priv);
 
 	umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, true);
@@ -3370,8 +3386,8 @@
 
 	bcmgenet_set_hw_addr(priv, dev->dev_addr);
 
-	/* Disable RX/TX DMA and flush TX queues */
-	dma_ctrl = bcmgenet_dma_disable(priv);
+	/* Disable RX/TX DMA and flush TX and RX queues */
+	dma_ctrl = bcmgenet_dma_disable(priv, true);
 
 	/* Reinitialize TDMA and RDMA and SW housekeeping */
 	ret = bcmgenet_init_dma(priv);
@@ -3589,16 +3605,19 @@
 	 * 3. The number of filters needed exceeds the number filters
 	 *    supported by the hardware.
 	*/
+	spin_lock(&priv->reg_lock);
 	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
 	if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) ||
 	    (nfilter > MAX_MDF_FILTER)) {
 		reg |= CMD_PROMISC;
 		bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+		spin_unlock(&priv->reg_lock);
 		bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL);
 		return;
 	} else {
 		reg &= ~CMD_PROMISC;
 		bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+		spin_unlock(&priv->reg_lock);
 	}
 
 	/* update MDF filter */
@@ -3997,6 +4016,7 @@
 		goto err;
 	}
 
+	spin_lock_init(&priv->reg_lock);
 	spin_lock_init(&priv->lock);
 
 	/* Set default pause parameters */
@@ -4237,7 +4257,7 @@
 			bcmgenet_hfb_create_rxnfc_filter(priv, rule);
 
 	/* Disable RX/TX DMA and flush TX queues */
-	dma_ctrl = bcmgenet_dma_disable(priv);
+	dma_ctrl = bcmgenet_dma_disable(priv, false);
 
 	/* Reinitialize TDMA and RDMA and SW housekeeping */
 	ret = bcmgenet_init_dma(priv);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Copyright (c) 2014-2020 Broadcom
+ * Copyright (c) 2014-2024 Broadcom
  */
 
 #ifndef __BCMGENET_H__
@@ -573,6 +573,8 @@
 /* device context */
 struct bcmgenet_priv {
 	void __iomem *base;
+	/* reg_lock: lock to serialize access to shared registers */
+	spinlock_t reg_lock;
 	enum bcmgenet_version version;
 	struct net_device *dev;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
@@ -2,7 +2,7 @@
 /*
  * Broadcom GENET (Gigabit Ethernet) Wake-on-LAN support
  *
- * Copyright (c) 2014-2020 Broadcom
+ * Copyright (c) 2014-2024 Broadcom
  */
 
 #define pr_fmt(fmt)				"bcmgenet_wol: " fmt
@@ -42,19 +42,15 @@
 	struct bcmgenet_priv *priv = netdev_priv(dev);
 	struct device *kdev = &priv->pdev->dev;
 
-	if (dev->phydev) {
+	if (dev->phydev)
 		phy_ethtool_get_wol(dev->phydev, wol);
-		if (wol->supported)
-			return;
-	}
 
-	if (!device_can_wakeup(kdev)) {
-		wol->supported = 0;
-		wol->wolopts = 0;
+	/* MAC is not wake-up capable, return what the PHY does */
+	if (!device_can_wakeup(kdev))
 		return;
-	}
 
-	wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER;
+	/* Overlay MAC capabilities with that of the PHY queried before */
+	wol->supported |= WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER;
 	wol->wolopts = priv->wolopts;
 	memset(wol->sopass, 0, sizeof(wol->sopass));
 
@@ -151,6 +147,7 @@
 	}
 
 	/* Can't suspend with WoL if MAC is still in reset */
+	spin_lock_bh(&priv->reg_lock);
 	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
 	if (reg & CMD_SW_RESET)
 		reg &= ~CMD_SW_RESET;
@@ -158,6 +155,7 @@
 	/* disable RX */
 	reg &= ~CMD_RX_EN;
 	bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+	spin_unlock_bh(&priv->reg_lock);
 	mdelay(10);
 
 	if (priv->wolopts & (WAKE_MAGIC | WAKE_MAGICSECURE)) {
@@ -203,6 +201,7 @@
 	}
 
 	/* Enable CRC forward */
+	spin_lock_bh(&priv->reg_lock);
 	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
 	priv->crc_fwd_en = 1;
 	reg |= CMD_CRC_FWD;
@@ -210,6 +209,7 @@
 	/* Receiver must be enabled for WOL MP detection */
 	reg |= CMD_RX_EN;
 	bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+	spin_unlock_bh(&priv->reg_lock);
 
 	reg = UMAC_IRQ_MPD_R;
 	if (hfb_enable)
@@ -256,7 +256,9 @@
 	}
 
 	/* Disable CRC Forward */
+	spin_lock_bh(&priv->reg_lock);
 	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
 	reg &= ~CMD_CRC_FWD;
 	bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+	spin_unlock_bh(&priv->reg_lock);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -2,7 +2,7 @@
 /*
  * Broadcom GENET MDIO routines
  *
- * Copyright (c) 2014-2017 Broadcom
+ * Copyright (c) 2014-2024 Broadcom
  */
 
 #include <linux/acpi.h>
@@ -75,6 +75,7 @@
 	reg |= RGMII_LINK;
 	bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
 
+	spin_lock_bh(&priv->reg_lock);
 	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
 	reg &= ~((CMD_SPEED_MASK << CMD_SPEED_SHIFT) |
 		       CMD_HD_EN |
@@ -87,6 +88,7 @@
 		reg |= CMD_TX_EN | CMD_RX_EN;
 	}
 	bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+	spin_unlock_bh(&priv->reg_lock);
 
 	priv->eee.eee_active = phy_init_eee(phydev, 0) >= 0;
 	bcmgenet_eee_enable_set(dev,
@@ -274,6 +276,7 @@
 	 * block for the interface to work, unconditionally clear the
 	 * Out-of-band disable since we do not need it.
 	 */
+	mutex_lock(&phydev->lock);
 	reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL);
 	reg &= ~OOB_DISABLE;
 	if (priv->ext_phy) {
@@ -285,6 +288,7 @@
 			reg |= RGMII_MODE_EN;
 	}
 	bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
+	mutex_unlock(&phydev->lock);
 
 	if (init)
 		dev_info(kdev, "configuring instance for %s\n", phy_name);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/broadcom/tg3.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/broadcom/tg3.c
@@ -17811,6 +17811,9 @@
 	} else
 		persist_dma_mask = dma_mask = DMA_BIT_MASK(64);
 
+	if (tg3_asic_rev(tp) == ASIC_REV_57766)
+		persist_dma_mask = DMA_BIT_MASK(31);
+
 	/* Configure DMA attributes. */
 	if (dma_mask > DMA_BIT_MASK(32)) {
 		err = dma_set_mask(&pdev->dev, dma_mask);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/brocade/bna/bna_types.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/brocade/bna/bna_types.h
@@ -416,7 +416,7 @@
 /* Tx object */
 
 /* Tx datapath control structure */
-#define BNA_Q_NAME_SIZE		16
+#define BNA_Q_NAME_SIZE		(IFNAMSIZ + 6)
 struct bna_tcb {
 	/* Fast path */
 	void			**sw_qpt;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/brocade/bna/bnad.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/brocade/bna/bnad.c
@@ -1534,8 +1534,9 @@
 
 	for (i = 0; i < num_txqs; i++) {
 		vector_num = tx_info->tcb[i]->intr_vector;
-		sprintf(tx_info->tcb[i]->name, "%s TXQ %d", bnad->netdev->name,
-				tx_id + tx_info->tcb[i]->id);
+		snprintf(tx_info->tcb[i]->name, BNA_Q_NAME_SIZE, "%s TXQ %d",
+			 bnad->netdev->name,
+			 tx_id + tx_info->tcb[i]->id);
 		err = request_irq(bnad->msix_table[vector_num].vector,
 				  (irq_handler_t)bnad_msix_tx, 0,
 				  tx_info->tcb[i]->name,
@@ -1585,9 +1586,9 @@
 
 	for (i = 0; i < num_rxps; i++) {
 		vector_num = rx_info->rx_ctrl[i].ccb->intr_vector;
-		sprintf(rx_info->rx_ctrl[i].ccb->name, "%s CQ %d",
-			bnad->netdev->name,
-			rx_id + rx_info->rx_ctrl[i].ccb->id);
+		snprintf(rx_info->rx_ctrl[i].ccb->name, BNA_Q_NAME_SIZE,
+			 "%s CQ %d", bnad->netdev->name,
+			 rx_id + rx_info->rx_ctrl[i].ccb->id);
 		err = request_irq(bnad->msix_table[vector_num].vector,
 				  (irq_handler_t)bnad_msix_rx, 0,
 				  rx_info->rx_ctrl[i].ccb->name,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
@@ -312,7 +312,7 @@
 	void *kern_buf;
 
 	/* Copy the user space buf */
-	kern_buf = memdup_user(buf, nbytes);
+	kern_buf = memdup_user_nul(buf, nbytes);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 
@@ -372,7 +372,7 @@
 	void *kern_buf;
 
 	/* Copy the user space buf */
-	kern_buf = memdup_user(buf, nbytes);
+	kern_buf = memdup_user_nul(buf, nbytes);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/cadence/macb_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/cadence/macb_main.c
@@ -930,9 +930,6 @@
 		return ret;
 	}
 
-	if (of_phy_is_fixed_link(np))
-		return mdiobus_register(bp->mii_bus);
-
 	/* Only create the PHY from the device tree if at least one PHY is
 	 * described. Otherwise scan the entire MDIO bus. We do this to support
 	 * old device tree that did not follow the best practices and did not
@@ -953,8 +950,19 @@
 
 static int macb_mii_init(struct macb *bp)
 {
+	struct device_node *child, *np = bp->pdev->dev.of_node;
 	int err = -ENXIO;
 
+	/* With fixed-link, we don't need to register the MDIO bus,
+	 * except if we have a child named "mdio" in the device tree.
+	 * In that case, some devices may be attached to the MACB's MDIO bus.
+	 */
+	child = of_get_child_by_name(np, "mdio");
+	if (child)
+		of_node_put(child);
+	else if (of_phy_is_fixed_link(np))
+		return macb_mii_probe(bp->dev);
+
 	/* Enable management port */
 	macb_writel(bp, NCR, MACB_BIT(MPE));
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
@@ -272,13 +272,12 @@
 				pg_info->page_offset;
 			memcpy(skb->data, va, MIN_SKB_SIZE);
 			skb_put(skb, MIN_SKB_SIZE);
+			skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+					pg_info->page,
+					pg_info->page_offset + MIN_SKB_SIZE,
+					len - MIN_SKB_SIZE,
+					LIO_RXBUFFER_SZ);
 		}
-
-		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
-				pg_info->page,
-				pg_info->page_offset + MIN_SKB_SIZE,
-				len - MIN_SKB_SIZE,
-				LIO_RXBUFFER_SZ);
 	} else {
 		struct octeon_skb_page_info *pg_info =
 			((struct octeon_skb_page_info *)(skb->cb));
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -2082,7 +2082,7 @@
 		     struct sge_idma_monitor_state *idma,
 		     int hz, int ticks);
 int t4_set_vf_mac_acl(struct adapter *adapter, unsigned int vf,
-		      unsigned int naddr, u8 *addr);
+		      u8 start, unsigned int naddr, u8 *addr);
 void t4_tp_pio_read(struct adapter *adap, u32 *buff, u32 nregs,
 		    u32 start_index, bool sleep_ok);
 void t4_tp_tm_pio_read(struct adapter *adap, u32 *buff, u32 nregs,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
@@ -1244,7 +1244,8 @@
 	 * in the Compressed Filter Tuple.
 	 */
 	if (tp->vlan_shift >= 0 && fs->mask.ivlan)
-		ntuple |= (FT_VLAN_VLD_F | fs->val.ivlan) << tp->vlan_shift;
+		ntuple |= (u64)(FT_VLAN_VLD_F |
+				fs->val.ivlan) << tp->vlan_shift;
 
 	if (tp->port_shift >= 0 && fs->mask.iport)
 		ntuple |= (u64)fs->val.iport << tp->port_shift;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -1799,7 +1799,10 @@
 	struct adapter *adap = container_of(t, struct adapter, tids);
 	struct sk_buff *skb;
 
-	WARN_ON(tid_out_of_range(&adap->tids, tid));
+	if (tid_out_of_range(&adap->tids, tid)) {
+		dev_err(adap->pdev_dev, "tid %d out of range\n", tid);
+		return;
+	}
 
 	if (t->tid_tab[tid - adap->tids.tid_base]) {
 		t->tid_tab[tid - adap->tids.tid_base] = NULL;
@@ -3246,7 +3249,7 @@
 
 	dev_info(pi->adapter->pdev_dev,
 		 "Setting MAC %pM on VF %d\n", mac, vf);
-	ret = t4_set_vf_mac_acl(adap, vf + 1, 1, mac);
+	ret = t4_set_vf_mac_acl(adap, vf + 1, pi->lport, 1, mac);
 	if (!ret)
 		ether_addr_copy(adap->vfinfo[vf].vf_mac_addr, mac);
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2684,12 +2684,12 @@
 	lb->loopback = 1;
 
 	q = &adap->sge.ethtxq[pi->first_qset];
-	__netif_tx_lock(q->txq, smp_processor_id());
+	__netif_tx_lock_bh(q->txq);
 
 	reclaim_completed_tx(adap, &q->q, -1, true);
 	credits = txq_avail(&q->q) - ndesc;
 	if (unlikely(credits < 0)) {
-		__netif_tx_unlock(q->txq);
+		__netif_tx_unlock_bh(q->txq);
 		return -ENOMEM;
 	}
 
@@ -2724,7 +2724,7 @@
 	init_completion(&lb->completion);
 	txq_advance(&q->q, ndesc);
 	cxgb4_ring_tx_db(adap, &q->q, ndesc);
-	__netif_tx_unlock(q->txq);
+	__netif_tx_unlock_bh(q->txq);
 
 	/* wait for the pkt to return */
 	ret = wait_for_completion_timeout(&lb->completion, 10 * HZ);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -10215,11 +10215,12 @@
  *	t4_set_vf_mac_acl - Set MAC address for the specified VF
  *	@adapter: The adapter
  *	@vf: one of the VFs instantiated by the specified PF
+ *	@start: The start port id associated with specified VF
  *	@naddr: the number of MAC addresses
  *	@addr: the MAC address(es) to be set to the specified VF
  */
 int t4_set_vf_mac_acl(struct adapter *adapter, unsigned int vf,
-		      unsigned int naddr, u8 *addr)
+		      u8 start, unsigned int naddr, u8 *addr)
 {
 	struct fw_acl_mac_cmd cmd;
 
@@ -10234,7 +10235,7 @@
 	cmd.en_to_len16 = cpu_to_be32((unsigned int)FW_LEN16(cmd));
 	cmd.nmac = naddr;
 
-	switch (adapter->pf) {
+	switch (start) {
 	case 3:
 		memcpy(cmd.macaddr3, addr, sizeof(cmd.macaddr3));
 		break;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_main.c
@@ -346,8 +346,9 @@
 	 * driver. Once driver synthesizes cpl_pass_accpet_req the skb will go
 	 * through the regular cpl_pass_accept_req processing in TOM.
 	 */
-	skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req)
-			- pktshift, GFP_ATOMIC);
+	skb = alloc_skb(size_add(gl->tot_len,
+				 sizeof(struct cpl_pass_accept_req)) -
+			pktshift, GFP_ATOMIC);
 	if (unlikely(!skb))
 		return NULL;
 	__skb_put(skb, gl->tot_len + sizeof(struct cpl_pass_accept_req)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/cisco/enic/enic_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1117,18 +1117,30 @@
 	pp->request = nla_get_u8(port[IFLA_PORT_REQUEST]);
 
 	if (port[IFLA_PORT_PROFILE]) {
+		if (nla_len(port[IFLA_PORT_PROFILE]) != PORT_PROFILE_MAX) {
+			memcpy(pp, &prev_pp, sizeof(*pp));
+			return -EINVAL;
+		}
 		pp->set |= ENIC_SET_NAME;
 		memcpy(pp->name, nla_data(port[IFLA_PORT_PROFILE]),
 			PORT_PROFILE_MAX);
 	}
 
 	if (port[IFLA_PORT_INSTANCE_UUID]) {
+		if (nla_len(port[IFLA_PORT_INSTANCE_UUID]) != PORT_UUID_MAX) {
+			memcpy(pp, &prev_pp, sizeof(*pp));
+			return -EINVAL;
+		}
 		pp->set |= ENIC_SET_INSTANCE;
 		memcpy(pp->instance_uuid,
 			nla_data(port[IFLA_PORT_INSTANCE_UUID]), PORT_UUID_MAX);
 	}
 
 	if (port[IFLA_PORT_HOST_UUID]) {
+		if (nla_len(port[IFLA_PORT_HOST_UUID]) != PORT_UUID_MAX) {
+			memcpy(pp, &prev_pp, sizeof(*pp));
+			return -EINVAL;
+		}
 		pp->set |= ENIC_SET_HOST;
 		memcpy(pp->host_uuid,
 			nla_data(port[IFLA_PORT_HOST_UUID]), PORT_UUID_MAX);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/cortina/gemini.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/cortina/gemini.c
@@ -79,7 +79,8 @@
 #define GMAC0_IRQ4_8 (GMAC0_MIB_INT_BIT | GMAC0_RX_OVERRUN_INT_BIT)
 
 #define GMAC_OFFLOAD_FEATURES (NETIF_F_SG | NETIF_F_IP_CSUM | \
-			       NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM)
+			       NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM | \
+			       NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6)
 
 /**
  * struct gmac_queue_page - page buffer per-page info
@@ -1107,10 +1108,13 @@
 {
 	struct gemini_ethernet_port *port = netdev_priv(netdev);
 	struct gemini_ethernet *geth = port->geth;
+	unsigned long flags;
 	u32 val, mask;
 
 	netdev_dbg(netdev, "%s device %d\n", __func__, netdev->dev_id);
 
+	spin_lock_irqsave(&geth->irq_lock, flags);
+
 	mask = GMAC0_IRQ0_TXQ0_INTS << (6 * netdev->dev_id + txq);
 
 	if (en)
@@ -1119,6 +1123,8 @@
 	val = readl(geth->base + GLOBAL_INTERRUPT_ENABLE_0_REG);
 	val = en ? val | mask : val & ~mask;
 	writel(val, geth->base + GLOBAL_INTERRUPT_ENABLE_0_REG);
+
+	spin_unlock_irqrestore(&geth->irq_lock, flags);
 }
 
 static void gmac_tx_irq(struct net_device *netdev, unsigned int txq_num)
@@ -1143,13 +1149,25 @@
 	skb_frag_t *skb_frag;
 	dma_addr_t mapping;
 	void *buffer;
+	u16 mss;
 	int ret;
 
-	/* TODO: implement proper TSO using MTU in word3 */
 	word1 = skb->len;
 	word3 = SOF_BIT;
 
-	if (skb->len >= ETH_FRAME_LEN) {
+	mss = skb_shinfo(skb)->gso_size;
+	if (mss) {
+		/* This means we are dealing with TCP and skb->len is the
+		 * sum total of all the segments. The TSO will deal with
+		 * chopping this up for us.
+		 */
+		/* The accelerator needs the full frame size here */
+		mss += skb_tcp_all_headers(skb);
+		netdev_dbg(netdev, "segment offloading mss = %04x len=%04x\n",
+			   mss, skb->len);
+		word1 |= TSS_MTU_ENABLE_BIT;
+		word3 |= mss;
+	} else if (skb->len >= ETH_FRAME_LEN) {
 		/* Hardware offloaded checksumming isn't working on frames
 		 * bigger than 1514 bytes. A hypothesis about this is that the
 		 * checksum buffer is only 1518 bytes, so when the frames get
@@ -1164,7 +1182,9 @@
 				return ret;
 		}
 		word1 |= TSS_BYPASS_BIT;
-	} else if (skb->ip_summed == CHECKSUM_PARTIAL) {
+	}
+
+	if (skb->ip_summed == CHECKSUM_PARTIAL) {
 		int tcp = 0;
 
 		/* We do not switch off the checksumming on non TCP/UDP
@@ -1415,15 +1435,19 @@
 	union gmac_rxdesc_3 word3;
 	struct page *page = NULL;
 	unsigned int page_offs;
+	unsigned long flags;
 	unsigned short r, w;
 	union dma_rwptr rw;
 	dma_addr_t mapping;
 	int frag_nr = 0;
 
+	spin_lock_irqsave(&geth->irq_lock, flags);
 	rw.bits32 = readl(ptr_reg);
 	/* Reset interrupt as all packages until here are taken into account */
 	writel(DEFAULT_Q0_INT_BIT << netdev->dev_id,
 	       geth->base + GLOBAL_INTERRUPT_STATUS_1_REG);
+	spin_unlock_irqrestore(&geth->irq_lock, flags);
+
 	r = rw.bits.rptr;
 	w = rw.bits.wptr;
 
@@ -1726,10 +1750,9 @@
 		gmac_update_hw_stats(netdev);
 
 	if (val & (GMAC0_RX_OVERRUN_INT_BIT << (netdev->dev_id * 8))) {
+		spin_lock(&geth->irq_lock);
 		writel(GMAC0_RXDERR_INT_BIT << (netdev->dev_id * 8),
 		       geth->base + GLOBAL_INTERRUPT_STATUS_4_REG);
-
-		spin_lock(&geth->irq_lock);
 		u64_stats_update_begin(&port->ir_stats_syncp);
 		++port->stats.rx_fifo_errors;
 		u64_stats_update_end(&port->ir_stats_syncp);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/emulex/benet/be_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1381,10 +1381,8 @@
 	be_get_wrb_params_from_skb(adapter, skb, &wrb_params);
 
 	wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params);
-	if (unlikely(!wrb_cnt)) {
-		dev_kfree_skb_any(skb);
-		goto drop;
-	}
+	if (unlikely(!wrb_cnt))
+		goto drop_skb;
 
 	/* if os2bmc is enabled and if the pkt is destined to bmc,
 	 * enqueue the pkt a 2nd time with mgmt bit set.
@@ -1393,7 +1391,7 @@
 		BE_WRB_F_SET(wrb_params.features, OS2BMC, 1);
 		wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params);
 		if (unlikely(!wrb_cnt))
-			goto drop;
+			goto drop_skb;
 		else
 			skb_get(skb);
 	}
@@ -1407,6 +1405,8 @@
 		be_xmit_flush(adapter, txo);
 
 	return NETDEV_TX_OK;
+drop_skb:
+	dev_kfree_skb_any(skb);
 drop:
 	tx_stats(txo)->tx_drv_drops++;
 	/* Flush the already enqueued tx requests */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/faraday/ftgmac100.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/faraday/ftgmac100.c
@@ -572,7 +572,7 @@
 	(*processed)++;
 	return true;
 
- drop:
+drop:
 	/* Clean rxdes0 (which resets own bit) */
 	rxdes->rxdes0 = cpu_to_le32(status & priv->rxdes0_edorr_mask);
 	priv->rx_pointer = ftgmac100_next_rx_pointer(priv, pointer);
@@ -656,6 +656,11 @@
 	ftgmac100_free_tx_packet(priv, pointer, skb, txdes, ctl_stat);
 	txdes->txdes0 = cpu_to_le32(ctl_stat & priv->txdes0_edotr_mask);
 
+	/* Ensure the descriptor config is visible before setting the tx
+	 * pointer.
+	 */
+	smp_wmb();
+
 	priv->tx_clean_pointer = ftgmac100_next_tx_pointer(priv, pointer);
 
 	return true;
@@ -809,6 +814,11 @@
 	dma_wmb();
 	first->txdes0 = cpu_to_le32(f_ctl_stat);
 
+	/* Ensure the descriptor config is visible before setting the tx
+	 * pointer.
+	 */
+	smp_wmb();
+
 	/* Update next TX pointer */
 	priv->tx_pointer = pointer;
 
@@ -829,7 +839,7 @@
 
 	return NETDEV_TX_OK;
 
- dma_err:
+dma_err:
 	if (net_ratelimit())
 		netdev_err(netdev, "map tx fragment failed\n");
 
@@ -851,7 +861,7 @@
 	 * last fragment, so we know ftgmac100_free_tx_packet()
 	 * hasn't freed the skb yet.
 	 */
- drop:
+drop:
 	/* Drop the packet */
 	dev_kfree_skb_any(skb);
 	netdev->stats.tx_dropped++;
@@ -1344,7 +1354,7 @@
 	ftgmac100_init_all(priv, true);
 
 	netdev_dbg(netdev, "Reset done !\n");
- bail:
+bail:
 	if (priv->mii_bus)
 		mutex_unlock(&priv->mii_bus->mdio_lock);
 	if (netdev->phydev)
@@ -1543,15 +1553,15 @@
 
 	return 0;
 
- err_ncsi:
+err_ncsi:
 	napi_disable(&priv->napi);
 	netif_stop_queue(netdev);
- err_alloc:
+err_alloc:
 	ftgmac100_free_buffers(priv);
 	free_irq(netdev->irq, netdev);
- err_irq:
+err_irq:
 	netif_napi_del(&priv->napi);
- err_hw:
+err_hw:
 	iowrite32(0, priv->base + FTGMAC100_OFFSET_IER);
 	ftgmac100_free_rings(priv);
 	return err;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/faraday/ftgmac100.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/faraday/ftgmac100.h
@@ -84,7 +84,7 @@
 			    FTGMAC100_INT_RPKT_BUF)
 
 /* All the interrupts we care about */
-#define FTGMAC100_INT_ALL (FTGMAC100_INT_RPKT_BUF  |  \
+#define FTGMAC100_INT_ALL (FTGMAC100_INT_RXTX  |  \
 			   FTGMAC100_INT_BAD)
 
 /*
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -931,14 +931,18 @@
 	}
 }
 
-static void dpaa_fq_setup(struct dpaa_priv *priv,
-			  const struct dpaa_fq_cbs *fq_cbs,
-			  struct fman_port *tx_port)
+static int dpaa_fq_setup(struct dpaa_priv *priv,
+			 const struct dpaa_fq_cbs *fq_cbs,
+			 struct fman_port *tx_port)
 {
 	int egress_cnt = 0, conf_cnt = 0, num_portals = 0, portal_cnt = 0, cpu;
 	const cpumask_t *affine_cpus = qman_affine_cpus();
-	u16 channels[NR_CPUS];
 	struct dpaa_fq *fq;
+	u16 *channels;
+
+	channels = kcalloc(num_possible_cpus(), sizeof(u16), GFP_KERNEL);
+	if (!channels)
+		return -ENOMEM;
 
 	for_each_cpu_and(cpu, affine_cpus, cpu_online_mask)
 		channels[num_portals++] = qman_affine_channel(cpu);
@@ -997,6 +1001,10 @@
 				break;
 		}
 	}
+
+	kfree(channels);
+
+	return 0;
 }
 
 static inline int dpaa_tx_fq_to_id(const struct dpaa_priv *priv,
@@ -2277,12 +2285,12 @@
 dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
 {
 	const int queue_mapping = skb_get_queue_mapping(skb);
-	bool nonlinear = skb_is_nonlinear(skb);
 	struct rtnl_link_stats64 *percpu_stats;
 	struct dpaa_percpu_priv *percpu_priv;
 	struct netdev_queue *txq;
 	struct dpaa_priv *priv;
 	struct qm_fd fd;
+	bool nonlinear;
 	int offset = 0;
 	int err = 0;
 
@@ -2292,6 +2300,13 @@
 
 	qm_fd_clear_fd(&fd);
 
+	/* Packet data is always read as 32-bit words, so zero out any part of
+	 * the skb which might be sent if we have to pad the packet
+	 */
+	if (__skb_put_padto(skb, ETH_ZLEN, false))
+		goto enomem;
+
+	nonlinear = skb_is_nonlinear(skb);
 	if (!nonlinear) {
 		/* We're going to store the skb backpointer at the beginning
 		 * of the data buffer, so we need a privately owned skb
@@ -3416,7 +3431,9 @@
 	 */
 	dpaa_eth_add_channel(priv->channel, &pdev->dev);
 
-	dpaa_fq_setup(priv, &dpaa_fq_cbs, priv->mac_dev->port[TX]);
+	err = dpaa_fq_setup(priv, &dpaa_fq_cbs, priv->mac_dev->port[TX]);
+	if (err)
+		goto free_dpaa_bps;
 
 	/* Create a congestion group for this netdev, with
 	 * dynamically-allocated CGR ID.
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/dpaa/dpaa_eth_trace.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/dpaa/dpaa_eth_trace.h
@@ -56,7 +56,7 @@
 		__entry->fd_format = qm_fd_get_format(fd);
 		__entry->fd_offset = qm_fd_get_offset(fd);
 		__entry->fd_length = qm_fd_get_length(fd);
-		__entry->fd_status = fd->status;
+		__entry->fd_status = __be32_to_cpu(fd->status);
 		__assign_str(name, netdev->name);
 	),
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c
@@ -457,12 +457,16 @@
 			     struct netlink_ext_ack *extack)
 {
 	const cpumask_t *cpus = qman_affine_cpus();
-	bool needs_revert[NR_CPUS] = {false};
 	struct qman_portal *portal;
 	u32 period, prev_period;
 	u8 thresh, prev_thresh;
+	bool *needs_revert;
 	int cpu, res;
 
+	needs_revert = kcalloc(num_possible_cpus(), sizeof(bool), GFP_KERNEL);
+	if (!needs_revert)
+		return -ENOMEM;
+
 	period = c->rx_coalesce_usecs;
 	thresh = c->rx_max_coalesced_frames;
 
@@ -485,6 +489,8 @@
 		needs_revert[cpu] = true;
 	}
 
+	kfree(needs_revert);
+
 	return 0;
 
 revert_values:
@@ -498,6 +504,8 @@
 		qman_dqrr_set_ithresh(portal, prev_thresh);
 	}
 
+	kfree(needs_revert);
+
 	return res;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
@@ -2896,11 +2896,14 @@
 static int update_xps(struct dpaa2_eth_priv *priv)
 {
 	struct net_device *net_dev = priv->net_dev;
-	struct cpumask xps_mask;
-	struct dpaa2_eth_fq *fq;
 	int i, num_queues, netdev_queues;
+	struct dpaa2_eth_fq *fq;
+	cpumask_var_t xps_mask;
 	int err = 0;
 
+	if (!alloc_cpumask_var(&xps_mask, GFP_KERNEL))
+		return -ENOMEM;
+
 	num_queues = dpaa2_eth_queue_count(priv);
 	netdev_queues = (net_dev->num_tc ? : 1) * num_queues;
 
@@ -2910,16 +2913,17 @@
 	for (i = 0; i < netdev_queues; i++) {
 		fq = &priv->fq[i % num_queues];
 
-		cpumask_clear(&xps_mask);
-		cpumask_set_cpu(fq->target_cpu, &xps_mask);
+		cpumask_clear(xps_mask);
+		cpumask_set_cpu(fq->target_cpu, xps_mask);
 
-		err = netif_set_xps_queue(net_dev, &xps_mask, i);
+		err = netif_set_xps_queue(net_dev, xps_mask, i);
 		if (err) {
 			netdev_warn_once(net_dev, "Error setting XPS queue\n");
 			break;
 		}
 	}
 
+	free_cpumask_var(xps_mask);
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
@@ -2638,13 +2638,14 @@
 
 static int dpaa2_switch_seed_bp(struct ethsw_core *ethsw)
 {
-	int *count, i;
+	int *count, ret, i;
 
 	for (i = 0; i < DPAA2_ETHSW_NUM_BUFS; i += BUFS_PER_CMD) {
+		ret = dpaa2_switch_add_bufs(ethsw, ethsw->bpid);
 		count = &ethsw->buf_count;
-		*count += dpaa2_switch_add_bufs(ethsw, ethsw->bpid);
+		*count += ret;
 
-		if (unlikely(*count < BUFS_PER_CMD))
+		if (unlikely(ret < BUFS_PER_CMD))
 			return -ENOMEM;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/enetc/enetc.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/enetc/enetc.c
@@ -28,6 +28,9 @@
 static void enetc_change_preemptible_tcs(struct enetc_ndev_priv *priv,
 					 u8 preemptible_tcs)
 {
+	if (!(priv->si->hw_features & ENETC_SI_F_QBU))
+		return;
+
 	priv->preemptible_tcs = preemptible_tcs;
 	enetc_mm_commit_preemptible_tcs(priv);
 }
@@ -902,6 +905,7 @@
 
 	if (unlikely(tx_frm_cnt && netif_carrier_ok(ndev) &&
 		     __netif_subqueue_stopped(ndev, tx_ring->index) &&
+		     !test_bit(ENETC_TX_DOWN, &priv->flags) &&
 		     (enetc_bd_unused(tx_ring) >= ENETC_TXBDS_MAX_NEEDED))) {
 		netif_wake_subqueue(ndev, tx_ring->index);
 	}
@@ -1380,6 +1384,9 @@
 	int xdp_tx_bd_cnt, i, k;
 	int xdp_tx_frm_cnt = 0;
 
+	if (unlikely(test_bit(ENETC_TX_DOWN, &priv->flags)))
+		return -ENETDOWN;
+
 	enetc_lock_mdio();
 
 	tx_ring = priv->xdp_tx_ring[smp_processor_id()];
@@ -1524,7 +1531,6 @@
 				  &rx_ring->rx_swbd[rx_ring_first]);
 		enetc_bdr_idx_inc(rx_ring, &rx_ring_first);
 	}
-	rx_ring->stats.xdp_drops++;
 }
 
 static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,
@@ -1589,6 +1595,7 @@
 			fallthrough;
 		case XDP_DROP:
 			enetc_xdp_drop(rx_ring, orig_i, i);
+			rx_ring->stats.xdp_drops++;
 			break;
 		case XDP_PASS:
 			rxbd = orig_rxbd;
@@ -1605,6 +1612,12 @@
 			break;
 		case XDP_TX:
 			tx_ring = priv->xdp_tx_ring[rx_ring->index];
+			if (unlikely(test_bit(ENETC_TX_DOWN, &priv->flags))) {
+				enetc_xdp_drop(rx_ring, orig_i, i);
+				tx_ring->stats.xdp_tx_drops++;
+				break;
+			}
+
 			xdp_tx_bd_cnt = enetc_rx_swbd_to_xdp_tx_swbd(xdp_tx_arr,
 								     rx_ring,
 								     orig_i, i);
@@ -2226,18 +2239,24 @@
 	enetc_rxbdr_wr(hw, idx, ENETC_RBMR, rbmr);
 }
 
-static void enetc_enable_bdrs(struct enetc_ndev_priv *priv)
+static void enetc_enable_rx_bdrs(struct enetc_ndev_priv *priv)
 {
 	struct enetc_hw *hw = &priv->si->hw;
 	int i;
 
-	for (i = 0; i < priv->num_tx_rings; i++)
-		enetc_enable_txbdr(hw, priv->tx_ring[i]);
-
 	for (i = 0; i < priv->num_rx_rings; i++)
 		enetc_enable_rxbdr(hw, priv->rx_ring[i]);
 }
 
+static void enetc_enable_tx_bdrs(struct enetc_ndev_priv *priv)
+{
+	struct enetc_hw *hw = &priv->si->hw;
+	int i;
+
+	for (i = 0; i < priv->num_tx_rings; i++)
+		enetc_enable_txbdr(hw, priv->tx_ring[i]);
+}
+
 static void enetc_disable_rxbdr(struct enetc_hw *hw, struct enetc_bdr *rx_ring)
 {
 	int idx = rx_ring->index;
@@ -2254,18 +2273,24 @@
 	enetc_txbdr_wr(hw, idx, ENETC_TBMR, 0);
 }
 
-static void enetc_disable_bdrs(struct enetc_ndev_priv *priv)
+static void enetc_disable_rx_bdrs(struct enetc_ndev_priv *priv)
 {
 	struct enetc_hw *hw = &priv->si->hw;
 	int i;
 
-	for (i = 0; i < priv->num_tx_rings; i++)
-		enetc_disable_txbdr(hw, priv->tx_ring[i]);
-
 	for (i = 0; i < priv->num_rx_rings; i++)
 		enetc_disable_rxbdr(hw, priv->rx_ring[i]);
 }
 
+static void enetc_disable_tx_bdrs(struct enetc_ndev_priv *priv)
+{
+	struct enetc_hw *hw = &priv->si->hw;
+	int i;
+
+	for (i = 0; i < priv->num_tx_rings; i++)
+		enetc_disable_txbdr(hw, priv->tx_ring[i]);
+}
+
 static void enetc_wait_txbdr(struct enetc_hw *hw, struct enetc_bdr *tx_ring)
 {
 	int delay = 8, timeout = 100;
@@ -2305,12 +2330,11 @@
 
 		snprintf(v->name, sizeof(v->name), "%s-rxtx%d",
 			 priv->ndev->name, i);
-		err = request_irq(irq, enetc_msix, 0, v->name, v);
+		err = request_irq(irq, enetc_msix, IRQF_NO_AUTOEN, v->name, v);
 		if (err) {
 			dev_err(priv->dev, "request_irq() failed!\n");
 			goto irq_err;
 		}
-		disable_irq(irq);
 
 		v->tbier_base = hw->reg + ENETC_BDR(TX, 0, ENETC_TBIER);
 		v->rbier = hw->reg + ENETC_BDR(RX, i, ENETC_RBIER);
@@ -2464,9 +2488,13 @@
 		enable_irq(irq);
 	}
 
-	enetc_enable_bdrs(priv);
+	enetc_enable_tx_bdrs(priv);
+
+	enetc_enable_rx_bdrs(priv);
 
 	netif_tx_start_all_queues(ndev);
+
+	clear_bit(ENETC_TX_DOWN, &priv->flags);
 }
 EXPORT_SYMBOL_GPL(enetc_start);
 
@@ -2524,9 +2552,15 @@
 	struct enetc_ndev_priv *priv = netdev_priv(ndev);
 	int i;
 
+	set_bit(ENETC_TX_DOWN, &priv->flags);
+
 	netif_tx_stop_all_queues(ndev);
 
-	enetc_disable_bdrs(priv);
+	enetc_disable_rx_bdrs(priv);
+
+	enetc_wait_bdrs(priv);
+
+	enetc_disable_tx_bdrs(priv);
 
 	for (i = 0; i < priv->bdr_int_num; i++) {
 		int irq = pci_irq_vector(priv->si->pdev,
@@ -2537,8 +2571,6 @@
 		napi_disable(&priv->int_vector[i]->napi);
 	}
 
-	enetc_wait_bdrs(priv);
-
 	enetc_clear_interrupts(priv);
 }
 EXPORT_SYMBOL_GPL(enetc_stop);
@@ -2769,7 +2801,7 @@
 	if (priv->min_num_stack_tx_queues + num_xdp_tx_queues >
 	    priv->num_tx_rings) {
 		NL_SET_ERR_MSG_FMT_MOD(extack,
-				       "Reserving %d XDP TXQs does not leave a minimum of %d for stack (total %d)",
+				       "Reserving %d XDP TXQs leaves under %d for stack (total %d)",
 				       num_xdp_tx_queues,
 				       priv->min_num_stack_tx_queues,
 				       priv->num_tx_rings);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/enetc/enetc.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/enetc/enetc.h
@@ -328,6 +328,7 @@
 
 enum enetc_flags_bit {
 	ENETC_TX_ONESTEP_TSTAMP_IN_PROGRESS = 0,
+	ENETC_TX_DOWN,
 };
 
 /* interrupt coalescing modes */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/enetc/enetc_pf.c
@@ -665,19 +665,11 @@
 
 	if (!num_vfs) {
 		enetc_msg_psi_free(pf);
-		kfree(pf->vf_state);
 		pf->num_vfs = 0;
 		pci_disable_sriov(pdev);
 	} else {
 		pf->num_vfs = num_vfs;
 
-		pf->vf_state = kcalloc(num_vfs, sizeof(struct enetc_vf_state),
-				       GFP_KERNEL);
-		if (!pf->vf_state) {
-			pf->num_vfs = 0;
-			return -ENOMEM;
-		}
-
 		err = enetc_msg_psi_init(pf);
 		if (err) {
 			dev_err(&pdev->dev, "enetc_msg_psi_init (%d)\n", err);
@@ -696,7 +688,6 @@
 err_en_sriov:
 	enetc_msg_psi_free(pf);
 err_msg_psi:
-	kfree(pf->vf_state);
 	pf->num_vfs = 0;
 
 	return err;
@@ -1286,6 +1277,12 @@
 	pf = enetc_si_priv(si);
 	pf->si = si;
 	pf->total_vfs = pci_sriov_get_totalvfs(pdev);
+	if (pf->total_vfs) {
+		pf->vf_state = kcalloc(pf->total_vfs, sizeof(struct enetc_vf_state),
+				       GFP_KERNEL);
+		if (!pf->vf_state)
+			goto err_alloc_vf_state;
+	}
 
 	err = enetc_setup_mac_addresses(node, pf);
 	if (err)
@@ -1363,6 +1360,8 @@
 	free_netdev(ndev);
 err_alloc_netdev:
 err_setup_mac_addresses:
+	kfree(pf->vf_state);
+err_alloc_vf_state:
 	enetc_psi_destroy(pdev);
 err_psi_create:
 	return err;
@@ -1389,6 +1388,7 @@
 	enetc_free_si_resources(priv);
 
 	free_netdev(si->ndev);
+	kfree(pf->vf_state);
 
 	enetc_psi_destroy(pdev);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/enetc/enetc_vf.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/enetc/enetc_vf.c
@@ -78,11 +78,18 @@
 {
 	struct enetc_ndev_priv *priv = netdev_priv(ndev);
 	struct sockaddr *saddr = addr;
+	int err;
 
 	if (!is_valid_ether_addr(saddr->sa_data))
 		return -EADDRNOTAVAIL;
 
-	return enetc_msg_vsi_set_primary_mac_addr(priv, saddr);
+	err = enetc_msg_vsi_set_primary_mac_addr(priv, saddr);
+	if (err)
+		return err;
+
+	eth_hw_addr_set(ndev, saddr->sa_data);
+
+	return 0;
 }
 
 static int enetc_vf_set_features(struct net_device *ndev,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/fec.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/fec.h
@@ -691,10 +691,19 @@
 	/* XDP BPF Program */
 	struct bpf_prog *xdp_prog;
 
+	struct {
+		int pps_enable;
+		u64 ns_sys, ns_phc;
+		u32 at_corr;
+		u8 at_inc_corr;
+	} ptp_saved_state;
+
 	u64 ethtool_stats[];
 };
 
 void fec_ptp_init(struct platform_device *pdev, int irq_idx);
+void fec_ptp_restore_state(struct fec_enet_private *fep);
+void fec_ptp_save_state(struct fec_enet_private *fep);
 void fec_ptp_stop(struct platform_device *pdev);
 void fec_ptp_start_cyclecounter(struct net_device *ndev);
 int fec_ptp_set(struct net_device *ndev, struct kernel_hwtstamp_config *config,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/fec_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/fec_main.c
@@ -240,8 +240,8 @@
 #define PKT_MINBUF_SIZE		64
 
 /* FEC receive acceleration */
-#define FEC_RACC_IPDIS		(1 << 1)
-#define FEC_RACC_PRODIS		(1 << 2)
+#define FEC_RACC_IPDIS		BIT(1)
+#define FEC_RACC_PRODIS		BIT(2)
 #define FEC_RACC_SHIFT16	BIT(7)
 #define FEC_RACC_OPTIONS	(FEC_RACC_IPDIS | FEC_RACC_PRODIS)
 
@@ -273,8 +273,23 @@
 #define FEC_MMFR_TA		(2 << 16)
 #define FEC_MMFR_DATA(v)	(v & 0xffff)
 /* FEC ECR bits definition */
-#define FEC_ECR_MAGICEN		(1 << 2)
-#define FEC_ECR_SLEEP		(1 << 3)
+#define FEC_ECR_RESET           BIT(0)
+#define FEC_ECR_ETHEREN         BIT(1)
+#define FEC_ECR_MAGICEN         BIT(2)
+#define FEC_ECR_SLEEP           BIT(3)
+#define FEC_ECR_EN1588          BIT(4)
+#define FEC_ECR_BYTESWP         BIT(8)
+/* FEC RCR bits definition */
+#define FEC_RCR_LOOP            BIT(0)
+#define FEC_RCR_HALFDPX         BIT(1)
+#define FEC_RCR_MII             BIT(2)
+#define FEC_RCR_PROMISC         BIT(3)
+#define FEC_RCR_BC_REJ          BIT(4)
+#define FEC_RCR_FLOWCTL         BIT(5)
+#define FEC_RCR_RMII            BIT(8)
+#define FEC_RCR_10BASET         BIT(9)
+/* TX WMARK bits */
+#define FEC_TXWMRK_STRFWD       BIT(8)
 
 #define FEC_MII_TIMEOUT		30000 /* us */
 
@@ -1062,7 +1077,10 @@
 	struct fec_enet_private *fep = netdev_priv(ndev);
 	u32 temp_mac[2];
 	u32 rcntl = OPT_FRAME_SIZE | 0x04;
-	u32 ecntl = 0x2; /* ETHEREN */
+	u32 ecntl = FEC_ECR_ETHEREN;
+
+	if (fep->bufdesc_ex)
+		fec_ptp_save_state(fep);
 
 	/* Whack a reset.  We should wait for this.
 	 * For i.MX6SX SOC, enet use AXI bus, we use disable MAC
@@ -1137,18 +1155,18 @@
 		    fep->phy_interface == PHY_INTERFACE_MODE_RGMII_TXID)
 			rcntl |= (1 << 6);
 		else if (fep->phy_interface == PHY_INTERFACE_MODE_RMII)
-			rcntl |= (1 << 8);
+			rcntl |= FEC_RCR_RMII;
 		else
-			rcntl &= ~(1 << 8);
+			rcntl &= ~FEC_RCR_RMII;
 
 		/* 1G, 100M or 10M */
 		if (ndev->phydev) {
 			if (ndev->phydev->speed == SPEED_1000)
 				ecntl |= (1 << 5);
 			else if (ndev->phydev->speed == SPEED_100)
-				rcntl &= ~(1 << 9);
+				rcntl &= ~FEC_RCR_10BASET;
 			else
-				rcntl |= (1 << 9);
+				rcntl |= FEC_RCR_10BASET;
 		}
 	} else {
 #ifdef FEC_MIIGSK_ENR
@@ -1207,13 +1225,13 @@
 
 	if (fep->quirks & FEC_QUIRK_ENET_MAC) {
 		/* enable ENET endian swap */
-		ecntl |= (1 << 8);
+		ecntl |= FEC_ECR_BYTESWP;
 		/* enable ENET store and forward mode */
-		writel(1 << 8, fep->hwp + FEC_X_WMRK);
+		writel(FEC_TXWMRK_STRFWD, fep->hwp + FEC_X_WMRK);
 	}
 
 	if (fep->bufdesc_ex)
-		ecntl |= (1 << 4);
+		ecntl |= FEC_ECR_EN1588;
 
 	if (fep->quirks & FEC_QUIRK_DELAYED_CLKS_SUPPORT &&
 	    fep->rgmii_txc_dly)
@@ -1231,8 +1249,10 @@
 	writel(ecntl, fep->hwp + FEC_ECNTRL);
 	fec_enet_active_rxring(ndev);
 
-	if (fep->bufdesc_ex)
+	if (fep->bufdesc_ex) {
 		fec_ptp_start_cyclecounter(ndev);
+		fec_ptp_restore_state(fep);
+	}
 
 	/* Enable interrupts we wish to service */
 	if (fep->link)
@@ -1312,7 +1332,7 @@
 fec_stop(struct net_device *ndev)
 {
 	struct fec_enet_private *fep = netdev_priv(ndev);
-	u32 rmii_mode = readl(fep->hwp + FEC_R_CNTRL) & (1 << 8);
+	u32 rmii_mode = readl(fep->hwp + FEC_R_CNTRL) & FEC_RCR_RMII;
 	u32 val;
 
 	/* We cannot expect a graceful transmit stop without link !!! */
@@ -1323,6 +1343,9 @@
 			netdev_err(ndev, "Graceful transmit stop did not complete!\n");
 	}
 
+	if (fep->bufdesc_ex)
+		fec_ptp_save_state(fep);
+
 	/* Whack a reset.  We should wait for this.
 	 * For i.MX6SX SOC, enet use AXI bus, we use disable MAC
 	 * instead of reset MAC itself.
@@ -1331,7 +1354,7 @@
 		if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES) {
 			writel(0, fep->hwp + FEC_ECNTRL);
 		} else {
-			writel(1, fep->hwp + FEC_ECNTRL);
+			writel(FEC_ECR_RESET, fep->hwp + FEC_ECNTRL);
 			udelay(10);
 		}
 	} else {
@@ -1345,11 +1368,19 @@
 	/* We have to keep ENET enabled to have MII interrupt stay working */
 	if (fep->quirks & FEC_QUIRK_ENET_MAC &&
 		!(fep->wol_flag & FEC_WOL_FLAG_SLEEP_ON)) {
-		writel(2, fep->hwp + FEC_ECNTRL);
+		writel(FEC_ECR_ETHEREN, fep->hwp + FEC_ECNTRL);
 		writel(rmii_mode, fep->hwp + FEC_R_CNTRL);
 	}
-}
 
+	if (fep->bufdesc_ex) {
+		val = readl(fep->hwp + FEC_ECNTRL);
+		val |= FEC_ECR_EN1588;
+		writel(val, fep->hwp + FEC_ECNTRL);
+
+		fec_ptp_start_cyclecounter(ndev);
+		fec_ptp_restore_state(fep);
+	}
+}
 
 static void
 fec_timeout(struct net_device *ndev, unsigned int txqueue)
@@ -1562,19 +1593,22 @@
 		fec_enet_tx_queue(ndev, i, budget);
 }
 
-static void fec_enet_update_cbd(struct fec_enet_priv_rx_q *rxq,
+static int fec_enet_update_cbd(struct fec_enet_priv_rx_q *rxq,
 				struct bufdesc *bdp, int index)
 {
 	struct page *new_page;
 	dma_addr_t phys_addr;
 
 	new_page = page_pool_dev_alloc_pages(rxq->page_pool);
-	WARN_ON(!new_page);
-	rxq->rx_skb_info[index].page = new_page;
+	if (unlikely(!new_page))
+		return -ENOMEM;
 
+	rxq->rx_skb_info[index].page = new_page;
 	rxq->rx_skb_info[index].offset = FEC_ENET_XDP_HEADROOM;
 	phys_addr = page_pool_get_dma_addr(new_page) + FEC_ENET_XDP_HEADROOM;
 	bdp->cbd_bufaddr = cpu_to_fec32(phys_addr);
+
+	return 0;
 }
 
 static u32
@@ -1669,6 +1703,7 @@
 	int cpu = smp_processor_id();
 	struct xdp_buff xdp;
 	struct page *page;
+	__fec32 cbd_bufaddr;
 	u32 sub_len = 4;
 
 #if !defined(CONFIG_M5272)
@@ -1737,12 +1772,17 @@
 
 		index = fec_enet_get_bd_index(bdp, &rxq->bd);
 		page = rxq->rx_skb_info[index].page;
+		cbd_bufaddr = bdp->cbd_bufaddr;
+		if (fec_enet_update_cbd(rxq, bdp, index)) {
+			ndev->stats.rx_dropped++;
+			goto rx_processing_done;
+		}
+
 		dma_sync_single_for_cpu(&fep->pdev->dev,
-					fec32_to_cpu(bdp->cbd_bufaddr),
+					fec32_to_cpu(cbd_bufaddr),
 					pkt_len,
 					DMA_FROM_DEVICE);
 		prefetch(page_address(page));
-		fec_enet_update_cbd(rxq, bdp, index);
 
 		if (xdp_prog) {
 			xdp_buff_clear_frags_flag(&xdp);
@@ -2406,8 +2446,6 @@
 	fep->link = 0;
 	fep->full_duplex = 0;
 
-	phy_dev->mac_managed_pm = true;
-
 	phy_attached_info(phy_dev);
 
 	return 0;
@@ -2419,10 +2457,12 @@
 	struct net_device *ndev = platform_get_drvdata(pdev);
 	struct fec_enet_private *fep = netdev_priv(ndev);
 	bool suppress_preamble = false;
+	struct phy_device *phydev;
 	struct device_node *node;
 	int err = -ENXIO;
 	u32 mii_speed, holdtime;
 	u32 bus_freq;
+	int addr;
 
 	/*
 	 * The i.MX28 dual fec interfaces are not equal.
@@ -2536,6 +2576,13 @@
 		goto err_out_free_mdiobus;
 	of_node_put(node);
 
+	/* find all the PHY devices on the bus and set mac_managed_pm to true */
+	for (addr = 0; addr < PHY_MAX_ADDR; addr++) {
+		phydev = mdiobus_get_phy(fep->mii_bus, addr);
+		if (phydev)
+			phydev->mac_managed_pm = true;
+	}
+
 	mii_cnt++;
 
 	/* save fec0 mii_bus */
@@ -3671,29 +3718,6 @@
 	return 0;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-/**
- * fec_poll_controller - FEC Poll controller function
- * @dev: The FEC network adapter
- *
- * Polled functionality used by netconsole and others in non interrupt mode
- *
- */
-static void fec_poll_controller(struct net_device *dev)
-{
-	int i;
-	struct fec_enet_private *fep = netdev_priv(dev);
-
-	for (i = 0; i < FEC_IRQ_NUM; i++) {
-		if (fep->irq[i] > 0) {
-			disable_irq(fep->irq[i]);
-			fec_enet_interrupt(fep->irq[i], dev);
-			enable_irq(fep->irq[i]);
-		}
-	}
-}
-#endif
-
 static inline void fec_enet_set_netdev_features(struct net_device *netdev,
 	netdev_features_t features)
 {
@@ -4000,9 +4024,6 @@
 	.ndo_tx_timeout		= fec_timeout,
 	.ndo_set_mac_address	= fec_set_mac_address,
 	.ndo_eth_ioctl		= phy_do_ioctl_running,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-	.ndo_poll_controller	= fec_poll_controller,
-#endif
 	.ndo_set_features	= fec_set_features,
 	.ndo_bpf		= fec_enet_bpf,
 	.ndo_xdp_xmit		= fec_enet_xdp_xmit,
@@ -4153,6 +4174,14 @@
 	return ret;
 }
 
+static void fec_enet_deinit(struct net_device *ndev)
+{
+	struct fec_enet_private *fep = netdev_priv(ndev);
+
+	netif_napi_del(&fep->napi);
+	fec_enet_free_queue(ndev);
+}
+
 #ifdef CONFIG_OF
 static int fec_reset_phy(struct platform_device *pdev)
 {
@@ -4547,6 +4576,7 @@
 	fec_enet_mii_remove(fep);
 failed_mii_init:
 failed_irq:
+	fec_enet_deinit(ndev);
 failed_init:
 	fec_ptp_stop(pdev);
 failed_reset:
@@ -4610,6 +4640,7 @@
 	pm_runtime_put_noidle(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 
+	fec_enet_deinit(ndev);
 	free_netdev(ndev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c
@@ -94,7 +94,7 @@
 		goto out_free;
 	}
 
-	snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start);
+	snprintf(bus->id, MII_BUS_ID_SIZE, "%pa", &res.start);
 	bus->priv = priv;
 
 	bus->parent = dev;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/fec_ptp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/fec_ptp.c
@@ -84,13 +84,36 @@
 #define FEC_CC_MULT	(1 << 31)
 #define FEC_COUNTER_PERIOD	(1 << 31)
 #define PPS_OUPUT_RELOAD_PERIOD	NSEC_PER_SEC
-#define FEC_CHANNLE_0		0
-#define DEFAULT_PPS_CHANNEL	FEC_CHANNLE_0
+#define DEFAULT_PPS_CHANNEL	0
 
 #define FEC_PTP_MAX_NSEC_PERIOD		4000000000ULL
 #define FEC_PTP_MAX_NSEC_COUNTER	0x80000000ULL
 
 /**
+ * fec_ptp_read - read raw cycle counter (to be used by time counter)
+ * @cc: the cyclecounter structure
+ *
+ * this function reads the cyclecounter registers and is called by the
+ * cyclecounter structure used to construct a ns counter from the
+ * arbitrary fixed point registers
+ */
+static u64 fec_ptp_read(const struct cyclecounter *cc)
+{
+	struct fec_enet_private *fep =
+		container_of(cc, struct fec_enet_private, cc);
+	u32 tempval;
+
+	tempval = readl(fep->hwp + FEC_ATIME_CTRL);
+	tempval |= FEC_T_CTRL_CAPTURE;
+	writel(tempval, fep->hwp + FEC_ATIME_CTRL);
+
+	if (fep->quirks & FEC_QUIRK_BUG_CAPTURE)
+		udelay(1);
+
+	return readl(fep->hwp + FEC_ATIME);
+}
+
+/**
  * fec_ptp_enable_pps
  * @fep: the fec_enet_private structure handle
  * @enable: enable the channel pps output
@@ -104,14 +127,13 @@
 	struct timespec64 ts;
 	u64 ns;
 
-	if (fep->pps_enable == enable)
-		return 0;
-
-	fep->pps_channel = DEFAULT_PPS_CHANNEL;
-	fep->reload_period = PPS_OUPUT_RELOAD_PERIOD;
-
 	spin_lock_irqsave(&fep->tmreg_lock, flags);
 
+	if (fep->pps_enable == enable) {
+		spin_unlock_irqrestore(&fep->tmreg_lock, flags);
+		return 0;
+	}
+
 	if (enable) {
 		/* clear capture or output compare interrupt status if have.
 		 */
@@ -137,7 +159,7 @@
 		 * NSEC_PER_SEC - ts.tv_nsec. Add the remaining nanoseconds
 		 * to current timer would be next second.
 		 */
-		tempval = fep->cc.read(&fep->cc);
+		tempval = fec_ptp_read(&fep->cc);
 		/* Convert the ptp local counter to 1588 timestamp */
 		ns = timecounter_cyc2time(&fep->tc, tempval);
 		ts = ns_to_timespec64(ns);
@@ -212,13 +234,7 @@
 	timecounter_read(&fep->tc);
 
 	/* Get the current ptp hardware time counter */
-	temp_val = readl(fep->hwp + FEC_ATIME_CTRL);
-	temp_val |= FEC_T_CTRL_CAPTURE;
-	writel(temp_val, fep->hwp + FEC_ATIME_CTRL);
-	if (fep->quirks & FEC_QUIRK_BUG_CAPTURE)
-		udelay(1);
-
-	ptp_hc = readl(fep->hwp + FEC_ATIME);
+	ptp_hc = fec_ptp_read(&fep->cc);
 
 	/* Convert the ptp local counter to 1588 timestamp */
 	curr_time = timecounter_cyc2time(&fep->tc, ptp_hc);
@@ -273,30 +289,6 @@
 }
 
 /**
- * fec_ptp_read - read raw cycle counter (to be used by time counter)
- * @cc: the cyclecounter structure
- *
- * this function reads the cyclecounter registers and is called by the
- * cyclecounter structure used to construct a ns counter from the
- * arbitrary fixed point registers
- */
-static u64 fec_ptp_read(const struct cyclecounter *cc)
-{
-	struct fec_enet_private *fep =
-		container_of(cc, struct fec_enet_private, cc);
-	u32 tempval;
-
-	tempval = readl(fep->hwp + FEC_ATIME_CTRL);
-	tempval |= FEC_T_CTRL_CAPTURE;
-	writel(tempval, fep->hwp + FEC_ATIME_CTRL);
-
-	if (fep->quirks & FEC_QUIRK_BUG_CAPTURE)
-		udelay(1);
-
-	return readl(fep->hwp + FEC_ATIME);
-}
-
-/**
  * fec_ptp_start_cyclecounter - create the cycle counter from hw
  * @ndev: network device
  *
@@ -532,6 +524,8 @@
 	int ret = 0;
 
 	if (rq->type == PTP_CLK_REQ_PPS) {
+		fep->reload_period = PPS_OUPUT_RELOAD_PERIOD;
+
 		ret = fec_ptp_enable_pps(fep, on);
 
 		return ret;
@@ -540,10 +534,9 @@
 		if (rq->perout.flags)
 			return -EOPNOTSUPP;
 
-		if (rq->perout.index != DEFAULT_PPS_CHANNEL)
+		if (rq->perout.index != fep->pps_channel)
 			return -EOPNOTSUPP;
 
-		fep->pps_channel = DEFAULT_PPS_CHANNEL;
 		period.tv_sec = rq->perout.period.sec;
 		period.tv_nsec = rq->perout.period.nsec;
 		period_ns = timespec64_to_ns(&period);
@@ -711,12 +704,16 @@
 {
 	struct net_device *ndev = platform_get_drvdata(pdev);
 	struct fec_enet_private *fep = netdev_priv(ndev);
+	struct device_node *np = fep->pdev->dev.of_node;
 	int irq;
 	int ret;
 
 	fep->ptp_caps.owner = THIS_MODULE;
 	strscpy(fep->ptp_caps.name, "fec ptp", sizeof(fep->ptp_caps.name));
 
+	fep->pps_channel = DEFAULT_PPS_CHANNEL;
+	of_property_read_u32(np, "fsl,pps-channel", &fep->pps_channel);
+
 	fep->ptp_caps.max_adj = 250000000;
 	fep->ptp_caps.n_alarm = 0;
 	fep->ptp_caps.n_ext_ts = 0;
@@ -768,11 +765,64 @@
 	schedule_delayed_work(&fep->time_keep, HZ);
 }
 
+void fec_ptp_save_state(struct fec_enet_private *fep)
+{
+	unsigned long flags;
+	u32 atime_inc_corr;
+
+	spin_lock_irqsave(&fep->tmreg_lock, flags);
+
+	fep->ptp_saved_state.pps_enable = fep->pps_enable;
+
+	fep->ptp_saved_state.ns_phc = timecounter_read(&fep->tc);
+	fep->ptp_saved_state.ns_sys = ktime_get_ns();
+
+	fep->ptp_saved_state.at_corr = readl(fep->hwp + FEC_ATIME_CORR);
+	atime_inc_corr = readl(fep->hwp + FEC_ATIME_INC) & FEC_T_INC_CORR_MASK;
+	fep->ptp_saved_state.at_inc_corr = (u8)(atime_inc_corr >> FEC_T_INC_CORR_OFFSET);
+
+	spin_unlock_irqrestore(&fep->tmreg_lock, flags);
+}
+
+/* Restore PTP functionality after a reset */
+void fec_ptp_restore_state(struct fec_enet_private *fep)
+{
+	u32 atime_inc = readl(fep->hwp + FEC_ATIME_INC) & FEC_T_INC_MASK;
+	unsigned long flags;
+	u32 counter;
+	u64 ns;
+
+	spin_lock_irqsave(&fep->tmreg_lock, flags);
+
+	/* Reset turned it off, so adjust our status flag */
+	fep->pps_enable = 0;
+
+	writel(fep->ptp_saved_state.at_corr, fep->hwp + FEC_ATIME_CORR);
+	atime_inc |= ((u32)fep->ptp_saved_state.at_inc_corr) << FEC_T_INC_CORR_OFFSET;
+	writel(atime_inc, fep->hwp + FEC_ATIME_INC);
+
+	ns = ktime_get_ns() - fep->ptp_saved_state.ns_sys + fep->ptp_saved_state.ns_phc;
+	counter = ns & fep->cc.mask;
+	writel(counter, fep->hwp + FEC_ATIME);
+	timecounter_init(&fep->tc, &fep->cc, ns);
+
+	spin_unlock_irqrestore(&fep->tmreg_lock, flags);
+
+	/* Restart PPS if needed */
+	if (fep->ptp_saved_state.pps_enable) {
+		/* Re-enable PPS */
+		fec_ptp_enable_pps(fep, 1);
+	}
+}
+
 void fec_ptp_stop(struct platform_device *pdev)
 {
 	struct net_device *ndev = platform_get_drvdata(pdev);
 	struct fec_enet_private *fep = netdev_priv(ndev);
 
+	if (fep->pps_enable)
+		fec_ptp_enable_pps(fep, 0);
+
 	cancel_delayed_work_sync(&fep->time_keep);
 	hrtimer_cancel(&fep->perout_timer);
 	if (fep->ptp_clock)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/fman/fman.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/fman/fman.c
@@ -24,7 +24,6 @@
 
 /* General defines */
 #define FMAN_LIODN_TBL			64	/* size of LIODN table */
-#define MAX_NUM_OF_MACS			10
 #define FM_NUM_OF_FMAN_CTRL_EVENT_REGS	4
 #define BASE_RX_PORTID			0x08
 #define BASE_TX_PORTID			0x28
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/fman/fman.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/fman/fman.h
@@ -74,6 +74,9 @@
 #define BM_MAX_NUM_OF_POOLS		64 /* Buffers pools */
 #define FMAN_PORT_MAX_EXT_POOLS_NUM	8  /* External BM pools per Rx port */
 
+/* General defines */
+#define MAX_NUM_OF_MACS			10
+
 struct fman; /* FMan data */
 
 /* Enum for defining port types */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/fman/mac.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/fman/mac.c
@@ -197,55 +197,72 @@
 		err = -EINVAL;
 		goto _return_of_node_put;
 	}
+	mac_dev->fman_dev = &of_dev->dev;
 
 	/* Get the FMan cell-index */
 	err = of_property_read_u32(dev_node, "cell-index", &val);
 	if (err) {
 		dev_err(dev, "failed to read cell-index for %pOF\n", dev_node);
 		err = -EINVAL;
-		goto _return_of_node_put;
+		goto _return_dev_put;
 	}
 	/* cell-index 0 => FMan id 1 */
 	fman_id = (u8)(val + 1);
 
-	priv->fman = fman_bind(&of_dev->dev);
+	priv->fman = fman_bind(mac_dev->fman_dev);
 	if (!priv->fman) {
 		dev_err(dev, "fman_bind(%pOF) failed\n", dev_node);
 		err = -ENODEV;
-		goto _return_of_node_put;
+		goto _return_dev_put;
 	}
 
+	/* Two references have been taken in of_find_device_by_node()
+	 * and fman_bind(). Release one of them here. The second one
+	 * will be released in mac_remove().
+	 */
+	put_device(mac_dev->fman_dev);
 	of_node_put(dev_node);
+	dev_node = NULL;
 
 	/* Get the address of the memory mapped registers */
 	mac_dev->res = platform_get_mem_or_io(_of_dev, 0);
 	if (!mac_dev->res) {
 		dev_err(dev, "could not get registers\n");
-		return -EINVAL;
+		err = -EINVAL;
+		goto _return_dev_put;
 	}
 
 	err = devm_request_resource(dev, fman_get_mem_region(priv->fman),
 				    mac_dev->res);
 	if (err) {
 		dev_err_probe(dev, err, "could not request resource\n");
-		return err;
+		goto _return_dev_put;
 	}
 
 	mac_dev->vaddr = devm_ioremap(dev, mac_dev->res->start,
 				      resource_size(mac_dev->res));
 	if (!mac_dev->vaddr) {
 		dev_err(dev, "devm_ioremap() failed\n");
-		return -EIO;
+		err = -EIO;
+		goto _return_dev_put;
 	}
 
-	if (!of_device_is_available(mac_node))
-		return -ENODEV;
+	if (!of_device_is_available(mac_node)) {
+		err = -ENODEV;
+		goto _return_dev_put;
+	}
 
 	/* Get the cell-index */
 	err = of_property_read_u32(mac_node, "cell-index", &val);
 	if (err) {
 		dev_err(dev, "failed to read cell-index for %pOF\n", mac_node);
-		return -EINVAL;
+		err = -EINVAL;
+		goto _return_dev_put;
+	}
+	if (val >= MAX_NUM_OF_MACS) {
+		dev_err(dev, "cell-index value is too big for %pOF\n", mac_node);
+		err = -EINVAL;
+		goto _return_dev_put;
 	}
 	priv->cell_index = (u8)val;
 
@@ -259,22 +276,26 @@
 	if (unlikely(nph < 0)) {
 		dev_err(dev, "of_count_phandle_with_args(%pOF, fsl,fman-ports) failed\n",
 			mac_node);
-		return nph;
+		err = nph;
+		goto _return_dev_put;
 	}
 
 	if (nph != ARRAY_SIZE(mac_dev->port)) {
 		dev_err(dev, "Not supported number of fman-ports handles of mac node %pOF from device tree\n",
 			mac_node);
-		return -EINVAL;
+		err = -EINVAL;
+		goto _return_dev_put;
 	}
 
-	for (i = 0; i < ARRAY_SIZE(mac_dev->port); i++) {
+	/* PORT_NUM determines the size of the port array */
+	for (i = 0; i < PORT_NUM; i++) {
 		/* Find the port node */
 		dev_node = of_parse_phandle(mac_node, "fsl,fman-ports", i);
 		if (!dev_node) {
 			dev_err(dev, "of_parse_phandle(%pOF, fsl,fman-ports) failed\n",
 				mac_node);
-			return -EINVAL;
+			err = -EINVAL;
+			goto _return_dev_arr_put;
 		}
 
 		of_dev = of_find_device_by_node(dev_node);
@@ -282,17 +303,24 @@
 			dev_err(dev, "of_find_device_by_node(%pOF) failed\n",
 				dev_node);
 			err = -EINVAL;
-			goto _return_of_node_put;
+			goto _return_dev_arr_put;
 		}
+		mac_dev->fman_port_devs[i] = &of_dev->dev;
 
-		mac_dev->port[i] = fman_port_bind(&of_dev->dev);
+		mac_dev->port[i] = fman_port_bind(mac_dev->fman_port_devs[i]);
 		if (!mac_dev->port[i]) {
 			dev_err(dev, "dev_get_drvdata(%pOF) failed\n",
 				dev_node);
 			err = -EINVAL;
-			goto _return_of_node_put;
+			goto _return_dev_arr_put;
 		}
+		/* Two references have been taken in of_find_device_by_node()
+		 * and fman_port_bind(). Release one of them here. The second
+		 * one will be released in mac_remove().
+		 */
+		put_device(mac_dev->fman_port_devs[i]);
 		of_node_put(dev_node);
+		dev_node = NULL;
 	}
 
 	/* Get the PHY connection type */
@@ -312,7 +340,7 @@
 
 	err = init(mac_dev, mac_node, &params);
 	if (err < 0)
-		return err;
+		goto _return_dev_arr_put;
 
 	if (!is_zero_ether_addr(mac_dev->addr))
 		dev_info(dev, "FMan MAC address: %pM\n", mac_dev->addr);
@@ -327,6 +355,12 @@
 
 	return err;
 
+_return_dev_arr_put:
+	/* mac_dev is kzalloc'ed */
+	for (i = 0; i < PORT_NUM; i++)
+		put_device(mac_dev->fman_port_devs[i]);
+_return_dev_put:
+	put_device(mac_dev->fman_dev);
 _return_of_node_put:
 	of_node_put(dev_node);
 	return err;
@@ -335,6 +369,11 @@
 static void mac_remove(struct platform_device *pdev)
 {
 	struct mac_device *mac_dev = platform_get_drvdata(pdev);
+	int		   i;
+
+	for (i = 0; i < PORT_NUM; i++)
+		put_device(mac_dev->fman_port_devs[i]);
+	put_device(mac_dev->fman_dev);
 
 	platform_device_unregister(mac_dev->priv->eth_dev);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/fman/mac.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/fman/mac.h
@@ -19,12 +19,13 @@
 struct fman_mac;
 struct mac_priv_s;
 
+#define PORT_NUM 2
 struct mac_device {
 	void __iomem		*vaddr;
 	struct device		*dev;
 	struct resource		*res;
 	u8			 addr[ETH_ALEN];
-	struct fman_port	*port[2];
+	struct fman_port	*port[PORT_NUM];
 	struct phylink		*phylink;
 	struct phylink_config	phylink_config;
 	phy_interface_t		phy_if;
@@ -52,6 +53,9 @@
 
 	struct fman_mac		*fman_mac;
 	struct mac_priv_s	*priv;
+
+	struct device		*fman_dev;
+	struct device		*fman_port_devs[PORT_NUM];
 };
 
 static inline struct mac_device
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
@@ -126,7 +126,7 @@
 	 * we get is an int, and the odds of multiple bitbang mdio buses
 	 * is low enough that it's not worth going too crazy.
 	 */
-	snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start);
+	snprintf(bus->id, MII_BUS_ID_SIZE, "%pa", &res.start);
 
 	data = of_get_property(np, "fsl,mdio-pin", &len);
 	if (!data || len != 4)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/google/gve/gve.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/google/gve/gve.h
@@ -678,6 +678,7 @@
 	union gve_adminq_command *adminq;
 	dma_addr_t adminq_bus_addr;
 	struct dma_pool *adminq_pool;
+	struct mutex adminq_lock; /* Protects adminq command execution */
 	u32 adminq_mask; /* masks prod_cnt to adminq size */
 	u32 adminq_prod_cnt; /* free-running count of AQ cmds executed */
 	u32 adminq_cmd_fail; /* free-running count of AQ cmds failed */
@@ -1051,6 +1052,7 @@
 void gve_xdp_tx_flush(struct gve_priv *priv, u32 xdp_qid);
 bool gve_tx_poll(struct gve_notify_block *block, int budget);
 bool gve_xdp_poll(struct gve_notify_block *block, int budget);
+int gve_xsk_tx_poll(struct gve_notify_block *block, int budget);
 int gve_tx_alloc_rings(struct gve_priv *priv, int start_id, int num_rings);
 void gve_tx_free_rings_gqi(struct gve_priv *priv, int start_id, int num_rings);
 u32 gve_tx_load_event_counter(struct gve_priv *priv,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/google/gve/gve_adminq.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -239,6 +239,7 @@
 			    &priv->reg_bar0->adminq_base_address_lo);
 		iowrite32be(GVE_DRIVER_STATUS_RUN_MASK, &priv->reg_bar0->driver_status);
 	}
+	mutex_init(&priv->adminq_lock);
 	gve_set_admin_queue_ok(priv);
 	return 0;
 }
@@ -466,28 +467,29 @@
 	return 0;
 }
 
-/* This function is not threadsafe - the caller is responsible for any
- * necessary locks.
- * The caller is also responsible for making sure there are no commands
- * waiting to be executed.
- */
 static int gve_adminq_execute_cmd(struct gve_priv *priv,
 				  union gve_adminq_command *cmd_orig)
 {
 	u32 tail, head;
 	int err;
 
+	mutex_lock(&priv->adminq_lock);
 	tail = ioread32be(&priv->reg_bar0->adminq_event_counter);
 	head = priv->adminq_prod_cnt;
-	if (tail != head)
-		// This is not a valid path
-		return -EINVAL;
+	if (tail != head) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	err = gve_adminq_issue_cmd(priv, cmd_orig);
 	if (err)
-		return err;
+		goto out;
+
+	err = gve_adminq_kick_and_wait(priv);
 
-	return gve_adminq_kick_and_wait(priv);
+out:
+	mutex_unlock(&priv->adminq_lock);
+	return err;
 }
 
 /* The device specifies that the management vector can either be the first irq
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/google/gve/gve_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/google/gve/gve_main.c
@@ -275,6 +275,14 @@
 
 	if (block->rx) {
 		work_done = gve_rx_poll(block, budget);
+
+		/* Poll XSK TX as part of RX NAPI. Setup re-poll based on max of
+		 * TX and RX work done.
+		 */
+		if (priv->xdp_prog)
+			work_done = max_t(int, work_done,
+					  gve_xsk_tx_poll(block, budget));
+
 		reschedule |= work_done == budget;
 	}
 
@@ -1540,8 +1548,8 @@
 	if (err)
 		return err;
 
-	/* If XDP prog is not installed, return */
-	if (!priv->xdp_prog)
+	/* If XDP prog is not installed or interface is down, return. */
+	if (!priv->xdp_prog || !netif_running(dev))
 		return 0;
 
 	rx = &priv->rx[qid];
@@ -1586,21 +1594,16 @@
 	if (qid >= priv->rx_cfg.num_queues)
 		return -EINVAL;
 
-	/* If XDP prog is not installed, unmap DMA and return */
-	if (!priv->xdp_prog)
-		goto done;
-
-	tx_qid = gve_xdp_tx_queue_id(priv, qid);
-	if (!netif_running(dev)) {
-		priv->rx[qid].xsk_pool = NULL;
-		xdp_rxq_info_unreg(&priv->rx[qid].xsk_rxq);
-		priv->tx[tx_qid].xsk_pool = NULL;
+	/* If XDP prog is not installed or interface is down, unmap DMA and
+	 * return.
+	 */
+	if (!priv->xdp_prog || !netif_running(dev))
 		goto done;
-	}
 
 	napi_rx = &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi;
 	napi_disable(napi_rx); /* make sure current rx poll is done */
 
+	tx_qid = gve_xdp_tx_queue_id(priv, qid);
 	napi_tx = &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi;
 	napi_disable(napi_tx); /* make sure current tx poll is done */
 
@@ -1626,24 +1629,20 @@
 static int gve_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags)
 {
 	struct gve_priv *priv = netdev_priv(dev);
-	int tx_queue_id = gve_xdp_tx_queue_id(priv, queue_id);
+	struct napi_struct *napi;
+
+	if (!gve_get_napi_enabled(priv))
+		return -ENETDOWN;
 
 	if (queue_id >= priv->rx_cfg.num_queues || !priv->xdp_prog)
 		return -EINVAL;
 
-	if (flags & XDP_WAKEUP_TX) {
-		struct gve_tx_ring *tx = &priv->tx[tx_queue_id];
-		struct napi_struct *napi =
-			&priv->ntfy_blocks[tx->ntfy_id].napi;
-
-		if (!napi_if_scheduled_mark_missed(napi)) {
-			/* Call local_bh_enable to trigger SoftIRQ processing */
-			local_bh_disable();
-			napi_schedule(napi);
-			local_bh_enable();
-		}
-
-		tx->xdp_xsk_wakeup++;
+	napi = &priv->ntfy_blocks[gve_rx_idx_to_ntfy(priv, queue_id)].napi;
+	if (!napi_if_scheduled_mark_missed(napi)) {
+		/* Call local_bh_enable to trigger SoftIRQ processing */
+		local_bh_disable();
+		napi_schedule(napi);
+		local_bh_enable();
 	}
 
 	return 0;
@@ -1769,6 +1768,9 @@
 
 	gve_clear_napi_enabled(priv);
 	gve_clear_report_stats(priv);
+
+	/* Make sure that all traffic is finished processing. */
+	synchronize_net();
 }
 
 static void gve_turnup(struct gve_priv *priv)
@@ -2021,14 +2023,18 @@
 
 static void gve_set_netdev_xdp_features(struct gve_priv *priv)
 {
+	xdp_features_t xdp_features;
+
 	if (priv->queue_format == GVE_GQI_QPL_FORMAT) {
-		priv->dev->xdp_features = NETDEV_XDP_ACT_BASIC;
-		priv->dev->xdp_features |= NETDEV_XDP_ACT_REDIRECT;
-		priv->dev->xdp_features |= NETDEV_XDP_ACT_NDO_XMIT;
-		priv->dev->xdp_features |= NETDEV_XDP_ACT_XSK_ZEROCOPY;
+		xdp_features = NETDEV_XDP_ACT_BASIC;
+		xdp_features |= NETDEV_XDP_ACT_REDIRECT;
+		xdp_features |= NETDEV_XDP_ACT_NDO_XMIT;
+		xdp_features |= NETDEV_XDP_ACT_XSK_ZEROCOPY;
 	} else {
-		priv->dev->xdp_features = 0;
+		xdp_features = 0;
 	}
+
+	xdp_set_features_flag(priv->dev, xdp_features);
 }
 
 static int gve_init_priv(struct gve_priv *priv, bool skip_describe_device)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/google/gve/gve_rx_dqo.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/google/gve/gve_rx_dqo.c
@@ -506,11 +506,13 @@
 	skb_set_hash(skb, le32_to_cpu(compl_desc->hash), hash_type);
 }
 
-static void gve_rx_free_skb(struct gve_rx_ring *rx)
+static void gve_rx_free_skb(struct napi_struct *napi, struct gve_rx_ring *rx)
 {
 	if (!rx->ctx.skb_head)
 		return;
 
+	if (rx->ctx.skb_head == napi->skb)
+		napi->skb = NULL;
 	dev_kfree_skb_any(rx->ctx.skb_head);
 	rx->ctx.skb_head = NULL;
 	rx->ctx.skb_tail = NULL;
@@ -783,7 +785,7 @@
 
 		err = gve_rx_dqo(napi, rx, compl_desc, rx->q_num);
 		if (err < 0) {
-			gve_rx_free_skb(rx);
+			gve_rx_free_skb(napi, rx);
 			u64_stats_update_begin(&rx->statss);
 			if (err == -ENOMEM)
 				rx->rx_skb_alloc_fail++;
@@ -826,7 +828,7 @@
 
 		/* gve_rx_complete_skb() will consume skb if successful */
 		if (gve_rx_complete_skb(rx, napi, compl_desc, feat) != 0) {
-			gve_rx_free_skb(rx);
+			gve_rx_free_skb(napi, rx);
 			u64_stats_update_begin(&rx->statss);
 			rx->rx_desc_err_dropped_pkt++;
 			u64_stats_update_end(&rx->statss);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/google/gve/gve_tx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/google/gve/gve_tx.c
@@ -158,15 +158,16 @@
 			      u32 to_do)
 {
 	struct gve_tx_buffer_state *info;
-	u32 clean_end = tx->done + to_do;
 	u64 pkts = 0, bytes = 0;
 	size_t space_freed = 0;
 	u32 xsk_complete = 0;
 	u32 idx;
+	int i;
 
-	for (; tx->done < clean_end; tx->done++) {
+	for (i = 0; i < to_do; i++) {
 		idx = tx->done & tx->mask;
 		info = &tx->info[idx];
+		tx->done++;
 
 		if (unlikely(!info->xdp.size))
 			continue;
@@ -776,9 +777,12 @@
 	struct gve_tx_ring *tx;
 	int i, err = 0, qid;
 
-	if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK))
+	if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK) || !priv->xdp_prog)
 		return -EINVAL;
 
+	if (!gve_get_napi_enabled(priv))
+		return -ENETDOWN;
+
 	qid = gve_xdp_tx_queue_id(priv,
 				  smp_processor_id() % priv->num_xdp_queues);
 
@@ -917,33 +921,41 @@
 	return sent;
 }
 
+int gve_xsk_tx_poll(struct gve_notify_block *rx_block, int budget)
+{
+	struct gve_rx_ring *rx = rx_block->rx;
+	struct gve_priv *priv = rx->gve;
+	struct gve_tx_ring *tx;
+	int sent = 0;
+
+	tx = &priv->tx[gve_xdp_tx_queue_id(priv, rx->q_num)];
+	if (tx->xsk_pool) {
+		sent = gve_xsk_tx(priv, tx, budget);
+
+		u64_stats_update_begin(&tx->statss);
+		tx->xdp_xsk_sent += sent;
+		u64_stats_update_end(&tx->statss);
+		if (xsk_uses_need_wakeup(tx->xsk_pool))
+			xsk_set_tx_need_wakeup(tx->xsk_pool);
+	}
+
+	return sent;
+}
+
 bool gve_xdp_poll(struct gve_notify_block *block, int budget)
 {
 	struct gve_priv *priv = block->priv;
 	struct gve_tx_ring *tx = block->tx;
 	u32 nic_done;
-	bool repoll;
 	u32 to_do;
 
 	/* Find out how much work there is to be done */
 	nic_done = gve_tx_load_event_counter(priv, tx);
 	to_do = min_t(u32, (nic_done - tx->done), budget);
 	gve_clean_xdp_done(priv, tx, to_do);
-	repoll = nic_done != tx->done;
-
-	if (tx->xsk_pool) {
-		int sent = gve_xsk_tx(priv, tx, budget);
-
-		u64_stats_update_begin(&tx->statss);
-		tx->xdp_xsk_sent += sent;
-		u64_stats_update_end(&tx->statss);
-		repoll |= (sent == budget);
-		if (xsk_uses_need_wakeup(tx->xsk_pool))
-			xsk_set_tx_need_wakeup(tx->xsk_pool);
-	}
 
 	/* If we still have work we want to repoll */
-	return repoll;
+	return nic_done != tx->done;
 }
 
 bool gve_tx_poll(struct gve_notify_block *block, int budget)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/google/gve/gve_tx_dqo.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/google/gve/gve_tx_dqo.c
@@ -501,28 +501,18 @@
 	if (unlikely(skb_shinfo(skb)->gso_size < GVE_TX_MIN_TSO_MSS_DQO))
 		return -1;
 
+	if (!(skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+		return -EINVAL;
+
 	/* Needed because we will modify header. */
 	err = skb_cow_head(skb, 0);
 	if (err < 0)
 		return err;
 
 	tcp = tcp_hdr(skb);
-
-	/* Remove payload length from checksum. */
 	paylen = skb->len - skb_transport_offset(skb);
-
-	switch (skb_shinfo(skb)->gso_type) {
-	case SKB_GSO_TCPV4:
-	case SKB_GSO_TCPV6:
-		csum_replace_by_diff(&tcp->check,
-				     (__force __wsum)htonl(paylen));
-
-		/* Compute length of segmentation header. */
-		header_len = skb_tcp_all_headers(skb);
-		break;
-	default:
-		return -EINVAL;
-	}
+	csum_replace_by_diff(&tcp->check, (__force __wsum)htonl(paylen));
+	header_len = skb_tcp_all_headers(skb);
 
 	if (unlikely(header_len > GVE_TX_MAX_HDR_SIZE_DQO))
 		return -EINVAL;
@@ -822,22 +812,42 @@
 	const int header_len = skb_tcp_all_headers(skb);
 	const int gso_size = shinfo->gso_size;
 	int cur_seg_num_bufs;
+	int prev_frag_size;
 	int cur_seg_size;
 	int i;
 
 	cur_seg_size = skb_headlen(skb) - header_len;
+	prev_frag_size = skb_headlen(skb);
 	cur_seg_num_bufs = cur_seg_size > 0;
 
 	for (i = 0; i < shinfo->nr_frags; i++) {
 		if (cur_seg_size >= gso_size) {
 			cur_seg_size %= gso_size;
 			cur_seg_num_bufs = cur_seg_size > 0;
+
+			if (prev_frag_size > GVE_TX_MAX_BUF_SIZE_DQO) {
+				int prev_frag_remain = prev_frag_size %
+					GVE_TX_MAX_BUF_SIZE_DQO;
+
+				/* If the last descriptor of the previous frag
+				 * is less than cur_seg_size, the segment will
+				 * span two descriptors in the previous frag.
+				 * Since max gso size (9728) is less than
+				 * GVE_TX_MAX_BUF_SIZE_DQO, it is impossible
+				 * for the segment to span more than two
+				 * descriptors.
+				 */
+				if (prev_frag_remain &&
+				    cur_seg_size > prev_frag_remain)
+					cur_seg_num_bufs++;
+			}
 		}
 
 		if (unlikely(++cur_seg_num_bufs > max_bufs_per_seg))
 			return false;
 
-		cur_seg_size += skb_frag_size(&shinfo->frags[i]);
+		prev_frag_size = skb_frag_size(&shinfo->frags[i]);
+		cur_seg_size += prev_frag_size;
 	}
 
 	return true;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -947,6 +947,7 @@
 	priv->tx_coalesce_timer.function = tx_done;
 
 	priv->map = syscon_node_to_regmap(arg.np);
+	of_node_put(arg.np);
 	if (IS_ERR(priv->map)) {
 		dev_warn(d, "no syscon hisilicon,hip04-ppe\n");
 		ret = PTR_ERR(priv->map);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -933,6 +933,7 @@
 			mac_cb->cpld_ctrl = NULL;
 		} else {
 			syscon = syscon_node_to_regmap(cpld_args.np);
+			of_node_put(cpld_args.np);
 			if (IS_ERR_OR_NULL(syscon)) {
 				dev_dbg(mac_cb->dev, "no cpld-syscon found!\n");
 				mac_cb->cpld_ctrl = NULL;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/Makefile
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/Makefile
@@ -15,15 +15,14 @@
 
 hns3-$(CONFIG_HNS3_DCB) += hns3_dcbnl.o
 
-obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o
+obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o hclge-common.o
 
-hclgevf-objs = hns3vf/hclgevf_main.o hns3vf/hclgevf_mbx.o  hns3vf/hclgevf_devlink.o hns3vf/hclgevf_regs.o \
-		hns3_common/hclge_comm_cmd.o hns3_common/hclge_comm_rss.o hns3_common/hclge_comm_tqp_stats.o
+hclge-common-objs += hns3_common/hclge_comm_cmd.o hns3_common/hclge_comm_rss.o hns3_common/hclge_comm_tqp_stats.o
 
-obj-$(CONFIG_HNS3_HCLGE) += hclge.o
+hclgevf-objs = hns3vf/hclgevf_main.o hns3vf/hclgevf_mbx.o  hns3vf/hclgevf_devlink.o hns3vf/hclgevf_regs.o
+
+obj-$(CONFIG_HNS3_HCLGE) += hclge.o hclge-common.o
 hclge-objs = hns3pf/hclge_main.o hns3pf/hclge_mdio.o hns3pf/hclge_tm.o hns3pf/hclge_regs.o \
 		hns3pf/hclge_mbx.o hns3pf/hclge_err.o  hns3pf/hclge_debugfs.o hns3pf/hclge_ptp.o hns3pf/hclge_devlink.o \
-		hns3_common/hclge_comm_cmd.o hns3_common/hclge_comm_rss.o hns3_common/hclge_comm_tqp_stats.o
-
 
 hclge-$(CONFIG_HNS3_DCB) += hns3pf/hclge_dcb.o
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hnae3.c
@@ -25,8 +25,11 @@
 		pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev);
 		if (!pci_id)
 			continue;
-		if (IS_ENABLED(CONFIG_PCI_IOV))
+		if (IS_ENABLED(CONFIG_PCI_IOV)) {
+			device_lock(&ae_dev->pdev->dev);
 			pci_disable_sriov(ae_dev->pdev);
+			device_unlock(&ae_dev->pdev->dev);
+		}
 	}
 }
 EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hnae3.h
@@ -895,15 +895,12 @@
 		struct hnae3_roce_private_info rinfo;
 	};
 
-	u32 numa_node_mask;	/* for multi-chip support */
+	nodemask_t numa_node_mask; /* for multi-chip support */
 
 	enum hnae3_port_base_vlan_state port_base_vlan_state;
 
 	u8 netdev_flags;
 	struct dentry *hnae3_dbgfs;
-	/* protects concurrent contention between debugfs commands */
-	struct mutex dbgfs_lock;
-	char **dbgfs_buf;
 
 	/* Network interface message level enabled bits */
 	u32 msg_enable;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c
@@ -48,6 +48,7 @@
 	else
 		desc->flag &= cpu_to_le16(~HCLGE_COMM_CMD_FLAG_WR);
 }
+EXPORT_SYMBOL_GPL(hclge_comm_cmd_reuse_desc);
 
 static void hclge_comm_set_default_capability(struct hnae3_ae_dev *ae_dev,
 					      bool is_pf)
@@ -72,6 +73,7 @@
 	if (is_read)
 		desc->flag |= cpu_to_le16(HCLGE_COMM_CMD_FLAG_WR);
 }
+EXPORT_SYMBOL_GPL(hclge_comm_cmd_setup_basic_desc);
 
 int hclge_comm_firmware_compat_config(struct hnae3_ae_dev *ae_dev,
 				      struct hclge_comm_hw *hw, bool en)
@@ -509,6 +511,7 @@
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_cmd_send);
 
 static void hclge_comm_cmd_uninit_regs(struct hclge_comm_hw *hw)
 {
@@ -545,6 +548,7 @@
 	hclge_comm_free_cmd_desc(&cmdq->csq);
 	hclge_comm_free_cmd_desc(&cmdq->crq);
 }
+EXPORT_SYMBOL_GPL(hclge_comm_cmd_uninit);
 
 int hclge_comm_cmd_queue_init(struct pci_dev *pdev, struct hclge_comm_hw *hw)
 {
@@ -583,6 +587,7 @@
 	hclge_comm_free_cmd_desc(&hw->cmq.csq);
 	return ret;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_cmd_queue_init);
 
 int hclge_comm_cmd_init(struct hnae3_ae_dev *ae_dev, struct hclge_comm_hw *hw,
 			u32 *fw_version, bool is_pf,
@@ -653,3 +658,8 @@
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_cmd_init);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("HNS3: Hisilicon Ethernet PF/VF Common Library");
+MODULE_AUTHOR("Huawei Tech. Co., Ltd.");
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c
@@ -62,6 +62,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_rss_init_cfg);
 
 void hclge_comm_get_rss_tc_info(u16 rss_size, u8 hw_tc_map, u16 *tc_offset,
 				u16 *tc_valid, u16 *tc_size)
@@ -78,6 +79,7 @@
 		tc_offset[i] = (hw_tc_map & BIT(i)) ? rss_size * i : 0;
 	}
 }
+EXPORT_SYMBOL_GPL(hclge_comm_get_rss_tc_info);
 
 int hclge_comm_set_rss_tc_mode(struct hclge_comm_hw *hw, u16 *tc_offset,
 			       u16 *tc_valid, u16 *tc_size)
@@ -113,6 +115,7 @@
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_set_rss_tc_mode);
 
 int hclge_comm_set_rss_hash_key(struct hclge_comm_rss_cfg *rss_cfg,
 				struct hclge_comm_hw *hw, const u8 *key,
@@ -143,6 +146,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_set_rss_hash_key);
 
 int hclge_comm_set_rss_tuple(struct hnae3_ae_dev *ae_dev,
 			     struct hclge_comm_hw *hw,
@@ -185,11 +189,13 @@
 	rss_cfg->rss_tuple_sets.ipv6_fragment_en = req->ipv6_fragment_en;
 	return 0;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_set_rss_tuple);
 
 u32 hclge_comm_get_rss_key_size(struct hnae3_handle *handle)
 {
 	return HCLGE_COMM_RSS_KEY_SIZE;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_get_rss_key_size);
 
 int hclge_comm_parse_rss_hfunc(struct hclge_comm_rss_cfg *rss_cfg,
 			       const u8 hfunc, u8 *hash_algo)
@@ -217,6 +223,7 @@
 	for (i = 0; i < ae_dev->dev_specs.rss_ind_tbl_size; i++)
 		rss_cfg->rss_indirection_tbl[i] = i % rss_cfg->rss_size;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_rss_indir_init_cfg);
 
 int hclge_comm_get_rss_tuple(struct hclge_comm_rss_cfg *rss_cfg, int flow_type,
 			     u8 *tuple_sets)
@@ -250,6 +257,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_get_rss_tuple);
 
 static void
 hclge_comm_append_rss_msb_info(struct hclge_comm_rss_ind_tbl_cmd *req,
@@ -304,6 +312,7 @@
 	}
 	return 0;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_set_rss_indir_table);
 
 int hclge_comm_set_rss_input_tuple(struct hclge_comm_hw *hw,
 				   struct hclge_comm_rss_cfg *rss_cfg)
@@ -332,6 +341,7 @@
 			"failed to configure rss input, ret = %d.\n", ret);
 	return ret;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_set_rss_input_tuple);
 
 void hclge_comm_get_rss_hash_info(struct hclge_comm_rss_cfg *rss_cfg, u8 *key,
 				  u8 *hfunc)
@@ -355,6 +365,7 @@
 	if (key)
 		memcpy(key, rss_cfg->rss_hash_key, HCLGE_COMM_RSS_KEY_SIZE);
 }
+EXPORT_SYMBOL_GPL(hclge_comm_get_rss_hash_info);
 
 void hclge_comm_get_rss_indir_tbl(struct hclge_comm_rss_cfg *rss_cfg,
 				  u32 *indir, u16 rss_ind_tbl_size)
@@ -367,6 +378,7 @@
 	for (i = 0; i < rss_ind_tbl_size; i++)
 		indir[i] = rss_cfg->rss_indirection_tbl[i];
 }
+EXPORT_SYMBOL_GPL(hclge_comm_get_rss_indir_tbl);
 
 int hclge_comm_set_rss_algo_key(struct hclge_comm_hw *hw, const u8 hfunc,
 				const u8 *key)
@@ -408,6 +420,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_set_rss_algo_key);
 
 static u8 hclge_comm_get_rss_hash_bits(struct ethtool_rxnfc *nfc)
 {
@@ -502,3 +515,4 @@
 
 	return tuple_data;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_convert_rss_tuple);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c
@@ -26,6 +26,7 @@
 
 	return buff;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_tqps_get_stats);
 
 int hclge_comm_tqps_get_sset_count(struct hnae3_handle *handle)
 {
@@ -33,6 +34,7 @@
 
 	return kinfo->num_tqps * HCLGE_COMM_QUEUE_PAIR_SIZE;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_tqps_get_sset_count);
 
 u8 *hclge_comm_tqps_get_strings(struct hnae3_handle *handle, u8 *data)
 {
@@ -56,6 +58,7 @@
 
 	return buff;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_tqps_get_strings);
 
 int hclge_comm_tqps_update_stats(struct hnae3_handle *handle,
 				 struct hclge_comm_hw *hw)
@@ -85,7 +88,7 @@
 		hclge_comm_cmd_setup_basic_desc(&desc, HCLGE_OPC_QUERY_TX_STATS,
 						true);
 
-		desc.data[0] = cpu_to_le32(tqp->index & 0x1ff);
+		desc.data[0] = cpu_to_le32(tqp->index);
 		ret = hclge_comm_cmd_send(hw, &desc, 1);
 		if (ret) {
 			dev_err(&hw->cmq.csq.pdev->dev,
@@ -99,6 +102,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(hclge_comm_tqps_update_stats);
 
 void hclge_comm_reset_tqp_stats(struct hnae3_handle *handle)
 {
@@ -113,3 +117,4 @@
 		memset(&tqp->tqp_stats, 0, sizeof(tqp->tqp_stats));
 	}
 }
+EXPORT_SYMBOL_GPL(hclge_comm_reset_tqp_stats);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_dcbnl.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3_dcbnl.c
@@ -76,7 +76,7 @@
 	if (hns3_nic_resetting(ndev))
 		return -EBUSY;
 
-	if (h->kinfo.dcb_ops->ieee_setapp)
+	if (h->kinfo.dcb_ops->ieee_delapp)
 		return h->kinfo.dcb_ops->ieee_delapp(h, app);
 
 	return -EOPNOTSUPP;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
@@ -1258,69 +1258,55 @@
 static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer,
 			     size_t count, loff_t *ppos)
 {
-	struct hns3_dbg_data *dbg_data = filp->private_data;
+	char *buf = filp->private_data;
+
+	return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
+}
+
+static int hns3_dbg_open(struct inode *inode, struct file *filp)
+{
+	struct hns3_dbg_data *dbg_data = inode->i_private;
 	struct hnae3_handle *handle = dbg_data->handle;
 	struct hns3_nic_priv *priv = handle->priv;
-	ssize_t size = 0;
-	char **save_buf;
-	char *read_buf;
 	u32 index;
+	char *buf;
 	int ret;
 
+	if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state) ||
+	    test_bit(HNS3_NIC_STATE_RESETTING, &priv->state))
+		return -EBUSY;
+
 	ret = hns3_dbg_get_cmd_index(dbg_data, &index);
 	if (ret)
 		return ret;
 
-	mutex_lock(&handle->dbgfs_lock);
-	save_buf = &handle->dbgfs_buf[index];
-
-	if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state) ||
-	    test_bit(HNS3_NIC_STATE_RESETTING, &priv->state)) {
-		ret = -EBUSY;
-		goto out;
-	}
-
-	if (*save_buf) {
-		read_buf = *save_buf;
-	} else {
-		read_buf = kvzalloc(hns3_dbg_cmd[index].buf_len, GFP_KERNEL);
-		if (!read_buf) {
-			ret = -ENOMEM;
-			goto out;
-		}
-
-		/* save the buffer addr until the last read operation */
-		*save_buf = read_buf;
-
-		/* get data ready for the first time to read */
-		ret = hns3_dbg_read_cmd(dbg_data, hns3_dbg_cmd[index].cmd,
-					read_buf, hns3_dbg_cmd[index].buf_len);
-		if (ret)
-			goto out;
-	}
+	buf = kvzalloc(hns3_dbg_cmd[index].buf_len, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
 
-	size = simple_read_from_buffer(buffer, count, ppos, read_buf,
-				       strlen(read_buf));
-	if (size > 0) {
-		mutex_unlock(&handle->dbgfs_lock);
-		return size;
+	ret = hns3_dbg_read_cmd(dbg_data, hns3_dbg_cmd[index].cmd,
+				buf, hns3_dbg_cmd[index].buf_len);
+	if (ret) {
+		kvfree(buf);
+		return ret;
 	}
 
-out:
-	/* free the buffer for the last read operation */
-	if (*save_buf) {
-		kvfree(*save_buf);
-		*save_buf = NULL;
-	}
+	filp->private_data = buf;
+	return 0;
+}
 
-	mutex_unlock(&handle->dbgfs_lock);
-	return ret;
+static int hns3_dbg_release(struct inode *inode, struct file *filp)
+{
+	kvfree(filp->private_data);
+	filp->private_data = NULL;
+	return 0;
 }
 
 static const struct file_operations hns3_dbg_fops = {
 	.owner = THIS_MODULE,
-	.open  = simple_open,
+	.open  = hns3_dbg_open,
 	.read  = hns3_dbg_read,
+	.release = hns3_dbg_release,
 };
 
 static int hns3_dbg_bd_file_init(struct hnae3_handle *handle, u32 cmd)
@@ -1377,13 +1363,6 @@
 	int ret;
 	u32 i;
 
-	handle->dbgfs_buf = devm_kcalloc(&handle->pdev->dev,
-					 ARRAY_SIZE(hns3_dbg_cmd),
-					 sizeof(*handle->dbgfs_buf),
-					 GFP_KERNEL);
-	if (!handle->dbgfs_buf)
-		return -ENOMEM;
-
 	hns3_dbg_dentry[HNS3_DBG_DENTRY_COMMON].dentry =
 				debugfs_create_dir(name, hns3_dbgfs_root);
 	handle->hnae3_dbgfs = hns3_dbg_dentry[HNS3_DBG_DENTRY_COMMON].dentry;
@@ -1393,8 +1372,6 @@
 			debugfs_create_dir(hns3_dbg_dentry[i].name,
 					   handle->hnae3_dbgfs);
 
-	mutex_init(&handle->dbgfs_lock);
-
 	for (i = 0; i < ARRAY_SIZE(hns3_dbg_cmd); i++) {
 		if ((hns3_dbg_cmd[i].cmd == HNAE3_DBG_CMD_TM_NODES &&
 		     ae_dev->dev_version <= HNAE3_DEVICE_VERSION_V2) ||
@@ -1423,24 +1400,13 @@
 out:
 	debugfs_remove_recursive(handle->hnae3_dbgfs);
 	handle->hnae3_dbgfs = NULL;
-	mutex_destroy(&handle->dbgfs_lock);
 	return ret;
 }
 
 void hns3_dbg_uninit(struct hnae3_handle *handle)
 {
-	u32 i;
-
 	debugfs_remove_recursive(handle->hnae3_dbgfs);
 	handle->hnae3_dbgfs = NULL;
-
-	for (i = 0; i < ARRAY_SIZE(hns3_dbg_cmd); i++)
-		if (handle->dbgfs_buf[i]) {
-			kvfree(handle->dbgfs_buf[i]);
-			handle->dbgfs_buf[i] = NULL;
-		}
-
-	mutex_destroy(&handle->dbgfs_lock);
 }
 
 void hns3_dbg_register_debugfs(const char *debugfs_dir_name)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2456,7 +2456,6 @@
 			return ret;
 	}
 
-	netdev->features = features;
 	return 0;
 }
 
@@ -3539,6 +3538,9 @@
 		ret = hns3_alloc_and_attach_buffer(ring, i);
 		if (ret)
 			goto out_buffer_fail;
+
+		if (!(i % HNS3_RESCHED_BD_NUM))
+			cond_resched();
 	}
 
 	return 0;
@@ -5111,6 +5113,7 @@
 		}
 
 		u64_stats_init(&priv->ring[i].syncp);
+		cond_resched();
 	}
 
 	return 0;
@@ -5724,6 +5727,9 @@
 	struct net_device *netdev = handle->kinfo.netdev;
 	struct hns3_nic_priv *priv = netdev_priv(netdev);
 
+	if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state))
+		hns3_nic_net_stop(netdev);
+
 	if (!test_and_clear_bit(HNS3_NIC_STATE_INITED, &priv->state)) {
 		netdev_warn(netdev, "already uninitialized\n");
 		return 0;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
@@ -214,6 +214,8 @@
 #define HNS3_CQ_MODE_EQE			1U
 #define HNS3_CQ_MODE_CQE			0U
 
+#define HNS3_RESCHED_BD_NUM			1024
+
 enum hns3_pkt_l2t_type {
 	HNS3_L2_TYPE_UNICAST,
 	HNS3_L2_TYPE_MULTICAST,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -78,6 +78,9 @@
 #define HNS3_NIC_LB_TEST_NO_MEM_ERR	1
 #define HNS3_NIC_LB_TEST_TX_CNT_ERR	2
 #define HNS3_NIC_LB_TEST_RX_CNT_ERR	3
+#define HNS3_NIC_LB_TEST_UNEXECUTED	4
+
+static int hns3_get_sset_count(struct net_device *netdev, int stringset);
 
 static int hns3_lp_setup(struct net_device *ndev, enum hnae3_loop loop, bool en)
 {
@@ -418,18 +421,26 @@
 static void hns3_self_test(struct net_device *ndev,
 			   struct ethtool_test *eth_test, u64 *data)
 {
+	int cnt = hns3_get_sset_count(ndev, ETH_SS_TEST);
 	struct hns3_nic_priv *priv = netdev_priv(ndev);
 	struct hnae3_handle *h = priv->ae_handle;
 	int st_param[HNAE3_LOOP_NONE][2];
 	bool if_running = netif_running(ndev);
+	int i;
+
+	/* initialize the loopback test result, avoid marking an unexcuted
+	 * loopback test as PASS.
+	 */
+	for (i = 0; i < cnt; i++)
+		data[i] = HNS3_NIC_LB_TEST_UNEXECUTED;
 
 	if (hns3_nic_resetting(ndev)) {
 		netdev_err(ndev, "dev resetting!");
-		return;
+		goto failure;
 	}
 
 	if (!(eth_test->flags & ETH_TEST_FL_OFFLINE))
-		return;
+		goto failure;
 
 	if (netif_msg_ifdown(h))
 		netdev_info(ndev, "self test start\n");
@@ -451,6 +462,10 @@
 
 	if (netif_msg_ifdown(h))
 		netdev_info(ndev, "self test end\n");
+	return;
+
+failure:
+	eth_test->flags |= ETH_TEST_FL_FAILED;
 }
 
 static void hns3_update_limit_promisc_mode(struct net_device *netdev,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -6,6 +6,7 @@
 #include <linux/etherdevice.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
@@ -1524,6 +1525,9 @@
 			cfg.default_speed, ret);
 		return ret;
 	}
+	hdev->hw.mac.req_speed = hdev->hw.mac.speed;
+	hdev->hw.mac.req_autoneg = AUTONEG_ENABLE;
+	hdev->hw.mac.req_duplex = DUPLEX_FULL;
 
 	hclge_parse_link_mode(hdev, cfg.speed_ability);
 
@@ -1753,7 +1757,8 @@
 
 	nic->pdev = hdev->pdev;
 	nic->ae_algo = &ae_algo;
-	nic->numa_node_mask = hdev->numa_node_mask;
+	bitmap_copy(nic->numa_node_mask.bits, hdev->numa_node_mask.bits,
+		    MAX_NUMNODES);
 	nic->kinfo.io_base = hdev->hw.hw.io_base;
 
 	ret = hclge_knic_setup(vport, num_tqps,
@@ -2445,7 +2450,8 @@
 
 	roce->pdev = nic->pdev;
 	roce->ae_algo = nic->ae_algo;
-	roce->numa_node_mask = nic->numa_node_mask;
+	bitmap_copy(roce->numa_node_mask.bits, nic->numa_node_mask.bits,
+		    MAX_NUMNODES);
 
 	return 0;
 }
@@ -2591,8 +2597,17 @@
 {
 	struct hclge_vport *vport = hclge_get_vport(handle);
 	struct hclge_dev *hdev = vport->back;
+	int ret;
+
+	ret = hclge_cfg_mac_speed_dup(hdev, speed, duplex, lane_num);
 
-	return hclge_cfg_mac_speed_dup(hdev, speed, duplex, lane_num);
+	if (ret)
+		return ret;
+
+	hdev->hw.mac.req_speed = speed;
+	hdev->hw.mac.req_duplex = duplex;
+
+	return 0;
 }
 
 static int hclge_set_autoneg_en(struct hclge_dev *hdev, bool enable)
@@ -2890,11 +2905,9 @@
 	int ret;
 
 	hdev->support_sfp_query = true;
-	hdev->hw.mac.duplex = HCLGE_MAC_FULL;
-	ret = hclge_cfg_mac_speed_dup_hw(hdev, hdev->hw.mac.speed,
-					 hdev->hw.mac.duplex, hdev->hw.mac.lane_num);
-	if (ret)
-		return ret;
+
+	if (!test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
+		hdev->hw.mac.duplex = HCLGE_MAC_FULL;
 
 	if (hdev->hw.mac.support_autoneg) {
 		ret = hclge_set_autoneg_en(hdev, hdev->hw.mac.autoneg);
@@ -2902,6 +2915,14 @@
 			return ret;
 	}
 
+	if (!hdev->hw.mac.autoneg) {
+		ret = hclge_cfg_mac_speed_dup_hw(hdev, hdev->hw.mac.req_speed,
+						 hdev->hw.mac.req_duplex,
+						 hdev->hw.mac.lane_num);
+		if (ret)
+			return ret;
+	}
+
 	mac->link = 0;
 
 	if (mac->user_fec_mode & BIT(HNAE3_FEC_USER_DEF)) {
@@ -3021,9 +3042,7 @@
 
 static void hclge_update_link_status(struct hclge_dev *hdev)
 {
-	struct hnae3_handle *rhandle = &hdev->vport[0].roce;
 	struct hnae3_handle *handle = &hdev->vport[0].nic;
-	struct hnae3_client *rclient = hdev->roce_client;
 	struct hnae3_client *client = hdev->nic_client;
 	int state;
 	int ret;
@@ -3047,8 +3066,15 @@
 
 		client->ops->link_status_change(handle, state);
 		hclge_config_mac_tnl_int(hdev, state);
-		if (rclient && rclient->ops->link_status_change)
-			rclient->ops->link_status_change(rhandle, state);
+
+		if (test_bit(HCLGE_STATE_ROCE_REGISTERED, &hdev->state)) {
+			struct hnae3_handle *rhandle = &hdev->vport[0].roce;
+			struct hnae3_client *rclient = hdev->roce_client;
+
+			if (rclient && rclient->ops->link_status_change)
+				rclient->ops->link_status_change(rhandle,
+								 state);
+		}
 
 		hclge_push_link_status(hdev);
 	}
@@ -3326,9 +3352,9 @@
 		return ret;
 	}
 
-	hdev->hw.mac.autoneg = cmd->base.autoneg;
-	hdev->hw.mac.speed = cmd->base.speed;
-	hdev->hw.mac.duplex = cmd->base.duplex;
+	hdev->hw.mac.req_autoneg = cmd->base.autoneg;
+	hdev->hw.mac.req_speed = cmd->base.speed;
+	hdev->hw.mac.req_duplex = cmd->base.duplex;
 	linkmode_copy(hdev->hw.mac.advertising, cmd->link_modes.advertising);
 
 	return 0;
@@ -3361,9 +3387,9 @@
 	if (!hnae3_dev_phy_imp_supported(hdev))
 		return 0;
 
-	cmd.base.autoneg = hdev->hw.mac.autoneg;
-	cmd.base.speed = hdev->hw.mac.speed;
-	cmd.base.duplex = hdev->hw.mac.duplex;
+	cmd.base.autoneg = hdev->hw.mac.req_autoneg;
+	cmd.base.speed = hdev->hw.mac.req_speed;
+	cmd.base.duplex = hdev->hw.mac.req_duplex;
 	linkmode_copy(cmd.link_modes.advertising, hdev->hw.mac.advertising);
 
 	return hclge_set_phy_link_ksettings(&hdev->vport->nic, &cmd);
@@ -3501,6 +3527,17 @@
 	return ret;
 }
 
+static void hclge_set_reset_pending(struct hclge_dev *hdev,
+				    enum hnae3_reset_type reset_type)
+{
+	/* When an incorrect reset type is executed, the get_reset_level
+	 * function generates the HNAE3_NONE_RESET flag. As a result, this
+	 * type do not need to pending.
+	 */
+	if (reset_type != HNAE3_NONE_RESET)
+		set_bit(reset_type, &hdev->reset_pending);
+}
+
 static u32 hclge_check_event_cause(struct hclge_dev *hdev, u32 *clearval)
 {
 	u32 cmdq_src_reg, msix_src_reg, hw_err_src_reg;
@@ -3521,7 +3558,7 @@
 	 */
 	if (BIT(HCLGE_VECTOR0_IMPRESET_INT_B) & msix_src_reg) {
 		dev_info(&hdev->pdev->dev, "IMP reset interrupt\n");
-		set_bit(HNAE3_IMP_RESET, &hdev->reset_pending);
+		hclge_set_reset_pending(hdev, HNAE3_IMP_RESET);
 		set_bit(HCLGE_COMM_STATE_CMD_DISABLE, &hdev->hw.hw.comm_state);
 		*clearval = BIT(HCLGE_VECTOR0_IMPRESET_INT_B);
 		hdev->rst_stats.imp_rst_cnt++;
@@ -3531,7 +3568,7 @@
 	if (BIT(HCLGE_VECTOR0_GLOBALRESET_INT_B) & msix_src_reg) {
 		dev_info(&hdev->pdev->dev, "global reset interrupt\n");
 		set_bit(HCLGE_COMM_STATE_CMD_DISABLE, &hdev->hw.hw.comm_state);
-		set_bit(HNAE3_GLOBAL_RESET, &hdev->reset_pending);
+		hclge_set_reset_pending(hdev, HNAE3_GLOBAL_RESET);
 		*clearval = BIT(HCLGE_VECTOR0_GLOBALRESET_INT_B);
 		hdev->rst_stats.global_rst_cnt++;
 		return HCLGE_VECTOR0_EVENT_RST;
@@ -3686,7 +3723,7 @@
 	snprintf(hdev->misc_vector.name, HNAE3_INT_NAME_LEN, "%s-misc-%s",
 		 HCLGE_NAME, pci_name(hdev->pdev));
 	ret = request_irq(hdev->misc_vector.vector_irq, hclge_misc_irq_handle,
-			  0, hdev->misc_vector.name, hdev);
+			  IRQF_NO_AUTOEN, hdev->misc_vector.name, hdev);
 	if (ret) {
 		hclge_free_vector(hdev, 0);
 		dev_err(&hdev->pdev->dev, "request misc irq(%d) fail\n",
@@ -3979,7 +4016,7 @@
 	case HNAE3_FUNC_RESET:
 		dev_info(&pdev->dev, "PF reset requested\n");
 		/* schedule again to check later */
-		set_bit(HNAE3_FUNC_RESET, &hdev->reset_pending);
+		hclge_set_reset_pending(hdev, HNAE3_FUNC_RESET);
 		hclge_reset_task_schedule(hdev);
 		break;
 	default:
@@ -4013,6 +4050,8 @@
 		clear_bit(HNAE3_FLR_RESET, addr);
 	}
 
+	clear_bit(HNAE3_NONE_RESET, addr);
+
 	if (hdev->reset_type != HNAE3_NONE_RESET &&
 	    rst_level < hdev->reset_type)
 		return HNAE3_NONE_RESET;
@@ -4154,7 +4193,7 @@
 		return false;
 	} else if (hdev->rst_stats.reset_fail_cnt < MAX_RESET_FAIL_CNT) {
 		hdev->rst_stats.reset_fail_cnt++;
-		set_bit(hdev->reset_type, &hdev->reset_pending);
+		hclge_set_reset_pending(hdev, hdev->reset_type);
 		dev_info(&hdev->pdev->dev,
 			 "re-schedule reset task(%u)\n",
 			 hdev->rst_stats.reset_fail_cnt);
@@ -4397,8 +4436,20 @@
 static void hclge_set_def_reset_request(struct hnae3_ae_dev *ae_dev,
 					enum hnae3_reset_type rst_type)
 {
+#define HCLGE_SUPPORT_RESET_TYPE \
+	(BIT(HNAE3_FLR_RESET) | BIT(HNAE3_FUNC_RESET) | \
+	BIT(HNAE3_GLOBAL_RESET) | BIT(HNAE3_IMP_RESET))
+
 	struct hclge_dev *hdev = ae_dev->priv;
 
+	if (!(BIT(rst_type) & HCLGE_SUPPORT_RESET_TYPE)) {
+		/* To prevent reset triggered by hclge_reset_event */
+		set_bit(HNAE3_NONE_RESET, &hdev->default_reset_request);
+		dev_warn(&hdev->pdev->dev, "unsupported reset type %d\n",
+			 rst_type);
+		return;
+	}
+
 	set_bit(rst_type, &hdev->default_reset_request);
 }
 
@@ -7936,8 +7987,7 @@
 		/* Set the DOWN flag here to disable link updating */
 		set_bit(HCLGE_STATE_DOWN, &hdev->state);
 
-		/* flush memory to make sure DOWN is seen by service task */
-		smp_mb__before_atomic();
+		smp_mb__after_atomic(); /* flush memory to make sure DOWN is seen by service task */
 		hclge_flush_link_update(hdev);
 	}
 }
@@ -9890,6 +9940,7 @@
 static int hclge_init_vlan_filter(struct hclge_dev *hdev)
 {
 	struct hclge_vport *vport;
+	bool enable = true;
 	int ret;
 	int i;
 
@@ -9909,8 +9960,12 @@
 		vport->cur_vlan_fltr_en = true;
 	}
 
+	if (test_bit(HNAE3_DEV_SUPPORT_VLAN_FLTR_MDF_B, hdev->ae_dev->caps) &&
+	    !test_bit(HNAE3_DEV_SUPPORT_PORT_VLAN_BYPASS_B, hdev->ae_dev->caps))
+		enable = false;
+
 	return hclge_set_vlan_filter_ctrl(hdev, HCLGE_FILTER_TYPE_PORT,
-					  HCLGE_FILTER_FE_INGRESS, true, 0);
+					  HCLGE_FILTER_FE_INGRESS, enable, 0);
 }
 
 static int hclge_init_vlan_type(struct hclge_dev *hdev)
@@ -11220,6 +11275,12 @@
 	return ret;
 }
 
+static bool hclge_uninit_need_wait(struct hclge_dev *hdev)
+{
+	return test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state) ||
+	       test_bit(HCLGE_STATE_LINK_UPDATING, &hdev->state);
+}
+
 static void hclge_uninit_client_instance(struct hnae3_client *client,
 					 struct hnae3_ae_dev *ae_dev)
 {
@@ -11228,7 +11289,7 @@
 
 	if (hdev->roce_client) {
 		clear_bit(HCLGE_STATE_ROCE_REGISTERED, &hdev->state);
-		while (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
+		while (hclge_uninit_need_wait(hdev))
 			msleep(HCLGE_WAIT_RESET_DONE);
 
 		hdev->roce_client->ops->uninit_instance(&vport->roce, 0);
@@ -11334,7 +11395,7 @@
 
 	pcim_iounmap(pdev, hdev->hw.hw.io_base);
 	pci_free_irq_vectors(pdev);
-	pci_release_mem_regions(pdev);
+	pci_release_regions(pdev);
 	pci_disable_device(pdev);
 }
 
@@ -11406,8 +11467,8 @@
 		dev_err(&hdev->pdev->dev, "fail to rebuild, ret=%d\n", ret);
 
 	hdev->reset_type = HNAE3_NONE_RESET;
-	clear_bit(HCLGE_STATE_RST_HANDLING, &hdev->state);
-	up(&hdev->reset_sem);
+	if (test_and_clear_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
+		up(&hdev->reset_sem);
 }
 
 static void hclge_clear_resetting_state(struct hclge_dev *hdev)
@@ -11606,14 +11667,10 @@
 	if (ret)
 		goto out;
 
-	ret = hclge_devlink_init(hdev);
-	if (ret)
-		goto err_pci_uninit;
-
 	/* Firmware command queue initialize */
 	ret = hclge_comm_cmd_queue_init(hdev->pdev, &hdev->hw.hw);
 	if (ret)
-		goto err_devlink_uninit;
+		goto err_pci_uninit;
 
 	/* Firmware command initialize */
 	ret = hclge_comm_cmd_init(hdev->ae_dev, &hdev->hw.hw, &hdev->fw_version,
@@ -11741,7 +11798,7 @@
 
 	ret = hclge_update_port_info(hdev);
 	if (ret)
-		goto err_mdiobus_unreg;
+		goto err_ptp_uninit;
 
 	INIT_KFIFO(hdev->mac_tnl_log);
 
@@ -11773,24 +11830,30 @@
 
 	hclge_init_rxd_adv_layout(hdev);
 
-	/* Enable MISC vector(vector0) */
-	hclge_enable_vector(&hdev->misc_vector, true);
-
 	ret = hclge_init_wol(hdev);
 	if (ret)
 		dev_warn(&pdev->dev,
 			 "failed to wake on lan init, ret = %d\n", ret);
 
+	ret = hclge_devlink_init(hdev);
+	if (ret)
+		goto err_ptp_uninit;
+
 	hclge_state_init(hdev);
 	hdev->last_reset_time = jiffies;
 
+	/* Enable MISC vector(vector0) */
+	enable_irq(hdev->misc_vector.vector_irq);
+	hclge_enable_vector(&hdev->misc_vector, true);
+
 	dev_info(&hdev->pdev->dev, "%s driver initialization finished.\n",
 		 HCLGE_DRIVER_NAME);
 
 	hclge_task_schedule(hdev, round_jiffies_relative(HZ));
-
 	return 0;
 
+err_ptp_uninit:
+	hclge_ptp_uninit(hdev);
 err_mdiobus_unreg:
 	if (hdev->hw.mac.phydev)
 		mdiobus_unregister(hdev->hw.mac.mdio_bus);
@@ -11800,8 +11863,6 @@
 	pci_free_irq_vectors(pdev);
 err_cmd_uninit:
 	hclge_comm_cmd_uninit(hdev->ae_dev, &hdev->hw.hw);
-err_devlink_uninit:
-	hclge_devlink_uninit(hdev);
 err_pci_uninit:
 	pcim_iounmap(pdev, hdev->hw.hw.io_base);
 	pci_release_regions(pdev);
@@ -12188,7 +12249,7 @@
 
 	/* Disable MISC vector(vector0) */
 	hclge_enable_vector(&hdev->misc_vector, false);
-	synchronize_irq(hdev->misc_vector.vector_irq);
+	disable_irq(hdev->misc_vector.vector_irq);
 
 	/* Disable all hw interrupts */
 	hclge_config_mac_tnl_int(hdev, false);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
@@ -270,11 +270,14 @@
 	u8 media_type;	/* port media type, e.g. fibre/copper/backplane */
 	u8 mac_addr[ETH_ALEN];
 	u8 autoneg;
+	u8 req_autoneg;
 	u8 duplex;
+	u8 req_duplex;
 	u8 support_autoneg;
 	u8 speed_type;	/* 0: sfp speed, 1: active speed */
 	u8 lane_num;
 	u32 speed;
+	u32 req_speed;
 	u32 max_speed;
 	u32 speed_ability; /* speed ability supported by current media */
 	u32 module_type; /* sub media type, e.g. kr/cr/sr/lr */
@@ -882,7 +885,7 @@
 
 	u16 fdir_pf_filter_count; /* Num of guaranteed filters for this PF */
 	u16 num_alloc_vport;		/* Num vports this driver supports */
-	u32 numa_node_mask;
+	nodemask_t numa_node_mask;
 	u16 rx_buf_len;
 	u16 num_tx_desc;		/* desc num of per tx queue */
 	u16 num_rx_desc;		/* desc num of per rx queue */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
@@ -1077,12 +1077,13 @@
 
 	hdev = param->vport->back;
 	cmd_func = hclge_mbx_ops_list[param->req->msg.code];
-	if (cmd_func)
-		ret = cmd_func(param);
-	else
+	if (!cmd_func) {
 		dev_err(&hdev->pdev->dev,
 			"un-supported mailbox message, code = %u\n",
 			param->req->msg.code);
+		return;
+	}
+	ret = cmd_func(param);
 
 	/* PF driver should not reply IMP */
 	if (hnae3_get_bit(param->req->mbx_need_resp, HCLGE_MBX_NEED_RESP_B) &&
@@ -1123,10 +1124,11 @@
 		req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data;
 
 		flag = le16_to_cpu(crq->desc[crq->next_to_use].flag);
-		if (unlikely(!hnae3_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B))) {
+		if (unlikely(!hnae3_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B) ||
+			     req->mbx_src_vfid > hdev->num_req_vfs)) {
 			dev_warn(&hdev->pdev->dev,
-				 "dropped invalid mailbox message, code = %u\n",
-				 req->msg.code);
+				 "dropped invalid mailbox message, code = %u, vfid = %u\n",
+				 req->msg.code, req->mbx_src_vfid);
 
 			/* dropping/not processing this invalid message */
 			crq->desc[crq->next_to_use].flag = 0;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
@@ -191,6 +191,9 @@
 	if (ret)
 		netdev_err(netdev, "failed to adjust link.\n");
 
+	hdev->hw.mac.req_speed = (u32)speed;
+	hdev->hw.mac.req_duplex = (u8)duplex;
+
 	ret = hclge_cfg_flowctrl(hdev);
 	if (ret)
 		netdev_err(netdev, "failed to configure flow control.\n");
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c
@@ -58,6 +58,9 @@
 	struct hclge_dev *hdev = vport->back;
 	struct hclge_ptp *ptp = hdev->ptp;
 
+	if (!ptp)
+		return false;
+
 	if (!test_bit(HCLGE_PTP_FLAG_TX_EN, &ptp->flags) ||
 	    test_and_set_bit(HCLGE_STATE_PTP_TX_HANDLING, &hdev->state)) {
 		ptp->tx_skipped++;
@@ -108,7 +111,7 @@
 	u64 ns = nsec;
 	u32 sec_h;
 
-	if (!test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags))
+	if (!hdev->ptp || !test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags))
 		return;
 
 	/* Since the BD does not have enough space for the higher 16 bits of
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c
@@ -510,9 +510,9 @@
 static int hclge_fetch_pf_reg(struct hclge_dev *hdev, void *data,
 			      struct hnae3_knic_private_info *kinfo)
 {
-#define HCLGE_RING_REG_OFFSET		0x200
 #define HCLGE_RING_INT_REG_OFFSET	0x4
 
+	struct hnae3_queue *tqp;
 	int i, j, reg_num;
 	int data_num_sum;
 	u32 *reg = data;
@@ -533,10 +533,11 @@
 	reg_num = ARRAY_SIZE(ring_reg_addr_list);
 	for (j = 0; j < kinfo->num_tqps; j++) {
 		reg += hclge_reg_get_tlv(HCLGE_REG_TAG_RING, reg_num, reg);
+		tqp = kinfo->tqp[j];
 		for (i = 0; i < reg_num; i++)
-			*reg++ = hclge_read_dev(&hdev->hw,
-						ring_reg_addr_list[i] +
-						HCLGE_RING_REG_OFFSET * j);
+			*reg++ = readl_relaxed(tqp->io_base -
+					       HCLGE_TQP_REG_OFFSET +
+					       ring_reg_addr_list[i]);
 	}
 	data_num_sum += (reg_num + HCLGE_REG_TLV_SPACE) * kinfo->num_tqps;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h
@@ -24,7 +24,7 @@
 		__field(u8, code)
 		__field(u8, subcode)
 		__string(pciname, pci_name(hdev->pdev))
-		__string(devname, &hdev->vport[0].nic.kinfo.netdev->name)
+		__string(devname, hdev->vport[0].nic.kinfo.netdev->name)
 		__array(u32, mbx_data, PF_GET_MBX_LEN)
 	),
 
@@ -33,7 +33,7 @@
 		__entry->code = req->msg.code;
 		__entry->subcode = req->msg.subcode;
 		__assign_str(pciname, pci_name(hdev->pdev));
-		__assign_str(devname, &hdev->vport[0].nic.kinfo.netdev->name);
+		__assign_str(devname, hdev->vport[0].nic.kinfo.netdev->name);
 		memcpy(__entry->mbx_data, req,
 		       sizeof(struct hclge_mbx_vf_to_pf_cmd));
 	),
@@ -56,7 +56,7 @@
 		__field(u8, vfid)
 		__field(u16, code)
 		__string(pciname, pci_name(hdev->pdev))
-		__string(devname, &hdev->vport[0].nic.kinfo.netdev->name)
+		__string(devname, hdev->vport[0].nic.kinfo.netdev->name)
 		__array(u32, mbx_data, PF_SEND_MBX_LEN)
 	),
 
@@ -64,7 +64,7 @@
 		__entry->vfid = req->dest_vfid;
 		__entry->code = le16_to_cpu(req->msg.code);
 		__assign_str(pciname, pci_name(hdev->pdev));
-		__assign_str(devname, &hdev->vport[0].nic.kinfo.netdev->name);
+		__assign_str(devname, hdev->vport[0].nic.kinfo.netdev->name);
 		memcpy(__entry->mbx_data, req,
 		       sizeof(struct hclge_mbx_pf_to_vf_cmd));
 	),
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -412,7 +412,8 @@
 
 	nic->ae_algo = &ae_algovf;
 	nic->pdev = hdev->pdev;
-	nic->numa_node_mask = hdev->numa_node_mask;
+	bitmap_copy(nic->numa_node_mask.bits, hdev->numa_node_mask.bits,
+		    MAX_NUMNODES);
 	nic->flags |= HNAE3_SUPPORT_VF;
 	nic->kinfo.io_base = hdev->hw.hw.io_base;
 
@@ -1357,6 +1358,17 @@
 	return ret;
 }
 
+static void hclgevf_set_reset_pending(struct hclgevf_dev *hdev,
+				      enum hnae3_reset_type reset_type)
+{
+	/* When an incorrect reset type is executed, the get_reset_level
+	 * function generates the HNAE3_NONE_RESET flag. As a result, this
+	 * type do not need to pending.
+	 */
+	if (reset_type != HNAE3_NONE_RESET)
+		set_bit(reset_type, &hdev->reset_pending);
+}
+
 static int hclgevf_reset_wait(struct hclgevf_dev *hdev)
 {
 #define HCLGEVF_RESET_WAIT_US	20000
@@ -1506,7 +1518,7 @@
 		hdev->rst_stats.rst_fail_cnt);
 
 	if (hdev->rst_stats.rst_fail_cnt < HCLGEVF_RESET_MAX_FAIL_CNT)
-		set_bit(hdev->reset_type, &hdev->reset_pending);
+		hclgevf_set_reset_pending(hdev, hdev->reset_type);
 
 	if (hclgevf_is_reset_pending(hdev)) {
 		set_bit(HCLGEVF_RESET_PENDING, &hdev->reset_state);
@@ -1626,6 +1638,8 @@
 		clear_bit(HNAE3_FLR_RESET, addr);
 	}
 
+	clear_bit(HNAE3_NONE_RESET, addr);
+
 	return rst_level;
 }
 
@@ -1635,14 +1649,15 @@
 	struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev);
 	struct hclgevf_dev *hdev = ae_dev->priv;
 
-	dev_info(&hdev->pdev->dev, "received reset request from VF enet\n");
-
 	if (hdev->default_reset_request)
 		hdev->reset_level =
 			hclgevf_get_reset_level(&hdev->default_reset_request);
 	else
 		hdev->reset_level = HNAE3_VF_FUNC_RESET;
 
+	dev_info(&hdev->pdev->dev, "received reset request from VF enet, reset level is %d\n",
+		 hdev->reset_level);
+
 	/* reset of this VF requested */
 	set_bit(HCLGEVF_RESET_REQUESTED, &hdev->reset_state);
 	hclgevf_reset_task_schedule(hdev);
@@ -1653,8 +1668,20 @@
 static void hclgevf_set_def_reset_request(struct hnae3_ae_dev *ae_dev,
 					  enum hnae3_reset_type rst_type)
 {
+#define HCLGEVF_SUPPORT_RESET_TYPE \
+	(BIT(HNAE3_VF_RESET) | BIT(HNAE3_VF_FUNC_RESET) | \
+	BIT(HNAE3_VF_PF_FUNC_RESET) | BIT(HNAE3_VF_FULL_RESET) | \
+	BIT(HNAE3_FLR_RESET) | BIT(HNAE3_VF_EXP_RESET))
+
 	struct hclgevf_dev *hdev = ae_dev->priv;
 
+	if (!(BIT(rst_type) & HCLGEVF_SUPPORT_RESET_TYPE)) {
+		/* To prevent reset triggered by hclge_reset_event */
+		set_bit(HNAE3_NONE_RESET, &hdev->default_reset_request);
+		dev_info(&hdev->pdev->dev, "unsupported reset type %d\n",
+			 rst_type);
+		return;
+	}
 	set_bit(rst_type, &hdev->default_reset_request);
 }
 
@@ -1709,8 +1736,8 @@
 			 ret);
 
 	hdev->reset_type = HNAE3_NONE_RESET;
-	clear_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state);
-	up(&hdev->reset_sem);
+	if (test_and_clear_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state))
+		up(&hdev->reset_sem);
 }
 
 static u32 hclgevf_get_fw_version(struct hnae3_handle *handle)
@@ -1811,14 +1838,14 @@
 		 */
 		if (hdev->reset_attempts > HCLGEVF_MAX_RESET_ATTEMPTS_CNT) {
 			/* prepare for full reset of stack + pcie interface */
-			set_bit(HNAE3_VF_FULL_RESET, &hdev->reset_pending);
+			hclgevf_set_reset_pending(hdev, HNAE3_VF_FULL_RESET);
 
 			/* "defer" schedule the reset task again */
 			set_bit(HCLGEVF_RESET_PENDING, &hdev->reset_state);
 		} else {
 			hdev->reset_attempts++;
 
-			set_bit(hdev->reset_level, &hdev->reset_pending);
+			hclgevf_set_reset_pending(hdev, hdev->reset_level);
 			set_bit(HCLGEVF_RESET_PENDING, &hdev->reset_state);
 		}
 		hclgevf_reset_task_schedule(hdev);
@@ -1941,7 +1968,7 @@
 		rst_ing_reg = hclgevf_read_dev(&hdev->hw, HCLGEVF_RST_ING);
 		dev_info(&hdev->pdev->dev,
 			 "receive reset interrupt 0x%x!\n", rst_ing_reg);
-		set_bit(HNAE3_VF_RESET, &hdev->reset_pending);
+		hclgevf_set_reset_pending(hdev, HNAE3_VF_RESET);
 		set_bit(HCLGEVF_RESET_PENDING, &hdev->reset_state);
 		set_bit(HCLGE_COMM_STATE_CMD_DISABLE, &hdev->hw.hw.comm_state);
 		*clearval = ~(1U << HCLGEVF_VECTOR0_RST_INT_B);
@@ -2082,8 +2109,8 @@
 
 	roce->pdev = nic->pdev;
 	roce->ae_algo = nic->ae_algo;
-	roce->numa_node_mask = nic->numa_node_mask;
-
+	bitmap_copy(roce->numa_node_mask.bits, nic->numa_node_mask.bits,
+		    MAX_NUMNODES);
 	return 0;
 }
 
@@ -2180,8 +2207,7 @@
 	} else {
 		set_bit(HCLGEVF_STATE_DOWN, &hdev->state);
 
-		/* flush memory to make sure DOWN is seen by service task */
-		smp_mb__before_atomic();
+		smp_mb__after_atomic(); /* flush memory to make sure DOWN is seen by service task */
 		hclgevf_flush_link_update(hdev);
 	}
 }
@@ -2252,6 +2278,8 @@
 	clear_bit(HCLGEVF_STATE_RST_FAIL, &hdev->state);
 
 	INIT_DELAYED_WORK(&hdev->service_task, hclgevf_service_task);
+	/* timer needs to be initialized before misc irq */
+	timer_setup(&hdev->reset_timer, hclgevf_reset_timer, 0);
 
 	mutex_init(&hdev->mbx_resp.mbx_mutex);
 	sema_init(&hdev->reset_sem, 1);
@@ -2845,10 +2873,6 @@
 	if (ret)
 		return ret;
 
-	ret = hclgevf_devlink_init(hdev);
-	if (ret)
-		goto err_devlink_init;
-
 	ret = hclge_comm_cmd_queue_init(hdev->pdev, &hdev->hw.hw);
 	if (ret)
 		goto err_cmd_queue_init;
@@ -2941,6 +2965,10 @@
 
 	hclgevf_init_rxd_adv_layout(hdev);
 
+	ret = hclgevf_devlink_init(hdev);
+	if (ret)
+		goto err_config;
+
 	set_bit(HCLGEVF_STATE_SERVICE_INITED, &hdev->state);
 
 	hdev->last_reset_time = jiffies;
@@ -2948,7 +2976,6 @@
 		 HCLGEVF_DRIVER_NAME);
 
 	hclgevf_task_schedule(hdev, round_jiffies_relative(HZ));
-	timer_setup(&hdev->reset_timer, hclgevf_reset_timer, 0);
 
 	return 0;
 
@@ -2960,8 +2987,6 @@
 err_cmd_init:
 	hclge_comm_cmd_uninit(hdev->ae_dev, &hdev->hw.hw);
 err_cmd_queue_init:
-	hclgevf_devlink_uninit(hdev);
-err_devlink_init:
 	hclgevf_pci_uninit(hdev);
 	clear_bit(HCLGEVF_STATE_IRQ_INITED, &hdev->state);
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
@@ -236,7 +236,7 @@
 	u16 rss_size_max;	/* HW defined max RSS task queue */
 
 	u16 num_alloc_vport;	/* num vports this driver supports */
-	u32 numa_node_mask;
+	nodemask_t numa_node_mask;
 	u16 rx_buf_len;
 	u16 num_tx_desc;	/* desc num of per tx queue */
 	u16 num_rx_desc;	/* desc num of per rx queue */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c
@@ -123,10 +123,10 @@
 void hclgevf_get_regs(struct hnae3_handle *handle, u32 *version,
 		      void *data)
 {
-#define HCLGEVF_RING_REG_OFFSET		0x200
 #define HCLGEVF_RING_INT_REG_OFFSET	0x4
 
 	struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
+	struct hnae3_queue *tqp;
 	int i, j, reg_um;
 	u32 *reg = data;
 
@@ -147,10 +147,11 @@
 	reg_um = sizeof(ring_reg_addr_list) / sizeof(u32);
 	for (j = 0; j < hdev->num_tqps; j++) {
 		reg += hclgevf_reg_get_tlv(HCLGEVF_REG_TAG_RING, reg_um, reg);
+		tqp = &hdev->htqp[j].q;
 		for (i = 0; i < reg_um; i++)
-			*reg++ = hclgevf_read_dev(&hdev->hw,
-						  ring_reg_addr_list[i] +
-						  HCLGEVF_RING_REG_OFFSET * j);
+			*reg++ = readl_relaxed(tqp->io_base -
+					       HCLGEVF_TQP_REG_OFFSET +
+					       ring_reg_addr_list[i]);
 	}
 
 	reg_um = sizeof(tqp_intr_reg_addr_list) / sizeof(u32);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h
@@ -23,7 +23,7 @@
 		__field(u8, vfid)
 		__field(u16, code)
 		__string(pciname, pci_name(hdev->pdev))
-		__string(devname, &hdev->nic.kinfo.netdev->name)
+		__string(devname, hdev->nic.kinfo.netdev->name)
 		__array(u32, mbx_data, VF_GET_MBX_LEN)
 	),
 
@@ -31,7 +31,7 @@
 		__entry->vfid = req->dest_vfid;
 		__entry->code = le16_to_cpu(req->msg.code);
 		__assign_str(pciname, pci_name(hdev->pdev));
-		__assign_str(devname, &hdev->nic.kinfo.netdev->name);
+		__assign_str(devname, hdev->nic.kinfo.netdev->name);
 		memcpy(__entry->mbx_data, req,
 		       sizeof(struct hclge_mbx_pf_to_vf_cmd));
 	),
@@ -55,7 +55,7 @@
 		__field(u8, code)
 		__field(u8, subcode)
 		__string(pciname, pci_name(hdev->pdev))
-		__string(devname, &hdev->nic.kinfo.netdev->name)
+		__string(devname, hdev->nic.kinfo.netdev->name)
 		__array(u32, mbx_data, VF_SEND_MBX_LEN)
 	),
 
@@ -64,7 +64,7 @@
 		__entry->code = req->msg.code;
 		__entry->subcode = req->msg.subcode;
 		__assign_str(pciname, pci_name(hdev->pdev));
-		__assign_str(devname, &hdev->nic.kinfo.netdev->name);
+		__assign_str(devname, hdev->nic.kinfo.netdev->name);
 		memcpy(__entry->mbx_data, req,
 		       sizeof(struct hclge_mbx_vf_to_pf_cmd));
 	),
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -575,6 +575,7 @@
 						MDIO_SC_RESET_ST;
 				}
 			}
+			of_node_put(reg_args.np);
 		} else {
 			dev_warn(&pdev->dev, "find syscon ret = %#x\n", ret);
 			mdio_dev->subctrl_vbase = NULL;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/huawei/hinic/hinic_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/huawei/hinic/hinic_main.c
@@ -172,6 +172,7 @@
 	hinic_sq_dbgfs_uninit(nic_dev);
 
 	devm_kfree(&netdev->dev, nic_dev->txqs);
+	nic_dev->txqs = NULL;
 	return err;
 }
 
@@ -268,6 +269,7 @@
 	hinic_rq_dbgfs_uninit(nic_dev);
 
 	devm_kfree(&netdev->dev, nic_dev->rxqs);
+	nic_dev->rxqs = NULL;
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/i825xx/sun3_82586.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/i825xx/sun3_82586.c
@@ -987,7 +987,7 @@
 	{
 #ifdef DEBUG
 		printk("%s: xmitter timed out, try to restart! stat: %02x\n",dev->name,p->scb->cus);
-		printk("%s: command-stats: %04x %04x\n",dev->name,swab16(p->xmit_cmds[0]->cmd_status),swab16(p->xmit_cmds[1]->cmd_status));
+		printk("%s: command-stats: %04x\n", dev->name, swab16(p->xmit_cmds[0]->cmd_status));
 		printk("%s: check, whether you set the right interrupt number!\n",dev->name);
 #endif
 		sun3_82586_close(dev);
@@ -1012,6 +1012,7 @@
 	if(skb->len > XMIT_BUFF_SIZE)
 	{
 		printk("%s: Sorry, max. framelength is %d bytes. The length of your frame is %d bytes.\n",dev->name,XMIT_BUFF_SIZE,skb->len);
+		dev_kfree_skb(skb);
 		return NETDEV_TX_OK;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/ibm/emac/mal.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/ibm/emac/mal.c
@@ -578,7 +578,7 @@
 		printk(KERN_ERR "%pOF: Support for 405EZ not enabled!\n",
 				ofdev->dev.of_node);
 		err = -ENODEV;
-		goto fail;
+		goto fail_unmap;
 #endif
 	}
 
@@ -734,6 +734,8 @@
 
 	mal_reset(mal);
 
+	dcr_unmap(mal->dcr_host, 0x100);
+
 	dma_free_coherent(&ofdev->dev,
 			  sizeof(struct mal_descriptor) *
 			  (NUM_TX_BUFF * mal->num_tx_chans +
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/ibm/ibmvnic.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/ibm/ibmvnic.c
@@ -2478,6 +2478,18 @@
 	    (tx_pool->consumer_index + 1) % tx_pool->num_buffers;
 
 	tx_buff = &tx_pool->tx_buff[bufidx];
+
+	/* Sanity checks on our free map to make sure it points to an index
+	 * that is not being occupied by another skb. If skb memory is
+	 * not freed then we see congestion control kick in and halt tx.
+	 */
+	if (unlikely(tx_buff->skb)) {
+		dev_warn_ratelimited(dev, "TX free map points to untracked skb (%s %d idx=%d)\n",
+				     skb_is_gso(skb) ? "tso_pool" : "tx_pool",
+				     queue_num, bufidx);
+		dev_kfree_skb_any(tx_buff->skb);
+	}
+
 	tx_buff->skb = skb;
 	tx_buff->index = bufidx;
 	tx_buff->pool_index = queue_num;
@@ -4057,6 +4069,12 @@
 		adapter->num_active_tx_scrqs = 0;
 	}
 
+	/* Clean any remaining outstanding SKBs
+	 * we freed the irq so we won't be hearing
+	 * from them
+	 */
+	clean_tx_pools(adapter);
+
 	if (adapter->rx_scrq) {
 		for (i = 0; i < adapter->num_active_rx_scrqs; i++) {
 			if (!adapter->rx_scrq[i])
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/e1000e/hw.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/e1000e/hw.h
@@ -108,8 +108,8 @@
 #define E1000_DEV_ID_PCH_RPL_I219_V22		0x0DC8
 #define E1000_DEV_ID_PCH_MTP_I219_LM18		0x550A
 #define E1000_DEV_ID_PCH_MTP_I219_V18		0x550B
-#define E1000_DEV_ID_PCH_MTP_I219_LM19		0x550C
-#define E1000_DEV_ID_PCH_MTP_I219_V19		0x550D
+#define E1000_DEV_ID_PCH_ADP_I219_LM19		0x550C
+#define E1000_DEV_ID_PCH_ADP_I219_V19		0x550D
 #define E1000_DEV_ID_PCH_LNP_I219_LM20		0x550E
 #define E1000_DEV_ID_PCH_LNP_I219_V20		0x550F
 #define E1000_DEV_ID_PCH_LNP_I219_LM21		0x5510
@@ -628,6 +628,7 @@
 	u32 id;
 	u32 reset_delay_us;	/* in usec */
 	u32 revision;
+	u32 retry_count;
 
 	enum e1000_media_type media_type;
 
@@ -644,6 +645,7 @@
 	bool polarity_correction;
 	bool speed_downgraded;
 	bool autoneg_wait_to_complete;
+	bool retry_enabled;
 };
 
 struct e1000_nvm_info {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -222,11 +222,18 @@
 	if (hw->mac.type >= e1000_pch_lpt) {
 		/* Only unforce SMBus if ME is not active */
 		if (!(er32(FWSM) & E1000_ICH_FWSM_FW_VALID)) {
+			/* Switching PHY interface always returns MDI error
+			 * so disable retry mechanism to avoid wasting time
+			 */
+			e1000e_disable_phy_retry(hw);
+
 			/* Unforce SMBus mode in PHY */
 			e1e_rphy_locked(hw, CV_SMB_CTRL, &phy_reg);
 			phy_reg &= ~CV_SMB_CTRL_FORCE_SMBUS;
 			e1e_wphy_locked(hw, CV_SMB_CTRL, phy_reg);
 
+			e1000e_enable_phy_retry(hw);
+
 			/* Unforce SMBus mode in MAC */
 			mac_reg = er32(CTRL_EXT);
 			mac_reg &= ~E1000_CTRL_EXT_FORCE_SMBUS;
@@ -310,6 +317,11 @@
 		goto out;
 	}
 
+	/* There is no guarantee that the PHY is accessible at this time
+	 * so disable retry mechanism to avoid wasting time
+	 */
+	e1000e_disable_phy_retry(hw);
+
 	/* The MAC-PHY interconnect may be in SMBus mode.  If the PHY is
 	 * inaccessible and resetting the PHY is not blocked, toggle the
 	 * LANPHYPC Value bit to force the interconnect to PCIe mode.
@@ -380,6 +392,8 @@
 		break;
 	}
 
+	e1000e_enable_phy_retry(hw);
+
 	hw->phy.ops.release(hw);
 	if (!ret_val) {
 
@@ -449,6 +463,11 @@
 
 	phy->id = e1000_phy_unknown;
 
+	if (hw->mac.type == e1000_pch_mtp) {
+		phy->retry_count = 2;
+		e1000e_enable_phy_retry(hw);
+	}
+
 	ret_val = e1000_init_phy_workarounds_pchlan(hw);
 	if (ret_val)
 		return ret_val;
@@ -1090,6 +1109,46 @@
 }
 
 /**
+ *  e1000e_force_smbus - Force interfaces to transition to SMBUS mode.
+ *  @hw: pointer to the HW structure
+ *
+ *  Force the MAC and the PHY to SMBUS mode. Assumes semaphore already
+ *  acquired.
+ *
+ * Return: 0 on success, negative errno on failure.
+ **/
+static s32 e1000e_force_smbus(struct e1000_hw *hw)
+{
+	u16 smb_ctrl = 0;
+	u32 ctrl_ext;
+	s32 ret_val;
+
+	/* Switching PHY interface always returns MDI error
+	 * so disable retry mechanism to avoid wasting time
+	 */
+	e1000e_disable_phy_retry(hw);
+
+	/* Force SMBus mode in the PHY */
+	ret_val = e1000_read_phy_reg_hv_locked(hw, CV_SMB_CTRL, &smb_ctrl);
+	if (ret_val) {
+		e1000e_enable_phy_retry(hw);
+		return ret_val;
+	}
+
+	smb_ctrl |= CV_SMB_CTRL_FORCE_SMBUS;
+	e1000_write_phy_reg_hv_locked(hw, CV_SMB_CTRL, smb_ctrl);
+
+	e1000e_enable_phy_retry(hw);
+
+	/* Force SMBus mode in the MAC */
+	ctrl_ext = er32(CTRL_EXT);
+	ctrl_ext |= E1000_CTRL_EXT_FORCE_SMBUS;
+	ew32(CTRL_EXT, ctrl_ext);
+
+	return 0;
+}
+
+/**
  *  e1000_enable_ulp_lpt_lp - configure Ultra Low Power mode for LynxPoint-LP
  *  @hw: pointer to the HW structure
  *  @to_sx: boolean indicating a system power state transition to Sx
@@ -1146,17 +1205,11 @@
 	if (ret_val)
 		goto out;
 
-	/* Force SMBus mode in PHY */
-	ret_val = e1000_read_phy_reg_hv_locked(hw, CV_SMB_CTRL, &phy_reg);
-	if (ret_val)
+	ret_val = e1000e_force_smbus(hw);
+	if (ret_val) {
+		e_dbg("Failed to force SMBUS: %d\n", ret_val);
 		goto release;
-	phy_reg |= CV_SMB_CTRL_FORCE_SMBUS;
-	e1000_write_phy_reg_hv_locked(hw, CV_SMB_CTRL, phy_reg);
-
-	/* Force SMBus mode in MAC */
-	mac_reg = er32(CTRL_EXT);
-	mac_reg |= E1000_CTRL_EXT_FORCE_SMBUS;
-	ew32(CTRL_EXT, mac_reg);
+	}
 
 	/* Si workaround for ULP entry flow on i127/rev6 h/w.  Enable
 	 * LPLU and disable Gig speed when entering ULP
@@ -1313,6 +1366,11 @@
 		/* Toggle LANPHYPC Value bit */
 		e1000_toggle_lanphypc_pch_lpt(hw);
 
+	/* Switching PHY interface always returns MDI error
+	 * so disable retry mechanism to avoid wasting time
+	 */
+	e1000e_disable_phy_retry(hw);
+
 	/* Unforce SMBus mode in PHY */
 	ret_val = e1000_read_phy_reg_hv_locked(hw, CV_SMB_CTRL, &phy_reg);
 	if (ret_val) {
@@ -1333,6 +1391,8 @@
 	phy_reg &= ~CV_SMB_CTRL_FORCE_SMBUS;
 	e1000_write_phy_reg_hv_locked(hw, CV_SMB_CTRL, phy_reg);
 
+	e1000e_enable_phy_retry(hw);
+
 	/* Unforce SMBus mode in MAC */
 	mac_reg = er32(CTRL_EXT);
 	mac_reg &= ~E1000_CTRL_EXT_FORCE_SMBUS;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/e1000e/netdev.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6363,49 +6363,49 @@
 		mac_data |= E1000_EXTCNF_CTRL_GATE_PHY_CFG;
 		ew32(EXTCNF_CTRL, mac_data);
 
-		/* Enable the Dynamic Power Gating in the MAC */
-		mac_data = er32(FEXTNVM7);
-		mac_data |= BIT(22);
-		ew32(FEXTNVM7, mac_data);
-
 		/* Disable disconnected cable conditioning for Power Gating */
 		mac_data = er32(DPGFR);
 		mac_data |= BIT(2);
 		ew32(DPGFR, mac_data);
 
-		/* Don't wake from dynamic Power Gating with clock request */
-		mac_data = er32(FEXTNVM12);
-		mac_data |= BIT(12);
-		ew32(FEXTNVM12, mac_data);
-
-		/* Ungate PGCB clock */
-		mac_data = er32(FEXTNVM9);
-		mac_data &= ~BIT(28);
-		ew32(FEXTNVM9, mac_data);
-
-		/* Enable K1 off to enable mPHY Power Gating */
-		mac_data = er32(FEXTNVM6);
-		mac_data |= BIT(31);
-		ew32(FEXTNVM6, mac_data);
-
-		/* Enable mPHY power gating for any link and speed */
-		mac_data = er32(FEXTNVM8);
-		mac_data |= BIT(9);
-		ew32(FEXTNVM8, mac_data);
-
 		/* Enable the Dynamic Clock Gating in the DMA and MAC */
 		mac_data = er32(CTRL_EXT);
 		mac_data |= E1000_CTRL_EXT_DMA_DYN_CLK_EN;
 		ew32(CTRL_EXT, mac_data);
-
-		/* No MAC DPG gating SLP_S0 in modern standby
-		 * Switch the logic of the lanphypc to use PMC counter
-		 */
-		mac_data = er32(FEXTNVM5);
-		mac_data |= BIT(7);
-		ew32(FEXTNVM5, mac_data);
 	}
 
+	/* Enable the Dynamic Power Gating in the MAC */
+	mac_data = er32(FEXTNVM7);
+	mac_data |= BIT(22);
+	ew32(FEXTNVM7, mac_data);
+
+	/* Don't wake from dynamic Power Gating with clock request */
+	mac_data = er32(FEXTNVM12);
+	mac_data |= BIT(12);
+	ew32(FEXTNVM12, mac_data);
+
+	/* Ungate PGCB clock */
+	mac_data = er32(FEXTNVM9);
+	mac_data &= ~BIT(28);
+	ew32(FEXTNVM9, mac_data);
+
+	/* Enable K1 off to enable mPHY Power Gating */
+	mac_data = er32(FEXTNVM6);
+	mac_data |= BIT(31);
+	ew32(FEXTNVM6, mac_data);
+
+	/* Enable mPHY power gating for any link and speed */
+	mac_data = er32(FEXTNVM8);
+	mac_data |= BIT(9);
+	ew32(FEXTNVM8, mac_data);
+
+	/* No MAC DPG gating SLP_S0 in modern standby
+	 * Switch the logic of the lanphypc to use PMC counter
+	 */
+	mac_data = er32(FEXTNVM5);
+	mac_data |= BIT(7);
+	ew32(FEXTNVM5, mac_data);
+
 	/* Disable the time synchronization clock */
 	mac_data = er32(FEXTNVM7);
 	mac_data |= BIT(31);
@@ -6498,33 +6498,6 @@
 	} else {
 		/* Request driver unconfigure the device from S0ix */
 
-		/* Disable the Dynamic Power Gating in the MAC */
-		mac_data = er32(FEXTNVM7);
-		mac_data &= 0xFFBFFFFF;
-		ew32(FEXTNVM7, mac_data);
-
-		/* Disable mPHY power gating for any link and speed */
-		mac_data = er32(FEXTNVM8);
-		mac_data &= ~BIT(9);
-		ew32(FEXTNVM8, mac_data);
-
-		/* Disable K1 off */
-		mac_data = er32(FEXTNVM6);
-		mac_data &= ~BIT(31);
-		ew32(FEXTNVM6, mac_data);
-
-		/* Disable Ungate PGCB clock */
-		mac_data = er32(FEXTNVM9);
-		mac_data |= BIT(28);
-		ew32(FEXTNVM9, mac_data);
-
-		/* Cancel not waking from dynamic
-		 * Power Gating with clock request
-		 */
-		mac_data = er32(FEXTNVM12);
-		mac_data &= ~BIT(12);
-		ew32(FEXTNVM12, mac_data);
-
 		/* Cancel disable disconnected cable conditioning
 		 * for Power Gating
 		 */
@@ -6537,13 +6510,6 @@
 		mac_data &= 0xFFF7FFFF;
 		ew32(CTRL_EXT, mac_data);
 
-		/* Revert the lanphypc logic to use the internal Gbe counter
-		 * and not the PMC counter
-		 */
-		mac_data = er32(FEXTNVM5);
-		mac_data &= 0xFFFFFF7F;
-		ew32(FEXTNVM5, mac_data);
-
 		/* Enable the periodic inband message,
 		 * Request PCIe clock in K1 page770_17[10:9] =01b
 		 */
@@ -6581,6 +6547,40 @@
 	mac_data &= ~BIT(31);
 	mac_data |= BIT(0);
 	ew32(FEXTNVM7, mac_data);
+
+	/* Disable the Dynamic Power Gating in the MAC */
+	mac_data = er32(FEXTNVM7);
+	mac_data &= 0xFFBFFFFF;
+	ew32(FEXTNVM7, mac_data);
+
+	/* Disable mPHY power gating for any link and speed */
+	mac_data = er32(FEXTNVM8);
+	mac_data &= ~BIT(9);
+	ew32(FEXTNVM8, mac_data);
+
+	/* Disable K1 off */
+	mac_data = er32(FEXTNVM6);
+	mac_data &= ~BIT(31);
+	ew32(FEXTNVM6, mac_data);
+
+	/* Disable Ungate PGCB clock */
+	mac_data = er32(FEXTNVM9);
+	mac_data |= BIT(28);
+	ew32(FEXTNVM9, mac_data);
+
+	/* Cancel not waking from dynamic
+	 * Power Gating with clock request
+	 */
+	mac_data = er32(FEXTNVM12);
+	mac_data &= ~BIT(12);
+	ew32(FEXTNVM12, mac_data);
+
+	/* Revert the lanphypc logic to use the internal Gbe counter
+	 * and not the PMC counter
+	 */
+	mac_data = er32(FEXTNVM5);
+	mac_data &= 0xFFFFFF7F;
+	ew32(FEXTNVM5, mac_data);
 }
 
 static int e1000e_pm_freeze(struct device *dev)
@@ -6671,8 +6671,10 @@
 		if (adapter->flags2 & FLAG2_HAS_PHY_WAKEUP) {
 			/* enable wakeup by the PHY */
 			retval = e1000_init_phy_wakeup(adapter, wufc);
-			if (retval)
-				return retval;
+			if (retval) {
+				e_err("Failed to enable wakeup\n");
+				goto skip_phy_configurations;
+			}
 		} else {
 			/* enable wakeup by the MAC */
 			ew32(WUFC, wufc);
@@ -6688,14 +6690,16 @@
 	if (adapter->hw.phy.type == e1000_phy_igp_3) {
 		e1000e_igp3_phy_powerdown_workaround_ich8lan(&adapter->hw);
 	} else if (hw->mac.type >= e1000_pch_lpt) {
-		if (wufc && !(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC)))
+		if (wufc && !(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC))) {
 			/* ULP does not support wake from unicast, multicast
 			 * or broadcast.
 			 */
 			retval = e1000_enable_ulp_lpt_lp(hw, !runtime);
-
-		if (retval)
-			return retval;
+			if (retval) {
+				e_err("Failed to enable ULP\n");
+				goto skip_phy_configurations;
+			}
+		}
 	}
 
 	/* Ensure that the appropriate bits are set in LPI_CTRL
@@ -6726,6 +6730,7 @@
 		hw->phy.ops.release(hw);
 	}
 
+skip_phy_configurations:
 	/* Release control of h/w to f/w.  If f/w is AMT enabled, this
 	 * would have already happened in close and is redundant.
 	 */
@@ -6968,15 +6973,13 @@
 	e1000e_pm_freeze(dev);
 
 	rc = __e1000_shutdown(pdev, false);
-	if (rc) {
-		e1000e_pm_thaw(dev);
-	} else {
+	if (!rc) {
 		/* Introduce S0ix implementation */
 		if (adapter->flags2 & FLAG2_ENABLE_S0IX_FLOWS)
 			e1000e_s0ix_entry_flow(adapter);
 	}
 
-	return rc;
+	return 0;
 }
 
 static __maybe_unused int e1000e_pm_resume(struct device *dev)
@@ -7896,10 +7899,10 @@
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_V17), board_pch_adp },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_RPL_I219_LM22), board_pch_adp },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_RPL_I219_V22), board_pch_adp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_LM19), board_pch_adp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_V19), board_pch_adp },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_LM18), board_pch_mtp },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_V18), board_pch_mtp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_LM19), board_pch_mtp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_V19), board_pch_mtp },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_LNP_I219_LM20), board_pch_mtp },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_LNP_I219_V20), board_pch_mtp },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_LNP_I219_LM21), board_pch_mtp },
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/e1000e/phy.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/e1000e/phy.c
@@ -107,6 +107,16 @@
 	return e1e_wphy(hw, M88E1000_PHY_GEN_CONTROL, 0);
 }
 
+void e1000e_disable_phy_retry(struct e1000_hw *hw)
+{
+	hw->phy.retry_enabled = false;
+}
+
+void e1000e_enable_phy_retry(struct e1000_hw *hw)
+{
+	hw->phy.retry_enabled = true;
+}
+
 /**
  *  e1000e_read_phy_reg_mdic - Read MDI control register
  *  @hw: pointer to the HW structure
@@ -118,55 +128,73 @@
  **/
 s32 e1000e_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data)
 {
+	u32 i, mdic = 0, retry_counter, retry_max;
 	struct e1000_phy_info *phy = &hw->phy;
-	u32 i, mdic = 0;
+	bool success;
 
 	if (offset > MAX_PHY_REG_ADDRESS) {
 		e_dbg("PHY Address %d is out of range\n", offset);
 		return -E1000_ERR_PARAM;
 	}
 
+	retry_max = phy->retry_enabled ? phy->retry_count : 0;
+
 	/* Set up Op-code, Phy Address, and register offset in the MDI
 	 * Control register.  The MAC will take care of interfacing with the
 	 * PHY to retrieve the desired data.
 	 */
-	mdic = ((offset << E1000_MDIC_REG_SHIFT) |
-		(phy->addr << E1000_MDIC_PHY_SHIFT) |
-		(E1000_MDIC_OP_READ));
-
-	ew32(MDIC, mdic);
-
-	/* Poll the ready bit to see if the MDI read completed
-	 * Increasing the time out as testing showed failures with
-	 * the lower time out
-	 */
-	for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) {
-		udelay(50);
-		mdic = er32(MDIC);
-		if (mdic & E1000_MDIC_READY)
-			break;
-	}
-	if (!(mdic & E1000_MDIC_READY)) {
-		e_dbg("MDI Read PHY Reg Address %d did not complete\n", offset);
-		return -E1000_ERR_PHY;
-	}
-	if (mdic & E1000_MDIC_ERROR) {
-		e_dbg("MDI Read PHY Reg Address %d Error\n", offset);
-		return -E1000_ERR_PHY;
-	}
-	if (FIELD_GET(E1000_MDIC_REG_MASK, mdic) != offset) {
-		e_dbg("MDI Read offset error - requested %d, returned %d\n",
-		      offset, FIELD_GET(E1000_MDIC_REG_MASK, mdic));
-		return -E1000_ERR_PHY;
+	for (retry_counter = 0; retry_counter <= retry_max; retry_counter++) {
+		success = true;
+
+		mdic = ((offset << E1000_MDIC_REG_SHIFT) |
+			(phy->addr << E1000_MDIC_PHY_SHIFT) |
+			(E1000_MDIC_OP_READ));
+
+		ew32(MDIC, mdic);
+
+		/* Poll the ready bit to see if the MDI read completed
+		 * Increasing the time out as testing showed failures with
+		 * the lower time out
+		 */
+		for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) {
+			udelay(50);
+			mdic = er32(MDIC);
+			if (mdic & E1000_MDIC_READY)
+				break;
+		}
+		if (!(mdic & E1000_MDIC_READY)) {
+			e_dbg("MDI Read PHY Reg Address %d did not complete\n",
+			      offset);
+			success = false;
+		}
+		if (mdic & E1000_MDIC_ERROR) {
+			e_dbg("MDI Read PHY Reg Address %d Error\n", offset);
+			success = false;
+		}
+		if (FIELD_GET(E1000_MDIC_REG_MASK, mdic) != offset) {
+			e_dbg("MDI Read offset error - requested %d, returned %d\n",
+			      offset, FIELD_GET(E1000_MDIC_REG_MASK, mdic));
+			success = false;
+		}
+
+		/* Allow some time after each MDIC transaction to avoid
+		 * reading duplicate data in the next MDIC transaction.
+		 */
+		if (hw->mac.type == e1000_pch2lan)
+			udelay(100);
+
+		if (success) {
+			*data = (u16)mdic;
+			return 0;
+		}
+
+		if (retry_counter != retry_max) {
+			e_dbg("Perform retry on PHY transaction...\n");
+			mdelay(10);
+		}
 	}
-	*data = (u16)mdic;
 
-	/* Allow some time after each MDIC transaction to avoid
-	 * reading duplicate data in the next MDIC transaction.
-	 */
-	if (hw->mac.type == e1000_pch2lan)
-		udelay(100);
-	return 0;
+	return -E1000_ERR_PHY;
 }
 
 /**
@@ -179,56 +207,72 @@
  **/
 s32 e1000e_write_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 data)
 {
+	u32 i, mdic = 0, retry_counter, retry_max;
 	struct e1000_phy_info *phy = &hw->phy;
-	u32 i, mdic = 0;
+	bool success;
 
 	if (offset > MAX_PHY_REG_ADDRESS) {
 		e_dbg("PHY Address %d is out of range\n", offset);
 		return -E1000_ERR_PARAM;
 	}
 
+	retry_max = phy->retry_enabled ? phy->retry_count : 0;
+
 	/* Set up Op-code, Phy Address, and register offset in the MDI
 	 * Control register.  The MAC will take care of interfacing with the
 	 * PHY to retrieve the desired data.
 	 */
-	mdic = (((u32)data) |
-		(offset << E1000_MDIC_REG_SHIFT) |
-		(phy->addr << E1000_MDIC_PHY_SHIFT) |
-		(E1000_MDIC_OP_WRITE));
-
-	ew32(MDIC, mdic);
-
-	/* Poll the ready bit to see if the MDI read completed
-	 * Increasing the time out as testing showed failures with
-	 * the lower time out
-	 */
-	for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) {
-		udelay(50);
-		mdic = er32(MDIC);
-		if (mdic & E1000_MDIC_READY)
-			break;
-	}
-	if (!(mdic & E1000_MDIC_READY)) {
-		e_dbg("MDI Write PHY Reg Address %d did not complete\n", offset);
-		return -E1000_ERR_PHY;
-	}
-	if (mdic & E1000_MDIC_ERROR) {
-		e_dbg("MDI Write PHY Red Address %d Error\n", offset);
-		return -E1000_ERR_PHY;
-	}
-	if (FIELD_GET(E1000_MDIC_REG_MASK, mdic) != offset) {
-		e_dbg("MDI Write offset error - requested %d, returned %d\n",
-		      offset, FIELD_GET(E1000_MDIC_REG_MASK, mdic));
-		return -E1000_ERR_PHY;
-	}
+	for (retry_counter = 0; retry_counter <= retry_max; retry_counter++) {
+		success = true;
 
-	/* Allow some time after each MDIC transaction to avoid
-	 * reading duplicate data in the next MDIC transaction.
-	 */
-	if (hw->mac.type == e1000_pch2lan)
-		udelay(100);
+		mdic = (((u32)data) |
+			(offset << E1000_MDIC_REG_SHIFT) |
+			(phy->addr << E1000_MDIC_PHY_SHIFT) |
+			(E1000_MDIC_OP_WRITE));
+
+		ew32(MDIC, mdic);
+
+		/* Poll the ready bit to see if the MDI read completed
+		 * Increasing the time out as testing showed failures with
+		 * the lower time out
+		 */
+		for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) {
+			udelay(50);
+			mdic = er32(MDIC);
+			if (mdic & E1000_MDIC_READY)
+				break;
+		}
+		if (!(mdic & E1000_MDIC_READY)) {
+			e_dbg("MDI Write PHY Reg Address %d did not complete\n",
+			      offset);
+			success = false;
+		}
+		if (mdic & E1000_MDIC_ERROR) {
+			e_dbg("MDI Write PHY Reg Address %d Error\n", offset);
+			success = false;
+		}
+		if (FIELD_GET(E1000_MDIC_REG_MASK, mdic) != offset) {
+			e_dbg("MDI Write offset error - requested %d, returned %d\n",
+			      offset, FIELD_GET(E1000_MDIC_REG_MASK, mdic));
+			success = false;
+		}
+
+		/* Allow some time after each MDIC transaction to avoid
+		 * reading duplicate data in the next MDIC transaction.
+		 */
+		if (hw->mac.type == e1000_pch2lan)
+			udelay(100);
+
+		if (success)
+			return 0;
+
+		if (retry_counter != retry_max) {
+			e_dbg("Perform retry on PHY transaction...\n");
+			mdelay(10);
+		}
+	}
 
-	return 0;
+	return -E1000_ERR_PHY;
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/e1000e/phy.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/e1000e/phy.h
@@ -51,6 +51,8 @@
 s32 e1000e_write_phy_reg_bm2(struct e1000_hw *hw, u32 offset, u16 data);
 void e1000_power_up_phy_copper(struct e1000_hw *hw);
 void e1000_power_down_phy_copper(struct e1000_hw *hw);
+void e1000e_disable_phy_retry(struct e1000_hw *hw);
+void e1000e_enable_phy_retry(struct e1000_hw *hw);
 s32 e1000e_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data);
 s32 e1000e_write_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 data);
 s32 e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/i40e/i40e.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/i40e/i40e.h
@@ -706,6 +706,7 @@
 	I40E_FILTER_ACTIVE,		/* Added to switch by FW */
 	I40E_FILTER_FAILED,		/* Rejected by FW */
 	I40E_FILTER_REMOVE,		/* To be removed */
+	I40E_FILTER_NEW_SYNC,		/* New, not sent yet, is in i40e_sync_vsi_filters() */
 /* There is no 'removed' state; the filter struct is freed */
 };
 struct i40e_mac_filter {
@@ -908,6 +909,7 @@
 	struct rcu_head rcu;	/* to avoid race with update stats on free */
 	char name[I40E_INT_NAME_STR_LEN];
 	bool arm_wb_state;
+	bool in_busy_poll;
 	int irq_num;		/* IRQ assigned to this q_vector */
 } ____cacheline_internodealigned_in_smp;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/i40e/i40e_adminq.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/i40e/i40e_adminq.h
@@ -109,10 +109,6 @@
 		-EFBIG,      /* I40E_AQ_RC_EFBIG */
 	};
 
-	/* aq_rc is invalid if AQ timed out */
-	if (aq_ret == -EIO)
-		return -EAGAIN;
-
 	if (!((u32)aq_rc < (sizeof(aq_to_posix) / sizeof((aq_to_posix)[0]))))
 		return -ERANGE;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -106,6 +106,7 @@
 	"ACTIVE",
 	"FAILED",
 	"REMOVE",
+	"NEW_SYNC",
 };
 
 /**
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -5306,7 +5306,7 @@
 	}
 
 flags_complete:
-	bitmap_xor(changed_flags, pf->flags, orig_flags, I40E_PF_FLAGS_NBITS);
+	bitmap_xor(changed_flags, new_flags, orig_flags, I40E_PF_FLAGS_NBITS);
 
 	if (test_bit(I40E_FLAG_FW_LLDP_DIS, changed_flags))
 		reset_needed = I40E_PF_RESET_AND_REBUILD_FLAG;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1257,8 +1257,12 @@
 	int bkt;
 	int cnt = 0;
 
-	hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist)
-		++cnt;
+	hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) {
+		if (f->state == I40E_FILTER_NEW ||
+		    f->state == I40E_FILTER_NEW_SYNC ||
+		    f->state == I40E_FILTER_ACTIVE)
+			++cnt;
+	}
 
 	return cnt;
 }
@@ -1442,6 +1446,8 @@
 
 			new->f = add_head;
 			new->state = add_head->state;
+			if (add_head->state == I40E_FILTER_NEW)
+				add_head->state = I40E_FILTER_NEW_SYNC;
 
 			/* Add the new filter to the tmp list */
 			hlist_add_head(&new->hlist, tmp_add_list);
@@ -1551,6 +1557,8 @@
 				return -ENOMEM;
 			new_mac->f = add_head;
 			new_mac->state = add_head->state;
+			if (add_head->state == I40E_FILTER_NEW)
+				add_head->state = I40E_FILTER_NEW_SYNC;
 
 			/* Add the new filter to the tmp list */
 			hlist_add_head(&new_mac->hlist, tmp_add_list);
@@ -1735,6 +1743,7 @@
 	struct hlist_node *h;
 	int bkt;
 
+	lockdep_assert_held(&vsi->mac_filter_hash_lock);
 	if (vsi->info.pvid)
 		return i40e_add_filter(vsi, macaddr,
 				       le16_to_cpu(vsi->info.pvid));
@@ -2437,7 +2446,8 @@
 i40e_aqc_broadcast_filter(struct i40e_vsi *vsi, const char *vsi_name,
 			  struct i40e_mac_filter *f)
 {
-	bool enable = f->state == I40E_FILTER_NEW;
+	bool enable = f->state == I40E_FILTER_NEW ||
+		      f->state == I40E_FILTER_NEW_SYNC;
 	struct i40e_hw *hw = &vsi->back->hw;
 	int aq_ret;
 
@@ -2611,6 +2621,7 @@
 
 				/* Add it to the hash list */
 				hlist_add_head(&new->hlist, &tmp_add_list);
+				f->state = I40E_FILTER_NEW_SYNC;
 			}
 
 			/* Count the number of active (current and new) VLAN
@@ -2762,7 +2773,8 @@
 		spin_lock_bh(&vsi->mac_filter_hash_lock);
 		hlist_for_each_entry_safe(new, h, &tmp_add_list, hlist) {
 			/* Only update the state if we're still NEW */
-			if (new->f->state == I40E_FILTER_NEW)
+			if (new->f->state == I40E_FILTER_NEW ||
+			    new->f->state == I40E_FILTER_NEW_SYNC)
 				new->f->state = new->state;
 			hlist_del(&new->hlist);
 			netdev_hw_addr_refcnt(new->f, vsi->netdev, -1);
@@ -3915,6 +3927,12 @@
 		     q_vector->tx.target_itr >> 1);
 		q_vector->tx.current_itr = q_vector->tx.target_itr;
 
+		/* Set ITR for software interrupts triggered after exiting
+		 * busy-loop polling.
+		 */
+		wr32(hw, I40E_PFINT_ITRN(I40E_SW_ITR, vector - 1),
+		     I40E_ITR_20K);
+
 		wr32(hw, I40E_PFINT_RATEN(vector - 1),
 		     i40e_intrl_usec_to_reg(vsi->int_rate_limit));
 
@@ -13292,6 +13310,10 @@
 	bool need_reset;
 	int i;
 
+	/* VSI shall be deleted in a moment, block loading new programs */
+	if (prog && test_bit(__I40E_IN_REMOVE, pf->state))
+		return -EINVAL;
+
 	/* Don't allow frames that span over multiple buffers */
 	if (vsi->netdev->mtu > frame_size - I40E_PACKET_HDR_PAD) {
 		NL_SET_ERR_MSG_MOD(extack, "MTU too large for linear frames and XDP prog does not support frags");
@@ -13300,14 +13322,9 @@
 
 	/* When turning XDP on->off/off->on we reset and rebuild the rings. */
 	need_reset = (i40e_enabled_xdp_vsi(vsi) != !!prog);
-
 	if (need_reset)
 		i40e_prep_for_reset(pf);
 
-	/* VSI shall be deleted in a moment, just return EINVAL */
-	if (test_bit(__I40E_IN_REMOVE, pf->state))
-		return -EINVAL;
-
 	old_prog = xchg(&vsi->xdp_prog, prog);
 
 	if (need_reset) {
@@ -16177,8 +16194,8 @@
 	val = FIELD_GET(I40E_PRTGL_SAH_MFS_MASK,
 			rd32(&pf->hw, I40E_PRTGL_SAH));
 	if (val < MAX_FRAME_SIZE_DEFAULT)
-		dev_warn(&pdev->dev, "MFS for port %x has been set below the default: %x\n",
-			 pf->hw.port, val);
+		dev_warn(&pdev->dev, "MFS for port %x (%d) has been set below the default (%d)\n",
+			 pf->hw.port, val, MAX_FRAME_SIZE_DEFAULT);
 
 	/* Add a filter to drop all Flow control frames from any VSI from being
 	 * transmitted. By doing so we stop a malicious VF from sending out
@@ -16724,7 +16741,7 @@
 	 * since we need to be able to guarantee forward progress even under
 	 * memory pressure.
 	 */
-	i40e_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0, i40e_driver_name);
+	i40e_wq = alloc_workqueue("%s", 0, 0, i40e_driver_name);
 	if (!i40e_wq) {
 		pr_err("%s: Failed to create workqueue\n", i40e_driver_name);
 		return -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/i40e/i40e_register.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/i40e/i40e_register.h
@@ -333,8 +333,11 @@
 #define I40E_PFINT_DYN_CTLN_ITR_INDX_SHIFT 3
 #define I40E_PFINT_DYN_CTLN_ITR_INDX_MASK I40E_MASK(0x3, I40E_PFINT_DYN_CTLN_ITR_INDX_SHIFT)
 #define I40E_PFINT_DYN_CTLN_INTERVAL_SHIFT 5
+#define I40E_PFINT_DYN_CTLN_INTERVAL_MASK I40E_MASK(0xFFF, I40E_PFINT_DYN_CTLN_INTERVAL_SHIFT)
 #define I40E_PFINT_DYN_CTLN_SW_ITR_INDX_ENA_SHIFT 24
 #define I40E_PFINT_DYN_CTLN_SW_ITR_INDX_ENA_MASK I40E_MASK(0x1, I40E_PFINT_DYN_CTLN_SW_ITR_INDX_ENA_SHIFT)
+#define I40E_PFINT_DYN_CTLN_SW_ITR_INDX_SHIFT 25
+#define I40E_PFINT_DYN_CTLN_SW_ITR_INDX_MASK I40E_MASK(0x3, I40E_PFINT_DYN_CTLN_SW_ITR_INDX_SHIFT)
 #define I40E_PFINT_ICR0 0x00038780 /* Reset: CORER */
 #define I40E_PFINT_ICR0_INTEVENT_SHIFT 0
 #define I40E_PFINT_ICR0_INTEVENT_MASK I40E_MASK(0x1, I40E_PFINT_ICR0_INTEVENT_SHIFT)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -2630,7 +2630,22 @@
 	return failure ? budget : (int)total_rx_packets;
 }
 
-static inline u32 i40e_buildreg_itr(const int type, u16 itr)
+/**
+ * i40e_buildreg_itr - build a value for writing to I40E_PFINT_DYN_CTLN register
+ * @itr_idx: interrupt throttling index
+ * @interval: interrupt throttling interval value in usecs
+ * @force_swint: force software interrupt
+ *
+ * The function builds a value for I40E_PFINT_DYN_CTLN register that
+ * is used to update interrupt throttling interval for specified ITR index
+ * and optionally enforces a software interrupt. If the @itr_idx is equal
+ * to I40E_ITR_NONE then no interval change is applied and only @force_swint
+ * parameter is taken into account. If the interval change and enforced
+ * software interrupt are not requested then the built value just enables
+ * appropriate vector interrupt.
+ **/
+static u32 i40e_buildreg_itr(enum i40e_dyn_idx itr_idx, u16 interval,
+			     bool force_swint)
 {
 	u32 val;
 
@@ -2644,23 +2659,33 @@
 	 * an event in the PBA anyway so we need to rely on the automask
 	 * to hold pending events for us until the interrupt is re-enabled
 	 *
-	 * The itr value is reported in microseconds, and the register
-	 * value is recorded in 2 microsecond units. For this reason we
-	 * only need to shift by the interval shift - 1 instead of the
-	 * full value.
+	 * We have to shift the given value as it is reported in microseconds
+	 * and the register value is recorded in 2 microsecond units.
 	 */
-	itr &= I40E_ITR_MASK;
+	interval >>= 1;
 
+	/* 1. Enable vector interrupt
+	 * 2. Update the interval for the specified ITR index
+	 *    (I40E_ITR_NONE in the register is used to indicate that
+	 *     no interval update is requested)
+	 */
 	val = I40E_PFINT_DYN_CTLN_INTENA_MASK |
-	      (type << I40E_PFINT_DYN_CTLN_ITR_INDX_SHIFT) |
-	      (itr << (I40E_PFINT_DYN_CTLN_INTERVAL_SHIFT - 1));
+	      FIELD_PREP(I40E_PFINT_DYN_CTLN_ITR_INDX_MASK, itr_idx) |
+	      FIELD_PREP(I40E_PFINT_DYN_CTLN_INTERVAL_MASK, interval);
+
+	/* 3. Enforce software interrupt trigger if requested
+	 *    (These software interrupts rate is limited by ITR2 that is
+	 *     set to 20K interrupts per second)
+	 */
+	if (force_swint)
+		val |= I40E_PFINT_DYN_CTLN_SWINT_TRIG_MASK |
+		       I40E_PFINT_DYN_CTLN_SW_ITR_INDX_ENA_MASK |
+		       FIELD_PREP(I40E_PFINT_DYN_CTLN_SW_ITR_INDX_MASK,
+				  I40E_SW_ITR);
 
 	return val;
 }
 
-/* a small macro to shorten up some long lines */
-#define INTREG I40E_PFINT_DYN_CTLN
-
 /* The act of updating the ITR will cause it to immediately trigger. In order
  * to prevent this from throwing off adaptive update statistics we defer the
  * update so that it can only happen so often. So after either Tx or Rx are
@@ -2679,8 +2704,10 @@
 static inline void i40e_update_enable_itr(struct i40e_vsi *vsi,
 					  struct i40e_q_vector *q_vector)
 {
+	enum i40e_dyn_idx itr_idx = I40E_ITR_NONE;
 	struct i40e_hw *hw = &vsi->back->hw;
-	u32 intval;
+	u16 interval = 0;
+	u32 itr_val;
 
 	/* If we don't have MSIX, then we only need to re-enable icr0 */
 	if (!test_bit(I40E_FLAG_MSIX_ENA, vsi->back->flags)) {
@@ -2702,8 +2729,8 @@
 	 */
 	if (q_vector->rx.target_itr < q_vector->rx.current_itr) {
 		/* Rx ITR needs to be reduced, this is highest priority */
-		intval = i40e_buildreg_itr(I40E_RX_ITR,
-					   q_vector->rx.target_itr);
+		itr_idx = I40E_RX_ITR;
+		interval = q_vector->rx.target_itr;
 		q_vector->rx.current_itr = q_vector->rx.target_itr;
 		q_vector->itr_countdown = ITR_COUNTDOWN_START;
 	} else if ((q_vector->tx.target_itr < q_vector->tx.current_itr) ||
@@ -2712,25 +2739,36 @@
 		/* Tx ITR needs to be reduced, this is second priority
 		 * Tx ITR needs to be increased more than Rx, fourth priority
 		 */
-		intval = i40e_buildreg_itr(I40E_TX_ITR,
-					   q_vector->tx.target_itr);
+		itr_idx = I40E_TX_ITR;
+		interval = q_vector->tx.target_itr;
 		q_vector->tx.current_itr = q_vector->tx.target_itr;
 		q_vector->itr_countdown = ITR_COUNTDOWN_START;
 	} else if (q_vector->rx.current_itr != q_vector->rx.target_itr) {
 		/* Rx ITR needs to be increased, third priority */
-		intval = i40e_buildreg_itr(I40E_RX_ITR,
-					   q_vector->rx.target_itr);
+		itr_idx = I40E_RX_ITR;
+		interval = q_vector->rx.target_itr;
 		q_vector->rx.current_itr = q_vector->rx.target_itr;
 		q_vector->itr_countdown = ITR_COUNTDOWN_START;
 	} else {
 		/* No ITR update, lowest priority */
-		intval = i40e_buildreg_itr(I40E_ITR_NONE, 0);
 		if (q_vector->itr_countdown)
 			q_vector->itr_countdown--;
 	}
 
-	if (!test_bit(__I40E_VSI_DOWN, vsi->state))
-		wr32(hw, INTREG(q_vector->reg_idx), intval);
+	/* Do not update interrupt control register if VSI is down */
+	if (test_bit(__I40E_VSI_DOWN, vsi->state))
+		return;
+
+	/* Update ITR interval if necessary and enforce software interrupt
+	 * if we are exiting busy poll.
+	 */
+	if (q_vector->in_busy_poll) {
+		itr_val = i40e_buildreg_itr(itr_idx, interval, true);
+		q_vector->in_busy_poll = false;
+	} else {
+		itr_val = i40e_buildreg_itr(itr_idx, interval, false);
+	}
+	wr32(hw, I40E_PFINT_DYN_CTLN(q_vector->reg_idx), itr_val);
 }
 
 /**
@@ -2845,6 +2883,8 @@
 	 */
 	if (likely(napi_complete_done(napi, work_done)))
 		i40e_update_enable_itr(vsi, q_vector);
+	else
+		q_vector->in_busy_poll = true;
 
 	return min(work_done, budget - 1);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/i40e/i40e_txrx.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/i40e/i40e_txrx.h
@@ -68,6 +68,7 @@
 /* these are indexes into ITRN registers */
 #define I40E_RX_ITR    I40E_IDX_ITR0
 #define I40E_TX_ITR    I40E_IDX_ITR1
+#define I40E_SW_ITR    I40E_IDX_ITR2
 
 /* Supported RSS offloads */
 #define I40E_DEFAULT_RSS_HENA ( \
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -1628,8 +1628,8 @@
 {
 	struct i40e_hw *hw = &pf->hw;
 	struct i40e_vf *vf;
-	int i, v;
 	u32 reg;
+	int i;
 
 	/* If we don't have any VFs, then there is nothing to reset */
 	if (!pf->num_alloc_vfs)
@@ -1640,11 +1640,10 @@
 		return false;
 
 	/* Begin reset on all VFs at once */
-	for (v = 0; v < pf->num_alloc_vfs; v++) {
-		vf = &pf->vf[v];
+	for (vf = &pf->vf[0]; vf < &pf->vf[pf->num_alloc_vfs]; ++vf) {
 		/* If VF is being reset no need to trigger reset again */
 		if (!test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))
-			i40e_trigger_vf_reset(&pf->vf[v], flr);
+			i40e_trigger_vf_reset(vf, flr);
 	}
 
 	/* HW requires some time to make sure it can flush the FIFO for a VF
@@ -1653,14 +1652,13 @@
 	 * the VFs using a simple iterator that increments once that VF has
 	 * finished resetting.
 	 */
-	for (i = 0, v = 0; i < 10 && v < pf->num_alloc_vfs; i++) {
+	for (i = 0, vf = &pf->vf[0]; i < 10 && vf < &pf->vf[pf->num_alloc_vfs]; ++i) {
 		usleep_range(10000, 20000);
 
 		/* Check each VF in sequence, beginning with the VF to fail
 		 * the previous check.
 		 */
-		while (v < pf->num_alloc_vfs) {
-			vf = &pf->vf[v];
+		while (vf < &pf->vf[pf->num_alloc_vfs]) {
 			if (!test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) {
 				reg = rd32(hw, I40E_VPGEN_VFRSTAT(vf->vf_id));
 				if (!(reg & I40E_VPGEN_VFRSTAT_VFRD_MASK))
@@ -1670,7 +1668,7 @@
 			/* If the current VF has finished resetting, move on
 			 * to the next VF in sequence.
 			 */
-			v++;
+			++vf;
 		}
 	}
 
@@ -1680,39 +1678,39 @@
 	/* Display a warning if at least one VF didn't manage to reset in
 	 * time, but continue on with the operation.
 	 */
-	if (v < pf->num_alloc_vfs)
+	if (vf < &pf->vf[pf->num_alloc_vfs])
 		dev_err(&pf->pdev->dev, "VF reset check timeout on VF %d\n",
-			pf->vf[v].vf_id);
+			vf->vf_id);
 	usleep_range(10000, 20000);
 
 	/* Begin disabling all the rings associated with VFs, but do not wait
 	 * between each VF.
 	 */
-	for (v = 0; v < pf->num_alloc_vfs; v++) {
+	for (vf = &pf->vf[0]; vf < &pf->vf[pf->num_alloc_vfs]; ++vf) {
 		/* On initial reset, we don't have any queues to disable */
-		if (pf->vf[v].lan_vsi_idx == 0)
+		if (vf->lan_vsi_idx == 0)
 			continue;
 
 		/* If VF is reset in another thread just continue */
 		if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))
 			continue;
 
-		i40e_vsi_stop_rings_no_wait(pf->vsi[pf->vf[v].lan_vsi_idx]);
+		i40e_vsi_stop_rings_no_wait(pf->vsi[vf->lan_vsi_idx]);
 	}
 
 	/* Now that we've notified HW to disable all of the VF rings, wait
 	 * until they finish.
 	 */
-	for (v = 0; v < pf->num_alloc_vfs; v++) {
+	for (vf = &pf->vf[0]; vf < &pf->vf[pf->num_alloc_vfs]; ++vf) {
 		/* On initial reset, we don't have any queues to disable */
-		if (pf->vf[v].lan_vsi_idx == 0)
+		if (vf->lan_vsi_idx == 0)
 			continue;
 
 		/* If VF is reset in another thread just continue */
 		if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))
 			continue;
 
-		i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[v].lan_vsi_idx]);
+		i40e_vsi_wait_queues_disabled(pf->vsi[vf->lan_vsi_idx]);
 	}
 
 	/* Hw may need up to 50ms to finish disabling the RX queues. We
@@ -1721,12 +1719,12 @@
 	mdelay(50);
 
 	/* Finish the reset on each VF */
-	for (v = 0; v < pf->num_alloc_vfs; v++) {
+	for (vf = &pf->vf[0]; vf < &pf->vf[pf->num_alloc_vfs]; ++vf) {
 		/* If VF is reset in another thread just continue */
 		if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))
 			continue;
 
-		i40e_cleanup_reset_vf(&pf->vf[v]);
+		i40e_cleanup_reset_vf(vf);
 	}
 
 	i40e_flush(hw);
@@ -2219,8 +2217,10 @@
 		vfres->vsi_res[0].qset_handle
 					  = le16_to_cpu(vsi->info.qs_handle[0]);
 		if (!(vf->driver_caps & VIRTCHNL_VF_OFFLOAD_USO) && !vf->pf_set_mac) {
+			spin_lock_bh(&vsi->mac_filter_hash_lock);
 			i40e_del_mac_filter(vsi, vf->default_lan_addr.addr);
 			eth_zero_addr(vf->default_lan_addr.addr);
+			spin_unlock_bh(&vsi->mac_filter_hash_lock);
 		}
 		ether_addr_copy(vfres->vsi_res[0].default_mac_addr,
 				vf->default_lan_addr.addr);
@@ -3143,11 +3143,12 @@
 		/* Allow to delete VF primary MAC only if it was not set
 		 * administratively by PF or if VF is trusted.
 		 */
-		if (ether_addr_equal(addr, vf->default_lan_addr.addr) &&
-		    i40e_can_vf_change_mac(vf))
-			was_unimac_deleted = true;
-		else
-			continue;
+		if (ether_addr_equal(addr, vf->default_lan_addr.addr)) {
+			if (i40e_can_vf_change_mac(vf))
+				was_unimac_deleted = true;
+			else
+				continue;
+		}
 
 		if (i40e_del_mac_filter(vsi, al->list[i].addr)) {
 			ret = -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/iavf/iavf_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/iavf/iavf_main.c
@@ -3512,6 +3512,34 @@
 }
 
 /**
+ * iavf_is_tc_config_same - Compare the mqprio TC config with the
+ * TC config already configured on this adapter.
+ * @adapter: board private structure
+ * @mqprio_qopt: TC config received from kernel.
+ *
+ * This function compares the TC config received from the kernel
+ * with the config already configured on the adapter.
+ *
+ * Return: True if configuration is same, false otherwise.
+ **/
+static bool iavf_is_tc_config_same(struct iavf_adapter *adapter,
+				   struct tc_mqprio_qopt *mqprio_qopt)
+{
+	struct virtchnl_channel_info *ch = &adapter->ch_config.ch_info[0];
+	int i;
+
+	if (adapter->num_tc != mqprio_qopt->num_tc)
+		return false;
+
+	for (i = 0; i < adapter->num_tc; i++) {
+		if (ch[i].count != mqprio_qopt->count[i] ||
+		    ch[i].offset != mqprio_qopt->offset[i])
+			return false;
+	}
+	return true;
+}
+
+/**
  * __iavf_setup_tc - configure multiple traffic classes
  * @netdev: network interface device structure
  * @type_data: tc offload data
@@ -3568,7 +3596,7 @@
 		if (ret)
 			return ret;
 		/* Return if same TC config is requested */
-		if (adapter->num_tc == num_tc)
+		if (iavf_is_tc_config_same(adapter, &mqprio_qopt->qopt))
 			return 0;
 		adapter->num_tc = num_tc;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice.h
@@ -317,6 +317,7 @@
 	ICE_VSI_UMAC_FLTR_CHANGED,
 	ICE_VSI_MMAC_FLTR_CHANGED,
 	ICE_VSI_PROMISC_CHANGED,
+	ICE_VSI_REBUILD_PENDING,
 	ICE_VSI_STATE_NBITS		/* must be last */
 };
 
@@ -412,9 +413,9 @@
 	struct ice_tc_cfg tc_cfg;
 	struct bpf_prog *xdp_prog;
 	struct ice_tx_ring **xdp_rings;	 /* XDP ring array */
-	unsigned long *af_xdp_zc_qps;	 /* tracks AF_XDP ZC enabled qps */
 	u16 num_xdp_txq;		 /* Used XDP queues */
 	u8 xdp_mapping_mode;		 /* ICE_MAP_MODE_[CONTIG|SCATTER] */
+	struct mutex xdp_state_lock;
 
 	struct net_device **target_netdevs;
 
@@ -749,21 +750,36 @@
 }
 
 /**
- * ice_xsk_pool - get XSK buffer pool bound to a ring
+ * ice_get_xp_from_qid - get ZC XSK buffer pool bound to a queue ID
+ * @vsi: pointer to VSI
+ * @qid: index of a queue to look at XSK buff pool presence
+ *
+ * Return: A pointer to xsk_buff_pool structure if there is a buffer pool
+ * attached and configured as zero-copy, NULL otherwise.
+ */
+static inline struct xsk_buff_pool *ice_get_xp_from_qid(struct ice_vsi *vsi,
+							u16 qid)
+{
+	struct xsk_buff_pool *pool = xsk_get_pool_from_qid(vsi->netdev, qid);
+
+	if (!ice_is_xdp_ena_vsi(vsi))
+		return NULL;
+
+	return (pool && pool->dev) ? pool : NULL;
+}
+
+/**
+ * ice_rx_xsk_pool - assign XSK buff pool to Rx ring
  * @ring: Rx ring to use
  *
- * Returns a pointer to xsk_buff_pool structure if there is a buffer pool
- * present, NULL otherwise.
+ * Sets XSK buff pool pointer on Rx ring.
  */
-static inline struct xsk_buff_pool *ice_xsk_pool(struct ice_rx_ring *ring)
+static inline void ice_rx_xsk_pool(struct ice_rx_ring *ring)
 {
 	struct ice_vsi *vsi = ring->vsi;
 	u16 qid = ring->q_index;
 
-	if (!ice_is_xdp_ena_vsi(vsi) || !test_bit(qid, vsi->af_xdp_zc_qps))
-		return NULL;
-
-	return xsk_get_pool_from_qid(vsi->netdev, qid);
+	WRITE_ONCE(ring->xsk_pool, ice_get_xp_from_qid(vsi, qid));
 }
 
 /**
@@ -788,12 +804,7 @@
 	if (!ring)
 		return;
 
-	if (!ice_is_xdp_ena_vsi(vsi) || !test_bit(qid, vsi->af_xdp_zc_qps)) {
-		ring->xsk_pool = NULL;
-		return;
-	}
-
-	ring->xsk_pool = xsk_get_pool_from_qid(vsi->netdev, qid);
+	WRITE_ONCE(ring->xsk_pool, ice_get_xp_from_qid(vsi, qid));
 }
 
 /**
@@ -921,9 +932,17 @@
 int ice_down_up(struct ice_vsi *vsi);
 int ice_vsi_cfg_lan(struct ice_vsi *vsi);
 struct ice_vsi *ice_lb_vsi_setup(struct ice_pf *pf, struct ice_port_info *pi);
+
+enum ice_xdp_cfg {
+	ICE_XDP_CFG_FULL,	/* Fully apply new config in .ndo_bpf() */
+	ICE_XDP_CFG_PART,	/* Save/use part of config in VSI rebuild */
+};
+
 int ice_vsi_determine_xdp_res(struct ice_vsi *vsi);
-int ice_prepare_xdp_rings(struct ice_vsi *vsi, struct bpf_prog *prog);
-int ice_destroy_xdp_rings(struct ice_vsi *vsi);
+int ice_prepare_xdp_rings(struct ice_vsi *vsi, struct bpf_prog *prog,
+			  enum ice_xdp_cfg cfg_type);
+int ice_destroy_xdp_rings(struct ice_vsi *vsi, enum ice_xdp_cfg cfg_type);
+void ice_map_xdp_rings(struct ice_vsi *vsi);
 int
 ice_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
 	     u32 flags);
@@ -983,6 +1002,8 @@
 int ice_load(struct ice_pf *pf);
 void ice_unload(struct ice_pf *pf);
 void ice_adv_lnk_speed_maps_init(void);
+int ice_init_dev(struct ice_pf *pf);
+void ice_deinit_dev(struct ice_pf *pf);
 
 /**
  * ice_set_rdma_cap - enable RDMA support
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
@@ -593,8 +593,9 @@
 struct ice_aqc_recipe_to_profile {
 	__le16 profile_id;
 	u8 rsvd[6];
-	DECLARE_BITMAP(recipe_assoc, ICE_MAX_NUM_RECIPES);
+	__le64 recipe_assoc;
 };
+static_assert(sizeof(struct ice_aqc_recipe_to_profile) == 16);
 
 /* Add/Update/Remove/Get switch rules (indirect 0x02A0, 0x02A1, 0x02A2, 0x02A3)
  */
@@ -2149,6 +2150,8 @@
 	struct ice_aqc_get_pkg_info pkg_info[];
 };
 
+#define ICE_AQC_GET_CGU_MAX_PHASE_ADJ	GENMASK(30, 0)
+
 /* Get CGU abilities command response data structure (indirect 0x0C61) */
 struct ice_aqc_get_cgu_abilities {
 	u8 num_inputs;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_base.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_base.c
@@ -189,16 +189,11 @@
 	}
 	q_vector = vsi->q_vectors[v_idx];
 
-	ice_for_each_tx_ring(tx_ring, q_vector->tx) {
-		ice_queue_set_napi(vsi, tx_ring->q_index, NETDEV_QUEUE_TYPE_TX,
-				   NULL);
+	ice_for_each_tx_ring(tx_ring, vsi->q_vectors[v_idx]->tx)
 		tx_ring->q_vector = NULL;
-	}
-	ice_for_each_rx_ring(rx_ring, q_vector->rx) {
-		ice_queue_set_napi(vsi, rx_ring->q_index, NETDEV_QUEUE_TYPE_RX,
-				   NULL);
+
+	ice_for_each_rx_ring(rx_ring, vsi->q_vectors[v_idx]->rx)
 		rx_ring->q_vector = NULL;
-	}
 
 	/* only VSI with an associated netdev is set up with NAPI */
 	if (vsi->netdev)
@@ -531,12 +526,31 @@
 }
 
 /**
+ * ice_get_frame_sz - calculate xdp_buff::frame_sz
+ * @rx_ring: the ring being configured
+ *
+ * Return frame size based on underlying PAGE_SIZE
+ */
+static unsigned int ice_get_frame_sz(struct ice_rx_ring *rx_ring)
+{
+	unsigned int frame_sz;
+
+#if (PAGE_SIZE >= 8192)
+	frame_sz = rx_ring->rx_buf_len;
+#else
+	frame_sz = ice_rx_pg_size(rx_ring) / 2;
+#endif
+
+	return frame_sz;
+}
+
+/**
  * ice_vsi_cfg_rxq - Configure an Rx queue
  * @ring: the ring being configured
  *
  * Return 0 on success and a negative value on error.
  */
-int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
+static int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
 {
 	struct device *dev = ice_pf_to_dev(ring->vsi->back);
 	u32 num_bufs = ICE_RX_DESC_UNUSED(ring);
@@ -554,7 +568,7 @@
 				return err;
 		}
 
-		ring->xsk_pool = ice_xsk_pool(ring);
+		ice_rx_xsk_pool(ring);
 		if (ring->xsk_pool) {
 			xdp_rxq_info_unreg(&ring->xdp_rxq);
 
@@ -594,7 +608,7 @@
 		}
 	}
 
-	xdp_init_buff(&ring->xdp, ice_rx_pg_size(ring) / 2, &ring->xdp_rxq);
+	xdp_init_buff(&ring->xdp, ice_get_frame_sz(ring), &ring->xdp_rxq);
 	ring->xdp.data = NULL;
 	ring->xdp_ext.pkt_ctx = &ring->pkt_ctx;
 	err = ice_setup_rx_ctx(ring);
@@ -615,7 +629,7 @@
 			return 0;
 		}
 
-		ok = ice_alloc_rx_bufs_zc(ring, num_bufs);
+		ok = ice_alloc_rx_bufs_zc(ring, ring->xsk_pool, num_bufs);
 		if (!ok) {
 			u16 pf_q = ring->vsi->rxq_map[ring->q_index];
 
@@ -631,6 +645,62 @@
 	return 0;
 }
 
+int ice_vsi_cfg_single_rxq(struct ice_vsi *vsi, u16 q_idx)
+{
+	if (q_idx >= vsi->num_rxq)
+		return -EINVAL;
+
+	return ice_vsi_cfg_rxq(vsi->rx_rings[q_idx]);
+}
+
+/**
+ * ice_vsi_cfg_frame_size - setup max frame size and Rx buffer length
+ * @vsi: VSI
+ */
+static void ice_vsi_cfg_frame_size(struct ice_vsi *vsi)
+{
+	if (!vsi->netdev || test_bit(ICE_FLAG_LEGACY_RX, vsi->back->flags)) {
+		vsi->max_frame = ICE_MAX_FRAME_LEGACY_RX;
+		vsi->rx_buf_len = ICE_RXBUF_1664;
+#if (PAGE_SIZE < 8192)
+	} else if (!ICE_2K_TOO_SMALL_WITH_PADDING &&
+		   (vsi->netdev->mtu <= ETH_DATA_LEN)) {
+		vsi->max_frame = ICE_RXBUF_1536 - NET_IP_ALIGN;
+		vsi->rx_buf_len = ICE_RXBUF_1536 - NET_IP_ALIGN;
+#endif
+	} else {
+		vsi->max_frame = ICE_AQ_SET_MAC_FRAME_SIZE_MAX;
+		vsi->rx_buf_len = ICE_RXBUF_3072;
+	}
+}
+
+/**
+ * ice_vsi_cfg_rxqs - Configure the VSI for Rx
+ * @vsi: the VSI being configured
+ *
+ * Return 0 on success and a negative value on error
+ * Configure the Rx VSI for operation.
+ */
+int ice_vsi_cfg_rxqs(struct ice_vsi *vsi)
+{
+	u16 i;
+
+	if (vsi->type == ICE_VSI_VF)
+		goto setup_rings;
+
+	ice_vsi_cfg_frame_size(vsi);
+setup_rings:
+	/* set up individual rings */
+	ice_for_each_rxq(vsi, i) {
+		int err = ice_vsi_cfg_rxq(vsi->rx_rings[i]);
+
+		if (err)
+			return err;
+	}
+
+	return 0;
+}
+
 /**
  * __ice_vsi_get_qs - helper function for assigning queues from PF to VSI
  * @qs_cfg: gathered variables needed for pf->vsi queues assignment
@@ -804,6 +874,9 @@
 		}
 		rx_rings_rem -= rx_rings_per_v;
 	}
+
+	if (ice_is_xdp_ena_vsi(vsi))
+		ice_map_xdp_rings(vsi);
 }
 
 /**
@@ -826,7 +899,7 @@
  * @ring: Tx ring to be configured
  * @qg_buf: queue group buffer
  */
-int
+static int
 ice_vsi_cfg_txq(struct ice_vsi *vsi, struct ice_tx_ring *ring,
 		struct ice_aqc_add_tx_qgrp *qg_buf)
 {
@@ -896,6 +969,80 @@
 
 	return 0;
 }
+
+int ice_vsi_cfg_single_txq(struct ice_vsi *vsi, struct ice_tx_ring **tx_rings,
+			   u16 q_idx)
+{
+	DEFINE_RAW_FLEX(struct ice_aqc_add_tx_qgrp, qg_buf, txqs, 1);
+
+	if (q_idx >= vsi->alloc_txq || !tx_rings || !tx_rings[q_idx])
+		return -EINVAL;
+
+	qg_buf->num_txqs = 1;
+
+	return ice_vsi_cfg_txq(vsi, tx_rings[q_idx], qg_buf);
+}
+
+/**
+ * ice_vsi_cfg_txqs - Configure the VSI for Tx
+ * @vsi: the VSI being configured
+ * @rings: Tx ring array to be configured
+ * @count: number of Tx ring array elements
+ *
+ * Return 0 on success and a negative value on error
+ * Configure the Tx VSI for operation.
+ */
+static int
+ice_vsi_cfg_txqs(struct ice_vsi *vsi, struct ice_tx_ring **rings, u16 count)
+{
+	DEFINE_RAW_FLEX(struct ice_aqc_add_tx_qgrp, qg_buf, txqs, 1);
+	int err = 0;
+	u16 q_idx;
+
+	qg_buf->num_txqs = 1;
+
+	for (q_idx = 0; q_idx < count; q_idx++) {
+		err = ice_vsi_cfg_txq(vsi, rings[q_idx], qg_buf);
+		if (err)
+			break;
+	}
+
+	return err;
+}
+
+/**
+ * ice_vsi_cfg_lan_txqs - Configure the VSI for Tx
+ * @vsi: the VSI being configured
+ *
+ * Return 0 on success and a negative value on error
+ * Configure the Tx VSI for operation.
+ */
+int ice_vsi_cfg_lan_txqs(struct ice_vsi *vsi)
+{
+	return ice_vsi_cfg_txqs(vsi, vsi->tx_rings, vsi->num_txq);
+}
+
+/**
+ * ice_vsi_cfg_xdp_txqs - Configure Tx queues dedicated for XDP in given VSI
+ * @vsi: the VSI being configured
+ *
+ * Return 0 on success and a negative value on error
+ * Configure the Tx queues dedicated for XDP in given VSI for operation.
+ */
+int ice_vsi_cfg_xdp_txqs(struct ice_vsi *vsi)
+{
+	int ret;
+	int i;
+
+	ret = ice_vsi_cfg_txqs(vsi, vsi->xdp_rings, vsi->num_xdp_txq);
+	if (ret)
+		return ret;
+
+	ice_for_each_rxq(vsi, i)
+		ice_tx_xsk_pool(vsi, i);
+
+	return 0;
+}
 
 /**
  * ice_cfg_itr - configure the initial interrupt throttle values
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_base.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_base.h
@@ -6,7 +6,8 @@
 
 #include "ice.h"
 
-int ice_vsi_cfg_rxq(struct ice_rx_ring *ring);
+int ice_vsi_cfg_single_rxq(struct ice_vsi *vsi, u16 q_idx);
+int ice_vsi_cfg_rxqs(struct ice_vsi *vsi);
 int __ice_vsi_get_qs(struct ice_qs_cfg *qs_cfg);
 int
 ice_vsi_ctrl_one_rx_ring(struct ice_vsi *vsi, bool ena, u16 rxq_idx, bool wait);
@@ -14,9 +15,10 @@
 int ice_vsi_alloc_q_vectors(struct ice_vsi *vsi);
 void ice_vsi_map_rings_to_vectors(struct ice_vsi *vsi);
 void ice_vsi_free_q_vectors(struct ice_vsi *vsi);
-int
-ice_vsi_cfg_txq(struct ice_vsi *vsi, struct ice_tx_ring *ring,
-		struct ice_aqc_add_tx_qgrp *qg_buf);
+int ice_vsi_cfg_single_txq(struct ice_vsi *vsi, struct ice_tx_ring **tx_rings,
+			   u16 q_idx);
+int ice_vsi_cfg_lan_txqs(struct ice_vsi *vsi);
+int ice_vsi_cfg_xdp_txqs(struct ice_vsi *vsi);
 void ice_cfg_itr(struct ice_hw *hw, struct ice_q_vector *q_vector);
 void
 ice_cfg_txq_interrupt(struct ice_vsi *vsi, u16 txq, u16 msix_idx, u16 itr_idx);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_common.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_common.c
@@ -475,7 +475,8 @@
 /**
  * ice_find_netlist_node
  * @hw: pointer to the hw struct
- * @node_type_ctx: type of netlist node to look for
+ * @node_type: type of netlist node to look for
+ * @ctx: context of the search
  * @node_part_number: node part number to look for
  * @node_handle: output parameter if node found - optional
  *
@@ -485,10 +486,12 @@
  * valid if the function returns zero, and should be ignored on any non-zero
  * return value.
  *
- * Returns: 0 if the node is found, -ENOENT if no handle was found, and
- * a negative error code on failure to access the AQ.
+ * Return:
+ * * 0 if the node is found,
+ * * -ENOENT if no handle was found,
+ * * negative error code on failure to access the AQ.
  */
-static int ice_find_netlist_node(struct ice_hw *hw, u8 node_type_ctx,
+static int ice_find_netlist_node(struct ice_hw *hw, u8 node_type, u8 ctx,
 				 u8 node_part_number, u16 *node_handle)
 {
 	u8 idx;
@@ -499,8 +502,8 @@
 		int status;
 
 		cmd.addr.topo_params.node_type_ctx =
-			FIELD_PREP(ICE_AQC_LINK_TOPO_NODE_TYPE_M,
-				   node_type_ctx);
+			FIELD_PREP(ICE_AQC_LINK_TOPO_NODE_TYPE_M, node_type) |
+			FIELD_PREP(ICE_AQC_LINK_TOPO_NODE_CTX_M, ctx);
 		cmd.addr.topo_params.index = idx;
 
 		status = ice_aq_get_netlist_node(hw, &cmd,
@@ -2624,9 +2627,11 @@
  */
 bool ice_is_phy_rclk_in_netlist(struct ice_hw *hw)
 {
-	if (ice_find_netlist_node(hw, ICE_AQC_LINK_TOPO_NODE_TYPE_CLK_CTRL,
+	if (ice_find_netlist_node(hw, ICE_AQC_LINK_TOPO_NODE_TYPE_PHY,
+				  ICE_AQC_LINK_TOPO_NODE_CTX_PORT,
 				  ICE_AQC_GET_LINK_TOPO_NODE_NR_C827, NULL) &&
-	    ice_find_netlist_node(hw, ICE_AQC_LINK_TOPO_NODE_TYPE_CLK_CTRL,
+	    ice_find_netlist_node(hw, ICE_AQC_LINK_TOPO_NODE_TYPE_PHY,
+				  ICE_AQC_LINK_TOPO_NODE_CTX_PORT,
 				  ICE_AQC_GET_LINK_TOPO_NODE_NR_E822_PHY, NULL))
 		return false;
 
@@ -2642,6 +2647,7 @@
 bool ice_is_clock_mux_in_netlist(struct ice_hw *hw)
 {
 	if (ice_find_netlist_node(hw, ICE_AQC_LINK_TOPO_NODE_TYPE_CLK_MUX,
+				  ICE_AQC_LINK_TOPO_NODE_CTX_GLOBAL,
 				  ICE_AQC_GET_LINK_TOPO_NODE_NR_GEN_CLK_MUX,
 				  NULL))
 		return false;
@@ -2662,12 +2668,14 @@
 bool ice_is_cgu_in_netlist(struct ice_hw *hw)
 {
 	if (!ice_find_netlist_node(hw, ICE_AQC_LINK_TOPO_NODE_TYPE_CLK_CTRL,
+				   ICE_AQC_LINK_TOPO_NODE_CTX_GLOBAL,
 				   ICE_AQC_GET_LINK_TOPO_NODE_NR_ZL30632_80032,
 				   NULL)) {
 		hw->cgu_part_number = ICE_AQC_GET_LINK_TOPO_NODE_NR_ZL30632_80032;
 		return true;
 	} else if (!ice_find_netlist_node(hw,
 					  ICE_AQC_LINK_TOPO_NODE_TYPE_CLK_CTRL,
+					  ICE_AQC_LINK_TOPO_NODE_CTX_GLOBAL,
 					  ICE_AQC_GET_LINK_TOPO_NODE_NR_SI5383_5384,
 					  NULL)) {
 		hw->cgu_part_number = ICE_AQC_GET_LINK_TOPO_NODE_NR_SI5383_5384;
@@ -2686,6 +2694,7 @@
 bool ice_is_gps_in_netlist(struct ice_hw *hw)
 {
 	if (ice_find_netlist_node(hw, ICE_AQC_LINK_TOPO_NODE_TYPE_GPS,
+				  ICE_AQC_LINK_TOPO_NODE_CTX_GLOBAL,
 				  ICE_AQC_GET_LINK_TOPO_NODE_NR_GEN_GPS, NULL))
 		return false;
 
@@ -3103,6 +3112,16 @@
 	case ICE_PHY_TYPE_HIGH_100G_AUI2:
 		speed_phy_type_high = ICE_AQ_LINK_SPEED_100GB;
 		break;
+	case ICE_PHY_TYPE_HIGH_200G_CR4_PAM4:
+	case ICE_PHY_TYPE_HIGH_200G_SR4:
+	case ICE_PHY_TYPE_HIGH_200G_FR4:
+	case ICE_PHY_TYPE_HIGH_200G_LR4:
+	case ICE_PHY_TYPE_HIGH_200G_DR4:
+	case ICE_PHY_TYPE_HIGH_200G_KR4_PAM4:
+	case ICE_PHY_TYPE_HIGH_200G_AUI4_AOC_ACC:
+	case ICE_PHY_TYPE_HIGH_200G_AUI4:
+		speed_phy_type_high = ICE_AQ_LINK_SPEED_200GB;
+		break;
 	default:
 		speed_phy_type_high = ICE_AQ_LINK_SPEED_UNKNOWN;
 		break;
@@ -4700,7 +4719,7 @@
 		enum ice_disq_rst_src rst_src, u16 vmvf_num,
 		struct ice_sq_cd *cd)
 {
-	DEFINE_FLEX(struct ice_aqc_dis_txq_item, qg_list, q_id, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_dis_txq_item, qg_list, q_id, 1);
 	u16 i, buf_size = __struct_size(qg_list);
 	struct ice_q_ctx *q_ctx;
 	int status = -ENOENT;
@@ -4922,7 +4941,7 @@
 ice_dis_vsi_rdma_qset(struct ice_port_info *pi, u16 count, u32 *qset_teid,
 		      u16 *q_id)
 {
-	DEFINE_FLEX(struct ice_aqc_dis_txq_item, qg_list, q_id, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_dis_txq_item, qg_list, q_id, 1);
 	u16 qg_size = __struct_size(qg_list);
 	struct ice_hw *hw;
 	int status = 0;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_ddp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_ddp.c
@@ -1329,6 +1329,7 @@
 
 	for (i = 0; i < count; i++) {
 		bool last = false;
+		int try_cnt = 0;
 		int status;
 
 		bh = (struct ice_buf_hdr *)(bufs + start + i);
@@ -1336,8 +1337,26 @@
 		if (indicate_last)
 			last = ice_is_last_download_buffer(bh, i, count);
 
-		status = ice_aq_download_pkg(hw, bh, ICE_PKG_BUF_SIZE, last,
-					     &offset, &info, NULL);
+		while (1) {
+			status = ice_aq_download_pkg(hw, bh, ICE_PKG_BUF_SIZE,
+						     last, &offset, &info,
+						     NULL);
+			if (hw->adminq.sq_last_status != ICE_AQ_RC_ENOSEC &&
+			    hw->adminq.sq_last_status != ICE_AQ_RC_EBADSIG)
+				break;
+
+			try_cnt++;
+
+			if (try_cnt == 5)
+				break;
+
+			msleep(20);
+		}
+
+		if (try_cnt)
+			dev_dbg(ice_hw_to_dev(hw),
+				"ice_aq_download_pkg number of retries: %d\n",
+				try_cnt);
 
 		/* Save AQ status from download package */
 		if (status) {
@@ -1424,14 +1443,14 @@
 		goto exit;
 	}
 
-	conf_idx = le32_to_cpu(seg->signed_seg_idx);
-	start = le32_to_cpu(seg->signed_buf_start);
 	count = le32_to_cpu(seg->signed_buf_count);
-
 	state = ice_download_pkg_sig_seg(hw, seg);
-	if (state)
+	if (state || !count)
 		goto exit;
 
+	conf_idx = le32_to_cpu(seg->signed_seg_idx);
+	start = le32_to_cpu(seg->signed_buf_start);
+
 	state = ice_download_pkg_config_seg(hw, pkg_hdr, conf_idx, start,
 					    count);
 
@@ -1934,8 +1953,8 @@
  */
 static enum ice_ddp_state ice_get_pkg_info(struct ice_hw *hw)
 {
-	DEFINE_FLEX(struct ice_aqc_get_pkg_info_resp, pkg_info, pkg_info,
-		    ICE_PKG_CNT);
+	DEFINE_RAW_FLEX(struct ice_aqc_get_pkg_info_resp, pkg_info, pkg_info,
+			ICE_PKG_CNT);
 	u16 size = __struct_size(pkg_info);
 	u32 i;
 
@@ -1986,8 +2005,8 @@
 					     struct ice_pkg_hdr *ospkg,
 					     struct ice_seg **seg)
 {
-	DEFINE_FLEX(struct ice_aqc_get_pkg_info_resp, pkg, pkg_info,
-		    ICE_PKG_CNT);
+	DEFINE_RAW_FLEX(struct ice_aqc_get_pkg_info_resp, pkg, pkg_info,
+			ICE_PKG_CNT);
 	u16 size = __struct_size(pkg);
 	enum ice_ddp_state state;
 	u32 i;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_debugfs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_debugfs.c
@@ -174,7 +174,7 @@
 	if (*ppos != 0 || count > 8)
 		return -EINVAL;
 
-	cmd_buf = memdup_user(buf, count);
+	cmd_buf = memdup_user_nul(buf, count);
 	if (IS_ERR(cmd_buf))
 		return PTR_ERR(cmd_buf);
 
@@ -260,7 +260,7 @@
 	if (*ppos != 0 || count > 4)
 		return -EINVAL;
 
-	cmd_buf = memdup_user(buf, count);
+	cmd_buf = memdup_user_nul(buf, count);
 	if (IS_ERR(cmd_buf))
 		return PTR_ERR(cmd_buf);
 
@@ -335,7 +335,7 @@
 	if (*ppos != 0 || count > 2)
 		return -EINVAL;
 
-	cmd_buf = memdup_user(buf, count);
+	cmd_buf = memdup_user_nul(buf, count);
 	if (IS_ERR(cmd_buf))
 		return PTR_ERR(cmd_buf);
 
@@ -431,7 +431,7 @@
 	if (*ppos != 0 || count > 5)
 		return -EINVAL;
 
-	cmd_buf = memdup_user(buf, count);
+	cmd_buf = memdup_user_nul(buf, count);
 	if (IS_ERR(cmd_buf))
 		return PTR_ERR(cmd_buf);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_devlink.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_devlink.c
@@ -445,6 +445,20 @@
 }
 
 /**
+ * ice_devlink_reinit_down - unload given PF
+ * @pf: pointer to the PF struct
+ */
+static void ice_devlink_reinit_down(struct ice_pf *pf)
+{
+	/* No need to take devl_lock, it's already taken by devlink API */
+	ice_unload(pf);
+	rtnl_lock();
+	ice_vsi_decfg(ice_get_main_vsi(pf));
+	rtnl_unlock();
+	ice_deinit_dev(pf);
+}
+
+/**
  * ice_devlink_reload_down - prepare for reload
  * @devlink: pointer to the devlink instance to reload
  * @netns_change: if true, the network namespace is changing
@@ -477,7 +491,7 @@
 					   "Remove all VFs before doing reinit\n");
 			return -EOPNOTSUPP;
 		}
-		ice_unload(pf);
+		ice_devlink_reinit_down(pf);
 		return 0;
 	case DEVLINK_RELOAD_ACTION_FW_ACTIVATE:
 		return ice_devlink_reload_empr_start(pf, extack);
@@ -1270,6 +1284,45 @@
 }
 
 /**
+ * ice_devlink_reinit_up - do reinit of the given PF
+ * @pf: pointer to the PF struct
+ */
+static int ice_devlink_reinit_up(struct ice_pf *pf)
+{
+	struct ice_vsi *vsi = ice_get_main_vsi(pf);
+	struct ice_vsi_cfg_params params;
+	int err;
+
+	err = ice_init_dev(pf);
+	if (err)
+		return err;
+
+	params = ice_vsi_to_params(vsi);
+	params.flags = ICE_VSI_FLAG_INIT;
+
+	rtnl_lock();
+	err = ice_vsi_cfg(vsi, &params);
+	rtnl_unlock();
+	if (err)
+		goto err_vsi_cfg;
+
+	/* No need to take devl_lock, it's already taken by devlink API */
+	err = ice_load(pf);
+	if (err)
+		goto err_load;
+
+	return 0;
+
+err_load:
+	rtnl_lock();
+	ice_vsi_decfg(vsi);
+	rtnl_unlock();
+err_vsi_cfg:
+	ice_deinit_dev(pf);
+	return err;
+}
+
+/**
  * ice_devlink_reload_up - do reload up after reinit
  * @devlink: pointer to the devlink instance reloading
  * @action: the action requested
@@ -1289,7 +1342,7 @@
 	switch (action) {
 	case DEVLINK_RELOAD_ACTION_DRIVER_REINIT:
 		*actions_performed = BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT);
-		return ice_load(pf);
+		return ice_devlink_reinit_up(pf);
 	case DEVLINK_RELOAD_ACTION_FW_ACTIVATE:
 		*actions_performed = BIT(DEVLINK_RELOAD_ACTION_FW_ACTIVATE);
 		return ice_devlink_reload_empr_finish(pf, extack);
@@ -1569,6 +1622,7 @@
  * @pf: the PF to create a devlink port for
  *
  * Create and register a devlink_port for this PF.
+ * This function has to be called under devl_lock.
  *
  * Return: zero on success or an error code on failure.
  */
@@ -1581,6 +1635,8 @@
 	struct device *dev;
 	int err;
 
+	devlink = priv_to_devlink(pf);
+
 	dev = ice_pf_to_dev(pf);
 
 	devlink_port = &pf->devlink_port;
@@ -1590,7 +1646,7 @@
 		return -EIO;
 
 	attrs.flavour = DEVLINK_PORT_FLAVOUR_PHYSICAL;
-	attrs.phys.port_number = pf->hw.bus.func;
+	attrs.phys.port_number = pf->hw.pf_id;
 
 	/* As FW supports only port split options for whole device,
 	 * set port split options only for first PF.
@@ -1601,10 +1657,9 @@
 	ice_devlink_set_switch_id(pf, &attrs.switch_id);
 
 	devlink_port_attrs_set(devlink_port, &attrs);
-	devlink = priv_to_devlink(pf);
 
-	err = devlink_port_register_with_ops(devlink, devlink_port, vsi->idx,
-					     &ice_devlink_port_ops);
+	err = devl_port_register_with_ops(devlink, devlink_port, vsi->idx,
+					  &ice_devlink_port_ops);
 	if (err) {
 		dev_err(dev, "Failed to create devlink port for PF %d, error %d\n",
 			pf->hw.pf_id, err);
@@ -1619,10 +1674,11 @@
  * @pf: the PF to cleanup
  *
  * Unregisters the devlink_port structure associated with this PF.
+ * This function has to be called under devl_lock.
  */
 void ice_devlink_destroy_pf_port(struct ice_pf *pf)
 {
-	devlink_port_unregister(&pf->devlink_port);
+	devl_port_unregister(&pf->devlink_port);
 }
 
 /**
@@ -1652,7 +1708,7 @@
 		return -EINVAL;
 
 	attrs.flavour = DEVLINK_PORT_FLAVOUR_PCI_VF;
-	attrs.pci_vf.pf = pf->hw.bus.func;
+	attrs.pci_vf.pf = pf->hw.pf_id;
 	attrs.pci_vf.vf = vf->vf_id;
 
 	ice_devlink_set_switch_id(pf, &attrs.switch_id);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_dpll.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_dpll.c
@@ -9,6 +9,8 @@
 #define ICE_CGU_STATE_ACQ_ERR_THRESHOLD		50
 #define ICE_DPLL_PIN_IDX_INVALID		0xff
 #define ICE_DPLL_RCLK_NUM_PER_PF		1
+#define ICE_DPLL_PIN_ESYNC_PULSE_HIGH_PERCENT	25
+#define ICE_DPLL_PIN_GEN_RCLK_FREQ		1953125
 
 /**
  * enum ice_dpll_pin_type - enumerate ice pin types:
@@ -30,6 +32,10 @@
 	[ICE_DPLL_PIN_TYPE_RCLK_INPUT] = "rclk-input",
 };
 
+static const struct dpll_pin_frequency ice_esync_range[] = {
+	DPLL_PIN_FREQUENCY_RANGE(0, DPLL_PIN_FREQUENCY_1_HZ),
+};
+
 /**
  * ice_dpll_is_reset - check if reset is in progress
  * @pf: private board structure
@@ -394,8 +400,8 @@
 
 	switch (pin_type) {
 	case ICE_DPLL_PIN_TYPE_INPUT:
-		ret = ice_aq_get_input_pin_cfg(&pf->hw, pin->idx, NULL, NULL,
-					       NULL, &pin->flags[0],
+		ret = ice_aq_get_input_pin_cfg(&pf->hw, pin->idx, &pin->status,
+					       NULL, NULL, &pin->flags[0],
 					       &pin->freq, &pin->phase_adjust);
 		if (ret)
 			goto err;
@@ -430,7 +436,7 @@
 			goto err;
 
 		parent &= ICE_AQC_GET_CGU_OUT_CFG_DPLL_SRC_SEL;
-		if (ICE_AQC_SET_CGU_OUT_CFG_OUT_EN & pin->flags[0]) {
+		if (ICE_AQC_GET_CGU_OUT_CFG_OUT_EN & pin->flags[0]) {
 			pin->state[pf->dplls.eec.dpll_idx] =
 				parent == pf->dplls.eec.dpll_idx ?
 				DPLL_PIN_STATE_CONNECTED :
@@ -649,6 +655,8 @@
 	struct ice_dpll_pin *p = pin_priv;
 	struct ice_dpll *d = dpll_priv;
 
+	if (state == DPLL_PIN_STATE_SELECTABLE)
+		return -EINVAL;
 	if (!enable && p->state[d->dpll_idx] == DPLL_PIN_STATE_DISCONNECTED)
 		return 0;
 
@@ -1097,6 +1105,214 @@
 }
 
 /**
+ * ice_dpll_output_esync_set - callback for setting embedded sync
+ * @pin: pointer to a pin
+ * @pin_priv: private data pointer passed on pin registration
+ * @dpll: registered dpll pointer
+ * @dpll_priv: private data pointer passed on dpll registration
+ * @freq: requested embedded sync frequency
+ * @extack: error reporting
+ *
+ * Dpll subsystem callback. Handler for setting embedded sync frequency value
+ * on output pin.
+ *
+ * Context: Acquires pf->dplls.lock
+ * Return:
+ * * 0 - success
+ * * negative - error
+ */
+static int
+ice_dpll_output_esync_set(const struct dpll_pin *pin, void *pin_priv,
+			  const struct dpll_device *dpll, void *dpll_priv,
+			  u64 freq, struct netlink_ext_ack *extack)
+{
+	struct ice_dpll_pin *p = pin_priv;
+	struct ice_dpll *d = dpll_priv;
+	struct ice_pf *pf = d->pf;
+	u8 flags = 0;
+	int ret;
+
+	if (ice_dpll_is_reset(pf, extack))
+		return -EBUSY;
+	mutex_lock(&pf->dplls.lock);
+	if (p->flags[0] & ICE_AQC_GET_CGU_OUT_CFG_OUT_EN)
+		flags = ICE_AQC_SET_CGU_OUT_CFG_OUT_EN;
+	if (freq == DPLL_PIN_FREQUENCY_1_HZ) {
+		if (p->flags[0] & ICE_AQC_GET_CGU_OUT_CFG_ESYNC_EN) {
+			ret = 0;
+		} else {
+			flags |= ICE_AQC_SET_CGU_OUT_CFG_ESYNC_EN;
+			ret = ice_aq_set_output_pin_cfg(&pf->hw, p->idx, flags,
+							0, 0, 0);
+		}
+	} else {
+		if (!(p->flags[0] & ICE_AQC_GET_CGU_OUT_CFG_ESYNC_EN)) {
+			ret = 0;
+		} else {
+			flags &= ~ICE_AQC_SET_CGU_OUT_CFG_ESYNC_EN;
+			ret = ice_aq_set_output_pin_cfg(&pf->hw, p->idx, flags,
+							0, 0, 0);
+		}
+	}
+	mutex_unlock(&pf->dplls.lock);
+
+	return ret;
+}
+
+/**
+ * ice_dpll_output_esync_get - callback for getting embedded sync config
+ * @pin: pointer to a pin
+ * @pin_priv: private data pointer passed on pin registration
+ * @dpll: registered dpll pointer
+ * @dpll_priv: private data pointer passed on dpll registration
+ * @esync: on success holds embedded sync pin properties
+ * @extack: error reporting
+ *
+ * Dpll subsystem callback. Handler for getting embedded sync frequency value
+ * and capabilities on output pin.
+ *
+ * Context: Acquires pf->dplls.lock
+ * Return:
+ * * 0 - success
+ * * negative - error
+ */
+static int
+ice_dpll_output_esync_get(const struct dpll_pin *pin, void *pin_priv,
+			  const struct dpll_device *dpll, void *dpll_priv,
+			  struct dpll_pin_esync *esync,
+			  struct netlink_ext_ack *extack)
+{
+	struct ice_dpll_pin *p = pin_priv;
+	struct ice_dpll *d = dpll_priv;
+	struct ice_pf *pf = d->pf;
+
+	if (ice_dpll_is_reset(pf, extack))
+		return -EBUSY;
+	mutex_lock(&pf->dplls.lock);
+	if (!(p->flags[0] & ICE_AQC_GET_CGU_OUT_CFG_ESYNC_ABILITY) ||
+	    p->freq != DPLL_PIN_FREQUENCY_10_MHZ) {
+		mutex_unlock(&pf->dplls.lock);
+		return -EOPNOTSUPP;
+	}
+	esync->range = ice_esync_range;
+	esync->range_num = ARRAY_SIZE(ice_esync_range);
+	if (p->flags[0] & ICE_AQC_GET_CGU_OUT_CFG_ESYNC_EN) {
+		esync->freq = DPLL_PIN_FREQUENCY_1_HZ;
+		esync->pulse = ICE_DPLL_PIN_ESYNC_PULSE_HIGH_PERCENT;
+	} else {
+		esync->freq = 0;
+		esync->pulse = 0;
+	}
+	mutex_unlock(&pf->dplls.lock);
+
+	return 0;
+}
+
+/**
+ * ice_dpll_input_esync_set - callback for setting embedded sync
+ * @pin: pointer to a pin
+ * @pin_priv: private data pointer passed on pin registration
+ * @dpll: registered dpll pointer
+ * @dpll_priv: private data pointer passed on dpll registration
+ * @freq: requested embedded sync frequency
+ * @extack: error reporting
+ *
+ * Dpll subsystem callback. Handler for setting embedded sync frequency value
+ * on input pin.
+ *
+ * Context: Acquires pf->dplls.lock
+ * Return:
+ * * 0 - success
+ * * negative - error
+ */
+static int
+ice_dpll_input_esync_set(const struct dpll_pin *pin, void *pin_priv,
+			 const struct dpll_device *dpll, void *dpll_priv,
+			 u64 freq, struct netlink_ext_ack *extack)
+{
+	struct ice_dpll_pin *p = pin_priv;
+	struct ice_dpll *d = dpll_priv;
+	struct ice_pf *pf = d->pf;
+	u8 flags_en = 0;
+	int ret;
+
+	if (ice_dpll_is_reset(pf, extack))
+		return -EBUSY;
+	mutex_lock(&pf->dplls.lock);
+	if (p->flags[0] & ICE_AQC_GET_CGU_IN_CFG_FLG2_INPUT_EN)
+		flags_en = ICE_AQC_SET_CGU_IN_CFG_FLG2_INPUT_EN;
+	if (freq == DPLL_PIN_FREQUENCY_1_HZ) {
+		if (p->flags[0] & ICE_AQC_GET_CGU_IN_CFG_FLG2_ESYNC_EN) {
+			ret = 0;
+		} else {
+			flags_en |= ICE_AQC_SET_CGU_IN_CFG_FLG2_ESYNC_EN;
+			ret = ice_aq_set_input_pin_cfg(&pf->hw, p->idx, 0,
+						       flags_en, 0, 0);
+		}
+	} else {
+		if (!(p->flags[0] & ICE_AQC_GET_CGU_IN_CFG_FLG2_ESYNC_EN)) {
+			ret = 0;
+		} else {
+			flags_en &= ~ICE_AQC_SET_CGU_IN_CFG_FLG2_ESYNC_EN;
+			ret = ice_aq_set_input_pin_cfg(&pf->hw, p->idx, 0,
+						       flags_en, 0, 0);
+		}
+	}
+	mutex_unlock(&pf->dplls.lock);
+
+	return ret;
+}
+
+/**
+ * ice_dpll_input_esync_get - callback for getting embedded sync config
+ * @pin: pointer to a pin
+ * @pin_priv: private data pointer passed on pin registration
+ * @dpll: registered dpll pointer
+ * @dpll_priv: private data pointer passed on dpll registration
+ * @esync: on success holds embedded sync pin properties
+ * @extack: error reporting
+ *
+ * Dpll subsystem callback. Handler for getting embedded sync frequency value
+ * and capabilities on input pin.
+ *
+ * Context: Acquires pf->dplls.lock
+ * Return:
+ * * 0 - success
+ * * negative - error
+ */
+static int
+ice_dpll_input_esync_get(const struct dpll_pin *pin, void *pin_priv,
+			 const struct dpll_device *dpll, void *dpll_priv,
+			 struct dpll_pin_esync *esync,
+			 struct netlink_ext_ack *extack)
+{
+	struct ice_dpll_pin *p = pin_priv;
+	struct ice_dpll *d = dpll_priv;
+	struct ice_pf *pf = d->pf;
+
+	if (ice_dpll_is_reset(pf, extack))
+		return -EBUSY;
+	mutex_lock(&pf->dplls.lock);
+	if (!(p->status & ICE_AQC_GET_CGU_IN_CFG_STATUS_ESYNC_CAP) ||
+	    p->freq != DPLL_PIN_FREQUENCY_10_MHZ) {
+		mutex_unlock(&pf->dplls.lock);
+		return -EOPNOTSUPP;
+	}
+	esync->range = ice_esync_range;
+	esync->range_num = ARRAY_SIZE(ice_esync_range);
+	if (p->flags[0] & ICE_AQC_GET_CGU_IN_CFG_FLG2_ESYNC_EN) {
+		esync->freq = DPLL_PIN_FREQUENCY_1_HZ;
+		esync->pulse = ICE_DPLL_PIN_ESYNC_PULSE_HIGH_PERCENT;
+	} else {
+		esync->freq = 0;
+		esync->pulse = 0;
+	}
+	mutex_unlock(&pf->dplls.lock);
+
+	return 0;
+}
+
+/**
  * ice_dpll_rclk_state_on_pin_set - set a state on rclk pin
  * @pin: pointer to a pin
  * @pin_priv: private data pointer passed on pin registration
@@ -1220,6 +1436,8 @@
 	.phase_adjust_get = ice_dpll_pin_phase_adjust_get,
 	.phase_adjust_set = ice_dpll_input_phase_adjust_set,
 	.phase_offset_get = ice_dpll_phase_offset_get,
+	.esync_set = ice_dpll_input_esync_set,
+	.esync_get = ice_dpll_input_esync_get,
 };
 
 static const struct dpll_pin_ops ice_dpll_output_ops = {
@@ -1230,6 +1448,8 @@
 	.direction_get = ice_dpll_output_direction,
 	.phase_adjust_get = ice_dpll_pin_phase_adjust_get,
 	.phase_adjust_set = ice_dpll_output_phase_adjust_set,
+	.esync_set = ice_dpll_output_esync_set,
+	.esync_get = ice_dpll_output_esync_get,
 };
 
 static const struct dpll_device_ops ice_dpll_ops = {
@@ -1624,6 +1844,8 @@
 	struct dpll_pin *parent;
 	int ret, i;
 
+	if (WARN_ON((!vsi || !vsi->netdev)))
+		return -EINVAL;
 	ret = ice_dpll_get_pins(pf, pin, start_idx, ICE_DPLL_RCLK_NUM_PER_PF,
 				pf->dplls.clock_id);
 	if (ret)
@@ -1639,8 +1861,6 @@
 		if (ret)
 			goto unregister_pins;
 	}
-	if (WARN_ON((!vsi || !vsi->netdev)))
-		return -EINVAL;
 	dpll_netdev_pin_set(vsi->netdev, pf->dplls.rclk.pin);
 
 	return 0;
@@ -1843,6 +2063,85 @@
 }
 
 /**
+ * ice_dpll_phase_range_set - initialize phase adjust range helper
+ * @range: pointer to phase adjust range struct to be initialized
+ * @phase_adj: a value to be used as min(-)/max(+) boundary
+ */
+static void ice_dpll_phase_range_set(struct dpll_pin_phase_adjust_range *range,
+				     u32 phase_adj)
+{
+	range->min = -phase_adj;
+	range->max = phase_adj;
+}
+
+/**
+ * ice_dpll_init_info_pins_generic - initializes generic pins info
+ * @pf: board private structure
+ * @input: if input pins initialized
+ *
+ * Init information for generic pins, cache them in PF's pins structures.
+ *
+ * Return:
+ * * 0 - success
+ * * negative - init failure reason
+ */
+static int ice_dpll_init_info_pins_generic(struct ice_pf *pf, bool input)
+{
+	struct ice_dpll *de = &pf->dplls.eec, *dp = &pf->dplls.pps;
+	static const char labels[][sizeof("99")] = {
+		"0", "1", "2", "3", "4", "5", "6", "7", "8",
+		"9", "10", "11", "12", "13", "14", "15" };
+	u32 cap = DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE;
+	enum ice_dpll_pin_type pin_type;
+	int i, pin_num, ret = -EINVAL;
+	struct ice_dpll_pin *pins;
+	u32 phase_adj_max;
+
+	if (input) {
+		pin_num = pf->dplls.num_inputs;
+		pins = pf->dplls.inputs;
+		phase_adj_max = pf->dplls.input_phase_adj_max;
+		pin_type = ICE_DPLL_PIN_TYPE_INPUT;
+		cap |= DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE;
+	} else {
+		pin_num = pf->dplls.num_outputs;
+		pins = pf->dplls.outputs;
+		phase_adj_max = pf->dplls.output_phase_adj_max;
+		pin_type = ICE_DPLL_PIN_TYPE_OUTPUT;
+	}
+	if (pin_num > ARRAY_SIZE(labels))
+		return ret;
+
+	for (i = 0; i < pin_num; i++) {
+		pins[i].idx = i;
+		pins[i].prop.board_label = labels[i];
+		ice_dpll_phase_range_set(&pins[i].prop.phase_range,
+					 phase_adj_max);
+		pins[i].prop.capabilities = cap;
+		pins[i].pf = pf;
+		ret = ice_dpll_pin_state_update(pf, &pins[i], pin_type, NULL);
+		if (ret)
+			break;
+		if (input && pins[i].freq == ICE_DPLL_PIN_GEN_RCLK_FREQ)
+			pins[i].prop.type = DPLL_PIN_TYPE_MUX;
+		else
+			pins[i].prop.type = DPLL_PIN_TYPE_EXT;
+		if (!input)
+			continue;
+		ret = ice_aq_get_cgu_ref_prio(&pf->hw, de->dpll_idx, i,
+					      &de->input_prio[i]);
+		if (ret)
+			break;
+		ret = ice_aq_get_cgu_ref_prio(&pf->hw, dp->dpll_idx, i,
+					      &dp->input_prio[i]);
+		if (ret)
+			break;
+	}
+
+	return ret;
+}
+
+/**
  * ice_dpll_init_info_direct_pins - initializes direct pins info
  * @pf: board private structure
  * @pin_type: type of pins being initialized
@@ -1863,6 +2162,7 @@
 	struct ice_hw *hw = &pf->hw;
 	struct ice_dpll_pin *pins;
 	unsigned long caps;
+	u32 phase_adj_max;
 	u8 freq_supp_num;
 	bool input;
 
@@ -1870,16 +2170,20 @@
 	case ICE_DPLL_PIN_TYPE_INPUT:
 		pins = pf->dplls.inputs;
 		num_pins = pf->dplls.num_inputs;
+		phase_adj_max = pf->dplls.input_phase_adj_max;
 		input = true;
 		break;
 	case ICE_DPLL_PIN_TYPE_OUTPUT:
 		pins = pf->dplls.outputs;
 		num_pins = pf->dplls.num_outputs;
+		phase_adj_max = pf->dplls.output_phase_adj_max;
 		input = false;
 		break;
 	default:
 		return -EINVAL;
 	}
+	if (num_pins != ice_cgu_get_num_pins(hw, input))
+		return ice_dpll_init_info_pins_generic(pf, input);
 
 	for (i = 0; i < num_pins; i++) {
 		caps = 0;
@@ -1897,19 +2201,13 @@
 				return ret;
 			caps |= (DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE |
 				 DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE);
-			pins[i].prop.phase_range.min =
-				pf->dplls.input_phase_adj_max;
-			pins[i].prop.phase_range.max =
-				-pf->dplls.input_phase_adj_max;
 		} else {
-			pins[i].prop.phase_range.min =
-				pf->dplls.output_phase_adj_max;
-			pins[i].prop.phase_range.max =
-				-pf->dplls.output_phase_adj_max;
 			ret = ice_cgu_get_output_pin_state_caps(hw, i, &caps);
 			if (ret)
 				return ret;
 		}
+		ice_dpll_phase_range_set(&pins[i].prop.phase_range,
+					 phase_adj_max);
 		pins[i].prop.capabilities = caps;
 		ret = ice_dpll_pin_state_update(pf, &pins[i], pin_type, NULL);
 		if (ret)
@@ -2017,8 +2315,10 @@
 	dp->dpll_idx = abilities.pps_dpll_idx;
 	d->num_inputs = abilities.num_inputs;
 	d->num_outputs = abilities.num_outputs;
-	d->input_phase_adj_max = le32_to_cpu(abilities.max_in_phase_adj);
-	d->output_phase_adj_max = le32_to_cpu(abilities.max_out_phase_adj);
+	d->input_phase_adj_max = le32_to_cpu(abilities.max_in_phase_adj) &
+		ICE_AQC_GET_CGU_MAX_PHASE_ADJ;
+	d->output_phase_adj_max = le32_to_cpu(abilities.max_out_phase_adj) &
+		ICE_AQC_GET_CGU_MAX_PHASE_ADJ;
 
 	alloc_size = sizeof(*d->inputs) * d->num_inputs;
 	d->inputs = kzalloc(alloc_size, GFP_KERNEL);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_dpll.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_dpll.h
@@ -31,6 +31,7 @@
 	struct dpll_pin_properties prop;
 	u32 freq;
 	s32 phase_adjust;
+	u8 status;
 };
 
 /** ice_dpll - store info required for DPLL control
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_eswitch_br.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_eswitch_br.c
@@ -582,10 +582,13 @@
 	return NOTIFY_DONE;
 }
 
-static void ice_eswitch_br_fdb_flush(struct ice_esw_br *bridge)
+void ice_eswitch_br_fdb_flush(struct ice_esw_br *bridge)
 {
 	struct ice_esw_br_fdb_entry *entry, *tmp;
 
+	if (!bridge)
+		return;
+
 	list_for_each_entry_safe(entry, tmp, &bridge->fdb_list, list)
 		ice_eswitch_br_fdb_entry_notify_and_cleanup(bridge, entry);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_eswitch_br.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_eswitch_br.h
@@ -116,5 +116,6 @@
 ice_eswitch_br_offloads_deinit(struct ice_pf *pf);
 int
 ice_eswitch_br_offloads_init(struct ice_pf *pf);
+void ice_eswitch_br_fdb_flush(struct ice_esw_br *bridge);
 
 #endif /* _ICE_ESWITCH_BR_H_ */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -3514,7 +3514,6 @@
 	struct ice_pf *pf = vsi->back;
 	int new_rx = 0, new_tx = 0;
 	bool locked = false;
-	u32 curr_combined;
 	int ret = 0;
 
 	/* do not support changing channels in Safe Mode */
@@ -3536,22 +3535,8 @@
 		return -EOPNOTSUPP;
 	}
 
-	curr_combined = ice_get_combined_cnt(vsi);
-
-	/* these checks are for cases where user didn't specify a particular
-	 * value on cmd line but we get non-zero value anyway via
-	 * get_channels(); look at ethtool.c in ethtool repository (the user
-	 * space part), particularly, do_schannels() routine
-	 */
-	if (ch->rx_count == vsi->num_rxq - curr_combined)
-		ch->rx_count = 0;
-	if (ch->tx_count == vsi->num_txq - curr_combined)
-		ch->tx_count = 0;
-	if (ch->combined_count == curr_combined)
-		ch->combined_count = 0;
-
-	if (!(ch->combined_count || (ch->rx_count && ch->tx_count))) {
-		netdev_err(dev, "Please specify at least 1 Rx and 1 Tx channel\n");
+	if (ch->rx_count && ch->tx_count) {
+		netdev_err(dev, "Dedicated RX or TX channels cannot be used simultaneously\n");
 		return -EINVAL;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
@@ -526,7 +526,7 @@
  *
  * Returns the number of available flow director filters to this VSI
  */
-static int ice_fdir_num_avail_fltr(struct ice_hw *hw, struct ice_vsi *vsi)
+int ice_fdir_num_avail_fltr(struct ice_hw *hw, struct ice_vsi *vsi)
 {
 	u16 vsi_num = ice_get_hw_vsi_num(hw, vsi->idx);
 	u16 num_guar;
@@ -1696,11 +1696,12 @@
 ice_set_fdir_input_set(struct ice_vsi *vsi, struct ethtool_rx_flow_spec *fsp,
 		       struct ice_fdir_fltr *input)
 {
-	u16 dest_vsi, q_index = 0;
+	s16 q_index = ICE_FDIR_NO_QUEUE_IDX;
 	u16 orig_q_index = 0;
 	struct ice_pf *pf;
 	struct ice_hw *hw;
 	int flow_type;
+	u16 dest_vsi;
 	u8 dest_ctl;
 
 	if (!vsi || !fsp || !input)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_fdir.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_fdir.h
@@ -50,6 +50,8 @@
  */
 #define ICE_FDIR_IPV4_PKT_FLAG_MF		0x20
 
+#define ICE_FDIR_NO_QUEUE_IDX			-1
+
 enum ice_fltr_prgm_desc_dest {
 	ICE_FLTR_PRGM_DESC_DEST_DROP_PKT,
 	ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX,
@@ -181,7 +183,7 @@
 	u16 flex_fltr;
 
 	/* filter control */
-	u16 q_index;
+	s16 q_index;
 	u16 orig_q_index;
 	u16 dest_vsi;
 	u8 dest_ctl;
@@ -202,6 +204,8 @@
 	const u8 *tun_pkt;
 };
 
+struct ice_vsi;
+
 int ice_alloc_fd_res_cntr(struct ice_hw *hw, u16 *cntr_id);
 int ice_free_fd_res_cntr(struct ice_hw *hw, u16 cntr_id);
 int ice_alloc_fd_guar_item(struct ice_hw *hw, u16 *cntr_id, u16 num_fltr);
@@ -213,6 +217,7 @@
 ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 			  u8 *pkt, bool frag, bool tun);
 int ice_get_fdir_cnt_all(struct ice_hw *hw);
+int ice_fdir_num_avail_fltr(struct ice_hw *hw, struct ice_vsi *vsi);
 bool ice_fdir_is_dup_fltr(struct ice_hw *hw, struct ice_fdir_fltr *input);
 bool ice_fdir_has_frag(enum ice_fltr_ptype flow);
 struct ice_fdir_fltr *
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_hwmon.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_hwmon.c
@@ -96,7 +96,7 @@
 
 	unsigned long sensors = pf->hw.dev_caps.supported_sensors;
 
-	return _test_bit(ICE_SENSOR_SUPPORT_E810_INT_TEMP_BIT, &sensors);
+	return test_bit(ICE_SENSOR_SUPPORT_E810_INT_TEMP_BIT, &sensors);
 };
 
 void ice_hwmon_init(struct ice_pf *pf)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_lag.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_lag.c
@@ -491,7 +491,7 @@
 ice_lag_move_vf_node_tc(struct ice_lag *lag, u8 oldport, u8 newport,
 			u16 vsi_num, u8 tc)
 {
-	DEFINE_FLEX(struct ice_aqc_move_elem, buf, teid, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_move_elem, buf, teid, 1);
 	struct device *dev = ice_pf_to_dev(lag->pf);
 	u16 numq, valq, num_moved, qbuf_size;
 	u16 buf_size = __struct_size(buf);
@@ -849,7 +849,7 @@
 ice_lag_reclaim_vf_tc(struct ice_lag *lag, struct ice_hw *src_hw, u16 vsi_num,
 		      u8 tc)
 {
-	DEFINE_FLEX(struct ice_aqc_move_elem, buf, teid, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_move_elem, buf, teid, 1);
 	struct device *dev = ice_pf_to_dev(lag->pf);
 	u16 numq, valq, num_moved, qbuf_size;
 	u16 buf_size = __struct_size(buf);
@@ -1873,7 +1873,7 @@
 ice_lag_move_vf_nodes_tc_sync(struct ice_lag *lag, struct ice_hw *dest_hw,
 			      u16 vsi_num, u8 tc)
 {
-	DEFINE_FLEX(struct ice_aqc_move_elem, buf, teid, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_move_elem, buf, teid, 1);
 	struct device *dev = ice_pf_to_dev(lag->pf);
 	u16 numq, valq, num_moved, qbuf_size;
 	u16 buf_size = __struct_size(buf);
@@ -2041,7 +2041,7 @@
 	/* associate recipes to profiles */
 	for (n = 0; n < ICE_PROFID_IPV6_GTPU_IPV6_TCP_INNER; n++) {
 		err = ice_aq_get_recipe_to_profile(&pf->hw, n,
-						   (u8 *)&recipe_bits, NULL);
+						   &recipe_bits, NULL);
 		if (err)
 			continue;
 
@@ -2049,7 +2049,7 @@
 			recipe_bits |= BIT(lag->pf_recipe) |
 				       BIT(lag->lport_recipe);
 			ice_aq_map_recipe_to_profile(&pf->hw, n,
-						     (u8 *)&recipe_bits, NULL);
+						     recipe_bits, NULL);
 		}
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_lib.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -117,14 +117,8 @@
 	if (!vsi->q_vectors)
 		goto err_vectors;
 
-	vsi->af_xdp_zc_qps = bitmap_zalloc(max_t(int, vsi->alloc_txq, vsi->alloc_rxq), GFP_KERNEL);
-	if (!vsi->af_xdp_zc_qps)
-		goto err_zc_qps;
-
 	return 0;
 
-err_zc_qps:
-	devm_kfree(dev, vsi->q_vectors);
 err_vectors:
 	devm_kfree(dev, vsi->rxq_map);
 err_rxq_map:
@@ -328,8 +322,6 @@
 
 	dev = ice_pf_to_dev(pf);
 
-	bitmap_free(vsi->af_xdp_zc_qps);
-	vsi->af_xdp_zc_qps = NULL;
 	/* free the ring and vector containers */
 	devm_kfree(dev, vsi->q_vectors);
 	vsi->q_vectors = NULL;
@@ -474,6 +466,7 @@
 
 	ice_vsi_free_stats(vsi);
 	ice_vsi_free_arrays(vsi);
+	mutex_destroy(&vsi->xdp_state_lock);
 	mutex_unlock(&pf->sw_mutex);
 	devm_kfree(dev, vsi);
 }
@@ -673,6 +666,8 @@
 	pf->next_vsi = ice_get_free_slot(pf->vsi, pf->num_alloc_vsi,
 					 pf->next_vsi);
 
+	mutex_init(&vsi->xdp_state_lock);
+
 unlock_pf:
 	mutex_unlock(&pf->sw_mutex);
 	return vsi;
@@ -1672,27 +1667,6 @@
 }
 
 /**
- * ice_vsi_cfg_frame_size - setup max frame size and Rx buffer length
- * @vsi: VSI
- */
-static void ice_vsi_cfg_frame_size(struct ice_vsi *vsi)
-{
-	if (!vsi->netdev || test_bit(ICE_FLAG_LEGACY_RX, vsi->back->flags)) {
-		vsi->max_frame = ICE_MAX_FRAME_LEGACY_RX;
-		vsi->rx_buf_len = ICE_RXBUF_1664;
-#if (PAGE_SIZE < 8192)
-	} else if (!ICE_2K_TOO_SMALL_WITH_PADDING &&
-		   (vsi->netdev->mtu <= ETH_DATA_LEN)) {
-		vsi->max_frame = ICE_RXBUF_1536 - NET_IP_ALIGN;
-		vsi->rx_buf_len = ICE_RXBUF_1536 - NET_IP_ALIGN;
-#endif
-	} else {
-		vsi->max_frame = ICE_AQ_SET_MAC_FRAME_SIZE_MAX;
-		vsi->rx_buf_len = ICE_RXBUF_3072;
-	}
-}
-
-/**
  * ice_pf_state_is_nominal - checks the PF for nominal state
  * @pf: pointer to PF to check
  *
@@ -1795,114 +1769,6 @@
 	wr32(hw, QRXFLXP_CNTXT(pf_q), regval);
 }
 
-int ice_vsi_cfg_single_rxq(struct ice_vsi *vsi, u16 q_idx)
-{
-	if (q_idx >= vsi->num_rxq)
-		return -EINVAL;
-
-	return ice_vsi_cfg_rxq(vsi->rx_rings[q_idx]);
-}
-
-int ice_vsi_cfg_single_txq(struct ice_vsi *vsi, struct ice_tx_ring **tx_rings, u16 q_idx)
-{
-	DEFINE_FLEX(struct ice_aqc_add_tx_qgrp, qg_buf, txqs, 1);
-
-	if (q_idx >= vsi->alloc_txq || !tx_rings || !tx_rings[q_idx])
-		return -EINVAL;
-
-	qg_buf->num_txqs = 1;
-
-	return ice_vsi_cfg_txq(vsi, tx_rings[q_idx], qg_buf);
-}
-
-/**
- * ice_vsi_cfg_rxqs - Configure the VSI for Rx
- * @vsi: the VSI being configured
- *
- * Return 0 on success and a negative value on error
- * Configure the Rx VSI for operation.
- */
-int ice_vsi_cfg_rxqs(struct ice_vsi *vsi)
-{
-	u16 i;
-
-	if (vsi->type == ICE_VSI_VF)
-		goto setup_rings;
-
-	ice_vsi_cfg_frame_size(vsi);
-setup_rings:
-	/* set up individual rings */
-	ice_for_each_rxq(vsi, i) {
-		int err = ice_vsi_cfg_rxq(vsi->rx_rings[i]);
-
-		if (err)
-			return err;
-	}
-
-	return 0;
-}
-
-/**
- * ice_vsi_cfg_txqs - Configure the VSI for Tx
- * @vsi: the VSI being configured
- * @rings: Tx ring array to be configured
- * @count: number of Tx ring array elements
- *
- * Return 0 on success and a negative value on error
- * Configure the Tx VSI for operation.
- */
-static int
-ice_vsi_cfg_txqs(struct ice_vsi *vsi, struct ice_tx_ring **rings, u16 count)
-{
-	DEFINE_FLEX(struct ice_aqc_add_tx_qgrp, qg_buf, txqs, 1);
-	int err = 0;
-	u16 q_idx;
-
-	qg_buf->num_txqs = 1;
-
-	for (q_idx = 0; q_idx < count; q_idx++) {
-		err = ice_vsi_cfg_txq(vsi, rings[q_idx], qg_buf);
-		if (err)
-			break;
-	}
-
-	return err;
-}
-
-/**
- * ice_vsi_cfg_lan_txqs - Configure the VSI for Tx
- * @vsi: the VSI being configured
- *
- * Return 0 on success and a negative value on error
- * Configure the Tx VSI for operation.
- */
-int ice_vsi_cfg_lan_txqs(struct ice_vsi *vsi)
-{
-	return ice_vsi_cfg_txqs(vsi, vsi->tx_rings, vsi->num_txq);
-}
-
-/**
- * ice_vsi_cfg_xdp_txqs - Configure Tx queues dedicated for XDP in given VSI
- * @vsi: the VSI being configured
- *
- * Return 0 on success and a negative value on error
- * Configure the Tx queues dedicated for XDP in given VSI for operation.
- */
-int ice_vsi_cfg_xdp_txqs(struct ice_vsi *vsi)
-{
-	int ret;
-	int i;
-
-	ret = ice_vsi_cfg_txqs(vsi, vsi->xdp_rings, vsi->num_xdp_txq);
-	if (ret)
-		return ret;
-
-	ice_for_each_rxq(vsi, i)
-		ice_tx_xsk_pool(vsi, i);
-
-	return 0;
-}
-
 /**
  * ice_intrl_usec_to_reg - convert interrupt rate limit to register value
  * @intrl: interrupt rate limit in usecs
@@ -2423,22 +2289,20 @@
 		if (ret)
 			goto unroll_vector_base;
 
-		ice_vsi_map_rings_to_vectors(vsi);
-
-		/* Associate q_vector rings to napi */
-		ice_vsi_set_napi_queues(vsi);
-
-		vsi->stat_offsets_loaded = false;
-
 		if (ice_is_xdp_ena_vsi(vsi)) {
 			ret = ice_vsi_determine_xdp_res(vsi);
 			if (ret)
 				goto unroll_vector_base;
-			ret = ice_prepare_xdp_rings(vsi, vsi->xdp_prog);
+			ret = ice_prepare_xdp_rings(vsi, vsi->xdp_prog,
+						    ICE_XDP_CFG_PART);
 			if (ret)
 				goto unroll_vector_base;
 		}
 
+		ice_vsi_map_rings_to_vectors(vsi);
+
+		vsi->stat_offsets_loaded = false;
+
 		/* ICE_VSI_CTRL does not need RSS so skip RSS processing */
 		if (vsi->type != ICE_VSI_CTRL)
 			/* Do not exit if configuring RSS had an issue, at
@@ -2568,24 +2432,17 @@
 	struct ice_pf *pf = vsi->back;
 	int err;
 
-	/* The Rx rule will only exist to remove if the LLDP FW
-	 * engine is currently stopped
-	 */
-	if (!ice_is_safe_mode(pf) && vsi->type == ICE_VSI_PF &&
-	    !test_bit(ICE_FLAG_FW_LLDP_AGENT, pf->flags))
-		ice_cfg_sw_lldp(vsi, false, false);
-
 	ice_rm_vsi_lan_cfg(vsi->port_info, vsi->idx);
 	err = ice_rm_vsi_rdma_cfg(vsi->port_info, vsi->idx);
 	if (err)
 		dev_err(ice_pf_to_dev(pf), "Failed to remove RDMA scheduler config for VSI %u, err %d\n",
 			vsi->vsi_num, err);
 
-	if (ice_is_xdp_ena_vsi(vsi))
+	if (vsi->xdp_rings)
 		/* return value check can be skipped here, it always returns
 		 * 0 if reset is in progress
 		 */
-		ice_destroy_xdp_rings(vsi);
+		ice_destroy_xdp_rings(vsi, ICE_XDP_CFG_PART);
 
 	ice_vsi_clear_rings(vsi);
 	ice_vsi_free_q_vectors(vsi);
@@ -2682,7 +2539,7 @@
 		for (q = 0; q < q_vector->num_ring_tx; q++) {
 			ice_write_itr(&q_vector->tx, 0);
 			wr32(hw, QINT_TQCTL(vsi->txq_map[txq]), 0);
-			if (ice_is_xdp_ena_vsi(vsi)) {
+			if (vsi->xdp_rings) {
 				u32 xdp_txq = txq + vsi->num_xdp_txq;
 
 				wr32(hw, QINT_TQCTL(vsi->txq_map[xdp_txq]), 0);
@@ -2782,6 +2639,7 @@
 	if (!test_and_set_bit(ICE_VSI_DOWN, vsi->state))
 		ice_down(vsi);
 
+	ice_vsi_clear_napi_queues(vsi);
 	ice_vsi_free_irq(vsi);
 	ice_vsi_free_tx_rings(vsi);
 	ice_vsi_free_rx_rings(vsi);
@@ -2825,8 +2683,7 @@
  */
 void ice_dis_vsi(struct ice_vsi *vsi, bool locked)
 {
-	if (test_bit(ICE_VSI_DOWN, vsi->state))
-		return;
+	bool already_down = test_bit(ICE_VSI_DOWN, vsi->state);
 
 	set_bit(ICE_VSI_NEEDS_RESTART, vsi->state);
 
@@ -2834,16 +2691,17 @@
 		if (netif_running(vsi->netdev)) {
 			if (!locked)
 				rtnl_lock();
-
-			ice_vsi_close(vsi);
+			already_down = test_bit(ICE_VSI_DOWN, vsi->state);
+			if (!already_down)
+				ice_vsi_close(vsi);
 
 			if (!locked)
 				rtnl_unlock();
-		} else {
+		} else if (!already_down) {
 			ice_vsi_close(vsi);
 		}
-	} else if (vsi->type == ICE_VSI_CTRL ||
-		   vsi->type == ICE_VSI_SWITCHDEV_CTRL) {
+	} else if ((vsi->type == ICE_VSI_CTRL ||
+		   vsi->type == ICE_VSI_SWITCHDEV_CTRL) && !already_down) {
 		ice_vsi_close(vsi);
 	}
 }
@@ -2904,120 +2762,55 @@
 }
 
 /**
- * __ice_queue_set_napi - Set the napi instance for the queue
- * @dev: device to which NAPI and queue belong
- * @queue_index: Index of queue
- * @type: queue type as RX or TX
- * @napi: NAPI context
- * @locked: is the rtnl_lock already held
- *
- * Set the napi instance for the queue. Caller indicates the lock status.
- */
-static void
-__ice_queue_set_napi(struct net_device *dev, unsigned int queue_index,
-		     enum netdev_queue_type type, struct napi_struct *napi,
-		     bool locked)
-{
-	if (!locked)
-		rtnl_lock();
-	netif_queue_set_napi(dev, queue_index, type, napi);
-	if (!locked)
-		rtnl_unlock();
-}
-
-/**
- * ice_queue_set_napi - Set the napi instance for the queue
- * @vsi: VSI being configured
- * @queue_index: Index of queue
- * @type: queue type as RX or TX
- * @napi: NAPI context
+ * ice_vsi_set_napi_queues - associate netdev queues with napi
+ * @vsi: VSI pointer
  *
- * Set the napi instance for the queue. The rtnl lock state is derived from the
- * execution path.
+ * Associate queue[s] with napi for all vectors.
+ * The caller must hold rtnl_lock.
  */
-void
-ice_queue_set_napi(struct ice_vsi *vsi, unsigned int queue_index,
-		   enum netdev_queue_type type, struct napi_struct *napi)
+void ice_vsi_set_napi_queues(struct ice_vsi *vsi)
 {
-	struct ice_pf *pf = vsi->back;
+	struct net_device *netdev = vsi->netdev;
+	int q_idx, v_idx;
 
-	if (!vsi->netdev)
+	if (!netdev)
 		return;
 
-	if (current_work() == &pf->serv_task ||
-	    test_bit(ICE_PREPARED_FOR_RESET, pf->state) ||
-	    test_bit(ICE_DOWN, pf->state) ||
-	    test_bit(ICE_SUSPENDED, pf->state))
-		__ice_queue_set_napi(vsi->netdev, queue_index, type, napi,
-				     false);
-	else
-		__ice_queue_set_napi(vsi->netdev, queue_index, type, napi,
-				     true);
-}
-
-/**
- * __ice_q_vector_set_napi_queues - Map queue[s] associated with the napi
- * @q_vector: q_vector pointer
- * @locked: is the rtnl_lock already held
- *
- * Associate the q_vector napi with all the queue[s] on the vector.
- * Caller indicates the lock status.
- */
-void __ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector, bool locked)
-{
-	struct ice_rx_ring *rx_ring;
-	struct ice_tx_ring *tx_ring;
+	ice_for_each_rxq(vsi, q_idx)
+		netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX,
+				     &vsi->rx_rings[q_idx]->q_vector->napi);
 
-	ice_for_each_rx_ring(rx_ring, q_vector->rx)
-		__ice_queue_set_napi(q_vector->vsi->netdev, rx_ring->q_index,
-				     NETDEV_QUEUE_TYPE_RX, &q_vector->napi,
-				     locked);
-
-	ice_for_each_tx_ring(tx_ring, q_vector->tx)
-		__ice_queue_set_napi(q_vector->vsi->netdev, tx_ring->q_index,
-				     NETDEV_QUEUE_TYPE_TX, &q_vector->napi,
-				     locked);
+	ice_for_each_txq(vsi, q_idx)
+		netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX,
+				     &vsi->tx_rings[q_idx]->q_vector->napi);
 	/* Also set the interrupt number for the NAPI */
-	netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq);
-}
+	ice_for_each_q_vector(vsi, v_idx) {
+		struct ice_q_vector *q_vector = vsi->q_vectors[v_idx];
 
-/**
- * ice_q_vector_set_napi_queues - Map queue[s] associated with the napi
- * @q_vector: q_vector pointer
- *
- * Associate the q_vector napi with all the queue[s] on the vector
- */
-void ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector)
-{
-	struct ice_rx_ring *rx_ring;
-	struct ice_tx_ring *tx_ring;
-
-	ice_for_each_rx_ring(rx_ring, q_vector->rx)
-		ice_queue_set_napi(q_vector->vsi, rx_ring->q_index,
-				   NETDEV_QUEUE_TYPE_RX, &q_vector->napi);
-
-	ice_for_each_tx_ring(tx_ring, q_vector->tx)
-		ice_queue_set_napi(q_vector->vsi, tx_ring->q_index,
-				   NETDEV_QUEUE_TYPE_TX, &q_vector->napi);
-	/* Also set the interrupt number for the NAPI */
-	netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq);
+		netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq);
+	}
 }
 
 /**
- * ice_vsi_set_napi_queues
+ * ice_vsi_clear_napi_queues - dissociate netdev queues from napi
  * @vsi: VSI pointer
  *
- * Associate queue[s] with napi for all vectors
+ * Clear the association between all VSI queues queue[s] and napi.
+ * The caller must hold rtnl_lock.
  */
-void ice_vsi_set_napi_queues(struct ice_vsi *vsi)
+void ice_vsi_clear_napi_queues(struct ice_vsi *vsi)
 {
-	int i;
+	struct net_device *netdev = vsi->netdev;
+	int q_idx;
 
-	if (!vsi->netdev)
+	if (!netdev)
 		return;
 
-	ice_for_each_q_vector(vsi, i)
-		ice_q_vector_set_napi_queues(vsi->q_vectors[i]);
+	ice_for_each_txq(vsi, q_idx)
+		netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, NULL);
+
+	ice_for_each_rxq(vsi, q_idx)
+		netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, NULL);
 }
 
 /**
@@ -3038,6 +2831,14 @@
 		ice_rss_clean(vsi);
 
 	ice_vsi_close(vsi);
+
+	/* The Rx rule will only exist to remove if the LLDP FW
+	 * engine is currently stopped
+	 */
+	if (!ice_is_safe_mode(pf) && vsi->type == ICE_VSI_PF &&
+	    !test_bit(ICE_FLAG_FW_LLDP_AGENT, pf->flags))
+		ice_cfg_sw_lldp(vsi, false, false);
+
 	ice_vsi_decfg(vsi);
 
 	/* retain SW VSI data structure since it is needed to unregister and
@@ -3238,7 +3039,7 @@
 {
 	struct ice_vsi_cfg_params params = {};
 	struct ice_coalesce_stored *coalesce;
-	int prev_num_q_vectors = 0;
+	int prev_num_q_vectors;
 	struct ice_pf *pf;
 	int ret;
 
@@ -3252,42 +3053,47 @@
 	if (WARN_ON(vsi->type == ICE_VSI_VF && !vsi->vf))
 		return -EINVAL;
 
-	coalesce = kcalloc(vsi->num_q_vectors,
-			   sizeof(struct ice_coalesce_stored), GFP_KERNEL);
-	if (!coalesce)
-		return -ENOMEM;
-
-	prev_num_q_vectors = ice_vsi_rebuild_get_coalesce(vsi, coalesce);
+	mutex_lock(&vsi->xdp_state_lock);
 
 	ret = ice_vsi_realloc_stat_arrays(vsi);
 	if (ret)
-		goto err_vsi_cfg;
+		goto unlock;
 
 	ice_vsi_decfg(vsi);
 	ret = ice_vsi_cfg_def(vsi, &params);
 	if (ret)
-		goto err_vsi_cfg;
+		goto unlock;
+
+	coalesce = kcalloc(vsi->num_q_vectors,
+			   sizeof(struct ice_coalesce_stored), GFP_KERNEL);
+	if (!coalesce) {
+		ret = -ENOMEM;
+		goto decfg;
+	}
+
+	prev_num_q_vectors = ice_vsi_rebuild_get_coalesce(vsi, coalesce);
 
 	ret = ice_vsi_cfg_tc_lan(pf, vsi);
 	if (ret) {
 		if (vsi_flags & ICE_VSI_FLAG_INIT) {
 			ret = -EIO;
-			goto err_vsi_cfg_tc_lan;
+			goto free_coalesce;
 		}
 
-		kfree(coalesce);
-		return ice_schedule_reset(pf, ICE_RESET_PFR);
+		ret = ice_schedule_reset(pf, ICE_RESET_PFR);
+		goto free_coalesce;
 	}
 
 	ice_vsi_rebuild_set_coalesce(vsi, coalesce, prev_num_q_vectors);
-	kfree(coalesce);
-
-	return 0;
+	clear_bit(ICE_VSI_REBUILD_PENDING, vsi->state);
 
-err_vsi_cfg_tc_lan:
-	ice_vsi_decfg(vsi);
-err_vsi_cfg:
+free_coalesce:
 	kfree(coalesce);
+decfg:
+	if (ret)
+		ice_vsi_decfg(vsi);
+unlock:
+	mutex_unlock(&vsi->xdp_state_lock);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_lib.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_lib.h
@@ -54,14 +54,6 @@
 
 void ice_update_eth_stats(struct ice_vsi *vsi);
 
-int ice_vsi_cfg_single_rxq(struct ice_vsi *vsi, u16 q_idx);
-
-int ice_vsi_cfg_single_txq(struct ice_vsi *vsi, struct ice_tx_ring **tx_rings, u16 q_idx);
-
-int ice_vsi_cfg_rxqs(struct ice_vsi *vsi);
-
-int ice_vsi_cfg_lan_txqs(struct ice_vsi *vsi);
-
 void ice_vsi_cfg_msix(struct ice_vsi *vsi);
 
 int ice_vsi_start_all_rx_rings(struct ice_vsi *vsi);
@@ -72,8 +64,6 @@
 ice_vsi_stop_lan_tx_rings(struct ice_vsi *vsi, enum ice_disq_rst_src rst_src,
 			  u16 rel_vmvf_num);
 
-int ice_vsi_cfg_xdp_txqs(struct ice_vsi *vsi);
-
 int ice_vsi_stop_xdp_tx_rings(struct ice_vsi *vsi);
 
 void ice_cfg_sw_lldp(struct ice_vsi *vsi, bool tx, bool create);
@@ -91,16 +81,10 @@
 struct ice_vsi *
 ice_vsi_setup(struct ice_pf *pf, struct ice_vsi_cfg_params *params);
 
-void
-ice_queue_set_napi(struct ice_vsi *vsi, unsigned int queue_index,
-		   enum netdev_queue_type type, struct napi_struct *napi);
-
-void __ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector, bool locked);
-
-void ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector);
-
 void ice_vsi_set_napi_queues(struct ice_vsi *vsi);
 
+void ice_vsi_clear_napi_queues(struct ice_vsi *vsi);
+
 int ice_vsi_release(struct ice_vsi *vsi);
 
 void ice_vsi_close(struct ice_vsi *vsi);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_main.c
@@ -85,7 +85,8 @@
 
 bool netif_is_ice(const struct net_device *dev)
 {
-	return dev && (dev->netdev_ops == &ice_netdev_ops);
+	return dev && (dev->netdev_ops == &ice_netdev_ops ||
+		       dev->netdev_ops == &ice_netdev_safe_mode_ops);
 }
 
 /**
@@ -519,25 +520,6 @@
 }
 
 /**
- * ice_clear_sw_switch_recipes - clear switch recipes
- * @pf: board private structure
- *
- * Mark switch recipes as not created in sw structures. There are cases where
- * rules (especially advanced rules) need to be restored, either re-read from
- * hardware or added again. For example after the reset. 'recp_created' flag
- * prevents from doing that and need to be cleared upfront.
- */
-static void ice_clear_sw_switch_recipes(struct ice_pf *pf)
-{
-	struct ice_sw_recipe *recp;
-	u8 i;
-
-	recp = pf->hw.switch_info->recp_list;
-	for (i = 0; i < ICE_MAX_NUM_RECIPES; i++)
-		recp[i].recp_created = false;
-}
-
-/**
  * ice_prepare_for_reset - prep for reset
  * @pf: board private structure
  * @reset_type: reset type requested
@@ -558,6 +540,8 @@
 	if (test_bit(ICE_PREPARED_FOR_RESET, pf->state))
 		return;
 
+	synchronize_irq(pf->oicr_irq.virq);
+
 	ice_unplug_aux_dev(pf);
 
 	/* Notify VFs of impending reset */
@@ -571,8 +555,9 @@
 	mutex_unlock(&pf->vfs.table_lock);
 
 	if (ice_is_eswitch_mode_switchdev(pf)) {
-		if (reset_type != ICE_RESET_PFR)
-			ice_clear_sw_switch_recipes(pf);
+		rtnl_lock();
+		ice_eswitch_br_fdb_flush(pf->eswitch.br_offloads->bridge);
+		rtnl_unlock();
 	}
 
 	/* release ADQ specific HW and SW resources */
@@ -605,11 +590,15 @@
 			memset(&vsi->mqprio_qopt, 0, sizeof(vsi->mqprio_qopt));
 		}
 	}
+
+	if (vsi->netdev)
+		netif_device_detach(vsi->netdev);
 skip:
 
 	/* clear SW filtering DB */
 	ice_clear_hw_tbls(hw);
 	/* disable the VSIs and their queues that are not already DOWN */
+	set_bit(ICE_VSI_REBUILD_PENDING, ice_get_main_vsi(pf)->state);
 	ice_pf_dis_all_vsi(pf, false);
 
 	if (test_bit(ICE_FLAG_PTP_SUPPORTED, pf->flags))
@@ -803,6 +792,9 @@
 	}
 
 	switch (vsi->port_info->phy.link_info.link_speed) {
+	case ICE_AQ_LINK_SPEED_200GB:
+		speed = "200 G";
+		break;
 	case ICE_AQ_LINK_SPEED_100GB:
 		speed = "100 G";
 		break;
@@ -2668,17 +2660,72 @@
 		bpf_prog_put(old_prog);
 }
 
+static struct ice_tx_ring *ice_xdp_ring_from_qid(struct ice_vsi *vsi, int qid)
+{
+	struct ice_q_vector *q_vector;
+	struct ice_tx_ring *ring;
+
+	if (static_key_enabled(&ice_xdp_locking_key))
+		return vsi->xdp_rings[qid % vsi->num_xdp_txq];
+
+	q_vector = vsi->rx_rings[qid]->q_vector;
+	ice_for_each_tx_ring(ring, q_vector->tx)
+		if (ice_ring_is_xdp(ring))
+			return ring;
+
+	return NULL;
+}
+
+/**
+ * ice_map_xdp_rings - Map XDP rings to interrupt vectors
+ * @vsi: the VSI with XDP rings being configured
+ *
+ * Map XDP rings to interrupt vectors and perform the configuration steps
+ * dependent on the mapping.
+ */
+void ice_map_xdp_rings(struct ice_vsi *vsi)
+{
+	int xdp_rings_rem = vsi->num_xdp_txq;
+	int v_idx, q_idx;
+
+	/* follow the logic from ice_vsi_map_rings_to_vectors */
+	ice_for_each_q_vector(vsi, v_idx) {
+		struct ice_q_vector *q_vector = vsi->q_vectors[v_idx];
+		int xdp_rings_per_v, q_id, q_base;
+
+		xdp_rings_per_v = DIV_ROUND_UP(xdp_rings_rem,
+					       vsi->num_q_vectors - v_idx);
+		q_base = vsi->num_xdp_txq - xdp_rings_rem;
+
+		for (q_id = q_base; q_id < (q_base + xdp_rings_per_v); q_id++) {
+			struct ice_tx_ring *xdp_ring = vsi->xdp_rings[q_id];
+
+			xdp_ring->q_vector = q_vector;
+			xdp_ring->next = q_vector->tx.tx_ring;
+			q_vector->tx.tx_ring = xdp_ring;
+		}
+		xdp_rings_rem -= xdp_rings_per_v;
+	}
+
+	ice_for_each_rxq(vsi, q_idx) {
+		vsi->rx_rings[q_idx]->xdp_ring = ice_xdp_ring_from_qid(vsi,
+								       q_idx);
+		ice_tx_xsk_pool(vsi, q_idx);
+	}
+}
+
 /**
  * ice_prepare_xdp_rings - Allocate, configure and setup Tx rings for XDP
  * @vsi: VSI to bring up Tx rings used by XDP
  * @prog: bpf program that will be assigned to VSI
+ * @cfg_type: create from scratch or restore the existing configuration
  *
  * Return 0 on success and negative value on error
  */
-int ice_prepare_xdp_rings(struct ice_vsi *vsi, struct bpf_prog *prog)
+int ice_prepare_xdp_rings(struct ice_vsi *vsi, struct bpf_prog *prog,
+			  enum ice_xdp_cfg cfg_type)
 {
 	u16 max_txqs[ICE_MAX_TRAFFIC_CLASS] = { 0 };
-	int xdp_rings_rem = vsi->num_xdp_txq;
 	struct ice_pf *pf = vsi->back;
 	struct ice_qs_cfg xdp_qs_cfg = {
 		.qs_mutex = &pf->avail_q_mutex,
@@ -2691,8 +2738,7 @@
 		.mapping_mode = ICE_VSI_MAP_CONTIG
 	};
 	struct device *dev;
-	int i, v_idx;
-	int status;
+	int status, i;
 
 	dev = ice_pf_to_dev(pf);
 	vsi->xdp_rings = devm_kcalloc(dev, vsi->num_xdp_txq,
@@ -2711,49 +2757,15 @@
 	if (ice_xdp_alloc_setup_rings(vsi))
 		goto clear_xdp_rings;
 
-	/* follow the logic from ice_vsi_map_rings_to_vectors */
-	ice_for_each_q_vector(vsi, v_idx) {
-		struct ice_q_vector *q_vector = vsi->q_vectors[v_idx];
-		int xdp_rings_per_v, q_id, q_base;
-
-		xdp_rings_per_v = DIV_ROUND_UP(xdp_rings_rem,
-					       vsi->num_q_vectors - v_idx);
-		q_base = vsi->num_xdp_txq - xdp_rings_rem;
-
-		for (q_id = q_base; q_id < (q_base + xdp_rings_per_v); q_id++) {
-			struct ice_tx_ring *xdp_ring = vsi->xdp_rings[q_id];
-
-			xdp_ring->q_vector = q_vector;
-			xdp_ring->next = q_vector->tx.tx_ring;
-			q_vector->tx.tx_ring = xdp_ring;
-		}
-		xdp_rings_rem -= xdp_rings_per_v;
-	}
-
-	ice_for_each_rxq(vsi, i) {
-		if (static_key_enabled(&ice_xdp_locking_key)) {
-			vsi->rx_rings[i]->xdp_ring = vsi->xdp_rings[i % vsi->num_xdp_txq];
-		} else {
-			struct ice_q_vector *q_vector = vsi->rx_rings[i]->q_vector;
-			struct ice_tx_ring *ring;
-
-			ice_for_each_tx_ring(ring, q_vector->tx) {
-				if (ice_ring_is_xdp(ring)) {
-					vsi->rx_rings[i]->xdp_ring = ring;
-					break;
-				}
-			}
-		}
-		ice_tx_xsk_pool(vsi, i);
-	}
-
 	/* omit the scheduler update if in reset path; XDP queues will be
 	 * taken into account at the end of ice_vsi_rebuild, where
 	 * ice_cfg_vsi_lan is being called
 	 */
-	if (ice_is_reset_in_progress(pf->state))
+	if (cfg_type == ICE_XDP_CFG_PART)
 		return 0;
 
+	ice_map_xdp_rings(vsi);
+
 	/* tell the Tx scheduler that right now we have
 	 * additional queues
 	 */
@@ -2803,22 +2815,21 @@
 /**
  * ice_destroy_xdp_rings - undo the configuration made by ice_prepare_xdp_rings
  * @vsi: VSI to remove XDP rings
+ * @cfg_type: disable XDP permanently or allow it to be restored later
  *
  * Detach XDP rings from irq vectors, clean up the PF bitmap and free
  * resources
  */
-int ice_destroy_xdp_rings(struct ice_vsi *vsi)
+int ice_destroy_xdp_rings(struct ice_vsi *vsi, enum ice_xdp_cfg cfg_type)
 {
 	u16 max_txqs[ICE_MAX_TRAFFIC_CLASS] = { 0 };
 	struct ice_pf *pf = vsi->back;
 	int i, v_idx;
 
 	/* q_vectors are freed in reset path so there's no point in detaching
-	 * rings; in case of rebuild being triggered not from reset bits
-	 * in pf->state won't be set, so additionally check first q_vector
-	 * against NULL
+	 * rings
 	 */
-	if (ice_is_reset_in_progress(pf->state) || !vsi->q_vectors[0])
+	if (cfg_type == ICE_XDP_CFG_PART)
 		goto free_qmap;
 
 	ice_for_each_q_vector(vsi, v_idx) {
@@ -2859,7 +2870,7 @@
 	if (static_key_enabled(&ice_xdp_locking_key))
 		static_branch_dec(&ice_xdp_locking_key);
 
-	if (ice_is_reset_in_progress(pf->state) || !vsi->q_vectors[0])
+	if (cfg_type == ICE_XDP_CFG_PART)
 		return 0;
 
 	ice_vsi_assign_bpf_prog(vsi, NULL);
@@ -2888,7 +2899,7 @@
 	ice_for_each_rxq(vsi, i) {
 		struct ice_rx_ring *rx_ring = vsi->rx_rings[i];
 
-		if (rx_ring->xsk_pool)
+		if (READ_ONCE(rx_ring->xsk_pool))
 			napi_schedule(&rx_ring->q_vector->napi);
 	}
 }
@@ -2939,8 +2950,8 @@
 		   struct netlink_ext_ack *extack)
 {
 	unsigned int frame_size = vsi->netdev->mtu + ICE_ETH_PKT_HDR_PAD;
-	bool if_running = netif_running(vsi->netdev);
 	int ret = 0, xdp_ring_err = 0;
+	bool if_running;
 
 	if (prog && !prog->aux->xdp_has_frags) {
 		if (frame_size > ice_max_xdp_frame_size(vsi)) {
@@ -2951,13 +2962,17 @@
 	}
 
 	/* hot swap progs and avoid toggling link */
-	if (ice_is_xdp_ena_vsi(vsi) == !!prog) {
+	if (ice_is_xdp_ena_vsi(vsi) == !!prog ||
+	    test_bit(ICE_VSI_REBUILD_PENDING, vsi->state)) {
 		ice_vsi_assign_bpf_prog(vsi, prog);
 		return 0;
 	}
 
+	if_running = netif_running(vsi->netdev) &&
+		     !test_and_set_bit(ICE_VSI_DOWN, vsi->state);
+
 	/* need to stop netdev while setting up the program for Rx rings */
-	if (if_running && !test_and_set_bit(ICE_VSI_DOWN, vsi->state)) {
+	if (if_running) {
 		ret = ice_down(vsi);
 		if (ret) {
 			NL_SET_ERR_MSG_MOD(extack, "Preparing device for XDP attach failed");
@@ -2970,7 +2985,8 @@
 		if (xdp_ring_err) {
 			NL_SET_ERR_MSG_MOD(extack, "Not enough Tx resources for XDP");
 		} else {
-			xdp_ring_err = ice_prepare_xdp_rings(vsi, prog);
+			xdp_ring_err = ice_prepare_xdp_rings(vsi, prog,
+							     ICE_XDP_CFG_FULL);
 			if (xdp_ring_err)
 				NL_SET_ERR_MSG_MOD(extack, "Setting up XDP Tx resources failed");
 		}
@@ -2981,7 +2997,7 @@
 			NL_SET_ERR_MSG_MOD(extack, "Setting up XDP Rx resources failed");
 	} else if (ice_is_xdp_ena_vsi(vsi) && !prog) {
 		xdp_features_clear_redirect_target(vsi->netdev);
-		xdp_ring_err = ice_destroy_xdp_rings(vsi);
+		xdp_ring_err = ice_destroy_xdp_rings(vsi, ICE_XDP_CFG_FULL);
 		if (xdp_ring_err)
 			NL_SET_ERR_MSG_MOD(extack, "Freeing XDP Tx resources failed");
 		/* reallocate Rx queues that were used for zero-copy */
@@ -3022,21 +3038,28 @@
 {
 	struct ice_netdev_priv *np = netdev_priv(dev);
 	struct ice_vsi *vsi = np->vsi;
+	int ret;
 
 	if (vsi->type != ICE_VSI_PF) {
 		NL_SET_ERR_MSG_MOD(xdp->extack, "XDP can be loaded only on PF VSI");
 		return -EINVAL;
 	}
 
+	mutex_lock(&vsi->xdp_state_lock);
+
 	switch (xdp->command) {
 	case XDP_SETUP_PROG:
-		return ice_xdp_setup_prog(vsi, xdp->prog, xdp->extack);
+		ret = ice_xdp_setup_prog(vsi, xdp->prog, xdp->extack);
+		break;
 	case XDP_SETUP_XSK_POOL:
-		return ice_xsk_pool_setup(vsi, xdp->xsk.pool,
-					  xdp->xsk.queue_id);
+		ret = ice_xsk_pool_setup(vsi, xdp->xsk.pool, xdp->xsk.queue_id);
+		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
 	}
+
+	mutex_unlock(&vsi->xdp_state_lock);
+	return ret;
 }
 
 /**
@@ -3492,11 +3515,9 @@
 	if (!vsi->netdev)
 		return;
 
-	ice_for_each_q_vector(vsi, v_idx) {
+	ice_for_each_q_vector(vsi, v_idx)
 		netif_napi_add(vsi->netdev, &vsi->q_vectors[v_idx]->napi,
 			       ice_napi_poll);
-		__ice_q_vector_set_napi_queues(vsi->q_vectors[v_idx], false);
-	}
 }
 
 /**
@@ -4077,7 +4098,7 @@
 int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked)
 {
 	struct ice_pf *pf = vsi->back;
-	int err = 0, timeout = 50;
+	int i, err = 0, timeout = 50;
 
 	if (!new_rx && !new_tx)
 		return -EINVAL;
@@ -4096,15 +4117,32 @@
 
 	/* set for the next time the netdev is started */
 	if (!netif_running(vsi->netdev)) {
-		ice_vsi_rebuild(vsi, ICE_VSI_FLAG_NO_INIT);
+		err = ice_vsi_rebuild(vsi, ICE_VSI_FLAG_NO_INIT);
+		if (err)
+			goto rebuild_err;
 		dev_dbg(ice_pf_to_dev(pf), "Link is down, queue count change happens when link is brought up\n");
 		goto done;
 	}
 
 	ice_vsi_close(vsi);
-	ice_vsi_rebuild(vsi, ICE_VSI_FLAG_NO_INIT);
+	err = ice_vsi_rebuild(vsi, ICE_VSI_FLAG_NO_INIT);
+	if (err)
+		goto rebuild_err;
+
+	ice_for_each_traffic_class(i) {
+		if (vsi->tc_cfg.ena_tc & BIT(i))
+			netdev_set_tc_queue(vsi->netdev,
+					    vsi->tc_cfg.tc_info[i].netdev_tc,
+					    vsi->tc_cfg.tc_info[i].qcount_tx,
+					    vsi->tc_cfg.tc_info[i].qoffset);
+	}
 	ice_pf_dcb_recfg(pf, locked);
 	ice_vsi_open(vsi);
+	goto done;
+
+rebuild_err:
+	dev_err(ice_pf_to_dev(pf), "Error during VSI rebuild: %d. Unload and reload the driver.\n",
+		err);
 done:
 	clear_bit(ICE_CFG_BUSY, pf->state);
 	return err;
@@ -4572,90 +4610,6 @@
 	vsi->netdev = NULL;
 }
 
-static int ice_start_eth(struct ice_vsi *vsi)
-{
-	int err;
-
-	err = ice_init_mac_fltr(vsi->back);
-	if (err)
-		return err;
-
-	err = ice_vsi_open(vsi);
-	if (err)
-		ice_fltr_remove_all(vsi);
-
-	return err;
-}
-
-static void ice_stop_eth(struct ice_vsi *vsi)
-{
-	ice_fltr_remove_all(vsi);
-	ice_vsi_close(vsi);
-}
-
-static int ice_init_eth(struct ice_pf *pf)
-{
-	struct ice_vsi *vsi = ice_get_main_vsi(pf);
-	int err;
-
-	if (!vsi)
-		return -EINVAL;
-
-	/* init channel list */
-	INIT_LIST_HEAD(&vsi->ch_list);
-
-	err = ice_cfg_netdev(vsi);
-	if (err)
-		return err;
-	/* Setup DCB netlink interface */
-	ice_dcbnl_setup(vsi);
-
-	err = ice_init_mac_fltr(pf);
-	if (err)
-		goto err_init_mac_fltr;
-
-	err = ice_devlink_create_pf_port(pf);
-	if (err)
-		goto err_devlink_create_pf_port;
-
-	SET_NETDEV_DEVLINK_PORT(vsi->netdev, &pf->devlink_port);
-
-	err = ice_register_netdev(vsi);
-	if (err)
-		goto err_register_netdev;
-
-	err = ice_tc_indir_block_register(vsi);
-	if (err)
-		goto err_tc_indir_block_register;
-
-	ice_napi_add(vsi);
-
-	return 0;
-
-err_tc_indir_block_register:
-	ice_unregister_netdev(vsi);
-err_register_netdev:
-	ice_devlink_destroy_pf_port(pf);
-err_devlink_create_pf_port:
-err_init_mac_fltr:
-	ice_decfg_netdev(vsi);
-	return err;
-}
-
-static void ice_deinit_eth(struct ice_pf *pf)
-{
-	struct ice_vsi *vsi = ice_get_main_vsi(pf);
-
-	if (!vsi)
-		return;
-
-	ice_vsi_close(vsi);
-	ice_unregister_netdev(vsi);
-	ice_devlink_destroy_pf_port(pf);
-	ice_tc_indir_block_unregister(vsi);
-	ice_decfg_netdev(vsi);
-}
-
 /**
  * ice_wait_for_fw - wait for full FW readiness
  * @hw: pointer to the hardware structure
@@ -4681,7 +4635,7 @@
 	return -ETIMEDOUT;
 }
 
-static int ice_init_dev(struct ice_pf *pf)
+int ice_init_dev(struct ice_pf *pf)
 {
 	struct device *dev = ice_pf_to_dev(pf);
 	struct ice_hw *hw = &pf->hw;
@@ -4774,7 +4728,7 @@
 	return err;
 }
 
-static void ice_deinit_dev(struct ice_pf *pf)
+void ice_deinit_dev(struct ice_pf *pf)
 {
 	ice_free_irq_msix_misc(pf);
 	ice_deinit_pf(pf);
@@ -5079,31 +5033,47 @@
 /**
  * ice_load - load pf by init hw and starting VSI
  * @pf: pointer to the pf instance
+ *
+ * This function has to be called under devl_lock.
  */
 int ice_load(struct ice_pf *pf)
 {
-	struct ice_vsi_cfg_params params = {};
 	struct ice_vsi *vsi;
 	int err;
 
-	err = ice_init_dev(pf);
+	devl_assert_locked(priv_to_devlink(pf));
+
+	vsi = ice_get_main_vsi(pf);
+
+	/* init channel list */
+	INIT_LIST_HEAD(&vsi->ch_list);
+
+	err = ice_cfg_netdev(vsi);
 	if (err)
 		return err;
 
-	vsi = ice_get_main_vsi(pf);
+	/* Setup DCB netlink interface */
+	ice_dcbnl_setup(vsi);
 
-	params = ice_vsi_to_params(vsi);
-	params.flags = ICE_VSI_FLAG_INIT;
+	err = ice_init_mac_fltr(pf);
+	if (err)
+		goto err_init_mac_fltr;
 
-	rtnl_lock();
-	err = ice_vsi_cfg(vsi, &params);
+	err = ice_devlink_create_pf_port(pf);
 	if (err)
-		goto err_vsi_cfg;
+		goto err_devlink_create_pf_port;
+
+	SET_NETDEV_DEVLINK_PORT(vsi->netdev, &pf->devlink_port);
 
-	err = ice_start_eth(ice_get_main_vsi(pf));
+	err = ice_register_netdev(vsi);
 	if (err)
-		goto err_start_eth;
-	rtnl_unlock();
+		goto err_register_netdev;
+
+	err = ice_tc_indir_block_register(vsi);
+	if (err)
+		goto err_tc_indir_block_register;
+
+	ice_napi_add(vsi);
 
 	err = ice_init_rdma(pf);
 	if (err)
@@ -5117,29 +5087,35 @@
 	return 0;
 
 err_init_rdma:
-	ice_vsi_close(ice_get_main_vsi(pf));
-	rtnl_lock();
-err_start_eth:
-	ice_vsi_decfg(ice_get_main_vsi(pf));
-err_vsi_cfg:
-	rtnl_unlock();
-	ice_deinit_dev(pf);
+	ice_tc_indir_block_unregister(vsi);
+err_tc_indir_block_register:
+	ice_unregister_netdev(vsi);
+err_register_netdev:
+	ice_devlink_destroy_pf_port(pf);
+err_devlink_create_pf_port:
+err_init_mac_fltr:
+	ice_decfg_netdev(vsi);
 	return err;
 }
 
 /**
  * ice_unload - unload pf by stopping VSI and deinit hw
  * @pf: pointer to the pf instance
+ *
+ * This function has to be called under devl_lock.
  */
 void ice_unload(struct ice_pf *pf)
 {
+	struct ice_vsi *vsi = ice_get_main_vsi(pf);
+
+	devl_assert_locked(priv_to_devlink(pf));
+
 	ice_deinit_features(pf);
 	ice_deinit_rdma(pf);
-	rtnl_lock();
-	ice_stop_eth(ice_get_main_vsi(pf));
-	ice_vsi_decfg(ice_get_main_vsi(pf));
-	rtnl_unlock();
-	ice_deinit_dev(pf);
+	ice_tc_indir_block_unregister(vsi);
+	ice_unregister_netdev(vsi);
+	ice_devlink_destroy_pf_port(pf);
+	ice_decfg_netdev(vsi);
 }
 
 /**
@@ -5237,27 +5213,23 @@
 	if (err)
 		goto err_init;
 
-	err = ice_init_eth(pf);
-	if (err)
-		goto err_init_eth;
-
-	err = ice_init_rdma(pf);
+	devl_lock(priv_to_devlink(pf));
+	err = ice_load(pf);
+	devl_unlock(priv_to_devlink(pf));
 	if (err)
-		goto err_init_rdma;
+		goto err_load;
 
 	err = ice_init_devlink(pf);
 	if (err)
 		goto err_init_devlink;
 
-	ice_init_features(pf);
-
 	return 0;
 
 err_init_devlink:
-	ice_deinit_rdma(pf);
-err_init_rdma:
-	ice_deinit_eth(pf);
-err_init_eth:
+	devl_lock(priv_to_devlink(pf));
+	ice_unload(pf);
+	devl_unlock(priv_to_devlink(pf));
+err_load:
 	ice_deinit(pf);
 err_init:
 	pci_disable_device(pdev);
@@ -5355,12 +5327,14 @@
 
 	if (!ice_is_safe_mode(pf))
 		ice_remove_arfs(pf);
-	ice_deinit_features(pf);
+
 	ice_deinit_devlink(pf);
-	ice_deinit_rdma(pf);
-	ice_deinit_eth(pf);
-	ice_deinit(pf);
 
+	devl_lock(priv_to_devlink(pf));
+	ice_unload(pf);
+	devl_unlock(priv_to_devlink(pf));
+
+	ice_deinit(pf);
 	ice_vsi_release_all(pf);
 
 	ice_setup_mc_magic_wake(pf);
@@ -5447,7 +5421,9 @@
 		if (ret)
 			goto err_reinit;
 		ice_vsi_map_rings_to_vectors(pf->vsi[v]);
+		rtnl_lock();
 		ice_vsi_set_napi_queues(pf->vsi[v]);
+		rtnl_unlock();
 	}
 
 	ret = ice_req_irq_msix_misc(pf);
@@ -5461,8 +5437,12 @@
 
 err_reinit:
 	while (v--)
-		if (pf->vsi[v])
+		if (pf->vsi[v]) {
+			rtnl_lock();
+			ice_vsi_clear_napi_queues(pf->vsi[v]);
+			rtnl_unlock();
 			ice_vsi_free_q_vectors(pf->vsi[v]);
+		}
 
 	return ret;
 }
@@ -5495,7 +5475,7 @@
 	 */
 	disabled = ice_service_task_stop(pf);
 
-	ice_unplug_aux_dev(pf);
+	ice_deinit_rdma(pf);
 
 	/* Already suspended?, then there is nothing to do */
 	if (test_and_set_bit(ICE_SUSPENDED, pf->state)) {
@@ -5527,6 +5507,9 @@
 	ice_for_each_vsi(pf, v) {
 		if (!pf->vsi[v])
 			continue;
+		rtnl_lock();
+		ice_vsi_clear_napi_queues(pf->vsi[v]);
+		rtnl_unlock();
 		ice_vsi_free_q_vectors(pf->vsi[v]);
 	}
 	ice_clear_interrupt_scheme(pf);
@@ -5575,6 +5558,11 @@
 	if (ret)
 		dev_err(dev, "Cannot restore interrupt scheme: %d\n", ret);
 
+	ret = ice_init_rdma(pf);
+	if (ret)
+		dev_err(dev, "Reinitialize RDMA during resume failed: %d\n",
+			ret);
+
 	clear_bit(ICE_DOWN, pf->state);
 	/* Now perform PF reset and rebuild */
 	reset_type = ICE_RESET_PFR;
@@ -6737,6 +6725,7 @@
 {
 	struct rtnl_link_stats64 *net_stats, *stats_prev;
 	struct rtnl_link_stats64 *vsi_stats;
+	struct ice_pf *pf = vsi->back;
 	u64 pkts, bytes;
 	int i;
 
@@ -6782,21 +6771,18 @@
 	net_stats = &vsi->net_stats;
 	stats_prev = &vsi->net_stats_prev;
 
-	/* clear prev counters after reset */
-	if (vsi_stats->tx_packets < stats_prev->tx_packets ||
-	    vsi_stats->rx_packets < stats_prev->rx_packets) {
-		stats_prev->tx_packets = 0;
-		stats_prev->tx_bytes = 0;
-		stats_prev->rx_packets = 0;
-		stats_prev->rx_bytes = 0;
+	/* Update netdev counters, but keep in mind that values could start at
+	 * random value after PF reset. And as we increase the reported stat by
+	 * diff of Prev-Cur, we need to be sure that Prev is valid. If it's not,
+	 * let's skip this round.
+	 */
+	if (likely(pf->stat_prev_loaded)) {
+		net_stats->tx_packets += vsi_stats->tx_packets - stats_prev->tx_packets;
+		net_stats->tx_bytes += vsi_stats->tx_bytes - stats_prev->tx_bytes;
+		net_stats->rx_packets += vsi_stats->rx_packets - stats_prev->rx_packets;
+		net_stats->rx_bytes += vsi_stats->rx_bytes - stats_prev->rx_bytes;
 	}
 
-	/* update netdev counters */
-	net_stats->tx_packets += vsi_stats->tx_packets - stats_prev->tx_packets;
-	net_stats->tx_bytes += vsi_stats->tx_bytes - stats_prev->tx_bytes;
-	net_stats->rx_packets += vsi_stats->rx_packets - stats_prev->rx_packets;
-	net_stats->rx_bytes += vsi_stats->rx_bytes - stats_prev->rx_bytes;
-
 	stats_prev->tx_packets = vsi_stats->tx_packets;
 	stats_prev->tx_bytes = vsi_stats->tx_bytes;
 	stats_prev->rx_packets = vsi_stats->rx_packets;
@@ -7087,7 +7073,7 @@
 	if (tx_err)
 		netdev_err(vsi->netdev, "Failed stop Tx rings, VSI %d error %d\n",
 			   vsi->vsi_num, tx_err);
-	if (!tx_err && ice_is_xdp_ena_vsi(vsi)) {
+	if (!tx_err && vsi->xdp_rings) {
 		tx_err = ice_vsi_stop_xdp_tx_rings(vsi);
 		if (tx_err)
 			netdev_err(vsi->netdev, "Failed stop XDP rings, VSI %d error %d\n",
@@ -7104,7 +7090,7 @@
 	ice_for_each_txq(vsi, i)
 		ice_clean_tx_ring(vsi->tx_rings[i]);
 
-	if (ice_is_xdp_ena_vsi(vsi))
+	if (vsi->xdp_rings)
 		ice_for_each_xdp_txq(vsi, i)
 			ice_clean_tx_ring(vsi->xdp_rings[i]);
 
@@ -7309,6 +7295,8 @@
 		err = netif_set_real_num_rx_queues(vsi->netdev, vsi->num_rxq);
 		if (err)
 			goto err_set_qs;
+
+		ice_vsi_set_napi_queues(vsi);
 	}
 
 	err = ice_up_complete(vsi);
@@ -7446,6 +7434,7 @@
  */
 static void ice_rebuild(struct ice_pf *pf, enum ice_reset_req reset_type)
 {
+	struct ice_vsi *vsi = ice_get_main_vsi(pf);
 	struct device *dev = ice_pf_to_dev(pf);
 	struct ice_hw *hw = &pf->hw;
 	bool dvm;
@@ -7594,6 +7583,9 @@
 		ice_rebuild_arfs(pf);
 	}
 
+	if (vsi && vsi->netdev)
+		netif_device_attach(vsi->netdev);
+
 	ice_update_pf_netdev_link(pf);
 
 	/* tell the firmware we are up */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_nvm.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_nvm.c
@@ -375,11 +375,25 @@
  *
  * Read the specified word from the copy of the Shadow RAM found in the
  * specified NVM module.
+ *
+ * Note that the Shadow RAM copy is always located after the CSS header, and
+ * is aligned to 64-byte (32-word) offsets.
  */
 static int
 ice_read_nvm_sr_copy(struct ice_hw *hw, enum ice_bank_select bank, u32 offset, u16 *data)
 {
-	return ice_read_nvm_module(hw, bank, ICE_NVM_SR_COPY_WORD_OFFSET + offset, data);
+	u32 sr_copy;
+
+	switch (bank) {
+	case ICE_ACTIVE_FLASH_BANK:
+		sr_copy = roundup(hw->flash.banks.active_css_hdr_len, 32);
+		break;
+	case ICE_INACTIVE_FLASH_BANK:
+		sr_copy = roundup(hw->flash.banks.inactive_css_hdr_len, 32);
+		break;
+	}
+
+	return ice_read_nvm_module(hw, bank, sr_copy + offset, data);
 }
 
 /**
@@ -441,8 +455,7 @@
 ice_get_pfa_module_tlv(struct ice_hw *hw, u16 *module_tlv, u16 *module_tlv_len,
 		       u16 module_type)
 {
-	u16 pfa_len, pfa_ptr;
-	u16 next_tlv;
+	u16 pfa_len, pfa_ptr, next_tlv, max_tlv;
 	int status;
 
 	status = ice_read_sr_word(hw, ICE_SR_PFA_PTR, &pfa_ptr);
@@ -455,11 +468,23 @@
 		ice_debug(hw, ICE_DBG_INIT, "Failed to read PFA length.\n");
 		return status;
 	}
+
+	/* The Preserved Fields Area contains a sequence of Type-Length-Value
+	 * structures which define its contents. The PFA length includes all
+	 * of the TLVs, plus the initial length word itself, *and* one final
+	 * word at the end after all of the TLVs.
+	 */
+	if (check_add_overflow(pfa_ptr, pfa_len - 1, &max_tlv)) {
+		dev_warn(ice_hw_to_dev(hw), "PFA starts at offset %u. PFA length of %u caused 16-bit arithmetic overflow.\n",
+			 pfa_ptr, pfa_len);
+		return -EINVAL;
+	}
+
 	/* Starting with first TLV after PFA length, iterate through the list
 	 * of TLVs to find the requested one.
 	 */
 	next_tlv = pfa_ptr + 1;
-	while (next_tlv < pfa_ptr + pfa_len) {
+	while (next_tlv < max_tlv) {
 		u16 tlv_sub_module_type;
 		u16 tlv_len;
 
@@ -483,10 +508,13 @@
 			}
 			return -EINVAL;
 		}
-		/* Check next TLV, i.e. current TLV pointer + length + 2 words
-		 * (for current TLV's type and length)
-		 */
-		next_tlv = next_tlv + tlv_len + 2;
+
+		if (check_add_overflow(next_tlv, 2, &next_tlv) ||
+		    check_add_overflow(next_tlv, tlv_len, &next_tlv)) {
+			dev_warn(ice_hw_to_dev(hw), "TLV of type %u and length 0x%04x caused 16-bit arithmetic overflow. The PFA starts at 0x%04x and has length of 0x%04x\n",
+				 tlv_sub_module_type, tlv_len, pfa_ptr, pfa_len);
+			return -EINVAL;
+		}
 	}
 	/* Module does not exist */
 	return -ENOENT;
@@ -1011,6 +1039,72 @@
 }
 
 /**
+ * ice_get_nvm_css_hdr_len - Read the CSS header length from the NVM CSS header
+ * @hw: pointer to the HW struct
+ * @bank: whether to read from the active or inactive flash bank
+ * @hdr_len: storage for header length in words
+ *
+ * Read the CSS header length from the NVM CSS header and add the Authentication
+ * header size, and then convert to words.
+ *
+ * Return: zero on success, or a negative error code on failure.
+ */
+static int
+ice_get_nvm_css_hdr_len(struct ice_hw *hw, enum ice_bank_select bank,
+			u32 *hdr_len)
+{
+	u16 hdr_len_l, hdr_len_h;
+	u32 hdr_len_dword;
+	int status;
+
+	status = ice_read_nvm_module(hw, bank, ICE_NVM_CSS_HDR_LEN_L,
+				     &hdr_len_l);
+	if (status)
+		return status;
+
+	status = ice_read_nvm_module(hw, bank, ICE_NVM_CSS_HDR_LEN_H,
+				     &hdr_len_h);
+	if (status)
+		return status;
+
+	/* CSS header length is in DWORD, so convert to words and add
+	 * authentication header size
+	 */
+	hdr_len_dword = hdr_len_h << 16 | hdr_len_l;
+	*hdr_len = (hdr_len_dword * 2) + ICE_NVM_AUTH_HEADER_LEN;
+
+	return 0;
+}
+
+/**
+ * ice_determine_css_hdr_len - Discover CSS header length for the device
+ * @hw: pointer to the HW struct
+ *
+ * Determine the size of the CSS header at the start of the NVM module. This
+ * is useful for locating the Shadow RAM copy in the NVM, as the Shadow RAM is
+ * always located just after the CSS header.
+ *
+ * Return: zero on success, or a negative error code on failure.
+ */
+static int ice_determine_css_hdr_len(struct ice_hw *hw)
+{
+	struct ice_bank_info *banks = &hw->flash.banks;
+	int status;
+
+	status = ice_get_nvm_css_hdr_len(hw, ICE_ACTIVE_FLASH_BANK,
+					 &banks->active_css_hdr_len);
+	if (status)
+		return status;
+
+	status = ice_get_nvm_css_hdr_len(hw, ICE_INACTIVE_FLASH_BANK,
+					 &banks->inactive_css_hdr_len);
+	if (status)
+		return status;
+
+	return 0;
+}
+
+/**
  * ice_init_nvm - initializes NVM setting
  * @hw: pointer to the HW struct
  *
@@ -1056,6 +1150,12 @@
 		return status;
 	}
 
+	status = ice_determine_css_hdr_len(hw);
+	if (status) {
+		ice_debug(hw, ICE_DBG_NVM, "Failed to determine Shadow RAM copy offsets.\n");
+		return status;
+	}
+
 	status = ice_get_nvm_ver_info(hw, ICE_ACTIVE_FLASH_BANK, &flash->nvm);
 	if (status) {
 		ice_debug(hw, ICE_DBG_INIT, "Failed to read NVM info.\n");
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_ptp_consts.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_ptp_consts.h
@@ -359,9 +359,9 @@
 		/* rx_desk_rsgb_par */
 		644531250, /* 644.53125 MHz Reed Solomon gearbox */
 		/* tx_desk_rsgb_pcs */
-		644531250, /* 644.53125 MHz Reed Solomon gearbox */
+		390625000, /* 390.625 MHz Reed Solomon gearbox */
 		/* rx_desk_rsgb_pcs */
-		644531250, /* 644.53125 MHz Reed Solomon gearbox */
+		390625000, /* 390.625 MHz Reed Solomon gearbox */
 		/* tx_fixed_delay */
 		1620,
 		/* pmd_adj_divisor */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
@@ -33,7 +33,6 @@
 		ARRAY_SIZE(ice_cgu_pin_freq_common), ice_cgu_pin_freq_common },
 	{ "GNSS-1PPS",	  ZL_REF4P, DPLL_PIN_TYPE_GNSS,
 		ARRAY_SIZE(ice_cgu_pin_freq_1_hz), ice_cgu_pin_freq_1_hz },
-	{ "OCXO",	  ZL_REF4N, DPLL_PIN_TYPE_INT_OSCILLATOR, 0, },
 };
 
 static const struct ice_cgu_pin_desc ice_e810t_qsfp_cgu_inputs[] = {
@@ -51,7 +50,6 @@
 		ARRAY_SIZE(ice_cgu_pin_freq_common), ice_cgu_pin_freq_common },
 	{ "GNSS-1PPS",	  ZL_REF4P, DPLL_PIN_TYPE_GNSS,
 		ARRAY_SIZE(ice_cgu_pin_freq_1_hz), ice_cgu_pin_freq_1_hz },
-	{ "OCXO",	  ZL_REF4N, DPLL_PIN_TYPE_INT_OSCILLATOR, },
 };
 
 static const struct ice_cgu_pin_desc ice_e810t_sfp_cgu_outputs[] = {
@@ -3760,6 +3758,25 @@
 }
 
 /**
+ * ice_cgu_get_num_pins - get pin description array size
+ * @hw: pointer to the hw struct
+ * @input: if request is done against input or output pins
+ *
+ * Return: size of pin description array for given hw.
+ */
+int ice_cgu_get_num_pins(struct ice_hw *hw, bool input)
+{
+	const struct ice_cgu_pin_desc *t;
+	int size;
+
+	t = ice_cgu_get_pin_desc(hw, input, &size);
+	if (t)
+		return size;
+
+	return 0;
+}
+
+/**
  * ice_cgu_get_pin_type - get pin's type
  * @hw: pointer to the hw struct
  * @pin: pin index
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_ptp_hw.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_ptp_hw.h
@@ -271,6 +271,7 @@
 int ice_write_sma_ctrl_e810t(struct ice_hw *hw, u8 data);
 int ice_read_pca9575_reg_e810t(struct ice_hw *hw, u8 offset, u8 *data);
 bool ice_is_pca9575_present(struct ice_hw *hw);
+int ice_cgu_get_num_pins(struct ice_hw *hw, bool input);
 enum dpll_pin_type ice_cgu_get_pin_type(struct ice_hw *hw, u8 pin, bool input);
 struct dpll_pin_frequency *
 ice_cgu_get_pin_freq_supp(struct ice_hw *hw, u8 pin, bool input, u8 *num);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_repr.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_repr.c
@@ -9,39 +9,6 @@
 #include "ice_dcb_lib.h"
 
 /**
- * ice_repr_get_sw_port_id - get port ID associated with representor
- * @repr: pointer to port representor
- */
-static int ice_repr_get_sw_port_id(struct ice_repr *repr)
-{
-	return repr->src_vsi->back->hw.port_info->lport;
-}
-
-/**
- * ice_repr_get_phys_port_name - get phys port name
- * @netdev: pointer to port representor netdev
- * @buf: write here port name
- * @len: max length of buf
- */
-static int
-ice_repr_get_phys_port_name(struct net_device *netdev, char *buf, size_t len)
-{
-	struct ice_netdev_priv *np = netdev_priv(netdev);
-	struct ice_repr *repr = np->repr;
-	int res;
-
-	/* Devlink port is registered and devlink core is taking care of name formatting. */
-	if (repr->vf->devlink_port.devlink)
-		return -EOPNOTSUPP;
-
-	res = snprintf(buf, len, "pf%dvfr%d", ice_repr_get_sw_port_id(repr),
-		       repr->id);
-	if (res <= 0)
-		return -EOPNOTSUPP;
-	return 0;
-}
-
-/**
  * ice_repr_get_stats64 - get VF stats for VFPR use
  * @netdev: pointer to port representor netdev
  * @stats: pointer to struct where stats can be stored
@@ -240,7 +207,6 @@
 }
 
 static const struct net_device_ops ice_repr_netdev_ops = {
-	.ndo_get_phys_port_name = ice_repr_get_phys_port_name,
 	.ndo_get_stats64 = ice_repr_get_stats64,
 	.ndo_open = ice_repr_open,
 	.ndo_stop = ice_repr_stop,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_sched.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_sched.c
@@ -28,9 +28,8 @@
 	if (!root)
 		return -ENOMEM;
 
-	/* coverity[suspicious_sizeof] */
 	root->children = devm_kcalloc(ice_hw_to_dev(hw), hw->max_children[0],
-				      sizeof(*root), GFP_KERNEL);
+				      sizeof(*root->children), GFP_KERNEL);
 	if (!root->children) {
 		devm_kfree(ice_hw_to_dev(hw), root);
 		return -ENOMEM;
@@ -186,10 +185,9 @@
 	if (!node)
 		return -ENOMEM;
 	if (hw->max_children[layer]) {
-		/* coverity[suspicious_sizeof] */
 		node->children = devm_kcalloc(ice_hw_to_dev(hw),
 					      hw->max_children[layer],
-					      sizeof(*node), GFP_KERNEL);
+					      sizeof(*node->children), GFP_KERNEL);
 		if (!node->children) {
 			devm_kfree(ice_hw_to_dev(hw), node);
 			return -ENOMEM;
@@ -237,7 +235,7 @@
 ice_sched_remove_elems(struct ice_hw *hw, struct ice_sched_node *parent,
 		       u32 node_teid)
 {
-	DEFINE_FLEX(struct ice_aqc_delete_elem, buf, teid, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_delete_elem, buf, teid, 1);
 	u16 buf_size = __struct_size(buf);
 	u16 num_groups_removed = 0;
 	int status;
@@ -2219,7 +2217,7 @@
 ice_sched_move_nodes(struct ice_port_info *pi, struct ice_sched_node *parent,
 		     u16 num_items, u32 *list)
 {
-	DEFINE_FLEX(struct ice_aqc_move_elem, buf, teid, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_move_elem, buf, teid, 1);
 	u16 buf_len = __struct_size(buf);
 	struct ice_sched_node *node;
 	u16 i, grps_movd = 0;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_sriov.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_sriov.c
@@ -1104,8 +1104,10 @@
 		return -ENOENT;
 
 	vsi = ice_get_vf_vsi(vf);
-	if (!vsi)
+	if (!vsi) {
+		ice_put_vf(vf);
 		return -ENOENT;
+	}
 
 	prev_msix = vf->num_msix;
 	prev_queues = vf->num_vf_qs;
@@ -1127,7 +1129,10 @@
 	if (vf->first_vector_idx < 0)
 		goto unroll;
 
-	if (ice_vf_reconfig_vsi(vf) || ice_vf_init_host_cfg(vf, vsi)) {
+	vsi->req_txq = queues;
+	vsi->req_rxq = queues;
+
+	if (ice_vsi_rebuild(vsi, ICE_VSI_FLAG_NO_INIT)) {
 		/* Try to rebuild with previous values */
 		needs_rebuild = true;
 		goto unroll;
@@ -1150,12 +1155,16 @@
 	vf->num_msix = prev_msix;
 	vf->num_vf_qs = prev_queues;
 	vf->first_vector_idx = ice_sriov_get_irqs(pf, vf->num_msix);
-	if (vf->first_vector_idx < 0)
+	if (vf->first_vector_idx < 0) {
+		ice_put_vf(vf);
 		return -EINVAL;
+	}
 
 	if (needs_rebuild) {
-		ice_vf_reconfig_vsi(vf);
-		ice_vf_init_host_cfg(vf, vsi);
+		vsi->req_txq = prev_queues;
+		vsi->req_rxq = prev_queues;
+
+		ice_vsi_rebuild(vsi, ICE_VSI_FLAG_NO_INIT);
 	}
 
 	ice_ena_vf_mappings(vf);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_switch.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_switch.c
@@ -1812,7 +1812,7 @@
 			   enum ice_sw_lkup_type lkup_type,
 			   enum ice_adminq_opc opc)
 {
-	DEFINE_FLEX(struct ice_aqc_alloc_free_res_elem, sw_buf, elem, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_alloc_free_res_elem, sw_buf, elem, 1);
 	u16 buf_len = __struct_size(sw_buf);
 	struct ice_aqc_res_elem *vsi_ele;
 	int status;
@@ -1825,7 +1825,8 @@
 	    lkup_type == ICE_SW_LKUP_ETHERTYPE_MAC ||
 	    lkup_type == ICE_SW_LKUP_PROMISC ||
 	    lkup_type == ICE_SW_LKUP_PROMISC_VLAN ||
-	    lkup_type == ICE_SW_LKUP_DFLT) {
+	    lkup_type == ICE_SW_LKUP_DFLT ||
+	    lkup_type == ICE_SW_LKUP_LAST) {
 		sw_buf->res_type = cpu_to_le16(ICE_AQC_RES_TYPE_VSI_LIST_REP);
 	} else if (lkup_type == ICE_SW_LKUP_VLAN) {
 		if (opc == ice_aqc_opc_alloc_res)
@@ -2025,12 +2026,12 @@
  * ice_aq_map_recipe_to_profile - Map recipe to packet profile
  * @hw: pointer to the HW struct
  * @profile_id: package profile ID to associate the recipe with
- * @r_bitmap: Recipe bitmap filled in and need to be returned as response
+ * @r_assoc: Recipe bitmap filled in and need to be returned as response
  * @cd: pointer to command details structure or NULL
  * Recipe to profile association (0x0291)
  */
 int
-ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
+ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 r_assoc,
 			     struct ice_sq_cd *cd)
 {
 	struct ice_aqc_recipe_to_profile *cmd;
@@ -2042,7 +2043,7 @@
 	/* Set the recipe ID bit in the bitmask to let the device know which
 	 * profile we are associating the recipe to
 	 */
-	memcpy(cmd->recipe_assoc, r_bitmap, sizeof(cmd->recipe_assoc));
+	cmd->recipe_assoc = cpu_to_le64(r_assoc);
 
 	return ice_aq_send_cmd(hw, &desc, NULL, 0, cd);
 }
@@ -2051,12 +2052,12 @@
  * ice_aq_get_recipe_to_profile - Map recipe to packet profile
  * @hw: pointer to the HW struct
  * @profile_id: package profile ID to associate the recipe with
- * @r_bitmap: Recipe bitmap filled in and need to be returned as response
+ * @r_assoc: Recipe bitmap filled in and need to be returned as response
  * @cd: pointer to command details structure or NULL
  * Associate profile ID with given recipe (0x0293)
  */
 int
-ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
+ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 *r_assoc,
 			     struct ice_sq_cd *cd)
 {
 	struct ice_aqc_recipe_to_profile *cmd;
@@ -2069,7 +2070,7 @@
 
 	status = ice_aq_send_cmd(hw, &desc, NULL, 0, cd);
 	if (!status)
-		memcpy(r_bitmap, cmd->recipe_assoc, sizeof(cmd->recipe_assoc));
+		*r_assoc = le64_to_cpu(cmd->recipe_assoc);
 
 	return status;
 }
@@ -2081,7 +2082,7 @@
  */
 int ice_alloc_recipe(struct ice_hw *hw, u16 *rid)
 {
-	DEFINE_FLEX(struct ice_aqc_alloc_free_res_elem, sw_buf, elem, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_alloc_free_res_elem, sw_buf, elem, 1);
 	u16 buf_len = __struct_size(sw_buf);
 	int status;
 
@@ -2108,6 +2109,7 @@
 static void ice_get_recp_to_prof_map(struct ice_hw *hw)
 {
 	DECLARE_BITMAP(r_bitmap, ICE_MAX_NUM_RECIPES);
+	u64 recp_assoc;
 	u16 i;
 
 	for (i = 0; i < hw->switch_info->max_used_prof_index + 1; i++) {
@@ -2115,8 +2117,9 @@
 
 		bitmap_zero(profile_to_recipe[i], ICE_MAX_NUM_RECIPES);
 		bitmap_zero(r_bitmap, ICE_MAX_NUM_RECIPES);
-		if (ice_aq_get_recipe_to_profile(hw, i, (u8 *)r_bitmap, NULL))
+		if (ice_aq_get_recipe_to_profile(hw, i, &recp_assoc, NULL))
 			continue;
+		bitmap_from_arr64(r_bitmap, &recp_assoc, ICE_MAX_NUM_RECIPES);
 		bitmap_copy(profile_to_recipe[i], r_bitmap,
 			    ICE_MAX_NUM_RECIPES);
 		for_each_set_bit(j, r_bitmap, ICE_MAX_NUM_RECIPES)
@@ -2255,10 +2258,10 @@
 		/* Propagate some data to the recipe database */
 		recps[idx].is_root = !!is_root;
 		recps[idx].priority = root_bufs.content.act_ctrl_fwd_priority;
-		recps[idx].need_pass_l2 = root_bufs.content.act_ctrl &
-					  ICE_AQ_RECIPE_ACT_NEED_PASS_L2;
-		recps[idx].allow_pass_l2 = root_bufs.content.act_ctrl &
-					   ICE_AQ_RECIPE_ACT_ALLOW_PASS_L2;
+		recps[idx].need_pass_l2 = !!(root_bufs.content.act_ctrl &
+					     ICE_AQ_RECIPE_ACT_NEED_PASS_L2);
+		recps[idx].allow_pass_l2 = !!(root_bufs.content.act_ctrl &
+					      ICE_AQ_RECIPE_ACT_ALLOW_PASS_L2);
 		bitmap_zero(recps[idx].res_idxs, ICE_MAX_FV_WORDS);
 		if (root_bufs.content.result_indx & ICE_AQ_RECIPE_RESULT_EN) {
 			recps[idx].chain_idx = root_bufs.content.result_indx &
@@ -2757,7 +2760,8 @@
 	    lkup_type == ICE_SW_LKUP_ETHERTYPE_MAC ||
 	    lkup_type == ICE_SW_LKUP_PROMISC ||
 	    lkup_type == ICE_SW_LKUP_PROMISC_VLAN ||
-	    lkup_type == ICE_SW_LKUP_DFLT)
+	    lkup_type == ICE_SW_LKUP_DFLT ||
+	    lkup_type == ICE_SW_LKUP_LAST)
 		rule_type = remove ? ICE_AQC_SW_RULES_T_VSI_LIST_CLEAR :
 			ICE_AQC_SW_RULES_T_VSI_LIST_SET;
 	else if (lkup_type == ICE_SW_LKUP_VLAN)
@@ -3052,7 +3056,7 @@
 
 		/* A rule already exists with the new VSI being added */
 		if (test_bit(vsi_handle, m_entry->vsi_list_info->vsi_map))
-			return 0;
+			return -EEXIST;
 
 		/* Update the previously created VSI list set with
 		 * the new VSI ID passed in
@@ -3122,7 +3126,7 @@
 
 	list_head = &sw->recp_list[recp_id].filt_rules;
 	list_for_each_entry(list_itr, list_head, list_entry) {
-		if (list_itr->vsi_list_info) {
+		if (list_itr->vsi_count == 1 && list_itr->vsi_list_info) {
 			map_info = list_itr->vsi_list_info;
 			if (test_bit(vsi_handle, map_info->vsi_map)) {
 				*vsi_list_id = map_info->vsi_list_id;
@@ -4418,7 +4422,7 @@
 ice_alloc_res_cntr(struct ice_hw *hw, u8 type, u8 alloc_shared, u16 num_items,
 		   u16 *counter_id)
 {
-	DEFINE_FLEX(struct ice_aqc_alloc_free_res_elem, buf, elem, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_alloc_free_res_elem, buf, elem, 1);
 	u16 buf_len = __struct_size(buf);
 	int status;
 
@@ -4446,7 +4450,7 @@
 ice_free_res_cntr(struct ice_hw *hw, u8 type, u8 alloc_shared, u16 num_items,
 		  u16 counter_id)
 {
-	DEFINE_FLEX(struct ice_aqc_alloc_free_res_elem, buf, elem, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_alloc_free_res_elem, buf, elem, 1);
 	u16 buf_len = __struct_size(buf);
 	int status;
 
@@ -4476,7 +4480,7 @@
  */
 int ice_share_res(struct ice_hw *hw, u16 type, u8 shared, u16 res_id)
 {
-	DEFINE_FLEX(struct ice_aqc_alloc_free_res_elem, buf, elem, 1);
+	DEFINE_RAW_FLEX(struct ice_aqc_alloc_free_res_elem, buf, elem, 1);
 	u16 buf_len = __struct_size(buf);
 	u16 res_type;
 	int status;
@@ -5390,22 +5394,24 @@
 	 */
 	list_for_each_entry(fvit, &rm->fv_list, list_entry) {
 		DECLARE_BITMAP(r_bitmap, ICE_MAX_NUM_RECIPES);
+		u64 recp_assoc;
 		u16 j;
 
 		status = ice_aq_get_recipe_to_profile(hw, fvit->profile_id,
-						      (u8 *)r_bitmap, NULL);
+						      &recp_assoc, NULL);
 		if (status)
 			goto err_unroll;
 
+		bitmap_from_arr64(r_bitmap, &recp_assoc, ICE_MAX_NUM_RECIPES);
 		bitmap_or(r_bitmap, r_bitmap, rm->r_bitmap,
 			  ICE_MAX_NUM_RECIPES);
 		status = ice_acquire_change_lock(hw, ICE_RES_WRITE);
 		if (status)
 			goto err_unroll;
 
+		bitmap_to_arr64(&recp_assoc, r_bitmap, ICE_MAX_NUM_RECIPES);
 		status = ice_aq_map_recipe_to_profile(hw, fvit->profile_id,
-						      (u8 *)r_bitmap,
-						      NULL);
+						      recp_assoc, NULL);
 		ice_release_change_lock(hw);
 
 		if (status)
@@ -6289,8 +6295,6 @@
 		if (!itr->vsi_list_info ||
 		    !test_bit(vsi_handle, itr->vsi_list_info->vsi_map))
 			continue;
-		/* Clearing it so that the logic can add it back */
-		clear_bit(vsi_handle, itr->vsi_list_info->vsi_map);
 		f_entry.fltr_info.vsi_handle = vsi_handle;
 		f_entry.fltr_info.fltr_act = ICE_FWD_TO_VSI;
 		/* update the src in case it is VSI num */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_switch.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_switch.h
@@ -424,10 +424,10 @@
 		      struct ice_aqc_recipe_data_elem *s_recipe_list,
 		      u16 num_recipes, struct ice_sq_cd *cd);
 int
-ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
+ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 *r_assoc,
 			     struct ice_sq_cd *cd);
 int
-ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
+ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 r_assoc,
 			     struct ice_sq_cd *cd);
 
 #endif /* _ICE_SWITCH_H_ */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_tc_lib.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_tc_lib.c
@@ -28,6 +28,8 @@
 	 * - ICE_TC_FLWR_FIELD_VLAN_TPID (present if specified)
 	 * - Tunnel flag (present if tunnel)
 	 */
+	if (fltr->direction == ICE_ESWITCH_FLTR_EGRESS)
+		lkups_cnt++;
 
 	if (flags & ICE_TC_FLWR_FIELD_TENANT_ID)
 		lkups_cnt++;
@@ -363,6 +365,11 @@
 	/* Always add direction metadata */
 	ice_rule_add_direction_metadata(&list[ICE_TC_METADATA_LKUP_IDX]);
 
+	if (tc_fltr->direction == ICE_ESWITCH_FLTR_EGRESS) {
+		ice_rule_add_src_vsi_metadata(&list[i]);
+		i++;
+	}
+
 	rule_info->tun_type = ice_sw_type_from_tunnel(tc_fltr->tunnel_type);
 	if (tc_fltr->tunnel_type != TNL_LAST) {
 		i = ice_tc_fill_tunnel_outer(flags, tc_fltr, list, i);
@@ -772,7 +779,7 @@
 	int ret;
 	int i;
 
-	if (!flags || (flags & ICE_TC_FLWR_FIELD_ENC_SRC_L4_PORT)) {
+	if (flags & ICE_TC_FLWR_FIELD_ENC_SRC_L4_PORT) {
 		NL_SET_ERR_MSG_MOD(fltr->extack, "Unsupported encap field(s)");
 		return -EOPNOTSUPP;
 	}
@@ -811,6 +818,17 @@
 		rule_info.sw_act.flag |= ICE_FLTR_TX;
 		rule_info.sw_act.src = vsi->idx;
 		rule_info.flags_info.act = ICE_SINGLE_ACT_LAN_ENABLE;
+		/* This is a specific case. The destination VSI index is
+		 * overwritten by the source VSI index. This type of filter
+		 * should allow the packet to go to the LAN, not to the
+		 * VSI passed here. It should set LAN_EN bit only. However,
+		 * the VSI must be a valid one. Setting source VSI index
+		 * here is safe. Even if the result from switch is set LAN_EN
+		 * and LB_EN (which normally will pass the packet to this VSI)
+		 * packet won't be seen on the VSI, because local loopback is
+		 * turned off.
+		 */
+		rule_info.sw_act.vsi_handle = vsi->idx;
 	} else {
 		/* VF to VF */
 		rule_info.sw_act.flag |= ICE_FLTR_TX;
@@ -820,6 +838,7 @@
 
 	/* specify the cookie as filter_rule_id */
 	rule_info.fltr_rule_id = fltr->cookie;
+	rule_info.src_vsi = vsi->idx;
 
 	ret = ice_add_adv_rule(hw, list, lkups_cnt, &rule_info, &rule_added);
 	if (ret == -EEXIST) {
@@ -1481,7 +1500,10 @@
 		  (BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) |
 		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) |
 		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_KEYID) |
-		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS))) {
+		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS) |
+		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IP) |
+		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_OPTS) |
+		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_CONTROL))) {
 		NL_SET_ERR_MSG_MOD(fltr->extack, "Tunnel key used, but device isn't a tunnel");
 		return -EOPNOTSUPP;
 	} else {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -456,7 +456,7 @@
 	if (rx_ring->vsi->type == ICE_VSI_PF)
 		if (xdp_rxq_info_is_reg(&rx_ring->xdp_rxq))
 			xdp_rxq_info_unreg(&rx_ring->xdp_rxq);
-	rx_ring->xdp_prog = NULL;
+	WRITE_ONCE(rx_ring->xdp_prog, NULL);
 	if (rx_ring->xsk_pool) {
 		kfree(rx_ring->xdp_buf);
 		rx_ring->xdp_buf = NULL;
@@ -522,30 +522,6 @@
 }
 
 /**
- * ice_rx_frame_truesize
- * @rx_ring: ptr to Rx ring
- * @size: size
- *
- * calculate the truesize with taking into the account PAGE_SIZE of
- * underlying arch
- */
-static unsigned int
-ice_rx_frame_truesize(struct ice_rx_ring *rx_ring, const unsigned int size)
-{
-	unsigned int truesize;
-
-#if (PAGE_SIZE < 8192)
-	truesize = ice_rx_pg_size(rx_ring) / 2; /* Must be power-of-2 */
-#else
-	truesize = rx_ring->rx_offset ?
-		SKB_DATA_ALIGN(rx_ring->rx_offset + size) +
-		SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) :
-		SKB_DATA_ALIGN(size);
-#endif
-	return truesize;
-}
-
-/**
  * ice_run_xdp - Executes an XDP program on initialized xdp_buff
  * @rx_ring: Rx ring
  * @xdp: xdp_buff used as input to the XDP program
@@ -837,16 +813,15 @@
 	if (!dev_page_is_reusable(page))
 		return false;
 
-#if (PAGE_SIZE < 8192)
 	/* if we are only owner of page we can reuse it */
 	if (unlikely(rx_buf->pgcnt - pagecnt_bias > 1))
 		return false;
-#else
+#if (PAGE_SIZE >= 8192)
 #define ICE_LAST_OFFSET \
-	(SKB_WITH_OVERHEAD(PAGE_SIZE) - ICE_RXBUF_2048)
+	(SKB_WITH_OVERHEAD(PAGE_SIZE) - ICE_RXBUF_3072)
 	if (rx_buf->page_offset > ICE_LAST_OFFSET)
 		return false;
-#endif /* PAGE_SIZE < 8192) */
+#endif /* PAGE_SIZE >= 8192) */
 
 	/* If we have drained the page fragment pool we need to update
 	 * the pagecnt_bias and page count so that we fully restock the
@@ -949,12 +924,7 @@
 	struct ice_rx_buf *rx_buf;
 
 	rx_buf = &rx_ring->rx_buf[ntc];
-	rx_buf->pgcnt =
-#if (PAGE_SIZE < 8192)
-		page_count(rx_buf->page);
-#else
-		0;
-#endif
+	rx_buf->pgcnt = page_count(rx_buf->page);
 	prefetchw(rx_buf->page);
 
 	if (!size)
@@ -1161,11 +1131,6 @@
 	bool failure;
 	u32 first;
 
-	/* Frame size depend on rx_ring setup when PAGE_SIZE=4K */
-#if (PAGE_SIZE < 8192)
-	xdp->frame_sz = ice_rx_frame_truesize(rx_ring, 0);
-#endif
-
 	xdp_prog = READ_ONCE(rx_ring->xdp_prog);
 	if (xdp_prog) {
 		xdp_ring = rx_ring->xdp_ring;
@@ -1224,10 +1189,6 @@
 			hard_start = page_address(rx_buf->page) + rx_buf->page_offset -
 				     offset;
 			xdp_prepare_buff(xdp, hard_start, offset, size, !!offset);
-#if (PAGE_SIZE > 4096)
-			/* At larger PAGE_SIZE, frame_sz depend on len size */
-			xdp->frame_sz = ice_rx_frame_truesize(rx_ring, size);
-#endif
 			xdp_buff_clear_frags_flag(xdp);
 		} else if (ice_add_xdp_frag(rx_ring, xdp, rx_buf, size)) {
 			break;
@@ -1522,10 +1483,11 @@
 	 * budget and be more aggressive about cleaning up the Tx descriptors.
 	 */
 	ice_for_each_tx_ring(tx_ring, q_vector->tx) {
+		struct xsk_buff_pool *xsk_pool = READ_ONCE(tx_ring->xsk_pool);
 		bool wd;
 
-		if (tx_ring->xsk_pool)
-			wd = ice_xmit_zc(tx_ring);
+		if (xsk_pool)
+			wd = ice_xmit_zc(tx_ring, xsk_pool);
 		else if (ice_ring_is_xdp(tx_ring))
 			wd = true;
 		else
@@ -1551,6 +1513,7 @@
 		budget_per_ring = budget;
 
 	ice_for_each_rx_ring(rx_ring, q_vector->rx) {
+		struct xsk_buff_pool *xsk_pool = READ_ONCE(rx_ring->xsk_pool);
 		int cleaned;
 
 		/* A dedicated path for zero-copy allows making a single
@@ -1558,7 +1521,7 @@
 		 * ice_clean_rx_irq function and makes the codebase cleaner.
 		 */
 		cleaned = rx_ring->xsk_pool ?
-			  ice_clean_rx_irq_zc(rx_ring, budget_per_ring) :
+			  ice_clean_rx_irq_zc(rx_ring, xsk_pool, budget_per_ring) :
 			  ice_clean_rx_irq(rx_ring, budget_per_ring);
 		work_done += cleaned;
 		/* if we clean as many as budgeted, we must not be done */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_type.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_type.h
@@ -480,6 +480,8 @@
 	u32 orom_size;				/* Size of OROM bank */
 	u32 netlist_ptr;			/* Pointer to 1st Netlist bank */
 	u32 netlist_size;			/* Size of Netlist bank */
+	u32 active_css_hdr_len;			/* Active CSS header length */
+	u32 inactive_css_hdr_len;		/* Inactive CSS header length */
 	enum ice_flash_bank nvm_bank;		/* Active NVM bank */
 	enum ice_flash_bank orom_bank;		/* Active OROM bank */
 	enum ice_flash_bank netlist_bank;	/* Active Netlist bank */
@@ -1083,17 +1085,13 @@
 #define ICE_SR_SECTOR_SIZE_IN_WORDS	0x800
 
 /* CSS Header words */
+#define ICE_NVM_CSS_HDR_LEN_L			0x02
+#define ICE_NVM_CSS_HDR_LEN_H			0x03
 #define ICE_NVM_CSS_SREV_L			0x14
 #define ICE_NVM_CSS_SREV_H			0x15
 
-/* Length of CSS header section in words */
-#define ICE_CSS_HEADER_LENGTH			330
-
-/* Offset of Shadow RAM copy in the NVM bank area. */
-#define ICE_NVM_SR_COPY_WORD_OFFSET		roundup(ICE_CSS_HEADER_LENGTH, 32)
-
-/* Size in bytes of Option ROM trailer */
-#define ICE_NVM_OROM_TRAILER_LENGTH		(2 * ICE_CSS_HEADER_LENGTH)
+/* Length of Authentication header section in words */
+#define ICE_NVM_AUTH_HEADER_LEN			0x08
 
 /* The Link Topology Netlist section is stored as a series of words. It is
  * stored in the NVM as a TLV, with the first two words containing the type
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_vf_lib.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_vf_lib.c
@@ -256,7 +256,7 @@
  *
  * It brings the VSI down and then reconfigures it with the hardware.
  */
-int ice_vf_reconfig_vsi(struct ice_vf *vf)
+static int ice_vf_reconfig_vsi(struct ice_vf *vf)
 {
 	struct ice_vsi *vsi = ice_get_vf_vsi(vf);
 	struct ice_vsi_cfg_params params = {};
@@ -344,6 +344,13 @@
 
 		err = vlan_ops->add_vlan(vsi, &vf->port_vlan_info);
 	} else {
+		/* clear possible previous port vlan config */
+		err = ice_vsi_clear_port_vlan(vsi);
+		if (err) {
+			dev_err(dev, "failed to clear port VLAN via VSI parameters for VF %u, error %d\n",
+				vf->vf_id, err);
+			return err;
+		}
 		err = ice_vsi_add_vlan_zero(vsi);
 	}
 
@@ -863,6 +870,11 @@
 		return 0;
 	}
 
+	if (flags & ICE_VF_RESET_LOCK)
+		mutex_lock(&vf->cfg_lock);
+	else
+		lockdep_assert_held(&vf->cfg_lock);
+
 	lag = pf->lag;
 	mutex_lock(&pf->lag_mutex);
 	if (lag && lag->bonded && lag->primary) {
@@ -874,11 +886,6 @@
 			act_prt = ICE_LAG_INVALID_PORT;
 	}
 
-	if (flags & ICE_VF_RESET_LOCK)
-		mutex_lock(&vf->cfg_lock);
-	else
-		lockdep_assert_held(&vf->cfg_lock);
-
 	if (ice_is_vf_disabled(vf)) {
 		vsi = ice_get_vf_vsi(vf);
 		if (!vsi) {
@@ -963,14 +970,14 @@
 	ice_mbx_clear_malvf(&vf->mbx_info);
 
 out_unlock:
-	if (flags & ICE_VF_RESET_LOCK)
-		mutex_unlock(&vf->cfg_lock);
-
 	if (lag && lag->bonded && lag->primary &&
 	    act_prt != ICE_LAG_INVALID_PORT)
 		ice_lag_move_vf_nodes_cfg(lag, pri_prt, act_prt);
 	mutex_unlock(&pf->lag_mutex);
 
+	if (flags & ICE_VF_RESET_LOCK)
+		mutex_unlock(&vf->cfg_lock);
+
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_vf_lib_private.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_vf_lib_private.h
@@ -23,7 +23,6 @@
 #warning "Only include ice_vf_lib_private.h in CONFIG_PCI_IOV virtualization files"
 #endif
 
-int ice_vf_reconfig_vsi(struct ice_vf *vf);
 void ice_initialize_vf_entry(struct ice_vf *vf);
 void ice_dis_vf_qs(struct ice_vf *vf);
 int ice_check_vf_init(struct ice_vf *vf);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c
@@ -26,24 +26,22 @@
 	struct ice_vsi_vlan_ops *vlan_ops;
 	struct ice_pf *pf = vsi->back;
 
-	if (ice_is_dvm_ena(&pf->hw)) {
-		vlan_ops = &vsi->outer_vlan_ops;
+	/* setup inner VLAN ops */
+	vlan_ops = &vsi->inner_vlan_ops;
 
-		/* setup outer VLAN ops */
-		vlan_ops->set_port_vlan = ice_vsi_set_outer_port_vlan;
-		vlan_ops->clear_port_vlan = ice_vsi_clear_outer_port_vlan;
-
-		/* setup inner VLAN ops */
-		vlan_ops = &vsi->inner_vlan_ops;
+	if (ice_is_dvm_ena(&pf->hw)) {
 		vlan_ops->add_vlan = noop_vlan_arg;
 		vlan_ops->del_vlan = noop_vlan_arg;
 		vlan_ops->ena_stripping = ice_vsi_ena_inner_stripping;
 		vlan_ops->dis_stripping = ice_vsi_dis_inner_stripping;
 		vlan_ops->ena_insertion = ice_vsi_ena_inner_insertion;
 		vlan_ops->dis_insertion = ice_vsi_dis_inner_insertion;
-	} else {
-		vlan_ops = &vsi->inner_vlan_ops;
 
+		/* setup outer VLAN ops */
+		vlan_ops = &vsi->outer_vlan_ops;
+		vlan_ops->set_port_vlan = ice_vsi_set_outer_port_vlan;
+		vlan_ops->clear_port_vlan = ice_vsi_clear_outer_port_vlan;
+	} else {
 		vlan_ops->set_port_vlan = ice_vsi_set_inner_port_vlan;
 		vlan_ops->clear_port_vlan = ice_vsi_clear_inner_port_vlan;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_virtchnl.c
@@ -499,7 +499,7 @@
 	vfres->rss_lut_size = ICE_LUT_VSI_SIZE;
 	vfres->max_mtu = ice_vc_get_max_frame_size(vf);
 
-	vfres->vsi_res[0].vsi_id = vf->lan_vsi_num;
+	vfres->vsi_res[0].vsi_id = ICE_VF_VSI_ID;
 	vfres->vsi_res[0].vsi_type = VIRTCHNL_VSI_SRIOV;
 	vfres->vsi_res[0].num_queue_pairs = vsi->num_txq;
 	ether_addr_copy(vfres->vsi_res[0].default_mac_addr,
@@ -545,27 +545,20 @@
  */
 bool ice_vc_isvalid_vsi_id(struct ice_vf *vf, u16 vsi_id)
 {
-	struct ice_pf *pf = vf->pf;
-	struct ice_vsi *vsi;
-
-	vsi = ice_find_vsi(pf, vsi_id);
-
-	return (vsi && (vsi->vf == vf));
+	return vsi_id == ICE_VF_VSI_ID;
 }
 
 /**
  * ice_vc_isvalid_q_id
- * @vf: pointer to the VF info
- * @vsi_id: VSI ID
+ * @vsi: VSI to check queue ID against
  * @qid: VSI relative queue ID
  *
  * check for the valid queue ID
  */
-static bool ice_vc_isvalid_q_id(struct ice_vf *vf, u16 vsi_id, u8 qid)
+static bool ice_vc_isvalid_q_id(struct ice_vsi *vsi, u8 qid)
 {
-	struct ice_vsi *vsi = ice_find_vsi(vf->pf, vsi_id);
 	/* allocated Tx and Rx queues should be always equal for VF VSI */
-	return (vsi && (qid < vsi->alloc_txq));
+	return qid < vsi->alloc_txq;
 }
 
 /**
@@ -1323,7 +1316,7 @@
 	 */
 	q_map = vqs->rx_queues;
 	for_each_set_bit(vf_q_id, &q_map, ICE_MAX_RSS_QS_PER_VF) {
-		if (!ice_vc_isvalid_q_id(vf, vqs->vsi_id, vf_q_id)) {
+		if (!ice_vc_isvalid_q_id(vsi, vf_q_id)) {
 			v_ret = VIRTCHNL_STATUS_ERR_PARAM;
 			goto error_param;
 		}
@@ -1345,7 +1338,7 @@
 
 	q_map = vqs->tx_queues;
 	for_each_set_bit(vf_q_id, &q_map, ICE_MAX_RSS_QS_PER_VF) {
-		if (!ice_vc_isvalid_q_id(vf, vqs->vsi_id, vf_q_id)) {
+		if (!ice_vc_isvalid_q_id(vsi, vf_q_id)) {
 			v_ret = VIRTCHNL_STATUS_ERR_PARAM;
 			goto error_param;
 		}
@@ -1450,7 +1443,7 @@
 		q_map = vqs->tx_queues;
 
 		for_each_set_bit(vf_q_id, &q_map, ICE_MAX_RSS_QS_PER_VF) {
-			if (!ice_vc_isvalid_q_id(vf, vqs->vsi_id, vf_q_id)) {
+			if (!ice_vc_isvalid_q_id(vsi, vf_q_id)) {
 				v_ret = VIRTCHNL_STATUS_ERR_PARAM;
 				goto error_param;
 			}
@@ -1476,7 +1469,7 @@
 		bitmap_zero(vf->rxq_ena, ICE_MAX_RSS_QS_PER_VF);
 	} else if (q_map) {
 		for_each_set_bit(vf_q_id, &q_map, ICE_MAX_RSS_QS_PER_VF) {
-			if (!ice_vc_isvalid_q_id(vf, vqs->vsi_id, vf_q_id)) {
+			if (!ice_vc_isvalid_q_id(vsi, vf_q_id)) {
 				v_ret = VIRTCHNL_STATUS_ERR_PARAM;
 				goto error_param;
 			}
@@ -1532,7 +1525,7 @@
 	for_each_set_bit(vsi_q_id_idx, &qmap, ICE_MAX_RSS_QS_PER_VF) {
 		vsi_q_id = vsi_q_id_idx;
 
-		if (!ice_vc_isvalid_q_id(vf, vsi->vsi_num, vsi_q_id))
+		if (!ice_vc_isvalid_q_id(vsi, vsi_q_id))
 			return VIRTCHNL_STATUS_ERR_PARAM;
 
 		q_vector->num_ring_rx++;
@@ -1546,7 +1539,7 @@
 	for_each_set_bit(vsi_q_id_idx, &qmap, ICE_MAX_RSS_QS_PER_VF) {
 		vsi_q_id = vsi_q_id_idx;
 
-		if (!ice_vc_isvalid_q_id(vf, vsi->vsi_num, vsi_q_id))
+		if (!ice_vc_isvalid_q_id(vsi, vsi_q_id))
 			return VIRTCHNL_STATUS_ERR_PARAM;
 
 		q_vector->num_ring_tx++;
@@ -1703,7 +1696,7 @@
 		    qpi->txq.headwb_enabled ||
 		    !ice_vc_isvalid_ring_len(qpi->txq.ring_len) ||
 		    !ice_vc_isvalid_ring_len(qpi->rxq.ring_len) ||
-		    !ice_vc_isvalid_q_id(vf, qci->vsi_id, qpi->txq.queue_id)) {
+		    !ice_vc_isvalid_q_id(vsi, qpi->txq.queue_id)) {
 			goto error_param;
 		}
 
@@ -1718,8 +1711,8 @@
 
 		/* copy Tx queue info from VF into VSI */
 		if (qpi->txq.ring_len > 0) {
-			vsi->tx_rings[i]->dma = qpi->txq.dma_ring_addr;
-			vsi->tx_rings[i]->count = qpi->txq.ring_len;
+			vsi->tx_rings[q_idx]->dma = qpi->txq.dma_ring_addr;
+			vsi->tx_rings[q_idx]->count = qpi->txq.ring_len;
 
 			/* Disable any existing queue first */
 			if (ice_vf_vsi_dis_single_txq(vf, vsi, q_idx))
@@ -1728,7 +1721,7 @@
 			/* Configure a queue with the requested settings */
 			if (ice_vsi_cfg_single_txq(vsi, vsi->tx_rings, q_idx)) {
 				dev_warn(ice_pf_to_dev(pf), "VF-%d failed to configure TX queue %d\n",
-					 vf->vf_id, i);
+					 vf->vf_id, q_idx);
 				goto error_param;
 			}
 		}
@@ -1736,24 +1729,23 @@
 		/* copy Rx queue info from VF into VSI */
 		if (qpi->rxq.ring_len > 0) {
 			u16 max_frame_size = ice_vc_get_max_frame_size(vf);
+			struct ice_rx_ring *ring = vsi->rx_rings[q_idx];
 			u32 rxdid;
 
-			vsi->rx_rings[i]->dma = qpi->rxq.dma_ring_addr;
-			vsi->rx_rings[i]->count = qpi->rxq.ring_len;
+			ring->dma = qpi->rxq.dma_ring_addr;
+			ring->count = qpi->rxq.ring_len;
 
 			if (qpi->rxq.crc_disable)
-				vsi->rx_rings[q_idx]->flags |=
-					ICE_RX_FLAGS_CRC_STRIP_DIS;
+				ring->flags |= ICE_RX_FLAGS_CRC_STRIP_DIS;
 			else
-				vsi->rx_rings[q_idx]->flags &=
-					~ICE_RX_FLAGS_CRC_STRIP_DIS;
+				ring->flags &= ~ICE_RX_FLAGS_CRC_STRIP_DIS;
 
 			if (qpi->rxq.databuffer_size != 0 &&
 			    (qpi->rxq.databuffer_size > ((16 * 1024) - 128) ||
 			     qpi->rxq.databuffer_size < 1024))
 				goto error_param;
 			vsi->rx_buf_len = qpi->rxq.databuffer_size;
-			vsi->rx_rings[i]->rx_buf_len = vsi->rx_buf_len;
+			ring->rx_buf_len = vsi->rx_buf_len;
 			if (qpi->rxq.max_pkt_size > max_frame_size ||
 			    qpi->rxq.max_pkt_size < 64)
 				goto error_param;
@@ -1768,7 +1760,7 @@
 
 			if (ice_vsi_cfg_single_rxq(vsi, q_idx)) {
 				dev_warn(ice_pf_to_dev(pf), "VF-%d failed to configure RX queue %d\n",
-					 vf->vf_id, i);
+					 vf->vf_id, q_idx);
 				goto error_param;
 			}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_virtchnl.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_virtchnl.h
@@ -19,6 +19,15 @@
 #define ICE_MAX_MACADDR_PER_VF		18
 #define ICE_FLEX_DESC_RXDID_MAX_NUM	64
 
+/* VFs only get a single VSI. For ice hardware, the VF does not need to know
+ * its VSI index. However, the virtchnl interface requires a VSI number,
+ * mainly due to legacy hardware.
+ *
+ * Since the VF doesn't need this information, report a static value to the VF
+ * instead of leaking any information about the PF or hardware setup.
+ */
+#define ICE_VF_VSI_ID	1
+
 struct ice_virtchnl_ops {
 	int (*get_ver_msg)(struct ice_vf *vf, u8 *msg);
 	int (*get_vf_res_msg)(struct ice_vf *vf, u8 *msg);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
@@ -94,9 +94,6 @@
 	if (!(vf->driver_caps & VIRTCHNL_VF_OFFLOAD_FDIR_PF))
 		return -EINVAL;
 
-	if (vsi_id != vf->lan_vsi_num)
-		return -EINVAL;
-
 	if (!ice_vc_isvalid_vsi_id(vf, vsi_id))
 		return -EINVAL;
 
@@ -539,6 +536,8 @@
 		fdir->fdir_fltr_cnt[flow][0] = 0;
 		fdir->fdir_fltr_cnt[flow][1] = 0;
 	}
+
+	fdir->fdir_fltr_cnt_total = 0;
 }
 
 /**
@@ -1563,6 +1562,7 @@
 	resp->status = status;
 	resp->flow_id = conf->flow_id;
 	vf->fdir.fdir_fltr_cnt[conf->input.flow_type][is_tun]++;
+	vf->fdir.fdir_fltr_cnt_total++;
 
 	ret = ice_vc_send_msg_to_vf(vf, ctx->v_opcode, v_ret,
 				    (u8 *)resp, len);
@@ -1627,6 +1627,7 @@
 	resp->status = status;
 	ice_vc_fdir_remove_entry(vf, conf, conf->flow_id);
 	vf->fdir.fdir_fltr_cnt[conf->input.flow_type][is_tun]--;
+	vf->fdir.fdir_fltr_cnt_total--;
 
 	ret = ice_vc_send_msg_to_vf(vf, ctx->v_opcode, v_ret,
 				    (u8 *)resp, len);
@@ -1793,6 +1794,7 @@
 	struct virtchnl_fdir_add *stat = NULL;
 	struct virtchnl_fdir_fltr_conf *conf;
 	enum virtchnl_status_code v_ret;
+	struct ice_vsi *vf_vsi;
 	struct device *dev;
 	struct ice_pf *pf;
 	int is_tun = 0;
@@ -1801,6 +1803,17 @@
 
 	pf = vf->pf;
 	dev = ice_pf_to_dev(pf);
+	vf_vsi = ice_get_vf_vsi(vf);
+
+#define ICE_VF_MAX_FDIR_FILTERS	128
+	if (!ice_fdir_num_avail_fltr(&pf->hw, vf_vsi) ||
+	    vf->fdir.fdir_fltr_cnt_total >= ICE_VF_MAX_FDIR_FILTERS) {
+		v_ret = VIRTCHNL_STATUS_ERR_PARAM;
+		dev_err(dev, "Max number of FDIR filters for VF %d is reached\n",
+			vf->vf_id);
+		goto err_exit;
+	}
+
 	ret = ice_vc_fdir_param_check(vf, fltr->vsi_id);
 	if (ret) {
 		v_ret = VIRTCHNL_STATUS_ERR_PARAM;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h
@@ -29,6 +29,7 @@
 struct ice_vf_fdir {
 	u16 fdir_fltr_cnt[ICE_FLTR_PTYPE_MAX][ICE_FD_HW_SEG_MAX];
 	int prof_entry_cnt[ICE_FLTR_PTYPE_MAX][ICE_FD_HW_SEG_MAX];
+	u16 fdir_fltr_cnt_total;
 	struct ice_fd_hw_prof **fdir_prof;
 
 	struct idr fdir_rule_idr;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c
@@ -45,14 +45,15 @@
 		return -EINVAL;
 
 	err = ice_fltr_add_vlan(vsi, vlan);
-	if (err && err != -EEXIST) {
+	if (!err)
+		vsi->num_vlan++;
+	else if (err == -EEXIST)
+		err = 0;
+	else
 		dev_err(ice_pf_to_dev(vsi->back), "Failure Adding VLAN %d on VSI %i, status %d\n",
 			vlan->vid, vsi->vsi_num, err);
-		return err;
-	}
 
-	vsi->num_vlan++;
-	return 0;
+	return err;
 }
 
 /**
@@ -785,4 +786,61 @@
 
 	kfree(ctxt);
 	return err;
+}
+
+int ice_vsi_clear_port_vlan(struct ice_vsi *vsi)
+{
+	struct ice_hw *hw = &vsi->back->hw;
+	struct ice_vsi_ctx *ctxt;
+	int err;
+
+	ctxt = kzalloc(sizeof(*ctxt), GFP_KERNEL);
+	if (!ctxt)
+		return -ENOMEM;
+
+	ctxt->info = vsi->info;
+
+	ctxt->info.port_based_outer_vlan = 0;
+	ctxt->info.port_based_inner_vlan = 0;
+
+	ctxt->info.inner_vlan_flags =
+		FIELD_PREP(ICE_AQ_VSI_INNER_VLAN_TX_MODE_M,
+			   ICE_AQ_VSI_INNER_VLAN_TX_MODE_ALL);
+	if (ice_is_dvm_ena(hw)) {
+		ctxt->info.inner_vlan_flags |=
+			FIELD_PREP(ICE_AQ_VSI_INNER_VLAN_EMODE_M,
+				   ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING);
+		ctxt->info.outer_vlan_flags =
+			FIELD_PREP(ICE_AQ_VSI_OUTER_VLAN_TX_MODE_M,
+				   ICE_AQ_VSI_OUTER_VLAN_TX_MODE_ALL);
+		ctxt->info.outer_vlan_flags |=
+			FIELD_PREP(ICE_AQ_VSI_OUTER_TAG_TYPE_M,
+				   ICE_AQ_VSI_OUTER_TAG_VLAN_8100);
+		ctxt->info.outer_vlan_flags |=
+			ICE_AQ_VSI_OUTER_VLAN_EMODE_NOTHING <<
+			ICE_AQ_VSI_OUTER_VLAN_EMODE_S;
+	}
+
+	ctxt->info.sw_flags2 &= ~ICE_AQ_VSI_SW_FLAG_RX_VLAN_PRUNE_ENA;
+	ctxt->info.valid_sections =
+		cpu_to_le16(ICE_AQ_VSI_PROP_OUTER_TAG_VALID |
+			    ICE_AQ_VSI_PROP_VLAN_VALID |
+			    ICE_AQ_VSI_PROP_SW_VALID);
+
+	err = ice_update_vsi(hw, vsi->idx, ctxt, NULL);
+	if (err) {
+		dev_err(ice_pf_to_dev(vsi->back), "update VSI for clearing port based VLAN failed, err %d aq_err %s\n",
+			err, ice_aq_str(hw->adminq.sq_last_status));
+	} else {
+		vsi->info.port_based_outer_vlan =
+			ctxt->info.port_based_outer_vlan;
+		vsi->info.port_based_inner_vlan =
+			ctxt->info.port_based_inner_vlan;
+		vsi->info.outer_vlan_flags = ctxt->info.outer_vlan_flags;
+		vsi->info.inner_vlan_flags = ctxt->info.inner_vlan_flags;
+		vsi->info.sw_flags2 = ctxt->info.sw_flags2;
+	}
+
+	kfree(ctxt);
+	return err;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.h
@@ -36,5 +36,6 @@
 int ice_vsi_dis_outer_insertion(struct ice_vsi *vsi);
 int ice_vsi_set_outer_port_vlan(struct ice_vsi *vsi, struct ice_vlan *vlan);
 int ice_vsi_clear_outer_port_vlan(struct ice_vsi *vsi);
+int ice_vsi_clear_port_vlan(struct ice_vsi *vsi);
 
 #endif /* _ICE_VSI_VLAN_LIB_H_ */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_xsk.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_xsk.c
@@ -39,7 +39,7 @@
 	       sizeof(vsi_stat->rx_ring_stats[q_idx]->rx_stats));
 	memset(&vsi_stat->tx_ring_stats[q_idx]->stats, 0,
 	       sizeof(vsi_stat->tx_ring_stats[q_idx]->stats));
-	if (ice_is_xdp_ena_vsi(vsi))
+	if (vsi->xdp_rings)
 		memset(&vsi->xdp_rings[q_idx]->ring_stats->stats, 0,
 		       sizeof(vsi->xdp_rings[q_idx]->ring_stats->stats));
 }
@@ -52,10 +52,8 @@
 static void ice_qp_clean_rings(struct ice_vsi *vsi, u16 q_idx)
 {
 	ice_clean_tx_ring(vsi->tx_rings[q_idx]);
-	if (ice_is_xdp_ena_vsi(vsi)) {
-		synchronize_rcu();
+	if (vsi->xdp_rings)
 		ice_clean_tx_ring(vsi->xdp_rings[q_idx]);
-	}
 	ice_clean_rx_ring(vsi->rx_rings[q_idx]);
 }
 
@@ -112,25 +110,29 @@
  * ice_qvec_cfg_msix - Enable IRQ for given queue vector
  * @vsi: the VSI that contains queue vector
  * @q_vector: queue vector
+ * @qid: queue index
  */
 static void
-ice_qvec_cfg_msix(struct ice_vsi *vsi, struct ice_q_vector *q_vector)
+ice_qvec_cfg_msix(struct ice_vsi *vsi, struct ice_q_vector *q_vector, u16 qid)
 {
 	u16 reg_idx = q_vector->reg_idx;
 	struct ice_pf *pf = vsi->back;
 	struct ice_hw *hw = &pf->hw;
-	struct ice_tx_ring *tx_ring;
-	struct ice_rx_ring *rx_ring;
+	int q, _qid = qid;
 
 	ice_cfg_itr(hw, q_vector);
 
-	ice_for_each_tx_ring(tx_ring, q_vector->tx)
-		ice_cfg_txq_interrupt(vsi, tx_ring->reg_idx, reg_idx,
-				      q_vector->tx.itr_idx);
-
-	ice_for_each_rx_ring(rx_ring, q_vector->rx)
-		ice_cfg_rxq_interrupt(vsi, rx_ring->reg_idx, reg_idx,
-				      q_vector->rx.itr_idx);
+	for (q = 0; q < q_vector->num_ring_tx; q++) {
+		ice_cfg_txq_interrupt(vsi, _qid, reg_idx, q_vector->tx.itr_idx);
+		_qid++;
+	}
+
+	_qid = qid;
+
+	for (q = 0; q < q_vector->num_ring_rx; q++) {
+		ice_cfg_rxq_interrupt(vsi, _qid, reg_idx, q_vector->rx.itr_idx);
+		_qid++;
+	}
 
 	ice_flush(hw);
 }
@@ -163,7 +165,7 @@
 	struct ice_q_vector *q_vector;
 	struct ice_tx_ring *tx_ring;
 	struct ice_rx_ring *rx_ring;
-	int timeout = 50;
+	int fail = 0;
 	int err;
 
 	if (q_idx >= vsi->num_rxq || q_idx >= vsi->num_txq)
@@ -173,40 +175,33 @@
 	rx_ring = vsi->rx_rings[q_idx];
 	q_vector = rx_ring->q_vector;
 
-	while (test_and_set_bit(ICE_CFG_BUSY, vsi->state)) {
-		timeout--;
-		if (!timeout)
-			return -EBUSY;
-		usleep_range(1000, 2000);
-	}
+	synchronize_net();
+	netif_carrier_off(vsi->netdev);
+	netif_tx_stop_queue(netdev_get_tx_queue(vsi->netdev, q_idx));
 
 	ice_qvec_dis_irq(vsi, rx_ring, q_vector);
 	ice_qvec_toggle_napi(vsi, q_vector, false);
 
-	netif_tx_stop_queue(netdev_get_tx_queue(vsi->netdev, q_idx));
-
 	ice_fill_txq_meta(vsi, tx_ring, &txq_meta);
 	err = ice_vsi_stop_tx_ring(vsi, ICE_NO_RESET, 0, tx_ring, &txq_meta);
-	if (err)
-		return err;
-	if (ice_is_xdp_ena_vsi(vsi)) {
+	if (!fail)
+		fail = err;
+	if (vsi->xdp_rings) {
 		struct ice_tx_ring *xdp_ring = vsi->xdp_rings[q_idx];
 
 		memset(&txq_meta, 0, sizeof(txq_meta));
 		ice_fill_txq_meta(vsi, xdp_ring, &txq_meta);
 		err = ice_vsi_stop_tx_ring(vsi, ICE_NO_RESET, 0, xdp_ring,
 					   &txq_meta);
-		if (err)
-			return err;
+		if (!fail)
+			fail = err;
 	}
-	err = ice_vsi_ctrl_one_rx_ring(vsi, false, q_idx, true);
-	if (err)
-		return err;
 
+	ice_vsi_ctrl_one_rx_ring(vsi, false, q_idx, false);
 	ice_qp_clean_rings(vsi, q_idx);
 	ice_qp_reset_stats(vsi, q_idx);
 
-	return 0;
+	return fail;
 }
 
 /**
@@ -218,55 +213,48 @@
  */
 static int ice_qp_ena(struct ice_vsi *vsi, u16 q_idx)
 {
-	DEFINE_FLEX(struct ice_aqc_add_tx_qgrp, qg_buf, txqs, 1);
-	u16 size = __struct_size(qg_buf);
 	struct ice_q_vector *q_vector;
-	struct ice_tx_ring *tx_ring;
-	struct ice_rx_ring *rx_ring;
+	int fail = 0;
+	bool link_up;
 	int err;
 
-	if (q_idx >= vsi->num_rxq || q_idx >= vsi->num_txq)
-		return -EINVAL;
-
-	qg_buf->num_txqs = 1;
-
-	tx_ring = vsi->tx_rings[q_idx];
-	rx_ring = vsi->rx_rings[q_idx];
-	q_vector = rx_ring->q_vector;
-
-	err = ice_vsi_cfg_txq(vsi, tx_ring, qg_buf);
-	if (err)
-		return err;
+	err = ice_vsi_cfg_single_txq(vsi, vsi->tx_rings, q_idx);
+	if (!fail)
+		fail = err;
 
 	if (ice_is_xdp_ena_vsi(vsi)) {
 		struct ice_tx_ring *xdp_ring = vsi->xdp_rings[q_idx];
 
-		memset(qg_buf, 0, size);
-		qg_buf->num_txqs = 1;
-		err = ice_vsi_cfg_txq(vsi, xdp_ring, qg_buf);
-		if (err)
-			return err;
+		err = ice_vsi_cfg_single_txq(vsi, vsi->xdp_rings, q_idx);
+		if (!fail)
+			fail = err;
 		ice_set_ring_xdp(xdp_ring);
 		ice_tx_xsk_pool(vsi, q_idx);
 	}
 
-	err = ice_vsi_cfg_rxq(rx_ring);
-	if (err)
-		return err;
+	err = ice_vsi_cfg_single_rxq(vsi, q_idx);
+	if (!fail)
+		fail = err;
 
-	ice_qvec_cfg_msix(vsi, q_vector);
+	q_vector = vsi->rx_rings[q_idx]->q_vector;
+	ice_qvec_cfg_msix(vsi, q_vector, q_idx);
 
 	err = ice_vsi_ctrl_one_rx_ring(vsi, true, q_idx, true);
-	if (err)
-		return err;
+	if (!fail)
+		fail = err;
 
 	ice_qvec_toggle_napi(vsi, q_vector, true);
 	ice_qvec_ena_irq(vsi, q_vector);
 
-	netif_tx_start_queue(netdev_get_tx_queue(vsi->netdev, q_idx));
-	clear_bit(ICE_CFG_BUSY, vsi->state);
+	/* make sure NAPI sees updated ice_{t,x}_ring::xsk_pool */
+	synchronize_net();
+	ice_get_link_status(vsi->port_info, &link_up);
+	if (link_up) {
+		netif_tx_start_queue(netdev_get_tx_queue(vsi->netdev, q_idx));
+		netif_carrier_on(vsi->netdev);
+	}
 
-	return 0;
+	return fail;
 }
 
 /**
@@ -283,7 +271,6 @@
 	if (!pool)
 		return -EINVAL;
 
-	clear_bit(qid, vsi->af_xdp_zc_qps);
 	xsk_pool_dma_unmap(pool, ICE_RX_DMA_ATTR);
 
 	return 0;
@@ -314,8 +301,6 @@
 	if (err)
 		return err;
 
-	set_bit(qid, vsi->af_xdp_zc_qps);
-
 	return 0;
 }
 
@@ -363,11 +348,13 @@
 int ice_realloc_zc_buf(struct ice_vsi *vsi, bool zc)
 {
 	struct ice_rx_ring *rx_ring;
-	unsigned long q;
+	uint i;
+
+	ice_for_each_rxq(vsi, i) {
+		rx_ring = vsi->rx_rings[i];
+		if (!rx_ring->xsk_pool)
+			continue;
 
-	for_each_set_bit(q, vsi->af_xdp_zc_qps,
-			 max_t(int, vsi->alloc_txq, vsi->alloc_rxq)) {
-		rx_ring = vsi->rx_rings[q];
 		if (ice_realloc_rx_xdp_bufs(rx_ring, zc))
 			return -ENOMEM;
 	}
@@ -394,7 +381,8 @@
 		goto failure;
 	}
 
-	if_running = netif_running(vsi->netdev) && ice_is_xdp_ena_vsi(vsi);
+	if_running = !test_bit(ICE_VSI_DOWN, vsi->state) &&
+		     ice_is_xdp_ena_vsi(vsi);
 
 	if (if_running) {
 		struct ice_rx_ring *rx_ring = vsi->rx_rings[qid];
@@ -474,6 +462,7 @@
 /**
  * __ice_alloc_rx_bufs_zc - allocate a number of Rx buffers
  * @rx_ring: Rx ring
+ * @xsk_pool: XSK buffer pool to pick buffers to be filled by HW
  * @count: The number of buffers to allocate
  *
  * Place the @count of descriptors onto Rx ring. Handle the ring wrap
@@ -482,7 +471,8 @@
  *
  * Returns true if all allocations were successful, false if any fail.
  */
-static bool __ice_alloc_rx_bufs_zc(struct ice_rx_ring *rx_ring, u16 count)
+static bool __ice_alloc_rx_bufs_zc(struct ice_rx_ring *rx_ring,
+				   struct xsk_buff_pool *xsk_pool, u16 count)
 {
 	u32 nb_buffs_extra = 0, nb_buffs = 0;
 	union ice_32b_rx_flex_desc *rx_desc;
@@ -494,8 +484,7 @@
 	xdp = ice_xdp_buf(rx_ring, ntu);
 
 	if (ntu + count >= rx_ring->count) {
-		nb_buffs_extra = ice_fill_rx_descs(rx_ring->xsk_pool, xdp,
-						   rx_desc,
+		nb_buffs_extra = ice_fill_rx_descs(xsk_pool, xdp, rx_desc,
 						   rx_ring->count - ntu);
 		if (nb_buffs_extra != rx_ring->count - ntu) {
 			ntu += nb_buffs_extra;
@@ -508,7 +497,7 @@
 		ice_release_rx_desc(rx_ring, 0);
 	}
 
-	nb_buffs = ice_fill_rx_descs(rx_ring->xsk_pool, xdp, rx_desc, count);
+	nb_buffs = ice_fill_rx_descs(xsk_pool, xdp, rx_desc, count);
 
 	ntu += nb_buffs;
 	if (ntu == rx_ring->count)
@@ -524,6 +513,7 @@
 /**
  * ice_alloc_rx_bufs_zc - allocate a number of Rx buffers
  * @rx_ring: Rx ring
+ * @xsk_pool: XSK buffer pool to pick buffers to be filled by HW
  * @count: The number of buffers to allocate
  *
  * Wrapper for internal allocation routine; figure out how many tail
@@ -531,7 +521,8 @@
  *
  * Returns true if all calls to internal alloc routine succeeded
  */
-bool ice_alloc_rx_bufs_zc(struct ice_rx_ring *rx_ring, u16 count)
+bool ice_alloc_rx_bufs_zc(struct ice_rx_ring *rx_ring,
+			  struct xsk_buff_pool *xsk_pool, u16 count)
 {
 	u16 rx_thresh = ICE_RING_QUARTER(rx_ring);
 	u16 leftover, i, tail_bumps;
@@ -540,9 +531,9 @@
 	leftover = count - (tail_bumps * rx_thresh);
 
 	for (i = 0; i < tail_bumps; i++)
-		if (!__ice_alloc_rx_bufs_zc(rx_ring, rx_thresh))
+		if (!__ice_alloc_rx_bufs_zc(rx_ring, xsk_pool, rx_thresh))
 			return false;
-	return __ice_alloc_rx_bufs_zc(rx_ring, leftover);
+	return __ice_alloc_rx_bufs_zc(rx_ring, xsk_pool, leftover);
 }
 
 /**
@@ -612,8 +603,10 @@
 /**
  * ice_clean_xdp_irq_zc - produce AF_XDP descriptors to CQ
  * @xdp_ring: XDP Tx ring
+ * @xsk_pool: AF_XDP buffer pool pointer
  */
-static u32 ice_clean_xdp_irq_zc(struct ice_tx_ring *xdp_ring)
+static u32 ice_clean_xdp_irq_zc(struct ice_tx_ring *xdp_ring,
+				struct xsk_buff_pool *xsk_pool)
 {
 	u16 ntc = xdp_ring->next_to_clean;
 	struct ice_tx_desc *tx_desc;
@@ -664,7 +657,7 @@
 	if (xdp_ring->next_to_clean >= cnt)
 		xdp_ring->next_to_clean -= cnt;
 	if (xsk_frames)
-		xsk_tx_completed(xdp_ring->xsk_pool, xsk_frames);
+		xsk_tx_completed(xsk_pool, xsk_frames);
 
 	return completed_frames;
 }
@@ -673,6 +666,7 @@
  * ice_xmit_xdp_tx_zc - AF_XDP ZC handler for XDP_TX
  * @xdp: XDP buffer to xmit
  * @xdp_ring: XDP ring to produce descriptor onto
+ * @xsk_pool: AF_XDP buffer pool pointer
  *
  * note that this function works directly on xdp_buff, no need to convert
  * it to xdp_frame. xdp_buff pointer is stored to ice_tx_buf so that cleaning
@@ -682,7 +676,8 @@
  * was not enough space on XDP ring
  */
 static int ice_xmit_xdp_tx_zc(struct xdp_buff *xdp,
-			      struct ice_tx_ring *xdp_ring)
+			      struct ice_tx_ring *xdp_ring,
+			      struct xsk_buff_pool *xsk_pool)
 {
 	struct skb_shared_info *sinfo = NULL;
 	u32 size = xdp->data_end - xdp->data;
@@ -696,7 +691,7 @@
 
 	free_space = ICE_DESC_UNUSED(xdp_ring);
 	if (free_space < ICE_RING_QUARTER(xdp_ring))
-		free_space += ice_clean_xdp_irq_zc(xdp_ring);
+		free_space += ice_clean_xdp_irq_zc(xdp_ring, xsk_pool);
 
 	if (unlikely(!free_space))
 		goto busy;
@@ -716,7 +711,7 @@
 		dma_addr_t dma;
 
 		dma = xsk_buff_xdp_get_dma(xdp);
-		xsk_buff_raw_dma_sync_for_device(xdp_ring->xsk_pool, dma, size);
+		xsk_buff_raw_dma_sync_for_device(xsk_pool, dma, size);
 
 		tx_buf->xdp = xdp;
 		tx_buf->type = ICE_TX_BUF_XSK_TX;
@@ -758,12 +753,14 @@
  * @xdp: xdp_buff used as input to the XDP program
  * @xdp_prog: XDP program to run
  * @xdp_ring: ring to be used for XDP_TX action
+ * @xsk_pool: AF_XDP buffer pool pointer
  *
  * Returns any of ICE_XDP_{PASS, CONSUMED, TX, REDIR}
  */
 static int
 ice_run_xdp_zc(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp,
-	       struct bpf_prog *xdp_prog, struct ice_tx_ring *xdp_ring)
+	       struct bpf_prog *xdp_prog, struct ice_tx_ring *xdp_ring,
+	       struct xsk_buff_pool *xsk_pool)
 {
 	int err, result = ICE_XDP_PASS;
 	u32 act;
@@ -774,7 +771,7 @@
 		err = xdp_do_redirect(rx_ring->netdev, xdp, xdp_prog);
 		if (!err)
 			return ICE_XDP_REDIR;
-		if (xsk_uses_need_wakeup(rx_ring->xsk_pool) && err == -ENOBUFS)
+		if (xsk_uses_need_wakeup(xsk_pool) && err == -ENOBUFS)
 			result = ICE_XDP_EXIT;
 		else
 			result = ICE_XDP_CONSUMED;
@@ -785,7 +782,7 @@
 	case XDP_PASS:
 		break;
 	case XDP_TX:
-		result = ice_xmit_xdp_tx_zc(xdp, xdp_ring);
+		result = ice_xmit_xdp_tx_zc(xdp, xdp_ring, xsk_pool);
 		if (result == ICE_XDP_CONSUMED)
 			goto out_failure;
 		break;
@@ -837,14 +834,16 @@
 /**
  * ice_clean_rx_irq_zc - consumes packets from the hardware ring
  * @rx_ring: AF_XDP Rx ring
+ * @xsk_pool: AF_XDP buffer pool pointer
  * @budget: NAPI budget
  *
  * Returns number of processed packets on success, remaining budget on failure.
  */
-int ice_clean_rx_irq_zc(struct ice_rx_ring *rx_ring, int budget)
+int ice_clean_rx_irq_zc(struct ice_rx_ring *rx_ring,
+			struct xsk_buff_pool *xsk_pool,
+			int budget)
 {
 	unsigned int total_rx_bytes = 0, total_rx_packets = 0;
-	struct xsk_buff_pool *xsk_pool = rx_ring->xsk_pool;
 	u32 ntc = rx_ring->next_to_clean;
 	u32 ntu = rx_ring->next_to_use;
 	struct xdp_buff *first = NULL;
@@ -907,7 +906,8 @@
 		if (ice_is_non_eop(rx_ring, rx_desc))
 			continue;
 
-		xdp_res = ice_run_xdp_zc(rx_ring, first, xdp_prog, xdp_ring);
+		xdp_res = ice_run_xdp_zc(rx_ring, first, xdp_prog, xdp_ring,
+					 xsk_pool);
 		if (likely(xdp_res & (ICE_XDP_TX | ICE_XDP_REDIR))) {
 			xdp_xmit |= xdp_res;
 		} else if (xdp_res == ICE_XDP_EXIT) {
@@ -956,7 +956,8 @@
 	rx_ring->next_to_clean = ntc;
 	entries_to_alloc = ICE_RX_DESC_UNUSED(rx_ring);
 	if (entries_to_alloc > ICE_RING_QUARTER(rx_ring))
-		failure |= !ice_alloc_rx_bufs_zc(rx_ring, entries_to_alloc);
+		failure |= !ice_alloc_rx_bufs_zc(rx_ring, xsk_pool,
+						 entries_to_alloc);
 
 	ice_finalize_xdp_rx(xdp_ring, xdp_xmit, 0);
 	ice_update_rx_ring_stats(rx_ring, total_rx_packets, total_rx_bytes);
@@ -979,17 +980,19 @@
 /**
  * ice_xmit_pkt - produce a single HW Tx descriptor out of AF_XDP descriptor
  * @xdp_ring: XDP ring to produce the HW Tx descriptor on
+ * @xsk_pool: XSK buffer pool to pick buffers to be consumed by HW
  * @desc: AF_XDP descriptor to pull the DMA address and length from
  * @total_bytes: bytes accumulator that will be used for stats update
  */
-static void ice_xmit_pkt(struct ice_tx_ring *xdp_ring, struct xdp_desc *desc,
+static void ice_xmit_pkt(struct ice_tx_ring *xdp_ring,
+			 struct xsk_buff_pool *xsk_pool, struct xdp_desc *desc,
 			 unsigned int *total_bytes)
 {
 	struct ice_tx_desc *tx_desc;
 	dma_addr_t dma;
 
-	dma = xsk_buff_raw_get_dma(xdp_ring->xsk_pool, desc->addr);
-	xsk_buff_raw_dma_sync_for_device(xdp_ring->xsk_pool, dma, desc->len);
+	dma = xsk_buff_raw_get_dma(xsk_pool, desc->addr);
+	xsk_buff_raw_dma_sync_for_device(xsk_pool, dma, desc->len);
 
 	tx_desc = ICE_TX_DESC(xdp_ring, xdp_ring->next_to_use++);
 	tx_desc->buf_addr = cpu_to_le64(dma);
@@ -1002,10 +1005,13 @@
 /**
  * ice_xmit_pkt_batch - produce a batch of HW Tx descriptors out of AF_XDP descriptors
  * @xdp_ring: XDP ring to produce the HW Tx descriptors on
+ * @xsk_pool: XSK buffer pool to pick buffers to be consumed by HW
  * @descs: AF_XDP descriptors to pull the DMA addresses and lengths from
  * @total_bytes: bytes accumulator that will be used for stats update
  */
-static void ice_xmit_pkt_batch(struct ice_tx_ring *xdp_ring, struct xdp_desc *descs,
+static void ice_xmit_pkt_batch(struct ice_tx_ring *xdp_ring,
+			       struct xsk_buff_pool *xsk_pool,
+			       struct xdp_desc *descs,
 			       unsigned int *total_bytes)
 {
 	u16 ntu = xdp_ring->next_to_use;
@@ -1015,8 +1021,8 @@
 	loop_unrolled_for(i = 0; i < PKTS_PER_BATCH; i++) {
 		dma_addr_t dma;
 
-		dma = xsk_buff_raw_get_dma(xdp_ring->xsk_pool, descs[i].addr);
-		xsk_buff_raw_dma_sync_for_device(xdp_ring->xsk_pool, dma, descs[i].len);
+		dma = xsk_buff_raw_get_dma(xsk_pool, descs[i].addr);
+		xsk_buff_raw_dma_sync_for_device(xsk_pool, dma, descs[i].len);
 
 		tx_desc = ICE_TX_DESC(xdp_ring, ntu++);
 		tx_desc->buf_addr = cpu_to_le64(dma);
@@ -1032,60 +1038,69 @@
 /**
  * ice_fill_tx_hw_ring - produce the number of Tx descriptors onto ring
  * @xdp_ring: XDP ring to produce the HW Tx descriptors on
+ * @xsk_pool: XSK buffer pool to pick buffers to be consumed by HW
  * @descs: AF_XDP descriptors to pull the DMA addresses and lengths from
  * @nb_pkts: count of packets to be send
  * @total_bytes: bytes accumulator that will be used for stats update
  */
-static void ice_fill_tx_hw_ring(struct ice_tx_ring *xdp_ring, struct xdp_desc *descs,
-				u32 nb_pkts, unsigned int *total_bytes)
+static void ice_fill_tx_hw_ring(struct ice_tx_ring *xdp_ring,
+				struct xsk_buff_pool *xsk_pool,
+				struct xdp_desc *descs, u32 nb_pkts,
+				unsigned int *total_bytes)
 {
 	u32 batched, leftover, i;
 
 	batched = ALIGN_DOWN(nb_pkts, PKTS_PER_BATCH);
 	leftover = nb_pkts & (PKTS_PER_BATCH - 1);
 	for (i = 0; i < batched; i += PKTS_PER_BATCH)
-		ice_xmit_pkt_batch(xdp_ring, &descs[i], total_bytes);
+		ice_xmit_pkt_batch(xdp_ring, xsk_pool, &descs[i], total_bytes);
 	for (; i < batched + leftover; i++)
-		ice_xmit_pkt(xdp_ring, &descs[i], total_bytes);
+		ice_xmit_pkt(xdp_ring, xsk_pool, &descs[i], total_bytes);
 }
 
 /**
  * ice_xmit_zc - take entries from XSK Tx ring and place them onto HW Tx ring
  * @xdp_ring: XDP ring to produce the HW Tx descriptors on
+ * @xsk_pool: AF_XDP buffer pool pointer
  *
  * Returns true if there is no more work that needs to be done, false otherwise
  */
-bool ice_xmit_zc(struct ice_tx_ring *xdp_ring)
+bool ice_xmit_zc(struct ice_tx_ring *xdp_ring, struct xsk_buff_pool *xsk_pool)
 {
-	struct xdp_desc *descs = xdp_ring->xsk_pool->tx_descs;
+	struct xdp_desc *descs = xsk_pool->tx_descs;
 	u32 nb_pkts, nb_processed = 0;
 	unsigned int total_bytes = 0;
 	int budget;
 
-	ice_clean_xdp_irq_zc(xdp_ring);
+	ice_clean_xdp_irq_zc(xdp_ring, xsk_pool);
+
+	if (!netif_carrier_ok(xdp_ring->vsi->netdev) ||
+	    !netif_running(xdp_ring->vsi->netdev))
+		return true;
 
 	budget = ICE_DESC_UNUSED(xdp_ring);
 	budget = min_t(u16, budget, ICE_RING_QUARTER(xdp_ring));
 
-	nb_pkts = xsk_tx_peek_release_desc_batch(xdp_ring->xsk_pool, budget);
+	nb_pkts = xsk_tx_peek_release_desc_batch(xsk_pool, budget);
 	if (!nb_pkts)
 		return true;
 
 	if (xdp_ring->next_to_use + nb_pkts >= xdp_ring->count) {
 		nb_processed = xdp_ring->count - xdp_ring->next_to_use;
-		ice_fill_tx_hw_ring(xdp_ring, descs, nb_processed, &total_bytes);
+		ice_fill_tx_hw_ring(xdp_ring, xsk_pool, descs, nb_processed,
+				    &total_bytes);
 		xdp_ring->next_to_use = 0;
 	}
 
-	ice_fill_tx_hw_ring(xdp_ring, &descs[nb_processed], nb_pkts - nb_processed,
-			    &total_bytes);
+	ice_fill_tx_hw_ring(xdp_ring, xsk_pool, &descs[nb_processed],
+			    nb_pkts - nb_processed, &total_bytes);
 
 	ice_set_rs_bit(xdp_ring);
 	ice_xdp_ring_update_tail(xdp_ring);
 	ice_update_tx_ring_stats(xdp_ring, nb_pkts, total_bytes);
 
-	if (xsk_uses_need_wakeup(xdp_ring->xsk_pool))
-		xsk_set_tx_need_wakeup(xdp_ring->xsk_pool);
+	if (xsk_uses_need_wakeup(xsk_pool))
+		xsk_set_tx_need_wakeup(xsk_pool);
 
 	return nb_pkts < budget;
 }
@@ -1107,7 +1122,7 @@
 	struct ice_vsi *vsi = np->vsi;
 	struct ice_tx_ring *ring;
 
-	if (test_bit(ICE_VSI_DOWN, vsi->state))
+	if (test_bit(ICE_VSI_DOWN, vsi->state) || !netif_carrier_ok(netdev))
 		return -ENETDOWN;
 
 	if (!ice_is_xdp_ena_vsi(vsi))
@@ -1118,7 +1133,7 @@
 
 	ring = vsi->rx_rings[queue_id]->xdp_ring;
 
-	if (!ring->xsk_pool)
+	if (!READ_ONCE(ring->xsk_pool))
 		return -EINVAL;
 
 	/* The idea here is that if NAPI is running, mark a miss, so
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ice/ice_xsk.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ice/ice_xsk.h
@@ -20,16 +20,20 @@
 #ifdef CONFIG_XDP_SOCKETS
 int ice_xsk_pool_setup(struct ice_vsi *vsi, struct xsk_buff_pool *pool,
 		       u16 qid);
-int ice_clean_rx_irq_zc(struct ice_rx_ring *rx_ring, int budget);
+int ice_clean_rx_irq_zc(struct ice_rx_ring *rx_ring,
+			struct xsk_buff_pool *xsk_pool,
+			int budget);
 int ice_xsk_wakeup(struct net_device *netdev, u32 queue_id, u32 flags);
-bool ice_alloc_rx_bufs_zc(struct ice_rx_ring *rx_ring, u16 count);
+bool ice_alloc_rx_bufs_zc(struct ice_rx_ring *rx_ring,
+			  struct xsk_buff_pool *xsk_pool, u16 count);
 bool ice_xsk_any_rx_ring_ena(struct ice_vsi *vsi);
 void ice_xsk_clean_rx_ring(struct ice_rx_ring *rx_ring);
 void ice_xsk_clean_xdp_ring(struct ice_tx_ring *xdp_ring);
-bool ice_xmit_zc(struct ice_tx_ring *xdp_ring);
+bool ice_xmit_zc(struct ice_tx_ring *xdp_ring, struct xsk_buff_pool *xsk_pool);
 int ice_realloc_zc_buf(struct ice_vsi *vsi, bool zc);
 #else
-static inline bool ice_xmit_zc(struct ice_tx_ring __always_unused *xdp_ring)
+static inline bool ice_xmit_zc(struct ice_tx_ring __always_unused *xdp_ring,
+			       struct xsk_buff_pool __always_unused *xsk_pool)
 {
 	return false;
 }
@@ -44,6 +48,7 @@
 
 static inline int
 ice_clean_rx_irq_zc(struct ice_rx_ring __always_unused *rx_ring,
+		    struct xsk_buff_pool __always_unused *xsk_pool,
 		    int __always_unused budget)
 {
 	return 0;
@@ -51,6 +56,7 @@
 
 static inline bool
 ice_alloc_rx_bufs_zc(struct ice_rx_ring __always_unused *rx_ring,
+		     struct xsk_buff_pool __always_unused *xsk_pool,
 		     u16 __always_unused count)
 {
 	return false;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/idpf/idpf.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/idpf/idpf.h
@@ -20,7 +20,6 @@
 #include <linux/dim.h>
 
 #include "virtchnl2.h"
-#include "idpf_lan_txrx.h"
 #include "idpf_txrx.h"
 #include "idpf_controlq.h"
 
@@ -145,6 +144,7 @@
  * @adapter: Adapter back pointer
  * @vport: Vport back pointer
  * @vport_id: Vport identifier
+ * @link_speed_mbps: Link speed in mbps
  * @vport_idx: Relative vport index
  * @state: See enum idpf_vport_state
  * @netstats: Packet and byte stats
@@ -154,6 +154,7 @@
 	struct idpf_adapter *adapter;
 	struct idpf_vport *vport;
 	u32 vport_id;
+	u32 link_speed_mbps;
 	u16 vport_idx;
 	enum idpf_vport_state state;
 	struct rtnl_link_stats64 netstats;
@@ -357,7 +358,6 @@
  * @tx_itr_profile: TX profiles for Dynamic Interrupt Moderation
  * @port_stats: per port csum, header split, and other offload stats
  * @link_up: True if link is up
- * @link_speed_mbps: Link speed in mbps
  * @vc_msg: Virtchnl message buffer
  * @vc_state: Virtchnl message state
  * @vchnl_wq: Wait queue for virtchnl messages
@@ -406,7 +406,6 @@
 	struct idpf_port_stats port_stats;
 
 	bool link_up;
-	u32 link_speed_mbps;
 
 	char vc_msg[IDPF_CTLQ_MAX_BUF_LEN];
 	DECLARE_BITMAP(vc_state, IDPF_VC_NBITS);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
@@ -222,14 +222,19 @@
 			     struct ethtool_channels *ch)
 {
 	struct idpf_vport_config *vport_config;
-	u16 combined, num_txq, num_rxq;
 	unsigned int num_req_tx_q;
 	unsigned int num_req_rx_q;
 	struct idpf_vport *vport;
+	u16 num_txq, num_rxq;
 	struct device *dev;
 	int err = 0;
 	u16 idx;
 
+	if (ch->rx_count && ch->tx_count) {
+		netdev_err(netdev, "Dedicated RX or TX channels cannot be used simultaneously\n");
+		return -EINVAL;
+	}
+
 	idpf_vport_ctrl_lock(netdev);
 	vport = idpf_netdev_to_vport(netdev);
 
@@ -239,20 +244,6 @@
 	num_txq = vport_config->user_config.num_req_tx_qs;
 	num_rxq = vport_config->user_config.num_req_rx_qs;
 
-	combined = min(num_txq, num_rxq);
-
-	/* these checks are for cases where user didn't specify a particular
-	 * value on cmd line but we get non-zero value anyway via
-	 * get_channels(); look at ethtool.c in ethtool repository (the user
-	 * space part), particularly, do_schannels() routine
-	 */
-	if (ch->combined_count == combined)
-		ch->combined_count = 0;
-	if (ch->combined_count && ch->rx_count == num_rxq - combined)
-		ch->rx_count = 0;
-	if (ch->combined_count && ch->tx_count == num_txq - combined)
-		ch->tx_count = 0;
-
 	num_req_tx_q = ch->combined_count + ch->tx_count;
 	num_req_rx_q = ch->combined_count + ch->rx_count;
 
@@ -376,7 +367,8 @@
 			    new_tx_count);
 
 	if (new_tx_count == vport->txq_desc_count &&
-	    new_rx_count == vport->rxq_desc_count)
+	    new_rx_count == vport->rxq_desc_count &&
+	    kring->tcp_data_split == idpf_vport_get_hsplit(vport))
 		goto unlock_mutex;
 
 	if (!idpf_vport_set_hsplit(vport, kring->tcp_data_split)) {
@@ -1318,24 +1310,19 @@
 static int idpf_get_link_ksettings(struct net_device *netdev,
 				   struct ethtool_link_ksettings *cmd)
 {
-	struct idpf_vport *vport;
-
-	idpf_vport_ctrl_lock(netdev);
-	vport = idpf_netdev_to_vport(netdev);
+	struct idpf_netdev_priv *np = netdev_priv(netdev);
 
 	ethtool_link_ksettings_zero_link_mode(cmd, supported);
 	cmd->base.autoneg = AUTONEG_DISABLE;
 	cmd->base.port = PORT_NONE;
-	if (vport->link_up) {
+	if (netif_carrier_ok(netdev)) {
 		cmd->base.duplex = DUPLEX_FULL;
-		cmd->base.speed = vport->link_speed_mbps;
+		cmd->base.speed = np->link_speed_mbps;
 	} else {
 		cmd->base.duplex = DUPLEX_UNKNOWN;
 		cmd->base.speed = SPEED_UNKNOWN;
 	}
 
-	idpf_vport_ctrl_unlock(netdev);
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/idpf/idpf_lan_txrx.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/idpf/idpf_lan_txrx.h
@@ -4,6 +4,8 @@
 #ifndef _IDPF_LAN_TXRX_H_
 #define _IDPF_LAN_TXRX_H_
 
+#include <linux/bits.h>
+
 enum idpf_rss_hash {
 	IDPF_HASH_INVALID			= 0,
 	/* Values 1 - 28 are reserved for future use */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/idpf/idpf_lib.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/idpf/idpf_lib.c
@@ -1419,6 +1419,7 @@
 	}
 
 	idpf_rx_init_buf_tail(vport);
+	idpf_vport_intr_ena(vport);
 
 	err = idpf_send_config_queues_msg(vport);
 	if (err) {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
@@ -205,7 +205,7 @@
 	data_len = skb->data_len;
 	size = skb_headlen(skb);
 
-	tx_desc = IDPF_BASE_TX_DESC(tx_q, i);
+	tx_desc = &tx_q->base_tx[i];
 
 	dma = dma_map_single(tx_q->dev, skb->data, size, DMA_TO_DEVICE);
 
@@ -239,7 +239,7 @@
 			i++;
 
 			if (i == tx_q->desc_count) {
-				tx_desc = IDPF_BASE_TX_DESC(tx_q, 0);
+				tx_desc = &tx_q->base_tx[0];
 				i = 0;
 			}
 
@@ -259,7 +259,7 @@
 		i++;
 
 		if (i == tx_q->desc_count) {
-			tx_desc = IDPF_BASE_TX_DESC(tx_q, 0);
+			tx_desc = &tx_q->base_tx[0];
 			i = 0;
 		}
 
@@ -307,7 +307,7 @@
 	memset(&txq->tx_buf[ntu], 0, sizeof(struct idpf_tx_buf));
 	txq->tx_buf[ntu].ctx_entry = true;
 
-	ctx_desc = IDPF_BASE_TX_CTX_DESC(txq, ntu);
+	ctx_desc = &txq->base_ctx[ntu];
 
 	IDPF_SINGLEQ_BUMP_RING_IDX(txq, ntu);
 	txq->next_to_use = ntu;
@@ -455,7 +455,7 @@
 	struct netdev_queue *nq;
 	bool dont_wake;
 
-	tx_desc = IDPF_BASE_TX_DESC(tx_q, ntc);
+	tx_desc = &tx_q->base_tx[ntc];
 	tx_buf = &tx_q->tx_buf[ntc];
 	ntc -= tx_q->desc_count;
 
@@ -517,7 +517,7 @@
 			if (unlikely(!ntc)) {
 				ntc -= tx_q->desc_count;
 				tx_buf = tx_q->tx_buf;
-				tx_desc = IDPF_BASE_TX_DESC(tx_q, 0);
+				tx_desc = &tx_q->base_tx[0];
 			}
 
 			/* unmap any remaining paged data */
@@ -540,7 +540,7 @@
 		if (unlikely(!ntc)) {
 			ntc -= tx_q->desc_count;
 			tx_buf = tx_q->tx_buf;
-			tx_desc = IDPF_BASE_TX_DESC(tx_q, 0);
+			tx_desc = &tx_q->base_tx[0];
 		}
 	} while (likely(budget));
 
@@ -895,7 +895,7 @@
 	if (!cleaned_count)
 		return false;
 
-	desc = IDPF_SINGLEQ_RX_BUF_DESC(rx_q, nta);
+	desc = &rx_q->single_buf[nta];
 	buf = &rx_q->rx_buf.buf[nta];
 
 	do {
@@ -915,7 +915,7 @@
 		buf++;
 		nta++;
 		if (unlikely(nta == rx_q->desc_count)) {
-			desc = IDPF_SINGLEQ_RX_BUF_DESC(rx_q, 0);
+			desc = &rx_q->single_buf[0];
 			buf = rx_q->rx_buf.buf;
 			nta = 0;
 		}
@@ -1016,7 +1016,7 @@
 		struct idpf_rx_buf *rx_buf;
 
 		/* get the Rx desc from Rx queue based on 'next_to_clean' */
-		rx_desc = IDPF_RX_DESC(rx_q, ntc);
+		rx_desc = &rx_q->rx[ntc];
 
 		/* status_error_ptype_len will always be zero for unused
 		 * descriptors because it's cleared in cleanup, and overlaps
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/idpf/idpf_txrx.c
@@ -530,7 +530,7 @@
 	struct idpf_rx_buf *buf;
 	dma_addr_t addr;
 
-	splitq_rx_desc = IDPF_SPLITQ_RX_BUF_DESC(bufq, nta);
+	splitq_rx_desc = &bufq->split_buf[nta];
 	buf = &bufq->rx_buf.buf[buf_id];
 
 	if (bufq->rx_hsplit_en) {
@@ -1583,7 +1583,7 @@
 	if (unlikely(!(ntc))) {					\
 		ntc -= (txq)->desc_count;			\
 		buf = (txq)->tx_buf;				\
-		desc = IDPF_FLEX_TX_DESC(txq, 0);		\
+		desc = &(txq)->flex_tx[0];			\
 	} else {						\
 		(buf)++;					\
 		(desc)++;					\
@@ -1616,8 +1616,8 @@
 	s16 ntc = tx_q->next_to_clean;
 	struct idpf_tx_buf *tx_buf;
 
-	tx_desc = IDPF_FLEX_TX_DESC(tx_q, ntc);
-	next_pending_desc = IDPF_FLEX_TX_DESC(tx_q, end);
+	tx_desc = &tx_q->flex_tx[ntc];
+	next_pending_desc = &tx_q->flex_tx[end];
 	tx_buf = &tx_q->tx_buf[ntc];
 	ntc -= tx_q->desc_count;
 
@@ -1813,7 +1813,7 @@
 	int i;
 
 	complq_budget = vport->compln_clean_budget;
-	tx_desc = IDPF_SPLITQ_TX_COMPLQ_DESC(complq, ntc);
+	tx_desc = &complq->comp[ntc];
 	ntc -= complq->desc_count;
 
 	do {
@@ -1878,7 +1878,7 @@
 		ntc++;
 		if (unlikely(!ntc)) {
 			ntc -= complq->desc_count;
-			tx_desc = IDPF_SPLITQ_TX_COMPLQ_DESC(complq, 0);
+			tx_desc = &complq->comp[0];
 			change_bit(__IDPF_Q_GEN_CHK, complq->flags);
 		}
 
@@ -2142,7 +2142,7 @@
 		 * used one additional descriptor for a context
 		 * descriptor. Reset that here.
 		 */
-		tx_desc = IDPF_FLEX_TX_DESC(txq, idx);
+		tx_desc = &txq->flex_tx[idx];
 		memset(tx_desc, 0, sizeof(struct idpf_flex_tx_ctx_desc));
 		if (idx == 0)
 			idx = txq->desc_count;
@@ -2201,7 +2201,7 @@
 	data_len = skb->data_len;
 	size = skb_headlen(skb);
 
-	tx_desc = IDPF_FLEX_TX_DESC(tx_q, i);
+	tx_desc = &tx_q->flex_tx[i];
 
 	dma = dma_map_single(tx_q->dev, skb->data, size, DMA_TO_DEVICE);
 
@@ -2274,7 +2274,7 @@
 			i++;
 
 			if (i == tx_q->desc_count) {
-				tx_desc = IDPF_FLEX_TX_DESC(tx_q, 0);
+				tx_desc = &tx_q->flex_tx[0];
 				i = 0;
 				tx_q->compl_tag_cur_gen =
 					IDPF_TX_ADJ_COMPL_TAG_GEN(tx_q);
@@ -2319,7 +2319,7 @@
 		i++;
 
 		if (i == tx_q->desc_count) {
-			tx_desc = IDPF_FLEX_TX_DESC(tx_q, 0);
+			tx_desc = &tx_q->flex_tx[0];
 			i = 0;
 			tx_q->compl_tag_cur_gen = IDPF_TX_ADJ_COMPL_TAG_GEN(tx_q);
 		}
@@ -2552,7 +2552,7 @@
 	txq->tx_buf[i].compl_tag = IDPF_SPLITQ_TX_INVAL_COMPL_TAG;
 
 	/* grab the next descriptor */
-	desc = IDPF_FLEX_TX_CTX_DESC(txq, i);
+	desc = &txq->flex_ctx[i];
 	txq->next_to_use = idpf_tx_splitq_bump_ntu(txq, i);
 
 	return desc;
@@ -2940,6 +2940,8 @@
 	rx_ptype = le16_get_bits(rx_desc->ptype_err_fflags0,
 				 VIRTCHNL2_RX_FLEX_DESC_ADV_PTYPE_M);
 
+	skb->protocol = eth_type_trans(skb, rxq->vport->netdev);
+
 	decoded = rxq->vport->rx_ptype_lkup[rx_ptype];
 	/* If we don't know the ptype we can't do anything else with it. Just
 	 * pass it up the stack as-is.
@@ -2950,8 +2952,6 @@
 	/* process RSS/hash */
 	idpf_rx_hash(rxq, skb, rx_desc, &decoded);
 
-	skb->protocol = eth_type_trans(skb, rxq->vport->netdev);
-
 	if (le16_get_bits(rx_desc->hdrlen_flags,
 			  VIRTCHNL2_RX_FLEX_DESC_ADV_RSC_M))
 		return idpf_rx_rsc(rxq, skb, rx_desc, &decoded);
@@ -3128,7 +3128,6 @@
 		struct idpf_sw_queue *refillq = NULL;
 		struct idpf_rxq_set *rxq_set = NULL;
 		struct idpf_rx_buf *rx_buf = NULL;
-		union virtchnl2_rx_desc *desc;
 		unsigned int pkt_len = 0;
 		unsigned int hdr_len = 0;
 		u16 gen_id, buf_id = 0;
@@ -3138,8 +3137,7 @@
 		u8 rxdid;
 
 		/* get the Rx desc from Rx queue based on 'next_to_clean' */
-		desc = IDPF_RX_DESC(rxq, ntc);
-		rx_desc = (struct virtchnl2_rx_flex_desc_adv_nic_3 *)desc;
+		rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb;
 
 		/* This memory barrier is needed to keep us from reading
 		 * any other fields out of the rx_desc
@@ -3320,11 +3318,11 @@
 	int cleaned = 0;
 	u16 gen;
 
-	buf_desc = IDPF_SPLITQ_RX_BUF_DESC(bufq, bufq_nta);
+	buf_desc = &bufq->split_buf[bufq_nta];
 
 	/* make sure we stop at ring wrap in the unlikely case ring is full */
 	while (likely(cleaned < refillq->desc_count)) {
-		u16 refill_desc = IDPF_SPLITQ_RX_BI_DESC(refillq, ntc);
+		u16 refill_desc = refillq->ring[ntc];
 		bool failure;
 
 		gen = FIELD_GET(IDPF_RX_BI_GEN_M, refill_desc);
@@ -3342,7 +3340,7 @@
 		}
 
 		if (unlikely(++bufq_nta == bufq->desc_count)) {
-			buf_desc = IDPF_SPLITQ_RX_BUF_DESC(bufq, 0);
+			buf_desc = &bufq->split_buf[0];
 			bufq_nta = 0;
 		} else {
 			buf_desc++;
@@ -3636,13 +3634,15 @@
 /**
  * idpf_vport_intr_req_irq - get MSI-X vectors from the OS for the vport
  * @vport: main vport structure
- * @basename: name for the vector
  */
-static int idpf_vport_intr_req_irq(struct idpf_vport *vport, char *basename)
+static int idpf_vport_intr_req_irq(struct idpf_vport *vport)
 {
 	struct idpf_adapter *adapter = vport->adapter;
+	const char *drv_name, *if_name, *vec_name;
 	int vector, err, irq_num, vidx;
-	const char *vec_name;
+
+	drv_name = dev_driver_string(&adapter->pdev->dev);
+	if_name = netdev_name(vport->netdev);
 
 	for (vector = 0; vector < vport->num_q_vectors; vector++) {
 		struct idpf_q_vector *q_vector = &vport->q_vectors[vector];
@@ -3659,8 +3659,8 @@
 		else
 			continue;
 
-		q_vector->name = kasprintf(GFP_KERNEL, "%s-%s-%d",
-					   basename, vec_name, vidx);
+		q_vector->name = kasprintf(GFP_KERNEL, "%s-%s-%s-%d", drv_name,
+					   if_name, vec_name, vidx);
 
 		err = request_irq(irq_num, idpf_vport_intr_clean_queues, 0,
 				  q_vector->name, q_vector);
@@ -3746,9 +3746,9 @@
  */
 void idpf_vport_intr_deinit(struct idpf_vport *vport)
 {
+	idpf_vport_intr_dis_irq_all(vport);
 	idpf_vport_intr_napi_dis_all(vport);
 	idpf_vport_intr_napi_del_all(vport);
-	idpf_vport_intr_dis_irq_all(vport);
 	idpf_vport_intr_rel_irq(vport);
 }
 
@@ -4170,7 +4170,6 @@
  */
 int idpf_vport_intr_init(struct idpf_vport *vport)
 {
-	char *int_name;
 	int err;
 
 	err = idpf_vport_intr_init_vec_idx(vport);
@@ -4179,31 +4178,29 @@
 
 	idpf_vport_intr_map_vector_to_qs(vport);
 	idpf_vport_intr_napi_add_all(vport);
-	idpf_vport_intr_napi_ena_all(vport);
 
 	err = vport->adapter->dev_ops.reg_ops.intr_reg_init(vport);
 	if (err)
 		goto unroll_vectors_alloc;
 
-	int_name = kasprintf(GFP_KERNEL, "%s-%s",
-			     dev_driver_string(&vport->adapter->pdev->dev),
-			     vport->netdev->name);
-
-	err = idpf_vport_intr_req_irq(vport, int_name);
+	err = idpf_vport_intr_req_irq(vport);
 	if (err)
 		goto unroll_vectors_alloc;
 
-	idpf_vport_intr_ena_irq_all(vport);
-
 	return 0;
 
 unroll_vectors_alloc:
-	idpf_vport_intr_napi_dis_all(vport);
 	idpf_vport_intr_napi_del_all(vport);
 
 	return err;
 }
 
+void idpf_vport_intr_ena(struct idpf_vport *vport)
+{
+	idpf_vport_intr_napi_ena_all(vport);
+	idpf_vport_intr_ena_irq_all(vport);
+}
+
 /**
  * idpf_config_rss - Send virtchnl messages to configure RSS
  * @vport: virtual port
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/idpf/idpf_txrx.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/idpf/idpf_txrx.h
@@ -8,6 +8,8 @@
 #include <net/tcp.h>
 #include <net/netdev_queues.h>
 
+#include "idpf_lan_txrx.h"
+
 #define IDPF_LARGE_MAX_Q			256
 #define IDPF_MAX_Q				16
 #define IDPF_MIN_Q				2
@@ -115,24 +117,6 @@
 #define IDPF_RXD_EOF_SPLITQ		VIRTCHNL2_RX_FLEX_DESC_ADV_STATUS0_EOF_M
 #define IDPF_RXD_EOF_SINGLEQ		VIRTCHNL2_RX_BASE_DESC_STATUS_EOF_M
 
-#define IDPF_SINGLEQ_RX_BUF_DESC(rxq, i)	\
-	(&(((struct virtchnl2_singleq_rx_buf_desc *)((rxq)->desc_ring))[i]))
-#define IDPF_SPLITQ_RX_BUF_DESC(rxq, i)	\
-	(&(((struct virtchnl2_splitq_rx_buf_desc *)((rxq)->desc_ring))[i]))
-#define IDPF_SPLITQ_RX_BI_DESC(rxq, i) ((((rxq)->ring))[i])
-
-#define IDPF_BASE_TX_DESC(txq, i)	\
-	(&(((struct idpf_base_tx_desc *)((txq)->desc_ring))[i]))
-#define IDPF_BASE_TX_CTX_DESC(txq, i) \
-	(&(((struct idpf_base_tx_ctx_desc *)((txq)->desc_ring))[i]))
-#define IDPF_SPLITQ_TX_COMPLQ_DESC(txcq, i)	\
-	(&(((struct idpf_splitq_tx_compl_desc *)((txcq)->desc_ring))[i]))
-
-#define IDPF_FLEX_TX_DESC(txq, i) \
-	(&(((union idpf_tx_flex_desc *)((txq)->desc_ring))[i]))
-#define IDPF_FLEX_TX_CTX_DESC(txq, i)	\
-	(&(((struct idpf_flex_tx_ctx_desc *)((txq)->desc_ring))[i]))
-
 #define IDPF_DESC_UNUSED(txq)     \
 	((((txq)->next_to_clean > (txq)->next_to_use) ? 0 : (txq)->desc_count) + \
 	(txq)->next_to_clean - (txq)->next_to_use - 1)
@@ -315,8 +299,6 @@
 
 #define IDPF_RX_DMA_ATTR \
 	(DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_WEAK_ORDERING)
-#define IDPF_RX_DESC(rxq, i)	\
-	(&(((union virtchnl2_rx_desc *)((rxq)->desc_ring))[i]))
 
 struct idpf_rx_buf {
 	struct page *page;
@@ -653,7 +635,15 @@
  * @q_vector: Backreference to associated vector
  * @size: Length of descriptor ring in bytes
  * @dma: Physical address of ring
- * @desc_ring: Descriptor ring memory
+ * @rx: universal receive descriptor array
+ * @single_buf: Rx buffer descriptor array in singleq
+ * @split_buf: Rx buffer descriptor array in splitq
+ * @base_tx: basic Tx descriptor array
+ * @base_ctx: basic Tx context descriptor array
+ * @flex_tx: flex Tx descriptor array
+ * @flex_ctx: flex Tx context descriptor array
+ * @comp: completion descriptor array
+ * @desc_ring: virtual descriptor ring address
  * @tx_max_bufs: Max buffers that can be transmitted with scatter-gather
  * @tx_min_pkt_len: Min supported packet length
  * @num_completions: Only relevant for TX completion queue. It tracks the
@@ -731,7 +721,21 @@
 	struct idpf_q_vector *q_vector;
 	unsigned int size;
 	dma_addr_t dma;
-	void *desc_ring;
+	union {
+		union virtchnl2_rx_desc *rx;
+
+		struct virtchnl2_singleq_rx_buf_desc *single_buf;
+		struct virtchnl2_splitq_rx_buf_desc *split_buf;
+
+		struct idpf_base_tx_desc *base_tx;
+		struct idpf_base_tx_ctx_desc *base_ctx;
+		union idpf_tx_flex_desc *flex_tx;
+		struct idpf_flex_tx_ctx_desc *flex_ctx;
+
+		struct idpf_splitq_tx_compl_desc *comp;
+
+		void *desc_ring;
+	};
 
 	u16 tx_max_bufs;
 	u8 tx_min_pkt_len;
@@ -988,6 +992,7 @@
 void idpf_vport_intr_update_itr_ena_irq(struct idpf_q_vector *q_vector);
 void idpf_vport_intr_deinit(struct idpf_vport *vport);
 int idpf_vport_intr_init(struct idpf_vport *vport);
+void idpf_vport_intr_ena(struct idpf_vport *vport);
 enum pkt_hash_types idpf_ptype_to_htype(const struct idpf_rx_ptype_decoded *decoded);
 int idpf_config_rss(struct idpf_vport *vport);
 int idpf_init_rss(struct idpf_vport *vport);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -23,7 +23,7 @@
 
 	switch (event) {
 	case VIRTCHNL2_EVENT_LINK_CHANGE:
-		vport->link_speed_mbps = le32_to_cpu(v2e->link_speed);
+		np->link_speed_mbps = le32_to_cpu(v2e->link_speed);
 		link_status = v2e->link_status;
 
 		if (vport->link_up == link_status)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/igb/igb_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/igb/igb_main.c
@@ -33,6 +33,7 @@
 #include <linux/bpf_trace.h>
 #include <linux/pm_runtime.h>
 #include <linux/etherdevice.h>
+#include <linux/lockdep.h>
 #ifdef CONFIG_IGB_DCA
 #include <linux/dca.h>
 #endif
@@ -664,6 +665,10 @@
 	dca_register_notify(&dca_notifier);
 #endif
 	ret = pci_register_driver(&igb_driver);
+#ifdef CONFIG_IGB_DCA
+	if (ret)
+		dca_unregister_notify(&dca_notifier);
+#endif
 	return ret;
 }
 
@@ -2939,8 +2944,11 @@
 	}
 }
 
+/* This function assumes __netif_tx_lock is held by the caller. */
 static void igb_xdp_ring_update_tail(struct igb_ring *ring)
 {
+	lockdep_assert_held(&txring_txq(ring)->_xmit_lock);
+
 	/* Force memory writes to complete before letting h/w know there
 	 * are new descriptors to fetch.
 	 */
@@ -3025,11 +3033,11 @@
 		nxmit++;
 	}
 
-	__netif_tx_unlock(nq);
-
 	if (unlikely(flags & XDP_XMIT_FLUSH))
 		igb_xdp_ring_update_tail(tx_ring);
 
+	__netif_tx_unlock(nq);
+
 	return nxmit;
 }
 
@@ -4833,6 +4841,7 @@
 
 #if (PAGE_SIZE < 8192)
 	if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB ||
+	    IGB_2K_TOO_SMALL_WITH_PADDING ||
 	    rd32(E1000_RCTL) & E1000_RCTL_SBP)
 		set_ring_uses_large_buffer(rx_ring);
 #endif
@@ -6984,45 +6993,42 @@
 
 static void igb_tsync_interrupt(struct igb_adapter *adapter)
 {
+	const u32 mask = (TSINTR_SYS_WRAP | E1000_TSICR_TXTS |
+			  TSINTR_TT0 | TSINTR_TT1 |
+			  TSINTR_AUTT0 | TSINTR_AUTT1);
 	struct e1000_hw *hw = &adapter->hw;
-	u32 ack = 0, tsicr = rd32(E1000_TSICR);
+	u32 tsicr = rd32(E1000_TSICR);
 	struct ptp_clock_event event;
 
+	if (hw->mac.type == e1000_82580) {
+		/* 82580 has a hardware bug that requires an explicit
+		 * write to clear the TimeSync interrupt cause.
+		 */
+		wr32(E1000_TSICR, tsicr & mask);
+	}
+
 	if (tsicr & TSINTR_SYS_WRAP) {
 		event.type = PTP_CLOCK_PPS;
 		if (adapter->ptp_caps.pps)
 			ptp_clock_event(adapter->ptp_clock, &event);
-		ack |= TSINTR_SYS_WRAP;
 	}
 
 	if (tsicr & E1000_TSICR_TXTS) {
 		/* retrieve hardware timestamp */
 		schedule_work(&adapter->ptp_tx_work);
-		ack |= E1000_TSICR_TXTS;
 	}
 
-	if (tsicr & TSINTR_TT0) {
+	if (tsicr & TSINTR_TT0)
 		igb_perout(adapter, 0);
-		ack |= TSINTR_TT0;
-	}
 
-	if (tsicr & TSINTR_TT1) {
+	if (tsicr & TSINTR_TT1)
 		igb_perout(adapter, 1);
-		ack |= TSINTR_TT1;
-	}
 
-	if (tsicr & TSINTR_AUTT0) {
+	if (tsicr & TSINTR_AUTT0)
 		igb_extts(adapter, 0);
-		ack |= TSINTR_AUTT0;
-	}
 
-	if (tsicr & TSINTR_AUTT1) {
+	if (tsicr & TSINTR_AUTT1)
 		igb_extts(adapter, 1);
-		ack |= TSINTR_AUTT1;
-	}
-
-	/* acknowledge the interrupts */
-	wr32(E1000_TSICR, ack);
 }
 
 static irqreturn_t igb_msix_other(int irq, void *data)
@@ -8891,12 +8897,14 @@
 
 static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)
 {
+	unsigned int total_bytes = 0, total_packets = 0;
 	struct igb_adapter *adapter = q_vector->adapter;
 	struct igb_ring *rx_ring = q_vector->rx.ring;
-	struct sk_buff *skb = rx_ring->skb;
-	unsigned int total_bytes = 0, total_packets = 0;
 	u16 cleaned_count = igb_desc_unused(rx_ring);
+	struct sk_buff *skb = rx_ring->skb;
+	int cpu = smp_processor_id();
 	unsigned int xdp_xmit = 0;
+	struct netdev_queue *nq;
 	struct xdp_buff xdp;
 	u32 frame_sz = 0;
 	int rx_buf_pgcnt;
@@ -9024,7 +9032,10 @@
 	if (xdp_xmit & IGB_XDP_TX) {
 		struct igb_ring *tx_ring = igb_xdp_tx_queue_mapping(adapter);
 
+		nq = txring_txq(tx_ring);
+		__netif_tx_lock(nq, cpu);
 		igb_xdp_ring_update_tail(tx_ring);
+		__netif_tx_unlock(nq);
 	}
 
 	u64_stats_update_begin(&rx_ring->rx_syncp);
@@ -9665,6 +9676,10 @@
 	struct igb_adapter *adapter = netdev_priv(netdev);
 
 	if (netif_running(netdev)) {
+		if (!test_bit(__IGB_DOWN, &adapter->state)) {
+			dev_dbg(&pdev->dev, "Resuming from non-fatal error, do nothing.\n");
+			return;
+		}
 		if (igb_up(adapter)) {
 			dev_err(&pdev->dev, "igb_up failed after reset\n");
 			return;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/igc/igc_base.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/igc/igc_base.c
@@ -68,6 +68,10 @@
 	u32 eecd = rd32(IGC_EECD);
 	u16 size;
 
+	/* failed to read reg and got all F's */
+	if (!(~eecd))
+		return -ENXIO;
+
 	size = FIELD_GET(IGC_EECD_SIZE_EX_MASK, eecd);
 
 	/* Added to a constant, "size" becomes the left-shift value
@@ -221,6 +225,8 @@
 
 	/* NVM initialization */
 	ret_val = igc_init_nvm_params_base(hw);
+	if (ret_val)
+		goto out;
 	switch (hw->mac.type) {
 	case igc_i225:
 		ret_val = igc_init_nvm_params_i225(hw);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/igc/igc_defines.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/igc/igc_defines.h
@@ -404,6 +404,12 @@
 #define IGC_DTXMXPKTSZ_TSN	0x19 /* 1600 bytes of max TX DMA packet size */
 #define IGC_DTXMXPKTSZ_DEFAULT	0x98 /* 9728-byte Jumbo frames */
 
+/* Retry Buffer Control */
+#define IGC_RETX_CTL			0x041C
+#define IGC_RETX_CTL_WATERMARK_MASK	0xF
+#define IGC_RETX_CTL_QBVFULLTH_SHIFT	8 /* QBV Retry Buffer Full Threshold */
+#define IGC_RETX_CTL_QBVFULLEN	0x1000 /* Enable QBV Retry Buffer Full Threshold */
+
 /* Transmit Scheduling Latency */
 /* Latency between transmission scheduling (LaunchTime) and the time
  * the packet is transmitted to the network in nanosecond.
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/igc/igc_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/igc/igc_main.c
@@ -1642,10 +1642,6 @@
 
 	if (unlikely(test_bit(IGC_RING_FLAG_TX_HWTSTAMP, &tx_ring->flags) &&
 		     skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)) {
-		/* FIXME: add support for retrieving timestamps from
-		 * the other timer registers before skipping the
-		 * timestamping request.
-		 */
 		unsigned long flags;
 		u32 tstamp_flags;
 
@@ -5302,25 +5298,22 @@
 
 static void igc_tsync_interrupt(struct igc_adapter *adapter)
 {
-	u32 ack, tsauxc, sec, nsec, tsicr;
 	struct igc_hw *hw = &adapter->hw;
+	u32 tsauxc, sec, nsec, tsicr;
 	struct ptp_clock_event event;
 	struct timespec64 ts;
 
 	tsicr = rd32(IGC_TSICR);
-	ack = 0;
 
 	if (tsicr & IGC_TSICR_SYS_WRAP) {
 		event.type = PTP_CLOCK_PPS;
 		if (adapter->ptp_caps.pps)
 			ptp_clock_event(adapter->ptp_clock, &event);
-		ack |= IGC_TSICR_SYS_WRAP;
 	}
 
 	if (tsicr & IGC_TSICR_TXTS) {
 		/* retrieve hardware timestamp */
 		igc_ptp_tx_tstamp_event(adapter);
-		ack |= IGC_TSICR_TXTS;
 	}
 
 	if (tsicr & IGC_TSICR_TT0) {
@@ -5334,7 +5327,6 @@
 		wr32(IGC_TSAUXC, tsauxc);
 		adapter->perout[0].start = ts;
 		spin_unlock(&adapter->tmreg_lock);
-		ack |= IGC_TSICR_TT0;
 	}
 
 	if (tsicr & IGC_TSICR_TT1) {
@@ -5348,7 +5340,6 @@
 		wr32(IGC_TSAUXC, tsauxc);
 		adapter->perout[1].start = ts;
 		spin_unlock(&adapter->tmreg_lock);
-		ack |= IGC_TSICR_TT1;
 	}
 
 	if (tsicr & IGC_TSICR_AUTT0) {
@@ -5358,7 +5349,6 @@
 		event.index = 0;
 		event.timestamp = sec * NSEC_PER_SEC + nsec;
 		ptp_clock_event(adapter->ptp_clock, &event);
-		ack |= IGC_TSICR_AUTT0;
 	}
 
 	if (tsicr & IGC_TSICR_AUTT1) {
@@ -5368,11 +5358,7 @@
 		event.index = 1;
 		event.timestamp = sec * NSEC_PER_SEC + nsec;
 		ptp_clock_event(adapter->ptp_clock, &event);
-		ack |= IGC_TSICR_AUTT1;
 	}
-
-	/* acknowledge the interrupts */
-	wr32(IGC_TSICR, ack);
 }
 
 /**
@@ -6220,21 +6206,6 @@
 	size_t n;
 	int i;
 
-	switch (qopt->cmd) {
-	case TAPRIO_CMD_REPLACE:
-		break;
-	case TAPRIO_CMD_DESTROY:
-		return igc_tsn_clear_schedule(adapter);
-	case TAPRIO_CMD_STATS:
-		igc_taprio_stats(adapter->netdev, &qopt->stats);
-		return 0;
-	case TAPRIO_CMD_QUEUE_STATS:
-		igc_taprio_queue_stats(adapter->netdev, &qopt->queue_stats);
-		return 0;
-	default:
-		return -EOPNOTSUPP;
-	}
-
 	if (qopt->base_time < 0)
 		return -ERANGE;
 
@@ -6244,12 +6215,16 @@
 	if (!validate_schedule(adapter, qopt))
 		return -EINVAL;
 
+	igc_ptp_read(adapter, &now);
+
+	if (igc_tsn_is_taprio_activated_by_user(adapter) &&
+	    is_base_time_past(qopt->base_time, &now))
+		adapter->qbv_config_change_errors++;
+
 	adapter->cycle_time = qopt->cycle_time;
 	adapter->base_time = qopt->base_time;
 	adapter->taprio_offload_enable = true;
 
-	igc_ptp_read(adapter, &now);
-
 	for (n = 0; n < qopt->num_entries; n++) {
 		struct tc_taprio_sched_entry *e = &qopt->entries[n];
 
@@ -6343,7 +6318,23 @@
 	if (hw->mac.type != igc_i225)
 		return -EOPNOTSUPP;
 
-	err = igc_save_qbv_schedule(adapter, qopt);
+	switch (qopt->cmd) {
+	case TAPRIO_CMD_REPLACE:
+		err = igc_save_qbv_schedule(adapter, qopt);
+		break;
+	case TAPRIO_CMD_DESTROY:
+		err = igc_tsn_clear_schedule(adapter);
+		break;
+	case TAPRIO_CMD_STATS:
+		igc_taprio_stats(adapter->netdev, &qopt->stats);
+		return 0;
+	case TAPRIO_CMD_QUEUE_STATS:
+		igc_taprio_queue_stats(adapter->netdev, &qopt->queue_stats);
+		return 0;
+	default:
+		return -EOPNOTSUPP;
+	}
+
 	if (err)
 		return err;
 
@@ -6833,6 +6824,9 @@
 	memcpy(&hw->mac.ops, ei->mac_ops, sizeof(hw->mac.ops));
 	memcpy(&hw->phy.ops, ei->phy_ops, sizeof(hw->phy.ops));
 
+	if (pci_is_thunderbolt_attached(pdev))
+		msleep(600);
+
 	/* Initialize skew-specific constants */
 	err = ei->get_invariants(hw);
 	if (err)
@@ -7316,6 +7310,7 @@
 	rtnl_lock();
 	if (netif_running(netdev)) {
 		if (igc_open(netdev)) {
+			rtnl_unlock();
 			netdev_err(netdev, "igc_open failed after reset\n");
 			return;
 		}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/igc/igc_tsn.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/igc/igc_tsn.c
@@ -49,12 +49,19 @@
 	return new_flags;
 }
 
+static bool igc_tsn_is_tx_mode_in_tsn(struct igc_adapter *adapter)
+{
+	struct igc_hw *hw = &adapter->hw;
+
+	return !!(rd32(IGC_TQAVCTRL) & IGC_TQAVCTRL_TRANSMIT_MODE_TSN);
+}
+
 void igc_tsn_adjust_txtime_offset(struct igc_adapter *adapter)
 {
 	struct igc_hw *hw = &adapter->hw;
 	u16 txoffset;
 
-	if (!is_any_launchtime(adapter))
+	if (!igc_tsn_is_tx_mode_in_tsn(adapter))
 		return;
 
 	switch (adapter->link_speed) {
@@ -78,6 +85,23 @@
 	wr32(IGC_GTXOFFSET, txoffset);
 }
 
+static void igc_tsn_restore_retx_default(struct igc_adapter *adapter)
+{
+	struct igc_hw *hw = &adapter->hw;
+	u32 retxctl;
+
+	retxctl = rd32(IGC_RETX_CTL) & IGC_RETX_CTL_WATERMARK_MASK;
+	wr32(IGC_RETX_CTL, retxctl);
+}
+
+bool igc_tsn_is_taprio_activated_by_user(struct igc_adapter *adapter)
+{
+	struct igc_hw *hw = &adapter->hw;
+
+	return (rd32(IGC_BASET_H) || rd32(IGC_BASET_L)) &&
+		adapter->taprio_offload_enable;
+}
+
 /* Returns the TSN specific registers to their default values after
  * the adapter is reset.
  */
@@ -91,6 +115,9 @@
 	wr32(IGC_TXPBS, I225_TXPBSIZE_DEFAULT);
 	wr32(IGC_DTXMXPKTSZ, IGC_DTXMXPKTSZ_DEFAULT);
 
+	if (igc_is_device_id_i226(hw))
+		igc_tsn_restore_retx_default(adapter);
+
 	tqavctrl = rd32(IGC_TQAVCTRL);
 	tqavctrl &= ~(IGC_TQAVCTRL_TRANSMIT_MODE_TSN |
 		      IGC_TQAVCTRL_ENHANCED_QAV | IGC_TQAVCTRL_FUTSCDDIS);
@@ -111,6 +138,25 @@
 	return 0;
 }
 
+/* To partially fix i226 HW errata, reduce MAC internal buffering from 192 Bytes
+ * to 88 Bytes by setting RETX_CTL register using the recommendation from:
+ * a) Ethernet Controller I225/I226 Specification Update Rev 2.1
+ *    Item 9: TSN: Packet Transmission Might Cross the Qbv Window
+ * b) I225/6 SW User Manual Rev 1.2.4: Section 8.11.5 Retry Buffer Control
+ */
+static void igc_tsn_set_retx_qbvfullthreshold(struct igc_adapter *adapter)
+{
+	struct igc_hw *hw = &adapter->hw;
+	u32 retxctl, watermark;
+
+	retxctl = rd32(IGC_RETX_CTL);
+	watermark = retxctl & IGC_RETX_CTL_WATERMARK_MASK;
+	/* Set QBVFULLTH value using watermark and set QBVFULLEN */
+	retxctl |= (watermark << IGC_RETX_CTL_QBVFULLTH_SHIFT) |
+		   IGC_RETX_CTL_QBVFULLEN;
+	wr32(IGC_RETX_CTL, retxctl);
+}
+
 static int igc_tsn_enable_offload(struct igc_adapter *adapter)
 {
 	struct igc_hw *hw = &adapter->hw;
@@ -123,6 +169,9 @@
 	wr32(IGC_DTXMXPKTSZ, IGC_DTXMXPKTSZ_TSN);
 	wr32(IGC_TXPBS, IGC_TXPBSIZE_TSN);
 
+	if (igc_is_device_id_i226(hw))
+		igc_tsn_set_retx_qbvfullthreshold(adapter);
+
 	for (i = 0; i < adapter->num_tx_queues; i++) {
 		struct igc_ring *ring = adapter->tx_ring[i];
 		u32 txqctl = 0;
@@ -262,14 +311,6 @@
 		s64 n = div64_s64(ktime_sub_ns(systim, base_time), cycle);
 
 		base_time = ktime_add_ns(base_time, (n + 1) * cycle);
-
-		/* Increase the counter if scheduling into the past while
-		 * Gate Control List (GCL) is running.
-		 */
-		if ((rd32(IGC_BASET_H) || rd32(IGC_BASET_L)) &&
-		    (adapter->tc_setup_type == TC_SETUP_QDISC_TAPRIO) &&
-		    (adapter->qbv_count > 1))
-			adapter->qbv_config_change_errors++;
 	} else {
 		if (igc_is_device_id_i226(hw)) {
 			ktime_t adjust_time, expires_time;
@@ -331,15 +372,22 @@
 	return err;
 }
 
-int igc_tsn_offload_apply(struct igc_adapter *adapter)
+static bool igc_tsn_will_tx_mode_change(struct igc_adapter *adapter)
 {
-	struct igc_hw *hw = &adapter->hw;
+	bool any_tsn_enabled = !!(igc_tsn_new_flags(adapter) &
+				  IGC_FLAG_TSN_ANY_ENABLED);
 
-	/* Per I225/6 HW Design Section 7.5.2.1, transmit mode
-	 * cannot be changed dynamically. Require reset the adapter.
+	return (any_tsn_enabled && !igc_tsn_is_tx_mode_in_tsn(adapter)) ||
+	       (!any_tsn_enabled && igc_tsn_is_tx_mode_in_tsn(adapter));
+}
+
+int igc_tsn_offload_apply(struct igc_adapter *adapter)
+{
+	/* Per I225/6 HW Design Section 7.5.2.1 guideline, if tx mode change
+	 * from legacy->tsn or tsn->legacy, then reset adapter is needed.
 	 */
 	if (netif_running(adapter->netdev) &&
-	    (igc_is_device_id_i225(hw) || !adapter->qbv_count)) {
+	    igc_tsn_will_tx_mode_change(adapter)) {
 		schedule_work(&adapter->reset_task);
 		return 0;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/igc/igc_tsn.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/igc/igc_tsn.h
@@ -7,5 +7,6 @@
 int igc_tsn_offload_apply(struct igc_adapter *adapter);
 int igc_tsn_reset(struct igc_adapter *adapter);
 void igc_tsn_adjust_txtime_offset(struct igc_adapter *adapter);
+bool igc_tsn_is_taprio_activated_by_user(struct igc_adapter *adapter);
 
 #endif /* _IGC_BASE_H */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ixgbe/ixgbe_common.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ixgbe/ixgbe_common.h
@@ -194,6 +194,8 @@
 	dev_err(&adapter->pdev->dev, format, ## arg)
 #define e_dev_notice(format, arg...) \
 	dev_notice(&adapter->pdev->dev, format, ## arg)
+#define e_dbg(msglvl, format, arg...) \
+	netif_dbg(adapter, msglvl, adapter->netdev, format, ## arg)
 #define e_info(msglvl, format, arg...) \
 	netif_info(adapter, msglvl, adapter->netdev, format, ## arg)
 #define e_err(msglvl, format, arg...) \
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -914,7 +914,13 @@
 		goto err_out;
 	}
 
-	xs = kzalloc(sizeof(*xs), GFP_KERNEL);
+	algo = xfrm_aead_get_byname(aes_gcm_name, IXGBE_IPSEC_AUTH_BITS, 1);
+	if (unlikely(!algo)) {
+		err = -ENOENT;
+		goto err_out;
+	}
+
+	xs = kzalloc(sizeof(*xs), GFP_ATOMIC);
 	if (unlikely(!xs)) {
 		err = -ENOMEM;
 		goto err_out;
@@ -930,14 +936,8 @@
 		memcpy(&xs->id.daddr.a4, sam->addr, sizeof(xs->id.daddr.a4));
 	xs->xso.dev = adapter->netdev;
 
-	algo = xfrm_aead_get_byname(aes_gcm_name, IXGBE_IPSEC_AUTH_BITS, 1);
-	if (unlikely(!algo)) {
-		err = -ENOENT;
-		goto err_xs;
-	}
-
 	aead_len = sizeof(*xs->aead) + IXGBE_IPSEC_KEY_BITS / 8;
-	xs->aead = kzalloc(aead_len, GFP_KERNEL);
+	xs->aead = kzalloc(aead_len, GFP_ATOMIC);
 	if (unlikely(!xs->aead)) {
 		err = -ENOMEM;
 		goto err_xs;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -1047,7 +1047,7 @@
 		break;
 	}
 
-	e_info(drv, "VF %d requested invalid api version %u\n", vf, api);
+	e_dbg(drv, "VF %d requested unsupported api version %u\n", vf, api);
 
 	return -1;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
@@ -3673,9 +3673,7 @@
 #define IXGBE_KRM_LINK_S1(P)		((P) ? 0x8200 : 0x4200)
 #define IXGBE_KRM_LINK_CTRL_1(P)	((P) ? 0x820C : 0x420C)
 #define IXGBE_KRM_AN_CNTL_1(P)		((P) ? 0x822C : 0x422C)
-#define IXGBE_KRM_AN_CNTL_4(P)		((P) ? 0x8238 : 0x4238)
 #define IXGBE_KRM_AN_CNTL_8(P)		((P) ? 0x8248 : 0x4248)
-#define IXGBE_KRM_PCS_KX_AN(P)		((P) ? 0x9918 : 0x5918)
 #define IXGBE_KRM_SGMII_CTRL(P)		((P) ? 0x82A0 : 0x42A0)
 #define IXGBE_KRM_LP_BASE_PAGE_HIGH(P)	((P) ? 0x836C : 0x436C)
 #define IXGBE_KRM_DSP_TXFFE_STATE_4(P)	((P) ? 0x8634 : 0x4634)
@@ -3685,7 +3683,6 @@
 #define IXGBE_KRM_PMD_FLX_MASK_ST20(P)	((P) ? 0x9054 : 0x5054)
 #define IXGBE_KRM_TX_COEFF_CTRL_1(P)	((P) ? 0x9520 : 0x5520)
 #define IXGBE_KRM_RX_ANA_CTL(P)		((P) ? 0x9A00 : 0x5A00)
-#define IXGBE_KRM_FLX_TMRS_CTRL_ST31(P)	((P) ? 0x9180 : 0x5180)
 
 #define IXGBE_KRM_PMD_FLX_MASK_ST20_SFI_10G_DA		~(0x3 << 20)
 #define IXGBE_KRM_PMD_FLX_MASK_ST20_SFI_10G_SR		BIT(20)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
@@ -1722,59 +1722,9 @@
 		return -EINVAL;
 	}
 
-	(void)mac->ops.write_iosf_sb_reg(hw,
-			IXGBE_KRM_PMD_FLX_MASK_ST20(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
-
-	/* change mode enforcement rules to hybrid */
-	(void)mac->ops.read_iosf_sb_reg(hw,
-			IXGBE_KRM_FLX_TMRS_CTRL_ST31(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, &reg_val);
-	reg_val |= 0x0400;
-
-	(void)mac->ops.write_iosf_sb_reg(hw,
-			IXGBE_KRM_FLX_TMRS_CTRL_ST31(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
-
-	/* manually control the config */
-	(void)mac->ops.read_iosf_sb_reg(hw,
-			IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, &reg_val);
-	reg_val |= 0x20002240;
-
-	(void)mac->ops.write_iosf_sb_reg(hw,
-			IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
-
-	/* move the AN base page values */
-	(void)mac->ops.read_iosf_sb_reg(hw,
-			IXGBE_KRM_PCS_KX_AN(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, &reg_val);
-	reg_val |= 0x1;
-
-	(void)mac->ops.write_iosf_sb_reg(hw,
-			IXGBE_KRM_PCS_KX_AN(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
-
-	/* set the AN37 over CB mode */
-	(void)mac->ops.read_iosf_sb_reg(hw,
-			IXGBE_KRM_AN_CNTL_4(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, &reg_val);
-	reg_val |= 0x20000000;
-
-	(void)mac->ops.write_iosf_sb_reg(hw,
-			IXGBE_KRM_AN_CNTL_4(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
-
-	/* restart AN manually */
-	(void)mac->ops.read_iosf_sb_reg(hw,
-			IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, &reg_val);
-	reg_val |= IXGBE_KRM_LINK_CTRL_1_TETH_AN_RESTART;
-
-	(void)mac->ops.write_iosf_sb_reg(hw,
-			IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id),
-			IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
+	status = mac->ops.write_iosf_sb_reg(hw,
+				IXGBE_KRM_PMD_FLX_MASK_ST20(hw->bus.lan_id),
+				IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
 
 	/* Toggle port SW reset by AN reset. */
 	status = ixgbe_restart_an_internal_phy_x550em(hw);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/intel/ixgbevf/ipsec.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/intel/ixgbevf/ipsec.c
@@ -629,7 +629,6 @@
 
 	switch (adapter->hw.api_version) {
 	case ixgbe_mbox_api_14:
-	case ixgbe_mbox_api_15:
 		break;
 	default:
 		return;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/jme.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/jme.c
@@ -946,15 +946,13 @@
 	if (skb->protocol != htons(ETH_P_IP))
 		return csum;
 	skb_set_network_header(skb, ETH_HLEN);
-	if ((ip_hdr(skb)->protocol != IPPROTO_UDP) ||
-	    (skb->len < (ETH_HLEN +
-			(ip_hdr(skb)->ihl << 2) +
-			sizeof(struct udphdr)))) {
+
+	if (ip_hdr(skb)->protocol != IPPROTO_UDP ||
+	    skb->len < (ETH_HLEN + ip_hdrlen(skb) + sizeof(struct udphdr))) {
 		skb_reset_network_header(skb);
 		return csum;
 	}
-	skb_set_transport_header(skb,
-			ETH_HLEN + (ip_hdr(skb)->ihl << 2));
+	skb_set_transport_header(skb, ETH_HLEN + ip_hdrlen(skb));
 	csum = udp_hdr(skb)->check;
 	skb_reset_transport_header(skb);
 	skb_reset_network_header(skb);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/lantiq_etop.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/lantiq_etop.c
@@ -217,9 +217,9 @@
 	if (ch->dma.irq)
 		free_irq(ch->dma.irq, priv);
 	if (IS_RX(ch->idx)) {
-		int desc;
+		struct ltq_dma_channel *dma = &ch->dma;
 
-		for (desc = 0; desc < LTQ_DESC_NUM; desc++)
+		for (dma->desc = 0; dma->desc < LTQ_DESC_NUM; dma->desc++)
 			dev_kfree_skb_any(ch->skb[ch->dma.desc]);
 	}
 }
@@ -482,7 +482,9 @@
 	unsigned long flags;
 	u32 byte_offset;
 
-	len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
+	if (skb_put_padto(skb, ETH_ZLEN))
+		return NETDEV_TX_OK;
+	len = skb->len;
 
 	if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) {
 		netdev_err(dev, "tx ring full\n");
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2708,9 +2708,15 @@
 
 static void mv643xx_eth_shared_of_remove(void)
 {
+	struct mv643xx_eth_platform_data *pd;
 	int n;
 
 	for (n = 0; n < 3; n++) {
+		if (!port_platdev[n])
+			continue;
+		pd = dev_get_platdata(&port_platdev[n]->dev);
+		if (pd)
+			of_node_put(pd->phy_node);
 		platform_device_del(port_platdev[n]);
 		port_platdev[n] = NULL;
 	}
@@ -2773,8 +2779,10 @@
 	}
 
 	ppdev = platform_device_alloc(MV643XX_ETH_NAME, dev_num);
-	if (!ppdev)
-		return -ENOMEM;
+	if (!ppdev) {
+		ret = -ENOMEM;
+		goto put_err;
+	}
 	ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
 	ppdev->dev.of_node = pnp;
 
@@ -2796,6 +2804,8 @@
 
 port_err:
 	platform_device_put(ppdev);
+put_err:
+	of_node_put(ppd.phy_node);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
@@ -1088,7 +1088,7 @@
 	unsigned int max_port_rxqs;
 
 	/* Workqueue to gather hardware statistics */
-	char queue_name[30];
+	char queue_name[31];
 	struct workqueue_struct *stats_queue;
 
 	/* Debugfs root entry */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -953,13 +953,13 @@
 static void mvpp2_bm_pool_update_priv_fc(struct mvpp2 *priv, bool en)
 {
 	struct mvpp2_port *port;
-	int i;
+	int i, j;
 
 	for (i = 0; i < priv->port_count; i++) {
 		port = priv->port_list[i];
 		if (port->priv->percpu_pools) {
-			for (i = 0; i < port->nrxqs; i++)
-				mvpp2_bm_pool_update_fc(port, &port->priv->bm_pools[i],
+			for (j = 0; j < port->nrxqs; j++)
+				mvpp2_bm_pool_update_fc(port, &port->priv->bm_pools[j],
 							port->tx_fc & en);
 		} else {
 			mvpp2_bm_pool_update_fc(port, port->pool_long, port->tx_fc & en);
@@ -4013,7 +4013,10 @@
 			}
 		}
 
-		skb = build_skb(data, frag_size);
+		if (frag_size)
+			skb = build_skb(data, frag_size);
+		else
+			skb = slab_build_skb(data);
 		if (!skb) {
 			netdev_warn(port->dev, "skb build failed\n");
 			goto err_drop_frame;
@@ -6903,6 +6906,7 @@
 	/* 9704 == 9728 - 20 and rounding to 8 */
 	dev->max_mtu = MVPP2_BM_JUMBO_PKT_SIZE;
 	device_set_node(&dev->dev, port_fwnode);
+	dev->dev_port = port->id;
 
 	port->pcs_gmac.ops = &mvpp2_phylink_gmac_pcs_ops;
 	port->pcs_gmac.neg_mode = true;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
@@ -337,6 +337,51 @@
 }
 
 /**
+ * octep_oq_next_pkt() - Move to the next packet in Rx queue.
+ *
+ * @oq: Octeon Rx queue data structure.
+ * @buff_info: Current packet buffer info.
+ * @read_idx: Current packet index in the ring.
+ * @desc_used: Current packet descriptor number.
+ *
+ * Free the resources associated with a packet.
+ * Increment packet index in the ring and packet descriptor number.
+ */
+static void octep_oq_next_pkt(struct octep_oq *oq,
+			      struct octep_rx_buffer *buff_info,
+			      u32 *read_idx, u32 *desc_used)
+{
+	dma_unmap_page(oq->dev, oq->desc_ring[*read_idx].buffer_ptr,
+		       PAGE_SIZE, DMA_FROM_DEVICE);
+	buff_info->page = NULL;
+	(*read_idx)++;
+	(*desc_used)++;
+	if (*read_idx == oq->max_count)
+		*read_idx = 0;
+}
+
+/**
+ * octep_oq_drop_rx() - Free the resources associated with a packet.
+ *
+ * @oq: Octeon Rx queue data structure.
+ * @buff_info: Current packet buffer info.
+ * @read_idx: Current packet index in the ring.
+ * @desc_used: Current packet descriptor number.
+ *
+ */
+static void octep_oq_drop_rx(struct octep_oq *oq,
+			     struct octep_rx_buffer *buff_info,
+			     u32 *read_idx, u32 *desc_used)
+{
+	int data_len = buff_info->len - oq->max_single_buffer_size;
+
+	while (data_len > 0) {
+		octep_oq_next_pkt(oq, buff_info, read_idx, desc_used);
+		data_len -= oq->buffer_size;
+	};
+}
+
+/**
  * __octep_oq_process_rx() - Process hardware Rx queue and push to stack.
  *
  * @oct: Octeon device private data structure.
@@ -367,10 +412,7 @@
 	desc_used = 0;
 	for (pkt = 0; pkt < pkts_to_process; pkt++) {
 		buff_info = (struct octep_rx_buffer *)&oq->buff_info[read_idx];
-		dma_unmap_page(oq->dev, oq->desc_ring[read_idx].buffer_ptr,
-			       PAGE_SIZE, DMA_FROM_DEVICE);
 		resp_hw = page_address(buff_info->page);
-		buff_info->page = NULL;
 
 		/* Swap the length field that is in Big-Endian to CPU */
 		buff_info->len = be64_to_cpu(resp_hw->length);
@@ -394,36 +436,33 @@
 			data_offset = OCTEP_OQ_RESP_HW_SIZE;
 			rx_ol_flags = 0;
 		}
+
+		octep_oq_next_pkt(oq, buff_info, &read_idx, &desc_used);
+
+		skb = build_skb((void *)resp_hw, PAGE_SIZE);
+		if (!skb) {
+			octep_oq_drop_rx(oq, buff_info,
+					 &read_idx, &desc_used);
+			oq->stats.alloc_failures++;
+			continue;
+		}
+		skb_reserve(skb, data_offset);
+
 		rx_bytes += buff_info->len;
 
 		if (buff_info->len <= oq->max_single_buffer_size) {
-			skb = build_skb((void *)resp_hw, PAGE_SIZE);
-			skb_reserve(skb, data_offset);
 			skb_put(skb, buff_info->len);
-			read_idx++;
-			desc_used++;
-			if (read_idx == oq->max_count)
-				read_idx = 0;
 		} else {
 			struct skb_shared_info *shinfo;
 			u16 data_len;
 
-			skb = build_skb((void *)resp_hw, PAGE_SIZE);
-			skb_reserve(skb, data_offset);
 			/* Head fragment includes response header(s);
 			 * subsequent fragments contains only data.
 			 */
 			skb_put(skb, oq->max_single_buffer_size);
-			read_idx++;
-			desc_used++;
-			if (read_idx == oq->max_count)
-				read_idx = 0;
-
 			shinfo = skb_shinfo(skb);
 			data_len = buff_info->len - oq->max_single_buffer_size;
 			while (data_len) {
-				dma_unmap_page(oq->dev, oq->desc_ring[read_idx].buffer_ptr,
-					       PAGE_SIZE, DMA_FROM_DEVICE);
 				buff_info = (struct octep_rx_buffer *)
 					    &oq->buff_info[read_idx];
 				if (data_len < oq->buffer_size) {
@@ -438,11 +477,8 @@
 						buff_info->page, 0,
 						buff_info->len,
 						buff_info->len);
-				buff_info->page = NULL;
-				read_idx++;
-				desc_used++;
-				if (read_idx == oq->max_count)
-					read_idx = 0;
+
+				octep_oq_next_pkt(oq, buff_info, &read_idx, &desc_used);
 			}
 		}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
@@ -24,6 +24,8 @@
 #define DRV_NAME	"Marvell-CGX/RPM"
 #define DRV_STRING      "Marvell CGX/RPM Driver"
 
+#define CGX_RX_STAT_GLOBAL_INDEX	9
+
 static LIST_HEAD(cgx_list);
 
 /* Convert firmware speed encoding to user format(Mbps) */
@@ -110,6 +112,11 @@
 	return ((struct cgx *)cgxd)->mac_ops;
 }
 
+u32 cgx_get_fifo_len(void *cgxd)
+{
+	return ((struct cgx *)cgxd)->fifo_len;
+}
+
 void cgx_write(struct cgx *cgx, u64 lmac, u64 offset, u64 val)
 {
 	writeq(val, cgx->reg_base + (lmac << cgx->mac_ops->lmac_offset) +
@@ -207,6 +214,24 @@
 	return (cfg & CMR_P2X_SEL_MASK) >> CMR_P2X_SEL_SHIFT;
 }
 
+static u8 cgx_get_nix_resetbit(struct cgx *cgx)
+{
+	int first_lmac;
+	u8 p2x;
+
+	/* non 98XX silicons supports only NIX0 block */
+	if (cgx->pdev->subsystem_device != PCI_SUBSYS_DEVID_98XX)
+		return CGX_NIX0_RESET;
+
+	first_lmac = find_first_bit(&cgx->lmac_bmap, cgx->max_lmac_per_mac);
+	p2x = cgx_lmac_get_p2x(cgx->cgx_id, first_lmac);
+
+	if (p2x == CMR_P2X_SEL_NIX1)
+		return CGX_NIX1_RESET;
+	else
+		return CGX_NIX0_RESET;
+}
+
 /* Ensure the required lock for event queue(where asynchronous events are
  * posted) is acquired before calling this API. Else an asynchronous event(with
  * latest link status) can reach the destination before this function returns
@@ -499,7 +524,7 @@
 	u8 num_lmacs;
 	u32 fifo_len;
 
-	fifo_len = cgx->mac_ops->fifo_len;
+	fifo_len = cgx->fifo_len;
 	num_lmacs = cgx->mac_ops->get_nr_lmacs(cgx);
 
 	switch (num_lmacs) {
@@ -701,6 +726,30 @@
 	return ((struct cgx *)cgxd)->hw_features;
 }
 
+int cgx_stats_reset(void *cgxd, int lmac_id)
+{
+	struct cgx *cgx = cgxd;
+	int stat_id;
+
+	if (!is_lmac_valid(cgx, lmac_id))
+		return -ENODEV;
+
+	for (stat_id = 0 ; stat_id < CGX_RX_STATS_COUNT; stat_id++) {
+		if (stat_id >= CGX_RX_STAT_GLOBAL_INDEX)
+		/* pass lmac as 0 for CGX_CMR_RX_STAT9-12 */
+			cgx_write(cgx, 0,
+				  (CGXX_CMRX_RX_STAT0 + (stat_id * 8)), 0);
+		else
+			cgx_write(cgx, lmac_id,
+				  (CGXX_CMRX_RX_STAT0 + (stat_id * 8)), 0);
+	}
+
+	for (stat_id = 0 ; stat_id < CGX_TX_STATS_COUNT; stat_id++)
+		cgx_write(cgx, lmac_id, CGXX_CMRX_TX_STAT0 + (stat_id * 8), 0);
+
+	return 0;
+}
+
 static int cgx_set_fec_stats_count(struct cgx_link_user_info *linfo)
 {
 	if (!linfo->fec)
@@ -808,6 +857,11 @@
 	if (!is_lmac_valid(cgx, lmac_id))
 		return -ENODEV;
 
+	cfg = cgx_read(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL);
+	cfg &= ~CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK;
+	cfg |= rx_pause ? CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK : 0x0;
+	cgx_write(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL, cfg);
+
 	cfg = cgx_read(cgx, lmac_id, CGXX_SMUX_RX_FRM_CTL);
 	cfg &= ~CGX_SMUX_RX_FRM_CTL_CTL_BCK;
 	cfg |= rx_pause ? CGX_SMUX_RX_FRM_CTL_CTL_BCK : 0x0;
@@ -1338,7 +1392,7 @@
 
 		/* Release thread waiting for completion  */
 		lmac->cmd_pend = false;
-		wake_up_interruptible(&lmac->wq_cmd_cmplt);
+		wake_up(&lmac->wq_cmd_cmplt);
 		break;
 	case CGX_EVT_ASYNC:
 		if (cgx_event_is_linkevent(event))
@@ -1688,6 +1742,8 @@
 		lmac->lmac_type = cgx->mac_ops->get_lmac_type(cgx, lmac->lmac_id);
 	}
 
+	/* Start X2P reset on given MAC block */
+	cgx->mac_ops->mac_x2p_reset(cgx, true);
 	return cgx_lmac_verify_fwi_version(cgx);
 
 err_bitmap_free:
@@ -1733,7 +1789,7 @@
 	u64 cfg;
 
 	cfg = cgx_read(cgx, 0, CGX_CONST);
-	cgx->mac_ops->fifo_len = FIELD_GET(CGX_CONST_RXFIFO_SIZE, cfg);
+	cgx->fifo_len = FIELD_GET(CGX_CONST_RXFIFO_SIZE, cfg);
 	cgx->max_lmac_per_mac = FIELD_GET(CGX_CONST_MAX_LMACS, cfg);
 
 	if (is_dev_rpm(cgx))
@@ -1753,6 +1809,45 @@
 		return 0x60;
 }
 
+static void cgx_x2p_reset(void *cgxd, bool enable)
+{
+	struct cgx *cgx = cgxd;
+	int lmac_id;
+	u64 cfg;
+
+	if (enable) {
+		for_each_set_bit(lmac_id, &cgx->lmac_bmap, cgx->max_lmac_per_mac)
+			cgx->mac_ops->mac_enadis_rx(cgx, lmac_id, false);
+
+		usleep_range(1000, 2000);
+
+		cfg = cgx_read(cgx, 0, CGXX_CMR_GLOBAL_CONFIG);
+		cfg |= cgx_get_nix_resetbit(cgx) | CGX_NSCI_DROP;
+		cgx_write(cgx, 0, CGXX_CMR_GLOBAL_CONFIG, cfg);
+	} else {
+		cfg = cgx_read(cgx, 0, CGXX_CMR_GLOBAL_CONFIG);
+		cfg &= ~(cgx_get_nix_resetbit(cgx) | CGX_NSCI_DROP);
+		cgx_write(cgx, 0, CGXX_CMR_GLOBAL_CONFIG, cfg);
+	}
+}
+
+static int cgx_enadis_rx(void *cgxd, int lmac_id, bool enable)
+{
+	struct cgx *cgx = cgxd;
+	u64 cfg;
+
+	if (!is_lmac_valid(cgx, lmac_id))
+		return -ENODEV;
+
+	cfg = cgx_read(cgx, lmac_id, CGXX_CMRX_CFG);
+	if (enable)
+		cfg |= DATA_PKT_RX_EN;
+	else
+		cfg &= ~DATA_PKT_RX_EN;
+	cgx_write(cgx, lmac_id, CGXX_CMRX_CFG, cfg);
+	return 0;
+}
+
 static struct mac_ops	cgx_mac_ops    = {
 	.name		=       "cgx",
 	.csr_offset	=       0,
@@ -1783,6 +1878,9 @@
 	.pfc_config =                   cgx_lmac_pfc_config,
 	.mac_get_pfc_frm_cfg   =        cgx_lmac_get_pfc_frm_cfg,
 	.mac_reset   =			cgx_lmac_reset,
+	.mac_stats_reset       =	cgx_stats_reset,
+	.mac_x2p_reset                   =      cgx_x2p_reset,
+	.mac_enadis_rx			 =      cgx_enadis_rx,
 };
 
 static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
@@ -32,6 +32,10 @@
 #define CGX_LMAC_TYPE_MASK		0xF
 #define CGXX_CMRX_INT			0x040
 #define FW_CGX_INT			BIT_ULL(1)
+#define CGXX_CMR_GLOBAL_CONFIG          0x08
+#define CGX_NIX0_RESET			BIT_ULL(2)
+#define CGX_NIX1_RESET			BIT_ULL(3)
+#define CGX_NSCI_DROP			BIT_ULL(9)
 #define CGXX_CMRX_INT_ENA_W1S		0x058
 #define CGXX_CMRX_RX_ID_MAP		0x060
 #define CGXX_CMRX_RX_STAT0		0x070
@@ -141,6 +145,7 @@
 int cgx_lmac_evh_unregister(void *cgxd, int lmac_id);
 int cgx_get_tx_stats(void *cgxd, int lmac_id, int idx, u64 *tx_stat);
 int cgx_get_rx_stats(void *cgxd, int lmac_id, int idx, u64 *rx_stat);
+int cgx_stats_reset(void *cgxd, int lmac_id);
 int cgx_lmac_rx_tx_enable(void *cgxd, int lmac_id, bool enable);
 int cgx_lmac_tx_enable(void *cgxd, int lmac_id, bool enable);
 int cgx_lmac_addr_set(u8 cgx_id, u8 lmac_id, u8 *mac_addr);
@@ -184,4 +189,5 @@
 int verify_lmac_fc_cfg(void *cgxd, int lmac_id, u8 tx_pause, u8 rx_pause,
 		       int pfvf_idx);
 int cgx_lmac_reset(void *cgxd, int lmac_id, u8 pf_req_flr);
+u32 cgx_get_fifo_len(void *cgxd);
 #endif /* CGX_H */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
@@ -72,7 +72,6 @@
 	u8			irq_offset;
 	u8			int_ena_bit;
 	u8			lmac_fwi;
-	u32			fifo_len;
 	bool			non_contiguous_serdes_lane;
 	/* RPM & CGX differs in number of Receive/transmit stats */
 	u8			rx_stats_cnt;
@@ -132,6 +131,9 @@
 	/* FEC stats */
 	int			(*get_fec_stats)(void *cgxd, int lmac_id,
 						 struct cgx_fec_stats_rsp *rsp);
+	int			(*mac_stats_reset)(void *cgxd, int lmac_id);
+	void                    (*mac_x2p_reset)(void *cgxd, bool enable);
+	int			(*mac_enadis_rx)(void *cgxd, int lmac_id, bool enable);
 };
 
 struct cgx {
@@ -141,6 +143,10 @@
 	u8			lmac_count;
 	/* number of LMACs per MAC could be 4 or 8 */
 	u8			max_lmac_per_mac;
+	/* length of fifo varies depending on the number
+	 * of LMACS
+	 */
+	u32			fifo_len;
 #define MAX_LMAC_COUNT		8
 	struct lmac             *lmac_idmap[MAX_LMAC_COUNT];
 	struct			work_struct cgx_cmd_work;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/mbox.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/mbox.c
@@ -214,11 +214,12 @@
 }
 EXPORT_SYMBOL(otx2_mbox_busy_poll_for_rsp);
 
-void otx2_mbox_msg_send(struct otx2_mbox *mbox, int devid)
+static void otx2_mbox_msg_send_data(struct otx2_mbox *mbox, int devid, u64 data)
 {
 	struct otx2_mbox_dev *mdev = &mbox->dev[devid];
 	struct mbox_hdr *tx_hdr, *rx_hdr;
 	void *hw_mbase = mdev->hwbase;
+	u64 intr_val;
 
 	tx_hdr = hw_mbase + mbox->tx_start;
 	rx_hdr = hw_mbase + mbox->rx_start;
@@ -254,14 +255,52 @@
 
 	spin_unlock(&mdev->mbox_lock);
 
+	/* Check if interrupt pending */
+	intr_val = readq((void __iomem *)mbox->reg_base +
+		     (mbox->trigger | (devid << mbox->tr_shift)));
+
+	intr_val |= data;
 	/* The interrupt should be fired after num_msgs is written
 	 * to the shared memory
 	 */
-	writeq(1, (void __iomem *)mbox->reg_base +
+	writeq(intr_val, (void __iomem *)mbox->reg_base +
 	       (mbox->trigger | (devid << mbox->tr_shift)));
 }
+
+void otx2_mbox_msg_send(struct otx2_mbox *mbox, int devid)
+{
+	otx2_mbox_msg_send_data(mbox, devid, MBOX_DOWN_MSG);
+}
 EXPORT_SYMBOL(otx2_mbox_msg_send);
 
+void otx2_mbox_msg_send_up(struct otx2_mbox *mbox, int devid)
+{
+	otx2_mbox_msg_send_data(mbox, devid, MBOX_UP_MSG);
+}
+EXPORT_SYMBOL(otx2_mbox_msg_send_up);
+
+bool otx2_mbox_wait_for_zero(struct otx2_mbox *mbox, int devid)
+{
+	u64 data;
+
+	data = readq((void __iomem *)mbox->reg_base +
+		     (mbox->trigger | (devid << mbox->tr_shift)));
+
+	/* If data is non-zero wait for ~1ms and return to caller
+	 * whether data has changed to zero or not after the wait.
+	 */
+	if (!data)
+		return true;
+
+	usleep_range(950, 1000);
+
+	data = readq((void __iomem *)mbox->reg_base +
+		     (mbox->trigger | (devid << mbox->tr_shift)));
+
+	return data == 0;
+}
+EXPORT_SYMBOL(otx2_mbox_wait_for_zero);
+
 struct mbox_msghdr *otx2_mbox_alloc_msg_rsp(struct otx2_mbox *mbox, int devid,
 					    int size, int size_rsp)
 {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
@@ -16,6 +16,9 @@
 
 #define MBOX_SIZE		SZ_64K
 
+#define MBOX_DOWN_MSG		1
+#define MBOX_UP_MSG		2
+
 /* AF/PF: PF initiated, PF/VF VF initiated */
 #define MBOX_DOWN_RX_START	0
 #define MBOX_DOWN_RX_SIZE	(46 * SZ_1K)
@@ -101,6 +104,7 @@
 			   struct pci_dev *pdev, void __force *reg_base,
 			   int direction, int ndevs, unsigned long *bmap);
 void otx2_mbox_msg_send(struct otx2_mbox *mbox, int devid);
+void otx2_mbox_msg_send_up(struct otx2_mbox *mbox, int devid);
 int otx2_mbox_wait_for_rsp(struct otx2_mbox *mbox, int devid);
 int otx2_mbox_busy_poll_for_rsp(struct otx2_mbox *mbox, int devid);
 struct mbox_msghdr *otx2_mbox_alloc_msg_rsp(struct otx2_mbox *mbox, int devid,
@@ -118,6 +122,8 @@
 	return otx2_mbox_alloc_msg_rsp(mbox, devid, size, 0);
 }
 
+bool otx2_mbox_wait_for_zero(struct otx2_mbox *mbox, int devid);
+
 /* Mailbox message types */
 #define MBOX_MSG_MASK				0xFFFF
 #define MBOX_MSG_INVALID			0xFFFE
@@ -168,6 +174,7 @@
 M(CGX_SET_LINK_MODE,	0x218, cgx_set_link_mode, cgx_set_link_mode_req,\
 			       cgx_set_link_mode_rsp)	\
 M(CGX_GET_PHY_FEC_STATS, 0x219, cgx_get_phy_fec_stats, msg_req, msg_rsp) \
+M(CGX_STATS_RST,	0x21A, cgx_stats_rst, msg_req, msg_rsp)		\
 M(CGX_FEATURES_GET,	0x21B, cgx_features_get, msg_req,		\
 			       cgx_features_info_msg)			\
 M(RPM_STATS,		0x21C, rpm_stats, msg_req, rpm_stats_rsp)	\
@@ -1736,7 +1743,7 @@
 	u16 nix_pf_func;
 	u16 sso_pf_func;
 	u16 eng_grpmsk;
-	int blkaddr;
+	u8 blkaddr;
 	u8 ctx_ilen_valid : 1;
 	u8 ctx_ilen : 7;
 };
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
@@ -121,13 +121,17 @@
 static int mcs_notify_pfvf(struct mcs_intr_event *event, struct rvu *rvu)
 {
 	struct mcs_intr_info *req;
-	int err, pf;
+	int pf;
 
 	pf = rvu_get_pf(event->pcifunc);
 
+	mutex_lock(&rvu->mbox_lock);
+
 	req = otx2_mbox_alloc_msg_mcs_intr_notify(rvu, pf);
-	if (!req)
+	if (!req) {
+		mutex_unlock(&rvu->mbox_lock);
 		return -ENOMEM;
+	}
 
 	req->mcs_id = event->mcs_id;
 	req->intr_mask = event->intr_mask;
@@ -135,10 +139,11 @@
 	req->hdr.pcifunc = event->pcifunc;
 	req->lmac_id = event->lmac_id;
 
-	otx2_mbox_msg_send(&rvu->afpf_wq_info.mbox_up, pf);
-	err = otx2_mbox_wait_for_rsp(&rvu->afpf_wq_info.mbox_up, pf);
-	if (err)
-		dev_warn(rvu->dev, "MCS notification to pf %d failed\n", pf);
+	otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, pf);
+
+	otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, pf);
+
+	mutex_unlock(&rvu->mbox_lock);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/npc.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/npc.h
@@ -63,8 +63,13 @@
 	NPC_LT_LB_CUSTOM1 = 0xF,
 };
 
+/* Don't modify ltypes up to IP6_EXT, otherwise length and checksum of IP
+ * headers may not be checked correctly. IPv4 ltypes and IPv6 ltypes must
+ * differ only at bit 0 so mask 0xE can be used to detect extended headers.
+ */
 enum npc_kpu_lc_ltype {
-	NPC_LT_LC_IP = 1,
+	NPC_LT_LC_PTP = 1,
+	NPC_LT_LC_IP,
 	NPC_LT_LC_IP_OPT,
 	NPC_LT_LC_IP6,
 	NPC_LT_LC_IP6_EXT,
@@ -72,7 +77,6 @@
 	NPC_LT_LC_RARP,
 	NPC_LT_LC_MPLS,
 	NPC_LT_LC_NSH,
-	NPC_LT_LC_PTP,
 	NPC_LT_LC_FCOE,
 	NPC_LT_LC_NGIO,
 	NPC_LT_LC_CUSTOM0 = 0xE,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
@@ -38,6 +38,9 @@
 	.pfc_config =                   rpm_lmac_pfc_config,
 	.mac_get_pfc_frm_cfg   =        rpm_lmac_get_pfc_frm_cfg,
 	.mac_reset   =			rpm_lmac_reset,
+	.mac_stats_reset		 =	  rpm_stats_reset,
+	.mac_x2p_reset                   =        rpm_x2p_reset,
+	.mac_enadis_rx			 =        rpm_enadis_rx,
 };
 
 static struct mac_ops		rpm2_mac_ops   = {
@@ -70,6 +73,9 @@
 	.pfc_config =                   rpm_lmac_pfc_config,
 	.mac_get_pfc_frm_cfg   =        rpm_lmac_get_pfc_frm_cfg,
 	.mac_reset   =			rpm_lmac_reset,
+	.mac_stats_reset	    =	rpm_stats_reset,
+	.mac_x2p_reset              =   rpm_x2p_reset,
+	.mac_enadis_rx		    =   rpm_enadis_rx,
 };
 
 bool is_dev_rpm2(void *rpmd)
@@ -443,6 +449,21 @@
 	return 0;
 }
 
+int rpm_stats_reset(void *rpmd, int lmac_id)
+{
+	rpm_t *rpm = rpmd;
+	u64 cfg;
+
+	if (!is_lmac_valid(rpm, lmac_id))
+		return -ENODEV;
+
+	cfg = rpm_read(rpm, 0, RPMX_MTI_STAT_STATN_CONTROL);
+	cfg |= RPMX_CMD_CLEAR_TX | RPMX_CMD_CLEAR_RX | BIT_ULL(lmac_id);
+	rpm_write(rpm, 0, RPMX_MTI_STAT_STATN_CONTROL, cfg);
+
+	return 0;
+}
+
 u8 rpm_get_lmac_type(void *rpmd, int lmac_id)
 {
 	rpm_t *rpm = rpmd;
@@ -450,7 +471,7 @@
 	int err;
 
 	req = FIELD_SET(CMDREG_ID, CGX_CMD_GET_LINK_STS, req);
-	err = cgx_fwi_cmd_generic(req, &resp, rpm, 0);
+	err = cgx_fwi_cmd_generic(req, &resp, rpm, lmac_id);
 	if (!err)
 		return FIELD_GET(RESP_LINKSTAT_LMAC_TYPE, resp);
 	return err;
@@ -463,7 +484,7 @@
 	u8 num_lmacs;
 	u32 fifo_len;
 
-	fifo_len = rpm->mac_ops->fifo_len;
+	fifo_len = rpm->fifo_len;
 	num_lmacs = rpm->mac_ops->get_nr_lmacs(rpm);
 
 	switch (num_lmacs) {
@@ -516,9 +537,9 @@
 	 */
 	max_lmac = (rpm_read(rpm, 0, CGX_CONST) >> 24) & 0xFF;
 	if (max_lmac > 4)
-		fifo_len = rpm->mac_ops->fifo_len / 2;
+		fifo_len = rpm->fifo_len / 2;
 	else
-		fifo_len = rpm->mac_ops->fifo_len;
+		fifo_len = rpm->fifo_len;
 
 	if (lmac_id < 4) {
 		num_lmacs = hweight8(lmac_info & 0xF);
@@ -682,46 +703,51 @@
 	if (rpm->lmac_idmap[lmac_id]->link_info.fec == OTX2_FEC_NONE)
 		return 0;
 
+	/* latched registers FCFECX_CW_HI/RSFEC_STAT_FAST_DATA_HI_CDC are common
+	 * for all counters. Acquire lock to ensure serialized reads
+	 */
+	mutex_lock(&rpm->lock);
 	if (rpm->lmac_idmap[lmac_id]->link_info.fec == OTX2_FEC_BASER) {
-		val_lo = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_VL0_CCW_LO);
-		val_hi = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_CW_HI);
+		val_lo = rpm_read(rpm, 0, RPMX_MTI_FCFECX_VL0_CCW_LO(lmac_id));
+		val_hi = rpm_read(rpm, 0, RPMX_MTI_FCFECX_CW_HI(lmac_id));
 		rsp->fec_corr_blks = (val_hi << 16 | val_lo);
 
-		val_lo = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_VL0_NCCW_LO);
-		val_hi = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_CW_HI);
+		val_lo = rpm_read(rpm, 0, RPMX_MTI_FCFECX_VL0_NCCW_LO(lmac_id));
+		val_hi = rpm_read(rpm, 0, RPMX_MTI_FCFECX_CW_HI(lmac_id));
 		rsp->fec_uncorr_blks = (val_hi << 16 | val_lo);
 
 		/* 50G uses 2 Physical serdes lines */
 		if (rpm->lmac_idmap[lmac_id]->link_info.lmac_type_id ==
 		    LMAC_MODE_50G_R) {
-			val_lo = rpm_read(rpm, lmac_id,
-					  RPMX_MTI_FCFECX_VL1_CCW_LO);
-			val_hi = rpm_read(rpm, lmac_id,
-					  RPMX_MTI_FCFECX_CW_HI);
+			val_lo = rpm_read(rpm, 0,
+					  RPMX_MTI_FCFECX_VL1_CCW_LO(lmac_id));
+			val_hi = rpm_read(rpm, 0,
+					  RPMX_MTI_FCFECX_CW_HI(lmac_id));
 			rsp->fec_corr_blks += (val_hi << 16 | val_lo);
 
-			val_lo = rpm_read(rpm, lmac_id,
-					  RPMX_MTI_FCFECX_VL1_NCCW_LO);
-			val_hi = rpm_read(rpm, lmac_id,
-					  RPMX_MTI_FCFECX_CW_HI);
+			val_lo = rpm_read(rpm, 0,
+					  RPMX_MTI_FCFECX_VL1_NCCW_LO(lmac_id));
+			val_hi = rpm_read(rpm, 0,
+					  RPMX_MTI_FCFECX_CW_HI(lmac_id));
 			rsp->fec_uncorr_blks += (val_hi << 16 | val_lo);
 		}
 	} else {
 		/* enable RS-FEC capture */
-		cfg = rpm_read(rpm, 0, RPMX_MTI_STAT_STATN_CONTROL);
+		cfg = rpm_read(rpm, 0, RPMX_MTI_RSFEC_STAT_STATN_CONTROL);
 		cfg |= RPMX_RSFEC_RX_CAPTURE | BIT(lmac_id);
-		rpm_write(rpm, 0, RPMX_MTI_STAT_STATN_CONTROL, cfg);
+		rpm_write(rpm, 0, RPMX_MTI_RSFEC_STAT_STATN_CONTROL, cfg);
 
 		val_lo = rpm_read(rpm, 0,
 				  RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_2);
-		val_hi = rpm_read(rpm, 0, RPMX_MTI_STAT_DATA_HI_CDC);
+		val_hi = rpm_read(rpm, 0, RPMX_MTI_RSFEC_STAT_FAST_DATA_HI_CDC);
 		rsp->fec_corr_blks = (val_hi << 32 | val_lo);
 
 		val_lo = rpm_read(rpm, 0,
 				  RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_3);
-		val_hi = rpm_read(rpm, 0, RPMX_MTI_STAT_DATA_HI_CDC);
+		val_hi = rpm_read(rpm, 0, RPMX_MTI_RSFEC_STAT_FAST_DATA_HI_CDC);
 		rsp->fec_uncorr_blks = (val_hi << 32 | val_lo);
 	}
+	mutex_unlock(&rpm->lock);
 
 	return 0;
 }
@@ -746,3 +772,41 @@
 
 	return 0;
 }
+
+void rpm_x2p_reset(void *rpmd, bool enable)
+{
+	rpm_t *rpm = rpmd;
+	int lmac_id;
+	u64 cfg;
+
+	if (enable) {
+		for_each_set_bit(lmac_id, &rpm->lmac_bmap, rpm->max_lmac_per_mac)
+			rpm->mac_ops->mac_enadis_rx(rpm, lmac_id, false);
+
+		usleep_range(1000, 2000);
+
+		cfg = rpm_read(rpm, 0, RPMX_CMR_GLOBAL_CFG);
+		rpm_write(rpm, 0, RPMX_CMR_GLOBAL_CFG, cfg | RPM_NIX0_RESET);
+	} else {
+		cfg = rpm_read(rpm, 0, RPMX_CMR_GLOBAL_CFG);
+		cfg &= ~RPM_NIX0_RESET;
+		rpm_write(rpm, 0, RPMX_CMR_GLOBAL_CFG, cfg);
+	}
+}
+
+int rpm_enadis_rx(void *rpmd, int lmac_id, bool enable)
+{
+	rpm_t *rpm = rpmd;
+	u64 cfg;
+
+	if (!is_lmac_valid(rpm, lmac_id))
+		return -ENODEV;
+
+	cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG);
+	if (enable)
+		cfg |= RPM_RX_EN;
+	else
+		cfg &= ~RPM_RX_EN;
+	rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
@@ -17,6 +17,8 @@
 
 /* Registers */
 #define RPMX_CMRX_CFG			0x00
+#define RPMX_CMR_GLOBAL_CFG		0x08
+#define RPM_NIX0_RESET			BIT_ULL(3)
 #define RPMX_RX_TS_PREPEND              BIT_ULL(22)
 #define RPMX_TX_PTP_1S_SUPPORT          BIT_ULL(17)
 #define RPMX_CMRX_RX_ID_MAP		0x80
@@ -84,14 +86,18 @@
 /* FEC stats */
 #define RPMX_MTI_STAT_STATN_CONTROL			0x10018
 #define RPMX_MTI_STAT_DATA_HI_CDC			0x10038
-#define RPMX_RSFEC_RX_CAPTURE				BIT_ULL(27)
+#define RPMX_RSFEC_RX_CAPTURE				BIT_ULL(28)
+#define RPMX_CMD_CLEAR_RX				BIT_ULL(30)
+#define RPMX_CMD_CLEAR_TX				BIT_ULL(31)
+#define RPMX_MTI_RSFEC_STAT_STATN_CONTROL               0x40018
+#define RPMX_MTI_RSFEC_STAT_FAST_DATA_HI_CDC            0x40000
 #define RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_2		0x40050
 #define RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_3		0x40058
-#define RPMX_MTI_FCFECX_VL0_CCW_LO			0x38618
-#define RPMX_MTI_FCFECX_VL0_NCCW_LO			0x38620
-#define RPMX_MTI_FCFECX_VL1_CCW_LO			0x38628
-#define RPMX_MTI_FCFECX_VL1_NCCW_LO			0x38630
-#define RPMX_MTI_FCFECX_CW_HI				0x38638
+#define RPMX_MTI_FCFECX_VL0_CCW_LO(a)			(0x38618 + ((a) * 0x40))
+#define RPMX_MTI_FCFECX_VL0_NCCW_LO(a)			(0x38620 + ((a) * 0x40))
+#define RPMX_MTI_FCFECX_VL1_CCW_LO(a)			(0x38628 + ((a) * 0x40))
+#define RPMX_MTI_FCFECX_VL1_NCCW_LO(a)			(0x38630 + ((a) * 0x40))
+#define RPMX_MTI_FCFECX_CW_HI(a)			(0x38638 + ((a) * 0x40))
 
 /* CN10KB CSR Declaration */
 #define  RPM2_CMRX_SW_INT				0x1b0
@@ -134,4 +140,7 @@
 bool is_dev_rpm2(void *rpmd);
 int rpm_get_fec_stats(void *cgxd, int lmac_id, struct cgx_fec_stats_rsp *rsp);
 int rpm_lmac_reset(void *rpmd, int lmac_id, u8 pf_req_flr);
+int rpm_stats_reset(void *rpmd, int lmac_id);
+void rpm_x2p_reset(void *rpmd, bool enable);
+int rpm_enadis_rx(void *rpmd, int lmac_id, bool enable);
 #endif /* RPM_H */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
@@ -1160,6 +1160,7 @@
 	}
 
 	rvu_program_channels(rvu);
+	cgx_start_linkup(rvu);
 
 	err = rvu_mcs_init(rvu);
 	if (err) {
@@ -1641,7 +1642,7 @@
 		if (req->ssow > block->lf.max) {
 			dev_err(&rvu->pdev->dev,
 				"Func 0x%x: Invalid SSOW req, %d > max %d\n",
-				 pcifunc, req->sso, block->lf.max);
+				 pcifunc, req->ssow, block->lf.max);
 			return -EINVAL;
 		}
 		mappedlfs = rvu_get_rsrc_mapcount(pfvf, block->addr);
@@ -2117,7 +2118,7 @@
 	}
 }
 
-static void __rvu_mbox_handler(struct rvu_work *mwork, int type)
+static void __rvu_mbox_handler(struct rvu_work *mwork, int type, bool poll)
 {
 	struct rvu *rvu = mwork->rvu;
 	int offset, err, id, devid;
@@ -2184,6 +2185,9 @@
 	}
 	mw->mbox_wrk[devid].num_msgs = 0;
 
+	if (poll)
+		otx2_mbox_wait_for_zero(mbox, devid);
+
 	/* Send mbox responses to VF/PF */
 	otx2_mbox_msg_send(mbox, devid);
 }
@@ -2191,15 +2195,18 @@
 static inline void rvu_afpf_mbox_handler(struct work_struct *work)
 {
 	struct rvu_work *mwork = container_of(work, struct rvu_work, work);
+	struct rvu *rvu = mwork->rvu;
 
-	__rvu_mbox_handler(mwork, TYPE_AFPF);
+	mutex_lock(&rvu->mbox_lock);
+	__rvu_mbox_handler(mwork, TYPE_AFPF, true);
+	mutex_unlock(&rvu->mbox_lock);
 }
 
 static inline void rvu_afvf_mbox_handler(struct work_struct *work)
 {
 	struct rvu_work *mwork = container_of(work, struct rvu_work, work);
 
-	__rvu_mbox_handler(mwork, TYPE_AFVF);
+	__rvu_mbox_handler(mwork, TYPE_AFVF, false);
 }
 
 static void __rvu_mbox_up_handler(struct rvu_work *mwork, int type)
@@ -2374,6 +2381,8 @@
 		}
 	}
 
+	mutex_init(&rvu->mbox_lock);
+
 	mbox_regions = kcalloc(num, sizeof(void *), GFP_KERNEL);
 	if (!mbox_regions) {
 		err = -ENOMEM;
@@ -2523,10 +2532,9 @@
 	}
 }
 
-static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq)
+static irqreturn_t rvu_mbox_pf_intr_handler(int irq, void *rvu_irq)
 {
 	struct rvu *rvu = (struct rvu *)rvu_irq;
-	int vfs = rvu->vfs;
 	u64 intr;
 
 	intr = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_PFAF_MBOX_INT);
@@ -2540,6 +2548,18 @@
 
 	rvu_queue_work(&rvu->afpf_wq_info, 0, rvu->hw->total_pfs, intr);
 
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq)
+{
+	struct rvu *rvu = (struct rvu *)rvu_irq;
+	int vfs = rvu->vfs;
+	u64 intr;
+
+	/* Sync with mbox memory region */
+	rmb();
+
 	/* Handle VF interrupts */
 	if (vfs > 64) {
 		intr = rvupf_read64(rvu, RVU_PF_VFPF_MBOX_INTX(1));
@@ -2881,7 +2901,7 @@
 	/* Register mailbox interrupt handler */
 	sprintf(&rvu->irq_name[RVU_AF_INT_VEC_MBOX * NAME_SIZE], "RVUAF Mbox");
 	ret = request_irq(pci_irq_vector(rvu->pdev, RVU_AF_INT_VEC_MBOX),
-			  rvu_mbox_intr_handler, 0,
+			  rvu_mbox_pf_intr_handler, 0,
 			  &rvu->irq_name[RVU_AF_INT_VEC_MBOX * NAME_SIZE], rvu);
 	if (ret) {
 		dev_err(rvu->dev,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
@@ -308,6 +308,7 @@
 
 /* smq(flush) to tl1 cir/pir info */
 struct nix_smq_tree_ctx {
+	u16 schq;
 	u64 cir_off;
 	u64 cir_val;
 	u64 pir_off;
@@ -317,8 +318,6 @@
 /* smq flush context */
 struct nix_smq_flush_ctx {
 	int smq;
-	u16 tl1_schq;
-	u16 tl2_schq;
 	struct nix_smq_tree_ctx smq_tree_ctx[NIX_TXSCH_LVL_CNT];
 };
 
@@ -570,6 +569,8 @@
 	spinlock_t		mcs_intrq_lock;
 	/* CPT interrupt lock */
 	spinlock_t		cpt_intr_lock;
+
+	struct mutex		mbox_lock; /* Serialize mbox up and down msgs */
 };
 
 static inline void rvu_write64(struct rvu *rvu, u64 block, u64 offset, u64 val)
@@ -940,6 +941,7 @@
 int rvu_cgx_cfg_pause_frm(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_pause);
 void rvu_mac_reset(struct rvu *rvu, u16 pcifunc);
 u32 rvu_cgx_get_lmac_fifolen(struct rvu *rvu, int cgx, int lmac);
+void cgx_start_linkup(struct rvu *rvu);
 int npc_get_nixlf_mcam_index(struct npc_mcam *mcam, u16 pcifunc, int nixlf,
 			     int type);
 bool is_mcam_entry_enabled(struct rvu *rvu, struct npc_mcam *mcam, int blkaddr,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
@@ -160,6 +160,8 @@
 			continue;
 		lmac_bmap = cgx_get_lmac_bmap(rvu_cgx_pdata(cgx, rvu));
 		for_each_set_bit(iter, &lmac_bmap, rvu->hw->lmac_per_cgx) {
+			if (iter >= MAX_LMAC_COUNT)
+				continue;
 			lmac = cgx_get_lmacid(rvu_cgx_pdata(cgx, rvu),
 					      iter);
 			rvu->pf2cgxlmac_map[pf] = cgxlmac_id_to_bmap(cgx, lmac);
@@ -232,7 +234,7 @@
 	struct cgx_link_user_info *linfo;
 	struct cgx_link_info_msg *msg;
 	unsigned long pfmap;
-	int err, pfid;
+	int pfid;
 
 	linfo = &event->link_uinfo;
 	pfmap = cgxlmac_to_pfmap(rvu, event->cgx_id, event->lmac_id);
@@ -255,16 +257,22 @@
 			continue;
 		}
 
+		mutex_lock(&rvu->mbox_lock);
+
 		/* Send mbox message to PF */
 		msg = otx2_mbox_alloc_msg_cgx_link_event(rvu, pfid);
-		if (!msg)
+		if (!msg) {
+			mutex_unlock(&rvu->mbox_lock);
 			continue;
+		}
+
 		msg->link_info = *linfo;
-		otx2_mbox_msg_send(&rvu->afpf_wq_info.mbox_up, pfid);
-		err = otx2_mbox_wait_for_rsp(&rvu->afpf_wq_info.mbox_up, pfid);
-		if (err)
-			dev_warn(rvu->dev, "notification to pf %d failed\n",
-				 pfid);
+
+		otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, pfid);
+
+		otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, pfid);
+
+		mutex_unlock(&rvu->mbox_lock);
 	} while (pfmap);
 }
 
@@ -341,6 +349,7 @@
 
 int rvu_cgx_init(struct rvu *rvu)
 {
+	struct mac_ops *mac_ops;
 	int cgx, err;
 	void *cgxd;
 
@@ -367,6 +376,15 @@
 	if (err)
 		return err;
 
+	/* Clear X2P reset on all MAC blocks */
+	for (cgx = 0; cgx < rvu->cgx_cnt_max; cgx++) {
+		cgxd = rvu_cgx_pdata(cgx, rvu);
+		if (!cgxd)
+			continue;
+		mac_ops = get_mac_ops(cgxd);
+		mac_ops->mac_x2p_reset(cgxd, false);
+	}
+
 	/* Register for CGX events */
 	err = cgx_lmac_event_handler_init(rvu);
 	if (err)
@@ -374,10 +392,26 @@
 
 	mutex_init(&rvu->cgx_cfg_lock);
 
-	/* Ensure event handler registration is completed, before
-	 * we turn on the links
-	 */
-	mb();
+	return 0;
+}
+
+void cgx_start_linkup(struct rvu *rvu)
+{
+	unsigned long lmac_bmap;
+	struct mac_ops *mac_ops;
+	int cgx, lmac, err;
+	void *cgxd;
+
+	/* Enable receive on all LMACS */
+	for (cgx = 0; cgx <= rvu->cgx_cnt_max; cgx++) {
+		cgxd = rvu_cgx_pdata(cgx, rvu);
+		if (!cgxd)
+			continue;
+		mac_ops = get_mac_ops(cgxd);
+		lmac_bmap = cgx_get_lmac_bmap(cgxd);
+		for_each_set_bit(lmac, &lmac_bmap, rvu->hw->lmac_per_cgx)
+			mac_ops->mac_enadis_rx(cgxd, lmac, true);
+	}
 
 	/* Do link up for all CGX ports */
 	for (cgx = 0; cgx <= rvu->cgx_cnt_max; cgx++) {
@@ -390,8 +424,6 @@
 				"Link up process failed to start on cgx %d\n",
 				cgx);
 	}
-
-	return 0;
 }
 
 int rvu_cgx_exit(struct rvu *rvu)
@@ -596,6 +628,35 @@
 	return rvu_lmac_get_stats(rvu, req, (void *)rsp);
 }
 
+int rvu_mbox_handler_cgx_stats_rst(struct rvu *rvu, struct msg_req *req,
+				   struct msg_rsp *rsp)
+{
+	int pf = rvu_get_pf(req->hdr.pcifunc);
+	struct rvu_pfvf	*parent_pf;
+	struct mac_ops *mac_ops;
+	u8 cgx_idx, lmac;
+	void *cgxd;
+
+	if (!is_cgx_config_permitted(rvu, req->hdr.pcifunc))
+		return LMAC_AF_ERR_PERM_DENIED;
+
+	parent_pf = &rvu->pf[pf];
+	/* To ensure reset cgx stats won't affect VF stats,
+	 *  check if it used by only PF interface.
+	 *  If not, return
+	 */
+	if (parent_pf->cgx_users > 1) {
+		dev_info(rvu->dev, "CGX busy, could not reset statistics\n");
+		return 0;
+	}
+
+	rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_idx, &lmac);
+	cgxd = rvu_cgx_pdata(cgx_idx, rvu);
+	mac_ops = get_mac_ops(cgxd);
+
+	return mac_ops->mac_stats_reset(cgxd, lmac);
+}
+
 int rvu_mbox_handler_cgx_fec_stats(struct rvu *rvu,
 				   struct msg_req *req,
 				   struct cgx_fec_stats_rsp *rsp)
@@ -886,13 +947,12 @@
 
 u32 rvu_cgx_get_fifolen(struct rvu *rvu)
 {
-	struct mac_ops *mac_ops;
-	u32 fifo_len;
+	void *cgxd = rvu_first_cgx_pdata(rvu);
 
-	mac_ops = get_mac_ops(rvu_first_cgx_pdata(rvu));
-	fifo_len = mac_ops ? mac_ops->fifo_len : 0;
+	if (!cgxd)
+		return 0;
 
-	return fifo_len;
+	return cgx_get_fifo_len(cgxd);
 }
 
 u32 rvu_cgx_get_lmac_fifolen(struct rvu *rvu, int cgx, int lmac)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c
@@ -632,7 +632,9 @@
 	return ret;
 }
 
-static bool is_valid_offset(struct rvu *rvu, struct cpt_rd_wr_reg_msg *req)
+static bool validate_and_update_reg_offset(struct rvu *rvu,
+					   struct cpt_rd_wr_reg_msg *req,
+					   u64 *reg_offset)
 {
 	u64 offset = req->reg_offset;
 	int blkaddr, num_lfs, lf;
@@ -663,6 +665,11 @@
 		if (lf < 0)
 			return false;
 
+		/* Translate local LF's offset to global CPT LF's offset to
+		 * access LFX register.
+		 */
+		*reg_offset = (req->reg_offset & 0xFF000) + (lf << 3);
+
 		return true;
 	} else if (!(req->hdr.pcifunc & RVU_PFVF_FUNC_MASK)) {
 		/* Registers that can be accessed from PF */
@@ -696,6 +703,7 @@
 					struct cpt_rd_wr_reg_msg *req,
 					struct cpt_rd_wr_reg_msg *rsp)
 {
+	u64 offset = req->reg_offset;
 	int blkaddr;
 
 	blkaddr = validate_and_get_cpt_blkaddr(req->blkaddr);
@@ -707,17 +715,17 @@
 	    !is_cpt_vf(rvu, req->hdr.pcifunc))
 		return CPT_AF_ERR_ACCESS_DENIED;
 
+	if (!validate_and_update_reg_offset(rvu, req, &offset))
+		return CPT_AF_ERR_ACCESS_DENIED;
+
 	rsp->reg_offset = req->reg_offset;
 	rsp->ret_val = req->ret_val;
 	rsp->is_write = req->is_write;
 
-	if (!is_valid_offset(rvu, req))
-		return CPT_AF_ERR_ACCESS_DENIED;
-
 	if (req->is_write)
-		rvu_write64(rvu, blkaddr, req->reg_offset, req->val);
+		rvu_write64(rvu, blkaddr, offset, req->val);
 	else
-		rsp->val = rvu_read64(rvu, blkaddr, req->reg_offset);
+		rsp->val = rvu_read64(rvu, blkaddr, offset);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -999,12 +999,10 @@
 	u16 pcifunc;
 	int ret, lf;
 
-	cmd_buf = memdup_user(buffer, count + 1);
+	cmd_buf = memdup_user_nul(buffer, count);
 	if (IS_ERR(cmd_buf))
 		return -ENOMEM;
 
-	cmd_buf[count] = '\0';
-
 	cmd_buf_tmp = strchr(cmd_buf, '\n');
 	if (cmd_buf_tmp) {
 		*cmd_buf_tmp = '\0';
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
@@ -1235,8 +1235,8 @@
 enum rvu_af_dl_param_id {
 	RVU_AF_DEVLINK_PARAM_ID_BASE = DEVLINK_PARAM_GENERIC_ID_MAX,
 	RVU_AF_DEVLINK_PARAM_ID_DWRR_MTU,
-	RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE,
 	RVU_AF_DEVLINK_PARAM_ID_NPC_MCAM_ZONE_PERCENT,
+	RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE,
 	RVU_AF_DEVLINK_PARAM_ID_NIX_MAXLF,
 };
 
@@ -1434,15 +1434,6 @@
 			     BIT(DEVLINK_PARAM_CMODE_RUNTIME),
 			     rvu_af_dl_dwrr_mtu_get, rvu_af_dl_dwrr_mtu_set,
 			     rvu_af_dl_dwrr_mtu_validate),
-};
-
-static const struct devlink_param rvu_af_dl_param_exact_match[] = {
-	DEVLINK_PARAM_DRIVER(RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE,
-			     "npc_exact_feature_disable", DEVLINK_PARAM_TYPE_STRING,
-			     BIT(DEVLINK_PARAM_CMODE_RUNTIME),
-			     rvu_af_npc_exact_feature_get,
-			     rvu_af_npc_exact_feature_disable,
-			     rvu_af_npc_exact_feature_validate),
 	DEVLINK_PARAM_DRIVER(RVU_AF_DEVLINK_PARAM_ID_NPC_MCAM_ZONE_PERCENT,
 			     "npc_mcam_high_zone_percent", DEVLINK_PARAM_TYPE_U8,
 			     BIT(DEVLINK_PARAM_CMODE_RUNTIME),
@@ -1457,6 +1448,15 @@
 			     rvu_af_dl_nix_maxlf_validate),
 };
 
+static const struct devlink_param rvu_af_dl_param_exact_match[] = {
+	DEVLINK_PARAM_DRIVER(RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE,
+			     "npc_exact_feature_disable", DEVLINK_PARAM_TYPE_STRING,
+			     BIT(DEVLINK_PARAM_CMODE_RUNTIME),
+			     rvu_af_npc_exact_feature_get,
+			     rvu_af_npc_exact_feature_disable,
+			     rvu_af_npc_exact_feature_validate),
+};
+
 /* Devlink switch mode */
 static int rvu_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode)
 {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
@@ -2168,14 +2168,13 @@
 	schq = smq;
 	for (lvl = NIX_TXSCH_LVL_SMQ; lvl <= NIX_TXSCH_LVL_TL1; lvl++) {
 		smq_tree_ctx = &smq_flush_ctx->smq_tree_ctx[lvl];
+		smq_tree_ctx->schq = schq;
 		if (lvl == NIX_TXSCH_LVL_TL1) {
-			smq_flush_ctx->tl1_schq = schq;
 			smq_tree_ctx->cir_off = NIX_AF_TL1X_CIR(schq);
 			smq_tree_ctx->pir_off = 0;
 			smq_tree_ctx->pir_val = 0;
 			parent_off = 0;
 		} else if (lvl == NIX_TXSCH_LVL_TL2) {
-			smq_flush_ctx->tl2_schq = schq;
 			smq_tree_ctx->cir_off = NIX_AF_TL2X_CIR(schq);
 			smq_tree_ctx->pir_off = NIX_AF_TL2X_PIR(schq);
 			parent_off = NIX_AF_TL2X_PARENT(schq);
@@ -2210,8 +2209,8 @@
 {
 	struct nix_txsch *txsch;
 	struct nix_hw *nix_hw;
+	int tl2, tl2_schq;
 	u64 regoff;
-	int tl2;
 
 	nix_hw = get_nix_hw(rvu->hw, blkaddr);
 	if (!nix_hw)
@@ -2219,16 +2218,17 @@
 
 	/* loop through all TL2s with matching PF_FUNC */
 	txsch = &nix_hw->txsch[NIX_TXSCH_LVL_TL2];
+	tl2_schq = smq_flush_ctx->smq_tree_ctx[NIX_TXSCH_LVL_TL2].schq;
 	for (tl2 = 0; tl2 < txsch->schq.max; tl2++) {
 		/* skip the smq(flush) TL2 */
-		if (tl2 == smq_flush_ctx->tl2_schq)
+		if (tl2 == tl2_schq)
 			continue;
 		/* skip unused TL2s */
 		if (TXSCH_MAP_FLAGS(txsch->pfvf_map[tl2]) & NIX_TXSCHQ_FREE)
 			continue;
 		/* skip if PF_FUNC doesn't match */
 		if ((TXSCH_MAP_FUNC(txsch->pfvf_map[tl2]) & ~RVU_PFVF_FUNC_MASK) !=
-		    (TXSCH_MAP_FUNC(txsch->pfvf_map[smq_flush_ctx->tl2_schq] &
+		    (TXSCH_MAP_FUNC(txsch->pfvf_map[tl2_schq] &
 				    ~RVU_PFVF_FUNC_MASK)))
 			continue;
 		/* enable/disable XOFF */
@@ -2270,10 +2270,12 @@
 			 int smq, u16 pcifunc, int nixlf)
 {
 	struct nix_smq_flush_ctx *smq_flush_ctx;
+	int err, restore_tx_en = 0, i;
 	int pf = rvu_get_pf(pcifunc);
 	u8 cgx_id = 0, lmac_id = 0;
-	int err, restore_tx_en = 0;
-	u64 cfg;
+	u16 tl2_tl3_link_schq;
+	u8 link, link_level;
+	u64 cfg, bmap = 0;
 
 	if (!is_rvu_otx2(rvu)) {
 		/* Skip SMQ flush if pkt count is zero */
@@ -2297,16 +2299,38 @@
 	nix_smq_flush_enadis_xoff(rvu, blkaddr, smq_flush_ctx, true);
 	nix_smq_flush_enadis_rate(rvu, blkaddr, smq_flush_ctx, false);
 
-	cfg = rvu_read64(rvu, blkaddr, NIX_AF_SMQX_CFG(smq));
-	/* Do SMQ flush and set enqueue xoff */
-	cfg |= BIT_ULL(50) | BIT_ULL(49);
-	rvu_write64(rvu, blkaddr, NIX_AF_SMQX_CFG(smq), cfg);
-
 	/* Disable backpressure from physical link,
 	 * otherwise SMQ flush may stall.
 	 */
 	rvu_cgx_enadis_rx_bp(rvu, pf, false);
 
+	link_level = rvu_read64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL) & 0x01 ?
+			NIX_TXSCH_LVL_TL3 : NIX_TXSCH_LVL_TL2;
+	tl2_tl3_link_schq = smq_flush_ctx->smq_tree_ctx[link_level].schq;
+	link = smq_flush_ctx->smq_tree_ctx[NIX_TXSCH_LVL_TL1].schq;
+
+	/* SMQ set enqueue xoff */
+	cfg = rvu_read64(rvu, blkaddr, NIX_AF_SMQX_CFG(smq));
+	cfg |= BIT_ULL(50);
+	rvu_write64(rvu, blkaddr, NIX_AF_SMQX_CFG(smq), cfg);
+
+	/* Clear all NIX_AF_TL3_TL2_LINK_CFG[ENA] for the TL3/TL2 queue */
+	for (i = 0; i < (rvu->hw->cgx_links + rvu->hw->lbk_links); i++) {
+		cfg = rvu_read64(rvu, blkaddr,
+				 NIX_AF_TL3_TL2X_LINKX_CFG(tl2_tl3_link_schq, link));
+		if (!(cfg & BIT_ULL(12)))
+			continue;
+		bmap |= BIT_ULL(i);
+		cfg &= ~BIT_ULL(12);
+		rvu_write64(rvu, blkaddr,
+			    NIX_AF_TL3_TL2X_LINKX_CFG(tl2_tl3_link_schq, link), cfg);
+	}
+
+	/* Do SMQ flush and set enqueue xoff */
+	cfg = rvu_read64(rvu, blkaddr, NIX_AF_SMQX_CFG(smq));
+	cfg |= BIT_ULL(50) | BIT_ULL(49);
+	rvu_write64(rvu, blkaddr, NIX_AF_SMQX_CFG(smq), cfg);
+
 	/* Wait for flush to complete */
 	err = rvu_poll_reg(rvu, blkaddr,
 			   NIX_AF_SMQX_CFG(smq), BIT_ULL(49), true);
@@ -2315,6 +2339,17 @@
 			 "NIXLF%d: SMQ%d flush failed, txlink might be busy\n",
 			 nixlf, smq);
 
+	/* Set NIX_AF_TL3_TL2_LINKX_CFG[ENA] for the TL3/TL2 queue */
+	for (i = 0; i < (rvu->hw->cgx_links + rvu->hw->lbk_links); i++) {
+		if (!(bmap & BIT_ULL(i)))
+			continue;
+		cfg = rvu_read64(rvu, blkaddr,
+				 NIX_AF_TL3_TL2X_LINKX_CFG(tl2_tl3_link_schq, link));
+		cfg |= BIT_ULL(12);
+		rvu_write64(rvu, blkaddr,
+			    NIX_AF_TL3_TL2X_LINKX_CFG(tl2_tl3_link_schq, link), cfg);
+	}
+
 	/* clear XOFF on TL2s */
 	nix_smq_flush_enadis_rate(rvu, blkaddr, smq_flush_ctx, true);
 	nix_smq_flush_enadis_xoff(rvu, blkaddr, smq_flush_ctx, false);
@@ -3773,6 +3808,11 @@
 	return -ERANGE;
 }
 
+/* Mask to match ipv6(NPC_LT_LC_IP6) and ipv6 ext(NPC_LT_LC_IP6_EXT) */
+#define NPC_LT_LC_IP6_MATCH_MSK ((~(NPC_LT_LC_IP6 ^ NPC_LT_LC_IP6_EXT)) & 0xf)
+/* Mask to match both ipv4(NPC_LT_LC_IP) and ipv4 ext(NPC_LT_LC_IP_OPT) */
+#define NPC_LT_LC_IP_MATCH_MSK  ((~(NPC_LT_LC_IP ^ NPC_LT_LC_IP_OPT)) & 0xf)
+
 static int set_flowkey_fields(struct nix_rx_flowkey_alg *alg, u32 flow_cfg)
 {
 	int idx, nr_field, key_off, field_marker, keyoff_marker;
@@ -3842,7 +3882,7 @@
 			field->hdr_offset = 9; /* offset */
 			field->bytesm1 = 0; /* 1 byte */
 			field->ltype_match = NPC_LT_LC_IP;
-			field->ltype_mask = 0xF;
+			field->ltype_mask = NPC_LT_LC_IP_MATCH_MSK;
 			break;
 		case NIX_FLOW_KEY_TYPE_IPV4:
 		case NIX_FLOW_KEY_TYPE_INNR_IPV4:
@@ -3869,8 +3909,7 @@
 					field->bytesm1 = 3; /* DIP, 4 bytes */
 				}
 			}
-
-			field->ltype_mask = 0xF; /* Match only IPv4 */
+			field->ltype_mask = NPC_LT_LC_IP_MATCH_MSK;
 			keyoff_marker = false;
 			break;
 		case NIX_FLOW_KEY_TYPE_IPV6:
@@ -3899,7 +3938,7 @@
 					field->bytesm1 = 15; /* DIP,16 bytes */
 				}
 			}
-			field->ltype_mask = 0xF; /* Match only IPv6 */
+			field->ltype_mask = NPC_LT_LC_IP6_MATCH_MSK;
 			break;
 		case NIX_FLOW_KEY_TYPE_TCP:
 		case NIX_FLOW_KEY_TYPE_UDP:
@@ -4721,18 +4760,18 @@
 		 */
 		rvu_write64(rvu, blkaddr, NIX_AF_CFG,
 			    rvu_read64(rvu, blkaddr, NIX_AF_CFG) | 0x40ULL);
+	}
 
-		/* Set chan/link to backpressure TL3 instead of TL2 */
-		rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
+	/* Set chan/link to backpressure TL3 instead of TL2 */
+	rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
 
-		/* Disable SQ manager's sticky mode operation (set TM6 = 0)
-		 * This sticky mode is known to cause SQ stalls when multiple
-		 * SQs are mapped to same SMQ and transmitting pkts at a time.
-		 */
-		cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
-		cfg &= ~BIT_ULL(15);
-		rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
-	}
+	/* Disable SQ manager's sticky mode operation (set TM6 = 0)
+	 * This sticky mode is known to cause SQ stalls when multiple
+	 * SQs are mapped to same SMQ and transmitting pkts at a time.
+	 */
+	cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
+	cfg &= ~BIT_ULL(15);
+	rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
 
 	ltdefs = rvu->kpu.lt_def;
 	/* Calibrate X2P bus to check if CGX/LBK links are fine */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
@@ -1657,7 +1657,7 @@
 	struct npc_coalesced_kpu_prfl *img_data = NULL;
 	int i = 0, rc = -EINVAL;
 	void __iomem *kpu_prfl_addr;
-	u16 offset;
+	u32 offset;
 
 	img_data = (struct npc_coalesced_kpu_prfl __force *)rvu->kpu_prfl_addr;
 	if (le64_to_cpu(img_data->signature) == KPU_SIGN &&
@@ -2181,7 +2181,6 @@
 
 	kfree(pkind->rsrc.bmap);
 	npc_mcam_rsrcs_deinit(rvu);
-	kfree(mcam->counters.bmap);
 	if (rvu->kpu_prfl_addr)
 		iounmap(rvu->kpu_prfl_addr);
 	else
@@ -2520,7 +2519,17 @@
 	 * - when available free entries are less.
 	 * Lower priority ones out of avaialble free entries are always
 	 * chosen when 'high vs low' question arises.
+	 *
+	 * For a VF base MCAM match rule is set by its PF. And all the
+	 * further MCAM rules installed by VF on its own are
+	 * concatenated with the base rule set by its PF. Hence PF entries
+	 * should be at lower priority compared to VF entries. Otherwise
+	 * base rule is hit always and rules installed by VF will be of
+	 * no use. Hence if the request is from PF then allocate low
+	 * priority entries.
 	 */
+	if (!(pcifunc & RVU_PFVF_FUNC_MASK))
+		goto lprio_alloc;
 
 	/* Get the search range for priority allocation request */
 	if (req->priority) {
@@ -2529,17 +2538,6 @@
 		goto alloc;
 	}
 
-	/* For a VF base MCAM match rule is set by its PF. And all the
-	 * further MCAM rules installed by VF on its own are
-	 * concatenated with the base rule set by its PF. Hence PF entries
-	 * should be at lower priority compared to VF entries. Otherwise
-	 * base rule is hit always and rules installed by VF will be of
-	 * no use. Hence if the request is from PF and NOT a priority
-	 * allocation request then allocate low priority entries.
-	 */
-	if (!(pcifunc & RVU_PFVF_FUNC_MASK))
-		goto lprio_alloc;
-
 	/* Find out the search range for non-priority allocation request
 	 *
 	 * Get MCAM free entry count in middle zone.
@@ -2569,6 +2567,18 @@
 		reverse = true;
 		start = 0;
 		end = mcam->bmap_entries;
+		/* Ensure PF requests are always at bottom and if PF requests
+		 * for higher/lower priority entry wrt reference entry then
+		 * honour that criteria and start search for entries from bottom
+		 * and not in mid zone.
+		 */
+		if (!(pcifunc & RVU_PFVF_FUNC_MASK) &&
+		    req->priority == NPC_MCAM_HIGHER_PRIO)
+			end = req->ref_entry;
+
+		if (!(pcifunc & RVU_PFVF_FUNC_MASK) &&
+		    req->priority == NPC_MCAM_LOWER_PRIO)
+			start = req->ref_entry;
 	}
 
 alloc:
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/Makefile
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/Makefile
@@ -9,10 +9,9 @@
 rvu_nicpf-y := otx2_pf.o otx2_common.o otx2_txrx.o otx2_ethtool.o \
                otx2_flows.o otx2_tc.o cn10k.o otx2_dmac_flt.o \
                otx2_devlink.o qos_sq.o qos.o
-rvu_nicvf-y := otx2_vf.o otx2_devlink.o
+rvu_nicvf-y := otx2_vf.o
 
 rvu_nicpf-$(CONFIG_DCB) += otx2_dcbnl.o
-rvu_nicvf-$(CONFIG_DCB) += otx2_dcbnl.o
 rvu_nicpf-$(CONFIG_MACSEC) += cn10k_macsec.o
 
 ccflags-y += -I$(srctree)/drivers/net/ethernet/marvell/octeontx2/af
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
@@ -203,6 +203,11 @@
 
 	rsp = (struct  nix_bandprof_alloc_rsp *)
 	       otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
+	if (IS_ERR(rsp)) {
+		rc = PTR_ERR(rsp);
+		goto out;
+	}
+
 	if (!rsp->prof_count[BAND_PROF_LEAF_LAYER]) {
 		rc = -EIO;
 		goto out;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
@@ -648,14 +648,14 @@
 	} else if (lvl == NIX_TXSCH_LVL_TL4) {
 		parent = schq_list[NIX_TXSCH_LVL_TL3][prio];
 		req->reg[0] = NIX_AF_TL4X_PARENT(schq);
-		req->regval[0] = parent << 16;
+		req->regval[0] = (u64)parent << 16;
 		req->num_regs++;
 		req->reg[1] = NIX_AF_TL4X_SCHEDULE(schq);
 		req->regval[1] = dwrr_val;
 	} else if (lvl == NIX_TXSCH_LVL_TL3) {
 		parent = schq_list[NIX_TXSCH_LVL_TL2][prio];
 		req->reg[0] = NIX_AF_TL3X_PARENT(schq);
-		req->regval[0] = parent << 16;
+		req->regval[0] = (u64)parent << 16;
 		req->num_regs++;
 		req->reg[1] = NIX_AF_TL3X_SCHEDULE(schq);
 		req->regval[1] = dwrr_val;
@@ -670,11 +670,11 @@
 	} else if (lvl == NIX_TXSCH_LVL_TL2) {
 		parent = schq_list[NIX_TXSCH_LVL_TL1][prio];
 		req->reg[0] = NIX_AF_TL2X_PARENT(schq);
-		req->regval[0] = parent << 16;
+		req->regval[0] = (u64)parent << 16;
 
 		req->num_regs++;
 		req->reg[1] = NIX_AF_TL2X_SCHEDULE(schq);
-		req->regval[1] = TXSCH_TL1_DFLT_RR_PRIO << 24 | dwrr_val;
+		req->regval[1] = (u64)hw->txschq_aggr_lvl_rr_prio << 24 | dwrr_val;
 
 		if (lvl == hw->txschq_link_cfg_lvl) {
 			req->num_regs++;
@@ -698,7 +698,7 @@
 
 		req->num_regs++;
 		req->reg[1] = NIX_AF_TL1X_TOPOLOGY(schq);
-		req->regval[1] = (TXSCH_TL1_DFLT_RR_PRIO << 1);
+		req->regval[1] = hw->txschq_aggr_lvl_rr_prio << 1;
 
 		req->num_regs++;
 		req->reg[2] = NIX_AF_TL1X_CIR(schq);
@@ -1592,7 +1592,7 @@
 	detach->partial = false;
 
 	/* Send detach request to AF */
-	otx2_mbox_msg_send(&mbox->mbox, 0);
+	otx2_sync_mbox_msg(mbox);
 	mutex_unlock(&mbox->lock);
 	return 0;
 }
@@ -1837,6 +1837,10 @@
 	if (!rc) {
 		rsp = (struct nix_hw_info *)
 		       otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
+		if (IS_ERR(rsp)) {
+			rc = PTR_ERR(rsp);
+			goto out;
+		}
 
 		/* HW counts VLAN insertion bytes (8 for double tag)
 		 * irrespective of whether SQE is requesting to insert VLAN
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
@@ -815,7 +815,7 @@
 
 	if (!otx2_mbox_nonempty(&mbox->mbox_up, devid))
 		return 0;
-	otx2_mbox_msg_send(&mbox->mbox_up, devid);
+	otx2_mbox_msg_send_up(&mbox->mbox_up, devid);
 	err = otx2_mbox_wait_for_rsp(&mbox->mbox_up, devid);
 	if (err)
 		return err;
@@ -961,6 +961,7 @@
 void otx2_config_irq_coalescing(struct otx2_nic *pfvf, int qidx);
 int otx2_config_pause_frm(struct otx2_nic *pfvf);
 void otx2_setup_segmentation(struct otx2_nic *pfvf);
+int otx2_reset_mac_stats(struct otx2_nic *pfvf);
 
 /* RVU block related APIs */
 int otx2_attach_npa_nix(struct otx2_nic *pfvf);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c
@@ -54,6 +54,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL(otx2_pfc_txschq_config);
 
 static int otx2_pfc_txschq_alloc_one(struct otx2_nic *pfvf, u8 prio)
 {
@@ -122,6 +123,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL(otx2_pfc_txschq_alloc);
 
 static int otx2_pfc_txschq_stop_one(struct otx2_nic *pfvf, u8 prio)
 {
@@ -260,6 +262,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL(otx2_pfc_txschq_update);
 
 int otx2_pfc_txschq_stop(struct otx2_nic *pfvf)
 {
@@ -282,6 +285,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL(otx2_pfc_txschq_stop);
 
 int otx2_config_priority_flow_ctrl(struct otx2_nic *pfvf)
 {
@@ -311,6 +315,11 @@
 	if (!otx2_sync_mbox_msg(&pfvf->mbox)) {
 		rsp = (struct cgx_pfc_rsp *)
 		       otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
+		if (IS_ERR(rsp)) {
+			err = PTR_ERR(rsp);
+			goto unlock;
+		}
+
 		if (req->rx_pause != rsp->rx_pause || req->tx_pause != rsp->tx_pause) {
 			dev_warn(pfvf->dev,
 				 "Failed to config PFC\n");
@@ -321,6 +330,7 @@
 	mutex_unlock(&pfvf->mbox.lock);
 	return err;
 }
+EXPORT_SYMBOL(otx2_config_priority_flow_ctrl);
 
 void otx2_update_bpid_in_rqctx(struct otx2_nic *pfvf, int vlan_prio, int qidx,
 			       bool pfc_enable)
@@ -385,6 +395,7 @@
 			 "Updating BPIDs in CQ and Aura contexts of RQ%d failed with err %d\n",
 			 qidx, err);
 }
+EXPORT_SYMBOL(otx2_update_bpid_in_rqctx);
 
 static int otx2_dcbnl_ieee_getpfc(struct net_device *dev, struct ieee_pfc *pfc)
 {
@@ -472,3 +483,4 @@
 
 	return 0;
 }
+EXPORT_SYMBOL(otx2_dcbnl_set_ops);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c
@@ -112,6 +112,7 @@
 	devlink_free(dl);
 	return err;
 }
+EXPORT_SYMBOL(otx2_register_dl);
 
 void otx2_unregister_dl(struct otx2_nic *pfvf)
 {
@@ -123,3 +124,4 @@
 				  ARRAY_SIZE(otx2_dl_params));
 	devlink_free(dl);
 }
+EXPORT_SYMBOL(otx2_unregister_dl);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c
@@ -28,6 +28,11 @@
 	if (!err) {
 		rsp = (struct cgx_mac_addr_add_rsp *)
 			 otx2_mbox_get_rsp(&pf->mbox.mbox, 0, &req->hdr);
+		if (IS_ERR(rsp)) {
+			mutex_unlock(&pf->mbox.lock);
+			return PTR_ERR(rsp);
+		}
+
 		*dmac_index = rsp->index;
 	}
 
@@ -200,6 +205,10 @@
 
 	rsp = (struct cgx_mac_addr_update_rsp *)
 		otx2_mbox_get_rsp(&pf->mbox.mbox, 0, &req->hdr);
+	if (IS_ERR(rsp)) {
+		rc = PTR_ERR(rsp);
+		goto out;
+	}
 
 	pf->flow_cfg->bmap_to_dmacindex[bit_pos] = rsp->index;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
@@ -343,6 +343,11 @@
 	if (!otx2_sync_mbox_msg(&pfvf->mbox)) {
 		rsp = (struct cgx_pause_frm_cfg *)
 		       otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
+		if (IS_ERR(rsp)) {
+			mutex_unlock(&pfvf->mbox.lock);
+			return;
+		}
+
 		pause->rx_pause = rsp->rx_pause;
 		pause->tx_pause = rsp->tx_pause;
 	}
@@ -1074,6 +1079,11 @@
 
 	rsp = (struct fec_mode *)otx2_mbox_get_rsp(&pfvf->mbox.mbox,
 						   0, &req->hdr);
+	if (IS_ERR(rsp)) {
+		err = PTR_ERR(rsp);
+		goto end;
+	}
+
 	if (rsp->fec >= 0)
 		pfvf->linfo.fec = rsp->fec;
 	else
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
@@ -121,6 +121,8 @@
 
 		rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp
 			(&pfvf->mbox.mbox, 0, &req->hdr);
+		if (IS_ERR(rsp))
+			goto exit;
 
 		for (ent = 0; ent < rsp->count; ent++)
 			flow_cfg->flow_ent[ent + allocated] = rsp->entry_list[ent];
@@ -199,6 +201,10 @@
 
 	rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp
 	       (&pfvf->mbox.mbox, 0, &req->hdr);
+	if (IS_ERR(rsp)) {
+		mutex_unlock(&pfvf->mbox.lock);
+		return PTR_ERR(rsp);
+	}
 
 	if (rsp->count != req->count) {
 		netdev_info(pfvf->netdev,
@@ -234,6 +240,10 @@
 
 	frsp = (struct npc_get_field_status_rsp *)otx2_mbox_get_rsp
 	       (&pfvf->mbox.mbox, 0, &freq->hdr);
+	if (IS_ERR(frsp)) {
+		mutex_unlock(&pfvf->mbox.lock);
+		return PTR_ERR(frsp);
+	}
 
 	if (frsp->enable) {
 		pfvf->flags |= OTX2_FLAG_RX_VLAN_SUPPORT;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -292,8 +292,8 @@
 	return 0;
 }
 
-static void otx2_queue_work(struct mbox *mw, struct workqueue_struct *mbox_wq,
-			    int first, int mdevs, u64 intr, int type)
+static void otx2_queue_vf_work(struct mbox *mw, struct workqueue_struct *mbox_wq,
+			       int first, int mdevs, u64 intr)
 {
 	struct otx2_mbox_dev *mdev;
 	struct otx2_mbox *mbox;
@@ -307,40 +307,26 @@
 
 		mbox = &mw->mbox;
 		mdev = &mbox->dev[i];
-		if (type == TYPE_PFAF)
-			otx2_sync_mbox_bbuf(mbox, i);
 		hdr = mdev->mbase + mbox->rx_start;
 		/* The hdr->num_msgs is set to zero immediately in the interrupt
-		 * handler to  ensure that it holds a correct value next time
-		 * when the interrupt handler is called.
-		 * pf->mbox.num_msgs holds the data for use in pfaf_mbox_handler
-		 * pf>mbox.up_num_msgs holds the data for use in
-		 * pfaf_mbox_up_handler.
+		 * handler to ensure that it holds a correct value next time
+		 * when the interrupt handler is called. pf->mw[i].num_msgs
+		 * holds the data for use in otx2_pfvf_mbox_handler and
+		 * pf->mw[i].up_num_msgs holds the data for use in
+		 * otx2_pfvf_mbox_up_handler.
 		 */
 		if (hdr->num_msgs) {
 			mw[i].num_msgs = hdr->num_msgs;
 			hdr->num_msgs = 0;
-			if (type == TYPE_PFAF)
-				memset(mbox->hwbase + mbox->rx_start, 0,
-				       ALIGN(sizeof(struct mbox_hdr),
-					     sizeof(u64)));
-
 			queue_work(mbox_wq, &mw[i].mbox_wrk);
 		}
 
 		mbox = &mw->mbox_up;
 		mdev = &mbox->dev[i];
-		if (type == TYPE_PFAF)
-			otx2_sync_mbox_bbuf(mbox, i);
 		hdr = mdev->mbase + mbox->rx_start;
 		if (hdr->num_msgs) {
 			mw[i].up_num_msgs = hdr->num_msgs;
 			hdr->num_msgs = 0;
-			if (type == TYPE_PFAF)
-				memset(mbox->hwbase + mbox->rx_start, 0,
-				       ALIGN(sizeof(struct mbox_hdr),
-					     sizeof(u64)));
-
 			queue_work(mbox_wq, &mw[i].mbox_up_wrk);
 		}
 	}
@@ -356,8 +342,10 @@
 	/* Msgs are already copied, trigger VF's mbox irq */
 	smp_wmb();
 
+	otx2_mbox_wait_for_zero(pfvf_mbox, devid);
+
 	offset = pfvf_mbox->trigger | (devid << pfvf_mbox->tr_shift);
-	writeq(1, (void __iomem *)pfvf_mbox->reg_base + offset);
+	writeq(MBOX_DOWN_MSG, (void __iomem *)pfvf_mbox->reg_base + offset);
 
 	/* Restore VF's mbox bounce buffer region address */
 	src_mdev->mbase = bbuf_base;
@@ -547,7 +535,7 @@
 end:
 		offset = mbox->rx_start + msg->next_msgoff;
 		if (mdev->msgs_acked == (vf_mbox->up_num_msgs - 1))
-			__otx2_mbox_reset(mbox, 0);
+			__otx2_mbox_reset(mbox, vf_idx);
 		mdev->msgs_acked++;
 	}
 }
@@ -564,8 +552,7 @@
 	if (vfs > 64) {
 		intr = otx2_read64(pf, RVU_PF_VFPF_MBOX_INTX(1));
 		otx2_write64(pf, RVU_PF_VFPF_MBOX_INTX(1), intr);
-		otx2_queue_work(mbox, pf->mbox_pfvf_wq, 64, vfs, intr,
-				TYPE_PFVF);
+		otx2_queue_vf_work(mbox, pf->mbox_pfvf_wq, 64, vfs, intr);
 		if (intr)
 			trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr);
 		vfs = 64;
@@ -574,7 +561,7 @@
 	intr = otx2_read64(pf, RVU_PF_VFPF_MBOX_INTX(0));
 	otx2_write64(pf, RVU_PF_VFPF_MBOX_INTX(0), intr);
 
-	otx2_queue_work(mbox, pf->mbox_pfvf_wq, 0, vfs, intr, TYPE_PFVF);
+	otx2_queue_vf_work(mbox, pf->mbox_pfvf_wq, 0, vfs, intr);
 
 	if (intr)
 		trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr);
@@ -597,8 +584,9 @@
 	if (!pf->mbox_pfvf)
 		return -ENOMEM;
 
-	pf->mbox_pfvf_wq = alloc_ordered_workqueue("otx2_pfvf_mailbox",
-						   WQ_HIGHPRI | WQ_MEM_RECLAIM);
+	pf->mbox_pfvf_wq = alloc_workqueue("otx2_pfvf_mailbox",
+					   WQ_UNBOUND | WQ_HIGHPRI |
+					   WQ_MEM_RECLAIM, 0);
 	if (!pf->mbox_pfvf_wq)
 		return -ENOMEM;
 
@@ -821,20 +809,22 @@
 	struct mbox *af_mbox;
 	struct otx2_nic *pf;
 	int offset, id;
+	u16 num_msgs;
 
 	af_mbox = container_of(work, struct mbox, mbox_wrk);
 	mbox = &af_mbox->mbox;
 	mdev = &mbox->dev[0];
 	rsp_hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
+	num_msgs = rsp_hdr->num_msgs;
 
 	offset = mbox->rx_start + ALIGN(sizeof(*rsp_hdr), MBOX_MSG_ALIGN);
 	pf = af_mbox->pfvf;
 
-	for (id = 0; id < af_mbox->num_msgs; id++) {
+	for (id = 0; id < num_msgs; id++) {
 		msg = (struct mbox_msghdr *)(mdev->mbase + offset);
 		otx2_process_pfaf_mbox_msg(pf, msg);
 		offset = mbox->rx_start + msg->next_msgoff;
-		if (mdev->msgs_acked == (af_mbox->num_msgs - 1))
+		if (mdev->msgs_acked == (num_msgs - 1))
 			__otx2_mbox_reset(mbox, 0);
 		mdev->msgs_acked++;
 	}
@@ -945,12 +935,14 @@
 	int offset, id, devid = 0;
 	struct mbox_hdr *rsp_hdr;
 	struct mbox_msghdr *msg;
+	u16 num_msgs;
 
 	rsp_hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
+	num_msgs = rsp_hdr->num_msgs;
 
 	offset = mbox->rx_start + ALIGN(sizeof(*rsp_hdr), MBOX_MSG_ALIGN);
 
-	for (id = 0; id < af_mbox->up_num_msgs; id++) {
+	for (id = 0; id < num_msgs; id++) {
 		msg = (struct mbox_msghdr *)(mdev->mbase + offset);
 
 		devid = msg->pcifunc & RVU_PFVF_FUNC_MASK;
@@ -959,10 +951,11 @@
 			otx2_process_mbox_msg_up(pf, msg);
 		offset = mbox->rx_start + msg->next_msgoff;
 	}
-	if (devid) {
+	/* Forward to VF iff VFs are really present */
+	if (devid && pci_num_vf(pf->pdev)) {
 		otx2_forward_vf_mbox_msgs(pf, &pf->mbox.mbox_up,
 					  MBOX_DIR_PFVF_UP, devid - 1,
-					  af_mbox->up_num_msgs);
+					  num_msgs);
 		return;
 	}
 
@@ -972,16 +965,49 @@
 static irqreturn_t otx2_pfaf_mbox_intr_handler(int irq, void *pf_irq)
 {
 	struct otx2_nic *pf = (struct otx2_nic *)pf_irq;
-	struct mbox *mbox;
+	struct mbox *mw = &pf->mbox;
+	struct otx2_mbox_dev *mdev;
+	struct otx2_mbox *mbox;
+	struct mbox_hdr *hdr;
+	u64 mbox_data;
 
 	/* Clear the IRQ */
 	otx2_write64(pf, RVU_PF_INT, BIT_ULL(0));
 
-	mbox = &pf->mbox;
 
-	trace_otx2_msg_interrupt(mbox->mbox.pdev, "AF to PF", BIT_ULL(0));
+	mbox_data = otx2_read64(pf, RVU_PF_PFAF_MBOX0);
+
+	if (mbox_data & MBOX_UP_MSG) {
+		mbox_data &= ~MBOX_UP_MSG;
+		otx2_write64(pf, RVU_PF_PFAF_MBOX0, mbox_data);
 
-	otx2_queue_work(mbox, pf->mbox_wq, 0, 1, 1, TYPE_PFAF);
+		mbox = &mw->mbox_up;
+		mdev = &mbox->dev[0];
+		otx2_sync_mbox_bbuf(mbox, 0);
+
+		hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
+		if (hdr->num_msgs)
+			queue_work(pf->mbox_wq, &mw->mbox_up_wrk);
+
+		trace_otx2_msg_interrupt(pf->pdev, "UP message from AF to PF",
+					 BIT_ULL(0));
+	}
+
+	if (mbox_data & MBOX_DOWN_MSG) {
+		mbox_data &= ~MBOX_DOWN_MSG;
+		otx2_write64(pf, RVU_PF_PFAF_MBOX0, mbox_data);
+
+		mbox = &mw->mbox;
+		mdev = &mbox->dev[0];
+		otx2_sync_mbox_bbuf(mbox, 0);
+
+		hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
+		if (hdr->num_msgs)
+			queue_work(pf->mbox_wq, &mw->mbox_wrk);
+
+		trace_otx2_msg_interrupt(pf->pdev, "DOWN reply from AF to PF",
+					 BIT_ULL(0));
+	}
 
 	return IRQ_HANDLED;
 }
@@ -1124,6 +1150,23 @@
 	return err;
 }
 
+int otx2_reset_mac_stats(struct otx2_nic *pfvf)
+{
+	struct msg_req *req;
+	int err;
+
+	mutex_lock(&pfvf->mbox.lock);
+	req = otx2_mbox_alloc_msg_cgx_stats_rst(&pfvf->mbox);
+	if (!req) {
+		mutex_unlock(&pfvf->mbox.lock);
+		return -ENOMEM;
+	}
+
+	err = otx2_sync_mbox_msg(&pfvf->mbox);
+	mutex_unlock(&pfvf->mbox.lock);
+	return err;
+}
+
 static int otx2_cgx_config_loopback(struct otx2_nic *pf, bool enable)
 {
 	struct msg_req *msg;
@@ -1907,7 +1950,7 @@
 	 * mcam entries are enabled to receive the packets. Hence disable the
 	 * packet I/O.
 	 */
-	if (err == EIO)
+	if (err == -EIO)
 		goto err_disable_rxtx;
 	else if (err)
 		goto err_tx_stop_queues;
@@ -3012,6 +3055,9 @@
 	netdev->min_mtu = OTX2_MIN_MTU;
 	netdev->max_mtu = otx2_get_max_mtu(pf);
 
+	/* reset CGX/RPM MAC stats */
+	otx2_reset_mac_stats(pf);
+
 	err = register_netdev(netdev);
 	if (err) {
 		dev_err(dev, "Failed to register netdevice\n");
@@ -3087,6 +3133,7 @@
 	struct otx2_vf_config *config;
 	struct cgx_link_info_msg *req;
 	struct mbox_msghdr *msghdr;
+	struct delayed_work *dwork;
 	struct otx2_nic *pf;
 	int vf_idx;
 
@@ -3095,10 +3142,24 @@
 	vf_idx = config - config->pf->vf_configs;
 	pf = config->pf;
 
+	if (config->intf_down)
+		return;
+
+	mutex_lock(&pf->mbox.lock);
+
+	dwork = &config->link_event_work;
+
+	if (!otx2_mbox_wait_for_zero(&pf->mbox_pfvf[0].mbox_up, vf_idx)) {
+		schedule_delayed_work(dwork, msecs_to_jiffies(100));
+		mutex_unlock(&pf->mbox.lock);
+		return;
+	}
+
 	msghdr = otx2_mbox_alloc_msg_rsp(&pf->mbox_pfvf[0].mbox_up, vf_idx,
 					 sizeof(*req), sizeof(struct msg_rsp));
 	if (!msghdr) {
 		dev_err(pf->dev, "Failed to create VF%d link event\n", vf_idx);
+		mutex_unlock(&pf->mbox.lock);
 		return;
 	}
 
@@ -3107,7 +3168,11 @@
 	req->hdr.sig = OTX2_MBOX_REQ_SIG;
 	memcpy(&req->link_info, &pf->linfo, sizeof(req->link_info));
 
+	otx2_mbox_wait_for_zero(&pf->mbox_pfvf[0].mbox_up, vf_idx);
+
 	otx2_sync_mbox_up_msg(&pf->mbox_pfvf[0], vf_idx);
+
+	mutex_unlock(&pf->mbox.lock);
 }
 
 static int otx2_sriov_enable(struct pci_dev *pdev, int numvfs)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_reg.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_reg.h
@@ -139,33 +139,34 @@
 #define	NIX_LF_CINTX_ENA_W1C(a)		(NIX_LFBASE | 0xD50 | (a) << 12)
 
 /* NIX AF transmit scheduler registers */
-#define NIX_AF_SMQX_CFG(a)		(0x700 | (a) << 16)
-#define NIX_AF_TL1X_SCHEDULE(a)		(0xC00 | (a) << 16)
-#define NIX_AF_TL1X_CIR(a)		(0xC20 | (a) << 16)
-#define NIX_AF_TL1X_TOPOLOGY(a)		(0xC80 | (a) << 16)
-#define NIX_AF_TL2X_PARENT(a)		(0xE88 | (a) << 16)
-#define NIX_AF_TL2X_SCHEDULE(a)		(0xE00 | (a) << 16)
-#define NIX_AF_TL2X_TOPOLOGY(a)		(0xE80 | (a) << 16)
-#define NIX_AF_TL2X_CIR(a)              (0xE20 | (a) << 16)
-#define NIX_AF_TL2X_PIR(a)              (0xE30 | (a) << 16)
-#define NIX_AF_TL3X_PARENT(a)		(0x1088 | (a) << 16)
-#define NIX_AF_TL3X_SCHEDULE(a)		(0x1000 | (a) << 16)
-#define NIX_AF_TL3X_SHAPE(a)		(0x1010 | (a) << 16)
-#define NIX_AF_TL3X_CIR(a)		(0x1020 | (a) << 16)
-#define NIX_AF_TL3X_PIR(a)		(0x1030 | (a) << 16)
-#define NIX_AF_TL3X_TOPOLOGY(a)		(0x1080 | (a) << 16)
-#define NIX_AF_TL4X_PARENT(a)		(0x1288 | (a) << 16)
-#define NIX_AF_TL4X_SCHEDULE(a)		(0x1200 | (a) << 16)
-#define NIX_AF_TL4X_SHAPE(a)		(0x1210 | (a) << 16)
-#define NIX_AF_TL4X_CIR(a)		(0x1220 | (a) << 16)
-#define NIX_AF_TL4X_PIR(a)		(0x1230 | (a) << 16)
-#define NIX_AF_TL4X_TOPOLOGY(a)		(0x1280 | (a) << 16)
-#define NIX_AF_MDQX_SCHEDULE(a)		(0x1400 | (a) << 16)
-#define NIX_AF_MDQX_SHAPE(a)		(0x1410 | (a) << 16)
-#define NIX_AF_MDQX_CIR(a)		(0x1420 | (a) << 16)
-#define NIX_AF_MDQX_PIR(a)		(0x1430 | (a) << 16)
-#define NIX_AF_MDQX_PARENT(a)		(0x1480 | (a) << 16)
-#define NIX_AF_TL3_TL2X_LINKX_CFG(a, b)	(0x1700 | (a) << 16 | (b) << 3)
+#define NIX_AF_SMQX_CFG(a)		(0x700 | (u64)(a) << 16)
+#define NIX_AF_TL4X_SDP_LINK_CFG(a)	(0xB10 | (u64)(a) << 16)
+#define NIX_AF_TL1X_SCHEDULE(a)		(0xC00 | (u64)(a) << 16)
+#define NIX_AF_TL1X_CIR(a)		(0xC20 | (u64)(a) << 16)
+#define NIX_AF_TL1X_TOPOLOGY(a)		(0xC80 | (u64)(a) << 16)
+#define NIX_AF_TL2X_PARENT(a)		(0xE88 | (u64)(a) << 16)
+#define NIX_AF_TL2X_SCHEDULE(a)		(0xE00 | (u64)(a) << 16)
+#define NIX_AF_TL2X_TOPOLOGY(a)		(0xE80 | (u64)(a) << 16)
+#define NIX_AF_TL2X_CIR(a)		(0xE20 | (u64)(a) << 16)
+#define NIX_AF_TL2X_PIR(a)		(0xE30 | (u64)(a) << 16)
+#define NIX_AF_TL3X_PARENT(a)		(0x1088 | (u64)(a) << 16)
+#define NIX_AF_TL3X_SCHEDULE(a)		(0x1000 | (u64)(a) << 16)
+#define NIX_AF_TL3X_SHAPE(a)		(0x1010 | (u64)(a) << 16)
+#define NIX_AF_TL3X_CIR(a)		(0x1020 | (u64)(a) << 16)
+#define NIX_AF_TL3X_PIR(a)		(0x1030 | (u64)(a) << 16)
+#define NIX_AF_TL3X_TOPOLOGY(a)		(0x1080 | (u64)(a) << 16)
+#define NIX_AF_TL4X_PARENT(a)		(0x1288 | (u64)(a) << 16)
+#define NIX_AF_TL4X_SCHEDULE(a)		(0x1200 | (u64)(a) << 16)
+#define NIX_AF_TL4X_SHAPE(a)		(0x1210 | (u64)(a) << 16)
+#define NIX_AF_TL4X_CIR(a)		(0x1220 | (u64)(a) << 16)
+#define NIX_AF_TL4X_PIR(a)		(0x1230 | (u64)(a) << 16)
+#define NIX_AF_TL4X_TOPOLOGY(a)		(0x1280 | (u64)(a) << 16)
+#define NIX_AF_MDQX_SCHEDULE(a)		(0x1400 | (u64)(a) << 16)
+#define NIX_AF_MDQX_SHAPE(a)		(0x1410 | (u64)(a) << 16)
+#define NIX_AF_MDQX_CIR(a)		(0x1420 | (u64)(a) << 16)
+#define NIX_AF_MDQX_PIR(a)		(0x1430 | (u64)(a) << 16)
+#define NIX_AF_MDQX_PARENT(a)		(0x1480 | (u64)(a) << 16)
+#define NIX_AF_TL3_TL2X_LINKX_CFG(a, b)	(0x1700 | (u64)(a) << 16 | (b) << 3)
 
 /* LMT LF registers */
 #define LMT_LFBASE			BIT_ULL(RVU_FUNC_BLKADDR_SHIFT)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
@@ -688,6 +688,7 @@
 
 	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
 		struct flow_match_control match;
+		u32 val;
 
 		flow_rule_match_control(rule, &match);
 		if (match.mask->flags & FLOW_DIS_FIRST_FRAG) {
@@ -696,12 +697,14 @@
 		}
 
 		if (match.mask->flags & FLOW_DIS_IS_FRAGMENT) {
+			val = match.key->flags & FLOW_DIS_IS_FRAGMENT;
 			if (ntohs(flow_spec->etype) == ETH_P_IP) {
-				flow_spec->ip_flag = IPV4_FLAG_MORE;
+				flow_spec->ip_flag = val ? IPV4_FLAG_MORE : 0;
 				flow_mask->ip_flag = IPV4_FLAG_MORE;
 				req->features |= BIT_ULL(NPC_IPFRAG_IPV4);
 			} else if (ntohs(flow_spec->etype) == ETH_P_IPV6) {
-				flow_spec->next_header = IPPROTO_FRAGMENT;
+				flow_spec->next_header = val ?
+							 IPPROTO_FRAGMENT : 0;
 				flow_mask->next_header = 0xff;
 				req->features |= BIT_ULL(NPC_IPFRAG_IPV6);
 			} else {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c
@@ -510,7 +510,7 @@
 
 static void otx2_adjust_adaptive_coalese(struct otx2_nic *pfvf, struct otx2_cq_poll *cq_poll)
 {
-	struct dim_sample dim_sample;
+	struct dim_sample dim_sample = { 0 };
 	u64 rx_frames, rx_bytes;
 	u64 tx_frames, tx_bytes;
 
@@ -1171,8 +1171,11 @@
 
 	if (skb_shinfo(skb)->gso_size && !is_hw_tso_supported(pfvf, skb)) {
 		/* Insert vlan tag before giving pkt to tso */
-		if (skb_vlan_tag_present(skb))
+		if (skb_vlan_tag_present(skb)) {
 			skb = __vlan_hwaccel_push_inside(skb);
+			if (!skb)
+				return true;
+		}
 		otx2_sq_append_tso(pfvf, sq, skb, qidx);
 		return true;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
@@ -89,16 +89,20 @@
 	struct otx2_mbox *mbox;
 	struct mbox *af_mbox;
 	int offset, id;
+	u16 num_msgs;
 
 	af_mbox = container_of(work, struct mbox, mbox_wrk);
 	mbox = &af_mbox->mbox;
 	mdev = &mbox->dev[0];
 	rsp_hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
-	if (af_mbox->num_msgs == 0)
+	num_msgs = rsp_hdr->num_msgs;
+
+	if (num_msgs == 0)
 		return;
+
 	offset = mbox->rx_start + ALIGN(sizeof(*rsp_hdr), MBOX_MSG_ALIGN);
 
-	for (id = 0; id < af_mbox->num_msgs; id++) {
+	for (id = 0; id < num_msgs; id++) {
 		msg = (struct mbox_msghdr *)(mdev->mbase + offset);
 		otx2vf_process_vfaf_mbox_msg(af_mbox->pfvf, msg);
 		offset = mbox->rx_start + msg->next_msgoff;
@@ -151,6 +155,7 @@
 	struct mbox *vf_mbox;
 	struct otx2_nic *vf;
 	int offset, id;
+	u16 num_msgs;
 
 	vf_mbox = container_of(work, struct mbox, mbox_up_wrk);
 	vf = vf_mbox->pfvf;
@@ -158,12 +163,14 @@
 	mdev = &mbox->dev[0];
 
 	rsp_hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
-	if (vf_mbox->up_num_msgs == 0)
+	num_msgs = rsp_hdr->num_msgs;
+
+	if (num_msgs == 0)
 		return;
 
 	offset = mbox->rx_start + ALIGN(sizeof(*rsp_hdr), MBOX_MSG_ALIGN);
 
-	for (id = 0; id < vf_mbox->up_num_msgs; id++) {
+	for (id = 0; id < num_msgs; id++) {
 		msg = (struct mbox_msghdr *)(mdev->mbase + offset);
 		otx2vf_process_mbox_msg_up(vf, msg);
 		offset = mbox->rx_start + msg->next_msgoff;
@@ -178,40 +185,48 @@
 	struct otx2_mbox_dev *mdev;
 	struct otx2_mbox *mbox;
 	struct mbox_hdr *hdr;
+	u64 mbox_data;
 
 	/* Clear the IRQ */
 	otx2_write64(vf, RVU_VF_INT, BIT_ULL(0));
 
+	mbox_data = otx2_read64(vf, RVU_VF_VFPF_MBOX0);
+
 	/* Read latest mbox data */
 	smp_rmb();
 
-	/* Check for PF => VF response messages */
-	mbox = &vf->mbox.mbox;
-	mdev = &mbox->dev[0];
-	otx2_sync_mbox_bbuf(mbox, 0);
-
-	trace_otx2_msg_interrupt(mbox->pdev, "PF to VF", BIT_ULL(0));
+	if (mbox_data & MBOX_DOWN_MSG) {
+		mbox_data &= ~MBOX_DOWN_MSG;
+		otx2_write64(vf, RVU_VF_VFPF_MBOX0, mbox_data);
+
+		/* Check for PF => VF response messages */
+		mbox = &vf->mbox.mbox;
+		mdev = &mbox->dev[0];
+		otx2_sync_mbox_bbuf(mbox, 0);
+
+		hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
+		if (hdr->num_msgs)
+			queue_work(vf->mbox_wq, &vf->mbox.mbox_wrk);
+
+		trace_otx2_msg_interrupt(mbox->pdev, "DOWN reply from PF to VF",
+					 BIT_ULL(0));
+	}
+
+	if (mbox_data & MBOX_UP_MSG) {
+		mbox_data &= ~MBOX_UP_MSG;
+		otx2_write64(vf, RVU_VF_VFPF_MBOX0, mbox_data);
+
+		/* Check for PF => VF notification messages */
+		mbox = &vf->mbox.mbox_up;
+		mdev = &mbox->dev[0];
+		otx2_sync_mbox_bbuf(mbox, 0);
+
+		hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
+		if (hdr->num_msgs)
+			queue_work(vf->mbox_wq, &vf->mbox.mbox_up_wrk);
 
-	hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
-	if (hdr->num_msgs) {
-		vf->mbox.num_msgs = hdr->num_msgs;
-		hdr->num_msgs = 0;
-		memset(mbox->hwbase + mbox->rx_start, 0,
-		       ALIGN(sizeof(struct mbox_hdr), sizeof(u64)));
-		queue_work(vf->mbox_wq, &vf->mbox.mbox_wrk);
-	}
-	/* Check for PF => VF notification messages */
-	mbox = &vf->mbox.mbox_up;
-	mdev = &mbox->dev[0];
-	otx2_sync_mbox_bbuf(mbox, 0);
-
-	hdr = (struct mbox_hdr *)(mdev->mbase + mbox->rx_start);
-	if (hdr->num_msgs) {
-		vf->mbox.up_num_msgs = hdr->num_msgs;
-		hdr->num_msgs = 0;
-		memset(mbox->hwbase + mbox->rx_start, 0,
-		       ALIGN(sizeof(struct mbox_hdr), sizeof(u64)));
-		queue_work(vf->mbox_wq, &vf->mbox.mbox_up_wrk);
+		trace_otx2_msg_interrupt(mbox->pdev, "UP message from PF to VF",
+					 BIT_ULL(0));
 	}
 
 	return IRQ_HANDLED;
@@ -760,8 +775,8 @@
 	otx2_mcam_flow_del(vf);
 	otx2_shutdown_tc(vf);
 	otx2_shutdown_qos(vf);
-	otx2vf_disable_mbox_intr(vf);
 	otx2_detach_resources(&vf->mbox);
+	otx2vf_disable_mbox_intr(vf);
 	free_percpu(vf->hw.lmt_info);
 	if (test_bit(CN10K_LMTST, &vf->hw.cap_flag))
 		qmem_free(vf->dev, vf->dync_lmt);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/qos.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/octeontx2/nic/qos.c
@@ -153,7 +153,6 @@
 		num_regs++;
 
 		otx2_config_sched_shaping(pfvf, node, cfg, &num_regs);
-
 	} else if (level == NIX_TXSCH_LVL_TL4) {
 		otx2_config_sched_shaping(pfvf, node, cfg, &num_regs);
 	} else if (level == NIX_TXSCH_LVL_TL3) {
@@ -176,7 +175,7 @@
 		/* check if node is root */
 		if (node->qid == OTX2_QOS_QID_INNER && !node->parent) {
 			cfg->reg[num_regs] = NIX_AF_TL2X_SCHEDULE(node->schq);
-			cfg->regval[num_regs] =  TXSCH_TL1_DFLT_RR_PRIO << 24 |
+			cfg->regval[num_regs] =  (u64)hw->txschq_aggr_lvl_rr_prio << 24 |
 						 mtu_to_dwrr_weight(pfvf,
 								    pfvf->tx_max_pktlen);
 			num_regs++;
@@ -382,6 +381,7 @@
 		otx2_qos_read_txschq_cfg_tl(node, cfg);
 		cnt = cfg->static_node_pos[node->level];
 		cfg->schq_contig_list[node->level][cnt] = node->schq;
+		cfg->schq_index_used[node->level][cnt] = true;
 		cfg->schq_contig[node->level]++;
 		cfg->static_node_pos[node->level]++;
 		otx2_qos_read_txschq_cfg_schq(node, cfg);
@@ -1406,7 +1406,10 @@
 	otx2_qos_read_txschq_cfg(pfvf, node, old_cfg);
 
 	/* delete the txschq nodes allocated for this node */
+	otx2_qos_disable_sq(pfvf, qid);
+	otx2_qos_free_hw_node_schq(pfvf, node);
 	otx2_qos_free_sw_node_schq(pfvf, node);
+	pfvf->qos.qid_to_sqmap[qid] = OTX2_QOS_INVALID_SQ;
 
 	/* mark this node as htb inner node */
 	WRITE_ONCE(node->qid, OTX2_QOS_QID_INNER);
@@ -1553,6 +1556,7 @@
 		dwrr_del_node = true;
 
 	/* destroy the leaf node */
+	otx2_qos_disable_sq(pfvf, qid);
 	otx2_qos_destroy_node(pfvf, node);
 	pfvf->qos.qid_to_sqmap[qid] = OTX2_QOS_INVALID_SQ;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/pxa168_eth.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1394,18 +1394,15 @@
 
 	printk(KERN_NOTICE "PXA168 10/100 Ethernet Driver\n");
 
-	clk = devm_clk_get(&pdev->dev, NULL);
+	clk = devm_clk_get_enabled(&pdev->dev, NULL);
 	if (IS_ERR(clk)) {
-		dev_err(&pdev->dev, "Fast Ethernet failed to get clock\n");
+		dev_err(&pdev->dev, "Fast Ethernet failed to get and enable clock\n");
 		return -ENODEV;
 	}
-	clk_prepare_enable(clk);
 
 	dev = alloc_etherdev(sizeof(struct pxa168_eth_private));
-	if (!dev) {
-		err = -ENOMEM;
-		goto err_clk;
-	}
+	if (!dev)
+		return -ENOMEM;
 
 	platform_set_drvdata(pdev, dev);
 	pep = netdev_priv(dev);
@@ -1523,8 +1520,6 @@
 	mdiobus_free(pep->smi_bus);
 err_netdev:
 	free_netdev(dev);
-err_clk:
-	clk_disable_unprepare(clk);
 	return err;
 }
 
@@ -1542,7 +1537,6 @@
 	if (dev->phydev)
 		phy_disconnect(dev->phydev);
 
-	clk_disable_unprepare(pep->clk);
 	mdiobus_unregister(pep->smi_bus);
 	mdiobus_free(pep->smi_bus);
 	unregister_netdev(dev);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/marvell/sky2.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/marvell/sky2.c
@@ -129,6 +129,7 @@
 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436C) }, /* 88E8072 */
 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436D) }, /* 88E8055 */
 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4370) }, /* 88E8075 */
+	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4373) }, /* 88E8075 */
 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4380) }, /* 88E8057 */
 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4381) }, /* 88E8059 */
 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4382) }, /* 88E8079 */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -110,16 +110,16 @@
 	.tx_irq_mask		= 0x461c,
 	.tx_irq_status		= 0x4618,
 	.pdma = {
-		.rx_ptr		= 0x6100,
-		.rx_cnt_cfg	= 0x6104,
-		.pcrx_ptr	= 0x6108,
-		.glo_cfg	= 0x6204,
-		.rst_idx	= 0x6208,
-		.delay_irq	= 0x620c,
-		.irq_status	= 0x6220,
-		.irq_mask	= 0x6228,
-		.adma_rx_dbg0	= 0x6238,
-		.int_grp	= 0x6250,
+		.rx_ptr		= 0x4100,
+		.rx_cnt_cfg	= 0x4104,
+		.pcrx_ptr	= 0x4108,
+		.glo_cfg	= 0x4204,
+		.rst_idx	= 0x4208,
+		.delay_irq	= 0x420c,
+		.irq_status	= 0x4220,
+		.irq_mask	= 0x4228,
+		.adma_rx_dbg0	= 0x4238,
+		.int_grp	= 0x4250,
 	},
 	.qdma = {
 		.qtx_cfg	= 0x4400,
@@ -677,8 +677,7 @@
 	mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
 	mcr_new = mcr_cur;
 	mcr_new |= MAC_MCR_IPG_CFG | MAC_MCR_FORCE_MODE |
-		   MAC_MCR_BACKOFF_EN | MAC_MCR_BACKPR_EN | MAC_MCR_FORCE_LINK |
-		   MAC_MCR_RX_FIFO_CLR_DIS;
+		   MAC_MCR_BACKOFF_EN | MAC_MCR_BACKPR_EN | MAC_MCR_RX_FIFO_CLR_DIS;
 
 	/* Only update control register when needed! */
 	if (mcr_new != mcr_cur)
@@ -694,7 +693,7 @@
 					   phylink_config);
 	u32 mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id));
 
-	mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN);
+	mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN | MAC_MCR_FORCE_LINK);
 	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
 }
 
@@ -803,7 +802,7 @@
 	if (rx_pause)
 		mcr |= MAC_MCR_FORCE_RX_FC;
 
-	mcr |= MAC_MCR_TX_EN | MAC_MCR_RX_EN;
+	mcr |= MAC_MCR_TX_EN | MAC_MCR_RX_EN | MAC_MCR_FORCE_LINK;
 	mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
 }
 
@@ -1108,7 +1107,7 @@
 	rxd->rxd1 = READ_ONCE(dma_rxd->rxd1);
 	rxd->rxd3 = READ_ONCE(dma_rxd->rxd3);
 	rxd->rxd4 = READ_ONCE(dma_rxd->rxd4);
-	if (mtk_is_netsys_v2_or_greater(eth)) {
+	if (mtk_is_netsys_v3_or_greater(eth)) {
 		rxd->rxd5 = READ_ONCE(dma_rxd->rxd5);
 		rxd->rxd6 = READ_ONCE(dma_rxd->rxd6);
 	}
@@ -1132,51 +1131,57 @@
 {
 	const struct mtk_soc_data *soc = eth->soc;
 	dma_addr_t phy_ring_tail;
-	int cnt = MTK_QDMA_RING_SIZE;
+	int cnt = soc->tx.fq_dma_size;
 	dma_addr_t dma_addr;
-	int i;
+	int i, j, len;
 
 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SRAM))
 		eth->scratch_ring = eth->sram_base;
 	else
 		eth->scratch_ring = dma_alloc_coherent(eth->dma_dev,
-						       cnt * soc->txrx.txd_size,
+						       cnt * soc->tx.desc_size,
 						       &eth->phy_scratch_ring,
 						       GFP_KERNEL);
+
 	if (unlikely(!eth->scratch_ring))
 		return -ENOMEM;
 
-	eth->scratch_head = kcalloc(cnt, MTK_QDMA_PAGE_SIZE, GFP_KERNEL);
-	if (unlikely(!eth->scratch_head))
-		return -ENOMEM;
+	phy_ring_tail = eth->phy_scratch_ring + soc->tx.desc_size * (cnt - 1);
 
-	dma_addr = dma_map_single(eth->dma_dev,
-				  eth->scratch_head, cnt * MTK_QDMA_PAGE_SIZE,
-				  DMA_FROM_DEVICE);
-	if (unlikely(dma_mapping_error(eth->dma_dev, dma_addr)))
-		return -ENOMEM;
+	for (j = 0; j < DIV_ROUND_UP(soc->tx.fq_dma_size, MTK_FQ_DMA_LENGTH); j++) {
+		len = min_t(int, cnt - j * MTK_FQ_DMA_LENGTH, MTK_FQ_DMA_LENGTH);
+		eth->scratch_head[j] = kcalloc(len, MTK_QDMA_PAGE_SIZE, GFP_KERNEL);
+
+		if (unlikely(!eth->scratch_head[j]))
+			return -ENOMEM;
 
-	phy_ring_tail = eth->phy_scratch_ring + soc->txrx.txd_size * (cnt - 1);
+		dma_addr = dma_map_single(eth->dma_dev,
+					  eth->scratch_head[j], len * MTK_QDMA_PAGE_SIZE,
+					  DMA_FROM_DEVICE);
 
-	for (i = 0; i < cnt; i++) {
-		dma_addr_t addr = dma_addr + i * MTK_QDMA_PAGE_SIZE;
-		struct mtk_tx_dma_v2 *txd;
-
-		txd = eth->scratch_ring + i * soc->txrx.txd_size;
-		txd->txd1 = addr;
-		if (i < cnt - 1)
-			txd->txd2 = eth->phy_scratch_ring +
-				    (i + 1) * soc->txrx.txd_size;
-
-		txd->txd3 = TX_DMA_PLEN0(MTK_QDMA_PAGE_SIZE);
-		if (MTK_HAS_CAPS(soc->caps, MTK_36BIT_DMA))
-			txd->txd3 |= TX_DMA_PREP_ADDR64(addr);
-		txd->txd4 = 0;
-		if (mtk_is_netsys_v2_or_greater(eth)) {
-			txd->txd5 = 0;
-			txd->txd6 = 0;
-			txd->txd7 = 0;
-			txd->txd8 = 0;
+		if (unlikely(dma_mapping_error(eth->dma_dev, dma_addr)))
+			return -ENOMEM;
+
+		for (i = 0; i < len; i++) {
+			struct mtk_tx_dma_v2 *txd;
+
+			txd = eth->scratch_ring + (j * MTK_FQ_DMA_LENGTH + i) * soc->tx.desc_size;
+			txd->txd1 = dma_addr + i * MTK_QDMA_PAGE_SIZE;
+			if (j * MTK_FQ_DMA_LENGTH + i < cnt)
+				txd->txd2 = eth->phy_scratch_ring +
+					    (j * MTK_FQ_DMA_LENGTH + i + 1) * soc->tx.desc_size;
+
+			txd->txd3 = TX_DMA_PLEN0(MTK_QDMA_PAGE_SIZE);
+			if (MTK_HAS_CAPS(soc->caps, MTK_36BIT_DMA))
+				txd->txd3 |= TX_DMA_PREP_ADDR64(dma_addr + i * MTK_QDMA_PAGE_SIZE);
+
+			txd->txd4 = 0;
+			if (mtk_is_netsys_v2_or_greater(eth)) {
+				txd->txd5 = 0;
+				txd->txd6 = 0;
+				txd->txd7 = 0;
+				txd->txd8 = 0;
+			}
 		}
 	}
 
@@ -1417,7 +1422,7 @@
 	if (itxd == ring->last_free)
 		return -ENOMEM;
 
-	itx_buf = mtk_desc_to_tx_buf(ring, itxd, soc->txrx.txd_size);
+	itx_buf = mtk_desc_to_tx_buf(ring, itxd, soc->tx.desc_size);
 	memset(itx_buf, 0, sizeof(*itx_buf));
 
 	txd_info.addr = dma_map_single(eth->dma_dev, skb->data, txd_info.size,
@@ -1458,7 +1463,7 @@
 
 			memset(&txd_info, 0, sizeof(struct mtk_tx_dma_desc_info));
 			txd_info.size = min_t(unsigned int, frag_size,
-					      soc->txrx.dma_max_len);
+					      soc->tx.dma_max_len);
 			txd_info.qid = queue;
 			txd_info.last = i == skb_shinfo(skb)->nr_frags - 1 &&
 					!(frag_size - txd_info.size);
@@ -1471,7 +1476,7 @@
 			mtk_tx_set_dma_desc(dev, txd, &txd_info);
 
 			tx_buf = mtk_desc_to_tx_buf(ring, txd,
-						    soc->txrx.txd_size);
+						    soc->tx.desc_size);
 			if (new_desc)
 				memset(tx_buf, 0, sizeof(*tx_buf));
 			tx_buf->data = (void *)MTK_DMA_DUMMY_DESC;
@@ -1514,7 +1519,7 @@
 	} else {
 		int next_idx;
 
-		next_idx = NEXT_DESP_IDX(txd_to_idx(ring, txd, soc->txrx.txd_size),
+		next_idx = NEXT_DESP_IDX(txd_to_idx(ring, txd, soc->tx.desc_size),
 					 ring->dma_size);
 		mtk_w32(eth, next_idx, MT7628_TX_CTX_IDX0);
 	}
@@ -1523,7 +1528,7 @@
 
 err_dma:
 	do {
-		tx_buf = mtk_desc_to_tx_buf(ring, itxd, soc->txrx.txd_size);
+		tx_buf = mtk_desc_to_tx_buf(ring, itxd, soc->tx.desc_size);
 
 		/* unmap dma */
 		mtk_tx_unmap(eth, tx_buf, NULL, false);
@@ -1548,7 +1553,7 @@
 		for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
 			frag = &skb_shinfo(skb)->frags[i];
 			nfrags += DIV_ROUND_UP(skb_frag_size(frag),
-					       eth->soc->txrx.dma_max_len);
+					       eth->soc->tx.dma_max_len);
 		}
 	} else {
 		nfrags += skb_shinfo(skb)->nr_frags;
@@ -1655,7 +1660,7 @@
 
 		ring = &eth->rx_ring[i];
 		idx = NEXT_DESP_IDX(ring->calc_idx, ring->dma_size);
-		rxd = ring->dma + idx * eth->soc->txrx.rxd_size;
+		rxd = ring->dma + idx * eth->soc->rx.desc_size;
 		if (rxd->rxd2 & RX_DMA_DONE) {
 			ring->calc_idx_update = true;
 			return ring;
@@ -1823,7 +1828,7 @@
 	}
 	htxd = txd;
 
-	tx_buf = mtk_desc_to_tx_buf(ring, txd, soc->txrx.txd_size);
+	tx_buf = mtk_desc_to_tx_buf(ring, txd, soc->tx.desc_size);
 	memset(tx_buf, 0, sizeof(*tx_buf));
 	htx_buf = tx_buf;
 
@@ -1842,7 +1847,7 @@
 				goto unmap;
 
 			tx_buf = mtk_desc_to_tx_buf(ring, txd,
-						    soc->txrx.txd_size);
+						    soc->tx.desc_size);
 			memset(tx_buf, 0, sizeof(*tx_buf));
 			n_desc++;
 		}
@@ -1880,7 +1885,7 @@
 	} else {
 		int idx;
 
-		idx = txd_to_idx(ring, txd, soc->txrx.txd_size);
+		idx = txd_to_idx(ring, txd, soc->tx.desc_size);
 		mtk_w32(eth, NEXT_DESP_IDX(idx, ring->dma_size),
 			MT7628_TX_CTX_IDX0);
 	}
@@ -1891,7 +1896,7 @@
 
 unmap:
 	while (htxd != txd) {
-		tx_buf = mtk_desc_to_tx_buf(ring, htxd, soc->txrx.txd_size);
+		tx_buf = mtk_desc_to_tx_buf(ring, htxd, soc->tx.desc_size);
 		mtk_tx_unmap(eth, tx_buf, NULL, false);
 
 		htxd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
@@ -2022,14 +2027,14 @@
 			goto rx_done;
 
 		idx = NEXT_DESP_IDX(ring->calc_idx, ring->dma_size);
-		rxd = ring->dma + idx * eth->soc->txrx.rxd_size;
+		rxd = ring->dma + idx * eth->soc->rx.desc_size;
 		data = ring->data[idx];
 
 		if (!mtk_rx_get_desc(eth, &trxd, rxd))
 			break;
 
 		/* find out which mac the packet come from. values start at 1 */
-		if (mtk_is_netsys_v2_or_greater(eth)) {
+		if (mtk_is_netsys_v3_or_greater(eth)) {
 			u32 val = RX_DMA_GET_SPORT_V2(trxd.rxd5);
 
 			switch (val) {
@@ -2141,7 +2146,7 @@
 		skb->dev = netdev;
 		bytes += skb->len;
 
-		if (mtk_is_netsys_v2_or_greater(eth)) {
+		if (mtk_is_netsys_v3_or_greater(eth)) {
 			reason = FIELD_GET(MTK_RXD5_PPE_CPU_REASON, trxd.rxd5);
 			hash = trxd.rxd5 & MTK_RXD5_FOE_ENTRY;
 			if (hash != MTK_RXD5_FOE_ENTRY)
@@ -2157,7 +2162,7 @@
 			rxdcsum = &trxd.rxd4;
 		}
 
-		if (*rxdcsum & eth->soc->txrx.rx_dma_l4_valid)
+		if (*rxdcsum & eth->soc->rx.dma_l4_valid)
 			skb->ip_summed = CHECKSUM_UNNECESSARY;
 		else
 			skb_checksum_none_assert(skb);
@@ -2281,7 +2286,7 @@
 			break;
 
 		tx_buf = mtk_desc_to_tx_buf(ring, desc,
-					    eth->soc->txrx.txd_size);
+					    eth->soc->tx.desc_size);
 		if (!tx_buf->data)
 			break;
 
@@ -2332,7 +2337,7 @@
 		}
 		mtk_tx_unmap(eth, tx_buf, &bq, true);
 
-		desc = ring->dma + cpu * eth->soc->txrx.txd_size;
+		desc = ring->dma + cpu * eth->soc->tx.desc_size;
 		ring->last_free = desc;
 		atomic_inc(&ring->free_count);
 
@@ -2422,7 +2427,7 @@
 	do {
 		int rx_done;
 
-		mtk_w32(eth, eth->soc->txrx.rx_irq_done_mask,
+		mtk_w32(eth, eth->soc->rx.irq_done_mask,
 			reg_map->pdma.irq_status);
 		rx_done = mtk_poll_rx(napi, budget - rx_done_total, eth);
 		rx_done_total += rx_done;
@@ -2438,10 +2443,10 @@
 			return budget;
 
 	} while (mtk_r32(eth, reg_map->pdma.irq_status) &
-		 eth->soc->txrx.rx_irq_done_mask);
+		 eth->soc->rx.irq_done_mask);
 
 	if (napi_complete_done(napi, rx_done_total))
-		mtk_rx_irq_enable(eth, eth->soc->txrx.rx_irq_done_mask);
+		mtk_rx_irq_enable(eth, eth->soc->rx.irq_done_mask);
 
 	return rx_done_total;
 }
@@ -2450,7 +2455,7 @@
 {
 	const struct mtk_soc_data *soc = eth->soc;
 	struct mtk_tx_ring *ring = &eth->tx_ring;
-	int i, sz = soc->txrx.txd_size;
+	int i, sz = soc->tx.desc_size;
 	struct mtk_tx_dma_v2 *txd;
 	int ring_size;
 	u32 ofs, val;
@@ -2458,7 +2463,7 @@
 	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA))
 		ring_size = MTK_QDMA_RING_SIZE;
 	else
-		ring_size = MTK_DMA_SIZE;
+		ring_size = soc->tx.dma_size;
 
 	ring->buf = kcalloc(ring_size, sizeof(*ring->buf),
 			       GFP_KERNEL);
@@ -2466,8 +2471,8 @@
 		goto no_tx_mem;
 
 	if (MTK_HAS_CAPS(soc->caps, MTK_SRAM)) {
-		ring->dma = eth->sram_base + ring_size * sz;
-		ring->phys = eth->phy_scratch_ring + ring_size * (dma_addr_t)sz;
+		ring->dma = eth->sram_base + soc->tx.fq_dma_size * sz;
+		ring->phys = eth->phy_scratch_ring + soc->tx.fq_dma_size * (dma_addr_t)sz;
 	} else {
 		ring->dma = dma_alloc_coherent(eth->dma_dev, ring_size * sz,
 					       &ring->phys, GFP_KERNEL);
@@ -2573,14 +2578,14 @@
 	}
 	if (!MTK_HAS_CAPS(soc->caps, MTK_SRAM) && ring->dma) {
 		dma_free_coherent(eth->dma_dev,
-				  ring->dma_size * soc->txrx.txd_size,
+				  ring->dma_size * soc->tx.desc_size,
 				  ring->dma, ring->phys);
 		ring->dma = NULL;
 	}
 
 	if (ring->dma_pdma) {
 		dma_free_coherent(eth->dma_dev,
-				  ring->dma_size * soc->txrx.txd_size,
+				  ring->dma_size * soc->tx.desc_size,
 				  ring->dma_pdma, ring->phys_pdma);
 		ring->dma_pdma = NULL;
 	}
@@ -2589,6 +2594,7 @@
 static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag)
 {
 	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
+	const struct mtk_soc_data *soc = eth->soc;
 	struct mtk_rx_ring *ring;
 	int rx_data_len, rx_dma_size, tx_ring_size;
 	int i;
@@ -2596,7 +2602,7 @@
 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
 		tx_ring_size = MTK_QDMA_RING_SIZE;
 	else
-		tx_ring_size = MTK_DMA_SIZE;
+		tx_ring_size = soc->tx.dma_size;
 
 	if (rx_flag == MTK_RX_FLAGS_QDMA) {
 		if (ring_no)
@@ -2611,7 +2617,7 @@
 		rx_dma_size = MTK_HW_LRO_DMA_SIZE;
 	} else {
 		rx_data_len = ETH_DATA_LEN;
-		rx_dma_size = MTK_DMA_SIZE;
+		rx_dma_size = soc->rx.dma_size;
 	}
 
 	ring->frag_size = mtk_max_frag_size(rx_data_len);
@@ -2635,15 +2641,15 @@
 	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SRAM) ||
 	    rx_flag != MTK_RX_FLAGS_NORMAL) {
 		ring->dma = dma_alloc_coherent(eth->dma_dev,
-					       rx_dma_size * eth->soc->txrx.rxd_size,
-					       &ring->phys, GFP_KERNEL);
+				rx_dma_size * eth->soc->rx.desc_size,
+				&ring->phys, GFP_KERNEL);
 	} else {
 		struct mtk_tx_ring *tx_ring = &eth->tx_ring;
 
 		ring->dma = tx_ring->dma + tx_ring_size *
-			    eth->soc->txrx.txd_size * (ring_no + 1);
+			    eth->soc->tx.desc_size * (ring_no + 1);
 		ring->phys = tx_ring->phys + tx_ring_size *
-			     eth->soc->txrx.txd_size * (ring_no + 1);
+			     eth->soc->tx.desc_size * (ring_no + 1);
 	}
 
 	if (!ring->dma)
@@ -2654,7 +2660,7 @@
 		dma_addr_t dma_addr;
 		void *data;
 
-		rxd = ring->dma + i * eth->soc->txrx.rxd_size;
+		rxd = ring->dma + i * eth->soc->rx.desc_size;
 		if (ring->page_pool) {
 			data = mtk_page_pool_get_buff(ring->page_pool,
 						      &dma_addr, GFP_KERNEL);
@@ -2691,7 +2697,7 @@
 
 		rxd->rxd3 = 0;
 		rxd->rxd4 = 0;
-		if (mtk_is_netsys_v2_or_greater(eth)) {
+		if (mtk_is_netsys_v3_or_greater(eth)) {
 			rxd->rxd5 = 0;
 			rxd->rxd6 = 0;
 			rxd->rxd7 = 0;
@@ -2745,7 +2751,7 @@
 			if (!ring->data[i])
 				continue;
 
-			rxd = ring->dma + i * eth->soc->txrx.rxd_size;
+			rxd = ring->dma + i * eth->soc->rx.desc_size;
 			if (!rxd->rxd1)
 				continue;
 
@@ -2762,7 +2768,7 @@
 
 	if (!in_sram && ring->dma) {
 		dma_free_coherent(eth->dma_dev,
-				  ring->dma_size * eth->soc->txrx.rxd_size,
+				  ring->dma_size * eth->soc->rx.desc_size,
 				  ring->dma, ring->phys);
 		ring->dma = NULL;
 	}
@@ -3125,7 +3131,7 @@
 			netdev_reset_queue(eth->netdev[i]);
 	if (!MTK_HAS_CAPS(soc->caps, MTK_SRAM) && eth->scratch_ring) {
 		dma_free_coherent(eth->dma_dev,
-				  MTK_QDMA_RING_SIZE * soc->txrx.txd_size,
+				  MTK_QDMA_RING_SIZE * soc->tx.desc_size,
 				  eth->scratch_ring, eth->phy_scratch_ring);
 		eth->scratch_ring = NULL;
 		eth->phy_scratch_ring = 0;
@@ -3140,7 +3146,10 @@
 			mtk_rx_clean(eth, &eth->rx_ring[i], false);
 	}
 
-	kfree(eth->scratch_head);
+	for (i = 0; i < DIV_ROUND_UP(soc->tx.fq_dma_size, MTK_FQ_DMA_LENGTH); i++) {
+		kfree(eth->scratch_head[i]);
+		eth->scratch_head[i] = NULL;
+	}
 }
 
 static bool mtk_hw_reset_check(struct mtk_eth *eth)
@@ -3175,7 +3184,7 @@
 
 	eth->rx_events++;
 	if (likely(napi_schedule_prep(&eth->rx_napi))) {
-		mtk_rx_irq_disable(eth, eth->soc->txrx.rx_irq_done_mask);
+		mtk_rx_irq_disable(eth, eth->soc->rx.irq_done_mask);
 		__napi_schedule(&eth->rx_napi);
 	}
 
@@ -3201,9 +3210,9 @@
 	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
 
 	if (mtk_r32(eth, reg_map->pdma.irq_mask) &
-	    eth->soc->txrx.rx_irq_done_mask) {
+	    eth->soc->rx.irq_done_mask) {
 		if (mtk_r32(eth, reg_map->pdma.irq_status) &
-		    eth->soc->txrx.rx_irq_done_mask)
+		    eth->soc->rx.irq_done_mask)
 			mtk_handle_irq_rx(irq, _eth);
 	}
 	if (mtk_r32(eth, reg_map->tx_irq_mask) & MTK_TX_DONE_INT) {
@@ -3221,10 +3230,10 @@
 	struct mtk_eth *eth = mac->hw;
 
 	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
-	mtk_rx_irq_disable(eth, eth->soc->txrx.rx_irq_done_mask);
+	mtk_rx_irq_disable(eth, eth->soc->rx.irq_done_mask);
 	mtk_handle_irq_rx(eth->irq[2], dev);
 	mtk_tx_irq_enable(eth, MTK_TX_DONE_INT);
-	mtk_rx_irq_enable(eth, eth->soc->txrx.rx_irq_done_mask);
+	mtk_rx_irq_enable(eth, eth->soc->rx.irq_done_mask);
 }
 #endif
 
@@ -3388,7 +3397,7 @@
 		napi_enable(&eth->tx_napi);
 		napi_enable(&eth->rx_napi);
 		mtk_tx_irq_enable(eth, MTK_TX_DONE_INT);
-		mtk_rx_irq_enable(eth, soc->txrx.rx_irq_done_mask);
+		mtk_rx_irq_enable(eth, soc->rx.irq_done_mask);
 		refcount_set(&eth->dma_refcnt, 1);
 	}
 	else
@@ -3472,7 +3481,7 @@
 	mtk_gdm_config(eth, MTK_GDMA_DROP_ALL);
 
 	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
-	mtk_rx_irq_disable(eth, eth->soc->txrx.rx_irq_done_mask);
+	mtk_rx_irq_disable(eth, eth->soc->rx.irq_done_mask);
 	napi_disable(&eth->tx_napi);
 	napi_disable(&eth->rx_napi);
 
@@ -3894,7 +3903,7 @@
 	else
 		mtk_hw_reset(eth);
 
-	if (mtk_is_netsys_v2_or_greater(eth)) {
+	if (mtk_is_netsys_v3_or_greater(eth)) {
 		/* Set FE to PDMAv2 if necessary */
 		val = mtk_r32(eth, MTK_FE_GLO_MISC);
 		mtk_w32(eth,  val | BIT(4), MTK_FE_GLO_MISC);
@@ -3948,9 +3957,9 @@
 
 	/* FE int grouping */
 	mtk_w32(eth, MTK_TX_DONE_INT, reg_map->pdma.int_grp);
-	mtk_w32(eth, eth->soc->txrx.rx_irq_done_mask, reg_map->pdma.int_grp + 4);
+	mtk_w32(eth, eth->soc->rx.irq_done_mask, reg_map->pdma.int_grp + 4);
 	mtk_w32(eth, MTK_TX_DONE_INT, reg_map->qdma.int_grp);
-	mtk_w32(eth, eth->soc->txrx.rx_irq_done_mask, reg_map->qdma.int_grp + 4);
+	mtk_w32(eth, eth->soc->rx.irq_done_mask, reg_map->qdma.int_grp + 4);
 	mtk_w32(eth, 0x21021000, MTK_FE_INT_GRP);
 
 	if (mtk_is_netsys_v3_or_greater(eth)) {
@@ -5040,11 +5049,18 @@
 	.required_clks = MT7623_CLKS_BITMAP,
 	.required_pctl = true,
 	.version = 1,
-	.txrx = {
-		.txd_size = sizeof(struct mtk_tx_dma),
-		.rxd_size = sizeof(struct mtk_rx_dma),
-		.rx_irq_done_mask = MTK_RX_DONE_INT,
-		.rx_dma_l4_valid = RX_DMA_L4_VALID,
+	.tx = {
+		.desc_size = sizeof(struct mtk_tx_dma),
+		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+		.dma_len_offset = 16,
+		.dma_size = MTK_DMA_SIZE(2K),
+		.fq_dma_size = MTK_DMA_SIZE(2K),
+	},
+	.rx = {
+		.desc_size = sizeof(struct mtk_rx_dma),
+		.irq_done_mask = MTK_RX_DONE_INT,
+		.dma_l4_valid = RX_DMA_L4_VALID,
+		.dma_size = MTK_DMA_SIZE(2K),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
@@ -5060,11 +5076,18 @@
 	.offload_version = 1,
 	.hash_offset = 2,
 	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
-	.txrx = {
-		.txd_size = sizeof(struct mtk_tx_dma),
-		.rxd_size = sizeof(struct mtk_rx_dma),
-		.rx_irq_done_mask = MTK_RX_DONE_INT,
-		.rx_dma_l4_valid = RX_DMA_L4_VALID,
+	.tx = {
+		.desc_size = sizeof(struct mtk_tx_dma),
+		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+		.dma_len_offset = 16,
+		.dma_size = MTK_DMA_SIZE(2K),
+		.fq_dma_size = MTK_DMA_SIZE(2K),
+	},
+	.rx = {
+		.desc_size = sizeof(struct mtk_rx_dma),
+		.irq_done_mask = MTK_RX_DONE_INT,
+		.dma_l4_valid = RX_DMA_L4_VALID,
+		.dma_size = MTK_DMA_SIZE(2K),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
@@ -5082,11 +5105,18 @@
 	.hash_offset = 2,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
-	.txrx = {
-		.txd_size = sizeof(struct mtk_tx_dma),
-		.rxd_size = sizeof(struct mtk_rx_dma),
-		.rx_irq_done_mask = MTK_RX_DONE_INT,
-		.rx_dma_l4_valid = RX_DMA_L4_VALID,
+	.tx = {
+		.desc_size = sizeof(struct mtk_tx_dma),
+		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+		.dma_len_offset = 16,
+		.dma_size = MTK_DMA_SIZE(2K),
+		.fq_dma_size = MTK_DMA_SIZE(2K),
+	},
+	.rx = {
+		.desc_size = sizeof(struct mtk_rx_dma),
+		.irq_done_mask = MTK_RX_DONE_INT,
+		.dma_l4_valid = RX_DMA_L4_VALID,
+		.dma_size = MTK_DMA_SIZE(2K),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
@@ -5103,11 +5133,18 @@
 	.hash_offset = 2,
 	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
 	.disable_pll_modes = true,
-	.txrx = {
-		.txd_size = sizeof(struct mtk_tx_dma),
-		.rxd_size = sizeof(struct mtk_rx_dma),
-		.rx_irq_done_mask = MTK_RX_DONE_INT,
-		.rx_dma_l4_valid = RX_DMA_L4_VALID,
+	.tx = {
+		.desc_size = sizeof(struct mtk_tx_dma),
+		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+		.dma_len_offset = 16,
+		.dma_size = MTK_DMA_SIZE(2K),
+		.fq_dma_size = MTK_DMA_SIZE(2K),
+	},
+	.rx = {
+		.desc_size = sizeof(struct mtk_rx_dma),
+		.irq_done_mask = MTK_RX_DONE_INT,
+		.dma_l4_valid = RX_DMA_L4_VALID,
+		.dma_size = MTK_DMA_SIZE(2K),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
@@ -5122,11 +5159,18 @@
 	.required_pctl = false,
 	.has_accounting = true,
 	.version = 1,
-	.txrx = {
-		.txd_size = sizeof(struct mtk_tx_dma),
-		.rxd_size = sizeof(struct mtk_rx_dma),
-		.rx_irq_done_mask = MTK_RX_DONE_INT,
-		.rx_dma_l4_valid = RX_DMA_L4_VALID,
+	.tx = {
+		.desc_size = sizeof(struct mtk_tx_dma),
+		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+		.dma_len_offset = 16,
+		.dma_size = MTK_DMA_SIZE(2K),
+		.fq_dma_size = MTK_DMA_SIZE(2K),
+	},
+	.rx = {
+		.desc_size = sizeof(struct mtk_rx_dma),
+		.irq_done_mask = MTK_RX_DONE_INT,
+		.dma_l4_valid = RX_DMA_L4_VALID,
+		.dma_size = MTK_DMA_SIZE(2K),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
@@ -5144,13 +5188,20 @@
 	.hash_offset = 4,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
-	.txrx = {
-		.txd_size = sizeof(struct mtk_tx_dma_v2),
-		.rxd_size = sizeof(struct mtk_rx_dma_v2),
-		.rx_irq_done_mask = MTK_RX_DONE_INT_V2,
-		.rx_dma_l4_valid = RX_DMA_L4_VALID_V2,
+	.tx = {
+		.desc_size = sizeof(struct mtk_tx_dma_v2),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
+		.dma_size = MTK_DMA_SIZE(2K),
+		.fq_dma_size = MTK_DMA_SIZE(2K),
+	},
+	.rx = {
+		.desc_size = sizeof(struct mtk_rx_dma),
+		.irq_done_mask = MTK_RX_DONE_INT,
+		.dma_l4_valid = RX_DMA_L4_VALID_V2,
+		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+		.dma_len_offset = 16,
+		.dma_size = MTK_DMA_SIZE(2K),
 	},
 };
 
@@ -5166,13 +5217,20 @@
 	.hash_offset = 4,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
-	.txrx = {
-		.txd_size = sizeof(struct mtk_tx_dma_v2),
-		.rxd_size = sizeof(struct mtk_rx_dma_v2),
-		.rx_irq_done_mask = MTK_RX_DONE_INT_V2,
-		.rx_dma_l4_valid = RX_DMA_L4_VALID_V2,
+	.tx = {
+		.desc_size = sizeof(struct mtk_tx_dma_v2),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
+		.dma_size = MTK_DMA_SIZE(2K),
+		.fq_dma_size = MTK_DMA_SIZE(2K),
+	},
+	.rx = {
+		.desc_size = sizeof(struct mtk_rx_dma),
+		.irq_done_mask = MTK_RX_DONE_INT,
+		.dma_l4_valid = RX_DMA_L4_VALID_V2,
+		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+		.dma_len_offset = 16,
+		.dma_size = MTK_DMA_SIZE(2K),
 	},
 };
 
@@ -5188,13 +5246,20 @@
 	.hash_offset = 4,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V3_SIZE,
-	.txrx = {
-		.txd_size = sizeof(struct mtk_tx_dma_v2),
-		.rxd_size = sizeof(struct mtk_rx_dma_v2),
-		.rx_irq_done_mask = MTK_RX_DONE_INT_V2,
-		.rx_dma_l4_valid = RX_DMA_L4_VALID_V2,
+	.tx = {
+		.desc_size = sizeof(struct mtk_tx_dma_v2),
+		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
+		.dma_len_offset = 8,
+		.dma_size = MTK_DMA_SIZE(2K),
+		.fq_dma_size = MTK_DMA_SIZE(4K),
+	},
+	.rx = {
+		.desc_size = sizeof(struct mtk_rx_dma_v2),
+		.irq_done_mask = MTK_RX_DONE_INT_V2,
+		.dma_l4_valid = RX_DMA_L4_VALID_V2,
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
+		.dma_size = MTK_DMA_SIZE(2K),
 	},
 };
 
@@ -5205,13 +5270,19 @@
 	.required_clks = MT7628_CLKS_BITMAP,
 	.required_pctl = false,
 	.version = 1,
-	.txrx = {
-		.txd_size = sizeof(struct mtk_tx_dma),
-		.rxd_size = sizeof(struct mtk_rx_dma),
-		.rx_irq_done_mask = MTK_RX_DONE_INT,
-		.rx_dma_l4_valid = RX_DMA_L4_VALID_PDMA,
+	.tx = {
+		.desc_size = sizeof(struct mtk_tx_dma),
+		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+		.dma_len_offset = 16,
+		.dma_size = MTK_DMA_SIZE(2K),
+	},
+	.rx = {
+		.desc_size = sizeof(struct mtk_rx_dma),
+		.irq_done_mask = MTK_RX_DONE_INT,
+		.dma_l4_valid = RX_DMA_L4_VALID_PDMA,
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
+		.dma_size = MTK_DMA_SIZE(2K),
 	},
 };
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -32,7 +32,9 @@
 #define MTK_TX_DMA_BUF_LEN	0x3fff
 #define MTK_TX_DMA_BUF_LEN_V2	0xffff
 #define MTK_QDMA_RING_SIZE	2048
-#define MTK_DMA_SIZE		512
+#define MTK_DMA_SIZE(x)		(SZ_##x)
+#define MTK_FQ_DMA_HEAD		32
+#define MTK_FQ_DMA_LENGTH	2048
 #define MTK_RX_ETH_HLEN		(ETH_HLEN + ETH_FCS_LEN)
 #define MTK_RX_HLEN		(NET_SKB_PAD + MTK_RX_ETH_HLEN + NET_IP_ALIGN)
 #define MTK_DMA_DUMMY_DESC	0xffffffff
@@ -327,8 +329,8 @@
 /* QDMA descriptor txd3 */
 #define TX_DMA_OWNER_CPU	BIT(31)
 #define TX_DMA_LS0		BIT(30)
-#define TX_DMA_PLEN0(x)		(((x) & eth->soc->txrx.dma_max_len) << eth->soc->txrx.dma_len_offset)
-#define TX_DMA_PLEN1(x)		((x) & eth->soc->txrx.dma_max_len)
+#define TX_DMA_PLEN0(x)		(((x) & eth->soc->tx.dma_max_len) << eth->soc->tx.dma_len_offset)
+#define TX_DMA_PLEN1(x)		((x) & eth->soc->tx.dma_max_len)
 #define TX_DMA_SWC		BIT(14)
 #define TX_DMA_PQID		GENMASK(3, 0)
 #define TX_DMA_ADDR64_MASK	GENMASK(3, 0)
@@ -348,8 +350,8 @@
 /* QDMA descriptor rxd2 */
 #define RX_DMA_DONE		BIT(31)
 #define RX_DMA_LSO		BIT(30)
-#define RX_DMA_PREP_PLEN0(x)	(((x) & eth->soc->txrx.dma_max_len) << eth->soc->txrx.dma_len_offset)
-#define RX_DMA_GET_PLEN0(x)	(((x) >> eth->soc->txrx.dma_len_offset) & eth->soc->txrx.dma_max_len)
+#define RX_DMA_PREP_PLEN0(x)	(((x) & eth->soc->rx.dma_max_len) << eth->soc->rx.dma_len_offset)
+#define RX_DMA_GET_PLEN0(x)	(((x) >> eth->soc->rx.dma_len_offset) & eth->soc->rx.dma_max_len)
 #define RX_DMA_VTAG		BIT(15)
 #define RX_DMA_ADDR64_MASK	GENMASK(3, 0)
 #if IS_ENABLED(CONFIG_64BIT)
@@ -1153,10 +1155,9 @@
  * @foe_entry_size		Foe table entry size.
  * @has_accounting		Bool indicating support for accounting of
  *				offloaded flows.
- * @txd_size			Tx DMA descriptor size.
- * @rxd_size			Rx DMA descriptor size.
- * @rx_irq_done_mask		Rx irq done register mask.
- * @rx_dma_l4_valid		Rx DMA valid register mask.
+ * @desc_size			Tx/Rx DMA descriptor size.
+ * @irq_done_mask		Rx irq done register mask.
+ * @dma_l4_valid		Rx DMA valid register mask.
  * @dma_max_len			Max DMA tx/rx buffer length.
  * @dma_len_offset		Tx/Rx DMA length field offset.
  */
@@ -1174,13 +1175,20 @@
 	bool		has_accounting;
 	bool		disable_pll_modes;
 	struct {
-		u32	txd_size;
-		u32	rxd_size;
-		u32	rx_irq_done_mask;
-		u32	rx_dma_l4_valid;
+		u32	desc_size;
 		u32	dma_max_len;
 		u32	dma_len_offset;
-	} txrx;
+		u32	dma_size;
+		u32	fq_dma_size;
+	} tx;
+	struct {
+		u32	desc_size;
+		u32	irq_done_mask;
+		u32	dma_l4_valid;
+		u32	dma_max_len;
+		u32	dma_len_offset;
+		u32	dma_size;
+	} rx;
 };
 
 #define MTK_DMA_MONITOR_TIMEOUT		msecs_to_jiffies(1000)
@@ -1261,7 +1269,7 @@
 	struct napi_struct		rx_napi;
 	void				*scratch_ring;
 	dma_addr_t			phy_scratch_ring;
-	void				*scratch_head;
+	void				*scratch_head[MTK_FQ_DMA_HEAD];
 	struct clk			*clks[MTK_CLK_MAX];
 
 	struct mii_bus			*mii_bus;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mediatek/mtk_ppe.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mediatek/mtk_ppe.c
@@ -994,7 +994,7 @@
 			 MTK_PPE_KEEPALIVE_DISABLE) |
 	      FIELD_PREP(MTK_PPE_TB_CFG_HASH_MODE, 1) |
 	      FIELD_PREP(MTK_PPE_TB_CFG_SCAN_MODE,
-			 MTK_PPE_SCAN_MODE_KEEPALIVE_AGE) |
+			 MTK_PPE_SCAN_MODE_CHECK_AGE) |
 	      FIELD_PREP(MTK_PPE_TB_CFG_ENTRY_NUM,
 			 MTK_PPE_ENTRIES_SHIFT);
 	if (mtk_is_netsys_v2_or_greater(ppe->eth))
@@ -1090,17 +1090,21 @@
 
 	mtk_ppe_cache_enable(ppe, false);
 
-	/* disable offload engine */
-	ppe_clear(ppe, MTK_PPE_GLO_CFG, MTK_PPE_GLO_CFG_EN);
-	ppe_w32(ppe, MTK_PPE_FLOW_CFG, 0);
-
 	/* disable aging */
 	val = MTK_PPE_TB_CFG_AGE_NON_L4 |
 	      MTK_PPE_TB_CFG_AGE_UNBIND |
 	      MTK_PPE_TB_CFG_AGE_TCP |
 	      MTK_PPE_TB_CFG_AGE_UDP |
-	      MTK_PPE_TB_CFG_AGE_TCP_FIN;
+	      MTK_PPE_TB_CFG_AGE_TCP_FIN |
+		  MTK_PPE_TB_CFG_SCAN_MODE;
 	ppe_clear(ppe, MTK_PPE_TB_CFG, val);
 
-	return mtk_ppe_wait_busy(ppe);
+	if (mtk_ppe_wait_busy(ppe))
+		return -ETIMEDOUT;
+
+	/* disable offload engine */
+	ppe_clear(ppe, MTK_PPE_GLO_CFG, MTK_PPE_GLO_CFG_EN);
+	ppe_w32(ppe, MTK_PPE_FLOW_CFG, 0);
+
+	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mediatek/mtk_star_emac.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mediatek/mtk_star_emac.c
@@ -1524,6 +1524,7 @@
 {
 	struct device_node *of_node;
 	struct mtk_star_priv *priv;
+	struct phy_device *phydev;
 	struct net_device *ndev;
 	struct device *dev;
 	void __iomem *base;
@@ -1649,6 +1650,12 @@
 	netif_napi_add(ndev, &priv->rx_napi, mtk_star_rx_poll);
 	netif_napi_add_tx(ndev, &priv->tx_napi, mtk_star_tx_poll);
 
+	phydev = of_phy_find_device(priv->phy_node);
+	if (phydev) {
+		phydev->mac_managed_pm = true;
+		put_device(&phydev->mdio.dev);
+	}
+
 	return devm_register_netdev(dev, ndev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mediatek/mtk_wed.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mediatek/mtk_wed.c
@@ -1074,13 +1074,13 @@
 static void
 mtk_wed_stop(struct mtk_wed_device *dev)
 {
+	mtk_wed_dma_disable(dev);
 	mtk_wed_set_ext_int(dev, false);
 
 	wed_w32(dev, MTK_WED_WPDMA_INT_TRIGGER, 0);
 	wed_w32(dev, MTK_WED_WDMA_INT_TRIGGER, 0);
 	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
 	wdma_w32(dev, MTK_WDMA_INT_GRP2, 0);
-	wed_w32(dev, MTK_WED_WPDMA_INT_MASK, 0);
 
 	if (!mtk_wed_get_rx_capa(dev))
 		return;
@@ -1093,7 +1093,6 @@
 mtk_wed_deinit(struct mtk_wed_device *dev)
 {
 	mtk_wed_stop(dev);
-	mtk_wed_dma_disable(dev);
 
 	wed_clr(dev, MTK_WED_CTRL,
 		MTK_WED_CTRL_WDMA_INT_AGENT_EN |
@@ -2605,9 +2604,6 @@
 static void
 mtk_wed_irq_set_mask(struct mtk_wed_device *dev, u32 mask)
 {
-	if (!dev->running)
-		return;
-
 	mtk_wed_set_ext_int(dev, !!mask);
 	wed_w32(dev, MTK_WED_INT_MASK, mask);
 }
@@ -2670,14 +2666,15 @@
 {
 	struct mtk_wed_flow_block_priv *priv = cb_priv;
 	struct flow_cls_offload *cls = type_data;
-	struct mtk_wed_hw *hw = priv->hw;
+	struct mtk_wed_hw *hw = NULL;
 
-	if (!tc_can_offload(priv->dev))
+	if (!priv || !tc_can_offload(priv->dev))
 		return -EOPNOTSUPP;
 
 	if (type != TC_SETUP_CLSFLOWER)
 		return -EOPNOTSUPP;
 
+	hw = priv->hw;
 	return mtk_flow_offload_cmd(hw->eth, cls, hw->index);
 }
 
@@ -2733,6 +2730,7 @@
 			flow_block_cb_remove(block_cb, f);
 			list_del(&block_cb->driver_list);
 			kfree(block_cb->cb_priv);
+			block_cb->cb_priv = NULL;
 		}
 		return 0;
 	default:
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mediatek/mtk_wed_wo.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mediatek/mtk_wed_wo.h
@@ -91,8 +91,8 @@
 #define MT7981_FIRMWARE_WO	"mediatek/mt7981_wo.bin"
 #define MT7986_FIRMWARE_WO0	"mediatek/mt7986_wo_0.bin"
 #define MT7986_FIRMWARE_WO1	"mediatek/mt7986_wo_1.bin"
-#define MT7988_FIRMWARE_WO0	"mediatek/mt7988_wo_0.bin"
-#define MT7988_FIRMWARE_WO1	"mediatek/mt7988_wo_1.bin"
+#define MT7988_FIRMWARE_WO0	"mediatek/mt7988/mt7988_wo_0.bin"
+#define MT7988_FIRMWARE_WO1	"mediatek/mt7988/mt7988_wo_1.bin"
 
 #define MTK_WO_MCU_CFG_LS_BASE				0
 #define MTK_WO_MCU_CFG_LS_HW_VER_ADDR			(MTK_WO_MCU_CFG_LS_BASE + 0x000)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -969,19 +969,32 @@
 	bool poll_cmd = ent->polling;
 	struct mlx5_cmd_layout *lay;
 	struct mlx5_core_dev *dev;
-	unsigned long cb_timeout;
-	struct semaphore *sem;
+	unsigned long timeout;
 	unsigned long flags;
 	int alloc_ret;
 	int cmd_mode;
 
+	complete(&ent->handling);
+
 	dev = container_of(cmd, struct mlx5_core_dev, cmd);
-	cb_timeout = msecs_to_jiffies(mlx5_tout_ms(dev, CMD));
+	timeout = msecs_to_jiffies(mlx5_tout_ms(dev, CMD));
 
-	complete(&ent->handling);
-	sem = ent->page_queue ? &cmd->vars.pages_sem : &cmd->vars.sem;
-	down(sem);
 	if (!ent->page_queue) {
+		if (down_timeout(&cmd->vars.sem, timeout)) {
+			mlx5_core_warn(dev, "%s(0x%x) timed out while waiting for a slot.\n",
+				       mlx5_command_str(ent->op), ent->op);
+			if (ent->callback) {
+				ent->callback(-EBUSY, ent->context);
+				mlx5_free_cmd_msg(dev, ent->out);
+				free_msg(dev, ent->in);
+				cmd_ent_put(ent);
+			} else {
+				ent->ret = -EBUSY;
+				complete(&ent->done);
+			}
+			complete(&ent->slotted);
+			return;
+		}
 		alloc_ret = cmd_alloc_index(cmd, ent);
 		if (alloc_ret < 0) {
 			mlx5_core_err_rl(dev, "failed to allocate command entry\n");
@@ -994,10 +1007,12 @@
 				ent->ret = -EAGAIN;
 				complete(&ent->done);
 			}
-			up(sem);
+			up(&cmd->vars.sem);
+			complete(&ent->slotted);
 			return;
 		}
 	} else {
+		down(&cmd->vars.pages_sem);
 		ent->idx = cmd->vars.max_reg_cmds;
 		spin_lock_irqsave(&cmd->alloc_lock, flags);
 		clear_bit(ent->idx, &cmd->vars.bitmask);
@@ -1005,6 +1020,8 @@
 		spin_unlock_irqrestore(&cmd->alloc_lock, flags);
 	}
 
+	complete(&ent->slotted);
+
 	lay = get_inst(cmd, ent->idx);
 	ent->lay = lay;
 	memset(lay, 0, sizeof(*lay));
@@ -1023,7 +1040,7 @@
 	ent->ts1 = ktime_get_ns();
 	cmd_mode = cmd->mode;
 
-	if (ent->callback && schedule_delayed_work(&ent->cb_timeout_work, cb_timeout))
+	if (ent->callback && schedule_delayed_work(&ent->cb_timeout_work, timeout))
 		cmd_ent_get(ent);
 	set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state);
 
@@ -1143,6 +1160,9 @@
 		ent->ret = -ECANCELED;
 		goto out_err;
 	}
+
+	wait_for_completion(&ent->slotted);
+
 	if (cmd->mode == CMD_MODE_POLLING || ent->polling)
 		wait_for_completion(&ent->done);
 	else if (!wait_for_completion_timeout(&ent->done, timeout))
@@ -1157,6 +1177,9 @@
 	} else if (err == -ECANCELED) {
 		mlx5_core_warn(dev, "%s(0x%x) canceled on out of queue timeout.\n",
 			       mlx5_command_str(ent->op), ent->op);
+	} else if (err == -EBUSY) {
+		mlx5_core_warn(dev, "%s(0x%x) timeout while waiting for command semaphore.\n",
+			       mlx5_command_str(ent->op), ent->op);
 	}
 	mlx5_core_dbg(dev, "err %d, delivery status %s(%d)\n",
 		      err, deliv_status_to_str(ent->status), ent->status);
@@ -1208,6 +1231,7 @@
 	ent->polling = force_polling;
 
 	init_completion(&ent->handling);
+	init_completion(&ent->slotted);
 	if (!callback)
 		init_completion(&ent->done);
 
@@ -1225,7 +1249,7 @@
 		return 0; /* mlx5_cmd_comp_handler() will put(ent) */
 
 	err = wait_func(dev, ent);
-	if (err == -ETIMEDOUT || err == -ECANCELED)
+	if (err == -ETIMEDOUT || err == -ECANCELED || err == -EBUSY)
 		goto out_free;
 
 	ds = ent->ts2 - ent->ts1;
@@ -1611,6 +1635,9 @@
 	dev = container_of(cmd, struct mlx5_core_dev, cmd);
 	eqe = data;
 
+	if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
+		return NOTIFY_DONE;
+
 	mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector), false);
 
 	return NOTIFY_OK;
@@ -1734,6 +1761,10 @@
 	}
 }
 
+#define MLX5_MAX_MANAGE_PAGES_CMD_ENT 1
+#define MLX5_CMD_MASK ((1UL << (cmd->vars.max_reg_cmds + \
+			   MLX5_MAX_MANAGE_PAGES_CMD_ENT)) - 1)
+
 static void mlx5_cmd_trigger_completions(struct mlx5_core_dev *dev)
 {
 	struct mlx5_cmd *cmd = &dev->cmd;
@@ -1745,7 +1776,7 @@
 	/* wait for pending handlers to complete */
 	mlx5_eq_synchronize_cmd_irq(dev);
 	spin_lock_irqsave(&dev->cmd.alloc_lock, flags);
-	vector = ~dev->cmd.vars.bitmask & ((1ul << (1 << dev->cmd.vars.log_sz)) - 1);
+	vector = ~dev->cmd.vars.bitmask & MLX5_CMD_MASK;
 	if (!vector)
 		goto no_trig;
 
@@ -2319,7 +2350,7 @@
 
 	cmd->state = MLX5_CMDIF_STATE_DOWN;
 	cmd->vars.max_reg_cmds = (1 << cmd->vars.log_sz) - 1;
-	cmd->vars.bitmask = (1UL << cmd->vars.max_reg_cmds) - 1;
+	cmd->vars.bitmask = MLX5_CMD_MASK;
 
 	sema_init(&cmd->vars.sem, cmd->vars.max_reg_cmds);
 	sema_init(&cmd->vars.pages_sem, 1);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -79,6 +79,7 @@
 				 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 
 #define MLX5E_RX_MAX_HEAD (256)
+#define MLX5E_SHAMPO_LOG_HEADER_ENTRY_SIZE (8)
 #define MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE (9)
 #define MLX5E_SHAMPO_WQ_HEADER_PER_PAGE (PAGE_SIZE >> MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE)
 #define MLX5E_SHAMPO_WQ_BASE_HEAD_ENTRY_SIZE (64)
@@ -145,25 +146,6 @@
 #define MLX5E_TX_XSK_POLL_BUDGET       64
 #define MLX5E_SQ_RECOVER_MIN_INTERVAL  500 /* msecs */
 
-#define MLX5E_KLM_UMR_WQE_SZ(sgl_len)\
-	(sizeof(struct mlx5e_umr_wqe) +\
-	(sizeof(struct mlx5_klm) * (sgl_len)))
-
-#define MLX5E_KLM_UMR_WQEBBS(klm_entries) \
-	(DIV_ROUND_UP(MLX5E_KLM_UMR_WQE_SZ(klm_entries), MLX5_SEND_WQE_BB))
-
-#define MLX5E_KLM_UMR_DS_CNT(klm_entries)\
-	(DIV_ROUND_UP(MLX5E_KLM_UMR_WQE_SZ(klm_entries), MLX5_SEND_WQE_DS))
-
-#define MLX5E_KLM_MAX_ENTRIES_PER_WQE(wqe_size)\
-	(((wqe_size) - sizeof(struct mlx5e_umr_wqe)) / sizeof(struct mlx5_klm))
-
-#define MLX5E_KLM_ENTRIES_PER_WQE(wqe_size)\
-	ALIGN_DOWN(MLX5E_KLM_MAX_ENTRIES_PER_WQE(wqe_size), MLX5_UMR_KLM_NUM_ENTRIES_ALIGNMENT)
-
-#define MLX5E_MAX_KLM_PER_WQE(mdev) \
-	MLX5E_KLM_ENTRIES_PER_WQE(MLX5_SEND_WQE_BB * mlx5e_get_max_sq_aligned_wqebbs(mdev))
-
 #define mlx5e_state_dereference(priv, p) \
 	rcu_dereference_protected((p), lockdep_is_held(&(priv)->state_lock))
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
@@ -1131,18 +1131,18 @@
 				 struct mlx5e_params *params,
 				 struct mlx5e_rq_param *rq_param)
 {
-	int max_num_of_umr_per_wqe, max_hd_per_wqe, max_klm_per_umr, rest;
+	int max_num_of_umr_per_wqe, max_hd_per_wqe, max_ksm_per_umr, rest;
 	void *wqc = MLX5_ADDR_OF(rqc, rq_param->rqc, wq);
 	int wq_size = BIT(MLX5_GET(wq, wqc, log_wq_sz));
 	u32 wqebbs;
 
-	max_klm_per_umr = MLX5E_MAX_KLM_PER_WQE(mdev);
+	max_ksm_per_umr = MLX5E_MAX_KSM_PER_WQE(mdev);
 	max_hd_per_wqe = mlx5e_shampo_hd_per_wqe(mdev, params, rq_param);
-	max_num_of_umr_per_wqe = max_hd_per_wqe / max_klm_per_umr;
-	rest = max_hd_per_wqe % max_klm_per_umr;
-	wqebbs = MLX5E_KLM_UMR_WQEBBS(max_klm_per_umr) * max_num_of_umr_per_wqe;
+	max_num_of_umr_per_wqe = max_hd_per_wqe / max_ksm_per_umr;
+	rest = max_hd_per_wqe % max_ksm_per_umr;
+	wqebbs = MLX5E_KSM_UMR_WQEBBS(max_ksm_per_umr) * max_num_of_umr_per_wqe;
 	if (rest)
-		wqebbs += MLX5E_KLM_UMR_WQEBBS(rest);
+		wqebbs += MLX5E_KSM_UMR_WQEBBS(rest);
 	wqebbs *= wq_size;
 	return wqebbs;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h
@@ -95,9 +95,15 @@
 }
 
 static inline u8
+mlx5e_ptp_metadata_fifo_peek(struct mlx5e_ptp_metadata_fifo *fifo)
+{
+	return fifo->data[fifo->mask & fifo->cc];
+}
+
+static inline void
 mlx5e_ptp_metadata_fifo_pop(struct mlx5e_ptp_metadata_fifo *fifo)
 {
-	return fifo->data[fifo->mask & fifo->cc++];
+	fifo->cc++;
 }
 
 static inline void
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
@@ -83,24 +83,25 @@
 
 	txq_ix = mlx5e_qid_from_qos(chs, node_qid);
 
-	WARN_ON(node_qid > priv->htb_max_qos_sqs);
-	if (node_qid == priv->htb_max_qos_sqs) {
-		struct mlx5e_sq_stats *stats, **stats_list = NULL;
-
-		if (priv->htb_max_qos_sqs == 0) {
-			stats_list = kvcalloc(mlx5e_qos_max_leaf_nodes(priv->mdev),
-					      sizeof(*stats_list),
-					      GFP_KERNEL);
-			if (!stats_list)
-				return -ENOMEM;
-		}
+	WARN_ON(node_qid >= mlx5e_htb_cur_leaf_nodes(priv->htb));
+	if (!priv->htb_qos_sq_stats) {
+		struct mlx5e_sq_stats **stats_list;
+
+		stats_list = kvcalloc(mlx5e_qos_max_leaf_nodes(priv->mdev),
+				      sizeof(*stats_list), GFP_KERNEL);
+		if (!stats_list)
+			return -ENOMEM;
+
+		WRITE_ONCE(priv->htb_qos_sq_stats, stats_list);
+	}
+
+	if (!priv->htb_qos_sq_stats[node_qid]) {
+		struct mlx5e_sq_stats *stats;
+
 		stats = kzalloc(sizeof(*stats), GFP_KERNEL);
-		if (!stats) {
-			kvfree(stats_list);
+		if (!stats)
 			return -ENOMEM;
-		}
-		if (stats_list)
-			WRITE_ONCE(priv->htb_qos_sq_stats, stats_list);
+
 		WRITE_ONCE(priv->htb_qos_sq_stats[node_qid], stats);
 		/* Order htb_max_qos_sqs increment after writing the array pointer.
 		 * Pairs with smp_load_acquire in en_stats.c.
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
@@ -143,7 +143,9 @@
 		return err;
 	}
 
+	mutex_lock(&priv->state_lock);
 	err = mlx5e_safe_reopen_channels(priv);
+	mutex_unlock(&priv->state_lock);
 	if (!err) {
 		to_ctx->status = 1; /* all channels recovered */
 		return err;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/selq.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/selq.c
@@ -57,6 +57,7 @@
 
 void mlx5e_selq_cleanup(struct mlx5e_selq *selq)
 {
+	mutex_lock(selq->state_lock);
 	WARN_ON_ONCE(selq->is_prepared);
 
 	kvfree(selq->standby);
@@ -67,6 +68,7 @@
 
 	kvfree(selq->standby);
 	selq->standby = NULL;
+	mutex_unlock(selq->state_lock);
 }
 
 void mlx5e_selq_prepare_params(struct mlx5e_selq *selq, struct mlx5e_params *params)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
@@ -854,7 +854,7 @@
 	return 0;
 
 err_rule:
-	mlx5_tc_ct_entry_destroy_mod_hdr(ct_priv, zone_rule->attr, zone_rule->mh);
+	mlx5_tc_ct_entry_destroy_mod_hdr(ct_priv, attr, zone_rule->mh);
 	mlx5_put_label_mapping(ct_priv, attr->ct_attr.ct_labels_id);
 err_mod_hdr:
 	kfree(attr);
@@ -920,6 +920,7 @@
 	mlx5_tc_ct_entry_destroy_mod_hdr(ct_priv, zone_rule->attr, mh);
 	mlx5_put_label_mapping(ct_priv, attr->ct_attr.ct_labels_id);
 err_mod_hdr:
+	*attr = *old_attr;
 	kfree(old_attr);
 err_attr:
 	kvfree(spec);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
@@ -5,6 +5,7 @@
 #include <net/nexthop.h>
 #include <net/ip_tunnels.h>
 #include "tc_tun_encap.h"
+#include "fs_core.h"
 #include "en_tc.h"
 #include "tc_tun.h"
 #include "rep/tc.h"
@@ -24,10 +25,18 @@
 
 	route_dev = dev_get_by_index(dev_net(e->out_dev), e->route_dev_ifindex);
 
-	if (!route_dev || !netif_is_ovs_master(route_dev) ||
-	    attr->parse_attr->filter_dev == e->out_dev)
+	if (!route_dev || !netif_is_ovs_master(route_dev))
 		goto out;
 
+	if (priv->mdev->priv.steering->mode == MLX5_FLOW_STEERING_MODE_DMFS &&
+	    mlx5e_eswitch_uplink_rep(attr->parse_attr->filter_dev) &&
+	    (attr->esw_attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP)) {
+		mlx5_core_warn(priv->mdev,
+			       "Matching on external port with encap + fwd to table actions is not allowed for firmware steering\n");
+		err = -EINVAL;
+		goto out;
+	}
+
 	err = mlx5e_set_fwd_to_int_port_actions(priv, attr, e->route_dev_ifindex,
 						MLX5E_TC_INT_PORT_EGRESS,
 						&attr->action, out_index);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c
@@ -23,6 +23,9 @@
 	struct mlx5e_tir_builder *builder;
 
 	builder = kvzalloc(sizeof(*builder), GFP_KERNEL);
+	if (!builder)
+		return NULL;
+
 	builder->modify = modify;
 
 	return builder;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
@@ -34,6 +34,25 @@
 
 #define MLX5E_RX_ERR_CQE(cqe) (get_cqe_opcode(cqe) != MLX5_CQE_RESP_SEND)
 
+#define MLX5E_KSM_UMR_WQE_SZ(sgl_len)\
+	(sizeof(struct mlx5e_umr_wqe) +\
+	(sizeof(struct mlx5_ksm) * (sgl_len)))
+
+#define MLX5E_KSM_UMR_WQEBBS(ksm_entries) \
+	(DIV_ROUND_UP(MLX5E_KSM_UMR_WQE_SZ(ksm_entries), MLX5_SEND_WQE_BB))
+
+#define MLX5E_KSM_UMR_DS_CNT(ksm_entries)\
+	(DIV_ROUND_UP(MLX5E_KSM_UMR_WQE_SZ(ksm_entries), MLX5_SEND_WQE_DS))
+
+#define MLX5E_KSM_MAX_ENTRIES_PER_WQE(wqe_size)\
+	(((wqe_size) - sizeof(struct mlx5e_umr_wqe)) / sizeof(struct mlx5_ksm))
+
+#define MLX5E_KSM_ENTRIES_PER_WQE(wqe_size)\
+	ALIGN_DOWN(MLX5E_KSM_MAX_ENTRIES_PER_WQE(wqe_size), MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT)
+
+#define MLX5E_MAX_KSM_PER_WQE(mdev) \
+	MLX5E_KSM_ENTRIES_PER_WQE(MLX5_SEND_WQE_BB * mlx5e_get_max_sq_aligned_wqebbs(mdev))
+
 static inline
 ktime_t mlx5e_cqe_ts_to_ns(cqe_ts_to_ns func, struct mlx5_clock *clock, u64 cqe_ts)
 {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
@@ -28,8 +28,10 @@
 			      struct mlx5e_xsk_param *xsk,
 			      struct mlx5_core_dev *mdev)
 {
-	/* AF_XDP doesn't support frames larger than PAGE_SIZE. */
-	if (xsk->chunk_size > PAGE_SIZE || xsk->chunk_size < MLX5E_MIN_XSK_CHUNK_SIZE) {
+	/* AF_XDP doesn't support frames larger than PAGE_SIZE,
+	 * and xsk->chunk_size is limited to 65535 bytes.
+	 */
+	if ((size_t)xsk->chunk_size > PAGE_SIZE || xsk->chunk_size < MLX5E_MIN_XSK_CHUNK_SIZE) {
 		mlx5_core_err(mdev, "XSK chunk size %u out of bounds [%u, %lu]\n", xsk->chunk_size,
 			      MLX5E_MIN_XSK_CHUNK_SIZE, PAGE_SIZE);
 		return false;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
@@ -102,8 +102,14 @@
 mlx5e_udp_gso_handle_tx_skb(struct sk_buff *skb)
 {
 	int payload_len = skb_shinfo(skb)->gso_size + sizeof(struct udphdr);
+	struct udphdr *udphdr;
 
-	udp_hdr(skb)->len = htons(payload_len);
+	if (skb->encapsulation)
+		udphdr = (struct udphdr *)skb_inner_transport_header(skb);
+	else
+		udphdr = udp_hdr(skb);
+
+	udphdr->len = htons(payload_len);
 }
 
 struct mlx5e_accel_tx_state {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -67,7 +67,6 @@
 		return;
 
 	spin_lock_bh(&x->lock);
-	xfrm_state_check_expire(x);
 	if (x->km.state == XFRM_STATE_EXPIRED) {
 		sa_entry->attrs.drop = true;
 		spin_unlock_bh(&x->lock);
@@ -75,6 +74,13 @@
 		mlx5e_accel_ipsec_fs_modify(sa_entry);
 		return;
 	}
+
+	if (x->km.state != XFRM_STATE_VALID) {
+		spin_unlock_bh(&x->lock);
+		return;
+	}
+
+	xfrm_state_check_expire(x);
 	spin_unlock_bh(&x->lock);
 
 	queue_delayed_work(sa_entry->ipsec->wq, &dwork->dwork,
@@ -718,6 +724,12 @@
 	/* check esn */
 	if (x->props.flags & XFRM_STATE_ESN)
 		mlx5e_ipsec_update_esn_state(sa_entry);
+	else
+		/* According to RFC4303, section "3.3.3. Sequence Number Generation",
+		 * the first packet sent using a given SA will contain a sequence
+		 * number of 1.
+		 */
+		sa_entry->esn_state.esn = 1;
 
 	mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, &sa_entry->attrs);
 
@@ -762,9 +774,12 @@
 				   MLX5_IPSEC_RESCHED);
 
 	if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET &&
-	    x->props.mode == XFRM_MODE_TUNNEL)
-		xa_set_mark(&ipsec->sadb, sa_entry->ipsec_obj_id,
-			    MLX5E_IPSEC_TUNNEL_SA);
+	    x->props.mode == XFRM_MODE_TUNNEL) {
+		xa_lock_bh(&ipsec->sadb);
+		__xa_set_mark(&ipsec->sadb, sa_entry->ipsec_obj_id,
+			      MLX5E_IPSEC_TUNNEL_SA);
+		xa_unlock_bh(&ipsec->sadb);
+	}
 
 out:
 	x->xso.offload_handle = (unsigned long)sa_entry;
@@ -791,7 +806,6 @@
 static void mlx5e_xfrm_del_state(struct xfrm_state *x)
 {
 	struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x);
-	struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
 	struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
 	struct mlx5e_ipsec_sa_entry *old;
 
@@ -800,12 +814,6 @@
 
 	old = xa_erase_bh(&ipsec->sadb, sa_entry->ipsec_obj_id);
 	WARN_ON(old != sa_entry);
-
-	if (attrs->mode == XFRM_MODE_TUNNEL &&
-	    attrs->type == XFRM_DEV_OFFLOAD_PACKET)
-		/* Make sure that no ARP requests are running in parallel */
-		flush_workqueue(ipsec->wq);
-
 }
 
 static void mlx5e_xfrm_free_state(struct xfrm_state *x)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
@@ -750,8 +750,7 @@
 err_fs_ft:
 	if (rx->allow_tunnel_mode)
 		mlx5_eswitch_unblock_encap(mdev);
-	mlx5_del_flow_rules(rx->status.rule);
-	mlx5_modify_header_dealloc(mdev, rx->status.modify_hdr);
+	mlx5_ipsec_rx_status_destroy(ipsec, rx);
 err_add:
 	mlx5_destroy_flow_table(rx->ft.status);
 err_fs_ft_status:
@@ -1719,23 +1718,21 @@
 		goto err_alloc;
 	}
 
-	if (attrs->family == AF_INET)
-		setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4);
-	else
-		setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6);
-
 	setup_fte_no_frags(spec);
 	setup_fte_upper_proto_match(spec, &attrs->upspec);
 
 	switch (attrs->type) {
 	case XFRM_DEV_OFFLOAD_CRYPTO:
+		if (attrs->family == AF_INET)
+			setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4);
+		else
+			setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6);
 		setup_fte_spi(spec, attrs->spi, false);
 		setup_fte_esp(spec);
 		setup_fte_reg_a(spec);
 		break;
 	case XFRM_DEV_OFFLOAD_PACKET:
-		if (attrs->reqid)
-			setup_fte_reg_c4(spec, attrs->reqid);
+		setup_fte_reg_c4(spec, attrs->reqid);
 		err = setup_pkt_reformat(ipsec, attrs, &flow_act);
 		if (err)
 			goto err_pkt_reformat;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
@@ -51,9 +51,10 @@
 		    MLX5_CAP_FLOWTABLE_NIC_RX(mdev, decap))
 			caps |= MLX5_IPSEC_CAP_PACKET_OFFLOAD;
 
-		if ((MLX5_CAP_FLOWTABLE_NIC_TX(mdev, ignore_flow_level) &&
-		     MLX5_CAP_FLOWTABLE_NIC_RX(mdev, ignore_flow_level)) ||
-		    MLX5_CAP_ESW_FLOWTABLE_FDB(mdev, ignore_flow_level))
+		if (IS_ENABLED(CONFIG_MLX5_CLS_ACT) &&
+		    ((MLX5_CAP_FLOWTABLE_NIC_TX(mdev, ignore_flow_level) &&
+		      MLX5_CAP_FLOWTABLE_NIC_RX(mdev, ignore_flow_level)) ||
+		     MLX5_CAP_ESW_FLOWTABLE_FDB(mdev, ignore_flow_level)))
 			caps |= MLX5_IPSEC_CAP_PRIO;
 
 		if (MLX5_CAP_FLOWTABLE_NIC_TX(mdev,
@@ -90,8 +91,9 @@
 EXPORT_SYMBOL_GPL(mlx5_ipsec_device_caps);
 
 static void mlx5e_ipsec_packet_setup(void *obj, u32 pdn,
-				     struct mlx5_accel_esp_xfrm_attrs *attrs)
+				     struct mlx5e_ipsec_sa_entry *sa_entry)
 {
+	struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
 	void *aso_ctx;
 
 	aso_ctx = MLX5_ADDR_OF(ipsec_obj, obj, ipsec_aso);
@@ -119,8 +121,12 @@
 	 * active.
 	 */
 	MLX5_SET(ipsec_obj, obj, aso_return_reg, MLX5_IPSEC_ASO_REG_C_4_5);
-	if (attrs->dir == XFRM_DEV_OFFLOAD_OUT)
+	if (attrs->dir == XFRM_DEV_OFFLOAD_OUT) {
 		MLX5_SET(ipsec_aso, aso_ctx, mode, MLX5_IPSEC_ASO_INC_SN);
+		if (!attrs->replay_esn.trigger)
+			MLX5_SET(ipsec_aso, aso_ctx, mode_parameter,
+				 sa_entry->esn_state.esn);
+	}
 
 	if (attrs->lft.hard_packet_limit != XFRM_INF) {
 		MLX5_SET(ipsec_aso, aso_ctx, remove_flow_pkt_cnt,
@@ -173,7 +179,7 @@
 
 	res = &mdev->mlx5e_res.hw_objs;
 	if (attrs->type == XFRM_DEV_OFFLOAD_PACKET)
-		mlx5e_ipsec_packet_setup(obj, res->pdn, attrs);
+		mlx5e_ipsec_packet_setup(obj, res->pdn, sa_entry);
 
 	err = mlx5_cmd_exec(mdev, in, sizeof(in), out, sizeof(out));
 	if (!err)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h
@@ -98,18 +98,11 @@
 		if (!x || !x->xso.offload_handle)
 			goto out_disable;
 
-		if (xo->inner_ipproto) {
-			/* Cannot support tunnel packet over IPsec tunnel mode
-			 * because we cannot offload three IP header csum
-			 */
-			if (x->props.mode == XFRM_MODE_TUNNEL)
-				goto out_disable;
-
-			/* Only support UDP or TCP L4 checksum */
-			if (xo->inner_ipproto != IPPROTO_UDP &&
-			    xo->inner_ipproto != IPPROTO_TCP)
-				goto out_disable;
-		}
+		/* Only support UDP or TCP L4 checksum */
+		if (xo->inner_ipproto &&
+		    xo->inner_ipproto != IPPROTO_UDP &&
+		    xo->inner_ipproto != IPPROTO_TCP)
+			goto out_disable;
 
 		return features;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
@@ -660,7 +660,7 @@
 	while (remaining > 0) {
 		skb_frag_t *frag = &record->frags[i];
 
-		get_page(skb_frag_page(frag));
+		page_ref_inc(skb_frag_page(frag));
 		remaining -= skb_frag_size(frag);
 		info->frags[i++] = *frag;
 	}
@@ -763,7 +763,7 @@
 	stats = sq->stats;
 
 	mlx5e_tx_dma_unmap(sq->pdev, dma);
-	put_page(wi->resync_dump_frag_page);
+	page_ref_dec(wi->resync_dump_frag_page);
 	stats->tls_dump_packets++;
 	stats->tls_dump_bytes += wi->num_bytes;
 }
@@ -816,12 +816,12 @@
 
 err_out:
 	for (; i < info.nr_frags; i++)
-		/* The put_page() here undoes the page ref obtained in tx_sync_info_get().
+		/* The page_ref_dec() here undoes the page ref obtained in tx_sync_info_get().
 		 * Page refs obtained for the DUMP WQEs above (by page_ref_add) will be
 		 * released only upon their completions (or in mlx5e_free_txqsq_descs,
 		 * if channel closes).
 		 */
-		put_page(skb_frag_page(&info.frags[i]));
+		page_ref_dec(skb_frag_page(&info.frags[i]));
 
 	return MLX5E_KTLS_SYNC_FAIL;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
@@ -339,9 +339,13 @@
 {
 	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	struct mlx5_macsec_fs *macsec_fs = priv->mdev->macsec_fs;
+	const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
 	struct mlx5_macsec_rule_attrs rule_attrs;
 	union mlx5_macsec_rule *macsec_rule;
 
+	if (is_tx && tx_sc->encoding_sa != sa->assoc_num)
+		return 0;
+
 	rule_attrs.macsec_obj_id = sa->macsec_obj_id;
 	rule_attrs.sci = sa->sci;
 	rule_attrs.assoc_num = sa->assoc_num;
@@ -1640,6 +1644,7 @@
 	.mdo_add_secy = mlx5e_macsec_add_secy,
 	.mdo_upd_secy = mlx5e_macsec_upd_secy,
 	.mdo_del_secy = mlx5e_macsec_del_secy,
+	.rx_uses_md_dst = true,
 };
 
 bool mlx5e_macsec_handle_tx_skb(struct mlx5e_macsec *macsec, struct sk_buff *skb)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
@@ -45,6 +45,10 @@
 	struct hlist_head	 rules_hash[ARFS_HASH_SIZE];
 };
 
+enum {
+	MLX5E_ARFS_STATE_ENABLED,
+};
+
 enum arfs_type {
 	ARFS_IPV4_TCP,
 	ARFS_IPV6_TCP,
@@ -59,6 +63,7 @@
 	spinlock_t                     arfs_lock;
 	int                            last_filter_id;
 	struct workqueue_struct        *wq;
+	unsigned long                  state;
 };
 
 struct arfs_tuple {
@@ -169,6 +174,8 @@
 			return err;
 		}
 	}
+	set_bit(MLX5E_ARFS_STATE_ENABLED, &arfs->state);
+
 	return 0;
 }
 
@@ -454,6 +461,8 @@
 	int i;
 	int j;
 
+	clear_bit(MLX5E_ARFS_STATE_ENABLED, &arfs->state);
+
 	spin_lock_bh(&arfs->arfs_lock);
 	mlx5e_for_each_arfs_rule(rule, htmp, arfs->arfs_tables, i, j) {
 		hlist_del_init(&rule->hlist);
@@ -626,17 +635,8 @@
 	struct mlx5_flow_handle *rule;
 
 	arfs = mlx5e_fs_get_arfs(priv->fs);
-	mutex_lock(&priv->state_lock);
-	if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
-		spin_lock_bh(&arfs->arfs_lock);
-		hlist_del(&arfs_rule->hlist);
-		spin_unlock_bh(&arfs->arfs_lock);
-
-		mutex_unlock(&priv->state_lock);
-		kfree(arfs_rule);
-		goto out;
-	}
-	mutex_unlock(&priv->state_lock);
+	if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &arfs->state))
+		return;
 
 	if (!arfs_rule->rule) {
 		rule = arfs_add_rule(priv, arfs_rule);
@@ -752,6 +752,11 @@
 		return -EPROTONOSUPPORT;
 
 	spin_lock_bh(&arfs->arfs_lock);
+	if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &arfs->state)) {
+		spin_unlock_bh(&arfs->arfs_lock);
+		return -EPERM;
+	}
+
 	arfs_rule = arfs_find_rule(arfs_t, &fk);
 	if (arfs_rule) {
 		if (arfs_rule->rxq == rxq_index || work_busy(&arfs_rule->arfs_work)) {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -136,6 +136,10 @@
 				       ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT);
 	MLX5_BUILD_PTYS2ETHTOOL_CONFIG(MLX5E_100GBASE_LR4, legacy,
 				       ETHTOOL_LINK_MODE_100000baseLR4_ER4_Full_BIT);
+	MLX5_BUILD_PTYS2ETHTOOL_CONFIG(MLX5E_100BASE_TX, legacy,
+				       ETHTOOL_LINK_MODE_100baseT_Full_BIT);
+	MLX5_BUILD_PTYS2ETHTOOL_CONFIG(MLX5E_1000BASE_T, legacy,
+				       ETHTOOL_LINK_MODE_1000baseT_Full_BIT);
 	MLX5_BUILD_PTYS2ETHTOOL_CONFIG(MLX5E_10GBASE_T, legacy,
 				       ETHTOOL_LINK_MODE_10000baseT_Full_BIT);
 	MLX5_BUILD_PTYS2ETHTOOL_CONFIG(MLX5E_25GBASE_CR, legacy,
@@ -201,6 +205,12 @@
 				       ETHTOOL_LINK_MODE_200000baseLR4_ER4_FR4_Full_BIT,
 				       ETHTOOL_LINK_MODE_200000baseDR4_Full_BIT,
 				       ETHTOOL_LINK_MODE_200000baseCR4_Full_BIT);
+	MLX5_BUILD_PTYS2ETHTOOL_CONFIG(MLX5E_400GAUI_8_400GBASE_CR8, ext,
+				       ETHTOOL_LINK_MODE_400000baseKR8_Full_BIT,
+				       ETHTOOL_LINK_MODE_400000baseSR8_Full_BIT,
+				       ETHTOOL_LINK_MODE_400000baseLR8_ER8_FR8_Full_BIT,
+				       ETHTOOL_LINK_MODE_400000baseDR8_Full_BIT,
+				       ETHTOOL_LINK_MODE_400000baseCR8_Full_BIT);
 	MLX5_BUILD_PTYS2ETHTOOL_CONFIG(MLX5E_100GAUI_1_100GBASE_CR_KR, ext,
 				       ETHTOOL_LINK_MODE_100000baseKR_Full_BIT,
 				       ETHTOOL_LINK_MODE_100000baseSR_Full_BIT,
@@ -451,6 +461,23 @@
 
 	mutex_lock(&priv->state_lock);
 
+	/* If RXFH is configured, changing the channels number is allowed only if
+	 * it does not require resizing the RSS table. This is because the previous
+	 * configuration may no longer be compatible with the new RSS table.
+	 */
+	if (netif_is_rxfh_configured(priv->netdev)) {
+		int cur_rqt_size = mlx5e_rqt_size(priv->mdev, cur_params->num_channels);
+		int new_rqt_size = mlx5e_rqt_size(priv->mdev, count);
+
+		if (new_rqt_size != cur_rqt_size) {
+			err = -EINVAL;
+			netdev_err(priv->netdev,
+				   "%s: RXFH is configured, block changing channels number that affects RSS table size (new: %d, current: %d)\n",
+				   __func__, new_rqt_size, cur_rqt_size);
+			goto out;
+		}
+	}
+
 	/* Don't allow changing the number of channels if HTB offload is active,
 	 * because the numeration of the QoS SQs will change, while per-queue
 	 * qdiscs are attached.
@@ -1223,7 +1250,12 @@
 	if (!an_changes && link_modes == eproto.admin)
 		goto out;
 
-	mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext);
+	err = mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext);
+	if (err) {
+		netdev_err(priv->netdev, "%s: failed to set ptys reg: %d\n", __func__, err);
+		goto out;
+	}
+
 	mlx5_toggle_port_link(mdev);
 
 out:
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
@@ -734,7 +734,7 @@
 	if (num_tuples <= 0) {
 		netdev_warn(priv->netdev, "%s: flow is not valid %d\n",
 			    __func__, num_tuples);
-		return num_tuples;
+		return num_tuples < 0 ? num_tuples : -EINVAL;
 	}
 
 	eth_ft = get_flow_table(priv, fs, num_tuples);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -501,8 +501,8 @@
 	return err;
 }
 
-static int mlx5e_create_umr_klm_mkey(struct mlx5_core_dev *mdev,
-				     u64 nentries,
+static int mlx5e_create_umr_ksm_mkey(struct mlx5_core_dev *mdev,
+				     u64 nentries, u8 log_entry_size,
 				     u32 *umr_mkey)
 {
 	int inlen;
@@ -522,12 +522,13 @@
 	MLX5_SET(mkc, mkc, umr_en, 1);
 	MLX5_SET(mkc, mkc, lw, 1);
 	MLX5_SET(mkc, mkc, lr, 1);
-	MLX5_SET(mkc, mkc, access_mode_1_0, MLX5_MKC_ACCESS_MODE_KLMS);
+	MLX5_SET(mkc, mkc, access_mode_1_0, MLX5_MKC_ACCESS_MODE_KSM);
 	mlx5e_mkey_set_relaxed_ordering(mdev, mkc);
 	MLX5_SET(mkc, mkc, qpn, 0xffffff);
 	MLX5_SET(mkc, mkc, pd, mdev->mlx5e_res.hw_objs.pdn);
 	MLX5_SET(mkc, mkc, translations_octword_size, nentries);
-	MLX5_SET(mkc, mkc, length64, 1);
+	MLX5_SET(mkc, mkc, log_page_size, log_entry_size);
+	MLX5_SET64(mkc, mkc, len, nentries << log_entry_size);
 	err = mlx5_core_create_mkey(mdev, umr_mkey, in, inlen);
 
 	kvfree(in);
@@ -562,14 +563,16 @@
 static int mlx5e_create_rq_hd_umr_mkey(struct mlx5_core_dev *mdev,
 				       struct mlx5e_rq *rq)
 {
-	u32 max_klm_size = BIT(MLX5_CAP_GEN(mdev, log_max_klm_list_size));
+	u32 max_ksm_size = BIT(MLX5_CAP_GEN(mdev, log_max_klm_list_size));
 
-	if (max_klm_size < rq->mpwqe.shampo->hd_per_wq) {
-		mlx5_core_err(mdev, "max klm list size 0x%x is smaller than shampo header buffer list size 0x%x\n",
-			      max_klm_size, rq->mpwqe.shampo->hd_per_wq);
+	if (max_ksm_size < rq->mpwqe.shampo->hd_per_wq) {
+		mlx5_core_err(mdev, "max ksm list size 0x%x is smaller than shampo header buffer list size 0x%x\n",
+			      max_ksm_size, rq->mpwqe.shampo->hd_per_wq);
 		return -EINVAL;
 	}
-	return mlx5e_create_umr_klm_mkey(mdev, rq->mpwqe.shampo->hd_per_wq,
+
+	return mlx5e_create_umr_ksm_mkey(mdev, rq->mpwqe.shampo->hd_per_wq,
+					 MLX5E_SHAMPO_LOG_HEADER_ENTRY_SIZE,
 					 &rq->mpwqe.shampo->mkey);
 }
 
@@ -3769,7 +3772,7 @@
 		mlx5e_fold_sw_stats64(priv, stats);
 	}
 
-	stats->rx_dropped = priv->stats.qcnt.rx_out_of_buffer;
+	stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer;
 
 	stats->rx_length_errors =
 		PPORT_802_3_GET(pstats, a_in_range_length_errors) +
@@ -4080,7 +4083,8 @@
 	struct mlx5e_params *params = &priv->channels.params;
 	xdp_features_t val;
 
-	if (params->packet_merge.type != MLX5E_PACKET_MERGE_NONE) {
+	if (!netdev->netdev_ops->ndo_bpf ||
+	    params->packet_merge.type != MLX5E_PACKET_MERGE_NONE) {
 		xdp_clear_features_flag(netdev);
 		return;
 	}
@@ -4717,7 +4721,7 @@
 
 		/* Verify if UDP port is being offloaded by HW */
 		if (mlx5_vxlan_lookup_port(priv->mdev->vxlan, port))
-			return features;
+			return vxlan_features_check(skb, features);
 
 #if IS_ENABLED(CONFIG_GENEVE)
 		/* Support Geneve offload for default UDP port */
@@ -4743,7 +4747,6 @@
 	struct mlx5e_priv *priv = netdev_priv(netdev);
 
 	features = vlan_features_check(skb, features);
-	features = vxlan_features_check(skb, features);
 
 	/* Validate if the tunneled packet is being offloaded by HW */
 	if (skb->encapsulation &&
@@ -5695,15 +5698,18 @@
 	kfree(priv->tx_rates);
 	kfree(priv->txq2sq);
 	destroy_workqueue(priv->wq);
-	mutex_lock(&priv->state_lock);
 	mlx5e_selq_cleanup(&priv->selq);
-	mutex_unlock(&priv->state_lock);
 	free_cpumask_var(priv->scratchpad.cpumask);
 
 	for (i = 0; i < priv->htb_max_qos_sqs; i++)
 		kfree(priv->htb_qos_sq_stats[i]);
 	kvfree(priv->htb_qos_sq_stats);
 
+	if (priv->mqprio_rl) {
+		mlx5e_mqprio_rl_cleanup(priv->mqprio_rl);
+		mlx5e_mqprio_rl_free(priv->mqprio_rl);
+	}
+
 	memset(priv, 0, sizeof(*priv));
 }
 
@@ -6005,14 +6011,14 @@
 	return 0;
 }
 
-static int _mlx5e_suspend(struct auxiliary_device *adev)
+static int _mlx5e_suspend(struct auxiliary_device *adev, bool pre_netdev_reg)
 {
 	struct mlx5e_dev *mlx5e_dev = auxiliary_get_drvdata(adev);
 	struct mlx5e_priv *priv = mlx5e_dev->priv;
 	struct net_device *netdev = priv->netdev;
 	struct mlx5_core_dev *mdev = priv->mdev;
 
-	if (!netif_device_present(netdev)) {
+	if (!pre_netdev_reg && !netif_device_present(netdev)) {
 		if (test_bit(MLX5E_STATE_DESTROYING, &priv->state))
 			mlx5e_destroy_mdev_resources(mdev);
 		return -ENODEV;
@@ -6025,7 +6031,7 @@
 
 static int mlx5e_suspend(struct auxiliary_device *adev, pm_message_t state)
 {
-	return _mlx5e_suspend(adev);
+	return _mlx5e_suspend(adev, false);
 }
 
 static int _mlx5e_probe(struct auxiliary_device *adev)
@@ -6089,7 +6095,7 @@
 	return 0;
 
 err_resume:
-	_mlx5e_suspend(adev);
+	_mlx5e_suspend(adev, true);
 err_profile_cleanup:
 	profile->cleanup(priv);
 err_destroy_netdev:
@@ -6114,9 +6120,22 @@
 
 	mlx5_core_uplink_netdev_set(priv->mdev, NULL);
 	mlx5e_dcbnl_delete_app(priv);
-	unregister_netdev(priv->netdev);
-	_mlx5e_suspend(adev);
-	priv->profile->cleanup(priv);
+	/* When unload driver, the netdev is in registered state
+	 * if it's from legacy mode. If from switchdev mode, it
+	 * is already unregistered before changing to NIC profile.
+	 */
+	if (priv->netdev->reg_state == NETREG_REGISTERED) {
+		unregister_netdev(priv->netdev);
+		_mlx5e_suspend(adev, false);
+	} else {
+		if (test_bit(MLX5E_STATE_DESTROYING, &priv->state))
+			mlx5e_destroy_mdev_resources(priv->mdev);
+		else
+			_mlx5e_suspend(adev, true);
+	}
+	/* Avoid cleanup if profile rollback failed. */
+	if (priv->profile)
+		priv->profile->cleanup(priv);
 	mlx5e_destroy_netdev(priv);
 	mlx5e_devlink_port_unregister(mlx5e_dev);
 	mlx5e_destroy_devlink(mlx5e_dev);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -1469,6 +1469,21 @@
 
 	priv = netdev_priv(netdev);
 
+	/* This bit is set when using devlink to change eswitch mode from
+	 * switchdev to legacy. As need to keep uplink netdev ifindex, we
+	 * detach uplink representor profile and attach NIC profile only.
+	 * The netdev will be unregistered later when unload NIC auxiliary
+	 * driver for this case.
+	 * We explicitly block devlink eswitch mode change if any IPSec rules
+	 * offloaded, but can't block other cases, such as driver unload
+	 * and devlink reload. We have to unregister netdev before profile
+	 * change for those cases. This is to avoid resource leak because
+	 * the offloaded rules don't have the chance to be unoffloaded before
+	 * cleanup which is triggered by detach uplink representor profile.
+	 */
+	if (!(priv->mdev->priv.flags & MLX5_PRIV_FLAGS_SWITCH_LEGACY))
+		unregister_netdev(netdev);
+
 	mlx5e_netdev_attach_nic_profile(priv);
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -619,25 +619,25 @@
 	return min(len, count);
 }
 
-static void build_klm_umr(struct mlx5e_icosq *sq, struct mlx5e_umr_wqe *umr_wqe,
-			  __be32 key, u16 offset, u16 klm_len, u16 wqe_bbs)
+static void build_ksm_umr(struct mlx5e_icosq *sq, struct mlx5e_umr_wqe *umr_wqe,
+			  __be32 key, u16 offset, u16 ksm_len)
 {
-	memset(umr_wqe, 0, offsetof(struct mlx5e_umr_wqe, inline_klms));
+	memset(umr_wqe, 0, offsetof(struct mlx5e_umr_wqe, inline_ksms));
 	umr_wqe->ctrl.opmod_idx_opcode =
 		cpu_to_be32((sq->pc << MLX5_WQE_CTRL_WQE_INDEX_SHIFT) |
 			     MLX5_OPCODE_UMR);
 	umr_wqe->ctrl.umr_mkey = key;
 	umr_wqe->ctrl.qpn_ds = cpu_to_be32((sq->sqn << MLX5_WQE_CTRL_QPN_SHIFT)
-					    | MLX5E_KLM_UMR_DS_CNT(klm_len));
+					    | MLX5E_KSM_UMR_DS_CNT(ksm_len));
 	umr_wqe->uctrl.flags = MLX5_UMR_TRANSLATION_OFFSET_EN | MLX5_UMR_INLINE;
 	umr_wqe->uctrl.xlt_offset = cpu_to_be16(offset);
-	umr_wqe->uctrl.xlt_octowords = cpu_to_be16(klm_len);
+	umr_wqe->uctrl.xlt_octowords = cpu_to_be16(ksm_len);
 	umr_wqe->uctrl.mkey_mask     = cpu_to_be64(MLX5_MKEY_MASK_FREE);
 }
 
 static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq,
 				     struct mlx5e_icosq *sq,
-				     u16 klm_entries, u16 index)
+				     u16 ksm_entries, u16 index)
 {
 	struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo;
 	u16 entries, pi, header_offset, err, wqe_bbs, new_entries;
@@ -650,20 +650,20 @@
 	int headroom, i;
 
 	headroom = rq->buff.headroom;
-	new_entries = klm_entries - (shampo->pi & (MLX5_UMR_KLM_NUM_ENTRIES_ALIGNMENT - 1));
-	entries = ALIGN(klm_entries, MLX5_UMR_KLM_NUM_ENTRIES_ALIGNMENT);
-	wqe_bbs = MLX5E_KLM_UMR_WQEBBS(entries);
+	new_entries = ksm_entries - (shampo->pi & (MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT - 1));
+	entries = ALIGN(ksm_entries, MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT);
+	wqe_bbs = MLX5E_KSM_UMR_WQEBBS(entries);
 	pi = mlx5e_icosq_get_next_pi(sq, wqe_bbs);
 	umr_wqe = mlx5_wq_cyc_get_wqe(&sq->wq, pi);
-	build_klm_umr(sq, umr_wqe, shampo->key, index, entries, wqe_bbs);
+	build_ksm_umr(sq, umr_wqe, shampo->key, index, entries);
 
 	frag_page = &shampo->pages[page_index];
 
 	for (i = 0; i < entries; i++, index++) {
 		dma_info = &shampo->info[index];
-		if (i >= klm_entries || (index < shampo->pi && shampo->pi - index <
-					 MLX5_UMR_KLM_NUM_ENTRIES_ALIGNMENT))
-			goto update_klm;
+		if (i >= ksm_entries || (index < shampo->pi && shampo->pi - index <
+					 MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT))
+			goto update_ksm;
 		header_offset = (index & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1)) <<
 			MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE;
 		if (!(header_offset & (PAGE_SIZE - 1))) {
@@ -683,12 +683,11 @@
 			dma_info->frag_page = frag_page;
 		}
 
-update_klm:
-		umr_wqe->inline_klms[i].bcount =
-			cpu_to_be32(MLX5E_RX_MAX_HEAD);
-		umr_wqe->inline_klms[i].key    = cpu_to_be32(lkey);
-		umr_wqe->inline_klms[i].va     =
-			cpu_to_be64(dma_info->addr + headroom);
+update_ksm:
+		umr_wqe->inline_ksms[i] = (struct mlx5_ksm) {
+			.key = cpu_to_be32(lkey),
+			.va  = cpu_to_be64(dma_info->addr + headroom),
+		};
 	}
 
 	sq->db.wqe_info[pi] = (struct mlx5e_icosq_wqe_info) {
@@ -720,37 +719,38 @@
 static int mlx5e_alloc_rx_hd_mpwqe(struct mlx5e_rq *rq)
 {
 	struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo;
-	u16 klm_entries, num_wqe, index, entries_before;
+	u16 ksm_entries, num_wqe, index, entries_before;
 	struct mlx5e_icosq *sq = rq->icosq;
-	int i, err, max_klm_entries, len;
+	int i, err, max_ksm_entries, len;
 
-	max_klm_entries = MLX5E_MAX_KLM_PER_WQE(rq->mdev);
-	klm_entries = bitmap_find_window(shampo->bitmap,
+	max_ksm_entries = MLX5E_MAX_KSM_PER_WQE(rq->mdev);
+	ksm_entries = bitmap_find_window(shampo->bitmap,
 					 shampo->hd_per_wqe,
 					 shampo->hd_per_wq, shampo->pi);
-	if (!klm_entries)
+	ksm_entries = ALIGN_DOWN(ksm_entries, MLX5E_SHAMPO_WQ_HEADER_PER_PAGE);
+	if (!ksm_entries)
 		return 0;
 
-	klm_entries += (shampo->pi & (MLX5_UMR_KLM_NUM_ENTRIES_ALIGNMENT - 1));
-	index = ALIGN_DOWN(shampo->pi, MLX5_UMR_KLM_NUM_ENTRIES_ALIGNMENT);
+	ksm_entries += (shampo->pi & (MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT - 1));
+	index = ALIGN_DOWN(shampo->pi, MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT);
 	entries_before = shampo->hd_per_wq - index;
 
-	if (unlikely(entries_before < klm_entries))
-		num_wqe = DIV_ROUND_UP(entries_before, max_klm_entries) +
-			  DIV_ROUND_UP(klm_entries - entries_before, max_klm_entries);
+	if (unlikely(entries_before < ksm_entries))
+		num_wqe = DIV_ROUND_UP(entries_before, max_ksm_entries) +
+			  DIV_ROUND_UP(ksm_entries - entries_before, max_ksm_entries);
 	else
-		num_wqe = DIV_ROUND_UP(klm_entries, max_klm_entries);
+		num_wqe = DIV_ROUND_UP(ksm_entries, max_ksm_entries);
 
 	for (i = 0; i < num_wqe; i++) {
-		len = (klm_entries > max_klm_entries) ? max_klm_entries :
-							klm_entries;
+		len = (ksm_entries > max_ksm_entries) ? max_ksm_entries :
+							ksm_entries;
 		if (unlikely(index + len > shampo->hd_per_wq))
 			len = shampo->hd_per_wq - index;
 		err = mlx5e_build_shampo_hd_umr(rq, sq, len, index);
 		if (unlikely(err))
 			return err;
 		index = (index + len) & (rq->mpwqe.shampo->hd_per_wq - 1);
-		klm_entries -= len;
+		ksm_entries -= len;
 	}
 
 	return 0;
@@ -2369,11 +2369,15 @@
 	if (flush)
 		mlx5e_shampo_flush_skb(rq, cqe, match);
 free_hd_entry:
-	mlx5e_free_rx_shampo_hd_entry(rq, header_index);
+	if (likely(head_size))
+		mlx5e_free_rx_shampo_hd_entry(rq, header_index);
 mpwrq_cqe_out:
 	if (likely(wi->consumed_strides < rq->mpwqe.num_strides))
 		return;
 
+	if (unlikely(!cstrides))
+		return;
+
 	wq  = &rq->mpwqe.wq;
 	wqe = mlx5_wq_ll_get_wqe(wq, wqe_id);
 	mlx5_wq_ll_pop(wq, cqe->wqe_id, &wqe->next.next_wqe_index);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -153,7 +153,11 @@
 
 	*hopbyhop = 0;
 	if (skb->encapsulation) {
-		ihs = skb_inner_tcp_all_headers(skb);
+		if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4)
+			ihs = skb_inner_transport_offset(skb) +
+			      sizeof(struct udphdr);
+		else
+			ihs = skb_inner_tcp_all_headers(skb);
 		stats->tso_inner_packets++;
 		stats->tso_inner_bytes += skb->len - ihs;
 	} else {
@@ -398,6 +402,8 @@
 		     (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP))) {
 		u8 metadata_index = be32_to_cpu(eseg->flow_table_metadata);
 
+		mlx5e_ptp_metadata_fifo_pop(&sq->ptpsq->metadata_freelist);
+
 		mlx5e_skb_cb_hwtstamp_init(skb);
 		mlx5e_ptp_metadata_map_put(&sq->ptpsq->metadata_map, skb,
 					   metadata_index);
@@ -496,9 +502,6 @@
 
 err_drop:
 	stats->dropped++;
-	if (unlikely(sq->ptpsq && (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)))
-		mlx5e_ptp_metadata_fifo_push(&sq->ptpsq->metadata_freelist,
-					     be32_to_cpu(eseg->flow_table_metadata));
 	dev_kfree_skb_any(skb);
 	mlx5e_tx_flush(sq);
 }
@@ -639,7 +642,6 @@
 	return;
 
 err_unmap:
-	mlx5e_dma_unmap_wqe_err(sq, 1);
 	sq->stats->dropped++;
 	dev_kfree_skb_any(skb);
 	mlx5e_tx_flush(sq);
@@ -657,7 +659,7 @@
 {
 	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP))
 		eseg->flow_table_metadata =
-			cpu_to_be32(mlx5e_ptp_metadata_fifo_pop(&ptpsq->metadata_freelist));
+			cpu_to_be32(mlx5e_ptp_metadata_fifo_peek(&ptpsq->metadata_freelist));
 }
 
 static void mlx5e_txwqe_build_eseg(struct mlx5e_priv *priv, struct mlx5e_txqsq *sq,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -1073,6 +1073,12 @@
 	struct mlx5_eq_comp *eq;
 	int ret = 0;
 
+	if (vecidx >= table->max_comp_eqs) {
+		mlx5_core_dbg(dev, "Requested vector index %u should be less than %u",
+			      vecidx, table->max_comp_eqs);
+		return -EINVAL;
+	}
+
 	mutex_lock(&table->comp_lock);
 	eq = xa_load(&table->comp_eqs, vecidx);
 	if (eq) {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c
@@ -6,6 +6,9 @@
 #include "helper.h"
 #include "ofld.h"
 
+static int
+acl_ingress_ofld_setup(struct mlx5_eswitch *esw, struct mlx5_vport *vport);
+
 static bool
 esw_acl_ingress_prio_tag_enabled(struct mlx5_eswitch *esw,
 				 const struct mlx5_vport *vport)
@@ -123,18 +126,31 @@
 {
 	struct mlx5_flow_act flow_act = {};
 	struct mlx5_flow_handle *flow_rule;
+	bool created = false;
 	int err = 0;
 
+	if (!vport->ingress.acl) {
+		err = acl_ingress_ofld_setup(esw, vport);
+		if (err)
+			return err;
+		created = true;
+	}
+
 	flow_act.action = MLX5_FLOW_CONTEXT_ACTION_DROP;
 	flow_act.fg = vport->ingress.offloads.drop_grp;
 	flow_rule = mlx5_add_flow_rules(vport->ingress.acl, NULL, &flow_act, NULL, 0);
 	if (IS_ERR(flow_rule)) {
 		err = PTR_ERR(flow_rule);
-		goto out;
+		goto err_out;
 	}
 
 	vport->ingress.offloads.drop_rule = flow_rule;
-out:
+
+	return 0;
+err_out:
+	/* Only destroy ingress acl created in this function. */
+	if (created)
+		esw_acl_ingress_ofld_cleanup(esw, vport);
 	return err;
 }
 
@@ -299,16 +315,12 @@
 	}
 }
 
-int esw_acl_ingress_ofld_setup(struct mlx5_eswitch *esw,
-			       struct mlx5_vport *vport)
+static int
+acl_ingress_ofld_setup(struct mlx5_eswitch *esw, struct mlx5_vport *vport)
 {
 	int num_ftes = 0;
 	int err;
 
-	if (!mlx5_eswitch_vport_match_metadata_enabled(esw) &&
-	    !esw_acl_ingress_prio_tag_enabled(esw, vport))
-		return 0;
-
 	esw_acl_ingress_allow_rule_destroy(vport);
 
 	if (mlx5_eswitch_vport_match_metadata_enabled(esw))
@@ -347,6 +359,15 @@
 	return err;
 }
 
+int esw_acl_ingress_ofld_setup(struct mlx5_eswitch *esw, struct mlx5_vport *vport)
+{
+	if (!mlx5_eswitch_vport_match_metadata_enabled(esw) &&
+	    !esw_acl_ingress_prio_tag_enabled(esw, vport))
+		return 0;
+
+	return acl_ingress_ofld_setup(esw, vport);
+}
+
 void esw_acl_ingress_ofld_cleanup(struct mlx5_eswitch *esw,
 				  struct mlx5_vport *vport)
 {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
@@ -1874,7 +1874,7 @@
 				 "Failed to lookup bridge port vlan metadata to create MDB (MAC=%pM,vid=%u,vport=%u)\n",
 				 addr, vid, vport_num);
 			NL_SET_ERR_MSG_FMT_MOD(extack,
-					       "Failed to lookup bridge port vlan metadata to create MDB (MAC=%pM,vid=%u,vport=%u)\n",
+					       "Failed to lookup vlan metadata for MDB (MAC=%pM,vid=%u,vport=%u)\n",
 					       addr, vid, vport_num);
 			return -EINVAL;
 		}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c
@@ -150,11 +150,11 @@
 	unsigned long i;
 	int err;
 
-	xa_for_each(&esw->offloads.vport_reps, i, rep) {
-		rpriv = rep->rep_data[REP_ETH].priv;
-		if (!rpriv || !rpriv->netdev)
+	mlx5_esw_for_each_rep(esw, i, rep) {
+		if (atomic_read(&rep->rep_data[REP_ETH].state) != REP_LOADED)
 			continue;
 
+		rpriv = rep->rep_data[REP_ETH].priv;
 		rhashtable_walk_enter(&rpriv->tc_ht, &iter);
 		rhashtable_walk_start(&iter);
 		while ((flow = rhashtable_walk_next(&iter)) != NULL) {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c
@@ -319,7 +319,7 @@
 		return -EPERM;
 
 	mutex_lock(&esw->state_lock);
-	if (esw->mode != MLX5_ESWITCH_LEGACY) {
+	if (esw->mode != MLX5_ESWITCH_LEGACY || !mlx5_esw_is_fdb_created(esw)) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
@@ -339,7 +339,7 @@
 	if (!mlx5_esw_allowed(esw))
 		return -EPERM;
 
-	if (esw->mode != MLX5_ESWITCH_LEGACY)
+	if (esw->mode != MLX5_ESWITCH_LEGACY || !mlx5_esw_is_fdb_created(esw))
 		return -EOPNOTSUPP;
 
 	*setting = esw->fdb_table.legacy.vepa_uplink_rule ? 1 : 0;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c
@@ -312,6 +312,25 @@
 	return err;
 }
 
+static bool esw_qos_element_type_supported(struct mlx5_core_dev *dev, int type)
+{
+	switch (type) {
+	case SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR:
+		return MLX5_CAP_QOS(dev, esw_element_type) &
+		       ELEMENT_TYPE_CAP_MASK_TSAR;
+	case SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT:
+		return MLX5_CAP_QOS(dev, esw_element_type) &
+		       ELEMENT_TYPE_CAP_MASK_VPORT;
+	case SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT_TC:
+		return MLX5_CAP_QOS(dev, esw_element_type) &
+		       ELEMENT_TYPE_CAP_MASK_VPORT_TC;
+	case SCHEDULING_CONTEXT_ELEMENT_TYPE_PARA_VPORT_TC:
+		return MLX5_CAP_QOS(dev, esw_element_type) &
+		       ELEMENT_TYPE_CAP_MASK_PARA_VPORT_TC;
+	}
+	return false;
+}
+
 static int esw_qos_vport_create_sched_element(struct mlx5_eswitch *esw,
 					      struct mlx5_vport *vport,
 					      u32 max_rate, u32 bw_share)
@@ -323,6 +342,9 @@
 	void *vport_elem;
 	int err;
 
+	if (!esw_qos_element_type_supported(dev, SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT))
+		return -EOPNOTSUPP;
+
 	parent_tsar_ix = group ? group->tsar_ix : esw->qos.root_tsar_ix;
 	MLX5_SET(scheduling_context, sched_ctx, element_type,
 		 SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT);
@@ -421,6 +443,7 @@
 {
 	u32 tsar_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {};
 	struct mlx5_esw_rate_group *group;
+	__be32 *attr;
 	u32 divider;
 	int err;
 
@@ -428,6 +451,12 @@
 	if (!group)
 		return ERR_PTR(-ENOMEM);
 
+	MLX5_SET(scheduling_context, tsar_ctx, element_type,
+		 SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR);
+
+	attr = MLX5_ADDR_OF(scheduling_context, tsar_ctx, element_attributes);
+	*attr = cpu_to_be32(TSAR_ELEMENT_TSAR_TYPE_DWRR << 16);
+
 	MLX5_SET(scheduling_context, tsar_ctx, parent_element_id,
 		 esw->qos.root_tsar_ix);
 	err = mlx5_create_scheduling_element_cmd(esw->dev,
@@ -526,25 +555,6 @@
 	return err;
 }
 
-static bool esw_qos_element_type_supported(struct mlx5_core_dev *dev, int type)
-{
-	switch (type) {
-	case SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR:
-		return MLX5_CAP_QOS(dev, esw_element_type) &
-		       ELEMENT_TYPE_CAP_MASK_TASR;
-	case SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT:
-		return MLX5_CAP_QOS(dev, esw_element_type) &
-		       ELEMENT_TYPE_CAP_MASK_VPORT;
-	case SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT_TC:
-		return MLX5_CAP_QOS(dev, esw_element_type) &
-		       ELEMENT_TYPE_CAP_MASK_VPORT_TC;
-	case SCHEDULING_CONTEXT_ELEMENT_TYPE_PARA_VPORT_TC:
-		return MLX5_CAP_QOS(dev, esw_element_type) &
-		       ELEMENT_TYPE_CAP_MASK_PARA_VPORT_TC;
-	}
-	return false;
-}
-
 static int esw_qos_create(struct mlx5_eswitch *esw, struct netlink_ext_ack *extack)
 {
 	u32 tsar_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {};
@@ -555,7 +565,8 @@
 	if (!MLX5_CAP_GEN(dev, qos) || !MLX5_CAP_QOS(dev, esw_scheduling))
 		return -EOPNOTSUPP;
 
-	if (!esw_qos_element_type_supported(dev, SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR))
+	if (!esw_qos_element_type_supported(dev, SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR) ||
+	    !(MLX5_CAP_QOS(dev, esw_tsar_type) & TSAR_TYPE_CAP_MASK_DWRR))
 		return -EOPNOTSUPP;
 
 	MLX5_SET(scheduling_context, tsar_ctx, element_type,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1489,7 +1489,7 @@
 	}
 
 	if (err)
-		goto abort;
+		goto err_esw_enable;
 
 	esw->fdb_table.flags |= MLX5_ESW_FDB_CREATED;
 
@@ -1503,7 +1503,8 @@
 
 	return 0;
 
-abort:
+err_esw_enable:
+	mlx5_eq_notifier_unregister(esw->dev, &esw->nb);
 	mlx5_esw_acls_ns_cleanup(esw);
 	return err;
 }
@@ -1868,6 +1869,7 @@
 	if (err)
 		goto abort;
 
+	dev->priv.eswitch = esw;
 	err = esw_offloads_init(esw);
 	if (err)
 		goto reps_err;
@@ -1892,11 +1894,6 @@
 		esw->offloads.encap = DEVLINK_ESWITCH_ENCAP_MODE_BASIC;
 	else
 		esw->offloads.encap = DEVLINK_ESWITCH_ENCAP_MODE_NONE;
-	if (MLX5_ESWITCH_MANAGER(dev) &&
-	    mlx5_esw_vport_match_metadata_supported(esw))
-		esw->flags |= MLX5_ESWITCH_VPORT_MATCH_METADATA;
-
-	dev->priv.eswitch = esw;
 	BLOCKING_INIT_NOTIFIER_HEAD(&esw->n_head);
 
 	esw_info(dev,
@@ -1908,6 +1905,7 @@
 
 reps_err:
 	mlx5_esw_vports_cleanup(esw);
+	dev->priv.eswitch = NULL;
 abort:
 	if (esw->work_queue)
 		destroy_workqueue(esw->work_queue);
@@ -1926,7 +1924,6 @@
 
 	esw_info(esw->dev, "cleanup\n");
 
-	esw->dev->priv.eswitch = NULL;
 	destroy_workqueue(esw->work_queue);
 	WARN_ON(refcount_read(&esw->qos.refcnt));
 	mutex_destroy(&esw->state_lock);
@@ -1937,6 +1934,7 @@
 	mutex_destroy(&esw->offloads.encap_tbl_lock);
 	mutex_destroy(&esw->offloads.decap_tbl_lock);
 	esw_offloads_cleanup(esw);
+	esw->dev->priv.eswitch = NULL;
 	mlx5_esw_vports_cleanup(esw);
 	debugfs_remove_recursive(esw->debugfs_root);
 	devl_params_unregister(priv_to_devlink(esw->dev), mlx5_eswitch_params,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -706,6 +706,9 @@
 			  MLX5_CAP_GEN_2((esw->dev), ec_vf_vport_base) +\
 			  (last) - 1)
 
+#define mlx5_esw_for_each_rep(esw, i, rep) \
+	xa_for_each(&((esw)->offloads.vport_reps), i, rep)
+
 struct mlx5_eswitch *__must_check
 mlx5_devlink_eswitch_get(struct devlink *devlink);
 
@@ -833,7 +836,7 @@
 					     struct mlx5_eswitch *slave_esw, int max_slaves);
 void mlx5_eswitch_offloads_single_fdb_del_one(struct mlx5_eswitch *master_esw,
 					      struct mlx5_eswitch *slave_esw);
-int mlx5_eswitch_reload_reps(struct mlx5_eswitch *esw);
+int mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw);
 
 bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev);
 void mlx5_eswitch_unblock_encap(struct mlx5_core_dev *dev);
@@ -925,7 +928,7 @@
 static inline int mlx5_eswitch_get_npeers(struct mlx5_eswitch *esw) { return 0; }
 
 static inline int
-mlx5_eswitch_reload_reps(struct mlx5_eswitch *esw)
+mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw)
 {
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -52,9 +52,6 @@
 #include "lag/lag.h"
 #include "en/tc/post_meter.h"
 
-#define mlx5_esw_for_each_rep(esw, i, rep) \
-	xa_for_each(&((esw)->offloads.vport_reps), i, rep)
-
 /* There are two match-all miss flows, one for unicast dst mac and
  * one for multicast.
  */
@@ -2476,6 +2473,10 @@
 	if (err)
 		return err;
 
+	if (MLX5_ESWITCH_MANAGER(esw->dev) &&
+	    mlx5_esw_vport_match_metadata_supported(esw))
+		esw->flags |= MLX5_ESWITCH_VPORT_MATCH_METADATA;
+
 	err = devl_params_register(priv_to_devlink(esw->dev),
 				   esw_devlink_params,
 				   ARRAY_SIZE(esw_devlink_params));
@@ -2497,6 +2498,16 @@
 	esw_offloads_cleanup_reps(esw);
 }
 
+static int __esw_offloads_load_rep(struct mlx5_eswitch *esw,
+				   struct mlx5_eswitch_rep *rep, u8 rep_type)
+{
+	if (atomic_cmpxchg(&rep->rep_data[rep_type].state,
+			   REP_REGISTERED, REP_LOADED) == REP_REGISTERED)
+		return esw->offloads.rep_ops[rep_type]->load(esw->dev, rep);
+
+	return 0;
+}
+
 static void __esw_offloads_unload_rep(struct mlx5_eswitch *esw,
 				      struct mlx5_eswitch_rep *rep, u8 rep_type)
 {
@@ -2521,13 +2532,11 @@
 	int err;
 
 	rep = mlx5_eswitch_get_rep(esw, vport_num);
-	for (rep_type = 0; rep_type < NUM_REP_TYPES; rep_type++)
-		if (atomic_cmpxchg(&rep->rep_data[rep_type].state,
-				   REP_REGISTERED, REP_LOADED) == REP_REGISTERED) {
-			err = esw->offloads.rep_ops[rep_type]->load(esw->dev, rep);
-			if (err)
-				goto err_reps;
-		}
+	for (rep_type = 0; rep_type < NUM_REP_TYPES; rep_type++) {
+		err = __esw_offloads_load_rep(esw, rep, rep_type);
+		if (err)
+			goto err_reps;
+	}
 
 	return 0;
 
@@ -3272,7 +3281,7 @@
 		esw_vport_destroy_offloads_acl_tables(esw, vport);
 }
 
-int mlx5_eswitch_reload_reps(struct mlx5_eswitch *esw)
+int mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw)
 {
 	struct mlx5_eswitch_rep *rep;
 	unsigned long i;
@@ -3285,13 +3294,13 @@
 	if (atomic_read(&rep->rep_data[REP_ETH].state) != REP_LOADED)
 		return 0;
 
-	ret = mlx5_esw_offloads_rep_load(esw, MLX5_VPORT_UPLINK);
+	ret = __esw_offloads_load_rep(esw, rep, REP_IB);
 	if (ret)
 		return ret;
 
 	mlx5_esw_for_each_rep(esw, i, rep) {
 		if (atomic_read(&rep->rep_data[REP_ETH].state) == REP_LOADED)
-			mlx5_esw_offloads_rep_load(esw, rep->vport);
+			__esw_offloads_load_rep(esw, rep, REP_IB);
 	}
 
 	return 0;
@@ -3729,6 +3738,8 @@
 	esw->eswitch_operation_in_progress = true;
 	up_write(&esw->mode_lock);
 
+	if (mode == DEVLINK_ESWITCH_MODE_LEGACY)
+		esw->dev->priv.flags |= MLX5_PRIV_FLAGS_SWITCH_LEGACY;
 	mlx5_eswitch_disable_locked(esw);
 	if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV) {
 		if (mlx5_devlink_trap_get_num_active(esw->dev)) {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1664,6 +1664,16 @@
 	return err;
 }
 
+static bool mlx5_pkt_reformat_cmp(struct mlx5_pkt_reformat *p1,
+				  struct mlx5_pkt_reformat *p2)
+{
+	return p1->owner == p2->owner &&
+		(p1->owner == MLX5_FLOW_RESOURCE_OWNER_FW ?
+		 p1->id == p2->id :
+		 mlx5_fs_dr_action_get_pkt_reformat_id(p1) ==
+		 mlx5_fs_dr_action_get_pkt_reformat_id(p2));
+}
+
 static bool mlx5_flow_dests_cmp(struct mlx5_flow_destination *d1,
 				struct mlx5_flow_destination *d2)
 {
@@ -1675,8 +1685,8 @@
 		     ((d1->vport.flags & MLX5_FLOW_DEST_VPORT_VHCA_ID) ?
 		      (d1->vport.vhca_id == d2->vport.vhca_id) : true) &&
 		     ((d1->vport.flags & MLX5_FLOW_DEST_VPORT_REFORMAT_ID) ?
-		      (d1->vport.pkt_reformat->id ==
-		       d2->vport.pkt_reformat->id) : true)) ||
+		      mlx5_pkt_reformat_cmp(d1->vport.pkt_reformat,
+					    d2->vport.pkt_reformat) : true)) ||
 		    (d1->type == MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE &&
 		     d1->ft == d2->ft) ||
 		    (d1->type == MLX5_FLOW_DESTINATION_TYPE_TIR &&
@@ -1808,8 +1818,9 @@
 	}
 	trace_mlx5_fs_set_fte(fte, false);
 
+	/* Link newly added rules into the tree. */
 	for (i = 0; i < handle->num_rules; i++) {
-		if (refcount_read(&handle->rule[i]->node.refcount) == 1) {
+		if (!handle->rule[i]->node.parent) {
 			tree_add_node(&handle->rule[i]->node, &fte->node);
 			trace_mlx5_fs_add_rule(handle->rule[i]);
 		}
@@ -1935,13 +1946,22 @@
 		fte_tmp = NULL;
 		goto out;
 	}
+
+	nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
+
 	if (!fte_tmp->node.active) {
+		up_write_ref_node(&fte_tmp->node, false);
+
+		if (take_write)
+			up_write_ref_node(&g->node, false);
+		else
+			up_read_ref_node(&g->node);
+
 		tree_put_node(&fte_tmp->node, false);
-		fte_tmp = NULL;
-		goto out;
+
+		return NULL;
 	}
 
-	nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
 out:
 	if (take_write)
 		up_write_ref_node(&g->node, false);
@@ -2470,6 +2490,7 @@
 		break;
 	case MLX5_FLOW_NAMESPACE_RDMA_TX:
 		root_ns = steering->rdma_tx_root_ns;
+		prio = RDMA_TX_BYPASS_PRIO;
 		break;
 	case MLX5_FLOW_NAMESPACE_RDMA_RX_COUNTERS:
 		root_ns = steering->rdma_rx_root_ns;
@@ -3458,6 +3479,7 @@
 int mlx5_fs_core_alloc(struct mlx5_core_dev *dev)
 {
 	struct mlx5_flow_steering *steering;
+	char name[80];
 	int err = 0;
 
 	err = mlx5_init_fc_stats(dev);
@@ -3482,10 +3504,12 @@
 	else
 		steering->mode = MLX5_FLOW_STEERING_MODE_DMFS;
 
-	steering->fgs_cache = kmem_cache_create("mlx5_fs_fgs",
+	snprintf(name, sizeof(name), "%s-mlx5_fs_fgs", dev_name(dev->device));
+	steering->fgs_cache = kmem_cache_create(name,
 						sizeof(struct mlx5_flow_group), 0,
 						0, NULL);
-	steering->ftes_cache = kmem_cache_create("mlx5_fs_ftes", sizeof(struct fs_fte), 0,
+	snprintf(name, sizeof(name), "%s-mlx5_fs_ftes", dev_name(dev->device));
+	steering->ftes_cache = kmem_cache_create(name, sizeof(struct fs_fte), 0,
 						 0, NULL);
 	if (!steering->ftes_cache || !steering->fgs_cache) {
 		err = -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/fw.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/fw.c
@@ -373,6 +373,10 @@
 	do {
 		if (mlx5_get_nic_state(dev) == MLX5_NIC_IFC_DISABLED)
 			break;
+		if (pci_channel_offline(dev->pdev)) {
+			mlx5_core_err(dev, "PCI channel offline, stop waiting for NIC IFC\n");
+			return -EACCES;
+		}
 
 		cond_resched();
 	} while (!time_after(jiffies, end));
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
@@ -206,6 +206,7 @@
 static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev, bool unloaded)
 {
 	struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset;
+	struct devlink *devlink = priv_to_devlink(dev);
 
 	/* if this is the driver that initiated the fw reset, devlink completed the reload */
 	if (test_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, &fw_reset->reset_flags)) {
@@ -217,9 +218,11 @@
 			mlx5_core_err(dev, "reset reload flow aborted, PCI reads still not working\n");
 		else
 			mlx5_load_one(dev, true);
-		devlink_remote_reload_actions_performed(priv_to_devlink(dev), 0,
+		devl_lock(devlink);
+		devlink_remote_reload_actions_performed(devlink, 0,
 							BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT) |
 							BIT(DEVLINK_RELOAD_ACTION_FW_ACTIVATE));
+		devl_unlock(devlink);
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -248,6 +248,10 @@
 	do {
 		if (mlx5_get_nic_state(dev) == MLX5_NIC_IFC_DISABLED)
 			break;
+		if (pci_channel_offline(dev->pdev)) {
+			mlx5_core_err(dev, "PCI channel offline, stop waiting for NIC IFC\n");
+			goto unlock;
+		}
 
 		msleep(20);
 	} while (!time_after(jiffies, end));
@@ -317,6 +321,10 @@
 			mlx5_core_warn(dev, "device is being removed, stop waiting for PCI\n");
 			return -ENODEV;
 		}
+		if (pci_channel_offline(dev->pdev)) {
+			mlx5_core_err(dev, "PCI channel offline, stop waiting for PCI\n");
+			return -EACCES;
+		}
 		msleep(100);
 	}
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c
@@ -48,6 +48,7 @@
 irq_pool_request_irq(struct mlx5_irq_pool *pool, struct irq_affinity_desc *af_desc)
 {
 	struct irq_affinity_desc auto_desc = {};
+	struct mlx5_irq *irq;
 	u32 irq_index;
 	int err;
 
@@ -64,9 +65,12 @@
 		else
 			cpu_get(pool, cpumask_first(&af_desc->mask));
 	}
-	return mlx5_irq_alloc(pool, irq_index,
-			      cpumask_empty(&auto_desc.mask) ? af_desc : &auto_desc,
-			      NULL);
+	irq = mlx5_irq_alloc(pool, irq_index,
+			     cpumask_empty(&auto_desc.mask) ? af_desc : &auto_desc,
+			     NULL);
+	if (IS_ERR(irq))
+		xa_erase(&pool->irqs, irq_index);
+	return irq;
 }
 
 /* Looking for the IRQ with the smallest refcount that fits req_mask.
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
@@ -703,8 +703,10 @@
 		return err;
 	}
 
-	if (test_bit(MLX5_LAG_MODE_FLAG_HASH_BASED, &flags))
+	if (test_bit(MLX5_LAG_MODE_FLAG_HASH_BASED, &flags)) {
 		mlx5_lag_port_sel_destroy(ldev);
+		ldev->buckets = 1;
+	}
 	if (mlx5_lag_has_drop_rule(ldev))
 		mlx5_lag_drop_rule_cleanup(ldev);
 
@@ -718,6 +720,7 @@
 	struct mlx5_core_dev *dev;
 	u8 mode;
 #endif
+	bool roce_support;
 	int i;
 
 	for (i = 0; i < ldev->ports; i++)
@@ -744,6 +747,11 @@
 		if (mlx5_sriov_is_enabled(ldev->pf[i].dev))
 			return false;
 #endif
+	roce_support = mlx5_get_roce_state(ldev->pf[MLX5_LAG_P1].dev);
+	for (i = 1; i < ldev->ports; i++)
+		if (mlx5_get_roce_state(ldev->pf[i].dev) != roce_support)
+			return false;
+
 	return true;
 }
 
@@ -812,7 +820,7 @@
 	if (shared_fdb)
 		for (i = 0; i < ldev->ports; i++)
 			if (!(ldev->pf[i].dev->priv.flags & MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV))
-				mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch);
+				mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch);
 }
 
 static bool mlx5_shared_fdb_supported(struct mlx5_lag *ldev)
@@ -911,8 +919,10 @@
 		} else if (roce_lag) {
 			dev0->priv.flags &= ~MLX5_PRIV_FLAGS_DISABLE_IB_ADEV;
 			mlx5_rescan_drivers_locked(dev0);
-			for (i = 1; i < ldev->ports; i++)
-				mlx5_nic_vport_enable_roce(ldev->pf[i].dev);
+			for (i = 1; i < ldev->ports; i++) {
+				if (mlx5_get_roce_state(ldev->pf[i].dev))
+					mlx5_nic_vport_enable_roce(ldev->pf[i].dev);
+			}
 		} else if (shared_fdb) {
 			int i;
 
@@ -920,7 +930,7 @@
 			mlx5_rescan_drivers_locked(dev0);
 
 			for (i = 0; i < ldev->ports; i++) {
-				err = mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch);
+				err = mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch);
 				if (err)
 					break;
 			}
@@ -931,7 +941,7 @@
 				mlx5_deactivate_lag(ldev);
 				mlx5_lag_add_devices(ldev);
 				for (i = 0; i < ldev->ports; i++)
-					mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch);
+					mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch);
 				mlx5_core_err(dev0, "Failed to enable lag\n");
 				return;
 			}
@@ -1531,7 +1541,7 @@
 		goto unlock;
 
 	for (i = 0; i < ldev->ports; i++) {
-		if (ldev->pf[MLX5_LAG_P1].netdev == slave) {
+		if (ldev->pf[i].netdev == slave) {
 			port = i;
 			break;
 		}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c
@@ -99,7 +99,7 @@
 	dev0->priv.flags &= ~MLX5_PRIV_FLAGS_DISABLE_IB_ADEV;
 	mlx5_rescan_drivers_locked(dev0);
 	for (i = 0; i < ldev->ports; i++) {
-		err = mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch);
+		err = mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch);
 		if (err)
 			goto err_rescan_drivers;
 	}
@@ -113,7 +113,7 @@
 err_add_devices:
 	mlx5_lag_add_devices(ldev);
 	for (i = 0; i < ldev->ports; i++)
-		mlx5_eswitch_reload_reps(ldev->pf[i].dev->priv.eswitch);
+		mlx5_eswitch_reload_ib_reps(ldev->pf[i].dev->priv.eswitch);
 	mlx5_mpesw_metadata_cleanup(ldev);
 	return err;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/lag/port_sel.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/lag/port_sel.c
@@ -88,9 +88,13 @@
 								      &dest, 1);
 			if (IS_ERR(lag_definer->rules[idx])) {
 				err = PTR_ERR(lag_definer->rules[idx]);
-				while (i--)
-					while (j--)
+				do {
+					while (j--) {
+						idx = i * ldev->buckets + j;
 						mlx5_del_flow_rules(lag_definer->rules[idx]);
+					}
+					j = ldev->buckets;
+				} while (i--);
 				goto destroy_fg;
 			}
 		}
@@ -530,7 +534,7 @@
 	set_tt_map(port_sel, hash_type);
 	err = mlx5_lag_create_definers(ldev, hash_type, ports);
 	if (err)
-		return err;
+		goto clear_port_sel;
 
 	if (port_sel->tunnel) {
 		err = mlx5_lag_create_inner_ttc_table(ldev);
@@ -549,6 +553,8 @@
 		mlx5_destroy_ttc_table(port_sel->inner.ttc);
 destroy_definers:
 	mlx5_lag_destroy_definers(ldev);
+clear_port_sel:
+	memset(port_sel, 0, sizeof(*port_sel));
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/lib/ipsec_fs_roce.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/lib/ipsec_fs_roce.c
@@ -386,7 +386,8 @@
 		return -EOPNOTSUPP;
 
 	peer_priv = mlx5_devcom_get_next_peer_data(*ipsec_roce->devcom, &tmp);
-	if (!peer_priv) {
+	if (!peer_priv || !peer_priv->ipsec) {
+		mlx5_core_err(mdev, "IPsec not supported on master device\n");
 		err = -EOPNOTSUPP;
 		goto release_peer;
 	}
@@ -455,7 +456,8 @@
 		return -EOPNOTSUPP;
 
 	peer_priv = mlx5_devcom_get_next_peer_data(*ipsec_roce->devcom, &tmp);
-	if (!peer_priv) {
+	if (!peer_priv || !peer_priv->ipsec) {
+		mlx5_core_err(mdev, "IPsec not supported on master device\n");
 		err = -EOPNOTSUPP;
 		goto release_peer;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c
@@ -24,6 +24,11 @@
 	pci_write_config_dword((dev)->pdev, (dev)->vsc_addr + (offset), (val))
 #define VSC_MAX_RETRIES 2048
 
+/* Reading VSC registers can take relatively long time.
+ * Yield the cpu every 128 registers read.
+ */
+#define VSC_GW_READ_BLOCK_COUNT 128
+
 enum {
 	VSC_CTRL_OFFSET = 0x4,
 	VSC_COUNTER_OFFSET = 0x8,
@@ -74,6 +79,10 @@
 			ret = -EBUSY;
 			goto pci_unlock;
 		}
+		if (pci_channel_offline(dev->pdev)) {
+			ret = -EACCES;
+			goto pci_unlock;
+		}
 
 		/* Check if semaphore is already locked */
 		ret = vsc_read(dev, VSC_SEMAPHORE_OFFSET, &lock_val);
@@ -269,6 +278,7 @@
 {
 	unsigned int next_read_addr = 0;
 	unsigned int read_addr = 0;
+	unsigned int count = 0;
 
 	while (read_addr < length) {
 		if (mlx5_vsc_gw_read_fast(dev, read_addr, &next_read_addr,
@@ -276,6 +286,10 @@
 			return read_addr;
 
 		read_addr = next_read_addr;
+		if (++count == VSC_GW_READ_BLOCK_COUNT) {
+			cond_resched();
+			count = 0;
+		}
 	}
 	return length;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1298,6 +1298,9 @@
 
 	if (!err)
 		mlx5_function_disable(dev, boot);
+	else
+		mlx5_stop_health_poll(dev, boot);
+
 	return err;
 }
 
@@ -1480,6 +1483,14 @@
 	if (err)
 		goto err_register;
 
+	err = mlx5_crdump_enable(dev);
+	if (err)
+		mlx5_core_err(dev, "mlx5_crdump_enable failed with error code %d\n", err);
+
+	err = mlx5_hwmon_dev_register(dev);
+	if (err)
+		mlx5_core_err(dev, "mlx5_hwmon_dev_register failed with error code %d\n", err);
+
 	mutex_unlock(&dev->intf_state_mutex);
 	return 0;
 
@@ -1505,7 +1516,10 @@
 	int err;
 
 	devl_lock(devlink);
+	devl_register(devlink);
 	err = mlx5_init_one_devl_locked(dev);
+	if (err)
+		devl_unregister(devlink);
 	devl_unlock(devlink);
 	return err;
 }
@@ -1517,6 +1531,8 @@
 	devl_lock(devlink);
 	mutex_lock(&dev->intf_state_mutex);
 
+	mlx5_hwmon_dev_unregister(dev);
+	mlx5_crdump_disable(dev);
 	mlx5_unregister_device(dev);
 
 	if (!test_bit(MLX5_INTERFACE_STATE_UP, &dev->intf_state)) {
@@ -1534,6 +1550,7 @@
 	mlx5_function_teardown(dev, true);
 out:
 	mutex_unlock(&dev->intf_state_mutex);
+	devl_unregister(devlink);
 	devl_unlock(devlink);
 }
 
@@ -1666,6 +1683,8 @@
 	struct devlink *devlink = priv_to_devlink(dev);
 	int err;
 
+	devl_lock(devlink);
+	devl_register(devlink);
 	dev->state = MLX5_DEVICE_STATE_UP;
 	err = mlx5_function_enable(dev, true, mlx5_tout_ms(dev, FW_PRE_INIT_TIMEOUT));
 	if (err) {
@@ -1679,20 +1698,21 @@
 		goto query_hca_caps_err;
 	}
 
-	devl_lock(devlink);
 	err = mlx5_devlink_params_register(priv_to_devlink(dev));
-	devl_unlock(devlink);
 	if (err) {
 		mlx5_core_warn(dev, "mlx5_devlink_param_reg err = %d\n", err);
 		goto query_hca_caps_err;
 	}
 
+	devl_unlock(devlink);
 	return 0;
 
 query_hca_caps_err:
 	mlx5_function_disable(dev, true);
 out:
 	dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
+	devl_unregister(devlink);
+	devl_unlock(devlink);
 	return err;
 }
 
@@ -1702,6 +1722,7 @@
 
 	devl_lock(devlink);
 	mlx5_devlink_params_unregister(priv_to_devlink(dev));
+	devl_unregister(devlink);
 	devl_unlock(devlink);
 	if (dev->state != MLX5_DEVICE_STATE_UP)
 		return;
@@ -1943,16 +1964,7 @@
 		goto err_init_one;
 	}
 
-	err = mlx5_crdump_enable(dev);
-	if (err)
-		dev_err(&pdev->dev, "mlx5_crdump_enable failed with error code %d\n", err);
-
-	err = mlx5_hwmon_dev_register(dev);
-	if (err)
-		mlx5_core_err(dev, "mlx5_hwmon_dev_register failed with error code %d\n", err);
-
 	pci_save_state(pdev);
-	devlink_register(devlink);
 	return 0;
 
 err_init_one:
@@ -1973,16 +1985,9 @@
 	struct devlink *devlink = priv_to_devlink(dev);
 
 	set_bit(MLX5_BREAK_FW_WAIT, &dev->intf_state);
-	/* mlx5_drain_fw_reset() and mlx5_drain_health_wq() are using
-	 * devlink notify APIs.
-	 * Hence, we must drain them before unregistering the devlink.
-	 */
 	mlx5_drain_fw_reset(dev);
 	mlx5_drain_health_wq(dev);
-	devlink_unregister(devlink);
 	mlx5_sriov_disable(pdev, false);
-	mlx5_hwmon_dev_unregister(dev);
-	mlx5_crdump_disable(dev);
 	mlx5_uninit_one(dev);
 	mlx5_pci_close(dev);
 	mlx5_mdev_uninit(dev);
@@ -2135,7 +2140,6 @@
 	/* Panic tear down fw command will stop the PCI bus communication
 	 * with the HCA, so the health poll is no longer needed.
 	 */
-	mlx5_drain_health_wq(dev);
 	mlx5_stop_health_poll(dev, false);
 
 	ret = mlx5_cmd_fast_teardown_hca(dev);
@@ -2170,6 +2174,7 @@
 
 	mlx5_core_info(dev, "Shutdown was called\n");
 	set_bit(MLX5_BREAK_FW_WAIT, &dev->intf_state);
+	mlx5_drain_health_wq(dev);
 	err = mlx5_try_fast_unload(dev);
 	if (err)
 		mlx5_unload_one(dev, false);
@@ -2210,6 +2215,7 @@
 	{ PCI_VDEVICE(MELLANOX, 0x101f) },			/* ConnectX-6 LX */
 	{ PCI_VDEVICE(MELLANOX, 0x1021) },			/* ConnectX-7 */
 	{ PCI_VDEVICE(MELLANOX, 0x1023) },			/* ConnectX-8 */
+	{ PCI_VDEVICE(MELLANOX, 0x1025) },			/* ConnectX-9 */
 	{ PCI_VDEVICE(MELLANOX, 0xa2d2) },			/* BlueField integrated ConnectX-5 network controller */
 	{ PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF},	/* BlueField integrated ConnectX-5 network controller VF */
 	{ PCI_VDEVICE(MELLANOX, 0xa2d6) },			/* BlueField-2 integrated ConnectX-6 Dx network controller */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c
@@ -19,6 +19,7 @@
 #define MLX5_IRQ_CTRL_SF_MAX 8
 /* min num of vectors for SFs to be enabled */
 #define MLX5_IRQ_VEC_COMP_BASE_SF 2
+#define MLX5_IRQ_VEC_COMP_BASE 1
 
 #define MLX5_EQ_SHARE_IRQ_MAX_COMP (8)
 #define MLX5_EQ_SHARE_IRQ_MAX_CTRL (UINT_MAX)
@@ -246,6 +247,7 @@
 		return;
 	}
 
+	vecidx -= MLX5_IRQ_VEC_COMP_BASE;
 	snprintf(name, MLX5_MAX_IRQ_NAME, "mlx5_comp%d", vecidx);
 }
 
@@ -585,7 +587,7 @@
 	struct mlx5_irq_table *table = mlx5_irq_table_get(dev);
 	struct mlx5_irq_pool *pool = table->pcif_pool;
 	struct irq_affinity_desc af_desc;
-	int offset = 1;
+	int offset = MLX5_IRQ_VEC_COMP_BASE;
 
 	if (!pool->xa_num_irqs.max)
 		offset = 0;
@@ -636,9 +638,11 @@
 	kvfree(pool);
 }
 
-static int irq_pools_init(struct mlx5_core_dev *dev, int sf_vec, int pcif_vec)
+static int irq_pools_init(struct mlx5_core_dev *dev, int sf_vec, int pcif_vec,
+			  bool dynamic_vec)
 {
 	struct mlx5_irq_table *table = dev->priv.irq_table;
+	int sf_vec_available = sf_vec;
 	int num_sf_ctrl_by_msix;
 	int num_sf_ctrl_by_sfs;
 	int num_sf_ctrl;
@@ -663,6 +667,13 @@
 					  MLX5_SFS_PER_CTRL_IRQ);
 	num_sf_ctrl = min_t(int, num_sf_ctrl_by_msix, num_sf_ctrl_by_sfs);
 	num_sf_ctrl = min_t(int, MLX5_IRQ_CTRL_SF_MAX, num_sf_ctrl);
+	if (!dynamic_vec && (num_sf_ctrl + 1) > sf_vec_available) {
+		mlx5_core_dbg(dev,
+			      "Not enough IRQs for SFs control and completion pool, required=%d avail=%d\n",
+			      num_sf_ctrl + 1, sf_vec_available);
+		return 0;
+	}
+
 	table->sf_ctrl_pool = irq_pool_alloc(dev, pcif_vec, num_sf_ctrl,
 					     "mlx5_sf_ctrl",
 					     MLX5_EQ_SHARE_IRQ_MIN_CTRL,
@@ -671,9 +682,11 @@
 		err = PTR_ERR(table->sf_ctrl_pool);
 		goto err_pf;
 	}
-	/* init sf_comp_pool */
+	sf_vec_available -= num_sf_ctrl;
+
+	/* init sf_comp_pool, remaining vectors are for the SF completions */
 	table->sf_comp_pool = irq_pool_alloc(dev, pcif_vec + num_sf_ctrl,
-					     sf_vec - num_sf_ctrl, "mlx5_sf_comp",
+					     sf_vec_available, "mlx5_sf_comp",
 					     MLX5_EQ_SHARE_IRQ_MIN_COMP,
 					     MLX5_EQ_SHARE_IRQ_MAX_COMP);
 	if (IS_ERR(table->sf_comp_pool)) {
@@ -764,6 +777,7 @@
 	int num_eqs = MLX5_CAP_GEN(dev, max_num_eqs) ?
 		      MLX5_CAP_GEN(dev, max_num_eqs) :
 		      1 << MLX5_CAP_GEN(dev, log_max_eq);
+	bool dynamic_vec;
 	int total_vec;
 	int pcif_vec;
 	int req_vec;
@@ -773,22 +787,32 @@
 	if (mlx5_core_is_sf(dev))
 		return 0;
 
+	/* PCI PF vectors usage is limited by online cpus, device EQs and
+	 * PCI MSI-X capability.
+	 */
 	pcif_vec = MLX5_CAP_GEN(dev, num_ports) * num_online_cpus() + 1;
 	pcif_vec = min_t(int, pcif_vec, num_eqs);
+	pcif_vec = min_t(int, pcif_vec, pci_msix_vec_count(dev->pdev));
 
 	total_vec = pcif_vec;
 	if (mlx5_sf_max_functions(dev))
 		total_vec += MLX5_IRQ_CTRL_SF_MAX +
 			MLX5_COMP_EQS_PER_SF * mlx5_sf_max_functions(dev);
 	total_vec = min_t(int, total_vec, pci_msix_vec_count(dev->pdev));
-	pcif_vec = min_t(int, pcif_vec, pci_msix_vec_count(dev->pdev));
 
 	req_vec = pci_msix_can_alloc_dyn(dev->pdev) ? 1 : total_vec;
 	n = pci_alloc_irq_vectors(dev->pdev, 1, req_vec, PCI_IRQ_MSIX);
 	if (n < 0)
 		return n;
 
-	err = irq_pools_init(dev, total_vec - pcif_vec, pcif_vec);
+	/* Further limit vectors of the pools based on platform for non dynamic case */
+	dynamic_vec = pci_msix_can_alloc_dyn(dev->pdev);
+	if (!dynamic_vec) {
+		pcif_vec = min_t(int, n, pcif_vec);
+		total_vec = min_t(int, n, total_vec);
+	}
+
+	err = irq_pools_init(dev, total_vec - pcif_vec, pcif_vec, dynamic_vec);
 	if (err)
 		pci_free_irq_vectors(dev->pdev);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/qos.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/qos.c
@@ -28,6 +28,9 @@
 {
 	u32 sched_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {0};
 
+	if (!(MLX5_CAP_QOS(mdev, nic_element_type) & ELEMENT_TYPE_CAP_MASK_QUEUE_GROUP))
+		return -EOPNOTSUPP;
+
 	MLX5_SET(scheduling_context, sched_ctx, parent_element_id, parent_id);
 	MLX5_SET(scheduling_context, sched_ctx, element_type,
 		 SCHEDULING_CONTEXT_ELEMENT_TYPE_QUEUE_GROUP);
@@ -44,6 +47,10 @@
 	u32 sched_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {0};
 	void *attr;
 
+	if (!(MLX5_CAP_QOS(mdev, nic_element_type) & ELEMENT_TYPE_CAP_MASK_TSAR) ||
+	    !(MLX5_CAP_QOS(mdev, nic_tsar_type) & TSAR_TYPE_CAP_MASK_DWRR))
+		return -EOPNOTSUPP;
+
 	MLX5_SET(scheduling_context, sched_ctx, parent_element_id, parent_id);
 	MLX5_SET(scheduling_context, sched_ctx, element_type,
 		 SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
@@ -60,6 +60,13 @@
 		goto remap_err;
 	}
 
+	/* Peer devlink logic expects to work on unregistered devlink instance. */
+	err = mlx5_core_peer_devlink_set(sf_dev, devlink);
+	if (err) {
+		mlx5_core_warn(mdev, "mlx5_core_peer_devlink_set err=%d\n", err);
+		goto peer_devlink_set_err;
+	}
+
 	if (MLX5_ESWITCH_MANAGER(sf_dev->parent_mdev))
 		err = mlx5_init_one_light(mdev);
 	else
@@ -69,21 +76,10 @@
 		goto init_one_err;
 	}
 
-	err = mlx5_core_peer_devlink_set(sf_dev, devlink);
-	if (err) {
-		mlx5_core_warn(mdev, "mlx5_core_peer_devlink_set err=%d\n", err);
-		goto peer_devlink_set_err;
-	}
-
-	devlink_register(devlink);
 	return 0;
 
-peer_devlink_set_err:
-	if (mlx5_dev_is_lightweight(sf_dev->mdev))
-		mlx5_uninit_one_light(sf_dev->mdev);
-	else
-		mlx5_uninit_one(sf_dev->mdev);
 init_one_err:
+peer_devlink_set_err:
 	iounmap(mdev->iseg);
 remap_err:
 	mlx5_mdev_uninit(mdev);
@@ -95,24 +91,29 @@
 static void mlx5_sf_dev_remove(struct auxiliary_device *adev)
 {
 	struct mlx5_sf_dev *sf_dev = container_of(adev, struct mlx5_sf_dev, adev);
-	struct devlink *devlink = priv_to_devlink(sf_dev->mdev);
+	struct mlx5_core_dev *mdev = sf_dev->mdev;
+	struct devlink *devlink;
 
-	mlx5_drain_health_wq(sf_dev->mdev);
-	devlink_unregister(devlink);
-	if (mlx5_dev_is_lightweight(sf_dev->mdev))
-		mlx5_uninit_one_light(sf_dev->mdev);
+	devlink = priv_to_devlink(mdev);
+	set_bit(MLX5_BREAK_FW_WAIT, &mdev->intf_state);
+	mlx5_drain_health_wq(mdev);
+	if (mlx5_dev_is_lightweight(mdev))
+		mlx5_uninit_one_light(mdev);
 	else
-		mlx5_uninit_one(sf_dev->mdev);
-	iounmap(sf_dev->mdev->iseg);
-	mlx5_mdev_uninit(sf_dev->mdev);
+		mlx5_uninit_one(mdev);
+	iounmap(mdev->iseg);
+	mlx5_mdev_uninit(mdev);
 	mlx5_devlink_free(devlink);
 }
 
 static void mlx5_sf_dev_shutdown(struct auxiliary_device *adev)
 {
 	struct mlx5_sf_dev *sf_dev = container_of(adev, struct mlx5_sf_dev, adev);
+	struct mlx5_core_dev *mdev = sf_dev->mdev;
 
-	mlx5_unload_one(sf_dev->mdev, false);
+	set_bit(MLX5_BREAK_FW_WAIT, &mdev->intf_state);
+	mlx5_drain_health_wq(mdev);
+	mlx5_unload_one(mdev, false);
 }
 
 static const struct auxiliary_device_id mlx5_sf_dev_id_table[] = {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c
@@ -249,6 +249,7 @@
 	return 0;
 
 esw_err:
+	mlx5_sf_function_id_erase(table, sf);
 	mlx5_sf_free(table, sf);
 	return err;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c
@@ -297,7 +297,9 @@
 	if (ret) {
 		mlx5dr_dbg(dmn, "Couldn't insert new vport into xarray (%d)\n", ret);
 		kvfree(vport_caps);
-		return ERR_PTR(ret);
+		if (ret == -EBUSY)
+			return ERR_PTR(-EBUSY);
+		return NULL;
 	}
 
 	return vport_caps;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
@@ -7,7 +7,7 @@
 /* don't try to optimize STE allocation if the stack is too constaraining */
 #define DR_RULE_MAX_STES_OPTIMIZED 0
 #else
-#define DR_RULE_MAX_STES_OPTIMIZED 5
+#define DR_RULE_MAX_STES_OPTIMIZED 2
 #endif
 #define DR_RULE_MAX_STE_CHAIN_OPTIMIZED (DR_RULE_MAX_STES_OPTIMIZED + DR_ACTION_MAX_STES)
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
@@ -1067,7 +1067,6 @@
 	int inlen, err, eqn;
 	void *cqc, *in;
 	__be64 *pas;
-	int vector;
 	u32 i;
 
 	cq = kzalloc(sizeof(*cq), GFP_KERNEL);
@@ -1096,8 +1095,7 @@
 	if (!in)
 		goto err_cqwq;
 
-	vector = raw_smp_processor_id() % mlx5_comp_vectors_max(mdev);
-	err = mlx5_comp_eqn_get(mdev, vector, &eqn);
+	err = mlx5_comp_eqn_get(mdev, 0, &eqn);
 	if (err) {
 		kvfree(in);
 		goto err_cqwq;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h
@@ -40,6 +40,7 @@
  */
 #define MLXBF_GIGE_BCAST_MAC_FILTER_IDX 0
 #define MLXBF_GIGE_LOCAL_MAC_FILTER_IDX 1
+#define MLXBF_GIGE_MAX_FILTER_IDX       3
 
 /* Define for broadcast MAC literal */
 #define BCAST_MAC_ADDR 0xFFFFFFFFFFFF
@@ -175,6 +176,13 @@
 int mlxbf_gige_mdio_probe(struct platform_device *pdev,
 			  struct mlxbf_gige *priv);
 void mlxbf_gige_mdio_remove(struct mlxbf_gige *priv);
+
+void mlxbf_gige_enable_multicast_rx(struct mlxbf_gige *priv);
+void mlxbf_gige_disable_multicast_rx(struct mlxbf_gige *priv);
+void mlxbf_gige_enable_mac_rx_filter(struct mlxbf_gige *priv,
+				     unsigned int index);
+void mlxbf_gige_disable_mac_rx_filter(struct mlxbf_gige *priv,
+				      unsigned int index);
 void mlxbf_gige_set_mac_rx_filter(struct mlxbf_gige *priv,
 				  unsigned int index, u64 dmac);
 void mlxbf_gige_get_mac_rx_filter(struct mlxbf_gige *priv,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/phy.h>
 #include <linux/platform_device.h>
+#include <linux/rtnetlink.h>
 #include <linux/skbuff.h>
 
 #include "mlxbf_gige.h"
@@ -139,13 +140,10 @@
 	control |= MLXBF_GIGE_CONTROL_PORT_EN;
 	writeq(control, priv->base + MLXBF_GIGE_CONTROL);
 
-	err = mlxbf_gige_request_irqs(priv);
-	if (err)
-		return err;
 	mlxbf_gige_cache_stats(priv);
 	err = mlxbf_gige_clean_port(priv);
 	if (err)
-		goto free_irqs;
+		return err;
 
 	/* Clear driver's valid_polarity to match hardware,
 	 * since the above call to clean_port() resets the
@@ -157,7 +155,7 @@
 
 	err = mlxbf_gige_tx_init(priv);
 	if (err)
-		goto free_irqs;
+		goto phy_deinit;
 	err = mlxbf_gige_rx_init(priv);
 	if (err)
 		goto tx_deinit;
@@ -166,6 +164,14 @@
 	napi_enable(&priv->napi);
 	netif_start_queue(netdev);
 
+	err = mlxbf_gige_request_irqs(priv);
+	if (err)
+		goto napi_deinit;
+
+	mlxbf_gige_enable_mac_rx_filter(priv, MLXBF_GIGE_BCAST_MAC_FILTER_IDX);
+	mlxbf_gige_enable_mac_rx_filter(priv, MLXBF_GIGE_LOCAL_MAC_FILTER_IDX);
+	mlxbf_gige_enable_multicast_rx(priv);
+
 	/* Set bits in INT_EN that we care about */
 	int_en = MLXBF_GIGE_INT_EN_HW_ACCESS_ERROR |
 		 MLXBF_GIGE_INT_EN_TX_CHECKSUM_INPUTS |
@@ -182,11 +188,17 @@
 
 	return 0;
 
+napi_deinit:
+	netif_stop_queue(netdev);
+	napi_disable(&priv->napi);
+	netif_napi_del(&priv->napi);
+	mlxbf_gige_rx_deinit(priv);
+
 tx_deinit:
 	mlxbf_gige_tx_deinit(priv);
 
-free_irqs:
-	mlxbf_gige_free_irqs(priv);
+phy_deinit:
+	phy_stop(phydev);
 	return err;
 }
 
@@ -371,6 +383,7 @@
 	void __iomem *plu_base;
 	void __iomem *base;
 	int addr, phy_irq;
+	unsigned int i;
 	int err;
 
 	base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC);
@@ -415,6 +428,11 @@
 	priv->rx_q_entries = MLXBF_GIGE_DEFAULT_RXQ_SZ;
 	priv->tx_q_entries = MLXBF_GIGE_DEFAULT_TXQ_SZ;
 
+	for (i = 0; i <= MLXBF_GIGE_MAX_FILTER_IDX; i++)
+		mlxbf_gige_disable_mac_rx_filter(priv, i);
+	mlxbf_gige_disable_multicast_rx(priv);
+	mlxbf_gige_disable_promisc(priv);
+
 	/* Write initial MAC address to hardware */
 	mlxbf_gige_initial_mac(priv);
 
@@ -485,8 +503,13 @@
 {
 	struct mlxbf_gige *priv = platform_get_drvdata(pdev);
 
-	writeq(0, priv->base + MLXBF_GIGE_INT_EN);
-	mlxbf_gige_clean_port(priv);
+	rtnl_lock();
+	netif_device_detach(priv->netdev);
+
+	if (netif_running(priv->netdev))
+		dev_close(priv->netdev);
+
+	rtnl_unlock();
 }
 
 static const struct acpi_device_id __maybe_unused mlxbf_gige_acpi_match[] = {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h
@@ -62,6 +62,8 @@
 #define MLXBF_GIGE_TX_STATUS_DATA_FIFO_FULL           BIT(1)
 #define MLXBF_GIGE_RX_MAC_FILTER_DMAC_RANGE_START     0x0520
 #define MLXBF_GIGE_RX_MAC_FILTER_DMAC_RANGE_END       0x0528
+#define MLXBF_GIGE_RX_MAC_FILTER_GENERAL              0x0530
+#define MLXBF_GIGE_RX_MAC_FILTER_EN_MULTICAST         BIT(1)
 #define MLXBF_GIGE_RX_MAC_FILTER_COUNT_DISC           0x0540
 #define MLXBF_GIGE_RX_MAC_FILTER_COUNT_DISC_EN        BIT(0)
 #define MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS           0x0548
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
@@ -11,15 +11,31 @@
 #include "mlxbf_gige.h"
 #include "mlxbf_gige_regs.h"
 
-void mlxbf_gige_set_mac_rx_filter(struct mlxbf_gige *priv,
-				  unsigned int index, u64 dmac)
+void mlxbf_gige_enable_multicast_rx(struct mlxbf_gige *priv)
 {
 	void __iomem *base = priv->base;
-	u64 control;
+	u64 data;
 
-	/* Write destination MAC to specified MAC RX filter */
-	writeq(dmac, base + MLXBF_GIGE_RX_MAC_FILTER +
-	       (index * MLXBF_GIGE_RX_MAC_FILTER_STRIDE));
+	data = readq(base + MLXBF_GIGE_RX_MAC_FILTER_GENERAL);
+	data |= MLXBF_GIGE_RX_MAC_FILTER_EN_MULTICAST;
+	writeq(data, base + MLXBF_GIGE_RX_MAC_FILTER_GENERAL);
+}
+
+void mlxbf_gige_disable_multicast_rx(struct mlxbf_gige *priv)
+{
+	void __iomem *base = priv->base;
+	u64 data;
+
+	data = readq(base + MLXBF_GIGE_RX_MAC_FILTER_GENERAL);
+	data &= ~MLXBF_GIGE_RX_MAC_FILTER_EN_MULTICAST;
+	writeq(data, base + MLXBF_GIGE_RX_MAC_FILTER_GENERAL);
+}
+
+void mlxbf_gige_enable_mac_rx_filter(struct mlxbf_gige *priv,
+				     unsigned int index)
+{
+	void __iomem *base = priv->base;
+	u64 control;
 
 	/* Enable MAC receive filter mask for specified index */
 	control = readq(base + MLXBF_GIGE_CONTROL);
@@ -27,6 +43,28 @@
 	writeq(control, base + MLXBF_GIGE_CONTROL);
 }
 
+void mlxbf_gige_disable_mac_rx_filter(struct mlxbf_gige *priv,
+				      unsigned int index)
+{
+	void __iomem *base = priv->base;
+	u64 control;
+
+	/* Disable MAC receive filter mask for specified index */
+	control = readq(base + MLXBF_GIGE_CONTROL);
+	control &= ~(MLXBF_GIGE_CONTROL_EN_SPECIFIC_MAC << index);
+	writeq(control, base + MLXBF_GIGE_CONTROL);
+}
+
+void mlxbf_gige_set_mac_rx_filter(struct mlxbf_gige *priv,
+				  unsigned int index, u64 dmac)
+{
+	void __iomem *base = priv->base;
+
+	/* Write destination MAC to specified MAC RX filter */
+	writeq(dmac, base + MLXBF_GIGE_RX_MAC_FILTER +
+	       (index * MLXBF_GIGE_RX_MAC_FILTER_STRIDE));
+}
+
 void mlxbf_gige_get_mac_rx_filter(struct mlxbf_gige *priv,
 				  unsigned int index, u64 *dmac)
 {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -849,7 +849,7 @@
 
 static const struct mlxsw_listener mlxsw_emad_rx_listener =
 	MLXSW_RXL(mlxsw_emad_rx_listener_func, ETHEMAD, TRAP_TO_CPU, false,
-		  EMAD, DISCARD);
+		  EMAD, FORWARD);
 
 static int mlxsw_emad_tlv_enable(struct mlxsw_core *mlxsw_core)
 {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
@@ -95,7 +95,7 @@
 		      */
 	   has_trap:1,
 	   has_police:1;
-	unsigned int ref_count;
+	refcount_t ref_count;
 	struct mlxsw_afa_set *next; /* Pointer to the next set. */
 	struct mlxsw_afa_set *prev; /* Pointer to the previous set,
 				     * note that set may have multiple
@@ -120,7 +120,7 @@
 	struct rhash_head ht_node;
 	struct mlxsw_afa_fwd_entry_ht_key ht_key;
 	u32 kvdl_index;
-	unsigned int ref_count;
+	refcount_t ref_count;
 };
 
 static const struct rhashtable_params mlxsw_afa_fwd_entry_ht_params = {
@@ -282,7 +282,7 @@
 	/* Need to initialize the set to pass by default */
 	mlxsw_afa_set_goto_set(set, MLXSW_AFA_SET_GOTO_BINDING_CMD_TERM, 0);
 	set->ht_key.is_first = is_first;
-	set->ref_count = 1;
+	refcount_set(&set->ref_count, 1);
 	return set;
 }
 
@@ -330,7 +330,7 @@
 static void mlxsw_afa_set_put(struct mlxsw_afa *mlxsw_afa,
 			      struct mlxsw_afa_set *set)
 {
-	if (--set->ref_count)
+	if (!refcount_dec_and_test(&set->ref_count))
 		return;
 	if (set->shared)
 		mlxsw_afa_set_unshare(mlxsw_afa, set);
@@ -350,7 +350,7 @@
 	set = rhashtable_lookup_fast(&mlxsw_afa->set_ht, &orig_set->ht_key,
 				     mlxsw_afa_set_ht_params);
 	if (set) {
-		set->ref_count++;
+		refcount_inc(&set->ref_count);
 		mlxsw_afa_set_put(mlxsw_afa, orig_set);
 	} else {
 		set = orig_set;
@@ -564,7 +564,7 @@
 	if (!fwd_entry)
 		return ERR_PTR(-ENOMEM);
 	fwd_entry->ht_key.local_port = local_port;
-	fwd_entry->ref_count = 1;
+	refcount_set(&fwd_entry->ref_count, 1);
 
 	err = rhashtable_insert_fast(&mlxsw_afa->fwd_entry_ht,
 				     &fwd_entry->ht_node,
@@ -607,7 +607,7 @@
 	fwd_entry = rhashtable_lookup_fast(&mlxsw_afa->fwd_entry_ht, &ht_key,
 					   mlxsw_afa_fwd_entry_ht_params);
 	if (fwd_entry) {
-		fwd_entry->ref_count++;
+		refcount_inc(&fwd_entry->ref_count);
 		return fwd_entry;
 	}
 	return mlxsw_afa_fwd_entry_create(mlxsw_afa, local_port);
@@ -616,7 +616,7 @@
 static void mlxsw_afa_fwd_entry_put(struct mlxsw_afa *mlxsw_afa,
 				    struct mlxsw_afa_fwd_entry *fwd_entry)
 {
-	if (--fwd_entry->ref_count)
+	if (!refcount_dec_and_test(&fwd_entry->ref_count))
 		return;
 	mlxsw_afa_fwd_entry_destroy(mlxsw_afa, fwd_entry);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c
@@ -5,6 +5,7 @@
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/errno.h>
+#include <linux/refcount.h>
 
 #include "item.h"
 #include "core_acl_flex_keys.h"
@@ -66,7 +67,7 @@
 
 		for (j = 0; j < block->instances_count; j++) {
 			const struct mlxsw_afk_element_info *elinfo;
-			struct mlxsw_afk_element_inst *elinst;
+			const struct mlxsw_afk_element_inst *elinst;
 
 			elinst = &block->instances[j];
 			elinfo = &mlxsw_afk_element_infos[elinst->element];
@@ -107,7 +108,7 @@
 
 struct mlxsw_afk_key_info {
 	struct list_head list;
-	unsigned int ref_count;
+	refcount_t ref_count;
 	unsigned int blocks_count;
 	int element_to_block[MLXSW_AFK_ELEMENT_MAX]; /* index is element, value
 						      * is index inside "blocks"
@@ -153,7 +154,7 @@
 		const struct mlxsw_afk_block *block = &mlxsw_afk->blocks[i];
 
 		for (j = 0; j < block->instances_count; j++) {
-			struct mlxsw_afk_element_inst *elinst;
+			const struct mlxsw_afk_element_inst *elinst;
 
 			elinst = &block->instances[j];
 			if (elinst->element == element) {
@@ -334,7 +335,7 @@
 	if (err)
 		goto err_picker;
 	list_add(&key_info->list, &mlxsw_afk->key_info_list);
-	key_info->ref_count = 1;
+	refcount_set(&key_info->ref_count, 1);
 	return key_info;
 
 err_picker:
@@ -356,7 +357,7 @@
 
 	key_info = mlxsw_afk_key_info_find(mlxsw_afk, elusage);
 	if (key_info) {
-		key_info->ref_count++;
+		refcount_inc(&key_info->ref_count);
 		return key_info;
 	}
 	return mlxsw_afk_key_info_create(mlxsw_afk, elusage);
@@ -365,7 +366,7 @@
 
 void mlxsw_afk_key_info_put(struct mlxsw_afk_key_info *key_info)
 {
-	if (--key_info->ref_count)
+	if (!refcount_dec_and_test(&key_info->ref_count))
 		return;
 	mlxsw_afk_key_info_destroy(key_info);
 }
@@ -385,7 +386,7 @@
 	int i;
 
 	for (i = 0; i < block->instances_count; i++) {
-		struct mlxsw_afk_element_inst *elinst;
+		const struct mlxsw_afk_element_inst *elinst;
 
 		elinst = &block->instances[i];
 		if (elinst->element == element)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h
@@ -117,7 +117,7 @@
 
 struct mlxsw_afk_block {
 	u16 encoding; /* block ID */
-	struct mlxsw_afk_element_inst *instances;
+	const struct mlxsw_afk_element_inst *instances;
 	unsigned int instances_count;
 	bool high_entropy;
 };
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/core_env.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/core_env.c
@@ -1357,24 +1357,20 @@
 	.got_inactive = mlxsw_env_got_inactive,
 };
 
-static int mlxsw_env_max_module_eeprom_len_query(struct mlxsw_env *mlxsw_env)
+static void mlxsw_env_max_module_eeprom_len_query(struct mlxsw_env *mlxsw_env)
 {
 	char mcam_pl[MLXSW_REG_MCAM_LEN];
-	bool mcia_128b_supported;
+	bool mcia_128b_supported = false;
 	int err;
 
 	mlxsw_reg_mcam_pack(mcam_pl,
 			    MLXSW_REG_MCAM_FEATURE_GROUP_ENHANCED_FEATURES);
 	err = mlxsw_reg_query(mlxsw_env->core, MLXSW_REG(mcam), mcam_pl);
-	if (err)
-		return err;
-
-	mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_MCIA_128B,
-			      &mcia_128b_supported);
+	if (!err)
+		mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_MCIA_128B,
+				      &mcia_128b_supported);
 
 	mlxsw_env->max_eeprom_len = mcia_128b_supported ? 128 : 48;
-
-	return 0;
 }
 
 int mlxsw_env_init(struct mlxsw_core *mlxsw_core,
@@ -1445,15 +1441,11 @@
 	if (err)
 		goto err_type_set;
 
-	err = mlxsw_env_max_module_eeprom_len_query(env);
-	if (err)
-		goto err_eeprom_len_query;
-
+	mlxsw_env_max_module_eeprom_len_query(env);
 	env->line_cards[0]->active = true;
 
 	return 0;
 
-err_eeprom_len_query:
 err_type_set:
 	mlxsw_env_module_event_disable(env, 0);
 err_mlxsw_env_module_event_enable:
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
@@ -1484,6 +1484,7 @@
 	vfree(types_info->data);
 err_data_alloc:
 	kfree(types_info);
+	linecards->types_info = NULL;
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -1490,20 +1490,31 @@
 	return -EBUSY;
 }
 
-static int mlxsw_pci_reset_at_pci_disable(struct mlxsw_pci *mlxsw_pci)
+static int mlxsw_pci_reset_at_pci_disable(struct mlxsw_pci *mlxsw_pci,
+					  bool pci_reset_sbr_supported)
 {
 	struct pci_dev *pdev = mlxsw_pci->pdev;
 	char mrsr_pl[MLXSW_REG_MRSR_LEN];
+	struct pci_dev *bridge;
 	int err;
 
+	if (!pci_reset_sbr_supported) {
+		pci_dbg(pdev, "Performing PCI hot reset instead of \"all reset\"\n");
+		goto sbr;
+	}
+
 	mlxsw_reg_mrsr_pack(mrsr_pl,
 			    MLXSW_REG_MRSR_COMMAND_RESET_AT_PCI_DISABLE);
 	err = mlxsw_reg_write(mlxsw_pci->core, MLXSW_REG(mrsr), mrsr_pl);
 	if (err)
 		return err;
 
+sbr:
 	device_lock_assert(&pdev->dev);
 
+	bridge = pci_upstream_bridge(pdev);
+	if (bridge)
+		pci_cfg_access_lock(bridge);
 	pci_cfg_access_lock(pdev);
 	pci_save_state(pdev);
 
@@ -1513,6 +1524,8 @@
 
 	pci_restore_state(pdev);
 	pci_cfg_access_unlock(pdev);
+	if (bridge)
+		pci_cfg_access_unlock(bridge);
 
 	return err;
 }
@@ -1529,8 +1542,9 @@
 mlxsw_pci_reset(struct mlxsw_pci *mlxsw_pci, const struct pci_device_id *id)
 {
 	struct pci_dev *pdev = mlxsw_pci->pdev;
+	bool pci_reset_sbr_supported = false;
 	char mcam_pl[MLXSW_REG_MCAM_LEN];
-	bool pci_reset_supported;
+	bool pci_reset_supported = false;
 	u32 sys_status;
 	int err;
 
@@ -1548,15 +1562,17 @@
 	mlxsw_reg_mcam_pack(mcam_pl,
 			    MLXSW_REG_MCAM_FEATURE_GROUP_ENHANCED_FEATURES);
 	err = mlxsw_reg_query(mlxsw_pci->core, MLXSW_REG(mcam), mcam_pl);
-	if (err)
-		return err;
-
-	mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_PCI_RESET,
-			      &pci_reset_supported);
+	if (!err) {
+		mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_PCI_RESET,
+				      &pci_reset_supported);
+		mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_PCI_RESET_SBR,
+				      &pci_reset_sbr_supported);
+	}
 
 	if (pci_reset_supported) {
 		pci_dbg(pdev, "Starting PCI reset flow\n");
-		err = mlxsw_pci_reset_at_pci_disable(mlxsw_pci);
+		err = mlxsw_pci_reset_at_pci_disable(mlxsw_pci,
+						     pci_reset_sbr_supported);
 	} else {
 		pci_dbg(pdev, "Starting software reset flow\n");
 		err = mlxsw_pci_reset_sw(mlxsw_pci);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -10668,6 +10668,8 @@
 	MLXSW_REG_MCAM_MCIA_128B = 34,
 	/* If set, MRSR.command=6 is supported. */
 	MLXSW_REG_MCAM_PCI_RESET = 48,
+	/* If set, MRSR.command=6 is supported with Secondary Bus Reset. */
+	MLXSW_REG_MCAM_PCI_RESET_SBR = 67,
 };
 
 #define MLXSW_REG_BYTES_PER_DWORD 0x4
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
@@ -9,6 +9,7 @@
 #include <linux/rhashtable.h>
 #include <linux/netdevice.h>
 #include <linux/mutex.h>
+#include <linux/refcount.h>
 #include <net/net_namespace.h>
 #include <net/tc_act/tc_vlan.h>
 
@@ -55,7 +56,7 @@
 	struct rhash_head ht_node; /* Member of acl HT */
 	struct mlxsw_sp_acl_ruleset_ht_key ht_key;
 	struct rhashtable rule_ht;
-	unsigned int ref_count;
+	refcount_t ref_count;
 	unsigned int min_prio;
 	unsigned int max_prio;
 	unsigned long priv[];
@@ -99,7 +100,7 @@
 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset)
 {
 	/* We hold a reference on ruleset ourselves */
-	return ruleset->ref_count == 2;
+	return refcount_read(&ruleset->ref_count) == 2;
 }
 
 int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp,
@@ -176,7 +177,7 @@
 	ruleset = kzalloc(alloc_size, GFP_KERNEL);
 	if (!ruleset)
 		return ERR_PTR(-ENOMEM);
-	ruleset->ref_count = 1;
+	refcount_set(&ruleset->ref_count, 1);
 	ruleset->ht_key.block = block;
 	ruleset->ht_key.chain_index = chain_index;
 	ruleset->ht_key.ops = ops;
@@ -222,13 +223,13 @@
 
 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset)
 {
-	ruleset->ref_count++;
+	refcount_inc(&ruleset->ref_count);
 }
 
 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp,
 					 struct mlxsw_sp_acl_ruleset *ruleset)
 {
-	if (--ruleset->ref_count)
+	if (!refcount_dec_and_test(&ruleset->ref_count))
 		return;
 	mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c
@@ -391,7 +391,8 @@
 	if (err)
 		return err;
 
-	lkey_id = aregion->ops->lkey_id_get(aregion, aentry->enc_key, erp_id);
+	lkey_id = aregion->ops->lkey_id_get(aregion, aentry->ht_key.enc_key,
+					    erp_id);
 	if (IS_ERR(lkey_id))
 		return PTR_ERR(lkey_id);
 	aentry->lkey_id = lkey_id;
@@ -399,7 +400,7 @@
 	kvdl_index = mlxsw_afa_block_first_kvdl_index(rulei->act_block);
 	mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_WRITE,
 			     priority, region->tcam_region_info,
-			     aentry->enc_key, erp_id,
+			     aentry->ht_key.enc_key, erp_id,
 			     aentry->delta_info.start,
 			     aentry->delta_info.mask,
 			     aentry->delta_info.value,
@@ -428,7 +429,7 @@
 
 	mlxsw_reg_ptce3_pack(ptce3_pl, false, MLXSW_REG_PTCE3_OP_WRITE_WRITE, 0,
 			     region->tcam_region_info,
-			     aentry->enc_key, erp_id,
+			     aentry->ht_key.enc_key, erp_id,
 			     aentry->delta_info.start,
 			     aentry->delta_info.mask,
 			     aentry->delta_info.value,
@@ -457,7 +458,7 @@
 	kvdl_index = mlxsw_afa_block_first_kvdl_index(rulei->act_block);
 	mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_UPDATE,
 			     priority, region->tcam_region_info,
-			     aentry->enc_key, erp_id,
+			     aentry->ht_key.enc_key, erp_id,
 			     aentry->delta_info.start,
 			     aentry->delta_info.mask,
 			     aentry->delta_info.value,
@@ -480,15 +481,13 @@
 	int err;
 
 	mlxsw_afk_encode(afk, region->key_info, &rulei->values,
-			 aentry->ht_key.full_enc_key, mask);
+			 aentry->ht_key.enc_key, mask);
 
 	erp_mask = mlxsw_sp_acl_erp_mask_get(aregion, mask, false);
 	if (IS_ERR(erp_mask))
 		return PTR_ERR(erp_mask);
 	aentry->erp_mask = erp_mask;
 	aentry->ht_key.erp_id = mlxsw_sp_acl_erp_mask_erp_id(erp_mask);
-	memcpy(aentry->enc_key, aentry->ht_key.full_enc_key,
-	       sizeof(aentry->enc_key));
 
 	/* Compute all needed delta information and clear the delta bits
 	 * from the encrypted key.
@@ -497,9 +496,8 @@
 	aentry->delta_info.start = mlxsw_sp_acl_erp_delta_start(delta);
 	aentry->delta_info.mask = mlxsw_sp_acl_erp_delta_mask(delta);
 	aentry->delta_info.value =
-		mlxsw_sp_acl_erp_delta_value(delta,
-					     aentry->ht_key.full_enc_key);
-	mlxsw_sp_acl_erp_delta_clear(delta, aentry->enc_key);
+		mlxsw_sp_acl_erp_delta_value(delta, aentry->ht_key.enc_key);
+	mlxsw_sp_acl_erp_delta_clear(delta, aentry->ht_key.enc_key);
 
 	/* Add rule to the list of A-TCAM rules, assuming this
 	 * rule is intended to A-TCAM. In case this rule does
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
@@ -249,7 +249,7 @@
 		memcpy(chunk + pad_bytes, &erp_region_id,
 		       sizeof(erp_region_id));
 		memcpy(chunk + key_offset,
-		       &aentry->enc_key[chunk_key_offsets[chunk_index]],
+		       &aentry->ht_key.enc_key[chunk_key_offsets[chunk_index]],
 		       chunk_key_len);
 		chunk += chunk_len;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c
@@ -1217,18 +1217,6 @@
 	return err ? false : true;
 }
 
-static int mlxsw_sp_acl_erp_hints_obj_cmp(const void *obj1, const void *obj2)
-{
-	const struct mlxsw_sp_acl_erp_key *key1 = obj1;
-	const struct mlxsw_sp_acl_erp_key *key2 = obj2;
-
-	/* For hints purposes, two objects are considered equal
-	 * in case the masks are the same. Does not matter what
-	 * the "ctcam" value is.
-	 */
-	return memcmp(key1->mask, key2->mask, sizeof(key1->mask));
-}
-
 static void *mlxsw_sp_acl_erp_delta_create(void *priv, void *parent_obj,
 					   void *obj)
 {
@@ -1308,7 +1296,6 @@
 static const struct objagg_ops mlxsw_sp_acl_erp_objagg_ops = {
 	.obj_size = sizeof(struct mlxsw_sp_acl_erp_key),
 	.delta_check = mlxsw_sp_acl_erp_delta_check,
-	.hints_obj_cmp = mlxsw_sp_acl_erp_hints_obj_cmp,
 	.delta_create = mlxsw_sp_acl_erp_delta_create,
 	.delta_destroy = mlxsw_sp_acl_erp_delta_destroy,
 	.root_create = mlxsw_sp_acl_erp_root_create,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_flex_keys.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_flex_keys.c
@@ -7,7 +7,7 @@
 #include "item.h"
 #include "core_acl_flex_keys.h"
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l2_dmac[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l2_dmac[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(DMAC_32_47, 0x00, 2),
 	MLXSW_AFK_ELEMENT_INST_BUF(DMAC_0_31, 0x02, 4),
 	MLXSW_AFK_ELEMENT_INST_U32(PCP, 0x08, 13, 3),
@@ -15,7 +15,7 @@
 	MLXSW_AFK_ELEMENT_INST_U32(SRC_SYS_PORT, 0x0C, 0, 16),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l2_smac[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l2_smac[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SMAC_32_47, 0x00, 2),
 	MLXSW_AFK_ELEMENT_INST_BUF(SMAC_0_31, 0x02, 4),
 	MLXSW_AFK_ELEMENT_INST_U32(PCP, 0x08, 13, 3),
@@ -23,27 +23,27 @@
 	MLXSW_AFK_ELEMENT_INST_U32(SRC_SYS_PORT, 0x0C, 0, 16),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l2_smac_ex[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l2_smac_ex[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SMAC_32_47, 0x02, 2),
 	MLXSW_AFK_ELEMENT_INST_BUF(SMAC_0_31, 0x04, 4),
 	MLXSW_AFK_ELEMENT_INST_U32(ETHERTYPE, 0x0C, 0, 16),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_sip[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_sip[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_0_31, 0x00, 4),
 	MLXSW_AFK_ELEMENT_INST_U32(L4_PORT_RANGE, 0x04, 16, 16),
 	MLXSW_AFK_ELEMENT_INST_U32(IP_PROTO, 0x08, 0, 8),
 	MLXSW_AFK_ELEMENT_INST_U32(SRC_SYS_PORT, 0x0C, 0, 16),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_dip[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_dip[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_0_31, 0x00, 4),
 	MLXSW_AFK_ELEMENT_INST_U32(L4_PORT_RANGE, 0x04, 16, 16),
 	MLXSW_AFK_ELEMENT_INST_U32(IP_PROTO, 0x08, 0, 8),
 	MLXSW_AFK_ELEMENT_INST_U32(SRC_SYS_PORT, 0x0C, 0, 16),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_0_31, 0x00, 4),
 	MLXSW_AFK_ELEMENT_INST_U32(IP_ECN, 0x04, 4, 2),
 	MLXSW_AFK_ELEMENT_INST_U32(IP_TTL_, 0x04, 24, 8),
@@ -51,35 +51,35 @@
 	MLXSW_AFK_ELEMENT_INST_U32(TCP_FLAGS, 0x08, 8, 9), /* TCP_CONTROL+TCP_ECN */
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_ex[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_ex[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(VID, 0x00, 0, 12),
 	MLXSW_AFK_ELEMENT_INST_U32(PCP, 0x08, 29, 3),
 	MLXSW_AFK_ELEMENT_INST_U32(SRC_L4_PORT, 0x08, 0, 16),
 	MLXSW_AFK_ELEMENT_INST_U32(DST_L4_PORT, 0x0C, 0, 16),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_dip[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_dip[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_32_63, 0x00, 4),
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_0_31, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_ex1[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_ex1[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_96_127, 0x00, 4),
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_64_95, 0x04, 4),
 	MLXSW_AFK_ELEMENT_INST_U32(IP_PROTO, 0x08, 0, 8),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_sip[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_sip[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_32_63, 0x00, 4),
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_0_31, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_sip_ex[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_sip_ex[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_96_127, 0x00, 4),
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_64_95, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_packet_type[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_packet_type[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(ETHERTYPE, 0x00, 0, 16),
 };
 
@@ -124,90 +124,90 @@
 	.clear_block	= mlxsw_sp1_afk_clear_block,
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_0[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_0[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(FDB_MISS, 0x00, 3, 1),
 	MLXSW_AFK_ELEMENT_INST_BUF(DMAC_0_31, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_1[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_1[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(FDB_MISS, 0x00, 3, 1),
 	MLXSW_AFK_ELEMENT_INST_BUF(SMAC_0_31, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_2[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_2[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SMAC_32_47, 0x04, 2),
 	MLXSW_AFK_ELEMENT_INST_BUF(DMAC_32_47, 0x06, 2),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_3[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_3[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(PCP, 0x00, 0, 3),
 	MLXSW_AFK_ELEMENT_INST_U32(VID, 0x04, 16, 12),
 	MLXSW_AFK_ELEMENT_INST_BUF(DMAC_32_47, 0x06, 2),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_4[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_4[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(PCP, 0x00, 0, 3),
 	MLXSW_AFK_ELEMENT_INST_U32(VID, 0x04, 16, 12),
 	MLXSW_AFK_ELEMENT_INST_U32(ETHERTYPE, 0x04, 0, 16),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_5[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_5[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(VID, 0x04, 16, 12),
 	MLXSW_AFK_ELEMENT_INST_EXT_U32(SRC_SYS_PORT, 0x04, 0, 8, -1, true), /* RX_ACL_SYSTEM_PORT */
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_0[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_0[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_0_31, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_1[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_1[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_0_31, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_2[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_2[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(IP_DSCP, 0x04, 0, 6),
 	MLXSW_AFK_ELEMENT_INST_U32(IP_ECN, 0x04, 6, 2),
 	MLXSW_AFK_ELEMENT_INST_U32(IP_TTL_, 0x04, 8, 8),
 	MLXSW_AFK_ELEMENT_INST_U32(IP_PROTO, 0x04, 16, 8),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_5[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_5[] = {
 	MLXSW_AFK_ELEMENT_INST_EXT_U32(VIRT_ROUTER, 0x04, 20, 11, 0, true),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_0[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_0[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(VIRT_ROUTER_0_3, 0x00, 0, 4),
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_32_63, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_1[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_1[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(VIRT_ROUTER_4_7, 0x00, 0, 4),
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_64_95, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_2[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_2[] = {
 	MLXSW_AFK_ELEMENT_INST_EXT_U32(VIRT_ROUTER_MSB, 0x00, 0, 3, 0, true),
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_96_127, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_3[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_3[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_32_63, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_4[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_4[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_64_95, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_5[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_5[] = {
 	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_96_127, 0x04, 4),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l4_0[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l4_0[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(SRC_L4_PORT, 0x04, 16, 16),
 	MLXSW_AFK_ELEMENT_INST_U32(DST_L4_PORT, 0x04, 0, 16),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l4_2[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_l4_2[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(TCP_FLAGS, 0x04, 16, 9), /* TCP_CONTROL + TCP_ECN */
 	MLXSW_AFK_ELEMENT_INST_U32(L4_PORT_RANGE, 0x04, 0, 16),
 };
@@ -319,16 +319,20 @@
 	.clear_block	= mlxsw_sp2_afk_clear_block,
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_5b[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_mac_5b[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(VID, 0x04, 18, 12),
 	MLXSW_AFK_ELEMENT_INST_EXT_U32(SRC_SYS_PORT, 0x04, 0, 9, -1, true), /* RX_ACL_SYSTEM_PORT */
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_5b[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_1b[] = {
+	MLXSW_AFK_ELEMENT_INST_BUF(SRC_IP_0_31, 0x04, 4),
+};
+
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv4_5b[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(VIRT_ROUTER, 0x04, 20, 12),
 };
 
-static struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_2b[] = {
+static const struct mlxsw_afk_element_inst mlxsw_sp_afk_element_info_ipv6_2b[] = {
 	MLXSW_AFK_ELEMENT_INST_U32(VIRT_ROUTER_MSB, 0x00, 0, 4),
 	MLXSW_AFK_ELEMENT_INST_BUF(DST_IP_96_127, 0x04, 4),
 };
@@ -341,7 +345,7 @@
 	MLXSW_AFK_BLOCK(0x14, mlxsw_sp_afk_element_info_mac_4),
 	MLXSW_AFK_BLOCK_HIGH_ENTROPY(0x1A, mlxsw_sp_afk_element_info_mac_5b),
 	MLXSW_AFK_BLOCK_HIGH_ENTROPY(0x38, mlxsw_sp_afk_element_info_ipv4_0),
-	MLXSW_AFK_BLOCK_HIGH_ENTROPY(0x39, mlxsw_sp_afk_element_info_ipv4_1),
+	MLXSW_AFK_BLOCK_HIGH_ENTROPY(0x3F, mlxsw_sp_afk_element_info_ipv4_1b),
 	MLXSW_AFK_BLOCK(0x3A, mlxsw_sp_afk_element_info_ipv4_2),
 	MLXSW_AFK_BLOCK(0x36, mlxsw_sp_afk_element_info_ipv4_5b),
 	MLXSW_AFK_BLOCK(0x40, mlxsw_sp_afk_element_info_ipv6_0),
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
@@ -9,6 +9,8 @@
 #include <linux/rhashtable.h>
 #include <linux/netdevice.h>
 #include <linux/mutex.h>
+#include <linux/refcount.h>
+#include <linux/idr.h>
 #include <net/devlink.h>
 #include <trace/events/mlxsw.h>
 
@@ -57,41 +59,43 @@
 static int mlxsw_sp_acl_tcam_region_id_get(struct mlxsw_sp_acl_tcam *tcam,
 					   u16 *p_id)
 {
-	u16 id;
+	int id;
 
-	id = find_first_zero_bit(tcam->used_regions, tcam->max_regions);
-	if (id < tcam->max_regions) {
-		__set_bit(id, tcam->used_regions);
-		*p_id = id;
-		return 0;
-	}
-	return -ENOBUFS;
+	id = ida_alloc_max(&tcam->used_regions, tcam->max_regions - 1,
+			   GFP_KERNEL);
+	if (id < 0)
+		return id;
+
+	*p_id = id;
+
+	return 0;
 }
 
 static void mlxsw_sp_acl_tcam_region_id_put(struct mlxsw_sp_acl_tcam *tcam,
 					    u16 id)
 {
-	__clear_bit(id, tcam->used_regions);
+	ida_free(&tcam->used_regions, id);
 }
 
 static int mlxsw_sp_acl_tcam_group_id_get(struct mlxsw_sp_acl_tcam *tcam,
 					  u16 *p_id)
 {
-	u16 id;
+	int id;
 
-	id = find_first_zero_bit(tcam->used_groups, tcam->max_groups);
-	if (id < tcam->max_groups) {
-		__set_bit(id, tcam->used_groups);
-		*p_id = id;
-		return 0;
-	}
-	return -ENOBUFS;
+	id = ida_alloc_max(&tcam->used_groups, tcam->max_groups - 1,
+			   GFP_KERNEL);
+	if (id < 0)
+		return id;
+
+	*p_id = id;
+
+	return 0;
 }
 
 static void mlxsw_sp_acl_tcam_group_id_put(struct mlxsw_sp_acl_tcam *tcam,
 					   u16 id)
 {
-	__clear_bit(id, tcam->used_groups);
+	ida_free(&tcam->used_groups, id);
 }
 
 struct mlxsw_sp_acl_tcam_pattern {
@@ -155,7 +159,7 @@
 		struct mlxsw_sp_acl_tcam_rehash_ctx ctx;
 	} rehash;
 	struct mlxsw_sp *mlxsw_sp;
-	unsigned int ref_count;
+	refcount_t ref_count;
 };
 
 struct mlxsw_sp_acl_tcam_vchunk;
@@ -176,7 +180,7 @@
 	unsigned int priority; /* Priority within the vregion and group */
 	struct mlxsw_sp_acl_tcam_vgroup *vgroup;
 	struct mlxsw_sp_acl_tcam_vregion *vregion;
-	unsigned int ref_count;
+	refcount_t ref_count;
 };
 
 struct mlxsw_sp_acl_tcam_entry {
@@ -714,7 +718,9 @@
 			     rehash.dw.work);
 	int credits = MLXSW_SP_ACL_TCAM_VREGION_REHASH_CREDITS;
 
+	mutex_lock(&vregion->lock);
 	mlxsw_sp_acl_tcam_vregion_rehash(vregion->mlxsw_sp, vregion, &credits);
+	mutex_unlock(&vregion->lock);
 	if (credits < 0)
 		/* Rehash gone out of credits so it was interrupted.
 		 * Schedule the work as soon as possible to continue.
@@ -725,6 +731,17 @@
 }
 
 static void
+mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(struct mlxsw_sp_acl_tcam_rehash_ctx *ctx)
+{
+	/* The entry markers are relative to the current chunk and therefore
+	 * needs to be reset together with the chunk marker.
+	 */
+	ctx->current_vchunk = NULL;
+	ctx->start_ventry = NULL;
+	ctx->stop_ventry = NULL;
+}
+
+static void
 mlxsw_sp_acl_tcam_rehash_ctx_vchunk_changed(struct mlxsw_sp_acl_tcam_vchunk *vchunk)
 {
 	struct mlxsw_sp_acl_tcam_vregion *vregion = vchunk->vregion;
@@ -746,7 +763,7 @@
 	 * the current chunk pointer to make sure all chunks
 	 * are properly migrated.
 	 */
-	vregion->rehash.ctx.current_vchunk = NULL;
+	mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(&vregion->rehash.ctx);
 }
 
 static struct mlxsw_sp_acl_tcam_vregion *
@@ -769,7 +786,7 @@
 	vregion->tcam = tcam;
 	vregion->mlxsw_sp = mlxsw_sp;
 	vregion->vgroup = vgroup;
-	vregion->ref_count = 1;
+	refcount_set(&vregion->ref_count, 1);
 
 	vregion->key_info = mlxsw_afk_key_info_get(afk, elusage);
 	if (IS_ERR(vregion->key_info)) {
@@ -819,10 +836,14 @@
 	struct mlxsw_sp_acl_tcam *tcam = vregion->tcam;
 
 	if (vgroup->vregion_rehash_enabled && ops->region_rehash_hints_get) {
+		struct mlxsw_sp_acl_tcam_rehash_ctx *ctx = &vregion->rehash.ctx;
+
 		mutex_lock(&tcam->lock);
 		list_del(&vregion->tlist);
 		mutex_unlock(&tcam->lock);
-		cancel_delayed_work_sync(&vregion->rehash.dw);
+		if (cancel_delayed_work_sync(&vregion->rehash.dw) &&
+		    ctx->hints_priv)
+			ops->region_rehash_hints_put(ctx->hints_priv);
 	}
 	mlxsw_sp_acl_tcam_vgroup_vregion_detach(mlxsw_sp, vregion);
 	if (vregion->region2)
@@ -856,7 +877,7 @@
 			 */
 			return ERR_PTR(-EOPNOTSUPP);
 		}
-		vregion->ref_count++;
+		refcount_inc(&vregion->ref_count);
 		return vregion;
 	}
 
@@ -871,7 +892,7 @@
 mlxsw_sp_acl_tcam_vregion_put(struct mlxsw_sp *mlxsw_sp,
 			      struct mlxsw_sp_acl_tcam_vregion *vregion)
 {
-	if (--vregion->ref_count)
+	if (!refcount_dec_and_test(&vregion->ref_count))
 		return;
 	mlxsw_sp_acl_tcam_vregion_destroy(mlxsw_sp, vregion);
 }
@@ -924,7 +945,7 @@
 	INIT_LIST_HEAD(&vchunk->ventry_list);
 	vchunk->priority = priority;
 	vchunk->vgroup = vgroup;
-	vchunk->ref_count = 1;
+	refcount_set(&vchunk->ref_count, 1);
 
 	vregion = mlxsw_sp_acl_tcam_vregion_get(mlxsw_sp, vgroup,
 						priority, elusage);
@@ -1008,7 +1029,7 @@
 		if (WARN_ON(!mlxsw_afk_key_info_subset(vchunk->vregion->key_info,
 						       elusage)))
 			return ERR_PTR(-EINVAL);
-		vchunk->ref_count++;
+		refcount_inc(&vchunk->ref_count);
 		return vchunk;
 	}
 	return mlxsw_sp_acl_tcam_vchunk_create(mlxsw_sp, vgroup,
@@ -1019,7 +1040,7 @@
 mlxsw_sp_acl_tcam_vchunk_put(struct mlxsw_sp *mlxsw_sp,
 			     struct mlxsw_sp_acl_tcam_vchunk *vchunk)
 {
-	if (--vchunk->ref_count)
+	if (!refcount_dec_and_test(&vchunk->ref_count))
 		return;
 	mlxsw_sp_acl_tcam_vchunk_destroy(mlxsw_sp, vchunk);
 }
@@ -1153,8 +1174,14 @@
 				      struct mlxsw_sp_acl_tcam_ventry *ventry,
 				      bool *activity)
 {
-	return mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp,
-						    ventry->entry, activity);
+	struct mlxsw_sp_acl_tcam_vregion *vregion = ventry->vchunk->vregion;
+	int err;
+
+	mutex_lock(&vregion->lock);
+	err = mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp, ventry->entry,
+						   activity);
+	mutex_unlock(&vregion->lock);
+	return err;
 }
 
 static int
@@ -1188,6 +1215,8 @@
 {
 	struct mlxsw_sp_acl_tcam_chunk *new_chunk;
 
+	WARN_ON(vchunk->chunk2);
+
 	new_chunk = mlxsw_sp_acl_tcam_chunk_create(mlxsw_sp, vchunk, region);
 	if (IS_ERR(new_chunk))
 		return PTR_ERR(new_chunk);
@@ -1206,7 +1235,7 @@
 {
 	mlxsw_sp_acl_tcam_chunk_destroy(mlxsw_sp, vchunk->chunk2);
 	vchunk->chunk2 = NULL;
-	ctx->current_vchunk = NULL;
+	mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(ctx);
 }
 
 static int
@@ -1229,6 +1258,9 @@
 		return 0;
 	}
 
+	if (list_empty(&vchunk->ventry_list))
+		goto out;
+
 	/* If the migration got interrupted, we have the ventry to start from
 	 * stored in context.
 	 */
@@ -1238,6 +1270,8 @@
 		ventry = list_first_entry(&vchunk->ventry_list,
 					  typeof(*ventry), list);
 
+	WARN_ON(ventry->vchunk != vchunk);
+
 	list_for_each_entry_from(ventry, &vchunk->ventry_list, list) {
 		/* During rollback, once we reach the ventry that failed
 		 * to migrate, we are done.
@@ -1278,6 +1312,7 @@
 		}
 	}
 
+out:
 	mlxsw_sp_acl_tcam_vchunk_migrate_end(mlxsw_sp, vchunk, ctx);
 	return 0;
 }
@@ -1291,6 +1326,9 @@
 	struct mlxsw_sp_acl_tcam_vchunk *vchunk;
 	int err;
 
+	if (list_empty(&vregion->vchunk_list))
+		return 0;
+
 	/* If the migration got interrupted, we have the vchunk
 	 * we are working on stored in context.
 	 */
@@ -1319,16 +1357,17 @@
 	int err, err2;
 
 	trace_mlxsw_sp_acl_tcam_vregion_migrate(mlxsw_sp, vregion);
-	mutex_lock(&vregion->lock);
 	err = mlxsw_sp_acl_tcam_vchunk_migrate_all(mlxsw_sp, vregion,
 						   ctx, credits);
 	if (err) {
+		if (ctx->this_is_rollback)
+			return err;
 		/* In case migration was not successful, we need to swap
 		 * so the original region pointer is assigned again
 		 * to vregion->region.
 		 */
 		swap(vregion->region, vregion->region2);
-		ctx->current_vchunk = NULL;
+		mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(ctx);
 		ctx->this_is_rollback = true;
 		err2 = mlxsw_sp_acl_tcam_vchunk_migrate_all(mlxsw_sp, vregion,
 							    ctx, credits);
@@ -1339,7 +1378,6 @@
 			/* Let the rollback to be continued later on. */
 		}
 	}
-	mutex_unlock(&vregion->lock);
 	trace_mlxsw_sp_acl_tcam_vregion_migrate_end(mlxsw_sp, vregion);
 	return err;
 }
@@ -1388,6 +1426,7 @@
 
 	ctx->hints_priv = hints_priv;
 	ctx->this_is_rollback = false;
+	mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(ctx);
 
 	return 0;
 
@@ -1440,7 +1479,8 @@
 	err = mlxsw_sp_acl_tcam_vregion_migrate(mlxsw_sp, vregion,
 						ctx, credits);
 	if (err) {
-		dev_err(mlxsw_sp->bus_info->dev, "Failed to migrate vregion\n");
+		dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Failed to migrate vregion\n");
+		return;
 	}
 
 	if (*credits >= 0)
@@ -1548,19 +1588,11 @@
 	if (max_tcam_regions < max_regions)
 		max_regions = max_tcam_regions;
 
-	tcam->used_regions = bitmap_zalloc(max_regions, GFP_KERNEL);
-	if (!tcam->used_regions) {
-		err = -ENOMEM;
-		goto err_alloc_used_regions;
-	}
+	ida_init(&tcam->used_regions);
 	tcam->max_regions = max_regions;
 
 	max_groups = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUPS);
-	tcam->used_groups = bitmap_zalloc(max_groups, GFP_KERNEL);
-	if (!tcam->used_groups) {
-		err = -ENOMEM;
-		goto err_alloc_used_groups;
-	}
+	ida_init(&tcam->used_groups);
 	tcam->max_groups = max_groups;
 	tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core,
 						  ACL_MAX_GROUP_SIZE);
@@ -1574,10 +1606,8 @@
 	return 0;
 
 err_tcam_init:
-	bitmap_free(tcam->used_groups);
-err_alloc_used_groups:
-	bitmap_free(tcam->used_regions);
-err_alloc_used_regions:
+	ida_destroy(&tcam->used_groups);
+	ida_destroy(&tcam->used_regions);
 	mlxsw_sp_acl_tcam_rehash_params_unregister(mlxsw_sp);
 err_rehash_params_register:
 	mutex_destroy(&tcam->lock);
@@ -1590,8 +1620,8 @@
 	const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops;
 
 	ops->fini(mlxsw_sp, tcam->priv);
-	bitmap_free(tcam->used_groups);
-	bitmap_free(tcam->used_regions);
+	ida_destroy(&tcam->used_groups);
+	ida_destroy(&tcam->used_regions);
 	mlxsw_sp_acl_tcam_rehash_params_unregister(mlxsw_sp);
 	mutex_destroy(&tcam->lock);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h
@@ -6,15 +6,16 @@
 
 #include <linux/list.h>
 #include <linux/parman.h>
+#include <linux/idr.h>
 
 #include "reg.h"
 #include "spectrum.h"
 #include "core_acl_flex_keys.h"
 
 struct mlxsw_sp_acl_tcam {
-	unsigned long *used_regions; /* bit array */
+	struct ida used_regions;
 	unsigned int max_regions;
-	unsigned long *used_groups;  /* bit array */
+	struct ida used_groups;
 	unsigned int max_groups;
 	unsigned int max_group_size;
 	struct mutex lock; /* guards vregion list */
@@ -166,9 +167,9 @@
 };
 
 struct mlxsw_sp_acl_atcam_entry_ht_key {
-	char full_enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN]; /* Encoded
-								 * key.
-								 */
+	char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN]; /* Encoded key, minus
+							    * delta bits.
+							    */
 	u8 erp_id;
 };
 
@@ -180,9 +181,6 @@
 	struct rhash_head ht_node;
 	struct list_head list; /* Member in entries_list */
 	struct mlxsw_sp_acl_atcam_entry_ht_key ht_key;
-	char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN]; /* Encoded key,
-							    * minus delta bits.
-							    */
 	struct {
 		u16 start;
 		u8 mask;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -1607,8 +1607,8 @@
 int mlxsw_sp_sb_occ_snapshot(struct mlxsw_core *mlxsw_core,
 			     unsigned int sb_index)
 {
+	u16 local_port, local_port_1, first_local_port, last_local_port;
 	struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core);
-	u16 local_port, local_port_1, last_local_port;
 	struct mlxsw_sp_sb_sr_occ_query_cb_ctx cb_ctx;
 	u8 masked_count, current_page = 0;
 	unsigned long cb_priv = 0;
@@ -1628,6 +1628,7 @@
 	masked_count = 0;
 	mlxsw_reg_sbsr_pack(sbsr_pl, false);
 	mlxsw_reg_sbsr_port_page_set(sbsr_pl, current_page);
+	first_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE;
 	last_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE +
 			  MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE - 1;
 
@@ -1645,9 +1646,12 @@
 		if (local_port != MLXSW_PORT_CPU_PORT) {
 			/* Ingress quotas are not supported for the CPU port */
 			mlxsw_reg_sbsr_ingress_port_mask_set(sbsr_pl,
-							     local_port, 1);
+							     local_port - first_local_port,
+							     1);
 		}
-		mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, local_port, 1);
+		mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl,
+						    local_port - first_local_port,
+						    1);
 		for (i = 0; i < mlxsw_sp->sb_vals->pool_count; i++) {
 			err = mlxsw_sp_sb_pm_occ_query(mlxsw_sp, local_port, i,
 						       &bulk_list);
@@ -1684,7 +1688,7 @@
 			      unsigned int sb_index)
 {
 	struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core);
-	u16 local_port, last_local_port;
+	u16 local_port, first_local_port, last_local_port;
 	LIST_HEAD(bulk_list);
 	unsigned int masked_count;
 	u8 current_page = 0;
@@ -1702,6 +1706,7 @@
 	masked_count = 0;
 	mlxsw_reg_sbsr_pack(sbsr_pl, true);
 	mlxsw_reg_sbsr_port_page_set(sbsr_pl, current_page);
+	first_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE;
 	last_local_port = current_page * MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE +
 			  MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE - 1;
 
@@ -1719,9 +1724,12 @@
 		if (local_port != MLXSW_PORT_CPU_PORT) {
 			/* Ingress quotas are not supported for the CPU port */
 			mlxsw_reg_sbsr_ingress_port_mask_set(sbsr_pl,
-							     local_port, 1);
+							     local_port - first_local_port,
+							     1);
 		}
-		mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl, local_port, 1);
+		mlxsw_reg_sbsr_egress_port_mask_set(sbsr_pl,
+						    local_port - first_local_port,
+						    1);
 		for (i = 0; i < mlxsw_sp->sb_vals->pool_count; i++) {
 			err = mlxsw_sp_sb_pm_occ_clear(mlxsw_sp, local_port, i,
 						       &bulk_list);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c
@@ -471,11 +471,33 @@
 				    struct mlxsw_sp_ipip_entry *ipip_entry,
 				    struct netlink_ext_ack *extack)
 {
+	u32 new_kvdl_index, old_kvdl_index = ipip_entry->dip_kvdl_index;
+	struct in6_addr old_addr6 = ipip_entry->parms.daddr.addr6;
 	struct mlxsw_sp_ipip_parms new_parms;
+	int err;
 
 	new_parms = mlxsw_sp_ipip_netdev_parms_init_gre6(ipip_entry->ol_dev);
-	return mlxsw_sp_ipip_ol_netdev_change_gre(mlxsw_sp, ipip_entry,
-						  &new_parms, extack);
+
+	err = mlxsw_sp_ipv6_addr_kvdl_index_get(mlxsw_sp,
+						&new_parms.daddr.addr6,
+						&new_kvdl_index);
+	if (err)
+		return err;
+	ipip_entry->dip_kvdl_index = new_kvdl_index;
+
+	err = mlxsw_sp_ipip_ol_netdev_change_gre(mlxsw_sp, ipip_entry,
+						 &new_parms, extack);
+	if (err)
+		goto err_change_gre;
+
+	mlxsw_sp_ipv6_addr_put(mlxsw_sp, &old_addr6);
+
+	return 0;
+
+err_change_gre:
+	ipip_entry->dip_kvdl_index = old_kvdl_index;
+	mlxsw_sp_ipv6_addr_put(mlxsw_sp, &new_parms.daddr.addr6);
+	return err;
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
@@ -16,6 +16,7 @@
 #include "spectrum.h"
 #include "spectrum_ptp.h"
 #include "core.h"
+#include "txheader.h"
 
 #define MLXSW_SP1_PTP_CLOCK_CYCLES_SHIFT	29
 #define MLXSW_SP1_PTP_CLOCK_FREQ_KHZ		156257 /* 6.4nSec */
@@ -1684,6 +1685,12 @@
 				 struct sk_buff *skb,
 				 const struct mlxsw_tx_info *tx_info)
 {
+	if (skb_cow_head(skb, MLXSW_TXHDR_LEN)) {
+		this_cpu_inc(mlxsw_sp_port->pcpu_stats->tx_dropped);
+		dev_kfree_skb_any(skb);
+		return -ENOMEM;
+	}
+
 	mlxsw_sp_txhdr_construct(skb, tx_info);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -501,7 +501,7 @@
 
 struct mlxsw_sp_lpm_tree {
 	u8 id; /* tree ID */
-	unsigned int ref_count;
+	refcount_t ref_count;
 	enum mlxsw_sp_l3proto proto;
 	unsigned long prefix_ref_count[MLXSW_SP_PREFIX_COUNT];
 	struct mlxsw_sp_prefix_usage prefix_usage;
@@ -578,7 +578,7 @@
 
 	for (i = 0; i < mlxsw_sp->router->lpm.tree_count; i++) {
 		lpm_tree = &mlxsw_sp->router->lpm.trees[i];
-		if (lpm_tree->ref_count == 0)
+		if (refcount_read(&lpm_tree->ref_count) == 0)
 			return lpm_tree;
 	}
 	return NULL;
@@ -654,7 +654,7 @@
 	       sizeof(lpm_tree->prefix_usage));
 	memset(&lpm_tree->prefix_ref_count, 0,
 	       sizeof(lpm_tree->prefix_ref_count));
-	lpm_tree->ref_count = 1;
+	refcount_set(&lpm_tree->ref_count, 1);
 	return lpm_tree;
 
 err_left_struct_set:
@@ -678,7 +678,7 @@
 
 	for (i = 0; i < mlxsw_sp->router->lpm.tree_count; i++) {
 		lpm_tree = &mlxsw_sp->router->lpm.trees[i];
-		if (lpm_tree->ref_count != 0 &&
+		if (refcount_read(&lpm_tree->ref_count) &&
 		    lpm_tree->proto == proto &&
 		    mlxsw_sp_prefix_usage_eq(&lpm_tree->prefix_usage,
 					     prefix_usage)) {
@@ -691,14 +691,15 @@
 
 static void mlxsw_sp_lpm_tree_hold(struct mlxsw_sp_lpm_tree *lpm_tree)
 {
-	lpm_tree->ref_count++;
+	refcount_inc(&lpm_tree->ref_count);
 }
 
 static void mlxsw_sp_lpm_tree_put(struct mlxsw_sp *mlxsw_sp,
 				  struct mlxsw_sp_lpm_tree *lpm_tree)
 {
-	if (--lpm_tree->ref_count == 0)
-		mlxsw_sp_lpm_tree_destroy(mlxsw_sp, lpm_tree);
+	if (!refcount_dec_and_test(&lpm_tree->ref_count))
+		return;
+	mlxsw_sp_lpm_tree_destroy(mlxsw_sp, lpm_tree);
 }
 
 #define MLXSW_SP_LPM_TREE_MIN 1 /* tree 0 is reserved */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
@@ -423,8 +423,7 @@
 
 	parms = mlxsw_sp_ipip_netdev_parms4(to_dev);
 	ip_tunnel_init_flow(&fl4, parms.iph.protocol, *daddrp, *saddrp,
-			    0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0,
-			    0);
+			    0, 0, tun->net, parms.link, tun->fwmark, 0, 0);
 
 	rt = ip_route_output_key(tun->net, &fl4);
 	if (IS_ERR(rt))
@@ -539,7 +538,7 @@
 	if (!dst || dst->error)
 		goto out;
 
-	rt6 = container_of(dst, struct rt6_info, dst);
+	rt6 = dst_rt6_info(dst);
 
 	dev = dst->dev;
 	*saddrp = fl6.saddr;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -61,7 +61,7 @@
 	struct mlxsw_sp_bridge_device *bridge_device;
 	struct list_head list;
 	struct list_head vlans_list;
-	unsigned int ref_count;
+	refcount_t ref_count;
 	u8 stp_state;
 	unsigned long flags;
 	bool mrouter;
@@ -495,7 +495,7 @@
 			     BR_MCAST_FLOOD;
 	INIT_LIST_HEAD(&bridge_port->vlans_list);
 	list_add(&bridge_port->list, &bridge_device->ports_list);
-	bridge_port->ref_count = 1;
+	refcount_set(&bridge_port->ref_count, 1);
 
 	err = switchdev_bridge_port_offload(brport_dev, mlxsw_sp_port->dev,
 					    NULL, NULL, NULL, false, extack);
@@ -531,7 +531,7 @@
 
 	bridge_port = mlxsw_sp_bridge_port_find(bridge, brport_dev);
 	if (bridge_port) {
-		bridge_port->ref_count++;
+		refcount_inc(&bridge_port->ref_count);
 		return bridge_port;
 	}
 
@@ -558,7 +558,7 @@
 {
 	struct mlxsw_sp_bridge_device *bridge_device;
 
-	if (--bridge_port->ref_count != 0)
+	if (!refcount_dec_and_test(&bridge_port->ref_count))
 		return;
 	bridge_device = bridge_port->bridge_device;
 	mlxsw_sp_bridge_port_destroy(bridge_port);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/micrel/ks8851.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/micrel/ks8851.h
@@ -368,7 +368,6 @@
  * @rdfifo: FIFO read callback
  * @wrfifo: FIFO write callback
  * @start_xmit: start_xmit() implementation callback
- * @rx_skb: rx_skb() implementation callback
  * @flush_tx_work: flush_tx_work() implementation callback
  *
  * The @statelock is used to protect information in the structure which may
@@ -423,8 +422,6 @@
 					  struct sk_buff *txp, bool irq);
 	netdev_tx_t		(*start_xmit)(struct sk_buff *skb,
 					      struct net_device *dev);
-	void			(*rx_skb)(struct ks8851_net *ks,
-					  struct sk_buff *skb);
 	void			(*flush_tx_work)(struct ks8851_net *ks);
 };
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/micrel/ks8851_common.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/micrel/ks8851_common.c
@@ -232,24 +232,15 @@
 }
 
 /**
- * ks8851_rx_skb - receive skbuff
- * @ks: The device state.
- * @skb: The skbuff
- */
-static void ks8851_rx_skb(struct ks8851_net *ks, struct sk_buff *skb)
-{
-	ks->rx_skb(ks, skb);
-}
-
-/**
  * ks8851_rx_pkts - receive packets from the host
  * @ks: The device information.
+ * @rxq: Queue of packets received in this function.
  *
  * This is called from the IRQ work queue when the system detects that there
  * are packets in the receive queue. Find out how many packets there are and
  * read them from the FIFO.
  */
-static void ks8851_rx_pkts(struct ks8851_net *ks)
+static void ks8851_rx_pkts(struct ks8851_net *ks, struct sk_buff_head *rxq)
 {
 	struct sk_buff *skb;
 	unsigned rxfc;
@@ -309,7 +300,7 @@
 					ks8851_dbg_dumpkkt(ks, rxpkt);
 
 				skb->protocol = eth_type_trans(skb, ks->netdev);
-				ks8851_rx_skb(ks, skb);
+				__skb_queue_tail(rxq, skb);
 
 				ks->netdev->stats.rx_packets++;
 				ks->netdev->stats.rx_bytes += rxlen;
@@ -336,63 +327,50 @@
 static irqreturn_t ks8851_irq(int irq, void *_ks)
 {
 	struct ks8851_net *ks = _ks;
-	unsigned handled = 0;
+	struct sk_buff_head rxq;
 	unsigned long flags;
 	unsigned int status;
+	struct sk_buff *skb;
 
 	ks8851_lock(ks, &flags);
 
 	status = ks8851_rdreg16(ks, KS_ISR);
+	ks8851_wrreg16(ks, KS_ISR, status);
 
 	netif_dbg(ks, intr, ks->netdev,
 		  "%s: status 0x%04x\n", __func__, status);
 
-	if (status & IRQ_LCI)
-		handled |= IRQ_LCI;
-
 	if (status & IRQ_LDI) {
 		u16 pmecr = ks8851_rdreg16(ks, KS_PMECR);
 		pmecr &= ~PMECR_WKEVT_MASK;
 		ks8851_wrreg16(ks, KS_PMECR, pmecr | PMECR_WKEVT_LINK);
-
-		handled |= IRQ_LDI;
 	}
 
-	if (status & IRQ_RXPSI)
-		handled |= IRQ_RXPSI;
-
 	if (status & IRQ_TXI) {
 		unsigned short tx_space = ks8851_rdreg16(ks, KS_TXMIR);
 
 		netif_dbg(ks, intr, ks->netdev,
 			  "%s: txspace %d\n", __func__, tx_space);
 
-		spin_lock(&ks->statelock);
+		spin_lock_bh(&ks->statelock);
 		ks->tx_space = tx_space;
 		if (netif_queue_stopped(ks->netdev))
 			netif_wake_queue(ks->netdev);
-		spin_unlock(&ks->statelock);
-
-		handled |= IRQ_TXI;
+		spin_unlock_bh(&ks->statelock);
 	}
 
-	if (status & IRQ_RXI)
-		handled |= IRQ_RXI;
-
 	if (status & IRQ_SPIBEI) {
 		netdev_err(ks->netdev, "%s: spi bus error\n", __func__);
-		handled |= IRQ_SPIBEI;
 	}
 
-	ks8851_wrreg16(ks, KS_ISR, handled);
-
 	if (status & IRQ_RXI) {
 		/* the datasheet says to disable the rx interrupt during
 		 * packet read-out, however we're masking the interrupt
 		 * from the device so do not bother masking just the RX
 		 * from the device. */
 
-		ks8851_rx_pkts(ks);
+		__skb_queue_head_init(&rxq);
+		ks8851_rx_pkts(ks, &rxq);
 	}
 
 	/* if something stopped the rx process, probably due to wanting
@@ -416,6 +394,10 @@
 	if (status & IRQ_LCI)
 		mii_check_link(&ks->mii);
 
+	if (status & IRQ_RXI)
+		while ((skb = __skb_dequeue(&rxq)))
+			netif_rx(skb);
+
 	return IRQ_HANDLED;
 }
 
@@ -500,6 +482,7 @@
 	ks8851_wrreg16(ks, KS_IER, ks->rc_ier);
 
 	ks->queued_len = 0;
+	ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR);
 	netif_start_queue(ks->netdev);
 
 	netif_dbg(ks, ifup, ks->netdev, "network device up\n");
@@ -653,14 +636,14 @@
 
 	/* schedule work to do the actual set of the data if needed */
 
-	spin_lock(&ks->statelock);
+	spin_lock_bh(&ks->statelock);
 
 	if (memcmp(&rxctrl, &ks->rxctrl, sizeof(rxctrl)) != 0) {
 		memcpy(&ks->rxctrl, &rxctrl, sizeof(ks->rxctrl));
 		schedule_work(&ks->rxctrl_work);
 	}
 
-	spin_unlock(&ks->statelock);
+	spin_unlock_bh(&ks->statelock);
 }
 
 static int ks8851_set_mac_address(struct net_device *dev, void *addr)
@@ -1119,7 +1102,6 @@
 	int ret;
 
 	ks->netdev = netdev;
-	ks->tx_space = 6144;
 
 	ks->gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
 	ret = PTR_ERR_OR_ZERO(ks->gpio);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/micrel/ks8851_par.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/micrel/ks8851_par.c
@@ -210,16 +210,6 @@
 	iowrite16_rep(ksp->hw_addr, txp->data, len / 2);
 }
 
-/**
- * ks8851_rx_skb_par - receive skbuff
- * @ks: The device state.
- * @skb: The skbuff
- */
-static void ks8851_rx_skb_par(struct ks8851_net *ks, struct sk_buff *skb)
-{
-	netif_rx(skb);
-}
-
 static unsigned int ks8851_rdreg16_par_txqcr(struct ks8851_net *ks)
 {
 	return ks8851_rdreg16_par(ks, KS_TXQCR);
@@ -298,7 +288,6 @@
 	ks->rdfifo = ks8851_rdfifo_par;
 	ks->wrfifo = ks8851_wrfifo_par;
 	ks->start_xmit = ks8851_start_xmit_par;
-	ks->rx_skb = ks8851_rx_skb_par;
 
 #define STD_IRQ (IRQ_LCI |	/* Link Change */	\
 		 IRQ_RXI |	/* RX done */		\
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/micrel/ks8851_spi.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/micrel/ks8851_spi.c
@@ -299,16 +299,6 @@
 }
 
 /**
- * ks8851_rx_skb_spi - receive skbuff
- * @ks: The device state
- * @skb: The skbuff
- */
-static void ks8851_rx_skb_spi(struct ks8851_net *ks, struct sk_buff *skb)
-{
-	netif_rx(skb);
-}
-
-/**
  * ks8851_tx_work - process tx packet(s)
  * @work: The work strucutre what was scheduled.
  *
@@ -350,10 +340,10 @@
 
 	tx_space = ks8851_rdreg16_spi(ks, KS_TXMIR);
 
-	spin_lock(&ks->statelock);
+	spin_lock_bh(&ks->statelock);
 	ks->queued_len -= dequeued_len;
 	ks->tx_space = tx_space;
-	spin_unlock(&ks->statelock);
+	spin_unlock_bh(&ks->statelock);
 
 	ks8851_unlock_spi(ks, &flags);
 }
@@ -435,7 +425,6 @@
 	ks->rdfifo = ks8851_rdfifo_spi;
 	ks->wrfifo = ks8851_wrfifo_spi;
 	ks->start_xmit = ks8851_start_xmit_spi;
-	ks->rx_skb = ks8851_rx_skb_spi;
 	ks->flush_tx_work = ks8851_flush_tx_work_spi;
 
 #define STD_IRQ (IRQ_LCI |	/* Link Change */	\
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microchip/lan743x_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microchip/lan743x_ethtool.c
@@ -1148,8 +1148,12 @@
 	if (netdev->phydev)
 		phy_ethtool_get_wol(netdev->phydev, wol);
 
-	wol->supported |= WAKE_BCAST | WAKE_UCAST | WAKE_MCAST |
-		WAKE_MAGIC | WAKE_PHY | WAKE_ARP;
+	if (wol->supported != adapter->phy_wol_supported)
+		netif_warn(adapter, drv, adapter->netdev,
+			   "PHY changed its supported WOL! old=%x, new=%x\n",
+			   adapter->phy_wol_supported, wol->supported);
+
+	wol->supported |= MAC_SUPPORTED_WAKES;
 
 	if (adapter->is_pci11x1x)
 		wol->supported |= WAKE_MAGICSECURE;
@@ -1164,7 +1168,39 @@
 {
 	struct lan743x_adapter *adapter = netdev_priv(netdev);
 
+	/* WAKE_MAGICSEGURE is a modifier of and only valid together with
+	 * WAKE_MAGIC
+	 */
+	if ((wol->wolopts & WAKE_MAGICSECURE) && !(wol->wolopts & WAKE_MAGIC))
+		return -EINVAL;
+
+	if (netdev->phydev) {
+		struct ethtool_wolinfo phy_wol;
+		int ret;
+
+		phy_wol.wolopts = wol->wolopts & adapter->phy_wol_supported;
+
+		/* If WAKE_MAGICSECURE was requested, filter out WAKE_MAGIC
+		 * for PHYs that do not support WAKE_MAGICSECURE
+		 */
+		if (wol->wolopts & WAKE_MAGICSECURE &&
+		    !(adapter->phy_wol_supported & WAKE_MAGICSECURE))
+			phy_wol.wolopts &= ~WAKE_MAGIC;
+
+		ret = phy_ethtool_set_wol(netdev->phydev, &phy_wol);
+		if (ret && (ret != -EOPNOTSUPP))
+			return ret;
+
+		if (ret == -EOPNOTSUPP)
+			adapter->phy_wolopts = 0;
+		else
+			adapter->phy_wolopts = phy_wol.wolopts;
+	} else {
+		adapter->phy_wolopts = 0;
+	}
+
 	adapter->wolopts = 0;
+	wol->wolopts &= ~adapter->phy_wolopts;
 	if (wol->wolopts & WAKE_UCAST)
 		adapter->wolopts |= WAKE_UCAST;
 	if (wol->wolopts & WAKE_MCAST)
@@ -1185,10 +1221,10 @@
 		memset(adapter->sopass, 0, sizeof(u8) * SOPASS_MAX);
 	}
 
+	wol->wolopts = adapter->wolopts | adapter->phy_wolopts;
 	device_set_wakeup_enable(&adapter->pdev->dev, (bool)wol->wolopts);
 
-	return netdev->phydev ? phy_ethtool_set_wol(netdev->phydev, wol)
-			: -ENETDOWN;
+	return 0;
 }
 #endif /* CONFIG_PM */
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microchip/lan743x_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microchip/lan743x_main.c
@@ -25,6 +25,8 @@
 #define PCS_POWER_STATE_DOWN	0x6
 #define PCS_POWER_STATE_UP	0x4
 
+#define RFE_RD_FIFO_TH_3_DWORDS	0x3
+
 static void pci11x1x_strap_get_status(struct lan743x_adapter *adapter)
 {
 	u32 chip_rev;
@@ -3109,6 +3111,17 @@
 		if (ret)
 			goto close_tx;
 	}
+
+#ifdef CONFIG_PM
+	if (adapter->netdev->phydev) {
+		struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
+
+		phy_ethtool_get_wol(netdev->phydev, &wol);
+		adapter->phy_wol_supported = wol.supported;
+		adapter->phy_wolopts = wol.wolopts;
+	}
+#endif
+
 	return 0;
 
 close_tx:
@@ -3272,6 +3285,21 @@
 	lan743x_pci_cleanup(adapter);
 }
 
+static void pci11x1x_set_rfe_rd_fifo_threshold(struct lan743x_adapter *adapter)
+{
+	u16 rev = adapter->csr.id_rev & ID_REV_CHIP_REV_MASK_;
+
+	if (rev == ID_REV_CHIP_REV_PCI11X1X_B0_) {
+		u32 misc_ctl;
+
+		misc_ctl = lan743x_csr_read(adapter, MISC_CTL_0);
+		misc_ctl &= ~MISC_CTL_0_RFE_READ_FIFO_MASK_;
+		misc_ctl |= FIELD_PREP(MISC_CTL_0_RFE_READ_FIFO_MASK_,
+				       RFE_RD_FIFO_TH_3_DWORDS);
+		lan743x_csr_write(adapter, MISC_CTL_0, misc_ctl);
+	}
+}
+
 static int lan743x_hardware_init(struct lan743x_adapter *adapter,
 				 struct pci_dev *pdev)
 {
@@ -3287,6 +3315,7 @@
 		pci11x1x_strap_get_status(adapter);
 		spin_lock_init(&adapter->eth_syslock_spinlock);
 		mutex_init(&adapter->sgmii_rw_lock);
+		pci11x1x_set_rfe_rd_fifo_threshold(adapter);
 	} else {
 		adapter->max_tx_channels = LAN743X_MAX_TX_CHANNELS;
 		adapter->used_tx_channels = LAN743X_USED_TX_CHANNELS;
@@ -3550,7 +3579,7 @@
 
 	/* clear wake settings */
 	pmtctl = lan743x_csr_read(adapter, PMT_CTL);
-	pmtctl |= PMT_CTL_WUPS_MASK_;
+	pmtctl |= PMT_CTL_WUPS_MASK_ | PMT_CTL_RES_CLR_WKP_MASK_;
 	pmtctl &= ~(PMT_CTL_GPIO_WAKEUP_EN_ | PMT_CTL_EEE_WAKEUP_EN_ |
 		PMT_CTL_WOL_EN_ | PMT_CTL_MAC_D3_RX_CLK_OVR_ |
 		PMT_CTL_RX_FCT_RFE_D3_CLK_OVR_ | PMT_CTL_ETH_PHY_WAKE_EN_);
@@ -3562,10 +3591,9 @@
 
 	pmtctl |= PMT_CTL_ETH_PHY_D3_COLD_OVR_ | PMT_CTL_ETH_PHY_D3_OVR_;
 
-	if (adapter->wolopts & WAKE_PHY) {
-		pmtctl |= PMT_CTL_ETH_PHY_EDPD_PLL_CTL_;
+	if (adapter->phy_wolopts)
 		pmtctl |= PMT_CTL_ETH_PHY_WAKE_EN_;
-	}
+
 	if (adapter->wolopts & WAKE_MAGIC) {
 		wucsr |= MAC_WUCSR_MPEN_;
 		macrx |= MAC_RX_RXEN_;
@@ -3661,7 +3689,7 @@
 	lan743x_csr_write(adapter, MAC_WUCSR2, 0);
 	lan743x_csr_write(adapter, MAC_WK_SRC, 0xFFFFFFFF);
 
-	if (adapter->wolopts)
+	if (adapter->wolopts || adapter->phy_wolopts)
 		lan743x_pm_set_wol(adapter);
 
 	if (adapter->is_pci11x1x) {
@@ -3685,6 +3713,7 @@
 	struct pci_dev *pdev = to_pci_dev(dev);
 	struct net_device *netdev = pci_get_drvdata(pdev);
 	struct lan743x_adapter *adapter = netdev_priv(netdev);
+	u32 data;
 	int ret;
 
 	pci_set_power_state(pdev, PCI_D0);
@@ -3703,6 +3732,30 @@
 		return ret;
 	}
 
+	ret = lan743x_csr_read(adapter, MAC_WK_SRC);
+	netif_dbg(adapter, drv, adapter->netdev,
+		  "Wakeup source : 0x%08X\n", ret);
+
+	/* Clear the wol configuration and status bits. Note that
+	 * the status bits are "Write One to Clear (W1C)"
+	 */
+	data = MAC_WUCSR_EEE_TX_WAKE_ | MAC_WUCSR_EEE_RX_WAKE_ |
+	       MAC_WUCSR_RFE_WAKE_FR_ | MAC_WUCSR_PFDA_FR_ | MAC_WUCSR_WUFR_ |
+	       MAC_WUCSR_MPR_ | MAC_WUCSR_BCAST_FR_;
+	lan743x_csr_write(adapter, MAC_WUCSR, data);
+
+	data = MAC_WUCSR2_NS_RCD_ | MAC_WUCSR2_ARP_RCD_ |
+	       MAC_WUCSR2_IPV6_TCPSYN_RCD_ | MAC_WUCSR2_IPV4_TCPSYN_RCD_;
+	lan743x_csr_write(adapter, MAC_WUCSR2, data);
+
+	data = MAC_WK_SRC_ETH_PHY_WK_ | MAC_WK_SRC_IPV6_TCPSYN_RCD_WK_ |
+	       MAC_WK_SRC_IPV4_TCPSYN_RCD_WK_ | MAC_WK_SRC_EEE_TX_WK_ |
+	       MAC_WK_SRC_EEE_RX_WK_ | MAC_WK_SRC_RFE_FR_WK_ |
+	       MAC_WK_SRC_PFDA_FR_WK_ | MAC_WK_SRC_MP_FR_WK_ |
+	       MAC_WK_SRC_BCAST_FR_WK_ | MAC_WK_SRC_WU_FR_WK_ |
+	       MAC_WK_SRC_WK_FR_SAVED_;
+	lan743x_csr_write(adapter, MAC_WK_SRC, data);
+
 	/* open netdev when netdev is at running state while resume.
 	 * For instance, it is true when system wakesup after pm-suspend
 	 * However, it is false when system wakes up after suspend GUI menu
@@ -3711,9 +3764,6 @@
 		lan743x_netdev_open(netdev);
 
 	netif_device_attach(netdev);
-	ret = lan743x_csr_read(adapter, MAC_WK_SRC);
-	netif_info(adapter, drv, adapter->netdev,
-		   "Wakeup source : 0x%08X\n", ret);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microchip/lan743x_main.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/microchip/lan743x_main.h
@@ -26,6 +26,7 @@
 #define ID_REV_CHIP_REV_MASK_		(0x0000FFFF)
 #define ID_REV_CHIP_REV_A0_		(0x00000000)
 #define ID_REV_CHIP_REV_B0_		(0x00000010)
+#define ID_REV_CHIP_REV_PCI11X1X_B0_	(0x000000B0)
 
 #define FPGA_REV			(0x04)
 #define FPGA_REV_GET_MINOR_(fpga_rev)	(((fpga_rev) >> 8) & 0x000000FF)
@@ -60,6 +61,7 @@
 #define PMT_CTL_RX_FCT_RFE_D3_CLK_OVR_		BIT(18)
 #define PMT_CTL_GPIO_WAKEUP_EN_			BIT(15)
 #define PMT_CTL_EEE_WAKEUP_EN_			BIT(13)
+#define PMT_CTL_RES_CLR_WKP_MASK_		GENMASK(9, 8)
 #define PMT_CTL_READY_				BIT(7)
 #define PMT_CTL_ETH_PHY_RST_			BIT(4)
 #define PMT_CTL_WOL_EN_				BIT(3)
@@ -226,12 +228,31 @@
 #define MAC_WUCSR				(0x140)
 #define MAC_MP_SO_EN_				BIT(21)
 #define MAC_WUCSR_RFE_WAKE_EN_			BIT(14)
+#define MAC_WUCSR_EEE_TX_WAKE_			BIT(13)
+#define MAC_WUCSR_EEE_RX_WAKE_			BIT(11)
+#define MAC_WUCSR_RFE_WAKE_FR_			BIT(9)
+#define MAC_WUCSR_PFDA_FR_			BIT(7)
+#define MAC_WUCSR_WUFR_				BIT(6)
+#define MAC_WUCSR_MPR_				BIT(5)
+#define MAC_WUCSR_BCAST_FR_			BIT(4)
 #define MAC_WUCSR_PFDA_EN_			BIT(3)
 #define MAC_WUCSR_WAKE_EN_			BIT(2)
 #define MAC_WUCSR_MPEN_				BIT(1)
 #define MAC_WUCSR_BCST_EN_			BIT(0)
 
 #define MAC_WK_SRC				(0x144)
+#define MAC_WK_SRC_ETH_PHY_WK_			BIT(17)
+#define MAC_WK_SRC_IPV6_TCPSYN_RCD_WK_		BIT(16)
+#define MAC_WK_SRC_IPV4_TCPSYN_RCD_WK_		BIT(15)
+#define MAC_WK_SRC_EEE_TX_WK_			BIT(14)
+#define MAC_WK_SRC_EEE_RX_WK_			BIT(13)
+#define MAC_WK_SRC_RFE_FR_WK_			BIT(12)
+#define MAC_WK_SRC_PFDA_FR_WK_			BIT(11)
+#define MAC_WK_SRC_MP_FR_WK_			BIT(10)
+#define MAC_WK_SRC_BCAST_FR_WK_			BIT(9)
+#define MAC_WK_SRC_WU_FR_WK_			BIT(8)
+#define MAC_WK_SRC_WK_FR_SAVED_			BIT(7)
+
 #define MAC_MP_SO_HI				(0x148)
 #define MAC_MP_SO_LO				(0x14C)
 
@@ -294,6 +315,10 @@
 #define RFE_INDX(index)			(0x580 + (index << 2))
 
 #define MAC_WUCSR2			(0x600)
+#define MAC_WUCSR2_NS_RCD_		BIT(7)
+#define MAC_WUCSR2_ARP_RCD_		BIT(6)
+#define MAC_WUCSR2_IPV6_TCPSYN_RCD_	BIT(5)
+#define MAC_WUCSR2_IPV4_TCPSYN_RCD_	BIT(4)
 
 #define SGMII_ACC			(0x720)
 #define SGMII_ACC_SGMII_BZY_		BIT(31)
@@ -311,6 +336,9 @@
 #define SGMII_CTL_LINK_STATUS_SOURCE_	BIT(8)
 #define SGMII_CTL_SGMII_POWER_DN_	BIT(1)
 
+#define MISC_CTL_0			(0x920)
+#define MISC_CTL_0_RFE_READ_FIFO_MASK_	GENMASK(6, 4)
+
 /* Vendor Specific SGMII MMD details */
 #define SR_VSMMD_PCS_ID1		0x0004
 #define SR_VSMMD_PCS_ID2		0x0005
@@ -1014,6 +1042,8 @@
 	LINK_2500_SLAVE
 };
 
+#define MAC_SUPPORTED_WAKES  (WAKE_BCAST | WAKE_UCAST | WAKE_MCAST | \
+			      WAKE_MAGIC | WAKE_ARP)
 struct lan743x_adapter {
 	struct net_device       *netdev;
 	struct mii_bus		*mdiobus;
@@ -1021,6 +1051,8 @@
 #ifdef CONFIG_PM
 	u32			wolopts;
 	u8			sopass[SOPASS_MAX];
+	u32			phy_wolopts;
+	u32			phy_wol_supported;
 #endif
 	struct pci_dev		*pdev;
 	struct lan743x_csr      csr;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
@@ -474,14 +474,14 @@
 	    cfg->source != HWTSTAMP_SOURCE_PHYLIB)
 		return -EOPNOTSUPP;
 
+	if (cfg->source == HWTSTAMP_SOURCE_NETDEV && !port->lan966x->ptp)
+		return -EOPNOTSUPP;
+
 	err = lan966x_ptp_setup_traps(port, cfg);
 	if (err)
 		return err;
 
 	if (cfg->source == HWTSTAMP_SOURCE_NETDEV) {
-		if (!port->lan966x->ptp)
-			return -EOPNOTSUPP;
-
 		err = lan966x_ptp_hwtstamp_set(port, cfg, extack);
 		if (err) {
 			lan966x_ptp_del_traps(port);
@@ -1087,8 +1087,6 @@
 	platform_set_drvdata(pdev, lan966x);
 	lan966x->dev = &pdev->dev;
 
-	lan966x->debugfs_root = debugfs_create_dir("lan966x", NULL);
-
 	if (!device_get_mac_address(&pdev->dev, mac_addr)) {
 		ether_addr_copy(lan966x->base_mac, mac_addr);
 	} else {
@@ -1179,6 +1177,8 @@
 		return dev_err_probe(&pdev->dev, -ENODEV,
 				     "no ethernet-ports child found\n");
 
+	lan966x->debugfs_root = debugfs_create_dir("lan966x", NULL);
+
 	/* init switch */
 	lan966x_init(lan966x);
 	lan966x_stats_init(lan966x);
@@ -1257,6 +1257,8 @@
 	destroy_workqueue(lan966x->stats_queue);
 	mutex_destroy(&lan966x->stats_lock);
 
+	debugfs_remove_recursive(lan966x->debugfs_root);
+
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
@@ -693,12 +693,11 @@
 	err = -ENXIO;
 	if (sparx5->fdma_irq >= 0) {
 		if (GCB_CHIP_ID_REV_ID_GET(sparx5->chip_id) > 0)
-			err = devm_request_threaded_irq(sparx5->dev,
-							sparx5->fdma_irq,
-							NULL,
-							sparx5_fdma_handler,
-							IRQF_ONESHOT,
-							"sparx5-fdma", sparx5);
+			err = devm_request_irq(sparx5->dev,
+					       sparx5->fdma_irq,
+					       sparx5_fdma_handler,
+					       0,
+					       "sparx5-fdma", sparx5);
 		if (!err)
 			err = sparx5_fdma_start(sparx5);
 		if (err)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microchip/sparx5/sparx5_packet.c
@@ -45,8 +45,12 @@
 	fwd = (fwd >> 5);
 	info->src_port = FIELD_GET(GENMASK(7, 1), fwd);
 
+	/*
+	 * Bit 270-271 are occasionally unexpectedly set by the hardware,
+	 * clear bits before extracting timestamp
+	 */
 	info->timestamp =
-		((u64)xtr_hdr[2] << 24) |
+		((u64)(xtr_hdr[2] & GENMASK(5, 0)) << 24) |
 		((u64)xtr_hdr[3] << 16) |
 		((u64)xtr_hdr[4] <<  8) |
 		((u64)xtr_hdr[5] <<  0);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microchip/sparx5/sparx5_port.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microchip/sparx5/sparx5_port.c
@@ -731,7 +731,7 @@
 	bool sgmii = false, inband_aneg = false;
 	int err;
 
-	if (port->conf.inband) {
+	if (conf->inband) {
 		if (conf->portmode == PHY_INTERFACE_MODE_SGMII ||
 		    conf->portmode == PHY_INTERFACE_MODE_QSGMII)
 			inband_aneg = true; /* Cisco-SGMII in-band-aneg */
@@ -948,7 +948,7 @@
 	if (err)
 		return -EINVAL;
 
-	if (port->conf.inband) {
+	if (conf->inband) {
 		/* Enable/disable 1G counters in ASM */
 		spx5_rmw(ASM_PORT_CFG_CSC_STAT_DIS_SET(high_speed_dev),
 			 ASM_PORT_CFG_CSC_STAT_DIS,
@@ -1119,7 +1119,7 @@
 	spx5_inst_rmw(DEV10G_MAC_MAXLEN_CFG_MAX_LEN_SET(ETH_MAXLEN),
 		      DEV10G_MAC_MAXLEN_CFG_MAX_LEN,
 		      devinst,
-		      DEV10G_MAC_ENA_CFG(0));
+		      DEV10G_MAC_MAXLEN_CFG(0));
 
 	/* Handle Signal Detect in 10G PCS */
 	spx5_inst_wr(PCS10G_BR_PCS_SD_CFG_SD_POL_SET(sd_pol) |
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microchip/sparx5/sparx5_tc_flower.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microchip/sparx5/sparx5_tc_flower.c
@@ -36,6 +36,27 @@
 	u16 l3_proto; /* protocol specified in the template */
 };
 
+/* SparX-5 VCAP fragment types:
+ * 0 = no fragment, 1 = initial fragment,
+ * 2 = suspicious fragment, 3 = valid follow-up fragment
+ */
+enum {                   /* key / mask */
+	FRAG_NOT   = 0x03, /* 0 / 3 */
+	FRAG_SOME  = 0x11, /* 1 / 1 */
+	FRAG_FIRST = 0x13, /* 1 / 3 */
+	FRAG_LATER = 0x33, /* 3 / 3 */
+	FRAG_INVAL = 0xff, /* invalid */
+};
+
+/* Flower fragment flag to VCAP fragment type mapping */
+static const u8 sparx5_vcap_frag_map[4][4] = {		  /* is_frag */
+	{ FRAG_INVAL, FRAG_INVAL, FRAG_INVAL, FRAG_FIRST }, /* 0/0 */
+	{ FRAG_NOT,   FRAG_NOT,   FRAG_INVAL, FRAG_INVAL }, /* 0/1 */
+	{ FRAG_INVAL, FRAG_INVAL, FRAG_INVAL, FRAG_INVAL }, /* 1/0 */
+	{ FRAG_SOME,  FRAG_LATER, FRAG_INVAL, FRAG_FIRST }  /* 1/1 */
+	/* 0/0	      0/1	  1/0	      1/1 <-- first_frag */
+};
+
 static int
 sparx5_tc_flower_es0_tpid(struct vcap_tc_flower_parse_usage *st)
 {
@@ -145,29 +166,27 @@
 	flow_rule_match_control(st->frule, &mt);
 
 	if (mt.mask->flags) {
-		if (mt.mask->flags & FLOW_DIS_FIRST_FRAG) {
-			if (mt.key->flags & FLOW_DIS_FIRST_FRAG) {
-				value = 1; /* initial fragment */
-				mask = 0x3;
-			} else {
-				if (mt.mask->flags & FLOW_DIS_IS_FRAGMENT) {
-					value = 3; /* follow up fragment */
-					mask = 0x3;
-				} else {
-					value = 0; /* no fragment */
-					mask = 0x3;
-				}
-			}
-		} else {
-			if (mt.mask->flags & FLOW_DIS_IS_FRAGMENT) {
-				value = 3; /* follow up fragment */
-				mask = 0x3;
-			} else {
-				value = 0; /* no fragment */
-				mask = 0x3;
-			}
+		u8 is_frag_key = !!(mt.key->flags & FLOW_DIS_IS_FRAGMENT);
+		u8 is_frag_mask = !!(mt.mask->flags & FLOW_DIS_IS_FRAGMENT);
+		u8 is_frag_idx = (is_frag_key << 1) | is_frag_mask;
+
+		u8 first_frag_key = !!(mt.key->flags & FLOW_DIS_FIRST_FRAG);
+		u8 first_frag_mask = !!(mt.mask->flags & FLOW_DIS_FIRST_FRAG);
+		u8 first_frag_idx = (first_frag_key << 1) | first_frag_mask;
+
+		/* Lookup verdict based on the 2 + 2 input bits */
+		u8 vdt = sparx5_vcap_frag_map[is_frag_idx][first_frag_idx];
+
+		if (vdt == FRAG_INVAL) {
+			NL_SET_ERR_MSG_MOD(st->fco->common.extack,
+					   "Match on invalid fragment flag combination");
+			return -EINVAL;
 		}
 
+		/* Extract VCAP fragment key and mask from verdict */
+		value = (vdt >> 4) & 0x3;
+		mask = vdt & 0x3;
+
 		err = vcap_rule_add_key_u32(st->vrule,
 					    VCAP_KF_L3_FRAGMENT_TYPE,
 					    value, mask);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
@@ -366,12 +366,13 @@
 	struct vcap_typegroup typegroups[] = {
 		{ .offset = 0, .width = 2, .value = 2, },
 		{ .offset = 156, .width = 1, .value = 0, },
-		{ .offset = 0, .width = 0, .value = 0, },
+		{ }
 	};
 	struct vcap_typegroup typegroups2[] = {
 		{ .offset = 0, .width = 3, .value = 4, },
 		{ .offset = 49, .width = 2, .value = 0, },
 		{ .offset = 98, .width = 2, .value = 0, },
+		{ }
 	};
 
 	vcap_iter_init(&iter, 52, typegroups, 86);
@@ -399,6 +400,7 @@
 		{ .offset = 147, .width = 3, .value = 0, },
 		{ .offset = 196, .width = 2, .value = 0, },
 		{ .offset = 245, .width = 1, .value = 0, },
+		{ }
 	};
 	int idx;
 
@@ -433,7 +435,7 @@
 		{ .offset = 147, .width = 3, .value = 5, },
 		{ .offset = 196, .width = 2, .value = 2, },
 		{ .offset = 245, .width = 5, .value = 27, },
-		{ .offset = 0, .width = 0, .value = 0, },
+		{ }
 	};
 
 	vcap_encode_typegroups(stream, 49, typegroups, false);
@@ -463,6 +465,7 @@
 		{ .offset = 147, .width = 3, .value = 5, },
 		{ .offset = 196, .width = 2, .value = 2, },
 		{ .offset = 245, .width = 1, .value = 0, },
+		{ }
 	};
 
 	vcap_iter_init(&iter, 49, typegroups, 44);
@@ -489,7 +492,7 @@
 		{ .offset = 147, .width = 3, .value = 5, },
 		{ .offset = 196, .width = 2, .value = 2, },
 		{ .offset = 245, .width = 5, .value = 27, },
-		{ .offset = 0, .width = 0, .value = 0, },
+		{ }
 	};
 	struct vcap_field rf = {
 		.type = VCAP_FIELD_U32,
@@ -538,7 +541,7 @@
 		{ .offset = 0, .width = 3, .value = 7, },
 		{ .offset = 21, .width = 2, .value = 3, },
 		{ .offset = 42, .width = 1, .value = 1, },
-		{ .offset = 0, .width = 0, .value = 0, },
+		{ }
 	};
 	struct vcap_field rf = {
 		.type = VCAP_FIELD_U32,
@@ -608,7 +611,7 @@
 	struct vcap_typegroup tgt[] = {
 		{ .offset = 0, .width = 2, .value = 2, },
 		{ .offset = 156, .width = 1, .value = 1, },
-		{ .offset = 0, .width = 0, .value = 0, },
+		{ }
 	};
 
 	vcap_test_api_init(&admin);
@@ -671,7 +674,7 @@
 	struct vcap_typegroup tgt[] = {
 		{ .offset = 0, .width = 2, .value = 2, },
 		{ .offset = 156, .width = 1, .value = 1, },
-		{ .offset = 0, .width = 0, .value = 0, },
+		{ }
 	};
 	u32 keyres[] = {
 		0x928e8a84,
@@ -732,7 +735,7 @@
 		{ .offset = 0, .width = 2, .value = 2, },
 		{ .offset = 21, .width = 1, .value = 1, },
 		{ .offset = 42, .width = 1, .value = 0, },
-		{ .offset = 0, .width = 0, .value = 0, },
+		{ }
 	};
 
 	vcap_encode_actionfield(&rule, &caf, &rf, tgt);
@@ -1442,18 +1445,10 @@
 	vcap_enable_lookups(&test_vctrl, &test_netdev, 0, 0,
 			    rule->cookie, false);
 
-	vcap_free_rule(rule);
-
-	/* Check that the rule has been freed: tricky to access since this
-	 * memory should not be accessible anymore
-	 */
-	KUNIT_EXPECT_PTR_NE(test, NULL, rule);
-	ret = list_empty(&rule->keyfields);
-	KUNIT_EXPECT_EQ(test, true, ret);
-	ret = list_empty(&rule->actionfields);
-	KUNIT_EXPECT_EQ(test, true, ret);
+	ret = vcap_del_rule(&test_vctrl, &test_netdev, id);
+	KUNIT_EXPECT_EQ(test, 0, ret);
 
-	vcap_del_rule(&test_vctrl, &test_netdev, id);
+	vcap_free_rule(rule);
 }
 
 static void vcap_api_set_rule_counter_test(struct kunit *test)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microsoft/Kconfig
+++ linux-qcom-6.8.0/drivers/net/ethernet/microsoft/Kconfig
@@ -17,7 +17,8 @@
 
 config MICROSOFT_MANA
 	tristate "Microsoft Azure Network Adapter (MANA) support"
-	depends on PCI_MSI && X86_64
+	depends on PCI_MSI
+	depends on X86_64 || (ARM64 && !CPU_BIG_ENDIAN)
 	depends on PCI_HYPERV
 	select AUXILIARY_BUS
 	select PAGE_POOL
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microsoft/mana/gdma_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microsoft/mana/gdma_main.c
@@ -182,7 +182,7 @@
 	dma_addr_t dma_handle;
 	void *buf;
 
-	if (length < PAGE_SIZE || !is_power_of_2(length))
+	if (length < MANA_PAGE_SIZE || !is_power_of_2(length))
 		return -EINVAL;
 
 	gmi->dev = gc->dev;
@@ -717,7 +717,7 @@
 static int mana_gd_create_dma_region(struct gdma_dev *gd,
 				     struct gdma_mem_info *gmi)
 {
-	unsigned int num_page = gmi->length / PAGE_SIZE;
+	unsigned int num_page = gmi->length / MANA_PAGE_SIZE;
 	struct gdma_create_dma_region_req *req = NULL;
 	struct gdma_create_dma_region_resp resp = {};
 	struct gdma_context *gc = gd->gdma_context;
@@ -727,10 +727,10 @@
 	int err;
 	int i;
 
-	if (length < PAGE_SIZE || !is_power_of_2(length))
+	if (length < MANA_PAGE_SIZE || !is_power_of_2(length))
 		return -EINVAL;
 
-	if (offset_in_page(gmi->virt_addr) != 0)
+	if (!MANA_PAGE_ALIGNED(gmi->virt_addr))
 		return -EINVAL;
 
 	hwc = gc->hwc.driver_data;
@@ -751,7 +751,7 @@
 	req->page_addr_list_len = num_page;
 
 	for (i = 0; i < num_page; i++)
-		req->page_addr_list[i] = gmi->dma_handle +  i * PAGE_SIZE;
+		req->page_addr_list[i] = gmi->dma_handle +  i * MANA_PAGE_SIZE;
 
 	err = mana_gd_send_request(gc, req_msg_size, req, sizeof(resp), &resp);
 	if (err)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microsoft/mana/hw_channel.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microsoft/mana/hw_channel.c
@@ -51,9 +51,33 @@
 	return 0;
 }
 
+static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq,
+				struct hwc_work_request *req)
+{
+	struct device *dev = hwc_rxq->hwc->dev;
+	struct gdma_sge *sge;
+	int err;
+
+	sge = &req->sge;
+	sge->address = (u64)req->buf_sge_addr;
+	sge->mem_key = hwc_rxq->msg_buf->gpa_mkey;
+	sge->size = req->buf_len;
+
+	memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request));
+	req->wqe_req.sgl = sge;
+	req->wqe_req.num_sge = 1;
+	req->wqe_req.client_data_unit = 0;
+
+	err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req, NULL);
+	if (err)
+		dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err);
+	return err;
+}
+
 static void mana_hwc_handle_resp(struct hw_channel_context *hwc, u32 resp_len,
-				 const struct gdma_resp_hdr *resp_msg)
+				 struct hwc_work_request *rx_req)
 {
+	const struct gdma_resp_hdr *resp_msg = rx_req->buf_va;
 	struct hwc_caller_ctx *ctx;
 	int err;
 
@@ -61,6 +85,7 @@
 		      hwc->inflight_msg_res.map)) {
 		dev_err(hwc->dev, "hwc_rx: invalid msg_id = %u\n",
 			resp_msg->response.hwc_msg_id);
+		mana_hwc_post_rx_wqe(hwc->rxq, rx_req);
 		return;
 	}
 
@@ -74,30 +99,13 @@
 	memcpy(ctx->output_buf, resp_msg, resp_len);
 out:
 	ctx->error = err;
-	complete(&ctx->comp_event);
-}
-
-static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq,
-				struct hwc_work_request *req)
-{
-	struct device *dev = hwc_rxq->hwc->dev;
-	struct gdma_sge *sge;
-	int err;
-
-	sge = &req->sge;
-	sge->address = (u64)req->buf_sge_addr;
-	sge->mem_key = hwc_rxq->msg_buf->gpa_mkey;
-	sge->size = req->buf_len;
 
-	memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request));
-	req->wqe_req.sgl = sge;
-	req->wqe_req.num_sge = 1;
-	req->wqe_req.client_data_unit = 0;
+	/* Must post rx wqe before complete(), otherwise the next rx may
+	 * hit no_wqe error.
+	 */
+	mana_hwc_post_rx_wqe(hwc->rxq, rx_req);
 
-	err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req, NULL);
-	if (err)
-		dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err);
-	return err;
+	complete(&ctx->comp_event);
 }
 
 static void mana_hwc_init_event_handler(void *ctx, struct gdma_queue *q_self,
@@ -234,14 +242,12 @@
 		return;
 	}
 
-	mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, resp);
+	mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, rx_req);
 
-	/* Do no longer use 'resp', because the buffer is posted to the HW
-	 * in the below mana_hwc_post_rx_wqe().
+	/* Can no longer use 'resp', because the buffer is posted to the HW
+	 * in mana_hwc_handle_resp() above.
 	 */
 	resp = NULL;
-
-	mana_hwc_post_rx_wqe(hwc_rxq, rx_req);
 }
 
 static void mana_hwc_tx_event_handler(void *ctx, u32 gdma_txq_id,
@@ -361,12 +367,12 @@
 	int err;
 
 	eq_size = roundup_pow_of_two(GDMA_EQE_SIZE * q_depth);
-	if (eq_size < MINIMUM_SUPPORTED_PAGE_SIZE)
-		eq_size = MINIMUM_SUPPORTED_PAGE_SIZE;
+	if (eq_size < MANA_MIN_QSIZE)
+		eq_size = MANA_MIN_QSIZE;
 
 	cq_size = roundup_pow_of_two(GDMA_CQE_SIZE * q_depth);
-	if (cq_size < MINIMUM_SUPPORTED_PAGE_SIZE)
-		cq_size = MINIMUM_SUPPORTED_PAGE_SIZE;
+	if (cq_size < MANA_MIN_QSIZE)
+		cq_size = MANA_MIN_QSIZE;
 
 	hwc_cq = kzalloc(sizeof(*hwc_cq), GFP_KERNEL);
 	if (!hwc_cq)
@@ -428,7 +434,7 @@
 
 	dma_buf->num_reqs = q_depth;
 
-	buf_size = PAGE_ALIGN(q_depth * max_msg_size);
+	buf_size = MANA_PAGE_ALIGN(q_depth * max_msg_size);
 
 	gmi = &dma_buf->mem_info;
 	err = mana_gd_alloc_memory(gc, buf_size, gmi);
@@ -496,8 +502,8 @@
 	else
 		queue_size = roundup_pow_of_two(GDMA_MAX_SQE_SIZE * q_depth);
 
-	if (queue_size < MINIMUM_SUPPORTED_PAGE_SIZE)
-		queue_size = MINIMUM_SUPPORTED_PAGE_SIZE;
+	if (queue_size < MANA_MIN_QSIZE)
+		queue_size = MANA_MIN_QSIZE;
 
 	hwc_wq = kzalloc(sizeof(*hwc_wq), GFP_KERNEL);
 	if (!hwc_wq)
@@ -848,7 +854,7 @@
 	}
 
 	if (!wait_for_completion_timeout(&ctx->comp_event,
-					 (msecs_to_jiffies(hwc->hwc_timeout) * HZ))) {
+					 (msecs_to_jiffies(hwc->hwc_timeout)))) {
 		dev_err(hwc->dev, "HWC: Request timed out!\n");
 		err = -ETIMEDOUT;
 		goto out;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -599,9 +599,13 @@
 	else
 		*headroom = XDP_PACKET_HEADROOM;
 
-	*alloc_size = mtu + MANA_RXBUF_PAD + *headroom;
+	*alloc_size = SKB_DATA_ALIGN(mtu + MANA_RXBUF_PAD + *headroom);
 
-	*datasize = ALIGN(mtu + ETH_HLEN, MANA_RX_DATA_ALIGN);
+	/* Using page pool in this case, so alloc_size is PAGE_SIZE */
+	if (*alloc_size < PAGE_SIZE)
+		*alloc_size = PAGE_SIZE;
+
+	*datasize = mtu + ETH_HLEN;
 }
 
 static int mana_pre_alloc_rxbufs(struct mana_port_context *mpc, int new_mtu)
@@ -1775,7 +1779,6 @@
 static int mana_cq_handler(void *context, struct gdma_queue *gdma_queue)
 {
 	struct mana_cq *cq = context;
-	u8 arm_bit;
 	int w;
 
 	WARN_ON_ONCE(cq->gdma_cq != gdma_queue);
@@ -1786,16 +1789,23 @@
 		mana_poll_tx_cq(cq);
 
 	w = cq->work_done;
+	cq->work_done_since_doorbell += w;
 
-	if (w < cq->budget &&
-	    napi_complete_done(&cq->napi, w)) {
-		arm_bit = SET_ARM_BIT;
-	} else {
-		arm_bit = 0;
+	if (w < cq->budget) {
+		mana_gd_ring_cq(gdma_queue, SET_ARM_BIT);
+		cq->work_done_since_doorbell = 0;
+		napi_complete_done(&cq->napi, w);
+	} else if (cq->work_done_since_doorbell >
+		   cq->gdma_cq->queue_size / COMP_ENTRY_SIZE * 4) {
+		/* MANA hardware requires at least one doorbell ring every 8
+		 * wraparounds of CQ even if there is no need to arm the CQ.
+		 * This driver rings the doorbell as soon as we have exceeded
+		 * 4 wraparounds.
+		 */
+		mana_gd_ring_cq(gdma_queue, 0);
+		cq->work_done_since_doorbell = 0;
 	}
 
-	mana_gd_ring_cq(gdma_queue, arm_bit);
-
 	return w;
 }
 
@@ -1849,10 +1859,12 @@
 
 	for (i = 0; i < apc->num_queues; i++) {
 		napi = &apc->tx_qp[i].tx_cq.napi;
-		napi_synchronize(napi);
-		napi_disable(napi);
-		netif_napi_del(napi);
-
+		if (apc->tx_qp[i].txq.napi_initialized) {
+			napi_synchronize(napi);
+			napi_disable(napi);
+			netif_napi_del(napi);
+			apc->tx_qp[i].txq.napi_initialized = false;
+		}
 		mana_destroy_wq_obj(apc, GDMA_SQ, apc->tx_qp[i].tx_object);
 
 		mana_deinit_cq(apc, &apc->tx_qp[i].tx_cq);
@@ -1891,10 +1903,10 @@
 	 *  to prevent overflow.
 	 */
 	txq_size = MAX_SEND_BUFFERS_PER_QUEUE * 32;
-	BUILD_BUG_ON(!PAGE_ALIGNED(txq_size));
+	BUILD_BUG_ON(!MANA_PAGE_ALIGNED(txq_size));
 
 	cq_size = MAX_SEND_BUFFERS_PER_QUEUE * COMP_ENTRY_SIZE;
-	cq_size = PAGE_ALIGN(cq_size);
+	cq_size = MANA_PAGE_ALIGN(cq_size);
 
 	gc = gd->gdma_context;
 
@@ -1908,6 +1920,7 @@
 		txq->ndev = net;
 		txq->net_txq = netdev_get_tx_queue(net, i);
 		txq->vp_offset = apc->tx_vp_offset;
+		txq->napi_initialized = false;
 		skb_queue_head_init(&txq->pending_skbs);
 
 		memset(&spec, 0, sizeof(spec));
@@ -1974,6 +1987,7 @@
 
 		netif_napi_add_tx(net, &cq->napi, mana_poll);
 		napi_enable(&cq->napi);
+		txq->napi_initialized = true;
 
 		mana_gd_ring_cq(cq->gdma_cq, SET_ARM_BIT);
 	}
@@ -1985,7 +1999,7 @@
 }
 
 static void mana_destroy_rxq(struct mana_port_context *apc,
-			     struct mana_rxq *rxq, bool validate_state)
+			     struct mana_rxq *rxq, bool napi_initialized)
 
 {
 	struct gdma_context *gc = apc->ac->gdma_dev->gdma_context;
@@ -2000,15 +2014,15 @@
 
 	napi = &rxq->rx_cq.napi;
 
-	if (validate_state)
+	if (napi_initialized) {
 		napi_synchronize(napi);
 
-	napi_disable(napi);
+		napi_disable(napi);
 
+		netif_napi_del(napi);
+	}
 	xdp_rxq_info_unreg(&rxq->xdp_rxq);
 
-	netif_napi_del(napi);
-
 	mana_destroy_wq_obj(apc, GDMA_RQ, rxq->rxobj);
 
 	mana_deinit_cq(apc, &rxq->rx_cq);
@@ -2191,8 +2205,8 @@
 	if (err)
 		goto out;
 
-	rq_size = PAGE_ALIGN(rq_size);
-	cq_size = PAGE_ALIGN(cq_size);
+	rq_size = MANA_PAGE_ALIGN(rq_size);
+	cq_size = MANA_PAGE_ALIGN(cq_size);
 
 	/* Create RQ */
 	memset(&spec, 0, sizeof(spec));
@@ -2387,6 +2401,7 @@
 
 	mana_gd_init_req_hdr(&req.hdr, MANA_QUERY_GF_STAT,
 			     sizeof(req), sizeof(resp));
+	req.hdr.resp.msg_version = GDMA_MESSAGE_V2;
 	req.req_stats = STATISTICS_FLAGS_RX_DISCARDS_NO_WQE |
 			STATISTICS_FLAGS_RX_ERRORS_VPORT_DISABLED |
 			STATISTICS_FLAGS_HC_RX_BYTES |
@@ -2800,6 +2815,8 @@
 	if (ret)
 		goto init_fail;
 
+	/* madev is owned by the auxiliary device */
+	madev = NULL;
 	ret = auxiliary_device_add(adev);
 	if (ret)
 		goto add_fail;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/microsoft/mana/shm_channel.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/microsoft/mana/shm_channel.c
@@ -6,6 +6,7 @@
 #include <linux/io.h>
 #include <linux/mm.h>
 
+#include <net/mana/gdma.h>
 #include <net/mana/shm_channel.h>
 
 #define PAGE_FRAME_L48_WIDTH_BYTES 6
@@ -155,8 +156,8 @@
 		return err;
 	}
 
-	if (!PAGE_ALIGNED(eq_addr) || !PAGE_ALIGNED(cq_addr) ||
-	    !PAGE_ALIGNED(rq_addr) || !PAGE_ALIGNED(sq_addr))
+	if (!MANA_PAGE_ALIGNED(eq_addr) || !MANA_PAGE_ALIGNED(cq_addr) ||
+	    !MANA_PAGE_ALIGNED(rq_addr) || !MANA_PAGE_ALIGNED(sq_addr))
 		return -EINVAL;
 
 	if ((eq_msix_index & VECTOR_MASK) != eq_msix_index)
@@ -183,7 +184,7 @@
 
 	/* EQ addr: low 48 bits of frame address */
 	shmem = (u64 *)ptr;
-	frame_addr = PHYS_PFN(eq_addr);
+	frame_addr = MANA_PFN(eq_addr);
 	*shmem = frame_addr & PAGE_FRAME_L48_MASK;
 	all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) <<
 		(frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS);
@@ -191,7 +192,7 @@
 
 	/* CQ addr: low 48 bits of frame address */
 	shmem = (u64 *)ptr;
-	frame_addr = PHYS_PFN(cq_addr);
+	frame_addr = MANA_PFN(cq_addr);
 	*shmem = frame_addr & PAGE_FRAME_L48_MASK;
 	all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) <<
 		(frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS);
@@ -199,7 +200,7 @@
 
 	/* RQ addr: low 48 bits of frame address */
 	shmem = (u64 *)ptr;
-	frame_addr = PHYS_PFN(rq_addr);
+	frame_addr = MANA_PFN(rq_addr);
 	*shmem = frame_addr & PAGE_FRAME_L48_MASK;
 	all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) <<
 		(frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS);
@@ -207,7 +208,7 @@
 
 	/* SQ addr: low 48 bits of frame address */
 	shmem = (u64 *)ptr;
-	frame_addr = PHYS_PFN(sq_addr);
+	frame_addr = MANA_PFN(sq_addr);
 	*shmem = frame_addr & PAGE_FRAME_L48_MASK;
 	all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) <<
 		(frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mscc/ocelot.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mscc/ocelot.c
@@ -1099,6 +1099,48 @@
 }
 EXPORT_SYMBOL(ocelot_ptp_rx_timestamp);
 
+void ocelot_lock_inj_grp(struct ocelot *ocelot, int grp)
+			 __acquires(&ocelot->inj_lock)
+{
+	spin_lock(&ocelot->inj_lock);
+}
+EXPORT_SYMBOL_GPL(ocelot_lock_inj_grp);
+
+void ocelot_unlock_inj_grp(struct ocelot *ocelot, int grp)
+			   __releases(&ocelot->inj_lock)
+{
+	spin_unlock(&ocelot->inj_lock);
+}
+EXPORT_SYMBOL_GPL(ocelot_unlock_inj_grp);
+
+void ocelot_lock_xtr_grp(struct ocelot *ocelot, int grp)
+			 __acquires(&ocelot->inj_lock)
+{
+	spin_lock(&ocelot->inj_lock);
+}
+EXPORT_SYMBOL_GPL(ocelot_lock_xtr_grp);
+
+void ocelot_unlock_xtr_grp(struct ocelot *ocelot, int grp)
+			   __releases(&ocelot->inj_lock)
+{
+	spin_unlock(&ocelot->inj_lock);
+}
+EXPORT_SYMBOL_GPL(ocelot_unlock_xtr_grp);
+
+void ocelot_lock_xtr_grp_bh(struct ocelot *ocelot, int grp)
+			    __acquires(&ocelot->xtr_lock)
+{
+	spin_lock_bh(&ocelot->xtr_lock);
+}
+EXPORT_SYMBOL_GPL(ocelot_lock_xtr_grp_bh);
+
+void ocelot_unlock_xtr_grp_bh(struct ocelot *ocelot, int grp)
+			      __releases(&ocelot->xtr_lock)
+{
+	spin_unlock_bh(&ocelot->xtr_lock);
+}
+EXPORT_SYMBOL_GPL(ocelot_unlock_xtr_grp_bh);
+
 int ocelot_xtr_poll_frame(struct ocelot *ocelot, int grp, struct sk_buff **nskb)
 {
 	u64 timestamp, src_port, len;
@@ -1109,6 +1151,8 @@
 	u32 val, *buf;
 	int err;
 
+	lockdep_assert_held(&ocelot->xtr_lock);
+
 	err = ocelot_xtr_poll_xfh(ocelot, grp, xfh);
 	if (err)
 		return err;
@@ -1184,6 +1228,8 @@
 {
 	u32 val = ocelot_read(ocelot, QS_INJ_STATUS);
 
+	lockdep_assert_held(&ocelot->inj_lock);
+
 	if (!(val & QS_INJ_STATUS_FIFO_RDY(BIT(grp))))
 		return false;
 	if (val & QS_INJ_STATUS_WMARK_REACHED(BIT(grp)))
@@ -1193,28 +1239,55 @@
 }
 EXPORT_SYMBOL(ocelot_can_inject);
 
-void ocelot_ifh_port_set(void *ifh, int port, u32 rew_op, u32 vlan_tag)
+/**
+ * ocelot_ifh_set_basic - Set basic information in Injection Frame Header
+ * @ifh: Pointer to Injection Frame Header memory
+ * @ocelot: Switch private data structure
+ * @port: Egress port number
+ * @rew_op: Egress rewriter operation for PTP
+ * @skb: Pointer to socket buffer (packet)
+ *
+ * Populate the Injection Frame Header with basic information for this skb: the
+ * analyzer bypass bit, destination port, VLAN info, egress rewriter info.
+ */
+void ocelot_ifh_set_basic(void *ifh, struct ocelot *ocelot, int port,
+			  u32 rew_op, struct sk_buff *skb)
 {
+	struct ocelot_port *ocelot_port = ocelot->ports[port];
+	struct net_device *dev = skb->dev;
+	u64 vlan_tci, tag_type;
+	int qos_class;
+
+	ocelot_xmit_get_vlan_info(skb, ocelot_port->bridge, &vlan_tci,
+				  &tag_type);
+
+	qos_class = netdev_get_num_tc(dev) ?
+		    netdev_get_prio_tc_map(dev, skb->priority) : skb->priority;
+
+	memset(ifh, 0, OCELOT_TAG_LEN);
 	ocelot_ifh_set_bypass(ifh, 1);
+	ocelot_ifh_set_src(ifh, ocelot->num_phys_ports);
 	ocelot_ifh_set_dest(ifh, BIT_ULL(port));
-	ocelot_ifh_set_tag_type(ifh, IFH_TAG_TYPE_C);
-	if (vlan_tag)
-		ocelot_ifh_set_vlan_tci(ifh, vlan_tag);
+	ocelot_ifh_set_qos_class(ifh, qos_class);
+	ocelot_ifh_set_tag_type(ifh, tag_type);
+	ocelot_ifh_set_vlan_tci(ifh, vlan_tci);
 	if (rew_op)
 		ocelot_ifh_set_rew_op(ifh, rew_op);
 }
-EXPORT_SYMBOL(ocelot_ifh_port_set);
+EXPORT_SYMBOL(ocelot_ifh_set_basic);
 
 void ocelot_port_inject_frame(struct ocelot *ocelot, int port, int grp,
 			      u32 rew_op, struct sk_buff *skb)
 {
-	u32 ifh[OCELOT_TAG_LEN / 4] = {0};
+	u32 ifh[OCELOT_TAG_LEN / 4];
 	unsigned int i, count, last;
 
+	lockdep_assert_held(&ocelot->inj_lock);
+
 	ocelot_write_rix(ocelot, QS_INJ_CTRL_GAP_SIZE(1) |
 			 QS_INJ_CTRL_SOF, QS_INJ_CTRL, grp);
 
-	ocelot_ifh_port_set(ifh, port, rew_op, skb_vlan_tag_get(skb));
+	ocelot_ifh_set_basic(ifh, ocelot, port, rew_op, skb);
 
 	for (i = 0; i < OCELOT_TAG_LEN / 4; i++)
 		ocelot_write_rix(ocelot, ifh[i], QS_INJ_WR, grp);
@@ -1247,6 +1320,8 @@
 
 void ocelot_drain_cpu_queue(struct ocelot *ocelot, int grp)
 {
+	lockdep_assert_held(&ocelot->xtr_lock);
+
 	while (ocelot_read(ocelot, QS_XTR_DATA_PRESENT) & BIT(grp))
 		ocelot_read_rix(ocelot, QS_XTR_RD, grp);
 }
@@ -2929,6 +3004,8 @@
 	mutex_init(&ocelot->fwd_domain_lock);
 	spin_lock_init(&ocelot->ptp_clock_lock);
 	spin_lock_init(&ocelot->ts_id_lock);
+	spin_lock_init(&ocelot->inj_lock);
+	spin_lock_init(&ocelot->xtr_lock);
 
 	ocelot->owq = alloc_ordered_workqueue("ocelot-owq", 0);
 	if (!ocelot->owq)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mscc/ocelot_fdma.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mscc/ocelot_fdma.c
@@ -665,8 +665,7 @@
 
 	ifh = skb_push(skb, OCELOT_TAG_LEN);
 	skb_put(skb, ETH_FCS_LEN);
-	memset(ifh, 0, OCELOT_TAG_LEN);
-	ocelot_ifh_port_set(ifh, port, rew_op, skb_vlan_tag_get(skb));
+	ocelot_ifh_set_basic(ifh, ocelot, port, rew_op, skb);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mscc/ocelot_ptp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mscc/ocelot_ptp.c
@@ -14,6 +14,8 @@
 #include <soc/mscc/ocelot.h>
 #include "ocelot.h"
 
+#define OCELOT_PTP_TX_TSTAMP_TIMEOUT		(5 * HZ)
+
 int ocelot_ptp_gettime64(struct ptp_clock_info *ptp, struct timespec64 *ts)
 {
 	struct ocelot *ocelot = container_of(ptp, struct ocelot, ptp_info);
@@ -495,6 +497,28 @@
 	return HWTSTAMP_FILTER_NONE;
 }
 
+static int ocelot_ptp_tx_type_to_cmd(int tx_type, int *ptp_cmd)
+{
+	switch (tx_type) {
+	case HWTSTAMP_TX_ON:
+		*ptp_cmd = IFH_REW_OP_TWO_STEP_PTP;
+		break;
+	case HWTSTAMP_TX_ONESTEP_SYNC:
+		/* IFH_REW_OP_ONE_STEP_PTP updates the correctionField,
+		 * what we need to update is the originTimestamp.
+		 */
+		*ptp_cmd = IFH_REW_OP_ORIGIN_PTP;
+		break;
+	case HWTSTAMP_TX_OFF:
+		*ptp_cmd = 0;
+		break;
+	default:
+		return -ERANGE;
+	}
+
+	return 0;
+}
+
 int ocelot_hwstamp_get(struct ocelot *ocelot, int port, struct ifreq *ifr)
 {
 	struct ocelot_port *ocelot_port = ocelot->ports[port];
@@ -521,30 +545,19 @@
 int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr)
 {
 	struct ocelot_port *ocelot_port = ocelot->ports[port];
+	int ptp_cmd, old_ptp_cmd = ocelot_port->ptp_cmd;
 	bool l2 = false, l4 = false;
 	struct hwtstamp_config cfg;
+	bool old_l2, old_l4;
 	int err;
 
 	if (copy_from_user(&cfg, ifr->ifr_data, sizeof(cfg)))
 		return -EFAULT;
 
 	/* Tx type sanity check */
-	switch (cfg.tx_type) {
-	case HWTSTAMP_TX_ON:
-		ocelot_port->ptp_cmd = IFH_REW_OP_TWO_STEP_PTP;
-		break;
-	case HWTSTAMP_TX_ONESTEP_SYNC:
-		/* IFH_REW_OP_ONE_STEP_PTP updates the correctional field, we
-		 * need to update the origin time.
-		 */
-		ocelot_port->ptp_cmd = IFH_REW_OP_ORIGIN_PTP;
-		break;
-	case HWTSTAMP_TX_OFF:
-		ocelot_port->ptp_cmd = 0;
-		break;
-	default:
-		return -ERANGE;
-	}
+	err = ocelot_ptp_tx_type_to_cmd(cfg.tx_type, &ptp_cmd);
+	if (err)
+		return err;
 
 	switch (cfg.rx_filter) {
 	case HWTSTAMP_FILTER_NONE:
@@ -569,13 +582,27 @@
 		return -ERANGE;
 	}
 
+	old_l2 = ocelot_port->trap_proto & OCELOT_PROTO_PTP_L2;
+	old_l4 = ocelot_port->trap_proto & OCELOT_PROTO_PTP_L4;
+
 	err = ocelot_setup_ptp_traps(ocelot, port, l2, l4);
 	if (err)
 		return err;
 
+	ocelot_port->ptp_cmd = ptp_cmd;
+
 	cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto);
 
-	return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
+	if (copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg))) {
+		err = -EFAULT;
+		goto out_restore_ptp_traps;
+	}
+
+	return 0;
+out_restore_ptp_traps:
+	ocelot_setup_ptp_traps(ocelot, port, old_l2, old_l4);
+	ocelot_port->ptp_cmd = old_ptp_cmd;
+	return err;
 }
 EXPORT_SYMBOL(ocelot_hwstamp_set);
 
@@ -607,34 +634,87 @@
 }
 EXPORT_SYMBOL(ocelot_get_ts_info);
 
-static int ocelot_port_add_txtstamp_skb(struct ocelot *ocelot, int port,
-					struct sk_buff *clone)
+static struct sk_buff *ocelot_port_dequeue_ptp_tx_skb(struct ocelot *ocelot,
+						      int port, u8 ts_id,
+						      u32 seqid)
 {
 	struct ocelot_port *ocelot_port = ocelot->ports[port];
-	unsigned long flags;
+	struct sk_buff *skb, *skb_tmp, *skb_match = NULL;
+	struct ptp_header *hdr;
+
+	spin_lock(&ocelot->ts_id_lock);
+
+	skb_queue_walk_safe(&ocelot_port->tx_skbs, skb, skb_tmp) {
+		if (OCELOT_SKB_CB(skb)->ts_id != ts_id)
+			continue;
 
-	spin_lock_irqsave(&ocelot->ts_id_lock, flags);
+		/* Check that the timestamp ID is for the expected PTP
+		 * sequenceId. We don't have to test ptp_parse_header() against
+		 * NULL, because we've pre-validated the packet's ptp_class.
+		 */
+		hdr = ptp_parse_header(skb, OCELOT_SKB_CB(skb)->ptp_class);
+		if (seqid != ntohs(hdr->sequence_id))
+			continue;
+
+		__skb_unlink(skb, &ocelot_port->tx_skbs);
+		ocelot->ptp_skbs_in_flight--;
+		skb_match = skb;
+		break;
+	}
 
-	if (ocelot_port->ptp_skbs_in_flight == OCELOT_MAX_PTP_ID ||
-	    ocelot->ptp_skbs_in_flight == OCELOT_PTP_FIFO_SIZE) {
-		spin_unlock_irqrestore(&ocelot->ts_id_lock, flags);
+	spin_unlock(&ocelot->ts_id_lock);
+
+	return skb_match;
+}
+
+static int ocelot_port_queue_ptp_tx_skb(struct ocelot *ocelot, int port,
+					struct sk_buff *clone)
+{
+	struct ocelot_port *ocelot_port = ocelot->ports[port];
+	DECLARE_BITMAP(ts_id_in_flight, OCELOT_MAX_PTP_ID);
+	struct sk_buff *skb, *skb_tmp;
+	unsigned long n;
+
+	spin_lock(&ocelot->ts_id_lock);
+
+	/* To get a better chance of acquiring a timestamp ID, first flush the
+	 * stale packets still waiting in the TX timestamping queue. They are
+	 * probably lost.
+	 */
+	skb_queue_walk_safe(&ocelot_port->tx_skbs, skb, skb_tmp) {
+		if (time_before(OCELOT_SKB_CB(skb)->ptp_tx_time +
+				OCELOT_PTP_TX_TSTAMP_TIMEOUT, jiffies)) {
+			dev_warn_ratelimited(ocelot->dev,
+					     "port %d invalidating stale timestamp ID %u which seems lost\n",
+					     port, OCELOT_SKB_CB(skb)->ts_id);
+			__skb_unlink(skb, &ocelot_port->tx_skbs);
+			kfree_skb(skb);
+			ocelot->ptp_skbs_in_flight--;
+		} else {
+			__set_bit(OCELOT_SKB_CB(skb)->ts_id, ts_id_in_flight);
+		}
+	}
+
+	if (ocelot->ptp_skbs_in_flight == OCELOT_PTP_FIFO_SIZE) {
+		spin_unlock(&ocelot->ts_id_lock);
 		return -EBUSY;
 	}
 
-	skb_shinfo(clone)->tx_flags |= SKBTX_IN_PROGRESS;
-	/* Store timestamp ID in OCELOT_SKB_CB(clone)->ts_id */
-	OCELOT_SKB_CB(clone)->ts_id = ocelot_port->ts_id;
-
-	ocelot_port->ts_id++;
-	if (ocelot_port->ts_id == OCELOT_MAX_PTP_ID)
-		ocelot_port->ts_id = 0;
+	n = find_first_zero_bit(ts_id_in_flight, OCELOT_MAX_PTP_ID);
+	if (n == OCELOT_MAX_PTP_ID) {
+		spin_unlock(&ocelot->ts_id_lock);
+		return -EBUSY;
+	}
 
-	ocelot_port->ptp_skbs_in_flight++;
+	/* Found an available timestamp ID, use it */
+	OCELOT_SKB_CB(clone)->ts_id = n;
+	OCELOT_SKB_CB(clone)->ptp_tx_time = jiffies;
 	ocelot->ptp_skbs_in_flight++;
+	__skb_queue_tail(&ocelot_port->tx_skbs, clone);
 
-	skb_queue_tail(&ocelot_port->tx_skbs, clone);
+	spin_unlock(&ocelot->ts_id_lock);
 
-	spin_unlock_irqrestore(&ocelot->ts_id_lock, flags);
+	dev_dbg_ratelimited(ocelot->dev, "port %d timestamp id %lu\n", port, n);
 
 	return 0;
 }
@@ -691,10 +771,14 @@
 		if (!(*clone))
 			return -ENOMEM;
 
-		err = ocelot_port_add_txtstamp_skb(ocelot, port, *clone);
-		if (err)
+		/* Store timestamp ID in OCELOT_SKB_CB(clone)->ts_id */
+		err = ocelot_port_queue_ptp_tx_skb(ocelot, port, *clone);
+		if (err) {
+			kfree_skb(*clone);
 			return err;
+		}
 
+		skb_shinfo(*clone)->tx_flags |= SKBTX_IN_PROGRESS;
 		OCELOT_SKB_CB(skb)->ptp_cmd = ptp_cmd;
 		OCELOT_SKB_CB(*clone)->ptp_class = ptp_class;
 	}
@@ -730,28 +814,15 @@
 	spin_unlock_irqrestore(&ocelot->ptp_clock_lock, flags);
 }
 
-static bool ocelot_validate_ptp_skb(struct sk_buff *clone, u16 seqid)
-{
-	struct ptp_header *hdr;
-
-	hdr = ptp_parse_header(clone, OCELOT_SKB_CB(clone)->ptp_class);
-	if (WARN_ON(!hdr))
-		return false;
-
-	return seqid == ntohs(hdr->sequence_id);
-}
-
 void ocelot_get_txtstamp(struct ocelot *ocelot)
 {
 	int budget = OCELOT_PTP_QUEUE_SZ;
 
 	while (budget--) {
-		struct sk_buff *skb, *skb_tmp, *skb_match = NULL;
 		struct skb_shared_hwtstamps shhwtstamps;
 		u32 val, id, seqid, txport;
-		struct ocelot_port *port;
+		struct sk_buff *skb_match;
 		struct timespec64 ts;
-		unsigned long flags;
 
 		val = ocelot_read(ocelot, SYS_PTP_STATUS);
 
@@ -766,36 +837,14 @@
 		txport = SYS_PTP_STATUS_PTP_MESS_TXPORT_X(val);
 		seqid = SYS_PTP_STATUS_PTP_MESS_SEQ_ID(val);
 
-		port = ocelot->ports[txport];
-
-		spin_lock(&ocelot->ts_id_lock);
-		port->ptp_skbs_in_flight--;
-		ocelot->ptp_skbs_in_flight--;
-		spin_unlock(&ocelot->ts_id_lock);
-
 		/* Retrieve its associated skb */
-try_again:
-		spin_lock_irqsave(&port->tx_skbs.lock, flags);
-
-		skb_queue_walk_safe(&port->tx_skbs, skb, skb_tmp) {
-			if (OCELOT_SKB_CB(skb)->ts_id != id)
-				continue;
-			__skb_unlink(skb, &port->tx_skbs);
-			skb_match = skb;
-			break;
-		}
-
-		spin_unlock_irqrestore(&port->tx_skbs.lock, flags);
-
-		if (WARN_ON(!skb_match))
-			continue;
-
-		if (!ocelot_validate_ptp_skb(skb_match, seqid)) {
-			dev_err_ratelimited(ocelot->dev,
-					    "port %d received stale TX timestamp for seqid %d, discarding\n",
-					    txport, seqid);
-			dev_kfree_skb_any(skb);
-			goto try_again;
+		skb_match = ocelot_port_dequeue_ptp_tx_skb(ocelot, txport, id,
+							   seqid);
+		if (!skb_match) {
+			dev_warn_ratelimited(ocelot->dev,
+					     "port %d received TX timestamp (seqid %d, ts id %u) for packet previously declared stale\n",
+					     txport, seqid, id);
+			goto next_ts;
 		}
 
 		/* Get the h/w timestamp */
@@ -806,7 +855,7 @@
 		shhwtstamps.hwtstamp = ktime_set(ts.tv_sec, ts.tv_nsec);
 		skb_complete_tx_timestamp(skb_match, &shhwtstamps);
 
-		/* Next ts */
+next_ts:
 		ocelot_write(ocelot, SYS_PTP_NXT_PTP_NXT, SYS_PTP_NXT);
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/mscc/ocelot_vsc7514.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/mscc/ocelot_vsc7514.c
@@ -51,6 +51,8 @@
 	struct ocelot *ocelot = arg;
 	int grp = 0, err;
 
+	ocelot_lock_xtr_grp(ocelot, grp);
+
 	while (ocelot_read(ocelot, QS_XTR_DATA_PRESENT) & BIT(grp)) {
 		struct sk_buff *skb;
 
@@ -69,6 +71,8 @@
 	if (err < 0)
 		ocelot_drain_cpu_queue(ocelot, 0);
 
+	ocelot_unlock_xtr_grp(ocelot, grp);
+
 	return IRQ_HANDLED;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/netronome/nfp/bpf/offload.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/netronome/nfp/bpf/offload.c
@@ -458,7 +458,8 @@
 	map_id_full = be64_to_cpu(cbe->map_ptr);
 	map_id = map_id_full;
 
-	if (len < sizeof(struct cmsg_bpf_event) + pkt_size + data_size)
+	if (size_add(pkt_size, data_size) > INT_MAX ||
+	    len < sizeof(struct cmsg_bpf_event) + pkt_size + data_size)
 		return -EINVAL;
 	if (cbe->hdr.ver != NFP_CCM_ABI_VERSION)
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c
@@ -337,6 +337,11 @@
 
 		acti_netdevs = kmalloc_array(entry->slave_cnt,
 					     sizeof(*acti_netdevs), GFP_KERNEL);
+		if (!acti_netdevs) {
+			schedule_delayed_work(&lag->work,
+					      NFP_FL_LAG_DELAY);
+			continue;
+		}
 
 		/* Include sanity check in the loop. It may be that a bond has
 		 * changed between processing the last notification and the
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -821,14 +821,13 @@
 
 	snprintf(r_vec->name, sizeof(r_vec->name),
 		 "%s-rxtx-%d", nfp_net_name(nn), idx);
-	err = request_irq(r_vec->irq_vector, r_vec->handler, 0, r_vec->name,
-			  r_vec);
+	err = request_irq(r_vec->irq_vector, r_vec->handler, IRQF_NO_AUTOEN,
+			  r_vec->name, r_vec);
 	if (err) {
 		nfp_net_napi_del(&nn->dp, r_vec);
 		nn_err(nn, "Error requesting IRQ %d\n", r_vec->irq_vector);
 		return err;
 	}
-	disable_irq(r_vec->irq_vector);
 
 	irq_set_affinity_hint(r_vec->irq_vector, &r_vec->affinity_mask);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
@@ -388,6 +388,7 @@
 err_out_pci:
 	ionic_dev_teardown(ionic);
 	ionic_clear_pci(ionic);
+	ionic_debugfs_del_dev(ionic);
 err_out:
 	mutex_destroy(&ionic->dev_cmd_lock);
 	ionic_devlink_free(ionic);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
@@ -947,8 +947,8 @@
 	len = min_t(u32, sizeof(xcvr->sprom), ee->len);
 
 	do {
-		memcpy(data, xcvr->sprom, len);
-		memcpy(tbuf, xcvr->sprom, len);
+		memcpy(data, &xcvr->sprom[ee->offset], len);
+		memcpy(tbuf, &xcvr->sprom[ee->offset], len);
 
 		/* Let's make sure we got a consistent copy */
 		if (!memcmp(data, tbuf, len))
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -234,7 +234,7 @@
 		name = dev_name(dev);
 
 	snprintf(intr->name, sizeof(intr->name),
-		 "%s-%s-%s", IONIC_DRV_NAME, name, q->name);
+		 "%.5s-%.16s-%.8s", IONIC_DRV_NAME, name, q->name);
 
 	return devm_request_irq(dev, intr->vector, ionic_isr,
 				0, intr->name, &qcq->napi);
@@ -296,10 +296,8 @@
 	if (ret)
 		return ret;
 
-	if (qcq->napi.poll)
-		napi_enable(&qcq->napi);
-
 	if (qcq->flags & IONIC_QCQ_F_INTR) {
+		napi_enable(&qcq->napi);
 		irq_set_affinity_hint(qcq->intr.vector,
 				      &qcq->intr.affinity_mask);
 		ionic_intr_mask(idev->intr_ctrl, qcq->intr.index,
@@ -3391,9 +3389,12 @@
 
 	napi_enable(&qcq->napi);
 
-	if (qcq->flags & IONIC_QCQ_F_INTR)
+	if (qcq->flags & IONIC_QCQ_F_INTR) {
+		irq_set_affinity_hint(qcq->intr.vector,
+				      &qcq->intr.affinity_mask);
 		ionic_intr_mask(idev->intr_ctrl, qcq->intr.index,
 				IONIC_INTR_MASK_CLEAR);
+	}
 
 	qcq->flags |= IONIC_QCQ_F_INITED;
 
@@ -3661,8 +3662,8 @@
 	/* only register LIF0 for now */
 	err = register_netdev(lif->netdev);
 	if (err) {
-		dev_err(lif->ionic->dev, "Cannot register net device, aborting\n");
-		ionic_lif_unregister_phc(lif);
+		dev_err(lif->ionic->dev, "Cannot register net device: %d, aborting\n", err);
+		ionic_lif_unregister(lif);
 		return err;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1206,7 +1206,6 @@
 static int qed_slowpath_wq_start(struct qed_dev *cdev)
 {
 	struct qed_hwfn *hwfn;
-	char name[NAME_SIZE];
 	int i;
 
 	if (IS_VF(cdev))
@@ -1215,11 +1214,11 @@
 	for_each_hwfn(cdev, i) {
 		hwfn = &cdev->hwfns[i];
 
-		snprintf(name, NAME_SIZE, "slowpath-%02x:%02x.%02x",
-			 cdev->pdev->bus->number,
-			 PCI_SLOT(cdev->pdev->devfn), hwfn->abs_pf_id);
+		hwfn->slowpath_wq = alloc_workqueue("slowpath-%02x:%02x.%02x",
+					 0, 0, cdev->pdev->bus->number,
+					 PCI_SLOT(cdev->pdev->devfn),
+					 hwfn->abs_pf_id);
 
-		hwfn->slowpath_wq = alloc_workqueue(name, 0, 0);
 		if (!hwfn->slowpath_wq) {
 			DP_NOTICE(hwfn, "Cannot create slowpath workqueue\n");
 			return -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -3314,7 +3314,9 @@
 	if (rc)
 		return rc;
 
-	if (((rsp & FW_MSG_CODE_MASK) != FW_MSG_CODE_OK))
+	if (((rsp & FW_MSG_CODE_MASK) == FW_MSG_CODE_UNSUPPORTED))
+		rc = -EOPNOTSUPP;
+	else if (((rsp & FW_MSG_CODE_MASK) != FW_MSG_CODE_OK))
 		rc = -EINVAL;
 
 	return rc;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/qlogic/qede/qede_filter.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/qlogic/qede/qede_filter.c
@@ -1868,8 +1868,8 @@
 			    struct flow_cls_offload *f)
 {
 	struct qede_arfs_fltr_node *n;
-	int min_hlen, rc = -EINVAL;
 	struct qede_arfs_tuple t;
+	int min_hlen, rc;
 
 	__qede_lock(edev);
 
@@ -1879,7 +1879,8 @@
 	}
 
 	/* parse flower attribute and prepare filter */
-	if (qede_parse_flow_attr(edev, proto, f->rule, &t))
+	rc = qede_parse_flow_attr(edev, proto, f->rule, &t);
+	if (rc)
 		goto unlock;
 
 	/* Validate profile mode and number of filters */
@@ -1888,11 +1889,13 @@
 		DP_NOTICE(edev,
 			  "Filter configuration invalidated, filter mode=0x%x, configured mode=0x%x, filter count=0x%x\n",
 			  t.mode, edev->arfs->mode, edev->arfs->filter_count);
+		rc = -EINVAL;
 		goto unlock;
 	}
 
 	/* parse tc actions and get the vf_id */
-	if (qede_parse_actions(edev, &f->rule->action, f->common.extack))
+	rc = qede_parse_actions(edev, &f->rule->action, f->common.extack);
+	if (rc)
 		goto unlock;
 
 	if (qede_flow_find_fltr(edev, &t)) {
@@ -1998,10 +2001,9 @@
 	if (IS_ERR(flow))
 		return PTR_ERR(flow);
 
-	if (qede_parse_flow_attr(edev, proto, flow->rule, t)) {
-		err = -EINVAL;
+	err = qede_parse_flow_attr(edev, proto, flow->rule, t);
+	if (err)
 		goto err_out;
-	}
 
 	/* Make sure location is valid and filter isn't already set */
 	err = qede_flow_spec_validate(edev, &flow->rule->action, t,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/qualcomm/qca_debug.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/qualcomm/qca_debug.c
@@ -111,10 +111,8 @@
 
 	seq_printf(s, "IRQ              : %d\n",
 		   qca->spi_dev->irq);
-	seq_printf(s, "INTR REQ         : %u\n",
-		   qca->intr_req);
-	seq_printf(s, "INTR SVC         : %u\n",
-		   qca->intr_svc);
+	seq_printf(s, "INTR             : %lx\n",
+		   qca->intr);
 
 	seq_printf(s, "SPI max speed    : %lu\n",
 		   (unsigned long)qca->spi_dev->max_speed_hz);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/qualcomm/qca_spi.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -48,6 +48,8 @@
 
 #define MAX_DMA_BURST_LEN 5000
 
+#define SPI_INTR 0
+
 /*   Modules parameters     */
 #define QCASPI_CLK_SPEED_MIN 1000000
 #define QCASPI_CLK_SPEED_MAX 16000000
@@ -64,7 +66,7 @@
 
 #define QCASPI_PLUGGABLE_MIN 0
 #define QCASPI_PLUGGABLE_MAX 1
-static int qcaspi_pluggable = QCASPI_PLUGGABLE_MIN;
+static int qcaspi_pluggable = QCASPI_PLUGGABLE_MAX;
 module_param(qcaspi_pluggable, int, 0);
 MODULE_PARM_DESC(qcaspi_pluggable, "Pluggable SPI connection (yes/no).");
 
@@ -592,14 +594,14 @@
 			continue;
 		}
 
-		if ((qca->intr_req == qca->intr_svc) &&
+		if (!test_bit(SPI_INTR, &qca->intr) &&
 		    !qca->txr.skb[qca->txr.head])
 			schedule();
 
 		set_current_state(TASK_RUNNING);
 
-		netdev_dbg(qca->net_dev, "have work to do. int: %d, tx_skb: %p\n",
-			   qca->intr_req - qca->intr_svc,
+		netdev_dbg(qca->net_dev, "have work to do. int: %lu, tx_skb: %p\n",
+			   qca->intr,
 			   qca->txr.skb[qca->txr.head]);
 
 		qcaspi_qca7k_sync(qca, QCASPI_EVENT_UPDATE);
@@ -613,8 +615,7 @@
 			msleep(QCASPI_QCA7K_REBOOT_TIME_MS);
 		}
 
-		if (qca->intr_svc != qca->intr_req) {
-			qca->intr_svc = qca->intr_req;
+		if (test_and_clear_bit(SPI_INTR, &qca->intr)) {
 			start_spi_intr_handling(qca, &intr_cause);
 
 			if (intr_cause & SPI_INT_CPU_ON) {
@@ -676,7 +677,7 @@
 {
 	struct qcaspi *qca = data;
 
-	qca->intr_req++;
+	set_bit(SPI_INTR, &qca->intr);
 	if (qca->spi_thread)
 		wake_up_process(qca->spi_thread);
 
@@ -692,8 +693,7 @@
 	if (!qca)
 		return -EINVAL;
 
-	qca->intr_req = 1;
-	qca->intr_svc = 0;
+	set_bit(SPI_INTR, &qca->intr);
 	qca->sync = QCASPI_SYNC_UNKNOWN;
 	qcafrm_fsm_init_spi(&qca->frm_handle);
 
@@ -828,7 +828,6 @@
 
 	dev->mtu = QCAFRM_MAX_MTU;
 	dev->type = ARPHRD_ETHER;
-	qca->clkspeed = qcaspi_clkspeed;
 	qca->burst_len = qcaspi_burst_len;
 	qca->spi_thread = NULL;
 	qca->buffer_size = (dev->mtu + VLAN_ETH_HLEN + QCAFRM_HEADER_LEN +
@@ -917,17 +916,15 @@
 	legacy_mode = of_property_read_bool(spi->dev.of_node,
 					    "qca,legacy-mode");
 
-	if (qcaspi_clkspeed == 0) {
-		if (spi->max_speed_hz)
-			qcaspi_clkspeed = spi->max_speed_hz;
-		else
-			qcaspi_clkspeed = QCASPI_CLK_SPEED;
-	}
-
-	if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) ||
-	    (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) {
-		dev_err(&spi->dev, "Invalid clkspeed: %d\n",
-			qcaspi_clkspeed);
+	if (qcaspi_clkspeed)
+		spi->max_speed_hz = qcaspi_clkspeed;
+	else if (!spi->max_speed_hz)
+		spi->max_speed_hz = QCASPI_CLK_SPEED;
+
+	if (spi->max_speed_hz < QCASPI_CLK_SPEED_MIN ||
+	    spi->max_speed_hz > QCASPI_CLK_SPEED_MAX) {
+		dev_err(&spi->dev, "Invalid clkspeed: %u\n",
+			spi->max_speed_hz);
 		return -EINVAL;
 	}
 
@@ -952,14 +949,13 @@
 		return -EINVAL;
 	}
 
-	dev_info(&spi->dev, "ver=%s, clkspeed=%d, burst_len=%d, pluggable=%d\n",
+	dev_info(&spi->dev, "ver=%s, clkspeed=%u, burst_len=%d, pluggable=%d\n",
 		 QCASPI_DRV_VERSION,
-		 qcaspi_clkspeed,
+		 spi->max_speed_hz,
 		 qcaspi_burst_len,
 		 qcaspi_pluggable);
 
 	spi->mode = SPI_MODE_3;
-	spi->max_speed_hz = qcaspi_clkspeed;
 	if (spi_setup(spi) < 0) {
 		dev_err(&spi->dev, "Unable to setup SPI device\n");
 		return -EFAULT;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/qualcomm/qca_spi.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/qualcomm/qca_spi.h
@@ -93,8 +93,7 @@
 	struct qcafrm_handle frm_handle;
 	struct sk_buff *rx_skb;
 
-	unsigned int intr_req;
-	unsigned int intr_svc;
+	unsigned long intr;
 	u16 reset_count;
 
 #ifdef CONFIG_DEBUG_FS
@@ -102,7 +101,6 @@
 #endif
 
 	/* user configurable options */
-	u32 clkspeed;
 	u8 legacy_mode;
 	u16 burst_len;
 };
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/realtek/r8169.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/realtek/r8169.h
@@ -72,6 +72,7 @@
 };
 
 struct rtl8169_private;
+struct r8169_led_classdev;
 
 void r8169_apply_firmware(struct rtl8169_private *tp);
 u16 rtl8168h_2_get_adc_bias_ioffset(struct rtl8169_private *tp);
@@ -83,4 +84,5 @@
 			char *buf, int buf_len);
 int rtl8168_get_led_mode(struct rtl8169_private *tp);
 int rtl8168_led_mod_ctrl(struct rtl8169_private *tp, u16 mask, u16 val);
-void rtl8168_init_leds(struct net_device *ndev);
+struct r8169_led_classdev *rtl8168_init_leds(struct net_device *ndev);
+void r8169_remove_leds(struct r8169_led_classdev *leds);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/realtek/r8169_leds.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/realtek/r8169_leds.c
@@ -138,20 +138,31 @@
 	led_cdev->hw_control_get_device = r8169_led_hw_control_get_device;
 
 	/* ignore errors */
-	devm_led_classdev_register(&ndev->dev, led_cdev);
+	led_classdev_register(&ndev->dev, led_cdev);
 }
 
-void rtl8168_init_leds(struct net_device *ndev)
+struct r8169_led_classdev *rtl8168_init_leds(struct net_device *ndev)
 {
-	/* bind resource mgmt to netdev */
-	struct device *dev = &ndev->dev;
 	struct r8169_led_classdev *leds;
 	int i;
 
-	leds = devm_kcalloc(dev, RTL8168_NUM_LEDS, sizeof(*leds), GFP_KERNEL);
+	leds = kcalloc(RTL8168_NUM_LEDS + 1, sizeof(*leds), GFP_KERNEL);
 	if (!leds)
-		return;
+		return NULL;
 
 	for (i = 0; i < RTL8168_NUM_LEDS; i++)
 		rtl8168_setup_ldev(leds + i, ndev, i);
+
+	return leds;
+}
+
+void r8169_remove_leds(struct r8169_led_classdev *leds)
+{
+	if (!leds)
+		return;
+
+	for (struct r8169_led_classdev *l = leds; l->ndev; l++)
+		led_classdev_unregister(&l->led);
+
+	kfree(leds);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/realtek/r8169_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/realtek/r8169_main.c
@@ -15,6 +15,7 @@
 #include <linux/etherdevice.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
+#include <linux/dmi.h>
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <linux/if_vlan.h>
@@ -563,7 +564,34 @@
 	__le64	rx_broadcast;
 	__le32	rx_multicast;
 	__le16	tx_aborted;
-	__le16	tx_underun;
+	__le16	tx_underrun;
+	/* new since RTL8125 */
+	__le64 tx_octets;
+	__le64 rx_octets;
+	__le64 rx_multicast64;
+	__le64 tx_unicast64;
+	__le64 tx_broadcast64;
+	__le64 tx_multicast64;
+	__le32 tx_pause_on;
+	__le32 tx_pause_off;
+	__le32 tx_pause_all;
+	__le32 tx_deferred;
+	__le32 tx_late_collision;
+	__le32 tx_all_collision;
+	__le32 tx_aborted32;
+	__le32 align_errors32;
+	__le32 rx_frame_too_long;
+	__le32 rx_runt;
+	__le32 rx_pause_on;
+	__le32 rx_pause_off;
+	__le32 rx_pause_all;
+	__le32 rx_unknown_opcode;
+	__le32 rx_mac_error;
+	__le32 tx_underrun32;
+	__le32 rx_mac_missed;
+	__le32 rx_tcam_dropped;
+	__le32 tdu;
+	__le32 rdu;
 };
 
 struct rtl8169_tc_offsets {
@@ -634,6 +662,8 @@
 	const char *fw_name;
 	struct rtl_fw *rtl_fw;
 
+	struct r8169_led_classdev *leds;
+
 	u32 ocp_base;
 };
 
@@ -1255,17 +1285,40 @@
 	RTL_W8(tp, IBCR0, RTL_R8(tp, IBCR0) & ~0x01);
 }
 
+static void rtl_dash_loop_wait(struct rtl8169_private *tp,
+			       const struct rtl_cond *c,
+			       unsigned long usecs, int n, bool high)
+{
+	if (!tp->dash_enabled)
+		return;
+	rtl_loop_wait(tp, c, usecs, n, high);
+}
+
+static void rtl_dash_loop_wait_high(struct rtl8169_private *tp,
+				    const struct rtl_cond *c,
+				    unsigned long d, int n)
+{
+	rtl_dash_loop_wait(tp, c, d, n, true);
+}
+
+static void rtl_dash_loop_wait_low(struct rtl8169_private *tp,
+				   const struct rtl_cond *c,
+				   unsigned long d, int n)
+{
+	rtl_dash_loop_wait(tp, c, d, n, false);
+}
+
 static void rtl8168dp_driver_start(struct rtl8169_private *tp)
 {
 	r8168dp_oob_notify(tp, OOB_CMD_DRIVER_START);
-	rtl_loop_wait_high(tp, &rtl_dp_ocp_read_cond, 10000, 10);
+	rtl_dash_loop_wait_high(tp, &rtl_dp_ocp_read_cond, 10000, 10);
 }
 
 static void rtl8168ep_driver_start(struct rtl8169_private *tp)
 {
 	r8168ep_ocp_write(tp, 0x01, 0x180, OOB_CMD_DRIVER_START);
 	r8168ep_ocp_write(tp, 0x01, 0x30, r8168ep_ocp_read(tp, 0x30) | 0x01);
-	rtl_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30);
+	rtl_dash_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30);
 }
 
 static void rtl8168_driver_start(struct rtl8169_private *tp)
@@ -1279,7 +1332,7 @@
 static void rtl8168dp_driver_stop(struct rtl8169_private *tp)
 {
 	r8168dp_oob_notify(tp, OOB_CMD_DRIVER_STOP);
-	rtl_loop_wait_low(tp, &rtl_dp_ocp_read_cond, 10000, 10);
+	rtl_dash_loop_wait_low(tp, &rtl_dp_ocp_read_cond, 10000, 10);
 }
 
 static void rtl8168ep_driver_stop(struct rtl8169_private *tp)
@@ -1287,7 +1340,7 @@
 	rtl8168ep_stop_cmac(tp);
 	r8168ep_ocp_write(tp, 0x01, 0x180, OOB_CMD_DRIVER_STOP);
 	r8168ep_ocp_write(tp, 0x01, 0x30, r8168ep_ocp_read(tp, 0x30) | 0x01);
-	rtl_loop_wait_low(tp, &rtl_ep_ocp_read_cond, 10000, 10);
+	rtl_dash_loop_wait_low(tp, &rtl_ep_ocp_read_cond, 10000, 10);
 }
 
 static void rtl8168_driver_stop(struct rtl8169_private *tp)
@@ -1757,7 +1810,7 @@
 	data[9] = le64_to_cpu(counters->rx_broadcast);
 	data[10] = le32_to_cpu(counters->rx_multicast);
 	data[11] = le16_to_cpu(counters->tx_aborted);
-	data[12] = le16_to_cpu(counters->tx_underun);
+	data[12] = le16_to_cpu(counters->tx_underrun);
 }
 
 static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data)
@@ -4049,8 +4102,8 @@
 {
 	unsigned int padto = 0, len = skb->len;
 
-	if (rtl_is_8125(tp) && len < 128 + RTL_MIN_PATCH_LEN &&
-	    rtl_skb_is_udp(skb) && skb_transport_header_was_set(skb)) {
+	if (len < 128 + RTL_MIN_PATCH_LEN && rtl_skb_is_udp(skb) &&
+	    skb_transport_header_was_set(skb)) {
 		unsigned int trans_data_len = skb_tail_pointer(skb) -
 					      skb_transport_header(skb);
 
@@ -4074,9 +4127,15 @@
 static unsigned int rtl_quirk_packet_padto(struct rtl8169_private *tp,
 					   struct sk_buff *skb)
 {
-	unsigned int padto;
+	unsigned int padto = 0;
 
-	padto = rtl8125_quirk_udp_padto(tp, skb);
+	switch (tp->mac_version) {
+	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_63:
+		padto = rtl8125_quirk_udp_padto(tp, skb);
+		break;
+	default:
+		break;
+	}
 
 	switch (tp->mac_version) {
 	case RTL_GIGA_MAC_VER_34:
@@ -4196,17 +4255,18 @@
 static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 				      struct net_device *dev)
 {
-	unsigned int frags = skb_shinfo(skb)->nr_frags;
 	struct rtl8169_private *tp = netdev_priv(dev);
 	unsigned int entry = tp->cur_tx % NUM_TX_DESC;
 	struct TxDesc *txd_first, *txd_last;
 	bool stop_queue, door_bell;
+	unsigned int frags;
 	u32 opts[2];
 
 	if (unlikely(!rtl_tx_slots_avail(tp))) {
 		if (net_ratelimit())
 			netdev_err(dev, "BUG! Tx Ring full when queue awake!\n");
-		goto err_stop_0;
+		netif_stop_queue(dev);
+		return NETDEV_TX_BUSY;
 	}
 
 	opts[1] = rtl8169_tx_vlan_tag(skb);
@@ -4223,6 +4283,7 @@
 
 	txd_first = tp->TxDescArray + entry;
 
+	frags = skb_shinfo(skb)->nr_frags;
 	if (frags) {
 		if (rtl8169_xmit_frags(tp, skb, opts, entry))
 			goto err_dma_1;
@@ -4261,11 +4322,6 @@
 	dev_kfree_skb_any(skb);
 	dev->stats.tx_dropped++;
 	return NETDEV_TX_OK;
-
-err_stop_0:
-	netif_stop_queue(dev);
-	dev->stats.tx_dropped++;
-	return NETDEV_TX_BUSY;
 }
 
 static unsigned int rtl_last_frag_len(struct sk_buff *skb)
@@ -4502,7 +4558,9 @@
 	if ((status & 0xffff) == 0xffff || !(status & tp->irq_mask))
 		return IRQ_NONE;
 
-	if (unlikely(status & SYSErr)) {
+	/* At least RTL8168fp may unexpectedly set the SYSErr bit */
+	if (unlikely(status & SYSErr &&
+	    tp->mac_version <= RTL_GIGA_MAC_VER_06)) {
 		rtl8169_pcierr_interrupt(tp->dev);
 		goto out;
 	}
@@ -4516,10 +4574,8 @@
 		rtl_schedule_task(tp, RTL_FLAG_TASK_RESET_PENDING);
 	}
 
-	if (napi_schedule_prep(&tp->napi)) {
-		rtl_irq_disable(tp);
-		__napi_schedule(&tp->napi);
-	}
+	rtl_irq_disable(tp);
+	napi_schedule(&tp->napi);
 out:
 	rtl_ack_events(tp, status);
 
@@ -4907,6 +4963,9 @@
 
 	cancel_work_sync(&tp->wk.work);
 
+	if (IS_ENABLED(CONFIG_R8169_LEDS))
+		r8169_remove_leds(tp->leds);
+
 	unregister_netdev(tp->dev);
 
 	if (tp->dash_type != RTL_DASH_NONE)
@@ -5027,6 +5086,15 @@
 	struct mii_bus *new_bus;
 	int ret;
 
+	/* On some boards with this chip version the BIOS is buggy and misses
+	 * to reset the PHY page selector. This results in the PHY ID read
+	 * accessing registers on a different page, returning a more or
+	 * less random value. Fix this by resetting the page selector first.
+	 */
+	if (tp->mac_version == RTL_GIGA_MAC_VER_25 ||
+	    tp->mac_version == RTL_GIGA_MAC_VER_26)
+		r8169_mdio_write(tp, 0x1f, 0);
+
 	new_bus = devm_mdiobus_alloc(&pdev->dev);
 	if (!new_bus)
 		return -ENOMEM;
@@ -5164,11 +5232,87 @@
 	rtl_rar_set(tp, mac_addr);
 }
 
+static bool rtl_aspm_dell_workaround(struct rtl8169_private *tp)
+{
+	static const struct dmi_system_id sysids[] = {
+		{
+			.ident = "Dell",
+			.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+				DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 16 5640"),
+				DMI_MATCH(DMI_PRODUCT_SKU, "0CA0"),
+			},
+		},
+		{
+			.ident = "Dell",
+			.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+				DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 14 3440"),
+				DMI_MATCH(DMI_PRODUCT_SKU, "0CA5"),
+			},
+		},
+		{
+			.ident = "Dell",
+			.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+				DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 14 3440"),
+				DMI_MATCH(DMI_PRODUCT_SKU, "0CA6"),
+			},
+		},
+		{
+			.ident = "Dell",
+			.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+				DMI_MATCH(DMI_PRODUCT_NAME, "Latitude 3450"),
+				DMI_MATCH(DMI_PRODUCT_SKU, "0C99"),
+			},
+		},
+		{
+			.ident = "Dell",
+			.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+				DMI_MATCH(DMI_PRODUCT_NAME, "Latitude 3450"),
+				DMI_MATCH(DMI_PRODUCT_SKU, "0C97"),
+			},
+		},
+		{
+			.ident = "Dell",
+			.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+				DMI_MATCH(DMI_PRODUCT_NAME, "Latitude 3550"),
+				DMI_MATCH(DMI_PRODUCT_SKU, "0C9A"),
+			},
+		},
+		{
+			.ident = "Dell",
+			.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+				DMI_MATCH(DMI_PRODUCT_NAME, "Latitude 3550"),
+				DMI_MATCH(DMI_PRODUCT_SKU, "0C98"),
+			},
+		},
+		{}
+	};
+
+	if (tp->mac_version == RTL_GIGA_MAC_VER_46 && dmi_check_system(sysids))
+		return true;
+
+	return false;
+}
+
 /* register is set if system vendor successfully tested ASPM 1.2 */
 static bool rtl_aspm_is_safe(struct rtl8169_private *tp)
 {
+	 /* definition of 0xc0b2,
+	  * 0: L1
+	  * 1: ASPM L1.0
+	  * 2: ASPM L0s
+	  * 3: CLKEREQ
+	  * 4-7: Reserved
+	  */
 	if (tp->mac_version >= RTL_GIGA_MAC_VER_61 &&
-	    r8168_mac_ocp_read(tp, 0xc0b2) & 0xf)
+		r8168_mac_ocp_read(tp, 0xc0b2) & 0xf ||
+		rtl_aspm_dell_workaround(tp))
 		return true;
 
 	return false;
@@ -5359,7 +5503,7 @@
 	if (IS_ENABLED(CONFIG_R8169_LEDS) &&
 	    tp->mac_version > RTL_GIGA_MAC_VER_06 &&
 	    tp->mac_version < RTL_GIGA_MAC_VER_61)
-		rtl8168_init_leds(dev);
+		tp->leds = rtl8168_init_leds(dev);
 
 	netdev_info(dev, "%s, %pM, XID %03x, IRQ %d\n",
 		    rtl_chip_infos[chipset].name, dev->dev_addr, xid, tp->irq);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/realtek/r8169_phy_config.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/realtek/r8169_phy_config.c
@@ -1060,6 +1060,7 @@
 	phy_modify_paged(phydev, 0xa86, 0x15, 0x0001, 0x0000);
 	rtl8168g_enable_gphy_10m(phydev);
 
+	rtl8168g_disable_aldps(phydev);
 	rtl8125a_config_eee_phy(phydev);
 }
 
@@ -1099,6 +1100,7 @@
 	phy_modify_paged(phydev, 0xbf8, 0x12, 0xe000, 0xa000);
 
 	rtl8125_legacy_force_mode(phydev);
+	rtl8168g_disable_aldps(phydev);
 	rtl8125b_config_eee_phy(phydev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/renesas/ravb.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/renesas/ravb.h
@@ -1027,7 +1027,8 @@
 	int stats_len;
 	size_t max_rx_len;
 	u32 tccr_mask;
-	u32 rx_max_buf_size;
+	u32 tx_max_frame_size;
+	u32 rx_max_frame_size;
 	unsigned aligned_tx: 1;
 
 	/* hardware features */
@@ -1060,8 +1061,10 @@
 	struct ravb_desc *desc_bat;
 	dma_addr_t rx_desc_dma[NUM_RX_QUEUE];
 	dma_addr_t tx_desc_dma[NUM_TX_QUEUE];
-	struct ravb_rx_desc *gbeth_rx_ring;
-	struct ravb_ex_rx_desc *rx_ring[NUM_RX_QUEUE];
+	union {
+		struct ravb_rx_desc *desc;
+		struct ravb_ex_rx_desc *ex_desc;
+	} rx_ring[NUM_RX_QUEUE];
 	struct ravb_tx_desc *tx_ring[NUM_TX_QUEUE];
 	void *tx_align[NUM_TX_QUEUE];
 	struct sk_buff *rx_1st_skb;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/renesas/ravb_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/renesas/ravb_main.c
@@ -250,11 +250,11 @@
 	unsigned int ring_size;
 	unsigned int i;
 
-	if (!priv->gbeth_rx_ring)
+	if (!priv->rx_ring[q].desc)
 		return;
 
 	for (i = 0; i < priv->num_rx_ring[q]; i++) {
-		struct ravb_rx_desc *desc = &priv->gbeth_rx_ring[i];
+		struct ravb_rx_desc *desc = &priv->rx_ring[q].desc[i];
 
 		if (!dma_mapping_error(ndev->dev.parent,
 				       le32_to_cpu(desc->dptr)))
@@ -264,9 +264,9 @@
 					 DMA_FROM_DEVICE);
 	}
 	ring_size = sizeof(struct ravb_rx_desc) * (priv->num_rx_ring[q] + 1);
-	dma_free_coherent(ndev->dev.parent, ring_size, priv->gbeth_rx_ring,
+	dma_free_coherent(ndev->dev.parent, ring_size, priv->rx_ring[q].desc,
 			  priv->rx_desc_dma[q]);
-	priv->gbeth_rx_ring = NULL;
+	priv->rx_ring[q].desc = NULL;
 }
 
 static void ravb_rx_ring_free_rcar(struct net_device *ndev, int q)
@@ -275,11 +275,11 @@
 	unsigned int ring_size;
 	unsigned int i;
 
-	if (!priv->rx_ring[q])
+	if (!priv->rx_ring[q].ex_desc)
 		return;
 
 	for (i = 0; i < priv->num_rx_ring[q]; i++) {
-		struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
+		struct ravb_ex_rx_desc *desc = &priv->rx_ring[q].ex_desc[i];
 
 		if (!dma_mapping_error(ndev->dev.parent,
 				       le32_to_cpu(desc->dptr)))
@@ -290,9 +290,9 @@
 	}
 	ring_size = sizeof(struct ravb_ex_rx_desc) *
 		    (priv->num_rx_ring[q] + 1);
-	dma_free_coherent(ndev->dev.parent, ring_size, priv->rx_ring[q],
+	dma_free_coherent(ndev->dev.parent, ring_size, priv->rx_ring[q].ex_desc,
 			  priv->rx_desc_dma[q]);
-	priv->rx_ring[q] = NULL;
+	priv->rx_ring[q].ex_desc = NULL;
 }
 
 /* Free skb's and DMA buffers for Ethernet AVB */
@@ -344,11 +344,11 @@
 	unsigned int i;
 
 	rx_ring_size = sizeof(*rx_desc) * priv->num_rx_ring[q];
-	memset(priv->gbeth_rx_ring, 0, rx_ring_size);
+	memset(priv->rx_ring[q].desc, 0, rx_ring_size);
 	/* Build RX ring buffer */
 	for (i = 0; i < priv->num_rx_ring[q]; i++) {
 		/* RX descriptor */
-		rx_desc = &priv->gbeth_rx_ring[i];
+		rx_desc = &priv->rx_ring[q].desc[i];
 		rx_desc->ds_cc = cpu_to_le16(GBETH_RX_DESC_DATA_SIZE);
 		dma_addr = dma_map_single(ndev->dev.parent, priv->rx_skb[q][i]->data,
 					  GBETH_RX_BUFF_MAX,
@@ -361,7 +361,7 @@
 		rx_desc->dptr = cpu_to_le32(dma_addr);
 		rx_desc->die_dt = DT_FEMPTY;
 	}
-	rx_desc = &priv->gbeth_rx_ring[i];
+	rx_desc = &priv->rx_ring[q].desc[i];
 	rx_desc->dptr = cpu_to_le32((u32)priv->rx_desc_dma[q]);
 	rx_desc->die_dt = DT_LINKFIX; /* type */
 }
@@ -374,11 +374,11 @@
 	dma_addr_t dma_addr;
 	unsigned int i;
 
-	memset(priv->rx_ring[q], 0, rx_ring_size);
+	memset(priv->rx_ring[q].ex_desc, 0, rx_ring_size);
 	/* Build RX ring buffer */
 	for (i = 0; i < priv->num_rx_ring[q]; i++) {
 		/* RX descriptor */
-		rx_desc = &priv->rx_ring[q][i];
+		rx_desc = &priv->rx_ring[q].ex_desc[i];
 		rx_desc->ds_cc = cpu_to_le16(RX_BUF_SZ);
 		dma_addr = dma_map_single(ndev->dev.parent, priv->rx_skb[q][i]->data,
 					  RX_BUF_SZ,
@@ -391,7 +391,7 @@
 		rx_desc->dptr = cpu_to_le32(dma_addr);
 		rx_desc->die_dt = DT_FEMPTY;
 	}
-	rx_desc = &priv->rx_ring[q][i];
+	rx_desc = &priv->rx_ring[q].ex_desc[i];
 	rx_desc->dptr = cpu_to_le32((u32)priv->rx_desc_dma[q]);
 	rx_desc->die_dt = DT_LINKFIX; /* type */
 }
@@ -446,10 +446,10 @@
 
 	ring_size = sizeof(struct ravb_rx_desc) * (priv->num_rx_ring[q] + 1);
 
-	priv->gbeth_rx_ring = dma_alloc_coherent(ndev->dev.parent, ring_size,
-						 &priv->rx_desc_dma[q],
-						 GFP_KERNEL);
-	return priv->gbeth_rx_ring;
+	priv->rx_ring[q].desc = dma_alloc_coherent(ndev->dev.parent, ring_size,
+						   &priv->rx_desc_dma[q],
+						   GFP_KERNEL);
+	return priv->rx_ring[q].desc;
 }
 
 static void *ravb_alloc_rx_desc_rcar(struct net_device *ndev, int q)
@@ -459,10 +459,11 @@
 
 	ring_size = sizeof(struct ravb_ex_rx_desc) * (priv->num_rx_ring[q] + 1);
 
-	priv->rx_ring[q] = dma_alloc_coherent(ndev->dev.parent, ring_size,
-					      &priv->rx_desc_dma[q],
-					      GFP_KERNEL);
-	return priv->rx_ring[q];
+	priv->rx_ring[q].ex_desc = dma_alloc_coherent(ndev->dev.parent,
+						      ring_size,
+						      &priv->rx_desc_dma[q],
+						      GFP_KERNEL);
+	return priv->rx_ring[q].ex_desc;
 }
 
 /* Init skb and descriptor buffer for Ethernet AVB */
@@ -561,8 +562,16 @@
 
 static void ravb_emac_init_rcar(struct net_device *ndev)
 {
-	/* Receive frame limit set register */
-	ravb_write(ndev, ndev->mtu + ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN, RFLR);
+	struct ravb_private *priv = netdev_priv(ndev);
+
+	/* Set receive frame length
+	 *
+	 * The length set here describes the frame from the destination address
+	 * up to and including the CRC data. However only the frame data,
+	 * excluding the CRC, are transferred to memory. To allow for the
+	 * largest frames add the CRC length to the maximum Rx descriptor size.
+	 */
+	ravb_write(ndev, priv->info->rx_max_frame_size + ETH_FCS_LEN, RFLR);
 
 	/* EMAC Mode: PAUSE prohibition; Duplex; RX Checksum; TX; RX */
 	ravb_write(ndev, ECMR_ZPF | ECMR_DM |
@@ -780,12 +789,15 @@
 	int limit;
 	int i;
 
-	entry = priv->cur_rx[q] % priv->num_rx_ring[q];
 	limit = priv->dirty_rx[q] + priv->num_rx_ring[q] - priv->cur_rx[q];
 	stats = &priv->stats[q];
 
-	desc = &priv->gbeth_rx_ring[entry];
-	for (i = 0; i < limit && rx_packets < *quota && desc->die_dt != DT_FEMPTY; i++) {
+	for (i = 0; i < limit; i++, priv->cur_rx[q]++) {
+		entry = priv->cur_rx[q] % priv->num_rx_ring[q];
+		desc = &priv->rx_ring[q].desc[entry];
+		if (rx_packets == *quota || desc->die_dt == DT_FEMPTY)
+			break;
+
 		/* Descriptor type must be checked before all other reads */
 		dma_rmb();
 		desc_status = desc->msc;
@@ -849,15 +861,12 @@
 				break;
 			}
 		}
-
-		entry = (++priv->cur_rx[q]) % priv->num_rx_ring[q];
-		desc = &priv->gbeth_rx_ring[entry];
 	}
 
 	/* Refill the RX ring buffers. */
 	for (; priv->cur_rx[q] - priv->dirty_rx[q] > 0; priv->dirty_rx[q]++) {
 		entry = priv->dirty_rx[q] % priv->num_rx_ring[q];
-		desc = &priv->gbeth_rx_ring[entry];
+		desc = &priv->rx_ring[q].desc[entry];
 		desc->ds_cc = cpu_to_le16(GBETH_RX_DESC_DATA_SIZE);
 
 		if (!priv->rx_skb[q][entry]) {
@@ -893,30 +902,29 @@
 {
 	struct ravb_private *priv = netdev_priv(ndev);
 	const struct ravb_hw_info *info = priv->info;
-	int entry = priv->cur_rx[q] % priv->num_rx_ring[q];
-	int boguscnt = (priv->dirty_rx[q] + priv->num_rx_ring[q]) -
-			priv->cur_rx[q];
 	struct net_device_stats *stats = &priv->stats[q];
 	struct ravb_ex_rx_desc *desc;
+	unsigned int limit, i;
 	struct sk_buff *skb;
 	dma_addr_t dma_addr;
 	struct timespec64 ts;
+	int rx_packets = 0;
 	u8  desc_status;
 	u16 pkt_len;
-	int limit;
+	int entry;
+
+	limit = priv->dirty_rx[q] + priv->num_rx_ring[q] - priv->cur_rx[q];
+	for (i = 0; i < limit; i++, priv->cur_rx[q]++) {
+		entry = priv->cur_rx[q] % priv->num_rx_ring[q];
+		desc = &priv->rx_ring[q].ex_desc[entry];
+		if (rx_packets == *quota || desc->die_dt == DT_FEMPTY)
+			break;
 
-	boguscnt = min(boguscnt, *quota);
-	limit = boguscnt;
-	desc = &priv->rx_ring[q][entry];
-	while (desc->die_dt != DT_FEMPTY) {
 		/* Descriptor type must be checked before all other reads */
 		dma_rmb();
 		desc_status = desc->msc;
 		pkt_len = le16_to_cpu(desc->ds_cc) & RX_DS;
 
-		if (--boguscnt < 0)
-			break;
-
 		/* We use 0-byte descriptors to mark the DMA mapping errors */
 		if (!pkt_len)
 			continue;
@@ -962,18 +970,15 @@
 			if (ndev->features & NETIF_F_RXCSUM)
 				ravb_rx_csum(skb);
 			napi_gro_receive(&priv->napi[q], skb);
-			stats->rx_packets++;
+			rx_packets++;
 			stats->rx_bytes += pkt_len;
 		}
-
-		entry = (++priv->cur_rx[q]) % priv->num_rx_ring[q];
-		desc = &priv->rx_ring[q][entry];
 	}
 
 	/* Refill the RX ring buffers. */
 	for (; priv->cur_rx[q] - priv->dirty_rx[q] > 0; priv->dirty_rx[q]++) {
 		entry = priv->dirty_rx[q] % priv->num_rx_ring[q];
-		desc = &priv->rx_ring[q][entry];
+		desc = &priv->rx_ring[q].ex_desc[entry];
 		desc->ds_cc = cpu_to_le16(RX_BUF_SZ);
 
 		if (!priv->rx_skb[q][entry]) {
@@ -998,9 +1003,9 @@
 		desc->die_dt = DT_FEMPTY;
 	}
 
-	*quota -= limit - (++boguscnt);
-
-	return boguscnt <= 0;
+	stats->rx_packets += rx_packets;
+	*quota -= rx_packets;
+	return *quota == 0;
 }
 
 /* Packet receive function for Ethernet AVB */
@@ -1284,25 +1289,16 @@
 	struct net_device *ndev = napi->dev;
 	struct ravb_private *priv = netdev_priv(ndev);
 	const struct ravb_hw_info *info = priv->info;
-	bool gptp = info->gptp || info->ccc_gac;
-	struct ravb_rx_desc *desc;
 	unsigned long flags;
 	int q = napi - priv->napi;
 	int mask = BIT(q);
 	int quota = budget;
-	unsigned int entry;
+	bool unmask;
 
-	if (!gptp) {
-		entry = priv->cur_rx[q] % priv->num_rx_ring[q];
-		desc = &priv->gbeth_rx_ring[entry];
-	}
 	/* Processing RX Descriptor Ring */
 	/* Clear RX interrupt */
 	ravb_write(ndev, ~(mask | RIS0_RESERVED), RIS0);
-	if (gptp || desc->die_dt != DT_FEMPTY) {
-		if (ravb_rx(ndev, &quota, q))
-			goto out;
-	}
+	unmask = !ravb_rx(ndev, &quota, q);
 
 	/* Processing TX Descriptor Ring */
 	spin_lock_irqsave(&priv->lock, flags);
@@ -1312,6 +1308,18 @@
 	netif_wake_subqueue(ndev, q);
 	spin_unlock_irqrestore(&priv->lock, flags);
 
+	/* Receive error message handling */
+	priv->rx_over_errors = priv->stats[RAVB_BE].rx_over_errors;
+	if (info->nc_queues)
+		priv->rx_over_errors += priv->stats[RAVB_NC].rx_over_errors;
+	if (priv->rx_over_errors != ndev->stats.rx_over_errors)
+		ndev->stats.rx_over_errors = priv->rx_over_errors;
+	if (priv->rx_fifo_errors != ndev->stats.rx_fifo_errors)
+		ndev->stats.rx_fifo_errors = priv->rx_fifo_errors;
+
+	if (!unmask)
+		goto out;
+
 	napi_complete(napi);
 
 	/* Re-enable RX/TX interrupts */
@@ -1325,14 +1333,6 @@
 	}
 	spin_unlock_irqrestore(&priv->lock, flags);
 
-	/* Receive error message handling */
-	priv->rx_over_errors =  priv->stats[RAVB_BE].rx_over_errors;
-	if (info->nc_queues)
-		priv->rx_over_errors += priv->stats[RAVB_NC].rx_over_errors;
-	if (priv->rx_over_errors != ndev->stats.rx_over_errors)
-		ndev->stats.rx_over_errors = priv->rx_over_errors;
-	if (priv->rx_fifo_errors != ndev->stats.rx_fifo_errors)
-		ndev->stats.rx_fifo_errors = priv->rx_fifo_errors;
 out:
 	return budget - quota;
 }
@@ -1674,20 +1674,19 @@
 	struct ravb_private *priv = netdev_priv(ndev);
 	const struct ravb_hw_info *hw_info = priv->info;
 
-	info->so_timestamping =
-		SOF_TIMESTAMPING_TX_SOFTWARE |
-		SOF_TIMESTAMPING_RX_SOFTWARE |
-		SOF_TIMESTAMPING_SOFTWARE |
-		SOF_TIMESTAMPING_TX_HARDWARE |
-		SOF_TIMESTAMPING_RX_HARDWARE |
-		SOF_TIMESTAMPING_RAW_HARDWARE;
-	info->tx_types = (1 << HWTSTAMP_TX_OFF) | (1 << HWTSTAMP_TX_ON);
-	info->rx_filters =
-		(1 << HWTSTAMP_FILTER_NONE) |
-		(1 << HWTSTAMP_FILTER_PTP_V2_L2_EVENT) |
-		(1 << HWTSTAMP_FILTER_ALL);
-	if (hw_info->gptp || hw_info->ccc_gac)
+	if (hw_info->gptp || hw_info->ccc_gac) {
+		info->so_timestamping =
+			SOF_TIMESTAMPING_TX_SOFTWARE |
+			SOF_TIMESTAMPING_TX_HARDWARE |
+			SOF_TIMESTAMPING_RX_HARDWARE |
+			SOF_TIMESTAMPING_RAW_HARDWARE;
+		info->tx_types = (1 << HWTSTAMP_TX_OFF) | (1 << HWTSTAMP_TX_ON);
+		info->rx_filters =
+			(1 << HWTSTAMP_FILTER_NONE) |
+			(1 << HWTSTAMP_FILTER_PTP_V2_L2_EVENT) |
+			(1 << HWTSTAMP_FILTER_ALL);
 		info->phc_index = ptp_clock_index(priv->ptp.clock);
+	}
 
 	return 0;
 }
@@ -2445,7 +2444,8 @@
 	.stats_len = ARRAY_SIZE(ravb_gstrings_stats),
 	.max_rx_len = RX_BUF_SZ + RAVB_ALIGN - 1,
 	.tccr_mask = TCCR_TSRQ0 | TCCR_TSRQ1 | TCCR_TSRQ2 | TCCR_TSRQ3,
-	.rx_max_buf_size = SZ_2K,
+	.tx_max_frame_size = SZ_2K,
+	.rx_max_frame_size = SZ_2K,
 	.internal_delay = 1,
 	.tx_counters = 1,
 	.multi_irqs = 1,
@@ -2471,7 +2471,8 @@
 	.stats_len = ARRAY_SIZE(ravb_gstrings_stats),
 	.max_rx_len = RX_BUF_SZ + RAVB_ALIGN - 1,
 	.tccr_mask = TCCR_TSRQ0 | TCCR_TSRQ1 | TCCR_TSRQ2 | TCCR_TSRQ3,
-	.rx_max_buf_size = SZ_2K,
+	.tx_max_frame_size = SZ_2K,
+	.rx_max_frame_size = SZ_2K,
 	.aligned_tx = 1,
 	.gptp = 1,
 	.nc_queues = 1,
@@ -2494,7 +2495,8 @@
 	.stats_len = ARRAY_SIZE(ravb_gstrings_stats),
 	.max_rx_len = RX_BUF_SZ + RAVB_ALIGN - 1,
 	.tccr_mask = TCCR_TSRQ0 | TCCR_TSRQ1 | TCCR_TSRQ2 | TCCR_TSRQ3,
-	.rx_max_buf_size = SZ_2K,
+	.tx_max_frame_size = SZ_2K,
+	.rx_max_frame_size = SZ_2K,
 	.multi_irqs = 1,
 	.err_mgmt_irqs = 1,
 	.gptp = 1,
@@ -2517,7 +2519,8 @@
 	.stats_len = ARRAY_SIZE(ravb_gstrings_stats_gbeth),
 	.max_rx_len = ALIGN(GBETH_RX_BUFF_MAX, RAVB_ALIGN),
 	.tccr_mask = TCCR_TSRQ0,
-	.rx_max_buf_size = SZ_8K,
+	.tx_max_frame_size = 1522,
+	.rx_max_frame_size = SZ_8K,
 	.aligned_tx = 1,
 	.tx_counters = 1,
 	.carrier_counters = 1,
@@ -2788,7 +2791,7 @@
 		clk_prepare_enable(priv->gptp_clk);
 	}
 
-	ndev->max_mtu = info->rx_max_buf_size - (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN);
+	ndev->max_mtu = info->tx_max_frame_size - (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN);
 	ndev->min_mtu = ETH_MIN_MTU;
 
 	/* FIXME: R-Car Gen2 has 4byte alignment restriction for tx buffer
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/renesas/rswitch.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/renesas/rswitch.c
@@ -547,7 +547,6 @@
 	desc = &gq->ts_ring[gq->ring_size];
 	desc->desc.die_dt = DT_LINKFIX;
 	rswitch_desc_set_dptr(&desc->desc, gq->ring_dma);
-	INIT_LIST_HEAD(&priv->gwca.ts_info_list);
 
 	return 0;
 }
@@ -862,24 +861,24 @@
 	struct rswitch_ext_desc *desc;
 	struct sk_buff *skb;
 
-	for (; rswitch_get_num_cur_queues(gq) > 0;
-	     gq->dirty = rswitch_next_queue_index(gq, false, 1)) {
-		desc = &gq->tx_ring[gq->dirty];
-		if ((desc->desc.die_dt & DT_MASK) != DT_FEMPTY)
-			break;
-
+	desc = &gq->tx_ring[gq->dirty];
+	while ((desc->desc.die_dt & DT_MASK) == DT_FEMPTY) {
 		dma_rmb();
+
 		skb = gq->skbs[gq->dirty];
 		if (skb) {
+			rdev->ndev->stats.tx_packets++;
+			rdev->ndev->stats.tx_bytes += skb->len;
 			dma_unmap_single(ndev->dev.parent,
 					 gq->unmap_addrs[gq->dirty],
 					 skb->len, DMA_TO_DEVICE);
 			dev_kfree_skb_any(gq->skbs[gq->dirty]);
 			gq->skbs[gq->dirty] = NULL;
-			rdev->ndev->stats.tx_packets++;
-			rdev->ndev->stats.tx_bytes += skb->len;
 		}
+
 		desc->desc.die_dt = DT_EEMPTY;
+		gq->dirty = rswitch_next_queue_index(gq, false, 1);
+		desc = &gq->tx_ring[gq->dirty];
 	}
 }
 
@@ -908,8 +907,10 @@
 
 	if (napi_complete_done(napi, budget - quota)) {
 		spin_lock_irqsave(&priv->lock, flags);
-		rswitch_enadis_data_irq(priv, rdev->tx_queue->index, true);
-		rswitch_enadis_data_irq(priv, rdev->rx_queue->index, true);
+		if (test_bit(rdev->port, priv->opened_ports)) {
+			rswitch_enadis_data_irq(priv, rdev->tx_queue->index, true);
+			rswitch_enadis_data_irq(priv, rdev->rx_queue->index, true);
+		}
 		spin_unlock_irqrestore(&priv->lock, flags);
 	}
 
@@ -1001,9 +1002,10 @@
 static void rswitch_ts(struct rswitch_private *priv)
 {
 	struct rswitch_gwca_queue *gq = &priv->gwca.ts_queue;
-	struct rswitch_gwca_ts_info *ts_info, *ts_info2;
 	struct skb_shared_hwtstamps shhwtstamps;
 	struct rswitch_ts_desc *desc;
+	struct rswitch_device *rdev;
+	struct sk_buff *ts_skb;
 	struct timespec64 ts;
 	unsigned int num;
 	u32 tag, port;
@@ -1013,23 +1015,28 @@
 		dma_rmb();
 
 		port = TS_DESC_DPN(__le32_to_cpu(desc->desc.dptrl));
-		tag = TS_DESC_TSUN(__le32_to_cpu(desc->desc.dptrl));
-
-		list_for_each_entry_safe(ts_info, ts_info2, &priv->gwca.ts_info_list, list) {
-			if (!(ts_info->port == port && ts_info->tag == tag))
-				continue;
+		if (unlikely(port >= RSWITCH_NUM_PORTS))
+			goto next;
+		rdev = priv->rdev[port];
 
-			memset(&shhwtstamps, 0, sizeof(shhwtstamps));
-			ts.tv_sec = __le32_to_cpu(desc->ts_sec);
-			ts.tv_nsec = __le32_to_cpu(desc->ts_nsec & cpu_to_le32(0x3fffffff));
-			shhwtstamps.hwtstamp = timespec64_to_ktime(ts);
-			skb_tstamp_tx(ts_info->skb, &shhwtstamps);
-			dev_consume_skb_irq(ts_info->skb);
-			list_del(&ts_info->list);
-			kfree(ts_info);
-			break;
-		}
+		tag = TS_DESC_TSUN(__le32_to_cpu(desc->desc.dptrl));
+		if (unlikely(tag >= TS_TAGS_PER_PORT))
+			goto next;
+		ts_skb = xchg(&rdev->ts_skb[tag], NULL);
+		smp_mb(); /* order rdev->ts_skb[] read before bitmap update */
+		clear_bit(tag, rdev->ts_skb_used);
+
+		if (unlikely(!ts_skb))
+			goto next;
+
+		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+		ts.tv_sec = __le32_to_cpu(desc->ts_sec);
+		ts.tv_nsec = __le32_to_cpu(desc->ts_nsec & cpu_to_le32(0x3fffffff));
+		shhwtstamps.hwtstamp = timespec64_to_ktime(ts);
+		skb_tstamp_tx(ts_skb, &shhwtstamps);
+		dev_consume_skb_irq(ts_skb);
 
+next:
 		gq->cur = rswitch_next_queue_index(gq, true, 1);
 		desc = &gq->ts_ring[gq->cur];
 	}
@@ -1114,25 +1121,40 @@
 
 static void rswitch_rmac_setting(struct rswitch_etha *etha, const u8 *mac)
 {
-	u32 val;
+	u32 pis, lsc;
 
 	rswitch_etha_write_mac_address(etha, mac);
 
+	switch (etha->phy_interface) {
+	case PHY_INTERFACE_MODE_SGMII:
+		pis = MPIC_PIS_GMII;
+		break;
+	case PHY_INTERFACE_MODE_USXGMII:
+	case PHY_INTERFACE_MODE_5GBASER:
+		pis = MPIC_PIS_XGMII;
+		break;
+	default:
+		pis = FIELD_GET(MPIC_PIS, ioread32(etha->addr + MPIC));
+		break;
+	}
+
 	switch (etha->speed) {
 	case 100:
-		val = MPIC_LSC_100M;
+		lsc = MPIC_LSC_100M;
 		break;
 	case 1000:
-		val = MPIC_LSC_1G;
+		lsc = MPIC_LSC_1G;
 		break;
 	case 2500:
-		val = MPIC_LSC_2_5G;
+		lsc = MPIC_LSC_2_5G;
 		break;
 	default:
-		return;
+		lsc = FIELD_GET(MPIC_LSC, ioread32(etha->addr + MPIC));
+		break;
 	}
 
-	iowrite32(MPIC_PIS_GMII | val, etha->addr + MPIC);
+	rswitch_modify(etha->addr, MPIC, MPIC_PIS | MPIC_LSC,
+		       FIELD_PREP(MPIC_PIS, pis) | FIELD_PREP(MPIC_LSC, lsc));
 }
 
 static void rswitch_etha_enable_mii(struct rswitch_etha *etha)
@@ -1538,20 +1560,20 @@
 	struct rswitch_device *rdev = netdev_priv(ndev);
 	unsigned long flags;
 
-	phy_start(ndev->phydev);
+	if (bitmap_empty(rdev->priv->opened_ports, RSWITCH_NUM_PORTS))
+		iowrite32(GWCA_TS_IRQ_BIT, rdev->priv->addr + GWTSDIE);
 
 	napi_enable(&rdev->napi);
-	netif_start_queue(ndev);
 
 	spin_lock_irqsave(&rdev->priv->lock, flags);
+	bitmap_set(rdev->priv->opened_ports, rdev->port, 1);
 	rswitch_enadis_data_irq(rdev->priv, rdev->tx_queue->index, true);
 	rswitch_enadis_data_irq(rdev->priv, rdev->rx_queue->index, true);
 	spin_unlock_irqrestore(&rdev->priv->lock, flags);
 
-	if (bitmap_empty(rdev->priv->opened_ports, RSWITCH_NUM_PORTS))
-		iowrite32(GWCA_TS_IRQ_BIT, rdev->priv->addr + GWTSDIE);
+	phy_start(ndev->phydev);
 
-	bitmap_set(rdev->priv->opened_ports, rdev->port, 1);
+	netif_start_queue(ndev);
 
 	return 0;
 };
@@ -1559,31 +1581,34 @@
 static int rswitch_stop(struct net_device *ndev)
 {
 	struct rswitch_device *rdev = netdev_priv(ndev);
-	struct rswitch_gwca_ts_info *ts_info, *ts_info2;
+	struct sk_buff *ts_skb;
 	unsigned long flags;
+	unsigned int tag;
 
 	netif_tx_stop_all_queues(ndev);
-	bitmap_clear(rdev->priv->opened_ports, rdev->port, 1);
 
-	if (bitmap_empty(rdev->priv->opened_ports, RSWITCH_NUM_PORTS))
-		iowrite32(GWCA_TS_IRQ_BIT, rdev->priv->addr + GWTSDID);
-
-	list_for_each_entry_safe(ts_info, ts_info2, &rdev->priv->gwca.ts_info_list, list) {
-		if (ts_info->port != rdev->port)
-			continue;
-		dev_kfree_skb_irq(ts_info->skb);
-		list_del(&ts_info->list);
-		kfree(ts_info);
-	}
+	phy_stop(ndev->phydev);
 
 	spin_lock_irqsave(&rdev->priv->lock, flags);
 	rswitch_enadis_data_irq(rdev->priv, rdev->tx_queue->index, false);
 	rswitch_enadis_data_irq(rdev->priv, rdev->rx_queue->index, false);
+	bitmap_clear(rdev->priv->opened_ports, rdev->port, 1);
 	spin_unlock_irqrestore(&rdev->priv->lock, flags);
 
-	phy_stop(ndev->phydev);
 	napi_disable(&rdev->napi);
 
+	if (bitmap_empty(rdev->priv->opened_ports, RSWITCH_NUM_PORTS))
+		iowrite32(GWCA_TS_IRQ_BIT, rdev->priv->addr + GWTSDID);
+
+	for (tag = find_first_bit(rdev->ts_skb_used, TS_TAGS_PER_PORT);
+	     tag < TS_TAGS_PER_PORT;
+	     tag = find_next_bit(rdev->ts_skb_used, TS_TAGS_PER_PORT, tag + 1)) {
+		ts_skb = xchg(&rdev->ts_skb[tag], NULL);
+		clear_bit(tag, rdev->ts_skb_used);
+		if (ts_skb)
+			dev_kfree_skb(ts_skb);
+	}
+
 	return 0;
 };
 
@@ -1594,20 +1619,17 @@
 	desc->info1 = cpu_to_le64(INFO1_DV(BIT(rdev->etha->index)) |
 				  INFO1_IPV(GWCA_IPV_NUM) | INFO1_FMT);
 	if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
-		struct rswitch_gwca_ts_info *ts_info;
+		unsigned int tag;
 
-		ts_info = kzalloc(sizeof(*ts_info), GFP_ATOMIC);
-		if (!ts_info)
+		tag = find_first_zero_bit(rdev->ts_skb_used, TS_TAGS_PER_PORT);
+		if (tag == TS_TAGS_PER_PORT)
 			return false;
+		smp_mb(); /* order bitmap read before rdev->ts_skb[] write */
+		rdev->ts_skb[tag] = skb_get(skb);
+		set_bit(tag, rdev->ts_skb_used);
 
 		skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
-		rdev->ts_tag++;
-		desc->info1 |= cpu_to_le64(INFO1_TSUN(rdev->ts_tag) | INFO1_TXC);
-
-		ts_info->skb = skb_get(skb);
-		ts_info->port = rdev->port;
-		ts_info->tag = rdev->ts_tag;
-		list_add_tail(&ts_info->list, &rdev->priv->gwca.ts_info_list);
+		desc->info1 |= cpu_to_le64(INFO1_TSUN(tag) | INFO1_TXC);
 
 		skb_tx_timestamp(skb);
 	}
@@ -1681,8 +1703,11 @@
 	if (dma_mapping_error(ndev->dev.parent, dma_addr_orig))
 		goto err_kfree;
 
-	gq->skbs[gq->cur] = skb;
-	gq->unmap_addrs[gq->cur] = dma_addr_orig;
+	/* Stored the skb at the last descriptor to avoid skb free before hardware completes send */
+	gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb;
+	gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig;
+
+	dma_wmb();
 
 	/* DT_FSTART should be set at last. So, this is reverse order. */
 	for (i = nr_desc; i-- > 0; ) {
@@ -1694,14 +1719,13 @@
 			goto err_unmap;
 	}
 
-	wmb();	/* gq->cur must be incremented after die_dt was set */
-
 	gq->cur = rswitch_next_queue_index(gq, true, nr_desc);
 	rswitch_modify(rdev->addr, GWTRC(gq->index), 0, BIT(gq->index % 32));
 
 	return ret;
 
 err_unmap:
+	gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = NULL;
 	dma_unmap_single(ndev->dev.parent, dma_addr_orig, skb->len, DMA_TO_DEVICE);
 
 err_kfree:
@@ -1891,7 +1915,6 @@
 	rdev->np_port = rswitch_get_port_node(rdev);
 	rdev->disabled = !rdev->np_port;
 	err = of_get_ethdev_address(rdev->np_port, ndev);
-	of_node_put(rdev->np_port);
 	if (err) {
 		if (is_valid_ether_addr(rdev->etha->mac_addr))
 			eth_hw_addr_set(ndev, rdev->etha->mac_addr);
@@ -1921,6 +1944,7 @@
 
 out_rxdmac:
 out_get_params:
+	of_node_put(rdev->np_port);
 	netif_napi_del(&rdev->napi);
 	free_netdev(ndev);
 
@@ -1934,6 +1958,7 @@
 
 	rswitch_txdmac_free(ndev);
 	rswitch_rxdmac_free(ndev);
+	of_node_put(rdev->np_port);
 	netif_napi_del(&rdev->napi);
 	free_netdev(ndev);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/renesas/rswitch.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/renesas/rswitch.h
@@ -724,13 +724,13 @@
 
 #define EAVCC_VEM_SC_TAG	(0x3 << 16)
 
-#define MPIC_PIS_MII		0x00
-#define MPIC_PIS_GMII		0x02
-#define MPIC_PIS_XGMII		0x04
-#define MPIC_LSC_SHIFT		3
-#define MPIC_LSC_100M		(1 << MPIC_LSC_SHIFT)
-#define MPIC_LSC_1G		(2 << MPIC_LSC_SHIFT)
-#define MPIC_LSC_2_5G		(3 << MPIC_LSC_SHIFT)
+#define MPIC_PIS		GENMASK(2, 0)
+#define MPIC_PIS_GMII		2
+#define MPIC_PIS_XGMII		4
+#define MPIC_LSC		GENMASK(5, 3)
+#define MPIC_LSC_100M		1
+#define MPIC_LSC_1G		2
+#define MPIC_LSC_2_5G		3
 
 #define MDIO_READ_C45		0x03
 #define MDIO_WRITE_C45		0x01
@@ -972,14 +972,6 @@
 	};
 };
 
-struct rswitch_gwca_ts_info {
-	struct sk_buff *skb;
-	struct list_head list;
-
-	int port;
-	u8 tag;
-};
-
 #define RSWITCH_NUM_IRQ_REGS	(RSWITCH_MAX_NUM_QUEUES / BITS_PER_TYPE(u32))
 struct rswitch_gwca {
 	unsigned int index;
@@ -989,7 +981,6 @@
 	struct rswitch_gwca_queue *queues;
 	int num_queues;
 	struct rswitch_gwca_queue ts_queue;
-	struct list_head ts_info_list;
 	DECLARE_BITMAP(used, RSWITCH_MAX_NUM_QUEUES);
 	u32 tx_irq_bits[RSWITCH_NUM_IRQ_REGS];
 	u32 rx_irq_bits[RSWITCH_NUM_IRQ_REGS];
@@ -997,6 +988,7 @@
 };
 
 #define NUM_QUEUES_PER_NDEV	2
+#define TS_TAGS_PER_PORT	256
 struct rswitch_device {
 	struct rswitch_private *priv;
 	struct net_device *ndev;
@@ -1004,7 +996,8 @@
 	void __iomem *addr;
 	struct rswitch_gwca_queue *tx_queue;
 	struct rswitch_gwca_queue *rx_queue;
-	u8 ts_tag;
+	struct sk_buff *ts_skb[TS_TAGS_PER_PORT];
+	DECLARE_BITMAP(ts_skb_used, TS_TAGS_PER_PORT);
 	bool disabled;
 
 	int port;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/renesas/sh_eth.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/renesas/sh_eth.c
@@ -50,7 +50,7 @@
  * the macros available to do this only define GCC 8.
  */
 __diag_push();
-__diag_ignore(GCC, 8, "-Woverride-init",
+__diag_ignore_all("-Woverride-init",
 	      "logic to initialize all and then override some is OK");
 static const u16 sh_eth_offset_gigabit[SH_ETH_MAX_REGISTER_OFFSET] = {
 	SH_ETH_OFFSET_DEFAULTS,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/rocker/rocker_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/rocker/rocker_main.c
@@ -2504,7 +2504,7 @@
 	u64 link_status = rocker_read64(rocker, PORT_PHYS_LINK_STATUS);
 	bool link_up;
 
-	link_up = link_status & (1 << rocker_port->pport);
+	link_up = link_status & (1ULL << rocker_port->pport);
 	if (link_up)
 		netif_carrier_on(rocker_port->dev);
 	else
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/seeq/ether3.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/seeq/ether3.c
@@ -847,9 +847,11 @@
 {
 	struct net_device *dev = ecard_get_drvdata(ec);
 
+	ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
 	ecard_set_drvdata(ec, NULL);
 
 	unregister_netdev(dev);
+	del_timer_sync(&priv(dev)->timer);
 	free_netdev(dev);
 	ecard_release_resources(ec);
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/sfc/tc_conntrack.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/sfc/tc_conntrack.c
@@ -16,7 +16,7 @@
 			     void *cb_priv);
 
 static const struct rhashtable_params efx_tc_ct_zone_ht_params = {
-	.key_len	= offsetof(struct efx_tc_ct_zone, linkage),
+	.key_len	= sizeof_field(struct efx_tc_ct_zone, zone),
 	.key_offset	= 0,
 	.head_offset	= offsetof(struct efx_tc_ct_zone, linkage),
 };
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/smsc/smc91x.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/smsc/smc91x.h
@@ -156,8 +156,8 @@
 		writew(*wp++, a);
 }
 
-#define SMC_inw(a, r)		_swapw(readw((a) + (r)))
-#define SMC_outw(lp, v, a, r)	writew(_swapw(v), (a) + (r))
+#define SMC_inw(a, r)		ioread16be((a) + (r))
+#define SMC_outw(lp, v, a, r)	iowrite16be(v, (a) + (r))
 #define SMC_insw(a, r, p, l)	mcf_insw(a + r, p, l)
 #define SMC_outsw(a, r, p, l)	mcf_outsw(a + r, p, l)
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -165,9 +165,9 @@
 	help
 	  Support for ethernet controllers on StarFive RISC-V SoCs
 
-	  This selects the StarFive platform specific glue layer support for
-	  the stmmac device driver. This driver is used for StarFive JH7110
-	  ethernet controller.
+	  This selects the StarFive platform specific glue layer support
+	  for the stmmac device driver. This driver is used for the
+	  StarFive JH7100 and JH7110 ethernet controllers.
 
 config DWMAC_STI
 	tristate "STi GMAC support"
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/Makefile
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/Makefile
@@ -6,7 +6,7 @@
 	      mmc_core.o stmmac_hwtstamp.o stmmac_ptp.o dwmac4_descs.o	\
 	      dwmac4_dma.o dwmac4_lib.o dwmac4_core.o dwmac5.o hwif.o \
 	      stmmac_tc.o dwxgmac2_core.o dwxgmac2_dma.o dwxgmac2_descs.o \
-	      stmmac_xdp.o stmmac_est.o \
+	      stmmac_xdp.o stmmac_est.o dw25gmac.o \
 	      $(stmmac-y)
 
 stmmac-$(CONFIG_STMMAC_SELFTESTS) += stmmac_selftests.o
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/common.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -37,9 +37,11 @@
 #define DWXGMAC_CORE_2_10	0x21
 #define DWXGMAC_CORE_2_20	0x22
 #define DWXLGMAC_CORE_2_00	0x20
+#define DW25GMAC_CORE_4_00	0x40
 
 /* Device ID */
 #define DWXGMAC_ID		0x76
+#define DW25GMAC_ID		0x55
 #define DWXLGMAC_ID		0x27
 
 #define STMMAC_CHAN0	0	/* Always supported and default for all chips */
@@ -225,6 +227,8 @@
 	unsigned long mtl_est_hlbf;
 	unsigned long mtl_est_btre;
 	unsigned long mtl_est_btrlm;
+	unsigned long max_sdu_txq_drop[MTL_MAX_TX_QUEUES];
+	unsigned long mtl_est_txq_hlbf[MTL_MAX_TX_QUEUES];
 	/* per queue statistics */
 	struct stmmac_txq_stats txq_stats[MTL_MAX_TX_QUEUES];
 	struct stmmac_rxq_stats rxq_stats[MTL_MAX_RX_QUEUES];
@@ -369,6 +373,7 @@
 	REQ_IRQ_ERR_ALL,
 	REQ_IRQ_ERR_TX,
 	REQ_IRQ_ERR_RX,
+	REQ_IRQ_ERR_SFTY,
 	REQ_IRQ_ERR_SFTY_UE,
 	REQ_IRQ_ERR_SFTY_CE,
 	REQ_IRQ_ERR_LPI,
@@ -550,6 +555,7 @@
 extern const struct stmmac_mode_ops dwmac4_ring_mode_ops;
 
 struct mac_link {
+	u32 caps;
 	u32 speed_mask;
 	u32 speed10;
 	u32 speed100;
@@ -560,6 +566,7 @@
 		u32 speed2500;
 		u32 speed5000;
 		u32 speed10000;
+		u32 speed25000;
 	} xgmii;
 	struct {
 		u32 speed25000;
@@ -618,6 +625,7 @@
 int dwmac1000_setup(struct stmmac_priv *priv);
 int dwmac4_setup(struct stmmac_priv *priv);
 int dwxgmac2_setup(struct stmmac_priv *priv);
+int dw25gmac_setup(struct stmmac_priv *priv);
 int dwxlgmac2_setup(struct stmmac_priv *priv);
 
 void stmmac_set_mac_addr(void __iomem *ioaddr, const u8 addr[6],
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dw25gmac.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dw25gmac.c
@@ -0,0 +1,238 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024 Broadcom Corporation
+ */
+#include "stmmac.h"
+#include "dwxgmac2.h"
+#include "dw25gmac.h"
+
+u32 dw25gmac_decode_vdma_count(u32 regval)
+{
+	/* compressed encoding for vdma count */
+	if (regval < 16) /* Direct mapping */
+		return regval + 1;
+	else if (regval < 20) /* 20, 24, 28, 32 */
+		return 20 + (regval - 16) * 4;
+	else if (regval < 24) /* 40, 48, 56, 64 */
+		return 40 + (regval - 20) * 8;
+	else if (regval < 28) /* 80, 96, 112, 128 */
+		return 80 + (regval - 24) * 16;
+	else  /* not defined */
+		return 0;
+}
+
+static int dw25gmac_dma_ops_wait(void __iomem *ioaddr)
+{
+	u32 value;
+
+	if (readl_poll_timeout(ioaddr + XXVGMAC_DMA_CH_IND_CONTROL, value,
+			       !(value & XGMAC_OB), 10, 200))
+		return -EBUSY;
+
+	return 0;
+}
+
+static int rd_dma_ch_ind(void __iomem *ioaddr, u8 mode, u32 channel)
+{
+	u32 reg_val = 0;
+
+	reg_val |= FIELD_PREP(XXVGMAC_MODE_SELECT, mode);
+	reg_val |= FIELD_PREP(XXVGMAC_ADDR_OFFSET, channel);
+	reg_val |= XXVGMAC_CMD_TYPE | XXVGMAC_OB;
+	writel(reg_val, ioaddr + XXVGMAC_DMA_CH_IND_CONTROL);
+	dw25gmac_dma_ops_wait(ioaddr);
+	return readl(ioaddr + XXVGMAC_DMA_CH_IND_DATA);
+}
+
+static void wr_dma_ch_ind(void __iomem *ioaddr, u8 mode, u32 channel, u32 val)
+{
+	u32 reg_val = 0;
+
+	writel(val, ioaddr + XXVGMAC_DMA_CH_IND_DATA);
+	reg_val |= FIELD_PREP(XXVGMAC_MODE_SELECT, mode);
+	reg_val |= FIELD_PREP(XXVGMAC_ADDR_OFFSET, channel);
+	reg_val |= XGMAC_OB;
+	writel(reg_val, ioaddr + XXVGMAC_DMA_CH_IND_CONTROL);
+	dw25gmac_dma_ops_wait(ioaddr);
+}
+
+void dw25gmac_dma_init(struct stmmac_priv *priv, void __iomem *ioaddr,
+		       struct stmmac_dma_cfg *dma_cfg, int atds)
+{
+	u32 tx_pdmas, rx_pdmas;
+	u32 hw_cap;
+	u32 value;
+	u32 i;
+	int ret;
+
+	ret = readl_poll_timeout(ioaddr + XGMAC_DMA_MODE, value,
+				 (value & XGMAC_HMIC), 10, 200);
+
+	value = readl(ioaddr + XGMAC_DMA_SYSBUS_MODE);
+	value &= ~(XGMAC_AAL | XGMAC_EAME);
+	if (dma_cfg->aal)
+		value |= XGMAC_AAL;
+	if (dma_cfg->eame)
+		value |= XGMAC_EAME;
+	writel(value, ioaddr + XGMAC_DMA_SYSBUS_MODE);
+
+	/* Get PDMA counts etither from the device-tree or the HW */
+	hw_cap = readl(ioaddr + XGMAC_HW_FEATURE2);
+	tx_pdmas = (priv->plat->tx_queues_to_use ? priv->plat->tx_queues_to_use :
+		   FIELD_GET(XGMAC_HWFEAT_TXQCNT, hw_cap) + 1);
+	rx_pdmas = (priv->plat->rx_queues_to_use ? priv->plat->rx_queues_to_use :
+		   FIELD_GET(XGMAC_HWFEAT_RXQCNT, hw_cap) + 1);
+
+	/* Initialize all PDMAs with burst length fields */
+	for (i = 0; i < tx_pdmas; i++) {
+		value = rd_dma_ch_ind(ioaddr, MODE_TXEXTCFG, i);
+		value &= ~(XXVGMAC_TXPBL | XXVGMAC_TPBLX8_MODE);
+		if (dma_cfg->pblx8)
+			value |= XXVGMAC_TPBLX8_MODE;
+		value |= FIELD_PREP(XXVGMAC_TXPBL, dma_cfg->pbl);
+		wr_dma_ch_ind(ioaddr, MODE_TXEXTCFG, i, value);
+	}
+
+	for (i = 0; i < rx_pdmas; i++) {
+		value = rd_dma_ch_ind(ioaddr, MODE_RXEXTCFG, i);
+		value &= ~(XXVGMAC_RXPBL | XXVGMAC_RPBLX8_MODE);
+		if (dma_cfg->pblx8)
+			value |= XXVGMAC_RPBLX8_MODE;
+		value |= FIELD_PREP(XXVGMAC_RXPBL, dma_cfg->pbl);
+		wr_dma_ch_ind(ioaddr, MODE_RXEXTCFG, i, value);
+	}
+}
+
+void dw25gmac_dma_init_tx_chan(struct stmmac_priv *priv,
+			       void __iomem *ioaddr,
+			       struct stmmac_dma_cfg *dma_cfg,
+			       dma_addr_t dma_addr, u32 chan)
+{
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 tc = (dma_cfg->tx_pdma_custom_map ? dma_cfg->tx_pdma_map[chan] : chan);
+	u32 value;
+
+	/* Descriptor cache size and prefetch threshold size */
+	value = rd_dma_ch_ind(ioaddr, MODE_TXDESCCTRL, chan);
+	value &= ~XXVGMAC_TXDCSZ;
+	value |= FIELD_PREP(XXVGMAC_TXDCSZ,
+			    dma_cfg->txdcsz);
+	value &= ~XXVGMAC_TDPS;
+	value |= FIELD_PREP(XXVGMAC_TDPS, dma_cfg->tdps);
+	wr_dma_ch_ind(ioaddr, MODE_TXDESCCTRL, chan, value);
+
+	/* PDMA to TC mapping */
+	value = rd_dma_ch_ind(ioaddr, MODE_TXEXTCFG, chan);
+	value &= ~XXVGMAC_TP2TCMP;
+	value |= FIELD_PREP(XXVGMAC_TP2TCMP, tc);
+	if (dma_cfg->orrq)
+		value |= FIELD_PREP(XXVGMAC_ORRQ, dma_cfg->orrq);
+	wr_dma_ch_ind(ioaddr, MODE_TXEXTCFG, chan, value);
+
+	/* VDMA to TC mapping */
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
+	value &= ~XXVGMAC_TVDMA2TCMP;
+	value |= FIELD_PREP(XXVGMAC_TVDMA2TCMP, tc);
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
+
+	writel(upper_32_bits(dma_addr),
+	       ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(dwxgmac_addrs, chan));
+	writel(lower_32_bits(dma_addr),
+	       ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(dwxgmac_addrs, chan));
+}
+
+void dw25gmac_dma_init_rx_chan(struct stmmac_priv *priv,
+			       void __iomem *ioaddr,
+			       struct stmmac_dma_cfg *dma_cfg,
+			       dma_addr_t dma_addr, u32 chan)
+{
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 tc = (dma_cfg->rx_pdma_custom_map ? dma_cfg->rx_pdma_map[chan] : chan);
+	u32 value;
+
+	/* Descriptor cache size and prefetch threshold size */
+	value = rd_dma_ch_ind(ioaddr, MODE_RXDESCCTRL, chan);
+	value &= ~XXVGMAC_RXDCSZ;
+	value |= FIELD_PREP(XXVGMAC_RXDCSZ,
+			    dma_cfg->rxdcsz);
+	value &= ~XXVGMAC_RDPS;
+	value |= FIELD_PREP(XXVGMAC_RDPS, dma_cfg->rdps);
+	wr_dma_ch_ind(ioaddr, MODE_RXDESCCTRL, chan, value);
+
+	/* PDMA to TC mapping */
+	value = rd_dma_ch_ind(ioaddr, MODE_RXEXTCFG, chan);
+	value &= ~XXVGMAC_RP2TCMP;
+	value |= FIELD_PREP(XXVGMAC_RP2TCMP, tc);
+	if (dma_cfg->owrq)
+		value |= FIELD_PREP(XXVGMAC_OWRQ, dma_cfg->owrq);
+	value |= XXVGMAC_RXPEN;
+	wr_dma_ch_ind(ioaddr, MODE_RXEXTCFG, chan, value);
+
+	/* VDMA to TC mapping */
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
+	value &= ~XXVGMAC_RVDMA2TCMP;
+	value |= FIELD_PREP(XXVGMAC_RVDMA2TCMP, tc);
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
+
+	writel(upper_32_bits(dma_addr),
+	       ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(dwxgmac_addrs, chan));
+	writel(lower_32_bits(dma_addr),
+	       ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(dwxgmac_addrs, chan));
+}
+
+void dw25gmac_dma_map_tx_offline_chan(struct stmmac_priv *priv,
+				      void __iomem *ioaddr,
+				      struct stmmac_dma_cfg *dma_cfg,
+				      u32 chan)
+{
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 tc = (dma_cfg->tx_pdma_custom_map ? dma_cfg->tx_pdma_map[chan] : chan);
+	u32 value;
+
+	/* PDMA to TC mapping for channels that are offline */
+	value = rd_dma_ch_ind(ioaddr, MODE_TXEXTCFG, chan);
+	value &= ~XXVGMAC_TP2TCMP;
+	value |= FIELD_PREP(XXVGMAC_TP2TCMP, tc);
+	wr_dma_ch_ind(ioaddr, MODE_TXEXTCFG, chan, value);
+
+	/* VDMA to TC mapping for channels that are offline */
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
+	value &= ~XXVGMAC_TVDMA2TCMP;
+	value |= FIELD_PREP(XXVGMAC_TVDMA2TCMP, tc);
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
+}
+
+void dw25gmac_dma_map_rx_offline_chan(struct stmmac_priv *priv,
+				      void __iomem *ioaddr,
+				      struct stmmac_dma_cfg *dma_cfg,
+				      u32 chan)
+{
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 tc = (dma_cfg->rx_pdma_custom_map ? dma_cfg->rx_pdma_map[chan] : chan);
+	u32 value;
+
+	/* PDMA to TC mapping for channels that are offline */
+	value = rd_dma_ch_ind(ioaddr, MODE_RXEXTCFG, chan);
+	value &= ~XXVGMAC_RP2TCMP;
+	value |= FIELD_PREP(XXVGMAC_RP2TCMP, tc);
+	wr_dma_ch_ind(ioaddr, MODE_RXEXTCFG, chan, value);
+
+	/* VDMA to TC mapping for channels that are offline */
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
+	value &= ~XXVGMAC_RVDMA2TCMP;
+	value |= FIELD_PREP(XXVGMAC_RVDMA2TCMP, tc);
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
+}
+
+void dw25gmac_desc_cache_compute(void __iomem *ioaddr)
+{
+	u32 value;
+	int ret;
+
+	value = readl(ioaddr + XGMAC_DMA_MODE);
+	value |= XGMAC_DSCB;
+	writel(value, ioaddr + XGMAC_DMA_MODE);
+
+	ret = readl_poll_timeout(ioaddr + XGMAC_DMA_MODE, value,
+				 !(value & XGMAC_DSCB), 10, 200);
+}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dw25gmac.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dw25gmac.h
@@ -0,0 +1,84 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright (c) 2024 Broadcom Corporation
+ * DW25GMAC definitions.
+ */
+#ifndef __STMMAC_DW25GMAC_H__
+#define __STMMAC_DW25GMAC_H__
+
+/* Hardware features */
+#define XXVGMAC_HWFEAT_VDMA_RXCNT	GENMASK(16, 12)
+#define XXVGMAC_HWFEAT_VDMA_TXCNT	GENMASK(22, 18)
+
+/* DMA Indirect Registers*/
+#define XXVGMAC_DMA_CH_IND_CONTROL	0x00003080
+#define XXVGMAC_MODE_SELECT		GENMASK(27, 24)
+enum dma_ch_ind_modes {
+	MODE_TXEXTCFG	 = 0x0,	  /* Tx Extended Config */
+	MODE_RXEXTCFG	 = 0x1,	  /* Rx Extended Config */
+	MODE_TXDBGSTS	 = 0x2,	  /* Tx Debug Status */
+	MODE_RXDBGSTS	 = 0x3,	  /* Rx Debug Status */
+	MODE_TXDESCCTRL	 = 0x4,	  /* Tx Descriptor control */
+	MODE_RXDESCCTRL	 = 0x5,	  /* Rx Descriptor control */
+};
+
+#define XXVGMAC_ADDR_OFFSET		GENMASK(14, 8)
+#define XXVGMAC_AUTO_INCR		GENMASK(5, 4)
+#define XXVGMAC_CMD_TYPE		BIT(1)
+#define XXVGMAC_OB			BIT(0)
+#define XXVGMAC_DMA_CH_IND_DATA		0x00003084
+
+/* TX Config definitions */
+#define XXVGMAC_TXPBL			GENMASK(29, 24)
+#define XXVGMAC_TPBLX8_MODE		BIT(19)
+#define XXVGMAC_TP2TCMP			GENMASK(18, 16)
+#define XXVGMAC_ORRQ			GENMASK(13, 8)
+
+/* RX Config definitions */
+#define XXVGMAC_RXPEN			BIT(31)
+#define XXVGMAC_RXPBL			GENMASK(29, 24)
+#define XXVGMAC_RPBLX8_MODE		BIT(19)
+#define XXVGMAC_RP2TCMP			GENMASK(18, 16)
+#define XXVGMAC_OWRQ			GENMASK(13, 8)
+
+/* Tx Descriptor control */
+#define XXVGMAC_TXDCSZ			GENMASK(2, 0)
+#define XXVGMAC_TDPS			GENMASK(5, 3)
+
+/* Rx Descriptor control */
+#define XXVGMAC_RXDCSZ			GENMASK(2, 0)
+#define XXVGMAC_RDPS			GENMASK(5, 3)
+
+/* DWCXG_DMA_CH(#i) Registers*/
+#define XXVGMAC_DSL			GENMASK(20, 18)
+#define XXVGMAC_MSS			GENMASK(13, 0)
+#define XXVGMAC_TFSEL			GENMASK(30, 29)
+#define XXVGMAC_TQOS			GENMASK(27, 24)
+#define XXVGMAC_IPBL			BIT(15)
+#define XXVGMAC_TVDMA2TCMP		GENMASK(6, 4)
+#define XXVGMAC_RPF			BIT(31)
+#define XXVGMAC_RVDMA2TCMP		GENMASK(30, 28)
+#define XXVGMAC_RQOS			GENMASK(27, 24)
+
+u32 dw25gmac_decode_vdma_count(u32 regval);
+
+void dw25gmac_dma_init(struct stmmac_priv *priv, void __iomem *ioaddr,
+		       struct stmmac_dma_cfg *dma_cfg, int atds);
+
+void dw25gmac_dma_init_tx_chan(struct stmmac_priv *priv,
+			       void __iomem *ioaddr,
+			       struct stmmac_dma_cfg *dma_cfg,
+			       dma_addr_t dma_addr, u32 chan);
+void dw25gmac_dma_init_rx_chan(struct stmmac_priv *priv,
+			       void __iomem *ioaddr,
+			       struct stmmac_dma_cfg *dma_cfg,
+			       dma_addr_t dma_addr, u32 chan);
+void dw25gmac_dma_map_tx_offline_chan(struct stmmac_priv *priv,
+				      void __iomem *ioaddr,
+				      struct stmmac_dma_cfg *dma_cfg,
+				      u32 chan);
+void dw25gmac_dma_map_rx_offline_chan(struct stmmac_priv *priv,
+				      void __iomem *ioaddr,
+				      struct stmmac_dma_cfg *dma_cfg,
+				      u32 chan);
+void dw25gmac_desc_cache_compute(void __iomem *ioaddr);
+#endif /* __STMMAC_DW25GMAC_H__ */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c
@@ -108,7 +108,12 @@
 			if (IS_ERR(dwmac->tx_clk))
 				return PTR_ERR(dwmac->tx_clk);
 
-			clk_prepare_enable(dwmac->tx_clk);
+			ret = clk_prepare_enable(dwmac->tx_clk);
+			if (ret) {
+				dev_err(&pdev->dev,
+					"Failed to enable tx_clk\n");
+				return ret;
+			}
 
 			/* Check and configure TX clock rate */
 			rate = clk_get_rate(dwmac->tx_clk);
@@ -119,7 +124,7 @@
 				if (ret) {
 					dev_err(&pdev->dev,
 						"Failed to set tx_clk\n");
-					return ret;
+					goto err_tx_clk_disable;
 				}
 			}
 		}
@@ -133,7 +138,7 @@
 			if (ret) {
 				dev_err(&pdev->dev,
 					"Failed to set clk_ptp_ref\n");
-				return ret;
+				goto err_tx_clk_disable;
 			}
 		}
 	}
@@ -149,12 +154,15 @@
 	}
 
 	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
-	if (ret) {
-		clk_disable_unprepare(dwmac->tx_clk);
-		return ret;
-	}
+	if (ret)
+		goto err_tx_clk_disable;
 
 	return 0;
+
+err_tx_clk_disable:
+	if (dwmac->data->tx_clk_en)
+		clk_disable_unprepare(dwmac->tx_clk);
+	return ret;
 }
 
 static void intel_eth_plat_remove(struct platform_device *pdev)
@@ -162,7 +170,8 @@
 	struct intel_dwmac *dwmac = get_stmmac_bsp_priv(&pdev->dev);
 
 	stmmac_pltfr_remove(pdev);
-	clk_disable_unprepare(dwmac->tx_clk);
+	if (dwmac->data->tx_clk_en)
+		clk_disable_unprepare(dwmac->tx_clk);
 }
 
 static struct platform_driver intel_eth_plat_driver = {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c
@@ -35,6 +35,9 @@
 	/* Disable RX queues routing by default */
 	plat->rx_queues_cfg[0].pkt_route = 0x0;
 
+	plat->clk_ref_rate = 125000000;
+	plat->clk_ptp_rate = 125000000;
+
 	/* Default to phy auto-detection */
 	plat->phy_addr = -1;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c
@@ -589,9 +589,9 @@
 
 	plat->mac_interface = priv_plat->phy_mode;
 	if (priv_plat->mac_wol)
-		plat->flags |= STMMAC_FLAG_USE_PHY_WOL;
-	else
 		plat->flags &= ~STMMAC_FLAG_USE_PHY_WOL;
+	else
+		plat->flags |= STMMAC_FLAG_USE_PHY_WOL;
 	plat->riwt_off = 1;
 	plat->maxmtu = ETH_DATA_LEN;
 	plat->host_dma_width = priv_plat->variant->dma_bit_mask;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
@@ -7,6 +7,7 @@
 #include <linux/platform_device.h>
 #include <linux/phy.h>
 #include <linux/phy/phy.h>
+#include <linux/pcs-xpcs-qcom.h>
 
 #include "stmmac.h"
 #include "stmmac_platform.h"
@@ -21,12 +22,16 @@
 #define RGMII_IO_MACRO_CONFIG2		0x1C
 #define RGMII_IO_MACRO_DEBUG1		0x20
 #define EMAC_SYSTEM_LOW_POWER_DEBUG	0x28
+#define EMAC_WRAPPER_SGMII_PHY_CNTRL1	0xf4
+#define RGMII_IO_MACRO_BYPASS 0x16C
+#define EMAC_WRAPPER_SGMII_PHY_CNTRL0 0x170
+#define EMAC_WRAPPER_USXGMII_MUX_SEL 0x1D0
+#define RGMII_IO_MACRO_SCRATCH_2		0x44
+#define EMAC_WRAPPER_SGMII_PHY_CNTRL1_V4 0x174
 
 /* RGMII_IO_MACRO_CONFIG fields */
 #define RGMII_CONFIG_FUNC_CLK_EN		BIT(30)
 #define RGMII_CONFIG_POS_NEG_DATA_SEL		BIT(23)
-#define RGMII_CONFIG_GPIO_CFG_RX_INT		GENMASK(21, 20)
-#define RGMII_CONFIG_GPIO_CFG_TX_INT		GENMASK(19, 17)
 #define RGMII_CONFIG_MAX_SPD_PRG_9		GENMASK(16, 8)
 #define RGMII_CONFIG_MAX_SPD_PRG_2		GENMASK(7, 6)
 #define RGMII_CONFIG_INTF_SEL			GENMASK(5, 4)
@@ -36,6 +41,12 @@
 #define RGMII_CONFIG_DDR_MODE			BIT(0)
 #define RGMII_CONFIG_SGMII_CLK_DVDR		GENMASK(18, 10)
 
+#define RGMII_CONFIG_MAX_SPD_PRG_9_V4		GENMASK(18, 10)
+#define RGMII_CONFIG_MAX_SPD_PRG_2_V4		GENMASK(9, 6)
+
+/*RGMII IO MACRO BYPASS fields*/
+#define RGMII_BYPASS_EN		BIT(0)
+
 /* SDCC_HC_REG_DLL_CONFIG fields */
 #define SDCC_DLL_CONFIG_DLL_RST			BIT(30)
 #define SDCC_DLL_CONFIG_PDN			BIT(29)
@@ -68,6 +79,8 @@
 
 /* RGMII_IO_MACRO_CONFIG2 fields */
 #define RGMII_CONFIG2_RSVD_CONFIG15		GENMASK(31, 17)
+#define RGMII_CONFIG2_MODE_EN_VIA_GMII        BIT(21)
+#define RGMII_CONFIG2_MAX_SPD_PRG_3		GENMASK(20, 17)
 #define RGMII_CONFIG2_RGMII_CLK_SEL_CFG		BIT(16)
 #define RGMII_CONFIG2_TX_TO_RX_LOOPBACK_EN	BIT(13)
 #define RGMII_CONFIG2_CLK_DIVIDE_SEL		BIT(12)
@@ -79,8 +92,27 @@
 #define ETHQOS_MAC_CTRL_SPEED_MODE		BIT(14)
 #define ETHQOS_MAC_CTRL_PORT_SEL		BIT(15)
 
+/* EMAC_WRAPPER_SGMII_PHY_CNTRL0 bits */
+#define SGMII_PHY_CNTRL0_2P5G_1G_CLK_SEL		GENMASK(6, 5)
+
+/* EMAC_WRAPPER_SGMII_PHY_CNTRL1 bits */
+#define SGMII_PHY_CNTRL1_RGMII_SGMII_CLK_MUX_SEL BIT(0)
+#define SGMII_PHY_CNTRL1_USXGMII_GMII_MASTER_CLK_MUX_SEL BIT(4)
+#define SGMII_PHY_CNTRL1_SGMII_TX_TO_RX_LOOPBACK_EN	BIT(3)
+
+/* EMAC_WRAPPER_USXGMII_MUX_SEL bits */
+#define USXGMII_CLK_BLK_GMII_CLK_BLK_SEL BIT(1)
+#define USXGMII_CLK_BLK_CLK_EN BIT(0)
+
+/* RGMII_IO_MACRO_SCRATCH_2 bits */
+#define RGMII_SCRATCH2_MAX_SPD_PRG_4		GENMASK(5, 2)
+#define RGMII_SCRATCH2_MAX_SPD_PRG_5		GENMASK(9, 6)
+#define RGMII_SCRATCH2_MAX_SPD_PRG_6		GENMASK(13, 10)
+
 #define SGMII_10M_RX_CLK_DVDR			0x31
 
+static u32 bus_id;
+
 struct ethqos_emac_por {
 	unsigned int offset;
 	unsigned int value;
@@ -88,12 +120,17 @@
 
 struct ethqos_emac_driver_data {
 	const struct ethqos_emac_por *por;
+	struct dwxgmac_addrs dwxgmac_addrs;
 	unsigned int num_por;
 	bool rgmii_config_loopback_en;
 	bool has_emac_ge_3;
 	const char *link_clk_name;
 	bool has_integrated_pcs;
+	u32 dma_addr_width;
 	struct dwmac4_addrs dwmac4_addrs;
+	bool needs_sgmii_loopback;
+	bool has_hdma;
+	bool has_io_macro_ge_4;
 };
 
 struct qcom_ethqos {
@@ -106,12 +143,16 @@
 	struct clk *link_clk;
 	struct phy *serdes_phy;
 	unsigned int speed;
+	int serdes_speed;
 	phy_interface_t phy_mode;
 
 	const struct ethqos_emac_por *por;
 	unsigned int num_por;
+	bool has_io_macro_ge_4;
 	bool rgmii_config_loopback_en;
 	bool has_emac_ge_3;
+	bool needs_sgmii_loopback;
+	bool needs_rx_prog_swap;
 };
 
 static int rgmii_readl(struct qcom_ethqos *ethqos, unsigned int offset)
@@ -169,6 +210,9 @@
 static void
 ethqos_update_link_clk(struct qcom_ethqos *ethqos, unsigned int speed)
 {
+	if (!phy_interface_mode_is_rgmii(ethqos->phy_mode))
+		return;
+
 	switch (speed) {
 	case SPEED_1000:
 		ethqos->link_clk_rate =  RGMII_1000_NOM_CLK_FREQ;
@@ -186,8 +230,23 @@
 	clk_set_rate(ethqos->link_clk, ethqos->link_clk_rate);
 }
 
+static void
+qcom_ethqos_set_sgmii_loopback(struct qcom_ethqos *ethqos, bool enable)
+{
+	if (ethqos->needs_sgmii_loopback &&
+	    (ethqos->phy_mode == PHY_INTERFACE_MODE_2500BASEX ||
+	     ethqos->phy_mode == PHY_INTERFACE_MODE_USXGMII))
+		rgmii_updatel(ethqos,
+			      SGMII_PHY_CNTRL1_SGMII_TX_TO_RX_LOOPBACK_EN,
+			      enable ? SGMII_PHY_CNTRL1_SGMII_TX_TO_RX_LOOPBACK_EN : 0,
+			      ethqos->has_io_macro_ge_4 ?
+			      EMAC_WRAPPER_SGMII_PHY_CNTRL1_V4 :
+			      EMAC_WRAPPER_SGMII_PHY_CNTRL1);
+}
+
 static void ethqos_set_func_clk_en(struct qcom_ethqos *ethqos)
 {
+	qcom_ethqos_set_sgmii_loopback(ethqos, true);
 	rgmii_updatel(ethqos, RGMII_CONFIG_FUNC_CLK_EN,
 		      RGMII_CONFIG_FUNC_CLK_EN, RGMII_IO_MACRO_CONFIG);
 }
@@ -224,6 +283,22 @@
 	.has_emac_ge_3 = false,
 };
 
+static const struct ethqos_emac_por emac_v2_3_1_por[] = {
+	{ .offset = RGMII_IO_MACRO_CONFIG,	.value = 0x00C01343 },
+	{ .offset = SDCC_HC_REG_DLL_CONFIG,	.value = 0x2004642C },
+	{ .offset = SDCC_HC_REG_DDR_CONFIG,	.value = 0x00000000 },
+	{ .offset = SDCC_HC_REG_DLL_CONFIG2,	.value = 0x00200000 },
+	{ .offset = SDCC_USR_CTL,		.value = 0x00010800 },
+	{ .offset = RGMII_IO_MACRO_CONFIG2,	.value = 0x00002060 },
+};
+
+static const struct ethqos_emac_driver_data emac_v2_3_1_data = {
+	.por = emac_v2_3_1_por,
+	.num_por = ARRAY_SIZE(emac_v2_3_1_por),
+	.rgmii_config_loopback_en = true,
+	.has_emac_ge_3 = false,
+};
+
 static const struct ethqos_emac_por emac_v3_0_0_por[] = {
 	{ .offset = RGMII_IO_MACRO_CONFIG,	.value = 0x40c01343 },
 	{ .offset = SDCC_HC_REG_DLL_CONFIG,	.value = 0x2004642c },
@@ -265,13 +340,25 @@
 	{ .offset = RGMII_IO_MACRO_CONFIG2,	.value = 0x00002060 },
 };
 
+static const struct ethqos_emac_por emac_v6_6_0_por[] = {
+	{ .offset = RGMII_IO_MACRO_CONFIG,	.value = 0x40c04c03 },
+	{ .offset = SDCC_HC_REG_DLL_CONFIG,	.value = 0xd642c },
+	{ .offset = SDCC_HC_REG_DDR_CONFIG,	.value = 0x80040868 },
+	{ .offset = SDCC_HC_REG_DLL_CONFIG2,	.value = 0xa001 },
+	{ .offset = SDCC_USR_CTL,		.value = 0x90106c0 },
+	{ .offset = RGMII_IO_MACRO_CONFIG2,	.value = 0x2200a0 },
+	{ .offset = SDCC_TEST_CTL, .value = 0x90106c0 },
+};
+
 static const struct ethqos_emac_driver_data emac_v4_0_0_data = {
 	.por = emac_v4_0_0_por,
-	.num_por = ARRAY_SIZE(emac_v3_0_0_por),
+	.num_por = ARRAY_SIZE(emac_v4_0_0_por),
 	.rgmii_config_loopback_en = false,
 	.has_emac_ge_3 = true,
 	.link_clk_name = "phyaux",
 	.has_integrated_pcs = true,
+	.needs_sgmii_loopback = true,
+	.dma_addr_width = 36,
 	.dwmac4_addrs = {
 		.dma_chan = 0x00008100,
 		.dma_chan_offset = 0x1000,
@@ -290,6 +377,27 @@
 	},
 };
 
+static const struct ethqos_emac_driver_data emac_v6_6_0_data = {
+	.por = emac_v6_6_0_por,
+	.num_por = ARRAY_SIZE(emac_v6_6_0_por),
+	.rgmii_config_loopback_en = false,
+	.dma_addr_width = 40,
+	.link_clk_name = "phyaux",
+	.has_hdma = true,
+	.needs_sgmii_loopback = true,
+	.has_io_macro_ge_4 = true,
+	.dwxgmac_addrs = {
+		.dma_even_chan_base  = 0x00008500,
+		.dma_odd_chan_base = 0x00008580,
+		.dma_chan_offset = 0x00001000,
+		.mtl_chan_base = 0x00008000,
+		.mtl_chan_offset =  0x00001000,
+		.timestamp_base = 0x00007000,
+		.pps_base = 0x00007080,
+		.pps_offset = 0x10,
+	},
+};
+
 static int ethqos_dll_configure(struct qcom_ethqos *ethqos)
 {
 	struct device *dev = &ethqos->pdev->dev;
@@ -374,6 +482,7 @@
 static int ethqos_rgmii_macro_init(struct qcom_ethqos *ethqos)
 {
 	struct device *dev = &ethqos->pdev->dev;
+	int rx_prog_swap = 0;
 	int phase_shift;
 	int loopback;
 
@@ -394,6 +503,9 @@
 	else
 		loopback = 0;
 
+	if (ethqos->needs_rx_prog_swap)
+		rx_prog_swap = RGMII_CONFIG2_RX_PROG_SWAP;
+
 	/* Select RGMII, write 0 to interface select */
 	rgmii_updatel(ethqos, RGMII_CONFIG_INTF_SEL,
 		      0, RGMII_IO_MACRO_CONFIG);
@@ -457,14 +569,8 @@
 			      BIT(6), RGMII_IO_MACRO_CONFIG);
 		rgmii_updatel(ethqos, RGMII_CONFIG2_RSVD_CONFIG15,
 			      0, RGMII_IO_MACRO_CONFIG2);
-
-		if (ethqos->has_emac_ge_3)
-			rgmii_updatel(ethqos, RGMII_CONFIG2_RX_PROG_SWAP,
-				      RGMII_CONFIG2_RX_PROG_SWAP,
-				      RGMII_IO_MACRO_CONFIG2);
-		else
-			rgmii_updatel(ethqos, RGMII_CONFIG2_RX_PROG_SWAP,
-				      0, RGMII_IO_MACRO_CONFIG2);
+		rgmii_updatel(ethqos, RGMII_CONFIG2_RX_PROG_SWAP, rx_prog_swap,
+			      RGMII_IO_MACRO_CONFIG2);
 
 		/* Write 0x5 to PRG_RCLK_DLY_CODE */
 		rgmii_updatel(ethqos, SDCC_DDR_CONFIG_EXT_PRG_RCLK_DLY_CODE,
@@ -498,13 +604,9 @@
 			      RGMII_IO_MACRO_CONFIG);
 		rgmii_updatel(ethqos, RGMII_CONFIG2_RSVD_CONFIG15,
 			      0, RGMII_IO_MACRO_CONFIG2);
-		if (ethqos->has_emac_ge_3)
-			rgmii_updatel(ethqos, RGMII_CONFIG2_RX_PROG_SWAP,
-				      RGMII_CONFIG2_RX_PROG_SWAP,
-				      RGMII_IO_MACRO_CONFIG2);
-		else
-			rgmii_updatel(ethqos, RGMII_CONFIG2_RX_PROG_SWAP,
-				      0, RGMII_IO_MACRO_CONFIG2);
+		rgmii_updatel(ethqos, RGMII_CONFIG2_RX_PROG_SWAP, rx_prog_swap,
+			      RGMII_IO_MACRO_CONFIG2);
+
 		/* Write 0x5 to PRG_RCLK_DLY_CODE */
 		rgmii_updatel(ethqos, SDCC_DDR_CONFIG_EXT_PRG_RCLK_DLY_CODE,
 			      (BIT(29) | BIT(27)), SDCC_HC_REG_DDR_CONFIG);
@@ -606,19 +708,39 @@
  */
 static int ethqos_configure_sgmii(struct qcom_ethqos *ethqos)
 {
+	struct net_device *dev = platform_get_drvdata(ethqos->pdev);
+	struct stmmac_priv *priv = netdev_priv(dev);
 	int val;
 
 	val = readl(ethqos->mac_base + MAC_CTRL_REG);
 
 	switch (ethqos->speed) {
+	case SPEED_2500:
+		val &= ~ETHQOS_MAC_CTRL_PORT_SEL;
+		rgmii_updatel(ethqos, RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+			      RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+			      RGMII_IO_MACRO_CONFIG2);
+		if (ethqos->serdes_speed != SPEED_2500)
+			phy_set_speed(ethqos->serdes_phy, SPEED_2500);
+		ethqos->serdes_speed = SPEED_2500;
+		stmmac_pcs_ctrl_ane(priv, priv->ioaddr, 0, 0, 0);
+		break;
 	case SPEED_1000:
 		val &= ~ETHQOS_MAC_CTRL_PORT_SEL;
 		rgmii_updatel(ethqos, RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
 			      RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
 			      RGMII_IO_MACRO_CONFIG2);
+		if (ethqos->serdes_speed != SPEED_1000)
+			phy_set_speed(ethqos->serdes_phy, SPEED_1000);
+		ethqos->serdes_speed = SPEED_1000;
+		stmmac_pcs_ctrl_ane(priv, priv->ioaddr, 1, 0, 0);
 		break;
 	case SPEED_100:
 		val |= ETHQOS_MAC_CTRL_PORT_SEL | ETHQOS_MAC_CTRL_SPEED_MODE;
+		if (ethqos->serdes_speed != SPEED_1000)
+			phy_set_speed(ethqos->serdes_phy, SPEED_1000);
+		ethqos->serdes_speed = SPEED_1000;
+		stmmac_pcs_ctrl_ane(priv, priv->ioaddr, 1, 0, 0);
 		break;
 	case SPEED_10:
 		val |= ETHQOS_MAC_CTRL_PORT_SEL;
@@ -627,6 +749,10 @@
 			      FIELD_PREP(RGMII_CONFIG_SGMII_CLK_DVDR,
 					 SGMII_10M_RX_CLK_DVDR),
 			      RGMII_IO_MACRO_CONFIG);
+		if (ethqos->serdes_speed != SPEED_1000)
+			phy_set_speed(ethqos->serdes_phy, ethqos->speed);
+		ethqos->serdes_speed = SPEED_1000;
+		stmmac_pcs_ctrl_ane(priv, priv->ioaddr, 1, 0, 0);
 		break;
 	}
 
@@ -635,18 +761,148 @@
 	return val;
 }
 
+static void qcom_ethqos_speed_mode_2500(struct net_device *ndev, void *data)
+{
+	struct stmmac_priv *priv = netdev_priv(ndev);
+
+	priv->plat->max_speed = 2500;
+	priv->plat->phy_interface = PHY_INTERFACE_MODE_2500BASEX;
+}
+
+static int  ethqos_configure_5gbaser(struct qcom_ethqos *ethqos)
+{
+	ethqos_set_func_clk_en(ethqos);
+
+	rgmii_updatel(ethqos, RGMII_BYPASS_EN, RGMII_BYPASS_EN, RGMII_IO_MACRO_BYPASS);
+	rgmii_updatel(ethqos, SGMII_PHY_CNTRL0_2P5G_1G_CLK_SEL, BIT(5),
+		      EMAC_WRAPPER_SGMII_PHY_CNTRL0);
+	rgmii_updatel(ethqos, SGMII_PHY_CNTRL1_RGMII_SGMII_CLK_MUX_SEL, 0,
+		      EMAC_WRAPPER_SGMII_PHY_CNTRL1_V4);
+	rgmii_updatel(ethqos, SGMII_PHY_CNTRL1_USXGMII_GMII_MASTER_CLK_MUX_SEL,
+		      SGMII_PHY_CNTRL1_USXGMII_GMII_MASTER_CLK_MUX_SEL,
+		      EMAC_WRAPPER_SGMII_PHY_CNTRL1_V4);
+	rgmii_updatel(ethqos, SGMII_PHY_CNTRL1_SGMII_TX_TO_RX_LOOPBACK_EN, 0,
+		      EMAC_WRAPPER_SGMII_PHY_CNTRL1_V4);
+	rgmii_updatel(ethqos, RGMII_CONFIG2_MODE_EN_VIA_GMII, 0, RGMII_IO_MACRO_CONFIG2);
+	rgmii_updatel(ethqos, USXGMII_CLK_BLK_GMII_CLK_BLK_SEL, USXGMII_CLK_BLK_GMII_CLK_BLK_SEL,
+		      EMAC_WRAPPER_USXGMII_MUX_SEL);
+	rgmii_updatel(ethqos, USXGMII_CLK_BLK_CLK_EN, 0, EMAC_WRAPPER_USXGMII_MUX_SEL);
+
+	rgmii_updatel(ethqos, RGMII_CONFIG_MAX_SPD_PRG_2_V4, (BIT(6) | BIT(9)),
+		      RGMII_IO_MACRO_CONFIG);
+	rgmii_updatel(ethqos, RGMII_CONFIG_MAX_SPD_PRG_9_V4, (BIT(10) |  BIT(14) | BIT(15)),
+		      RGMII_IO_MACRO_CONFIG);
+	rgmii_updatel(ethqos, RGMII_CONFIG2_MAX_SPD_PRG_3, (BIT(17) | BIT(20)),
+		      RGMII_IO_MACRO_CONFIG2);
+	rgmii_updatel(ethqos, RGMII_SCRATCH2_MAX_SPD_PRG_4, BIT(2),
+		      RGMII_IO_MACRO_SCRATCH_2);
+	rgmii_updatel(ethqos, RGMII_SCRATCH2_MAX_SPD_PRG_5, (BIT(6) | BIT(7)),
+		      RGMII_IO_MACRO_SCRATCH_2);
+	rgmii_updatel(ethqos, RGMII_SCRATCH2_MAX_SPD_PRG_6, 0,
+		      RGMII_IO_MACRO_SCRATCH_2);
+	rgmii_updatel(ethqos, RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+		      RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+		      RGMII_IO_MACRO_CONFIG2);
+
+	return 0;
+}
+
+static int ethqos_configure_usxgmii(struct qcom_ethqos *ethqos)
+{
+	ethqos_set_func_clk_en(ethqos);
+
+	rgmii_updatel(ethqos, RGMII_BYPASS_EN, RGMII_BYPASS_EN, RGMII_IO_MACRO_BYPASS);
+	rgmii_updatel(ethqos, RGMII_CONFIG2_MODE_EN_VIA_GMII, 0, RGMII_IO_MACRO_CONFIG2);
+	rgmii_updatel(ethqos, SGMII_PHY_CNTRL0_2P5G_1G_CLK_SEL, BIT(5),
+		      EMAC_WRAPPER_SGMII_PHY_CNTRL0);
+	rgmii_updatel(ethqos, SGMII_PHY_CNTRL1_RGMII_SGMII_CLK_MUX_SEL, 0,
+		      EMAC_WRAPPER_SGMII_PHY_CNTRL1_V4);
+	rgmii_updatel(ethqos, SGMII_PHY_CNTRL1_USXGMII_GMII_MASTER_CLK_MUX_SEL,
+		      SGMII_PHY_CNTRL1_USXGMII_GMII_MASTER_CLK_MUX_SEL,
+		      EMAC_WRAPPER_SGMII_PHY_CNTRL1_V4);
+	rgmii_updatel(ethqos, SGMII_PHY_CNTRL1_SGMII_TX_TO_RX_LOOPBACK_EN, 0,
+		      EMAC_WRAPPER_SGMII_PHY_CNTRL1_V4);
+	rgmii_updatel(ethqos, USXGMII_CLK_BLK_GMII_CLK_BLK_SEL, 0, EMAC_WRAPPER_USXGMII_MUX_SEL);
+	rgmii_updatel(ethqos, USXGMII_CLK_BLK_CLK_EN, 0, EMAC_WRAPPER_USXGMII_MUX_SEL);
+
+	switch (ethqos->speed) {
+	case SPEED_10000:
+		rgmii_updatel(ethqos, USXGMII_CLK_BLK_GMII_CLK_BLK_SEL,
+			      USXGMII_CLK_BLK_GMII_CLK_BLK_SEL,
+			      EMAC_WRAPPER_USXGMII_MUX_SEL);
+		break;
+
+	case SPEED_5000:
+		rgmii_updatel(ethqos, SGMII_PHY_CNTRL0_2P5G_1G_CLK_SEL, 0,
+			      EMAC_WRAPPER_SGMII_PHY_CNTRL0);
+		rgmii_updatel(ethqos, RGMII_CONFIG_MAX_SPD_PRG_2_V4, (BIT(6) | BIT(7)),
+			      RGMII_IO_MACRO_CONFIG);
+		rgmii_updatel(ethqos, RGMII_CONFIG2_MAX_SPD_PRG_3, (BIT(17) | BIT(18)),
+			      RGMII_IO_MACRO_CONFIG2);
+		break;
+
+	case SPEED_2500:
+		rgmii_updatel(ethqos, SGMII_PHY_CNTRL0_2P5G_1G_CLK_SEL, 0,
+			      EMAC_WRAPPER_SGMII_PHY_CNTRL0);
+		rgmii_updatel(ethqos, RGMII_CONFIG_SGMII_CLK_DVDR, (BIT(10) | BIT(11)),
+			      RGMII_IO_MACRO_CONFIG);
+		rgmii_updatel(ethqos, RGMII_SCRATCH2_MAX_SPD_PRG_4, (BIT(2) | BIT(3)),
+			      RGMII_IO_MACRO_SCRATCH_2);
+		rgmii_updatel(ethqos, RGMII_SCRATCH2_MAX_SPD_PRG_5, 0,
+			      RGMII_IO_MACRO_SCRATCH_2);
+		break;
+
+	case SPEED_1000:
+		rgmii_updatel(ethqos, RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+			      RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+			      RGMII_IO_MACRO_CONFIG2);
+		break;
+
+	case SPEED_100:
+		rgmii_updatel(ethqos, RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+			      RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+			      RGMII_IO_MACRO_CONFIG2);
+		rgmii_updatel(ethqos, RGMII_CONFIG_MAX_SPD_PRG_2_V4, BIT(9),
+			      RGMII_IO_MACRO_CONFIG);
+		rgmii_updatel(ethqos, RGMII_CONFIG2_MAX_SPD_PRG_3, BIT(20),
+			      RGMII_IO_MACRO_CONFIG2);
+		rgmii_updatel(ethqos, RGMII_SCRATCH2_MAX_SPD_PRG_6, BIT(1),
+			      RGMII_IO_MACRO_SCRATCH_2);
+		break;
+
+	case SPEED_10:
+		rgmii_updatel(ethqos, RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+			      RGMII_CONFIG2_RGMII_CLK_SEL_CFG,
+			      RGMII_IO_MACRO_CONFIG2);
+		break;
+
+	default:
+		dev_err(&ethqos->pdev->dev,
+			"Invalid speed %d\n", ethqos->speed);
+		return -EINVAL;
+	}
+	return 0;
+}
+
 static int ethqos_configure(struct qcom_ethqos *ethqos)
 {
 	return ethqos->configure_func(ethqos);
 }
 
-static void ethqos_fix_mac_speed(void *priv, unsigned int speed, unsigned int mode)
+static void ethqos_fix_mac_speed(void *priv_n, unsigned int speed, unsigned int mode)
 {
-	struct qcom_ethqos *ethqos = priv;
+	struct qcom_ethqos *ethqos = priv_n;
+	struct net_device *dev = platform_get_drvdata(ethqos->pdev);
+	struct stmmac_priv *priv = netdev_priv(dev);
 
+	qcom_ethqos_set_sgmii_loopback(ethqos, false);
 	ethqos->speed = speed;
 	ethqos_update_link_clk(ethqos, speed);
 	ethqos_configure(ethqos);
+	if (priv->plat->qcom_pcs)
+		qcom_xpcs_link_up(priv->plat->qcom_pcs, mode,
+				  priv->plat->phy_interface, speed,
+				  DUPLEX_FULL);
 }
 
 static int qcom_ethqos_serdes_powerup(struct net_device *ndev, void *priv)
@@ -720,15 +976,54 @@
 	netdev_dbg(priv->dev, "PTP rate %d\n", plat_dat->clk_ptp_rate);
 }
 
+static void qcom_ethqos_hdma_cfg(struct plat_stmmacenet_data *plat)
+{
+	plat->dma_cfg->orrq = 15;
+	plat->dma_cfg->owrq = 15;
+	plat->dma_cfg->txdcsz = 4;
+	plat->dma_cfg->tdps = 1;
+	plat->dma_cfg->rxdcsz = 4;
+	plat->dma_cfg->rdps = 1;
+
+	plat->dma_cfg->tx_pdma_custom_map = true;
+	plat->dma_cfg->tx_pdma_map[0] = 0;
+	plat->dma_cfg->tx_pdma_map[1] = 0;
+	plat->dma_cfg->tx_pdma_map[2] = 0;
+	plat->dma_cfg->tx_pdma_map[3] = 0;
+	plat->dma_cfg->tx_pdma_map[4] = 5;
+	plat->dma_cfg->tx_pdma_map[5] = 5;
+	plat->dma_cfg->tx_pdma_map[6] = 5;
+	plat->dma_cfg->tx_pdma_map[7] = 2;
+	plat->dma_cfg->tx_pdma_map[8] = 3;
+	plat->dma_cfg->tx_pdma_map[9] = 4;
+	plat->dma_cfg->tx_pdma_map[10] = 6;
+	plat->dma_cfg->tx_pdma_map[11] = 7;
+
+	plat->dma_cfg->rx_pdma_custom_map = true;
+	plat->dma_cfg->rx_pdma_map[0] = 0;
+	plat->dma_cfg->rx_pdma_map[1] = 0;
+	plat->dma_cfg->rx_pdma_map[2] = 0;
+	plat->dma_cfg->rx_pdma_map[3] = 0;
+	plat->dma_cfg->rx_pdma_map[4] = 5;
+	plat->dma_cfg->rx_pdma_map[5] = 5;
+	plat->dma_cfg->rx_pdma_map[6] = 5;
+	plat->dma_cfg->rx_pdma_map[7] = 2;
+	plat->dma_cfg->rx_pdma_map[8] = 3;
+	plat->dma_cfg->rx_pdma_map[9] = 4;
+	plat->dma_cfg->rx_pdma_map[10] = 6;
+	plat->dma_cfg->rx_pdma_map[11] = 7;
+}
+
 static int qcom_ethqos_probe(struct platform_device *pdev)
 {
-	struct device_node *np = pdev->dev.of_node;
+	struct device_node *np = pdev->dev.of_node, *root;
+	struct device_node *pcs_node;
 	const struct ethqos_emac_driver_data *data;
 	struct plat_stmmacenet_data *plat_dat;
 	struct stmmac_resources stmmac_res;
 	struct device *dev = &pdev->dev;
 	struct qcom_ethqos *ethqos;
-	int ret;
+	int ret, i;
 
 	ret = stmmac_get_platform_resources(pdev, &stmmac_res);
 	if (ret)
@@ -750,6 +1045,15 @@
 	ret = of_get_phy_mode(np, &ethqos->phy_mode);
 	if (ret)
 		return dev_err_probe(dev, ret, "Failed to get phy mode\n");
+
+	root = of_find_node_by_path("/");
+	if (root && of_device_is_compatible(root, "qcom,sa8540p-ride"))
+		ethqos->needs_rx_prog_swap = true;
+	else
+		ethqos->needs_rx_prog_swap =
+			of_property_read_bool(np, "qcom,rx-prog-swap");
+	of_node_put(root);
+
 	switch (ethqos->phy_mode) {
 	case PHY_INTERFACE_MODE_RGMII:
 	case PHY_INTERFACE_MODE_RGMII_ID:
@@ -757,9 +1061,19 @@
 	case PHY_INTERFACE_MODE_RGMII_TXID:
 		ethqos->configure_func = ethqos_configure_rgmii;
 		break;
+	case PHY_INTERFACE_MODE_2500BASEX:
+		plat_dat->speed_mode_2500 = qcom_ethqos_speed_mode_2500;
+		fallthrough;
 	case PHY_INTERFACE_MODE_SGMII:
 		ethqos->configure_func = ethqos_configure_sgmii;
 		break;
+	case PHY_INTERFACE_MODE_5GBASER:
+		ethqos->configure_func = ethqos_configure_5gbaser;
+		break;
+	case PHY_INTERFACE_MODE_USXGMII:
+	case PHY_INTERFACE_MODE_10GBASER:
+		ethqos->configure_func = ethqos_configure_usxgmii;
+		break;
 	default:
 		dev_err(dev, "Unsupported phy mode %s\n",
 			phy_modes(ethqos->phy_mode));
@@ -777,8 +1091,10 @@
 	data = of_device_get_match_data(dev);
 	ethqos->por = data->por;
 	ethqos->num_por = data->num_por;
+	ethqos->has_io_macro_ge_4 = data->has_io_macro_ge_4;
 	ethqos->rgmii_config_loopback_en = data->rgmii_config_loopback_en;
 	ethqos->has_emac_ge_3 = data->has_emac_ge_3;
+	ethqos->needs_sgmii_loopback = data->needs_sgmii_loopback;
 
 	ethqos->link_clk = devm_clk_get(dev, data->link_clk_name ?: "rgmii");
 	if (IS_ERR(ethqos->link_clk))
@@ -799,6 +1115,7 @@
 				     "Failed to get serdes phy\n");
 
 	ethqos->speed = SPEED_1000;
+	ethqos->serdes_speed = SPEED_1000;
 	ethqos_update_link_clk(ethqos, SPEED_1000);
 	ethqos_set_func_clk_en(ethqos);
 
@@ -810,26 +1127,54 @@
 	if (ethqos->has_emac_ge_3)
 		plat_dat->dwmac4_addrs = &data->dwmac4_addrs;
 	plat_dat->pmt = 1;
+	if (plat_dat->has_xgmac) {
+		plat_dat->has_gmac4 = 0;
+		plat_dat->dwxgmac_addrs = &data->dwxgmac_addrs;
+		plat_dat->has_hdma = data->has_hdma;
+		plat_dat->insert_ts_pktid = true;
+		plat_dat->bus_id = bus_id++;
+		if (plat_dat->has_hdma)
+			qcom_ethqos_hdma_cfg(plat_dat);
+	}
 	if (of_property_read_bool(np, "snps,tso"))
 		plat_dat->flags |= STMMAC_FLAG_TSO_EN;
 	if (of_device_is_compatible(np, "qcom,qcs404-ethqos"))
 		plat_dat->flags |= STMMAC_FLAG_RX_CLK_RUNS_IN_LPI;
 	if (data->has_integrated_pcs)
 		plat_dat->flags |= STMMAC_FLAG_HAS_INTEGRATED_PCS;
+	if (data->dma_addr_width)
+		plat_dat->host_dma_width = data->dma_addr_width;
 
 	if (ethqos->serdes_phy) {
 		plat_dat->serdes_powerup = qcom_ethqos_serdes_powerup;
 		plat_dat->serdes_powerdown  = qcom_ethqos_serdes_powerdown;
 	}
 
+	if (of_property_present(dev->of_node, "qcom-xpcs-handle")) {
+		pcs_node = of_parse_phandle(dev->of_node, "qcom-xpcs-handle", 0);
+		plat_dat->qcom_pcs = qcom_xpcs_create(pcs_node, plat_dat->phy_interface);
+		if (IS_ERR_OR_NULL(plat_dat->qcom_pcs)) {
+			dev_warn(dev, "Qcom Xpcs not found\n");
+			return -ENODEV;
+		}
+	}
+
+	/* Enable TSO on queue0 and enable TBS on rest of the queues */
+	for (i = 1; i < plat_dat->tx_queues_to_use; i++)
+		plat_dat->tx_queues_cfg[i].tbs_en = 1;
+
 	return devm_stmmac_pltfr_probe(pdev, plat_dat, &stmmac_res);
 }
 
 static const struct of_device_id qcom_ethqos_match[] = {
 	{ .compatible = "qcom,qcs404-ethqos", .data = &emac_v2_3_0_data},
+	{ .compatible = "qcom,qcs615-ethqos", .data = &emac_v2_3_1_data},
+	{ .compatible = "qcom,qcs8300-ethqos", .data = &emac_v4_0_0_data},
 	{ .compatible = "qcom,sa8775p-ethqos", .data = &emac_v4_0_0_data},
 	{ .compatible = "qcom,sc8280xp-ethqos", .data = &emac_v3_0_0_data},
 	{ .compatible = "qcom,sm8150-ethqos", .data = &emac_v2_1_0_data},
+	{ .compatible = "qcom,sa8620p-ethqos", .data = &emac_v4_0_0_data},
+	{ .compatible = "qcom,sa8797p-ethqos", .data = &emac_v6_6_0_data},
 	{ }
 };
 MODULE_DEVICE_TABLE(of, qcom_ethqos_match);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -427,6 +427,8 @@
 	plat_dat->bsp_priv = dwmac;
 	plat_dat->fix_mac_speed = socfpga_dwmac_fix_mac_speed;
 
+	plat_dat->riwt_off = 1;
+
 	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
 	if (ret)
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c
@@ -15,13 +15,20 @@
 
 #include "stmmac_platform.h"
 
-#define STARFIVE_DWMAC_PHY_INFT_RGMII	0x1
-#define STARFIVE_DWMAC_PHY_INFT_RMII	0x4
-#define STARFIVE_DWMAC_PHY_INFT_FIELD	0x7U
+#define STARFIVE_DWMAC_PHY_INFT_RGMII		0x1
+#define STARFIVE_DWMAC_PHY_INFT_RMII		0x4
+#define STARFIVE_DWMAC_PHY_INFT_FIELD		0x7U
+
+#define JH7100_SYSMAIN_REGISTER49_DLYCHAIN	0xc8
+
+struct starfive_dwmac_data {
+	unsigned int gtxclk_dlychain;
+};
 
 struct starfive_dwmac {
 	struct device *dev;
 	struct clk *clk_tx;
+	const struct starfive_dwmac_data *data;
 };
 
 static void starfive_dwmac_fix_mac_speed(void *priv, unsigned int speed, unsigned int mode)
@@ -67,6 +74,8 @@
 
 	case PHY_INTERFACE_MODE_RGMII:
 	case PHY_INTERFACE_MODE_RGMII_ID:
+	case PHY_INTERFACE_MODE_RGMII_RXID:
+	case PHY_INTERFACE_MODE_RGMII_TXID:
 		mode = STARFIVE_DWMAC_PHY_INFT_RGMII;
 		break;
 
@@ -89,6 +98,14 @@
 	if (err)
 		return dev_err_probe(dwmac->dev, err, "error setting phy mode\n");
 
+	if (dwmac->data) {
+		err = regmap_write(regmap, JH7100_SYSMAIN_REGISTER49_DLYCHAIN,
+				   dwmac->data->gtxclk_dlychain);
+		if (err)
+			return dev_err_probe(dwmac->dev, err,
+					     "error selecting gtxclk delay chain\n");
+	}
+
 	return 0;
 }
 
@@ -114,6 +131,8 @@
 	if (!dwmac)
 		return -ENOMEM;
 
+	dwmac->data = device_get_match_data(&pdev->dev);
+
 	dwmac->clk_tx = devm_clk_get_enabled(&pdev->dev, "tx");
 	if (IS_ERR(dwmac->clk_tx))
 		return dev_err_probe(&pdev->dev, PTR_ERR(dwmac->clk_tx),
@@ -144,8 +163,13 @@
 	return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
 }
 
+static const struct starfive_dwmac_data jh7100_data = {
+	.gtxclk_dlychain = 4,
+};
+
 static const struct of_device_id starfive_dwmac_match[] = {
-	{ .compatible = "starfive,jh7110-dwmac"	},
+	{ .compatible = "starfive,jh7100-dwmac", .data = &jh7100_data },
+	{ .compatible = "starfive,jh7110-dwmac" },
 	{ /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, starfive_dwmac_match);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -298,7 +298,7 @@
 /* sun8i_dwmac_dma_init() - initialize the EMAC
  * Called from stmmac via stmmac_dma_ops->init
  */
-static void sun8i_dwmac_dma_init(void __iomem *ioaddr,
+static void sun8i_dwmac_dma_init(struct stmmac_priv *priv, void __iomem *ioaddr,
 				 struct stmmac_dma_cfg *dma_cfg, int atds)
 {
 	writel(EMAC_RX_INT | EMAC_TX_INT, ioaddr + EMAC_INT_EN);
@@ -343,7 +343,8 @@
  * Called from stmmac_ops->dump_regs
  * Used for ethtool
  */
-static void sun8i_dwmac_dump_mac_regs(struct mac_device_info *hw,
+static void sun8i_dwmac_dump_mac_regs(struct stmmac_priv *priv,
+				      struct mac_device_info *hw,
 				      u32 *reg_space)
 {
 	int i;
@@ -1096,6 +1097,8 @@
 
 	priv->dev->priv_flags |= IFF_UNICAST_FLT;
 
+	mac->link.caps = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
+			 MAC_10 | MAC_100 | MAC_1000;
 	/* The loopback bit seems to be re-set when link change
 	 * Simply mask it each time
 	 * Speed 10/100/1000 are set in BIT(2)/BIT(3)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-only
+#include <linux/iommu.h>
 #include <linux/platform_device.h>
 #include <linux/of.h>
 #include <linux/module.h>
@@ -19,6 +20,8 @@
 	struct reset_control *rst_mac;
 	struct reset_control *rst_pcs;
 
+	u32 iommu_sid;
+
 	void __iomem *hv;
 	void __iomem *regs;
 	void __iomem *xpcs;
@@ -50,7 +53,6 @@
 #define MGBE_WRAP_COMMON_INTR_ENABLE	0x8704
 #define MAC_SBD_INTR			BIT(2)
 #define MGBE_WRAP_AXI_ASID0_CTRL	0x8400
-#define MGBE_SID			0x6
 
 static int __maybe_unused tegra_mgbe_suspend(struct device *dev)
 {
@@ -84,7 +86,7 @@
 	writel(MAC_SBD_INTR, mgbe->regs + MGBE_WRAP_COMMON_INTR_ENABLE);
 
 	/* Program SID */
-	writel(MGBE_SID, mgbe->hv + MGBE_WRAP_AXI_ASID0_CTRL);
+	writel(mgbe->iommu_sid, mgbe->hv + MGBE_WRAP_AXI_ASID0_CTRL);
 
 	value = readl(mgbe->xpcs + XPCS_WRAP_UPHY_STATUS);
 	if ((value & XPCS_WRAP_UPHY_STATUS_TX_P_UP) == 0) {
@@ -127,10 +129,12 @@
 	value &= ~XPCS_WRAP_UPHY_RX_CONTROL_AUX_RX_IDDQ;
 	writel(value, mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 
+	usleep_range(10, 20);  /* 50ns min delay needed as per HW design */
 	value = readl(mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 	value &= ~XPCS_WRAP_UPHY_RX_CONTROL_RX_SLEEP;
 	writel(value, mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 
+	usleep_range(10, 20);  /* 500ns min delay needed as per HW design */
 	value = readl(mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 	value |= XPCS_WRAP_UPHY_RX_CONTROL_RX_CAL_EN;
 	writel(value, mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
@@ -143,22 +147,30 @@
 		return err;
 	}
 
+	usleep_range(10, 20);  /* 50ns min delay needed as per HW design */
 	value = readl(mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 	value |= XPCS_WRAP_UPHY_RX_CONTROL_RX_DATA_EN;
 	writel(value, mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 
 	value = readl(mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
-	value |= XPCS_WRAP_UPHY_RX_CONTROL_RX_CDR_RESET;
+	value &= ~XPCS_WRAP_UPHY_RX_CONTROL_RX_PCS_PHY_RDY;
 	writel(value, mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 
+	usleep_range(10, 20);  /* 50ns min delay needed as per HW design */
 	value = readl(mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
-	value &= ~XPCS_WRAP_UPHY_RX_CONTROL_RX_CDR_RESET;
+	value |= XPCS_WRAP_UPHY_RX_CONTROL_RX_CDR_RESET;
 	writel(value, mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 
+	usleep_range(10, 20);  /* 50ns min delay needed as per HW design */
 	value = readl(mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 	value |= XPCS_WRAP_UPHY_RX_CONTROL_RX_PCS_PHY_RDY;
 	writel(value, mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
 
+	msleep(30);  /* 30ms delay needed as per HW design */
+	value = readl(mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
+	value &= ~XPCS_WRAP_UPHY_RX_CONTROL_RX_CDR_RESET;
+	writel(value, mgbe->xpcs + XPCS_WRAP_UPHY_RX_CONTROL);
+
 	err = readl_poll_timeout(mgbe->xpcs + XPCS_WRAP_IRQ_STATUS, value,
 				 value & XPCS_WRAP_IRQ_STATUS_PCS_LINK_STS,
 				 500, 500 * 2000);
@@ -231,6 +243,12 @@
 	if (IS_ERR(mgbe->xpcs))
 		return PTR_ERR(mgbe->xpcs);
 
+	/* get controller's stream id from iommu property in device tree */
+	if (!tegra_dev_iommu_get_stream_id(mgbe->dev, &mgbe->iommu_sid)) {
+		dev_err(mgbe->dev, "failed to get iommu stream id\n");
+		return -EINVAL;
+	}
+
 	res.addr = mgbe->regs;
 	res.irq = irq;
 
@@ -336,7 +354,7 @@
 	writel(MAC_SBD_INTR, mgbe->regs + MGBE_WRAP_COMMON_INTR_ENABLE);
 
 	/* Program SID */
-	writel(MGBE_SID, mgbe->hv + MGBE_WRAP_AXI_ASID0_CTRL);
+	writel(mgbe->iommu_sid, mgbe->hv + MGBE_WRAP_AXI_ASID0_CTRL);
 
 	plat->flags |= STMMAC_FLAG_SERDES_UP_AFTER_PHY_LINKUP;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -85,7 +85,8 @@
 	return !!(value & GMAC_CONTROL_IPC);
 }
 
-static void dwmac1000_dump_regs(struct mac_device_info *hw, u32 *reg_space)
+static void dwmac1000_dump_regs(struct stmmac_priv *priv, struct mac_device_info *hw,
+				u32 *reg_space)
 {
 	void __iomem *ioaddr = hw->pcsr;
 	int i;
@@ -539,6 +540,8 @@
 	if (mac->multicast_filter_bins)
 		mac->mcast_bits_log2 = ilog2(mac->multicast_filter_bins);
 
+	mac->link.caps = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
+			 MAC_10 | MAC_100 | MAC_1000;
 	mac->link.duplex = GMAC_CONTROL_DM;
 	mac->link.speed10 = GMAC_CONTROL_PS;
 	mac->link.speed100 = GMAC_CONTROL_PS | GMAC_CONTROL_FES;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
@@ -70,7 +70,7 @@
 	writel(value, ioaddr + DMA_AXI_BUS_MODE);
 }
 
-static void dwmac1000_dma_init(void __iomem *ioaddr,
+static void dwmac1000_dma_init(struct stmmac_priv *priv, void __iomem *ioaddr,
 			       struct stmmac_dma_cfg *dma_cfg, int atds)
 {
 	u32 value = readl(ioaddr + DMA_BUS_MODE);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac100_core.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac100_core.c
@@ -34,7 +34,8 @@
 #endif
 }
 
-static void dwmac100_dump_mac_regs(struct mac_device_info *hw, u32 *reg_space)
+static void dwmac100_dump_mac_regs(struct stmmac_priv *priv, struct mac_device_info *hw,
+				   u32 *reg_space)
 {
 	void __iomem *ioaddr = hw->pcsr;
 
@@ -175,6 +176,8 @@
 	dev_info(priv->device, "\tDWMAC100\n");
 
 	mac->pcsr = priv->ioaddr;
+	mac->link.caps = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
+			 MAC_10 | MAC_100;
 	mac->link.duplex = MAC_CONTROL_F;
 	mac->link.speed10 = 0;
 	mac->link.speed100 = 0;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c
@@ -18,7 +18,7 @@
 #include "dwmac100.h"
 #include "dwmac_dma.h"
 
-static void dwmac100_dma_init(void __iomem *ioaddr,
+static void dwmac100_dma_init(struct stmmac_priv *priv, void __iomem *ioaddr,
 			      struct stmmac_dma_cfg *dma_cfg, int atds)
 {
 	/* Enable Application Access by writing to DMA CSR0 */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
@@ -44,6 +44,7 @@
 #define GMAC_MDIO_DATA			0x00000204
 #define GMAC_GPIO_STATUS		0x0000020C
 #define GMAC_ARP_ADDR			0x00000210
+#define GMAC_EXT_CFG1			0x00000238
 #define GMAC_ADDR_HIGH(reg)		(0x300 + reg * 8)
 #define GMAC_ADDR_LOW(reg)		(0x304 + reg * 8)
 #define GMAC_L3L4_CTRL(reg)		(0x900 + (reg) * 0x30)
@@ -284,6 +285,10 @@
 #define GMAC_HW_FEAT_DVLAN		BIT(5)
 #define GMAC_HW_FEAT_NRVF		GENMASK(2, 0)
 
+/* MAC extended config 1 */
+#define GMAC_CONFIG1_SAVE_EN		BIT(24)
+#define GMAC_CONFIG1_SPLM(v)		FIELD_PREP(GENMASK(9, 8), v)
+
 /* GMAC GPIO Status reg */
 #define GMAC_GPO0			BIT(16)
 #define GMAC_GPO1			BIT(17)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/ethtool.h>
 #include <linux/io.h>
+#include <linux/iopoll.h>
 #include "stmmac.h"
 #include "stmmac_pcs.h"
 #include "dwmac4.h"
@@ -70,7 +71,10 @@
 
 static void dwmac4_phylink_get_caps(struct stmmac_priv *priv)
 {
-	priv->phylink_config.mac_capabilities |= MAC_2500FD;
+	if (priv->plat->tx_queues_to_use > 1)
+		priv->hw->link.caps &= ~(MAC_10HD | MAC_100HD | MAC_1000HD);
+	else
+		priv->hw->link.caps |= (MAC_10HD | MAC_100HD | MAC_1000HD);
 }
 
 static void dwmac4_rx_queue_enable(struct mac_device_info *hw,
@@ -92,19 +96,41 @@
 				     u32 prio, u32 queue)
 {
 	void __iomem *ioaddr = hw->pcsr;
-	u32 base_register;
-	u32 value;
+	u32 clear_mask = 0;
+	u32 ctrl2, ctrl3;
+	int i;
 
-	base_register = (queue < 4) ? GMAC_RXQ_CTRL2 : GMAC_RXQ_CTRL3;
-	if (queue >= 4)
-		queue -= 4;
+	ctrl2 = readl(ioaddr + GMAC_RXQ_CTRL2);
+	ctrl3 = readl(ioaddr + GMAC_RXQ_CTRL3);
 
-	value = readl(ioaddr + base_register);
+	/* The software must ensure that the same priority
+	 * is not mapped to multiple Rx queues
+	 */
+	for (i = 0; i < 4; i++)
+		clear_mask |= ((prio << GMAC_RXQCTRL_PSRQX_SHIFT(i)) &
+						GMAC_RXQCTRL_PSRQX_MASK(i));
+
+	ctrl2 &= ~clear_mask;
+	ctrl3 &= ~clear_mask;
+
+	/* First assign new priorities to a queue, then
+	 * clear them from others queues
+	 */
+	if (queue < 4) {
+		ctrl2 |= (prio << GMAC_RXQCTRL_PSRQX_SHIFT(queue)) &
+						GMAC_RXQCTRL_PSRQX_MASK(queue);
+
+		writel(ctrl2, ioaddr + GMAC_RXQ_CTRL2);
+		writel(ctrl3, ioaddr + GMAC_RXQ_CTRL3);
+	} else {
+		queue -= 4;
 
-	value &= ~GMAC_RXQCTRL_PSRQX_MASK(queue);
-	value |= (prio << GMAC_RXQCTRL_PSRQX_SHIFT(queue)) &
+		ctrl3 |= (prio << GMAC_RXQCTRL_PSRQX_SHIFT(queue)) &
 						GMAC_RXQCTRL_PSRQX_MASK(queue);
-	writel(value, ioaddr + base_register);
+
+		writel(ctrl3, ioaddr + GMAC_RXQ_CTRL3);
+		writel(ctrl2, ioaddr + GMAC_RXQ_CTRL2);
+	}
 }
 
 static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
@@ -181,7 +207,7 @@
 	writel(value, ioaddr + MTL_OPERATION_MODE);
 }
 
-static void dwmac4_prog_mtl_tx_algorithms(struct mac_device_info *hw,
+static void dwmac4_prog_mtl_tx_algorithms(struct stmmac_priv *priv, struct mac_device_info *hw,
 					  u32 tx_alg)
 {
 	void __iomem *ioaddr = hw->pcsr;
@@ -285,7 +311,7 @@
 	writel(value, ioaddr + mtl_low_credx_base_addr(dwmac4_addrs, queue));
 }
 
-static void dwmac4_dump_regs(struct mac_device_info *hw, u32 *reg_space)
+static void dwmac4_dump_regs(struct stmmac_priv *priv, struct mac_device_info *hw, u32 *reg_space)
 {
 	void __iomem *ioaddr = hw->pcsr;
 	int i;
@@ -450,7 +476,7 @@
 				    u8 index, u32 data)
 {
 	void __iomem *ioaddr = (void __iomem *)dev->base_addr;
-	int i, timeout = 10;
+	int ret;
 	u32 val;
 
 	if (index >= hw->num_vlan)
@@ -466,16 +492,15 @@
 
 	writel(val, ioaddr + GMAC_VLAN_TAG);
 
-	for (i = 0; i < timeout; i++) {
-		val = readl(ioaddr + GMAC_VLAN_TAG);
-		if (!(val & GMAC_VLAN_TAG_CTRL_OB))
-			return 0;
-		udelay(1);
+	ret = readl_poll_timeout(ioaddr + GMAC_VLAN_TAG, val,
+				 !(val & GMAC_VLAN_TAG_CTRL_OB),
+				 1000, 500000);
+	if (ret) {
+		netdev_err(dev, "Timeout accessing MAC_VLAN_Tag_Filter\n");
+		return -EBUSY;
 	}
 
-	netdev_err(dev, "Timeout accessing MAC_VLAN_Tag_Filter\n");
-
-	return -EBUSY;
+	return 0;
 }
 
 static int dwmac4_add_hw_vlan_rx_fltr(struct net_device *dev,
@@ -957,7 +982,7 @@
 }
 
 static void dwmac4_update_vlan_hash(struct mac_device_info *hw, u32 hash,
-				    __le16 perfect_match, bool is_double)
+				    u16 perfect_match, bool is_double)
 {
 	void __iomem *ioaddr = hw->pcsr;
 	u32 value;
@@ -1356,6 +1381,8 @@
 	if (mac->multicast_filter_bins)
 		mac->mcast_bits_log2 = ilog2(mac->multicast_filter_bins);
 
+	mac->link.caps = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
+			 MAC_10 | MAC_100 | MAC_1000 | MAC_2500FD;
 	mac->link.duplex = GMAC_CONFIG_DM;
 	mac->link.speed10 = GMAC_CONFIG_PS;
 	mac->link.speed100 = GMAC_CONFIG_FES | GMAC_CONFIG_PS;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
@@ -152,7 +152,7 @@
 	       ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
 }
 
-static void dwmac4_dma_init(void __iomem *ioaddr,
+static void dwmac4_dma_init(struct stmmac_priv *priv, void __iomem *ioaddr,
 			    struct stmmac_dma_cfg *dma_cfg, int atds)
 {
 	u32 value = readl(ioaddr + DMA_SYS_BUS_MODE);
@@ -203,8 +203,12 @@
 		readl(ioaddr + DMA_CHAN_TX_CONTROL(dwmac4_addrs, channel));
 	reg_space[DMA_CHAN_RX_CONTROL(default_addrs, channel) / 4] =
 		readl(ioaddr + DMA_CHAN_RX_CONTROL(dwmac4_addrs, channel));
+	reg_space[DMA_CHAN_TX_BASE_ADDR_HI(default_addrs, channel) / 4] =
+		readl(ioaddr + DMA_CHAN_TX_BASE_ADDR_HI(dwmac4_addrs, channel));
 	reg_space[DMA_CHAN_TX_BASE_ADDR(default_addrs, channel) / 4] =
 		readl(ioaddr + DMA_CHAN_TX_BASE_ADDR(dwmac4_addrs, channel));
+	reg_space[DMA_CHAN_RX_BASE_ADDR_HI(default_addrs, channel) / 4] =
+		readl(ioaddr + DMA_CHAN_RX_BASE_ADDR_HI(dwmac4_addrs, channel));
 	reg_space[DMA_CHAN_RX_BASE_ADDR(default_addrs, channel) / 4] =
 		readl(ioaddr + DMA_CHAN_RX_BASE_ADDR(dwmac4_addrs, channel));
 	reg_space[DMA_CHAN_TX_END_ADDR(default_addrs, channel) / 4] =
@@ -225,8 +229,12 @@
 		readl(ioaddr + DMA_CHAN_CUR_TX_DESC(dwmac4_addrs, channel));
 	reg_space[DMA_CHAN_CUR_RX_DESC(default_addrs, channel) / 4] =
 		readl(ioaddr + DMA_CHAN_CUR_RX_DESC(dwmac4_addrs, channel));
+	reg_space[DMA_CHAN_CUR_TX_BUF_ADDR_HI(default_addrs, channel) / 4] =
+		readl(ioaddr + DMA_CHAN_CUR_TX_BUF_ADDR_HI(dwmac4_addrs, channel));
 	reg_space[DMA_CHAN_CUR_TX_BUF_ADDR(default_addrs, channel) / 4] =
 		readl(ioaddr + DMA_CHAN_CUR_TX_BUF_ADDR(dwmac4_addrs, channel));
+	reg_space[DMA_CHAN_CUR_RX_BUF_ADDR_HI(default_addrs, channel) / 4] =
+		readl(ioaddr + DMA_CHAN_CUR_RX_BUF_ADDR_HI(dwmac4_addrs, channel));
 	reg_space[DMA_CHAN_CUR_RX_BUF_ADDR(default_addrs, channel) / 4] =
 		readl(ioaddr + DMA_CHAN_CUR_RX_BUF_ADDR(dwmac4_addrs, channel));
 	reg_space[DMA_CHAN_STATUS(default_addrs, channel) / 4] =
@@ -526,6 +534,11 @@
 	value |= GMAC_CONFIG_HDSMS_256; /* Segment max 256 bytes */
 	writel(value, ioaddr + GMAC_EXT_CONFIG);
 
+	value = readl(ioaddr + GMAC_EXT_CFG1);
+	value |= GMAC_CONFIG1_SPLM(1); /* Split mode set to L2OFST */
+	value |= GMAC_CONFIG1_SAVE_EN; /* Enable Split AV mode */
+	writel(value, ioaddr + GMAC_EXT_CFG1);
+
 	value = readl(ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan));
 	if (en)
 		value |= DMA_CONTROL_SPH;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h
@@ -127,7 +127,9 @@
 #define DMA_CHAN_SLOT_CTRL_STATUS(addrs, x)	(dma_chanx_base_addr(addrs, x) + 0x3c)
 #define DMA_CHAN_CUR_TX_DESC(addrs, x)	(dma_chanx_base_addr(addrs, x) + 0x44)
 #define DMA_CHAN_CUR_RX_DESC(addrs, x)	(dma_chanx_base_addr(addrs, x) + 0x4c)
+#define DMA_CHAN_CUR_TX_BUF_ADDR_HI(addrs, x)	(dma_chanx_base_addr(addrs, x) + 0x50)
 #define DMA_CHAN_CUR_TX_BUF_ADDR(addrs, x)	(dma_chanx_base_addr(addrs, x) + 0x54)
+#define DMA_CHAN_CUR_RX_BUF_ADDR_HI(addrs, x)	(dma_chanx_base_addr(addrs, x) + 0x58)
 #define DMA_CHAN_CUR_RX_BUF_ADDR(addrs, x)	(dma_chanx_base_addr(addrs, x) + 0x5c)
 #define DMA_CHAN_STATUS(addrs, x)	(dma_chanx_base_addr(addrs, x) + 0x60)
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
@@ -517,7 +517,7 @@
 	return ret;
 }
 
-int dwmac5_flex_pps_config(void __iomem *ioaddr, int index,
+int dwmac5_flex_pps_config(struct stmmac_priv *priv, void __iomem *ioaddr, int index,
 			   struct stmmac_pps_cfg *cfg, bool enable,
 			   u32 sub_second_inc, u32 systime_flags)
 {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac5.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwmac5.h
@@ -99,7 +99,7 @@
 			int index, unsigned long *count, const char **desc);
 int dwmac5_rxp_config(void __iomem *ioaddr, struct stmmac_tc_entry *entries,
 		      unsigned int count);
-int dwmac5_flex_pps_config(void __iomem *ioaddr, int index,
+int dwmac5_flex_pps_config(struct stmmac_priv *priv, void __iomem *ioaddr, int index,
 			   struct stmmac_pps_cfg *cfg, bool enable,
 			   u32 sub_second_inc, u32 systime_flags);
 void dwmac5_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -17,6 +17,7 @@
 #define XGMAC_CONFIG_SS_OFF		29
 #define XGMAC_CONFIG_SS_MASK		GENMASK(31, 29)
 #define XGMAC_CONFIG_SS_10000		(0x0 << XGMAC_CONFIG_SS_OFF)
+#define XGMAC_CONFIG_SS_25000		(0x1 << XGMAC_CONFIG_SS_OFF)
 #define XGMAC_CONFIG_SS_2500_GMII	(0x2 << XGMAC_CONFIG_SS_OFF)
 #define XGMAC_CONFIG_SS_1000_GMII	(0x3 << XGMAC_CONFIG_SS_OFF)
 #define XGMAC_CONFIG_SS_100_MII		(0x4 << XGMAC_CONFIG_SS_OFF)
@@ -241,12 +242,42 @@
 #define XGMAC_CT			BIT(1)
 #define XGMAC_OB			BIT(0)
 #define XGMAC_RSS_DATA			0x00000c8c
-#define XGMAC_TIMESTAMP_STATUS		0x00000d20
+#define XGMAC_TIMESTAMP_BASE_ADDR	0x00000d00
+#define XGMAC_PPS_BASE_ADDR		0x00000d80
+
+static inline u32 xgmac_timestamp_base_addr(const struct dwxgmac_addrs *addrs)
+{
+	u32 addr;
+
+	if (addrs)
+		addr = addrs->timestamp_base;
+	else
+		addr = XGMAC_TIMESTAMP_BASE_ADDR;
+
+	return addr;
+}
+
+static inline u32 xgmac_pps_base_addr(const struct dwxgmac_addrs *addrs,
+				      const u32 x)
+{
+	u32 addr;
+
+	if (addrs)
+		addr = addrs->pps_base +  x * addrs->pps_offset;
+	else
+		addr = XGMAC_PPS_BASE_ADDR + x * 0x10;
+
+	return addr;
+}
+
+#define XGMAC_TIMESTAMP_STATUS(addrs)	(xgmac_timestamp_base_addr(addrs) + 0x20)
 #define XGMAC_TXTSC			BIT(15)
-#define XGMAC_TXTIMESTAMP_NSEC		0x00000d30
+#define XGMAC_TXTIMESTAMP_NSEC(addrs)		(xgmac_timestamp_base_addr(addrs) + 0x30)
 #define XGMAC_TXTSSTSLO			GENMASK(30, 0)
-#define XGMAC_TXTIMESTAMP_SEC		0x00000d34
-#define XGMAC_PPS_CONTROL		0x00000d70
+#define XGMAC_TXTIMESTAMP_SEC(addrs)		(xgmac_timestamp_base_addr(addrs) + 0x34)
+#define XGMAC_TXTIMESTAMP_STATUS_PKTID(addrs) (xgmac_timestamp_base_addr(addrs) + 0x38)
+
+#define XGMAC_PPS_CONTROL(addrs)		(xgmac_timestamp_base_addr(addrs) + 0x70)
 #define XGMAC_PPS_MAXIDX(x)		((((x) + 1) * 8) - 1)
 #define XGMAC_PPS_MINIDX(x)		((x) * 8)
 #define XGMAC_PPSx_MASK(x)		\
@@ -260,13 +291,15 @@
 #define XGMAC_PPSCMD_START		0x2
 #define XGMAC_PPSCMD_STOP		0x5
 #define XGMAC_PPSENx(x)			BIT(4 + (x) * 8)
-#define XGMAC_PPSx_TARGET_TIME_SEC(x)	(0x00000d80 + (x) * 0x10)
-#define XGMAC_PPSx_TARGET_TIME_NSEC(x)	(0x00000d84 + (x) * 0x10)
+#define XGMAC_PPSx_TARGET_TIME_SEC(addrs, x)			xgmac_pps_base_addr(addrs, x)
+#define XGMAC_PPSx_TARGET_TIME_NSEC(addrs, x)	(xgmac_pps_base_addr(addrs, x) + 0x04)
 #define XGMAC_TRGTBUSY0			BIT(31)
-#define XGMAC_PPSx_INTERVAL(x)		(0x00000d88 + (x) * 0x10)
-#define XGMAC_PPSx_WIDTH(x)		(0x00000d8c + (x) * 0x10)
+#define XGMAC_PPSx_INTERVAL(addrs, x)		(xgmac_pps_base_addr(addrs, x) + 0x08)
+#define XGMAC_PPSx_WIDTH(addrs, x)		(xgmac_pps_base_addr(addrs, x) + 0x0c)
 
 /* MTL Registers */
+#define XGMAC_MTL_CHAN_BASE_ADDR	0x00001100
+#define XGMAC_MTL_CHAN_OFFSET		0x80
 #define XGMAC_MTL_OPMODE		0x00001000
 #define XGMAC_FRPE			BIT(15)
 #define XGMAC_ETSALG			GENMASK(6, 5)
@@ -305,7 +338,21 @@
 #define XGMAC_MTL_ECC_INT_STATUS	0x000010cc
 #define XGMAC_MTL_DPP_CONTROL		0x000010e0
 #define XGMAC_DPP_DISABLE		BIT(0)
-#define XGMAC_MTL_TXQ_OPMODE(x)		(0x00001100 + (0x80 * (x)))
+
+static inline u32 xgmac_mtl_chanx_base_addr(const struct dwxgmac_addrs *addrs,
+					    const u32 x)
+{
+	u32 addr;
+
+	if (addrs)
+		addr = addrs->mtl_chan_base + (x * addrs->mtl_chan_offset);
+	else
+		addr = XGMAC_MTL_CHAN_BASE_ADDR + (x * XGMAC_MTL_CHAN_OFFSET);
+
+	return addr;
+}
+
+#define XGMAC_MTL_TXQ_OPMODE(addrs, x)	xgmac_mtl_chanx_base_addr(addrs, x)
 #define XGMAC_TQS			GENMASK(25, 16)
 #define XGMAC_TQS_SHIFT			16
 #define XGMAC_Q2TCMAP			GENMASK(10, 8)
@@ -315,39 +362,43 @@
 #define XGMAC_TXQEN			GENMASK(3, 2)
 #define XGMAC_TXQEN_SHIFT		2
 #define XGMAC_TSF			BIT(1)
-#define XGMAC_MTL_TCx_ETS_CONTROL(x)	(0x00001110 + (0x80 * (x)))
-#define XGMAC_MTL_TCx_QUANTUM_WEIGHT(x)	(0x00001118 + (0x80 * (x)))
-#define XGMAC_MTL_TCx_SENDSLOPE(x)	(0x0000111c + (0x80 * (x)))
-#define XGMAC_MTL_TCx_HICREDIT(x)	(0x00001120 + (0x80 * (x)))
-#define XGMAC_MTL_TCx_LOCREDIT(x)	(0x00001124 + (0x80 * (x)))
+#define XGMAC_MTL_TCx_ETS_CONTROL(addrs, x)	(xgmac_mtl_chanx_base_addr(addrs, x) + 0x10)
+#define XGMAC_MTL_TCx_QUANTUM_WEIGHT(addrs, x)	(xgmac_mtl_chanx_base_addr(addrs, x) + 0x18)
+#define XGMAC_MTL_TCx_SENDSLOPE(addrs, x)	(xgmac_mtl_chanx_base_addr(addrs, x) + 0x1c)
+#define XGMAC_MTL_TCx_HICREDIT(addrs, x)	(xgmac_mtl_chanx_base_addr(addrs, x) + 0x20)
+#define XGMAC_MTL_TCx_LOCREDIT(addrs, x)	(xgmac_mtl_chanx_base_addr(addrs, x) + 0x24)
 #define XGMAC_CC			BIT(3)
 #define XGMAC_TSA			GENMASK(1, 0)
 #define XGMAC_SP			(0x0 << 0)
 #define XGMAC_CBS			(0x1 << 0)
 #define XGMAC_ETS			(0x2 << 0)
-#define XGMAC_MTL_RXQ_OPMODE(x)		(0x00001140 + (0x80 * (x)))
+#define XGMAC_MTL_RXQ_OPMODE(addrs, x)		(xgmac_mtl_chanx_base_addr(addrs, x) + 0x40)
 #define XGMAC_RQS			GENMASK(25, 16)
 #define XGMAC_RQS_SHIFT			16
 #define XGMAC_EHFC			BIT(7)
 #define XGMAC_RSF			BIT(5)
 #define XGMAC_RTC			GENMASK(1, 0)
 #define XGMAC_RTC_SHIFT			0
-#define XGMAC_MTL_RXQ_FLOW_CONTROL(x)	(0x00001150 + (0x80 * (x)))
+#define XGMAC_MTL_RXQ_FLOW_CONTROL(addrs, x)	(xgmac_mtl_chanx_base_addr(addrs, x) + 0x50)
 #define XGMAC_RFD			GENMASK(31, 17)
 #define XGMAC_RFD_SHIFT			17
 #define XGMAC_RFA			GENMASK(15, 1)
 #define XGMAC_RFA_SHIFT			1
-#define XGMAC_MTL_QINTEN(x)		(0x00001170 + (0x80 * (x)))
+#define XGMAC_MTL_QINTEN(addrs, x)		(xgmac_mtl_chanx_base_addr(addrs, x) + 0x70)
 #define XGMAC_RXOIE			BIT(16)
-#define XGMAC_MTL_QINT_STATUS(x)	(0x00001174 + (0x80 * (x)))
+#define XGMAC_MTL_QINT_STATUS(addrs, x)	(xgmac_mtl_chanx_base_addr(addrs, x) + 0x74)
 #define XGMAC_RXOVFIS			BIT(16)
 #define XGMAC_ABPSIS			BIT(1)
 #define XGMAC_TXUNFIS			BIT(0)
-#define XGMAC_MAC_REGSIZE		(XGMAC_MTL_QINT_STATUS(15) / 4)
+#define XGMAC_MAC_REGSIZE(addrs)		(XGMAC_MTL_QINT_STATUS(addrs, 15) / 4)
 
 /* DMA Registers */
+#define XGMAC_DMA_CHAN_BASE_ADDR		0x00003100
+#define XGMAC_DMA_CHAN_OFFSET		0x80
 #define XGMAC_DMA_MODE			0x00003000
 #define XGMAC_SWR			BIT(0)
+#define XGMAC_DSCB		BIT(16)
+#define XGMAC_HMIC		BIT(17)
 #define XGMAC_DMA_SYSBUS_MODE		0x00003004
 #define XGMAC_WR_OSR_LMT		GENMASK(29, 24)
 #define XGMAC_WR_OSR_LMT_SHIFT		24
@@ -355,6 +406,7 @@
 #define XGMAC_RD_OSR_LMT_SHIFT		16
 #define XGMAC_EN_LPI			BIT(15)
 #define XGMAC_LPI_XIT_PKT		BIT(14)
+#define XGMAC_ONEKBBE		BIT(13)
 #define XGMAC_AAL			BIT(12)
 #define XGMAC_EAME			BIT(11)
 #define XGMAC_BLEN			GENMASK(7, 1)
@@ -388,44 +440,61 @@
 #define XGMAC_TCEIE			BIT(0)
 #define XGMAC_DMA_ECC_INT_STATUS	0x0000306c
 #define XGMAC_DMA_DPP_INT_STATUS	0x00003074
-#define XGMAC_DMA_CH_CONTROL(x)		(0x00003100 + (0x80 * (x)))
+
+static inline u32 xgmac_dma_chanx_base_addr(const struct dwxgmac_addrs *addrs,
+					    const u32 x)
+{
+	u32 addr;
+
+	if (addrs && (x % 2))
+		addr = addrs->dma_odd_chan_base + (x * addrs->dma_chan_offset);
+	else if (addrs)
+		addr = addrs->dma_even_chan_base + (x * addrs->dma_chan_offset);
+	else
+		addr = XGMAC_DMA_CHAN_BASE_ADDR + (x * XGMAC_DMA_CHAN_OFFSET);
+
+	return addr;
+}
+
+#define XGMAC_DMA_CH_CONTROL(addr, x)		(xgmac_dma_chanx_base_addr(addr, x))
 #define XGMAC_SPH			BIT(24)
 #define XGMAC_PBLx8			BIT(16)
-#define XGMAC_DMA_CH_TX_CONTROL(x)	(0x00003104 + (0x80 * (x)))
+#define XGMAC_DMA_CH_TX_CONTROL(addr, x)	(xgmac_dma_chanx_base_addr(addr, x) + 0x04)
 #define XGMAC_EDSE			BIT(28)
 #define XGMAC_TxPBL			GENMASK(21, 16)
 #define XGMAC_TxPBL_SHIFT		16
 #define XGMAC_TSE			BIT(12)
 #define XGMAC_OSP			BIT(4)
 #define XGMAC_TXST			BIT(0)
-#define XGMAC_DMA_CH_RX_CONTROL(x)	(0x00003108 + (0x80 * (x)))
+#define XGMAC_DMA_CH_RX_CONTROL(addr, x)	(xgmac_dma_chanx_base_addr(addr, x) + 0x08)
 #define XGMAC_RxPBL			GENMASK(21, 16)
 #define XGMAC_RxPBL_SHIFT		16
 #define XGMAC_RBSZ			GENMASK(14, 1)
 #define XGMAC_RBSZ_SHIFT		1
 #define XGMAC_RXST			BIT(0)
-#define XGMAC_DMA_CH_TxDESC_HADDR(x)	(0x00003110 + (0x80 * (x)))
-#define XGMAC_DMA_CH_TxDESC_LADDR(x)	(0x00003114 + (0x80 * (x)))
-#define XGMAC_DMA_CH_RxDESC_HADDR(x)	(0x00003118 + (0x80 * (x)))
-#define XGMAC_DMA_CH_RxDESC_LADDR(x)	(0x0000311c + (0x80 * (x)))
-#define XGMAC_DMA_CH_TxDESC_TAIL_LPTR(x)	(0x00003124 + (0x80 * (x)))
-#define XGMAC_DMA_CH_RxDESC_TAIL_LPTR(x)	(0x0000312c + (0x80 * (x)))
-#define XGMAC_DMA_CH_TxDESC_RING_LEN(x)		(0x00003130 + (0x80 * (x)))
-#define XGMAC_DMA_CH_RxDESC_RING_LEN(x)		(0x00003134 + (0x80 * (x)))
-#define XGMAC_DMA_CH_INT_EN(x)		(0x00003138 + (0x80 * (x)))
+#define XGMAC_DMA_CH_TxDESC_HADDR(addr, x)	(xgmac_dma_chanx_base_addr(addr, x) + 0x10)
+#define XGMAC_DMA_CH_TxDESC_LADDR(addr, x)	(xgmac_dma_chanx_base_addr(addr, x) + 0x14)
+#define XGMAC_DMA_CH_RxDESC_HADDR(addr, x)	(xgmac_dma_chanx_base_addr(addr, x) + 0x18)
+#define XGMAC_DMA_CH_RxDESC_LADDR(addr, x)	(xgmac_dma_chanx_base_addr(addr, x) + 0x1c)
+#define XGMAC_DMA_CH_TxDESC_TAIL_LPTR(addr, x)	(xgmac_dma_chanx_base_addr(addr, x) + 0x24)
+#define XGMAC_DMA_CH_RxDESC_TAIL_LPTR(addr, x)	(xgmac_dma_chanx_base_addr(addr, x) + 0x2c)
+#define XGMAC_DMA_CH_TxDESC_RING_LEN(addr, x)		(xgmac_dma_chanx_base_addr(addr, x) + 0x30)
+#define XGMAC_DMA_CH_RxDESC_RING_LEN(addr, x)		(xgmac_dma_chanx_base_addr(addr, x) + 0x34)
+#define XGMAC_DMA_CH_INT_EN(addr, x)		(xgmac_dma_chanx_base_addr(addr, x) + 0x38)
 #define XGMAC_NIE			BIT(15)
 #define XGMAC_AIE			BIT(14)
+#define XGMAC_FBEE			BIT(12)
 #define XGMAC_RBUE			BIT(7)
 #define XGMAC_RIE			BIT(6)
 #define XGMAC_TBUE			BIT(2)
 #define XGMAC_TIE			BIT(0)
 #define XGMAC_DMA_INT_DEFAULT_EN	(XGMAC_NIE | XGMAC_AIE | XGMAC_RBUE | \
-					XGMAC_RIE | XGMAC_TIE)
+					XGMAC_RIE | XGMAC_TIE | XGMAC_FBEE)
 #define XGMAC_DMA_INT_DEFAULT_RX	(XGMAC_RBUE | XGMAC_RIE)
 #define XGMAC_DMA_INT_DEFAULT_TX	(XGMAC_TIE)
-#define XGMAC_DMA_CH_Rx_WATCHDOG(x)	(0x0000313c + (0x80 * (x)))
+#define XGMAC_DMA_CH_Rx_WATCHDOG(addr, x)	(xgmac_dma_chanx_base_addr(addr, x) + 0x3c)
 #define XGMAC_RWT			GENMASK(7, 0)
-#define XGMAC_DMA_CH_STATUS(x)		(0x00003160 + (0x80 * (x)))
+#define XGMAC_DMA_CH_STATUS(addr, x)		(xgmac_dma_chanx_base_addr(addr, x) + 0x60)
 #define XGMAC_NIS			BIT(15)
 #define XGMAC_AIS			BIT(14)
 #define XGMAC_FBE			BIT(12)
@@ -434,7 +503,7 @@
 #define XGMAC_TBU			BIT(2)
 #define XGMAC_TPS			BIT(1)
 #define XGMAC_TI			BIT(0)
-#define XGMAC_REGSIZE			((0x0000317c + (0x80 * 15)) / 4)
+#define XGMAC_REGSIZE(addr)			((xgmac_dma_chanx_base_addr(addr, 15) + 0x7c) / 4)
 
 #define XGMAC_DMA_STATUS_MSK_COMMON	(XGMAC_NIS | XGMAC_AIS | XGMAC_FBE)
 #define XGMAC_DMA_STATUS_MSK_RX		(XGMAC_RBU | XGMAC_RI | \
@@ -445,6 +514,7 @@
 /* Descriptors */
 #define XGMAC_TDES0_LTV			BIT(31)
 #define XGMAC_TDES0_LT			GENMASK(7, 0)
+#define XGMAC_TDES0_TTSL		GENMASK(9, 0)
 #define XGMAC_TDES1_LT			GENMASK(31, 8)
 #define XGMAC_TDES2_IVT			GENMASK(31, 16)
 #define XGMAC_TDES2_IVT_SHIFT		16
@@ -459,6 +529,8 @@
 #define XGMAC_TDES3_CTXT		BIT(30)
 #define XGMAC_TDES3_FD			BIT(29)
 #define XGMAC_TDES3_LD			BIT(28)
+#define XGMAC_TDES3_OSTC		BIT(27)
+#define XGMAC_TDES3_PIDV		BIT(25)
 #define XGMAC_TDES3_CPC			GENMASK(27, 26)
 #define XGMAC_TDES3_CPC_SHIFT		26
 #define XGMAC_TDES3_TCMSSV		BIT(26)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -11,6 +11,7 @@
 #include "stmmac_ptp.h"
 #include "dwxlgmac2.h"
 #include "dwxgmac2.h"
+#include "dw25gmac.h"
 
 static void dwxgmac2_core_init(struct mac_device_info *hw,
 			       struct net_device *dev)
@@ -47,14 +48,6 @@
 	writel(XGMAC_INT_DEFAULT_EN, ioaddr + XGMAC_INT_EN);
 }
 
-static void xgmac_phylink_get_caps(struct stmmac_priv *priv)
-{
-	priv->phylink_config.mac_capabilities |= MAC_2500FD | MAC_5000FD |
-						 MAC_10000FD | MAC_25000FD |
-						 MAC_40000FD | MAC_50000FD |
-						 MAC_100000FD;
-}
-
 static void dwxgmac2_set_mac(void __iomem *ioaddr, bool enable)
 {
 	u32 tx = readl(ioaddr + XGMAC_TX_CONFIG);
@@ -105,17 +98,41 @@
 				   u32 queue)
 {
 	void __iomem *ioaddr = hw->pcsr;
-	u32 value, reg;
+	u32 clear_mask = 0;
+	u32 ctrl2, ctrl3;
+	int i;
 
-	reg = (queue < 4) ? XGMAC_RXQ_CTRL2 : XGMAC_RXQ_CTRL3;
-	if (queue >= 4)
+	ctrl2 = readl(ioaddr + XGMAC_RXQ_CTRL2);
+	ctrl3 = readl(ioaddr + XGMAC_RXQ_CTRL3);
+
+	/* The software must ensure that the same priority
+	 * is not mapped to multiple Rx queues
+	 */
+	for (i = 0; i < 4; i++)
+		clear_mask |= ((prio << XGMAC_PSRQ_SHIFT(i)) &
+						XGMAC_PSRQ(i));
+
+	ctrl2 &= ~clear_mask;
+	ctrl3 &= ~clear_mask;
+
+	/* First assign new priorities to a queue, then
+	 * clear them from others queues
+	 */
+	if (queue < 4) {
+		ctrl2 |= (prio << XGMAC_PSRQ_SHIFT(queue)) &
+						XGMAC_PSRQ(queue);
+
+		writel(ctrl2, ioaddr + XGMAC_RXQ_CTRL2);
+		writel(ctrl3, ioaddr + XGMAC_RXQ_CTRL3);
+	} else {
 		queue -= 4;
 
-	value = readl(ioaddr + reg);
-	value &= ~XGMAC_PSRQ(queue);
-	value |= (prio << XGMAC_PSRQ_SHIFT(queue)) & XGMAC_PSRQ(queue);
+		ctrl3 |= (prio << XGMAC_PSRQ_SHIFT(queue)) &
+						XGMAC_PSRQ(queue);
 
-	writel(value, ioaddr + reg);
+		writel(ctrl3, ioaddr + XGMAC_RXQ_CTRL3);
+		writel(ctrl2, ioaddr + XGMAC_RXQ_CTRL2);
+	}
 }
 
 static void dwxgmac2_tx_queue_prio(struct mac_device_info *hw, u32 prio,
@@ -187,9 +204,10 @@
 	writel(value, ioaddr + XGMAC_MTL_OPMODE);
 }
 
-static void dwxgmac2_prog_mtl_tx_algorithms(struct mac_device_info *hw,
+static void dwxgmac2_prog_mtl_tx_algorithms(struct stmmac_priv *priv, struct mac_device_info *hw,
 					    u32 tx_alg)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	void __iomem *ioaddr = hw->pcsr;
 	bool ets = true;
 	u32 value;
@@ -217,11 +235,11 @@
 
 	/* Set ETS if desired */
 	for (i = 0; i < MTL_MAX_TX_QUEUES; i++) {
-		value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(i));
+		value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(dwxgmac_addrs, i));
 		value &= ~XGMAC_TSA;
 		if (ets)
 			value |= XGMAC_ETS;
-		writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(i));
+		writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(dwxgmac_addrs, i));
 	}
 }
 
@@ -229,9 +247,10 @@
 					     struct mac_device_info *hw,
 					     u32 weight, u32 queue)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	void __iomem *ioaddr = hw->pcsr;
 
-	writel(weight, ioaddr + XGMAC_MTL_TCx_QUANTUM_WEIGHT(queue));
+	writel(weight, ioaddr + XGMAC_MTL_TCx_QUANTUM_WEIGHT(dwxgmac_addrs, queue));
 }
 
 static void dwxgmac2_map_mtl_to_dma(struct mac_device_info *hw, u32 queue,
@@ -256,26 +275,28 @@
 				u32 send_slope, u32 idle_slope,
 				u32 high_credit, u32 low_credit, u32 queue)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	void __iomem *ioaddr = hw->pcsr;
 	u32 value;
 
-	writel(send_slope, ioaddr + XGMAC_MTL_TCx_SENDSLOPE(queue));
-	writel(idle_slope, ioaddr + XGMAC_MTL_TCx_QUANTUM_WEIGHT(queue));
-	writel(high_credit, ioaddr + XGMAC_MTL_TCx_HICREDIT(queue));
-	writel(low_credit, ioaddr + XGMAC_MTL_TCx_LOCREDIT(queue));
+	writel(send_slope, ioaddr + XGMAC_MTL_TCx_SENDSLOPE(dwxgmac_addrs, queue));
+	writel(idle_slope, ioaddr + XGMAC_MTL_TCx_QUANTUM_WEIGHT(dwxgmac_addrs, queue));
+	writel(high_credit, ioaddr + XGMAC_MTL_TCx_HICREDIT(dwxgmac_addrs, queue));
+	writel(low_credit, ioaddr + XGMAC_MTL_TCx_LOCREDIT(dwxgmac_addrs, queue));
 
-	value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue));
+	value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(dwxgmac_addrs, queue));
 	value &= ~XGMAC_TSA;
 	value |= XGMAC_CC | XGMAC_CBS;
-	writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue));
+	writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(dwxgmac_addrs, queue));
 }
 
-static void dwxgmac2_dump_regs(struct mac_device_info *hw, u32 *reg_space)
+static void dwxgmac2_dump_regs(struct stmmac_priv *priv, struct mac_device_info *hw, u32 *reg_space)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	void __iomem *ioaddr = hw->pcsr;
 	int i;
 
-	for (i = 0; i < XGMAC_MAC_REGSIZE; i++)
+	for (i = 0; i < XGMAC_MAC_REGSIZE(dwxgmac_addrs); i++)
 		reg_space[i] = readl(ioaddr + i * 4);
 }
 
@@ -319,18 +340,19 @@
 static int dwxgmac2_host_mtl_irq_status(struct stmmac_priv *priv,
 					struct mac_device_info *hw, u32 chan)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	void __iomem *ioaddr = hw->pcsr;
 	int ret = 0;
 	u32 status;
 
 	status = readl(ioaddr + XGMAC_MTL_INT_STATUS);
 	if (status & BIT(chan)) {
-		u32 chan_status = readl(ioaddr + XGMAC_MTL_QINT_STATUS(chan));
+		u32 chan_status = readl(ioaddr + XGMAC_MTL_QINT_STATUS(dwxgmac_addrs, chan));
 
 		if (chan_status & XGMAC_RXOVFIS)
 			ret |= CORE_IRQ_MTL_RX_OVERFLOW;
 
-		writel(~0x0, ioaddr + XGMAC_MTL_QINT_STATUS(chan));
+		writel(~0x0, ioaddr + XGMAC_MTL_QINT_STATUS(dwxgmac_addrs, chan));
 	}
 
 	return ret;
@@ -599,7 +621,7 @@
 }
 
 static void dwxgmac2_update_vlan_hash(struct mac_device_info *hw, u32 hash,
-				      __le16 perfect_match, bool is_double)
+				      u16 perfect_match, bool is_double)
 {
 	void __iomem *ioaddr = hw->pcsr;
 
@@ -1195,26 +1217,29 @@
 	return ret;
 }
 
-static int dwxgmac2_get_mac_tx_timestamp(struct mac_device_info *hw, u64 *ts)
+static int dwxgmac2_get_mac_tx_timestamp(struct stmmac_priv *priv, struct mac_device_info *hw,
+					 u64 *ts)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	void __iomem *ioaddr = hw->pcsr;
 	u32 value;
 
-	if (readl_poll_timeout_atomic(ioaddr + XGMAC_TIMESTAMP_STATUS,
+	if (readl_poll_timeout_atomic(ioaddr + XGMAC_TIMESTAMP_STATUS(dwxgmac_addrs),
 				      value, value & XGMAC_TXTSC, 100, 10000))
 		return -EBUSY;
 
-	*ts = readl(ioaddr + XGMAC_TXTIMESTAMP_NSEC) & XGMAC_TXTSSTSLO;
-	*ts += readl(ioaddr + XGMAC_TXTIMESTAMP_SEC) * 1000000000ULL;
+	*ts = readl(ioaddr + XGMAC_TXTIMESTAMP_NSEC(dwxgmac_addrs)) & XGMAC_TXTSSTSLO;
+	*ts += readl(ioaddr + XGMAC_TXTIMESTAMP_SEC(dwxgmac_addrs)) * 1000000000ULL;
 	return 0;
 }
 
-static int dwxgmac2_flex_pps_config(void __iomem *ioaddr, int index,
+static int dwxgmac2_flex_pps_config(struct stmmac_priv *priv, void __iomem *ioaddr, int index,
 				    struct stmmac_pps_cfg *cfg, bool enable,
 				    u32 sub_second_inc, u32 systime_flags)
 {
-	u32 tnsec = readl(ioaddr + XGMAC_PPSx_TARGET_TIME_NSEC(index));
-	u32 val = readl(ioaddr + XGMAC_PPS_CONTROL);
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 tnsec = readl(ioaddr + XGMAC_PPSx_TARGET_TIME_NSEC(dwxgmac_addrs, index));
+	u32 val = readl(ioaddr + XGMAC_PPS_CONTROL(dwxgmac_addrs));
 	u64 period;
 
 	if (!cfg->available)
@@ -1228,7 +1253,7 @@
 
 	if (!enable) {
 		val |= XGMAC_PPSCMDx(index, XGMAC_PPSCMD_STOP);
-		writel(val, ioaddr + XGMAC_PPS_CONTROL);
+		writel(val, ioaddr + XGMAC_PPS_CONTROL(dwxgmac_addrs));
 		return 0;
 	}
 
@@ -1248,11 +1273,11 @@
 	 */
 	val |= XGMAC_PPSENx(index);
 
-	writel(cfg->start.tv_sec, ioaddr + XGMAC_PPSx_TARGET_TIME_SEC(index));
+	writel(cfg->start.tv_sec, ioaddr + XGMAC_PPSx_TARGET_TIME_SEC(dwxgmac_addrs, index));
 
 	if (!(systime_flags & PTP_TCR_TSCTRLSSR))
 		cfg->start.tv_nsec = (cfg->start.tv_nsec * 1000) / 465;
-	writel(cfg->start.tv_nsec, ioaddr + XGMAC_PPSx_TARGET_TIME_NSEC(index));
+	writel(cfg->start.tv_nsec, ioaddr + XGMAC_PPSx_TARGET_TIME_NSEC(dwxgmac_addrs, index));
 
 	period = cfg->period.tv_sec * 1000000000;
 	period += cfg->period.tv_nsec;
@@ -1262,16 +1287,16 @@
 	if (period <= 1)
 		return -EINVAL;
 
-	writel(period - 1, ioaddr + XGMAC_PPSx_INTERVAL(index));
+	writel(period - 1, ioaddr + XGMAC_PPSx_INTERVAL(dwxgmac_addrs, index));
 
 	period >>= 1;
 	if (period <= 1)
 		return -EINVAL;
 
-	writel(period - 1, ioaddr + XGMAC_PPSx_WIDTH(index));
+	writel(period - 1, ioaddr + XGMAC_PPSx_WIDTH(dwxgmac_addrs, index));
 
 	/* Finally, activate it */
-	writel(val, ioaddr + XGMAC_PPS_CONTROL);
+	writel(val, ioaddr + XGMAC_PPS_CONTROL(dwxgmac_addrs));
 	return 0;
 }
 
@@ -1516,7 +1541,6 @@
 
 const struct stmmac_ops dwxgmac210_ops = {
 	.core_init = dwxgmac2_core_init,
-	.phylink_get_caps = xgmac_phylink_get_caps,
 	.set_mac = dwxgmac2_set_mac,
 	.rx_ipc = dwxgmac2_rx_ipc,
 	.rx_queue_enable = dwxgmac2_rx_queue_enable,
@@ -1577,7 +1601,6 @@
 
 const struct stmmac_ops dwxlgmac2_ops = {
 	.core_init = dwxgmac2_core_init,
-	.phylink_get_caps = xgmac_phylink_get_caps,
 	.set_mac = dwxgmac2_set_mac,
 	.rx_ipc = dwxgmac2_rx_ipc,
 	.rx_queue_enable = dwxlgmac2_rx_queue_enable,
@@ -1637,6 +1660,50 @@
 	if (mac->multicast_filter_bins)
 		mac->mcast_bits_log2 = ilog2(mac->multicast_filter_bins);
 
+	mac->link.caps = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
+			 MAC_1000FD | MAC_2500FD | MAC_5000FD |
+			 MAC_10000FD;
+	mac->link.duplex = 0;
+	mac->link.speed10 = XGMAC_CONFIG_SS_10_MII;
+	mac->link.speed100 = XGMAC_CONFIG_SS_100_MII;
+	mac->link.speed1000 = XGMAC_CONFIG_SS_1000_GMII;
+	mac->link.speed2500 = XGMAC_CONFIG_SS_2500_GMII;
+	mac->link.xgmii.speed2500 = XGMAC_CONFIG_SS_2500;
+	mac->link.xgmii.speed5000 = XGMAC_CONFIG_SS_5000;
+	mac->link.xgmii.speed10000 = XGMAC_CONFIG_SS_10000;
+	mac->link.speed_mask = XGMAC_CONFIG_SS_MASK;
+
+	mac->mii.addr = XGMAC_MDIO_ADDR;
+	mac->mii.data = XGMAC_MDIO_DATA;
+	mac->mii.addr_shift = 16;
+	mac->mii.addr_mask = GENMASK(20, 16);
+	mac->mii.reg_shift = 0;
+	mac->mii.reg_mask = GENMASK(15, 0);
+	mac->mii.clk_csr_shift = 19;
+	mac->mii.clk_csr_mask = GENMASK(21, 19);
+
+	return 0;
+}
+
+int dw25gmac_setup(struct stmmac_priv *priv)
+{
+	struct mac_device_info *mac = priv->hw;
+
+	dev_info(priv->device, "\tDW25GMAC\n");
+
+	priv->dev->priv_flags |= IFF_UNICAST_FLT;
+	mac->pcsr = priv->ioaddr;
+	mac->multicast_filter_bins = priv->plat->multicast_filter_bins;
+	mac->unicast_filter_entries = priv->plat->unicast_filter_entries;
+	mac->mcast_bits_log2 = 0;
+
+	if (mac->multicast_filter_bins)
+		mac->mcast_bits_log2 = ilog2(mac->multicast_filter_bins);
+
+	mac->link.caps = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
+			 MAC_10FD | MAC_100FD | MAC_1000FD |
+			 MAC_2500FD | MAC_5000FD |
+			 MAC_10000FD | MAC_25000FD;
 	mac->link.duplex = 0;
 	mac->link.speed10 = XGMAC_CONFIG_SS_10_MII;
 	mac->link.speed100 = XGMAC_CONFIG_SS_100_MII;
@@ -1645,6 +1712,7 @@
 	mac->link.xgmii.speed2500 = XGMAC_CONFIG_SS_2500;
 	mac->link.xgmii.speed5000 = XGMAC_CONFIG_SS_5000;
 	mac->link.xgmii.speed10000 = XGMAC_CONFIG_SS_10000;
+	mac->link.xgmii.speed25000 = XGMAC_CONFIG_SS_25000;
 	mac->link.speed_mask = XGMAC_CONFIG_SS_MASK;
 
 	mac->mii.addr = XGMAC_MDIO_ADDR;
@@ -1674,6 +1742,11 @@
 	if (mac->multicast_filter_bins)
 		mac->mcast_bits_log2 = ilog2(mac->multicast_filter_bins);
 
+	mac->link.caps = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
+			 MAC_1000FD | MAC_2500FD | MAC_5000FD |
+			 MAC_10000FD | MAC_25000FD |
+			 MAC_40000FD | MAC_50000FD |
+			 MAC_100000FD;
 	mac->link.duplex = 0;
 	mac->link.speed1000 = XLGMAC_CONFIG_SS_1000;
 	mac->link.speed2500 = XLGMAC_CONFIG_SS_2500;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
@@ -341,6 +341,17 @@
 	p->des7 = 0;
 }
 
+static void dwxgmac2_set_hw_ts(struct dma_desc *p, u32 pid)
+{
+	p->des0 = 0;
+	p->des1 = 0;
+	p->des2 = 0;
+	p->des3 = 0;
+	p->des0 = cpu_to_le32(pid & XGMAC_TDES0_TTSL);
+	p->des3 |= cpu_to_le32(XGMAC_TDES3_CTXT);
+	p->des3 |= cpu_to_le32(XGMAC_TDES3_PIDV);
+}
+
 const struct stmmac_desc_ops dwxgmac210_desc_ops = {
 	.tx_status = dwxgmac2_get_tx_status,
 	.rx_status = dwxgmac2_get_rx_status,
@@ -370,4 +381,5 @@
 	.set_vlan_tag = dwxgmac2_set_vlan_tag,
 	.set_vlan = dwxgmac2_set_vlan,
 	.set_tbs = dwxgmac2_set_tbs,
+	.set_hw_ts = dwxgmac2_set_hw_ts,
 };
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -7,6 +7,7 @@
 #include <linux/iopoll.h>
 #include "stmmac.h"
 #include "dwxgmac2.h"
+#include "dw25gmac.h"
 
 static int dwxgmac2_dma_reset(void __iomem *ioaddr)
 {
@@ -19,7 +20,7 @@
 				  !(value & XGMAC_SWR), 0, 100000);
 }
 
-static void dwxgmac2_dma_init(void __iomem *ioaddr,
+static void dwxgmac2_dma_init(struct stmmac_priv *priv, void __iomem *ioaddr,
 			      struct stmmac_dma_cfg *dma_cfg, int atds)
 {
 	u32 value = readl(ioaddr + XGMAC_DMA_SYSBUS_MODE);
@@ -37,13 +38,14 @@
 				   void __iomem *ioaddr,
 				   struct stmmac_dma_cfg *dma_cfg, u32 chan)
 {
-	u32 value = readl(ioaddr + XGMAC_DMA_CH_CONTROL(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_CONTROL(dwxgmac_addrs, chan));
 
 	if (dma_cfg->pblx8)
 		value |= XGMAC_PBLx8;
 
-	writel(value, ioaddr + XGMAC_DMA_CH_CONTROL(chan));
-	writel(XGMAC_DMA_INT_DEFAULT_EN, ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_CONTROL(dwxgmac_addrs, chan));
+	writel(XGMAC_DMA_INT_DEFAULT_EN, ioaddr + XGMAC_DMA_CH_INT_EN(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_dma_init_rx_chan(struct stmmac_priv *priv,
@@ -51,16 +53,17 @@
 				      struct stmmac_dma_cfg *dma_cfg,
 				      dma_addr_t phy, u32 chan)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	u32 rxpbl = dma_cfg->rxpbl ?: dma_cfg->pbl;
 	u32 value;
 
-	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
 	value &= ~XGMAC_RxPBL;
 	value |= (rxpbl << XGMAC_RxPBL_SHIFT) & XGMAC_RxPBL;
-	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
 
-	writel(upper_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(chan));
-	writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(chan));
+	writel(upper_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(dwxgmac_addrs, chan));
+	writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_dma_init_tx_chan(struct stmmac_priv *priv,
@@ -68,17 +71,18 @@
 				      struct stmmac_dma_cfg *dma_cfg,
 				      dma_addr_t phy, u32 chan)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	u32 txpbl = dma_cfg->txpbl ?: dma_cfg->pbl;
 	u32 value;
 
-	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 	value &= ~XGMAC_TxPBL;
 	value |= (txpbl << XGMAC_TxPBL_SHIFT) & XGMAC_TxPBL;
 	value |= XGMAC_OSP;
-	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 
-	writel(upper_32_bits(phy), ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(chan));
-	writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(chan));
+	writel(upper_32_bits(phy), ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(dwxgmac_addrs, chan));
+	writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_dma_axi(void __iomem *ioaddr, struct stmmac_axi *axi)
@@ -102,6 +106,9 @@
 	if (!axi->axi_fb)
 		value |= XGMAC_UNDEF;
 
+	if (axi->axi_kbbe)
+		value |= XGMAC_ONEKBBE;
+
 	value &= ~XGMAC_BLEN;
 	for (i = 0; i < AXI_BLEN; i++) {
 		switch (axi->axi_blen[i]) {
@@ -137,16 +144,18 @@
 static void dwxgmac2_dma_dump_regs(struct stmmac_priv *priv,
 				   void __iomem *ioaddr, u32 *reg_space)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	int i;
 
-	for (i = (XGMAC_DMA_MODE / 4); i < XGMAC_REGSIZE; i++)
+	for (i = (XGMAC_DMA_MODE / 4); i < XGMAC_REGSIZE(dwxgmac_addrs); i++)
 		reg_space[i] = readl(ioaddr + i * 4);
 }
 
 static void dwxgmac2_dma_rx_mode(struct stmmac_priv *priv, void __iomem *ioaddr,
 				 int mode, u32 channel, int fifosz, u8 qmode)
 {
-	u32 value = readl(ioaddr + XGMAC_MTL_RXQ_OPMODE(channel));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 value = readl(ioaddr + XGMAC_MTL_RXQ_OPMODE(dwxgmac_addrs, channel));
 	unsigned int rqs = fifosz / 256 - 1;
 
 	if (mode == SF_DMA_MODE) {
@@ -167,7 +176,7 @@
 	value |= (rqs << XGMAC_RQS_SHIFT) & XGMAC_RQS;
 
 	if ((fifosz >= 4096) && (qmode != MTL_QUEUE_AVB)) {
-		u32 flow = readl(ioaddr + XGMAC_MTL_RXQ_FLOW_CONTROL(channel));
+		u32 flow = readl(ioaddr + XGMAC_MTL_RXQ_FLOW_CONTROL(dwxgmac_addrs, channel));
 		unsigned int rfd, rfa;
 
 		value |= XGMAC_EHFC;
@@ -199,20 +208,21 @@
 		flow &= ~XGMAC_RFA;
 		flow |= rfa << XGMAC_RFA_SHIFT;
 
-		writel(flow, ioaddr + XGMAC_MTL_RXQ_FLOW_CONTROL(channel));
+		writel(flow, ioaddr + XGMAC_MTL_RXQ_FLOW_CONTROL(dwxgmac_addrs, channel));
 	}
 
-	writel(value, ioaddr + XGMAC_MTL_RXQ_OPMODE(channel));
+	writel(value, ioaddr + XGMAC_MTL_RXQ_OPMODE(dwxgmac_addrs, channel));
 
 	/* Enable MTL RX overflow */
-	value = readl(ioaddr + XGMAC_MTL_QINTEN(channel));
-	writel(value | XGMAC_RXOIE, ioaddr + XGMAC_MTL_QINTEN(channel));
+	value = readl(ioaddr + XGMAC_MTL_QINTEN(dwxgmac_addrs, channel));
+	writel(value | XGMAC_RXOIE, ioaddr + XGMAC_MTL_QINTEN(dwxgmac_addrs, channel));
 }
 
 static void dwxgmac2_dma_tx_mode(struct stmmac_priv *priv, void __iomem *ioaddr,
 				 int mode, u32 channel, int fifosz, u8 qmode)
 {
-	u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(channel));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(dwxgmac_addrs, channel));
 	unsigned int tqs = fifosz / 256 - 1;
 
 	if (mode == SF_DMA_MODE) {
@@ -249,45 +259,48 @@
 	value &= ~XGMAC_TQS;
 	value |= (tqs << XGMAC_TQS_SHIFT) & XGMAC_TQS;
 
-	writel(value, ioaddr +  XGMAC_MTL_TXQ_OPMODE(channel));
+	writel(value, ioaddr + XGMAC_MTL_TXQ_OPMODE(dwxgmac_addrs, channel));
 }
 
 static void dwxgmac2_enable_dma_irq(struct stmmac_priv *priv,
 				    void __iomem *ioaddr, u32 chan,
 				    bool rx, bool tx)
 {
-	u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(dwxgmac_addrs, chan));
 
 	if (rx)
 		value |= XGMAC_DMA_INT_DEFAULT_RX;
 	if (tx)
 		value |= XGMAC_DMA_INT_DEFAULT_TX;
 
-	writel(value, ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_INT_EN(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_disable_dma_irq(struct stmmac_priv *priv,
 				     void __iomem *ioaddr, u32 chan,
 				     bool rx, bool tx)
 {
-	u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(dwxgmac_addrs, chan));
 
 	if (rx)
 		value &= ~XGMAC_DMA_INT_DEFAULT_RX;
 	if (tx)
 		value &= ~XGMAC_DMA_INT_DEFAULT_TX;
 
-	writel(value, ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_INT_EN(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_dma_start_tx(struct stmmac_priv *priv,
 				  void __iomem *ioaddr, u32 chan)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	u32 value;
 
-	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 	value |= XGMAC_TXST;
-	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 
 	value = readl(ioaddr + XGMAC_TX_CONFIG);
 	value |= XGMAC_CONFIG_TE;
@@ -297,11 +310,12 @@
 static void dwxgmac2_dma_stop_tx(struct stmmac_priv *priv, void __iomem *ioaddr,
 				 u32 chan)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	u32 value;
 
-	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 	value &= ~XGMAC_TXST;
-	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 
 	value = readl(ioaddr + XGMAC_TX_CONFIG);
 	value &= ~XGMAC_CONFIG_TE;
@@ -311,11 +325,12 @@
 static void dwxgmac2_dma_start_rx(struct stmmac_priv *priv,
 				  void __iomem *ioaddr, u32 chan)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	u32 value;
 
-	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
 	value |= XGMAC_RXST;
-	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
 
 	value = readl(ioaddr + XGMAC_RX_CONFIG);
 	value |= XGMAC_CONFIG_RE;
@@ -325,11 +340,12 @@
 static void dwxgmac2_dma_stop_rx(struct stmmac_priv *priv, void __iomem *ioaddr,
 				 u32 chan)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	u32 value;
 
-	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
 	value &= ~XGMAC_RXST;
-	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
 }
 
 static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv,
@@ -338,8 +354,10 @@
 				  u32 dir)
 {
 	struct stmmac_pcpu_stats *stats = this_cpu_ptr(priv->xstats.pcpu_stats);
-	u32 intr_status = readl(ioaddr + XGMAC_DMA_CH_STATUS(chan));
-	u32 intr_en = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 intr_status = readl(ioaddr + XGMAC_DMA_CH_STATUS(dwxgmac_addrs, chan));
+	u32 intr_en = readl(ioaddr + XGMAC_DMA_CH_INT_EN(dwxgmac_addrs, chan));
+
 	int ret = 0;
 
 	if (dir == DMA_DIR_RX)
@@ -380,7 +398,7 @@
 	}
 
 	/* Clear interrupts */
-	writel(intr_en & intr_status, ioaddr + XGMAC_DMA_CH_STATUS(chan));
+	writel(intr_en & intr_status, ioaddr + XGMAC_DMA_CH_STATUS(dwxgmac_addrs, chan));
 
 	return ret;
 }
@@ -500,108 +518,146 @@
 	return 0;
 }
 
+static int dw25gmac_get_hw_feature(void __iomem *ioaddr,
+				   struct dma_features *dma_cap)
+
+{
+	u32 hw_cap;
+	int ret;
+
+	ret = dwxgmac2_get_hw_feature(ioaddr, dma_cap);
+
+	/* For DW25GMAC VDMA channel count is channel count */
+	hw_cap = readl(ioaddr + XGMAC_HW_FEATURE2);
+	dma_cap->number_tx_channel =
+		dw25gmac_decode_vdma_count(FIELD_GET(XXVGMAC_HWFEAT_VDMA_TXCNT,
+						     hw_cap));
+	dma_cap->number_rx_channel =
+		dw25gmac_decode_vdma_count(FIELD_GET(XXVGMAC_HWFEAT_VDMA_RXCNT,
+						     hw_cap));
+
+	return ret;
+}
+
 static void dwxgmac2_rx_watchdog(struct stmmac_priv *priv, void __iomem *ioaddr,
 				 u32 riwt, u32 queue)
 {
-	writel(riwt & XGMAC_RWT, ioaddr + XGMAC_DMA_CH_Rx_WATCHDOG(queue));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+
+	writel(riwt & XGMAC_RWT, ioaddr + XGMAC_DMA_CH_Rx_WATCHDOG(dwxgmac_addrs, queue));
 }
 
 static void dwxgmac2_set_rx_ring_len(struct stmmac_priv *priv,
 				     void __iomem *ioaddr, u32 len, u32 chan)
 {
-	writel(len, ioaddr + XGMAC_DMA_CH_RxDESC_RING_LEN(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+
+	writel(len, ioaddr + XGMAC_DMA_CH_RxDESC_RING_LEN(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_set_tx_ring_len(struct stmmac_priv *priv,
 				     void __iomem *ioaddr, u32 len, u32 chan)
 {
-	writel(len, ioaddr + XGMAC_DMA_CH_TxDESC_RING_LEN(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+
+	writel(len, ioaddr + XGMAC_DMA_CH_TxDESC_RING_LEN(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_set_rx_tail_ptr(struct stmmac_priv *priv,
 				     void __iomem *ioaddr, u32 ptr, u32 chan)
 {
-	writel(ptr, ioaddr + XGMAC_DMA_CH_RxDESC_TAIL_LPTR(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+
+	writel(ptr, ioaddr + XGMAC_DMA_CH_RxDESC_TAIL_LPTR(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_set_tx_tail_ptr(struct stmmac_priv *priv,
 				     void __iomem *ioaddr, u32 ptr, u32 chan)
 {
-	writel(ptr, ioaddr + XGMAC_DMA_CH_TxDESC_TAIL_LPTR(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+
+	writel(ptr, ioaddr + XGMAC_DMA_CH_TxDESC_TAIL_LPTR(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_enable_tso(struct stmmac_priv *priv, void __iomem *ioaddr,
 				bool en, u32 chan)
 {
-	u32 value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 
 	if (en)
 		value |= XGMAC_TSE;
 	else
 		value &= ~XGMAC_TSE;
 
-	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_qmode(struct stmmac_priv *priv, void __iomem *ioaddr,
 			   u32 channel, u8 qmode)
 {
-	u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(channel));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(dwxgmac_addrs, channel));
+
 	u32 flow = readl(ioaddr + XGMAC_RX_FLOW_CTRL);
 
 	value &= ~XGMAC_TXQEN;
 	if (qmode != MTL_QUEUE_AVB) {
 		value |= 0x2 << XGMAC_TXQEN_SHIFT;
-		writel(0, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(channel));
+		writel(0, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(dwxgmac_addrs, channel));
 	} else {
 		value |= 0x1 << XGMAC_TXQEN_SHIFT;
 		writel(flow & (~XGMAC_RFE), ioaddr + XGMAC_RX_FLOW_CTRL);
 	}
 
-	writel(value, ioaddr +  XGMAC_MTL_TXQ_OPMODE(channel));
+	writel(value, ioaddr + XGMAC_MTL_TXQ_OPMODE(dwxgmac_addrs, channel));
 }
 
 static void dwxgmac2_set_bfsize(struct stmmac_priv *priv, void __iomem *ioaddr,
 				int bfsize, u32 chan)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	u32 value;
 
-	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
 	value &= ~XGMAC_RBSZ;
 	value |= bfsize << XGMAC_RBSZ_SHIFT;
-	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(dwxgmac_addrs, chan));
 }
 
 static void dwxgmac2_enable_sph(struct stmmac_priv *priv, void __iomem *ioaddr,
 				bool en, u32 chan)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	u32 value = readl(ioaddr + XGMAC_RX_CONFIG);
 
 	value &= ~XGMAC_CONFIG_HDSMS;
 	value |= XGMAC_CONFIG_HDSMS_256; /* Segment max 256 bytes */
 	writel(value, ioaddr + XGMAC_RX_CONFIG);
 
-	value = readl(ioaddr + XGMAC_DMA_CH_CONTROL(chan));
+	value = readl(ioaddr + XGMAC_DMA_CH_CONTROL(dwxgmac_addrs, chan));
 	if (en)
 		value |= XGMAC_SPH;
 	else
 		value &= ~XGMAC_SPH;
-	writel(value, ioaddr + XGMAC_DMA_CH_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_CONTROL(dwxgmac_addrs, chan));
 }
 
 static int dwxgmac2_enable_tbs(struct stmmac_priv *priv, void __iomem *ioaddr,
 			       bool en, u32 chan)
 {
-	u32 value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 
 	if (en)
 		value |= XGMAC_EDSE;
 	else
 		value &= ~XGMAC_EDSE;
 
-	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan));
 
-	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan)) & XGMAC_EDSE;
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(dwxgmac_addrs, chan)) & XGMAC_EDSE;
 	if (en && !value)
 		return -EIO;
 
@@ -633,6 +689,39 @@
 	.rx_watchdog = dwxgmac2_rx_watchdog,
 	.set_rx_ring_len = dwxgmac2_set_rx_ring_len,
 	.set_tx_ring_len = dwxgmac2_set_tx_ring_len,
+	.set_rx_tail_ptr = dwxgmac2_set_rx_tail_ptr,
+	.set_tx_tail_ptr = dwxgmac2_set_tx_tail_ptr,
+	.enable_tso = dwxgmac2_enable_tso,
+	.qmode = dwxgmac2_qmode,
+	.set_bfsize = dwxgmac2_set_bfsize,
+	.enable_sph = dwxgmac2_enable_sph,
+	.enable_tbs = dwxgmac2_enable_tbs,
+};
+
+const struct stmmac_dma_ops dw25gmac400_dma_ops = {
+	.reset = dwxgmac2_dma_reset,
+	.init = dw25gmac_dma_init,
+	.init_chan = dwxgmac2_dma_init_chan,
+	.init_rx_chan = dw25gmac_dma_init_rx_chan,
+	.init_tx_chan = dw25gmac_dma_init_tx_chan,
+	.map_tx_offline_chan = dw25gmac_dma_map_tx_offline_chan,
+	.map_rx_offline_chan = dw25gmac_dma_map_rx_offline_chan,
+	.desc_cache_compute = dw25gmac_desc_cache_compute,
+	.axi = dwxgmac2_dma_axi,
+	.dump_regs = dwxgmac2_dma_dump_regs,
+	.dma_rx_mode = dwxgmac2_dma_rx_mode,
+	.dma_tx_mode = dwxgmac2_dma_tx_mode,
+	.enable_dma_irq = dwxgmac2_enable_dma_irq,
+	.disable_dma_irq = dwxgmac2_disable_dma_irq,
+	.start_tx = dwxgmac2_dma_start_tx,
+	.stop_tx = dwxgmac2_dma_stop_tx,
+	.start_rx = dwxgmac2_dma_start_rx,
+	.stop_rx = dwxgmac2_dma_stop_rx,
+	.dma_interrupt = dwxgmac2_dma_interrupt,
+	.get_hw_feature = dw25gmac_get_hw_feature,
+	.rx_watchdog = dwxgmac2_rx_watchdog,
+	.set_rx_ring_len = dwxgmac2_set_rx_ring_len,
+	.set_tx_ring_len = dwxgmac2_set_tx_ring_len,
 	.set_rx_tail_ptr = dwxgmac2_set_rx_tail_ptr,
 	.set_tx_tail_ptr = dwxgmac2_set_tx_tail_ptr,
 	.enable_tso = dwxgmac2_enable_tso,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/hwif.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/hwif.c
@@ -278,11 +278,31 @@
 		.est = &dwmac510_est_ops,
 		.setup = dwxlgmac2_setup,
 		.quirks = stmmac_dwxlgmac_quirks,
+	}, {
+		.gmac = false,
+		.gmac4 = false,
+		.xgmac = true,
+		.min_id = DW25GMAC_CORE_4_00,
+		.dev_id = DW25GMAC_ID,
+		.regs = {
+			.ptp_off = PTP_XGMAC_OFFSET,
+			.mmc_off = MMC_XGMAC_OFFSET,
+		},
+		.desc = &dwxgmac210_desc_ops,
+		.dma = &dw25gmac400_dma_ops,
+		.mac = &dwxgmac210_ops,
+		.hwtimestamp = &stmmac_ptp,
+		.mode = NULL,
+		.tc = &dwmac510_tc_ops,
+		.mmc = &dwxgmac_mmc_ops,
+		.setup = dw25gmac_setup,
+		.quirks = NULL,
 	},
 };
 
 int stmmac_hwif_init(struct stmmac_priv *priv)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	bool needs_xgmac = priv->plat->has_xgmac;
 	bool needs_gmac4 = priv->plat->has_gmac4;
 	bool needs_gmac = priv->plat->has_gmac;
@@ -292,7 +312,10 @@
 	u32 id, dev_id = 0;
 	int i, ret;
 
-	if (needs_gmac) {
+	if (priv->plat->snps_id && priv->plat->dev_id) {
+		id = priv->plat->snps_id;
+		dev_id = priv->plat->dev_id;
+	} else if (needs_gmac) {
 		id = stmmac_get_id(priv, GMAC_VERSION);
 	} else if (needs_gmac4 || needs_xgmac) {
 		id = stmmac_get_id(priv, GMAC4_VERSION);
@@ -353,7 +376,8 @@
 		mac->est = mac->est ? : entry->est;
 
 		priv->hw = mac;
-		priv->ptpaddr = priv->ioaddr + entry->regs.ptp_off;
+		priv->ptpaddr = priv->ioaddr +
+			(dwxgmac_addrs ? dwxgmac_addrs->timestamp_base : entry->regs.ptp_off);
 		priv->mmcaddr = priv->ioaddr + entry->regs.mmc_off;
 		if (entry->est)
 			priv->estaddr = priv->ioaddr + entry->regs.est_off;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -101,6 +101,7 @@
 			     u32 inner_type);
 	void (*set_vlan)(struct dma_desc *p, u32 type);
 	void (*set_tbs)(struct dma_edesc *p, u32 sec, u32 nsec);
+	void (*set_hw_ts)(struct dma_desc *p, u32 pid);
 };
 
 #define stmmac_init_rx_desc(__priv, __args...) \
@@ -167,6 +168,8 @@
 	stmmac_do_void_callback(__priv, desc, set_vlan, __args)
 #define stmmac_set_desc_tbs(__priv, __args...) \
 	stmmac_do_void_callback(__priv, desc, set_tbs, __args)
+#define stmmac_set_desc_hw_ts(__priv, __args...) \
+	stmmac_do_void_callback(__priv, desc, set_hw_ts, __args)
 
 struct stmmac_dma_cfg;
 struct dma_features;
@@ -175,7 +178,7 @@
 struct stmmac_dma_ops {
 	/* DMA core initialization */
 	int (*reset)(void __iomem *ioaddr);
-	void (*init)(void __iomem *ioaddr, struct stmmac_dma_cfg *dma_cfg,
+	void (*init)(struct stmmac_priv *priv, void __iomem *ioaddr, struct stmmac_dma_cfg *dma_cfg,
 		     int atds);
 	void (*init_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
 			  struct stmmac_dma_cfg *dma_cfg, u32 chan);
@@ -185,6 +188,13 @@
 	void (*init_tx_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
 			     struct stmmac_dma_cfg *dma_cfg,
 			     dma_addr_t phy, u32 chan);
+	void (*map_rx_offline_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
+				    struct stmmac_dma_cfg *dma_cfg,
+				    u32 chan);
+	void (*map_tx_offline_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
+				    struct stmmac_dma_cfg *dma_cfg,
+				    u32 chan);
+	void (*desc_cache_compute)(void __iomem *ioaddr);
 	/* Configure the AXI Bus Mode Register */
 	void (*axi)(void __iomem *ioaddr, struct stmmac_axi *axi);
 	/* Dump DMA registers */
@@ -240,13 +250,19 @@
 };
 
 #define stmmac_dma_init(__priv, __args...) \
-	stmmac_do_void_callback(__priv, dma, init, __args)
+	stmmac_do_void_callback(__priv, dma, init, __priv, __args)
 #define stmmac_init_chan(__priv, __args...) \
 	stmmac_do_void_callback(__priv, dma, init_chan, __priv, __args)
 #define stmmac_init_rx_chan(__priv, __args...) \
 	stmmac_do_void_callback(__priv, dma, init_rx_chan, __priv, __args)
 #define stmmac_init_tx_chan(__priv, __args...) \
 	stmmac_do_void_callback(__priv, dma, init_tx_chan, __priv, __args)
+#define stmmac_map_rx_offline_chan(__priv, __args...) \
+	stmmac_do_void_callback(__priv, dma, map_rx_offline_chan, __priv, __args)
+#define stmmac_map_tx_offline_chan(__priv, __args...) \
+	stmmac_do_void_callback(__priv, dma, map_tx_offline_chan, __priv, __args)
+#define stmmac_desc_cache_compute(__priv, __args...) \
+	stmmac_do_void_callback(__priv, dma, desc_cache_compute, __args)
 #define stmmac_axi(__priv, __args...) \
 	stmmac_do_void_callback(__priv, dma, axi, __args)
 #define stmmac_dump_dma_regs(__priv, __args...) \
@@ -326,7 +342,8 @@
 	/* Program RX Algorithms */
 	void (*prog_mtl_rx_algorithms)(struct mac_device_info *hw, u32 rx_alg);
 	/* Program TX Algorithms */
-	void (*prog_mtl_tx_algorithms)(struct mac_device_info *hw, u32 tx_alg);
+	void (*prog_mtl_tx_algorithms)(struct stmmac_priv *priv, struct mac_device_info *hw,
+				       u32 tx_alg);
 	/* Set MTL TX queues weight */
 	void (*set_mtl_tx_queue_weight)(struct stmmac_priv *priv,
 					struct mac_device_info *hw,
@@ -338,7 +355,9 @@
 			   u32 send_slope, u32 idle_slope, u32 high_credit,
 			   u32 low_credit, u32 queue);
 	/* Dump MAC registers */
-	void (*dump_regs)(struct mac_device_info *hw, u32 *reg_space);
+	void (*dump_regs)(struct stmmac_priv *priv,
+			  struct mac_device_info *hw,
+			  u32 *reg_space);
 	/* Handle extra events on specific interrupts hw dependent */
 	int (*host_irq_status)(struct mac_device_info *hw,
 			       struct stmmac_extra_stats *x);
@@ -384,7 +403,7 @@
 	int (*rxp_config)(void __iomem *ioaddr, struct stmmac_tc_entry *entries,
 			  unsigned int count);
 	/* Flexible PPS */
-	int (*flex_pps_config)(void __iomem *ioaddr, int index,
+	int (*flex_pps_config)(struct stmmac_priv *priv, void __iomem *ioaddr, int index,
 			       struct stmmac_pps_cfg *cfg, bool enable,
 			       u32 sub_second_inc, u32 systime_flags);
 	/* Loopback for selftests */
@@ -394,7 +413,7 @@
 			     struct stmmac_rss *cfg, u32 num_rxq);
 	/* VLAN */
 	void (*update_vlan_hash)(struct mac_device_info *hw, u32 hash,
-				 __le16 perfect_match, bool is_double);
+				 u16 perfect_match, bool is_double);
 	void (*enable_vlan)(struct mac_device_info *hw, u32 type);
 	void (*rx_hw_vlan)(struct mac_device_info *hw, struct dma_desc *rx_desc,
 			   struct sk_buff *skb);
@@ -408,7 +427,7 @@
 	void (*restore_hw_vlan_rx_fltr)(struct net_device *dev,
 					struct mac_device_info *hw);
 	/* TX Timestamp */
-	int (*get_mac_tx_timestamp)(struct mac_device_info *hw, u64 *ts);
+	int (*get_mac_tx_timestamp)(struct stmmac_priv *priv, struct mac_device_info *hw, u64 *ts);
 	/* Source Address Insertion / Replacement */
 	void (*sarc_configure)(void __iomem *ioaddr, int val);
 	/* Filtering */
@@ -447,7 +466,7 @@
 #define stmmac_prog_mtl_rx_algorithms(__priv, __args...) \
 	stmmac_do_void_callback(__priv, mac, prog_mtl_rx_algorithms, __args)
 #define stmmac_prog_mtl_tx_algorithms(__priv, __args...) \
-	stmmac_do_void_callback(__priv, mac, prog_mtl_tx_algorithms, __args)
+	stmmac_do_void_callback(__priv, mac, prog_mtl_tx_algorithms, __priv, __args)
 #define stmmac_set_mtl_tx_queue_weight(__priv, __args...) \
 	stmmac_do_void_callback(__priv, mac, set_mtl_tx_queue_weight, __priv, __args)
 #define stmmac_map_mtl_to_dma(__priv, __args...) \
@@ -455,7 +474,7 @@
 #define stmmac_config_cbs(__priv, __args...) \
 	stmmac_do_void_callback(__priv, mac, config_cbs, __priv, __args)
 #define stmmac_dump_mac_regs(__priv, __args...) \
-	stmmac_do_void_callback(__priv, mac, dump_regs, __args)
+	stmmac_do_void_callback(__priv, mac, dump_regs, __priv, __args)
 #define stmmac_host_irq_status(__priv, __args...) \
 	stmmac_do_callback(__priv, mac, host_irq_status, __args)
 #define stmmac_host_mtl_irq_status(__priv, __args...) \
@@ -497,7 +516,7 @@
 #define stmmac_rxp_config(__priv, __args...) \
 	stmmac_do_callback(__priv, mac, rxp_config, __args)
 #define stmmac_flex_pps_config(__priv, __args...) \
-	stmmac_do_callback(__priv, mac, flex_pps_config, __args)
+	stmmac_do_callback(__priv, mac, flex_pps_config, __priv, __args)
 #define stmmac_set_mac_loopback(__priv, __args...) \
 	stmmac_do_void_callback(__priv, mac, set_mac_loopback, __args)
 #define stmmac_rss_configure(__priv, __args...) \
@@ -517,7 +536,7 @@
 #define stmmac_restore_hw_vlan_rx_fltr(__priv, __args...) \
 	stmmac_do_void_callback(__priv, mac, restore_hw_vlan_rx_fltr, __args)
 #define stmmac_get_mac_tx_timestamp(__priv, __args...) \
-	stmmac_do_callback(__priv, mac, get_mac_tx_timestamp, __args)
+	stmmac_do_callback(__priv, mac, get_mac_tx_timestamp, __priv, __args)
 #define stmmac_sarc_configure(__priv, __args...) \
 	stmmac_do_void_callback(__priv, mac, sarc_configure, __args)
 #define stmmac_config_l3_filter(__priv, __args...) \
@@ -686,6 +705,7 @@
 extern const struct stmmac_mmc_ops dwmac_mmc_ops;
 extern const struct stmmac_mmc_ops dwxgmac_mmc_ops;
 extern const struct stmmac_est_ops dwmac510_est_ops;
+extern const struct stmmac_dma_ops dw25gmac400_dma_ops;
 
 #define GMAC_VERSION		0x00000020	/* GMAC CORE Version */
 #define GMAC4_VERSION		0x00000110	/* GMAC4+ CORE Version */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -31,6 +31,7 @@
 	int wol_irq;
 	int lpi_irq;
 	int irq;
+	int sfty_irq;
 	int sfty_ce_irq;
 	int sfty_ue_irq;
 	int rx_irq[MTL_MAX_RX_QUEUES];
@@ -79,6 +80,7 @@
 	dma_addr_t dma_tx_phy;
 	dma_addr_t tx_tail_addr;
 	u32 mss;
+	u32 pid;
 };
 
 struct stmmac_rx_buffer {
@@ -260,6 +262,8 @@
 	struct stmmac_extra_stats xstats ____cacheline_aligned_in_smp;
 	struct stmmac_safety_stats sstats;
 	struct plat_stmmacenet_data *plat;
+	/* Protect est parameters */
+	struct mutex est_lock;
 	struct dma_features dma_cap;
 	struct stmmac_counters mmc;
 	int hw_cap_support;
@@ -298,6 +302,7 @@
 	void __iomem *ptpaddr;
 	void __iomem *estaddr;
 	unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
+	int sfty_irq;
 	int sfty_ce_irq;
 	int sfty_ue_irq;
 	int rx_irq[MTL_MAX_RX_QUEUES];
@@ -306,6 +311,7 @@
 	char int_name_mac[IFNAMSIZ + 9];
 	char int_name_wol[IFNAMSIZ + 9];
 	char int_name_lpi[IFNAMSIZ + 9];
+	char int_name_sfty[IFNAMSIZ + 10];
 	char int_name_sfty_ce[IFNAMSIZ + 10];
 	char int_name_sfty_ue[IFNAMSIZ + 10];
 	char int_name_rx_irq[MTL_MAX_TX_QUEUES][IFNAMSIZ + 14];
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
@@ -81,6 +81,7 @@
 	u32 status, value, feqn, hbfq, hbfs, btrl, btrl_max;
 	void __iomem *est_addr = priv->estaddr;
 	u32 txqcnt_mask = BIT(txqcnt) - 1;
+	int i;
 
 	status = readl(est_addr + EST_STATUS);
 
@@ -125,6 +126,11 @@
 
 		x->mtl_est_hlbf++;
 
+		for (i = 0; i < txqcnt; i++) {
+			if (feqn & BIT(i))
+				x->mtl_est_txq_hlbf[i]++;
+		}
+
 		/* Clear Interrupt */
 		writel(feqn, est_addr + EST_FRM_SZ_ERR);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -448,9 +448,10 @@
 static int stmmac_ethtool_get_regs_len(struct net_device *dev)
 {
 	struct stmmac_priv *priv = netdev_priv(dev);
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 
 	if (priv->plat->has_xgmac)
-		return XGMAC_REGSIZE * 4;
+		return XGMAC_REGSIZE(dwxgmac_addrs) * 4;
 	else if (priv->plat->has_gmac4)
 		return GMAC4_REG_SPACE_SIZE;
 	return REG_SPACE_SIZE;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
@@ -218,6 +218,7 @@
 {
 	u32 num_snapshot, ts_status, tsync_int;
 	struct ptp_clock_event event;
+	u32 acr_value, channel;
 	unsigned long flags;
 	u64 ptp_time;
 	int i;
@@ -243,12 +244,15 @@
 	num_snapshot = (ts_status & GMAC_TIMESTAMP_ATSNS_MASK) >>
 		       GMAC_TIMESTAMP_ATSNS_SHIFT;
 
+	acr_value = readl(priv->ptpaddr + PTP_ACR);
+	channel = ilog2(FIELD_GET(PTP_ACR_MASK, acr_value));
+
 	for (i = 0; i < num_snapshot; i++) {
 		read_lock_irqsave(&priv->ptp_lock, flags);
 		get_ptptime(priv->ptpaddr, &ptp_time);
 		read_unlock_irqrestore(&priv->ptp_lock, flags);
 		event.type = PTP_CLOCK_EXTTS;
-		event.index = 0;
+		event.index = channel;
 		event.timestamp = ptp_time;
 		ptp_clock_event(priv->ptp_clock, &event);
 	}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -536,8 +536,11 @@
 static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
 				   struct dma_desc *p, struct sk_buff *skb)
 {
+	const struct dwxgmac_addrs *dwxgmac_addrs = priv->plat->dwxgmac_addrs;
 	struct skb_shared_hwtstamps shhwtstamp;
+	void __iomem *ioaddr = priv->hw->pcsr;
 	bool found = false;
+	u32 pktid;
 	u64 ns = 0;
 
 	if (!priv->hwts_tx_en)
@@ -547,6 +550,9 @@
 	if (likely(!skb || !(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)))
 		return;
 
+	if (priv->plat->insert_ts_pktid)
+		pktid = readl(ioaddr + XGMAC_TXTIMESTAMP_STATUS_PKTID(dwxgmac_addrs));
+
 	/* check tx tstamp status */
 	if (stmmac_get_tx_timestamp_status(priv, p)) {
 		stmmac_get_timestamp(priv, p, priv->adv_ts, &ns);
@@ -947,6 +953,9 @@
 	if (priv->hw->lynx_pcs)
 		return priv->hw->lynx_pcs;
 
+	if (priv->plat->qcom_pcs)
+		return priv->plat->qcom_pcs;
+
 	return NULL;
 }
 
@@ -1014,6 +1023,15 @@
 		case SPEED_2500:
 			ctrl |= priv->hw->link.xgmii.speed2500;
 			break;
+		case SPEED_1000:
+			ctrl |= priv->hw->link.speed1000;
+			break;
+		case SPEED_100:
+			ctrl |= priv->hw->link.speed100;
+			break;
+		case SPEED_10:
+			ctrl |= priv->hw->link.speed10;
+			break;
 		default:
 			return;
 		}
@@ -1043,6 +1061,34 @@
 		default:
 			return;
 		}
+	} else if (interface == PHY_INTERFACE_MODE_10GBASER) {
+		switch (speed) {
+		case SPEED_10000:
+			ctrl |= priv->hw->link.xgmii.speed10000;
+			break;
+		default:
+			return;
+		}
+	} else if (interface == PHY_INTERFACE_MODE_5GBASER) {
+		switch (speed) {
+		case SPEED_5000:
+			ctrl |= priv->hw->link.xgmii.speed5000;
+			break;
+		case SPEED_2500:
+			ctrl |= priv->hw->link.xgmii.speed2500;
+			break;
+		case SPEED_1000:
+			ctrl |= priv->hw->link.speed1000;
+			break;
+		case SPEED_100:
+			ctrl |= priv->hw->link.speed100;
+			break;
+		case SPEED_10:
+			ctrl |= priv->hw->link.speed10;
+			break;
+		default:
+			return;
+		}
 	} else {
 		switch (speed) {
 		case SPEED_2500:
@@ -1198,17 +1244,6 @@
 	return ret;
 }
 
-static void stmmac_set_half_duplex(struct stmmac_priv *priv)
-{
-	/* Half-Duplex can only work with single tx queue */
-	if (priv->plat->tx_queues_to_use > 1)
-		priv->phylink_config.mac_capabilities &=
-			~(MAC_10HD | MAC_100HD | MAC_1000HD);
-	else
-		priv->phylink_config.mac_capabilities |=
-			(MAC_10HD | MAC_100HD | MAC_1000HD);
-}
-
 static int stmmac_phy_setup(struct stmmac_priv *priv)
 {
 	struct stmmac_mdio_bus_data *mdio_bus_data;
@@ -1236,15 +1271,11 @@
 		xpcs_get_interfaces(priv->hw->xpcs,
 				    priv->phylink_config.supported_interfaces);
 
-	priv->phylink_config.mac_capabilities = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
-						MAC_10FD | MAC_100FD |
-						MAC_1000FD;
-
-	stmmac_set_half_duplex(priv);
-
 	/* Get the MAC specific capabilities */
 	stmmac_mac_phylink_get_caps(priv);
 
+	priv->phylink_config.mac_capabilities = priv->hw->link.caps;
+
 	max_speed = priv->plat->max_speed;
 	if (max_speed)
 		phylink_limit_mac_speed(&priv->phylink_config, max_speed);
@@ -2506,6 +2537,13 @@
 		if (!xsk_tx_peek_desc(pool, &xdp_desc))
 			break;
 
+		if (priv->plat->est && priv->plat->est->enable &&
+		    priv->plat->est->max_sdu[queue] &&
+		    xdp_desc.len > priv->plat->est->max_sdu[queue]) {
+			priv->xstats.max_sdu_txq_drop[queue]++;
+			continue;
+		}
+
 		if (likely(priv->extend_desc))
 			tx_desc = (struct dma_desc *)(tx_q->dma_etx + entry);
 		else if (tx_q->tbs & STMMAC_TBS_AVAIL)
@@ -3001,9 +3039,11 @@
  */
 static int stmmac_init_dma_engine(struct stmmac_priv *priv)
 {
-	u32 rx_channels_count = priv->plat->rx_queues_to_use;
-	u32 tx_channels_count = priv->plat->tx_queues_to_use;
-	u32 dma_csr_ch = max(rx_channels_count, tx_channels_count);
+	u32 rx_channels_enabled = priv->plat->rx_queues_to_use;
+	u32 tx_channels_enabled = priv->plat->tx_queues_to_use;
+	u32 rx_channels_supported = priv->dma_cap.number_rx_channel;
+	u32 tx_channels_supported = priv->dma_cap.number_tx_channel;
+	u32 dma_csr_ch = max(rx_channels_enabled, tx_channels_enabled);
 	struct stmmac_rx_queue *rx_q;
 	struct stmmac_tx_queue *tx_q;
 	u32 chan = 0;
@@ -3037,7 +3077,7 @@
 	}
 
 	/* DMA RX Channel Configuration */
-	for (chan = 0; chan < rx_channels_count; chan++) {
+	for (chan = 0; chan < rx_channels_enabled; chan++) {
 		rx_q = &priv->dma_conf.rx_queue[chan];
 
 		stmmac_init_rx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
@@ -3051,7 +3091,7 @@
 	}
 
 	/* DMA TX Channel Configuration */
-	for (chan = 0; chan < tx_channels_count; chan++) {
+	for (chan = 0; chan < tx_channels_enabled ; chan++) {
 		tx_q = &priv->dma_conf.tx_queue[chan];
 
 		stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
@@ -3062,6 +3102,18 @@
 				       tx_q->tx_tail_addr, chan);
 	}
 
+	if (priv->plat->has_hdma) {
+		/* DMA RX Mapping Configuration for offline channels */
+		for (chan = rx_channels_enabled; chan < rx_channels_supported; chan++)
+			stmmac_map_rx_offline_chan(priv, priv->ioaddr, priv->plat->dma_cfg, chan);
+
+		/* DMA TX Mapping Configuration for offline channels */
+		for (chan = tx_channels_enabled; chan < tx_channels_supported; chan++)
+			stmmac_map_tx_offline_chan(priv, priv->ioaddr, priv->plat->dma_cfg, chan);
+
+		stmmac_desc_cache_compute(priv, priv->ioaddr);
+	}
+
 	return ret;
 }
 
@@ -3591,6 +3643,10 @@
 		if (priv->wol_irq > 0 && priv->wol_irq != dev->irq)
 			free_irq(priv->wol_irq, dev);
 		fallthrough;
+	case REQ_IRQ_ERR_SFTY:
+		if (priv->sfty_irq > 0 && priv->sfty_irq != dev->irq)
+			free_irq(priv->sfty_irq, dev);
+		fallthrough;
 	case REQ_IRQ_ERR_WOL:
 		free_irq(dev->irq, dev);
 		fallthrough;
@@ -3661,6 +3717,23 @@
 		}
 	}
 
+	/* Request the common Safety Feature Correctible/Uncorrectible
+	 * Error line in case of another line is used
+	 */
+	if (priv->sfty_irq > 0 && priv->sfty_irq != dev->irq) {
+		int_name = priv->int_name_sfty;
+		sprintf(int_name, "%s:%s", dev->name, "safety");
+		ret = request_irq(priv->sfty_irq, stmmac_safety_interrupt,
+				  0, int_name, dev);
+		if (unlikely(ret < 0)) {
+			netdev_err(priv->dev,
+				   "%s: alloc sfty MSI %d (error: %d)\n",
+				   __func__, priv->sfty_irq, ret);
+			irq_err = REQ_IRQ_ERR_SFTY;
+			goto irq_error;
+		}
+	}
+
 	/* Request the Safety Feature Correctible Error line in
 	 * case of another line is used
 	 */
@@ -3773,6 +3846,7 @@
 	/* Request the Wake IRQ in case of another line
 	 * is used for WoL
 	 */
+	priv->wol_irq_disabled = true;
 	if (priv->wol_irq > 0 && priv->wol_irq != dev->irq) {
 		ret = request_irq(priv->wol_irq, stmmac_interrupt,
 				  IRQF_SHARED, dev->name, dev);
@@ -3798,6 +3872,21 @@
 		}
 	}
 
+	/* Request the common Safety Feature Correctible/Uncorrectible
+	 * Error line in case of another line is used
+	 */
+	if (priv->sfty_irq > 0 && priv->sfty_irq != dev->irq) {
+		ret = request_irq(priv->sfty_irq, stmmac_safety_interrupt,
+				  IRQF_SHARED, dev->name, dev);
+		if (unlikely(ret < 0)) {
+			netdev_err(priv->dev,
+				   "%s: ERROR: allocating the sfty IRQ %d (%d)\n",
+				   __func__, priv->sfty_irq, ret);
+			irq_err = REQ_IRQ_ERR_SFTY;
+			goto irq_error;
+		}
+	}
+
 	return 0;
 
 irq_error:
@@ -4206,18 +4295,32 @@
 {
 	struct dma_desc *desc, *first, *mss_desc = NULL;
 	struct stmmac_priv *priv = netdev_priv(dev);
-	int nfrags = skb_shinfo(skb)->nr_frags;
-	u32 queue = skb_get_queue_mapping(skb);
+	int tmp_pay_len = 0, first_tx, nfrags;
 	unsigned int first_entry, tx_packets;
 	struct stmmac_txq_stats *txq_stats;
-	int tmp_pay_len = 0, first_tx;
 	struct stmmac_tx_queue *tx_q;
-	bool has_vlan, set_ic;
+	u32 pay_len, mss, queue;
+	dma_addr_t tso_des, des;
 	u8 proto_hdr_len, hdr;
-	u32 pay_len, mss;
-	dma_addr_t des;
+	bool set_ic;
 	int i;
 
+	/* Always insert VLAN tag to SKB payload for TSO frames.
+	 *
+	 * Never insert VLAN tag by HW, since segments splited by
+	 * TSO engine will be un-tagged by mistake.
+	 */
+	if (skb_vlan_tag_present(skb)) {
+		skb = __vlan_hwaccel_push_inside(skb);
+		if (unlikely(!skb)) {
+			priv->xstats.tx_dropped++;
+			return NETDEV_TX_OK;
+		}
+	}
+
+	nfrags = skb_shinfo(skb)->nr_frags;
+	queue = skb_get_queue_mapping(skb);
+
 	tx_q = &priv->dma_conf.tx_queue[queue];
 	txq_stats = &priv->xstats.txq_stats[queue];
 	first_tx = tx_q->cur_tx;
@@ -4270,9 +4373,6 @@
 			skb->data_len);
 	}
 
-	/* Check if VLAN can be inserted by HW */
-	has_vlan = stmmac_vlan_insert(priv, skb, tx_q);
-
 	first_entry = tx_q->cur_tx;
 	WARN_ON(tx_q->tx_skbuff[first_entry]);
 
@@ -4282,20 +4382,12 @@
 		desc = &tx_q->dma_tx[first_entry];
 	first = desc;
 
-	if (has_vlan)
-		stmmac_set_desc_vlan(priv, first, STMMAC_VLAN_INSERT);
-
 	/* first descriptor: fill Headers on Buf1 */
 	des = dma_map_single(priv->device, skb->data, skb_headlen(skb),
 			     DMA_TO_DEVICE);
 	if (dma_mapping_error(priv->device, des))
 		goto dma_map_err;
 
-	tx_q->tx_skbuff_dma[first_entry].buf = des;
-	tx_q->tx_skbuff_dma[first_entry].len = skb_headlen(skb);
-	tx_q->tx_skbuff_dma[first_entry].map_as_page = false;
-	tx_q->tx_skbuff_dma[first_entry].buf_type = STMMAC_TXBUF_T_SKB;
-
 	if (priv->dma_cap.addr64 <= 32) {
 		first->des0 = cpu_to_le32(des);
 
@@ -4305,14 +4397,32 @@
 
 		/* If needed take extra descriptors to fill the remaining payload */
 		tmp_pay_len = pay_len - TSO_MAX_BUFF_SIZE;
+		tso_des = des;
 	} else {
 		stmmac_set_desc_addr(priv, first, des);
 		tmp_pay_len = pay_len;
-		des += proto_hdr_len;
+		tso_des = des + proto_hdr_len;
 		pay_len = 0;
 	}
 
-	stmmac_tso_allocator(priv, des, tmp_pay_len, (nfrags == 0), queue);
+	stmmac_tso_allocator(priv, tso_des, tmp_pay_len, (nfrags == 0), queue);
+
+	/* In case two or more DMA transmit descriptors are allocated for this
+	 * non-paged SKB data, the DMA buffer address should be saved to
+	 * tx_q->tx_skbuff_dma[].buf corresponding to the last descriptor,
+	 * and leave the other tx_q->tx_skbuff_dma[].buf as NULL to guarantee
+	 * that stmmac_tx_clean() does not unmap the entire DMA buffer too early
+	 * since the tail areas of the DMA buffer can be accessed by DMA engine
+	 * sooner or later.
+	 * By saving the DMA buffer address to tx_q->tx_skbuff_dma[].buf
+	 * corresponding to the last descriptor, stmmac_tx_clean() will unmap
+	 * this DMA buffer right after the DMA engine completely finishes the
+	 * full buffer transmission.
+	 */
+	tx_q->tx_skbuff_dma[tx_q->cur_tx].buf = des;
+	tx_q->tx_skbuff_dma[tx_q->cur_tx].len = skb_headlen(skb);
+	tx_q->tx_skbuff_dma[tx_q->cur_tx].map_as_page = false;
+	tx_q->tx_skbuff_dma[tx_q->cur_tx].buf_type = STMMAC_TXBUF_T_SKB;
 
 	/* Prepare fragments */
 	for (i = 0; i < nfrags; i++) {
@@ -4460,6 +4570,34 @@
 		(proto == htons(ETH_P_IP) || proto == htons(ETH_P_IPV6));
 }
 
+#define STMMAC_MAX_PID 1023
+
+static void stmmac_hw_ts_insert(struct stmmac_priv *priv, struct stmmac_tx_queue *tx_q)
+{
+	struct dma_desc *p;
+
+	if (!priv->plat->insert_ts_pktid)
+		return;
+
+	if (priv->extend_desc)
+		p = &tx_q->dma_etx[tx_q->cur_tx].basic;
+	else if (tx_q->tbs & STMMAC_TBS_AVAIL)
+		p = &tx_q->dma_entx[tx_q->cur_tx].basic;
+	else
+		p = &tx_q->dma_tx[tx_q->cur_tx];
+
+	tx_q->pid = (tx_q->pid + 1) % STMMAC_MAX_PID;
+
+	/*this condition will be hit when 1023%1023 is 0*/
+	if (tx_q->pid == 0)
+		tx_q->pid = 1;
+
+	stmmac_set_desc_hw_ts(priv, p, tx_q->pid);
+	stmmac_set_tx_owner(priv, p);
+
+	tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, priv->dma_conf.dma_tx_size);
+}
+
 /**
  *  stmmac_xmit - Tx entry point of the driver
  *  @skb : the socket buffer
@@ -4500,6 +4638,13 @@
 			return stmmac_tso_xmit(skb, dev);
 	}
 
+	if (priv->plat->est && priv->plat->est->enable &&
+	    priv->plat->est->max_sdu[queue] &&
+	    skb->len > priv->plat->est->max_sdu[queue]){
+		priv->xstats.max_sdu_txq_drop[queue]++;
+		goto max_sdu_err;
+	}
+
 	if (unlikely(stmmac_tx_avail(priv, queue) < nfrags + 1)) {
 		if (!netif_tx_queue_stopped(netdev_get_tx_queue(dev, queue))) {
 			netif_tx_stop_queue(netdev_get_tx_queue(priv->dev,
@@ -4512,6 +4657,11 @@
 		return NETDEV_TX_BUSY;
 	}
 
+	/* Check if HW TS can be inserted by HW */
+	if (unlikely((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+		     priv->hwts_tx_en))
+		stmmac_hw_ts_insert(priv, tx_q);
+
 	/* Check if VLAN can be inserted by HW */
 	has_vlan = stmmac_vlan_insert(priv, skb, tx_q);
 
@@ -4717,6 +4867,7 @@
 
 dma_map_err:
 	netdev_err(priv->dev, "Tx DMA map failed\n");
+max_sdu_err:
 	dev_kfree_skb(skb);
 	priv->xstats.tx_dropped++;
 	return NETDEV_TX_OK;
@@ -4873,6 +5024,13 @@
 	if (stmmac_tx_avail(priv, queue) < STMMAC_TX_THRESH(priv))
 		return STMMAC_XDP_CONSUMED;
 
+	if (priv->plat->est && priv->plat->est->enable &&
+	    priv->plat->est->max_sdu[queue] &&
+	    xdpf->len > priv->plat->est->max_sdu[queue]) {
+		priv->xstats.max_sdu_txq_drop[queue]++;
+		return STMMAC_XDP_CONSUMED;
+	}
+
 	if (likely(priv->extend_desc))
 		tx_desc = (struct dma_desc *)(tx_q->dma_etx + entry);
 	else if (tx_q->tbs & STMMAC_TBS_AVAIL)
@@ -6044,8 +6202,8 @@
 	if (test_bit(STMMAC_DOWN, &priv->state))
 		return IRQ_HANDLED;
 
-	/* Check if a fatal error happened */
-	if (stmmac_safety_feat_interrupt(priv))
+	/* Check ASP error if it isn't delivered via an individual IRQ */
+	if (priv->sfty_irq <= 0 && stmmac_safety_feat_interrupt(priv))
 		return IRQ_HANDLED;
 
 	/* To handle Common interrupts */
@@ -6590,7 +6748,7 @@
 static int stmmac_vlan_update(struct stmmac_priv *priv, bool is_double)
 {
 	u32 crc, hash = 0;
-	__le16 pmatch = 0;
+	u16 pmatch = 0;
 	int count = 0;
 	u16 vid = 0;
 
@@ -6605,7 +6763,7 @@
 		if (count > 2) /* VID = 0 always passes filter */
 			return -EOPNOTSUPP;
 
-		pmatch = cpu_to_le16(vid);
+		pmatch = vid;
 		hash = 0;
 	}
 
@@ -7286,6 +7444,7 @@
 {
 	struct stmmac_priv *priv = netdev_priv(dev);
 	int ret = 0, i;
+	int max_speed;
 
 	if (netif_running(dev))
 		stmmac_release(dev);
@@ -7299,7 +7458,14 @@
 			priv->rss.table[i] = ethtool_rxfh_indir_default(i,
 									rx_cnt);
 
-	stmmac_set_half_duplex(priv);
+	stmmac_mac_phylink_get_caps(priv);
+
+	priv->phylink_config.mac_capabilities = priv->hw->link.caps;
+
+	max_speed = priv->plat->max_speed;
+	if (max_speed)
+		phylink_limit_mac_speed(&priv->phylink_config, max_speed);
+
 	stmmac_napi_add(dev);
 
 	if (netif_running(dev))
@@ -7474,6 +7640,7 @@
 	priv->dev->irq = res->irq;
 	priv->wol_irq = res->wol_irq;
 	priv->lpi_irq = res->lpi_irq;
+	priv->sfty_irq = res->sfty_irq;
 	priv->sfty_ce_irq = res->sfty_ce_irq;
 	priv->sfty_ue_irq = res->sfty_ue_irq;
 	for (i = 0; i < MTL_MAX_RX_QUEUES; i++)
@@ -7612,9 +7779,10 @@
 #ifdef STMMAC_VLAN_TAG_USED
 	/* Both mac100 and gmac support receive VLAN tag detection */
 	ndev->features |= NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_STAG_RX;
-	ndev->hw_features |= NETIF_F_HW_VLAN_CTAG_RX;
-	priv->hw->hw_vlan_en = true;
-
+	if (priv->plat->has_gmac4) {
+		ndev->hw_features |= NETIF_F_HW_VLAN_CTAG_RX;
+		priv->hw->hw_vlan_en = true;
+	}
 	if (priv->dma_cap.vlhash) {
 		ndev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
 		ndev->features |= NETIF_F_HW_VLAN_STAG_FILTER;
@@ -7639,8 +7807,6 @@
 		ndev->features |= NETIF_F_RXHASH;
 
 	ndev->vlan_features |= ndev->features;
-	/* TSO doesn't work on VLANs yet */
-	ndev->vlan_features &= ~NETIF_F_TSO;
 
 	/* MTU range: 46 - hw-specific max */
 	ndev->min_mtu = ETH_ZLEN - ETH_HLEN;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/stmmac_pcs.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/stmmac_pcs.h
@@ -110,6 +110,8 @@
 	/* Enable and restart the Auto-Negotiation */
 	if (ane)
 		value |= GMAC_AN_CTRL_ANE | GMAC_AN_CTRL_RAN;
+	else
+		value &= ~GMAC_AN_CTRL_ANE;
 
 	/* In case of MAC-2-MAC connection, block is configured to operate
 	 * according to MAC conf register.
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -406,22 +406,6 @@
 }
 
 /**
- * stmmac_remove_config_dt - undo the effects of stmmac_probe_config_dt()
- * @pdev: platform_device structure
- * @plat: driver data platform structure
- *
- * Release resources claimed by stmmac_probe_config_dt().
- */
-static void stmmac_remove_config_dt(struct platform_device *pdev,
-				    struct plat_stmmacenet_data *plat)
-{
-	clk_disable_unprepare(plat->stmmac_clk);
-	clk_disable_unprepare(plat->pclk);
-	of_node_put(plat->phy_node);
-	of_node_put(plat->mdio_node);
-}
-
-/**
  * stmmac_probe_config_dt - parse device-tree driver parameters
  * @pdev: platform_device structure
  * @mac: MAC address to use
@@ -490,8 +474,10 @@
 		dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n");
 
 	rc = stmmac_mdio_setup(plat, np, &pdev->dev);
-	if (rc)
-		return ERR_PTR(rc);
+	if (rc) {
+		ret = ERR_PTR(rc);
+		goto error_put_phy;
+	}
 
 	of_property_read_u32(np, "tx-fifo-depth", &plat->tx_fifo_size);
 
@@ -580,8 +566,8 @@
 	dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg),
 			       GFP_KERNEL);
 	if (!dma_cfg) {
-		stmmac_remove_config_dt(pdev, plat);
-		return ERR_PTR(-ENOMEM);
+		ret = ERR_PTR(-ENOMEM);
+		goto error_put_mdio;
 	}
 	plat->dma_cfg = dma_cfg;
 
@@ -609,8 +595,8 @@
 
 	rc = stmmac_mtl_setup(pdev, plat);
 	if (rc) {
-		stmmac_remove_config_dt(pdev, plat);
-		return ERR_PTR(rc);
+		ret = ERR_PTR(rc);
+		goto error_put_mdio;
 	}
 
 	/* clock setup */
@@ -662,6 +648,10 @@
 	clk_disable_unprepare(plat->pclk);
 error_pclk_get:
 	clk_disable_unprepare(plat->stmmac_clk);
+error_put_mdio:
+	of_node_put(plat->mdio_node);
+error_put_phy:
+	of_node_put(plat->phy_node);
 
 	return ret;
 }
@@ -670,16 +660,17 @@
 {
 	struct plat_stmmacenet_data *plat = data;
 
-	/* Platform data argument is unused */
-	stmmac_remove_config_dt(NULL, plat);
+	clk_disable_unprepare(plat->stmmac_clk);
+	clk_disable_unprepare(plat->pclk);
+	of_node_put(plat->mdio_node);
+	of_node_put(plat->phy_node);
 }
 
 /**
  * devm_stmmac_probe_config_dt
  * @pdev: platform_device structure
  * @mac: MAC address to use
- * Description: Devres variant of stmmac_probe_config_dt(). Does not require
- * the user to call stmmac_remove_config_dt() at driver detach.
+ * Description: Devres variant of stmmac_probe_config_dt().
  */
 struct plat_stmmacenet_data *
 devm_stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac)
@@ -743,6 +734,14 @@
 		dev_info(&pdev->dev, "IRQ eth_lpi not found\n");
 	}
 
+	stmmac_res->sfty_irq =
+		platform_get_irq_byname_optional(pdev, "sfty");
+	if (stmmac_res->sfty_irq < 0) {
+		if (stmmac_res->sfty_irq == -EPROBE_DEFER)
+			return -EPROBE_DEFER;
+		dev_info(&pdev->dev, "IRQ sfty not found\n");
+	}
+
 	stmmac_res->addr = devm_platform_ioremap_resource(pdev, 0);
 
 	return PTR_ERR_OR_ZERO(stmmac_res->addr);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -70,11 +70,11 @@
 	/* If EST is enabled, disabled it before adjust ptp time. */
 	if (priv->plat->est && priv->plat->est->enable) {
 		est_rst = true;
-		mutex_lock(&priv->plat->est->lock);
+		mutex_lock(&priv->est_lock);
 		priv->plat->est->enable = false;
 		stmmac_est_configure(priv, priv, priv->plat->est,
 				     priv->plat->clk_ptp_rate);
-		mutex_unlock(&priv->plat->est->lock);
+		mutex_unlock(&priv->est_lock);
 	}
 
 	write_lock_irqsave(&priv->ptp_lock, flags);
@@ -87,7 +87,7 @@
 		ktime_t current_time_ns, basetime;
 		u64 cycle_time;
 
-		mutex_lock(&priv->plat->est->lock);
+		mutex_lock(&priv->est_lock);
 		priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, &current_time);
 		current_time_ns = timespec64_to_ktime(current_time);
 		time.tv_nsec = priv->plat->est->btr_reserve[0];
@@ -104,7 +104,7 @@
 		priv->plat->est->enable = true;
 		ret = stmmac_est_configure(priv, priv, priv->plat->est,
 					   priv->plat->clk_ptp_rate);
-		mutex_unlock(&priv->plat->est->lock);
+		mutex_unlock(&priv->est_lock);
 		if (ret)
 			netdev_err(priv->dev, "failed to configure EST\n");
 	}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -343,10 +343,11 @@
 			struct tc_cbs_qopt_offload *qopt)
 {
 	u32 tx_queues_count = priv->plat->tx_queues_to_use;
+	s64 port_transmit_rate_kbps;
 	u32 queue = qopt->queue;
-	u32 ptr, speed_div;
 	u32 mode_to_use;
 	u64 value;
+	u32 ptr;
 	int ret;
 
 	/* Queue 0 is not AVB capable */
@@ -355,30 +356,30 @@
 	if (!priv->dma_cap.av)
 		return -EOPNOTSUPP;
 
-	/* Port Transmit Rate and Speed Divider */
-	switch (priv->speed) {
-	case SPEED_10000:
-		ptr = 32;
-		speed_div = 10000000;
-		break;
-	case SPEED_5000:
-		ptr = 32;
-		speed_div = 5000000;
-		break;
-	case SPEED_2500:
-		ptr = 8;
-		speed_div = 2500000;
-		break;
-	case SPEED_1000:
-		ptr = 8;
-		speed_div = 1000000;
-		break;
-	case SPEED_100:
-		ptr = 4;
-		speed_div = 100000;
-		break;
-	default:
-		return -EOPNOTSUPP;
+	port_transmit_rate_kbps = qopt->idleslope - qopt->sendslope;
+
+	if (qopt->enable) {
+		/* Port Transmit Rate and Speed Divider */
+		switch (div_s64(port_transmit_rate_kbps, 1000)) {
+		case SPEED_10000:
+		case SPEED_5000:
+			ptr = 32;
+			break;
+		case SPEED_2500:
+		case SPEED_1000:
+			ptr = 8;
+			break;
+		case SPEED_100:
+			ptr = 4;
+			break;
+		default:
+			netdev_err(priv->dev,
+				   "Invalid portTransmitRate %lld (idleSlope - sendSlope)\n",
+				   port_transmit_rate_kbps);
+			return -EINVAL;
+		}
+	} else {
+		ptr = 0;
 	}
 
 	mode_to_use = priv->plat->tx_queues_cfg[queue].mode_to_use;
@@ -395,13 +396,14 @@
 			return ret;
 
 		priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
+		return 0;
 	}
 
 	/* Final adjustments for HW */
-	value = div_s64(qopt->idleslope * 1024ll * ptr, speed_div);
+	value = div_s64(qopt->idleslope * 1024ll * ptr, port_transmit_rate_kbps);
 	priv->plat->tx_queues_cfg[queue].idle_slope = value & GENMASK(31, 0);
 
-	value = div_s64(-qopt->sendslope * 1024ll * ptr, speed_div);
+	value = div_s64(-qopt->sendslope * 1024ll * ptr, port_transmit_rate_kbps);
 	priv->plat->tx_queues_cfg[queue].send_slope = value & GENMASK(31, 0);
 
 	value = qopt->hicredit * 1024ll * 8;
@@ -915,8 +917,30 @@
 	return time;
 }
 
-static int tc_setup_taprio(struct stmmac_priv *priv,
-			   struct tc_taprio_qopt_offload *qopt)
+static void tc_taprio_map_maxsdu_txq(struct stmmac_priv *priv,
+				     struct tc_taprio_qopt_offload *qopt)
+{
+	struct plat_stmmacenet_data *plat = priv->plat;
+	u32 num_tc = qopt->mqprio.qopt.num_tc;
+	u32 offset, count, i, j;
+
+	/* QueueMaxSDU received from the driver corresponds to the Linux traffic
+	 * class. Map queueMaxSDU per Linux traffic class to DWMAC Tx queues.
+	 */
+	for (i = 0; i < num_tc; i++) {
+		if (!qopt->max_sdu[i])
+			continue;
+
+		offset = qopt->mqprio.qopt.offset[i];
+		count = qopt->mqprio.qopt.count[i];
+
+		for (j = offset; j < offset + count; j++)
+			plat->est->max_sdu[j] = qopt->max_sdu[i] + ETH_HLEN - ETH_TLEN;
+	}
+}
+
+static int tc_taprio_configure(struct stmmac_priv *priv,
+			       struct tc_taprio_qopt_offload *qopt)
 {
 	u32 size, wid = priv->dma_cap.estwid, dep = priv->dma_cap.estdep;
 	struct plat_stmmacenet_data *plat = priv->plat;
@@ -968,8 +992,6 @@
 
 	if (qopt->cmd == TAPRIO_CMD_DESTROY)
 		goto disable;
-	else if (qopt->cmd != TAPRIO_CMD_REPLACE)
-		return -EOPNOTSUPP;
 
 	if (qopt->num_entries >= dep)
 		return -EINVAL;
@@ -984,17 +1006,19 @@
 		if (!plat->est)
 			return -ENOMEM;
 
-		mutex_init(&priv->plat->est->lock);
+		mutex_init(&priv->est_lock);
 	} else {
+		mutex_lock(&priv->est_lock);
 		memset(plat->est, 0, sizeof(*plat->est));
+		mutex_unlock(&priv->est_lock);
 	}
 
 	size = qopt->num_entries;
 
-	mutex_lock(&priv->plat->est->lock);
+	mutex_lock(&priv->est_lock);
 	priv->plat->est->gcl_size = size;
 	priv->plat->est->enable = qopt->cmd == TAPRIO_CMD_REPLACE;
-	mutex_unlock(&priv->plat->est->lock);
+	mutex_unlock(&priv->est_lock);
 
 	for (i = 0; i < size; i++) {
 		s64 delta_ns = qopt->entries[i].interval;
@@ -1025,7 +1049,7 @@
 		priv->plat->est->gcl[i] = delta_ns | (gates << wid);
 	}
 
-	mutex_lock(&priv->plat->est->lock);
+	mutex_lock(&priv->est_lock);
 	/* Adjust for real system time */
 	priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, &current_time);
 	current_time_ns = timespec64_to_ktime(current_time);
@@ -1045,8 +1069,10 @@
 
 	priv->plat->est->ter = qopt->cycle_time_extension;
 
+	tc_taprio_map_maxsdu_txq(priv, qopt);
+
 	if (fpe && !priv->dma_cap.fpesel) {
-		mutex_unlock(&priv->plat->est->lock);
+		mutex_unlock(&priv->est_lock);
 		return -EOPNOTSUPP;
 	}
 
@@ -1057,7 +1083,7 @@
 
 	ret = stmmac_est_configure(priv, priv, priv->plat->est,
 				   priv->plat->clk_ptp_rate);
-	mutex_unlock(&priv->plat->est->lock);
+	mutex_unlock(&priv->est_lock);
 	if (ret) {
 		netdev_err(priv->dev, "failed to configure EST\n");
 		goto disable;
@@ -1074,11 +1100,16 @@
 
 disable:
 	if (priv->plat->est) {
-		mutex_lock(&priv->plat->est->lock);
+		mutex_lock(&priv->est_lock);
 		priv->plat->est->enable = false;
 		stmmac_est_configure(priv, priv, priv->plat->est,
 				     priv->plat->clk_ptp_rate);
-		mutex_unlock(&priv->plat->est->lock);
+		/* Reset taprio status */
+		for (i = 0; i < priv->plat->tx_queues_to_use; i++) {
+			priv->xstats.max_sdu_txq_drop[i] = 0;
+			priv->xstats.mtl_est_txq_hlbf[i] = 0;
+		}
+		mutex_unlock(&priv->est_lock);
 	}
 
 	priv->plat->fpe_cfg->enable = false;
@@ -1095,6 +1126,57 @@
 	return ret;
 }
 
+static void tc_taprio_stats(struct stmmac_priv *priv,
+			    struct tc_taprio_qopt_offload *qopt)
+{
+	u64 window_drops = 0;
+	int i = 0;
+
+	for (i = 0; i < priv->plat->tx_queues_to_use; i++)
+		window_drops += priv->xstats.max_sdu_txq_drop[i] +
+				priv->xstats.mtl_est_txq_hlbf[i];
+	qopt->stats.window_drops = window_drops;
+
+	/* Transmission overrun doesn't happen for stmmac, hence always 0 */
+	qopt->stats.tx_overruns = 0;
+}
+
+static void tc_taprio_queue_stats(struct stmmac_priv *priv,
+				  struct tc_taprio_qopt_offload *qopt)
+{
+	struct tc_taprio_qopt_queue_stats *q_stats = &qopt->queue_stats;
+	int queue = qopt->queue_stats.queue;
+
+	q_stats->stats.window_drops = priv->xstats.max_sdu_txq_drop[queue] +
+				      priv->xstats.mtl_est_txq_hlbf[queue];
+
+	/* Transmission overrun doesn't happen for stmmac, hence always 0 */
+	q_stats->stats.tx_overruns = 0;
+}
+
+static int tc_setup_taprio(struct stmmac_priv *priv,
+			   struct tc_taprio_qopt_offload *qopt)
+{
+	int err = 0;
+
+	switch (qopt->cmd) {
+	case TAPRIO_CMD_REPLACE:
+	case TAPRIO_CMD_DESTROY:
+		err = tc_taprio_configure(priv, qopt);
+		break;
+	case TAPRIO_CMD_STATS:
+		tc_taprio_stats(priv, qopt);
+		break;
+	case TAPRIO_CMD_QUEUE_STATS:
+		tc_taprio_queue_stats(priv, qopt);
+		break;
+	default:
+		err = -EOPNOTSUPP;
+	}
+
+	return err;
+}
+
 static int tc_setup_etf(struct stmmac_priv *priv,
 			struct tc_etf_qopt_offload *qopt)
 {
@@ -1126,6 +1208,7 @@
 			return -EOPNOTSUPP;
 
 		caps->gate_mask_per_txq = true;
+		caps->supports_queue_max_sdu = true;
 
 		return 0;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/sun/sungem.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/sun/sungem.c
@@ -949,17 +949,6 @@
 	return IRQ_HANDLED;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void gem_poll_controller(struct net_device *dev)
-{
-	struct gem *gp = netdev_priv(dev);
-
-	disable_irq(gp->pdev->irq);
-	gem_interrupt(gp->pdev->irq, dev);
-	enable_irq(gp->pdev->irq);
-}
-#endif
-
 static void gem_tx_timeout(struct net_device *dev, unsigned int txqueue)
 {
 	struct gem *gp = netdev_priv(dev);
@@ -2839,9 +2828,6 @@
 	.ndo_change_mtu		= gem_change_mtu,
 	.ndo_validate_addr	= eth_validate_addr,
 	.ndo_set_mac_address    = gem_set_mac_address,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-	.ndo_poll_controller    = gem_poll_controller,
-#endif
 };
 
 static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/ti/am65-cpsw-nuss.c
@@ -2793,6 +2793,8 @@
 
 static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common)
 {
+	struct am65_cpsw_rx_chn *rx_chan = &common->rx_chns;
+	struct am65_cpsw_tx_chn *tx_chan = common->tx_chns;
 	struct device *dev = common->dev;
 	struct am65_cpsw_port *port;
 	int ret = 0, i;
@@ -2805,6 +2807,22 @@
 	if (ret)
 		return ret;
 
+	/* The DMA Channels are not guaranteed to be in a clean state.
+	 * Reset and disable them to ensure that they are back to the
+	 * clean state and ready to be used.
+	 */
+	for (i = 0; i < common->tx_ch_num; i++) {
+		k3_udma_glue_reset_tx_chn(tx_chan[i].tx_chn, &tx_chan[i],
+					  am65_cpsw_nuss_tx_cleanup);
+		k3_udma_glue_disable_tx_chn(tx_chan[i].tx_chn);
+	}
+
+	for (i = 0; i < AM65_CPSW_MAX_RX_FLOWS; i++)
+		k3_udma_glue_reset_rx_chn(rx_chan->rx_chn, i, rx_chan,
+					  am65_cpsw_nuss_rx_cleanup, !!i);
+
+	k3_udma_glue_disable_rx_chn(rx_chan->rx_chn);
+
 	ret = am65_cpsw_nuss_register_devlink(common);
 	if (ret)
 		return ret;
@@ -2976,7 +2994,7 @@
 	common->rx_flow_id_base = -1;
 	init_completion(&common->tdown_complete);
 	common->tx_ch_num = AM65_CPSW_DEFAULT_TX_CHNS;
-	common->pf_p0_rx_ptype_rrobin = false;
+	common->pf_p0_rx_ptype_rrobin = true;
 	common->default_vlan = 1;
 
 	common->ports = devm_kcalloc(dev, common->port_num,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/ti/am65-cpts.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/ti/am65-cpts.c
@@ -784,6 +784,11 @@
 		struct am65_cpts_skb_cb_data *skb_cb =
 					(struct am65_cpts_skb_cb_data *)skb->cb;
 
+		if ((ptp_classify_raw(skb) & PTP_CLASS_V1) &&
+		    ((mtype_seqid & AM65_CPTS_EVENT_1_SEQUENCE_ID_MASK) ==
+		     (skb_cb->skb_mtype_seqid & AM65_CPTS_EVENT_1_SEQUENCE_ID_MASK)))
+			mtype_seqid = skb_cb->skb_mtype_seqid;
+
 		if (mtype_seqid == skb_cb->skb_mtype_seqid) {
 			u64 ns = event->timestamp;
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/ti/cpsw_ale.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/ti/cpsw_ale.c
@@ -106,15 +106,15 @@
 
 static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits)
 {
-	int idx, idx2;
+	int idx, idx2, index;
 	u32 hi_val = 0;
 
 	idx    = start / 32;
 	idx2 = (start + bits - 1) / 32;
 	/* Check if bits to be fetched exceed a word */
 	if (idx != idx2) {
-		idx2 = 2 - idx2; /* flip */
-		hi_val = ale_entry[idx2] << ((idx2 * 32) - start);
+		index = 2 - idx2; /* flip */
+		hi_val = ale_entry[index] << ((idx2 * 32) - start);
 	}
 	start -= idx * 32;
 	idx    = 2 - idx; /* flip */
@@ -124,16 +124,16 @@
 static inline void cpsw_ale_set_field(u32 *ale_entry, u32 start, u32 bits,
 				      u32 value)
 {
-	int idx, idx2;
+	int idx, idx2, index;
 
 	value &= BITMASK(bits);
 	idx = start / 32;
 	idx2 = (start + bits - 1) / 32;
 	/* Check if bits to be set exceed a word */
 	if (idx != idx2) {
-		idx2 = 2 - idx2; /* flip */
-		ale_entry[idx2] &= ~(BITMASK(bits + start - (idx2 * 32)));
-		ale_entry[idx2] |= (value >> ((idx2 * 32) - start));
+		index = 2 - idx2; /* flip */
+		ale_entry[index] &= ~(BITMASK(bits + start - (idx2 * 32)));
+		ale_entry[index] |= (value >> ((idx2 * 32) - start));
 	}
 	start -= idx * 32;
 	idx = 2 - idx; /* flip */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/ti/icssg/icss_iep.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/ti/icssg/icss_iep.c
@@ -290,6 +290,9 @@
 	for (cmp = IEP_MIN_CMP; cmp < IEP_MAX_CMP; cmp++) {
 		regmap_update_bits(iep->map, ICSS_IEP_CMP_STAT_REG,
 				   IEP_CMP_STATUS(cmp), IEP_CMP_STATUS(cmp));
+
+		regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
+				   IEP_CMP_CFG_CMP_EN(cmp), 0);
 	}
 
 	/* enable reset counter on CMP0 event */
@@ -808,6 +811,11 @@
 	}
 	icss_iep_disable(iep);
 
+	if (iep->pps_enabled)
+		icss_iep_pps_enable(iep, false);
+	else if (iep->perout_enabled)
+		icss_iep_perout_enable(iep, NULL, false);
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(icss_iep_exit);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/ti/icssg/icssg_classifier.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/ti/icssg/icssg_classifier.c
@@ -360,7 +360,7 @@
 {
 	const u8 mask_addr[] = { 0, 0, 0, 0, 0, 0, };
 
-	rx_class_ft1_set_start_len(miig_rt, slice, 0, 6);
+	rx_class_ft1_set_start_len(miig_rt, slice, ETH_ALEN, ETH_ALEN);
 	rx_class_ft1_set_da(miig_rt, slice, 0, mac_addr);
 	rx_class_ft1_set_da_mask(miig_rt, slice, 0, mask_addr);
 	rx_class_ft1_cfg_set_type(miig_rt, slice, 0, FT1_CFG_TYPE_EQ);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/ti/icssg/icssg_prueth.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/ti/icssg/icssg_prueth.c
@@ -15,6 +15,7 @@
 #include <linux/genalloc.h>
 #include <linux/if_vlan.h>
 #include <linux/interrupt.h>
+#include <linux/io-64-nonatomic-hi-lo.h>
 #include <linux/kernel.h>
 #include <linux/mfd/syscon.h>
 #include <linux/module.h>
@@ -421,12 +422,14 @@
 		if (!i)
 			fdqring_id = k3_udma_glue_rx_flow_get_fdq_id(rx_chn->rx_chn,
 								     i);
-		rx_chn->irq[i] = k3_udma_glue_rx_get_irq(rx_chn->rx_chn, i);
-		if (rx_chn->irq[i] <= 0) {
-			ret = rx_chn->irq[i];
+		ret = k3_udma_glue_rx_get_irq(rx_chn->rx_chn, i);
+		if (ret <= 0) {
+			if (!ret)
+				ret = -ENXIO;
 			netdev_err(ndev, "Failed to get rx dma irq");
 			goto fail;
 		}
+		rx_chn->irq[i] = ret;
 	}
 
 	return 0;
@@ -1249,6 +1252,8 @@
 	struct prueth_emac *emac = clockops_data;
 	u32 reduction_factor = 0, offset = 0;
 	struct timespec64 ts;
+	u64 current_cycle;
+	u64 start_offset;
 	u64 ns_period;
 
 	if (!on)
@@ -1287,8 +1292,14 @@
 	writel(reduction_factor, emac->prueth->shram.va +
 		TIMESYNC_FW_WC_SYNCOUT_REDUCTION_FACTOR_OFFSET);
 
-	writel(0, emac->prueth->shram.va +
-		TIMESYNC_FW_WC_SYNCOUT_START_TIME_CYCLECOUNT_OFFSET);
+	current_cycle = icssg_read_time(emac->prueth->shram.va +
+					TIMESYNC_FW_WC_CYCLECOUNT_OFFSET);
+
+	/* Rounding of current_cycle count to next second */
+	start_offset = roundup(current_cycle, MSEC_PER_SEC);
+
+	hi_lo_writeq(start_offset, emac->prueth->shram.va +
+		     TIMESYNC_FW_WC_SYNCOUT_START_TIME_CYCLECOUNT_OFFSET);
 
 	return 0;
 }
@@ -2154,7 +2165,12 @@
 
 		prueth->registered_netdevs[PRUETH_MAC0] = prueth->emac[PRUETH_MAC0]->ndev;
 
-		emac_phy_connect(prueth->emac[PRUETH_MAC0]);
+		ret = emac_phy_connect(prueth->emac[PRUETH_MAC0]);
+		if (ret) {
+			dev_err(dev,
+				"can't connect to MII0 PHY, error -%d", ret);
+			goto netdev_unregister;
+		}
 		phy_attached_info(prueth->emac[PRUETH_MAC0]->ndev->phydev);
 	}
 
@@ -2166,7 +2182,12 @@
 		}
 
 		prueth->registered_netdevs[PRUETH_MAC1] = prueth->emac[PRUETH_MAC1]->ndev;
-		emac_phy_connect(prueth->emac[PRUETH_MAC1]);
+		ret = emac_phy_connect(prueth->emac[PRUETH_MAC1]);
+		if (ret) {
+			dev_err(dev,
+				"can't connect to MII1 PHY, error %d", ret);
+			goto netdev_unregister;
+		}
 		phy_attached_info(prueth->emac[PRUETH_MAC1]->ndev->phydev);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/ti/icssg/icssg_prueth.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/ti/icssg/icssg_prueth.h
@@ -258,6 +258,18 @@
 
 extern const struct ethtool_ops icssg_ethtool_ops;
 
+static inline u64 icssg_read_time(const void __iomem *addr)
+{
+	u32 low, high;
+
+	do {
+		high = readl(addr + 4);
+		low = readl(addr);
+	} while (high != readl(addr + 4));
+
+	return low + ((u64)high << 32);
+}
+
 /* Classifier helpers */
 void icssg_class_set_mac_addr(struct regmap *miig_rt, int slice, u8 *mac);
 void icssg_class_set_host_mac_addr(struct regmap *miig_rt, const u8 *mac);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/vertexcom/mse102x.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/vertexcom/mse102x.c
@@ -222,7 +222,7 @@
 	struct mse102x_net_spi *mses = to_mse102x_spi(mse);
 	struct spi_transfer *xfer = &mses->spi_xfer;
 	struct spi_message *msg = &mses->spi_msg;
-	struct sk_buff *tskb;
+	struct sk_buff *tskb = NULL;
 	int ret;
 
 	netif_dbg(mse, tx_queued, mse->ndev, "%s: skb %p, %d@%p\n",
@@ -235,7 +235,6 @@
 		if (!tskb)
 			return -ENOMEM;
 
-		dev_kfree_skb(txp);
 		txp = tskb;
 	}
 
@@ -257,6 +256,8 @@
 		mse->stats.xfer_err++;
 	}
 
+	dev_kfree_skb(tskb);
+
 	return ret;
 }
 
@@ -436,13 +437,15 @@
 	mse = &mses->mse102x;
 
 	while ((txb = skb_dequeue(&mse->txq))) {
+		unsigned int len = max_t(unsigned int, txb->len, ETH_ZLEN);
+
 		mutex_lock(&mses->lock);
 		ret = mse102x_tx_pkt_spi(mse, txb, work_timeout);
 		mutex_unlock(&mses->lock);
 		if (ret) {
 			mse->ndev->stats.tx_dropped++;
 		} else {
-			mse->ndev->stats.tx_bytes += txb->len;
+			mse->ndev->stats.tx_bytes += len;
 			mse->ndev->stats.tx_packets++;
 		}
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/libwx/wx_hw.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/libwx/wx_hw.c
@@ -334,27 +334,25 @@
 	status = read_poll_timeout(rd32, hicr, hicr & WX_MNG_MBOX_CTL_FWRDY, 1000,
 				   timeout * 1000, false, wx, WX_MNG_MBOX_CTL);
 
+	buf[0] = rd32(wx, WX_MNG_MBOX);
+	if ((buf[0] & 0xff0000) >> 16 == 0x80) {
+		wx_err(wx, "Unknown FW command: 0x%x\n", buffer[0] & 0xff);
+		status = -EINVAL;
+		goto rel_out;
+	}
+
 	/* Check command completion */
 	if (status) {
-		wx_dbg(wx, "Command has failed with no status valid.\n");
-
-		buf[0] = rd32(wx, WX_MNG_MBOX);
-		if ((buffer[0] & 0xff) != (~buf[0] >> 24)) {
-			status = -EINVAL;
-			goto rel_out;
-		}
-		if ((buf[0] & 0xff0000) >> 16 == 0x80) {
-			wx_dbg(wx, "It's unknown cmd.\n");
-			status = -EINVAL;
-			goto rel_out;
-		}
-
+		wx_err(wx, "Command has failed with no status valid.\n");
 		wx_dbg(wx, "write value:\n");
 		for (i = 0; i < dword_len; i++)
 			wx_dbg(wx, "%x ", buffer[i]);
 		wx_dbg(wx, "read value:\n");
 		for (i = 0; i < dword_len; i++)
 			wx_dbg(wx, "%x ", buf[i]);
+		wx_dbg(wx, "\ncheck: %x %x\n", buffer[0] & 0xff, ~buf[0] >> 24);
+
+		goto rel_out;
 	}
 
 	if (!return_data)
@@ -1958,7 +1956,8 @@
 		return -ENOMEM;
 	}
 
-	wx->msix_in_use = false;
+	bitmap_zero(wx->state, WX_STATE_NBITS);
+	wx->misc_irq_domain = false;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/libwx/wx_lib.c
@@ -1614,14 +1614,12 @@
 	/* One for non-queue interrupts */
 	nvecs += 1;
 
-	if (!wx->msix_in_use) {
-		wx->msix_entry = kcalloc(1, sizeof(struct msix_entry),
-					 GFP_KERNEL);
-		if (!wx->msix_entry) {
-			kfree(wx->msix_q_entries);
-			wx->msix_q_entries = NULL;
-			return -ENOMEM;
-		}
+	wx->msix_entry = kcalloc(1, sizeof(struct msix_entry),
+				 GFP_KERNEL);
+	if (!wx->msix_entry) {
+		kfree(wx->msix_q_entries);
+		wx->msix_q_entries = NULL;
+		return -ENOMEM;
 	}
 
 	nvecs = pci_alloc_irq_vectors_affinity(wx->pdev, nvecs,
@@ -1688,6 +1686,7 @@
 	}
 
 	pdev->irq = pci_irq_vector(pdev, 0);
+	wx->num_q_vectors = 1;
 
 	return 0;
 }
@@ -1931,10 +1930,8 @@
 	if (pdev->msix_enabled) {
 		kfree(wx->msix_q_entries);
 		wx->msix_q_entries = NULL;
-		if (!wx->msix_in_use) {
-			kfree(wx->msix_entry);
-			wx->msix_entry = NULL;
-		}
+		kfree(wx->msix_entry);
+		wx->msix_entry = NULL;
 	}
 	pci_free_irq_vectors(wx->pdev);
 }
@@ -2000,7 +1997,8 @@
 	int vector;
 
 	if (!(pdev->msix_enabled)) {
-		free_irq(pdev->irq, wx);
+		if (!wx->misc_irq_domain)
+			free_irq(pdev->irq, wx);
 		return;
 	}
 
@@ -2015,7 +2013,7 @@
 		free_irq(entry->vector, q_vector);
 	}
 
-	if (wx->mac.type == wx_mac_em)
+	if (!wx->misc_irq_domain)
 		free_irq(wx->msix_entry->vector, wx);
 }
 EXPORT_SYMBOL(wx_free_irq);
@@ -2030,6 +2028,9 @@
 {
 	struct pci_dev *pdev = wx->pdev;
 
+	if (wx->isb_mem)
+		return 0;
+
 	wx->isb_mem = dma_alloc_coherent(&pdev->dev,
 					 sizeof(u32) * 4,
 					 &wx->isb_dma,
@@ -2389,7 +2390,6 @@
 
 void wx_free_resources(struct wx *wx)
 {
-	wx_free_isb_resources(wx);
 	wx_free_all_rx_resources(wx);
 	wx_free_all_tx_resources(wx);
 }
@@ -2694,15 +2694,63 @@
 		wx->rss_enabled = false;
 	}
 
-	if (changed &
-	    (NETIF_F_HW_VLAN_CTAG_RX |
-	     NETIF_F_HW_VLAN_STAG_RX))
+	netdev->features = features;
+
+	if (wx->mac.type == wx_mac_sp && changed & NETIF_F_HW_VLAN_CTAG_RX)
+		wx->do_reset(netdev);
+	else if (changed & (NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_CTAG_FILTER))
 		wx_set_rx_mode(netdev);
 
-	return 1;
+	return 0;
 }
 EXPORT_SYMBOL(wx_set_features);
 
+#define NETIF_VLAN_STRIPPING_FEATURES	(NETIF_F_HW_VLAN_CTAG_RX | \
+					 NETIF_F_HW_VLAN_STAG_RX)
+
+#define NETIF_VLAN_INSERTION_FEATURES	(NETIF_F_HW_VLAN_CTAG_TX | \
+					 NETIF_F_HW_VLAN_STAG_TX)
+
+#define NETIF_VLAN_FILTERING_FEATURES	(NETIF_F_HW_VLAN_CTAG_FILTER | \
+					 NETIF_F_HW_VLAN_STAG_FILTER)
+
+netdev_features_t wx_fix_features(struct net_device *netdev,
+				  netdev_features_t features)
+{
+	netdev_features_t changed = netdev->features ^ features;
+	struct wx *wx = netdev_priv(netdev);
+
+	if (changed & NETIF_VLAN_STRIPPING_FEATURES) {
+		if ((features & NETIF_VLAN_STRIPPING_FEATURES) != NETIF_VLAN_STRIPPING_FEATURES &&
+		    (features & NETIF_VLAN_STRIPPING_FEATURES) != 0) {
+			features &= ~NETIF_VLAN_STRIPPING_FEATURES;
+			features |= netdev->features & NETIF_VLAN_STRIPPING_FEATURES;
+			wx_err(wx, "802.1Q and 802.1ad VLAN stripping must be either both on or both off.");
+		}
+	}
+
+	if (changed & NETIF_VLAN_INSERTION_FEATURES) {
+		if ((features & NETIF_VLAN_INSERTION_FEATURES) != NETIF_VLAN_INSERTION_FEATURES &&
+		    (features & NETIF_VLAN_INSERTION_FEATURES) != 0) {
+			features &= ~NETIF_VLAN_INSERTION_FEATURES;
+			features |= netdev->features & NETIF_VLAN_INSERTION_FEATURES;
+			wx_err(wx, "802.1Q and 802.1ad VLAN insertion must be either both on or both off.");
+		}
+	}
+
+	if (changed & NETIF_VLAN_FILTERING_FEATURES) {
+		if ((features & NETIF_VLAN_FILTERING_FEATURES) != NETIF_VLAN_FILTERING_FEATURES &&
+		    (features & NETIF_VLAN_FILTERING_FEATURES) != 0) {
+			features &= ~NETIF_VLAN_FILTERING_FEATURES;
+			features |= netdev->features & NETIF_VLAN_FILTERING_FEATURES;
+			wx_err(wx, "802.1Q and 802.1ad VLAN filtering must be either both on or both off.");
+		}
+	}
+
+	return features;
+}
+EXPORT_SYMBOL(wx_fix_features);
+
 void wx_set_ring(struct wx *wx, u32 new_tx_count,
 		 u32 new_rx_count, struct wx_ring *temp_ring)
 {
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/libwx/wx_lib.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/libwx/wx_lib.h
@@ -30,6 +30,8 @@
 void wx_get_stats64(struct net_device *netdev,
 		    struct rtnl_link_stats64 *stats);
 int wx_set_features(struct net_device *netdev, netdev_features_t features);
+netdev_features_t wx_fix_features(struct net_device *netdev,
+				  netdev_features_t features);
 void wx_set_ring(struct wx *wx, u32 new_tx_count,
 		 u32 new_rx_count, struct wx_ring *temp_ring);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/libwx/wx_type.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/libwx/wx_type.h
@@ -424,9 +424,9 @@
 #define WX_MIN_RXD                   128
 #define WX_MIN_TXD                   128
 
-/* Number of Transmit and Receive Descriptors must be a multiple of 8 */
-#define WX_REQ_RX_DESCRIPTOR_MULTIPLE   8
-#define WX_REQ_TX_DESCRIPTOR_MULTIPLE   8
+/* Number of Transmit and Receive Descriptors must be a multiple of 128 */
+#define WX_REQ_RX_DESCRIPTOR_MULTIPLE   128
+#define WX_REQ_TX_DESCRIPTOR_MULTIPLE   128
 
 #define WX_MAX_JUMBO_FRAME_SIZE      9432 /* max payload 9414 */
 #define VMDQ_P(p)                    p
@@ -982,8 +982,13 @@
 	u64 qmprc;
 };
 
+enum wx_state {
+	WX_STATE_RESETTING,
+	WX_STATE_NBITS,		/* must be last */
+};
 struct wx {
 	unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
+	DECLARE_BITMAP(state, WX_STATE_NBITS);
 
 	void *priv;
 	u8 __iomem *hw_addr;
@@ -1047,13 +1052,13 @@
 	unsigned int queues_per_pool;
 	struct msix_entry *msix_q_entries;
 	struct msix_entry *msix_entry;
-	bool msix_in_use;
 	struct wx_ring_feature ring_feature[RING_F_ARRAY_SIZE];
 
 	/* misc interrupt status block */
 	dma_addr_t isb_dma;
 	u32 *isb_mem;
 	u32 isb_tag[WX_ISB_MAX];
+	bool misc_irq_domain;
 
 #define WX_MAX_RETA_ENTRIES 128
 #define WX_RSS_INDIR_TBL_MAX 64
@@ -1072,6 +1077,8 @@
 	u64 hw_csum_rx_good;
 	u64 hw_csum_rx_error;
 	u64 alloc_rx_buff_failed;
+
+	void (*do_reset)(struct net_device *netdev);
 };
 
 #define WX_INTR_ALL (~0ULL)
@@ -1132,4 +1139,19 @@
 	return container_of(config, struct wx, phylink_config);
 }
 
+static inline int wx_set_state_reset(struct wx *wx)
+{
+	u8 timeout = 50;
+
+	while (test_and_set_bit(WX_STATE_RESETTING, wx->state)) {
+		timeout--;
+		if (!timeout)
+			return -EBUSY;
+
+		usleep_range(1000, 2000);
+	}
+
+	return 0;
+}
+
 #endif /* _WX_TYPE_H_ */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/ngbe/ngbe_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/ngbe/ngbe_ethtool.c
@@ -52,7 +52,7 @@
 	struct wx *wx = netdev_priv(netdev);
 	u32 new_rx_count, new_tx_count;
 	struct wx_ring *temp_ring;
-	int i;
+	int i, err = 0;
 
 	new_tx_count = clamp_t(u32, ring->tx_pending, WX_MIN_TXD, WX_MAX_TXD);
 	new_tx_count = ALIGN(new_tx_count, WX_REQ_TX_DESCRIPTOR_MULTIPLE);
@@ -64,6 +64,10 @@
 	    new_rx_count == wx->rx_ring_count)
 		return 0;
 
+	err = wx_set_state_reset(wx);
+	if (err)
+		return err;
+
 	if (!netif_running(wx->netdev)) {
 		for (i = 0; i < wx->num_tx_queues; i++)
 			wx->tx_ring[i]->count = new_tx_count;
@@ -72,14 +76,16 @@
 		wx->tx_ring_count = new_tx_count;
 		wx->rx_ring_count = new_rx_count;
 
-		return 0;
+		goto clear_reset;
 	}
 
 	/* allocate temporary buffer to store rings in */
 	i = max_t(int, wx->num_tx_queues, wx->num_rx_queues);
 	temp_ring = kvmalloc_array(i, sizeof(struct wx_ring), GFP_KERNEL);
-	if (!temp_ring)
-		return -ENOMEM;
+	if (!temp_ring) {
+		err = -ENOMEM;
+		goto clear_reset;
+	}
 
 	ngbe_down(wx);
 
@@ -89,7 +95,9 @@
 	wx_configure(wx);
 	ngbe_up(wx);
 
-	return 0;
+clear_reset:
+	clear_bit(WX_STATE_RESETTING, wx->state);
+	return err;
 }
 
 static int ngbe_set_channels(struct net_device *dev,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
@@ -387,6 +387,7 @@
 err_free_irq:
 	wx_free_irq(wx);
 err_free_resources:
+	wx_free_isb_resources(wx);
 	wx_free_resources(wx);
 	return err;
 }
@@ -408,6 +409,7 @@
 
 	ngbe_down(wx);
 	wx_free_irq(wx);
+	wx_free_isb_resources(wx);
 	wx_free_resources(wx);
 	phylink_disconnect_phy(wx->phylink);
 	wx_control_hw(wx, false);
@@ -499,6 +501,7 @@
 	.ndo_start_xmit         = wx_xmit_frame,
 	.ndo_set_rx_mode        = wx_set_rx_mode,
 	.ndo_set_features       = wx_set_features,
+	.ndo_fix_features       = wx_fix_features,
 	.ndo_validate_addr      = eth_validate_addr,
 	.ndo_set_mac_address    = wx_set_mac,
 	.ndo_get_stats64        = wx_get_stats64,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c
@@ -124,8 +124,12 @@
 				   MAC_SYM_PAUSE | MAC_ASYM_PAUSE;
 	config->mac_managed_pm = true;
 
-	phy_mode = PHY_INTERFACE_MODE_RGMII_ID;
-	__set_bit(PHY_INTERFACE_MODE_RGMII_ID, config->supported_interfaces);
+	/* The MAC only has add the Tx delay and it can not be modified.
+	 * So just disable TX delay in PHY, and it is does not matter to
+	 * internal phy.
+	 */
+	phy_mode = PHY_INTERFACE_MODE_RGMII_RXID;
+	__set_bit(PHY_INTERFACE_MODE_RGMII_RXID, config->supported_interfaces);
 
 	phylink = phylink_create(config, NULL, phy_mode, &ngbe_mac_ops);
 	if (IS_ERR(phylink))
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/txgbe/Makefile
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/txgbe/Makefile
@@ -9,4 +9,5 @@
 txgbe-objs := txgbe_main.o \
               txgbe_hw.o \
               txgbe_phy.o \
+              txgbe_irq.o \
               txgbe_ethtool.o
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/txgbe/txgbe_ethtool.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/txgbe/txgbe_ethtool.c
@@ -19,7 +19,7 @@
 	struct wx *wx = netdev_priv(netdev);
 	u32 new_rx_count, new_tx_count;
 	struct wx_ring *temp_ring;
-	int i;
+	int i, err = 0;
 
 	new_tx_count = clamp_t(u32, ring->tx_pending, WX_MIN_TXD, WX_MAX_TXD);
 	new_tx_count = ALIGN(new_tx_count, WX_REQ_TX_DESCRIPTOR_MULTIPLE);
@@ -31,6 +31,10 @@
 	    new_rx_count == wx->rx_ring_count)
 		return 0;
 
+	err = wx_set_state_reset(wx);
+	if (err)
+		return err;
+
 	if (!netif_running(wx->netdev)) {
 		for (i = 0; i < wx->num_tx_queues; i++)
 			wx->tx_ring[i]->count = new_tx_count;
@@ -39,14 +43,16 @@
 		wx->tx_ring_count = new_tx_count;
 		wx->rx_ring_count = new_rx_count;
 
-		return 0;
+		goto clear_reset;
 	}
 
 	/* allocate temporary buffer to store rings in */
 	i = max_t(int, wx->num_tx_queues, wx->num_rx_queues);
 	temp_ring = kvmalloc_array(i, sizeof(struct wx_ring), GFP_KERNEL);
-	if (!temp_ring)
-		return -ENOMEM;
+	if (!temp_ring) {
+		err = -ENOMEM;
+		goto clear_reset;
+	}
 
 	txgbe_down(wx);
 
@@ -55,7 +61,9 @@
 
 	txgbe_up(wx);
 
-	return 0;
+clear_reset:
+	clear_bit(WX_STATE_RESETTING, wx->state);
+	return err;
 }
 
 static int txgbe_set_channels(struct net_device *dev,
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c
@@ -0,0 +1,219 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2015 - 2024 Beijing WangXun Technology Co., Ltd. */
+
+#include <linux/irqdomain.h>
+#include <linux/pci.h>
+
+#include "../libwx/wx_type.h"
+#include "../libwx/wx_lib.h"
+#include "../libwx/wx_hw.h"
+#include "txgbe_type.h"
+#include "txgbe_phy.h"
+#include "txgbe_irq.h"
+
+/**
+ * txgbe_irq_enable - Enable default interrupt generation settings
+ * @wx: pointer to private structure
+ * @queues: enable irqs for queues
+ **/
+void txgbe_irq_enable(struct wx *wx, bool queues)
+{
+	wr32(wx, WX_PX_MISC_IEN, TXGBE_PX_MISC_IEN_MASK);
+
+	/* unmask interrupt */
+	wx_intr_enable(wx, TXGBE_INTR_MISC);
+	if (queues)
+		wx_intr_enable(wx, TXGBE_INTR_QALL(wx));
+}
+
+/**
+ * txgbe_request_queue_irqs - Initialize MSI-X queue interrupts
+ * @wx: board private structure
+ *
+ * Allocate MSI-X queue vectors and request interrupts from the kernel.
+ **/
+int txgbe_request_queue_irqs(struct wx *wx)
+{
+	struct net_device *netdev = wx->netdev;
+	int vector, err;
+
+	if (!wx->pdev->msix_enabled)
+		return 0;
+
+	for (vector = 0; vector < wx->num_q_vectors; vector++) {
+		struct wx_q_vector *q_vector = wx->q_vector[vector];
+		struct msix_entry *entry = &wx->msix_q_entries[vector];
+
+		if (q_vector->tx.ring && q_vector->rx.ring)
+			snprintf(q_vector->name, sizeof(q_vector->name) - 1,
+				 "%s-TxRx-%d", netdev->name, entry->entry);
+		else
+			/* skip this unused q_vector */
+			continue;
+
+		err = request_irq(entry->vector, wx_msix_clean_rings, 0,
+				  q_vector->name, q_vector);
+		if (err) {
+			wx_err(wx, "request_irq failed for MSIX interrupt %s Error: %d\n",
+			       q_vector->name, err);
+			goto free_queue_irqs;
+		}
+	}
+
+	return 0;
+
+free_queue_irqs:
+	while (vector) {
+		vector--;
+		free_irq(wx->msix_q_entries[vector].vector,
+			 wx->q_vector[vector]);
+	}
+	wx_reset_interrupt_capability(wx);
+	return err;
+}
+
+static int txgbe_request_link_irq(struct txgbe *txgbe)
+{
+	txgbe->link_irq = irq_find_mapping(txgbe->misc.domain, TXGBE_IRQ_LINK);
+	return request_threaded_irq(txgbe->link_irq, NULL,
+				    txgbe_link_irq_handler,
+				    IRQF_ONESHOT, "txgbe-link-irq", txgbe);
+}
+
+static const struct irq_chip txgbe_irq_chip = {
+	.name = "txgbe-misc-irq",
+};
+
+static int txgbe_misc_irq_domain_map(struct irq_domain *d,
+				     unsigned int irq,
+				     irq_hw_number_t hwirq)
+{
+	struct txgbe *txgbe = d->host_data;
+
+	irq_set_chip_data(irq, txgbe);
+	irq_set_chip(irq, &txgbe->misc.chip);
+	irq_set_nested_thread(irq, true);
+	irq_set_noprobe(irq);
+
+	return 0;
+}
+
+static const struct irq_domain_ops txgbe_misc_irq_domain_ops = {
+	.map = txgbe_misc_irq_domain_map,
+};
+
+static irqreturn_t txgbe_misc_irq_handle(int irq, void *data)
+{
+	struct wx_q_vector *q_vector;
+	struct txgbe *txgbe = data;
+	struct wx *wx = txgbe->wx;
+	u32 eicr;
+
+	if (wx->pdev->msix_enabled)
+		return IRQ_WAKE_THREAD;
+
+	eicr = wx_misc_isb(wx, WX_ISB_VEC0);
+	if (!eicr) {
+		/* shared interrupt alert!
+		 * the interrupt that we masked before the ICR read.
+		 */
+		if (netif_running(wx->netdev))
+			txgbe_irq_enable(wx, true);
+		return IRQ_NONE;        /* Not our interrupt */
+	}
+	wx->isb_mem[WX_ISB_VEC0] = 0;
+	if (!(wx->pdev->msi_enabled))
+		wr32(wx, WX_PX_INTA, 1);
+
+	/* would disable interrupts here but it is auto disabled */
+	q_vector = wx->q_vector[0];
+	napi_schedule_irqoff(&q_vector->napi);
+
+	return IRQ_WAKE_THREAD;
+}
+
+static irqreturn_t txgbe_misc_irq_thread_fn(int irq, void *data)
+{
+	struct txgbe *txgbe = data;
+	struct wx *wx = txgbe->wx;
+	unsigned int nhandled = 0;
+	unsigned int sub_irq;
+	u32 eicr;
+
+	eicr = wx_misc_isb(wx, WX_ISB_MISC);
+	if (eicr & (TXGBE_PX_MISC_ETH_LK | TXGBE_PX_MISC_ETH_LKDN |
+		    TXGBE_PX_MISC_ETH_AN)) {
+		sub_irq = irq_find_mapping(txgbe->misc.domain, TXGBE_IRQ_LINK);
+		handle_nested_irq(sub_irq);
+		nhandled++;
+	}
+
+	wx_intr_enable(wx, TXGBE_INTR_MISC);
+	return (nhandled > 0 ? IRQ_HANDLED : IRQ_NONE);
+}
+
+static void txgbe_del_irq_domain(struct txgbe *txgbe)
+{
+	int hwirq, virq;
+
+	for (hwirq = 0; hwirq < txgbe->misc.nirqs; hwirq++) {
+		virq = irq_find_mapping(txgbe->misc.domain, hwirq);
+		irq_dispose_mapping(virq);
+	}
+
+	irq_domain_remove(txgbe->misc.domain);
+}
+
+void txgbe_free_misc_irq(struct txgbe *txgbe)
+{
+	free_irq(txgbe->link_irq, txgbe);
+	free_irq(txgbe->misc.irq, txgbe);
+	txgbe_del_irq_domain(txgbe);
+}
+
+int txgbe_setup_misc_irq(struct txgbe *txgbe)
+{
+	unsigned long flags = IRQF_ONESHOT;
+	struct wx *wx = txgbe->wx;
+	int hwirq, err;
+
+	txgbe->misc.nirqs = 1;
+	txgbe->misc.domain = irq_domain_add_simple(NULL, txgbe->misc.nirqs, 0,
+						   &txgbe_misc_irq_domain_ops, txgbe);
+	if (!txgbe->misc.domain)
+		return -ENOMEM;
+
+	for (hwirq = 0; hwirq < txgbe->misc.nirqs; hwirq++)
+		irq_create_mapping(txgbe->misc.domain, hwirq);
+
+	txgbe->misc.chip = txgbe_irq_chip;
+	if (wx->pdev->msix_enabled) {
+		txgbe->misc.irq = wx->msix_entry->vector;
+	} else {
+		txgbe->misc.irq = wx->pdev->irq;
+		if (!wx->pdev->msi_enabled)
+			flags |= IRQF_SHARED;
+	}
+
+	err = request_threaded_irq(txgbe->misc.irq, txgbe_misc_irq_handle,
+				   txgbe_misc_irq_thread_fn,
+				   flags,
+				   wx->netdev->name, txgbe);
+	if (err)
+		goto del_misc_irq;
+
+	err = txgbe_request_link_irq(txgbe);
+	if (err)
+		goto free_msic_irq;
+
+	wx->misc_irq_domain = true;
+
+	return 0;
+
+free_msic_irq:
+	free_irq(txgbe->misc.irq, txgbe);
+del_misc_irq:
+	txgbe_del_irq_domain(txgbe);
+
+	return err;
+}
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/txgbe/txgbe_irq.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/txgbe/txgbe_irq.h
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (c) 2015 - 2024 Beijing WangXun Technology Co., Ltd. */
+
+void txgbe_irq_enable(struct wx *wx, bool queues);
+int txgbe_request_queue_irqs(struct wx *wx);
+void txgbe_free_misc_irq(struct txgbe *txgbe);
+int txgbe_setup_misc_irq(struct txgbe *txgbe);
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
@@ -17,6 +17,7 @@
 #include "txgbe_type.h"
 #include "txgbe_hw.h"
 #include "txgbe_phy.h"
+#include "txgbe_irq.h"
 #include "txgbe_ethtool.h"
 
 char txgbe_driver_name[] = "txgbe";
@@ -76,133 +77,6 @@
 	return physfns;
 }
 
-/**
- * txgbe_irq_enable - Enable default interrupt generation settings
- * @wx: pointer to private structure
- * @queues: enable irqs for queues
- **/
-static void txgbe_irq_enable(struct wx *wx, bool queues)
-{
-	wr32(wx, WX_PX_MISC_IEN, TXGBE_PX_MISC_IEN_MASK);
-
-	/* unmask interrupt */
-	wx_intr_enable(wx, TXGBE_INTR_MISC);
-	if (queues)
-		wx_intr_enable(wx, TXGBE_INTR_QALL(wx));
-}
-
-/**
- * txgbe_intr - msi/legacy mode Interrupt Handler
- * @irq: interrupt number
- * @data: pointer to a network interface device structure
- **/
-static irqreturn_t txgbe_intr(int __always_unused irq, void *data)
-{
-	struct wx_q_vector *q_vector;
-	struct wx *wx  = data;
-	struct pci_dev *pdev;
-	u32 eicr;
-
-	q_vector = wx->q_vector[0];
-	pdev = wx->pdev;
-
-	eicr = wx_misc_isb(wx, WX_ISB_VEC0);
-	if (!eicr) {
-		/* shared interrupt alert!
-		 * the interrupt that we masked before the ICR read.
-		 */
-		if (netif_running(wx->netdev))
-			txgbe_irq_enable(wx, true);
-		return IRQ_NONE;        /* Not our interrupt */
-	}
-	wx->isb_mem[WX_ISB_VEC0] = 0;
-	if (!(pdev->msi_enabled))
-		wr32(wx, WX_PX_INTA, 1);
-
-	wx->isb_mem[WX_ISB_MISC] = 0;
-	/* would disable interrupts here but it is auto disabled */
-	napi_schedule_irqoff(&q_vector->napi);
-
-	/* re-enable link(maybe) and non-queue interrupts, no flush.
-	 * txgbe_poll will re-enable the queue interrupts
-	 */
-	if (netif_running(wx->netdev))
-		txgbe_irq_enable(wx, false);
-
-	return IRQ_HANDLED;
-}
-
-/**
- * txgbe_request_msix_irqs - Initialize MSI-X interrupts
- * @wx: board private structure
- *
- * Allocate MSI-X vectors and request interrupts from the kernel.
- **/
-static int txgbe_request_msix_irqs(struct wx *wx)
-{
-	struct net_device *netdev = wx->netdev;
-	int vector, err;
-
-	for (vector = 0; vector < wx->num_q_vectors; vector++) {
-		struct wx_q_vector *q_vector = wx->q_vector[vector];
-		struct msix_entry *entry = &wx->msix_q_entries[vector];
-
-		if (q_vector->tx.ring && q_vector->rx.ring)
-			snprintf(q_vector->name, sizeof(q_vector->name) - 1,
-				 "%s-TxRx-%d", netdev->name, entry->entry);
-		else
-			/* skip this unused q_vector */
-			continue;
-
-		err = request_irq(entry->vector, wx_msix_clean_rings, 0,
-				  q_vector->name, q_vector);
-		if (err) {
-			wx_err(wx, "request_irq failed for MSIX interrupt %s Error: %d\n",
-			       q_vector->name, err);
-			goto free_queue_irqs;
-		}
-	}
-
-	return 0;
-
-free_queue_irqs:
-	while (vector) {
-		vector--;
-		free_irq(wx->msix_q_entries[vector].vector,
-			 wx->q_vector[vector]);
-	}
-	wx_reset_interrupt_capability(wx);
-	return err;
-}
-
-/**
- * txgbe_request_irq - initialize interrupts
- * @wx: board private structure
- *
- * Attempt to configure interrupts using the best available
- * capabilities of the hardware and kernel.
- **/
-static int txgbe_request_irq(struct wx *wx)
-{
-	struct net_device *netdev = wx->netdev;
-	struct pci_dev *pdev = wx->pdev;
-	int err;
-
-	if (pdev->msix_enabled)
-		err = txgbe_request_msix_irqs(wx);
-	else if (pdev->msi_enabled)
-		err = request_irq(wx->pdev->irq, &txgbe_intr, 0,
-				  netdev->name, wx);
-	else
-		err = request_irq(wx->pdev->irq, &txgbe_intr, IRQF_SHARED,
-				  netdev->name, wx);
-
-	if (err)
-		wx_err(wx, "request_irq failed, Error %d\n", err);
-
-	return err;
-}
-
 static void txgbe_up_complete(struct wx *wx)
 {
 	struct net_device *netdev = wx->netdev;
@@ -394,6 +268,8 @@
 	wx->tx_work_limit = TXGBE_DEFAULT_TX_WORK;
 	wx->rx_work_limit = TXGBE_DEFAULT_RX_WORK;
 
+	wx->do_reset = txgbe_do_reset;
+
 	return 0;
 }
 
@@ -417,9 +293,9 @@
 
 	wx_configure(wx);
 
-	err = txgbe_request_irq(wx);
+	err = txgbe_request_queue_irqs(wx);
 	if (err)
-		goto err_free_isb;
+		goto err_free_resources;
 
 	/* Notify the stack of the actual queue counts. */
 	err = netif_set_real_num_tx_queues(netdev, wx->num_tx_queues);
@@ -436,8 +312,8 @@
 
 err_free_irq:
 	wx_free_irq(wx);
-err_free_isb:
-	wx_free_isb_resources(wx);
+err_free_resources:
+	wx_free_resources(wx);
 err_reset:
 	txgbe_reset(wx);
 
@@ -518,6 +394,7 @@
 int txgbe_setup_tc(struct net_device *dev, u8 tc)
 {
 	struct wx *wx = netdev_priv(dev);
+	struct txgbe *txgbe = wx->priv;
 
 	/* Hardware has to reinitialize queues and interrupts to
 	 * match packet buffer alignment. Unfortunately, the
@@ -528,6 +405,7 @@
 	else
 		txgbe_reset(wx);
 
+	txgbe_free_misc_irq(txgbe);
 	wx_clear_interrupt_scheme(wx);
 
 	if (tc)
@@ -536,6 +414,7 @@
 		netdev_reset_tc(dev);
 
 	wx_init_interrupt_scheme(wx);
+	txgbe_setup_misc_irq(txgbe);
 
 	if (netif_running(dev))
 		txgbe_open(dev);
@@ -543,6 +422,34 @@
 	return 0;
 }
 
+static void txgbe_reinit_locked(struct wx *wx)
+{
+	int err = 0;
+
+	netif_trans_update(wx->netdev);
+
+	err = wx_set_state_reset(wx);
+	if (err) {
+		wx_err(wx, "wait device reset timeout\n");
+		return;
+	}
+
+	txgbe_down(wx);
+	txgbe_up(wx);
+
+	clear_bit(WX_STATE_RESETTING, wx->state);
+}
+
+void txgbe_do_reset(struct net_device *netdev)
+{
+	struct wx *wx = netdev_priv(netdev);
+
+	if (netif_running(netdev))
+		txgbe_reinit_locked(wx);
+	else
+		txgbe_reset(wx);
+}
+
 static const struct net_device_ops txgbe_netdev_ops = {
 	.ndo_open               = txgbe_open,
 	.ndo_stop               = txgbe_close,
@@ -550,6 +457,7 @@
 	.ndo_start_xmit         = wx_xmit_frame,
 	.ndo_set_rx_mode        = wx_set_rx_mode,
 	.ndo_set_features       = wx_set_features,
+	.ndo_fix_features       = wx_fix_features,
 	.ndo_validate_addr      = eth_validate_addr,
 	.ndo_set_mac_address    = wx_set_mac,
 	.ndo_get_stats64        = wx_get_stats64,
@@ -751,10 +659,14 @@
 	txgbe->wx = wx;
 	wx->priv = txgbe;
 
-	err = txgbe_init_phy(txgbe);
+	err = txgbe_setup_misc_irq(txgbe);
 	if (err)
 		goto err_release_hw;
 
+	err = txgbe_init_phy(txgbe);
+	if (err)
+		goto err_free_misc_irq;
+
 	err = register_netdev(netdev);
 	if (err)
 		goto err_remove_phy;
@@ -781,6 +693,8 @@
 
 err_remove_phy:
 	txgbe_remove_phy(txgbe);
+err_free_misc_irq:
+	txgbe_free_misc_irq(txgbe);
 err_release_hw:
 	wx_clear_interrupt_scheme(wx);
 	wx_control_hw(wx, false);
@@ -813,6 +727,8 @@
 	unregister_netdev(netdev);
 
 	txgbe_remove_phy(txgbe);
+	txgbe_free_misc_irq(txgbe);
+	wx_free_isb_resources(wx);
 
 	pci_release_selected_regions(pdev,
 				     pci_select_bars(pdev, IORESOURCE_MEM));
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
@@ -162,7 +162,7 @@
 	struct wx *wx = phylink_to_wx(config);
 	struct txgbe *txgbe = wx->priv;
 
-	if (interface == PHY_INTERFACE_MODE_10GBASER)
+	if (wx->media_type != sp_media_copper)
 		return &txgbe->xpcs->pcs;
 
 	return NULL;
@@ -292,6 +292,21 @@
 	return 0;
 }
 
+irqreturn_t txgbe_link_irq_handler(int irq, void *data)
+{
+	struct txgbe *txgbe = data;
+	struct wx *wx = txgbe->wx;
+	u32 status;
+	bool up;
+
+	status = rd32(wx, TXGBE_CFG_PORT_ST);
+	up = !!(status & TXGBE_CFG_PORT_ST_LINK_UP);
+
+	phylink_mac_change(wx->phylink, up);
+
+	return IRQ_HANDLED;
+}
+
 static int txgbe_gpio_get(struct gpio_chip *chip, unsigned int offset)
 {
 	struct wx *wx = gpiochip_get_data(chip);
@@ -343,156 +358,8 @@
 	return 0;
 }
 
-static void txgbe_gpio_irq_ack(struct irq_data *d)
-{
-	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
-	irq_hw_number_t hwirq = irqd_to_hwirq(d);
-	struct wx *wx = gpiochip_get_data(gc);
-	unsigned long flags;
-
-	raw_spin_lock_irqsave(&wx->gpio_lock, flags);
-	wr32(wx, WX_GPIO_EOI, BIT(hwirq));
-	raw_spin_unlock_irqrestore(&wx->gpio_lock, flags);
-}
-
-static void txgbe_gpio_irq_mask(struct irq_data *d)
-{
-	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
-	irq_hw_number_t hwirq = irqd_to_hwirq(d);
-	struct wx *wx = gpiochip_get_data(gc);
-	unsigned long flags;
-
-	gpiochip_disable_irq(gc, hwirq);
-
-	raw_spin_lock_irqsave(&wx->gpio_lock, flags);
-	wr32m(wx, WX_GPIO_INTMASK, BIT(hwirq), BIT(hwirq));
-	raw_spin_unlock_irqrestore(&wx->gpio_lock, flags);
-}
-
-static void txgbe_gpio_irq_unmask(struct irq_data *d)
-{
-	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
-	irq_hw_number_t hwirq = irqd_to_hwirq(d);
-	struct wx *wx = gpiochip_get_data(gc);
-	unsigned long flags;
-
-	gpiochip_enable_irq(gc, hwirq);
-
-	raw_spin_lock_irqsave(&wx->gpio_lock, flags);
-	wr32m(wx, WX_GPIO_INTMASK, BIT(hwirq), 0);
-	raw_spin_unlock_irqrestore(&wx->gpio_lock, flags);
-}
-
-static void txgbe_toggle_trigger(struct gpio_chip *gc, unsigned int offset)
-{
-	struct wx *wx = gpiochip_get_data(gc);
-	u32 pol, val;
-
-	pol = rd32(wx, WX_GPIO_POLARITY);
-	val = rd32(wx, WX_GPIO_EXT);
-
-	if (val & BIT(offset))
-		pol &= ~BIT(offset);
-	else
-		pol |= BIT(offset);
-
-	wr32(wx, WX_GPIO_POLARITY, pol);
-}
-
-static int txgbe_gpio_set_type(struct irq_data *d, unsigned int type)
-{
-	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
-	irq_hw_number_t hwirq = irqd_to_hwirq(d);
-	struct wx *wx = gpiochip_get_data(gc);
-	u32 level, polarity, mask;
-	unsigned long flags;
-
-	mask = BIT(hwirq);
-
-	if (type & IRQ_TYPE_LEVEL_MASK) {
-		level = 0;
-		irq_set_handler_locked(d, handle_level_irq);
-	} else {
-		level = mask;
-		irq_set_handler_locked(d, handle_edge_irq);
-	}
-
-	if (type == IRQ_TYPE_EDGE_RISING || type == IRQ_TYPE_LEVEL_HIGH)
-		polarity = mask;
-	else
-		polarity = 0;
-
-	raw_spin_lock_irqsave(&wx->gpio_lock, flags);
-
-	wr32m(wx, WX_GPIO_INTEN, mask, mask);
-	wr32m(wx, WX_GPIO_INTTYPE_LEVEL, mask, level);
-	if (type == IRQ_TYPE_EDGE_BOTH)
-		txgbe_toggle_trigger(gc, hwirq);
-	else
-		wr32m(wx, WX_GPIO_POLARITY, mask, polarity);
-
-	raw_spin_unlock_irqrestore(&wx->gpio_lock, flags);
-
-	return 0;
-}
-
-static const struct irq_chip txgbe_gpio_irq_chip = {
-	.name = "txgbe_gpio_irq",
-	.irq_ack = txgbe_gpio_irq_ack,
-	.irq_mask = txgbe_gpio_irq_mask,
-	.irq_unmask = txgbe_gpio_irq_unmask,
-	.irq_set_type = txgbe_gpio_set_type,
-	.flags = IRQCHIP_IMMUTABLE,
-	GPIOCHIP_IRQ_RESOURCE_HELPERS,
-};
-
-static void txgbe_irq_handler(struct irq_desc *desc)
-{
-	struct irq_chip *chip = irq_desc_get_chip(desc);
-	struct wx *wx = irq_desc_get_handler_data(desc);
-	struct txgbe *txgbe = wx->priv;
-	irq_hw_number_t hwirq;
-	unsigned long gpioirq;
-	struct gpio_chip *gc;
-	unsigned long flags;
-	u32 eicr;
-
-	eicr = wx_misc_isb(wx, WX_ISB_MISC);
-
-	chained_irq_enter(chip, desc);
-
-	gpioirq = rd32(wx, WX_GPIO_INTSTATUS);
-
-	gc = txgbe->gpio;
-	for_each_set_bit(hwirq, &gpioirq, gc->ngpio) {
-		int gpio = irq_find_mapping(gc->irq.domain, hwirq);
-		u32 irq_type = irq_get_trigger_type(gpio);
-
-		generic_handle_domain_irq(gc->irq.domain, hwirq);
-
-		if ((irq_type & IRQ_TYPE_SENSE_MASK) == IRQ_TYPE_EDGE_BOTH) {
-			raw_spin_lock_irqsave(&wx->gpio_lock, flags);
-			txgbe_toggle_trigger(gc, hwirq);
-			raw_spin_unlock_irqrestore(&wx->gpio_lock, flags);
-		}
-	}
-
-	chained_irq_exit(chip, desc);
-
-	if (eicr & (TXGBE_PX_MISC_ETH_LK | TXGBE_PX_MISC_ETH_LKDN |
-		    TXGBE_PX_MISC_ETH_AN)) {
-		u32 reg = rd32(wx, TXGBE_CFG_PORT_ST);
-
-		phylink_mac_change(wx->phylink, !!(reg & TXGBE_CFG_PORT_ST_LINK_UP));
-	}
-
-	/* unmask interrupt */
-	wx_intr_enable(wx, TXGBE_INTR_MISC);
-}
-
 static int txgbe_gpio_init(struct txgbe *txgbe)
 {
-	struct gpio_irq_chip *girq;
 	struct gpio_chip *gc;
 	struct device *dev;
 	struct wx *wx;
@@ -522,24 +389,6 @@
 	gc->direction_input = txgbe_gpio_direction_in;
 	gc->direction_output = txgbe_gpio_direction_out;
 
-	girq = &gc->irq;
-	gpio_irq_chip_set_chip(girq, &txgbe_gpio_irq_chip);
-	girq->parent_handler = txgbe_irq_handler;
-	girq->parent_handler_data = wx;
-	girq->num_parents = 1;
-	girq->parents = devm_kcalloc(dev, girq->num_parents,
-				     sizeof(*girq->parents), GFP_KERNEL);
-	if (!girq->parents)
-		return -ENOMEM;
-
-	/* now only suuported on MSI-X interrupt */
-	if (!wx->msix_entry)
-		return -EPERM;
-
-	girq->parents[0] = wx->msix_entry->vector;
-	girq->default_type = IRQ_TYPE_NONE;
-	girq->handler = handle_bad_irq;
-
 	ret = devm_gpiochip_add_data(dev, gc, wx);
 	if (ret)
 		return ret;
@@ -754,8 +603,6 @@
 		goto err_unregister_i2c;
 	}
 
-	wx->msix_in_use = true;
-
 	return 0;
 
 err_unregister_i2c:
@@ -788,5 +635,4 @@
 	phylink_destroy(txgbe->wx->phylink);
 	xpcs_destroy(txgbe->xpcs);
 	software_node_unregister_node_group(txgbe->nodes.group);
-	txgbe->wx->msix_in_use = false;
 }
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/txgbe/txgbe_phy.h
@@ -4,6 +4,7 @@
 #ifndef _TXGBE_PHY_H_
 #define _TXGBE_PHY_H_
 
+irqreturn_t txgbe_link_irq_handler(int irq, void *data);
 int txgbe_init_phy(struct txgbe *txgbe);
 void txgbe_remove_phy(struct txgbe *txgbe);
 
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/wangxun/txgbe/txgbe_type.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/wangxun/txgbe/txgbe_type.h
@@ -5,6 +5,7 @@
 #define _TXGBE_TYPE_H_
 
 #include <linux/property.h>
+#include <linux/irq.h>
 
 /* Device IDs */
 #define TXGBE_DEV_ID_SP1000                     0x1001
@@ -74,8 +75,7 @@
 #define TXGBE_PX_MISC_IEN_MASK                            \
 	(TXGBE_PX_MISC_ETH_LKDN | TXGBE_PX_MISC_DEV_RST | \
 	 TXGBE_PX_MISC_ETH_EVENT | TXGBE_PX_MISC_ETH_LK | \
-	 TXGBE_PX_MISC_ETH_AN | TXGBE_PX_MISC_INT_ERR |   \
-	 TXGBE_PX_MISC_GPIO)
+	 TXGBE_PX_MISC_ETH_AN | TXGBE_PX_MISC_INT_ERR)
 
 /* Port cfg registers */
 #define TXGBE_CFG_PORT_ST                       0x14404
@@ -133,6 +133,7 @@
 void txgbe_down(struct wx *wx);
 void txgbe_up(struct wx *wx);
 int txgbe_setup_tc(struct net_device *dev, u8 tc);
+void txgbe_do_reset(struct net_device *netdev);
 
 #define NODE_PROP(_NAME, _PROP)			\
 	(const struct software_node) {		\
@@ -169,15 +170,29 @@
 	const struct software_node *group[SWNODE_MAX + 1];
 };
 
+enum txgbe_misc_irqs {
+	TXGBE_IRQ_LINK = 0,
+	TXGBE_IRQ_MAX
+};
+
+struct txgbe_irq {
+	struct irq_chip chip;
+	struct irq_domain *domain;
+	int nirqs;
+	int irq;
+};
+
 struct txgbe {
 	struct wx *wx;
 	struct txgbe_nodes nodes;
+	struct txgbe_irq misc;
 	struct dw_xpcs *xpcs;
 	struct platform_device *sfp_dev;
 	struct platform_device *i2c_dev;
 	struct clk_lookup *clock;
 	struct clk *clk;
 	struct gpio_chip *gpio;
+	unsigned int link_irq;
 };
 
 #endif /* _TXGBE_TYPE_H_ */
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1443,7 +1443,7 @@
 	}
 
 	/* map device registers */
-	lp->regs = devm_platform_ioremap_resource_byname(pdev, 0);
+	lp->regs = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(lp->regs)) {
 		dev_err(&pdev->dev, "could not map TEMAC registers\n");
 		return -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/xilinx/xilinx_axienet.h
+++ linux-qcom-6.8.0/drivers/net/ethernet/xilinx/xilinx_axienet.h
@@ -160,16 +160,17 @@
 #define XAE_RCW1_OFFSET		0x00000404 /* Rx Configuration Word 1 */
 #define XAE_TC_OFFSET		0x00000408 /* Tx Configuration */
 #define XAE_FCC_OFFSET		0x0000040C /* Flow Control Configuration */
-#define XAE_EMMC_OFFSET		0x00000410 /* EMAC mode configuration */
-#define XAE_PHYC_OFFSET		0x00000414 /* RGMII/SGMII configuration */
+#define XAE_EMMC_OFFSET		0x00000410 /* MAC speed configuration */
+#define XAE_PHYC_OFFSET		0x00000414 /* RX Max Frame Configuration */
 #define XAE_ID_OFFSET		0x000004F8 /* Identification register */
-#define XAE_MDIO_MC_OFFSET	0x00000500 /* MII Management Config */
-#define XAE_MDIO_MCR_OFFSET	0x00000504 /* MII Management Control */
-#define XAE_MDIO_MWD_OFFSET	0x00000508 /* MII Management Write Data */
-#define XAE_MDIO_MRD_OFFSET	0x0000050C /* MII Management Read Data */
+#define XAE_MDIO_MC_OFFSET	0x00000500 /* MDIO Setup */
+#define XAE_MDIO_MCR_OFFSET	0x00000504 /* MDIO Control */
+#define XAE_MDIO_MWD_OFFSET	0x00000508 /* MDIO Write Data */
+#define XAE_MDIO_MRD_OFFSET	0x0000050C /* MDIO Read Data */
 #define XAE_UAW0_OFFSET		0x00000700 /* Unicast address word 0 */
 #define XAE_UAW1_OFFSET		0x00000704 /* Unicast address word 1 */
-#define XAE_FMI_OFFSET		0x00000708 /* Filter Mask Index */
+#define XAE_FMI_OFFSET		0x00000708 /* Frame Filter Control */
+#define XAE_FFE_OFFSET		0x0000070C /* Frame Filter Enable */
 #define XAE_AF0_OFFSET		0x00000710 /* Address Filter 0 */
 #define XAE_AF1_OFFSET		0x00000714 /* Address Filter 1 */
 
@@ -308,7 +309,7 @@
  */
 #define XAE_UAW1_UNICASTADDR_MASK	0x0000FFFF
 
-/* Bit masks for Axi Ethernet FMI register */
+/* Bit masks for Axi Ethernet FMC register */
 #define XAE_FMI_PM_MASK			0x80000000 /* Promis. mode enable */
 #define XAE_FMI_IND_MASK		0x00000003 /* Index Mask */
 
@@ -435,6 +436,8 @@
  * @tx_bytes:	TX byte count for statistics
  * @tx_stat_sync: Synchronization object for TX stats
  * @dma_err_task: Work structure to process Axi DMA errors
+ * @stopping:   Set when @dma_err_task shouldn't do anything because we are
+ *              about to stop the device.
  * @tx_irq:	Axidma TX IRQ number
  * @rx_irq:	Axidma RX IRQ number
  * @eth_irq:	Ethernet core IRQ number
@@ -506,6 +509,7 @@
 	struct u64_stats_sync tx_stat_sync;
 
 	struct work_struct dma_err_task;
+	bool stopping;
 
 	int tx_irq;
 	int rx_irq;
--- linux-qcom-6.8.0.orig/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ linux-qcom-6.8.0/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -432,7 +432,7 @@
  */
 static void axienet_set_multicast_list(struct net_device *ndev)
 {
-	int i;
+	int i = 0;
 	u32 reg, af0reg, af1reg;
 	struct axienet_local *lp = netdev_priv(ndev);
 
@@ -450,7 +450,10 @@
 	} else if (!netdev_mc_empty(ndev)) {
 		struct netdev_hw_addr *ha;
 
-		i = 0;
+		reg = axienet_ior(lp, XAE_FMI_OFFSET);
+		reg &= ~XAE_FMI_PM_MASK;
+		axienet_iow(lp, XAE_FMI_OFFSET, reg);
+
 		netdev_for_each_mc_addr(ha, ndev) {
 			if (i >= XAE_MULTICAST_CAM_TABLE_NUM)
 				break;
@@ -469,6 +472,7 @@
 			axienet_iow(lp, XAE_FMI_OFFSET, reg);
 			axienet_iow(lp, XAE_AF0_OFFSET, af0reg);
 			axienet_iow(lp, XAE_AF1_OFFSET, af1reg);
+			axienet_iow(lp, XAE_FFE_OFFSET, 1);
 			i++;
 		}
 	} else {
@@ -476,18 +480,15 @@
 		reg &= ~XAE_FMI_PM_MASK;
 
 		axienet_iow(lp, XAE_FMI_OFFSET, reg);
-
-		for (i = 0; i < XAE_MULTICAST_CAM_TABLE_NUM; i++) {
-			reg = axienet_ior(lp, XAE_FMI_OFFSET) & 0xFFFFFF00;
-			reg |= i;
-
-			axienet_iow(lp, XAE_FMI_OFFSET, reg);
-			axienet_iow(lp, XAE_AF0_OFFSET, 0);
-			axienet_iow(lp, XAE_AF1_OFFSET, 0);
-		}
-
 		dev_info(&ndev->dev, "Promiscuous mode disabled.\n");
 	}
+
+	for (; i < XAE_MULTICAST_CAM_TABLE_NUM; i++) {
+		reg = axienet_ior(lp, XAE_FMI_OFFSET) & 0xFFFFFF00;
+		reg |= i;
+		axienet_iow(lp, XAE_FMI_OFFSET, reg);
+		axienet_iow(lp, XAE_FFE_OFFSET, 0);
+	}
 }
 
 /**
@@ -673,15 +674,15 @@
  *
  * Would either be called after a successful transmit operation, or after
  * there was an error when setting up the chain.
- * Returns the number of descriptors handled.
+ * Returns the number of packets handled.
  */
 static int axienet_free_tx_chain(struct axienet_local *lp, u32 first_bd,
 				 int nr_bds, bool force, u32 *sizep, int budget)
 {
 	struct axidma_bd *cur_p;
 	unsigned int status;
+	int i, packets = 0;
 	dma_addr_t phys;
-	int i;
 
 	for (i = 0; i < nr_bds; i++) {
 		cur_p = &lp->tx_bd_v[(first_bd + i) % lp->tx_bd_num];
@@ -700,8 +701,10 @@
 				 (cur_p->cntrl & XAXIDMA_BD_CTRL_LENGTH_MASK),
 				 DMA_TO_DEVICE);
 
-		if (cur_p->skb && (status & XAXIDMA_BD_STS_COMPLETE_MASK))
+		if (cur_p->skb && (status & XAXIDMA_BD_STS_COMPLETE_MASK)) {
 			napi_consume_skb(cur_p->skb, budget);
+			packets++;
+		}
 
 		cur_p->app0 = 0;
 		cur_p->app1 = 0;
@@ -717,7 +720,13 @@
 			*sizep += status & XAXIDMA_BD_STS_ACTUAL_LEN_MASK;
 	}
 
-	return i;
+	if (!force) {
+		lp->tx_bd_ci += i;
+		if (lp->tx_bd_ci >= lp->tx_bd_num)
+			lp->tx_bd_ci %= lp->tx_bd_num;
+	}
+
+	return packets;
 }
 
 /**
@@ -853,13 +862,13 @@
 	skbuf_dma->sg_len = sg_len;
 	dma_tx_desc->callback_param = lp;
 	dma_tx_desc->callback_result = axienet_dma_tx_cb;
-	dmaengine_submit(dma_tx_desc);
-	dma_async_issue_pending(lp->tx_chan);
 	txq = skb_get_tx_queue(lp->ndev, skb);
 	netdev_tx_sent_queue(txq, skb->len);
 	netif_txq_maybe_stop(txq, CIRC_SPACE(lp->tx_ring_head, lp->tx_ring_tail, TX_BD_NUM_MAX),
 			     MAX_SKB_FRAGS + 1, 2 * MAX_SKB_FRAGS);
 
+	dmaengine_submit(dma_tx_desc);
+	dma_async_issue_pending(lp->tx_chan);
 	return NETDEV_TX_OK;
 
 xmit_error_unmap_sg:
@@ -890,13 +899,10 @@
 	u32 size = 0;
 	int packets;
 
-	packets = axienet_free_tx_chain(lp, lp->tx_bd_ci, budget, false, &size, budget);
+	packets = axienet_free_tx_chain(lp, lp->tx_bd_ci, lp->tx_bd_num, false,
+					&size, budget);
 
 	if (packets) {
-		lp->tx_bd_ci += packets;
-		if (lp->tx_bd_ci >= lp->tx_bd_num)
-			lp->tx_bd_ci %= lp->tx_bd_num;
-
 		u64_stats_update_begin(&lp->tx_stat_sync);
 		u64_stats_add(&lp->tx_packets, packets);
 		u64_stats_add(&lp->tx_bytes, size);
@@ -983,6 +989,7 @@
 		if (net_ratelimit())
 			netdev_err(ndev, "TX DMA mapping error\n");
 		ndev->stats.tx_dropped++;
+		dev_kfree_skb_any(skb);
 		return NETDEV_TX_OK;
 	}
 	desc_set_phys_addr(lp, phys, cur_p);
@@ -1003,6 +1010,7 @@
 			ndev->stats.tx_dropped++;
 			axienet_free_tx_chain(lp, orig_tail_ptr, ii + 1,
 					      true, NULL, 0);
+			dev_kfree_skb_any(skb);
 			return NETDEV_TX_OK;
 		}
 		desc_set_phys_addr(lp, phys, cur_p);
@@ -1221,9 +1229,10 @@
 		u32 cr = lp->tx_dma_cr;
 
 		cr &= ~(XAXIDMA_IRQ_IOC_MASK | XAXIDMA_IRQ_DELAY_MASK);
-		axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET, cr);
-
-		napi_schedule(&lp->napi_tx);
+		if (napi_schedule_prep(&lp->napi_tx)) {
+			axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET, cr);
+			__napi_schedule(&lp->napi_tx);
+		}
 	}
 
 	return IRQ_HANDLED;
@@ -1265,9 +1274,10 @@
 		u32 cr = lp->rx_dma_cr;
 
 		cr &= ~(XAXIDMA_IRQ_IOC_MASK | XAXIDMA_IRQ_DELAY_MASK);
-		axienet_dma_out32(lp, XAXIDMA_RX_CR_OFFSET, cr);
-
-		napi_schedule(&lp->napi_rx);
+		if (napi_schedule_prep(&lp->napi_rx)) {
+			axienet_dma_out32(lp, XAXIDMA_RX_CR_OFFSET, cr);
+			__napi_schedule(&lp->napi_rx);
+		}
 	}
 
 	return IRQ_HANDLED;
@@ -1459,6 +1469,7 @@
 	struct axienet_local *lp = netdev_priv(ndev);
 
 	/* Enable worker thread for Axi DMA error handling */
+	lp->stopping = false;
 	INIT_WORK(&lp->dma_err_task, axienet_dma_err_handler);
 
 	napi_enable(&lp->napi_rx);
@@ -1579,6 +1590,9 @@
 	dev_dbg(&ndev->dev, "axienet_close()\n");
 
 	if (!lp->use_dmaengine) {
+		WRITE_ONCE(lp->stopping, true);
+		flush_work(&lp->dma_err_task);
+
 		napi_disable(&lp->napi_tx);
 		napi_disable(&lp->napi_rx);
 	}
@@ -1950,6 +1964,12 @@
 		return -EFAULT;
 	}
 
+	if (ecoalesce->rx_max_coalesced_frames > 255 ||
+	    ecoalesce->tx_max_coalesced_frames > 255) {
+		NL_SET_ERR_MSG(extack, "frames must be less than 256");
+		return -EINVAL;
+	}
+
 	if (ecoalesce->rx_max_coalesced_frames)
 		lp->coalesce_count_rx = ecoalesce->rx_max_coalesced_frames;
 	if (ecoalesce->rx_coalesce_usecs)
@@ -2153,6 +2173,10 @@
 						dma_err_task);
 	struct net_device *ndev = lp->ndev;
 
+	/* Don't bother if we are going to stop anyway */
+	if (READ_ONCE(lp->stopping))
+		return;
+
 	napi_disable(&lp->napi_tx);
 	napi_disable(&lp->napi_rx);
 
@@ -2219,9 +2243,9 @@
 			   ~(XAE_OPTION_TXEN | XAE_OPTION_RXEN));
 	axienet_set_mac_address(ndev, NULL);
 	axienet_set_multicast_list(ndev);
-	axienet_setoptions(ndev, lp->options);
 	napi_enable(&lp->napi_rx);
 	napi_enable(&lp->napi_tx);
+	axienet_setoptions(ndev, lp->options);
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/net/geneve.c
+++ linux-qcom-6.8.0/drivers/net/geneve.c
@@ -349,6 +349,7 @@
 		gro_cells_destroy(&geneve->gro_cells);
 		return err;
 	}
+	netdev_lockdep_set_classes(dev);
 	return 0;
 }
 
@@ -818,6 +819,7 @@
 			   struct geneve_dev *geneve,
 			   const struct ip_tunnel_info *info)
 {
+	bool inner_proto_inherit = geneve->cfg.inner_proto_inherit;
 	bool xnet = !net_eq(geneve->net, dev_net(geneve->dev));
 	struct geneve_sock *gs4 = rcu_dereference(geneve->sock4);
 	const struct ip_tunnel_key *key = &info->key;
@@ -829,7 +831,7 @@
 	__be16 sport;
 	int err;
 
-	if (!pskb_inet_may_pull(skb))
+	if (!skb_vlan_inet_prepare(skb, inner_proto_inherit))
 		return -EINVAL;
 
 	if (!gs4)
@@ -896,7 +898,7 @@
 		if (geneve->cfg.df == GENEVE_DF_SET) {
 			df = htons(IP_DF);
 		} else if (geneve->cfg.df == GENEVE_DF_INHERIT) {
-			struct ethhdr *eth = eth_hdr(skb);
+			struct ethhdr *eth = skb_eth_hdr(skb);
 
 			if (ntohs(eth->h_proto) == ETH_P_IPV6) {
 				df = htons(IP_DF);
@@ -910,7 +912,7 @@
 	}
 
 	err = geneve_build_skb(&rt->dst, skb, info, xnet, sizeof(struct iphdr),
-			       geneve->cfg.inner_proto_inherit);
+			       inner_proto_inherit);
 	if (unlikely(err))
 		return err;
 
@@ -926,6 +928,7 @@
 			    struct geneve_dev *geneve,
 			    const struct ip_tunnel_info *info)
 {
+	bool inner_proto_inherit = geneve->cfg.inner_proto_inherit;
 	bool xnet = !net_eq(geneve->net, dev_net(geneve->dev));
 	struct geneve_sock *gs6 = rcu_dereference(geneve->sock6);
 	const struct ip_tunnel_key *key = &info->key;
@@ -936,7 +939,7 @@
 	__be16 sport;
 	int err;
 
-	if (!pskb_inet_may_pull(skb))
+	if (!skb_vlan_inet_prepare(skb, inner_proto_inherit))
 		return -EINVAL;
 
 	if (!gs6)
@@ -998,7 +1001,7 @@
 		ttl = ttl ? : ip6_dst_hoplimit(dst);
 	}
 	err = geneve_build_skb(dst, skb, info, xnet, sizeof(struct ipv6hdr),
-			       geneve->cfg.inner_proto_inherit);
+			       inner_proto_inherit);
 	if (unlikely(err))
 		return err;
 
--- linux-qcom-6.8.0.orig/drivers/net/gtp.c
+++ linux-qcom-6.8.0/drivers/net/gtp.c
@@ -901,6 +901,9 @@
 	if (skb_cow_head(skb, dev->needed_headroom))
 		goto tx_err;
 
+	if (!pskb_inet_may_pull(skb))
+		goto tx_err;
+
 	skb_reset_inner_headers(skb);
 
 	/* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */
@@ -1092,8 +1095,8 @@
 		goto out_encap;
 	}
 
-	gn = net_generic(dev_net(dev), gtp_net_id);
-	list_add_rcu(&gtp->list, &gn->gtp_dev_list);
+	gn = net_generic(src_net, gtp_net_id);
+	list_add(&gtp->list, &gn->gtp_dev_list);
 	dev->priv_destructor = gtp_destructor;
 
 	netdev_dbg(dev, "registered new GTP interface\n");
@@ -1111,14 +1114,15 @@
 static void gtp_dellink(struct net_device *dev, struct list_head *head)
 {
 	struct gtp_dev *gtp = netdev_priv(dev);
+	struct hlist_node *next;
 	struct pdp_ctx *pctx;
 	int i;
 
 	for (i = 0; i < gtp->hash_size; i++)
-		hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid)
+		hlist_for_each_entry_safe(pctx, next, &gtp->tid_hash[i], hlist_tid)
 			pdp_context_delete(pctx);
 
-	list_del_rcu(&gtp->list);
+	list_del(&gtp->list);
 	unregister_netdevice_queue(dev, head);
 }
 
@@ -1216,7 +1220,7 @@
 	sock = sockfd_lookup(fd, &err);
 	if (!sock) {
 		pr_debug("gtp socket fd=%d not found\n", fd);
-		return NULL;
+		return ERR_PTR(err);
 	}
 
 	sk = sock->sk;
@@ -1259,20 +1263,24 @@
 		return -EINVAL;
 
 	if (data[IFLA_GTP_FD0]) {
-		u32 fd0 = nla_get_u32(data[IFLA_GTP_FD0]);
+		int fd0 = nla_get_u32(data[IFLA_GTP_FD0]);
 
-		sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp);
-		if (IS_ERR(sk0))
-			return PTR_ERR(sk0);
+		if (fd0 >= 0) {
+			sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp);
+			if (IS_ERR(sk0))
+				return PTR_ERR(sk0);
+		}
 	}
 
 	if (data[IFLA_GTP_FD1]) {
-		u32 fd1 = nla_get_u32(data[IFLA_GTP_FD1]);
+		int fd1 = nla_get_u32(data[IFLA_GTP_FD1]);
 
-		sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp);
-		if (IS_ERR(sk1u)) {
-			gtp_encap_disable_sock(sk0);
-			return PTR_ERR(sk1u);
+		if (fd1 >= 0) {
+			sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp);
+			if (IS_ERR(sk1u)) {
+				gtp_encap_disable_sock(sk0);
+				return PTR_ERR(sk1u);
+			}
 		}
 	}
 
@@ -1682,16 +1690,19 @@
 	struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp;
 	int i, j, bucket = cb->args[0], skip = cb->args[1];
 	struct net *net = sock_net(skb->sk);
+	struct net_device *dev;
 	struct pdp_ctx *pctx;
-	struct gtp_net *gn;
-
-	gn = net_generic(net, gtp_net_id);
 
 	if (cb->args[4])
 		return 0;
 
 	rcu_read_lock();
-	list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) {
+	for_each_netdev_rcu(net, dev) {
+		if (dev->rtnl_link_ops != &gtp_link_ops)
+			continue;
+
+		gtp = netdev_priv(dev);
+
 		if (last_gtp && last_gtp != gtp)
 			continue;
 		else
@@ -1876,23 +1887,23 @@
 	return 0;
 }
 
-static void __net_exit gtp_net_exit(struct net *net)
+static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list,
+					       struct list_head *dev_to_kill)
 {
-	struct gtp_net *gn = net_generic(net, gtp_net_id);
-	struct gtp_dev *gtp;
-	LIST_HEAD(list);
+	struct net *net;
 
-	rtnl_lock();
-	list_for_each_entry(gtp, &gn->gtp_dev_list, list)
-		gtp_dellink(gtp->dev, &list);
+	list_for_each_entry(net, net_list, exit_list) {
+		struct gtp_net *gn = net_generic(net, gtp_net_id);
+		struct gtp_dev *gtp, *gtp_next;
 
-	unregister_netdevice_many(&list);
-	rtnl_unlock();
+		list_for_each_entry_safe(gtp, gtp_next, &gn->gtp_dev_list, list)
+			gtp_dellink(gtp->dev, dev_to_kill);
+	}
 }
 
 static struct pernet_operations gtp_net_ops = {
 	.init	= gtp_net_init,
-	.exit	= gtp_net_exit,
+	.exit_batch_rtnl = gtp_net_exit_batch_rtnl,
 	.id	= &gtp_net_id,
 	.size	= sizeof(struct gtp_net),
 };
--- linux-qcom-6.8.0.orig/drivers/net/hyperv/netvsc.c
+++ linux-qcom-6.8.0/drivers/net/hyperv/netvsc.c
@@ -154,8 +154,11 @@
 	int i;
 
 	kfree(nvdev->extension);
-	vfree(nvdev->recv_buf);
-	vfree(nvdev->send_buf);
+
+	if (!nvdev->recv_buf_gpadl_handle.decrypted)
+		vfree(nvdev->recv_buf);
+	if (!nvdev->send_buf_gpadl_handle.decrypted)
+		vfree(nvdev->send_buf);
 	bitmap_free(nvdev->send_section_map);
 
 	for (i = 0; i < VRSS_CHANNEL_MAX; i++) {
--- linux-qcom-6.8.0.orig/drivers/net/hyperv/netvsc_drv.c
+++ linux-qcom-6.8.0/drivers/net/hyperv/netvsc_drv.c
@@ -2797,6 +2797,31 @@
 	},
 };
 
+/* Set VF's namespace same as the synthetic NIC */
+static void netvsc_event_set_vf_ns(struct net_device *ndev)
+{
+	struct net_device_context *ndev_ctx = netdev_priv(ndev);
+	struct net_device *vf_netdev;
+	int ret;
+
+	vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
+	if (!vf_netdev)
+		return;
+
+	if (!net_eq(dev_net(ndev), dev_net(vf_netdev))) {
+		ret = dev_change_net_namespace(vf_netdev, dev_net(ndev),
+					       "eth%d");
+		if (ret)
+			netdev_err(vf_netdev,
+				   "Cannot move to same namespace as %s: %d\n",
+				   ndev->name, ret);
+		else
+			netdev_info(vf_netdev,
+				    "Moved VF to namespace with: %s\n",
+				    ndev->name);
+	}
+}
+
 /*
  * On Hyper-V, every VF interface is matched with a corresponding
  * synthetic interface. The synthetic interface is presented first
@@ -2809,6 +2834,11 @@
 	struct net_device *event_dev = netdev_notifier_info_to_dev(ptr);
 	int ret = 0;
 
+	if (event_dev->netdev_ops == &device_ops && event == NETDEV_REGISTER) {
+		netvsc_event_set_vf_ns(event_dev);
+		return NOTIFY_DONE;
+	}
+
 	ret = check_dev_is_matching_vf(event_dev);
 	if (ret != 0)
 		return NOTIFY_DONE;
--- linux-qcom-6.8.0.orig/drivers/net/ieee802154/Kconfig
+++ linux-qcom-6.8.0/drivers/net/ieee802154/Kconfig
@@ -101,6 +101,7 @@
 
 config IEEE802154_MCR20A
 	tristate "MCR20A transceiver driver"
+	select REGMAP_SPI
 	depends on IEEE802154_DRIVERS && MAC802154
 	depends on SPI
 	help
--- linux-qcom-6.8.0.orig/drivers/net/ieee802154/ca8210.c
+++ linux-qcom-6.8.0/drivers/net/ieee802154/ca8210.c
@@ -3078,7 +3078,11 @@
 	spi_set_drvdata(priv->spi, priv);
 	if (IS_ENABLED(CONFIG_IEEE802154_CA8210_DEBUGFS)) {
 		cascoda_api_upstream = ca8210_test_int_driver_write;
-		ca8210_test_interface_init(priv);
+		ret = ca8210_test_interface_init(priv);
+		if (ret) {
+			dev_crit(&spi_device->dev, "ca8210_test_interface_init failed\n");
+			goto error;
+		}
 	} else {
 		cascoda_api_upstream = NULL;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/ieee802154/mcr20a.c
+++ linux-qcom-6.8.0/drivers/net/ieee802154/mcr20a.c
@@ -1303,16 +1303,13 @@
 		irq_type = IRQF_TRIGGER_FALLING;
 
 	ret = devm_request_irq(&spi->dev, spi->irq, mcr20a_irq_isr,
-			       irq_type, dev_name(&spi->dev), lp);
+			       irq_type | IRQF_NO_AUTOEN, dev_name(&spi->dev), lp);
 	if (ret) {
 		dev_err(&spi->dev, "could not request_irq for mcr20a\n");
 		ret = -ENODEV;
 		goto free_dev;
 	}
 
-	/* disable_irq by default and wait for starting hardware */
-	disable_irq(spi->irq);
-
 	ret = ieee802154_register_hw(hw);
 	if (ret) {
 		dev_crit(&spi->dev, "ieee802154_register_hw failed\n");
--- linux-qcom-6.8.0.orig/drivers/net/ipa/ipa_smp2p.c
+++ linux-qcom-6.8.0/drivers/net/ipa/ipa_smp2p.c
@@ -92,7 +92,7 @@
 		return;
 
 	dev = &smp2p->ipa->pdev->dev;
-	smp2p->power_on = pm_runtime_get_if_active(dev, true) > 0;
+	smp2p->power_on = pm_runtime_get_if_active(dev) > 0;
 
 	/* Signal whether the IPA power is enabled */
 	mask = BIT(smp2p->enabled_bit);
--- linux-qcom-6.8.0.orig/drivers/net/ipvlan/ipvlan_core.c
+++ linux-qcom-6.8.0/drivers/net/ipvlan/ipvlan_core.c
@@ -439,7 +439,7 @@
 
 	memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
-	err = ip_local_out(net, skb->sk, skb);
+	err = ip_local_out(net, NULL, skb);
 	if (unlikely(net_xmit_eval(err)))
 		DEV_STATS_INC(dev, tx_errors);
 	else
@@ -494,7 +494,7 @@
 
 	memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
 
-	err = ip6_local_out(dev_net(dev), skb->sk, skb);
+	err = ip6_local_out(dev_net(dev), NULL, skb);
 	if (unlikely(net_xmit_eval(err)))
 		DEV_STATS_INC(dev, tx_errors);
 	else
--- linux-qcom-6.8.0.orig/drivers/net/loopback.c
+++ linux-qcom-6.8.0/drivers/net/loopback.c
@@ -144,6 +144,7 @@
 	dev->lstats = netdev_alloc_pcpu_stats(struct pcpu_lstats);
 	if (!dev->lstats)
 		return -ENOMEM;
+	netdev_lockdep_set_classes(dev);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/macsec.c
+++ linux-qcom-6.8.0/drivers/net/macsec.c
@@ -154,19 +154,6 @@
 	return sa;
 }
 
-static struct macsec_rx_sa *macsec_active_rxsa_get(struct macsec_rx_sc *rx_sc)
-{
-	struct macsec_rx_sa *sa = NULL;
-	int an;
-
-	for (an = 0; an < MACSEC_NUM_AN; an++)	{
-		sa = macsec_rxsa_get(rx_sc->sa[an]);
-		if (sa)
-			break;
-	}
-	return sa;
-}
-
 static void free_rx_sc_rcu(struct rcu_head *head)
 {
 	struct macsec_rx_sc *rx_sc = container_of(head, struct macsec_rx_sc, rcu_head);
@@ -999,10 +986,12 @@
 	struct metadata_dst *md_dst;
 	struct macsec_rxh_data *rxd;
 	struct macsec_dev *macsec;
+	bool is_macsec_md_dst;
 
 	rcu_read_lock();
 	rxd = macsec_data_rcu(skb->dev);
 	md_dst = skb_metadata_dst(skb);
+	is_macsec_md_dst = md_dst && md_dst->type == METADATA_MACSEC;
 
 	list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
 		struct sk_buff *nskb;
@@ -1013,14 +1002,42 @@
 		 * the SecTAG, so we have to deduce which port to deliver to.
 		 */
 		if (macsec_is_offloaded(macsec) && netif_running(ndev)) {
-			struct macsec_rx_sc *rx_sc = NULL;
+			const struct macsec_ops *ops;
 
-			if (md_dst && md_dst->type == METADATA_MACSEC)
-				rx_sc = find_rx_sc(&macsec->secy, md_dst->u.macsec_info.sci);
+			ops = macsec_get_ops(macsec, NULL);
 
-			if (md_dst && md_dst->type == METADATA_MACSEC && !rx_sc)
+			if (ops->rx_uses_md_dst && !is_macsec_md_dst)
 				continue;
 
+			if (is_macsec_md_dst) {
+				struct macsec_rx_sc *rx_sc;
+
+				/* All drivers that implement MACsec offload
+				 * support using skb metadata destinations must
+				 * indicate that they do so.
+				 */
+				DEBUG_NET_WARN_ON_ONCE(!ops->rx_uses_md_dst);
+				rx_sc = find_rx_sc(&macsec->secy,
+						   md_dst->u.macsec_info.sci);
+				if (!rx_sc)
+					continue;
+				/* device indicated macsec offload occurred */
+				skb->dev = ndev;
+				skb->pkt_type = PACKET_HOST;
+				eth_skb_pkt_type(skb, ndev);
+				ret = RX_HANDLER_ANOTHER;
+				goto out;
+			}
+
+			/* This datapath is insecure because it is unable to
+			 * enforce isolation of broadcast/multicast traffic and
+			 * unicast traffic with promiscuous mode on the macsec
+			 * netdev. Since the core stack has no mechanism to
+			 * check that the hardware did indeed receive MACsec
+			 * traffic, it is possible that the response handling
+			 * done by the MACsec port was to a plaintext packet.
+			 * This violates the MACsec protocol standard.
+			 */
 			if (ether_addr_equal_64bits(hdr->h_dest,
 						    ndev->dev_addr)) {
 				/* exact match, divert skb to this port */
@@ -1036,14 +1053,10 @@
 					break;
 
 				nskb->dev = ndev;
-				if (ether_addr_equal_64bits(hdr->h_dest,
-							    ndev->broadcast))
-					nskb->pkt_type = PACKET_BROADCAST;
-				else
-					nskb->pkt_type = PACKET_MULTICAST;
+				eth_skb_pkt_type(nskb, ndev);
 
 				__netif_rx(nskb);
-			} else if (rx_sc || ndev->flags & IFF_PROMISC) {
+			} else if (ndev->flags & IFF_PROMISC) {
 				skb->dev = ndev;
 				skb->pkt_type = PACKET_HOST;
 				ret = RX_HANDLER_ANOTHER;
@@ -1182,15 +1195,12 @@
 		/* If validateFrames is Strict or the C bit in the
 		 * SecTAG is set, discard
 		 */
-		struct macsec_rx_sa *active_rx_sa = macsec_active_rxsa_get(rx_sc);
 		if (hdr->tci_an & MACSEC_TCI_C ||
 		    secy->validate_frames == MACSEC_VALIDATE_STRICT) {
 			u64_stats_update_begin(&rxsc_stats->syncp);
 			rxsc_stats->stats.InPktsNotUsingSA++;
 			u64_stats_update_end(&rxsc_stats->syncp);
 			DEV_STATS_INC(secy->netdev, rx_errors);
-			if (active_rx_sa)
-				this_cpu_inc(active_rx_sa->stats->InPktsNotUsingSA);
 			goto drop_nosa;
 		}
 
@@ -1200,8 +1210,6 @@
 		u64_stats_update_begin(&rxsc_stats->syncp);
 		rxsc_stats->stats.InPktsUnusedSA++;
 		u64_stats_update_end(&rxsc_stats->syncp);
-		if (active_rx_sa)
-			this_cpu_inc(active_rx_sa->stats->InPktsUnusedSA);
 		goto deliver;
 	}
 
@@ -3796,8 +3804,7 @@
 {
 	struct macsec_dev *macsec = macsec_priv(dev);
 
-	if (macsec->secy.tx_sc.md_dst)
-		metadata_dst_free(macsec->secy.tx_sc.md_dst);
+	dst_release(&macsec->secy.tx_sc.md_dst->dst);
 	free_percpu(macsec->stats);
 	free_percpu(macsec->secy.tx_sc.stats);
 
--- linux-qcom-6.8.0.orig/drivers/net/mctp/mctp-i2c.c
+++ linux-qcom-6.8.0/drivers/net/mctp/mctp-i2c.c
@@ -547,6 +547,9 @@
 	if (len > MCTP_I2C_MAXMTU)
 		return -EMSGSIZE;
 
+	if (!daddr || !saddr)
+		return -EINVAL;
+
 	lldst = *((u8 *)daddr);
 	llsrc = *((u8 *)saddr);
 
--- linux-qcom-6.8.0.orig/drivers/net/mctp/mctp-i3c.c
+++ linux-qcom-6.8.0/drivers/net/mctp/mctp-i3c.c
@@ -125,6 +125,8 @@
 
 	xfer.data.in = skb_put(skb, mi->mrl);
 
+	/* Make sure netif_rx() is read in the same order as i3c. */
+	mutex_lock(&mi->lock);
 	rc = i3c_device_do_priv_xfers(mi->i3c, &xfer, 1);
 	if (rc < 0)
 		goto err;
@@ -166,8 +168,10 @@
 		stats->rx_dropped++;
 	}
 
+	mutex_unlock(&mi->lock);
 	return 0;
 err:
+	mutex_unlock(&mi->lock);
 	kfree_skb(skb);
 	return rc;
 }
--- linux-qcom-6.8.0.orig/drivers/net/mctp/mctp-serial.c
+++ linux-qcom-6.8.0/drivers/net/mctp/mctp-serial.c
@@ -91,8 +91,8 @@
 	 * will be those non-escaped bytes, and does not include the escaped
 	 * byte.
 	 */
-	for (i = 1; i + dev->txpos + 1 < dev->txlen; i++) {
-		if (needs_escape(dev->txbuf[dev->txpos + i + 1]))
+	for (i = 1; i + dev->txpos < dev->txlen; i++) {
+		if (needs_escape(dev->txbuf[dev->txpos + i]))
 			break;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/mdio/fwnode_mdio.c
+++ linux-qcom-6.8.0/drivers/net/mdio/fwnode_mdio.c
@@ -39,6 +39,7 @@
 static struct mii_timestamper *
 fwnode_find_mii_timestamper(struct fwnode_handle *fwnode)
 {
+	struct mii_timestamper *mii_ts;
 	struct of_phandle_args arg;
 	int err;
 
@@ -52,10 +53,16 @@
 	else if (err)
 		return ERR_PTR(err);
 
-	if (arg.args_count != 1)
-		return ERR_PTR(-EINVAL);
+	if (arg.args_count != 1) {
+		mii_ts = ERR_PTR(-EINVAL);
+		goto put_node;
+	}
 
-	return register_mii_timestamper(arg.np, arg.args[0]);
+	mii_ts = register_mii_timestamper(arg.np, arg.args[0]);
+
+put_node:
+	of_node_put(arg.np);
+	return mii_ts;
 }
 
 int fwnode_mdiobus_phy_device_register(struct mii_bus *mdio,
--- linux-qcom-6.8.0.orig/drivers/net/mdio/mdio-bcm-unimac.c
+++ linux-qcom-6.8.0/drivers/net/mdio/mdio-bcm-unimac.c
@@ -329,6 +329,7 @@
 static const struct of_device_id unimac_mdio_ids[] = {
 	{ .compatible = "brcm,asp-v2.1-mdio", },
 	{ .compatible = "brcm,asp-v2.0-mdio", },
+	{ .compatible = "brcm,bcm6846-mdio", },
 	{ .compatible = "brcm,genet-mdio-v5", },
 	{ .compatible = "brcm,genet-mdio-v4", },
 	{ .compatible = "brcm,genet-mdio-v3", },
--- linux-qcom-6.8.0.orig/drivers/net/mdio/mdio-ipq4019.c
+++ linux-qcom-6.8.0/drivers/net/mdio/mdio-ipq4019.c
@@ -255,8 +255,11 @@
 	/* The platform resource is provided on the chipset IPQ5018 */
 	/* This resource is optional */
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-	if (res)
+	if (res) {
 		priv->eth_ldo_rdy = devm_ioremap_resource(&pdev->dev, res);
+		if (IS_ERR(priv->eth_ldo_rdy))
+			return PTR_ERR(priv->eth_ldo_rdy);
+	}
 
 	bus->name = "ipq4019_mdio";
 	bus->read = ipq4019_mdio_read_c22;
--- linux-qcom-6.8.0.orig/drivers/net/mhi_ep_net.c
+++ linux-qcom-6.8.0/drivers/net/mhi_ep_net.c
@@ -0,0 +1,332 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * MHI Endpoint Network driver
+ *
+ * Based on drivers/net/mhi_net.c
+ *
+ * Copyright (c) 2023, Linaro Ltd.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * Author: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+ */
+
+#include <linux/if_arp.h>
+#include <linux/mhi_ep.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/u64_stats_sync.h>
+
+#define MHI_NET_MIN_MTU		ETH_MIN_MTU
+#define MHI_NET_MAX_MTU		0xffff
+
+struct mhi_ep_net_stats {
+	u64_stats_t rx_packets;
+	u64_stats_t rx_bytes;
+	u64_stats_t rx_errors;
+	u64_stats_t tx_packets;
+	u64_stats_t tx_bytes;
+	u64_stats_t tx_errors;
+	u64_stats_t tx_dropped;
+	struct u64_stats_sync tx_syncp;
+	struct u64_stats_sync rx_syncp;
+};
+
+struct mhi_ep_net_dev {
+	struct mhi_ep_device *mdev;
+	struct net_device *ndev;
+	struct mhi_ep_net_stats stats;
+	struct workqueue_struct *xmit_wq;
+	struct work_struct xmit_work;
+	struct sk_buff_head tx_buffers;
+	spinlock_t tx_lock; /* Lock for protecting tx_buffers */
+	u32 mru;
+};
+
+static void mhi_ep_net_dev_process_queue_packets(struct work_struct *work)
+{
+	struct mhi_ep_net_dev *mhi_ep_netdev = container_of(work,
+			struct mhi_ep_net_dev, xmit_work);
+	struct mhi_ep_device *mdev = mhi_ep_netdev->mdev;
+	struct sk_buff_head q;
+	struct sk_buff *skb;
+	int ret;
+
+	if (mhi_ep_queue_is_empty(mdev, DMA_FROM_DEVICE)) {
+		netif_stop_queue(mhi_ep_netdev->ndev);
+		return;
+	}
+
+	__skb_queue_head_init(&q);
+
+	spin_lock_bh(&mhi_ep_netdev->tx_lock);
+	skb_queue_splice_init(&mhi_ep_netdev->tx_buffers, &q);
+	spin_unlock_bh(&mhi_ep_netdev->tx_lock);
+
+	while ((skb = __skb_dequeue(&q))) {
+		ret = mhi_ep_queue_skb(mdev, skb);
+		if (ret) {
+			kfree_skb(skb);
+			goto exit_drop;
+		}
+
+		u64_stats_update_begin(&mhi_ep_netdev->stats.tx_syncp);
+		u64_stats_inc(&mhi_ep_netdev->stats.tx_packets);
+		u64_stats_add(&mhi_ep_netdev->stats.tx_bytes, skb->len);
+		u64_stats_update_end(&mhi_ep_netdev->stats.tx_syncp);
+
+		/* Check if queue is empty */
+		if (mhi_ep_queue_is_empty(mdev, DMA_FROM_DEVICE)) {
+			netif_stop_queue(mhi_ep_netdev->ndev);
+			break;
+		}
+
+		consume_skb(skb);
+		cond_resched();
+	}
+
+	return;
+
+exit_drop:
+	u64_stats_update_begin(&mhi_ep_netdev->stats.tx_syncp);
+	u64_stats_inc(&mhi_ep_netdev->stats.tx_dropped);
+	u64_stats_update_end(&mhi_ep_netdev->stats.tx_syncp);
+}
+
+static int mhi_ndo_open(struct net_device *ndev)
+{
+	netif_carrier_on(ndev);
+	netif_start_queue(ndev);
+
+	return 0;
+}
+
+static int mhi_ndo_stop(struct net_device *ndev)
+{
+	netif_stop_queue(ndev);
+	netif_carrier_off(ndev);
+
+	return 0;
+}
+
+static netdev_tx_t mhi_ndo_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+	struct mhi_ep_net_dev *mhi_ep_netdev = netdev_priv(ndev);
+
+	spin_lock(&mhi_ep_netdev->tx_lock);
+	skb_queue_tail(&mhi_ep_netdev->tx_buffers, skb);
+	spin_unlock(&mhi_ep_netdev->tx_lock);
+
+	queue_work(mhi_ep_netdev->xmit_wq, &mhi_ep_netdev->xmit_work);
+
+	return NETDEV_TX_OK;
+}
+
+static void mhi_ndo_get_stats64(struct net_device *ndev,
+				struct rtnl_link_stats64 *stats)
+{
+	struct mhi_ep_net_dev *mhi_ep_netdev = netdev_priv(ndev);
+	unsigned int start;
+
+	do {
+		start = u64_stats_fetch_begin(&mhi_ep_netdev->stats.rx_syncp);
+		stats->rx_packets = u64_stats_read(&mhi_ep_netdev->stats.rx_packets);
+		stats->rx_bytes = u64_stats_read(&mhi_ep_netdev->stats.rx_bytes);
+		stats->rx_errors = u64_stats_read(&mhi_ep_netdev->stats.rx_errors);
+	} while (u64_stats_fetch_retry(&mhi_ep_netdev->stats.rx_syncp, start));
+
+	do {
+		start = u64_stats_fetch_begin(&mhi_ep_netdev->stats.tx_syncp);
+		stats->tx_packets = u64_stats_read(&mhi_ep_netdev->stats.tx_packets);
+		stats->tx_bytes = u64_stats_read(&mhi_ep_netdev->stats.tx_bytes);
+		stats->tx_errors = u64_stats_read(&mhi_ep_netdev->stats.tx_errors);
+		stats->tx_dropped = u64_stats_read(&mhi_ep_netdev->stats.tx_dropped);
+	} while (u64_stats_fetch_retry(&mhi_ep_netdev->stats.tx_syncp, start));
+}
+
+static const struct net_device_ops mhi_ep_netdev_ops = {
+	.ndo_open               = mhi_ndo_open,
+	.ndo_stop               = mhi_ndo_stop,
+	.ndo_start_xmit         = mhi_ndo_xmit,
+	.ndo_get_stats64	= mhi_ndo_get_stats64,
+};
+
+static void mhi_ep_net_setup(struct net_device *ndev)
+{
+	ndev->header_ops = NULL;  /* No header */
+	ndev->type = ARPHRD_RAWIP;
+	ndev->hard_header_len = 0;
+	ndev->addr_len = 0;
+	ndev->flags = IFF_POINTOPOINT | IFF_NOARP;
+	ndev->netdev_ops = &mhi_ep_netdev_ops;
+	ndev->mtu = MHI_EP_DEFAULT_MTU;
+	ndev->min_mtu = MHI_NET_MIN_MTU;
+	ndev->max_mtu = MHI_NET_MAX_MTU;
+	ndev->tx_queue_len = 1000;
+}
+
+static void mhi_ep_net_ul_callback(struct mhi_ep_device *mhi_dev,
+				   struct mhi_result *mhi_res)
+{
+	struct mhi_ep_net_dev *mhi_ep_netdev = dev_get_drvdata(&mhi_dev->dev);
+	struct net_device *ndev = mhi_ep_netdev->ndev;
+	struct sk_buff *skb;
+	size_t size;
+
+	size = mhi_ep_netdev->mru ? mhi_ep_netdev->mru : READ_ONCE(ndev->mtu);
+
+	skb = netdev_alloc_skb(ndev, size);
+	if (unlikely(!skb)) {
+		u64_stats_update_begin(&mhi_ep_netdev->stats.rx_syncp);
+		u64_stats_inc(&mhi_ep_netdev->stats.rx_errors);
+		u64_stats_update_end(&mhi_ep_netdev->stats.rx_syncp);
+		return;
+	}
+
+	skb_copy_to_linear_data(skb, mhi_res->buf_addr, mhi_res->bytes_xferd);
+	skb->len = mhi_res->bytes_xferd;
+	skb->dev = mhi_ep_netdev->ndev;
+
+	if (unlikely(mhi_res->transaction_status)) {
+		switch (mhi_res->transaction_status) {
+		case -ENOTCONN:
+			/* MHI layer stopping/resetting the UL channel */
+			dev_kfree_skb_any(skb);
+			return;
+		default:
+			/* Unknown error, simply drop */
+			dev_kfree_skb_any(skb);
+			u64_stats_update_begin(&mhi_ep_netdev->stats.rx_syncp);
+			u64_stats_inc(&mhi_ep_netdev->stats.rx_errors);
+			u64_stats_update_end(&mhi_ep_netdev->stats.rx_syncp);
+		}
+	} else {
+		skb_put(skb, mhi_res->bytes_xferd);
+
+		switch (skb->data[0] & 0xf0) {
+		case 0x40:
+			skb->protocol = htons(ETH_P_IP);
+			break;
+		case 0x60:
+			skb->protocol = htons(ETH_P_IPV6);
+			break;
+		default:
+			skb->protocol = htons(ETH_P_MAP);
+			break;
+		}
+
+		u64_stats_update_begin(&mhi_ep_netdev->stats.rx_syncp);
+		u64_stats_inc(&mhi_ep_netdev->stats.rx_packets);
+		u64_stats_add(&mhi_ep_netdev->stats.rx_bytes, skb->len);
+		u64_stats_update_end(&mhi_ep_netdev->stats.rx_syncp);
+		netif_rx(skb);
+	}
+}
+
+static void mhi_ep_net_dl_callback(struct mhi_ep_device *mhi_dev,
+				   struct mhi_result *mhi_res)
+{
+	struct mhi_ep_net_dev *mhi_ep_netdev = dev_get_drvdata(&mhi_dev->dev);
+
+	if (unlikely(mhi_res->transaction_status == -ENOTCONN))
+		return;
+
+	/* Since we got enough buffers to queue, wake the queue if stopped */
+	if (netif_queue_stopped(mhi_ep_netdev->ndev)) {
+		netif_wake_queue(mhi_ep_netdev->ndev);
+		queue_work(mhi_ep_netdev->xmit_wq, &mhi_ep_netdev->xmit_work);
+	}
+}
+
+static int mhi_ep_net_newlink(struct mhi_ep_device *mhi_dev, struct net_device *ndev)
+{
+	struct mhi_ep_net_dev *mhi_ep_netdev;
+	int ret;
+
+	mhi_ep_netdev = netdev_priv(ndev);
+
+	dev_set_drvdata(&mhi_dev->dev, mhi_ep_netdev);
+	mhi_ep_netdev->ndev = ndev;
+	mhi_ep_netdev->mdev = mhi_dev;
+	mhi_ep_netdev->mru = mhi_dev->mhi_cntrl->mru;
+
+	skb_queue_head_init(&mhi_ep_netdev->tx_buffers);
+	spin_lock_init(&mhi_ep_netdev->tx_lock);
+
+	u64_stats_init(&mhi_ep_netdev->stats.rx_syncp);
+	u64_stats_init(&mhi_ep_netdev->stats.tx_syncp);
+
+	mhi_ep_netdev->xmit_wq = alloc_workqueue("mhi_ep_net_xmit_wq", 0, WQ_HIGHPRI);
+	INIT_WORK(&mhi_ep_netdev->xmit_work, mhi_ep_net_dev_process_queue_packets);
+
+	ret = register_netdev(ndev);
+	if (ret) {
+		destroy_workqueue(mhi_ep_netdev->xmit_wq);
+		return ret;
+	}
+
+	return 0;
+}
+
+static void mhi_ep_net_dellink(struct mhi_ep_device *mhi_dev, struct net_device *ndev)
+{
+	struct mhi_ep_net_dev *mhi_ep_netdev = netdev_priv(ndev);
+
+	destroy_workqueue(mhi_ep_netdev->xmit_wq);
+	unregister_netdev(ndev);
+	free_netdev(ndev);
+	dev_set_drvdata(&mhi_dev->dev, NULL);
+}
+
+static int mhi_ep_net_probe(struct mhi_ep_device *mhi_dev, const struct mhi_device_id *id)
+{
+	struct net_device *ndev;
+	int ret;
+
+	ndev = alloc_netdev(sizeof(struct mhi_ep_net_dev), (const char *)id->driver_data,
+			    NET_NAME_PREDICTABLE, mhi_ep_net_setup);
+	if (!ndev)
+		return -ENOMEM;
+
+	SET_NETDEV_DEV(ndev, &mhi_dev->dev);
+
+	ret = mhi_ep_net_newlink(mhi_dev, ndev);
+	if (ret) {
+		free_netdev(ndev);
+		return ret;
+	}
+
+	return 0;
+}
+
+static void mhi_ep_net_remove(struct mhi_ep_device *mhi_dev)
+{
+	struct mhi_ep_net_dev *mhi_ep_netdev = dev_get_drvdata(&mhi_dev->dev);
+
+	mhi_ep_net_dellink(mhi_dev, mhi_ep_netdev->ndev);
+}
+
+static const struct mhi_device_id mhi_ep_net_id_table[] = {
+	/* Software data PATH (from endpoint CPU) */
+	{ .chan = "IP_SW0", .driver_data = (kernel_ulong_t)"mhi_swip%d" },
+	{}
+};
+MODULE_DEVICE_TABLE(mhi, mhi_ep_net_id_table);
+
+static struct mhi_ep_driver mhi_ep_net_driver = {
+	.probe = mhi_ep_net_probe,
+	.remove = mhi_ep_net_remove,
+	.dl_xfer_cb = mhi_ep_net_dl_callback,
+	.ul_xfer_cb = mhi_ep_net_ul_callback,
+	.id_table = mhi_ep_net_id_table,
+	.driver = {
+		.name = "mhi_ep_net",
+		.owner = THIS_MODULE,
+	},
+};
+
+module_mhi_ep_driver(mhi_ep_net_driver);
+
+MODULE_DESCRIPTION("MHI Endpoint Network driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/net/netconsole.c
+++ linux-qcom-6.8.0/drivers/net/netconsole.c
@@ -763,6 +763,7 @@
 				/* rtnl_lock already held
 				 * we might sleep in __netpoll_cleanup()
 				 */
+				nt->enabled = false;
 				spin_unlock_irqrestore(&target_list_lock, flags);
 
 				__netpoll_cleanup(&nt->np);
@@ -770,7 +771,6 @@
 				spin_lock_irqsave(&target_list_lock, flags);
 				netdev_put(nt->np.dev, &nt->np.dev_tracker);
 				nt->np.dev = NULL;
-				nt->enabled = false;
 				stopped = true;
 				netconsole_target_put(nt);
 				goto restart;
--- linux-qcom-6.8.0.orig/drivers/net/netdevsim/dev.c
+++ linux-qcom-6.8.0/drivers/net/netdevsim/dev.c
@@ -836,7 +836,8 @@
 	nsim_dev = nsim_trap_data->nsim_dev;
 
 	if (!devl_trylock(priv_to_devlink(nsim_dev))) {
-		schedule_delayed_work(&nsim_dev->trap_data->trap_report_dw, 1);
+		queue_delayed_work(system_unbound_wq,
+				   &nsim_dev->trap_data->trap_report_dw, 1);
 		return;
 	}
 
@@ -848,11 +849,12 @@
 			continue;
 
 		nsim_dev_trap_report(nsim_dev_port);
+		cond_resched();
 	}
 	devl_unlock(priv_to_devlink(nsim_dev));
-
-	schedule_delayed_work(&nsim_dev->trap_data->trap_report_dw,
-			      msecs_to_jiffies(NSIM_TRAP_REPORT_INTERVAL_MS));
+	queue_delayed_work(system_unbound_wq,
+			   &nsim_dev->trap_data->trap_report_dw,
+			   msecs_to_jiffies(NSIM_TRAP_REPORT_INTERVAL_MS));
 }
 
 static int nsim_dev_traps_init(struct devlink *devlink)
@@ -907,8 +909,9 @@
 
 	INIT_DELAYED_WORK(&nsim_dev->trap_data->trap_report_dw,
 			  nsim_dev_trap_report_work);
-	schedule_delayed_work(&nsim_dev->trap_data->trap_report_dw,
-			      msecs_to_jiffies(NSIM_TRAP_REPORT_INTERVAL_MS));
+	queue_delayed_work(system_unbound_wq,
+			   &nsim_dev->trap_data->trap_report_dw,
+			   msecs_to_jiffies(NSIM_TRAP_REPORT_INTERVAL_MS));
 
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/net/netdevsim/fib.c
+++ linux-qcom-6.8.0/drivers/net/netdevsim/fib.c
@@ -1377,10 +1377,12 @@
 
 	if (pos != 0)
 		return -EINVAL;
-	if (size > sizeof(buf))
+	if (size > sizeof(buf) - 1)
 		return -EINVAL;
 	if (copy_from_user(buf, user_buf, size))
 		return -EFAULT;
+	buf[size] = 0;
+
 	if (sscanf(buf, "%u %hu", &nhid, &bucket_index) != 2)
 		return -EINVAL;
 
--- linux-qcom-6.8.0.orig/drivers/net/netdevsim/health.c
+++ linux-qcom-6.8.0/drivers/net/netdevsim/health.c
@@ -149,6 +149,8 @@
 	char *break_msg;
 	int err;
 
+	if (count == 0 || count > PAGE_SIZE)
+		return -EINVAL;
 	break_msg = memdup_user_nul(data, count);
 	if (IS_ERR(break_msg))
 		return PTR_ERR(break_msg);
--- linux-qcom-6.8.0.orig/drivers/net/netdevsim/ipsec.c
+++ linux-qcom-6.8.0/drivers/net/netdevsim/ipsec.c
@@ -176,14 +176,13 @@
 		return ret;
 	}
 
-	if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) {
+	if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN)
 		sa.rx = true;
 
-		if (xs->props.family == AF_INET6)
-			memcpy(sa.ipaddr, &xs->id.daddr.a6, 16);
-		else
-			memcpy(&sa.ipaddr[3], &xs->id.daddr.a4, 4);
-	}
+	if (xs->props.family == AF_INET6)
+		memcpy(sa.ipaddr, &xs->id.daddr.a6, 16);
+	else
+		memcpy(&sa.ipaddr[3], &xs->id.daddr.a4, 4);
 
 	/* the preparations worked, so save the info */
 	memcpy(&ipsec->sa[sa_idx], &sa, sizeof(sa));
--- linux-qcom-6.8.0.orig/drivers/net/netkit.c
+++ linux-qcom-6.8.0/drivers/net/netkit.c
@@ -20,6 +20,7 @@
 	struct net_device __rcu *peer;
 	struct bpf_mprog_entry __rcu *active;
 	enum netkit_action policy;
+	enum netkit_scrub scrub;
 	struct bpf_mprog_bundle	bundle;
 
 	/* Needed in slow-path */
@@ -50,11 +51,24 @@
 	return ret;
 }
 
-static void netkit_prep_forward(struct sk_buff *skb, bool xnet)
+static void netkit_xnet(struct sk_buff *skb)
 {
-	skb_scrub_packet(skb, xnet);
 	skb->priority = 0;
+	skb->mark = 0;
+}
+
+static void netkit_prep_forward(struct sk_buff *skb,
+				bool xnet, bool xnet_scrub)
+{
+	skb_scrub_packet(skb, false);
 	nf_skip_egress(skb, true);
+	skb_reset_mac_header(skb);
+	if (!xnet)
+		return;
+	ipvs_reset(skb);
+	skb_clear_tstamp(skb);
+	if (xnet_scrub)
+		netkit_xnet(skb);
 }
 
 static struct netkit *netkit_priv(const struct net_device *dev)
@@ -77,7 +91,9 @@
 		     !pskb_may_pull(skb, ETH_HLEN) ||
 		     skb_orphan_frags(skb, GFP_ATOMIC)))
 		goto drop;
-	netkit_prep_forward(skb, !net_eq(dev_net(dev), dev_net(peer)));
+	netkit_prep_forward(skb, !net_eq(dev_net(dev), dev_net(peer)),
+			    nk->scrub);
+	eth_skb_pkt_type(skb, peer);
 	skb->dev = peer;
 	entry = rcu_dereference(nk->active);
 	if (entry)
@@ -85,7 +101,7 @@
 	switch (ret) {
 	case NETKIT_NEXT:
 	case NETKIT_PASS:
-		skb->protocol = eth_type_trans(skb, skb->dev);
+		eth_skb_pull_mac(skb);
 		skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 		if (likely(__netif_rx(skb) == NET_RX_SUCCESS)) {
 			dev_sw_netstats_tx_add(dev, 1, len);
@@ -155,6 +171,16 @@
 	/* Nothing to do, we receive whatever gets pushed to us! */
 }
 
+static int netkit_set_macaddr(struct net_device *dev, void *sa)
+{
+	struct netkit *nk = netkit_priv(dev);
+
+	if (nk->mode != NETKIT_L2)
+		return -EOPNOTSUPP;
+
+	return eth_mac_addr(dev, sa);
+}
+
 static void netkit_set_headroom(struct net_device *dev, int headroom)
 {
 	struct netkit *nk = netkit_priv(dev), *nk2;
@@ -198,6 +224,7 @@
 	.ndo_start_xmit		= netkit_xmit,
 	.ndo_set_rx_mode	= netkit_set_multicast,
 	.ndo_set_rx_headroom	= netkit_set_headroom,
+	.ndo_set_mac_address	= netkit_set_macaddr,
 	.ndo_get_iflink		= netkit_get_iflink,
 	.ndo_get_peer_dev	= netkit_peer_dev,
 	.ndo_get_stats64	= netkit_get_stats,
@@ -300,9 +327,11 @@
 
 	if (!attr)
 		return 0;
-	NL_SET_ERR_MSG_ATTR(extack, attr,
-			    "Setting Ethernet address is not supported");
-	return -EOPNOTSUPP;
+	if (nla_len(attr) != ETH_ALEN)
+		return -EINVAL;
+	if (!is_valid_ether_addr(nla_data(attr)))
+		return -EADDRNOTAVAIL;
+	return 0;
 }
 
 static struct rtnl_link_ops netkit_link_ops;
@@ -312,8 +341,10 @@
 			   struct netlink_ext_ack *extack)
 {
 	struct nlattr *peer_tb[IFLA_MAX + 1], **tbp = tb, *attr;
-	enum netkit_action default_prim = NETKIT_PASS;
-	enum netkit_action default_peer = NETKIT_PASS;
+	enum netkit_action policy_prim = NETKIT_PASS;
+	enum netkit_action policy_peer = NETKIT_PASS;
+	enum netkit_scrub scrub_prim = NETKIT_SCRUB_DEFAULT;
+	enum netkit_scrub scrub_peer = NETKIT_SCRUB_DEFAULT;
 	enum netkit_mode mode = NETKIT_L3;
 	unsigned char ifname_assign_type;
 	struct ifinfomsg *ifmp = NULL;
@@ -342,17 +373,21 @@
 				return err;
 			tbp = peer_tb;
 		}
+		if (data[IFLA_NETKIT_SCRUB])
+			scrub_prim = nla_get_u32(data[IFLA_NETKIT_SCRUB]);
+		if (data[IFLA_NETKIT_PEER_SCRUB])
+			scrub_peer = nla_get_u32(data[IFLA_NETKIT_PEER_SCRUB]);
 		if (data[IFLA_NETKIT_POLICY]) {
 			attr = data[IFLA_NETKIT_POLICY];
-			default_prim = nla_get_u32(attr);
-			err = netkit_check_policy(default_prim, attr, extack);
+			policy_prim = nla_get_u32(attr);
+			err = netkit_check_policy(policy_prim, attr, extack);
 			if (err < 0)
 				return err;
 		}
 		if (data[IFLA_NETKIT_PEER_POLICY]) {
 			attr = data[IFLA_NETKIT_PEER_POLICY];
-			default_peer = nla_get_u32(attr);
-			err = netkit_check_policy(default_peer, attr, extack);
+			policy_peer = nla_get_u32(attr);
+			err = netkit_check_policy(policy_peer, attr, extack);
 			if (err < 0)
 				return err;
 		}
@@ -365,6 +400,9 @@
 		strscpy(ifname, "nk%d", IFNAMSIZ);
 		ifname_assign_type = NET_NAME_ENUM;
 	}
+	if (mode != NETKIT_L2 &&
+	    (tb[IFLA_ADDRESS] || tbp[IFLA_ADDRESS]))
+		return -EOPNOTSUPP;
 
 	net = rtnl_link_get_net(src_net, tbp);
 	if (IS_ERR(net))
@@ -379,14 +417,15 @@
 
 	netif_inherit_tso_max(peer, dev);
 
-	if (mode == NETKIT_L2)
+	if (mode == NETKIT_L2 && !(ifmp && tbp[IFLA_ADDRESS]))
 		eth_hw_addr_random(peer);
 	if (ifmp && dev->ifindex)
 		peer->ifindex = ifmp->ifi_index;
 
 	nk = netkit_priv(peer);
 	nk->primary = false;
-	nk->policy = default_peer;
+	nk->policy = policy_peer;
+	nk->scrub = scrub_peer;
 	nk->mode = mode;
 	bpf_mprog_bundle_init(&nk->bundle);
 
@@ -402,7 +441,7 @@
 	if (err < 0)
 		goto err_configure_peer;
 
-	if (mode == NETKIT_L2)
+	if (mode == NETKIT_L2 && !tb[IFLA_ADDRESS])
 		eth_hw_addr_random(dev);
 	if (tb[IFLA_IFNAME])
 		nla_strscpy(dev->name, tb[IFLA_IFNAME], IFNAMSIZ);
@@ -411,7 +450,8 @@
 
 	nk = netkit_priv(dev);
 	nk->primary = true;
-	nk->policy = default_prim;
+	nk->policy = policy_prim;
+	nk->scrub = scrub_prim;
 	nk->mode = mode;
 	bpf_mprog_bundle_init(&nk->bundle);
 
@@ -851,6 +891,18 @@
 		return -EACCES;
 	}
 
+	if (data[IFLA_NETKIT_SCRUB]) {
+		NL_SET_ERR_MSG_ATTR(extack, data[IFLA_NETKIT_SCRUB],
+				    "netkit scrubbing cannot be changed after device creation");
+		return -EACCES;
+	}
+
+	if (data[IFLA_NETKIT_PEER_SCRUB]) {
+		NL_SET_ERR_MSG_ATTR(extack, data[IFLA_NETKIT_PEER_SCRUB],
+				    "netkit scrubbing cannot be changed after device creation");
+		return -EACCES;
+	}
+
 	if (data[IFLA_NETKIT_PEER_INFO]) {
 		NL_SET_ERR_MSG_ATTR(extack, data[IFLA_NETKIT_PEER_INFO],
 				    "netkit peer info cannot be changed after device creation");
@@ -885,8 +937,10 @@
 {
 	return nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_POLICY */
 	       nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_PEER_POLICY */
-	       nla_total_size(sizeof(u8))  + /* IFLA_NETKIT_PRIMARY */
+	       nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_SCRUB */
+	       nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_PEER_SCRUB */
 	       nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_MODE */
+	       nla_total_size(sizeof(u8))  + /* IFLA_NETKIT_PRIMARY */
 	       0;
 }
 
@@ -901,11 +955,15 @@
 		return -EMSGSIZE;
 	if (nla_put_u32(skb, IFLA_NETKIT_MODE, nk->mode))
 		return -EMSGSIZE;
+	if (nla_put_u32(skb, IFLA_NETKIT_SCRUB, nk->scrub))
+		return -EMSGSIZE;
 
 	if (peer) {
 		nk = netkit_priv(peer);
 		if (nla_put_u32(skb, IFLA_NETKIT_PEER_POLICY, nk->policy))
 			return -EMSGSIZE;
+		if (nla_put_u32(skb, IFLA_NETKIT_PEER_SCRUB, nk->scrub))
+			return -EMSGSIZE;
 	}
 
 	return 0;
@@ -913,9 +971,11 @@
 
 static const struct nla_policy netkit_policy[IFLA_NETKIT_MAX + 1] = {
 	[IFLA_NETKIT_PEER_INFO]		= { .len = sizeof(struct ifinfomsg) },
-	[IFLA_NETKIT_POLICY]		= { .type = NLA_U32 },
 	[IFLA_NETKIT_MODE]		= { .type = NLA_U32 },
+	[IFLA_NETKIT_POLICY]		= { .type = NLA_U32 },
 	[IFLA_NETKIT_PEER_POLICY]	= { .type = NLA_U32 },
+	[IFLA_NETKIT_SCRUB]		= NLA_POLICY_MAX(NLA_U32, NETKIT_SCRUB_DEFAULT),
+	[IFLA_NETKIT_PEER_SCRUB]	= NLA_POLICY_MAX(NLA_U32, NETKIT_SCRUB_DEFAULT),
 	[IFLA_NETKIT_PRIMARY]		= { .type = NLA_REJECT,
 					    .reject_message = "Primary attribute is read-only" },
 };
--- linux-qcom-6.8.0.orig/drivers/net/ntb_netdev.c
+++ linux-qcom-6.8.0/drivers/net/ntb_netdev.c
@@ -119,7 +119,7 @@
 	skb->protocol = eth_type_trans(skb, ndev);
 	skb->ip_summed = CHECKSUM_NONE;
 
-	if (__netif_rx(skb) == NET_RX_DROP) {
+	if (netif_rx(skb) == NET_RX_DROP) {
 		ndev->stats.rx_errors++;
 		ndev->stats.rx_dropped++;
 	} else {
--- linux-qcom-6.8.0.orig/drivers/net/pcs/Makefile
+++ linux-qcom-6.8.0/drivers/net/pcs/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for Linux PCS drivers
 
-pcs_xpcs-$(CONFIG_PCS_XPCS)	:= pcs-xpcs.o pcs-xpcs-nxp.o pcs-xpcs-wx.o
+pcs_xpcs-$(CONFIG_PCS_XPCS)	:= pcs-xpcs.o pcs-xpcs-nxp.o pcs-xpcs-wx.o pcs-xpcs-qcom.o
 
 obj-$(CONFIG_PCS_XPCS)		+= pcs_xpcs.o
 obj-$(CONFIG_PCS_LYNX)		+= pcs-lynx.o
--- linux-qcom-6.8.0.orig/drivers/net/pcs/pcs-xpcs-qcom.c
+++ linux-qcom-6.8.0/drivers/net/pcs/pcs-xpcs-qcom.c
@@ -0,0 +1,853 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Synopsys DesignWare XPCS platform device driver
+ *
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/pcs-xpcs-qcom.h>
+#include <linux/platform_device.h>
+#include <linux/mdio.h>
+#include <linux/phylink.h>
+#include <linux/workqueue.h>
+#include "pcs-xpcs-qcom.h"
+
+#define phylink_pcs_to_xpcs(pl_pcs) \
+	container_of((pl_pcs), struct dw_xpcs_qcom, pcs)
+
+#define DRV_NAME "qcom-xpcs"
+
+#define XPCSINFO(fmt, args...) \
+	pr_info(DRV_NAME " %s:%d " fmt, __func__, __LINE__, ## args)
+
+#define XPCSERR(fmt, args...) \
+	pr_err(DRV_NAME " %s:%d " fmt, __func__, __LINE__, ## args)
+
+phy_interface_t g_interface;
+static const int xpcs_usxgmii_features[] = {
+	ETHTOOL_LINK_MODE_Pause_BIT,
+	ETHTOOL_LINK_MODE_Asym_Pause_BIT,
+	ETHTOOL_LINK_MODE_Autoneg_BIT,
+	ETHTOOL_LINK_MODE_10baseT_Full_BIT,
+	ETHTOOL_LINK_MODE_100baseT_Full_BIT,
+	ETHTOOL_LINK_MODE_1000baseKX_Full_BIT,
+	ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+	ETHTOOL_LINK_MODE_2500baseX_Full_BIT,
+	ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+	ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+	ETHTOOL_LINK_MODE_10000baseKX4_Full_BIT,
+	ETHTOOL_LINK_MODE_10000baseKR_Full_BIT,
+	ETHTOOL_LINK_MODE_10000baseT_Full_BIT,
+	__ETHTOOL_LINK_MODE_MASK_NBITS,
+};
+
+static const int xpcs_10gbaser_features[] = {
+	ETHTOOL_LINK_MODE_Pause_BIT,
+	ETHTOOL_LINK_MODE_Asym_Pause_BIT,
+	ETHTOOL_LINK_MODE_10000baseSR_Full_BIT,
+	ETHTOOL_LINK_MODE_10000baseLR_Full_BIT,
+	ETHTOOL_LINK_MODE_10000baseLRM_Full_BIT,
+	ETHTOOL_LINK_MODE_10000baseER_Full_BIT,
+	__ETHTOOL_LINK_MODE_MASK_NBITS,
+};
+
+static const int xpcs_usx5g_features[] = {
+	ETHTOOL_LINK_MODE_Pause_BIT,
+	ETHTOOL_LINK_MODE_Asym_Pause_BIT,
+	ETHTOOL_LINK_MODE_Autoneg_BIT,
+	ETHTOOL_LINK_MODE_10baseT_Half_BIT,
+	ETHTOOL_LINK_MODE_10baseT_Full_BIT,
+	ETHTOOL_LINK_MODE_100baseT_Half_BIT,
+	ETHTOOL_LINK_MODE_100baseT_Full_BIT,
+	ETHTOOL_LINK_MODE_1000baseT_Half_BIT,
+	ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+	ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+	ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+	__ETHTOOL_LINK_MODE_MASK_NBITS,
+};
+
+static const phy_interface_t xpcs_usxgmii_interfaces[] = {
+	PHY_INTERFACE_MODE_USXGMII,
+};
+
+static const phy_interface_t xpcs_10gbaser_interfaces[] = {
+	PHY_INTERFACE_MODE_10GBASER,
+};
+
+static const phy_interface_t xpcs_usx5g_interfaces[] = {
+	PHY_INTERFACE_MODE_5GBASER,
+};
+
+enum {
+	DW_XPCS_USXGMII,
+	DW_XPCS_10GBASER,
+	DW_XPCS_USX5G,
+	DW_XPCS_INTERFACE_MAX,
+};
+
+struct xpcs_id {
+	u32 id;
+	u32 mask;
+	const struct xpcs_compat *compat;
+};
+
+const struct xpcs_compat *xpcs_find_compat(const struct xpcs_id *id,
+					   phy_interface_t interface)
+{
+	int i, j;
+
+	for (i = 0; i < DW_XPCS_INTERFACE_MAX; i++) {
+		const struct xpcs_compat *compat = &id->compat[i];
+
+		for (j = 0; j < compat->num_interfaces; j++)
+			if (compat->interface[j] == interface)
+				return compat;
+	}
+
+	return NULL;
+}
+
+int qcom_xpcs_get_an_mode(struct dw_xpcs_qcom *qxpcs, phy_interface_t interface)
+{
+	const struct xpcs_compat *compat;
+
+	compat = xpcs_find_compat(qxpcs->id, interface);
+	if (!compat)
+		return -ENODEV;
+
+	return compat->an_mode;
+}
+
+static int qcom_xpcs_read(struct dw_xpcs_qcom *qxpcs, u32 reg)
+{
+	return readl(qxpcs->addr + reg);
+}
+
+static void qcom_xpcs_write(struct dw_xpcs_qcom *qxpcs, u32 reg, u16 val)
+{
+	writel(val, qxpcs->addr + reg);
+}
+
+static int qcom_xpcs_poll_reset(struct dw_xpcs_qcom *qxpcs, unsigned int offset,
+				unsigned int field)
+{
+	unsigned int retries = 32;
+	int ret;
+
+	do {
+		usleep_range(1000, 2000);
+		ret = qcom_xpcs_read(qxpcs, offset);
+		if (ret < 0)
+			return ret;
+	} while (ret & field && --retries);
+
+	return (ret & field) ? -ETIMEDOUT : 0;
+}
+
+static int xpcs_soft_reset(struct dw_xpcs_qcom *qxpcs,
+			   const struct xpcs_compat *compat)
+{
+	int ret;
+
+	ret = qcom_xpcs_read(qxpcs, DW_SR_MII_PCS_CTRL1);
+	if (ret < 0)
+		return ret;
+
+	qcom_xpcs_write(qxpcs, DW_SR_MII_PCS_CTRL1, ret | SOFT_RST);
+
+	ret = qcom_xpcs_poll_reset(qxpcs, DW_SR_MII_PCS_CTRL1, SW_RST_BIT_STATUS);
+
+	ret = qcom_xpcs_read(qxpcs, DW_VR_MII_DIG_CTRL1);
+	if (ret < 0)
+		return ret;
+
+	qcom_xpcs_write(qxpcs, DW_VR_MII_DIG_CTRL1, ret | SOFT_RST);
+
+	return qcom_xpcs_poll_reset(qxpcs, DW_VR_MII_DIG_CTRL1, SW_RST_BIT_STATUS);
+}
+
+static int qcom_xpcs_validate(struct phylink_pcs *pcs, unsigned long *supported,
+			      const struct phylink_link_state *state)
+{
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(xpcs_supported);
+	struct dw_xpcs_qcom *qxpcs = phylink_pcs_to_xpcs(pcs);
+	const struct xpcs_compat *compat;
+	int i;
+
+	/* phylink expects us to report all supported modes with
+	 * PHY_INTERFACE_MODE_NA, just don't limit the supported and
+	 * advertising masks and exit.
+	 */
+	if (state->interface == PHY_INTERFACE_MODE_NA)
+		return -EINVAL;
+
+	bitmap_zero(xpcs_supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
+
+	compat = xpcs_find_compat(qxpcs->id, state->interface);
+
+	/* Populate the supported link modes for this
+	 * PHY interface type
+	 */
+	if (compat)
+		for (i = 0; compat->supported[i] != __ETHTOOL_LINK_MODE_MASK_NBITS; i++)
+			set_bit(compat->supported[i], xpcs_supported);
+
+	linkmode_and(supported, supported, xpcs_supported);
+	linkmode_and(state->advertising, state->advertising, xpcs_supported);
+
+	return 0;
+}
+
+/* Cannot sleep in interrupt-context, increase retries and remove usleep call. */
+static int qcom_xpcs_poll_reset_usxgmii(struct dw_xpcs_qcom *qxpcs, unsigned int offset,
+					unsigned int field)
+{
+	unsigned int retries = 1000;
+	int ret;
+
+	do {
+		ret = qcom_xpcs_read(qxpcs, offset);
+		if (ret < 0)
+			return ret;
+	} while (ret & field && --retries);
+
+	return (ret & field) ? -ETIMEDOUT : 0;
+}
+
+/* Reset PCS and USXGMII Rate Adaptor Logic*/
+static int qcom_xpcs_reset_usxgmii(struct dw_xpcs_qcom *qxpcs)
+{
+	int ret;
+
+	ret = qcom_xpcs_read(qxpcs, DW_VR_MII_DIG_CTRL1);
+	if (ret < 0)
+		return ret;
+
+	qcom_xpcs_write(qxpcs, DW_VR_MII_DIG_CTRL1, ret | SOFT_RST);
+
+	if (!qxpcs->intr_en)
+		ret = qcom_xpcs_poll_reset(qxpcs, DW_VR_MII_DIG_CTRL1, SW_RST_BIT_STATUS);
+	else
+		ret = qcom_xpcs_poll_reset_usxgmii(qxpcs, DW_VR_MII_DIG_CTRL1, SW_RST_BIT_STATUS);
+
+	if (ret < 0)
+		return ret;
+
+	ret = qcom_xpcs_read(qxpcs, DW_VR_MII_PCS_DIG_CTRL1);
+	if (ret < 0)
+		return ret;
+
+	qcom_xpcs_write(qxpcs, DW_VR_MII_PCS_DIG_CTRL1, ret | DW_USXGMII_RST);
+
+	if (!qxpcs->intr_en)
+		return qcom_xpcs_poll_reset(qxpcs, DW_VR_MII_PCS_DIG_CTRL1, USXG_RST_BIT_STATUS);
+
+	return qcom_xpcs_poll_reset_usxgmii(qxpcs, DW_VR_MII_PCS_DIG_CTRL1, USXG_RST_BIT_STATUS);
+}
+
+static int qcom_xpcs_usxgmii_read_intr_status(struct dw_xpcs_qcom *qxpcs)
+{
+	int intr_stat;
+
+	intr_stat = qcom_xpcs_read(qxpcs, DW_VR_MII_AN_INTR_STS);
+	if (intr_stat < 0)
+		return intr_stat;
+
+	if (intr_stat & DW_VR_MII_USXG_ANSGM_SP_LNKSTS) {
+		int mmd_ctrl, speed;
+
+		mmd_ctrl = qcom_xpcs_read(qxpcs, DW_SR_MII_MMD_CTRL);
+		if (mmd_ctrl < 0)
+			return mmd_ctrl;
+
+		mmd_ctrl &= ~DW_USXGMII_SS_MASK;
+		speed = (intr_stat & DW_VR_MII_USXG_ANSGM_SP) >> DW_VR_MII_USXG_ANSGM_SP_SHIFT;
+
+		switch (speed) {
+		case DW_VR_MII_USXG_ANSGM_SP_10G:
+			mmd_ctrl |= DW_USXGMII_10000;
+			XPCSINFO("10Gbps-USXGMII enabled\n");
+			break;
+		case DW_VR_MII_USXG_ANSGM_SP_5G:
+			mmd_ctrl |= DW_USXGMII_5000;
+			XPCSINFO("5Gbps-USXGMII enabled\n");
+			break;
+		case DW_VR_MII_USXG_ANSGM_SP_2P5G:
+			mmd_ctrl |= DW_GMII_2500;
+			XPCSINFO("2.5Gbps-USXGMII enabled\n");
+			break;
+		case DW_VR_MII_USXG_ANSGM_SP_1000:
+			mmd_ctrl |= DW_GMII_1000;
+			XPCSINFO("1Gbps-USXGMII enabled\n");
+			break;
+		case DW_VR_MII_USXG_ANSGM_SP_100:
+			mmd_ctrl |= DW_GMII_100;
+			XPCSINFO("100Mbps-USXGMII enabled\n");
+			break;
+		case DW_VR_MII_USXG_ANSGM_SP_10:
+			XPCSINFO("10Mbps-USXGMII enabled\n");
+			break;
+		default:
+			XPCSERR("Invalid speed mode: %d\n", speed);
+			return -EINVAL;
+		}
+
+		qcom_xpcs_write(qxpcs, DW_SR_MII_MMD_CTRL, mmd_ctrl);
+
+		mmd_ctrl = qcom_xpcs_reset_usxgmii(qxpcs);
+		if (mmd_ctrl < 0)
+			XPCSERR("Failed to reset USXGMII\n");
+
+		return mmd_ctrl;
+	}
+		XPCSERR("Link is down, aborting\n");
+		return 0;
+}
+
+static void qcom_xpcs_handle_an_intr(struct dw_xpcs_qcom *qxpcs,
+				     phy_interface_t interface)
+{
+	int ret = 0;
+
+	switch (interface) {
+	case PHY_INTERFACE_MODE_USXGMII:
+		ret = qcom_xpcs_usxgmii_read_intr_status(qxpcs);
+		if (ret < 0)
+			goto out;
+
+		XPCSINFO("Finished Autonegotiation for USXGMII\n");
+		return;
+	default:
+		XPCSERR("Invalid MII mode for Autonegotiation\n");
+		goto out;
+	}
+
+out:
+	XPCSERR("Failed to handle Autonegotiation interrupt\n");
+}
+
+int qcom_xpcs_check_aneg_ioc(struct dw_xpcs_qcom *qxpcs, phy_interface_t interface)
+{
+	int ret;
+
+	/* Check if interrupt was set */
+	ret = qcom_xpcs_read(qxpcs, DW_VR_MII_AN_INTR_STS);
+	if (ret < 0)
+		return -EINVAL;
+
+	if (!(ret & DW_VR_MII_ANCMPLT_INTR)) {
+		XPCSERR("Autonegotiation is still not finished\n");
+		return -ENODEV;
+	}
+
+	/* Clear the IOC status */
+	ret &= ~DW_VR_MII_ANCMPLT_INTR;
+	qcom_xpcs_write(qxpcs, DW_VR_MII_AN_INTR_STS, ret);
+
+	qcom_xpcs_handle_an_intr(qxpcs, interface);
+	return 0;
+}
+
+/* By default, enable Clause 37 autonegotiation */
+static int xpcs_config_aneg_c37(struct dw_xpcs_qcom *qxpcs)
+{
+	int ret;
+
+	ret = qcom_xpcs_read(qxpcs, DW_SR_MII_MMD_CTRL);
+	if (ret < 0)
+		return -EINVAL;
+
+	ret |= AN_CL37_EN;
+	qcom_xpcs_write(qxpcs, DW_SR_MII_MMD_CTRL, ret);
+
+	ret = qcom_xpcs_read(qxpcs, DW_VR_MII_AN_CTRL);
+	if (ret < 0)
+		return -EINVAL;
+
+	ret |= DW_VR_MII_TX_CONFIG_MASK;
+	ret |= DW_VR_MII_SGMII_LINK_STS;
+
+	qcom_xpcs_write(qxpcs, DW_VR_MII_AN_CTRL, ret);
+
+	return 0;
+}
+
+static int qcom_xpcs_do_config(struct dw_xpcs_qcom *qxpcs, phy_interface_t interface)
+{
+	const struct xpcs_compat *compat;
+	int ret;
+
+	compat = xpcs_find_compat(qxpcs->id, interface);
+	if (!compat)
+		return -ENODEV;
+
+	switch (compat->an_mode) {
+	case DW_AN_C37_USXGMII:
+		ret = xpcs_config_aneg_c37(qxpcs);
+		if (ret < 0)
+			return ret;
+		break;
+	case DW_10GBASER:
+		break;
+	default:
+		XPCSERR("Incompatible Autonegotiation mode\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int qcom_xpcs_config(struct phylink_pcs *pcs, unsigned int mode, phy_interface_t interface,
+			    const unsigned long *advertising,
+			    bool permit_pause_to_mac)
+{
+	struct dw_xpcs_qcom *qxpcs = phylink_pcs_to_xpcs(pcs);
+
+	return qcom_xpcs_do_config(qxpcs, interface);
+}
+
+static int xpcs_get_state_c37_usxgmii(struct dw_xpcs_qcom *qxpcs,
+				      struct phylink_link_state *state)
+{
+	int ret;
+
+	ret = qcom_xpcs_read(qxpcs, DW_VR_MII_AN_INTR_STS);
+	if (ret < 0)
+		return -ENODEV;
+
+	if (ret & DW_VR_MII_USXG_ANSGM_SP_LNKSTS)
+		state->link = true;
+	else
+		state->link = false;
+
+	return 0;
+}
+
+static void qcom_xpcs_get_state(struct phylink_pcs *pcs,
+				struct phylink_link_state *state)
+{
+	struct dw_xpcs_qcom *qxpcs = phylink_pcs_to_xpcs(pcs);
+	const struct xpcs_compat *compat;
+	int ret;
+
+	compat = xpcs_find_compat(qxpcs->id, state->interface);
+	if (!compat)
+		return;
+
+	switch (compat->an_mode) {
+	case DW_AN_C37_USXGMII:
+		ret = xpcs_get_state_c37_usxgmii(qxpcs, state);
+		if (ret < 0)
+			XPCSERR("Failed to get USXGMII state\n");
+		break;
+	default:
+		return;
+	}
+}
+
+void qcom_xpcs_link_up_usxgmii(struct dw_xpcs_qcom *qxpcs, int speed)
+{
+	int mmd_ctrl;
+
+	mmd_ctrl = qcom_xpcs_read(qxpcs, DW_SR_MII_MMD_CTRL);
+	if (mmd_ctrl < 0)
+		goto out;
+
+	mmd_ctrl &= ~DW_USXGMII_SS_MASK;
+
+	switch (speed) {
+	case SPEED_10000:
+		mmd_ctrl |= DW_USXGMII_10000;
+		XPCSINFO("10Gbps-USXGMII enabled\n");
+		break;
+	case SPEED_5000:
+		mmd_ctrl |= DW_USXGMII_5000;
+		XPCSINFO("5Gbps-USXGMII enabled\n");
+		break;
+	case SPEED_2500:
+		mmd_ctrl |= DW_GMII_2500;
+		XPCSINFO("2.5Gbps-USXGMII enabled\n");
+		break;
+	case SPEED_1000:
+		mmd_ctrl |= DW_GMII_1000;
+		XPCSINFO("1Gbps-USXGMII enabled\n");
+		break;
+	case SPEED_100:
+		mmd_ctrl |= DW_GMII_100;
+		XPCSINFO("100Mbps-USXGMII enabled\n");
+		break;
+	case SPEED_10:
+		XPCSINFO("10Mbps-USXGMII enabled\n");
+		break;
+	default:
+		XPCSERR("Invalid speed mode selected\n");
+		return;
+	}
+
+	qcom_xpcs_write(qxpcs, DW_SR_MII_MMD_CTRL, mmd_ctrl);
+
+	mmd_ctrl = qcom_xpcs_reset_usxgmii(qxpcs);
+	if (mmd_ctrl < 0)
+		goto out;
+
+	XPCSINFO("USXGMII link is up\n");
+	return;
+out:
+	XPCSERR("Failed to bring up USXGMII link\n");
+}
+
+static int qcom_xpcs_select_mode(struct dw_xpcs_qcom *qxpcs, phy_interface_t interface)
+{
+	int ret;
+
+	g_interface = interface;
+
+	if (interface == PHY_INTERFACE_MODE_USXGMII ||
+	    interface == PHY_INTERFACE_MODE_10GBASER ||
+	    interface == PHY_INTERFACE_MODE_5GBASER) {
+		ret = qcom_xpcs_read(qxpcs, DW_SR_MII_PCS_CTRL2);
+		if (ret < 0)
+			goto out;
+
+		ret &= ~PCS_TYPE_SEL_10GBR;
+		qcom_xpcs_write(qxpcs, DW_SR_MII_PCS_CTRL2, ret);
+
+		ret = qcom_xpcs_read(qxpcs, DW_SR_MII_PCS_CTRL1);
+		if (ret < 0)
+			goto out;
+
+		qcom_xpcs_write(qxpcs, DW_SR_MII_PCS_CTRL1, ret | LPM_EN);
+
+		usleep_range(1, 20);
+
+		ret = qcom_xpcs_read(qxpcs, DW_SR_MII_PCS_CTRL1);
+		if (ret < 0)
+			goto out;
+
+		ret &= ~LPM_EN;
+		qcom_xpcs_write(qxpcs, DW_SR_MII_PCS_CTRL1, ret);
+
+		ret = qcom_xpcs_read(qxpcs, DW_VR_MII_PCS_DIG_CTRL1);
+		if (ret < 0)
+			goto out;
+
+		if (interface == PHY_INTERFACE_MODE_USXGMII)
+			qcom_xpcs_write(qxpcs, DW_VR_MII_PCS_DIG_CTRL1, ret | DW_USXGMII_EN);
+
+		ret = qcom_xpcs_read(qxpcs, DW_VR_MII_PCS_KR_CTRL);
+		if (ret < 0)
+			goto out;
+
+		ret &= ~USXG_MODE_SEL;
+		if (interface == PHY_INTERFACE_MODE_5GBASER)
+			ret |= USXGMII_5G;
+
+		qcom_xpcs_write(qxpcs, DW_VR_MII_PCS_KR_CTRL, ret);
+
+		return 0;
+	}
+
+	XPCSERR("Incompatible MII interface: %d\n", interface);
+	return -EINVAL;
+
+out:
+	XPCSERR("Register read failed\n");
+	return -EINVAL;
+}
+
+/* USXGMII: Return early if interrupt was enabled.
+ * Autonegotiation ISR will set speed and duplex instead.
+ * SGMII: For 2.5Gbps, let ISR do NOP since SGMII+ not supported in
+ * registers for CL37. qcom_xpcs_link_up_sgmii will take care of
+ * setting 2.5Gbps.
+ */
+void qcom_xpcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
+		       phy_interface_t interface, int speed, int duplex)
+{
+	struct dw_xpcs_qcom *qxpcs = phylink_pcs_to_xpcs(pcs);
+
+	if (qxpcs->intr_en)
+		return;
+
+	switch (interface) {
+	case PHY_INTERFACE_MODE_USXGMII:
+	case PHY_INTERFACE_MODE_10GBASER:
+	case PHY_INTERFACE_MODE_5GBASER:
+		qcom_xpcs_link_up_usxgmii(qxpcs, speed);
+		break;
+	default:
+		XPCSERR("Invalid MII mode: %s\n", phy_modes(interface));
+		return;
+	}
+}
+EXPORT_SYMBOL_GPL(qcom_xpcs_link_up);
+
+static u32 xpcs_get_id(struct dw_xpcs_qcom *qxpcs)
+{
+	int ret;
+	u32 id;
+
+	/* Next, search C37 PCS using Vendor-Specific MII MMD */
+	ret = qcom_xpcs_read(qxpcs, DW_SR_MII_PCS_DEV_ID1);
+	if (ret < 0)
+		return 0xffffffff;
+
+	id = ret << 16;
+
+	ret = qcom_xpcs_read(qxpcs, DW_SR_MII_PCS_DEV_ID2);
+	if (ret < 0)
+		return 0xffffffff;
+
+	/* If Device IDs are not all zeros, we found C37 AN-type device */
+	if (id | ret)
+		return id | ret;
+
+	return 0xffffffff;
+}
+
+static const struct xpcs_compat synopsys_xpcs_compat[DW_XPCS_INTERFACE_MAX] = {
+	[DW_XPCS_USXGMII] = {
+		.supported = xpcs_usxgmii_features,
+		.interface = xpcs_usxgmii_interfaces,
+		.num_interfaces = ARRAY_SIZE(xpcs_usxgmii_interfaces),
+		.an_mode = DW_AN_C37_USXGMII,
+	},
+	[DW_XPCS_10GBASER] = {
+		.supported = xpcs_10gbaser_features,
+		.interface = xpcs_10gbaser_interfaces,
+		.num_interfaces = ARRAY_SIZE(xpcs_10gbaser_interfaces),
+		.an_mode = DW_10GBASER,
+	},
+	[DW_XPCS_USX5G] = {
+		.supported = xpcs_usx5g_features,
+		.interface = xpcs_usx5g_interfaces,
+		.num_interfaces = ARRAY_SIZE(xpcs_usx5g_interfaces),
+		.an_mode = DW_10GBASER,
+	},
+};
+
+static const struct xpcs_id xpcs_id_list[] = {
+	{
+		.id = SYNOPSYS_XPCS_ID,
+		.mask = SYNOPSYS_XPCS_MASK,
+		.compat = synopsys_xpcs_compat,
+	},
+};
+
+static const struct phylink_pcs_ops qcom_xpcs_phylink_ops = {
+	.pcs_validate = qcom_xpcs_validate,
+	.pcs_config = qcom_xpcs_config,
+	.pcs_get_state = qcom_xpcs_get_state,
+};
+
+struct phylink_pcs *qcom_xpcs_create(struct device_node *np, phy_interface_t interface)
+{
+	const struct xpcs_compat *compat;
+	struct platform_device *pdev;
+	struct dw_xpcs_qcom *qxpcs;
+	u32 xpcs_id;
+	int i, ret = 0;
+
+	pdev = of_find_device_by_node(np);
+	of_node_put(np);
+
+	if (!pdev || !platform_get_drvdata(pdev)) {
+		if (pdev)
+			put_device(&pdev->dev);
+
+		return ERR_PTR(-EPROBE_DEFER);
+	}
+
+	qxpcs = platform_get_drvdata(pdev);
+
+	qxpcs->phy_interface = interface;
+
+	xpcs_id = xpcs_get_id(qxpcs);
+	if (xpcs_id == 0xffffffff) {
+		XPCSERR("Invalid qxpcs Device ID\n");
+		ret = -ENODEV;
+		goto out;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(xpcs_id_list); i++) {
+		const struct xpcs_id *entry = &xpcs_id_list[i];
+
+		if ((xpcs_id & entry->mask) != entry->id)
+			continue;
+
+		qxpcs->id = entry;
+		compat = xpcs_find_compat(entry, interface);
+		if (!compat) {
+			XPCSERR("Incompatible MII interface: %d\n", interface);
+			ret = -ENODEV;
+			goto out;
+		}
+
+		qxpcs->pcs.ops = &qcom_xpcs_phylink_ops;
+		qxpcs->pcs.poll = true;
+
+		ret = xpcs_soft_reset(qxpcs, compat);
+		if (ret) {
+			XPCSERR("Soft reset of XPCS block failed\n");
+			goto out;
+		}
+
+		/* Select PCS mode before further configuration */
+		ret = qcom_xpcs_select_mode(qxpcs, interface);
+		if (ret < 0)
+			goto out;
+
+		return &qxpcs->pcs;
+	}
+
+out:
+	XPCSERR("qxpcs creation failed\n");
+	kfree(qxpcs);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_xpcs_create);
+
+/* Power off the DWC_xpcs controller */
+void qcom_xpcs_destroy(struct dw_xpcs_qcom *qxpcs)
+{
+	int i, ret;
+	u32 xpcs_id;
+	const struct xpcs_compat *compat;
+
+	xpcs_id = xpcs_get_id(qxpcs);
+	if (xpcs_id == 0xffffffff) {
+		XPCSERR("Invalid XPCS Device ID\n");
+		ret = -ENODEV;
+		goto out;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(xpcs_id_list); i++) {
+		const struct xpcs_id *entry = &xpcs_id_list[i];
+
+		if ((xpcs_id & entry->mask) != entry->id)
+			continue;
+
+		qxpcs->id = entry;
+		compat = xpcs_find_compat(entry, g_interface);
+		if (!compat) {
+			XPCSERR("Incompatible MII interface: %d\n", g_interface);
+			ret = -ENODEV;
+			goto out;
+		}
+
+		ret = xpcs_soft_reset(qxpcs, compat);
+		if (ret) {
+			XPCSERR("Soft reset of XPCS block failed\n");
+			ret = -ENODEV;
+		}
+		goto done;
+	}
+
+	/* Enable xpc_spdown_o signal assertion on xpcs power down, then
+	 * intiate the power down sequence
+	 */
+	ret = qcom_xpcs_read(qxpcs, DW_SR_MII_VSMMD_CTRL);
+	if (ret < 0)
+		goto out;
+
+	qcom_xpcs_write(qxpcs, DW_SR_MII_VSMMD_CTRL, ret & ~PD_CTRL);
+
+	ret = qcom_xpcs_read(qxpcs, DW_SR_MII_PCS_CTRL1);
+	if (ret < 0)
+		goto out;
+
+	qcom_xpcs_write(qxpcs, DW_SR_MII_PCS_CTRL1, ret | LPM_EN);
+	goto done;
+
+out:
+	XPCSERR("Could not power down the XPCS\n");
+done:
+	kfree(qxpcs);
+}
+EXPORT_SYMBOL_GPL(qcom_xpcs_destroy);
+
+irqreturn_t qcom_xpcs_isr(int irq, void *dev_data)
+{
+	int ret;
+	struct dw_xpcs_qcom *qxpcs = (struct dw_xpcs_qcom *)dev_data;
+
+	ret = qcom_xpcs_check_aneg_ioc(qxpcs, qxpcs->phy_interface);
+	if (ret < 0)
+		return IRQ_HANDLED;
+
+	return IRQ_HANDLED;
+}
+
+int qcom_xpcs_intr_enable(struct dw_xpcs_qcom *qxpcs)
+{
+	int ret = 0;
+
+	ret = qcom_xpcs_read(qxpcs, DW_VR_MII_AN_CTRL);
+	if (ret < 0) {
+		XPCSERR("Failed to enable CL37 interrupts\n");
+		return ret;
+	}
+
+	ret |= DW_VR_MII_AN_INTR_EN;
+
+	qcom_xpcs_write(qxpcs, DW_VR_MII_AN_CTRL, ret);
+
+	ret = request_irq(qxpcs->pcs_intr, qcom_xpcs_isr,
+			  IRQF_SHARED, "qcom-xpcs", qxpcs);
+	if (ret)
+		pr_err("Unable to register XPCS IRQ %d\n",
+		       qxpcs->pcs_intr);
+
+	return ret;
+}
+
+static int qcom_xpcs_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct dw_xpcs_qcom *qxpcs;
+
+	qxpcs = kzalloc(sizeof(*qxpcs), GFP_KERNEL);
+	if (!qxpcs)
+		return ERR_PTR(-ENOMEM);
+
+	qxpcs->addr = devm_platform_ioremap_resource_byname(pdev, "qxpcs");
+	if (IS_ERR_OR_NULL(qxpcs->addr)) {
+		pr_err("XPCS not supported from device tree!\n");
+		kfree(qxpcs);
+		return -ENODEV;
+	}
+
+	qxpcs->pcs_intr = platform_get_irq_byname_optional(pdev, "pcs_intr");
+	if (qxpcs->pcs_intr < 0) {
+		pr_info("XPCS IRQ is not enabled\n");
+	} else {
+		ret = qcom_xpcs_intr_enable(qxpcs);
+		if (ret)
+			qxpcs->intr_en = false;
+		else
+			qxpcs->intr_en = true;
+	}
+
+	platform_set_drvdata(pdev, qxpcs);
+
+	return 0;
+}
+
+static const struct of_device_id qcom_xpcs_match[] = {
+	{ .compatible = "qcom,xpcs"},
+	{}
+};
+
+static struct platform_driver pcs_xpcs_qcom_driver = {
+	.probe = qcom_xpcs_probe,
+	.driver = {
+		.name = "dwxpcs",
+		.of_match_table = of_match_ptr(qcom_xpcs_match),
+	},
+};
+module_platform_driver(pcs_xpcs_qcom_driver);
+
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/net/pcs/pcs-xpcs-qcom.h
+++ linux-qcom-6.8.0/drivers/net/pcs/pcs-xpcs-qcom.h
@@ -0,0 +1,225 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Synopsys DesignWare XPCS platform device driver
+ *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/pcs-xpcs-qcom.h>
+
+#define LINK_STS_RETRY_COUNT		50
+#define SYNOPSYS_XPCS_ID		0x7996ced0
+#define SYNOPSYS_XPCS_MASK		0xffffffff // Reset mask for Dev IDs
+
+/* Vendor regs access */
+#define DW_VENDOR			BIT(15)
+
+/* VR_XS_PCS */
+#define DW_USXGMII_RST			BIT(10)
+#define DW_USXGMII_EN			BIT(9)
+#define DW_VR_XS_PCS_DIG_STS		0x2040 /* SWI name: EMAC0_VR_XS_PCS_DIG_STS */
+#define DW_RXFIFO_ERR			GENMASK(6, 5)
+#define DW_R2TLBE				BIT(14)
+
+/* SR_MII */
+#define DW_FULL_DUPLEX			BIT(8)
+#define DW_USXGMII_SS_MASK		(BIT(13) | BIT(6) | BIT(5))
+#define DW_USXGMII_10000		(BIT(13) | BIT(6))
+#define DW_USXGMII_5000			(BIT(13) | BIT(5))
+#define DW_GMII_2500			(BIT(5))
+#define DW_GMII_1000			(BIT(6))
+#define DW_GMII_100				(BIT(13))
+#define DW_SGMII_SS_MASK		(BIT(13) | BIT(6))
+
+/* SR_AN */
+#define DW_SR_AN_ADV1			0x10
+#define DW_SR_AN_ADV2			0x11
+#define DW_SR_AN_ADV3			0x12
+#define DW_SR_AN_LP_ABL1		0x13
+#define DW_SR_AN_LP_ABL2		0x14
+#define DW_SR_AN_LP_ABL3		0x15
+
+/* Clause 37 Defines */
+/* VR MII MMD registers offsets */
+#define DW_SR_MII_MMD_CTRL		0x4000 /* SWI name: EMAC0_SR_MII_CTRL */
+#define DW_VR_MII_DIG_CTRL1		0x5000 /* SWI name: EMAC0_VR_MII_DIG_CTRL1 */
+#define DW_VR_MII_AN_CTRL		0x5004 /* SWI name: EMAC0_VR_MII_AN_CTRL */
+#define DW_VR_MII_AN_INTR_STS		0x5008 /* SWI name: EMAC0_VR_MII_AN_INTR_STS */
+/* Enable 2.5G Mode */
+#define DW_VR_MII_DIG_CTRL1_2G5_EN	BIT(2)
+/* EEE Mode Control Register */
+#define DW_VR_XS_PCS_EEE_MCTRL0		0x2018 /* SWI name: EMAC0_VR_XS_PCS_EEE_MCTRL0 */
+#define DW_VR_XS_PCS_EEE_MCTRL1		0x202c /* SWI name: EMAC0_VR_XS_PCS_EEE_MCTRL1 */
+#define DW_VR_MII_DIG_CTRL2		0x2004 /* SWI name: EMAC0_VR_XS_PCS_DIG_CTRL2 */
+
+#define DW_SR_MII_PCS_CTRL1		0x0000 /* SWI name: EMAC0_SR_XS_PCS_CTRL1 */
+#define DW_SR_MII_PCS_STS1		0x0004 /* SWI name: EMAC0_SR_XS_PCS_STS1 */
+#define DW_SR_MII_PCS_DEV_ID1		0x0008
+#define DW_SR_MII_PCS_DEV_ID2		0x000c
+#define DW_SR_MII_PCS_SPD_ABL		0x0010
+#define DW_SR_MII_PCS_DEV_PKG1		0x0014
+#define DW_SR_MII_PCS_DEV_PKG2		0x0018
+#define DW_SR_MII_PCS_CTRL2		0x001c
+#define DW_SR_MII_PCS_STS2		0x0020
+#define DW_SR_MII_PCS_STS3		0x0024
+#define DW_SR_MII_PCS_PKG1		0x0038
+#define DW_SR_MII_PCS_PKG2		0x003c
+#define DW_SR_MII_PCS_EEE_ABL		0x0050
+#define DW_SR_MII_PCS_EEE_ABL2		0x0054
+#define DW_SR_MII_PCS_EEE_WKERR		0x0058
+#define DW_SR_MII_PCS_LSTS		0x0060
+#define DW_SR_MII_PCS_TCTRL		0x0064
+#define DW_SR_MII_PCS_KR_STS1		0x0080
+#define DW_SR_MII_PCS_KR_STS2		0x0084
+#define DW_SR_MII_PCS_TP_A0		0x0088
+#define DW_SR_MII_PCS_TP_A1		0x008c
+#define DW_SR_MII_PCS_TP_A2		0x0090
+#define DW_SR_MII_PCS_TP_A3		0x0094
+#define DW_SR_MII_PCS_TP_B0		0x0098
+#define DW_SR_MII_PCS_TP_B1		0x009c
+#define DW_SR_MII_PCS_TP_B2		0x00a0
+#define DW_SR_MII_PCS_TP_B3		0x00a4
+#define DW_SR_MII_PCS_TP_CTRL		0x00a8
+#define DW_SR_MII_PCS_TP_ERRCTR		0x00ac
+#define DW_SR_MII_PCS_ABL		0x1c20
+#define DW_SR_MII_PCS_TIME_SYNC_TX_MAX_DLY_LWR		0x1c24
+#define DW_SR_MII_PCS_TIME_SYNC_TX_MAX_DLY_UPR		0x1c28
+#define DW_SR_MII_PCS_TIME_SYNC_TX_MIN_DLY_LWR		0x1c2c
+#define DW_SR_MII_PCS_TIME_SYNC_TX_MIN_DLY_UPR		0x1c30
+#define DW_SR_MII_PCS_TIME_SYNC_RX_MAX_DLY_LWR		0x1c34
+#define DW_SR_MII_PCS_TIME_SYNC_RX_MAX_DLY_UPR		0x1c38
+#define DW_SR_MII_PCS_TIME_SYNC_RX_MIN_DLY_LWR		0x1c3c
+#define DW_SR_MII_PCS_TIME_SYNC_RX_MIN_DLY_UPR		0x1c40
+#define DW_VR_MII_PCS_DIG_CTRL1		0x2000
+#define DW_VR_MII_PCS_DIG_ERRCNT_SEL	0x2008
+#define DW_VR_MII_PCS_XAUI_CTRL		0x2010
+#define DW_VR_MII_PCS_DEBUG_CTRL	0x2014
+#define DW_VR_MII_PCS_KR_CTRL		0x201c
+#define DW_VR_MII_PCS_EEE_TXTIMER	0x2020
+#define DW_VR_MII_PCS_EEE_RXTIMER	0x2024
+#define DW_VR_MII_PCS_ICG_ERRCNT1	0x2044
+#define DW_VR_MII_PCS_GPIO		0x2054
+#define DW_SR_MII_VSMMD_PMA_ID1		0x3000
+#define DW_SR_MII_VSMMD_PMA_ID2		0x3004
+#define DW_SR_MII_VSMMD_DEV_ID1		0x3008
+#define DW_SR_MII_VSMMD_DEV_ID2		0x300c
+#define DW_SR_MII_VSMMD_PCS_ID1		0x3010
+#define DW_SR_MII_VSMMD_PCS_ID2		0x3014
+#define DW_SR_MII_VSMMD_AN_ID1		0x3018
+#define DW_SR_MII_VSMMD_AN_ID2		0x301c
+#define DW_SR_MII_VSMMD_MMD_STS		0x3020
+#define DW_SR_MII_VSMMD_CTRL		0x3024
+#define DW_SR_MII_VSMMD_PKGID1		0x3038
+#define DW_SR_MII_VSMMD_PKGID2		0x303c
+#define DW_SR_MII_MMD_STS		0x4004
+#define DW_SR_MII_MMD_DEV_ID1		0x4008
+#define DW_SR_MII_MMD_DEV_ID2		0x400c
+#define DW_SR_MII_AN_ADV		0x4010
+#define DW_SR_MII_LP_BABL		0x4014
+#define DW_SR_MII_AN_EXPN		0x4018
+#define DW_SR_MII_EXT_STS		0x403c
+#define DW_VR_MII_LINK_TIMER_CTRL	0x5028
+
+/* XPCS power-down configuration registers */
+#define PD_CTRL					BIT(5)
+#define LPM_EN					BIT(11)
+
+/* VR_MII_DIG_CTRL1 */
+#define DW_VR_MII_DIG_CTRL1_MAC_AUTO_SW		BIT(9)
+#define DW_VR_MII_DIG_CTRL1_PHY_MODE_CTRL	BIT(0)
+
+/* VR_MII_DIG_CTRL2 */
+#define DW_VR_MII_DIG_CTRL2_TX_POL_INV		BIT(4)
+#define DW_VR_MII_DIG_CTRL2_RX_POL_INV		BIT(0)
+
+/* VR_MII_AN_CTRL */
+#define DW_VR_MII_AN_CTRL_TX_CONFIG_SHIFT	3
+#define DW_VR_MII_TX_CONFIG_MASK		BIT(3)
+#define DW_VR_MII_TX_CONFIG_PHY_SIDE		0x1
+#define DW_VR_MII_TX_CONFIG_MAC_SIDE		0x0
+#define DW_VR_MII_AN_CTRL_PCS_MODE_SHIFT	1
+#define DW_VR_MII_PCS_MODE_MASK			GENMASK(2, 1)
+#define DW_VR_MII_PCS_MODE_C37_1000BASEX	0x0
+#define DW_VR_MII_PCS_MODE_C37_SGMII		BIT(2)
+#define DW_VR_MII_PCS_MODE_C37_QSGMII		0x3
+#define DW_VR_MII_AN_INTR_EN			BIT(0)
+#define DW_VR_MII_SGMII_LINK_STS		BIT(4)
+#define DW_VR_MII_CTRL					BIT(8)
+
+/* VR_MII_AN_INTR_STS */
+#define DW_VR_MII_AN_STS_C37_ANSGM_FD		BIT(1)
+#define DW_VR_MII_AN_STS_C37_ANSGM_SP_SHIFT	2
+#define DW_VR_MII_AN_STS_C37_ANSGM_SP		GENMASK(3, 2)
+#define DW_VR_MII_C37_ANSGM_SP_10		0x0
+#define DW_VR_MII_C37_ANSGM_SP_100		0x1
+#define DW_VR_MII_C37_ANSGM_SP_1000		0x2
+#define DW_VR_MII_C37_ANSGM_SP_LNKSTS		BIT(4)
+#define DW_VR_MII_USXG_ANSGM_FD			BIT(13)
+#define DW_VR_MII_USXG_ANSGM_SP_SHIFT		10
+#define DW_VR_MII_USXG_ANSGM_SP			GENMASK(12, 10)
+#define DW_VR_MII_USXG_ANSGM_SP_10		0x0
+#define DW_VR_MII_USXG_ANSGM_SP_100		0x1
+#define DW_VR_MII_USXG_ANSGM_SP_1000		0x2
+#define DW_VR_MII_USXG_ANSGM_SP_10G		0x3
+#define DW_VR_MII_USXG_ANSGM_SP_2P5G		0x4
+#define DW_VR_MII_USXG_ANSGM_SP_5G		0x5
+#define DW_VR_MII_USXG_ANSGM_SP_LNKSTS		BIT(14)
+#define DW_VR_MII_ANCMPLT_INTR			BIT(0)
+
+/* Bit 15 is the Soft Reset field for various registers */
+#define SOFT_RST				BIT(15)
+#define SW_RST_BIT_STATUS			0x8000
+#define USXG_RST_BIT_STATUS			0x0400
+
+/* SR MII MMD Control defines */
+#define AN_CL37_EN			BIT(12)	/* Enable Clause 37 auto-nego */
+
+/* VR MII EEE Control 0 defines */
+#define DW_VR_MII_EEE_LTX_EN			BIT(0)  /* LPI Tx Enable */
+#define DW_VR_MII_EEE_LRX_EN			BIT(1)  /* LPI Rx Enable */
+#define DW_VR_MII_EEE_TX_QUIET_EN		BIT(2)  /* Tx Quiet Enable */
+#define DW_VR_MII_EEE_RX_QUIET_EN		BIT(3)  /* Rx Quiet Enable */
+#define DW_VR_MII_EEE_TX_EN_CTRL		BIT(4)  /* Tx Control Enable */
+#define DW_VR_MII_EEE_RX_EN_CTRL		BIT(7)  /* Rx Control Enable */
+
+#define DW_VR_MII_EEE_MULT_FACT_100NS_SHIFT	8
+#define DW_VR_MII_EEE_MULT_FACT_100NS		GENMASK(11, 8)
+
+/* VR MII EEE Control 1 defines */
+#define DW_VR_MII_EEE_TRN_LPI		BIT(0)	/* Transparent Mode Enable */
+
+/* SR MII PCS Control 2 defines */
+#define PCS_TYPE_SEL_10GBR			GENMASK(3, 0)
+#define PCS_TYPE_SEL_10GBX			BIT(0)
+
+/* SR MII PCS Control 2 defines */
+#define PCS_TYPE_SEL_2500BASEX			GENMASK(3, 1)
+
+/* SR MII PCS KR Control defines */
+#define USXG_MODE_SEL				GENMASK(12, 10)
+#define USXGMII_5G				BIT(10)
+#define USXGMII_2P5G				BIT(11)
+
+/* SR_MII_AN_ADV */
+#define DW_SR_MII_AN_ADV_FD			BIT(5)
+#define DW_SR_MII_AN_ADV_HD			BIT(6)
+#define DW_SR_MII_STS_LINK_STS			BIT(2)
+
+/* Required settings to enable 2.5G SGMII mode */
+#define LINK_TIMER_1P6MS			0x07a1
+#define CL37_TMR_OVR_RIDE			BIT(3)
+
+/* EEE Ability register defines */
+#define KREEE_SUPPORT				BIT(6)
+#define KX4EEE_SUPPORT				BIT(5)
+#define KXEEE_SUPPORT				BIT(4)
+
+/* Tx Preemable Control for Debug Register */
+#define TX_PMBL_CTRL				BIT(8)
+
+struct xpcs_compat {
+	const int *supported;
+	const phy_interface_t *interface;
+	int num_interfaces;
+	int an_mode;
+};
--- linux-qcom-6.8.0.orig/drivers/net/pcs/pcs-xpcs-wx.c
+++ linux-qcom-6.8.0/drivers/net/pcs/pcs-xpcs-wx.c
@@ -109,7 +109,7 @@
 	txgbe_write_pma(xpcs, TXGBE_DFE_TAP_CTL0, 0);
 	val = txgbe_read_pma(xpcs, TXGBE_RX_GEN_CTL3);
 	val = u16_replace_bits(val, 0x4, TXGBE_RX_GEN_CTL3_LOS_TRSHLD0);
-	txgbe_write_pma(xpcs, TXGBE_RX_EQ_ATTN_CTL, val);
+	txgbe_write_pma(xpcs, TXGBE_RX_GEN_CTL3, val);
 
 	txgbe_write_pma(xpcs, TXGBE_MPLLA_CTL0, 0x20);
 	txgbe_write_pma(xpcs, TXGBE_MPLLA_CTL3, 0x46);
--- linux-qcom-6.8.0.orig/drivers/net/pcs/pcs-xpcs.c
+++ linux-qcom-6.8.0/drivers/net/pcs/pcs-xpcs.c
@@ -293,7 +293,7 @@
 		dev = MDIO_MMD_VEND2;
 		break;
 	default:
-		return -1;
+		return -EINVAL;
 	}
 
 	ret = xpcs_write(xpcs, dev, MDIO_CTRL1, MDIO_CTRL1_RESET);
@@ -891,7 +891,7 @@
 			return ret;
 		break;
 	default:
-		return -1;
+		return -EINVAL;
 	}
 
 	if (compat->pma_config) {
--- linux-qcom-6.8.0.orig/drivers/net/phy/aquantia/Makefile
+++ linux-qcom-6.8.0/drivers/net/phy/aquantia/Makefile
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-aquantia-objs			+= aquantia_main.o aquantia_firmware.o
+aquantia-objs			+= aquantia_main.o aquantia_firmware.o aquantia_leds.o
 ifdef CONFIG_HWMON
 aquantia-objs			+= aquantia_hwmon.o
 endif
--- linux-qcom-6.8.0.orig/drivers/net/phy/aquantia/aquantia.h
+++ linux-qcom-6.8.0/drivers/net/phy/aquantia/aquantia.h
@@ -6,6 +6,9 @@
  * Author: Heiner Kallweit <hkallweit1@gmail.com>
  */
 
+#ifndef AQUANTIA_H
+#define AQUANTIA_H
+
 #include <linux/device.h>
 #include <linux/phy.h>
 
@@ -63,6 +66,28 @@
 #define VEND1_GLOBAL_CONTROL2_UP_RUN_STALL_OVD	BIT(6)
 #define VEND1_GLOBAL_CONTROL2_UP_RUN_STALL	BIT(0)
 
+#define VEND1_GLOBAL_LED_PROV			0xc430
+#define AQR_LED_PROV(x)				(VEND1_GLOBAL_LED_PROV + (x))
+#define VEND1_GLOBAL_LED_PROV_LINK2500		BIT(14)
+#define VEND1_GLOBAL_LED_PROV_LINK5000		BIT(15)
+#define VEND1_GLOBAL_LED_PROV_FORCE_ON		BIT(8)
+#define VEND1_GLOBAL_LED_PROV_LINK10000		BIT(7)
+#define VEND1_GLOBAL_LED_PROV_LINK1000		BIT(6)
+#define VEND1_GLOBAL_LED_PROV_LINK100		BIT(5)
+#define VEND1_GLOBAL_LED_PROV_RX_ACT		BIT(3)
+#define VEND1_GLOBAL_LED_PROV_TX_ACT		BIT(2)
+#define VEND1_GLOBAL_LED_PROV_ACT_STRETCH	GENMASK(0, 1)
+
+#define VEND1_GLOBAL_LED_PROV_LINK_MASK		(VEND1_GLOBAL_LED_PROV_LINK100 | \
+						 VEND1_GLOBAL_LED_PROV_LINK1000 | \
+						 VEND1_GLOBAL_LED_PROV_LINK10000 | \
+						 VEND1_GLOBAL_LED_PROV_LINK5000 | \
+						 VEND1_GLOBAL_LED_PROV_LINK2500)
+
+#define VEND1_GLOBAL_LED_DRIVE			0xc438
+#define VEND1_GLOBAL_LED_DRIVE_VDD		BIT(1)
+#define AQR_LED_DRIVE(x)			(VEND1_GLOBAL_LED_DRIVE + (x))
+
 #define VEND1_THERMAL_PROV_HIGH_TEMP_FAIL	0xc421
 #define VEND1_THERMAL_PROV_LOW_TEMP_FAIL	0xc422
 #define VEND1_THERMAL_PROV_HIGH_TEMP_WARN	0xc423
@@ -87,6 +112,18 @@
 #define VEND1_GLOBAL_RSVD_STAT9_MODE		GENMASK(7, 0)
 #define VEND1_GLOBAL_RSVD_STAT9_1000BT2		0x23
 
+/* MDIO_MMD_C22EXT */
+#define MDIO_C22EXT_STAT_SGMII_RX_GOOD_FRAMES		0xd292
+#define MDIO_C22EXT_STAT_SGMII_RX_BAD_FRAMES		0xd294
+#define MDIO_C22EXT_STAT_SGMII_RX_FALSE_CARRIER		0xd297
+#define MDIO_C22EXT_STAT_SGMII_TX_GOOD_FRAMES		0xd313
+#define MDIO_C22EXT_STAT_SGMII_TX_BAD_FRAMES		0xd315
+#define MDIO_C22EXT_STAT_SGMII_TX_FALSE_CARRIER		0xd317
+#define MDIO_C22EXT_STAT_SGMII_TX_COLLISIONS		0xd318
+#define MDIO_C22EXT_STAT_SGMII_TX_LINE_COLLISIONS	0xd319
+#define MDIO_C22EXT_STAT_SGMII_TX_FRAME_ALIGN_ERR	0xd31a
+#define MDIO_C22EXT_STAT_SGMII_TX_RUNT_FRAMES		0xd31b
+
 #define VEND1_GLOBAL_INT_STD_STATUS		0xfc00
 #define VEND1_GLOBAL_INT_VEND_STATUS		0xfc01
 
@@ -113,6 +150,35 @@
 #define VEND1_GLOBAL_INT_VEND_MASK_GLOBAL2	BIT(1)
 #define VEND1_GLOBAL_INT_VEND_MASK_GLOBAL3	BIT(0)
 
+#define AQR_MAX_LEDS				3
+
+struct aqr107_hw_stat {
+	const char *name;
+	int reg;
+	int size;
+};
+
+#define SGMII_STAT(n, r, s) { n, MDIO_C22EXT_STAT_SGMII_ ## r, s }
+static const struct aqr107_hw_stat aqr107_hw_stats[] = {
+	SGMII_STAT("sgmii_rx_good_frames",	    RX_GOOD_FRAMES,	26),
+	SGMII_STAT("sgmii_rx_bad_frames",	    RX_BAD_FRAMES,	26),
+	SGMII_STAT("sgmii_rx_false_carrier_events", RX_FALSE_CARRIER,	 8),
+	SGMII_STAT("sgmii_tx_good_frames",	    TX_GOOD_FRAMES,	26),
+	SGMII_STAT("sgmii_tx_bad_frames",	    TX_BAD_FRAMES,	26),
+	SGMII_STAT("sgmii_tx_false_carrier_events", TX_FALSE_CARRIER,	 8),
+	SGMII_STAT("sgmii_tx_collisions",	    TX_COLLISIONS,	 8),
+	SGMII_STAT("sgmii_tx_line_collisions",	    TX_LINE_COLLISIONS,	 8),
+	SGMII_STAT("sgmii_tx_frame_alignment_err",  TX_FRAME_ALIGN_ERR,	16),
+	SGMII_STAT("sgmii_tx_runt_frames",	    TX_RUNT_FRAMES,	22),
+};
+
+#define AQR107_SGMII_STAT_SZ ARRAY_SIZE(aqr107_hw_stats)
+
+struct aqr107_priv {
+	u64 sgmii_stats[AQR107_SGMII_STAT_SZ];
+	unsigned long leds_active_low;
+};
+
 #if IS_REACHABLE(CONFIG_HWMON)
 int aqr_hwmon_probe(struct phy_device *phydev);
 #else
@@ -120,3 +186,21 @@
 #endif
 
 int aqr_firmware_load(struct phy_device *phydev);
+
+int aqr_phy_led_blink_set(struct phy_device *phydev, u8 index,
+			  unsigned long *delay_on,
+			  unsigned long *delay_off);
+int aqr_phy_led_brightness_set(struct phy_device *phydev,
+			       u8 index, enum led_brightness value);
+int aqr_phy_led_hw_is_supported(struct phy_device *phydev, u8 index,
+				unsigned long rules);
+int aqr_phy_led_hw_control_get(struct phy_device *phydev, u8 index,
+			       unsigned long *rules);
+int aqr_phy_led_hw_control_set(struct phy_device *phydev, u8 index,
+			       unsigned long rules);
+int aqr_phy_led_active_low_set(struct phy_device *phydev, int index, bool enable);
+int aqr_phy_led_polarity_set(struct phy_device *phydev, int index,
+			     unsigned long modes);
+int aqr_wait_reset_complete(struct phy_device *phydev);
+
+#endif /* AQUANTIA_H */
--- linux-qcom-6.8.0.orig/drivers/net/phy/aquantia/aquantia_firmware.c
+++ linux-qcom-6.8.0/drivers/net/phy/aquantia/aquantia_firmware.c
@@ -353,22 +353,32 @@
 {
 	int ret;
 
-	/* Check if the firmware is not already loaded by pooling
-	 * the current version returned by the PHY. If 0 is returned,
-	 * no firmware is loaded.
+	/* Check if the firmware is not already loaded by polling
+	 * the current version returned by the PHY.
 	 */
-	ret = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_FW_ID);
-	if (ret > 0)
-		goto exit;
+	ret = aqr_wait_reset_complete(phydev);
+	switch (ret) {
+	case 0:
+		/* Some firmware is loaded => do nothing */
+		return 0;
+	case -ETIMEDOUT:
+		/* VEND1_GLOBAL_FW_ID still reads 0 after 2 seconds of polling.
+		 * We don't have full confidence that no firmware is loaded (in
+		 * theory it might just not have loaded yet), but we will
+		 * assume that, and load a new image.
+		 */
+		ret = aqr_firmware_load_nvmem(phydev);
+		if (!ret)
+			return ret;
 
-	ret = aqr_firmware_load_nvmem(phydev);
-	if (!ret)
-		goto exit;
-
-	ret = aqr_firmware_load_fs(phydev);
-	if (ret)
+		ret = aqr_firmware_load_fs(phydev);
+		if (ret)
+			return ret;
+		break;
+	default:
+		/* PHY read error, propagate it to the caller */
 		return ret;
+	}
 
-exit:
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/phy/aquantia/aquantia_leds.c
+++ linux-qcom-6.8.0/drivers/net/phy/aquantia/aquantia_leds.c
@@ -0,0 +1,150 @@
+// SPDX-License-Identifier: GPL-2.0
+/* LED driver for Aquantia PHY
+ *
+ * Author: Daniel Golle <daniel@makrotopia.org>
+ */
+
+#include <linux/phy.h>
+
+#include "aquantia.h"
+
+int aqr_phy_led_brightness_set(struct phy_device *phydev,
+			       u8 index, enum led_brightness value)
+{
+	if (index >= AQR_MAX_LEDS)
+		return -EINVAL;
+
+	return phy_modify_mmd(phydev, MDIO_MMD_VEND1, AQR_LED_PROV(index),
+			      VEND1_GLOBAL_LED_PROV_LINK_MASK |
+			      VEND1_GLOBAL_LED_PROV_FORCE_ON |
+			      VEND1_GLOBAL_LED_PROV_RX_ACT |
+			      VEND1_GLOBAL_LED_PROV_TX_ACT,
+			      value ? VEND1_GLOBAL_LED_PROV_FORCE_ON : 0);
+}
+
+static const unsigned long supported_triggers = (BIT(TRIGGER_NETDEV_LINK) |
+						 BIT(TRIGGER_NETDEV_LINK_100) |
+						 BIT(TRIGGER_NETDEV_LINK_1000) |
+						 BIT(TRIGGER_NETDEV_LINK_2500) |
+						 BIT(TRIGGER_NETDEV_LINK_5000) |
+						 BIT(TRIGGER_NETDEV_LINK_10000)  |
+						 BIT(TRIGGER_NETDEV_RX) |
+						 BIT(TRIGGER_NETDEV_TX));
+
+int aqr_phy_led_hw_is_supported(struct phy_device *phydev, u8 index,
+				unsigned long rules)
+{
+	if (index >= AQR_MAX_LEDS)
+		return -EINVAL;
+
+	/* All combinations of the supported triggers are allowed */
+	if (rules & ~supported_triggers)
+		return -EOPNOTSUPP;
+
+	return 0;
+}
+
+int aqr_phy_led_hw_control_get(struct phy_device *phydev, u8 index,
+			       unsigned long *rules)
+{
+	int val;
+
+	if (index >= AQR_MAX_LEDS)
+		return -EINVAL;
+
+	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, AQR_LED_PROV(index));
+	if (val < 0)
+		return val;
+
+	*rules = 0;
+	if (val & VEND1_GLOBAL_LED_PROV_LINK100)
+		*rules |= BIT(TRIGGER_NETDEV_LINK_100);
+
+	if (val & VEND1_GLOBAL_LED_PROV_LINK1000)
+		*rules |= BIT(TRIGGER_NETDEV_LINK_1000);
+
+	if (val & VEND1_GLOBAL_LED_PROV_LINK2500)
+		*rules |= BIT(TRIGGER_NETDEV_LINK_2500);
+
+	if (val & VEND1_GLOBAL_LED_PROV_LINK5000)
+		*rules |= BIT(TRIGGER_NETDEV_LINK_5000);
+
+	if (val & VEND1_GLOBAL_LED_PROV_LINK10000)
+		*rules |= BIT(TRIGGER_NETDEV_LINK_10000);
+
+	if (val & VEND1_GLOBAL_LED_PROV_RX_ACT)
+		*rules |= BIT(TRIGGER_NETDEV_RX);
+
+	if (val & VEND1_GLOBAL_LED_PROV_TX_ACT)
+		*rules |= BIT(TRIGGER_NETDEV_TX);
+
+	return 0;
+}
+
+int aqr_phy_led_hw_control_set(struct phy_device *phydev, u8 index,
+			       unsigned long rules)
+{
+	u16 val = 0;
+
+	if (index >= AQR_MAX_LEDS)
+		return -EINVAL;
+
+	if (rules & (BIT(TRIGGER_NETDEV_LINK_100) | BIT(TRIGGER_NETDEV_LINK)))
+		val |= VEND1_GLOBAL_LED_PROV_LINK100;
+
+	if (rules & (BIT(TRIGGER_NETDEV_LINK_1000) | BIT(TRIGGER_NETDEV_LINK)))
+		val |= VEND1_GLOBAL_LED_PROV_LINK1000;
+
+	if (rules & (BIT(TRIGGER_NETDEV_LINK_2500) | BIT(TRIGGER_NETDEV_LINK)))
+		val |= VEND1_GLOBAL_LED_PROV_LINK2500;
+
+	if (rules & (BIT(TRIGGER_NETDEV_LINK_5000) | BIT(TRIGGER_NETDEV_LINK)))
+		val |= VEND1_GLOBAL_LED_PROV_LINK5000;
+
+	if (rules & (BIT(TRIGGER_NETDEV_LINK_10000) | BIT(TRIGGER_NETDEV_LINK)))
+		val |= VEND1_GLOBAL_LED_PROV_LINK10000;
+
+	if (rules & BIT(TRIGGER_NETDEV_RX))
+		val |= VEND1_GLOBAL_LED_PROV_RX_ACT;
+
+	if (rules & BIT(TRIGGER_NETDEV_TX))
+		val |= VEND1_GLOBAL_LED_PROV_TX_ACT;
+
+	return phy_modify_mmd(phydev, MDIO_MMD_VEND1, AQR_LED_PROV(index),
+			      VEND1_GLOBAL_LED_PROV_LINK_MASK |
+			      VEND1_GLOBAL_LED_PROV_FORCE_ON |
+			      VEND1_GLOBAL_LED_PROV_RX_ACT |
+			      VEND1_GLOBAL_LED_PROV_TX_ACT, val);
+}
+
+int aqr_phy_led_active_low_set(struct phy_device *phydev, int index, bool enable)
+{
+	return phy_modify_mmd(phydev, MDIO_MMD_VEND1, AQR_LED_DRIVE(index),
+			      VEND1_GLOBAL_LED_DRIVE_VDD, enable);
+}
+
+int aqr_phy_led_polarity_set(struct phy_device *phydev, int index, unsigned long modes)
+{
+	struct aqr107_priv *priv = phydev->priv;
+	bool active_low = false;
+	u32 mode;
+
+	if (index >= AQR_MAX_LEDS)
+		return -EINVAL;
+
+	for_each_set_bit(mode, &modes, __PHY_LED_MODES_NUM) {
+		switch (mode) {
+		case PHY_LED_ACTIVE_LOW:
+			active_low = true;
+			break;
+		default:
+			return -EINVAL;
+		}
+	}
+
+	/* Save LED driver vdd state to restore on SW reset */
+	if (active_low)
+		priv->leds_active_low |= BIT(index);
+
+	return aqr_phy_led_active_low_set(phydev, index, active_low);
+}
--- linux-qcom-6.8.0.orig/drivers/net/phy/aquantia/aquantia_main.c
+++ linux-qcom-6.8.0/drivers/net/phy/aquantia/aquantia_main.c
@@ -22,9 +22,15 @@
 #define PHY_ID_AQR107	0x03a1b4e0
 #define PHY_ID_AQCS109	0x03a1b5c2
 #define PHY_ID_AQR405	0x03a1b4b0
+#define PHY_ID_AQR111	0x03a1b610
+#define PHY_ID_AQR111B0	0x03a1b612
 #define PHY_ID_AQR112	0x03a1b662
 #define PHY_ID_AQR412	0x03a1b712
+#define PHY_ID_AQR113	0x31c31c40
 #define PHY_ID_AQR113C	0x31c31c12
+#define PHY_ID_AQR114C	0x31c31c22
+#define PHY_ID_AQR115C	0x31c31c33
+#define PHY_ID_AQR813	0x31c31cb2
 
 #define MDIO_PHYXS_VEND_IF_STATUS		0xe812
 #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK	GENMASK(7, 3)
@@ -35,7 +41,9 @@
 #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_XAUI	4
 #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_SGMII	6
 #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_RXAUI	7
+#define MDIO_PHYXS_VEND_IF_STATUS_TYPE_OFF	9
 #define MDIO_PHYXS_VEND_IF_STATUS_TYPE_OCSGMII	10
+#define MDIO_PHYXS_VEND_IF_STATUS_TYPE_USX_5G	12
 
 #define MDIO_AN_VEND_PROV			0xc400
 #define MDIO_AN_VEND_PROV_1000BASET_FULL	BIT(15)
@@ -79,49 +87,12 @@
 #define MDIO_AN_RX_VEND_STAT3			0xe832
 #define MDIO_AN_RX_VEND_STAT3_AFR		BIT(0)
 
-/* MDIO_MMD_C22EXT */
-#define MDIO_C22EXT_STAT_SGMII_RX_GOOD_FRAMES		0xd292
-#define MDIO_C22EXT_STAT_SGMII_RX_BAD_FRAMES		0xd294
-#define MDIO_C22EXT_STAT_SGMII_RX_FALSE_CARRIER		0xd297
-#define MDIO_C22EXT_STAT_SGMII_TX_GOOD_FRAMES		0xd313
-#define MDIO_C22EXT_STAT_SGMII_TX_BAD_FRAMES		0xd315
-#define MDIO_C22EXT_STAT_SGMII_TX_FALSE_CARRIER		0xd317
-#define MDIO_C22EXT_STAT_SGMII_TX_COLLISIONS		0xd318
-#define MDIO_C22EXT_STAT_SGMII_TX_LINE_COLLISIONS	0xd319
-#define MDIO_C22EXT_STAT_SGMII_TX_FRAME_ALIGN_ERR	0xd31a
-#define MDIO_C22EXT_STAT_SGMII_TX_RUNT_FRAMES		0xd31b
-
 /* Sleep and timeout for checking if the Processor-Intensive
  * MDIO operation is finished
  */
 #define AQR107_OP_IN_PROG_SLEEP		1000
 #define AQR107_OP_IN_PROG_TIMEOUT	100000
 
-struct aqr107_hw_stat {
-	const char *name;
-	int reg;
-	int size;
-};
-
-#define SGMII_STAT(n, r, s) { n, MDIO_C22EXT_STAT_SGMII_ ## r, s }
-static const struct aqr107_hw_stat aqr107_hw_stats[] = {
-	SGMII_STAT("sgmii_rx_good_frames",	    RX_GOOD_FRAMES,	26),
-	SGMII_STAT("sgmii_rx_bad_frames",	    RX_BAD_FRAMES,	26),
-	SGMII_STAT("sgmii_rx_false_carrier_events", RX_FALSE_CARRIER,	 8),
-	SGMII_STAT("sgmii_tx_good_frames",	    TX_GOOD_FRAMES,	26),
-	SGMII_STAT("sgmii_tx_bad_frames",	    TX_BAD_FRAMES,	26),
-	SGMII_STAT("sgmii_tx_false_carrier_events", TX_FALSE_CARRIER,	 8),
-	SGMII_STAT("sgmii_tx_collisions",	    TX_COLLISIONS,	 8),
-	SGMII_STAT("sgmii_tx_line_collisions",	    TX_LINE_COLLISIONS,	 8),
-	SGMII_STAT("sgmii_tx_frame_alignment_err",  TX_FRAME_ALIGN_ERR,	16),
-	SGMII_STAT("sgmii_tx_runt_frames",	    TX_RUNT_FRAMES,	22),
-};
-#define AQR107_SGMII_STAT_SZ ARRAY_SIZE(aqr107_hw_stats)
-
-struct aqr107_priv {
-	u64 sgmii_stats[AQR107_SGMII_STAT_SZ];
-};
-
 static int aqr107_get_sset_count(struct phy_device *phydev)
 {
 	return AQR107_SGMII_STAT_SZ;
@@ -373,9 +344,19 @@
 	if (!phydev->link || phydev->autoneg == AUTONEG_DISABLE)
 		return 0;
 
-	val = phy_read_mmd(phydev, MDIO_MMD_PHYXS, MDIO_PHYXS_VEND_IF_STATUS);
-	if (val < 0)
-		return val;
+	/**
+	 * The status register is not immediately correct on line side link up.
+	 * Poll periodically until it reflects the correct ON state.
+	 * Only return fail for read error, timeout defaults to OFF state.
+	 */
+	ret = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_PHYXS,
+					MDIO_PHYXS_VEND_IF_STATUS, val,
+					(FIELD_GET(MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK, val) !=
+					MDIO_PHYXS_VEND_IF_STATUS_TYPE_OFF),
+					AQR107_OP_IN_PROG_SLEEP,
+					AQR107_OP_IN_PROG_TIMEOUT, false);
+	if (ret && ret != -ETIMEDOUT)
+		return ret;
 
 	switch (FIELD_GET(MDIO_PHYXS_VEND_IF_STATUS_TYPE_MASK, val)) {
 	case MDIO_PHYXS_VEND_IF_STATUS_TYPE_KR:
@@ -402,7 +383,12 @@
 	case MDIO_PHYXS_VEND_IF_STATUS_TYPE_OCSGMII:
 		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
 		break;
+	case MDIO_PHYXS_VEND_IF_STATUS_TYPE_USX_5G:
+		phydev->interface = PHY_INTERFACE_MODE_5GBASER;
+		break;
+	case MDIO_PHYXS_VEND_IF_STATUS_TYPE_OFF:
 	default:
+		phydev->link = false;
 		phydev->interface = PHY_INTERFACE_MODE_NA;
 		break;
 	}
@@ -466,6 +452,9 @@
 	}
 }
 
+#define AQR_FW_WAIT_SLEEP_US	20000
+#define AQR_FW_WAIT_TIMEOUT_US	2000000
+
 /* If we configure settings whilst firmware is still initializing the chip,
  * then these settings may be overwritten. Therefore make sure chip
  * initialization has completed. Use presence of the firmware ID as
@@ -473,13 +462,21 @@
  * The chip also provides a "reset completed" bit, but it's cleared after
  * read. Therefore function would time out if called again.
  */
-static int aqr107_wait_reset_complete(struct phy_device *phydev)
+int aqr_wait_reset_complete(struct phy_device *phydev)
 {
-	int val;
+	int ret, val;
 
-	return phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1,
-					 VEND1_GLOBAL_FW_ID, val, val != 0,
-					 20000, 2000000, false);
+	ret = read_poll_timeout(phy_read_mmd, val, val != 0,
+				AQR_FW_WAIT_SLEEP_US, AQR_FW_WAIT_TIMEOUT_US,
+				false, phydev, MDIO_MMD_VEND1,
+				VEND1_GLOBAL_FW_ID);
+	if (val < 0) {
+		phydev_err(phydev, "Failed to read VEND1_GLOBAL_FW_ID: %pe\n",
+			   ERR_PTR(val));
+		return val;
+	}
+
+	return ret;
 }
 
 static void aqr107_chip_info(struct phy_device *phydev)
@@ -507,7 +504,9 @@
 
 static int aqr107_config_init(struct phy_device *phydev)
 {
-	int ret;
+	struct aqr107_priv *priv = phydev->priv;
+	u32 led_active_low;
+	int ret, index = 0;
 
 	/* Check that the PHY interface type is compatible */
 	if (phydev->interface != PHY_INTERFACE_MODE_SGMII &&
@@ -518,17 +517,30 @@
 	    phydev->interface != PHY_INTERFACE_MODE_10GKR &&
 	    phydev->interface != PHY_INTERFACE_MODE_10GBASER &&
 	    phydev->interface != PHY_INTERFACE_MODE_XAUI &&
-	    phydev->interface != PHY_INTERFACE_MODE_RXAUI)
+	    phydev->interface != PHY_INTERFACE_MODE_RXAUI &&
+	    phydev->interface != PHY_INTERFACE_MODE_5GBASER)
 		return -ENODEV;
 
 	WARN(phydev->interface == PHY_INTERFACE_MODE_XGMII,
 	     "Your devicetree is out of date, please update it. The AQR107 family doesn't support XGMII, maybe you mean USXGMII.\n");
 
-	ret = aqr107_wait_reset_complete(phydev);
+	ret = aqr_wait_reset_complete(phydev);
 	if (!ret)
 		aqr107_chip_info(phydev);
 
-	return aqr107_set_downshift(phydev, MDIO_AN_VEND_PROV_DOWNSHIFT_DFLT);
+	ret = aqr107_set_downshift(phydev, MDIO_AN_VEND_PROV_DOWNSHIFT_DFLT);
+	if (ret)
+		return ret;
+
+	/* Restore LED polarity state after reset */
+	for_each_set_bit(led_active_low, &priv->leds_active_low, AQR_MAX_LEDS) {
+		ret = aqr_phy_led_active_low_set(phydev, index, led_active_low);
+		if (ret)
+			return ret;
+		index++;
+	}
+
+	return 0;
 }
 
 static int aqcs109_config_init(struct phy_device *phydev)
@@ -540,7 +552,7 @@
 	    phydev->interface != PHY_INTERFACE_MODE_2500BASEX)
 		return -ENODEV;
 
-	ret = aqr107_wait_reset_complete(phydev);
+	ret = aqr_wait_reset_complete(phydev);
 	if (!ret)
 		aqr107_chip_info(phydev);
 
@@ -627,7 +639,8 @@
 {
 	if (iface == PHY_INTERFACE_MODE_10GBASER ||
 	    iface == PHY_INTERFACE_MODE_2500BASEX ||
-	    iface == PHY_INTERFACE_MODE_NA)
+	    iface == PHY_INTERFACE_MODE_NA ||
+	    iface == PHY_INTERFACE_MODE_5GBASER)
 		return RATE_MATCH_PAUSE;
 	return RATE_MATCH_NONE;
 }
@@ -719,6 +732,53 @@
 	return 0;
 }
 
+static int aqr113c_fill_interface_modes(struct phy_device *phydev)
+{
+	int val, ret;
+
+	/* It's been observed on some models that - when coming out of suspend
+	 * - the FW signals that the PHY is ready but the GLOBAL_CFG registers
+	 * continue on returning zeroes for some time. Let's poll the 100M
+	 * register until it returns a real value as both 113c and 115c support
+	 * this mode.
+	 */
+	ret = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1,
+					VEND1_GLOBAL_CFG_100M, val, val != 0,
+					1000, 100000, false);
+	if (ret)
+		return ret;
+
+	return aqr107_fill_interface_modes(phydev);
+}
+
+static int aqr113c_get_features(struct phy_device *phydev)
+{
+	unsigned long *supported = phydev->supported;
+
+	/* PHY supports speeds up to 10G with autoneg. PMA capabilities
+	 * are not useful.
+	 */
+	linkmode_or(supported, supported, phy_gbit_features);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT, supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT, supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT, supported);
+
+	return 0;
+}
+
+static int aqr115c_get_features(struct phy_device *phydev)
+{
+	unsigned long *supported = phydev->supported;
+
+	/* PHY supports speeds up to 2.5G with autoneg. PMA capabilities
+	 * are not useful.
+	 */
+	linkmode_or(supported, supported, phy_gbit_features);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT, supported);
+
+	return 0;
+}
+
 static int aqr113c_config_init(struct phy_device *phydev)
 {
 	int ret;
@@ -727,7 +787,16 @@
 	if (ret < 0)
 		return ret;
 
-	return aqr107_fill_interface_modes(phydev);
+	ret = phy_clear_bits_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_PMA_TXDIS,
+				 MDIO_PMD_TXDIS_GLOBAL);
+	if (ret)
+		return ret;
+
+	ret = aqr107_wait_processor_intensive_op(phydev);
+	if (ret)
+		return ret;
+
+	return aqr113c_fill_interface_modes(phydev);
 }
 
 static int aqr107_probe(struct phy_device *phydev)
@@ -746,6 +815,16 @@
 	return aqr_hwmon_probe(phydev);
 }
 
+static int aqr111_config_init(struct phy_device *phydev)
+{
+	/* AQR111 reports supporting speed up to 10G,
+	 * however only speeds up to 5G are supported.
+	 */
+	phy_set_max_speed(phydev, SPEED_5000);
+
+	return aqr107_config_init(phydev);
+}
+
 static struct phy_driver aqr_driver[] = {
 {
 	PHY_ID_MATCH_MODEL(PHY_ID_AQ1202),
@@ -799,6 +878,11 @@
 	.get_strings	= aqr107_get_strings,
 	.get_stats	= aqr107_get_stats,
 	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
 },
 {
 	PHY_ID_MATCH_MODEL(PHY_ID_AQCS109),
@@ -818,6 +902,59 @@
 	.get_strings	= aqr107_get_strings,
 	.get_stats	= aqr107_get_stats,
 	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
+},
+{
+	PHY_ID_MATCH_MODEL(PHY_ID_AQR111),
+	.name		= "Aquantia AQR111",
+	.probe		= aqr107_probe,
+	.get_rate_matching = aqr107_get_rate_matching,
+	.config_init	= aqr111_config_init,
+	.config_aneg    = aqr_config_aneg,
+	.config_intr	= aqr_config_intr,
+	.handle_interrupt = aqr_handle_interrupt,
+	.read_status	= aqr107_read_status,
+	.get_tunable    = aqr107_get_tunable,
+	.set_tunable    = aqr107_set_tunable,
+	.suspend	= aqr107_suspend,
+	.resume		= aqr107_resume,
+	.get_sset_count	= aqr107_get_sset_count,
+	.get_strings	= aqr107_get_strings,
+	.get_stats	= aqr107_get_stats,
+	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
+},
+{
+	PHY_ID_MATCH_MODEL(PHY_ID_AQR111B0),
+	.name		= "Aquantia AQR111B0",
+	.probe		= aqr107_probe,
+	.get_rate_matching = aqr107_get_rate_matching,
+	.config_init	= aqr111_config_init,
+	.config_aneg    = aqr_config_aneg,
+	.config_intr	= aqr_config_intr,
+	.handle_interrupt = aqr_handle_interrupt,
+	.read_status	= aqr107_read_status,
+	.get_tunable    = aqr107_get_tunable,
+	.set_tunable    = aqr107_set_tunable,
+	.suspend	= aqr107_suspend,
+	.resume		= aqr107_resume,
+	.get_sset_count	= aqr107_get_sset_count,
+	.get_strings	= aqr107_get_strings,
+	.get_stats	= aqr107_get_stats,
+	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
 },
 {
 	PHY_ID_MATCH_MODEL(PHY_ID_AQR405),
@@ -844,6 +981,11 @@
 	.get_strings	= aqr107_get_strings,
 	.get_stats	= aqr107_get_stats,
 	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
 },
 {
 	PHY_ID_MATCH_MODEL(PHY_ID_AQR412),
@@ -864,6 +1006,30 @@
 	.link_change_notify = aqr107_link_change_notify,
 },
 {
+	PHY_ID_MATCH_MODEL(PHY_ID_AQR113),
+	.name		= "Aquantia AQR113",
+	.probe          = aqr107_probe,
+	.get_rate_matching = aqr107_get_rate_matching,
+	.config_init    = aqr113c_config_init,
+	.config_aneg    = aqr_config_aneg,
+	.config_intr    = aqr_config_intr,
+	.handle_interrupt       = aqr_handle_interrupt,
+	.read_status    = aqr107_read_status,
+	.get_tunable    = aqr107_get_tunable,
+	.set_tunable    = aqr107_set_tunable,
+	.suspend        = aqr107_suspend,
+	.resume         = aqr107_resume,
+	.get_sset_count = aqr107_get_sset_count,
+	.get_strings    = aqr107_get_strings,
+	.get_stats      = aqr107_get_stats,
+	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
+},
+{
 	PHY_ID_MATCH_MODEL(PHY_ID_AQR113C),
 	.name           = "Aquantia AQR113C",
 	.probe          = aqr107_probe,
@@ -880,7 +1046,86 @@
 	.get_sset_count = aqr107_get_sset_count,
 	.get_strings    = aqr107_get_strings,
 	.get_stats      = aqr107_get_stats,
+	.get_features   = aqr113c_get_features,
+	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
+},
+{
+	PHY_ID_MATCH_MODEL(PHY_ID_AQR114C),
+	.name           = "Aquantia AQR114C",
+	.probe          = aqr107_probe,
+	.get_rate_matching = aqr107_get_rate_matching,
+	.config_init    = aqr111_config_init,
+	.config_aneg    = aqr_config_aneg,
+	.config_intr    = aqr_config_intr,
+	.handle_interrupt = aqr_handle_interrupt,
+	.read_status    = aqr107_read_status,
+	.get_tunable    = aqr107_get_tunable,
+	.set_tunable    = aqr107_set_tunable,
+	.suspend        = aqr107_suspend,
+	.resume         = aqr107_resume,
+	.get_sset_count = aqr107_get_sset_count,
+	.get_strings    = aqr107_get_strings,
+	.get_stats      = aqr107_get_stats,
+	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
+},
+{
+	PHY_ID_MATCH_MODEL(PHY_ID_AQR115C),
+	.name           = "Aquantia AQR115C",
+	.probe          = aqr107_probe,
+	.get_rate_matching = aqr107_get_rate_matching,
+	.config_init    = aqr113c_config_init,
+	.config_aneg    = aqr_config_aneg,
+	.config_intr    = aqr_config_intr,
+	.handle_interrupt = aqr_handle_interrupt,
+	.read_status    = aqr107_read_status,
+	.get_tunable    = aqr107_get_tunable,
+	.set_tunable    = aqr107_set_tunable,
+	.suspend        = aqr107_suspend,
+	.resume         = aqr107_resume,
+	.get_sset_count = aqr107_get_sset_count,
+	.get_strings    = aqr107_get_strings,
+	.get_stats      = aqr107_get_stats,
+	.get_features   = aqr115c_get_features,
+	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
+},
+{
+	PHY_ID_MATCH_MODEL(PHY_ID_AQR813),
+	.name		= "Aquantia AQR813",
+	.probe		= aqr107_probe,
+	.get_rate_matching = aqr107_get_rate_matching,
+	.config_init	= aqr107_config_init,
+	.config_aneg    = aqr_config_aneg,
+	.config_intr	= aqr_config_intr,
+	.handle_interrupt = aqr_handle_interrupt,
+	.read_status	= aqr107_read_status,
+	.get_tunable    = aqr107_get_tunable,
+	.set_tunable    = aqr107_set_tunable,
+	.suspend	= aqr107_suspend,
+	.resume		= aqr107_resume,
+	.get_sset_count	= aqr107_get_sset_count,
+	.get_strings	= aqr107_get_strings,
+	.get_stats	= aqr107_get_stats,
 	.link_change_notify = aqr107_link_change_notify,
+	.led_brightness_set = aqr_phy_led_brightness_set,
+	.led_hw_is_supported = aqr_phy_led_hw_is_supported,
+	.led_hw_control_set = aqr_phy_led_hw_control_set,
+	.led_hw_control_get = aqr_phy_led_hw_control_get,
+	.led_polarity_set = aqr_phy_led_polarity_set,
 },
 };
 
@@ -894,9 +1139,15 @@
 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR107) },
 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQCS109) },
 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR405) },
+	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR111) },
+	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR111B0) },
 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR112) },
 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR412) },
+	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR113) },
 	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR113C) },
+	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR114C) },
+	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR115C) },
+	{ PHY_ID_MATCH_MODEL(PHY_ID_AQR813) },
 	{ }
 };
 
--- linux-qcom-6.8.0.orig/drivers/net/phy/at803x.c
+++ linux-qcom-6.8.0/drivers/net/phy/at803x.c
@@ -1503,7 +1503,7 @@
 
 static int at8031_probe(struct phy_device *phydev)
 {
-	struct at803x_priv *priv = phydev->priv;
+	struct at803x_priv *priv;
 	int mode_cfg;
 	int ccr;
 	int ret;
@@ -1512,6 +1512,8 @@
 	if (ret)
 		return ret;
 
+	priv = phydev->priv;
+
 	/* Only supported on AR8031/AR8033, the AR8030/AR8035 use strapping
 	 * options.
 	 */
--- linux-qcom-6.8.0.orig/drivers/net/phy/bcm84881.c
+++ linux-qcom-6.8.0/drivers/net/phy/bcm84881.c
@@ -132,7 +132,7 @@
 
 	bmsr = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_C22 + MII_BMSR);
 	if (bmsr < 0)
-		return val;
+		return bmsr;
 
 	return !!(val & MDIO_AN_STAT1_COMPLETE) &&
 	       !!(bmsr & BMSR_ANEGCOMPLETE);
@@ -158,7 +158,7 @@
 
 	bmsr = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_C22 + MII_BMSR);
 	if (bmsr < 0)
-		return val;
+		return bmsr;
 
 	phydev->autoneg_complete = !!(val & MDIO_AN_STAT1_COMPLETE) &&
 				   !!(bmsr & BMSR_ANEGCOMPLETE);
--- linux-qcom-6.8.0.orig/drivers/net/phy/dp83822.c
+++ linux-qcom-6.8.0/drivers/net/phy/dp83822.c
@@ -40,8 +40,8 @@
 /* Control Register 2 bits */
 #define DP83822_FX_ENABLE	BIT(14)
 
-#define DP83822_HW_RESET	BIT(15)
-#define DP83822_SW_RESET	BIT(14)
+#define DP83822_SW_RESET	BIT(15)
+#define DP83822_DIG_RESTART	BIT(14)
 
 /* PHY STS bits */
 #define DP83822_PHYSTS_DUPLEX			BIT(2)
@@ -380,7 +380,7 @@
 {
 	struct dp83822_private *dp83822 = phydev->priv;
 	struct device *dev = &phydev->mdio.dev;
-	int rgmii_delay;
+	int rgmii_delay = 0;
 	s32 rx_int_delay;
 	s32 tx_int_delay;
 	int err = 0;
@@ -390,30 +390,33 @@
 		rx_int_delay = phy_get_internal_delay(phydev, dev, NULL, 0,
 						      true);
 
-		if (rx_int_delay <= 0)
-			rgmii_delay = 0;
-		else
-			rgmii_delay = DP83822_RX_CLK_SHIFT;
+		/* Set DP83822_RX_CLK_SHIFT to enable rx clk internal delay */
+		if (rx_int_delay > 0)
+			rgmii_delay |= DP83822_RX_CLK_SHIFT;
 
 		tx_int_delay = phy_get_internal_delay(phydev, dev, NULL, 0,
 						      false);
+
+		/* Set DP83822_TX_CLK_SHIFT to disable tx clk internal delay */
 		if (tx_int_delay <= 0)
-			rgmii_delay &= ~DP83822_TX_CLK_SHIFT;
-		else
 			rgmii_delay |= DP83822_TX_CLK_SHIFT;
 
-		if (rgmii_delay) {
-			err = phy_set_bits_mmd(phydev, DP83822_DEVADDR,
-					       MII_DP83822_RCSR, rgmii_delay);
-			if (err)
-				return err;
-		}
+		err = phy_modify_mmd(phydev, DP83822_DEVADDR, MII_DP83822_RCSR,
+				     DP83822_RX_CLK_SHIFT | DP83822_TX_CLK_SHIFT, rgmii_delay);
+		if (err)
+			return err;
 
-		phy_set_bits_mmd(phydev, DP83822_DEVADDR,
-					MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
+		err = phy_set_bits_mmd(phydev, DP83822_DEVADDR,
+				       MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
+
+		if (err)
+			return err;
 	} else {
-		phy_clear_bits_mmd(phydev, DP83822_DEVADDR,
-					MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
+		err = phy_clear_bits_mmd(phydev, DP83822_DEVADDR,
+					 MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
+
+		if (err)
+			return err;
 	}
 
 	if (dp83822->fx_enabled) {
--- linux-qcom-6.8.0.orig/drivers/net/phy/dp83848.c
+++ linux-qcom-6.8.0/drivers/net/phy/dp83848.c
@@ -147,6 +147,8 @@
 		/* IRQ related */				\
 		.config_intr	= dp83848_config_intr,		\
 		.handle_interrupt = dp83848_handle_interrupt,	\
+								\
+		.flags		= PHY_RST_AFTER_CLK_EN,		\
 	}
 
 static struct phy_driver dp83848_driver[] = {
--- linux-qcom-6.8.0.orig/drivers/net/phy/dp83869.c
+++ linux-qcom-6.8.0/drivers/net/phy/dp83869.c
@@ -153,19 +153,31 @@
 	int mode;
 };
 
+static int dp83869_config_aneg(struct phy_device *phydev)
+{
+	struct dp83869_private *dp83869 = phydev->priv;
+
+	if (dp83869->mode != DP83869_RGMII_1000_BASE)
+		return genphy_config_aneg(phydev);
+
+	return genphy_c37_config_aneg(phydev);
+}
+
 static int dp83869_read_status(struct phy_device *phydev)
 {
 	struct dp83869_private *dp83869 = phydev->priv;
 	int ret;
 
+	if (dp83869->mode == DP83869_RGMII_1000_BASE)
+		return genphy_c37_read_status(phydev);
+
 	ret = genphy_read_status(phydev);
 	if (ret)
 		return ret;
 
-	if (linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported)) {
+	if (dp83869->mode == DP83869_RGMII_100_BASE) {
 		if (phydev->link) {
-			if (dp83869->mode == DP83869_RGMII_100_BASE)
-				phydev->speed = SPEED_100;
+			phydev->speed = SPEED_100;
 		} else {
 			phydev->speed = SPEED_UNKNOWN;
 			phydev->duplex = DUPLEX_UNKNOWN;
@@ -645,7 +657,6 @@
 		     phydev->supported);
 
 	linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported);
-	linkmode_set_bit(ADVERTISED_FIBRE, phydev->advertising);
 
 	if (dp83869->mode == DP83869_RGMII_1000_BASE) {
 		linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
@@ -695,7 +706,8 @@
 	phy_ctrl_val = dp83869->mode;
 	if (phydev->interface == PHY_INTERFACE_MODE_MII) {
 		if (dp83869->mode == DP83869_100M_MEDIA_CONVERT ||
-		    dp83869->mode == DP83869_RGMII_100_BASE) {
+		    dp83869->mode == DP83869_RGMII_100_BASE ||
+		    dp83869->mode == DP83869_RGMII_COPPER_ETHERNET) {
 			phy_ctrl_val |= DP83869_OP_MODE_MII;
 		} else {
 			phydev_err(phydev, "selected op-mode is not valid with MII mode\n");
@@ -898,6 +910,7 @@
 	.soft_reset	= dp83869_phy_reset,			\
 	.config_intr	= dp83869_config_intr,			\
 	.handle_interrupt = dp83869_handle_interrupt,		\
+	.config_aneg    = dp83869_config_aneg,                  \
 	.read_status	= dp83869_read_status,			\
 	.get_tunable	= dp83869_get_tunable,			\
 	.set_tunable	= dp83869_set_tunable,			\
--- linux-qcom-6.8.0.orig/drivers/net/phy/dp83tg720.c
+++ linux-qcom-6.8.0/drivers/net/phy/dp83tg720.c
@@ -17,6 +17,11 @@
 #define DP83TG720S_PHY_RESET			0x1f
 #define DP83TG720S_HW_RESET			BIT(15)
 
+#define DP83TG720S_LPS_CFG3			0x18c
+/* Power modes are documented as bit fields but used as values */
+/* Power Mode 0 is Normal mode */
+#define DP83TG720S_LPS_CFG3_PWR_MODE_0		BIT(0)
+
 #define DP83TG720S_RGMII_DELAY_CTRL		0x602
 /* In RGMII mode, Enable or disable the internal delay for RXD */
 #define DP83TG720S_RGMII_RX_CLK_SEL		BIT(1)
@@ -31,11 +36,20 @@
 
 static int dp83tg720_config_aneg(struct phy_device *phydev)
 {
+	int ret;
+
 	/* Autoneg is not supported and this PHY supports only one speed.
 	 * We need to care only about master/slave configuration if it was
 	 * changed by user.
 	 */
-	return genphy_c45_pma_baset1_setup_master_slave(phydev);
+	ret = genphy_c45_pma_baset1_setup_master_slave(phydev);
+	if (ret)
+		return ret;
+
+	/* Re-read role configuration to make changes visible even if
+	 * the link is in administrative down state.
+	 */
+	return genphy_c45_pma_baset1_read_master_slave(phydev);
 }
 
 static int dp83tg720_read_status(struct phy_device *phydev)
@@ -64,6 +78,8 @@
 			return ret;
 
 		/* After HW reset we need to restore master/slave configuration.
+		 * genphy_c45_pma_baset1_read_master_slave() call will be done
+		 * by the dp83tg720_config_aneg() function.
 		 */
 		ret = dp83tg720_config_aneg(phydev);
 		if (ret)
@@ -154,10 +170,24 @@
 	 */
 	usleep_range(1000, 2000);
 
-	if (phy_interface_is_rgmii(phydev))
-		return dp83tg720_config_rgmii_delay(phydev);
+	if (phy_interface_is_rgmii(phydev)) {
+		ret = dp83tg720_config_rgmii_delay(phydev);
+		if (ret)
+			return ret;
+	}
+
+	/* In case the PHY is bootstrapped in managed mode, we need to
+	 * wake it.
+	 */
+	ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, DP83TG720S_LPS_CFG3,
+			    DP83TG720S_LPS_CFG3_PWR_MODE_0);
+	if (ret)
+		return ret;
 
-	return 0;
+	/* Make role configuration visible for ethtool on init and after
+	 * rest.
+	 */
+	return genphy_c45_pma_baset1_read_master_slave(phydev);
 }
 
 static struct phy_driver dp83tg720_driver[] = {
--- linux-qcom-6.8.0.orig/drivers/net/phy/marvell.c
+++ linux-qcom-6.8.0/drivers/net/phy/marvell.c
@@ -33,6 +33,7 @@
 #include <linux/bitfield.h>
 #include <linux/of.h>
 #include <linux/sfp.h>
+#include <linux/dmi.h>
 
 #include <linux/io.h>
 #include <asm/irq.h>
@@ -312,6 +313,16 @@
 	s8 pair;
 };
 
+static const struct dmi_system_id skip_config_led_tbl[] = {
+	{
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Dell EMC"),
+			DMI_MATCH(DMI_BOARD_NAME, "0d370eed-89ca-4dc0-a365-e9904c4c62bb"),
+		},
+	},
+	{}
+};
+
 static int marvell_read_page(struct phy_device *phydev)
 {
 	return __phy_read(phydev, MII_MARVELL_PHY_PAGE);
@@ -759,6 +770,9 @@
 	u16 def_config;
 	int err;
 
+	if (dmi_check_system(skip_config_led_tbl))
+		return;
+
 	switch (MARVELL_PHY_FAMILY_ID(phydev->phy_id)) {
 	/* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
 	case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1121R):
--- linux-qcom-6.8.0.orig/drivers/net/phy/mediatek-ge-soc.c
+++ linux-qcom-6.8.0/drivers/net/phy/mediatek-ge-soc.c
@@ -216,6 +216,9 @@
 #define   MTK_PHY_LED_ON_LINK1000		BIT(0)
 #define   MTK_PHY_LED_ON_LINK100		BIT(1)
 #define   MTK_PHY_LED_ON_LINK10			BIT(2)
+#define   MTK_PHY_LED_ON_LINK			(MTK_PHY_LED_ON_LINK10 |\
+						 MTK_PHY_LED_ON_LINK100 |\
+						 MTK_PHY_LED_ON_LINK1000)
 #define   MTK_PHY_LED_ON_LINKDOWN		BIT(3)
 #define   MTK_PHY_LED_ON_FDX			BIT(4) /* Full duplex */
 #define   MTK_PHY_LED_ON_HDX			BIT(5) /* Half duplex */
@@ -231,6 +234,12 @@
 #define   MTK_PHY_LED_BLINK_100RX		BIT(3)
 #define   MTK_PHY_LED_BLINK_10TX		BIT(4)
 #define   MTK_PHY_LED_BLINK_10RX		BIT(5)
+#define   MTK_PHY_LED_BLINK_RX			(MTK_PHY_LED_BLINK_10RX |\
+						 MTK_PHY_LED_BLINK_100RX |\
+						 MTK_PHY_LED_BLINK_1000RX)
+#define   MTK_PHY_LED_BLINK_TX			(MTK_PHY_LED_BLINK_10TX |\
+						 MTK_PHY_LED_BLINK_100TX |\
+						 MTK_PHY_LED_BLINK_1000TX)
 #define   MTK_PHY_LED_BLINK_COLLISION		BIT(6)
 #define   MTK_PHY_LED_BLINK_RX_CRC_ERR		BIT(7)
 #define   MTK_PHY_LED_BLINK_RX_IDLE_ERR		BIT(8)
@@ -1247,11 +1256,9 @@
 	if (blink < 0)
 		return -EIO;
 
-	if ((on & (MTK_PHY_LED_ON_LINK1000 | MTK_PHY_LED_ON_LINK100 |
-		   MTK_PHY_LED_ON_LINK10)) ||
-	    (blink & (MTK_PHY_LED_BLINK_1000RX | MTK_PHY_LED_BLINK_100RX |
-		      MTK_PHY_LED_BLINK_10RX | MTK_PHY_LED_BLINK_1000TX |
-		      MTK_PHY_LED_BLINK_100TX | MTK_PHY_LED_BLINK_10TX)))
+	if ((on & (MTK_PHY_LED_ON_LINK | MTK_PHY_LED_ON_FDX | MTK_PHY_LED_ON_HDX |
+		   MTK_PHY_LED_ON_LINKDOWN)) ||
+	    (blink & (MTK_PHY_LED_BLINK_RX | MTK_PHY_LED_BLINK_TX)))
 		set_bit(bit_netdev, &priv->led_state);
 	else
 		clear_bit(bit_netdev, &priv->led_state);
@@ -1269,7 +1276,7 @@
 	if (!rules)
 		return 0;
 
-	if (on & (MTK_PHY_LED_ON_LINK1000 | MTK_PHY_LED_ON_LINK100 | MTK_PHY_LED_ON_LINK10))
+	if (on & MTK_PHY_LED_ON_LINK)
 		*rules |= BIT(TRIGGER_NETDEV_LINK);
 
 	if (on & MTK_PHY_LED_ON_LINK10)
@@ -1287,10 +1294,10 @@
 	if (on & MTK_PHY_LED_ON_HDX)
 		*rules |= BIT(TRIGGER_NETDEV_HALF_DUPLEX);
 
-	if (blink & (MTK_PHY_LED_BLINK_1000RX | MTK_PHY_LED_BLINK_100RX | MTK_PHY_LED_BLINK_10RX))
+	if (blink & MTK_PHY_LED_BLINK_RX)
 		*rules |= BIT(TRIGGER_NETDEV_RX);
 
-	if (blink & (MTK_PHY_LED_BLINK_1000TX | MTK_PHY_LED_BLINK_100TX | MTK_PHY_LED_BLINK_10TX))
+	if (blink & MTK_PHY_LED_BLINK_TX)
 		*rules |= BIT(TRIGGER_NETDEV_TX);
 
 	return 0;
@@ -1323,15 +1330,19 @@
 		on |= MTK_PHY_LED_ON_LINK1000;
 
 	if (rules & BIT(TRIGGER_NETDEV_RX)) {
-		blink |= MTK_PHY_LED_BLINK_10RX  |
-			 MTK_PHY_LED_BLINK_100RX |
-			 MTK_PHY_LED_BLINK_1000RX;
+		blink |= (on & MTK_PHY_LED_ON_LINK) ?
+			  (((on & MTK_PHY_LED_ON_LINK10) ? MTK_PHY_LED_BLINK_10RX : 0) |
+			   ((on & MTK_PHY_LED_ON_LINK100) ? MTK_PHY_LED_BLINK_100RX : 0) |
+			   ((on & MTK_PHY_LED_ON_LINK1000) ? MTK_PHY_LED_BLINK_1000RX : 0)) :
+			  MTK_PHY_LED_BLINK_RX;
 	}
 
 	if (rules & BIT(TRIGGER_NETDEV_TX)) {
-		blink |= MTK_PHY_LED_BLINK_10TX  |
-			 MTK_PHY_LED_BLINK_100TX |
-			 MTK_PHY_LED_BLINK_1000TX;
+		blink |= (on & MTK_PHY_LED_ON_LINK) ?
+			  (((on & MTK_PHY_LED_ON_LINK10) ? MTK_PHY_LED_BLINK_10TX : 0) |
+			   ((on & MTK_PHY_LED_ON_LINK100) ? MTK_PHY_LED_BLINK_100TX : 0) |
+			   ((on & MTK_PHY_LED_ON_LINK1000) ? MTK_PHY_LED_BLINK_1000TX : 0)) :
+			  MTK_PHY_LED_BLINK_TX;
 	}
 
 	if (blink || on)
@@ -1344,9 +1355,7 @@
 				MTK_PHY_LED0_ON_CTRL,
 			     MTK_PHY_LED_ON_FDX     |
 			     MTK_PHY_LED_ON_HDX     |
-			     MTK_PHY_LED_ON_LINK10  |
-			     MTK_PHY_LED_ON_LINK100 |
-			     MTK_PHY_LED_ON_LINK1000,
+			     MTK_PHY_LED_ON_LINK,
 			     on);
 
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/net/phy/micrel.c
+++ linux-qcom-6.8.0/drivers/net/phy/micrel.c
@@ -336,10 +336,12 @@
 struct kszphy_priv {
 	struct kszphy_ptp_priv ptp_priv;
 	const struct kszphy_type *type;
+	struct clk *clk;
 	int led_mode;
 	u16 vct_ctrl1000;
 	bool rmii_ref_clk_sel;
 	bool rmii_ref_clk_sel_val;
+	bool clk_enable;
 	u64 stats[ARRAY_SIZE(kszphy_hw_stats)];
 };
 
@@ -770,6 +772,17 @@
 {
 	int ret;
 
+	/* Chip can be powered down by the bootstrap code. */
+	ret = phy_read(phydev, MII_BMCR);
+	if (ret < 0)
+		return ret;
+	if (ret & BMCR_PDOWN) {
+		ret = phy_write(phydev, MII_BMCR, ret & ~BMCR_PDOWN);
+		if (ret < 0)
+			return ret;
+		usleep_range(1000, 2000);
+	}
+
 	ret = phy_write_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_DEVID1, 0xB61A);
 	if (ret)
 		return ret;
@@ -1282,6 +1295,8 @@
 	const struct device *dev_walker;
 	int ret;
 
+	phydev->mdix_ctrl = ETH_TP_MDI_AUTO;
+
 	dev_walker = &phydev->mdio.dev;
 	do {
 		of_node = dev_walker->of_node;
@@ -1331,28 +1346,30 @@
 #define MII_KSZ9131_AUTO_MDIX		0x1C
 #define MII_KSZ9131_AUTO_MDI_SET	BIT(7)
 #define MII_KSZ9131_AUTO_MDIX_SWAP_OFF	BIT(6)
+#define MII_KSZ9131_DIG_AXAN_STS	0x14
+#define MII_KSZ9131_DIG_AXAN_STS_LINK_DET	BIT(14)
+#define MII_KSZ9131_DIG_AXAN_STS_A_SELECT	BIT(12)
 
 static int ksz9131_mdix_update(struct phy_device *phydev)
 {
 	int ret;
 
-	ret = phy_read(phydev, MII_KSZ9131_AUTO_MDIX);
-	if (ret < 0)
-		return ret;
-
-	if (ret & MII_KSZ9131_AUTO_MDIX_SWAP_OFF) {
-		if (ret & MII_KSZ9131_AUTO_MDI_SET)
-			phydev->mdix_ctrl = ETH_TP_MDI;
-		else
-			phydev->mdix_ctrl = ETH_TP_MDI_X;
+	if (phydev->mdix_ctrl != ETH_TP_MDI_AUTO) {
+		phydev->mdix = phydev->mdix_ctrl;
 	} else {
-		phydev->mdix_ctrl = ETH_TP_MDI_AUTO;
-	}
+		ret = phy_read(phydev, MII_KSZ9131_DIG_AXAN_STS);
+		if (ret < 0)
+			return ret;
 
-	if (ret & MII_KSZ9131_AUTO_MDI_SET)
-		phydev->mdix = ETH_TP_MDI;
-	else
-		phydev->mdix = ETH_TP_MDI_X;
+		if (ret & MII_KSZ9131_DIG_AXAN_STS_LINK_DET) {
+			if (ret & MII_KSZ9131_DIG_AXAN_STS_A_SELECT)
+				phydev->mdix = ETH_TP_MDI;
+			else
+				phydev->mdix = ETH_TP_MDI_X;
+		} else {
+			phydev->mdix = ETH_TP_MDI_INVALID;
+		}
+	}
 
 	return 0;
 }
@@ -1843,7 +1860,7 @@
 	{0x1c, 0x20, 0xeeee},
 };
 
-static int ksz9477_config_init(struct phy_device *phydev)
+static int ksz9477_phy_errata(struct phy_device *phydev)
 {
 	int err;
 	int i;
@@ -1871,16 +1888,30 @@
 			return err;
 	}
 
+	err = genphy_restart_aneg(phydev);
+	if (err)
+		return err;
+
+	return err;
+}
+
+static int ksz9477_config_init(struct phy_device *phydev)
+{
+	int err;
+
+	/* Only KSZ9897 family of switches needs this fix. */
+	if ((phydev->phy_id & 0xf) == 1) {
+		err = ksz9477_phy_errata(phydev);
+		if (err)
+			return err;
+	}
+
 	/* According to KSZ9477 Errata DS80000754C (Module 4) all EEE modes
 	 * in this switch shall be regarded as broken.
 	 */
 	if (phydev->dev_flags & MICREL_NO_EEE)
 		phydev->eee_broken_modes = -1;
 
-	err = genphy_restart_aneg(phydev);
-	if (err)
-		return err;
-
 	return kszphy_config_init(phydev);
 }
 
@@ -1927,6 +1958,46 @@
 		data[i] = kszphy_get_stat(phydev, i);
 }
 
+static void kszphy_enable_clk(struct phy_device *phydev)
+{
+	struct kszphy_priv *priv = phydev->priv;
+
+	if (!priv->clk_enable && priv->clk) {
+		clk_prepare_enable(priv->clk);
+		priv->clk_enable = true;
+	}
+}
+
+static void kszphy_disable_clk(struct phy_device *phydev)
+{
+	struct kszphy_priv *priv = phydev->priv;
+
+	if (priv->clk_enable && priv->clk) {
+		clk_disable_unprepare(priv->clk);
+		priv->clk_enable = false;
+	}
+}
+
+static int kszphy_generic_resume(struct phy_device *phydev)
+{
+	kszphy_enable_clk(phydev);
+
+	return genphy_resume(phydev);
+}
+
+static int kszphy_generic_suspend(struct phy_device *phydev)
+{
+	int ret;
+
+	ret = genphy_suspend(phydev);
+	if (ret)
+		return ret;
+
+	kszphy_disable_clk(phydev);
+
+	return 0;
+}
+
 static int kszphy_suspend(struct phy_device *phydev)
 {
 	/* Disable PHY Interrupts */
@@ -1936,7 +2007,7 @@
 			phydev->drv->config_intr(phydev);
 	}
 
-	return genphy_suspend(phydev);
+	return kszphy_generic_suspend(phydev);
 }
 
 static void kszphy_parse_led_mode(struct phy_device *phydev)
@@ -1967,7 +2038,9 @@
 {
 	int ret;
 
-	genphy_resume(phydev);
+	ret = kszphy_generic_resume(phydev);
+	if (ret)
+		return ret;
 
 	/* After switching from power-down to normal mode, an internal global
 	 * reset is automatically generated. Wait a minimum of 1 ms before
@@ -1989,6 +2062,97 @@
 	return 0;
 }
 
+/* Because of errata DS80000700A, receiver error following software
+ * power down. Suspend and resume callbacks only disable and enable
+ * external rmii reference clock.
+ */
+static int ksz8041_resume(struct phy_device *phydev)
+{
+	kszphy_enable_clk(phydev);
+
+	return 0;
+}
+
+static int ksz8041_suspend(struct phy_device *phydev)
+{
+	kszphy_disable_clk(phydev);
+
+	return 0;
+}
+
+static int ksz9477_resume(struct phy_device *phydev)
+{
+	int ret;
+
+	/* No need to initialize registers if not powered down. */
+	ret = phy_read(phydev, MII_BMCR);
+	if (ret < 0)
+		return ret;
+	if (!(ret & BMCR_PDOWN))
+		return 0;
+
+	genphy_resume(phydev);
+
+	/* After switching from power-down to normal mode, an internal global
+	 * reset is automatically generated. Wait a minimum of 1 ms before
+	 * read/write access to the PHY registers.
+	 */
+	usleep_range(1000, 2000);
+
+	/* Only KSZ9897 family of switches needs this fix. */
+	if ((phydev->phy_id & 0xf) == 1) {
+		ret = ksz9477_phy_errata(phydev);
+		if (ret)
+			return ret;
+	}
+
+	/* Enable PHY Interrupts */
+	if (phy_interrupt_is_valid(phydev)) {
+		phydev->interrupts = PHY_INTERRUPT_ENABLED;
+		if (phydev->drv->config_intr)
+			phydev->drv->config_intr(phydev);
+	}
+
+	return 0;
+}
+
+static int ksz8061_resume(struct phy_device *phydev)
+{
+	int ret;
+
+	/* This function can be called twice when the Ethernet device is on. */
+	ret = phy_read(phydev, MII_BMCR);
+	if (ret < 0)
+		return ret;
+	if (!(ret & BMCR_PDOWN))
+		return 0;
+
+	ret = kszphy_generic_resume(phydev);
+	if (ret)
+		return ret;
+
+	usleep_range(1000, 2000);
+
+	/* Re-program the value after chip is reset. */
+	ret = phy_write_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_DEVID1, 0xB61A);
+	if (ret)
+		return ret;
+
+	/* Enable PHY Interrupts */
+	if (phy_interrupt_is_valid(phydev)) {
+		phydev->interrupts = PHY_INTERRUPT_ENABLED;
+		if (phydev->drv->config_intr)
+			phydev->drv->config_intr(phydev);
+	}
+
+	return 0;
+}
+
+static int ksz8061_suspend(struct phy_device *phydev)
+{
+	return kszphy_suspend(phydev);
+}
+
 static int kszphy_probe(struct phy_device *phydev)
 {
 	const struct kszphy_type *type = phydev->drv->driver_data;
@@ -2029,10 +2193,14 @@
 	} else if (!clk) {
 		/* unnamed clock from the generic ethernet-phy binding */
 		clk = devm_clk_get_optional_enabled(&phydev->mdio.dev, NULL);
-		if (IS_ERR(clk))
-			return PTR_ERR(clk);
 	}
 
+	if (IS_ERR(clk))
+		return PTR_ERR(clk);
+
+	clk_disable_unprepare(clk);
+	priv->clk = clk;
+
 	if (ksz8041_fiber_mode(phydev))
 		phydev->port = PORT_FIBRE;
 
@@ -2416,6 +2584,7 @@
 	struct lan8814_ptp_rx_ts *rx_ts, *tmp;
 	int txcfg = 0, rxcfg = 0;
 	int pkt_ts_enable;
+	int tx_mod;
 
 	ptp_priv->hwts_tx_type = config->tx_type;
 	ptp_priv->rx_filter = config->rx_filter;
@@ -2462,9 +2631,14 @@
 	lanphy_write_page_reg(ptp_priv->phydev, 5, PTP_RX_TIMESTAMP_EN, pkt_ts_enable);
 	lanphy_write_page_reg(ptp_priv->phydev, 5, PTP_TX_TIMESTAMP_EN, pkt_ts_enable);
 
-	if (ptp_priv->hwts_tx_type == HWTSTAMP_TX_ONESTEP_SYNC)
+	tx_mod = lanphy_read_page_reg(ptp_priv->phydev, 5, PTP_TX_MOD);
+	if (ptp_priv->hwts_tx_type == HWTSTAMP_TX_ONESTEP_SYNC) {
+		lanphy_write_page_reg(ptp_priv->phydev, 5, PTP_TX_MOD,
+				      tx_mod | PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_);
+	} else if (ptp_priv->hwts_tx_type == HWTSTAMP_TX_ON) {
 		lanphy_write_page_reg(ptp_priv->phydev, 5, PTP_TX_MOD,
-				      PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_);
+				      tx_mod & ~PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_);
+	}
 
 	if (config->rx_filter != HWTSTAMP_FILTER_NONE)
 		lan8814_config_ts_intr(ptp_priv->phydev, true);
@@ -2522,7 +2696,7 @@
 	}
 }
 
-static void lan8814_get_sig_rx(struct sk_buff *skb, u16 *sig)
+static bool lan8814_get_sig_rx(struct sk_buff *skb, u16 *sig)
 {
 	struct ptp_header *ptp_header;
 	u32 type;
@@ -2532,7 +2706,11 @@
 	ptp_header = ptp_parse_header(skb, type);
 	skb_pull_inline(skb, ETH_HLEN);
 
+	if (!ptp_header)
+		return false;
+
 	*sig = (__force u16)(ntohs(ptp_header->sequence_id));
+	return true;
 }
 
 static bool lan8814_match_rx_skb(struct kszphy_ptp_priv *ptp_priv,
@@ -2544,7 +2722,8 @@
 	bool ret = false;
 	u16 skb_sig;
 
-	lan8814_get_sig_rx(skb, &skb_sig);
+	if (!lan8814_get_sig_rx(skb, &skb_sig))
+		return ret;
 
 	/* Iterate over all RX timestamps and match it with the received skbs */
 	spin_lock_irqsave(&ptp_priv->rx_ts_lock, flags);
@@ -2824,7 +3003,7 @@
 	return 0;
 }
 
-static void lan8814_get_sig_tx(struct sk_buff *skb, u16 *sig)
+static bool lan8814_get_sig_tx(struct sk_buff *skb, u16 *sig)
 {
 	struct ptp_header *ptp_header;
 	u32 type;
@@ -2832,7 +3011,11 @@
 	type = ptp_classify_raw(skb);
 	ptp_header = ptp_parse_header(skb, type);
 
+	if (!ptp_header)
+		return false;
+
 	*sig = (__force u16)(ntohs(ptp_header->sequence_id));
+	return true;
 }
 
 static void lan8814_match_tx_skb(struct kszphy_ptp_priv *ptp_priv,
@@ -2846,7 +3029,8 @@
 
 	spin_lock_irqsave(&ptp_priv->tx_queue.lock, flags);
 	skb_queue_walk_safe(&ptp_priv->tx_queue, skb, skb_tmp) {
-		lan8814_get_sig_tx(skb, &skb_sig);
+		if (!lan8814_get_sig_tx(skb, &skb_sig))
+			continue;
 
 		if (memcmp(&skb_sig, &seq_id, sizeof(seq_id)))
 			continue;
@@ -2900,7 +3084,8 @@
 
 	spin_lock_irqsave(&ptp_priv->rx_queue.lock, flags);
 	skb_queue_walk_safe(&ptp_priv->rx_queue, skb, skb_tmp) {
-		lan8814_get_sig_rx(skb, &skb_sig);
+		if (!lan8814_get_sig_rx(skb, &skb_sig))
+			continue;
 
 		if (memcmp(&skb_sig, &rx_ts->seq_id, sizeof(rx_ts->seq_id)))
 			continue;
@@ -3458,7 +3643,7 @@
 
 	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
 		err = phy_read(phydev, LAN8814_INTS);
-		if (err)
+		if (err < 0)
 			return err;
 
 		/* Enable / disable interrupts. It is OK to enable PTP interrupt
@@ -3474,6 +3659,14 @@
 			return err;
 
 		err = phy_read(phydev, LAN8814_INTS);
+		if (err < 0)
+			return err;
+
+		/* Getting a positive value doesn't mean that is an error, it
+		 * just indicates what was the status. Therefore make sure to
+		 * clear the value and say that there is no error.
+		 */
+		err = 0;
 	}
 
 	return err;
@@ -4613,14 +4806,30 @@
 	return 0;
 }
 
+static int lan8804_resume(struct phy_device *phydev)
+{
+	return kszphy_resume(phydev);
+}
+
+static int lan8804_suspend(struct phy_device *phydev)
+{
+	return kszphy_generic_suspend(phydev);
+}
+
+static int lan8841_resume(struct phy_device *phydev)
+{
+	return kszphy_generic_resume(phydev);
+}
+
 static int lan8841_suspend(struct phy_device *phydev)
 {
 	struct kszphy_priv *priv = phydev->priv;
 	struct kszphy_ptp_priv *ptp_priv = &priv->ptp_priv;
 
-	ptp_cancel_worker_sync(ptp_priv->ptp_clock);
+	if (ptp_priv->ptp_clock)
+		ptp_cancel_worker_sync(ptp_priv->ptp_clock);
 
-	return genphy_suspend(phydev);
+	return kszphy_generic_suspend(phydev);
 }
 
 static struct phy_driver ksphy_driver[] = {
@@ -4680,9 +4889,8 @@
 	.get_sset_count = kszphy_get_sset_count,
 	.get_strings	= kszphy_get_strings,
 	.get_stats	= kszphy_get_stats,
-	/* No suspend/resume callbacks because of errata DS80000700A,
-	 * receiver error following software power down.
-	 */
+	.suspend	= ksz8041_suspend,
+	.resume		= ksz8041_resume,
 }, {
 	.phy_id		= PHY_ID_KSZ8041RNLI,
 	.phy_id_mask	= MICREL_PHY_ID_MASK,
@@ -4755,10 +4963,11 @@
 	/* PHY_BASIC_FEATURES */
 	.probe		= kszphy_probe,
 	.config_init	= ksz8061_config_init,
+	.soft_reset	= genphy_soft_reset,
 	.config_intr	= kszphy_config_intr,
 	.handle_interrupt = kszphy_handle_interrupt,
-	.suspend	= kszphy_suspend,
-	.resume		= kszphy_resume,
+	.suspend	= ksz8061_suspend,
+	.resume		= ksz8061_resume,
 }, {
 	.phy_id		= PHY_ID_KSZ9021,
 	.phy_id_mask	= 0x000ffffe,
@@ -4828,8 +5037,8 @@
 	.get_sset_count	= kszphy_get_sset_count,
 	.get_strings	= kszphy_get_strings,
 	.get_stats	= kszphy_get_stats,
-	.suspend	= genphy_suspend,
-	.resume		= kszphy_resume,
+	.suspend	= lan8804_suspend,
+	.resume		= lan8804_resume,
 	.config_intr	= lan8804_config_intr,
 	.handle_interrupt = lan8804_handle_interrupt,
 }, {
@@ -4847,7 +5056,7 @@
 	.get_strings	= kszphy_get_strings,
 	.get_stats	= kszphy_get_stats,
 	.suspend	= lan8841_suspend,
-	.resume		= genphy_resume,
+	.resume		= lan8841_resume,
 	.cable_test_start	= lan8814_cable_test_start,
 	.cable_test_get_status	= ksz886x_cable_test_get_status,
 }, {
@@ -4912,7 +5121,7 @@
 	.config_intr	= kszphy_config_intr,
 	.handle_interrupt = kszphy_handle_interrupt,
 	.suspend	= genphy_suspend,
-	.resume		= genphy_resume,
+	.resume		= ksz9477_resume,
 	.get_features	= ksz9477_get_features,
 } };
 
@@ -4936,6 +5145,7 @@
 	{ PHY_ID_KSZ8081, MICREL_PHY_ID_MASK },
 	{ PHY_ID_KSZ8873MLL, MICREL_PHY_ID_MASK },
 	{ PHY_ID_KSZ886X, MICREL_PHY_ID_MASK },
+	{ PHY_ID_KSZ9477, MICREL_PHY_ID_MASK },
 	{ PHY_ID_LAN8814, MICREL_PHY_ID_MASK },
 	{ PHY_ID_LAN8804, MICREL_PHY_ID_MASK },
 	{ PHY_ID_LAN8841, MICREL_PHY_ID_MASK },
--- linux-qcom-6.8.0.orig/drivers/net/phy/microchip.c
+++ linux-qcom-6.8.0/drivers/net/phy/microchip.c
@@ -345,6 +345,22 @@
 static void lan88xx_link_change_notify(struct phy_device *phydev)
 {
 	int temp;
+	int ret;
+
+	/* Reset PHY to ensure MII_LPA provides up-to-date information. This
+	 * issue is reproducible only after parallel detection, as described
+	 * in IEEE 802.3-2022, Section 28.2.3.1 ("Parallel detection function"),
+	 * where the link partner does not support auto-negotiation.
+	 */
+	if (phydev->state == PHY_NOLINK) {
+		ret = phy_init_hw(phydev);
+		if (ret < 0)
+			goto link_change_notify_failed;
+
+		ret = _phy_start_aneg(phydev);
+		if (ret < 0)
+			goto link_change_notify_failed;
+	}
 
 	/* At forced 100 F/H mode, chip may fail to set mode correctly
 	 * when cable is switched between long(~50+m) and short one.
@@ -371,6 +387,11 @@
 		temp |= LAN88XX_INT_MASK_MDINTPIN_EN_;
 		phy_write(phydev, LAN88XX_INT_MASK, temp);
 	}
+
+	return;
+
+link_change_notify_failed:
+	phydev_err(phydev, "Link change process failed %pe\n", ERR_PTR(ret));
 }
 
 static struct phy_driver microchip_phy_driver[] = {
--- linux-qcom-6.8.0.orig/drivers/net/phy/microchip_t1.c
+++ linux-qcom-6.8.0/drivers/net/phy/microchip_t1.c
@@ -748,7 +748,7 @@
 	ethnl_cable_test_result(phydev, ETHTOOL_A_CABLE_PAIR_A,
 				lan87xx_cable_test_report_trans(detect));
 
-	return 0;
+	return phy_init_hw(phydev);
 }
 
 static int lan87xx_cable_test_get_status(struct phy_device *phydev,
--- linux-qcom-6.8.0.orig/drivers/net/phy/mxl-gpy.c
+++ linux-qcom-6.8.0/drivers/net/phy/mxl-gpy.c
@@ -107,6 +107,7 @@
 
 	u8 fw_major;
 	u8 fw_minor;
+	u32 wolopts;
 
 	/* It takes 3 seconds to fully switch out of loopback mode before
 	 * it can safely re-enter loopback mode. Record the time when
@@ -221,6 +222,15 @@
 }
 #endif
 
+static int gpy_ack_interrupt(struct phy_device *phydev)
+{
+	int ret;
+
+	/* Clear all pending interrupts */
+	ret = phy_read(phydev, PHY_ISTAT);
+	return ret < 0 ? ret : 0;
+}
+
 static int gpy_mbox_read(struct phy_device *phydev, u32 addr)
 {
 	struct gpy_priv *priv = phydev->priv;
@@ -262,16 +272,8 @@
 
 static int gpy_config_init(struct phy_device *phydev)
 {
-	int ret;
-
-	/* Mask all interrupts */
-	ret = phy_write(phydev, PHY_IMASK, 0);
-	if (ret)
-		return ret;
-
-	/* Clear all pending interrupts */
-	ret = phy_read(phydev, PHY_ISTAT);
-	return ret < 0 ? ret : 0;
+	/* Nothing to configure. Configuration Requirement Placeholder */
+	return 0;
 }
 
 static int gpy_probe(struct phy_device *phydev)
@@ -619,11 +621,23 @@
 
 static int gpy_config_intr(struct phy_device *phydev)
 {
+	struct gpy_priv *priv = phydev->priv;
 	u16 mask = 0;
+	int ret;
+
+	ret = gpy_ack_interrupt(phydev);
+	if (ret)
+		return ret;
 
 	if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
 		mask = PHY_IMASK_MASK;
 
+	if (priv->wolopts & WAKE_MAGIC)
+		mask |= PHY_IMASK_WOL;
+
+	if (priv->wolopts & WAKE_PHY)
+		mask |= PHY_IMASK_LSTC;
+
 	return phy_write(phydev, PHY_IMASK, mask);
 }
 
@@ -670,6 +684,7 @@
 		       struct ethtool_wolinfo *wol)
 {
 	struct net_device *attach_dev = phydev->attached_dev;
+	struct gpy_priv *priv = phydev->priv;
 	int ret;
 
 	if (wol->wolopts & WAKE_MAGIC) {
@@ -717,6 +732,8 @@
 		ret = phy_read(phydev, PHY_ISTAT);
 		if (ret < 0)
 			return ret;
+
+		priv->wolopts |= WAKE_MAGIC;
 	} else {
 		/* Disable magic packet matching */
 		ret = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2,
@@ -724,6 +741,13 @@
 					 WOL_EN);
 		if (ret < 0)
 			return ret;
+
+		/* Disable the WOL interrupt */
+		ret = phy_clear_bits(phydev, PHY_IMASK, PHY_IMASK_WOL);
+		if (ret < 0)
+			return ret;
+
+		priv->wolopts &= ~WAKE_MAGIC;
 	}
 
 	if (wol->wolopts & WAKE_PHY) {
@@ -740,9 +764,11 @@
 		if (ret & (PHY_IMASK_MASK & ~PHY_IMASK_LSTC))
 			phy_trigger_machine(phydev);
 
+		priv->wolopts |= WAKE_PHY;
 		return 0;
 	}
 
+	priv->wolopts &= ~WAKE_PHY;
 	/* Disable the link state change interrupt */
 	return phy_clear_bits(phydev, PHY_IMASK, PHY_IMASK_LSTC);
 }
@@ -750,18 +776,10 @@
 static void gpy_get_wol(struct phy_device *phydev,
 			struct ethtool_wolinfo *wol)
 {
-	int ret;
+	struct gpy_priv *priv = phydev->priv;
 
 	wol->supported = WAKE_MAGIC | WAKE_PHY;
-	wol->wolopts = 0;
-
-	ret = phy_read_mmd(phydev, MDIO_MMD_VEND2, VPSPEC2_WOL_CTL);
-	if (ret & WOL_EN)
-		wol->wolopts |= WAKE_MAGIC;
-
-	ret = phy_read(phydev, PHY_IMASK);
-	if (ret & PHY_IMASK_LSTC)
-		wol->wolopts |= WAKE_PHY;
+	wol->wolopts = priv->wolopts;
 }
 
 static int gpy_loopback(struct phy_device *phydev, bool enable)
--- linux-qcom-6.8.0.orig/drivers/net/phy/phy.c
+++ linux-qcom-6.8.0/drivers/net/phy/phy.c
@@ -342,14 +342,19 @@
 		if (mdio_phy_id_is_c45(mii_data->phy_id)) {
 			prtad = mdio_phy_id_prtad(mii_data->phy_id);
 			devad = mdio_phy_id_devad(mii_data->phy_id);
-			mii_data->val_out = mdiobus_c45_read(
-				phydev->mdio.bus, prtad, devad,
-				mii_data->reg_num);
+			ret = mdiobus_c45_read(phydev->mdio.bus, prtad, devad,
+					       mii_data->reg_num);
+
 		} else {
-			mii_data->val_out = mdiobus_read(
-				phydev->mdio.bus, mii_data->phy_id,
-				mii_data->reg_num);
+			ret = mdiobus_read(phydev->mdio.bus, mii_data->phy_id,
+					   mii_data->reg_num);
 		}
+
+		if (ret < 0)
+			return ret;
+
+		mii_data->val_out = ret;
+
 		return 0;
 
 	case SIOCSMIIREG:
--- linux-qcom-6.8.0.orig/drivers/net/phy/phy_device.c
+++ linux-qcom-6.8.0/drivers/net/phy/phy_device.c
@@ -1413,6 +1413,11 @@
 }
 EXPORT_SYMBOL(phy_sfp_probe);
 
+static bool phy_drv_supports_irq(struct phy_driver *phydrv)
+{
+	return phydrv->config_intr && phydrv->handle_interrupt;
+}
+
 /**
  * phy_attach_direct - attach a network device to a given PHY device pointer
  * @dev: network device to attach
@@ -1527,6 +1532,9 @@
 	if (phydev->dev_flags & PHY_F_NO_IRQ)
 		phydev->irq = PHY_POLL;
 
+	if (!phy_drv_supports_irq(phydev->drv) && phy_interrupt_is_valid(phydev))
+		phydev->irq = PHY_POLL;
+
 	/* Port is set to PORT_TP by default and the actual PHY driver will set
 	 * it to different value depending on the PHY configuration. If we have
 	 * the generic PHY driver we can't figure it out, thus set the old
@@ -2706,8 +2714,8 @@
 int genphy_loopback(struct phy_device *phydev, bool enable)
 {
 	if (enable) {
-		u16 val, ctl = BMCR_LOOPBACK;
-		int ret;
+		u16 ctl = BMCR_LOOPBACK;
+		int ret, val;
 
 		ctl |= mii_bmcr_encode_fixed(phydev->speed, phydev->duplex);
 
@@ -2959,7 +2967,7 @@
 	if (delay < 0)
 		return delay;
 
-	if (delay && size == 0)
+	if (size == 0)
 		return delay;
 
 	if (delay < delay_values[0] || delay > delay_values[size - 1]) {
@@ -2992,11 +3000,6 @@
 }
 EXPORT_SYMBOL(phy_get_internal_delay);
 
-static bool phy_drv_supports_irq(struct phy_driver *phydrv)
-{
-	return phydrv->config_intr && phydrv->handle_interrupt;
-}
-
 static int phy_led_set_brightness(struct led_classdev *led_cdev,
 				  enum led_brightness value)
 {
@@ -3084,10 +3087,11 @@
 
 static void phy_leds_unregister(struct phy_device *phydev)
 {
-	struct phy_led *phyled;
+	struct phy_led *phyled, *tmp;
 
-	list_for_each_entry(phyled, &phydev->leds, list) {
+	list_for_each_entry_safe(phyled, tmp, &phydev->leds, list) {
 		led_classdev_unregister(&phyled->led_cdev);
+		list_del(&phyled->list);
 	}
 }
 
@@ -3097,6 +3101,7 @@
 	struct device *dev = &phydev->mdio.dev;
 	struct led_init_data init_data = {};
 	struct led_classdev *cdev;
+	unsigned long modes = 0;
 	struct phy_led *phyled;
 	u32 index;
 	int err;
@@ -3114,6 +3119,21 @@
 	if (index > U8_MAX)
 		return -EINVAL;
 
+	if (of_property_read_bool(led, "active-low"))
+		set_bit(PHY_LED_ACTIVE_LOW, &modes);
+	if (of_property_read_bool(led, "inactive-high-impedance"))
+		set_bit(PHY_LED_INACTIVE_HIGH_IMPEDANCE, &modes);
+
+	if (modes) {
+		/* Return error if asked to set polarity modes but not supported */
+		if (!phydev->drv->led_polarity_set)
+			return -EINVAL;
+
+		err = phydev->drv->led_polarity_set(phydev, index, modes);
+		if (err)
+			return err;
+	}
+
 	phyled->index = index;
 	if (phydev->drv->led_brightness_set)
 		cdev->brightness_set_blocking = phy_led_set_brightness;
@@ -3166,11 +3186,13 @@
 		err = of_phy_led(phydev, led);
 		if (err) {
 			of_node_put(led);
+			of_node_put(leds);
 			phy_leds_unregister(phydev);
 			return err;
 		}
 	}
 
+	of_node_put(leds);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/phy/phylink.c
+++ linux-qcom-6.8.0/drivers/net/phy/phylink.c
@@ -78,7 +78,7 @@
 	unsigned int pcs_neg_mode;
 	unsigned int pcs_state;
 
-	bool mac_link_dropped;
+	bool link_failed;
 	bool using_mac_select_pcs;
 
 	struct sfp_bus *sfp_bus;
@@ -691,13 +691,17 @@
 	}
 
 	/* Then validate the link parameters with the MAC */
-	if (pl->mac_ops->mac_get_caps)
-		capabilities = pl->mac_ops->mac_get_caps(pl->config,
-							 state->interface);
-	else
-		capabilities = pl->config->mac_capabilities;
+	if (pl->mac_ops->validate) {
+		pl->mac_ops->validate(pl->config, supported, state);
+	} else {
+		if (pl->mac_ops->mac_get_caps)
+			capabilities = pl->mac_ops->mac_get_caps(pl->config,
+							state->interface);
+		else
+			capabilities = pl->config->mac_capabilities;
 
-	phylink_validate_mask_caps(supported, state, capabilities);
+		phylink_validate_mask_caps(supported, state, capabilities);
+	}
 
 	return phylink_is_empty_linkmode(supported) ? -EINVAL : 0;
 }
@@ -1448,9 +1452,9 @@
 		cur_link_state = pl->old_link_state;
 
 	if (pl->phylink_disable_state) {
-		pl->mac_link_dropped = false;
+		pl->link_failed = false;
 		link_state.link = false;
-	} else if (pl->mac_link_dropped) {
+	} else if (pl->link_failed) {
 		link_state.link = false;
 		retrigger = true;
 	} else {
@@ -1545,7 +1549,7 @@
 			phylink_link_up(pl, link_state);
 	}
 	if (!link_state.link && retrigger) {
-		pl->mac_link_dropped = false;
+		pl->link_failed = false;
 		queue_work(system_power_efficient_wq, &pl->resolve);
 	}
 	mutex_unlock(&pl->state_mutex);
@@ -1766,6 +1770,8 @@
 		pl->phy_state.pause |= MLO_PAUSE_RX;
 	pl->phy_state.interface = phydev->interface;
 	pl->phy_state.link = up;
+	if (!up)
+		pl->link_failed = true;
 	mutex_unlock(&pl->state_mutex);
 
 	phylink_run_resolve(pl);
@@ -2078,7 +2084,7 @@
 static void phylink_link_changed(struct phylink *pl, bool up, const char *what)
 {
 	if (!up)
-		pl->mac_link_dropped = true;
+		pl->link_failed = true;
 	phylink_run_resolve(pl);
 	phylink_dbg(pl, "%s link %s\n", what, up ? "up" : "down");
 }
@@ -2712,7 +2718,7 @@
 	 * link will cycle.
 	 */
 	if (manual_changed) {
-		pl->mac_link_dropped = true;
+		pl->link_failed = true;
 		phylink_run_resolve(pl);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/phy/realtek.c
+++ linux-qcom-6.8.0/drivers/net/phy/realtek.c
@@ -1083,6 +1083,13 @@
 		.handle_interrupt = genphy_handle_interrupt_no_ack,
 		.suspend	= genphy_suspend,
 		.resume		= genphy_resume,
+	}, {
+		PHY_ID_MATCH_EXACT(0x001cc960),
+		.name		= "RTL8366S Gigabit Ethernet",
+		.suspend	= genphy_suspend,
+		.resume		= genphy_resume,
+		.read_mmd	= genphy_read_mmd_unsupported,
+		.write_mmd	= genphy_write_mmd_unsupported,
 	},
 };
 
--- linux-qcom-6.8.0.orig/drivers/net/phy/sfp.c
+++ linux-qcom-6.8.0/drivers/net/phy/sfp.c
@@ -461,7 +461,8 @@
 static const struct sfp_quirk sfp_quirks[] = {
 	// Alcatel Lucent G-010S-P can operate at 2500base-X, but incorrectly
 	// report 2500MBd NRZ in their EEPROM
-	SFP_QUIRK_M("ALCATELLUCENT", "G010SP", sfp_quirk_2500basex),
+	SFP_QUIRK("ALCATELLUCENT", "G010SP", sfp_quirk_2500basex,
+		  sfp_fixup_ignore_tx_fault),
 
 	// Alcatel Lucent G-010S-A can operate at 2500base-X, but report 3.2GBd
 	// NRZ in their EEPROM
@@ -502,6 +503,9 @@
 	SFP_QUIRK_F("Walsun", "HXSX-ATRC-1", sfp_fixup_fs_10gt),
 	SFP_QUIRK_F("Walsun", "HXSX-ATRI-1", sfp_fixup_fs_10gt),
 
+	// OEM SFP-GE-T is a 1000Base-T module with broken TX_FAULT indicator
+	SFP_QUIRK_F("OEM", "SFP-GE-T", sfp_fixup_ignore_tx_fault),
+
 	SFP_QUIRK_F("OEM", "SFP-10G-T", sfp_fixup_rollball_cc),
 	SFP_QUIRK_M("OEM", "SFP-2.5G-T", sfp_quirk_oem_2_5g),
 	SFP_QUIRK_F("OEM", "RTSFP-10", sfp_fixup_rollball_cc),
@@ -2418,8 +2422,7 @@
 
 	/* Handle remove event globally, it resets this state machine */
 	if (event == SFP_E_REMOVE) {
-		if (sfp->sm_mod_state > SFP_MOD_PROBE)
-			sfp_sm_mod_remove(sfp);
+		sfp_sm_mod_remove(sfp);
 		sfp_sm_mod_next(sfp, SFP_MOD_EMPTY, 0);
 		return;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/phy/vitesse.c
+++ linux-qcom-6.8.0/drivers/net/phy/vitesse.c
@@ -237,16 +237,6 @@
 	return 0;
 }
 
-static int vsc73xx_config_aneg(struct phy_device *phydev)
-{
-	/* The VSC73xx switches does not like to be instructed to
-	 * do autonegotiation in any way, it prefers that you just go
-	 * with the power-on/reset defaults. Writing some registers will
-	 * just make autonegotiation permanently fail.
-	 */
-	return 0;
-}
-
 /* This adds a skew for both TX and RX clocks, so the skew should only be
  * applied to "rgmii-id" interfaces. It may not work as expected
  * on "rgmii-txid", "rgmii-rxid" or "rgmii" interfaces.
@@ -444,7 +434,6 @@
 	.phy_id_mask    = 0x000ffff0,
 	/* PHY_GBIT_FEATURES */
 	.config_init    = vsc738x_config_init,
-	.config_aneg    = vsc73xx_config_aneg,
 	.read_page      = vsc73xx_read_page,
 	.write_page     = vsc73xx_write_page,
 }, {
@@ -453,7 +442,6 @@
 	.phy_id_mask    = 0x000ffff0,
 	/* PHY_GBIT_FEATURES */
 	.config_init    = vsc738x_config_init,
-	.config_aneg    = vsc73xx_config_aneg,
 	.read_page      = vsc73xx_read_page,
 	.write_page     = vsc73xx_write_page,
 }, {
@@ -462,7 +450,6 @@
 	.phy_id_mask    = 0x000ffff0,
 	/* PHY_GBIT_FEATURES */
 	.config_init    = vsc739x_config_init,
-	.config_aneg    = vsc73xx_config_aneg,
 	.read_page      = vsc73xx_read_page,
 	.write_page     = vsc73xx_write_page,
 }, {
@@ -471,7 +458,6 @@
 	.phy_id_mask    = 0x000ffff0,
 	/* PHY_GBIT_FEATURES */
 	.config_init    = vsc739x_config_init,
-	.config_aneg    = vsc73xx_config_aneg,
 	.read_page      = vsc73xx_read_page,
 	.write_page     = vsc73xx_write_page,
 }, {
--- linux-qcom-6.8.0.orig/drivers/net/plip/plip.c
+++ linux-qcom-6.8.0/drivers/net/plip/plip.c
@@ -815,7 +815,7 @@
 				return HS_TIMEOUT;
 			}
 		}
-		break;
+		fallthrough;
 
 	case PLIP_PK_LENGTH_LSB:
 		if (plip_send(nibble_timeout, dev,
--- linux-qcom-6.8.0.orig/drivers/net/ppp/ppp_async.c
+++ linux-qcom-6.8.0/drivers/net/ppp/ppp_async.c
@@ -542,7 +542,7 @@
 	 * and 7 (code-reject) must be sent as though no options
 	 * had been negotiated.
 	 */
-	islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7;
+	islcp = proto == PPP_LCP && count >= 3 && 1 <= data[2] && data[2] <= 7;
 
 	if (i == 0) {
 		if (islcp)
--- linux-qcom-6.8.0.orig/drivers/net/ppp/ppp_generic.c
+++ linux-qcom-6.8.0/drivers/net/ppp/ppp_generic.c
@@ -70,6 +70,7 @@
 #define MPHDRLEN_SSN	4	/* ditto with short sequence numbers */
 
 #define PPP_PROTO_LEN	2
+#define PPP_LCP_HDRLEN	4
 
 /*
  * An instance of /dev/ppp can be associated with either a ppp
@@ -491,6 +492,15 @@
 	return ret;
 }
 
+static bool ppp_check_packet(struct sk_buff *skb, size_t count)
+{
+	/* LCP packets must include LCP header which 4 bytes long:
+	 * 1-byte code, 1-byte identifier, and 2-byte length.
+	 */
+	return get_unaligned_be16(skb->data) != PPP_LCP ||
+		count >= PPP_PROTO_LEN + PPP_LCP_HDRLEN;
+}
+
 static ssize_t ppp_write(struct file *file, const char __user *buf,
 			 size_t count, loff_t *ppos)
 {
@@ -513,6 +523,11 @@
 		kfree_skb(skb);
 		goto out;
 	}
+	ret = -EINVAL;
+	if (unlikely(!ppp_check_packet(skb, count))) {
+		kfree_skb(skb);
+		goto out;
+	}
 
 	switch (pf->kind) {
 	case INTERFACE:
@@ -2254,7 +2269,7 @@
 	if (!pchb)
 		goto out_rcu;
 
-	spin_lock(&pchb->downl);
+	spin_lock_bh(&pchb->downl);
 	if (!pchb->chan) {
 		/* channel got unregistered */
 		kfree_skb(skb);
@@ -2266,7 +2281,7 @@
 		kfree_skb(skb);
 
 outl:
-	spin_unlock(&pchb->downl);
+	spin_unlock_bh(&pchb->downl);
 out_rcu:
 	rcu_read_unlock();
 
--- linux-qcom-6.8.0.orig/drivers/net/slip/slhc.c
+++ linux-qcom-6.8.0/drivers/net/slip/slhc.c
@@ -643,46 +643,57 @@
 int
 slhc_remember(struct slcompress *comp, unsigned char *icp, int isize)
 {
-	struct cstate *cs;
-	unsigned ihl;
-
+	const struct tcphdr *th;
 	unsigned char index;
+	struct iphdr *iph;
+	struct cstate *cs;
+	unsigned int ihl;
 
-	if(isize < 20) {
-		/* The packet is shorter than a legal IP header */
+	/* The packet is shorter than a legal IP header.
+	 * Also make sure isize is positive.
+	 */
+	if (isize < (int)sizeof(struct iphdr)) {
+runt:
 		comp->sls_i_runt++;
-		return slhc_toss( comp );
+		return slhc_toss(comp);
 	}
+	iph = (struct iphdr *)icp;
 	/* Peek at the IP header's IHL field to find its length */
-	ihl = icp[0] & 0xf;
-	if(ihl < 20 / 4){
-		/* The IP header length field is too small */
-		comp->sls_i_runt++;
-		return slhc_toss( comp );
-	}
-	index = icp[9];
-	icp[9] = IPPROTO_TCP;
+	ihl = iph->ihl;
+	/* The IP header length field is too small,
+	 * or packet is shorter than the IP header followed
+	 * by minimal tcp header.
+	 */
+	if (ihl < 5 || isize < ihl * 4 + sizeof(struct tcphdr))
+		goto runt;
+
+	index = iph->protocol;
+	iph->protocol = IPPROTO_TCP;
 
 	if (ip_fast_csum(icp, ihl)) {
 		/* Bad IP header checksum; discard */
 		comp->sls_i_badcheck++;
-		return slhc_toss( comp );
+		return slhc_toss(comp);
 	}
-	if(index > comp->rslot_limit) {
+	if (index > comp->rslot_limit) {
 		comp->sls_i_error++;
 		return slhc_toss(comp);
 	}
-
+	th = (struct tcphdr *)(icp + ihl * 4);
+	if (th->doff < sizeof(struct tcphdr) / 4)
+		goto runt;
+	if (isize < ihl * 4 + th->doff * 4)
+		goto runt;
 	/* Update local state */
 	cs = &comp->rstate[comp->recv_current = index];
 	comp->flags &=~ SLF_TOSS;
-	memcpy(&cs->cs_ip,icp,20);
-	memcpy(&cs->cs_tcp,icp + ihl*4,20);
+	memcpy(&cs->cs_ip, iph, sizeof(*iph));
+	memcpy(&cs->cs_tcp, th, sizeof(*th));
 	if (ihl > 5)
-	  memcpy(cs->cs_ipopt, icp + sizeof(struct iphdr), (ihl - 5) * 4);
-	if (cs->cs_tcp.doff > 5)
-	  memcpy(cs->cs_tcpopt, icp + ihl*4 + sizeof(struct tcphdr), (cs->cs_tcp.doff - 5) * 4);
-	cs->cs_hsize = ihl*2 + cs->cs_tcp.doff*2;
+	  memcpy(cs->cs_ipopt, &iph[1], (ihl - 5) * 4);
+	if (th->doff > 5)
+	  memcpy(cs->cs_tcpopt, &th[1], (th->doff - 5) * 4);
+	cs->cs_hsize = ihl*2 + th->doff*2;
 	cs->initialized = true;
 	/* Put headers back on packet
 	 * Neither header checksum is recalculated
--- linux-qcom-6.8.0.orig/drivers/net/tap.c
+++ linux-qcom-6.8.0/drivers/net/tap.c
@@ -1177,6 +1177,11 @@
 	struct sk_buff *skb;
 	int err, depth;
 
+	if (unlikely(xdp->data_end - xdp->data < ETH_HLEN)) {
+		err = -EINVAL;
+		goto err;
+	}
+
 	if (q->flags & IFF_VNET_HDR)
 		vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz);
 
--- linux-qcom-6.8.0.orig/drivers/net/team/team.c
+++ linux-qcom-6.8.0/drivers/net/team/team.c
@@ -982,7 +982,8 @@
 
 #define TEAM_VLAN_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \
 			    NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE | \
-			    NETIF_F_HIGHDMA | NETIF_F_LRO)
+			    NETIF_F_HIGHDMA | NETIF_F_LRO | \
+			    NETIF_F_GSO_ENCAP_ALL)
 
 #define TEAM_ENC_FEATURES	(NETIF_F_HW_CSUM | NETIF_F_SG | \
 				 NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE)
@@ -990,14 +991,19 @@
 static void __team_compute_features(struct team *team)
 {
 	struct team_port *port;
-	netdev_features_t vlan_features = TEAM_VLAN_FEATURES &
-					  NETIF_F_ALL_FOR_ALL;
+	netdev_features_t vlan_features = TEAM_VLAN_FEATURES;
 	netdev_features_t enc_features  = TEAM_ENC_FEATURES;
 	unsigned short max_hard_header_len = ETH_HLEN;
 	unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
 					IFF_XMIT_DST_RELEASE_PERM;
 
 	rcu_read_lock();
+	if (list_empty(&team->port_list))
+		goto done;
+
+	vlan_features = netdev_base_features(vlan_features);
+	enc_features = netdev_base_features(enc_features);
+
 	list_for_each_entry_rcu(port, &team->port_list, list) {
 		vlan_features = netdev_increment_features(vlan_features,
 					port->dev->vlan_features,
@@ -1007,11 +1013,11 @@
 						  port->dev->hw_enc_features,
 						  TEAM_ENC_FEATURES);
 
-
 		dst_release_flag &= port->dev->priv_flags;
 		if (port->dev->hard_header_len > max_hard_header_len)
 			max_hard_header_len = port->dev->hard_header_len;
 	}
+done:
 	rcu_read_unlock();
 
 	team->dev->vlan_features = vlan_features;
@@ -2011,8 +2017,7 @@
 	netdev_features_t mask;
 
 	mask = features;
-	features &= ~NETIF_F_ONE_FOR_ALL;
-	features |= NETIF_F_ALL_FOR_ALL;
+	features = netdev_base_features(features);
 
 	rcu_read_lock();
 	list_for_each_entry_rcu(port, &team->port_list, list) {
--- linux-qcom-6.8.0.orig/drivers/net/tun.c
+++ linux-qcom-6.8.0/drivers/net/tun.c
@@ -1487,7 +1487,7 @@
 	skb->truesize += skb->data_len;
 
 	for (i = 1; i < it->nr_segs; i++) {
-		const struct iovec *iov = iter_iov(it);
+		const struct iovec *iov = iter_iov(it) + i;
 		size_t fragsz = iov->iov_len;
 		struct page *page;
 		void *frag;
@@ -2132,14 +2132,16 @@
 					    tun_is_little_endian(tun), true,
 					    vlan_hlen)) {
 			struct skb_shared_info *sinfo = skb_shinfo(skb);
-			pr_err("unexpected GSO type: "
-			       "0x%x, gso_size %d, hdr_len %d\n",
-			       sinfo->gso_type, tun16_to_cpu(tun, gso.gso_size),
-			       tun16_to_cpu(tun, gso.hdr_len));
-			print_hex_dump(KERN_ERR, "tun: ",
-				       DUMP_PREFIX_NONE,
-				       16, 1, skb->head,
-				       min((int)tun16_to_cpu(tun, gso.hdr_len), 64), true);
+
+			if (net_ratelimit()) {
+				netdev_err(tun->dev, "unexpected GSO type: 0x%x, gso_size %d, hdr_len %d\n",
+					   sinfo->gso_type, tun16_to_cpu(tun, gso.gso_size),
+					   tun16_to_cpu(tun, gso.hdr_len));
+				print_hex_dump(KERN_ERR, "tun: ",
+					       DUMP_PREFIX_NONE,
+					       16, 1, skb->head,
+					       min((int)tun16_to_cpu(tun, gso.hdr_len), 64), true);
+			}
 			WARN_ON_ONCE(1);
 			return -EINVAL;
 		}
@@ -2457,6 +2459,9 @@
 	bool skb_xdp = false;
 	struct page *page;
 
+	if (unlikely(datasize < ETH_HLEN))
+		return -EINVAL;
+
 	xdp_prog = rcu_dereference(tun->xdp_prog);
 	if (xdp_prog) {
 		if (gso->gso_type) {
--- linux-qcom-6.8.0.orig/drivers/net/usb/aqc111.c
+++ linux-qcom-6.8.0/drivers/net/usb/aqc111.c
@@ -1141,17 +1141,15 @@
 			continue;
 		}
 
-		/* Clone SKB */
-		new_skb = skb_clone(skb, GFP_ATOMIC);
+		new_skb = netdev_alloc_skb_ip_align(dev->net, pkt_len);
 
 		if (!new_skb)
 			goto err;
 
-		new_skb->len = pkt_len;
+		skb_put(new_skb, pkt_len);
+		memcpy(new_skb->data, skb->data, pkt_len);
 		skb_pull(new_skb, AQ_RX_HW_PAD);
-		skb_set_tail_pointer(new_skb, new_skb->len);
 
-		new_skb->truesize = SKB_TRUESIZE(new_skb->len);
 		if (aqc111_data->rx_checksum)
 			aqc111_rx_checksum(new_skb, pkt_desc);
 
--- linux-qcom-6.8.0.orig/drivers/net/usb/ax88179_178a.c
+++ linux-qcom-6.8.0/drivers/net/usb/ax88179_178a.c
@@ -326,7 +326,8 @@
 
 	if (netif_carrier_ok(dev->net) != link) {
 		usbnet_link_change(dev, link, 1);
-		netdev_info(dev->net, "ax88179 - Link status is: %d\n", link);
+		if (!link)
+			netdev_info(dev->net, "ax88179 - Link status is: 0\n");
 	}
 }
 
@@ -1273,6 +1274,8 @@
 
 	if (is_valid_ether_addr(mac)) {
 		eth_hw_addr_set(dev->net, mac);
+		if (!is_local_ether_addr(mac))
+			dev->net->addr_assign_type = NET_ADDR_PERM;
 	} else {
 		netdev_info(dev->net, "invalid MAC address, using random\n");
 		eth_hw_addr_random(dev->net);
@@ -1315,6 +1318,8 @@
 
 	netif_set_tso_max_size(dev->net, 16384);
 
+	ax88179_reset(dev);
+
 	return 0;
 }
 
@@ -1452,21 +1457,16 @@
 			/* Skip IP alignment pseudo header */
 			skb_pull(skb, 2);
 
-			skb->truesize = SKB_TRUESIZE(pkt_len_plus_padd);
 			ax88179_rx_checksum(skb, pkt_hdr);
 			return 1;
 		}
 
-		ax_skb = skb_clone(skb, GFP_ATOMIC);
+		ax_skb = netdev_alloc_skb_ip_align(dev->net, pkt_len);
 		if (!ax_skb)
 			return 0;
-		skb_trim(ax_skb, pkt_len);
+		skb_put(ax_skb, pkt_len);
+		memcpy(ax_skb->data, skb->data + 2, pkt_len);
 
-		/* Skip IP alignment pseudo header */
-		skb_pull(ax_skb, 2);
-
-		skb->truesize = pkt_len_plus_padd +
-				SKB_DATA_ALIGN(sizeof(struct sk_buff));
 		ax88179_rx_checksum(ax_skb, pkt_hdr);
 		usbnet_skb_return(dev, ax_skb);
 
@@ -1541,6 +1541,7 @@
 			 GMII_PHY_PHYSR, 2, &tmp16);
 
 	if (!(tmp16 & GMII_PHY_PHYSR_LINK)) {
+		netdev_info(dev->net, "ax88179 - Link status is: 0\n");
 		return 0;
 	} else if (GMII_PHY_PHYSR_GIGA == (tmp16 & GMII_PHY_PHYSR_SMASK)) {
 		mode |= AX_MEDIUM_GIGAMODE | AX_MEDIUM_EN_125MHZ;
@@ -1578,6 +1579,8 @@
 
 	netif_carrier_on(dev->net);
 
+	netdev_info(dev->net, "ax88179 - Link status is: 1\n");
+
 	return 0;
 }
 
@@ -1674,6 +1677,27 @@
 	return 0;
 }
 
+static int ax88179_net_reset(struct usbnet *dev)
+{
+	u16 tmp16;
+
+	ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, GMII_PHY_PHYSR,
+			 2, &tmp16);
+	if (tmp16) {
+		ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+				 2, 2, &tmp16);
+		if (!(tmp16 & AX_MEDIUM_RECEIVE_EN)) {
+			tmp16 |= AX_MEDIUM_RECEIVE_EN;
+			ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+					  2, 2, &tmp16);
+		}
+	} else {
+		ax88179_reset(dev);
+	}
+
+	return 0;
+}
+
 static int ax88179_stop(struct usbnet *dev)
 {
 	u16 tmp16;
@@ -1693,7 +1717,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset = ax88179_reset,
+	.reset = ax88179_net_reset,
 	.stop = ax88179_stop,
 	.flags = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1706,7 +1730,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset = ax88179_reset,
+	.reset = ax88179_net_reset,
 	.stop = ax88179_stop,
 	.flags = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1719,7 +1743,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset = ax88179_reset,
+	.reset = ax88179_net_reset,
 	.stop = ax88179_stop,
 	.flags = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1732,7 +1756,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset = ax88179_reset,
+	.reset = ax88179_net_reset,
 	.stop = ax88179_stop,
 	.flags = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1745,7 +1769,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset = ax88179_reset,
+	.reset = ax88179_net_reset,
 	.stop = ax88179_stop,
 	.flags = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1758,7 +1782,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset = ax88179_reset,
+	.reset = ax88179_net_reset,
 	.stop = ax88179_stop,
 	.flags = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1771,7 +1795,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset = ax88179_reset,
+	.reset = ax88179_net_reset,
 	.stop = ax88179_stop,
 	.flags = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1784,7 +1808,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset	= ax88179_reset,
+	.reset	= ax88179_net_reset,
 	.stop	= ax88179_stop,
 	.flags	= FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1797,7 +1821,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset	= ax88179_reset,
+	.reset	= ax88179_net_reset,
 	.stop = ax88179_stop,
 	.flags	= FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1810,7 +1834,7 @@
 	.unbind	= ax88179_unbind,
 	.status	= ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset	= ax88179_reset,
+	.reset	= ax88179_net_reset,
 	.stop	= ax88179_stop,
 	.flags	= FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1823,7 +1847,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset  = ax88179_reset,
+	.reset  = ax88179_net_reset,
 	.stop   = ax88179_stop,
 	.flags  = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1836,7 +1860,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset  = ax88179_reset,
+	.reset  = ax88179_net_reset,
 	.stop   = ax88179_stop,
 	.flags  = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
@@ -1849,7 +1873,7 @@
 	.unbind = ax88179_unbind,
 	.status = ax88179_status,
 	.link_reset = ax88179_link_reset,
-	.reset  = ax88179_reset,
+	.reset  = ax88179_net_reset,
 	.stop   = ax88179_stop,
 	.flags  = FLAG_ETHER | FLAG_FRAMING_AX,
 	.rx_fixup = ax88179_rx_fixup,
--- linux-qcom-6.8.0.orig/drivers/net/usb/ipheth.c
+++ linux-qcom-6.8.0/drivers/net/usb/ipheth.c
@@ -286,10 +286,11 @@
 		return;
 	}
 
-	if (urb->actual_length <= IPHETH_IP_ALIGN) {
-		dev->net->stats.rx_length_errors++;
-		return;
-	}
+	/* iPhone may periodically send URBs with no payload
+	 * on the "bulk in" endpoint. It is safe to ignore them.
+	 */
+	if (urb->actual_length == 0)
+		goto rx_submit;
 
 	/* RX URBs starting with 0x00 0x01 do not encapsulate Ethernet frames,
 	 * but rather are control frames. Their purpose is not documented, and
@@ -298,7 +299,8 @@
 	 * URB received from the bulk IN endpoint.
 	 */
 	if (unlikely
-		(((char *)urb->transfer_buffer)[0] == 0 &&
+		(urb->actual_length == 4 &&
+		 ((char *)urb->transfer_buffer)[0] == 0 &&
 		 ((char *)urb->transfer_buffer)[1] == 1))
 		goto rx_submit;
 
@@ -306,7 +308,6 @@
 	if (retval != 0) {
 		dev_err(&dev->intf->dev, "%s: callback retval: %d\n",
 			__func__, retval);
-		return;
 	}
 
 rx_submit:
@@ -354,13 +355,14 @@
 			0x02, /* index */
 			dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
 			IPHETH_CTRL_TIMEOUT);
-	if (retval < 0) {
+	if (retval <= 0) {
 		dev_err(&dev->intf->dev, "%s: usb_control_msg: %d\n",
 			__func__, retval);
 		return retval;
 	}
 
-	if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) {
+	if ((retval == 1 && dev->ctrl_buf[0] == IPHETH_CARRIER_ON) ||
+	    (retval >= 2 && dev->ctrl_buf[1] == IPHETH_CARRIER_ON)) {
 		netif_carrier_on(dev->net);
 		if (dev->tx_urb->status != -EINPROGRESS)
 			netif_wake_queue(dev->net);
@@ -475,8 +477,8 @@
 {
 	struct ipheth_device *dev = netdev_priv(net);
 
-	cancel_delayed_work_sync(&dev->carrier_work);
 	netif_stop_queue(net);
+	cancel_delayed_work_sync(&dev->carrier_work);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/usb/lan78xx.c
+++ linux-qcom-6.8.0/drivers/net/usb/lan78xx.c
@@ -1657,13 +1657,13 @@
 	struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
 	int ret;
 
+	if (wol->wolopts & ~WAKE_ALL)
+		return -EINVAL;
+
 	ret = usb_autopm_get_interface(dev->intf);
 	if (ret < 0)
 		return ret;
 
-	if (wol->wolopts & ~WAKE_ALL)
-		return -EINVAL;
-
 	pdata->wol = wol->wolopts;
 
 	device_set_wakeup_enable(&dev->udev->dev, (bool)wol->wolopts);
@@ -2385,6 +2385,7 @@
 		if (dev->chipid == ID_REV_CHIP_ID_7801_) {
 			if (phy_is_pseudo_fixed_link(phydev)) {
 				fixed_phy_unregister(phydev);
+				phy_device_free(phydev);
 			} else {
 				phy_unregister_fixup_for_uid(PHY_KSZ9031RNX,
 							     0xfffffff0);
@@ -4244,8 +4245,10 @@
 
 	phy_disconnect(net->phydev);
 
-	if (phy_is_pseudo_fixed_link(phydev))
+	if (phy_is_pseudo_fixed_link(phydev)) {
 		fixed_phy_unregister(phydev);
+		phy_device_free(phydev);
+	}
 
 	usb_scuttle_anchored_urbs(&dev->deferred);
 
@@ -4412,29 +4415,30 @@
 
 	period = ep_intr->desc.bInterval;
 	maxp = usb_maxpacket(dev->udev, dev->pipe_intr);
-	buf = kmalloc(maxp, GFP_KERNEL);
-	if (!buf) {
+
+	dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL);
+	if (!dev->urb_intr) {
 		ret = -ENOMEM;
 		goto out5;
 	}
 
-	dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL);
-	if (!dev->urb_intr) {
+	buf = kmalloc(maxp, GFP_KERNEL);
+	if (!buf) {
 		ret = -ENOMEM;
-		goto out6;
-	} else {
-		usb_fill_int_urb(dev->urb_intr, dev->udev,
-				 dev->pipe_intr, buf, maxp,
-				 intr_complete, dev, period);
-		dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
+		goto free_urbs;
 	}
 
+	usb_fill_int_urb(dev->urb_intr, dev->udev,
+			 dev->pipe_intr, buf, maxp,
+			 intr_complete, dev, period);
+	dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
+
 	dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out);
 
 	/* Reject broken descriptors. */
 	if (dev->maxpacket == 0) {
 		ret = -ENODEV;
-		goto out6;
+		goto free_urbs;
 	}
 
 	/* driver requires remote-wakeup capability during autosuspend. */
@@ -4442,7 +4446,7 @@
 
 	ret = lan78xx_phy_init(dev);
 	if (ret < 0)
-		goto out7;
+		goto free_urbs;
 
 	ret = register_netdev(netdev);
 	if (ret != 0) {
@@ -4464,10 +4468,8 @@
 
 out8:
 	phy_disconnect(netdev->phydev);
-out7:
+free_urbs:
 	usb_free_urb(dev->urb_intr);
-out6:
-	kfree(buf);
 out5:
 	lan78xx_unbind(dev, intf);
 out4:
--- linux-qcom-6.8.0.orig/drivers/net/usb/qmi_wwan.c
+++ linux-qcom-6.8.0/drivers/net/usb/qmi_wwan.c
@@ -201,6 +201,7 @@
 			break;
 		default:
 			/* not ip - do not know what to do */
+			kfree_skb(skbn);
 			goto skip;
 		}
 
@@ -1083,6 +1084,7 @@
 		USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
 		.driver_info = (unsigned long)&qmi_wwan_info,
 	},
+	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0122)},	/* Quectel RG650V */
 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)},	/* Quectel EC25, EC20 R2.0  Mini PCIe */
 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)},	/* Quectel EP06/EG06/EM06 */
 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)},	/* Quectel EG12/EM12 */
@@ -1368,6 +1370,12 @@
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)},	/* Telit LN920 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)},	/* Telit FN990 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */
 	{QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},	/* Telit ME910 */
 	{QMI_FIXED_INTF(0x1bc7, 0x1101, 3)},	/* Telit ME910 dual modem */
 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
@@ -1377,6 +1385,8 @@
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)},	/* Telit LE910Cx */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)},	/* Telit LE910Cx */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)},	/* Telit LN940 series */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x3000, 0)},	/* Telit FN912 series */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x3001, 0)},	/* Telit FN912 series */
 	{QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},	/* Telewell TW-3G HSPA+ */
 	{QMI_FIXED_INTF(0x1c9e, 0x9803, 4)},	/* Telewell TW-3G HSPA+ */
 	{QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},	/* XS Stick W100-2 from 4G Systems */
@@ -1426,11 +1436,14 @@
 	{QMI_FIXED_INTF(0x2c7c, 0x0296, 4)},	/* Quectel BG96 */
 	{QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)},	/* Quectel EM05GV2 */
 	{QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)},	/* Fibocom NL678 series */
+	{QMI_QUIRK_SET_DTR(0x2cb7, 0x0112, 0)},	/* Fibocom FG132 */
 	{QMI_FIXED_INTF(0x0489, 0xe0b4, 0)},	/* Foxconn T77W968 LTE */
 	{QMI_FIXED_INTF(0x0489, 0xe0b5, 0)},	/* Foxconn T77W968 LTE with eSIM support*/
 	{QMI_FIXED_INTF(0x2692, 0x9025, 4)},    /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
 	{QMI_QUIRK_SET_DTR(0x1546, 0x1312, 4)},	/* u-blox LARA-R6 01B */
 	{QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)},	/* u-blox LARA-L6 */
+	{QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET */
+	{QMI_FIXED_INTF(0x2dee, 0x4d22, 5)},    /* MeiG Smart SRM825L */
 
 	/* 4. Gobi 1000 devices */
 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
--- linux-qcom-6.8.0.orig/drivers/net/usb/r8152.c
+++ linux-qcom-6.8.0/drivers/net/usb/r8152.c
@@ -5176,14 +5176,23 @@
 	data = (u8 *)mac;
 	data += __le16_to_cpu(mac->fw_offset);
 
-	generic_ocp_write(tp, __le16_to_cpu(mac->fw_reg), 0xff, length, data,
-			  type);
+	if (generic_ocp_write(tp, __le16_to_cpu(mac->fw_reg), 0xff, length,
+			      data, type) < 0) {
+		dev_err(&tp->intf->dev, "Write %s fw fail\n",
+			type ? "PLA" : "USB");
+		return;
+	}
 
 	ocp_write_word(tp, type, __le16_to_cpu(mac->bp_ba_addr),
 		       __le16_to_cpu(mac->bp_ba_value));
 
-	generic_ocp_write(tp, __le16_to_cpu(mac->bp_start), BYTE_EN_DWORD,
-			  __le16_to_cpu(mac->bp_num) << 1, mac->bp, type);
+	if (generic_ocp_write(tp, __le16_to_cpu(mac->bp_start), BYTE_EN_DWORD,
+			      ALIGN(__le16_to_cpu(mac->bp_num) << 1, 4),
+			      mac->bp, type) < 0) {
+		dev_err(&tp->intf->dev, "Write %s bp fail\n",
+			type ? "PLA" : "USB");
+		return;
+	}
 
 	bp_en_addr = __le16_to_cpu(mac->bp_en_addr);
 	if (bp_en_addr)
@@ -10040,6 +10049,7 @@
 	{ USB_DEVICE(VENDOR_ID_LENOVO,  0x3062) },
 	{ USB_DEVICE(VENDOR_ID_LENOVO,  0x3069) },
 	{ USB_DEVICE(VENDOR_ID_LENOVO,  0x3082) },
+	{ USB_DEVICE(VENDOR_ID_LENOVO,  0x3098) },
 	{ USB_DEVICE(VENDOR_ID_LENOVO,  0x7205) },
 	{ USB_DEVICE(VENDOR_ID_LENOVO,  0x720c) },
 	{ USB_DEVICE(VENDOR_ID_LENOVO,  0x7214) },
@@ -10078,7 +10088,7 @@
 	 * driver supports it.
 	 */
 	if (__rtl_get_hw_ver(udev) == RTL_VER_UNKNOWN)
-		return 0;
+		return -ENODEV;
 
 	/* The vendor mode is not always config #1, so to find it out. */
 	c = udev->config;
--- linux-qcom-6.8.0.orig/drivers/net/usb/rtl8150.c
+++ linux-qcom-6.8.0/drivers/net/usb/rtl8150.c
@@ -778,7 +778,8 @@
 				      struct ethtool_link_ksettings *ecmd)
 {
 	rtl8150_t *dev = netdev_priv(netdev);
-	short lpa, bmcr;
+	short lpa = 0;
+	short bmcr = 0;
 	u32 supported;
 
 	supported = (SUPPORTED_10baseT_Half |
--- linux-qcom-6.8.0.orig/drivers/net/usb/smsc95xx.c
+++ linux-qcom-6.8.0/drivers/net/usb/smsc95xx.c
@@ -879,7 +879,7 @@
 static int smsc95xx_reset(struct usbnet *dev)
 {
 	struct smsc95xx_priv *pdata = dev->driver_priv;
-	u32 read_buf, write_buf, burst_cap;
+	u32 read_buf, burst_cap;
 	int ret = 0, timeout;
 
 	netif_dbg(dev, ifup, dev->net, "entering smsc95xx_reset\n");
@@ -1003,10 +1003,13 @@
 		return ret;
 	netif_dbg(dev, ifup, dev->net, "ID_REV = 0x%08x\n", read_buf);
 
+	ret = smsc95xx_read_reg(dev, LED_GPIO_CFG, &read_buf);
+	if (ret < 0)
+		return ret;
 	/* Configure GPIO pins as LED outputs */
-	write_buf = LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED |
-		LED_GPIO_CFG_FDX_LED;
-	ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, write_buf);
+	read_buf |= LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED |
+		    LED_GPIO_CFG_FDX_LED;
+	ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, read_buf);
 	if (ret < 0)
 		return ret;
 
@@ -1810,9 +1813,11 @@
 
 static void smsc95xx_rx_csum_offload(struct sk_buff *skb)
 {
-	skb->csum = *(u16 *)(skb_tail_pointer(skb) - 2);
+	u16 *csum_ptr = (u16 *)(skb_tail_pointer(skb) - 2);
+
+	skb->csum = (__force __wsum)get_unaligned(csum_ptr);
 	skb->ip_summed = CHECKSUM_COMPLETE;
-	skb_trim(skb, skb->len - 2);
+	skb_trim(skb, skb->len - 2); /* remove csum */
 }
 
 static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
@@ -1870,25 +1875,22 @@
 				if (dev->net->features & NETIF_F_RXCSUM)
 					smsc95xx_rx_csum_offload(skb);
 				skb_trim(skb, skb->len - 4); /* remove fcs */
-				skb->truesize = size + sizeof(struct sk_buff);
 
 				return 1;
 			}
 
-			ax_skb = skb_clone(skb, GFP_ATOMIC);
+			ax_skb = netdev_alloc_skb_ip_align(dev->net, size);
 			if (unlikely(!ax_skb)) {
 				netdev_warn(dev->net, "Error allocating skb\n");
 				return 0;
 			}
 
-			ax_skb->len = size;
-			ax_skb->data = packet;
-			skb_set_tail_pointer(ax_skb, size);
+			skb_put(ax_skb, size);
+			memcpy(ax_skb->data, packet, size);
 
 			if (dev->net->features & NETIF_F_RXCSUM)
 				smsc95xx_rx_csum_offload(ax_skb);
 			skb_trim(ax_skb, ax_skb->len - 4); /* remove fcs */
-			ax_skb->truesize = size + sizeof(struct sk_buff);
 
 			usbnet_skb_return(dev, ax_skb);
 		}
--- linux-qcom-6.8.0.orig/drivers/net/usb/sr9700.c
+++ linux-qcom-6.8.0/drivers/net/usb/sr9700.c
@@ -179,6 +179,7 @@
 	struct usbnet *dev = netdev_priv(netdev);
 	__le16 res;
 	int rc = 0;
+	int err;
 
 	if (phy_id) {
 		netdev_dbg(netdev, "Only internal phy supported\n");
@@ -189,11 +190,17 @@
 	if (loc == MII_BMSR) {
 		u8 value;
 
-		sr_read_reg(dev, SR_NSR, &value);
+		err = sr_read_reg(dev, SR_NSR, &value);
+		if (err < 0)
+			return err;
+
 		if (value & NSR_LINKST)
 			rc = 1;
 	}
-	sr_share_read_word(dev, 1, loc, &res);
+	err = sr_share_read_word(dev, 1, loc, &res);
+	if (err < 0)
+		return err;
+
 	if (rc == 1)
 		res = le16_to_cpu(res) | BMSR_LSTATUS;
 	else
@@ -421,19 +428,15 @@
 			skb_pull(skb, 3);
 			skb->len = len;
 			skb_set_tail_pointer(skb, len);
-			skb->truesize = len + sizeof(struct sk_buff);
 			return 2;
 		}
 
-		/* skb_clone is used for address align */
-		sr_skb = skb_clone(skb, GFP_ATOMIC);
+		sr_skb = netdev_alloc_skb_ip_align(dev->net, len);
 		if (!sr_skb)
 			return 0;
 
-		sr_skb->len = len;
-		sr_skb->data = skb->data + 3;
-		skb_set_tail_pointer(sr_skb, len);
-		sr_skb->truesize = len + sizeof(struct sk_buff);
+		skb_put(sr_skb, len);
+		memcpy(sr_skb->data, skb->data + 3, len);
 		usbnet_skb_return(dev, sr_skb);
 
 		skb_pull(skb, len + SR_RX_OVERHEAD);
--- linux-qcom-6.8.0.orig/drivers/net/usb/sr9800.c
+++ linux-qcom-6.8.0/drivers/net/usb/sr9800.c
@@ -737,7 +737,9 @@
 
 	data->eeprom_len = SR9800_EEPROM_LEN;
 
-	usbnet_get_endpoints(dev, intf);
+	ret = usbnet_get_endpoints(dev, intf);
+	if (ret)
+		goto out;
 
 	/* LED Setting Rule :
 	 * AABB:CCDD
--- linux-qcom-6.8.0.orig/drivers/net/usb/usbnet.c
+++ linux-qcom-6.8.0/drivers/net/usb/usbnet.c
@@ -61,9 +61,6 @@
 
 /*-------------------------------------------------------------------------*/
 
-// randomly generated ethernet address
-static u8	node_id [ETH_ALEN];
-
 /* use ethtool to change the level for any given device */
 static int msg_level = -1;
 module_param (msg_level, int, 0);
@@ -467,10 +464,15 @@
 void usbnet_defer_kevent (struct usbnet *dev, int work)
 {
 	set_bit (work, &dev->flags);
-	if (!schedule_work (&dev->kevent))
-		netdev_dbg(dev->net, "kevent %s may have been dropped\n", usbnet_event_names[work]);
-	else
-		netdev_dbg(dev->net, "kevent %s scheduled\n", usbnet_event_names[work]);
+	if (!usbnet_going_away(dev)) {
+		if (!schedule_work(&dev->kevent))
+			netdev_dbg(dev->net,
+				   "kevent %s may have been dropped\n",
+				   usbnet_event_names[work]);
+		else
+			netdev_dbg(dev->net,
+				   "kevent %s scheduled\n", usbnet_event_names[work]);
+	}
 }
 EXPORT_SYMBOL_GPL(usbnet_defer_kevent);
 
@@ -538,7 +540,8 @@
 			tasklet_schedule (&dev->bh);
 			break;
 		case 0:
-			__usbnet_queue_skb(&dev->rxq, skb, rx_start);
+			if (!usbnet_going_away(dev))
+				__usbnet_queue_skb(&dev->rxq, skb, rx_start);
 		}
 	} else {
 		netif_dbg(dev, ifdown, dev->net, "rx: stopped\n");
@@ -846,9 +849,18 @@
 
 	/* deferred work (timer, softirq, task) must also stop */
 	dev->flags = 0;
-	del_timer_sync (&dev->delay);
-	tasklet_kill (&dev->bh);
+	del_timer_sync(&dev->delay);
+	tasklet_kill(&dev->bh);
 	cancel_work_sync(&dev->kevent);
+
+	/* We have cyclic dependencies. Those calls are needed
+	 * to break a cycle. We cannot fall into the gaps because
+	 * we have a flag
+	 */
+	tasklet_kill(&dev->bh);
+	del_timer_sync(&dev->delay);
+	cancel_work_sync(&dev->kevent);
+
 	if (!pm)
 		usb_autopm_put_interface(dev->intf);
 
@@ -1174,7 +1186,8 @@
 					   status);
 		} else {
 			clear_bit (EVENT_RX_HALT, &dev->flags);
-			tasklet_schedule (&dev->bh);
+			if (!usbnet_going_away(dev))
+				tasklet_schedule(&dev->bh);
 		}
 	}
 
@@ -1199,7 +1212,8 @@
 			usb_autopm_put_interface(dev->intf);
 fail_lowmem:
 			if (resched)
-				tasklet_schedule (&dev->bh);
+				if (!usbnet_going_away(dev))
+					tasklet_schedule(&dev->bh);
 		}
 	}
 
@@ -1562,6 +1576,7 @@
 	} else if (netif_running (dev->net) &&
 		   netif_device_present (dev->net) &&
 		   netif_carrier_ok(dev->net) &&
+		   !usbnet_going_away(dev) &&
 		   !timer_pending(&dev->delay) &&
 		   !test_bit(EVENT_RX_PAUSED, &dev->flags) &&
 		   !test_bit(EVENT_RX_HALT, &dev->flags)) {
@@ -1609,6 +1624,7 @@
 	usb_set_intfdata(intf, NULL);
 	if (!dev)
 		return;
+	usbnet_mark_going_away(dev);
 
 	xdev = interface_to_usbdev (intf);
 
@@ -1731,7 +1747,6 @@
 
 	dev->net = net;
 	strscpy(net->name, "usb%d", sizeof(net->name));
-	eth_hw_addr_set(net, node_id);
 
 	/* rx and tx sides can use different message sizes;
 	 * bind() should set rx_urb_size in that case.
@@ -1756,7 +1771,8 @@
 		// can rename the link if it knows better.
 		if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
 		    ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||
-		     (net->dev_addr [0] & 0x02) == 0))
+		     /* somebody touched it*/
+		     !is_zero_ether_addr(net->dev_addr)))
 			strscpy(net->name, "eth%d", sizeof(net->name));
 		/* WLAN devices should always be named "wlan%d" */
 		if ((dev->driver_info->flags & FLAG_WLAN) != 0)
@@ -1805,9 +1821,9 @@
 		goto out4;
 	}
 
-	/* let userspace know we have a random address */
-	if (ether_addr_equal(net->dev_addr, node_id))
-		net->addr_assign_type = NET_ADDR_RANDOM;
+	/* this flags the device for user space */
+	if (!is_valid_ether_addr(net->dev_addr))
+		eth_hw_addr_random(net);
 
 	if ((dev->driver_info->flags & FLAG_WLAN) != 0)
 		SET_NETDEV_DEVTYPE(net, &wlan_type);
@@ -1859,6 +1875,7 @@
 	 * may trigger an error resubmitting itself and, worse,
 	 * schedule a timer. So we kill it all just in case.
 	 */
+	usbnet_mark_going_away(dev);
 	cancel_work_sync(&dev->kevent);
 	del_timer_sync(&dev->delay);
 	free_percpu(net->tstats);
@@ -2217,7 +2234,6 @@
 	BUILD_BUG_ON(
 		sizeof_field(struct sk_buff, cb) < sizeof(struct skb_data));
 
-	eth_random_addr(node_id);
 	return 0;
 }
 module_init(usbnet_init);
--- linux-qcom-6.8.0.orig/drivers/net/veth.c
+++ linux-qcom-6.8.0/drivers/net/veth.c
@@ -1483,6 +1483,7 @@
 
 static int veth_dev_init(struct net_device *dev)
 {
+	netdev_lockdep_set_classes(dev);
 	return veth_alloc_queues(dev);
 }
 
@@ -1533,8 +1534,6 @@
 		if (peer_priv->_xdp_prog)
 			features &= ~NETIF_F_GSO_SOFTWARE;
 	}
-	if (priv->_xdp_prog)
-		features |= NETIF_F_GRO;
 
 	return features;
 }
@@ -1638,14 +1637,6 @@
 		}
 
 		if (!old_prog) {
-			if (!veth_gro_requested(dev)) {
-				/* user-space did not require GRO, but adding
-				 * XDP is supposed to get GRO working
-				 */
-				dev->features |= NETIF_F_GRO;
-				netdev_features_change(dev);
-			}
-
 			peer->hw_features &= ~NETIF_F_GSO_SOFTWARE;
 			peer->max_mtu = max_mtu;
 		}
@@ -1661,14 +1652,6 @@
 			if (dev->flags & IFF_UP)
 				veth_disable_xdp(dev);
 
-			/* if user-space did not require GRO, since adding XDP
-			 * enabled it, clear it now
-			 */
-			if (!veth_gro_requested(dev)) {
-				dev->features &= ~NETIF_F_GRO;
-				netdev_features_change(dev);
-			}
-
 			if (peer) {
 				peer->hw_features |= NETIF_F_GSO_SOFTWARE;
 				peer->max_mtu = ETH_MAX_MTU;
--- linux-qcom-6.8.0.orig/drivers/net/virtio_net.c
+++ linux-qcom-6.8.0/drivers/net/virtio_net.c
@@ -695,9 +695,6 @@
 	void *buf, *head;
 	dma_addr_t addr;
 
-	if (unlikely(!skb_page_frag_refill(size, alloc_frag, gfp)))
-		return NULL;
-
 	head = page_address(alloc_frag->page);
 
 	if (rq->do_dma) {
@@ -1209,6 +1206,10 @@
 	if (unlikely(hdr->hdr.gso_type))
 		goto err_xdp;
 
+	/* Partially checksummed packets must be dropped. */
+	if (unlikely(hdr->hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM))
+		goto err_xdp;
+
 	buflen = SKB_DATA_ALIGN(GOOD_PACKET_LEN + headroom) +
 		SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
@@ -1284,6 +1285,11 @@
 	struct page *page = virt_to_head_page(buf);
 	struct sk_buff *skb;
 
+	/* We passed the address of virtnet header to virtio-core,
+	 * so truncate the padding.
+	 */
+	buf -= VIRTNET_RX_PAD + xdp_headroom;
+
 	len -= vi->hdr_len;
 	u64_stats_add(&stats->bytes, len);
 
@@ -1526,6 +1532,10 @@
 	if (unlikely(hdr->hdr.gso_type))
 		return NULL;
 
+	/* Partially checksummed packets must be dropped. */
+	if (unlikely(hdr->hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM))
+		return NULL;
+
 	/* Now XDP core assumes frag size is PAGE_SIZE, but buffers
 	 * with headroom may add hole in truesize, which
 	 * make their length exceed PAGE_SIZE. So we disabled the
@@ -1792,6 +1802,7 @@
 	struct net_device *dev = vi->dev;
 	struct sk_buff *skb;
 	struct virtio_net_common_hdr *hdr;
+	u8 flags;
 
 	if (unlikely(len < vi->hdr_len + ETH_HLEN)) {
 		pr_debug("%s: short packet %i\n", dev->name, len);
@@ -1800,6 +1811,15 @@
 		return;
 	}
 
+	/* 1. Save the flags early, as the XDP program might overwrite them.
+	 * These flags ensure packets marked as VIRTIO_NET_HDR_F_DATA_VALID
+	 * stay valid after XDP processing.
+	 * 2. XDP doesn't work with partially checksummed packets (refer to
+	 * virtnet_xdp_set()), so packets marked as
+	 * VIRTIO_NET_HDR_F_NEEDS_CSUM get dropped during XDP processing.
+	 */
+	flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags;
+
 	if (vi->mergeable_rx_bufs)
 		skb = receive_mergeable(dev, vi, rq, buf, ctx, len, xdp_xmit,
 					stats);
@@ -1815,7 +1835,7 @@
 	if (dev->features & NETIF_F_RXHASH && vi->has_rss_hash_report)
 		virtio_skb_set_hash(&hdr->hash_v1_hdr, skb);
 
-	if (hdr->hdr.flags & VIRTIO_NET_HDR_F_DATA_VALID)
+	if (flags & VIRTIO_NET_HDR_F_DATA_VALID)
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 
 	if (virtio_net_hdr_to_skb(skb, &hdr->hdr,
@@ -1856,12 +1876,16 @@
 	len = SKB_DATA_ALIGN(len) +
 	      SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
+	if (unlikely(!skb_page_frag_refill(len, &rq->alloc_frag, gfp)))
+		return -ENOMEM;
+
 	buf = virtnet_rq_alloc(rq, len, gfp);
 	if (unlikely(!buf))
 		return -ENOMEM;
 
-	virtnet_rq_init_one_sg(rq, buf + VIRTNET_RX_PAD + xdp_headroom,
-			       vi->hdr_len + GOOD_PACKET_LEN);
+	buf += VIRTNET_RX_PAD + xdp_headroom;
+
+	virtnet_rq_init_one_sg(rq, buf, vi->hdr_len + GOOD_PACKET_LEN);
 
 	err = virtqueue_add_inbuf_ctx(rq->vq, rq->sg, 1, buf, ctx, gfp);
 	if (err < 0) {
@@ -1957,6 +1981,12 @@
 	 */
 	len = get_mergeable_buf_len(rq, &rq->mrg_avg_pkt_len, room);
 
+	if (unlikely(!skb_page_frag_refill(len + room, alloc_frag, gfp)))
+		return -ENOMEM;
+
+	if (!alloc_frag->offset && len + room + sizeof(struct virtnet_rq_dma) > alloc_frag->size)
+		len -= sizeof(struct virtnet_rq_dma);
+
 	buf = virtnet_rq_alloc(rq, len + room, gfp);
 	if (unlikely(!buf))
 		return -ENOMEM;
@@ -2142,7 +2172,7 @@
 	return packets;
 }
 
-static void virtnet_poll_cleantx(struct receive_queue *rq)
+static void virtnet_poll_cleantx(struct receive_queue *rq, int budget)
 {
 	struct virtnet_info *vi = rq->vq->vdev->priv;
 	unsigned int index = vq2rxq(rq->vq);
@@ -2160,7 +2190,7 @@
 
 		do {
 			virtqueue_disable_cb(sq->vq);
-			free_old_xmit_skbs(sq, true);
+			free_old_xmit_skbs(sq, !!budget);
 		} while (unlikely(!virtqueue_enable_cb_delayed(sq->vq)));
 
 		if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS)
@@ -2198,7 +2228,7 @@
 	unsigned int xdp_xmit = 0;
 	bool napi_complete;
 
-	virtnet_poll_cleantx(rq);
+	virtnet_poll_cleantx(rq, budget);
 
 	received = virtnet_receive(rq, budget, &xdp_xmit);
 	rq->packets_in_napi += received;
@@ -2258,6 +2288,25 @@
 	return err;
 }
 
+static void virtnet_update_settings(struct virtnet_info *vi)
+{
+	u32 speed;
+	u8 duplex;
+
+	if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_SPEED_DUPLEX))
+		return;
+
+	virtio_cread_le(vi->vdev, struct virtio_net_config, speed, &speed);
+
+	if (ethtool_validate_speed(speed))
+		vi->speed = speed;
+
+	virtio_cread_le(vi->vdev, struct virtio_net_config, duplex, &duplex);
+
+	if (ethtool_validate_duplex(duplex))
+		vi->duplex = duplex;
+}
+
 static int virtnet_open(struct net_device *dev)
 {
 	struct virtnet_info *vi = netdev_priv(dev);
@@ -2276,6 +2325,15 @@
 			goto err_enable_qp;
 	}
 
+	if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_STATUS)) {
+		if (vi->status & VIRTIO_NET_S_LINK_UP)
+			netif_carrier_on(vi->dev);
+		virtio_config_driver_enable(vi->vdev);
+	} else {
+		vi->status = VIRTIO_NET_S_LINK_UP;
+		netif_carrier_on(dev);
+	}
+
 	return 0;
 
 err_enable_qp:
@@ -2308,7 +2366,7 @@
 	txq = netdev_get_tx_queue(vi->dev, index);
 	__netif_tx_lock(txq, raw_smp_processor_id());
 	virtqueue_disable_cb(sq->vq);
-	free_old_xmit_skbs(sq, true);
+	free_old_xmit_skbs(sq, !!budget);
 
 	if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS)
 		netif_tx_wake_queue(txq);
@@ -2697,12 +2755,22 @@
 	disable_delayed_refill(vi);
 	/* Make sure refill_work doesn't re-enable napi! */
 	cancel_delayed_work_sync(&vi->refill);
+	/* Prevent the config change callback from changing carrier
+	 * after close
+	 */
+	virtio_config_driver_disable(vi->vdev);
+	/* Stop getting status/speed updates: we don't care until next
+	 * open
+	 */
+	cancel_work_sync(&vi->config_work);
 
 	for (i = 0; i < vi->max_queue_pairs; i++) {
 		virtnet_disable_queue_pair(vi, i);
 		cancel_work_sync(&vi->rq[i].dim.work);
 	}
 
+	netif_carrier_off(dev);
+
 	return 0;
 }
 
@@ -2932,6 +3000,9 @@
 {
 	int err;
 
+	if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_VQ_NOTF_COAL))
+		return -EOPNOTSUPP;
+
 	err = virtnet_send_ctrl_coal_vq_cmd(vi, rxq2vq(queue),
 					    max_usecs, max_packets);
 	if (err)
@@ -2949,6 +3020,9 @@
 {
 	int err;
 
+	if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_VQ_NOTF_COAL))
+		return -EOPNOTSUPP;
+
 	err = virtnet_send_ctrl_coal_vq_cmd(vi, txq2vq(queue),
 					    max_usecs, max_packets);
 	if (err)
@@ -3017,7 +3091,11 @@
 			err = virtnet_send_tx_ctrl_coal_vq_cmd(vi, i,
 							       vi->intr_coal_tx.max_usecs,
 							       vi->intr_coal_tx.max_packets);
-			if (err)
+
+			/* Don't break the tx resize action if the vq coalescing is not
+			 * supported. The same is true for rx resize below.
+			 */
+			if (err && err != -EOPNOTSUPP)
 				return err;
 		}
 
@@ -3030,7 +3108,7 @@
 			err = virtnet_send_rx_ctrl_coal_vq_cmd(vi, i,
 							       vi->intr_coal_rx.max_usecs,
 							       vi->intr_coal_rx.max_packets);
-			if (err)
+			if (err && err != -EOPNOTSUPP)
 				return err;
 		}
 	}
@@ -3550,10 +3628,10 @@
 			if (err)
 				pr_debug("%s: Failed to send dim parameters on rxq%d\n",
 					 dev->name, qnum);
-			dim->state = DIM_START_MEASURE;
 		}
 	}
 
+	dim->state = DIM_START_MEASURE;
 	rtnl_unlock();
 }
 
@@ -3715,25 +3793,6 @@
 	vi->duplex = DUPLEX_UNKNOWN;
 }
 
-static void virtnet_update_settings(struct virtnet_info *vi)
-{
-	u32 speed;
-	u8 duplex;
-
-	if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_SPEED_DUPLEX))
-		return;
-
-	virtio_cread_le(vi->vdev, struct virtio_net_config, speed, &speed);
-
-	if (ethtool_validate_speed(speed))
-		vi->speed = speed;
-
-	virtio_cread_le(vi->vdev, struct virtio_net_config, duplex, &duplex);
-
-	if (ethtool_validate_duplex(duplex))
-		vi->duplex = duplex;
-}
-
 static u32 virtnet_get_rxfh_key_size(struct net_device *dev)
 {
 	return ((struct virtnet_info *)netdev_priv(dev))->rss_key_size;
@@ -3768,6 +3827,7 @@
 			    struct netlink_ext_ack *extack)
 {
 	struct virtnet_info *vi = netdev_priv(dev);
+	bool update = false;
 	int i;
 
 	if (rxfh->hfunc != ETH_RSS_HASH_NO_CHANGE &&
@@ -3775,13 +3835,28 @@
 		return -EOPNOTSUPP;
 
 	if (rxfh->indir) {
+		if (!vi->has_rss)
+			return -EOPNOTSUPP;
+
 		for (i = 0; i < vi->rss_indir_table_size; ++i)
 			vi->ctrl->rss.indirection_table[i] = rxfh->indir[i];
+		update = true;
 	}
-	if (rxfh->key)
+
+	if (rxfh->key) {
+		/* If either _F_HASH_REPORT or _F_RSS are negotiated, the
+		 * device provides hash calculation capabilities, that is,
+		 * hash_key is configured.
+		 */
+		if (!vi->has_rss && !vi->has_rss_hash_report)
+			return -EOPNOTSUPP;
+
 		memcpy(vi->ctrl->rss.key, rxfh->key, vi->rss_key_size);
+		update = true;
+	}
 
-	virtnet_commit_rss_command(vi);
+	if (update)
+		virtnet_commit_rss_command(vi);
 
 	return 0;
 }
@@ -4640,8 +4715,16 @@
 			dev->features |= dev->hw_features & NETIF_F_ALL_TSO;
 		/* (!csum && gso) case will be fixed by register_netdev() */
 	}
-	if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_CSUM))
-		dev->features |= NETIF_F_RXCSUM;
+
+	/* 1. With VIRTIO_NET_F_GUEST_CSUM negotiation, the driver doesn't
+	 * need to calculate checksums for partially checksummed packets,
+	 * as they're considered valid by the upper layer.
+	 * 2. Without VIRTIO_NET_F_GUEST_CSUM negotiation, the driver only
+	 * receives fully checksummed packets. The device may assist in
+	 * validating these packets' checksums, so the driver won't have to.
+	 */
+	dev->features |= NETIF_F_RXCSUM;
+
 	if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
 	    virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6))
 		dev->features |= NETIF_F_GRO_HW;
@@ -4686,15 +4769,23 @@
 	if (virtio_has_feature(vdev, VIRTIO_NET_F_HASH_REPORT))
 		vi->has_rss_hash_report = true;
 
-	if (virtio_has_feature(vdev, VIRTIO_NET_F_RSS))
+	if (virtio_has_feature(vdev, VIRTIO_NET_F_RSS)) {
 		vi->has_rss = true;
 
-	if (vi->has_rss || vi->has_rss_hash_report) {
 		vi->rss_indir_table_size =
 			virtio_cread16(vdev, offsetof(struct virtio_net_config,
 				rss_max_indirection_table_length));
+	}
+
+	if (vi->has_rss || vi->has_rss_hash_report) {
 		vi->rss_key_size =
 			virtio_cread8(vdev, offsetof(struct virtio_net_config, rss_max_key_size));
+		if (vi->rss_key_size > VIRTIO_NET_RSS_MAX_KEY_SIZE) {
+			dev_err(&vdev->dev, "rss_max_key_size=%u exceeds the limit %u.\n",
+				vi->rss_key_size, VIRTIO_NET_RSS_MAX_KEY_SIZE);
+			err = -EINVAL;
+			goto free;
+		}
 
 		vi->rss_hash_types_supported =
 		    virtio_cread32(vdev, offsetof(struct virtio_net_config, supported_hash_types));
@@ -4808,8 +4899,20 @@
 		goto free_failover;
 	}
 
+	/* Disable config change notification until ndo_open. */
+	virtio_config_driver_disable(vi->vdev);
+
 	virtio_device_ready(vdev);
 
+	if (vi->has_rss || vi->has_rss_hash_report) {
+		if (!virtnet_commit_rss_command(vi)) {
+			dev_warn(&vdev->dev, "RSS disabled because committing failed.\n");
+			dev->hw_features &= ~NETIF_F_RXHASH;
+			vi->has_rss_hash_report = false;
+			vi->has_rss = false;
+		}
+	}
+
 	_virtnet_set_queues(vi, vi->curr_queue_pairs);
 
 	/* a random MAC address has been assigned, notify the device.
@@ -4830,19 +4933,11 @@
 		}
 	}
 
-	rtnl_unlock();
-
-	err = virtnet_cpu_notif_add(vi);
-	if (err) {
-		pr_debug("virtio_net: registering cpu notifier failed\n");
-		goto free_unregister_netdev;
-	}
-
 	/* Assume link up if device can't report link status,
 	   otherwise get link status from config. */
 	netif_carrier_off(dev);
 	if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_STATUS)) {
-		schedule_work(&vi->config_work);
+		virtnet_config_changed_work(&vi->config_work);
 	} else {
 		vi->status = VIRTIO_NET_S_LINK_UP;
 		virtnet_update_settings(vi);
@@ -4854,6 +4949,14 @@
 			set_bit(guest_offloads[i], &vi->guest_offloads);
 	vi->guest_offloads_capable = vi->guest_offloads;
 
+	rtnl_unlock();
+
+	err = virtnet_cpu_notif_add(vi);
+	if (err) {
+		pr_debug("virtio_net: registering cpu notifier failed\n");
+		goto free_unregister_netdev;
+	}
+
 	pr_debug("virtnet: registered device %s with %d RX and TX vq's\n",
 		 dev->name, max_queue_pairs);
 
--- linux-qcom-6.8.0.orig/drivers/net/vmxnet3/vmxnet3_drv.c
+++ linux-qcom-6.8.0/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2034,8 +2034,8 @@
 					  rq->data_ring.base,
 					  rq->data_ring.basePA);
 			rq->data_ring.base = NULL;
-			rq->data_ring.desc_size = 0;
 		}
+		rq->data_ring.desc_size = 0;
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/vmxnet3/vmxnet3_xdp.c
+++ linux-qcom-6.8.0/drivers/net/vmxnet3/vmxnet3_xdp.c
@@ -148,7 +148,7 @@
 	} else { /* XDP buffer from page pool */
 		page = virt_to_page(xdpf->data);
 		tbi->dma_addr = page_pool_get_dma_addr(page) +
-				VMXNET3_XDP_HEADROOM;
+				(xdpf->data - (void *)xdpf);
 		dma_sync_single_for_device(&adapter->pdev->dev,
 					   tbi->dma_addr, buf_size,
 					   DMA_TO_DEVICE);
@@ -382,12 +382,12 @@
 	page = rbi->page;
 	dma_sync_single_for_cpu(&adapter->pdev->dev,
 				page_pool_get_dma_addr(page) +
-				rq->page_pool->p.offset, rcd->len,
+				rq->page_pool->p.offset, rbi->len,
 				page_pool_get_dma_dir(rq->page_pool));
 
-	xdp_init_buff(&xdp, rbi->len, &rq->xdp_rxq);
+	xdp_init_buff(&xdp, PAGE_SIZE, &rq->xdp_rxq);
 	xdp_prepare_buff(&xdp, page_address(page), rq->page_pool->p.offset,
-			 rcd->len, false);
+			 rbi->len, false);
 	xdp_buff_clear_frags_flag(&xdp);
 
 	xdp_prog = rcu_dereference(rq->adapter->xdp_bpf_prog);
--- linux-qcom-6.8.0.orig/drivers/net/vrf.c
+++ linux-qcom-6.8.0/drivers/net/vrf.c
@@ -628,7 +628,9 @@
 		eth_zero_addr(eth->h_dest);
 		eth->h_proto = skb->protocol;
 
+		rcu_read_lock_bh();
 		dev_queue_xmit_nit(skb, vrf_dev);
+		rcu_read_unlock_bh();
 
 		skb_pull(skb, ETH_HLEN);
 	}
@@ -653,7 +655,7 @@
 	skb->dev = dev;
 
 	rcu_read_lock();
-	nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
+	nexthop = rt6_nexthop(dst_rt6_info(dst), &ipv6_hdr(skb)->daddr);
 	neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
 	if (unlikely(!neigh))
 		neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
@@ -860,7 +862,7 @@
 static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
 	struct dst_entry *dst = skb_dst(skb);
-	struct rtable *rt = (struct rtable *)dst;
+	struct rtable *rt = dst_rtable(dst);
 	struct net_device *dev = dst->dev;
 	unsigned int hh_len = LL_RESERVED_SPACE(dev);
 	struct neighbour *neigh;
--- linux-qcom-6.8.0.orig/drivers/net/vxlan/vxlan_core.c
+++ linux-qcom-6.8.0/drivers/net/vxlan/vxlan_core.c
@@ -13,6 +13,7 @@
 #include <linux/slab.h>
 #include <linux/udp.h>
 #include <linux/igmp.h>
+#include <linux/inetdevice.h>
 #include <linux/if_ether.h>
 #include <linux/ethtool.h>
 #include <net/arp.h>
@@ -71,6 +72,167 @@
 	       ip_tunnel_collect_metadata();
 }
 
+static struct ip_fan_map *vxlan_fan_find_map(struct vxlan_dev *vxlan, __be32 daddr)
+{
+	struct ip_fan_map *fan_map;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(fan_map, &vxlan->fan.fan_maps, list) {
+		if (fan_map->overlay ==
+		    (daddr & inet_make_mask(fan_map->overlay_prefix))) {
+			rcu_read_unlock();
+			return fan_map;
+		}
+	}
+	rcu_read_unlock();
+
+	return NULL;
+}
+
+static void vxlan_fan_flush_map(struct vxlan_dev *vxlan)
+{
+	struct ip_fan_map *fan_map;
+
+	list_for_each_entry_rcu(fan_map, &vxlan->fan.fan_maps, list) {
+		list_del_rcu(&fan_map->list);
+		kfree_rcu(fan_map, rcu);
+	}
+}
+
+static int vxlan_fan_del_map(struct vxlan_dev *vxlan, __be32 overlay)
+{
+	struct ip_fan_map *fan_map;
+
+	fan_map = vxlan_fan_find_map(vxlan, overlay);
+	if (!fan_map)
+		return -ENOENT;
+
+	list_del_rcu(&fan_map->list);
+	kfree_rcu(fan_map, rcu);
+
+	return 0;
+}
+
+static int vxlan_fan_add_map(struct vxlan_dev *vxlan, struct ifla_fan_map *map)
+{
+	__be32 overlay_mask, underlay_mask;
+	struct ip_fan_map *fan_map;
+
+	overlay_mask = inet_make_mask(map->overlay_prefix);
+	underlay_mask = inet_make_mask(map->underlay_prefix);
+
+	netdev_dbg(vxlan->dev, "vfam: map: o %x/%d u %x/%d om %x um %x\n",
+		   map->overlay, map->overlay_prefix,
+		   map->underlay, map->underlay_prefix,
+		   overlay_mask, underlay_mask);
+
+	if ((map->overlay & ~overlay_mask) || (map->underlay & ~underlay_mask))
+		return -EINVAL;
+
+	if (!(map->overlay & overlay_mask) && (map->underlay & underlay_mask))
+		return -EINVAL;
+
+	/* Special case: overlay 0 and underlay 0: flush all mappings */
+	if (!map->overlay && !map->underlay) {
+		vxlan_fan_flush_map(vxlan);
+		return 0;
+	}
+
+	/* Special case: overlay set and underlay 0: clear map for overlay */
+	if (!map->underlay)
+		return vxlan_fan_del_map(vxlan, map->overlay);
+
+	if (vxlan_fan_find_map(vxlan, map->overlay))
+		return -EEXIST;
+
+	fan_map = kmalloc(sizeof(*fan_map), GFP_KERNEL);
+	fan_map->underlay = map->underlay;
+	fan_map->overlay = map->overlay;
+	fan_map->underlay_prefix = map->underlay_prefix;
+	fan_map->overlay_mask = ntohl(overlay_mask);
+	fan_map->overlay_prefix = map->overlay_prefix;
+
+	list_add_tail_rcu(&fan_map->list, &vxlan->fan.fan_maps);
+
+	return 0;
+}
+
+static int vxlan_parse_fan_map(struct nlattr *data[], struct vxlan_dev *vxlan)
+{
+	struct ifla_fan_map *map;
+	struct nlattr *attr;
+	int rem, rv;
+
+	nla_for_each_nested(attr, data[IFLA_IPTUN_FAN_MAP], rem) {
+		map = nla_data(attr);
+		rv = vxlan_fan_add_map(vxlan, map);
+		if (rv)
+			return rv;
+	}
+
+	return 0;
+}
+
+static int vxlan_fan_build_rdst(struct vxlan_dev *vxlan, struct sk_buff *skb,
+				      struct vxlan_rdst *fan_rdst)
+{
+	struct ip_fan_map *f_map;
+	union vxlan_addr *va;
+	u32 daddr, underlay;
+	struct arphdr *arp;
+	void *arp_ptr;
+	struct ethhdr *eth;
+	struct iphdr *iph;
+
+	eth = eth_hdr(skb);
+	switch (eth->h_proto) {
+	case htons(ETH_P_IP):
+		iph = ip_hdr(skb);
+		if (!iph)
+			return -EINVAL;
+		daddr = iph->daddr;
+		break;
+	case htons(ETH_P_ARP):
+		arp = arp_hdr(skb);
+		if (!arp)
+			return -EINVAL;
+		arp_ptr = arp + 1;
+		netdev_dbg(vxlan->dev,
+			   "vfbr: arp sha %pM sip %pI4 tha %pM tip %pI4\n",
+			   arp_ptr, arp_ptr + skb->dev->addr_len,
+			   arp_ptr + skb->dev->addr_len + 4,
+			   arp_ptr + (skb->dev->addr_len * 2) + 4);
+		arp_ptr += (skb->dev->addr_len * 2) + 4;
+		memcpy(&daddr, arp_ptr, 4);
+		break;
+	default:
+		netdev_dbg(vxlan->dev, "vfbr: unknown eth p %x\n", eth->h_proto);
+		return -EINVAL;
+	}
+
+	f_map = vxlan_fan_find_map(vxlan, daddr);
+	if (!f_map)
+		return -EINVAL;
+
+	daddr = ntohl(daddr);
+	underlay = ntohl(f_map->underlay);
+	if (!underlay)
+		return -EINVAL;
+
+	memset(fan_rdst, 0, sizeof(*fan_rdst));
+	va = &fan_rdst->remote_ip;
+	va->sa.sa_family = AF_INET;
+	fan_rdst->remote_vni = vxlan->default_dst.remote_vni;
+	va->sin.sin_addr.s_addr = htonl(underlay |
+					((daddr & ~f_map->overlay_mask) >>
+					 (32 - f_map->overlay_prefix -
+					  (32 - f_map->underlay_prefix))));
+	netdev_dbg(vxlan->dev, "vfbr: daddr %x ul %x dst %x\n",
+		   daddr, underlay, va->sin.sin_addr.s_addr);
+
+	return 0;
+}
+
 /* Find VXLAN socket based on network namespace, address family, UDP port,
  * enabled unshareable flags and socket device binding (see l3mdev with
  * non-default VRF).
@@ -1446,6 +1608,10 @@
 	struct vxlan_fdb *f;
 	u32 ifindex = 0;
 
+	/* Ignore packets from invalid src-address */
+	if (!is_valid_ether_addr(src_mac))
+		return true;
+
 #if IS_ENABLED(CONFIG_IPV6)
 	if (src_ip->sa.sa_family == AF_INET6 &&
 	    (ipv6_addr_type(&src_ip->sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL))
@@ -1670,6 +1836,7 @@
 	bool raw_proto = false;
 	void *oiph;
 	__be32 vni = 0;
+	int nh;
 
 	/* Need UDP and VXLAN header to be present */
 	if (!pskb_may_pull(skb, VXLAN_HLEN))
@@ -1758,12 +1925,28 @@
 		skb->pkt_type = PACKET_HOST;
 	}
 
-	oiph = skb_network_header(skb);
+	/* Save offset of outer header relative to skb->head,
+	 * because we are going to reset the network header to the inner header
+	 * and might change skb->head.
+	 */
+	nh = skb_network_header(skb) - skb->head;
+
 	skb_reset_network_header(skb);
 
+	if (!pskb_inet_may_pull(skb)) {
+		DEV_STATS_INC(vxlan->dev, rx_length_errors);
+		DEV_STATS_INC(vxlan->dev, rx_errors);
+		vxlan_vnifilter_count(vxlan, vni, vninode,
+				      VXLAN_VNI_STATS_RX_ERRORS, 0);
+		goto drop;
+	}
+
+	/* Get the outer header. */
+	oiph = skb->head + nh;
+
 	if (!vxlan_ecn_decapsulate(vs, oiph, skb)) {
-		++vxlan->dev->stats.rx_frame_errors;
-		++vxlan->dev->stats.rx_errors;
+		DEV_STATS_INC(vxlan->dev, rx_frame_errors);
+		DEV_STATS_INC(vxlan->dev, rx_errors);
 		vxlan_vnifilter_count(vxlan, vni, vninode,
 				      VXLAN_VNI_STATS_RX_ERRORS, 0);
 		goto drop;
@@ -1833,7 +2016,9 @@
 		goto out;
 
 	if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
-		dev->stats.tx_dropped++;
+		dev_core_stats_tx_dropped_inc(dev);
+		vxlan_vnifilter_count(vxlan, vni, NULL,
+				      VXLAN_VNI_STATS_TX_DROPS, 0);
 		goto out;
 	}
 	parp = arp_hdr(skb);
@@ -1889,7 +2074,7 @@
 		reply->pkt_type = PACKET_HOST;
 
 		if (netif_rx(reply) == NET_RX_DROP) {
-			dev->stats.rx_dropped++;
+			dev_core_stats_rx_dropped_inc(dev);
 			vxlan_vnifilter_count(vxlan, vni, NULL,
 					      VXLAN_VNI_STATS_RX_DROPS, 0);
 		}
@@ -2048,7 +2233,7 @@
 			goto out;
 
 		if (netif_rx(reply) == NET_RX_DROP) {
-			dev->stats.rx_dropped++;
+			dev_core_stats_rx_dropped_inc(dev);
 			vxlan_vnifilter_count(vxlan, vni, NULL,
 					      VXLAN_VNI_STATS_RX_DROPS, 0);
 		}
@@ -2259,7 +2444,7 @@
 				      len);
 	} else {
 drop:
-		dev->stats.rx_dropped++;
+		dev_core_stats_rx_dropped_inc(dev);
 		vxlan_vnifilter_count(dst_vxlan, vni, NULL,
 				      VXLAN_VNI_STATS_RX_DROPS, 0);
 	}
@@ -2291,7 +2476,7 @@
 					   addr_family, dst_port,
 					   vxlan->cfg.flags);
 		if (!dst_vxlan) {
-			dev->stats.tx_errors++;
+			DEV_STATS_INC(dev, tx_errors);
 			vxlan_vnifilter_count(vxlan, vni, NULL,
 					      VXLAN_VNI_STATS_TX_ERRORS, 0);
 			kfree_skb(skb);
@@ -2313,7 +2498,7 @@
 	struct ip_tunnel_key *pkey;
 	struct ip_tunnel_key key;
 	struct vxlan_dev *vxlan = netdev_priv(dev);
-	const struct iphdr *old_iph = ip_hdr(skb);
+	const struct iphdr *old_iph;
 	struct vxlan_metadata _md;
 	struct vxlan_metadata *md = &_md;
 	unsigned int pkt_len = skb->len;
@@ -2327,8 +2512,15 @@
 	bool use_cache;
 	bool udp_sum = false;
 	bool xnet = !net_eq(vxlan->net, dev_net(vxlan->dev));
+	bool no_eth_encap;
 	__be32 vni = 0;
 
+	no_eth_encap = flags & VXLAN_F_GPE && skb->protocol != htons(ETH_P_TEB);
+	if (!skb_vlan_inet_prepare(skb, no_eth_encap))
+		goto drop;
+
+	old_iph = ip_hdr(skb);
+
 	info = skb_tunnel_info(skb);
 	use_cache = ip_tunnel_dst_cache_usable(skb, info);
 
@@ -2433,6 +2625,14 @@
 			goto tx_error;
 		}
 
+		if (fan_has_map(&vxlan->fan) && rt->rt_flags & RTCF_LOCAL) {
+			netdev_dbg(dev, "discard fan to localhost %pI4\n",
+				   &rdst->remote_ip.sin.sin_addr.s_addr);
+			rcu_read_unlock();
+			ip_rt_put(rt);
+			goto tx_free;
+		}
+
 		if (!info) {
 			/* Bypass encapsulation if the destination is local */
 			err = encap_bypass_if_local(skb, dev, vxlan, AF_INET,
@@ -2505,7 +2705,7 @@
 		}
 
 		if (!info) {
-			u32 rt6i_flags = ((struct rt6_info *)ndst)->rt6i_flags;
+			u32 rt6i_flags = dst_rt6_info(ndst)->rt6i_flags;
 
 			err = encap_bypass_if_local(skb, dev, vxlan, AF_INET6,
 						    dst_port, ifindex, vni,
@@ -2555,7 +2755,7 @@
 	return;
 
 drop:
-	dev->stats.tx_dropped++;
+	dev_core_stats_tx_dropped_inc(dev);
 	vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX_DROPS, 0);
 	dev_kfree_skb(skb);
 	return;
@@ -2563,12 +2763,13 @@
 tx_error:
 	rcu_read_unlock();
 	if (err == -ELOOP)
-		dev->stats.collisions++;
+		DEV_STATS_INC(dev, collisions);
 	else if (err == -ENETUNREACH)
-		dev->stats.tx_carrier_errors++;
+		DEV_STATS_INC(dev, tx_carrier_errors);
 	dst_release(ndst);
-	dev->stats.tx_errors++;
+	DEV_STATS_INC(dev, tx_errors);
 	vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX_ERRORS, 0);
+tx_free:
 	kfree_skb(skb);
 }
 
@@ -2600,7 +2801,7 @@
 	return;
 
 drop:
-	dev->stats.tx_dropped++;
+	dev_core_stats_tx_dropped_inc(dev);
 	vxlan_vnifilter_count(netdev_priv(dev), vni, NULL,
 			      VXLAN_VNI_STATS_TX_DROPS, 0);
 	dev_kfree_skb(skb);
@@ -2638,7 +2839,7 @@
 	return NETDEV_TX_OK;
 
 drop:
-	dev->stats.tx_dropped++;
+	dev_core_stats_tx_dropped_inc(dev);
 	vxlan_vnifilter_count(netdev_priv(dev), vni, NULL,
 			      VXLAN_VNI_STATS_TX_DROPS, 0);
 	dev_kfree_skb(skb);
@@ -2716,6 +2917,20 @@
 		rcu_read_unlock();
 	}
 
+	if (fan_has_map(&vxlan->fan)) {
+		struct vxlan_rdst fan_rdst;
+
+		netdev_dbg(vxlan->dev, "vxlan_xmit p %x d %pM\n",
+			   eth->h_proto, eth->h_dest);
+		if (vxlan_fan_build_rdst(vxlan, skb, &fan_rdst)) {
+			dev_core_stats_tx_dropped_inc(dev);
+			kfree_skb(skb);
+			return NETDEV_TX_OK;
+		}
+		vxlan_xmit_one(skb, dev, vni, &fan_rdst, 0);
+		return NETDEV_TX_OK;
+	}
+
 	eth = eth_hdr(skb);
 	f = vxlan_find_mac(vxlan, eth->h_dest, vni);
 	did_rsc = false;
@@ -2735,7 +2950,7 @@
 			    !is_multicast_ether_addr(eth->h_dest))
 				vxlan_fdb_miss(vxlan, eth->h_dest);
 
-			dev->stats.tx_dropped++;
+			dev_core_stats_tx_dropped_inc(dev);
 			vxlan_vnifilter_count(vxlan, vni, NULL,
 					      VXLAN_VNI_STATS_TX_DROPS, 0);
 			kfree_skb(skb);
@@ -2855,6 +3070,7 @@
 	if (err)
 		goto err_gro_cells_destroy;
 
+	netdev_lockdep_set_classes(dev);
 	return 0;
 
 err_gro_cells_destroy:
@@ -3325,6 +3541,8 @@
 		spin_lock_init(&vxlan->hash_lock[h]);
 		INIT_HLIST_HEAD(&vxlan->fdb_head[h]);
 	}
+
+	INIT_LIST_HEAD(&vxlan->fan.fan_maps);
 }
 
 static void vxlan_ether_setup(struct net_device *dev)
@@ -3344,6 +3562,22 @@
 	dev->netdev_ops = &vxlan_netdev_raw_ops;
 }
 
+/* Validate Ubuntu FAN payload.
+ *
+ * This is required to bypass the strict length validation enforced for the
+ * attribute types >= IFLA_VXLAN_LOCALBYPASS in vxlan_policy.
+ *
+ * In this way we can continue to use the same allocated ID for
+ * IFLA_VXLAN_FAN_MAP, without breaking the existing user-space and also
+ * future kernel ABIs that may add new attribute types to vxlan_policy.
+ */
+static int fan_map_validate_entry(const struct nlattr *attr,
+				  struct netlink_ext_ack *extack)
+{
+	/* Accept any payload for Ubuntu FAN */
+	return 0;
+}
+
 static const struct nla_policy vxlan_policy[IFLA_VXLAN_MAX + 1] = {
 	[IFLA_VXLAN_UNSPEC]     = { .strict_start_type = IFLA_VXLAN_LOCALBYPASS },
 	[IFLA_VXLAN_ID]		= { .type = NLA_U32 },
@@ -3378,6 +3612,9 @@
 	[IFLA_VXLAN_VNIFILTER]	= { .type = NLA_U8 },
 	[IFLA_VXLAN_LOCALBYPASS]	= NLA_POLICY_MAX(NLA_U8, 1),
 	[IFLA_VXLAN_LABEL_POLICY]       = NLA_POLICY_MAX(NLA_U32, VXLAN_LABEL_MAX),
+	[IFLA_VXLAN_FAN_MAP]		= NLA_POLICY_VALIDATE_FN(NLA_BINARY,
+						fan_map_validate_entry,
+						sizeof(struct ifla_fan_map) * 256),
 };
 
 static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[],
@@ -4055,6 +4292,12 @@
 		conf->remote_ip.sa.sa_family = AF_INET6;
 	}
 
+	if (data[IFLA_VXLAN_FAN_MAP]) {
+		err = vxlan_parse_fan_map(data, vxlan);
+		if (err)
+			return err;
+	}
+
 	if (data[IFLA_VXLAN_LOCAL]) {
 		if (changelink && (conf->saddr.sa.sa_family != AF_INET)) {
 			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL], "New local address family does not match old");
@@ -4440,6 +4683,7 @@
 		nla_total_size(0) + /* IFLA_VXLAN_GPE */
 		nla_total_size(0) + /* IFLA_VXLAN_REMCSUM_NOPARTIAL */
 		nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_VNIFILTER */
+		nla_total_size(sizeof(struct ip_fan_map) * 256) +
 		0;
 }
 
@@ -4486,6 +4730,26 @@
 		}
 	}
 
+	if (fan_has_map(&vxlan->fan)) {
+		struct nlattr *fan_nest;
+		struct ip_fan_map *fan_map;
+
+		fan_nest = nla_nest_start(skb, IFLA_VXLAN_FAN_MAP);
+		if (!fan_nest)
+			goto nla_put_failure;
+		list_for_each_entry_rcu(fan_map, &vxlan->fan.fan_maps, list) {
+			struct ifla_fan_map map;
+
+			map.underlay = fan_map->underlay;
+			map.underlay_prefix = fan_map->underlay_prefix;
+			map.overlay = fan_map->overlay;
+			map.overlay_prefix = fan_map->overlay_prefix;
+			if (nla_put(skb, IFLA_FAN_MAPPING, sizeof(map), &map))
+				goto nla_put_failure;
+		}
+		nla_nest_end(skb, fan_nest);
+	}
+
 	if (nla_put_u8(skb, IFLA_VXLAN_TTL, vxlan->cfg.ttl) ||
 	    nla_put_u8(skb, IFLA_VXLAN_TTL_INHERIT,
 		       !!(vxlan->cfg.flags & VXLAN_F_TTL_INHERIT)) ||
@@ -4826,6 +5090,22 @@
 					 NULL);
 }
 
+#ifdef CONFIG_SYSCTL
+static struct ctl_table_header *vxlan_fan_header;
+static unsigned int vxlan_fan_version = 4;
+
+static struct ctl_table vxlan_fan_sysctls[] = {
+	{
+		.procname	= "vxlan",
+		.data		= &vxlan_fan_version,
+		.maxlen		= sizeof(vxlan_fan_version),
+		.mode		= 0444,
+		.proc_handler	= proc_dointvec,
+	},
+	{},
+};
+#endif /* CONFIG_SYSCTL */
+
 static void vxlan_destroy_tunnels(struct net *net, struct list_head *head)
 {
 	struct vxlan_net *vn = net_generic(net, vxlan_net_id);
@@ -4901,9 +5181,22 @@
 	if (rc)
 		goto out4;
 
-	vxlan_vnifilter_init();
+	rc = vxlan_vnifilter_init();
+	if (rc)
+		goto out5;
+
+#ifdef CONFIG_SYSCTL
+	vxlan_fan_header = register_net_sysctl(&init_net, "net/fan",
+					      vxlan_fan_sysctls);
+	if (!vxlan_fan_header) {
+		rc = -ENOMEM;
+		goto out5;
+	}
+#endif /* CONFIG_SYSCTL */
 
 	return 0;
+out5:
+	rtnl_link_unregister(&vxlan_link_ops);
 out4:
 	unregister_switchdev_notifier(&vxlan_switchdev_notifier_block);
 out3:
@@ -4917,6 +5210,9 @@
 
 static void __exit vxlan_cleanup_module(void)
 {
+#ifdef CONFIG_SYSCTL
+	unregister_net_sysctl_table(vxlan_fan_header);
+#endif /* CONFIG_SYSCTL */
 	vxlan_vnifilter_uninit();
 	rtnl_link_unregister(&vxlan_link_ops);
 	unregister_switchdev_notifier(&vxlan_switchdev_notifier_block);
--- linux-qcom-6.8.0.orig/drivers/net/vxlan/vxlan_private.h
+++ linux-qcom-6.8.0/drivers/net/vxlan/vxlan_private.h
@@ -202,7 +202,7 @@
 int vxlan_vnigroup_init(struct vxlan_dev *vxlan);
 void vxlan_vnigroup_uninit(struct vxlan_dev *vxlan);
 
-void vxlan_vnifilter_init(void);
+int vxlan_vnifilter_init(void);
 void vxlan_vnifilter_uninit(void);
 void vxlan_vnifilter_count(struct vxlan_dev *vxlan, __be32 vni,
 			   struct vxlan_vni_node *vninode,
--- linux-qcom-6.8.0.orig/drivers/net/vxlan/vxlan_vnifilter.c
+++ linux-qcom-6.8.0/drivers/net/vxlan/vxlan_vnifilter.c
@@ -992,19 +992,18 @@
 	return err;
 }
 
-void vxlan_vnifilter_init(void)
+static const struct rtnl_msg_handler vxlan_vnifilter_rtnl_msg_handlers[] = {
+	{THIS_MODULE, PF_BRIDGE, RTM_GETTUNNEL, NULL, vxlan_vnifilter_dump, 0},
+	{THIS_MODULE, PF_BRIDGE, RTM_NEWTUNNEL, vxlan_vnifilter_process, NULL, 0},
+	{THIS_MODULE, PF_BRIDGE, RTM_DELTUNNEL, vxlan_vnifilter_process, NULL, 0},
+};
+
+int vxlan_vnifilter_init(void)
 {
-	rtnl_register_module(THIS_MODULE, PF_BRIDGE, RTM_GETTUNNEL, NULL,
-			     vxlan_vnifilter_dump, 0);
-	rtnl_register_module(THIS_MODULE, PF_BRIDGE, RTM_NEWTUNNEL,
-			     vxlan_vnifilter_process, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_BRIDGE, RTM_DELTUNNEL,
-			     vxlan_vnifilter_process, NULL, 0);
+	return rtnl_register_many(vxlan_vnifilter_rtnl_msg_handlers);
 }
 
 void vxlan_vnifilter_uninit(void)
 {
-	rtnl_unregister(PF_BRIDGE, RTM_GETTUNNEL);
-	rtnl_unregister(PF_BRIDGE, RTM_NEWTUNNEL);
-	rtnl_unregister(PF_BRIDGE, RTM_DELTUNNEL);
+	rtnl_unregister_many(vxlan_vnifilter_rtnl_msg_handlers);
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireguard/allowedips.c
+++ linux-qcom-6.8.0/drivers/net/wireguard/allowedips.c
@@ -15,8 +15,8 @@
 	if (bits == 32) {
 		*(u32 *)dst = be32_to_cpu(*(const __be32 *)src);
 	} else if (bits == 128) {
-		((u64 *)dst)[0] = be64_to_cpu(((const __be64 *)src)[0]);
-		((u64 *)dst)[1] = be64_to_cpu(((const __be64 *)src)[1]);
+		((u64 *)dst)[0] = get_unaligned_be64(src);
+		((u64 *)dst)[1] = get_unaligned_be64(src + 8);
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wireguard/netlink.c
+++ linux-qcom-6.8.0/drivers/net/wireguard/netlink.c
@@ -164,8 +164,8 @@
 	if (!allowedips_node)
 		goto no_allowedips;
 	if (!ctx->allowedips_seq)
-		ctx->allowedips_seq = peer->device->peer_allowedips.seq;
-	else if (ctx->allowedips_seq != peer->device->peer_allowedips.seq)
+		ctx->allowedips_seq = ctx->wg->peer_allowedips.seq;
+	else if (ctx->allowedips_seq != ctx->wg->peer_allowedips.seq)
 		goto no_allowedips;
 
 	allowedips_nest = nla_nest_start(skb, WGPEER_A_ALLOWEDIPS);
@@ -255,17 +255,17 @@
 	if (!peers_nest)
 		goto out;
 	ret = 0;
-	/* If the last cursor was removed via list_del_init in peer_remove, then
+	lockdep_assert_held(&wg->device_update_lock);
+	/* If the last cursor was removed in peer_remove or peer_remove_all, then
 	 * we just treat this the same as there being no more peers left. The
 	 * reason is that seq_nr should indicate to userspace that this isn't a
 	 * coherent dump anyway, so they'll try again.
 	 */
 	if (list_empty(&wg->peer_list) ||
-	    (ctx->next_peer && list_empty(&ctx->next_peer->peer_list))) {
+	    (ctx->next_peer && ctx->next_peer->is_dead)) {
 		nla_nest_cancel(skb, peers_nest);
 		goto out;
 	}
-	lockdep_assert_held(&wg->device_update_lock);
 	peer = list_prepare_entry(ctx->next_peer, &wg->peer_list, peer_list);
 	list_for_each_entry_continue(peer, &wg->peer_list, peer_list) {
 		if (get_peer(peer, skb, ctx)) {
--- linux-qcom-6.8.0.orig/drivers/net/wireguard/queueing.h
+++ linux-qcom-6.8.0/drivers/net/wireguard/queueing.h
@@ -124,10 +124,10 @@
  */
 static inline int wg_cpumask_next_online(int *last_cpu)
 {
-	int cpu = cpumask_next(*last_cpu, cpu_online_mask);
+	int cpu = cpumask_next(READ_ONCE(*last_cpu), cpu_online_mask);
 	if (cpu >= nr_cpu_ids)
 		cpu = cpumask_first(cpu_online_mask);
-	*last_cpu = cpu;
+	WRITE_ONCE(*last_cpu, cpu);
 	return cpu;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wireguard/receive.c
+++ linux-qcom-6.8.0/drivers/net/wireguard/receive.c
@@ -251,7 +251,7 @@
 
 	if (unlikely(!READ_ONCE(keypair->receiving.is_valid) ||
 		  wg_birthdate_has_expired(keypair->receiving.birthdate, REJECT_AFTER_TIME) ||
-		  keypair->receiving_counter.counter >= REJECT_AFTER_MESSAGES)) {
+		  READ_ONCE(keypair->receiving_counter.counter) >= REJECT_AFTER_MESSAGES)) {
 		WRITE_ONCE(keypair->receiving.is_valid, false);
 		return false;
 	}
@@ -318,7 +318,7 @@
 		for (i = 1; i <= top; ++i)
 			counter->backtrack[(i + index_current) &
 				((COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1)] = 0;
-		counter->counter = their_counter;
+		WRITE_ONCE(counter->counter, their_counter);
 	}
 
 	index &= (COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1;
@@ -463,7 +463,7 @@
 			net_dbg_ratelimited("%s: Packet has invalid nonce %llu (max %llu)\n",
 					    peer->device->dev->name,
 					    PACKET_CB(skb)->nonce,
-					    keypair->receiving_counter.counter);
+					    READ_ONCE(keypair->receiving_counter.counter));
 			goto next;
 		}
 
--- linux-qcom-6.8.0.orig/drivers/net/wireguard/send.c
+++ linux-qcom-6.8.0/drivers/net/wireguard/send.c
@@ -222,7 +222,7 @@
 {
 	struct sk_buff *skb;
 
-	if (skb_queue_empty(&peer->staged_packet_queue)) {
+	if (skb_queue_empty_lockless(&peer->staged_packet_queue)) {
 		skb = alloc_skb(DATA_PACKET_HEAD_ROOM + MESSAGE_MINIMUM_LENGTH,
 				GFP_ATOMIC);
 		if (unlikely(!skb))
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ar5523/ar5523.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -1590,6 +1590,20 @@
 	struct ar5523 *ar;
 	int error = -ENOMEM;
 
+	static const u8 bulk_ep_addr[] = {
+		AR5523_CMD_TX_PIPE | USB_DIR_OUT,
+		AR5523_DATA_TX_PIPE | USB_DIR_OUT,
+		AR5523_CMD_RX_PIPE | USB_DIR_IN,
+		AR5523_DATA_RX_PIPE | USB_DIR_IN,
+		0};
+
+	if (!usb_check_bulk_endpoints(intf, bulk_ep_addr)) {
+		dev_err(&dev->dev,
+			"Could not find all expected endpoints\n");
+		error = -ENODEV;
+		goto out;
+	}
+
 	/*
 	 * Load firmware if the device requires it.  This will return
 	 * -ENXIO on success and we'll get called back afer the usb
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath.h
@@ -171,8 +171,10 @@
 	unsigned int clockrate;
 
 	spinlock_t cc_lock;
-	struct ath_cycle_counters cc_ani;
-	struct ath_cycle_counters cc_survey;
+	struct_group(cc,
+		struct ath_cycle_counters cc_ani;
+		struct ath_cycle_counters cc_survey;
+	);
 
 	struct ath_regulatory regulatory;
 	struct ath_regulatory reg_world_copy;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath10k/Kconfig
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath10k/Kconfig
@@ -45,6 +45,7 @@
 	depends on ATH10K
 	depends on ARCH_QCOM || COMPILE_TEST
 	depends on QCOM_SMEM
+	depends on QCOM_RPROC_COMMON || QCOM_RPROC_COMMON=n
 	select QCOM_SCM
 	select QCOM_QMI_HELPERS
 	help
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath10k/core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath10k/core.c
@@ -720,6 +720,9 @@
 		.max_spatial_stream = 4,
 		.fw = {
 			.dir = WCN3990_HW_1_0_FW_DIR,
+			.board = WCN3990_HW_1_0_BOARD_DATA_FILE,
+			.board_size = WCN3990_BOARD_DATA_SZ,
+			.board_ext_size = WCN3990_BOARD_EXT_DATA_SZ,
 		},
 		.sw_decrypt_mcast_mgmt = true,
 		.rx_desc_ops = &wcn3990_rx_desc_ops,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath10k/debugfs_sta.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath10k/debugfs_sta.c
@@ -439,7 +439,7 @@
 	}
 out:
 	mutex_unlock(&ar->conf_mutex);
-	return count;
+	return ret ?: count;
 }
 
 static const struct file_operations fops_peer_debug_trigger = {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath10k/hw.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath10k/hw.h
@@ -133,6 +133,7 @@
 /* WCN3990 1.0 definitions */
 #define WCN3990_HW_1_0_DEV_VERSION	ATH10K_HW_WCN3990
 #define WCN3990_HW_1_0_FW_DIR		ATH10K_FW_DIR "/WCN3990/hw1.0"
+#define WCN3990_HW_1_0_BOARD_DATA_FILE "board.bin"
 
 #define ATH10K_FW_FILE_BASE		"firmware"
 #define ATH10K_FW_API_MAX		6
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath10k/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath10k/mac.c
@@ -9120,7 +9120,7 @@
 	{6,  {2633, 2925}, {1215, 1350}, {585,  650} },
 	{7,  {2925, 3250}, {1350, 1500}, {650,  722} },
 	{8,  {3510, 3900}, {1620, 1800}, {780,  867} },
-	{9,  {3900, 4333}, {1800, 2000}, {780,  867} }
+	{9,  {3900, 4333}, {1800, 2000}, {865,  960} }
 };
 
 /*MCS parameters with Nss = 2 */
@@ -9135,7 +9135,7 @@
 	{6,  {5265, 5850}, {2430, 2700}, {1170, 1300} },
 	{7,  {5850, 6500}, {2700, 3000}, {1300, 1444} },
 	{8,  {7020, 7800}, {3240, 3600}, {1560, 1733} },
-	{9,  {7800, 8667}, {3600, 4000}, {1560, 1733} }
+	{9,  {7800, 8667}, {3600, 4000}, {1730, 1920} }
 };
 
 static void ath10k_mac_get_rate_flags_ht(struct ath10k *ar, u32 rate, u8 nss, u8 mcs,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath10k/sdio.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath10k/sdio.c
@@ -3,7 +3,7 @@
  * Copyright (c) 2004-2011 Atheros Communications Inc.
  * Copyright (c) 2011-2012,2017 Qualcomm Atheros, Inc.
  * Copyright (c) 2016-2017 Erik Stromdahl <erik.stromdahl@gmail.com>
- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/module.h>
@@ -2648,9 +2648,9 @@
 
 	netif_napi_del(&ar->napi);
 
-	ath10k_core_destroy(ar);
-
 	destroy_workqueue(ar_sdio->workqueue);
+
+	ath10k_core_destroy(ar);
 }
 
 static const struct sdio_device_id ath10k_sdio_devices[] = {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath10k/targaddrs.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath10k/targaddrs.h
@@ -491,4 +491,7 @@
 #define QCA4019_BOARD_DATA_SZ	  12064
 #define QCA4019_BOARD_EXT_DATA_SZ 0
 
+#define WCN3990_BOARD_DATA_SZ	  26328
+#define WCN3990_BOARD_EXT_DATA_SZ 0
+
 #endif /* __TARGADDRS_H__ */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -851,6 +851,10 @@
 	}
 
 	ev = tb[WMI_TLV_TAG_STRUCT_MGMT_TX_COMPL_EVENT];
+	if (!ev) {
+		kfree(tb);
+		return -EPROTO;
+	}
 
 	arg->desc_id = ev->desc_id;
 	arg->status = ev->status;
@@ -3038,9 +3042,14 @@
 				       struct sk_buff *msdu)
 {
 	struct ath10k_skb_cb *cb = ATH10K_SKB_CB(msdu);
+	struct ath10k_mgmt_tx_pkt_addr *pkt_addr;
 	struct ath10k_wmi *wmi = &ar->wmi;
 
-	idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id);
+	spin_lock_bh(&ar->data_lock);
+	pkt_addr = idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id);
+	spin_unlock_bh(&ar->data_lock);
+
+	kfree(pkt_addr);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath10k/wmi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1763,12 +1763,32 @@
 
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
 {
-	unsigned long time_left;
+	unsigned long time_left, i;
 
 	time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
 						WMI_SERVICE_READY_TIMEOUT_HZ);
-	if (!time_left)
-		return -ETIMEDOUT;
+	if (!time_left) {
+		/* Sometimes the PCI HIF doesn't receive interrupt
+		 * for the service ready message even if the buffer
+		 * was completed. PCIe sniffer shows that it's
+		 * because the corresponding CE ring doesn't fires
+		 * it. Workaround here by polling CE rings once.
+		 */
+		ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+
+		for (i = 0; i < CE_COUNT; i++)
+			ath10k_hif_send_complete_check(ar, i, 1);
+
+		time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+							WMI_SERVICE_READY_TIMEOUT_HZ);
+		if (!time_left) {
+			ath10k_warn(ar, "polling timed out\n");
+			return -ETIMEDOUT;
+		}
+
+		ath10k_warn(ar, "service ready completion received, continuing normally\n");
+	}
+
 	return 0;
 }
 
@@ -2421,6 +2441,7 @@
 	dma_unmap_single(ar->dev, pkt_addr->paddr,
 			 msdu->len, DMA_TO_DEVICE);
 	info = IEEE80211_SKB_CB(msdu);
+	kfree(pkt_addr);
 
 	if (param->status) {
 		info->flags &= ~IEEE80211_TX_STAT_ACK;
@@ -9540,6 +9561,7 @@
 	dma_unmap_single(ar->dev, pkt_addr->paddr,
 			 msdu->len, DMA_TO_DEVICE);
 	ieee80211_free_txskb(ar->hw, msdu);
+	kfree(pkt_addr);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/Kconfig
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/Kconfig
@@ -57,3 +57,14 @@
 	  Enable ath11k spectral scan support
 
 	  Say Y to enable access to the FFT/spectral data via debugfs.
+
+config ATH11K_COREDUMP
+	bool "ath11k coredump"
+	depends on ATH11K
+	select WANT_DEV_COREDUMP
+	help
+	  Enable ath11k coredump collection
+
+	  If unsure, say Y to make it easier to debug problems. But if
+	  dump collection not required choose N.
+
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/Makefile
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/Makefile
@@ -26,6 +26,7 @@
 ath11k-$(CONFIG_THERMAL) += thermal.o
 ath11k-$(CONFIG_ATH11K_SPECTRAL) += spectral.o
 ath11k-$(CONFIG_PM) += wow.o
+ath11k-$(CONFIG_ATH11K_COREDUMP) += coredump.o
 
 obj-$(CONFIG_ATH11K_AHB) += ath11k_ahb.o
 ath11k_ahb-y += ahb.o
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/ce.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/ce.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause-Clear */
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef ATH11K_CE_H
@@ -146,7 +146,7 @@
 	/* Host address space */
 	void *base_addr_owner_space_unaligned;
 	/* CE address space */
-	u32 base_addr_ce_space_unaligned;
+	dma_addr_t base_addr_ce_space_unaligned;
 
 	/* Actual start of descriptors.
 	 * Aligned to descriptor-size boundary.
@@ -156,7 +156,7 @@
 	void *base_addr_owner_space;
 
 	/* CE address space */
-	u32 base_addr_ce_space;
+	dma_addr_t base_addr_ce_space;
 
 	/* HAL ring id */
 	u32 hal_ring_id;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/core.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/module.h>
@@ -62,7 +62,7 @@
 		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = false,
 		.rxdma1_enable = true,
-		.num_rxmda_per_pdev = 1,
+		.num_rxdma_per_pdev = 1,
 		.rx_mac_buf_ring = false,
 		.vdev_start_delay = false,
 		.htt_peer_map_v2 = true,
@@ -122,6 +122,8 @@
 		.tcl_ring_retry = true,
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
+		.support_dual_stations = false,
+		.pdev_suspend = false,
 	},
 	{
 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
@@ -147,7 +149,7 @@
 		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = false,
 		.rxdma1_enable = true,
-		.num_rxmda_per_pdev = 1,
+		.num_rxdma_per_pdev = 1,
 		.rx_mac_buf_ring = false,
 		.vdev_start_delay = false,
 		.htt_peer_map_v2 = true,
@@ -205,6 +207,8 @@
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = false,
+		.support_dual_stations = false,
+		.pdev_suspend = false,
 	},
 	{
 		.name = "qca6390 hw2.0",
@@ -230,7 +234,7 @@
 		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = true,
 		.rxdma1_enable = false,
-		.num_rxmda_per_pdev = 2,
+		.num_rxdma_per_pdev = 2,
 		.rx_mac_buf_ring = true,
 		.vdev_start_delay = true,
 		.htt_peer_map_v2 = false,
@@ -255,7 +259,7 @@
 		.coldboot_cal_ftm = false,
 		.cbcal_restart_fw = false,
 		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
+		.num_vdevs = 2 + 1,
 		.num_peers = 512,
 		.supports_suspend = true,
 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
@@ -290,6 +294,8 @@
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = true,
+		.support_dual_stations = true,
+		.pdev_suspend = false,
 	},
 	{
 		.name = "qcn9074 hw1.0",
@@ -314,7 +320,7 @@
 		.svc_to_ce_map_len = 18,
 		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.rxdma1_enable = true,
-		.num_rxmda_per_pdev = 1,
+		.num_rxdma_per_pdev = 1,
 		.rx_mac_buf_ring = false,
 		.vdev_start_delay = false,
 		.htt_peer_map_v2 = true,
@@ -372,6 +378,8 @@
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = false,
+		.support_dual_stations = false,
+		.pdev_suspend = false,
 	},
 	{
 		.name = "wcn6855 hw2.0",
@@ -397,7 +405,7 @@
 		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = true,
 		.rxdma1_enable = false,
-		.num_rxmda_per_pdev = 2,
+		.num_rxdma_per_pdev = 2,
 		.rx_mac_buf_ring = true,
 		.vdev_start_delay = true,
 		.htt_peer_map_v2 = false,
@@ -422,7 +430,7 @@
 		.coldboot_cal_ftm = false,
 		.cbcal_restart_fw = false,
 		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
+		.num_vdevs = 2 + 1,
 		.num_peers = 512,
 		.supports_suspend = true,
 		.hal_desc_sz = sizeof(struct hal_rx_desc_wcn6855),
@@ -457,6 +465,8 @@
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = true,
+		.support_dual_stations = true,
+		.pdev_suspend = false,
 	},
 	{
 		.name = "wcn6855 hw2.1",
@@ -481,7 +491,7 @@
 		.svc_to_ce_map_len = 14,
 		.single_pdev_only = true,
 		.rxdma1_enable = false,
-		.num_rxmda_per_pdev = 2,
+		.num_rxdma_per_pdev = 2,
 		.rx_mac_buf_ring = true,
 		.vdev_start_delay = true,
 		.htt_peer_map_v2 = false,
@@ -505,7 +515,7 @@
 		.coldboot_cal_ftm = false,
 		.cbcal_restart_fw = false,
 		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
+		.num_vdevs = 2 + 1,
 		.num_peers = 512,
 		.supports_suspend = true,
 		.hal_desc_sz = sizeof(struct hal_rx_desc_wcn6855),
@@ -540,6 +550,8 @@
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = true,
+		.support_dual_stations = true,
+		.pdev_suspend = false,
 	},
 	{
 		.name = "wcn6750 hw1.0",
@@ -565,7 +577,7 @@
 		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = true,
 		.rxdma1_enable = false,
-		.num_rxmda_per_pdev = 1,
+		.num_rxdma_per_pdev = 1,
 		.rx_mac_buf_ring = true,
 		.vdev_start_delay = true,
 		.htt_peer_map_v2 = false,
@@ -589,7 +601,7 @@
 		.coldboot_cal_ftm = true,
 		.cbcal_restart_fw = false,
 		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
+		.num_vdevs = 3,
 		.num_peers = 512,
 		.supports_suspend = false,
 		.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9074),
@@ -601,7 +613,7 @@
 		.supports_dynamic_smps_6ghz = false,
 		.alloc_cacheable_memory = false,
 		.supports_rssi_stats = true,
-		.fw_wmi_diag_event = false,
+		.fw_wmi_diag_event = true,
 		.current_cc_support = true,
 		.dbr_debug_support = false,
 		.global_reset = false,
@@ -621,6 +633,8 @@
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
 		.smp2p_wow_exit = true,
 		.support_fw_mac_sequence = true,
+		.support_dual_stations = false,
+		.pdev_suspend = true,
 	},
 	{
 		.hw_rev = ATH11K_HW_IPQ5018_HW10,
@@ -657,7 +671,7 @@
 		.ce_ie_addr = &ath11k_ce_ie_addr_ipq5018,
 		.ce_remap = &ath11k_ce_remap_ipq5018,
 		.rxdma1_enable = true,
-		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
+		.num_rxdma_per_pdev = RXDMA_PER_PDEV_5018,
 		.rx_mac_buf_ring = false,
 		.vdev_start_delay = false,
 		.htt_peer_map_v2 = true,
@@ -702,6 +716,183 @@
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = false,
+		.support_dual_stations = false,
+		.pdev_suspend = false,
+	},
+	{
+		.name = "qca2066 hw2.1",
+		.hw_rev = ATH11K_HW_QCA2066_HW21,
+		.fw = {
+			.dir = "QCA2066/hw2.1",
+			.board_size = 256 * 1024,
+			.cal_offset = 128 * 1024,
+		},
+		.max_radios = 3,
+		.bdf_addr = 0x4B0C0000,
+		.hw_ops = &wcn6855_ops,
+		.ring_mask = &ath11k_hw_ring_mask_qca6390,
+		.internal_sleep_clock = true,
+		.regs = &wcn6855_regs,
+		.qmi_service_ins_id = ATH11K_QMI_WLFW_SERVICE_INS_ID_V01_QCA6390,
+		.host_ce_config = ath11k_host_ce_config_qca6390,
+		.ce_count = 9,
+		.target_ce_config = ath11k_target_ce_config_wlan_qca6390,
+		.target_ce_count = 9,
+		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
+		.svc_to_ce_map_len = 14,
+		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+		.single_pdev_only = true,
+		.rxdma1_enable = false,
+		.num_rxdma_per_pdev = 2,
+		.rx_mac_buf_ring = true,
+		.vdev_start_delay = true,
+		.htt_peer_map_v2 = false,
+
+		.spectral = {
+			.fft_sz = 0,
+			.fft_pad_sz = 0,
+			.summary_pad_sz = 0,
+			.fft_hdr_len = 0,
+			.max_fft_bins = 0,
+			.fragment_160mhz = false,
+		},
+
+		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+					BIT(NL80211_IFTYPE_AP),
+		.supports_monitor = false,
+		.full_monitor_mode = false,
+		.supports_shadow_regs = true,
+		.idle_ps = true,
+		.supports_sta_ps = true,
+		.coldboot_cal_mm = false,
+		.coldboot_cal_ftm = false,
+		.cbcal_restart_fw = false,
+		.fw_mem_mode = 0,
+		.num_vdevs = 2 + 1,
+		.num_peers = 512,
+		.supports_suspend = true,
+		.hal_desc_sz = sizeof(struct hal_rx_desc_wcn6855),
+		.supports_regdb = true,
+		.fix_l1ss = false,
+		.credit_flow = true,
+		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
+		.hal_params = &ath11k_hw_hal_params_qca6390,
+		.supports_dynamic_smps_6ghz = false,
+		.alloc_cacheable_memory = false,
+		.supports_rssi_stats = true,
+		.fw_wmi_diag_event = true,
+		.current_cc_support = true,
+		.dbr_debug_support = false,
+		.global_reset = true,
+		.bios_sar_capa = &ath11k_hw_sar_capa_wcn6855,
+		.m3_fw_support = true,
+		.fixed_bdf_addr = false,
+		.fixed_mem_region = false,
+		.static_window_map = false,
+		.hybrid_bus_type = false,
+		.fixed_fw_mem = false,
+		.support_off_channel_tx = true,
+		.supports_multi_bssid = true,
+
+		.sram_dump = {
+			.start = 0x01400000,
+			.end = 0x0177ffff,
+		},
+
+		.tcl_ring_retry = true,
+		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+		.smp2p_wow_exit = false,
+		.support_fw_mac_sequence = true,
+		.support_dual_stations = true,
+		.pdev_suspend = false,
+	},
+	{
+		.name = "qca6698aq hw2.1",
+		.hw_rev = ATH11K_HW_QCA6698AQ_HW21,
+		.fw = {
+			.dir = "QCA6698AQ/hw2.1",
+			.board_size = 256 * 1024,
+			.cal_offset = 128 * 1024,
+		},
+		.max_radios = 3,
+		.bdf_addr = 0x4B0C0000,
+		.hw_ops = &wcn6855_ops,
+		.ring_mask = &ath11k_hw_ring_mask_qca6390,
+		.internal_sleep_clock = true,
+		.regs = &wcn6855_regs,
+		.qmi_service_ins_id = ATH11K_QMI_WLFW_SERVICE_INS_ID_V01_QCA6390,
+		.host_ce_config = ath11k_host_ce_config_qca6390,
+		.ce_count = 9,
+		.target_ce_config = ath11k_target_ce_config_wlan_qca6390,
+		.target_ce_count = 9,
+		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
+		.svc_to_ce_map_len = 14,
+		.single_pdev_only = true,
+		.rxdma1_enable = false,
+		.num_rxdma_per_pdev = 2,
+		.rx_mac_buf_ring = true,
+		.vdev_start_delay = true,
+		.htt_peer_map_v2 = false,
+
+		.spectral = {
+			.fft_sz = 0,
+			.fft_pad_sz = 0,
+			.summary_pad_sz = 0,
+			.fft_hdr_len = 0,
+			.max_fft_bins = 0,
+			.fragment_160mhz = false,
+		},
+
+		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+					BIT(NL80211_IFTYPE_AP) |
+					BIT(NL80211_IFTYPE_P2P_DEVICE) |
+					BIT(NL80211_IFTYPE_P2P_CLIENT) |
+					BIT(NL80211_IFTYPE_P2P_GO),
+		.supports_monitor = false,
+		.supports_shadow_regs = true,
+		.idle_ps = true,
+		.supports_sta_ps = true,
+		.coldboot_cal_mm = false,
+		.coldboot_cal_ftm = false,
+		.cbcal_restart_fw = false,
+		.fw_mem_mode = 0,
+		.num_vdevs = 2 + 1,
+		.num_peers = 512,
+		.supports_suspend = true,
+		.hal_desc_sz = sizeof(struct hal_rx_desc_wcn6855),
+		.supports_regdb = true,
+		.fix_l1ss = false,
+		.credit_flow = true,
+		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
+		.hal_params = &ath11k_hw_hal_params_qca6390,
+		.supports_dynamic_smps_6ghz = false,
+		.alloc_cacheable_memory = false,
+		.supports_rssi_stats = true,
+		.fw_wmi_diag_event = true,
+		.current_cc_support = true,
+		.dbr_debug_support = false,
+		.global_reset = true,
+		.bios_sar_capa = &ath11k_hw_sar_capa_wcn6855,
+		.m3_fw_support = true,
+		.fixed_bdf_addr = false,
+		.fixed_mem_region = false,
+		.static_window_map = false,
+		.hybrid_bus_type = false,
+		.fixed_fw_mem = false,
+		.support_off_channel_tx = true,
+		.supports_multi_bssid = true,
+
+		.sram_dump = {
+			.start = 0x01400000,
+			.end = 0x0177ffff,
+		},
+
+		.tcl_ring_retry = true,
+		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+		.smp2p_wow_exit = false,
+		.support_fw_mac_sequence = true,
+		.support_dual_stations = true,
+		.pdev_suspend = false,
 	},
 };
 
@@ -1563,11 +1754,47 @@
 	return ret;
 }
 
+static void ath11k_core_pdev_suspend_target(struct ath11k_base *ab)
+{
+	struct ath11k *ar;
+	struct ath11k_pdev *pdev;
+	unsigned long time_left;
+	int ret;
+	int i;
+
+	if (!ab->hw_params.pdev_suspend)
+		return;
+
+	for (i = 0; i < ab->num_radios; i++) {
+		pdev = &ab->pdevs[i];
+		ar = pdev->ar;
+
+		reinit_completion(&ab->htc_suspend);
+
+		ret = ath11k_wmi_pdev_suspend(ar, WMI_PDEV_SUSPEND_AND_DISABLE_INTR,
+					      pdev->pdev_id);
+		if (ret) {
+			ath11k_warn(ab, "could not suspend target :%d\n", ret);
+			/* pointless to try other pdevs */
+			return;
+		}
+
+		time_left = wait_for_completion_timeout(&ab->htc_suspend, 3 * HZ);
+
+		if (!time_left) {
+			ath11k_warn(ab, "suspend timed out - target pause event never came\n");
+			/* pointless to try other pdevs */
+			return;
+		}
+	}
+}
+
 static void ath11k_core_pdev_destroy(struct ath11k_base *ab)
 {
 	ath11k_spectral_deinit(ab);
 	ath11k_thermal_unregister(ab);
 	ath11k_mac_unregister(ab);
+	ath11k_core_pdev_suspend_target(ab);
 	ath11k_hif_irq_disable(ab);
 	ath11k_dp_pdev_free(ab);
 	ath11k_debugfs_pdev_destroy(ab);
@@ -1655,7 +1882,7 @@
 	}
 
 	/* put hardware to DBS mode */
-	if (ab->hw_params.single_pdev_only && ab->hw_params.num_rxmda_per_pdev > 1) {
+	if (ab->hw_params.single_pdev_only && ab->hw_params.num_rxdma_per_pdev > 1) {
 		ret = ath11k_wmi_set_hw_mode(ab, WMI_HOST_HW_MODE_DBS);
 		if (ret) {
 			ath11k_err(ab, "failed to send dbs mode: %d\n", ret);
@@ -1833,23 +2060,20 @@
 	struct ath11k_base *ab = container_of(work, struct ath11k_base, update_11d_work);
 	struct ath11k *ar;
 	struct ath11k_pdev *pdev;
-	struct wmi_set_current_country_params set_current_param = {};
 	int ret, i;
 
-	spin_lock_bh(&ab->base_lock);
-	memcpy(&set_current_param.alpha2, &ab->new_alpha2, 2);
-	spin_unlock_bh(&ab->base_lock);
-
-	ath11k_dbg(ab, ATH11K_DBG_WMI, "update 11d new cc %c%c\n",
-		   set_current_param.alpha2[0],
-		   set_current_param.alpha2[1]);
-
 	for (i = 0; i < ab->num_radios; i++) {
 		pdev = &ab->pdevs[i];
 		ar = pdev->ar;
 
-		memcpy(&ar->alpha2, &set_current_param.alpha2, 2);
-		ret = ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param);
+		spin_lock_bh(&ab->base_lock);
+		memcpy(&ar->alpha2, &ab->new_alpha2, 2);
+		spin_unlock_bh(&ab->base_lock);
+
+		ath11k_dbg(ab, ATH11K_DBG_WMI, "update 11d new cc %c%c for pdev %d\n",
+			   ar->alpha2[0], ar->alpha2[1], i);
+
+		ret = ath11k_reg_set_cc(ar);
 		if (ret)
 			ath11k_warn(ar->ab,
 				    "pdev id %d failed set current country code: %d\n",
@@ -2023,6 +2247,7 @@
 	reinit_completion(&ab->recovery_start);
 	atomic_set(&ab->recovery_start_count, 0);
 
+	ath11k_coredump_collect(ab);
 	ath11k_core_pre_reconfigure_recovery(ab);
 
 	reinit_completion(&ab->reconfigure_complete);
@@ -2156,6 +2381,7 @@
 	INIT_WORK(&ab->restart_work, ath11k_core_restart);
 	INIT_WORK(&ab->update_11d_work, ath11k_update_11d);
 	INIT_WORK(&ab->reset_work, ath11k_core_reset);
+	INIT_WORK(&ab->dump_work, ath11k_coredump_upload);
 	timer_setup(&ab->rx_replenish_retry, ath11k_ce_rx_replenish_retry, 0);
 	init_completion(&ab->htc_suspend);
 	init_completion(&ab->wow.wakeup_completed);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/core.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/core.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause-Clear */
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef ATH11K_CORE_H
@@ -32,6 +32,7 @@
 #include "spectral.h"
 #include "wow.h"
 #include "fw.h"
+#include "coredump.h"
 
 #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
 
@@ -147,6 +148,8 @@
 	ATH11K_HW_WCN6855_HW21,
 	ATH11K_HW_WCN6750_HW10,
 	ATH11K_HW_IPQ5018_HW10,
+	ATH11K_HW_QCA2066_HW21,
+	ATH11K_HW_QCA6698AQ_HW21,
 };
 
 enum ath11k_firmware_mode {
@@ -331,6 +334,7 @@
 
 	u16 tx_seq_no;
 	struct wmi_wmm_params_all_arg wmm_params;
+	struct wmi_wmm_params_all_arg muedca_params;
 	struct list_head list;
 	union {
 		struct {
@@ -358,6 +362,7 @@
 	u8 bssid[ETH_ALEN];
 	struct cfg80211_bitrate_mask bitrate_mask;
 	struct delayed_work connection_loss_work;
+	struct work_struct bcn_tx_work;
 	int num_legacy_stations;
 	int rtscts_prot_mode;
 	int txpower;
@@ -851,6 +856,10 @@
 	/* HW channel counters frequency value in hertz common to all MACs */
 	u32 cc_freq_hz;
 
+	struct ath11k_dump_file_data *dump_data;
+	size_t ath11k_coredump_len;
+	struct work_struct dump_work;
+
 	struct ath11k_htc htc;
 
 	struct ath11k_dp dp;
@@ -918,6 +927,7 @@
 	 * This may or may not be used during the runtime
 	 */
 	struct ieee80211_regdomain *new_regd[MAX_RADIOS];
+	struct cur_regulatory_info *reg_info_store;
 
 	/* Current DFS Regulatory */
 	enum ath11k_dfs_region dfs_region;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/coredump.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/coredump.c
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: BSD-3-Clause-Clear
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/devcoredump.h>
+#include "hif.h"
+#include "coredump.h"
+#include "debug.h"
+
+enum
+ath11k_fw_crash_dump_type ath11k_coredump_get_dump_type(int type)
+{
+	enum ath11k_fw_crash_dump_type dump_type;
+
+	switch (type) {
+	case HOST_DDR_REGION_TYPE:
+		dump_type = FW_CRASH_DUMP_REMOTE_MEM_DATA;
+		break;
+	case M3_DUMP_REGION_TYPE:
+		dump_type = FW_CRASH_DUMP_M3_DUMP;
+		break;
+	case PAGEABLE_MEM_REGION_TYPE:
+		dump_type = FW_CRASH_DUMP_PAGEABLE_DATA;
+		break;
+	case BDF_MEM_REGION_TYPE:
+	case CALDB_MEM_REGION_TYPE:
+		dump_type = FW_CRASH_DUMP_NONE;
+		break;
+	default:
+		dump_type = FW_CRASH_DUMP_TYPE_MAX;
+		break;
+	}
+
+	return dump_type;
+}
+EXPORT_SYMBOL_GPL(ath11k_coredump_get_dump_type);
+
+void ath11k_coredump_upload(struct work_struct *work)
+{
+	struct ath11k_base *ab = container_of(work, struct ath11k_base, dump_work);
+
+	ath11k_info(ab, "Uploading coredump\n");
+	/* dev_coredumpv() takes ownership of the buffer */
+	dev_coredumpv(ab->dev, ab->dump_data, ab->ath11k_coredump_len, GFP_KERNEL);
+	ab->dump_data = NULL;
+}
+
+void ath11k_coredump_collect(struct ath11k_base *ab)
+{
+	ath11k_hif_coredump_download(ab);
+}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/coredump.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/coredump.h
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: BSD-3-Clause-Clear */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _ATH11K_COREDUMP_H_
+#define _ATH11K_COREDUMP_H_
+
+#define ATH11K_FW_CRASH_DUMP_V2      2
+
+enum ath11k_fw_crash_dump_type {
+	FW_CRASH_DUMP_PAGING_DATA,
+	FW_CRASH_DUMP_RDDM_DATA,
+	FW_CRASH_DUMP_REMOTE_MEM_DATA,
+	FW_CRASH_DUMP_PAGEABLE_DATA,
+	FW_CRASH_DUMP_M3_DUMP,
+	FW_CRASH_DUMP_NONE,
+
+	/* keep last */
+	FW_CRASH_DUMP_TYPE_MAX,
+};
+
+#define COREDUMP_TLV_HDR_SIZE 8
+
+struct ath11k_tlv_dump_data {
+	/* see ath11k_fw_crash_dump_type above */
+	__le32 type;
+
+	/* in bytes */
+	__le32 tlv_len;
+
+	/* pad to 32-bit boundaries as needed */
+	u8 tlv_data[];
+} __packed;
+
+struct ath11k_dump_file_data {
+	/* "ATH11K-FW-DUMP" */
+	char df_magic[16];
+	/* total dump len in bytes */
+	__le32 len;
+	/* file dump version */
+	__le32 version;
+	/* pci device id */
+	__le32 chip_id;
+	/* qrtr instance id */
+	__le32 qrtr_id;
+	/* pci domain id */
+	__le32 bus_id;
+	guid_t guid;
+	/* time-of-day stamp */
+	__le64 tv_sec;
+	/* time-of-day stamp, nano-seconds */
+	__le64 tv_nsec;
+	/* room for growth w/out changing binary format */
+	u8 unused[128];
+	u8 data[];
+} __packed;
+
+#ifdef CONFIG_ATH11K_COREDUMP
+enum ath11k_fw_crash_dump_type ath11k_coredump_get_dump_type(int type);
+void ath11k_coredump_upload(struct work_struct *work);
+void ath11k_coredump_collect(struct ath11k_base *ab);
+#else
+static inline enum
+ath11k_fw_crash_dump_type ath11k_coredump_get_dump_type(int type)
+{
+	return FW_CRASH_DUMP_TYPE_MAX;
+}
+
+static inline void ath11k_coredump_upload(struct work_struct *work)
+{
+}
+
+static inline void ath11k_coredump_collect(struct ath11k_base *ab)
+{
+}
+#endif
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/debugfs.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/debugfs.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2020 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/vmalloc.h>
@@ -668,7 +668,7 @@
 
 	ar->debug.rx_filter = tlv_filter.rx_filter;
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, ar->dp.mac_id,
 						       HAL_RXDMA_MONITOR_STATUS,
@@ -980,7 +980,7 @@
 	debugfs_create_file("simulate_fw_crash", 0600, ab->debugfs_soc, ab,
 			    &fops_simulate_fw_crash);
 
-	debugfs_create_file("soc_dp_stats", 0600, ab->debugfs_soc, ab,
+	debugfs_create_file("soc_dp_stats", 0400, ab->debugfs_soc, ab,
 			    &fops_soc_dp_stats);
 
 	if (ab->hw_params.sram_dump.start != 0)
@@ -1112,7 +1112,7 @@
 	}
 
 	/* Clear rx filter set for monitor mode and rx status */
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, ar->dp.mac_id,
 						       HAL_RXDMA_MONITOR_STATUS,
@@ -1171,7 +1171,7 @@
 					       HTT_RX_FP_DATA_FILTER_FLASG3;
 	}
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 		ret = ath11k_dp_tx_htt_rx_filter_setup(ab, ring_id,
 						       ar->dp.mac_id + i,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/dp.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/dp.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <crypto/hash.h>
@@ -816,8 +816,8 @@
 
 	if (ab->hw_params.ring_mask->rx_mon_status[grp_id]) {
 		for (i = 0; i < ab->num_radios; i++) {
-			for (j = 0; j < ab->hw_params.num_rxmda_per_pdev; j++) {
-				int id = i * ab->hw_params.num_rxmda_per_pdev + j;
+			for (j = 0; j < ab->hw_params.num_rxdma_per_pdev; j++) {
+				int id = i * ab->hw_params.num_rxdma_per_pdev + j;
 
 				if (ab->hw_params.ring_mask->rx_mon_status[grp_id] &
 					BIT(id)) {
@@ -839,8 +839,8 @@
 		ath11k_dp_process_reo_status(ab);
 
 	for (i = 0; i < ab->num_radios; i++) {
-		for (j = 0; j < ab->hw_params.num_rxmda_per_pdev; j++) {
-			int id = i * ab->hw_params.num_rxmda_per_pdev + j;
+		for (j = 0; j < ab->hw_params.num_rxdma_per_pdev; j++) {
+			int id = i * ab->hw_params.num_rxdma_per_pdev + j;
 
 			if (ab->hw_params.ring_mask->rxdma2host[grp_id] & BIT(id)) {
 				work_done = ath11k_dp_process_rxdma_err(ab, id, budget);
@@ -899,7 +899,7 @@
 		spin_lock_init(&dp->rx_refill_buf_ring.idr_lock);
 		atomic_set(&dp->num_tx_pending, 0);
 		init_waitqueue_head(&dp->tx_empty_waitq);
-		for (j = 0; j < ab->hw_params.num_rxmda_per_pdev; j++) {
+		for (j = 0; j < ab->hw_params.num_rxdma_per_pdev; j++) {
 			idr_init(&dp->rx_mon_status_refill_ring[j].bufs_idr);
 			spin_lock_init(&dp->rx_mon_status_refill_ring[j].idr_lock);
 		}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/ieee80211.h>
@@ -311,7 +311,7 @@
 	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
 	int i;
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++)
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++)
 		ath11k_dp_rx_process_mon_rings(ab, i, NULL, DP_MON_SERVICE_BUDGET);
 
 	mod_timer(&ab->mon_reap_timer, jiffies +
@@ -324,7 +324,7 @@
 	unsigned long timeout = jiffies + msecs_to_jiffies(DP_MON_PURGE_TIMEOUT_MS);
 
 	do {
-		for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++)
+		for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++)
 			reaped += ath11k_dp_rx_process_mon_rings(ab, i,
 								 NULL,
 								 DP_MON_SERVICE_BUDGET);
@@ -468,7 +468,7 @@
 	rx_ring = &dp->rxdma_mon_buf_ring;
 	ath11k_dp_rxdma_buf_ring_free(ar, rx_ring);
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		rx_ring = &dp->rx_mon_status_refill_ring[i];
 		ath11k_dp_rxdma_buf_ring_free(ar, rx_ring);
 	}
@@ -506,7 +506,7 @@
 		ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_MONITOR_BUF);
 	}
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		rx_ring = &dp->rx_mon_status_refill_ring[i];
 		ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_MONITOR_STATUS);
 	}
@@ -522,7 +522,7 @@
 
 	ath11k_dp_srng_cleanup(ab, &dp->rx_refill_buf_ring.refill_buf_ring);
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		if (ab->hw_params.rx_mac_buf_ring)
 			ath11k_dp_srng_cleanup(ab, &dp->rx_mac_buf_ring[i]);
 
@@ -585,7 +585,7 @@
 	}
 
 	if (ar->ab->hw_params.rx_mac_buf_ring) {
-		for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+		for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 			ret = ath11k_dp_srng_setup(ar->ab,
 						   &dp->rx_mac_buf_ring[i],
 						   HAL_RXDMA_BUF, 1,
@@ -598,7 +598,7 @@
 		}
 	}
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		ret = ath11k_dp_srng_setup(ar->ab, &dp->rxdma_err_dst_ring[i],
 					   HAL_RXDMA_DST, 0, dp->mac_id + i,
 					   DP_RXDMA_ERR_DST_RING_SIZE);
@@ -608,7 +608,7 @@
 		}
 	}
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		srng = &dp->rx_mon_status_refill_ring[i].refill_buf_ring;
 		ret = ath11k_dp_srng_setup(ar->ab,
 					   srng,
@@ -1877,8 +1877,7 @@
 			  CHECKSUM_NONE : CHECKSUM_UNNECESSARY;
 }
 
-static int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar,
-				       enum hal_encrypt_type enctype)
+int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar, enum hal_encrypt_type enctype)
 {
 	switch (enctype) {
 	case HAL_ENCRYPT_TYPE_OPEN:
@@ -2698,7 +2697,7 @@
 		if (unlikely(push_reason !=
 			     HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION)) {
 			dev_kfree_skb_any(msdu);
-			ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++;
+			ab->soc_stats.hal_reo_error[ring_id]++;
 			continue;
 		}
 
@@ -3809,6 +3808,7 @@
 		ath11k_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus, msdu_cookies,
 						 &rbm);
 		if (rbm != HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST &&
+		    rbm != HAL_RX_BUF_RBM_SW1_BM &&
 		    rbm != HAL_RX_BUF_RBM_SW3_BM) {
 			ab->soc_stats.invalid_rbm++;
 			ath11k_warn(ab, "invalid return buffer manager %d\n", rbm);
@@ -4391,7 +4391,7 @@
 	}
 
 	if (ab->hw_params.rx_mac_buf_ring) {
-		for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+		for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 			ring_id = dp->rx_mac_buf_ring[i].ring_id;
 			ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id,
 							  mac_id + i, HAL_RXDMA_BUF);
@@ -4403,7 +4403,7 @@
 		}
 	}
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		ring_id = dp->rxdma_err_dst_ring[i].ring_id;
 		ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id,
 						  mac_id + i, HAL_RXDMA_DST);
@@ -4443,7 +4443,7 @@
 	}
 
 config_refill_ring:
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		ring_id = dp->rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 		ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id, mac_id + i,
 						  HAL_RXDMA_MONITOR_STATUS);
@@ -5228,8 +5228,11 @@
 		    hal_status == HAL_TLV_STATUS_PPDU_DONE) {
 			rx_mon_stats->status_ppdu_done++;
 			pmon->mon_ppdu_status = DP_PPDU_STATUS_DONE;
-			ath11k_dp_rx_mon_dest_process(ar, mac_id, budget, napi);
-			pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
+			if (!ab->hw_params.full_monitor_mode) {
+				ath11k_dp_rx_mon_dest_process(ar, mac_id,
+							      budget, napi);
+				pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
+			}
 		}
 
 		if (ppdu_info->peer_id == HAL_INVALID_PEERID ||
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/dp_rx.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/dp_rx.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause-Clear */
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #ifndef ATH11K_DP_RX_H
 #define ATH11K_DP_RX_H
@@ -95,4 +96,6 @@
 int ath11k_dp_rx_pktlog_start(struct ath11k_base *ab);
 int ath11k_dp_rx_pktlog_stop(struct ath11k_base *ab, bool stop_timer);
 
+int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar, enum hal_encrypt_type enctype);
+
 #endif /* ATH11K_DP_RX_H */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/dp_tx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/dp_tx.c
@@ -1035,7 +1035,7 @@
 	int ret;
 	int i;
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		skb = ath11k_htc_alloc_skb(ab, len);
 		if (!skb)
 			return -ENOMEM;
@@ -1218,7 +1218,7 @@
 						       &tlv_filter);
 	} else if (!reset) {
 		/* set in monitor mode only */
-		for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+		for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 			ring_id = dp->rx_mac_buf_ring[i].ring_id;
 			ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
 							       dp->mac_id + i,
@@ -1231,7 +1231,7 @@
 	if (ret)
 		return ret;
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		ring_id = dp->rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 		if (!reset) {
 			tlv_filter.rx_filter =
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/hal.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/hal.c
@@ -1322,6 +1322,7 @@
 	ath11k_hal_free_cont_rdp(ab);
 	ath11k_hal_free_cont_wrp(ab);
 	kfree(hal->srng_config);
+	hal->srng_config = NULL;
 }
 EXPORT_SYMBOL(ath11k_hal_srng_deinit);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/hal_rx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/hal_rx.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include "debug.h"
@@ -372,7 +372,8 @@
 
 	ret_buf_mgr = FIELD_GET(BUFFER_ADDR_INFO1_RET_BUF_MGR,
 				wbm_desc->buf_addr_info.info1);
-	if (ret_buf_mgr != HAL_RX_BUF_RBM_SW3_BM) {
+	if (ret_buf_mgr != HAL_RX_BUF_RBM_SW1_BM &&
+	    ret_buf_mgr != HAL_RX_BUF_RBM_SW3_BM) {
 		ab->soc_stats.invalid_rbm++;
 		return -EINVAL;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/hif.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/hif.h
@@ -31,6 +31,7 @@
 	void (*ce_irq_enable)(struct ath11k_base *ab);
 	void (*ce_irq_disable)(struct ath11k_base *ab);
 	void (*get_ce_msi_idx)(struct ath11k_base *ab, u32 ce_id, u32 *msi_idx);
+	void (*coredump_download)(struct ath11k_base *ab);
 };
 
 static inline void ath11k_hif_ce_irq_enable(struct ath11k_base *ab)
@@ -146,4 +147,10 @@
 		*msi_data_idx = ce_id;
 }
 
+static inline void ath11k_hif_coredump_download(struct ath11k_base *ab)
+{
+	if (ab->hif.ops->coredump_download)
+		ab->hif.ops->coredump_download(ab);
+}
+
 #endif /* _HIF_H_ */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/hw.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/hw.c
@@ -58,7 +58,7 @@
 static void ath11k_init_wmi_config_qca6390(struct ath11k_base *ab,
 					   struct target_resource_config *config)
 {
-	config->num_vdevs = 4;
+	config->num_vdevs = ab->hw_params.num_vdevs;
 	config->num_peers = 16;
 	config->num_tids = 32;
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/hw.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/hw.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause-Clear */
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef ATH11K_HW_H
@@ -167,7 +167,7 @@
 	bool single_pdev_only;
 
 	bool rxdma1_enable;
-	int num_rxmda_per_pdev;
+	int num_rxdma_per_pdev;
 	bool rx_mac_buf_ring;
 	bool vdev_start_delay;
 	bool htt_peer_map_v2;
@@ -226,6 +226,8 @@
 	u32 tx_ring_size;
 	bool smp2p_wow_exit;
 	bool support_fw_mac_sequence;
+	bool support_dual_stations;
+	bool pdev_suspend;
 };
 
 struct ath11k_hw_ops {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/mac.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <net/mac80211.h>
@@ -255,9 +255,6 @@
 	[WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE,
 };
 
-static int ath11k_start_vdev_delay(struct ieee80211_hw *hw,
-				   struct ieee80211_vif *vif);
-
 enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy)
 {
 	enum nl80211_he_ru_alloc ret;
@@ -1234,14 +1231,7 @@
 
 	enable_ps = arvif->ps;
 
-	if (!arvif->is_started) {
-		/* mac80211 can update vif powersave state while disconnected.
-		 * Firmware doesn't behave nicely and consumes more power than
-		 * necessary if PS is disabled on a non-started vdev. Hence
-		 * force-enable PS for non-running vdevs.
-		 */
-		psmode = WMI_STA_PS_MODE_ENABLED;
-	} else if (enable_ps) {
+	if (enable_ps) {
 		psmode = WMI_STA_PS_MODE_ENABLED;
 		param = WMI_STA_PS_PARAM_INACTIVITY_TIME;
 
@@ -2297,6 +2287,8 @@
 	mcs_160_map = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_160);
 	mcs_80_map = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_80);
 
+	/* Initialize rx_mcs_160 to 9 which is an invalid value */
+	rx_mcs_160 = 9;
 	if (support_160) {
 		for (i = 7; i >= 0; i--) {
 			u8 mcs_160 = (mcs_160_map >> (2 * i)) & 3;
@@ -2308,6 +2300,8 @@
 		}
 	}
 
+	/* Initialize rx_mcs_80 to 9 which is an invalid value */
+	rx_mcs_80 = 9;
 	for (i = 7; i >= 0; i--) {
 		u8 mcs_80 = (mcs_80_map >> (2 * i)) & 3;
 
@@ -3026,7 +3020,14 @@
 
 	rcu_read_unlock();
 
+	if (!ath11k_mac_vif_recalc_sta_he_txbf(ar, vif, &he_cap)) {
+		ath11k_warn(ar->ab, "failed to recalc he txbf for vdev %i on bss %pM\n",
+			    arvif->vdev_id, bss_conf->bssid);
+		return;
+	}
+
 	peer_arg.is_assoc = true;
+
 	ret = ath11k_wmi_send_peer_assoc_cmd(ar, &peer_arg);
 	if (ret) {
 		ath11k_warn(ar->ab, "failed to run peer assoc for %pM vdev %i: %d\n",
@@ -3049,12 +3050,6 @@
 		return;
 	}
 
-	if (!ath11k_mac_vif_recalc_sta_he_txbf(ar, vif, &he_cap)) {
-		ath11k_warn(ar->ab, "failed to recalc he txbf for vdev %i on bss %pM\n",
-			    arvif->vdev_id, bss_conf->bssid);
-		return;
-	}
-
 	WARN_ON(arvif->is_up);
 
 	arvif->aid = vif->cfg.aid;
@@ -4133,6 +4128,7 @@
 
 	switch (key->cipher) {
 	case WLAN_CIPHER_SUITE_CCMP:
+	case WLAN_CIPHER_SUITE_CCMP_256:
 		arg.key_cipher = WMI_CIPHER_AES_CCM;
 		/* TODO: Re-check if flag is valid */
 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT;
@@ -4142,12 +4138,10 @@
 		arg.key_txmic_len = 8;
 		arg.key_rxmic_len = 8;
 		break;
-	case WLAN_CIPHER_SUITE_CCMP_256:
-		arg.key_cipher = WMI_CIPHER_AES_CCM;
-		break;
 	case WLAN_CIPHER_SUITE_GCMP:
 	case WLAN_CIPHER_SUITE_GCMP_256:
 		arg.key_cipher = WMI_CIPHER_AES_GCM;
+		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT;
 		break;
 	default:
 		ath11k_warn(ar->ab, "cipher %d is not supported\n", key->cipher);
@@ -4906,100 +4900,6 @@
 	ar->num_stations--;
 }
 
-static int ath11k_mac_station_add(struct ath11k *ar,
-				  struct ieee80211_vif *vif,
-				  struct ieee80211_sta *sta)
-{
-	struct ath11k_base *ab = ar->ab;
-	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
-	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
-	struct peer_create_params peer_param;
-	int ret;
-
-	lockdep_assert_held(&ar->conf_mutex);
-
-	ret = ath11k_mac_inc_num_stations(arvif, sta);
-	if (ret) {
-		ath11k_warn(ab, "refusing to associate station: too many connected already (%d)\n",
-			    ar->max_num_stations);
-		goto exit;
-	}
-
-	arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL);
-	if (!arsta->rx_stats) {
-		ret = -ENOMEM;
-		goto dec_num_station;
-	}
-
-	peer_param.vdev_id = arvif->vdev_id;
-	peer_param.peer_addr = sta->addr;
-	peer_param.peer_type = WMI_PEER_TYPE_DEFAULT;
-
-	ret = ath11k_peer_create(ar, arvif, sta, &peer_param);
-	if (ret) {
-		ath11k_warn(ab, "Failed to add peer: %pM for VDEV: %d\n",
-			    sta->addr, arvif->vdev_id);
-		goto free_rx_stats;
-	}
-
-	ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n",
-		   sta->addr, arvif->vdev_id);
-
-	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
-		arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL);
-		if (!arsta->tx_stats) {
-			ret = -ENOMEM;
-			goto free_peer;
-		}
-	}
-
-	if (ieee80211_vif_is_mesh(vif)) {
-		ath11k_dbg(ab, ATH11K_DBG_MAC,
-			   "setting USE_4ADDR for mesh STA %pM\n", sta->addr);
-		ret = ath11k_wmi_set_peer_param(ar, sta->addr,
-						arvif->vdev_id,
-						WMI_PEER_USE_4ADDR, 1);
-		if (ret) {
-			ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n",
-				    sta->addr, ret);
-			goto free_tx_stats;
-		}
-	}
-
-	ret = ath11k_dp_peer_setup(ar, arvif->vdev_id, sta->addr);
-	if (ret) {
-		ath11k_warn(ab, "failed to setup dp for peer %pM on vdev %i (%d)\n",
-			    sta->addr, arvif->vdev_id, ret);
-		goto free_tx_stats;
-	}
-
-	if (ab->hw_params.vdev_start_delay &&
-	    !arvif->is_started &&
-	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
-		ret = ath11k_start_vdev_delay(ar->hw, vif);
-		if (ret) {
-			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
-			goto free_tx_stats;
-		}
-	}
-
-	ewma_avg_rssi_init(&arsta->avg_rssi);
-	return 0;
-
-free_tx_stats:
-	kfree(arsta->tx_stats);
-	arsta->tx_stats = NULL;
-free_peer:
-	ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
-free_rx_stats:
-	kfree(arsta->rx_stats);
-	arsta->rx_stats = NULL;
-dec_num_station:
-	ath11k_mac_dec_num_stations(arvif, sta);
-exit:
-	return ret;
-}
-
 static u32 ath11k_mac_ieee80211_sta_bw_to_wmi(struct ath11k *ar,
 					      struct ieee80211_sta *sta)
 {
@@ -5028,140 +4928,6 @@
 	return bw;
 }
 
-static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
-				   struct ieee80211_vif *vif,
-				   struct ieee80211_sta *sta,
-				   enum ieee80211_sta_state old_state,
-				   enum ieee80211_sta_state new_state)
-{
-	struct ath11k *ar = hw->priv;
-	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
-	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
-	struct ath11k_peer *peer;
-	int ret = 0;
-
-	/* cancel must be done outside the mutex to avoid deadlock */
-	if ((old_state == IEEE80211_STA_NONE &&
-	     new_state == IEEE80211_STA_NOTEXIST)) {
-		cancel_work_sync(&arsta->update_wk);
-		cancel_work_sync(&arsta->set_4addr_wk);
-	}
-
-	mutex_lock(&ar->conf_mutex);
-
-	if (old_state == IEEE80211_STA_NOTEXIST &&
-	    new_state == IEEE80211_STA_NONE) {
-		memset(arsta, 0, sizeof(*arsta));
-		arsta->arvif = arvif;
-		arsta->peer_ps_state = WMI_PEER_PS_STATE_DISABLED;
-		INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk);
-		INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk);
-
-		ret = ath11k_mac_station_add(ar, vif, sta);
-		if (ret)
-			ath11k_warn(ar->ab, "Failed to add station: %pM for VDEV: %d\n",
-				    sta->addr, arvif->vdev_id);
-	} else if ((old_state == IEEE80211_STA_NONE &&
-		    new_state == IEEE80211_STA_NOTEXIST)) {
-		bool skip_peer_delete = ar->ab->hw_params.vdev_start_delay &&
-			vif->type == NL80211_IFTYPE_STATION;
-
-		ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
-
-		if (!skip_peer_delete) {
-			ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
-			if (ret)
-				ath11k_warn(ar->ab,
-					    "Failed to delete peer: %pM for VDEV: %d\n",
-					    sta->addr, arvif->vdev_id);
-			else
-				ath11k_dbg(ar->ab,
-					   ATH11K_DBG_MAC,
-					   "Removed peer: %pM for VDEV: %d\n",
-					   sta->addr, arvif->vdev_id);
-		}
-
-		ath11k_mac_dec_num_stations(arvif, sta);
-		mutex_lock(&ar->ab->tbl_mtx_lock);
-		spin_lock_bh(&ar->ab->base_lock);
-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
-		if (skip_peer_delete && peer) {
-			peer->sta = NULL;
-		} else if (peer && peer->sta == sta) {
-			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
-				    vif->addr, arvif->vdev_id);
-			ath11k_peer_rhash_delete(ar->ab, peer);
-			peer->sta = NULL;
-			list_del(&peer->list);
-			kfree(peer);
-			ar->num_peers--;
-		}
-		spin_unlock_bh(&ar->ab->base_lock);
-		mutex_unlock(&ar->ab->tbl_mtx_lock);
-
-		kfree(arsta->tx_stats);
-		arsta->tx_stats = NULL;
-
-		kfree(arsta->rx_stats);
-		arsta->rx_stats = NULL;
-	} else if (old_state == IEEE80211_STA_AUTH &&
-		   new_state == IEEE80211_STA_ASSOC &&
-		   (vif->type == NL80211_IFTYPE_AP ||
-		    vif->type == NL80211_IFTYPE_MESH_POINT ||
-		    vif->type == NL80211_IFTYPE_ADHOC)) {
-		ret = ath11k_station_assoc(ar, vif, sta, false);
-		if (ret)
-			ath11k_warn(ar->ab, "Failed to associate station: %pM\n",
-				    sta->addr);
-
-		spin_lock_bh(&ar->data_lock);
-		/* Set arsta bw and prev bw */
-		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
-		arsta->bw_prev = arsta->bw;
-		spin_unlock_bh(&ar->data_lock);
-	} else if (old_state == IEEE80211_STA_ASSOC &&
-		   new_state == IEEE80211_STA_AUTHORIZED) {
-		spin_lock_bh(&ar->ab->base_lock);
-
-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
-		if (peer)
-			peer->is_authorized = true;
-
-		spin_unlock_bh(&ar->ab->base_lock);
-
-		if (vif->type == NL80211_IFTYPE_STATION && arvif->is_up) {
-			ret = ath11k_wmi_set_peer_param(ar, sta->addr,
-							arvif->vdev_id,
-							WMI_PEER_AUTHORIZE,
-							1);
-			if (ret)
-				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
-					    sta->addr, arvif->vdev_id, ret);
-		}
-	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
-		   new_state == IEEE80211_STA_ASSOC) {
-		spin_lock_bh(&ar->ab->base_lock);
-
-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
-		if (peer)
-			peer->is_authorized = false;
-
-		spin_unlock_bh(&ar->ab->base_lock);
-	} else if (old_state == IEEE80211_STA_ASSOC &&
-		   new_state == IEEE80211_STA_AUTH &&
-		   (vif->type == NL80211_IFTYPE_AP ||
-		    vif->type == NL80211_IFTYPE_MESH_POINT ||
-		    vif->type == NL80211_IFTYPE_ADHOC)) {
-		ret = ath11k_station_disassoc(ar, vif, sta);
-		if (ret)
-			ath11k_warn(ar->ab, "Failed to disassociate station: %pM\n",
-				    sta->addr);
-	}
-
-	mutex_unlock(&ar->conf_mutex);
-	return ret;
-}
-
 static int ath11k_mac_op_sta_set_txpwr(struct ieee80211_hw *hw,
 				       struct ieee80211_vif *vif,
 				       struct ieee80211_sta *sta)
@@ -5338,6 +5104,51 @@
 	return ret;
 }
 
+static int ath11k_mac_op_conf_tx_mu_edca(struct ieee80211_hw *hw,
+					 struct ieee80211_vif *vif,
+					 unsigned int link_id, u16 ac,
+					 const struct ieee80211_tx_queue_params *params)
+{
+	struct ath11k *ar = hw->priv;
+	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+	struct wmi_wmm_params_arg *p = NULL;
+	int ret;
+
+	switch (ac) {
+	case IEEE80211_AC_VO:
+		p = &arvif->muedca_params.ac_vo;
+		break;
+	case IEEE80211_AC_VI:
+		p = &arvif->muedca_params.ac_vi;
+		break;
+	case IEEE80211_AC_BE:
+		p = &arvif->muedca_params.ac_be;
+		break;
+	case IEEE80211_AC_BK:
+		p = &arvif->muedca_params.ac_bk;
+		break;
+	}
+
+	if (WARN_ON(!p)) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	p->cwmin = params->mu_edca_param_rec.ecw_min_max & 0x0f;
+	p->cwmax = (params->mu_edca_param_rec.ecw_min_max & 0xf0) >> 4;
+	p->aifs = params->mu_edca_param_rec.aifsn & 0x0f;
+	p->txop = params->mu_edca_param_rec.mu_edca_timer;
+
+	ret = ath11k_wmi_send_wmm_update_cmd_tlv(ar, arvif->vdev_id,
+						 &arvif->muedca_params,
+						 WMM_PARAM_TYPE_11AX_MU_EDCA);
+	if (ret)
+		ath11k_warn(ar->ab, "failed to set mu_edca params: %d\n", ret);
+
+exit:
+	return ret;
+}
+
 static int ath11k_mac_op_conf_tx(struct ieee80211_hw *hw,
 				 struct ieee80211_vif *vif,
 				 unsigned int link_id, u16 ac,
@@ -5376,12 +5187,21 @@
 	p->txop = params->txop;
 
 	ret = ath11k_wmi_send_wmm_update_cmd_tlv(ar, arvif->vdev_id,
-						 &arvif->wmm_params);
+					 &arvif->wmm_params, WMM_PARAM_TYPE_LEGACY);
 	if (ret) {
 		ath11k_warn(ar->ab, "failed to set wmm params: %d\n", ret);
 		goto exit;
 	}
 
+	if (params->mu_edca) {
+		ret = ath11k_mac_op_conf_tx_mu_edca(hw, vif, link_id, ac,
+						    params);
+		if (ret) {
+			ath11k_warn(ar->ab, "failed to set mu_edca params: %d\n", ret);
+			goto exit;
+		}
+	}
+
 	ret = ath11k_conf_tx_uapsd(ar, vif, ac, params->uapsd);
 
 	if (ret)
@@ -5470,8 +5290,6 @@
 	if (vht_cap & (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE)) {
 		nsts = vht_cap & IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
 		nsts >>= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
-		if (nsts > (ar->num_rx_chains - 1))
-			nsts = ar->num_rx_chains - 1;
 		value |= SM(nsts, WMI_TXBF_STS_CAP_OFFSET);
 	}
 
@@ -5555,9 +5373,6 @@
 
 	/* Enable Beamformee STS Field only if SU BF is enabled */
 	if (subfee) {
-		if (nsts > (ar->num_rx_chains - 1))
-			nsts = ar->num_rx_chains - 1;
-
 		nsts <<= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
 		nsts &=  IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
 		*vht_cap |= nsts;
@@ -6035,7 +5850,10 @@
 {
 	struct ath11k_base *ab = ar->ab;
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+	struct ath11k_skb_cb *skb_cb = ATH11K_SKB_CB(skb);
 	struct ieee80211_tx_info *info;
+	enum hal_encrypt_type enctype;
+	unsigned int mic_len;
 	dma_addr_t paddr;
 	int buf_id;
 	int ret;
@@ -6059,7 +5877,12 @@
 		     ieee80211_is_deauth(hdr->frame_control) ||
 		     ieee80211_is_disassoc(hdr->frame_control)) &&
 		     ieee80211_has_protected(hdr->frame_control)) {
-			skb_put(skb, IEEE80211_CCMP_MIC_LEN);
+			if (!(skb_cb->flags & ATH11K_SKB_CIPHER_SET))
+				ath11k_warn(ab, "WMI management tx frame without ATH11K_SKB_CIPHER_SET");
+
+			enctype = ath11k_dp_tx_get_encrypt_type(skb_cb->cipher);
+			mic_len = ath11k_dp_rx_crypto_mic_len(ar, enctype);
+			skb_put(skb, mic_len);
 		}
 	}
 
@@ -6240,7 +6063,7 @@
 			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
 	}
 
-	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
 						       ar->dp.mac_id + i,
@@ -6724,6 +6547,16 @@
 	return ret;
 }
 
+static void ath11k_mac_bcn_tx_work(struct work_struct *work)
+{
+	struct ath11k_vif *arvif = container_of(work, struct ath11k_vif,
+						bcn_tx_work);
+
+	mutex_lock(&arvif->ar->conf_mutex);
+	ath11k_mac_bcn_tx_event(arvif);
+	mutex_unlock(&arvif->ar->conf_mutex);
+}
+
 static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
 				       struct ieee80211_vif *vif)
 {
@@ -6762,6 +6595,7 @@
 	arvif->vif = vif;
 
 	INIT_LIST_HEAD(&arvif->list);
+	INIT_WORK(&arvif->bcn_tx_work, ath11k_mac_bcn_tx_work);
 	INIT_DELAYED_WORK(&arvif->connection_loss_work,
 			  ath11k_mac_vif_sta_connection_loss_work);
 
@@ -6940,6 +6774,14 @@
 				    ret);
 	}
 
+	if (ath11k_wmi_supports_6ghz_cc_ext(ar)) {
+		struct cur_regulatory_info *reg_info;
+
+		reg_info = &ab->reg_info_store[ar->pdev_idx];
+		ath11k_dbg(ab, ATH11K_DBG_MAC, "interface added to change reg rules\n");
+		ath11k_reg_handle_chan_list(ab, reg_info, IEEE80211_REG_LPI_AP);
+	}
+
 	mutex_unlock(&ar->conf_mutex);
 
 	return 0;
@@ -6987,6 +6829,7 @@
 	int i;
 
 	cancel_delayed_work_sync(&arvif->connection_loss_work);
+	cancel_work_sync(&arvif->bcn_tx_work);
 
 	mutex_lock(&ar->conf_mutex);
 
@@ -7542,8 +7385,8 @@
 	mutex_unlock(&ar->conf_mutex);
 }
 
-static int ath11k_start_vdev_delay(struct ieee80211_hw *hw,
-				   struct ieee80211_vif *vif)
+static int ath11k_mac_start_vdev_delay(struct ieee80211_hw *hw,
+				       struct ieee80211_vif *vif)
 {
 	struct ath11k *ar = hw->priv;
 	struct ath11k_base *ab = ar->ab;
@@ -7589,6 +7432,30 @@
 	return 0;
 }
 
+static int ath11k_mac_stop_vdev_early(struct ieee80211_hw *hw,
+				      struct ieee80211_vif *vif)
+{
+	struct ath11k *ar = hw->priv;
+	struct ath11k_base *ab = ar->ab;
+	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+	int ret;
+
+	if (WARN_ON(!arvif->is_started))
+		return -EBUSY;
+
+	ret = ath11k_mac_vdev_stop(arvif);
+	if (ret) {
+		ath11k_warn(ab, "failed to stop vdev %i: %d\n",
+			    arvif->vdev_id, ret);
+		return ret;
+	}
+
+	arvif->is_started = false;
+
+	/* TODO: Setup ps and cts/rts protection */
+	return 0;
+}
+
 static int
 ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
 				 struct ieee80211_vif *vif,
@@ -7599,7 +7466,8 @@
 	struct ath11k_base *ab = ar->ab;
 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
 	int ret;
-	struct peer_create_params param;
+	struct cur_regulatory_info *reg_info;
+	enum ieee80211_ap_reg_power power_type;
 
 	mutex_lock(&ar->conf_mutex);
 
@@ -7607,6 +7475,22 @@
 		   "chanctx assign ptr %p vdev_id %i\n",
 		   ctx, arvif->vdev_id);
 
+	if (ath11k_wmi_supports_6ghz_cc_ext(ar) &&
+	    ctx->def.chan->band == NL80211_BAND_6GHZ &&
+	    arvif->vdev_type == WMI_VDEV_TYPE_STA) {
+		reg_info = &ab->reg_info_store[ar->pdev_idx];
+		power_type = vif->bss_conf.power_type;
+
+		ath11k_dbg(ab, ATH11K_DBG_MAC, "chanctx power type %d\n", power_type);
+
+		if (power_type == IEEE80211_REG_UNSET_AP) {
+			ret = -EINVAL;
+			goto out;
+		}
+
+		ath11k_reg_handle_chan_list(ab, reg_info, power_type);
+	}
+
 	/* for QCA6390 bss peer must be created before vdev_start */
 	if (ab->hw_params.vdev_start_delay &&
 	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
@@ -7622,21 +7506,6 @@
 		goto out;
 	}
 
-	if (ab->hw_params.vdev_start_delay &&
-	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
-	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) {
-		param.vdev_id = arvif->vdev_id;
-		param.peer_type = WMI_PEER_TYPE_DEFAULT;
-		param.peer_addr = ar->mac_addr;
-
-		ret = ath11k_peer_create(ar, arvif, NULL, &param);
-		if (ret) {
-			ath11k_warn(ab, "failed to create peer after vdev start delay: %d",
-				    ret);
-			goto out;
-		}
-	}
-
 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 		ret = ath11k_mac_monitor_start(ar);
 		if (ret) {
@@ -7649,15 +7518,17 @@
 		goto out;
 	}
 
-	ret = ath11k_mac_vdev_start(arvif, ctx);
-	if (ret) {
-		ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
-			    arvif->vdev_id, vif->addr,
-			    ctx->def.chan->center_freq, ret);
-		goto out;
-	}
+	if (!arvif->is_started) {
+		ret = ath11k_mac_vdev_start(arvif, ctx);
+		if (ret) {
+			ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
+				    arvif->vdev_id, vif->addr,
+				    ctx->def.chan->center_freq, ret);
+			goto out;
+		}
 
-	arvif->is_started = true;
+		arvif->is_started = true;
+	}
 
 	if (arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
 	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
@@ -7697,8 +7568,6 @@
 		   "chanctx unassign ptr %p vdev_id %i\n",
 		   ctx, arvif->vdev_id);
 
-	WARN_ON(!arvif->is_started);
-
 	if (ab->hw_params.vdev_start_delay &&
 	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 		spin_lock_bh(&ab->base_lock);
@@ -7722,24 +7591,13 @@
 		return;
 	}
 
-	ret = ath11k_mac_vdev_stop(arvif);
-	if (ret)
-		ath11k_warn(ab, "failed to stop vdev %i: %d\n",
-			    arvif->vdev_id, ret);
-
-	arvif->is_started = false;
-
-	if (ab->hw_params.vdev_start_delay &&
-	    arvif->vdev_type == WMI_VDEV_TYPE_STA) {
-		ret = ath11k_peer_delete(ar, arvif->vdev_id, arvif->bssid);
+	if (arvif->is_started) {
+		ret = ath11k_mac_vdev_stop(arvif);
 		if (ret)
-			ath11k_warn(ar->ab,
-				    "failed to delete peer %pM for vdev %d: %d\n",
-				    arvif->bssid, arvif->vdev_id, ret);
-		else
-			ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
-				   "removed peer %pM  vdev %d after vdev stop\n",
-				   arvif->bssid, arvif->vdev_id);
+			ath11k_warn(ab, "failed to stop vdev %i: %d\n",
+				    arvif->vdev_id, ret);
+
+		arvif->is_started = false;
 	}
 
 	if (ab->hw_params.vdev_start_delay &&
@@ -8482,12 +8340,8 @@
 		ieee80211_wake_queues(ar->hw);
 
 		if (ar->ab->hw_params.current_cc_support &&
-		    ar->alpha2[0] != 0 && ar->alpha2[1] != 0) {
-			struct wmi_set_current_country_params set_current_param = {};
-
-			memcpy(&set_current_param.alpha2, ar->alpha2, 2);
-			ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param);
-		}
+		    ar->alpha2[0] != 0 && ar->alpha2[1] != 0)
+			ath11k_reg_set_cc(ar);
 
 		if (ab->is_reset) {
 			recovery_count = atomic_inc_return(&ab->recovery_count);
@@ -9097,6 +8951,252 @@
 	return 0;
 }
 
+static int ath11k_mac_station_add(struct ath11k *ar,
+				  struct ieee80211_vif *vif,
+				  struct ieee80211_sta *sta)
+{
+	struct ath11k_base *ab = ar->ab;
+	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
+	struct peer_create_params peer_param;
+	int ret;
+
+	lockdep_assert_held(&ar->conf_mutex);
+
+	ret = ath11k_mac_inc_num_stations(arvif, sta);
+	if (ret) {
+		ath11k_warn(ab, "refusing to associate station: too many connected already (%d)\n",
+			    ar->max_num_stations);
+		goto exit;
+	}
+
+	arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL);
+	if (!arsta->rx_stats) {
+		ret = -ENOMEM;
+		goto dec_num_station;
+	}
+
+	peer_param.vdev_id = arvif->vdev_id;
+	peer_param.peer_addr = sta->addr;
+	peer_param.peer_type = WMI_PEER_TYPE_DEFAULT;
+
+	ret = ath11k_peer_create(ar, arvif, sta, &peer_param);
+	if (ret) {
+		ath11k_warn(ab, "Failed to add peer: %pM for VDEV: %d\n",
+			    sta->addr, arvif->vdev_id);
+		goto free_rx_stats;
+	}
+
+	ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n",
+		   sta->addr, arvif->vdev_id);
+
+	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
+		arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL);
+		if (!arsta->tx_stats) {
+			ret = -ENOMEM;
+			goto free_peer;
+		}
+	}
+
+	if (ieee80211_vif_is_mesh(vif)) {
+		ath11k_dbg(ab, ATH11K_DBG_MAC,
+			   "setting USE_4ADDR for mesh STA %pM\n", sta->addr);
+		ret = ath11k_wmi_set_peer_param(ar, sta->addr,
+						arvif->vdev_id,
+						WMI_PEER_USE_4ADDR, 1);
+		if (ret) {
+			ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n",
+				    sta->addr, ret);
+			goto free_tx_stats;
+		}
+	}
+
+	ret = ath11k_dp_peer_setup(ar, arvif->vdev_id, sta->addr);
+	if (ret) {
+		ath11k_warn(ab, "failed to setup dp for peer %pM on vdev %i (%d)\n",
+			    sta->addr, arvif->vdev_id, ret);
+		goto free_tx_stats;
+	}
+
+	if (ab->hw_params.vdev_start_delay &&
+	    !arvif->is_started &&
+	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
+		ret = ath11k_mac_start_vdev_delay(ar->hw, vif);
+		if (ret) {
+			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
+			goto free_tx_stats;
+		}
+	}
+
+	ewma_avg_rssi_init(&arsta->avg_rssi);
+	return 0;
+
+free_tx_stats:
+	kfree(arsta->tx_stats);
+	arsta->tx_stats = NULL;
+free_peer:
+	ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
+free_rx_stats:
+	kfree(arsta->rx_stats);
+	arsta->rx_stats = NULL;
+dec_num_station:
+	ath11k_mac_dec_num_stations(arvif, sta);
+exit:
+	return ret;
+}
+
+static int ath11k_mac_station_remove(struct ath11k *ar,
+				     struct ieee80211_vif *vif,
+				     struct ieee80211_sta *sta)
+{
+	struct ath11k_base *ab = ar->ab;
+	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
+	int ret;
+
+	if (ab->hw_params.vdev_start_delay &&
+	    arvif->is_started &&
+	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
+		ret = ath11k_mac_stop_vdev_early(ar->hw, vif);
+		if (ret) {
+			ath11k_warn(ab, "failed to do early vdev stop: %d\n", ret);
+			return ret;
+		}
+	}
+
+	ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
+
+	ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
+	if (ret)
+		ath11k_warn(ab, "Failed to delete peer: %pM for VDEV: %d\n",
+			    sta->addr, arvif->vdev_id);
+	else
+		ath11k_dbg(ab, ATH11K_DBG_MAC, "Removed peer: %pM for VDEV: %d\n",
+			   sta->addr, arvif->vdev_id);
+
+	ath11k_mac_dec_num_stations(arvif, sta);
+
+	kfree(arsta->tx_stats);
+	arsta->tx_stats = NULL;
+
+	kfree(arsta->rx_stats);
+	arsta->rx_stats = NULL;
+
+	return ret;
+}
+
+static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
+				   struct ieee80211_vif *vif,
+				   struct ieee80211_sta *sta,
+				   enum ieee80211_sta_state old_state,
+				   enum ieee80211_sta_state new_state)
+{
+	struct ath11k *ar = hw->priv;
+	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
+	struct ath11k_peer *peer;
+	int ret = 0;
+
+	/* cancel must be done outside the mutex to avoid deadlock */
+	if ((old_state == IEEE80211_STA_NONE &&
+	     new_state == IEEE80211_STA_NOTEXIST)) {
+		cancel_work_sync(&arsta->update_wk);
+		cancel_work_sync(&arsta->set_4addr_wk);
+	}
+
+	mutex_lock(&ar->conf_mutex);
+
+	if (old_state == IEEE80211_STA_NOTEXIST &&
+	    new_state == IEEE80211_STA_NONE) {
+		memset(arsta, 0, sizeof(*arsta));
+		arsta->arvif = arvif;
+		arsta->peer_ps_state = WMI_PEER_PS_STATE_DISABLED;
+		INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk);
+		INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk);
+
+		ret = ath11k_mac_station_add(ar, vif, sta);
+		if (ret)
+			ath11k_warn(ar->ab, "Failed to add station: %pM for VDEV: %d\n",
+				    sta->addr, arvif->vdev_id);
+	} else if ((old_state == IEEE80211_STA_NONE &&
+		    new_state == IEEE80211_STA_NOTEXIST)) {
+		ret = ath11k_mac_station_remove(ar, vif, sta);
+		if (ret)
+			ath11k_warn(ar->ab, "Failed to remove station: %pM for VDEV: %d\n",
+				    sta->addr, arvif->vdev_id);
+
+		mutex_lock(&ar->ab->tbl_mtx_lock);
+		spin_lock_bh(&ar->ab->base_lock);
+		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
+		if (peer && peer->sta == sta) {
+			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
+				    vif->addr, arvif->vdev_id);
+			ath11k_peer_rhash_delete(ar->ab, peer);
+			peer->sta = NULL;
+			list_del(&peer->list);
+			kfree(peer);
+			ar->num_peers--;
+		}
+		spin_unlock_bh(&ar->ab->base_lock);
+		mutex_unlock(&ar->ab->tbl_mtx_lock);
+	} else if (old_state == IEEE80211_STA_AUTH &&
+		   new_state == IEEE80211_STA_ASSOC &&
+		   (vif->type == NL80211_IFTYPE_AP ||
+		    vif->type == NL80211_IFTYPE_MESH_POINT ||
+		    vif->type == NL80211_IFTYPE_ADHOC)) {
+		ret = ath11k_station_assoc(ar, vif, sta, false);
+		if (ret)
+			ath11k_warn(ar->ab, "Failed to associate station: %pM\n",
+				    sta->addr);
+
+		spin_lock_bh(&ar->data_lock);
+		/* Set arsta bw and prev bw */
+		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
+		arsta->bw_prev = arsta->bw;
+		spin_unlock_bh(&ar->data_lock);
+	} else if (old_state == IEEE80211_STA_ASSOC &&
+		   new_state == IEEE80211_STA_AUTHORIZED) {
+		spin_lock_bh(&ar->ab->base_lock);
+
+		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
+		if (peer)
+			peer->is_authorized = true;
+
+		spin_unlock_bh(&ar->ab->base_lock);
+
+		if (vif->type == NL80211_IFTYPE_STATION && arvif->is_up) {
+			ret = ath11k_wmi_set_peer_param(ar, sta->addr,
+							arvif->vdev_id,
+							WMI_PEER_AUTHORIZE,
+							1);
+			if (ret)
+				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
+					    sta->addr, arvif->vdev_id, ret);
+		}
+	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
+		   new_state == IEEE80211_STA_ASSOC) {
+		spin_lock_bh(&ar->ab->base_lock);
+
+		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
+		if (peer)
+			peer->is_authorized = false;
+
+		spin_unlock_bh(&ar->ab->base_lock);
+	} else if (old_state == IEEE80211_STA_ASSOC &&
+		   new_state == IEEE80211_STA_AUTH &&
+		   (vif->type == NL80211_IFTYPE_AP ||
+		    vif->type == NL80211_IFTYPE_MESH_POINT ||
+		    vif->type == NL80211_IFTYPE_ADHOC)) {
+		ret = ath11k_station_disassoc(ar, vif, sta);
+		if (ret)
+			ath11k_warn(ar->ab, "Failed to disassociate station: %pM\n",
+				    sta->addr);
+	}
+
+	mutex_unlock(&ar->conf_mutex);
+	return ret;
+}
+
 static const struct ieee80211_ops ath11k_ops = {
 	.tx				= ath11k_mac_op_tx,
 	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
@@ -9288,19 +9388,50 @@
 	return 0;
 }
 
+static void ath11k_mac_setup_mac_address_list(struct ath11k *ar)
+{
+	struct mac_address *addresses;
+	u16 n_addresses;
+	int i;
+
+	if (!ar->ab->hw_params.support_dual_stations)
+		return;
+
+	n_addresses = ar->ab->hw_params.num_vdevs;
+	addresses = kcalloc(n_addresses, sizeof(*addresses), GFP_KERNEL);
+	if (!addresses)
+		return;
+
+	memcpy(addresses[0].addr, ar->mac_addr, ETH_ALEN);
+	for (i = 1; i < n_addresses; i++) {
+		memcpy(addresses[i].addr, ar->mac_addr, ETH_ALEN);
+		/* set Local Administered Address bit */
+		addresses[i].addr[0] |= 0x2;
+
+		addresses[i].addr[0] += (i - 1) << 4;
+	}
+
+	ar->hw->wiphy->addresses = addresses;
+	ar->hw->wiphy->n_addresses = n_addresses;
+}
+
 static int ath11k_mac_setup_iface_combinations(struct ath11k *ar)
 {
 	struct ath11k_base *ab = ar->ab;
 	struct ieee80211_iface_combination *combinations;
 	struct ieee80211_iface_limit *limits;
-	int n_limits;
+	int n_limits, n_combos;
 
-	combinations = kzalloc(sizeof(*combinations), GFP_KERNEL);
+	if (ab->hw_params.support_dual_stations)
+		n_combos = 2;
+	else
+		n_combos = 1;
+
+	combinations = kcalloc(n_combos, sizeof(*combinations), GFP_KERNEL);
 	if (!combinations)
 		return -ENOMEM;
 
 	n_limits = 2;
-
 	limits = kcalloc(n_limits, sizeof(*limits), GFP_KERNEL);
 	if (!limits) {
 		kfree(combinations);
@@ -9309,20 +9440,18 @@
 
 	limits[0].max = 1;
 	limits[0].types |= BIT(NL80211_IFTYPE_STATION);
-
 	limits[1].max = 16;
 	limits[1].types |= BIT(NL80211_IFTYPE_AP);
-
 	if (IS_ENABLED(CONFIG_MAC80211_MESH) &&
 	    ab->hw_params.interface_modes & BIT(NL80211_IFTYPE_MESH_POINT))
 		limits[1].types |= BIT(NL80211_IFTYPE_MESH_POINT);
 
 	combinations[0].limits = limits;
 	combinations[0].n_limits = n_limits;
-	combinations[0].max_interfaces = 16;
-	combinations[0].num_different_channels = 1;
 	combinations[0].beacon_int_infra_match = true;
 	combinations[0].beacon_int_min_gcd = 100;
+	combinations[0].max_interfaces = 16;
+	combinations[0].num_different_channels = 1;
 	combinations[0].radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 						BIT(NL80211_CHAN_WIDTH_20) |
 						BIT(NL80211_CHAN_WIDTH_40) |
@@ -9330,8 +9459,19 @@
 						BIT(NL80211_CHAN_WIDTH_80P80) |
 						BIT(NL80211_CHAN_WIDTH_160);
 
+	if (ab->hw_params.support_dual_stations) {
+		limits[0].max = 2;
+
+		combinations[1].limits = limits;
+		combinations[1].n_limits = n_limits;
+		combinations[1].beacon_int_infra_match = true;
+		combinations[1].beacon_int_min_gcd = 100;
+		combinations[1].max_interfaces = ab->hw_params.num_vdevs;
+		combinations[1].num_different_channels = 2;
+	}
+
 	ar->hw->wiphy->iface_combinations = combinations;
-	ar->hw->wiphy->n_iface_combinations = 1;
+	ar->hw->wiphy->n_iface_combinations = n_combos;
 
 	return 0;
 }
@@ -9393,6 +9533,8 @@
 	kfree(ar->hw->wiphy->iface_combinations[0].limits);
 	kfree(ar->hw->wiphy->iface_combinations);
 
+	kfree(ar->hw->wiphy->addresses);
+
 	SET_IEEE80211_DEV(ar->hw, NULL);
 }
 
@@ -9435,6 +9577,7 @@
 	ath11k_pdev_caps_update(ar);
 
 	SET_IEEE80211_PERM_ADDR(ar->hw, ar->mac_addr);
+	ath11k_mac_setup_mac_address_list(ar);
 
 	SET_IEEE80211_DEV(ar->hw, ab->dev);
 
@@ -9629,11 +9772,8 @@
 	}
 
 	if (ab->hw_params.current_cc_support && ab->new_alpha2[0]) {
-		struct wmi_set_current_country_params set_current_param = {};
-
-		memcpy(&set_current_param.alpha2, ab->new_alpha2, 2);
 		memcpy(&ar->alpha2, ab->new_alpha2, 2);
-		ret = ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param);
+		ret = ath11k_reg_set_cc(ar);
 		if (ret)
 			ath11k_warn(ar->ab,
 				    "failed set cc code for mac register: %d\n", ret);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/mhi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/mhi.c
@@ -20,7 +20,7 @@
 #define MHI_TIMEOUT_DEFAULT_MS	20000
 #define RDDM_DUMP_SIZE	0x420000
 
-static struct mhi_channel_config ath11k_mhi_channels_qca6390[] = {
+static const struct mhi_channel_config ath11k_mhi_channels_qca6390[] = {
 	{
 		.num = 0,
 		.name = "LOOPBACK",
@@ -102,18 +102,18 @@
 	},
 };
 
-static struct mhi_controller_config ath11k_mhi_config_qca6390 = {
+static const struct mhi_controller_config ath11k_mhi_config_qca6390 = {
 	.max_channels = 128,
 	.timeout_ms = 2000,
 	.use_bounce_buf = false,
-	.buf_len = 0,
+	.buf_len = 8192,
 	.num_channels = ARRAY_SIZE(ath11k_mhi_channels_qca6390),
 	.ch_cfg = ath11k_mhi_channels_qca6390,
 	.num_events = ARRAY_SIZE(ath11k_mhi_events_qca6390),
 	.event_cfg = ath11k_mhi_events_qca6390,
 };
 
-static struct mhi_channel_config ath11k_mhi_channels_qcn9074[] = {
+static const struct mhi_channel_config ath11k_mhi_channels_qcn9074[] = {
 	{
 		.num = 0,
 		.name = "LOOPBACK",
@@ -195,7 +195,7 @@
 	},
 };
 
-static struct mhi_controller_config ath11k_mhi_config_qcn9074 = {
+static const struct mhi_controller_config ath11k_mhi_config_qcn9074 = {
 	.max_channels = 30,
 	.timeout_ms = 10000,
 	.use_bounce_buf = false,
@@ -384,7 +384,7 @@
 {
 	struct ath11k_base *ab = ab_pci->ab;
 	struct mhi_controller *mhi_ctrl;
-	struct mhi_controller_config *ath11k_mhi_config;
+	const struct mhi_controller_config *ath11k_mhi_config;
 	int ret;
 
 	mhi_ctrl = mhi_alloc_controller();
@@ -443,6 +443,8 @@
 	case ATH11K_HW_QCA6390_HW20:
 	case ATH11K_HW_WCN6855_HW20:
 	case ATH11K_HW_WCN6855_HW21:
+	case ATH11K_HW_QCA2066_HW21:
+	case ATH11K_HW_QCA6698AQ_HW21:
 		ath11k_mhi_config = &ath11k_mhi_config_qca6390;
 		break;
 	default:
@@ -534,3 +536,8 @@
 
 	return 0;
 }
+
+void ath11k_mhi_coredump(struct mhi_controller *mhi_ctrl, bool in_panic)
+{
+	mhi_download_rddm_image(mhi_ctrl, in_panic);
+}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/mhi.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/mhi.h
@@ -26,5 +26,5 @@
 
 int ath11k_mhi_suspend(struct ath11k_pci *ar_pci);
 int ath11k_mhi_resume(struct ath11k_pci *ar_pci);
-
+void ath11k_mhi_coredump(struct mhi_controller *mhi_ctrl, bool in_panic);
 #endif
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/pci.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/pci.c
@@ -1,13 +1,15 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2019-2020 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/module.h>
 #include <linux/msi.h>
 #include <linux/pci.h>
 #include <linux/of.h>
+#include <linux/time.h>
+#include <linux/vmalloc.h>
 
 #include "pci.h"
 #include "core.h"
@@ -28,6 +30,8 @@
 #define QCN9074_DEVICE_ID		0x1104
 #define WCN6855_DEVICE_ID		0x1103
 
+#define TCSR_SOC_HW_SUB_VER	0x1910010
+
 static const struct pci_device_id ath11k_pci_id_table[] = {
 	{ PCI_VDEVICE(QCOM, QCA6390_DEVICE_ID) },
 	{ PCI_VDEVICE(QCOM, WCN6855_DEVICE_ID) },
@@ -597,6 +601,187 @@
 						   PCI_EXP_LNKCTL_ASPMC);
 }
 
+#ifdef CONFIG_ATH11K_COREDUMP
+static int ath11k_pci_coredump_calculate_size(struct ath11k_base *ab, u32 *dump_seg_sz)
+{
+	struct ath11k_pci *ab_pci = ath11k_pci_priv(ab);
+	struct mhi_controller *mhi_ctrl = ab_pci->mhi_ctrl;
+	struct image_info *rddm_img, *fw_img;
+	struct ath11k_tlv_dump_data *dump_tlv;
+	enum ath11k_fw_crash_dump_type mem_type;
+	u32 len = 0, rddm_tlv_sz = 0, paging_tlv_sz = 0;
+	struct ath11k_dump_file_data *file_data;
+	int i;
+
+	rddm_img = mhi_ctrl->rddm_image;
+	if (!rddm_img) {
+		ath11k_err(ab, "No RDDM dump found\n");
+		return 0;
+	}
+
+	fw_img = mhi_ctrl->fbc_image;
+
+	for (i = 0; i < fw_img->entries ; i++) {
+		if (!fw_img->mhi_buf[i].buf)
+			continue;
+
+		paging_tlv_sz += fw_img->mhi_buf[i].len;
+	}
+	dump_seg_sz[FW_CRASH_DUMP_PAGING_DATA] = paging_tlv_sz;
+
+	for (i = 0; i < rddm_img->entries; i++) {
+		if (!rddm_img->mhi_buf[i].buf)
+			continue;
+
+		rddm_tlv_sz += rddm_img->mhi_buf[i].len;
+	}
+	dump_seg_sz[FW_CRASH_DUMP_RDDM_DATA] = rddm_tlv_sz;
+
+	for (i = 0; i < ab->qmi.mem_seg_count; i++) {
+		mem_type = ath11k_coredump_get_dump_type(ab->qmi.target_mem[i].type);
+
+		if (mem_type == FW_CRASH_DUMP_NONE)
+			continue;
+
+		if (mem_type == FW_CRASH_DUMP_TYPE_MAX) {
+			ath11k_dbg(ab, ATH11K_DBG_PCI,
+				   "target mem region type %d not supported",
+				   ab->qmi.target_mem[i].type);
+			continue;
+		}
+
+		if (!ab->qmi.target_mem[i].v.iaddr)
+			continue;
+
+		dump_seg_sz[mem_type] += ab->qmi.target_mem[i].size;
+	}
+
+	for (i = 0; i < FW_CRASH_DUMP_TYPE_MAX; i++) {
+		if (!dump_seg_sz[i])
+			continue;
+
+		len += sizeof(*dump_tlv) + dump_seg_sz[i];
+	}
+
+	if (len)
+		len += sizeof(*file_data);
+
+	return len;
+}
+
+static void ath11k_pci_coredump_download(struct ath11k_base *ab)
+{
+	struct ath11k_pci *ab_pci = ath11k_pci_priv(ab);
+	struct mhi_controller *mhi_ctrl = ab_pci->mhi_ctrl;
+	struct image_info *rddm_img, *fw_img;
+	struct timespec64 timestamp;
+	int i, len, mem_idx;
+	enum ath11k_fw_crash_dump_type mem_type;
+	struct ath11k_dump_file_data *file_data;
+	struct ath11k_tlv_dump_data *dump_tlv;
+	size_t hdr_len = sizeof(*file_data);
+	void *buf;
+	u32 dump_seg_sz[FW_CRASH_DUMP_TYPE_MAX] = { 0 };
+
+	ath11k_mhi_coredump(mhi_ctrl, false);
+
+	len = ath11k_pci_coredump_calculate_size(ab, dump_seg_sz);
+	if (!len) {
+		ath11k_warn(ab, "No crash dump data found for devcoredump");
+		return;
+	}
+
+	rddm_img = mhi_ctrl->rddm_image;
+	fw_img = mhi_ctrl->fbc_image;
+
+	/* dev_coredumpv() requires vmalloc data */
+	buf = vzalloc(len);
+	if (!buf)
+		return;
+
+	ab->dump_data = buf;
+	ab->ath11k_coredump_len = len;
+	file_data = ab->dump_data;
+	strscpy(file_data->df_magic, "ATH11K-FW-DUMP", sizeof(file_data->df_magic));
+	file_data->len = cpu_to_le32(len);
+	file_data->version = cpu_to_le32(ATH11K_FW_CRASH_DUMP_V2);
+	file_data->chip_id = cpu_to_le32(ab_pci->dev_id);
+	file_data->qrtr_id = cpu_to_le32(ab_pci->ab->qmi.service_ins_id);
+	file_data->bus_id = cpu_to_le32(pci_domain_nr(ab_pci->pdev->bus));
+	guid_gen(&file_data->guid);
+	ktime_get_real_ts64(&timestamp);
+	file_data->tv_sec = cpu_to_le64(timestamp.tv_sec);
+	file_data->tv_nsec = cpu_to_le64(timestamp.tv_nsec);
+	buf += hdr_len;
+	dump_tlv = buf;
+	dump_tlv->type = cpu_to_le32(FW_CRASH_DUMP_PAGING_DATA);
+	dump_tlv->tlv_len = cpu_to_le32(dump_seg_sz[FW_CRASH_DUMP_PAGING_DATA]);
+	buf += COREDUMP_TLV_HDR_SIZE;
+
+	/* append all segments together as they are all part of a single contiguous
+	 * block of memory
+	 */
+	for (i = 0; i < fw_img->entries ; i++) {
+		if (!fw_img->mhi_buf[i].buf)
+			continue;
+
+		memcpy_fromio(buf, (void const __iomem *)fw_img->mhi_buf[i].buf,
+			      fw_img->mhi_buf[i].len);
+		buf += fw_img->mhi_buf[i].len;
+	}
+
+	dump_tlv = buf;
+	dump_tlv->type = cpu_to_le32(FW_CRASH_DUMP_RDDM_DATA);
+	dump_tlv->tlv_len = cpu_to_le32(dump_seg_sz[FW_CRASH_DUMP_RDDM_DATA]);
+	buf += COREDUMP_TLV_HDR_SIZE;
+
+	/* append all segments together as they are all part of a single contiguous
+	 * block of memory
+	 */
+	for (i = 0; i < rddm_img->entries; i++) {
+		if (!rddm_img->mhi_buf[i].buf)
+			continue;
+
+		memcpy_fromio(buf, (void const __iomem *)rddm_img->mhi_buf[i].buf,
+			      rddm_img->mhi_buf[i].len);
+		buf += rddm_img->mhi_buf[i].len;
+	}
+
+	mem_idx = FW_CRASH_DUMP_REMOTE_MEM_DATA;
+	for (; mem_idx < FW_CRASH_DUMP_TYPE_MAX; mem_idx++) {
+		if (mem_idx == FW_CRASH_DUMP_NONE)
+			continue;
+
+		for (i = 0; i < ab->qmi.mem_seg_count; i++) {
+			mem_type = ath11k_coredump_get_dump_type
+						(ab->qmi.target_mem[i].type);
+
+			if (mem_type != mem_idx)
+				continue;
+
+			if (!ab->qmi.target_mem[i].v.iaddr) {
+				ath11k_dbg(ab, ATH11K_DBG_PCI,
+					   "Skipping mem region type %d",
+					   ab->qmi.target_mem[i].type);
+				continue;
+			}
+
+			dump_tlv = buf;
+			dump_tlv->type = cpu_to_le32(mem_idx);
+			dump_tlv->tlv_len = cpu_to_le32(dump_seg_sz[mem_idx]);
+			buf += COREDUMP_TLV_HDR_SIZE;
+
+			memcpy_fromio(buf, ab->qmi.target_mem[i].v.iaddr,
+				      ab->qmi.target_mem[i].size);
+
+			buf += ab->qmi.target_mem[i].size;
+		}
+	}
+
+	queue_work(ab->workqueue, &ab->dump_work);
+}
+#endif
+
 static int ath11k_pci_power_up(struct ath11k_base *ab)
 {
 	struct ath11k_pci *ab_pci = ath11k_pci_priv(ab);
@@ -700,6 +885,9 @@
 	.ce_irq_enable = ath11k_pci_hif_ce_irq_enable,
 	.ce_irq_disable = ath11k_pci_hif_ce_irq_disable,
 	.get_ce_msi_idx = ath11k_pcic_get_ce_msi_idx,
+#ifdef CONFIG_ATH11K_COREDUMP
+	.coredump_download = ath11k_pci_coredump_download,
+#endif
 };
 
 static void ath11k_pci_read_hw_version(struct ath11k_base *ab, u32 *major, u32 *minor)
@@ -731,8 +919,8 @@
 	struct ath11k_base *ab;
 	struct ath11k_pci *ab_pci;
 	u32 soc_hw_version_major, soc_hw_version_minor, addr;
-	const struct ath11k_pci_ops *pci_ops;
 	int ret;
+	u32 sub_version;
 
 	ab = ath11k_core_alloc(&pdev->dev, sizeof(*ab_pci), ATH11K_BUS_PCI);
 
@@ -777,6 +965,12 @@
 
 	switch (pci_dev->device) {
 	case QCA6390_DEVICE_ID:
+		ret = ath11k_pcic_register_pci_ops(ab, &ath11k_pci_ops_qca6390);
+		if (ret) {
+			ath11k_err(ab, "failed to register PCI ops: %d\n", ret);
+			goto err_pci_free_region;
+		}
+
 		ath11k_pci_read_hw_version(ab, &soc_hw_version_major,
 					   &soc_hw_version_minor);
 		switch (soc_hw_version_major) {
@@ -790,13 +984,21 @@
 			goto err_pci_free_region;
 		}
 
-		pci_ops = &ath11k_pci_ops_qca6390;
 		break;
 	case QCN9074_DEVICE_ID:
-		pci_ops = &ath11k_pci_ops_qcn9074;
+		ret = ath11k_pcic_register_pci_ops(ab, &ath11k_pci_ops_qcn9074);
+		if (ret) {
+			ath11k_err(ab, "failed to register PCI ops: %d\n", ret);
+			goto err_pci_free_region;
+		}
 		ab->hw_rev = ATH11K_HW_QCN9074_HW10;
 		break;
 	case WCN6855_DEVICE_ID:
+		ret = ath11k_pcic_register_pci_ops(ab, &ath11k_pci_ops_qca6390);
+		if (ret) {
+			ath11k_err(ab, "failed to register PCI ops: %d\n", ret);
+			goto err_pci_free_region;
+		}
 		ab->id.bdf_search = ATH11K_BDF_SEARCH_BUS_AND_BOARD;
 		ath11k_pci_read_hw_version(ab, &soc_hw_version_major,
 					   &soc_hw_version_minor);
@@ -809,7 +1011,23 @@
 				break;
 			case 0x10:
 			case 0x11:
-				ab->hw_rev = ATH11K_HW_WCN6855_HW21;
+				sub_version = ath11k_pcic_read32(ab, TCSR_SOC_HW_SUB_VER);
+				ath11k_dbg(ab, ATH11K_DBG_PCI, "sub_version 0x%x\n",
+					   sub_version);
+				switch (sub_version) {
+				case 0x1019A0E1:
+				case 0x1019B0E1:
+				case 0x1019C0E1:
+				case 0x1019D0E1:
+					ab->hw_rev = ATH11K_HW_QCA2066_HW21;
+					break;
+				case 0x001e60e1:
+				case 0x1016d0e1:
+					ab->hw_rev = ATH11K_HW_QCA6698AQ_HW21;
+					break;
+				default:
+					ab->hw_rev = ATH11K_HW_WCN6855_HW21;
+				}
 				break;
 			default:
 				goto unsupported_wcn6855_soc;
@@ -823,7 +1041,6 @@
 			goto err_pci_free_region;
 		}
 
-		pci_ops = &ath11k_pci_ops_qca6390;
 		break;
 	default:
 		dev_err(&pdev->dev, "Unknown PCI device found: 0x%x\n",
@@ -832,12 +1049,6 @@
 		goto err_pci_free_region;
 	}
 
-	ret = ath11k_pcic_register_pci_ops(ab, pci_ops);
-	if (ret) {
-		ath11k_err(ab, "failed to register PCI ops: %d\n", ret);
-		goto err_pci_free_region;
-	}
-
 	ret = ath11k_pcic_init_msi_config(ab);
 	if (ret) {
 		ath11k_err(ab, "failed to init msi config: %d\n", ret);
@@ -946,6 +1157,8 @@
 
 	set_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags);
 
+	cancel_work_sync(&ab->reset_work);
+	cancel_work_sync(&ab->dump_work);
 	ath11k_core_deinit(ab);
 
 qmi_fail:
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/pcic.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/pcic.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2019-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include "core.h"
@@ -115,6 +115,28 @@
 		},
 		.hw_rev = ATH11K_HW_WCN6750_HW10,
 	},
+	{
+		.total_vectors = 32,
+		.total_users = 4,
+		.users = (struct ath11k_msi_user[]) {
+			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
+			{ .name = "CE", .num_vectors = 10, .base_vector = 3 },
+			{ .name = "WAKE", .num_vectors = 1, .base_vector = 13 },
+			{ .name = "DP", .num_vectors = 18, .base_vector = 14 },
+		},
+		.hw_rev = ATH11K_HW_QCA2066_HW21,
+	},
+	{
+		.total_vectors = 32,
+		.total_users = 4,
+		.users = (struct ath11k_msi_user[]) {
+			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
+			{ .name = "CE", .num_vectors = 10, .base_vector = 3 },
+			{ .name = "WAKE", .num_vectors = 1, .base_vector = 13 },
+			{ .name = "DP", .num_vectors = 18, .base_vector = 14 },
+		},
+		.hw_rev = ATH11K_HW_QCA6698AQ_HW21,
+	},
 };
 
 int ath11k_pcic_init_msi_config(struct ath11k_base *ab)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/qmi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/qmi.c
@@ -1955,19 +1955,21 @@
 	int i;
 
 	for (i = 0; i < ab->qmi.mem_seg_count; i++) {
-		if ((ab->hw_params.fixed_mem_region ||
-		     test_bit(ATH11K_FLAG_FIXED_MEM_RGN, &ab->dev_flags)) &&
-		     ab->qmi.target_mem[i].iaddr)
-			iounmap(ab->qmi.target_mem[i].iaddr);
+		if (!ab->qmi.target_mem[i].v.iaddr)
+			continue;
 
-		if (!ab->qmi.target_mem[i].vaddr)
+		if (ab->hw_params.fixed_mem_region ||
+		    test_bit(ATH11K_FLAG_FIXED_MEM_RGN, &ab->dev_flags)) {
+			iounmap(ab->qmi.target_mem[i].v.iaddr);
+			ab->qmi.target_mem[i].v.iaddr = NULL;
 			continue;
+		}
 
 		dma_free_coherent(ab->dev,
 				  ab->qmi.target_mem[i].prev_size,
-				  ab->qmi.target_mem[i].vaddr,
+				  ab->qmi.target_mem[i].v.vaddr,
 				  ab->qmi.target_mem[i].paddr);
-		ab->qmi.target_mem[i].vaddr = NULL;
+		ab->qmi.target_mem[i].v.vaddr = NULL;
 	}
 }
 
@@ -1984,22 +1986,22 @@
 		/* Firmware reloads in coldboot/firmware recovery.
 		 * in such case, no need to allocate memory for FW again.
 		 */
-		if (chunk->vaddr) {
+		if (chunk->v.vaddr) {
 			if (chunk->prev_type == chunk->type &&
 			    chunk->prev_size == chunk->size)
 				continue;
 
 			/* cannot reuse the existing chunk */
 			dma_free_coherent(ab->dev, chunk->prev_size,
-					  chunk->vaddr, chunk->paddr);
-			chunk->vaddr = NULL;
+					  chunk->v.vaddr, chunk->paddr);
+			chunk->v.vaddr = NULL;
 		}
 
-		chunk->vaddr = dma_alloc_coherent(ab->dev,
-						  chunk->size,
-						  &chunk->paddr,
-						  GFP_KERNEL | __GFP_NOWARN);
-		if (!chunk->vaddr) {
+		chunk->v.vaddr = dma_alloc_coherent(ab->dev,
+						    chunk->size,
+						    &chunk->paddr,
+						    GFP_KERNEL | __GFP_NOWARN);
+		if (!chunk->v.vaddr) {
 			if (ab->qmi.mem_seg_count <= ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT) {
 				ath11k_dbg(ab, ATH11K_DBG_QMI,
 					   "dma allocation failed (%d B type %u), will try later with small size\n",
@@ -2055,10 +2057,10 @@
 			}
 
 			ab->qmi.target_mem[idx].paddr = res.start;
-			ab->qmi.target_mem[idx].iaddr =
+			ab->qmi.target_mem[idx].v.iaddr =
 				ioremap(ab->qmi.target_mem[idx].paddr,
 					ab->qmi.target_mem[i].size);
-			if (!ab->qmi.target_mem[idx].iaddr)
+			if (!ab->qmi.target_mem[idx].v.iaddr)
 				return -EIO;
 
 			ab->qmi.target_mem[idx].size = ab->qmi.target_mem[i].size;
@@ -2068,7 +2070,7 @@
 			break;
 		case BDF_MEM_REGION_TYPE:
 			ab->qmi.target_mem[idx].paddr = ab->hw_params.bdf_addr;
-			ab->qmi.target_mem[idx].vaddr = NULL;
+			ab->qmi.target_mem[idx].v.vaddr = NULL;
 			ab->qmi.target_mem[idx].size = ab->qmi.target_mem[i].size;
 			ab->qmi.target_mem[idx].type = ab->qmi.target_mem[i].type;
 			idx++;
@@ -2083,18 +2085,19 @@
 				if (hremote_node) {
 					ab->qmi.target_mem[idx].paddr =
 							res.start + host_ddr_sz;
-					ab->qmi.target_mem[idx].iaddr =
+					ab->qmi.target_mem[idx].v.iaddr =
 						ioremap(ab->qmi.target_mem[idx].paddr,
 							ab->qmi.target_mem[i].size);
-					if (!ab->qmi.target_mem[idx].iaddr)
+					if (!ab->qmi.target_mem[idx].v.iaddr)
 						return -EIO;
 				} else {
 					ab->qmi.target_mem[idx].paddr =
 						ATH11K_QMI_CALDB_ADDRESS;
+					ab->qmi.target_mem[idx].v.vaddr = NULL;
 				}
 			} else {
 				ab->qmi.target_mem[idx].paddr = 0;
-				ab->qmi.target_mem[idx].vaddr = NULL;
+				ab->qmi.target_mem[idx].v.vaddr = NULL;
 			}
 			ab->qmi.target_mem[idx].size = ab->qmi.target_mem[i].size;
 			ab->qmi.target_mem[idx].type = ab->qmi.target_mem[i].type;
@@ -2180,6 +2183,9 @@
 	ab->mem = bar_addr_va;
 	ab->mem_len = resp.bar_size;
 
+	if (!ab->hw_params.ce_remap)
+		ab->mem_ce = ab->mem;
+
 	return 0;
 out:
 	return ret;
@@ -2293,7 +2299,7 @@
 	struct qmi_txn txn;
 	const u8 *temp = data;
 	void __iomem *bdf_addr = NULL;
-	int ret;
+	int ret = 0;
 	u32 remaining = len;
 
 	req = kzalloc(sizeof(*req), GFP_KERNEL);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/qmi.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/qmi.h
@@ -102,8 +102,10 @@
 	u32 prev_size;
 	u32 prev_type;
 	dma_addr_t paddr;
-	u32 *vaddr;
-	void __iomem *iaddr;
+	union {
+		u32 *vaddr;
+		void __iomem *iaddr;
+	} v;
 };
 
 struct target_info {
@@ -154,6 +156,7 @@
 #define BDF_MEM_REGION_TYPE				0x2
 #define M3_DUMP_REGION_TYPE				0x3
 #define CALDB_MEM_REGION_TYPE				0x4
+#define PAGEABLE_MEM_REGION_TYPE			0x9
 
 struct qmi_wlanfw_host_cap_req_msg_v01 {
 	u8 num_clients_valid;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/reg.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/reg.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/rtnetlink.h>
 
@@ -49,7 +49,6 @@
 {
 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 	struct wmi_init_country_params init_country_param;
-	struct wmi_set_current_country_params set_current_param = {};
 	struct ath11k *ar = hw->priv;
 	int ret;
 
@@ -83,9 +82,8 @@
 	 * reg info
 	 */
 	if (ar->ab->hw_params.current_cc_support) {
-		memcpy(&set_current_param.alpha2, request->alpha2, 2);
-		memcpy(&ar->alpha2, &set_current_param.alpha2, 2);
-		ret = ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param);
+		memcpy(&ar->alpha2, request->alpha2, 2);
+		ret = ath11k_reg_set_cc(ar);
 		if (ret)
 			ath11k_warn(ar->ab,
 				    "failed set current country code: %d\n", ret);
@@ -425,6 +423,11 @@
 	/* Use the flags of both the rules */
 	new_rule->flags = rule1->flags | rule2->flags;
 
+	if ((rule1->flags & NL80211_RRF_PSD) && (rule2->flags & NL80211_RRF_PSD))
+		new_rule->psd = min_t(s8, rule1->psd, rule2->psd);
+	else
+		new_rule->flags &= ~NL80211_RRF_PSD;
+
 	/* To be safe, lts use the max cac timeout of both rules */
 	new_rule->dfs_cac_ms = max_t(u32, rule1->dfs_cac_ms,
 				     rule2->dfs_cac_ms);
@@ -527,13 +530,14 @@
 static void
 ath11k_reg_update_rule(struct ieee80211_reg_rule *reg_rule, u32 start_freq,
 		       u32 end_freq, u32 bw, u32 ant_gain, u32 reg_pwr,
-		       u32 reg_flags)
+		       s8 psd, u32 reg_flags)
 {
 	reg_rule->freq_range.start_freq_khz = MHZ_TO_KHZ(start_freq);
 	reg_rule->freq_range.end_freq_khz = MHZ_TO_KHZ(end_freq);
 	reg_rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw);
 	reg_rule->power_rule.max_antenna_gain = DBI_TO_MBI(ant_gain);
 	reg_rule->power_rule.max_eirp = DBM_TO_MBM(reg_pwr);
+	reg_rule->psd = psd;
 	reg_rule->flags = reg_flags;
 }
 
@@ -563,7 +567,7 @@
 				       reg_rule->start_freq,
 				       ETSI_WEATHER_RADAR_BAND_LOW, bw,
 				       reg_rule->ant_gain, reg_rule->reg_power,
-				       flags);
+				       reg_rule->psd_eirp, flags);
 
 		ath11k_dbg(ab, ATH11K_DBG_REG,
 			   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
@@ -584,7 +588,7 @@
 
 		ath11k_reg_update_rule(regd->reg_rules + i, start_freq,
 				       end_freq, bw, reg_rule->ant_gain,
-				       reg_rule->reg_power, flags);
+				       reg_rule->reg_power, reg_rule->psd_eirp, flags);
 
 		regd->reg_rules[i].dfs_cac_ms = ETSI_WEATHER_RADAR_BAND_CAC_TIMEOUT;
 
@@ -605,7 +609,7 @@
 				       ETSI_WEATHER_RADAR_BAND_HIGH,
 				       reg_rule->end_freq, bw,
 				       reg_rule->ant_gain, reg_rule->reg_power,
-				       flags);
+				       reg_rule->psd_eirp, flags);
 
 		ath11k_dbg(ab, ATH11K_DBG_REG,
 			   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
@@ -618,25 +622,68 @@
 	*rule_idx = i;
 }
 
+enum wmi_reg_6ghz_ap_type
+ath11k_reg_ap_pwr_convert(enum ieee80211_ap_reg_power power_type)
+{
+	switch (power_type) {
+	case IEEE80211_REG_LPI_AP:
+		return WMI_REG_INDOOR_AP;
+	case IEEE80211_REG_SP_AP:
+		return WMI_REG_STANDARD_POWER_AP;
+	case IEEE80211_REG_VLP_AP:
+		return WMI_REG_VERY_LOW_POWER_AP;
+	default:
+		return WMI_REG_MAX_AP_TYPE;
+	}
+}
+
 struct ieee80211_regdomain *
 ath11k_reg_build_regd(struct ath11k_base *ab,
-		      struct cur_regulatory_info *reg_info, bool intersect)
+		      struct cur_regulatory_info *reg_info, bool intersect,
+		      enum wmi_vdev_type vdev_type,
+		      enum ieee80211_ap_reg_power power_type)
 {
 	struct ieee80211_regdomain *tmp_regd, *default_regd, *new_regd = NULL;
-	struct cur_reg_rule *reg_rule;
+	struct cur_reg_rule *reg_rule, *reg_rule_6ghz;
 	u8 i = 0, j = 0, k = 0;
 	u8 num_rules;
 	u16 max_bw;
-	u32 flags;
+	u32 flags, reg_6ghz_number, max_bw_6ghz;
 	char alpha2[3];
 
 	num_rules = reg_info->num_5ghz_reg_rules + reg_info->num_2ghz_reg_rules;
 
-	/* FIXME: Currently taking reg rules for 6 GHz only from Indoor AP mode list.
-	 * This can be updated after complete 6 GHz regulatory support is added.
-	 */
-	if (reg_info->is_ext_reg_event)
-		num_rules += reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP];
+	if (reg_info->is_ext_reg_event) {
+		if (vdev_type == WMI_VDEV_TYPE_STA) {
+			enum wmi_reg_6ghz_ap_type ap_type;
+
+			ap_type = ath11k_reg_ap_pwr_convert(power_type);
+
+			if (ap_type == WMI_REG_MAX_AP_TYPE)
+				ap_type = WMI_REG_INDOOR_AP;
+
+			reg_6ghz_number = reg_info->num_6ghz_rules_client
+					[ap_type][WMI_REG_DEFAULT_CLIENT];
+
+			if (reg_6ghz_number == 0) {
+				ap_type = WMI_REG_INDOOR_AP;
+				reg_6ghz_number = reg_info->num_6ghz_rules_client
+						[ap_type][WMI_REG_DEFAULT_CLIENT];
+			}
+
+			reg_rule_6ghz = reg_info->reg_rules_6ghz_client_ptr
+					[ap_type][WMI_REG_DEFAULT_CLIENT];
+			max_bw_6ghz = reg_info->max_bw_6ghz_client
+					[ap_type][WMI_REG_DEFAULT_CLIENT];
+		} else {
+			reg_6ghz_number = reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP];
+			reg_rule_6ghz =
+				reg_info->reg_rules_6ghz_ap_ptr[WMI_REG_INDOOR_AP];
+			max_bw_6ghz = reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP];
+		}
+
+		num_rules += reg_6ghz_number;
+	}
 
 	if (!num_rules)
 		goto ret;
@@ -683,14 +730,13 @@
 			 * per other BW rule flags we pass from here
 			 */
 			flags = NL80211_RRF_AUTO_BW;
-		} else if (reg_info->is_ext_reg_event &&
-			   reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] &&
-			   (k < reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP])) {
-			reg_rule = reg_info->reg_rules_6ghz_ap_ptr[WMI_REG_INDOOR_AP] +
-				   k++;
-			max_bw = min_t(u16, reg_rule->max_bw,
-				       reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP]);
+		} else if (reg_info->is_ext_reg_event && reg_6ghz_number &&
+			   k < reg_6ghz_number) {
+			reg_rule = reg_rule_6ghz + k++;
+			max_bw = min_t(u16, reg_rule->max_bw, max_bw_6ghz);
 			flags = NL80211_RRF_AUTO_BW;
+			if (reg_rule->psd_flag)
+				flags |= NL80211_RRF_PSD;
 		} else {
 			break;
 		}
@@ -702,7 +748,7 @@
 				       reg_rule->start_freq,
 				       reg_rule->end_freq, max_bw,
 				       reg_rule->ant_gain, reg_rule->reg_power,
-				       flags);
+				       reg_rule->psd_eirp, flags);
 
 		/* Update dfs cac timeout if the dfs domain is ETSI and the
 		 * new rule covers weather radar band.
@@ -758,6 +804,159 @@
 	return new_regd;
 }
 
+static bool ath11k_reg_is_world_alpha(char *alpha)
+{
+	if (alpha[0] == '0' && alpha[1] == '0')
+		return true;
+
+	if (alpha[0] == 'n' && alpha[1] == 'a')
+		return true;
+
+	return false;
+}
+
+static enum wmi_vdev_type ath11k_reg_get_ar_vdev_type(struct ath11k *ar)
+{
+	struct ath11k_vif *arvif;
+
+	/* Currently each struct ath11k maps to one struct ieee80211_hw/wiphy
+	 * and one struct ieee80211_regdomain, so it could only store one group
+	 * reg rules. It means multi-interface concurrency in the same ath11k is
+	 * not support for the regdomain. So get the vdev type of the first entry
+	 * now. After concurrency support for the regdomain, this should change.
+	 */
+	arvif = list_first_entry_or_null(&ar->arvifs, struct ath11k_vif, list);
+	if (arvif)
+		return arvif->vdev_type;
+
+	return WMI_VDEV_TYPE_UNSPEC;
+}
+
+int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
+				struct cur_regulatory_info *reg_info,
+				enum ieee80211_ap_reg_power power_type)
+{
+	struct ieee80211_regdomain *regd;
+	bool intersect = false;
+	int pdev_idx;
+	struct ath11k *ar;
+	enum wmi_vdev_type vdev_type;
+
+	ath11k_dbg(ab, ATH11K_DBG_WMI, "event reg handle chan list");
+
+	if (reg_info->status_code != REG_SET_CC_STATUS_PASS) {
+		/* In case of failure to set the requested ctry,
+		 * fw retains the current regd. We print a failure info
+		 * and return from here.
+		 */
+		ath11k_warn(ab, "Failed to set the requested Country regulatory setting\n");
+		return -EINVAL;
+	}
+
+	pdev_idx = reg_info->phy_id;
+
+	/* Avoid default reg rule updates sent during FW recovery if
+	 * it is already available
+	 */
+	spin_lock_bh(&ab->base_lock);
+	if (test_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags) &&
+	    ab->default_regd[pdev_idx]) {
+		spin_unlock_bh(&ab->base_lock);
+		goto retfail;
+	}
+	spin_unlock_bh(&ab->base_lock);
+
+	if (pdev_idx >= ab->num_radios) {
+		/* Process the event for phy0 only if single_pdev_only
+		 * is true. If pdev_idx is valid but not 0, discard the
+		 * event. Otherwise, it goes to fallback. In either case
+		 * ath11k_reg_reset_info() needs to be called to avoid
+		 * memory leak issue.
+		 */
+		ath11k_reg_reset_info(reg_info);
+
+		if (ab->hw_params.single_pdev_only &&
+		    pdev_idx < ab->hw_params.num_rxdma_per_pdev)
+			return 0;
+		goto fallback;
+	}
+
+	/* Avoid multiple overwrites to default regd, during core
+	 * stop-start after mac registration.
+	 */
+	if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] &&
+	    !memcmp((char *)ab->default_regd[pdev_idx]->alpha2,
+		    (char *)reg_info->alpha2, 2))
+		goto retfail;
+
+	/* Intersect new rules with default regd if a new country setting was
+	 * requested, i.e a default regd was already set during initialization
+	 * and the regd coming from this event has a valid country info.
+	 */
+	if (ab->default_regd[pdev_idx] &&
+	    !ath11k_reg_is_world_alpha((char *)
+		ab->default_regd[pdev_idx]->alpha2) &&
+	    !ath11k_reg_is_world_alpha((char *)reg_info->alpha2))
+		intersect = true;
+
+	ar = ab->pdevs[pdev_idx].ar;
+	vdev_type = ath11k_reg_get_ar_vdev_type(ar);
+
+	ath11k_dbg(ab, ATH11K_DBG_WMI,
+		   "wmi handle chan list power type %d vdev type %d intersect %d\n",
+		   power_type, vdev_type, intersect);
+
+	regd = ath11k_reg_build_regd(ab, reg_info, intersect, vdev_type, power_type);
+	if (!regd) {
+		ath11k_warn(ab, "failed to build regd from reg_info\n");
+		goto fallback;
+	}
+
+	if (power_type == IEEE80211_REG_UNSET_AP) {
+		ath11k_reg_reset_info(&ab->reg_info_store[pdev_idx]);
+		ab->reg_info_store[pdev_idx] = *reg_info;
+	}
+
+	spin_lock_bh(&ab->base_lock);
+	if (ab->default_regd[pdev_idx]) {
+		/* The initial rules from FW after WMI Init is to build
+		 * the default regd. From then on, any rules updated for
+		 * the pdev could be due to user reg changes.
+		 * Free previously built regd before assigning the newly
+		 * generated regd to ar. NULL pointer handling will be
+		 * taken care by kfree itself.
+		 */
+		ar = ab->pdevs[pdev_idx].ar;
+		kfree(ab->new_regd[pdev_idx]);
+		ab->new_regd[pdev_idx] = regd;
+		queue_work(ab->workqueue, &ar->regd_update_work);
+	} else {
+		/* This regd would be applied during mac registration and is
+		 * held constant throughout for regd intersection purpose
+		 */
+		ab->default_regd[pdev_idx] = regd;
+	}
+	ab->dfs_region = reg_info->dfs_region;
+	spin_unlock_bh(&ab->base_lock);
+
+	return 0;
+
+fallback:
+	/* Fallback to older reg (by sending previous country setting
+	 * again if fw has succeeded and we failed to process here.
+	 * The Regdomain should be uniform across driver and fw. Since the
+	 * FW has processed the command and sent a success status, we expect
+	 * this function to succeed as well. If it doesn't, CTRY needs to be
+	 * reverted at the fw and the old SCAN_CHAN_LIST cmd needs to be sent.
+	 */
+	/* TODO: This is rare, but still should also be handled */
+	WARN_ON(1);
+
+retfail:
+
+	return -EINVAL;
+}
+
 void ath11k_regd_update_work(struct work_struct *work)
 {
 	struct ath11k *ar = container_of(work, struct ath11k,
@@ -781,12 +980,46 @@
 	ar->hw->wiphy->reg_notifier = ath11k_reg_notifier;
 }
 
+void ath11k_reg_reset_info(struct cur_regulatory_info *reg_info)
+{
+	int i, j;
+
+	if (!reg_info)
+		return;
+
+	kfree(reg_info->reg_rules_2ghz_ptr);
+	kfree(reg_info->reg_rules_5ghz_ptr);
+
+	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
+		kfree(reg_info->reg_rules_6ghz_ap_ptr[i]);
+
+		for (j = 0; j < WMI_REG_MAX_CLIENT_TYPE; j++)
+			kfree(reg_info->reg_rules_6ghz_client_ptr[i][j]);
+	}
+
+	memset(reg_info, 0, sizeof(*reg_info));
+}
+
 void ath11k_reg_free(struct ath11k_base *ab)
 {
 	int i;
 
+	for (i = 0; i < ab->num_radios; i++)
+		ath11k_reg_reset_info(&ab->reg_info_store[i]);
+
+	kfree(ab->reg_info_store);
+	ab->reg_info_store = NULL;
+
 	for (i = 0; i < ab->hw_params.max_radios; i++) {
 		kfree(ab->default_regd[i]);
 		kfree(ab->new_regd[i]);
 	}
 }
+
+int ath11k_reg_set_cc(struct ath11k *ar)
+{
+	struct wmi_set_current_country_params set_current_param = {};
+
+	memcpy(&set_current_param.alpha2, ar->alpha2, 2);
+	return ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param);
+}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/reg.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/reg.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause-Clear */
 /*
  * Copyright (c) 2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef ATH11K_REG_H
@@ -30,11 +30,20 @@
 
 /* ATH11K Regulatory API's */
 void ath11k_reg_init(struct ath11k *ar);
+void ath11k_reg_reset_info(struct cur_regulatory_info *reg_info);
 void ath11k_reg_free(struct ath11k_base *ab);
 void ath11k_regd_update_work(struct work_struct *work);
 struct ieee80211_regdomain *
 ath11k_reg_build_regd(struct ath11k_base *ab,
-		      struct cur_regulatory_info *reg_info, bool intersect);
+		      struct cur_regulatory_info *reg_info, bool intersect,
+		      enum wmi_vdev_type vdev_type,
+		      enum ieee80211_ap_reg_power power_type);
 int ath11k_regd_update(struct ath11k *ar);
 int ath11k_reg_update_chan_list(struct ath11k *ar, bool wait);
+enum wmi_reg_6ghz_ap_type
+ath11k_reg_ap_pwr_convert(enum ieee80211_ap_reg_power power_type);
+int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
+				struct cur_regulatory_info *reg_info,
+				enum ieee80211_ap_reg_power power_type);
+int ath11k_reg_set_cc(struct ath11k *ar);
 #endif
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/wmi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/wmi.c
@@ -2554,7 +2554,7 @@
 }
 
 int ath11k_wmi_send_wmm_update_cmd_tlv(struct ath11k *ar, u32 vdev_id,
-				       struct wmi_wmm_params_all_arg *param)
+				       struct wmi_wmm_params_all_arg *param, u32 wmm_param_type)
 {
 	struct ath11k_pdev_wmi *wmi = ar->wmi;
 	struct wmi_vdev_set_wmm_params_cmd *cmd;
@@ -2573,7 +2573,7 @@
 			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
 
 	cmd->vdev_id = vdev_id;
-	cmd->wmm_param_type = 0;
+	cmd->wmm_param_type = wmm_param_type;
 
 	for (ac = 0; ac < WME_NUM_AC; ac++) {
 		switch (ac) {
@@ -2606,8 +2606,8 @@
 		wmm_param->no_ack = wmi_wmm_arg->no_ack;
 
 		ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
-			   "wmm set ac %d aifs %d cwmin %d cwmax %d txop %d acm %d no_ack %d\n",
-			   ac, wmm_param->aifs, wmm_param->cwmin,
+			   "wmm set type %d ac %d aifs %d cwmin %d cwmax %d txop %d acm %d no_ack %d\n",
+			   wmm_param_type, ac, wmm_param->aifs, wmm_param->cwmin,
 			   wmm_param->cwmax, wmm_param->txoplimit,
 			   wmm_param->acm, wmm_param->no_ack);
 	}
@@ -4749,6 +4749,14 @@
 		soc->pdevs[0].pdev_id = 0;
 	}
 
+	if (!soc->reg_info_store) {
+		soc->reg_info_store = kcalloc(soc->num_radios,
+					      sizeof(*soc->reg_info_store),
+					      GFP_ATOMIC);
+		if (!soc->reg_info_store)
+			return -ENOMEM;
+	}
+
 	return 0;
 }
 
@@ -7060,32 +7068,15 @@
 		wake_up(&wmi->tx_ce_desc_wq);
 }
 
-static bool ath11k_reg_is_world_alpha(char *alpha)
-{
-	if (alpha[0] == '0' && alpha[1] == '0')
-		return true;
-
-	if (alpha[0] == 'n' && alpha[1] == 'a')
-		return true;
-
-	return false;
-}
-
-static int ath11k_reg_chan_list_event(struct ath11k_base *ab,
-				      struct sk_buff *skb,
+static int ath11k_reg_chan_list_event(struct ath11k_base *ab, struct sk_buff *skb,
 				      enum wmi_reg_chan_list_cmd_type id)
 {
-	struct cur_regulatory_info *reg_info = NULL;
-	struct ieee80211_regdomain *regd = NULL;
-	bool intersect = false;
-	int ret = 0, pdev_idx, i, j;
-	struct ath11k *ar;
+	struct cur_regulatory_info *reg_info;
+	int ret;
 
 	reg_info = kzalloc(sizeof(*reg_info), GFP_ATOMIC);
-	if (!reg_info) {
-		ret = -ENOMEM;
-		goto fallback;
-	}
+	if (!reg_info)
+		return -ENOMEM;
 
 	if (id == WMI_REG_CHAN_LIST_CC_ID)
 		ret = ath11k_pull_reg_chan_list_update_ev(ab, skb, reg_info);
@@ -7093,118 +7084,22 @@
 		ret = ath11k_pull_reg_chan_list_ext_update_ev(ab, skb, reg_info);
 
 	if (ret) {
-		ath11k_warn(ab, "failed to extract regulatory info from received event\n");
-		goto fallback;
-	}
-
-	ath11k_dbg(ab, ATH11K_DBG_WMI, "event reg chan list id %d", id);
-
-	if (reg_info->status_code != REG_SET_CC_STATUS_PASS) {
-		/* In case of failure to set the requested ctry,
-		 * fw retains the current regd. We print a failure info
-		 * and return from here.
-		 */
-		ath11k_warn(ab, "Failed to set the requested Country regulatory setting\n");
-		goto mem_free;
-	}
-
-	pdev_idx = reg_info->phy_id;
-
-	/* Avoid default reg rule updates sent during FW recovery if
-	 * it is already available
-	 */
-	spin_lock(&ab->base_lock);
-	if (test_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags) &&
-	    ab->default_regd[pdev_idx]) {
-		spin_unlock(&ab->base_lock);
+		ath11k_warn(ab, "failed to extract regulatory info\n");
 		goto mem_free;
 	}
-	spin_unlock(&ab->base_lock);
 
-	if (pdev_idx >= ab->num_radios) {
-		/* Process the event for phy0 only if single_pdev_only
-		 * is true. If pdev_idx is valid but not 0, discard the
-		 * event. Otherwise, it goes to fallback.
-		 */
-		if (ab->hw_params.single_pdev_only &&
-		    pdev_idx < ab->hw_params.num_rxmda_per_pdev)
-			goto mem_free;
-		else
-			goto fallback;
-	}
-
-	/* Avoid multiple overwrites to default regd, during core
-	 * stop-start after mac registration.
-	 */
-	if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] &&
-	    !memcmp((char *)ab->default_regd[pdev_idx]->alpha2,
-		    (char *)reg_info->alpha2, 2))
+	ret = ath11k_reg_handle_chan_list(ab, reg_info, IEEE80211_REG_UNSET_AP);
+	if (ret) {
+		ath11k_warn(ab, "failed to process regulatory info %d\n", ret);
 		goto mem_free;
-
-	/* Intersect new rules with default regd if a new country setting was
-	 * requested, i.e a default regd was already set during initialization
-	 * and the regd coming from this event has a valid country info.
-	 */
-	if (ab->default_regd[pdev_idx] &&
-	    !ath11k_reg_is_world_alpha((char *)
-		ab->default_regd[pdev_idx]->alpha2) &&
-	    !ath11k_reg_is_world_alpha((char *)reg_info->alpha2))
-		intersect = true;
-
-	regd = ath11k_reg_build_regd(ab, reg_info, intersect);
-	if (!regd) {
-		ath11k_warn(ab, "failed to build regd from reg_info\n");
-		goto fallback;
-	}
-
-	spin_lock(&ab->base_lock);
-	if (ab->default_regd[pdev_idx]) {
-		/* The initial rules from FW after WMI Init is to build
-		 * the default regd. From then on, any rules updated for
-		 * the pdev could be due to user reg changes.
-		 * Free previously built regd before assigning the newly
-		 * generated regd to ar. NULL pointer handling will be
-		 * taken care by kfree itself.
-		 */
-		ar = ab->pdevs[pdev_idx].ar;
-		kfree(ab->new_regd[pdev_idx]);
-		ab->new_regd[pdev_idx] = regd;
-		queue_work(ab->workqueue, &ar->regd_update_work);
-	} else {
-		/* This regd would be applied during mac registration and is
-		 * held constant throughout for regd intersection purpose
-		 */
-		ab->default_regd[pdev_idx] = regd;
 	}
-	ab->dfs_region = reg_info->dfs_region;
-	spin_unlock(&ab->base_lock);
 
-	goto mem_free;
+	kfree(reg_info);
+	return 0;
 
-fallback:
-	/* Fallback to older reg (by sending previous country setting
-	 * again if fw has succeeded and we failed to process here.
-	 * The Regdomain should be uniform across driver and fw. Since the
-	 * FW has processed the command and sent a success status, we expect
-	 * this function to succeed as well. If it doesn't, CTRY needs to be
-	 * reverted at the fw and the old SCAN_CHAN_LIST cmd needs to be sent.
-	 */
-	/* TODO: This is rare, but still should also be handled */
-	WARN_ON(1);
 mem_free:
-	if (reg_info) {
-		kfree(reg_info->reg_rules_2ghz_ptr);
-		kfree(reg_info->reg_rules_5ghz_ptr);
-		if (reg_info->is_ext_reg_event) {
-			for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++)
-				kfree(reg_info->reg_rules_6ghz_ap_ptr[i]);
-
-			for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++)
-				for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++)
-					kfree(reg_info->reg_rules_6ghz_client_ptr[j][i]);
-		}
-		kfree(reg_info);
-	}
+	ath11k_reg_reset_info(reg_info);
+	kfree(reg_info);
 	return ret;
 }
 
@@ -7400,7 +7295,9 @@
 		rcu_read_unlock();
 		return;
 	}
-	ath11k_mac_bcn_tx_event(arvif);
+
+	queue_work(ab->workqueue, &arvif->bcn_tx_work);
+
 	rcu_read_unlock();
 }
 
@@ -9023,7 +8920,7 @@
 	ab->wmi_ab.preferred_hw_mode = WMI_HOST_HW_MODE_MAX;
 
 	/* It's overwritten when service_ext_ready is handled */
-	if (ab->hw_params.single_pdev_only && ab->hw_params.num_rxmda_per_pdev > 1)
+	if (ab->hw_params.single_pdev_only && ab->hw_params.num_rxdma_per_pdev > 1)
 		ab->wmi_ab.preferred_hw_mode = WMI_HOST_HW_MODE_SINGLE;
 
 	/* TODO: Init remaining wmi soc resources required */
@@ -9793,3 +9690,9 @@
 
 	return ath11k_wmi_cmd_send(wmi, skb, WMI_STA_KEEPALIVE_CMDID);
 }
+
+bool ath11k_wmi_supports_6ghz_cc_ext(struct ath11k *ar)
+{
+	return test_bit(WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT,
+			ar->ab->wmi_ab.svc_map) && ar->supports_6ghz;
+}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath11k/wmi.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath11k/wmi.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause-Clear */
 /*
  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef ATH11K_WMI_H
@@ -3399,34 +3399,6 @@
 	const u8 *bssid;
 };
 
-struct wmi_start_scan_arg {
-	u32 scan_id;
-	u32 scan_req_id;
-	u32 vdev_id;
-	u32 scan_priority;
-	u32 notify_scan_events;
-	u32 dwell_time_active;
-	u32 dwell_time_passive;
-	u32 min_rest_time;
-	u32 max_rest_time;
-	u32 repeat_probe_time;
-	u32 probe_spacing_time;
-	u32 idle_time;
-	u32 max_scan_time;
-	u32 probe_delay;
-	u32 scan_ctrl_flags;
-
-	u32 ie_len;
-	u32 n_channels;
-	u32 n_ssids;
-	u32 n_bssids;
-
-	u8 ie[WLAN_SCAN_PARAMS_MAX_IE_LEN];
-	u32 channels[64];
-	struct wmi_ssid_arg ssids[WLAN_SCAN_PARAMS_MAX_SSID];
-	struct wmi_bssid_arg bssids[WLAN_SCAN_PARAMS_MAX_BSSID];
-};
-
 #define WMI_SCAN_STOP_ONE       0x00000000
 #define WMI_SCN_STOP_VAP_ALL    0x01000000
 #define WMI_SCAN_STOP_ALL       0x04000000
@@ -4951,6 +4923,7 @@
 };
 
 enum wmi_vdev_type {
+	WMI_VDEV_TYPE_UNSPEC =  0,
 	WMI_VDEV_TYPE_AP      = 1,
 	WMI_VDEV_TYPE_STA     = 2,
 	WMI_VDEV_TYPE_IBSS    = 3,
@@ -6295,6 +6268,11 @@
 #define WMI_STA_KEEPALIVE_INTERVAL_DEFAULT	30
 #define WMI_STA_KEEPALIVE_INTERVAL_DISABLE	0
 
+enum wmm_edca_params_type {
+	WMM_PARAM_TYPE_LEGACY = 0,
+	WMM_PARAM_TYPE_11AX_MU_EDCA = 1,
+};
+
 const void **ath11k_wmi_tlv_parse_alloc(struct ath11k_base *ab, const void *ptr,
 					size_t len, gfp_t gfp);
 int ath11k_wmi_cmd_send(struct ath11k_pdev_wmi *wmi, struct sk_buff *skb,
@@ -6349,7 +6327,7 @@
 int ath11k_wmi_send_scan_stop_cmd(struct ath11k *ar,
 				  struct scan_cancel_param *param);
 int ath11k_wmi_send_wmm_update_cmd_tlv(struct ath11k *ar, u32 vdev_id,
-				       struct wmi_wmm_params_all_arg *param);
+				       struct wmi_wmm_params_all_arg *param, u32 wmm_param_type);
 int ath11k_wmi_pdev_suspend(struct ath11k *ar, u32 suspend_opt,
 			    u32 pdev_id);
 int ath11k_wmi_pdev_resume(struct ath11k *ar, u32 pdev_id);
@@ -6479,5 +6457,6 @@
 int ath11k_wmi_pdev_set_bios_geo_table_param(struct ath11k *ar);
 int ath11k_wmi_sta_keepalive(struct ath11k *ar,
 			     const struct wmi_sta_keepalive_arg *arg);
+bool ath11k_wmi_supports_6ghz_cc_ext(struct ath11k *ar);
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/Makefile
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/Makefile
@@ -19,7 +19,8 @@
 	    hw.o \
 	    mhi.o \
 	    pci.o \
-	    dp_mon.o
+	    dp_mon.o \
+	    fw.o
 
 ath12k-$(CONFIG_ATH12K_TRACING) += trace.o
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/ce.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/ce.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause-Clear */
 /*
  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef ATH12K_CE_H
@@ -119,7 +119,7 @@
 	/* Host address space */
 	void *base_addr_owner_space_unaligned;
 	/* CE address space */
-	u32 base_addr_ce_space_unaligned;
+	dma_addr_t base_addr_ce_space_unaligned;
 
 	/* Actual start of descriptors.
 	 * Aligned to descriptor-size boundary.
@@ -129,7 +129,7 @@
 	void *base_addr_owner_space;
 
 	/* CE address space */
-	u32 base_addr_ce_space;
+	dma_addr_t base_addr_ce_space;
 
 	/* HAL ring id */
 	u32 hal_ring_id;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/core.c
@@ -14,6 +14,7 @@
 #include "dp_rx.h"
 #include "debug.h"
 #include "hif.h"
+#include "fw.h"
 
 unsigned int ath12k_debug_mask;
 module_param_named(debug_mask, ath12k_debug_mask, uint, 0644);
@@ -104,27 +105,66 @@
 	return 0;
 }
 
-static int ath12k_core_create_board_name(struct ath12k_base *ab, char *name,
-					 size_t name_len)
+static int __ath12k_core_create_board_name(struct ath12k_base *ab, char *name,
+					   size_t name_len, bool with_variant,
+					   bool bus_type_mode)
 {
 	/* strlen(',variant=') + strlen(ab->qmi.target.bdf_ext) */
 	char variant[9 + ATH12K_QMI_BDF_EXT_STR_LENGTH] = { 0 };
 
-	if (ab->qmi.target.bdf_ext[0] != '\0')
+	if (with_variant && ab->qmi.target.bdf_ext[0] != '\0')
 		scnprintf(variant, sizeof(variant), ",variant=%s",
 			  ab->qmi.target.bdf_ext);
 
-	scnprintf(name, name_len,
-		  "bus=%s,qmi-chip-id=%d,qmi-board-id=%d%s",
-		  ath12k_bus_str(ab->hif.bus),
-		  ab->qmi.target.chip_id,
-		  ab->qmi.target.board_id, variant);
+	switch (ab->id.bdf_search) {
+	case ATH12K_BDF_SEARCH_BUS_AND_BOARD:
+		if (bus_type_mode)
+			scnprintf(name, name_len,
+				  "bus=%s",
+				  ath12k_bus_str(ab->hif.bus));
+		else
+			scnprintf(name, name_len,
+				  "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x,qmi-chip-id=%d,qmi-board-id=%d%s",
+				  ath12k_bus_str(ab->hif.bus),
+				  ab->id.vendor, ab->id.device,
+				  ab->id.subsystem_vendor,
+				  ab->id.subsystem_device,
+				  ab->qmi.target.chip_id,
+				  ab->qmi.target.board_id,
+				  variant);
+		break;
+	default:
+		scnprintf(name, name_len,
+			  "bus=%s,qmi-chip-id=%d,qmi-board-id=%d%s",
+			  ath12k_bus_str(ab->hif.bus),
+			  ab->qmi.target.chip_id,
+			  ab->qmi.target.board_id, variant);
+		break;
+	}
 
 	ath12k_dbg(ab, ATH12K_DBG_BOOT, "boot using board name '%s'\n", name);
 
 	return 0;
 }
 
+static int ath12k_core_create_board_name(struct ath12k_base *ab, char *name,
+					 size_t name_len)
+{
+	return __ath12k_core_create_board_name(ab, name, name_len, true, false);
+}
+
+static int ath12k_core_create_fallback_board_name(struct ath12k_base *ab, char *name,
+						  size_t name_len)
+{
+	return __ath12k_core_create_board_name(ab, name, name_len, false, false);
+}
+
+static int ath12k_core_create_bus_type_board_name(struct ath12k_base *ab, char *name,
+						  size_t name_len)
+{
+	return __ath12k_core_create_board_name(ab, name, name_len, false, true);
+}
+
 const struct firmware *ath12k_core_firmware_request(struct ath12k_base *ab,
 						    const char *file)
 {
@@ -159,7 +199,9 @@
 					 struct ath12k_board_data *bd,
 					 const void *buf, size_t buf_len,
 					 const char *boardname,
-					 int bd_ie_type)
+					 int ie_id,
+					 int name_id,
+					 int data_id)
 {
 	const struct ath12k_fw_ie *hdr;
 	bool name_match_found;
@@ -169,7 +211,7 @@
 
 	name_match_found = false;
 
-	/* go through ATH12K_BD_IE_BOARD_ elements */
+	/* go through ATH12K_BD_IE_BOARD_/ATH12K_BD_IE_REGDB_ elements */
 	while (buf_len > sizeof(struct ath12k_fw_ie)) {
 		hdr = buf;
 		board_ie_id = le32_to_cpu(hdr->id);
@@ -180,48 +222,50 @@
 		buf += sizeof(*hdr);
 
 		if (buf_len < ALIGN(board_ie_len, 4)) {
-			ath12k_err(ab, "invalid ATH12K_BD_IE_BOARD length: %zu < %zu\n",
+			ath12k_err(ab, "invalid %s length: %zu < %zu\n",
+				   ath12k_bd_ie_type_str(ie_id),
 				   buf_len, ALIGN(board_ie_len, 4));
 			ret = -EINVAL;
 			goto out;
 		}
 
-		switch (board_ie_id) {
-		case ATH12K_BD_IE_BOARD_NAME:
+		if (board_ie_id == name_id) {
 			ath12k_dbg_dump(ab, ATH12K_DBG_BOOT, "board name", "",
 					board_ie_data, board_ie_len);
 
 			if (board_ie_len != strlen(boardname))
-				break;
+				goto next;
 
 			ret = memcmp(board_ie_data, boardname, strlen(boardname));
 			if (ret)
-				break;
+				goto next;
 
 			name_match_found = true;
 			ath12k_dbg(ab, ATH12K_DBG_BOOT,
-				   "boot found match for name '%s'",
+				   "boot found match %s for name '%s'",
+				   ath12k_bd_ie_type_str(ie_id),
 				   boardname);
-			break;
-		case ATH12K_BD_IE_BOARD_DATA:
+		} else if (board_ie_id == data_id) {
 			if (!name_match_found)
 				/* no match found */
-				break;
+				goto next;
 
 			ath12k_dbg(ab, ATH12K_DBG_BOOT,
-				   "boot found board data for '%s'", boardname);
+				   "boot found %s for '%s'",
+				   ath12k_bd_ie_type_str(ie_id),
+				   boardname);
 
 			bd->data = board_ie_data;
 			bd->len = board_ie_len;
 
 			ret = 0;
 			goto out;
-		default:
-			ath12k_warn(ab, "unknown ATH12K_BD_IE_BOARD found: %d\n",
+		} else {
+			ath12k_warn(ab, "unknown %s id found: %d\n",
+				    ath12k_bd_ie_type_str(ie_id),
 				    board_ie_id);
-			break;
 		}
-
+next:
 		/* jump over the padding */
 		board_ie_len = ALIGN(board_ie_len, 4);
 
@@ -238,7 +282,10 @@
 
 static int ath12k_core_fetch_board_data_api_n(struct ath12k_base *ab,
 					      struct ath12k_board_data *bd,
-					      const char *boardname)
+					      const char *boardname,
+					      int ie_id_match,
+					      int name_id,
+					      int data_id)
 {
 	size_t len, magic_len;
 	const u8 *data;
@@ -303,22 +350,23 @@
 			goto err;
 		}
 
-		switch (ie_id) {
-		case ATH12K_BD_IE_BOARD:
+		if (ie_id == ie_id_match) {
 			ret = ath12k_core_parse_bd_ie_board(ab, bd, data,
 							    ie_len,
 							    boardname,
-							    ATH12K_BD_IE_BOARD);
+							    ie_id_match,
+							    name_id,
+							    data_id);
 			if (ret == -ENOENT)
 				/* no match found, continue */
-				break;
+				goto next;
 			else if (ret)
 				/* there was an error, bail out */
 				goto err;
 			/* either found or error, so stop searching */
 			goto out;
 		}
-
+next:
 		/* jump over the padding */
 		ie_len = ALIGN(ie_len, 4);
 
@@ -328,8 +376,9 @@
 
 out:
 	if (!bd->data || !bd->len) {
-		ath12k_err(ab,
-			   "failed to fetch board data for %s from %s\n",
+		ath12k_dbg(ab, ATH12K_DBG_BOOT,
+			   "failed to fetch %s for %s from %s\n",
+			   ath12k_bd_ie_type_str(ie_id_match),
 			   boardname, filepath);
 		ret = -ENODATA;
 		goto err;
@@ -356,28 +405,56 @@
 	return 0;
 }
 
-#define BOARD_NAME_SIZE 100
+#define BOARD_NAME_SIZE 200
 int ath12k_core_fetch_bdf(struct ath12k_base *ab, struct ath12k_board_data *bd)
 {
-	char boardname[BOARD_NAME_SIZE];
+	char boardname[BOARD_NAME_SIZE], fallback_boardname[BOARD_NAME_SIZE];
+	char *filename, filepath[100];
 	int bd_api;
 	int ret;
 
-	ret = ath12k_core_create_board_name(ab, boardname, BOARD_NAME_SIZE);
+	filename = ATH12K_BOARD_API2_FILE;
+
+	ret = ath12k_core_create_board_name(ab, boardname, sizeof(boardname));
 	if (ret) {
 		ath12k_err(ab, "failed to create board name: %d", ret);
 		return ret;
 	}
 
 	bd_api = 2;
-	ret = ath12k_core_fetch_board_data_api_n(ab, bd, boardname);
+	ret = ath12k_core_fetch_board_data_api_n(ab, bd, boardname,
+						 ATH12K_BD_IE_BOARD,
+						 ATH12K_BD_IE_BOARD_NAME,
+						 ATH12K_BD_IE_BOARD_DATA);
+	if (!ret)
+		goto success;
+
+	ret = ath12k_core_create_fallback_board_name(ab, fallback_boardname,
+						     sizeof(fallback_boardname));
+	if (ret) {
+		ath12k_err(ab, "failed to create fallback board name: %d", ret);
+		return ret;
+	}
+
+	ret = ath12k_core_fetch_board_data_api_n(ab, bd, fallback_boardname,
+						 ATH12K_BD_IE_BOARD,
+						 ATH12K_BD_IE_BOARD_NAME,
+						 ATH12K_BD_IE_BOARD_DATA);
 	if (!ret)
 		goto success;
 
 	bd_api = 1;
 	ret = ath12k_core_fetch_board_data_api_1(ab, bd, ATH12K_DEFAULT_BOARD_FILE);
 	if (ret) {
-		ath12k_err(ab, "failed to fetch board-2.bin or board.bin from %s\n",
+		ath12k_core_create_firmware_path(ab, filename,
+						 filepath, sizeof(filepath));
+		ath12k_err(ab, "failed to fetch board data for %s from %s\n",
+			   boardname, filepath);
+		if (memcmp(boardname, fallback_boardname, strlen(boardname)))
+			ath12k_err(ab, "failed to fetch board data for %s from %s\n",
+				   fallback_boardname, filepath);
+
+		ath12k_err(ab, "failed to fetch board.bin from %s\n",
 			   ab->hw_params->fw.dir);
 		return ret;
 	}
@@ -387,6 +464,52 @@
 	return 0;
 }
 
+int ath12k_core_fetch_regdb(struct ath12k_base *ab, struct ath12k_board_data *bd)
+{
+	char boardname[BOARD_NAME_SIZE], default_boardname[BOARD_NAME_SIZE];
+	int ret;
+
+	ret = ath12k_core_create_board_name(ab, boardname, BOARD_NAME_SIZE);
+	if (ret) {
+		ath12k_dbg(ab, ATH12K_DBG_BOOT,
+			   "failed to create board name for regdb: %d", ret);
+		goto exit;
+	}
+
+	ret = ath12k_core_fetch_board_data_api_n(ab, bd, boardname,
+						 ATH12K_BD_IE_REGDB,
+						 ATH12K_BD_IE_REGDB_NAME,
+						 ATH12K_BD_IE_REGDB_DATA);
+	if (!ret)
+		goto exit;
+
+	ret = ath12k_core_create_bus_type_board_name(ab, default_boardname,
+						     BOARD_NAME_SIZE);
+	if (ret) {
+		ath12k_dbg(ab, ATH12K_DBG_BOOT,
+			   "failed to create default board name for regdb: %d", ret);
+		goto exit;
+	}
+
+	ret = ath12k_core_fetch_board_data_api_n(ab, bd, default_boardname,
+						 ATH12K_BD_IE_REGDB,
+						 ATH12K_BD_IE_REGDB_NAME,
+						 ATH12K_BD_IE_REGDB_DATA);
+	if (!ret)
+		goto exit;
+
+	ret = ath12k_core_fetch_board_data_api_1(ab, bd, ATH12K_REGDB_FILE_NAME);
+	if (ret)
+		ath12k_dbg(ab, ATH12K_DBG_BOOT, "failed to fetch %s from %s\n",
+			   ATH12K_REGDB_FILE_NAME, ab->hw_params->fw.dir);
+
+exit:
+	if (!ret)
+		ath12k_dbg(ab, ATH12K_DBG_BOOT, "fetched regdb\n");
+
+	return ret;
+}
+
 static void ath12k_core_stop(struct ath12k_base *ab)
 {
 	if (!test_bit(ATH12K_FLAG_CRASH_FLUSH, &ab->dev_flags))
@@ -963,7 +1086,6 @@
 						ATH12K_RECOVER_START_TIMEOUT_HZ);
 
 	ath12k_hif_power_down(ab);
-	ath12k_qmi_free_resource(ab);
 	ath12k_hif_power_up(ab);
 
 	ath12k_dbg(ab, ATH12K_DBG_BOOT, "reset started\n");
@@ -979,6 +1101,8 @@
 		return ret;
 	}
 
+	ath12k_fw_map(ab);
+
 	return 0;
 }
 
@@ -1007,6 +1131,7 @@
 	ath12k_hif_power_down(ab);
 	ath12k_mac_destroy(ab);
 	ath12k_core_soc_destroy(ab);
+	ath12k_fw_unmap(ab);
 }
 
 void ath12k_core_free(struct ath12k_base *ab)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/core.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/core.h
@@ -13,6 +13,7 @@
 #include <linux/bitfield.h>
 #include <linux/dmi.h>
 #include <linux/ctype.h>
+#include <linux/firmware.h>
 #include "qmi.h"
 #include "htc.h"
 #include "wmi.h"
@@ -24,6 +25,7 @@
 #include "hal_rx.h"
 #include "reg.h"
 #include "dbring.h"
+#include "fw.h"
 
 #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
 
@@ -55,6 +57,11 @@
 #define ATH12K_RECONFIGURE_TIMEOUT_HZ		(10 * HZ)
 #define ATH12K_RECOVER_START_TIMEOUT_HZ		(20 * HZ)
 
+enum ath12k_bdf_search {
+	ATH12K_BDF_SEARCH_DEFAULT,
+	ATH12K_BDF_SEARCH_BUS_AND_BOARD,
+};
+
 enum wme_ac {
 	WME_AC_BE,
 	WME_AC_BK,
@@ -420,7 +427,7 @@
 };
 
 #define ATH12K_MIN_5G_FREQ 4150
-#define ATH12K_MIN_6G_FREQ 5945
+#define ATH12K_MIN_6G_FREQ 5925
 #define ATH12K_MAX_6G_FREQ 7115
 #define ATH12K_NUM_CHANS 100
 #define ATH12K_MAX_5G_CHAN 173
@@ -793,6 +800,26 @@
 	/* true means radio is on */
 	bool rfkill_radio_on;
 
+	struct {
+		enum ath12k_bdf_search bdf_search;
+		u32 vendor;
+		u32 device;
+		u32 subsystem_vendor;
+		u32 subsystem_device;
+	} id;
+
+	struct {
+		u32 api_version;
+
+		const struct firmware *fw;
+		const u8 *amss_data;
+		size_t amss_len;
+		const u8 *m3_data;
+		size_t m3_len;
+
+		DECLARE_BITMAP(fw_features, ATH12K_FW_FEATURE_COUNT);
+	} fw;
+
 	/* must be last */
 	u8 drv_priv[] __aligned(sizeof(void *));
 };
@@ -810,6 +837,7 @@
 int ath12k_core_fetch_bdf(struct ath12k_base *ath12k,
 			  struct ath12k_board_data *bd);
 void ath12k_core_free_bdf(struct ath12k_base *ab, struct ath12k_board_data *bd);
+int ath12k_core_fetch_regdb(struct ath12k_base *ab, struct ath12k_board_data *bd);
 int ath12k_core_check_dt(struct ath12k_base *ath12k);
 int ath12k_core_check_smbios(struct ath12k_base *ab);
 void ath12k_core_halt(struct ath12k *ar);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/dp.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/dp.c
@@ -127,7 +127,9 @@
 static int ath12k_dp_srng_calculate_msi_group(struct ath12k_base *ab,
 					      enum hal_ring_type type, int ring_num)
 {
+	const struct ath12k_hal_tcl_to_wbm_rbm_map *map;
 	const u8 *grp_mask;
+	int i;
 
 	switch (type) {
 	case HAL_WBM2SW_RELEASE:
@@ -135,6 +137,14 @@
 			grp_mask = &ab->hw_params->ring_mask->rx_wbm_rel[0];
 			ring_num = 0;
 		} else {
+			map = ab->hw_params->hal_ops->tcl_to_wbm_rbm_map;
+			for (i = 0; i < ab->hw_params->max_tx_ring; i++) {
+				if (ring_num == map[i].wbm_ring_num) {
+					ring_num = i;
+					break;
+				}
+			}
+
 			grp_mask = &ab->hw_params->ring_mask->tx[0];
 		}
 		break;
@@ -876,11 +886,9 @@
 	enum dp_monitor_mode monitor_mode;
 	u8 ring_mask;
 
-	while (i < ab->hw_params->max_tx_ring) {
-		if (ab->hw_params->ring_mask->tx[grp_id] &
-			BIT(ab->hw_params->hal_ops->tcl_to_wbm_rbm_map[i].wbm_ring_num))
-			ath12k_dp_tx_completion_handler(ab, i);
-		i++;
+	if (ab->hw_params->ring_mask->tx[grp_id]) {
+		i = fls(ab->hw_params->ring_mask->tx[grp_id]) - 1;
+		ath12k_dp_tx_completion_handler(ab, i);
 	}
 
 	if (ab->hw_params->ring_mask->rx_err[grp_id]) {
@@ -1204,6 +1212,7 @@
 	}
 
 	kfree(dp->spt_info);
+	dp->spt_info = NULL;
 }
 
 static void ath12k_dp_reoq_lut_cleanup(struct ath12k_base *ab)
@@ -1239,8 +1248,10 @@
 
 	ath12k_dp_rx_reo_cmd_list_cleanup(ab);
 
-	for (i = 0; i < ab->hw_params->max_tx_ring; i++)
+	for (i = 0; i < ab->hw_params->max_tx_ring; i++) {
 		kfree(dp->tx_ring[i].tx_status);
+		dp->tx_ring[i].tx_status = NULL;
+	}
 
 	ath12k_dp_rx_free(ab);
 	/* Deinit any SOC level resource */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -2355,8 +2355,10 @@
 	channel_num = meta_data;
 	center_freq = meta_data >> 16;
 
-	if (center_freq >= 5935 && center_freq <= 7105) {
+	if (center_freq >= ATH12K_MIN_6G_FREQ &&
+	    center_freq <= ATH12K_MAX_6G_FREQ) {
 		rx_status->band = NL80211_BAND_6GHZ;
+		rx_status->freq = center_freq;
 	} else if (channel_num >= 1 && channel_num <= 14) {
 		rx_status->band = NL80211_BAND_2GHZ;
 	} else if (channel_num >= 36 && channel_num <= 173) {
@@ -2374,8 +2376,9 @@
 				rx_desc, sizeof(*rx_desc));
 	}
 
-	rx_status->freq = ieee80211_channel_to_frequency(channel_num,
-							 rx_status->band);
+	if (rx_status->band != NL80211_BAND_6GHZ)
+		rx_status->freq = ieee80211_channel_to_frequency(channel_num,
+								 rx_status->band);
 
 	ath12k_dp_rx_h_rate(ar, rx_desc, rx_status);
 }
@@ -2647,7 +2650,7 @@
 		if (push_reason !=
 		    HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION) {
 			dev_kfree_skb_any(msdu);
-			ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++;
+			ab->soc_stats.hal_reo_error[ring_id]++;
 			continue;
 		}
 
@@ -2734,6 +2737,7 @@
 	peer = ath12k_peer_find(ab, vdev_id, peer_mac);
 	if (!peer) {
 		spin_unlock_bh(&ab->base_lock);
+		crypto_free_shash(tfm);
 		ath12k_warn(ab, "failed to find the peer to set up fragment info\n");
 		return -ENOENT;
 	}
@@ -2963,7 +2967,7 @@
 	struct hal_srng *srng;
 	dma_addr_t link_paddr, buf_paddr;
 	u32 desc_bank, msdu_info, msdu_ext_info, mpdu_info;
-	u32 cookie, hal_rx_desc_sz, dest_ring_info0;
+	u32 cookie, hal_rx_desc_sz, dest_ring_info0, queue_addr_hi;
 	int ret;
 	struct ath12k_rx_desc_info *desc_info;
 	u8 dst_ind;
@@ -2999,7 +3003,7 @@
 
 	buf_paddr = dma_map_single(ab->dev, defrag_skb->data,
 				   defrag_skb->len + skb_tailroom(defrag_skb),
-				   DMA_FROM_DEVICE);
+				   DMA_TO_DEVICE);
 	if (dma_mapping_error(ab->dev, buf_paddr))
 		return -ENOMEM;
 
@@ -3055,13 +3059,11 @@
 	reo_ent_ring->rx_mpdu_info.peer_meta_data =
 		reo_dest_ring->rx_mpdu_info.peer_meta_data;
 
-	/* Firmware expects physical address to be filled in queue_addr_lo in
-	 * the MLO scenario and in case of non MLO peer meta data needs to be
-	 * filled.
-	 * TODO: Need to handle for MLO scenario.
-	 */
-	reo_ent_ring->queue_addr_lo = reo_dest_ring->rx_mpdu_info.peer_meta_data;
-	reo_ent_ring->info0 = le32_encode_bits(dst_ind,
+	reo_ent_ring->queue_addr_lo = cpu_to_le32(lower_32_bits(rx_tid->paddr));
+	queue_addr_hi = upper_32_bits(rx_tid->paddr);
+	reo_ent_ring->info0 = le32_encode_bits(queue_addr_hi,
+					       HAL_REO_ENTR_RING_INFO0_QUEUE_ADDR_HI) |
+			      le32_encode_bits(dst_ind,
 					       HAL_REO_ENTR_RING_INFO0_DEST_IND);
 
 	reo_ent_ring->info1 = le32_encode_bits(rx_tid->cur_sn,
@@ -3085,7 +3087,7 @@
 	spin_unlock_bh(&dp->rx_desc_lock);
 err_unmap_dma:
 	dma_unmap_single(ab->dev, buf_paddr, defrag_skb->len + skb_tailroom(defrag_skb),
-			 DMA_FROM_DEVICE);
+			 DMA_TO_DEVICE);
 	return ret;
 }
 
@@ -3956,7 +3958,7 @@
 	struct ath12k_dp *dp = &ab->dp;
 	struct htt_rx_ring_tlv_filter tlv_filter = {0};
 	u32 ring_id;
-	int ret;
+	int ret = 0;
 	u32 hal_rx_desc_sz = ab->hw_params->hal_desc_sz;
 	int i;
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/dp_tx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/dp_tx.c
@@ -124,6 +124,60 @@
 						 HAL_TX_MSDU_EXT_INFO1_ENCRYPT_TYPE);
 }
 
+static void ath12k_dp_tx_move_payload(struct sk_buff *skb,
+				      unsigned long delta,
+				      bool head)
+{
+	unsigned long len = skb->len;
+
+	if (head) {
+		skb_push(skb, delta);
+		memmove(skb->data, skb->data + delta, len);
+		skb_trim(skb, len);
+	} else {
+		skb_put(skb, delta);
+		memmove(skb->data + delta, skb->data, len);
+		skb_pull(skb, delta);
+	}
+}
+
+static int ath12k_dp_tx_align_payload(struct ath12k_base *ab,
+				      struct sk_buff **pskb)
+{
+	u32 iova_mask = ab->hw_params->iova_mask;
+	unsigned long offset, delta1, delta2;
+	struct sk_buff *skb2, *skb = *pskb;
+	unsigned int headroom = skb_headroom(skb);
+	int tailroom = skb_tailroom(skb);
+	int ret = 0;
+
+	offset = (unsigned long)skb->data & iova_mask;
+	delta1 = offset;
+	delta2 = iova_mask - offset + 1;
+
+	if (headroom >= delta1) {
+		ath12k_dp_tx_move_payload(skb, delta1, true);
+	} else if (tailroom >= delta2) {
+		ath12k_dp_tx_move_payload(skb, delta2, false);
+	} else {
+		skb2 = skb_realloc_headroom(skb, iova_mask);
+		if (!skb2) {
+			ret = -ENOMEM;
+			goto out;
+		}
+
+		dev_kfree_skb_any(skb);
+
+		offset = (unsigned long)skb2->data & iova_mask;
+		if (offset)
+			ath12k_dp_tx_move_payload(skb2, offset, true);
+		*pskb = skb2;
+	}
+
+out:
+	return ret;
+}
+
 int ath12k_dp_tx(struct ath12k *ar, struct ath12k_vif *arvif,
 		 struct sk_buff *skb)
 {
@@ -145,6 +199,7 @@
 	u8 ring_selector, ring_map = 0;
 	bool tcl_ring_retry;
 	bool msdu_ext_desc = false;
+	u32 iova_mask = ab->hw_params->iova_mask;
 
 	if (test_bit(ATH12K_FLAG_CRASH_FLUSH, &ar->ab->dev_flags))
 		return -ESHUTDOWN;
@@ -240,6 +295,23 @@
 		goto fail_remove_tx_buf;
 	}
 
+	if (iova_mask &&
+	    (unsigned long)skb->data & iova_mask) {
+		ret = ath12k_dp_tx_align_payload(ab, &skb);
+		if (ret) {
+			ath12k_warn(ab, "failed to align TX buffer %d\n", ret);
+			/* don't bail out, give original buffer
+			 * a chance even unaligned.
+			 */
+			goto map;
+		}
+
+		/* hdr is pointing to a wrong place after alignment,
+		 * so refresh it for later use.
+		 */
+		hdr = (void *)skb->data;
+	}
+map:
 	ti.paddr = dma_map_single(ab->dev, skb->data, skb->len, DMA_TO_DEVICE);
 	if (dma_mapping_error(ab->dev, ti.paddr)) {
 		atomic_inc(&ab->soc_stats.tx_err.misc_fail);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/fw.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/fw.c
@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: BSD-3-Clause-Clear
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "core.h"
+
+#include "debug.h"
+
+static int ath12k_fw_request_firmware_api_n(struct ath12k_base *ab,
+					    const char *name)
+{
+	size_t magic_len, len, ie_len;
+	int ie_id, i, index, bit, ret;
+	struct ath12k_fw_ie *hdr;
+	const u8 *data;
+	__le32 *timestamp;
+
+	ab->fw.fw = ath12k_core_firmware_request(ab, name);
+	if (IS_ERR(ab->fw.fw)) {
+		ret = PTR_ERR(ab->fw.fw);
+		ath12k_dbg(ab, ATH12K_DBG_BOOT, "failed to load %s: %d\n", name, ret);
+		ab->fw.fw = NULL;
+		return ret;
+	}
+
+	data = ab->fw.fw->data;
+	len = ab->fw.fw->size;
+
+	/* magic also includes the null byte, check that as well */
+	magic_len = strlen(ATH12K_FIRMWARE_MAGIC) + 1;
+
+	if (len < magic_len) {
+		ath12k_err(ab, "firmware image too small to contain magic: %zu\n",
+			   len);
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (memcmp(data, ATH12K_FIRMWARE_MAGIC, magic_len) != 0) {
+		ath12k_err(ab, "Invalid firmware magic\n");
+		ret = -EINVAL;
+		goto err;
+	}
+
+	/* jump over the padding */
+	magic_len = ALIGN(magic_len, 4);
+
+	/* make sure there's space for padding */
+	if (magic_len > len) {
+		ath12k_err(ab, "No space for padding after magic\n");
+		ret = -EINVAL;
+		goto err;
+	}
+
+	len -= magic_len;
+	data += magic_len;
+
+	/* loop elements */
+	while (len > sizeof(struct ath12k_fw_ie)) {
+		hdr = (struct ath12k_fw_ie *)data;
+
+		ie_id = le32_to_cpu(hdr->id);
+		ie_len = le32_to_cpu(hdr->len);
+
+		len -= sizeof(*hdr);
+		data += sizeof(*hdr);
+
+		if (len < ie_len) {
+			ath12k_err(ab, "Invalid length for FW IE %d (%zu < %zu)\n",
+				   ie_id, len, ie_len);
+			ret = -EINVAL;
+			goto err;
+		}
+
+		switch (ie_id) {
+		case ATH12K_FW_IE_TIMESTAMP:
+			if (ie_len != sizeof(u32))
+				break;
+
+			timestamp = (__le32 *)data;
+
+			ath12k_dbg(ab, ATH12K_DBG_BOOT, "found fw timestamp %d\n",
+				   le32_to_cpup(timestamp));
+			break;
+		case ATH12K_FW_IE_FEATURES:
+			ath12k_dbg(ab, ATH12K_DBG_BOOT,
+				   "found firmware features ie (%zd B)\n",
+				   ie_len);
+
+			for (i = 0; i < ATH12K_FW_FEATURE_COUNT; i++) {
+				index = i / 8;
+				bit = i % 8;
+
+				if (index == ie_len)
+					break;
+
+				if (data[index] & (1 << bit))
+					__set_bit(i, ab->fw.fw_features);
+			}
+
+			ath12k_dbg_dump(ab, ATH12K_DBG_BOOT, "features", "",
+					ab->fw.fw_features,
+					sizeof(ab->fw.fw_features));
+			break;
+		case ATH12K_FW_IE_AMSS_IMAGE:
+			ath12k_dbg(ab, ATH12K_DBG_BOOT,
+				   "found fw image ie (%zd B)\n",
+				   ie_len);
+
+			ab->fw.amss_data = data;
+			ab->fw.amss_len = ie_len;
+			break;
+		case ATH12K_FW_IE_M3_IMAGE:
+			ath12k_dbg(ab, ATH12K_DBG_BOOT,
+				   "found m3 image ie (%zd B)\n",
+				   ie_len);
+
+			ab->fw.m3_data = data;
+			ab->fw.m3_len = ie_len;
+			break;
+		default:
+			ath12k_warn(ab, "Unknown FW IE: %u\n", ie_id);
+			break;
+		}
+
+		/* jump over the padding */
+		ie_len = ALIGN(ie_len, 4);
+
+		/* make sure there's space for padding */
+		if (ie_len > len)
+			break;
+
+		len -= ie_len;
+		data += ie_len;
+	}
+
+	return 0;
+
+err:
+	release_firmware(ab->fw.fw);
+	ab->fw.fw = NULL;
+	return ret;
+}
+
+void ath12k_fw_map(struct ath12k_base *ab)
+{
+	int ret;
+
+	ret = ath12k_fw_request_firmware_api_n(ab, ATH12K_FW_API2_FILE);
+	if (ret == 0)
+		ab->fw.api_version = 2;
+	else
+		ab->fw.api_version = 1;
+
+	ath12k_dbg(ab, ATH12K_DBG_BOOT, "using fw api %d\n",
+		   ab->fw.api_version);
+}
+
+void ath12k_fw_unmap(struct ath12k_base *ab)
+{
+	release_firmware(ab->fw.fw);
+	memset(&ab->fw, 0, sizeof(ab->fw));
+}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/fw.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/fw.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: BSD-3-Clause-Clear */
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef ATH12K_FW_H
+#define ATH12K_FW_H
+
+#define ATH12K_FW_API2_FILE		"firmware-2.bin"
+#define ATH12K_FIRMWARE_MAGIC		"QCOM-ATH12K-FW"
+
+enum ath12k_fw_ie_type {
+	ATH12K_FW_IE_TIMESTAMP = 0,
+	ATH12K_FW_IE_FEATURES = 1,
+	ATH12K_FW_IE_AMSS_IMAGE = 2,
+	ATH12K_FW_IE_M3_IMAGE = 3,
+};
+
+enum ath12k_fw_features {
+	/* keep last */
+	ATH12K_FW_FEATURE_COUNT,
+};
+
+void ath12k_fw_map(struct ath12k_base *ab);
+void ath12k_fw_unmap(struct ath12k_base *ab);
+
+#endif /* ATH12K_FW_H */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/hal.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/hal.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/dma-mapping.h>
 #include "hal_tx.h"
@@ -449,8 +449,8 @@
 
 static bool ath12k_hw_qcn9274_rx_desc_is_da_mcbc(struct hal_rx_desc *desc)
 {
-	return __le16_to_cpu(desc->u.qcn9274.msdu_end.info5) &
-	       RX_MSDU_END_INFO5_DA_IS_MCBC;
+	return __le32_to_cpu(desc->u.qcn9274.mpdu_start.info6) &
+	       RX_MPDU_START_INFO6_MCAST_BCAST;
 }
 
 static void ath12k_hw_qcn9274_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/hw.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/hw.c
@@ -540,9 +540,6 @@
 	},
 	.rx_mon_dest = {
 		0, 0, 0,
-		ATH12K_RX_MON_RING_MASK_0,
-		ATH12K_RX_MON_RING_MASK_1,
-		ATH12K_RX_MON_RING_MASK_2,
 	},
 	.rx = {
 		0, 0, 0, 0,
@@ -568,16 +565,15 @@
 		ATH12K_HOST2RXDMA_RING_MASK_0,
 	},
 	.tx_mon_dest = {
-		ATH12K_TX_MON_RING_MASK_0,
-		ATH12K_TX_MON_RING_MASK_1,
+		0, 0, 0,
 	},
 };
 
 static const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn7850 = {
 	.tx  = {
 		ATH12K_TX_RING_MASK_0,
+		ATH12K_TX_RING_MASK_1,
 		ATH12K_TX_RING_MASK_2,
-		ATH12K_TX_RING_MASK_4,
 	},
 	.rx_mon_dest = {
 	},
@@ -914,6 +910,8 @@
 		.rfkill_on_level = 0,
 
 		.rddm_size = 0,
+
+		.iova_mask = 0,
 	},
 	{
 		.name = "wcn7850 hw2.0",
@@ -978,6 +976,8 @@
 		.rfkill_on_level = 1,
 
 		.rddm_size = 0x780000,
+
+		.iova_mask = ATH12K_PCIE_MAX_PAYLOAD_SIZE - 1,
 	},
 	{
 		.name = "qcn9274 hw2.0",
@@ -1040,6 +1040,8 @@
 		.rfkill_on_level = 0,
 
 		.rddm_size = 0,
+
+		.iova_mask = 0,
 	},
 };
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/hw.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/hw.h
@@ -66,6 +66,7 @@
 #define TARGET_NUM_WDS_ENTRIES		32
 #define TARGET_DMA_BURST_SIZE		1
 #define TARGET_RX_BATCHMODE		1
+#define TARGET_EMA_MAX_PROFILE_PERIOD	8
 
 #define ATH12K_HW_MAX_QUEUES		4
 #define ATH12K_QUEUE_LEN		4096
@@ -82,6 +83,8 @@
 #define ATH12K_M3_FILE			"m3.bin"
 #define ATH12K_REGDB_FILE_NAME		"regdb.bin"
 
+#define ATH12K_PCIE_MAX_PAYLOAD_SIZE	128
+
 enum ath12k_hw_rate_cck {
 	ATH12K_HW_RATE_CCK_LP_11M = 0,
 	ATH12K_HW_RATE_CCK_LP_5_5M,
@@ -192,6 +195,8 @@
 	u32 rfkill_on_level;
 
 	u32 rddm_size;
+
+	u32 iova_mask;
 };
 
 struct ath12k_hw_ops {
@@ -242,10 +247,16 @@
 	ATH12K_BD_IE_BOARD_DATA = 1,
 };
 
+enum ath12k_bd_ie_regdb_type {
+	ATH12K_BD_IE_REGDB_NAME = 0,
+	ATH12K_BD_IE_REGDB_DATA = 1,
+};
+
 enum ath12k_bd_ie_type {
 	/* contains sub IEs of enum ath12k_bd_ie_board_type */
 	ATH12K_BD_IE_BOARD = 0,
-	ATH12K_BD_IE_BOARD_EXT = 1,
+	/* contains sub IEs of enum ath12k_bd_ie_regdb_type */
+	ATH12K_BD_IE_REGDB = 1,
 };
 
 struct ath12k_hw_regs {
@@ -315,6 +326,18 @@
 	u32 hal_reo_status_ring_base;
 };
 
+static inline const char *ath12k_bd_ie_type_str(enum ath12k_bd_ie_type type)
+{
+	switch (type) {
+	case ATH12K_BD_IE_BOARD:
+		return "board data";
+	case ATH12K_BD_IE_REGDB:
+		return "regdb data";
+	}
+
+	return "unknown";
+}
+
 int ath12k_hw_init(struct ath12k_base *ab);
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/mac.c
@@ -780,7 +780,10 @@
 
 	spin_lock_bh(&ab->base_lock);
 	list_for_each_entry_safe(peer, tmp, &ab->peers, list) {
-		ath12k_dp_rx_peer_tid_cleanup(ar, peer);
+		/* Skip Rx TID cleanup for self peer */
+		if (peer->sta)
+			ath12k_dp_rx_peer_tid_cleanup(ar, peer);
+
 		list_del(&peer->list);
 		kfree(peer);
 	}
@@ -1619,7 +1622,9 @@
 {
 	const struct ieee80211_sta_he_cap *he_cap = &sta->deflink.he_cap;
 	int i;
-	u8 ampdu_factor, rx_mcs_80, rx_mcs_160, max_nss;
+	u8 ampdu_factor, max_nss;
+	u8 rx_mcs_80 = IEEE80211_HE_MCS_NOT_SUPPORTED;
+	u8 rx_mcs_160 = IEEE80211_HE_MCS_NOT_SUPPORTED;
 	u16 mcs_160_map, mcs_80_map;
 	bool support_160;
 	u16 v;
@@ -1684,9 +1689,8 @@
 	 * request, then use MAX_AMPDU_LEN_FACTOR as 16 to calculate max_ampdu
 	 * length.
 	 */
-	ampdu_factor = (he_cap->he_cap_elem.mac_cap_info[3] &
-			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK) >>
-			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK;
+	ampdu_factor = u8_get_bits(he_cap->he_cap_elem.mac_cap_info[3],
+				   IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK);
 
 	if (ampdu_factor) {
 		if (sta->deflink.vht_cap.vht_supported)
@@ -3361,6 +3365,11 @@
 
 	ath12k_peer_assoc_prepare(ar, vif, sta, &peer_arg, reassoc);
 
+	if (peer_arg.peer_nss < 1) {
+		ath12k_warn(ar->ab,
+			    "invalid peer NSS %d\n", peer_arg.peer_nss);
+		return -EINVAL;
+	}
 	ret = ath12k_wmi_send_peer_assoc_cmd(ar, &peer_arg);
 	if (ret) {
 		ath12k_warn(ar->ab, "failed to run peer assoc for STA %pM vdev %i: %d\n",
@@ -5269,7 +5278,7 @@
 	do {
 		if (ab->free_vdev_stats_id_map & (1LL << vdev_stats_id)) {
 			vdev_stats_id++;
-			if (vdev_stats_id <= ATH12K_INVAL_VDEV_STATS_ID) {
+			if (vdev_stats_id >= ATH12K_MAX_VDEV_STATS_ID) {
 				vdev_stats_id = ATH12K_INVAL_VDEV_STATS_ID;
 				break;
 			}
@@ -5911,14 +5920,24 @@
 				     enum nl80211_band band,
 				     enum nl80211_iftype type)
 {
-	struct ieee80211_sta_eht_cap *eht_cap;
+	struct ieee80211_sta_eht_cap *eht_cap = NULL;
 	enum wmi_phy_mode down_mode;
+	int n = ar->mac.sbands[band].n_iftype_data;
+	int i;
+	struct ieee80211_sband_iftype_data *data;
 
 	if (mode < MODE_11BE_EHT20)
 		return mode;
 
-	eht_cap = &ar->mac.iftype[band][type].eht_cap;
-	if (eht_cap->has_eht)
+	data = ar->mac.iftype[band];
+	for (i = 0; i < n; i++) {
+		if (data[i].types_mask & BIT(type)) {
+			eht_cap = &data[i].eht_cap;
+			break;
+		}
+	}
+
+	if (eht_cap && eht_cap->has_eht)
 		return mode;
 
 	switch (mode) {
@@ -6845,9 +6864,9 @@
 				    arvif->vdev_id, ret);
 			return ret;
 		}
-		ieee80211_iterate_stations_atomic(hw,
-						  ath12k_mac_disable_peer_fixed_rate,
-						  arvif);
+		ieee80211_iterate_stations_mtx(hw,
+					       ath12k_mac_disable_peer_fixed_rate,
+					       arvif);
 	} else if (ath12k_mac_bitrate_mask_get_single_nss(ar, band, mask,
 							  &single_nss)) {
 		rate = WMI_FIXED_RATE_NONE;
@@ -6891,16 +6910,16 @@
 			return -EINVAL;
 		}
 
-		ieee80211_iterate_stations_atomic(hw,
-						  ath12k_mac_disable_peer_fixed_rate,
-						  arvif);
+		ieee80211_iterate_stations_mtx(hw,
+					       ath12k_mac_disable_peer_fixed_rate,
+					       arvif);
 
 		mutex_lock(&ar->conf_mutex);
 
 		arvif->bitrate_mask = *mask;
-		ieee80211_iterate_stations_atomic(hw,
-						  ath12k_mac_set_bitrate_mask_iter,
-						  arvif);
+		ieee80211_iterate_stations_mtx(hw,
+					       ath12k_mac_set_bitrate_mask_iter,
+					       arvif);
 
 		mutex_unlock(&ar->conf_mutex);
 	}
@@ -7198,7 +7217,7 @@
 	}
 
 	if (supported_bands & WMI_HOST_WLAN_5G_CAP) {
-		if (reg_cap->high_5ghz_chan >= ATH12K_MAX_6G_FREQ) {
+		if (reg_cap->high_5ghz_chan >= ATH12K_MIN_6G_FREQ) {
 			channels = kmemdup(ath12k_6ghz_channels,
 					   sizeof(ath12k_6ghz_channels), GFP_KERNEL);
 			if (!channels) {
@@ -7314,19 +7333,23 @@
 
 static const u8 ath12k_if_types_ext_capa[] = {
 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
+	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
 };
 
 static const u8 ath12k_if_types_ext_capa_sta[] = {
 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
+	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
 	[9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
 };
 
 static const u8 ath12k_if_types_ext_capa_ap[] = {
 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
+	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
 	[9] = WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT,
+	[10] = WLAN_EXT_CAPA11_EMA_SUPPORT,
 };
 
 static const struct wiphy_iftype_ext_capab ath12k_iftypes_ext_capa[] = {
@@ -7495,6 +7518,7 @@
 
 	hw->vif_data_size = sizeof(struct ath12k_vif);
 	hw->sta_data_size = sizeof(struct ath12k_sta);
+	hw->extra_tx_headroom = ab->hw_params->iova_mask;
 
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STA_TX_PWR);
@@ -7505,6 +7529,9 @@
 	wiphy->iftype_ext_capab = ath12k_iftypes_ext_capa;
 	wiphy->num_iftype_ext_capab = ARRAY_SIZE(ath12k_iftypes_ext_capa);
 
+	wiphy->mbssid_max_interfaces = TARGET_NUM_VDEVS;
+	wiphy->ema_max_profile_periodicity = TARGET_EMA_MAX_PROFILE_PERIOD;
+
 	if (ar->supports_6ghz) {
 		wiphy_ext_feature_set(wiphy,
 				      NL80211_EXT_FEATURE_FILS_DISCOVERY);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/mhi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/mhi.c
@@ -1,11 +1,12 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2020-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/msi.h>
 #include <linux/pci.h>
+#include <linux/firmware.h>
 
 #include "core.h"
 #include "debug.h"
@@ -364,17 +365,24 @@
 	if (!mhi_ctrl)
 		return -ENOMEM;
 
-	ath12k_core_create_firmware_path(ab, ATH12K_AMSS_FILE,
-					 ab_pci->amss_path,
-					 sizeof(ab_pci->amss_path));
-
 	ab_pci->mhi_ctrl = mhi_ctrl;
 	mhi_ctrl->cntrl_dev = ab->dev;
-	mhi_ctrl->fw_image = ab_pci->amss_path;
 	mhi_ctrl->regs = ab->mem;
 	mhi_ctrl->reg_len = ab->mem_len;
 	mhi_ctrl->rddm_size = ab->hw_params->rddm_size;
 
+	if (ab->fw.amss_data && ab->fw.amss_len > 0) {
+		/* use MHI firmware file from firmware-N.bin */
+		mhi_ctrl->fw_data = ab->fw.amss_data;
+		mhi_ctrl->fw_sz = ab->fw.amss_len;
+	} else {
+		/* use the old separate mhi.bin MHI firmware file */
+		ath12k_core_create_firmware_path(ab, ATH12K_AMSS_FILE,
+						 ab_pci->amss_path,
+						 sizeof(ab_pci->amss_path));
+		mhi_ctrl->fw_image = ab_pci->amss_path;
+	}
+
 	ret = ath12k_mhi_get_msi(ab_pci);
 	if (ret) {
 		ath12k_err(ab, "failed to get msi for mhi\n");
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/pci.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/pci.c
@@ -469,7 +469,8 @@
 {
 	int i;
 
-	clear_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags);
+	if (!test_and_clear_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags))
+		return;
 
 	for (i = 0; i < ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {
 		struct ath12k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
@@ -1057,14 +1058,14 @@
 {
 	int i;
 
-	set_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags);
-
 	for (i = 0; i < ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {
 		struct ath12k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
 
 		napi_enable(&irq_grp->napi);
 		ath12k_pci_ext_grp_enable(irq_grp);
 	}
+
+	set_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags);
 }
 
 void ath12k_pci_ext_irq_disable(struct ath12k_base *ab)
@@ -1310,6 +1311,15 @@
 		goto err_free_core;
 	}
 
+	ath12k_dbg(ab, ATH12K_DBG_BOOT, "pci probe %04x:%04x %04x:%04x\n",
+		   pdev->vendor, pdev->device,
+		   pdev->subsystem_vendor, pdev->subsystem_device);
+
+	ab->id.vendor = pdev->vendor;
+	ab->id.device = pdev->device;
+	ab->id.subsystem_vendor = pdev->subsystem_vendor;
+	ab->id.subsystem_device = pdev->subsystem_device;
+
 	switch (pci_dev->device) {
 	case QCN9274_DEVICE_ID:
 		ab_pci->msi_config = &ath12k_msi_config[0];
@@ -1333,6 +1343,7 @@
 		}
 		break;
 	case WCN7850_DEVICE_ID:
+		ab->id.bdf_search = ATH12K_BDF_SEARCH_BUS_AND_BOARD;
 		ab_pci->msi_config = &ath12k_msi_config[0];
 		ab->static_window_map = false;
 		ab_pci->pci_ops = &ath12k_pci_ops_wcn7850;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/qmi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/qmi.c
@@ -1977,6 +1977,7 @@
 			       QMI_WLANFW_HOST_CAP_REQ_MSG_V01_MAX_LEN,
 			       qmi_wlanfw_host_cap_req_msg_v01_ei, &req);
 	if (ret < 0) {
+		qmi_txn_cancel(&txn);
 		ath12k_warn(ab, "Failed to send host capability request,err = %d\n", ret);
 		goto out;
 	}
@@ -2040,6 +2041,7 @@
 			       QMI_WLANFW_IND_REGISTER_REQ_MSG_V01_MAX_LEN,
 			       qmi_wlanfw_ind_register_req_msg_v01_ei, req);
 	if (ret < 0) {
+		qmi_txn_cancel(&txn);
 		ath12k_warn(ab, "Failed to send indication register request, err = %d\n",
 			    ret);
 		goto out;
@@ -2114,6 +2116,7 @@
 			       QMI_WLANFW_RESPOND_MEM_REQ_MSG_V01_MAX_LEN,
 			       qmi_wlanfw_respond_mem_req_msg_v01_ei, req);
 	if (ret < 0) {
+		qmi_txn_cancel(&txn);
 		ath12k_warn(ab, "qmi failed to respond memory request, err = %d\n",
 			    ret);
 		goto out;
@@ -2149,8 +2152,9 @@
 	for (i = 0; i < ab->qmi.mem_seg_count; i++) {
 		if (!ab->qmi.target_mem[i].v.addr)
 			continue;
+
 		dma_free_coherent(ab->dev,
-				  ab->qmi.target_mem[i].size,
+				  ab->qmi.target_mem[i].prev_size,
 				  ab->qmi.target_mem[i].v.addr,
 				  ab->qmi.target_mem[i].paddr);
 		ab->qmi.target_mem[i].v.addr = NULL;
@@ -2176,6 +2180,20 @@
 		case M3_DUMP_REGION_TYPE:
 		case PAGEABLE_MEM_REGION_TYPE:
 		case CALDB_MEM_REGION_TYPE:
+			/* Firmware reloads in recovery/resume.
+			 * In such cases, no need to allocate memory for FW again.
+			 */
+			if (chunk->v.addr) {
+				if (chunk->prev_type == chunk->type &&
+				    chunk->prev_size == chunk->size)
+					goto this_chunk_done;
+
+				/* cannot reuse the existing chunk */
+				dma_free_coherent(ab->dev, chunk->prev_size,
+						  chunk->v.addr, chunk->paddr);
+				chunk->v.addr = NULL;
+			}
+
 			chunk->v.addr = dma_alloc_coherent(ab->dev,
 							   chunk->size,
 							   &chunk->paddr,
@@ -2194,6 +2212,10 @@
 					    chunk->type, chunk->size);
 				return -ENOMEM;
 			}
+
+			chunk->prev_type = chunk->type;
+			chunk->prev_size = chunk->size;
+this_chunk_done:
 			break;
 		default:
 			ath12k_warn(ab, "memory type %u not supported\n",
@@ -2229,6 +2251,7 @@
 			       QMI_WLANFW_CAP_REQ_MSG_V01_MAX_LEN,
 			       qmi_wlanfw_cap_req_msg_v01_ei, &req);
 	if (ret < 0) {
+		qmi_txn_cancel(&txn);
 		ath12k_warn(ab, "qmi failed to send target cap request, err = %d\n",
 			    ret);
 		goto out;
@@ -2313,7 +2336,7 @@
 	struct qmi_wlanfw_bdf_download_resp_msg_v01 resp;
 	struct qmi_txn txn = {};
 	const u8 *temp = data;
-	int ret;
+	int ret = 0;
 	u32 remaining = len;
 
 	req = kzalloc(sizeof(*req), GFP_KERNEL);
@@ -2423,8 +2446,7 @@
 
 		break;
 	case ATH12K_QMI_BDF_TYPE_REGDB:
-		ret = ath12k_core_fetch_board_data_api_1(ab, &bd,
-							 ATH12K_REGDB_FILE_NAME);
+		ret = ath12k_core_fetch_regdb(ab, &bd);
 		if (ret) {
 			ath12k_warn(ab, "qmi failed to load regdb bin:\n");
 			goto out;
@@ -2494,53 +2516,78 @@
 	return ret;
 }
 
+static void ath12k_qmi_m3_free(struct ath12k_base *ab)
+{
+	struct m3_mem_region *m3_mem = &ab->qmi.m3_mem;
+
+	if (!m3_mem->vaddr)
+		return;
+
+	dma_free_coherent(ab->dev, m3_mem->size,
+			  m3_mem->vaddr, m3_mem->paddr);
+	m3_mem->vaddr = NULL;
+	m3_mem->size = 0;
+}
+
 static int ath12k_qmi_m3_load(struct ath12k_base *ab)
 {
 	struct m3_mem_region *m3_mem = &ab->qmi.m3_mem;
-	const struct firmware *fw;
+	const struct firmware *fw = NULL;
+	const void *m3_data;
 	char path[100];
+	size_t m3_len;
 	int ret;
 
-	if (m3_mem->vaddr || m3_mem->size)
-		return 0;
+	if (ab->fw.m3_data && ab->fw.m3_len > 0) {
+		/* firmware-N.bin had a m3 firmware file so use that */
+		m3_data = ab->fw.m3_data;
+		m3_len = ab->fw.m3_len;
+	} else {
+		/* No m3 file in firmware-N.bin so try to request old
+		 * separate m3.bin.
+		 */
+		fw = ath12k_core_firmware_request(ab, ATH12K_M3_FILE);
+		if (IS_ERR(fw)) {
+			ret = PTR_ERR(fw);
+			ath12k_core_create_firmware_path(ab, ATH12K_M3_FILE,
+							 path, sizeof(path));
+			ath12k_err(ab, "failed to load %s: %d\n", path, ret);
+			return ret;
+		}
+
+		m3_data = fw->data;
+		m3_len = fw->size;
+	}
+
+	/* In recovery/resume cases, M3 buffer is not freed, try to reuse that */
+	if (m3_mem->vaddr) {
+		if (m3_mem->size >= m3_len)
+			goto skip_m3_alloc;
 
-	fw = ath12k_core_firmware_request(ab, ATH12K_M3_FILE);
-	if (IS_ERR(fw)) {
-		ret = PTR_ERR(fw);
-		ath12k_core_create_firmware_path(ab, ATH12K_M3_FILE,
-						 path, sizeof(path));
-		ath12k_err(ab, "failed to load %s: %d\n", path, ret);
-		return ret;
+		/* Old buffer is too small, free and reallocate */
+		ath12k_qmi_m3_free(ab);
 	}
 
 	m3_mem->vaddr = dma_alloc_coherent(ab->dev,
-					   fw->size, &m3_mem->paddr,
+					   m3_len, &m3_mem->paddr,
 					   GFP_KERNEL);
 	if (!m3_mem->vaddr) {
 		ath12k_err(ab, "failed to allocate memory for M3 with size %zu\n",
 			   fw->size);
-		release_firmware(fw);
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto out;
 	}
 
-	memcpy(m3_mem->vaddr, fw->data, fw->size);
-	m3_mem->size = fw->size;
-	release_firmware(fw);
+skip_m3_alloc:
+	memcpy(m3_mem->vaddr, m3_data, m3_len);
+	m3_mem->size = m3_len;
 
-	return 0;
-}
-
-static void ath12k_qmi_m3_free(struct ath12k_base *ab)
-{
-	struct m3_mem_region *m3_mem = &ab->qmi.m3_mem;
+	ret = 0;
 
-	if (!m3_mem->vaddr)
-		return;
+out:
+	release_firmware(fw);
 
-	dma_free_coherent(ab->dev, m3_mem->size,
-			  m3_mem->vaddr, m3_mem->paddr);
-	m3_mem->vaddr = NULL;
-	m3_mem->size = 0;
+	return ret;
 }
 
 static int ath12k_qmi_wlanfw_m3_info_send(struct ath12k_base *ab)
@@ -2573,6 +2620,7 @@
 			       QMI_WLANFW_M3_INFO_REQ_MSG_V01_MAX_MSG_LEN,
 			       qmi_wlanfw_m3_info_req_msg_v01_ei, &req);
 	if (ret < 0) {
+		qmi_txn_cancel(&txn);
 		ath12k_warn(ab, "qmi failed to send M3 information request, err = %d\n",
 			    ret);
 		goto out;
@@ -2619,6 +2667,7 @@
 			       QMI_WLANFW_WLAN_MODE_REQ_MSG_V01_MAX_LEN,
 			       qmi_wlanfw_wlan_mode_req_msg_v01_ei, &req);
 	if (ret < 0) {
+		qmi_txn_cancel(&txn);
 		ath12k_warn(ab, "qmi failed to send mode request, mode: %d, err = %d\n",
 			    mode, ret);
 		goto out;
@@ -2710,6 +2759,7 @@
 			       QMI_WLANFW_WLAN_CFG_REQ_MSG_V01_MAX_LEN,
 			       qmi_wlanfw_wlan_cfg_req_msg_v01_ei, req);
 	if (ret < 0) {
+		qmi_txn_cancel(&txn);
 		ath12k_warn(ab, "qmi failed to send wlan config request, err = %d\n",
 			    ret);
 		goto out;
@@ -2941,6 +2991,9 @@
 		.decoded_size = sizeof(struct qmi_wlanfw_fw_ready_ind_msg_v01),
 		.fn = ath12k_qmi_msg_fw_ready_cb,
 	},
+
+	/* end of list */
+	{},
 };
 
 static int ath12k_qmi_ops_new_server(struct qmi_handle *qmi_hdl,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/qmi.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/qmi.h
@@ -97,6 +97,8 @@
 struct target_mem_chunk {
 	u32 size;
 	u32 type;
+	u32 prev_size;
+	u32 prev_type;
 	dma_addr_t paddr;
 	union {
 		void __iomem *ioaddr;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/reg.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/reg.c
@@ -103,7 +103,7 @@
 
 	bands = hw->wiphy->bands;
 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
-		if (!bands[band])
+		if (!(ar->mac.sbands[band].channels && bands[band]))
 			continue;
 
 		for (i = 0; i < bands[band]->n_channels; i++) {
@@ -129,7 +129,7 @@
 	ch = arg->channel;
 
 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
-		if (!bands[band])
+		if (!(ar->mac.sbands[band].channels && bands[band]))
 			continue;
 
 		for (i = 0; i < bands[band]->n_channels; i++) {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/wmi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/wmi.c
@@ -228,6 +228,9 @@
 	config->peer_map_unmap_version = 0x32;
 	config->twt_ap_pdev_count = ab->num_radios;
 	config->twt_ap_sta_count = 1000;
+	config->ema_max_vap_cnt = ab->num_radios;
+	config->ema_max_profile_period = TARGET_EMA_MAX_PROFILE_PERIOD;
+	config->beacon_tx_offload_max_vdev += config->ema_max_vap_cnt;
 }
 
 void ath12k_wmi_init_wcn7850(struct ath12k_base *ab,
@@ -1503,6 +1506,7 @@
 	cmd->tlv_header = ath12k_wmi_tlv_cmd_hdr(WMI_TAG_PDEV_BSS_CHAN_INFO_REQUEST,
 						 sizeof(*cmd));
 	cmd->req_type = cpu_to_le32(type);
+	cmd->pdev_id = cpu_to_le32(ar->pdev->pdev_id);
 
 	ath12k_dbg(ar->ab, ATH12K_DBG_WMI,
 		   "WMI bss chan info req type %d\n", type);
@@ -1836,7 +1840,7 @@
 		if (arg->bw_160)
 			cmd->peer_flags |= cpu_to_le32(WMI_PEER_160MHZ);
 		if (arg->bw_320)
-			cmd->peer_flags |= cpu_to_le32(WMI_PEER_EXT_320MHZ);
+			cmd->peer_flags_ext |= cpu_to_le32(WMI_PEER_EXT_320MHZ);
 
 		/* Typically if STBC is enabled for VHT it should be enabled
 		 * for HT as well
@@ -3267,6 +3271,9 @@
 	wmi_cfg->twt_ap_sta_count = cpu_to_le32(tg_cfg->twt_ap_sta_count);
 	wmi_cfg->host_service_flags = cpu_to_le32(tg_cfg->is_reg_cc_ext_event_supported <<
 				WMI_RSRC_CFG_HOST_SVC_FLAG_REG_CC_EXT_SUPPORT_BIT);
+	wmi_cfg->ema_max_vap_cnt = cpu_to_le32(tg_cfg->ema_max_vap_cnt);
+	wmi_cfg->ema_max_profile_period = cpu_to_le32(tg_cfg->ema_max_profile_period);
+	wmi_cfg->flags2 |= cpu_to_le32(WMI_RSRC_CFG_FLAGS2_CALC_NEXT_DTIM_COUNT_SET);
 }
 
 static int ath12k_init_cmd_send(struct ath12k_wmi_pdev *wmi,
@@ -5799,8 +5806,10 @@
 	if (rx_ev.status & WMI_RX_STATUS_ERR_MIC)
 		status->flag |= RX_FLAG_MMIC_ERROR;
 
-	if (rx_ev.chan_freq >= ATH12K_MIN_6G_FREQ) {
+	if (rx_ev.chan_freq >= ATH12K_MIN_6G_FREQ &&
+	    rx_ev.chan_freq <= ATH12K_MAX_6G_FREQ) {
 		status->band = NL80211_BAND_6GHZ;
+		status->freq = rx_ev.chan_freq;
 	} else if (rx_ev.channel >= 1 && rx_ev.channel <= 14) {
 		status->band = NL80211_BAND_2GHZ;
 	} else if (rx_ev.channel >= 36 && rx_ev.channel <= ATH12K_MAX_5G_CHAN) {
@@ -5821,8 +5830,10 @@
 
 	sband = &ar->mac.sbands[status->band];
 
-	status->freq = ieee80211_channel_to_frequency(rx_ev.channel,
-						      status->band);
+	if (status->band != NL80211_BAND_6GHZ)
+		status->freq = ieee80211_channel_to_frequency(rx_ev.channel,
+							      status->band);
+
 	status->signal = rx_ev.snr + ATH12K_DEFAULT_NOISE_FLOOR;
 	status->rate_idx = ath12k_mac_bitrate_to_idx(sband, rx_ev.rate / 100);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath12k/wmi.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath12k/wmi.h
@@ -2350,6 +2350,8 @@
 	u32 twt_ap_pdev_count;
 	u32 twt_ap_sta_count;
 	bool is_reg_cc_ext_event_supported;
+	u32 ema_max_vap_cnt;
+	u32 ema_max_profile_period;
 };
 
 struct ath12k_wmi_init_cmd_arg {
@@ -2402,6 +2404,7 @@
 } __packed;
 
 #define WMI_RSRC_CFG_HOST_SVC_FLAG_REG_CC_EXT_SUPPORT_BIT 4
+#define WMI_RSRC_CFG_FLAGS2_CALC_NEXT_DTIM_COUNT_SET      BIT(9)
 
 struct ath12k_wmi_resource_config_params {
 	__le32 tlv_header;
@@ -3064,6 +3067,7 @@
 	__le32 tlv_header;
 	/* ref wmi_bss_chan_info_req_type */
 	__le32 req_type;
+	__le32 pdev_id;
 } __packed;
 
 struct wmi_ap_ps_peer_cmd {
@@ -4014,7 +4018,6 @@
 } __packed;
 
 struct wmi_pdev_bss_chan_info_event {
-	__le32 pdev_id;
 	__le32 freq;	/* Units in MHz */
 	__le32 noise_floor;	/* units are dBm */
 	/* rx clear - how often the channel was unused */
@@ -4032,6 +4035,7 @@
 	/*rx_cycle cnt for my bss in 64bits format */
 	__le32 rx_bss_cycle_count_low;
 	__le32 rx_bss_cycle_count_high;
+	__le32 pdev_id;
 } __packed;
 
 #define WMI_VDEV_INSTALL_KEY_COMPL_STATUS_SUCCESS 0
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath5k/pci.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath5k/pci.c
@@ -46,6 +46,8 @@
 	{ PCI_VDEVICE(ATHEROS, 0x001b) }, /* 5413 Eagle */
 	{ PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */
 	{ PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */
+	{ PCI_VDEVICE(ATHEROS, 0xff16) }, /* Gigaset SX76[23] AR241[34]A */
+	{ PCI_VDEVICE(ATHEROS, 0xff1a) }, /* Arcadyan ARV45XX AR2417 */
 	{ PCI_VDEVICE(ATHEROS, 0xff1b) }, /* AR5BXB63 */
 	{ 0 }
 };
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/antenna.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/antenna.c
@@ -643,7 +643,7 @@
 				conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
 				conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
 			} else if (antcomb->rssi_sub >
-				   antcomb->rssi_lna1) {
+				   antcomb->rssi_lna2) {
 				/* set to A-B */
 				conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
 				conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/debug.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/debug.c
@@ -1325,11 +1325,11 @@
 	struct ath_softc *sc = hw->priv;
 	int i = 0;
 
-	data[i++] = (sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_pkts_all +
+	data[i++] = ((u64)sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_pkts_all +
 		     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].tx_pkts_all +
 		     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].tx_pkts_all +
 		     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].tx_pkts_all);
-	data[i++] = (sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_bytes_all +
+	data[i++] = ((u64)sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_bytes_all +
 		     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].tx_bytes_all +
 		     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].tx_bytes_all +
 		     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].tx_bytes_all);
@@ -1380,8 +1380,6 @@
 
 	sc->debug.debugfs_phy = debugfs_create_dir("ath9k",
 						   sc->hw->wiphy->debugfsdir);
-	if (IS_ERR(sc->debug.debugfs_phy))
-		return -ENOMEM;
 
 #ifdef CONFIG_ATH_DEBUG
 	debugfs_create_file("debug", 0600, sc->debug.debugfs_phy,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -716,8 +716,7 @@
 	}
 
 resubmit:
-	skb_reset_tail_pointer(skb);
-	skb_trim(skb, 0);
+	__skb_set_length(skb, 0);
 
 	usb_anchor_urb(urb, &hif_dev->rx_submitted);
 	ret = usb_submit_urb(urb, GFP_ATOMIC);
@@ -754,8 +753,7 @@
 	case -ESHUTDOWN:
 		goto free_skb;
 	default:
-		skb_reset_tail_pointer(skb);
-		skb_trim(skb, 0);
+		__skb_set_length(skb, 0);
 
 		goto resubmit;
 	}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/htc.h
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/htc.h
@@ -306,7 +306,6 @@
 	DECLARE_BITMAP(tx_slot, MAX_TX_BUF_NUM);
 	struct timer_list cleanup_timer;
 	spinlock_t tx_lock;
-	bool initialized;
 };
 
 struct ath9k_htc_tx_ctl {
@@ -515,6 +514,7 @@
 	unsigned long ps_usecount;
 	bool ps_enabled;
 	bool ps_idle;
+	bool initialized;
 
 #ifdef CONFIG_MAC80211_LEDS
 	enum led_brightness brightness;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -486,8 +486,6 @@
 
 	priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME,
 					     priv->hw->wiphy->debugfsdir);
-	if (IS_ERR(priv->debug.debugfs_phy))
-		return -ENOMEM;
 
 	ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -966,6 +966,10 @@
 
 	htc_handle->drv_priv = priv;
 
+	/* Allow ath9k_wmi_event_tasklet() to operate. */
+	smp_wmb();
+	priv->initialized = true;
+
 	return 0;
 
 err_init:
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -815,10 +815,6 @@
 	skb_queue_head_init(&priv->tx.data_vo_queue);
 	skb_queue_head_init(&priv->tx.tx_failed);
 
-	/* Allow ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) to operate. */
-	smp_wmb();
-	priv->tx.initialized = true;
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -294,6 +294,9 @@
 		return -ETIMEDOUT;
 	}
 
+	if (target->conn_rsp_epid < 0 || target->conn_rsp_epid >= ENDPOINT_MAX)
+		return -EINVAL;
+
 	*conn_rsp_epid = target->conn_rsp_epid;
 	return 0;
 err:
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/main.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/main.c
@@ -135,8 +135,7 @@
 	if (power_mode != ATH9K_PM_AWAKE) {
 		spin_lock(&common->cc_lock);
 		ath_hw_cycle_counters_update(common);
-		memset(&common->cc_survey, 0, sizeof(common->cc_survey));
-		memset(&common->cc_ani, 0, sizeof(common->cc_ani));
+		memset(&common->cc, 0, sizeof(common->cc));
 		spin_unlock(&common->cc_lock);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/ath9k/wmi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/ath9k/wmi.c
@@ -155,6 +155,12 @@
 		}
 		spin_unlock_irqrestore(&wmi->wmi_lock, flags);
 
+		/* Check if ath9k_htc_probe_device() completed. */
+		if (!data_race(priv->initialized)) {
+			kfree_skb(skb);
+			continue;
+		}
+
 		hdr = (struct wmi_cmd_hdr *) skb->data;
 		cmd_id = be16_to_cpu(hdr->command_id);
 		wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
@@ -169,10 +175,6 @@
 					     &wmi->drv_priv->fatal_work);
 			break;
 		case WMI_TXSTATUS_EVENTID:
-			/* Check if ath9k_tx_init() completed. */
-			if (!data_race(priv->tx.initialized))
-				break;
-
 			spin_lock_bh(&priv->tx.tx_lock);
 			if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) {
 				spin_unlock_bh(&priv->tx.tx_lock);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/carl9170/tx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/carl9170/tx.c
@@ -280,7 +280,8 @@
 	 * carl9170_tx_fill_rateinfo() has filled the rate information
 	 * before we get to this point.
 	 */
-	memset_after(&txinfo->status, 0, rates);
+	memset(&txinfo->pad, 0, sizeof(txinfo->pad));
+	memset(&txinfo->rate_driver_data, 0, sizeof(txinfo->rate_driver_data));
 
 	if (atomic_read(&ar->tx_total_queued))
 		ar->tx_schedule = true;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/carl9170/usb.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/carl9170/usb.c
@@ -1069,6 +1069,38 @@
 			ar->usb_ep_cmd_is_bulk = true;
 	}
 
+	/* Verify that all expected endpoints are present */
+	if (ar->usb_ep_cmd_is_bulk) {
+		u8 bulk_ep_addr[] = {
+			AR9170_USB_EP_RX | USB_DIR_IN,
+			AR9170_USB_EP_TX | USB_DIR_OUT,
+			AR9170_USB_EP_CMD | USB_DIR_OUT,
+			0};
+		u8 int_ep_addr[] = {
+			AR9170_USB_EP_IRQ | USB_DIR_IN,
+			0};
+		if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) ||
+		    !usb_check_int_endpoints(intf, int_ep_addr))
+			err = -ENODEV;
+	} else {
+		u8 bulk_ep_addr[] = {
+			AR9170_USB_EP_RX | USB_DIR_IN,
+			AR9170_USB_EP_TX | USB_DIR_OUT,
+			0};
+		u8 int_ep_addr[] = {
+			AR9170_USB_EP_IRQ | USB_DIR_IN,
+			AR9170_USB_EP_CMD | USB_DIR_OUT,
+			0};
+		if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) ||
+		    !usb_check_int_endpoints(intf, int_ep_addr))
+			err = -ENODEV;
+	}
+
+	if (err) {
+		carl9170_free(ar);
+		return err;
+	}
+
 	usb_set_intfdata(intf, ar);
 	SET_IEEE80211_DEV(ar->hw, &intf->dev);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/ath/wil6210/txrx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/ath/wil6210/txrx.c
@@ -306,7 +306,7 @@
 				       struct sk_buff *skb)
 {
 	struct wil6210_rtap {
-		struct ieee80211_radiotap_header rthdr;
+		struct ieee80211_radiotap_header_fixed rthdr;
 		/* fields should be in the order of bits in rthdr.it_present */
 		/* flags */
 		u8 flags;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/b43/b43.h
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/b43/b43.h
@@ -1082,6 +1082,22 @@
 	return dev->__using_pio_transfers;
 }
 
+static inline void b43_wake_queue(struct b43_wldev *dev, int queue_prio)
+{
+	if (dev->qos_enabled)
+		ieee80211_wake_queue(dev->wl->hw, queue_prio);
+	else
+		ieee80211_wake_queue(dev->wl->hw, 0);
+}
+
+static inline void b43_stop_queue(struct b43_wldev *dev, int queue_prio)
+{
+	if (dev->qos_enabled)
+		ieee80211_stop_queue(dev->wl->hw, queue_prio);
+	else
+		ieee80211_stop_queue(dev->wl->hw, 0);
+}
+
 /* Message printing */
 __printf(2, 3) void b43info(struct b43_wl *wl, const char *fmt, ...);
 __printf(2, 3) void b43err(struct b43_wl *wl, const char *fmt, ...);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/b43/dma.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/b43/dma.c
@@ -1399,7 +1399,7 @@
 	    should_inject_overflow(ring)) {
 		/* This TX ring is full. */
 		unsigned int skb_mapping = skb_get_queue_mapping(skb);
-		ieee80211_stop_queue(dev->wl->hw, skb_mapping);
+		b43_stop_queue(dev, skb_mapping);
 		dev->wl->tx_queue_stopped[skb_mapping] = true;
 		ring->stopped = true;
 		if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
@@ -1570,7 +1570,7 @@
 	} else {
 		/* If the driver queue is running wake the corresponding
 		 * mac80211 queue. */
-		ieee80211_wake_queue(dev->wl->hw, ring->queue_prio);
+		b43_wake_queue(dev, ring->queue_prio);
 		if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
 			b43dbg(dev->wl, "Woke up TX ring %d\n", ring->index);
 		}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/b43/main.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/b43/main.c
@@ -2587,7 +2587,8 @@
 
 start_ieee80211:
 	wl->hw->queues = B43_QOS_QUEUE_NUM;
-	if (!modparam_qos || dev->fw.opensource)
+	if (!modparam_qos || dev->fw.opensource ||
+	    dev->dev->chip_id == BCMA_CHIP_ID_BCM4331)
 		wl->hw->queues = 1;
 
 	err = ieee80211_register_hw(wl->hw);
@@ -3603,7 +3604,7 @@
 				err = b43_dma_tx(dev, skb);
 			if (err == -ENOSPC) {
 				wl->tx_queue_stopped[queue_num] = true;
-				ieee80211_stop_queue(wl->hw, queue_num);
+				b43_stop_queue(dev, queue_num);
 				skb_queue_head(&wl->tx_queue[queue_num], skb);
 				break;
 			}
@@ -3627,6 +3628,7 @@
 		      struct sk_buff *skb)
 {
 	struct b43_wl *wl = hw_to_b43_wl(hw);
+	u16 skb_queue_mapping;
 
 	if (unlikely(skb->len < 2 + 2 + 6)) {
 		/* Too short, this can't be a valid frame. */
@@ -3635,12 +3637,12 @@
 	}
 	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
 
-	skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
-	if (!wl->tx_queue_stopped[skb->queue_mapping]) {
+	skb_queue_mapping = skb_get_queue_mapping(skb);
+	skb_queue_tail(&wl->tx_queue[skb_queue_mapping], skb);
+	if (!wl->tx_queue_stopped[skb_queue_mapping])
 		ieee80211_queue_work(wl->hw, &wl->tx_work);
-	} else {
-		ieee80211_stop_queue(wl->hw, skb->queue_mapping);
-	}
+	else
+		b43_stop_queue(wl->current_dev, skb_queue_mapping);
 }
 
 static void b43_qos_params_upload(struct b43_wldev *dev,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/b43/pio.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/b43/pio.c
@@ -525,7 +525,7 @@
 	if (total_len > (q->buffer_size - q->buffer_used)) {
 		/* Not enough memory on the queue. */
 		err = -EBUSY;
-		ieee80211_stop_queue(dev->wl->hw, skb_get_queue_mapping(skb));
+		b43_stop_queue(dev, skb_get_queue_mapping(skb));
 		q->stopped = true;
 		goto out;
 	}
@@ -552,7 +552,7 @@
 	if (((q->buffer_size - q->buffer_used) < roundup(2 + 2 + 6, 4)) ||
 	    (q->free_packet_slots == 0)) {
 		/* The queue is full. */
-		ieee80211_stop_queue(dev->wl->hw, skb_get_queue_mapping(skb));
+		b43_stop_queue(dev, skb_get_queue_mapping(skb));
 		q->stopped = true;
 	}
 
@@ -587,7 +587,7 @@
 	list_add(&pack->list, &q->packets_list);
 
 	if (q->stopped) {
-		ieee80211_wake_queue(dev->wl->hw, q->queue_prio);
+		b43_wake_queue(dev, q->queue_prio);
 		q->stopped = false;
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/Kconfig
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/Kconfig
@@ -27,6 +27,7 @@
 config BRCM_TRACING
 	bool "Broadcom device tracing"
 	depends on BRCMSMAC || BRCMFMAC
+	depends on TRACING
 	help
 	  If you say Y here, the Broadcom wireless drivers will register
 	  with ftrace to dump event information into the trace ringbuffer.
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c
@@ -7,21 +7,16 @@
 #include <core.h>
 #include <bus.h>
 #include <fwvid.h>
+#include <feature.h>
 
 #include "vops.h"
 
-static int brcmf_bca_attach(struct brcmf_pub *drvr)
+static void brcmf_bca_feat_attach(struct brcmf_if *ifp)
 {
-	pr_err("%s: executing\n", __func__);
-	return 0;
-}
-
-static void brcmf_bca_detach(struct brcmf_pub *drvr)
-{
-	pr_err("%s: executing\n", __func__);
+	/* SAE support not confirmed so disabling for now */
+	ifp->drvr->feat_flags &= ~BIT(BRCMF_FEAT_SAE);
 }
 
 const struct brcmf_fwvid_ops brcmf_bca_ops = {
-	.attach = brcmf_bca_attach,
-	.detach = brcmf_bca_detach,
+	.feat_attach = brcmf_bca_feat_attach,
 };
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -770,7 +770,7 @@
 
 	nents = max_t(uint, BRCMF_DEFAULT_RXGLOM_SIZE,
 		      sdiodev->settings->bus.sdio.txglomsz);
-	nents += (nents >> 4) + 1;
+	nents *= 2;
 
 	WARN_ON(nents > sdiodev->max_segment_count);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
@@ -123,7 +123,7 @@
 {
 	*data = addr;
 
-	return brcmf_fil_iovar_int_get(ifp, "btc_params", data);
+	return brcmf_fil_iovar_int_query(ifp, "btc_params", data);
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -32,6 +32,7 @@
 #include "vendor.h"
 #include "bus.h"
 #include "common.h"
+#include "fwvid.h"
 
 #define BRCMF_SCAN_IE_LEN_MAX		2048
 
@@ -662,8 +663,8 @@
 	/* interface_create version 3+ */
 	/* get supported version from firmware side */
 	iface_create_ver = 0;
-	err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
-				       &iface_create_ver);
+	err = brcmf_fil_bsscfg_int_query(ifp, "interface_create",
+					 &iface_create_ver);
 	if (err) {
 		brcmf_err("fail to get supported version, err=%d\n", err);
 		return -EOPNOTSUPP;
@@ -755,8 +756,8 @@
 	/* interface_create version 3+ */
 	/* get supported version from firmware side */
 	iface_create_ver = 0;
-	err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
-				       &iface_create_ver);
+	err = brcmf_fil_bsscfg_int_query(ifp, "interface_create",
+					 &iface_create_ver);
 	if (err) {
 		brcmf_err("fail to get supported version, err=%d\n", err);
 		return -EOPNOTSUPP;
@@ -1179,8 +1180,7 @@
 	scan_request = cfg->scan_request;
 	cfg->scan_request = NULL;
 
-	if (timer_pending(&cfg->escan_timeout))
-		del_timer_sync(&cfg->escan_timeout);
+	timer_delete_sync(&cfg->escan_timeout);
 
 	if (fw_abort) {
 		/* Do a scan abort to stop the driver's scan engine */
@@ -1687,52 +1687,39 @@
 	return reason;
 }
 
-static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
+int brcmf_set_wsec(struct brcmf_if *ifp, const u8 *key, u16 key_len, u16 flags)
 {
 	struct brcmf_pub *drvr = ifp->drvr;
 	struct brcmf_wsec_pmk_le pmk;
 	int err;
 
+	if (key_len > sizeof(pmk.key)) {
+		bphy_err(drvr, "key must be less than %zu bytes\n",
+			 sizeof(pmk.key));
+		return -EINVAL;
+	}
+
 	memset(&pmk, 0, sizeof(pmk));
 
-	/* pass pmk directly */
-	pmk.key_len = cpu_to_le16(pmk_len);
-	pmk.flags = cpu_to_le16(0);
-	memcpy(pmk.key, pmk_data, pmk_len);
+	/* pass key material directly */
+	pmk.key_len = cpu_to_le16(key_len);
+	pmk.flags = cpu_to_le16(flags);
+	memcpy(pmk.key, key, key_len);
 
-	/* store psk in firmware */
+	/* store key material in firmware */
 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
 				     &pmk, sizeof(pmk));
 	if (err < 0)
 		bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n",
-			 pmk_len);
+			 key_len);
 
 	return err;
 }
+BRCMF_EXPORT_SYMBOL_GPL(brcmf_set_wsec);
 
-static int brcmf_set_sae_password(struct brcmf_if *ifp, const u8 *pwd_data,
-				  u16 pwd_len)
+static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
 {
-	struct brcmf_pub *drvr = ifp->drvr;
-	struct brcmf_wsec_sae_pwd_le sae_pwd;
-	int err;
-
-	if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) {
-		bphy_err(drvr, "sae_password must be less than %d\n",
-			 BRCMF_WSEC_MAX_SAE_PASSWORD_LEN);
-		return -EINVAL;
-	}
-
-	sae_pwd.key_len = cpu_to_le16(pwd_len);
-	memcpy(sae_pwd.key, pwd_data, pwd_len);
-
-	err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd,
-				       sizeof(sae_pwd));
-	if (err < 0)
-		bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n",
-			 pwd_len);
-
-	return err;
+	return brcmf_set_wsec(ifp, pmk_data, pmk_len, 0);
 }
 
 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason,
@@ -2114,7 +2101,8 @@
 	if (!sme->crypto.n_akm_suites)
 		return 0;
 
-	err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
+	err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev),
+				       "wpa_auth", &val);
 	if (err) {
 		bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
 		return err;
@@ -2503,8 +2491,7 @@
 			bphy_err(drvr, "failed to clean up user-space RSNE\n");
 			goto done;
 		}
-		err = brcmf_set_sae_password(ifp, sme->crypto.sae_pwd,
-					     sme->crypto.sae_pwd_len);
+		err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
 		if (!err && sme->crypto.psk)
 			err = brcmf_set_pmk(ifp, sme->crypto.psk,
 					    BRCMF_WSEC_MAX_PSK_LEN);
@@ -2694,7 +2681,7 @@
 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 	struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
 	struct brcmf_pub *drvr = cfg->pub;
-	s32 qdbm = 0;
+	s32 qdbm;
 	s32 err;
 
 	brcmf_dbg(TRACE, "Enter\n");
@@ -4322,6 +4309,9 @@
 	int ret;
 
 	pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL);
+	if (!pmk_op)
+		return -ENOMEM;
+
 	pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3);
 
 	if (!pmksa) {
@@ -4331,9 +4321,16 @@
 		/* Single PMK operation */
 		pmk_op->count = cpu_to_le16(1);
 		length += sizeof(struct brcmf_pmksa_v3);
-		memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
-		memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
-		pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
+		if (pmksa->bssid)
+			memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
+		if (pmksa->pmkid) {
+			memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
+			pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
+		}
+		if (pmksa->ssid && pmksa->ssid_len) {
+			memcpy(pmk_op->pmk[0].ssid.SSID, pmksa->ssid, pmksa->ssid_len);
+			pmk_op->pmk[0].ssid.SSID_len = pmksa->ssid_len;
+		}
 		pmk_op->pmk[0].time_left = cpu_to_le32(alive ? BRCMF_PMKSA_NO_EXPIRY : 0);
 	}
 
@@ -5254,8 +5251,7 @@
 		if (crypto->sae_pwd) {
 			brcmf_dbg(INFO, "using SAE offload\n");
 			profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_SAE);
-			err = brcmf_set_sae_password(ifp, crypto->sae_pwd,
-						     crypto->sae_pwd_len);
+			err = brcmf_fwvid_set_sae_password(ifp, crypto);
 			if (err < 0)
 				goto exit;
 		}
@@ -5362,10 +5358,12 @@
 		msleep(400);
 
 		if (profile->use_fwauth != BIT(BRCMF_PROFILE_FWAUTH_NONE)) {
+			struct cfg80211_crypto_settings crypto = {};
+
 			if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_PSK))
 				brcmf_set_pmk(ifp, NULL, 0);
 			if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_SAE))
-				brcmf_set_sae_password(ifp, NULL, 0);
+				brcmf_fwvid_set_sae_password(ifp, &crypto);
 			profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
 		}
 
@@ -7048,8 +7046,8 @@
 			ch.bw = BRCMU_CHAN_BW_20;
 			cfg->d11inf.encchspec(&ch);
 			chaninfo = ch.chspec;
-			err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
-						       &chaninfo);
+			err = brcmf_fil_bsscfg_int_query(ifp, "per_chan_info",
+							 &chaninfo);
 			if (!err) {
 				if (chaninfo & WL_CHAN_RADAR)
 					channel->flags |=
@@ -7083,7 +7081,7 @@
 
 	/* verify support for bw_cap command */
 	val = WLC_BAND_5G;
-	err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
+	err = brcmf_fil_iovar_int_query(ifp, "bw_cap", &val);
 
 	if (!err) {
 		/* only set 2G bandwidth using bw_cap command */
@@ -7159,11 +7157,11 @@
 	int err;
 
 	band = WLC_BAND_2G;
-	err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
+	err = brcmf_fil_iovar_int_query(ifp, "bw_cap", &band);
 	if (!err) {
 		bw_cap[NL80211_BAND_2GHZ] = band;
 		band = WLC_BAND_5G;
-		err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
+		err = brcmf_fil_iovar_int_query(ifp, "bw_cap", &band);
 		if (!err) {
 			bw_cap[NL80211_BAND_5GHZ] = band;
 			return;
@@ -7172,7 +7170,6 @@
 		return;
 	}
 	brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
-	mimo_bwcap = 0;
 	err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
 	if (err)
 		/* assume 20MHz if firmware does not give a clue */
@@ -7268,7 +7265,7 @@
 	struct brcmf_pub *drvr = cfg->pub;
 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
-	u32 nmode = 0;
+	u32 nmode;
 	u32 vhtmode = 0;
 	u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
 	u32 rxchain;
@@ -8437,6 +8434,7 @@
 	brcmf_btcoex_detach(cfg);
 	wiphy_unregister(cfg->wiphy);
 	wl_deinit_priv(cfg);
+	cancel_work_sync(&cfg->escan_timeout_work);
 	brcmf_free_wiphy(cfg->wiphy);
 	kfree(cfg);
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
@@ -468,4 +468,6 @@
 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg);
 void brcmf_cfg80211_free_netdev(struct net_device *ndev);
 
+int brcmf_set_wsec(struct brcmf_if *ifp, const u8 *key, u16 key_len, u16 flags);
+
 #endif /* BRCMFMAC_CFG80211_H */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
@@ -7,21 +7,36 @@
 #include <core.h>
 #include <bus.h>
 #include <fwvid.h>
+#include <fwil.h>
 
 #include "vops.h"
 
-static int brcmf_cyw_attach(struct brcmf_pub *drvr)
+static int brcmf_cyw_set_sae_pwd(struct brcmf_if *ifp,
+				 struct cfg80211_crypto_settings *crypto)
 {
-	pr_err("%s: executing\n", __func__);
-	return 0;
-}
+	struct brcmf_pub *drvr = ifp->drvr;
+	struct brcmf_wsec_sae_pwd_le sae_pwd;
+	u16 pwd_len = crypto->sae_pwd_len;
+	int err;
 
-static void brcmf_cyw_detach(struct brcmf_pub *drvr)
-{
-	pr_err("%s: executing\n", __func__);
+	if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) {
+		bphy_err(drvr, "sae_password must be less than %d\n",
+			 BRCMF_WSEC_MAX_SAE_PASSWORD_LEN);
+		return -EINVAL;
+	}
+
+	sae_pwd.key_len = cpu_to_le16(pwd_len);
+	memcpy(sae_pwd.key, crypto->sae_pwd, pwd_len);
+
+	err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd,
+				       sizeof(sae_pwd));
+	if (err < 0)
+		bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n",
+			 pwd_len);
+
+	return err;
 }
 
 const struct brcmf_fwvid_ops brcmf_cyw_ops = {
-	.attach = brcmf_cyw_attach,
-	.detach = brcmf_cyw_detach,
+	.set_sae_password = brcmf_cyw_set_sae_pwd,
 };
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
@@ -83,6 +83,15 @@
 		.driver_data = (void *)&acepc_t8_data,
 	},
 	{
+		/* ACEPC W5 Pro Cherry Trail Z8350 HDMI stick, same wifi as the T8 */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "T3 MRD"),
+			DMI_MATCH(DMI_CHASSIS_TYPE, "3"),
+			DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
+		},
+		.driver_data = (void *)&acepc_t8_data,
+	},
+	{
 		/* Chuwi Hi8 Pro with D2D3_Hi8Pro.233 BIOS */
 		.matches = {
 			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Hampoo"),
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -13,6 +13,7 @@
 #include "debug.h"
 #include "fwil.h"
 #include "fwil_types.h"
+#include "fwvid.h"
 #include "feature.h"
 #include "common.h"
 
@@ -339,6 +340,8 @@
 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_FWSUP, "sup_wpa");
 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_SCAN_V2, "scan_ver");
 
+	brcmf_fwvid_feat_attach(ifp);
+
 	if (drvr->settings->feature_disable) {
 		brcmf_dbg(INFO, "Features: 0x%02x, disable: 0x%02x\n",
 			  ifp->drvr->feat_flags,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
@@ -142,6 +142,7 @@
 
 	return err;
 }
+BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_cmd_data_set);
 
 s32
 brcmf_fil_cmd_data_get(struct brcmf_if *ifp, u32 cmd, void *data, u32 len)
@@ -160,36 +161,7 @@
 
 	return err;
 }
-
-
-s32
-brcmf_fil_cmd_int_set(struct brcmf_if *ifp, u32 cmd, u32 data)
-{
-	s32 err;
-	__le32 data_le = cpu_to_le32(data);
-
-	mutex_lock(&ifp->drvr->proto_block);
-	brcmf_dbg(FIL, "ifidx=%d, cmd=%d, value=%d\n", ifp->ifidx, cmd, data);
-	err = brcmf_fil_cmd_data(ifp, cmd, &data_le, sizeof(data_le), true);
-	mutex_unlock(&ifp->drvr->proto_block);
-
-	return err;
-}
-
-s32
-brcmf_fil_cmd_int_get(struct brcmf_if *ifp, u32 cmd, u32 *data)
-{
-	s32 err;
-	__le32 data_le = cpu_to_le32(*data);
-
-	mutex_lock(&ifp->drvr->proto_block);
-	err = brcmf_fil_cmd_data(ifp, cmd, &data_le, sizeof(data_le), false);
-	mutex_unlock(&ifp->drvr->proto_block);
-	*data = le32_to_cpu(data_le);
-	brcmf_dbg(FIL, "ifidx=%d, cmd=%d, value=%d\n", ifp->ifidx, cmd, *data);
-
-	return err;
-}
+BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_cmd_data_get);
 
 static u32
 brcmf_create_iovar(const char *name, const char *data, u32 datalen,
@@ -239,6 +211,7 @@
 	mutex_unlock(&drvr->proto_block);
 	return err;
 }
+BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_iovar_data_set);
 
 s32
 brcmf_fil_iovar_data_get(struct brcmf_if *ifp, const char *name, void *data,
@@ -270,26 +243,7 @@
 	mutex_unlock(&drvr->proto_block);
 	return err;
 }
-
-s32
-brcmf_fil_iovar_int_set(struct brcmf_if *ifp, const char *name, u32 data)
-{
-	__le32 data_le = cpu_to_le32(data);
-
-	return brcmf_fil_iovar_data_set(ifp, name, &data_le, sizeof(data_le));
-}
-
-s32
-brcmf_fil_iovar_int_get(struct brcmf_if *ifp, const char *name, u32 *data)
-{
-	__le32 data_le = cpu_to_le32(*data);
-	s32 err;
-
-	err = brcmf_fil_iovar_data_get(ifp, name, &data_le, sizeof(data_le));
-	if (err == 0)
-		*data = le32_to_cpu(data_le);
-	return err;
-}
+BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_iovar_data_get);
 
 static u32
 brcmf_create_bsscfg(s32 bsscfgidx, const char *name, char *data, u32 datalen,
@@ -364,6 +318,7 @@
 	mutex_unlock(&drvr->proto_block);
 	return err;
 }
+BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_bsscfg_data_set);
 
 s32
 brcmf_fil_bsscfg_data_get(struct brcmf_if *ifp, const char *name,
@@ -394,28 +349,7 @@
 	mutex_unlock(&drvr->proto_block);
 	return err;
 }
-
-s32
-brcmf_fil_bsscfg_int_set(struct brcmf_if *ifp, const char *name, u32 data)
-{
-	__le32 data_le = cpu_to_le32(data);
-
-	return brcmf_fil_bsscfg_data_set(ifp, name, &data_le,
-					 sizeof(data_le));
-}
-
-s32
-brcmf_fil_bsscfg_int_get(struct brcmf_if *ifp, const char *name, u32 *data)
-{
-	__le32 data_le = cpu_to_le32(*data);
-	s32 err;
-
-	err = brcmf_fil_bsscfg_data_get(ifp, name, &data_le,
-					sizeof(data_le));
-	if (err == 0)
-		*data = le32_to_cpu(data_le);
-	return err;
-}
+BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_bsscfg_data_get);
 
 static u32 brcmf_create_xtlv(const char *name, u16 id, char *data, u32 len,
 			     char *buf, u32 buflen)
@@ -465,6 +399,7 @@
 	mutex_unlock(&drvr->proto_block);
 	return err;
 }
+BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_xtlv_data_set);
 
 s32 brcmf_fil_xtlv_data_get(struct brcmf_if *ifp, const char *name, u16 id,
 			    void *data, u32 len)
@@ -494,39 +429,4 @@
 	mutex_unlock(&drvr->proto_block);
 	return err;
 }
-
-s32 brcmf_fil_xtlv_int_set(struct brcmf_if *ifp, const char *name, u16 id, u32 data)
-{
-	__le32 data_le = cpu_to_le32(data);
-
-	return brcmf_fil_xtlv_data_set(ifp, name, id, &data_le,
-					 sizeof(data_le));
-}
-
-s32 brcmf_fil_xtlv_int_get(struct brcmf_if *ifp, const char *name, u16 id, u32 *data)
-{
-	__le32 data_le = cpu_to_le32(*data);
-	s32 err;
-
-	err = brcmf_fil_xtlv_data_get(ifp, name, id, &data_le, sizeof(data_le));
-	if (err == 0)
-		*data = le32_to_cpu(data_le);
-	return err;
-}
-
-s32 brcmf_fil_xtlv_int8_get(struct brcmf_if *ifp, const char *name, u16 id, u8 *data)
-{
-	return brcmf_fil_xtlv_data_get(ifp, name, id, data, sizeof(*data));
-}
-
-s32 brcmf_fil_xtlv_int16_get(struct brcmf_if *ifp, const char *name, u16 id, u16 *data)
-{
-	__le16 data_le = cpu_to_le16(*data);
-	s32 err;
-
-	err = brcmf_fil_xtlv_data_get(ifp, name, id, &data_le, sizeof(data_le));
-	if (err == 0)
-		*data = le16_to_cpu(data_le);
-	return err;
-}
-
+BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_xtlv_data_get);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
@@ -81,29 +81,142 @@
 
 s32 brcmf_fil_cmd_data_set(struct brcmf_if *ifp, u32 cmd, void *data, u32 len);
 s32 brcmf_fil_cmd_data_get(struct brcmf_if *ifp, u32 cmd, void *data, u32 len);
-s32 brcmf_fil_cmd_int_set(struct brcmf_if *ifp, u32 cmd, u32 data);
-s32 brcmf_fil_cmd_int_get(struct brcmf_if *ifp, u32 cmd, u32 *data);
+static inline
+s32 brcmf_fil_cmd_int_set(struct brcmf_if *ifp, u32 cmd, u32 data)
+{
+	s32 err;
+	__le32 data_le = cpu_to_le32(data);
 
-s32 brcmf_fil_iovar_data_set(struct brcmf_if *ifp, const char *name, const void *data,
-			     u32 len);
+	brcmf_dbg(FIL, "ifidx=%d, cmd=%d, value=%d\n", ifp->ifidx, cmd, data);
+	err = brcmf_fil_cmd_data_set(ifp, cmd, &data_le, sizeof(data_le));
+
+	return err;
+}
+static inline
+s32 brcmf_fil_cmd_int_get(struct brcmf_if *ifp, u32 cmd, u32 *data)
+{
+	s32 err;
+
+	err = brcmf_fil_cmd_data_get(ifp, cmd, data, sizeof(*data));
+	if (err == 0)
+		*data = le32_to_cpu(*(__le32 *)data);
+	brcmf_dbg(FIL, "ifidx=%d, cmd=%d, value=%d\n", ifp->ifidx, cmd, *data);
+
+	return err;
+}
+static inline
+s32 brcmf_fil_cmd_int_query(struct brcmf_if *ifp, u32 cmd, u32 *data)
+{
+	__le32 *data_le = (__le32 *)data;
+
+	*data_le = cpu_to_le32(*data);
+	return brcmf_fil_cmd_int_get(ifp, cmd, data);
+}
+
+s32 brcmf_fil_iovar_data_set(struct brcmf_if *ifp, const char *name,
+			     const void *data, u32 len);
 s32 brcmf_fil_iovar_data_get(struct brcmf_if *ifp, const char *name, void *data,
 			     u32 len);
-s32 brcmf_fil_iovar_int_set(struct brcmf_if *ifp, const char *name, u32 data);
-s32 brcmf_fil_iovar_int_get(struct brcmf_if *ifp, const char *name, u32 *data);
+static inline
+s32 brcmf_fil_iovar_int_set(struct brcmf_if *ifp, const char *name, u32 data)
+{
+	__le32 data_le = cpu_to_le32(data);
+
+	return brcmf_fil_iovar_data_set(ifp, name, &data_le, sizeof(data_le));
+}
+static inline
+s32 brcmf_fil_iovar_int_get(struct brcmf_if *ifp, const char *name, u32 *data)
+{
+	s32 err;
+
+	err = brcmf_fil_iovar_data_get(ifp, name, data, sizeof(*data));
+	if (err == 0)
+		*data = le32_to_cpu(*(__le32 *)data);
+	return err;
+}
+static inline
+s32 brcmf_fil_iovar_int_query(struct brcmf_if *ifp, const char *name, u32 *data)
+{
+	__le32 *data_le = (__le32 *)data;
+
+	*data_le = cpu_to_le32(*data);
+	return brcmf_fil_iovar_int_get(ifp, name, data);
+}
+
+
+s32 brcmf_fil_bsscfg_data_set(struct brcmf_if *ifp, const char *name,
+			      void *data, u32 len);
+s32 brcmf_fil_bsscfg_data_get(struct brcmf_if *ifp, const char *name,
+			      void *data, u32 len);
+static inline
+s32 brcmf_fil_bsscfg_int_set(struct brcmf_if *ifp, const char *name, u32 data)
+{
+	__le32 data_le = cpu_to_le32(data);
+
+	return brcmf_fil_bsscfg_data_set(ifp, name, &data_le,
+					 sizeof(data_le));
+}
+static inline
+s32 brcmf_fil_bsscfg_int_get(struct brcmf_if *ifp, const char *name, u32 *data)
+{
+	s32 err;
+
+	err = brcmf_fil_bsscfg_data_get(ifp, name, data, sizeof(*data));
+	if (err == 0)
+		*data = le32_to_cpu(*(__le32 *)data);
+	return err;
+}
+static inline
+s32 brcmf_fil_bsscfg_int_query(struct brcmf_if *ifp, const char *name, u32 *data)
+{
+	__le32 *data_le = (__le32 *)data;
+
+	*data_le = cpu_to_le32(*data);
+	return brcmf_fil_bsscfg_int_get(ifp, name, data);
+}
 
-s32 brcmf_fil_bsscfg_data_set(struct brcmf_if *ifp, const char *name, void *data,
-			      u32 len);
-s32 brcmf_fil_bsscfg_data_get(struct brcmf_if *ifp, const char *name, void *data,
-			      u32 len);
-s32 brcmf_fil_bsscfg_int_set(struct brcmf_if *ifp, const char *name, u32 data);
-s32 brcmf_fil_bsscfg_int_get(struct brcmf_if *ifp, const char *name, u32 *data);
 s32 brcmf_fil_xtlv_data_set(struct brcmf_if *ifp, const char *name, u16 id,
 			    void *data, u32 len);
 s32 brcmf_fil_xtlv_data_get(struct brcmf_if *ifp, const char *name, u16 id,
 			    void *data, u32 len);
-s32 brcmf_fil_xtlv_int_set(struct brcmf_if *ifp, const char *name, u16 id, u32 data);
-s32 brcmf_fil_xtlv_int_get(struct brcmf_if *ifp, const char *name, u16 id, u32 *data);
-s32 brcmf_fil_xtlv_int8_get(struct brcmf_if *ifp, const char *name, u16 id, u8 *data);
-s32 brcmf_fil_xtlv_int16_get(struct brcmf_if *ifp, const char *name, u16 id, u16 *data);
+static inline
+s32 brcmf_fil_xtlv_int_set(struct brcmf_if *ifp, const char *name, u16 id,
+			   u32 data)
+{
+	__le32 data_le = cpu_to_le32(data);
+
+	return brcmf_fil_xtlv_data_set(ifp, name, id, &data_le,
+					 sizeof(data_le));
+}
+static inline
+s32 brcmf_fil_xtlv_int_get(struct brcmf_if *ifp, const char *name, u16 id,
+			   u32 *data)
+{
+	__le32 data_le = cpu_to_le32(*data);
+	s32 err;
+
+	err = brcmf_fil_xtlv_data_get(ifp, name, id, &data_le, sizeof(data_le));
+	if (err == 0)
+		*data = le32_to_cpu(data_le);
+	return err;
+}
+static inline
+s32 brcmf_fil_xtlv_int8_get(struct brcmf_if *ifp, const char *name, u16 id,
+			    u8 *data)
+{
+	return brcmf_fil_xtlv_data_get(ifp, name, id, data, sizeof(*data));
+}
+static inline
+s32 brcmf_fil_xtlv_int16_get(struct brcmf_if *ifp, const char *name, u16 id,
+			     u16 *data)
+{
+	__le16 data_le = cpu_to_le16(*data);
+	s32 err;
+
+	err = brcmf_fil_xtlv_data_get(ifp, name, id, &data_le, sizeof(data_le));
+	if (err == 0)
+		*data = le16_to_cpu(data_le);
+	return err;
+}
 
 #endif /* _fwil_h_ */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -584,7 +584,7 @@
 struct brcmf_wsec_pmk_le {
 	__le16  key_len;
 	__le16  flags;
-	u8 key[2 * BRCMF_WSEC_MAX_PSK_LEN + 1];
+	u8 key[BRCMF_WSEC_MAX_SAE_PASSWORD_LEN];
 };
 
 /**
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c
@@ -89,8 +89,7 @@
 	if (fwvid >= BRCMF_FWVENDOR_NUM)
 		return -ERANGE;
 
-	if (WARN_ON(!vmod) || WARN_ON(!vops) ||
-	    WARN_ON(!vops->attach) || WARN_ON(!vops->detach))
+	if (WARN_ON(!vmod) || WARN_ON(!vops))
 		return -EINVAL;
 
 	if (WARN_ON(fwvid_list[fwvid].vmod))
@@ -150,7 +149,7 @@
 }
 #endif
 
-int brcmf_fwvid_attach_ops(struct brcmf_pub *drvr)
+int brcmf_fwvid_attach(struct brcmf_pub *drvr)
 {
 	enum brcmf_fwvendor fwvid = drvr->bus_if->fwvid;
 	int ret;
@@ -175,7 +174,7 @@
 	return ret;
 }
 
-void brcmf_fwvid_detach_ops(struct brcmf_pub *drvr)
+void brcmf_fwvid_detach(struct brcmf_pub *drvr)
 {
 	enum brcmf_fwvendor fwvid = drvr->bus_if->fwvid;
 
@@ -187,9 +186,10 @@
 
 	mutex_lock(&fwvid_list_lock);
 
-	drvr->vops = NULL;
-	list_del(&drvr->bus_if->list);
-
+	if (drvr->vops) {
+		drvr->vops = NULL;
+		list_del(&drvr->bus_if->list);
+	}
 	mutex_unlock(&fwvid_list_lock);
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h
@@ -6,12 +6,14 @@
 #define FWVID_H_
 
 #include "firmware.h"
+#include "cfg80211.h"
 
 struct brcmf_pub;
+struct brcmf_if;
 
 struct brcmf_fwvid_ops {
-	int (*attach)(struct brcmf_pub *drvr);
-	void (*detach)(struct brcmf_pub *drvr);
+	void (*feat_attach)(struct brcmf_if *ifp);
+	int (*set_sae_password)(struct brcmf_if *ifp, struct cfg80211_crypto_settings *crypto);
 };
 
 /* exported functions */
@@ -20,28 +22,29 @@
 int brcmf_fwvid_unregister_vendor(enum brcmf_fwvendor fwvid, struct module *mod);
 
 /* core driver functions */
-int brcmf_fwvid_attach_ops(struct brcmf_pub *drvr);
-void brcmf_fwvid_detach_ops(struct brcmf_pub *drvr);
+int brcmf_fwvid_attach(struct brcmf_pub *drvr);
+void brcmf_fwvid_detach(struct brcmf_pub *drvr);
 const char *brcmf_fwvid_vendor_name(struct brcmf_pub *drvr);
 
-static inline int brcmf_fwvid_attach(struct brcmf_pub *drvr)
+static inline void brcmf_fwvid_feat_attach(struct brcmf_if *ifp)
 {
-	int ret;
+	const struct brcmf_fwvid_ops *vops = ifp->drvr->vops;
 
-	ret = brcmf_fwvid_attach_ops(drvr);
-	if (ret)
-		return ret;
+	if (!vops->feat_attach)
+		return;
 
-	return drvr->vops->attach(drvr);
+	vops->feat_attach(ifp);
 }
 
-static inline void brcmf_fwvid_detach(struct brcmf_pub *drvr)
+static inline int brcmf_fwvid_set_sae_password(struct brcmf_if *ifp,
+					       struct cfg80211_crypto_settings *crypto)
 {
-	if (!drvr->vops)
-		return;
+	const struct brcmf_fwvid_ops *vops = ifp->drvr->vops;
+
+	if (!vops || !vops->set_sae_password)
+		return -EOPNOTSUPP;
 
-	drvr->vops->detach(drvr);
-	brcmf_fwvid_detach_ops(drvr);
+	return vops->set_sae_password(ifp, crypto);
 }
 
 #endif /* FWVID_H_ */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
@@ -109,9 +109,8 @@
 		}
 		strreplace(board_type, '/', '-');
 		settings->board_type = board_type;
-
-		of_node_put(root);
 	}
+	of_node_put(root);
 
 	if (!np || !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
 		return;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1675,6 +1675,15 @@
 #define BRCMF_RANDOM_SEED_MAGIC		0xfeedc0de
 #define BRCMF_RANDOM_SEED_LENGTH	0x100
 
+static noinline_for_stack void
+brcmf_pcie_provide_random_bytes(struct brcmf_pciedev_info *devinfo, u32 address)
+{
+	u8 randbuf[BRCMF_RANDOM_SEED_LENGTH];
+
+	get_random_bytes(randbuf, BRCMF_RANDOM_SEED_LENGTH);
+	memcpy_toio(devinfo->tcm + address, randbuf, BRCMF_RANDOM_SEED_LENGTH);
+}
+
 static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
 					const struct firmware *fw, void *nvram,
 					u32 nvram_len)
@@ -1717,7 +1726,6 @@
 				.length = cpu_to_le32(rand_len),
 				.magic = cpu_to_le32(BRCMF_RANDOM_SEED_MAGIC),
 			};
-			void *randbuf;
 
 			/* Some Apple chips/firmwares expect a buffer of random
 			 * data to be present before NVRAM
@@ -1729,10 +1737,7 @@
 				    sizeof(footer));
 
 			address -= rand_len;
-			randbuf = kzalloc(rand_len, GFP_KERNEL);
-			get_random_bytes(randbuf, rand_len);
-			memcpy_toio(devinfo->tcm + address, randbuf, rand_len);
-			kfree(randbuf);
+			brcmf_pcie_provide_random_bytes(devinfo, address);
 		}
 	} else {
 		brcmf_dbg(PCIE, "No matching NVRAM file found %s\n",
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c
@@ -7,21 +7,17 @@
 #include <core.h>
 #include <bus.h>
 #include <fwvid.h>
+#include <cfg80211.h>
 
 #include "vops.h"
 
-static int brcmf_wcc_attach(struct brcmf_pub *drvr)
+static int brcmf_wcc_set_sae_pwd(struct brcmf_if *ifp,
+				 struct cfg80211_crypto_settings *crypto)
 {
-	pr_debug("%s: executing\n", __func__);
-	return 0;
-}
-
-static void brcmf_wcc_detach(struct brcmf_pub *drvr)
-{
-	pr_debug("%s: executing\n", __func__);
+	return brcmf_set_wsec(ifp, crypto->sae_pwd, crypto->sae_pwd_len,
+			      BRCMF_WSEC_PASSPHRASE);
 }
 
 const struct brcmf_fwvid_ops brcmf_wcc_ops = {
-	.attach = brcmf_wcc_attach,
-	.detach = brcmf_wcc_detach,
+	.set_sae_password = brcmf_wcc_set_sae_pwd,
 };
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
@@ -1086,6 +1086,7 @@
 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
 	ieee80211_hw_set(hw, SIGNAL_DBM);
 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
+	ieee80211_hw_set(hw, MFP_CAPABLE);
 
 	hw->extra_tx_headroom = brcms_c_get_header_len();
 	hw->queues = N_TX_QUEUES;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c
@@ -383,8 +383,9 @@
 	return sh;
 }
 
-static void wlc_phy_timercb_phycal(struct brcms_phy *pi)
+static void wlc_phy_timercb_phycal(void *ptr)
 {
+	struct brcms_phy *pi = ptr;
 	uint delay = 5;
 
 	if (PHY_PERICAL_MPHASE_PENDING(pi)) {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -2567,7 +2567,6 @@
 
 	struct lcnphy_txgains cal_gains, temp_gains;
 	u16 hash;
-	u8 band_idx;
 	int j;
 	u16 ncorr_override[5];
 	u16 syst_coeffs[] = { 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
@@ -2599,6 +2598,9 @@
 	u16 *values_to_save;
 	struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy;
 
+	if (WARN_ON(CHSPEC_IS5G(pi->radio_chanspec)))
+		return;
+
 	values_to_save = kmalloc_array(20, sizeof(u16), GFP_ATOMIC);
 	if (NULL == values_to_save)
 		return;
@@ -2662,20 +2664,18 @@
 	hash = (target_gains->gm_gain << 8) |
 	       (target_gains->pga_gain << 4) | (target_gains->pad_gain);
 
-	band_idx = (CHSPEC_IS5G(pi->radio_chanspec) ? 1 : 0);
-
 	cal_gains = *target_gains;
 	memset(ncorr_override, 0, sizeof(ncorr_override));
-	for (j = 0; j < iqcal_gainparams_numgains_lcnphy[band_idx]; j++) {
-		if (hash == tbl_iqcal_gainparams_lcnphy[band_idx][j][0]) {
+	for (j = 0; j < iqcal_gainparams_numgains_lcnphy[0]; j++) {
+		if (hash == tbl_iqcal_gainparams_lcnphy[0][j][0]) {
 			cal_gains.gm_gain =
-				tbl_iqcal_gainparams_lcnphy[band_idx][j][1];
+				tbl_iqcal_gainparams_lcnphy[0][j][1];
 			cal_gains.pga_gain =
-				tbl_iqcal_gainparams_lcnphy[band_idx][j][2];
+				tbl_iqcal_gainparams_lcnphy[0][j][2];
 			cal_gains.pad_gain =
-				tbl_iqcal_gainparams_lcnphy[band_idx][j][3];
+				tbl_iqcal_gainparams_lcnphy[0][j][3];
 			memcpy(ncorr_override,
-			       &tbl_iqcal_gainparams_lcnphy[band_idx][j][3],
+			       &tbl_iqcal_gainparams_lcnphy[0][j][3],
 			       sizeof(ncorr_override));
 			break;
 		}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c
@@ -57,12 +57,11 @@
 }
 
 struct wlapi_timer *wlapi_init_timer(struct phy_shim_info *physhim,
-				     void (*fn)(struct brcms_phy *pi),
+				     void (*fn)(void *pi),
 				     void *arg, const char *name)
 {
 	return (struct wlapi_timer *)
-			brcms_init_timer(physhim->wl, (void (*)(void *))fn,
-					 arg, name);
+			brcms_init_timer(physhim->wl, fn, arg, name);
 }
 
 void wlapi_free_timer(struct wlapi_timer *t)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h
+++ linux-qcom-6.8.0/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h
@@ -131,7 +131,7 @@
 
 /* PHY to WL utility functions */
 struct wlapi_timer *wlapi_init_timer(struct phy_shim_info *physhim,
-				     void (*fn)(struct brcms_phy *pi),
+				     void (*fn)(void *pi),
 				     void *arg, const char *name);
 void wlapi_free_timer(struct wlapi_timer *t);
 void wlapi_add_timer(struct wlapi_timer *t, uint ms, int periodic);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/ipw2x00/ipw2100.c
@@ -2518,7 +2518,7 @@
 	 * to build this manually element by element, we can write it much
 	 * more efficiently than we can parse it. ORDER MATTERS HERE */
 	struct ipw_rt_hdr {
-		struct ieee80211_radiotap_header rt_hdr;
+		struct ieee80211_radiotap_header_fixed rt_hdr;
 		s8 rt_dbmsignal; /* signal in dbM, kluged to signed */
 	} *ipw_rt;
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/ipw2x00/ipw2200.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/ipw2x00/ipw2200.h
@@ -1143,7 +1143,7 @@
  * structure is provided regardless of any bits unset.
  */
 struct ipw_rt_hdr {
-	struct ieee80211_radiotap_header rt_hdr;
+	struct ieee80211_radiotap_header_fixed rt_hdr;
 	u64 rt_tsf;      /* TSF */	/* XXX */
 	u8 rt_flags;	/* radiotap packet flags */
 	u8 rt_rate;	/* rate in 500kb/s */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
@@ -870,8 +870,8 @@
 	switch (ieee->iw_mode) {
 	case IW_MODE_ADHOC:
 		/* our BSS and not from/to DS */
-		if (ether_addr_equal(hdr->addr3, ieee->bssid))
-		if ((fc & (IEEE80211_FCTL_TODS+IEEE80211_FCTL_FROMDS)) == 0) {
+		if (ether_addr_equal(hdr->addr3, ieee->bssid) &&
+		    ((fc & (IEEE80211_FCTL_TODS + IEEE80211_FCTL_FROMDS)) == 0)) {
 			/* promisc: get all */
 			if (ieee->dev->flags & IFF_PROMISC)
 				is_packet_for_us = 1;
@@ -885,8 +885,8 @@
 		break;
 	case IW_MODE_INFRA:
 		/* our BSS (== from our AP) and from DS */
-		if (ether_addr_equal(hdr->addr2, ieee->bssid))
-		if ((fc & (IEEE80211_FCTL_TODS+IEEE80211_FCTL_FROMDS)) == IEEE80211_FCTL_FROMDS) {
+		if (ether_addr_equal(hdr->addr2, ieee->bssid) &&
+		    ((fc & (IEEE80211_FCTL_TODS + IEEE80211_FCTL_FROMDS)) == IEEE80211_FCTL_FROMDS)) {
 			/* promisc: get all */
 			if (ieee->dev->flags & IFF_PROMISC)
 				is_packet_for_us = 1;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlegacy/common.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlegacy/common.c
@@ -3122,6 +3122,7 @@
 	struct il_cmd_meta *out_meta;
 	dma_addr_t phys_addr;
 	unsigned long flags;
+	u8 *out_payload;
 	u32 idx;
 	u16 fix_size;
 
@@ -3157,6 +3158,16 @@
 	out_cmd = txq->cmd[idx];
 	out_meta = &txq->meta[idx];
 
+	/* The payload is in the same place in regular and huge
+	 * command buffers, but we need to let the compiler know when
+	 * we're using a larger payload buffer to avoid "field-
+	 * spanning write" warnings at run-time for huge commands.
+	 */
+	if (cmd->flags & CMD_SIZE_HUGE)
+		out_payload = ((struct il_device_cmd_huge *)out_cmd)->cmd.payload;
+	else
+		out_payload = out_cmd->cmd.payload;
+
 	if (WARN_ON(out_meta->flags & CMD_MAPPED)) {
 		spin_unlock_irqrestore(&il->hcmd_lock, flags);
 		return -ENOSPC;
@@ -3170,7 +3181,7 @@
 		out_meta->callback = cmd->callback;
 
 	out_cmd->hdr.cmd = cmd->id;
-	memcpy(&out_cmd->cmd.payload, cmd->data, cmd->len);
+	memcpy(out_payload, cmd->data, cmd->len);
 
 	/* At this point, the out_cmd now has all of the incoming cmd
 	 * information */
@@ -4964,6 +4975,8 @@
 	 */
 	pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
 
+	_il_wr(il, CSR_INT, 0xffffffff);
+	_il_wr(il, CSR_FH_INT_STATUS, 0xffffffff);
 	il_enable_interrupts(il);
 
 	if (!(_il_rd(il, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW))
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlegacy/common.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlegacy/common.h
@@ -560,6 +560,18 @@
 
 #define TFD_MAX_PAYLOAD_SIZE (sizeof(struct il_device_cmd))
 
+/**
+ * struct il_device_cmd_huge
+ *
+ * For use when sending huge commands.
+ */
+struct il_device_cmd_huge {
+	struct il_cmd_header hdr;	/* uCode API */
+	union {
+		u8 payload[IL_MAX_CMD_SIZE - sizeof(struct il_cmd_header)];
+	} __packed cmd;
+} __packed;
+
 struct il_host_cmd {
 	const void *data;
 	unsigned long reply_page;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/cfg/ax210.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/cfg/ax210.c
@@ -299,3 +299,9 @@
 MODULE_FIRMWARE(IWL_MA_B_GF_A_FW_MODULE_FIRMWARE(IWL_AX210_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_MA_B_GF4_A_FW_MODULE_FIRMWARE(IWL_AX210_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_MA_B_MR_A_FW_MODULE_FIRMWARE(IWL_AX210_UCODE_API_MAX));
+
+MODULE_FIRMWARE("iwlwifi-so-a0-gf-a0.pnvm");
+MODULE_FIRMWARE("iwlwifi-so-a0-gf4-a0.pnvm");
+MODULE_FIRMWARE("iwlwifi-ty-a0-gf-a0.pnvm");
+MODULE_FIRMWARE("iwlwifi-ma-b0-gf-a0.pnvm");
+MODULE_FIRMWARE("iwlwifi-ma-b0-gf4-a0.pnvm");
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/cfg/bz.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/cfg/bz.c
@@ -152,6 +152,17 @@
 	.ltr_delay = IWL_CFG_TRANS_LTR_DELAY_2500US,
 };
 
+const struct iwl_cfg_trans_params iwl_gl_trans_cfg = {
+	.device_family = IWL_DEVICE_FAMILY_BZ,
+	.base_params = &iwl_bz_base_params,
+	.mq_rx_supported = true,
+	.rf_id = true,
+	.gen2 = true,
+	.umac_prph_offset = 0x300000,
+	.xtal_latency = 12000,
+	.low_latency_xtal = true,
+};
+
 const char iwl_bz_name[] = "Intel(R) TBD Bz device";
 
 const struct iwl_cfg iwl_cfg_bz = {
@@ -179,3 +190,5 @@
 MODULE_FIRMWARE(IWL_BZ_A_FM4_B_MODULE_FIRMWARE(IWL_BZ_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_GL_B_FM_B_MODULE_FIRMWARE(IWL_BZ_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_GL_C_FM_C_MODULE_FIRMWARE(IWL_BZ_UCODE_API_MAX));
+
+MODULE_FIRMWARE("iwlwifi-gl-c0-fm-c0.pnvm");
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/cfg/sc.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/cfg/sc.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
  * Copyright (C) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018-2023 Intel Corporation
+ * Copyright (C) 2018-2024 Intel Corporation
  */
 #include <linux/module.h>
 #include <linux/stringify.h>
@@ -33,6 +33,10 @@
 #define IWL_SC_A_GF_A_FW_PRE		"iwlwifi-sc-a0-gf-a0"
 #define IWL_SC_A_GF4_A_FW_PRE		"iwlwifi-sc-a0-gf4-a0"
 #define IWL_SC_A_WH_A_FW_PRE		"iwlwifi-sc-a0-wh-a0"
+#define IWL_SC2_A_FM_C_FW_PRE		"iwlwifi-sc2-a0-fm-c0"
+#define IWL_SC2_A_WH_A_FW_PRE		"iwlwifi-sc2-a0-wh-a0"
+#define IWL_SC2F_A_FM_C_FW_PRE		"iwlwifi-sc2f-a0-fm-c0"
+#define IWL_SC2F_A_WH_A_FW_PRE		"iwlwifi-sc2f-a0-wh-a0"
 
 #define IWL_SC_A_FM_B_FW_MODULE_FIRMWARE(api) \
 	IWL_SC_A_FM_B_FW_PRE "-" __stringify(api) ".ucode"
@@ -48,6 +52,14 @@
 	IWL_SC_A_GF4_A_FW_PRE "-" __stringify(api) ".ucode"
 #define IWL_SC_A_WH_A_FW_MODULE_FIRMWARE(api) \
 	IWL_SC_A_WH_A_FW_PRE "-" __stringify(api) ".ucode"
+#define IWL_SC2_A_FM_C_FW_MODULE_FIRMWARE(api) \
+	IWL_SC2_A_FM_C_FW_PRE "-" __stringify(api) ".ucode"
+#define IWL_SC2_A_WH_A_FW_MODULE_FIRMWARE(api) \
+	IWL_SC2_A_WH_A_FW_PRE "-" __stringify(api) ".ucode"
+#define IWL_SC2F_A_FM_C_FW_MODULE_FIRMWARE(api) \
+	IWL_SC2F_A_FM_C_FW_PRE "-" __stringify(api) ".ucode"
+#define IWL_SC2F_A_WH_A_FW_MODULE_FIRMWARE(api) \
+	IWL_SC2F_A_WH_A_FW_PRE "-" __stringify(api) ".ucode"
 
 static const struct iwl_base_params iwl_sc_base_params = {
 	.eeprom_size = OTP_LOW_IMAGE_SIZE_32K,
@@ -124,6 +136,9 @@
 
 #define IWL_DEVICE_SC							\
 	IWL_DEVICE_BZ_COMMON,						\
+	.uhb_supported = true,						\
+	.features = IWL_TX_CSUM_NETIF_FLAGS | NETIF_F_RXCSUM,		\
+	.num_rbds = IWL_NUM_RBDS_SC_EHT,				\
 	.ht_params = &iwl_22000_ht_params
 
 /*
@@ -149,10 +164,21 @@
 
 const struct iwl_cfg iwl_cfg_sc = {
 	.fw_name_mac = "sc",
-	.uhb_supported = true,
 	IWL_DEVICE_SC,
-	.features = IWL_TX_CSUM_NETIF_FLAGS | NETIF_F_RXCSUM,
-	.num_rbds = IWL_NUM_RBDS_SC_EHT,
+};
+
+const char iwl_sc2_name[] = "Intel(R) TBD Sc2 device";
+
+const struct iwl_cfg iwl_cfg_sc2 = {
+	.fw_name_mac = "sc2",
+	IWL_DEVICE_SC,
+};
+
+const char iwl_sc2f_name[] = "Intel(R) TBD Sc2f device";
+
+const struct iwl_cfg iwl_cfg_sc2f = {
+	.fw_name_mac = "sc2f",
+	IWL_DEVICE_SC,
 };
 
 MODULE_FIRMWARE(IWL_SC_A_FM_B_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX));
@@ -162,3 +188,7 @@
 MODULE_FIRMWARE(IWL_SC_A_GF_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_SC_A_GF4_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_SC_A_WH_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_SC2_A_FM_C_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_SC2_A_WH_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_SC2F_A_FM_C_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_SC2F_A_WH_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX));
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -767,7 +767,7 @@
 	 * from index 1, so the maximum value allowed here is
 	 * ACPI_SAR_PROFILES_NUM - 1.
 	 */
-	if (n_profiles <= 0 || n_profiles >= ACPI_SAR_PROFILE_NUM) {
+	if (n_profiles >= ACPI_SAR_PROFILE_NUM) {
 		ret = -EINVAL;
 		goto out_free;
 	}
@@ -867,22 +867,25 @@
 				entry = &wifi_pkg->package.elements[entry_idx];
 				entry_idx++;
 				if (entry->type != ACPI_TYPE_INTEGER ||
-				    entry->integer.value > num_profiles) {
+				    entry->integer.value > num_profiles ||
+				    entry->integer.value <
+					rev_data[idx].min_profiles) {
 					ret = -EINVAL;
 					goto out_free;
 				}
-				num_profiles = entry->integer.value;
 
 				/*
-				 * this also validates >= min_profiles since we
-				 * otherwise wouldn't have gotten the data when
-				 * looking up in ACPI
+				 * Check to see if we received package count
+				 * same as max # of profiles
 				 */
 				if (wifi_pkg->package.count !=
 				    hdr_size + profile_size * num_profiles) {
 					ret = -EINVAL;
 					goto out_free;
 				}
+
+				/* Number of valid profiles */
+				num_profiles = entry->integer.value;
 			}
 			goto read_table;
 		}
@@ -1296,7 +1299,6 @@
 	if (IS_ERR(data))
 		return;
 
-	/* try to read wtas table revision 1 or revision 0*/
 	wifi_pkg = iwl_acpi_get_wifi_pkg(fwrt->dev, data,
 					 ACPI_WPFC_WIFI_DATA_SIZE,
 					 &tbl_rev);
@@ -1306,13 +1308,14 @@
 	if (tbl_rev != 0)
 		goto out_free;
 
-	BUILD_BUG_ON(ARRAY_SIZE(filters->filter_cfg_chains) != ACPI_WPFC_WIFI_DATA_SIZE);
+	BUILD_BUG_ON(ARRAY_SIZE(filters->filter_cfg_chains) !=
+		     ACPI_WPFC_WIFI_DATA_SIZE - 1);
 
 	for (i = 0; i < ARRAY_SIZE(filters->filter_cfg_chains); i++) {
-		if (wifi_pkg->package.elements[i].type != ACPI_TYPE_INTEGER)
-			return;
+		if (wifi_pkg->package.elements[i + 1].type != ACPI_TYPE_INTEGER)
+			goto out_free;
 		tmp.filter_cfg_chains[i] =
-			cpu_to_le32(wifi_pkg->package.elements[i].integer.value);
+			cpu_to_le32(wifi_pkg->package.elements[i + 1].integer.value);
 	}
 
 	IWL_DEBUG_RADIO(fwrt, "Loaded WPFC filter config from ACPI\n");
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -56,7 +56,7 @@
 #define ACPI_EWRD_WIFI_DATA_SIZE_REV2	((ACPI_SAR_PROFILE_NUM - 1) * \
 					 ACPI_SAR_NUM_CHAINS_REV2 * \
 					 ACPI_SAR_NUM_SUB_BANDS_REV2 + 3)
-#define ACPI_WPFC_WIFI_DATA_SIZE	4 /* 4 filter config words */
+#define ACPI_WPFC_WIFI_DATA_SIZE	5 /* domain and 4 filter config words */
 
 /* revision 0 and 1 are identical, except for the semantics in the FW */
 #define ACPI_GEO_NUM_BANDS_REV0		2
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
@@ -385,6 +385,33 @@
 	__le32 timer_period;
 	__le32 flags;
 } __packed; /* TX_REDUCED_POWER_API_S_VER_7 */
+
+/**
+ * struct iwl_dev_tx_power_cmd_v8 - TX power reduction command version 8
+ * @per_chain: per chain restrictions
+ * @enable_ack_reduction: enable or disable close range ack TX power
+ *	reduction.
+ * @per_chain_restriction_changed: is per_chain_restriction has changed
+ *	from last command. used if set_mode is
+ *	IWL_TX_POWER_MODE_SET_SAR_TIMER.
+ *	note: if not changed, the command is used for keep alive only.
+ * @reserved: reserved (padding)
+ * @timer_period: timer in milliseconds. if expires FW will change to default
+ *	BIOS values. relevant if setMode is IWL_TX_POWER_MODE_SET_SAR_TIMER
+ * @flags: reduce power flags.
+ * @tpc_vlp_backoff_level: user backoff of UNII5,7 VLP channels in USA.
+ *	Not in use.
+ */
+struct iwl_dev_tx_power_cmd_v8 {
+	__le16 per_chain[IWL_NUM_CHAIN_TABLES_V2][IWL_NUM_CHAIN_LIMITS][IWL_NUM_SUB_BANDS_V2];
+	u8 enable_ack_reduction;
+	u8 per_chain_restriction_changed;
+	u8 reserved[2];
+	__le32 timer_period;
+	__le32 flags;
+	__le32 tpc_vlp_backoff_level;
+} __packed; /* TX_REDUCED_POWER_API_S_VER_8 */
+
 /**
  * struct iwl_dev_tx_power_cmd - TX power reduction command (multiversion)
  * @common: common part of the command
@@ -392,6 +419,8 @@
  * @v4: version 4 part of the command
  * @v5: version 5 part of the command
  * @v6: version 6 part of the command
+ * @v7: version 7 part of the command
+ * @v8: version 8 part of the command
  */
 struct iwl_dev_tx_power_cmd {
 	struct iwl_dev_tx_power_common common;
@@ -401,6 +430,7 @@
 		struct iwl_dev_tx_power_cmd_v5 v5;
 		struct iwl_dev_tx_power_cmd_v6 v6;
 		struct iwl_dev_tx_power_cmd_v7 v7;
+		struct iwl_dev_tx_power_cmd_v8 v8;
 	};
 };
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -1124,6 +1124,19 @@
 } __packed; /* SCAN_ABORT_CMD_UMAC_API_S_VER_1 */
 
 /**
+ * enum iwl_umac_scan_abort_status
+ *
+ * @IWL_UMAC_SCAN_ABORT_STATUS_SUCCESS: scan was successfully aborted
+ * @IWL_UMAC_SCAN_ABORT_STATUS_IN_PROGRESS: scan abort is in progress
+ * @IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND: nothing to abort
+ */
+enum iwl_umac_scan_abort_status {
+	IWL_UMAC_SCAN_ABORT_STATUS_SUCCESS = 0,
+	IWL_UMAC_SCAN_ABORT_STATUS_IN_PROGRESS,
+	IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND,
+};
+
+/**
  * struct iwl_umac_scan_complete
  * @uid: scan id, &enum iwl_umac_scan_uid_offsets
  * @last_schedule: last scheduling line
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -3074,8 +3074,6 @@
 	struct iwl_fw_dbg_params params = {0};
 	struct iwl_fwrt_dump_data *dump_data =
 		&fwrt->dump.wks[wk_idx].dump_data;
-	u32 policy;
-	u32 time_point;
 	if (!test_bit(wk_idx, &fwrt->dump.active_wks))
 		return;
 
@@ -3106,13 +3104,16 @@
 
 	iwl_fw_dbg_stop_restart_recording(fwrt, &params, false);
 
-	policy = le32_to_cpu(dump_data->trig->apply_policy);
-	time_point = le32_to_cpu(dump_data->trig->time_point);
+	if (iwl_trans_dbg_ini_valid(fwrt->trans)) {
+		u32 policy = le32_to_cpu(dump_data->trig->apply_policy);
+		u32 time_point = le32_to_cpu(dump_data->trig->time_point);
 
-	if (policy & IWL_FW_INI_APPLY_POLICY_DUMP_COMPLETE_CMD) {
-		IWL_DEBUG_FW_INFO(fwrt, "WRT: sending dump complete\n");
-		iwl_send_dbg_dump_complete_cmd(fwrt, time_point, 0);
+		if (policy & IWL_FW_INI_APPLY_POLICY_DUMP_COMPLETE_CMD) {
+			IWL_DEBUG_FW_INFO(fwrt, "WRT: sending dump complete\n");
+			iwl_send_dbg_dump_complete_cmd(fwrt, time_point, 0);
+		}
 	}
+
 	if (fwrt->trans->dbg.last_tp_resetfw == IWL_FW_INI_RESET_FW_MODE_STOP_FW_ONLY)
 		iwl_force_nmi(fwrt->trans);
 
@@ -3346,7 +3347,7 @@
 {
 	int ret __maybe_unused = 0;
 
-	if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status))
+	if (!iwl_trans_fw_running(fwrt->trans))
 		return;
 
 	if (fw_has_capa(&fwrt->fw->ucode_capa,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
@@ -230,8 +230,7 @@
 		.data = { NULL, },
 	};
 
-	if (fwrt->ops && fwrt->ops->fw_running &&
-	    !fwrt->ops->fw_running(fwrt->ops_ctx))
+	if (!iwl_trans_fw_running(fwrt->trans))
 		return -EIO;
 
 	if (count < header_size + 1 || count > 1024 * 4)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/fw/init.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/fw/init.c
@@ -39,10 +39,12 @@
 }
 IWL_EXPORT_SYMBOL(iwl_fw_runtime_init);
 
+/* Assumes the appropriate lock is held by the caller */
 void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt)
 {
 	iwl_fw_suspend_timestamp(fwrt);
-	iwl_dbg_tlv_time_point(fwrt, IWL_FW_INI_TIME_POINT_HOST_D3_START, NULL);
+	iwl_dbg_tlv_time_point_sync(fwrt, IWL_FW_INI_TIME_POINT_HOST_D3_START,
+				    NULL);
 }
 IWL_EXPORT_SYMBOL(iwl_fw_runtime_suspend);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
@@ -255,21 +255,27 @@
 	struct pnvm_sku_package *package;
 	u8 *image = NULL;
 
-	/* First attempt to get the PNVM from BIOS */
-	package = iwl_uefi_get_pnvm(trans_p, len);
-	if (!IS_ERR_OR_NULL(package)) {
-		if (*len >= sizeof(*package)) {
-			/* we need only the data */
-			*len -= sizeof(*package);
-			image = kmemdup(package->data, *len, GFP_KERNEL);
+	/* Get PNVM from BIOS for non-Intel SKU */
+	if (trans_p->sku_id[2]) {
+		package = iwl_uefi_get_pnvm(trans_p, len);
+		if (!IS_ERR_OR_NULL(package)) {
+			if (*len >= sizeof(*package)) {
+				/* we need only the data */
+				*len -= sizeof(*package);
+				image = kmemdup(package->data,
+						*len, GFP_KERNEL);
+			}
+			/*
+			 * free package regardless of whether kmemdup
+			 * succeeded
+			 */
+			kfree(package);
+			if (image)
+				return image;
 		}
-		/* free package regardless of whether kmemdup succeeded */
-		kfree(package);
-		if (image)
-			return image;
 	}
 
-	/* If it's not available, try from the filesystem */
+	/* If it's not available, or for Intel SKU, try from the filesystem */
 	if (iwl_pnvm_get_from_fs(trans_p, &image, len))
 		return NULL;
 	return image;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
@@ -18,7 +18,6 @@
 struct iwl_fw_runtime_ops {
 	void (*dump_start)(void *ctx);
 	void (*dump_end)(void *ctx);
-	bool (*fw_running)(void *ctx);
 	int (*send_hcmd)(void *ctx, struct iwl_host_cmd *host_cmd);
 	bool (*d3_debug_enable)(void *ctx);
 };
@@ -173,9 +172,9 @@
 	struct iwl_sar_offset_mapping_cmd sgom_table;
 	bool sgom_enabled;
 	u8 reduced_power_flags;
-	bool uats_enabled;
 	struct iwl_uats_table_cmd uats_table;
 #endif
+	bool uats_enabled;
 };
 
 void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -2,7 +2,7 @@
 /*
  * Copyright (C) 2005-2014, 2018-2021 Intel Corporation
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
- * Copyright (C) 2018-2023 Intel Corporation
+ * Copyright (C) 2018-2024 Intel Corporation
  */
 #ifndef __IWL_CONFIG_H__
 #define __IWL_CONFIG_H__
@@ -418,6 +418,8 @@
 #define IWL_CFG_MAC_TYPE_BZ		0x46
 #define IWL_CFG_MAC_TYPE_GL		0x47
 #define IWL_CFG_MAC_TYPE_SC		0x48
+#define IWL_CFG_MAC_TYPE_SC2		0x49
+#define IWL_CFG_MAC_TYPE_SC2F		0x4A
 
 #define IWL_CFG_RF_TYPE_TH		0x105
 #define IWL_CFG_RF_TYPE_TH1		0x108
@@ -487,6 +489,7 @@
 extern const struct iwl_cfg_trans_params iwl_so_long_latency_imr_trans_cfg;
 extern const struct iwl_cfg_trans_params iwl_ma_trans_cfg;
 extern const struct iwl_cfg_trans_params iwl_bz_trans_cfg;
+extern const struct iwl_cfg_trans_params iwl_gl_trans_cfg;
 extern const struct iwl_cfg_trans_params iwl_sc_trans_cfg;
 extern const char iwl9162_name[];
 extern const char iwl9260_name[];
@@ -527,6 +530,8 @@
 extern const char iwl_ax411_name[];
 extern const char iwl_bz_name[];
 extern const char iwl_sc_name[];
+extern const char iwl_sc2_name[];
+extern const char iwl_sc2f_name[];
 #if IS_ENABLED(CONFIG_IWLDVM)
 extern const struct iwl_cfg iwl5300_agn_cfg;
 extern const struct iwl_cfg iwl5100_agn_cfg;
@@ -632,6 +637,8 @@
 extern const struct iwl_cfg iwl_cfg_gl;
 
 extern const struct iwl_cfg iwl_cfg_sc;
+extern const struct iwl_cfg iwl_cfg_sc2;
+extern const struct iwl_cfg iwl_cfg_sc2f;
 #endif /* CONFIG_IWLMVM */
 
 #endif /* __IWL_CONFIG_H__ */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -103,6 +103,12 @@
 	if (le32_to_cpu(tlv->length) != sizeof(*debug_info))
 		return -EINVAL;
 
+	/* we use this as a string, ensure input was NUL terminated */
+	if (strnlen(debug_info->debug_cfg_name,
+		    sizeof(debug_info->debug_cfg_name)) ==
+			sizeof(debug_info->debug_cfg_name))
+		return -EINVAL;
+
 	IWL_DEBUG_FW(trans, "WRT: Loading debug cfg: %s\n",
 		     debug_info->debug_cfg_name);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -1838,8 +1838,8 @@
 err_fw:
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 	debugfs_remove_recursive(drv->dbgfs_drv);
-	iwl_dbg_tlv_free(drv->trans);
 #endif
+	iwl_dbg_tlv_free(drv->trans);
 	kfree(drv);
 err:
 	return ERR_PTR(ret);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -2097,7 +2097,7 @@
 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
 	nvm->sku_cap_mimo_disabled =
 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
-	if (CSR_HW_RFID_TYPE(trans->hw_rf_id) == IWL_CFG_RF_TYPE_FM)
+	if (CSR_HW_RFID_TYPE(trans->hw_rf_id) >= IWL_CFG_RF_TYPE_FM)
 		nvm->sku_cap_11be_enable = true;
 
 	/* Initialize PHY sku data */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
@@ -1536,8 +1536,8 @@
 
 	/* prevent double restarts due to the same erroneous FW */
 	if (!test_and_set_bit(STATUS_FW_ERROR, &trans->status)) {
-		iwl_op_mode_nic_error(trans->op_mode, sync);
 		trans->state = IWL_TRANS_NO_FW;
+		iwl_op_mode_nic_error(trans->op_mode, sync);
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
@@ -104,7 +104,7 @@
 #define IWL_MVM_FTM_INITIATOR_SECURE_LTF	false
 #define IWL_MVM_FTM_RESP_NDP_SUPPORT		true
 #define IWL_MVM_FTM_RESP_LMR_FEEDBACK_SUPPORT	true
-#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR	5
+#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR	7
 #define IWL_MVM_FTM_NON_TB_MAX_TIME_BETWEEN_MSR	1000
 #define IWL_MVM_D3_DEBUG			false
 #define IWL_MVM_USE_TWT				true
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -461,12 +461,10 @@
 		struct wowlan_key_rsc_v5_data data = {};
 		int i;
 
-		data.rsc = kmalloc(sizeof(*data.rsc), GFP_KERNEL);
+		data.rsc = kzalloc(sizeof(*data.rsc), GFP_KERNEL);
 		if (!data.rsc)
 			return -ENOMEM;
 
-		memset(data.rsc, 0xff, sizeof(*data.rsc));
-
 		for (i = 0; i < ARRAY_SIZE(data.rsc->mcast_key_id_map); i++)
 			data.rsc->mcast_key_id_map[i] =
 				IWL_MCAST_KEY_MAP_INVALID;
@@ -597,6 +595,12 @@
 					 void *_data)
 {
 	struct wowlan_key_gtk_type_iter *data = _data;
+	__le32 *cipher = NULL;
+
+	if (key->keyidx == 4 || key->keyidx == 5)
+		cipher = &data->kek_kck_cmd->igtk_cipher;
+	if (key->keyidx == 6 || key->keyidx == 7)
+		cipher = &data->kek_kck_cmd->bigtk_cipher;
 
 	switch (key->cipher) {
 	default:
@@ -608,10 +612,13 @@
 		return;
 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
-		data->kek_kck_cmd->igtk_cipher = cpu_to_le32(STA_KEY_FLG_GCMP);
+		if (cipher)
+			*cipher = cpu_to_le32(STA_KEY_FLG_GCMP);
 		return;
 	case WLAN_CIPHER_SUITE_AES_CMAC:
-		data->kek_kck_cmd->igtk_cipher = cpu_to_le32(STA_KEY_FLG_CCM);
+	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
+		if (cipher)
+			*cipher = cpu_to_le32(STA_KEY_FLG_CCM);
 		return;
 	case WLAN_CIPHER_SUITE_CCMP:
 		if (!sta)
@@ -1375,7 +1382,9 @@
 
 	iwl_mvm_pause_tcm(mvm, true);
 
+	mutex_lock(&mvm->mutex);
 	iwl_fw_runtime_suspend(&mvm->fwrt);
+	mutex_unlock(&mvm->mutex);
 
 	return __iwl_mvm_suspend(hw, wowlan, false);
 }
@@ -1846,9 +1855,12 @@
 		memcpy(seq->aes_gmac.pn, key->ipn, sizeof(seq->aes_gmac.pn));
 		break;
 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
+	case WLAN_CIPHER_SUITE_AES_CMAC:
 		BUILD_BUG_ON(sizeof(seq->aes_cmac.pn) != sizeof(key->ipn));
 		memcpy(seq->aes_cmac.pn, key->ipn, sizeof(seq->aes_cmac.pn));
 		break;
+	default:
+		WARN_ON(1);
 	}
 }
 
@@ -2137,7 +2149,8 @@
 
 out:
 	if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP,
-				    WOWLAN_GET_STATUSES, 0) < 10) {
+				    WOWLAN_GET_STATUSES,
+				    IWL_FW_CMD_VER_UNKNOWN) < 10) {
 		mvmvif->seqno_valid = true;
 		/* +0x10 because the set API expects next-to-use, not last-used */
 		mvmvif->seqno = status->non_qos_seq_ctr + 0x10;
@@ -2200,7 +2213,10 @@
 static void iwl_mvm_convert_igtk(struct iwl_wowlan_status_data *status,
 				 struct iwl_wowlan_igtk_status *data)
 {
+	int i;
+
 	BUILD_BUG_ON(sizeof(status->igtk.key) < sizeof(data->key));
+	BUILD_BUG_ON(sizeof(status->igtk.ipn) != sizeof(data->ipn));
 
 	if (!data->key_len)
 		return;
@@ -2212,7 +2228,10 @@
 		+ WOWLAN_IGTK_MIN_INDEX;
 
 	memcpy(status->igtk.key, data->key, sizeof(data->key));
-	memcpy(status->igtk.ipn, data->ipn, sizeof(data->ipn));
+
+	/* mac80211 expects big endian for memcmp() to work, convert */
+	for (i = 0; i < sizeof(data->ipn); i++)
+		status->igtk.ipn[i] = data->ipn[sizeof(data->ipn) - i - 1];
 }
 
 static void iwl_mvm_convert_bigtk(struct iwl_wowlan_status_data *status,
@@ -2622,6 +2641,7 @@
 				    int idx)
 {
 	int i;
+	int n_channels = 0;
 
 	if (fw_has_api(&mvm->fw->ucode_capa,
 		       IWL_UCODE_TLV_API_SCAN_OFFLOAD_CHANS)) {
@@ -2630,7 +2650,7 @@
 
 		for (i = 0; i < SCAN_OFFLOAD_MATCHING_CHANNELS_LEN * 8; i++)
 			if (matches[idx].matching_channels[i / 8] & (BIT(i % 8)))
-				match->channels[match->n_channels++] =
+				match->channels[n_channels++] =
 					mvm->nd_channels[i]->center_freq;
 	} else {
 		struct iwl_scan_offload_profile_match_v1 *matches =
@@ -2638,9 +2658,11 @@
 
 		for (i = 0; i < SCAN_OFFLOAD_MATCHING_CHANNELS_LEN_V1 * 8; i++)
 			if (matches[idx].matching_channels[i / 8] & (BIT(i % 8)))
-				match->channels[match->n_channels++] =
+				match->channels[n_channels++] =
 					mvm->nd_channels[i]->center_freq;
 	}
+	/* We may have ended up with fewer channels than we allocated. */
+	match->n_channels = n_channels;
 }
 
 /**
@@ -2721,6 +2743,8 @@
 			     GFP_KERNEL);
 	if (!net_detect || !n_matches)
 		goto out_report_nd;
+	net_detect->n_matches = n_matches;
+	n_matches = 0;
 
 	for_each_set_bit(i, &matched_profiles, mvm->n_nd_match_sets) {
 		struct cfg80211_wowlan_nd_match *match;
@@ -2734,8 +2758,9 @@
 				GFP_KERNEL);
 		if (!match)
 			goto out_report_nd;
+		match->n_channels = n_channels;
 
-		net_detect->matches[net_detect->n_matches++] = match;
+		net_detect->matches[n_matches++] = match;
 
 		/* We inverted the order of the SSIDs in the scan
 		 * request, so invert the index here.
@@ -2750,6 +2775,8 @@
 
 		iwl_mvm_query_set_freqs(mvm, d3_data->nd_results, match, i);
 	}
+	/* We may have fewer matches than we allocated. */
+	net_detect->n_matches = n_matches;
 
 out_report_nd:
 	wakeup.net_detect = net_detect;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
@@ -735,7 +735,9 @@
 {
 	struct dentry *dbgfs_dir = vif->debugfs_dir;
 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-	char buf[100];
+	char buf[3 * 3 + 11 + (NL80211_WIPHY_NAME_MAXLEN + 1) +
+		 (7 + IFNAMSIZ + 1) + 6 + 1];
+	char name[7 + IFNAMSIZ + 1];
 
 	/* this will happen in monitor mode */
 	if (!dbgfs_dir)
@@ -748,10 +750,11 @@
 	 * find
 	 * netdev:wlan0 -> ../../../ieee80211/phy0/netdev:wlan0/iwlmvm/
 	 */
-	snprintf(buf, 100, "../../../%pd3/iwlmvm", dbgfs_dir);
+	snprintf(name, sizeof(name), "%pd", dbgfs_dir);
+	snprintf(buf, sizeof(buf), "../../../%pd3/iwlmvm", dbgfs_dir);
 
-	mvmvif->dbgfs_slink = debugfs_create_symlink(dbgfs_dir->d_name.name,
-						     mvm->debugfs_dir, buf);
+	mvmvif->dbgfs_slink =
+		debugfs_create_symlink(name, mvm->debugfs_dir, buf);
 }
 
 void iwl_mvm_vif_dbgfs_rm_link(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
@@ -53,6 +53,8 @@
 	if (!pasn)
 		return -ENOBUFS;
 
+	iwl_mvm_ftm_remove_pasn_sta(mvm, addr);
+
 	pasn->cipher = iwl_mvm_cipher_to_location_cipher(cipher);
 
 	switch (pasn->cipher) {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -93,20 +93,10 @@
 {
 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
 	struct iwl_mfu_assert_dump_notif *mfu_dump_notif = (void *)pkt->data;
-	__le32 *dump_data = mfu_dump_notif->data;
-	int n_words = le32_to_cpu(mfu_dump_notif->data_size) / sizeof(__le32);
-	int i;
 
 	if (mfu_dump_notif->index_num == 0)
 		IWL_INFO(mvm, "MFUART assert id 0x%x occurred\n",
 			 le32_to_cpu(mfu_dump_notif->assert_id));
-
-	for (i = 0; i < n_words; i++)
-		IWL_DEBUG_INFO(mvm,
-			       "MFUART assert dump, dword %u: 0x%08x\n",
-			       le16_to_cpu(mfu_dump_notif->index_num) *
-			       n_words + i,
-			       le32_to_cpu(dump_data[i]));
 }
 
 static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
@@ -901,13 +891,15 @@
 	int ret;
 	u16 len = 0;
 	u32 n_subbands;
-	u8 cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, cmd_id,
-					   IWL_FW_CMD_VER_UNKNOWN);
-	if (cmd_ver == 7) {
+	u8 cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, cmd_id, 3);
+
+	if (cmd_ver >= 7) {
 		len = sizeof(cmd.v7);
 		n_subbands = IWL_NUM_SUB_BANDS_V2;
 		per_chain = cmd.v7.per_chain[0][0];
 		cmd.v7.flags = cpu_to_le32(mvm->fwrt.reduced_power_flags);
+		if (cmd_ver == 8)
+			len = sizeof(cmd.v8);
 	} else if (cmd_ver == 6) {
 		len = sizeof(cmd.v6);
 		n_subbands = IWL_NUM_SUB_BANDS_V2;
@@ -1499,11 +1491,18 @@
 
 #endif /* CONFIG_ACPI */
 
+static void iwl_mvm_disconnect_iterator(void *data, u8 *mac,
+					struct ieee80211_vif *vif)
+{
+	if (vif->type == NL80211_IFTYPE_STATION)
+		ieee80211_hw_restart_disconnect(vif);
+}
+
 void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)
 {
 	u32 error_log_size = mvm->fw->ucode_capa.error_log_size;
+	u32 status = 0;
 	int ret;
-	u32 resp;
 
 	struct iwl_fw_error_recovery_cmd recovery_cmd = {
 		.flags = cpu_to_le32(flags),
@@ -1511,7 +1510,6 @@
 	};
 	struct iwl_host_cmd host_cmd = {
 		.id = WIDE_ID(SYSTEM_GROUP, FW_ERROR_RECOVERY_CMD),
-		.flags = CMD_WANT_SKB,
 		.data = {&recovery_cmd, },
 		.len = {sizeof(recovery_cmd), },
 	};
@@ -1531,7 +1529,7 @@
 		recovery_cmd.buf_size = cpu_to_le32(error_log_size);
 	}
 
-	ret = iwl_mvm_send_cmd(mvm, &host_cmd);
+	ret = iwl_mvm_send_cmd_status(mvm, &host_cmd, &status);
 	kfree(mvm->error_recovery_buf);
 	mvm->error_recovery_buf = NULL;
 
@@ -1542,11 +1540,15 @@
 
 	/* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */
 	if (flags & ERROR_RECOVERY_UPDATE_DB) {
-		resp = le32_to_cpu(*(__le32 *)host_cmd.resp_pkt->data);
-		if (resp)
+		if (status) {
 			IWL_ERR(mvm,
 				"Failed to send recovery cmd blob was invalid %d\n",
-				resp);
+				status);
+
+			ieee80211_iterate_interfaces(mvm->hw, 0,
+						     iwl_mvm_disconnect_iterator,
+						     mvm);
+		}
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -354,7 +354,7 @@
 	if (mvm->mld_api_is_used && mvm->nvm_data->sku_cap_11be_enable &&
 	    !iwlwifi_mod_params.disable_11ax &&
 	    !iwlwifi_mod_params.disable_11be)
-		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
+		hw->wiphy->flags |= WIPHY_FLAG_DISABLE_WEXT;
 
 	/* With MLD FW API, it tracks timing by itself,
 	 * no need for any timing from the host
@@ -640,7 +640,7 @@
 		hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
 
 	if (iwl_fw_lookup_cmd_ver(mvm->fw, WOWLAN_KEK_KCK_MATERIAL,
-				  IWL_FW_CMD_VER_UNKNOWN) == 3)
+				  IWL_FW_CMD_VER_UNKNOWN) >= 3)
 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK;
 
 	if (fw_has_api(&mvm->fw->ucode_capa,
@@ -806,20 +806,10 @@
 	if (ieee80211_is_mgmt(hdr->frame_control))
 		sta = NULL;
 
-	/* If there is no sta, and it's not offchannel - send through AP */
+	/* this shouldn't even happen: just drop */
 	if (!sta && info->control.vif->type == NL80211_IFTYPE_STATION &&
-	    !offchannel) {
-		struct iwl_mvm_vif *mvmvif =
-			iwl_mvm_vif_from_mac80211(info->control.vif);
-		u8 ap_sta_id = READ_ONCE(mvmvif->deflink.ap_sta_id);
-
-		if (ap_sta_id < mvm->fw->ucode_capa.num_stations) {
-			/* mac80211 holds rcu read lock */
-			sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
-			if (IS_ERR_OR_NULL(sta))
-				goto drop;
-		}
-	}
+	    !offchannel)
+		goto drop;
 
 	if (tmp_sta && !sta && link_id != IEEE80211_LINK_UNSPECIFIED &&
 	    !ieee80211_is_probe_resp(hdr->frame_control)) {
@@ -1092,6 +1082,39 @@
 	RCU_INIT_POINTER(mvmvif->deflink.probe_resp_data, NULL);
 }
 
+static void iwl_mvm_cleanup_sta_iterator(void *data, struct ieee80211_sta *sta)
+{
+	struct iwl_mvm *mvm = data;
+	struct iwl_mvm_sta *mvm_sta;
+	struct ieee80211_vif *vif;
+	int link_id;
+
+	mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+	vif = mvm_sta->vif;
+
+	if (!sta->valid_links)
+		return;
+
+	for (link_id = 0; link_id < ARRAY_SIZE((sta)->link); link_id++) {
+		struct iwl_mvm_link_sta *mvm_link_sta;
+
+		mvm_link_sta =
+			rcu_dereference_check(mvm_sta->link[link_id],
+					      lockdep_is_held(&mvm->mutex));
+		if (mvm_link_sta && !(vif->active_links & BIT(link_id))) {
+			/*
+			 * We have a link STA but the link is inactive in
+			 * mac80211. This will happen if we failed to
+			 * deactivate the link but mac80211 roll back the
+			 * deactivation of the link.
+			 * Delete the stale data to avoid issues later on.
+			 */
+			iwl_mvm_mld_free_sta_link(mvm, mvm_sta, mvm_link_sta,
+						  link_id, false);
+		}
+	}
+}
+
 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 {
 	iwl_mvm_stop_device(mvm);
@@ -1114,6 +1137,10 @@
 	 */
 	ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
 
+	/* cleanup stations as links may be gone after restart */
+	ieee80211_iterate_stations_atomic(mvm->hw,
+					  iwl_mvm_cleanup_sta_iterator, mvm);
+
 	mvm->p2p_device_vif = NULL;
 
 	iwl_mvm_reset_phy_ctxts(mvm);
@@ -1383,7 +1410,9 @@
 	if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
 		cmd.common.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
 
-	if (cmd_ver == 7)
+	if (cmd_ver == 8)
+		len = sizeof(cmd.v8);
+	else if (cmd_ver == 7)
 		len = sizeof(cmd.v7);
 	else if (cmd_ver == 6)
 		len = sizeof(cmd.v6);
@@ -1547,6 +1576,17 @@
 					IWL_STA_MULTICAST);
 }
 
+void iwl_mvm_mac_init_mvmvif(struct iwl_mvm *mvm, struct iwl_mvm_vif *mvmvif)
+{
+	lockdep_assert_held(&mvm->mutex);
+
+	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
+		return;
+
+	INIT_DELAYED_WORK(&mvmvif->csa_work,
+			  iwl_mvm_channel_switch_disconnect_wk);
+}
+
 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
 				     struct ieee80211_vif *vif)
 {
@@ -1557,6 +1597,8 @@
 
 	mutex_lock(&mvm->mutex);
 
+	iwl_mvm_mac_init_mvmvif(mvm, mvmvif);
+
 	mvmvif->mvm = mvm;
 
 	/* the first link always points to the default one */
@@ -1632,8 +1674,6 @@
 		mvm->p2p_device_vif = vif;
 
 	iwl_mvm_tcm_add_vif(mvm, vif);
-	INIT_DELAYED_WORK(&mvmvif->csa_work,
-			  iwl_mvm_channel_switch_disconnect_wk);
 
 	if (vif->type == NL80211_IFTYPE_MONITOR) {
 		mvm->monitor_on = true;
@@ -1671,6 +1711,8 @@
 void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
 				 struct ieee80211_vif *vif)
 {
+	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
 		/*
 		 * Flush the ROC worker which will flush the OFFCHANNEL queue.
@@ -1679,6 +1721,8 @@
 		 */
 		flush_work(&mvm->roc_done_wk);
 	}
+
+	cancel_delayed_work_sync(&mvmvif->csa_work);
 }
 
 /* This function is doing the common part of removing the interface for
@@ -3698,6 +3742,19 @@
 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls)
 		mvmvif->ap_sta = sta;
 
+	/*
+	 * Initialize the rates here already - this really tells
+	 * the firmware only what the supported legacy rates are
+	 * (may be) since it's initialized already from what the
+	 * AP advertised in the beacon/probe response. This will
+	 * allow the firmware to send auth/assoc frames with one
+	 * of the supported rates already, rather than having to
+	 * use a mandatory rate.
+	 * If we're the AP, we'll just assume mandatory rates at
+	 * this point, but we know nothing about the STA anyway.
+	 */
+	iwl_mvm_rs_rate_init_all_links(mvm, vif, sta);
+
 	return 0;
 }
 
@@ -3796,13 +3853,17 @@
 
 	mvm_sta->authorized = true;
 
-	iwl_mvm_rs_rate_init_all_links(mvm, vif, sta);
-
 	/* MFP is set by default before the station is authorized.
 	 * Clear it here in case it's not used.
 	 */
-	if (!sta->mfp)
-		return callbacks->update_sta(mvm, vif, sta);
+	if (!sta->mfp) {
+		int ret = callbacks->update_sta(mvm, vif, sta);
+
+		if (ret)
+			return ret;
+	}
+
+	iwl_mvm_rs_rate_init_all_links(mvm, vif, sta);
 
 	return 0;
 }
@@ -4651,7 +4712,7 @@
 
 	if (fw_ver == IWL_FW_CMD_VER_UNKNOWN) {
 		ret = iwl_mvm_send_aux_roc_cmd(mvm, channel, vif, duration);
-	} else if (fw_ver == 3) {
+	} else if (fw_ver >= 3) {
 		ret = iwl_mvm_roc_add_cmd(mvm, channel, vif, duration,
 					  ROC_ACTIVITY_HOTSPOT);
 	} else {
@@ -5633,6 +5694,10 @@
 	int i;
 
 	if (!iwl_mvm_has_new_tx_api(mvm)) {
+		/* we can't ask the firmware anything if it is dead */
+		if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+			     &mvm->status))
+			return;
 		if (drop) {
 			mutex_lock(&mvm->mutex);
 			iwl_mvm_flush_tx_path(mvm,
@@ -5717,8 +5782,11 @@
 
 	/* this can take a while, and we may need/want other operations
 	 * to succeed while doing this, so do it without the mutex held
+	 * If the firmware is dead, this can't work...
 	 */
-	if (!drop && !iwl_mvm_has_new_tx_api(mvm))
+	if (!drop && !iwl_mvm_has_new_tx_api(mvm) &&
+	    !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+		      &mvm->status))
 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
 }
 
@@ -6130,7 +6198,7 @@
 		.len[0] = sizeof(cmd),
 		.data[1] = data,
 		.len[1] = size,
-		.flags = sync ? 0 : CMD_ASYNC,
+		.flags = CMD_SEND_IN_RFKILL | (sync ? 0 : CMD_ASYNC),
 	};
 	int ret;
 
@@ -6155,11 +6223,9 @@
 	if (sync) {
 		lockdep_assert_held(&mvm->mutex);
 		ret = wait_event_timeout(mvm->rx_sync_waitq,
-					 READ_ONCE(mvm->queue_sync_state) == 0 ||
-					 iwl_mvm_is_radio_killed(mvm),
+					 READ_ONCE(mvm->queue_sync_state) == 0,
 					 HZ);
-		WARN_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm),
-			  "queue sync: failed to sync, state is 0x%lx\n",
+		WARN_ONCE(!ret, "queue sync: failed to sync, state is 0x%lx\n",
 			  mvm->queue_sync_state);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2022 - 2023 Intel Corporation
+ * Copyright (C) 2022 - 2024 Intel Corporation
  */
 #include <linux/kernel.h>
 #include <net/mac80211.h>
@@ -62,11 +62,13 @@
 			  struct ieee80211_key_conf *keyconf)
 {
 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+	bool pairwise = keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE;
+	bool igtk = keyconf->keyidx == 4 || keyconf->keyidx == 5;
 	u32 flags = 0;
 
 	lockdep_assert_held(&mvm->mutex);
 
-	if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+	if (!pairwise)
 		flags |= IWL_SEC_KEY_FLAG_MCAST_KEY;
 
 	switch (keyconf->cipher) {
@@ -96,12 +98,14 @@
 	if (!sta && vif->type == NL80211_IFTYPE_STATION)
 		sta = mvmvif->ap_sta;
 
-	/* Set the MFP flag also for an AP interface where the key is an IGTK
-	 * key as in such a case the station would always be NULL
+	/*
+	 * If we are installing an iGTK (in AP or STA mode), we need to tell
+	 * the firmware this key will en/decrypt MGMT frames.
+	 * Same goes if we are installing a pairwise key for an MFP station.
+	 * In case we're installing a groupwise key (which is not an iGTK),
+	 * then, we will not use this key for MGMT frames.
 	 */
-	if ((!IS_ERR_OR_NULL(sta) && sta->mfp) ||
-	    (vif->type == NL80211_IFTYPE_AP &&
-	     (keyconf->keyidx == 4 || keyconf->keyidx == 5)))
+	if ((!IS_ERR_OR_NULL(sta) && sta->mfp && pairwise) || igtk)
 		flags |= IWL_SEC_KEY_FLAG_MFP;
 
 	return flags;
@@ -137,7 +141,7 @@
 	if (sta != data->sta || key->link_id >= 0)
 		return;
 
-	err = iwl_mvm_send_cmd_pdu(mvm, cmd_id, CMD_ASYNC, sizeof(cmd), &cmd);
+	err = iwl_mvm_send_cmd_pdu(mvm, cmd_id, 0, sizeof(cmd), &cmd);
 
 	if (err)
 		data->err = err;
@@ -155,8 +159,8 @@
 		.new_sta_mask = new_sta_mask,
 	};
 
-	ieee80211_iter_keys_rcu(mvm->hw, vif, iwl_mvm_mld_update_sta_key,
-				&data);
+	ieee80211_iter_keys(mvm->hw, vif, iwl_mvm_mld_update_sta_key,
+			    &data);
 	return data.err;
 }
 
@@ -380,7 +384,7 @@
 	if (!sec_key_ver)
 		return;
 
-	ieee80211_iter_keys_rcu(mvm->hw, vif,
-				iwl_mvm_sec_key_remove_ap_iter,
-				(void *)(uintptr_t)link_id);
+	ieee80211_iter_keys(mvm->hw, vif,
+			    iwl_mvm_sec_key_remove_ap_iter,
+			    (void *)(uintptr_t)link_id);
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
@@ -167,7 +167,7 @@
 	iwl_mvm_mld_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
 
 	cmd.filter_flags = cpu_to_le32(MAC_CFG_FILTER_PROMISC |
-				       MAC_FILTER_IN_CONTROL_AND_MGMT |
+				       MAC_CFG_FILTER_ACCEPT_CONTROL_AND_MGMT |
 				       MAC_CFG_FILTER_ACCEPT_BEACON |
 				       MAC_CFG_FILTER_ACCEPT_PROBE_REQ |
 				       MAC_CFG_FILTER_ACCEPT_GRP);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
@@ -14,6 +14,8 @@
 
 	mutex_lock(&mvm->mutex);
 
+	iwl_mvm_mac_init_mvmvif(mvm, mvmvif);
+
 	mvmvif->mvm = mvm;
 
 	/* Not much to do here. The stack will not allow interface
@@ -39,8 +41,6 @@
 	/* reset deflink MLO parameters */
 	mvmvif->deflink.fw_link_id = IWL_MVM_FW_LINK_ID_INVALID;
 	mvmvif->deflink.active = 0;
-	/* the first link always points to the default one */
-	mvmvif->link[0] = &mvmvif->deflink;
 
 	ret = iwl_mvm_mld_mac_ctxt_add(mvm, vif);
 	if (ret)
@@ -58,9 +58,19 @@
 				     IEEE80211_VIF_SUPPORTS_CQM_RSSI;
 	}
 
-	ret = iwl_mvm_add_link(mvm, vif, &vif->bss_conf);
-	if (ret)
-		goto out_free_bf;
+	/* We want link[0] to point to the default link, unless we have MLO and
+	 * in this case this will be modified later by .change_vif_links()
+	 * If we are in the restart flow with an MLD connection, we will wait
+	 * to .change_vif_links() to setup the links.
+	 */
+	if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
+	    !ieee80211_vif_is_mld(vif)) {
+		mvmvif->link[0] = &mvmvif->deflink;
+
+		ret = iwl_mvm_add_link(mvm, vif, &vif->bss_conf);
+		if (ret)
+			goto out_free_bf;
+	}
 
 	/* Save a pointer to p2p device vif, so it can later be used to
 	 * update the p2p device MAC when a GO is started/stopped
@@ -73,8 +83,6 @@
 		goto out_free_bf;
 
 	iwl_mvm_tcm_add_vif(mvm, vif);
-	INIT_DELAYED_WORK(&mvmvif->csa_work,
-			  iwl_mvm_channel_switch_disconnect_wk);
 
 	if (vif->type == NL80211_IFTYPE_MONITOR) {
 		mvm->monitor_on = true;
@@ -189,17 +197,13 @@
 	mutex_unlock(&mvm->mutex);
 }
 
-static unsigned int iwl_mvm_mld_count_active_links(struct ieee80211_vif *vif)
+static unsigned int iwl_mvm_mld_count_active_links(struct iwl_mvm_vif *mvmvif)
 {
 	unsigned int n_active = 0;
 	int i;
 
 	for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
-		struct ieee80211_bss_conf *link_conf;
-
-		link_conf = link_conf_dereference_protected(vif, i);
-		if (link_conf &&
-		    rcu_access_pointer(link_conf->chanctx_conf))
+		if (mvmvif->link[i] && mvmvif->link[i]->phy_ctxt)
 			n_active++;
 	}
 
@@ -245,21 +249,18 @@
 {
 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
-	unsigned int n_active = iwl_mvm_mld_count_active_links(vif);
 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+	unsigned int n_active = iwl_mvm_mld_count_active_links(mvmvif);
 	unsigned int link_id = link_conf->link_id;
 	int ret;
 
-	/* if the assigned one was not counted yet, count it now */
-	if (!rcu_access_pointer(link_conf->chanctx_conf))
-		n_active++;
-
-	if (n_active > iwl_mvm_max_active_links(mvm, vif))
-		return -EOPNOTSUPP;
-
 	if (WARN_ON_ONCE(!mvmvif->link[link_id]))
 		return -EINVAL;
 
+	/* if the assigned one was not counted yet, count it now */
+	if (!mvmvif->link[link_id]->phy_ctxt)
+		n_active++;
+
 	/* mac parameters such as HE support can change at this stage
 	 * For sta, need first to configure correct state from drv_sta_state
 	 * and only after that update mac config.
@@ -299,13 +300,8 @@
 	 * this needs the phy context assigned (and in FW?), and we cannot
 	 * do it later because it needs to be initialized as soon as we're
 	 * able to TX on the link, i.e. when active.
-	 *
-	 * Firmware restart isn't quite correct yet for MLO, but we don't
-	 * need to do it in that case anyway since it will happen from the
-	 * normal station state callback.
 	 */
-	if (mvmvif->ap_sta &&
-	    !test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+	if (mvmvif->ap_sta) {
 		struct ieee80211_link_sta *link_sta;
 
 		rcu_read_lock();
@@ -419,7 +415,7 @@
 
 {
 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-	unsigned int n_active = iwl_mvm_mld_count_active_links(vif);
+	unsigned int n_active = iwl_mvm_mld_count_active_links(mvmvif);
 	unsigned int link_id = link_conf->link_id;
 
 	/* shouldn't happen, but verify link_id is valid before accessing */
@@ -1122,17 +1118,12 @@
 			     struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
 {
 	struct iwl_mvm_vif_link_info *new_link[IEEE80211_MLD_MAX_NUM_LINKS] = {};
-	unsigned int n_active = iwl_mvm_mld_count_active_links(vif);
 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 	u16 removed = old_links & ~new_links;
 	u16 added = new_links & ~old_links;
 	int err, i;
 
-	if (hweight16(new_links) > 1 &&
-	    n_active > iwl_mvm_max_active_links(mvm, vif))
-		return -EOPNOTSUPP;
-
 	for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
 		int r;
 
@@ -1159,7 +1150,11 @@
 
 	mutex_lock(&mvm->mutex);
 
-	if (old_links == 0) {
+	/* If we're in RESTART flow, the default link wasn't added in
+         * drv_add_interface(), and link[0] doesn't point to it.
+	 */
+	if (old_links == 0 && !test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
+					&mvm->status)) {
 		err = iwl_mvm_disable_link(mvm, vif, &vif->bss_conf);
 		if (err)
 			goto out_err;
@@ -1224,6 +1219,15 @@
 	return ret;
 }
 
+static bool iwl_mvm_mld_can_activate_links(struct ieee80211_hw *hw,
+					   struct ieee80211_vif *vif,
+					   u16 desired_links)
+{
+	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+	return hweight16(desired_links) <= iwl_mvm_max_active_links(mvm, vif);
+}
+
 const struct ieee80211_ops iwl_mvm_mld_hw_ops = {
 	.tx = iwl_mvm_mac_tx,
 	.wake_tx_queue = iwl_mvm_mac_wake_tx_queue,
@@ -1318,4 +1322,5 @@
 
 	.change_vif_links = iwl_mvm_mld_change_vif_links,
 	.change_sta_links = iwl_mvm_mld_change_sta_links,
+	.can_activate_links = iwl_mvm_mld_can_activate_links,
 };
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c
@@ -9,7 +9,9 @@
 u32 iwl_mvm_sta_fw_id_mask(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 			   int filter_link_id)
 {
+	struct ieee80211_link_sta *link_sta;
 	struct iwl_mvm_sta *mvmsta;
+	struct ieee80211_vif *vif;
 	unsigned int link_id;
 	u32 result = 0;
 
@@ -17,26 +19,27 @@
 		return 0;
 
 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
+	vif = mvmsta->vif;
 
 	/* it's easy when the STA is not an MLD */
 	if (!sta->valid_links)
 		return BIT(mvmsta->deflink.sta_id);
 
 	/* but if it is an MLD, get the mask of all the FW STAs it has ... */
-	for (link_id = 0; link_id < ARRAY_SIZE(mvmsta->link); link_id++) {
-		struct iwl_mvm_link_sta *link_sta;
+	for_each_sta_active_link(vif, sta, link_sta, link_id) {
+		struct iwl_mvm_link_sta *mvm_link_sta;
 
 		/* unless we have a specific link in mind */
 		if (filter_link_id >= 0 && link_id != filter_link_id)
 			continue;
 
-		link_sta =
+		mvm_link_sta =
 			rcu_dereference_check(mvmsta->link[link_id],
 					      lockdep_is_held(&mvm->mutex));
-		if (!link_sta)
+		if (!mvm_link_sta)
 			continue;
 
-		result |= BIT(link_sta->sta_id);
+		result |= BIT(mvm_link_sta->sta_id);
 	}
 
 	return result;
@@ -512,11 +515,11 @@
 	return iwl_mvm_mld_send_sta_cmd(mvm, &cmd);
 }
 
-static void iwl_mvm_mld_free_sta_link(struct iwl_mvm *mvm,
-				      struct iwl_mvm_sta *mvm_sta,
-				      struct iwl_mvm_link_sta *mvm_sta_link,
-				      unsigned int link_id,
-				      bool is_in_fw)
+void iwl_mvm_mld_free_sta_link(struct iwl_mvm *mvm,
+			       struct iwl_mvm_sta *mvm_sta,
+			       struct iwl_mvm_link_sta *mvm_sta_link,
+			       unsigned int link_id,
+			       bool is_in_fw)
 {
 	RCU_INIT_POINTER(mvm->fw_id_to_mac_id[mvm_sta_link->sta_id],
 			 is_in_fw ? ERR_PTR(-EINVAL) : NULL);
@@ -582,14 +585,14 @@
 				       struct ieee80211_sta *sta)
 {
 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+	struct ieee80211_link_sta *link_sta;
 	unsigned int link_id;
 	int ret;
 
 	lockdep_assert_held(&mvm->mutex);
 
-	for (link_id = 0; link_id < ARRAY_SIZE(sta->link); link_id++) {
-		if (!rcu_access_pointer(sta->link[link_id]) ||
-		    mvm_sta->link[link_id])
+	for_each_sta_active_link(vif, sta, link_sta, link_id) {
+		if (WARN_ON(mvm_sta->link[link_id]))
 			continue;
 
 		ret = iwl_mvm_mld_alloc_sta_link(mvm, vif, sta, link_id);
@@ -855,10 +858,15 @@
 
 int iwl_mvm_mld_rm_sta_id(struct iwl_mvm *mvm, u8 sta_id)
 {
-	int ret = iwl_mvm_mld_rm_sta_from_fw(mvm, sta_id);
+	int ret;
 
 	lockdep_assert_held(&mvm->mutex);
 
+	if (WARN_ON(sta_id == IWL_MVM_INVALID_STA))
+		return 0;
+
+	ret = iwl_mvm_mld_rm_sta_from_fw(mvm, sta_id);
+
 	RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta_id], NULL);
 	RCU_INIT_POINTER(mvm->fw_id_to_link_sta[sta_id], NULL);
 	return ret;
@@ -1004,7 +1012,8 @@
 
 		cmd.modify.tid = cpu_to_le32(data->tid);
 
-		ret = iwl_mvm_send_cmd_pdu(mvm, cmd_id, 0, sizeof(cmd), &cmd);
+		ret = iwl_mvm_send_cmd_pdu(mvm, cmd_id, CMD_SEND_IN_RFKILL,
+					   sizeof(cmd), &cmd);
 		data->sta_mask = new_sta_mask;
 		if (ret)
 			return ret;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -121,7 +121,7 @@
 	 * if the te is in the time event list or not (when id == TE_MAX)
 	 */
 	u32 id;
-	u8 link_id;
+	s8 link_id;
 };
 
  /* Power management */
@@ -1317,7 +1317,8 @@
 static inline struct ieee80211_bss_conf *
 iwl_mvm_rcu_fw_link_id_to_link_conf(struct iwl_mvm *mvm, u8 link_id, bool rcu)
 {
-	if (WARN_ON(link_id >= ARRAY_SIZE(mvm->link_id_to_link_conf)))
+	if (IWL_FW_CHECK(mvm, link_id >= ARRAY_SIZE(mvm->link_id_to_link_conf),
+			 "erroneous FW link ID: %d\n", link_id))
 		return NULL;
 
 	if (rcu)
@@ -1734,10 +1735,10 @@
 
 static inline u8 iwl_mvm_get_valid_rx_ant(struct iwl_mvm *mvm)
 {
-	u8 rx_ant = mvm->fw->valid_tx_ant;
+	u8 rx_ant = mvm->fw->valid_rx_ant;
 
 	if (mvm->nvm_data && mvm->nvm_data->valid_rx_ant)
-		rx_ant &= mvm->nvm_data->valid_tx_ant;
+		rx_ant &= mvm->nvm_data->valid_rx_ant;
 
 	if (mvm->set_rx_ant)
 		rx_ant &= mvm->set_rx_ant;
@@ -1769,6 +1770,8 @@
 
 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm);
 
+void iwl_mvm_mac_init_mvmvif(struct iwl_mvm *mvm, struct iwl_mvm_vif *mvmvif);
+
 /*
  * FW notifications / CMD responses handlers
  * Convention: iwl_mvm_rx_<NAME OF THE CMD>
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -731,11 +731,6 @@
 	mutex_unlock(&mvm->mutex);
 }
 
-static bool iwl_mvm_fwrt_fw_running(void *ctx)
-{
-	return iwl_mvm_firmware_running(ctx);
-}
-
 static int iwl_mvm_fwrt_send_hcmd(void *ctx, struct iwl_host_cmd *host_cmd)
 {
 	struct iwl_mvm *mvm = (struct iwl_mvm *)ctx;
@@ -756,7 +751,6 @@
 static const struct iwl_fw_runtime_ops iwl_mvm_fwrt_ops = {
 	.dump_start = iwl_mvm_fwrt_dump_start,
 	.dump_end = iwl_mvm_fwrt_dump_end,
-	.fw_running = iwl_mvm_fwrt_fw_running,
 	.send_hcmd = iwl_mvm_fwrt_send_hcmd,
 	.d3_debug_enable = iwl_mvm_d3_debug_enable,
 };
@@ -1459,6 +1453,8 @@
 
 	clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
 
+	iwl_mvm_pause_tcm(mvm, false);
+
 	iwl_fw_dbg_stop_sync(&mvm->fwrt);
 	iwl_trans_stop_device(mvm->trans);
 	iwl_free_fw_paging(&mvm->fwrt);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
@@ -132,14 +132,18 @@
 	if (ret)
 		return ERR_PTR(ret);
 
-	if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != resp_size))
+	if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) !=
+			 resp_size)) {
+		iwl_free_resp(&cmd);
 		return ERR_PTR(-EIO);
+	}
 
 	resp = kmemdup(cmd.resp_pkt->data, resp_size, GFP_KERNEL);
+	iwl_free_resp(&cmd);
+
 	if (!resp)
 		return ERR_PTR(-ENOMEM);
 
-	iwl_free_resp(&cmd);
 	return resp;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
@@ -122,13 +122,8 @@
 
 #define LINK_QUAL_AGG_FRAME_LIMIT_DEF	(63)
 #define LINK_QUAL_AGG_FRAME_LIMIT_MAX	(63)
-/*
- * FIXME - various places in firmware API still use u8,
- * e.g. LQ command and SCD config command.
- * This should be 256 instead.
- */
-#define LINK_QUAL_AGG_FRAME_LIMIT_GEN2_DEF	(255)
-#define LINK_QUAL_AGG_FRAME_LIMIT_GEN2_MAX	(255)
+#define LINK_QUAL_AGG_FRAME_LIMIT_GEN2_DEF	(64)
+#define LINK_QUAL_AGG_FRAME_LIMIT_GEN2_MAX	(64)
 #define LINK_QUAL_AGG_FRAME_LIMIT_MIN	(0)
 
 #define LQ_SIZE		2	/* 2 mode tables:  "Active" and "Search" */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -236,21 +236,13 @@
 static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
 					    struct napi_struct *napi,
 					    struct sk_buff *skb, int queue,
-					    struct ieee80211_sta *sta,
-					    struct ieee80211_link_sta *link_sta)
+					    struct ieee80211_sta *sta)
 {
 	if (unlikely(iwl_mvm_check_pn(mvm, skb, queue, sta))) {
 		kfree_skb(skb);
 		return;
 	}
 
-	if (sta && sta->valid_links && link_sta) {
-		struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
-
-		rx_status->link_valid = 1;
-		rx_status->link_id = link_sta->link_id;
-	}
-
 	ieee80211_rx_napi(mvm->hw, sta, skb, napi);
 }
 
@@ -282,6 +274,7 @@
 				u32 status,
 				struct ieee80211_rx_status *stats)
 {
+	struct wireless_dev *wdev;
 	struct iwl_mvm_sta *mvmsta;
 	struct iwl_mvm_vif *mvmvif;
 	u8 keyid;
@@ -303,9 +296,15 @@
 	if (!ieee80211_is_beacon(hdr->frame_control))
 		return 0;
 
+	if (!sta)
+		return -1;
+
+	mvmsta = iwl_mvm_sta_from_mac80211(sta);
+	mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
+
 	/* key mismatch - will also report !MIC_OK but we shouldn't count it */
 	if (!(status & IWL_RX_MPDU_STATUS_KEY_VALID))
-		return -1;
+		goto report;
 
 	/* good cases */
 	if (likely(status & IWL_RX_MPDU_STATUS_MIC_OK &&
@@ -314,13 +313,6 @@
 		return 0;
 	}
 
-	if (!sta)
-		return -1;
-
-	mvmsta = iwl_mvm_sta_from_mac80211(sta);
-
-	mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
-
 	/*
 	 * both keys will have the same cipher and MIC length, use
 	 * whichever one is available
@@ -329,11 +321,11 @@
 	if (!key) {
 		key = rcu_dereference(mvmvif->bcn_prot.keys[1]);
 		if (!key)
-			return -1;
+			goto report;
 	}
 
 	if (len < key->icv_len + IEEE80211_GMAC_PN_LEN + 2)
-		return -1;
+		goto report;
 
 	/* get the real key ID */
 	keyid = frame[len - key->icv_len - IEEE80211_GMAC_PN_LEN - 2];
@@ -347,7 +339,7 @@
 			return -1;
 		key = rcu_dereference(mvmvif->bcn_prot.keys[keyid - 6]);
 		if (!key)
-			return -1;
+			goto report;
 	}
 
 	/* Report status to mac80211 */
@@ -355,6 +347,10 @@
 		ieee80211_key_mic_failure(key);
 	else if (status & IWL_RX_MPDU_STATUS_REPLAY_ERROR)
 		ieee80211_key_replay(key);
+report:
+	wdev = ieee80211_vif_to_wdev(mvmsta->vif);
+	if (wdev->netdev)
+		cfg80211_rx_unprot_mlme_mgmt(wdev->netdev, (void *)hdr, len);
 
 	return -1;
 }
@@ -583,7 +579,7 @@
 		while ((skb = __skb_dequeue(skb_list))) {
 			iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb,
 							reorder_buf->queue,
-							sta, NULL /* FIXME */);
+							sta);
 			reorder_buf->num_stored--;
 		}
 	}
@@ -2210,6 +2206,11 @@
 			if (IS_ERR(sta))
 				sta = NULL;
 			link_sta = rcu_dereference(mvm->fw_id_to_link_sta[id]);
+
+			if (sta && sta->valid_links && link_sta) {
+				rx_status->link_valid = 1;
+				rx_status->link_id = link_sta->link_id;
+			}
 		}
 	} else if (!is_multicast_ether_addr(hdr->addr2)) {
 		/*
@@ -2353,8 +2354,7 @@
 		    !(desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME))
 			rx_status->flag |= RX_FLAG_AMSDU_MORE;
 
-		iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta,
-						link_sta);
+		iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta);
 	}
 out:
 	rcu_read_unlock();
@@ -2457,8 +2457,11 @@
 	 *
 	 * We mark it as mac header, for upper layers to know where
 	 * all radio tap header ends.
+	 *
+	 * Since data doesn't move data while putting data on skb and that is
+	 * the only way we use, data + len is the next place that hdr would be put
 	 */
-	skb_reset_mac_header(skb);
+	skb_set_mac_header(skb, skb->len);
 
 	/*
 	 * Override the nss from the rx_vec since the rate_n_flags has
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -48,6 +48,8 @@
 /* Number of iterations on the channel for mei filtered scan */
 #define IWL_MEI_SCAN_NUM_ITER	5U
 
+#define WFA_TPC_IE_LEN	9
+
 struct iwl_mvm_scan_timing_params {
 	u32 suspend_time;
 	u32 max_out_time;
@@ -297,8 +299,8 @@
 
 	max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE;
 
-	/* we create the 802.11 header and SSID element */
-	max_probe_len -= 24 + 2;
+	/* we create the 802.11 header SSID element and WFA TPC element */
+	max_probe_len -= 24 + 2 + WFA_TPC_IE_LEN;
 
 	/* DS parameter set element is added on 2.4GHZ band if required */
 	if (iwl_mvm_rrm_scan_needed(mvm))
@@ -725,8 +727,6 @@
 	return newpos;
 }
 
-#define WFA_TPC_IE_LEN	9
-
 static void iwl_mvm_add_tpc_report_ie(u8 *pos)
 {
 	pos[0] = WLAN_EID_VENDOR_SPECIFIC;
@@ -831,8 +831,8 @@
 	return ((n_ssids <= PROBE_OPTION_MAX) &&
 		(n_channels <= mvm->fw->ucode_capa.n_scan_channels) &
 		(ies->common_ie_len +
-		 ies->len[NL80211_BAND_2GHZ] +
-		 ies->len[NL80211_BAND_5GHZ] <=
+		 ies->len[NL80211_BAND_2GHZ] + ies->len[NL80211_BAND_5GHZ] +
+		 ies->len[NL80211_BAND_6GHZ] <=
 		 iwl_mvm_max_scan_ie_fw_cmd_room(mvm)));
 }
 
@@ -1305,7 +1305,7 @@
 		if (IWL_MVM_ADWELL_MAX_BUDGET)
 			cmd->v7.adwell_max_budget =
 				cpu_to_le16(IWL_MVM_ADWELL_MAX_BUDGET);
-		else if (params->ssids && params->ssids[0].ssid_len)
+		else if (params->n_ssids && params->ssids[0].ssid_len)
 			cmd->v7.adwell_max_budget =
 				cpu_to_le16(IWL_SCAN_ADWELL_MAX_BUDGET_DIRECTED_SCAN);
 		else
@@ -1407,7 +1407,7 @@
 	if (IWL_MVM_ADWELL_MAX_BUDGET)
 		general_params->adwell_max_budget =
 			cpu_to_le16(IWL_MVM_ADWELL_MAX_BUDGET);
-	else if (params->ssids && params->ssids[0].ssid_len)
+	else if (params->n_ssids && params->ssids[0].ssid_len)
 		general_params->adwell_max_budget =
 			cpu_to_le16(IWL_SCAN_ADWELL_MAX_BUDGET_DIRECTED_SCAN);
 	else
@@ -1719,7 +1719,10 @@
 				break;
 		}
 
-		if (k == idex_b && idex_b < SCAN_BSSID_MAX_SIZE) {
+		if (k == idex_b && idex_b < SCAN_BSSID_MAX_SIZE &&
+		    !WARN_ONCE(!is_valid_ether_addr(scan_6ghz_params[j].bssid),
+			       "scan: invalid BSSID at index %u, index_b=%u\n",
+			       j, idex_b)) {
 			memcpy(&pp->bssid_array[idex_b++],
 			       scan_6ghz_params[j].bssid, ETH_ALEN);
 		}
@@ -1749,7 +1752,8 @@
 			&cp->channel_config[ch_cnt];
 
 		u32 s_ssid_bitmap = 0, bssid_bitmap = 0, flags = 0;
-		u8 j, k, s_max = 0, b_max = 0, n_used_bssid_entries;
+		u8 k, s_max = 0, b_max = 0, n_used_bssid_entries;
+		u32 j;
 		bool force_passive, found = false, allow_passive = true,
 		     unsolicited_probe_on_chan = false, psc_no_listen = false;
 		s8 psd_20 = IEEE80211_RNR_TBTT_PARAMS_PSD_RESERVED;
@@ -2815,7 +2819,8 @@
 		if (ver_handler->version != scan_ver)
 			continue;
 
-		return ver_handler->handler(mvm, vif, params, type, uid);
+		err = ver_handler->handler(mvm, vif, params, type, uid);
+		return err ? : uid;
 	}
 
 	err = iwl_mvm_scan_umac(mvm, vif, params, type, uid);
@@ -3118,18 +3123,16 @@
 		params.n_channels = j;
 	}
 
-	if (non_psc_included &&
-	    !iwl_mvm_scan_fits(mvm, req->n_ssids, ies, params.n_channels)) {
-		kfree(params.channels);
-		return -ENOBUFS;
+	if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, params.n_channels)) {
+		ret = -ENOBUFS;
+		goto out;
 	}
 
 	uid = iwl_mvm_build_scan_cmd(mvm, vif, &hcmd, &params, type);
-
-	if (non_psc_included)
-		kfree(params.channels);
-	if (uid < 0)
-		return uid;
+	if (uid < 0) {
+		ret = uid;
+		goto out;
+	}
 
 	ret = iwl_mvm_send_cmd(mvm, &hcmd);
 	if (!ret) {
@@ -3146,6 +3149,9 @@
 		mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
 	}
 
+out:
+	if (non_psc_included)
+		kfree(params.channels);
 	return ret;
 }
 
@@ -3172,8 +3178,13 @@
 		struct iwl_mvm_vif_link_info *link_info =
 			scan_vif->link[mvm->scan_link_id];
 
-		if (!WARN_ON(!link_info))
+		/* It is possible that by the time the scan is complete the link
+		 * was already removed and is not valid.
+		 */
+		if (link_info)
 			memcpy(info.tsf_bssid, link_info->bssid, ETH_ALEN);
+		else
+			IWL_DEBUG_SCAN(mvm, "Scan link is no longer valid\n");
 
 		ieee80211_scan_completed(mvm->hw, &info);
 		mvm->scan_vif = NULL;
@@ -3226,13 +3237,23 @@
 		       mvm->scan_start);
 }
 
-static int iwl_mvm_umac_scan_abort(struct iwl_mvm *mvm, int type)
+static int iwl_mvm_umac_scan_abort(struct iwl_mvm *mvm, int type, bool *wait)
 {
-	struct iwl_umac_scan_abort cmd = {};
+	struct iwl_umac_scan_abort abort_cmd = {};
+	struct iwl_host_cmd cmd = {
+		.id = WIDE_ID(IWL_ALWAYS_LONG_GROUP, SCAN_ABORT_UMAC),
+		.len = { sizeof(abort_cmd), },
+		.data = { &abort_cmd, },
+		.flags = CMD_SEND_IN_RFKILL,
+	};
+
 	int uid, ret;
+	u32 status = IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND;
 
 	lockdep_assert_held(&mvm->mutex);
 
+	*wait = true;
+
 	/* We should always get a valid index here, because we already
 	 * checked that this type of scan was running in the generic
 	 * code.
@@ -3241,16 +3262,28 @@
 	if (WARN_ON_ONCE(uid < 0))
 		return uid;
 
-	cmd.uid = cpu_to_le32(uid);
+	abort_cmd.uid = cpu_to_le32(uid);
 
 	IWL_DEBUG_SCAN(mvm, "Sending scan abort, uid %u\n", uid);
 
-	ret = iwl_mvm_send_cmd_pdu(mvm,
-				   WIDE_ID(IWL_ALWAYS_LONG_GROUP, SCAN_ABORT_UMAC),
-				   0, sizeof(cmd), &cmd);
+	ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
+
+	IWL_DEBUG_SCAN(mvm, "Scan abort: ret=%d, status=%u\n", ret, status);
 	if (!ret)
 		mvm->scan_uid_status[uid] = type << IWL_MVM_SCAN_STOPPING_SHIFT;
 
+	/* Handle the case that the FW is no longer familiar with the scan that
+	 * is to be stopped. In such a case, it is expected that the scan
+	 * complete notification was already received but not yet processed.
+	 * In such a case, there is no need to wait for a scan complete
+	 * notification and the flow should continue similar to the case that
+	 * the scan was really aborted.
+	 */
+	if (status == IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND) {
+		mvm->scan_uid_status[uid] = type << IWL_MVM_SCAN_STOPPING_SHIFT;
+		*wait = false;
+	}
+
 	return ret;
 }
 
@@ -3260,6 +3293,7 @@
 	static const u16 scan_done_notif[] = { SCAN_COMPLETE_UMAC,
 					      SCAN_OFFLOAD_COMPLETE, };
 	int ret;
+	bool wait = true;
 
 	lockdep_assert_held(&mvm->mutex);
 
@@ -3271,7 +3305,7 @@
 	IWL_DEBUG_SCAN(mvm, "Preparing to stop scan, type %x\n", type);
 
 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
-		ret = iwl_mvm_umac_scan_abort(mvm, type);
+		ret = iwl_mvm_umac_scan_abort(mvm, type, &wait);
 	else
 		ret = iwl_mvm_lmac_scan_abort(mvm);
 
@@ -3279,6 +3313,10 @@
 		IWL_DEBUG_SCAN(mvm, "couldn't stop scan type %d\n", type);
 		iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
 		return ret;
+	} else if (!wait) {
+		IWL_DEBUG_SCAN(mvm, "no need to wait for scan type %d\n", type);
+		iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
+		return 0;
 	}
 
 	return iwl_wait_notification(&mvm->notif_wait, &wait_scan_done,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2836,7 +2836,12 @@
 		.action = start ? cpu_to_le32(IWL_RX_BAID_ACTION_ADD) :
 				  cpu_to_le32(IWL_RX_BAID_ACTION_REMOVE),
 	};
-	u32 cmd_id = WIDE_ID(DATA_PATH_GROUP, RX_BAID_ALLOCATION_CONFIG_CMD);
+	struct iwl_host_cmd hcmd = {
+		.id = WIDE_ID(DATA_PATH_GROUP, RX_BAID_ALLOCATION_CONFIG_CMD),
+		.flags = CMD_SEND_IN_RFKILL,
+		.len[0] = sizeof(cmd),
+		.data[0] = &cmd,
+	};
 	int ret;
 
 	BUILD_BUG_ON(sizeof(struct iwl_rx_baid_cfg_resp) != sizeof(baid));
@@ -2848,7 +2853,7 @@
 		cmd.alloc.ssn = cpu_to_le16(ssn);
 		cmd.alloc.win_size = cpu_to_le16(buf_size);
 		baid = -EIO;
-	} else if (iwl_fw_lookup_cmd_ver(mvm->fw, cmd_id, 1) == 1) {
+	} else if (iwl_fw_lookup_cmd_ver(mvm->fw, hcmd.id, 1) == 1) {
 		cmd.remove_v1.baid = cpu_to_le32(baid);
 		BUILD_BUG_ON(sizeof(cmd.remove_v1) > sizeof(cmd.remove));
 	} else {
@@ -2857,8 +2862,7 @@
 		cmd.remove.tid = cpu_to_le32(tid);
 	}
 
-	ret = iwl_mvm_send_cmd_pdu_status(mvm, cmd_id, sizeof(cmd),
-					  &cmd, &baid);
+	ret = iwl_mvm_send_cmd_status(mvm, &hcmd, &baid);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -637,6 +637,11 @@
 			   struct ieee80211_sta *sta);
 int iwl_mvm_mld_rm_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 		       struct ieee80211_sta *sta);
+void iwl_mvm_mld_free_sta_link(struct iwl_mvm *mvm,
+			       struct iwl_mvm_sta *mvm_sta,
+			       struct iwl_mvm_link_sta *mvm_sta_link,
+			       unsigned int link_id,
+			       bool is_in_fw);
 int iwl_mvm_mld_rm_sta_id(struct iwl_mvm *mvm, u8 sta_id);
 int iwl_mvm_mld_update_sta_links(struct iwl_mvm *mvm,
 				 struct ieee80211_vif *vif,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -692,7 +692,7 @@
 /* Determine whether mac or link id should be used, and validate the link id */
 static int iwl_mvm_get_session_prot_id(struct iwl_mvm *mvm,
 				       struct ieee80211_vif *vif,
-				       u32 link_id)
+				       s8 link_id)
 {
 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 	int ver = iwl_fw_lookup_cmd_ver(mvm->fw,
@@ -706,8 +706,7 @@
 		 "Invalid link ID for session protection: %u\n", link_id))
 		return -EINVAL;
 
-	if (WARN(ieee80211_vif_is_mld(vif) &&
-		 !(vif->active_links & BIT(link_id)),
+	if (WARN(!mvmvif->link[link_id]->active,
 		 "Session Protection on an inactive link: %u\n", link_id))
 		return -EINVAL;
 
@@ -716,7 +715,7 @@
 
 static void iwl_mvm_cancel_session_protection(struct iwl_mvm *mvm,
 					      struct ieee80211_vif *vif,
-					      u32 id, u32 link_id)
+					      u32 id, s8 link_id)
 {
 	int mac_link_id = iwl_mvm_get_session_prot_id(mvm, vif, link_id);
 	struct iwl_mvm_session_prot_cmd cmd = {
@@ -745,7 +744,7 @@
 	struct ieee80211_vif *vif = te_data->vif;
 	struct iwl_mvm_vif *mvmvif;
 	enum nl80211_iftype iftype;
-	unsigned int link_id;
+	s8 link_id;
 
 	if (!vif)
 		return false;
@@ -899,9 +898,8 @@
 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
 	struct iwl_mvm_session_prot_notif *notif = (void *)pkt->data;
 	unsigned int ver =
-		iwl_fw_lookup_cmd_ver(mvm->fw,
-				      WIDE_ID(MAC_CONF_GROUP,
-					      SESSION_PROTECTION_CMD), 2);
+		iwl_fw_lookup_notif_ver(mvm->fw, MAC_CONF_GROUP,
+					SESSION_PROTECTION_NOTIF, 2);
 	int id = le32_to_cpu(notif->mac_link_id);
 	struct ieee80211_vif *vif;
 	struct iwl_mvm_vif *mvmvif;
@@ -1297,7 +1295,7 @@
 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
 	const u16 notif[] = { WIDE_ID(MAC_CONF_GROUP, SESSION_PROTECTION_NOTIF) };
 	struct iwl_notification_wait wait_notif;
-	int mac_link_id = iwl_mvm_get_session_prot_id(mvm, vif, link_id);
+	int mac_link_id = iwl_mvm_get_session_prot_id(mvm, vif, (s8)link_id);
 	struct iwl_mvm_session_prot_cmd cmd = {
 		.id_and_color = cpu_to_le32(mac_link_id),
 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2012-2014, 2018-2023 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2024 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -1165,6 +1165,9 @@
 	bool is_ampdu = false;
 	int hdrlen;
 
+	if (WARN_ON_ONCE(!sta))
+		return -1;
+
 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
 	fc = hdr->frame_control;
 	hdrlen = ieee80211_hdrlen(fc);
@@ -1172,9 +1175,6 @@
 	if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))
 		return -1;
 
-	if (WARN_ON_ONCE(!mvmsta))
-		return -1;
-
 	if (WARN_ON_ONCE(mvmsta->deflink.sta_id == IWL_MVM_INVALID_STA))
 		return -1;
 
@@ -1305,7 +1305,7 @@
 int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb,
 		       struct ieee80211_sta *sta)
 {
-	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+	struct iwl_mvm_sta *mvmsta;
 	struct ieee80211_tx_info info;
 	struct sk_buff_head mpdus_skbs;
 	struct ieee80211_vif *vif;
@@ -1314,9 +1314,11 @@
 	struct sk_buff *orig_skb = skb;
 	const u8 *addr3;
 
-	if (WARN_ON_ONCE(!mvmsta))
+	if (WARN_ON_ONCE(!sta))
 		return -1;
 
+	mvmsta = iwl_mvm_sta_from_mac80211(sta);
+
 	if (WARN_ON_ONCE(mvmsta->deflink.sta_id == IWL_MVM_INVALID_STA))
 		return -1;
 
@@ -1636,12 +1638,18 @@
  * of the batch. This is why the SSN of the SCD is written at the end of the
  * whole struct at a variable offset. This function knows how to cope with the
  * variable offset and returns the SSN of the SCD.
+ *
+ * For 22000-series and lower, this is just 12 bits. For later, 16 bits.
  */
 static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm *mvm,
 				      struct iwl_mvm_tx_resp *tx_resp)
 {
-	return le32_to_cpup((__le32 *)iwl_mvm_get_agg_status(mvm, tx_resp) +
-			    tx_resp->frame_count) & 0xfff;
+	u32 val = le32_to_cpup((__le32 *)iwl_mvm_get_agg_status(mvm, tx_resp) +
+			       tx_resp->frame_count);
+
+	if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
+		return val & 0xFFFF;
+	return val & 0xFFF;
 }
 
 static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
@@ -68,7 +68,8 @@
 		}
 		break;
 	default:
-		IWL_ERR(trans, "WRT: Invalid buffer destination\n");
+		IWL_DEBUG_FW(trans, "WRT: Invalid buffer destination (%d)\n",
+			     le32_to_cpu(fw_mon_cfg->buf_location));
 	}
 out:
 	if (dbg_flags)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2005-2014, 2018-2023 Intel Corporation
+ * Copyright (C) 2005-2014, 2018-2024 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -210,6 +210,7 @@
 	{IWL_PCI_DEVICE(0x088E, 0x446A, iwl6035_2agn_sff_cfg)},
 	{IWL_PCI_DEVICE(0x088E, 0x4860, iwl6035_2agn_cfg)},
 	{IWL_PCI_DEVICE(0x088F, 0x5260, iwl6035_2agn_cfg)},
+	{IWL_PCI_DEVICE(0x088F, 0x526A, iwl6035_2agn_cfg)},
 
 /* 105 Series */
 	{IWL_PCI_DEVICE(0x0894, 0x0022, iwl105_bgn_cfg)},
@@ -501,13 +502,45 @@
 	{IWL_PCI_DEVICE(0x7E40, PCI_ANY_ID, iwl_ma_trans_cfg)},
 
 /* Bz devices */
-	{IWL_PCI_DEVICE(0x2727, PCI_ANY_ID, iwl_bz_trans_cfg)},
-	{IWL_PCI_DEVICE(0x272b, PCI_ANY_ID, iwl_bz_trans_cfg)},
-	{IWL_PCI_DEVICE(0xA840, PCI_ANY_ID, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0x272b, PCI_ANY_ID, iwl_gl_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0000, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0090, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0094, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0098, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x009C, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x00C0, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x00C4, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x00E0, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x00E4, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x00E8, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x00EC, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0100, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0110, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0114, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0118, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x011C, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0310, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0314, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0510, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x0A10, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x1671, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x1672, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x1771, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x1772, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x1791, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x1792, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x4090, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x40C4, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x40E0, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x4110, iwl_bz_trans_cfg)},
+	{IWL_PCI_DEVICE(0xA840, 0x4314, iwl_bz_trans_cfg)},
 	{IWL_PCI_DEVICE(0x7740, PCI_ANY_ID, iwl_bz_trans_cfg)},
 
 /* Sc devices */
 	{IWL_PCI_DEVICE(0xE440, PCI_ANY_ID, iwl_sc_trans_cfg)},
+	{IWL_PCI_DEVICE(0xE340, PCI_ANY_ID, iwl_sc_trans_cfg)},
+	{IWL_PCI_DEVICE(0xD340, PCI_ANY_ID, iwl_sc_trans_cfg)},
+	{IWL_PCI_DEVICE(0x6E70, PCI_ANY_ID, iwl_sc_trans_cfg)},
 #endif /* CONFIG_IWLMVM */
 
 	{0}
@@ -1115,6 +1148,16 @@
 		      IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
 		      IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
 		      iwl_cfg_sc, iwl_sc_name),
+	_IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
+		      IWL_CFG_MAC_TYPE_SC2, IWL_CFG_ANY,
+		      IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
+		      IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
+		      iwl_cfg_sc2, iwl_sc2_name),
+	_IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
+		      IWL_CFG_MAC_TYPE_SC2F, IWL_CFG_ANY,
+		      IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
+		      IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
+		      iwl_cfg_sc2f, iwl_sc2f_name),
 #endif /* CONFIG_IWLMVM */
 };
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intel/iwlwifi/queue/tx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intel/iwlwifi/queue/tx.c
@@ -1588,9 +1588,9 @@
 		return;
 
 	tfd_num = iwl_txq_get_cmd_index(txq, ssn);
-	read_ptr = iwl_txq_get_cmd_index(txq, txq->read_ptr);
 
 	spin_lock_bh(&txq->lock);
+	read_ptr = iwl_txq_get_cmd_index(txq, txq->read_ptr);
 
 	if (!test_bit(txq_id, trans->txqs.queue_used)) {
 		IWL_DEBUG_TX_QUEUES(trans, "Q %d inactive - ignoring idx %d\n",
--- linux-qcom-6.8.0.orig/drivers/net/wireless/intersil/p54/p54spi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/intersil/p54/p54spi.c
@@ -624,7 +624,7 @@
 	gpio_direction_input(p54spi_gpio_irq);
 
 	ret = request_irq(gpio_to_irq(p54spi_gpio_irq),
-			  p54spi_interrupt, 0, "p54spi",
+			  p54spi_interrupt, IRQF_NO_AUTOEN, "p54spi",
 			  priv->spi);
 	if (ret < 0) {
 		dev_err(&priv->spi->dev, "request_irq() failed");
@@ -633,8 +633,6 @@
 
 	irq_set_irq_type(gpio_to_irq(p54spi_gpio_irq), IRQ_TYPE_EDGE_RISING);
 
-	disable_irq(gpio_to_irq(p54spi_gpio_irq));
-
 	INIT_WORK(&priv->work, p54spi_work);
 	init_completion(&priv->fw_comp);
 	INIT_LIST_HEAD(&priv->tx_pending);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/libertas/cmd.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/libertas/cmd.c
@@ -1132,7 +1132,7 @@
 		if (!cmdarray[i].cmdbuf) {
 			lbs_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n");
 			ret = -1;
-			goto done;
+			goto free_cmd_array;
 		}
 	}
 
@@ -1140,8 +1140,17 @@
 		init_waitqueue_head(&cmdarray[i].cmdwait_q);
 		lbs_cleanup_and_insert_cmd(priv, &cmdarray[i]);
 	}
-	ret = 0;
+	return 0;
 
+free_cmd_array:
+	for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) {
+		if (cmdarray[i].cmdbuf) {
+			kfree(cmdarray[i].cmdbuf);
+			cmdarray[i].cmdbuf = NULL;
+		}
+	}
+	kfree(priv->cmd_array);
+	priv->cmd_array = NULL;
 done:
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/libertas/radiotap.h
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/libertas/radiotap.h
@@ -2,7 +2,7 @@
 #include <net/ieee80211_radiotap.h>
 
 struct tx_radiotap_hdr {
-	struct ieee80211_radiotap_header hdr;
+	struct ieee80211_radiotap_header_fixed hdr;
 	u8 rate;
 	u8 txpower;
 	u8 rts_retries;
@@ -31,7 +31,7 @@
 #define IEEE80211_FC_DSTODS          0x0300
 
 struct rx_radiotap_hdr {
-	struct ieee80211_radiotap_header hdr;
+	struct ieee80211_radiotap_header_fixed hdr;
 	u8 flags;
 	u8 rate;
 	u8 antsignal;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -926,6 +926,8 @@
 		return -EOPNOTSUPP;
 	}
 
+	priv->bss_num = mwifiex_get_unused_bss_num(adapter, priv->bss_type);
+
 	spin_lock_irqsave(&adapter->main_proc_lock, flags);
 	adapter->main_locked = false;
 	spin_unlock_irqrestore(&adapter->main_proc_lock, flags);
@@ -4361,11 +4363,27 @@
 	if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info))
 		wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
 
-	wiphy->bands[NL80211_BAND_2GHZ] = &mwifiex_band_2ghz;
-	if (adapter->config_bands & BAND_A)
-		wiphy->bands[NL80211_BAND_5GHZ] = &mwifiex_band_5ghz;
-	else
+	wiphy->bands[NL80211_BAND_2GHZ] = devm_kmemdup(adapter->dev,
+						       &mwifiex_band_2ghz,
+						       sizeof(mwifiex_band_2ghz),
+						       GFP_KERNEL);
+	if (!wiphy->bands[NL80211_BAND_2GHZ]) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	if (adapter->config_bands & BAND_A) {
+		wiphy->bands[NL80211_BAND_5GHZ] = devm_kmemdup(adapter->dev,
+							       &mwifiex_band_5ghz,
+							       sizeof(mwifiex_band_5ghz),
+							       GFP_KERNEL);
+		if (!wiphy->bands[NL80211_BAND_5GHZ]) {
+			ret = -ENOMEM;
+			goto err;
+		}
+	} else {
 		wiphy->bands[NL80211_BAND_5GHZ] = NULL;
+	}
 
 	if (adapter->drcs_enabled && ISSUPP_DRCS_ENABLED(adapter->fw_cap_info))
 		wiphy->iface_combinations = &mwifiex_iface_comb_ap_sta_drcs;
@@ -4459,8 +4477,7 @@
 	if (ret < 0) {
 		mwifiex_dbg(adapter, ERROR,
 			    "%s: wiphy_register failed: %d\n", __func__, ret);
-		wiphy_free(wiphy);
-		return ret;
+		goto err;
 	}
 
 	if (!adapter->regd) {
@@ -4502,4 +4519,9 @@
 
 	adapter->wiphy = wiphy;
 	return ret;
+
+err:
+	wiphy_free(wiphy);
+
+	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/debugfs.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/debugfs.c
@@ -970,9 +970,6 @@
 	priv->dfs_dev_dir = debugfs_create_dir(priv->netdev->name,
 					       mwifiex_dfs_dir);
 
-	if (!priv->dfs_dev_dir)
-		return;
-
 	MWIFIEX_DFS_ADD_FILE(info);
 	MWIFIEX_DFS_ADD_FILE(debug);
 	MWIFIEX_DFS_ADD_FILE(getlog);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/fw.h
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -206,6 +206,7 @@
 #define TLV_TYPE_CHANNEL_STATS      (PROPRIETARY_TLV_BASE_ID + 198)
 #define TLV_BTCOEX_WL_AGGR_WINSIZE  (PROPRIETARY_TLV_BASE_ID + 202)
 #define TLV_BTCOEX_WL_SCANTIME      (PROPRIETARY_TLV_BASE_ID + 203)
+#define TLV_TYPE_LED_CONTROL        (PROPRIETARY_TLV_BASE_ID + 205)
 #define TLV_TYPE_BSS_MODE           (PROPRIETARY_TLV_BASE_ID + 206)
 #define TLV_TYPE_RANDOM_MAC         (PROPRIETARY_TLV_BASE_ID + 236)
 #define TLV_TYPE_CHAN_ATTR_CFG      (PROPRIETARY_TLV_BASE_ID + 237)
@@ -353,6 +354,7 @@
 #define HostCmd_CMD_802_11_AD_HOC_JOIN                0x002c
 #define HostCmd_CMD_802_11_AD_HOC_STOP                0x0040
 #define HostCmd_CMD_802_11_MAC_ADDRESS                0x004D
+#define HostCmd_CMD_802_11_LED_CONTROL                0X004E
 #define HostCmd_CMD_802_11D_DOMAIN_INFO               0x005b
 #define HostCmd_CMD_802_11_KEY_MATERIAL               0x005e
 #define HostCmd_CMD_802_11_BG_SCAN_CONFIG             0x006b
@@ -842,7 +844,7 @@
 struct mwifiex_ie_types_wildcard_ssid_params {
 	struct mwifiex_ie_types_header header;
 	u8 max_ssid_length;
-	u8 ssid[1];
+	u8 ssid[];
 } __packed;
 
 #define TSF_DATA_SIZE            8
@@ -1191,6 +1193,16 @@
 	u8 oper_mode;
 } __packed;
 
+struct mwifiex_led_param {
+	__le16 mode;
+	__le16 on;
+} __packed;
+
+struct mwifiex_ie_types_led_param {
+	struct mwifiex_ie_types_header header;
+	struct mwifiex_led_param led_cfg;
+} __packed;
+
 struct host_cmd_ds_802_11_ad_hoc_start {
 	u8 ssid[IEEE80211_MAX_SSID_LEN];
 	u8 bss_mode;
@@ -1314,6 +1326,11 @@
 	} params;
 } __packed;
 
+struct host_cmd_ds_802_11_led_control {
+	__le16 action;
+	__le16 num_led;
+} __packed;
+
 enum SNMP_MIB_INDEX {
 	OP_RATE_SET_I = 1,
 	DTIM_PERIOD_I = 3,
@@ -1587,7 +1604,7 @@
 
 struct host_cmd_ds_802_11_scan_ext {
 	u32   reserved;
-	u8    tlv_buffer[1];
+	u8    tlv_buffer[];
 } __packed;
 
 struct mwifiex_ie_types_bss_mode {
@@ -2371,6 +2388,7 @@
 		struct host_cmd_sdio_sp_rx_aggr_cfg sdio_rx_aggr_cfg;
 		struct host_cmd_ds_multi_chan_policy mc_policy;
 		struct host_cmd_ds_robust_coex coex;
+		struct host_cmd_ds_802_11_led_control led_cfg;
 		struct host_cmd_ds_wakeup_reason hs_wakeup_reason;
 		struct host_cmd_ds_gtk_rekey_params rekey;
 		struct host_cmd_ds_chan_region_cfg reg_cfg;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/main.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/main.c
@@ -752,8 +752,10 @@
 static int
 mwifiex_open(struct net_device *dev)
 {
-	netif_carrier_off(dev);
+	struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
+	netif_carrier_off(dev);
+	mwifiex_set_led(priv->adapter, MWIFIEX_LED_ON);
 	return 0;
 }
 
@@ -784,6 +786,7 @@
 		cfg80211_sched_scan_stopped(priv->wdev.wiphy, 0);
 	}
 
+	mwifiex_set_led(priv->adapter, MWIFIEX_LED_OFF);
 	return 0;
 }
 
@@ -1633,7 +1636,8 @@
 	}
 
 	ret = devm_request_irq(dev, adapter->irq_wakeup,
-			       mwifiex_irq_wakeup_handler, IRQF_TRIGGER_LOW,
+			       mwifiex_irq_wakeup_handler,
+			       IRQF_TRIGGER_LOW | IRQF_NO_AUTOEN,
 			       "wifi_wake", adapter);
 	if (ret) {
 		dev_err(dev, "Failed to request irq_wakeup %d (%d)\n",
@@ -1641,7 +1645,6 @@
 		goto err_exit;
 	}
 
-	disable_irq(adapter->irq_wakeup);
 	if (device_init_wakeup(dev, true)) {
 		dev_err(dev, "fail to init wakeup for mwifiex\n");
 		goto err_exit;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/main.h
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/main.h
@@ -122,6 +122,10 @@
 
 #define PKT_TYPE_MGMT	0xE5
 
+#define MWIFIEX_LED_ON		1
+#define MWIFIEX_LED_OFF		0
+#define MWIFIEX_LED_MAX		3
+
 /*
  * Do not check for data_received for USB, as data_received
  * is handled in mwifiex_usb_recv for USB
@@ -681,6 +685,7 @@
 	struct mwifiex_user_scan_chan hidden_chan[MWIFIEX_USER_SCAN_CHAN_MAX];
 	u8 assoc_resp_ht_param;
 	bool ht_param_present;
+	bool is_edge_gateway;
 };
 
 
@@ -1289,6 +1294,9 @@
 
 	for (i = 0; i < adapter->priv_num; i++) {
 		if (adapter->priv[i]) {
+			if (adapter->priv[i]->bss_mode == NL80211_IFTYPE_UNSPECIFIED)
+				continue;
+
 			if ((adapter->priv[i]->bss_num == bss_num) &&
 			    (adapter->priv[i]->bss_type == bss_type))
 				break;
@@ -1476,6 +1484,7 @@
 				struct cmd_ctrl_node *cmd_queued);
 int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
 		      struct cfg80211_ssid *req_ssid);
+int mwifiex_set_led(struct mwifiex_adapter *adapter, int on);
 int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type);
 int mwifiex_enable_hs(struct mwifiex_adapter *adapter);
 int mwifiex_disable_auto_ds(struct mwifiex_private *priv);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -377,6 +377,8 @@
 					const struct pci_device_id *ent)
 {
 	struct pcie_service_card *card;
+	struct mwifiex_private *priv;
+	struct pci_dev *pdev_host;
 	int ret;
 
 	pr_debug("info: vendor=0x%4.04X device=0x%4.04X rev=%d\n",
@@ -418,6 +420,14 @@
 		return -1;
 	}
 
+	priv = mwifiex_get_priv(card->adapter, MWIFIEX_BSS_ROLE_STA);
+	pdev_host = pci_get_subsys(PCI_ANY_ID, PCI_ANY_ID, 0x1028, 0x0720, NULL);
+	if (!pdev_host)
+		pdev_host = pci_get_subsys(PCI_ANY_ID, PCI_ANY_ID, 0x1028, 0x0733, NULL);
+	if (pdev_host) {
+		priv->is_edge_gateway = true;
+		pci_dev_put(pdev_host);
+	}
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/scan.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -2532,8 +2532,7 @@
 	ext_scan_resp = &resp->params.ext_scan;
 
 	tlv = (void *)ext_scan_resp->tlv_buffer;
-	buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN
-					      - 1);
+	buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN);
 
 	while (buf_left >= sizeof(struct mwifiex_ie_types_header)) {
 		type = le16_to_cpu(tlv->type);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -416,6 +416,31 @@
 	return 0;
 }
 
+static int mwifiex_cmd_802_11_led_cfg(struct mwifiex_private *priv,
+				      struct host_cmd_ds_command *cmd,
+				      u16 cmd_action,
+				      struct mwifiex_led_param *ledcfg_param)
+{
+	struct host_cmd_ds_802_11_led_control *led_cfg = &cmd->params.led_cfg;
+	struct mwifiex_ie_types_led_param *led_tlv;
+	u8 *pos;
+
+	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_LED_CONTROL);
+	cmd->size = cpu_to_le16(S_DS_GEN);
+	le16_add_cpu(&cmd->size, sizeof(struct host_cmd_ds_802_11_led_control));
+
+	led_cfg->action = cpu_to_le16(cmd_action);
+	led_cfg->num_led = cpu_to_le16(MWIFIEX_LED_MAX);
+
+	pos = (u8 *)led_cfg + sizeof(struct host_cmd_ds_802_11_led_control);
+	led_tlv = (void *)pos;
+	led_tlv->header.type = cpu_to_le16(TLV_TYPE_LED_CONTROL);
+	led_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_led_param));
+	memcpy(&led_tlv->led_cfg, ledcfg_param, sizeof(struct mwifiex_led_param));
+	le16_add_cpu(&cmd->size, sizeof(struct mwifiex_ie_types_led_param));
+	return 0;
+}
+
 /*
  * This function prepares command to set/get MAC address.
  *
@@ -1987,6 +2012,10 @@
 		ret = mwifiex_cmd_802_11_hs_cfg(priv, cmd_ptr, cmd_action,
 				(struct mwifiex_hs_config_param *) data_buf);
 		break;
+	case HostCmd_CMD_802_11_LED_CONTROL:
+		ret = mwifiex_cmd_802_11_led_cfg(priv, cmd_ptr, cmd_action,
+						 data_buf);
+		break;
 	case HostCmd_CMD_802_11_SCAN:
 		ret = mwifiex_cmd_802_11_scan(cmd_ptr, data_buf);
 		break;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
@@ -1422,6 +1422,8 @@
 	case HostCmd_CMD_ROBUST_COEX:
 		ret = mwifiex_ret_robust_coex(priv, resp, data_buf);
 		break;
+	case HostCmd_CMD_802_11_LED_CONTROL:
+		break;
 	case HostCmd_CMD_GTK_REKEY_OFFLOAD_CFG:
 		break;
 	case HostCmd_CMD_CHAN_REGION_CFG:
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
@@ -558,6 +558,24 @@
 }
 EXPORT_SYMBOL_GPL(mwifiex_enable_hs);
 
+int mwifiex_set_led(struct mwifiex_adapter *adapter, int on)
+{
+	struct mwifiex_private *priv;
+	struct mwifiex_led_param ledcfg;
+
+	priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
+	if (!priv->is_edge_gateway)
+		return -ENODEV;
+
+	memset(&ledcfg, 0, sizeof(struct mwifiex_led_param));
+	ledcfg.on = cpu_to_le16(on);
+
+	return mwifiex_send_cmd(priv,
+				HostCmd_CMD_802_11_LED_CONTROL,
+				HostCmd_ACT_GEN_SET, 0,
+				&ledcfg, true);
+}
+
 /*
  * IOCTL request handler to get BSS information.
  *
--- linux-qcom-6.8.0.orig/drivers/net/wireless/marvell/mwl8k.c
+++ linux-qcom-6.8.0/drivers/net/wireless/marvell/mwl8k.c
@@ -2718,7 +2718,7 @@
 		cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_MULTICAST);
 		cmd->numaddr = cpu_to_le16(mc_count);
 		netdev_hw_addr_list_for_each(ha, mc_list) {
-			memcpy(cmd->addr[i], ha->addr, ETH_ALEN);
+			memcpy(cmd->addr[i++], ha->addr, ETH_ALEN);
 		}
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -1515,7 +1515,7 @@
 
 void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
 {
-	struct mt76_phy *phy = dev->phys[wcid->phy_idx];
+	struct mt76_phy *phy = mt76_dev_phy(dev, wcid->phy_idx);
 	struct ieee80211_hw *hw;
 	struct sk_buff_head list;
 	struct sk_buff *skb;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
@@ -4,6 +4,13 @@
 #include "mac.h"
 #include "../dma.h"
 
+static const u8 wmm_queue_map[] = {
+	[IEEE80211_AC_BK] = 0,
+	[IEEE80211_AC_BE] = 1,
+	[IEEE80211_AC_VI] = 2,
+	[IEEE80211_AC_VO] = 3,
+};
+
 static void
 mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb)
 {
@@ -22,10 +29,10 @@
 	struct ieee80211_sta *sta;
 	struct mt7603_sta *msta;
 	struct mt76_wcid *wcid;
+	u8 qid, tid = 0, hwq = 0;
 	void *priv;
 	int idx;
 	u32 val;
-	u8 tid = 0;
 
 	if (skb->len < MT_TXD_SIZE + sizeof(struct ieee80211_hdr))
 		goto free;
@@ -42,19 +49,36 @@
 		goto free;
 
 	priv = msta = container_of(wcid, struct mt7603_sta, wcid);
-	val = le32_to_cpu(txd[0]);
-	val &= ~(MT_TXD0_P_IDX | MT_TXD0_Q_IDX);
-	val |= FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_HW_QUEUE_MGMT);
-	txd[0] = cpu_to_le32(val);
 
 	sta = container_of(priv, struct ieee80211_sta, drv_priv);
 	hdr = (struct ieee80211_hdr *)&skb->data[MT_TXD_SIZE];
-	if (ieee80211_is_data_qos(hdr->frame_control))
+
+	hwq = wmm_queue_map[IEEE80211_AC_BE];
+	if (ieee80211_is_data_qos(hdr->frame_control)) {
 		tid = *ieee80211_get_qos_ctl(hdr) &
-		      IEEE80211_QOS_CTL_TAG1D_MASK;
-	skb_set_queue_mapping(skb, tid_to_ac[tid]);
+			 IEEE80211_QOS_CTL_TAG1D_MASK;
+		qid = tid_to_ac[tid];
+		hwq = wmm_queue_map[qid];
+		skb_set_queue_mapping(skb, qid);
+	} else if (ieee80211_is_data(hdr->frame_control)) {
+		skb_set_queue_mapping(skb, IEEE80211_AC_BE);
+		hwq = wmm_queue_map[IEEE80211_AC_BE];
+	} else {
+		skb_pull(skb, MT_TXD_SIZE);
+		if (!ieee80211_is_bufferable_mmpdu(skb))
+			goto free;
+		skb_push(skb, MT_TXD_SIZE);
+		skb_set_queue_mapping(skb, MT_TXQ_PSD);
+		hwq = MT_TX_HW_QUEUE_MGMT;
+	}
+
 	ieee80211_sta_set_buffered(sta, tid, true);
 
+	val = le32_to_cpu(txd[0]);
+	val &= ~(MT_TXD0_P_IDX | MT_TXD0_Q_IDX);
+	val |= FIELD_PREP(MT_TXD0_Q_IDX, hwq);
+	txd[0] = cpu_to_le32(val);
+
 	spin_lock_bh(&dev->ps_lock);
 	__skb_queue_tail(&msta->psq, skb);
 	if (skb_queue_len(&msta->psq) >= 64) {
@@ -151,12 +175,6 @@
 
 int mt7603_dma_init(struct mt7603_dev *dev)
 {
-	static const u8 wmm_queue_map[] = {
-		[IEEE80211_AC_BK] = 0,
-		[IEEE80211_AC_BE] = 1,
-		[IEEE80211_AC_VI] = 2,
-		[IEEE80211_AC_VO] = 3,
-	};
 	int ret;
 	int i;
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
@@ -1393,6 +1393,7 @@
 		   MT_CLIENT_RESET_TX_R_E_2_S);
 
 	/* Start PSE client TX abort */
+	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_FORCE_TX_EOF);
 	mt76_set(dev, addr, MT_CLIENT_RESET_TX_R_E_1);
 	mt76_poll_msec(dev, addr, MT_CLIENT_RESET_TX_R_E_1_S,
 		       MT_CLIENT_RESET_TX_R_E_1_S, 500);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7615/init.c
@@ -56,6 +56,9 @@
 
 	name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7615_%s",
 			      wiphy_name(wiphy));
+	if (!name)
+		return -ENOMEM;
+
 	hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, dev,
 						       mt7615_hwmon_groups);
 	return PTR_ERR_OR_ZERO(hwmon);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h
@@ -28,8 +28,6 @@
 #define MT_RXD0_MESH			BIT(18)
 #define MT_RXD0_MHCP			BIT(19)
 #define MT_RXD0_NORMAL_ETH_TYPE_OFS	GENMASK(22, 16)
-#define MT_RXD0_NORMAL_IP_SUM		BIT(23)
-#define MT_RXD0_NORMAL_UDP_TCP_SUM	BIT(24)
 
 #define MT_RXD0_SW_PKT_TYPE_MASK	GENMASK(31, 16)
 #define MT_RXD0_SW_PKT_TYPE_MAP		0x380F
@@ -80,6 +78,8 @@
 #define MT_RXD3_NORMAL_BEACON_UC	BIT(21)
 #define MT_RXD3_NORMAL_CO_ANT		BIT(22)
 #define MT_RXD3_NORMAL_FCS_ERR		BIT(24)
+#define MT_RXD3_NORMAL_IP_SUM		BIT(26)
+#define MT_RXD3_NORMAL_UDP_TCP_SUM	BIT(27)
 #define MT_RXD3_NORMAL_VLAN2ETH		BIT(31)
 
 /* RXD DW4 */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
@@ -66,7 +66,7 @@
 
 	if ((!is_connac_v1(dev) && addr == MCU_PATCH_ADDRESS) ||
 	    (is_mt7921(dev) && addr == 0x900000) ||
-	    (is_mt7925(dev) && addr == 0x900000) ||
+	    (is_mt7925(dev) && (addr == 0x900000 || addr == 0xe0002800)) ||
 	    (is_mt7996(dev) && addr == 0x900000) ||
 	    (is_mt7992(dev) && addr == 0x900000))
 		cmd = MCU_CMD(PATCH_START_REQ);
@@ -257,7 +257,7 @@
 	};
 	u16 ntlv;
 
-	ptlv = skb_put(skb, len);
+	ptlv = skb_put_zero(skb, len);
 	memcpy(ptlv, &tlv, sizeof(tlv));
 
 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
@@ -1667,7 +1667,7 @@
 	set_bit(MT76_HW_SCANNING, &phy->state);
 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
 
-	req = (struct mt76_connac_hw_scan_req *)skb_put(skb, sizeof(*req));
+	req = (struct mt76_connac_hw_scan_req *)skb_put_zero(skb, sizeof(*req));
 
 	req->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
 	req->bss_idx = mvif->idx;
@@ -1795,7 +1795,7 @@
 
 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
 
-	req = (struct mt76_connac_sched_scan_req *)skb_put(skb, sizeof(*req));
+	req = (struct mt76_connac_sched_scan_req *)skb_put_zero(skb, sizeof(*req));
 	req->version = 1;
 	req->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
 
@@ -2101,7 +2101,7 @@
 		int j, msg_len, num_ch;
 		struct sk_buff *skb;
 
-		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
+		num_ch = i == batch_size - 1 ? n_chan - i * batch_len : batch_len;
 		msg_len = sizeof(tx_power_tlv) + num_ch * sizeof(sku_tlbv);
 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
 		if (!skb) {
@@ -2318,7 +2318,7 @@
 		return -ENOMEM;
 
 	skb_put_data(skb, &hdr, sizeof(hdr));
-	gtk_tlv = (struct mt76_connac_gtk_rekey_tlv *)skb_put(skb,
+	gtk_tlv = (struct mt76_connac_gtk_rekey_tlv *)skb_put_zero(skb,
 							 sizeof(*gtk_tlv));
 	gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
 	gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
@@ -2443,7 +2443,7 @@
 		return -ENOMEM;
 
 	skb_put_data(skb, &hdr, sizeof(hdr));
-	ptlv = (struct mt76_connac_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
+	ptlv = (struct mt76_connac_wow_pattern_tlv *)skb_put_zero(skb, sizeof(*ptlv));
 	ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
 	ptlv->len = cpu_to_le16(sizeof(*ptlv));
 	ptlv->data_len = pattern->pattern_len;
@@ -2524,6 +2524,7 @@
 			__le16 tag;
 			__le16 len;
 			u8 suspend;
+			u8 pad[7];
 		} __packed hif_suspend;
 	} req = {
 		.hif_suspend = {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
@@ -808,6 +808,7 @@
 	STA_REC_MLD = 0x20,
 	STA_REC_EHT = 0x22,
 	STA_REC_PN_INFO = 0x26,
+	STA_REC_KEY_V3 = 0x27,
 	STA_REC_HDRT = 0x28,
 	STA_REC_HDR_TRANS = 0x2B,
 	STA_REC_MAX_NUM
@@ -935,6 +936,9 @@
 	PHY_TYPE_INDEX_NUM
 };
 
+#define HR_DSSS_ERP_BASIC_RATE			GENMASK(3, 0)
+#define OFDM_BASIC_RATE				(BIT(6) | BIT(8) | BIT(10))
+
 #define PHY_TYPE_BIT_HR_DSSS			BIT(PHY_TYPE_HR_DSSS_INDEX)
 #define PHY_TYPE_BIT_ERP			BIT(PHY_TYPE_ERP_INDEX)
 #define PHY_TYPE_BIT_OFDM			BIT(PHY_TYPE_OFDM_INDEX)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
@@ -1049,6 +1049,7 @@
 mt7915_rate_txpower_set(struct file *file, const char __user *user_buf,
 			size_t count, loff_t *ppos)
 {
+	int i, ret, pwr, pwr160 = 0, pwr80 = 0, pwr40 = 0, pwr20 = 0;
 	struct mt7915_phy *phy = file->private_data;
 	struct mt7915_dev *dev = phy->dev;
 	struct mt76_phy *mphy = phy->mt76;
@@ -1057,7 +1058,6 @@
 		.band_idx = phy->mt76->band_idx,
 	};
 	char buf[100];
-	int i, ret, pwr160 = 0, pwr80 = 0, pwr40 = 0, pwr20 = 0;
 	enum mac80211_rx_encoding mode;
 	u32 offs = 0, len = 0;
 
@@ -1130,8 +1130,8 @@
 	if (ret)
 		goto out;
 
-	mphy->txpower_cur = max(mphy->txpower_cur,
-				max(pwr160, max(pwr80, max(pwr40, pwr20))));
+	pwr = max3(pwr80, pwr40, pwr20);
+	mphy->txpower_cur = max3(mphy->txpower_cur, pwr160, pwr);
 out:
 	mutex_unlock(&dev->mt76.mutex);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7915/init.c
@@ -194,6 +194,8 @@
 
 	name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7915_%s",
 			      wiphy_name(wiphy));
+	if (!name)
+		return -ENOMEM;
 
 	cdev = thermal_cooling_device_register(name, phy, &mt7915_thermal_ops);
 	if (!IS_ERR(cdev)) {
@@ -398,6 +400,7 @@
 	ieee80211_hw_set(hw, SUPPORTS_RX_DECAP_OFFLOAD);
 	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
+	ieee80211_hw_set(hw, SUPPORTS_TX_FRAG);
 
 	hw->max_tx_fragments = 4;
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
@@ -1538,12 +1538,14 @@
 		set_bit(MT76_RESET, &phy2->mt76->state);
 		cancel_delayed_work_sync(&phy2->mt76->mac_work);
 	}
+
+	mutex_lock(&dev->mt76.mutex);
+
 	mt76_worker_disable(&dev->mt76.tx_worker);
 	mt76_for_each_q_rx(&dev->mt76, i)
 		napi_disable(&dev->mt76.napi[i]);
 	napi_disable(&dev->mt76.tx_napi);
 
-	mutex_lock(&dev->mt76.mutex);
 
 	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7915/main.c
@@ -564,8 +564,7 @@
 
 	MT76_FILTER(CONTROL, MT_WF_RFCR_DROP_CTS |
 			     MT_WF_RFCR_DROP_RTS |
-			     MT_WF_RFCR_DROP_CTL_RSV |
-			     MT_WF_RFCR_DROP_NDPA);
+			     MT_WF_RFCR_DROP_CTL_RSV);
 
 	*total_flags = flags;
 	rxfilter = phy->rxfilter;
@@ -1575,6 +1574,12 @@
 }
 
 static int
+mt7915_set_frag_threshold(struct ieee80211_hw *hw, u32 val)
+{
+	return 0;
+}
+
+static int
 mt7915_set_radar_background(struct ieee80211_hw *hw,
 			    struct cfg80211_chan_def *chandef)
 {
@@ -1700,6 +1705,7 @@
 	.sta_set_decap_offload = mt7915_sta_set_decap_offload,
 	.add_twt_setup = mt7915_mac_add_twt_setup,
 	.twt_teardown_request = mt7915_twt_teardown_request,
+	.set_frag_threshold = mt7915_set_frag_threshold,
 	CFG80211_TESTMODE_CMD(mt76_testmode_cmd)
 	CFG80211_TESTMODE_DUMP(mt76_testmode_dump)
 #ifdef CONFIG_MAC80211_DEBUGFS
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -424,7 +424,7 @@
 		.len = cpu_to_le16(sub_len),
 	};
 
-	ptlv = skb_put(skb, sub_len);
+	ptlv = skb_put_zero(skb, sub_len);
 	memcpy(ptlv, &tlv, sizeof(tlv));
 
 	le16_add_cpu(sub_ntlv, 1);
@@ -690,13 +690,17 @@
 {
 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
 	struct mt7915_vif *mvif = msta->vif;
+	int ret;
 
+	mt76_worker_disable(&dev->mt76.tx_worker);
 	if (enable && !params->amsdu)
 		msta->wcid.amsdu = false;
+	ret = mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
+				     MCU_EXT_CMD(STA_REC_UPDATE),
+				     enable, true);
+	mt76_worker_enable(&dev->mt76.tx_worker);
 
-	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
-				      MCU_EXT_CMD(STA_REC_UPDATE),
-				      enable, true);
+	return ret;
 }
 
 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
@@ -490,6 +490,11 @@
 		return dev->reg.map[i].maps + ofs;
 	}
 
+	return 0;
+}
+
+static u32 __mt7915_reg_remap_addr(struct mt7915_dev *dev, u32 addr)
+{
 	if ((addr >= MT_INFRA_BASE && addr < MT_WFSYS0_PHY_START) ||
 	    (addr >= MT_WFSYS0_PHY_START && addr < MT_WFSYS1_PHY_START) ||
 	    (addr >= MT_WFSYS1_PHY_START && addr <= MT_WFSYS1_PHY_END))
@@ -514,15 +519,30 @@
 {
 	u32 addr = __mt7915_reg_addr(dev, offset);
 
-	memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
+	if (addr) {
+		memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
+		return;
+	}
+
+	spin_lock_bh(&dev->reg_lock);
+	memcpy_fromio(buf, dev->mt76.mmio.regs +
+			   __mt7915_reg_remap_addr(dev, offset), len);
+	spin_unlock_bh(&dev->reg_lock);
 }
 
 static u32 mt7915_rr(struct mt76_dev *mdev, u32 offset)
 {
 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
-	u32 addr = __mt7915_reg_addr(dev, offset);
+	u32 addr = __mt7915_reg_addr(dev, offset), val;
 
-	return dev->bus_ops->rr(mdev, addr);
+	if (addr)
+		return dev->bus_ops->rr(mdev, addr);
+
+	spin_lock_bh(&dev->reg_lock);
+	val = dev->bus_ops->rr(mdev, __mt7915_reg_remap_addr(dev, offset));
+	spin_unlock_bh(&dev->reg_lock);
+
+	return val;
 }
 
 static void mt7915_wr(struct mt76_dev *mdev, u32 offset, u32 val)
@@ -530,7 +550,14 @@
 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 	u32 addr = __mt7915_reg_addr(dev, offset);
 
-	dev->bus_ops->wr(mdev, addr, val);
+	if (addr) {
+		dev->bus_ops->wr(mdev, addr, val);
+		return;
+	}
+
+	spin_lock_bh(&dev->reg_lock);
+	dev->bus_ops->wr(mdev, __mt7915_reg_remap_addr(dev, offset), val);
+	spin_unlock_bh(&dev->reg_lock);
 }
 
 static u32 mt7915_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
@@ -538,7 +565,14 @@
 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 	u32 addr = __mt7915_reg_addr(dev, offset);
 
-	return dev->bus_ops->rmw(mdev, addr, mask, val);
+	if (addr)
+		return dev->bus_ops->rmw(mdev, addr, mask, val);
+
+	spin_lock_bh(&dev->reg_lock);
+	val = dev->bus_ops->rmw(mdev, __mt7915_reg_remap_addr(dev, offset), mask, val);
+	spin_unlock_bh(&dev->reg_lock);
+
+	return val;
 }
 
 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
@@ -707,6 +741,7 @@
 
 	dev = container_of(mdev, struct mt7915_dev, mt76);
 	mt76_mmio_init(&dev->mt76, mem_base);
+	spin_lock_init(&dev->reg_lock);
 
 	switch (device_id) {
 	case 0x7915:
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
@@ -287,6 +287,7 @@
 
 	struct list_head sta_rc_list;
 	struct list_head twt_list;
+	spinlock_t reg_lock;
 
 	u32 hw_pattern;
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7921/init.c
@@ -52,6 +52,8 @@
 
 	name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7921_%s",
 			      wiphy_name(wiphy));
+	if (!name)
+		return -ENOMEM;
 
 	hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy,
 						       mt7921_hwmon_groups);
@@ -83,7 +85,7 @@
 		}
 
 		/* UNII-4 */
-		if (IS_UNII_INVALID(0, 5850, 5925))
+		if (IS_UNII_INVALID(0, 5845, 5925))
 			ch->flags |= IEEE80211_CHAN_DISABLED;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
@@ -663,6 +663,7 @@
 	int i, ret;
 
 	dev_dbg(dev->mt76.dev, "chip reset\n");
+	set_bit(MT76_RESET, &dev->mphy.state);
 	dev->hw_full_reset = true;
 	ieee80211_stop_queues(hw);
 
@@ -691,6 +692,7 @@
 	}
 
 	dev->hw_full_reset = false;
+	clear_bit(MT76_RESET, &dev->mphy.state);
 	pm->suspended = false;
 	ieee80211_wake_queues(hw);
 	ieee80211_iterate_active_interfaces(hw,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -1139,7 +1139,7 @@
 				    struct inet6_dev *idev)
 {
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
-	struct mt792x_dev *dev = mvif->phy->dev;
+	struct mt792x_dev *dev = mt792x_hw_dev(hw);
 	struct inet6_ifaddr *ifa;
 	struct in6_addr ns_addrs[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
 	struct sk_buff *skb;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -1272,7 +1272,7 @@
 		.mtcl_conf = mt792x_acpi_get_mtcl_conf(&dev->phy, alpha2),
 	};
 	int ret, valid_cnt = 0;
-	u16 buf_len = 0;
+	u32 buf_len = 0;
 	u8 *pos;
 
 	if (!clc)
@@ -1283,7 +1283,7 @@
 	if (mt76_find_power_limits_node(&dev->mt76))
 		req.cap |= CLC_CAP_DTS_EN;
 
-	buf_len = le16_to_cpu(clc->len) - sizeof(*clc);
+	buf_len = le32_to_cpu(clc->len) - sizeof(*clc);
 	pos = clc->data;
 	while (buf_len > 16) {
 		struct mt7921_clc_rule *rule = (struct mt7921_clc_rule *)pos;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
@@ -387,6 +387,7 @@
 	struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
 
 	mt7921e_unregister_device(dev);
+	set_bit(MT76_REMOVED, &mdev->phy.state);
 	devm_free_irq(&pdev->dev, pdev->irq, dev);
 	mt76_free_device(&dev->mt76);
 	pci_free_irq_vectors(pdev);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c
@@ -64,7 +64,6 @@
 	mt76_wr(dev, dev->irq_map->host_irq_enable, 0);
 	mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0x0);
 
-	set_bit(MT76_RESET, &dev->mphy.state);
 	set_bit(MT76_MCU_RESET, &dev->mphy.state);
 	wake_up(&dev->mt76.mcu.wait);
 	skb_queue_purge(&dev->mt76.mcu.res_q);
@@ -115,7 +114,6 @@
 
 	err = __mt7921_start(&dev->phy);
 out:
-	clear_bit(MT76_RESET, &dev->mphy.state);
 
 	local_bh_disable();
 	napi_enable(&dev->mt76.tx_napi);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c
@@ -98,7 +98,6 @@
 	mt76_connac_free_pending_tx_skbs(&dev->pm, NULL);
 	mt76_txq_schedule_all(&dev->mphy);
 	mt76_worker_disable(&dev->mt76.tx_worker);
-	set_bit(MT76_RESET, &dev->mphy.state);
 	set_bit(MT76_MCU_RESET, &dev->mphy.state);
 	wake_up(&dev->mt76.mcu.wait);
 	skb_queue_purge(&dev->mt76.mcu.res_q);
@@ -135,7 +134,6 @@
 
 	err = __mt7921_start(&dev->phy);
 out:
-	clear_bit(MT76_RESET, &dev->mphy.state);
 
 	mt76_worker_enable(&dev->mt76.tx_worker);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
@@ -350,7 +350,7 @@
 static int
 mt7925_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)
 {
-	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
+	u32 csum_mask = MT_RXD3_NORMAL_IP_SUM | MT_RXD3_NORMAL_UDP_TCP_SUM;
 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
 	bool hdr_trans, unicast, insert_ccmp_hdr = false;
 	u8 chfreq, qos_ctl = 0, remove_pad, amsdu_info;
@@ -360,7 +360,6 @@
 	struct mt792x_phy *phy = &dev->phy;
 	struct ieee80211_supported_band *sband;
 	u32 csum_status = *(u32 *)skb->cb;
-	u32 rxd0 = le32_to_cpu(rxd[0]);
 	u32 rxd1 = le32_to_cpu(rxd[1]);
 	u32 rxd2 = le32_to_cpu(rxd[2]);
 	u32 rxd3 = le32_to_cpu(rxd[3]);
@@ -418,7 +417,7 @@
 	if (!sband->channels)
 		return -EINVAL;
 
-	if (mt76_is_mmio(&dev->mt76) && (rxd0 & csum_mask) == csum_mask &&
+	if (mt76_is_mmio(&dev->mt76) && (rxd3 & csum_mask) == csum_mask &&
 	    !(csum_status & (BIT(0) | BIT(2) | BIT(3))))
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -359,6 +359,7 @@
 	mvif->sta.wcid.phy_idx = mvif->mt76.band_idx;
 	mvif->sta.wcid.hw_key_idx = -1;
 	mvif->sta.wcid.tx_info |= MT_WCID_TX_INFO_SET;
+	mvif->sta.vif = mvif;
 	mt76_wcid_init(&mvif->sta.wcid);
 
 	mt7925_mac_wtbl_update(dev, idx,
@@ -388,6 +389,19 @@
 	mt7925_mcu_abort_roc(phy, mvif, phy->roc_token_id);
 }
 
+void mt7925_roc_abort_sync(struct mt792x_dev *dev)
+{
+	struct mt792x_phy *phy = &dev->phy;
+
+	del_timer_sync(&phy->roc_timer);
+	cancel_work_sync(&phy->roc_work);
+	if (test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
+		ieee80211_iterate_interfaces(mt76_hw(dev),
+					     IEEE80211_IFACE_ITER_RESUME_ALL,
+					     mt7925_roc_iter, (void *)phy);
+}
+EXPORT_SYMBOL_GPL(mt7925_roc_abort_sync);
+
 void mt7925_roc_work(struct work_struct *work)
 {
 	struct mt792x_phy *phy;
@@ -526,7 +540,7 @@
 	if (cmd == SET_KEY && !mvif->mt76.cipher) {
 		struct mt792x_phy *phy = mt792x_hw_phy(hw);
 
-		mvif->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
+		mvif->mt76.cipher = mt7925_mcu_get_cipher(key->cipher);
 		mt7925_mcu_add_bss_info(phy, mvif->mt76.ctx, vif, sta, true);
 	}
 
@@ -710,7 +724,7 @@
 
 		if (slottime != phy->slottime) {
 			phy->slottime = slottime;
-			mt792x_mac_set_timeing(phy);
+			mt7925_mcu_set_timing(phy, vif);
 		}
 	}
 
@@ -830,6 +844,8 @@
 	struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
 
+	mt7925_roc_abort_sync(dev);
+
 	mt76_connac_free_pending_tx_skbs(&dev->pm, &msta->wcid);
 	mt76_connac_pm_wake(&dev->mphy, &dev->pm);
 
@@ -1274,6 +1290,25 @@
 }
 
 static int
+mt7925_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+	       unsigned int link_id, u16 queue,
+	       const struct ieee80211_tx_queue_params *params)
+{
+	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+	static const u8 mq_to_aci[] = {
+		    [IEEE80211_AC_VO] = 3,
+		    [IEEE80211_AC_VI] = 2,
+		    [IEEE80211_AC_BE] = 0,
+		    [IEEE80211_AC_BK] = 1,
+	};
+
+	/* firmware uses access class index */
+	mvif->queue_params[mq_to_aci[queue]] = *params;
+
+	return 0;
+}
+
+static int
 mt7925_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 		struct ieee80211_bss_conf *link_conf)
 {
@@ -1396,7 +1431,7 @@
 	.add_interface = mt7925_add_interface,
 	.remove_interface = mt792x_remove_interface,
 	.config = mt7925_config,
-	.conf_tx = mt792x_conf_tx,
+	.conf_tx = mt7925_conf_tx,
 	.configure_filter = mt7925_configure_filter,
 	.bss_info_changed = mt7925_bss_info_changed,
 	.start_ap = mt7925_start_ap,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -613,6 +613,9 @@
 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
 		clc = (const struct mt7925_clc *)(clc_base + offset);
 
+		if (clc->idx > ARRAY_SIZE(phy->clc))
+			break;
+
 		/* do not init buf again if chip reset triggered */
 		if (phy->clc[clc->idx])
 			continue;
@@ -814,6 +817,7 @@
 			     struct ieee80211_vif *vif,
 			     struct ieee80211_sta *sta)
 {
+	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
 	struct sta_rec_hdr_trans *hdr_trans;
 	struct mt76_wcid *wcid;
 	struct tlv *tlv;
@@ -827,7 +831,11 @@
 	else
 		hdr_trans->from_ds = true;
 
-	wcid = (struct mt76_wcid *)sta->drv_priv;
+	if (sta)
+		wcid = (struct mt76_wcid *)sta->drv_priv;
+	else
+		wcid = &mvif->sta.wcid;
+
 	if (!wcid)
 		return;
 
@@ -895,7 +903,7 @@
 
 		e = (struct edca *)tlv;
 		e->set = WMM_PARAM_SET;
-		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
+		e->queue = ac;
 		e->aifs = q->aifs;
 		e->txop = cpu_to_le16(q->txop);
 
@@ -921,61 +929,67 @@
 		       struct ieee80211_key_conf *key,
 		       enum set_key_cmd cmd)
 {
+	struct mt792x_sta *msta = container_of(wcid, struct mt792x_sta, wcid);
 	struct sta_rec_sec_uni *sec;
+	struct mt792x_vif *mvif = msta->vif;
+	struct ieee80211_sta *sta;
+	struct ieee80211_vif *vif;
 	struct tlv *tlv;
 
-	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
+	sta = msta == &mvif->sta ?
+		      NULL :
+		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
+	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
+
+	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
 	sec = (struct sta_rec_sec_uni *)tlv;
-	sec->add = cmd;
+	sec->bss_idx = mvif->mt76.idx;
+	sec->is_authenticator = 0;
+	sec->mgmt_prot = 0;
+	sec->wlan_idx = (u8)wcid->idx;
+
+	if (sta) {
+		sec->tx_key = 1;
+		sec->key_type = 1;
+		memcpy(sec->peer_addr, sta->addr, ETH_ALEN);
+	} else {
+		memcpy(sec->peer_addr, vif->bss_conf.bssid, ETH_ALEN);
+	}
 
 	if (cmd == SET_KEY) {
-		struct sec_key_uni *sec_key;
 		u8 cipher;
 
-		cipher = mt76_connac_mcu_get_cipher(key->cipher);
-		if (cipher == MCU_CIPHER_NONE)
+		sec->add = 1;
+		cipher = mt7925_mcu_get_cipher(key->cipher);
+		if (cipher == CONNAC3_CIPHER_NONE)
 			return -EOPNOTSUPP;
 
-		sec_key = &sec->key[0];
-		sec_key->cipher_len = sizeof(*sec_key);
-
-		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
-			sec_key->wlan_idx = cpu_to_le16(wcid->idx);
-			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
-			sec_key->key_id = sta_key_conf->keyidx;
-			sec_key->key_len = 16;
-			memcpy(sec_key->key, sta_key_conf->key, 16);
-
-			sec_key = &sec->key[1];
-			sec_key->wlan_idx = cpu_to_le16(wcid->idx);
-			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
-			sec_key->cipher_len = sizeof(*sec_key);
-			sec_key->key_len = 16;
-			memcpy(sec_key->key, key->key, 16);
-			sec->n_cipher = 2;
+		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
+			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
+			sec->key_id = sta_key_conf->keyidx;
+			sec->key_len = 32;
+			memcpy(sec->key, sta_key_conf->key, 16);
+			memcpy(sec->key + 16, key->key, 16);
 		} else {
-			sec_key->wlan_idx = cpu_to_le16(wcid->idx);
-			sec_key->cipher_id = cipher;
-			sec_key->key_id = key->keyidx;
-			sec_key->key_len = key->keylen;
-			memcpy(sec_key->key, key->key, key->keylen);
+			sec->cipher_id = cipher;
+			sec->key_id = key->keyidx;
+			sec->key_len = key->keylen;
+			memcpy(sec->key, key->key, key->keylen);
 
-			if (cipher == MCU_CIPHER_TKIP) {
+			if (cipher == CONNAC3_CIPHER_TKIP) {
 				/* Rx/Tx MIC keys are swapped */
-				memcpy(sec_key->key + 16, key->key + 24, 8);
-				memcpy(sec_key->key + 24, key->key + 16, 8);
+				memcpy(sec->key + 16, key->key + 24, 8);
+				memcpy(sec->key + 24, key->key + 16, 8);
 			}
 
 			/* store key_conf for BIP batch update */
-			if (cipher == MCU_CIPHER_AES_CCMP) {
+			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
 				memcpy(sta_key_conf->key, key->key, key->keylen);
 				sta_key_conf->keyidx = key->keyidx;
 			}
-
-			sec->n_cipher = 1;
 		}
 	} else {
-		sec->n_cipher = 0;
+		sec->add = 0;
 	}
 
 	return 0;
@@ -1460,12 +1474,10 @@
 	struct tlv *tlv;
 	u8 af = 0, mm = 0;
 
-	if (!sta->deflink.ht_cap.ht_supported && !sta->deflink.he_6ghz_capa.capa)
-		return;
-
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
 	phy = (struct sta_rec_phy *)tlv;
 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif, chandef->chan->band, sta);
+	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
 	if (sta->deflink.ht_cap.ht_supported) {
 		af = sta->deflink.ht_cap.ampdu_factor;
 		mm = sta->deflink.ht_cap.ampdu_density;
@@ -1573,8 +1585,6 @@
 {
 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
 	struct mt76_dev *dev = phy->dev;
-	struct wtbl_req_hdr *wtbl_hdr;
-	struct tlv *sta_wtbl;
 	struct sk_buff *skb;
 
 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
@@ -1598,30 +1608,11 @@
 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->sta,
 					    info->vif, info->rcpi,
 					    info->state);
-		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->sta);
 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->sta);
 	}
 
-	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
-					   sizeof(struct tlv));
-
-	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, info->wcid,
-						  WTBL_RESET_AND_SET,
-						  sta_wtbl, &skb);
-	if (IS_ERR(wtbl_hdr))
-		return PTR_ERR(wtbl_hdr);
-
-	if (info->enable) {
-		mt76_connac_mcu_wtbl_generic_tlv(dev, skb, info->vif,
-						 info->sta, sta_wtbl,
-						 wtbl_hdr);
-		mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, info->vif, info->wcid,
-						   sta_wtbl, wtbl_hdr);
-		if (info->sta)
-			mt76_connac_mcu_wtbl_ht_tlv(dev, skb, info->sta,
-						    sta_wtbl, wtbl_hdr,
-						    true, true);
-	}
+	if (info->enable)
+		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->sta);
 
 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
 }
@@ -2049,9 +2040,9 @@
 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &phy->chandef;
 	enum nl80211_band band = chandef->chan->band;
 	struct mt76_connac_bss_basic_tlv *basic_req;
-	u8 idx, basic_phy;
 	struct tlv *tlv;
 	int conn_type;
+	u8 idx;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
@@ -2062,8 +2053,10 @@
 
 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band, sta);
 
-	basic_phy = mt76_connac_get_phy_mode_v2(phy, vif, band, sta);
-	basic_req->nonht_basic_phy = cpu_to_le16(basic_phy);
+	if (band == NL80211_BAND_2GHZ)
+		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
+	else
+		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
 
 	memcpy(basic_req->bssid, vif->bss_conf.bssid, ETH_ALEN);
 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, sta);
@@ -2122,21 +2115,21 @@
 	sec = (struct bss_sec_tlv *)tlv;
 
 	switch (mvif->cipher) {
-	case MCU_CIPHER_GCMP_256:
-	case MCU_CIPHER_GCMP:
+	case CONNAC3_CIPHER_GCMP_256:
+	case CONNAC3_CIPHER_GCMP:
 		sec->mode = MODE_WPA3_SAE;
 		sec->status = 8;
 		break;
-	case MCU_CIPHER_AES_CCMP:
+	case CONNAC3_CIPHER_AES_CCMP:
 		sec->mode = MODE_WPA2_PSK;
 		sec->status = 6;
 		break;
-	case MCU_CIPHER_TKIP:
+	case CONNAC3_CIPHER_TKIP:
 		sec->mode = MODE_WPA2_PSK;
 		sec->status = 4;
 		break;
-	case MCU_CIPHER_WEP104:
-	case MCU_CIPHER_WEP40:
+	case CONNAC3_CIPHER_WEP104:
+	case CONNAC3_CIPHER_WEP40:
 		sec->mode = MODE_SHARED;
 		sec->status = 0;
 		break;
@@ -2167,6 +2160,11 @@
 
 	bmc = (struct bss_rate_tlv *)tlv;
 
+	if (band == NL80211_BAND_2GHZ)
+		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
+	else
+		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
+
 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
 	bmc->bc_fixed_rate = idx;
 	bmc->mc_fixed_rate = idx;
@@ -2249,6 +2247,38 @@
 		vif->bss_conf.he_bss_color.color : 0;
 }
 
+static void
+mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+{
+	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+	struct mt792x_phy *phy = mvif->phy;
+	struct bss_ifs_time_tlv *ifs_time;
+	struct tlv *tlv;
+
+	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
+	ifs_time = (struct bss_ifs_time_tlv *)tlv;
+	ifs_time->slot_valid = true;
+	ifs_time->slot_time = cpu_to_le16(phy->slottime);
+}
+
+int mt7925_mcu_set_timing(struct mt792x_phy *phy,
+			  struct ieee80211_vif *vif)
+{
+	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+	struct mt792x_dev *dev = phy->dev;
+	struct sk_buff *skb;
+
+	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
+					 MT7925_BSS_UPDATE_MAX_SIZE);
+	if (IS_ERR(skb))
+		return PTR_ERR(skb);
+
+	mt7925_mcu_bss_ifs_tlv(skb, vif);
+
+	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
+}
+
 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
 			    struct ieee80211_chanctx_conf *ctx,
 			    struct ieee80211_vif *vif,
@@ -2273,6 +2303,7 @@
 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, vif, sta);
 	mt7925_mcu_bss_qos_tlv(skb, vif);
 	mt7925_mcu_bss_mld_tlv(skb, vif, sta);
+	mt7925_mcu_bss_ifs_tlv(skb, vif);
 
 	if (vif->bss_conf.he_support) {
 		mt7925_mcu_bss_he_tlv(skb, vif, phy);
@@ -2845,12 +2876,16 @@
 	if (cmd & __MCU_CMD_FIELD_UNI) {
 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
-		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 		uni_txd->cid = cpu_to_le16(mcu_cmd);
 		uni_txd->s2d_index = MCU_S2D_H2N;
 		uni_txd->pkt_type = MCU_PKT_ID;
 		uni_txd->seq = seq;
 
+		if (cmd & __MCU_CMD_FIELD_QUERY)
+			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
+		else
+			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
+
 		goto exit;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
@@ -159,6 +159,20 @@
 	UNI_EVENT_SCAN_DONE_NLO = 3,
 };
 
+enum connac3_mcu_cipher_type {
+	CONNAC3_CIPHER_NONE = 0,
+	CONNAC3_CIPHER_WEP40 = 1,
+	CONNAC3_CIPHER_TKIP = 2,
+	CONNAC3_CIPHER_AES_CCMP = 4,
+	CONNAC3_CIPHER_WEP104 = 5,
+	CONNAC3_CIPHER_BIP_CMAC_128 = 6,
+	CONNAC3_CIPHER_WEP128 = 7,
+	CONNAC3_CIPHER_WAPI = 8,
+	CONNAC3_CIPHER_CCMP_256 = 10,
+	CONNAC3_CIPHER_GCMP = 11,
+	CONNAC3_CIPHER_GCMP_256 = 12,
+};
+
 struct mt7925_mcu_scan_chinfo_event {
 	u8 nr_chan;
 	u8 alpha2[3];
@@ -334,7 +348,8 @@
 struct bss_rate_tlv {
 	__le16 tag;
 	__le16 len;
-	u8 __rsv1[4];
+	u8 __rsv1[2];
+	__le16 basic_rate;
 	__le16 bc_trans;
 	__le16 mc_trans;
 	u8 short_preamble;
@@ -382,25 +397,22 @@
 	u8 _rsv2[3];
 } __packed;
 
-struct sec_key_uni {
-	__le16 wlan_idx;
-	u8 mgmt_prot;
-	u8 cipher_id;
-	u8 cipher_len;
-	u8 key_id;
-	u8 key_len;
-	u8 need_resp;
-	u8 key[32];
-} __packed;
-
 struct sta_rec_sec_uni {
 	__le16 tag;
 	__le16 len;
 	u8 add;
-	u8 n_cipher;
-	u8 rsv[2];
-
-	struct sec_key_uni key[2];
+	u8 tx_key;
+	u8 key_type;
+	u8 is_authenticator;
+	u8 peer_addr[6];
+	u8 bss_idx;
+	u8 cipher_id;
+	u8 key_id;
+	u8 key_len;
+	u8 wlan_idx;
+	u8 mgmt_prot;
+	u8 key[32];
+	u8 key_rsc[16];
 } __packed;
 
 struct sta_rec_hdr_trans {
@@ -428,6 +440,22 @@
 	} __packed link[2];
 } __packed;
 
+struct bss_ifs_time_tlv {
+	__le16 tag;
+	__le16 len;
+	u8 slot_valid;
+	u8 sifs_valid;
+	u8 rifs_valid;
+	u8 eifs_valid;
+	__le16 slot_time;
+	__le16 sifs_time;
+	__le16 rifs_time;
+	__le16 eifs_time;
+	u8 eifs_cck_valid;
+	u8 rsv;
+	__le16 eifs_cck_time;
+} __packed;
+
 #define MT7925_STA_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +		\
 					 sizeof(struct sta_rec_basic) +		\
 					 sizeof(struct sta_rec_bf) +		\
@@ -440,7 +468,7 @@
 					 sizeof(struct sta_rec_bfee) +		\
 					 sizeof(struct sta_rec_phy) +		\
 					 sizeof(struct sta_rec_ra) +		\
-					 sizeof(struct sta_rec_sec) +		\
+					 sizeof(struct sta_rec_sec_uni) +   \
 					 sizeof(struct sta_rec_ra_fixed) +	\
 					 sizeof(struct sta_rec_he_6g_capa) +	\
 					 sizeof(struct sta_rec_eht) +		\
@@ -455,6 +483,7 @@
 					 sizeof(struct bss_mld_tlv) +			\
 					 sizeof(struct bss_info_uni_he) +		\
 					 sizeof(struct bss_info_uni_bss_color) +	\
+					 sizeof(struct bss_ifs_time_tlv) +		\
 					 sizeof(struct tlv))
 
 #define MT_CONNAC3_SKU_POWER_LIMIT      449
@@ -506,9 +535,36 @@
 	u8 offset;
 	u8 mask[MT76_CONNAC_WOW_MASK_MAX_LEN];
 	u8 pattern[MT76_CONNAC_WOW_PATTEN_MAX_LEN];
-	u8 rsv[4];
+	u8 rsv[7];
 } __packed;
 
+static inline enum connac3_mcu_cipher_type
+mt7925_mcu_get_cipher(int cipher)
+{
+	switch (cipher) {
+	case WLAN_CIPHER_SUITE_WEP40:
+		return CONNAC3_CIPHER_WEP40;
+	case WLAN_CIPHER_SUITE_WEP104:
+		return CONNAC3_CIPHER_WEP104;
+	case WLAN_CIPHER_SUITE_TKIP:
+		return CONNAC3_CIPHER_TKIP;
+	case WLAN_CIPHER_SUITE_AES_CMAC:
+		return CONNAC3_CIPHER_BIP_CMAC_128;
+	case WLAN_CIPHER_SUITE_CCMP:
+		return CONNAC3_CIPHER_AES_CCMP;
+	case WLAN_CIPHER_SUITE_CCMP_256:
+		return CONNAC3_CIPHER_CCMP_256;
+	case WLAN_CIPHER_SUITE_GCMP:
+		return CONNAC3_CIPHER_GCMP;
+	case WLAN_CIPHER_SUITE_GCMP_256:
+		return CONNAC3_CIPHER_GCMP_256;
+	case WLAN_CIPHER_SUITE_SMS4:
+		return CONNAC3_CIPHER_WAPI;
+	default:
+		return CONNAC3_CIPHER_NONE;
+	}
+}
+
 int mt7925_mcu_set_dbdc(struct mt76_phy *phy);
 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
 		       struct ieee80211_scan_request *scan_req);
@@ -525,6 +581,8 @@
 			    struct ieee80211_vif *vif,
 			    struct ieee80211_sta *sta,
 			    int enable);
+int mt7925_mcu_set_timing(struct mt792x_phy *phy,
+			  struct ieee80211_vif *vif);
 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable);
 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy);
 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h
@@ -295,6 +295,7 @@
 		       enum mt7925_roc_req type, u8 token_id);
 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_vif *vif,
 			 u8 token_id);
+void mt7925_roc_abort_sync(struct mt792x_dev *dev);
 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
 			    int cmd, int *wait_seq);
 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
@@ -386,6 +386,8 @@
 
 	dev_info(mdev->dev, "ASIC revision: %04x\n", mdev->rev);
 
+	mt76_rmw_field(dev, MT_HW_EMI_CTL, MT_HW_EMI_CTL_SLPPROT_EN, 1);
+
 	ret = mt792x_wfsys_reset(dev);
 	if (ret)
 		goto err_free_dev;
@@ -425,6 +427,7 @@
 	struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
 
 	mt7925e_unregister_device(dev);
+	set_bit(MT76_REMOVED, &mdev->phy.state);
 	devm_free_irq(&pdev->dev, pdev->irq, dev);
 	mt76_free_device(&dev->mt76);
 	pci_free_irq_vectors(pdev);
@@ -443,6 +446,8 @@
 	cancel_delayed_work_sync(&pm->ps_work);
 	cancel_work_sync(&pm->wake_work);
 
+	mt7925_roc_abort_sync(dev);
+
 	err = mt792x_mcu_drv_pmctrl(dev);
 	if (err < 0)
 		goto restore_suspend;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
@@ -66,13 +66,15 @@
 }
 
 /* MTCL : Country List Table for 6G band */
-static void
+static int
 mt792x_asar_acpi_read_mtcl(struct mt792x_dev *dev, u8 **table, u8 *version)
 {
-	if (mt792x_acpi_read(dev, MT792x_ACPI_MTCL, table, NULL) < 0)
-		*version = 1;
-	else
-		*version = 2;
+	int ret;
+
+	*version = ((ret = mt792x_acpi_read(dev, MT792x_ACPI_MTCL, table, NULL)) < 0)
+		   ? 1 : 2;
+
+	return ret;
 }
 
 /* MTDS : Dynamic SAR Power Table */
@@ -166,16 +168,16 @@
 	if (!asar)
 		return -ENOMEM;
 
-	mt792x_asar_acpi_read_mtcl(dev, (u8 **)&asar->countrylist, &asar->ver);
+	ret = mt792x_asar_acpi_read_mtcl(dev, (u8 **)&asar->countrylist, &asar->ver);
+	if (ret) {
+		devm_kfree(dev->mt76.dev, asar->countrylist);
+		asar->countrylist = NULL;
+	}
 
-	/* MTDS is mandatory. Return error if table is invalid */
 	ret = mt792x_asar_acpi_read_mtds(dev, (u8 **)&asar->dyn, asar->ver);
 	if (ret) {
 		devm_kfree(dev->mt76.dev, asar->dyn);
-		devm_kfree(dev->mt76.dev, asar->countrylist);
-		devm_kfree(dev->mt76.dev, asar);
-
-		return ret;
+		asar->dyn = NULL;
 	}
 
 	/* MTGS is optional */
@@ -290,7 +292,7 @@
 	const struct cfg80211_sar_capa *capa = phy->mt76->hw->wiphy->sar_capa;
 	int i;
 
-	if (!phy->acpisar)
+	if (!phy->acpisar || !((struct mt792x_acpi_sar *)phy->acpisar)->dyn)
 		return 0;
 
 	/* When ACPI SAR enabled in HW, we should apply rules for .frp
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt792x_core.c
@@ -354,6 +354,7 @@
 	"v_tx_bw_40",
 	"v_tx_bw_80",
 	"v_tx_bw_160",
+	"v_tx_bw_320",
 	"v_tx_mcs_0",
 	"v_tx_mcs_1",
 	"v_tx_mcs_2",
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
@@ -12,6 +12,8 @@
 {
 	struct mt792x_dev *dev = dev_instance;
 
+	if (test_bit(MT76_REMOVED, &dev->mt76.phy.state))
+		return IRQ_NONE;
 	mt76_wr(dev, dev->irq_map->host_irq_enable, 0);
 
 	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
@@ -123,14 +125,13 @@
 
 int mt792x_dma_enable(struct mt792x_dev *dev)
 {
-	if (is_mt7925(&dev->mt76))
-		mt76_rmw(dev, MT_UWFDMA0_GLO_CFG_EXT1, BIT(28), BIT(28));
-
 	/* configure perfetch settings */
 	mt792x_dma_prefetch(dev);
 
 	/* reset dma idx */
 	mt76_wr(dev, MT_WFDMA0_RST_DTX_PTR, ~0);
+	if (is_mt7925(&dev->mt76))
+		mt76_wr(dev, MT_WFDMA0_RST_DRX_PTR, ~0);
 
 	/* configure delay interrupt */
 	mt76_wr(dev, MT_WFDMA0_PRI_DLY_INT_CFG0, 0);
@@ -140,12 +141,20 @@
 		 MT_WFDMA0_GLO_CFG_FIFO_LITTLE_ENDIAN |
 		 MT_WFDMA0_GLO_CFG_CLK_GAT_DIS |
 		 MT_WFDMA0_GLO_CFG_OMIT_TX_INFO |
+		 FIELD_PREP(MT_WFDMA0_GLO_CFG_DMA_SIZE, 3) |
+		 MT_WFDMA0_GLO_CFG_FIFO_DIS_CHECK |
+		 MT_WFDMA0_GLO_CFG_RX_WB_DDONE |
 		 MT_WFDMA0_GLO_CFG_CSR_DISP_BASE_PTR_CHAIN_EN |
 		 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
 
 	mt76_set(dev, MT_WFDMA0_GLO_CFG,
 		 MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN);
 
+	if (is_mt7925(&dev->mt76)) {
+		mt76_rmw(dev, MT_UWFDMA0_GLO_CFG_EXT1, BIT(28), BIT(28));
+		mt76_set(dev, MT_WFDMA0_INT_RX_PRI, 0x0F00);
+		mt76_set(dev, MT_WFDMA0_INT_TX_PRI, 0x7F00);
+	}
 	mt76_set(dev, MT_WFDMA_DUMMY_CR, MT_WFDMA_NEED_REINIT);
 
 	/* enable interrupts for TX/RX rings */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
@@ -292,9 +292,12 @@
 #define MT_WFDMA0_GLO_CFG_TX_DMA_BUSY	BIT(1)
 #define MT_WFDMA0_GLO_CFG_RX_DMA_EN	BIT(2)
 #define MT_WFDMA0_GLO_CFG_RX_DMA_BUSY	BIT(3)
+#define MT_WFDMA0_GLO_CFG_DMA_SIZE	GENMASK(5, 4)
 #define MT_WFDMA0_GLO_CFG_TX_WB_DDONE	BIT(6)
 #define MT_WFDMA0_GLO_CFG_FW_DWLD_BYPASS_DMASHDL BIT(9)
+#define MT_WFDMA0_GLO_CFG_FIFO_DIS_CHECK	BIT(11)
 #define MT_WFDMA0_GLO_CFG_FIFO_LITTLE_ENDIAN	BIT(12)
+#define MT_WFDMA0_GLO_CFG_RX_WB_DDONE	BIT(13)
 #define MT_WFDMA0_GLO_CFG_CSR_DISP_BASE_PTR_CHAIN_EN BIT(15)
 #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
 #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO	BIT(27)
@@ -322,6 +325,8 @@
 
 #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
 #define MT_WFDMA0_RST_DRX_PTR		MT_WFDMA0(0x280)
+#define MT_WFDMA0_INT_RX_PRI		MT_WFDMA0(0x298)
+#define MT_WFDMA0_INT_TX_PRI		MT_WFDMA0(0x29c)
 #define MT_WFDMA0_GLO_CFG_EXT0		MT_WFDMA0(0x2b0)
 #define MT_WFDMA0_CSR_TX_DMASHDL_ENABLE	BIT(6)
 #define MT_WFDMA0_PRI_DLY_INT_CFG0	MT_WFDMA0(0x2f0)
@@ -389,6 +394,9 @@
 #define MT_HW_CHIPID			0x70010200
 #define MT_HW_REV			0x70010204
 
+#define MT_HW_EMI_CTL			0x18011100
+#define MT_HW_EMI_CTL_SLPPROT_EN	BIT(1)
+
 #define MT_PCIE_MAC_BASE		0x10000
 #define MT_PCIE_MAC(ofs)		(MT_PCIE_MAC_BASE + (ofs))
 #define MT_PCIE_MAC_INT_ENABLE		MT_PCIE_MAC(0x188)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c
@@ -225,6 +225,11 @@
 	if (val > MT_RX_SEL2)
 		return -EINVAL;
 
+	if (val == MT_RX_SEL2 && !dev->rdd2_phy) {
+		dev_err(dev->mt76.dev, "Background radar is not enabled\n");
+		return -EINVAL;
+	}
+
 	return mt7996_mcu_rdd_cmd(dev, RDD_RADAR_EMULATE,
 				  val, 0, 0);
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
@@ -237,7 +237,8 @@
 				 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
 				 MT_WFDMA0_GLO_CFG_RX_DMA_EN |
 				 MT_WFDMA0_GLO_CFG_OMIT_TX_INFO |
-				 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
+				 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2 |
+				 MT_WFDMA0_GLO_CFG_EXT_EN);
 
 		if (dev->hif2)
 			mt76_set(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -493,7 +493,7 @@
 
 void mt7996_mac_init(struct mt7996_dev *dev)
 {
-#define HIF_TXD_V2_1	4
+#define HIF_TXD_V2_1	0x21
 	int i;
 
 	mt76_clear(dev, MT_MDP_DCR2, MT_MDP_DCR2_RX_TRANS_SHORT);
@@ -1012,11 +1012,10 @@
 	/* the maximum cap is 4 x 3, (Nr, Nc) = (3, 2) */
 	elem->phy_cap_info[7] |= min_t(int, sts - 1, 2) << 3;
 
-	if (vif != NL80211_IFTYPE_AP)
+	if (!(vif == NL80211_IFTYPE_AP || vif == NL80211_IFTYPE_STATION))
 		return;
 
 	elem->phy_cap_info[3] |= IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
-	elem->phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
 
 	c = FIELD_PREP(IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
 		       sts - 1) |
@@ -1024,6 +1023,11 @@
 		       sts - 1);
 	elem->phy_cap_info[5] |= c;
 
+	if (vif != NL80211_IFTYPE_AP)
+		return;
+
+	elem->phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
+
 	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
 	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB;
 	elem->phy_cap_info[6] |= c;
@@ -1183,7 +1187,6 @@
 		IEEE80211_EHT_MAC_CAP0_OM_CONTROL;
 
 	eht_cap_elem->phy_cap_info[0] =
-		IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
 		IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE;
@@ -1197,30 +1200,36 @@
 		u8_encode_bits(u8_get_bits(val, GENMASK(2, 1)),
 			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK) |
 		u8_encode_bits(val,
-			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK) |
-		u8_encode_bits(val,
-			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK);
+			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK);
 
 	eht_cap_elem->phy_cap_info[2] =
 		u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK) |
-		u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK) |
-		u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK);
+		u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK);
+
+	if (band == NL80211_BAND_6GHZ) {
+		eht_cap_elem->phy_cap_info[0] |=
+			IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
+
+		eht_cap_elem->phy_cap_info[1] |=
+			u8_encode_bits(val,
+				       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK);
+
+		eht_cap_elem->phy_cap_info[2] |=
+			u8_encode_bits(sts - 1,
+				       IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK);
+	}
 
 	eht_cap_elem->phy_cap_info[3] =
 		IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
 		IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
 		IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
-		IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
-		IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
-		IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
-		IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK;
+		IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK;
 
 	eht_cap_elem->phy_cap_info[4] =
 		u8_encode_bits(min_t(int, sts - 1, 2),
 			       IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK);
 
 	eht_cap_elem->phy_cap_info[5] =
-		IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
 		u8_encode_bits(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US,
 			       IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK) |
 		u8_encode_bits(u8_get_bits(0x11, GENMASK(1, 0)),
@@ -1234,14 +1243,6 @@
 			       IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK) |
 		u8_encode_bits(val, IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK);
 
-	eht_cap_elem->phy_cap_info[7] =
-		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
-		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
-		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
-		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
-		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
-		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ;
-
 	val = u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_RX) |
 	      u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_TX);
 #define SET_EHT_MAX_NSS(_bw, _val) do {				\
@@ -1252,8 +1253,29 @@
 
 	SET_EHT_MAX_NSS(80, val);
 	SET_EHT_MAX_NSS(160, val);
-	SET_EHT_MAX_NSS(320, val);
+	if (band == NL80211_BAND_6GHZ)
+		SET_EHT_MAX_NSS(320, val);
 #undef SET_EHT_MAX_NSS
+
+	if (iftype != NL80211_IFTYPE_AP)
+		return;
+
+	eht_cap_elem->phy_cap_info[3] |=
+		IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
+		IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK;
+
+	eht_cap_elem->phy_cap_info[7] =
+		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
+		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
+		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
+		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ;
+
+	if (band != NL80211_BAND_6GHZ)
+		return;
+
+	eht_cap_elem->phy_cap_info[7] |=
+		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
+		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ;
 }
 
 static void
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -435,7 +435,7 @@
 	u32 rxd2 = le32_to_cpu(rxd[2]);
 	u32 rxd3 = le32_to_cpu(rxd[3]);
 	u32 rxd4 = le32_to_cpu(rxd[4]);
-	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
+	u32 csum_mask = MT_RXD3_NORMAL_IP_SUM | MT_RXD3_NORMAL_UDP_TCP_SUM;
 	u32 csum_status = *(u32 *)skb->cb;
 	u32 mesh_mask = MT_RXD0_MESH | MT_RXD0_MHCP;
 	bool is_mesh = (rxd0 & mesh_mask) == mesh_mask;
@@ -497,7 +497,7 @@
 	if (!sband->channels)
 		return -EINVAL;
 
-	if ((rxd0 & csum_mask) == csum_mask &&
+	if ((rxd3 & csum_mask) == csum_mask &&
 	    !(csum_status & (BIT(0) | BIT(2) | BIT(3))))
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 
@@ -732,6 +732,9 @@
 	      FIELD_PREP(MT_TXD2_SUB_TYPE, fc_stype);
 
 	txwi[2] |= cpu_to_le32(val);
+
+	if (wcid->amsdu)
+		txwi[3] |= cpu_to_le32(MT_TXD3_HW_AMSDU);
 }
 
 static void
@@ -862,8 +865,6 @@
 		val |= MT_TXD3_PROTECT_FRAME;
 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
 		val |= MT_TXD3_NO_ACK;
-	if (wcid->amsdu)
-		val |= MT_TXD3_HW_AMSDU;
 
 	txwi[3] = cpu_to_le32(val);
 	txwi[4] = 0;
@@ -1188,25 +1189,28 @@
 	struct ieee80211_tx_info *info;
 	struct sk_buff_head list;
 	struct rate_info rate = {};
-	struct sk_buff *skb;
+	struct sk_buff *skb = NULL;
 	bool cck = false;
 	u32 txrate, txs, mode, stbc;
 
 	txs = le32_to_cpu(txs_data[0]);
 
 	mt76_tx_status_lock(mdev, &list);
-	skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
 
-	if (skb) {
-		info = IEEE80211_SKB_CB(skb);
-		if (!(txs & MT_TXS0_ACK_ERROR_MASK))
-			info->flags |= IEEE80211_TX_STAT_ACK;
-
-		info->status.ampdu_len = 1;
-		info->status.ampdu_ack_len =
-			!!(info->flags & IEEE80211_TX_STAT_ACK);
+	/* only report MPDU TXS */
+	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == 0) {
+		skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
+		if (skb) {
+			info = IEEE80211_SKB_CB(skb);
+			if (!(txs & MT_TXS0_ACK_ERROR_MASK))
+				info->flags |= IEEE80211_TX_STAT_ACK;
+
+			info->status.ampdu_len = 1;
+			info->status.ampdu_ack_len =
+				!!(info->flags & IEEE80211_TX_STAT_ACK);
 
-		info->status.rates[0].idx = -1;
+			info->status.rates[0].idx = -1;
+		}
 	}
 
 	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && wcid->sta) {
@@ -2527,6 +2531,34 @@
 	return 0;
 }
 
+static bool
+mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
+			   struct ieee80211_twt_params *twt_agrt)
+{
+	u16 type = le16_to_cpu(twt_agrt->req_type);
+	u8 exp;
+	int i;
+
+	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, type);
+	for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) {
+		struct mt7996_twt_flow *f;
+
+		if (!(msta->twt.flowid_mask & BIT(i)))
+			continue;
+
+		f = &msta->twt.flow[i];
+		if (f->duration == twt_agrt->min_twt_dur &&
+		    f->mantissa == twt_agrt->mantissa &&
+		    f->exp == exp &&
+		    f->protection == !!(type & IEEE80211_TWT_REQTYPE_PROTECTION) &&
+		    f->flowtype == !!(type & IEEE80211_TWT_REQTYPE_FLOWTYPE) &&
+		    f->trigger == !!(type & IEEE80211_TWT_REQTYPE_TRIGGER))
+			return true;
+	}
+
+	return false;
+}
+
 void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
 			      struct ieee80211_sta *sta,
 			      struct ieee80211_twt_setup *twt)
@@ -2538,8 +2570,7 @@
 	enum ieee80211_twt_setup_cmd sta_setup_cmd;
 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 	struct mt7996_twt_flow *flow;
-	int flowid, table_id;
-	u8 exp;
+	u8 flowid, table_id, exp;
 
 	if (mt7996_mac_check_twt_req(twt))
 		goto out;
@@ -2552,9 +2583,19 @@
 	if (hweight8(msta->twt.flowid_mask) == ARRAY_SIZE(msta->twt.flow))
 		goto unlock;
 
+	if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) {
+		setup_cmd = TWT_SETUP_CMD_DICTATE;
+		twt_agrt->min_twt_dur = MT7996_MIN_TWT_DUR;
+		goto unlock;
+	}
+
+	if (mt7996_mac_twt_param_equal(msta, twt_agrt))
+		goto unlock;
+
 	flowid = ffs(~msta->twt.flowid_mask) - 1;
-	le16p_replace_bits(&twt_agrt->req_type, flowid,
-			   IEEE80211_TWT_REQTYPE_FLOWID);
+	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID);
+	twt_agrt->req_type |= le16_encode_bits(flowid,
+					       IEEE80211_TWT_REQTYPE_FLOWID);
 
 	table_id = ffs(~dev->twt.table_mask) - 1;
 	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
@@ -2601,10 +2642,10 @@
 unlock:
 	mutex_unlock(&dev->mt76.mutex);
 out:
-	le16p_replace_bits(&twt_agrt->req_type, setup_cmd,
-			   IEEE80211_TWT_REQTYPE_SETUP_CMD);
-	twt->control = (twt->control & IEEE80211_TWT_CONTROL_WAKE_DUR_UNIT) |
-		       (twt->control & IEEE80211_TWT_CONTROL_RX_DISABLED);
+	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_SETUP_CMD);
+	twt_agrt->req_type |=
+		le16_encode_bits(setup_cmd, IEEE80211_TWT_REQTYPE_SETUP_CMD);
+	twt->control = twt->control & IEEE80211_TWT_CONTROL_RX_DISABLED;
 }
 
 void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -198,7 +198,7 @@
 	mvif->mt76.omac_idx = idx;
 	mvif->phy = phy;
 	mvif->mt76.band_idx = band_idx;
-	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
+	mvif->mt76.wmm_idx = vif->type == NL80211_IFTYPE_AP ? 0 : 3;
 
 	ret = mt7996_mcu_add_dev_info(phy, vif, true);
 	if (ret)
@@ -295,6 +295,10 @@
 	if (ret)
 		goto out;
 
+	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
+	if (ret)
+		goto out;
+
 	ret = mt7996_dfs_init_radar_detector(phy);
 	mt7996_mac_cca_stats_reset(phy);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -355,7 +355,10 @@
 	if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
 		return;
 
-	if (dev->rdd2_phy && r->band_idx == MT_RX_SEL2)
+	if (r->band_idx == MT_RX_SEL2 && !dev->rdd2_phy)
+		return;
+
+	if (r->band_idx == MT_RX_SEL2)
 		mphy = dev->rdd2_phy->mt76;
 	else
 		mphy = dev->mt76.phys[r->band_idx];
@@ -732,13 +735,10 @@
 static struct tlv *
 mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
 {
-	struct tlv *ptlv, tlv = {
-		.tag = cpu_to_le16(tag),
-		.len = cpu_to_le16(len),
-	};
+	struct tlv *ptlv = skb_put_zero(skb, len);
 
-	ptlv = skb_put(skb, len);
-	memcpy(ptlv, &tlv, sizeof(tlv));
+	ptlv->tag = cpu_to_le16(tag);
+	ptlv->len = cpu_to_le16(len);
 
 	return ptlv;
 }
@@ -1240,6 +1240,9 @@
 static void
 mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
 {
+	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct ieee80211_vif *vif = container_of((void *)msta->vif,
+						 struct ieee80211_vif, drv_priv);
 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
 	struct ieee80211_eht_cap_elem_fixed *elem;
 	struct sta_rec_eht *eht;
@@ -1259,8 +1262,17 @@
 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
 
-	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_20)
-		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
+	if (vif->type != NL80211_IFTYPE_STATION &&
+	    (sta->deflink.he_cap.he_cap_elem.phy_cap_info[0] &
+	     (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
+	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
+	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
+	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)) == 0) {
+		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz,
+		       sizeof(eht->mcs_map_bw20));
+		return;
+	}
+
 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
 	memcpy(eht->mcs_map_bw320, &mcs_map->bw._320, sizeof(eht->mcs_map_bw320));
@@ -1414,10 +1426,10 @@
 
 		if (bfee)
 			return vif->bss_conf.eht_su_beamformee &&
-			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
+			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
 		else
 			return vif->bss_conf.eht_su_beamformer &&
-			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
+			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
 	}
 
 	if (sta->deflink.he_cap.has_he) {
@@ -1529,6 +1541,9 @@
 	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
 	u8 snd_dim, sts;
 
+	if (!vc)
+		return;
+
 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
 
 	mt7996_mcu_sta_sounding_rate(bf);
@@ -1638,7 +1653,7 @@
 {
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_phy *phy = mvif->phy;
-	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
+	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
 	struct sta_rec_bf *bf;
 	struct tlv *tlv;
 	const u8 matrix[4][4] = {
@@ -2510,7 +2525,7 @@
 	info = IEEE80211_SKB_CB(skb);
 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->mt76->band_idx);
 
-	len = sizeof(*bcn) + MT_TXD_SIZE + skb->len;
+	len = ALIGN(sizeof(*bcn) + MT_TXD_SIZE + skb->len, 4);
 	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_CONTENT, len);
 	bcn = (struct bss_bcn_content_tlv *)tlv;
 	bcn->enable = en;
@@ -2579,8 +2594,7 @@
 	info->band = band;
 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->mt76->band_idx);
 
-	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
-
+	len = ALIGN(sizeof(*discov) + MT_TXD_SIZE + skb->len, 4);
 	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_OFFLOAD, len);
 
 	discov = (struct bss_inband_discovery_tlv *)tlv;
@@ -3539,7 +3553,7 @@
 		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
 		u8 *buf = (u8 *)dev->mt76.eeprom.data + addr;
 
-		skb_pull(skb, 64);
+		skb_pull(skb, 48);
 		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
 	}
 
@@ -3721,6 +3735,7 @@
 	} __packed * res;
 	struct sk_buff *skb;
 	int ret;
+	u32 temp;
 
 	ret = mt76_mcu_send_and_get_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
 					&req, sizeof(req), true, &skb);
@@ -3728,8 +3743,10 @@
 		return ret;
 
 	res = (void *)skb->data;
+	temp = le32_to_cpu(res->temperature);
+	dev_kfree_skb(skb);
 
-	return le32_to_cpu(res->temperature);
+	return temp;
 }
 
 int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state)
@@ -4456,7 +4473,7 @@
 		u8 band_idx;
 	} __packed req = {
 		.tag = cpu_to_le16(UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL),
-		.len = cpu_to_le16(sizeof(req) + MT7996_SKU_RATE_NUM - 4),
+		.len = cpu_to_le16(sizeof(req) + MT7996_SKU_PATH_NUM - 4),
 		.power_ctrl_id = UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL,
 		.power_limit_type = TX_POWER_LIMIT_TABLE_RATE,
 		.band_idx = phy->mt76->band_idx,
@@ -4471,7 +4488,7 @@
 	mphy->txpower_cur = tx_power;
 
 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
-				 sizeof(req) + MT7996_SKU_RATE_NUM);
+				 sizeof(req) + MT7996_SKU_PATH_NUM);
 	if (!skb)
 		return -ENOMEM;
 
@@ -4495,6 +4512,9 @@
 	/* eht */
 	skb_put_data(skb, &la.eht[0], sizeof(la.eht));
 
+	/* padding */
+	skb_put_zero(skb, MT7996_SKU_PATH_NUM - MT7996_SKU_RATE_NUM);
+
 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 				     MCU_WM_UNI_CMD(TXPOWER), true);
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
@@ -800,10 +800,10 @@
 					 sizeof(struct sta_rec_hdr_trans) +	\
 					 sizeof(struct tlv))
 
-#define MT7996_MAX_BEACON_SIZE		1342
+#define MT7996_MAX_BEACON_SIZE		1338
 #define MT7996_BEACON_UPDATE_SIZE	(sizeof(struct bss_req_hdr) +		\
 					 sizeof(struct bss_bcn_content_tlv) +	\
-					 MT_TXD_SIZE +				\
+					 4 + MT_TXD_SIZE +			\
 					 sizeof(struct bss_bcn_cntdwn_tlv) +	\
 					 sizeof(struct bss_bcn_mbss_tlv))
 #define MT7996_MAX_BSS_OFFLOAD_SIZE	(MT7996_MAX_BEACON_SIZE +		\
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
@@ -140,7 +140,6 @@
 	u32 offset = FIELD_GET(MT_HIF_REMAP_L1_OFFSET, addr);
 	u32 base = FIELD_GET(MT_HIF_REMAP_L1_BASE, addr);
 
-	dev->reg_l1_backup = dev->bus_ops->rr(&dev->mt76, MT_HIF_REMAP_L1);
 	dev->bus_ops->rmw(&dev->mt76, MT_HIF_REMAP_L1,
 			  MT_HIF_REMAP_L1_MASK,
 			  FIELD_PREP(MT_HIF_REMAP_L1_MASK, base));
@@ -155,7 +154,6 @@
 	u32 offset = FIELD_GET(MT_HIF_REMAP_L2_OFFSET, addr);
 	u32 base = FIELD_GET(MT_HIF_REMAP_L2_BASE, addr);
 
-	dev->reg_l2_backup = dev->bus_ops->rr(&dev->mt76, MT_HIF_REMAP_L2);
 	dev->bus_ops->rmw(&dev->mt76, MT_HIF_REMAP_L2,
 			  MT_HIF_REMAP_L2_MASK,
 			  FIELD_PREP(MT_HIF_REMAP_L2_MASK, base));
@@ -165,26 +163,10 @@
 	return MT_HIF_REMAP_BASE_L2 + offset;
 }
 
-static void mt7996_reg_remap_restore(struct mt7996_dev *dev)
-{
-	/* remap to ori status */
-	if (unlikely(dev->reg_l1_backup)) {
-		dev->bus_ops->wr(&dev->mt76, MT_HIF_REMAP_L1, dev->reg_l1_backup);
-		dev->reg_l1_backup = 0;
-	}
-
-	if (dev->reg_l2_backup) {
-		dev->bus_ops->wr(&dev->mt76, MT_HIF_REMAP_L2, dev->reg_l2_backup);
-		dev->reg_l2_backup = 0;
-	}
-}
-
 static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr)
 {
 	int i;
 
-	mt7996_reg_remap_restore(dev);
-
 	if (addr < 0x100000)
 		return addr;
 
@@ -201,6 +183,11 @@
 		return dev->reg.map[i].mapped + ofs;
 	}
 
+	return 0;
+}
+
+static u32 __mt7996_reg_remap_addr(struct mt7996_dev *dev, u32 addr)
+{
 	if ((addr >= MT_INFRA_BASE && addr < MT_WFSYS0_PHY_START) ||
 	    (addr >= MT_WFSYS0_PHY_START && addr < MT_WFSYS1_PHY_START) ||
 	    (addr >= MT_WFSYS1_PHY_START && addr <= MT_WFSYS1_PHY_END))
@@ -225,28 +212,60 @@
 {
 	u32 addr = __mt7996_reg_addr(dev, offset);
 
-	memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
+	if (addr) {
+		memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
+		return;
+	}
+
+	spin_lock_bh(&dev->reg_lock);
+	memcpy_fromio(buf, dev->mt76.mmio.regs +
+			   __mt7996_reg_remap_addr(dev, offset), len);
+	spin_unlock_bh(&dev->reg_lock);
 }
 
 static u32 mt7996_rr(struct mt76_dev *mdev, u32 offset)
 {
 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
+	u32 addr = __mt7996_reg_addr(dev, offset), val;
+
+	if (addr)
+		return dev->bus_ops->rr(mdev, addr);
 
-	return dev->bus_ops->rr(mdev, __mt7996_reg_addr(dev, offset));
+	spin_lock_bh(&dev->reg_lock);
+	val = dev->bus_ops->rr(mdev, __mt7996_reg_remap_addr(dev, offset));
+	spin_unlock_bh(&dev->reg_lock);
+
+	return val;
 }
 
 static void mt7996_wr(struct mt76_dev *mdev, u32 offset, u32 val)
 {
 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
+	u32 addr = __mt7996_reg_addr(dev, offset);
 
-	dev->bus_ops->wr(mdev, __mt7996_reg_addr(dev, offset), val);
+	if (addr) {
+		dev->bus_ops->wr(mdev, addr, val);
+		return;
+	}
+
+	spin_lock_bh(&dev->reg_lock);
+	dev->bus_ops->wr(mdev, __mt7996_reg_remap_addr(dev, offset), val);
+	spin_unlock_bh(&dev->reg_lock);
 }
 
 static u32 mt7996_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
 {
 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
+	u32 addr = __mt7996_reg_addr(dev, offset);
+
+	if (addr)
+		return dev->bus_ops->rmw(mdev, addr, mask, val);
+
+	spin_lock_bh(&dev->reg_lock);
+	val = dev->bus_ops->rmw(mdev, __mt7996_reg_remap_addr(dev, offset), mask, val);
+	spin_unlock_bh(&dev->reg_lock);
 
-	return dev->bus_ops->rmw(mdev, __mt7996_reg_addr(dev, offset), mask, val);
+	return val;
 }
 
 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
@@ -421,6 +440,7 @@
 
 	dev = container_of(mdev, struct mt7996_dev, mt76);
 	mt76_mmio_init(&dev->mt76, mem_base);
+	spin_lock_init(&dev->reg_lock);
 
 	switch (device_id) {
 	case 0x7990:
@@ -499,7 +519,7 @@
 	struct mt7996_dev *dev = from_tasklet(dev, t, mt76.irq_tasklet);
 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
 	struct mtk_wed_device *wed_hif2 = &dev->mt76.mmio.wed_hif2;
-	u32 i, intr, mask, intr1;
+	u32 i, intr, mask, intr1 = 0;
 
 	if (dev->hif2 && mtk_wed_device_active(wed_hif2)) {
 		mtk_wed_device_irq_set_mask(wed_hif2, 0);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -50,9 +50,11 @@
 #define MT7996_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 
 #define MT7996_SKU_RATE_NUM		417
+#define MT7996_SKU_PATH_NUM		494
 
 #define MT7996_MAX_TWT_AGRT		16
 #define MT7996_MAX_STA_TWT_AGRT		8
+#define MT7996_MIN_TWT_DUR		64
 #define MT7996_MAX_QUEUE		(__MT_RXQ_MAX +	__MT_MCUQ_MAX + 3)
 
 /* NOTE: used to map mt76_rates. idx may change if firmware expands table */
@@ -320,12 +322,11 @@
 	struct rchan *relay_fwlog;
 
 	struct {
-		u8 table_mask;
+		u16 table_mask;
 		u8 n_agrt;
 	} twt;
 
-	u32 reg_l1_backup;
-	u32 reg_l2_backup;
+	spinlock_t reg_lock;
 
 	u8 wtbl_size_group;
 };
--- linux-qcom-6.8.0.orig/drivers/net/wireless/mediatek/mt76/sdio.c
+++ linux-qcom-6.8.0/drivers/net/wireless/mediatek/mt76/sdio.c
@@ -499,7 +499,8 @@
 	dev = container_of(sdio, struct mt76_dev, sdio);
 
 	while (true) {
-		if (test_bit(MT76_REMOVED, &dev->phy.state))
+		if (test_bit(MT76_RESET, &dev->phy.state) ||
+		    test_bit(MT76_REMOVED, &dev->phy.state))
 			break;
 
 		if (!dev->drv->tx_status_data(dev, &update))
--- linux-qcom-6.8.0.orig/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+++ linux-qcom-6.8.0/drivers/net/wireless/microchip/wilc1000/cfg80211.c
@@ -1609,7 +1609,6 @@
 	cfg80211_unregister_netdevice(vif->ndev);
 	vif->monitor_flag = 0;
 
-	wilc_set_operation_mode(vif, 0, 0, 0);
 	mutex_lock(&wl->vif_mutex);
 	list_del_rcu(&vif->list);
 	wl->vif_num--;
@@ -1804,15 +1803,24 @@
 	INIT_LIST_HEAD(&wl->rxq_head.list);
 	INIT_LIST_HEAD(&wl->vif_list);
 
+	wl->hif_workqueue = alloc_ordered_workqueue("%s", WQ_MEM_RECLAIM,
+						    wiphy_name(wl->wiphy));
+	if (!wl->hif_workqueue) {
+		ret = -ENOMEM;
+		goto free_cfg;
+	}
 	vif = wilc_netdev_ifc_init(wl, "wlan%d", WILC_STATION_MODE,
 				   NL80211_IFTYPE_STATION, false);
 	if (IS_ERR(vif)) {
 		ret = PTR_ERR(vif);
-		goto free_cfg;
+		goto free_hq;
 	}
 
 	return 0;
 
+free_hq:
+	destroy_workqueue(wl->hif_workqueue);
+
 free_cfg:
 	wilc_wlan_cfg_deinit(wl);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/microchip/wilc1000/hif.c
+++ linux-qcom-6.8.0/drivers/net/wireless/microchip/wilc1000/hif.c
@@ -377,38 +377,52 @@
 wilc_parse_join_bss_param(struct cfg80211_bss *bss,
 			  struct cfg80211_crypto_settings *crypto)
 {
-	struct wilc_join_bss_param *param;
+	const u8 *ies_data, *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie;
+	const u8 *ht_ie, *wpa_ie, *wmm_ie, *rsn_ie;
 	struct ieee80211_p2p_noa_attr noa_attr;
+	const struct cfg80211_bss_ies *ies;
+	struct wilc_join_bss_param *param;
 	u8 rates_len = 0;
-	const u8 *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie;
-	const u8 *ht_ie, *wpa_ie, *wmm_ie, *rsn_ie;
+	int ies_len;
+	u64 ies_tsf;
 	int ret;
-	const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies);
 
 	param = kzalloc(sizeof(*param), GFP_KERNEL);
 	if (!param)
 		return NULL;
 
+	rcu_read_lock();
+	ies = rcu_dereference(bss->ies);
+	ies_data = kmemdup(ies->data, ies->len, GFP_ATOMIC);
+	if (!ies_data) {
+		rcu_read_unlock();
+		kfree(param);
+		return NULL;
+	}
+	ies_len = ies->len;
+	ies_tsf = ies->tsf;
+	rcu_read_unlock();
+
 	param->beacon_period = cpu_to_le16(bss->beacon_interval);
 	param->cap_info = cpu_to_le16(bss->capability);
 	param->bss_type = WILC_FW_BSS_TYPE_INFRA;
 	param->ch = ieee80211_frequency_to_channel(bss->channel->center_freq);
 	ether_addr_copy(param->bssid, bss->bssid);
 
-	ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
+	ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies_data, ies_len);
 	if (ssid_elm) {
 		if (ssid_elm[1] <= IEEE80211_MAX_SSID_LEN)
 			memcpy(param->ssid, ssid_elm + 2, ssid_elm[1]);
 	}
 
-	tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
+	tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies_data, ies_len);
 	if (tim_elm && tim_elm[1] >= 2)
 		param->dtim_period = tim_elm[3];
 
 	memset(param->p_suites, 0xFF, 3);
 	memset(param->akm_suites, 0xFF, 3);
 
-	rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len);
+	rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies_data, ies_len);
 	if (rates_ie) {
 		rates_len = rates_ie[1];
 		if (rates_len > WILC_MAX_RATES_SUPPORTED)
@@ -419,7 +433,7 @@
 
 	if (rates_len < WILC_MAX_RATES_SUPPORTED) {
 		supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES,
-						 ies->data, ies->len);
+						 ies_data, ies_len);
 		if (supp_rates_ie) {
 			u8 ext_rates = supp_rates_ie[1];
 
@@ -434,15 +448,15 @@
 		}
 	}
 
-	ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies->data, ies->len);
+	ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies_data, ies_len);
 	if (ht_ie)
 		param->ht_capable = true;
 
-	ret = cfg80211_get_p2p_attr(ies->data, ies->len,
+	ret = cfg80211_get_p2p_attr(ies_data, ies_len,
 				    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
 				    (u8 *)&noa_attr, sizeof(noa_attr));
 	if (ret > 0) {
-		param->tsf_lo = cpu_to_le32(ies->tsf);
+		param->tsf_lo = cpu_to_le32(ies_tsf);
 		param->noa_enabled = 1;
 		param->idx = noa_attr.index;
 		if (noa_attr.oppps_ctwindow & IEEE80211_P2P_OPPPS_ENABLE_BIT) {
@@ -462,7 +476,7 @@
 	}
 	wmm_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
 					 WLAN_OUI_TYPE_MICROSOFT_WMM,
-					 ies->data, ies->len);
+					 ies_data, ies_len);
 	if (wmm_ie) {
 		struct ieee80211_wmm_param_ie *ie;
 
@@ -477,13 +491,13 @@
 
 	wpa_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
 					 WLAN_OUI_TYPE_MICROSOFT_WPA,
-					 ies->data, ies->len);
+					 ies_data, ies_len);
 	if (wpa_ie) {
 		param->mode_802_11i = 1;
 		param->rsn_found = true;
 	}
 
-	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len);
+	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies_data, ies_len);
 	if (rsn_ie) {
 		int rsn_ie_len = sizeof(struct element) + rsn_ie[1];
 		int offset = 8;
@@ -517,6 +531,7 @@
 			param->akm_suites[i] = crypto->akm_suites[i] & 0xFF;
 	}
 
+	kfree(ies_data);
 	return (void *)param;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/microchip/wilc1000/mon.c
+++ linux-qcom-6.8.0/drivers/net/wireless/microchip/wilc1000/mon.c
@@ -7,12 +7,12 @@
 #include "cfg80211.h"
 
 struct wilc_wfi_radiotap_hdr {
-	struct ieee80211_radiotap_header hdr;
+	struct ieee80211_radiotap_header_fixed hdr;
 	u8 rate;
 } __packed;
 
 struct wilc_wfi_radiotap_cb_hdr {
-	struct ieee80211_radiotap_header hdr;
+	struct ieee80211_radiotap_header_fixed hdr;
 	u8 rate;
 	u8 dump;
 	u16 tx_flags;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/microchip/wilc1000/netdev.c
+++ linux-qcom-6.8.0/drivers/net/wireless/microchip/wilc1000/netdev.c
@@ -890,8 +890,7 @@
 
 void wilc_netdev_cleanup(struct wilc *wilc)
 {
-	struct wilc_vif *vif;
-	int srcu_idx, ifc_cnt = 0;
+	struct wilc_vif *vif, *vif_tmp;
 
 	if (!wilc)
 		return;
@@ -901,32 +900,19 @@
 		wilc->firmware = NULL;
 	}
 
-	srcu_idx = srcu_read_lock(&wilc->srcu);
-	list_for_each_entry_rcu(vif, &wilc->vif_list, list) {
+	list_for_each_entry_safe(vif, vif_tmp, &wilc->vif_list, list) {
+		mutex_lock(&wilc->vif_mutex);
+		list_del_rcu(&vif->list);
+		wilc->vif_num--;
+		mutex_unlock(&wilc->vif_mutex);
+		synchronize_srcu(&wilc->srcu);
 		if (vif->ndev)
 			unregister_netdev(vif->ndev);
 	}
-	srcu_read_unlock(&wilc->srcu, srcu_idx);
 
 	wilc_wfi_deinit_mon_interface(wilc, false);
 	destroy_workqueue(wilc->hif_workqueue);
 
-	while (ifc_cnt < WILC_NUM_CONCURRENT_IFC) {
-		mutex_lock(&wilc->vif_mutex);
-		if (wilc->vif_num <= 0) {
-			mutex_unlock(&wilc->vif_mutex);
-			break;
-		}
-		vif = wilc_get_wl_to_vif(wilc);
-		if (!IS_ERR(vif))
-			list_del_rcu(&vif->list);
-
-		wilc->vif_num--;
-		mutex_unlock(&wilc->vif_mutex);
-		synchronize_srcu(&wilc->srcu);
-		ifc_cnt++;
-	}
-
 	wilc_wlan_cfg_deinit(wilc);
 	wlan_deinit_locks(wilc);
 	wiphy_unregister(wilc->wiphy);
@@ -989,13 +975,6 @@
 		goto error;
 	}
 
-	wl->hif_workqueue = alloc_ordered_workqueue("%s-wq", WQ_MEM_RECLAIM,
-						    ndev->name);
-	if (!wl->hif_workqueue) {
-		ret = -ENOMEM;
-		goto unregister_netdev;
-	}
-
 	ndev->needs_free_netdev = true;
 	vif->iftype = vif_type;
 	vif->idx = wilc_get_available_idx(wl);
@@ -1008,12 +987,11 @@
 
 	return vif;
 
-unregister_netdev:
+error:
 	if (rtnl_locked)
 		cfg80211_unregister_netdevice(ndev);
 	else
 		unregister_netdev(ndev);
-  error:
 	free_netdev(ndev);
 	return ERR_PTR(ret);
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/microchip/wilc1000/sdio.c
+++ linux-qcom-6.8.0/drivers/net/wireless/microchip/wilc1000/sdio.c
@@ -232,6 +232,10 @@
 	int ret;
 
 	dev_info(dev, "sdio suspend\n");
+
+	if (!wilc->initialized)
+		return 0;
+
 	chip_wakeup(wilc);
 
 	if (!IS_ERR(wilc->rtc_clk))
@@ -948,6 +952,10 @@
 	struct wilc *wilc = sdio_get_drvdata(func);
 
 	dev_info(dev, "sdio resume\n");
+
+	if (!wilc->initialized)
+		return 0;
+
 	sdio_release_host(func);
 	chip_wakeup(wilc);
 	wilc_sdio_init(wilc, true);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/microchip/wilc1000/spi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/microchip/wilc1000/spi.c
@@ -192,11 +192,11 @@
 		/* assert ENABLE: */
 		gpiod_set_value(gpios->enable, 1);
 		mdelay(5);
-		/* assert RESET: */
-		gpiod_set_value(gpios->reset, 1);
-	} else {
 		/* deassert RESET: */
 		gpiod_set_value(gpios->reset, 0);
+	} else {
+		/* assert RESET: */
+		gpiod_set_value(gpios->reset, 1);
 		/* deassert ENABLE: */
 		gpiod_set_value(gpios->enable, 0);
 	}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
@@ -121,6 +121,15 @@
 	RX_TYPE_ERROR = -1
 };
 
+enum rtl8xxxu_rx_desc_enc {
+	RX_DESC_ENC_NONE	= 0,
+	RX_DESC_ENC_WEP40	= 1,
+	RX_DESC_ENC_TKIP_WO_MIC	= 2,
+	RX_DESC_ENC_TKIP_MIC	= 3,
+	RX_DESC_ENC_AES		= 4,
+	RX_DESC_ENC_WEP104	= 5,
+};
+
 struct rtl8xxxu_rxdesc16 {
 #ifdef __LITTLE_ENDIAN
 	u32 pktlen:14;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c
@@ -713,9 +713,14 @@
 	rtl8xxxu_write32(priv, REG_OFDM0_FA_RSTC, val32);
 }
 
+#define TX_POWER_INDEX_MAX 0x3F
+#define TX_POWER_INDEX_DEFAULT_CCK 0x22
+#define TX_POWER_INDEX_DEFAULT_HT40 0x27
+
 static int rtl8188fu_parse_efuse(struct rtl8xxxu_priv *priv)
 {
 	struct rtl8188fu_efuse *efuse = &priv->efuse_wifi.efuse8188fu;
+	int i;
 
 	if (efuse->rtl_id != cpu_to_le16(0x8129))
 		return -EINVAL;
@@ -729,6 +734,16 @@
 	       efuse->tx_power_index_A.ht40_base,
 	       sizeof(efuse->tx_power_index_A.ht40_base));
 
+	for (i = 0; i < ARRAY_SIZE(priv->cck_tx_power_index_A); i++) {
+		if (priv->cck_tx_power_index_A[i] > TX_POWER_INDEX_MAX)
+			priv->cck_tx_power_index_A[i] = TX_POWER_INDEX_DEFAULT_CCK;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(priv->ht40_1s_tx_power_index_A); i++) {
+		if (priv->ht40_1s_tx_power_index_A[i] > TX_POWER_INDEX_MAX)
+			priv->ht40_1s_tx_power_index_A[i] = TX_POWER_INDEX_DEFAULT_HT40;
+	}
+
 	priv->ofdm_tx_power_diff[0].a = efuse->tx_power_index_A.ht20_ofdm_1s_diff.a;
 	priv->ht20_tx_power_diff[0].a = efuse->tx_power_index_A.ht20_ofdm_1s_diff.b;
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -1505,13 +1505,13 @@
 	u8 cck[RTL8723A_MAX_RF_PATHS], ofdm[RTL8723A_MAX_RF_PATHS];
 	u8 ofdmbase[RTL8723A_MAX_RF_PATHS], mcsbase[RTL8723A_MAX_RF_PATHS];
 	u32 val32, ofdm_a, ofdm_b, mcs_a, mcs_b;
-	u8 val8;
+	u8 val8, base;
 	int group, i;
 
 	group = rtl8xxxu_gen1_channel_to_group(channel);
 
-	cck[0] = priv->cck_tx_power_index_A[group] - 1;
-	cck[1] = priv->cck_tx_power_index_B[group] - 1;
+	cck[0] = priv->cck_tx_power_index_A[group];
+	cck[1] = priv->cck_tx_power_index_B[group];
 
 	if (priv->hi_pa) {
 		if (cck[0] > 0x20)
@@ -1522,10 +1522,6 @@
 
 	ofdm[0] = priv->ht40_1s_tx_power_index_A[group];
 	ofdm[1] = priv->ht40_1s_tx_power_index_B[group];
-	if (ofdm[0])
-		ofdm[0] -= 1;
-	if (ofdm[1])
-		ofdm[1] -= 1;
 
 	ofdmbase[0] = ofdm[0] +	priv->ofdm_tx_power_index_diff[group].a;
 	ofdmbase[1] = ofdm[1] +	priv->ofdm_tx_power_index_diff[group].b;
@@ -1614,20 +1610,19 @@
 
 	rtl8xxxu_write32(priv, REG_TX_AGC_A_MCS15_MCS12,
 			 mcs_a + power_base->reg_0e1c);
+	val8 = u32_get_bits(mcs_a + power_base->reg_0e1c, 0xff000000);
 	for (i = 0; i < 3; i++) {
-		if (i != 2)
-			val8 = (mcsbase[0] > 8) ? (mcsbase[0] - 8) : 0;
-		else
-			val8 = (mcsbase[0] > 6) ? (mcsbase[0] - 6) : 0;
+		base = i != 2 ? 8 : 6;
+		val8 = max_t(int, val8 - base, 0);
 		rtl8xxxu_write8(priv, REG_OFDM0_XC_TX_IQ_IMBALANCE + i, val8);
 	}
+
 	rtl8xxxu_write32(priv, REG_TX_AGC_B_MCS15_MCS12,
 			 mcs_b + power_base->reg_0868);
+	val8 = u32_get_bits(mcs_b + power_base->reg_0868, 0xff000000);
 	for (i = 0; i < 3; i++) {
-		if (i != 2)
-			val8 = (mcsbase[1] > 8) ? (mcsbase[1] - 8) : 0;
-		else
-			val8 = (mcsbase[1] > 6) ? (mcsbase[1] - 6) : 0;
+		base = i != 2 ? 8 : 6;
+		val8 = max_t(int, val8 - base, 0);
 		rtl8xxxu_write8(priv, REG_OFDM0_XD_TX_IQ_IMBALANCE + i, val8);
 	}
 }
@@ -5063,10 +5058,12 @@
 	}
 
 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
-		if (bss_conf->enable_beacon)
+		if (bss_conf->enable_beacon) {
 			rtl8xxxu_start_tx_beacon(priv);
-		else
+			schedule_work(&priv->update_beacon_work);
+		} else {
 			rtl8xxxu_stop_tx_beacon(priv);
+		}
 	}
 
 	if (changed & BSS_CHANGED_BEACON)
@@ -6324,7 +6321,8 @@
 			rx_status->mactime = rx_desc->tsfl;
 			rx_status->flag |= RX_FLAG_MACTIME_START;
 
-			if (!rx_desc->swdec)
+			if (!rx_desc->swdec &&
+			    rx_desc->security != RX_DESC_ENC_NONE)
 				rx_status->flag |= RX_FLAG_DECRYPTED;
 			if (rx_desc->crc32)
 				rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
@@ -6424,7 +6422,8 @@
 			rx_status->mactime = rx_desc->tsfl;
 			rx_status->flag |= RX_FLAG_MACTIME_START;
 
-			if (!rx_desc->swdec)
+			if (!rx_desc->swdec &&
+			    rx_desc->security != RX_DESC_ENC_NONE)
 				rx_status->flag |= RX_FLAG_DECRYPTED;
 			if (rx_desc->crc32)
 				rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
@@ -7304,6 +7303,7 @@
 	if (priv->usb_interrupts)
 		rtl8xxxu_write32(priv, REG_USB_HIMR, 0);
 
+	cancel_work_sync(&priv->c2hcmd_work);
 	cancel_delayed_work_sync(&priv->ra_watchdog);
 
 	rtl8xxxu_free_rx_resources(priv);
@@ -7659,6 +7659,7 @@
 	ieee80211_hw_set(hw, HAS_RATE_CONTROL);
 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
+	ieee80211_hw_set(hw, MFP_CAPABLE);
 
 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
 
@@ -7843,6 +7844,8 @@
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x817e, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x8186, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x818a, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x317f, 0xff, 0xff, 0xff),
@@ -7853,12 +7856,18 @@
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x050d, 0x1102, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(0x050d, 0x11f2, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x06f8, 0xe033, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(0x07b8, 0x8188, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x07b8, 0x8189, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9041, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9043, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x0b05, 0x17ba, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x1e1e, 0xff, 0xff, 0xff),
@@ -7875,6 +7884,10 @@
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x13d3, 0x3357, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(0x13d3, 0x3358, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(0x13d3, 0x3359, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x330b, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x2019, 0x4902, 0xff, 0xff, 0xff),
@@ -7889,6 +7902,8 @@
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x4856, 0x0091, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(0x9846, 0x9041, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0xcdab, 0x8010, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x04f2, 0xaff7, 0xff, 0xff, 0xff),
@@ -7914,6 +7929,8 @@
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x0586, 0x341f, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(0x06f8, 0xe033, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x06f8, 0xe035, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x0b05, 0x17ab, 0xff, 0xff, 0xff),
@@ -7922,6 +7939,8 @@
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x0df6, 0x0070, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(0x0df6, 0x0077, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x0789, 0x016d, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x07aa, 0x0056, 0xff, 0xff, 0xff),
@@ -7944,6 +7963,8 @@
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x330a, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
+{USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x330d, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x2019, 0xab2b, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x624d, 0xff, 0xff, 0xff),
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtlwifi/core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -633,21 +633,6 @@
 		}
 	}
 
-	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
-		rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
-			"IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n",
-			hw->conf.long_frame_max_tx_count);
-		/* brought up everything changes (changed == ~0) indicates first
-		 * open, so use our default value instead of that of wiphy.
-		 */
-		if (changed != ~0) {
-			mac->retry_long = hw->conf.long_frame_max_tx_count;
-			mac->retry_short = hw->conf.long_frame_max_tx_count;
-			rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RETRY_LIMIT,
-				(u8 *)(&hw->conf.long_frame_max_tx_count));
-		}
-	}
-
 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL &&
 	    !rtlpriv->proximity.proxim_on) {
 		struct ieee80211_channel *channel = hw->conf.chandef.chan;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtlwifi/efuse.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtlwifi/efuse.c
@@ -162,10 +162,19 @@
 void read_efuse_byte(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+	u16 max_attempts = 10000;
 	u32 value32;
 	u8 readbyte;
 	u16 retry;
 
+	/*
+	 * In case of USB devices, transfer speeds are limited, hence
+	 * efuse I/O reads could be (way) slower. So, decrease (a lot)
+	 * the read attempts in case of failures.
+	 */
+	if (rtlpriv->rtlhal.interface == INTF_USB)
+		max_attempts = 10;
+
 	rtl_write_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL] + 1,
 		       (_offset & 0xff));
 	readbyte = rtl_read_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL] + 2);
@@ -178,7 +187,7 @@
 
 	retry = 0;
 	value32 = rtl_read_dword(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL]);
-	while (!(((value32 >> 24) & 0xff) & 0x80) && (retry < 10000)) {
+	while (!(((value32 >> 24) & 0xff) & 0x80) && (retry < max_attempts)) {
 		value32 = rtl_read_dword(rtlpriv,
 					 rtlpriv->cfg->maps[EFUSE_CTRL]);
 		retry++;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
@@ -892,8 +892,8 @@
 	u8 place = chnl;
 
 	if (chnl > 14) {
-		for (place = 14; place < ARRAY_SIZE(channel5g); place++) {
-			if (channel5g[place] == chnl) {
+		for (place = 14; place < ARRAY_SIZE(channel_all); place++) {
+			if (channel_all[place] == chnl) {
 				place++;
 				break;
 			}
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c
@@ -35,7 +35,7 @@
 
 static void _rtl92de_query_rxphystatus(struct ieee80211_hw *hw,
 				       struct rtl_stats *pstats,
-				       struct rx_desc_92d *pdesc,
+				       __le32 *pdesc,
 				       struct rx_fwinfo_92d *p_drvinfo,
 				       bool packet_match_bssid,
 				       bool packet_toself,
@@ -49,8 +49,10 @@
 	u8 i, max_spatial_stream;
 	u32 rssi, total_rssi = 0;
 	bool is_cck_rate;
+	u8 rxmcs;
 
-	is_cck_rate = RX_HAL_IS_CCK_RATE(pdesc->rxmcs);
+	rxmcs = get_rx_desc_rxmcs(pdesc);
+	is_cck_rate = rxmcs <= DESC_RATE11M;
 	pstats->packet_matchbssid = packet_match_bssid;
 	pstats->packet_toself = packet_toself;
 	pstats->packet_beacon = packet_beacon;
@@ -158,8 +160,8 @@
 		pstats->rx_pwdb_all = pwdb_all;
 		pstats->rxpower = rx_pwr_all;
 		pstats->recvsignalpower = rx_pwr_all;
-		if (pdesc->rxht && pdesc->rxmcs >= DESC_RATEMCS8 &&
-		    pdesc->rxmcs <= DESC_RATEMCS15)
+		if (get_rx_desc_rxht(pdesc) && rxmcs >= DESC_RATEMCS8 &&
+		    rxmcs <= DESC_RATEMCS15)
 			max_spatial_stream = 2;
 		else
 			max_spatial_stream = 1;
@@ -365,7 +367,7 @@
 static void _rtl92de_translate_rx_signal_stuff(struct ieee80211_hw *hw,
 					       struct sk_buff *skb,
 					       struct rtl_stats *pstats,
-					       struct rx_desc_92d *pdesc,
+					       __le32 *pdesc,
 					       struct rx_fwinfo_92d *p_drvinfo)
 {
 	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
@@ -414,7 +416,8 @@
 	stats->icv = (u16)get_rx_desc_icv(pdesc);
 	stats->crc = (u16)get_rx_desc_crc32(pdesc);
 	stats->hwerror = (stats->crc | stats->icv);
-	stats->decrypted = !get_rx_desc_swdec(pdesc);
+	stats->decrypted = !get_rx_desc_swdec(pdesc) &&
+			   get_rx_desc_enc_type(pdesc) != RX_DESC_ENC_NONE;
 	stats->rate = (u8)get_rx_desc_rxmcs(pdesc);
 	stats->shortpreamble = (u16)get_rx_desc_splcp(pdesc);
 	stats->isampdu = (bool)(get_rx_desc_paggr(pdesc) == 1);
@@ -427,8 +430,6 @@
 	rx_status->band = hw->conf.chandef.chan->band;
 	if (get_rx_desc_crc32(pdesc))
 		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
-	if (!get_rx_desc_swdec(pdesc))
-		rx_status->flag |= RX_FLAG_DECRYPTED;
 	if (get_rx_desc_bw(pdesc))
 		rx_status->bw = RATE_INFO_BW_40;
 	if (get_rx_desc_rxht(pdesc))
@@ -442,9 +443,7 @@
 	if (phystatus) {
 		p_drvinfo = (struct rx_fwinfo_92d *)(skb->data +
 						     stats->rx_bufshift);
-		_rtl92de_translate_rx_signal_stuff(hw,
-						   skb, stats,
-						   (struct rx_desc_92d *)pdesc,
+		_rtl92de_translate_rx_signal_stuff(hw, skb, stats, pdesc,
 						   p_drvinfo);
 	}
 	/*rx_status->qual = stats->signal; */
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h
@@ -14,6 +14,15 @@
 #define USB_HWDESC_HEADER_LEN			32
 #define CRCLENGTH				4
 
+enum rtl92d_rx_desc_enc {
+	RX_DESC_ENC_NONE	= 0,
+	RX_DESC_ENC_WEP40	= 1,
+	RX_DESC_ENC_TKIP_WO_MIC	= 2,
+	RX_DESC_ENC_TKIP_MIC	= 3,
+	RX_DESC_ENC_AES		= 4,
+	RX_DESC_ENC_WEP104	= 5,
+};
+
 /* macros to read/write various fields in RX or TX descriptors */
 
 static inline void set_tx_desc_pkt_size(__le32 *__pdesc, u32 __val)
@@ -246,6 +255,11 @@
 	return le32_get_bits(*__pdesc, GENMASK(19, 16));
 }
 
+static inline u32 get_rx_desc_enc_type(__le32 *__pdesc)
+{
+	return le32_get_bits(*__pdesc, GENMASK(22, 20));
+}
+
 static inline u32 get_rx_desc_shift(__le32 *__pdesc)
 {
 	return le32_get_bits(*__pdesc, GENMASK(25, 24));
@@ -380,10 +394,17 @@
 	u8 csi_target[2];
 	u8 sigevm;
 	u8 max_ex_pwr;
+#ifdef __LITTLE_ENDIAN
 	u8 ex_intf_flag:1;
 	u8 sgi_en:1;
 	u8 rxsc:2;
 	u8 reserve:4;
+#else
+	u8 reserve:4;
+	u8 rxsc:2;
+	u8 sgi_en:1;
+	u8 ex_intf_flag:1;
+#endif
 } __packed;
 
 struct tx_desc_92d {
@@ -488,64 +509,6 @@
 	u32 reserve_pass_pcie_mm_limit[4];
 } __packed;
 
-struct rx_desc_92d {
-	u32 length:14;
-	u32 crc32:1;
-	u32 icverror:1;
-	u32 drv_infosize:4;
-	u32 security:3;
-	u32 qos:1;
-	u32 shift:2;
-	u32 phystatus:1;
-	u32 swdec:1;
-	u32 lastseg:1;
-	u32 firstseg:1;
-	u32 eor:1;
-	u32 own:1;
-
-	u32 macid:5;
-	u32 tid:4;
-	u32 hwrsvd:5;
-	u32 paggr:1;
-	u32 faggr:1;
-	u32 a1_fit:4;
-	u32 a2_fit:4;
-	u32 pam:1;
-	u32 pwr:1;
-	u32 moredata:1;
-	u32 morefrag:1;
-	u32 type:2;
-	u32 mc:1;
-	u32 bc:1;
-
-	u32 seq:12;
-	u32 frag:4;
-	u32 nextpktlen:14;
-	u32 nextind:1;
-	u32 rsvd:1;
-
-	u32 rxmcs:6;
-	u32 rxht:1;
-	u32 amsdu:1;
-	u32 splcp:1;
-	u32 bandwidth:1;
-	u32 htc:1;
-	u32 tcpchk_rpt:1;
-	u32 ipcchk_rpt:1;
-	u32 tcpchk_valid:1;
-	u32 hwpcerr:1;
-	u32 hwpcind:1;
-	u32 iv0:16;
-
-	u32 iv1;
-
-	u32 tsfl;
-
-	u32 bufferaddress;
-	u32 bufferaddress64;
-
-} __packed;
-
 void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
 			  struct ieee80211_hdr *hdr, u8 *pdesc,
 			  u8 *pbd_desc_tx, struct ieee80211_tx_info *info,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -23,6 +23,8 @@
 
 #define MAX_USBCTRL_VENDORREQ_TIMES		10
 
+static void _rtl_usb_cleanup_tx(struct ieee80211_hw *hw);
+
 static void usbctrl_async_callback(struct urb *urb)
 {
 	if (urb) {
@@ -332,9 +334,23 @@
 	}
 	/* usb endpoint mapping */
 	err = rtlpriv->cfg->usb_interface_cfg->usb_endpoint_mapping(hw);
-	rtlusb->usb_mq_to_hwq =  rtlpriv->cfg->usb_interface_cfg->usb_mq_to_hwq;
-	_rtl_usb_init_tx(hw);
-	_rtl_usb_init_rx(hw);
+	if (err)
+		return err;
+
+	rtlusb->usb_mq_to_hwq = rtlpriv->cfg->usb_interface_cfg->usb_mq_to_hwq;
+
+	err = _rtl_usb_init_tx(hw);
+	if (err)
+		return err;
+
+	err = _rtl_usb_init_rx(hw);
+	if (err)
+		goto err_out;
+
+	return 0;
+
+err_out:
+	_rtl_usb_cleanup_tx(hw);
 	return err;
 }
 
@@ -738,17 +754,13 @@
 }
 
 /*=======================  tx =========================================*/
-static void rtl_usb_cleanup(struct ieee80211_hw *hw)
+static void _rtl_usb_cleanup_tx(struct ieee80211_hw *hw)
 {
 	u32 i;
 	struct sk_buff *_skb;
 	struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
 	struct ieee80211_tx_info *txinfo;
 
-	/* clean up rx stuff. */
-	_rtl_usb_cleanup_rx(hw);
-
-	/* clean up tx stuff */
 	for (i = 0; i < RTL_USB_MAX_EP_NUM; i++) {
 		while ((_skb = skb_dequeue(&rtlusb->tx_skb_queue[i]))) {
 			rtlusb->usb_tx_cleanup(hw, _skb);
@@ -762,6 +774,12 @@
 	usb_kill_anchored_urbs(&rtlusb->tx_submitted);
 }
 
+static void rtl_usb_cleanup(struct ieee80211_hw *hw)
+{
+	_rtl_usb_cleanup_rx(hw);
+	_rtl_usb_cleanup_tx(hw);
+}
+
 /* We may add some struct into struct rtl_usb later. Do deinit here.  */
 static void rtl_usb_deinit(struct ieee80211_hw *hw)
 {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/Kconfig
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/Kconfig
@@ -12,6 +12,7 @@
 
 config RTW88_CORE
 	tristate
+	select WANT_DEV_COREDUMP
 
 config RTW88_PCI
 	tristate
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/coex.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/coex.c
@@ -2194,7 +2194,6 @@
 	struct rtw_coex_stat *coex_stat = &coex->stat;
 	struct rtw_efuse *efuse = &rtwdev->efuse;
 	u8 table_case, tdma_case;
-	bool wl_cpt_test = false, bt_cpt_test = false;
 
 	rtw_dbg(rtwdev, RTW_DBG_COEX, "[BTCoex], %s()\n", __func__);
 
@@ -2202,29 +2201,16 @@
 	rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
 	if (efuse->share_ant) {
 		/* Shared-Ant */
-		if (wl_cpt_test) {
-			if (coex_stat->wl_gl_busy) {
-				table_case = 20;
-				tdma_case = 17;
-			} else {
-				table_case = 10;
-				tdma_case = 15;
-			}
-		} else if (bt_cpt_test) {
-			table_case = 26;
-			tdma_case = 26;
-		} else {
-			if (coex_stat->wl_gl_busy &&
-			    coex_stat->wl_noisy_level == 0)
-				table_case = 14;
-			else
-				table_case = 10;
+		if (coex_stat->wl_gl_busy &&
+		    coex_stat->wl_noisy_level == 0)
+			table_case = 14;
+		else
+			table_case = 10;
 
-			if (coex_stat->wl_gl_busy)
-				tdma_case = 15;
-			else
-				tdma_case = 20;
-		}
+		if (coex_stat->wl_gl_busy)
+			tdma_case = 15;
+		else
+			tdma_case = 20;
 	} else {
 		/* Non-Shared-Ant */
 		table_case = 112;
@@ -2235,11 +2221,7 @@
 			tdma_case = 120;
 	}
 
-	if (wl_cpt_test)
-		rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[1]);
-	else
-		rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
-
+	rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
 	rtw_coex_table(rtwdev, false, table_case);
 	rtw_coex_tdma(rtwdev, false, tdma_case);
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/fw.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/fw.c
@@ -1462,10 +1462,12 @@
 	val |= BIT_ENSWBCN >> 8;
 	rtw_write8(rtwdev, REG_CR + 1, val);
 
-	val = rtw_read8(rtwdev, REG_FWHW_TXQ_CTRL + 2);
-	bckp[1] = val;
-	val &= ~(BIT_EN_BCNQ_DL >> 16);
-	rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 2, val);
+	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE) {
+		val = rtw_read8(rtwdev, REG_FWHW_TXQ_CTRL + 2);
+		bckp[1] = val;
+		val &= ~(BIT_EN_BCNQ_DL >> 16);
+		rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 2, val);
+	}
 
 	ret = rtw_hci_write_data_rsvd_page(rtwdev, buf, size);
 	if (ret) {
@@ -1490,7 +1492,8 @@
 	rsvd_pg_head = rtwdev->fifo.rsvd_boundary;
 	rtw_write16(rtwdev, REG_FIFOPAGE_CTRL_2,
 		    rsvd_pg_head | BIT_BCN_VALID_V1);
-	rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 2, bckp[1]);
+	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
+		rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 2, bckp[1]);
 	rtw_write8(rtwdev, REG_CR + 1, bckp[0]);
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/mac.c
@@ -309,6 +309,13 @@
 	pwr_seq = pwr_on ? chip->pwr_on_seq : chip->pwr_off_seq;
 	ret = rtw_pwr_seq_parser(rtwdev, pwr_seq);
 
+	if (pwr_on && rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB) {
+		if (chip->id == RTW_CHIP_TYPE_8822C ||
+		    chip->id == RTW_CHIP_TYPE_8822B ||
+		    chip->id == RTW_CHIP_TYPE_8821C)
+			rtw_write8_clr(rtwdev, REG_SYS_STATUS1 + 1, BIT(0));
+	}
+
 	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_SDIO)
 		rtw_write32(rtwdev, REG_SDIO_HIMR, imr);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/main.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/main.c
@@ -1314,20 +1314,21 @@
 {
 	const struct rtw_chip_info *chip = rtwdev->chip;
 	struct rtw_fw_state *fw;
+	int ret = 0;
 
 	fw = &rtwdev->fw;
 	wait_for_completion(&fw->completion);
 	if (!fw->firmware)
-		return -EINVAL;
+		ret = -EINVAL;
 
 	if (chip->wow_fw_name) {
 		fw = &rtwdev->wow_fw;
 		wait_for_completion(&fw->completion);
 		if (!fw->firmware)
-			return -EINVAL;
+			ret = -EINVAL;
 	}
 
-	return 0;
+	return ret;
 }
 
 static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,
@@ -2032,8 +2033,6 @@
 	rtw_phy_setup_phy_cond(rtwdev, hal->pkg_type);
 
 	rtw_phy_init_tx_power(rtwdev);
-	if (rfe_def->agc_btg_tbl)
-		rtw_load_table(rtwdev, rfe_def->agc_btg_tbl);
 	rtw_load_table(rtwdev, rfe_def->phy_pg_tbl);
 	rtw_load_table(rtwdev, rfe_def->txpwr_lmt_tbl);
 	rtw_phy_tx_power_by_rate_config(hal);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/phy.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/phy.c
@@ -1761,12 +1761,15 @@
 
 void rtw_phy_load_tables(struct rtw_dev *rtwdev)
 {
+	const struct rtw_rfe_def *rfe_def = rtw_get_rfe_def(rtwdev);
 	const struct rtw_chip_info *chip = rtwdev->chip;
 	u8 rf_path;
 
 	rtw_load_table(rtwdev, chip->mac_tbl);
 	rtw_load_table(rtwdev, chip->bb_tbl);
 	rtw_load_table(rtwdev, chip->agc_tbl);
+	if (rfe_def->agc_btg_tbl)
+		rtw_load_table(rtwdev, rfe_def->agc_btg_tbl);
 	rtw_load_rfk_table(rtwdev);
 
 	for (rf_path = 0; rf_path < rtwdev->hal.rf_path_num; rf_path++) {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/rtw8821c.c
@@ -773,9 +773,9 @@
 
 	dm_info->cck_fa_cnt = cck_fa_cnt;
 	dm_info->ofdm_fa_cnt = ofdm_fa_cnt;
+	dm_info->total_fa_cnt = ofdm_fa_cnt;
 	if (cck_enable)
 		dm_info->total_fa_cnt += cck_fa_cnt;
-	dm_info->total_fa_cnt = ofdm_fa_cnt;
 
 	crc32_cnt = rtw_read32(rtwdev, REG_CRC_CCK);
 	dm_info->cck_ok_cnt = FIELD_GET(GENMASK(15, 0), crc32_cnt);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
@@ -9,24 +9,34 @@
 #include "usb.h"
 
 static const struct usb_device_id rtw_8821cu_id_table[] = {
-	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xb82b, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x2006, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x8731, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x8811, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xb820, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */
-	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc821, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xb82b, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc80c, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc811, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc820, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc821, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc82a, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc82b, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */
-	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc811, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8811CU */
-	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x8811, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8811CU */
-	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x2006, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* TOTOLINK A650UA v3 */
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x331d, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* D-Link */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xc811, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff),
+	  .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
 	{},
 };
 MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/rtw8822c.c
@@ -2611,12 +2611,14 @@
 	else
 		rxsc = GET_PHY_STAT_P1_HT_RXSC(phy_status);
 
-	if (rxsc >= 9 && rxsc <= 12)
+	if (rxsc == 0)
+		bw = rtwdev->hal.current_band_width;
+	else if (rxsc >= 1 && rxsc <= 8)
+		bw = RTW_CHANNEL_WIDTH_20;
+	else if (rxsc >= 9 && rxsc <= 12)
 		bw = RTW_CHANNEL_WIDTH_40;
-	else if (rxsc >= 13)
-		bw = RTW_CHANNEL_WIDTH_80;
 	else
-		bw = RTW_CHANNEL_WIDTH_20;
+		bw = RTW_CHANNEL_WIDTH_80;
 
 	channel = GET_PHY_STAT_P1_CHANNEL(phy_status);
 	rtw_set_rx_freq_band(pkt_stat, channel);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/sdio.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/sdio.c
@@ -1295,12 +1295,12 @@
 	struct rtw_sdio *rtwsdio = (struct rtw_sdio *)rtwdev->priv;
 	int i;
 
-	for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++)
-		skb_queue_purge(&rtwsdio->tx_queue[i]);
-
 	flush_workqueue(rtwsdio->txwq);
 	destroy_workqueue(rtwsdio->txwq);
 	kfree(rtwsdio->tx_handler_data);
+
+	for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++)
+		ieee80211_purge_tx_queue(rtwdev->hw, &rtwsdio->tx_queue[i]);
 }
 
 int rtw_sdio_probe(struct sdio_func *sdio_func,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw88/usb.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw88/usb.c
@@ -33,6 +33,36 @@
 	rtw_tx_fill_txdesc_checksum(rtwdev, &pkt_info, skb->data);
 }
 
+static void rtw_usb_reg_sec(struct rtw_dev *rtwdev, u32 addr, __le32 *data)
+{
+	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
+	struct usb_device *udev = rtwusb->udev;
+	bool reg_on_section = false;
+	u16 t_reg = 0x4e0;
+	u8 t_len = 1;
+	int status;
+
+	/* There are three sections:
+	 * 1. on (0x00~0xFF; 0x1000~0x10FF): this section is always powered on
+	 * 2. off (< 0xFE00, excluding "on" section): this section could be
+	 *    powered off
+	 * 3. local (>= 0xFE00): usb specific registers section
+	 */
+	if (addr <= 0xff || (addr >= 0x1000 && addr <= 0x10ff))
+		reg_on_section = true;
+
+	if (!reg_on_section)
+		return;
+
+	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+				 RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
+				 t_reg, 0, data, t_len, 500);
+
+	if (status != t_len && status != -ENODEV)
+		rtw_err(rtwdev, "%s: reg 0x%x, usb write %u fail, status: %d\n",
+			__func__, t_reg, t_len, status);
+}
+
 static u32 rtw_usb_read(struct rtw_dev *rtwdev, u32 addr, u16 len)
 {
 	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
@@ -58,6 +88,11 @@
 		rtw_err(rtwdev, "read register 0x%x failed with %d\n",
 			addr, ret);
 
+	if (rtwdev->chip->id == RTW_CHIP_TYPE_8822C ||
+	    rtwdev->chip->id == RTW_CHIP_TYPE_8822B ||
+	    rtwdev->chip->id == RTW_CHIP_TYPE_8821C)
+		rtw_usb_reg_sec(rtwdev, addr, data);
+
 	return le32_to_cpu(*data);
 }
 
@@ -102,6 +137,11 @@
 	if (ret < 0 && ret != -ENODEV && count++ < 4)
 		rtw_err(rtwdev, "write register 0x%x failed with %d\n",
 			addr, ret);
+
+	if (rtwdev->chip->id == RTW_CHIP_TYPE_8822C ||
+	    rtwdev->chip->id == RTW_CHIP_TYPE_8822B ||
+	    rtwdev->chip->id == RTW_CHIP_TYPE_8821C)
+		rtw_usb_reg_sec(rtwdev, addr, data);
 }
 
 static void rtw_usb_write8(struct rtw_dev *rtwdev, u32 addr, u8 val)
@@ -233,6 +273,8 @@
 		info = IEEE80211_SKB_CB(skb);
 		tx_data = rtw_usb_get_tx_data(skb);
 
+		skb_pull(skb, rtwdev->chip->tx_pkt_desc_sz);
+
 		/* enqueue to wait for tx report */
 		if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
 			rtw_tx_report_enqueue(rtwdev, skb, tx_data->sn);
@@ -374,10 +416,11 @@
 
 static void rtw_usb_tx_queue_purge(struct rtw_usb *rtwusb)
 {
+	struct rtw_dev *rtwdev = rtwusb->rtwdev;
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++)
-		skb_queue_purge(&rtwusb->tx_queue[i]);
+		ieee80211_purge_tx_queue(rtwdev->hw, &rtwusb->tx_queue[i]);
 }
 
 static void rtw_usb_write_port_complete(struct urb *urb)
@@ -700,7 +743,6 @@
 static int rtw_usb_init_rx(struct rtw_dev *rtwdev)
 {
 	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
-	int i;
 
 	rtwusb->rxwq = create_singlethread_workqueue("rtw88_usb: rx wq");
 	if (!rtwusb->rxwq) {
@@ -712,13 +754,19 @@
 
 	INIT_WORK(&rtwusb->rx_work, rtw_usb_rx_handler);
 
+	return 0;
+}
+
+static void rtw_usb_setup_rx(struct rtw_dev *rtwdev)
+{
+	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
+	int i;
+
 	for (i = 0; i < RTW_USB_RXCB_NUM; i++) {
 		struct rx_usb_ctrl_block *rxcb = &rtwusb->rx_cb[i];
 
 		rtw_usb_rx_resubmit(rtwusb, rxcb);
 	}
-
-	return 0;
 }
 
 static void rtw_usb_deinit_rx(struct rtw_dev *rtwdev)
@@ -754,9 +802,9 @@
 {
 	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
 
-	rtw_usb_tx_queue_purge(rtwusb);
 	flush_workqueue(rtwusb->txwq);
 	destroy_workqueue(rtwusb->txwq);
+	rtw_usb_tx_queue_purge(rtwusb);
 }
 
 static int rtw_usb_intf_init(struct rtw_dev *rtwdev,
@@ -855,6 +903,8 @@
 		goto err_destroy_rxwq;
 	}
 
+	rtw_usb_setup_rx(rtwdev);
+
 	return 0;
 
 err_destroy_rxwq:
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/core.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/core.c
@@ -1896,7 +1896,8 @@
 		return;
 
 	if (ieee80211_is_beacon(hdr->frame_control)) {
-		if (vif->type == NL80211_IFTYPE_STATION)
+		if (vif->type == NL80211_IFTYPE_STATION &&
+		    !test_bit(RTW89_FLAG_WOWLAN, rtwdev->flags))
 			rtw89_fw_h2c_rssi_offload(rtwdev, phy_ppdu);
 		pkt_stat->beacon_nr++;
 	}
@@ -3132,6 +3133,7 @@
 	rtw89_phy_edcca_track(rtwdev);
 	rtw89_tas_track(rtwdev);
 	rtw89_chanctx_track(rtwdev);
+	rtw89_core_rfkill_poll(rtwdev, false);
 
 	if (rtwdev->lps_enabled && !rtwdev->btc.lps)
 		rtw89_enter_lps_track(rtwdev);
@@ -3940,6 +3942,24 @@
 	}
 }
 
+void rtw89_check_quirks(struct rtw89_dev *rtwdev, const struct dmi_system_id *quirks)
+{
+	const struct dmi_system_id *match;
+	enum rtw89_quirks quirk;
+
+	if (!quirks)
+		return;
+
+	for (match = dmi_first_match(quirks); match; match = dmi_first_match(match + 1)) {
+		quirk = (uintptr_t)match->driver_data;
+		if (quirk >= NUM_OF_RTW89_QUIRKS)
+			continue;
+
+		set_bit(quirk, rtwdev->quirks);
+	}
+}
+EXPORT_SYMBOL(rtw89_check_quirks);
+
 int rtw89_core_start(struct rtw89_dev *rtwdev)
 {
 	int ret;
@@ -4249,6 +4269,70 @@
 	return 0;
 }
 
+static bool rtw89_chip_has_rfkill(struct rtw89_dev *rtwdev)
+{
+	return !!rtwdev->chip->rfkill_init;
+}
+
+static void rtw89_core_rfkill_init(struct rtw89_dev *rtwdev)
+{
+	const struct rtw89_rfkill_regs *regs = rtwdev->chip->rfkill_init;
+
+	rtw89_write16_mask(rtwdev, regs->pinmux.addr,
+			   regs->pinmux.mask, regs->pinmux.data);
+	rtw89_write16_mask(rtwdev, regs->mode.addr,
+			   regs->mode.mask, regs->mode.data);
+}
+
+static bool rtw89_core_rfkill_get(struct rtw89_dev *rtwdev)
+{
+	const struct rtw89_reg_def *reg = &rtwdev->chip->rfkill_get;
+
+	return !rtw89_read8_mask(rtwdev, reg->addr, reg->mask);
+}
+
+static void rtw89_rfkill_polling_init(struct rtw89_dev *rtwdev)
+{
+	if (!rtw89_chip_has_rfkill(rtwdev))
+		return;
+
+	rtw89_core_rfkill_init(rtwdev);
+	rtw89_core_rfkill_poll(rtwdev, true);
+	wiphy_rfkill_start_polling(rtwdev->hw->wiphy);
+}
+
+static void rtw89_rfkill_polling_deinit(struct rtw89_dev *rtwdev)
+{
+	if (!rtw89_chip_has_rfkill(rtwdev))
+		return;
+
+	wiphy_rfkill_stop_polling(rtwdev->hw->wiphy);
+}
+
+void rtw89_core_rfkill_poll(struct rtw89_dev *rtwdev, bool force)
+{
+	bool prev, blocked;
+
+	if (!rtw89_chip_has_rfkill(rtwdev))
+		return;
+
+	prev = test_bit(RTW89_FLAG_HW_RFKILL_STATE, rtwdev->flags);
+	blocked = rtw89_core_rfkill_get(rtwdev);
+
+	if (!force && prev == blocked)
+		return;
+
+	rtw89_info(rtwdev, "rfkill hardware state changed to %s\n",
+		   blocked ? "disable" : "enable");
+
+	if (blocked)
+		set_bit(RTW89_FLAG_HW_RFKILL_STATE, rtwdev->flags);
+	else
+		clear_bit(RTW89_FLAG_HW_RFKILL_STATE, rtwdev->flags);
+
+	wiphy_rfkill_set_hw_state(rtwdev->hw->wiphy, blocked);
+}
+
 int rtw89_chip_info_setup(struct rtw89_dev *rtwdev)
 {
 	int ret;
@@ -4389,6 +4473,8 @@
 		goto err_unregister_hw;
 	}
 
+	rtw89_rfkill_polling_init(rtwdev);
+
 	return 0;
 
 err_unregister_hw:
@@ -4403,6 +4489,7 @@
 {
 	struct ieee80211_hw *hw = rtwdev->hw;
 
+	rtw89_rfkill_polling_deinit(rtwdev);
 	ieee80211_unregister_hw(hw);
 	rtw89_core_clr_supported_band(rtwdev);
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/core.h
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/core.h
@@ -7,6 +7,7 @@
 
 #include <linux/average.h>
 #include <linux/bitfield.h>
+#include <linux/dmi.h>
 #include <linux/firmware.h>
 #include <linux/iopoll.h>
 #include <linux/workqueue.h>
@@ -129,6 +130,7 @@
 enum rtw89_core_chip_id {
 	RTL8852A,
 	RTL8852B,
+	RTL8852BT,
 	RTL8852C,
 	RTL8851B,
 	RTL8922A,
@@ -3455,16 +3457,22 @@
 	const void *data;
 };
 
+static inline bool rtw89_txpwr_entcpy(void *entry, const void *cursor, u8 size,
+				      const struct rtw89_txpwr_conf *conf)
+{
+	u8 valid_size = min(size, conf->ent_sz);
+
+	memcpy(entry, cursor, valid_size);
+	return true;
+}
+
 #define rtw89_txpwr_conf_valid(conf) (!!(conf)->data)
 
 #define rtw89_for_each_in_txpwr_conf(entry, cursor, conf) \
-	for (typecheck(const void *, cursor), (cursor) = (conf)->data, \
-	     memcpy(&(entry), cursor, \
-		    min_t(u8, sizeof(entry), (conf)->ent_sz)); \
+	for (typecheck(const void *, cursor), (cursor) = (conf)->data; \
 	     (cursor) < (conf)->data + (conf)->num_ents * (conf)->ent_sz; \
-	     (cursor) += (conf)->ent_sz, \
-	     memcpy(&(entry), cursor, \
-		    min_t(u8, sizeof(entry), (conf)->ent_sz)))
+	     (cursor) += (conf)->ent_sz) \
+		if (rtw89_txpwr_entcpy(&(entry), cursor, sizeof(entry), conf))
 
 struct rtw89_txpwr_byrate_data {
 	struct rtw89_txpwr_conf conf;
@@ -3612,6 +3620,11 @@
 	struct rtw89_reg3_def rsc;
 };
 
+struct rtw89_rfkill_regs {
+	struct rtw89_reg3_def pinmux;
+	struct rtw89_reg3_def mode;
+};
+
 struct rtw89_dig_regs {
 	u32 seg0_pd_reg;
 	u32 pd_lower_bound_mask;
@@ -3800,6 +3813,8 @@
 	const struct rtw89_rrsr_cfgs *rrsr_cfgs;
 	struct rtw89_reg_def bss_clr_vld;
 	u32 bss_clr_map_reg;
+	const struct rtw89_rfkill_regs *rfkill_init;
+	struct rtw89_reg_def rfkill_get;
 	u32 dma_ch_mask;
 	const struct rtw89_edcca_regs *edcca_regs;
 	const struct wiphy_wowlan_support *wowlan_stub;
@@ -3812,6 +3827,7 @@
 
 struct rtw89_driver_info {
 	const struct rtw89_chip_info *chip;
+	const struct dmi_system_id *quirks;
 	union rtw89_bus_info bus;
 };
 
@@ -4135,10 +4151,17 @@
 	RTW89_FLAG_WOWLAN,
 	RTW89_FLAG_FORBIDDEN_TRACK_WROK,
 	RTW89_FLAG_CHANGING_INTERFACE,
+	RTW89_FLAG_HW_RFKILL_STATE,
 
 	NUM_OF_RTW89_FLAGS,
 };
 
+enum rtw89_quirks {
+	RTW89_QUIRK_PCI_BER,
+
+	NUM_OF_RTW89_QUIRKS,
+};
+
 enum rtw89_pkt_drop_sel {
 	RTW89_PKT_DROP_SEL_MACID_BE_ONCE,
 	RTW89_PKT_DROP_SEL_MACID_BK_ONCE,
@@ -4804,6 +4827,7 @@
 	DECLARE_BITMAP(mac_id_map, RTW89_MAX_MAC_ID_NUM);
 	DECLARE_BITMAP(flags, NUM_OF_RTW89_FLAGS);
 	DECLARE_BITMAP(pkt_offload, RTW89_MAX_PKT_OFLD_NUM);
+	DECLARE_BITMAP(quirks, NUM_OF_RTW89_QUIRKS);
 
 	struct rtw89_phy_stat phystat;
 	struct rtw89_dack_info dack;
@@ -5803,6 +5827,8 @@
 void rtw89_core_set_tid_config(struct rtw89_dev *rtwdev,
 			       struct ieee80211_sta *sta,
 			       struct cfg80211_tid_config *tid_config);
+void rtw89_core_rfkill_poll(struct rtw89_dev *rtwdev, bool force);
+void rtw89_check_quirks(struct rtw89_dev *rtwdev, const struct dmi_system_id *quirks);
 int rtw89_core_init(struct rtw89_dev *rtwdev);
 void rtw89_core_deinit(struct rtw89_dev *rtwdev);
 int rtw89_core_register(struct rtw89_dev *rtwdev);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/debug.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/debug.c
@@ -3528,7 +3528,7 @@
 	case RX_ENC_HE:
 		seq_printf(m, "HE %dSS MCS-%d GI:%s", status->nss, status->rate_idx,
 			   status->he_gi <= NL80211_RATE_INFO_HE_GI_3_2 ?
-			   he_gi_str[rate->he_gi] : "N/A");
+			   he_gi_str[status->he_gi] : "N/A");
 		break;
 	case RX_ENC_EHT:
 		seq_printf(m, "EHT %dSS MCS-%d GI:%s", status->nss, status->rate_idx,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/fw.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/fw.c
@@ -1086,13 +1086,12 @@
 static void rtw89_fw_dl_fail_dump(struct rtw89_dev *rtwdev)
 {
 	u32 val32;
-	u16 val16;
 
 	val32 = rtw89_read32(rtwdev, R_AX_WCPU_FW_CTRL);
 	rtw89_err(rtwdev, "[ERR]fwdl 0x1E0 = 0x%x\n", val32);
 
-	val16 = rtw89_read16(rtwdev, R_AX_BOOT_DBG + 2);
-	rtw89_err(rtwdev, "[ERR]fwdl 0x83F2 = 0x%x\n", val16);
+	val32 = rtw89_read32(rtwdev, R_AX_BOOT_DBG);
+	rtw89_err(rtwdev, "[ERR]fwdl 0x83F0 = 0x%x\n", val32);
 
 	rtw89_fw_prog_cnt_dump(rtwdev);
 }
@@ -1132,8 +1131,9 @@
 	return 0;
 }
 
-int rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type,
-		      bool include_bb)
+static
+int __rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type,
+			bool include_bb)
 {
 	const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
 	struct rtw89_fw_info *fw_info = &rtwdev->fw;
@@ -1171,7 +1171,7 @@
 	ret = rtw89_fw_check_rdy(rtwdev, RTW89_FWDL_CHECK_FREERTOS_DONE);
 	if (ret) {
 		rtw89_warn(rtwdev, "download firmware fail\n");
-		return ret;
+		goto fwdl_err;
 	}
 
 	return ret;
@@ -1181,6 +1181,21 @@
 	return ret;
 }
 
+int rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type,
+		      bool include_bb)
+{
+	int retry;
+	int ret;
+
+	for (retry = 0; retry < 5; retry++) {
+		ret = __rtw89_fw_download(rtwdev, type, include_bb);
+		if (!ret)
+			return 0;
+	}
+
+	return ret;
+}
+
 int rtw89_wait_firmware_completion(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_info *fw = &rtwdev->fw;
@@ -3943,6 +3958,9 @@
 
 		skb = ieee80211_probereq_get(rtwdev->hw, rtwvif->mac_addr,
 					     NULL, 0, req->ie_len);
+		if (!skb)
+			return -ENOMEM;
+
 		skb_put_data(skb, ies->ies[NL80211_BAND_6GHZ], ies->len[NL80211_BAND_6GHZ]);
 		skb_put_data(skb, ies->common_ies, ies->common_ie_len);
 		hdr = (struct ieee80211_hdr *)skb->data;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/mac.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/mac.c
@@ -2717,6 +2717,7 @@
 
 static int ptcl_init_ax(struct rtw89_dev *rtwdev, u8 mac_idx)
 {
+	enum rtw89_core_chip_id chip_id = rtwdev->chip->chip_id;
 	u32 val, reg;
 	int ret;
 
@@ -2755,6 +2756,12 @@
 				  B_AX_SPE_RPT_PATH_MASK, FWD_TO_WLCPU);
 	}
 
+	if (chip_id == RTL8852A || chip_id == RTL8852B || chip_id == RTL8851B || chip_id == RTL8852BT) {
+		reg = rtw89_mac_reg_by_idx(rtwdev, R_AX_AGG_LEN_VHT_0, mac_idx);
+		rtw89_write32_mask(rtwdev, reg,
+				   B_AX_AMPDU_MAX_LEN_VHT_MASK, 0x3FF80);
+	}
+
 	return 0;
 }
 
@@ -3739,7 +3746,9 @@
 
 	rtw89_write32(rtwdev, R_AX_WCPU_FW_CTRL, val);
 
-	if (rtwdev->chip->chip_id == RTL8852B)
+	if (rtwdev->chip->chip_id == RTL8852B ||
+	    rtwdev->chip->chip_id == RTL8851B ||
+	    rtwdev->chip->chip_id == RTL8852BT)
 		rtw89_write32_mask(rtwdev, R_AX_SEC_CTRL,
 				   B_AX_SEC_IDMEM_SIZE_CONFIG_MASK, 0x2);
 
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -126,7 +126,9 @@
 	rtwvif->rtwdev = rtwdev;
 	rtwvif->roc.state = RTW89_ROC_IDLE;
 	rtwvif->offchan = false;
-	list_add_tail(&rtwvif->list, &rtwdev->rtwvifs_list);
+	if (!rtw89_rtwvif_in_list(rtwdev, rtwvif))
+		list_add_tail(&rtwvif->list, &rtwdev->rtwvifs_list);
+
 	INIT_WORK(&rtwvif->update_beacon_work, rtw89_core_update_beacon_work);
 	INIT_DELAYED_WORK(&rtwvif->roc.roc_work, rtw89_roc_work);
 	rtw89_leave_ps_mode(rtwdev);
@@ -318,7 +320,7 @@
 	u8 sifs;
 
 	slot_time = vif->bss_conf.use_short_slot ? 9 : 20;
-	sifs = chan->band_type == RTW89_BAND_5G ? 16 : 10;
+	sifs = chan->band_type == RTW89_BAND_2G ? 10 : 16;
 
 	return aifsn * slot_time + sifs;
 }
@@ -441,7 +443,7 @@
 			 * when disconnected by peer
 			 */
 			if (rtwdev->scanning)
-				rtw89_hw_scan_abort(rtwdev, vif);
+				rtw89_hw_scan_abort(rtwdev, rtwdev->scan_info.scanning_vif);
 		}
 	}
 
@@ -990,7 +992,7 @@
 	}
 
 	if (rtwdev->scanning)
-		rtw89_hw_scan_abort(rtwdev, vif);
+		rtw89_hw_scan_abort(rtwdev, rtwdev->scan_info.scanning_vif);
 
 	if (type == IEEE80211_ROC_TYPE_MGMT_TX)
 		roc->state = RTW89_ROC_MGMT;
@@ -1103,6 +1105,22 @@
 }
 #endif
 
+static void rtw89_ops_rfkill_poll(struct ieee80211_hw *hw)
+{
+	struct rtw89_dev *rtwdev = hw->priv;
+
+	mutex_lock(&rtwdev->mutex);
+
+	/* wl_disable GPIO get floating when entering LPS */
+	if (test_bit(RTW89_FLAG_RUNNING, rtwdev->flags))
+		goto out;
+
+	rtw89_core_rfkill_poll(rtwdev, false);
+
+out:
+	mutex_unlock(&rtwdev->mutex);
+}
+
 const struct ieee80211_ops rtw89_ops = {
 	.tx			= rtw89_ops_tx,
 	.wake_tx_queue		= rtw89_ops_wake_tx_queue,
@@ -1147,5 +1165,6 @@
 	.resume			= rtw89_ops_resume,
 	.set_wakeup		= rtw89_ops_set_wakeup,
 #endif
+	.rfkill_poll		= rtw89_ops_rfkill_poll,
 };
 EXPORT_SYMBOL(rtw89_ops);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/pci.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/pci.c
@@ -155,21 +155,72 @@
 				   DMA_FROM_DEVICE);
 }
 
-static int rtw89_pci_rxbd_info_update(struct rtw89_dev *rtwdev,
-				      struct sk_buff *skb)
+static void rtw89_pci_rxbd_info_update(struct rtw89_dev *rtwdev,
+				       struct sk_buff *skb)
 {
-	struct rtw89_pci_rxbd_info *rxbd_info;
 	struct rtw89_pci_rx_info *rx_info = RTW89_PCI_RX_SKB_CB(skb);
+	struct rtw89_pci_rxbd_info *rxbd_info;
+	__le32 info;
 
 	rxbd_info = (struct rtw89_pci_rxbd_info *)skb->data;
-	rx_info->fs = le32_get_bits(rxbd_info->dword, RTW89_PCI_RXBD_FS);
-	rx_info->ls = le32_get_bits(rxbd_info->dword, RTW89_PCI_RXBD_LS);
-	rx_info->len = le32_get_bits(rxbd_info->dword, RTW89_PCI_RXBD_WRITE_SIZE);
-	rx_info->tag = le32_get_bits(rxbd_info->dword, RTW89_PCI_RXBD_TAG);
+	info = rxbd_info->dword;
+
+	rx_info->fs = le32_get_bits(info, RTW89_PCI_RXBD_FS);
+	rx_info->ls = le32_get_bits(info, RTW89_PCI_RXBD_LS);
+	rx_info->len = le32_get_bits(info, RTW89_PCI_RXBD_WRITE_SIZE);
+	rx_info->tag = le32_get_bits(info, RTW89_PCI_RXBD_TAG);
+}
+
+static int rtw89_pci_validate_rx_tag(struct rtw89_dev *rtwdev,
+				     struct rtw89_pci_rx_ring *rx_ring,
+				     struct sk_buff *skb)
+{
+	struct rtw89_pci_rx_info *rx_info = RTW89_PCI_RX_SKB_CB(skb);
+	const struct rtw89_pci_info *info = rtwdev->pci_info;
+	u32 target_rx_tag;
+
+	if (!info->check_rx_tag)
+		return 0;
+
+	/* valid range is 1 ~ 0x1FFF */
+	if (rx_ring->target_rx_tag == 0)
+		target_rx_tag = 1;
+	else
+		target_rx_tag = rx_ring->target_rx_tag;
+
+	if (rx_info->tag != target_rx_tag) {
+		rtw89_debug(rtwdev, RTW89_DBG_UNEXP, "mismatch RX tag 0x%x 0x%x\n",
+			    rx_info->tag, target_rx_tag);
+		return -EAGAIN;
+	}
 
 	return 0;
 }
 
+static
+int rtw89_pci_sync_skb_for_device_and_validate_rx_info(struct rtw89_dev *rtwdev,
+						       struct rtw89_pci_rx_ring *rx_ring,
+						       struct sk_buff *skb)
+{
+	struct rtw89_pci_rx_info *rx_info = RTW89_PCI_RX_SKB_CB(skb);
+	int rx_tag_retry = 100;
+	int ret;
+
+	do {
+		rtw89_pci_sync_skb_for_cpu(rtwdev, skb);
+		rtw89_pci_rxbd_info_update(rtwdev, skb);
+
+		ret = rtw89_pci_validate_rx_tag(rtwdev, rx_ring, skb);
+		if (ret != -EAGAIN)
+			break;
+	} while (rx_tag_retry--);
+
+	/* update target rx_tag for next RX */
+	rx_ring->target_rx_tag = rx_info->tag + 1;
+
+	return ret;
+}
+
 static void rtw89_pci_ctrl_txdma_ch_pcie(struct rtw89_dev *rtwdev, bool enable)
 {
 	const struct rtw89_pci_info *info = rtwdev->pci_info;
@@ -259,9 +310,8 @@
 
 	skb_idx = rtw89_pci_get_rx_skb_idx(rtwdev, bd_ring);
 	skb = rx_ring->buf[skb_idx];
-	rtw89_pci_sync_skb_for_cpu(rtwdev, skb);
 
-	ret = rtw89_pci_rxbd_info_update(rtwdev, skb);
+	ret = rtw89_pci_sync_skb_for_device_and_validate_rx_info(rtwdev, rx_ring, skb);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to update %d RXBD info: %d\n",
 			  bd_ring->wp, ret);
@@ -549,9 +599,8 @@
 
 	skb_idx = rtw89_pci_get_rx_skb_idx(rtwdev, bd_ring);
 	skb = rx_ring->buf[skb_idx];
-	rtw89_pci_sync_skb_for_cpu(rtwdev, skb);
 
-	ret = rtw89_pci_rxbd_info_update(rtwdev, skb);
+	ret = rtw89_pci_sync_skb_for_device_and_validate_rx_info(rtwdev, rx_ring, skb);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to update %d RXBD info: %d\n",
 			  bd_ring->wp, ret);
@@ -1043,7 +1092,8 @@
 
 	spin_lock_bh(&rtwpci->trx_lock);
 	cnt = rtw89_pci_get_avail_txbd_num(tx_ring);
-	cnt = min(cnt, wd_ring->curr_num);
+	if (txch != RTW89_TXCH_CH12)
+		cnt = min(cnt, wd_ring->curr_num);
 	spin_unlock_bh(&rtwpci->trx_lock);
 
 	return cnt;
@@ -1550,6 +1600,7 @@
 		bd_ring->rp = 0;
 		rx_ring->diliver_skb = NULL;
 		rx_ring->diliver_desc.ready = false;
+		rx_ring->target_rx_tag = 0;
 
 		rtw89_write16(rtwdev, addr_num, bd_ring->len);
 		rtw89_write32(rtwdev, addr_desa_l, bd_ring->dma);
@@ -2186,6 +2237,22 @@
 	return 0;
 }
 
+static void rtw89_pci_ber(struct rtw89_dev *rtwdev)
+{
+	u32 phy_offset;
+
+	if (!test_bit(RTW89_QUIRK_PCI_BER, rtwdev->quirks))
+		return;
+
+	phy_offset = R_RAC_DIRECT_OFFSET_G1;
+	rtw89_write16(rtwdev, phy_offset + RAC_ANA1E * RAC_MULT, RAC_ANA1E_G1_VAL);
+	rtw89_write16(rtwdev, phy_offset + RAC_ANA2E * RAC_MULT, RAC_ANA2E_VAL);
+
+	phy_offset = R_RAC_DIRECT_OFFSET_G2;
+	rtw89_write16(rtwdev, phy_offset + RAC_ANA1E * RAC_MULT, RAC_ANA1E_G2_VAL);
+	rtw89_write16(rtwdev, phy_offset + RAC_ANA2E * RAC_MULT, RAC_ANA2E_VAL);
+}
+
 static void rtw89_pci_rxdma_prefth(struct rtw89_dev *rtwdev)
 {
 	if (rtwdev->chip->chip_id != RTL8852A)
@@ -2583,6 +2650,7 @@
 	const struct rtw89_pci_info *info = rtwdev->pci_info;
 	int ret;
 
+	rtw89_pci_ber(rtwdev);
 	rtw89_pci_rxdma_prefth(rtwdev);
 	rtw89_pci_l1off_pwroff(rtwdev);
 	rtw89_pci_deglitch_setting(rtwdev);
@@ -3148,6 +3216,7 @@
 	rx_ring->buf_sz = buf_sz;
 	rx_ring->diliver_skb = NULL;
 	rx_ring->diliver_desc.ready = false;
+	rx_ring->target_rx_tag = 0;
 
 	for (i = 0; i < len; i++) {
 		skb = dev_alloc_skb(buf_sz);
@@ -4024,6 +4093,8 @@
 	rtwdev->hci.rpwm_addr = pci_info->rpwm_addr;
 	rtwdev->hci.cpwm_addr = pci_info->cpwm_addr;
 
+	rtw89_check_quirks(rtwdev, info->quirks);
+
 	SET_IEEE80211_DEV(rtwdev->hw, &pdev->dev);
 
 	ret = rtw89_core_init(rtwdev);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/pci.h
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/pci.h
@@ -26,11 +26,16 @@
 #define RAC_REG_FLD_0			0x1D
 #define BAC_AUTOK_N_MASK		GENMASK(3, 2)
 #define PCIE_AUTOK_4			0x3
+#define RAC_ANA1E			0x1E
+#define RAC_ANA1E_G1_VAL		0x66EA
+#define RAC_ANA1E_G2_VAL		0x6EEA
 #define RAC_ANA1F			0x1F
 #define RAC_ANA24			0x24
 #define B_AX_DEGLITCH			GENMASK(11, 8)
 #define RAC_ANA26			0x26
 #define B_AX_RXEN			GENMASK(15, 14)
+#define RAC_ANA2E			0x2E
+#define RAC_ANA2E_VAL			0xFFFE
 #define RAC_CTRL_PPR_V1			0x30
 #define B_AX_CLK_CALIB_EN		BIT(12)
 #define B_AX_CALIB_EN			BIT(13)
@@ -996,7 +1001,7 @@
 #define RTW89_PCI_TXWD_NUM_MAX		512
 #define RTW89_PCI_TXWD_PAGE_SIZE	128
 #define RTW89_PCI_ADDRINFO_MAX		4
-#define RTW89_PCI_RX_BUF_SIZE		11460
+#define RTW89_PCI_RX_BUF_SIZE		(11454 + 40) /* +40 for rtw89_rxdesc_long_v2 */
 
 #define RTW89_PCI_POLL_BDRAM_RST_CNT	100
 #define RTW89_PCI_MULTITAG		8
@@ -1234,6 +1239,7 @@
 	enum mac_ax_pcie_func_ctrl io_rcy_en;
 	enum mac_ax_io_rcy_tmr io_rcy_tmr;
 	bool rx_ring_eq_is_full;
+	bool check_rx_tag;
 
 	u32 init_cfg_reg;
 	u32 txhci_en_bit;
@@ -1276,7 +1282,7 @@
 
 struct rtw89_pci_rx_info {
 	dma_addr_t dma;
-	u32 fs:1, ls:1, tag:11, len:14;
+	u32 fs:1, ls:1, tag:13, len:14;
 };
 
 #define RTW89_PCI_TXBD_OPTION_LS	BIT(14)
@@ -1405,6 +1411,7 @@
 	u32 buf_sz;
 	struct sk_buff *diliver_skb;
 	struct rtw89_rx_desc_info diliver_desc;
+	u32 target_rx_tag:13;
 };
 
 struct rtw89_pci_isrs {
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/phy.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/phy.c
@@ -340,8 +340,8 @@
 		csi_mode = RTW89_RA_RPT_MODE_HT;
 		ra_mask |= ((u64)sta->deflink.ht_cap.mcs.rx_mask[3] << 48) |
 			   ((u64)sta->deflink.ht_cap.mcs.rx_mask[2] << 36) |
-			   (sta->deflink.ht_cap.mcs.rx_mask[1] << 24) |
-			   (sta->deflink.ht_cap.mcs.rx_mask[0] << 12);
+			   ((u64)sta->deflink.ht_cap.mcs.rx_mask[1] << 24) |
+			   ((u64)sta->deflink.ht_cap.mcs.rx_mask[0] << 12);
 		high_rate_masks = rtw89_ra_mask_ht_rates;
 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
 			stbc_en = 1;
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/ps.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/ps.c
@@ -54,7 +54,8 @@
 
 static void rtw89_ps_power_mode_change(struct rtw89_dev *rtwdev, bool enter)
 {
-	if (rtwdev->chip->low_power_hci_modes & BIT(rtwdev->ps_mode))
+	if (rtwdev->chip->low_power_hci_modes & BIT(rtwdev->ps_mode) &&
+	    !test_bit(RTW89_FLAG_WOWLAN, rtwdev->flags))
 		rtw89_ps_power_mode_change_with_hci(rtwdev, enter);
 	else
 		rtw89_mac_power_mode_change(rtwdev, enter);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/reg.h
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/reg.h
@@ -107,6 +107,15 @@
 #define B_AX_DBG_SEL0_16BIT BIT(11)
 #define B_AX_DBG_SEL0 GENMASK(7, 0)
 
+#define R_AX_GPIO_EXT_CTRL 0x0060
+#define B_AX_GPIO_MOD_15_TO_8_MASK GENMASK(31, 24)
+#define B_AX_GPIO_MOD_9 BIT(25)
+#define B_AX_GPIO_IO_SEL_15_TO_8_MASK GENMASK(23, 16)
+#define B_AX_GPIO_IO_SEL_9 BIT(17)
+#define B_AX_GPIO_OUT_15_TO_8_MASK GENMASK(15, 8)
+#define B_AX_GPIO_IN_15_TO_8_MASK GENMASK(7, 0)
+#define B_AX_GPIO_IN_9 BIT(1)
+
 #define R_AX_SYS_SDIO_CTRL 0x0070
 #define B_AX_PCIE_DIS_L2_CTRL_LDO_HCI BIT(15)
 #define B_AX_PCIE_DIS_WLSUS_AFT_PDN BIT(14)
@@ -264,6 +273,9 @@
 
 #define R_AX_GPIO0_7_FUNC_SEL 0x02D0
 
+#define R_AX_GPIO8_15_FUNC_SEL 0x02D4
+#define B_AX_PINMUX_GPIO9_FUNC_SEL_MASK GENMASK(7, 4)
+
 #define R_AX_EECS_EESK_FUNC_SEL 0x02D8
 #define B_AX_PINMUX_EESK_FUNC_SEL_MASK GENMASK(7, 4)
 
@@ -1891,7 +1903,6 @@
 				     B_AX_B0_IMR_ERR_USRCTL_NOINIT | \
 				     B_AX_B0_IMR_ERR_CMDPSR_1STCMDERR | \
 				     B_AX_B0_IMR_ERR_CMDPSR_CMDTYPE | \
-				     B_AX_B0_IMR_ERR_CMDPSR_FRZTO | \
 				     B_AX_B0_IMR_ERR_CMDPSR_TBLSZ | \
 				     B_AX_B0_IMR_ERR_MPDUINFO_RECFG | \
 				     B_AX_B0_IMR_ERR_MPDUIF_DATAERR | \
@@ -2435,6 +2446,10 @@
 #define B_AX_RTS_TXTIME_TH_MASK GENMASK(15, 8)
 #define B_AX_RTS_LEN_TH_MASK GENMASK(7, 0)
 
+#define R_AX_AGG_LEN_VHT_0 0xC618
+#define R_AX_AGG_LEN_VHT_0_C1 0xE618
+#define B_AX_AMPDU_MAX_LEN_VHT_MASK GENMASK(19, 0)
+
 #define S_AX_CTS2S_TH_SEC_256B 1
 #define R_AX_SIFS_SETTING 0xC624
 #define R_AX_SIFS_SETTING_C1 0xE624
@@ -3822,6 +3837,15 @@
 #define R_BE_EFUSE_CTRL_1_V1 0x0034
 #define B_BE_EF_DATA_MASK GENMASK(31, 0)
 
+#define R_BE_GPIO_EXT_CTRL 0x0060
+#define B_BE_GPIO_MOD_15_TO_8_MASK GENMASK(31, 24)
+#define B_BE_GPIO_MOD_9 BIT(25)
+#define B_BE_GPIO_IO_SEL_15_TO_8_MASK GENMASK(23, 16)
+#define B_BE_GPIO_IO_SEL_9 BIT(17)
+#define B_BE_GPIO_OUT_15_TO_8_MASK GENMASK(15, 8)
+#define B_BE_GPIO_IN_15_TO_8_MASK GENMASK(7, 0)
+#define B_BE_GPIO_IN_9 BIT(1)
+
 #define R_BE_WL_BT_PWR_CTRL 0x0068
 #define B_BE_ISO_BD2PP BIT(31)
 #define B_BE_LDOV12B_EN BIT(30)
@@ -4243,6 +4267,9 @@
 #define B_BE_REG_CK40M_EN BIT(1)
 #define B_BE_REG_CK640M_EN BIT(0)
 
+#define R_BE_GPIO8_15_FUNC_SEL 0x02D4
+#define B_BE_PINMUX_GPIO9_FUNC_SEL_MASK GENMASK(7, 4)
+
 #define R_BE_WLAN_XTAL_SI_CTRL 0x0270
 #define B_BE_WL_XTAL_SI_CMD_POLL BIT(31)
 #define B_BE_WL_XTAL_SI_CHIPID_MASK GENMASK(30, 28)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8851b.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8851b.c
@@ -181,6 +181,15 @@
 	.rsc = {R_AX_TRXPTCL_RRSR_CTL_0, B_AX_WMAC_RESP_RSC_MASK, 2},
 };
 
+static const struct rtw89_rfkill_regs rtw8851b_rfkill_regs = {
+	.pinmux = {R_AX_GPIO8_15_FUNC_SEL,
+		   B_AX_PINMUX_GPIO9_FUNC_SEL_MASK,
+		   0xf},
+	.mode = {R_AX_GPIO_EXT_CTRL + 2,
+		 (B_AX_GPIO_MOD_9 | B_AX_GPIO_IO_SEL_9) >> 16,
+		 0x0},
+};
+
 static const struct rtw89_dig_regs rtw8851b_dig_regs = {
 	.seg0_pd_reg = R_SEG0R_PD_V1,
 	.pd_lower_bound_mask = B_SEG0R_PD_LOWER_BOUND_MSK,
@@ -2274,6 +2283,7 @@
 	u8 wl_rfc_s1;
 	int ret;
 
+	rtw89_write32_clr(rtwdev, R_AX_WLRF_CTRL, B_AX_AFC_AFEDIG);
 	rtw89_write8_clr(rtwdev, R_AX_SYS_FUNC_EN,
 			 B_AX_FEN_BBRSTB | B_AX_FEN_BB_GLB_RSTN);
 
@@ -2459,6 +2469,8 @@
 	.rrsr_cfgs		= &rtw8851b_rrsr_cfgs,
 	.bss_clr_vld		= {R_BSS_CLR_MAP_V1, B_BSS_CLR_MAP_VLD0},
 	.bss_clr_map_reg	= R_BSS_CLR_MAP_V1,
+	.rfkill_init		= &rtw8851b_rfkill_regs,
+	.rfkill_get		= {R_AX_GPIO_EXT_CTRL, B_AX_GPIO_IN_9},
 	.dma_ch_mask		= BIT(RTW89_DMA_ACH4) | BIT(RTW89_DMA_ACH5) |
 				  BIT(RTW89_DMA_ACH6) | BIT(RTW89_DMA_ACH7) |
 				  BIT(RTW89_DMA_B1MG) | BIT(RTW89_DMA_B1HI),
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8851be.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8851be.c
@@ -25,6 +25,8 @@
 	.autok_en		= MAC_AX_PCIE_DISABLE,
 	.io_rcy_en		= MAC_AX_PCIE_DISABLE,
 	.io_rcy_tmr		= MAC_AX_IO_RCY_ANA_TMR_6MS,
+	.rx_ring_eq_is_full	= false,
+	.check_rx_tag		= false,
 
 	.init_cfg_reg		= R_AX_PCIE_INIT_CFG1,
 	.txhci_en_bit		= B_AX_TXHCI_EN,
@@ -61,6 +63,7 @@
 
 static const struct rtw89_driver_info rtw89_8851be_info = {
 	.chip = &rtw8851b_chip_info,
+	.quirks = NULL,
 	.bus = {
 		.pci = &rtw8851b_pci_info,
 	},
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8852a.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8852a.c
@@ -474,6 +474,15 @@
 	.rsc = {R_AX_TRXPTCL_RRSR_CTL_0, B_AX_WMAC_RESP_RSC_MASK, 2},
 };
 
+static const struct rtw89_rfkill_regs rtw8852a_rfkill_regs = {
+	.pinmux = {R_AX_GPIO8_15_FUNC_SEL,
+		   B_AX_PINMUX_GPIO9_FUNC_SEL_MASK,
+		   0xf},
+	.mode = {R_AX_GPIO_EXT_CTRL + 2,
+		 (B_AX_GPIO_MOD_9 | B_AX_GPIO_IO_SEL_9) >> 16,
+		 0x0},
+};
+
 static const struct rtw89_dig_regs rtw8852a_dig_regs = {
 	.seg0_pd_reg = R_SEG0R_PD,
 	.pd_lower_bound_mask = B_SEG0R_PD_LOWER_BOUND_MSK,
@@ -2196,6 +2205,8 @@
 	.rrsr_cfgs		= &rtw8852a_rrsr_cfgs,
 	.bss_clr_vld		= {R_BSS_CLR_MAP, B_BSS_CLR_MAP_VLD0},
 	.bss_clr_map_reg	= R_BSS_CLR_MAP,
+	.rfkill_init		= &rtw8852a_rfkill_regs,
+	.rfkill_get		= {R_AX_GPIO_EXT_CTRL, B_AX_GPIO_IN_9},
 	.dma_ch_mask		= 0,
 	.edcca_regs		= &rtw8852a_edcca_regs,
 #ifdef CONFIG_PM
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8852ae.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8852ae.c
@@ -26,6 +26,7 @@
 	.io_rcy_en		= MAC_AX_PCIE_DISABLE,
 	.io_rcy_tmr		= MAC_AX_IO_RCY_ANA_TMR_6MS,
 	.rx_ring_eq_is_full	= false,
+	.check_rx_tag		= false,
 
 	.init_cfg_reg		= R_AX_PCIE_INIT_CFG1,
 	.txhci_en_bit		= B_AX_TXHCI_EN,
@@ -60,6 +61,7 @@
 
 static const struct rtw89_driver_info rtw89_8852ae_info = {
 	.chip = &rtw8852a_chip_info,
+	.quirks = NULL,
 	.bus = {
 		.pci = &rtw8852a_pci_info,
 	},
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8852b.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8852b.c
@@ -306,6 +306,15 @@
 	.rsc = {R_AX_TRXPTCL_RRSR_CTL_0, B_AX_WMAC_RESP_RSC_MASK, 2},
 };
 
+static const struct rtw89_rfkill_regs rtw8852b_rfkill_regs = {
+	.pinmux = {R_AX_GPIO8_15_FUNC_SEL,
+		   B_AX_PINMUX_GPIO9_FUNC_SEL_MASK,
+		   0xf},
+	.mode = {R_AX_GPIO_EXT_CTRL + 2,
+		 (B_AX_GPIO_MOD_9 | B_AX_GPIO_IO_SEL_9) >> 16,
+		 0x0},
+};
+
 static const struct rtw89_dig_regs rtw8852b_dig_regs = {
 	.seg0_pd_reg = R_SEG0R_PD_V1,
 	.pd_lower_bound_mask = B_SEG0R_PD_LOWER_BOUND_MSK,
@@ -550,6 +559,7 @@
 		return ret;
 
 	rtw89_write32_set(rtwdev, R_AX_SYS_PW_CTRL, B_AX_EN_WLON);
+	rtw89_write32_clr(rtwdev, R_AX_WLRF_CTRL, B_AX_AFC_AFEDIG);
 	rtw89_write8_clr(rtwdev, R_AX_SYS_FUNC_EN, B_AX_FEN_BB_GLB_RSTN | B_AX_FEN_BBRSTB);
 	rtw89_write32_clr(rtwdev, R_AX_SYS_ADIE_PAD_PWR_CTRL, B_AX_SYM_PADPDN_WL_RFC_1P3);
 
@@ -2443,6 +2453,7 @@
 	u8 wl_rfc_s1;
 	int ret;
 
+	rtw89_write32_clr(rtwdev, R_AX_WLRF_CTRL, B_AX_AFC_AFEDIG);
 	rtw89_write8_clr(rtwdev, R_AX_SYS_FUNC_EN,
 			 B_AX_FEN_BBRSTB | B_AX_FEN_BB_GLB_RSTN);
 
@@ -2630,6 +2641,8 @@
 	.rrsr_cfgs		= &rtw8852b_rrsr_cfgs,
 	.bss_clr_vld		= {R_BSS_CLR_MAP_V1, B_BSS_CLR_MAP_VLD0},
 	.bss_clr_map_reg	= R_BSS_CLR_MAP_V1,
+	.rfkill_init		= &rtw8852b_rfkill_regs,
+	.rfkill_get		= {R_AX_GPIO_EXT_CTRL, B_AX_GPIO_IN_9},
 	.dma_ch_mask		= BIT(RTW89_DMA_ACH4) | BIT(RTW89_DMA_ACH5) |
 				  BIT(RTW89_DMA_ACH6) | BIT(RTW89_DMA_ACH7) |
 				  BIT(RTW89_DMA_B1MG) | BIT(RTW89_DMA_B1HI),
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c
@@ -20,7 +20,7 @@
 #define RTW8852B_RF_REL_VERSION 34
 #define RTW8852B_DPK_VER 0x0d
 #define RTW8852B_DPK_RF_PATH 2
-#define RTW8852B_DPK_KIP_REG_NUM 2
+#define RTW8852B_DPK_KIP_REG_NUM 3
 
 #define _TSSI_DE_MASK GENMASK(21, 12)
 #define ADDC_T_AVG 100
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8852be.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8852be.c
@@ -26,6 +26,7 @@
 	.io_rcy_en		= MAC_AX_PCIE_DISABLE,
 	.io_rcy_tmr		= MAC_AX_IO_RCY_ANA_TMR_6MS,
 	.rx_ring_eq_is_full	= false,
+	.check_rx_tag		= false,
 
 	.init_cfg_reg		= R_AX_PCIE_INIT_CFG1,
 	.txhci_en_bit		= B_AX_TXHCI_EN,
@@ -62,6 +63,7 @@
 
 static const struct rtw89_driver_info rtw89_8852be_info = {
 	.chip = &rtw8852b_chip_info,
+	.quirks = NULL,
 	.bus = {
 		.pci = &rtw8852b_pci_info,
 	},
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8852c.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8852c.c
@@ -143,6 +143,15 @@
 	.rsc = {R_AX_PTCL_RRSR1, B_AX_RSC_MASK, 2},
 };
 
+static const struct rtw89_rfkill_regs rtw8852c_rfkill_regs = {
+	.pinmux = {R_AX_GPIO8_15_FUNC_SEL,
+		   B_AX_PINMUX_GPIO9_FUNC_SEL_MASK,
+		   0xf},
+	.mode = {R_AX_GPIO_EXT_CTRL + 2,
+		 (B_AX_GPIO_MOD_9 | B_AX_GPIO_IO_SEL_9) >> 16,
+		 0x0},
+};
+
 static const struct rtw89_dig_regs rtw8852c_dig_regs = {
 	.seg0_pd_reg = R_SEG0R_PD,
 	.pd_lower_bound_mask = B_SEG0R_PD_LOWER_BOUND_MSK,
@@ -203,6 +212,9 @@
 	rtw89_write32_clr(rtwdev, R_AX_SYS_PW_CTRL, B_AX_APDM_HPDN);
 	rtw89_write32_clr(rtwdev, R_AX_SYS_PW_CTRL, B_AX_APFM_SWLPS);
 
+	rtw89_write32_mask(rtwdev, R_AX_SPS_DIG_ON_CTRL0,
+			   B_AX_OCP_L1_MASK, 0x7);
+
 	ret = read_poll_timeout(rtw89_read32, val32, val32 & B_AX_RDY_SYSPWR,
 				1000, 20000, false, rtwdev, R_AX_SYS_PW_CTRL);
 	if (ret)
@@ -266,7 +278,7 @@
 	ret = rtw89_mac_write_xtal_si(rtwdev, XTAL_SI_ANAPAR_WL, 0, XTAL_SI_SRAM2RFC);
 	if (ret)
 		return ret;
-	ret = rtw89_mac_write_xtal_si(rtwdev, XTAL_SI_XTAL_XMD_2, 0, XTAL_SI_LDO_LPS);
+	ret = rtw89_mac_write_xtal_si(rtwdev, XTAL_SI_XTAL_XMD_2, 0x10, XTAL_SI_LDO_LPS);
 	if (ret)
 		return ret;
 	ret = rtw89_mac_write_xtal_si(rtwdev, XTAL_SI_XTAL_XMD_4, 0, XTAL_SI_LPS_CAP);
@@ -338,6 +350,7 @@
 		return ret;
 
 	rtw89_write32_set(rtwdev, R_AX_SYS_PW_CTRL, B_AX_EN_WLON);
+	rtw89_write32_clr(rtwdev, R_AX_WLRF_CTRL, B_AX_AFC_AFEDIG);
 	rtw89_write8_clr(rtwdev, R_AX_SYS_FUNC_EN, B_AX_FEN_BB_GLB_RSTN | B_AX_FEN_BBRSTB);
 	rtw89_write32_clr(rtwdev, R_AX_SYS_ISO_CTRL_EXTEND,
 			  B_AX_R_SYM_FEN_WLBBGLB_1 | B_AX_R_SYM_FEN_WLBBFUN_1);
@@ -360,8 +373,11 @@
 	if (ret)
 		return ret;
 
-	rtw89_write32(rtwdev, R_AX_WLLPS_CTRL, 0x0001A0B0);
+	rtw89_write32(rtwdev, R_AX_WLLPS_CTRL, SW_LPS_OPTION);
 	rtw89_write32_set(rtwdev, R_AX_SYS_PW_CTRL, B_AX_XTAL_OFF_A_DIE);
+	rtw89_write32_set(rtwdev, R_AX_SYS_SWR_CTRL1, B_AX_SYM_CTRL_SPS_PWMFREQ);
+	rtw89_write32_mask(rtwdev, R_AX_SPS_DIG_ON_CTRL0,
+			   B_AX_REG_ZCDC_H_MASK, 0x3);
 	rtw89_write32_set(rtwdev, R_AX_SYS_PW_CTRL, B_AX_APFM_SWLPS);
 
 	return 0;
@@ -2790,6 +2806,7 @@
 
 static int rtw8852c_mac_disable_bb_rf(struct rtw89_dev *rtwdev)
 {
+	rtw89_write32_clr(rtwdev, R_AX_WLRF_CTRL, B_AX_AFC_AFEDIG);
 	rtw89_write8_clr(rtwdev, R_AX_SYS_FUNC_EN,
 			 B_AX_FEN_BBRSTB | B_AX_FEN_BB_GLB_RSTN);
 
@@ -2969,6 +2986,8 @@
 	.rrsr_cfgs		= &rtw8852c_rrsr_cfgs,
 	.bss_clr_vld		= {R_BSS_CLR_MAP, B_BSS_CLR_MAP_VLD0},
 	.bss_clr_map_reg	= R_BSS_CLR_MAP,
+	.rfkill_init		= &rtw8852c_rfkill_regs,
+	.rfkill_get		= {R_AX_GPIO_EXT_CTRL, B_AX_GPIO_IN_9},
 	.dma_ch_mask		= 0,
 	.edcca_regs		= &rtw8852c_edcca_regs,
 #ifdef CONFIG_PM
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8852ce.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8852ce.c
@@ -35,6 +35,7 @@
 	.io_rcy_en		= MAC_AX_PCIE_ENABLE,
 	.io_rcy_tmr		= MAC_AX_IO_RCY_ANA_TMR_6MS,
 	.rx_ring_eq_is_full	= false,
+	.check_rx_tag		= false,
 
 	.init_cfg_reg		= R_AX_HAXI_INIT_CFG1,
 	.txhci_en_bit		= B_AX_TXHCI_EN_V1,
@@ -67,8 +68,31 @@
 	.recognize_intrs	= rtw89_pci_recognize_intrs_v1,
 };
 
+static const struct dmi_system_id rtw8852c_pci_quirks[] = {
+	{
+		.ident = "Dell Inc. Vostro 16 5640",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 16 5640"),
+			DMI_MATCH(DMI_PRODUCT_SKU, "0CA0"),
+		},
+		.driver_data = (void *)RTW89_QUIRK_PCI_BER,
+	},
+	{
+		.ident = "Dell Inc. Inspiron 16 5640",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 16 5640"),
+			DMI_MATCH(DMI_PRODUCT_SKU, "0C9F"),
+		},
+		.driver_data = (void *)RTW89_QUIRK_PCI_BER,
+	},
+	{},
+};
+
 static const struct rtw89_driver_info rtw89_8852ce_info = {
 	.chip = &rtw8852c_chip_info,
+	.quirks = rtw8852c_pci_quirks,
 	.bus = {
 		.pci = &rtw8852c_pci_info,
 	},
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8922a.c
@@ -119,6 +119,15 @@
 	.n_regs = ARRAY_SIZE(rtw8922a_imr_cmac_regs),
 };
 
+static const struct rtw89_rfkill_regs rtw8922a_rfkill_regs = {
+	.pinmux = {R_BE_GPIO8_15_FUNC_SEL,
+		   B_BE_PINMUX_GPIO9_FUNC_SEL_MASK,
+		   0xf},
+	.mode = {R_BE_GPIO_EXT_CTRL + 2,
+		 (B_BE_GPIO_MOD_9 | B_BE_GPIO_IO_SEL_9) >> 16,
+		 0x0},
+};
+
 static const struct rtw89_efuse_block_cfg rtw8922a_efuse_blocks[] = {
 	[RTW89_EFUSE_BLOCK_SYS]			= {.offset = 0x00000, .size = 0x310},
 	[RTW89_EFUSE_BLOCK_RF]			= {.offset = 0x10000, .size = 0x240},
@@ -696,6 +705,8 @@
 	.imr_cmac_table		= &rtw8922a_imr_cmac_table,
 	.bss_clr_vld		= {R_BSS_CLR_VLD_V2, B_BSS_CLR_VLD0_V2},
 	.bss_clr_map_reg	= R_BSS_CLR_MAP_V2,
+	.rfkill_init		= &rtw8922a_rfkill_regs,
+	.rfkill_get		= {R_BE_GPIO_EXT_CTRL, B_BE_GPIO_IN_9},
 	.dma_ch_mask		= 0,
 #ifdef CONFIG_PM
 	.wowlan_stub		= &rtw_wowlan_stub_8922a,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/rtw8922ae.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/rtw8922ae.c
@@ -26,6 +26,7 @@
 	.io_rcy_en		= MAC_AX_PCIE_ENABLE,
 	.io_rcy_tmr		= MAC_AX_IO_RCY_ANA_TMR_DEF,
 	.rx_ring_eq_is_full	= true,
+	.check_rx_tag		= true,
 
 	.init_cfg_reg		= R_BE_HAXI_INIT_CFG1,
 	.txhci_en_bit		= B_BE_TXDMA_EN,
@@ -60,6 +61,7 @@
 
 static const struct rtw89_driver_info rtw89_8922ae_info = {
 	.chip = &rtw8922a_chip_info,
+	.quirks = NULL,
 	.bus = {
 		.pci = &rtw8922a_pci_info,
 	},
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/ser.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/ser.c
@@ -308,9 +308,13 @@
 
 static void ser_sta_deinit_cam_iter(void *data, struct ieee80211_sta *sta)
 {
-	struct rtw89_vif *rtwvif = (struct rtw89_vif *)data;
-	struct rtw89_dev *rtwdev = rtwvif->rtwdev;
+	struct rtw89_vif *target_rtwvif = (struct rtw89_vif *)data;
 	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
+	struct rtw89_vif *rtwvif = rtwsta->rtwvif;
+	struct rtw89_dev *rtwdev = rtwvif->rtwdev;
+
+	if (rtwvif != target_rtwvif)
+		return;
 
 	if (rtwvif->net_type == RTW89_NET_TYPE_AP_MODE || sta->tdls)
 		rtw89_cam_deinit_addr_cam(rtwdev, &rtwsta->addr_cam);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/util.h
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/util.h
@@ -14,6 +14,24 @@
 #define rtw89_for_each_rtwvif(rtwdev, rtwvif)				       \
 	list_for_each_entry(rtwvif, &(rtwdev)->rtwvifs_list, list)
 
+/* Before adding rtwvif to list, we need to check if it already exist, beacase
+ * in some case such as SER L2 happen during WoWLAN flow, calling reconfig
+ * twice cause the list to be added twice.
+ */
+static inline bool rtw89_rtwvif_in_list(struct rtw89_dev *rtwdev,
+					struct rtw89_vif *new)
+{
+	struct rtw89_vif *rtwvif;
+
+	lockdep_assert_held(&rtwdev->mutex);
+
+	rtw89_for_each_rtwvif(rtwdev, rtwvif)
+		if (rtwvif == new)
+			return true;
+
+	return false;
+}
+
 /* The result of negative dividend and positive divisor is undefined, but it
  * should be one case of round-down or round-up. So, make it round-down if the
  * result is round-up.
--- linux-qcom-6.8.0.orig/drivers/net/wireless/realtek/rtw89/wow.c
+++ linux-qcom-6.8.0/drivers/net/wireless/realtek/rtw89/wow.c
@@ -489,14 +489,17 @@
 	struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
 	struct ieee80211_vif *wow_vif = rtw_wow->wow_vif;
 	struct rtw89_vif *rtwvif = (struct rtw89_vif *)wow_vif->drv_priv;
+	enum rtw89_core_chip_id chip_id = rtwdev->chip->chip_id;
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	bool include_bb = !!chip->bbmcu_nr;
+	bool disable_intr_for_dlfw = false;
 	struct ieee80211_sta *wow_sta;
 	struct rtw89_sta *rtwsta = NULL;
 	bool is_conn = true;
 	int ret;
 
-	rtw89_hci_disable_intr(rtwdev);
+	if (chip_id == RTL8852C || chip_id == RTL8922A)
+		disable_intr_for_dlfw = true;
 
 	wow_sta = ieee80211_find_sta(wow_vif, rtwvif->bssid);
 	if (wow_sta)
@@ -504,12 +507,18 @@
 	else
 		is_conn = false;
 
+	if (disable_intr_for_dlfw)
+		rtw89_hci_disable_intr(rtwdev);
+
 	ret = rtw89_fw_download(rtwdev, fw_type, include_bb);
 	if (ret) {
 		rtw89_warn(rtwdev, "download fw failed\n");
 		return ret;
 	}
 
+	if (disable_intr_for_dlfw)
+		rtw89_hci_enable_intr(rtwdev);
+
 	rtw89_phy_init_rf_reg(rtwdev, true);
 
 	ret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif, rtwsta,
@@ -552,7 +561,6 @@
 	}
 
 	rtw89_mac_hw_mgnt_sec(rtwdev, wow);
-	rtw89_hci_enable_intr(rtwdev);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/net/wireless/silabs/wfx/main.c
+++ linux-qcom-6.8.0/drivers/net/wireless/silabs/wfx/main.c
@@ -480,10 +480,23 @@
 {
 	int ret = 0;
 
-	if (IS_ENABLED(CONFIG_SPI))
+	if (IS_ENABLED(CONFIG_SPI)) {
 		ret = spi_register_driver(&wfx_spi_driver);
-	if (IS_ENABLED(CONFIG_MMC) && !ret)
+		if (ret)
+			goto out;
+	}
+	if (IS_ENABLED(CONFIG_MMC)) {
 		ret = sdio_register_driver(&wfx_sdio_driver);
+		if (ret)
+			goto unregister_spi;
+	}
+
+	return 0;
+
+unregister_spi:
+	if (IS_ENABLED(CONFIG_SPI))
+		spi_unregister_driver(&wfx_spi_driver);
+out:
 	return ret;
 }
 module_init(wfx_core_init);
--- linux-qcom-6.8.0.orig/drivers/net/wireless/silabs/wfx/sta.c
+++ linux-qcom-6.8.0/drivers/net/wireless/silabs/wfx/sta.c
@@ -344,6 +344,7 @@
 	const int pairwise_cipher_suite_count_offset = 8 / sizeof(u16);
 	const int pairwise_cipher_suite_size = 4 / sizeof(u16);
 	const int akm_suite_size = 4 / sizeof(u16);
+	int ret = -EINVAL;
 	const u16 *ptr;
 
 	if (unlikely(!skb))
@@ -351,23 +352,30 @@
 
 	ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset,
 				      skb->len - ieoffset);
-	if (unlikely(!ptr))
-		return -EINVAL;
+	if (!ptr) {
+		/* No RSN IE is fine in open networks */
+		ret = 0;
+		goto free_skb;
+	}
 
 	ptr += pairwise_cipher_suite_count_offset;
 	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
-		return -EINVAL;
+		goto free_skb;
 
 	ptr += 1 + pairwise_cipher_suite_size * *ptr;
 	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
-		return -EINVAL;
+		goto free_skb;
 
 	ptr += 1 + akm_suite_size * *ptr;
 	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
-		return -EINVAL;
+		goto free_skb;
 
 	wfx_hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6));
-	return 0;
+	ret = 0;
+
+free_skb:
+	dev_kfree_skb(skb);
+	return ret;
 }
 
 int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--- linux-qcom-6.8.0.orig/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ linux-qcom-6.8.0/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -751,7 +751,7 @@
 };
 
 struct hwsim_radiotap_hdr {
-	struct ieee80211_radiotap_header hdr;
+	struct ieee80211_radiotap_header_fixed hdr;
 	__le64 rt_tsft;
 	u8 rt_flags;
 	u8 rt_rate;
@@ -760,7 +760,7 @@
 } __packed;
 
 struct hwsim_radiotap_ack_hdr {
-	struct ieee80211_radiotap_header hdr;
+	struct ieee80211_radiotap_header_fixed hdr;
 	u8 rt_flags;
 	u8 pad;
 	__le16 rt_channel;
@@ -3818,7 +3818,7 @@
 	}
 
 	nla_for_each_nested(peer, peers, rem) {
-		struct cfg80211_pmsr_result result;
+		struct cfg80211_pmsr_result result = {};
 
 		err = mac80211_hwsim_parse_pmsr_result(peer, &result, info);
 		if (err)
--- linux-qcom-6.8.0.orig/drivers/net/wireless/virtual/virt_wifi.c
+++ linux-qcom-6.8.0/drivers/net/wireless/virtual/virt_wifi.c
@@ -136,6 +136,9 @@
 /* Assigned at module init. Guaranteed locally-administered and unicast. */
 static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {};
 
+#define VIRT_WIFI_SSID "VirtWifi"
+#define VIRT_WIFI_SSID_LEN 8
+
 static void virt_wifi_inform_bss(struct wiphy *wiphy)
 {
 	u64 tsf = div_u64(ktime_get_boottime_ns(), 1000);
@@ -146,8 +149,8 @@
 		u8 ssid[8];
 	} __packed ssid = {
 		.tag = WLAN_EID_SSID,
-		.len = 8,
-		.ssid = "VirtWifi",
+		.len = VIRT_WIFI_SSID_LEN,
+		.ssid = VIRT_WIFI_SSID,
 	};
 
 	informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz,
@@ -213,6 +216,8 @@
 	struct net_device *upperdev;
 	u32 tx_packets;
 	u32 tx_failed;
+	u32 connect_requested_ssid_len;
+	u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN];
 	u8 connect_requested_bss[ETH_ALEN];
 	bool is_up;
 	bool is_connected;
@@ -229,6 +234,12 @@
 	if (priv->being_deleted || !priv->is_up)
 		return -EBUSY;
 
+	if (!sme->ssid)
+		return -EINVAL;
+
+	priv->connect_requested_ssid_len = sme->ssid_len;
+	memcpy(priv->connect_requested_ssid, sme->ssid, sme->ssid_len);
+
 	could_schedule = schedule_delayed_work(&priv->connect, HZ * 2);
 	if (!could_schedule)
 		return -EBUSY;
@@ -252,12 +263,15 @@
 		container_of(work, struct virt_wifi_netdev_priv, connect.work);
 	u8 *requested_bss = priv->connect_requested_bss;
 	bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid);
+	bool right_ssid = priv->connect_requested_ssid_len == VIRT_WIFI_SSID_LEN &&
+			  !memcmp(priv->connect_requested_ssid, VIRT_WIFI_SSID,
+				  priv->connect_requested_ssid_len);
 	u16 status = WLAN_STATUS_SUCCESS;
 
 	if (is_zero_ether_addr(requested_bss))
 		requested_bss = NULL;
 
-	if (!priv->is_up || (requested_bss && !right_addr))
+	if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid)
 		status = WLAN_STATUS_UNSPECIFIED_FAILURE;
 	else
 		priv->is_connected = true;
--- linux-qcom-6.8.0.orig/drivers/net/wwan/iosm/iosm_ipc_devlink.c
+++ linux-qcom-6.8.0/drivers/net/wwan/iosm/iosm_ipc_devlink.c
@@ -210,7 +210,7 @@
 			rc = PTR_ERR(devlink->cd_regions[i]);
 			dev_err(devlink->dev, "Devlink region fail,err %d", rc);
 			/* Delete previously created regions */
-			for ( ; i >= 0; i--)
+			for (i--; i >= 0; i--)
 				devlink_region_destroy(devlink->cd_regions[i]);
 			goto region_create_fail;
 		}
--- linux-qcom-6.8.0.orig/drivers/net/wwan/iosm/iosm_ipc_mmio.c
+++ linux-qcom-6.8.0/drivers/net/wwan/iosm/iosm_ipc_mmio.c
@@ -104,7 +104,7 @@
 			break;
 
 		msleep(20);
-	} while (retries-- > 0);
+	} while (--retries > 0);
 
 	if (!retries) {
 		dev_err(ipc_mmio->dev, "invalid exec stage %X", stage);
--- linux-qcom-6.8.0.orig/drivers/net/wwan/qcom_bam_dmux.c
+++ linux-qcom-6.8.0/drivers/net/wwan/qcom_bam_dmux.c
@@ -823,17 +823,17 @@
 	ret = devm_request_threaded_irq(dev, pc_ack_irq, NULL, bam_dmux_pc_ack_irq,
 					IRQF_ONESHOT, NULL, dmux);
 	if (ret)
-		return ret;
+		goto err_disable_pm;
 
 	ret = devm_request_threaded_irq(dev, dmux->pc_irq, NULL, bam_dmux_pc_irq,
 					IRQF_ONESHOT, NULL, dmux);
 	if (ret)
-		return ret;
+		goto err_disable_pm;
 
 	ret = irq_get_irqchip_state(dmux->pc_irq, IRQCHIP_STATE_LINE_LEVEL,
 				    &dmux->pc_state);
 	if (ret)
-		return ret;
+		goto err_disable_pm;
 
 	/* Check if remote finished initialization before us */
 	if (dmux->pc_state) {
@@ -844,6 +844,11 @@
 	}
 
 	return 0;
+
+err_disable_pm:
+	pm_runtime_disable(dev);
+	pm_runtime_dont_use_autosuspend(dev);
+	return ret;
 }
 
 static void bam_dmux_remove(struct platform_device *pdev)
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_cldma.c
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_cldma.c
@@ -106,7 +106,7 @@
 {
 	u32 offset = REG_CLDMA_UL_START_ADDRL_0 + qno * ADDR_SIZE;
 
-	return ioread64(hw_info->ap_pdn_base + offset);
+	return ioread64_lo_hi(hw_info->ap_pdn_base + offset);
 }
 
 void t7xx_cldma_hw_set_start_addr(struct t7xx_cldma_hw *hw_info, unsigned int qno, u64 address,
@@ -117,7 +117,7 @@
 
 	reg = tx_rx == MTK_RX ? hw_info->ap_ao_base + REG_CLDMA_DL_START_ADDRL_0 :
 				hw_info->ap_pdn_base + REG_CLDMA_UL_START_ADDRL_0;
-	iowrite64(address, reg + offset);
+	iowrite64_lo_hi(address, reg + offset);
 }
 
 void t7xx_cldma_hw_resume_queue(struct t7xx_cldma_hw *hw_info, unsigned int qno,
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_hif_cldma.c
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_hif_cldma.c
@@ -57,8 +57,6 @@
 #define CHECK_Q_STOP_TIMEOUT_US		1000000
 #define CHECK_Q_STOP_STEP_US		10000
 
-#define CLDMA_JUMBO_BUFF_SZ		(63 * 1024 + sizeof(struct ccci_header))
-
 static void md_cd_queue_struct_reset(struct cldma_queue *queue, struct cldma_ctrl *md_ctrl,
 				     enum mtk_txrx tx_rx, unsigned int index)
 {
@@ -139,8 +137,9 @@
 				return -ENODEV;
 			}
 
-			gpd_addr = ioread64(hw_info->ap_pdn_base + REG_CLDMA_DL_CURRENT_ADDRL_0 +
-					    queue->index * sizeof(u64));
+			gpd_addr = ioread64_lo_hi(hw_info->ap_pdn_base +
+						  REG_CLDMA_DL_CURRENT_ADDRL_0 +
+						  queue->index * sizeof(u64));
 			if (req->gpd_addr == gpd_addr || hwo_polling_count++ >= 100)
 				return 0;
 
@@ -161,7 +160,7 @@
 		skb_reset_tail_pointer(skb);
 		skb_put(skb, le16_to_cpu(gpd->data_buff_len));
 
-		ret = md_ctrl->recv_skb(queue, skb);
+		ret = queue->recv_skb(queue, skb);
 		/* Break processing, will try again later */
 		if (ret < 0)
 			return ret;
@@ -318,8 +317,8 @@
 		struct t7xx_cldma_hw *hw_info = &md_ctrl->hw_info;
 
 		/* Check current processing TGPD, 64-bit address is in a table by Q index */
-		ul_curr_addr = ioread64(hw_info->ap_pdn_base + REG_CLDMA_UL_CURRENT_ADDRL_0 +
-					queue->index * sizeof(u64));
+		ul_curr_addr = ioread64_lo_hi(hw_info->ap_pdn_base + REG_CLDMA_UL_CURRENT_ADDRL_0 +
+					      queue->index * sizeof(u64));
 		if (req->gpd_addr != ul_curr_addr) {
 			spin_unlock_irqrestore(&md_ctrl->cldma_lock, flags);
 			dev_err(md_ctrl->dev, "CLDMA%d queue %d is not empty\n",
@@ -897,13 +896,13 @@
 
 /**
  * t7xx_cldma_set_recv_skb() - Set the callback to handle RX packets.
- * @md_ctrl: CLDMA context structure.
+ * @queue: CLDMA queue.
  * @recv_skb: Receiving skb callback.
  */
-void t7xx_cldma_set_recv_skb(struct cldma_ctrl *md_ctrl,
+void t7xx_cldma_set_recv_skb(struct cldma_queue *queue,
 			     int (*recv_skb)(struct cldma_queue *queue, struct sk_buff *skb))
 {
-	md_ctrl->recv_skb = recv_skb;
+	queue->recv_skb = recv_skb;
 }
 
 /**
@@ -993,6 +992,28 @@
 	return ret;
 }
 
+static void t7xx_cldma_adjust_config(struct cldma_ctrl *md_ctrl, enum cldma_cfg cfg_id)
+{
+	int qno;
+
+	for (qno = 0; qno < CLDMA_RXQ_NUM; qno++) {
+		md_ctrl->rx_ring[qno].pkt_size = CLDMA_SHARED_Q_BUFF_SZ;
+		t7xx_cldma_set_recv_skb(&md_ctrl->rxq[qno], t7xx_port_proxy_recv_skb);
+	}
+
+	md_ctrl->rx_ring[CLDMA_RXQ_NUM - 1].pkt_size = CLDMA_JUMBO_BUFF_SZ;
+
+	for (qno = 0; qno < CLDMA_TXQ_NUM; qno++)
+		md_ctrl->tx_ring[qno].pkt_size = CLDMA_SHARED_Q_BUFF_SZ;
+
+	if (cfg_id == CLDMA_DEDICATED_Q_CFG) {
+		md_ctrl->tx_ring[CLDMA_Q_IDX_DUMP].pkt_size = CLDMA_DEDICATED_Q_BUFF_SZ;
+		md_ctrl->rx_ring[CLDMA_Q_IDX_DUMP].pkt_size = CLDMA_DEDICATED_Q_BUFF_SZ;
+		t7xx_cldma_set_recv_skb(&md_ctrl->rxq[CLDMA_Q_IDX_DUMP],
+					t7xx_port_proxy_recv_skb_from_dedicated_queue);
+	}
+}
+
 static int t7xx_cldma_late_init(struct cldma_ctrl *md_ctrl)
 {
 	char dma_pool_name[32];
@@ -1018,16 +1039,9 @@
 			dev_err(md_ctrl->dev, "control TX ring init fail\n");
 			goto err_free_tx_ring;
 		}
-
-		md_ctrl->tx_ring[i].pkt_size = CLDMA_MTU;
 	}
 
 	for (j = 0; j < CLDMA_RXQ_NUM; j++) {
-		md_ctrl->rx_ring[j].pkt_size = CLDMA_MTU;
-
-		if (j == CLDMA_RXQ_NUM - 1)
-			md_ctrl->rx_ring[j].pkt_size = CLDMA_JUMBO_BUFF_SZ;
-
 		ret = t7xx_cldma_rx_ring_init(md_ctrl, &md_ctrl->rx_ring[j]);
 		if (ret) {
 			dev_err(md_ctrl->dev, "Control RX ring init fail\n");
@@ -1094,6 +1108,7 @@
 {
 	struct device *dev = &t7xx_dev->pdev->dev;
 	struct cldma_ctrl *md_ctrl;
+	int qno;
 
 	md_ctrl = devm_kzalloc(dev, sizeof(*md_ctrl), GFP_KERNEL);
 	if (!md_ctrl)
@@ -1102,7 +1117,9 @@
 	md_ctrl->t7xx_dev = t7xx_dev;
 	md_ctrl->dev = dev;
 	md_ctrl->hif_id = hif_id;
-	md_ctrl->recv_skb = t7xx_cldma_default_recv_skb;
+	for (qno = 0; qno < CLDMA_RXQ_NUM; qno++)
+		md_ctrl->rxq[qno].recv_skb = t7xx_cldma_default_recv_skb;
+
 	t7xx_hw_info_init(md_ctrl);
 	t7xx_dev->md->md_ctrl[hif_id] = md_ctrl;
 	return 0;
@@ -1332,9 +1349,10 @@
 	return -ENOMEM;
 }
 
-void t7xx_cldma_switch_cfg(struct cldma_ctrl *md_ctrl)
+void t7xx_cldma_switch_cfg(struct cldma_ctrl *md_ctrl, enum cldma_cfg cfg_id)
 {
 	t7xx_cldma_late_release(md_ctrl);
+	t7xx_cldma_adjust_config(md_ctrl, cfg_id);
 	t7xx_cldma_late_init(md_ctrl);
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_hif_cldma.h
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_hif_cldma.h
@@ -31,6 +31,10 @@
 #include "t7xx_cldma.h"
 #include "t7xx_pci.h"
 
+#define CLDMA_JUMBO_BUFF_SZ		(63 * 1024 + sizeof(struct ccci_header))
+#define CLDMA_SHARED_Q_BUFF_SZ		3584
+#define CLDMA_DEDICATED_Q_BUFF_SZ	2048
+
 /**
  * enum cldma_id - Identifiers for CLDMA HW units.
  * @CLDMA_ID_MD: Modem control channel.
@@ -55,6 +59,11 @@
 	__le16 not_used2;
 };
 
+enum cldma_cfg {
+	CLDMA_SHARED_Q_CFG,
+	CLDMA_DEDICATED_Q_CFG,
+};
+
 struct cldma_request {
 	struct cldma_gpd *gpd;	/* Virtual address for CPU */
 	dma_addr_t gpd_addr;	/* Physical address for DMA */
@@ -82,6 +91,7 @@
 	wait_queue_head_t req_wq;	/* Only for TX */
 	struct workqueue_struct *worker;
 	struct work_struct cldma_work;
+	int (*recv_skb)(struct cldma_queue *queue, struct sk_buff *skb);
 };
 
 struct cldma_ctrl {
@@ -101,24 +111,22 @@
 	struct md_pm_entity *pm_entity;
 	struct t7xx_cldma_hw hw_info;
 	bool is_late_init;
-	int (*recv_skb)(struct cldma_queue *queue, struct sk_buff *skb);
 };
 
+#define CLDMA_Q_IDX_DUMP	1
 #define GPD_FLAGS_HWO		BIT(0)
 #define GPD_FLAGS_IOC		BIT(7)
 #define GPD_DMAPOOL_ALIGN	16
 
-#define CLDMA_MTU		3584	/* 3.5kB */
-
 int t7xx_cldma_alloc(enum cldma_id hif_id, struct t7xx_pci_dev *t7xx_dev);
 void t7xx_cldma_hif_hw_init(struct cldma_ctrl *md_ctrl);
 int t7xx_cldma_init(struct cldma_ctrl *md_ctrl);
 void t7xx_cldma_exit(struct cldma_ctrl *md_ctrl);
-void t7xx_cldma_switch_cfg(struct cldma_ctrl *md_ctrl);
+void t7xx_cldma_switch_cfg(struct cldma_ctrl *md_ctrl, enum cldma_cfg cfg_id);
 void t7xx_cldma_start(struct cldma_ctrl *md_ctrl);
 int t7xx_cldma_stop(struct cldma_ctrl *md_ctrl);
 void t7xx_cldma_reset(struct cldma_ctrl *md_ctrl);
-void t7xx_cldma_set_recv_skb(struct cldma_ctrl *md_ctrl,
+void t7xx_cldma_set_recv_skb(struct cldma_queue *queue,
 			     int (*recv_skb)(struct cldma_queue *queue, struct sk_buff *skb));
 int t7xx_cldma_send_skb(struct cldma_ctrl *md_ctrl, int qno, struct sk_buff *skb);
 void t7xx_cldma_stop_all_qs(struct cldma_ctrl *md_ctrl, enum mtk_txrx tx_rx);
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c
@@ -226,7 +226,7 @@
 	return 0;
 
 err_unmap_skbs:
-	while (--i > 0)
+	while (i--)
 		t7xx_unmap_bat_skb(dpmaif_ctrl->dev, bat_req->bat_skb, i);
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_modem_ops.c
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_modem_ops.c
@@ -177,6 +177,11 @@
 	return t7xx_acpi_reset(t7xx_dev, "_RST");
 }
 
+int t7xx_acpi_pldr_func(struct t7xx_pci_dev *t7xx_dev)
+{
+	return t7xx_acpi_reset(t7xx_dev, "MRST._RST");
+}
+
 static void t7xx_reset_device_via_pmic(struct t7xx_pci_dev *t7xx_dev)
 {
 	u32 val;
@@ -192,6 +197,7 @@
 {
 	struct t7xx_pci_dev *t7xx_dev = data;
 
+	t7xx_mode_update(t7xx_dev, T7XX_RESET);
 	msleep(RGU_RESET_DELAY_MS);
 	t7xx_reset_device_via_pmic(t7xx_dev);
 	return IRQ_HANDLED;
@@ -529,7 +535,7 @@
 
 	/* Clear the HS2 EXIT event appended in core_reset() */
 	t7xx_fsm_clr_event(ctl, FSM_EVENT_MD_HS2_EXIT);
-	t7xx_cldma_switch_cfg(md->md_ctrl[CLDMA_ID_MD]);
+	t7xx_cldma_switch_cfg(md->md_ctrl[CLDMA_ID_MD], CLDMA_SHARED_Q_CFG);
 	t7xx_cldma_start(md->md_ctrl[CLDMA_ID_MD]);
 	t7xx_fsm_broadcast_state(ctl, MD_STATE_WAITING_FOR_HS2);
 	md->core_md.handshake_ongoing = true;
@@ -544,7 +550,7 @@
 	 /* Clear the HS2 EXIT event appended in t7xx_core_reset(). */
 	t7xx_fsm_clr_event(ctl, FSM_EVENT_AP_HS2_EXIT);
 	t7xx_cldma_stop(md->md_ctrl[CLDMA_ID_AP]);
-	t7xx_cldma_switch_cfg(md->md_ctrl[CLDMA_ID_AP]);
+	t7xx_cldma_switch_cfg(md->md_ctrl[CLDMA_ID_AP], CLDMA_SHARED_Q_CFG);
 	t7xx_cldma_start(md->md_ctrl[CLDMA_ID_AP]);
 	md->core_ap.handshake_ongoing = true;
 	t7xx_core_hk_handler(md, &md->core_ap, ctl, FSM_EVENT_AP_HS2, FSM_EVENT_AP_HS2_EXIT);
@@ -758,6 +764,7 @@
 
 void t7xx_md_exit(struct t7xx_pci_dev *t7xx_dev)
 {
+	enum t7xx_mode mode = READ_ONCE(t7xx_dev->mode);
 	struct t7xx_modem *md = t7xx_dev->md;
 
 	t7xx_pcie_mac_clear_int(t7xx_dev, SAP_RGU_INT);
@@ -765,7 +772,8 @@
 	if (!md->md_init_finish)
 		return;
 
-	t7xx_fsm_append_cmd(md->fsm_ctl, FSM_CMD_PRE_STOP, FSM_CMD_FLAG_WAIT_FOR_COMPLETION);
+	if (mode != T7XX_RESET && mode != T7XX_UNKNOWN)
+		t7xx_fsm_append_cmd(md->fsm_ctl, FSM_CMD_PRE_STOP, FSM_CMD_FLAG_WAIT_FOR_COMPLETION);
 	t7xx_port_proxy_uninit(md->port_prox);
 	t7xx_cldma_exit(md->md_ctrl[CLDMA_ID_AP]);
 	t7xx_cldma_exit(md->md_ctrl[CLDMA_ID_MD]);
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_modem_ops.h
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_modem_ops.h
@@ -85,6 +85,7 @@
 void t7xx_md_exit(struct t7xx_pci_dev *t7xx_dev);
 void t7xx_clear_rgu_irq(struct t7xx_pci_dev *t7xx_dev);
 int t7xx_acpi_fldr_func(struct t7xx_pci_dev *t7xx_dev);
+int t7xx_acpi_pldr_func(struct t7xx_pci_dev *t7xx_dev);
 int t7xx_pci_mhccif_isr(struct t7xx_pci_dev *t7xx_dev);
 
 #endif	/* __T7XX_MODEM_OPS_H__ */
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_pci.c
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_pci.c
@@ -52,6 +52,81 @@
 #define PM_RESOURCE_POLL_TIMEOUT_US	10000
 #define PM_RESOURCE_POLL_STEP_US	100
 
+static const char * const t7xx_mode_names[] = {
+	[T7XX_UNKNOWN] = "unknown",
+	[T7XX_READY] = "ready",
+	[T7XX_RESET] = "reset",
+	[T7XX_FASTBOOT_SWITCHING] = "fastboot_switching",
+	[T7XX_FASTBOOT_DOWNLOAD] = "fastboot_download",
+	[T7XX_FASTBOOT_DUMP] = "fastboot_dump",
+};
+
+static_assert(ARRAY_SIZE(t7xx_mode_names) == T7XX_MODE_LAST);
+
+static ssize_t t7xx_mode_store(struct device *dev,
+			       struct device_attribute *attr,
+			       const char *buf, size_t count)
+{
+	struct t7xx_pci_dev *t7xx_dev;
+	struct pci_dev *pdev;
+	int index = 0;
+
+	pdev = to_pci_dev(dev);
+	t7xx_dev = pci_get_drvdata(pdev);
+	if (!t7xx_dev)
+		return -ENODEV;
+
+	index = sysfs_match_string(t7xx_mode_names, buf);
+	if (index == T7XX_FASTBOOT_SWITCHING) {
+		WRITE_ONCE(t7xx_dev->mode, T7XX_FASTBOOT_SWITCHING);
+	} else if (index == T7XX_RESET) {
+		WRITE_ONCE(t7xx_dev->mode, T7XX_RESET);
+		t7xx_acpi_pldr_func(t7xx_dev);
+	}
+
+	return count;
+};
+
+static ssize_t t7xx_mode_show(struct device *dev,
+			      struct device_attribute *attr,
+			      char *buf)
+{
+	enum t7xx_mode mode = T7XX_UNKNOWN;
+	struct t7xx_pci_dev *t7xx_dev;
+	struct pci_dev *pdev;
+
+	pdev = to_pci_dev(dev);
+	t7xx_dev = pci_get_drvdata(pdev);
+	if (!t7xx_dev)
+		return -ENODEV;
+
+	mode = READ_ONCE(t7xx_dev->mode);
+	if (mode < T7XX_MODE_LAST)
+		return sysfs_emit(buf, "%s\n", t7xx_mode_names[mode]);
+
+	return sysfs_emit(buf, "%s\n", t7xx_mode_names[T7XX_UNKNOWN]);
+}
+
+static DEVICE_ATTR_RW(t7xx_mode);
+
+static struct attribute *t7xx_mode_attr[] = {
+	&dev_attr_t7xx_mode.attr,
+	NULL
+};
+
+static const struct attribute_group t7xx_mode_attribute_group = {
+	.attrs = t7xx_mode_attr,
+};
+
+void t7xx_mode_update(struct t7xx_pci_dev *t7xx_dev, enum t7xx_mode mode)
+{
+	if (!t7xx_dev)
+		return;
+
+	WRITE_ONCE(t7xx_dev->mode, mode);
+	sysfs_notify(&t7xx_dev->pdev->dev.kobj, NULL, "t7xx_mode");
+}
+
 enum t7xx_pm_state {
 	MTK_PM_EXCEPTION,
 	MTK_PM_INIT,		/* Device initialized, but handshake not completed */
@@ -108,7 +183,7 @@
 	pm_runtime_set_autosuspend_delay(&pdev->dev, PM_AUTOSUSPEND_MS);
 	pm_runtime_use_autosuspend(&pdev->dev);
 
-	return t7xx_wait_pm_config(t7xx_dev);
+	return 0;
 }
 
 void t7xx_pci_pm_init_late(struct t7xx_pci_dev *t7xx_dev)
@@ -279,7 +354,8 @@
 	int ret;
 
 	t7xx_dev = pci_get_drvdata(pdev);
-	if (atomic_read(&t7xx_dev->md_pm_state) <= MTK_PM_INIT) {
+	if (atomic_read(&t7xx_dev->md_pm_state) <= MTK_PM_INIT ||
+	    READ_ONCE(t7xx_dev->mode) != T7XX_READY) {
 		dev_err(&pdev->dev, "[PM] Exiting suspend, modem in invalid state\n");
 		return -EFAULT;
 	}
@@ -729,16 +805,28 @@
 
 	t7xx_pcie_mac_interrupts_dis(t7xx_dev);
 
+	ret = sysfs_create_group(&t7xx_dev->pdev->dev.kobj,
+				 &t7xx_mode_attribute_group);
+	if (ret)
+		goto err_md_exit;
+
 	ret = t7xx_interrupt_init(t7xx_dev);
-	if (ret) {
-		t7xx_md_exit(t7xx_dev);
-		return ret;
-	}
+	if (ret)
+		goto err_remove_group;
+
 
 	t7xx_pcie_mac_set_int(t7xx_dev, MHCCIF_INT);
 	t7xx_pcie_mac_interrupts_en(t7xx_dev);
 
 	return 0;
+
+err_remove_group:
+	sysfs_remove_group(&t7xx_dev->pdev->dev.kobj,
+			   &t7xx_mode_attribute_group);
+
+err_md_exit:
+	t7xx_md_exit(t7xx_dev);
+	return ret;
 }
 
 static void t7xx_pci_remove(struct pci_dev *pdev)
@@ -747,6 +835,9 @@
 	int i;
 
 	t7xx_dev = pci_get_drvdata(pdev);
+
+	sysfs_remove_group(&t7xx_dev->pdev->dev.kobj,
+			   &t7xx_mode_attribute_group);
 	t7xx_md_exit(t7xx_dev);
 
 	for (i = 0; i < EXT_INT_NUM; i++) {
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_pci.h
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_pci.h
@@ -43,6 +43,16 @@
 
 typedef irqreturn_t (*t7xx_intr_callback)(int irq, void *param);
 
+enum t7xx_mode {
+	T7XX_UNKNOWN,
+	T7XX_READY,
+	T7XX_RESET,
+	T7XX_FASTBOOT_SWITCHING,
+	T7XX_FASTBOOT_DOWNLOAD,
+	T7XX_FASTBOOT_DUMP,
+	T7XX_MODE_LAST, /* must always be last */
+};
+
 /* struct t7xx_pci_dev - MTK device context structure
  * @intr_handler: array of handler function for request_threaded_irq
  * @intr_thread: array of thread_fn for request_threaded_irq
@@ -59,6 +69,7 @@
  * @md_pm_lock: protects PCIe sleep lock
  * @sleep_disable_count: PCIe L1.2 lock counter
  * @sleep_lock_acquire: indicates that sleep has been disabled
+ * @mode: indicates the device mode
  */
 struct t7xx_pci_dev {
 	t7xx_intr_callback	intr_handler[EXT_INT_NUM];
@@ -82,6 +93,7 @@
 #ifdef CONFIG_WWAN_DEBUGFS
 	struct dentry		*debugfs_dir;
 #endif
+	u32			mode;
 };
 
 enum t7xx_pm_id {
@@ -120,5 +132,5 @@
 int t7xx_pci_pm_entity_unregister(struct t7xx_pci_dev *t7xx_dev, struct md_pm_entity *pm_entity);
 void t7xx_pci_pm_init_late(struct t7xx_pci_dev *t7xx_dev);
 void t7xx_pci_pm_exp_detected(struct t7xx_pci_dev *t7xx_dev);
-
+void t7xx_mode_update(struct t7xx_pci_dev *t7xx_dev, enum t7xx_mode mode);
 #endif /* __T7XX_PCI_H__ */
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_pcie_mac.c
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_pcie_mac.c
@@ -75,7 +75,7 @@
 	for (i = 0; i < ATR_TABLE_NUM_PER_ATR; i++) {
 		offset = ATR_PORT_OFFSET * port + ATR_TABLE_OFFSET * i;
 		reg = pbase + ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset;
-		iowrite64(0, reg);
+		iowrite64_lo_hi(0, reg);
 	}
 }
 
@@ -112,17 +112,17 @@
 
 	reg = pbase + ATR_PCIE_WIN0_T0_TRSL_ADDR + offset;
 	value = cfg->trsl_addr & ATR_PCIE_WIN0_ADDR_ALGMT;
-	iowrite64(value, reg);
+	iowrite64_lo_hi(value, reg);
 
 	reg = pbase + ATR_PCIE_WIN0_T0_TRSL_PARAM + offset;
 	iowrite32(cfg->trsl_id, reg);
 
 	reg = pbase + ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset;
 	value = (cfg->src_addr & ATR_PCIE_WIN0_ADDR_ALGMT) | (atr_size << 1) | BIT(0);
-	iowrite64(value, reg);
+	iowrite64_lo_hi(value, reg);
 
 	/* Ensure ATR is set */
-	ioread64(reg);
+	ioread64_lo_hi(reg);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_port.h
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_port.h
@@ -75,6 +75,8 @@
 	PORT_CH_DSS6_TX = 0x20df,
 	PORT_CH_DSS7_RX = 0x20e0,
 	PORT_CH_DSS7_TX = 0x20e1,
+
+	PORT_CH_UNIMPORTANT = 0xffff,
 };
 
 struct t7xx_port;
@@ -135,11 +137,13 @@
 	};
 };
 
+int t7xx_get_port_mtu(struct t7xx_port *port);
 struct sk_buff *t7xx_port_alloc_skb(int payload);
 struct sk_buff *t7xx_ctrl_alloc_skb(int payload);
 int t7xx_port_enqueue_skb(struct t7xx_port *port, struct sk_buff *skb);
 int t7xx_port_send_skb(struct t7xx_port *port, struct sk_buff *skb, unsigned int pkt_header,
 		       unsigned int ex_msg);
+int t7xx_port_send_raw_skb(struct t7xx_port *port, struct sk_buff *skb);
 int t7xx_port_send_ctl_skb(struct t7xx_port *port, struct sk_buff *skb, unsigned int msg,
 			   unsigned int ex_msg);
 
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_port_proxy.c
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_port_proxy.c
@@ -48,6 +48,9 @@
 	     i < (proxy)->port_count;		\
 	     i++, (p) = &(proxy)->ports[i])
 
+#define T7XX_MAX_POSSIBLE_PORTS_NUM	\
+	(max(ARRAY_SIZE(t7xx_port_conf), ARRAY_SIZE(t7xx_early_port_conf)))
+
 static const struct t7xx_port_conf t7xx_port_conf[] = {
 	{
 		.tx_ch = PORT_CH_UART2_TX,
@@ -100,6 +103,21 @@
 	},
 };
 
+static const struct t7xx_port_conf t7xx_early_port_conf[] = {
+	{
+		.tx_ch = PORT_CH_UNIMPORTANT,
+		.rx_ch = PORT_CH_UNIMPORTANT,
+		.txq_index = CLDMA_Q_IDX_DUMP,
+		.rxq_index = CLDMA_Q_IDX_DUMP,
+		.txq_exp_index = CLDMA_Q_IDX_DUMP,
+		.rxq_exp_index = CLDMA_Q_IDX_DUMP,
+		.path_id = CLDMA_ID_AP,
+		.ops = &wwan_sub_port_ops,
+		.name = "fastboot",
+		.port_type = WWAN_PORT_FASTBOOT,
+	},
+};
+
 static struct t7xx_port *t7xx_proxy_get_port_by_ch(struct port_proxy *port_prox, enum port_ch ch)
 {
 	const struct t7xx_port_conf *port_conf;
@@ -214,7 +232,17 @@
 	return 0;
 }
 
-static int t7xx_port_send_raw_skb(struct t7xx_port *port, struct sk_buff *skb)
+int t7xx_get_port_mtu(struct t7xx_port *port)
+{
+	enum cldma_id path_id = port->port_conf->path_id;
+	int tx_qno = t7xx_port_get_queue_no(port);
+	struct cldma_ctrl *md_ctrl;
+
+	md_ctrl = port->t7xx_dev->md->md_ctrl[path_id];
+	return md_ctrl->tx_ring[tx_qno].pkt_size;
+}
+
+int t7xx_port_send_raw_skb(struct t7xx_port *port, struct sk_buff *skb)
 {
 	enum cldma_id path_id = port->port_conf->path_id;
 	struct cldma_ctrl *md_ctrl;
@@ -329,6 +357,39 @@
 	}
 }
 
+/**
+ * t7xx_port_proxy_recv_skb_from_dedicated_queue() - Dispatch early port received skb.
+ * @queue: CLDMA queue.
+ * @skb: Socket buffer.
+ *
+ * Return:
+ ** 0		- Packet consumed.
+ ** -ERROR	- Failed to process skb.
+ */
+int t7xx_port_proxy_recv_skb_from_dedicated_queue(struct cldma_queue *queue, struct sk_buff *skb)
+{
+	struct t7xx_pci_dev *t7xx_dev = queue->md_ctrl->t7xx_dev;
+	struct port_proxy *port_prox = t7xx_dev->md->port_prox;
+	const struct t7xx_port_conf *port_conf;
+	struct t7xx_port *port;
+	int ret;
+
+	port = &port_prox->ports[0];
+	if (WARN_ON_ONCE(port->port_conf->rxq_index != queue->index)) {
+		dev_kfree_skb_any(skb);
+		return -EINVAL;
+	}
+
+	port_conf = port->port_conf;
+	ret = port_conf->ops->recv_skb(port, skb);
+	if (ret < 0 && ret != -ENOBUFS) {
+		dev_err(port->dev, "drop on RX ch %d, %d\n", port_conf->rx_ch, ret);
+		dev_kfree_skb_any(skb);
+	}
+
+	return ret;
+}
+
 static struct t7xx_port *t7xx_port_proxy_find_port(struct t7xx_pci_dev *t7xx_dev,
 						   struct cldma_queue *queue, u16 channel)
 {
@@ -359,7 +420,7 @@
  ** 0		- Packet consumed.
  ** -ERROR	- Failed to process skb.
  */
-static int t7xx_port_proxy_recv_skb(struct cldma_queue *queue, struct sk_buff *skb)
+int t7xx_port_proxy_recv_skb(struct cldma_queue *queue, struct sk_buff *skb)
 {
 	struct ccci_header *ccci_h = (struct ccci_header *)skb->data;
 	struct t7xx_pci_dev *t7xx_dev = queue->md_ctrl->t7xx_dev;
@@ -444,33 +505,54 @@
 		spin_lock_init(&port->port_update_lock);
 		port->chan_enable = false;
 
-		if (port_conf->ops->init)
+		if (port_conf->ops && port_conf->ops->init)
 			port_conf->ops->init(port);
 	}
 
 	t7xx_proxy_setup_ch_mapping(port_prox);
 }
 
+void t7xx_port_proxy_set_cfg(struct t7xx_modem *md, enum port_cfg_id cfg_id)
+{
+	struct port_proxy *port_prox = md->port_prox;
+	const struct t7xx_port_conf *port_conf;
+	u32 port_count;
+	int i;
+
+	t7xx_port_proxy_uninit(port_prox);
+
+	if (cfg_id == PORT_CFG_ID_EARLY) {
+		port_conf = t7xx_early_port_conf;
+		port_count = ARRAY_SIZE(t7xx_early_port_conf);
+	} else {
+		port_conf = t7xx_port_conf;
+		port_count = ARRAY_SIZE(t7xx_port_conf);
+	}
+
+	for (i = 0; i < port_count; i++)
+		port_prox->ports[i].port_conf = &port_conf[i];
+
+	port_prox->cfg_id = cfg_id;
+	port_prox->port_count = port_count;
+
+	t7xx_proxy_init_all_ports(md);
+}
+
 static int t7xx_proxy_alloc(struct t7xx_modem *md)
 {
-	unsigned int port_count = ARRAY_SIZE(t7xx_port_conf);
 	struct device *dev = &md->t7xx_dev->pdev->dev;
 	struct port_proxy *port_prox;
-	int i;
 
-	port_prox = devm_kzalloc(dev, sizeof(*port_prox) + sizeof(struct t7xx_port) * port_count,
+	port_prox = devm_kzalloc(dev, sizeof(*port_prox) +
+				 sizeof(struct t7xx_port) * T7XX_MAX_POSSIBLE_PORTS_NUM,
 				 GFP_KERNEL);
 	if (!port_prox)
 		return -ENOMEM;
 
 	md->port_prox = port_prox;
 	port_prox->dev = dev;
+	t7xx_port_proxy_set_cfg(md, PORT_CFG_ID_EARLY);
 
-	for (i = 0; i < port_count; i++)
-		port_prox->ports[i].port_conf = &t7xx_port_conf[i];
-
-	port_prox->port_count = port_count;
-	t7xx_proxy_init_all_ports(md);
 	return 0;
 }
 
@@ -492,8 +574,6 @@
 	if (ret)
 		return ret;
 
-	t7xx_cldma_set_recv_skb(md->md_ctrl[CLDMA_ID_AP], t7xx_port_proxy_recv_skb);
-	t7xx_cldma_set_recv_skb(md->md_ctrl[CLDMA_ID_MD], t7xx_port_proxy_recv_skb);
 	return 0;
 }
 
@@ -505,7 +585,7 @@
 	for_each_proxy_port(i, port, port_prox) {
 		const struct t7xx_port_conf *port_conf = port->port_conf;
 
-		if (port_conf->ops->uninit)
+		if (port_conf->ops && port_conf->ops->uninit)
 			port_conf->ops->uninit(port);
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_port_proxy.h
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_port_proxy.h
@@ -31,11 +31,18 @@
 #define RX_QUEUE_MAXLEN		32
 #define CTRL_QUEUE_MAXLEN	16
 
+enum port_cfg_id {
+	PORT_CFG_ID_INVALID,
+	PORT_CFG_ID_NORMAL,
+	PORT_CFG_ID_EARLY,
+};
+
 struct port_proxy {
 	int			port_count;
 	struct list_head	rx_ch_ports[PORT_CH_ID_MASK + 1];
 	struct list_head	queue_ports[CLDMA_NUM][MTK_QUEUES];
 	struct device		*dev;
+	enum port_cfg_id	cfg_id;
 	struct t7xx_port	ports[];
 };
 
@@ -98,5 +105,8 @@
 int t7xx_port_enum_msg_handler(struct t7xx_modem *md, void *msg);
 int t7xx_port_proxy_chl_enable_disable(struct port_proxy *port_prox, unsigned int ch_id,
 				       bool en_flag);
+void t7xx_port_proxy_set_cfg(struct t7xx_modem *md, enum port_cfg_id cfg_id);
+int t7xx_port_proxy_recv_skb(struct cldma_queue *queue, struct sk_buff *skb);
+int t7xx_port_proxy_recv_skb_from_dedicated_queue(struct cldma_queue *queue, struct sk_buff *skb);
 
 #endif /* __T7XX_PORT_PROXY_H__ */
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_port_wwan.c
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_port_wwan.c
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2021, MediaTek Inc.
  * Copyright (c) 2021-2022, Intel Corporation.
+ * Copyright (c) 2024, Fibocom Wireless Inc.
  *
  * Authors:
  *  Amir Hanania <amir.hanania@intel.com>
@@ -15,6 +16,7 @@
  *  Chiranjeevi Rapolu <chiranjeevi.rapolu@intel.com>
  *  Eliot Lee <eliot.lee@intel.com>
  *  Sreehari Kancharla <sreehari.kancharla@intel.com>
+ *  Jinjian Song <jinjian.song@fibocom.com>
  */
 
 #include <linux/atomic.h>
@@ -33,7 +35,7 @@
 #include "t7xx_port_proxy.h"
 #include "t7xx_state_monitor.h"
 
-static int t7xx_port_ctrl_start(struct wwan_port *port)
+static int t7xx_port_wwan_start(struct wwan_port *port)
 {
 	struct t7xx_port *port_mtk = wwan_port_get_drvdata(port);
 
@@ -44,30 +46,60 @@
 	return 0;
 }
 
-static void t7xx_port_ctrl_stop(struct wwan_port *port)
+static void t7xx_port_wwan_stop(struct wwan_port *port)
 {
 	struct t7xx_port *port_mtk = wwan_port_get_drvdata(port);
 
 	atomic_dec(&port_mtk->usage_cnt);
 }
 
-static int t7xx_port_ctrl_tx(struct wwan_port *port, struct sk_buff *skb)
+static int t7xx_port_fastboot_tx(struct t7xx_port *port, struct sk_buff *skb)
+{
+	struct sk_buff *cur = skb, *tx_skb;
+	size_t actual, len, offset = 0;
+	int txq_mtu;
+	int ret;
+
+	txq_mtu = t7xx_get_port_mtu(port);
+	if (txq_mtu < 0)
+		return -EINVAL;
+
+	actual = cur->len;
+	while (actual) {
+		len = min_t(size_t, actual, txq_mtu);
+		tx_skb = __dev_alloc_skb(len, GFP_KERNEL);
+		if (!tx_skb)
+			return -ENOMEM;
+
+		skb_put_data(tx_skb, cur->data + offset, len);
+
+		ret = t7xx_port_send_raw_skb(port, tx_skb);
+		if (ret) {
+			dev_kfree_skb(tx_skb);
+			dev_err(port->dev, "Write error on fastboot port, %d\n", ret);
+			break;
+		}
+		offset += len;
+		actual -= len;
+	}
+
+	dev_kfree_skb(skb);
+	return 0;
+}
+
+static int t7xx_port_ctrl_tx(struct t7xx_port *port, struct sk_buff *skb)
 {
-	struct t7xx_port *port_private = wwan_port_get_drvdata(port);
 	const struct t7xx_port_conf *port_conf;
 	struct sk_buff *cur = skb, *cloned;
 	struct t7xx_fsm_ctl *ctl;
 	enum md_state md_state;
 	int cnt = 0, ret;
 
-	if (!port_private->chan_enable)
-		return -EINVAL;
-
-	port_conf = port_private->port_conf;
-	ctl = port_private->t7xx_dev->md->fsm_ctl;
+	port_conf = port->port_conf;
+	ctl = port->t7xx_dev->md->fsm_ctl;
 	md_state = t7xx_fsm_get_md_state(ctl);
 	if (md_state == MD_STATE_WAITING_FOR_HS1 || md_state == MD_STATE_WAITING_FOR_HS2) {
-		dev_warn(port_private->dev, "Cannot write to %s port when md_state=%d\n",
+		dev_warn(port->dev, "Cannot write to %s port when md_state=%d\n",
 			 port_conf->name, md_state);
 		return -ENODEV;
 	}
@@ -75,10 +107,10 @@
 	while (cur) {
 		cloned = skb_clone(cur, GFP_KERNEL);
 		cloned->len = skb_headlen(cur);
-		ret = t7xx_port_send_skb(port_private, cloned, 0, 0);
+		ret = t7xx_port_send_skb(port, cloned, 0, 0);
 		if (ret) {
 			dev_kfree_skb(cloned);
-			dev_err(port_private->dev, "Write error on %s port, %d\n",
+			dev_err(port->dev, "Write error on %s port, %d\n",
 				port_conf->name, ret);
 			return cnt ? cnt + ret : ret;
 		}
@@ -93,14 +125,53 @@
 	return 0;
 }
 
+static int t7xx_port_wwan_tx(struct wwan_port *port, struct sk_buff *skb)
+{
+	struct t7xx_port *port_private = wwan_port_get_drvdata(port);
+	const struct t7xx_port_conf *port_conf = port_private->port_conf;
+	int ret;
+
+	if (!port_private->chan_enable)
+		return -EINVAL;
+
+	if (port_conf->port_type != WWAN_PORT_FASTBOOT)
+		ret = t7xx_port_ctrl_tx(port_private, skb);
+	else
+		ret = t7xx_port_fastboot_tx(port_private, skb);
+
+	return ret;
+}
+
 static const struct wwan_port_ops wwan_ops = {
-	.start = t7xx_port_ctrl_start,
-	.stop = t7xx_port_ctrl_stop,
-	.tx = t7xx_port_ctrl_tx,
+	.start = t7xx_port_wwan_start,
+	.stop = t7xx_port_wwan_stop,
+	.tx = t7xx_port_wwan_tx,
 };
 
+static void t7xx_port_wwan_create(struct t7xx_port *port)
+{
+	const struct t7xx_port_conf *port_conf = port->port_conf;
+	unsigned int header_len = sizeof(struct ccci_header), mtu;
+	struct wwan_port_caps caps;
+
+	if (!port->wwan.wwan_port) {
+		mtu = t7xx_get_port_mtu(port);
+		caps.frag_len = mtu - header_len;
+		caps.headroom_len = header_len;
+		port->wwan.wwan_port = wwan_create_port(port->dev, port_conf->port_type,
+							&wwan_ops, &caps, port);
+		if (IS_ERR(port->wwan.wwan_port))
+			dev_err(port->dev, "Unable to create WWAN port %s", port_conf->name);
+	}
+}
+
 static int t7xx_port_wwan_init(struct t7xx_port *port)
 {
+	const struct t7xx_port_conf *port_conf = port->port_conf;
+
+	if (port_conf->port_type == WWAN_PORT_FASTBOOT)
+		t7xx_port_wwan_create(port);
+
 	port->rx_length_th = RX_QUEUE_MAXLEN;
 	return 0;
 }
@@ -152,20 +223,14 @@
 static void t7xx_port_wwan_md_state_notify(struct t7xx_port *port, unsigned int state)
 {
 	const struct t7xx_port_conf *port_conf = port->port_conf;
-	unsigned int header_len = sizeof(struct ccci_header);
-	struct wwan_port_caps caps;
+
+	if (port_conf->port_type == WWAN_PORT_FASTBOOT)
+		return;
 
 	if (state != MD_STATE_READY)
 		return;
 
-	if (!port->wwan.wwan_port) {
-		caps.frag_len = CLDMA_MTU - header_len;
-		caps.headroom_len = header_len;
-		port->wwan.wwan_port = wwan_create_port(port->dev, port_conf->port_type,
-							&wwan_ops, &caps, port);
-		if (IS_ERR(port->wwan.wwan_port))
-			dev_err(port->dev, "Unable to create WWWAN port %s", port_conf->name);
-	}
+	t7xx_port_wwan_create(port);
 }
 
 struct port_ops wwan_sub_port_ops = {
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_reg.h
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_reg.h
@@ -101,11 +101,33 @@
 	PM_RESUME_REG_STATE_L2_EXP,
 };
 
+enum host_event_e {
+	HOST_EVENT_INIT = 0,
+	FASTBOOT_DL_NOTIFY = 0x3,
+};
+
 #define T7XX_PCIE_MISC_DEV_STATUS		0x0d1c
 #define MISC_STAGE_MASK				GENMASK(2, 0)
 #define MISC_RESET_TYPE_PLDR			BIT(26)
 #define MISC_RESET_TYPE_FLDR			BIT(27)
-#define LINUX_STAGE				4
+#define MISC_RESET_TYPE_PLDR			BIT(26)
+#define MISC_LK_EVENT_MASK			GENMASK(11, 8)
+#define HOST_EVENT_MASK				GENMASK(31, 28)
+
+enum lk_event_id {
+	LK_EVENT_NORMAL = 0,
+	LK_EVENT_CREATE_PD_PORT = 1,
+	LK_EVENT_CREATE_POST_DL_PORT = 2,
+	LK_EVENT_RESET = 7,
+};
+
+enum t7xx_device_stage {
+	T7XX_DEV_STAGE_INIT = 0,
+	T7XX_DEV_STAGE_BROM_PRE = 1,
+	T7XX_DEV_STAGE_BROM_POST = 2,
+	T7XX_DEV_STAGE_LK = 3,
+	T7XX_DEV_STAGE_LINUX = 4,
+};
 
 #define T7XX_PCIE_RESOURCE_STATUS		0x0d28
 #define T7XX_PCIE_RESOURCE_STS_MSK		GENMASK(4, 0)
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_state_monitor.c
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_state_monitor.c
@@ -47,6 +47,13 @@
 #define FSM_MD_EX_PASS_TIMEOUT_MS		45000
 #define FSM_CMD_TIMEOUT_MS			2000
 
+#define wait_for_expected_dev_stage(status)	\
+	read_poll_timeout(ioread32, status,	\
+			  ((status & MISC_STAGE_MASK) == T7XX_DEV_STAGE_LINUX) ||	\
+			  ((status & MISC_STAGE_MASK) == T7XX_DEV_STAGE_LK), 100000,	\
+			  20000000, false, IREG_BASE(md->t7xx_dev) +	\
+			  T7XX_PCIE_MISC_DEV_STATUS)
+
 void t7xx_fsm_notifier_register(struct t7xx_modem *md, struct t7xx_fsm_notifier *notifier)
 {
 	struct t7xx_fsm_ctl *ctl = md->fsm_ctl;
@@ -97,14 +104,21 @@
 	fsm_state_notify(ctl->md, state);
 }
 
+static void fsm_release_command(struct kref *ref)
+{
+	struct t7xx_fsm_command *cmd = container_of(ref, typeof(*cmd), refcnt);
+
+	kfree(cmd);
+}
+
 static void fsm_finish_command(struct t7xx_fsm_ctl *ctl, struct t7xx_fsm_command *cmd, int result)
 {
 	if (cmd->flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) {
-		*cmd->ret = result;
-		complete_all(cmd->done);
+		cmd->result = result;
+		complete_all(&cmd->done);
 	}
 
-	kfree(cmd);
+	kref_put(&cmd->refcnt, fsm_release_command);
 }
 
 static void fsm_del_kf_event(struct t7xx_fsm_event *event)
@@ -206,6 +220,55 @@
 		fsm_finish_command(ctl, cmd, 0);
 }
 
+static void t7xx_host_event_notify(struct t7xx_modem *md, unsigned int event_id)
+{
+	u32 value;
+
+	value = ioread32(IREG_BASE(md->t7xx_dev) + T7XX_PCIE_MISC_DEV_STATUS);
+	value &= ~HOST_EVENT_MASK;
+	value |= FIELD_PREP(HOST_EVENT_MASK, event_id);
+	iowrite32(value, IREG_BASE(md->t7xx_dev) + T7XX_PCIE_MISC_DEV_STATUS);
+}
+
+static void t7xx_lk_stage_event_handling(struct t7xx_fsm_ctl *ctl, unsigned int status)
+{
+	struct t7xx_modem *md = ctl->md;
+	struct cldma_ctrl *md_ctrl;
+	enum lk_event_id lk_event;
+	struct device *dev;
+	struct t7xx_port *port;
+
+	dev = &md->t7xx_dev->pdev->dev;
+	lk_event = FIELD_GET(MISC_LK_EVENT_MASK, status);
+	switch (lk_event) {
+	case LK_EVENT_NORMAL:
+	case LK_EVENT_RESET:
+		break;
+
+	case LK_EVENT_CREATE_PD_PORT:
+	case LK_EVENT_CREATE_POST_DL_PORT:
+		md_ctrl = md->md_ctrl[CLDMA_ID_AP];
+		t7xx_cldma_hif_hw_init(md_ctrl);
+		t7xx_cldma_stop(md_ctrl);
+		t7xx_cldma_switch_cfg(md_ctrl, CLDMA_DEDICATED_Q_CFG);
+
+		port = &ctl->md->port_prox->ports[0];
+		port->port_conf->ops->enable_chl(port);
+
+		t7xx_cldma_start(md_ctrl);
+
+		if (lk_event == LK_EVENT_CREATE_POST_DL_PORT)
+			t7xx_mode_update(md->t7xx_dev, T7XX_FASTBOOT_DOWNLOAD);
+		else
+			t7xx_mode_update(md->t7xx_dev, T7XX_FASTBOOT_DUMP);
+		break;
+
+	default:
+		dev_err(dev, "Invalid LK event %d\n", lk_event);
+		break;
+	}
+}
+
 static int fsm_stopped_handler(struct t7xx_fsm_ctl *ctl)
 {
 	ctl->curr_state = FSM_STATE_STOPPED;
@@ -226,8 +289,9 @@
 
 static void fsm_routine_stopping(struct t7xx_fsm_ctl *ctl, struct t7xx_fsm_command *cmd)
 {
-	struct t7xx_pci_dev *t7xx_dev;
-	struct cldma_ctrl *md_ctrl;
+	struct cldma_ctrl *md_ctrl = ctl->md->md_ctrl[CLDMA_ID_MD];
+	struct t7xx_pci_dev *t7xx_dev = ctl->md->t7xx_dev;
+	enum t7xx_mode mode = READ_ONCE(t7xx_dev->mode);
 	int err;
 
 	if (ctl->curr_state == FSM_STATE_STOPPED || ctl->curr_state == FSM_STATE_STOPPING) {
@@ -235,18 +299,20 @@
 		return;
 	}
 
-	md_ctrl = ctl->md->md_ctrl[CLDMA_ID_MD];
-	t7xx_dev = ctl->md->t7xx_dev;
-
 	ctl->curr_state = FSM_STATE_STOPPING;
 	t7xx_fsm_broadcast_state(ctl, MD_STATE_WAITING_TO_STOP);
 	t7xx_cldma_stop(md_ctrl);
 
-	if (!ctl->md->rgu_irq_asserted) {
-		t7xx_mhccif_h2d_swint_trigger(t7xx_dev, H2D_CH_DRM_DISABLE_AP);
-		/* Wait for the DRM disable to take effect */
-		msleep(FSM_DRM_DISABLE_DELAY_MS);
+	if (mode == T7XX_FASTBOOT_SWITCHING)
+		t7xx_host_event_notify(ctl->md, FASTBOOT_DL_NOTIFY);
 
+	t7xx_mhccif_h2d_swint_trigger(t7xx_dev, H2D_CH_DRM_DISABLE_AP);
+	/* Wait for the DRM disable to take effect */
+	msleep(FSM_DRM_DISABLE_DELAY_MS);
+
+	if (mode == T7XX_FASTBOOT_SWITCHING) {
+		t7xx_mhccif_h2d_swint_trigger(t7xx_dev, H2D_CH_DEVICE_RESET);
+	} else {
 		err = t7xx_acpi_fldr_func(t7xx_dev);
 		if (err)
 			t7xx_mhccif_h2d_swint_trigger(t7xx_dev, H2D_CH_DEVICE_RESET);
@@ -272,6 +338,7 @@
 
 	ctl->curr_state = FSM_STATE_READY;
 	t7xx_fsm_broadcast_ready_state(ctl);
+	t7xx_mode_update(md->t7xx_dev, T7XX_READY);
 	t7xx_md_event_notify(md, FSM_READY);
 }
 
@@ -317,7 +384,8 @@
 static void fsm_routine_start(struct t7xx_fsm_ctl *ctl, struct t7xx_fsm_command *cmd)
 {
 	struct t7xx_modem *md = ctl->md;
-	u32 dev_status;
+	struct device *dev;
+	u32 status;
 	int ret;
 
 	if (!md)
@@ -329,23 +397,53 @@
 		return;
 	}
 
+	dev = &md->t7xx_dev->pdev->dev;
 	ctl->curr_state = FSM_STATE_PRE_START;
 	t7xx_md_event_notify(md, FSM_PRE_START);
 
-	ret = read_poll_timeout(ioread32, dev_status,
-				(dev_status & MISC_STAGE_MASK) == LINUX_STAGE, 20000, 2000000,
-				false, IREG_BASE(md->t7xx_dev) + T7XX_PCIE_MISC_DEV_STATUS);
+	ret = wait_for_expected_dev_stage(status);
+
 	if (ret) {
-		struct device *dev = &md->t7xx_dev->pdev->dev;
+		dev_err(dev, "read poll timeout %d\n", ret);
+		goto finish_command;
+	}
 
-		fsm_finish_command(ctl, cmd, -ETIMEDOUT);
-		dev_err(dev, "Invalid device status 0x%lx\n", dev_status & MISC_STAGE_MASK);
-		return;
+	if (status != ctl->status || cmd->flag != 0) {
+		u32 stage = FIELD_GET(MISC_STAGE_MASK, status);
+
+		switch (stage) {
+		case T7XX_DEV_STAGE_INIT:
+		case T7XX_DEV_STAGE_BROM_PRE:
+		case T7XX_DEV_STAGE_BROM_POST:
+			dev_dbg(dev, "BROM_STAGE Entered\n");
+			ret = t7xx_fsm_append_cmd(ctl, FSM_CMD_START, 0);
+			break;
+
+		case T7XX_DEV_STAGE_LK:
+			dev_dbg(dev, "LK_STAGE Entered\n");
+			t7xx_lk_stage_event_handling(ctl, status);
+			break;
+
+		case T7XX_DEV_STAGE_LINUX:
+			dev_dbg(dev, "LINUX_STAGE Entered\n");
+			t7xx_mhccif_mask_clr(md->t7xx_dev, D2H_INT_PORT_ENUM |
+					     D2H_INT_ASYNC_MD_HK | D2H_INT_ASYNC_AP_HK);
+			if (cmd->flag == 0)
+				break;
+			t7xx_cldma_hif_hw_init(md->md_ctrl[CLDMA_ID_AP]);
+			t7xx_cldma_hif_hw_init(md->md_ctrl[CLDMA_ID_MD]);
+			t7xx_port_proxy_set_cfg(md, PORT_CFG_ID_NORMAL);
+			ret = fsm_routine_starting(ctl);
+			break;
+
+		default:
+			break;
+		}
+		ctl->status = status;
 	}
 
-	t7xx_cldma_hif_hw_init(md->md_ctrl[CLDMA_ID_AP]);
-	t7xx_cldma_hif_hw_init(md->md_ctrl[CLDMA_ID_MD]);
-	fsm_finish_command(ctl, cmd, fsm_routine_starting(ctl));
+finish_command:
+	fsm_finish_command(ctl, cmd, ret);
 }
 
 static int fsm_main_thread(void *data)
@@ -396,7 +494,6 @@
 
 int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id, unsigned int flag)
 {
-	DECLARE_COMPLETION_ONSTACK(done);
 	struct t7xx_fsm_command *cmd;
 	unsigned long flags;
 	int ret;
@@ -408,11 +505,13 @@
 	INIT_LIST_HEAD(&cmd->entry);
 	cmd->cmd_id = cmd_id;
 	cmd->flag = flag;
+	kref_init(&cmd->refcnt);
 	if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) {
-		cmd->done = &done;
-		cmd->ret = &ret;
+		init_completion(&cmd->done);
+		kref_get(&cmd->refcnt);
 	}
 
+	kref_get(&cmd->refcnt);
 	spin_lock_irqsave(&ctl->command_lock, flags);
 	list_add_tail(&cmd->entry, &ctl->command_queue);
 	spin_unlock_irqrestore(&ctl->command_lock, flags);
@@ -422,11 +521,11 @@
 	if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) {
 		unsigned long wait_ret;
 
-		wait_ret = wait_for_completion_timeout(&done,
+		wait_ret = wait_for_completion_timeout(&cmd->done,
 						       msecs_to_jiffies(FSM_CMD_TIMEOUT_MS));
-		if (!wait_ret)
-			return -ETIMEDOUT;
 
+		ret = wait_ret ? cmd->result : -ETIMEDOUT;
+		kref_put(&cmd->refcnt, fsm_release_command);
 		return ret;
 	}
 
@@ -517,6 +616,7 @@
 	fsm_flush_event_cmd_qs(ctl);
 	ctl->curr_state = FSM_STATE_STOPPED;
 	ctl->exp_flg = false;
+	ctl->status = T7XX_DEV_STAGE_INIT;
 }
 
 int t7xx_fsm_init(struct t7xx_modem *md)
--- linux-qcom-6.8.0.orig/drivers/net/wwan/t7xx/t7xx_state_monitor.h
+++ linux-qcom-6.8.0/drivers/net/wwan/t7xx/t7xx_state_monitor.h
@@ -96,6 +96,7 @@
 	bool			exp_flg;
 	spinlock_t		notifier_lock;		/* Protects notifier list */
 	struct list_head	notifier_list;
+	u32			status;			/* Device boot stage */
 };
 
 struct t7xx_fsm_event {
@@ -109,8 +110,9 @@
 	struct list_head	entry;
 	enum t7xx_fsm_cmd_state	cmd_id;
 	unsigned int		flag;
-	struct completion	*done;
-	int			*ret;
+	struct completion	done;
+	int			result;
+	struct kref		refcnt;
 };
 
 struct t7xx_fsm_notifier {
--- linux-qcom-6.8.0.orig/drivers/net/wwan/wwan_core.c
+++ linux-qcom-6.8.0/drivers/net/wwan/wwan_core.c
@@ -328,6 +328,10 @@
 		.name = "XMMRPC",
 		.devsuf = "xmmrpc",
 	},
+	[WWAN_PORT_FASTBOOT] = {
+		.name = "FASTBOOT",
+		.devsuf = "fastboot",
+	},
 };
 
 static ssize_t type_show(struct device *dev, struct device_attribute *attr,
@@ -1032,7 +1036,7 @@
 
 static struct rtnl_link_ops wwan_rtnl_link_ops __read_mostly = {
 	.kind = "wwan",
-	.maxtype = __IFLA_WWAN_MAX,
+	.maxtype = IFLA_WWAN_MAX,
 	.alloc = wwan_rtnl_alloc,
 	.validate = wwan_rtnl_validate,
 	.newlink = wwan_rtnl_newlink,
--- linux-qcom-6.8.0.orig/drivers/net/xen-netback/hash.c
+++ linux-qcom-6.8.0/drivers/net/xen-netback/hash.c
@@ -95,7 +95,7 @@
 
 static void xenvif_flush_hash(struct xenvif *vif)
 {
-	struct xenvif_hash_cache_entry *entry;
+	struct xenvif_hash_cache_entry *entry, *n;
 	unsigned long flags;
 
 	if (xenvif_hash_cache_size == 0)
@@ -103,8 +103,7 @@
 
 	spin_lock_irqsave(&vif->hash.cache.lock, flags);
 
-	list_for_each_entry_rcu(entry, &vif->hash.cache.list, link,
-				lockdep_is_held(&vif->hash.cache.lock)) {
+	list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) {
 		list_del_rcu(&entry->link);
 		vif->hash.cache.count--;
 		kfree_rcu(entry, rcu);
--- linux-qcom-6.8.0.orig/drivers/net/xen-netfront.c
+++ linux-qcom-6.8.0/drivers/net/xen-netfront.c
@@ -285,6 +285,7 @@
 		return NULL;
 	}
 	skb_add_rx_frag(skb, 0, page, 0, 0, PAGE_SIZE);
+	skb_mark_for_recycle(skb);
 
 	/* Align ip header to a 16 bytes boundary */
 	skb_reserve(skb, NET_IP_ALIGN);
@@ -866,7 +867,7 @@
 static int xennet_close(struct net_device *dev)
 {
 	struct netfront_info *np = netdev_priv(dev);
-	unsigned int num_queues = dev->real_num_tx_queues;
+	unsigned int num_queues = np->queues ? dev->real_num_tx_queues : 0;
 	unsigned int i;
 	struct netfront_queue *queue;
 	netif_tx_stop_all_queues(np->netdev);
@@ -881,6 +882,9 @@
 {
 	unsigned int i;
 
+	if (!info->queues)
+		return;
+
 	for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
 		struct netfront_queue *queue = &info->queues[i];
 
--- linux-qcom-6.8.0.orig/drivers/nfc/pn533/pn533.c
+++ linux-qcom-6.8.0/drivers/nfc/pn533/pn533.c
@@ -1723,6 +1723,11 @@
 	}
 
 	pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
+	if (!dev->poll_mod_count) {
+		nfc_err(dev->dev,
+			"Poll mod list is empty\n");
+		return -EINVAL;
+	}
 
 	/* Do not always start polling from the same modulation */
 	get_random_bytes(&rand_mod, sizeof(rand_mod));
--- linux-qcom-6.8.0.orig/drivers/nfc/trf7970a.c
+++ linux-qcom-6.8.0/drivers/nfc/trf7970a.c
@@ -424,7 +424,8 @@
 	enum trf7970a_state		state;
 	struct device			*dev;
 	struct spi_device		*spi;
-	struct regulator		*regulator;
+	struct regulator		*vin_regulator;
+	struct regulator		*vddio_regulator;
 	struct nfc_digital_dev		*ddev;
 	u32				quirks;
 	bool				is_initiator;
@@ -1883,7 +1884,7 @@
 	if (trf->state != TRF7970A_ST_PWR_OFF)
 		return 0;
 
-	ret = regulator_enable(trf->regulator);
+	ret = regulator_enable(trf->vin_regulator);
 	if (ret) {
 		dev_err(trf->dev, "%s - Can't enable VIN: %d\n", __func__, ret);
 		return ret;
@@ -1926,7 +1927,7 @@
 	if (trf->en2_gpiod && !(trf->quirks & TRF7970A_QUIRK_EN2_MUST_STAY_LOW))
 		gpiod_set_value_cansleep(trf->en2_gpiod, 0);
 
-	ret = regulator_disable(trf->regulator);
+	ret = regulator_disable(trf->vin_regulator);
 	if (ret)
 		dev_err(trf->dev, "%s - Can't disable VIN: %d\n", __func__,
 			ret);
@@ -2065,37 +2066,37 @@
 	mutex_init(&trf->lock);
 	INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler);
 
-	trf->regulator = devm_regulator_get(&spi->dev, "vin");
-	if (IS_ERR(trf->regulator)) {
-		ret = PTR_ERR(trf->regulator);
+	trf->vin_regulator = devm_regulator_get(&spi->dev, "vin");
+	if (IS_ERR(trf->vin_regulator)) {
+		ret = PTR_ERR(trf->vin_regulator);
 		dev_err(trf->dev, "Can't get VIN regulator: %d\n", ret);
 		goto err_destroy_lock;
 	}
 
-	ret = regulator_enable(trf->regulator);
+	ret = regulator_enable(trf->vin_regulator);
 	if (ret) {
 		dev_err(trf->dev, "Can't enable VIN: %d\n", ret);
 		goto err_destroy_lock;
 	}
 
-	uvolts = regulator_get_voltage(trf->regulator);
+	uvolts = regulator_get_voltage(trf->vin_regulator);
 	if (uvolts > 4000000)
 		trf->chip_status_ctrl = TRF7970A_CHIP_STATUS_VRS5_3;
 
-	trf->regulator = devm_regulator_get(&spi->dev, "vdd-io");
-	if (IS_ERR(trf->regulator)) {
-		ret = PTR_ERR(trf->regulator);
+	trf->vddio_regulator = devm_regulator_get(&spi->dev, "vdd-io");
+	if (IS_ERR(trf->vddio_regulator)) {
+		ret = PTR_ERR(trf->vddio_regulator);
 		dev_err(trf->dev, "Can't get VDD_IO regulator: %d\n", ret);
-		goto err_destroy_lock;
+		goto err_disable_vin_regulator;
 	}
 
-	ret = regulator_enable(trf->regulator);
+	ret = regulator_enable(trf->vddio_regulator);
 	if (ret) {
 		dev_err(trf->dev, "Can't enable VDD_IO: %d\n", ret);
-		goto err_destroy_lock;
+		goto err_disable_vin_regulator;
 	}
 
-	if (regulator_get_voltage(trf->regulator) == 1800000) {
+	if (regulator_get_voltage(trf->vddio_regulator) == 1800000) {
 		trf->io_ctrl = TRF7970A_REG_IO_CTRL_IO_LOW;
 		dev_dbg(trf->dev, "trf7970a config vdd_io to 1.8V\n");
 	}
@@ -2108,7 +2109,7 @@
 	if (!trf->ddev) {
 		dev_err(trf->dev, "Can't allocate NFC digital device\n");
 		ret = -ENOMEM;
-		goto err_disable_regulator;
+		goto err_disable_vddio_regulator;
 	}
 
 	nfc_digital_set_parent_dev(trf->ddev, trf->dev);
@@ -2137,8 +2138,10 @@
 	trf7970a_shutdown(trf);
 err_free_ddev:
 	nfc_digital_free_device(trf->ddev);
-err_disable_regulator:
-	regulator_disable(trf->regulator);
+err_disable_vddio_regulator:
+	regulator_disable(trf->vddio_regulator);
+err_disable_vin_regulator:
+	regulator_disable(trf->vin_regulator);
 err_destroy_lock:
 	mutex_destroy(&trf->lock);
 	return ret;
@@ -2157,7 +2160,8 @@
 	nfc_digital_unregister_device(trf->ddev);
 	nfc_digital_free_device(trf->ddev);
 
-	regulator_disable(trf->regulator);
+	regulator_disable(trf->vddio_regulator);
+	regulator_disable(trf->vin_regulator);
 
 	mutex_destroy(&trf->lock);
 }
--- linux-qcom-6.8.0.orig/drivers/nfc/virtual_ncidev.c
+++ linux-qcom-6.8.0/drivers/nfc/virtual_ncidev.c
@@ -125,6 +125,10 @@
 		kfree_skb(skb);
 		return -EFAULT;
 	}
+	if (strnlen(skb->data, count) != count) {
+		kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	nci_recv_frame(vdev->ndev, skb);
 	return count;
--- linux-qcom-6.8.0.orig/drivers/ntb/core.c
+++ linux-qcom-6.8.0/drivers/ntb/core.c
@@ -100,6 +100,8 @@
 
 int ntb_register_device(struct ntb_dev *ntb)
 {
+	int ret;
+
 	if (!ntb)
 		return -EINVAL;
 	if (!ntb->pdev)
@@ -120,7 +122,11 @@
 	ntb->ctx_ops = NULL;
 	spin_lock_init(&ntb->ctx_lock);
 
-	return device_register(&ntb->dev);
+	ret = device_register(&ntb->dev);
+	if (ret)
+		put_device(&ntb->dev);
+
+	return ret;
 }
 EXPORT_SYMBOL(ntb_register_device);
 
--- linux-qcom-6.8.0.orig/drivers/ntb/hw/intel/ntb_hw_gen1.c
+++ linux-qcom-6.8.0/drivers/ntb/hw/intel/ntb_hw_gen1.c
@@ -778,7 +778,7 @@
 		ndev->debugfs_dir =
 			debugfs_create_dir(pci_name(ndev->ntb.pdev),
 					   debugfs_dir);
-		if (!ndev->debugfs_dir)
+		if (IS_ERR(ndev->debugfs_dir))
 			ndev->debugfs_info = NULL;
 		else
 			ndev->debugfs_info =
--- linux-qcom-6.8.0.orig/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+++ linux-qcom-6.8.0/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
@@ -1554,6 +1554,7 @@
 	switchtec_ntb_deinit_db_msg_irq(sndev);
 	switchtec_ntb_deinit_shared_mw(sndev);
 	switchtec_ntb_deinit_crosslink(sndev);
+	cancel_work_sync(&sndev->check_link_status_work);
 	kfree(sndev);
 	dev_info(dev, "ntb device unregistered\n");
 }
--- linux-qcom-6.8.0.orig/drivers/ntb/ntb_transport.c
+++ linux-qcom-6.8.0/drivers/ntb/ntb_transport.c
@@ -807,16 +807,29 @@
 }
 
 static int ntb_alloc_mw_buffer(struct ntb_transport_mw *mw,
-			       struct device *dma_dev, size_t align)
+			       struct device *ntb_dev, size_t align)
 {
 	dma_addr_t dma_addr;
 	void *alloc_addr, *virt_addr;
 	int rc;
 
-	alloc_addr = dma_alloc_coherent(dma_dev, mw->alloc_size,
-					&dma_addr, GFP_KERNEL);
+	/*
+	 * The buffer here is allocated against the NTB device. The reason to
+	 * use dma_alloc_*() call is to allocate a large IOVA contiguous buffer
+	 * backing the NTB BAR for the remote host to write to. During receive
+	 * processing, the data is being copied out of the receive buffer to
+	 * the kernel skbuff. When a DMA device is being used, dma_map_page()
+	 * is called on the kvaddr of the receive buffer (from dma_alloc_*())
+	 * and remapped against the DMA device. It appears to be a double
+	 * DMA mapping of buffers, but first is mapped to the NTB device and
+	 * second is to the DMA device. DMA_ATTR_FORCE_CONTIGUOUS is necessary
+	 * in order for the later dma_map_page() to not fail.
+	 */
+	alloc_addr = dma_alloc_attrs(ntb_dev, mw->alloc_size,
+				     &dma_addr, GFP_KERNEL,
+				     DMA_ATTR_FORCE_CONTIGUOUS);
 	if (!alloc_addr) {
-		dev_err(dma_dev, "Unable to alloc MW buff of size %zu\n",
+		dev_err(ntb_dev, "Unable to alloc MW buff of size %zu\n",
 			mw->alloc_size);
 		return -ENOMEM;
 	}
@@ -845,7 +858,7 @@
 	return 0;
 
 err:
-	dma_free_coherent(dma_dev, mw->alloc_size, alloc_addr, dma_addr);
+	dma_free_coherent(ntb_dev, mw->alloc_size, alloc_addr, dma_addr);
 
 	return rc;
 }
--- linux-qcom-6.8.0.orig/drivers/ntb/test/ntb_perf.c
+++ linux-qcom-6.8.0/drivers/ntb/test/ntb_perf.c
@@ -1227,7 +1227,7 @@
 			"\tOut buffer addr 0x%pK\n", peer->outbuf);
 
 		pos += scnprintf(buf + pos, buf_size - pos,
-			"\tOut buff phys addr %pa[p]\n", &peer->out_phys_addr);
+			"\tOut buff phys addr %pap\n", &peer->out_phys_addr);
 
 		pos += scnprintf(buf + pos, buf_size - pos,
 			"\tOut buffer size %pa\n", &peer->outbuf_size);
--- linux-qcom-6.8.0.orig/drivers/nvdimm/dax_devs.c
+++ linux-qcom-6.8.0/drivers/nvdimm/dax_devs.c
@@ -106,12 +106,12 @@
 
 	nvdimm_bus_lock(&ndns->dev);
 	nd_dax = nd_dax_alloc(nd_region);
-	nd_pfn = &nd_dax->nd_pfn;
-	dax_dev = nd_pfn_devinit(nd_pfn, ndns);
+	dax_dev = nd_dax_devinit(nd_dax, ndns);
 	nvdimm_bus_unlock(&ndns->dev);
 	if (!dax_dev)
 		return -ENOMEM;
 	pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+	nd_pfn = &nd_dax->nd_pfn;
 	nd_pfn->pfn_sb = pfn_sb;
 	rc = nd_pfn_validate(nd_pfn, DAX_SIG);
 	dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : "<none>");
--- linux-qcom-6.8.0.orig/drivers/nvdimm/namespace_devs.c
+++ linux-qcom-6.8.0/drivers/nvdimm/namespace_devs.c
@@ -1937,12 +1937,16 @@
 static struct device **scan_labels(struct nd_region *nd_region)
 {
 	int i, count = 0;
-	struct device *dev, **devs = NULL;
+	struct device *dev, **devs;
 	struct nd_label_ent *label_ent, *e;
 	struct nd_mapping *nd_mapping = &nd_region->mapping[0];
 	struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
 	resource_size_t map_end = nd_mapping->start + nd_mapping->size - 1;
 
+	devs = kcalloc(2, sizeof(dev), GFP_KERNEL);
+	if (!devs)
+		return NULL;
+
 	/* "safe" because create_namespace_pmem() might list_move() label_ent */
 	list_for_each_entry_safe(label_ent, e, &nd_mapping->labels, list) {
 		struct nd_namespace_label *nd_label = label_ent->label;
@@ -1961,12 +1965,14 @@
 			goto err;
 		if (i < count)
 			continue;
-		__devs = kcalloc(count + 2, sizeof(dev), GFP_KERNEL);
-		if (!__devs)
-			goto err;
-		memcpy(__devs, devs, sizeof(dev) * count);
-		kfree(devs);
-		devs = __devs;
+		if (count) {
+			__devs = kcalloc(count + 2, sizeof(dev), GFP_KERNEL);
+			if (!__devs)
+				goto err;
+			memcpy(__devs, devs, sizeof(dev) * count);
+			kfree(devs);
+			devs = __devs;
+		}
 
 		dev = create_namespace_pmem(nd_region, nd_mapping, nd_label);
 		if (IS_ERR(dev)) {
@@ -1993,11 +1999,6 @@
 
 		/* Publish a zero-sized namespace for userspace to configure. */
 		nd_mapping_free_labels(nd_mapping);
-
-		devs = kcalloc(2, sizeof(dev), GFP_KERNEL);
-		if (!devs)
-			goto err;
-
 		nspm = kzalloc(sizeof(*nspm), GFP_KERNEL);
 		if (!nspm)
 			goto err;
@@ -2036,11 +2037,10 @@
 	return devs;
 
  err:
-	if (devs) {
-		for (i = 0; devs[i]; i++)
-			namespace_pmem_release(devs[i]);
-		kfree(devs);
-	}
+	for (i = 0; devs[i]; i++)
+		namespace_pmem_release(devs[i]);
+	kfree(devs);
+
 	return NULL;
 }
 
--- linux-qcom-6.8.0.orig/drivers/nvdimm/nd.h
+++ linux-qcom-6.8.0/drivers/nvdimm/nd.h
@@ -601,6 +601,13 @@
 int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns);
 bool is_nd_dax(const struct device *dev);
 struct device *nd_dax_create(struct nd_region *nd_region);
+static inline struct device *nd_dax_devinit(struct nd_dax *nd_dax,
+					    struct nd_namespace_common *ndns)
+{
+	if (!nd_dax)
+		return NULL;
+	return nd_pfn_devinit(&nd_dax->nd_pfn, ndns);
+}
 #else
 static inline int nd_dax_probe(struct device *dev,
 		struct nd_namespace_common *ndns)
--- linux-qcom-6.8.0.orig/drivers/nvdimm/nd_virtio.c
+++ linux-qcom-6.8.0/drivers/nvdimm/nd_virtio.c
@@ -44,6 +44,15 @@
 	unsigned long flags;
 	int err, err1;
 
+	/*
+	 * Don't bother to submit the request to the device if the device is
+	 * not activated.
+	 */
+	if (vdev->config->get_status(vdev) & VIRTIO_CONFIG_S_NEEDS_RESET) {
+		dev_info(&vdev->dev, "virtio pmem device needs a reset\n");
+		return -EIO;
+	}
+
 	might_sleep();
 	req_data = kmalloc(sizeof(*req_data), GFP_KERNEL);
 	if (!req_data)
--- linux-qcom-6.8.0.orig/drivers/nvme/common/keyring.c
+++ linux-qcom-6.8.0/drivers/nvme/common/keyring.c
@@ -20,6 +20,28 @@
 }
 EXPORT_SYMBOL_GPL(nvme_keyring_id);
 
+static bool nvme_tls_psk_revoked(struct key *psk)
+{
+	return test_bit(KEY_FLAG_REVOKED, &psk->flags) ||
+		test_bit(KEY_FLAG_INVALIDATED, &psk->flags);
+}
+
+struct key *nvme_tls_key_lookup(key_serial_t key_id)
+{
+	struct key *key = key_lookup(key_id);
+
+	if (IS_ERR(key)) {
+		pr_err("key id %08x not found\n", key_id);
+		return key;
+	}
+	if (nvme_tls_psk_revoked(key)) {
+		pr_err("key id %08x revoked\n", key_id);
+		return ERR_PTR(-EKEYREVOKED);
+	}
+	return key;
+}
+EXPORT_SYMBOL_GPL(nvme_tls_key_lookup);
+
 static void nvme_tls_psk_describe(const struct key *key, struct seq_file *m)
 {
 	seq_puts(m, key->description);
@@ -36,14 +58,12 @@
 		pr_debug("%s: no key description\n", __func__);
 		return false;
 	}
-	match_len = strlen(key->description);
-	pr_debug("%s: id %s len %zd\n", __func__, key->description, match_len);
-
 	if (!match_data->raw_data) {
 		pr_debug("%s: no match data\n", __func__);
 		return false;
 	}
 	match_id = match_data->raw_data;
+	match_len = strlen(match_id);
 	pr_debug("%s: match '%s' '%s' len %zd\n",
 		 __func__, match_id, key->description, match_len);
 	return !memcmp(key->description, match_id, match_len);
@@ -71,7 +91,7 @@
 
 static struct key *nvme_tls_psk_lookup(struct key *keyring,
 		const char *hostnqn, const char *subnqn,
-		int hmac, bool generated)
+		u8 hmac, u8 psk_ver, bool generated)
 {
 	char *identity;
 	size_t identity_len = (NVMF_NQN_SIZE) * 2 + 11;
@@ -82,8 +102,8 @@
 	if (!identity)
 		return ERR_PTR(-ENOMEM);
 
-	snprintf(identity, identity_len, "NVMe0%c%02d %s %s",
-		 generated ? 'G' : 'R', hmac, hostnqn, subnqn);
+	snprintf(identity, identity_len, "NVMe%u%c%02u %s %s",
+		 psk_ver, generated ? 'G' : 'R', hmac, hostnqn, subnqn);
 
 	if (!keyring)
 		keyring = nvme_keyring;
@@ -107,21 +127,38 @@
 /*
  * NVMe PSK priority list
  *
- * 'Retained' PSKs (ie 'generated == false')
- * should be preferred to 'generated' PSKs,
- * and SHA-384 should be preferred to SHA-256.
+ * 'Retained' PSKs (ie 'generated == false') should be preferred to 'generated'
+ * PSKs, PSKs with hash (psk_ver 1) should be preferred to PSKs without hash
+ * (psk_ver 0), and SHA-384 should be preferred to SHA-256.
  */
 static struct nvme_tls_psk_priority_list {
 	bool generated;
+	u8 psk_ver;
 	enum nvme_tcp_tls_cipher cipher;
 } nvme_tls_psk_prio[] = {
 	{ .generated = false,
+	  .psk_ver = 1,
+	  .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
+	{ .generated = false,
+	  .psk_ver = 1,
+	  .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
+	{ .generated = false,
+	  .psk_ver = 0,
 	  .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
 	{ .generated = false,
+	  .psk_ver = 0,
+	  .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
+	{ .generated = true,
+	  .psk_ver = 1,
+	  .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
+	{ .generated = true,
+	  .psk_ver = 1,
 	  .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
 	{ .generated = true,
+	  .psk_ver = 0,
 	  .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
 	{ .generated = true,
+	  .psk_ver = 0,
 	  .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
 };
 
@@ -137,10 +174,11 @@
 
 	for (prio = 0; prio < ARRAY_SIZE(nvme_tls_psk_prio); prio++) {
 		bool generated = nvme_tls_psk_prio[prio].generated;
+		u8 ver = nvme_tls_psk_prio[prio].psk_ver;
 		enum nvme_tcp_tls_cipher cipher = nvme_tls_psk_prio[prio].cipher;
 
 		tls_key = nvme_tls_psk_lookup(keyring, hostnqn, subnqn,
-					      cipher, generated);
+					      cipher, ver, generated);
 		if (!IS_ERR(tls_key)) {
 			tls_key_id = tls_key->serial;
 			key_put(tls_key);
--- linux-qcom-6.8.0.orig/drivers/nvme/host/Kconfig
+++ linux-qcom-6.8.0/drivers/nvme/host/Kconfig
@@ -42,6 +42,7 @@
 
 config NVME_FABRICS
 	select NVME_CORE
+	select NVME_KEYRING if NVME_TCP_TLS
 	tristate
 
 config NVME_RDMA
@@ -95,7 +96,6 @@
 config NVME_TCP_TLS
 	bool "NVMe over Fabrics TCP TLS encryption support"
 	depends on NVME_TCP
-	select NVME_KEYRING
 	select NET_HANDSHAKE
 	select KEYS
 	help
@@ -110,6 +110,7 @@
 	bool "NVMe over Fabrics In-Band Authentication in host side"
 	depends on NVME_CORE
 	select NVME_AUTH
+	select NVME_KEYRING if NVME_TCP_TLS
 	help
 	  This provides support for NVMe over Fabrics In-Band Authentication in
 	  host side.
--- linux-qcom-6.8.0.orig/drivers/nvme/host/apple.c
+++ linux-qcom-6.8.0/drivers/nvme/host/apple.c
@@ -1388,7 +1388,7 @@
 	mempool_destroy(data);
 }
 
-static int apple_nvme_probe(struct platform_device *pdev)
+static struct apple_nvme *apple_nvme_alloc(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct apple_nvme *anv;
@@ -1396,7 +1396,7 @@
 
 	anv = devm_kzalloc(dev, sizeof(*anv), GFP_KERNEL);
 	if (!anv)
-		return -ENOMEM;
+		return ERR_PTR(-ENOMEM);
 
 	anv->dev = get_device(dev);
 	anv->adminq.is_adminq = true;
@@ -1516,10 +1516,26 @@
 		goto put_dev;
 	}
 
+	return anv;
+put_dev:
+	put_device(anv->dev);
+	return ERR_PTR(ret);
+}
+
+static int apple_nvme_probe(struct platform_device *pdev)
+{
+	struct apple_nvme *anv;
+	int ret;
+
+	anv = apple_nvme_alloc(pdev);
+	if (IS_ERR(anv))
+		return PTR_ERR(anv);
+
 	anv->ctrl.admin_q = blk_mq_init_queue(&anv->admin_tagset);
 	if (IS_ERR(anv->ctrl.admin_q)) {
 		ret = -ENOMEM;
-		goto put_dev;
+		anv->ctrl.admin_q = NULL;
+		goto out_uninit_ctrl;
 	}
 
 	nvme_reset_ctrl(&anv->ctrl);
@@ -1527,8 +1543,9 @@
 
 	return 0;
 
-put_dev:
-	put_device(anv->dev);
+out_uninit_ctrl:
+	nvme_uninit_ctrl(&anv->ctrl);
+	nvme_put_ctrl(&anv->ctrl);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/nvme/host/constants.c
+++ linux-qcom-6.8.0/drivers/nvme/host/constants.c
@@ -173,7 +173,7 @@
 
 const char *nvme_get_error_status_str(u16 status)
 {
-	status &= 0x7ff;
+	status &= NVME_SCT_SC_MASK;
 	if (status < ARRAY_SIZE(nvme_statuses) && nvme_statuses[status])
 		return nvme_statuses[status];
 	return "Unknown";
--- linux-qcom-6.8.0.orig/drivers/nvme/host/core.c
+++ linux-qcom-6.8.0/drivers/nvme/host/core.c
@@ -110,7 +110,7 @@
 EXPORT_SYMBOL_GPL(nvme_delete_wq);
 
 static LIST_HEAD(nvme_subsystems);
-static DEFINE_MUTEX(nvme_subsystems_lock);
+DEFINE_MUTEX(nvme_subsystems_lock);
 
 static DEFINE_IDA(nvme_instance_ida);
 static dev_t nvme_ctrl_base_chr_devt;
@@ -252,7 +252,7 @@
 
 static blk_status_t nvme_error_status(u16 status)
 {
-	switch (status & 0x7ff) {
+	switch (status & NVME_SCT_SC_MASK) {
 	case NVME_SC_SUCCESS:
 		return BLK_STS_OK;
 	case NVME_SC_CAP_EXCEEDED:
@@ -298,7 +298,7 @@
 	u16 crd;
 
 	/* The mask and shift result must be <= 3 */
-	crd = (nvme_req(req)->status & NVME_SC_CRD) >> 11;
+	crd = (nvme_req(req)->status & NVME_STATUS_CRD) >> 11;
 	if (crd)
 		delay = nvme_req(req)->ctrl->crdt[crd - 1] * 100;
 
@@ -320,10 +320,10 @@
 		       nvme_sect_to_lba(ns->head, blk_rq_pos(req)),
 		       blk_rq_bytes(req) >> ns->head->lba_shift,
 		       nvme_get_error_status_str(nr->status),
-		       nr->status >> 8 & 7,	/* Status Code Type */
-		       nr->status & 0xff,	/* Status Code */
-		       nr->status & NVME_SC_MORE ? "MORE " : "",
-		       nr->status & NVME_SC_DNR  ? "DNR "  : "");
+		       NVME_SCT(nr->status),		/* Status Code Type */
+		       nr->status & NVME_SC_MASK,	/* Status Code */
+		       nr->status & NVME_STATUS_MORE ? "MORE " : "",
+		       nr->status & NVME_STATUS_DNR  ? "DNR "  : "");
 		return;
 	}
 
@@ -332,10 +332,10 @@
 			   nvme_get_admin_opcode_str(nr->cmd->common.opcode),
 			   nr->cmd->common.opcode,
 			   nvme_get_error_status_str(nr->status),
-			   nr->status >> 8 & 7,	/* Status Code Type */
-			   nr->status & 0xff,	/* Status Code */
-			   nr->status & NVME_SC_MORE ? "MORE " : "",
-			   nr->status & NVME_SC_DNR  ? "DNR "  : "");
+			   NVME_SCT(nr->status),	/* Status Code Type */
+			   nr->status & NVME_SC_MASK,	/* Status Code */
+			   nr->status & NVME_STATUS_MORE ? "MORE " : "",
+			   nr->status & NVME_STATUS_DNR  ? "DNR "  : "");
 }
 
 static void nvme_log_err_passthru(struct request *req)
@@ -350,10 +350,10 @@
 		     nvme_get_admin_opcode_str(nr->cmd->common.opcode),
 		nr->cmd->common.opcode,
 		nvme_get_error_status_str(nr->status),
-		nr->status >> 8 & 7,	/* Status Code Type */
-		nr->status & 0xff,	/* Status Code */
-		nr->status & NVME_SC_MORE ? "MORE " : "",
-		nr->status & NVME_SC_DNR  ? "DNR "  : "",
+		NVME_SCT(nr->status),		/* Status Code Type */
+		nr->status & NVME_SC_MASK,	/* Status Code */
+		nr->status & NVME_STATUS_MORE ? "MORE " : "",
+		nr->status & NVME_STATUS_DNR  ? "DNR "  : "",
 		nr->cmd->common.cdw10,
 		nr->cmd->common.cdw11,
 		nr->cmd->common.cdw12,
@@ -374,11 +374,11 @@
 	if (likely(nvme_req(req)->status == 0))
 		return COMPLETE;
 
-	if ((nvme_req(req)->status & 0x7ff) == NVME_SC_AUTH_REQUIRED)
+	if ((nvme_req(req)->status & NVME_SCT_SC_MASK) == NVME_SC_AUTH_REQUIRED)
 		return AUTHENTICATE;
 
 	if (blk_noretry_request(req) ||
-	    (nvme_req(req)->status & NVME_SC_DNR) ||
+	    (nvme_req(req)->status & NVME_STATUS_DNR) ||
 	    nvme_req(req)->retries >= nvme_max_retries)
 		return COMPLETE;
 
@@ -405,7 +405,15 @@
 	}
 }
 
-static inline void nvme_end_req(struct request *req)
+static inline void __nvme_end_req(struct request *req)
+{
+	nvme_end_req_zoned(req);
+	nvme_trace_bio_complete(req);
+	if (req->cmd_flags & REQ_NVME_MPATH)
+		nvme_mpath_end_request(req);
+}
+
+void nvme_end_req(struct request *req)
 {
 	blk_status_t status = nvme_error_status(nvme_req(req)->status);
 
@@ -415,10 +423,7 @@
 		else
 			nvme_log_error(req);
 	}
-	nvme_end_req_zoned(req);
-	nvme_trace_bio_complete(req);
-	if (req->cmd_flags & REQ_NVME_MPATH)
-		nvme_mpath_end_request(req);
+	__nvme_end_req(req);
 	blk_mq_end_request(req, status);
 }
 
@@ -467,7 +472,7 @@
 {
 	trace_nvme_complete_rq(req);
 	nvme_cleanup_cmd(req);
-	nvme_end_req_zoned(req);
+	__nvme_end_req(req);
 }
 EXPORT_SYMBOL_GPL(nvme_complete_batch_req);
 
@@ -620,27 +625,6 @@
 EXPORT_SYMBOL_GPL(nvme_change_ctrl_state);
 
 /*
- * Returns true for sink states that can't ever transition back to live.
- */
-static bool nvme_state_terminal(struct nvme_ctrl *ctrl)
-{
-	switch (nvme_ctrl_state(ctrl)) {
-	case NVME_CTRL_NEW:
-	case NVME_CTRL_LIVE:
-	case NVME_CTRL_RESETTING:
-	case NVME_CTRL_CONNECTING:
-		return false;
-	case NVME_CTRL_DELETING:
-	case NVME_CTRL_DELETING_NOIO:
-	case NVME_CTRL_DEAD:
-		return true;
-	default:
-		WARN_ONCE(1, "Unhandled ctrl state:%d", ctrl->state);
-		return true;
-	}
-}
-
-/*
  * Waits for the controller state to be resetting, or returns false if it is
  * not possible to ever transition to that state.
  */
@@ -685,7 +669,7 @@
 	kfree(ns);
 }
 
-static inline bool nvme_get_ns(struct nvme_ns *ns)
+bool nvme_get_ns(struct nvme_ns *ns)
 {
 	return kref_get_unless_zero(&ns->kref);
 }
@@ -1005,6 +989,7 @@
 			clear_bit_unlock(0, &ctrl->discard_page_busy);
 		else
 			kfree(bvec_virt(&req->special_vec));
+		req->rq_flags &= ~RQF_SPECIAL_PAYLOAD;
 	}
 }
 EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);
@@ -1230,7 +1215,7 @@
 
 /*
  * Recommended frequency for KATO commands per NVMe 1.4 section 7.12.1:
- * 
+ *
  *   The host should send Keep Alive commands at half of the Keep Alive Timeout
  *   accounting for transport roundtrip times [..].
  */
@@ -1267,10 +1252,9 @@
 						 blk_status_t status)
 {
 	struct nvme_ctrl *ctrl = rq->end_io_data;
-	unsigned long flags;
-	bool startka = false;
 	unsigned long rtt = jiffies - (rq->deadline - rq->timeout);
 	unsigned long delay = nvme_keep_alive_work_period(ctrl);
+	enum nvme_ctrl_state state = nvme_ctrl_state(ctrl);
 
 	/*
 	 * Subtract off the keepalive RTT so nvme_keep_alive_work runs
@@ -1295,12 +1279,7 @@
 
 	ctrl->ka_last_check_time = jiffies;
 	ctrl->comp_seen = false;
-	spin_lock_irqsave(&ctrl->lock, flags);
-	if (ctrl->state == NVME_CTRL_LIVE ||
-	    ctrl->state == NVME_CTRL_CONNECTING)
-		startka = true;
-	spin_unlock_irqrestore(&ctrl->lock, flags);
-	if (startka)
+	if (state == NVME_CTRL_LIVE || state == NVME_CTRL_CONNECTING)
 		queue_delayed_work(nvme_wq, &ctrl->ka_work, delay);
 	return RQ_END_IO_NONE;
 }
@@ -1398,8 +1377,10 @@
 
 	error = nvme_submit_sync_cmd(dev->admin_q, &c, *id,
 			sizeof(struct nvme_id_ctrl));
-	if (error)
+	if (error) {
 		kfree(*id);
+		*id = NULL;
+	}
 	return error;
 }
 
@@ -1528,6 +1509,7 @@
 	if (error) {
 		dev_warn(ctrl->device, "Identify namespace failed (%d)\n", error);
 		kfree(*id);
+		*id = NULL;
 	}
 	return error;
 }
@@ -2342,8 +2324,13 @@
 	else
 		ctrl->ctrl_config = NVME_CC_CSS_NVM;
 
-	if (ctrl->cap & NVME_CAP_CRMS_CRWMS && ctrl->cap & NVME_CAP_CRMS_CRIMS)
-		ctrl->ctrl_config |= NVME_CC_CRIME;
+	/*
+	 * Setting CRIME results in CSTS.RDY before the media is ready. This
+	 * makes it possible for media related commands to return the error
+	 * NVME_SC_ADMIN_COMMAND_MEDIA_NOT_READY. Until the driver is
+	 * restructured to handle retries, disable CC.CRIME.
+	 */
+	ctrl->ctrl_config &= ~NVME_CC_CRIME;
 
 	ctrl->ctrl_config |= (NVME_CTRL_PAGE_SHIFT - 12) << NVME_CC_MPS_SHIFT;
 	ctrl->ctrl_config |= NVME_CC_AMS_RR | NVME_CC_SHN_NONE;
@@ -2378,10 +2365,7 @@
 		 * devices are known to get this wrong. Use the larger of the
 		 * two values.
 		 */
-		if (ctrl->ctrl_config & NVME_CC_CRIME)
-			ready_timeout = NVME_CRTO_CRIMT(crto);
-		else
-			ready_timeout = NVME_CRTO_CRWMT(crto);
+		ready_timeout = NVME_CRTO_CRWMT(crto);
 
 		if (ready_timeout < timeout)
 			dev_warn_once(ctrl->device, "bad crto:%x cap:%llx\n",
@@ -3630,7 +3614,7 @@
 				"Found shared namespace %d, but multipathing not supported.\n",
 				info->nsid);
 			dev_warn_once(ctrl->device,
-				"Support for shared namespaces without CONFIG_NVME_MULTIPATH is deprecated and will be removed in Linux 6.0\n.");
+				"Support for shared namespaces without CONFIG_NVME_MULTIPATH is deprecated and will be removed in Linux 6.0.\n");
 		}
 	}
 
@@ -3649,9 +3633,11 @@
 struct nvme_ns *nvme_find_get_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 {
 	struct nvme_ns *ns, *ret = NULL;
+	int srcu_idx;
 
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list) {
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu)) {
 		if (ns->head->ns_id == nsid) {
 			if (!nvme_get_ns(ns))
 				continue;
@@ -3661,7 +3647,7 @@
 		if (ns->head->ns_id > nsid)
 			break;
 	}
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 	return ret;
 }
 EXPORT_SYMBOL_NS_GPL(nvme_find_get_ns, NVME_TARGET_PASSTHRU);
@@ -3675,7 +3661,7 @@
 
 	list_for_each_entry_reverse(tmp, &ns->ctrl->namespaces, list) {
 		if (tmp->head->ns_id < ns->head->ns_id) {
-			list_add(&ns->list, &tmp->list);
+			list_add_rcu(&ns->list, &tmp->list);
 			return;
 		}
 	}
@@ -3741,17 +3727,18 @@
 	if (nvme_update_ns_info(ns, info))
 		goto out_unlink_ns;
 
-	down_write(&ctrl->namespaces_rwsem);
+	mutex_lock(&ctrl->namespaces_lock);
 	/*
 	 * Ensure that no namespaces are added to the ctrl list after the queues
 	 * are frozen, thereby avoiding a deadlock between scan and reset.
 	 */
 	if (test_bit(NVME_CTRL_FROZEN, &ctrl->flags)) {
-		up_write(&ctrl->namespaces_rwsem);
+		mutex_unlock(&ctrl->namespaces_lock);
 		goto out_unlink_ns;
 	}
 	nvme_ns_add_to_ctrl_list(ns);
-	up_write(&ctrl->namespaces_rwsem);
+	mutex_unlock(&ctrl->namespaces_lock);
+	synchronize_srcu(&ctrl->srcu);
 	nvme_get_ctrl(ctrl);
 
 	if (device_add_disk(ctrl->device, ns->disk, nvme_ns_attr_groups))
@@ -3774,9 +3761,10 @@
 
  out_cleanup_ns_from_list:
 	nvme_put_ctrl(ctrl);
-	down_write(&ctrl->namespaces_rwsem);
-	list_del_init(&ns->list);
-	up_write(&ctrl->namespaces_rwsem);
+	mutex_lock(&ctrl->namespaces_lock);
+	list_del_rcu(&ns->list);
+	mutex_unlock(&ctrl->namespaces_lock);
+	synchronize_srcu(&ctrl->srcu);
  out_unlink_ns:
 	mutex_lock(&ctrl->subsys->lock);
 	list_del_rcu(&ns->siblings);
@@ -3826,9 +3814,10 @@
 		nvme_cdev_del(&ns->cdev, &ns->cdev_device);
 	del_gendisk(ns->disk);
 
-	down_write(&ns->ctrl->namespaces_rwsem);
-	list_del_init(&ns->list);
-	up_write(&ns->ctrl->namespaces_rwsem);
+	mutex_lock(&ns->ctrl->namespaces_lock);
+	list_del_rcu(&ns->list);
+	mutex_unlock(&ns->ctrl->namespaces_lock);
+	synchronize_srcu(&ns->ctrl->srcu);
 
 	if (last_path)
 		nvme_mpath_shutdown_disk(ns->head);
@@ -3847,7 +3836,7 @@
 
 static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_info *info)
 {
-	int ret = NVME_SC_INVALID_NS | NVME_SC_DNR;
+	int ret = NVME_SC_INVALID_NS | NVME_STATUS_DNR;
 
 	if (!nvme_ns_ids_equal(&ns->head->ids, &info->ids)) {
 		dev_err(ns->ctrl->device,
@@ -3863,7 +3852,7 @@
 	 *
 	 * TODO: we should probably schedule a delayed retry here.
 	 */
-	if (ret > 0 && (ret & NVME_SC_DNR))
+	if (ret > 0 && (ret & NVME_STATUS_DNR))
 		nvme_ns_remove(ns);
 }
 
@@ -3918,16 +3907,18 @@
 	struct nvme_ns *ns, *next;
 	LIST_HEAD(rm_list);
 
-	down_write(&ctrl->namespaces_rwsem);
+	mutex_lock(&ctrl->namespaces_lock);
 	list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
-		if (ns->head->ns_id > nsid)
-			list_move_tail(&ns->list, &rm_list);
+		if (ns->head->ns_id > nsid) {
+			list_del_rcu(&ns->list);
+			synchronize_srcu(&ctrl->srcu);
+			list_add_tail_rcu(&ns->list, &rm_list);
+		}
 	}
-	up_write(&ctrl->namespaces_rwsem);
+	mutex_unlock(&ctrl->namespaces_lock);
 
 	list_for_each_entry_safe(ns, next, &rm_list, list)
 		nvme_ns_remove(ns);
-
 }
 
 static int nvme_scan_ns_list(struct nvme_ctrl *ctrl)
@@ -4053,7 +4044,7 @@
 		 * they report) but don't actually support it.
 		 */
 		ret = nvme_scan_ns_list(ctrl);
-		if (ret > 0 && ret & NVME_SC_DNR)
+		if (ret > 0 && ret & NVME_STATUS_DNR)
 			nvme_scan_ns_sequential(ctrl);
 	}
 	mutex_unlock(&ctrl->scan_lock);
@@ -4097,9 +4088,10 @@
 	/* this is a no-op when called from the controller reset handler */
 	nvme_change_ctrl_state(ctrl, NVME_CTRL_DELETING_NOIO);
 
-	down_write(&ctrl->namespaces_rwsem);
-	list_splice_init(&ctrl->namespaces, &ns_list);
-	up_write(&ctrl->namespaces_rwsem);
+	mutex_lock(&ctrl->namespaces_lock);
+	list_splice_init_rcu(&ctrl->namespaces, &ns_list, synchronize_rcu);
+	mutex_unlock(&ctrl->namespaces_lock);
+	synchronize_srcu(&ctrl->srcu);
 
 	list_for_each_entry_safe(ns, next, &ns_list, list)
 		nvme_ns_remove(ns);
@@ -4359,7 +4351,8 @@
 	set->ops = ops;
 	set->queue_depth = NVME_AQ_MQ_TAG_DEPTH;
 	if (ctrl->ops->flags & NVME_F_FABRICS)
-		set->reserved_tags = NVMF_RESERVED_TAGS;
+		/* Reserved for fabric connect and keep alive */
+		set->reserved_tags = 2;
 	set->numa_node = ctrl->numa_node;
 	set->flags = BLK_MQ_F_NO_SCHED;
 	if (ctrl->ops->flags & NVME_F_BLOCKING)
@@ -4402,6 +4395,11 @@
 
 void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl)
 {
+	/*
+	 * As we're about to destroy the queue and free tagset
+	 * we can not have keep-alive work running.
+	 */
+	nvme_stop_keep_alive(ctrl);
 	blk_mq_destroy_queue(ctrl->admin_q);
 	blk_put_queue(ctrl->admin_q);
 	if (ctrl->ops->flags & NVME_F_FABRICS) {
@@ -4428,7 +4426,8 @@
 	if (ctrl->quirks & NVME_QUIRK_SHARED_TAGS)
 		set->reserved_tags = NVME_AQ_DEPTH;
 	else if (ctrl->ops->flags & NVME_F_FABRICS)
-		set->reserved_tags = NVMF_RESERVED_TAGS;
+		/* Reserved for fabric connect */
+		set->reserved_tags = 1;
 	set->numa_node = ctrl->numa_node;
 	set->flags = BLK_MQ_F_SHOULD_MERGE;
 	if (ctrl->ops->flags & NVME_F_BLOCKING)
@@ -4476,7 +4475,6 @@
 {
 	nvme_mpath_stop(ctrl);
 	nvme_auth_stop(ctrl);
-	nvme_stop_keep_alive(ctrl);
 	nvme_stop_failfast_work(ctrl);
 	flush_work(&ctrl->async_event_work);
 	cancel_work_sync(&ctrl->fw_act_work);
@@ -4512,6 +4510,7 @@
 
 void nvme_uninit_ctrl(struct nvme_ctrl *ctrl)
 {
+	nvme_stop_keep_alive(ctrl);
 	nvme_hwmon_exit(ctrl);
 	nvme_fault_inject_fini(&ctrl->fault_inject);
 	dev_pm_qos_hide_latency_tolerance(ctrl->device);
@@ -4541,9 +4540,9 @@
 
 	if (!subsys || ctrl->instance != subsys->instance)
 		ida_free(&nvme_instance_ida, ctrl->instance);
-	key_put(ctrl->tls_key);
 	nvme_free_cels(ctrl);
 	nvme_mpath_uninit(ctrl);
+	cleanup_srcu_struct(&ctrl->srcu);
 	nvme_auth_stop(ctrl);
 	nvme_auth_free(ctrl);
 	__free_page(ctrl->discard_page);
@@ -4576,10 +4575,15 @@
 	ctrl->passthru_err_log_enabled = false;
 	clear_bit(NVME_CTRL_FAILFAST_EXPIRED, &ctrl->flags);
 	spin_lock_init(&ctrl->lock);
+	mutex_init(&ctrl->namespaces_lock);
+
+	ret = init_srcu_struct(&ctrl->srcu);
+	if (ret)
+		return ret;
+
 	mutex_init(&ctrl->scan_lock);
 	INIT_LIST_HEAD(&ctrl->namespaces);
 	xa_init(&ctrl->cels);
-	init_rwsem(&ctrl->namespaces_rwsem);
 	ctrl->dev = dev;
 	ctrl->ops = ops;
 	ctrl->quirks = quirks;
@@ -4659,6 +4663,7 @@
 out:
 	if (ctrl->discard_page)
 		__free_page(ctrl->discard_page);
+	cleanup_srcu_struct(&ctrl->srcu);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(nvme_init_ctrl);
@@ -4667,22 +4672,26 @@
 void nvme_mark_namespaces_dead(struct nvme_ctrl *ctrl)
 {
 	struct nvme_ns *ns;
+	int srcu_idx;
 
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list)
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu))
 		blk_mark_disk_dead(ns->disk);
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 }
 EXPORT_SYMBOL_GPL(nvme_mark_namespaces_dead);
 
 void nvme_unfreeze(struct nvme_ctrl *ctrl)
 {
 	struct nvme_ns *ns;
+	int srcu_idx;
 
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list)
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu))
 		blk_mq_unfreeze_queue(ns->queue);
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 	clear_bit(NVME_CTRL_FROZEN, &ctrl->flags);
 }
 EXPORT_SYMBOL_GPL(nvme_unfreeze);
@@ -4690,14 +4699,16 @@
 int nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
 {
 	struct nvme_ns *ns;
+	int srcu_idx;
 
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list) {
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu)) {
 		timeout = blk_mq_freeze_queue_wait_timeout(ns->queue, timeout);
 		if (timeout <= 0)
 			break;
 	}
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 	return timeout;
 }
 EXPORT_SYMBOL_GPL(nvme_wait_freeze_timeout);
@@ -4705,23 +4716,27 @@
 void nvme_wait_freeze(struct nvme_ctrl *ctrl)
 {
 	struct nvme_ns *ns;
+	int srcu_idx;
 
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list)
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu))
 		blk_mq_freeze_queue_wait(ns->queue);
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 }
 EXPORT_SYMBOL_GPL(nvme_wait_freeze);
 
 void nvme_start_freeze(struct nvme_ctrl *ctrl)
 {
 	struct nvme_ns *ns;
+	int srcu_idx;
 
 	set_bit(NVME_CTRL_FROZEN, &ctrl->flags);
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list)
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu))
 		blk_freeze_queue_start(ns->queue);
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 }
 EXPORT_SYMBOL_GPL(nvme_start_freeze);
 
@@ -4764,11 +4779,13 @@
 void nvme_sync_io_queues(struct nvme_ctrl *ctrl)
 {
 	struct nvme_ns *ns;
+	int srcu_idx;
 
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list)
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu))
 		blk_sync_queue(ns->queue);
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 }
 EXPORT_SYMBOL_GPL(nvme_sync_io_queues);
 
--- linux-qcom-6.8.0.orig/drivers/nvme/host/fabrics.c
+++ linux-qcom-6.8.0/drivers/nvme/host/fabrics.c
@@ -180,14 +180,14 @@
 	cmd.prop_get.offset = cpu_to_le32(off);
 
 	ret = __nvme_submit_sync_cmd(ctrl->fabrics_q, &cmd, &res, NULL, 0,
-			NVME_QID_ANY, 0);
+			NVME_QID_ANY, NVME_SUBMIT_RESERVED);
 
 	if (ret >= 0)
 		*val = le64_to_cpu(res.u64);
 	if (unlikely(ret != 0))
 		dev_err(ctrl->device,
 			"Property Get error: %d, offset %#x\n",
-			ret > 0 ? ret & ~NVME_SC_DNR : ret, off);
+			ret > 0 ? ret & ~NVME_STATUS_DNR : ret, off);
 
 	return ret;
 }
@@ -226,14 +226,14 @@
 	cmd.prop_get.offset = cpu_to_le32(off);
 
 	ret = __nvme_submit_sync_cmd(ctrl->fabrics_q, &cmd, &res, NULL, 0,
-			NVME_QID_ANY, 0);
+			NVME_QID_ANY, NVME_SUBMIT_RESERVED);
 
 	if (ret >= 0)
 		*val = le64_to_cpu(res.u64);
 	if (unlikely(ret != 0))
 		dev_err(ctrl->device,
 			"Property Get error: %d, offset %#x\n",
-			ret > 0 ? ret & ~NVME_SC_DNR : ret, off);
+			ret > 0 ? ret & ~NVME_STATUS_DNR : ret, off);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(nvmf_reg_read64);
@@ -271,11 +271,11 @@
 	cmd.prop_set.value = cpu_to_le64(val);
 
 	ret = __nvme_submit_sync_cmd(ctrl->fabrics_q, &cmd, NULL, NULL, 0,
-			NVME_QID_ANY, 0);
+			NVME_QID_ANY, NVME_SUBMIT_RESERVED);
 	if (unlikely(ret))
 		dev_err(ctrl->device,
 			"Property Set error: %d, offset %#x\n",
-			ret > 0 ? ret & ~NVME_SC_DNR : ret, off);
+			ret > 0 ? ret & ~NVME_STATUS_DNR : ret, off);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(nvmf_reg_write32);
@@ -295,7 +295,7 @@
 		int errval, int offset, struct nvme_command *cmd,
 		struct nvmf_connect_data *data)
 {
-	int err_sctype = errval & ~NVME_SC_DNR;
+	int err_sctype = errval & ~NVME_STATUS_DNR;
 
 	if (errval < 0) {
 		dev_err(ctrl->device,
@@ -637,8 +637,8 @@
 		return ERR_PTR(-EINVAL);
 	}
 
-	key = key_lookup(key_id);
-	if (!IS_ERR(key))
+	key = nvme_tls_key_lookup(key_id);
+	if (IS_ERR(key))
 		pr_err("key id %08x not found\n", key_id);
 	else
 		pr_debug("Using key id %08x\n", key_id);
--- linux-qcom-6.8.0.orig/drivers/nvme/host/fabrics.h
+++ linux-qcom-6.8.0/drivers/nvme/host/fabrics.h
@@ -19,13 +19,6 @@
 #define NVMF_DEF_FAIL_FAST_TMO		-1
 
 /*
- * Reserved one command for internal usage.  This command is used for sending
- * the connect command, as well as for the keep alive command on the admin
- * queue once live.
- */
-#define NVMF_RESERVED_TAGS	1
-
-/*
  * Define a host as seen by the target.  We allocate one at boot, but also
  * allow the override it when creating controllers.  This is both to provide
  * persistence of the Host NQN over multiple boots, and to allow using
--- linux-qcom-6.8.0.orig/drivers/nvme/host/fault_inject.c
+++ linux-qcom-6.8.0/drivers/nvme/host/fault_inject.c
@@ -75,7 +75,7 @@
 		/* inject status code and DNR bit */
 		status = fault_inject->status;
 		if (fault_inject->dont_retry)
-			status |= NVME_SC_DNR;
+			status |= NVME_STATUS_DNR;
 		nvme_req(req)->status =	status;
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/nvme/host/fc.c
+++ linux-qcom-6.8.0/drivers/nvme/host/fc.c
@@ -3132,7 +3132,7 @@
 	if (ctrl->ctrl.icdoff) {
 		dev_err(ctrl->ctrl.device, "icdoff %d is not supported!\n",
 				ctrl->ctrl.icdoff);
-		ret = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		ret = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto out_stop_keep_alive;
 	}
 
@@ -3140,7 +3140,7 @@
 	if (!nvme_ctrl_sgl_supported(&ctrl->ctrl)) {
 		dev_err(ctrl->ctrl.device,
 			"Mandatory sgls are not supported!\n");
-		ret = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		ret = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto out_stop_keep_alive;
 	}
 
@@ -3310,7 +3310,7 @@
 		dev_info(ctrl->ctrl.device,
 			"NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n",
 			ctrl->cnum, status);
-		if (status > 0 && (status & NVME_SC_DNR))
+		if (status > 0 && (status & NVME_STATUS_DNR))
 			recon = false;
 	} else if (time_after_eq(jiffies, rport->dev_loss_end))
 		recon = false;
@@ -3327,7 +3327,7 @@
 		queue_delayed_work(nvme_wq, &ctrl->connect_work, recon_delay);
 	} else {
 		if (portptr->port_state == FC_OBJSTATE_ONLINE) {
-			if (status > 0 && (status & NVME_SC_DNR))
+			if (status > 0 && (status & NVME_STATUS_DNR))
 				dev_warn(ctrl->ctrl.device,
 					 "NVME-FC{%d}: reconnect failure\n",
 					 ctrl->cnum);
--- linux-qcom-6.8.0.orig/drivers/nvme/host/ioctl.c
+++ linux-qcom-6.8.0/drivers/nvme/host/ioctl.c
@@ -3,6 +3,7 @@
  * Copyright (c) 2011-2014, Intel Corporation.
  * Copyright (c) 2017-2021 Christoph Hellwig.
  */
+#include <linux/blk-integrity.h>
 #include <linux/ptrace.h>	/* for force_successful_syscall_return */
 #include <linux/nvme_ioctl.h>
 #include <linux/io_uring/cmd.h>
@@ -118,9 +119,14 @@
 	struct request_queue *q = req->q;
 	struct nvme_ns *ns = q->queuedata;
 	struct block_device *bdev = ns ? ns->disk->part0 : NULL;
+	bool supports_metadata = bdev && blk_get_integrity(bdev->bd_disk);
+	bool has_metadata = meta_buffer && meta_len;
 	struct bio *bio = NULL;
 	int ret;
 
+	if (has_metadata && !supports_metadata)
+		return -EINVAL;
+
 	if (ioucmd && (ioucmd->flags & IORING_URING_CMD_FIXED)) {
 		struct iov_iter iter;
 
@@ -142,15 +148,15 @@
 		goto out;
 
 	bio = req->bio;
-	if (bdev) {
+	if (bdev)
 		bio_set_dev(bio, bdev);
-		if (meta_buffer && meta_len) {
-			ret = bio_integrity_map_user(bio, meta_buffer, meta_len,
-						     meta_seed);
-			if (ret)
-				goto out_unmap;
-			req->cmd_flags |= REQ_INTEGRITY;
-		}
+
+	if (has_metadata) {
+		ret = bio_integrity_map_user(bio, meta_buffer, meta_len,
+					     meta_seed);
+		if (ret)
+			goto out_unmap;
+		req->cmd_flags |= REQ_INTEGRITY;
 	}
 
 	return ret;
@@ -416,10 +422,13 @@
 	struct io_uring_cmd *ioucmd = req->end_io_data;
 	struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd);
 
-	if (nvme_req(req)->flags & NVME_REQ_CANCELLED)
+	if (nvme_req(req)->flags & NVME_REQ_CANCELLED) {
 		pdu->status = -EINTR;
-	else
+	} else {
 		pdu->status = nvme_req(req)->status;
+		if (!pdu->status)
+			pdu->status = blk_status_to_errno(err);
+	}
 	pdu->result = le64_to_cpu(nvme_req(req)->result.u64);
 
 	/*
@@ -782,15 +791,15 @@
 		bool open_for_write)
 {
 	struct nvme_ns *ns;
-	int ret;
+	int ret, srcu_idx;
 
-	down_read(&ctrl->namespaces_rwsem);
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
 	if (list_empty(&ctrl->namespaces)) {
 		ret = -ENOTTY;
 		goto out_unlock;
 	}
 
-	ns = list_first_entry(&ctrl->namespaces, struct nvme_ns, list);
+	ns = list_first_or_null_rcu(&ctrl->namespaces, struct nvme_ns, list);
 	if (ns != list_last_entry(&ctrl->namespaces, struct nvme_ns, list)) {
 		dev_warn(ctrl->device,
 			"NVME_IOCTL_IO_CMD not supported when multiple namespaces present!\n");
@@ -800,15 +809,18 @@
 
 	dev_warn(ctrl->device,
 		"using deprecated NVME_IOCTL_IO_CMD ioctl on the char device!\n");
-	kref_get(&ns->kref);
-	up_read(&ctrl->namespaces_rwsem);
+	if (!nvme_get_ns(ns)) {
+		ret = -ENXIO;
+		goto out_unlock;
+	}
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 
 	ret = nvme_user_cmd(ctrl, ns, argp, 0, open_for_write);
 	nvme_put_ns(ns);
 	return ret;
 
 out_unlock:
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/nvme/host/multipath.c
+++ linux-qcom-6.8.0/drivers/nvme/host/multipath.c
@@ -17,6 +17,7 @@
 static const char *nvme_iopolicy_names[] = {
 	[NVME_IOPOLICY_NUMA]	= "numa",
 	[NVME_IOPOLICY_RR]	= "round-robin",
+	[NVME_IOPOLICY_QD]      = "queue-depth",
 };
 
 static int iopolicy = NVME_IOPOLICY_NUMA;
@@ -29,6 +30,8 @@
 		iopolicy = NVME_IOPOLICY_NUMA;
 	else if (!strncmp(val, "round-robin", 11))
 		iopolicy = NVME_IOPOLICY_RR;
+	else if (!strncmp(val, "queue-depth", 11))
+		iopolicy = NVME_IOPOLICY_QD;
 	else
 		return -EINVAL;
 
@@ -43,7 +46,7 @@
 module_param_call(iopolicy, nvme_set_iopolicy, nvme_get_iopolicy,
 	&iopolicy, 0644);
 MODULE_PARM_DESC(iopolicy,
-	"Default multipath I/O policy; 'numa' (default) or 'round-robin'");
+	"Default multipath I/O policy; 'numa' (default), 'round-robin' or 'queue-depth'");
 
 void nvme_mpath_default_iopolicy(struct nvme_subsystem *subsys)
 {
@@ -83,7 +86,7 @@
 void nvme_failover_req(struct request *req)
 {
 	struct nvme_ns *ns = req->q->queuedata;
-	u16 status = nvme_req(req)->status & 0x7ff;
+	u16 status = nvme_req(req)->status & NVME_SCT_SC_MASK;
 	unsigned long flags;
 	struct bio *bio;
 
@@ -118,7 +121,8 @@
 	blk_steal_bios(&ns->head->requeue_list, req);
 	spin_unlock_irqrestore(&ns->head->requeue_lock, flags);
 
-	blk_mq_end_request(req, 0);
+	nvme_req(req)->status = 0;
+	nvme_end_req(req);
 	kblockd_schedule_work(&ns->head->requeue_work);
 }
 
@@ -127,6 +131,11 @@
 	struct nvme_ns *ns = rq->q->queuedata;
 	struct gendisk *disk = ns->head->disk;
 
+	if (READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) {
+		atomic_inc(&ns->ctrl->nr_active);
+		nvme_req(rq)->flags |= NVME_MPATH_CNT_ACTIVE;
+	}
+
 	if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq))
 		return;
 
@@ -140,6 +149,9 @@
 {
 	struct nvme_ns *ns = rq->q->queuedata;
 
+	if (nvme_req(rq)->flags & NVME_MPATH_CNT_ACTIVE)
+		atomic_dec_if_positive(&ns->ctrl->nr_active);
+
 	if (!(nvme_req(rq)->flags & NVME_MPATH_IO_STATS))
 		return;
 	bdev_end_io_acct(ns->head->disk->part0, req_op(rq),
@@ -150,16 +162,18 @@
 void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl)
 {
 	struct nvme_ns *ns;
+	int srcu_idx;
 
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list) {
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu)) {
 		if (!ns->head->disk)
 			continue;
 		kblockd_schedule_work(&ns->head->requeue_work);
 		if (nvme_ctrl_state(ns->ctrl) == NVME_CTRL_LIVE)
 			disk_uevent(ns->head->disk, KOBJ_CHANGE);
 	}
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 }
 
 static const char *nvme_ana_state_names[] = {
@@ -193,13 +207,15 @@
 void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
 {
 	struct nvme_ns *ns;
+	int srcu_idx;
 
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list) {
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu)) {
 		nvme_mpath_clear_current_path(ns);
 		kblockd_schedule_work(&ns->head->requeue_work);
 	}
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 }
 
 void nvme_mpath_revalidate_paths(struct nvme_ns *ns)
@@ -210,7 +226,8 @@
 	int srcu_idx;
 
 	srcu_idx = srcu_read_lock(&head->srcu);
-	list_for_each_entry_rcu(ns, &head->list, siblings) {
+	list_for_each_entry_srcu(ns, &head->list, siblings,
+				 srcu_read_lock_held(&head->srcu)) {
 		if (capacity != get_capacity(ns->disk))
 			clear_bit(NVME_NS_READY, &ns->flags);
 	}
@@ -243,11 +260,13 @@
 	int found_distance = INT_MAX, fallback_distance = INT_MAX, distance;
 	struct nvme_ns *found = NULL, *fallback = NULL, *ns;
 
-	list_for_each_entry_rcu(ns, &head->list, siblings) {
+	list_for_each_entry_srcu(ns, &head->list, siblings,
+				 srcu_read_lock_held(&head->srcu)) {
 		if (nvme_path_is_disabled(ns))
 			continue;
 
-		if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_NUMA)
+		if (ns->ctrl->numa_node != NUMA_NO_NODE &&
+		    READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_NUMA)
 			distance = node_distance(node, ns->ctrl->numa_node);
 		else
 			distance = LOCAL_DISTANCE;
@@ -287,10 +306,15 @@
 	return list_first_or_null_rcu(&head->list, struct nvme_ns, siblings);
 }
 
-static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head,
-		int node, struct nvme_ns *old)
+static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head)
 {
 	struct nvme_ns *ns, *found = NULL;
+	int node = numa_node_id();
+	struct nvme_ns *old = srcu_dereference(head->current_path[node],
+					       &head->srcu);
+
+	if (unlikely(!old))
+		return __nvme_find_path(head, node);
 
 	if (list_is_singular(&head->list)) {
 		if (nvme_path_is_disabled(old))
@@ -330,13 +354,50 @@
 	return found;
 }
 
+static struct nvme_ns *nvme_queue_depth_path(struct nvme_ns_head *head)
+{
+	struct nvme_ns *best_opt = NULL, *best_nonopt = NULL, *ns;
+	unsigned int min_depth_opt = UINT_MAX, min_depth_nonopt = UINT_MAX;
+	unsigned int depth;
+
+	list_for_each_entry_srcu(ns, &head->list, siblings,
+				 srcu_read_lock_held(&head->srcu)) {
+		if (nvme_path_is_disabled(ns))
+			continue;
+
+		depth = atomic_read(&ns->ctrl->nr_active);
+
+		switch (ns->ana_state) {
+		case NVME_ANA_OPTIMIZED:
+			if (depth < min_depth_opt) {
+				min_depth_opt = depth;
+				best_opt = ns;
+			}
+			break;
+		case NVME_ANA_NONOPTIMIZED:
+			if (depth < min_depth_nonopt) {
+				min_depth_nonopt = depth;
+				best_nonopt = ns;
+			}
+			break;
+		default:
+			break;
+		}
+
+		if (min_depth_opt == 0)
+			return best_opt;
+	}
+
+	return best_opt ? best_opt : best_nonopt;
+}
+
 static inline bool nvme_path_is_optimized(struct nvme_ns *ns)
 {
 	return nvme_ctrl_state(ns->ctrl) == NVME_CTRL_LIVE &&
 		ns->ana_state == NVME_ANA_OPTIMIZED;
 }
 
-inline struct nvme_ns *nvme_find_path(struct nvme_ns_head *head)
+static struct nvme_ns *nvme_numa_path(struct nvme_ns_head *head)
 {
 	int node = numa_node_id();
 	struct nvme_ns *ns;
@@ -344,19 +405,32 @@
 	ns = srcu_dereference(head->current_path[node], &head->srcu);
 	if (unlikely(!ns))
 		return __nvme_find_path(head, node);
-
-	if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_RR)
-		return nvme_round_robin_path(head, node, ns);
 	if (unlikely(!nvme_path_is_optimized(ns)))
 		return __nvme_find_path(head, node);
 	return ns;
 }
 
+inline struct nvme_ns *nvme_find_path(struct nvme_ns_head *head)
+{
+	switch (READ_ONCE(head->subsys->iopolicy)) {
+	case NVME_IOPOLICY_QD:
+		return nvme_queue_depth_path(head);
+	case NVME_IOPOLICY_RR:
+		return nvme_round_robin_path(head);
+	default:
+		return nvme_numa_path(head);
+	}
+}
+
 static bool nvme_available_path(struct nvme_ns_head *head)
 {
 	struct nvme_ns *ns;
 
-	list_for_each_entry_rcu(ns, &head->list, siblings) {
+	if (!test_bit(NVME_NSHEAD_DISK_LIVE, &head->flags))
+		return NULL;
+
+	list_for_each_entry_srcu(ns, &head->list, siblings,
+				 srcu_read_lock_held(&head->srcu)) {
 		if (test_bit(NVME_CTRL_FAILFAST_EXPIRED, &ns->ctrl->flags))
 			continue;
 		switch (nvme_ctrl_state(ns->ctrl)) {
@@ -496,6 +570,20 @@
 	return ret;
 }
 
+static void nvme_partition_scan_work(struct work_struct *work)
+{
+	struct nvme_ns_head *head =
+		container_of(work, struct nvme_ns_head, partition_scan_work);
+
+	if (WARN_ON_ONCE(!test_and_clear_bit(GD_SUPPRESS_PART_SCAN,
+					     &head->disk->state)))
+		return;
+
+	mutex_lock(&head->disk->open_mutex);
+	bdev_disk_changed(head->disk, false);
+	mutex_unlock(&head->disk->open_mutex);
+}
+
 static void nvme_requeue_work(struct work_struct *work)
 {
 	struct nvme_ns_head *head =
@@ -522,6 +610,7 @@
 	bio_list_init(&head->requeue_list);
 	spin_lock_init(&head->requeue_lock);
 	INIT_WORK(&head->requeue_work, nvme_requeue_work);
+	INIT_WORK(&head->partition_scan_work, nvme_partition_scan_work);
 
 	/*
 	 * Add a multipath node if the subsystems supports multiple controllers.
@@ -537,6 +626,16 @@
 		return -ENOMEM;
 	head->disk->fops = &nvme_ns_head_ops;
 	head->disk->private_data = head;
+
+	/*
+	 * We need to suppress the partition scan from occuring within the
+	 * controller's scan_work context. If a path error occurs here, the IO
+	 * will wait until a path becomes available or all paths are torn down,
+	 * but that action also occurs within scan_work, so it would deadlock.
+	 * Defer the partion scan to a different context that does not block
+	 * scan_work.
+	 */
+	set_bit(GD_SUPPRESS_PART_SCAN, &head->disk->state);
 	sprintf(head->disk->disk_name, "nvme%dn%d",
 			ctrl->subsys->instance, head->instance);
 
@@ -582,10 +681,11 @@
 		rc = device_add_disk(&head->subsys->dev, head->disk,
 				     nvme_ns_attr_groups);
 		if (rc) {
-			clear_bit(NVME_NSHEAD_DISK_LIVE, &ns->flags);
+			clear_bit(NVME_NSHEAD_DISK_LIVE, &head->flags);
 			return;
 		}
 		nvme_add_ns_head_cdev(head);
+		kblockd_schedule_work(&head->partition_scan_work);
 	}
 
 	mutex_lock(&head->lock);
@@ -593,7 +693,7 @@
 		int node, srcu_idx;
 
 		srcu_idx = srcu_read_lock(&head->srcu);
-		for_each_node(node)
+		for_each_online_node(node)
 			__nvme_find_path(head, node);
 		srcu_read_unlock(&head->srcu, srcu_idx);
 	}
@@ -678,6 +778,7 @@
 	u32 nr_nsids = le32_to_cpu(desc->nnsids), n = 0;
 	unsigned *nr_change_groups = data;
 	struct nvme_ns *ns;
+	int srcu_idx;
 
 	dev_dbg(ctrl->device, "ANA group %d: %s.\n",
 			le32_to_cpu(desc->grpid),
@@ -689,8 +790,9 @@
 	if (!nr_nsids)
 		return 0;
 
-	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list) {
+	srcu_idx = srcu_read_lock(&ctrl->srcu);
+	list_for_each_entry_srcu(ns, &ctrl->namespaces, list,
+				 srcu_read_lock_held(&ctrl->srcu)) {
 		unsigned nsid;
 again:
 		nsid = le32_to_cpu(desc->nsids[n]);
@@ -703,7 +805,7 @@
 		if (ns->head->ns_id > nsid)
 			goto again;
 	}
-	up_read(&ctrl->namespaces_rwsem);
+	srcu_read_unlock(&ctrl->srcu, srcu_idx);
 	return 0;
 }
 
@@ -797,6 +899,29 @@
 			  nvme_iopolicy_names[READ_ONCE(subsys->iopolicy)]);
 }
 
+static void nvme_subsys_iopolicy_update(struct nvme_subsystem *subsys,
+		int iopolicy)
+{
+	struct nvme_ctrl *ctrl;
+	int old_iopolicy = READ_ONCE(subsys->iopolicy);
+
+	if (old_iopolicy == iopolicy)
+		return;
+
+	WRITE_ONCE(subsys->iopolicy, iopolicy);
+
+	/* iopolicy changes clear the mpath by design */
+	mutex_lock(&nvme_subsystems_lock);
+	list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry)
+		nvme_mpath_clear_ctrl_paths(ctrl);
+	mutex_unlock(&nvme_subsystems_lock);
+
+	pr_notice("subsysnqn %s iopolicy changed from %s to %s\n",
+			subsys->subnqn,
+			nvme_iopolicy_names[old_iopolicy],
+			nvme_iopolicy_names[iopolicy]);
+}
+
 static ssize_t nvme_subsys_iopolicy_store(struct device *dev,
 		struct device_attribute *attr, const char *buf, size_t count)
 {
@@ -806,7 +931,7 @@
 
 	for (i = 0; i < ARRAY_SIZE(nvme_iopolicy_names); i++) {
 		if (sysfs_streq(buf, nvme_iopolicy_names[i])) {
-			WRITE_ONCE(subsys->iopolicy, i);
+			nvme_subsys_iopolicy_update(subsys, i);
 			return count;
 		}
 	}
@@ -882,11 +1007,22 @@
 {
 	if (!head->disk)
 		return;
-	kblockd_schedule_work(&head->requeue_work);
-	if (test_bit(NVME_NSHEAD_DISK_LIVE, &head->flags)) {
+	if (test_and_clear_bit(NVME_NSHEAD_DISK_LIVE, &head->flags)) {
 		nvme_cdev_del(&head->cdev, &head->cdev_device);
+		/*
+		 * requeue I/O after NVME_NSHEAD_DISK_LIVE has been cleared
+		 * to allow multipath to fail all I/O.
+		 */
+		synchronize_srcu(&head->srcu);
+		kblockd_schedule_work(&head->requeue_work);
 		del_gendisk(head->disk);
 	}
+	/*
+	 * requeue I/O after NVME_NSHEAD_DISK_LIVE has been cleared
+	 * to allow multipath to fail all I/O.
+	 */
+	synchronize_srcu(&head->srcu);
+	kblockd_schedule_work(&head->requeue_work);
 }
 
 void nvme_mpath_remove_disk(struct nvme_ns_head *head)
@@ -896,6 +1032,7 @@
 	/* make sure all pending bios are cleaned up */
 	kblockd_schedule_work(&head->requeue_work);
 	flush_work(&head->requeue_work);
+	flush_work(&head->partition_scan_work);
 	put_disk(head->disk);
 }
 
@@ -917,6 +1054,9 @@
 	    !(ctrl->subsys->cmic & NVME_CTRL_CMIC_ANA))
 		return 0;
 
+	/* initialize this in the identify path to cover controller resets */
+	atomic_set(&ctrl->nr_active, 0);
+
 	if (!ctrl->max_namespaces ||
 	    ctrl->max_namespaces > le32_to_cpu(id->nn)) {
 		dev_err(ctrl->device,
--- linux-qcom-6.8.0.orig/drivers/nvme/host/nvme.h
+++ linux-qcom-6.8.0/drivers/nvme/host/nvme.h
@@ -49,6 +49,7 @@
 extern struct workqueue_struct *nvme_wq;
 extern struct workqueue_struct *nvme_reset_wq;
 extern struct workqueue_struct *nvme_delete_wq;
+extern struct mutex nvme_subsystems_lock;
 
 /*
  * List of workarounds for devices that required behavior not specified in
@@ -90,6 +91,11 @@
 	NVME_QUIRK_NO_DEEPEST_PS		= (1 << 5),
 
 	/*
+	 *  Problems seen with concurrent commands
+	 */
+	NVME_QUIRK_QDEPTH_ONE			= (1 << 6),
+
+	/*
 	 * Set MEDIUM priority on SQ creation
 	 */
 	NVME_QUIRK_MEDIUM_PRIO_SQ		= (1 << 7),
@@ -162,6 +168,16 @@
 	 * Disables simple suspend/resume path.
 	 */
 	NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND	= (1 << 20),
+
+	/*
+	 * MSI (but not MSI-X) interrupts are broken and never fire.
+	 */
+	NVME_QUIRK_BROKEN_MSI			= (1 << 21),
+
+	/*
+	 * Align dma pool segment size to 512 bytes
+	 */
+	NVME_QUIRK_DMAPOOL_ALIGN_512		= (1 << 22),
 };
 
 /*
@@ -190,6 +206,7 @@
 	NVME_REQ_CANCELLED		= (1 << 0),
 	NVME_REQ_USERCMD		= (1 << 1),
 	NVME_MPATH_IO_STATS		= (1 << 2),
+	NVME_MPATH_CNT_ACTIVE		= (1 << 3),
 };
 
 static inline struct nvme_request *nvme_req(struct request *req)
@@ -277,7 +294,8 @@
 	struct blk_mq_tag_set *tagset;
 	struct blk_mq_tag_set *admin_tagset;
 	struct list_head namespaces;
-	struct rw_semaphore namespaces_rwsem;
+	struct mutex namespaces_lock;
+	struct srcu_struct srcu;
 	struct device ctrl_device;
 	struct device *device;	/* char device */
 #ifdef CONFIG_NVME_HWMON
@@ -354,6 +372,7 @@
 	size_t ana_log_size;
 	struct timer_list anatt_timer;
 	struct work_struct ana_work;
+	atomic_t nr_active;
 #endif
 
 #ifdef CONFIG_NVME_HOST_AUTH
@@ -364,7 +383,7 @@
 	struct nvme_dhchap_key *ctrl_key;
 	u16 transaction;
 #endif
-	struct key *tls_key;
+	key_serial_t tls_pskid;
 
 	/* Power saving configuration */
 	u64 ps_max_latency_us;
@@ -402,6 +421,7 @@
 enum nvme_iopolicy {
 	NVME_IOPOLICY_NUMA,
 	NVME_IOPOLICY_RR,
+	NVME_IOPOLICY_QD,
 };
 
 struct nvme_subsystem {
@@ -482,6 +502,7 @@
 	struct bio_list		requeue_list;
 	spinlock_t		requeue_lock;
 	struct work_struct	requeue_work;
+	struct work_struct	partition_scan_work;
 	struct mutex		lock;
 	unsigned long		flags;
 #define NVME_NSHEAD_DISK_LIVE	0
@@ -497,7 +518,7 @@
 enum nvme_ns_features {
 	NVME_NS_EXT_LBAS = 1 << 0, /* support extended LBA format */
 	NVME_NS_METADATA_SUPPORTED = 1 << 1, /* support getting generated md */
-	NVME_NS_DEAC,		/* DEAC bit in Write Zeores supported */
+	NVME_NS_DEAC = 1 << 2,		/* DEAC bit in Write Zeores supported */
 };
 
 struct nvme_ns {
@@ -684,7 +705,7 @@
 
 static inline bool nvme_is_ana_error(u16 status)
 {
-	switch (status & 0x7ff) {
+	switch (status & NVME_SCT_SC_MASK) {
 	case NVME_SC_ANA_TRANSITION:
 	case NVME_SC_ANA_INACCESSIBLE:
 	case NVME_SC_ANA_PERSISTENT_LOSS:
@@ -697,7 +718,7 @@
 static inline bool nvme_is_path_error(u16 status)
 {
 	/* check for a status code type of 'path related status' */
-	return (status & 0x700) == 0x300;
+	return (status & NVME_SCT_MASK) == NVME_SCT_PATH;
 }
 
 /*
@@ -740,6 +761,28 @@
 		nvme_tag_from_cid(command_id) >= NVME_AQ_BLK_MQ_DEPTH;
 }
 
+/*
+ * Returns true for sink states that can't ever transition back to live.
+ */
+static inline bool nvme_state_terminal(struct nvme_ctrl *ctrl)
+{
+	switch (nvme_ctrl_state(ctrl)) {
+	case NVME_CTRL_NEW:
+	case NVME_CTRL_LIVE:
+	case NVME_CTRL_RESETTING:
+	case NVME_CTRL_CONNECTING:
+		return false;
+	case NVME_CTRL_DELETING:
+	case NVME_CTRL_DELETING_NOIO:
+	case NVME_CTRL_DEAD:
+		return true;
+	default:
+		WARN_ONCE(1, "Unhandled ctrl state:%d", ctrl->state);
+		return true;
+	}
+}
+
+void nvme_end_req(struct request *req);
 void nvme_complete_rq(struct request *req);
 void nvme_complete_batch_req(struct request *req);
 
@@ -850,7 +893,7 @@
 	NVME_SUBMIT_NOWAIT = (__force nvme_submit_flags_t)(1 << 1),
 	/* Set BLK_MQ_REQ_RESERVED when allocating request */
 	NVME_SUBMIT_RESERVED = (__force nvme_submit_flags_t)(1 << 2),
-	/* Retry command when NVME_SC_DNR is not set in the result */
+	/* Retry command when NVME_STATUS_DNR is not set in the result */
 	NVME_SUBMIT_RETRY = (__force nvme_submit_flags_t)(1 << 3),
 };
 
@@ -1133,6 +1176,7 @@
 		       struct nvme_command *cmd, int status);
 struct nvme_ctrl *nvme_ctrl_from_file(struct file *file);
 struct nvme_ns *nvme_find_get_ns(struct nvme_ctrl *ctrl, unsigned nsid);
+bool nvme_get_ns(struct nvme_ns *ns);
 void nvme_put_ns(struct nvme_ns *ns);
 
 static inline bool nvme_multi_css(struct nvme_ctrl *ctrl)
--- linux-qcom-6.8.0.orig/drivers/nvme/host/pci.c
+++ linux-qcom-6.8.0/drivers/nvme/host/pci.c
@@ -153,6 +153,7 @@
 	/* host memory buffer support: */
 	u64 host_mem_size;
 	u32 nr_host_mem_descs;
+	u32 host_mem_descs_size;
 	dma_addr_t host_mem_descs_dma;
 	struct nvme_host_mem_buf_desc *host_mem_descs;
 	void **host_mem_desc_bufs;
@@ -778,7 +779,8 @@
 		struct bio_vec bv = req_bvec(req);
 
 		if (!is_pci_p2pdma_page(bv.bv_page)) {
-			if (bv.bv_offset + bv.bv_len <= NVME_CTRL_PAGE_SIZE * 2)
+			if ((bv.bv_offset & (NVME_CTRL_PAGE_SIZE - 1)) +
+			     bv.bv_len <= NVME_CTRL_PAGE_SIZE * 2)
 				return nvme_setup_prp_simple(dev, req,
 							     &cmnd->rw, &bv);
 
@@ -825,9 +827,9 @@
 		struct nvme_command *cmnd)
 {
 	struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+	struct bio_vec bv = rq_integrity_vec(req);
 
-	iod->meta_dma = dma_map_bvec(dev->dev, rq_integrity_vec(req),
-			rq_dma_dir(req), 0);
+	iod->meta_dma = dma_map_bvec(dev->dev, &bv, rq_dma_dir(req), 0);
 	if (dma_mapping_error(dev->dev, iod->meta_dma))
 		return BLK_STS_IOERR;
 	cmnd->rw.metadata = cpu_to_le64(iod->meta_dma);
@@ -862,7 +864,8 @@
 	nvme_start_request(req);
 	return BLK_STS_OK;
 out_unmap_data:
-	nvme_unmap_data(dev, req);
+	if (blk_rq_nr_phys_segments(req))
+		nvme_unmap_data(dev, req);
 out_free_cmd:
 	nvme_cleanup_cmd(req);
 	return ret;
@@ -902,9 +905,10 @@
 
 static void nvme_submit_cmds(struct nvme_queue *nvmeq, struct request **rqlist)
 {
+	struct request *req;
+
 	spin_lock(&nvmeq->sq_lock);
-	while (!rq_list_empty(*rqlist)) {
-		struct request *req = rq_list_pop(rqlist);
+	while ((req = rq_list_pop(rqlist))) {
 		struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
 
 		nvme_sq_copy_cmd(nvmeq, &iod->cmd);
@@ -929,31 +933,25 @@
 
 static void nvme_queue_rqs(struct request **rqlist)
 {
-	struct request *req, *next, *prev = NULL;
+	struct request *submit_list = NULL;
 	struct request *requeue_list = NULL;
+	struct request **requeue_lastp = &requeue_list;
+	struct nvme_queue *nvmeq = NULL;
+	struct request *req;
 
-	rq_list_for_each_safe(rqlist, req, next) {
-		struct nvme_queue *nvmeq = req->mq_hctx->driver_data;
-
-		if (!nvme_prep_rq_batch(nvmeq, req)) {
-			/* detach 'req' and add to remainder list */
-			rq_list_move(rqlist, &requeue_list, req, prev);
-
-			req = prev;
-			if (!req)
-				continue;
-		}
+	while ((req = rq_list_pop(rqlist))) {
+		if (nvmeq && nvmeq != req->mq_hctx->driver_data)
+			nvme_submit_cmds(nvmeq, &submit_list);
+		nvmeq = req->mq_hctx->driver_data;
 
-		if (!next || req->mq_hctx != next->mq_hctx) {
-			/* detach rest of list, and submit */
-			req->rq_next = NULL;
-			nvme_submit_cmds(nvmeq, rqlist);
-			*rqlist = next;
-			prev = NULL;
-		} else
-			prev = req;
+		if (nvme_prep_rq_batch(nvmeq, req))
+			rq_list_add(&submit_list, req); /* reverse order */
+		else
+			rq_list_add_tail(&requeue_lastp, req);
 	}
 
+	if (nvmeq)
+		nvme_submit_cmds(nvmeq, &submit_list);
 	*rqlist = requeue_list;
 }
 
@@ -966,7 +964,7 @@
 	        struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
 
 		dma_unmap_page(dev->dev, iod->meta_dma,
-			       rq_integrity_vec(req)->bv_len, rq_dma_dir(req));
+			       rq_integrity_vec(req).bv_len, rq_dma_dir(req));
 	}
 
 	if (blk_rq_nr_phys_segments(req))
@@ -1273,7 +1271,7 @@
 	dev_warn(dev->ctrl.device,
 		 "Does your device have a faulty power saving mode enabled?\n");
 	dev_warn(dev->ctrl.device,
-		 "Try \"nvme_core.default_ps_max_latency_us=0 pcie_aspm=off\" and report a bug\n");
+		 "Try \"nvme_core.default_ps_max_latency_us=0 pcie_aspm=off pcie_port_pm=off\" and report a bug\n");
 }
 
 static enum blk_eh_timer_return nvme_timeout(struct request *req)
@@ -1286,6 +1284,9 @@
 	u32 csts = readl(dev->bar + NVME_REG_CSTS);
 	u8 opcode;
 
+	if (nvme_state_terminal(&dev->ctrl))
+		goto disable;
+
 	/* If PCI error recovery process is happening, we cannot reset or
 	 * the recovery mechanism will surely fail.
 	 */
@@ -1390,8 +1391,11 @@
 	return BLK_EH_RESET_TIMER;
 
 disable:
-	if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
+	if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING)) {
+		if (nvme_state_terminal(&dev->ctrl))
+			nvme_dev_disable(dev, true);
 		return BLK_EH_DONE;
+	}
 
 	nvme_dev_disable(dev, false);
 	if (nvme_try_sched_reset(&dev->ctrl))
@@ -1923,10 +1927,10 @@
 
 	kfree(dev->host_mem_desc_bufs);
 	dev->host_mem_desc_bufs = NULL;
-	dma_free_coherent(dev->dev,
-			dev->nr_host_mem_descs * sizeof(*dev->host_mem_descs),
+	dma_free_coherent(dev->dev, dev->host_mem_descs_size,
 			dev->host_mem_descs, dev->host_mem_descs_dma);
 	dev->host_mem_descs = NULL;
+	dev->host_mem_descs_size = 0;
 	dev->nr_host_mem_descs = 0;
 }
 
@@ -1934,7 +1938,7 @@
 		u32 chunk_size)
 {
 	struct nvme_host_mem_buf_desc *descs;
-	u32 max_entries, len;
+	u32 max_entries, len, descs_size;
 	dma_addr_t descs_dma;
 	int i = 0;
 	void **bufs;
@@ -1947,8 +1951,9 @@
 	if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries)
 		max_entries = dev->ctrl.hmmaxd;
 
-	descs = dma_alloc_coherent(dev->dev, max_entries * sizeof(*descs),
-				   &descs_dma, GFP_KERNEL);
+	descs_size = max_entries * sizeof(*descs);
+	descs = dma_alloc_coherent(dev->dev, descs_size, &descs_dma,
+			GFP_KERNEL);
 	if (!descs)
 		goto out;
 
@@ -1977,6 +1982,7 @@
 	dev->host_mem_size = size;
 	dev->host_mem_descs = descs;
 	dev->host_mem_descs_dma = descs_dma;
+	dev->host_mem_descs_size = descs_size;
 	dev->host_mem_desc_bufs = bufs;
 	return 0;
 
@@ -1991,8 +1997,7 @@
 
 	kfree(bufs);
 out_free_descs:
-	dma_free_coherent(dev->dev, max_entries * sizeof(*descs), descs,
-			descs_dma);
+	dma_free_coherent(dev->dev, descs_size, descs, descs_dma);
 out:
 	dev->host_mem_descs = NULL;
 	return -ENOMEM;
@@ -2218,6 +2223,7 @@
 		.priv		= dev,
 	};
 	unsigned int irq_queues, poll_queues;
+	unsigned int flags = PCI_IRQ_ALL_TYPES | PCI_IRQ_AFFINITY;
 
 	/*
 	 * Poll queues don't need interrupts, but we need at least one I/O queue
@@ -2241,8 +2247,10 @@
 	irq_queues = 1;
 	if (!(dev->ctrl.quirks & NVME_QUIRK_SINGLE_VECTOR))
 		irq_queues += (nr_io_queues - poll_queues);
-	return pci_alloc_irq_vectors_affinity(pdev, 1, irq_queues,
-			      PCI_IRQ_ALL_TYPES | PCI_IRQ_AFFINITY, &affd);
+	if (dev->ctrl.quirks & NVME_QUIRK_BROKEN_MSI)
+		flags &= ~PCI_IRQ_MSI;
+	return pci_alloc_irq_vectors_affinity(pdev, 1, irq_queues, flags,
+					      &affd);
 }
 
 static unsigned int nvme_max_io_queues(struct nvme_dev *dev)
@@ -2460,17 +2468,36 @@
 	return 1;
 }
 
-static void nvme_pci_update_nr_queues(struct nvme_dev *dev)
+static bool nvme_pci_update_nr_queues(struct nvme_dev *dev)
 {
+	if (!dev->ctrl.tagset) {
+		nvme_alloc_io_tag_set(&dev->ctrl, &dev->tagset, &nvme_mq_ops,
+				nvme_pci_nr_maps(dev), sizeof(struct nvme_iod));
+		return true;
+	}
+
+	/* Give up if we are racing with nvme_dev_disable() */
+	if (!mutex_trylock(&dev->shutdown_lock))
+		return false;
+
+	/* Check if nvme_dev_disable() has been executed already */
+	if (!dev->online_queues) {
+		mutex_unlock(&dev->shutdown_lock);
+		return false;
+	}
+
 	blk_mq_update_nr_hw_queues(&dev->tagset, dev->online_queues - 1);
 	/* free previously allocated queues that are no longer usable */
 	nvme_free_queues(dev, dev->online_queues);
+	mutex_unlock(&dev->shutdown_lock);
+	return true;
 }
 
 static int nvme_pci_enable(struct nvme_dev *dev)
 {
 	int result = -ENOMEM;
 	struct pci_dev *pdev = to_pci_dev(dev->dev);
+	unsigned int flags = PCI_IRQ_ALL_TYPES;
 
 	if (pci_enable_device_mem(pdev))
 		return result;
@@ -2487,7 +2514,9 @@
 	 * interrupts. Pre-enable a single MSIX or MSI vec for setup. We'll
 	 * adjust this later.
 	 */
-	result = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
+	if (dev->ctrl.quirks & NVME_QUIRK_BROKEN_MSI)
+		flags &= ~PCI_IRQ_MSI;
+	result = pci_alloc_irq_vectors(pdev, 1, 1, flags);
 	if (result < 0)
 		goto disable;
 
@@ -2508,15 +2537,8 @@
 	else
 		dev->io_sqes = NVME_NVM_IOSQES;
 
-	/*
-	 * Temporary fix for the Apple controller found in the MacBook8,1 and
-	 * some MacBook7,1 to avoid controller resets and data loss.
-	 */
-	if (pdev->vendor == PCI_VENDOR_ID_APPLE && pdev->device == 0x2001) {
+	if (dev->ctrl.quirks & NVME_QUIRK_QDEPTH_ONE) {
 		dev->q_depth = 2;
-		dev_warn(dev->ctrl.device, "detected Apple NVMe controller, "
-			"set queue depth=%u to work around controller resets\n",
-			dev->q_depth);
 	} else if (pdev->vendor == PCI_VENDOR_ID_SAMSUNG &&
 		   (pdev->device == 0xa821 || pdev->device == 0xa822) &&
 		   NVME_CAP_MQES(dev->ctrl.cap) == 0) {
@@ -2633,15 +2655,20 @@
 
 static int nvme_setup_prp_pools(struct nvme_dev *dev)
 {
+	size_t small_align = 256;
+
 	dev->prp_page_pool = dma_pool_create("prp list page", dev->dev,
 						NVME_CTRL_PAGE_SIZE,
 						NVME_CTRL_PAGE_SIZE, 0);
 	if (!dev->prp_page_pool)
 		return -ENOMEM;
 
+	if (dev->ctrl.quirks & NVME_QUIRK_DMAPOOL_ALIGN_512)
+		small_align = 512;
+
 	/* Optimisation for I/Os between 4k and 128k */
 	dev->prp_small_pool = dma_pool_create("prp list 256", dev->dev,
-						256, 256, 0);
+						256, small_align, 0);
 	if (!dev->prp_small_pool) {
 		dma_pool_destroy(dev->prp_page_pool);
 		return -ENOMEM;
@@ -2749,7 +2776,8 @@
 		nvme_dbbuf_set(dev);
 		nvme_unquiesce_io_queues(&dev->ctrl);
 		nvme_wait_freeze(&dev->ctrl);
-		nvme_pci_update_nr_queues(dev);
+		if (!nvme_pci_update_nr_queues(dev))
+			goto out;
 		nvme_unfreeze(&dev->ctrl);
 	} else {
 		dev_warn(dev->ctrl.device, "IO queues lost\n");
@@ -2917,8 +2945,28 @@
 		    dmi_match(DMI_BOARD_NAME, "NS5x_7xPU") ||
 		    dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1"))
 			return NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND;
+	} else if (pdev->vendor == 0x144d && pdev->device == 0xa80d) {
+		/*
+		 * Exclude Samsung 990 Evo from NVME_QUIRK_SIMPLE_SUSPEND
+		 * because of high power consumption (> 2 Watt) in s2idle
+		 * sleep. Only some boards with Intel CPU are affected.
+		 */
+		if (dmi_match(DMI_BOARD_NAME, "DN50Z-140HC-YD") ||
+		    dmi_match(DMI_BOARD_NAME, "GMxPXxx") ||
+		    dmi_match(DMI_BOARD_NAME, "GXxMRXx") ||
+		    dmi_match(DMI_BOARD_NAME, "PH4PG31") ||
+		    dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1") ||
+		    dmi_match(DMI_BOARD_NAME, "PH6PG01_PH6PG71"))
+			return NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND;
 	}
 
+	/*
+	 * NVMe SSD drops off the PCIe bus after system idle
+	 * for 10 hours on a Lenovo N60z board.
+	 */
+	if (dmi_match(DMI_BOARD_NAME, "LXKT-ZXEG-N6"))
+		return NVME_QUIRK_NO_APST;
+
 	return 0;
 }
 
@@ -3363,6 +3411,11 @@
 				NVME_QUIRK_BOGUS_NID, },
 	{ PCI_VDEVICE(REDHAT, 0x0010),	/* Qemu emulated controller */
 		.driver_data = NVME_QUIRK_BOGUS_NID, },
+	{ PCI_DEVICE(0x1217, 0x8760), /* O2 Micro 64GB Steam Deck */
+		.driver_data = NVME_QUIRK_DMAPOOL_ALIGN_512, },
+	{ PCI_DEVICE(0x126f, 0x2262),	/* Silicon Motion generic */
+		.driver_data = NVME_QUIRK_NO_DEEPEST_PS |
+				NVME_QUIRK_BOGUS_NID, },
 	{ PCI_DEVICE(0x126f, 0x2263),	/* Silicon Motion unidentified */
 		.driver_data = NVME_QUIRK_NO_NS_DESC_LIST |
 				NVME_QUIRK_BOGUS_NID, },
@@ -3381,6 +3434,8 @@
 		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY |
 				NVME_QUIRK_DISABLE_WRITE_ZEROES|
 				NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+	{ PCI_DEVICE(0x15b7, 0x5008),   /* Sandisk SN530 */
+		.driver_data = NVME_QUIRK_BROKEN_MSI },
 	{ PCI_DEVICE(0x1987, 0x5012),	/* Phison E12 */
 		.driver_data = NVME_QUIRK_BOGUS_NID, },
 	{ PCI_DEVICE(0x1987, 0x5016),	/* Phison E16 */
@@ -3492,7 +3547,12 @@
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0xcd02),
 		.driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, },
 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001),
-		.driver_data = NVME_QUIRK_SINGLE_VECTOR },
+		/*
+		 * Fix for the Apple controller found in the MacBook8,1 and
+		 * some MacBook7,1 to avoid controller resets and data loss.
+		 */
+		.driver_data = NVME_QUIRK_SINGLE_VECTOR |
+				NVME_QUIRK_QDEPTH_ONE },
 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005),
 		.driver_data = NVME_QUIRK_SINGLE_VECTOR |
--- linux-qcom-6.8.0.orig/drivers/nvme/host/pr.c
+++ linux-qcom-6.8.0/drivers/nvme/host/pr.c
@@ -72,12 +72,12 @@
 	return nvme_submit_sync_cmd(ns->queue, c, data, data_len);
 }
 
-static int nvme_sc_to_pr_err(int nvme_sc)
+static int nvme_status_to_pr_err(int status)
 {
-	if (nvme_is_path_error(nvme_sc))
+	if (nvme_is_path_error(status))
 		return PR_STS_PATH_FAILED;
 
-	switch (nvme_sc) {
+	switch (status & NVME_SCT_SC_MASK) {
 	case NVME_SC_SUCCESS:
 		return PR_STS_SUCCESS;
 	case NVME_SC_RESERVATION_CONFLICT:
@@ -122,7 +122,7 @@
 	if (ret < 0)
 		return ret;
 
-	return nvme_sc_to_pr_err(ret);
+	return nvme_status_to_pr_err(ret);
 }
 
 static int nvme_pr_register(struct block_device *bdev, u64 old,
@@ -197,7 +197,7 @@
 	if (ret < 0)
 		return ret;
 
-	return nvme_sc_to_pr_err(ret);
+	return nvme_status_to_pr_err(ret);
 }
 
 static int nvme_pr_read_keys(struct block_device *bdev,
--- linux-qcom-6.8.0.orig/drivers/nvme/host/rdma.c
+++ linux-qcom-6.8.0/drivers/nvme/host/rdma.c
@@ -1084,13 +1084,7 @@
 	}
 destroy_admin:
 	nvme_stop_keep_alive(&ctrl->ctrl);
-	nvme_quiesce_admin_queue(&ctrl->ctrl);
-	blk_sync_queue(ctrl->ctrl.admin_q);
-	nvme_rdma_stop_queue(&ctrl->queues[0]);
-	nvme_cancel_admin_tagset(&ctrl->ctrl);
-	if (new)
-		nvme_remove_admin_tag_set(&ctrl->ctrl);
-	nvme_rdma_destroy_admin_queue(ctrl);
+	nvme_rdma_teardown_admin_queue(ctrl, new);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/nvme/host/sysfs.c
+++ linux-qcom-6.8.0/drivers/nvme/host/sysfs.c
@@ -221,14 +221,11 @@
 
 	ret = nvme_identify_ns(ns->ctrl, ns->head->ns_id, &id);
 	if (ret)
-		goto out_free_id;
+		return ret;
 
 	ns->head->nuse = le64_to_cpu(id->nuse);
-
-out_free_id:
 	kfree(id);
-
-	return ret;
+	return 0;
 }
 
 static ssize_t nuse_show(struct device *dev, struct device_attribute *attr,
@@ -675,9 +672,9 @@
 {
 	struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
 
-	if (!ctrl->tls_key)
+	if (!ctrl->tls_pskid)
 		return 0;
-	return sysfs_emit(buf, "%08x", key_serial(ctrl->tls_key));
+	return sysfs_emit(buf, "%08x", ctrl->tls_pskid);
 }
 static DEVICE_ATTR_RO(tls_key);
 #endif
--- linux-qcom-6.8.0.orig/drivers/nvme/host/tcp.c
+++ linux-qcom-6.8.0/drivers/nvme/host/tcp.c
@@ -157,6 +157,7 @@
 
 	bool			hdr_digest;
 	bool			data_digest;
+	bool			tls_enabled;
 	struct ahash_request	*rcv_hash;
 	struct ahash_request	*snd_hash;
 	__le32			exp_ddgst;
@@ -205,7 +206,21 @@
 	return queue - queue->ctrl->queues;
 }
 
-static inline bool nvme_tcp_tls(struct nvme_ctrl *ctrl)
+/*
+ * Check if the queue is TLS encrypted
+ */
+static inline bool nvme_tcp_queue_tls(struct nvme_tcp_queue *queue)
+{
+	if (!IS_ENABLED(CONFIG_NVME_TCP_TLS))
+		return 0;
+
+	return queue->tls_enabled;
+}
+
+/*
+ * Check if TLS is configured for the controller.
+ */
+static inline bool nvme_tcp_tls_configured(struct nvme_ctrl *ctrl)
 {
 	if (!IS_ENABLED(CONFIG_NVME_TCP_TLS))
 		return 0;
@@ -352,12 +367,18 @@
 	} while (ret > 0);
 }
 
-static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue)
+static inline bool nvme_tcp_queue_has_pending(struct nvme_tcp_queue *queue)
 {
 	return !list_empty(&queue->send_list) ||
 		!llist_empty(&queue->req_list);
 }
 
+static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue)
+{
+	return !nvme_tcp_queue_tls(queue) &&
+		nvme_tcp_queue_has_pending(queue);
+}
+
 static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req,
 		bool sync, bool last)
 {
@@ -378,7 +399,7 @@
 		mutex_unlock(&queue->send_mutex);
 	}
 
-	if (last && nvme_tcp_queue_more(queue))
+	if (last && nvme_tcp_queue_has_pending(queue))
 		queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work);
 }
 
@@ -1037,7 +1058,7 @@
 		else
 			msg.msg_flags |= MSG_MORE;
 
-		if (!sendpage_ok(page))
+		if (!sendpages_ok(page, len, offset))
 			msg.msg_flags &= ~MSG_SPLICE_PAGES;
 
 		bvec_set_page(&bvec, page, len, offset);
@@ -1418,7 +1439,7 @@
 	memset(&msg, 0, sizeof(msg));
 	iov.iov_base = icresp;
 	iov.iov_len = sizeof(*icresp);
-	if (nvme_tcp_tls(&queue->ctrl->ctrl)) {
+	if (nvme_tcp_queue_tls(queue)) {
 		msg.msg_control = cbuf;
 		msg.msg_controllen = sizeof(cbuf);
 	}
@@ -1430,7 +1451,7 @@
 		goto free_icresp;
 	}
 	ret = -ENOTCONN;
-	if (nvme_tcp_tls(&queue->ctrl->ctrl)) {
+	if (nvme_tcp_queue_tls(queue)) {
 		ctype = tls_get_record_type(queue->sock->sk,
 					    (struct cmsghdr *)cbuf);
 		if (ctype != TLS_RECORD_TYPE_DATA) {
@@ -1569,13 +1590,16 @@
 		goto out_complete;
 	}
 
-	tls_key = key_lookup(pskid);
+	tls_key = nvme_tls_key_lookup(pskid);
 	if (IS_ERR(tls_key)) {
 		dev_warn(ctrl->ctrl.device, "queue %d: Invalid key %x\n",
 			 qid, pskid);
 		queue->tls_err = -ENOKEY;
 	} else {
-		ctrl->ctrl.tls_key = tls_key;
+		queue->tls_enabled = true;
+		if (qid == 0)
+			ctrl->ctrl.tls_pskid = key_serial(tls_key);
+		key_put(tls_key);
 		queue->tls_err = 0;
 	}
 
@@ -1756,7 +1780,7 @@
 	}
 
 	/* If PSKs are configured try to start TLS */
-	if (IS_ENABLED(CONFIG_NVME_TCP_TLS) && pskid) {
+	if (nvme_tcp_tls_configured(nctrl) && pskid) {
 		ret = nvme_tcp_start_tls(nctrl, queue, pskid);
 		if (ret)
 			goto err_init_connect;
@@ -1817,6 +1841,8 @@
 	mutex_lock(&queue->queue_lock);
 	if (test_and_clear_bit(NVME_TCP_Q_LIVE, &queue->flags))
 		__nvme_tcp_stop_queue(queue);
+	/* Stopping the queue will disable TLS */
+	queue->tls_enabled = false;
 	mutex_unlock(&queue->queue_lock);
 }
 
@@ -1913,16 +1939,17 @@
 	int ret;
 	key_serial_t pskid = 0;
 
-	if (nvme_tcp_tls(ctrl)) {
+	if (nvme_tcp_tls_configured(ctrl)) {
 		if (ctrl->opts->tls_key)
 			pskid = key_serial(ctrl->opts->tls_key);
-		else
+		else {
 			pskid = nvme_tls_psk_default(ctrl->opts->keyring,
 						      ctrl->opts->host->nqn,
 						      ctrl->opts->subsysnqn);
-		if (!pskid) {
-			dev_err(ctrl->device, "no valid PSK found\n");
-			return -ENOKEY;
+			if (!pskid) {
+				dev_err(ctrl->device, "no valid PSK found\n");
+				return -ENOKEY;
+			}
 		}
 	}
 
@@ -1945,13 +1972,14 @@
 {
 	int i, ret;
 
-	if (nvme_tcp_tls(ctrl) && !ctrl->tls_key) {
+	if (nvme_tcp_tls_configured(ctrl) && !ctrl->tls_pskid) {
 		dev_err(ctrl->device, "no PSK negotiated\n");
 		return -ENOKEY;
 	}
+
 	for (i = 1; i < ctrl->queue_count; i++) {
 		ret = nvme_tcp_alloc_queue(ctrl, i,
-				key_serial(ctrl->tls_key));
+				ctrl->tls_pskid);
 		if (ret)
 			goto out_free_queues;
 	}
@@ -2132,6 +2160,11 @@
 	if (remove)
 		nvme_unquiesce_admin_queue(ctrl);
 	nvme_tcp_destroy_admin_queue(ctrl, remove);
+	if (ctrl->tls_pskid) {
+		dev_dbg(ctrl->device, "Wipe negotiated TLS_PSK %08x\n",
+			ctrl->tls_pskid);
+		ctrl->tls_pskid = 0;
+	}
 }
 
 static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,
@@ -2237,7 +2270,7 @@
 	}
 destroy_admin:
 	nvme_stop_keep_alive(ctrl);
-	nvme_tcp_teardown_admin_queue(ctrl, false);
+	nvme_tcp_teardown_admin_queue(ctrl, new);
 	return ret;
 }
 
@@ -2599,10 +2632,11 @@
 
 	len = nvmf_get_address(ctrl, buf, size);
 
+	if (!test_bit(NVME_TCP_Q_LIVE, &queue->flags))
+		return len;
+
 	mutex_lock(&queue->queue_lock);
 
-	if (!test_bit(NVME_TCP_Q_LIVE, &queue->flags))
-		goto done;
 	ret = kernel_getsockname(queue->sock, (struct sockaddr *)&src_addr);
 	if (ret > 0) {
 		if (len > 0)
@@ -2610,7 +2644,7 @@
 		len += scnprintf(buf + len, size - len, "%ssrc_addr=%pISc\n",
 				(len) ? "," : "", &src_addr);
 	}
-done:
+
 	mutex_unlock(&queue->queue_lock);
 
 	return len;
--- linux-qcom-6.8.0.orig/drivers/nvme/target/admin-cmd.c
+++ linux-qcom-6.8.0/drivers/nvme/target/admin-cmd.c
@@ -344,7 +344,7 @@
 	pr_debug("unhandled lid %d on qid %d\n",
 	       req->cmd->get_log_page.lid, req->sq->qid);
 	req->error_loc = offsetof(struct nvme_get_log_page_command, lid);
-	nvmet_req_complete(req, NVME_SC_INVALID_FIELD | NVME_SC_DNR);
+	nvmet_req_complete(req, NVME_SC_INVALID_FIELD | NVME_STATUS_DNR);
 }
 
 static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
@@ -496,7 +496,7 @@
 
 	if (le32_to_cpu(req->cmd->identify.nsid) == NVME_NSID_ALL) {
 		req->error_loc = offsetof(struct nvme_identify, nsid);
-		status = NVME_SC_INVALID_NS | NVME_SC_DNR;
+		status = NVME_SC_INVALID_NS | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -587,6 +587,16 @@
 	u16 status = 0;
 	int i = 0;
 
+	/*
+	 * NSID values 0xFFFFFFFE and NVME_NSID_ALL are invalid
+	 * See NVMe Base Specification, Active Namespace ID list (CNS 02h).
+	 */
+	if (min_nsid == 0xFFFFFFFE || min_nsid == NVME_NSID_ALL) {
+		req->error_loc = offsetof(struct nvme_identify, nsid);
+		status = NVME_SC_INVALID_NS | NVME_STATUS_DNR;
+		goto out;
+	}
+
 	list = kzalloc(buf_size, GFP_KERNEL);
 	if (!list) {
 		status = NVME_SC_INTERNAL;
@@ -662,7 +672,7 @@
 
 	if (sg_zero_buffer(req->sg, req->sg_cnt, NVME_IDENTIFY_DATA_SIZE - off,
 			off) != NVME_IDENTIFY_DATA_SIZE - off)
-		status = NVME_SC_INTERNAL | NVME_SC_DNR;
+		status = NVME_SC_INTERNAL | NVME_STATUS_DNR;
 
 out:
 	nvmet_req_complete(req, status);
@@ -724,7 +734,7 @@
 	pr_debug("unhandled identify cns %d on qid %d\n",
 	       req->cmd->identify.cns, req->sq->qid);
 	req->error_loc = offsetof(struct nvme_identify, cns);
-	nvmet_req_complete(req, NVME_SC_INVALID_FIELD | NVME_SC_DNR);
+	nvmet_req_complete(req, NVME_SC_INVALID_FIELD | NVME_STATUS_DNR);
 }
 
 /*
@@ -807,7 +817,7 @@
 
 	if (val32 & ~mask) {
 		req->error_loc = offsetof(struct nvme_common_command, cdw11);
-		return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 	}
 
 	WRITE_ONCE(req->sq->ctrl->aen_enabled, val32);
@@ -833,7 +843,7 @@
 		ncqr = (cdw11 >> 16) & 0xffff;
 		nsqr = cdw11 & 0xffff;
 		if (ncqr == 0xffff || nsqr == 0xffff) {
-			status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+			status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 			break;
 		}
 		nvmet_set_result(req,
@@ -846,14 +856,14 @@
 		status = nvmet_set_feat_async_event(req, NVMET_AEN_CFG_ALL);
 		break;
 	case NVME_FEAT_HOST_ID:
-		status = NVME_SC_CMD_SEQ_ERROR | NVME_SC_DNR;
+		status = NVME_SC_CMD_SEQ_ERROR | NVME_STATUS_DNR;
 		break;
 	case NVME_FEAT_WRITE_PROTECT:
 		status = nvmet_set_feat_write_protect(req);
 		break;
 	default:
 		req->error_loc = offsetof(struct nvme_common_command, cdw10);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		break;
 	}
 
@@ -939,7 +949,7 @@
 		if (!(req->cmd->common.cdw11 & cpu_to_le32(1 << 0))) {
 			req->error_loc =
 				offsetof(struct nvme_common_command, cdw11);
-			status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+			status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 			break;
 		}
 
@@ -952,7 +962,7 @@
 	default:
 		req->error_loc =
 			offsetof(struct nvme_common_command, cdw10);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		break;
 	}
 
@@ -969,7 +979,7 @@
 	mutex_lock(&ctrl->lock);
 	if (ctrl->nr_async_event_cmds >= NVMET_ASYNC_EVENTS) {
 		mutex_unlock(&ctrl->lock);
-		nvmet_req_complete(req, NVME_SC_ASYNC_LIMIT | NVME_SC_DNR);
+		nvmet_req_complete(req, NVME_SC_ASYNC_LIMIT | NVME_STATUS_DNR);
 		return;
 	}
 	ctrl->async_event_cmds[ctrl->nr_async_event_cmds++] = req;
@@ -1006,7 +1016,7 @@
 	if (nvme_is_fabrics(cmd))
 		return nvmet_parse_fabrics_admin_cmd(req);
 	if (unlikely(!nvmet_check_auth_status(req)))
-		return NVME_SC_AUTH_REQUIRED | NVME_SC_DNR;
+		return NVME_SC_AUTH_REQUIRED | NVME_STATUS_DNR;
 	if (nvmet_is_disc_subsys(nvmet_req_subsys(req)))
 		return nvmet_parse_discovery_cmd(req);
 
--- linux-qcom-6.8.0.orig/drivers/nvme/target/auth.c
+++ linux-qcom-6.8.0/drivers/nvme/target/auth.c
@@ -101,6 +101,7 @@
 			pr_debug("%s: ctrl %d failed to generate private key, err %d\n",
 				 __func__, ctrl->cntlid, ret);
 			kfree_sensitive(ctrl->dh_key);
+			ctrl->dh_key = NULL;
 			return ret;
 		}
 		ctrl->dh_keysize = crypto_kpp_maxsize(ctrl->dh_tfm);
@@ -285,9 +286,9 @@
 	}
 
 	if (shash_len != crypto_shash_digestsize(shash_tfm)) {
-		pr_debug("%s: hash len mismatch (len %d digest %d)\n",
-			 __func__, shash_len,
-			 crypto_shash_digestsize(shash_tfm));
+		pr_err("%s: hash len mismatch (len %d digest %d)\n",
+			__func__, shash_len,
+			crypto_shash_digestsize(shash_tfm));
 		ret = -EINVAL;
 		goto out_free_tfm;
 	}
@@ -316,7 +317,7 @@
 						    req->sq->dhchap_c1,
 						    challenge, shash_len);
 		if (ret)
-			goto out_free_response;
+			goto out_free_challenge;
 	}
 
 	pr_debug("ctrl %d qid %d host response seq %u transaction %d\n",
@@ -327,7 +328,7 @@
 			GFP_KERNEL);
 	if (!shash) {
 		ret = -ENOMEM;
-		goto out_free_response;
+		goto out_free_challenge;
 	}
 	shash->tfm = shash_tfm;
 	ret = crypto_shash_init(shash);
@@ -363,14 +364,15 @@
 		goto out;
 	ret = crypto_shash_final(shash, response);
 out:
+	kfree(shash);
+out_free_challenge:
 	if (challenge != req->sq->dhchap_c1)
 		kfree(challenge);
-	kfree(shash);
 out_free_response:
 	nvme_auth_free_key(transformed_key);
 out_free_tfm:
 	crypto_free_shash(shash_tfm);
-	return 0;
+	return ret;
 }
 
 int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response,
@@ -429,14 +431,14 @@
 						    req->sq->dhchap_c2,
 						    challenge, shash_len);
 		if (ret)
-			goto out_free_response;
+			goto out_free_challenge;
 	}
 
 	shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(shash_tfm),
 			GFP_KERNEL);
 	if (!shash) {
 		ret = -ENOMEM;
-		goto out_free_response;
+		goto out_free_challenge;
 	}
 	shash->tfm = shash_tfm;
 
@@ -473,9 +475,10 @@
 		goto out;
 	ret = crypto_shash_final(shash, response);
 out:
+	kfree(shash);
+out_free_challenge:
 	if (challenge != req->sq->dhchap_c2)
 		kfree(challenge);
-	kfree(shash);
 out_free_response:
 	nvme_auth_free_key(transformed_key);
 out_free_tfm:
--- linux-qcom-6.8.0.orig/drivers/nvme/target/configfs.c
+++ linux-qcom-6.8.0/drivers/nvme/target/configfs.c
@@ -384,7 +384,29 @@
 				return sprintf(page, "%s\n", nvmet_addr_tsas_rdma[i].name);
 		}
 	}
-	return sprintf(page, "reserved\n");
+	return sprintf(page, "\n");
+}
+
+static u8 nvmet_addr_tsas_rdma_store(const char *page)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(nvmet_addr_tsas_rdma); i++) {
+		if (sysfs_streq(page, nvmet_addr_tsas_rdma[i].name))
+			return nvmet_addr_tsas_rdma[i].type;
+	}
+	return NVMF_RDMA_QPTYPE_INVALID;
+}
+
+static u8 nvmet_addr_tsas_tcp_store(const char *page)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(nvmet_addr_tsas_tcp); i++) {
+		if (sysfs_streq(page, nvmet_addr_tsas_tcp[i].name))
+			return nvmet_addr_tsas_tcp[i].type;
+	}
+	return NVMF_TCP_SECTYPE_INVALID;
 }
 
 static ssize_t nvmet_addr_tsas_store(struct config_item *item,
@@ -392,20 +414,19 @@
 {
 	struct nvmet_port *port = to_nvmet_port(item);
 	u8 treq = nvmet_port_disc_addr_treq_mask(port);
-	u8 sectype;
-	int i;
+	u8 sectype, qptype;
 
 	if (nvmet_is_port_enabled(port, __func__))
 		return -EACCES;
 
-	if (port->disc_addr.trtype != NVMF_TRTYPE_TCP)
-		return -EINVAL;
-
-	for (i = 0; i < ARRAY_SIZE(nvmet_addr_tsas_tcp); i++) {
-		if (sysfs_streq(page, nvmet_addr_tsas_tcp[i].name)) {
-			sectype = nvmet_addr_tsas_tcp[i].type;
+	if (port->disc_addr.trtype == NVMF_TRTYPE_RDMA) {
+		qptype = nvmet_addr_tsas_rdma_store(page);
+		if (qptype == port->disc_addr.tsas.rdma.qptype)
+			return count;
+	} else if (port->disc_addr.trtype == NVMF_TRTYPE_TCP) {
+		sectype = nvmet_addr_tsas_tcp_store(page);
+		if (sectype != NVMF_TCP_SECTYPE_INVALID)
 			goto found;
-		}
 	}
 
 	pr_err("Invalid value '%s' for tsas\n", page);
@@ -650,10 +671,18 @@
 	if (kstrtobool(page, &enable))
 		return -EINVAL;
 
+	/*
+	 * take a global nvmet_config_sem because the disable routine has a
+	 * window where it releases the subsys-lock, giving a chance to
+	 * a parallel enable to concurrently execute causing the disable to
+	 * have a misaccounting of the ns percpu_ref.
+	 */
+	down_write(&nvmet_config_sem);
 	if (enable)
 		ret = nvmet_ns_enable(ns);
 	else
 		nvmet_ns_disable(ns);
+	up_write(&nvmet_config_sem);
 
 	return ret ? ret : count;
 }
@@ -728,6 +757,18 @@
 	NULL,
 };
 
+bool nvmet_subsys_nsid_exists(struct nvmet_subsys *subsys, u32 nsid)
+{
+	struct config_item *ns_item;
+	char name[12];
+
+	snprintf(name, sizeof(name), "%u", nsid);
+	mutex_lock(&subsys->namespaces_group.cg_subsys->su_mutex);
+	ns_item = config_group_find_item(&subsys->namespaces_group, name);
+	mutex_unlock(&subsys->namespaces_group.cg_subsys->su_mutex);
+	return ns_item != NULL;
+}
+
 static void nvmet_ns_release(struct config_item *item)
 {
 	struct nvmet_ns *ns = to_nvmet_ns(item);
--- linux-qcom-6.8.0.orig/drivers/nvme/target/core.c
+++ linux-qcom-6.8.0/drivers/nvme/target/core.c
@@ -55,18 +55,18 @@
 		return NVME_SC_SUCCESS;
 	case -ENOSPC:
 		req->error_loc = offsetof(struct nvme_rw_command, length);
-		return NVME_SC_CAP_EXCEEDED | NVME_SC_DNR;
+		return NVME_SC_CAP_EXCEEDED | NVME_STATUS_DNR;
 	case -EREMOTEIO:
 		req->error_loc = offsetof(struct nvme_rw_command, slba);
-		return  NVME_SC_LBA_RANGE | NVME_SC_DNR;
+		return  NVME_SC_LBA_RANGE | NVME_STATUS_DNR;
 	case -EOPNOTSUPP:
 		req->error_loc = offsetof(struct nvme_common_command, opcode);
 		switch (req->cmd->common.opcode) {
 		case nvme_cmd_dsm:
 		case nvme_cmd_write_zeroes:
-			return NVME_SC_ONCS_NOT_SUPPORTED | NVME_SC_DNR;
+			return NVME_SC_ONCS_NOT_SUPPORTED | NVME_STATUS_DNR;
 		default:
-			return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+			return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 		}
 		break;
 	case -ENODATA:
@@ -76,7 +76,7 @@
 		fallthrough;
 	default:
 		req->error_loc = offsetof(struct nvme_common_command, opcode);
-		return NVME_SC_INTERNAL | NVME_SC_DNR;
+		return NVME_SC_INTERNAL | NVME_STATUS_DNR;
 	}
 }
 
@@ -86,7 +86,7 @@
 		 req->sq->qid);
 
 	req->error_loc = offsetof(struct nvme_common_command, opcode);
-	return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+	return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 }
 
 static struct nvmet_subsys *nvmet_find_get_subsys(struct nvmet_port *port,
@@ -97,7 +97,7 @@
 {
 	if (sg_pcopy_from_buffer(req->sg, req->sg_cnt, buf, len, off) != len) {
 		req->error_loc = offsetof(struct nvme_common_command, dptr);
-		return NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR;
+		return NVME_SC_SGL_INVALID_DATA | NVME_STATUS_DNR;
 	}
 	return 0;
 }
@@ -106,7 +106,7 @@
 {
 	if (sg_pcopy_to_buffer(req->sg, req->sg_cnt, buf, len, off) != len) {
 		req->error_loc = offsetof(struct nvme_common_command, dptr);
-		return NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR;
+		return NVME_SC_SGL_INVALID_DATA | NVME_STATUS_DNR;
 	}
 	return 0;
 }
@@ -115,7 +115,7 @@
 {
 	if (sg_zero_buffer(req->sg, req->sg_cnt, len, off) != len) {
 		req->error_loc = offsetof(struct nvme_common_command, dptr);
-		return NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR;
+		return NVME_SC_SGL_INVALID_DATA | NVME_STATUS_DNR;
 	}
 	return 0;
 }
@@ -145,7 +145,7 @@
 	while (ctrl->nr_async_event_cmds) {
 		req = ctrl->async_event_cmds[--ctrl->nr_async_event_cmds];
 		mutex_unlock(&ctrl->lock);
-		nvmet_req_complete(req, NVME_SC_INTERNAL | NVME_SC_DNR);
+		nvmet_req_complete(req, NVME_SC_INTERNAL | NVME_STATUS_DNR);
 		mutex_lock(&ctrl->lock);
 	}
 	mutex_unlock(&ctrl->lock);
@@ -425,11 +425,14 @@
 u16 nvmet_req_find_ns(struct nvmet_req *req)
 {
 	u32 nsid = le32_to_cpu(req->cmd->common.nsid);
+	struct nvmet_subsys *subsys = nvmet_req_subsys(req);
 
-	req->ns = xa_load(&nvmet_req_subsys(req)->namespaces, nsid);
+	req->ns = xa_load(&subsys->namespaces, nsid);
 	if (unlikely(!req->ns)) {
 		req->error_loc = offsetof(struct nvme_common_command, nsid);
-		return NVME_SC_INVALID_NS | NVME_SC_DNR;
+		if (nvmet_subsys_nsid_exists(subsys, nsid))
+			return NVME_SC_INTERNAL_PATH_ERROR;
+		return NVME_SC_INVALID_NS | NVME_STATUS_DNR;
 	}
 
 	percpu_ref_get(&req->ns->ref);
@@ -803,6 +806,15 @@
 	percpu_ref_exit(&sq->ref);
 	nvmet_auth_sq_free(sq);
 
+	/*
+	 * we must reference the ctrl again after waiting for inflight IO
+	 * to complete. Because admin connect may have sneaked in after we
+	 * store sq->ctrl locally, but before we killed the percpu_ref. the
+	 * admin connect allocates and assigns sq->ctrl, which now needs a
+	 * final ref put, as this ctrl is going away.
+	 */
+	ctrl = sq->ctrl;
+
 	if (ctrl) {
 		/*
 		 * The teardown flow may take some time, and the host may not
@@ -880,7 +892,7 @@
 		return nvmet_parse_fabrics_io_cmd(req);
 
 	if (unlikely(!nvmet_check_auth_status(req)))
-		return NVME_SC_AUTH_REQUIRED | NVME_SC_DNR;
+		return NVME_SC_AUTH_REQUIRED | NVME_STATUS_DNR;
 
 	ret = nvmet_check_ctrl_status(req);
 	if (unlikely(ret))
@@ -933,6 +945,7 @@
 	req->metadata_sg_cnt = 0;
 	req->transfer_len = 0;
 	req->metadata_len = 0;
+	req->cqe->result.u64 = 0;
 	req->cqe->status = 0;
 	req->cqe->sq_head = 0;
 	req->ns = NULL;
@@ -942,7 +955,7 @@
 	/* no support for fused commands yet */
 	if (unlikely(flags & (NVME_CMD_FUSE_FIRST | NVME_CMD_FUSE_SECOND))) {
 		req->error_loc = offsetof(struct nvme_common_command, flags);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto fail;
 	}
 
@@ -953,7 +966,7 @@
 	 */
 	if (unlikely((flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METABUF)) {
 		req->error_loc = offsetof(struct nvme_common_command, flags);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto fail;
 	}
 
@@ -971,7 +984,7 @@
 	trace_nvmet_req_init(req, req->cmd);
 
 	if (unlikely(!percpu_ref_tryget_live(&sq->ref))) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto fail;
 	}
 
@@ -998,7 +1011,7 @@
 {
 	if (unlikely(len != req->transfer_len)) {
 		req->error_loc = offsetof(struct nvme_common_command, dptr);
-		nvmet_req_complete(req, NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR);
+		nvmet_req_complete(req, NVME_SC_SGL_INVALID_DATA | NVME_STATUS_DNR);
 		return false;
 	}
 
@@ -1010,7 +1023,7 @@
 {
 	if (unlikely(data_len > req->transfer_len)) {
 		req->error_loc = offsetof(struct nvme_common_command, dptr);
-		nvmet_req_complete(req, NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR);
+		nvmet_req_complete(req, NVME_SC_SGL_INVALID_DATA | NVME_STATUS_DNR);
 		return false;
 	}
 
@@ -1278,18 +1291,18 @@
 	if (unlikely(!(req->sq->ctrl->cc & NVME_CC_ENABLE))) {
 		pr_err("got cmd %d while CC.EN == 0 on qid = %d\n",
 		       req->cmd->common.opcode, req->sq->qid);
-		return NVME_SC_CMD_SEQ_ERROR | NVME_SC_DNR;
+		return NVME_SC_CMD_SEQ_ERROR | NVME_STATUS_DNR;
 	}
 
 	if (unlikely(!(req->sq->ctrl->csts & NVME_CSTS_RDY))) {
 		pr_err("got cmd %d while CSTS.RDY == 0 on qid = %d\n",
 		       req->cmd->common.opcode, req->sq->qid);
-		return NVME_SC_CMD_SEQ_ERROR | NVME_SC_DNR;
+		return NVME_SC_CMD_SEQ_ERROR | NVME_STATUS_DNR;
 	}
 
 	if (unlikely(!nvmet_check_auth_status(req))) {
 		pr_warn("qid %d not authenticated\n", req->sq->qid);
-		return NVME_SC_AUTH_REQUIRED | NVME_SC_DNR;
+		return NVME_SC_AUTH_REQUIRED | NVME_STATUS_DNR;
 	}
 	return 0;
 }
@@ -1363,7 +1376,7 @@
 	int ret;
 	u16 status;
 
-	status = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+	status = NVME_SC_CONNECT_INVALID_PARAM | NVME_STATUS_DNR;
 	subsys = nvmet_find_get_subsys(req->port, subsysnqn);
 	if (!subsys) {
 		pr_warn("connect request for invalid subsystem %s!\n",
@@ -1379,7 +1392,7 @@
 			hostnqn, subsysnqn);
 		req->cqe->result.u32 = IPO_IATTR_CONNECT_DATA(hostnqn);
 		up_read(&nvmet_config_sem);
-		status = NVME_SC_CONNECT_INVALID_HOST | NVME_SC_DNR;
+		status = NVME_SC_CONNECT_INVALID_HOST | NVME_STATUS_DNR;
 		req->error_loc = offsetof(struct nvme_common_command, dptr);
 		goto out_put_subsystem;
 	}
@@ -1429,7 +1442,7 @@
 			     subsys->cntlid_min, subsys->cntlid_max,
 			     GFP_KERNEL);
 	if (ret < 0) {
-		status = NVME_SC_CONNECT_CTRL_BUSY | NVME_SC_DNR;
+		status = NVME_SC_CONNECT_CTRL_BUSY | NVME_STATUS_DNR;
 		goto out_free_sqs;
 	}
 	ctrl->cntlid = ret;
--- linux-qcom-6.8.0.orig/drivers/nvme/target/discovery.c
+++ linux-qcom-6.8.0/drivers/nvme/target/discovery.c
@@ -179,7 +179,7 @@
 	if (req->cmd->get_log_page.lid != NVME_LOG_DISC) {
 		req->error_loc =
 			offsetof(struct nvme_get_log_page_command, lid);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -187,7 +187,7 @@
 	if (offset & 0x3) {
 		req->error_loc =
 			offsetof(struct nvme_get_log_page_command, lpo);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -256,7 +256,7 @@
 
 	if (req->cmd->identify.cns != NVME_ID_CNS_CTRL) {
 		req->error_loc = offsetof(struct nvme_identify, cns);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -320,7 +320,7 @@
 	default:
 		req->error_loc =
 			offsetof(struct nvme_common_command, cdw10);
-		stat = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		stat = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		break;
 	}
 
@@ -345,7 +345,7 @@
 	default:
 		req->error_loc =
 			offsetof(struct nvme_common_command, cdw10);
-		stat = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		stat = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		break;
 	}
 
@@ -361,7 +361,7 @@
 		       cmd->common.opcode);
 		req->error_loc =
 			offsetof(struct nvme_common_command, opcode);
-		return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+		return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 	}
 
 	switch (cmd->common.opcode) {
@@ -386,7 +386,7 @@
 	default:
 		pr_debug("unhandled cmd %d\n", cmd->common.opcode);
 		req->error_loc = offsetof(struct nvme_common_command, opcode);
-		return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+		return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 	}
 
 }
--- linux-qcom-6.8.0.orig/drivers/nvme/target/fabrics-cmd-auth.c
+++ linux-qcom-6.8.0/drivers/nvme/target/fabrics-cmd-auth.c
@@ -188,26 +188,26 @@
 	u16 status = 0;
 
 	if (req->cmd->auth_send.secp != NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
 			offsetof(struct nvmf_auth_send_command, secp);
 		goto done;
 	}
 	if (req->cmd->auth_send.spsp0 != 0x01) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
 			offsetof(struct nvmf_auth_send_command, spsp0);
 		goto done;
 	}
 	if (req->cmd->auth_send.spsp1 != 0x01) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
 			offsetof(struct nvmf_auth_send_command, spsp1);
 		goto done;
 	}
 	tl = le32_to_cpu(req->cmd->auth_send.tl);
 	if (!tl) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
 			offsetof(struct nvmf_auth_send_command, tl);
 		goto done;
@@ -332,7 +332,6 @@
 		pr_debug("%s: ctrl %d qid %d nvme status %x error loc %d\n",
 			 __func__, ctrl->cntlid, req->sq->qid,
 			 status, req->error_loc);
-	req->cqe->result.u64 = 0;
 	if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 &&
 	    req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
 		unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;
@@ -437,26 +436,26 @@
 	u16 status = 0;
 
 	if (req->cmd->auth_receive.secp != NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
 			offsetof(struct nvmf_auth_receive_command, secp);
 		goto done;
 	}
 	if (req->cmd->auth_receive.spsp0 != 0x01) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
 			offsetof(struct nvmf_auth_receive_command, spsp0);
 		goto done;
 	}
 	if (req->cmd->auth_receive.spsp1 != 0x01) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
 			offsetof(struct nvmf_auth_receive_command, spsp1);
 		goto done;
 	}
 	al = le32_to_cpu(req->cmd->auth_receive.al);
 	if (!al) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
 			offsetof(struct nvmf_auth_receive_command, al);
 		goto done;
@@ -515,8 +514,6 @@
 	status = nvmet_copy_to_sgl(req, 0, d, al);
 	kfree(d);
 done:
-	req->cqe->result.u64 = 0;
-
 	if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2)
 		nvmet_auth_sq_free(req->sq);
 	else if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) {
--- linux-qcom-6.8.0.orig/drivers/nvme/target/fabrics-cmd.c
+++ linux-qcom-6.8.0/drivers/nvme/target/fabrics-cmd.c
@@ -18,7 +18,7 @@
 	if (req->cmd->prop_set.attrib & 1) {
 		req->error_loc =
 			offsetof(struct nvmf_property_set_command, attrib);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -29,7 +29,7 @@
 	default:
 		req->error_loc =
 			offsetof(struct nvmf_property_set_command, offset);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 	}
 out:
 	nvmet_req_complete(req, status);
@@ -50,7 +50,7 @@
 			val = ctrl->cap;
 			break;
 		default:
-			status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+			status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 			break;
 		}
 	} else {
@@ -65,7 +65,7 @@
 			val = ctrl->csts;
 			break;
 		default:
-			status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+			status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 			break;
 		}
 	}
@@ -105,7 +105,7 @@
 		pr_debug("received unknown capsule type 0x%x\n",
 			cmd->fabrics.fctype);
 		req->error_loc = offsetof(struct nvmf_common_command, fctype);
-		return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+		return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 	}
 
 	return 0;
@@ -128,7 +128,7 @@
 		pr_debug("received unknown capsule type 0x%x\n",
 			cmd->fabrics.fctype);
 		req->error_loc = offsetof(struct nvmf_common_command, fctype);
-		return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+		return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 	}
 
 	return 0;
@@ -147,14 +147,14 @@
 		pr_warn("queue size zero!\n");
 		req->error_loc = offsetof(struct nvmf_connect_command, sqsize);
 		req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(sqsize);
-		ret = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+		ret = NVME_SC_CONNECT_INVALID_PARAM | NVME_STATUS_DNR;
 		goto err;
 	}
 
 	if (ctrl->sqs[qid] != NULL) {
 		pr_warn("qid %u has already been created\n", qid);
 		req->error_loc = offsetof(struct nvmf_connect_command, qid);
-		return NVME_SC_CMD_SEQ_ERROR | NVME_SC_DNR;
+		return NVME_SC_CMD_SEQ_ERROR | NVME_STATUS_DNR;
 	}
 
 	if (sqsize > mqes) {
@@ -162,14 +162,14 @@
 				sqsize, mqes, ctrl->cntlid);
 		req->error_loc = offsetof(struct nvmf_connect_command, sqsize);
 		req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(sqsize);
-		return NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+		return NVME_SC_CONNECT_INVALID_PARAM | NVME_STATUS_DNR;
 	}
 
 	old = cmpxchg(&req->sq->ctrl, NULL, ctrl);
 	if (old) {
 		pr_warn("queue already connected!\n");
 		req->error_loc = offsetof(struct nvmf_connect_command, opcode);
-		return NVME_SC_CONNECT_CTRL_BUSY | NVME_SC_DNR;
+		return NVME_SC_CONNECT_CTRL_BUSY | NVME_STATUS_DNR;
 	}
 
 	/* note: convert queue size from 0's-based value to 1's-based value */
@@ -225,21 +225,18 @@
 	if (status)
 		goto out;
 
-	/* zero out initial completion result, assign values as needed */
-	req->cqe->result.u32 = 0;
-
 	if (c->recfmt != 0) {
 		pr_warn("invalid connect version (%d).\n",
 			le16_to_cpu(c->recfmt));
 		req->error_loc = offsetof(struct nvmf_connect_command, recfmt);
-		status = NVME_SC_CONNECT_FORMAT | NVME_SC_DNR;
+		status = NVME_SC_CONNECT_FORMAT | NVME_STATUS_DNR;
 		goto out;
 	}
 
 	if (unlikely(d->cntlid != cpu_to_le16(0xffff))) {
 		pr_warn("connect attempt for invalid controller ID %#x\n",
 			d->cntlid);
-		status = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+		status = NVME_SC_CONNECT_INVALID_PARAM | NVME_STATUS_DNR;
 		req->cqe->result.u32 = IPO_IATTR_CONNECT_DATA(cntlid);
 		goto out;
 	}
@@ -260,7 +257,7 @@
 		pr_err("Failed to setup authentication, error %d\n", ret);
 		nvmet_ctrl_put(ctrl);
 		if (ret == -EPERM)
-			status = (NVME_SC_CONNECT_INVALID_HOST | NVME_SC_DNR);
+			status = (NVME_SC_CONNECT_INVALID_HOST | NVME_STATUS_DNR);
 		else
 			status = NVME_SC_INTERNAL;
 		goto out;
@@ -305,13 +302,10 @@
 	if (status)
 		goto out;
 
-	/* zero out initial completion result, assign values as needed */
-	req->cqe->result.u32 = 0;
-
 	if (c->recfmt != 0) {
 		pr_warn("invalid connect version (%d).\n",
 			le16_to_cpu(c->recfmt));
-		status = NVME_SC_CONNECT_FORMAT | NVME_SC_DNR;
+		status = NVME_SC_CONNECT_FORMAT | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -320,13 +314,13 @@
 	ctrl = nvmet_ctrl_find_get(d->subsysnqn, d->hostnqn,
 				   le16_to_cpu(d->cntlid), req);
 	if (!ctrl) {
-		status = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+		status = NVME_SC_CONNECT_INVALID_PARAM | NVME_STATUS_DNR;
 		goto out;
 	}
 
 	if (unlikely(qid > ctrl->subsys->max_qid)) {
 		pr_warn("invalid queue id (%d)\n", qid);
-		status = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+		status = NVME_SC_CONNECT_INVALID_PARAM | NVME_STATUS_DNR;
 		req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(qid);
 		goto out_ctrl_put;
 	}
@@ -356,13 +350,13 @@
 		pr_debug("invalid command 0x%x on unconnected queue.\n",
 			cmd->fabrics.opcode);
 		req->error_loc = offsetof(struct nvme_common_command, opcode);
-		return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+		return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 	}
 	if (cmd->fabrics.fctype != nvme_fabrics_type_connect) {
 		pr_debug("invalid capsule type 0x%x on unconnected queue.\n",
 			cmd->fabrics.fctype);
 		req->error_loc = offsetof(struct nvmf_common_command, fctype);
-		return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+		return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 	}
 
 	if (cmd->connect.qid == 0)
--- linux-qcom-6.8.0.orig/drivers/nvme/target/fc.c
+++ linux-qcom-6.8.0/drivers/nvme/target/fc.c
@@ -148,7 +148,7 @@
 	struct workqueue_struct		*work_q;
 	struct kref			ref;
 	/* array of fcp_iods */
-	struct nvmet_fc_fcp_iod		fod[] __counted_by(sqsize);
+	struct nvmet_fc_fcp_iod		fod[] /* __counted_by(sqsize) */;
 } __aligned(sizeof(unsigned long long));
 
 struct nvmet_fc_hostport {
--- linux-qcom-6.8.0.orig/drivers/nvme/target/io-cmd-bdev.c
+++ linux-qcom-6.8.0/drivers/nvme/target/io-cmd-bdev.c
@@ -36,7 +36,7 @@
 	 */
 	id->nsfeat |= 1 << 4;
 	/* NPWG = Namespace Preferred Write Granularity. 0's based */
-	id->npwg = lpp0b;
+	id->npwg = to0based(bdev_io_min(bdev) / bdev_logical_block_size(bdev));
 	/* NPWA = Namespace Preferred Write Alignment. 0's based */
 	id->npwa = id->npwg;
 	/* NPDG = Namespace Preferred Deallocate Granularity. 0's based */
@@ -135,11 +135,11 @@
 	 */
 	switch (blk_sts) {
 	case BLK_STS_NOSPC:
-		status = NVME_SC_CAP_EXCEEDED | NVME_SC_DNR;
+		status = NVME_SC_CAP_EXCEEDED | NVME_STATUS_DNR;
 		req->error_loc = offsetof(struct nvme_rw_command, length);
 		break;
 	case BLK_STS_TARGET:
-		status = NVME_SC_LBA_RANGE | NVME_SC_DNR;
+		status = NVME_SC_LBA_RANGE | NVME_STATUS_DNR;
 		req->error_loc = offsetof(struct nvme_rw_command, slba);
 		break;
 	case BLK_STS_NOTSUPP:
@@ -147,10 +147,10 @@
 		switch (req->cmd->common.opcode) {
 		case nvme_cmd_dsm:
 		case nvme_cmd_write_zeroes:
-			status = NVME_SC_ONCS_NOT_SUPPORTED | NVME_SC_DNR;
+			status = NVME_SC_ONCS_NOT_SUPPORTED | NVME_STATUS_DNR;
 			break;
 		default:
-			status = NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+			status = NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 		}
 		break;
 	case BLK_STS_MEDIUM:
@@ -159,7 +159,7 @@
 		break;
 	case BLK_STS_IOERR:
 	default:
-		status = NVME_SC_INTERNAL | NVME_SC_DNR;
+		status = NVME_SC_INTERNAL | NVME_STATUS_DNR;
 		req->error_loc = offsetof(struct nvme_common_command, opcode);
 	}
 
@@ -356,7 +356,7 @@
 		return 0;
 
 	if (blkdev_issue_flush(req->ns->bdev))
-		return NVME_SC_INTERNAL | NVME_SC_DNR;
+		return NVME_SC_INTERNAL | NVME_STATUS_DNR;
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/nvme/target/loop.c
+++ linux-qcom-6.8.0/drivers/nvme/target/loop.c
@@ -265,6 +265,13 @@
 {
 	if (!test_and_clear_bit(NVME_LOOP_Q_LIVE, &ctrl->queues[0].flags))
 		return;
+	/*
+	 * It's possible that some requests might have been added
+	 * after admin queue is stopped/quiesced. So now start the
+	 * queue to flush these requests to the completion.
+	 */
+	nvme_unquiesce_admin_queue(&ctrl->ctrl);
+
 	nvmet_sq_destroy(&ctrl->queues[0].nvme_sq);
 	nvme_remove_admin_tag_set(&ctrl->ctrl);
 }
@@ -297,6 +304,12 @@
 		nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
 	}
 	ctrl->ctrl.queue_count = 1;
+	/*
+	 * It's possible that some requests might have been added
+	 * after io queue is stopped/quiesced. So now start the
+	 * queue to flush these requests to the completion.
+	 */
+	nvme_unquiesce_io_queues(&ctrl->ctrl);
 }
 
 static int nvme_loop_init_io_queues(struct nvme_loop_ctrl *ctrl)
--- linux-qcom-6.8.0.orig/drivers/nvme/target/nvmet.h
+++ linux-qcom-6.8.0/drivers/nvme/target/nvmet.h
@@ -542,6 +542,7 @@
 		struct nvmet_host *host);
 void nvmet_add_async_event(struct nvmet_ctrl *ctrl, u8 event_type,
 		u8 event_info, u8 log_page);
+bool nvmet_subsys_nsid_exists(struct nvmet_subsys *subsys, u32 nsid);
 
 #define NVMET_QUEUE_SIZE	1024
 #define NVMET_NR_QUEUES		128
--- linux-qcom-6.8.0.orig/drivers/nvme/target/passthru.c
+++ linux-qcom-6.8.0/drivers/nvme/target/passthru.c
@@ -226,13 +226,13 @@
 	    req->cmd->common.opcode == nvme_admin_identify) {
 		switch (req->cmd->identify.cns) {
 		case NVME_ID_CNS_CTRL:
-			nvmet_passthru_override_id_ctrl(req);
+			status = nvmet_passthru_override_id_ctrl(req);
 			break;
 		case NVME_ID_CNS_NS:
-			nvmet_passthru_override_id_ns(req);
+			status = nvmet_passthru_override_id_ns(req);
 			break;
 		case NVME_ID_CNS_NS_DESC_LIST:
-			nvmet_passthru_override_id_descs(req);
+			status = nvmet_passthru_override_id_descs(req);
 			break;
 		}
 	} else if (status < 0)
@@ -306,7 +306,7 @@
 		ns = nvme_find_get_ns(ctrl, nsid);
 		if (unlikely(!ns)) {
 			pr_err("failed to get passthru ns nsid:%u\n", nsid);
-			status = NVME_SC_INVALID_NS | NVME_SC_DNR;
+			status = NVME_SC_INVALID_NS | NVME_STATUS_DNR;
 			goto out;
 		}
 
@@ -426,7 +426,7 @@
 		 * emulated in the future if regular targets grow support for
 		 * this feature.
 		 */
-		return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+		return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 	}
 
 	return nvmet_setup_passthru_command(req);
@@ -478,7 +478,7 @@
 	case NVME_FEAT_RESV_PERSIST:
 		/* No reservations, see nvmet_parse_passthru_io_cmd() */
 	default:
-		return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+		return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 	}
 }
 
@@ -535,10 +535,6 @@
 		break;
 	case nvme_admin_identify:
 		switch (req->cmd->identify.cns) {
-		case NVME_ID_CNS_CTRL:
-			req->execute = nvmet_passthru_execute_cmd;
-			req->p.use_workqueue = true;
-			return NVME_SC_SUCCESS;
 		case NVME_ID_CNS_CS_CTRL:
 			switch (req->cmd->identify.csi) {
 			case NVME_CSI_ZNS:
@@ -546,8 +542,10 @@
 				req->p.use_workqueue = true;
 				return NVME_SC_SUCCESS;
 			}
-			return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+			return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
+		case NVME_ID_CNS_CTRL:
 		case NVME_ID_CNS_NS:
+		case NVME_ID_CNS_NS_DESC_LIST:
 			req->execute = nvmet_passthru_execute_cmd;
 			req->p.use_workqueue = true;
 			return NVME_SC_SUCCESS;
@@ -558,7 +556,7 @@
 				req->p.use_workqueue = true;
 				return NVME_SC_SUCCESS;
 			}
-			return NVME_SC_INVALID_OPCODE | NVME_SC_DNR;
+			return NVME_SC_INVALID_OPCODE | NVME_STATUS_DNR;
 		default:
 			return nvmet_setup_passthru_command(req);
 		}
--- linux-qcom-6.8.0.orig/drivers/nvme/target/rdma.c
+++ linux-qcom-6.8.0/drivers/nvme/target/rdma.c
@@ -475,12 +475,8 @@
 	return 0;
 
 out_free:
-	while (--i >= 0) {
-		struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
-
-		list_del(&rsp->free_list);
-		nvmet_rdma_free_rsp(ndev, rsp);
-	}
+	while (--i >= 0)
+		nvmet_rdma_free_rsp(ndev, &queue->rsps[i]);
 	kfree(queue->rsps);
 out:
 	return ret;
@@ -491,12 +487,8 @@
 	struct nvmet_rdma_device *ndev = queue->dev;
 	int i, nr_rsps = queue->recv_queue_size * 2;
 
-	for (i = 0; i < nr_rsps; i++) {
-		struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
-
-		list_del(&rsp->free_list);
-		nvmet_rdma_free_rsp(ndev, rsp);
-	}
+	for (i = 0; i < nr_rsps; i++)
+		nvmet_rdma_free_rsp(ndev, &queue->rsps[i]);
 	kfree(queue->rsps);
 }
 
@@ -861,12 +853,12 @@
 	if (!nvme_is_write(rsp->req.cmd)) {
 		rsp->req.error_loc =
 			offsetof(struct nvme_common_command, opcode);
-		return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 	}
 
 	if (off + len > rsp->queue->dev->inline_data_size) {
 		pr_err("invalid inline data offset!\n");
-		return NVME_SC_SGL_INVALID_OFFSET | NVME_SC_DNR;
+		return NVME_SC_SGL_INVALID_OFFSET | NVME_STATUS_DNR;
 	}
 
 	/* no data command? */
@@ -930,7 +922,7 @@
 			pr_err("invalid SGL subtype: %#x\n", sgl->type);
 			rsp->req.error_loc =
 				offsetof(struct nvme_common_command, dptr);
-			return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+			return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		}
 	case NVME_KEY_SGL_FMT_DATA_DESC:
 		switch (sgl->type & 0xf) {
@@ -942,12 +934,12 @@
 			pr_err("invalid SGL subtype: %#x\n", sgl->type);
 			rsp->req.error_loc =
 				offsetof(struct nvme_common_command, dptr);
-			return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+			return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		}
 	default:
 		pr_err("invalid SGL type: %#x\n", sgl->type);
 		rsp->req.error_loc = offsetof(struct nvme_common_command, dptr);
-		return NVME_SC_SGL_INVALID_TYPE | NVME_SC_DNR;
+		return NVME_SC_SGL_INVALID_TYPE | NVME_STATUS_DNR;
 	}
 }
 
--- linux-qcom-6.8.0.orig/drivers/nvme/target/tcp.c
+++ linux-qcom-6.8.0/drivers/nvme/target/tcp.c
@@ -348,6 +348,7 @@
 	return 0;
 }
 
+/* If cmd buffers are NULL, no operation is performed */
 static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd)
 {
 	kfree(cmd->iov);
@@ -415,10 +416,10 @@
 	if (sgl->type == ((NVME_SGL_FMT_DATA_DESC << 4) |
 			  NVME_SGL_FMT_OFFSET)) {
 		if (!nvme_is_write(cmd->req.cmd))
-			return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+			return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 
 		if (len > cmd->req.port->inline_data_size)
-			return NVME_SC_SGL_INVALID_OFFSET | NVME_SC_DNR;
+			return NVME_SC_SGL_INVALID_OFFSET | NVME_STATUS_DNR;
 		cmd->pdu_len = len;
 	}
 	cmd->req.transfer_len += len;
@@ -898,6 +899,7 @@
 		pr_err("bad nvme-tcp pdu length (%d)\n",
 			le32_to_cpu(icreq->hdr.plen));
 		nvmet_tcp_fatal_error(queue);
+		return -EPROTO;
 	}
 
 	if (icreq->pfv != NVME_TCP_PFV_1_0) {
@@ -1580,13 +1582,9 @@
 	struct nvmet_tcp_cmd *cmd = queue->cmds;
 	int i;
 
-	for (i = 0; i < queue->nr_cmds; i++, cmd++) {
-		if (nvmet_tcp_need_data_in(cmd))
-			nvmet_tcp_free_cmd_buffers(cmd);
-	}
-
-	if (!queue->nr_cmds && nvmet_tcp_need_data_in(&queue->connect))
-		nvmet_tcp_free_cmd_buffers(&queue->connect);
+	for (i = 0; i < queue->nr_cmds; i++, cmd++)
+		nvmet_tcp_free_cmd_buffers(cmd);
+	nvmet_tcp_free_cmd_buffers(&queue->connect);
 }
 
 static void nvmet_tcp_release_queue_work(struct work_struct *w)
@@ -2150,8 +2148,10 @@
 	}
 
 	queue->nr_cmds = sq->size * 2;
-	if (nvmet_tcp_alloc_cmds(queue))
+	if (nvmet_tcp_alloc_cmds(queue)) {
+		queue->nr_cmds = 0;
 		return NVME_SC_INTERNAL;
+	}
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/nvme/target/zns.c
+++ linux-qcom-6.8.0/drivers/nvme/target/zns.c
@@ -104,7 +104,7 @@
 
 	if (le32_to_cpu(req->cmd->identify.nsid) == NVME_NSID_ALL) {
 		req->error_loc = offsetof(struct nvme_identify, nsid);
-		status = NVME_SC_INVALID_NS | NVME_SC_DNR;
+		status = NVME_SC_INVALID_NS | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -125,7 +125,7 @@
 	}
 
 	if (!bdev_is_zoned(req->ns->bdev)) {
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc = offsetof(struct nvme_identify, nsid);
 		goto out;
 	}
@@ -162,17 +162,17 @@
 
 	if (sect >= get_capacity(req->ns->bdev->bd_disk)) {
 		req->error_loc = offsetof(struct nvme_zone_mgmt_recv_cmd, slba);
-		return NVME_SC_LBA_RANGE | NVME_SC_DNR;
+		return NVME_SC_LBA_RANGE | NVME_STATUS_DNR;
 	}
 
 	if (out_bufsize < sizeof(struct nvme_zone_report)) {
 		req->error_loc = offsetof(struct nvme_zone_mgmt_recv_cmd, numd);
-		return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 	}
 
 	if (req->cmd->zmr.zra != NVME_ZRA_ZONE_REPORT) {
 		req->error_loc = offsetof(struct nvme_zone_mgmt_recv_cmd, zra);
-		return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 	}
 
 	switch (req->cmd->zmr.pr) {
@@ -181,7 +181,7 @@
 		break;
 	default:
 		req->error_loc = offsetof(struct nvme_zone_mgmt_recv_cmd, pr);
-		return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 	}
 
 	switch (req->cmd->zmr.zrasf) {
@@ -197,7 +197,7 @@
 	default:
 		req->error_loc =
 			offsetof(struct nvme_zone_mgmt_recv_cmd, zrasf);
-		return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 	}
 
 	return NVME_SC_SUCCESS;
@@ -345,7 +345,7 @@
 		return NVME_SC_SUCCESS;
 	case -EINVAL:
 	case -EIO:
-		return NVME_SC_ZONE_INVALID_TRANSITION | NVME_SC_DNR;
+		return NVME_SC_ZONE_INVALID_TRANSITION | NVME_STATUS_DNR;
 	default:
 		return NVME_SC_INTERNAL;
 	}
@@ -468,7 +468,7 @@
 	default:
 		/* this is needed to quiet compiler warning */
 		req->error_loc = offsetof(struct nvme_zone_mgmt_send_cmd, zsa);
-		return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 	}
 
 	return NVME_SC_SUCCESS;
@@ -486,7 +486,7 @@
 
 	if (op == REQ_OP_LAST) {
 		req->error_loc = offsetof(struct nvme_zone_mgmt_send_cmd, zsa);
-		status = NVME_SC_ZONE_INVALID_TRANSITION | NVME_SC_DNR;
+		status = NVME_SC_ZONE_INVALID_TRANSITION | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -498,13 +498,13 @@
 
 	if (sect >= get_capacity(bdev->bd_disk)) {
 		req->error_loc = offsetof(struct nvme_zone_mgmt_send_cmd, slba);
-		status = NVME_SC_LBA_RANGE | NVME_SC_DNR;
+		status = NVME_SC_LBA_RANGE | NVME_STATUS_DNR;
 		goto out;
 	}
 
 	if (sect & (zone_sectors - 1)) {
 		req->error_loc = offsetof(struct nvme_zone_mgmt_send_cmd, slba);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -556,13 +556,13 @@
 
 	if (sect >= get_capacity(req->ns->bdev->bd_disk)) {
 		req->error_loc = offsetof(struct nvme_rw_command, slba);
-		status = NVME_SC_LBA_RANGE | NVME_SC_DNR;
+		status = NVME_SC_LBA_RANGE | NVME_STATUS_DNR;
 		goto out;
 	}
 
 	if (sect & (bdev_zone_sectors(req->ns->bdev) - 1)) {
 		req->error_loc = offsetof(struct nvme_rw_command, slba);
-		status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		goto out;
 	}
 
@@ -595,7 +595,7 @@
 	}
 
 	if (total_len != nvmet_rw_data_len(req)) {
-		status = NVME_SC_INTERNAL | NVME_SC_DNR;
+		status = NVME_SC_INTERNAL | NVME_STATUS_DNR;
 		goto out_put_bio;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/nvmem/core.c
+++ linux-qcom-6.8.0/drivers/nvmem/core.c
@@ -396,10 +396,9 @@
 	if (!config->base_dev)
 		return -EINVAL;
 
-	if (config->type == NVMEM_TYPE_FRAM)
-		bin_attr_nvmem_eeprom_compat.attr.name = "fram";
-
 	nvmem->eeprom = bin_attr_nvmem_eeprom_compat;
+	if (config->type == NVMEM_TYPE_FRAM)
+		nvmem->eeprom.attr.name = "fram";
 	nvmem->eeprom.attr.mode = nvmem_bin_attr_get_umode(nvmem);
 	nvmem->eeprom.size = nvmem->size;
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
@@ -463,7 +462,7 @@
 						    "%s@%x,%x", entry->name,
 						    entry->offset,
 						    entry->bit_offset);
-		attrs[i].attr.mode = 0444;
+		attrs[i].attr.mode = 0444 & nvmem_bin_attr_get_umode(nvmem);
 		attrs[i].size = entry->bytes;
 		attrs[i].read = &nvmem_cell_attr_read;
 		attrs[i].private = entry;
@@ -1254,13 +1253,13 @@
 EXPORT_SYMBOL_GPL(nvmem_device_put);
 
 /**
- * devm_nvmem_device_get() - Get nvmem cell of device form a given id
+ * devm_nvmem_device_get() - Get nvmem device of device form a given id
  *
  * @dev: Device that requests the nvmem device.
  * @id: name id for the requested nvmem device.
  *
- * Return: ERR_PTR() on error or a valid pointer to a struct nvmem_cell
- * on success.  The nvmem_cell will be freed by the automatically once the
+ * Return: ERR_PTR() on error or a valid pointer to a struct nvmem_device
+ * on success.  The nvmem_device will be freed by the automatically once the
  * device is freed.
  */
 struct nvmem_device *devm_nvmem_device_get(struct device *dev, const char *id)
--- linux-qcom-6.8.0.orig/drivers/nvmem/meson-efuse.c
+++ linux-qcom-6.8.0/drivers/nvmem/meson-efuse.c
@@ -18,18 +18,24 @@
 			    void *val, size_t bytes)
 {
 	struct meson_sm_firmware *fw = context;
+	int ret;
 
-	return meson_sm_call_read(fw, (u8 *)val, bytes, SM_EFUSE_READ, offset,
-				  bytes, 0, 0, 0);
+	ret = meson_sm_call_read(fw, (u8 *)val, bytes, SM_EFUSE_READ, offset,
+				 bytes, 0, 0, 0);
+
+	return ret < 0 ? ret : 0;
 }
 
 static int meson_efuse_write(void *context, unsigned int offset,
 			     void *val, size_t bytes)
 {
 	struct meson_sm_firmware *fw = context;
+	int ret;
+
+	ret = meson_sm_call_write(fw, (u8 *)val, bytes, SM_EFUSE_WRITE, offset,
+				  bytes, 0, 0, 0);
 
-	return meson_sm_call_write(fw, (u8 *)val, bytes, SM_EFUSE_WRITE, offset,
-				   bytes, 0, 0, 0);
+	return ret < 0 ? ret : 0;
 }
 
 static const struct of_device_id meson_efuse_match[] = {
@@ -47,7 +53,6 @@
 	struct nvmem_config *econfig;
 	struct clk *clk;
 	unsigned int size;
-	int ret;
 
 	sm_np = of_parse_phandle(pdev->dev.of_node, "secure-monitor", 0);
 	if (!sm_np) {
@@ -60,27 +65,9 @@
 	if (!fw)
 		return -EPROBE_DEFER;
 
-	clk = devm_clk_get(dev, NULL);
-	if (IS_ERR(clk)) {
-		ret = PTR_ERR(clk);
-		if (ret != -EPROBE_DEFER)
-			dev_err(dev, "failed to get efuse gate");
-		return ret;
-	}
-
-	ret = clk_prepare_enable(clk);
-	if (ret) {
-		dev_err(dev, "failed to enable gate");
-		return ret;
-	}
-
-	ret = devm_add_action_or_reset(dev,
-				       (void(*)(void *))clk_disable_unprepare,
-				       clk);
-	if (ret) {
-		dev_err(dev, "failed to add disable callback");
-		return ret;
-	}
+	clk = devm_clk_get_enabled(dev, NULL);
+	if (IS_ERR(clk))
+		return dev_err_probe(dev, PTR_ERR(clk), "failed to get efuse gate");
 
 	if (meson_sm_call(fw, SM_EFUSE_USER_MAX, &size, 0, 0, 0, 0, 0) < 0) {
 		dev_err(dev, "failed to get max user");
--- linux-qcom-6.8.0.orig/drivers/nvmem/qfprom.c
+++ linux-qcom-6.8.0/drivers/nvmem/qfprom.c
@@ -68,6 +68,7 @@
  * @secclk:       Clock supply.
  * @vcc:          Regulator supply.
  * @soc_data:     Data that for things that varies from SoC to SoC.
+ * @soc_cdata:    Data that are relevant to convey SoC constraints.
  */
 struct qfprom_priv {
 	void __iomem *qfpraw;
@@ -78,6 +79,7 @@
 	struct clk *secclk;
 	struct regulator *vcc;
 	const struct qfprom_soc_data *soc_data;
+	const struct qfprom_soc_compatible_data *soc_cdata;
 };
 
 /**
@@ -99,10 +101,14 @@
  *
  * @keepout: Array of keepout regions for this SoC.
  * @nkeepout: Number of elements in the keepout array.
+ * @word_size: Should be given for SoC where it is not possible
+ *	       to do incremental reading or bytewise and while
+ *	       it is possible read 4 byte at a time.
  */
 struct qfprom_soc_compatible_data {
 	const struct nvmem_keepout *keepout;
 	unsigned int nkeepout;
+	unsigned int word_size;
 };
 
 static const struct nvmem_keepout sc7180_qfprom_keepout[] = {
@@ -110,6 +116,10 @@
 	{.start = 0x220, .end = 0x228}
 };
 
+static const struct qfprom_soc_compatible_data sm8450_qfprom = {
+	.word_size = 4,
+};
+
 static const struct qfprom_soc_compatible_data sc7180_qfprom = {
 	.keepout = sc7180_qfprom_keepout,
 	.nkeepout = ARRAY_SIZE(sc7180_qfprom_keepout)
@@ -317,21 +327,55 @@
 	return ret;
 }
 
+static int __qfprom_reg_constraint_read(void __iomem *base, unsigned int reg,
+					void *_val, size_t bytes,
+					unsigned int word_size)
+{
+	unsigned int i;
+	u8 *val = _val;
+	u32 read_val;
+	u8 *tmp;
+
+	for (i = 0; i < bytes; i++, reg++) {
+		if (i == 0 || reg % word_size == 0) {
+			read_val = readl(base + (reg & ~(word_size - 1)));
+			tmp = (u8 *)&read_val;
+		}
+
+		val[i] = tmp[reg & (word_size - 1)];
+	}
+
+	return 0;
+}
+
+static int __qfprom_reg_read(void __iomem *base, unsigned int reg, void *_val,
+			     size_t bytes)
+{
+	u8 *val = _val;
+	int words = bytes;
+	int i = 0;
+
+	while (words--)
+		*val++ = readb(base + reg + i++);
+
+	return 0;
+}
+
 static int qfprom_reg_read(void *context,
 			unsigned int reg, void *_val, size_t bytes)
 {
 	struct qfprom_priv *priv = context;
-	u8 *val = _val;
-	int i = 0, words = bytes;
 	void __iomem *base = priv->qfpcorrected;
 
 	if (read_raw_data && priv->qfpraw)
 		base = priv->qfpraw;
 
-	while (words--)
-		*val++ = readb(base + reg + i++);
+	if (priv->soc_cdata && priv->soc_cdata->word_size == 4)
+		return __qfprom_reg_constraint_read(base, reg,
+				_val, bytes,
+				priv->soc_cdata->word_size);
 
-	return 0;
+	return __qfprom_reg_read(base, reg, _val, bytes);
 }
 
 static void qfprom_runtime_disable(void *data)
@@ -390,6 +434,8 @@
 		econfig.nkeepout = soc_data->nkeepout;
 	}
 
+	priv->soc_cdata = soc_data;
+
 	/*
 	 * If more than one region is provided then the OS has the ability
 	 * to write.
@@ -447,6 +493,7 @@
 	{ .compatible = "qcom,qfprom",},
 	{ .compatible = "qcom,sc7180-qfprom", .data = &sc7180_qfprom},
 	{ .compatible = "qcom,sc7280-qfprom", .data = &sc7280_qfprom},
+	{ .compatible = "qcom,sm8450-qfprom", .data = &sm8450_qfprom},
 	{/* sentinel */},
 };
 MODULE_DEVICE_TABLE(of, qfprom_of_match);
--- linux-qcom-6.8.0.orig/drivers/nvmem/rmem.c
+++ linux-qcom-6.8.0/drivers/nvmem/rmem.c
@@ -46,7 +46,10 @@
 
 	memunmap(addr);
 
-	return count;
+	if (count < 0)
+		return count;
+
+	return count == bytes ? 0 : -EIO;
 }
 
 static int rmem_probe(struct platform_device *pdev)
--- linux-qcom-6.8.0.orig/drivers/nvmem/rockchip-otp.c
+++ linux-qcom-6.8.0/drivers/nvmem/rockchip-otp.c
@@ -255,6 +255,7 @@
 static struct nvmem_config otp_config = {
 	.name = "rockchip-otp",
 	.owner = THIS_MODULE,
+	.add_legacy_fixed_of_cells = true,
 	.read_only = true,
 	.stride = 1,
 	.word_size = 1,
--- linux-qcom-6.8.0.orig/drivers/nvmem/u-boot-env.c
+++ linux-qcom-6.8.0/drivers/nvmem/u-boot-env.c
@@ -176,6 +176,13 @@
 		data_offset = offsetof(struct u_boot_env_image_broadcom, data);
 		break;
 	}
+
+	if (dev_size < data_offset) {
+		dev_err(dev, "Device too small for u-boot-env\n");
+		err = -EIO;
+		goto err_kfree;
+	}
+
 	crc32_addr = (__le32 *)(buf + crc32_offset);
 	crc32 = le32_to_cpu(*crc32_addr);
 	crc32_data_len = dev_size - crc32_data_offset;
--- linux-qcom-6.8.0.orig/drivers/of/address.c
+++ linux-qcom-6.8.0/drivers/of/address.c
@@ -8,6 +8,7 @@
 #include <linux/logic_pio.h>
 #include <linux/module.h>
 #include <linux/of_address.h>
+#include <linux/overflow.h>
 #include <linux/pci.h>
 #include <linux/pci_regs.h>
 #include <linux/sizes.h>
@@ -443,7 +444,8 @@
 	}
 	if (ranges == NULL || rlen == 0) {
 		offset = of_read_number(addr, na);
-		memset(addr, 0, pna * 4);
+		/* set address to zero, pass flags through */
+		memset(addr + pbus->flag_cells, 0, (pna - pbus->flag_cells) * 4);
 		pr_debug("empty ranges; 1:1 translation\n");
 		goto finish;
 	}
@@ -611,7 +613,7 @@
 	if (ret < 0)
 		return of_get_parent(np);
 
-	return of_node_get(args.np);
+	return args.np;
 }
 #endif
 
@@ -1096,7 +1098,11 @@
 	if (of_mmio_is_nonposted(dev))
 		flags |= IORESOURCE_MEM_NONPOSTED;
 
+	if (overflows_type(taddr, r->start))
+		return -EOVERFLOW;
 	r->start = taddr;
+	if (overflows_type(taddr + size - 1, r->end))
+		return -EOVERFLOW;
 	r->end = taddr + size - 1;
 	r->flags = flags;
 	r->name = name ? name : dev->full_name;
--- linux-qcom-6.8.0.orig/drivers/of/base.c
+++ linux-qcom-6.8.0/drivers/of/base.c
@@ -1415,8 +1415,10 @@
 			map_len--;
 
 			/* Check if not found */
-			if (!new)
+			if (!new) {
+				ret = -EINVAL;
 				goto put;
+			}
 
 			if (!of_device_is_available(new))
 				match = 0;
@@ -1426,17 +1428,20 @@
 				goto put;
 
 			/* Check for malformed properties */
-			if (WARN_ON(new_size > MAX_PHANDLE_ARGS))
-				goto put;
-			if (map_len < new_size)
+			if (WARN_ON(new_size > MAX_PHANDLE_ARGS) ||
+			    map_len < new_size) {
+				ret = -EINVAL;
 				goto put;
+			}
 
 			/* Move forward by new node's #<list>-cells amount */
 			map += new_size;
 			map_len -= new_size;
 		}
-		if (!match)
+		if (!match) {
+			ret = -ENOENT;
 			goto put;
+		}
 
 		/* Get the <list>-map-pass-thru property (optional) */
 		pass = of_get_property(cur, pass_name, NULL);
--- linux-qcom-6.8.0.orig/drivers/of/dynamic.c
+++ linux-qcom-6.8.0/drivers/of/dynamic.c
@@ -9,6 +9,7 @@
 
 #define pr_fmt(fmt)	"OF: " fmt
 
+#include <linux/device.h>
 #include <linux/of.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
@@ -667,6 +668,17 @@
 {
 	struct of_changeset_entry *ce, *cen;
 
+	/*
+	 * When a device is deleted, the device links to/from it are also queued
+	 * for deletion. Until these device links are freed, the devices
+	 * themselves aren't freed. If the device being deleted is due to an
+	 * overlay change, this device might be holding a reference to a device
+	 * node that will be freed. So, wait until all already pending device
+	 * links are deleted before freeing a device node. This ensures we don't
+	 * free any device node that has a non-zero reference count.
+	 */
+	device_link_wait_removal();
+
 	list_for_each_entry_safe_reverse(ce, cen, &ocs->entries, node)
 		__of_changeset_entry_destroy(ce);
 }
--- linux-qcom-6.8.0.orig/drivers/of/fdt.c
+++ linux-qcom-6.8.0/drivers/of/fdt.c
@@ -471,6 +471,7 @@
 int __initdata dt_root_size_cells;
 
 void *initial_boot_params __ro_after_init;
+phys_addr_t initial_boot_params_pa __ro_after_init;
 
 #ifdef CONFIG_OF_EARLY_FLATTREE
 
@@ -1270,17 +1271,18 @@
 	return ptr;
 }
 
-bool __init early_init_dt_verify(void *params)
+bool __init early_init_dt_verify(void *dt_virt, phys_addr_t dt_phys)
 {
-	if (!params)
+	if (!dt_virt)
 		return false;
 
 	/* check device tree validity */
-	if (fdt_check_header(params))
+	if (fdt_check_header(dt_virt))
 		return false;
 
 	/* Setup flat device-tree pointer */
-	initial_boot_params = params;
+	initial_boot_params = dt_virt;
+	initial_boot_params_pa = dt_phys;
 	of_fdt_crc32 = crc32_be(~0, initial_boot_params,
 				fdt_totalsize(initial_boot_params));
 	return true;
@@ -1306,11 +1308,11 @@
 	early_init_dt_check_for_usable_mem_range();
 }
 
-bool __init early_init_dt_scan(void *params)
+bool __init early_init_dt_scan(void *dt_virt, phys_addr_t dt_phys)
 {
 	bool status;
 
-	status = early_init_dt_verify(params);
+	status = early_init_dt_verify(dt_virt, dt_phys);
 	if (!status)
 		return false;
 
--- linux-qcom-6.8.0.orig/drivers/of/irq.c
+++ linux-qcom-6.8.0/drivers/of/irq.c
@@ -25,6 +25,8 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 
+#include "of_private.h"
+
 /**
  * irq_of_parse_and_map - Parse and map an interrupt into linux virq space
  * @dev: Device node of the device whose interrupt is to be mapped
@@ -79,7 +81,8 @@
 /*
  * These interrupt controllers abuse interrupt-map for unspeakable
  * reasons and rely on the core code to *ignore* it (the drivers do
- * their own parsing of the property).
+ * their own parsing of the property). The PAsemi entry covers a
+ * non-sensical interrupt-map that is better left ignored.
  *
  * If you think of adding to the list for something *new*, think
  * again. There is a high chance that you will be sent back to the
@@ -93,9 +96,62 @@
 	"fsl,ls1043a-extirq",
 	"fsl,ls1088a-extirq",
 	"renesas,rza1-irqc",
+	"pasemi,rootbus",
 	NULL,
 };
 
+const __be32 *of_irq_parse_imap_parent(const __be32 *imap, int len, struct of_phandle_args *out_irq)
+{
+	u32 intsize, addrsize;
+	struct device_node *np;
+
+	/* Get the interrupt parent */
+	if (of_irq_workarounds & OF_IMAP_NO_PHANDLE)
+		np = of_node_get(of_irq_dflt_pic);
+	else
+		np = of_find_node_by_phandle(be32_to_cpup(imap));
+	imap++;
+	len--;
+
+	/* Check if not found */
+	if (!np) {
+		pr_debug(" -> imap parent not found !\n");
+		return NULL;
+	}
+
+	/* Get #interrupt-cells and #address-cells of new parent */
+	if (of_property_read_u32(np, "#interrupt-cells",
+					&intsize)) {
+		pr_debug(" -> parent lacks #interrupt-cells!\n");
+		of_node_put(np);
+		return NULL;
+	}
+	if (of_property_read_u32(np, "#address-cells",
+					&addrsize))
+		addrsize = 0;
+
+	pr_debug(" -> intsize=%d, addrsize=%d\n",
+		intsize, addrsize);
+
+	/* Check for malformed properties */
+	if (WARN_ON(addrsize + intsize > MAX_PHANDLE_ARGS)
+		|| (len < (addrsize + intsize))) {
+		of_node_put(np);
+		return NULL;
+	}
+
+	pr_debug(" -> imaplen=%d\n", len);
+
+	imap += addrsize + intsize;
+
+	out_irq->np = np;
+	for (int i = 0; i < intsize; i++)
+		out_irq->args[i] = be32_to_cpup(imap - intsize + i);
+	out_irq->args_count = intsize;
+
+	return imap;
+}
+
 /**
  * of_irq_parse_raw - Low level interrupt tree parsing
  * @addr:	address specifier (start of "reg" property of the device) in be32 format
@@ -112,12 +168,12 @@
  */
 int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
 {
-	struct device_node *ipar, *tnode, *old = NULL, *newpar = NULL;
+	struct device_node *ipar, *tnode, *old = NULL;
 	__be32 initial_match_array[MAX_PHANDLE_ARGS];
 	const __be32 *match_array = initial_match_array;
-	const __be32 *tmp, *imap, *imask, dummy_imask[] = { [0 ... MAX_PHANDLE_ARGS] = cpu_to_be32(~0) };
-	u32 intsize = 1, addrsize, newintsize = 0, newaddrsize = 0;
-	int imaplen, match, i, rc = -EINVAL;
+	const __be32 *tmp, dummy_imask[] = { [0 ... MAX_PHANDLE_ARGS] = cpu_to_be32(~0) };
+	u32 intsize = 1, addrsize;
+	int i, rc = -EINVAL;
 
 #ifdef DEBUG
 	of_print_phandle_args("of_irq_parse_raw: ", out_irq);
@@ -176,6 +232,9 @@
 
 	/* Now start the actual "proper" walk of the interrupt tree */
 	while (ipar != NULL) {
+		int imaplen, match;
+		const __be32 *imap, *oldimap, *imask;
+		struct device_node *newpar;
 		/*
 		 * Now check if cursor is an interrupt-controller and
 		 * if it is then we are done, unless there is an
@@ -216,7 +275,7 @@
 
 		/* Parse interrupt-map */
 		match = 0;
-		while (imaplen > (addrsize + intsize + 1) && !match) {
+		while (imaplen > (addrsize + intsize + 1)) {
 			/* Compare specifiers */
 			match = 1;
 			for (i = 0; i < (addrsize + intsize); i++, imaplen--)
@@ -224,74 +283,31 @@
 
 			pr_debug(" -> match=%d (imaplen=%d)\n", match, imaplen);
 
-			/* Get the interrupt parent */
-			if (of_irq_workarounds & OF_IMAP_NO_PHANDLE)
-				newpar = of_node_get(of_irq_dflt_pic);
-			else
-				newpar = of_find_node_by_phandle(be32_to_cpup(imap));
-			imap++;
-			--imaplen;
-
-			/* Check if not found */
-			if (newpar == NULL) {
-				pr_debug(" -> imap parent not found !\n");
+			oldimap = imap;
+			imap = of_irq_parse_imap_parent(oldimap, imaplen, out_irq);
+			if (!imap)
 				goto fail;
-			}
 
-			if (!of_device_is_available(newpar))
-				match = 0;
-
-			/* Get #interrupt-cells and #address-cells of new
-			 * parent
-			 */
-			if (of_property_read_u32(newpar, "#interrupt-cells",
-						 &newintsize)) {
-				pr_debug(" -> parent lacks #interrupt-cells!\n");
-				goto fail;
-			}
-			if (of_property_read_u32(newpar, "#address-cells",
-						 &newaddrsize))
-				newaddrsize = 0;
-
-			pr_debug(" -> newintsize=%d, newaddrsize=%d\n",
-			    newintsize, newaddrsize);
-
-			/* Check for malformed properties */
-			if (WARN_ON(newaddrsize + newintsize > MAX_PHANDLE_ARGS)
-			    || (imaplen < (newaddrsize + newintsize))) {
-				rc = -EFAULT;
-				goto fail;
-			}
-
-			imap += newaddrsize + newintsize;
-			imaplen -= newaddrsize + newintsize;
+			match &= of_device_is_available(out_irq->np);
+			if (match)
+				break;
 
+			of_node_put(out_irq->np);
+			imaplen -= imap - oldimap;
 			pr_debug(" -> imaplen=%d\n", imaplen);
 		}
-		if (!match) {
-			if (intc) {
-				/*
-				 * The PASEMI Nemo is a known offender, so
-				 * let's only warn for anyone else.
-				 */
-				WARN(!IS_ENABLED(CONFIG_PPC_PASEMI),
-				     "%pOF interrupt-map failed, using interrupt-controller\n",
-				     ipar);
-				return 0;
-			}
-
+		if (!match)
 			goto fail;
-		}
 
 		/*
 		 * Successfully parsed an interrupt-map translation; copy new
 		 * interrupt specifier into the out_irq structure
 		 */
-		match_array = imap - newaddrsize - newintsize;
-		for (i = 0; i < newintsize; i++)
-			out_irq->args[i] = be32_to_cpup(imap - newintsize + i);
-		out_irq->args_count = intsize = newintsize;
-		addrsize = newaddrsize;
+		match_array = oldimap + 1;
+
+		newpar = out_irq->np;
+		intsize = out_irq->args_count;
+		addrsize = (imap - match_array) - intsize;
 
 		if (ipar == newpar) {
 			pr_debug("%pOF interrupt-map entry to self\n", ipar);
@@ -300,7 +316,6 @@
 
 	skiplevel:
 		/* Iterate again with new parent */
-		out_irq->np = newpar;
 		pr_debug(" -> new parent: %pOF\n", newpar);
 		of_node_put(ipar);
 		ipar = newpar;
@@ -310,7 +325,6 @@
 
  fail:
 	of_node_put(ipar);
-	of_node_put(newpar);
 
 	return rc;
 }
@@ -331,7 +345,8 @@
 	struct device_node *p;
 	const __be32 *addr;
 	u32 intsize;
-	int i, res;
+	int i, res, addr_len;
+	__be32 addr_buf[3] = { 0 };
 
 	pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index);
 
@@ -340,13 +355,20 @@
 		return of_irq_parse_oldworld(device, index, out_irq);
 
 	/* Get the reg property (if any) */
-	addr = of_get_property(device, "reg", NULL);
+	addr_len = 0;
+	addr = of_get_property(device, "reg", &addr_len);
+
+	/* Prevent out-of-bounds read in case of longer interrupt parent address size */
+	if (addr_len > sizeof(addr_buf))
+		addr_len = sizeof(addr_buf);
+	if (addr)
+		memcpy(addr_buf, addr, addr_len);
 
 	/* Try the new-style interrupts-extended first */
 	res = of_parse_phandle_with_args(device, "interrupts-extended",
 					"#interrupt-cells", index, out_irq);
 	if (!res)
-		return of_irq_parse_raw(addr, out_irq);
+		return of_irq_parse_raw(addr_buf, out_irq);
 
 	/* Look for the interrupt parent. */
 	p = of_irq_find_parent(device);
@@ -376,7 +398,7 @@
 
 
 	/* Check if there are any interrupt-map translations to process */
-	res = of_irq_parse_raw(addr, out_irq);
+	res = of_irq_parse_raw(addr_buf, out_irq);
  out:
 	of_node_put(p);
 	return res;
@@ -696,8 +718,7 @@
  * @np: device node for @dev
  * @token: bus type for this domain
  *
- * Parse the msi-parent property (both the simple and the complex
- * versions), and returns the corresponding MSI domain.
+ * Parse the msi-parent property and returns the corresponding MSI domain.
  *
  * Returns: the MSI domain for this device (or NULL on failure).
  */
@@ -705,33 +726,14 @@
 				     struct device_node *np,
 				     enum irq_domain_bus_token token)
 {
-	struct device_node *msi_np;
+	struct of_phandle_iterator it;
 	struct irq_domain *d;
+	int err;
 
-	/* Check for a single msi-parent property */
-	msi_np = of_parse_phandle(np, "msi-parent", 0);
-	if (msi_np && !of_property_read_bool(msi_np, "#msi-cells")) {
-		d = irq_find_matching_host(msi_np, token);
-		if (!d)
-			of_node_put(msi_np);
-		return d;
-	}
-
-	if (token == DOMAIN_BUS_PLATFORM_MSI) {
-		/* Check for the complex msi-parent version */
-		struct of_phandle_args args;
-		int index = 0;
-
-		while (!of_parse_phandle_with_args(np, "msi-parent",
-						   "#msi-cells",
-						   index, &args)) {
-			d = irq_find_matching_host(args.np, token);
-			if (d)
-				return d;
-
-			of_node_put(args.np);
-			index++;
-		}
+	of_for_each_phandle(&it, err, np, "msi-parent", "#msi-cells", 0) {
+		d = irq_find_matching_host(it.node, token);
+		if (d)
+			return d;
 	}
 
 	return NULL;
--- linux-qcom-6.8.0.orig/drivers/of/kexec.c
+++ linux-qcom-6.8.0/drivers/of/kexec.c
@@ -301,7 +301,7 @@
 	}
 
 	/* Remove memory reservation for the current device tree. */
-	ret = fdt_find_and_del_mem_rsv(fdt, __pa(initial_boot_params),
+	ret = fdt_find_and_del_mem_rsv(fdt, initial_boot_params_pa,
 				       fdt_totalsize(initial_boot_params));
 	if (ret == -EINVAL) {
 		pr_err("Error removing memory reservation.\n");
--- linux-qcom-6.8.0.orig/drivers/of/module.c
+++ linux-qcom-6.8.0/drivers/of/module.c
@@ -16,19 +16,28 @@
 	ssize_t csize;
 	ssize_t tsize;
 
+	/*
+	 * Prevent a kernel oops in vsnprintf() -- it only allows passing a
+	 * NULL ptr when the length is also 0. Also filter out the negative
+	 * lengths...
+	 */
+	if ((len > 0 && !str) || len < 0)
+		return -EINVAL;
+
 	/* Name & Type */
 	/* %p eats all alphanum characters, so %c must be used here */
 	csize = snprintf(str, len, "of:N%pOFn%c%s", np, 'T',
 			 of_node_get_device_type(np));
 	tsize = csize;
+	if (csize >= len)
+		csize = len > 0 ? len - 1 : 0;
 	len -= csize;
-	if (str)
-		str += csize;
+	str += csize;
 
 	of_property_for_each_string(np, "compatible", p, compat) {
 		csize = strlen(compat) + 1;
 		tsize += csize;
-		if (csize > len)
+		if (csize >= len)
 			continue;
 
 		csize = snprintf(str, len, "C%s", compat);
--- linux-qcom-6.8.0.orig/drivers/of/of_private.h
+++ linux-qcom-6.8.0/drivers/of/of_private.h
@@ -158,6 +158,9 @@
 extern int of_bus_n_addr_cells(struct device_node *np);
 extern int of_bus_n_size_cells(struct device_node *np);
 
+const __be32 *of_irq_parse_imap_parent(const __be32 *imap, int len,
+				       struct of_phandle_args *out_irq);
+
 struct bus_dma_region;
 #if defined(CONFIG_OF_ADDRESS) && defined(CONFIG_HAS_DMA)
 int of_dma_get_range(struct device_node *np,
--- linux-qcom-6.8.0.orig/drivers/of/platform.c
+++ linux-qcom-6.8.0/drivers/of/platform.c
@@ -593,7 +593,7 @@
 			 * This can happen for example on DT systems that do EFI
 			 * booting and may provide a GOP handle to the EFI stub.
 			 */
-			sysfb_disable();
+			sysfb_disable(NULL);
 			of_platform_device_create(node, NULL, NULL);
 			of_node_put(node);
 		}
--- linux-qcom-6.8.0.orig/drivers/of/property.c
+++ linux-qcom-6.8.0/drivers/of/property.c
@@ -1217,7 +1217,6 @@
 DEFINE_SIMPLE_PROP(iommus, "iommus", "#iommu-cells")
 DEFINE_SIMPLE_PROP(mboxes, "mboxes", "#mbox-cells")
 DEFINE_SIMPLE_PROP(io_channels, "io-channels", "#io-channel-cells")
-DEFINE_SIMPLE_PROP(interrupt_parent, "interrupt-parent", NULL)
 DEFINE_SIMPLE_PROP(dmas, "dmas", "#dma-cells")
 DEFINE_SIMPLE_PROP(power_domains, "power-domains", "#power-domain-cells")
 DEFINE_SIMPLE_PROP(hwlocks, "hwlocks", "#hwlock-cells")
@@ -1317,7 +1316,6 @@
 	{ .parse_prop = parse_iommu_maps, .optional = true, },
 	{ .parse_prop = parse_mboxes, },
 	{ .parse_prop = parse_io_channels, },
-	{ .parse_prop = parse_interrupt_parent, },
 	{ .parse_prop = parse_dmas, .optional = true, },
 	{ .parse_prop = parse_power_domains, },
 	{ .parse_prop = parse_hwlocks, },
--- linux-qcom-6.8.0.orig/drivers/of/unittest-data/tests-platform.dtsi
+++ linux-qcom-6.8.0/drivers/of/unittest-data/tests-platform.dtsi
@@ -34,5 +34,18 @@
 				};
 			};
 		};
+
+		platform-tests-2 {
+			// No #address-cells or #size-cells
+			node {
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				test-device@100 {
+					compatible = "test-sub-device";
+					reg = <0x100 1>;
+				};
+			};
+		};
 	};
 };
--- linux-qcom-6.8.0.orig/drivers/of/unittest.c
+++ linux-qcom-6.8.0/drivers/of/unittest.c
@@ -1186,6 +1186,7 @@
 static void __init of_unittest_reg(void)
 {
 	struct device_node *np;
+	struct resource res;
 	int ret;
 	u64 addr, size;
 
@@ -1202,6 +1203,19 @@
 		np, addr);
 
 	of_node_put(np);
+
+	np = of_find_node_by_path("/testcase-data/platform-tests-2/node/test-device@100");
+	if (!np) {
+		pr_err("missing testcase data\n");
+		return;
+	}
+
+	ret = of_address_to_resource(np, 0, &res);
+	unittest(ret == -EINVAL, "of_address_to_resource(%pOF) expected error on untranslatable address\n",
+		 np);
+
+	of_node_put(np);
+
 }
 
 struct of_unittest_expected_res {
@@ -4093,10 +4107,6 @@
 	add_taint(TAINT_TEST, LOCKDEP_STILL_OK);
 
 	/* adding data for unittest */
-
-	if (IS_ENABLED(CONFIG_UML))
-		unittest_unflatten_overlay_base();
-
 	res = unittest_data_add();
 	if (res)
 		return res;
--- linux-qcom-6.8.0.orig/drivers/opp/core.c
+++ linux-qcom-6.8.0/drivers/opp/core.c
@@ -2393,7 +2393,8 @@
 static int _opp_attach_genpd(struct opp_table *opp_table, struct device *dev,
 			const char * const *names, struct device ***virt_devs)
 {
-	struct device *virt_dev;
+	struct device *virt_dev, *gdev;
+	struct opp_table *genpd_table;
 	int index = 0, ret = -EINVAL;
 	const char * const *name = names;
 
@@ -2427,6 +2428,36 @@
 		}
 
 		/*
+		 * The required_opp_tables parsing is not perfect, as the OPP
+		 * core does the parsing solely based on the DT node pointers.
+		 * The core sets the required_opp_tables entry to the first OPP
+		 * table in the "opp_tables" list, that matches with the node
+		 * pointer.
+		 *
+		 * If the target DT OPP table is used by multiple devices and
+		 * they all create separate instances of 'struct opp_table' from
+		 * it, then it is possible that the required_opp_tables entry
+		 * may be set to the incorrect sibling device.
+		 *
+		 * Cross check it again and fix if required.
+		 */
+		gdev = dev_to_genpd_dev(virt_dev);
+		if (IS_ERR(gdev)) {
+			ret = PTR_ERR(gdev);
+			goto err;
+		}
+
+		genpd_table = _find_opp_table(gdev);
+		if (!IS_ERR(genpd_table)) {
+			if (genpd_table != opp_table->required_opp_tables[index]) {
+				dev_pm_opp_put_opp_table(opp_table->required_opp_tables[index]);
+				opp_table->required_opp_tables[index] = genpd_table;
+			} else {
+				dev_pm_opp_put_opp_table(genpd_table);
+			}
+		}
+
+		/*
 		 * Add the virtual genpd device as a user of the OPP table, so
 		 * we can call dev_pm_opp_set_opp() on it directly.
 		 *
@@ -2611,8 +2642,10 @@
 
 	/* Attach genpds */
 	if (config->genpd_names) {
-		if (config->required_devs)
+		if (config->required_devs) {
+			ret = -EINVAL;
 			goto err;
+		}
 
 		ret = _opp_attach_genpd(opp_table, dev, config->genpd_names,
 					config->virt_devs);
@@ -3176,3 +3209,25 @@
 	dev_pm_opp_put_opp_table(opp_table);
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_remove_table);
+
+/*
+ * dev_pm_opp_set_level() - Configure device for a level
+ * @dev: device for which we do this operation
+ * @level: level to set to
+ *
+ * Return: 0 on success, a negative error number otherwise.
+ */
+int dev_pm_opp_set_level(struct device *dev, unsigned int level)
+{
+	struct dev_pm_opp *opp = dev_pm_opp_find_level_exact(dev, level);
+	int ret = 0;
+
+	if (IS_ERR(opp))
+		return -EINVAL;
+
+	ret = dev_pm_opp_set_opp(dev, opp);
+	dev_pm_opp_put(opp);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(dev_pm_opp_set_level);
--- linux-qcom-6.8.0.orig/drivers/opp/debugfs.c
+++ linux-qcom-6.8.0/drivers/opp/debugfs.c
@@ -37,10 +37,12 @@
 			    size_t count, loff_t *ppos)
 {
 	struct icc_path *path = fp->private_data;
+	const char *name = icc_get_name(path);
 	char buf[64];
-	int i;
+	int i = 0;
 
-	i = scnprintf(buf, sizeof(buf), "%.62s\n", icc_get_name(path));
+	if (name)
+		i = scnprintf(buf, sizeof(buf), "%.62s\n", name);
 
 	return simple_read_from_buffer(userbuf, count, ppos, buf, i);
 }
--- linux-qcom-6.8.0.orig/drivers/opp/ti-opp-supply.c
+++ linux-qcom-6.8.0/drivers/opp/ti-opp-supply.c
@@ -393,10 +393,12 @@
 	}
 
 	ret = dev_pm_opp_set_config_regulators(cpu_dev, ti_opp_config_regulators);
-	if (ret < 0)
+	if (ret < 0) {
 		_free_optimized_voltages(dev, &opp_data);
+		return ret;
+	}
 
-	return ret;
+	return 0;
 }
 
 static struct platform_driver ti_opp_supply_driver = {
--- linux-qcom-6.8.0.orig/drivers/parport/parport_amiga.c
+++ linux-qcom-6.8.0/drivers/parport/parport_amiga.c
@@ -230,7 +230,13 @@
 	return 0;
 }
 
-static struct platform_driver amiga_parallel_driver = {
+/*
+ * amiga_parallel_remove() lives in .exit.text. For drivers registered via
+ * module_platform_driver_probe() this is ok because they cannot get unbound at
+ * runtime. So mark the driver struct with __refdata to prevent modpost
+ * triggering a section mismatch warning.
+ */
+static struct platform_driver amiga_parallel_driver __refdata = {
 	.remove = __exit_p(amiga_parallel_remove),
 	.driver   = {
 		.name	= "amiga-parallel",
--- linux-qcom-6.8.0.orig/drivers/parport/procfs.c
+++ linux-qcom-6.8.0/drivers/parport/procfs.c
@@ -51,12 +51,12 @@
 	
 	for (dev = port->devices; dev ; dev = dev->next) {
 		if(dev == port->cad) {
-			len += sprintf(buffer, "%s\n", dev->name);
+			len += scnprintf(buffer, sizeof(buffer), "%s\n", dev->name);
 		}
 	}
 
 	if(!len) {
-		len += sprintf(buffer, "%s\n", "none");
+		len += scnprintf(buffer, sizeof(buffer), "%s\n", "none");
 	}
 
 	if (len > *lenp)
@@ -87,19 +87,19 @@
 	}
 	
 	if ((str = info->class_name) != NULL)
-		len += sprintf (buffer + len, "CLASS:%s;\n", str);
+		len += scnprintf (buffer + len, sizeof(buffer) - len, "CLASS:%s;\n", str);
 
 	if ((str = info->model) != NULL)
-		len += sprintf (buffer + len, "MODEL:%s;\n", str);
+		len += scnprintf (buffer + len, sizeof(buffer) - len, "MODEL:%s;\n", str);
 
 	if ((str = info->mfr) != NULL)
-		len += sprintf (buffer + len, "MANUFACTURER:%s;\n", str);
+		len += scnprintf (buffer + len, sizeof(buffer) - len, "MANUFACTURER:%s;\n", str);
 
 	if ((str = info->description) != NULL)
-		len += sprintf (buffer + len, "DESCRIPTION:%s;\n", str);
+		len += scnprintf (buffer + len, sizeof(buffer) - len, "DESCRIPTION:%s;\n", str);
 
 	if ((str = info->cmdset) != NULL)
-		len += sprintf (buffer + len, "COMMAND SET:%s;\n", str);
+		len += scnprintf (buffer + len, sizeof(buffer) - len, "COMMAND SET:%s;\n", str);
 
 	if (len > *lenp)
 		len = *lenp;
@@ -117,7 +117,7 @@
 				 void *result, size_t *lenp, loff_t *ppos)
 {
 	struct parport *port = (struct parport *)table->extra1;
-	char buffer[20];
+	char buffer[64];
 	int len = 0;
 
 	if (*ppos) {
@@ -128,7 +128,7 @@
 	if (write) /* permissions prevent this anyway */
 		return -EACCES;
 
-	len += sprintf (buffer, "%lu\t%lu\n", port->base, port->base_hi);
+	len += scnprintf (buffer, sizeof(buffer), "%lu\t%lu\n", port->base, port->base_hi);
 
 	if (len > *lenp)
 		len = *lenp;
@@ -155,7 +155,7 @@
 	if (write) /* permissions prevent this anyway */
 		return -EACCES;
 
-	len += sprintf (buffer, "%d\n", port->irq);
+	len += scnprintf (buffer, sizeof(buffer), "%d\n", port->irq);
 
 	if (len > *lenp)
 		len = *lenp;
@@ -182,7 +182,7 @@
 	if (write) /* permissions prevent this anyway */
 		return -EACCES;
 
-	len += sprintf (buffer, "%d\n", port->dma);
+	len += scnprintf (buffer, sizeof(buffer), "%d\n", port->dma);
 
 	if (len > *lenp)
 		len = *lenp;
@@ -213,7 +213,7 @@
 #define printmode(x)							\
 do {									\
 	if (port->modes & PARPORT_MODE_##x)				\
-		len += sprintf(buffer + len, "%s%s", f++ ? "," : "", #x); \
+		len += scnprintf(buffer + len, sizeof(buffer) - len, "%s%s", f++ ? "," : "", #x); \
 } while (0)
 		int f = 0;
 		printmode(PCSPP);
--- linux-qcom-6.8.0.orig/drivers/pci/Kconfig
+++ linux-qcom-6.8.0/drivers/pci/Kconfig
@@ -291,5 +291,6 @@
 source "drivers/pci/controller/Kconfig"
 source "drivers/pci/endpoint/Kconfig"
 source "drivers/pci/switch/Kconfig"
+source "drivers/pci/pwrctl/Kconfig"
 
 endif
--- linux-qcom-6.8.0.orig/drivers/pci/Makefile
+++ linux-qcom-6.8.0/drivers/pci/Makefile
@@ -9,6 +9,7 @@
 
 obj-$(CONFIG_PCI)		+= msi/
 obj-$(CONFIG_PCI)		+= pcie/
+obj-$(CONFIG_PCI)		+= pwrctl/
 
 ifdef CONFIG_PCI
 obj-$(CONFIG_PROC_FS)		+= proc.o
--- linux-qcom-6.8.0.orig/drivers/pci/bus.c
+++ linux-qcom-6.8.0/drivers/pci/bus.c
@@ -12,6 +12,7 @@
 #include <linux/errno.h>
 #include <linux/ioport.h>
 #include <linux/of.h>
+#include <linux/of_platform.h>
 #include <linux/proc_fs.h>
 #include <linux/slab.h>
 
@@ -354,6 +355,14 @@
 		pci_warn(dev, "device attach failed (%d)\n", retval);
 
 	pci_dev_assign_added(dev, true);
+
+	if (pci_is_bridge(dev)) {
+		retval = of_platform_populate(dev->dev.of_node, NULL, NULL,
+					      &dev->dev);
+		if (retval)
+			pci_err(dev, "failed to populate child OF nodes (%d)\n",
+				retval);
+	}
 }
 EXPORT_SYMBOL_GPL(pci_bus_add_device);
 
--- linux-qcom-6.8.0.orig/drivers/pci/controller/Kconfig
+++ linux-qcom-6.8.0/drivers/pci/controller/Kconfig
@@ -356,4 +356,5 @@
 source "drivers/pci/controller/cadence/Kconfig"
 source "drivers/pci/controller/dwc/Kconfig"
 source "drivers/pci/controller/mobiveil/Kconfig"
+source "drivers/pci/controller/misc/Kconfig"
 endmenu
--- linux-qcom-6.8.0.orig/drivers/pci/controller/Makefile
+++ linux-qcom-6.8.0/drivers/pci/controller/Makefile
@@ -44,6 +44,7 @@
 # pcie-hisi.o quirks are needed even without CONFIG_PCIE_DW
 obj-y				+= dwc/
 obj-y				+= mobiveil/
+obj-y				+= misc/
 
 
 # The following drivers are for devices that use the generic ACPI
--- linux-qcom-6.8.0.orig/drivers/pci/controller/cadence/pci-j721e.c
+++ linux-qcom-6.8.0/drivers/pci/controller/cadence/pci-j721e.c
@@ -7,6 +7,8 @@
  */
 
 #include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <linux/container_of.h>
 #include <linux/delay.h>
 #include <linux/gpio/consumer.h>
 #include <linux/io.h>
@@ -22,6 +24,8 @@
 #include "../../pci.h"
 #include "pcie-cadence.h"
 
+#define cdns_pcie_to_rc(p) container_of(p, struct cdns_pcie_rc, pcie)
+
 #define ENABLE_REG_SYS_2	0x108
 #define STATUS_REG_SYS_2	0x508
 #define STATUS_CLR_REG_SYS_2	0x708
@@ -52,6 +56,7 @@
 	u32			mode;
 	u32			num_lanes;
 	u32			max_lanes;
+	struct gpio_desc	*reset_gpio;
 	void __iomem		*user_cfg_base;
 	void __iomem		*intd_cfg_base;
 	u32			linkdown_irq_regfield;
@@ -510,6 +515,7 @@
 				dev_err(dev, "Failed to get reset GPIO\n");
 			goto err_get_sync;
 		}
+		pcie->reset_gpio = gpiod;
 
 		ret = cdns_pcie_init_phy(dev, cdns_pcie);
 		if (ret) {
@@ -532,15 +538,14 @@
 		pcie->refclk = clk;
 
 		/*
-		 * "Power Sequencing and Reset Signal Timings" table in
-		 * PCI EXPRESS CARD ELECTROMECHANICAL SPECIFICATION, REV. 3.0
-		 * indicates PERST# should be deasserted after minimum of 100us
-		 * once REFCLK is stable. The REFCLK to the connector in RC
-		 * mode is selected while enabling the PHY. So deassert PERST#
-		 * after 100 us.
+		 * Section 2.2 of the PCI Express Card Electromechanical
+		 * Specification (Revision 5.1) mandates that the deassertion
+		 * of the PERST# signal should be delayed by 100 ms (TPVPERL).
+		 * This shall ensure that the power and the reference clock
+		 * are stable.
 		 */
 		if (gpiod) {
-			usleep_range(100, 200);
+			msleep(PCIE_T_PVPERL_MS);
 			gpiod_set_value_cansleep(gpiod, 1);
 		}
 
@@ -589,6 +594,86 @@
 	pm_runtime_disable(dev);
 }
 
+static int j721e_pcie_suspend_noirq(struct device *dev)
+{
+	struct j721e_pcie *pcie = dev_get_drvdata(dev);
+
+	if (pcie->mode == PCI_MODE_RC) {
+		gpiod_set_value_cansleep(pcie->reset_gpio, 0);
+		clk_disable_unprepare(pcie->refclk);
+	}
+
+	cdns_pcie_disable_phy(pcie->cdns_pcie);
+
+	return 0;
+}
+
+static int j721e_pcie_resume_noirq(struct device *dev)
+{
+	struct j721e_pcie *pcie = dev_get_drvdata(dev);
+	struct cdns_pcie *cdns_pcie = pcie->cdns_pcie;
+	int ret;
+
+	ret = j721e_pcie_ctrl_init(pcie);
+	if (ret < 0)
+		return ret;
+
+	j721e_pcie_config_link_irq(pcie);
+
+	/*
+	 * This is not called explicitly in the probe, it is called by
+	 * cdns_pcie_init_phy().
+	 */
+	ret = cdns_pcie_enable_phy(pcie->cdns_pcie);
+	if (ret < 0)
+		return ret;
+
+	if (pcie->mode == PCI_MODE_RC) {
+		struct cdns_pcie_rc *rc = cdns_pcie_to_rc(cdns_pcie);
+
+		ret = clk_prepare_enable(pcie->refclk);
+		if (ret < 0)
+			return ret;
+
+		/*
+		 * Section 2.2 of the PCI Express Card Electromechanical
+		 * Specification (Revision 5.1) mandates that the deassertion
+		 * of the PERST# signal should be delayed by 100 ms (TPVPERL).
+		 * This shall ensure that the power and the reference clock
+		 * are stable.
+		 */
+		if (pcie->reset_gpio) {
+			msleep(PCIE_T_PVPERL_MS);
+			gpiod_set_value_cansleep(pcie->reset_gpio, 1);
+		}
+
+		ret = cdns_pcie_host_link_setup(rc);
+		if (ret < 0) {
+			clk_disable_unprepare(pcie->refclk);
+			return ret;
+		}
+
+		/*
+		 * Reset internal status of BARs to force reinitialization in
+		 * cdns_pcie_host_init().
+		 */
+		for (enum cdns_pcie_rp_bar bar = RP_BAR0; bar <= RP_NO_BAR; bar++)
+			rc->avail_ib_bar[bar] = true;
+
+		ret = cdns_pcie_host_init(rc);
+		if (ret) {
+			clk_disable_unprepare(pcie->refclk);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+static DEFINE_NOIRQ_DEV_PM_OPS(j721e_pcie_pm_ops,
+			       j721e_pcie_suspend_noirq,
+			       j721e_pcie_resume_noirq);
+
 static struct platform_driver j721e_pcie_driver = {
 	.probe  = j721e_pcie_probe,
 	.remove_new = j721e_pcie_remove,
@@ -596,6 +681,7 @@
 		.name	= "j721e-pcie",
 		.of_match_table = of_j721e_pcie_match,
 		.suppress_bind_attrs = true,
+		.pm	= pm_sleep_ptr(&j721e_pcie_pm_ops),
 	},
 };
 builtin_platform_driver(j721e_pcie_driver);
--- linux-qcom-6.8.0.orig/drivers/pci/controller/cadence/pcie-cadence-host.c
+++ linux-qcom-6.8.0/drivers/pci/controller/cadence/pcie-cadence-host.c
@@ -485,8 +485,7 @@
 	return cdns_pcie_host_map_dma_ranges(rc);
 }
 
-static int cdns_pcie_host_init(struct device *dev,
-			       struct cdns_pcie_rc *rc)
+int cdns_pcie_host_init(struct cdns_pcie_rc *rc)
 {
 	int err;
 
@@ -497,6 +496,30 @@
 	return cdns_pcie_host_init_address_translation(rc);
 }
 
+int cdns_pcie_host_link_setup(struct cdns_pcie_rc *rc)
+{
+	struct cdns_pcie *pcie = &rc->pcie;
+	struct device *dev = rc->pcie.dev;
+	int ret;
+
+	if (rc->quirk_detect_quiet_flag)
+		cdns_pcie_detect_quiet_min_delay_set(&rc->pcie);
+
+	cdns_pcie_host_enable_ptm_response(pcie);
+
+	ret = cdns_pcie_start_link(pcie);
+	if (ret) {
+		dev_err(dev, "Failed to start link\n");
+		return ret;
+	}
+
+	ret = cdns_pcie_host_start_link(rc);
+	if (ret)
+		dev_dbg(dev, "PCIe link never came up\n");
+
+	return 0;
+}
+
 int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
 {
 	struct device *dev = rc->pcie.dev;
@@ -533,25 +556,14 @@
 		return PTR_ERR(rc->cfg_base);
 	rc->cfg_res = res;
 
-	if (rc->quirk_detect_quiet_flag)
-		cdns_pcie_detect_quiet_min_delay_set(&rc->pcie);
-
-	cdns_pcie_host_enable_ptm_response(pcie);
-
-	ret = cdns_pcie_start_link(pcie);
-	if (ret) {
-		dev_err(dev, "Failed to start link\n");
-		return ret;
-	}
-
-	ret = cdns_pcie_host_start_link(rc);
+	ret = cdns_pcie_host_link_setup(rc);
 	if (ret)
-		dev_dbg(dev, "PCIe link never came up\n");
+		return ret;
 
 	for (bar = RP_BAR0; bar <= RP_NO_BAR; bar++)
 		rc->avail_ib_bar[bar] = true;
 
-	ret = cdns_pcie_host_init(dev, rc);
+	ret = cdns_pcie_host_init(rc);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/pci/controller/cadence/pcie-cadence.h
+++ linux-qcom-6.8.0/drivers/pci/controller/cadence/pcie-cadence.h
@@ -515,10 +515,22 @@
 }
 
 #ifdef CONFIG_PCIE_CADENCE_HOST
+int cdns_pcie_host_link_setup(struct cdns_pcie_rc *rc);
+int cdns_pcie_host_init(struct cdns_pcie_rc *rc);
 int cdns_pcie_host_setup(struct cdns_pcie_rc *rc);
 void __iomem *cdns_pci_map_bus(struct pci_bus *bus, unsigned int devfn,
 			       int where);
 #else
+static inline int cdns_pcie_host_link_setup(struct cdns_pcie_rc *rc)
+{
+	return 0;
+}
+
+static inline int cdns_pcie_host_init(struct cdns_pcie_rc *rc)
+{
+	return 0;
+}
+
 static inline int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
 {
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/Kconfig
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/Kconfig
@@ -265,12 +265,17 @@
 	  order to enable device-specific features PCI_DW_PLAT_EP must be
 	  selected.
 
+config PCIE_QCOM_COMMON
+	bool
+
 config PCIE_QCOM
 	bool "Qualcomm PCIe controller (host mode)"
 	depends on OF && (ARCH_QCOM || COMPILE_TEST)
+	depends on QCOM_COMMAND_DB || QCOM_COMMAND_DB=n
 	depends on PCI_MSI
 	select PCIE_DW_HOST
 	select CRC8
+	select PCIE_QCOM_COMMON
 	help
 	  Say Y here to enable PCIe controller support on Qualcomm SoCs. The
 	  PCIe controller uses the DesignWare core plus Qualcomm-specific
@@ -281,6 +286,7 @@
 	depends on OF && (ARCH_QCOM || COMPILE_TEST)
 	depends on PCI_ENDPOINT
 	select PCIE_DW_EP
+	select PCIE_QCOM_COMMON
 	help
 	  Say Y here to enable support for the PCIe controllers on Qualcomm SoCs
 	  to work in endpoint mode. The PCIe controller uses the DesignWare core
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/Makefile
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/Makefile
@@ -12,6 +12,7 @@
 obj-$(CONFIG_PCI_KEYSTONE) += pci-keystone.o
 obj-$(CONFIG_PCI_LAYERSCAPE) += pci-layerscape.o
 obj-$(CONFIG_PCI_LAYERSCAPE_EP) += pci-layerscape-ep.o
+obj-$(CONFIG_PCIE_QCOM_COMMON) += pcie-qcom-common.o
 obj-$(CONFIG_PCIE_QCOM) += pcie-qcom.o
 obj-$(CONFIG_PCIE_QCOM_EP) += pcie-qcom-ep.o
 obj-$(CONFIG_PCIE_ARMADA_8K) += pcie-armada8k.o
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pci-dra7xx.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pci-dra7xx.c
@@ -841,14 +841,21 @@
 	dra7xx->mode = mode;
 
 	ret = devm_request_threaded_irq(dev, irq, NULL, dra7xx_pcie_irq_handler,
-			       IRQF_SHARED, "dra7xx-pcie-main", dra7xx);
+					IRQF_SHARED | IRQF_ONESHOT,
+					"dra7xx-pcie-main", dra7xx);
 	if (ret) {
 		dev_err(dev, "failed to request irq\n");
-		goto err_gpio;
+		goto err_deinit;
 	}
 
 	return 0;
 
+err_deinit:
+	if (dra7xx->mode == DW_PCIE_RC_TYPE)
+		dw_pcie_host_deinit(&dra7xx->pci->pp);
+	else
+		dw_pcie_ep_deinit(&dra7xx->pci->ep);
+
 err_gpio:
 err_get_sync:
 	pm_runtime_put(dev);
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pci-imx6.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pci-imx6.c
@@ -895,12 +895,12 @@
 	if (ret)
 		goto err_reset_phy;
 
-	if (pci->link_gen > 1) {
+	if (pci->max_link_speed > 1) {
 		/* Allow faster modes after the link is up */
 		dw_pcie_dbi_ro_wr_en(pci);
 		tmp = dw_pcie_readl_dbi(pci, offset + PCI_EXP_LNKCAP);
 		tmp &= ~PCI_EXP_LNKCAP_SLS;
-		tmp |= pci->link_gen;
+		tmp |= pci->max_link_speed;
 		dw_pcie_writel_dbi(pci, offset + PCI_EXP_LNKCAP, tmp);
 
 		/*
@@ -997,7 +997,7 @@
 		ret = phy_power_on(imx6_pcie->phy);
 		if (ret) {
 			dev_err(dev, "waiting for PHY ready timeout!\n");
-			goto err_phy_off;
+			goto err_phy_exit;
 		}
 	}
 
@@ -1012,8 +1012,9 @@
 	return 0;
 
 err_phy_off:
-	if (imx6_pcie->phy)
-		phy_exit(imx6_pcie->phy);
+	phy_power_off(imx6_pcie->phy);
+err_phy_exit:
+	phy_exit(imx6_pcie->phy);
 err_clk_disable:
 	imx6_pcie_clk_disable(imx6_pcie);
 err_reg_disable:
@@ -1417,8 +1418,8 @@
 		imx6_pcie->tx_swing_low = 127;
 
 	/* Limit link speed */
-	pci->link_gen = 1;
-	of_property_read_u32(node, "fsl,max-link-speed", &pci->link_gen);
+	pci->max_link_speed = 1;
+	of_property_read_u32(node, "fsl,max-link-speed", &pci->max_link_speed);
 
 	imx6_pcie->vpcie = devm_regulator_get_optional(&pdev->dev, "vpcie");
 	if (IS_ERR(imx6_pcie->vpcie)) {
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pci-keystone.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pci-keystone.c
@@ -34,6 +34,11 @@
 #define PCIE_DEVICEID_SHIFT	16
 
 /* Application registers */
+#define PID				0x000
+#define RTL				GENMASK(15, 11)
+#define RTL_SHIFT			11
+#define AM6_PCI_PG1_RTL_VER		0x15
+
 #define CMD_STATUS			0x004
 #define LTSSM_EN_VAL		        BIT(0)
 #define OB_XLAT_EN_VAL		        BIT(1)
@@ -104,6 +109,8 @@
 
 #define to_keystone_pcie(x)		dev_get_drvdata((x)->dev)
 
+#define PCI_DEVICE_ID_TI_AM654X		0xb00c
+
 struct ks_pcie_of_data {
 	enum dw_pcie_device_mode mode;
 	const struct dw_pcie_host_ops *host_ops;
@@ -245,8 +252,68 @@
 	.irq_unmask = ks_pcie_msi_unmask,
 };
 
+/**
+ * ks_pcie_set_dbi_mode() - Set DBI mode to access overlaid BAR mask registers
+ * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone
+ *	     PCIe host controller driver information.
+ *
+ * Since modification of dbi_cs2 involves different clock domain, read the
+ * status back to ensure the transition is complete.
+ */
+static void ks_pcie_set_dbi_mode(struct keystone_pcie *ks_pcie)
+{
+	u32 val;
+
+	val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
+	val |= DBI_CS2;
+	ks_pcie_app_writel(ks_pcie, CMD_STATUS, val);
+
+	do {
+		val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
+	} while (!(val & DBI_CS2));
+}
+
+/**
+ * ks_pcie_clear_dbi_mode() - Disable DBI mode
+ * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone
+ *	     PCIe host controller driver information.
+ *
+ * Since modification of dbi_cs2 involves different clock domain, read the
+ * status back to ensure the transition is complete.
+ */
+static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie)
+{
+	u32 val;
+
+	val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
+	val &= ~DBI_CS2;
+	ks_pcie_app_writel(ks_pcie, CMD_STATUS, val);
+
+	do {
+		val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
+	} while (val & DBI_CS2);
+}
+
 static int ks_pcie_msi_host_init(struct dw_pcie_rp *pp)
 {
+	struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
+	struct keystone_pcie *ks_pcie = to_keystone_pcie(pci);
+
+	/* Configure and set up BAR0 */
+	ks_pcie_set_dbi_mode(ks_pcie);
+
+	/* Enable BAR0 */
+	dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 1);
+	dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, SZ_4K - 1);
+
+	ks_pcie_clear_dbi_mode(ks_pcie);
+
+	/*
+	 * For BAR0, just setting bus address for inbound writes (MSI) should
+	 * be sufficient.  Use physical address to avoid any conflicts.
+	 */
+	dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, ks_pcie->app.start);
+
 	pp->msi_irq_chip = &ks_pcie_msi_irq_chip;
 	return dw_pcie_allocate_domains(pp);
 }
@@ -340,59 +407,22 @@
 	.xlate = irq_domain_xlate_onetwocell,
 };
 
-/**
- * ks_pcie_set_dbi_mode() - Set DBI mode to access overlaid BAR mask registers
- * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone
- *	     PCIe host controller driver information.
- *
- * Since modification of dbi_cs2 involves different clock domain, read the
- * status back to ensure the transition is complete.
- */
-static void ks_pcie_set_dbi_mode(struct keystone_pcie *ks_pcie)
-{
-	u32 val;
-
-	val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
-	val |= DBI_CS2;
-	ks_pcie_app_writel(ks_pcie, CMD_STATUS, val);
-
-	do {
-		val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
-	} while (!(val & DBI_CS2));
-}
-
-/**
- * ks_pcie_clear_dbi_mode() - Disable DBI mode
- * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone
- *	     PCIe host controller driver information.
- *
- * Since modification of dbi_cs2 involves different clock domain, read the
- * status back to ensure the transition is complete.
- */
-static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie)
-{
-	u32 val;
-
-	val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
-	val &= ~DBI_CS2;
-	ks_pcie_app_writel(ks_pcie, CMD_STATUS, val);
-
-	do {
-		val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
-	} while (val & DBI_CS2);
-}
-
-static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie)
+static int ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie)
 {
 	u32 val;
 	u32 num_viewport = ks_pcie->num_viewport;
 	struct dw_pcie *pci = ks_pcie->pci;
 	struct dw_pcie_rp *pp = &pci->pp;
-	u64 start, end;
+	struct resource_entry *entry;
 	struct resource *mem;
+	u64 start, end;
 	int i;
 
-	mem = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM)->res;
+	entry = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM);
+	if (!entry)
+		return -ENODEV;
+
+	mem = entry->res;
 	start = mem->start;
 	end = mem->end;
 
@@ -403,7 +433,7 @@
 	ks_pcie_clear_dbi_mode(ks_pcie);
 
 	if (ks_pcie->is_am6)
-		return;
+		return 0;
 
 	val = ilog2(OB_WIN_SIZE);
 	ks_pcie_app_writel(ks_pcie, OB_SIZE, val);
@@ -420,6 +450,8 @@
 	val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
 	val |= OB_XLAT_EN_VAL;
 	ks_pcie_app_writel(ks_pcie, CMD_STATUS, val);
+
+	return 0;
 }
 
 static void __iomem *ks_pcie_other_map_bus(struct pci_bus *bus,
@@ -430,6 +462,17 @@
 	struct keystone_pcie *ks_pcie = to_keystone_pcie(pci);
 	u32 reg;
 
+	/*
+	 * Checking whether the link is up here is a last line of defense
+	 * against platforms that forward errors on the system bus as
+	 * SError upon PCI configuration transactions issued when the link
+	 * is down. This check is racy by definition and does not stop
+	 * the system from triggering an SError if the link goes down
+	 * after this check is performed.
+	 */
+	if (!dw_pcie_link_up(pci))
+		return NULL;
+
 	reg = CFG_BUS(bus->number) | CFG_DEVICE(PCI_SLOT(devfn)) |
 		CFG_FUNC(PCI_FUNC(devfn));
 	if (!pci_is_root_bus(bus->parent))
@@ -445,44 +488,10 @@
 	.write = pci_generic_config_write,
 };
 
-/**
- * ks_pcie_v3_65_add_bus() - keystone add_bus post initialization
- * @bus: A pointer to the PCI bus structure.
- *
- * This sets BAR0 to enable inbound access for MSI_IRQ register
- */
-static int ks_pcie_v3_65_add_bus(struct pci_bus *bus)
-{
-	struct dw_pcie_rp *pp = bus->sysdata;
-	struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
-	struct keystone_pcie *ks_pcie = to_keystone_pcie(pci);
-
-	if (!pci_is_root_bus(bus))
-		return 0;
-
-	/* Configure and set up BAR0 */
-	ks_pcie_set_dbi_mode(ks_pcie);
-
-	/* Enable BAR0 */
-	dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 1);
-	dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, SZ_4K - 1);
-
-	ks_pcie_clear_dbi_mode(ks_pcie);
-
-	 /*
-	  * For BAR0, just setting bus address for inbound writes (MSI) should
-	  * be sufficient.  Use physical address to avoid any conflicts.
-	  */
-	dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, ks_pcie->app.start);
-
-	return 0;
-}
-
 static struct pci_ops ks_pcie_ops = {
 	.map_bus = dw_pcie_own_conf_map_bus,
 	.read = pci_generic_config_read,
 	.write = pci_generic_config_write,
-	.add_bus = ks_pcie_v3_65_add_bus,
 };
 
 /**
@@ -525,7 +534,11 @@
 static void ks_pcie_quirk(struct pci_dev *dev)
 {
 	struct pci_bus *bus = dev->bus;
+	struct keystone_pcie *ks_pcie;
+	struct device *bridge_dev;
 	struct pci_dev *bridge;
+	u32 val;
+
 	static const struct pci_device_id rc_pci_devids[] = {
 		{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2HK),
 		 .class = PCI_CLASS_BRIDGE_PCI_NORMAL, .class_mask = ~0, },
@@ -537,6 +550,11 @@
 		 .class = PCI_CLASS_BRIDGE_PCI_NORMAL, .class_mask = ~0, },
 		{ 0, },
 	};
+	static const struct pci_device_id am6_pci_devids[] = {
+		{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_AM654X),
+		 .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
+		{ 0, },
+	};
 
 	if (pci_is_root_bus(bus))
 		bridge = dev;
@@ -558,10 +576,36 @@
 	 */
 	if (pci_match_id(rc_pci_devids, bridge)) {
 		if (pcie_get_readrq(dev) > 256) {
-			dev_info(&dev->dev, "limiting MRRS to 256\n");
+			dev_info(&dev->dev, "limiting MRRS to 256 bytes\n");
 			pcie_set_readrq(dev, 256);
 		}
 	}
+
+	/*
+	 * Memory transactions fail with PCI controller in AM654 PG1.0
+	 * when MRRS is set to more than 128 bytes. Force the MRRS to
+	 * 128 bytes in all downstream devices.
+	 */
+	if (pci_match_id(am6_pci_devids, bridge)) {
+		bridge_dev = pci_get_host_bridge_device(dev);
+		if (!bridge_dev || !bridge_dev->parent)
+			return;
+
+		ks_pcie = dev_get_drvdata(bridge_dev->parent);
+		if (!ks_pcie)
+			return;
+
+		val = ks_pcie_app_readl(ks_pcie, PID);
+		val &= RTL;
+		val >>= RTL_SHIFT;
+		if (val != AM6_PCI_PG1_RTL_VER)
+			return;
+
+		if (pcie_get_readrq(dev) > 128) {
+			dev_info(&dev->dev, "limiting MRRS to 128 bytes\n");
+			pcie_set_readrq(dev, 128);
+		}
+	}
 }
 DECLARE_PCI_FIXUP_ENABLE(PCI_ANY_ID, PCI_ANY_ID, ks_pcie_quirk);
 
@@ -814,7 +858,10 @@
 		return ret;
 
 	ks_pcie_stop_link(pci);
-	ks_pcie_setup_rc_app_regs(ks_pcie);
+	ret = ks_pcie_setup_rc_app_regs(ks_pcie);
+	if (ret)
+		return ret;
+
 	writew(PCI_IO_RANGE_TYPE_32 | (PCI_IO_RANGE_TYPE_32 << 8),
 			pci->dbi_base + PCI_IO_BASE);
 
@@ -1064,6 +1111,7 @@
 
 static const struct ks_pcie_of_data ks_pcie_rc_of_data = {
 	.host_ops = &ks_pcie_host_ops,
+	.mode = DW_PCIE_RC_TYPE,
 	.version = DW_PCIE_VER_365A,
 };
 
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-al.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-al.c
@@ -242,18 +242,24 @@
 	.write = pci_generic_config_write,
 };
 
-static void al_pcie_config_prepare(struct al_pcie *pcie)
+static int al_pcie_config_prepare(struct al_pcie *pcie)
 {
 	struct al_pcie_target_bus_cfg *target_bus_cfg;
 	struct dw_pcie_rp *pp = &pcie->pci->pp;
 	unsigned int ecam_bus_mask;
+	struct resource_entry *ft;
 	u32 cfg_control_offset;
+	struct resource *bus;
 	u8 subordinate_bus;
 	u8 secondary_bus;
 	u32 cfg_control;
 	u32 reg;
-	struct resource *bus = resource_list_first_type(&pp->bridge->windows, IORESOURCE_BUS)->res;
 
+	ft = resource_list_first_type(&pp->bridge->windows, IORESOURCE_BUS);
+	if (!ft)
+		return -ENODEV;
+
+	bus = ft->res;
 	target_bus_cfg = &pcie->target_bus_cfg;
 
 	ecam_bus_mask = (pcie->ecam_size >> PCIE_ECAM_BUS_SHIFT) - 1;
@@ -287,6 +293,8 @@
 	       FIELD_PREP(CFG_CONTROL_SEC_BUS_MASK, secondary_bus);
 
 	al_pcie_controller_writel(pcie, cfg_control_offset, reg);
+
+	return 0;
 }
 
 static int al_pcie_host_init(struct dw_pcie_rp *pp)
@@ -305,7 +313,9 @@
 	if (rc)
 		return rc;
 
-	al_pcie_config_prepare(pcie);
+	rc = al_pcie_config_prepare(pcie);
+	if (rc)
+		return rc;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -15,6 +15,10 @@
 #include <linux/pci-epc.h>
 #include <linux/pci-epf.h>
 
+/**
+ * dw_pcie_ep_linkup - Notify EPF drivers about Link Up event
+ * @ep: DWC EP device
+ */
 void dw_pcie_ep_linkup(struct dw_pcie_ep *ep)
 {
 	struct pci_epc *epc = ep->epc;
@@ -23,6 +27,10 @@
 }
 EXPORT_SYMBOL_GPL(dw_pcie_ep_linkup);
 
+/**
+ * dw_pcie_ep_init_notify - Notify EPF drivers about EPC initialization complete
+ * @ep: DWC EP device
+ */
 void dw_pcie_ep_init_notify(struct dw_pcie_ep *ep)
 {
 	struct pci_epc *epc = ep->epc;
@@ -31,6 +39,14 @@
 }
 EXPORT_SYMBOL_GPL(dw_pcie_ep_init_notify);
 
+/**
+ * dw_pcie_ep_get_func_from_ep - Get the struct dw_pcie_ep_func corresponding to
+ *				 the endpoint function
+ * @ep: DWC EP device
+ * @func_no: Function number of the endpoint device
+ *
+ * Return: struct dw_pcie_ep_func if success, NULL otherwise.
+ */
 struct dw_pcie_ep_func *
 dw_pcie_ep_get_func_from_ep(struct dw_pcie_ep *ep, u8 func_no)
 {
@@ -61,6 +77,11 @@
 	dw_pcie_dbi_ro_wr_dis(pci);
 }
 
+/**
+ * dw_pcie_ep_reset_bar - Reset endpoint BAR
+ * @pci: DWC PCI device
+ * @bar: BAR number of the endpoint
+ */
 void dw_pcie_ep_reset_bar(struct dw_pcie *pci, enum pci_barno bar)
 {
 	u8 func_no, funcs;
@@ -140,7 +161,7 @@
 	if (!ep->bar_to_atu[bar])
 		free_win = find_first_zero_bit(ep->ib_window_map, pci->num_ib_windows);
 	else
-		free_win = ep->bar_to_atu[bar];
+		free_win = ep->bar_to_atu[bar] - 1;
 
 	if (free_win >= pci->num_ib_windows) {
 		dev_err(pci->dev, "No free inbound window\n");
@@ -154,7 +175,11 @@
 		return ret;
 	}
 
-	ep->bar_to_atu[bar] = free_win;
+	/*
+	 * Always increment free_win before assignment, since value 0 is used to identify
+	 * unallocated mapping.
+	 */
+	ep->bar_to_atu[bar] = free_win + 1;
 	set_bit(free_win, ep->ib_window_map);
 
 	return 0;
@@ -191,7 +216,10 @@
 	struct dw_pcie_ep *ep = epc_get_drvdata(epc);
 	struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
 	enum pci_barno bar = epf_bar->barno;
-	u32 atu_index = ep->bar_to_atu[bar];
+	u32 atu_index = ep->bar_to_atu[bar] - 1;
+
+	if (!ep->bar_to_atu[bar])
+		return;
 
 	__dw_pcie_ep_reset_bar(pci, func_no, bar, epf_bar->flags);
 
@@ -440,6 +468,13 @@
 	.get_features		= dw_pcie_ep_get_features,
 };
 
+/**
+ * dw_pcie_ep_raise_intx_irq - Raise INTx IRQ to the host
+ * @ep: DWC EP device
+ * @func_no: Function number of the endpoint
+ *
+ * Return: 0 if success, errono otherwise.
+ */
 int dw_pcie_ep_raise_intx_irq(struct dw_pcie_ep *ep, u8 func_no)
 {
 	struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
@@ -451,6 +486,14 @@
 }
 EXPORT_SYMBOL_GPL(dw_pcie_ep_raise_intx_irq);
 
+/**
+ * dw_pcie_ep_raise_msi_irq - Raise MSI IRQ to the host
+ * @ep: DWC EP device
+ * @func_no: Function number of the endpoint
+ * @interrupt_num: Interrupt number to be raised
+ *
+ * Return: 0 if success, errono otherwise.
+ */
 int dw_pcie_ep_raise_msi_irq(struct dw_pcie_ep *ep, u8 func_no,
 			     u8 interrupt_num)
 {
@@ -500,6 +543,15 @@
 }
 EXPORT_SYMBOL_GPL(dw_pcie_ep_raise_msi_irq);
 
+/**
+ * dw_pcie_ep_raise_msix_irq_doorbell - Raise MSI-X to the host using Doorbell
+ *					method
+ * @ep: DWC EP device
+ * @func_no: Function number of the endpoint device
+ * @interrupt_num: Interrupt number to be raised
+ *
+ * Return: 0 if success, errno otherwise.
+ */
 int dw_pcie_ep_raise_msix_irq_doorbell(struct dw_pcie_ep *ep, u8 func_no,
 				       u16 interrupt_num)
 {
@@ -519,6 +571,14 @@
 	return 0;
 }
 
+/**
+ * dw_pcie_ep_raise_msix_irq - Raise MSI-X to the host
+ * @ep: DWC EP device
+ * @func_no: Function number of the endpoint device
+ * @interrupt_num: Interrupt number to be raised
+ *
+ * Return: 0 if success, errno otherwise.
+ */
 int dw_pcie_ep_raise_msix_irq(struct dw_pcie_ep *ep, u8 func_no,
 			      u16 interrupt_num)
 {
@@ -566,22 +626,41 @@
 	return 0;
 }
 
-void dw_pcie_ep_exit(struct dw_pcie_ep *ep)
+/**
+ * dw_pcie_ep_cleanup - Cleanup DWC EP resources after fundamental reset
+ * @ep: DWC EP device
+ *
+ * Cleans up the DWC EP specific resources like eDMA etc... after fundamental
+ * reset like PERST#. Note that this API is only applicable for drivers
+ * supporting PERST# or any other methods of fundamental reset.
+ */
+void dw_pcie_ep_cleanup(struct dw_pcie_ep *ep)
 {
 	struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
-	struct pci_epc *epc = ep->epc;
 
 	dw_pcie_edma_remove(pci);
+}
+EXPORT_SYMBOL_GPL(dw_pcie_ep_cleanup);
+
+/**
+ * dw_pcie_ep_deinit - Deinitialize the endpoint device
+ * @ep: DWC EP device
+ *
+ * Deinitialize the endpoint device. EPC device is not destroyed since that will
+ * be taken care by Devres.
+ */
+void dw_pcie_ep_deinit(struct dw_pcie_ep *ep)
+{
+	struct pci_epc *epc = ep->epc;
+
+	dw_pcie_ep_cleanup(ep);
 
 	pci_epc_mem_free_addr(epc, ep->msi_mem_phys, ep->msi_mem,
 			      epc->mem->window.page_size);
 
 	pci_epc_mem_exit(epc);
-
-	if (ep->ops->deinit)
-		ep->ops->deinit(ep);
 }
-EXPORT_SYMBOL_GPL(dw_pcie_ep_exit);
+EXPORT_SYMBOL_GPL(dw_pcie_ep_deinit);
 
 static unsigned int dw_pcie_ep_find_ext_capability(struct dw_pcie *pci, int cap)
 {
@@ -601,14 +680,27 @@
 	return 0;
 }
 
-int dw_pcie_ep_init_complete(struct dw_pcie_ep *ep)
+/**
+ * dw_pcie_ep_init_registers - Initialize DWC EP specific registers
+ * @ep: DWC EP device
+ *
+ * Initialize the registers (CSRs) specific to DWC EP. This API should be called
+ * only when the endpoint receives an active refclk (either from host or
+ * generated locally).
+ */
+int dw_pcie_ep_init_registers(struct dw_pcie_ep *ep)
 {
 	struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
+	struct dw_pcie_ep_func *ep_func;
+	struct device *dev = pci->dev;
+	struct pci_epc *epc = ep->epc;
 	unsigned int offset, ptm_cap_base;
 	unsigned int nbars;
 	u8 hdr_type;
+	u8 func_no;
+	int i, ret;
+	void *addr;
 	u32 reg;
-	int i;
 
 	hdr_type = dw_pcie_readb_dbi(pci, PCI_HEADER_TYPE) &
 		   PCI_HEADER_TYPE_MASK;
@@ -619,6 +711,58 @@
 		return -EIO;
 	}
 
+	dw_pcie_version_detect(pci);
+
+	dw_pcie_iatu_detect(pci);
+
+	ret = dw_pcie_edma_detect(pci);
+	if (ret)
+		return ret;
+
+	if (!ep->ib_window_map) {
+		ep->ib_window_map = devm_bitmap_zalloc(dev, pci->num_ib_windows,
+						       GFP_KERNEL);
+		if (!ep->ib_window_map)
+			goto err_remove_edma;
+	}
+
+	if (!ep->ob_window_map) {
+		ep->ob_window_map = devm_bitmap_zalloc(dev, pci->num_ob_windows,
+						       GFP_KERNEL);
+		if (!ep->ob_window_map)
+			goto err_remove_edma;
+	}
+
+	if (!ep->outbound_addr) {
+		addr = devm_kcalloc(dev, pci->num_ob_windows, sizeof(phys_addr_t),
+				    GFP_KERNEL);
+		if (!addr)
+			goto err_remove_edma;
+		ep->outbound_addr = addr;
+	}
+
+	for (func_no = 0; func_no < epc->max_functions; func_no++) {
+
+		ep_func = dw_pcie_ep_get_func_from_ep(ep, func_no);
+		if (ep_func)
+			continue;
+
+		ep_func = devm_kzalloc(dev, sizeof(*ep_func), GFP_KERNEL);
+		if (!ep_func)
+			goto err_remove_edma;
+
+		ep_func->func_no = func_no;
+		ep_func->msi_cap = dw_pcie_ep_find_capability(ep, func_no,
+							      PCI_CAP_ID_MSI);
+		ep_func->msix_cap = dw_pcie_ep_find_capability(ep, func_no,
+							       PCI_CAP_ID_MSIX);
+
+		list_add_tail(&ep_func->list, &ep->func_list);
+	}
+
+	if (ep->ops->init)
+		ep->ops->init(ep);
+
 	offset = dw_pcie_ep_find_ext_capability(pci, PCI_EXT_CAP_ID_REBAR);
 	ptm_cap_base = dw_pcie_ep_find_ext_capability(pci, PCI_EXT_CAP_ID_PTM);
 
@@ -629,8 +773,13 @@
 		nbars = (reg & PCI_REBAR_CTRL_NBAR_MASK) >>
 			PCI_REBAR_CTRL_NBAR_SHIFT;
 
+		/*
+		 * PCIe r6.0, sec 7.8.6.2 require us to support at least one
+		 * size in the range from 1 MB to 512 GB. Advertise support
+		 * for 1 MB BAR size only.
+		 */
 		for (i = 0; i < nbars; i++, offset += PCI_REBAR_CTRL)
-			dw_pcie_writel_dbi(pci, offset + PCI_REBAR_CAP, 0x0);
+			dw_pcie_writel_dbi(pci, offset + PCI_REBAR_CAP, BIT(4));
 	}
 
 	/*
@@ -653,14 +802,26 @@
 	dw_pcie_dbi_ro_wr_dis(pci);
 
 	return 0;
+
+err_remove_edma:
+	dw_pcie_edma_remove(pci);
+
+	return ret;
 }
-EXPORT_SYMBOL_GPL(dw_pcie_ep_init_complete);
+EXPORT_SYMBOL_GPL(dw_pcie_ep_init_registers);
 
+/**
+ * dw_pcie_ep_init - Initialize the endpoint device
+ * @ep: DWC EP device
+ *
+ * Initialize the endpoint device. Allocate resources and create the EPC
+ * device with the endpoint framework.
+ *
+ * Return: 0 if success, errno otherwise.
+ */
 int dw_pcie_ep_init(struct dw_pcie_ep *ep)
 {
 	int ret;
-	void *addr;
-	u8 func_no;
 	struct resource *res;
 	struct pci_epc *epc;
 	struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
@@ -668,7 +829,6 @@
 	struct platform_device *pdev = to_platform_device(dev);
 	struct device_node *np = dev->of_node;
 	const struct pci_epc_features *epc_features;
-	struct dw_pcie_ep_func *ep_func;
 
 	INIT_LIST_HEAD(&ep->func_list);
 
@@ -686,26 +846,6 @@
 	if (ep->ops->pre_init)
 		ep->ops->pre_init(ep);
 
-	dw_pcie_version_detect(pci);
-
-	dw_pcie_iatu_detect(pci);
-
-	ep->ib_window_map = devm_bitmap_zalloc(dev, pci->num_ib_windows,
-					       GFP_KERNEL);
-	if (!ep->ib_window_map)
-		return -ENOMEM;
-
-	ep->ob_window_map = devm_bitmap_zalloc(dev, pci->num_ob_windows,
-					       GFP_KERNEL);
-	if (!ep->ob_window_map)
-		return -ENOMEM;
-
-	addr = devm_kcalloc(dev, pci->num_ob_windows, sizeof(phys_addr_t),
-			    GFP_KERNEL);
-	if (!addr)
-		return -ENOMEM;
-	ep->outbound_addr = addr;
-
 	epc = devm_pci_epc_create(dev, &epc_ops);
 	if (IS_ERR(epc)) {
 		dev_err(dev, "Failed to create epc device\n");
@@ -719,28 +859,11 @@
 	if (ret < 0)
 		epc->max_functions = 1;
 
-	for (func_no = 0; func_no < epc->max_functions; func_no++) {
-		ep_func = devm_kzalloc(dev, sizeof(*ep_func), GFP_KERNEL);
-		if (!ep_func)
-			return -ENOMEM;
-
-		ep_func->func_no = func_no;
-		ep_func->msi_cap = dw_pcie_ep_find_capability(ep, func_no,
-							      PCI_CAP_ID_MSI);
-		ep_func->msix_cap = dw_pcie_ep_find_capability(ep, func_no,
-							       PCI_CAP_ID_MSIX);
-
-		list_add_tail(&ep_func->list, &ep->func_list);
-	}
-
-	if (ep->ops->init)
-		ep->ops->init(ep);
-
 	ret = pci_epc_mem_init(epc, ep->phys_base, ep->addr_size,
 			       ep->page_size);
 	if (ret < 0) {
 		dev_err(dev, "Failed to initialize address space\n");
-		goto err_ep_deinit;
+		return ret;
 	}
 
 	ep->msi_mem = pci_epc_mem_alloc_addr(epc, &ep->msi_mem_phys,
@@ -751,25 +874,25 @@
 		goto err_exit_epc_mem;
 	}
 
-	ret = dw_pcie_edma_detect(pci);
-	if (ret)
-		goto err_free_epc_mem;
-
 	if (ep->ops->get_features) {
 		epc_features = ep->ops->get_features(ep);
 		if (epc_features->core_init_notifier)
 			return 0;
 	}
 
-	ret = dw_pcie_ep_init_complete(ep);
+	/*
+	 * NOTE:- Avoid accessing the hardware (Ex:- DBI space) before this
+	 * step as platforms that implement 'core_init_notifier' feature may
+	 * not have the hardware ready (i.e. core initialized) for access
+	 * (Ex: tegra194). Any hardware access on such platforms result
+	 * in system hang.
+	 */
+	ret = dw_pcie_ep_init_registers(ep);
 	if (ret)
-		goto err_remove_edma;
+		goto err_free_epc_mem;
 
 	return 0;
 
-err_remove_edma:
-	dw_pcie_edma_remove(pci);
-
 err_free_epc_mem:
 	pci_epc_mem_free_addr(epc, ep->msi_mem_phys, ep->msi_mem,
 			      epc->mem->window.page_size);
@@ -777,10 +900,6 @@
 err_exit_epc_mem:
 	pci_epc_mem_exit(epc);
 
-err_ep_deinit:
-	if (ep->ops->deinit)
-		ep->ops->deinit(ep);
-
 	return ret;
 }
 EXPORT_SYMBOL_GPL(dw_pcie_ep_init);
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-designware.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-designware.c
@@ -112,6 +112,7 @@
 		pci->dbi_base = devm_pci_remap_cfg_resource(pci->dev, res);
 		if (IS_ERR(pci->dbi_base))
 			return PTR_ERR(pci->dbi_base);
+		pci->dbi_phys_addr = res->start;
 	}
 
 	/* DBI2 is mainly useful for the endpoint controller */
@@ -134,6 +135,7 @@
 			pci->atu_base = devm_ioremap_resource(pci->dev, res);
 			if (IS_ERR(pci->atu_base))
 				return PTR_ERR(pci->atu_base);
+			pci->atu_phys_addr = res->start;
 		} else {
 			pci->atu_base = pci->dbi_base + DEFAULT_DBI_ATU_OFFSET;
 		}
@@ -166,8 +168,8 @@
 			return ret;
 	}
 
-	if (pci->link_gen < 1)
-		pci->link_gen = of_pci_get_max_link_speed(np);
+	if (pci->max_link_speed < 1)
+		pci->max_link_speed = of_pci_get_max_link_speed(np);
 
 	of_property_read_u32(np, "num-lanes", &pci->num_lanes);
 
@@ -697,16 +699,27 @@
 }
 EXPORT_SYMBOL_GPL(dw_pcie_upconfig_setup);
 
-static void dw_pcie_link_set_max_speed(struct dw_pcie *pci, u32 link_gen)
+static void dw_pcie_link_set_max_speed(struct dw_pcie *pci)
 {
 	u32 cap, ctrl2, link_speed;
 	u8 offset = dw_pcie_find_capability(pci, PCI_CAP_ID_EXP);
 
 	cap = dw_pcie_readl_dbi(pci, offset + PCI_EXP_LNKCAP);
+
+	/*
+	 * Even if the platform doesn't want to limit the maximum link speed,
+	 * just cache the hardware default value so that the vendor drivers can
+	 * use it to do any link specific configuration.
+	 */
+	if (pci->max_link_speed < 1) {
+		pci->max_link_speed = FIELD_GET(PCI_EXP_LNKCAP_SLS, cap);
+		return;
+	}
+
 	ctrl2 = dw_pcie_readl_dbi(pci, offset + PCI_EXP_LNKCTL2);
 	ctrl2 &= ~PCI_EXP_LNKCTL2_TLS;
 
-	switch (pcie_link_speed[link_gen]) {
+	switch (pcie_link_speed[pci->max_link_speed]) {
 	case PCIE_SPEED_2_5GT:
 		link_speed = PCI_EXP_LNKCTL2_TLS_2_5GT;
 		break;
@@ -880,30 +893,40 @@
 	.irq_vector = dw_pcie_edma_irq_vector,
 };
 
-static int dw_pcie_edma_find_chip(struct dw_pcie *pci)
+static void dw_pcie_edma_init_data(struct dw_pcie *pci)
+{
+	pci->edma.dev = pci->dev;
+
+	if (!pci->edma.ops)
+		pci->edma.ops = &dw_pcie_edma_ops;
+
+	pci->edma.flags |= DW_EDMA_CHIP_LOCAL;
+}
+
+static int dw_pcie_edma_find_mf(struct dw_pcie *pci)
 {
 	u32 val;
 
 	/*
+	 * Bail out finding the mapping format if it is already set by the glue
+	 * driver. Also ensure that the edma.reg_base is pointing to a valid
+	 * memory region.
+	 */
+	if (pci->edma.mf != EDMA_MF_EDMA_LEGACY)
+		return pci->edma.reg_base ? 0 : -ENODEV;
+
+	/*
 	 * Indirect eDMA CSRs access has been completely removed since v5.40a
 	 * thus no space is now reserved for the eDMA channels viewport and
 	 * former DMA CTRL register is no longer fixed to FFs.
-	 *
-	 * Note that Renesas R-Car S4-8's PCIe controllers for unknown reason
-	 * have zeros in the eDMA CTRL register even though the HW-manual
-	 * explicitly states there must FFs if the unrolled mapping is enabled.
-	 * For such cases the low-level drivers are supposed to manually
-	 * activate the unrolled mapping to bypass the auto-detection procedure.
 	 */
-	if (dw_pcie_ver_is_ge(pci, 540A) || dw_pcie_cap_is(pci, EDMA_UNROLL))
+	if (dw_pcie_ver_is_ge(pci, 540A))
 		val = 0xFFFFFFFF;
 	else
 		val = dw_pcie_readl_dbi(pci, PCIE_DMA_VIEWPORT_BASE + PCIE_DMA_CTRL);
 
 	if (val == 0xFFFFFFFF && pci->edma.reg_base) {
 		pci->edma.mf = EDMA_MF_EDMA_UNROLL;
-
-		val = dw_pcie_readl_dma(pci, PCIE_DMA_CTRL);
 	} else if (val != 0xFFFFFFFF) {
 		pci->edma.mf = EDMA_MF_EDMA_LEGACY;
 
@@ -912,15 +935,25 @@
 		return -ENODEV;
 	}
 
-	pci->edma.dev = pci->dev;
+	return 0;
+}
 
-	if (!pci->edma.ops)
-		pci->edma.ops = &dw_pcie_edma_ops;
+static int dw_pcie_edma_find_channels(struct dw_pcie *pci)
+{
+	u32 val;
 
-	pci->edma.flags |= DW_EDMA_CHIP_LOCAL;
+	/*
+	 * Autodetect the read/write channels count only for non-HDMA platforms.
+	 * HDMA platforms with native CSR mapping doesn't support autodetect,
+	 * so the glue drivers should've passed the valid count already. If not,
+	 * the below sanity check will catch it.
+	 */
+	if (pci->edma.mf != EDMA_MF_HDMA_NATIVE) {
+		val = dw_pcie_readl_dma(pci, PCIE_DMA_CTRL);
 
-	pci->edma.ll_wr_cnt = FIELD_GET(PCIE_DMA_NUM_WR_CHAN, val);
-	pci->edma.ll_rd_cnt = FIELD_GET(PCIE_DMA_NUM_RD_CHAN, val);
+		pci->edma.ll_wr_cnt = FIELD_GET(PCIE_DMA_NUM_WR_CHAN, val);
+		pci->edma.ll_rd_cnt = FIELD_GET(PCIE_DMA_NUM_RD_CHAN, val);
+	}
 
 	/* Sanity check the channels count if the mapping was incorrect */
 	if (!pci->edma.ll_wr_cnt || pci->edma.ll_wr_cnt > EDMA_MAX_WR_CH ||
@@ -930,6 +963,19 @@
 	return 0;
 }
 
+static int dw_pcie_edma_find_chip(struct dw_pcie *pci)
+{
+	int ret;
+
+	dw_pcie_edma_init_data(pci);
+
+	ret = dw_pcie_edma_find_mf(pci);
+	if (ret)
+		return ret;
+
+	return dw_pcie_edma_find_channels(pci);
+}
+
 static int dw_pcie_edma_irq_verify(struct dw_pcie *pci)
 {
 	struct platform_device *pdev = to_platform_device(pci->dev);
@@ -1035,8 +1081,7 @@
 {
 	u32 val;
 
-	if (pci->link_gen > 0)
-		dw_pcie_link_set_max_speed(pci, pci->link_gen);
+	dw_pcie_link_set_max_speed(pci);
 
 	/* Configure Gen1 N_FTS */
 	if (pci->n_fts[0]) {
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-designware.h
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-designware.h
@@ -51,9 +51,8 @@
 
 /* DWC PCIe controller capabilities */
 #define DW_PCIE_CAP_REQ_RES		0
-#define DW_PCIE_CAP_EDMA_UNROLL		1
-#define DW_PCIE_CAP_IATU_UNROLL		2
-#define DW_PCIE_CAP_CDM_CHECK		3
+#define DW_PCIE_CAP_IATU_UNROLL		1
+#define DW_PCIE_CAP_CDM_CHECK		2
 
 #define dw_pcie_cap_is(_pci, _cap) \
 	test_bit(DW_PCIE_CAP_ ## _cap, &(_pci)->caps)
@@ -121,6 +120,19 @@
 #define GEN3_RELATED_OFF_GEN3_EQ_DISABLE	BIT(16)
 #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_SHIFT	24
 #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK	GENMASK(25, 24)
+#define GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT	0x1
+
+#define GEN3_EQ_CONTROL_OFF			0x8A8
+#define GEN3_EQ_CONTROL_OFF_FB_MODE		GENMASK(3, 0)
+#define GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE	BIT(4)
+#define GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC	GENMASK(23, 8)
+#define GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL	BIT(24)
+
+#define GEN3_EQ_FB_MODE_DIR_CHANGE_OFF		0x8AC
+#define GEN3_EQ_FMDC_T_MIN_PHASE23		GENMASK(4, 0)
+#define GEN3_EQ_FMDC_N_EVALS			GENMASK(9, 5)
+#define GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA	GENMASK(13, 10)
+#define GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA	GENMASK(17, 14)
 
 #define PCIE_PORT_MULTI_LANE_CTRL	0x8C0
 #define PORT_MLTI_UPCFG_SUPPORT		BIT(7)
@@ -192,6 +204,24 @@
 #define PCIE_PL_CHK_REG_ERR_ADDR			0xB28
 
 /*
+ * 16.0 GT/s (Gen 4) lane margining register definitions
+ */
+#define GEN4_LANE_MARGINING_1_OFF		0xB80
+#define MARGINING_MAX_VOLTAGE_OFFSET		GENMASK(29, 24)
+#define MARGINING_NUM_VOLTAGE_STEPS		GENMASK(22, 16)
+#define MARGINING_MAX_TIMING_OFFSET		GENMASK(13, 8)
+#define MARGINING_NUM_TIMING_STEPS		GENMASK(5, 0)
+
+#define GEN4_LANE_MARGINING_2_OFF		0xB84
+#define MARGINING_IND_ERROR_SAMPLER		BIT(28)
+#define MARGINING_SAMPLE_REPORTING_METHOD	BIT(27)
+#define MARGINING_IND_LEFT_RIGHT_TIMING		BIT(26)
+#define MARGINING_IND_UP_DOWN_VOLTAGE		BIT(25)
+#define MARGINING_VOLTAGE_SUPPORTED		BIT(24)
+#define MARGINING_MAXLANES			GENMASK(20, 16)
+#define MARGINING_SAMPLE_RATE_TIMING		GENMASK(13, 8)
+#define MARGINING_SAMPLE_RATE_VOLTAGE		GENMASK(5, 0)
+/*
  * iATU Unroll-specific register definitions
  * From 4.80 core version the address translation will be made by unroll
  */
@@ -333,7 +363,6 @@
 struct dw_pcie_ep_ops {
 	void	(*pre_init)(struct dw_pcie_ep *ep);
 	void	(*init)(struct dw_pcie_ep *ep);
-	void	(*deinit)(struct dw_pcie_ep *ep);
 	int	(*raise_irq)(struct dw_pcie_ep *ep, u8 func_no,
 			     unsigned int type, u16 interrupt_num);
 	const struct pci_epc_features* (*get_features)(struct dw_pcie_ep *ep);
@@ -388,8 +417,10 @@
 struct dw_pcie {
 	struct device		*dev;
 	void __iomem		*dbi_base;
+	resource_size_t		dbi_phys_addr;
 	void __iomem		*dbi_base2;
 	void __iomem		*atu_base;
+	resource_size_t		atu_phys_addr;
 	size_t			atu_size;
 	u32			num_ib_windows;
 	u32			num_ob_windows;
@@ -402,7 +433,7 @@
 	u32			type;
 	unsigned long		caps;
 	int			num_lanes;
-	int			link_gen;
+	int			max_link_speed;
 	u8			n_fts[2];
 	struct dw_edma_chip	edma;
 	struct clk_bulk_data	app_clks[DW_PCIE_NUM_APP_CLKS];
@@ -670,9 +701,10 @@
 #ifdef CONFIG_PCIE_DW_EP
 void dw_pcie_ep_linkup(struct dw_pcie_ep *ep);
 int dw_pcie_ep_init(struct dw_pcie_ep *ep);
-int dw_pcie_ep_init_complete(struct dw_pcie_ep *ep);
+int dw_pcie_ep_init_registers(struct dw_pcie_ep *ep);
 void dw_pcie_ep_init_notify(struct dw_pcie_ep *ep);
-void dw_pcie_ep_exit(struct dw_pcie_ep *ep);
+void dw_pcie_ep_deinit(struct dw_pcie_ep *ep);
+void dw_pcie_ep_cleanup(struct dw_pcie_ep *ep);
 int dw_pcie_ep_raise_intx_irq(struct dw_pcie_ep *ep, u8 func_no);
 int dw_pcie_ep_raise_msi_irq(struct dw_pcie_ep *ep, u8 func_no,
 			     u8 interrupt_num);
@@ -693,7 +725,7 @@
 	return 0;
 }
 
-static inline int dw_pcie_ep_init_complete(struct dw_pcie_ep *ep)
+static inline int dw_pcie_ep_init_registers(struct dw_pcie_ep *ep)
 {
 	return 0;
 }
@@ -702,7 +734,11 @@
 {
 }
 
-static inline void dw_pcie_ep_exit(struct dw_pcie_ep *ep)
+static inline void dw_pcie_ep_deinit(struct dw_pcie_ep *ep)
+{
+}
+
+static inline void dw_pcie_ep_cleanup(struct dw_pcie_ep *ep)
 {
 }
 
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-dw-rockchip.c
@@ -240,7 +240,7 @@
 		return PTR_ERR(rockchip->apb_base);
 
 	rockchip->rst_gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
-						     GPIOD_OUT_HIGH);
+						     GPIOD_OUT_LOW);
 	if (IS_ERR(rockchip->rst_gpio))
 		return PTR_ERR(rockchip->rst_gpio);
 
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-intel-gw.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-intel-gw.c
@@ -132,7 +132,7 @@
 
 static void intel_pcie_init_n_fts(struct dw_pcie *pci)
 {
-	switch (pci->link_gen) {
+	switch (pci->max_link_speed) {
 	case 3:
 		pci->n_fts[1] = PORT_AFR_N_FTS_GEN3;
 		break;
@@ -252,7 +252,7 @@
 	int ret;
 	struct dw_pcie *pci = &pcie->pci;
 
-	if (pci->link_gen < 3)
+	if (pci->max_link_speed < 3)
 		return 0;
 
 	/* Send PME_TURN_OFF message */
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-kirin.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-kirin.c
@@ -412,12 +412,12 @@
 			if (pcie->gpio_id_reset[i] < 0)
 				continue;
 
-			pcie->num_slots++;
-			if (pcie->num_slots > MAX_PCI_SLOTS) {
+			if (pcie->num_slots + 1 >= MAX_PCI_SLOTS) {
 				dev_err(dev, "Too many PCI slots!\n");
 				ret = -EINVAL;
 				goto put_node;
 			}
+			pcie->num_slots++;
 
 			ret = of_pci_get_devfn(child);
 			if (ret < 0) {
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-qcom-common.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-qcom-common.c
@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/pci.h>
+
+#include "pcie-designware.h"
+#include "pcie-qcom-common.h"
+
+void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci)
+{
+	u32 reg;
+
+	/*
+	 * GEN3_RELATED_OFF register is repurposed to apply equalization
+	 * settings at various data transmission rates through registers namely
+	 * GEN3_EQ_*. The RATE_SHADOW_SEL bit field of GEN3_RELATED_OFF
+	 * determines the data rate for which these equalization settings are
+	 * applied.
+	 */
+	reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
+	reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL;
+	reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK;
+	reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK,
+			  GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT);
+	dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg);
+
+	reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF);
+	reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 |
+		GEN3_EQ_FMDC_N_EVALS |
+		GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA |
+		GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA);
+	reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) |
+		FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) |
+		FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) |
+		FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5);
+	dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg);
+
+	reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
+	reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE |
+		GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE |
+		GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL |
+		GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC);
+	dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg);
+}
+EXPORT_SYMBOL_GPL(qcom_pcie_common_set_16gt_equalization);
+
+void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci)
+{
+	u32 reg;
+
+	reg = dw_pcie_readl_dbi(pci, GEN4_LANE_MARGINING_1_OFF);
+	reg &= ~(MARGINING_MAX_VOLTAGE_OFFSET |
+		MARGINING_NUM_VOLTAGE_STEPS |
+		MARGINING_MAX_TIMING_OFFSET |
+		MARGINING_NUM_TIMING_STEPS);
+	reg |= FIELD_PREP(MARGINING_MAX_VOLTAGE_OFFSET, 0x24) |
+		FIELD_PREP(MARGINING_NUM_VOLTAGE_STEPS, 0x78) |
+		FIELD_PREP(MARGINING_MAX_TIMING_OFFSET, 0x32) |
+		FIELD_PREP(MARGINING_NUM_TIMING_STEPS, 0x10);
+	dw_pcie_writel_dbi(pci, GEN4_LANE_MARGINING_1_OFF, reg);
+
+	reg = dw_pcie_readl_dbi(pci, GEN4_LANE_MARGINING_2_OFF);
+	reg |= MARGINING_IND_ERROR_SAMPLER |
+		MARGINING_SAMPLE_REPORTING_METHOD |
+		MARGINING_IND_LEFT_RIGHT_TIMING |
+		MARGINING_VOLTAGE_SUPPORTED;
+	reg &= ~(MARGINING_IND_UP_DOWN_VOLTAGE |
+		MARGINING_MAXLANES |
+		MARGINING_SAMPLE_RATE_TIMING |
+		MARGINING_SAMPLE_RATE_VOLTAGE);
+	reg |= FIELD_PREP(MARGINING_MAXLANES, pci->num_lanes) |
+		FIELD_PREP(MARGINING_SAMPLE_RATE_TIMING, 0x3f) |
+		FIELD_PREP(MARGINING_SAMPLE_RATE_VOLTAGE, 0x3f);
+	dw_pcie_writel_dbi(pci, GEN4_LANE_MARGINING_2_OFF, reg);
+}
+EXPORT_SYMBOL_GPL(qcom_pcie_common_set_16gt_lane_margining);
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-qcom-common.h
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-qcom-common.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _PCIE_QCOM_COMMON_H
+#define _PCIE_QCOM_COMMON_H
+
+struct dw_pcie;
+
+void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci);
+void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-qcom-ep.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-qcom-ep.c
@@ -25,6 +25,7 @@
 
 #include "../../pci.h"
 #include "pcie-designware.h"
+#include "pcie-qcom-common.h"
 
 /* PARF registers */
 #define PARF_SYS_CTRL				0x00
@@ -47,6 +48,7 @@
 #define PARF_DBI_BASE_ADDR_HI			0x354
 #define PARF_SLV_ADDR_SPACE_SIZE		0x358
 #define PARF_SLV_ADDR_SPACE_SIZE_HI		0x35c
+#define PARF_NO_SNOOP_OVERIDE			0x3d4
 #define PARF_ATU_BASE_ADDR			0x634
 #define PARF_ATU_BASE_ADDR_HI			0x638
 #define PARF_SRIS_MODE				0x644
@@ -57,6 +59,7 @@
 #define PARF_DEBUG_CNT_AUX_CLK_IN_L1SUB_L2	0xc88
 #define PARF_DEVICE_TYPE			0x1000
 #define PARF_BDF_TO_SID_CFG			0x2c00
+#define PARF_INT_ALL_5_MASK			0x2dcc
 
 /* PARF_INT_ALL_{STATUS/CLEAR/MASK} register fields */
 #define PARF_INT_ALL_LINK_DOWN			BIT(1)
@@ -86,6 +89,10 @@
 #define PARF_DEBUG_INT_CFG_BUS_MASTER_EN	BIT(2)
 #define PARF_DEBUG_INT_RADM_PM_TURNOFF		BIT(3)
 
+/* PARF_NO_SNOOP_OVERIDE register fields */
+#define WR_NO_SNOOP_OVERIDE_EN                 BIT(1)
+#define RD_NO_SNOOP_OVERIDE_EN                 BIT(3)
+
 /* PARF_DEVICE_TYPE register fields */
 #define PARF_DEVICE_TYPE_EP			0x0
 
@@ -122,6 +129,9 @@
 /* PARF_CFG_BITS register fields */
 #define PARF_CFG_BITS_REQ_EXIT_L1SS_MSI_LTR_EN	BIT(1)
 
+/* PARF_INT_ALL_5_MASK fields */
+#define PARF_INT_ALL_5_MHI_RAM_DATA_PARITY_ERR	BIT(0)
+
 /* ELBI registers */
 #define ELBI_SYS_STTS				0x08
 #define ELBI_CS2_ENABLE				0xa4
@@ -150,6 +160,18 @@
 };
 
 /**
+ * struct qcom_pcie_ep_cfg - Per SoC config struct
+ * @hdma_support: HDMA support on this SoC
+ * @override_no_snoop: Override NO_SNOOP attribute in TLP to enable cache snooping
+ * @disable_mhi_ram_parity_check: Disable MHI RAM data parity error check
+ */
+struct qcom_pcie_ep_cfg {
+	bool hdma_support;
+	bool override_no_snoop;
+	bool disable_mhi_ram_parity_check;
+};
+
+/**
  * struct qcom_pcie_ep - Qualcomm PCIe Endpoint Controller
  * @pci: Designware PCIe controller struct
  * @parf: Qualcomm PCIe specific PARF register base
@@ -167,6 +189,7 @@
  * @num_clks: PCIe clocks count
  * @perst_en: Flag for PERST enable
  * @perst_sep_en: Flag for PERST separation enable
+ * @cfg: PCIe EP config struct
  * @link_status: PCIe Link status
  * @global_irq: Qualcomm PCIe specific Global IRQ
  * @perst_irq: PERST# IRQ
@@ -194,6 +217,7 @@
 	u32 perst_en;
 	u32 perst_sep_en;
 
+	const struct qcom_pcie_ep_cfg *cfg;
 	enum qcom_pcie_ep_link_status link_status;
 	int global_irq;
 	int perst_irq;
@@ -463,12 +487,23 @@
 	      PARF_INT_ALL_LINK_UP | PARF_INT_ALL_EDMA;
 	writel_relaxed(val, pcie_ep->parf + PARF_INT_ALL_MASK);
 
-	ret = dw_pcie_ep_init_complete(&pcie_ep->pci.ep);
+	if (pcie_ep->cfg && pcie_ep->cfg->disable_mhi_ram_parity_check) {
+		val = readl_relaxed(pcie_ep->parf + PARF_INT_ALL_5_MASK);
+		val &= ~PARF_INT_ALL_5_MHI_RAM_DATA_PARITY_ERR;
+		writel_relaxed(val, pcie_ep->parf + PARF_INT_ALL_5_MASK);
+	}
+
+	ret = dw_pcie_ep_init_registers(&pcie_ep->pci.ep);
 	if (ret) {
 		dev_err(dev, "Failed to complete initialization: %d\n", ret);
 		goto err_disable_resources;
 	}
 
+	if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
+		qcom_pcie_common_set_16gt_equalization(pci);
+		qcom_pcie_common_set_16gt_lane_margining(pci);
+	}
+
 	/*
 	 * The physical address of the MMIO region which is exposed as the BAR
 	 * should be written to MHI BASE registers.
@@ -489,6 +524,10 @@
 	val |= BIT(8);
 	writel_relaxed(val, pcie_ep->parf + PARF_LTSSM);
 
+	if (pcie_ep->cfg && pcie_ep->cfg->override_no_snoop)
+		writel_relaxed(WR_NO_SNOOP_OVERIDE_EN | RD_NO_SNOOP_OVERIDE_EN,
+				pcie_ep->parf + PARF_NO_SNOOP_OVERIDE);
+
 	return 0;
 
 err_disable_resources:
@@ -500,13 +539,8 @@
 static void qcom_pcie_perst_assert(struct dw_pcie *pci)
 {
 	struct qcom_pcie_ep *pcie_ep = to_pcie_ep(pci);
-	struct device *dev = pci->dev;
-
-	if (pcie_ep->link_status == QCOM_PCIE_EP_LINK_DISABLED) {
-		dev_dbg(dev, "Link is already disabled\n");
-		return;
-	}
 
+	dw_pcie_ep_cleanup(&pci->ep);
 	qcom_pcie_disable_resources(pcie_ep);
 	pcie_ep->link_status = QCOM_PCIE_EP_LINK_DISABLED;
 }
@@ -816,27 +850,29 @@
 	pcie_ep->pci.ops = &pci_ops;
 	pcie_ep->pci.ep.ops = &pci_ep_ops;
 	pcie_ep->pci.edma.nr_irqs = 1;
+
+	pcie_ep->cfg = of_device_get_match_data(dev);
+	if (pcie_ep->cfg && pcie_ep->cfg->hdma_support) {
+		pcie_ep->pci.edma.ll_wr_cnt = 8;
+		pcie_ep->pci.edma.ll_rd_cnt = 8;
+		pcie_ep->pci.edma.mf = EDMA_MF_HDMA_NATIVE;
+	}
+
 	platform_set_drvdata(pdev, pcie_ep);
 
 	ret = qcom_pcie_ep_get_resources(pdev, pcie_ep);
 	if (ret)
 		return ret;
 
-	ret = qcom_pcie_enable_resources(pcie_ep);
-	if (ret) {
-		dev_err(dev, "Failed to enable resources: %d\n", ret);
-		return ret;
-	}
-
 	ret = dw_pcie_ep_init(&pcie_ep->pci.ep);
 	if (ret) {
 		dev_err(dev, "Failed to initialize endpoint: %d\n", ret);
-		goto err_disable_resources;
+		return ret;
 	}
 
 	ret = qcom_pcie_ep_enable_irq_resources(pdev, pcie_ep);
 	if (ret)
-		goto err_disable_resources;
+		goto err_ep_deinit;
 
 	name = devm_kasprintf(dev, GFP_KERNEL, "%pOFP", dev->of_node);
 	if (!name) {
@@ -853,8 +889,8 @@
 	disable_irq(pcie_ep->global_irq);
 	disable_irq(pcie_ep->perst_irq);
 
-err_disable_resources:
-	qcom_pcie_disable_resources(pcie_ep);
+err_ep_deinit:
+	dw_pcie_ep_deinit(&pcie_ep->pci.ep);
 
 	return ret;
 }
@@ -874,7 +910,14 @@
 	qcom_pcie_disable_resources(pcie_ep);
 }
 
+static const struct qcom_pcie_ep_cfg cfg_1_34_0 = {
+	.hdma_support = true,
+	.override_no_snoop = true,
+	.disable_mhi_ram_parity_check = true,
+};
+
 static const struct of_device_id qcom_pcie_ep_match[] = {
+	{ .compatible = "qcom,sa8775p-pcie-ep", .data = &cfg_1_34_0},
 	{ .compatible = "qcom,sdx55-pcie-ep", },
 	{ .compatible = "qcom,sm8450-pcie-ep", },
 	{ }
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-qcom.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-qcom.c
@@ -30,19 +30,26 @@
 #include <linux/reset.h>
 #include <linux/slab.h>
 #include <linux/types.h>
+#include <soc/qcom/cmd-db.h>
 
 #include "../../pci.h"
 #include "pcie-designware.h"
+#include "pcie-qcom-common.h"
+
+#include <dt-bindings/interconnect/qcom,icc.h>
+#include <dt-bindings/interconnect/qcom,rpm-icc.h>
 
 /* PARF registers */
 #define PARF_SYS_CTRL				0x00
 #define PARF_PM_CTRL				0x20
+#define PARF_PM_STTS				0x24
 #define PARF_PCS_DEEMPH				0x34
 #define PARF_PCS_SWING				0x38
 #define PARF_PHY_CTRL				0x40
 #define PARF_PHY_REFCLK				0x4c
 #define PARF_CONFIG_BITS			0x50
 #define PARF_DBI_BASE_ADDR			0x168
+#define PARF_SLV_ADDR_SPACE_SIZE		0x16c
 #define PARF_MHI_CLOCK_RESET_CTRL		0x174
 #define PARF_AXI_MSTR_WR_ADDR_HALT		0x178
 #define PARF_AXI_MSTR_WR_ADDR_HALT_V2		0x1a8
@@ -50,9 +57,16 @@
 #define PARF_LTSSM				0x1b0
 #define PARF_SID_OFFSET				0x234
 #define PARF_BDF_TRANSLATE_CFG			0x24c
-#define PARF_SLV_ADDR_SPACE_SIZE		0x358
+#define PARF_DBI_BASE_ADDR_V2			0x350
+#define PARF_DBI_BASE_ADDR_V2_HI		0x354
+#define PARF_SLV_ADDR_SPACE_SIZE_V2		0x358
+#define PARF_SLV_ADDR_SPACE_SIZE_V2_HI		0x35c
+#define PARF_NO_SNOOP_OVERIDE			0x3d4
+#define PARF_ATU_BASE_ADDR			0x634
+#define PARF_ATU_BASE_ADDR_HI			0x638
 #define PARF_DEVICE_TYPE			0x1000
 #define PARF_BDF_TO_SID_TABLE_N			0x2000
+#define PARF_BDF_TO_SID_CFG			0x2c00
 
 /* ELBI registers */
 #define ELBI_SYS_CTRL				0x04
@@ -80,7 +94,10 @@
 #define L1_CLK_RMV_DIS				BIT(1)
 
 /* PARF_PM_CTRL register fields */
-#define REQ_NOT_ENTR_L1				BIT(5)
+#define REQ_NOT_ENTR_L1				BIT(5) /* "Prevent L0->L1" */
+
+/* PARF_PM_STTS register fields */
+#define PM_ENTER_L23				BIT(5)
 
 /* PARF_PCS_DEEMPH register fields */
 #define PCS_DEEMPH_TX_DEEMPH_GEN1(x)		FIELD_PREP(GENMASK(21, 16), x)
@@ -104,7 +121,7 @@
 #define PHY_RX0_EQ(x)				FIELD_PREP(GENMASK(26, 24), x)
 
 /* PARF_SLV_ADDR_SPACE_SIZE register value */
-#define SLV_ADDR_SPACE_SZ			0x10000000
+#define SLV_ADDR_SPACE_SZ			0x80000000
 
 /* PARF_MHI_CLOCK_RESET_CTRL register fields */
 #define AHB_CLK_EN				BIT(0)
@@ -117,11 +134,19 @@
 /* PARF_LTSSM register fields */
 #define LTSSM_EN				BIT(8)
 
+/* PARF_NO_SNOOP_OVERIDE register fields */
+#define WR_NO_SNOOP_OVERIDE_EN			BIT(1)
+#define RD_NO_SNOOP_OVERIDE_EN			BIT(3)
+
 /* PARF_DEVICE_TYPE register fields */
 #define DEVICE_TYPE_RC				0x4
 
+/* PARF_BDF_TO_SID_CFG fields */
+#define BDF_TO_SID_BYPASS			BIT(0)
+
 /* ELBI_SYS_CTRL register fields */
 #define ELBI_SYS_CTRL_LT_ENABLE			BIT(0)
+#define ELBI_SYS_CTRL_PME_TURNOFF_MSG		BIT(4)
 
 /* AXI_MSTR_RESP_COMP_CTRL0 register fields */
 #define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K	0x4
@@ -221,14 +246,21 @@
 	int (*get_resources)(struct qcom_pcie *pcie);
 	int (*init)(struct qcom_pcie *pcie);
 	int (*post_init)(struct qcom_pcie *pcie);
-	void (*host_post_init)(struct qcom_pcie *pcie);
 	void (*deinit)(struct qcom_pcie *pcie);
 	void (*ltssm_enable)(struct qcom_pcie *pcie);
 	int (*config_sid)(struct qcom_pcie *pcie);
 };
 
+ /**
+  * struct qcom_pcie_cfg - Per SoC config struct
+  * @ops: qcom PCIe ops structure
+  * @override_no_snoop: Override NO_SNOOP attribute in TLP to enable cache
+  * snooping
+  */
 struct qcom_pcie_cfg {
 	const struct qcom_pcie_ops *ops;
+	bool override_no_snoop;
+	bool no_l0s;
 };
 
 struct qcom_pcie {
@@ -243,6 +275,7 @@
 	const struct qcom_pcie_cfg *cfg;
 	struct dentry *debugfs;
 	bool suspended;
+	bool soc_is_rpmh;
 };
 
 #define to_qcom_pcie(x)		dev_get_drvdata((x)->dev)
@@ -265,6 +298,11 @@
 {
 	struct qcom_pcie *pcie = to_qcom_pcie(pci);
 
+	if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
+		qcom_pcie_common_set_16gt_equalization(pci);
+		qcom_pcie_common_set_16gt_lane_margining(pci);
+	}
+
 	/* Enable Link Training state machine */
 	if (pcie->cfg->ops->ltssm_enable)
 		pcie->cfg->ops->ltssm_enable(pcie);
@@ -272,6 +310,44 @@
 	return 0;
 }
 
+static void qcom_pcie_clear_aspm_l0s(struct dw_pcie *pci)
+{
+	struct qcom_pcie *pcie = to_qcom_pcie(pci);
+	u16 offset;
+	u32 val;
+
+	if (!pcie->cfg->no_l0s)
+		return;
+
+	offset = dw_pcie_find_capability(pci, PCI_CAP_ID_EXP);
+
+	dw_pcie_dbi_ro_wr_en(pci);
+
+	val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP);
+	val &= ~PCI_EXP_LNKCAP_ASPM_L0S;
+	writel(val, pci->dbi_base + offset + PCI_EXP_LNKCAP);
+
+	dw_pcie_dbi_ro_wr_dis(pci);
+}
+
+static int qcom_pcie_stop_link(struct dw_pcie *pci)
+{
+	struct qcom_pcie *pcie = to_qcom_pcie(pci);
+	u32 ret_l23, val;
+
+	writel(ELBI_SYS_CTRL_PME_TURNOFF_MSG, pcie->elbi + ELBI_SYS_CTRL);
+	readl(pcie->elbi + ELBI_SYS_CTRL);
+
+	ret_l23 = readl_poll_timeout(pcie->parf + PARF_PM_STTS, val,
+				     val & PM_ENTER_L23, 10000, 100000);
+	if (ret_l23) {
+		dev_err(pci->dev, "Failed to enter L2/L3\n");
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
 static void qcom_pcie_clear_hpc(struct dw_pcie *pci)
 {
 	u16 offset = dw_pcie_find_capability(pci, PCI_CAP_ID_EXP);
@@ -286,6 +362,50 @@
 	dw_pcie_dbi_ro_wr_dis(pci);
 }
 
+static void qcom_pcie_configure_dbi_base(struct qcom_pcie *pcie)
+{
+	struct dw_pcie *pci = pcie->pci;
+
+	if (pci->dbi_phys_addr) {
+		/*
+		 * PARF_DBI_BASE_ADDR register is in CPU domain and require to
+		 * be programmed with CPU physical address.
+		 */
+		writel(lower_32_bits(pci->dbi_phys_addr), pcie->parf +
+							PARF_DBI_BASE_ADDR);
+		writel(SLV_ADDR_SPACE_SZ, pcie->parf +
+						PARF_SLV_ADDR_SPACE_SIZE);
+	}
+}
+
+static void qcom_pcie_configure_dbi_atu_base(struct qcom_pcie *pcie)
+{
+	struct dw_pcie *pci = pcie->pci;
+
+	if (pci->dbi_phys_addr) {
+		/*
+		 * PARF_DBI_BASE_ADDR_V2 and PARF_ATU_BASE_ADDR registers are
+		 * in CPU domain and require to be programmed with CPU
+		 * physical addresses.
+		 */
+		writel(lower_32_bits(pci->dbi_phys_addr), pcie->parf +
+							PARF_DBI_BASE_ADDR_V2);
+		writel(upper_32_bits(pci->dbi_phys_addr), pcie->parf +
+						PARF_DBI_BASE_ADDR_V2_HI);
+
+		if (pci->atu_phys_addr) {
+			writel(lower_32_bits(pci->atu_phys_addr), pcie->parf +
+							PARF_ATU_BASE_ADDR);
+			writel(upper_32_bits(pci->atu_phys_addr), pcie->parf +
+							PARF_ATU_BASE_ADDR_HI);
+		}
+
+		writel(0x0, pcie->parf + PARF_SLV_ADDR_SPACE_SIZE_V2);
+		writel(SLV_ADDR_SPACE_SZ, pcie->parf +
+					PARF_SLV_ADDR_SPACE_SIZE_V2_HI);
+	}
+}
+
 static void qcom_pcie_2_1_0_ltssm_enable(struct qcom_pcie *pcie)
 {
 	u32 val;
@@ -516,8 +636,7 @@
 
 static int qcom_pcie_post_init_1_0_0(struct qcom_pcie *pcie)
 {
-	/* change DBI base address */
-	writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+	qcom_pcie_configure_dbi_base(pcie);
 
 	if (IS_ENABLED(CONFIG_PCI_MSI)) {
 		u32 val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT);
@@ -539,6 +658,7 @@
 	val = readl(pcie->parf + PARF_LTSSM);
 	val |= LTSSM_EN;
 	writel(val, pcie->parf + PARF_LTSSM);
+	readl(pcie->parf + PARF_LTSSM);
 }
 
 static int qcom_pcie_get_resources_2_3_2(struct qcom_pcie *pcie)
@@ -607,8 +727,7 @@
 	val &= ~PHY_TEST_PWR_DOWN;
 	writel(val, pcie->parf + PARF_PHY_CTRL);
 
-	/* change DBI base address */
-	writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+	qcom_pcie_configure_dbi_base(pcie);
 
 	/* MAC PHY_POWERDOWN MUX DISABLE  */
 	val = readl(pcie->parf + PARF_SYS_CTRL);
@@ -800,13 +919,11 @@
 	u16 offset = dw_pcie_find_capability(pci, PCI_CAP_ID_EXP);
 	u32 val;
 
-	writel(SLV_ADDR_SPACE_SZ, pcie->parf + PARF_SLV_ADDR_SPACE_SIZE);
-
 	val = readl(pcie->parf + PARF_PHY_CTRL);
 	val &= ~PHY_TEST_PWR_DOWN;
 	writel(val, pcie->parf + PARF_PHY_CTRL);
 
-	writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+	qcom_pcie_configure_dbi_atu_base(pcie);
 
 	writel(MST_WAKEUP_EN | SLV_WAKEUP_EN | MSTR_ACLK_CGC_DIS
 		| SLV_ACLK_CGC_DIS | CORE_CLK_CGC_DIS |
@@ -900,27 +1017,27 @@
 		return ret;
 	}
 
-	ret = clk_bulk_prepare_enable(res->num_clks, res->clks);
-	if (ret < 0)
-		goto err_disable_regulators;
-
+	/* Assert the reset to hold the RC in a known state */
 	ret = reset_control_assert(res->rst);
 	if (ret) {
 		dev_err(dev, "reset assert failed (%d)\n", ret);
-		goto err_disable_clocks;
+		goto err_disable_regulators;
 	}
-
 	usleep_range(1000, 1500);
 
+	/* GCC_PCIE_n_AUX_CLK won't come up if the reset is asserted */
 	ret = reset_control_deassert(res->rst);
 	if (ret) {
 		dev_err(dev, "reset deassert failed (%d)\n", ret);
-		goto err_disable_clocks;
+		goto err_disable_regulators;
 	}
-
 	/* Wait for reset to complete, required on SM8450 */
 	usleep_range(1000, 1500);
 
+	ret = clk_bulk_prepare_enable(res->num_clks, res->clks);
+	if (ret < 0)
+		goto err_disable_regulators;
+
 	/* configure PCIe to RC mode */
 	writel(DEVICE_TYPE_RC, pcie->parf + PARF_DEVICE_TYPE);
 
@@ -929,8 +1046,7 @@
 	val &= ~PHY_TEST_PWR_DOWN;
 	writel(val, pcie->parf + PARF_PHY_CTRL);
 
-	/* change DBI base address */
-	writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+	qcom_pcie_configure_dbi_atu_base(pcie);
 
 	/* MAC PHY_POWERDOWN MUX DISABLE  */
 	val = readl(pcie->parf + PARF_SYS_CTRL);
@@ -951,8 +1067,6 @@
 	writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2);
 
 	return 0;
-err_disable_clocks:
-	clk_bulk_disable_unprepare(res->num_clks, res->clks);
 err_disable_regulators:
 	regulator_bulk_disable(ARRAY_SIZE(res->supplies), res->supplies);
 
@@ -961,33 +1075,28 @@
 
 static int qcom_pcie_post_init_2_7_0(struct qcom_pcie *pcie)
 {
-	qcom_pcie_clear_hpc(pcie->pci);
+	const struct qcom_pcie_cfg *pcie_cfg = pcie->cfg;
 
-	return 0;
-}
+	if (pcie_cfg->override_no_snoop)
+		writel(WR_NO_SNOOP_OVERIDE_EN | RD_NO_SNOOP_OVERIDE_EN,
+				pcie->parf + PARF_NO_SNOOP_OVERIDE);
 
-static int qcom_pcie_enable_aspm(struct pci_dev *pdev, void *userdata)
-{
-	/*
-	 * Downstream devices need to be in D0 state before enabling PCI PM
-	 * substates.
-	 */
-	pci_set_power_state_locked(pdev, PCI_D0);
-	pci_enable_link_state_locked(pdev, PCIE_LINK_STATE_ALL);
+	qcom_pcie_clear_aspm_l0s(pcie->pci);
+	qcom_pcie_clear_hpc(pcie->pci);
 
 	return 0;
 }
 
-static void qcom_pcie_host_post_init_2_7_0(struct qcom_pcie *pcie)
-{
-	struct dw_pcie_rp *pp = &pcie->pci->pp;
-
-	pci_walk_bus(pp->bridge->bus, qcom_pcie_enable_aspm, NULL);
-}
-
 static void qcom_pcie_deinit_2_7_0(struct qcom_pcie *pcie)
 {
 	struct qcom_pcie_resources_2_7_0 *res = &pcie->res.v2_7_0;
+	u32 val;
+
+	/* Disable PCIe clocks and resets */
+	val = readl(pcie->parf + PARF_PHY_CTRL);
+	val |= PHY_TEST_PWR_DOWN;
+	writel(val, pcie->parf + PARF_PHY_CTRL);
+	readl(pcie->parf + PARF_PHY_CTRL);
 
 	clk_bulk_disable_unprepare(res->num_clks, res->clks);
 
@@ -1008,11 +1117,17 @@
 	u8 qcom_pcie_crc8_table[CRC8_TABLE_SIZE];
 	int i, nr_map, size = 0;
 	u32 smmu_sid_base;
+	u32 val;
 
 	of_get_property(dev->of_node, "iommu-map", &size);
 	if (!size)
 		return 0;
 
+	/* Enable BDF to SID translation by disabling bypass mode (default) */
+	val = readl(pcie->parf + PARF_BDF_TO_SID_CFG);
+	val &= ~BDF_TO_SID_BYPASS;
+	writel(val, pcie->parf + PARF_BDF_TO_SID_CFG);
+
 	map = kzalloc(size, GFP_KERNEL);
 	if (!map)
 		return -ENOMEM;
@@ -1131,14 +1246,11 @@
 	u32 val;
 	int i;
 
-	writel(SLV_ADDR_SPACE_SZ,
-		pcie->parf + PARF_SLV_ADDR_SPACE_SIZE);
-
 	val = readl(pcie->parf + PARF_PHY_CTRL);
 	val &= ~PHY_TEST_PWR_DOWN;
 	writel(val, pcie->parf + PARF_PHY_CTRL);
 
-	writel(0, pcie->parf + PARF_DBI_BASE_ADDR);
+	qcom_pcie_configure_dbi_atu_base(pcie);
 
 	writel(DEVICE_TYPE_RC, pcie->parf + PARF_DEVICE_TYPE);
 	writel(BYPASS | MSTR_AXI_CLK_EN | AHB_CLK_EN,
@@ -1237,19 +1349,9 @@
 	pcie->cfg->ops->deinit(pcie);
 }
 
-static void qcom_pcie_host_post_init(struct dw_pcie_rp *pp)
-{
-	struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
-	struct qcom_pcie *pcie = to_qcom_pcie(pci);
-
-	if (pcie->cfg->ops->host_post_init)
-		pcie->cfg->ops->host_post_init(pcie);
-}
-
 static const struct dw_pcie_host_ops qcom_pcie_dw_ops = {
 	.init		= qcom_pcie_host_init,
 	.deinit		= qcom_pcie_host_deinit,
-	.post_init	= qcom_pcie_host_post_init,
 };
 
 /* Qcom IP rev.: 2.1.0	Synopsys IP rev.: 4.01a */
@@ -1311,7 +1413,6 @@
 	.get_resources = qcom_pcie_get_resources_2_7_0,
 	.init = qcom_pcie_init_2_7_0,
 	.post_init = qcom_pcie_post_init_2_7_0,
-	.host_post_init = qcom_pcie_host_post_init_2_7_0,
 	.deinit = qcom_pcie_deinit_2_7_0,
 	.ltssm_enable = qcom_pcie_2_3_2_ltssm_enable,
 	.config_sid = qcom_pcie_config_sid_1_9_0,
@@ -1334,6 +1435,11 @@
 	.ops = &ops_1_9_0,
 };
 
+static const struct qcom_pcie_cfg cfg_1_34_0 = {
+	.ops = &ops_1_9_0,
+	.override_no_snoop = true,
+};
+
 static const struct qcom_pcie_cfg cfg_2_1_0 = {
 	.ops = &ops_2_1_0,
 };
@@ -1358,6 +1464,11 @@
 	.ops = &ops_2_9_0,
 };
 
+static const struct qcom_pcie_cfg cfg_sc8280xp = {
+	.ops = &ops_1_9_0,
+	.no_l0s = true,
+};
+
 static const struct dw_pcie_ops dw_pcie_ops = {
 	.link_up = qcom_pcie_link_up,
 	.start_link = qcom_pcie_start_link,
@@ -1546,6 +1657,9 @@
 		goto err_phy_exit;
 	}
 
+	/* If the soc features RPMh, cmd_db must have been prepared by now */
+	pcie->soc_is_rpmh = !cmd_db_ready();
+
 	qcom_pcie_icc_update(pcie);
 
 	if (pcie->mhi)
@@ -1562,58 +1676,110 @@
 	return ret;
 }
 
-static int qcom_pcie_suspend_noirq(struct device *dev)
+static int qcom_pcie_resume_noirq(struct device *dev)
 {
 	struct qcom_pcie *pcie = dev_get_drvdata(dev);
 	int ret;
 
-	/*
-	 * Set minimum bandwidth required to keep data path functional during
-	 * suspend.
-	 */
-	ret = icc_set_bw(pcie->icc_mem, 0, kBps_to_icc(1));
-	if (ret) {
-		dev_err(dev, "Failed to set interconnect bandwidth: %d\n", ret);
-		return ret;
+	if (pcie->soc_is_rpmh) {
+		/*
+		 * Undo the tag change from qcom_pcie_suspend_noirq first in
+		 * case RPMh spontaneously decides to power collapse the
+		 * platform based on other inputs.
+		 */
+		icc_set_tag(pcie->icc_mem, QCOM_ICC_TAG_ALWAYS);
+
+		/* Flush the tag change */
+		ret = icc_enable(pcie->icc_mem);
+		if (ret) {
+			dev_err(pcie->pci->dev, "failed to icc_enable: %d\n", ret);
+			return ret;
+		}
 	}
 
-	/*
-	 * Turn OFF the resources only for controllers without active PCIe
-	 * devices. For controllers with active devices, the resources are kept
-	 * ON and the link is expected to be in L0/L1 (sub)states.
-	 *
-	 * Turning OFF the resources for controllers with active PCIe devices
-	 * will trigger access violation during the end of the suspend cycle,
-	 * as kernel tries to access the PCIe devices config space for masking
-	 * MSIs.
-	 *
-	 * Also, it is not desirable to put the link into L2/L3 state as that
-	 * implies VDD supply will be removed and the devices may go into
-	 * powerdown state. This will affect the lifetime of the storage devices
-	 * like NVMe.
-	 */
-	if (!dw_pcie_link_up(pcie->pci)) {
-		qcom_pcie_host_deinit(&pcie->pci->pp);
-		pcie->suspended = true;
-	}
+	/* Only check this now to make sure the icc tag has been set. */
+	if (!pcie->suspended)
+		return 0;
+
+	ret = qcom_pcie_host_init(&pcie->pci->pp);
+	if (ret)
+		goto revert_icc_tag;
+
+	dw_pcie_setup_rc(&pcie->pci->pp);
+
+	ret = qcom_pcie_start_link(pcie->pci);
+	if (ret)
+		goto deinit_host;
+
+	/* Ignore the retval, the devices may come up later. */
+	dw_pcie_wait_for_link(pcie->pci);
+
+	qcom_pcie_icc_update(pcie);
+
+	pcie->suspended = false;
 
 	return 0;
+
+deinit_host:
+	qcom_pcie_host_deinit(&pcie->pci->pp);
+revert_icc_tag:
+	if (pcie->soc_is_rpmh) {
+		icc_set_tag(pcie->icc_mem, QCOM_ICC_TAG_WAKE);
+
+		/* Ignore the retval, failing here would be tragic anyway.. */
+		icc_enable(pcie->icc_mem);
+	}
+
+	return ret;
 }
 
-static int qcom_pcie_resume_noirq(struct device *dev)
+static int qcom_pcie_suspend_noirq(struct device *dev)
 {
 	struct qcom_pcie *pcie = dev_get_drvdata(dev);
 	int ret;
 
-	if (pcie->suspended) {
-		ret = qcom_pcie_host_init(&pcie->pci->pp);
+	if (pcie->suspended)
+		return 0;
+
+	if (!dw_pcie_link_up(pcie->pci))
+		goto suspend;
+
+	if (pcie->soc_is_rpmh) {
+		/*
+		 * The PCIe RC may be covertly accessed by the secure firmware
+		 * on sleep exit. Use the WAKE bucket to let RPMh pull the plug
+		 * on PCIe in sleep, but guarantee it comes back up for resume.
+		 */
+		icc_set_tag(pcie->icc_mem, QCOM_ICC_TAG_WAKE);
+
+		/* Flush the tag change */
+		ret = icc_enable(pcie->icc_mem);
+		if (ret) {
+			dev_err(pcie->pci->dev, "failed to icc_enable %d\n", ret);
+
+			/* Revert everything and pray icc calls succeed */
+			return qcom_pcie_resume_noirq(dev);
+		}
+	} else {
+		/*
+		 * Set minimum bandwidth required to keep data path functional
+		 * during suspend.
+		 */
+		ret = icc_set_bw(pcie->icc_mem, 0, kBps_to_icc(1));
 		if (ret)
-			return ret;
+			dev_err(dev, "Failed to set interconnect bandwidth: %d\n", ret);
 
-		pcie->suspended = false;
+		return ret;
 	}
 
-	qcom_pcie_icc_update(pcie);
+	ret = qcom_pcie_stop_link(pcie->pci);
+	if (ret)
+		return ret;
+
+suspend:
+	qcom_pcie_host_deinit(&pcie->pci->pp);
+
+	pcie->suspended = true;
 
 	return 0;
 }
@@ -1627,13 +1793,15 @@
 	{ .compatible = "qcom,pcie-ipq8064-v2", .data = &cfg_2_1_0 },
 	{ .compatible = "qcom,pcie-ipq8074", .data = &cfg_2_3_3 },
 	{ .compatible = "qcom,pcie-ipq8074-gen3", .data = &cfg_2_9_0 },
+	{ .compatible = "qcom,pcie-ipq9574", .data = &cfg_2_9_0 },
 	{ .compatible = "qcom,pcie-msm8996", .data = &cfg_2_3_2 },
 	{ .compatible = "qcom,pcie-qcs404", .data = &cfg_2_4_0 },
-	{ .compatible = "qcom,pcie-sa8540p", .data = &cfg_1_9_0 },
-	{ .compatible = "qcom,pcie-sa8775p", .data = &cfg_1_9_0},
+	{ .compatible = "qcom,pcie-sa8540p", .data = &cfg_sc8280xp },
+	{ .compatible = "qcom,pcie-sa8775p", .data = &cfg_1_34_0},
+	{ .compatible = "qcom,pcie-qcs8300", .data = &cfg_1_9_0},
 	{ .compatible = "qcom,pcie-sc7280", .data = &cfg_1_9_0 },
 	{ .compatible = "qcom,pcie-sc8180x", .data = &cfg_1_9_0 },
-	{ .compatible = "qcom,pcie-sc8280xp", .data = &cfg_1_9_0 },
+	{ .compatible = "qcom,pcie-sc8280xp", .data = &cfg_sc8280xp },
 	{ .compatible = "qcom,pcie-sdm845", .data = &cfg_2_7_0 },
 	{ .compatible = "qcom,pcie-sdx55", .data = &cfg_1_9_0 },
 	{ .compatible = "qcom,pcie-sm8150", .data = &cfg_1_9_0 },
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-rcar-gen4.c
@@ -128,10 +128,10 @@
 	rcar_gen4_pcie_ltssm_enable(rcar, true);
 
 	/*
-	 * Require direct speed change with retrying here if the link_gen is
-	 * PCIe Gen2 or higher.
+	 * Require direct speed change with retrying here if the max_link_speed
+	 * is PCIe Gen2 or higher.
 	 */
-	changes = min_not_zero(dw->link_gen, RCAR_MAX_LINK_SPEED) - 1;
+	changes = min_not_zero(dw->max_link_speed, RCAR_MAX_LINK_SPEED) - 1;
 
 	/*
 	 * Since dw_pcie_setup_rc() sets it once, PCIe Gen2 will be trained.
@@ -255,7 +255,7 @@
 	rcar->dw.ops = &dw_pcie_ops;
 	rcar->dw.dev = dev;
 	rcar->pdev = pdev;
-	dw_pcie_cap_set(&rcar->dw, EDMA_UNROLL);
+	rcar->dw.edma.mf = EDMA_MF_EDMA_UNROLL;
 	dw_pcie_cap_set(&rcar->dw, REQ_RES);
 	platform_set_drvdata(pdev, rcar);
 
@@ -352,11 +352,8 @@
 		dw_pcie_ep_reset_bar(pci, bar);
 }
 
-static void rcar_gen4_pcie_ep_deinit(struct dw_pcie_ep *ep)
+static void rcar_gen4_pcie_ep_deinit(struct rcar_gen4_pcie *rcar)
 {
-	struct dw_pcie *dw = to_dw_pcie_from_ep(ep);
-	struct rcar_gen4_pcie *rcar = to_rcar_gen4_pcie(dw);
-
 	writel(0, rcar->base + PCIEDMAINTSTSEN);
 	rcar_gen4_pcie_common_deinit(rcar);
 }
@@ -408,7 +405,6 @@
 static const struct dw_pcie_ep_ops pcie_ep_ops = {
 	.pre_init = rcar_gen4_pcie_ep_pre_init,
 	.init = rcar_gen4_pcie_ep_init,
-	.deinit = rcar_gen4_pcie_ep_deinit,
 	.raise_irq = rcar_gen4_pcie_ep_raise_irq,
 	.get_features = rcar_gen4_pcie_ep_get_features,
 	.get_dbi_offset = rcar_gen4_pcie_ep_get_dbi_offset,
@@ -418,18 +414,24 @@
 static int rcar_gen4_add_dw_pcie_ep(struct rcar_gen4_pcie *rcar)
 {
 	struct dw_pcie_ep *ep = &rcar->dw.ep;
+	int ret;
 
 	if (!IS_ENABLED(CONFIG_PCIE_RCAR_GEN4_EP))
 		return -ENODEV;
 
 	ep->ops = &pcie_ep_ops;
 
-	return dw_pcie_ep_init(ep);
+	ret = dw_pcie_ep_init(ep);
+	if (ret)
+		rcar_gen4_pcie_ep_deinit(rcar);
+
+	return ret;
 }
 
 static void rcar_gen4_remove_dw_pcie_ep(struct rcar_gen4_pcie *rcar)
 {
-	dw_pcie_ep_exit(&rcar->dw.ep);
+	dw_pcie_ep_deinit(&rcar->dw.ep);
+	rcar_gen4_pcie_ep_deinit(rcar);
 }
 
 /* Common */
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-spear13xx.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-spear13xx.c
@@ -233,7 +233,7 @@
 	}
 
 	if (of_property_read_bool(np, "st,pcie-is-gen1"))
-		pci->link_gen = 1;
+		pci->max_link_speed = 1;
 
 	platform_set_drvdata(pdev, spear13xx_pcie);
 
--- linux-qcom-6.8.0.orig/drivers/pci/controller/dwc/pcie-tegra194.c
+++ linux-qcom-6.8.0/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -179,11 +179,6 @@
 #define N_FTS_VAL					52
 #define FTS_VAL						52
 
-#define GEN3_EQ_CONTROL_OFF			0x8a8
-#define GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC_SHIFT	8
-#define GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC_MASK	GENMASK(23, 8)
-#define GEN3_EQ_CONTROL_OFF_FB_MODE_MASK	GENMASK(3, 0)
-
 #define PORT_LOGIC_AMBA_ERROR_RESPONSE_DEFAULT	0x8D0
 #define AMBA_ERROR_RESPONSE_CRS_SHIFT		3
 #define AMBA_ERROR_RESPONSE_CRS_MASK		GENMASK(1, 0)
@@ -867,9 +862,9 @@
 	dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, val);
 
 	val = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
-	val &= ~GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC_MASK;
-	val |= (0x3ff << GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC_SHIFT);
-	val &= ~GEN3_EQ_CONTROL_OFF_FB_MODE_MASK;
+	val &= ~GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC;
+	val |= FIELD_PREP(GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC, 0x3ff);
+	val &= ~GEN3_EQ_CONTROL_OFF_FB_MODE;
 	dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, val);
 
 	val = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
@@ -878,10 +873,10 @@
 	dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, val);
 
 	val = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
-	val &= ~GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC_MASK;
-	val |= (pcie->of_data->gen4_preset_vec <<
-		GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC_SHIFT);
-	val &= ~GEN3_EQ_CONTROL_OFF_FB_MODE_MASK;
+	val &= ~GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC;
+	val |= FIELD_PREP(GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC,
+			  pcie->of_data->gen4_preset_vec);
+	val &= ~GEN3_EQ_CONTROL_OFF_FB_MODE;
 	dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, val);
 
 	val = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
@@ -1715,6 +1710,8 @@
 	if (ret)
 		dev_err(pcie->dev, "Failed to go Detect state: %d\n", ret);
 
+	dw_pcie_ep_cleanup(&pcie->pci.ep);
+
 	reset_control_assert(pcie->core_rst);
 
 	tegra_pcie_disable_phy(pcie);
@@ -1895,7 +1892,7 @@
 	val = (upper_32_bits(ep->msi_mem_phys) & MSIX_ADDR_MATCH_HIGH_OFF_MASK);
 	dw_pcie_writel_dbi(pci, MSIX_ADDR_MATCH_HIGH_OFF, val);
 
-	ret = dw_pcie_ep_init_complete(ep);
+	ret = dw_pcie_ep_init_registers(ep);
 	if (ret) {
 		dev_err(dev, "Failed to complete initialization: %d\n", ret);
 		goto fail_init_complete;
@@ -2010,6 +2007,7 @@
 	.reserved_bar = 1 << BAR_2 | 1 << BAR_3 | 1 << BAR_4 | 1 << BAR_5,
 	.bar_fixed_64bit = 1 << BAR_0,
 	.bar_fixed_size[0] = SZ_1M,
+	.align = SZ_64K,
 };
 
 static const struct pci_epc_features*
@@ -2269,11 +2267,14 @@
 		ret = tegra_pcie_config_ep(pcie, pdev);
 		if (ret < 0)
 			goto fail;
+		else
+			return 0;
 		break;
 
 	default:
 		dev_err(dev, "Invalid PCIe device type %d\n",
 			pcie->of_data->mode);
+		ret = -EINVAL;
 	}
 
 fail:
--- linux-qcom-6.8.0.orig/drivers/pci/controller/misc/Kconfig
+++ linux-qcom-6.8.0/drivers/pci/controller/misc/Kconfig
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0
+config QCOM_QPS615_PCIE_SWITCH
+	bool "QCOM QPS615 PCIe Switch Driver"
+	depends on PCI
+	help
+	 This adds support to enable QPS615 PCIe switch power. And after powering on the switch do
+	 switch initialization through I2C writes. The I2C data is parsed from the requested
+	 firmware.
+
+	 Say Y to compile this driver.
--- linux-qcom-6.8.0.orig/drivers/pci/controller/misc/Makefile
+++ linux-qcom-6.8.0/drivers/pci/controller/misc/Makefile
@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_QCOM_QPS615_PCIE_SWITCH) += qps615.o
--- linux-qcom-6.8.0.orig/drivers/pci/controller/misc/qps615.c
+++ linux-qcom-6.8.0/drivers/pci/controller/misc/qps615.c
@@ -0,0 +1,260 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/* Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved. */
+
+#include <linux/firmware.h>
+#include <linux/i2c.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+
+#define DRV_NAME		"qps615-switch-i2c"
+
+struct pcie_switch_i2c_setting {
+	u32 slv_addr;
+	u32 reg_addr;
+	u32 val;
+};
+
+struct qps615_switch_i2c {
+	struct i2c_client *client;
+	struct regulator *vdda;
+};
+
+static const struct of_device_id qps615_switch_of_match[] = {
+	{.compatible = "qcom,switch-i2c" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, qps615_switch_of_match);
+
+/* write 32-bit value to 24 bit register */
+static int qps615_switch_i2c_write(struct i2c_client *client, u32 slv_addr, u32 reg_addr,
+				   u32 reg_val)
+{
+	struct i2c_msg msg;
+	u8 msg_buf[7];
+	int ret;
+
+	msg.addr = slv_addr;
+	msg.len = 7;
+	msg.flags = 0;
+
+	/* Big Endian for reg addr */
+	msg_buf[0] = (u8)(reg_addr >> 16);
+	msg_buf[1] = (u8)(reg_addr >> 8);
+	msg_buf[2] = (u8)reg_addr;
+
+	/* Little Endian for reg val */
+	msg_buf[3] = (u8)(reg_val);
+	msg_buf[4] = (u8)(reg_val >> 8);
+	msg_buf[5] = (u8)(reg_val >> 16);
+	msg_buf[6] = (u8)(reg_val >> 24);
+
+	msg.buf = msg_buf;
+	ret = i2c_transfer(client->adapter, &msg, 1);
+	return ret == 1 ? 0 : ret;
+}
+
+/* read 32 bit value from 24 bit reg addr */
+static int qps615_switch_i2c_read(struct i2c_client *client, u32 slv_addr, u32 reg_addr,
+				  u32 *reg_val)
+{
+	u8 wr_data[3], rd_data[4] = {0};
+	struct i2c_msg msg[2];
+	int ret;
+
+	msg[0].addr = slv_addr;
+	msg[0].len = 3;
+	msg[0].flags = 0;
+
+	/* Big Endian for reg addr */
+	wr_data[0] = (u8)(reg_addr >> 16);
+	wr_data[1] = (u8)(reg_addr >> 8);
+	wr_data[2] = (u8)reg_addr;
+
+	msg[0].buf = wr_data;
+
+	msg[1].addr = slv_addr;
+	msg[1].len = 4;
+	msg[1].flags = I2C_M_RD;
+
+	msg[1].buf = rd_data;
+
+	ret = i2c_transfer(client->adapter, &msg[0], 2);
+	if (ret != 2)
+		return ret;
+
+	*reg_val = (rd_data[3] << 24) | (rd_data[2] << 16) | (rd_data[1] << 8) | rd_data[0];
+
+	return 0;
+}
+
+/*
+ * QPS615 switch uses i2c interface to configure its internal registers.
+ * The sequence of register writes though i2c is requested through
+ * request_firmware API. This firmware bin is parsed and i2c writes
+ * are performed to initialize the QPS615 switch.
+ */
+int qps615_switch_init(struct i2c_client *client)
+{
+	const struct firmware *fw;
+	struct pcie_switch_i2c_setting *set;
+	int ret;
+	u32 val;
+	const u8 *pos, *eof;
+
+	if (!client)
+		return 0;
+
+	ret = request_firmware(&fw, "qcom/qps615.bin", &client->dev);
+	if (ret < 0) {
+		dev_err(&client->dev, "firmware loading failed with ret %d\n", ret);
+		return ret;
+	}
+
+	if (!fw) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	pos = fw->data;
+	eof = fw->data + fw->size;
+
+	while (pos < (fw->data + fw->size)) {
+		set = (struct pcie_switch_i2c_setting *)pos;
+
+		ret = qps615_switch_i2c_write(client, set->slv_addr, set->reg_addr, set->val);
+		if (ret) {
+			dev_err(&client->dev,
+				"I2c write failed for slv addr:%x at addr%x with val %x ret %d\n",
+				set->slv_addr, set->reg_addr, set->val, ret);
+			goto err;
+		}
+
+		ret = qps615_switch_i2c_read(client,  set->slv_addr, set->reg_addr, &val);
+		if (ret) {
+			dev_err(&client->dev, "I2c read failed for slv addr:%x at addr%x ret %d\n",
+				set->slv_addr, set->reg_addr, ret);
+			goto err;
+		}
+
+		if (set->val != val) {
+			dev_err(&client->dev,
+				"I2c read's mismatch for slv:%x at addr%x exp%d got%d\n",
+				set->slv_addr, set->reg_addr, set->val, val);
+			goto err;
+		}
+		pos += sizeof(struct pcie_switch_i2c_setting);
+	}
+
+err:
+	release_firmware(fw);
+
+	return ret;
+}
+
+static void qps615_power_on(struct i2c_client *client)
+{
+	struct qps615_switch_i2c *qps615 = i2c_get_clientdata(client);
+	int ret;
+
+	ret = regulator_enable(qps615->vdda);
+	if (ret)
+		dev_err(&client->dev, "cannot enable vdda regulator\n");
+
+	qps615_switch_init(client);
+}
+
+static int qps615_suspend_noirq(struct device *dev)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct qps615_switch_i2c *qps615 = i2c_get_clientdata(client);
+
+	/* disable power of qps615 switch */
+	regulator_disable(qps615->vdda);
+
+	return 0;
+}
+
+static int qps615_resume_noirq(struct device *dev)
+{
+	qps615_power_on(to_i2c_client(dev));
+
+	return 0;
+}
+
+static int qps615_switch_probe(struct i2c_client *client)
+{
+	struct qps615_switch_i2c *qps615;
+	int ret;
+
+	qps615 = devm_kzalloc(&client->dev, sizeof(*qps615), GFP_KERNEL);
+	if (!qps615)
+		return -ENOMEM;
+
+	qps615->client = client;
+
+	i2c_set_clientdata(client, qps615);
+
+	qps615->vdda = devm_regulator_get(&client->dev, "vdda");
+
+	ret = regulator_enable(qps615->vdda);
+	if (ret)
+		dev_err(&client->dev, "cannot enable vdda regulator\n");
+
+	qps615_switch_init(client);
+	return 0;
+}
+
+static const struct i2c_device_id qps615_switch_id[] = {
+	{DRV_NAME, 0},
+	{}
+};
+MODULE_DEVICE_TABLE(i2c, qps615_switch_id);
+
+static const struct dev_pm_ops qps615_pm_ops = {
+	NOIRQ_SYSTEM_SLEEP_PM_OPS(qps615_suspend_noirq, qps615_resume_noirq)
+};
+static struct i2c_driver qps615_switch_driver = {
+	.driver = {
+		.name = DRV_NAME,
+		.pm = &qps615_pm_ops,
+		.of_match_table = qps615_switch_of_match,
+	},
+	.probe = qps615_switch_probe,
+	.id_table = qps615_switch_id,
+};
+
+static __init int qps615_i2c_init(void)
+{
+	int ret = -ENODEV;
+
+	ret = i2c_add_driver(&qps615_switch_driver);
+	if (ret)
+		pr_err("qps615 driver failed to register with i2c framework %d\n", ret);
+
+	return ret;
+}
+module_init(qps615_i2c_init);
+
+static void qcom_pcie_resume_early(struct pci_dev *pdev)
+{
+	pci_restore_state(pdev);
+}
+
+DECLARE_PCI_FIXUP_CLASS_RESUME_EARLY(PCI_ANY_ID,
+				PCI_ANY_ID, PCI_CLASS_BRIDGE_PCI_NORMAL, 0,
+				qcom_pcie_resume_early);
+
+static void qcom_pcie_suspend_late(struct pci_dev *pdev)
+{
+	pci_save_state(pdev);
+}
+
+DECLARE_PCI_FIXUP_CLASS_SUSPEND_LATE(PCI_ANY_ID,
+				PCI_ANY_ID, PCI_CLASS_BRIDGE_PCI_NORMAL, 0,
+				qcom_pcie_suspend_late);
+
+MODULE_AUTHOR("Krishna Chaitanya Chundru <quic_krichai@quicinc.com>");
+MODULE_DESCRIPTION("QPS615 PCIE Switch driver");
+MODULE_LICENSE("GPL");
+MODULE_FIRMWARE("qcom/qps615.bin");
--- linux-qcom-6.8.0.orig/drivers/pci/controller/pci-hyperv.c
+++ linux-qcom-6.8.0/drivers/pci/controller/pci-hyperv.c
@@ -49,6 +49,7 @@
 #include <linux/refcount.h>
 #include <linux/irqdomain.h>
 #include <linux/acpi.h>
+#include <linux/sizes.h>
 #include <asm/mshyperv.h>
 
 /*
@@ -465,7 +466,7 @@
 	u32 status;
 } __packed;
 
-static int pci_ring_size = (4 * PAGE_SIZE);
+static int pci_ring_size = VMBUS_RING_SIZE(SZ_16K);
 
 /*
  * Driver specific state.
@@ -1129,8 +1130,8 @@
 		   PCI_CAPABILITY_LIST) {
 		/* ROM BARs are unimplemented */
 		*val = 0;
-	} else if (where >= PCI_INTERRUPT_LINE && where + size <=
-		   PCI_INTERRUPT_PIN) {
+	} else if ((where >= PCI_INTERRUPT_LINE && where + size <= PCI_INTERRUPT_PIN) ||
+		   (where >= PCI_INTERRUPT_PIN && where + size <= PCI_MIN_GNT)) {
 		/*
 		 * Interrupt Line and Interrupt PIN are hard-wired to zero
 		 * because this front-end only supports message-signaled
--- linux-qcom-6.8.0.orig/drivers/pci/controller/pci-loongson.c
+++ linux-qcom-6.8.0/drivers/pci/controller/pci-loongson.c
@@ -163,6 +163,19 @@
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON,
 			DEV_LS7A_HDMI, loongson_pci_pin_quirk);
 
+static void loongson_pci_msi_quirk(struct pci_dev *dev)
+{
+	u16 val, class = dev->class >> 8;
+
+	if (class != PCI_CLASS_BRIDGE_HOST)
+		return;
+
+	pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &val);
+	val |= PCI_MSI_FLAGS_ENABLE;
+	pci_write_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, val);
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, DEV_LS7A_PCIE_PORT5, loongson_pci_msi_quirk);
+
 static struct loongson_pci *pci_bus_to_loongson_pci(struct pci_bus *bus)
 {
 	struct pci_config_window *cfg;
--- linux-qcom-6.8.0.orig/drivers/pci/controller/pcie-brcmstb.c
+++ linux-qcom-6.8.0/drivers/pci/controller/pcie-brcmstb.c
@@ -336,7 +336,7 @@
 	readl(base + PCIE_RC_DL_MDIO_ADDR);
 	writel(MDIO_DATA_DONE_MASK | wrdata, base + PCIE_RC_DL_MDIO_WR_DATA);
 
-	err = readw_poll_timeout_atomic(base + PCIE_RC_DL_MDIO_WR_DATA, data,
+	err = readl_poll_timeout_atomic(base + PCIE_RC_DL_MDIO_WR_DATA, data,
 					MDIO_WT_DONE(data), 10, 100);
 	return err;
 }
--- linux-qcom-6.8.0.orig/drivers/pci/controller/pcie-rcar-host.c
+++ linux-qcom-6.8.0/drivers/pci/controller/pcie-rcar-host.c
@@ -78,7 +78,11 @@
 		writel(L1IATN, pcie_base + PMCTLR);
 		ret = readl_poll_timeout_atomic(pcie_base + PMSR, val,
 						val & L1FAEG, 10, 1000);
-		WARN(ret, "Timeout waiting for L1 link state, ret=%d\n", ret);
+		if (ret) {
+			dev_warn_ratelimited(pcie_dev,
+					     "Timeout waiting for L1 link state, ret=%d\n",
+					     ret);
+		}
 		writel(L1FAEG | PMEL1RX, pcie_base + PMSR);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/pci/controller/pcie-rockchip-ep.c
+++ linux-qcom-6.8.0/drivers/pci/controller/pcie-rockchip-ep.c
@@ -63,15 +63,25 @@
 			    ROCKCHIP_PCIE_AT_OB_REGION_DESC1(region));
 }
 
+static int rockchip_pcie_ep_ob_atu_num_bits(struct rockchip_pcie *rockchip,
+					    u64 pci_addr, size_t size)
+{
+	int num_pass_bits = fls64(pci_addr ^ (pci_addr + size - 1));
+
+	return clamp(num_pass_bits,
+		     ROCKCHIP_PCIE_AT_MIN_NUM_BITS,
+		     ROCKCHIP_PCIE_AT_MAX_NUM_BITS);
+}
+
 static void rockchip_pcie_prog_ep_ob_atu(struct rockchip_pcie *rockchip, u8 fn,
 					 u32 r, u64 cpu_addr, u64 pci_addr,
 					 size_t size)
 {
-	int num_pass_bits = fls64(size - 1);
+	int num_pass_bits;
 	u32 addr0, addr1, desc0;
 
-	if (num_pass_bits < 8)
-		num_pass_bits = 8;
+	num_pass_bits = rockchip_pcie_ep_ob_atu_num_bits(rockchip,
+							 pci_addr, size);
 
 	addr0 = ((num_pass_bits - 1) & PCIE_CORE_OB_REGION_ADDR0_NUM_BITS) |
 		(lower_32_bits(pci_addr) & PCIE_CORE_OB_REGION_ADDR0_LO_ADDR);
@@ -98,10 +108,8 @@
 
 	/* All functions share the same vendor ID with function 0 */
 	if (fn == 0) {
-		u32 vid_regs = (hdr->vendorid & GENMASK(15, 0)) |
-			       (hdr->subsys_vendor_id & GENMASK(31, 16)) << 16;
-
-		rockchip_pcie_write(rockchip, vid_regs,
+		rockchip_pcie_write(rockchip,
+				    hdr->vendorid | hdr->subsys_vendor_id << 16,
 				    PCIE_CORE_CONFIG_VENDOR);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/pci/controller/pcie-rockchip.c
+++ linux-qcom-6.8.0/drivers/pci/controller/pcie-rockchip.c
@@ -121,7 +121,7 @@
 
 	if (rockchip->is_rc) {
 		rockchip->ep_gpio = devm_gpiod_get_optional(dev, "ep",
-							    GPIOD_OUT_HIGH);
+							    GPIOD_OUT_LOW);
 		if (IS_ERR(rockchip->ep_gpio))
 			return dev_err_probe(dev, PTR_ERR(rockchip->ep_gpio),
 					     "failed to get ep GPIO\n");
--- linux-qcom-6.8.0.orig/drivers/pci/controller/pcie-rockchip.h
+++ linux-qcom-6.8.0/drivers/pci/controller/pcie-rockchip.h
@@ -245,6 +245,10 @@
 	(PCIE_EP_PF_CONFIG_REGS_BASE + (((fn) << 12) & GENMASK(19, 12)))
 #define ROCKCHIP_PCIE_EP_VIRT_FUNC_BASE(fn) \
 	(PCIE_EP_PF_CONFIG_REGS_BASE + 0x10000 + (((fn) << 12) & GENMASK(19, 12)))
+
+#define ROCKCHIP_PCIE_AT_MIN_NUM_BITS  8
+#define ROCKCHIP_PCIE_AT_MAX_NUM_BITS  20
+
 #define ROCKCHIP_PCIE_AT_IB_EP_FUNC_BAR_ADDR0(fn, bar) \
 	(PCIE_CORE_AXI_CONF_BASE + 0x0828 + (fn) * 0x0040 + (bar) * 0x0008)
 #define ROCKCHIP_PCIE_AT_IB_EP_FUNC_BAR_ADDR1(fn, bar) \
--- linux-qcom-6.8.0.orig/drivers/pci/controller/pcie-xilinx-nwl.c
+++ linux-qcom-6.8.0/drivers/pci/controller/pcie-xilinx-nwl.c
@@ -80,8 +80,8 @@
 #define MSGF_MISC_SR_NON_FATAL_DEV	BIT(22)
 #define MSGF_MISC_SR_FATAL_DEV		BIT(23)
 #define MSGF_MISC_SR_LINK_DOWN		BIT(24)
-#define MSGF_MSIC_SR_LINK_AUTO_BWIDTH	BIT(25)
-#define MSGF_MSIC_SR_LINK_BWIDTH	BIT(26)
+#define MSGF_MISC_SR_LINK_AUTO_BWIDTH	BIT(25)
+#define MSGF_MISC_SR_LINK_BWIDTH	BIT(26)
 
 #define MSGF_MISC_SR_MASKALL		(MSGF_MISC_SR_RXMSG_AVAIL | \
 					MSGF_MISC_SR_RXMSG_OVER | \
@@ -96,8 +96,8 @@
 					MSGF_MISC_SR_NON_FATAL_DEV | \
 					MSGF_MISC_SR_FATAL_DEV | \
 					MSGF_MISC_SR_LINK_DOWN | \
-					MSGF_MSIC_SR_LINK_AUTO_BWIDTH | \
-					MSGF_MSIC_SR_LINK_BWIDTH)
+					MSGF_MISC_SR_LINK_AUTO_BWIDTH | \
+					MSGF_MISC_SR_LINK_BWIDTH)
 
 /* Legacy interrupt status mask bits */
 #define MSGF_LEG_SR_INTA		BIT(0)
@@ -299,10 +299,10 @@
 	if (misc_stat & MSGF_MISC_SR_FATAL_DEV)
 		dev_err(dev, "Fatal Error Detected\n");
 
-	if (misc_stat & MSGF_MSIC_SR_LINK_AUTO_BWIDTH)
+	if (misc_stat & MSGF_MISC_SR_LINK_AUTO_BWIDTH)
 		dev_info(dev, "Link Autonomous Bandwidth Management Status bit set\n");
 
-	if (misc_stat & MSGF_MSIC_SR_LINK_BWIDTH)
+	if (misc_stat & MSGF_MISC_SR_LINK_BWIDTH)
 		dev_info(dev, "Link Bandwidth Management Status bit set\n");
 
 	/* Clear misc interrupt status */
@@ -371,7 +371,7 @@
 	u32 mask;
 	u32 val;
 
-	mask = 1 << (data->hwirq - 1);
+	mask = 1 << data->hwirq;
 	raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags);
 	val = nwl_bridge_readl(pcie, MSGF_LEG_MASK);
 	nwl_bridge_writel(pcie, (val & (~mask)), MSGF_LEG_MASK);
@@ -385,7 +385,7 @@
 	u32 mask;
 	u32 val;
 
-	mask = 1 << (data->hwirq - 1);
+	mask = 1 << data->hwirq;
 	raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags);
 	val = nwl_bridge_readl(pcie, MSGF_LEG_MASK);
 	nwl_bridge_writel(pcie, (val | mask), MSGF_LEG_MASK);
@@ -779,6 +779,7 @@
 		return -ENODEV;
 
 	pcie = pci_host_bridge_priv(bridge);
+	platform_set_drvdata(pdev, pcie);
 
 	pcie->dev = dev;
 
@@ -801,13 +802,13 @@
 	err = nwl_pcie_bridge_init(pcie);
 	if (err) {
 		dev_err(dev, "HW Initialization failed\n");
-		return err;
+		goto err_clk;
 	}
 
 	err = nwl_pcie_init_irq_domain(pcie);
 	if (err) {
 		dev_err(dev, "Failed creating IRQ Domain\n");
-		return err;
+		goto err_clk;
 	}
 
 	bridge->sysdata = pcie;
@@ -817,11 +818,24 @@
 		err = nwl_pcie_enable_msi(pcie);
 		if (err < 0) {
 			dev_err(dev, "failed to enable MSI support: %d\n", err);
-			return err;
+			goto err_clk;
 		}
 	}
 
-	return pci_host_probe(bridge);
+	err = pci_host_probe(bridge);
+	if (!err)
+		return 0;
+
+err_clk:
+	clk_disable_unprepare(pcie->clk);
+	return err;
+}
+
+static void nwl_pcie_remove(struct platform_device *pdev)
+{
+	struct nwl_pcie *pcie = platform_get_drvdata(pdev);
+
+	clk_disable_unprepare(pcie->clk);
 }
 
 static struct platform_driver nwl_pcie_driver = {
@@ -831,5 +845,6 @@
 		.of_match_table = nwl_pcie_of_match,
 	},
 	.probe = nwl_pcie_probe,
+	.remove_new = nwl_pcie_remove,
 };
 builtin_platform_driver(nwl_pcie_driver);
--- linux-qcom-6.8.0.orig/drivers/pci/controller/vmd.c
+++ linux-qcom-6.8.0/drivers/pci/controller/vmd.c
@@ -751,11 +751,11 @@
 	if (!(features & VMD_FEAT_BIOS_PM_QUIRK))
 		return 0;
 
-	pci_enable_link_state_locked(pdev, PCIE_LINK_STATE_ALL);
+	pdev->aspm_os_control = 1;
 
 	pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_LTR);
 	if (!pos)
-		return 0;
+		goto out_state_change;
 
 	/*
 	 * Skip if the max snoop LTR is non-zero, indicating BIOS has set it
@@ -763,7 +763,7 @@
 	 */
 	pci_read_config_dword(pdev, pos + PCI_LTR_MAX_SNOOP_LAT, &ltr_reg);
 	if (!!(ltr_reg & (PCI_LTR_VALUE_MASK | PCI_LTR_SCALE_MASK)))
-		return 0;
+		goto out_state_change;
 
 	/*
 	 * Set the default values to the maximum required by the platform to
@@ -775,6 +775,13 @@
 	pci_write_config_dword(pdev, pos + PCI_LTR_MAX_SNOOP_LAT, ltr_reg);
 	pci_info(pdev, "VMD: Default LTR value set by driver\n");
 
+out_state_change:
+	/*
+	 * Ensure devices are in D0 before enabling PCI-PM L1 PM Substates, per
+	 * PCIe r6.0, sec 5.5.4.
+	 */
+	pci_set_power_state_locked(pdev, PCI_D0);
+	pci_enable_link_state_locked(pdev, PCIE_LINK_STATE_ALL);
 	return 0;
 }
 
@@ -907,9 +914,13 @@
 	pci_add_resource_offset(&resources, &vmd->resources[1], offset[0]);
 	pci_add_resource_offset(&resources, &vmd->resources[2], offset[1]);
 
+	pci_lock_rescan_remove();
+
 	vmd->bus = pci_create_root_bus(&vmd->dev->dev, vmd->busn_start,
 				       &vmd_ops, sd, &resources);
 	if (!vmd->bus) {
+		pci_unlock_rescan_remove();
+
 		pci_free_resource_list(&resources);
 		vmd_remove_irq_domain(vmd);
 		return -ENODEV;
@@ -925,6 +936,9 @@
 		dev_set_msi_domain(&vmd->bus->dev,
 				   dev_get_msi_domain(&vmd->dev->dev));
 
+	WARN(sysfs_create_link(&vmd->dev->dev.kobj, &vmd->bus->dev.kobj,
+			       "domain"), "Can't create symlink to domain\n");
+
 	vmd_acpi_begin();
 
 	pci_scan_child_bus(vmd->bus);
@@ -965,8 +979,8 @@
 
 	vmd_acpi_end();
 
-	WARN(sysfs_create_link(&vmd->dev->dev.kobj, &vmd->bus->dev.kobj,
-			       "domain"), "Can't create symlink to domain\n");
+	pci_unlock_rescan_remove();
+
 	return 0;
 }
 
@@ -1042,8 +1056,8 @@
 {
 	struct vmd_dev *vmd = pci_get_drvdata(dev);
 
-	sysfs_remove_link(&vmd->dev->dev.kobj, "domain");
 	pci_stop_root_bus(vmd->bus);
+	sysfs_remove_link(&vmd->dev->dev.kobj, "domain");
 	pci_remove_root_bus(vmd->bus);
 	vmd_cleanup_srcu(vmd);
 	vmd_detach_resources(vmd);
@@ -1111,6 +1125,10 @@
 		.driver_data = VMD_FEATS_CLIENT,},
 	{PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_VMD_9A0B),
 		.driver_data = VMD_FEATS_CLIENT,},
+	{PCI_VDEVICE(INTEL, 0xb60b),
+                .driver_data = VMD_FEATS_CLIENT,},
+	{PCI_VDEVICE(INTEL, 0xb06f),
+                .driver_data = VMD_FEATS_CLIENT,},
 	{0,}
 };
 MODULE_DEVICE_TABLE(pci, vmd_ids);
--- linux-qcom-6.8.0.orig/drivers/pci/endpoint/functions/pci-epf-mhi.c
+++ linux-qcom-6.8.0/drivers/pci/endpoint/functions/pci-epf-mhi.c
@@ -123,6 +123,23 @@
 	.flags = MHI_EPF_USE_DMA,
 };
 
+static struct pci_epf_header sa8775p_header = {
+	.vendorid = PCI_VENDOR_ID_QCOM,
+	.deviceid = 0x0116,
+	.baseclass_code = PCI_CLASS_OTHERS,
+	.interrupt_pin = PCI_INTERRUPT_INTA,
+};
+
+static const struct pci_epf_mhi_ep_info sa8775p_info = {
+	.config = &mhi_v1_config,
+	.epf_header = &sa8775p_header,
+	.bar_num = BAR_0,
+	.epf_flags = PCI_BASE_ADDRESS_MEM_TYPE_32,
+	.msi_count = 32,
+	.mru = 0x8000,
+	.flags = MHI_EPF_USE_DMA,
+};
+
 struct pci_epf_mhi {
 	const struct pci_epc_features *epc_features;
 	const struct pci_epf_mhi_ep_info *info;
@@ -832,12 +849,18 @@
 {
 	struct pci_epf_mhi *epf_mhi = epf_get_drvdata(epf);
 	struct pci_epc *epc = epf->epc;
+	struct device *dev = &epf->dev;
 	struct platform_device *pdev = to_platform_device(epc->dev.parent);
 	struct resource *res;
 	int ret;
 
 	/* Get MMIO base address from Endpoint controller */
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "mmio");
+	if (!res) {
+		dev_err(dev, "Failed to get \"mmio\" resource\n");
+		return -ENODEV;
+	}
+
 	epf_mhi->mmio_phys = res->start;
 	epf_mhi->mmio_size = resource_size(res);
 
@@ -913,8 +936,9 @@
 }
 
 static const struct pci_epf_device_id pci_epf_mhi_ids[] = {
-	{ .name = "sdx55", .driver_data = (kernel_ulong_t)&sdx55_info },
-	{ .name = "sm8450", .driver_data = (kernel_ulong_t)&sm8450_info },
+	{ .name = "pci_epf_mhi_sa8775p", .driver_data = (kernel_ulong_t)&sa8775p_info },
+	{ .name = "pci_epf_mhi_sdx55", .driver_data = (kernel_ulong_t)&sdx55_info },
+	{ .name = "pci_epf_mhi_sm8450", .driver_data = (kernel_ulong_t)&sm8450_info },
 	{},
 };
 
--- linux-qcom-6.8.0.orig/drivers/pci/endpoint/functions/pci-epf-test.c
+++ linux-qcom-6.8.0/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -750,19 +750,11 @@
 {
 	struct pci_epf_test *epf_test = epf_get_drvdata(epf);
 	struct pci_epf_header *header = epf->header;
-	const struct pci_epc_features *epc_features;
+	const struct pci_epc_features *epc_features = epf_test->epc_features;
 	struct pci_epc *epc = epf->epc;
 	struct device *dev = &epf->dev;
-	bool msix_capable = false;
-	bool msi_capable = true;
 	int ret;
 
-	epc_features = pci_epc_get_features(epc, epf->func_no, epf->vfunc_no);
-	if (epc_features) {
-		msix_capable = epc_features->msix_capable;
-		msi_capable = epc_features->msi_capable;
-	}
-
 	if (epf->vfunc_no <= 1) {
 		ret = pci_epc_write_header(epc, epf->func_no, epf->vfunc_no, header);
 		if (ret) {
@@ -775,7 +767,7 @@
 	if (ret)
 		return ret;
 
-	if (msi_capable) {
+	if (epc_features->msi_capable) {
 		ret = pci_epc_set_msi(epc, epf->func_no, epf->vfunc_no,
 				      epf->msi_interrupts);
 		if (ret) {
@@ -784,7 +776,7 @@
 		}
 	}
 
-	if (msix_capable) {
+	if (epc_features->msix_capable) {
 		ret = pci_epc_set_msix(epc, epf->func_no, epf->vfunc_no,
 				       epf->msix_interrupts,
 				       epf_test->test_reg_bar,
--- linux-qcom-6.8.0.orig/drivers/pci/endpoint/functions/pci-epf-vntb.c
+++ linux-qcom-6.8.0/drivers/pci/endpoint/functions/pci-epf-vntb.c
@@ -810,8 +810,9 @@
  */
 static void epf_ntb_epc_cleanup(struct epf_ntb *ntb)
 {
-	epf_ntb_db_bar_clear(ntb);
 	epf_ntb_mw_bar_clear(ntb, ntb->num_mws);
+	epf_ntb_db_bar_clear(ntb);
+	epf_ntb_config_sspad_bar_clear(ntb);
 }
 
 #define EPF_NTB_R(_name)						\
@@ -1029,8 +1030,10 @@
 	struct epf_ntb *ndev = sysdata;
 
 	vpci_bus = pci_scan_bus(ndev->vbus_number, &vpci_ops, sysdata);
-	if (vpci_bus)
-		pr_err("create pci bus\n");
+	if (!vpci_bus) {
+		pr_err("create pci bus failed\n");
+		return -EINVAL;
+	}
 
 	pci_bus_add_devices(vpci_bus);
 
@@ -1275,15 +1278,11 @@
 	ret = ntb_register_device(&ndev->ntb);
 	if (ret) {
 		dev_err(dev, "Failed to register NTB device\n");
-		goto err_register_dev;
+		return ret;
 	}
 
 	dev_dbg(dev, "PCI Virtual NTB driver loaded\n");
 	return 0;
-
-err_register_dev:
-	put_device(&ndev->ntb.dev);
-	return -EINVAL;
 }
 
 static struct pci_device_id pci_vntb_table[] = {
@@ -1350,13 +1349,19 @@
 	ret = pci_register_driver(&vntb_pci_driver);
 	if (ret) {
 		dev_err(dev, "failure register vntb pci driver\n");
-		goto err_bar_alloc;
+		goto err_epc_cleanup;
 	}
 
-	vpci_scan_bus(ntb);
+	ret = vpci_scan_bus(ntb);
+	if (ret)
+		goto err_unregister;
 
 	return 0;
 
+err_unregister:
+	pci_unregister_driver(&vntb_pci_driver);
+err_epc_cleanup:
+	epf_ntb_epc_cleanup(ntb);
 err_bar_alloc:
 	epf_ntb_config_spad_bar_free(ntb);
 
--- linux-qcom-6.8.0.orig/drivers/pci/endpoint/pci-epc-core.c
+++ linux-qcom-6.8.0/drivers/pci/endpoint/pci-epc-core.c
@@ -663,18 +663,18 @@
 	if (IS_ERR_OR_NULL(epc) || !epf)
 		return;
 
+	mutex_lock(&epc->list_lock);
 	if (type == PRIMARY_INTERFACE) {
 		func_no = epf->func_no;
 		list = &epf->list;
+		epf->epc = NULL;
 	} else {
 		func_no = epf->sec_epc_func_no;
 		list = &epf->sec_epc_list;
+		epf->sec_epc = NULL;
 	}
-
-	mutex_lock(&epc->list_lock);
 	clear_bit(func_no, &epc->function_num_map);
 	list_del(list);
-	epf->epc = NULL;
 	mutex_unlock(&epc->list_lock);
 }
 EXPORT_SYMBOL_GPL(pci_epc_remove_epf);
@@ -792,6 +792,9 @@
 void pci_epc_destroy(struct pci_epc *epc)
 {
 	pci_ep_cfs_remove_epc_group(epc->group);
+#ifdef CONFIG_PCI_DOMAINS_GENERIC
+	pci_bus_release_domain_nr(epc->dev.parent, epc->domain_nr);
+#endif
 	device_unregister(&epc->dev);
 }
 EXPORT_SYMBOL_GPL(pci_epc_destroy);
@@ -855,6 +858,16 @@
 	epc->dev.release = pci_epc_release;
 	epc->ops = ops;
 
+#ifdef CONFIG_PCI_DOMAINS_GENERIC
+	epc->domain_nr = pci_bus_find_domain_nr(NULL, dev);
+#else
+	/*
+	 * TODO: If the architecture doesn't support generic PCI
+	 * domains, then a custom implementation has to be used.
+	 */
+	WARN_ONCE(1, "This architecture doesn't support generic PCI domains\n");
+#endif
+
 	ret = dev_set_name(&epc->dev, "%s", dev_name(dev));
 	if (ret)
 		goto put_dev;
--- linux-qcom-6.8.0.orig/drivers/pci/hotplug/cpqphp_pci.c
+++ linux-qcom-6.8.0/drivers/pci/hotplug/cpqphp_pci.c
@@ -135,11 +135,13 @@
 static int PCI_RefinedAccessConfig(struct pci_bus *bus, unsigned int devfn, u8 offset, u32 *value)
 {
 	u32 vendID = 0;
+	int ret;
 
-	if (pci_bus_read_config_dword(bus, devfn, PCI_VENDOR_ID, &vendID) == -1)
-		return -1;
-	if (vendID == 0xffffffff)
-		return -1;
+	ret = pci_bus_read_config_dword(bus, devfn, PCI_VENDOR_ID, &vendID);
+	if (ret != PCIBIOS_SUCCESSFUL)
+		return PCIBIOS_DEVICE_NOT_FOUND;
+	if (PCI_POSSIBLE_ERROR(vendID))
+		return PCIBIOS_DEVICE_NOT_FOUND;
 	return pci_bus_read_config_dword(bus, devfn, offset, value);
 }
 
@@ -202,13 +204,15 @@
 {
 	u16 tdevice;
 	u32 work;
+	int ret;
 	u8 tbus;
 
 	ctrl->pci_bus->number = bus_num;
 
 	for (tdevice = 0; tdevice < 0xFF; tdevice++) {
 		/* Scan for access first */
-		if (PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work) == -1)
+		ret = PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work);
+		if (ret)
 			continue;
 		dbg("Looking for nonbridge bus_num %d dev_num %d\n", bus_num, tdevice);
 		/* Yep we got one. Not a bridge ? */
@@ -220,7 +224,8 @@
 	}
 	for (tdevice = 0; tdevice < 0xFF; tdevice++) {
 		/* Scan for access first */
-		if (PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work) == -1)
+		ret = PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work);
+		if (ret)
 			continue;
 		dbg("Looking for bridge bus_num %d dev_num %d\n", bus_num, tdevice);
 		/* Yep we got one. bridge ? */
@@ -253,7 +258,7 @@
 			*dev_num = tdevice;
 			ctrl->pci_bus->number = tbus;
 			pci_bus_read_config_dword(ctrl->pci_bus, *dev_num, PCI_VENDOR_ID, &work);
-			if (!nobridge || (work == 0xffffffff))
+			if (!nobridge || PCI_POSSIBLE_ERROR(work))
 				return 0;
 
 			dbg("bus_num %d devfn %d\n", *bus_num, *dev_num);
--- linux-qcom-6.8.0.orig/drivers/pci/hotplug/pciehp_hpc.c
+++ linux-qcom-6.8.0/drivers/pci/hotplug/pciehp_hpc.c
@@ -485,7 +485,9 @@
 	struct pci_dev *pdev = ctrl_dev(ctrl);
 
 	pci_config_pm_runtime_get(pdev);
-	pcie_write_cmd_nowait(ctrl, FIELD_PREP(PCI_EXP_SLTCTL_AIC, status),
+
+	/* Attention and Power Indicator Control bits are supported */
+	pcie_write_cmd_nowait(ctrl, FIELD_PREP(PCI_EXP_SLTCTL_AIC | PCI_EXP_SLTCTL_PIC, status),
 			      PCI_EXP_SLTCTL_AIC | PCI_EXP_SLTCTL_PIC);
 	pci_config_pm_runtime_put(pdev);
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/pci/hotplug/pnv_php.c
+++ linux-qcom-6.8.0/drivers/pci/hotplug/pnv_php.c
@@ -40,7 +40,6 @@
 				bool disable_device)
 {
 	struct pci_dev *pdev = php_slot->pdev;
-	int irq = php_slot->irq;
 	u16 ctrl;
 
 	if (php_slot->irq > 0) {
@@ -59,7 +58,7 @@
 		php_slot->wq = NULL;
 	}
 
-	if (disable_device || irq > 0) {
+	if (disable_device) {
 		if (pdev->msix_enabled)
 			pci_disable_msix(pdev);
 		else if (pdev->msi_enabled)
--- linux-qcom-6.8.0.orig/drivers/pci/iov.c
+++ linux-qcom-6.8.0/drivers/pci/iov.c
@@ -747,6 +747,7 @@
 	struct resource *res;
 	const char *res_name;
 	struct pci_dev *pdev;
+	u32 sriovbars[PCI_SRIOV_NUM_BARS];
 
 	pci_read_config_word(dev, pos + PCI_SRIOV_CTRL, &ctrl);
 	if (ctrl & PCI_SRIOV_CTRL_VFE) {
@@ -783,6 +784,10 @@
 	if (!iov)
 		return -ENOMEM;
 
+	/* Sizing SR-IOV BARs with VF Enable cleared - no decode */
+	__pci_size_stdbars(dev, PCI_SRIOV_NUM_BARS,
+			   pos + PCI_SRIOV_BAR, sriovbars);
+
 	nres = 0;
 	for (i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
 		res = &dev->resource[i + PCI_IOV_RESOURCES];
@@ -796,7 +801,8 @@
 			bar64 = (res->flags & IORESOURCE_MEM_64) ? 1 : 0;
 		else
 			bar64 = __pci_read_base(dev, pci_bar_unknown, res,
-						pos + PCI_SRIOV_BAR + i * 4);
+						pos + PCI_SRIOV_BAR + i * 4,
+						&sriovbars[i]);
 		if (!res->flags)
 			continue;
 		if (resource_size(res) & (PAGE_SIZE - 1)) {
--- linux-qcom-6.8.0.orig/drivers/pci/msi/irqdomain.c
+++ linux-qcom-6.8.0/drivers/pci/msi/irqdomain.c
@@ -330,8 +330,11 @@
 
 	domain = dev_get_msi_domain(&pdev->dev);
 
-	if (!domain || !irq_domain_is_hierarchy(domain))
-		return mode == ALLOW_LEGACY;
+	if (!domain || !irq_domain_is_hierarchy(domain)) {
+		if (IS_ENABLED(CONFIG_PCI_MSI_ARCH_FALLBACKS))
+			return mode == ALLOW_LEGACY;
+		return false;
+	}
 
 	if (!irq_domain_is_msi_parent(domain)) {
 		/*
--- linux-qcom-6.8.0.orig/drivers/pci/msi/msi.c
+++ linux-qcom-6.8.0/drivers/pci/msi/msi.c
@@ -349,7 +349,7 @@
 			       struct irq_affinity *affd)
 {
 	struct irq_affinity_desc *masks = NULL;
-	struct msi_desc *entry;
+	struct msi_desc *entry, desc;
 	int ret;
 
 	/* Reject multi-MSI early on irq domain enabled architectures */
@@ -374,6 +374,12 @@
 	/* All MSIs are unmasked by default; mask them all */
 	entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);
 	pci_msi_mask(entry, msi_multi_mask(entry));
+	/*
+	 * Copy the MSI descriptor for the error path because
+	 * pci_msi_setup_msi_irqs() will free it for the hierarchical
+	 * interrupt domain case.
+	 */
+	memcpy(&desc, entry, sizeof(desc));
 
 	/* Configure MSI capability structure */
 	ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI);
@@ -393,7 +399,7 @@
 	goto unlock;
 
 err:
-	pci_msi_unmask(entry, msi_multi_mask(entry));
+	pci_msi_unmask(&desc, msi_multi_mask(&desc));
 	pci_free_msi_irqs(dev);
 fail:
 	dev->msi_enabled = 0;
@@ -424,6 +430,10 @@
 	if (WARN_ON_ONCE(dev->msi_enabled))
 		return -EINVAL;
 
+	/* Test for the availability of MSI support */
+	if (!pci_msi_domain_supports(dev, 0, ALLOW_LEGACY))
+		return -ENOTSUPP;
+
 	nvec = pci_msi_vec_count(dev);
 	if (nvec < 0)
 		return nvec;
@@ -724,6 +734,9 @@
 		goto out_disable;
 	}
 
+	/* Ensure that all table entries are masked.  */
+	msix_mask_all(dev->msix_base, tsize);
+
 	ret = msix_setup_interrupts(dev, entries, nvec, affd);
 	if (ret)
 		goto out_disable;
@@ -731,15 +744,6 @@
 	/* Disable INTX */
 	pci_intx_for_msi(dev, 0);
 
-	/*
-	 * Ensure that all table entries are masked to prevent
-	 * stale entries from firing in a crash kernel.
-	 *
-	 * Done late to deal with a broken Marvell NVME device
-	 * which takes the MSI-X mask bits into account even
-	 * when MSI-X is disabled, which prevents MSI delivery.
-	 */
-	msix_mask_all(dev->msix_base, tsize);
 	pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL, 0);
 
 	pcibios_free_irq(dev);
--- linux-qcom-6.8.0.orig/drivers/pci/of.c
+++ linux-qcom-6.8.0/drivers/pci/of.c
@@ -6,6 +6,7 @@
  */
 #define pr_fmt(fmt)	"PCI: OF: " fmt
 
+#include <linux/cleanup.h>
 #include <linux/irqdomain.h>
 #include <linux/kernel.h>
 #include <linux/pci.h>
@@ -13,6 +14,7 @@
 #include <linux/of_irq.h>
 #include <linux/of_address.h>
 #include <linux/of_pci.h>
+#include <linux/platform_device.h>
 #include "pci.h"
 
 #ifdef CONFIG_PCI
@@ -25,16 +27,20 @@
  */
 int pci_set_of_node(struct pci_dev *dev)
 {
-	struct device_node *node;
-
 	if (!dev->bus->dev.of_node)
 		return 0;
 
-	node = of_pci_find_child_device(dev->bus->dev.of_node, dev->devfn);
+	struct device_node *node __free(device_node) =
+		of_pci_find_child_device(dev->bus->dev.of_node, dev->devfn);
 	if (!node)
 		return 0;
 
-	device_set_node(&dev->dev, of_fwnode_handle(node));
+	struct device *pdev __free(put_device) =
+		bus_find_device_by_of_node(&platform_bus_type, node);
+	if (pdev)
+		dev->bus->dev.of_node_reused = true;
+
+	device_set_node(&dev->dev, of_fwnode_handle(no_free_ptr(node)));
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/pci/of_property.c
+++ linux-qcom-6.8.0/drivers/pci/of_property.c
@@ -126,7 +126,7 @@
 		if (of_pci_get_addr_flags(&res[j], &flags))
 			continue;
 
-		val64 = res[j].start;
+		val64 = pci_bus_address(pdev, &res[j] - pdev->resource);
 		of_pci_set_address(pdev, rp[i].parent_addr, val64, 0, flags,
 				   false);
 		if (pci_is_bridge(pdev)) {
@@ -238,6 +238,8 @@
 		return 0;
 
 	int_map = kcalloc(map_sz, sizeof(u32), GFP_KERNEL);
+	if (!int_map)
+		return -ENOMEM;
 	mapp = int_map;
 
 	list_for_each_entry(child, &pdev->subordinate->devices, bus_list) {
--- linux-qcom-6.8.0.orig/drivers/pci/p2pdma.c
+++ linux-qcom-6.8.0/drivers/pci/p2pdma.c
@@ -661,7 +661,7 @@
 	p2pdma = rcu_dereference(provider->p2pdma);
 	if (p2pdma)
 		xa_store(&p2pdma->map_types, map_types_idx(client),
-			 xa_mk_value(map_type), GFP_KERNEL);
+			 xa_mk_value(map_type), GFP_ATOMIC);
 	rcu_read_unlock();
 	return map_type;
 }
--- linux-qcom-6.8.0.orig/drivers/pci/pci-driver.c
+++ linux-qcom-6.8.0/drivers/pci/pci-driver.c
@@ -473,6 +473,13 @@
 
 	if (drv->remove) {
 		pm_runtime_get_sync(dev);
+		/*
+		 * If the driver provides a .runtime_idle() callback and it has
+		 * started to run already, it may continue to run in parallel
+		 * with the code below, so wait until all of the runtime PM
+		 * activity has completed.
+		 */
+		pm_runtime_barrier(dev);
 		drv->remove(pci_dev);
 		pm_runtime_put_noidle(dev);
 	}
--- linux-qcom-6.8.0.orig/drivers/pci/pci-sysfs.c
+++ linux-qcom-6.8.0/drivers/pci/pci-sysfs.c
@@ -517,6 +517,31 @@
 static struct device_attribute dev_attr_bus_rescan = __ATTR(rescan, 0200, NULL,
 							    bus_rescan_store);
 
+static ssize_t reset_subordinate_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct pci_dev *pdev = to_pci_dev(dev);
+	struct pci_bus *bus = pdev->subordinate;
+	unsigned long val;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
+	if (kstrtoul(buf, 0, &val) < 0)
+		return -EINVAL;
+
+	if (val) {
+		int ret = __pci_reset_bus(bus);
+
+		if (ret)
+			return ret;
+	}
+
+	return count;
+}
+static DEVICE_ATTR_WO(reset_subordinate);
+
 #if defined(CONFIG_PM) && defined(CONFIG_ACPI)
 static ssize_t d3cold_allowed_store(struct device *dev,
 				    struct device_attribute *attr,
@@ -621,6 +646,7 @@
 static struct attribute *pci_bridge_attrs[] = {
 	&dev_attr_subordinate_bus_number.attr,
 	&dev_attr_secondary_bus_number.attr,
+	&dev_attr_reset_subordinate.attr,
 	NULL,
 };
 
--- linux-qcom-6.8.0.orig/drivers/pci/pci.c
+++ linux-qcom-6.8.0/drivers/pci/pci.c
@@ -1227,7 +1227,9 @@
 {
 	int delay = 1;
 	bool retrain = false;
-	struct pci_dev *bridge;
+	struct pci_dev *root, *bridge;
+
+	root = pcie_find_root_port(dev);
 
 	if (pci_is_pcie(dev)) {
 		bridge = pci_upstream_bridge(dev);
@@ -1236,23 +1238,41 @@
 	}
 
 	/*
-	 * After reset, the device should not silently discard config
-	 * requests, but it may still indicate that it needs more time by
-	 * responding to them with CRS completions.  The Root Port will
-	 * generally synthesize ~0 (PCI_ERROR_RESPONSE) data to complete
-	 * the read (except when CRS SV is enabled and the read was for the
-	 * Vendor ID; in that case it synthesizes 0x0001 data).
+	 * The caller has already waited long enough after a reset that the
+	 * device should respond to config requests, but it may respond
+	 * with Request Retry Status (RRS) if it needs more time to
+	 * initialize.
+	 *
+	 * If the device is below a Root Port with Configuration RRS
+	 * Software Visibility enabled, reading the Vendor ID returns a
+	 * special data value if the device responded with RRS.  Read the
+	 * Vendor ID until we get non-RRS status.
 	 *
-	 * Wait for the device to return a non-CRS completion.  Read the
-	 * Command register instead of Vendor ID so we don't have to
-	 * contend with the CRS SV value.
+	 * If there's no Root Port or Configuration RRS Software Visibility
+	 * is not enabled, the device may still respond with RRS, but
+	 * hardware may retry the config request.  If no retries receive
+	 * Successful Completion, hardware generally synthesizes ~0
+	 * (PCI_ERROR_RESPONSE) data to complete the read.  Reading Vendor
+	 * ID for VFs and non-existent devices also returns ~0, so read the
+	 * Command register until it returns something other than ~0.
 	 */
 	for (;;) {
 		u32 id;
 
-		pci_read_config_dword(dev, PCI_COMMAND, &id);
-		if (!PCI_POSSIBLE_ERROR(id))
-			break;
+		if (pci_dev_is_disconnected(dev)) {
+			pci_dbg(dev, "disconnected; not waiting\n");
+			return -ENOTTY;
+		}
+
+		if (root && root->config_crs_sv) {
+			pci_read_config_dword(dev, PCI_VENDOR_ID, &id);
+			if (!pci_bus_crs_vendor_id(id))
+				break;
+		} else {
+			pci_read_config_dword(dev, PCI_COMMAND, &id);
+			if (!PCI_POSSIBLE_ERROR(id))
+				break;
+		}
 
 		if (delay > timeout) {
 			pci_warn(dev, "not ready %dms after %s; giving up\n",
@@ -1263,7 +1283,7 @@
 		if (delay > PCI_RESET_WAIT) {
 			if (retrain) {
 				retrain = false;
-				if (pcie_failed_link_retrain(bridge)) {
+				if (pcie_failed_link_retrain(bridge) == 0) {
 					delay = 1;
 					continue;
 				}
@@ -1649,25 +1669,10 @@
 	pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &cap[i++]);
 	pcie_capability_read_word(dev, PCI_EXP_SLTCTL2, &cap[i++]);
 
-	return 0;
-}
-
-void pci_bridge_reconfigure_ltr(struct pci_dev *dev)
-{
-#ifdef CONFIG_PCIEASPM
-	struct pci_dev *bridge;
-	u32 ctl;
+	pci_save_aspm_l1ss_state(dev);
+	pci_save_ltr_state(dev);
 
-	bridge = pci_upstream_bridge(dev);
-	if (bridge && bridge->ltr_path) {
-		pcie_capability_read_dword(bridge, PCI_EXP_DEVCTL2, &ctl);
-		if (!(ctl & PCI_EXP_DEVCTL2_LTR_EN)) {
-			pci_dbg(bridge, "re-enabling LTR\n");
-			pcie_capability_set_word(bridge, PCI_EXP_DEVCTL2,
-						 PCI_EXP_DEVCTL2_LTR_EN);
-		}
-	}
-#endif
+	return 0;
 }
 
 static void pci_restore_pcie_state(struct pci_dev *dev)
@@ -1676,6 +1681,13 @@
 	struct pci_cap_saved_state *save_state;
 	u16 *cap;
 
+	/*
+	 * Restore max latencies (in the LTR capability) before enabling
+	 * LTR itself in PCI_EXP_DEVCTL2.
+	 */
+	pci_restore_ltr_state(dev);
+	pci_restore_aspm_l1ss_state(dev);
+
 	save_state = pci_find_saved_cap(dev, PCI_CAP_ID_EXP);
 	if (!save_state)
 		return;
@@ -1733,46 +1745,6 @@
 	pci_write_config_word(dev, pos + PCI_X_CMD, cap[i++]);
 }
 
-static void pci_save_ltr_state(struct pci_dev *dev)
-{
-	int ltr;
-	struct pci_cap_saved_state *save_state;
-	u32 *cap;
-
-	if (!pci_is_pcie(dev))
-		return;
-
-	ltr = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_LTR);
-	if (!ltr)
-		return;
-
-	save_state = pci_find_saved_ext_cap(dev, PCI_EXT_CAP_ID_LTR);
-	if (!save_state) {
-		pci_err(dev, "no suspend buffer for LTR; ASPM issues possible after resume\n");
-		return;
-	}
-
-	/* Some broken devices only support dword access to LTR */
-	cap = &save_state->cap.data[0];
-	pci_read_config_dword(dev, ltr + PCI_LTR_MAX_SNOOP_LAT, cap);
-}
-
-static void pci_restore_ltr_state(struct pci_dev *dev)
-{
-	struct pci_cap_saved_state *save_state;
-	int ltr;
-	u32 *cap;
-
-	save_state = pci_find_saved_ext_cap(dev, PCI_EXT_CAP_ID_LTR);
-	ltr = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_LTR);
-	if (!save_state || !ltr)
-		return;
-
-	/* Some broken devices only support dword access to LTR */
-	cap = &save_state->cap.data[0];
-	pci_write_config_dword(dev, ltr + PCI_LTR_MAX_SNOOP_LAT, *cap);
-}
-
 /**
  * pci_save_state - save the PCI configuration space of a device before
  *		    suspending
@@ -1797,7 +1769,6 @@
 	if (i != 0)
 		return i;
 
-	pci_save_ltr_state(dev);
 	pci_save_dpc_state(dev);
 	pci_save_aer_state(dev);
 	pci_save_ptm_state(dev);
@@ -1898,12 +1869,6 @@
 	if (!dev->state_saved)
 		return;
 
-	/*
-	 * Restore max latencies (in the LTR capability) before enabling
-	 * LTR itself (in the PCIe capability).
-	 */
-	pci_restore_ltr_state(dev);
-
 	pci_restore_pcie_state(dev);
 	pci_restore_pasid_state(dev);
 	pci_restore_pri_state(dev);
@@ -2532,7 +2497,7 @@
 			 * course of the call.
 			 */
 			if (bdev) {
-				bref = pm_runtime_get_if_active(bdev, true);
+				bref = pm_runtime_get_if_active(bdev);
 				if (!bref)
 					continue;
 
@@ -3102,6 +3067,18 @@
 			DMI_MATCH(DMI_BOARD_VERSION, "Continental Z2"),
 		},
 	},
+	{
+		/*
+		 * Changing power state of root port dGPU is connected fails
+		 * https://gitlab.freedesktop.org/drm/amd/-/issues/3229
+		 */
+		.ident = "Hewlett-Packard HP Pavilion 17 Notebook PC/1972",
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
+			DMI_MATCH(DMI_BOARD_NAME, "1972"),
+			DMI_MATCH(DMI_BOARD_VERSION, "95.33"),
+		},
+	},
 #endif
 	{ }
 };
@@ -5049,7 +5026,7 @@
 	 * avoid LTSSM race as recommended in Implementation Note at the
 	 * end of PCIe r6.0.1 sec 7.5.3.7.
 	 */
-	rc = pcie_wait_for_link_status(pdev, use_lt, !use_lt);
+	rc = pcie_wait_for_link_status(pdev, true, false);
 	if (rc)
 		return rc;
 
@@ -5063,7 +5040,15 @@
 		pcie_capability_clear_word(pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_RL);
 	}
 
-	return pcie_wait_for_link_status(pdev, use_lt, !use_lt);
+	rc = pcie_wait_for_link_status(pdev, use_lt, !use_lt);
+
+	/*
+	 * Clear LBMS after a manual retrain so that the bit can be used
+	 * to track link speed or width changes made by hardware itself
+	 * in attempt to correct unreliable link operation.
+	 */
+	pcie_capability_write_word(pdev, PCI_EXP_LNKSTA, PCI_EXP_LNKSTA_LBMS);
+	return rc;
 }
 
 /**
@@ -5169,7 +5154,7 @@
  */
 int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type)
 {
-	struct pci_dev *child;
+	struct pci_dev *child __free(pci_dev_put) = NULL;
 	int delay;
 
 	if (pci_dev_is_disconnected(dev))
@@ -5198,8 +5183,8 @@
 		return 0;
 	}
 
-	child = list_first_entry(&dev->subordinate->devices, struct pci_dev,
-				 bus_list);
+	child = pci_dev_get(list_first_entry(&dev->subordinate->devices,
+					     struct pci_dev, bus_list));
 	up_read(&pci_bus_sem);
 
 	/*
@@ -5482,7 +5467,7 @@
 				  const char *buf, size_t count)
 {
 	struct pci_dev *pdev = to_pci_dev(dev);
-	char *options, *name;
+	char *options, *tmp_options, *name;
 	int m, n;
 	u8 reset_methods[PCI_NUM_RESET_METHODS] = { 0 };
 
@@ -5502,7 +5487,8 @@
 		return -ENOMEM;
 
 	n = 0;
-	while ((name = strsep(&options, " ")) != NULL) {
+	tmp_options = options;
+	while ((name = strsep(&tmp_options, " ")) != NULL) {
 		if (sysfs_streq(name, ""))
 			continue;
 
@@ -5764,10 +5750,12 @@
 {
 	struct pci_dev *dev;
 
+	pci_dev_lock(bus->self);
 	list_for_each_entry(dev, &bus->devices, bus_list) {
-		pci_dev_lock(dev);
 		if (dev->subordinate)
 			pci_bus_lock(dev->subordinate);
+		else
+			pci_dev_lock(dev);
 	}
 }
 
@@ -5779,8 +5767,10 @@
 	list_for_each_entry(dev, &bus->devices, bus_list) {
 		if (dev->subordinate)
 			pci_bus_unlock(dev->subordinate);
-		pci_dev_unlock(dev);
+		else
+			pci_dev_unlock(dev);
 	}
+	pci_dev_unlock(bus->self);
 }
 
 /* Return 1 on successful lock, 0 on contention */
@@ -5788,15 +5778,15 @@
 {
 	struct pci_dev *dev;
 
+	if (!pci_dev_trylock(bus->self))
+		return 0;
+
 	list_for_each_entry(dev, &bus->devices, bus_list) {
-		if (!pci_dev_trylock(dev))
-			goto unlock;
 		if (dev->subordinate) {
-			if (!pci_bus_trylock(dev->subordinate)) {
-				pci_dev_unlock(dev);
+			if (!pci_bus_trylock(dev->subordinate))
 				goto unlock;
-			}
-		}
+		} else if (!pci_dev_trylock(dev))
+			goto unlock;
 	}
 	return 1;
 
@@ -5804,8 +5794,10 @@
 	list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) {
 		if (dev->subordinate)
 			pci_bus_unlock(dev->subordinate);
-		pci_dev_unlock(dev);
+		else
+			pci_dev_unlock(dev);
 	}
+	pci_dev_unlock(bus->self);
 	return 0;
 }
 
@@ -5837,9 +5829,10 @@
 	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
 		if (!dev->slot || dev->slot != slot)
 			continue;
-		pci_dev_lock(dev);
 		if (dev->subordinate)
 			pci_bus_lock(dev->subordinate);
+		else
+			pci_dev_lock(dev);
 	}
 }
 
@@ -5865,14 +5858,13 @@
 	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
 		if (!dev->slot || dev->slot != slot)
 			continue;
-		if (!pci_dev_trylock(dev))
-			goto unlock;
 		if (dev->subordinate) {
 			if (!pci_bus_trylock(dev->subordinate)) {
 				pci_dev_unlock(dev);
 				goto unlock;
 			}
-		}
+		} else if (!pci_dev_trylock(dev))
+			goto unlock;
 	}
 	return 1;
 
@@ -5883,7 +5875,8 @@
 			continue;
 		if (dev->subordinate)
 			pci_bus_unlock(dev->subordinate);
-		pci_dev_unlock(dev);
+		else
+			pci_dev_unlock(dev);
 	}
 	return 0;
 }
@@ -5914,8 +5907,10 @@
 
 	list_for_each_entry(dev, &bus->devices, bus_list) {
 		pci_dev_restore(dev);
-		if (dev->subordinate)
+		if (dev->subordinate) {
+			pci_bridge_wait_for_secondary_bus(dev, "bus reset");
 			pci_bus_restore_locked(dev->subordinate);
+		}
 	}
 }
 
@@ -5949,8 +5944,10 @@
 		if (!dev->slot || dev->slot != slot)
 			continue;
 		pci_dev_restore(dev);
-		if (dev->subordinate)
+		if (dev->subordinate) {
+			pci_bridge_wait_for_secondary_bus(dev, "slot reset");
 			pci_bus_restore_locked(dev->subordinate);
+		}
 	}
 }
 
@@ -6095,7 +6092,7 @@
  *
  * Same as above except return -EAGAIN if the bus cannot be locked
  */
-static int __pci_reset_bus(struct pci_bus *bus)
+int __pci_reset_bus(struct pci_bus *bus)
 {
 	int rc;
 
@@ -7060,16 +7057,16 @@
 	return ida_alloc(&pci_domain_nr_dynamic_ida, GFP_KERNEL);
 }
 
-static void of_pci_bus_release_domain_nr(struct pci_bus *bus, struct device *parent)
+static void of_pci_bus_release_domain_nr(struct device *parent, int domain_nr)
 {
-	if (bus->domain_nr < 0)
+	if (domain_nr < 0)
 		return;
 
 	/* Release domain from IDA where it was allocated. */
-	if (of_get_pci_domain_nr(parent->of_node) == bus->domain_nr)
-		ida_free(&pci_domain_nr_static_ida, bus->domain_nr);
+	if (of_get_pci_domain_nr(parent->of_node) == domain_nr)
+		ida_free(&pci_domain_nr_static_ida, domain_nr);
 	else
-		ida_free(&pci_domain_nr_dynamic_ida, bus->domain_nr);
+		ida_free(&pci_domain_nr_dynamic_ida, domain_nr);
 }
 
 int pci_bus_find_domain_nr(struct pci_bus *bus, struct device *parent)
@@ -7078,11 +7075,11 @@
 			       acpi_pci_bus_find_domain_nr(bus);
 }
 
-void pci_bus_release_domain_nr(struct pci_bus *bus, struct device *parent)
+void pci_bus_release_domain_nr(struct device *parent, int domain_nr)
 {
 	if (!acpi_disabled)
 		return;
-	of_pci_bus_release_domain_nr(bus, parent);
+	of_pci_bus_release_domain_nr(parent, domain_nr);
 }
 #endif
 
--- linux-qcom-6.8.0.orig/drivers/pci/pci.h
+++ linux-qcom-6.8.0/drivers/pci/pci.h
@@ -49,6 +49,7 @@
 void pci_init_reset_methods(struct pci_dev *dev);
 int pci_bridge_secondary_bus_reset(struct pci_dev *dev);
 int pci_bus_error_reset(struct pci_dev *dev);
+int __pci_reset_bus(struct pci_bus *bus);
 
 struct pci_cap_saved_data {
 	u16		cap_nr;
@@ -97,9 +98,13 @@
 void pci_msix_init(struct pci_dev *dev);
 bool pci_bridge_d3_possible(struct pci_dev *dev);
 void pci_bridge_d3_update(struct pci_dev *dev);
-void pci_bridge_reconfigure_ltr(struct pci_dev *dev);
 int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type);
 
+static inline bool pci_bus_crs_vendor_id(u32 l)
+{
+	return (l & 0xffff) == PCI_VENDOR_ID_PCI_SIG;
+}
+
 static inline void pci_wakeup_event(struct pci_dev *dev)
 {
 	/* Wait 100 ms before the system can be put into a sleep state. */
@@ -245,8 +250,10 @@
 int pci_idt_bus_quirk(struct pci_bus *bus, int devfn, u32 *pl, int crs_timeout);
 
 int pci_setup_device(struct pci_dev *dev);
+void __pci_size_stdbars(struct pci_dev *dev, int count,
+			unsigned int pos, u32 *sizes);
 int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
-		    struct resource *res, unsigned int reg);
+		    struct resource *res, unsigned int reg, u32 *sizes);
 void pci_configure_ari(struct pci_dev *dev);
 void __pci_bus_size_bridges(struct pci_bus *bus,
 			struct list_head *realloc_head);
@@ -368,11 +375,6 @@
 	return 0;
 }
 
-static inline bool pci_dev_is_disconnected(const struct pci_dev *dev)
-{
-	return dev->error_state == pci_channel_io_perm_failure;
-}
-
 /* pci_dev priv_flags */
 #define PCI_DEV_ADDED 0
 #define PCI_DPC_RECOVERED 1
@@ -540,7 +542,7 @@
 int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
 int pci_dev_specific_enable_acs(struct pci_dev *dev);
 int pci_dev_specific_disable_acs_redir(struct pci_dev *dev);
-bool pcie_failed_link_retrain(struct pci_dev *dev);
+int pcie_failed_link_retrain(struct pci_dev *dev);
 #else
 static inline int pci_dev_specific_acs_enabled(struct pci_dev *dev,
 					       u16 acs_flags)
@@ -555,9 +557,9 @@
 {
 	return -ENOTTY;
 }
-static inline bool pcie_failed_link_retrain(struct pci_dev *dev)
+static inline int pcie_failed_link_retrain(struct pci_dev *dev)
 {
-	return false;
+	return -ENOTTY;
 }
 #endif
 
@@ -568,16 +570,28 @@
 
 bool pcie_wait_for_link(struct pci_dev *pdev, bool active);
 int pcie_retrain_link(struct pci_dev *pdev, bool use_lt);
+
+/* ASPM-related functionality we need even without CONFIG_PCIEASPM */
+void pci_save_ltr_state(struct pci_dev *dev);
+void pci_restore_ltr_state(struct pci_dev *dev);
+void pci_configure_aspm_l1ss(struct pci_dev *dev);
+void pci_save_aspm_l1ss_state(struct pci_dev *dev);
+void pci_restore_aspm_l1ss_state(struct pci_dev *dev);
+
 #ifdef CONFIG_PCIEASPM
 void pcie_aspm_init_link_state(struct pci_dev *pdev);
 void pcie_aspm_exit_link_state(struct pci_dev *pdev);
 void pcie_aspm_pm_state_change(struct pci_dev *pdev, bool locked);
 void pcie_aspm_powersave_config_link(struct pci_dev *pdev);
+void pci_configure_ltr(struct pci_dev *pdev);
+void pci_bridge_reconfigure_ltr(struct pci_dev *pdev);
 #else
 static inline void pcie_aspm_init_link_state(struct pci_dev *pdev) { }
 static inline void pcie_aspm_exit_link_state(struct pci_dev *pdev) { }
 static inline void pcie_aspm_pm_state_change(struct pci_dev *pdev, bool locked) { }
 static inline void pcie_aspm_powersave_config_link(struct pci_dev *pdev) { }
+static inline void pci_configure_ltr(struct pci_dev *pdev) { }
+static inline void pci_bridge_reconfigure_ltr(struct pci_dev *pdev) { }
 #endif
 
 #ifdef CONFIG_PCIE_ECRC
--- linux-qcom-6.8.0.orig/drivers/pci/pcie/Makefile
+++ linux-qcom-6.8.0/drivers/pci/pcie/Makefile
@@ -6,7 +6,7 @@
 
 obj-$(CONFIG_PCIEPORTBUS)	+= pcieportdrv.o
 
-obj-$(CONFIG_PCIEASPM)		+= aspm.o
+obj-y				+= aspm.o
 obj-$(CONFIG_PCIEAER)		+= aer.o err.o
 obj-$(CONFIG_PCIEAER_INJECT)	+= aer_inject.o
 obj-$(CONFIG_PCIE_PME)		+= pme.o
--- linux-qcom-6.8.0.orig/drivers/pci/pcie/aer.c
+++ linux-qcom-6.8.0/drivers/pci/pcie/aer.c
@@ -1505,6 +1505,22 @@
 	return 0;
 }
 
+static int aer_suspend(struct pcie_device *dev)
+{
+	struct aer_rpc *rpc = get_service_data(dev);
+
+	aer_disable_rootport(rpc);
+	return 0;
+}
+
+static int aer_resume(struct pcie_device *dev)
+{
+	struct aer_rpc *rpc = get_service_data(dev);
+
+	aer_enable_rootport(rpc);
+	return 0;
+}
+
 /**
  * aer_root_reset - reset Root Port hierarchy, RCEC, or RCiEP
  * @dev: pointer to Root Port, RCEC, or RCiEP
@@ -1569,6 +1585,8 @@
 	.service	= PCIE_PORT_SERVICE_AER,
 
 	.probe		= aer_probe,
+	.suspend	= aer_suspend,
+	.resume		= aer_resume,
 	.remove		= aer_remove,
 };
 
--- linux-qcom-6.8.0.orig/drivers/pci/pcie/aspm.c
+++ linux-qcom-6.8.0/drivers/pci/pcie/aspm.c
@@ -24,6 +24,166 @@
 
 #include "../pci.h"
 
+void pci_save_ltr_state(struct pci_dev *dev)
+{
+	int ltr;
+	struct pci_cap_saved_state *save_state;
+	u32 *cap;
+
+	if (!pci_is_pcie(dev))
+		return;
+
+	ltr = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_LTR);
+	if (!ltr)
+		return;
+
+	save_state = pci_find_saved_ext_cap(dev, PCI_EXT_CAP_ID_LTR);
+	if (!save_state) {
+		pci_err(dev, "no suspend buffer for LTR; ASPM issues possible after resume\n");
+		return;
+	}
+
+	/* Some broken devices only support dword access to LTR */
+	cap = &save_state->cap.data[0];
+	pci_read_config_dword(dev, ltr + PCI_LTR_MAX_SNOOP_LAT, cap);
+}
+
+void pci_restore_ltr_state(struct pci_dev *dev)
+{
+	struct pci_cap_saved_state *save_state;
+	int ltr;
+	u32 *cap;
+
+	save_state = pci_find_saved_ext_cap(dev, PCI_EXT_CAP_ID_LTR);
+	ltr = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_LTR);
+	if (!save_state || !ltr)
+		return;
+
+	/* Some broken devices only support dword access to LTR */
+	cap = &save_state->cap.data[0];
+	pci_write_config_dword(dev, ltr + PCI_LTR_MAX_SNOOP_LAT, *cap);
+}
+
+void pci_configure_aspm_l1ss(struct pci_dev *pdev)
+{
+	int rc;
+
+	pdev->l1ss = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_L1SS);
+
+	rc = pci_add_ext_cap_save_buffer(pdev, PCI_EXT_CAP_ID_L1SS,
+					 2 * sizeof(u32));
+	if (rc)
+		pci_err(pdev, "unable to allocate ASPM L1SS save buffer (%pe)\n",
+			ERR_PTR(rc));
+}
+
+void pci_save_aspm_l1ss_state(struct pci_dev *pdev)
+{
+	struct pci_cap_saved_state *save_state;
+	u16 l1ss = pdev->l1ss;
+	u32 *cap;
+
+	/*
+	 * Save L1 substate configuration. The ASPM L0s/L1 configuration
+	 * in PCI_EXP_LNKCTL_ASPMC is saved by pci_save_pcie_state().
+	 */
+	if (!l1ss)
+		return;
+
+	save_state = pci_find_saved_ext_cap(pdev, PCI_EXT_CAP_ID_L1SS);
+	if (!save_state)
+		return;
+
+	cap = &save_state->cap.data[0];
+	pci_read_config_dword(pdev, l1ss + PCI_L1SS_CTL2, cap++);
+	pci_read_config_dword(pdev, l1ss + PCI_L1SS_CTL1, cap++);
+}
+
+void pci_restore_aspm_l1ss_state(struct pci_dev *pdev)
+{
+	struct pci_cap_saved_state *pl_save_state, *cl_save_state;
+	struct pci_dev *parent = pdev->bus->self;
+	u32 *cap, pl_ctl1, pl_ctl2, pl_l1_2_enable;
+	u32 cl_ctl1, cl_ctl2, cl_l1_2_enable;
+	u16 clnkctl, plnkctl;
+
+	/*
+	 * In case BIOS enabled L1.2 when resuming, we need to disable it first
+	 * on the downstream component before the upstream. So, don't attempt to
+	 * restore either until we are at the downstream component.
+	 */
+	if (pcie_downstream_port(pdev) || !parent)
+		return;
+
+	if (!pdev->l1ss || !parent->l1ss)
+		return;
+
+	cl_save_state = pci_find_saved_ext_cap(pdev, PCI_EXT_CAP_ID_L1SS);
+	pl_save_state = pci_find_saved_ext_cap(parent, PCI_EXT_CAP_ID_L1SS);
+	if (!cl_save_state || !pl_save_state)
+		return;
+
+	cap = &cl_save_state->cap.data[0];
+	cl_ctl2 = *cap++;
+	cl_ctl1 = *cap;
+	cap = &pl_save_state->cap.data[0];
+	pl_ctl2 = *cap++;
+	pl_ctl1 = *cap;
+
+	/* Make sure L0s/L1 are disabled before updating L1SS config */
+	pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &clnkctl);
+	pcie_capability_read_word(parent, PCI_EXP_LNKCTL, &plnkctl);
+	if (FIELD_GET(PCI_EXP_LNKCTL_ASPMC, clnkctl) ||
+	    FIELD_GET(PCI_EXP_LNKCTL_ASPMC, plnkctl)) {
+		pcie_capability_write_word(pdev, PCI_EXP_LNKCTL,
+					   clnkctl & ~PCI_EXP_LNKCTL_ASPMC);
+		pcie_capability_write_word(parent, PCI_EXP_LNKCTL,
+					   plnkctl & ~PCI_EXP_LNKCTL_ASPMC);
+	}
+
+	/*
+	 * Disable L1.2 on this downstream endpoint device first, followed
+	 * by the upstream
+	 */
+	pci_clear_and_set_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL1,
+				       PCI_L1SS_CTL1_L1_2_MASK, 0);
+	pci_clear_and_set_config_dword(parent, parent->l1ss + PCI_L1SS_CTL1,
+				       PCI_L1SS_CTL1_L1_2_MASK, 0);
+
+	/*
+	 * In addition, Common_Mode_Restore_Time and LTR_L1.2_THRESHOLD
+	 * in PCI_L1SS_CTL1 must be programmed *before* setting the L1.2
+	 * enable bits, even though they're all in PCI_L1SS_CTL1.
+	 */
+	pl_l1_2_enable = pl_ctl1 & PCI_L1SS_CTL1_L1_2_MASK;
+	pl_ctl1 &= ~PCI_L1SS_CTL1_L1_2_MASK;
+	cl_l1_2_enable = cl_ctl1 & PCI_L1SS_CTL1_L1_2_MASK;
+	cl_ctl1 &= ~PCI_L1SS_CTL1_L1_2_MASK;
+
+	/* Write back without enables first (above we cleared them in ctl1) */
+	pci_write_config_dword(parent, parent->l1ss + PCI_L1SS_CTL2, pl_ctl2);
+	pci_write_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL2, cl_ctl2);
+	pci_write_config_dword(parent, parent->l1ss + PCI_L1SS_CTL1, pl_ctl1);
+	pci_write_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL1, cl_ctl1);
+
+	/* Then write back the enables */
+	if (pl_l1_2_enable || cl_l1_2_enable) {
+		pci_write_config_dword(parent, parent->l1ss + PCI_L1SS_CTL1,
+				       pl_ctl1 | pl_l1_2_enable);
+		pci_write_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL1,
+				       cl_ctl1 | cl_l1_2_enable);
+	}
+
+	/* Restore L0s/L1 if they were enabled */
+	if (FIELD_GET(PCI_EXP_LNKCTL_ASPMC, clnkctl) ||
+	    FIELD_GET(PCI_EXP_LNKCTL_ASPMC, plnkctl)) {
+		pcie_capability_write_word(parent, PCI_EXP_LNKCTL, plnkctl);
+		pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, clnkctl);
+	}
+}
+
+#ifdef CONFIG_PCIEASPM
+
 #ifdef MODULE_PARAM_PREFIX
 #undef MODULE_PARAM_PREFIX
 #endif
@@ -141,16 +301,42 @@
 	return 0;
 }
 
+static void pci_update_aspm_saved_state(struct pci_dev *dev)
+{
+	struct pci_cap_saved_state *save_state;
+	u16 *cap, lnkctl, aspm_ctl;
+
+	save_state = pci_find_saved_cap(dev, PCI_CAP_ID_EXP);
+	if (!save_state)
+		return;
+
+	pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnkctl);
+
+	/*
+	 * Update ASPM and CLKREQ bits of LNKCTL in save_state. We only
+	 * write PCI_EXP_LNKCTL_CCC during enumeration, so it shouldn't
+	 * change after being captured in save_state.
+	 */
+	aspm_ctl = lnkctl & (PCI_EXP_LNKCTL_ASPMC | PCI_EXP_LNKCTL_CLKREQ_EN);
+	lnkctl &= ~(PCI_EXP_LNKCTL_ASPMC | PCI_EXP_LNKCTL_CLKREQ_EN);
+
+	/* Depends on pci_save_pcie_state(): cap[1] is LNKCTL */
+	cap = (u16 *)&save_state->cap.data[0];
+	cap[1] = lnkctl | aspm_ctl;
+}
+
 static void pcie_set_clkpm_nocheck(struct pcie_link_state *link, int enable)
 {
 	struct pci_dev *child;
 	struct pci_bus *linkbus = link->pdev->subordinate;
 	u32 val = enable ? PCI_EXP_LNKCTL_CLKREQ_EN : 0;
 
-	list_for_each_entry(child, &linkbus->devices, bus_list)
+	list_for_each_entry(child, &linkbus->devices, bus_list) {
 		pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL,
 						   PCI_EXP_LNKCTL_CLKREQ_EN,
 						   val);
+		pci_update_aspm_saved_state(child);
+	}
 	link->clkpm_enabled = !!enable;
 }
 
@@ -645,7 +831,8 @@
 	aspm_l1ss_init(link);
 
 	/* Save default state */
-	link->aspm_default = link->aspm_enabled;
+	link->aspm_default = parent->dev_flags & PCI_DEV_FLAGS_ENABLE_ASPM ?
+			     ASPM_STATE_ALL : link->aspm_enabled;
 
 	/* Setup initial capable state. Will be updated later */
 	link->aspm_capable = link->aspm_support;
@@ -769,6 +956,12 @@
 		pcie_config_aspm_dev(parent, upstream);
 
 	link->aspm_enabled = state;
+
+	/* Update latest ASPM configuration in saved context */
+	pci_save_aspm_l1ss_state(link->downstream);
+	pci_update_aspm_saved_state(link->downstream);
+	pci_save_aspm_l1ss_state(parent);
+	pci_update_aspm_saved_state(parent);
 }
 
 static void pcie_config_aspm_path(struct pcie_link_state *link)
@@ -938,6 +1131,78 @@
 	up_read(&pci_bus_sem);
 }
 
+void pci_bridge_reconfigure_ltr(struct pci_dev *pdev)
+{
+	struct pci_dev *bridge;
+	u32 ctl;
+
+	bridge = pci_upstream_bridge(pdev);
+	if (bridge && bridge->ltr_path) {
+		pcie_capability_read_dword(bridge, PCI_EXP_DEVCTL2, &ctl);
+		if (!(ctl & PCI_EXP_DEVCTL2_LTR_EN)) {
+			pci_dbg(bridge, "re-enabling LTR\n");
+			pcie_capability_set_word(bridge, PCI_EXP_DEVCTL2,
+						 PCI_EXP_DEVCTL2_LTR_EN);
+		}
+	}
+}
+
+void pci_configure_ltr(struct pci_dev *pdev)
+{
+	struct pci_host_bridge *host = pci_find_host_bridge(pdev->bus);
+	struct pci_dev *bridge;
+	u32 cap, ctl;
+
+	if (!pci_is_pcie(pdev))
+		return;
+
+	pcie_capability_read_dword(pdev, PCI_EXP_DEVCAP2, &cap);
+	if (!(cap & PCI_EXP_DEVCAP2_LTR))
+		return;
+
+	pcie_capability_read_dword(pdev, PCI_EXP_DEVCTL2, &ctl);
+	if (ctl & PCI_EXP_DEVCTL2_LTR_EN) {
+		if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT) {
+			pdev->ltr_path = 1;
+			return;
+		}
+
+		bridge = pci_upstream_bridge(pdev);
+		if (bridge && bridge->ltr_path)
+			pdev->ltr_path = 1;
+
+		return;
+	}
+
+	if (!host->native_ltr)
+		return;
+
+	/*
+	 * Software must not enable LTR in an Endpoint unless the Root
+	 * Complex and all intermediate Switches indicate support for LTR.
+	 * PCIe r4.0, sec 6.18.
+	 */
+	if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT) {
+		pcie_capability_set_word(pdev, PCI_EXP_DEVCTL2,
+					 PCI_EXP_DEVCTL2_LTR_EN);
+		pdev->ltr_path = 1;
+		return;
+	}
+
+	/*
+	 * If we're configuring a hot-added device, LTR was likely
+	 * disabled in the upstream bridge, so re-enable it before enabling
+	 * it in the new device.
+	 */
+	bridge = pci_upstream_bridge(pdev);
+	if (bridge && bridge->ltr_path) {
+		pci_bridge_reconfigure_ltr(pdev);
+		pcie_capability_set_word(pdev, PCI_EXP_DEVCTL2,
+					 PCI_EXP_DEVCTL2_LTR_EN);
+		pdev->ltr_path = 1;
+	}
+}
+
 /* Recheck latencies and update aspm_capable for links under the root */
 static void pcie_update_aspm_capable(struct pcie_link_state *root)
 {
@@ -1143,8 +1408,12 @@
 	 * the _OSC method), we can't honor that request.
 	 */
 	if (aspm_disabled) {
-		pci_warn(pdev, "can't override BIOS ASPM; OS doesn't have ASPM control\n");
-		return -EPERM;
+		if (aspm_support_enabled && pdev->aspm_os_control)
+			pci_info(pdev, "BIOS can't program ASPM, let OS control it\n");
+		else {
+			pci_warn(pdev, "can't override BIOS ASPM; OS doesn't have ASPM control\n");
+			return -EPERM;
+		}
 	}
 
 	if (!locked)
@@ -1272,6 +1541,17 @@
 }
 EXPORT_SYMBOL_GPL(pcie_aspm_enabled);
 
+bool pcie_aspm_capable(struct pci_dev *pdev)
+{
+	struct pcie_link_state *link = pcie_aspm_get_link(pdev);
+
+	if (!link)
+		return false;
+
+	return link->aspm_capable;
+}
+EXPORT_SYMBOL_GPL(pcie_aspm_capable);
+
 static ssize_t aspm_attr_show_common(struct device *dev,
 				     struct device_attribute *attr,
 				     char *buf, u8 state)
@@ -1447,3 +1727,5 @@
 {
 	return aspm_support_enabled;
 }
+
+#endif /* CONFIG_PCIEASPM */
--- linux-qcom-6.8.0.orig/drivers/pci/pcie/dpc.c
+++ linux-qcom-6.8.0/drivers/pci/pcie/dpc.c
@@ -234,7 +234,7 @@
 
 	for (i = 0; i < pdev->dpc_rp_log_size - 5; i++) {
 		pci_read_config_dword(pdev,
-			cap + PCI_EXP_DPC_RP_PIO_TLPPREFIX_LOG, &prefix);
+			cap + PCI_EXP_DPC_RP_PIO_TLPPREFIX_LOG + i * 4, &prefix);
 		pci_err(pdev, "TLP Prefix Header: dw%d, %#010x\n", i, prefix);
 	}
  clear_status:
@@ -358,13 +358,34 @@
 	}
 }
 
+static void dpc_enable(struct pcie_device *dev)
+{
+	struct pci_dev *pdev = dev->port;
+	u16 ctl;
+
+	pci_read_config_word(pdev, pdev->dpc_cap + PCI_EXP_DPC_CTL, &ctl);
+	ctl &= ~PCI_EXP_DPC_CTL_EN_MASK;
+	ctl |= PCI_EXP_DPC_CTL_EN_FATAL | PCI_EXP_DPC_CTL_INT_EN;
+	pci_write_config_word(pdev, pdev->dpc_cap + PCI_EXP_DPC_CTL, ctl);
+}
+
+static void dpc_disable(struct pcie_device *dev)
+{
+	struct pci_dev *pdev = dev->port;
+	u16 ctl;
+
+	pci_read_config_word(pdev, pdev->dpc_cap + PCI_EXP_DPC_CTL, &ctl);
+	ctl &= ~(PCI_EXP_DPC_CTL_EN_FATAL | PCI_EXP_DPC_CTL_INT_EN);
+	pci_write_config_word(pdev, pdev->dpc_cap + PCI_EXP_DPC_CTL, ctl);
+}
+
 #define FLAG(x, y) (((x) & (y)) ? '+' : '-')
 static int dpc_probe(struct pcie_device *dev)
 {
 	struct pci_dev *pdev = dev->port;
 	struct device *device = &dev->device;
 	int status;
-	u16 ctl, cap;
+	u16 cap;
 
 	if (!pcie_aer_is_native(pdev) && !pcie_ports_dpc_native)
 		return -ENOTSUPP;
@@ -379,13 +400,9 @@
 	}
 
 	pci_read_config_word(pdev, pdev->dpc_cap + PCI_EXP_DPC_CAP, &cap);
-
-	pci_read_config_word(pdev, pdev->dpc_cap + PCI_EXP_DPC_CTL, &ctl);
-	ctl &= ~PCI_EXP_DPC_CTL_EN_MASK;
-	ctl |= PCI_EXP_DPC_CTL_EN_FATAL | PCI_EXP_DPC_CTL_INT_EN;
-	pci_write_config_word(pdev, pdev->dpc_cap + PCI_EXP_DPC_CTL, ctl);
-
+	dpc_enable(dev);
 	pci_info(pdev, "enabled with IRQ %d\n", dev->irq);
+
 	pci_info(pdev, "error containment capabilities: Int Msg #%d, RPExt%c PoisonedTLP%c SwTrigger%c RP PIO Log %d, DL_ActiveErr%c\n",
 		 cap & PCI_EXP_DPC_IRQ, FLAG(cap, PCI_EXP_DPC_CAP_RP_EXT),
 		 FLAG(cap, PCI_EXP_DPC_CAP_POISONED_TLP),
@@ -396,14 +413,21 @@
 	return status;
 }
 
-static void dpc_remove(struct pcie_device *dev)
+static int dpc_suspend(struct pcie_device *dev)
 {
-	struct pci_dev *pdev = dev->port;
-	u16 ctl;
+	dpc_disable(dev);
+	return 0;
+}
 
-	pci_read_config_word(pdev, pdev->dpc_cap + PCI_EXP_DPC_CTL, &ctl);
-	ctl &= ~(PCI_EXP_DPC_CTL_EN_FATAL | PCI_EXP_DPC_CTL_INT_EN);
-	pci_write_config_word(pdev, pdev->dpc_cap + PCI_EXP_DPC_CTL, ctl);
+static int dpc_resume(struct pcie_device *dev)
+{
+	dpc_enable(dev);
+	return 0;
+}
+
+static void dpc_remove(struct pcie_device *dev)
+{
+	dpc_disable(dev);
 }
 
 static struct pcie_port_service_driver dpcdriver = {
@@ -411,6 +435,8 @@
 	.port_type	= PCIE_ANY_PORT,
 	.service	= PCIE_PORT_SERVICE_DPC,
 	.probe		= dpc_probe,
+	.suspend	= dpc_suspend,
+	.resume		= dpc_resume,
 	.remove		= dpc_remove,
 };
 
--- linux-qcom-6.8.0.orig/drivers/pci/pcie/edr.c
+++ linux-qcom-6.8.0/drivers/pci/pcie/edr.c
@@ -32,10 +32,10 @@
 	int status = 0;
 
 	/*
-	 * Behavior when calling unsupported _DSM functions is undefined,
-	 * so check whether EDR_PORT_DPC_ENABLE_DSM is supported.
+	 * Per PCI Firmware r3.3, sec 4.6.12, EDR_PORT_DPC_ENABLE_DSM is
+	 * optional. Return success if it's not implemented.
 	 */
-	if (!acpi_check_dsm(adev->handle, &pci_acpi_dsm_guid, 5,
+	if (!acpi_check_dsm(adev->handle, &pci_acpi_dsm_guid, 6,
 			    1ULL << EDR_PORT_DPC_ENABLE_DSM))
 		return 0;
 
@@ -46,12 +46,7 @@
 	argv4.package.count = 1;
 	argv4.package.elements = &req;
 
-	/*
-	 * Per Downstream Port Containment Related Enhancements ECN to PCI
-	 * Firmware Specification r3.2, sec 4.6.12, EDR_PORT_DPC_ENABLE_DSM is
-	 * optional.  Return success if it's not implemented.
-	 */
-	obj = acpi_evaluate_dsm(adev->handle, &pci_acpi_dsm_guid, 5,
+	obj = acpi_evaluate_dsm(adev->handle, &pci_acpi_dsm_guid, 6,
 				EDR_PORT_DPC_ENABLE_DSM, &argv4);
 	if (!obj)
 		return 0;
@@ -85,8 +80,9 @@
 	u16 port;
 
 	/*
-	 * Behavior when calling unsupported _DSM functions is undefined,
-	 * so check whether EDR_PORT_DPC_ENABLE_DSM is supported.
+	 * If EDR_PORT_LOCATE_DSM is not implemented under the target of
+	 * EDR, the target is the port that experienced the containment
+	 * event (PCI Firmware r3.3, sec 4.6.13).
 	 */
 	if (!acpi_check_dsm(adev->handle, &pci_acpi_dsm_guid, 5,
 			    1ULL << EDR_PORT_LOCATE_DSM))
@@ -103,6 +99,16 @@
 		return NULL;
 	}
 
+	/*
+	 * Bit 31 represents the success/failure of the operation. If bit
+	 * 31 is set, the operation failed.
+	 */
+	if (obj->integer.value & BIT(31)) {
+		ACPI_FREE(obj);
+		pci_err(pdev, "Locate Port _DSM failed\n");
+		return NULL;
+	}
+
 	/*
 	 * Firmware returns DPC port BDF details in following format:
 	 *	15:8 = bus
--- linux-qcom-6.8.0.orig/drivers/pci/pcie/err.c
+++ linux-qcom-6.8.0/drivers/pci/pcie/err.c
@@ -13,6 +13,7 @@
 #define dev_fmt(fmt) "AER: " fmt
 
 #include <linux/pci.h>
+#include <linux/pm_runtime.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
@@ -85,6 +86,18 @@
 	return 0;
 }
 
+static int pci_pm_runtime_get_sync(struct pci_dev *pdev, void *data)
+{
+	pm_runtime_get_sync(&pdev->dev);
+	return 0;
+}
+
+static int pci_pm_runtime_put(struct pci_dev *pdev, void *data)
+{
+	pm_runtime_put(&pdev->dev);
+	return 0;
+}
+
 static int report_frozen_detected(struct pci_dev *dev, void *data)
 {
 	return report_error_detected(dev, pci_channel_io_frozen, data);
@@ -207,6 +220,8 @@
 	else
 		bridge = pci_upstream_bridge(dev);
 
+	pci_walk_bridge(bridge, pci_pm_runtime_get_sync, NULL);
+
 	pci_dbg(bridge, "broadcast error_detected message\n");
 	if (state == pci_channel_io_frozen) {
 		pci_walk_bridge(bridge, report_frozen_detected, &status);
@@ -251,10 +266,15 @@
 		pcie_clear_device_status(dev);
 		pci_aer_clear_nonfatal_status(dev);
 	}
+
+	pci_walk_bridge(bridge, pci_pm_runtime_put, NULL);
+
 	pci_info(bridge, "device recovery successful\n");
 	return status;
 
 failed:
+	pci_walk_bridge(bridge, pci_pm_runtime_put, NULL);
+
 	pci_uevent_ers(bridge, PCI_ERS_RESULT_DISCONNECT);
 
 	/* TODO: Should kernel panic here? */
--- linux-qcom-6.8.0.orig/drivers/pci/probe.c
+++ linux-qcom-6.8.0/drivers/pci/probe.c
@@ -165,40 +165,66 @@
 #define PCI_COMMAND_DECODE_ENABLE	(PCI_COMMAND_MEMORY | PCI_COMMAND_IO)
 
 /**
+ * __pci_size_bars - Read the raw BAR mask for a range of PCI BARs
+ * @dev: the PCI device
+ * @count: number of BARs to size
+ * @pos: starting config space position
+ * @sizes: array to store mask values
+ * @rom: indicate whether to use ROM mask, which avoids enabling ROM BARs
+ *
+ * Provided @sizes array must be sufficiently sized to store results for
+ * @count u32 BARs.  Caller is responsible for disabling decode to specified
+ * BAR range around calling this function.  This function is intended to avoid
+ * disabling decode around sizing each BAR individually, which can result in
+ * non-trivial overhead in virtualized environments with very large PCI BARs.
+ */
+static void __pci_size_bars(struct pci_dev *dev, int count,
+			    unsigned int pos, u32 *sizes, bool rom)
+{
+	u32 orig, mask = rom ? PCI_ROM_ADDRESS_MASK : ~0;
+	int i;
+
+	for (i = 0; i < count; i++, pos += 4, sizes++) {
+		pci_read_config_dword(dev, pos, &orig);
+		pci_write_config_dword(dev, pos, mask);
+		pci_read_config_dword(dev, pos, sizes);
+		pci_write_config_dword(dev, pos, orig);
+	}
+}
+
+void __pci_size_stdbars(struct pci_dev *dev, int count,
+			unsigned int pos, u32 *sizes)
+{
+	__pci_size_bars(dev, count, pos, sizes, false);
+}
+
+static void __pci_size_rom(struct pci_dev *dev, unsigned int pos, u32 *sizes)
+{
+	__pci_size_bars(dev, 1, pos, sizes, true);
+}
+
+/**
  * __pci_read_base - Read a PCI BAR
  * @dev: the PCI device
  * @type: type of the BAR
  * @res: resource buffer to be filled in
  * @pos: BAR position in the config space
+ * @sizes: array of one or more pre-read BAR masks
  *
  * Returns 1 if the BAR is 64-bit, or 0 if 32-bit.
  */
 int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
-		    struct resource *res, unsigned int pos)
+		    struct resource *res, unsigned int pos, u32 *sizes)
 {
-	u32 l = 0, sz = 0, mask;
+	u32 l = 0, sz;
 	u64 l64, sz64, mask64;
-	u16 orig_cmd;
 	struct pci_bus_region region, inverted_region;
 	const char *res_name = pci_resource_name(dev, res - dev->resource);
 
-	mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
-
-	/* No printks while decoding is disabled! */
-	if (!dev->mmio_always_on) {
-		pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
-		if (orig_cmd & PCI_COMMAND_DECODE_ENABLE) {
-			pci_write_config_word(dev, PCI_COMMAND,
-				orig_cmd & ~PCI_COMMAND_DECODE_ENABLE);
-		}
-	}
-
 	res->name = pci_name(dev);
 
 	pci_read_config_dword(dev, pos, &l);
-	pci_write_config_dword(dev, pos, l | mask);
-	pci_read_config_dword(dev, pos, &sz);
-	pci_write_config_dword(dev, pos, l);
+	sz = sizes[0];
 
 	/*
 	 * All bits set in sz means the device isn't working properly.
@@ -238,18 +264,13 @@
 
 	if (res->flags & IORESOURCE_MEM_64) {
 		pci_read_config_dword(dev, pos + 4, &l);
-		pci_write_config_dword(dev, pos + 4, ~0);
-		pci_read_config_dword(dev, pos + 4, &sz);
-		pci_write_config_dword(dev, pos + 4, l);
+		sz = sizes[1];
 
 		l64 |= ((u64)l << 32);
 		sz64 |= ((u64)sz << 32);
 		mask64 |= ((u64)~0 << 32);
 	}
 
-	if (!dev->mmio_always_on && (orig_cmd & PCI_COMMAND_DECODE_ENABLE))
-		pci_write_config_word(dev, PCI_COMMAND, orig_cmd);
-
 	if (!sz64)
 		goto fail;
 
@@ -320,7 +341,11 @@
 
 static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom)
 {
+	u32 rombar, stdbars[PCI_STD_NUM_BARS];
 	unsigned int pos, reg;
+	u16 orig_cmd;
+
+	BUILD_BUG_ON(howmany > PCI_STD_NUM_BARS);
 
 	if (dev->non_compliant_bars)
 		return;
@@ -329,10 +354,28 @@
 	if (dev->is_virtfn)
 		return;
 
+	/* No printks while decoding is disabled! */
+	if (!dev->mmio_always_on) {
+		pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
+		if (orig_cmd & PCI_COMMAND_DECODE_ENABLE) {
+			pci_write_config_word(dev, PCI_COMMAND,
+				orig_cmd & ~PCI_COMMAND_DECODE_ENABLE);
+		}
+	}
+
+	__pci_size_stdbars(dev, howmany, PCI_BASE_ADDRESS_0, stdbars);
+	if (rom)
+		__pci_size_rom(dev, rom, &rombar);
+
+	if (!dev->mmio_always_on &&
+	    (orig_cmd & PCI_COMMAND_DECODE_ENABLE))
+		pci_write_config_word(dev, PCI_COMMAND, orig_cmd);
+
 	for (pos = 0; pos < howmany; pos++) {
 		struct resource *res = &dev->resource[pos];
 		reg = PCI_BASE_ADDRESS_0 + (pos << 2);
-		pos += __pci_read_base(dev, pci_bar_unknown, res, reg);
+		pos += __pci_read_base(dev, pci_bar_unknown,
+				       res, reg, &stdbars[pos]);
 	}
 
 	if (rom) {
@@ -340,7 +383,7 @@
 		dev->rom_base_reg = rom;
 		res->flags = IORESOURCE_MEM | IORESOURCE_PREFETCH |
 				IORESOURCE_READONLY | IORESOURCE_SIZEALIGN;
-		__pci_read_base(dev, pci_bar_mem32, res, rom);
+		__pci_read_base(dev, pci_bar_mem32, res, rom, &rombar);
 	}
 }
 
@@ -1047,7 +1090,7 @@
 
 free:
 #ifdef CONFIG_PCI_DOMAINS_GENERIC
-	pci_bus_release_domain_nr(bus, parent);
+	pci_bus_release_domain_nr(parent, bus->domain_nr);
 #endif
 	kfree(bus);
 	return err;
@@ -1195,9 +1238,11 @@
 
 	/* Enable CRS Software Visibility if supported */
 	pcie_capability_read_word(pdev, PCI_EXP_RTCAP, &root_cap);
-	if (root_cap & PCI_EXP_RTCAP_CRSVIS)
+	if (root_cap & PCI_EXP_RTCAP_CRSVIS) {
 		pcie_capability_set_word(pdev, PCI_EXP_RTCTL,
 					 PCI_EXP_RTCTL_CRSSVE);
+		pdev->config_crs_sv = 1;
+	}
 }
 
 static unsigned int pci_scan_child_bus_extend(struct pci_bus *bus,
@@ -1614,23 +1659,33 @@
 
 static void set_pcie_untrusted(struct pci_dev *dev)
 {
-	struct pci_dev *parent;
+	struct pci_dev *parent = pci_upstream_bridge(dev);
 
+	if (!parent)
+		return;
 	/*
-	 * If the upstream bridge is untrusted we treat this device
+	 * If the upstream bridge is untrusted we treat this device as
 	 * untrusted as well.
 	 */
-	parent = pci_upstream_bridge(dev);
-	if (parent && (parent->untrusted || parent->external_facing))
+	if (parent->untrusted) {
+		dev->untrusted = true;
+		return;
+	}
+
+	if (arch_pci_dev_is_removable(dev)) {
+		pci_dbg(dev, "marking as untrusted\n");
 		dev->untrusted = true;
+	}
 }
 
 static void pci_set_removable(struct pci_dev *dev)
 {
 	struct pci_dev *parent = pci_upstream_bridge(dev);
 
+	if (!parent)
+		return;
 	/*
-	 * We (only) consider everything downstream from an external_facing
+	 * We (only) consider everything tunneled below an external_facing
 	 * device to be removable by the user. We're mainly concerned with
 	 * consumer platforms with user accessible thunderbolt ports that are
 	 * vulnerable to DMA attacks, and we expect those ports to be marked by
@@ -1640,9 +1695,15 @@
 	 * accessible to user / may not be removed by end user, and thus not
 	 * exposed as "removable" to userspace.
 	 */
-	if (parent &&
-	    (parent->external_facing || dev_is_removable(&parent->dev)))
+	if (dev_is_removable(&parent->dev)) {
+		dev_set_removable(&dev->dev, DEVICE_REMOVABLE);
+		return;
+	}
+
+	if (arch_pci_dev_is_removable(dev)) {
+		pci_dbg(dev, "marking as removable\n");
 		dev_set_removable(&dev->dev, DEVICE_REMOVABLE);
+	}
 }
 
 /**
@@ -2209,67 +2270,6 @@
 	}
 }
 
-static void pci_configure_ltr(struct pci_dev *dev)
-{
-#ifdef CONFIG_PCIEASPM
-	struct pci_host_bridge *host = pci_find_host_bridge(dev->bus);
-	struct pci_dev *bridge;
-	u32 cap, ctl;
-
-	if (!pci_is_pcie(dev))
-		return;
-
-	/* Read L1 PM substate capabilities */
-	dev->l1ss = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_L1SS);
-
-	pcie_capability_read_dword(dev, PCI_EXP_DEVCAP2, &cap);
-	if (!(cap & PCI_EXP_DEVCAP2_LTR))
-		return;
-
-	pcie_capability_read_dword(dev, PCI_EXP_DEVCTL2, &ctl);
-	if (ctl & PCI_EXP_DEVCTL2_LTR_EN) {
-		if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) {
-			dev->ltr_path = 1;
-			return;
-		}
-
-		bridge = pci_upstream_bridge(dev);
-		if (bridge && bridge->ltr_path)
-			dev->ltr_path = 1;
-
-		return;
-	}
-
-	if (!host->native_ltr)
-		return;
-
-	/*
-	 * Software must not enable LTR in an Endpoint unless the Root
-	 * Complex and all intermediate Switches indicate support for LTR.
-	 * PCIe r4.0, sec 6.18.
-	 */
-	if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) {
-		pcie_capability_set_word(dev, PCI_EXP_DEVCTL2,
-					 PCI_EXP_DEVCTL2_LTR_EN);
-		dev->ltr_path = 1;
-		return;
-	}
-
-	/*
-	 * If we're configuring a hot-added device, LTR was likely
-	 * disabled in the upstream bridge, so re-enable it before enabling
-	 * it in the new device.
-	 */
-	bridge = pci_upstream_bridge(dev);
-	if (bridge && bridge->ltr_path) {
-		pci_bridge_reconfigure_ltr(dev);
-		pcie_capability_set_word(dev, PCI_EXP_DEVCTL2,
-					 PCI_EXP_DEVCTL2_LTR_EN);
-		dev->ltr_path = 1;
-	}
-#endif
-}
-
 static void pci_configure_eetlp_prefix(struct pci_dev *dev)
 {
 #ifdef CONFIG_PCI_PASID
@@ -2320,6 +2320,7 @@
 	pci_configure_extended_tags(dev, NULL);
 	pci_configure_relaxed_ordering(dev);
 	pci_configure_ltr(dev);
+	pci_configure_aspm_l1ss(dev);
 	pci_configure_eetlp_prefix(dev);
 	pci_configure_serr(dev);
 
@@ -2382,11 +2383,6 @@
 }
 EXPORT_SYMBOL(pci_alloc_dev);
 
-static bool pci_bus_crs_vendor_id(u32 l)
-{
-	return (l & 0xffff) == PCI_VENDOR_ID_PCI_SIG;
-}
-
 static bool pci_bus_wait_crs(struct pci_bus *bus, int devfn, u32 *l,
 			     int timeout)
 {
@@ -3122,7 +3118,9 @@
 	struct pci_bus *bus, *child;
 	int ret;
 
+	pci_lock_rescan_remove();
 	ret = pci_scan_root_bus_bridge(bridge);
+	pci_unlock_rescan_remove();
 	if (ret < 0) {
 		dev_err(bridge->dev.parent, "Scanning root bridge failed");
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/pci/pwrctl/Kconfig
+++ linux-qcom-6.8.0/drivers/pci/pwrctl/Kconfig
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+menu "PCI Power control drivers"
+
+config PCI_PWRCTL
+	tristate
+
+config PCI_PWRCTL_PWRSEQ
+	tristate "PCI Power Control driver using the Power Sequencing subsystem"
+	select POWER_SEQUENCING
+	select PCI_PWRCTL
+	default m if ((ATH11K_PCI || ATH12K) && ARCH_QCOM)
+	help
+	  Enable support for the PCI power control driver for device
+	  drivers using the Power Sequencing subsystem.
+
+endmenu
--- linux-qcom-6.8.0.orig/drivers/pci/pwrctl/Makefile
+++ linux-qcom-6.8.0/drivers/pci/pwrctl/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+obj-$(CONFIG_PCI_PWRCTL)		+= pci-pwrctl-core.o
+pci-pwrctl-core-y			:= core.o
+
+obj-$(CONFIG_PCI_PWRCTL_PWRSEQ)		+= pci-pwrctl-pwrseq.o
--- linux-qcom-6.8.0.orig/drivers/pci/pwrctl/core.c
+++ linux-qcom-6.8.0/drivers/pci/pwrctl/core.c
@@ -0,0 +1,137 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2024 Linaro Ltd.
+ */
+
+#include <linux/device.h>
+#include <linux/export.h>
+#include <linux/kernel.h>
+#include <linux/pci.h>
+#include <linux/pci-pwrctl.h>
+#include <linux/property.h>
+#include <linux/slab.h>
+
+static int pci_pwrctl_notify(struct notifier_block *nb, unsigned long action,
+			     void *data)
+{
+	struct pci_pwrctl *pwrctl = container_of(nb, struct pci_pwrctl, nb);
+	struct device *dev = data;
+
+	if (dev_fwnode(dev) != dev_fwnode(pwrctl->dev))
+		return NOTIFY_DONE;
+
+	switch (action) {
+	case BUS_NOTIFY_ADD_DEVICE:
+		/*
+		 * We will have two struct device objects bound to two different
+		 * drivers on different buses but consuming the same DT node. We
+		 * must not bind the pins twice in this case but only once for
+		 * the first device to be added.
+		 *
+		 * If we got here then the PCI device is the second after the
+		 * power control platform device. Mark its OF node as reused.
+		 */
+		dev->of_node_reused = true;
+		break;
+	case BUS_NOTIFY_BOUND_DRIVER:
+		pwrctl->link = device_link_add(dev, pwrctl->dev,
+					       DL_FLAG_AUTOREMOVE_CONSUMER);
+		if (!pwrctl->link)
+			dev_err(pwrctl->dev, "Failed to add device link\n");
+		break;
+	case BUS_NOTIFY_UNBOUND_DRIVER:
+		if (pwrctl->link)
+			device_link_remove(dev, pwrctl->dev);
+		break;
+	}
+
+	return NOTIFY_DONE;
+}
+
+/**
+ * pci_pwrctl_device_set_ready() - Notify the pwrctl subsystem that the PCI
+ * device is powered-up and ready to be detected.
+ *
+ * @pwrctl: PCI power control data.
+ *
+ * Returns:
+ * 0 on success, negative error number on error.
+ *
+ * Note:
+ * This function returning 0 doesn't mean the device was detected. It means,
+ * that the bus rescan was successfully started. The device will get bound to
+ * its PCI driver asynchronously.
+ */
+int pci_pwrctl_device_set_ready(struct pci_pwrctl *pwrctl)
+{
+	int ret;
+
+	if (!pwrctl->dev)
+		return -ENODEV;
+
+	pwrctl->nb.notifier_call = pci_pwrctl_notify;
+	ret = bus_register_notifier(&pci_bus_type, &pwrctl->nb);
+	if (ret)
+		return ret;
+
+	pci_lock_rescan_remove();
+	pci_rescan_bus(to_pci_dev(pwrctl->dev->parent)->bus);
+	pci_unlock_rescan_remove();
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(pci_pwrctl_device_set_ready);
+
+/**
+ * pci_pwrctl_device_unset_ready() - Notify the pwrctl subsystem that the PCI
+ * device is about to be powered-down.
+ *
+ * @pwrctl: PCI power control data.
+ */
+void pci_pwrctl_device_unset_ready(struct pci_pwrctl *pwrctl)
+{
+	/*
+	 * We don't have to delete the link here. Typically, this function
+	 * is only called when the power control device is being detached. If
+	 * it is being detached then the child PCI device must have already
+	 * been unbound too or the device core wouldn't let us unbind.
+	 */
+	bus_unregister_notifier(&pci_bus_type, &pwrctl->nb);
+}
+EXPORT_SYMBOL_GPL(pci_pwrctl_device_unset_ready);
+
+static void devm_pci_pwrctl_device_unset_ready(void *data)
+{
+	struct pci_pwrctl *pwrctl = data;
+
+	pci_pwrctl_device_unset_ready(pwrctl);
+}
+
+/**
+ * devm_pci_pwrctl_device_set_ready - Managed variant of
+ * pci_pwrctl_device_set_ready().
+ *
+ * @dev: Device managing this pwrctl provider.
+ * @pwrctl: PCI power control data.
+ *
+ * Returns:
+ * 0 on success, negative error number on error.
+ */
+int devm_pci_pwrctl_device_set_ready(struct device *dev,
+				     struct pci_pwrctl *pwrctl)
+{
+	int ret;
+
+	ret = pci_pwrctl_device_set_ready(pwrctl);
+	if (ret)
+		return ret;
+
+	return devm_add_action_or_reset(dev,
+					devm_pci_pwrctl_device_unset_ready,
+					pwrctl);
+}
+EXPORT_SYMBOL_GPL(devm_pci_pwrctl_device_set_ready);
+
+MODULE_AUTHOR("Bartosz Golaszewski <bartosz.golaszewski@linaro.org>");
+MODULE_DESCRIPTION("PCI Device Power Control core driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c
+++ linux-qcom-6.8.0/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2024 Linaro Ltd.
+ */
+
+#include <linux/device.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/pci-pwrctl.h>
+#include <linux/platform_device.h>
+#include <linux/pwrseq/consumer.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+
+struct pci_pwrctl_pwrseq_data {
+	struct pci_pwrctl ctx;
+	struct pwrseq_desc *pwrseq;
+};
+
+static void devm_pci_pwrctl_pwrseq_power_off(void *data)
+{
+	struct pwrseq_desc *pwrseq = data;
+
+	pwrseq_power_off(pwrseq);
+}
+
+static int pci_pwrctl_pwrseq_probe(struct platform_device *pdev)
+{
+	struct pci_pwrctl_pwrseq_data *data;
+	struct device *dev = &pdev->dev;
+	int ret;
+
+	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	data->pwrseq = devm_pwrseq_get(dev, of_device_get_match_data(dev));
+	if (IS_ERR(data->pwrseq))
+		return dev_err_probe(dev, PTR_ERR(data->pwrseq),
+				     "Failed to get the power sequencer\n");
+
+	ret = pwrseq_power_on(data->pwrseq);
+	if (ret)
+		return dev_err_probe(dev, ret,
+				     "Failed to power-on the device\n");
+
+	ret = devm_add_action_or_reset(dev, devm_pci_pwrctl_pwrseq_power_off,
+				       data->pwrseq);
+	if (ret)
+		return ret;
+
+	data->ctx.dev = dev;
+
+	ret = devm_pci_pwrctl_device_set_ready(dev, &data->ctx);
+	if (ret)
+		return dev_err_probe(dev, ret,
+				     "Failed to register the pwrctl wrapper\n");
+
+	return 0;
+}
+
+static const struct of_device_id pci_pwrctl_pwrseq_of_match[] = {
+	{
+		/* ATH11K in QCA6390 package. */
+		.compatible = "qcom,qca6390-wifi",
+		.data = "wlan",
+	},
+	{
+		/* ATH11K in WCN6855 package. */
+		.compatible = "qcom,wcn6855-wifi",
+		.data = "wlan",
+	},
+	{
+		/* ATH12K in WCN7850 package. */
+		.compatible = "qcom,wcn7850-wifi",
+		.data = "wlan",
+	},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, pci_pwrctl_pwrseq_of_match);
+
+static struct platform_driver pci_pwrctl_pwrseq_driver = {
+	.driver = {
+		.name = "pci-pwrctl-pwrseq",
+		.of_match_table = pci_pwrctl_pwrseq_of_match,
+	},
+	.probe = pci_pwrctl_pwrseq_probe,
+};
+module_platform_driver(pci_pwrctl_pwrseq_driver);
+
+MODULE_AUTHOR("Bartosz Golaszewski <bartosz.golaszewski@linaro.org>");
+MODULE_DESCRIPTION("Generic PCI Power Control module for power sequenced devices");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/pci/quirks.c
+++ linux-qcom-6.8.0/drivers/pci/quirks.c
@@ -66,7 +66,7 @@
  * apply this erratum workaround to any downstream ports as long as they
  * support Link Active reporting and have the Link Control 2 register.
  * Restrict the speed to 2.5GT/s then with the Target Link Speed field,
- * request a retrain and wait 200ms for the data link to go up.
+ * request a retrain and check the result.
  *
  * If this turns out successful and we know by the Vendor:Device ID it is
  * safe to do so, then lift the restriction, letting the devices negotiate
@@ -74,33 +74,45 @@
  * firmware may have already arranged and lift it with ports that already
  * report their data link being up.
  *
- * Return TRUE if the link has been successfully retrained, otherwise FALSE.
+ * Otherwise revert the speed to the original setting and request a retrain
+ * again to remove any residual state, ignoring the result as it's supposed
+ * to fail anyway.
+ *
+ * Return 0 if the link has been successfully retrained.  Return an error
+ * if retraining was not needed or we attempted a retrain and it failed.
  */
-bool pcie_failed_link_retrain(struct pci_dev *dev)
+int pcie_failed_link_retrain(struct pci_dev *dev)
 {
 	static const struct pci_device_id ids[] = {
 		{ PCI_VDEVICE(ASMEDIA, 0x2824) }, /* ASMedia ASM2824 */
 		{}
 	};
 	u16 lnksta, lnkctl2;
+	int ret = -ENOTTY;
 
 	if (!pci_is_pcie(dev) || !pcie_downstream_port(dev) ||
 	    !pcie_cap_has_lnkctl2(dev) || !dev->link_active_reporting)
-		return false;
+		return ret;
 
 	pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &lnkctl2);
 	pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
 	if ((lnksta & (PCI_EXP_LNKSTA_LBMS | PCI_EXP_LNKSTA_DLLLA)) ==
 	    PCI_EXP_LNKSTA_LBMS) {
+		u16 oldlnkctl2 = lnkctl2;
+
 		pci_info(dev, "broken device, retraining non-functional downstream link at 2.5GT/s\n");
 
 		lnkctl2 &= ~PCI_EXP_LNKCTL2_TLS;
 		lnkctl2 |= PCI_EXP_LNKCTL2_TLS_2_5GT;
 		pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2);
 
-		if (pcie_retrain_link(dev, false)) {
+		ret = pcie_retrain_link(dev, false);
+		if (ret) {
 			pci_info(dev, "retraining failed\n");
-			return false;
+			pcie_capability_write_word(dev, PCI_EXP_LNKCTL2,
+						   oldlnkctl2);
+			pcie_retrain_link(dev, true);
+			return ret;
 		}
 
 		pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
@@ -117,13 +129,14 @@
 		lnkctl2 |= lnkcap & PCI_EXP_LNKCAP_SLS;
 		pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2);
 
-		if (pcie_retrain_link(dev, false)) {
+		ret = pcie_retrain_link(dev, false);
+		if (ret) {
 			pci_info(dev, "retraining failed\n");
-			return false;
+			return ret;
 		}
 	}
 
-	return true;
+	return ret;
 }
 
 static ktime_t fixup_debug_start(struct pci_dev *dev,
@@ -300,6 +313,21 @@
 DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_ANY_ID, PCI_ANY_ID,
 				PCI_CLASS_BRIDGE_HOST, 8, quirk_mmio_always_on);
 
+/* The BAR0 ~ BAR4 of Marvell 9125 device can't be accessed
+*  by IO resource file, and need to skip the files
+*/
+static void quirk_marvell_mask_bar(struct pci_dev *dev)
+{
+	int i;
+
+	for (i = 0; i < 5; i++)
+		if (dev->resource[i].start)
+			dev->resource[i].start =
+				dev->resource[i].end = 0;
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9125,
+				quirk_marvell_mask_bar);
+
 /*
  * The Mellanox Tavor device gives false positive parity errors.  Disable
  * parity error reporting.
@@ -3608,6 +3636,8 @@
 			quirk_broken_intx_masking);
 DECLARE_PCI_FIXUP_FINAL(0x1b7c, 0x0004, /* Ceton InfiniTV4 */
 			quirk_broken_intx_masking);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CREATIVE, PCI_DEVICE_ID_CREATIVE_20K2,
+			quirk_broken_intx_masking);
 
 /*
  * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10)
@@ -4246,6 +4276,10 @@
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_RICOH, 0xe832, quirk_dma_func0_alias);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_RICOH, 0xe476, quirk_dma_func0_alias);
 
+/* Some Glenfly chips use function 0 as the PCIe Requester ID for DMA */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_GLENFLY, 0x3d40, quirk_dma_func0_alias);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_GLENFLY, 0x3d41, quirk_dma_func0_alias);
+
 static void quirk_dma_func1_alias(struct pci_dev *dev)
 {
 	if (PCI_FUNC(dev->devfn) != 1)
@@ -4977,18 +5011,21 @@
 }
 
 /*
- * Wangxun 10G/1G NICs have no ACS capability, and on multi-function
- * devices, peer-to-peer transactions are not be used between the functions.
- * So add an ACS quirk for below devices to isolate functions.
+ * Wangxun 40G/25G/10G/1G NICs have no ACS capability, but on
+ * multi-function devices, the hardware isolates the functions by
+ * directing all peer-to-peer traffic upstream as though PCI_ACS_RR and
+ * PCI_ACS_CR were set.
  * SFxxx 1G NICs(em).
  * RP1000/RP2000 10G NICs(sp).
+ * FF5xxx 40G/25G/10G NICs(aml).
  */
 static int  pci_quirk_wangxun_nic_acs(struct pci_dev *dev, u16 acs_flags)
 {
 	switch (dev->device) {
-	case 0x0100 ... 0x010F:
-	case 0x1001:
-	case 0x2001:
+	case 0x0100 ... 0x010F: /* EM */
+	case 0x1001: case 0x2001: /* SP */
+	case 0x5010: case 0x5025: case 0x5040: /* AML */
+	case 0x5110: case 0x5125: case 0x5140: /* AML */
 		return pci_acs_ctrl_enabled(acs_flags,
 			PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
 	}
@@ -5070,6 +5107,8 @@
 	/* QCOM QDF2xxx root ports */
 	{ PCI_VENDOR_ID_QCOM, 0x0400, pci_quirk_qcom_rp_acs },
 	{ PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
+	/* QCOM SA8775P root port */
+	{ PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },
 	/* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */
 	{ PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs },
 	/* Intel PCH root ports */
@@ -5099,6 +5138,10 @@
 	{ PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs },
 	{ PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs },
 	{ PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs },
+	{ PCI_VENDOR_ID_BROADCOM, 0x1760, pci_quirk_mf_endpoint_acs },
+	{ PCI_VENDOR_ID_BROADCOM, 0x1761, pci_quirk_mf_endpoint_acs },
+	{ PCI_VENDOR_ID_BROADCOM, 0x1762, pci_quirk_mf_endpoint_acs },
+	{ PCI_VENDOR_ID_BROADCOM, 0x1763, pci_quirk_mf_endpoint_acs },
 	{ PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs },
 	/* Amazon Annapurna Labs */
 	{ PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs },
@@ -5494,7 +5537,7 @@
  * AMD Matisse USB 3.0 Host Controller 0x149c
  * Intel 82579LM Gigabit Ethernet Controller 0x1502
  * Intel 82579V Gigabit Ethernet Controller 0x1503
- *
+ * Mediatek MT7922 802.11ax PCI Express Wireless Network Adapter
  */
 static void quirk_no_flr(struct pci_dev *dev)
 {
@@ -5506,6 +5549,7 @@
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x7901, quirk_no_flr);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_MEDIATEK, 0x0616, quirk_no_flr);
 
 /* FLR may cause the SolidRun SNET DPU (rev 0x1) to hang */
 static void quirk_no_flr_snet(struct pci_dev *dev)
@@ -5527,6 +5571,7 @@
 
 	pci_walk_bus(bridge->bus, pci_configure_extended_tags, NULL);
 }
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_3WARE, 0x1004, quirk_no_ext_tags);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0132, quirk_no_ext_tags);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0140, quirk_no_ext_tags);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0141, quirk_no_ext_tags);
@@ -6225,6 +6270,8 @@
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2d, dpc_log_size);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2f, dpc_log_size);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a31, dpc_log_size);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0xa73f, dpc_log_size);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0xa76e, dpc_log_size);
 #endif
 
 /*
@@ -6250,3 +6297,72 @@
 	pdev->d3cold_delay = 1000;
 }
 DECLARE_PCI_FIXUP_FINAL(0x5555, 0x0004, pci_fixup_d3cold_delay_1sec);
+
+/*
+ * Device [8086:9a09], [8086:a0b0] and [8086:a0bc]
+ * BIOS may not be able to access config space of devices under VMD domain, so
+ * it relies on software to enable ASPM for links under VMD.
+ */
+static bool pci_fixup_is_vmd_bridge(struct pci_dev *pdev)
+{
+	struct pci_bus *bus = pdev->bus;
+	struct device *dev;
+	struct pci_driver *pdrv;
+
+	if (!pci_is_root_bus(bus))
+		return false;
+
+	dev = bus->bridge->parent;
+	if (dev == NULL)
+		return false;
+
+	pdrv = pci_dev_driver(to_pci_dev(dev));
+	if (pdrv == NULL || strcmp("vmd", pdrv->name))
+		return false;
+
+	return true;
+}
+
+static void pci_fixup_enable_aspm(struct pci_dev *pdev)
+{
+	if (!pci_fixup_is_vmd_bridge(pdev))
+		return;
+
+	pdev->dev_flags |= PCI_DEV_FLAGS_ENABLE_ASPM;
+	pci_info(pdev, "enable ASPM for pci bridge behind vmd");
+}
+DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
+			       PCI_CLASS_BRIDGE_PCI, 8, pci_fixup_enable_aspm);
+
+static void pci_fixup_enable_vmd_nvme_ltr(struct pci_dev *pdev)
+{
+	struct pci_dev *parent;
+	int pos;
+	u16 val;
+
+	parent = pci_upstream_bridge(pdev);
+	if (!parent)
+		return;
+
+	if (!pci_fixup_is_vmd_bridge(parent))
+		return;
+
+	pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_LTR);
+	if (!pos)
+		return;
+
+	pci_read_config_word(pdev, pos + PCI_LTR_MAX_SNOOP_LAT, &val);
+	if (val)
+		return;
+
+	pci_read_config_word(pdev, pos + PCI_LTR_MAX_NOSNOOP_LAT, &val);
+	if (val)
+		return;
+
+	/* 3145728ns, i.e. 0x300000ns */
+	pci_write_config_word(pdev, pos + PCI_LTR_MAX_SNOOP_LAT, 0x1003);
+	pci_write_config_word(pdev, pos + PCI_LTR_MAX_NOSNOOP_LAT, 0x1003);
+	pci_info(pdev, "enable LTR for nvme behind vmd");
+}
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_ANY_ID, PCI_ANY_ID,
+			      PCI_CLASS_STORAGE_EXPRESS, 0, pci_fixup_enable_vmd_nvme_ltr);
--- linux-qcom-6.8.0.orig/drivers/pci/remove.c
+++ linux-qcom-6.8.0/drivers/pci/remove.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/pci.h>
 #include <linux/module.h>
+#include <linux/of_platform.h>
 #include "pci.h"
 
 static void pci_free_resources(struct pci_dev *dev)
@@ -18,10 +19,11 @@
 	pci_pme_active(dev, false);
 
 	if (pci_dev_is_added(dev)) {
-
+		of_platform_depopulate(&dev->dev);
 		device_release_driver(&dev->dev);
 		pci_proc_detach_device(dev);
 		pci_remove_sysfs_dev_files(dev);
+		of_platform_depopulate(&dev->dev);
 		of_pci_remove_node(dev);
 
 		pci_dev_assign_added(dev, false);
@@ -162,7 +164,7 @@
 #ifdef CONFIG_PCI_DOMAINS_GENERIC
 	/* Release domain_nr if it was dynamically allocated */
 	if (host_bridge->domain_nr == PCI_DOMAIN_NR_NOT_SET)
-		pci_bus_release_domain_nr(bus, host_bridge->dev.parent);
+		pci_bus_release_domain_nr(host_bridge->dev.parent, bus->domain_nr);
 #endif
 
 	pci_remove_bus(bus);
--- linux-qcom-6.8.0.orig/drivers/pci/setup-bus.c
+++ linux-qcom-6.8.0/drivers/pci/setup-bus.c
@@ -829,11 +829,9 @@
 		size = min_size;
 	if (old_size == 1)
 		old_size = 0;
-	if (size < old_size)
-		size = old_size;
 
-	size = ALIGN(max(size, add_size) + children_add_size, align);
-	return size;
+	size = max(size, add_size) + children_add_size;
+	return ALIGN(max(size, old_size), align);
 }
 
 resource_size_t __weak pcibios_window_alignment(struct pci_bus *bus,
--- linux-qcom-6.8.0.orig/drivers/pci/slot.c
+++ linux-qcom-6.8.0/drivers/pci/slot.c
@@ -79,6 +79,7 @@
 	up_read(&pci_bus_sem);
 
 	list_del(&slot->list);
+	pci_bus_put(slot->bus);
 
 	kfree(slot);
 }
@@ -261,7 +262,7 @@
 		goto err;
 	}
 
-	slot->bus = parent;
+	slot->bus = pci_bus_get(parent);
 	slot->number = slot_nr;
 
 	slot->kobj.kset = pci_slots_kset;
@@ -269,6 +270,7 @@
 	slot_name = make_slot_name(name);
 	if (!slot_name) {
 		err = -ENOMEM;
+		pci_bus_put(slot->bus);
 		kfree(slot);
 		goto err;
 	}
--- linux-qcom-6.8.0.orig/drivers/pci/switch/switchtec.c
+++ linux-qcom-6.8.0/drivers/pci/switch/switchtec.c
@@ -1672,7 +1672,7 @@
 	rc = switchtec_init_isr(stdev);
 	if (rc) {
 		dev_err(&stdev->dev, "failed to init isr.\n");
-		goto err_put;
+		goto err_exit_pci;
 	}
 
 	iowrite32(SWITCHTEC_EVENT_CLEAR |
@@ -1693,6 +1693,8 @@
 
 err_devadd:
 	stdev_kill(stdev);
+err_exit_pci:
+	switchtec_exit_pci(stdev);
 err_put:
 	ida_free(&switchtec_minor_ida, MINOR(stdev->dev.devt));
 	put_device(&stdev->dev);
--- linux-qcom-6.8.0.orig/drivers/pcmcia/yenta_socket.c
+++ linux-qcom-6.8.0/drivers/pcmcia/yenta_socket.c
@@ -638,11 +638,11 @@
 		start = PCIBIOS_MIN_CARDBUS_IO;
 		end = ~0U;
 	} else {
-		unsigned long avail = root->end - root->start;
+		unsigned long avail = resource_size(root);
 		int i;
 		size = BRIDGE_MEM_MAX;
-		if (size > avail/8) {
-			size = (avail+1)/8;
+		if (size > (avail - 1) / 8) {
+			size = avail / 8;
 			/* round size down to next power of 2 */
 			i = 0;
 			while ((size /= 2) != 0)
--- linux-qcom-6.8.0.orig/drivers/perf/alibaba_uncore_drw_pmu.c
+++ linux-qcom-6.8.0/drivers/perf/alibaba_uncore_drw_pmu.c
@@ -408,7 +408,7 @@
 			}
 
 			/* clear common counter intr status */
-			clr_status = FIELD_PREP(ALI_DRW_PMCOM_CNT_OV_INTR_MASK, 1);
+			clr_status = FIELD_PREP(ALI_DRW_PMCOM_CNT_OV_INTR_MASK, status);
 			writel(clr_status,
 			       drw_pmu->cfg_base + ALI_DRW_PMU_OV_INTR_CLR);
 		}
--- linux-qcom-6.8.0.orig/drivers/perf/arm-cmn.c
+++ linux-qcom-6.8.0/drivers/perf/arm-cmn.c
@@ -24,14 +24,6 @@
 #define CMN_NI_NODE_ID			GENMASK_ULL(31, 16)
 #define CMN_NI_LOGICAL_ID		GENMASK_ULL(47, 32)
 
-#define CMN_NODEID_DEVID(reg)		((reg) & 3)
-#define CMN_NODEID_EXT_DEVID(reg)	((reg) & 1)
-#define CMN_NODEID_PID(reg)		(((reg) >> 2) & 1)
-#define CMN_NODEID_EXT_PID(reg)		(((reg) >> 1) & 3)
-#define CMN_NODEID_1x1_PID(reg)		(((reg) >> 2) & 7)
-#define CMN_NODEID_X(reg, bits)		((reg) >> (3 + (bits)))
-#define CMN_NODEID_Y(reg, bits)		(((reg) >> 3) & ((1U << (bits)) - 1))
-
 #define CMN_CHILD_INFO			0x0080
 #define CMN_CI_CHILD_COUNT		GENMASK_ULL(15, 0)
 #define CMN_CI_CHILD_PTR_OFFSET		GENMASK_ULL(31, 16)
@@ -43,6 +35,9 @@
 #define CMN_MAX_XPS			(CMN_MAX_DIMENSION * CMN_MAX_DIMENSION)
 #define CMN_MAX_DTMS			(CMN_MAX_XPS + (CMN_MAX_DIMENSION - 1) * 4)
 
+/* Currently XPs are the node type we can have most of; others top out at 128 */
+#define CMN_MAX_NODES_PER_EVENT		CMN_MAX_XPS
+
 /* The CFG node has various info besides the discovery tree */
 #define CMN_CFGM_PERIPH_ID_01		0x0008
 #define CMN_CFGM_PID0_PART_0		GENMASK_ULL(7, 0)
@@ -78,7 +73,8 @@
 /* Technically this is 4 bits wide on DNs, but we only use 2 there anyway */
 #define CMN__PMU_OCCUP1_ID		GENMASK_ULL(34, 32)
 
-/* HN-Ps are weird... */
+/* Some types are designed to coexist with another device in the same node */
+#define CMN_CCLA_PMU_EVENT_SEL		0x008
 #define CMN_HNP_PMU_EVENT_SEL		0x008
 
 /* DTMs live in the PMU space of XP registers */
@@ -281,8 +277,11 @@
 	u16 id, logid;
 	enum cmn_node_type type;
 
+	/* XP properties really, but replicated to children for convenience */
 	u8 dtm;
 	s8 dtc;
+	u8 portid_bits:4;
+	u8 deviceid_bits:4;
 	/* DN/HN-F/CXHA */
 	struct {
 		u8 val : 4;
@@ -358,49 +357,33 @@
 static int arm_cmn_hp_state;
 
 struct arm_cmn_nodeid {
-	u8 x;
-	u8 y;
 	u8 port;
 	u8 dev;
 };
 
 static int arm_cmn_xyidbits(const struct arm_cmn *cmn)
 {
-	return fls((cmn->mesh_x - 1) | (cmn->mesh_y - 1) | 2);
+	return fls((cmn->mesh_x - 1) | (cmn->mesh_y - 1));
 }
 
-static struct arm_cmn_nodeid arm_cmn_nid(const struct arm_cmn *cmn, u16 id)
+static struct arm_cmn_nodeid arm_cmn_nid(const struct arm_cmn_node *dn)
 {
 	struct arm_cmn_nodeid nid;
 
-	if (cmn->num_xps == 1) {
-		nid.x = 0;
-		nid.y = 0;
-		nid.port = CMN_NODEID_1x1_PID(id);
-		nid.dev = CMN_NODEID_DEVID(id);
-	} else {
-		int bits = arm_cmn_xyidbits(cmn);
-
-		nid.x = CMN_NODEID_X(id, bits);
-		nid.y = CMN_NODEID_Y(id, bits);
-		if (cmn->ports_used & 0xc) {
-			nid.port = CMN_NODEID_EXT_PID(id);
-			nid.dev = CMN_NODEID_EXT_DEVID(id);
-		} else {
-			nid.port = CMN_NODEID_PID(id);
-			nid.dev = CMN_NODEID_DEVID(id);
-		}
-	}
+	nid.dev = dn->id & ((1U << dn->deviceid_bits) - 1);
+	nid.port = (dn->id >> dn->deviceid_bits) & ((1U << dn->portid_bits) - 1);
 	return nid;
 }
 
 static struct arm_cmn_node *arm_cmn_node_to_xp(const struct arm_cmn *cmn,
 					       const struct arm_cmn_node *dn)
 {
-	struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, dn->id);
-	int xp_idx = cmn->mesh_x * nid.y + nid.x;
+	int id = dn->id >> (dn->portid_bits + dn->deviceid_bits);
+	int bits = arm_cmn_xyidbits(cmn);
+	int x = id >> bits;
+	int y = id & ((1U << bits) - 1);
 
-	return cmn->xps + xp_idx;
+	return cmn->xps + cmn->mesh_x * y + x;
 }
 static struct arm_cmn_node *arm_cmn_node(const struct arm_cmn *cmn,
 					 enum cmn_node_type type)
@@ -486,13 +469,14 @@
 	}
 }
 
-static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)
+static void arm_cmn_show_logid(struct seq_file *s, const struct arm_cmn_node *xp, int p, int d)
 {
 	struct arm_cmn *cmn = s->private;
 	struct arm_cmn_node *dn;
+	u16 id = xp->id | d | (p << xp->deviceid_bits);
 
 	for (dn = cmn->dns; dn->type; dn++) {
-		struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, dn->id);
+		int pad = dn->logid < 10;
 
 		if (dn->type == CMN_TYPE_XP)
 			continue;
@@ -500,10 +484,10 @@
 		if (dn->type < CMN_TYPE_HNI)
 			continue;
 
-		if (nid.x != x || nid.y != y || nid.port != p || nid.dev != d)
+		if (dn->id != id)
 			continue;
 
-		seq_printf(s, "   #%-2d  |", dn->logid);
+		seq_printf(s, " %*c#%-*d  |", pad + 1, ' ', 3 - pad, dn->logid);
 		return;
 	}
 	seq_puts(s, "        |");
@@ -516,28 +500,27 @@
 
 	seq_puts(s, "     X");
 	for (x = 0; x < cmn->mesh_x; x++)
-		seq_printf(s, "    %d    ", x);
+		seq_printf(s, "    %-2d   ", x);
 	seq_puts(s, "\nY P D+");
 	y = cmn->mesh_y;
 	while (y--) {
 		int xp_base = cmn->mesh_x * y;
+		struct arm_cmn_node *xp = cmn->xps + xp_base;
 		u8 port[CMN_MAX_PORTS][CMN_MAX_DIMENSION];
 
 		for (x = 0; x < cmn->mesh_x; x++)
 			seq_puts(s, "--------+");
 
-		seq_printf(s, "\n%d    |", y);
+		seq_printf(s, "\n%-2d   |", y);
 		for (x = 0; x < cmn->mesh_x; x++) {
-			struct arm_cmn_node *xp = cmn->xps + xp_base + x;
-
 			for (p = 0; p < CMN_MAX_PORTS; p++)
-				port[p][x] = arm_cmn_device_connect_info(cmn, xp, p);
-			seq_printf(s, " XP #%-2d |", xp_base + x);
+				port[p][x] = arm_cmn_device_connect_info(cmn, xp + x, p);
+			seq_printf(s, " XP #%-3d|", xp_base + x);
 		}
 
 		seq_puts(s, "\n     |");
 		for (x = 0; x < cmn->mesh_x; x++) {
-			s8 dtc = cmn->xps[xp_base + x].dtc;
+			s8 dtc = xp[x].dtc;
 
 			if (dtc < 0)
 				seq_puts(s, " DTC ?? |");
@@ -554,10 +537,10 @@
 				seq_puts(s, arm_cmn_device_type(port[p][x]));
 			seq_puts(s, "\n    0|");
 			for (x = 0; x < cmn->mesh_x; x++)
-				arm_cmn_show_logid(s, x, y, p, 0);
+				arm_cmn_show_logid(s, xp + x, p, 0);
 			seq_puts(s, "\n    1|");
 			for (x = 0; x < cmn->mesh_x; x++)
-				arm_cmn_show_logid(s, x, y, p, 1);
+				arm_cmn_show_logid(s, xp + x, p, 1);
 		}
 		seq_puts(s, "\n-----+");
 	}
@@ -585,7 +568,7 @@
 
 struct arm_cmn_hw_event {
 	struct arm_cmn_node *dn;
-	u64 dtm_idx[4];
+	u64 dtm_idx[DIV_ROUND_UP(CMN_MAX_NODES_PER_EVENT * 2, 64)];
 	s8 dtc_idx[CMN_MAX_DTCS];
 	u8 num_dns;
 	u8 dtm_offset;
@@ -1752,10 +1735,7 @@
 	}
 
 	if (!hw->num_dns) {
-		struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, nodeid);
-
-		dev_dbg(cmn->dev, "invalid node 0x%x (%d,%d,%d,%d) type 0x%x\n",
-			nodeid, nid.x, nid.y, nid.port, nid.dev, type);
+		dev_dbg(cmn->dev, "invalid node 0x%x type 0x%x\n", nodeid, type);
 		return -EINVAL;
 	}
 
@@ -1850,7 +1830,7 @@
 			dtm->wp_event[wp_idx] = hw->dtc_idx[d];
 			writel_relaxed(cfg, dtm->base + CMN_DTM_WPn_CONFIG(wp_idx));
 		} else {
-			struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, dn->id);
+			struct arm_cmn_nodeid nid = arm_cmn_nid(dn);
 
 			if (cmn->multi_dtm)
 				nid.port %= 2;
@@ -2100,7 +2080,7 @@
 		dn->dtc = xp->dtc;
 		dn->dtm = xp->dtm;
 		if (cmn->multi_dtm)
-			dn->dtm += arm_cmn_nid(cmn, dn->id).port / 2;
+			dn->dtm += arm_cmn_nid(dn).port / 2;
 
 		if (dn->type == CMN_TYPE_DTC) {
 			int err = arm_cmn_init_dtc(cmn, dn, dtc_idx++);
@@ -2270,18 +2250,27 @@
 		arm_cmn_init_dtm(dtm++, xp, 0);
 		/*
 		 * Keeping track of connected ports will let us filter out
-		 * unnecessary XP events easily. We can also reliably infer the
-		 * "extra device ports" configuration for the node ID format
-		 * from this, since in that case we will see at least one XP
-		 * with port 2 connected, for the HN-D.
+		 * unnecessary XP events easily, and also infer the per-XP
+		 * part of the node ID format.
 		 */
 		for (int p = 0; p < CMN_MAX_PORTS; p++)
 			if (arm_cmn_device_connect_info(cmn, xp, p))
 				xp_ports |= BIT(p);
 
-		if (cmn->multi_dtm && (xp_ports & 0xc))
+		if (cmn->num_xps == 1) {
+			xp->portid_bits = 3;
+			xp->deviceid_bits = 2;
+		} else if (xp_ports > 0x3) {
+			xp->portid_bits = 2;
+			xp->deviceid_bits = 1;
+		} else {
+			xp->portid_bits = 1;
+			xp->deviceid_bits = 2;
+		}
+
+		if (cmn->multi_dtm && (xp_ports > 0x3))
 			arm_cmn_init_dtm(dtm++, xp, 1);
-		if (cmn->multi_dtm && (xp_ports & 0x30))
+		if (cmn->multi_dtm && (xp_ports > 0xf))
 			arm_cmn_init_dtm(dtm++, xp, 2);
 
 		cmn->ports_used |= xp_ports;
@@ -2318,6 +2307,8 @@
 			}
 
 			arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn);
+			dn->portid_bits = xp->portid_bits;
+			dn->deviceid_bits = xp->deviceid_bits;
 
 			switch (dn->type) {
 			case CMN_TYPE_DTC:
@@ -2336,10 +2327,13 @@
 			case CMN_TYPE_CXHA:
 			case CMN_TYPE_CCRA:
 			case CMN_TYPE_CCHA:
-			case CMN_TYPE_CCLA:
 			case CMN_TYPE_HNS:
 				dn++;
 				break;
+			case CMN_TYPE_CCLA:
+				dn->pmu_base += CMN_CCLA_PMU_EVENT_SEL;
+				dn++;
+				break;
 			/* Nothing to see here */
 			case CMN_TYPE_MPAM_S:
 			case CMN_TYPE_MPAM_NS:
@@ -2357,7 +2351,7 @@
 			case CMN_TYPE_HNP:
 			case CMN_TYPE_CCLA_RNI:
 				dn[1] = dn[0];
-				dn[0].pmu_base += CMN_HNP_PMU_EVENT_SEL;
+				dn[0].pmu_base += CMN_CCLA_PMU_EVENT_SEL;
 				dn[1].type = arm_cmn_subtype(dn->type);
 				dn += 2;
 				break;
--- linux-qcom-6.8.0.orig/drivers/perf/arm_dmc620_pmu.c
+++ linux-qcom-6.8.0/drivers/perf/arm_dmc620_pmu.c
@@ -542,12 +542,16 @@
 	if (event->cpu < 0)
 		return -EINVAL;
 
+	hwc->idx = -1;
+
+	if (event->group_leader == event)
+		return 0;
+
 	/*
 	 * We can't atomically disable all HW counters so only one event allowed,
 	 * although software events are acceptable.
 	 */
-	if (event->group_leader != event &&
-			!is_software_event(event->group_leader))
+	if (!is_software_event(event->group_leader))
 		return -EINVAL;
 
 	for_each_sibling_event(sibling, event->group_leader) {
@@ -556,7 +560,6 @@
 			return -EINVAL;
 	}
 
-	hwc->idx = -1;
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/perf/arm_pmuv3.c
+++ linux-qcom-6.8.0/drivers/perf/arm_pmuv3.c
@@ -338,6 +338,11 @@
 	return ATTR_CFG_GET_FLD(&event->attr, rdpmc);
 }
 
+static u32 armv8pmu_event_get_threshold(struct perf_event_attr *attr)
+{
+	return ATTR_CFG_GET_FLD(attr, threshold);
+}
+
 static u8 armv8pmu_event_threshold_control(struct perf_event_attr *attr)
 {
 	u8 th_compare = ATTR_CFG_GET_FLD(attr, threshold_compare);
@@ -941,7 +946,8 @@
 	unsigned long evtype = hwc->config_base & ARMV8_PMU_EVTYPE_EVENT;
 
 	/* Always prefer to place a cycle counter into the cycle counter. */
-	if (evtype == ARMV8_PMUV3_PERFCTR_CPU_CYCLES) {
+	if ((evtype == ARMV8_PMUV3_PERFCTR_CPU_CYCLES) &&
+	    !armv8pmu_event_get_threshold(&event->attr)) {
 		if (!test_and_set_bit(ARMV8_IDX_CYCLE_COUNTER, cpuc->used_mask))
 			return ARMV8_IDX_CYCLE_COUNTER;
 		else if (armv8pmu_event_is_64bit(event) &&
@@ -1033,7 +1039,7 @@
 	 * If FEAT_PMUv3_TH isn't implemented, then THWIDTH (threshold_max) will
 	 * be 0 and will also trigger this check, preventing it from being used.
 	 */
-	th = ATTR_CFG_GET_FLD(attr, threshold);
+	th = armv8pmu_event_get_threshold(attr);
 	if (th > threshold_max(cpu_pmu)) {
 		pr_debug("PMU event threshold exceeds max value\n");
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/perf/arm_smmuv3_pmu.c
+++ linux-qcom-6.8.0/drivers/perf/arm_smmuv3_pmu.c
@@ -431,6 +431,17 @@
 			return -EINVAL;
 	}
 
+	/*
+	 * Ensure all events are on the same cpu so all events are in the
+	 * same cpu context, to avoid races on pmu_enable etc.
+	 */
+	event->cpu = smmu_pmu->on_cpu;
+
+	hwc->idx = -1;
+
+	if (event->group_leader == event)
+		return 0;
+
 	for_each_sibling_event(sibling, event->group_leader) {
 		if (is_software_event(sibling))
 			continue;
@@ -442,14 +453,6 @@
 			return -EINVAL;
 	}
 
-	hwc->idx = -1;
-
-	/*
-	 * Ensure all events are on the same cpu so all events are in the
-	 * same cpu context, to avoid races on pmu_enable etc.
-	 */
-	event->cpu = smmu_pmu->on_cpu;
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/perf/arm_spe_pmu.c
+++ linux-qcom-6.8.0/drivers/perf/arm_spe_pmu.c
@@ -41,7 +41,7 @@
 
 /*
  * Cache if the event is allowed to trace Context information.
- * This allows us to perform the check, i.e, perfmon_capable(),
+ * This allows us to perform the check, i.e, perf_allow_kernel(),
  * in the context of the event owner, once, during the event_init().
  */
 #define SPE_PMU_HW_FLAGS_CX			0x00001
@@ -50,7 +50,7 @@
 
 static void set_spe_event_has_cx(struct perf_event *event)
 {
-	if (IS_ENABLED(CONFIG_PID_IN_CONTEXTIDR) && perfmon_capable())
+	if (IS_ENABLED(CONFIG_PID_IN_CONTEXTIDR) && !perf_allow_kernel(&event->attr))
 		event->hw.flags |= SPE_PMU_HW_FLAGS_CX;
 }
 
@@ -745,9 +745,8 @@
 
 	set_spe_event_has_cx(event);
 	reg = arm_spe_event_to_pmscr(event);
-	if (!perfmon_capable() &&
-	    (reg & (PMSCR_EL1_PA | PMSCR_EL1_PCT)))
-		return -EACCES;
+	if (reg & (PMSCR_EL1_PA | PMSCR_EL1_PCT))
+		return perf_allow_kernel(&event->attr);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/perf/dwc_pcie_pmu.c
+++ linux-qcom-6.8.0/drivers/perf/dwc_pcie_pmu.c
@@ -556,10 +556,10 @@
 {
 	struct platform_device *plat_dev;
 	struct dwc_pcie_dev_info *dev_info;
-	u32 bdf;
+	u32 sbdf;
 
-	bdf = PCI_DEVID(pdev->bus->number, pdev->devfn);
-	plat_dev = platform_device_register_data(NULL, "dwc_pcie_pmu", bdf,
+	sbdf = (pci_domain_nr(pdev->bus) << 16) | PCI_DEVID(pdev->bus->number, pdev->devfn);
+	plat_dev = platform_device_register_data(NULL, "dwc_pcie_pmu", sbdf,
 						 pdev, sizeof(*pdev));
 
 	if (IS_ERR(plat_dev))
@@ -611,15 +611,15 @@
 	struct pci_dev *pdev = plat_dev->dev.platform_data;
 	struct dwc_pcie_pmu *pcie_pmu;
 	char *name;
-	u32 bdf, val;
+	u32 sbdf, val;
 	u16 vsec;
 	int ret;
 
 	vsec = pci_find_vsec_capability(pdev, pdev->vendor,
 					DWC_PCIE_VSEC_RAS_DES_ID);
 	pci_read_config_dword(pdev, vsec + PCI_VNDR_HEADER, &val);
-	bdf = PCI_DEVID(pdev->bus->number, pdev->devfn);
-	name = devm_kasprintf(&plat_dev->dev, GFP_KERNEL, "dwc_rootport_%x", bdf);
+	sbdf = plat_dev->id;
+	name = devm_kasprintf(&plat_dev->dev, GFP_KERNEL, "dwc_rootport_%x", sbdf);
 	if (!name)
 		return -ENOMEM;
 
@@ -650,7 +650,7 @@
 	ret = cpuhp_state_add_instance(dwc_pcie_pmu_hp_state,
 				       &pcie_pmu->cpuhp_node);
 	if (ret) {
-		pci_err(pdev, "Error %d registering hotplug @%x\n", ret, bdf);
+		pci_err(pdev, "Error %d registering hotplug @%x\n", ret, sbdf);
 		return ret;
 	}
 
@@ -663,7 +663,7 @@
 
 	ret = perf_pmu_register(&pcie_pmu->pmu, name, -1);
 	if (ret) {
-		pci_err(pdev, "Error %d registering PMU @%x\n", ret, bdf);
+		pci_err(pdev, "Error %d registering PMU @%x\n", ret, sbdf);
 		return ret;
 	}
 	ret = devm_add_action_or_reset(&plat_dev->dev, dwc_pcie_unregister_pmu,
@@ -728,7 +728,6 @@
 static int __init dwc_pcie_pmu_init(void)
 {
 	struct pci_dev *pdev = NULL;
-	bool found = false;
 	int ret;
 
 	for_each_pci_dev(pdev) {
@@ -740,11 +739,7 @@
 			pci_dev_put(pdev);
 			return ret;
 		}
-
-		found = true;
 	}
-	if (!found)
-		return -ENODEV;
 
 	ret = cpuhp_setup_state_multi(CPUHP_AP_ONLINE_DYN,
 				      "perf/dwc_pcie_pmu:online",
--- linux-qcom-6.8.0.orig/drivers/perf/fsl_imx9_ddr_perf.c
+++ linux-qcom-6.8.0/drivers/perf/fsl_imx9_ddr_perf.c
@@ -476,12 +476,12 @@
 	hwc->idx = counter;
 	hwc->state |= PERF_HES_STOPPED;
 
-	if (flags & PERF_EF_START)
-		ddr_perf_event_start(event, flags);
-
 	/* read trans, write trans, read beat */
 	ddr_perf_monitor_config(pmu, cfg, cfg1, cfg2);
 
+	if (flags & PERF_EF_START)
+		ddr_perf_event_start(event, flags);
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/perf/hisilicon/hisi_pcie_pmu.c
+++ linux-qcom-6.8.0/drivers/perf/hisilicon/hisi_pcie_pmu.c
@@ -221,7 +221,7 @@
 	struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu);
 	struct hw_perf_event *hwc = &event->hw;
 	u64 port, trig_len, thr_len, len_mode;
-	u64 reg = HISI_PCIE_INIT_SET;
+	u64 reg = 0;
 
 	/* Config HISI_PCIE_EVENT_CTRL according to event. */
 	reg |= FIELD_PREP(HISI_PCIE_EVENT_M, hisi_pcie_get_real_event(event));
@@ -337,15 +337,27 @@
 			return false;
 
 		for (num = 0; num < counters; num++) {
+			/*
+			 * If we find a related event, then it's a valid group
+			 * since we don't need to allocate a new counter for it.
+			 */
 			if (hisi_pcie_pmu_cmp_event(event_group[num], sibling))
 				break;
 		}
 
+		/*
+		 * Otherwise it's a new event but if there's no available counter,
+		 * fail the check since we cannot schedule all the events in
+		 * the group simultaneously.
+		 */
+		if (num == HISI_PCIE_MAX_COUNTERS)
+			return false;
+
 		if (num == counters)
 			event_group[counters++] = sibling;
 	}
 
-	return counters <= HISI_PCIE_MAX_COUNTERS;
+	return true;
 }
 
 static int hisi_pcie_pmu_event_init(struct perf_event *event)
@@ -446,10 +458,24 @@
 	struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu);
 	struct hw_perf_event *hwc = &event->hw;
 	int idx = hwc->idx;
+	u64 orig_cnt, cnt;
+
+	orig_cnt = hisi_pcie_pmu_read_counter(event);
 
 	local64_set(&hwc->prev_count, HISI_PCIE_INIT_VAL);
 	hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_CNT, idx, HISI_PCIE_INIT_VAL);
 	hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EXT_CNT, idx, HISI_PCIE_INIT_VAL);
+
+	/*
+	 * The counter maybe unwritable if the target event is unsupported.
+	 * Check this by comparing the counts after setting the period. If
+	 * the counts stay unchanged after setting the period then update
+	 * the hwc->prev_count correctly. Otherwise the final counts user
+	 * get maybe totally wrong.
+	 */
+	cnt = hisi_pcie_pmu_read_counter(event);
+	if (orig_cnt == cnt)
+		local64_set(&hwc->prev_count, cnt);
 }
 
 static void hisi_pcie_pmu_enable_counter(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc)
--- linux-qcom-6.8.0.orig/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c
+++ linux-qcom-6.8.0/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c
@@ -287,12 +287,52 @@
 	return readq(uc_pmu->base + HISI_UC_CNTR_REGn(hwc->idx));
 }
 
-static void hisi_uc_pmu_write_counter(struct hisi_pmu *uc_pmu,
+static bool hisi_uc_pmu_get_glb_en_state(struct hisi_pmu *uc_pmu)
+{
+	u32 val;
+
+	val = readl(uc_pmu->base + HISI_UC_EVENT_CTRL_REG);
+	return !!FIELD_GET(HISI_UC_EVENT_GLB_EN, val);
+}
+
+static void hisi_uc_pmu_write_counter_normal(struct hisi_pmu *uc_pmu,
 				      struct hw_perf_event *hwc, u64 val)
 {
 	writeq(val, uc_pmu->base + HISI_UC_CNTR_REGn(hwc->idx));
 }
 
+static void hisi_uc_pmu_write_counter_quirk_v2(struct hisi_pmu *uc_pmu,
+				      struct hw_perf_event *hwc, u64 val)
+{
+	hisi_uc_pmu_start_counters(uc_pmu);
+	hisi_uc_pmu_write_counter_normal(uc_pmu, hwc, val);
+	hisi_uc_pmu_stop_counters(uc_pmu);
+}
+
+static void hisi_uc_pmu_write_counter(struct hisi_pmu *uc_pmu,
+				      struct hw_perf_event *hwc, u64 val)
+{
+	bool enable = hisi_uc_pmu_get_glb_en_state(uc_pmu);
+	bool erratum = uc_pmu->identifier == HISI_PMU_V2;
+
+	/*
+	 * HiSilicon UC PMU v2 suffers the erratum 162700402 that the
+	 * PMU counter cannot be set due to the lack of clock under power
+	 * saving mode. This will lead to error or inaccurate counts.
+	 * The clock can be enabled by the PMU global enabling control.
+	 * The irq handler and pmu_start() will call the function to set
+	 * period. If the function under irq context, the PMU has been
+	 * enabled therefore we set counter directly. Other situations
+	 * the PMU is disabled, we need to enable it to turn on the
+	 * counter clock to set period, and then restore PMU enable
+	 * status, the counter can hold its value without a clock.
+	 */
+	if (enable || !erratum)
+		hisi_uc_pmu_write_counter_normal(uc_pmu, hwc, val);
+	else
+		hisi_uc_pmu_write_counter_quirk_v2(uc_pmu, hwc, val);
+}
+
 static void hisi_uc_pmu_enable_counter_int(struct hisi_pmu *uc_pmu,
 					   struct hw_perf_event *hwc)
 {
--- linux-qcom-6.8.0.orig/drivers/perf/hisilicon/hns3_pmu.c
+++ linux-qcom-6.8.0/drivers/perf/hisilicon/hns3_pmu.c
@@ -1085,15 +1085,27 @@
 			return false;
 
 		for (num = 0; num < counters; num++) {
+			/*
+			 * If we find a related event, then it's a valid group
+			 * since we don't need to allocate a new counter for it.
+			 */
 			if (hns3_pmu_cmp_event(event_group[num], sibling))
 				break;
 		}
 
+		/*
+		 * Otherwise it's a new event but if there's no available counter,
+		 * fail the check since we cannot schedule all the events in
+		 * the group simultaneously.
+		 */
+		if (num == HNS3_PMU_MAX_HW_EVENTS)
+			return false;
+
 		if (num == counters)
 			event_group[counters++] = sibling;
 	}
 
-	return counters <= HNS3_PMU_MAX_HW_EVENTS;
+	return true;
 }
 
 static u32 hns3_pmu_get_filter_condition(struct perf_event *event)
@@ -1515,7 +1527,7 @@
 		return ret;
 	}
 
-	ret = devm_add_action(&pdev->dev, hns3_pmu_free_irq, pdev);
+	ret = devm_add_action_or_reset(&pdev->dev, hns3_pmu_free_irq, pdev);
 	if (ret) {
 		pci_err(pdev, "failed to add free irq action, ret = %d.\n", ret);
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/perf/riscv_pmu.c
+++ linux-qcom-6.8.0/drivers/perf/riscv_pmu.c
@@ -313,6 +313,10 @@
 	u64 event_config = 0;
 	uint64_t cmask;
 
+	/* driver does not support branch stack sampling */
+	if (has_branch_stack(event))
+		return -EOPNOTSUPP;
+
 	hwc->flags = 0;
 	mapped_event = rvpmu->event_map(event, &event_config);
 	if (mapped_event < 0) {
--- linux-qcom-6.8.0.orig/drivers/perf/riscv_pmu_legacy.c
+++ linux-qcom-6.8.0/drivers/perf/riscv_pmu_legacy.c
@@ -22,13 +22,13 @@
 	struct perf_event_attr *attr = &event->attr;
 
 	if (event->attr.type != PERF_TYPE_HARDWARE)
-		return -EOPNOTSUPP;
+		return -ENOENT;
 	if (attr->config == PERF_COUNT_HW_CPU_CYCLES)
 		return RISCV_PMU_LEGACY_CYCLE;
 	else if (attr->config == PERF_COUNT_HW_INSTRUCTIONS)
 		return RISCV_PMU_LEGACY_INSTRET;
 	else
-		return -EOPNOTSUPP;
+		return -ENOENT;
 }
 
 /* For legacy config & counter index are same */
--- linux-qcom-6.8.0.orig/drivers/perf/riscv_pmu_sbi.c
+++ linux-qcom-6.8.0/drivers/perf/riscv_pmu_sbi.c
@@ -355,7 +355,7 @@
 	 * but not in the user access mode as we want to use the other counters
 	 * that support sampling/filtering.
 	 */
-	if (hwc->flags & PERF_EVENT_FLAG_LEGACY) {
+	if ((hwc->flags & PERF_EVENT_FLAG_LEGACY) && (event->attr.type == PERF_TYPE_HARDWARE)) {
 		if (event->attr.config == PERF_COUNT_HW_CPU_CYCLES) {
 			cflags |= SBI_PMU_CFG_FLAG_SKIP_MATCH;
 			cmask = 1;
@@ -476,7 +476,7 @@
 		}
 		break;
 	default:
-		ret = -EINVAL;
+		ret = -ENOENT;
 		break;
 	}
 
@@ -611,7 +611,7 @@
 	 * which may include counters that are not enabled yet.
 	 */
 	sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_STOP,
-		  0, pmu->cmask, 0, 0, 0, 0);
+		  0, pmu->cmask, SBI_PMU_STOP_FLAG_RESET, 0, 0, 0);
 }
 
 static inline void pmu_sbi_stop_hw_ctrs(struct riscv_pmu *pmu)
--- linux-qcom-6.8.0.orig/drivers/phy/Kconfig
+++ linux-qcom-6.8.0/drivers/phy/Kconfig
@@ -72,6 +72,17 @@
 	  functional modes using gpios and sets the attribute max link
 	  rate, for CAN drivers.
 
+config PHY_NXP_PTN3222
+	tristate "NXP PTN3222 1-port eUSB2 to USB2 redriver"
+	depends on I2C
+	depends on OF
+	select GENERIC_PHY
+	help
+	  Enable this to support NXP PTN3222 1-port eUSB2 to USB2 Redriver.
+	  This redriver performs translation between eUSB2 and USB2 signalling
+	  schemes. It supports all three USB 2.0 data rates: Low Speed, Full
+	  Speed and High Speed.
+
 source "drivers/phy/allwinner/Kconfig"
 source "drivers/phy/amlogic/Kconfig"
 source "drivers/phy/broadcom/Kconfig"
--- linux-qcom-6.8.0.orig/drivers/phy/Makefile
+++ linux-qcom-6.8.0/drivers/phy/Makefile
@@ -10,6 +10,7 @@
 obj-$(CONFIG_PHY_XGENE)			+= phy-xgene.o
 obj-$(CONFIG_PHY_PISTACHIO_USB)		+= phy-pistachio-usb.o
 obj-$(CONFIG_USB_LGM_PHY)		+= phy-lgm-usb.o
+obj-$(CONFIG_PHY_NXP_PTN3222)		+= phy-nxp-ptn3222.o
 obj-y					+= allwinner/	\
 					   amlogic/	\
 					   broadcom/	\
--- linux-qcom-6.8.0.orig/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
+++ linux-qcom-6.8.0/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
@@ -323,6 +323,12 @@
 	void __iomem *ctrl = params->regs[BRCM_REGS_CTRL];
 
 	USB_CTRL_UNSET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN);
+
+	/*
+	 * The PHY might be in a bad state if it is already powered
+	 * up. Toggle the power just in case.
+	 */
+	USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN);
 	USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN);
 
 	/* 1 millisecond - for USB clocks to settle down */
--- linux-qcom-6.8.0.orig/drivers/phy/cadence/phy-cadence-torrent.c
+++ linux-qcom-6.8.0/drivers/phy/cadence/phy-cadence-torrent.c
@@ -1154,6 +1154,9 @@
 	ret = regmap_read_poll_timeout(regmap, PHY_PMA_XCVR_POWER_STATE_ACK,
 				       read_val, (read_val & mask) == value, 0,
 				       POLL_TIMEOUT_US);
+	if (ret)
+		return ret;
+
 	cdns_torrent_dp_write(regmap, PHY_PMA_XCVR_POWER_STATE_REQ, 0x00000000);
 	ndelay(100);
 
--- linux-qcom-6.8.0.orig/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
+++ linux-qcom-6.8.0/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
@@ -110,8 +110,10 @@
 		/* Source clock from SoC internal PLL */
 		writel(ANA_PLL_CLK_OUT_TO_EXT_IO_SEL,
 		       imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG062);
-		writel(AUX_PLL_REFCLK_SEL_SYS_PLL,
-		       imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG063);
+		if (imx8_phy->drvdata->variant != IMX8MM) {
+			writel(AUX_PLL_REFCLK_SEL_SYS_PLL,
+			       imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG063);
+		}
 		val = ANA_AUX_RX_TX_SEL_TX | ANA_AUX_TX_TERM;
 		writel(val | ANA_AUX_RX_TERM_GND_EN,
 		       imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG064);
@@ -139,11 +141,6 @@
 			   IMX8MM_GPR_PCIE_REF_CLK_PLL);
 	usleep_range(100, 200);
 
-	/* Do the PHY common block reset */
-	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
-			   IMX8MM_GPR_PCIE_CMN_RST,
-			   IMX8MM_GPR_PCIE_CMN_RST);
-
 	switch (imx8_phy->drvdata->variant) {
 	case IMX8MP:
 		reset_control_deassert(imx8_phy->perst);
@@ -154,6 +151,11 @@
 		break;
 	}
 
+	/* Do the PHY common block reset */
+	regmap_update_bits(imx8_phy->iomuxc_gpr, IOMUXC_GPR14,
+			   IMX8MM_GPR_PCIE_CMN_RST,
+			   IMX8MM_GPR_PCIE_CMN_RST);
+
 	/* Polling to check the phy is ready or not. */
 	ret = readl_poll_timeout(imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG075,
 				 val, val == ANA_PLL_DONE, 10, 20000);
--- linux-qcom-6.8.0.orig/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+++ linux-qcom-6.8.0/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
@@ -176,7 +176,7 @@
 		imx_phy->comp_dis_tune =
 			phy_comp_dis_tune_from_property(imx_phy->comp_dis_tune);
 
-	if (device_property_read_u32(dev, "fsl,pcs-tx-deemph-3p5db-attenuation-db",
+	if (device_property_read_u32(dev, "fsl,phy-pcs-tx-deemph-3p5db-attenuation-db",
 				     &imx_phy->pcs_tx_deemph_3p5db))
 		imx_phy->pcs_tx_deemph_3p5db = PHY_TUNE_DEFAULT;
 	else
--- linux-qcom-6.8.0.orig/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+++ linux-qcom-6.8.0/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
@@ -603,7 +603,7 @@
 	u16 val;
 
 	fix_idx = 0;
-	for (addr = 0; addr < 512; addr++) {
+	for (addr = 0; addr < ARRAY_SIZE(gbe_phy_init); addr++) {
 		/*
 		 * All PHY register values are defined in full for 3.125Gbps
 		 * SERDES speed. The values required for 1.25 Gbps are almost
@@ -611,11 +611,12 @@
 		 * comparison to 3.125 Gbps values. These register values are
 		 * stored in "gbe_phy_init_fix" array.
 		 */
-		if (!is_1gbps && gbe_phy_init_fix[fix_idx].addr == addr) {
+		if (!is_1gbps &&
+		    fix_idx < ARRAY_SIZE(gbe_phy_init_fix) &&
+		    gbe_phy_init_fix[fix_idx].addr == addr) {
 			/* Use new value */
 			val = gbe_phy_init_fix[fix_idx].value;
-			if (fix_idx < ARRAY_SIZE(gbe_phy_init_fix))
-				fix_idx++;
+			fix_idx++;
 		} else {
 			val = gbe_phy_init[addr];
 		}
--- linux-qcom-6.8.0.orig/drivers/phy/phy-core.c
+++ linux-qcom-6.8.0/drivers/phy/phy-core.c
@@ -140,8 +140,10 @@
 			return phy_provider;
 
 		for_each_child_of_node(phy_provider->children, child)
-			if (child == node)
+			if (child == node) {
+				of_node_put(child);
 				return phy_provider;
+			}
 	}
 
 	return ERR_PTR(-EPROBE_DEFER);
@@ -577,8 +579,10 @@
 		return ERR_PTR(-ENODEV);
 
 	/* This phy type handled by the usb-phy subsystem for now */
-	if (of_device_is_compatible(args.np, "usb-nop-xceiv"))
-		return ERR_PTR(-ENODEV);
+	if (of_device_is_compatible(args.np, "usb-nop-xceiv")) {
+		phy = ERR_PTR(-ENODEV);
+		goto out_put_node;
+	}
 
 	mutex_lock(&phy_provider_mutex);
 	phy_provider = of_phy_provider_lookup(args.np);
@@ -600,6 +604,7 @@
 
 out_unlock:
 	mutex_unlock(&phy_provider_mutex);
+out_put_node:
 	of_node_put(args.np);
 
 	return phy;
@@ -685,7 +690,7 @@
 	if (!phy)
 		return;
 
-	r = devres_destroy(dev, devm_phy_release, devm_phy_match, phy);
+	r = devres_release(dev, devm_phy_release, devm_phy_match, phy);
 	dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n");
 }
 EXPORT_SYMBOL_GPL(devm_phy_put);
@@ -1069,7 +1074,7 @@
 {
 	int r;
 
-	r = devres_destroy(dev, devm_phy_consume, devm_phy_match, phy);
+	r = devres_release(dev, devm_phy_consume, devm_phy_match, phy);
 	dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n");
 }
 EXPORT_SYMBOL_GPL(devm_phy_destroy);
@@ -1207,12 +1212,12 @@
  * of_phy_provider_unregister to unregister the phy provider.
  */
 void devm_of_phy_provider_unregister(struct device *dev,
-	struct phy_provider *phy_provider)
+				     struct phy_provider *phy_provider)
 {
 	int r;
 
-	r = devres_destroy(dev, devm_phy_provider_release, devm_phy_match,
-		phy_provider);
+	r = devres_release(dev, devm_phy_provider_release, devm_phy_match,
+			   phy_provider);
 	dev_WARN_ONCE(dev, r, "couldn't find PHY provider device resource\n");
 }
 EXPORT_SYMBOL_GPL(devm_of_phy_provider_unregister);
--- linux-qcom-6.8.0.orig/drivers/phy/phy-nxp-ptn3222.c
+++ linux-qcom-6.8.0/drivers/phy/phy-nxp-ptn3222.c
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2024, Linaro Limited
+ */
+
+#include <linux/gpio/consumer.h>
+#include <linux/i2c.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/phy/phy.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+
+#define NUM_SUPPLIES 2
+
+struct ptn3222 {
+	struct i2c_client *client;
+	struct phy *phy;
+	struct gpio_desc *reset_gpio;
+	struct regulator_bulk_data *supplies;
+};
+
+static int ptn3222_init(struct phy *phy)
+{
+	struct ptn3222 *ptn3222 = phy_get_drvdata(phy);
+	int ret;
+
+	ret = regulator_bulk_enable(NUM_SUPPLIES, ptn3222->supplies);
+	if (ret)
+		return ret;
+
+	gpiod_set_value_cansleep(ptn3222->reset_gpio, 0);
+
+	return 0;
+}
+
+static int ptn3222_exit(struct phy *phy)
+{
+	struct ptn3222 *ptn3222 = phy_get_drvdata(phy);
+
+	gpiod_set_value_cansleep(ptn3222->reset_gpio, 1);
+
+	return regulator_bulk_disable(NUM_SUPPLIES, ptn3222->supplies);
+}
+
+static const struct phy_ops ptn3222_ops = {
+	.init		= ptn3222_init,
+	.exit		= ptn3222_exit,
+	.owner		= THIS_MODULE,
+};
+
+static const struct regulator_bulk_data ptn3222_supplies[NUM_SUPPLIES] = {
+	{
+		.supply = "vdd3v3",
+		.init_load_uA = 11000,
+	}, {
+		.supply = "vdd1v8",
+		.init_load_uA = 55000,
+	}
+};
+
+static int ptn3222_probe(struct i2c_client *client)
+{
+	struct device *dev = &client->dev;
+	struct phy_provider *phy_provider;
+	struct ptn3222 *ptn3222;
+	int ret;
+
+	ptn3222 = devm_kzalloc(dev, sizeof(*ptn3222), GFP_KERNEL);
+	if (!ptn3222)
+		return -ENOMEM;
+
+	ptn3222->client = client;
+
+	ptn3222->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+						      GPIOD_OUT_HIGH);
+	if (IS_ERR(ptn3222->reset_gpio))
+		return dev_err_probe(dev, PTR_ERR(ptn3222->reset_gpio),
+				     "unable to acquire reset gpio\n");
+
+	ret = devm_regulator_bulk_get_const(dev, NUM_SUPPLIES, ptn3222_supplies,
+					    &ptn3222->supplies);
+	if (ret)
+		return ret;
+
+	ptn3222->phy = devm_phy_create(dev, dev->of_node, &ptn3222_ops);
+	if (IS_ERR(ptn3222->phy)) {
+		dev_err(dev, "failed to create PHY: %d\n", ret);
+		return PTR_ERR(ptn3222->phy);
+	}
+
+	phy_set_drvdata(ptn3222->phy, ptn3222);
+
+	phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
+
+	return PTR_ERR_OR_ZERO(phy_provider);
+}
+
+static const struct i2c_device_id ptn3222_table[] = {
+	{ "ptn3222" },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, ptn3222_table);
+
+static const struct of_device_id ptn3222_of_table[] = {
+	{ .compatible = "nxp,ptn3222" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, ptn3222_of_table);
+
+static struct i2c_driver ptn3222_driver = {
+	.driver = {
+		.name = "ptn3222",
+		.of_match_table = ptn3222_of_table,
+	},
+	.probe = ptn3222_probe,
+	.id_table = ptn3222_table,
+};
+
+module_i2c_driver(ptn3222_driver);
+
+MODULE_DESCRIPTION("NXP PTN3222 eUSB2 Redriver driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/Makefile
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/Makefile
@@ -7,7 +7,7 @@
 obj-$(CONFIG_PHY_QCOM_M31_USB)		+= phy-qcom-m31.o
 obj-$(CONFIG_PHY_QCOM_PCIE2)		+= phy-qcom-pcie2.o
 
-obj-$(CONFIG_PHY_QCOM_QMP_COMBO)	+= phy-qcom-qmp-combo.o
+obj-$(CONFIG_PHY_QCOM_QMP_COMBO)	+= phy-qcom-qmp-combo.o phy-qcom-qmp-usbc.o
 obj-$(CONFIG_PHY_QCOM_QMP_PCIE)		+= phy-qcom-qmp-pcie.o
 obj-$(CONFIG_PHY_QCOM_QMP_PCIE_8996)	+= phy-qcom-qmp-pcie-msm8996.o
 obj-$(CONFIG_PHY_QCOM_QMP_UFS)		+= phy-qcom-qmp-ufs.o
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-edp.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-edp.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/phy/phy.h>
+#include <linux/phy/phy-dp.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/consumer.h>
 #include <linux/reset.h>
@@ -21,7 +22,9 @@
 
 #include <dt-bindings/phy/phy.h>
 
-#include "phy-qcom-qmp.h"
+#include "phy-qcom-qmp-dp-phy.h"
+#include "phy-qcom-qmp-qserdes-com-v4.h"
+#include "phy-qcom-qmp-qserdes-com-v6.h"
 
 /* EDP_PHY registers */
 #define DP_PHY_CFG                              0x0010
@@ -68,19 +71,39 @@
 
 #define TXn_TRAN_DRVR_EMP_EN                    0x0078
 
-struct qcom_edp_cfg {
-	bool is_dp;
+enum edp_ver {
+	EDP_VER_4,
+	EDP_VER_5,
+	EDP_VER_6,
+};
 
-	/* DP PHY swing and pre_emphasis tables */
+struct qcom_edp_swing_pre_emph_cfg {
 	const u8 (*swing_hbr_rbr)[4][4];
 	const u8 (*swing_hbr3_hbr2)[4][4];
 	const u8 (*pre_emphasis_hbr_rbr)[4][4];
 	const u8 (*pre_emphasis_hbr3_hbr2)[4][4];
 };
 
+struct qcom_edp;
+
+struct phy_ver_ops {
+	int (*com_power_on)(const struct qcom_edp *edp);
+	int (*com_resetsm_cntrl)(const struct qcom_edp *edp);
+	int (*com_bias_en_clkbuflr)(const struct qcom_edp *edp);
+	int (*com_configure_pll)(const struct qcom_edp *edp);
+	int (*com_configure_ssc)(const struct qcom_edp *edp);
+};
+
+struct qcom_edp_phy_cfg {
+	bool is_edp;
+	enum edp_ver ver;
+	const struct qcom_edp_swing_pre_emph_cfg *swing_pre_emph_cfg;
+	const struct phy_ver_ops *ver_ops;
+};
+
 struct qcom_edp {
 	struct device *dev;
-	const struct qcom_edp_cfg *cfg;
+	const struct qcom_edp_phy_cfg *cfg;
 
 	struct phy *phy;
 
@@ -96,6 +119,8 @@
 
 	struct clk_bulk_data clks[2];
 	struct regulator_bulk_data supplies[2];
+
+	bool is_edp;
 };
 
 static const u8 dp_swing_hbr_rbr[4][4] = {
@@ -126,8 +151,7 @@
 	{ 0x04, 0xff, 0xff, 0xff }
 };
 
-static const struct qcom_edp_cfg dp_phy_cfg = {
-	.is_dp = true,
+static const struct qcom_edp_swing_pre_emph_cfg dp_phy_swing_pre_emph_cfg = {
 	.swing_hbr_rbr = &dp_swing_hbr_rbr,
 	.swing_hbr3_hbr2 = &dp_swing_hbr2_hbr3,
 	.pre_emphasis_hbr_rbr = &dp_pre_emp_hbr_rbr,
@@ -162,20 +186,53 @@
 	{ 0x00, 0xff, 0xff, 0xff }
 };
 
-static const struct qcom_edp_cfg edp_phy_cfg = {
-	.is_dp = false,
+static const struct qcom_edp_swing_pre_emph_cfg edp_phy_swing_pre_emph_cfg = {
 	.swing_hbr_rbr = &edp_swing_hbr_rbr,
 	.swing_hbr3_hbr2 = &edp_swing_hbr2_hbr3,
 	.pre_emphasis_hbr_rbr = &edp_pre_emp_hbr_rbr,
 	.pre_emphasis_hbr3_hbr2 = &edp_pre_emp_hbr2_hbr3,
 };
 
+static const u8 edp_swing_hbr_rbr_v5[4][4] = {
+	{ 0x07, 0x0f, 0x16, 0x1f },
+	{ 0x0d, 0x16, 0x1e, 0xff },
+	{ 0x11, 0x1b, 0xff, 0xff },
+	{ 0x16, 0xff, 0xff, 0xff }
+};
+
+static const u8 edp_pre_emp_hbr_rbr_v5[4][4] = {
+	{ 0x05, 0x11, 0x17, 0x1d },
+	{ 0x05, 0x11, 0x18, 0xff },
+	{ 0x06, 0x11, 0xff, 0xff },
+	{ 0x00, 0xff, 0xff, 0xff }
+};
+
+static const u8 edp_swing_hbr2_hbr3_v5[4][4] = {
+	{ 0x0b, 0x11, 0x17, 0x1c },
+	{ 0x10, 0x19, 0x1f, 0xff },
+	{ 0x19, 0x1f, 0xff, 0xff },
+	{ 0x1f, 0xff, 0xff, 0xff }
+};
+
+static const u8 edp_pre_emp_hbr2_hbr3_v5[4][4] = {
+	{ 0x0c, 0x15, 0x19, 0x1e },
+	{ 0x0b, 0x15, 0x19, 0xff },
+	{ 0x0e, 0x14, 0xff, 0xff },
+	{ 0x0d, 0xff, 0xff, 0xff }
+};
+
+static const struct qcom_edp_swing_pre_emph_cfg edp_phy_swing_pre_emph_cfg_v5 = {
+	.swing_hbr_rbr = &edp_swing_hbr_rbr_v5,
+	.swing_hbr3_hbr2 = &edp_swing_hbr2_hbr3_v5,
+	.pre_emphasis_hbr_rbr = &edp_pre_emp_hbr_rbr_v5,
+	.pre_emphasis_hbr3_hbr2 = &edp_pre_emp_hbr2_hbr3_v5,
+};
+
 static int qcom_edp_phy_init(struct phy *phy)
 {
 	struct qcom_edp *edp = phy_get_drvdata(phy);
-	const struct qcom_edp_cfg *cfg = edp->cfg;
 	int ret;
-	u8 cfg8;
+	u8 cfg2, cfg8;
 
 	ret = regulator_bulk_enable(ARRAY_SIZE(edp->supplies), edp->supplies);
 	if (ret)
@@ -189,8 +246,9 @@
 	       DP_PHY_PD_CTL_PLL_PWRDN | DP_PHY_PD_CTL_DP_CLAMP_EN,
 	       edp->edp + DP_PHY_PD_CTL);
 
-	/* Turn on BIAS current for PHY/PLL */
-	writel(0x17, edp->pll + QSERDES_V4_COM_BIAS_EN_CLKBUFLR_EN);
+	ret = edp->cfg->ver_ops->com_bias_en_clkbuflr(edp);
+	if (ret)
+		return ret;
 
 	writel(DP_PHY_PD_CTL_PSR_PWRDN, edp->edp + DP_PHY_PD_CTL);
 	msleep(20);
@@ -200,16 +258,26 @@
 	       DP_PHY_PD_CTL_PLL_PWRDN | DP_PHY_PD_CTL_DP_CLAMP_EN,
 	       edp->edp + DP_PHY_PD_CTL);
 
-	if (cfg && cfg->is_dp)
+	/*
+	 * TODO: Re-work the conditions around setting the cfg8 value
+	 * when more information becomes available about why this is
+	 * even needed.
+	 */
+	if (edp->cfg->swing_pre_emph_cfg && !edp->is_edp)
 		cfg8 = 0xb7;
 	else
 		cfg8 = 0x37;
 
+	if (edp->cfg->ver == EDP_VER_5)
+		cfg2 = 0xa4;
+	else
+		cfg2 = 0x24;
+
 	writel(0xfc, edp->edp + DP_PHY_MODE);
 
 	writel(0x00, edp->edp + DP_PHY_AUX_CFG0);
 	writel(0x13, edp->edp + DP_PHY_AUX_CFG1);
-	writel(0x24, edp->edp + DP_PHY_AUX_CFG2);
+	writel(cfg2, edp->edp + DP_PHY_AUX_CFG2);
 	writel(0x00, edp->edp + DP_PHY_AUX_CFG3);
 	writel(0x0a, edp->edp + DP_PHY_AUX_CFG4);
 	writel(0x26, edp->edp + DP_PHY_AUX_CFG5);
@@ -234,7 +302,7 @@
 
 static int qcom_edp_set_voltages(struct qcom_edp *edp, const struct phy_configure_opts_dp *dp_opts)
 {
-	const struct qcom_edp_cfg *cfg = edp->cfg;
+	const struct qcom_edp_swing_pre_emph_cfg *cfg = edp->cfg->swing_pre_emph_cfg;
 	unsigned int v_level = 0;
 	unsigned int p_level = 0;
 	u8 ldo_config;
@@ -245,6 +313,9 @@
 	if (!cfg)
 		return 0;
 
+	if (edp->is_edp)
+		cfg = &edp_phy_swing_pre_emph_cfg;
+
 	for (i = 0; i < dp_opts->lanes; i++) {
 		v_level = max(v_level, dp_opts->voltage[i]);
 		p_level = max(p_level, dp_opts->pre[i]);
@@ -261,7 +332,7 @@
 	if (swing == 0xff || emph == 0xff)
 		return -EINVAL;
 
-	ldo_config = (cfg && cfg->is_dp) ? 0x1 : 0x0;
+	ldo_config = edp->is_edp ? 0x0 : 0x1;
 
 	writel(ldo_config, edp->tx0 + TXn_LDO_CONFIG);
 	writel(swing, edp->tx0 + TXn_TX_DRV_LVL);
@@ -290,6 +361,84 @@
 
 static int qcom_edp_configure_ssc(const struct qcom_edp *edp)
 {
+	return edp->cfg->ver_ops->com_configure_ssc(edp);
+}
+
+static int qcom_edp_configure_pll(const struct qcom_edp *edp)
+{
+	return edp->cfg->ver_ops->com_configure_pll(edp);
+}
+
+static int qcom_edp_set_vco_div(const struct qcom_edp *edp, unsigned long *pixel_freq)
+{
+	const struct phy_configure_opts_dp *dp_opts = &edp->dp_opts;
+	u32 vco_div;
+
+	switch (dp_opts->link_rate) {
+	case 1620:
+		vco_div = 0x1;
+		*pixel_freq = 1620000000UL / 2;
+		break;
+
+	case 2700:
+		vco_div = 0x1;
+		*pixel_freq = 2700000000UL / 2;
+		break;
+
+	case 5400:
+		vco_div = 0x2;
+		*pixel_freq = 5400000000UL / 4;
+		break;
+
+	case 8100:
+		vco_div = 0x0;
+		*pixel_freq = 8100000000UL / 6;
+		break;
+
+	default:
+		/* Other link rates aren't supported */
+		return -EINVAL;
+	}
+
+	writel(vco_div, edp->edp + DP_PHY_VCO_DIV);
+
+	return 0;
+}
+
+static int qcom_edp_phy_power_on_v4(const struct qcom_edp *edp)
+{
+	u32 val;
+
+	writel(DP_PHY_PD_CTL_PWRDN | DP_PHY_PD_CTL_AUX_PWRDN |
+	       DP_PHY_PD_CTL_LANE_0_1_PWRDN | DP_PHY_PD_CTL_LANE_2_3_PWRDN |
+	       DP_PHY_PD_CTL_PLL_PWRDN | DP_PHY_PD_CTL_DP_CLAMP_EN,
+	       edp->edp + DP_PHY_PD_CTL);
+	writel(0xfc, edp->edp + DP_PHY_MODE);
+
+	return readl_poll_timeout(edp->pll + QSERDES_V4_COM_CMN_STATUS,
+				     val, val & BIT(7), 5, 200);
+}
+
+static int qcom_edp_phy_com_resetsm_cntrl_v4(const struct qcom_edp *edp)
+{
+	u32 val;
+
+	writel(0x20, edp->pll + QSERDES_V4_COM_RESETSM_CNTRL);
+
+	return readl_poll_timeout(edp->pll + QSERDES_V4_COM_C_READY_STATUS,
+				     val, val & BIT(0), 500, 10000);
+}
+
+static int qcom_edp_com_bias_en_clkbuflr_v4(const struct qcom_edp *edp)
+{
+	/* Turn on BIAS current for PHY/PLL */
+	writel(0x17, edp->pll + QSERDES_V4_COM_BIAS_EN_CLKBUFLR_EN);
+
+	return 0;
+}
+
+static int qcom_edp_com_configure_ssc_v4(const struct qcom_edp *edp)
+{
 	const struct phy_configure_opts_dp *dp_opts = &edp->dp_opts;
 	u32 step1;
 	u32 step2;
@@ -322,7 +471,7 @@
 	return 0;
 }
 
-static int qcom_edp_configure_pll(const struct qcom_edp *edp)
+static int qcom_edp_com_configure_pll_v4(const struct qcom_edp *edp)
 {
 	const struct phy_configure_opts_dp *dp_opts = &edp->dp_opts;
 	u32 div_frac_start2_mode0;
@@ -408,30 +557,164 @@
 	return 0;
 }
 
-static int qcom_edp_set_vco_div(const struct qcom_edp *edp, unsigned long *pixel_freq)
+static const struct phy_ver_ops qcom_edp_phy_ops_v4 = {
+	.com_power_on		= qcom_edp_phy_power_on_v4,
+	.com_resetsm_cntrl	= qcom_edp_phy_com_resetsm_cntrl_v4,
+	.com_bias_en_clkbuflr	= qcom_edp_com_bias_en_clkbuflr_v4,
+	.com_configure_pll	= qcom_edp_com_configure_pll_v4,
+	.com_configure_ssc	= qcom_edp_com_configure_ssc_v4,
+};
+
+static const struct qcom_edp_phy_cfg qcs8300_dp_phy_cfg = {
+	.is_edp = false,
+	.ver = EDP_VER_5,
+	.swing_pre_emph_cfg = &edp_phy_swing_pre_emph_cfg_v5,
+	.ver_ops = &qcom_edp_phy_ops_v4,
+};
+
+static const struct qcom_edp_phy_cfg sa8775p_dp_phy_cfg = {
+	.is_edp = false,
+	.ver = EDP_VER_5,
+	.swing_pre_emph_cfg = &edp_phy_swing_pre_emph_cfg_v5,
+	.ver_ops = &qcom_edp_phy_ops_v4,
+};
+
+static const struct qcom_edp_phy_cfg sc7280_dp_phy_cfg = {
+	.ver_ops = &qcom_edp_phy_ops_v4,
+};
+
+static const struct qcom_edp_phy_cfg sc8280xp_dp_phy_cfg = {
+	.swing_pre_emph_cfg = &dp_phy_swing_pre_emph_cfg,
+	.ver_ops = &qcom_edp_phy_ops_v4,
+};
+
+static const struct qcom_edp_phy_cfg sc8280xp_edp_phy_cfg = {
+	.is_edp = true,
+	.swing_pre_emph_cfg = &edp_phy_swing_pre_emph_cfg,
+	.ver_ops = &qcom_edp_phy_ops_v4,
+};
+
+static int qcom_edp_phy_power_on_v6(const struct qcom_edp *edp)
+{
+	u32 val;
+
+	writel(DP_PHY_PD_CTL_PWRDN | DP_PHY_PD_CTL_AUX_PWRDN |
+	       DP_PHY_PD_CTL_LANE_0_1_PWRDN | DP_PHY_PD_CTL_LANE_2_3_PWRDN |
+	       DP_PHY_PD_CTL_PLL_PWRDN | DP_PHY_PD_CTL_DP_CLAMP_EN,
+	       edp->edp + DP_PHY_PD_CTL);
+	writel(0xfc, edp->edp + DP_PHY_MODE);
+
+	return readl_poll_timeout(edp->pll + QSERDES_V6_COM_CMN_STATUS,
+				     val, val & BIT(7), 5, 200);
+}
+
+static int qcom_edp_phy_com_resetsm_cntrl_v6(const struct qcom_edp *edp)
+{
+	u32 val;
+
+	writel(0x20, edp->pll + QSERDES_V6_COM_RESETSM_CNTRL);
+
+	return readl_poll_timeout(edp->pll + QSERDES_V6_COM_C_READY_STATUS,
+				     val, val & BIT(0), 500, 10000);
+}
+
+static int qcom_edp_com_bias_en_clkbuflr_v6(const struct qcom_edp *edp)
+{
+	/* Turn on BIAS current for PHY/PLL */
+	writel(0x1f, edp->pll + QSERDES_V6_COM_PLL_BIAS_EN_CLK_BUFLR_EN);
+
+	return 0;
+}
+
+static int qcom_edp_com_configure_ssc_v6(const struct qcom_edp *edp)
 {
 	const struct phy_configure_opts_dp *dp_opts = &edp->dp_opts;
-	u32 vco_div;
+	u32 step1;
+	u32 step2;
 
 	switch (dp_opts->link_rate) {
 	case 1620:
-		vco_div = 0x1;
-		*pixel_freq = 1620000000UL / 2;
+	case 2700:
+	case 8100:
+		step1 = 0x92;
+		step2 = 0x01;
+		break;
+
+	case 5400:
+		step1 = 0x18;
+		step2 = 0x02;
+		break;
+
+	default:
+		/* Other link rates aren't supported */
+		return -EINVAL;
+	}
+
+	writel(0x01, edp->pll + QSERDES_V6_COM_SSC_EN_CENTER);
+	writel(0x00, edp->pll + QSERDES_V6_COM_SSC_ADJ_PER1);
+	writel(0x36, edp->pll + QSERDES_V6_COM_SSC_PER1);
+	writel(0x01, edp->pll + QSERDES_V6_COM_SSC_PER2);
+	writel(step1, edp->pll + QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0);
+	writel(step2, edp->pll + QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0);
+
+	return 0;
+}
+
+static int qcom_edp_com_configure_pll_v6(const struct qcom_edp *edp)
+{
+	const struct phy_configure_opts_dp *dp_opts = &edp->dp_opts;
+	u32 div_frac_start2_mode0;
+	u32 div_frac_start3_mode0;
+	u32 dec_start_mode0;
+	u32 lock_cmp1_mode0;
+	u32 lock_cmp2_mode0;
+	u32 code1_mode0;
+	u32 code2_mode0;
+	u32 hsclk_sel;
+
+	switch (dp_opts->link_rate) {
+	case 1620:
+		hsclk_sel = 0x5;
+		dec_start_mode0 = 0x34;
+		div_frac_start2_mode0 = 0xc0;
+		div_frac_start3_mode0 = 0x0b;
+		lock_cmp1_mode0 = 0x37;
+		lock_cmp2_mode0 = 0x04;
+		code1_mode0 = 0x71;
+		code2_mode0 = 0x0c;
 		break;
 
 	case 2700:
-		vco_div = 0x1;
-		*pixel_freq = 2700000000UL / 2;
+		hsclk_sel = 0x3;
+		dec_start_mode0 = 0x34;
+		div_frac_start2_mode0 = 0xc0;
+		div_frac_start3_mode0 = 0x0b;
+		lock_cmp1_mode0 = 0x07;
+		lock_cmp2_mode0 = 0x07;
+		code1_mode0 = 0x71;
+		code2_mode0 = 0x0c;
 		break;
 
 	case 5400:
-		vco_div = 0x2;
-		*pixel_freq = 5400000000UL / 4;
+		hsclk_sel = 0x1;
+		dec_start_mode0 = 0x46;
+		div_frac_start2_mode0 = 0x00;
+		div_frac_start3_mode0 = 0x05;
+		lock_cmp1_mode0 = 0x0f;
+		lock_cmp2_mode0 = 0x0e;
+		code1_mode0 = 0x97;
+		code2_mode0 = 0x10;
 		break;
 
 	case 8100:
-		vco_div = 0x0;
-		*pixel_freq = 8100000000UL / 6;
+		hsclk_sel = 0x0;
+		dec_start_mode0 = 0x34;
+		div_frac_start2_mode0 = 0xc0;
+		div_frac_start3_mode0 = 0x0b;
+		lock_cmp1_mode0 = 0x17;
+		lock_cmp2_mode0 = 0x15;
+		code1_mode0 = 0x71;
+		code2_mode0 = 0x0c;
 		break;
 
 	default:
@@ -439,36 +722,72 @@
 		return -EINVAL;
 	}
 
-	writel(vco_div, edp->edp + DP_PHY_VCO_DIV);
+	writel(0x01, edp->pll + QSERDES_V6_COM_SVS_MODE_CLK_SEL);
+	writel(0x0b, edp->pll + QSERDES_V6_COM_SYSCLK_EN_SEL);
+	writel(0x02, edp->pll + QSERDES_V6_COM_SYS_CLK_CTRL);
+	writel(0x0c, edp->pll + QSERDES_V6_COM_CLK_ENABLE1);
+	writel(0x06, edp->pll + QSERDES_V6_COM_SYSCLK_BUF_ENABLE);
+	writel(0x30, edp->pll + QSERDES_V6_COM_CLK_SELECT);
+	writel(hsclk_sel, edp->pll + QSERDES_V6_COM_HSCLK_SEL_1);
+	writel(0x07, edp->pll + QSERDES_V6_COM_PLL_IVCO);
+	writel(0x08, edp->pll + QSERDES_V6_COM_LOCK_CMP_EN);
+	writel(0x36, edp->pll + QSERDES_V6_COM_PLL_CCTRL_MODE0);
+	writel(0x16, edp->pll + QSERDES_V6_COM_PLL_RCTRL_MODE0);
+	writel(0x06, edp->pll + QSERDES_V6_COM_CP_CTRL_MODE0);
+	writel(dec_start_mode0, edp->pll + QSERDES_V6_COM_DEC_START_MODE0);
+	writel(0x00, edp->pll + QSERDES_V6_COM_DIV_FRAC_START1_MODE0);
+	writel(div_frac_start2_mode0, edp->pll + QSERDES_V6_COM_DIV_FRAC_START2_MODE0);
+	writel(div_frac_start3_mode0, edp->pll + QSERDES_V6_COM_DIV_FRAC_START3_MODE0);
+	writel(0x12, edp->pll + QSERDES_V6_COM_CMN_CONFIG_1);
+	writel(0x3f, edp->pll + QSERDES_V6_COM_INTEGLOOP_GAIN0_MODE0);
+	writel(0x00, edp->pll + QSERDES_V6_COM_INTEGLOOP_GAIN1_MODE0);
+	writel(0x00, edp->pll + QSERDES_V6_COM_VCO_TUNE_MAP);
+	writel(lock_cmp1_mode0, edp->pll + QSERDES_V6_COM_LOCK_CMP1_MODE0);
+	writel(lock_cmp2_mode0, edp->pll + QSERDES_V6_COM_LOCK_CMP2_MODE0);
+
+	writel(0x0a, edp->pll + QSERDES_V6_COM_BG_TIMER);
+	writel(0x14, edp->pll + QSERDES_V6_COM_PLL_CORE_CLK_DIV_MODE0);
+	writel(0x00, edp->pll + QSERDES_V6_COM_VCO_TUNE_CTRL);
+	writel(0x1f, edp->pll + QSERDES_V6_COM_PLL_BIAS_EN_CLK_BUFLR_EN);
+	writel(0x0f, edp->pll + QSERDES_V6_COM_CORE_CLK_EN);
+	writel(0xa0, edp->pll + QSERDES_V6_COM_VCO_TUNE1_MODE0);
+	writel(0x03, edp->pll + QSERDES_V6_COM_VCO_TUNE2_MODE0);
+
+	writel(code1_mode0, edp->pll + QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE1_MODE0);
+	writel(code2_mode0, edp->pll + QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0);
 
 	return 0;
 }
 
+static const struct phy_ver_ops qcom_edp_phy_ops_v6 = {
+	.com_power_on		= qcom_edp_phy_power_on_v6,
+	.com_resetsm_cntrl	= qcom_edp_phy_com_resetsm_cntrl_v6,
+	.com_bias_en_clkbuflr	= qcom_edp_com_bias_en_clkbuflr_v6,
+	.com_configure_pll	= qcom_edp_com_configure_pll_v6,
+	.com_configure_ssc	= qcom_edp_com_configure_ssc_v6,
+};
+
+static struct qcom_edp_phy_cfg x1e80100_phy_cfg = {
+	.swing_pre_emph_cfg = &dp_phy_swing_pre_emph_cfg,
+	.ver_ops = &qcom_edp_phy_ops_v6,
+};
+
 static int qcom_edp_phy_power_on(struct phy *phy)
 {
 	const struct qcom_edp *edp = phy_get_drvdata(phy);
-	const struct qcom_edp_cfg *cfg = edp->cfg;
 	u32 bias0_en, drvr0_en, bias1_en, drvr1_en;
 	unsigned long pixel_freq;
-	u8 ldo_config;
-	int timeout;
+	u8 ldo_config = 0x0;
 	int ret;
 	u32 val;
 	u8 cfg1;
 
-	writel(DP_PHY_PD_CTL_PWRDN | DP_PHY_PD_CTL_AUX_PWRDN |
-	       DP_PHY_PD_CTL_LANE_0_1_PWRDN | DP_PHY_PD_CTL_LANE_2_3_PWRDN |
-	       DP_PHY_PD_CTL_PLL_PWRDN | DP_PHY_PD_CTL_DP_CLAMP_EN,
-	       edp->edp + DP_PHY_PD_CTL);
-	writel(0xfc, edp->edp + DP_PHY_MODE);
-
-	timeout = readl_poll_timeout(edp->pll + QSERDES_V4_COM_CMN_STATUS,
-				     val, val & BIT(7), 5, 200);
-	if (timeout)
-		return timeout;
-
+	ret = edp->cfg->ver_ops->com_power_on(edp);
+	if (ret)
+		return ret;
 
-	ldo_config = (cfg && cfg->is_dp) ? 0x1 : 0x0;
+	if (edp->cfg->swing_pre_emph_cfg && !edp->is_edp)
+		ldo_config = 0x1;
 
 	writel(ldo_config, edp->tx0 + TXn_LDO_CONFIG);
 	writel(ldo_config, edp->tx1 + TXn_LDO_CONFIG);
@@ -512,12 +831,9 @@
 	writel(0x01, edp->edp + DP_PHY_CFG);
 	writel(0x09, edp->edp + DP_PHY_CFG);
 
-	writel(0x20, edp->pll + QSERDES_V4_COM_RESETSM_CNTRL);
-
-	timeout = readl_poll_timeout(edp->pll + QSERDES_V4_COM_C_READY_STATUS,
-				     val, val & BIT(0), 500, 10000);
-	if (timeout)
-		return timeout;
+	ret = edp->cfg->ver_ops->com_resetsm_cntrl(edp);
+	if (ret)
+		return ret;
 
 	writel(0x19, edp->edp + DP_PHY_CFG);
 	writel(0x1f, edp->tx0 + TXn_HIGHZ_DRVR_EN);
@@ -589,6 +905,18 @@
 	return 0;
 }
 
+static int qcom_edp_phy_set_mode(struct phy *phy, enum phy_mode mode, int submode)
+{
+	struct qcom_edp *edp = phy_get_drvdata(phy);
+
+	if (mode != PHY_MODE_DP)
+		return -EINVAL;
+
+	edp->is_edp = submode == PHY_SUBMODE_EDP;
+
+	return 0;
+}
+
 static int qcom_edp_phy_exit(struct phy *phy)
 {
 	struct qcom_edp *edp = phy_get_drvdata(phy);
@@ -604,6 +932,7 @@
 	.configure	= qcom_edp_phy_configure,
 	.power_on	= qcom_edp_phy_power_on,
 	.power_off	= qcom_edp_phy_power_off,
+	.set_mode	= qcom_edp_phy_set_mode,
 	.exit		= qcom_edp_phy_exit,
 	.owner		= THIS_MODULE,
 };
@@ -781,6 +1110,7 @@
 
 	edp->dev = dev;
 	edp->cfg = of_device_get_match_data(&pdev->dev);
+	edp->is_edp = edp->cfg->is_edp;
 
 	edp->edp = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(edp->edp))
@@ -839,10 +1169,13 @@
 }
 
 static const struct of_device_id qcom_edp_phy_match_table[] = {
-	{ .compatible = "qcom,sc7280-edp-phy" },
-	{ .compatible = "qcom,sc8180x-edp-phy" },
-	{ .compatible = "qcom,sc8280xp-dp-phy", .data = &dp_phy_cfg },
-	{ .compatible = "qcom,sc8280xp-edp-phy", .data = &edp_phy_cfg },
+	{ .compatible = "qcom,qcs8300-edp-phy", .data = &qcs8300_dp_phy_cfg, },
+	{ .compatible = "qcom,sa8775p-edp-phy", .data = &sa8775p_dp_phy_cfg, },
+	{ .compatible = "qcom,sc7280-edp-phy", .data = &sc7280_dp_phy_cfg, },
+	{ .compatible = "qcom,sc8180x-edp-phy", .data = &sc7280_dp_phy_cfg, },
+	{ .compatible = "qcom,sc8280xp-dp-phy", .data = &sc8280xp_dp_phy_cfg, },
+	{ .compatible = "qcom,sc8280xp-edp-phy", .data = &sc8280xp_edp_phy_cfg, },
+	{ .compatible = "qcom,x1e80100-dp-phy", .data = &x1e80100_phy_cfg, },
 	{ }
 };
 MODULE_DEVICE_TABLE(of, qcom_edp_phy_match_table);
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-m31.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-m31.c
@@ -297,7 +297,7 @@
 		return dev_err_probe(dev, PTR_ERR(qphy->phy),
 				     "failed to create phy\n");
 
-	qphy->vreg = devm_regulator_get(dev, "vdda-phy");
+	qphy->vreg = devm_regulator_get(dev, "vdd");
 	if (IS_ERR(qphy->vreg))
 		return dev_err_probe(dev, PTR_ERR(qphy->vreg),
 				     "failed to get vreg\n");
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
@@ -25,21 +25,21 @@
 
 #include <dt-bindings/phy/phy-qcom-qmp.h>
 
+#include "phy-qcom-qmp-common.h"
+
 #include "phy-qcom-qmp.h"
 #include "phy-qcom-qmp-pcs-misc-v3.h"
 #include "phy-qcom-qmp-pcs-usb-v4.h"
 #include "phy-qcom-qmp-pcs-usb-v5.h"
 #include "phy-qcom-qmp-pcs-usb-v6.h"
 
-/* QPHY_SW_RESET bit */
-#define SW_RESET				BIT(0)
-/* QPHY_POWER_DOWN_CONTROL */
-#define SW_PWRDN				BIT(0)
-/* QPHY_START_CONTROL bits */
-#define SERDES_START				BIT(0)
-#define PCS_START				BIT(1)
-/* QPHY_PCS_STATUS bit */
-#define PHYSTATUS				BIT(6)
+#include "phy-qcom-qmp-dp-com-v3.h"
+
+#include "phy-qcom-qmp-dp-phy.h"
+#include "phy-qcom-qmp-dp-phy-v3.h"
+#include "phy-qcom-qmp-dp-phy-v4.h"
+#include "phy-qcom-qmp-dp-phy-v5.h"
+#include "phy-qcom-qmp-dp-phy-v6.h"
 
 /* QPHY_V3_DP_COM_RESET_OVRD_CTRL register bits */
 /* DP PHY soft reset */
@@ -55,47 +55,12 @@
 #define USB3_MODE				BIT(0) /* enables USB3 mode */
 #define DP_MODE					BIT(1) /* enables DP mode */
 
-/* QPHY_PCS_AUTONOMOUS_MODE_CTRL register bits */
-#define ARCVR_DTCT_EN				BIT(0)
-#define ALFPS_DTCT_EN				BIT(1)
-#define ARCVR_DTCT_EVENT_SEL			BIT(4)
-
-/* QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR register bits */
-#define IRQ_CLEAR				BIT(0)
-
-/* QPHY_V3_PCS_MISC_CLAMP_ENABLE register bits */
-#define CLAMP_EN				BIT(0) /* enables i/o clamp_n */
-
 /* QPHY_V3_DP_COM_TYPEC_CTRL register bits */
 #define SW_PORTSELECT_VAL			BIT(0)
 #define SW_PORTSELECT_MUX			BIT(1)
 
 #define PHY_INIT_COMPLETE_TIMEOUT		10000
 
-struct qmp_phy_init_tbl {
-	unsigned int offset;
-	unsigned int val;
-	/*
-	 * mask of lanes for which this register is written
-	 * for cases when second lane needs different values
-	 */
-	u8 lane_mask;
-};
-
-#define QMP_PHY_INIT_CFG(o, v)		\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = 0xff,	\
-	}
-
-#define QMP_PHY_INIT_CFG_LANE(o, v, l)	\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = l,		\
-	}
-
 /* set of registers with offsets different per-PHY */
 enum qphy_reg_layout {
 	/* PCS registers */
@@ -112,6 +77,7 @@
 	QPHY_COM_BIAS_EN_CLKBUFLR_EN,
 
 	QPHY_DP_PHY_STATUS,
+	QPHY_DP_PHY_VCO_DIV,
 
 	QPHY_TX_TX_POL_INV,
 	QPHY_TX_TX_DRV_LVL,
@@ -137,6 +103,7 @@
 	[QPHY_COM_BIAS_EN_CLKBUFLR_EN]	= QSERDES_V3_COM_BIAS_EN_CLKBUFLR_EN,
 
 	[QPHY_DP_PHY_STATUS]		= QSERDES_V3_DP_PHY_STATUS,
+	[QPHY_DP_PHY_VCO_DIV]		= QSERDES_V3_DP_PHY_VCO_DIV,
 
 	[QPHY_TX_TX_POL_INV]		= QSERDES_V3_TX_TX_POL_INV,
 	[QPHY_TX_TX_DRV_LVL]		= QSERDES_V3_TX_TX_DRV_LVL,
@@ -161,6 +128,7 @@
 	[QPHY_COM_BIAS_EN_CLKBUFLR_EN]	= QSERDES_V4_COM_BIAS_EN_CLKBUFLR_EN,
 
 	[QPHY_DP_PHY_STATUS]		= QSERDES_V4_DP_PHY_STATUS,
+	[QPHY_DP_PHY_VCO_DIV]		= QSERDES_V4_DP_PHY_VCO_DIV,
 
 	[QPHY_TX_TX_POL_INV]		= QSERDES_V4_TX_TX_POL_INV,
 	[QPHY_TX_TX_DRV_LVL]		= QSERDES_V4_TX_TX_DRV_LVL,
@@ -185,6 +153,7 @@
 	[QPHY_COM_BIAS_EN_CLKBUFLR_EN]	= QSERDES_V5_COM_BIAS_EN_CLKBUFLR_EN,
 
 	[QPHY_DP_PHY_STATUS]		= QSERDES_V5_DP_PHY_STATUS,
+	[QPHY_DP_PHY_VCO_DIV]		= QSERDES_V5_DP_PHY_VCO_DIV,
 
 	[QPHY_TX_TX_POL_INV]		= QSERDES_V5_5NM_TX_TX_POL_INV,
 	[QPHY_TX_TX_DRV_LVL]		= QSERDES_V5_5NM_TX_TX_DRV_LVL,
@@ -209,6 +178,7 @@
 	[QPHY_COM_BIAS_EN_CLKBUFLR_EN]	= QSERDES_V6_COM_PLL_BIAS_EN_CLK_BUFLR_EN,
 
 	[QPHY_DP_PHY_STATUS]		= QSERDES_V6_DP_PHY_STATUS,
+	[QPHY_DP_PHY_VCO_DIV]		= QSERDES_V6_DP_PHY_VCO_DIV,
 
 	[QPHY_TX_TX_POL_INV]		= QSERDES_V6_TX_TX_POL_INV,
 	[QPHY_TX_TX_DRV_LVL]		= QSERDES_V6_TX_TX_DRV_LVL,
@@ -217,6 +187,31 @@
 	[QPHY_TX_TRANSCEIVER_BIAS_EN]	= QSERDES_V6_TX_TRANSCEIVER_BIAS_EN,
 };
 
+static const unsigned int qmp_v6_n4_usb3phy_regs_layout[QPHY_LAYOUT_SIZE] = {
+	[QPHY_SW_RESET]			= QPHY_V6_N4_PCS_SW_RESET,
+	[QPHY_START_CTRL]		= QPHY_V6_N4_PCS_START_CONTROL,
+	[QPHY_PCS_STATUS]		= QPHY_V6_N4_PCS_PCS_STATUS1,
+	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V6_N4_PCS_POWER_DOWN_CONTROL,
+
+	/* In PCS_USB */
+	[QPHY_PCS_AUTONOMOUS_MODE_CTRL]	= QPHY_V6_PCS_USB3_AUTONOMOUS_MODE_CTRL,
+	[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = QPHY_V6_PCS_USB3_LFPS_RXTERM_IRQ_CLEAR,
+
+	[QPHY_COM_RESETSM_CNTRL]	= QSERDES_V6_COM_RESETSM_CNTRL,
+	[QPHY_COM_C_READY_STATUS]	= QSERDES_V6_COM_C_READY_STATUS,
+	[QPHY_COM_CMN_STATUS]		= QSERDES_V6_COM_CMN_STATUS,
+	[QPHY_COM_BIAS_EN_CLKBUFLR_EN]	= QSERDES_V6_COM_PLL_BIAS_EN_CLK_BUFLR_EN,
+
+	[QPHY_DP_PHY_STATUS]		= QSERDES_V6_DP_PHY_STATUS,
+	[QPHY_DP_PHY_VCO_DIV]		= QSERDES_V6_DP_PHY_VCO_DIV,
+
+	[QPHY_TX_TX_POL_INV]		= QSERDES_V6_N4_TX_TX_POL_INV,
+	[QPHY_TX_TX_DRV_LVL]		= QSERDES_V6_N4_TX_TX_DRV_LVL,
+	[QPHY_TX_TX_EMP_POST1_LVL]	= QSERDES_V6_N4_TX_TX_EMP_POST1_LVL,
+	[QPHY_TX_HIGHZ_DRVR_EN]		= QSERDES_V6_N4_TX_HIGHZ_DRVR_EN,
+	[QPHY_TX_TRANSCEIVER_BIAS_EN]	= QSERDES_V6_N4_TX_TRANSCEIVER_BIAS_EN,
+};
+
 static const struct qmp_phy_init_tbl qmp_v3_usb3_serdes_tbl[] = {
 	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_IVCO, 0x07),
 	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SYSCLK_EN_SEL, 0x14),
@@ -1027,6 +1022,31 @@
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CORE_CLK_EN, 0x0f),
 };
 
+static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SVS_MODE_CLK_SEL, 0x15),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SYSCLK_EN_SEL, 0x3b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SYS_CLK_CTRL, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CLK_ENABLE1, 0x0c),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SYSCLK_BUF_ENABLE, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CLK_SELECT, 0x30),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_IVCO, 0x07),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_CCTRL_MODE0, 0x36),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_RCTRL_MODE0, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CP_CTRL_MODE0, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE0, 0x34),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START1_MODE0, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START2_MODE0, 0xc0),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CMN_CONFIG_1, 0x12),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_INTEGLOOP_GAIN0_MODE0, 0x3f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_INTEGLOOP_GAIN1_MODE0, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_VCO_TUNE_MAP, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BG_TIMER, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_CORE_CLK_DIV_MODE0, 0x14),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_VCO_TUNE_CTRL, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_BIAS_EN_CLK_BUFLR_EN, 0x17),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CORE_CLK_EN, 0x0f),
+};
+
 static const struct qmp_phy_init_tbl qmp_v6_dp_tx_tbl[] = {
 	QMP_PHY_INIT_CFG(QSERDES_V6_TX_VMODE_CTRL1, 0x40),
 	QMP_PHY_INIT_CFG(QSERDES_V6_TX_PRE_STALL_LDO_BOOST_EN, 0x30),
@@ -1041,6 +1061,19 @@
 	QMP_PHY_INIT_CFG(QSERDES_V6_TX_TX_BAND, 0x4),
 };
 
+static const struct qmp_phy_init_tbl qmp_v6_n4_dp_tx_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_VMODE_CTRL1, 0x40),
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_PRE_STALL_LDO_BOOST_EN, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_INTERFACE_SELECT, 0xff),
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_CLKBUF_ENABLE, 0x0f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_RESET_TSYNC_EN, 0x03),
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_TRAN_DRVR_EMP_EN, 0x0f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_PARRATE_REC_DETECT_IDLE_EN, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_RES_CODE_LANE_OFFSET_TX, 0x11),
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_RES_CODE_LANE_OFFSET_RX, 0x11),
+	QMP_PHY_INIT_CFG(QSERDES_V6_N4_TX_TX_BAND, 0x1),
+};
+
 static const struct qmp_phy_init_tbl qmp_v6_dp_serdes_tbl_rbr[] = {
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_HSCLK_SEL_1, 0x05),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE0, 0x34),
@@ -1089,6 +1122,74 @@
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0, 0x0c),
 };
 
+static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl_rbr[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_HSCLK_SEL_1, 0x05),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE0, 0x34),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP_EN, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START3_MODE0, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP1_MODE0, 0x37),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP2_MODE0, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE1_MODE0, 0x71),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0, 0x0c),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_EN_CENTER, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_ADJ_PER1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER1, 0x6b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER2, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0, 0x92),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0, 0x01),
+};
+
+static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl_hbr[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_HSCLK_SEL_1, 0x03),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE0, 0x34),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP_EN, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START3_MODE0, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP1_MODE0, 0x07),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP2_MODE0, 0x07),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE1_MODE0, 0x71),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0, 0x0c),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_EN_CENTER, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_ADJ_PER1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER1, 0x6b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER2, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0, 0x92),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0, 0x01),
+};
+
+static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl_hbr2[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_HSCLK_SEL_1, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE0, 0x46),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP_EN, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START3_MODE0, 0x05),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP1_MODE0, 0x0f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP2_MODE0, 0x0e),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE1_MODE0, 0x97),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0, 0x10),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_EN_CENTER, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_ADJ_PER1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER1, 0x6b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER2, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0, 0x18),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0, 0x02),
+};
+
+static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl_hbr3[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_HSCLK_SEL_1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE0, 0x34),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP_EN, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START3_MODE0, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP1_MODE0, 0x17),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP2_MODE0, 0x15),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE1_MODE0, 0x71),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0, 0x0c),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_EN_CENTER, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_ADJ_PER1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER1, 0x6b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER2, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0, 0x92),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0, 0x01),
+};
+
 static const struct qmp_phy_init_tbl sc8280xp_usb43dp_serdes_tbl[] = {
 	QMP_PHY_INIT_CFG(QSERDES_V5_COM_SSC_EN_CENTER, 0x01),
 	QMP_PHY_INIT_CFG(QSERDES_V5_COM_SSC_PER1, 0x31),
@@ -1303,20 +1404,20 @@
 };
 
 static const struct qmp_phy_init_tbl x1e80100_usb43dp_pcs_tbl[] = {
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_LOCK_DETECT_CONFIG1, 0xc4),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_LOCK_DETECT_CONFIG2, 0x89),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_LOCK_DETECT_CONFIG3, 0x20),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_LOCK_DETECT_CONFIG6, 0x13),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_REFGEN_REQ_CONFIG1, 0x21),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_RX_SIGDET_LVL, 0x55),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_CDR_RESET_TIME, 0x0a),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_ALIGN_DETECT_CONFIG1, 0xd4),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_ALIGN_DETECT_CONFIG2, 0x30),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_PCS_TX_RX_CONFIG, 0x0c),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_EQ_CONFIG1, 0x4b),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_EQ_CONFIG5, 0x10),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG1, 0xc4),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG2, 0x89),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG3, 0x20),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG6, 0x13),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_REFGEN_REQ_CONFIG1, 0x21),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_RX_SIGDET_LVL, 0x55),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_RX_CONFIG, 0x0a),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_ALIGN_DETECT_CONFIG1, 0xd4),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_ALIGN_DETECT_CONFIG2, 0x30),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_PCS_TX_RX_CONFIG, 0x0c),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_EQ_CONFIG1, 0x4b),
+	QMP_PHY_INIT_CFG(QPHY_V6_N4_PCS_EQ_CONFIG5, 0x10),
 };
 
 static const struct qmp_phy_init_tbl x1e80100_usb43dp_pcs_usb_tbl[] = {
@@ -1412,6 +1513,13 @@
 	{ 0x3f, 0xff, 0xff, 0xff }
 };
 
+static const u8 qmp_dp_v6_voltage_swing_hbr_rbr[4][4] = {
+	{ 0x27, 0x2f, 0x36, 0x3f },
+	{ 0x31, 0x3e, 0x3f, 0xff },
+	{ 0x36, 0x3f, 0xff, 0xff },
+	{ 0x3f, 0xff, 0xff, 0xff }
+};
+
 static const u8 qmp_dp_v6_pre_emphasis_hbr_rbr[4][4] = {
 	{ 0x20, 0x2d, 0x34, 0x3a },
 	{ 0x20, 0x2e, 0x35, 0xff },
@@ -1817,22 +1925,22 @@
 	.pcs_usb_tbl		= x1e80100_usb43dp_pcs_usb_tbl,
 	.pcs_usb_tbl_num	= ARRAY_SIZE(x1e80100_usb43dp_pcs_usb_tbl),
 
-	.dp_serdes_tbl		= qmp_v6_dp_serdes_tbl,
-	.dp_serdes_tbl_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl),
-	.dp_tx_tbl		= qmp_v6_dp_tx_tbl,
-	.dp_tx_tbl_num		= ARRAY_SIZE(qmp_v6_dp_tx_tbl),
+	.dp_serdes_tbl		= qmp_v6_n4_dp_serdes_tbl,
+	.dp_serdes_tbl_num	= ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl),
+	.dp_tx_tbl		= qmp_v6_n4_dp_tx_tbl,
+	.dp_tx_tbl_num		= ARRAY_SIZE(qmp_v6_n4_dp_tx_tbl),
+
+	.serdes_tbl_rbr		= qmp_v6_n4_dp_serdes_tbl_rbr,
+	.serdes_tbl_rbr_num	= ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl_rbr),
+	.serdes_tbl_hbr		= qmp_v6_n4_dp_serdes_tbl_hbr,
+	.serdes_tbl_hbr_num	= ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl_hbr),
+	.serdes_tbl_hbr2	= qmp_v6_n4_dp_serdes_tbl_hbr2,
+	.serdes_tbl_hbr2_num	= ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl_hbr2),
+	.serdes_tbl_hbr3	= qmp_v6_n4_dp_serdes_tbl_hbr3,
+	.serdes_tbl_hbr3_num	= ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl_hbr3),
 
-	.serdes_tbl_rbr		= qmp_v6_dp_serdes_tbl_rbr,
-	.serdes_tbl_rbr_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl_rbr),
-	.serdes_tbl_hbr		= qmp_v6_dp_serdes_tbl_hbr,
-	.serdes_tbl_hbr_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr),
-	.serdes_tbl_hbr2	= qmp_v6_dp_serdes_tbl_hbr2,
-	.serdes_tbl_hbr2_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr2),
-	.serdes_tbl_hbr3	= qmp_v6_dp_serdes_tbl_hbr3,
-	.serdes_tbl_hbr3_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr3),
-
-	.swing_hbr_rbr		= &qmp_dp_v5_voltage_swing_hbr_rbr,
-	.pre_emphasis_hbr_rbr	= &qmp_dp_v5_pre_emphasis_hbr_rbr,
+	.swing_hbr_rbr		= &qmp_dp_v6_voltage_swing_hbr_rbr,
+	.pre_emphasis_hbr_rbr	= &qmp_dp_v6_pre_emphasis_hbr_rbr,
 	.swing_hbr3_hbr2	= &qmp_dp_v5_voltage_swing_hbr3_hbr2,
 	.pre_emphasis_hbr3_hbr2 = &qmp_dp_v5_pre_emphasis_hbr3_hbr2,
 
@@ -1845,7 +1953,7 @@
 	.num_resets		= ARRAY_SIZE(msm8996_usb3phy_reset_l),
 	.vreg_list		= qmp_phy_vreg_l,
 	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
-	.regs			= qmp_v45_usb3phy_regs_layout,
+	.regs			= qmp_v6_n4_usb3phy_regs_layout,
 };
 
 static const struct qmp_phy_cfg sm6350_usb3dpphy_cfg = {
@@ -2031,31 +2139,50 @@
 	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
 };
 
-static void qmp_combo_configure_lane(void __iomem *base,
-					const struct qmp_phy_init_tbl tbl[],
-					int num,
-					u8 lane_mask)
-{
-	int i;
-	const struct qmp_phy_init_tbl *t = tbl;
+static const struct qmp_phy_cfg sm8650_usb3dpphy_cfg = {
+	.offsets		= &qmp_combo_offsets_v3,
 
-	if (!t)
-		return;
+	.serdes_tbl		= sm8550_usb3_serdes_tbl,
+	.serdes_tbl_num		= ARRAY_SIZE(sm8550_usb3_serdes_tbl),
+	.tx_tbl			= sm8550_usb3_tx_tbl,
+	.tx_tbl_num		= ARRAY_SIZE(sm8550_usb3_tx_tbl),
+	.rx_tbl			= sm8550_usb3_rx_tbl,
+	.rx_tbl_num		= ARRAY_SIZE(sm8550_usb3_rx_tbl),
+	.pcs_tbl		= sm8550_usb3_pcs_tbl,
+	.pcs_tbl_num		= ARRAY_SIZE(sm8550_usb3_pcs_tbl),
+	.pcs_usb_tbl		= sm8550_usb3_pcs_usb_tbl,
+	.pcs_usb_tbl_num	= ARRAY_SIZE(sm8550_usb3_pcs_usb_tbl),
 
-	for (i = 0; i < num; i++, t++) {
-		if (!(t->lane_mask & lane_mask))
-			continue;
+	.dp_serdes_tbl		= qmp_v6_dp_serdes_tbl,
+	.dp_serdes_tbl_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl),
+	.dp_tx_tbl		= qmp_v6_dp_tx_tbl,
+	.dp_tx_tbl_num		= ARRAY_SIZE(qmp_v6_dp_tx_tbl),
 
-		writel(t->val, base + t->offset);
-	}
-}
+	.serdes_tbl_rbr		= qmp_v6_dp_serdes_tbl_rbr,
+	.serdes_tbl_rbr_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl_rbr),
+	.serdes_tbl_hbr		= qmp_v6_dp_serdes_tbl_hbr,
+	.serdes_tbl_hbr_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr),
+	.serdes_tbl_hbr2	= qmp_v6_dp_serdes_tbl_hbr2,
+	.serdes_tbl_hbr2_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr2),
+	.serdes_tbl_hbr3	= qmp_v6_dp_serdes_tbl_hbr3,
+	.serdes_tbl_hbr3_num	= ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr3),
 
-static void qmp_combo_configure(void __iomem *base,
-				   const struct qmp_phy_init_tbl tbl[],
-				   int num)
-{
-	qmp_combo_configure_lane(base, tbl, num, 0xff);
-}
+	.swing_hbr_rbr		= &qmp_dp_v6_voltage_swing_hbr_rbr,
+	.pre_emphasis_hbr_rbr	= &qmp_dp_v6_pre_emphasis_hbr_rbr,
+	.swing_hbr3_hbr2	= &qmp_dp_v5_voltage_swing_hbr3_hbr2,
+	.pre_emphasis_hbr3_hbr2 = &qmp_dp_v5_pre_emphasis_hbr3_hbr2,
+
+	.dp_aux_init		= qmp_v4_dp_aux_init,
+	.configure_dp_tx	= qmp_v4_configure_dp_tx,
+	.configure_dp_phy	= qmp_v4_configure_dp_phy,
+	.calibrate_dp_phy	= qmp_v4_calibrate_dp_phy,
+
+	.regs			= qmp_v6_usb3phy_regs_layout,
+	.reset_list		= msm8996_usb3phy_reset_l,
+	.num_resets		= ARRAY_SIZE(msm8996_usb3phy_reset_l),
+	.vreg_list		= qmp_phy_vreg_l,
+	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
+};
 
 static int qmp_combo_dp_serdes_init(struct qmp_combo *qmp)
 {
@@ -2063,24 +2190,25 @@
 	void __iomem *serdes = qmp->dp_serdes;
 	const struct phy_configure_opts_dp *dp_opts = &qmp->dp_opts;
 
-	qmp_combo_configure(serdes, cfg->dp_serdes_tbl, cfg->dp_serdes_tbl_num);
+	qmp_configure(qmp->dev, serdes, cfg->dp_serdes_tbl,
+		      cfg->dp_serdes_tbl_num);
 
 	switch (dp_opts->link_rate) {
 	case 1620:
-		qmp_combo_configure(serdes, cfg->serdes_tbl_rbr,
-				cfg->serdes_tbl_rbr_num);
+		qmp_configure(qmp->dev, serdes, cfg->serdes_tbl_rbr,
+			      cfg->serdes_tbl_rbr_num);
 		break;
 	case 2700:
-		qmp_combo_configure(serdes, cfg->serdes_tbl_hbr,
-				cfg->serdes_tbl_hbr_num);
+		qmp_configure(qmp->dev, serdes, cfg->serdes_tbl_hbr,
+			      cfg->serdes_tbl_hbr_num);
 		break;
 	case 5400:
-		qmp_combo_configure(serdes, cfg->serdes_tbl_hbr2,
-				cfg->serdes_tbl_hbr2_num);
+		qmp_configure(qmp->dev, serdes, cfg->serdes_tbl_hbr2,
+			      cfg->serdes_tbl_hbr2_num);
 		break;
 	case 8100:
-		qmp_combo_configure(serdes, cfg->serdes_tbl_hbr3,
-				cfg->serdes_tbl_hbr3_num);
+		qmp_configure(qmp->dev, serdes, cfg->serdes_tbl_hbr3,
+			      cfg->serdes_tbl_hbr3_num);
 		break;
 	default:
 		/* Other link rates aren't supported */
@@ -2211,9 +2339,9 @@
 	writel(val, qmp->dp_dp_phy + QSERDES_DP_PHY_PD_CTL);
 
 	if (reverse)
-		writel(0x4c, qmp->pcs + QSERDES_DP_PHY_MODE);
+		writel(0x4c, qmp->dp_dp_phy + QSERDES_DP_PHY_MODE);
 	else
-		writel(0x5c, qmp->pcs + QSERDES_DP_PHY_MODE);
+		writel(0x5c, qmp->dp_dp_phy + QSERDES_DP_PHY_MODE);
 
 	return reverse;
 }
@@ -2223,6 +2351,7 @@
 	const struct phy_configure_opts_dp *dp_opts = &qmp->dp_opts;
 	u32 phy_vco_div;
 	unsigned long pixel_freq;
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
 
 	switch (dp_opts->link_rate) {
 	case 1620:
@@ -2245,7 +2374,7 @@
 		/* Other link rates aren't supported */
 		return -EINVAL;
 	}
-	writel(phy_vco_div, qmp->dp_dp_phy + QSERDES_V4_DP_PHY_VCO_DIV);
+	writel(phy_vco_div, qmp->dp_dp_phy + cfg->regs[QPHY_DP_PHY_VCO_DIV]);
 
 	clk_set_rate(qmp->dp_link_hw.clk, dp_opts->link_rate * 100000);
 	clk_set_rate(qmp->dp_pixel_hw.clk, pixel_freq);
@@ -2370,7 +2499,7 @@
 	u32 status;
 	int ret;
 
-	writel(0x0f, qmp->dp_dp_phy + QSERDES_V4_DP_PHY_CFG_1);
+	writel(0x0f, qmp->dp_dp_phy + QSERDES_DP_PHY_CFG_1);
 
 	qmp_combo_configure_dp_mode(qmp);
 
@@ -2492,8 +2621,6 @@
 	writel(0x20, qmp->dp_tx2 + cfg->regs[QPHY_TX_TX_EMP_POST1_LVL]);
 
 	return 0;
-
-	return 0;
 }
 
 /*
@@ -2681,8 +2808,8 @@
 
 	qmp_combo_dp_serdes_init(qmp);
 
-	qmp_combo_configure_lane(tx, cfg->dp_tx_tbl, cfg->dp_tx_tbl_num, 1);
-	qmp_combo_configure_lane(tx2, cfg->dp_tx_tbl, cfg->dp_tx_tbl_num, 2);
+	qmp_configure_lane(qmp->dev, tx, cfg->dp_tx_tbl, cfg->dp_tx_tbl_num, 1);
+	qmp_configure_lane(qmp->dev, tx2, cfg->dp_tx_tbl, cfg->dp_tx_tbl_num, 2);
 
 	/* Configure special DP tx tunings */
 	cfg->configure_dp_tx(qmp);
@@ -2724,7 +2851,7 @@
 	unsigned int val;
 	int ret;
 
-	qmp_combo_configure(serdes, cfg->serdes_tbl, cfg->serdes_tbl_num);
+	qmp_configure(qmp->dev, serdes, cfg->serdes_tbl, cfg->serdes_tbl_num);
 
 	ret = clk_prepare_enable(qmp->pipe_clk);
 	if (ret) {
@@ -2733,16 +2860,17 @@
 	}
 
 	/* Tx, Rx, and PCS configurations */
-	qmp_combo_configure_lane(tx, cfg->tx_tbl, cfg->tx_tbl_num, 1);
-	qmp_combo_configure_lane(tx2, cfg->tx_tbl, cfg->tx_tbl_num, 2);
+	qmp_configure_lane(qmp->dev, tx, cfg->tx_tbl, cfg->tx_tbl_num, 1);
+	qmp_configure_lane(qmp->dev, tx2, cfg->tx_tbl, cfg->tx_tbl_num, 2);
 
-	qmp_combo_configure_lane(rx, cfg->rx_tbl, cfg->rx_tbl_num, 1);
-	qmp_combo_configure_lane(rx2, cfg->rx_tbl, cfg->rx_tbl_num, 2);
+	qmp_configure_lane(qmp->dev, rx, cfg->rx_tbl, cfg->rx_tbl_num, 1);
+	qmp_configure_lane(qmp->dev, rx2, cfg->rx_tbl, cfg->rx_tbl_num, 2);
 
-	qmp_combo_configure(pcs, cfg->pcs_tbl, cfg->pcs_tbl_num);
+	qmp_configure(qmp->dev, pcs, cfg->pcs_tbl, cfg->pcs_tbl_num);
 
 	if (pcs_usb)
-		qmp_combo_configure(pcs_usb, cfg->pcs_usb_tbl, cfg->pcs_usb_tbl_num);
+		qmp_configure(qmp->dev, pcs_usb, cfg->pcs_usb_tbl,
+			      cfg->pcs_usb_tbl_num);
 
 	if (cfg->has_pwrdn_delay)
 		usleep_range(10, 20);
@@ -3562,6 +3690,10 @@
 	if (ret)
 		return ret;
 
+	if (of_property_read_bool(dev->of_node,
+				  "default-typec-orientation-reverse"))
+		qmp->orientation = TYPEC_ORIENTATION_REVERSE;
+
 	/* Check for legacy binding with child nodes. */
 	usb_np = of_get_child_by_name(dev->of_node, "usb3-phy");
 	if (usb_np) {
@@ -3686,7 +3818,7 @@
 	},
 	{
 		.compatible = "qcom,sm8650-qmp-usb3-dp-phy",
-		.data = &sm8550_usb3dpphy_cfg,
+		.data = &sm8650_usb3dpphy_cfg,
 	},
 	{
 		.compatible = "qcom,x1e80100-qmp-usb3-dp-phy",
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-common.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-common.h
@@ -0,0 +1,62 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef QCOM_PHY_QMP_COMMON_H_
+#define QCOM_PHY_QMP_COMMON_H_
+
+struct qmp_phy_init_tbl {
+	unsigned int offset;
+	unsigned int val;
+	char *name;
+	/*
+	 * mask of lanes for which this register is written
+	 * for cases when second lane needs different values
+	 */
+	u8 lane_mask;
+};
+
+#define QMP_PHY_INIT_CFG(o, v)		\
+	{				\
+		.offset = o,		\
+		.val = v,		\
+		.name = #o,		\
+		.lane_mask = 0xff,	\
+	}
+
+#define QMP_PHY_INIT_CFG_LANE(o, v, l)	\
+	{				\
+		.offset = o,		\
+		.val = v,		\
+		.name = #o,		\
+		.lane_mask = l,		\
+	}
+
+static inline void qmp_configure_lane(struct device *dev, void __iomem *base,
+				      const struct qmp_phy_init_tbl tbl[],
+				      int num, u8 lane_mask)
+{
+	int i;
+	const struct qmp_phy_init_tbl *t = tbl;
+
+	if (!t)
+		return;
+
+	for (i = 0; i < num; i++, t++) {
+		if (!(t->lane_mask & lane_mask))
+			continue;
+
+		dev_dbg(dev, "Writing Reg: %s Offset: 0x%04x Val: 0x%02x\n",
+			t->name, t->offset, t->val);
+		writel(t->val, base + t->offset);
+	}
+}
+
+static inline void qmp_configure(struct device *dev, void __iomem *base,
+				 const struct qmp_phy_init_tbl tbl[], int num)
+{
+	qmp_configure_lane(dev, base, tbl, num, 0xff);
+}
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-dp-com-v3.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-dp-com-v3.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef QCOM_PHY_QMP_DP_COM_V3_H_
+#define QCOM_PHY_QMP_DP_COM_V3_H_
+
+/* Only for QMP V3 & V4 PHY - DP COM registers */
+#define QPHY_V3_DP_COM_PHY_MODE_CTRL			0x00
+#define QPHY_V3_DP_COM_SW_RESET				0x04
+#define QPHY_V3_DP_COM_POWER_DOWN_CTRL			0x08
+#define QPHY_V3_DP_COM_SWI_CTRL				0x0c
+#define QPHY_V3_DP_COM_TYPEC_CTRL			0x10
+#define QPHY_V3_DP_COM_TYPEC_PWRDN_CTRL			0x14
+#define QPHY_V3_DP_COM_RESET_OVRD_CTRL			0x1c
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v3.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v3.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef QCOM_PHY_QMP_DP_PHY_V3_H_
+#define QCOM_PHY_QMP_DP_PHY_V3_H_
+
+/* Only for QMP V3 PHY - DP PHY registers */
+#define QSERDES_V3_DP_PHY_AUX_INTERRUPT_MASK		0x048
+#define QSERDES_V3_DP_PHY_AUX_INTERRUPT_CLEAR		0x04c
+#define QSERDES_V3_DP_PHY_AUX_BIST_CFG			0x050
+
+#define QSERDES_V3_DP_PHY_VCO_DIV			0x064
+#define QSERDES_V3_DP_PHY_TX0_TX1_LANE_CTL		0x06c
+#define QSERDES_V3_DP_PHY_TX2_TX3_LANE_CTL		0x088
+
+#define QSERDES_V3_DP_PHY_SPARE0			0x0ac
+#define QSERDES_V3_DP_PHY_STATUS			0x0c0
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v4.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v4.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef QCOM_PHY_QMP_DP_PHY_V4_H_
+#define QCOM_PHY_QMP_DP_PHY_V4_H_
+
+/* Only for QMP V4 PHY - DP PHY registers */
+#define QSERDES_V4_DP_PHY_AUX_INTERRUPT_MASK		0x054
+#define QSERDES_V4_DP_PHY_AUX_INTERRUPT_CLEAR		0x058
+#define QSERDES_V4_DP_PHY_VCO_DIV			0x070
+#define QSERDES_V4_DP_PHY_TX0_TX1_LANE_CTL		0x078
+#define QSERDES_V4_DP_PHY_TX2_TX3_LANE_CTL		0x09c
+#define QSERDES_V4_DP_PHY_SPARE0			0x0c8
+#define QSERDES_V4_DP_PHY_AUX_INTERRUPT_STATUS		0x0d8
+#define QSERDES_V4_DP_PHY_STATUS			0x0dc
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v5.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v5.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef QCOM_PHY_QMP_DP_PHY_V5_H_
+#define QCOM_PHY_QMP_DP_PHY_V5_H_
+
+/* Only for QMP V5 PHY - DP PHY registers */
+#define QSERDES_V5_DP_PHY_VCO_DIV			0x070
+#define QSERDES_V5_DP_PHY_AUX_INTERRUPT_STATUS		0x0d8
+#define QSERDES_V5_DP_PHY_STATUS			0x0dc
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v6.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v6.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef QCOM_PHY_QMP_DP_PHY_V6_H_
+#define QCOM_PHY_QMP_DP_PHY_V6_H_
+
+/* Only for QMP V6 PHY - DP PHY registers */
+#define QSERDES_V6_DP_PHY_VCO_DIV			0x070
+#define QSERDES_V6_DP_PHY_AUX_INTERRUPT_STATUS		0x0e0
+#define QSERDES_V6_DP_PHY_STATUS			0x0e4
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-dp-phy.h
@@ -0,0 +1,62 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef QCOM_PHY_QMP_DP_PHY_H_
+#define QCOM_PHY_QMP_DP_PHY_H_
+
+/* QMP PHY - DP PHY registers */
+#define QSERDES_DP_PHY_REVISION_ID0			0x000
+#define QSERDES_DP_PHY_REVISION_ID1			0x004
+#define QSERDES_DP_PHY_REVISION_ID2			0x008
+#define QSERDES_DP_PHY_REVISION_ID3			0x00c
+#define QSERDES_DP_PHY_CFG				0x010
+#define QSERDES_DP_PHY_CFG_1				0x014
+#define QSERDES_DP_PHY_PD_CTL				0x018
+#define QSERDES_DP_PHY_MODE				0x01c
+#define QSERDES_DP_PHY_AUX_CFG0				0x020
+#define QSERDES_DP_PHY_AUX_CFG1				0x024
+#define QSERDES_DP_PHY_AUX_CFG2				0x028
+#define QSERDES_DP_PHY_AUX_CFG3				0x02c
+#define QSERDES_DP_PHY_AUX_CFG4				0x030
+#define QSERDES_DP_PHY_AUX_CFG5				0x034
+#define QSERDES_DP_PHY_AUX_CFG6				0x038
+#define QSERDES_DP_PHY_AUX_CFG7				0x03c
+#define QSERDES_DP_PHY_AUX_CFG8				0x040
+#define QSERDES_DP_PHY_AUX_CFG9				0x044
+
+/* QSERDES COM_BIAS_EN_CLKBUFLR_EN bits */
+# define QSERDES_V3_COM_BIAS_EN				0x0001
+# define QSERDES_V3_COM_BIAS_EN_MUX			0x0002
+# define QSERDES_V3_COM_CLKBUF_R_EN			0x0004
+# define QSERDES_V3_COM_CLKBUF_L_EN			0x0008
+# define QSERDES_V3_COM_EN_SYSCLK_TX_SEL		0x0010
+# define QSERDES_V3_COM_CLKBUF_RX_DRIVE_L		0x0020
+# define QSERDES_V3_COM_CLKBUF_RX_DRIVE_R		0x0040
+
+/* QPHY_TX_TX_EMP_POST1_LVL bits */
+# define DP_PHY_TXn_TX_EMP_POST1_LVL_MASK		0x001f
+# define DP_PHY_TXn_TX_EMP_POST1_LVL_MUX_EN		0x0020
+
+/* QPHY_TX_TX_DRV_LVL bits */
+# define DP_PHY_TXn_TX_DRV_LVL_MASK			0x001f
+# define DP_PHY_TXn_TX_DRV_LVL_MUX_EN			0x0020
+
+/* QSERDES_DP_PHY_PD_CTL bits */
+# define DP_PHY_PD_CTL_PWRDN				0x001
+# define DP_PHY_PD_CTL_PSR_PWRDN			0x002
+# define DP_PHY_PD_CTL_AUX_PWRDN			0x004
+# define DP_PHY_PD_CTL_LANE_0_1_PWRDN			0x008
+# define DP_PHY_PD_CTL_LANE_2_3_PWRDN			0x010
+# define DP_PHY_PD_CTL_PLL_PWRDN			0x020
+# define DP_PHY_PD_CTL_DP_CLAMP_EN			0x040
+
+/* QPHY_DP_PHY_AUX_INTERRUPT_STATUS bits */
+# define PHY_AUX_STOP_ERR_MASK				0x01
+# define PHY_AUX_DEC_ERR_MASK				0x02
+# define PHY_AUX_SYNC_ERR_MASK				0x04
+# define PHY_AUX_ALIGN_ERR_MASK				0x08
+# define PHY_AUX_REQ_ERR_MASK				0x10
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
@@ -19,19 +19,13 @@
 #include <linux/reset.h>
 #include <linux/slab.h>
 
+#include "phy-qcom-qmp-common.h"
+
 #include "phy-qcom-qmp.h"
 
-/* QPHY_SW_RESET bit */
-#define SW_RESET				BIT(0)
-/* QPHY_POWER_DOWN_CONTROL */
-#define SW_PWRDN				BIT(0)
-#define REFCLK_DRV_DSBL				BIT(1)
 /* QPHY_START_CONTROL bits */
-#define SERDES_START				BIT(0)
-#define PCS_START				BIT(1)
 #define PLL_READY_GATE_EN			BIT(3)
-/* QPHY_PCS_STATUS bit */
-#define PHYSTATUS				BIT(6)
+
 /* QPHY_COM_PCS_READY_STATUS bit */
 #define PCS_READY				BIT(0)
 
@@ -39,30 +33,6 @@
 #define POWER_DOWN_DELAY_US_MIN			10
 #define POWER_DOWN_DELAY_US_MAX			20
 
-struct qmp_phy_init_tbl {
-	unsigned int offset;
-	unsigned int val;
-	/*
-	 * mask of lanes for which this register is written
-	 * for cases when second lane needs different values
-	 */
-	u8 lane_mask;
-};
-
-#define QMP_PHY_INIT_CFG(o, v)		\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = 0xff,	\
-	}
-
-#define QMP_PHY_INIT_CFG_LANE(o, v, l)	\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = l,		\
-	}
-
 /* set of registers with offsets different per-PHY */
 enum qphy_reg_layout {
 	/* Common block control registers */
@@ -307,32 +277,6 @@
 	.regs			= pciephy_regs_layout,
 };
 
-static void qmp_pcie_msm8996_configure_lane(void __iomem *base,
-					const struct qmp_phy_init_tbl tbl[],
-					int num,
-					u8 lane_mask)
-{
-	int i;
-	const struct qmp_phy_init_tbl *t = tbl;
-
-	if (!t)
-		return;
-
-	for (i = 0; i < num; i++, t++) {
-		if (!(t->lane_mask & lane_mask))
-			continue;
-
-		writel(t->val, base + t->offset);
-	}
-}
-
-static void qmp_pcie_msm8996_configure(void __iomem *base,
-				   const struct qmp_phy_init_tbl tbl[],
-				   int num)
-{
-	qmp_pcie_msm8996_configure_lane(base, tbl, num, 0xff);
-}
-
 static int qmp_pcie_msm8996_serdes_init(struct qmp_phy *qphy)
 {
 	struct qcom_qmp *qmp = qphy->qmp;
@@ -344,7 +288,7 @@
 	unsigned int val;
 	int ret;
 
-	qmp_pcie_msm8996_configure(serdes, serdes_tbl, serdes_tbl_num);
+	qmp_configure(qmp->dev, serdes, serdes_tbl, serdes_tbl_num);
 
 	qphy_clrbits(serdes, cfg->regs[QPHY_COM_SW_RESET], SW_RESET);
 	qphy_setbits(serdes, cfg->regs[QPHY_COM_START_CONTROL],
@@ -487,9 +431,9 @@
 	}
 
 	/* Tx, Rx, and PCS configurations */
-	qmp_pcie_msm8996_configure_lane(tx, cfg->tx_tbl, cfg->tx_tbl_num, 1);
-	qmp_pcie_msm8996_configure_lane(rx, cfg->rx_tbl, cfg->rx_tbl_num, 1);
-	qmp_pcie_msm8996_configure(pcs, cfg->pcs_tbl, cfg->pcs_tbl_num);
+	qmp_configure_lane(qmp->dev, tx, cfg->tx_tbl, cfg->tx_tbl_num, 1);
+	qmp_configure_lane(qmp->dev, rx, cfg->rx_tbl, cfg->rx_tbl_num, 1);
+	qmp_configure(qmp->dev, pcs, cfg->pcs_tbl, cfg->pcs_tbl_num);
 
 	/*
 	 * Pull out PHY from POWER DOWN state.
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcie.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcie.c
@@ -22,6 +22,8 @@
 #include <linux/reset.h>
 #include <linux/slab.h>
 
+#include "phy-qcom-qmp-common.h"
+
 #include "phy-qcom-qmp.h"
 #include "phy-qcom-qmp-pcs-misc-v3.h"
 #include "phy-qcom-qmp-pcs-pcie-v4.h"
@@ -32,44 +34,11 @@
 #include "phy-qcom-qmp-pcs-pcie-v6_20.h"
 #include "phy-qcom-qmp-pcie-qhp.h"
 
-/* QPHY_SW_RESET bit */
-#define SW_RESET				BIT(0)
-/* QPHY_POWER_DOWN_CONTROL */
-#define SW_PWRDN				BIT(0)
-#define REFCLK_DRV_DSBL				BIT(1)
-/* QPHY_START_CONTROL bits */
-#define SERDES_START				BIT(0)
-#define PCS_START				BIT(1)
-/* QPHY_PCS_STATUS bit */
-#define PHYSTATUS				BIT(6)
-#define PHYSTATUS_4_20				BIT(7)
+/* PCS_PCIE_ENDPOINT_REFCLK_CNTRL */
+#define EPCLK_ALWAYS_ON_EN			BIT(6)
 
 #define PHY_INIT_COMPLETE_TIMEOUT		10000
 
-struct qmp_phy_init_tbl {
-	unsigned int offset;
-	unsigned int val;
-	/*
-	 * mask of lanes for which this register is written
-	 * for cases when second lane needs different values
-	 */
-	u8 lane_mask;
-};
-
-#define QMP_PHY_INIT_CFG(o, v)		\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = 0xff,	\
-	}
-
-#define QMP_PHY_INIT_CFG_LANE(o, v, l)	\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = l,		\
-	}
-
 /* set of registers with offsets different per-PHY */
 enum qphy_reg_layout {
 	/* PCS registers */
@@ -77,6 +46,7 @@
 	QPHY_START_CTRL,
 	QPHY_PCS_STATUS,
 	QPHY_PCS_POWER_DOWN_CONTROL,
+	QPHY_PCS_ENDPOINT_REFCLK_CNTRL,
 	/* Keep last to ensure regs_layout arrays are properly initialized */
 	QPHY_LAYOUT_SIZE
 };
@@ -93,6 +63,7 @@
 	[QPHY_START_CTRL]		= QPHY_V3_PCS_START_CONTROL,
 	[QPHY_PCS_STATUS]		= QPHY_V3_PCS_PCS_STATUS,
 	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V3_PCS_POWER_DOWN_CONTROL,
+	[QPHY_PCS_ENDPOINT_REFCLK_CNTRL]	= QPHY_V3_PCS_ENDPOINT_REFCLK_CNTRL,
 };
 
 static const unsigned int sdm845_qhp_pciephy_regs_layout[QPHY_LAYOUT_SIZE] = {
@@ -107,6 +78,7 @@
 	[QPHY_START_CTRL]		= QPHY_V4_PCS_START_CONTROL,
 	[QPHY_PCS_STATUS]		= QPHY_V4_PCS_PCS_STATUS1,
 	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V4_PCS_POWER_DOWN_CONTROL,
+	[QPHY_PCS_ENDPOINT_REFCLK_CNTRL]	= QPHY_V4_PCS_PCIE_ENDPOINT_REFCLK_CNTRL,
 };
 
 static const unsigned int pciephy_v5_regs_layout[QPHY_LAYOUT_SIZE] = {
@@ -114,6 +86,30 @@
 	[QPHY_START_CTRL]		= QPHY_V5_PCS_START_CONTROL,
 	[QPHY_PCS_STATUS]		= QPHY_V5_PCS_PCS_STATUS1,
 	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V5_PCS_POWER_DOWN_CONTROL,
+	[QPHY_PCS_ENDPOINT_REFCLK_CNTRL]	= QPHY_V5_PCS_PCIE_ENDPOINT_REFCLK_CNTRL,
+};
+
+static const unsigned int pciephy_v5_20_regs_layout[QPHY_LAYOUT_SIZE] = {
+	[QPHY_SW_RESET]			= QPHY_V5_20_PCS_SW_RESET,
+	[QPHY_START_CTRL]		= QPHY_V5_20_PCS_START_CONTROL,
+	[QPHY_PCS_STATUS]		= QPHY_V5_20_PCS_PCS_STATUS1,
+	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V5_20_PCS_POWER_DOWN_CONTROL,
+	[QPHY_PCS_ENDPOINT_REFCLK_CNTRL]	= QPHY_V5_20_PCS_PCIE_ENDPOINT_REFCLK_CNTRL,
+};
+
+static const unsigned int pciephy_v6_20_regs_layout[QPHY_LAYOUT_SIZE] = {
+	[QPHY_SW_RESET]			= QPHY_V6_20_PCS_SW_RESET,
+	[QPHY_START_CTRL]		= QPHY_V6_20_PCS_START_CONTROL,
+	[QPHY_PCS_STATUS]		= QPHY_V6_20_PCS_PCS_STATUS1,
+	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V6_20_PCS_POWER_DOWN_CONTROL,
+	[QPHY_PCS_ENDPOINT_REFCLK_CNTRL]	= QPHY_PCIE_V6_20_PCS_ENDPOINT_REFCLK_CNTRL,
+};
+
+static const unsigned int pciephy_v6_regs_layout[QPHY_LAYOUT_SIZE] = {
+	[QPHY_SW_RESET]			= QPHY_V6_PCS_SW_RESET,
+	[QPHY_START_CTRL]		= QPHY_V6_PCS_START_CONTROL,
+	[QPHY_PCS_STATUS]		= QPHY_V6_PCS_PCS_STATUS1,
+	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V6_PCS_POWER_DOWN_CONTROL,
 };
 
 static const struct qmp_phy_init_tbl msm8998_pcie_serdes_tbl[] = {
@@ -982,6 +978,143 @@
 	QMP_PHY_INIT_CFG(QPHY_V5_PCS_PCIE_OSC_DTCT_ACTIONS, 0x00),
 };
 
+static const struct qmp_phy_init_tbl x1e80100_qmp_gen4x2_pcie_serdes_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE1_MODE1, 0x26),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE2_MODE1, 0x03),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CP_CTRL_MODE1, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_RCTRL_MODE1, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_CCTRL_MODE1, 0x36),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CORECLK_DIV_MODE1, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP1_MODE1, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP2_MODE1, 0x1a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE1, 0x68),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START1_MODE1, 0xab),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START2_MODE1, 0xaa),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START3_MODE1, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_HSCLK_SEL_1, 0x12),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0, 0xf8),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CP_CTRL_MODE0, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_RCTRL_MODE0, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_CCTRL_MODE0, 0x36),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_CORE_CLK_DIV_MODE0, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP1_MODE0, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP2_MODE0, 0x0d),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE0, 0x41),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START1_MODE0, 0xab),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START2_MODE0, 0xaa),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DIV_FRAC_START3_MODE0, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_HSCLK_HS_SWITCH_SEL_1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_BG_TIMER, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_EN_CENTER, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER1, 0x62),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SSC_PER2, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_POST_DIV_MUX, 0x40),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_BIAS_EN_CLK_BUFLR_EN, 0x14),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CLK_ENABLE1, 0x90),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SYS_CLK_CTRL, 0x82),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_IVCO, 0x0f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SYSCLK_EN_SEL, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP_EN, 0x46),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP_CFG, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_VCO_TUNE_MAP, 0x14),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CLK_SELECT, 0x34),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CORE_CLK_EN, 0xa0),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CMN_CONFIG_1, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CMN_MISC_1, 0x88),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CMN_MODE, 0x14),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_VCO_DC_LEVEL_CTRL, 0x0f),
+};
+
+static const struct qmp_phy_init_tbl x1e80100_qmp_gen4x2_pcie_ln_shrd_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RXCLK_DIV2_CTRL, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_DFE_DAC_ENABLE1, 0x88),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_TX_ADAPT_POST_THRESH1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_TX_ADAPT_POST_THRESH2, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B0, 0xd4),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B1, 0x12),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B2, 0xdb),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B3, 0x9a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B4, 0x32),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B5, 0xb6),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B6, 0x64),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH1_RATE210, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH1_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH2_RATE210, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH2_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH3_RATE210, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH3_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH4_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH5_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH6_RATE3, 0x1f),
+};
+
+static const struct qmp_phy_init_tbl x1e80100_qmp_gen4x2_pcie_tx_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_TX_RES_CODE_LANE_OFFSET_TX, 0x1d),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_TX_RES_CODE_LANE_OFFSET_RX, 0x03),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_TX_LANE_MODE_1, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_TX_LANE_MODE_2, 0x10),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_TX_LANE_MODE_3, 0x51),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_TX_TRAN_DRVR_EMP_EN, 0x34),
+};
+
+static const struct qmp_phy_init_tbl x1e80100_qmp_gen4x2_pcie_rx_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_FO_GAIN_RATE_2, 0x0c),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_SO_GAIN_RATE_2, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_FO_GAIN_RATE_3, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_PI_CONTROLS, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_SO_ACC_DEFAULT_VAL_RATE3, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_IVCM_CAL_CTRL2, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_IVCM_POSTCAL_OFFSET, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_BKUP_CTRL1, 0x15),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_DFE_1, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_DFE_2, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_DFE_3, 0x45),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_VGA_CAL_MAN_VAL, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_GM_CAL, 0x0d),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_EQU_ADAPTOR_CNTRL4, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_SIGDET_ENABLES, 0x1c),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_PHPRE_CTRL, 0x20),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_DFE_CTLE_POST_CAL_OFFSET, 0x38),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_Q_PI_INTRINSIC_BIAS_RATE32, 0x39),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE2_B0, 0x14),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE2_B1, 0xb3),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE2_B2, 0x58),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE2_B3, 0x9a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE2_B4, 0x26),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE2_B5, 0xb6),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE2_B6, 0xee),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B0, 0xe4),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B1, 0xa4),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B2, 0x60),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B3, 0xdf),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B4, 0x4b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B5, 0x76),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B6, 0xff),
+};
+
+static const struct qmp_phy_init_tbl x1e80100_qmp_gen4x2_pcie_pcs_tbl[] = {
+	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_G3S2_PRE_GAIN, 0x2e),
+	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_RX_SIGDET_LVL, 0xcc),
+	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_EQ_CONFIG4, 0x00),
+	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_EQ_CONFIG5, 0x22),
+};
+
+static const struct qmp_phy_init_tbl x1e80100_qmp_gen4x2_pcie_pcs_misc_tbl[] = {
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_ENDPOINT_REFCLK_DRIVE, 0xc1),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_OSC_DTCT_ATCIONS, 0x00),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_EQ_CONFIG1, 0x16),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_EQ_CONFIG5, 0x02),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_G4_PRE_GAIN, 0x2e),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_RX_MARGINING_CONFIG1, 0x03),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_RX_MARGINING_CONFIG3, 0x28),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_TX_RX_CONFIG, 0xc0),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_POWER_STATE_CONFIG2, 0x1d),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_RX_MARGINING_CONFIG5, 0x0f),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_G3_FOM_EQ_CONFIG5, 0xf2),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_G4_FOM_EQ_CONFIG5, 0xf2),
+};
+
 static const struct qmp_phy_init_tbl sm8250_qmp_pcie_serdes_tbl[] = {
 	QMP_PHY_INIT_CFG(QSERDES_V4_COM_SYSCLK_EN_SEL, 0x08),
 	QMP_PHY_INIT_CFG(QSERDES_V4_COM_CLK_SELECT, 0x34),
@@ -1747,7 +1880,7 @@
 	QMP_PHY_INIT_CFG(QSERDES_V6_RX_RX_MODE_10_HIGH2, 0x5b),
 	QMP_PHY_INIT_CFG(QSERDES_V6_RX_RX_MODE_10_HIGH3, 0x1a),
 	QMP_PHY_INIT_CFG(QSERDES_V6_RX_RX_MODE_10_HIGH4, 0x89),
-	QMP_PHY_INIT_CFG(QSERDES_V6_RX_TX_ADAPT_POST_THRESH, 0xf0),
+	QMP_PHY_INIT_CFG(QSERDES_V6_RX_TX_ADAPT_POST_THRESH, 0x00),
 	QMP_PHY_INIT_CFG(QSERDES_V6_RX_UCDR_FO_GAIN, 0x09),
 	QMP_PHY_INIT_CFG(QSERDES_V6_RX_UCDR_SO_GAIN, 0x05),
 	QMP_PHY_INIT_CFG(QSERDES_V6_RX_UCDR_SB2_THRESH1, 0x08),
@@ -1767,6 +1900,8 @@
 };
 
 static const struct qmp_phy_init_tbl sm8550_qmp_gen3x2_pcie_pcs_misc_tbl[] = {
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_PCS_PCIE_EQ_CONFIG1, 0x1e),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_PCS_PCIE_RXEQEVAL_TIME, 0x27),
 	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_PCS_PCIE_POWER_STATE_CONFIG2, 0x1d),
 	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_PCS_PCIE_POWER_STATE_CONFIG4, 0x07),
 	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_PCS_PCIE_ENDPOINT_REFCLK_DRIVE, 0xc1),
@@ -1823,10 +1958,9 @@
 
 static const struct qmp_phy_init_tbl sm8550_qmp_gen4x2_pcie_ln_shrd_tbl[] = {
 	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RXCLK_DIV2_CTRL, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_Q_EN_RATES, 0xe),
 	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_DFE_DAC_ENABLE1, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_TX_ADAPT_POST_THRESH1, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_TX_ADAPT_POST_THRESH2, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_TX_ADAPT_POST_THRESH1, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_TX_ADAPT_POST_THRESH2, 0x0d),
 	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B0, 0x12),
 	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B1, 0x12),
 	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MODE_RATE_0_1_B2, 0xdb),
@@ -1843,6 +1977,7 @@
 	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH4_RATE3, 0x1f),
 	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH5_RATE3, 0x1f),
 	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_MARG_COARSE_THRESH6_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_LN_SHRD_RX_SUMMER_CAL_SPD_MODE, 0x5b),
 };
 
 static const struct qmp_phy_init_tbl sm8550_qmp_gen4x2_pcie_tx_tbl[] = {
@@ -1855,13 +1990,15 @@
 };
 
 static const struct qmp_phy_init_tbl sm8550_qmp_gen4x2_pcie_rx_tbl[] = {
-	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_FO_GAIN_RATE_2, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_FO_GAIN_RATE_2, 0x0c),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_FO_GAIN_RATE_3, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_SO_GAIN_RATE_2, 0x04),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_PI_CONTROLS, 0x16),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_UCDR_SO_ACC_DEFAULT_VAL_RATE3, 0x00),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_IVCM_CAL_CTRL2, 0x80),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_IVCM_POSTCAL_OFFSET, 0x7c),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_DFE_3, 0x05),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_TX_ADPT_CTRL, 0x10),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_VGA_CAL_MAN_VAL, 0x0a),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_GM_CAL, 0x0d),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_EQU_ADAPTOR_CNTRL4, 0x0b),
@@ -1883,11 +2020,13 @@
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B4, 0x78),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B5, 0x76),
 	QMP_PHY_INIT_CFG(QSERDES_V6_20_RX_MODE_RATE3_B6, 0xff),
+	QMP_PHY_INIT_CFG(QSERDES_V6_20_VGA_CAL_CNTRL1, 0x00),
 };
 
 static const struct qmp_phy_init_tbl sm8550_qmp_gen4x2_pcie_pcs_tbl[] = {
+	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_G12S1_TXDEEMPH_M6DB, 0x17),
 	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_G3S2_PRE_GAIN, 0x2e),
-	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_COM_ELECIDLE_DLY_SEL, 0x25),
+	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_RX_SIGDET_LVL, 0xcc),
 	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_EQ_CONFIG4, 0x00),
 	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_EQ_CONFIG5, 0x22),
 	QMP_PHY_INIT_CFG(QPHY_V6_20_PCS_TX_RX_CONFIG1, 0x04),
@@ -1898,6 +2037,8 @@
 	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_ENDPOINT_REFCLK_DRIVE, 0xc1),
 	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_OSC_DTCT_ATCIONS, 0x00),
 	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_EQ_CONFIG1, 0x16),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_G3_RXEQEVAL_TIME, 0x27),
+	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_G4_RXEQEVAL_TIME, 0x27),
 	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_EQ_CONFIG5, 0x02),
 	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_G4_PRE_GAIN, 0x2e),
 	QMP_PHY_INIT_CFG(QPHY_PCIE_V6_20_PCS_RX_MARGINING_CONFIG1, 0x03),
@@ -2204,6 +2345,58 @@
 	QMP_PHY_INIT_CFG(QPHY_V5_20_PCS_INSIG_SW_CTRL7, 0x00),
 };
 
+static const struct qmp_phy_init_tbl qcs8300_qmp_gen4x2_pcie_rx_alt_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_UCDR_PI_CONTROLS, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_DFE_CTLE_POST_CAL_OFFSET, 0x38),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE_0_1_B0, 0x9b),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE_0_1_B1, 0xb0),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE_0_1_B2, 0xd2),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE_0_1_B3, 0xf0),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE_0_1_B4, 0x42),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE_0_1_B5, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE_0_1_B6, 0x20),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE2_B0, 0x9b),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE2_B1, 0xfb),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE2_B2, 0xd2),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE2_B3, 0xec),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE2_B4, 0x43),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE2_B5, 0xdd),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE2_B6, 0x0d),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE3_B0, 0xf3),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE3_B1, 0xf8),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE3_B2, 0xec),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE3_B3, 0xd6),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE3_B4, 0x83),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE3_B5, 0xf5),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MODE_RATE3_B6, 0x5e),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_PHPRE_CTRL, 0x20),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_AUX_DATA_THRESH_BIN_RATE_0_1, 0x3f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_AUX_DATA_THRESH_BIN_RATE_2_3, 0x37),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_DFE_3, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MARG_COARSE_THRESH1_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MARG_COARSE_THRESH2_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MARG_COARSE_THRESH3_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MARG_COARSE_THRESH4_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MARG_COARSE_THRESH5_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MARG_COARSE_THRESH6_RATE3, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MARG_COARSE_THRESH1_RATE210, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MARG_COARSE_THRESH2_RATE210, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_MARG_COARSE_THRESH3_RATE210, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_Q_PI_INTRINSIC_BIAS_RATE32, 0x09),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_UCDR_FO_GAIN_RATE2, 0x0c),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_UCDR_FO_GAIN_RATE3, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_UCDR_SO_GAIN_RATE3, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_VGA_CAL_CNTRL1, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_VGA_CAL_MAN_VAL, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_EQU_ADAPTOR_CNTRL4, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x7c),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_RX_IDAC_SAOFFSET, 0x10),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_DFE_DAC_ENABLE1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_GM_CAL, 0x05),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_TX_ADAPT_POST_THRESH1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V5_20_RX_TX_ADAPT_POST_THRESH2, 0x1f),
+};
+
 struct qmp_pcie_offsets {
 	u16 serdes;
 	u16 pcs;
@@ -2301,6 +2494,8 @@
 	struct phy *phy;
 	int mode;
 
+	bool refclk_always_on;
+
 	struct clk_fixed_rate pipe_clk_fixed;
 };
 
@@ -2936,7 +3131,7 @@
 	.num_resets             = ARRAY_SIZE(sdm845_pciephy_reset_l),
 	.vreg_list              = qmp_phy_vreg_l,
 	.num_vregs              = ARRAY_SIZE(qmp_phy_vreg_l),
-	.regs                   = pciephy_v5_regs_layout,
+	.regs                   = pciephy_v6_regs_layout,
 
 	.pwrdn_ctrl             = SW_PWRDN,
 	.phy_status             = PHYSTATUS_4_20,
@@ -3013,7 +3208,7 @@
 	.num_resets		= ARRAY_SIZE(sdm845_pciephy_reset_l),
 	.vreg_list		= qmp_phy_vreg_l,
 	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
-	.regs			= pciephy_v5_regs_layout,
+	.regs			= pciephy_v5_20_regs_layout,
 
 	.pwrdn_ctrl		= SW_PWRDN | REFCLK_DRV_DSBL,
 	.phy_status		= PHYSTATUS_4_20,
@@ -3069,7 +3264,7 @@
 	.num_resets		= ARRAY_SIZE(sdm845_pciephy_reset_l),
 	.vreg_list		= sm8550_qmp_phy_vreg_l,
 	.num_vregs		= ARRAY_SIZE(sm8550_qmp_phy_vreg_l),
-	.regs			= pciephy_v5_regs_layout,
+	.regs			= pciephy_v6_20_regs_layout,
 
 	.pwrdn_ctrl		= SW_PWRDN | REFCLK_DRV_DSBL,
 	.phy_status		= PHYSTATUS_4_20,
@@ -3099,7 +3294,7 @@
 	.num_resets		= ARRAY_SIZE(sdm845_pciephy_reset_l),
 	.vreg_list		= sm8550_qmp_phy_vreg_l,
 	.num_vregs		= ARRAY_SIZE(sm8550_qmp_phy_vreg_l),
-	.regs			= pciephy_v5_regs_layout,
+	.regs			= pciephy_v6_regs_layout,
 
 	.pwrdn_ctrl		= SW_PWRDN | REFCLK_DRV_DSBL,
 	.phy_status		= PHYSTATUS_4_20,
@@ -3143,7 +3338,7 @@
 	.num_resets		= ARRAY_SIZE(sdm845_pciephy_reset_l),
 	.vreg_list		= qmp_phy_vreg_l,
 	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
-	.regs			= pciephy_v5_regs_layout,
+	.regs			= pciephy_v5_20_regs_layout,
 
 	.pwrdn_ctrl		= SW_PWRDN | REFCLK_DRV_DSBL,
 	.phy_status		= PHYSTATUS_4_20,
@@ -3183,31 +3378,69 @@
 	.phy_status		= PHYSTATUS_4_20,
 };
 
-static void qmp_pcie_configure_lane(void __iomem *base,
-					const struct qmp_phy_init_tbl tbl[],
-					int num,
-					u8 lane_mask)
-{
-	int i;
-	const struct qmp_phy_init_tbl *t = tbl;
+static const struct qmp_phy_cfg x1e80100_qmp_gen4x2_pciephy_cfg = {
+	.lanes = 2,
 
-	if (!t)
-		return;
+	.offsets		= &qmp_pcie_offsets_v6_20,
 
-	for (i = 0; i < num; i++, t++) {
-		if (!(t->lane_mask & lane_mask))
-			continue;
+	.tbls = {
+		.serdes			= x1e80100_qmp_gen4x2_pcie_serdes_tbl,
+		.serdes_num		= ARRAY_SIZE(x1e80100_qmp_gen4x2_pcie_serdes_tbl),
+		.tx			= x1e80100_qmp_gen4x2_pcie_tx_tbl,
+		.tx_num			= ARRAY_SIZE(x1e80100_qmp_gen4x2_pcie_tx_tbl),
+		.rx			= x1e80100_qmp_gen4x2_pcie_rx_tbl,
+		.rx_num			= ARRAY_SIZE(x1e80100_qmp_gen4x2_pcie_rx_tbl),
+		.pcs			= x1e80100_qmp_gen4x2_pcie_pcs_tbl,
+		.pcs_num		= ARRAY_SIZE(x1e80100_qmp_gen4x2_pcie_pcs_tbl),
+		.pcs_misc		= x1e80100_qmp_gen4x2_pcie_pcs_misc_tbl,
+		.pcs_misc_num		= ARRAY_SIZE(x1e80100_qmp_gen4x2_pcie_pcs_misc_tbl),
+		.ln_shrd		= x1e80100_qmp_gen4x2_pcie_ln_shrd_tbl,
+		.ln_shrd_num		= ARRAY_SIZE(x1e80100_qmp_gen4x2_pcie_ln_shrd_tbl),
+	},
+	.reset_list		= sdm845_pciephy_reset_l,
+	.num_resets		= ARRAY_SIZE(sdm845_pciephy_reset_l),
+	.vreg_list		= sm8550_qmp_phy_vreg_l,
+	.num_vregs		= ARRAY_SIZE(sm8550_qmp_phy_vreg_l),
+	.regs			= pciephy_v6_regs_layout,
 
-		writel(t->val, base + t->offset);
-	}
-}
+	.pwrdn_ctrl		= SW_PWRDN | REFCLK_DRV_DSBL,
+	.phy_status		= PHYSTATUS_4_20,
+	.has_nocsr_reset	= true,
+};
 
-static void qmp_pcie_configure(void __iomem *base,
-					const struct qmp_phy_init_tbl tbl[],
-					int num)
-{
-	qmp_pcie_configure_lane(base, tbl, num, 0xff);
-}
+static const struct qmp_phy_cfg qcs8300_qmp_gen4x2_pciephy_cfg = {
+	.lanes			= 2,
+	.offsets		= &qmp_pcie_offsets_v5_20,
+
+	.tbls = {
+		.serdes		= sa8775p_qmp_gen4x2_pcie_serdes_alt_tbl,
+		.serdes_num		= ARRAY_SIZE(sa8775p_qmp_gen4x2_pcie_serdes_alt_tbl),
+		.tx		= sa8775p_qmp_gen4_pcie_tx_tbl,
+		.tx_num		= ARRAY_SIZE(sa8775p_qmp_gen4_pcie_tx_tbl),
+		.rx		= qcs8300_qmp_gen4x2_pcie_rx_alt_tbl,
+		.rx_num		= ARRAY_SIZE(qcs8300_qmp_gen4x2_pcie_rx_alt_tbl),
+		.pcs		= sa8775p_qmp_gen4x2_pcie_pcs_alt_tbl,
+		.pcs_num		= ARRAY_SIZE(sa8775p_qmp_gen4x2_pcie_pcs_alt_tbl),
+		.pcs_misc		= sa8775p_qmp_gen4_pcie_pcs_misc_tbl,
+		.pcs_misc_num	= ARRAY_SIZE(sa8775p_qmp_gen4_pcie_pcs_misc_tbl),
+	},
+
+	.tbls_rc = &(const struct qmp_phy_cfg_tbls) {
+		.serdes		= sa8775p_qmp_gen4x2_pcie_rc_serdes_alt_tbl,
+		.serdes_num	= ARRAY_SIZE(sa8775p_qmp_gen4x2_pcie_rc_serdes_alt_tbl),
+		.pcs_misc	= sa8775p_qmp_gen4_pcie_rc_pcs_misc_tbl,
+		.pcs_misc_num	= ARRAY_SIZE(sa8775p_qmp_gen4_pcie_rc_pcs_misc_tbl),
+	},
+
+	.reset_list		= sdm845_pciephy_reset_l,
+	.num_resets		= ARRAY_SIZE(sdm845_pciephy_reset_l),
+	.vreg_list		= qmp_phy_vreg_l,
+	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
+	.regs			= pciephy_v5_20_regs_layout,
+
+	.pwrdn_ctrl		= SW_PWRDN | REFCLK_DRV_DSBL,
+	.phy_status		= PHYSTATUS_4_20,
+};
 
 static void qmp_pcie_init_port_b(struct qmp_pcie *qmp, const struct qmp_phy_cfg_tbls *tbls)
 {
@@ -3220,11 +3453,11 @@
 	tx4 = qmp->port_b + offs->tx2;
 	rx4 = qmp->port_b + offs->rx2;
 
-	qmp_pcie_configure_lane(tx3, tbls->tx, tbls->tx_num, 1);
-	qmp_pcie_configure_lane(rx3, tbls->rx, tbls->rx_num, 1);
+	qmp_configure_lane(qmp->dev, tx3, tbls->tx, tbls->tx_num, 1);
+	qmp_configure_lane(qmp->dev, rx3, tbls->rx, tbls->rx_num, 1);
 
-	qmp_pcie_configure_lane(tx4, tbls->tx, tbls->tx_num, 2);
-	qmp_pcie_configure_lane(rx4, tbls->rx, tbls->rx_num, 2);
+	qmp_configure_lane(qmp->dev, tx4, tbls->tx, tbls->tx_num, 2);
+	qmp_configure_lane(qmp->dev, rx4, tbls->rx, tbls->rx_num, 2);
 }
 
 static void qmp_pcie_init_registers(struct qmp_pcie *qmp, const struct qmp_phy_cfg_tbls *tbls)
@@ -3242,25 +3475,30 @@
 	if (!tbls)
 		return;
 
-	qmp_pcie_configure(serdes, tbls->serdes, tbls->serdes_num);
+	qmp_configure(qmp->dev, serdes, tbls->serdes, tbls->serdes_num);
 
-	qmp_pcie_configure_lane(tx, tbls->tx, tbls->tx_num, 1);
-	qmp_pcie_configure_lane(rx, tbls->rx, tbls->rx_num, 1);
+	qmp_configure_lane(qmp->dev, tx, tbls->tx, tbls->tx_num, 1);
+	qmp_configure_lane(qmp->dev, rx, tbls->rx, tbls->rx_num, 1);
 
 	if (cfg->lanes >= 2) {
-		qmp_pcie_configure_lane(tx2, tbls->tx, tbls->tx_num, 2);
-		qmp_pcie_configure_lane(rx2, tbls->rx, tbls->rx_num, 2);
+		qmp_configure_lane(qmp->dev, tx2, tbls->tx, tbls->tx_num, 2);
+		qmp_configure_lane(qmp->dev, rx2, tbls->rx, tbls->rx_num, 2);
 	}
 
-	qmp_pcie_configure(pcs, tbls->pcs, tbls->pcs_num);
-	qmp_pcie_configure(pcs_misc, tbls->pcs_misc, tbls->pcs_misc_num);
+	qmp_configure(qmp->dev, pcs, tbls->pcs, tbls->pcs_num);
+	qmp_configure(qmp->dev, pcs_misc, tbls->pcs_misc, tbls->pcs_misc_num);
+
+	if (qmp->refclk_always_on && cfg->regs[QPHY_PCS_ENDPOINT_REFCLK_CNTRL])
+		qphy_setbits(pcs_misc, cfg->regs[QPHY_PCS_ENDPOINT_REFCLK_CNTRL],
+			     EPCLK_ALWAYS_ON_EN);
 
 	if (cfg->lanes >= 4 && qmp->tcsr_4ln_config) {
-		qmp_pcie_configure(serdes, cfg->serdes_4ln_tbl, cfg->serdes_4ln_num);
+		qmp_configure(qmp->dev, serdes, cfg->serdes_4ln_tbl,
+			      cfg->serdes_4ln_num);
 		qmp_pcie_init_port_b(qmp, tbls);
 	}
 
-	qmp_pcie_configure(ln_shrd, tbls->ln_shrd, tbls->ln_shrd_num);
+	qmp_configure(qmp->dev, ln_shrd, tbls->ln_shrd, tbls->ln_shrd_num);
 }
 
 static int qmp_pcie_init(struct phy *phy)
@@ -3777,6 +4015,12 @@
 	if (ret)
 		goto err_node_put;
 
+	qmp->refclk_always_on = of_property_read_bool(dev->of_node, "qcom,refclk-always-on");
+	if (qmp->refclk_always_on && !qmp->cfg->regs[QPHY_PCS_ENDPOINT_REFCLK_CNTRL]) {
+		dev_err(dev, "refclk is always on is present but refclk cntrl offset is not present\n");
+		goto err_node_put;
+	}
+
 	ret = phy_pipe_clk_register(qmp, np);
 	if (ret)
 		goto err_node_put;
@@ -3823,6 +4067,9 @@
 		.compatible = "qcom,sa8775p-qmp-gen4x4-pcie-phy",
 		.data = &sa8775p_qmp_gen4x4_pciephy_cfg,
 	}, {
+		.compatible = "qcom,qcs8300-qmp-gen4x2-pcie-phy",
+		.data = &qcs8300_qmp_gen4x2_pciephy_cfg,
+	}, {
 		.compatible = "qcom,sc8180x-qmp-pcie-phy",
 		.data = &sc8180x_pciephy_cfg,
 	}, {
@@ -3885,6 +4132,12 @@
 	}, {
 		.compatible = "qcom,sm8650-qmp-gen4x2-pcie-phy",
 		.data = &sm8650_qmp_gen4x2_pciephy_cfg,
+	}, {
+		.compatible = "qcom,x1e80100-qmp-gen3x2-pcie-phy",
+		.data = &sm8550_qmp_gen3x2_pciephy_cfg,
+	}, {
+		.compatible = "qcom,x1e80100-qmp-gen4x2-pcie-phy",
+		.data = &x1e80100_qmp_gen4x2_pciephy_cfg,
 	},
 	{ },
 };
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcs-pcie-v5.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcs-pcie-v5.h
@@ -11,6 +11,7 @@
 #define QPHY_V5_PCS_PCIE_POWER_STATE_CONFIG2		0x0c
 #define QPHY_V5_PCS_PCIE_POWER_STATE_CONFIG4		0x14
 #define QPHY_V5_PCS_PCIE_ENDPOINT_REFCLK_DRIVE		0x20
+#define QPHY_V5_PCS_PCIE_ENDPOINT_REFCLK_CNTRL		0x24
 #define QPHY_V5_PCS_PCIE_INT_AUX_CLK_CONFIG1		0x54
 #define QPHY_V5_PCS_PCIE_OSC_DTCT_ACTIONS		0x94
 #define QPHY_V5_PCS_PCIE_EQ_CONFIG2			0xa8
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcs-pcie-v5_20.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcs-pcie-v5_20.h
@@ -9,6 +9,7 @@
 /* Only for QMP V5_20 PHY - PCIe PCS registers */
 #define QPHY_V5_20_PCS_PCIE_POWER_STATE_CONFIG2		0x00c
 #define QPHY_V5_20_PCS_PCIE_ENDPOINT_REFCLK_DRIVE	0x01c
+#define QPHY_V5_20_PCS_PCIE_ENDPOINT_REFCLK_CNTRL	0x020
 #define QPHY_V5_20_PCS_PCIE_OSC_DTCT_MODE2_CONFIG5	0x084
 #define QPHY_V5_20_PCS_PCIE_OSC_DTCT_ACTIONS		0x090
 #define QPHY_V5_20_PCS_PCIE_EQ_CONFIG1			0x0a0
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcs-pcie-v6.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcs-pcie-v6.h
@@ -7,6 +7,8 @@
 #define QCOM_PHY_QMP_PCS_PCIE_V6_H_
 
 /* Only for QMP V6 PHY - PCIE have different offsets than V5 */
+#define QPHY_PCIE_V6_PCS_PCIE_EQ_CONFIG1		0xa4
+#define QPHY_PCIE_V6_PCS_PCIE_RXEQEVAL_TIME		0xf4
 #define QPHY_PCIE_V6_PCS_PCIE_POWER_STATE_CONFIG2	0x0c
 #define QPHY_PCIE_V6_PCS_PCIE_POWER_STATE_CONFIG4	0x14
 #define QPHY_PCIE_V6_PCS_PCIE_ENDPOINT_REFCLK_DRIVE	0x20
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcs-pcie-v6_20.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcs-pcie-v6_20.h
@@ -10,8 +10,11 @@
 #define QPHY_PCIE_V6_20_PCS_POWER_STATE_CONFIG2		0x00c
 #define QPHY_PCIE_V6_20_PCS_TX_RX_CONFIG		0x018
 #define QPHY_PCIE_V6_20_PCS_ENDPOINT_REFCLK_DRIVE	0x01c
+#define QPHY_PCIE_V6_20_PCS_ENDPOINT_REFCLK_CNTRL	0x020
 #define QPHY_PCIE_V6_20_PCS_OSC_DTCT_ATCIONS		0x090
 #define QPHY_PCIE_V6_20_PCS_EQ_CONFIG1			0x0a0
+#define QPHY_PCIE_V6_20_PCS_G3_RXEQEVAL_TIME		0x0f0
+#define QPHY_PCIE_V6_20_PCS_G4_RXEQEVAL_TIME		0x0f4
 #define QPHY_PCIE_V6_20_PCS_EQ_CONFIG5			0x108
 #define QPHY_PCIE_V6_20_PCS_G4_PRE_GAIN			0x15c
 #define QPHY_PCIE_V6_20_PCS_RX_MARGINING_CONFIG1	0x17c
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcs-ufs-v6.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcs-ufs-v6.h
@@ -19,6 +19,7 @@
 #define QPHY_V6_PCS_UFS_BIST_FIXED_PAT_CTRL		0x060
 #define QPHY_V6_PCS_UFS_TX_HSGEAR_CAPABILITY		0x074
 #define QPHY_V6_PCS_UFS_RX_HSGEAR_CAPABILITY		0x0bc
+#define QPHY_V6_PCS_UFS_RX_HS_G5_SYNC_LENGTH_CAPABILITY	0x12c
 #define QPHY_V6_PCS_UFS_DEBUG_BUS_CLKSEL		0x158
 #define QPHY_V6_PCS_UFS_LINECFG_DISABLE			0x17c
 #define QPHY_V6_PCS_UFS_RX_MIN_HIBERN8_TIME		0x184
@@ -28,5 +29,6 @@
 #define QPHY_V6_PCS_UFS_READY_STATUS			0x1a8
 #define QPHY_V6_PCS_UFS_TX_MID_TERM_CTRL1		0x1f4
 #define QPHY_V6_PCS_UFS_MULTI_LANE_CTRL1		0x1fc
+#define QPHY_V6_PCS_UFS_RX_HSG5_SYNC_WAIT_TIME		0x220
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcs-v5_20.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcs-v5_20.h
@@ -8,6 +8,10 @@
 
 #define QPHY_V5_20_PCS_INSIG_SW_CTRL7			0x060
 #define QPHY_V5_20_PCS_INSIG_MX_CTRL7			0x07c
+#define QPHY_V5_20_PCS_SW_RESET				0x000
+#define QPHY_V5_20_PCS_PCS_STATUS1			0x014
+#define QPHY_V5_20_PCS_POWER_DOWN_CONTROL		0x040
+#define QPHY_V5_20_PCS_START_CONTROL			0x044
 #define QPHY_V5_20_PCS_G3S2_PRE_GAIN			0x170
 #define QPHY_V5_20_PCS_RX_SIGDET_LVL			0x188
 #define QPHY_V5_20_PCS_EQ_CONFIG2			0x1d8
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcs-v6-n4.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcs-v6-n4.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2023, Linaro Limited
+ */
+
+#ifndef QCOM_PHY_QMP_PCS_V6_N4_H_
+#define QCOM_PHY_QMP_PCS_V6_N4_H_
+
+/* Only for QMP V6 N4 PHY - USB/PCIe PCS registers */
+#define QPHY_V6_N4_PCS_SW_RESET			0x000
+#define QPHY_V6_N4_PCS_PCS_STATUS1		0x014
+#define QPHY_V6_N4_PCS_POWER_DOWN_CONTROL	0x040
+#define QPHY_V6_N4_PCS_START_CONTROL		0x044
+#define QPHY_V6_N4_PCS_POWER_STATE_CONFIG1	0x090
+#define QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG1	0x0c4
+#define QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG2	0x0c8
+#define QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG3	0x0cc
+#define QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG6	0x0d8
+#define QPHY_V6_N4_PCS_REFGEN_REQ_CONFIG1	0x0dc
+#define QPHY_V6_N4_PCS_RX_SIGDET_LVL		0x188
+#define QPHY_V6_N4_PCS_RCVR_DTCT_DLY_P1U2_L	0x190
+#define QPHY_V6_N4_PCS_RCVR_DTCT_DLY_P1U2_H	0x194
+#define QPHY_V6_N4_PCS_RATE_SLEW_CNTRL1		0x198
+#define QPHY_V6_N4_PCS_RX_CONFIG		0x1b0
+#define QPHY_V6_N4_PCS_ALIGN_DETECT_CONFIG1	0x1c0
+#define QPHY_V6_N4_PCS_ALIGN_DETECT_CONFIG2	0x1c4
+#define QPHY_V6_N4_PCS_PCS_TX_RX_CONFIG		0x1d0
+#define QPHY_V6_N4_PCS_EQ_CONFIG1		0x1dc
+#define QPHY_V6_N4_PCS_EQ_CONFIG2		0x1e0
+#define QPHY_V6_N4_PCS_EQ_CONFIG5		0x1ec
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-pcs-v6_20.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-pcs-v6_20.h
@@ -7,6 +7,11 @@
 #define QCOM_PHY_QMP_PCS_V6_20_H_
 
 /* Only for QMP V6_20 PHY - USB/PCIe PCS registers */
+#define QPHY_V6_20_PCS_SW_RESET				0x000
+#define QPHY_V6_20_PCS_PCS_STATUS1			0x014
+#define QPHY_V6_20_PCS_POWER_DOWN_CONTROL		0x040
+#define QPHY_V6_20_PCS_START_CONTROL			0x044
+#define QPHY_V6_20_PCS_G12S1_TXDEEMPH_M6DB		0x170
 #define QPHY_V6_20_PCS_G3S2_PRE_GAIN			0x178
 #define QPHY_V6_20_PCS_RX_SIGDET_LVL			0x190
 #define QPHY_V6_20_PCS_COM_ELECIDLE_DLY_SEL		0x1b8
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-qserdes-com-v6.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-qserdes-com-v6.h
@@ -60,6 +60,8 @@
 #define QSERDES_V6_COM_SYSCLK_BUF_ENABLE			0xe8
 #define QSERDES_V6_COM_PLL_IVCO					0xf4
 #define QSERDES_V6_COM_PLL_IVCO_MODE1				0xf8
+#define QSERDES_V6_COM_CMN_IETRIM				0xfc
+#define QSERDES_V6_COM_CMN_IPTRIM				0x100
 #define QSERDES_V6_COM_SYSCLK_EN_SEL				0x110
 #define QSERDES_V6_COM_RESETSM_CNTRL				0x118
 #define QSERDES_V6_COM_LOCK_CMP_EN				0x120
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-qserdes-txrx-ufs-v6.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-qserdes-txrx-ufs-v6.h
@@ -15,13 +15,19 @@
 
 #define QSERDES_UFS_V6_RX_UCDR_FASTLOCK_FO_GAIN_RATE2		0x08
 #define QSERDES_UFS_V6_RX_UCDR_FASTLOCK_FO_GAIN_RATE4		0x10
+#define QSERDES_UFS_V6_RX_UCDR_FASTLOCK_SO_GAIN_RATE4		0x24
 #define QSERDES_UFS_V6_RX_UCDR_SO_SATURATION			0x28
+#define QSERDES_UFS_V6_RX_UCDR_FASTLOCK_COUNT_HIGH_RATE4	0x54
 #define QSERDES_UFS_V6_RX_UCDR_PI_CTRL1				0x58
 #define QSERDES_UFS_V6_RX_RX_TERM_BW_CTRL0			0xc4
 #define QSERDES_UFS_V6_RX_UCDR_FO_GAIN_RATE2			0xd4
 #define QSERDES_UFS_V6_RX_UCDR_FO_GAIN_RATE4			0xdc
+#define QSERDES_UFS_V6_RX_UCDR_SO_GAIN_RATE4			0xf0
+#define QSERDES_UFS_V6_RX_UCDR_PI_CONTROLS			0xf4
 #define QSERDES_UFS_V6_RX_VGA_CAL_MAN_VAL			0x178
+#define QSERDES_UFS_V6_RX_EQ_OFFSET_ADAPTOR_CNTRL1		0x1bc
 #define QSERDES_UFS_V6_RX_INTERFACE_MODE			0x1e0
+#define QSERDES_UFS_V6_RX_OFFSET_ADAPTOR_CNTRL3			0x1c4
 #define QSERDES_UFS_V6_RX_MODE_RATE_0_1_B0			0x208
 #define QSERDES_UFS_V6_RX_MODE_RATE_0_1_B1			0x20c
 #define QSERDES_UFS_V6_RX_MODE_RATE_0_1_B3			0x214
@@ -33,6 +39,8 @@
 #define QSERDES_UFS_V6_RX_MODE_RATE3_B5				0x264
 #define QSERDES_UFS_V6_RX_MODE_RATE3_B8				0x270
 #define QSERDES_UFS_V6_RX_MODE_RATE4_B3				0x280
+#define QSERDES_UFS_V6_RX_MODE_RATE4_B4				0x284
 #define QSERDES_UFS_V6_RX_MODE_RATE4_B6				0x28c
+#define QSERDES_UFS_V6_RX_DLL0_FTUNE_CTRL			0x2f8
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-qserdes-txrx-v6_20.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-qserdes-txrx-v6_20.h
@@ -23,6 +23,8 @@
 #define QSERDES_V6_20_RX_DFE_1					0xac
 #define QSERDES_V6_20_RX_DFE_2					0xb0
 #define QSERDES_V6_20_RX_DFE_3					0xb4
+#define QSERDES_V6_20_RX_TX_ADPT_CTRL				0xd4
+#define QSERDES_V6_20_VGA_CAL_CNTRL1				0xe0
 #define QSERDES_V6_20_RX_VGA_CAL_MAN_VAL			0xe8
 #define QSERDES_V6_20_RX_GM_CAL					0x10c
 #define QSERDES_V6_20_RX_EQU_ADAPTOR_CNTRL4			0x120
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-qserdes-txrx-v6_n4.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-qserdes-txrx-v6_n4.h
@@ -6,11 +6,24 @@
 #ifndef QCOM_PHY_QMP_QSERDES_TXRX_V6_N4_H_
 #define QCOM_PHY_QMP_QSERDES_TXRX_V6_N4_H_
 
+#define QSERDES_V6_N4_TX_CLKBUF_ENABLE			0x08
+#define QSERDES_V6_N4_TX_TX_EMP_POST1_LVL		0x0c
+#define QSERDES_V6_N4_TX_TX_DRV_LVL			0x14
+#define QSERDES_V6_N4_TX_RESET_TSYNC_EN			0x1c
+#define QSERDES_V6_N4_TX_PRE_STALL_LDO_BOOST_EN		0x20
 #define QSERDES_V6_N4_TX_RES_CODE_LANE_OFFSET_TX	0x30
 #define QSERDES_V6_N4_TX_RES_CODE_LANE_OFFSET_RX	0x34
+#define QSERDES_V6_N4_TX_TRANSCEIVER_BIAS_EN		0x48
+#define QSERDES_V6_N4_TX_HIGHZ_DRVR_EN			0x4c
+#define QSERDES_V6_N4_TX_TX_POL_INV			0x50
+#define QSERDES_V6_N4_TX_PARRATE_REC_DETECT_IDLE_EN	0x54
 #define QSERDES_V6_N4_TX_LANE_MODE_1			0x78
 #define QSERDES_V6_N4_TX_LANE_MODE_2			0x7c
 #define QSERDES_V6_N4_TX_LANE_MODE_3			0x80
+#define QSERDES_V6_N4_TX_TRAN_DRVR_EMP_EN		0xac
+#define QSERDES_V6_N4_TX_TX_BAND			0xd8
+#define QSERDES_V6_N4_TX_INTERFACE_SELECT		0xe4
+#define QSERDES_V6_N4_TX_VMODE_CTRL1			0xb0
 
 #define QSERDES_V6_N4_RX_UCDR_FO_GAIN_RATE2		0x8
 #define QSERDES_V6_N4_RX_UCDR_SO_GAIN_RATE2		0x18
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-ufs.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-ufs.c
@@ -20,6 +20,9 @@
 #include <linux/slab.h>
 
 #include <ufs/unipro.h>
+
+#include "phy-qcom-qmp-common.h"
+
 #include "phy-qcom-qmp.h"
 #include "phy-qcom-qmp-pcs-ufs-v2.h"
 #include "phy-qcom-qmp-pcs-ufs-v3.h"
@@ -29,41 +32,12 @@
 
 #include "phy-qcom-qmp-qserdes-txrx-ufs-v6.h"
 
-/* QPHY_SW_RESET bit */
-#define SW_RESET				BIT(0)
-/* QPHY_POWER_DOWN_CONTROL */
-#define SW_PWRDN				BIT(0)
-/* QPHY_START_CONTROL bits */
-#define SERDES_START				BIT(0)
-#define PCS_START				BIT(1)
 /* QPHY_PCS_READY_STATUS bit */
 #define PCS_READY				BIT(0)
 
 #define PHY_INIT_COMPLETE_TIMEOUT		10000
 
-struct qmp_phy_init_tbl {
-	unsigned int offset;
-	unsigned int val;
-	/*
-	 * mask of lanes for which this register is written
-	 * for cases when second lane needs different values
-	 */
-	u8 lane_mask;
-};
-
-#define QMP_PHY_INIT_CFG(o, v)		\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = 0xff,	\
-	}
-
-#define QMP_PHY_INIT_CFG_LANE(o, v, l)	\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = l,		\
-	}
+#define NUM_OVERLAY				2
 
 /* set of registers with offsets different per-PHY */
 enum qphy_reg_layout {
@@ -754,15 +728,22 @@
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_HSCLK_SEL_1, 0x11),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_HSCLK_HS_SWITCH_SEL_1, 0x00),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP_EN, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_V6_COM_VCO_TUNE_MAP, 0x04),
-	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_IVCO, 0x0f),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_VCO_TUNE_INITVAL2, 0x00),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE0, 0x41),
-	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CP_CTRL_MODE0, 0x0a),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_RCTRL_MODE0, 0x18),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_CCTRL_MODE0, 0x14),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP1_MODE0, 0x7f),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP2_MODE0, 0x06),
+};
+
+static const struct qmp_phy_init_tbl sm8550_ufsphy_hs_b_serdes[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_VCO_TUNE_MAP, 0x44),
+};
+
+static const struct qmp_phy_init_tbl sm8550_ufsphy_g4_serdes[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_VCO_TUNE_MAP, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_IVCO, 0x0f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CP_CTRL_MODE0, 0x0a),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_DEC_START_MODE1, 0x4c),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CP_CTRL_MODE1, 0x0a),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_RCTRL_MODE1, 0x18),
@@ -771,19 +752,24 @@
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_LOCK_CMP2_MODE1, 0x07),
 };
 
-static const struct qmp_phy_init_tbl sm8550_ufsphy_hs_b_serdes[] = {
-	QMP_PHY_INIT_CFG(QSERDES_V6_COM_VCO_TUNE_MAP, 0x44),
+static const struct qmp_phy_init_tbl sm8550_ufsphy_g5_serdes[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_PLL_IVCO, 0x1f),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CMN_IETRIM, 0x1b),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CMN_IPTRIM, 0x1c),
+	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CP_CTRL_MODE0, 0x06),
 };
 
 static const struct qmp_phy_init_tbl sm8550_ufsphy_tx[] = {
 	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_TX_LANE_MODE_1, 0x05),
 	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_TX_RES_CODE_LANE_OFFSET_TX, 0x07),
+};
+
+static const struct qmp_phy_init_tbl sm8550_ufsphy_g4_tx[] = {
 	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_TX_FR_DCC_CTRL, 0x4c),
 };
 
 static const struct qmp_phy_init_tbl sm8550_ufsphy_rx[] = {
 	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_UCDR_FO_GAIN_RATE2, 0x0c),
-	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_VGA_CAL_MAN_VAL, 0x0e),
 
 	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_MODE_RATE_0_1_B0, 0xc2),
 	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_MODE_RATE_0_1_B1, 0xc2),
@@ -799,16 +785,45 @@
 	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_MODE_RATE3_B8, 0x02),
 };
 
+static const struct qmp_phy_init_tbl sm8550_ufsphy_g4_rx[] = {
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_VGA_CAL_MAN_VAL, 0x0e),
+};
+
+static const struct qmp_phy_init_tbl sm8550_ufsphy_g5_rx[] = {
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_UCDR_FO_GAIN_RATE4, 0x0c),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_UCDR_SO_GAIN_RATE4, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x14),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_UCDR_PI_CONTROLS, 0x07),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_OFFSET_ADAPTOR_CNTRL3, 0x0e),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_UCDR_FASTLOCK_COUNT_HIGH_RATE4, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_UCDR_FASTLOCK_FO_GAIN_RATE4, 0x1c),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_UCDR_FASTLOCK_SO_GAIN_RATE4, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_VGA_CAL_MAN_VAL, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_MODE_RATE4_B3, 0xb9),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_MODE_RATE4_B4, 0x4f),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_MODE_RATE4_B6, 0xff),
+	QMP_PHY_INIT_CFG(QSERDES_UFS_V6_RX_DLL0_FTUNE_CTRL, 0x30),
+};
+
 static const struct qmp_phy_init_tbl sm8550_ufsphy_pcs[] = {
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_RX_SIGDET_CTRL2, 0x69),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_TX_LARGE_AMP_DRV_LVL, 0x0f),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_TX_MID_TERM_CTRL1, 0x43),
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_PLL_CNTL, 0x2b),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_MULTI_LANE_CTRL1, 0x02),
+};
+
+static const struct qmp_phy_init_tbl sm8550_ufsphy_g4_pcs[] = {
+	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_PLL_CNTL, 0x2b),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_TX_HSGEAR_CAPABILITY, 0x04),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_RX_HSGEAR_CAPABILITY, 0x04),
 };
 
+static const struct qmp_phy_init_tbl sm8550_ufsphy_g5_pcs[] = {
+	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_PLL_CNTL, 0x33),
+	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_RX_HS_G5_SYNC_LENGTH_CAPABILITY, 0x4f),
+	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_RX_HSG5_SYNC_WAIT_TIME, 0x9e),
+};
+
 static const struct qmp_phy_init_tbl sm8650_ufsphy_serdes[] = {
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_SYSCLK_EN_SEL, 0xd9),
 	QMP_PHY_INIT_CFG(QSERDES_V6_COM_CMN_CONFIG_1, 0x16),
@@ -889,6 +904,8 @@
 	int rx_num;
 	const struct qmp_phy_init_tbl *pcs;
 	int pcs_num;
+	/* Maximum supported Gear of this tbls */
+	u32 max_gear;
 };
 
 /* struct qmp_phy_cfg - per-PHY initialization config */
@@ -896,13 +913,15 @@
 	int lanes;
 
 	const struct qmp_ufs_offsets *offsets;
+	/* Maximum supported Gear of this config */
+	u32 max_supported_gear;
 
 	/* Main init sequence for PHY blocks - serdes, tx, rx, pcs */
 	const struct qmp_phy_cfg_tbls tbls;
 	/* Additional sequence for HS Series B */
 	const struct qmp_phy_cfg_tbls tbls_hs_b;
-	/* Additional sequence for HS G4 */
-	const struct qmp_phy_cfg_tbls tbls_hs_g4;
+	/* Additional sequence for different HS Gears */
+	const struct qmp_phy_cfg_tbls tbls_hs_overlay[NUM_OVERLAY];
 
 	/* clock ids to be requested */
 	const char * const *clk_list;
@@ -1005,6 +1024,7 @@
 	.lanes			= 1,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G3,
 
 	.tbls = {
 		.serdes		= msm8996_ufsphy_serdes,
@@ -1030,6 +1050,7 @@
 	.lanes			= 2,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G4,
 
 	.tbls = {
 		.serdes		= sm8350_ufsphy_serdes,
@@ -1045,13 +1066,14 @@
 		.serdes		= sm8350_ufsphy_hs_b_serdes,
 		.serdes_num	= ARRAY_SIZE(sm8350_ufsphy_hs_b_serdes),
 	},
-	.tbls_hs_g4 = {
+	.tbls_hs_overlay[0] = {
 		.tx		= sm8350_ufsphy_g4_tx,
 		.tx_num		= ARRAY_SIZE(sm8350_ufsphy_g4_tx),
 		.rx		= sm8350_ufsphy_g4_rx,
 		.rx_num		= ARRAY_SIZE(sm8350_ufsphy_g4_rx),
 		.pcs		= sm8350_ufsphy_g4_pcs,
 		.pcs_num	= ARRAY_SIZE(sm8350_ufsphy_g4_pcs),
+		.max_gear	= UFS_HS_G4,
 	},
 	.clk_list		= sm8450_ufs_phy_clk_l,
 	.num_clks		= ARRAY_SIZE(sm8450_ufs_phy_clk_l),
@@ -1064,6 +1086,7 @@
 	.lanes                  = 2,
 
 	.offsets                = &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G4,
 
 	.tbls = {
 		.serdes         = sm8150_ufsphy_serdes,
@@ -1079,13 +1102,14 @@
 		.serdes         = sm8150_ufsphy_hs_b_serdes,
 		.serdes_num     = ARRAY_SIZE(sm8150_ufsphy_hs_b_serdes),
 	},
-	.tbls_hs_g4 = {
+	.tbls_hs_overlay[0] = {
 		.tx             = sm8250_ufsphy_hs_g4_tx,
 		.tx_num         = ARRAY_SIZE(sm8250_ufsphy_hs_g4_tx),
 		.rx             = sc7280_ufsphy_hs_g4_rx,
 		.rx_num         = ARRAY_SIZE(sc7280_ufsphy_hs_g4_rx),
 		.pcs            = sm8150_ufsphy_hs_g4_pcs,
 		.pcs_num        = ARRAY_SIZE(sm8150_ufsphy_hs_g4_pcs),
+		.max_gear	= UFS_HS_G4,
 	},
 	.clk_list               = sm8450_ufs_phy_clk_l,
 	.num_clks               = ARRAY_SIZE(sm8450_ufs_phy_clk_l),
@@ -1098,6 +1122,7 @@
 	.lanes			= 2,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G4,
 
 	.tbls = {
 		.serdes		= sm8350_ufsphy_serdes,
@@ -1113,13 +1138,14 @@
 		.serdes		= sm8350_ufsphy_hs_b_serdes,
 		.serdes_num	= ARRAY_SIZE(sm8350_ufsphy_hs_b_serdes),
 	},
-	.tbls_hs_g4 = {
+	.tbls_hs_overlay[0] = {
 		.tx		= sm8350_ufsphy_g4_tx,
 		.tx_num		= ARRAY_SIZE(sm8350_ufsphy_g4_tx),
 		.rx		= sm8350_ufsphy_g4_rx,
 		.rx_num		= ARRAY_SIZE(sm8350_ufsphy_g4_rx),
 		.pcs		= sm8350_ufsphy_g4_pcs,
 		.pcs_num	= ARRAY_SIZE(sm8350_ufsphy_g4_pcs),
+		.max_gear	= UFS_HS_G4,
 	},
 	.clk_list		= sdm845_ufs_phy_clk_l,
 	.num_clks		= ARRAY_SIZE(sdm845_ufs_phy_clk_l),
@@ -1132,6 +1158,7 @@
 	.lanes			= 2,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G3,
 
 	.tbls = {
 		.serdes		= sdm845_ufsphy_serdes,
@@ -1160,6 +1187,7 @@
 	.lanes			= 1,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G3,
 
 	.tbls = {
 		.serdes		= sm6115_ufsphy_serdes,
@@ -1188,6 +1216,7 @@
 	.lanes			= 1,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G3,
 
 	.tbls = {
 		.serdes		= sdm845_ufsphy_serdes,
@@ -1216,6 +1245,7 @@
 	.lanes			= 2,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G4,
 
 	.tbls = {
 		.serdes		= sm8150_ufsphy_serdes,
@@ -1231,13 +1261,14 @@
 		.serdes		= sm8150_ufsphy_hs_b_serdes,
 		.serdes_num	= ARRAY_SIZE(sm8150_ufsphy_hs_b_serdes),
 	},
-	.tbls_hs_g4 = {
+	.tbls_hs_overlay[0] = {
 		.tx		= sm8150_ufsphy_hs_g4_tx,
 		.tx_num		= ARRAY_SIZE(sm8150_ufsphy_hs_g4_tx),
 		.rx		= sm8150_ufsphy_hs_g4_rx,
 		.rx_num		= ARRAY_SIZE(sm8150_ufsphy_hs_g4_rx),
 		.pcs		= sm8150_ufsphy_hs_g4_pcs,
 		.pcs_num	= ARRAY_SIZE(sm8150_ufsphy_hs_g4_pcs),
+		.max_gear	= UFS_HS_G4,
 	},
 	.clk_list		= sdm845_ufs_phy_clk_l,
 	.num_clks		= ARRAY_SIZE(sdm845_ufs_phy_clk_l),
@@ -1250,6 +1281,7 @@
 	.lanes			= 2,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G4,
 
 	.tbls = {
 		.serdes		= sm8150_ufsphy_serdes,
@@ -1265,13 +1297,14 @@
 		.serdes		= sm8150_ufsphy_hs_b_serdes,
 		.serdes_num	= ARRAY_SIZE(sm8150_ufsphy_hs_b_serdes),
 	},
-	.tbls_hs_g4 = {
+	.tbls_hs_overlay[0] = {
 		.tx		= sm8250_ufsphy_hs_g4_tx,
 		.tx_num		= ARRAY_SIZE(sm8250_ufsphy_hs_g4_tx),
 		.rx		= sm8250_ufsphy_hs_g4_rx,
 		.rx_num		= ARRAY_SIZE(sm8250_ufsphy_hs_g4_rx),
 		.pcs		= sm8150_ufsphy_hs_g4_pcs,
 		.pcs_num	= ARRAY_SIZE(sm8150_ufsphy_hs_g4_pcs),
+		.max_gear	= UFS_HS_G4,
 	},
 	.clk_list		= sdm845_ufs_phy_clk_l,
 	.num_clks		= ARRAY_SIZE(sdm845_ufs_phy_clk_l),
@@ -1284,6 +1317,7 @@
 	.lanes			= 2,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G4,
 
 	.tbls = {
 		.serdes		= sm8350_ufsphy_serdes,
@@ -1299,13 +1333,14 @@
 		.serdes		= sm8350_ufsphy_hs_b_serdes,
 		.serdes_num	= ARRAY_SIZE(sm8350_ufsphy_hs_b_serdes),
 	},
-	.tbls_hs_g4 = {
+	.tbls_hs_overlay[0] = {
 		.tx		= sm8350_ufsphy_g4_tx,
 		.tx_num		= ARRAY_SIZE(sm8350_ufsphy_g4_tx),
 		.rx		= sm8350_ufsphy_g4_rx,
 		.rx_num		= ARRAY_SIZE(sm8350_ufsphy_g4_rx),
 		.pcs		= sm8350_ufsphy_g4_pcs,
 		.pcs_num	= ARRAY_SIZE(sm8350_ufsphy_g4_pcs),
+		.max_gear	= UFS_HS_G4,
 	},
 	.clk_list		= sdm845_ufs_phy_clk_l,
 	.num_clks		= ARRAY_SIZE(sdm845_ufs_phy_clk_l),
@@ -1318,6 +1353,7 @@
 	.lanes			= 2,
 
 	.offsets		= &qmp_ufs_offsets,
+	.max_supported_gear	= UFS_HS_G4,
 
 	.tbls = {
 		.serdes		= sm8350_ufsphy_serdes,
@@ -1333,13 +1369,14 @@
 		.serdes		= sm8350_ufsphy_hs_b_serdes,
 		.serdes_num	= ARRAY_SIZE(sm8350_ufsphy_hs_b_serdes),
 	},
-	.tbls_hs_g4 = {
+	.tbls_hs_overlay[0] = {
 		.tx		= sm8350_ufsphy_g4_tx,
 		.tx_num		= ARRAY_SIZE(sm8350_ufsphy_g4_tx),
 		.rx		= sm8350_ufsphy_g4_rx,
 		.rx_num		= ARRAY_SIZE(sm8350_ufsphy_g4_rx),
 		.pcs		= sm8350_ufsphy_g4_pcs,
 		.pcs_num	= ARRAY_SIZE(sm8350_ufsphy_g4_pcs),
+		.max_gear	= UFS_HS_G4,
 	},
 	.clk_list		= sm8450_ufs_phy_clk_l,
 	.num_clks		= ARRAY_SIZE(sm8450_ufs_phy_clk_l),
@@ -1352,6 +1389,7 @@
 	.lanes			= 2,
 
 	.offsets		= &qmp_ufs_offsets_v6,
+	.max_supported_gear	= UFS_HS_G5,
 
 	.tbls = {
 		.serdes		= sm8550_ufsphy_serdes,
@@ -1367,6 +1405,26 @@
 		.serdes		= sm8550_ufsphy_hs_b_serdes,
 		.serdes_num	= ARRAY_SIZE(sm8550_ufsphy_hs_b_serdes),
 	},
+	.tbls_hs_overlay[0] = {
+		.serdes		= sm8550_ufsphy_g4_serdes,
+		.serdes_num	= ARRAY_SIZE(sm8550_ufsphy_g4_serdes),
+		.tx		= sm8550_ufsphy_g4_tx,
+		.tx_num		= ARRAY_SIZE(sm8550_ufsphy_g4_tx),
+		.rx		= sm8550_ufsphy_g4_rx,
+		.rx_num		= ARRAY_SIZE(sm8550_ufsphy_g4_rx),
+		.pcs		= sm8550_ufsphy_g4_pcs,
+		.pcs_num	= ARRAY_SIZE(sm8550_ufsphy_g4_pcs),
+		.max_gear	= UFS_HS_G4,
+	},
+	.tbls_hs_overlay[1] = {
+		.serdes		= sm8550_ufsphy_g5_serdes,
+		.serdes_num	= ARRAY_SIZE(sm8550_ufsphy_g5_serdes),
+		.rx		= sm8550_ufsphy_g5_rx,
+		.rx_num		= ARRAY_SIZE(sm8550_ufsphy_g5_rx),
+		.pcs		= sm8550_ufsphy_g5_pcs,
+		.pcs_num	= ARRAY_SIZE(sm8550_ufsphy_g5_pcs),
+		.max_gear	= UFS_HS_G5,
+	},
 	.clk_list		= sdm845_ufs_phy_clk_l,
 	.num_clks		= ARRAY_SIZE(sdm845_ufs_phy_clk_l),
 	.vreg_list		= qmp_phy_vreg_l,
@@ -1378,6 +1436,7 @@
 	.lanes			= 2,
 
 	.offsets		= &qmp_ufs_offsets_v6,
+	.max_supported_gear	= UFS_HS_G5,
 
 	.tbls = {
 		.serdes		= sm8650_ufsphy_serdes,
@@ -1396,37 +1455,11 @@
 	.regs			= ufsphy_v6_regs_layout,
 };
 
-static void qmp_ufs_configure_lane(void __iomem *base,
-					const struct qmp_phy_init_tbl tbl[],
-					int num,
-					u8 lane_mask)
-{
-	int i;
-	const struct qmp_phy_init_tbl *t = tbl;
-
-	if (!t)
-		return;
-
-	for (i = 0; i < num; i++, t++) {
-		if (!(t->lane_mask & lane_mask))
-			continue;
-
-		writel(t->val, base + t->offset);
-	}
-}
-
-static void qmp_ufs_configure(void __iomem *base,
-				   const struct qmp_phy_init_tbl tbl[],
-				   int num)
-{
-	qmp_ufs_configure_lane(base, tbl, num, 0xff);
-}
-
 static void qmp_ufs_serdes_init(struct qmp_ufs *qmp, const struct qmp_phy_cfg_tbls *tbls)
 {
 	void __iomem *serdes = qmp->serdes;
 
-	qmp_ufs_configure(serdes, tbls->serdes, tbls->serdes_num);
+	qmp_configure(qmp->dev, serdes, tbls->serdes, tbls->serdes_num);
 }
 
 static void qmp_ufs_lanes_init(struct qmp_ufs *qmp, const struct qmp_phy_cfg_tbls *tbls)
@@ -1435,12 +1468,12 @@
 	void __iomem *tx = qmp->tx;
 	void __iomem *rx = qmp->rx;
 
-	qmp_ufs_configure_lane(tx, tbls->tx, tbls->tx_num, 1);
-	qmp_ufs_configure_lane(rx, tbls->rx, tbls->rx_num, 1);
+	qmp_configure_lane(qmp->dev, tx, tbls->tx, tbls->tx_num, 1);
+	qmp_configure_lane(qmp->dev, rx, tbls->rx, tbls->rx_num, 1);
 
 	if (cfg->lanes >= 2) {
-		qmp_ufs_configure_lane(qmp->tx2, tbls->tx, tbls->tx_num, 2);
-		qmp_ufs_configure_lane(qmp->rx2, tbls->rx, tbls->rx_num, 2);
+		qmp_configure_lane(qmp->dev, qmp->tx2, tbls->tx, tbls->tx_num, 2);
+		qmp_configure_lane(qmp->dev, qmp->rx2, tbls->rx, tbls->rx_num, 2);
 	}
 }
 
@@ -1448,20 +1481,52 @@
 {
 	void __iomem *pcs = qmp->pcs;
 
-	qmp_ufs_configure(pcs, tbls->pcs, tbls->pcs_num);
+	qmp_configure(qmp->dev, pcs, tbls->pcs, tbls->pcs_num);
+}
+
+static int qmp_ufs_get_gear_overlay(struct qmp_ufs *qmp, const struct qmp_phy_cfg *cfg)
+{
+	u32 max_gear, floor_max_gear = cfg->max_supported_gear;
+	int idx, ret = -EINVAL;
+
+	for (idx = NUM_OVERLAY - 1; idx >= 0; idx--) {
+		max_gear = cfg->tbls_hs_overlay[idx].max_gear;
+
+		/* Skip if the table is not available */
+		if (max_gear == 0)
+			continue;
+
+		/* Direct matching, bail */
+		if (qmp->submode == max_gear)
+			return idx;
+
+		/* If no direct matching, the lowest gear is the best matching */
+		if (max_gear < floor_max_gear) {
+			ret = idx;
+			floor_max_gear = max_gear;
+		}
+	}
+
+	return ret;
 }
 
 static void qmp_ufs_init_registers(struct qmp_ufs *qmp, const struct qmp_phy_cfg *cfg)
 {
+	int i;
+
 	qmp_ufs_serdes_init(qmp, &cfg->tbls);
-	if (qmp->mode == PHY_MODE_UFS_HS_B)
-		qmp_ufs_serdes_init(qmp, &cfg->tbls_hs_b);
 	qmp_ufs_lanes_init(qmp, &cfg->tbls);
-	if (qmp->submode == UFS_HS_G4)
-		qmp_ufs_lanes_init(qmp, &cfg->tbls_hs_g4);
 	qmp_ufs_pcs_init(qmp, &cfg->tbls);
-	if (qmp->submode == UFS_HS_G4)
-		qmp_ufs_pcs_init(qmp, &cfg->tbls_hs_g4);
+
+	i = qmp_ufs_get_gear_overlay(qmp, cfg);
+	if (i >= 0) {
+		qmp_ufs_serdes_init(qmp, &cfg->tbls_hs_overlay[i]);
+		qmp_ufs_lanes_init(qmp, &cfg->tbls_hs_overlay[i]);
+		qmp_ufs_pcs_init(qmp, &cfg->tbls_hs_overlay[i]);
+	}
+
+	if (qmp->mode == PHY_MODE_UFS_HS_B)
+		qmp_ufs_serdes_init(qmp, &cfg->tbls_hs_b);
 }
 
 static int qmp_ufs_com_init(struct qmp_ufs *qmp)
@@ -1633,6 +1698,12 @@
 static int qmp_ufs_set_mode(struct phy *phy, enum phy_mode mode, int submode)
 {
 	struct qmp_ufs *qmp = phy_get_drvdata(phy);
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
+
+	if (submode > cfg->max_supported_gear || submode == 0) {
+		dev_err(qmp->dev, "Invalid PHY submode %d\n", submode);
+		return -EINVAL;
+	}
 
 	qmp->mode = mode;
 	qmp->submode = submode;
@@ -1878,6 +1949,9 @@
 		.compatible = "qcom,msm8998-qmp-ufs-phy",
 		.data = &sdm845_ufsphy_cfg,
 	}, {
+		.compatible = "qcom,qcs8300-qmp-ufs-phy",
+		.data = &sa8775p_ufsphy_cfg,
+	}, {
 		.compatible = "qcom,sa8775p-qmp-ufs-phy",
 		.data = &sa8775p_ufsphy_cfg,
 	}, {
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c
@@ -25,15 +25,7 @@
 #include "phy-qcom-qmp-pcs-usb-v4.h"
 #include "phy-qcom-qmp-pcs-usb-v5.h"
 
-/* QPHY_SW_RESET bit */
-#define SW_RESET				BIT(0)
-/* QPHY_POWER_DOWN_CONTROL */
-#define SW_PWRDN				BIT(0)
-/* QPHY_START_CONTROL bits */
-#define SERDES_START				BIT(0)
-#define PCS_START				BIT(1)
-/* QPHY_PCS_STATUS bit */
-#define PHYSTATUS				BIT(6)
+#include "phy-qcom-qmp-dp-com-v3.h"
 
 /* QPHY_V3_DP_COM_RESET_OVRD_CTRL register bits */
 /* DP PHY soft reset */
@@ -49,17 +41,6 @@
 #define USB3_MODE				BIT(0) /* enables USB3 mode */
 #define DP_MODE					BIT(1) /* enables DP mode */
 
-/* QPHY_PCS_AUTONOMOUS_MODE_CTRL register bits */
-#define ARCVR_DTCT_EN				BIT(0)
-#define ALFPS_DTCT_EN				BIT(1)
-#define ARCVR_DTCT_EVENT_SEL			BIT(4)
-
-/* QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR register bits */
-#define IRQ_CLEAR				BIT(0)
-
-/* QPHY_V3_PCS_MISC_CLAMP_ENABLE register bits */
-#define CLAMP_EN				BIT(0) /* enables i/o clamp_n */
-
 #define PHY_INIT_COMPLETE_TIMEOUT		10000
 
 struct qmp_phy_init_tbl {
@@ -1302,6 +1283,7 @@
 		return -ENOMEM;
 
 	qmp->dev = dev;
+	dev_set_drvdata(dev, qmp);
 
 	qmp->cfg = of_device_get_match_data(dev);
 	if (!qmp->cfg)
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-usb.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-usb.c
@@ -19,6 +19,8 @@
 #include <linux/reset.h>
 #include <linux/slab.h>
 
+#include "phy-qcom-qmp-common.h"
+
 #include "phy-qcom-qmp.h"
 #include "phy-qcom-qmp-pcs-misc-v3.h"
 #include "phy-qcom-qmp-pcs-misc-v4.h"
@@ -27,67 +29,8 @@
 #include "phy-qcom-qmp-pcs-usb-v6.h"
 #include "phy-qcom-qmp-pcs-usb-v7.h"
 
-/* QPHY_SW_RESET bit */
-#define SW_RESET				BIT(0)
-/* QPHY_POWER_DOWN_CONTROL */
-#define SW_PWRDN				BIT(0)
-/* QPHY_START_CONTROL bits */
-#define SERDES_START				BIT(0)
-#define PCS_START				BIT(1)
-/* QPHY_PCS_STATUS bit */
-#define PHYSTATUS				BIT(6)
-
-/* QPHY_V3_DP_COM_RESET_OVRD_CTRL register bits */
-/* DP PHY soft reset */
-#define SW_DPPHY_RESET				BIT(0)
-/* mux to select DP PHY reset control, 0:HW control, 1: software reset */
-#define SW_DPPHY_RESET_MUX			BIT(1)
-/* USB3 PHY soft reset */
-#define SW_USB3PHY_RESET			BIT(2)
-/* mux to select USB3 PHY reset control, 0:HW control, 1: software reset */
-#define SW_USB3PHY_RESET_MUX			BIT(3)
-
-/* QPHY_V3_DP_COM_PHY_MODE_CTRL register bits */
-#define USB3_MODE				BIT(0) /* enables USB3 mode */
-#define DP_MODE					BIT(1) /* enables DP mode */
-
-/* QPHY_PCS_AUTONOMOUS_MODE_CTRL register bits */
-#define ARCVR_DTCT_EN				BIT(0)
-#define ALFPS_DTCT_EN				BIT(1)
-#define ARCVR_DTCT_EVENT_SEL			BIT(4)
-
-/* QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR register bits */
-#define IRQ_CLEAR				BIT(0)
-
-/* QPHY_V3_PCS_MISC_CLAMP_ENABLE register bits */
-#define CLAMP_EN				BIT(0) /* enables i/o clamp_n */
-
 #define PHY_INIT_COMPLETE_TIMEOUT		10000
 
-struct qmp_phy_init_tbl {
-	unsigned int offset;
-	unsigned int val;
-	/*
-	 * mask of lanes for which this register is written
-	 * for cases when second lane needs different values
-	 */
-	u8 lane_mask;
-};
-
-#define QMP_PHY_INIT_CFG(o, v)		\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = 0xff,	\
-	}
-
-#define QMP_PHY_INIT_CFG_LANE(o, v, l)	\
-	{				\
-		.offset = o,		\
-		.val = v,		\
-		.lane_mask = l,		\
-	}
-
 /* set of registers with offsets different per-PHY */
 enum qphy_reg_layout {
 	/* PCS registers */
@@ -121,15 +64,6 @@
 	[QPHY_PCS_MISC_CLAMP_ENABLE]	= QPHY_V3_PCS_MISC_CLAMP_ENABLE,
 };
 
-static const unsigned int qmp_v3_usb3phy_regs_layout_qcm2290[QPHY_LAYOUT_SIZE] = {
-	[QPHY_SW_RESET]			= QPHY_V3_PCS_SW_RESET,
-	[QPHY_START_CTRL]		= QPHY_V3_PCS_START_CONTROL,
-	[QPHY_PCS_STATUS]		= QPHY_V3_PCS_PCS_STATUS,
-	[QPHY_PCS_AUTONOMOUS_MODE_CTRL]	= QPHY_V3_PCS_AUTONOMOUS_MODE_CTRL,
-	[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = QPHY_V3_PCS_LFPS_RXTERM_IRQ_CLEAR,
-	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V3_PCS_POWER_DOWN_CONTROL,
-};
-
 static const unsigned int qmp_v4_usb3phy_regs_layout[QPHY_LAYOUT_SIZE] = {
 	[QPHY_SW_RESET]			= QPHY_V4_PCS_SW_RESET,
 	[QPHY_START_CTRL]		= QPHY_V4_PCS_START_CONTROL,
@@ -514,115 +448,6 @@
 	QMP_PHY_INIT_CFG(QPHY_V3_PCS_REFGEN_REQ_CONFIG2, 0x60),
 };
 
-static const struct qmp_phy_init_tbl msm8998_usb3_serdes_tbl[] = {
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CLK_SELECT, 0x30),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_BIAS_EN_CLKBUFLR_EN, 0x04),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SYSCLK_EN_SEL, 0x14),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SYS_CLK_CTRL, 0x06),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_RESETSM_CNTRL2, 0x08),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CMN_CONFIG, 0x06),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SVS_MODE_CLK_SEL, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_HSCLK_SEL, 0x80),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DEC_START_MODE0, 0x82),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START1_MODE0, 0xab),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START2_MODE0, 0xea),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START3_MODE0, 0x02),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CP_CTRL_MODE0, 0x06),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_RCTRL_MODE0, 0x16),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_CCTRL_MODE0, 0x36),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_GAIN1_MODE0, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_GAIN0_MODE0, 0x3f),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE2_MODE0, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE1_MODE0, 0xc9),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CORECLK_DIV_MODE0, 0x0a),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP3_MODE0, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP2_MODE0, 0x34),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP1_MODE0, 0x15),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP_EN, 0x04),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CORE_CLK_EN, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP_CFG, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE_MAP, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_BG_TIMER, 0x0a),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_IVCO, 0x07),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_INITVAL, 0x80),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CMN_MODE, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_EN_CENTER, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_PER1, 0x31),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_PER2, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_ADJ_PER1, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_ADJ_PER2, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_STEP_SIZE1, 0x85),
-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_STEP_SIZE2, 0x07),
-};
-
-static const struct qmp_phy_init_tbl msm8998_usb3_tx_tbl[] = {
-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_HIGHZ_DRVR_EN, 0x10),
-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RCV_DETECT_LVL_2, 0x12),
-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_LANE_MODE_1, 0x16),
-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_TX, 0x00),
-};
-
-static const struct qmp_phy_init_tbl msm8998_usb3_rx_tbl[] = {
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_FO_GAIN, 0x0b),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL2, 0x0f),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL3, 0x4e),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL4, 0x18),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x07),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_OFFSET_ADAPTOR_CNTRL2, 0x80),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_CNTRL, 0x43),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_DEGLITCH_CNTRL, 0x1c),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x75),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_LOW, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_PI_CONTROLS, 0x80),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FO_GAIN, 0x0a),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_GAIN, 0x06),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_ENABLES, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_VGA_CAL_CNTRL2, 0x03),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_MODE_00, 0x05),
-};
-
-static const struct qmp_phy_init_tbl msm8998_usb3_pcs_tbl[] = {
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL2, 0x83),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_L, 0x09),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_H_TOL, 0xa2),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_MAN_CODE, 0x40),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL1, 0x02),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG1, 0xd1),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG2, 0x1f),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG3, 0x47),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_POWER_STATE_CONFIG2, 0x1b),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V0, 0x9f),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V1, 0x9f),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V2, 0xb7),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V3, 0x4e),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V4, 0x65),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_LS, 0x6b),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V0, 0x15),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V0, 0x0d),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V1, 0x15),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V1, 0x0d),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V2, 0x15),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V2, 0x0d),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V3, 0x15),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V3, 0x0d),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V4, 0x15),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V4, 0x0d),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_LS, 0x15),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_LS, 0x0d),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RATE_SLEW_CNTRL, 0x02),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_PWRUP_RESET_DLY_TIME_AUXCLK, 0x04),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TSYNC_RSYNC_TIME, 0x44),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_L, 0x40),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_H, 0x00),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RX_SIGDET_LVL, 0x8a),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_WAIT_TIME, 0x75),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LFPS_TX_ECSTART_EQTLOCK, 0x86),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_RUN_TIME, 0x13),
-};
-
 static const struct qmp_phy_init_tbl sm8150_usb3_uniphy_serdes_tbl[] = {
 	QMP_PHY_INIT_CFG(QSERDES_V4_COM_SYSCLK_EN_SEL, 0x1a),
 	QMP_PHY_INIT_CFG(QSERDES_V4_COM_BIN_VCOCAL_HSCLK_SEL, 0x11),
@@ -1089,99 +914,6 @@
 	QMP_PHY_INIT_CFG(QPHY_V5_PCS_USB3_LFPS_DET_HIGH_COUNT_VAL, 0xf8),
 };
 
-static const struct qmp_phy_init_tbl qcm2290_usb3_serdes_tbl[] = {
-	QMP_PHY_INIT_CFG(QSERDES_COM_SYSCLK_EN_SEL, 0x14),
-	QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CLKBUFLR_EN, 0x08),
-	QMP_PHY_INIT_CFG(QSERDES_COM_CLK_SELECT, 0x30),
-	QMP_PHY_INIT_CFG(QSERDES_COM_SYS_CLK_CTRL, 0x06),
-	QMP_PHY_INIT_CFG(QSERDES_COM_RESETSM_CNTRL, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_RESETSM_CNTRL2, 0x08),
-	QMP_PHY_INIT_CFG(QSERDES_COM_BG_TRIM, 0x0f),
-	QMP_PHY_INIT_CFG(QSERDES_COM_SVS_MODE_CLK_SEL, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_COM_HSCLK_SEL, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_DEC_START_MODE0, 0x82),
-	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START1_MODE0, 0x55),
-	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START2_MODE0, 0x55),
-	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START3_MODE0, 0x03),
-	QMP_PHY_INIT_CFG(QSERDES_COM_CP_CTRL_MODE0, 0x0b),
-	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_RCTRL_MODE0, 0x16),
-	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_CCTRL_MODE0, 0x28),
-	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN0_MODE0, 0x80),
-	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN1_MODE0, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_CORECLK_DIV, 0x0a),
-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP1_MODE0, 0x15),
-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP2_MODE0, 0x34),
-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP3_MODE0, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_EN, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_CORE_CLK_EN, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_CFG, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_MAP, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_BG_TIMER, 0x0a),
-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_EN_CENTER, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER1, 0x31),
-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER2, 0x01),
-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_ADJ_PER1, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_ADJ_PER2, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE1, 0xde),
-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE2, 0x07),
-	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_IVCO, 0x0f),
-	QMP_PHY_INIT_CFG(QSERDES_COM_CMN_CONFIG, 0x06),
-	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_INITVAL, 0x80),
-	QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CTRL_BY_PSM, 0x01),
-};
-
-static const struct qmp_phy_init_tbl qcm2290_usb3_tx_tbl[] = {
-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_HIGHZ_DRVR_EN, 0x10),
-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RCV_DETECT_LVL_2, 0x12),
-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_LANE_MODE_1, 0xc6),
-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_TX, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_RX, 0x00),
-};
-
-static const struct qmp_phy_init_tbl qcm2290_usb3_rx_tbl[] = {
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_FO_GAIN, 0x0b),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_PI_CONTROLS, 0x80),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_LOW, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FO_GAIN, 0x0a),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_GAIN, 0x06),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x75),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL2, 0x02),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL3, 0x4e),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL4, 0x18),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x77),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_OFFSET_ADAPTOR_CNTRL2, 0x80),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_VGA_CAL_CNTRL2, 0x0a),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_CNTRL, 0x03),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_DEGLITCH_CNTRL, 0x16),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_ENABLES, 0x00),
-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_MODE_00, 0x00),
-};
-
-static const struct qmp_phy_init_tbl qcm2290_usb3_pcs_tbl[] = {
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V0, 0x9f),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V0, 0x17),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V0, 0x0f),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL2, 0x83),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL1, 0x02),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_L, 0x09),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_H_TOL, 0xa2),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_MAN_CODE, 0x85),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG1, 0xd1),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG2, 0x1f),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG3, 0x47),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_WAIT_TIME, 0x75),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_RUN_TIME, 0x13),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LFPS_TX_ECSTART_EQTLOCK, 0x86),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_PWRUP_RESET_DLY_TIME_AUXCLK, 0x04),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TSYNC_RSYNC_TIME, 0x44),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_L, 0x40),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_H, 0x00),
-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RX_SIGDET_LVL, 0x88),
-};
-
 static const struct qmp_phy_init_tbl sc8280xp_usb3_uniphy_serdes_tbl[] = {
 	QMP_PHY_INIT_CFG(QSERDES_V5_COM_SYSCLK_EN_SEL, 0x1a),
 	QMP_PHY_INIT_CFG(QSERDES_V5_COM_BIN_VCOCAL_HSCLK_SEL, 0x11),
@@ -1253,7 +985,7 @@
 	QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FASTLOCK_FO_GAIN, 0x2f),
 	QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FASTLOCK_COUNT_LOW, 0xff),
 	QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x0f),
-	QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_SO_GAIN, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FO_GAIN, 0x0a),
 	QMP_PHY_INIT_CFG(QSERDES_V5_RX_VGA_CAL_CNTRL1, 0x54),
 	QMP_PHY_INIT_CFG(QSERDES_V5_RX_VGA_CAL_CNTRL2, 0x0f),
 	QMP_PHY_INIT_CFG(QSERDES_V5_RX_RX_EQU_ADAPTOR_CNTRL2, 0x0f),
@@ -1448,15 +1180,10 @@
 	u16 pcs_usb;
 	u16 tx;
 	u16 rx;
-	/* for PHYs with >= 2 lanes */
-	u16 tx2;
-	u16 rx2;
 };
 
 /* struct qmp_phy_cfg - per-PHY initialization config */
 struct qmp_phy_cfg {
-	int lanes;
-
 	const struct qmp_usb_offsets *offsets;
 
 	/* Init sequence for PHY blocks - serdes, tx, rx, pcs */
@@ -1496,8 +1223,6 @@
 	void __iomem *pcs_usb;
 	void __iomem *tx;
 	void __iomem *rx;
-	void __iomem *tx2;
-	void __iomem *rx2;
 
 	struct clk *pipe_clk;
 	struct clk_bulk_data *clks;
@@ -1579,16 +1304,6 @@
 	.rx		= 0x400,
 };
 
-static const struct qmp_usb_offsets qmp_usb_offsets_v3_qcm2290 = {
-	.serdes		= 0x0,
-	.pcs		= 0xc00,
-	.pcs_misc	= 0xa00,
-	.tx		= 0x200,
-	.rx		= 0x400,
-	.tx2		= 0x600,
-	.rx2		= 0x800,
-};
-
 static const struct qmp_usb_offsets qmp_usb_offsets_v4 = {
 	.serdes		= 0,
 	.pcs		= 0x0800,
@@ -1622,8 +1337,6 @@
 };
 
 static const struct qmp_phy_cfg ipq6018_usb3phy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v3,
 
 	.serdes_tbl		= ipq9574_usb3_serdes_tbl,
@@ -1640,8 +1353,6 @@
 };
 
 static const struct qmp_phy_cfg ipq8074_usb3phy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v3,
 
 	.serdes_tbl		= ipq8074_usb3_serdes_tbl,
@@ -1658,8 +1369,6 @@
 };
 
 static const struct qmp_phy_cfg ipq9574_usb3phy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_ipq9574,
 
 	.serdes_tbl		= ipq9574_usb3_serdes_tbl,
@@ -1676,8 +1385,6 @@
 };
 
 static const struct qmp_phy_cfg msm8996_usb3phy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v3_msm8996,
 
 	.serdes_tbl		= msm8996_usb3_serdes_tbl,
@@ -1694,8 +1401,6 @@
 };
 
 static const struct qmp_phy_cfg sa8775p_usb3_uniphy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v5,
 
 	.serdes_tbl		= sc8280xp_usb3_uniphy_serdes_tbl,
@@ -1714,8 +1419,6 @@
 };
 
 static const struct qmp_phy_cfg sc8280xp_usb3_uniphy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v5,
 
 	.serdes_tbl		= sc8280xp_usb3_uniphy_serdes_tbl,
@@ -1734,8 +1437,6 @@
 };
 
 static const struct qmp_phy_cfg qmp_v3_usb3_uniphy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v3,
 
 	.serdes_tbl		= qmp_v3_usb3_uniphy_serdes_tbl,
@@ -1753,27 +1454,7 @@
 	.has_pwrdn_delay	= true,
 };
 
-static const struct qmp_phy_cfg msm8998_usb3phy_cfg = {
-	.lanes			= 2,
-
-	.offsets		= &qmp_usb_offsets_v3_qcm2290,
-
-	.serdes_tbl             = msm8998_usb3_serdes_tbl,
-	.serdes_tbl_num         = ARRAY_SIZE(msm8998_usb3_serdes_tbl),
-	.tx_tbl                 = msm8998_usb3_tx_tbl,
-	.tx_tbl_num             = ARRAY_SIZE(msm8998_usb3_tx_tbl),
-	.rx_tbl                 = msm8998_usb3_rx_tbl,
-	.rx_tbl_num             = ARRAY_SIZE(msm8998_usb3_rx_tbl),
-	.pcs_tbl                = msm8998_usb3_pcs_tbl,
-	.pcs_tbl_num            = ARRAY_SIZE(msm8998_usb3_pcs_tbl),
-	.vreg_list              = qmp_phy_vreg_l,
-	.num_vregs              = ARRAY_SIZE(qmp_phy_vreg_l),
-	.regs                   = qmp_v3_usb3phy_regs_layout,
-};
-
 static const struct qmp_phy_cfg sm8150_usb3_uniphy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v4,
 
 	.serdes_tbl		= sm8150_usb3_uniphy_serdes_tbl,
@@ -1795,8 +1476,6 @@
 };
 
 static const struct qmp_phy_cfg sm8250_usb3_uniphy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v4,
 
 	.serdes_tbl		= sm8150_usb3_uniphy_serdes_tbl,
@@ -1818,8 +1497,6 @@
 };
 
 static const struct qmp_phy_cfg sdx55_usb3_uniphy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v4,
 
 	.serdes_tbl		= sm8150_usb3_uniphy_serdes_tbl,
@@ -1841,8 +1518,6 @@
 };
 
 static const struct qmp_phy_cfg sdx65_usb3_uniphy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v5,
 
 	.serdes_tbl		= sm8150_usb3_uniphy_serdes_tbl,
@@ -1864,7 +1539,6 @@
 };
 
 static const struct qmp_phy_cfg sdx75_usb3_uniphy_cfg = {
-	.lanes			= 1,
 	.offsets		= &qmp_usb_offsets_v6,
 
 	.serdes_tbl		= sdx75_usb3_uniphy_serdes_tbl,
@@ -1886,8 +1560,6 @@
 };
 
 static const struct qmp_phy_cfg sm8350_usb3_uniphy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v5,
 
 	.serdes_tbl		= sm8150_usb3_uniphy_serdes_tbl,
@@ -1908,27 +1580,7 @@
 	.has_pwrdn_delay	= true,
 };
 
-static const struct qmp_phy_cfg qcm2290_usb3phy_cfg = {
-	.lanes			= 2,
-
-	.offsets		= &qmp_usb_offsets_v3_qcm2290,
-
-	.serdes_tbl		= qcm2290_usb3_serdes_tbl,
-	.serdes_tbl_num		= ARRAY_SIZE(qcm2290_usb3_serdes_tbl),
-	.tx_tbl			= qcm2290_usb3_tx_tbl,
-	.tx_tbl_num		= ARRAY_SIZE(qcm2290_usb3_tx_tbl),
-	.rx_tbl			= qcm2290_usb3_rx_tbl,
-	.rx_tbl_num		= ARRAY_SIZE(qcm2290_usb3_rx_tbl),
-	.pcs_tbl		= qcm2290_usb3_pcs_tbl,
-	.pcs_tbl_num		= ARRAY_SIZE(qcm2290_usb3_pcs_tbl),
-	.vreg_list		= qmp_phy_vreg_l,
-	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
-	.regs			= qmp_v3_usb3phy_regs_layout_qcm2290,
-};
-
 static const struct qmp_phy_cfg x1e80100_usb3_uniphy_cfg = {
-	.lanes			= 1,
-
 	.offsets		= &qmp_usb_offsets_v7,
 
 	.serdes_tbl		= x1e80100_usb3_uniphy_serdes_tbl,
@@ -1946,32 +1598,6 @@
 	.regs			= qmp_v7_usb3phy_regs_layout,
 };
 
-static void qmp_usb_configure_lane(void __iomem *base,
-					const struct qmp_phy_init_tbl tbl[],
-					int num,
-					u8 lane_mask)
-{
-	int i;
-	const struct qmp_phy_init_tbl *t = tbl;
-
-	if (!t)
-		return;
-
-	for (i = 0; i < num; i++, t++) {
-		if (!(t->lane_mask & lane_mask))
-			continue;
-
-		writel(t->val, base + t->offset);
-	}
-}
-
-static void qmp_usb_configure(void __iomem *base,
-				   const struct qmp_phy_init_tbl tbl[],
-				   int num)
-{
-	qmp_usb_configure_lane(base, tbl, num, 0xff);
-}
-
 static int qmp_usb_serdes_init(struct qmp_usb *qmp)
 {
 	const struct qmp_phy_cfg *cfg = qmp->cfg;
@@ -1979,7 +1605,7 @@
 	const struct qmp_phy_init_tbl *serdes_tbl = cfg->serdes_tbl;
 	int serdes_tbl_num = cfg->serdes_tbl_num;
 
-	qmp_usb_configure(serdes, serdes_tbl, serdes_tbl_num);
+	qmp_configure(qmp->dev, serdes, serdes_tbl, serdes_tbl_num);
 
 	return 0;
 }
@@ -2060,18 +1686,13 @@
 	}
 
 	/* Tx, Rx, and PCS configurations */
-	qmp_usb_configure_lane(tx, cfg->tx_tbl, cfg->tx_tbl_num, 1);
-	qmp_usb_configure_lane(rx, cfg->rx_tbl, cfg->rx_tbl_num, 1);
+	qmp_configure_lane(qmp->dev, tx, cfg->tx_tbl, cfg->tx_tbl_num, 1);
+	qmp_configure_lane(qmp->dev, rx, cfg->rx_tbl, cfg->rx_tbl_num, 1);
 
-	if (cfg->lanes >= 2) {
-		qmp_usb_configure_lane(qmp->tx2, cfg->tx_tbl, cfg->tx_tbl_num, 2);
-		qmp_usb_configure_lane(qmp->rx2, cfg->rx_tbl, cfg->rx_tbl_num, 2);
-	}
-
-	qmp_usb_configure(pcs, cfg->pcs_tbl, cfg->pcs_tbl_num);
+	qmp_configure(qmp->dev, pcs, cfg->pcs_tbl, cfg->pcs_tbl_num);
 
 	if (pcs_usb)
-		qmp_usb_configure(pcs_usb, cfg->pcs_usb_tbl, cfg->pcs_usb_tbl_num);
+		qmp_configure(qmp->dev, pcs_usb, cfg->pcs_usb_tbl, cfg->pcs_usb_tbl_num);
 
 	if (cfg->has_pwrdn_delay)
 		usleep_range(10, 20);
@@ -2414,7 +2035,6 @@
 	/*
 	 * Get memory resources for the PHY:
 	 * Resources are indexed as: tx -> 0; rx -> 1; pcs -> 2.
-	 * For dual lane PHYs: tx2 -> 3, rx2 -> 4, pcs_misc (optional) -> 5
 	 * For single lane PHYs: pcs_misc (optional) -> 3.
 	 */
 	qmp->tx = devm_of_iomap(dev, np, 0, NULL);
@@ -2432,19 +2052,7 @@
 	if (cfg->pcs_usb_offset)
 		qmp->pcs_usb = qmp->pcs + cfg->pcs_usb_offset;
 
-	if (cfg->lanes >= 2) {
-		qmp->tx2 = devm_of_iomap(dev, np, 3, NULL);
-		if (IS_ERR(qmp->tx2))
-			return PTR_ERR(qmp->tx2);
-
-		qmp->rx2 = devm_of_iomap(dev, np, 4, NULL);
-		if (IS_ERR(qmp->rx2))
-			return PTR_ERR(qmp->rx2);
-
-		qmp->pcs_misc = devm_of_iomap(dev, np, 5, NULL);
-	} else {
-		qmp->pcs_misc = devm_of_iomap(dev, np, 3, NULL);
-	}
+	qmp->pcs_misc = devm_of_iomap(dev, np, 3, NULL);
 
 	if (IS_ERR(qmp->pcs_misc)) {
 		dev_vdbg(dev, "PHY pcs_misc-reg not used\n");
@@ -2496,11 +2104,6 @@
 	qmp->tx = base + offs->tx;
 	qmp->rx = base + offs->rx;
 
-	if (cfg->lanes >= 2) {
-		qmp->tx2 = base + offs->tx2;
-		qmp->rx2 = base + offs->rx2;
-	}
-
 	ret = qmp_usb_clk_init(qmp);
 	if (ret)
 		return ret;
@@ -2532,6 +2135,7 @@
 		return -ENOMEM;
 
 	qmp->dev = dev;
+	dev_set_drvdata(dev, qmp);
 
 	qmp->cfg = of_device_get_match_data(dev);
 	if (!qmp->cfg)
@@ -2600,11 +2204,8 @@
 		.compatible = "qcom,msm8996-qmp-usb3-phy",
 		.data = &msm8996_usb3phy_cfg,
 	}, {
-		.compatible = "qcom,msm8998-qmp-usb3-phy",
-		.data = &msm8998_usb3phy_cfg,
-	}, {
-		.compatible = "qcom,qcm2290-qmp-usb3-phy",
-		.data = &qcm2290_usb3phy_cfg,
+		.compatible = "qcom,qcs8300-qmp-usb3-uni-phy",
+		.data = &sa8775p_usb3_uniphy_cfg,
 	}, {
 		.compatible = "qcom,sa8775p-qmp-usb3-uni-phy",
 		.data = &sa8775p_usb3_uniphy_cfg,
@@ -2624,9 +2225,6 @@
 		.compatible = "qcom,sdx75-qmp-usb3-uni-phy",
 		.data = &sdx75_usb3_uniphy_cfg,
 	}, {
-		.compatible = "qcom,sm6115-qmp-usb3-phy",
-		.data = &qcm2290_usb3phy_cfg,
-	}, {
 		.compatible = "qcom,sm8150-qmp-usb3-uni-phy",
 		.data = &sm8150_usb3_uniphy_cfg,
 	}, {
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
@@ -0,0 +1,1154 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/iopoll.h>
+#include <linux/kernel.h>
+#include <linux/mfd/syscon.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/phy/phy.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+#include <linux/reset.h>
+#include <linux/slab.h>
+#include <linux/usb/typec.h>
+#include <linux/usb/typec_mux.h>
+
+#include "phy-qcom-qmp-common.h"
+
+#include "phy-qcom-qmp.h"
+#include "phy-qcom-qmp-pcs-misc-v3.h"
+
+#define PHY_INIT_COMPLETE_TIMEOUT		10000
+
+/* set of registers with offsets different per-PHY */
+enum qphy_reg_layout {
+	/* PCS registers */
+	QPHY_SW_RESET,
+	QPHY_START_CTRL,
+	QPHY_PCS_STATUS,
+	QPHY_PCS_AUTONOMOUS_MODE_CTRL,
+	QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR,
+	QPHY_PCS_POWER_DOWN_CONTROL,
+	/* Keep last to ensure regs_layout arrays are properly initialized */
+	QPHY_LAYOUT_SIZE
+};
+
+static const unsigned int qmp_v3_usb3phy_regs_layout[QPHY_LAYOUT_SIZE] = {
+	[QPHY_SW_RESET]			= QPHY_V3_PCS_SW_RESET,
+	[QPHY_START_CTRL]		= QPHY_V3_PCS_START_CONTROL,
+	[QPHY_PCS_STATUS]		= QPHY_V3_PCS_PCS_STATUS,
+	[QPHY_PCS_AUTONOMOUS_MODE_CTRL]	= QPHY_V3_PCS_AUTONOMOUS_MODE_CTRL,
+	[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = QPHY_V3_PCS_LFPS_RXTERM_IRQ_CLEAR,
+	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V3_PCS_POWER_DOWN_CONTROL,
+};
+
+static const unsigned int qmp_v3_usb3phy_regs_layout_qcm2290[QPHY_LAYOUT_SIZE] = {
+	[QPHY_SW_RESET]			= QPHY_V3_PCS_SW_RESET,
+	[QPHY_START_CTRL]		= QPHY_V3_PCS_START_CONTROL,
+	[QPHY_PCS_STATUS]		= QPHY_V3_PCS_PCS_STATUS,
+	[QPHY_PCS_AUTONOMOUS_MODE_CTRL]	= QPHY_V3_PCS_AUTONOMOUS_MODE_CTRL,
+	[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = QPHY_V3_PCS_LFPS_RXTERM_IRQ_CLEAR,
+	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V3_PCS_POWER_DOWN_CONTROL,
+};
+
+static const struct qmp_phy_init_tbl msm8998_usb3_serdes_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CLK_SELECT, 0x30),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_BIAS_EN_CLKBUFLR_EN, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SYSCLK_EN_SEL, 0x14),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SYS_CLK_CTRL, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_RESETSM_CNTRL2, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CMN_CONFIG, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SVS_MODE_CLK_SEL, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_HSCLK_SEL, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DEC_START_MODE0, 0x82),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START1_MODE0, 0xab),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START2_MODE0, 0xea),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START3_MODE0, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CP_CTRL_MODE0, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_RCTRL_MODE0, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_CCTRL_MODE0, 0x36),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_GAIN1_MODE0, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_GAIN0_MODE0, 0x3f),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE2_MODE0, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE1_MODE0, 0xc9),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CORECLK_DIV_MODE0, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP3_MODE0, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP2_MODE0, 0x34),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP1_MODE0, 0x15),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP_EN, 0x04),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CORE_CLK_EN, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP_CFG, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE_MAP, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_BG_TIMER, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_IVCO, 0x07),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_INITVAL, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CMN_MODE, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_EN_CENTER, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_PER1, 0x31),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_PER2, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_ADJ_PER1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_ADJ_PER2, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_STEP_SIZE1, 0x85),
+	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_STEP_SIZE2, 0x07),
+};
+
+static const struct qmp_phy_init_tbl msm8998_usb3_tx_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V3_TX_HIGHZ_DRVR_EN, 0x10),
+	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RCV_DETECT_LVL_2, 0x12),
+	QMP_PHY_INIT_CFG(QSERDES_V3_TX_LANE_MODE_1, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_TX, 0x00),
+};
+
+static const struct qmp_phy_init_tbl msm8998_usb3_rx_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_FO_GAIN, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL2, 0x0f),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL3, 0x4e),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL4, 0x18),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x07),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_OFFSET_ADAPTOR_CNTRL2, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_CNTRL, 0x43),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_DEGLITCH_CNTRL, 0x1c),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x75),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_LOW, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_PI_CONTROLS, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FO_GAIN, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_GAIN, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_ENABLES, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_VGA_CAL_CNTRL2, 0x03),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_MODE_00, 0x05),
+};
+
+static const struct qmp_phy_init_tbl msm8998_usb3_pcs_tbl[] = {
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL2, 0x83),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_L, 0x09),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_H_TOL, 0xa2),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_MAN_CODE, 0x40),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL1, 0x02),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG1, 0xd1),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG2, 0x1f),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG3, 0x47),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_POWER_STATE_CONFIG2, 0x1b),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V0, 0x9f),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V1, 0x9f),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V2, 0xb7),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V3, 0x4e),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V4, 0x65),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_LS, 0x6b),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V0, 0x15),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V0, 0x0d),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V1, 0x15),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V1, 0x0d),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V2, 0x15),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V2, 0x0d),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V3, 0x15),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V3, 0x0d),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V4, 0x15),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V4, 0x0d),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_LS, 0x15),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_LS, 0x0d),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RATE_SLEW_CNTRL, 0x02),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_PWRUP_RESET_DLY_TIME_AUXCLK, 0x04),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TSYNC_RSYNC_TIME, 0x44),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_L, 0x40),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_H, 0x00),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RX_SIGDET_LVL, 0x8a),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_WAIT_TIME, 0x75),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LFPS_TX_ECSTART_EQTLOCK, 0x86),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_RUN_TIME, 0x13),
+};
+
+static const struct qmp_phy_init_tbl qcm2290_usb3_serdes_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_COM_SYSCLK_EN_SEL, 0x14),
+	QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CLKBUFLR_EN, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_COM_CLK_SELECT, 0x30),
+	QMP_PHY_INIT_CFG(QSERDES_COM_SYS_CLK_CTRL, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_COM_RESETSM_CNTRL, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_RESETSM_CNTRL2, 0x08),
+	QMP_PHY_INIT_CFG(QSERDES_COM_BG_TRIM, 0x0f),
+	QMP_PHY_INIT_CFG(QSERDES_COM_SVS_MODE_CLK_SEL, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_COM_HSCLK_SEL, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_DEC_START_MODE0, 0x82),
+	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START1_MODE0, 0x55),
+	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START2_MODE0, 0x55),
+	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START3_MODE0, 0x03),
+	QMP_PHY_INIT_CFG(QSERDES_COM_CP_CTRL_MODE0, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_RCTRL_MODE0, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_CCTRL_MODE0, 0x28),
+	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN0_MODE0, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN1_MODE0, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_CORECLK_DIV, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP1_MODE0, 0x15),
+	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP2_MODE0, 0x34),
+	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP3_MODE0, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_EN, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_CORE_CLK_EN, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_CFG, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_MAP, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_BG_TIMER, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_EN_CENTER, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER1, 0x31),
+	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER2, 0x01),
+	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_ADJ_PER1, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_ADJ_PER2, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE1, 0xde),
+	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE2, 0x07),
+	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_IVCO, 0x0f),
+	QMP_PHY_INIT_CFG(QSERDES_COM_CMN_CONFIG, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_INITVAL, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CTRL_BY_PSM, 0x01),
+};
+
+static const struct qmp_phy_init_tbl qcm2290_usb3_tx_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V3_TX_HIGHZ_DRVR_EN, 0x10),
+	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RCV_DETECT_LVL_2, 0x12),
+	QMP_PHY_INIT_CFG(QSERDES_V3_TX_LANE_MODE_1, 0xc6),
+	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_TX, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_RX, 0x00),
+};
+
+static const struct qmp_phy_init_tbl qcm2290_usb3_rx_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_FO_GAIN, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_PI_CONTROLS, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_LOW, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FO_GAIN, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_GAIN, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x75),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL2, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL3, 0x4e),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL4, 0x18),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x77),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_OFFSET_ADAPTOR_CNTRL2, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_VGA_CAL_CNTRL2, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_CNTRL, 0x03),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_DEGLITCH_CNTRL, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_ENABLES, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_MODE_00, 0x00),
+};
+
+/* the only difference is QSERDES_V3_RX_UCDR_PI_CONTROLS */
+static const struct qmp_phy_init_tbl sdm660_usb3_rx_tbl[] = {
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_FO_GAIN, 0x0b),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_PI_CONTROLS, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_LOW, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FO_GAIN, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_GAIN, 0x06),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x75),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL2, 0x02),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL3, 0x4e),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL4, 0x18),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x77),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_OFFSET_ADAPTOR_CNTRL2, 0x80),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_VGA_CAL_CNTRL2, 0x0a),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_CNTRL, 0x03),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_DEGLITCH_CNTRL, 0x16),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_ENABLES, 0x00),
+	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_MODE_00, 0x00),
+};
+
+static const struct qmp_phy_init_tbl qcm2290_usb3_pcs_tbl[] = {
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V0, 0x9f),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V0, 0x17),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V0, 0x0f),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL2, 0x83),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL1, 0x02),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_L, 0x09),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_H_TOL, 0xa2),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_MAN_CODE, 0x85),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG1, 0xd1),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG2, 0x1f),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG3, 0x47),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_WAIT_TIME, 0x75),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_RUN_TIME, 0x13),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LFPS_TX_ECSTART_EQTLOCK, 0x86),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_PWRUP_RESET_DLY_TIME_AUXCLK, 0x04),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TSYNC_RSYNC_TIME, 0x44),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_L, 0x40),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_H, 0x00),
+	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RX_SIGDET_LVL, 0x88),
+};
+
+struct qmp_usbc_offsets {
+	u16 serdes;
+	u16 pcs;
+	u16 pcs_misc;
+	u16 tx;
+	u16 rx;
+	/* for PHYs with >= 2 lanes */
+	u16 tx2;
+	u16 rx2;
+};
+
+/* struct qmp_phy_cfg - per-PHY initialization config */
+struct qmp_phy_cfg {
+	const struct qmp_usbc_offsets *offsets;
+
+	/* Init sequence for PHY blocks - serdes, tx, rx, pcs */
+	const struct qmp_phy_init_tbl *serdes_tbl;
+	int serdes_tbl_num;
+	const struct qmp_phy_init_tbl *tx_tbl;
+	int tx_tbl_num;
+	const struct qmp_phy_init_tbl *rx_tbl;
+	int rx_tbl_num;
+	const struct qmp_phy_init_tbl *pcs_tbl;
+	int pcs_tbl_num;
+
+	/* regulators to be requested */
+	const char * const *vreg_list;
+	int num_vregs;
+
+	/* array of registers with different offsets */
+	const unsigned int *regs;
+};
+
+struct qmp_usbc {
+	struct device *dev;
+
+	const struct qmp_phy_cfg *cfg;
+
+	void __iomem *serdes;
+	void __iomem *pcs;
+	void __iomem *pcs_misc;
+	void __iomem *tx;
+	void __iomem *rx;
+	void __iomem *tx2;
+	void __iomem *rx2;
+
+	struct regmap *tcsr_map;
+	u32 vls_clamp_reg;
+
+	struct clk *pipe_clk;
+	struct clk_bulk_data *clks;
+	int num_clks;
+	int num_resets;
+	struct reset_control_bulk_data *resets;
+	struct regulator_bulk_data *vregs;
+
+	struct mutex phy_mutex;
+
+	enum phy_mode mode;
+	unsigned int usb_init_count;
+
+	struct phy *phy;
+
+	struct clk_fixed_rate pipe_clk_fixed;
+
+	struct typec_switch_dev *sw;
+	enum typec_orientation orientation;
+};
+
+static inline void qphy_setbits(void __iomem *base, u32 offset, u32 val)
+{
+	u32 reg;
+
+	reg = readl(base + offset);
+	reg |= val;
+	writel(reg, base + offset);
+
+	/* ensure that above write is through */
+	readl(base + offset);
+}
+
+static inline void qphy_clrbits(void __iomem *base, u32 offset, u32 val)
+{
+	u32 reg;
+
+	reg = readl(base + offset);
+	reg &= ~val;
+	writel(reg, base + offset);
+
+	/* ensure that above write is through */
+	readl(base + offset);
+}
+
+/* list of clocks required by phy */
+static const char * const qmp_usbc_phy_clk_l[] = {
+	"aux", "cfg_ahb", "ref", "com_aux",
+};
+
+/* list of resets */
+static const char * const usb3phy_legacy_reset_l[] = {
+	"phy", "common",
+};
+
+static const char * const usb3phy_reset_l[] = {
+	"phy_phy", "phy",
+};
+
+/* list of regulators */
+static const char * const qmp_phy_vreg_l[] = {
+	"vdda-phy", "vdda-pll",
+};
+
+static const struct qmp_usbc_offsets qmp_usbc_offsets_v3_qcm2290 = {
+	.serdes		= 0x0,
+	.pcs		= 0xc00,
+	.pcs_misc	= 0xa00,
+	.tx		= 0x200,
+	.rx		= 0x400,
+	.tx2		= 0x600,
+	.rx2		= 0x800,
+};
+
+static const struct qmp_phy_cfg msm8998_usb3phy_cfg = {
+	.offsets		= &qmp_usbc_offsets_v3_qcm2290,
+
+	.serdes_tbl             = msm8998_usb3_serdes_tbl,
+	.serdes_tbl_num         = ARRAY_SIZE(msm8998_usb3_serdes_tbl),
+	.tx_tbl                 = msm8998_usb3_tx_tbl,
+	.tx_tbl_num             = ARRAY_SIZE(msm8998_usb3_tx_tbl),
+	.rx_tbl                 = msm8998_usb3_rx_tbl,
+	.rx_tbl_num             = ARRAY_SIZE(msm8998_usb3_rx_tbl),
+	.pcs_tbl                = msm8998_usb3_pcs_tbl,
+	.pcs_tbl_num            = ARRAY_SIZE(msm8998_usb3_pcs_tbl),
+	.vreg_list              = qmp_phy_vreg_l,
+	.num_vregs              = ARRAY_SIZE(qmp_phy_vreg_l),
+	.regs                   = qmp_v3_usb3phy_regs_layout,
+};
+
+static const struct qmp_phy_cfg qcm2290_usb3phy_cfg = {
+	.offsets		= &qmp_usbc_offsets_v3_qcm2290,
+
+	.serdes_tbl		= qcm2290_usb3_serdes_tbl,
+	.serdes_tbl_num		= ARRAY_SIZE(qcm2290_usb3_serdes_tbl),
+	.tx_tbl			= qcm2290_usb3_tx_tbl,
+	.tx_tbl_num		= ARRAY_SIZE(qcm2290_usb3_tx_tbl),
+	.rx_tbl			= qcm2290_usb3_rx_tbl,
+	.rx_tbl_num		= ARRAY_SIZE(qcm2290_usb3_rx_tbl),
+	.pcs_tbl		= qcm2290_usb3_pcs_tbl,
+	.pcs_tbl_num		= ARRAY_SIZE(qcm2290_usb3_pcs_tbl),
+	.vreg_list		= qmp_phy_vreg_l,
+	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
+	.regs			= qmp_v3_usb3phy_regs_layout_qcm2290,
+};
+
+static const struct qmp_phy_cfg sdm660_usb3phy_cfg = {
+	.offsets		= &qmp_usbc_offsets_v3_qcm2290,
+
+	.serdes_tbl		= qcm2290_usb3_serdes_tbl,
+	.serdes_tbl_num		= ARRAY_SIZE(qcm2290_usb3_serdes_tbl),
+	.tx_tbl			= qcm2290_usb3_tx_tbl,
+	.tx_tbl_num		= ARRAY_SIZE(qcm2290_usb3_tx_tbl),
+	.rx_tbl			= sdm660_usb3_rx_tbl,
+	.rx_tbl_num		= ARRAY_SIZE(sdm660_usb3_rx_tbl),
+	.pcs_tbl		= qcm2290_usb3_pcs_tbl,
+	.pcs_tbl_num		= ARRAY_SIZE(qcm2290_usb3_pcs_tbl),
+	.vreg_list		= qmp_phy_vreg_l,
+	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
+	.regs			= qmp_v3_usb3phy_regs_layout_qcm2290,
+};
+
+static int qmp_usbc_init(struct phy *phy)
+{
+	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
+	void __iomem *pcs = qmp->pcs;
+	u32 val = 0;
+	int ret;
+
+	ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
+	if (ret) {
+		dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
+		return ret;
+	}
+
+	ret = reset_control_bulk_assert(qmp->num_resets, qmp->resets);
+	if (ret) {
+		dev_err(qmp->dev, "reset assert failed\n");
+		goto err_disable_regulators;
+	}
+
+	ret = reset_control_bulk_deassert(qmp->num_resets, qmp->resets);
+	if (ret) {
+		dev_err(qmp->dev, "reset deassert failed\n");
+		goto err_disable_regulators;
+	}
+
+	ret = clk_bulk_prepare_enable(qmp->num_clks, qmp->clks);
+	if (ret)
+		goto err_assert_reset;
+
+	qphy_setbits(pcs, cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL], SW_PWRDN);
+
+#define SW_PORTSELECT_VAL			BIT(0)
+#define SW_PORTSELECT_MUX			BIT(1)
+	/* Use software based port select and switch on typec orientation */
+	val = SW_PORTSELECT_MUX;
+	if (qmp->orientation == TYPEC_ORIENTATION_REVERSE)
+		val |= SW_PORTSELECT_VAL;
+	writel(val, qmp->pcs_misc);
+
+	return 0;
+
+err_assert_reset:
+	reset_control_bulk_assert(qmp->num_resets, qmp->resets);
+err_disable_regulators:
+	regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
+
+	return ret;
+}
+
+static int qmp_usbc_exit(struct phy *phy)
+{
+	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
+
+	reset_control_bulk_assert(qmp->num_resets, qmp->resets);
+
+	clk_bulk_disable_unprepare(qmp->num_clks, qmp->clks);
+
+	regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
+
+	return 0;
+}
+
+static int qmp_usbc_power_on(struct phy *phy)
+{
+	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
+	void __iomem *status;
+	unsigned int val;
+	int ret;
+
+	qmp_configure(qmp->dev, qmp->serdes, cfg->serdes_tbl,
+		      cfg->serdes_tbl_num);
+
+	ret = clk_prepare_enable(qmp->pipe_clk);
+	if (ret) {
+		dev_err(qmp->dev, "pipe_clk enable failed err=%d\n", ret);
+		return ret;
+	}
+
+	/* Tx, Rx, and PCS configurations */
+	qmp_configure_lane(qmp->dev, qmp->tx, cfg->tx_tbl, cfg->tx_tbl_num, 1);
+	qmp_configure_lane(qmp->dev, qmp->rx, cfg->rx_tbl, cfg->rx_tbl_num, 1);
+
+	qmp_configure_lane(qmp->dev, qmp->tx2, cfg->tx_tbl, cfg->tx_tbl_num, 2);
+	qmp_configure_lane(qmp->dev, qmp->rx2, cfg->rx_tbl, cfg->rx_tbl_num, 2);
+
+	qmp_configure(qmp->dev, qmp->pcs, cfg->pcs_tbl, cfg->pcs_tbl_num);
+
+	/* Pull PHY out of reset state */
+	qphy_clrbits(qmp->pcs, cfg->regs[QPHY_SW_RESET], SW_RESET);
+
+	/* start SerDes and Phy-Coding-Sublayer */
+	qphy_setbits(qmp->pcs, cfg->regs[QPHY_START_CTRL], SERDES_START | PCS_START);
+
+	status = qmp->pcs + cfg->regs[QPHY_PCS_STATUS];
+	ret = readl_poll_timeout(status, val, !(val & PHYSTATUS), 200,
+				 PHY_INIT_COMPLETE_TIMEOUT);
+	if (ret) {
+		dev_err(qmp->dev, "phy initialization timed-out\n");
+		goto err_disable_pipe_clk;
+	}
+
+	return 0;
+
+err_disable_pipe_clk:
+	clk_disable_unprepare(qmp->pipe_clk);
+
+	return ret;
+}
+
+static int qmp_usbc_power_off(struct phy *phy)
+{
+	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
+
+	clk_disable_unprepare(qmp->pipe_clk);
+
+	/* PHY reset */
+	qphy_setbits(qmp->pcs, cfg->regs[QPHY_SW_RESET], SW_RESET);
+
+	/* stop SerDes and Phy-Coding-Sublayer */
+	qphy_clrbits(qmp->pcs, cfg->regs[QPHY_START_CTRL],
+			SERDES_START | PCS_START);
+
+	/* Put PHY into POWER DOWN state: active low */
+	qphy_clrbits(qmp->pcs, cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL],
+			SW_PWRDN);
+
+	return 0;
+}
+
+static int qmp_usbc_enable(struct phy *phy)
+{
+	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+	int ret;
+
+	mutex_lock(&qmp->phy_mutex);
+
+	ret = qmp_usbc_init(phy);
+	if (ret)
+		goto out_unlock;
+
+	ret = qmp_usbc_power_on(phy);
+	if (ret) {
+		qmp_usbc_exit(phy);
+		goto out_unlock;
+	}
+
+	qmp->usb_init_count++;
+out_unlock:
+	mutex_unlock(&qmp->phy_mutex);
+
+	return ret;
+}
+
+static int qmp_usbc_disable(struct phy *phy)
+{
+	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+	int ret;
+
+	qmp->usb_init_count--;
+	ret = qmp_usbc_power_off(phy);
+	if (ret)
+		return ret;
+	return qmp_usbc_exit(phy);
+}
+
+static int qmp_usbc_set_mode(struct phy *phy, enum phy_mode mode, int submode)
+{
+	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+
+	qmp->mode = mode;
+
+	return 0;
+}
+
+static const struct phy_ops qmp_usbc_phy_ops = {
+	.init		= qmp_usbc_enable,
+	.exit		= qmp_usbc_disable,
+	.set_mode	= qmp_usbc_set_mode,
+	.owner		= THIS_MODULE,
+};
+
+static void qmp_usbc_enable_autonomous_mode(struct qmp_usbc *qmp)
+{
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
+	void __iomem *pcs = qmp->pcs;
+	u32 intr_mask;
+
+	if (qmp->mode == PHY_MODE_USB_HOST_SS ||
+	    qmp->mode == PHY_MODE_USB_DEVICE_SS)
+		intr_mask = ARCVR_DTCT_EN | ALFPS_DTCT_EN;
+	else
+		intr_mask = ARCVR_DTCT_EN | ARCVR_DTCT_EVENT_SEL;
+
+	/* Clear any pending interrupts status */
+	qphy_setbits(pcs, cfg->regs[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR], IRQ_CLEAR);
+	/* Writing 1 followed by 0 clears the interrupt */
+	qphy_clrbits(pcs, cfg->regs[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR], IRQ_CLEAR);
+
+	qphy_clrbits(pcs, cfg->regs[QPHY_PCS_AUTONOMOUS_MODE_CTRL],
+		     ARCVR_DTCT_EN | ALFPS_DTCT_EN | ARCVR_DTCT_EVENT_SEL);
+
+	/* Enable required PHY autonomous mode interrupts */
+	qphy_setbits(pcs, cfg->regs[QPHY_PCS_AUTONOMOUS_MODE_CTRL], intr_mask);
+
+	/* Enable i/o clamp_n for autonomous mode */
+	if (qmp->tcsr_map && qmp->vls_clamp_reg)
+		regmap_write(qmp->tcsr_map, qmp->vls_clamp_reg, 1);
+}
+
+static void qmp_usbc_disable_autonomous_mode(struct qmp_usbc *qmp)
+{
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
+	void __iomem *pcs = qmp->pcs;
+
+	/* Disable i/o clamp_n on resume for normal mode */
+	if (qmp->tcsr_map && qmp->vls_clamp_reg)
+		regmap_write(qmp->tcsr_map, qmp->vls_clamp_reg, 0);
+
+	qphy_clrbits(pcs, cfg->regs[QPHY_PCS_AUTONOMOUS_MODE_CTRL],
+		     ARCVR_DTCT_EN | ARCVR_DTCT_EVENT_SEL | ALFPS_DTCT_EN);
+
+	qphy_setbits(pcs, cfg->regs[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR], IRQ_CLEAR);
+	/* Writing 1 followed by 0 clears the interrupt */
+	qphy_clrbits(pcs, cfg->regs[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR], IRQ_CLEAR);
+}
+
+static int __maybe_unused qmp_usbc_runtime_suspend(struct device *dev)
+{
+	struct qmp_usbc *qmp = dev_get_drvdata(dev);
+
+	dev_vdbg(dev, "Suspending QMP phy, mode:%d\n", qmp->mode);
+
+	if (!qmp->phy->init_count) {
+		dev_vdbg(dev, "PHY not initialized, bailing out\n");
+		return 0;
+	}
+
+	qmp_usbc_enable_autonomous_mode(qmp);
+
+	clk_disable_unprepare(qmp->pipe_clk);
+	clk_bulk_disable_unprepare(qmp->num_clks, qmp->clks);
+
+	return 0;
+}
+
+static int __maybe_unused qmp_usbc_runtime_resume(struct device *dev)
+{
+	struct qmp_usbc *qmp = dev_get_drvdata(dev);
+	int ret = 0;
+
+	dev_vdbg(dev, "Resuming QMP phy, mode:%d\n", qmp->mode);
+
+	if (!qmp->phy->init_count) {
+		dev_vdbg(dev, "PHY not initialized, bailing out\n");
+		return 0;
+	}
+
+	ret = clk_bulk_prepare_enable(qmp->num_clks, qmp->clks);
+	if (ret)
+		return ret;
+
+	ret = clk_prepare_enable(qmp->pipe_clk);
+	if (ret) {
+		dev_err(dev, "pipe_clk enable failed, err=%d\n", ret);
+		clk_bulk_disable_unprepare(qmp->num_clks, qmp->clks);
+		return ret;
+	}
+
+	qmp_usbc_disable_autonomous_mode(qmp);
+
+	return 0;
+}
+
+static const struct dev_pm_ops qmp_usbc_pm_ops = {
+	SET_RUNTIME_PM_OPS(qmp_usbc_runtime_suspend,
+			   qmp_usbc_runtime_resume, NULL)
+};
+
+static int qmp_usbc_vreg_init(struct qmp_usbc *qmp)
+{
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
+	struct device *dev = qmp->dev;
+	int num = cfg->num_vregs;
+	int i;
+
+	qmp->vregs = devm_kcalloc(dev, num, sizeof(*qmp->vregs), GFP_KERNEL);
+	if (!qmp->vregs)
+		return -ENOMEM;
+
+	for (i = 0; i < num; i++)
+		qmp->vregs[i].supply = cfg->vreg_list[i];
+
+	return devm_regulator_bulk_get(dev, num, qmp->vregs);
+}
+
+static int qmp_usbc_reset_init(struct qmp_usbc *qmp,
+			      const char *const *reset_list,
+			      int num_resets)
+{
+	struct device *dev = qmp->dev;
+	int i;
+	int ret;
+
+	qmp->resets = devm_kcalloc(dev, num_resets,
+				   sizeof(*qmp->resets), GFP_KERNEL);
+	if (!qmp->resets)
+		return -ENOMEM;
+
+	for (i = 0; i < num_resets; i++)
+		qmp->resets[i].id = reset_list[i];
+
+	qmp->num_resets = num_resets;
+
+	ret = devm_reset_control_bulk_get_exclusive(dev, num_resets, qmp->resets);
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to get resets\n");
+
+	return 0;
+}
+
+static int qmp_usbc_clk_init(struct qmp_usbc *qmp)
+{
+	struct device *dev = qmp->dev;
+	int num = ARRAY_SIZE(qmp_usbc_phy_clk_l);
+	int i;
+
+	qmp->clks = devm_kcalloc(dev, num, sizeof(*qmp->clks), GFP_KERNEL);
+	if (!qmp->clks)
+		return -ENOMEM;
+
+	for (i = 0; i < num; i++)
+		qmp->clks[i].id = qmp_usbc_phy_clk_l[i];
+
+	qmp->num_clks = num;
+
+	return devm_clk_bulk_get_optional(dev, num, qmp->clks);
+}
+
+static void phy_clk_release_provider(void *res)
+{
+	of_clk_del_provider(res);
+}
+
+/*
+ * Register a fixed rate pipe clock.
+ *
+ * The <s>_pipe_clksrc generated by PHY goes to the GCC that gate
+ * controls it. The <s>_pipe_clk coming out of the GCC is requested
+ * by the PHY driver for its operations.
+ * We register the <s>_pipe_clksrc here. The gcc driver takes care
+ * of assigning this <s>_pipe_clksrc as parent to <s>_pipe_clk.
+ * Below picture shows this relationship.
+ *
+ *         +---------------+
+ *         |   PHY block   |<<---------------------------------------+
+ *         |               |                                         |
+ *         |   +-------+   |                   +-----+               |
+ *   I/P---^-->|  PLL  |---^--->pipe_clksrc--->| GCC |--->pipe_clk---+
+ *    clk  |   +-------+   |                   +-----+
+ *         +---------------+
+ */
+static int phy_pipe_clk_register(struct qmp_usbc *qmp, struct device_node *np)
+{
+	struct clk_fixed_rate *fixed = &qmp->pipe_clk_fixed;
+	struct clk_init_data init = { };
+	int ret;
+
+	ret = of_property_read_string(np, "clock-output-names", &init.name);
+	if (ret) {
+		dev_err(qmp->dev, "%pOFn: No clock-output-names\n", np);
+		return ret;
+	}
+
+	init.ops = &clk_fixed_rate_ops;
+
+	/* controllers using QMP phys use 125MHz pipe clock interface */
+	fixed->fixed_rate = 125000000;
+	fixed->hw.init = &init;
+
+	ret = devm_clk_hw_register(qmp->dev, &fixed->hw);
+	if (ret)
+		return ret;
+
+	ret = of_clk_add_hw_provider(np, of_clk_hw_simple_get, &fixed->hw);
+	if (ret)
+		return ret;
+
+	/*
+	 * Roll a devm action because the clock provider is the child node, but
+	 * the child node is not actually a device.
+	 */
+	return devm_add_action_or_reset(qmp->dev, phy_clk_release_provider, np);
+}
+
+#if IS_ENABLED(CONFIG_TYPEC)
+static int qmp_usbc_typec_switch_set(struct typec_switch_dev *sw,
+				      enum typec_orientation orientation)
+{
+	struct qmp_usbc *qmp = typec_switch_get_drvdata(sw);
+
+	if (orientation == qmp->orientation || orientation == TYPEC_ORIENTATION_NONE)
+		return 0;
+
+	mutex_lock(&qmp->phy_mutex);
+	qmp->orientation = orientation;
+
+	if (qmp->usb_init_count) {
+		qmp_usbc_power_off(qmp->phy);
+		qmp_usbc_exit(qmp->phy);
+
+		qmp_usbc_init(qmp->phy);
+		qmp_usbc_power_on(qmp->phy);
+	}
+
+	mutex_unlock(&qmp->phy_mutex);
+
+	return 0;
+}
+
+static void qmp_usbc_typec_unregister(void *data)
+{
+	struct qmp_usbc *qmp = data;
+
+	typec_switch_unregister(qmp->sw);
+}
+
+static int qmp_usbc_typec_switch_register(struct qmp_usbc *qmp)
+{
+	struct typec_switch_desc sw_desc = {};
+	struct device *dev = qmp->dev;
+
+	sw_desc.drvdata = qmp;
+	sw_desc.fwnode = dev->fwnode;
+	sw_desc.set = qmp_usbc_typec_switch_set;
+	qmp->sw = typec_switch_register(dev, &sw_desc);
+	if (IS_ERR(qmp->sw)) {
+		dev_err(dev, "Unable to register typec switch: %pe\n", qmp->sw);
+		return PTR_ERR(qmp->sw);
+	}
+
+	return devm_add_action_or_reset(dev, qmp_usbc_typec_unregister, qmp);
+}
+#else
+static int qmp_usbc_typec_switch_register(struct qmp_usbc *qmp)
+{
+	return 0;
+}
+#endif
+
+static int qmp_usbc_parse_dt_legacy(struct qmp_usbc *qmp, struct device_node *np)
+{
+	struct platform_device *pdev = to_platform_device(qmp->dev);
+	struct device *dev = qmp->dev;
+	int ret;
+
+	qmp->serdes = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(qmp->serdes))
+		return PTR_ERR(qmp->serdes);
+
+	/*
+	 * Get memory resources for the PHY:
+	 * Resources are indexed as: tx -> 0; rx -> 1; pcs -> 2.
+	 * For dual lane PHYs: tx2 -> 3, rx2 -> 4, pcs_misc (optional) -> 5
+	 * For single lane PHYs: pcs_misc (optional) -> 3.
+	 */
+	qmp->tx = devm_of_iomap(dev, np, 0, NULL);
+	if (IS_ERR(qmp->tx))
+		return PTR_ERR(qmp->tx);
+
+	qmp->rx = devm_of_iomap(dev, np, 1, NULL);
+	if (IS_ERR(qmp->rx))
+		return PTR_ERR(qmp->rx);
+
+	qmp->pcs = devm_of_iomap(dev, np, 2, NULL);
+	if (IS_ERR(qmp->pcs))
+		return PTR_ERR(qmp->pcs);
+
+	qmp->tx2 = devm_of_iomap(dev, np, 3, NULL);
+	if (IS_ERR(qmp->tx2))
+		return PTR_ERR(qmp->tx2);
+
+	qmp->rx2 = devm_of_iomap(dev, np, 4, NULL);
+	if (IS_ERR(qmp->rx2))
+		return PTR_ERR(qmp->rx2);
+
+	qmp->pcs_misc = devm_of_iomap(dev, np, 5, NULL);
+	if (IS_ERR(qmp->pcs_misc)) {
+		dev_vdbg(dev, "PHY pcs_misc-reg not used\n");
+		qmp->pcs_misc = NULL;
+	}
+
+	qmp->pipe_clk = devm_get_clk_from_child(dev, np, NULL);
+	if (IS_ERR(qmp->pipe_clk)) {
+		return dev_err_probe(dev, PTR_ERR(qmp->pipe_clk),
+				     "failed to get pipe clock\n");
+	}
+
+	ret = devm_clk_bulk_get_all(qmp->dev, &qmp->clks);
+	if (ret < 0)
+		return ret;
+
+	qmp->num_clks = ret;
+
+	ret = qmp_usbc_reset_init(qmp, usb3phy_legacy_reset_l,
+				 ARRAY_SIZE(usb3phy_legacy_reset_l));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int qmp_usbc_parse_dt(struct qmp_usbc *qmp)
+{
+	struct platform_device *pdev = to_platform_device(qmp->dev);
+	const struct qmp_phy_cfg *cfg = qmp->cfg;
+	const struct qmp_usbc_offsets *offs = cfg->offsets;
+	struct device *dev = qmp->dev;
+	void __iomem *base;
+	int ret;
+
+	if (!offs)
+		return -EINVAL;
+
+	base = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(base))
+		return PTR_ERR(base);
+
+	qmp->serdes = base + offs->serdes;
+	qmp->pcs = base + offs->pcs;
+	if (offs->pcs_misc)
+		qmp->pcs_misc = base + offs->pcs_misc;
+	qmp->tx = base + offs->tx;
+	qmp->rx = base + offs->rx;
+
+	qmp->tx2 = base + offs->tx2;
+	qmp->rx2 = base + offs->rx2;
+
+	ret = qmp_usbc_clk_init(qmp);
+	if (ret)
+		return ret;
+
+	qmp->pipe_clk = devm_clk_get(dev, "pipe");
+	if (IS_ERR(qmp->pipe_clk)) {
+		return dev_err_probe(dev, PTR_ERR(qmp->pipe_clk),
+				     "failed to get pipe clock\n");
+	}
+
+	ret = qmp_usbc_reset_init(qmp, usb3phy_reset_l,
+				 ARRAY_SIZE(usb3phy_reset_l));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int qmp_usbc_parse_vls_clamp(struct qmp_usbc *qmp)
+{
+	struct of_phandle_args tcsr_args;
+	struct device *dev = qmp->dev;
+	int ret;
+
+	/*  for backwards compatibility ignore if there is no property */
+	ret = of_parse_phandle_with_fixed_args(dev->of_node, "qcom,tcsr-reg", 1, 0,
+					       &tcsr_args);
+	if (ret == -ENOENT)
+		return 0;
+	else if (ret < 0)
+		return dev_err_probe(dev, ret, "Failed to parse qcom,tcsr-reg\n");
+
+	qmp->tcsr_map = syscon_node_to_regmap(tcsr_args.np);
+	of_node_put(tcsr_args.np);
+	if (IS_ERR(qmp->tcsr_map))
+		return PTR_ERR(qmp->tcsr_map);
+
+	qmp->vls_clamp_reg = tcsr_args.args[0];
+
+	return 0;
+}
+
+static int qmp_usbc_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct phy_provider *phy_provider;
+	struct device_node *np;
+	struct qmp_usbc *qmp;
+	int ret;
+
+	qmp = devm_kzalloc(dev, sizeof(*qmp), GFP_KERNEL);
+	if (!qmp)
+		return -ENOMEM;
+
+	qmp->dev = dev;
+	dev_set_drvdata(dev, qmp);
+
+	qmp->orientation = TYPEC_ORIENTATION_NORMAL;
+
+	qmp->cfg = of_device_get_match_data(dev);
+	if (!qmp->cfg)
+		return -EINVAL;
+
+	mutex_init(&qmp->phy_mutex);
+
+	ret = qmp_usbc_vreg_init(qmp);
+	if (ret)
+		return ret;
+
+	ret = qmp_usbc_typec_switch_register(qmp);
+	if (ret)
+		return ret;
+
+	ret = qmp_usbc_parse_vls_clamp(qmp);
+	if (ret)
+		return ret;
+
+	/* Check for legacy binding with child node. */
+	np = of_get_child_by_name(dev->of_node, "phy");
+	if (np) {
+		ret = qmp_usbc_parse_dt_legacy(qmp, np);
+	} else {
+		np = of_node_get(dev->of_node);
+		ret = qmp_usbc_parse_dt(qmp);
+	}
+	if (ret)
+		goto err_node_put;
+
+	pm_runtime_set_active(dev);
+	ret = devm_pm_runtime_enable(dev);
+	if (ret)
+		goto err_node_put;
+	/*
+	 * Prevent runtime pm from being ON by default. Users can enable
+	 * it using power/control in sysfs.
+	 */
+	pm_runtime_forbid(dev);
+
+	ret = phy_pipe_clk_register(qmp, np);
+	if (ret)
+		goto err_node_put;
+
+	qmp->phy = devm_phy_create(dev, np, &qmp_usbc_phy_ops);
+	if (IS_ERR(qmp->phy)) {
+		ret = PTR_ERR(qmp->phy);
+		dev_err(dev, "failed to create PHY: %d\n", ret);
+		goto err_node_put;
+	}
+
+	phy_set_drvdata(qmp->phy, qmp);
+
+	of_node_put(np);
+
+	phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
+
+	return PTR_ERR_OR_ZERO(phy_provider);
+
+err_node_put:
+	of_node_put(np);
+	return ret;
+}
+
+static const struct of_device_id qmp_usbc_of_match_table[] = {
+	{
+		.compatible = "qcom,msm8998-qmp-usb3-phy",
+		.data = &msm8998_usb3phy_cfg,
+	}, {
+		.compatible = "qcom,qcm2290-qmp-usb3-phy",
+		.data = &qcm2290_usb3phy_cfg,
+	}, {
+		.compatible = "qcom,qcs615-qmp-usb3-phy",
+		.data = &qcm2290_usb3phy_cfg,
+	}, {
+		.compatible = "qcom,sdm660-qmp-usb3-phy",
+		.data = &sdm660_usb3phy_cfg,
+	}, {
+		.compatible = "qcom,sm6115-qmp-usb3-phy",
+		.data = &qcm2290_usb3phy_cfg,
+	},
+	{ },
+};
+MODULE_DEVICE_TABLE(of, qmp_usbc_of_match_table);
+
+static struct platform_driver qmp_usbc_driver = {
+	.probe		= qmp_usbc_probe,
+	.driver = {
+		.name	= "qcom-qmp-usbc-phy",
+		.pm	= &qmp_usbc_pm_ops,
+		.of_match_table = qmp_usbc_of_match_table,
+	},
+};
+
+module_platform_driver(qmp_usbc_driver);
+
+MODULE_AUTHOR("Vivek Gautam <vivek.gautam@codeaurora.org>");
+MODULE_DESCRIPTION("Qualcomm QMP USB-C PHY driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qmp.h
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qmp.h
@@ -46,96 +46,35 @@
 
 #include "phy-qcom-qmp-pcs-v6.h"
 
+#include "phy-qcom-qmp-pcs-v6-n4.h"
+
 #include "phy-qcom-qmp-pcs-v6_20.h"
 
 #include "phy-qcom-qmp-pcs-v7.h"
 
-/* Only for QMP V3 & V4 PHY - DP COM registers */
-#define QPHY_V3_DP_COM_PHY_MODE_CTRL			0x00
-#define QPHY_V3_DP_COM_SW_RESET				0x04
-#define QPHY_V3_DP_COM_POWER_DOWN_CTRL			0x08
-#define QPHY_V3_DP_COM_SWI_CTRL				0x0c
-#define QPHY_V3_DP_COM_TYPEC_CTRL			0x10
-#define QPHY_V3_DP_COM_TYPEC_PWRDN_CTRL			0x14
-#define QPHY_V3_DP_COM_RESET_OVRD_CTRL			0x1c
-
-/* QSERDES V3 COM bits */
-# define QSERDES_V3_COM_BIAS_EN				0x0001
-# define QSERDES_V3_COM_BIAS_EN_MUX			0x0002
-# define QSERDES_V3_COM_CLKBUF_R_EN			0x0004
-# define QSERDES_V3_COM_CLKBUF_L_EN			0x0008
-# define QSERDES_V3_COM_EN_SYSCLK_TX_SEL		0x0010
-# define QSERDES_V3_COM_CLKBUF_RX_DRIVE_L		0x0020
-# define QSERDES_V3_COM_CLKBUF_RX_DRIVE_R		0x0040
-
-/* QSERDES V3 TX bits */
-# define DP_PHY_TXn_TX_EMP_POST1_LVL_MASK		0x001f
-# define DP_PHY_TXn_TX_EMP_POST1_LVL_MUX_EN		0x0020
-# define DP_PHY_TXn_TX_DRV_LVL_MASK			0x001f
-# define DP_PHY_TXn_TX_DRV_LVL_MUX_EN			0x0020
-
-/* QMP PHY - DP PHY registers */
-#define QSERDES_DP_PHY_REVISION_ID0			0x000
-#define QSERDES_DP_PHY_REVISION_ID1			0x004
-#define QSERDES_DP_PHY_REVISION_ID2			0x008
-#define QSERDES_DP_PHY_REVISION_ID3			0x00c
-#define QSERDES_DP_PHY_CFG				0x010
-#define QSERDES_DP_PHY_PD_CTL				0x018
-# define DP_PHY_PD_CTL_PWRDN				0x001
-# define DP_PHY_PD_CTL_PSR_PWRDN			0x002
-# define DP_PHY_PD_CTL_AUX_PWRDN			0x004
-# define DP_PHY_PD_CTL_LANE_0_1_PWRDN			0x008
-# define DP_PHY_PD_CTL_LANE_2_3_PWRDN			0x010
-# define DP_PHY_PD_CTL_PLL_PWRDN			0x020
-# define DP_PHY_PD_CTL_DP_CLAMP_EN			0x040
-#define QSERDES_DP_PHY_MODE				0x01c
-#define QSERDES_DP_PHY_AUX_CFG0				0x020
-#define QSERDES_DP_PHY_AUX_CFG1				0x024
-#define QSERDES_DP_PHY_AUX_CFG2				0x028
-#define QSERDES_DP_PHY_AUX_CFG3				0x02c
-#define QSERDES_DP_PHY_AUX_CFG4				0x030
-#define QSERDES_DP_PHY_AUX_CFG5				0x034
-#define QSERDES_DP_PHY_AUX_CFG6				0x038
-#define QSERDES_DP_PHY_AUX_CFG7				0x03c
-#define QSERDES_DP_PHY_AUX_CFG8				0x040
-#define QSERDES_DP_PHY_AUX_CFG9				0x044
-
-/* Only for QMP V3 PHY - DP PHY registers */
-#define QSERDES_V3_DP_PHY_AUX_INTERRUPT_MASK		0x048
-# define PHY_AUX_STOP_ERR_MASK				0x01
-# define PHY_AUX_DEC_ERR_MASK				0x02
-# define PHY_AUX_SYNC_ERR_MASK				0x04
-# define PHY_AUX_ALIGN_ERR_MASK				0x08
-# define PHY_AUX_REQ_ERR_MASK				0x10
-
-#define QSERDES_V3_DP_PHY_AUX_INTERRUPT_CLEAR		0x04c
-#define QSERDES_V3_DP_PHY_AUX_BIST_CFG			0x050
-
-#define QSERDES_V3_DP_PHY_VCO_DIV			0x064
-#define QSERDES_V3_DP_PHY_TX0_TX1_LANE_CTL		0x06c
-#define QSERDES_V3_DP_PHY_TX2_TX3_LANE_CTL		0x088
-
-#define QSERDES_V3_DP_PHY_SPARE0			0x0ac
-#define DP_PHY_SPARE0_MASK				0x0f
-#define DP_PHY_SPARE0_ORIENTATION_INFO_SHIFT		0x04(0x0004)
-
-#define QSERDES_V3_DP_PHY_STATUS			0x0c0
-
-/* Only for QMP V4 PHY - DP PHY registers */
-#define QSERDES_V4_DP_PHY_CFG_1				0x014
-#define QSERDES_V4_DP_PHY_AUX_INTERRUPT_MASK		0x054
-#define QSERDES_V4_DP_PHY_AUX_INTERRUPT_CLEAR		0x058
-#define QSERDES_V4_DP_PHY_VCO_DIV			0x070
-#define QSERDES_V4_DP_PHY_TX0_TX1_LANE_CTL		0x078
-#define QSERDES_V4_DP_PHY_TX2_TX3_LANE_CTL		0x09c
-#define QSERDES_V4_DP_PHY_SPARE0			0x0c8
-#define QSERDES_V4_DP_PHY_AUX_INTERRUPT_STATUS		0x0d8
-#define QSERDES_V4_DP_PHY_STATUS			0x0dc
-
-#define QSERDES_V5_DP_PHY_STATUS			0x0dc
-
-/* Only for QMP V6 PHY - DP PHY registers */
-#define QSERDES_V6_DP_PHY_AUX_INTERRUPT_STATUS		0x0e0
-#define QSERDES_V6_DP_PHY_STATUS			0x0e4
+/* QPHY_SW_RESET bit */
+#define SW_RESET				BIT(0)
+/* QPHY_POWER_DOWN_CONTROL */
+#define SW_PWRDN				BIT(0)
+#define REFCLK_DRV_DSBL				BIT(1) /* PCIe */
+
+/* QPHY_START_CONTROL bits */
+#define SERDES_START				BIT(0)
+#define PCS_START				BIT(1)
+
+/* QPHY_PCS_STATUS bit */
+#define PHYSTATUS				BIT(6)
+#define PHYSTATUS_4_20				BIT(7)
+
+/* QPHY_PCS_AUTONOMOUS_MODE_CTRL register bits */
+#define ARCVR_DTCT_EN				BIT(0)
+#define ALFPS_DTCT_EN				BIT(1)
+#define ARCVR_DTCT_EVENT_SEL			BIT(4)
+
+/* QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR register bits */
+#define IRQ_CLEAR				BIT(0)
+
+/* QPHY_PCS_MISC_CLAMP_ENABLE register bits */
+#define CLAMP_EN				BIT(0) /* enables i/o clamp_n */
 
 #endif
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-qusb2.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-qusb2.c
@@ -151,6 +151,34 @@
 	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_AUTOPGM_CTL1, 0x9F),
 };
 
+static const struct qusb2_phy_init_tbl ipq5424_init_tbl[] = {
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL, 0x14),
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TUNE1, 0x00),
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TUNE2, 0x53),
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TUNE4, 0xc3),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_TUNE, 0x30),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_USER_CTL1, 0x79),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_USER_CTL2, 0x21),
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TUNE5, 0x00),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_PWR_CTRL, 0x00),
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TEST2, 0x14),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_TEST, 0x80),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_AUTOPGM_CTL1, 0x9f),
+};
+
+static const struct qusb2_phy_init_tbl qcs615_init_tbl[] = {
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TUNE1, 0xc8),
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TUNE2, 0xb3),
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TUNE3, 0x83),
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TUNE4, 0xc0),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_TUNE, 0x30),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_USER_CTL1, 0x79),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_USER_CTL2, 0x21),
+	QUSB2_PHY_INIT_CFG_L(QUSB2PHY_PORT_TEST2, 0x14),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_AUTOPGM_CTL1, 0x9f),
+	QUSB2_PHY_INIT_CFG(QUSB2PHY_PLL_PWR_CTRL, 0x00),
+};
+
 static const unsigned int ipq6018_regs_layout[] = {
 	[QUSB2PHY_PLL_STATUS]              = 0x38,
 	[QUSB2PHY_PORT_TUNE1]              = 0x80,
@@ -331,6 +359,27 @@
 	.autoresume_en   = BIT(0),
 };
 
+static const struct qusb2_phy_cfg ipq5424_phy_cfg = {
+	.tbl            = ipq5424_init_tbl,
+	.tbl_num        = ARRAY_SIZE(ipq5424_init_tbl),
+	.regs           = ipq6018_regs_layout,
+
+	.disable_ctrl   = POWER_DOWN,
+	.mask_core_ready = PLL_LOCKED,
+	.autoresume_en   = BIT(0),
+};
+
+static const struct qusb2_phy_cfg qcs615_phy_cfg = {
+	.tbl            = qcs615_init_tbl,
+	.tbl_num        = ARRAY_SIZE(qcs615_init_tbl),
+	.regs           = ipq6018_regs_layout,
+
+	.disable_ctrl   = (CLAMP_N_EN | FREEZIO_N | POWER_DOWN),
+	.mask_core_ready = PLL_LOCKED,
+	/* autoresume not used */
+	.autoresume_en   = BIT(0),
+};
+
 static const struct qusb2_phy_cfg qusb2_v2_phy_cfg = {
 	.tbl		= qusb2_v2_init_tbl,
 	.tbl_num	= ARRAY_SIZE(qusb2_v2_init_tbl),
@@ -905,6 +954,9 @@
 
 static const struct of_device_id qusb2_phy_of_match_table[] = {
 	{
+		.compatible	= "qcom,ipq5424-qusb2-phy",
+		.data		= &ipq5424_phy_cfg,
+	}, {
 		.compatible	= "qcom,ipq6018-qusb2-phy",
 		.data		= &ipq6018_phy_cfg,
 	}, {
@@ -923,6 +975,9 @@
 		.compatible	= "qcom,msm8998-qusb2-phy",
 		.data		= &msm8998_phy_cfg,
 	}, {
+		.compatible	= "qcom,qcs615-qusb2-phy",
+		.data		= &qcs615_phy_cfg,
+	}, {
 		.compatible	= "qcom,qcm2290-qusb2-phy",
 		.data		= &sm6115_phy_cfg,
 	}, {
--- linux-qcom-6.8.0.orig/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c
+++ linux-qcom-6.8.0/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c
@@ -432,6 +432,7 @@
 }
 
 static const struct of_device_id qcom_dwmac_sgmii_phy_of_match[] = {
+	{ .compatible = "qcom,qcs8300-dwmac-sgmii-phy" },
 	{ .compatible = "qcom,sa8775p-dwmac-sgmii-phy" },
 	{ },
 };
--- linux-qcom-6.8.0.orig/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+++ linux-qcom-6.8.0/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
@@ -125,12 +125,15 @@
 };
 
 struct rockchip_combphy_cfg {
+	unsigned int num_phys;
+	unsigned int phy_ids[3];
 	const struct rockchip_combphy_grfcfg *grfcfg;
 	int (*combphy_cfg)(struct rockchip_combphy_priv *priv);
 };
 
 struct rockchip_combphy_priv {
 	u8 type;
+	int id;
 	void __iomem *mmio;
 	int num_clks;
 	struct clk_bulk_data *clks;
@@ -306,7 +309,7 @@
 
 	priv->ext_refclk = device_property_present(dev, "rockchip,ext-refclk");
 
-	priv->phy_rst = devm_reset_control_array_get_exclusive(dev);
+	priv->phy_rst = devm_reset_control_get(dev, "phy");
 	if (IS_ERR(priv->phy_rst))
 		return dev_err_probe(dev, PTR_ERR(priv->phy_rst), "failed to get phy reset\n");
 
@@ -320,7 +323,7 @@
 	struct rockchip_combphy_priv *priv;
 	const struct rockchip_combphy_cfg *phy_cfg;
 	struct resource *res;
-	int ret;
+	int ret, id;
 
 	phy_cfg = of_device_get_match_data(dev);
 	if (!phy_cfg) {
@@ -338,6 +341,15 @@
 		return ret;
 	}
 
+	/* find the phy-id from the io address */
+	priv->id = -ENODEV;
+	for (id = 0; id < phy_cfg->num_phys; id++) {
+		if (res->start == phy_cfg->phy_ids[id]) {
+			priv->id = id;
+			break;
+		}
+	}
+
 	priv->dev = dev;
 	priv->type = PHY_NONE;
 	priv->cfg = phy_cfg;
@@ -562,6 +574,12 @@
 };
 
 static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = {
+	.num_phys = 3,
+	.phy_ids = {
+		0xfe820000,
+		0xfe830000,
+		0xfe840000,
+	},
 	.grfcfg		= &rk3568_combphy_grfcfgs,
 	.combphy_cfg	= rk3568_combphy_cfg,
 };
@@ -578,8 +596,14 @@
 		rockchip_combphy_param_write(priv->phy_grf, &cfg->con1_for_pcie, true);
 		rockchip_combphy_param_write(priv->phy_grf, &cfg->con2_for_pcie, true);
 		rockchip_combphy_param_write(priv->phy_grf, &cfg->con3_for_pcie, true);
-		rockchip_combphy_param_write(priv->pipe_grf, &cfg->pipe_pcie1l0_sel, true);
-		rockchip_combphy_param_write(priv->pipe_grf, &cfg->pipe_pcie1l1_sel, true);
+		switch (priv->id) {
+		case 1:
+			rockchip_combphy_param_write(priv->pipe_grf, &cfg->pipe_pcie1l0_sel, true);
+			break;
+		case 2:
+			rockchip_combphy_param_write(priv->pipe_grf, &cfg->pipe_pcie1l1_sel, true);
+			break;
+		}
 		break;
 	case PHY_TYPE_USB3:
 		/* Set SSC downward spread spectrum */
@@ -736,6 +760,12 @@
 };
 
 static const struct rockchip_combphy_cfg rk3588_combphy_cfgs = {
+	.num_phys = 3,
+	.phy_ids = {
+		0xfee00000,
+		0xfee10000,
+		0xfee20000,
+	},
 	.grfcfg		= &rk3588_combphy_grfcfgs,
 	.combphy_cfg	= rk3588_combphy_cfg,
 };
--- linux-qcom-6.8.0.orig/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c
+++ linux-qcom-6.8.0/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c
@@ -40,6 +40,8 @@
 #define RK3588_BIFURCATION_LANE_0_1		BIT(0)
 #define RK3588_BIFURCATION_LANE_2_3		BIT(1)
 #define RK3588_LANE_AGGREGATION		BIT(2)
+#define RK3588_PCIE1LN_SEL_EN			(GENMASK(1, 0) << 16)
+#define RK3588_PCIE30_PHY_MODE_EN		(GENMASK(2, 0) << 16)
 
 struct rockchip_p3phy_ops;
 
@@ -132,7 +134,7 @@
 static int rockchip_p3phy_rk3588_init(struct rockchip_p3phy_priv *priv)
 {
 	u32 reg = 0;
-	u8 mode = 0;
+	u8 mode = RK3588_LANE_AGGREGATION; /* default */
 	int ret;
 
 	/* Deassert PCIe PMA output clamp mode */
@@ -140,31 +142,24 @@
 
 	/* Set bifurcation if needed */
 	for (int i = 0; i < priv->num_lanes; i++) {
-		if (!priv->lanes[i])
-			mode |= (BIT(i) << 3);
-
 		if (priv->lanes[i] > 1)
-			mode |= (BIT(i) >> 1);
-	}
-
-	if (!mode)
-		reg = RK3588_LANE_AGGREGATION;
-	else {
-		if (mode & (BIT(0) | BIT(1)))
-			reg |= RK3588_BIFURCATION_LANE_0_1;
-
-		if (mode & (BIT(2) | BIT(3)))
-			reg |= RK3588_BIFURCATION_LANE_2_3;
+			mode &= ~RK3588_LANE_AGGREGATION;
+		if (priv->lanes[i] == 3)
+			mode |= RK3588_BIFURCATION_LANE_0_1;
+		if (priv->lanes[i] == 4)
+			mode |= RK3588_BIFURCATION_LANE_2_3;
 	}
 
-	regmap_write(priv->phy_grf, RK3588_PCIE3PHY_GRF_CMN_CON0, (0x7<<16) | reg);
+	reg = mode;
+	regmap_write(priv->phy_grf, RK3588_PCIE3PHY_GRF_CMN_CON0,
+		     RK3588_PCIE30_PHY_MODE_EN | reg);
 
 	/* Set pcie1ln_sel in PHP_GRF_PCIESEL_CON */
 	if (!IS_ERR(priv->pipe_grf)) {
-		reg = (mode & (BIT(6) | BIT(7))) >> 6;
+		reg = mode & (RK3588_BIFURCATION_LANE_0_1 | RK3588_BIFURCATION_LANE_2_3);
 		if (reg)
 			regmap_write(priv->pipe_grf, PHP_GRF_PCIESEL_CON,
-				     (reg << 16) | reg);
+				     RK3588_PCIE1LN_SEL_EN | reg);
 	}
 
 	reset_control_deassert(priv->p30phy);
--- linux-qcom-6.8.0.orig/drivers/phy/tegra/xusb.c
+++ linux-qcom-6.8.0/drivers/phy/tegra/xusb.c
@@ -1531,6 +1531,19 @@
 }
 EXPORT_SYMBOL_GPL(tegra_xusb_padctl_get_usb3_companion);
 
+int tegra_xusb_padctl_get_port_number(struct phy *phy)
+{
+	struct tegra_xusb_lane *lane;
+
+	if (!phy)
+		return -ENODEV;
+
+	lane = phy_get_drvdata(phy);
+
+	return lane->index;
+}
+EXPORT_SYMBOL_GPL(tegra_xusb_padctl_get_port_number);
+
 MODULE_AUTHOR("Thierry Reding <treding@nvidia.com>");
 MODULE_DESCRIPTION("Tegra XUSB Pad Controller driver");
 MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/drivers/phy/ti/phy-tusb1210.c
+++ linux-qcom-6.8.0/drivers/phy/ti/phy-tusb1210.c
@@ -65,7 +65,6 @@
 	struct delayed_work chg_det_work;
 	struct notifier_block psy_nb;
 	struct power_supply *psy;
-	struct power_supply *charger;
 #endif
 };
 
@@ -231,19 +230,24 @@
 
 static bool tusb1210_get_online(struct tusb1210 *tusb)
 {
+	struct power_supply *charger = NULL;
 	union power_supply_propval val;
-	int i;
+	bool online = false;
+	int i, ret;
 
-	for (i = 0; i < ARRAY_SIZE(tusb1210_chargers) && !tusb->charger; i++)
-		tusb->charger = power_supply_get_by_name(tusb1210_chargers[i]);
+	for (i = 0; i < ARRAY_SIZE(tusb1210_chargers) && !charger; i++)
+		charger = power_supply_get_by_name(tusb1210_chargers[i]);
 
-	if (!tusb->charger)
+	if (!charger)
 		return false;
 
-	if (power_supply_get_property(tusb->charger, POWER_SUPPLY_PROP_ONLINE, &val))
-		return false;
+	ret = power_supply_get_property(charger, POWER_SUPPLY_PROP_ONLINE, &val);
+	if (ret == 0)
+		online = val.intval;
+
+	power_supply_put(charger);
 
-	return val.intval;
+	return online;
 }
 
 static void tusb1210_chg_det_work(struct work_struct *work)
@@ -467,9 +471,6 @@
 		cancel_delayed_work_sync(&tusb->chg_det_work);
 		power_supply_unregister(tusb->psy);
 	}
-
-	if (tusb->charger)
-		power_supply_put(tusb->charger);
 }
 #else
 static void tusb1210_probe_charger_detect(struct tusb1210 *tusb) { }
--- linux-qcom-6.8.0.orig/drivers/phy/xilinx/phy-zynqmp.c
+++ linux-qcom-6.8.0/drivers/phy/xilinx/phy-zynqmp.c
@@ -80,7 +80,8 @@
 
 /* Reference clock selection parameters */
 #define L0_Ln_REF_CLK_SEL(n)		(0x2860 + (n) * 4)
-#define L0_REF_CLK_SEL_MASK		0x8f
+#define L0_REF_CLK_LCL_SEL		BIT(7)
+#define L0_REF_CLK_SEL_MASK		0x9f
 
 /* Calibration digital logic parameters */
 #define L3_TM_CALIB_DIG19		0xec4c
@@ -165,6 +166,24 @@
 /* Timeout values */
 #define TIMEOUT_US			1000
 
+/* Lane 0/1/2/3 offset */
+#define DIG_8(n)		((0x4000 * (n)) + 0x1074)
+#define ILL13(n)		((0x4000 * (n)) + 0x1994)
+#define DIG_10(n)		((0x4000 * (n)) + 0x107c)
+#define RST_DLY(n)		((0x4000 * (n)) + 0x19a4)
+#define BYP_15(n)		((0x4000 * (n)) + 0x1038)
+#define BYP_12(n)		((0x4000 * (n)) + 0x102c)
+#define MISC3(n)		((0x4000 * (n)) + 0x19ac)
+#define EQ11(n)			((0x4000 * (n)) + 0x1978)
+
+static u32 save_reg_address[] = {
+	/* Lane 0/1/2/3 Register */
+	DIG_8(0), ILL13(0), DIG_10(0), RST_DLY(0), BYP_15(0), BYP_12(0), MISC3(0), EQ11(0),
+	DIG_8(1), ILL13(1), DIG_10(1), RST_DLY(1), BYP_15(1), BYP_12(1), MISC3(1), EQ11(1),
+	DIG_8(2), ILL13(2), DIG_10(2), RST_DLY(2), BYP_15(2), BYP_12(2), MISC3(2), EQ11(2),
+	DIG_8(3), ILL13(3), DIG_10(3), RST_DLY(3), BYP_15(3), BYP_12(3), MISC3(3), EQ11(3),
+};
+
 struct xpsgtr_dev;
 
 /**
@@ -213,6 +232,7 @@
  * @tx_term_fix: fix for GT issue
  * @saved_icm_cfg0: stored value of ICM CFG0 register
  * @saved_icm_cfg1: stored value of ICM CFG1 register
+ * @saved_regs: registers to be saved/restored during suspend/resume
  */
 struct xpsgtr_dev {
 	struct device *dev;
@@ -225,6 +245,7 @@
 	bool tx_term_fix;
 	unsigned int saved_icm_cfg0;
 	unsigned int saved_icm_cfg1;
+	u32 *saved_regs;
 };
 
 /*
@@ -298,6 +319,32 @@
 	writel((readl(addr) & ~clr) | set, addr);
 }
 
+/**
+ * xpsgtr_save_lane_regs - Saves registers on suspend
+ * @gtr_dev: pointer to phy controller context structure
+ */
+static void xpsgtr_save_lane_regs(struct xpsgtr_dev *gtr_dev)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(save_reg_address); i++)
+		gtr_dev->saved_regs[i] = xpsgtr_read(gtr_dev,
+						     save_reg_address[i]);
+}
+
+/**
+ * xpsgtr_restore_lane_regs - Restores registers on resume
+ * @gtr_dev: pointer to phy controller context structure
+ */
+static void xpsgtr_restore_lane_regs(struct xpsgtr_dev *gtr_dev)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(save_reg_address); i++)
+		xpsgtr_write(gtr_dev, save_reg_address[i],
+			     gtr_dev->saved_regs[i]);
+}
+
 /*
  * Hardware Configuration
  */
@@ -349,11 +396,12 @@
 		       PLL_FREQ_MASK, ssc->pll_ref_clk);
 
 	/* Enable lane clock sharing, if required */
-	if (gtr_phy->refclk != gtr_phy->lane) {
-		/* Lane3 Ref Clock Selection Register */
+	if (gtr_phy->refclk == gtr_phy->lane)
+		xpsgtr_clr_set(gtr_phy->dev, L0_Ln_REF_CLK_SEL(gtr_phy->lane),
+			       L0_REF_CLK_SEL_MASK, L0_REF_CLK_LCL_SEL);
+	else
 		xpsgtr_clr_set(gtr_phy->dev, L0_Ln_REF_CLK_SEL(gtr_phy->lane),
 			       L0_REF_CLK_SEL_MASK, 1 << gtr_phy->refclk);
-	}
 
 	/* SSC step size [7:0] */
 	xpsgtr_clr_set_phy(gtr_phy, L0_PLL_SS_STEP_SIZE_0_LSB,
@@ -573,7 +621,7 @@
 	mutex_lock(&gtr_dev->gtr_mutex);
 
 	/* Configure and enable the clock when peripheral phy_init call */
-	if (clk_prepare_enable(gtr_dev->clk[gtr_phy->lane]))
+	if (clk_prepare_enable(gtr_dev->clk[gtr_phy->refclk]))
 		goto out;
 
 	/* Skip initialization if not required. */
@@ -625,7 +673,7 @@
 	gtr_phy->skip_phy_init = false;
 
 	/* Ensure that disable clock only, which configure for lane */
-	clk_disable_unprepare(gtr_dev->clk[gtr_phy->lane]);
+	clk_disable_unprepare(gtr_dev->clk[gtr_phy->refclk]);
 
 	return 0;
 }
@@ -798,6 +846,7 @@
 	phy_type = args->args[1];
 	phy_instance = args->args[2];
 
+	guard(mutex)(&gtr_phy->phy->mutex);
 	ret = xpsgtr_set_lane_type(gtr_phy, phy_type, phy_instance);
 	if (ret < 0) {
 		dev_err(gtr_dev->dev, "Invalid PHY type and/or instance\n");
@@ -837,6 +886,8 @@
 	gtr_dev->saved_icm_cfg0 = xpsgtr_read(gtr_dev, ICM_CFG0);
 	gtr_dev->saved_icm_cfg1 = xpsgtr_read(gtr_dev, ICM_CFG1);
 
+	xpsgtr_save_lane_regs(gtr_dev);
+
 	return 0;
 }
 
@@ -847,6 +898,8 @@
 	unsigned int i;
 	bool skip_phy_init;
 
+	xpsgtr_restore_lane_regs(gtr_dev);
+
 	icm_cfg0 = xpsgtr_read(gtr_dev, ICM_CFG0);
 	icm_cfg1 = xpsgtr_read(gtr_dev, ICM_CFG1);
 
@@ -992,6 +1045,12 @@
 		return ret;
 	}
 
+	gtr_dev->saved_regs = devm_kmalloc(gtr_dev->dev,
+					   sizeof(save_reg_address),
+					   GFP_KERNEL);
+	if (!gtr_dev->saved_regs)
+		return -ENOMEM;
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/pinctrl/aspeed/Makefile
+++ linux-qcom-6.8.0/drivers/pinctrl/aspeed/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 # Aspeed pinctrl support
 
-ccflags-y += $(call cc-option,-Woverride-init)
+ccflags-y += -Woverride-init
 obj-$(CONFIG_PINCTRL_ASPEED)	+= pinctrl-aspeed.o pinmux-aspeed.o
 obj-$(CONFIG_PINCTRL_ASPEED_G4)	+= pinctrl-aspeed-g4.o
 obj-$(CONFIG_PINCTRL_ASPEED_G5)	+= pinctrl-aspeed-g5.o
--- linux-qcom-6.8.0.orig/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c
+++ linux-qcom-6.8.0/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c
@@ -43,7 +43,7 @@
 #define SCU614		0x614 /* Disable GPIO Internal Pull-Down #1 */
 #define SCU618		0x618 /* Disable GPIO Internal Pull-Down #2 */
 #define SCU61C		0x61c /* Disable GPIO Internal Pull-Down #3 */
-#define SCU620		0x620 /* Disable GPIO Internal Pull-Down #4 */
+#define SCU630		0x630 /* Disable GPIO Internal Pull-Down #4 */
 #define SCU634		0x634 /* Disable GPIO Internal Pull-Down #5 */
 #define SCU638		0x638 /* Disable GPIO Internal Pull-Down #6 */
 #define SCU690		0x690 /* Multi-function Pin Control #24 */
@@ -2495,38 +2495,38 @@
 	ASPEED_PULL_DOWN_PINCONF(D14, SCU61C, 0),
 
 	/* GPIOS7 */
-	ASPEED_PULL_DOWN_PINCONF(T24, SCU620, 23),
+	ASPEED_PULL_DOWN_PINCONF(T24, SCU630, 23),
 	/* GPIOS6 */
-	ASPEED_PULL_DOWN_PINCONF(P23, SCU620, 22),
+	ASPEED_PULL_DOWN_PINCONF(P23, SCU630, 22),
 	/* GPIOS5 */
-	ASPEED_PULL_DOWN_PINCONF(P24, SCU620, 21),
+	ASPEED_PULL_DOWN_PINCONF(P24, SCU630, 21),
 	/* GPIOS4 */
-	ASPEED_PULL_DOWN_PINCONF(R26, SCU620, 20),
+	ASPEED_PULL_DOWN_PINCONF(R26, SCU630, 20),
 	/* GPIOS3*/
-	ASPEED_PULL_DOWN_PINCONF(R24, SCU620, 19),
+	ASPEED_PULL_DOWN_PINCONF(R24, SCU630, 19),
 	/* GPIOS2 */
-	ASPEED_PULL_DOWN_PINCONF(T26, SCU620, 18),
+	ASPEED_PULL_DOWN_PINCONF(T26, SCU630, 18),
 	/* GPIOS1 */
-	ASPEED_PULL_DOWN_PINCONF(T25, SCU620, 17),
+	ASPEED_PULL_DOWN_PINCONF(T25, SCU630, 17),
 	/* GPIOS0 */
-	ASPEED_PULL_DOWN_PINCONF(R23, SCU620, 16),
+	ASPEED_PULL_DOWN_PINCONF(R23, SCU630, 16),
 
 	/* GPIOR7 */
-	ASPEED_PULL_DOWN_PINCONF(U26, SCU620, 15),
+	ASPEED_PULL_DOWN_PINCONF(U26, SCU630, 15),
 	/* GPIOR6 */
-	ASPEED_PULL_DOWN_PINCONF(W26, SCU620, 14),
+	ASPEED_PULL_DOWN_PINCONF(W26, SCU630, 14),
 	/* GPIOR5 */
-	ASPEED_PULL_DOWN_PINCONF(T23, SCU620, 13),
+	ASPEED_PULL_DOWN_PINCONF(T23, SCU630, 13),
 	/* GPIOR4 */
-	ASPEED_PULL_DOWN_PINCONF(U25, SCU620, 12),
+	ASPEED_PULL_DOWN_PINCONF(U25, SCU630, 12),
 	/* GPIOR3*/
-	ASPEED_PULL_DOWN_PINCONF(V26, SCU620, 11),
+	ASPEED_PULL_DOWN_PINCONF(V26, SCU630, 11),
 	/* GPIOR2 */
-	ASPEED_PULL_DOWN_PINCONF(V24, SCU620, 10),
+	ASPEED_PULL_DOWN_PINCONF(V24, SCU630, 10),
 	/* GPIOR1 */
-	ASPEED_PULL_DOWN_PINCONF(U24, SCU620, 9),
+	ASPEED_PULL_DOWN_PINCONF(U24, SCU630, 9),
 	/* GPIOR0 */
-	ASPEED_PULL_DOWN_PINCONF(V25, SCU620, 8),
+	ASPEED_PULL_DOWN_PINCONF(V25, SCU630, 8),
 
 	/* GPIOX7 */
 	ASPEED_PULL_DOWN_PINCONF(AB10, SCU634, 31),
--- linux-qcom-6.8.0.orig/drivers/pinctrl/core.c
+++ linux-qcom-6.8.0/drivers/pinctrl/core.c
@@ -220,6 +220,9 @@
 
 	/* Set owner */
 	pindesc->pctldev = pctldev;
+#ifdef CONFIG_PINMUX
+	mutex_init(&pindesc->mux_lock);
+#endif
 
 	/* Copy basic pin info */
 	if (pin->name) {
@@ -1102,8 +1105,8 @@
 		 * an -EPROBE_DEFER later, as that is the worst case.
 		 */
 		if (ret == -EPROBE_DEFER) {
-			pinctrl_free(p, false);
 			mutex_unlock(&pinctrl_maps_mutex);
+			pinctrl_free(p, false);
 			return ERR_PTR(ret);
 		}
 	}
@@ -1666,6 +1669,7 @@
 		seq_printf(s, "pin %d (%s) ", pin, desc->name);
 
 #ifdef CONFIG_GPIOLIB
+		gdev = NULL;
 		gpio_num = -1;
 		list_for_each_entry(range, &pctldev->gpio_ranges, node) {
 			if ((pin >= range->pin_base) &&
@@ -2076,6 +2080,14 @@
 	return ERR_PTR(ret);
 }
 
+static void pinctrl_uninit_controller(struct pinctrl_dev *pctldev, struct pinctrl_desc *pctldesc)
+{
+	pinctrl_free_pindescs(pctldev, pctldesc->pins,
+			      pctldesc->npins);
+	mutex_destroy(&pctldev->mutex);
+	kfree(pctldev);
+}
+
 static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev)
 {
 	pctldev->p = create_pinctrl(pctldev->dev, pctldev);
@@ -2120,13 +2132,7 @@
 
 	error = pinctrl_claim_hogs(pctldev);
 	if (error) {
-		dev_err(pctldev->dev, "could not claim hogs: %i\n",
-			error);
-		pinctrl_free_pindescs(pctldev, pctldev->desc->pins,
-				      pctldev->desc->npins);
-		mutex_destroy(&pctldev->mutex);
-		kfree(pctldev);
-
+		dev_err(pctldev->dev, "could not claim hogs: %i\n", error);
 		return error;
 	}
 
@@ -2162,8 +2168,10 @@
 		return pctldev;
 
 	error = pinctrl_enable(pctldev);
-	if (error)
+	if (error) {
+		pinctrl_uninit_controller(pctldev, pctldesc);
 		return ERR_PTR(error);
+	}
 
 	return pctldev;
 }
--- linux-qcom-6.8.0.orig/drivers/pinctrl/core.h
+++ linux-qcom-6.8.0/drivers/pinctrl/core.h
@@ -177,6 +177,7 @@
 	const char *mux_owner;
 	const struct pinctrl_setting_mux *mux_setting;
 	const char *gpio_owner;
+	struct mutex mux_lock;
 #endif
 };
 
--- linux-qcom-6.8.0.orig/drivers/pinctrl/devicetree.c
+++ linux-qcom-6.8.0/drivers/pinctrl/devicetree.c
@@ -220,14 +220,16 @@
 	for (state = 0; ; state++) {
 		/* Retrieve the pinctrl-* property */
 		propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state);
-		if (!propname)
-			return -ENOMEM;
+		if (!propname) {
+			ret = -ENOMEM;
+			goto err;
+		}
 		prop = of_find_property(np, propname, &size);
 		kfree(propname);
 		if (!prop) {
 			if (state == 0) {
-				of_node_put(np);
-				return -ENODEV;
+				ret = -ENODEV;
+				goto err;
 			}
 			break;
 		}
--- linux-qcom-6.8.0.orig/drivers/pinctrl/freescale/Kconfig
+++ linux-qcom-6.8.0/drivers/pinctrl/freescale/Kconfig
@@ -9,7 +9,7 @@
 
 config PINCTRL_IMX_SCU
 	tristate
-	depends on IMX_SCU
+	depends on IMX_SCU || COMPILE_TEST
 	select PINCTRL_IMX
 
 config PINCTRL_IMX1_CORE
--- linux-qcom-6.8.0.orig/drivers/pinctrl/freescale/pinctrl-mxs.c
+++ linux-qcom-6.8.0/drivers/pinctrl/freescale/pinctrl-mxs.c
@@ -413,8 +413,8 @@
 	int ret;
 	u32 val;
 
-	child = of_get_next_child(np, NULL);
-	if (!child) {
+	val = of_get_child_count(np);
+	if (val == 0) {
 		dev_err(&pdev->dev, "no group is defined\n");
 		return -ENOENT;
 	}
--- linux-qcom-6.8.0.orig/drivers/pinctrl/intel/Kconfig
+++ linux-qcom-6.8.0/drivers/pinctrl/intel/Kconfig
@@ -46,6 +46,7 @@
 	  of Intel PCH pins and using them as GPIOs. Currently the following
 	  Intel SoCs / platforms require this to be functional:
 	  - Lunar Lake
+	  - Panther Lake
 
 config PINCTRL_ALDERLAKE
 	tristate "Intel Alder Lake pinctrl and GPIO driver"
--- linux-qcom-6.8.0.orig/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ linux-qcom-6.8.0/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -278,33 +278,33 @@
 static const unsigned int byt_score_smbus_pins[] = { 51, 52, 53 };
 
 static const struct intel_pingroup byt_score_groups[] = {
-	PIN_GROUP("uart1_grp", byt_score_uart1_pins, 1),
-	PIN_GROUP("uart2_grp", byt_score_uart2_pins, 1),
-	PIN_GROUP("pwm0_grp", byt_score_pwm0_pins, 1),
-	PIN_GROUP("pwm1_grp", byt_score_pwm1_pins, 1),
-	PIN_GROUP("ssp2_grp", byt_score_ssp2_pins, 1),
-	PIN_GROUP("sio_spi_grp", byt_score_sio_spi_pins, 1),
-	PIN_GROUP("i2c5_grp", byt_score_i2c5_pins, 1),
-	PIN_GROUP("i2c6_grp", byt_score_i2c6_pins, 1),
-	PIN_GROUP("i2c4_grp", byt_score_i2c4_pins, 1),
-	PIN_GROUP("i2c3_grp", byt_score_i2c3_pins, 1),
-	PIN_GROUP("i2c2_grp", byt_score_i2c2_pins, 1),
-	PIN_GROUP("i2c1_grp", byt_score_i2c1_pins, 1),
-	PIN_GROUP("i2c0_grp", byt_score_i2c0_pins, 1),
-	PIN_GROUP("ssp0_grp", byt_score_ssp0_pins, 1),
-	PIN_GROUP("ssp1_grp", byt_score_ssp1_pins, 1),
-	PIN_GROUP("sdcard_grp", byt_score_sdcard_pins, byt_score_sdcard_mux_values),
-	PIN_GROUP("sdio_grp", byt_score_sdio_pins, 1),
-	PIN_GROUP("emmc_grp", byt_score_emmc_pins, 1),
-	PIN_GROUP("lpc_grp", byt_score_ilb_lpc_pins, 1),
-	PIN_GROUP("sata_grp", byt_score_sata_pins, 1),
-	PIN_GROUP("plt_clk0_grp", byt_score_plt_clk0_pins, 1),
-	PIN_GROUP("plt_clk1_grp", byt_score_plt_clk1_pins, 1),
-	PIN_GROUP("plt_clk2_grp", byt_score_plt_clk2_pins, 1),
-	PIN_GROUP("plt_clk3_grp", byt_score_plt_clk3_pins, 1),
-	PIN_GROUP("plt_clk4_grp", byt_score_plt_clk4_pins, 1),
-	PIN_GROUP("plt_clk5_grp", byt_score_plt_clk5_pins, 1),
-	PIN_GROUP("smbus_grp", byt_score_smbus_pins, 1),
+	PIN_GROUP_GPIO("uart1_grp", byt_score_uart1_pins, 1),
+	PIN_GROUP_GPIO("uart2_grp", byt_score_uart2_pins, 1),
+	PIN_GROUP_GPIO("pwm0_grp", byt_score_pwm0_pins, 1),
+	PIN_GROUP_GPIO("pwm1_grp", byt_score_pwm1_pins, 1),
+	PIN_GROUP_GPIO("ssp2_grp", byt_score_ssp2_pins, 1),
+	PIN_GROUP_GPIO("sio_spi_grp", byt_score_sio_spi_pins, 1),
+	PIN_GROUP_GPIO("i2c5_grp", byt_score_i2c5_pins, 1),
+	PIN_GROUP_GPIO("i2c6_grp", byt_score_i2c6_pins, 1),
+	PIN_GROUP_GPIO("i2c4_grp", byt_score_i2c4_pins, 1),
+	PIN_GROUP_GPIO("i2c3_grp", byt_score_i2c3_pins, 1),
+	PIN_GROUP_GPIO("i2c2_grp", byt_score_i2c2_pins, 1),
+	PIN_GROUP_GPIO("i2c1_grp", byt_score_i2c1_pins, 1),
+	PIN_GROUP_GPIO("i2c0_grp", byt_score_i2c0_pins, 1),
+	PIN_GROUP_GPIO("ssp0_grp", byt_score_ssp0_pins, 1),
+	PIN_GROUP_GPIO("ssp1_grp", byt_score_ssp1_pins, 1),
+	PIN_GROUP_GPIO("sdcard_grp", byt_score_sdcard_pins, byt_score_sdcard_mux_values),
+	PIN_GROUP_GPIO("sdio_grp", byt_score_sdio_pins, 1),
+	PIN_GROUP_GPIO("emmc_grp", byt_score_emmc_pins, 1),
+	PIN_GROUP_GPIO("lpc_grp", byt_score_ilb_lpc_pins, 1),
+	PIN_GROUP_GPIO("sata_grp", byt_score_sata_pins, 1),
+	PIN_GROUP_GPIO("plt_clk0_grp", byt_score_plt_clk0_pins, 1),
+	PIN_GROUP_GPIO("plt_clk1_grp", byt_score_plt_clk1_pins, 1),
+	PIN_GROUP_GPIO("plt_clk2_grp", byt_score_plt_clk2_pins, 1),
+	PIN_GROUP_GPIO("plt_clk3_grp", byt_score_plt_clk3_pins, 1),
+	PIN_GROUP_GPIO("plt_clk4_grp", byt_score_plt_clk4_pins, 1),
+	PIN_GROUP_GPIO("plt_clk5_grp", byt_score_plt_clk5_pins, 1),
+	PIN_GROUP_GPIO("smbus_grp", byt_score_smbus_pins, 1),
 };
 
 static const char * const byt_score_uart_groups[] = {
@@ -332,12 +332,14 @@
 };
 static const char * const byt_score_smbus_groups[] = { "smbus_grp" };
 static const char * const byt_score_gpio_groups[] = {
-	"uart1_grp", "uart2_grp", "pwm0_grp", "pwm1_grp", "ssp0_grp",
-	"ssp1_grp", "ssp2_grp", "sio_spi_grp", "i2c0_grp", "i2c1_grp",
-	"i2c2_grp", "i2c3_grp", "i2c4_grp", "i2c5_grp", "i2c6_grp",
-	"sdcard_grp", "sdio_grp", "emmc_grp", "lpc_grp", "sata_grp",
-	"plt_clk0_grp", "plt_clk1_grp", "plt_clk2_grp", "plt_clk3_grp",
-	"plt_clk4_grp", "plt_clk5_grp", "smbus_grp",
+	"uart1_grp_gpio", "uart2_grp_gpio", "pwm0_grp_gpio",
+	"pwm1_grp_gpio", "ssp0_grp_gpio", "ssp1_grp_gpio", "ssp2_grp_gpio",
+	"sio_spi_grp_gpio", "i2c0_grp_gpio", "i2c1_grp_gpio", "i2c2_grp_gpio",
+	"i2c3_grp_gpio", "i2c4_grp_gpio", "i2c5_grp_gpio", "i2c6_grp_gpio",
+	"sdcard_grp_gpio", "sdio_grp_gpio", "emmc_grp_gpio", "lpc_grp_gpio",
+	"sata_grp_gpio", "plt_clk0_grp_gpio", "plt_clk1_grp_gpio",
+	"plt_clk2_grp_gpio", "plt_clk3_grp_gpio", "plt_clk4_grp_gpio",
+	"plt_clk5_grp_gpio", "smbus_grp_gpio",
 };
 
 static const struct intel_function byt_score_functions[] = {
@@ -456,8 +458,8 @@
 	PIN_GROUP("usb_oc_grp_gpio", byt_sus_usb_over_current_pins, byt_sus_usb_over_current_gpio_mode_values),
 	PIN_GROUP("usb_ulpi_grp_gpio", byt_sus_usb_ulpi_pins, byt_sus_usb_ulpi_gpio_mode_values),
 	PIN_GROUP("pcu_spi_grp_gpio", byt_sus_pcu_spi_pins, byt_sus_pcu_spi_gpio_mode_values),
-	PIN_GROUP("pmu_clk1_grp", byt_sus_pmu_clk1_pins, 1),
-	PIN_GROUP("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1),
+	PIN_GROUP_GPIO("pmu_clk1_grp", byt_sus_pmu_clk1_pins, 1),
+	PIN_GROUP_GPIO("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1),
 };
 
 static const char * const byt_sus_usb_groups[] = {
@@ -469,7 +471,7 @@
 };
 static const char * const byt_sus_gpio_groups[] = {
 	"usb_oc_grp_gpio", "usb_ulpi_grp_gpio", "pcu_spi_grp_gpio",
-	"pmu_clk1_grp", "pmu_clk2_grp",
+	"pmu_clk1_grp_gpio", "pmu_clk2_grp_gpio",
 };
 
 static const struct intel_function byt_sus_functions[] = {
--- linux-qcom-6.8.0.orig/drivers/pinctrl/intel/pinctrl-intel-platform.c
+++ linux-qcom-6.8.0/drivers/pinctrl/intel/pinctrl-intel-platform.c
@@ -90,7 +90,6 @@
 						    struct intel_community *community,
 						    struct intel_platform_pins *pins)
 {
-	struct fwnode_handle *child;
 	struct intel_padgroup *gpps;
 	unsigned int group;
 	size_t ngpps;
@@ -131,7 +130,7 @@
 		return -ENOMEM;
 
 	group = 0;
-	device_for_each_child_node(dev, child) {
+	device_for_each_child_node_scoped(dev, child) {
 		struct intel_padgroup *gpp = &gpps[group];
 
 		gpp->reg_num = group;
--- linux-qcom-6.8.0.orig/drivers/pinctrl/intel/pinctrl-intel.h
+++ linux-qcom-6.8.0/drivers/pinctrl/intel/pinctrl-intel.h
@@ -179,6 +179,10 @@
 		.modes = __builtin_choose_expr(__builtin_constant_p((m)), NULL, (m)),	\
 	}
 
+#define PIN_GROUP_GPIO(n, p, m)						\
+	 PIN_GROUP(n, p, m),						\
+	 PIN_GROUP(n "_gpio", p, 0)
+
 #define FUNCTION(n, g)							\
 	{								\
 		.func = PINCTRL_PINFUNCTION((n), (g), ARRAY_SIZE(g)),	\
--- linux-qcom-6.8.0.orig/drivers/pinctrl/intel/pinctrl-meteorlake.c
+++ linux-qcom-6.8.0/drivers/pinctrl/intel/pinctrl-meteorlake.c
@@ -584,6 +584,7 @@
 };
 
 static const struct acpi_device_id mtl_pinctrl_acpi_match[] = {
+	{ "INTC105E", (kernel_ulong_t)&mtlp_soc_data },
 	{ "INTC1083", (kernel_ulong_t)&mtlp_soc_data },
 	{ "INTC1082", (kernel_ulong_t)&mtls_soc_data },
 	{ }
--- linux-qcom-6.8.0.orig/drivers/pinctrl/mediatek/pinctrl-mt8186.c
+++ linux-qcom-6.8.0/drivers/pinctrl/mediatek/pinctrl-mt8186.c
@@ -1198,7 +1198,6 @@
 	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt8186_pin_dir_range),
 	[PINCTRL_PIN_REG_DI] = MTK_RANGE(mt8186_pin_di_range),
 	[PINCTRL_PIN_REG_DO] = MTK_RANGE(mt8186_pin_do_range),
-	[PINCTRL_PIN_REG_SR] = MTK_RANGE(mt8186_pin_dir_range),
 	[PINCTRL_PIN_REG_SMT] = MTK_RANGE(mt8186_pin_smt_range),
 	[PINCTRL_PIN_REG_IES] = MTK_RANGE(mt8186_pin_ies_range),
 	[PINCTRL_PIN_REG_PU] = MTK_RANGE(mt8186_pin_pu_range),
--- linux-qcom-6.8.0.orig/drivers/pinctrl/mediatek/pinctrl-mt8192.c
+++ linux-qcom-6.8.0/drivers/pinctrl/mediatek/pinctrl-mt8192.c
@@ -1379,7 +1379,6 @@
 	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt8192_pin_dir_range),
 	[PINCTRL_PIN_REG_DI] = MTK_RANGE(mt8192_pin_di_range),
 	[PINCTRL_PIN_REG_DO] = MTK_RANGE(mt8192_pin_do_range),
-	[PINCTRL_PIN_REG_SR] = MTK_RANGE(mt8192_pin_dir_range),
 	[PINCTRL_PIN_REG_SMT] = MTK_RANGE(mt8192_pin_smt_range),
 	[PINCTRL_PIN_REG_IES] = MTK_RANGE(mt8192_pin_ies_range),
 	[PINCTRL_PIN_REG_PU] = MTK_RANGE(mt8192_pin_pu_range),
--- linux-qcom-6.8.0.orig/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+++ linux-qcom-6.8.0/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
@@ -709,32 +709,35 @@
 {
 	int err, rsel_val;
 
-	if (!pullup && arg == MTK_DISABLE)
-		return 0;
-
 	if (hw->rsel_si_unit) {
 		/* find pin rsel_index from pin_rsel array*/
 		err = mtk_hw_pin_rsel_lookup(hw, desc, pullup, arg, &rsel_val);
 		if (err)
-			goto out;
+			return err;
 	} else {
-		if (arg < MTK_PULL_SET_RSEL_000 ||
-		    arg > MTK_PULL_SET_RSEL_111) {
-			err = -EINVAL;
-			goto out;
-		}
+		if (arg < MTK_PULL_SET_RSEL_000 || arg > MTK_PULL_SET_RSEL_111)
+			return -EINVAL;
 
 		rsel_val = arg - MTK_PULL_SET_RSEL_000;
 	}
 
-	err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_RSEL, rsel_val);
-	if (err)
-		goto out;
+	return mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_RSEL, rsel_val);
+}
 
-	err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, MTK_ENABLE);
+static int mtk_pinconf_bias_set_pu_pd_rsel(struct mtk_pinctrl *hw,
+					   const struct mtk_pin_desc *desc,
+					   u32 pullup, u32 arg)
+{
+	u32 enable = arg == MTK_DISABLE ? MTK_DISABLE : MTK_ENABLE;
+	int err;
 
-out:
-	return err;
+	if (arg != MTK_DISABLE) {
+		err = mtk_pinconf_bias_set_rsel(hw, desc, pullup, arg);
+		if (err)
+			return err;
+	}
+
+	return mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, enable);
 }
 
 int mtk_pinconf_bias_set_combo(struct mtk_pinctrl *hw,
@@ -750,22 +753,22 @@
 		try_all_type = MTK_PULL_TYPE_MASK;
 
 	if (try_all_type & MTK_PULL_RSEL_TYPE) {
-		err = mtk_pinconf_bias_set_rsel(hw, desc, pullup, arg);
+		err = mtk_pinconf_bias_set_pu_pd_rsel(hw, desc, pullup, arg);
 		if (!err)
-			return err;
+			return 0;
 	}
 
 	if (try_all_type & MTK_PULL_PU_PD_TYPE) {
 		err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, arg);
 		if (!err)
-			return err;
+			return 0;
 	}
 
 	if (try_all_type & MTK_PULL_PULLSEL_TYPE) {
 		err = mtk_pinconf_bias_set_pullsel_pullen(hw, desc,
 							  pullup, arg);
 		if (!err)
-			return err;
+			return 0;
 	}
 
 	if (try_all_type & MTK_PULL_PUPD_R1R0_TYPE)
@@ -803,9 +806,9 @@
 	return 0;
 }
 
-static int mtk_pinconf_bias_get_rsel(struct mtk_pinctrl *hw,
-				     const struct mtk_pin_desc *desc,
-				     u32 *pullup, u32 *enable)
+static int mtk_pinconf_bias_get_pu_pd_rsel(struct mtk_pinctrl *hw,
+					   const struct mtk_pin_desc *desc,
+					   u32 *pullup, u32 *enable)
 {
 	int pu, pd, rsel, err;
 
@@ -939,22 +942,22 @@
 		try_all_type = MTK_PULL_TYPE_MASK;
 
 	if (try_all_type & MTK_PULL_RSEL_TYPE) {
-		err = mtk_pinconf_bias_get_rsel(hw, desc, pullup, enable);
+		err = mtk_pinconf_bias_get_pu_pd_rsel(hw, desc, pullup, enable);
 		if (!err)
-			return err;
+			return 0;
 	}
 
 	if (try_all_type & MTK_PULL_PU_PD_TYPE) {
 		err = mtk_pinconf_bias_get_pu_pd(hw, desc, pullup, enable);
 		if (!err)
-			return err;
+			return 0;
 	}
 
 	if (try_all_type & MTK_PULL_PULLSEL_TYPE) {
 		err = mtk_pinconf_bias_get_pullsel_pullen(hw, desc,
 							  pullup, enable);
 		if (!err)
-			return err;
+			return 0;
 	}
 
 	if (try_all_type & MTK_PULL_PUPD_R1R0_TYPE)
--- linux-qcom-6.8.0.orig/drivers/pinctrl/mediatek/pinctrl-paris.c
+++ linux-qcom-6.8.0/drivers/pinctrl/mediatek/pinctrl-paris.c
@@ -165,20 +165,21 @@
 		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_SR, &ret);
 		break;
 	case PIN_CONFIG_INPUT_ENABLE:
-	case PIN_CONFIG_OUTPUT_ENABLE:
+		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_IES, &ret);
+		if (!ret)
+			err = -EINVAL;
+		break;
+	case PIN_CONFIG_OUTPUT:
 		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_DIR, &ret);
 		if (err)
 			break;
-		/*     CONFIG     Current direction return value
-		 * -------------  ----------------- ----------------------
-		 * OUTPUT_ENABLE       output       1 (= HW value)
-		 *                     input        0 (= HW value)
-		 * INPUT_ENABLE        output       0 (= reverse HW value)
-		 *                     input        1 (= reverse HW value)
-		 */
-		if (param == PIN_CONFIG_INPUT_ENABLE)
-			ret = !ret;
 
+		if (!ret) {
+			err = -EINVAL;
+			break;
+		}
+
+		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_DO, &ret);
 		break;
 	case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
 		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_DIR, &ret);
@@ -193,6 +194,8 @@
 		}
 
 		err = mtk_hw_get_value(hw, desc, PINCTRL_PIN_REG_SMT, &ret);
+		if (!ret)
+			err = -EINVAL;
 		break;
 	case PIN_CONFIG_DRIVE_STRENGTH:
 		if (!hw->soc->drive_get)
@@ -281,26 +284,9 @@
 			break;
 		err = hw->soc->bias_set_combo(hw, desc, 0, arg);
 		break;
-	case PIN_CONFIG_OUTPUT_ENABLE:
-		err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_SMT,
-				       MTK_DISABLE);
-		/* Keep set direction to consider the case that a GPIO pin
-		 *  does not have SMT control
-		 */
-		if (err != -ENOTSUPP)
-			break;
-
-		err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_DIR,
-				       MTK_OUTPUT);
-		break;
 	case PIN_CONFIG_INPUT_ENABLE:
 		/* regard all non-zero value as enable */
 		err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_IES, !!arg);
-		if (err)
-			break;
-
-		err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_DIR,
-				       MTK_INPUT);
 		break;
 	case PIN_CONFIG_SLEW_RATE:
 		/* regard all non-zero value as enable */
--- linux-qcom-6.8.0.orig/drivers/pinctrl/meson/pinctrl-meson-a1.c
+++ linux-qcom-6.8.0/drivers/pinctrl/meson/pinctrl-meson-a1.c
@@ -250,7 +250,7 @@
 static const unsigned int pdm_din2_a_pins[]		= { GPIOA_6 };
 static const unsigned int pdm_din1_a_pins[]		= { GPIOA_7 };
 static const unsigned int pdm_din0_a_pins[]		= { GPIOA_8 };
-static const unsigned int pdm_dclk_pins[]		= { GPIOA_9 };
+static const unsigned int pdm_dclk_a_pins[]		= { GPIOA_9 };
 
 /* gen_clk */
 static const unsigned int gen_clk_x_pins[]		= { GPIOX_7 };
@@ -591,7 +591,7 @@
 	GROUP(pdm_din2_a,		3),
 	GROUP(pdm_din1_a,		3),
 	GROUP(pdm_din0_a,		3),
-	GROUP(pdm_dclk,			3),
+	GROUP(pdm_dclk_a,		3),
 	GROUP(pwm_c_a,			3),
 	GROUP(pwm_b_a,			3),
 
@@ -755,7 +755,7 @@
 
 static const char * const pdm_groups[] = {
 	"pdm_din0_x", "pdm_din1_x", "pdm_din2_x", "pdm_dclk_x", "pdm_din2_a",
-	"pdm_din1_a", "pdm_din0_a", "pdm_dclk",
+	"pdm_din1_a", "pdm_din0_a", "pdm_dclk_a",
 };
 
 static const char * const gen_clk_groups[] = {
--- linux-qcom-6.8.0.orig/drivers/pinctrl/mvebu/pinctrl-dove.c
+++ linux-qcom-6.8.0/drivers/pinctrl/mvebu/pinctrl-dove.c
@@ -767,7 +767,7 @@
 	struct resource fb_res;
 	struct mvebu_mpp_ctrl_data *mpp_data;
 	void __iomem *base;
-	int i;
+	int i, ret;
 
 	pdev->dev.platform_data = (void *)device_get_match_data(&pdev->dev);
 
@@ -783,13 +783,17 @@
 	clk_prepare_enable(clk);
 
 	base = devm_platform_get_and_ioremap_resource(pdev, 0, &mpp_res);
-	if (IS_ERR(base))
-		return PTR_ERR(base);
+	if (IS_ERR(base)) {
+		ret = PTR_ERR(base);
+		goto err_probe;
+	}
 
 	mpp_data = devm_kcalloc(&pdev->dev, dove_pinctrl_info.ncontrols,
 				sizeof(*mpp_data), GFP_KERNEL);
-	if (!mpp_data)
-		return -ENOMEM;
+	if (!mpp_data) {
+		ret = -ENOMEM;
+		goto err_probe;
+	}
 
 	dove_pinctrl_info.control_data = mpp_data;
 	for (i = 0; i < ARRAY_SIZE(dove_mpp_controls); i++)
@@ -808,8 +812,10 @@
 	}
 
 	mpp4_base = devm_ioremap_resource(&pdev->dev, res);
-	if (IS_ERR(mpp4_base))
-		return PTR_ERR(mpp4_base);
+	if (IS_ERR(mpp4_base)) {
+		ret = PTR_ERR(mpp4_base);
+		goto err_probe;
+	}
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
 	if (!res) {
@@ -820,8 +826,10 @@
 	}
 
 	pmu_base = devm_ioremap_resource(&pdev->dev, res);
-	if (IS_ERR(pmu_base))
-		return PTR_ERR(pmu_base);
+	if (IS_ERR(pmu_base)) {
+		ret = PTR_ERR(pmu_base);
+		goto err_probe;
+	}
 
 	gconfmap = syscon_regmap_lookup_by_compatible("marvell,dove-global-config");
 	if (IS_ERR(gconfmap)) {
@@ -831,12 +839,17 @@
 		adjust_resource(&fb_res,
 			(mpp_res->start & INT_REGS_MASK) + GC_REGS_OFFS, 0x14);
 		gc_base = devm_ioremap_resource(&pdev->dev, &fb_res);
-		if (IS_ERR(gc_base))
-			return PTR_ERR(gc_base);
+		if (IS_ERR(gc_base)) {
+			ret = PTR_ERR(gc_base);
+			goto err_probe;
+		}
+
 		gconfmap = devm_regmap_init_mmio(&pdev->dev,
 						 gc_base, &gc_regmap_config);
-		if (IS_ERR(gconfmap))
-			return PTR_ERR(gconfmap);
+		if (IS_ERR(gconfmap)) {
+			ret = PTR_ERR(gconfmap);
+			goto err_probe;
+		}
 	}
 
 	/* Warn on any missing DT resource */
@@ -844,6 +857,9 @@
 		dev_warn(&pdev->dev, FW_BUG "Missing pinctrl regs in DTB. Please update your firmware.\n");
 
 	return mvebu_pinctrl_probe(pdev);
+err_probe:
+	clk_disable_unprepare(clk);
+	return ret;
 }
 
 static struct platform_driver dove_pinctrl_driver = {
--- linux-qcom-6.8.0.orig/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+++ linux-qcom-6.8.0/drivers/pinctrl/nomadik/pinctrl-nomadik.c
@@ -1579,8 +1579,10 @@
 		 * Then mask the pins that need to be sleeping now when we're
 		 * switching to the ALT C function.
 		 */
-		for (i = 0; i < g->grp.npins; i++)
-			slpm[g->grp.pins[i] / NMK_GPIO_PER_CHIP] &= ~BIT(g->grp.pins[i]);
+		for (i = 0; i < g->grp.npins; i++) {
+			unsigned int bit = g->grp.pins[i] % NMK_GPIO_PER_CHIP;
+			slpm[g->grp.pins[i] / NMK_GPIO_PER_CHIP] &= ~BIT(bit);
+		}
 		nmk_gpio_glitch_slpm_init(slpm);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-amd.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-amd.c
@@ -1159,7 +1159,7 @@
 	}
 
 	ret = devm_request_irq(&pdev->dev, gpio_dev->irq, amd_gpio_irq_handler,
-			       IRQF_SHARED | IRQF_ONESHOT, KBUILD_MODNAME, gpio_dev);
+			       IRQF_SHARED | IRQF_COND_ONESHOT, KBUILD_MODNAME, gpio_dev);
 	if (ret)
 		goto out2;
 
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-apple-gpio.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-apple-gpio.c
@@ -474,6 +474,9 @@
 	for (i = 0; i < npins; i++) {
 		pins[i].number = i;
 		pins[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "PIN%u", i);
+		if (!pins[i].name)
+			return -ENOMEM;
+
 		pins[i].drv_data = pctl;
 		pin_names[i] = pins[i].name;
 		pin_nums[i] = i;
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-at91.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-at91.c
@@ -1409,8 +1409,11 @@
 
 	/* We will handle a range of GPIO pins */
 	for (i = 0; i < gpio_banks; i++)
-		if (gpio_chips[i])
+		if (gpio_chips[i]) {
 			pinctrl_add_gpio_range(info->pctl, &gpio_chips[i]->range);
+			gpiochip_add_pin_range(&gpio_chips[i]->chip, dev_name(info->pctl->dev), 0,
+				gpio_chips[i]->range.pin_base, gpio_chips[i]->range.npins);
+		}
 
 	dev_info(dev, "initialized AT91 pinctrl driver\n");
 
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-k210.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-k210.c
@@ -183,7 +183,7 @@
 	[K210_PC_DEFAULT_INT13] = K210_PC_MODE_IN | K210_PC_PU,
 };
 
-#undef DEFAULT
+#undef K210_PC_DEFAULT
 
 /*
  * Pin functions configuration information.
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-mcp23s08.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -86,6 +86,7 @@
 	.num_reg_defaults = ARRAY_SIZE(mcp23x08_defaults),
 	.cache_type = REGCACHE_FLAT,
 	.max_register = MCP_OLAT,
+	.disable_locking = true, /* mcp->lock protects the regmap */
 };
 EXPORT_SYMBOL_GPL(mcp23x08_regmap);
 
@@ -132,6 +133,7 @@
 	.num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults),
 	.cache_type = REGCACHE_FLAT,
 	.val_format_endian = REGMAP_ENDIAN_LITTLE,
+	.disable_locking = true, /* mcp->lock protects the regmap */
 };
 EXPORT_SYMBOL_GPL(mcp23x17_regmap);
 
@@ -228,7 +230,9 @@
 
 	switch (param) {
 	case PIN_CONFIG_BIAS_PULL_UP:
+		mutex_lock(&mcp->lock);
 		ret = mcp_read(mcp, MCP_GPPU, &data);
+		mutex_unlock(&mcp->lock);
 		if (ret < 0)
 			return ret;
 		status = (data & BIT(pin)) ? 1 : 0;
@@ -257,7 +261,9 @@
 
 		switch (param) {
 		case PIN_CONFIG_BIAS_PULL_UP:
+			mutex_lock(&mcp->lock);
 			ret = mcp_set_bit(mcp, MCP_GPPU, pin, arg);
+			mutex_unlock(&mcp->lock);
 			break;
 		default:
 			dev_dbg(mcp->dev, "Invalid config param %04x\n", param);
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-ocelot.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-ocelot.c
@@ -1956,21 +1956,21 @@
 	unsigned int reg = 0, irq, i;
 	unsigned long irqs;
 
+	chained_irq_enter(parent_chip, desc);
+
 	for (i = 0; i < info->stride; i++) {
 		regmap_read(info->map, id_reg + 4 * i, &reg);
 		if (!reg)
 			continue;
 
-		chained_irq_enter(parent_chip, desc);
-
 		irqs = reg;
 
 		for_each_set_bit(irq, &irqs,
 				 min(32U, info->desc->npins - 32 * i))
 			generic_handle_domain_irq(chip->irq.domain, irq + 32 * i);
-
-		chained_irq_exit(parent_chip, desc);
 	}
+
+	chained_irq_exit(parent_chip, desc);
 }
 
 static int ocelot_gpiochip_register(struct platform_device *pdev,
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-rockchip.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-rockchip.c
@@ -634,23 +634,68 @@
 
 static struct rockchip_mux_recalced_data rk3328_mux_recalced_data[] = {
 	{
-		.num = 2,
-		.pin = 12,
-		.reg = 0x24,
-		.bit = 8,
-		.mask = 0x3
-	}, {
+		/* gpio2_b7_sel */
 		.num = 2,
 		.pin = 15,
 		.reg = 0x28,
 		.bit = 0,
 		.mask = 0x7
 	}, {
+		/* gpio2_c7_sel */
 		.num = 2,
 		.pin = 23,
 		.reg = 0x30,
 		.bit = 14,
 		.mask = 0x3
+	}, {
+		/* gpio3_b1_sel */
+		.num = 3,
+		.pin = 9,
+		.reg = 0x44,
+		.bit = 2,
+		.mask = 0x3
+	}, {
+		/* gpio3_b2_sel */
+		.num = 3,
+		.pin = 10,
+		.reg = 0x44,
+		.bit = 4,
+		.mask = 0x3
+	}, {
+		/* gpio3_b3_sel */
+		.num = 3,
+		.pin = 11,
+		.reg = 0x44,
+		.bit = 6,
+		.mask = 0x3
+	}, {
+		/* gpio3_b4_sel */
+		.num = 3,
+		.pin = 12,
+		.reg = 0x44,
+		.bit = 8,
+		.mask = 0x3
+	}, {
+		/* gpio3_b5_sel */
+		.num = 3,
+		.pin = 13,
+		.reg = 0x44,
+		.bit = 10,
+		.mask = 0x3
+	}, {
+		/* gpio3_b6_sel */
+		.num = 3,
+		.pin = 14,
+		.reg = 0x44,
+		.bit = 12,
+		.mask = 0x3
+	}, {
+		/* gpio3_b7_sel */
+		.num = 3,
+		.pin = 15,
+		.reg = 0x44,
+		.bit = 14,
+		.mask = 0x3
 	},
 };
 
@@ -870,9 +915,8 @@
 	RK_MUXROUTE_SAME(0, RK_PC3, 1, 0x314, BIT(16 + 0) | BIT(0)), /* rtc_clk */
 	RK_MUXROUTE_SAME(1, RK_PC6, 2, 0x314, BIT(16 + 2) | BIT(16 + 3)), /* uart2_rxm0 */
 	RK_MUXROUTE_SAME(4, RK_PD2, 2, 0x314, BIT(16 + 2) | BIT(16 + 3) | BIT(2)), /* uart2_rxm1 */
-	RK_MUXROUTE_SAME(0, RK_PB7, 2, 0x608, BIT(16 + 8) | BIT(16 + 9)), /* i2c3_sdam0 */
-	RK_MUXROUTE_SAME(3, RK_PB4, 2, 0x608, BIT(16 + 8) | BIT(16 + 9) | BIT(8)), /* i2c3_sdam1 */
-	RK_MUXROUTE_SAME(2, RK_PA0, 3, 0x608, BIT(16 + 8) | BIT(16 + 9) | BIT(9)), /* i2c3_sdam2 */
+	RK_MUXROUTE_SAME(0, RK_PB7, 2, 0x314, BIT(16 + 4)), /* i2c3_sdam0 */
+	RK_MUXROUTE_SAME(3, RK_PB4, 2, 0x314, BIT(16 + 4) | BIT(4)), /* i2c3_sdam1 */
 	RK_MUXROUTE_SAME(1, RK_PA3, 2, 0x308, BIT(16 + 3)), /* i2s-8ch-1-sclktxm0 */
 	RK_MUXROUTE_SAME(1, RK_PA4, 2, 0x308, BIT(16 + 3)), /* i2s-8ch-1-sclkrxm0 */
 	RK_MUXROUTE_SAME(1, RK_PB5, 2, 0x308, BIT(16 + 3) | BIT(3)), /* i2s-8ch-1-sclktxm1 */
@@ -881,18 +925,6 @@
 	RK_MUXROUTE_SAME(1, RK_PB6, 4, 0x308, BIT(16 + 12) | BIT(16 + 13) | BIT(12)), /* pdm-clkm1 */
 	RK_MUXROUTE_SAME(2, RK_PA6, 2, 0x308, BIT(16 + 12) | BIT(16 + 13) | BIT(13)), /* pdm-clkm2 */
 	RK_MUXROUTE_SAME(2, RK_PA4, 3, 0x600, BIT(16 + 2) | BIT(2)), /* pdm-clkm-m2 */
-	RK_MUXROUTE_SAME(3, RK_PB2, 3, 0x314, BIT(16 + 9)), /* spi1_miso */
-	RK_MUXROUTE_SAME(2, RK_PA4, 2, 0x314, BIT(16 + 9) | BIT(9)), /* spi1_miso_m1 */
-	RK_MUXROUTE_SAME(0, RK_PB3, 3, 0x314, BIT(16 + 10) | BIT(16 + 11)), /* owire_m0 */
-	RK_MUXROUTE_SAME(1, RK_PC6, 7, 0x314, BIT(16 + 10) | BIT(16 + 11) | BIT(10)), /* owire_m1 */
-	RK_MUXROUTE_SAME(2, RK_PA2, 5, 0x314, BIT(16 + 10) | BIT(16 + 11) | BIT(11)), /* owire_m2 */
-	RK_MUXROUTE_SAME(0, RK_PB3, 2, 0x314, BIT(16 + 12) | BIT(16 + 13)), /* can_rxd_m0 */
-	RK_MUXROUTE_SAME(1, RK_PC6, 5, 0x314, BIT(16 + 12) | BIT(16 + 13) | BIT(12)), /* can_rxd_m1 */
-	RK_MUXROUTE_SAME(2, RK_PA2, 4, 0x314, BIT(16 + 12) | BIT(16 + 13) | BIT(13)), /* can_rxd_m2 */
-	RK_MUXROUTE_SAME(1, RK_PC4, 3, 0x314, BIT(16 + 14)), /* mac_rxd0_m0 */
-	RK_MUXROUTE_SAME(4, RK_PA2, 2, 0x314, BIT(16 + 14) | BIT(14)), /* mac_rxd0_m1 */
-	RK_MUXROUTE_SAME(3, RK_PB4, 4, 0x314, BIT(16 + 15)), /* uart3_rx */
-	RK_MUXROUTE_SAME(0, RK_PC1, 3, 0x314, BIT(16 + 15) | BIT(15)), /* uart3_rx_m1 */
 };
 
 static struct rockchip_mux_route_data rk3328_mux_route_data[] = {
@@ -2433,6 +2465,7 @@
 	case RK3188:
 	case RK3288:
 	case RK3308:
+	case RK3328:
 	case RK3368:
 	case RK3399:
 	case RK3568:
@@ -2491,6 +2524,7 @@
 	case RK3188:
 	case RK3288:
 	case RK3308:
+	case RK3328:
 	case RK3368:
 	case RK3399:
 	case RK3568:
@@ -2704,8 +2738,10 @@
 
 	if (ret) {
 		/* revert the already done pin settings */
-		for (cnt--; cnt >= 0; cnt--)
+		for (cnt--; cnt >= 0; cnt--) {
+			bank = pin_to_bank(info, pins[cnt]);
 			rockchip_set_mux(bank, pins[cnt] - bank->pin_base, 0);
+		}
 
 		return ret;
 	}
@@ -2753,6 +2789,7 @@
 	case RK3188:
 	case RK3288:
 	case RK3308:
+	case RK3328:
 	case RK3368:
 	case RK3399:
 	case RK3568:
@@ -3763,7 +3800,7 @@
 	PIN_BANK_IOMUX_FLAGS(0, 32, "gpio0", 0, 0, 0, 0),
 	PIN_BANK_IOMUX_FLAGS(1, 32, "gpio1", 0, 0, 0, 0),
 	PIN_BANK_IOMUX_FLAGS(2, 32, "gpio2", 0,
-			     IOMUX_WIDTH_3BIT,
+			     IOMUX_WIDTH_2BIT,
 			     IOMUX_WIDTH_3BIT,
 			     0),
 	PIN_BANK_IOMUX_FLAGS(3, 32, "gpio3",
@@ -3777,7 +3814,7 @@
 		.pin_banks		= rk3328_pin_banks,
 		.nr_banks		= ARRAY_SIZE(rk3328_pin_banks),
 		.label			= "RK3328-GPIO",
-		.type			= RK3288,
+		.type			= RK3328,
 		.grf_mux_offset		= 0x0,
 		.iomux_recalced		= rk3328_mux_recalced_data,
 		.niomux_recalced	= ARRAY_SIZE(rk3328_mux_recalced_data),
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-rockchip.h
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-rockchip.h
@@ -193,6 +193,7 @@
 	RK3188,
 	RK3288,
 	RK3308,
+	RK3328,
 	RK3368,
 	RK3399,
 	RK3568,
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-single.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-single.c
@@ -349,6 +349,8 @@
 		return -ENOTSUPP;
 	fselector = setting->func;
 	function = pinmux_generic_get_function(pctldev, fselector);
+	if (!function)
+		return -EINVAL;
 	*func = function->data;
 	if (!(*func)) {
 		dev_err(pcs->dev, "%s could not find function%i\n",
@@ -1327,7 +1329,6 @@
 static void pcs_free_resources(struct pcs_device *pcs)
 {
 	pcs_irq_free(pcs);
-	pinctrl_unregister(pcs->pctl);
 
 #if IS_BUILTIN(CONFIG_PINCTRL_SINGLE)
 	if (pcs->missing_nr_pinctrl_cells)
@@ -1884,7 +1885,7 @@
 	if (ret < 0)
 		goto free;
 
-	ret = pinctrl_register_and_init(&pcs->desc, pcs->dev, pcs, &pcs->pctl);
+	ret = devm_pinctrl_register_and_init(pcs->dev, &pcs->desc, pcs, &pcs->pctl);
 	if (ret) {
 		dev_err(pcs->dev, "could not register single pinctrl driver\n");
 		goto free;
@@ -1917,8 +1918,11 @@
 
 	dev_info(pcs->dev, "%i pins, size %u\n", pcs->desc.npins, pcs->size);
 
-	return pinctrl_enable(pcs->pctl);
+	ret = pinctrl_enable(pcs->pctl);
+	if (ret)
+		goto free;
 
+	return 0;
 free:
 	pcs_free_resources(pcs);
 
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinctrl-zynqmp.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinctrl-zynqmp.c
@@ -48,7 +48,6 @@
  * @name:	Name of the pin mux function
  * @groups:	List of pin groups for this function
  * @ngroups:	Number of entries in @groups
- * @node:	Firmware node matching with the function
  *
  * This structure holds information about pin control function
  * and function group names supporting that function.
--- linux-qcom-6.8.0.orig/drivers/pinctrl/pinmux.c
+++ linux-qcom-6.8.0/drivers/pinctrl/pinmux.c
@@ -14,6 +14,7 @@
 
 #include <linux/array_size.h>
 #include <linux/ctype.h>
+#include <linux/cleanup.h>
 #include <linux/debugfs.h>
 #include <linux/device.h>
 #include <linux/err.h>
@@ -93,6 +94,7 @@
 	if (!desc || !ops)
 		return true;
 
+	guard(mutex)(&desc->mux_lock);
 	if (ops->strict && desc->mux_usecount)
 		return false;
 
@@ -127,29 +129,31 @@
 	dev_dbg(pctldev->dev, "request pin %d (%s) for %s\n",
 		pin, desc->name, owner);
 
-	if ((!gpio_range || ops->strict) &&
-	    desc->mux_usecount && strcmp(desc->mux_owner, owner)) {
-		dev_err(pctldev->dev,
-			"pin %s already requested by %s; cannot claim for %s\n",
-			desc->name, desc->mux_owner, owner);
-		goto out;
-	}
+	scoped_guard(mutex, &desc->mux_lock) {
+		if ((!gpio_range || ops->strict) &&
+		    desc->mux_usecount && strcmp(desc->mux_owner, owner)) {
+			dev_err(pctldev->dev,
+				"pin %s already requested by %s; cannot claim for %s\n",
+				desc->name, desc->mux_owner, owner);
+			goto out;
+		}
 
-	if ((gpio_range || ops->strict) && desc->gpio_owner) {
-		dev_err(pctldev->dev,
-			"pin %s already requested by %s; cannot claim for %s\n",
-			desc->name, desc->gpio_owner, owner);
-		goto out;
-	}
+		if ((gpio_range || ops->strict) && desc->gpio_owner) {
+			dev_err(pctldev->dev,
+				"pin %s already requested by %s; cannot claim for %s\n",
+				desc->name, desc->gpio_owner, owner);
+			goto out;
+		}
 
-	if (gpio_range) {
-		desc->gpio_owner = owner;
-	} else {
-		desc->mux_usecount++;
-		if (desc->mux_usecount > 1)
-			return 0;
+		if (gpio_range) {
+			desc->gpio_owner = owner;
+		} else {
+			desc->mux_usecount++;
+			if (desc->mux_usecount > 1)
+				return 0;
 
-		desc->mux_owner = owner;
+			desc->mux_owner = owner;
+		}
 	}
 
 	/* Let each pin increase references to this module */
@@ -178,12 +182,14 @@
 
 out_free_pin:
 	if (status) {
-		if (gpio_range) {
-			desc->gpio_owner = NULL;
-		} else {
-			desc->mux_usecount--;
-			if (!desc->mux_usecount)
-				desc->mux_owner = NULL;
+		scoped_guard(mutex, &desc->mux_lock) {
+			if (gpio_range) {
+				desc->gpio_owner = NULL;
+			} else {
+				desc->mux_usecount--;
+				if (!desc->mux_usecount)
+					desc->mux_owner = NULL;
+			}
 		}
 	}
 out:
@@ -219,15 +225,17 @@
 		return NULL;
 	}
 
-	if (!gpio_range) {
-		/*
-		 * A pin should not be freed more times than allocated.
-		 */
-		if (WARN_ON(!desc->mux_usecount))
-			return NULL;
-		desc->mux_usecount--;
-		if (desc->mux_usecount)
-			return NULL;
+	scoped_guard(mutex, &desc->mux_lock) {
+		if (!gpio_range) {
+			/*
+			 * A pin should not be freed more times than allocated.
+			 */
+			if (WARN_ON(!desc->mux_usecount))
+				return NULL;
+			desc->mux_usecount--;
+			if (desc->mux_usecount)
+				return NULL;
+		}
 	}
 
 	/*
@@ -239,13 +247,15 @@
 	else if (ops->free)
 		ops->free(pctldev, pin);
 
-	if (gpio_range) {
-		owner = desc->gpio_owner;
-		desc->gpio_owner = NULL;
-	} else {
-		owner = desc->mux_owner;
-		desc->mux_owner = NULL;
-		desc->mux_setting = NULL;
+	scoped_guard(mutex, &desc->mux_lock) {
+		if (gpio_range) {
+			owner = desc->gpio_owner;
+			desc->gpio_owner = NULL;
+		} else {
+			owner = desc->mux_owner;
+			desc->mux_owner = NULL;
+			desc->mux_setting = NULL;
+		}
 	}
 
 	module_put(pctldev->owner);
@@ -459,7 +469,8 @@
 				 pins[i]);
 			continue;
 		}
-		desc->mux_setting = &(setting->data.mux);
+		scoped_guard(mutex, &desc->mux_lock)
+			desc->mux_setting = &(setting->data.mux);
 	}
 
 	ret = ops->set_mux(pctldev, setting->data.mux.func,
@@ -473,8 +484,10 @@
 err_set_mux:
 	for (i = 0; i < num_pins; i++) {
 		desc = pin_desc_get(pctldev, pins[i]);
-		if (desc)
-			desc->mux_setting = NULL;
+		if (desc) {
+			scoped_guard(mutex, &desc->mux_lock)
+				desc->mux_setting = NULL;
+		}
 	}
 err_pin_request:
 	/* On error release all taken pins */
@@ -493,6 +506,7 @@
 	unsigned int num_pins = 0;
 	int i;
 	struct pin_desc *desc;
+	bool is_equal;
 
 	if (pctlops->get_group_pins)
 		ret = pctlops->get_group_pins(pctldev, setting->data.mux.group,
@@ -518,7 +532,10 @@
 				 pins[i]);
 			continue;
 		}
-		if (desc->mux_setting == &(setting->data.mux)) {
+		scoped_guard(mutex, &desc->mux_lock)
+			is_equal = (desc->mux_setting == &(setting->data.mux));
+
+		if (is_equal) {
 			pin_free(pctldev, pins[i], NULL);
 		} else {
 			const char *gname;
@@ -610,40 +627,42 @@
 		if (desc == NULL)
 			continue;
 
-		if (desc->mux_owner &&
-		    !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev)))
-			is_hog = true;
-
-		if (pmxops->strict) {
-			if (desc->mux_owner)
-				seq_printf(s, "pin %d (%s): device %s%s",
-					   pin, desc->name, desc->mux_owner,
+		scoped_guard(mutex, &desc->mux_lock) {
+			if (desc->mux_owner &&
+			    !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev)))
+				is_hog = true;
+
+			if (pmxops->strict) {
+				if (desc->mux_owner)
+					seq_printf(s, "pin %d (%s): device %s%s",
+						   pin, desc->name, desc->mux_owner,
+						   is_hog ? " (HOG)" : "");
+				else if (desc->gpio_owner)
+					seq_printf(s, "pin %d (%s): GPIO %s",
+						   pin, desc->name, desc->gpio_owner);
+				else
+					seq_printf(s, "pin %d (%s): UNCLAIMED",
+						   pin, desc->name);
+			} else {
+				/* For non-strict controllers */
+				seq_printf(s, "pin %d (%s): %s %s%s", pin, desc->name,
+					   desc->mux_owner ? desc->mux_owner
+					   : "(MUX UNCLAIMED)",
+					   desc->gpio_owner ? desc->gpio_owner
+					   : "(GPIO UNCLAIMED)",
 					   is_hog ? " (HOG)" : "");
-			else if (desc->gpio_owner)
-				seq_printf(s, "pin %d (%s): GPIO %s",
-					   pin, desc->name, desc->gpio_owner);
+			}
+
+			/* If mux: print function+group claiming the pin */
+			if (desc->mux_setting)
+				seq_printf(s, " function %s group %s\n",
+					   pmxops->get_function_name(pctldev,
+						desc->mux_setting->func),
+					   pctlops->get_group_name(pctldev,
+						desc->mux_setting->group));
 			else
-				seq_printf(s, "pin %d (%s): UNCLAIMED",
-					   pin, desc->name);
-		} else {
-			/* For non-strict controllers */
-			seq_printf(s, "pin %d (%s): %s %s%s", pin, desc->name,
-				   desc->mux_owner ? desc->mux_owner
-				   : "(MUX UNCLAIMED)",
-				   desc->gpio_owner ? desc->gpio_owner
-				   : "(GPIO UNCLAIMED)",
-				   is_hog ? " (HOG)" : "");
-		}
-
-		/* If mux: print function+group claiming the pin */
-		if (desc->mux_setting)
-			seq_printf(s, " function %s group %s\n",
-				   pmxops->get_function_name(pctldev,
-					desc->mux_setting->func),
-				   pctlops->get_group_name(pctldev,
-					desc->mux_setting->group));
-		else
-			seq_putc(s, '\n');
+				seq_putc(s, '\n');
+		}
 	}
 
 	mutex_unlock(&pctldev->mutex);
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/Kconfig
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/Kconfig
@@ -59,6 +59,16 @@
 	  Qualcomm Technologies Inc LPASS (Low Power Audio SubSystem) LPI
 	  (Low Power Island) found on the Qualcomm Technologies Inc SoCs.
 
+config PINCTRL_QCS8300_LPASS_LPI
+	tristate "Qualcomm Technologies Inc QCS8300 LPASS LPI pin controller driver"
+	depends on ARM64 || COMPILE_TEST
+	depends on PINCTRL_LPASS_LPI
+	help
+	  This is the pinctrl, pinmux, pinconf and gpiolib driver for the
+	  Qualcomm Technologies Inc LPASS (Low Power Audio SubSystem) LPI
+	  (Low Power Island) found on the Qualcomm Technologies Inc QCS8300
+	  platform.
+
 config PINCTRL_SC7280_LPASS_LPI
 	tristate "Qualcomm Technologies Inc SC7280 LPASS LPI pin controller driver"
 	depends on ARM64 || COMPILE_TEST
@@ -125,7 +135,7 @@
 	  platform.
 
 config PINCTRL_SM8650_LPASS_LPI
-	tristate "Qualcomm Technologies Inc SM8550 LPASS LPI pin controller driver"
+	tristate "Qualcomm Technologies Inc SM8650 LPASS LPI pin controller driver"
 	depends on ARM64 || COMPILE_TEST
 	depends on PINCTRL_LPASS_LPI
 	help
@@ -134,4 +144,14 @@
 	  (Low Power Island) found on the Qualcomm Technologies Inc SM8650
 	  platform.
 
+config PINCTRL_SA8775P_LPASS_LPI
+	tristate "Qualcomm Technologies Inc SA8775P LPASS LPI pin controller driver"
+	depends on ARM64 || COMPILE_TEST
+	depends on PINCTRL_LPASS_LPI
+	help
+	  This is the pinctrl, pinmux, pinconf and gpiolib driver for the
+	  Qualcomm Technologies Inc LPASS (Low Power Audio SubSystem) LPI
+	  (Low Power Island) found on the Qualcomm Technologies Inc SA8775P
+	  platform.
+
 endif
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/Kconfig.msm
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/Kconfig.msm
@@ -182,6 +182,20 @@
 	  This is the pinctrl, pinmux, pinconf and gpiolib driver for the
 	  TLMM block found in the Qualcomm QCS404 platform.
 
+config PINCTRL_QCS615
+	tristate "Qualcomm Technologies QCS615 pin controller driver"
+	depends on ARM64 || COMPILE_TEST
+	help
+	  This is the pinctrl, pinmux, pinconf and gpiolib driver for the
+	  TLMM block found on the Qualcomm QCS615 platform.
+
+config PINCTRL_QCS8300
+	tristate "Qualcomm Technologies QCS8300 pin controller driver"
+	depends on ARM64 || COMPILE_TEST
+	help
+	  This is the pinctrl, pinmux and pinconf driver for the Qualcomm
+	  TLMM block found on the Qualcomm QCS8300 platform.
+
 config PINCTRL_QDF2XXX
 	tristate "Qualcomm Technologies QDF2xxx pin controller driver"
 	depends on ACPI
@@ -197,6 +211,14 @@
 	  Qualcomm Technologies Inc TLMM block found on the Qualcomm
 	  Technologies Inc QDU1000 and QRU1000 platforms.
 
+config PINCTRL_SA7255P
+	tristate "Qualcomm Technologies Inc SA7255P pin controller driver"
+	depends on ARM64 || COMPILE_TEST
+	help
+	  This is the pinctrl, pinmux and pinconf driver for the Qualcomm
+	  Technologies Inc TLMM block found on the Qualcom TLMM block
+	  found on the Qualcomm SA7255P platforms.
+
 config PINCTRL_SA8775P
 	tristate "Qualcomm Technologies Inc SA8775P pin controller driver"
 	depends on ARM64 || COMPILE_TEST
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/Makefile
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/Makefile
@@ -23,6 +23,9 @@
 obj-$(CONFIG_PINCTRL_MSM8998)   += pinctrl-msm8998.o
 obj-$(CONFIG_PINCTRL_QCM2290)	+= pinctrl-qcm2290.o
 obj-$(CONFIG_PINCTRL_QCS404)	+= pinctrl-qcs404.o
+obj-$(CONFIG_PINCTRL_QCS615)    += pinctrl-qcs615.o
+obj-$(CONFIG_PINCTRL_QCS8300)	+= pinctrl-qcs8300.o
+obj-$(CONFIG_PINCTRL_QCS8300_LPASS_LPI) += pinctrl-qcs8300-lpass-lpi.o
 obj-$(CONFIG_PINCTRL_QDF2XXX)	+= pinctrl-qdf2xxx.o
 obj-$(CONFIG_PINCTRL_MDM9607)	+= pinctrl-mdm9607.o
 obj-$(CONFIG_PINCTRL_MDM9615)	+= pinctrl-mdm9615.o
@@ -31,7 +34,9 @@
 obj-$(CONFIG_PINCTRL_QCOM_SSBI_PMIC) += pinctrl-ssbi-gpio.o
 obj-$(CONFIG_PINCTRL_QCOM_SSBI_PMIC) += pinctrl-ssbi-mpp.o
 obj-$(CONFIG_PINCTRL_QDU1000)	+= pinctrl-qdu1000.o
+obj-$(CONFIG_PINCTRL_SA7255P)	+= pinctrl-sa7255p.o
 obj-$(CONFIG_PINCTRL_SA8775P)	+= pinctrl-sa8775p.o
+obj-$(CONFIG_PINCTRL_SA8775P_LPASS_LPI) += pinctrl-sa8775p-lpass-lpi.o
 obj-$(CONFIG_PINCTRL_SC7180)	+= pinctrl-sc7180.o
 obj-$(CONFIG_PINCTRL_SC7280)	+= pinctrl-sc7280.o
 obj-$(CONFIG_PINCTRL_SC7280_LPASS_LPI) += pinctrl-sc7280-lpass-lpi.o
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
  * Copyright (c) 2020 Linaro Ltd.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/bitfield.h>
@@ -10,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/seq_file.h>
 
 #include <linux/pinctrl/pinconf-generic.h>
@@ -24,6 +26,8 @@
 #define GPIO_FUNC		0
 #define MAX_LPI_NUM_CLKS	2
 
+static struct device *lpi_dev;
+
 struct lpi_pinctrl {
 	struct device *dev;
 	struct pinctrl_dev *ctrl;
@@ -34,6 +38,8 @@
 	struct clk_bulk_data clks[MAX_LPI_NUM_CLKS];
 	/* Protects from concurrent register updates */
 	struct mutex lock;
+	/* Protects from concurrent clock updates */
+	struct mutex lpi_lock;
 	DECLARE_BITMAP(ever_gpio, MAX_NR_GPIO);
 	const struct lpi_pinctrl_variant_data *data;
 };
@@ -41,14 +47,26 @@
 static int lpi_gpio_read(struct lpi_pinctrl *state, unsigned int pin,
 			 unsigned int addr)
 {
-	return ioread32(state->tlmm_base + LPI_TLMM_REG_OFFSET * pin + addr);
+	int ret = 0;
+
+	pm_runtime_get_sync(lpi_dev);
+
+	ret = ioread32(state->tlmm_base + LPI_TLMM_REG_OFFSET * pin + addr);
+
+	pm_runtime_mark_last_busy(lpi_dev);
+	pm_runtime_put_autosuspend(lpi_dev);
+	return ret;
 }
 
 static int lpi_gpio_write(struct lpi_pinctrl *state, unsigned int pin,
 			  unsigned int addr, unsigned int val)
 {
+	pm_runtime_get_sync(lpi_dev);
+
 	iowrite32(val, state->tlmm_base + LPI_TLMM_REG_OFFSET * pin + addr);
 
+	pm_runtime_mark_last_busy(lpi_dev);
+	pm_runtime_put_autosuspend(lpi_dev);
 	return 0;
 }
 
@@ -448,6 +466,7 @@
 
 	pctrl->data = data;
 	pctrl->dev = &pdev->dev;
+	lpi_dev = &pdev->dev;
 
 	pctrl->clks[0].id = "core";
 	pctrl->clks[1].id = "audio";
@@ -487,6 +506,7 @@
 	pctrl->chip.can_sleep = false;
 
 	mutex_init(&pctrl->lock);
+	mutex_init(&pctrl->lpi_lock);
 
 	pctrl->ctrl = devm_pinctrl_register(dev, &pctrl->desc, pctrl);
 	if (IS_ERR(pctrl->ctrl)) {
@@ -505,10 +525,16 @@
 		goto err_pinctrl;
 	}
 
+	pm_runtime_set_autosuspend_delay(dev, 100);
+	pm_runtime_use_autosuspend(dev);
+	pm_runtime_set_active(dev);
+	pm_runtime_enable(dev);
+
 	return 0;
 
 err_pinctrl:
 	mutex_destroy(&pctrl->lock);
+	mutex_destroy(&pctrl->lpi_lock);
 	clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks);
 
 	return ret;
@@ -521,6 +547,7 @@
 	int i;
 
 	mutex_destroy(&pctrl->lock);
+	mutex_destroy(&pctrl->lpi_lock);
 	clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks);
 
 	for (i = 0; i < pctrl->data->npins; i++)
@@ -528,5 +555,29 @@
 }
 EXPORT_SYMBOL_GPL(lpi_pinctrl_remove);
 
+int lpi_pinctrl_runtime_suspend(struct device *dev)
+{
+	struct lpi_pinctrl *pctrl = dev_get_drvdata(dev);
+
+	mutex_lock(&pctrl->lpi_lock);
+	clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks);
+	mutex_unlock(&pctrl->lpi_lock);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(lpi_pinctrl_runtime_suspend);
+
+int lpi_pinctrl_runtime_resume(struct device *dev)
+{
+	struct lpi_pinctrl *pctrl = dev_get_drvdata(dev);
+
+	mutex_lock(&pctrl->lpi_lock);
+	clk_bulk_prepare_enable(MAX_LPI_NUM_CLKS, pctrl->clks);
+	mutex_unlock(&pctrl->lpi_lock);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(lpi_pinctrl_runtime_resume);
+
 MODULE_DESCRIPTION("QTI LPI GPIO pin control driver");
 MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-lpass-lpi.h
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-lpass-lpi.h
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
  * Copyright (c) 2020 Linaro Ltd.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #ifndef __PINCTRL_LPASS_LPI_H__
 #define __PINCTRL_LPASS_LPI_H__
@@ -89,5 +90,7 @@
 
 int lpi_pinctrl_probe(struct platform_device *pdev);
 void lpi_pinctrl_remove(struct platform_device *pdev);
+int lpi_pinctrl_runtime_suspend(struct device *dev);
+int lpi_pinctrl_runtime_resume(struct device *dev);
 
 #endif /*__PINCTRL_LPASS_LPI_H__*/
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-qcs615.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-qcs615.c
@@ -0,0 +1,1107 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include "pinctrl-msm.h"
+
+enum {
+	SOUTH,
+	EAST,
+	WEST
+};
+
+static const char * const qcs615_tiles[] = {
+	[SOUTH] = "south",
+	[EAST] = "east",
+	[WEST] = "west"
+};
+
+#define PINGROUP(id, _tile, f1, f2, f3, f4, f5, f6, f7, f8, f9)	\
+	{						\
+		.grp = PINCTRL_PINGROUP("gpio" #id,	\
+			gpio##id##_pins,		\
+			ARRAY_SIZE(gpio##id##_pins)),	\
+		.funcs = (int[]){			\
+			msm_mux_gpio, /* gpio mode */	\
+			msm_mux_##f1,			\
+			msm_mux_##f2,			\
+			msm_mux_##f3,			\
+			msm_mux_##f4,			\
+			msm_mux_##f5,			\
+			msm_mux_##f6,			\
+			msm_mux_##f7,			\
+			msm_mux_##f8,			\
+			msm_mux_##f9			\
+		},					\
+		.nfuncs = 10,				\
+		.ctl_reg = 0x1000 * id,		\
+		.io_reg = 0x1000 * id + 0x4,		\
+		.intr_cfg_reg = 0x1000 * id + 0x8,	\
+		.intr_status_reg = 0x1000 * id + 0xc,	\
+		.intr_target_reg = 0x1000 * id + 0x8,	\
+		.tile = _tile,			\
+		.mux_bit = 2,			\
+		.pull_bit = 0,			\
+		.drv_bit = 6,			\
+		.oe_bit = 9,			\
+		.in_bit = 0,			\
+		.out_bit = 1,			\
+		.intr_enable_bit = 0,		\
+		.intr_status_bit = 0,		\
+		.intr_target_bit = 5,		\
+		.intr_target_kpss_val = 3,	\
+		.intr_raw_status_bit = 4,	\
+		.intr_polarity_bit = 1,		\
+		.intr_detection_bit = 2,	\
+		.intr_detection_width = 2,	\
+	}
+
+#define SDC_QDSD_PINGROUP(pg_name, _tile, ctl, pull, drv)	\
+	{						\
+		.grp = PINCTRL_PINGROUP(#pg_name,	\
+			pg_name##_pins,			\
+			ARRAY_SIZE(pg_name##_pins)),	\
+		.ctl_reg = ctl,				\
+		.io_reg = 0,				\
+		.intr_cfg_reg = 0,			\
+		.intr_status_reg = 0,			\
+		.intr_target_reg = 0,			\
+		.tile = _tile,				\
+		.mux_bit = -1,				\
+		.pull_bit = pull,			\
+		.drv_bit = drv,				\
+		.oe_bit = -1,				\
+		.in_bit = -1,				\
+		.out_bit = -1,				\
+		.intr_enable_bit = -1,			\
+		.intr_status_bit = -1,			\
+		.intr_target_bit = -1,			\
+		.intr_raw_status_bit = -1,		\
+		.intr_polarity_bit = -1,		\
+		.intr_detection_bit = -1,		\
+		.intr_detection_width = -1,		\
+	}
+
+#define UFS_RESET(pg_name, offset)			\
+	{						\
+		.grp = PINCTRL_PINGROUP(#pg_name,	\
+			pg_name##_pins,			\
+			ARRAY_SIZE(pg_name##_pins)),	\
+		.ctl_reg = offset,			\
+		.io_reg = offset + 0x4,			\
+		.intr_cfg_reg = 0,			\
+		.intr_status_reg = 0,			\
+		.intr_target_reg = 0,			\
+		.tile = WEST,				\
+		.mux_bit = -1,				\
+		.pull_bit = 3,				\
+		.drv_bit = 0,				\
+		.oe_bit = -1,				\
+		.in_bit = -1,				\
+		.out_bit = 0,				\
+		.intr_enable_bit = -1,			\
+		.intr_status_bit = -1,			\
+		.intr_target_bit = -1,			\
+		.intr_raw_status_bit = -1,		\
+		.intr_polarity_bit = -1,		\
+		.intr_detection_bit = -1,		\
+		.intr_detection_width = -1,		\
+	}
+
+static const struct pinctrl_pin_desc qcs615_pins[] = {
+	PINCTRL_PIN(0, "GPIO_0"),
+	PINCTRL_PIN(1, "GPIO_1"),
+	PINCTRL_PIN(2, "GPIO_2"),
+	PINCTRL_PIN(3, "GPIO_3"),
+	PINCTRL_PIN(4, "GPIO_4"),
+	PINCTRL_PIN(5, "GPIO_5"),
+	PINCTRL_PIN(6, "GPIO_6"),
+	PINCTRL_PIN(7, "GPIO_7"),
+	PINCTRL_PIN(8, "GPIO_8"),
+	PINCTRL_PIN(9, "GPIO_9"),
+	PINCTRL_PIN(10, "GPIO_10"),
+	PINCTRL_PIN(11, "GPIO_11"),
+	PINCTRL_PIN(12, "GPIO_12"),
+	PINCTRL_PIN(13, "GPIO_13"),
+	PINCTRL_PIN(14, "GPIO_14"),
+	PINCTRL_PIN(15, "GPIO_15"),
+	PINCTRL_PIN(16, "GPIO_16"),
+	PINCTRL_PIN(17, "GPIO_17"),
+	PINCTRL_PIN(18, "GPIO_18"),
+	PINCTRL_PIN(19, "GPIO_19"),
+	PINCTRL_PIN(20, "GPIO_20"),
+	PINCTRL_PIN(21, "GPIO_21"),
+	PINCTRL_PIN(22, "GPIO_22"),
+	PINCTRL_PIN(23, "GPIO_23"),
+	PINCTRL_PIN(24, "GPIO_24"),
+	PINCTRL_PIN(25, "GPIO_25"),
+	PINCTRL_PIN(26, "GPIO_26"),
+	PINCTRL_PIN(27, "GPIO_27"),
+	PINCTRL_PIN(28, "GPIO_28"),
+	PINCTRL_PIN(29, "GPIO_29"),
+	PINCTRL_PIN(30, "GPIO_30"),
+	PINCTRL_PIN(31, "GPIO_31"),
+	PINCTRL_PIN(32, "GPIO_32"),
+	PINCTRL_PIN(33, "GPIO_33"),
+	PINCTRL_PIN(34, "GPIO_34"),
+	PINCTRL_PIN(35, "GPIO_35"),
+	PINCTRL_PIN(36, "GPIO_36"),
+	PINCTRL_PIN(37, "GPIO_37"),
+	PINCTRL_PIN(38, "GPIO_38"),
+	PINCTRL_PIN(39, "GPIO_39"),
+	PINCTRL_PIN(40, "GPIO_40"),
+	PINCTRL_PIN(41, "GPIO_41"),
+	PINCTRL_PIN(42, "GPIO_42"),
+	PINCTRL_PIN(43, "GPIO_43"),
+	PINCTRL_PIN(44, "GPIO_44"),
+	PINCTRL_PIN(45, "GPIO_45"),
+	PINCTRL_PIN(46, "GPIO_46"),
+	PINCTRL_PIN(47, "GPIO_47"),
+	PINCTRL_PIN(48, "GPIO_48"),
+	PINCTRL_PIN(49, "GPIO_49"),
+	PINCTRL_PIN(50, "GPIO_50"),
+	PINCTRL_PIN(51, "GPIO_51"),
+	PINCTRL_PIN(52, "GPIO_52"),
+	PINCTRL_PIN(53, "GPIO_53"),
+	PINCTRL_PIN(54, "GPIO_54"),
+	PINCTRL_PIN(55, "GPIO_55"),
+	PINCTRL_PIN(56, "GPIO_56"),
+	PINCTRL_PIN(57, "GPIO_57"),
+	PINCTRL_PIN(58, "GPIO_58"),
+	PINCTRL_PIN(59, "GPIO_59"),
+	PINCTRL_PIN(60, "GPIO_60"),
+	PINCTRL_PIN(61, "GPIO_61"),
+	PINCTRL_PIN(62, "GPIO_62"),
+	PINCTRL_PIN(63, "GPIO_63"),
+	PINCTRL_PIN(64, "GPIO_64"),
+	PINCTRL_PIN(65, "GPIO_65"),
+	PINCTRL_PIN(66, "GPIO_66"),
+	PINCTRL_PIN(67, "GPIO_67"),
+	PINCTRL_PIN(68, "GPIO_68"),
+	PINCTRL_PIN(69, "GPIO_69"),
+	PINCTRL_PIN(70, "GPIO_70"),
+	PINCTRL_PIN(71, "GPIO_71"),
+	PINCTRL_PIN(72, "GPIO_72"),
+	PINCTRL_PIN(73, "GPIO_73"),
+	PINCTRL_PIN(74, "GPIO_74"),
+	PINCTRL_PIN(75, "GPIO_75"),
+	PINCTRL_PIN(76, "GPIO_76"),
+	PINCTRL_PIN(77, "GPIO_77"),
+	PINCTRL_PIN(78, "GPIO_78"),
+	PINCTRL_PIN(79, "GPIO_79"),
+	PINCTRL_PIN(80, "GPIO_80"),
+	PINCTRL_PIN(81, "GPIO_81"),
+	PINCTRL_PIN(82, "GPIO_82"),
+	PINCTRL_PIN(83, "GPIO_83"),
+	PINCTRL_PIN(84, "GPIO_84"),
+	PINCTRL_PIN(85, "GPIO_85"),
+	PINCTRL_PIN(86, "GPIO_86"),
+	PINCTRL_PIN(87, "GPIO_87"),
+	PINCTRL_PIN(88, "GPIO_88"),
+	PINCTRL_PIN(89, "GPIO_89"),
+	PINCTRL_PIN(90, "GPIO_90"),
+	PINCTRL_PIN(91, "GPIO_91"),
+	PINCTRL_PIN(92, "GPIO_92"),
+	PINCTRL_PIN(93, "GPIO_93"),
+	PINCTRL_PIN(94, "GPIO_94"),
+	PINCTRL_PIN(95, "GPIO_95"),
+	PINCTRL_PIN(96, "GPIO_96"),
+	PINCTRL_PIN(97, "GPIO_97"),
+	PINCTRL_PIN(98, "GPIO_98"),
+	PINCTRL_PIN(99, "GPIO_99"),
+	PINCTRL_PIN(100, "GPIO_100"),
+	PINCTRL_PIN(101, "GPIO_101"),
+	PINCTRL_PIN(102, "GPIO_102"),
+	PINCTRL_PIN(103, "GPIO_103"),
+	PINCTRL_PIN(104, "GPIO_104"),
+	PINCTRL_PIN(105, "GPIO_105"),
+	PINCTRL_PIN(106, "GPIO_106"),
+	PINCTRL_PIN(107, "GPIO_107"),
+	PINCTRL_PIN(108, "GPIO_108"),
+	PINCTRL_PIN(109, "GPIO_109"),
+	PINCTRL_PIN(110, "GPIO_110"),
+	PINCTRL_PIN(111, "GPIO_111"),
+	PINCTRL_PIN(112, "GPIO_112"),
+	PINCTRL_PIN(113, "GPIO_113"),
+	PINCTRL_PIN(114, "GPIO_114"),
+	PINCTRL_PIN(115, "GPIO_115"),
+	PINCTRL_PIN(116, "GPIO_116"),
+	PINCTRL_PIN(117, "GPIO_117"),
+	PINCTRL_PIN(118, "GPIO_118"),
+	PINCTRL_PIN(119, "GPIO_119"),
+	PINCTRL_PIN(120, "GPIO_120"),
+	PINCTRL_PIN(121, "GPIO_121"),
+	PINCTRL_PIN(122, "GPIO_122"),
+	PINCTRL_PIN(123, "UFS_RESET"),
+	PINCTRL_PIN(124, "SDC1_RCLK"),
+	PINCTRL_PIN(125, "SDC1_CLK"),
+	PINCTRL_PIN(126, "SDC1_CMD"),
+	PINCTRL_PIN(127, "SDC1_DATA"),
+	PINCTRL_PIN(128, "SDC2_CLK"),
+	PINCTRL_PIN(129, "SDC2_CMD"),
+	PINCTRL_PIN(130, "SDC2_DATA"),
+};
+
+#define DECLARE_MSM_GPIO_PINS(pin) \
+	static const unsigned int gpio##pin##_pins[] = { pin }
+DECLARE_MSM_GPIO_PINS(0);
+DECLARE_MSM_GPIO_PINS(1);
+DECLARE_MSM_GPIO_PINS(2);
+DECLARE_MSM_GPIO_PINS(3);
+DECLARE_MSM_GPIO_PINS(4);
+DECLARE_MSM_GPIO_PINS(5);
+DECLARE_MSM_GPIO_PINS(6);
+DECLARE_MSM_GPIO_PINS(7);
+DECLARE_MSM_GPIO_PINS(8);
+DECLARE_MSM_GPIO_PINS(9);
+DECLARE_MSM_GPIO_PINS(10);
+DECLARE_MSM_GPIO_PINS(11);
+DECLARE_MSM_GPIO_PINS(12);
+DECLARE_MSM_GPIO_PINS(13);
+DECLARE_MSM_GPIO_PINS(14);
+DECLARE_MSM_GPIO_PINS(15);
+DECLARE_MSM_GPIO_PINS(16);
+DECLARE_MSM_GPIO_PINS(17);
+DECLARE_MSM_GPIO_PINS(18);
+DECLARE_MSM_GPIO_PINS(19);
+DECLARE_MSM_GPIO_PINS(20);
+DECLARE_MSM_GPIO_PINS(21);
+DECLARE_MSM_GPIO_PINS(22);
+DECLARE_MSM_GPIO_PINS(23);
+DECLARE_MSM_GPIO_PINS(24);
+DECLARE_MSM_GPIO_PINS(25);
+DECLARE_MSM_GPIO_PINS(26);
+DECLARE_MSM_GPIO_PINS(27);
+DECLARE_MSM_GPIO_PINS(28);
+DECLARE_MSM_GPIO_PINS(29);
+DECLARE_MSM_GPIO_PINS(30);
+DECLARE_MSM_GPIO_PINS(31);
+DECLARE_MSM_GPIO_PINS(32);
+DECLARE_MSM_GPIO_PINS(33);
+DECLARE_MSM_GPIO_PINS(34);
+DECLARE_MSM_GPIO_PINS(35);
+DECLARE_MSM_GPIO_PINS(36);
+DECLARE_MSM_GPIO_PINS(37);
+DECLARE_MSM_GPIO_PINS(38);
+DECLARE_MSM_GPIO_PINS(39);
+DECLARE_MSM_GPIO_PINS(40);
+DECLARE_MSM_GPIO_PINS(41);
+DECLARE_MSM_GPIO_PINS(42);
+DECLARE_MSM_GPIO_PINS(43);
+DECLARE_MSM_GPIO_PINS(44);
+DECLARE_MSM_GPIO_PINS(45);
+DECLARE_MSM_GPIO_PINS(46);
+DECLARE_MSM_GPIO_PINS(47);
+DECLARE_MSM_GPIO_PINS(48);
+DECLARE_MSM_GPIO_PINS(49);
+DECLARE_MSM_GPIO_PINS(50);
+DECLARE_MSM_GPIO_PINS(51);
+DECLARE_MSM_GPIO_PINS(52);
+DECLARE_MSM_GPIO_PINS(53);
+DECLARE_MSM_GPIO_PINS(54);
+DECLARE_MSM_GPIO_PINS(55);
+DECLARE_MSM_GPIO_PINS(56);
+DECLARE_MSM_GPIO_PINS(57);
+DECLARE_MSM_GPIO_PINS(58);
+DECLARE_MSM_GPIO_PINS(59);
+DECLARE_MSM_GPIO_PINS(60);
+DECLARE_MSM_GPIO_PINS(61);
+DECLARE_MSM_GPIO_PINS(62);
+DECLARE_MSM_GPIO_PINS(63);
+DECLARE_MSM_GPIO_PINS(64);
+DECLARE_MSM_GPIO_PINS(65);
+DECLARE_MSM_GPIO_PINS(66);
+DECLARE_MSM_GPIO_PINS(67);
+DECLARE_MSM_GPIO_PINS(68);
+DECLARE_MSM_GPIO_PINS(69);
+DECLARE_MSM_GPIO_PINS(70);
+DECLARE_MSM_GPIO_PINS(71);
+DECLARE_MSM_GPIO_PINS(72);
+DECLARE_MSM_GPIO_PINS(73);
+DECLARE_MSM_GPIO_PINS(74);
+DECLARE_MSM_GPIO_PINS(75);
+DECLARE_MSM_GPIO_PINS(76);
+DECLARE_MSM_GPIO_PINS(77);
+DECLARE_MSM_GPIO_PINS(78);
+DECLARE_MSM_GPIO_PINS(79);
+DECLARE_MSM_GPIO_PINS(80);
+DECLARE_MSM_GPIO_PINS(81);
+DECLARE_MSM_GPIO_PINS(82);
+DECLARE_MSM_GPIO_PINS(83);
+DECLARE_MSM_GPIO_PINS(84);
+DECLARE_MSM_GPIO_PINS(85);
+DECLARE_MSM_GPIO_PINS(86);
+DECLARE_MSM_GPIO_PINS(87);
+DECLARE_MSM_GPIO_PINS(88);
+DECLARE_MSM_GPIO_PINS(89);
+DECLARE_MSM_GPIO_PINS(90);
+DECLARE_MSM_GPIO_PINS(91);
+DECLARE_MSM_GPIO_PINS(92);
+DECLARE_MSM_GPIO_PINS(93);
+DECLARE_MSM_GPIO_PINS(94);
+DECLARE_MSM_GPIO_PINS(95);
+DECLARE_MSM_GPIO_PINS(96);
+DECLARE_MSM_GPIO_PINS(97);
+DECLARE_MSM_GPIO_PINS(98);
+DECLARE_MSM_GPIO_PINS(99);
+DECLARE_MSM_GPIO_PINS(100);
+DECLARE_MSM_GPIO_PINS(101);
+DECLARE_MSM_GPIO_PINS(102);
+DECLARE_MSM_GPIO_PINS(103);
+DECLARE_MSM_GPIO_PINS(104);
+DECLARE_MSM_GPIO_PINS(105);
+DECLARE_MSM_GPIO_PINS(106);
+DECLARE_MSM_GPIO_PINS(107);
+DECLARE_MSM_GPIO_PINS(108);
+DECLARE_MSM_GPIO_PINS(109);
+DECLARE_MSM_GPIO_PINS(110);
+DECLARE_MSM_GPIO_PINS(111);
+DECLARE_MSM_GPIO_PINS(112);
+DECLARE_MSM_GPIO_PINS(113);
+DECLARE_MSM_GPIO_PINS(114);
+DECLARE_MSM_GPIO_PINS(115);
+DECLARE_MSM_GPIO_PINS(116);
+DECLARE_MSM_GPIO_PINS(117);
+DECLARE_MSM_GPIO_PINS(118);
+DECLARE_MSM_GPIO_PINS(119);
+DECLARE_MSM_GPIO_PINS(120);
+DECLARE_MSM_GPIO_PINS(121);
+DECLARE_MSM_GPIO_PINS(122);
+
+static const unsigned int ufs_reset_pins[] = { 123 };
+static const unsigned int sdc1_rclk_pins[] = { 124 };
+static const unsigned int sdc1_clk_pins[] = { 125 };
+static const unsigned int sdc1_cmd_pins[] = { 126 };
+static const unsigned int sdc1_data_pins[] = { 127 };
+static const unsigned int sdc2_clk_pins[] = { 128 };
+static const unsigned int sdc2_cmd_pins[] = { 129 };
+static const unsigned int sdc2_data_pins[] = { 130 };
+
+enum qcs615_functions {
+	msm_mux_gpio,
+	msm_mux_adsp_ext,
+	msm_mux_agera_pll,
+	msm_mux_aoss_cti,
+	msm_mux_atest_char,
+	msm_mux_atest_tsens,
+	msm_mux_atest_usb,
+	msm_mux_cam_mclk,
+	msm_mux_cci_async,
+	msm_mux_cci_i2c,
+	msm_mux_cci_timer,
+	msm_mux_copy_gp,
+	msm_mux_copy_phase,
+	msm_mux_cri_trng,
+	msm_mux_dbg_out_clk,
+	msm_mux_ddr_bist,
+	msm_mux_ddr_pxi,
+	msm_mux_dp_hot,
+	msm_mux_edp_hot,
+	msm_mux_edp_lcd,
+	msm_mux_emac_gcc,
+	msm_mux_emac_phy_intr,
+	msm_mux_forced_usb,
+	msm_mux_gcc_gp,
+	msm_mux_gp_pdm,
+	msm_mux_gps_tx,
+	msm_mux_hs0_mi2s,
+	msm_mux_hs1_mi2s,
+	msm_mux_jitter_bist,
+	msm_mux_ldo_en,
+	msm_mux_ldo_update,
+	msm_mux_m_voc,
+	msm_mux_mclk1,
+	msm_mux_mclk2,
+	msm_mux_mdp_vsync,
+	msm_mux_mdp_vsync0_out,
+	msm_mux_mdp_vsync1_out,
+	msm_mux_mdp_vsync2_out,
+	msm_mux_mdp_vsync3_out,
+	msm_mux_mdp_vsync4_out,
+	msm_mux_mdp_vsync5_out,
+	msm_mux_mi2s_1,
+	msm_mux_mss_lte,
+	msm_mux_nav_pps_in,
+	msm_mux_nav_pps_out,
+	msm_mux_pa_indicator_or,
+	msm_mux_pcie_clk_req,
+	msm_mux_pcie_ep_rst,
+	msm_mux_phase_flag,
+	msm_mux_pll_bist,
+	msm_mux_pll_bypassnl,
+	msm_mux_pll_reset_n,
+	msm_mux_prng_rosc,
+	msm_mux_qdss_cti,
+	msm_mux_qdss_gpio,
+	msm_mux_qlink_enable,
+	msm_mux_qlink_request,
+	msm_mux_qspi,
+	msm_mux_qup0,
+	msm_mux_qup1,
+	msm_mux_rgmii,
+	msm_mux_sd_write_protect,
+	msm_mux_sp_cmu,
+	msm_mux_ter_mi2s,
+	msm_mux_tgu_ch,
+	msm_mux_uim1,
+	msm_mux_uim2,
+	msm_mux_usb0_hs,
+	msm_mux_usb1_hs,
+	msm_mux_usb_phy_ps,
+	msm_mux_vfr_1,
+	msm_mux_vsense_trigger_mirnat,
+	msm_mux_wlan,
+	msm_mux_wsa_clk,
+	msm_mux_wsa_data,
+	msm_mux__,
+};
+
+static const char *const gpio_groups[] = {
+	"gpio0",   "gpio1",   "gpio2",   "gpio3",   "gpio4",   "gpio5",
+	"gpio6",   "gpio7",   "gpio8",   "gpio9",   "gpio10",  "gpio11",
+	"gpio12",  "gpio13",  "gpio14",  "gpio15",  "gpio16",  "gpio17",
+	"gpio18",  "gpio19",  "gpio20",  "gpio21",  "gpio22",  "gpio23",
+	"gpio24",  "gpio25",  "gpio26",  "gpio27",  "gpio28",  "gpio29",
+	"gpio30",  "gpio31",  "gpio32",  "gpio33",  "gpio34",  "gpio35",
+	"gpio36",  "gpio37",  "gpio38",  "gpio39",  "gpio40",  "gpio41",
+	"gpio42",  "gpio43",  "gpio44",  "gpio45",  "gpio46",  "gpio47",
+	"gpio48",  "gpio49",  "gpio50",  "gpio51",  "gpio52",  "gpio53",
+	"gpio54",  "gpio55",  "gpio56",  "gpio57",  "gpio58",  "gpio59",
+	"gpio60",  "gpio61",  "gpio62",  "gpio63",  "gpio64",  "gpio65",
+	"gpio66",  "gpio67",  "gpio68",  "gpio69",  "gpio70",  "gpio71",
+	"gpio72",  "gpio73",  "gpio74",  "gpio75",  "gpio76",  "gpio77",
+	"gpio78",  "gpio79",  "gpio80",  "gpio81",  "gpio82",  "gpio83",
+	"gpio84",  "gpio85",  "gpio86",  "gpio87",  "gpio88",  "gpio89",
+	"gpio90",  "gpio91",  "gpio92",  "gpio93",  "gpio94",  "gpio95",
+	"gpio96",  "gpio97",  "gpio98",  "gpio99",  "gpio100", "gpio101",
+	"gpio102", "gpio103", "gpio104", "gpio105", "gpio106", "gpio107",
+	"gpio108", "gpio109", "gpio110", "gpio111", "gpio112", "gpio113",
+	"gpio114", "gpio115", "gpio116", "gpio117", "gpio118", "gpio119",
+	"gpio120", "gpio121", "gpio122",
+};
+
+static const char *const adsp_ext_groups[] = {
+	"gpio118",
+};
+
+static const char *const agera_pll_groups[] = {
+	"gpio28",
+};
+
+static const char *const aoss_cti_groups[] = {
+	"gpio76",
+};
+
+static const char *const atest_char_groups[] = {
+	"gpio84",  "gpio85",  "gpio86",  "gpio87",
+	"gpio115", "gpio117", "gpio118", "gpio119",
+	"gpio120", "gpio121",
+};
+
+static const char *const atest_tsens_groups[] = {
+	"gpio7", "gpio29",
+};
+
+static const char *const atest_usb_groups[] = {
+	"gpio7",  "gpio10", "gpio11", "gpio54",
+	"gpio55", "gpio67", "gpio68", "gpio76",
+	"gpio75", "gpio77",
+};
+
+static const char *const cam_mclk_groups[] = {
+	"gpio28", "gpio29", "gpio30", "gpio31",
+};
+
+static const char *const cci_async_groups[] = {
+	"gpio26", "gpio41", "gpio42",
+};
+
+static const char *const cci_i2c_groups[] = {
+	"gpio32", "gpio33", "gpio34", "gpio35",
+};
+
+static const char *const cci_timer_groups[] = {
+	"gpio37", "gpio38", "gpio39", "gpio41",
+	"gpio42",
+};
+
+static const char *const copy_gp_groups[] = {
+	"gpio86",
+};
+
+static const char *const copy_phase_groups[] = {
+	"gpio103",
+};
+
+static const char *const cri_trng_groups[] = {
+	"gpio60", "gpio61", "gpio62",
+};
+
+static const char *const dbg_out_clk_groups[] = {
+	"gpio11",
+};
+
+static const char *const ddr_bist_groups[] = {
+	"gpio7", "gpio8", "gpio9", "gpio10",
+};
+
+static const char *const ddr_pxi_groups[] = {
+	"gpio6",  "gpio7",  "gpio10", "gpio11",
+	"gpio12", "gpio13", "gpio54", "gpio55",
+};
+
+static const char *const dp_hot_groups[] = {
+	"gpio102", "gpio103", "gpio104",
+};
+
+static const char *const edp_hot_groups[] = {
+	"gpio113",
+};
+
+static const char *const edp_lcd_groups[] = {
+	"gpio119",
+};
+
+static const char *const emac_gcc_groups[] = {
+	"gpio101", "gpio102",
+};
+
+static const char *const emac_phy_intr_groups[] = {
+	"gpio89",
+};
+
+static const char *const forced_usb_groups[] = {
+	"gpio43",
+};
+
+static const char *const gcc_gp_groups[] = {
+	"gpio21", "gpio22", "gpio57", "gpio58",
+	"gpio59", "gpio78",
+};
+
+static const char *const gp_pdm_groups[] = {
+	"gpio8", "gpio54", "gpio63", "gpio66",
+	"gpio79", "gpio95",
+};
+
+static const char *const gps_tx_groups[] = {
+	"gpio53", "gpio54", "gpio56", "gpio57",
+	"gpio59", "gpio60",
+};
+
+static const char *const hs0_mi2s_groups[] = {
+	"gpio36", "gpio37", "gpio38", "gpio39",
+};
+
+static const char *const hs1_mi2s_groups[] = {
+	"gpio24", "gpio25", "gpio26", "gpio27",
+};
+
+static const char *const jitter_bist_groups[] = {
+	"gpio12", "gpio26",
+};
+
+static const char *const ldo_en_groups[] = {
+	"gpio97",
+};
+
+static const char *const ldo_update_groups[] = {
+	"gpio98",
+};
+
+static const char *const m_voc_groups[] = {
+	"gpio120",
+};
+
+static const char *const mclk1_groups[] = {
+	"gpio121",
+};
+
+static const char *const mclk2_groups[] = {
+	"gpio122",
+};
+
+static const char *const mdp_vsync_groups[] = {
+	"gpio81", "gpio82", "gpio83", "gpio90",
+	"gpio97", "gpio98",
+};
+
+static const char *const mdp_vsync0_out_groups[] = {
+	"gpio90",
+};
+
+static const char *const mdp_vsync1_out_groups[] = {
+	"gpio90",
+};
+
+static const char *const mdp_vsync2_out_groups[] = {
+	"gpio90",
+};
+
+static const char *const mdp_vsync3_out_groups[] = {
+	"gpio90",
+};
+
+static const char *const mdp_vsync4_out_groups[] = {
+	"gpio90",
+};
+
+static const char *const mdp_vsync5_out_groups[] = {
+	"gpio90",
+};
+
+static const char *const mi2s_1_groups[] = {
+	"gpio108", "gpio109", "gpio110", "gpio111",
+};
+
+static const char *const mss_lte_groups[] = {
+	"gpio106", "gpio107",
+};
+
+static const char *const nav_pps_in_groups[] = {
+	"gpio53", "gpio56", "gpio57", "gpio59",
+	"gpio60",
+};
+
+static const char *const nav_pps_out_groups[] = {
+	"gpio53", "gpio56", "gpio57", "gpio59",
+	"gpio60",
+};
+
+static const char *const pa_indicator_or_groups[] = {
+	"gpio53",
+};
+
+static const char *const pcie_clk_req_groups[] = {
+	"gpio90",
+};
+
+static const char *const pcie_ep_rst_groups[] = {
+	"gpio89",
+};
+
+static const char *const phase_flag_groups[] = {
+	"gpio10",  "gpio18",  "gpio19",  "gpio20",
+	"gpio23",  "gpio24",  "gpio25",  "gpio38",
+	"gpio40",  "gpio41",  "gpio42",  "gpio43",
+	"gpio44",  "gpio45",  "gpio53",  "gpio54",
+	"gpio55",  "gpio67",  "gpio68",  "gpio75",
+	"gpio76",  "gpio77",  "gpio78",  "gpio79",
+	"gpio80",  "gpio82",  "gpio84",  "gpio92",
+	"gpio116", "gpio117", "gpio118", "gpio119",
+};
+
+static const char *const pll_bist_groups[] = {
+	"gpio27",
+};
+
+static const char *const pll_bypassnl_groups[] = {
+	"gpio13",
+};
+
+static const char *const pll_reset_n_groups[] = {
+	"gpio14",
+};
+
+static const char *const prng_rosc_groups[] = {
+	"gpio99", "gpio102",
+};
+
+static const char *const qdss_cti_groups[] = {
+	"gpio83",  "gpio96",  "gpio97",  "gpio98",
+	"gpio103", "gpio104", "gpio112", "gpio113",
+};
+
+static const char *const qdss_gpio_groups[] = {
+	"gpio0",   "gpio1",   "gpio2",   "gpio3",
+	"gpio6",   "gpio7",   "gpio8",   "gpio9",
+	"gpio14",  "gpio15",  "gpio20",  "gpio21",
+	"gpio28",  "gpio29",  "gpio30",  "gpio31",
+	"gpio32",  "gpio33",  "gpio34",  "gpio35",
+	"gpio44",  "gpio45",  "gpio46",  "gpio47",
+	"gpio81",  "gpio82",  "gpio92",  "gpio93",
+	"gpio94",  "gpio95",  "gpio108", "gpio109",
+	"gpio117", "gpio118", "gpio119", "gpio120",
+};
+
+static const char *const qlink_enable_groups[] = {
+	"gpio52",
+};
+
+static const char *const qlink_request_groups[] = {
+	"gpio51",
+};
+
+static const char *const qspi_groups[] = {
+	"gpio44", "gpio45", "gpio46", "gpio47",
+	"gpio48", "gpio49", "gpio50",
+};
+
+static const char *const qup0_groups[] = {
+	"gpio0",  "gpio1",  "gpio2",  "gpio3",
+	"gpio4",  "gpio5",  "gpio16", "gpio17",
+	"gpio18", "gpio19",
+};
+
+static const char *const qup1_groups[] = {
+	"gpio6",  "gpio7",  "gpio8",  "gpio9",
+	"gpio10", "gpio11", "gpio12", "gpio13",
+	"gpio14", "gpio15", "gpio20", "gpio21",
+	"gpio22", "gpio23",
+};
+
+static const char *const rgmii_groups[] = {
+	"gpio81",  "gpio82",  "gpio83",  "gpio91",
+	"gpio92",  "gpio93",  "gpio94",  "gpio95",
+	"gpio96",  "gpio97",  "gpio102", "gpio103",
+	"gpio112", "gpio113", "gpio114",
+};
+
+static const char *const sd_write_protect_groups[] = {
+	"gpio24",
+};
+
+static const char *const sp_cmu_groups[] = {
+	"gpio64",
+};
+
+static const char *const ter_mi2s_groups[] = {
+	"gpio115", "gpio116", "gpio117", "gpio118",
+};
+
+static const char *const tgu_ch_groups[] = {
+	"gpio89", "gpio90", "gpio91", "gpio92",
+};
+
+static const char *const uim1_groups[] = {
+	"gpio77", "gpio78", "gpio79", "gpio80",
+};
+
+static const char *const uim2_groups[] = {
+	"gpio73", "gpio74", "gpio75", "gpio76",
+};
+
+static const char *const usb0_hs_groups[] = {
+	"gpio88",
+};
+
+static const char *const usb1_hs_groups[] = {
+	"gpio89",
+};
+
+static const char *const usb_phy_ps_groups[] = {
+	"gpio104",
+};
+
+static const char *const vfr_1_groups[] = {
+	"gpio92",
+};
+
+static const char *const vsense_trigger_mirnat_groups[] = {
+	"gpio7",
+};
+
+static const char *const wlan_groups[] = {
+	"gpio16", "gpio17", "gpio47", "gpio48",
+};
+
+static const char *const wsa_clk_groups[] = {
+	"gpio111",
+};
+
+static const char *const wsa_data_groups[] = {
+	"gpio110",
+};
+
+static const struct pinfunction qcs615_functions[] = {
+	MSM_PIN_FUNCTION(gpio),
+	MSM_PIN_FUNCTION(adsp_ext),
+	MSM_PIN_FUNCTION(agera_pll),
+	MSM_PIN_FUNCTION(aoss_cti),
+	MSM_PIN_FUNCTION(atest_char),
+	MSM_PIN_FUNCTION(atest_tsens),
+	MSM_PIN_FUNCTION(atest_usb),
+	MSM_PIN_FUNCTION(cam_mclk),
+	MSM_PIN_FUNCTION(cci_async),
+	MSM_PIN_FUNCTION(cci_i2c),
+	MSM_PIN_FUNCTION(cci_timer),
+	MSM_PIN_FUNCTION(copy_gp),
+	MSM_PIN_FUNCTION(copy_phase),
+	MSM_PIN_FUNCTION(cri_trng),
+	MSM_PIN_FUNCTION(dbg_out_clk),
+	MSM_PIN_FUNCTION(ddr_bist),
+	MSM_PIN_FUNCTION(ddr_pxi),
+	MSM_PIN_FUNCTION(dp_hot),
+	MSM_PIN_FUNCTION(edp_hot),
+	MSM_PIN_FUNCTION(edp_lcd),
+	MSM_PIN_FUNCTION(emac_gcc),
+	MSM_PIN_FUNCTION(emac_phy_intr),
+	MSM_PIN_FUNCTION(forced_usb),
+	MSM_PIN_FUNCTION(gcc_gp),
+	MSM_PIN_FUNCTION(gp_pdm),
+	MSM_PIN_FUNCTION(gps_tx),
+	MSM_PIN_FUNCTION(hs0_mi2s),
+	MSM_PIN_FUNCTION(hs1_mi2s),
+	MSM_PIN_FUNCTION(jitter_bist),
+	MSM_PIN_FUNCTION(ldo_en),
+	MSM_PIN_FUNCTION(ldo_update),
+	MSM_PIN_FUNCTION(m_voc),
+	MSM_PIN_FUNCTION(mclk1),
+	MSM_PIN_FUNCTION(mclk2),
+	MSM_PIN_FUNCTION(mdp_vsync),
+	MSM_PIN_FUNCTION(mdp_vsync0_out),
+	MSM_PIN_FUNCTION(mdp_vsync1_out),
+	MSM_PIN_FUNCTION(mdp_vsync2_out),
+	MSM_PIN_FUNCTION(mdp_vsync3_out),
+	MSM_PIN_FUNCTION(mdp_vsync4_out),
+	MSM_PIN_FUNCTION(mdp_vsync5_out),
+	MSM_PIN_FUNCTION(mi2s_1),
+	MSM_PIN_FUNCTION(mss_lte),
+	MSM_PIN_FUNCTION(nav_pps_in),
+	MSM_PIN_FUNCTION(nav_pps_out),
+	MSM_PIN_FUNCTION(pa_indicator_or),
+	MSM_PIN_FUNCTION(pcie_clk_req),
+	MSM_PIN_FUNCTION(pcie_ep_rst),
+	MSM_PIN_FUNCTION(phase_flag),
+	MSM_PIN_FUNCTION(pll_bist),
+	MSM_PIN_FUNCTION(pll_bypassnl),
+	MSM_PIN_FUNCTION(pll_reset_n),
+	MSM_PIN_FUNCTION(prng_rosc),
+	MSM_PIN_FUNCTION(qdss_cti),
+	MSM_PIN_FUNCTION(qdss_gpio),
+	MSM_PIN_FUNCTION(qlink_enable),
+	MSM_PIN_FUNCTION(qlink_request),
+	MSM_PIN_FUNCTION(qspi),
+	MSM_PIN_FUNCTION(qup0),
+	MSM_PIN_FUNCTION(qup1),
+	MSM_PIN_FUNCTION(rgmii),
+	MSM_PIN_FUNCTION(sd_write_protect),
+	MSM_PIN_FUNCTION(sp_cmu),
+	MSM_PIN_FUNCTION(ter_mi2s),
+	MSM_PIN_FUNCTION(tgu_ch),
+	MSM_PIN_FUNCTION(uim1),
+	MSM_PIN_FUNCTION(uim2),
+	MSM_PIN_FUNCTION(usb0_hs),
+	MSM_PIN_FUNCTION(usb1_hs),
+	MSM_PIN_FUNCTION(usb_phy_ps),
+	MSM_PIN_FUNCTION(vfr_1),
+	MSM_PIN_FUNCTION(vsense_trigger_mirnat),
+	MSM_PIN_FUNCTION(wlan),
+	MSM_PIN_FUNCTION(wsa_clk),
+	MSM_PIN_FUNCTION(wsa_data),
+};
+
+/* Every pin is maintained as a single group, and missing or non-existing pin
+ * would be maintained as dummy group to synchronize pin group index with
+ * pin descriptor registered with pinctrl core.
+ * Clients would not be able to request these dummy pin groups.
+ */
+static const struct msm_pingroup qcs615_groups[] = {
+	[0] = PINGROUP(0, WEST, qup0, _, qdss_gpio, _, _, _, _, _, _),
+	[1] = PINGROUP(1, WEST, qup0, _, qdss_gpio, _, _, _, _, _, _),
+	[2] = PINGROUP(2, WEST, qup0, _, qdss_gpio, _, _, _, _, _, _),
+	[3] = PINGROUP(3, WEST, qup0, _, qdss_gpio, _, _, _, _, _, _),
+	[4] = PINGROUP(4, WEST, qup0, _, _, _, _, _, _, _, _),
+	[5] = PINGROUP(5, WEST, qup0, _, _, _, _, _, _, _, _),
+	[6] = PINGROUP(6, EAST, qup1, qdss_gpio, ddr_pxi, _, _, _, _, _, _),
+	[7] = PINGROUP(7, EAST, qup1, ddr_bist, qdss_gpio, atest_tsens,
+			vsense_trigger_mirnat, atest_usb, ddr_pxi, _, _),
+	[8] = PINGROUP(8, EAST, qup1, gp_pdm, ddr_bist, qdss_gpio, _, _, _, _, _),
+	[9] = PINGROUP(9, EAST, qup1, ddr_bist, qdss_gpio, _, _, _, _, _, _),
+	[10] = PINGROUP(10, EAST, qup1, ddr_bist, _, phase_flag, atest_usb, ddr_pxi, _, _, _),
+	[11] = PINGROUP(11, EAST, qup1, dbg_out_clk, atest_usb, ddr_pxi, _, _, _, _, _),
+	[12] = PINGROUP(12, EAST, qup1, jitter_bist, ddr_pxi, _, _, _, _, _, _),
+	[13] = PINGROUP(13, EAST, qup1, pll_bypassnl, _, ddr_pxi, _, _, _, _, _),
+	[14] = PINGROUP(14, EAST, qup1, pll_reset_n, _, qdss_gpio, _, _, _, _, _),
+	[15] = PINGROUP(15, EAST, qup1, qdss_gpio, _, _, _, _, _, _, _),
+	[16] = PINGROUP(16, WEST, qup0, _, wlan, _, _, _, _, _, _),
+	[17] = PINGROUP(17, WEST, qup0, _, wlan, _, _, _, _, _, _),
+	[18] = PINGROUP(18, WEST, qup0, _, phase_flag, _, _, _, _, _, _),
+	[19] = PINGROUP(19, WEST, qup0, _, phase_flag, _, _, _, _, _, _),
+	[20] = PINGROUP(20, SOUTH, qup1, _, phase_flag, qdss_gpio, _, _, _, _, _),
+	[21] = PINGROUP(21, SOUTH, qup1, gcc_gp, _, qdss_gpio, _, _, _, _, _),
+	[22] = PINGROUP(22, SOUTH, qup1, gcc_gp, _, _, _, _, _, _, _),
+	[23] = PINGROUP(23, SOUTH, qup1, _, phase_flag, _, _, _, _, _, _),
+	[24] = PINGROUP(24, EAST, hs1_mi2s, sd_write_protect, _, phase_flag, _, _, _, _, _),
+	[25] = PINGROUP(25, EAST, hs1_mi2s, _, phase_flag, _, _, _, _, _, _),
+	[26] = PINGROUP(26, EAST, cci_async, hs1_mi2s, jitter_bist, _, _, _, _, _, _),
+	[27] = PINGROUP(27, EAST, hs1_mi2s, pll_bist, _, _, _, _, _, _, _),
+	[28] = PINGROUP(28, EAST, cam_mclk, agera_pll, qdss_gpio, _, _, _, _, _, _),
+	[29] = PINGROUP(29, EAST, cam_mclk, _, qdss_gpio, atest_tsens, _, _, _, _, _),
+	[30] = PINGROUP(30, EAST, cam_mclk, qdss_gpio, _, _, _, _, _, _, _),
+	[31] = PINGROUP(31, EAST, cam_mclk, _, qdss_gpio, _, _, _, _, _, _),
+	[32] = PINGROUP(32, EAST, cci_i2c, _, qdss_gpio, _, _, _, _, _, _),
+	[33] = PINGROUP(33, EAST, cci_i2c, _, qdss_gpio, _, _, _, _, _, _),
+	[34] = PINGROUP(34, EAST, cci_i2c, _, qdss_gpio, _, _, _, _, _, _),
+	[35] = PINGROUP(35, EAST, cci_i2c, _, qdss_gpio, _, _, _, _, _, _),
+	[36] = PINGROUP(36, EAST, hs0_mi2s, _, _, _, _, _, _, _, _),
+	[37] = PINGROUP(37, EAST, cci_timer, hs0_mi2s, _, _, _, _, _, _, _),
+	[38] = PINGROUP(38, EAST, cci_timer, hs0_mi2s, _, phase_flag, _, _, _, _, _),
+	[39] = PINGROUP(39, EAST, cci_timer, hs0_mi2s, _, _, _, _, _, _, _),
+	[40] = PINGROUP(40, EAST, _, phase_flag, _, _, _, _, _, _, _),
+	[41] = PINGROUP(41, EAST, cci_async, cci_timer, _, phase_flag, _, _, _, _, _),
+	[42] = PINGROUP(42, EAST, cci_async, cci_timer, _, phase_flag, _, _, _, _, _),
+	[43] = PINGROUP(43, SOUTH, _, phase_flag, forced_usb, _, _, _, _, _, _),
+	[44] = PINGROUP(44, EAST, qspi, _, phase_flag, qdss_gpio, _, _, _, _, _),
+	[45] = PINGROUP(45, EAST, qspi, _, phase_flag, qdss_gpio, _, _, _, _, _),
+	[46] = PINGROUP(46, EAST, qspi, _, qdss_gpio, _, _, _, _, _, _),
+	[47] = PINGROUP(47, EAST, qspi, _, qdss_gpio, wlan, _, _, _, _, _),
+	[48] = PINGROUP(48, EAST, qspi, _, wlan, _, _, _, _, _, _),
+	[49] = PINGROUP(49, EAST, qspi, _, _, _, _, _, _, _, _),
+	[50] = PINGROUP(50, EAST, qspi, _, _, _, _, _, _, _, _),
+	[51] = PINGROUP(51, SOUTH, qlink_request, _, _, _, _, _, _, _, _),
+	[52] = PINGROUP(52, SOUTH, qlink_enable, _, _, _, _, _, _, _, _),
+	[53] = PINGROUP(53, SOUTH, pa_indicator_or, nav_pps_in, nav_pps_out, gps_tx, _,
+			phase_flag, _, _, _),
+	[54] = PINGROUP(54, SOUTH, _, gps_tx, gp_pdm, _, phase_flag, atest_usb, ddr_pxi, _, _),
+	[55] = PINGROUP(55, SOUTH, _, _, phase_flag, atest_usb, ddr_pxi, _, _, _, _),
+	[56] = PINGROUP(56, SOUTH, _, nav_pps_in, nav_pps_out, gps_tx, _, _, _, _, _),
+	[57] = PINGROUP(57, SOUTH, _, nav_pps_in, gps_tx, nav_pps_out, gcc_gp, _, _, _, _),
+	[58] = PINGROUP(58, SOUTH, _, gcc_gp, _, _, _, _, _, _, _),
+	[59] = PINGROUP(59, SOUTH, _, nav_pps_in, nav_pps_out, gps_tx, gcc_gp, _, _, _, _),
+	[60] = PINGROUP(60, SOUTH, _, nav_pps_in, nav_pps_out, gps_tx, cri_trng, _, _, _, _),
+	[61] = PINGROUP(61, SOUTH, _, cri_trng, _, _, _, _, _, _, _),
+	[62] = PINGROUP(62, SOUTH, _, cri_trng, _, _, _, _, _, _, _),
+	[63] = PINGROUP(63, SOUTH, _, _, gp_pdm, _, _, _, _, _, _),
+	[64] = PINGROUP(64, SOUTH, _, sp_cmu, _, _, _, _, _, _, _),
+	[65] = PINGROUP(65, SOUTH, _, _, _, _, _, _, _, _, _),
+	[66] = PINGROUP(66, SOUTH, _, gp_pdm, _, _, _, _, _, _, _),
+	[67] = PINGROUP(67, SOUTH, _, _, _, phase_flag, atest_usb, _, _, _, _),
+	[68] = PINGROUP(68, SOUTH, _, _, _, phase_flag, atest_usb, _, _, _, _),
+	[69] = PINGROUP(69, SOUTH, _, _, _, _, _, _, _, _, _),
+	[70] = PINGROUP(70, SOUTH, _, _, _, _, _, _, _, _, _),
+	[71] = PINGROUP(71, SOUTH, _, _, _, _, _, _, _, _, _),
+	[72] = PINGROUP(72, SOUTH, _, _, _, _, _, _, _, _, _),
+	[73] = PINGROUP(73, SOUTH, uim2, _, _, _, _, _, _, _, _),
+	[74] = PINGROUP(74, SOUTH, uim2, _, _, _, _, _, _, _, _),
+	[75] = PINGROUP(75, SOUTH, uim2, _, phase_flag, atest_usb, _, _, _, _, _),
+	[76] = PINGROUP(76, SOUTH, uim2, _, phase_flag, atest_usb, aoss_cti, _, _, _, _),
+	[77] = PINGROUP(77, SOUTH, uim1, _, phase_flag, atest_usb, _, _, _, _, _),
+	[78] = PINGROUP(78, SOUTH, uim1, gcc_gp, _, phase_flag, _, _, _, _, _),
+	[79] = PINGROUP(79, SOUTH, uim1, gp_pdm, _, phase_flag, _, _, _, _, _),
+	[80] = PINGROUP(80, SOUTH, uim1, _, phase_flag, _, _, _, _, _, _),
+	[81] = PINGROUP(81, WEST, rgmii, mdp_vsync, _, qdss_gpio, _, _, _, _, _),
+	[82] = PINGROUP(82, WEST, rgmii, mdp_vsync, _, phase_flag, qdss_gpio, _, _, _, _),
+	[83] = PINGROUP(83, WEST, rgmii, mdp_vsync, _, qdss_cti, _, _, _, _, _),
+	[84] = PINGROUP(84, SOUTH, _, phase_flag, atest_char, _, _, _, _, _, _),
+	[85] = PINGROUP(85, SOUTH, _, atest_char, _, _, _, _, _, _, _),
+	[86] = PINGROUP(86, SOUTH, copy_gp, _, atest_char, _, _, _, _, _, _),
+	[87] = PINGROUP(87, SOUTH, _, atest_char, _, _, _, _, _, _, _),
+	[88] = PINGROUP(88, WEST, _, usb0_hs, _, _, _, _, _, _, _),
+	[89] = PINGROUP(89, WEST, emac_phy_intr, pcie_ep_rst, tgu_ch, usb1_hs, _, _, _, _, _),
+	[90] = PINGROUP(90, WEST, mdp_vsync, mdp_vsync0_out, mdp_vsync1_out,
+			mdp_vsync2_out, mdp_vsync3_out, mdp_vsync4_out, mdp_vsync5_out,
+			pcie_clk_req, tgu_ch),
+	[91] = PINGROUP(91, WEST, rgmii, tgu_ch, _, _, _, _, _, _, _),
+	[92] = PINGROUP(92, WEST, rgmii, vfr_1, tgu_ch, _, phase_flag, qdss_gpio, _, _, _),
+	[93] = PINGROUP(93, WEST, rgmii, qdss_gpio, _, _, _, _, _, _, _),
+	[94] = PINGROUP(94, WEST, rgmii, qdss_gpio, _, _, _, _, _, _, _),
+	[95] = PINGROUP(95, WEST, rgmii, gp_pdm, qdss_gpio, _, _, _, _, _, _),
+	[96] = PINGROUP(96, WEST, rgmii, qdss_cti, _, _, _, _, _, _, _),
+	[97] = PINGROUP(97, WEST, rgmii, mdp_vsync, ldo_en, qdss_cti, _, _, _, _, _),
+	[98] = PINGROUP(98, WEST, mdp_vsync, ldo_update, qdss_cti, _, _, _, _, _, _),
+	[99] = PINGROUP(99, EAST, prng_rosc, _, _, _, _, _, _, _, _),
+	[100] = PINGROUP(100, WEST, _, _, _, _, _, _, _, _, _),
+	[101] = PINGROUP(101, WEST, emac_gcc, _, _, _, _, _, _, _, _),
+	[102] = PINGROUP(102, WEST, rgmii, dp_hot, emac_gcc, prng_rosc, _, _, _, _, _),
+	[103] = PINGROUP(103, WEST, rgmii, dp_hot, copy_phase, qdss_cti, _, _, _, _, _),
+	[104] = PINGROUP(104, WEST, usb_phy_ps, _, qdss_cti, dp_hot, _, _, _, _, _),
+	[105] = PINGROUP(105, SOUTH, _, _, _, _, _, _, _, _, _),
+	[106] = PINGROUP(106, EAST, mss_lte, _, _, _, _, _, _, _, _),
+	[107] = PINGROUP(107, EAST, mss_lte, _, _, _, _, _, _, _, _),
+	[108] = PINGROUP(108, SOUTH, mi2s_1, _, qdss_gpio, _, _, _, _, _, _),
+	[109] = PINGROUP(109, SOUTH, mi2s_1, _, qdss_gpio, _, _, _, _, _, _),
+	[110] = PINGROUP(110, SOUTH, wsa_data, mi2s_1, _, _, _, _, _, _, _),
+	[111] = PINGROUP(111, SOUTH, wsa_clk, mi2s_1, _, _, _, _, _, _, _),
+	[112] = PINGROUP(112, WEST, rgmii, _, qdss_cti, _, _, _, _, _, _),
+	[113] = PINGROUP(113, WEST, rgmii, edp_hot, _, qdss_cti, _, _, _, _, _),
+	[114] = PINGROUP(114, WEST, rgmii, _, _, _, _, _, _, _, _),
+	[115] = PINGROUP(115, SOUTH, ter_mi2s, atest_char, _, _, _, _, _, _, _),
+	[116] = PINGROUP(116, SOUTH, ter_mi2s, _, phase_flag, _, _, _, _, _, _),
+	[117] = PINGROUP(117, SOUTH, ter_mi2s, _, phase_flag, qdss_gpio, atest_char, _, _, _, _),
+	[118] = PINGROUP(118, SOUTH, ter_mi2s, adsp_ext, _, phase_flag, qdss_gpio, atest_char,
+			_, _, _),
+	[119] = PINGROUP(119, SOUTH, edp_lcd, _, phase_flag, qdss_gpio, atest_char, _, _, _, _),
+	[120] = PINGROUP(120, SOUTH, m_voc, qdss_gpio, atest_char, _, _, _, _, _, _),
+	[121] = PINGROUP(121, SOUTH, mclk1, atest_char, _, _, _, _, _, _, _),
+	[122] = PINGROUP(122, SOUTH, mclk2, _, _, _, _, _, _, _, _),
+	[123] = UFS_RESET(ufs_reset, 0x9f000),
+	[124] = SDC_QDSD_PINGROUP(sdc1_rclk, WEST, 0x9a000, 15, 0),
+	[125] = SDC_QDSD_PINGROUP(sdc1_clk, WEST, 0x9a000, 13, 6),
+	[126] = SDC_QDSD_PINGROUP(sdc1_cmd, WEST, 0x9a000, 11, 3),
+	[127] = SDC_QDSD_PINGROUP(sdc1_data, WEST, 0x9a000, 9, 0),
+	[128] = SDC_QDSD_PINGROUP(sdc2_clk, SOUTH, 0x98000, 14, 6),
+	[129] = SDC_QDSD_PINGROUP(sdc2_cmd, SOUTH, 0x98000, 11, 3),
+	[130] = SDC_QDSD_PINGROUP(sdc2_data, SOUTH, 0x98000, 9, 0),
+};
+
+static const struct msm_gpio_wakeirq_map qcs615_pdc_map[] = {
+	{ 1, 45 },    { 3, 31 },    { 7, 55 },    { 9, 110 },   { 11, 34 },
+	{ 13, 33 },   { 14, 35 },   { 17, 46 },   { 19, 48 },   { 21, 83 },
+	{ 22, 36 },   { 26, 38 },   { 35, 37 },   { 39, 125 },  { 41, 47 },
+	{ 47, 49 },   { 48, 51 },   { 50, 52 },   { 51, 123 },  { 55, 56 },
+	{ 56, 57 },   { 57, 58 },   { 60, 60 },   { 71, 54 },   { 80, 73 },
+	{ 81, 64 },   { 82, 50 },   { 83, 65 },   { 84, 92 },   { 85, 99 },
+	{ 86, 67 },   { 87, 84 },   { 88, 124 },  { 89, 122 },  { 90, 69 },
+	{ 92, 88 },   { 93, 75 },   { 94, 91 },   { 95, 72 },   { 96, 82 },
+	{ 97, 74 },   { 98, 95 },   { 99, 94 },   { 100, 100 }, { 101, 40 },
+	{ 102, 93 },  { 103, 77 },  { 104, 78 },  { 105, 96 },  { 107, 97 },
+	{ 108, 111 }, { 112, 112 }, { 113, 113 }, { 117, 85 },  { 118, 102 },
+	{ 119, 87 },  { 120, 114 }, { 121, 89 },  { 122, 90 },
+};
+
+static const struct msm_pinctrl_soc_data qcs615_tlmm = {
+	.pins = qcs615_pins,
+	.npins = ARRAY_SIZE(qcs615_pins),
+	.functions = qcs615_functions,
+	.nfunctions = ARRAY_SIZE(qcs615_functions),
+	.groups = qcs615_groups,
+	.ngroups = ARRAY_SIZE(qcs615_groups),
+	.ngpios = 124,
+	.tiles = qcs615_tiles,
+	.ntiles = ARRAY_SIZE(qcs615_tiles),
+	.wakeirq_map = qcs615_pdc_map,
+	.nwakeirq_map = ARRAY_SIZE(qcs615_pdc_map),
+};
+
+static const struct of_device_id qcs615_tlmm_of_match[] = {
+	{
+		.compatible = "qcom,qcs615-tlmm",
+	},
+	{},
+};
+
+static int qcs615_tlmm_probe(struct platform_device *pdev)
+{
+	return  msm_pinctrl_probe(pdev, &qcs615_tlmm);
+}
+
+static struct platform_driver qcs615_tlmm_driver = {
+	.driver = {
+		.name = "qcs615-tlmm",
+		.of_match_table = qcs615_tlmm_of_match,
+	},
+	.probe = qcs615_tlmm_probe,
+	.remove_new = msm_pinctrl_remove,
+};
+
+static int __init qcs615_tlmm_init(void)
+{
+	return platform_driver_register(&qcs615_tlmm_driver);
+}
+arch_initcall(qcs615_tlmm_init);
+
+static void __exit qcs615_tlmm_exit(void)
+{
+	platform_driver_unregister(&qcs615_tlmm_driver);
+}
+module_exit(qcs615_tlmm_exit);
+
+MODULE_DESCRIPTION("QTI QCS615 TLMM driver");
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(of, qcs615_tlmm_of_match);
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-qcs8300-lpass-lpi.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-qcs8300-lpass-lpi.c
@@ -0,0 +1,217 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * LPI GPIO pin control driver for QTi LPASS
+ */
+
+#include <linux/gpio/driver.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include "pinctrl-lpass-lpi.h"
+
+enum lpass_lpi_functions {
+	LPI_MUX_dmic1_clk,
+	LPI_MUX_dmic1_data,
+	LPI_MUX_dmic2_clk,
+	LPI_MUX_dmic2_data,
+	LPI_MUX_dmic3_clk,
+	LPI_MUX_dmic3_data,
+	LPI_MUX_dmic4_clk,
+	LPI_MUX_dmic4_data,
+	LPI_MUX_i2s1_clk,
+	LPI_MUX_i2s1_data,
+	LPI_MUX_i2s1_ws,
+	LPI_MUX_i2s2_clk,
+	LPI_MUX_i2s2_data,
+	LPI_MUX_i2s2_ws,
+	LPI_MUX_i2s3_clk,
+	LPI_MUX_i2s3_data,
+	LPI_MUX_i2s3_ws,
+	LPI_MUX_i2s4_clk,
+	LPI_MUX_i2s4_data,
+	LPI_MUX_i2s4_ws,
+	LPI_MUX_qua_mi2s_data,
+	LPI_MUX_qua_mi2s_sclk,
+	LPI_MUX_qua_mi2s_ws,
+	LPI_MUX_ext_mclk1_a,
+	LPI_MUX_ext_mclk1_b,
+	LPI_MUX_ext_mclk1_c,
+	LPI_MUX_ext_mclk1_d,
+	LPI_MUX_ext_mclk1_e,
+	LPI_MUX_gpio,
+	LPI_MUX__,
+};
+
+static int gpio0_pins[] = { 0 };
+static int gpio1_pins[] = { 1 };
+static int gpio2_pins[] = { 2 };
+static int gpio3_pins[] = { 3 };
+static int gpio4_pins[] = { 4 };
+static int gpio5_pins[] = { 5 };
+static int gpio6_pins[] = { 6 };
+static int gpio7_pins[] = { 7 };
+static int gpio8_pins[] = { 8 };
+static int gpio9_pins[] = { 9 };
+static int gpio10_pins[] = { 10 };
+static int gpio11_pins[] = { 11 };
+static int gpio12_pins[] = { 12 };
+static int gpio13_pins[] = { 13 };
+static int gpio14_pins[] = { 14 };
+static int gpio15_pins[] = { 15 };
+static int gpio16_pins[] = { 16 };
+static int gpio17_pins[] = { 17 };
+static int gpio18_pins[] = { 18 };
+static int gpio19_pins[] = { 19 };
+static int gpio20_pins[] = { 20 };
+static int gpio21_pins[] = { 21 };
+static int gpio22_pins[] = { 22 };
+
+static const struct pinctrl_pin_desc qcs8300_lpi_pins[] = {
+	PINCTRL_PIN(0, "gpio0"),
+	PINCTRL_PIN(1, "gpio1"),
+	PINCTRL_PIN(2, "gpio2"),
+	PINCTRL_PIN(3, "gpio3"),
+	PINCTRL_PIN(4, "gpio4"),
+	PINCTRL_PIN(5, "gpio5"),
+	PINCTRL_PIN(6, "gpio6"),
+	PINCTRL_PIN(7, "gpio7"),
+	PINCTRL_PIN(8, "gpio8"),
+	PINCTRL_PIN(9, "gpio9"),
+	PINCTRL_PIN(10, "gpio10"),
+	PINCTRL_PIN(11, "gpio11"),
+	PINCTRL_PIN(12, "gpio12"),
+	PINCTRL_PIN(13, "gpio13"),
+	PINCTRL_PIN(14, "gpio14"),
+	PINCTRL_PIN(15, "gpio15"),
+	PINCTRL_PIN(16, "gpio16"),
+	PINCTRL_PIN(17, "gpio17"),
+	PINCTRL_PIN(18, "gpio18"),
+	PINCTRL_PIN(19, "gpio19"),
+	PINCTRL_PIN(20, "gpio20"),
+	PINCTRL_PIN(21, "gpio21"),
+	PINCTRL_PIN(22, "gpio22"),
+};
+
+static const char * const dmic1_clk_groups[] = { "gpio6" };
+static const char * const dmic1_data_groups[] = { "gpio7" };
+static const char * const dmic2_clk_groups[] = { "gpio8" };
+static const char * const dmic2_data_groups[] = { "gpio9" };
+static const char * const i2s2_clk_groups[] = { "gpio10" };
+static const char * const i2s2_ws_groups[] = { "gpio11" };
+static const char * const dmic3_clk_groups[] = { "gpio12" };
+static const char * const dmic3_data_groups[] = { "gpio13" };
+static const char * const dmic4_clk_groups[] = { "gpio17" };
+static const char * const dmic4_data_groups[] = { "gpio18" };
+static const char * const qua_mi2s_sclk_groups[] = { "gpio0" };
+static const char * const qua_mi2s_ws_groups[] = { "gpio1" };
+static const char * const qua_mi2s_data_groups[] = { "gpio2", "gpio3", "gpio4", "gpio5" };
+static const char * const i2s1_clk_groups[] = { "gpio6" };
+static const char * const i2s1_ws_groups[] = { "gpio7" };
+static const char * const i2s1_data_groups[] = { "gpio8", "gpio9" };
+static const char * const i2s4_clk_groups[] = { "gpio12" };
+static const char * const i2s4_ws_groups[] = { "gpio13" };
+static const char * const i2s2_data_groups[] = { "gpio15", "gpio16" };
+static const char * const i2s3_clk_groups[] = { "gpio19" };
+static const char * const i2s3_ws_groups[] = { "gpio20" };
+static const char * const i2s3_data_groups[] = { "gpio21", "gpio22" };
+static const char * const i2s4_data_groups[] = { "gpio17", "gpio18" };
+static const char * const ext_mclk1_c_groups[] = { "gpio5" };
+static const char * const ext_mclk1_b_groups[] = { "gpio9" };
+static const char * const ext_mclk1_a_groups[] = { "gpio13" };
+static const char * const ext_mclk1_d_groups[] = { "gpio14" };
+static const char * const ext_mclk1_e_groups[] = { "gpio22" };
+
+static const struct lpi_pingroup qcs8300_groups[] = {
+	LPI_PINGROUP(0, LPI_NO_SLEW, qua_mi2s_sclk, _, _, _),
+	LPI_PINGROUP(1, LPI_NO_SLEW, qua_mi2s_ws, _, _, _),
+	LPI_PINGROUP(2, LPI_NO_SLEW, qua_mi2s_data, _, _, _),
+	LPI_PINGROUP(3, LPI_NO_SLEW, qua_mi2s_data, _, _, _),
+	LPI_PINGROUP(4, LPI_NO_SLEW, qua_mi2s_data, _, _, _),
+	LPI_PINGROUP(5, LPI_NO_SLEW, ext_mclk1_c, qua_mi2s_data, _, _),
+	LPI_PINGROUP(6, LPI_NO_SLEW, dmic1_clk, i2s1_clk, _, _),
+	LPI_PINGROUP(7, LPI_NO_SLEW, dmic1_data, i2s1_ws, _, _),
+	LPI_PINGROUP(8, LPI_NO_SLEW, dmic2_clk, i2s1_data, _, _),
+	LPI_PINGROUP(9, LPI_NO_SLEW, dmic2_data, i2s1_data, ext_mclk1_b, _),
+	LPI_PINGROUP(10, LPI_NO_SLEW, i2s2_clk, _, _, _),
+	LPI_PINGROUP(11, LPI_NO_SLEW, i2s2_ws, _, _, _),
+	LPI_PINGROUP(12, LPI_NO_SLEW, dmic3_clk, i2s4_clk, _, _),
+	LPI_PINGROUP(13, LPI_NO_SLEW, dmic3_data, i2s4_ws, ext_mclk1_a, _),
+	LPI_PINGROUP(14, LPI_NO_SLEW, ext_mclk1_d, _, _, _),
+	LPI_PINGROUP(15, LPI_NO_SLEW, i2s2_data, _, _, _),
+	LPI_PINGROUP(16, LPI_NO_SLEW, i2s2_data, _, _, _),
+	LPI_PINGROUP(17, LPI_NO_SLEW, dmic4_clk, i2s4_data, _, _),
+	LPI_PINGROUP(18, LPI_NO_SLEW, dmic4_data, i2s4_data, _, _),
+	LPI_PINGROUP(19, LPI_NO_SLEW, i2s3_clk, _, _, _),
+	LPI_PINGROUP(20, LPI_NO_SLEW, i2s3_ws, _, _, _),
+	LPI_PINGROUP(21, LPI_NO_SLEW, i2s3_data, _, _, _),
+	LPI_PINGROUP(22, LPI_NO_SLEW, i2s3_data, ext_mclk1_e, _, _),
+};
+
+static const struct lpi_function qcs8300_functions[] = {
+	LPI_FUNCTION(dmic1_clk),
+	LPI_FUNCTION(dmic1_data),
+	LPI_FUNCTION(dmic2_clk),
+	LPI_FUNCTION(dmic2_data),
+	LPI_FUNCTION(dmic3_clk),
+	LPI_FUNCTION(dmic3_data),
+	LPI_FUNCTION(dmic4_clk),
+	LPI_FUNCTION(dmic4_data),
+	LPI_FUNCTION(i2s1_clk),
+	LPI_FUNCTION(i2s1_data),
+	LPI_FUNCTION(i2s1_ws),
+	LPI_FUNCTION(i2s2_clk),
+	LPI_FUNCTION(i2s2_data),
+	LPI_FUNCTION(i2s2_ws),
+	LPI_FUNCTION(i2s3_clk),
+	LPI_FUNCTION(i2s3_data),
+	LPI_FUNCTION(i2s3_ws),
+	LPI_FUNCTION(i2s4_clk),
+	LPI_FUNCTION(i2s4_data),
+	LPI_FUNCTION(i2s4_ws),
+	LPI_FUNCTION(qua_mi2s_data),
+	LPI_FUNCTION(qua_mi2s_sclk),
+	LPI_FUNCTION(qua_mi2s_ws),
+	LPI_FUNCTION(ext_mclk1_a),
+	LPI_FUNCTION(ext_mclk1_b),
+	LPI_FUNCTION(ext_mclk1_c),
+	LPI_FUNCTION(ext_mclk1_d),
+	LPI_FUNCTION(ext_mclk1_e),
+};
+
+static const struct lpi_pinctrl_variant_data qcs8300_lpi_data = {
+	.pins = qcs8300_lpi_pins,
+	.npins = ARRAY_SIZE(qcs8300_lpi_pins),
+	.groups = qcs8300_groups,
+	.ngroups = ARRAY_SIZE(qcs8300_groups),
+	.functions = qcs8300_functions,
+	.nfunctions = ARRAY_SIZE(qcs8300_functions),
+};
+
+static const struct of_device_id lpi_pinctrl_of_match[] = {
+	{
+	       .compatible = "qcom,qcs8300-lpass-lpi-pinctrl",
+	       .data = &qcs8300_lpi_data,
+	},
+
+	{ }
+};
+MODULE_DEVICE_TABLE(of, lpi_pinctrl_of_match);
+
+static const struct dev_pm_ops lpi_pinctrl_pm_ops = {
+	SET_RUNTIME_PM_OPS(lpi_pinctrl_runtime_suspend, lpi_pinctrl_runtime_resume, NULL)
+};
+
+static struct platform_driver lpi_pinctrl_driver = {
+	.driver = {
+		   .name = "qcom-qcs8300-lpass-lpi-pinctrl",
+		   .of_match_table = lpi_pinctrl_of_match,
+		   .pm = &lpi_pinctrl_pm_ops,
+	},
+	.probe = lpi_pinctrl_probe,
+	.remove_new = lpi_pinctrl_remove,
+};
+
+module_platform_driver(lpi_pinctrl_driver);
+MODULE_DESCRIPTION("QTI QCS8300 LPI GPIO pin control driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-qcs8300.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-qcs8300.c
@@ -0,0 +1,1306 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include "pinctrl-msm.h"
+
+#define REG_SIZE 0x1000
+#define PINGROUP(id, f1, f2, f3, f4, f5, f6, f7, f8, f9, f10, f11)\
+	{						\
+		.grp = PINCTRL_PINGROUP("gpio" #id,	\
+			gpio##id##_pins,		\
+			ARRAY_SIZE(gpio##id##_pins)),	\
+		.funcs = (int[]){			\
+			msm_mux_gpio, /* gpio mode */	\
+			msm_mux_##f1,			\
+			msm_mux_##f2,			\
+			msm_mux_##f3,			\
+			msm_mux_##f4,			\
+			msm_mux_##f5,			\
+			msm_mux_##f6,			\
+			msm_mux_##f7,			\
+			msm_mux_##f8,			\
+			msm_mux_##f9,			\
+			msm_mux_##f10,			\
+			msm_mux_##f11 /* egpio mode */	\
+		},					\
+		.nfuncs = 12,				\
+		.ctl_reg = REG_SIZE * id,		\
+		.io_reg = 0x4 + REG_SIZE * id,		\
+		.intr_cfg_reg = 0x8 + REG_SIZE * id,	\
+		.intr_status_reg = 0xc + REG_SIZE * id,	\
+		.intr_target_reg = 0x8 + REG_SIZE * id,	\
+		.mux_bit = 2,			\
+		.pull_bit = 0,			\
+		.drv_bit = 6,			\
+		.egpio_enable = 12,		\
+		.egpio_present = 11,		\
+		.oe_bit = 9,			\
+		.in_bit = 0,			\
+		.out_bit = 1,			\
+		.intr_enable_bit = 0,		\
+		.intr_status_bit = 0,		\
+		.intr_target_bit = 5,		\
+		.intr_target_kpss_val = 3,	\
+		.intr_raw_status_bit = 4,	\
+		.intr_polarity_bit = 1,		\
+		.intr_detection_bit = 2,	\
+		.intr_detection_width = 2,	\
+	}
+
+#define SDC_QDSD_PINGROUP(pg_name, ctl, pull, drv)	\
+	{						\
+		.grp = PINCTRL_PINGROUP(#pg_name,	\
+			pg_name##_pins,			\
+			ARRAY_SIZE(pg_name##_pins)),	\
+		.ctl_reg = ctl,				\
+		.io_reg = 0,				\
+		.intr_cfg_reg = 0,			\
+		.intr_status_reg = 0,			\
+		.intr_target_reg = 0,			\
+		.mux_bit = -1,				\
+		.pull_bit = pull,			\
+		.drv_bit = drv,				\
+		.oe_bit = -1,				\
+		.in_bit = -1,				\
+		.out_bit = -1,				\
+		.intr_enable_bit = -1,			\
+		.intr_status_bit = -1,			\
+		.intr_target_bit = -1,			\
+		.intr_raw_status_bit = -1,		\
+		.intr_polarity_bit = -1,		\
+		.intr_detection_bit = -1,		\
+		.intr_detection_width = -1,		\
+	}
+
+#define UFS_RESET(pg_name, offset)			\
+	{						\
+		.grp = PINCTRL_PINGROUP(#pg_name,	\
+			pg_name##_pins,			\
+			ARRAY_SIZE(pg_name##_pins)),	\
+		.ctl_reg = offset,			\
+		.io_reg = offset + 0x4,			\
+		.intr_cfg_reg = 0,			\
+		.intr_status_reg = 0,			\
+		.intr_target_reg = 0,			\
+		.mux_bit = -1,				\
+		.pull_bit = 3,				\
+		.drv_bit = 0,				\
+		.oe_bit = -1,				\
+		.in_bit = -1,				\
+		.out_bit = 0,				\
+		.intr_enable_bit = -1,			\
+		.intr_status_bit = -1,			\
+		.intr_target_bit = -1,			\
+		.intr_raw_status_bit = -1,		\
+		.intr_polarity_bit = -1,		\
+		.intr_detection_bit = -1,		\
+		.intr_detection_width = -1,		\
+	}
+
+#define QUP_I3C(qup_mode, qup_offset)			\
+	{						\
+		.mode = qup_mode,			\
+		.offset = qup_offset,			\
+	}
+
+#define QUP_I3C_6_MODE_OFFSET	0xaf000
+#define QUP_I3C_7_MODE_OFFSET	0xb0000
+#define QUP_I3C_13_MODE_OFFSET	0xb1000
+#define QUP_I3C_14_MODE_OFFSET	0xb2000
+
+static const struct pinctrl_pin_desc qcs8300_pins[] = {
+	PINCTRL_PIN(0, "GPIO_0"),
+	PINCTRL_PIN(1, "GPIO_1"),
+	PINCTRL_PIN(2, "GPIO_2"),
+	PINCTRL_PIN(3, "GPIO_3"),
+	PINCTRL_PIN(4, "GPIO_4"),
+	PINCTRL_PIN(5, "GPIO_5"),
+	PINCTRL_PIN(6, "GPIO_6"),
+	PINCTRL_PIN(7, "GPIO_7"),
+	PINCTRL_PIN(8, "GPIO_8"),
+	PINCTRL_PIN(9, "GPIO_9"),
+	PINCTRL_PIN(10, "GPIO_10"),
+	PINCTRL_PIN(11, "GPIO_11"),
+	PINCTRL_PIN(12, "GPIO_12"),
+	PINCTRL_PIN(13, "GPIO_13"),
+	PINCTRL_PIN(14, "GPIO_14"),
+	PINCTRL_PIN(15, "GPIO_15"),
+	PINCTRL_PIN(16, "GPIO_16"),
+	PINCTRL_PIN(17, "GPIO_17"),
+	PINCTRL_PIN(18, "GPIO_18"),
+	PINCTRL_PIN(19, "GPIO_19"),
+	PINCTRL_PIN(20, "GPIO_20"),
+	PINCTRL_PIN(21, "GPIO_21"),
+	PINCTRL_PIN(22, "GPIO_22"),
+	PINCTRL_PIN(23, "GPIO_23"),
+	PINCTRL_PIN(24, "GPIO_24"),
+	PINCTRL_PIN(25, "GPIO_25"),
+	PINCTRL_PIN(26, "GPIO_26"),
+	PINCTRL_PIN(27, "GPIO_27"),
+	PINCTRL_PIN(28, "GPIO_28"),
+	PINCTRL_PIN(29, "GPIO_29"),
+	PINCTRL_PIN(30, "GPIO_30"),
+	PINCTRL_PIN(31, "GPIO_31"),
+	PINCTRL_PIN(32, "GPIO_32"),
+	PINCTRL_PIN(33, "GPIO_33"),
+	PINCTRL_PIN(34, "GPIO_34"),
+	PINCTRL_PIN(35, "GPIO_35"),
+	PINCTRL_PIN(36, "GPIO_36"),
+	PINCTRL_PIN(37, "GPIO_37"),
+	PINCTRL_PIN(38, "GPIO_38"),
+	PINCTRL_PIN(39, "GPIO_39"),
+	PINCTRL_PIN(40, "GPIO_40"),
+	PINCTRL_PIN(41, "GPIO_41"),
+	PINCTRL_PIN(42, "GPIO_42"),
+	PINCTRL_PIN(43, "GPIO_43"),
+	PINCTRL_PIN(44, "GPIO_44"),
+	PINCTRL_PIN(45, "GPIO_45"),
+	PINCTRL_PIN(46, "GPIO_46"),
+	PINCTRL_PIN(47, "GPIO_47"),
+	PINCTRL_PIN(48, "GPIO_48"),
+	PINCTRL_PIN(49, "GPIO_49"),
+	PINCTRL_PIN(50, "GPIO_50"),
+	PINCTRL_PIN(51, "GPIO_51"),
+	PINCTRL_PIN(52, "GPIO_52"),
+	PINCTRL_PIN(53, "GPIO_53"),
+	PINCTRL_PIN(54, "GPIO_54"),
+	PINCTRL_PIN(55, "GPIO_55"),
+	PINCTRL_PIN(56, "GPIO_56"),
+	PINCTRL_PIN(57, "GPIO_57"),
+	PINCTRL_PIN(58, "GPIO_58"),
+	PINCTRL_PIN(59, "GPIO_59"),
+	PINCTRL_PIN(60, "GPIO_60"),
+	PINCTRL_PIN(61, "GPIO_61"),
+	PINCTRL_PIN(62, "GPIO_62"),
+	PINCTRL_PIN(63, "GPIO_63"),
+	PINCTRL_PIN(64, "GPIO_64"),
+	PINCTRL_PIN(65, "GPIO_65"),
+	PINCTRL_PIN(66, "GPIO_66"),
+	PINCTRL_PIN(67, "GPIO_67"),
+	PINCTRL_PIN(68, "GPIO_68"),
+	PINCTRL_PIN(69, "GPIO_69"),
+	PINCTRL_PIN(70, "GPIO_70"),
+	PINCTRL_PIN(71, "GPIO_71"),
+	PINCTRL_PIN(72, "GPIO_72"),
+	PINCTRL_PIN(73, "GPIO_73"),
+	PINCTRL_PIN(74, "GPIO_74"),
+	PINCTRL_PIN(75, "GPIO_75"),
+	PINCTRL_PIN(76, "GPIO_76"),
+	PINCTRL_PIN(77, "GPIO_77"),
+	PINCTRL_PIN(78, "GPIO_78"),
+	PINCTRL_PIN(79, "GPIO_79"),
+	PINCTRL_PIN(80, "GPIO_80"),
+	PINCTRL_PIN(81, "GPIO_81"),
+	PINCTRL_PIN(82, "GPIO_82"),
+	PINCTRL_PIN(83, "GPIO_83"),
+	PINCTRL_PIN(84, "GPIO_84"),
+	PINCTRL_PIN(85, "GPIO_85"),
+	PINCTRL_PIN(86, "GPIO_86"),
+	PINCTRL_PIN(87, "GPIO_87"),
+	PINCTRL_PIN(88, "GPIO_88"),
+	PINCTRL_PIN(89, "GPIO_89"),
+	PINCTRL_PIN(90, "GPIO_90"),
+	PINCTRL_PIN(91, "GPIO_91"),
+	PINCTRL_PIN(92, "GPIO_92"),
+	PINCTRL_PIN(93, "GPIO_93"),
+	PINCTRL_PIN(94, "GPIO_94"),
+	PINCTRL_PIN(95, "GPIO_95"),
+	PINCTRL_PIN(96, "GPIO_96"),
+	PINCTRL_PIN(97, "GPIO_97"),
+	PINCTRL_PIN(98, "GPIO_98"),
+	PINCTRL_PIN(99, "GPIO_99"),
+	PINCTRL_PIN(100, "GPIO_100"),
+	PINCTRL_PIN(101, "GPIO_101"),
+	PINCTRL_PIN(102, "GPIO_102"),
+	PINCTRL_PIN(103, "GPIO_103"),
+	PINCTRL_PIN(104, "GPIO_104"),
+	PINCTRL_PIN(105, "GPIO_105"),
+	PINCTRL_PIN(106, "GPIO_106"),
+	PINCTRL_PIN(107, "GPIO_107"),
+	PINCTRL_PIN(108, "GPIO_108"),
+	PINCTRL_PIN(109, "GPIO_109"),
+	PINCTRL_PIN(110, "GPIO_110"),
+	PINCTRL_PIN(111, "GPIO_111"),
+	PINCTRL_PIN(112, "GPIO_112"),
+	PINCTRL_PIN(113, "GPIO_113"),
+	PINCTRL_PIN(114, "GPIO_114"),
+	PINCTRL_PIN(115, "GPIO_115"),
+	PINCTRL_PIN(116, "GPIO_116"),
+	PINCTRL_PIN(117, "GPIO_117"),
+	PINCTRL_PIN(118, "GPIO_118"),
+	PINCTRL_PIN(119, "GPIO_119"),
+	PINCTRL_PIN(120, "GPIO_120"),
+	PINCTRL_PIN(121, "GPIO_121"),
+	PINCTRL_PIN(122, "GPIO_122"),
+	PINCTRL_PIN(123, "GPIO_123"),
+	PINCTRL_PIN(124, "GPIO_124"),
+	PINCTRL_PIN(125, "GPIO_125"),
+	PINCTRL_PIN(126, "GPIO_126"),
+	PINCTRL_PIN(127, "GPIO_127"),
+	PINCTRL_PIN(128, "GPIO_128"),
+	PINCTRL_PIN(129, "GPIO_129"),
+	PINCTRL_PIN(130, "GPIO_130"),
+	PINCTRL_PIN(131, "GPIO_131"),
+	PINCTRL_PIN(132, "GPIO_132"),
+	PINCTRL_PIN(133, "UFS_RESET"),
+	PINCTRL_PIN(134, "SDC1_RCLK"),
+	PINCTRL_PIN(135, "SDC1_CLK"),
+	PINCTRL_PIN(136, "SDC1_CMD"),
+	PINCTRL_PIN(137, "SDC1_DATA"),
+};
+
+#define DECLARE_MSM_GPIO_PINS(pin) \
+	static const unsigned int gpio##pin##_pins[] = { pin }
+DECLARE_MSM_GPIO_PINS(0);
+DECLARE_MSM_GPIO_PINS(1);
+DECLARE_MSM_GPIO_PINS(2);
+DECLARE_MSM_GPIO_PINS(3);
+DECLARE_MSM_GPIO_PINS(4);
+DECLARE_MSM_GPIO_PINS(5);
+DECLARE_MSM_GPIO_PINS(6);
+DECLARE_MSM_GPIO_PINS(7);
+DECLARE_MSM_GPIO_PINS(8);
+DECLARE_MSM_GPIO_PINS(9);
+DECLARE_MSM_GPIO_PINS(10);
+DECLARE_MSM_GPIO_PINS(11);
+DECLARE_MSM_GPIO_PINS(12);
+DECLARE_MSM_GPIO_PINS(13);
+DECLARE_MSM_GPIO_PINS(14);
+DECLARE_MSM_GPIO_PINS(15);
+DECLARE_MSM_GPIO_PINS(16);
+DECLARE_MSM_GPIO_PINS(17);
+DECLARE_MSM_GPIO_PINS(18);
+DECLARE_MSM_GPIO_PINS(19);
+DECLARE_MSM_GPIO_PINS(20);
+DECLARE_MSM_GPIO_PINS(21);
+DECLARE_MSM_GPIO_PINS(22);
+DECLARE_MSM_GPIO_PINS(23);
+DECLARE_MSM_GPIO_PINS(24);
+DECLARE_MSM_GPIO_PINS(25);
+DECLARE_MSM_GPIO_PINS(26);
+DECLARE_MSM_GPIO_PINS(27);
+DECLARE_MSM_GPIO_PINS(28);
+DECLARE_MSM_GPIO_PINS(29);
+DECLARE_MSM_GPIO_PINS(30);
+DECLARE_MSM_GPIO_PINS(31);
+DECLARE_MSM_GPIO_PINS(32);
+DECLARE_MSM_GPIO_PINS(33);
+DECLARE_MSM_GPIO_PINS(34);
+DECLARE_MSM_GPIO_PINS(35);
+DECLARE_MSM_GPIO_PINS(36);
+DECLARE_MSM_GPIO_PINS(37);
+DECLARE_MSM_GPIO_PINS(38);
+DECLARE_MSM_GPIO_PINS(39);
+DECLARE_MSM_GPIO_PINS(40);
+DECLARE_MSM_GPIO_PINS(41);
+DECLARE_MSM_GPIO_PINS(42);
+DECLARE_MSM_GPIO_PINS(43);
+DECLARE_MSM_GPIO_PINS(44);
+DECLARE_MSM_GPIO_PINS(45);
+DECLARE_MSM_GPIO_PINS(46);
+DECLARE_MSM_GPIO_PINS(47);
+DECLARE_MSM_GPIO_PINS(48);
+DECLARE_MSM_GPIO_PINS(49);
+DECLARE_MSM_GPIO_PINS(50);
+DECLARE_MSM_GPIO_PINS(51);
+DECLARE_MSM_GPIO_PINS(52);
+DECLARE_MSM_GPIO_PINS(53);
+DECLARE_MSM_GPIO_PINS(54);
+DECLARE_MSM_GPIO_PINS(55);
+DECLARE_MSM_GPIO_PINS(56);
+DECLARE_MSM_GPIO_PINS(57);
+DECLARE_MSM_GPIO_PINS(58);
+DECLARE_MSM_GPIO_PINS(59);
+DECLARE_MSM_GPIO_PINS(60);
+DECLARE_MSM_GPIO_PINS(61);
+DECLARE_MSM_GPIO_PINS(62);
+DECLARE_MSM_GPIO_PINS(63);
+DECLARE_MSM_GPIO_PINS(64);
+DECLARE_MSM_GPIO_PINS(65);
+DECLARE_MSM_GPIO_PINS(66);
+DECLARE_MSM_GPIO_PINS(67);
+DECLARE_MSM_GPIO_PINS(68);
+DECLARE_MSM_GPIO_PINS(69);
+DECLARE_MSM_GPIO_PINS(70);
+DECLARE_MSM_GPIO_PINS(71);
+DECLARE_MSM_GPIO_PINS(72);
+DECLARE_MSM_GPIO_PINS(73);
+DECLARE_MSM_GPIO_PINS(74);
+DECLARE_MSM_GPIO_PINS(75);
+DECLARE_MSM_GPIO_PINS(76);
+DECLARE_MSM_GPIO_PINS(77);
+DECLARE_MSM_GPIO_PINS(78);
+DECLARE_MSM_GPIO_PINS(79);
+DECLARE_MSM_GPIO_PINS(80);
+DECLARE_MSM_GPIO_PINS(81);
+DECLARE_MSM_GPIO_PINS(82);
+DECLARE_MSM_GPIO_PINS(83);
+DECLARE_MSM_GPIO_PINS(84);
+DECLARE_MSM_GPIO_PINS(85);
+DECLARE_MSM_GPIO_PINS(86);
+DECLARE_MSM_GPIO_PINS(87);
+DECLARE_MSM_GPIO_PINS(88);
+DECLARE_MSM_GPIO_PINS(89);
+DECLARE_MSM_GPIO_PINS(90);
+DECLARE_MSM_GPIO_PINS(91);
+DECLARE_MSM_GPIO_PINS(92);
+DECLARE_MSM_GPIO_PINS(93);
+DECLARE_MSM_GPIO_PINS(94);
+DECLARE_MSM_GPIO_PINS(95);
+DECLARE_MSM_GPIO_PINS(96);
+DECLARE_MSM_GPIO_PINS(97);
+DECLARE_MSM_GPIO_PINS(98);
+DECLARE_MSM_GPIO_PINS(99);
+DECLARE_MSM_GPIO_PINS(100);
+DECLARE_MSM_GPIO_PINS(101);
+DECLARE_MSM_GPIO_PINS(102);
+DECLARE_MSM_GPIO_PINS(103);
+DECLARE_MSM_GPIO_PINS(104);
+DECLARE_MSM_GPIO_PINS(105);
+DECLARE_MSM_GPIO_PINS(106);
+DECLARE_MSM_GPIO_PINS(107);
+DECLARE_MSM_GPIO_PINS(108);
+DECLARE_MSM_GPIO_PINS(109);
+DECLARE_MSM_GPIO_PINS(110);
+DECLARE_MSM_GPIO_PINS(111);
+DECLARE_MSM_GPIO_PINS(112);
+DECLARE_MSM_GPIO_PINS(113);
+DECLARE_MSM_GPIO_PINS(114);
+DECLARE_MSM_GPIO_PINS(115);
+DECLARE_MSM_GPIO_PINS(116);
+DECLARE_MSM_GPIO_PINS(117);
+DECLARE_MSM_GPIO_PINS(118);
+DECLARE_MSM_GPIO_PINS(119);
+DECLARE_MSM_GPIO_PINS(120);
+DECLARE_MSM_GPIO_PINS(121);
+DECLARE_MSM_GPIO_PINS(122);
+DECLARE_MSM_GPIO_PINS(123);
+DECLARE_MSM_GPIO_PINS(124);
+DECLARE_MSM_GPIO_PINS(125);
+DECLARE_MSM_GPIO_PINS(126);
+DECLARE_MSM_GPIO_PINS(127);
+DECLARE_MSM_GPIO_PINS(128);
+DECLARE_MSM_GPIO_PINS(129);
+DECLARE_MSM_GPIO_PINS(130);
+DECLARE_MSM_GPIO_PINS(131);
+DECLARE_MSM_GPIO_PINS(132);
+
+static const unsigned int ufs_reset_pins[] = { 133 };
+static const unsigned int sdc1_rclk_pins[] = { 134 };
+static const unsigned int sdc1_clk_pins[]  = { 135 };
+static const unsigned int sdc1_cmd_pins[]  = { 136 };
+static const unsigned int sdc1_data_pins[] = { 137 };
+
+enum qcs8300_functions {
+	msm_mux_gpio,
+	msm_mux_aoss_cti,
+	msm_mux_atest_char,
+	msm_mux_atest_usb2,
+	msm_mux_audio_ref,
+	msm_mux_cam_mclk,
+	msm_mux_cci_async,
+	msm_mux_cci_i2c_scl0,
+	msm_mux_cci_i2c_scl1,
+	msm_mux_cci_i2c_scl2,
+	msm_mux_cci_i2c_scl3,
+	msm_mux_cci_i2c_scl4,
+	msm_mux_cci_i2c_scl5,
+	msm_mux_cci_i2c_sda0,
+	msm_mux_cci_i2c_sda1,
+	msm_mux_cci_i2c_sda2,
+	msm_mux_cci_i2c_sda3,
+	msm_mux_cci_i2c_sda4,
+	msm_mux_cci_i2c_sda5,
+	msm_mux_cci_timer,
+	msm_mux_cri_trng,
+	msm_mux_dbg_out,
+	msm_mux_ddr_bist,
+	msm_mux_ddr_pxi0,
+	msm_mux_ddr_pxi1,
+	msm_mux_ddr_pxi2,
+	msm_mux_ddr_pxi3,
+	msm_mux_edp0_hot,
+	msm_mux_edp0_lcd,
+	msm_mux_edp1_lcd,
+	msm_mux_egpio,
+	msm_mux_emac0_mcg0,
+	msm_mux_emac0_mcg1,
+	msm_mux_emac0_mcg2,
+	msm_mux_emac0_mcg3,
+	msm_mux_emac0_mdc,
+	msm_mux_emac0_mdio,
+	msm_mux_emac0_ptp_aux,
+	msm_mux_emac0_ptp_pps,
+	msm_mux_gcc_gp1,
+	msm_mux_gcc_gp2,
+	msm_mux_gcc_gp3,
+	msm_mux_gcc_gp4,
+	msm_mux_gcc_gp5,
+	msm_mux_hs0_mi2s,
+	msm_mux_hs1_mi2s,
+	msm_mux_hs2_mi2s,
+	msm_mux_ibi_i3c,
+	msm_mux_jitter_bist,
+	msm_mux_mdp0_vsync0,
+	msm_mux_mdp0_vsync1,
+	msm_mux_mdp0_vsync3,
+	msm_mux_mdp0_vsync6,
+	msm_mux_mdp0_vsync7,
+	msm_mux_mdp_vsync,
+	msm_mux_mi2s1_data0,
+	msm_mux_mi2s1_data1,
+	msm_mux_mi2s1_sck,
+	msm_mux_mi2s1_ws,
+	msm_mux_mi2s2_data0,
+	msm_mux_mi2s2_data1,
+	msm_mux_mi2s2_sck,
+	msm_mux_mi2s2_ws,
+	msm_mux_mi2s_mclk0,
+	msm_mux_mi2s_mclk1,
+	msm_mux_pcie0_clkreq,
+	msm_mux_pcie1_clkreq,
+	msm_mux_phase_flag,
+	msm_mux_pll_bist,
+	msm_mux_pll_clk,
+	msm_mux_prng_rosc0,
+	msm_mux_prng_rosc1,
+	msm_mux_prng_rosc2,
+	msm_mux_prng_rosc3,
+	msm_mux_qdss_cti,
+	msm_mux_qdss_gpio,
+	msm_mux_qup0_se0,
+	msm_mux_qup0_se1,
+	msm_mux_qup0_se2,
+	msm_mux_qup0_se3,
+	msm_mux_qup0_se4,
+	msm_mux_qup0_se5,
+	msm_mux_qup0_se6,
+	msm_mux_qup0_se7,
+	msm_mux_qup1_se0,
+	msm_mux_qup1_se1,
+	msm_mux_qup1_se2,
+	msm_mux_qup1_se3,
+	msm_mux_qup1_se4,
+	msm_mux_qup1_se5,
+	msm_mux_qup1_se6,
+	msm_mux_qup1_se7,
+	msm_mux_qup2_se0,
+	msm_mux_sailss_emac0,
+	msm_mux_sailss_ospi,
+	msm_mux_sgmii_phy,
+	msm_mux_tb_trig,
+	msm_mux_tgu_ch0,
+	msm_mux_tgu_ch1,
+	msm_mux_tgu_ch2,
+	msm_mux_tgu_ch3,
+	msm_mux_tsense_pwm1,
+	msm_mux_tsense_pwm2,
+	msm_mux_tsense_pwm3,
+	msm_mux_tsense_pwm4,
+	msm_mux_usb2phy_ac,
+	msm_mux_vsense_trigger,
+	msm_mux__,
+};
+
+static const char * const gpio_groups[] = {
+	"gpio0", "gpio1", "gpio2", "gpio3", "gpio4", "gpio5", "gpio6", "gpio7",
+	"gpio8", "gpio9", "gpio10", "gpio11", "gpio12", "gpio13", "gpio14",
+	"gpio15", "gpio16", "gpio17", "gpio18", "gpio19", "gpio20", "gpio21",
+	"gpio22", "gpio23", "gpio24", "gpio25", "gpio26", "gpio27", "gpio28",
+	"gpio29", "gpio30", "gpio31", "gpio32", "gpio33", "gpio34", "gpio35",
+	"gpio36", "gpio37", "gpio38", "gpio39", "gpio40", "gpio41", "gpio42",
+	"gpio43", "gpio44", "gpio45", "gpio46", "gpio47", "gpio48", "gpio49",
+	"gpio50", "gpio51", "gpio52", "gpio53", "gpio54", "gpio55", "gpio56",
+	"gpio57", "gpio58", "gpio59", "gpio60", "gpio61", "gpio62", "gpio63",
+	"gpio64", "gpio65", "gpio66", "gpio67", "gpio68", "gpio69", "gpio70",
+	"gpio71", "gpio72", "gpio73", "gpio74", "gpio75", "gpio76", "gpio77",
+	"gpio78", "gpio79", "gpio80", "gpio81", "gpio82", "gpio83", "gpio84",
+	"gpio85", "gpio86", "gpio87", "gpio88", "gpio89", "gpio90", "gpio91",
+	"gpio92", "gpio93", "gpio94", "gpio95", "gpio96", "gpio97", "gpio98",
+	"gpio99", "gpio100", "gpio101", "gpio102", "gpio103", "gpio104",
+	"gpio105", "gpio106", "gpio107", "gpio108", "gpio109", "gpio110",
+	"gpio111", "gpio112", "gpio113", "gpio114", "gpio115", "gpio116",
+	"gpio117", "gpio118", "gpio119", "gpio120", "gpio121", "gpio122",
+	"gpio123", "gpio124", "gpio125", "gpio126", "gpio127", "gpio128",
+	"gpio129", "gpio130", "gpio131", "gpio132",
+};
+
+static const char *const aoss_cti_groups[] = {
+	"gpio37", "gpio38", "gpio39", "gpio40",
+};
+
+static const char * const atest_char_groups[] = {
+	"gpio66", "gpio70", "gpio71", "gpio72", "gpio93",
+};
+
+static const char * const atest_usb2_groups[] = {
+	"gpio63", "gpio83", "gpio92", "gpio74", "gpio84", "gpio87", "gpio67",
+	"gpio75", "gpio85", "gpio65", "gpio68", "gpio80", "gpio64", "gpio69",
+	"gpio81",
+};
+
+static const char * const audio_ref_groups[] = {
+	"gpio105",
+};
+
+static const char * const cam_mclk_groups[] = {
+	"gpio67", "gpio68", "gpio69",
+};
+
+static const char * const cci_async_groups[] = {
+	"gpio63", "gpio64", "gpio65", "gpio29", "gpio30", "gpio31",
+};
+
+static const char *const cci_i2c_scl0_groups[] = {
+	"gpio58",
+};
+
+static const char *const cci_i2c_scl1_groups[] = {
+	"gpio30",
+};
+
+static const char *const cci_i2c_scl2_groups[] = {
+	"gpio60",
+};
+
+static const char *const cci_i2c_scl3_groups[] = {
+	"gpio32",
+};
+
+static const char *const cci_i2c_scl4_groups[] = {
+	"gpio62",
+};
+
+static const char *const cci_i2c_scl5_groups[] = {
+	"gpio55",
+};
+
+static const char *const cci_i2c_sda0_groups[] = {
+	"gpio57",
+};
+
+static const char *const cci_i2c_sda1_groups[] = {
+	"gpio29",
+};
+
+static const char *const cci_i2c_sda2_groups[] = {
+	"gpio59",
+};
+
+static const char *const cci_i2c_sda3_groups[] = {
+	"gpio31",
+};
+
+static const char *const cci_i2c_sda4_groups[] = {
+	"gpio61",
+};
+
+static const char *const cci_i2c_sda5_groups[] = {
+	"gpio54",
+};
+
+static const char *const cci_timer_groups[] = {
+	"gpio63", "gpio64", "gpio65", "gpio49", "gpio50", "gpio19",
+	"gpio20", "gpio21", "gpio22", "gpio23",
+};
+
+static const char *const cri_trng_groups[] = {
+	"gpio92", "gpio90", "gpio91",
+};
+
+static const char *const dbg_out_groups[] = {
+	"gpio75",
+};
+
+static const char * const ddr_bist_groups[] = {
+	"gpio53", "gpio54", "gpio55", "gpio56",
+};
+
+static const char *const ddr_pxi0_groups[] = {
+	"gpio68", "gpio69",
+};
+
+static const char *const ddr_pxi1_groups[] = {
+	"gpio49", "gpio50",
+};
+
+static const char *const ddr_pxi2_groups[] = {
+	"gpio52", "gpio83",
+};
+
+static const char *const ddr_pxi3_groups[] = {
+	"gpio80", "gpio81",
+};
+
+static const char *const edp0_hot_groups[] = {
+	"gpio94",
+};
+
+static const char *const edp0_lcd_groups[] = {
+	"gpio48",
+};
+
+static const char *const edp1_lcd_groups[] = {
+	"gpio49",
+};
+
+static const char *const egpio_groups[] = {
+	"gpio110", "gpio111", "gpio112", "gpio113", "gpio114", "gpio115",
+	"gpio116", "gpio117", "gpio118", "gpio119", "gpio120", "gpio121",
+	"gpio122", "gpio123", "gpio124", "gpio125", "gpio126", "gpio127",
+	"gpio128", "gpio129", "gpio130", "gpio131", "gpio132",
+};
+
+static const char *const emac0_mcg0_groups[] = {
+	"gpio10",
+};
+
+static const char *const emac0_mcg1_groups[] = {
+	"gpio11",
+};
+
+static const char *const emac0_mcg2_groups[] = {
+	"gpio24",
+};
+
+static const char *const emac0_mcg3_groups[] = {
+	"gpio79",
+};
+
+static const char *const emac0_mdc_groups[] = {
+	"gpio5",
+};
+
+static const char *const emac0_mdio_groups[] = {
+	"gpio6",
+};
+
+static const char * const emac0_ptp_aux_groups[] = {
+	"gpio24", "gpio31", "gpio32", "gpio79",
+};
+
+static const char * const emac0_ptp_pps_groups[] = {
+	"gpio24", "gpio29", "gpio30", "gpio79",
+};
+
+static const char *const gcc_gp1_groups[] = {
+	"gpio35", "gpio84",
+};
+
+static const char *const gcc_gp2_groups[] = {
+	"gpio36", "gpio81",
+};
+
+static const char *const gcc_gp3_groups[] = {
+	"gpio69", "gpio82",
+};
+
+static const char *const gcc_gp4_groups[] = {
+	"gpio68", "gpio83",
+};
+
+static const char *const gcc_gp5_groups[] = {
+	"gpio76", "gpio77",
+};
+
+static const char * const hs0_mi2s_groups[] = {
+	"gpio106", "gpio107", "gpio108", "gpio109",
+};
+
+static const char * const hs1_mi2s_groups[] = {
+	"gpio45", "gpio46", "gpio47", "gpio48",
+};
+
+static const char * const hs2_mi2s_groups[] = {
+	"gpio49", "gpio50", "gpio51", "gpio52",
+};
+
+static const char * const ibi_i3c_groups[] = {
+	"gpio17", "gpio18", "gpio19", "gpio20", "gpio37", "gpio38",
+	"gpio39", "gpio40",
+};
+
+static const char *const jitter_bist_groups[] = {
+	"gpio97",
+};
+
+static const char *const mdp0_vsync0_groups[] = {
+	"gpio89",
+};
+
+static const char *const mdp0_vsync1_groups[] = {
+	"gpio90",
+};
+
+static const char *const mdp0_vsync3_groups[] = {
+	"gpio91",
+};
+
+static const char *const mdp0_vsync6_groups[] = {
+	"gpio80",
+};
+
+static const char *const mdp0_vsync7_groups[] = {
+	"gpio81",
+};
+
+static const char *const mdp_vsync_groups[] = {
+	"gpio42", "gpio52", "gpio32",
+};
+
+static const char *const mi2s1_data0_groups[] = {
+	"gpio100",
+};
+
+static const char *const mi2s1_data1_groups[] = {
+	"gpio101",
+};
+
+static const char *const mi2s1_sck_groups[] = {
+	"gpio98",
+};
+
+static const char *const mi2s1_ws_groups[] = {
+	"gpio99",
+};
+
+static const char *const mi2s2_data0_groups[] = {
+	"gpio104",
+};
+
+static const char *const mi2s2_data1_groups[] = {
+	"gpio105",
+};
+
+static const char *const mi2s2_sck_groups[] = {
+	"gpio102",
+};
+
+static const char *const mi2s2_ws_groups[] = {
+	"gpio103",
+};
+
+static const char *const mi2s_mclk0_groups[] = {
+	"gpio97",
+};
+
+static const char *const mi2s_mclk1_groups[] = {
+	"gpio109",
+};
+
+static const char *const pcie0_clkreq_groups[] = {
+	"gpio1",
+};
+
+static const char *const pcie1_clkreq_groups[] = {
+	"gpio22",
+};
+
+static const char *const phase_flag_groups[] = {
+	"gpio66", "gpio56", "gpio118", "gpio117", "gpio116",
+	"gpio3", "gpio114", "gpio113", "gpio112", "gpio111",
+	"gpio110", "gpio28", "gpio55", "gpio108", "gpio107",
+	"gpio106", "gpio105", "gpio104", "gpio103", "gpio102",
+	"gpio101", "gpio100", "gpio99", "gpio125", "gpio98",
+	"gpio54", "gpio25", "gpio26", "gpio122", "gpio121",
+	"gpio120", "gpio9",
+};
+
+static const char *const pll_bist_groups[] = {
+	"gpio107",
+};
+
+static const char *const pll_clk_groups[] = {
+	"gpio74",
+};
+
+static const char *const prng_rosc0_groups[] = {
+	"gpio57",
+};
+
+static const char *const prng_rosc1_groups[] = {
+	"gpio58",
+};
+
+static const char *const prng_rosc2_groups[] = {
+	"gpio59",
+};
+
+static const char *const prng_rosc3_groups[] = {
+	"gpio60",
+};
+
+static const char *const qdss_cti_groups[] = {
+	"gpio4", "gpio5", "gpio23", "gpio24", "gpio49", "gpio50",
+	"gpio51", "gpio52",
+};
+
+static const char *const qdss_gpio_groups[] = {
+	"gpio57", "gpio58", "gpio97", "gpio106",
+	"gpio59", "gpio107", "gpio60", "gpio108",
+	"gpio36", "gpio100", "gpio61", "gpio101",
+	"gpio62", "gpio102", "gpio33", "gpio103",
+	"gpio34", "gpio104", "gpio75", "gpio105",
+	"gpio72", "gpio109", "gpio71", "gpio110",
+	"gpio70", "gpio111", "gpio63", "gpio112",
+	"gpio64", "gpio113", "gpio65", "gpio114",
+	"gpio73", "gpio98", "gpio74", "gpio99",
+};
+
+static const char *const qup0_se0_groups[] = {
+	"gpio17", "gpio18", "gpio19", "gpio20",
+};
+
+static const char *const qup0_se1_groups[] = {
+	"gpio19", "gpio20", "gpio17", "gpio18",
+};
+
+static const char *const qup0_se2_groups[] = {
+	"gpio33", "gpio34", "gpio35", "gpio36",
+};
+
+static const char *const qup0_se3_groups[] = {
+	"gpio25", "gpio26", "gpio27", "gpio28",
+};
+
+static const char *const qup0_se4_groups[] = {
+	"gpio29", "gpio30", "gpio31", "gpio32",
+};
+
+static const char *const qup0_se5_groups[] = {
+	"gpio21", "gpio22", "gpio23", "gpio24",
+};
+
+static const char *const qup0_se6_groups[] = {
+	"gpio80", "gpio81", "gpio82", "gpio83",
+};
+
+static const char *const qup0_se7_groups[] = {
+	"gpio43", "gpio44", "gpio43", "gpio44",
+};
+
+static const char *const qup1_se0_groups[] = {
+	"gpio37", "gpio38", "gpio39", "gpio40",
+};
+
+static const char *const qup1_se1_groups[] = {
+	"gpio39", "gpio40", "gpio37", "gpio38",
+};
+
+static const char *const qup1_se2_groups[] = {
+	"gpio84", "gpio85", "gpio86", "gpio87", "gpio88",
+};
+
+static const char *const qup1_se3_groups[] = {
+	"gpio41", "gpio42", "gpio41", "gpio42",
+};
+
+static const char *const qup1_se4_groups[] = {
+	"gpio45", "gpio46", "gpio47", "gpio48",
+};
+
+static const char *const qup1_se5_groups[] = {
+	"gpio49", "gpio50", "gpio51", "gpio52",
+};
+
+static const char *const qup1_se6_groups[] = {
+	"gpio89", "gpio90", "gpio91", "gpio92",
+};
+
+static const char *const qup1_se7_groups[] = {
+	"gpio91", "gpio92", "gpio89", "gpio90",
+};
+
+static const char *const qup2_se0_groups[] = {
+	"gpio10", "gpio11", "gpio12", "gpio13",
+	"gpio14", "gpio15", "gpio16",
+};
+
+static const char *const sailss_emac0_groups[] = {
+	"gpio15", "gpio16",
+};
+
+static const char *const sailss_ospi_groups[] = {
+	"gpio15", "gpio16",
+};
+
+static const char *const sgmii_phy_groups[] = {
+	"gpio4",
+};
+
+static const char *const tb_trig_groups[] = {
+	"gpio14",
+};
+
+static const char *const tgu_ch0_groups[] = {
+	"gpio43",
+};
+
+static const char *const tgu_ch1_groups[] = {
+	"gpio44",
+};
+
+static const char *const tgu_ch2_groups[] = {
+	"gpio29",
+};
+
+static const char *const tgu_ch3_groups[] = {
+	"gpio30",
+};
+
+static const char *const tsense_pwm1_groups[] = {
+	"gpio79",
+};
+
+static const char *const tsense_pwm2_groups[] = {
+	"gpio78",
+};
+
+static const char *const tsense_pwm3_groups[] = {
+	"gpio77",
+};
+
+static const char *const tsense_pwm4_groups[] = {
+	"gpio76",
+};
+
+static const char *const usb2phy_ac_groups[] = {
+	"gpio7", "gpio8",
+};
+
+static const char *const vsense_trigger_groups[] = {
+	"gpio67",
+};
+
+static const struct pinfunction qcs8300_functions[] = {
+	MSM_PIN_FUNCTION(gpio),
+	MSM_PIN_FUNCTION(aoss_cti),
+	MSM_PIN_FUNCTION(atest_char),
+	MSM_PIN_FUNCTION(atest_usb2),
+	MSM_PIN_FUNCTION(audio_ref),
+	MSM_PIN_FUNCTION(cam_mclk),
+	MSM_PIN_FUNCTION(cci_async),
+	MSM_PIN_FUNCTION(cci_i2c_scl0),
+	MSM_PIN_FUNCTION(cci_i2c_scl1),
+	MSM_PIN_FUNCTION(cci_i2c_scl2),
+	MSM_PIN_FUNCTION(cci_i2c_scl3),
+	MSM_PIN_FUNCTION(cci_i2c_scl4),
+	MSM_PIN_FUNCTION(cci_i2c_scl5),
+	MSM_PIN_FUNCTION(cci_i2c_sda0),
+	MSM_PIN_FUNCTION(cci_i2c_sda1),
+	MSM_PIN_FUNCTION(cci_i2c_sda2),
+	MSM_PIN_FUNCTION(cci_i2c_sda3),
+	MSM_PIN_FUNCTION(cci_i2c_sda4),
+	MSM_PIN_FUNCTION(cci_i2c_sda5),
+	MSM_PIN_FUNCTION(cci_timer),
+	MSM_PIN_FUNCTION(cri_trng),
+	MSM_PIN_FUNCTION(dbg_out),
+	MSM_PIN_FUNCTION(ddr_bist),
+	MSM_PIN_FUNCTION(ddr_pxi0),
+	MSM_PIN_FUNCTION(ddr_pxi1),
+	MSM_PIN_FUNCTION(ddr_pxi2),
+	MSM_PIN_FUNCTION(ddr_pxi3),
+	MSM_PIN_FUNCTION(edp0_hot),
+	MSM_PIN_FUNCTION(edp0_lcd),
+	MSM_PIN_FUNCTION(edp1_lcd),
+	MSM_PIN_FUNCTION(egpio),
+	MSM_PIN_FUNCTION(emac0_mcg0),
+	MSM_PIN_FUNCTION(emac0_mcg1),
+	MSM_PIN_FUNCTION(emac0_mcg2),
+	MSM_PIN_FUNCTION(emac0_mcg3),
+	MSM_PIN_FUNCTION(emac0_mdc),
+	MSM_PIN_FUNCTION(emac0_mdio),
+	MSM_PIN_FUNCTION(emac0_ptp_aux),
+	MSM_PIN_FUNCTION(emac0_ptp_pps),
+	MSM_PIN_FUNCTION(gcc_gp1),
+	MSM_PIN_FUNCTION(gcc_gp2),
+	MSM_PIN_FUNCTION(gcc_gp3),
+	MSM_PIN_FUNCTION(gcc_gp4),
+	MSM_PIN_FUNCTION(gcc_gp5),
+	MSM_PIN_FUNCTION(hs0_mi2s),
+	MSM_PIN_FUNCTION(hs1_mi2s),
+	MSM_PIN_FUNCTION(hs2_mi2s),
+	MSM_PIN_FUNCTION(ibi_i3c),
+	MSM_PIN_FUNCTION(jitter_bist),
+	MSM_PIN_FUNCTION(mdp0_vsync0),
+	MSM_PIN_FUNCTION(mdp0_vsync1),
+	MSM_PIN_FUNCTION(mdp0_vsync3),
+	MSM_PIN_FUNCTION(mdp0_vsync6),
+	MSM_PIN_FUNCTION(mdp0_vsync7),
+	MSM_PIN_FUNCTION(mdp_vsync),
+	MSM_PIN_FUNCTION(mi2s1_data0),
+	MSM_PIN_FUNCTION(mi2s1_data1),
+	MSM_PIN_FUNCTION(mi2s1_sck),
+	MSM_PIN_FUNCTION(mi2s1_ws),
+	MSM_PIN_FUNCTION(mi2s2_data0),
+	MSM_PIN_FUNCTION(mi2s2_data1),
+	MSM_PIN_FUNCTION(mi2s2_sck),
+	MSM_PIN_FUNCTION(mi2s2_ws),
+	MSM_PIN_FUNCTION(mi2s_mclk0),
+	MSM_PIN_FUNCTION(mi2s_mclk1),
+	MSM_PIN_FUNCTION(pcie0_clkreq),
+	MSM_PIN_FUNCTION(pcie1_clkreq),
+	MSM_PIN_FUNCTION(phase_flag),
+	MSM_PIN_FUNCTION(pll_bist),
+	MSM_PIN_FUNCTION(pll_clk),
+	MSM_PIN_FUNCTION(prng_rosc0),
+	MSM_PIN_FUNCTION(prng_rosc1),
+	MSM_PIN_FUNCTION(prng_rosc2),
+	MSM_PIN_FUNCTION(prng_rosc3),
+	MSM_PIN_FUNCTION(qdss_cti),
+	MSM_PIN_FUNCTION(qdss_gpio),
+	MSM_PIN_FUNCTION(qup0_se0),
+	MSM_PIN_FUNCTION(qup0_se1),
+	MSM_PIN_FUNCTION(qup0_se2),
+	MSM_PIN_FUNCTION(qup0_se3),
+	MSM_PIN_FUNCTION(qup0_se4),
+	MSM_PIN_FUNCTION(qup0_se5),
+	MSM_PIN_FUNCTION(qup0_se6),
+	MSM_PIN_FUNCTION(qup0_se7),
+	MSM_PIN_FUNCTION(qup1_se0),
+	MSM_PIN_FUNCTION(qup1_se1),
+	MSM_PIN_FUNCTION(qup1_se2),
+	MSM_PIN_FUNCTION(qup1_se3),
+	MSM_PIN_FUNCTION(qup1_se4),
+	MSM_PIN_FUNCTION(qup1_se5),
+	MSM_PIN_FUNCTION(qup1_se6),
+	MSM_PIN_FUNCTION(qup1_se7),
+	MSM_PIN_FUNCTION(qup2_se0),
+	MSM_PIN_FUNCTION(sailss_emac0),
+	MSM_PIN_FUNCTION(sailss_ospi),
+	MSM_PIN_FUNCTION(sgmii_phy),
+	MSM_PIN_FUNCTION(tb_trig),
+	MSM_PIN_FUNCTION(tgu_ch0),
+	MSM_PIN_FUNCTION(tgu_ch1),
+	MSM_PIN_FUNCTION(tgu_ch2),
+	MSM_PIN_FUNCTION(tgu_ch3),
+	MSM_PIN_FUNCTION(tsense_pwm1),
+	MSM_PIN_FUNCTION(tsense_pwm2),
+	MSM_PIN_FUNCTION(tsense_pwm3),
+	MSM_PIN_FUNCTION(tsense_pwm4),
+	MSM_PIN_FUNCTION(usb2phy_ac),
+	MSM_PIN_FUNCTION(vsense_trigger),
+};
+
+/*
+ * Every pin is maintained as a single group, and missing or non-existing pin
+ * would be maintained as dummy group to synchronize pin group index with
+ * pin descriptor registered with pinctrl core.
+ * Clients would not be able to request these dummy pin groups.
+ */
+static const struct msm_pingroup qcs8300_groups[] = {
+	[0] = PINGROUP(0, _, _, _, _, _, _, _, _, _, _, _),
+	[1] = PINGROUP(1, pcie0_clkreq, _, _, _, _, _, _, _, _, _, _),
+	[2] = PINGROUP(2, _, _, _, _, _, _, _, _, _, _, _),
+	[3] = PINGROUP(3, phase_flag, _, _, _, _, _, _, _, _, _, _),
+	[4] = PINGROUP(4, sgmii_phy, qdss_cti, _, _, _, _, _, _, _, _, _),
+	[5] = PINGROUP(5, emac0_mdc, qdss_cti, _, _, _, _, _, _, _, _, _),
+	[6] = PINGROUP(6, emac0_mdio, _, _, _, _, _, _, _, _, _, _),
+	[7] = PINGROUP(7, usb2phy_ac, _, _, _, _, _, _, _, _, _, _),
+	[8] = PINGROUP(8, usb2phy_ac, _, _, _, _, _, _, _, _, _, _),
+	[9] = PINGROUP(9, phase_flag, _, _, _, _, _, _, _, _, _, _),
+	[10] = PINGROUP(10, qup2_se0, emac0_mcg0, _, _, _, _, _, _, _, _, _),
+	[11] = PINGROUP(11, qup2_se0, emac0_mcg1, _, _, _, _, _, _, _, _, _),
+	[12] = PINGROUP(12, qup2_se0, _, _, _, _, _, _, _, _, _, _),
+	[13] = PINGROUP(13, qup2_se0, _, _, _, _, _, _, _, _, _, _),
+	[14] = PINGROUP(14, qup2_se0, tb_trig, _, _, _, _, _, _, _, _, _),
+	[15] = PINGROUP(15, qup2_se0, _, sailss_ospi, sailss_emac0, _, _, _, _, _, _, _),
+	[16] = PINGROUP(16, qup2_se0, _, _, sailss_ospi, sailss_emac0, _, _, _, _, _, _),
+	[17] = PINGROUP(17, qup0_se0, qup0_se1, ibi_i3c, _, _, _, _, _, _, _, _),
+	[18] = PINGROUP(18, qup0_se0, qup0_se1, ibi_i3c, _, _, _, _, _, _, _, _),
+	[19] = PINGROUP(19, qup0_se1, qup0_se0, cci_timer, ibi_i3c, _, _, _, _, _, _, _),
+	[20] = PINGROUP(20, qup0_se1, qup0_se0, cci_timer, ibi_i3c, _, _, _, _, _, _, _),
+	[21] = PINGROUP(21, qup0_se5, cci_timer, _, _, _, _, _, _, _, _, _),
+	[22] = PINGROUP(22, pcie1_clkreq, qup0_se5, cci_timer, _, _, _, _, _, _, _, _),
+	[23] = PINGROUP(23, qup0_se5, cci_timer, qdss_cti, _, _, _, _, _, _, _, _),
+	[24] = PINGROUP(24, qup0_se5, emac0_ptp_aux, emac0_ptp_pps, qdss_cti,
+			emac0_mcg2, _, _, _, _, _, _),
+	[25] = PINGROUP(25, qup0_se3, phase_flag, _, _, _, _, _, _, _, _, _),
+	[26] = PINGROUP(26, qup0_se3, phase_flag, _, _, _, _, _, _, _, _, _),
+	[27] = PINGROUP(27, qup0_se3, _, _, _, _, _, _, _, _, _, _),
+	[28] = PINGROUP(28, qup0_se3, phase_flag, _, _, _, _, _, _, _, _, _),
+	[29] = PINGROUP(29, qup0_se4, cci_i2c_sda1, cci_async, emac0_ptp_pps,
+			tgu_ch2, _, _, _, _, _, _),
+	[30] = PINGROUP(30, qup0_se4, cci_i2c_scl1, cci_async, emac0_ptp_pps,
+			tgu_ch3, _, _, _, _, _, _),
+	[31] = PINGROUP(31, qup0_se4, cci_i2c_sda3, cci_async, emac0_ptp_aux, _, _, _, _, _, _, _),
+	[32] = PINGROUP(32, qup0_se4, cci_i2c_scl3, emac0_ptp_aux, mdp_vsync, _, _, _, _, _, _, _),
+	[33] = PINGROUP(33, qup0_se2, qdss_gpio, _, _, _, _, _, _, _, _, _),
+	[34] = PINGROUP(34, qup0_se2, qdss_gpio, _, _, _, _, _, _, _, _, _),
+	[35] = PINGROUP(35, qup0_se2, gcc_gp1, _, _, _, _, _, _, _, _, _),
+	[36] = PINGROUP(36, qup0_se2, gcc_gp2, qdss_gpio, _, _, _, _, _, _, _, _),
+	[37] = PINGROUP(37, qup1_se0, ibi_i3c, qup1_se1, aoss_cti, _, _, _, _, _, _, _),
+	[38] = PINGROUP(38, qup1_se0, ibi_i3c, qup1_se1, aoss_cti, _, _, _, _, _, _, _),
+	[39] = PINGROUP(39, qup1_se1, ibi_i3c, qup1_se0, aoss_cti, _, _, _, _, _, _, _),
+	[40] = PINGROUP(40, qup1_se1, ibi_i3c, qup1_se0, aoss_cti, _, _, _, _, _, _, _),
+	[41] = PINGROUP(41, qup1_se3, _, _, _, _, _, _, _, _, _, _),
+	[42] = PINGROUP(42, qup1_se3, _, mdp_vsync, _, _, _, _, _, _, _, _),
+	[43] = PINGROUP(43, qup0_se7, _, tgu_ch0, _, _, _, _, _, _, _, _),
+	[44] = PINGROUP(44, qup0_se7, _, tgu_ch1, _, _, _, _, _, _, _, _),
+	[45] = PINGROUP(45, qup1_se4, hs1_mi2s, _, _, _, _, _, _, _, _, _),
+	[46] = PINGROUP(46, qup1_se4, hs1_mi2s, _, _, _, _, _, _, _, _, _),
+	[47] = PINGROUP(47, qup1_se4, hs1_mi2s, _, _, _, _, _, _, _, _, _),
+	[48] = PINGROUP(48, qup1_se4, hs1_mi2s, edp0_lcd, _, _, _, _, _, _, _, _),
+	[49] = PINGROUP(49, qup1_se5, hs2_mi2s, cci_timer, qdss_cti, edp1_lcd,
+			ddr_pxi1, _, _, _, _, _),
+	[50] = PINGROUP(50, qup1_se5, hs2_mi2s, cci_timer, qdss_cti, _, ddr_pxi1, _, _, _, _, _),
+	[51] = PINGROUP(51, qup1_se5, hs2_mi2s, qdss_cti, _, _, _, _, _, _, _, _),
+	[52] = PINGROUP(52, qup1_se5, hs2_mi2s, qdss_cti, mdp_vsync, ddr_pxi2, _, _, _, _, _, _),
+	[53] = PINGROUP(53, ddr_bist, _, _, _, _, _, _, _, _, _, _),
+	[54] = PINGROUP(54, cci_i2c_sda5, phase_flag, ddr_bist, _, _, _, _, _, _, _, _),
+	[55] = PINGROUP(55, cci_i2c_scl5, phase_flag, ddr_bist, _, _, _, _, _, _, _, _),
+	[56] = PINGROUP(56, phase_flag, ddr_bist, _, _, _, _, _, _, _, _, _),
+	[57] = PINGROUP(57, cci_i2c_sda0, prng_rosc0, qdss_gpio, _, _, _, _, _, _, _, _),
+	[58] = PINGROUP(58, cci_i2c_scl0, prng_rosc1, qdss_gpio, _, _, _, _, _, _, _, _),
+	[59] = PINGROUP(59, cci_i2c_sda2, prng_rosc2, qdss_gpio, _, _, _, _, _, _, _, _),
+	[60] = PINGROUP(60, cci_i2c_scl2, prng_rosc3, qdss_gpio, _, _, _, _, _, _, _, _),
+	[61] = PINGROUP(61, cci_i2c_sda4, qdss_gpio, _, _, _, _, _, _, _, _, _),
+	[62] = PINGROUP(62, cci_i2c_scl4, qdss_gpio, _, _, _, _, _, _, _, _, _),
+	[63] = PINGROUP(63, cci_timer, cci_async, qdss_gpio, atest_usb2, _, _, _, _, _, _, _),
+	[64] = PINGROUP(64, cci_timer, cci_async, qdss_gpio, atest_usb2, _, _, _, _, _, _, _),
+	[65] = PINGROUP(65, cci_timer, cci_async, qdss_gpio, atest_usb2, _, _, _, _, _, _, _),
+	[66] = PINGROUP(66, phase_flag, _, atest_char, _, _, _, _, _, _, _, _),
+	[67] = PINGROUP(67, cam_mclk, vsense_trigger, atest_usb2, _, _, _, _, _, _, _, _),
+	[68] = PINGROUP(68, cam_mclk, gcc_gp4, atest_usb2, ddr_pxi0, _, _, _, _, _, _, _),
+	[69] = PINGROUP(69, cam_mclk, gcc_gp3, atest_usb2, ddr_pxi0, _, _, _, _, _, _, _),
+	[70] = PINGROUP(70, qdss_gpio, atest_char, _, _, _, _, _, _, _, _, _),
+	[71] = PINGROUP(71, qdss_gpio, atest_char, _, _, _, _, _, _, _, _, _),
+	[72] = PINGROUP(72, qdss_gpio, atest_char, _, _, _, _, _, _, _, _, _),
+	[73] = PINGROUP(73, _, qdss_gpio, _, _, _, _, _, _, _, _, _),
+	[74] = PINGROUP(74, pll_clk, qdss_gpio, atest_usb2, _, _, _, _, _, _, _, _),
+	[75] = PINGROUP(75, _, dbg_out, qdss_gpio, atest_usb2, _, _, _, _, _, _, _),
+	[76] = PINGROUP(76, gcc_gp5, tsense_pwm4, _, _, _, _, _, _, _, _, _),
+	[77] = PINGROUP(77, gcc_gp5, tsense_pwm3, _, _, _, _, _, _, _, _, _),
+	[78] = PINGROUP(78, tsense_pwm2, _, _, _, _, _, _, _, _, _, _),
+	[79] = PINGROUP(79, emac0_ptp_aux, emac0_ptp_pps, emac0_mcg3, _,
+			tsense_pwm1, _, _, _, _, _, _),
+	[80] = PINGROUP(80, qup0_se6, mdp0_vsync6, _, atest_usb2, ddr_pxi3, _, _, _, _, _, _),
+	[81] = PINGROUP(81, qup0_se6, mdp0_vsync7, gcc_gp2, _, atest_usb2, ddr_pxi3, _, _, _, _, _),
+	[82] = PINGROUP(82, qup0_se6, gcc_gp3, _, _, _, _, _, _, _, _, _),
+	[83] = PINGROUP(83, qup0_se6, gcc_gp4, _, atest_usb2, ddr_pxi2, _, _, _, _, _, _),
+	[84] = PINGROUP(84, qup1_se2, gcc_gp1, _, atest_usb2, _, _, _, _, _, _, _),
+	[85] = PINGROUP(85, qup1_se2, _, atest_usb2, _, _, _, _, _, _, _, _),
+	[86] = PINGROUP(86, qup1_se2, _, _, _, _, _, _, _, _, _, _),
+	[87] = PINGROUP(87, qup1_se2, _, atest_usb2, _, _, _, _, _, _, _, _),
+	[88] = PINGROUP(88, qup1_se2, _, _, _, _, _, _, _, _, _, _),
+	[89] = PINGROUP(89, qup1_se6, qup1_se7, mdp0_vsync0, _, _, _, _, _, _, _, _),
+	[90] = PINGROUP(90, qup1_se6, qup1_se7, mdp0_vsync1, cri_trng, _, _, _, _, _, _, _),
+	[91] = PINGROUP(91, qup1_se7, qup1_se6, mdp0_vsync3, cri_trng, _, _, _, _, _, _, _),
+	[92] = PINGROUP(92, qup1_se7, qup1_se6, cri_trng, _, atest_usb2, _, _, _, _, _, _),
+	[93] = PINGROUP(93, atest_char, _, _, _, _, _, _, _, _, _, _),
+	[94] = PINGROUP(94, edp0_hot, _, _, _, _, _, _, _, _, _, _),
+	[95] = PINGROUP(95, _, _, _, _, _, _, _, _, _, _, _),
+	[96] = PINGROUP(96, _, _, _, _, _, _, _, _, _, _, _),
+	[97] = PINGROUP(97, mi2s_mclk0, jitter_bist, qdss_gpio, _, _, _, _, _, _, _, _),
+	[98] = PINGROUP(98, mi2s1_sck, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _),
+	[99] = PINGROUP(99, mi2s1_ws, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _),
+	[100] = PINGROUP(100, mi2s1_data0, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _),
+	[101] = PINGROUP(101, mi2s1_data1, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _),
+	[102] = PINGROUP(102, mi2s2_sck, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _),
+	[103] = PINGROUP(103, mi2s2_ws, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _),
+	[104] = PINGROUP(104, mi2s2_data0, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _),
+	[105] = PINGROUP(105, mi2s2_data1, audio_ref, phase_flag, _, qdss_gpio, _, _, _, _, _, _),
+	[106] = PINGROUP(106, hs0_mi2s, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _),
+	[107] = PINGROUP(107, hs0_mi2s, pll_bist, phase_flag, _, qdss_gpio, _, _, _, _, _, _),
+	[108] = PINGROUP(108, hs0_mi2s, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _),
+	[109] = PINGROUP(109, hs0_mi2s, mi2s_mclk1, qdss_gpio, _, _, _, _, _, _, _, _),
+	[110] = PINGROUP(110, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _, egpio),
+	[111] = PINGROUP(111, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _, egpio),
+	[112] = PINGROUP(112, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _, egpio),
+	[113] = PINGROUP(113, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _, egpio),
+	[114] = PINGROUP(114, phase_flag, _, qdss_gpio, _, _, _, _, _, _, _, egpio),
+	[115] = PINGROUP(115, _, _, _, _, _, _, _, _, _, _, egpio),
+	[116] = PINGROUP(116, phase_flag, _, _, _, _, _, _, _, _, _, egpio),
+	[117] = PINGROUP(117, phase_flag, _, _, _, _, _, _, _, _, _, egpio),
+	[118] = PINGROUP(118, phase_flag, _, _, _, _, _, _, _, _, _, egpio),
+	[119] = PINGROUP(119, _, _, _, _, _, _, _, _, _, _, egpio),
+	[120] = PINGROUP(120, phase_flag, _, _, _, _, _, _, _, _, _, egpio),
+	[121] = PINGROUP(121, phase_flag, _, _, _, _, _, _, _, _, _, egpio),
+	[122] = PINGROUP(122, phase_flag, _, _, _, _, _, _, _, _, _, egpio),
+	[123] = PINGROUP(123, _, _, _, _, _, _, _, _, _, _, egpio),
+	[124] = PINGROUP(124, _, _, _, _, _, _, _, _, _, _, egpio),
+	[125] = PINGROUP(125, phase_flag, _, _, _, _, _, _, _, _, _, egpio),
+	[126] = PINGROUP(126, _, _, _, _, _, _, _, _, _, _, egpio),
+	[127] = PINGROUP(127, _, _, _, _, _, _, _, _, _, _, egpio),
+	[128] = PINGROUP(128, _, _, _, _, _, _, _, _, _, _, egpio),
+	[129] = PINGROUP(129, _, _, _, _, _, _, _, _, _, _, egpio),
+	[130] = PINGROUP(130, _, _, _, _, _, _, _, _, _, _, egpio),
+	[131] = PINGROUP(131, _, _, _, _, _, _, _, _, _, _, egpio),
+	[132] = PINGROUP(132, _, _, _, _, _, _, _, _, _, _, egpio),
+	[133] = UFS_RESET(ufs_reset, 0x92000),
+	[134] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x89000, 15, 0),
+	[135] = SDC_QDSD_PINGROUP(sdc1_clk, 0x89000, 13, 6),
+	[136] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x89000, 11, 3),
+	[137] = SDC_QDSD_PINGROUP(sdc1_data, 0x89000, 9, 0),
+};
+
+static const struct msm_gpio_wakeirq_map qcs8300_pdc_map[] = {
+	{ 0, 169 },   { 1, 174 },   { 2, 221 },   { 3, 176 },   { 4, 171 },
+	{ 9, 198 },   { 10, 187 },  { 11, 188 },  { 13, 211 },  { 16, 203 },
+	{ 17, 213 },  { 18, 209 },  { 19, 201 },  { 20, 230 },  { 21, 231 },
+	{ 22, 175 },  { 23, 170 },  { 24, 232 },  { 28, 235 },  { 29, 216 },
+	{ 31, 208 },  { 32, 200 },  { 36, 212 },  { 37, 177 },  { 38, 178 },
+	{ 39, 184 },  { 40, 185 },  { 42, 186 },  { 44, 194 },  { 45, 173 },
+	{ 48, 195 },  { 51, 215 },  { 52, 197 },  { 53, 192 },  { 56, 193 },
+	{ 66, 238 },  { 67, 172 },  { 68, 182 },  { 69, 179 },  { 70, 181 },
+	{ 71, 202 },  { 72, 183 },  { 73, 189 },  { 74, 196 },  { 75, 190 },
+	{ 76, 191 },  { 77, 204 },  { 78, 206 },  { 79, 207 },  { 83, 214 },
+	{ 84, 205 },  { 87, 237 },  { 89, 225 },  { 90, 217 },  { 91, 218 },
+	{ 92, 226 },  { 93, 227 },  { 94, 228 },  { 95, 236 },  { 97, 199 },
+	{ 98, 229 },  { 99, 180 },  { 100, 220 }, { 101, 239 }, { 102, 219 },
+	{ 103, 233 }, { 104, 234 }, { 105, 223 }, { 129, 210 }, { 130, 222 },
+};
+
+static const struct msm_pinctrl_soc_data qcs8300_pinctrl = {
+	.pins = qcs8300_pins,
+	.npins = ARRAY_SIZE(qcs8300_pins),
+	.functions = qcs8300_functions,
+	.nfunctions = ARRAY_SIZE(qcs8300_functions),
+	.groups = qcs8300_groups,
+	.ngroups = ARRAY_SIZE(qcs8300_groups),
+	.ngpios = 133,
+	.wakeirq_map = qcs8300_pdc_map,
+	.nwakeirq_map = ARRAY_SIZE(qcs8300_pdc_map),
+	.egpio_func = 11,
+};
+
+static int qcs8300_pinctrl_probe(struct platform_device *pdev)
+{
+	return msm_pinctrl_probe(pdev, &qcs8300_pinctrl);
+}
+
+static const struct of_device_id qcs8300_pinctrl_of_match[] = {
+	{ .compatible = "qcom,qcs8300-tlmm", },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, qcs8300_pinctrl_of_match);
+
+static struct platform_driver qcs8300_pinctrl_driver = {
+	.driver = {
+		.name = "qcs8300-tlmm",
+		.of_match_table = qcs8300_pinctrl_of_match,
+	},
+	.probe = qcs8300_pinctrl_probe,
+	.remove_new = msm_pinctrl_remove,
+};
+
+static int __init qcs8300_pinctrl_init(void)
+{
+	return platform_driver_register(&qcs8300_pinctrl_driver);
+}
+arch_initcall(qcs8300_pinctrl_init);
+
+static void __exit qcs8300_pinctrl_exit(void)
+{
+	platform_driver_unregister(&qcs8300_pinctrl_driver);
+}
+module_exit(qcs8300_pinctrl_exit);
+
+MODULE_DESCRIPTION("QTI QCS8300 pinctrl driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-sa7255p.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-sa7255p.c
@@ -0,0 +1,1270 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include "pinctrl-msm.h"
+
+#define REG_BASE 0x100000
+#define REG_SIZE 0x1000
+#define PINGROUP(id, f1, f2, f3, f4, f5, f6, f7, f8, f9)\
+	{						\
+		.grp = PINCTRL_PINGROUP("gpio" #id,	\
+			gpio##id##_pins,		\
+			ARRAY_SIZE(gpio##id##_pins)),	\
+		.funcs = (int[]){			\
+			msm_mux_gpio, /* gpio mode */	\
+			msm_mux_##f1,			\
+			msm_mux_##f2,			\
+			msm_mux_##f3,			\
+			msm_mux_##f4,			\
+			msm_mux_##f5,			\
+			msm_mux_##f6,			\
+			msm_mux_##f7,			\
+			msm_mux_##f8,			\
+			msm_mux_##f9			\
+		},					\
+		.nfuncs = 10,				\
+		.ctl_reg = REG_BASE + REG_SIZE * id,			\
+		.io_reg = REG_BASE + 0x4 + REG_SIZE * id,		\
+		.intr_cfg_reg = REG_BASE + 0x8 + REG_SIZE * id,		\
+		.intr_status_reg = REG_BASE + 0xc + REG_SIZE * id,	\
+		.intr_target_reg = REG_BASE + 0x8 + REG_SIZE * id,	\
+		.mux_bit = 2,			\
+		.pull_bit = 0,			\
+		.drv_bit = 6,			\
+		.egpio_enable = 12,		\
+		.egpio_present = 11,		\
+		.oe_bit = 9,			\
+		.in_bit = 0,			\
+		.out_bit = 1,			\
+		.intr_enable_bit = 0,		\
+		.intr_status_bit = 0,		\
+		.intr_target_bit = 5,		\
+		.intr_target_kpss_val = 3,	\
+		.intr_raw_status_bit = 4,	\
+		.intr_polarity_bit = 1,		\
+		.intr_detection_bit = 2,	\
+		.intr_detection_width = 2,	\
+	}
+
+#define SDC_QDSD_PINGROUP(pg_name, ctl, pull, drv)	\
+	{						\
+		.grp = PINCTRL_PINGROUP(#pg_name,	\
+			pg_name##_pins,			\
+			ARRAY_SIZE(pg_name##_pins)),	\
+		.ctl_reg = ctl,				\
+		.io_reg = 0,				\
+		.intr_cfg_reg = 0,			\
+		.intr_status_reg = 0,			\
+		.intr_target_reg = 0,			\
+		.mux_bit = -1,				\
+		.pull_bit = pull,			\
+		.drv_bit = drv,				\
+		.oe_bit = -1,				\
+		.in_bit = -1,				\
+		.out_bit = -1,				\
+		.intr_enable_bit = -1,			\
+		.intr_status_bit = -1,			\
+		.intr_target_bit = -1,			\
+		.intr_raw_status_bit = -1,		\
+		.intr_polarity_bit = -1,		\
+		.intr_detection_bit = -1,		\
+		.intr_detection_width = -1,		\
+	}
+
+#define UFS_RESET(pg_name, offset)				\
+	{						\
+		.grp = PINCTRL_PINGROUP(#pg_name,	\
+			pg_name##_pins,			\
+			ARRAY_SIZE(pg_name##_pins)),	\
+		.ctl_reg = offset,			\
+		.io_reg = offset + 0x4,			\
+		.intr_cfg_reg = 0,			\
+		.intr_status_reg = 0,			\
+		.intr_target_reg = 0,			\
+		.mux_bit = -1,				\
+		.pull_bit = 3,				\
+		.drv_bit = 0,				\
+		.oe_bit = -1,				\
+		.in_bit = -1,				\
+		.out_bit = 0,				\
+		.intr_enable_bit = -1,			\
+		.intr_status_bit = -1,			\
+		.intr_target_bit = -1,			\
+		.intr_raw_status_bit = -1,		\
+		.intr_polarity_bit = -1,		\
+		.intr_detection_bit = -1,		\
+		.intr_detection_width = -1,		\
+	}
+
+#define QUP_I3C(qup_mode, qup_offset)			\
+	{						\
+		.mode = qup_mode,			\
+		.offset = qup_offset,			\
+	}
+
+#define QUP_I3C_6_MODE_OFFSET	0xAF000
+#define QUP_I3C_7_MODE_OFFSET	0xB0000
+#define QUP_I3C_13_MODE_OFFSET	0xB1000
+#define QUP_I3C_14_MODE_OFFSET	0xB2000
+
+static const struct pinctrl_pin_desc sa7255p_pins[] = {
+	PINCTRL_PIN(0, "GPIO_0"),
+	PINCTRL_PIN(1, "GPIO_1"),
+	PINCTRL_PIN(2, "GPIO_2"),
+	PINCTRL_PIN(3, "GPIO_3"),
+	PINCTRL_PIN(4, "GPIO_4"),
+	PINCTRL_PIN(5, "GPIO_5"),
+	PINCTRL_PIN(6, "GPIO_6"),
+	PINCTRL_PIN(7, "GPIO_7"),
+	PINCTRL_PIN(8, "GPIO_8"),
+	PINCTRL_PIN(9, "GPIO_9"),
+	PINCTRL_PIN(10, "GPIO_10"),
+	PINCTRL_PIN(11, "GPIO_11"),
+	PINCTRL_PIN(12, "GPIO_12"),
+	PINCTRL_PIN(13, "GPIO_13"),
+	PINCTRL_PIN(14, "GPIO_14"),
+	PINCTRL_PIN(15, "GPIO_15"),
+	PINCTRL_PIN(16, "GPIO_16"),
+	PINCTRL_PIN(17, "GPIO_17"),
+	PINCTRL_PIN(18, "GPIO_18"),
+	PINCTRL_PIN(19, "GPIO_19"),
+	PINCTRL_PIN(20, "GPIO_20"),
+	PINCTRL_PIN(21, "GPIO_21"),
+	PINCTRL_PIN(22, "GPIO_22"),
+	PINCTRL_PIN(23, "GPIO_23"),
+	PINCTRL_PIN(24, "GPIO_24"),
+	PINCTRL_PIN(25, "GPIO_25"),
+	PINCTRL_PIN(26, "GPIO_26"),
+	PINCTRL_PIN(27, "GPIO_27"),
+	PINCTRL_PIN(28, "GPIO_28"),
+	PINCTRL_PIN(29, "GPIO_29"),
+	PINCTRL_PIN(30, "GPIO_30"),
+	PINCTRL_PIN(31, "GPIO_31"),
+	PINCTRL_PIN(32, "GPIO_32"),
+	PINCTRL_PIN(33, "GPIO_33"),
+	PINCTRL_PIN(34, "GPIO_34"),
+	PINCTRL_PIN(35, "GPIO_35"),
+	PINCTRL_PIN(36, "GPIO_36"),
+	PINCTRL_PIN(37, "GPIO_37"),
+	PINCTRL_PIN(38, "GPIO_38"),
+	PINCTRL_PIN(39, "GPIO_39"),
+	PINCTRL_PIN(40, "GPIO_40"),
+	PINCTRL_PIN(41, "GPIO_41"),
+	PINCTRL_PIN(42, "GPIO_42"),
+	PINCTRL_PIN(43, "GPIO_43"),
+	PINCTRL_PIN(44, "GPIO_44"),
+	PINCTRL_PIN(45, "GPIO_45"),
+	PINCTRL_PIN(46, "GPIO_46"),
+	PINCTRL_PIN(47, "GPIO_47"),
+	PINCTRL_PIN(48, "GPIO_48"),
+	PINCTRL_PIN(49, "GPIO_49"),
+	PINCTRL_PIN(50, "GPIO_50"),
+	PINCTRL_PIN(51, "GPIO_51"),
+	PINCTRL_PIN(52, "GPIO_52"),
+	PINCTRL_PIN(53, "GPIO_53"),
+	PINCTRL_PIN(54, "GPIO_54"),
+	PINCTRL_PIN(55, "GPIO_55"),
+	PINCTRL_PIN(56, "GPIO_56"),
+	PINCTRL_PIN(57, "GPIO_57"),
+	PINCTRL_PIN(58, "GPIO_58"),
+	PINCTRL_PIN(59, "GPIO_59"),
+	PINCTRL_PIN(60, "GPIO_60"),
+	PINCTRL_PIN(61, "GPIO_61"),
+	PINCTRL_PIN(62, "GPIO_62"),
+	PINCTRL_PIN(63, "GPIO_63"),
+	PINCTRL_PIN(64, "GPIO_64"),
+	PINCTRL_PIN(65, "GPIO_65"),
+	PINCTRL_PIN(66, "GPIO_66"),
+	PINCTRL_PIN(67, "GPIO_67"),
+	PINCTRL_PIN(68, "GPIO_68"),
+	PINCTRL_PIN(69, "GPIO_69"),
+	PINCTRL_PIN(70, "GPIO_70"),
+	PINCTRL_PIN(71, "GPIO_71"),
+	PINCTRL_PIN(72, "GPIO_72"),
+	PINCTRL_PIN(73, "GPIO_73"),
+	PINCTRL_PIN(74, "GPIO_74"),
+	PINCTRL_PIN(75, "GPIO_75"),
+	PINCTRL_PIN(76, "GPIO_76"),
+	PINCTRL_PIN(77, "GPIO_77"),
+	PINCTRL_PIN(78, "GPIO_78"),
+	PINCTRL_PIN(79, "GPIO_79"),
+	PINCTRL_PIN(80, "GPIO_80"),
+	PINCTRL_PIN(81, "GPIO_81"),
+	PINCTRL_PIN(82, "GPIO_82"),
+	PINCTRL_PIN(83, "GPIO_83"),
+	PINCTRL_PIN(84, "GPIO_84"),
+	PINCTRL_PIN(85, "GPIO_85"),
+	PINCTRL_PIN(86, "GPIO_86"),
+	PINCTRL_PIN(87, "GPIO_87"),
+	PINCTRL_PIN(88, "GPIO_88"),
+	PINCTRL_PIN(89, "GPIO_89"),
+	PINCTRL_PIN(90, "GPIO_90"),
+	PINCTRL_PIN(91, "GPIO_91"),
+	PINCTRL_PIN(92, "GPIO_92"),
+	PINCTRL_PIN(93, "GPIO_93"),
+	PINCTRL_PIN(94, "GPIO_94"),
+	PINCTRL_PIN(95, "GPIO_95"),
+	PINCTRL_PIN(96, "GPIO_96"),
+	PINCTRL_PIN(97, "GPIO_97"),
+	PINCTRL_PIN(98, "GPIO_98"),
+	PINCTRL_PIN(99, "GPIO_99"),
+	PINCTRL_PIN(100, "GPIO_100"),
+	PINCTRL_PIN(101, "GPIO_101"),
+	PINCTRL_PIN(102, "GPIO_102"),
+	PINCTRL_PIN(103, "GPIO_103"),
+	PINCTRL_PIN(104, "GPIO_104"),
+	PINCTRL_PIN(105, "GPIO_105"),
+	PINCTRL_PIN(106, "GPIO_106"),
+	PINCTRL_PIN(107, "GPIO_107"),
+	PINCTRL_PIN(108, "GPIO_108"),
+	PINCTRL_PIN(109, "GPIO_109"),
+	PINCTRL_PIN(110, "GPIO_110"),
+	PINCTRL_PIN(111, "GPIO_111"),
+	PINCTRL_PIN(112, "GPIO_112"),
+	PINCTRL_PIN(113, "GPIO_113"),
+	PINCTRL_PIN(114, "GPIO_114"),
+	PINCTRL_PIN(115, "GPIO_115"),
+	PINCTRL_PIN(116, "GPIO_116"),
+	PINCTRL_PIN(117, "GPIO_117"),
+	PINCTRL_PIN(118, "GPIO_118"),
+	PINCTRL_PIN(119, "GPIO_119"),
+	PINCTRL_PIN(120, "GPIO_120"),
+	PINCTRL_PIN(121, "GPIO_121"),
+	PINCTRL_PIN(122, "GPIO_122"),
+	PINCTRL_PIN(123, "GPIO_123"),
+	PINCTRL_PIN(124, "GPIO_124"),
+	PINCTRL_PIN(125, "GPIO_125"),
+	PINCTRL_PIN(126, "GPIO_126"),
+	PINCTRL_PIN(127, "GPIO_127"),
+	PINCTRL_PIN(128, "GPIO_128"),
+	PINCTRL_PIN(129, "GPIO_129"),
+	PINCTRL_PIN(130, "GPIO_130"),
+	PINCTRL_PIN(131, "GPIO_131"),
+	PINCTRL_PIN(132, "GPIO_132"),
+	PINCTRL_PIN(133, "UFS_RESET"),
+	PINCTRL_PIN(134, "SDC1_RCLK"),
+	PINCTRL_PIN(135, "SDC1_CLK"),
+	PINCTRL_PIN(136, "SDC1_CMD"),
+	PINCTRL_PIN(137, "SDC1_DATA"),
+};
+
+#define DECLARE_MSM_GPIO_PINS(pin) \
+	static const unsigned int gpio##pin##_pins[] = { pin }
+DECLARE_MSM_GPIO_PINS(0);
+DECLARE_MSM_GPIO_PINS(1);
+DECLARE_MSM_GPIO_PINS(2);
+DECLARE_MSM_GPIO_PINS(3);
+DECLARE_MSM_GPIO_PINS(4);
+DECLARE_MSM_GPIO_PINS(5);
+DECLARE_MSM_GPIO_PINS(6);
+DECLARE_MSM_GPIO_PINS(7);
+DECLARE_MSM_GPIO_PINS(8);
+DECLARE_MSM_GPIO_PINS(9);
+DECLARE_MSM_GPIO_PINS(10);
+DECLARE_MSM_GPIO_PINS(11);
+DECLARE_MSM_GPIO_PINS(12);
+DECLARE_MSM_GPIO_PINS(13);
+DECLARE_MSM_GPIO_PINS(14);
+DECLARE_MSM_GPIO_PINS(15);
+DECLARE_MSM_GPIO_PINS(16);
+DECLARE_MSM_GPIO_PINS(17);
+DECLARE_MSM_GPIO_PINS(18);
+DECLARE_MSM_GPIO_PINS(19);
+DECLARE_MSM_GPIO_PINS(20);
+DECLARE_MSM_GPIO_PINS(21);
+DECLARE_MSM_GPIO_PINS(22);
+DECLARE_MSM_GPIO_PINS(23);
+DECLARE_MSM_GPIO_PINS(24);
+DECLARE_MSM_GPIO_PINS(25);
+DECLARE_MSM_GPIO_PINS(26);
+DECLARE_MSM_GPIO_PINS(27);
+DECLARE_MSM_GPIO_PINS(28);
+DECLARE_MSM_GPIO_PINS(29);
+DECLARE_MSM_GPIO_PINS(30);
+DECLARE_MSM_GPIO_PINS(31);
+DECLARE_MSM_GPIO_PINS(32);
+DECLARE_MSM_GPIO_PINS(33);
+DECLARE_MSM_GPIO_PINS(34);
+DECLARE_MSM_GPIO_PINS(35);
+DECLARE_MSM_GPIO_PINS(36);
+DECLARE_MSM_GPIO_PINS(37);
+DECLARE_MSM_GPIO_PINS(38);
+DECLARE_MSM_GPIO_PINS(39);
+DECLARE_MSM_GPIO_PINS(40);
+DECLARE_MSM_GPIO_PINS(41);
+DECLARE_MSM_GPIO_PINS(42);
+DECLARE_MSM_GPIO_PINS(43);
+DECLARE_MSM_GPIO_PINS(44);
+DECLARE_MSM_GPIO_PINS(45);
+DECLARE_MSM_GPIO_PINS(46);
+DECLARE_MSM_GPIO_PINS(47);
+DECLARE_MSM_GPIO_PINS(48);
+DECLARE_MSM_GPIO_PINS(49);
+DECLARE_MSM_GPIO_PINS(50);
+DECLARE_MSM_GPIO_PINS(51);
+DECLARE_MSM_GPIO_PINS(52);
+DECLARE_MSM_GPIO_PINS(53);
+DECLARE_MSM_GPIO_PINS(54);
+DECLARE_MSM_GPIO_PINS(55);
+DECLARE_MSM_GPIO_PINS(56);
+DECLARE_MSM_GPIO_PINS(57);
+DECLARE_MSM_GPIO_PINS(58);
+DECLARE_MSM_GPIO_PINS(59);
+DECLARE_MSM_GPIO_PINS(60);
+DECLARE_MSM_GPIO_PINS(61);
+DECLARE_MSM_GPIO_PINS(62);
+DECLARE_MSM_GPIO_PINS(63);
+DECLARE_MSM_GPIO_PINS(64);
+DECLARE_MSM_GPIO_PINS(65);
+DECLARE_MSM_GPIO_PINS(66);
+DECLARE_MSM_GPIO_PINS(67);
+DECLARE_MSM_GPIO_PINS(68);
+DECLARE_MSM_GPIO_PINS(69);
+DECLARE_MSM_GPIO_PINS(70);
+DECLARE_MSM_GPIO_PINS(71);
+DECLARE_MSM_GPIO_PINS(72);
+DECLARE_MSM_GPIO_PINS(73);
+DECLARE_MSM_GPIO_PINS(74);
+DECLARE_MSM_GPIO_PINS(75);
+DECLARE_MSM_GPIO_PINS(76);
+DECLARE_MSM_GPIO_PINS(77);
+DECLARE_MSM_GPIO_PINS(78);
+DECLARE_MSM_GPIO_PINS(79);
+DECLARE_MSM_GPIO_PINS(80);
+DECLARE_MSM_GPIO_PINS(81);
+DECLARE_MSM_GPIO_PINS(82);
+DECLARE_MSM_GPIO_PINS(83);
+DECLARE_MSM_GPIO_PINS(84);
+DECLARE_MSM_GPIO_PINS(85);
+DECLARE_MSM_GPIO_PINS(86);
+DECLARE_MSM_GPIO_PINS(87);
+DECLARE_MSM_GPIO_PINS(88);
+DECLARE_MSM_GPIO_PINS(89);
+DECLARE_MSM_GPIO_PINS(90);
+DECLARE_MSM_GPIO_PINS(91);
+DECLARE_MSM_GPIO_PINS(92);
+DECLARE_MSM_GPIO_PINS(93);
+DECLARE_MSM_GPIO_PINS(94);
+DECLARE_MSM_GPIO_PINS(95);
+DECLARE_MSM_GPIO_PINS(96);
+DECLARE_MSM_GPIO_PINS(97);
+DECLARE_MSM_GPIO_PINS(98);
+DECLARE_MSM_GPIO_PINS(99);
+DECLARE_MSM_GPIO_PINS(100);
+DECLARE_MSM_GPIO_PINS(101);
+DECLARE_MSM_GPIO_PINS(102);
+DECLARE_MSM_GPIO_PINS(103);
+DECLARE_MSM_GPIO_PINS(104);
+DECLARE_MSM_GPIO_PINS(105);
+DECLARE_MSM_GPIO_PINS(106);
+DECLARE_MSM_GPIO_PINS(107);
+DECLARE_MSM_GPIO_PINS(108);
+DECLARE_MSM_GPIO_PINS(109);
+DECLARE_MSM_GPIO_PINS(110);
+DECLARE_MSM_GPIO_PINS(111);
+DECLARE_MSM_GPIO_PINS(112);
+DECLARE_MSM_GPIO_PINS(113);
+DECLARE_MSM_GPIO_PINS(114);
+DECLARE_MSM_GPIO_PINS(115);
+DECLARE_MSM_GPIO_PINS(116);
+DECLARE_MSM_GPIO_PINS(117);
+DECLARE_MSM_GPIO_PINS(118);
+DECLARE_MSM_GPIO_PINS(119);
+DECLARE_MSM_GPIO_PINS(120);
+DECLARE_MSM_GPIO_PINS(121);
+DECLARE_MSM_GPIO_PINS(122);
+DECLARE_MSM_GPIO_PINS(123);
+DECLARE_MSM_GPIO_PINS(124);
+DECLARE_MSM_GPIO_PINS(125);
+DECLARE_MSM_GPIO_PINS(126);
+DECLARE_MSM_GPIO_PINS(127);
+DECLARE_MSM_GPIO_PINS(128);
+DECLARE_MSM_GPIO_PINS(129);
+DECLARE_MSM_GPIO_PINS(130);
+DECLARE_MSM_GPIO_PINS(131);
+DECLARE_MSM_GPIO_PINS(132);
+
+static const unsigned int ufs_reset_pins[] = { 133 };
+static const unsigned int sdc1_rclk_pins[] = { 134 };
+static const unsigned int sdc1_clk_pins[]  = { 135 };
+static const unsigned int sdc1_cmd_pins[]  = { 136 };
+static const unsigned int sdc1_data_pins[] = { 137 };
+
+enum sa7255p_functions {
+	msm_mux_gpio,
+	msm_mux_aoss_cti,
+	msm_mux_atest_char,
+	msm_mux_atest_usb2,
+	msm_mux_audio_ref,
+	msm_mux_cam_mclk,
+	msm_mux_cci_async,
+	msm_mux_cci_i2c_scl,
+	msm_mux_cci_i2c_sda,
+	msm_mux_cci_timer0,
+	msm_mux_cci_timer1,
+	msm_mux_cci_timer2,
+	msm_mux_cci_timer3,
+	msm_mux_cci_timer4,
+	msm_mux_cci_timer5,
+	msm_mux_cci_timer6,
+	msm_mux_cci_timer7,
+	msm_mux_cci_timer8,
+	msm_mux_cci_timer9,
+	msm_mux_cri_trng,
+	msm_mux_cri_trng0,
+	msm_mux_cri_trng1,
+	msm_mux_dbg_out,
+	msm_mux_ddr_bist,
+	msm_mux_ddr_pxi0,
+	msm_mux_ddr_pxi1,
+	msm_mux_ddr_pxi2,
+	msm_mux_ddr_pxi3,
+	msm_mux_edp0_hot,
+	msm_mux_edp0_lcd,
+	msm_mux_edp1_lcd,
+	msm_mux_emac0_mcg0,
+	msm_mux_emac0_mcg1,
+	msm_mux_emac0_mcg2,
+	msm_mux_emac0_mcg3,
+	msm_mux_emac0_mdc,
+	msm_mux_emac0_mdio,
+	msm_mux_emac0_ptp_aux,
+	msm_mux_emac0_ptp_pps,
+	msm_mux_gcc_gp1,
+	msm_mux_gcc_gp2,
+	msm_mux_gcc_gp3,
+	msm_mux_gcc_gp4,
+	msm_mux_gcc_gp5,
+	msm_mux_hs0_mi2s,
+	msm_mux_hs1_mi2s,
+	msm_mux_hs2_mi2s,
+	msm_mux_ibi_i3c,
+	msm_mux_jitter_bist,
+	msm_mux_mdp0_vsync0,
+	msm_mux_mdp0_vsync1,
+	msm_mux_mdp0_vsync3,
+	msm_mux_mdp0_vsync6,
+	msm_mux_mdp0_vsync7,
+	msm_mux_mdp_vsync,
+	msm_mux_mi2s1_data0,
+	msm_mux_mi2s1_data1,
+	msm_mux_mi2s1_sck,
+	msm_mux_mi2s1_ws,
+	msm_mux_mi2s2_data0,
+	msm_mux_mi2s2_data1,
+	msm_mux_mi2s2_sck,
+	msm_mux_mi2s2_ws,
+	msm_mux_mi2s_mclk0,
+	msm_mux_mi2s_mclk1,
+	msm_mux_pcie0_clkreq,
+	msm_mux_pcie1_clkreq,
+	msm_mux_phase_flag,
+	msm_mux_pll_bist,
+	msm_mux_pll_clk,
+	msm_mux_prng_rosc0,
+	msm_mux_prng_rosc1,
+	msm_mux_prng_rosc2,
+	msm_mux_prng_rosc3,
+	msm_mux_qdss_cti,
+	msm_mux_qdss_gpio,
+	msm_mux_qup0_se0,
+	msm_mux_qup0_se1,
+	msm_mux_qup0_se2,
+	msm_mux_qup0_se3,
+	msm_mux_qup0_se4,
+	msm_mux_qup0_se5,
+	msm_mux_qup0_se6,
+	msm_mux_qup0_se7,
+	msm_mux_qup1_se0,
+	msm_mux_qup1_se1,
+	msm_mux_qup1_se2,
+	msm_mux_qup1_se3,
+	msm_mux_qup1_se4,
+	msm_mux_qup1_se5,
+	msm_mux_qup1_se6,
+	msm_mux_qup1_se7,
+	msm_mux_qup2_se0,
+	msm_mux_sailss_emac0,
+	msm_mux_sailss_ospi,
+	msm_mux_sgmii_phy,
+	msm_mux_tb_trig,
+	msm_mux_tgu_ch0,
+	msm_mux_tgu_ch1,
+	msm_mux_tgu_ch2,
+	msm_mux_tgu_ch3,
+	msm_mux_tsense_pwm1,
+	msm_mux_tsense_pwm2,
+	msm_mux_tsense_pwm3,
+	msm_mux_tsense_pwm4,
+	msm_mux_usb2phy_ac,
+	msm_mux_vsense_trigger,
+	msm_mux__,
+};
+
+static const char * const gpio_groups[] = {
+	"gpio0", "gpio1", "gpio2", "gpio3", "gpio4", "gpio5", "gpio6", "gpio7",
+	"gpio8", "gpio9", "gpio10", "gpio11", "gpio12", "gpio13", "gpio14",
+	"gpio15", "gpio16", "gpio17", "gpio18", "gpio19", "gpio20", "gpio21",
+	"gpio22", "gpio23", "gpio24", "gpio25", "gpio26", "gpio27", "gpio28",
+	"gpio29", "gpio30", "gpio31", "gpio32", "gpio33", "gpio34", "gpio35",
+	"gpio36", "gpio37", "gpio38", "gpio39", "gpio40", "gpio41", "gpio42",
+	"gpio43", "gpio44", "gpio45", "gpio46", "gpio47", "gpio48", "gpio49",
+	"gpio50", "gpio51", "gpio52", "gpio53", "gpio54", "gpio55", "gpio56",
+	"gpio57", "gpio58", "gpio59", "gpio60", "gpio61", "gpio62", "gpio63",
+	"gpio64", "gpio65", "gpio66", "gpio67", "gpio68", "gpio69", "gpio70",
+	"gpio71", "gpio72", "gpio73", "gpio74", "gpio75", "gpio76", "gpio77",
+	"gpio78", "gpio79", "gpio80", "gpio81", "gpio82", "gpio83", "gpio84",
+	"gpio85", "gpio86", "gpio87", "gpio88", "gpio89", "gpio90", "gpio91",
+	"gpio92", "gpio93", "gpio94", "gpio95", "gpio96", "gpio97", "gpio98",
+	"gpio99", "gpio100", "gpio101", "gpio102", "gpio103", "gpio104",
+	"gpio105", "gpio106", "gpio107", "gpio108", "gpio109", "gpio110",
+	"gpio111", "gpio112", "gpio113", "gpio114", "gpio115", "gpio116",
+	"gpio117", "gpio118", "gpio119", "gpio120", "gpio121", "gpio122",
+	"gpio123", "gpio124", "gpio125", "gpio126", "gpio127", "gpio128",
+	"gpio129", "gpio130", "gpio131", "gpio132",
+};
+
+static const char *const aoss_cti_groups[] = {
+	"gpio37", "gpio38", "gpio39", "gpio40",
+};
+
+static const char * const atest_char_groups[] = {
+	"gpio66", "gpio70", "gpio71", "gpio72", "gpio93",
+};
+
+static const char * const atest_usb2_groups[] = {
+	"gpio63", "gpio83", "gpio92", "gpio74", "gpio84", "gpio87", "gpio67",
+	"gpio75", "gpio85", "gpio65", "gpio68", "gpio80", "gpio64", "gpio69",
+	"gpio81",
+};
+
+static const char * const audio_ref_groups[] = {
+	"gpio113",
+};
+
+static const char * const cam_mclk_groups[] = {
+	"gpio67", "gpio68", "gpio69",
+};
+
+static const char * const cci_async_groups[] = {
+	"gpio63", "gpio64", "gpio65", "gpio29", "gpio30", "gpio31",
+};
+
+static const char * const cci_i2c_scl_groups[] = {
+	"gpio58", "gpio30", "gpio60", "gpio32", "gpio62", "gpio55",
+};
+
+static const char * const cci_i2c_sda_groups[] = {
+	"gpio57", "gpio29", "gpio59", "gpio31", "gpio61", "gpio54",
+};
+
+static const char *const cci_timer0_groups[] = {
+	"gpio63",
+};
+
+static const char *const cci_timer1_groups[] = {
+	"gpio64",
+};
+
+static const char *const cci_timer2_groups[] = {
+	"gpio65",
+};
+
+static const char *const cci_timer3_groups[] = {
+	"gpio49",
+};
+
+static const char *const cci_timer4_groups[] = {
+	"gpio50",
+};
+
+static const char *const cci_timer5_groups[] = {
+	"gpio19",
+};
+
+static const char *const cci_timer6_groups[] = {
+	"gpio20",
+};
+
+static const char *const cci_timer7_groups[] = {
+	"gpio21",
+};
+
+static const char *const cci_timer8_groups[] = {
+	"gpio22",
+};
+
+static const char *const cci_timer9_groups[] = {
+	"gpio23",
+};
+
+static const char *const cri_trng_groups[] = {
+	"gpio92",
+};
+
+static const char *const cri_trng0_groups[] = {
+	"gpio90",
+};
+
+static const char *const cri_trng1_groups[] = {
+	"gpio91",
+};
+
+static const char *const dbg_out_groups[] = {
+	"gpio75",
+};
+
+static const char * const ddr_bist_groups[] = {
+	"gpio53", "gpio54", "gpio55", "gpio56",
+};
+
+static const char *const ddr_pxi0_groups[] = {
+	"gpio68", "gpio69",
+};
+
+static const char *const ddr_pxi1_groups[] = {
+	"gpio49", "gpio50",
+};
+
+static const char *const ddr_pxi2_groups[] = {
+	"gpio52", "gpio83",
+};
+
+static const char *const ddr_pxi3_groups[] = {
+	"gpio80", "gpio81",
+};
+
+static const char *const edp0_hot_groups[] = {
+	"gpio94",
+};
+
+static const char *const edp0_lcd_groups[] = {
+	"gpio48",
+};
+
+static const char *const edp1_lcd_groups[] = {
+	"gpio49",
+};
+
+static const char *const emac0_mcg0_groups[] = {
+	"gpio10",
+};
+
+static const char *const emac0_mcg1_groups[] = {
+	"gpio11",
+};
+
+static const char *const emac0_mcg2_groups[] = {
+	"gpio24",
+};
+
+static const char *const emac0_mcg3_groups[] = {
+	"gpio79",
+};
+
+static const char *const emac0_mdc_groups[] = {
+	"gpio5",
+};
+
+static const char *const emac0_mdio_groups[] = {
+	"gpio6",
+};
+
+static const char * const emac0_ptp_aux_groups[] = {
+	"gpio24", "gpio31", "gpio32", "gpio79",
+};
+
+static const char * const emac0_ptp_pps_groups[] = {
+	"gpio24", "gpio29", "gpio30", "gpio79",
+};
+
+static const char *const gcc_gp1_groups[] = {
+	"gpio35", "gpio84",
+};
+
+static const char *const gcc_gp2_groups[] = {
+	"gpio36", "gpio81",
+};
+
+static const char *const gcc_gp3_groups[] = {
+	"gpio69", "gpio82",
+};
+
+static const char *const gcc_gp4_groups[] = {
+	"gpio68", "gpio83",
+};
+
+static const char *const gcc_gp5_groups[] = {
+	"gpio76", "gpio77",
+};
+
+static const char * const hs0_mi2s_groups[] = {
+	"gpio106", "gpio107", "gpio108", "gpio109",
+};
+
+static const char * const hs1_mi2s_groups[] = {
+	"gpio45", "gpio46", "gpio47", "gpio48",
+};
+
+static const char * const hs2_mi2s_groups[] = {
+	"gpio49", "gpio50", "gpio51", "gpio52",
+};
+
+static const char * const ibi_i3c_groups[] = {
+	"gpio17", "gpio18", "gpio19", "gpio20", "gpio37", "gpio38",
+	"gpio39", "gpio40",
+};
+
+static const char *const jitter_bist_groups[] = {
+	"gpio97",
+};
+
+static const char *const mdp0_vsync0_groups[] = {
+	"gpio89",
+};
+
+static const char *const mdp0_vsync1_groups[] = {
+	"gpio90",
+};
+
+static const char *const mdp0_vsync3_groups[] = {
+	"gpio91",
+};
+
+static const char *const mdp0_vsync6_groups[] = {
+	"gpio80",
+};
+
+static const char *const mdp0_vsync7_groups[] = {
+	"gpio81",
+};
+
+static const char *const mdp_vsync_groups[] = {
+	"gpio42", "gpio52", "gpio32",
+};
+
+static const char *const mi2s1_data0_groups[] = {
+	"gpio100",
+};
+
+static const char *const mi2s1_data1_groups[] = {
+	"gpio101",
+};
+
+static const char *const mi2s1_sck_groups[] = {
+	"gpio98",
+};
+
+static const char *const mi2s1_ws_groups[] = {
+	"gpio99",
+};
+
+static const char *const mi2s2_data0_groups[] = {
+	"gpio104",
+};
+
+static const char *const mi2s2_data1_groups[] = {
+	"gpio105",
+};
+
+static const char *const mi2s2_sck_groups[] = {
+	"gpio102",
+};
+
+static const char *const mi2s2_ws_groups[] = {
+	"gpio103",
+};
+
+static const char *const mi2s_mclk0_groups[] = {
+	"gpio97",
+};
+
+static const char *const mi2s_mclk1_groups[] = {
+	"gpio109",
+};
+
+static const char *const pcie0_clkreq_groups[] = {
+	"gpio1",
+};
+
+static const char *const pcie1_clkreq_groups[] = {
+	"gpio22",
+};
+
+static const char *const phase_flag_groups[] = {
+	"gpio66", "gpio56", "gpio118", "gpio117", "gpio116",
+	"gpio3", "gpio114", "gpio113", "gpio112", "gpio111",
+	"gpio110", "gpio28", "gpio55", "gpio108", "gpio107",
+	"gpio106", "gpio105", "gpio104", "gpio103", "gpio102",
+	"gpio101", "gpio100", "gpio99", "gpio125", "gpio98",
+	"gpio54", "gpio25", "gpio26", "gpio122", "gpio121",
+	"gpio120", "gpio9",
+};
+
+static const char *const pll_bist_groups[] = {
+	"gpio107",
+};
+static const char *const pll_clk_groups[] = {
+	"gpio74",
+};
+static const char *const prng_rosc0_groups[] = {
+	"gpio57",
+};
+static const char *const prng_rosc1_groups[] = {
+	"gpio58",
+};
+static const char *const prng_rosc2_groups[] = {
+	"gpio59",
+};
+static const char *const prng_rosc3_groups[] = {
+	"gpio60",
+};
+static const char *const qdss_cti_groups[] = {
+	"gpio4", "gpio5", "gpio23", "gpio24", "gpio49", "gpio50",
+	"gpio51", "gpio52",
+};
+static const char *const qdss_gpio_groups[] = {
+	"gpio57", "gpio58", "gpio97", "gpio106",
+	"gpio59", "gpio107", "gpio60", "gpio108",
+	"gpio36", "gpio100", "gpio61", "gpio101",
+	"gpio62", "gpio102", "gpio33", "gpio103",
+	"gpio34", "gpio104", "gpio75", "gpio105",
+	"gpio72", "gpio109", "gpio71", "gpio110",
+	"gpio70", "gpio111", "gpio63", "gpio112",
+	"gpio64", "gpio113", "gpio65", "gpio114",
+	"gpio73", "gpio98", "gpio74", "gpio99",
+};
+
+static const char *const qup0_se0_groups[] = {
+	"gpio17", "gpio18", "gpio19", "gpio20",
+};
+
+static const char *const qup0_se1_groups[] = {
+	"gpio19", "gpio20", "gpio17", "gpio18",
+};
+
+static const char *const qup0_se2_groups[] = {
+	"gpio33", "gpio34", "gpio35", "gpio36",
+};
+
+static const char *const qup0_se3_groups[] = {
+	"gpio25", "gpio26", "gpio27", "gpio28",
+};
+
+static const char *const qup0_se4_groups[] = {
+	"gpio29", "gpio30", "gpio31", "gpio32",
+};
+
+static const char *const qup0_se5_groups[] = {
+	"gpio21", "gpio22", "gpio23", "gpio24",
+};
+
+static const char *const qup0_se6_groups[] = {
+	"gpio80", "gpio81", "gpio82", "gpio83",
+};
+
+static const char *const qup0_se7_groups[] = {
+	"gpio43", "gpio44", "gpio43", "gpio44",
+};
+
+static const char *const qup1_se0_groups[] = {
+	"gpio37", "gpio38", "gpio39", "gpio40",
+};
+
+static const char *const qup1_se1_groups[] = {
+	"gpio39", "gpio40", "gpio37", "gpio38",
+};
+
+static const char *const qup1_se2_groups[] = {
+	"gpio84", "gpio85", "gpio86", "gpio87", "gpio88",
+};
+
+static const char *const qup1_se3_groups[] = {
+	"gpio41", "gpio42", "gpio41", "gpio42",
+};
+
+static const char *const qup1_se4_groups[] = {
+	"gpio45", "gpio46", "gpio47", "gpio48",
+};
+
+static const char *const qup1_se5_groups[] = {
+	"gpio49", "gpio50", "gpio51", "gpio52",
+};
+
+static const char *const qup1_se6_groups[] = {
+	"gpio89", "gpio90", "gpio91", "gpio92",
+};
+
+static const char *const qup1_se7_groups[] = {
+	"gpio91", "gpio92", "gpio89", "gpio90",
+};
+
+static const char *const qup2_se0_groups[] = {
+	"gpio10", "gpio11", "gpio12", "gpio13",
+	"gpio14", "gpio15", "gpio16",
+};
+
+static const char *const sailss_emac0_groups[] = {
+	"gpio15", "gpio16",
+};
+static const char *const sailss_ospi_groups[] = {
+	"gpio15", "gpio16",
+};
+static const char *const sgmii_phy_groups[] = {
+	"gpio4",
+};
+static const char *const tb_trig_groups[] = {
+	"gpio14", "gpio14",
+};
+static const char *const tgu_ch0_groups[] = {
+	"gpio43",
+};
+static const char *const tgu_ch1_groups[] = {
+	"gpio44",
+};
+static const char *const tgu_ch2_groups[] = {
+	"gpio29",
+};
+static const char *const tgu_ch3_groups[] = {
+	"gpio30",
+};
+static const char *const tsense_pwm1_groups[] = {
+	"gpio79",
+};
+static const char *const tsense_pwm2_groups[] = {
+	"gpio78",
+};
+static const char *const tsense_pwm3_groups[] = {
+	"gpio77",
+};
+static const char *const tsense_pwm4_groups[] = {
+	"gpio76",
+};
+static const char *const usb2phy_ac_groups[] = {
+	"gpio7", "gpio8",
+};
+static const char *const vsense_trigger_groups[] = {
+	"gpio67",
+};
+
+static const struct pinfunction sa7255p_functions[] = {
+	MSM_PIN_FUNCTION(gpio),
+	MSM_PIN_FUNCTION(aoss_cti),
+	MSM_PIN_FUNCTION(atest_char),
+	MSM_PIN_FUNCTION(atest_usb2),
+	MSM_PIN_FUNCTION(audio_ref),
+	MSM_PIN_FUNCTION(cam_mclk),
+	MSM_PIN_FUNCTION(cci_async),
+	MSM_PIN_FUNCTION(cci_i2c_scl),
+	MSM_PIN_FUNCTION(cci_i2c_sda),
+	MSM_PIN_FUNCTION(cci_timer0),
+	MSM_PIN_FUNCTION(cci_timer1),
+	MSM_PIN_FUNCTION(cci_timer2),
+	MSM_PIN_FUNCTION(cci_timer3),
+	MSM_PIN_FUNCTION(cci_timer4),
+	MSM_PIN_FUNCTION(cci_timer5),
+	MSM_PIN_FUNCTION(cci_timer6),
+	MSM_PIN_FUNCTION(cci_timer7),
+	MSM_PIN_FUNCTION(cci_timer8),
+	MSM_PIN_FUNCTION(cci_timer9),
+	MSM_PIN_FUNCTION(cri_trng),
+	MSM_PIN_FUNCTION(cri_trng0),
+	MSM_PIN_FUNCTION(cri_trng1),
+	MSM_PIN_FUNCTION(dbg_out),
+	MSM_PIN_FUNCTION(ddr_bist),
+	MSM_PIN_FUNCTION(ddr_pxi0),
+	MSM_PIN_FUNCTION(ddr_pxi1),
+	MSM_PIN_FUNCTION(ddr_pxi2),
+	MSM_PIN_FUNCTION(ddr_pxi3),
+	MSM_PIN_FUNCTION(edp0_hot),
+	MSM_PIN_FUNCTION(edp0_lcd),
+	MSM_PIN_FUNCTION(edp1_lcd),
+	MSM_PIN_FUNCTION(emac0_mcg0),
+	MSM_PIN_FUNCTION(emac0_mcg1),
+	MSM_PIN_FUNCTION(emac0_mcg2),
+	MSM_PIN_FUNCTION(emac0_mcg3),
+	MSM_PIN_FUNCTION(emac0_mdc),
+	MSM_PIN_FUNCTION(emac0_mdio),
+	MSM_PIN_FUNCTION(emac0_ptp_aux),
+	MSM_PIN_FUNCTION(emac0_ptp_pps),
+	MSM_PIN_FUNCTION(gcc_gp1),
+	MSM_PIN_FUNCTION(gcc_gp2),
+	MSM_PIN_FUNCTION(gcc_gp3),
+	MSM_PIN_FUNCTION(gcc_gp4),
+	MSM_PIN_FUNCTION(gcc_gp5),
+	MSM_PIN_FUNCTION(hs0_mi2s),
+	MSM_PIN_FUNCTION(hs1_mi2s),
+	MSM_PIN_FUNCTION(hs2_mi2s),
+	MSM_PIN_FUNCTION(ibi_i3c),
+	MSM_PIN_FUNCTION(jitter_bist),
+	MSM_PIN_FUNCTION(mdp0_vsync0),
+	MSM_PIN_FUNCTION(mdp0_vsync1),
+	MSM_PIN_FUNCTION(mdp0_vsync3),
+	MSM_PIN_FUNCTION(mdp0_vsync6),
+	MSM_PIN_FUNCTION(mdp0_vsync7),
+	MSM_PIN_FUNCTION(mdp_vsync),
+	MSM_PIN_FUNCTION(mi2s1_data0),
+	MSM_PIN_FUNCTION(mi2s1_data1),
+	MSM_PIN_FUNCTION(mi2s1_sck),
+	MSM_PIN_FUNCTION(mi2s1_ws),
+	MSM_PIN_FUNCTION(mi2s2_data0),
+	MSM_PIN_FUNCTION(mi2s2_data1),
+	MSM_PIN_FUNCTION(mi2s2_sck),
+	MSM_PIN_FUNCTION(mi2s2_ws),
+	MSM_PIN_FUNCTION(mi2s_mclk0),
+	MSM_PIN_FUNCTION(mi2s_mclk1),
+	MSM_PIN_FUNCTION(pcie0_clkreq),
+	MSM_PIN_FUNCTION(pcie1_clkreq),
+	MSM_PIN_FUNCTION(phase_flag),
+	MSM_PIN_FUNCTION(pll_bist),
+	MSM_PIN_FUNCTION(pll_clk),
+	MSM_PIN_FUNCTION(prng_rosc0),
+	MSM_PIN_FUNCTION(prng_rosc1),
+	MSM_PIN_FUNCTION(prng_rosc2),
+	MSM_PIN_FUNCTION(prng_rosc3),
+	MSM_PIN_FUNCTION(qdss_cti),
+	MSM_PIN_FUNCTION(qdss_gpio),
+	MSM_PIN_FUNCTION(qup0_se0),
+	MSM_PIN_FUNCTION(qup0_se1),
+	MSM_PIN_FUNCTION(qup0_se2),
+	MSM_PIN_FUNCTION(qup0_se3),
+	MSM_PIN_FUNCTION(qup0_se4),
+	MSM_PIN_FUNCTION(qup0_se5),
+	MSM_PIN_FUNCTION(qup0_se6),
+	MSM_PIN_FUNCTION(qup0_se7),
+	MSM_PIN_FUNCTION(qup1_se0),
+	MSM_PIN_FUNCTION(qup1_se1),
+	MSM_PIN_FUNCTION(qup1_se2),
+	MSM_PIN_FUNCTION(qup1_se3),
+	MSM_PIN_FUNCTION(qup1_se4),
+	MSM_PIN_FUNCTION(qup1_se5),
+	MSM_PIN_FUNCTION(qup1_se6),
+	MSM_PIN_FUNCTION(qup1_se7),
+	MSM_PIN_FUNCTION(qup2_se0),
+	MSM_PIN_FUNCTION(sailss_emac0),
+	MSM_PIN_FUNCTION(sailss_ospi),
+	MSM_PIN_FUNCTION(sgmii_phy),
+	MSM_PIN_FUNCTION(tb_trig),
+	MSM_PIN_FUNCTION(tgu_ch0),
+	MSM_PIN_FUNCTION(tgu_ch1),
+	MSM_PIN_FUNCTION(tgu_ch2),
+	MSM_PIN_FUNCTION(tgu_ch3),
+	MSM_PIN_FUNCTION(tsense_pwm1),
+	MSM_PIN_FUNCTION(tsense_pwm2),
+	MSM_PIN_FUNCTION(tsense_pwm3),
+	MSM_PIN_FUNCTION(tsense_pwm4),
+	MSM_PIN_FUNCTION(usb2phy_ac),
+	MSM_PIN_FUNCTION(vsense_trigger),
+};
+
+/*
+ * Every pin is maintained as a single group, and missing or non-existing pin
+ * would be maintained as dummy group to synchronize pin group index with
+ * pin descriptor registered with pinctrl core.
+ * Clients would not be able to request these dummy pin groups.
+ */
+static const struct msm_pingroup sa7255p_groups[] = {
+	[0] = PINGROUP(0, _, _, _, _, _, _, _, _, _),
+	[1] = PINGROUP(1, pcie0_clkreq, _, _, _, _, _, _, _, _),
+	[2] = PINGROUP(2, _, _, _, _, _, _, _, _, _),
+	[3] = PINGROUP(3, phase_flag, _, _, _, _, _, _, _, _),
+	[4] = PINGROUP(4, sgmii_phy, qdss_cti, _, _, _, _, _, _, _),
+	[5] = PINGROUP(5, emac0_mdc, qdss_cti, _, _, _, _, _, _, _),
+	[6] = PINGROUP(6, emac0_mdio, _, _, _, _, _, _, _, _),
+	[7] = PINGROUP(7, usb2phy_ac, _, _, _, _, _, _, _, _),
+	[8] = PINGROUP(8, usb2phy_ac, _, _, _, _, _, _, _, _),
+	[9] = PINGROUP(9, phase_flag, _, _, _, _, _, _, _, _),
+	[10] = PINGROUP(10, qup2_se0, emac0_mcg0, _, _, _, _, _, _, _),
+	[11] = PINGROUP(11, qup2_se0, emac0_mcg1, _, _, _, _, _, _, _),
+	[12] = PINGROUP(12, qup2_se0, _, _, _, _, _, _, _, _),
+	[13] = PINGROUP(13, qup2_se0, _, _, _, _, _, _, _, _),
+	[14] = PINGROUP(14, qup2_se0, tb_trig, tb_trig, _, _, _, _, _, _),
+	[15] = PINGROUP(15, qup2_se0, _, sailss_ospi, sailss_emac0, _, _,	_, _, _),
+	[16] = PINGROUP(16, qup2_se0, _, _, sailss_ospi, sailss_emac0, _,	_, _, _),
+	[17] = PINGROUP(17, qup0_se0, qup0_se1, ibi_i3c, _, _, _, _, _, _),
+	[18] = PINGROUP(18, qup0_se0, qup0_se1, ibi_i3c, _, _, _, _, _, _),
+	[19] = PINGROUP(19, qup0_se1, qup0_se0, cci_timer5, ibi_i3c, _, _, _, _, _),
+	[20] = PINGROUP(20, qup0_se1, qup0_se0, cci_timer6, ibi_i3c, _, _, _, _, _),
+	[21] = PINGROUP(21, qup0_se5, cci_timer7, _, _, _, _, _, _, _),
+	[22] = PINGROUP(22, pcie1_clkreq, qup0_se5, cci_timer8, _, _, _, _, _, _),
+	[23] = PINGROUP(23, qup0_se5, cci_timer9, qdss_cti, _, _, _, _, _, _),
+	[24] = PINGROUP(24, qup0_se5, emac0_ptp_aux, emac0_ptp_pps, qdss_cti,
+			emac0_mcg2, _, _, _, _),
+	[25] = PINGROUP(25, qup0_se3, phase_flag, _, _, _, _, _, _, _),
+	[26] = PINGROUP(26, qup0_se3, phase_flag, _, _, _, _, _, _, _),
+	[27] = PINGROUP(27, qup0_se3, _, _, _, _, _, _, _, _),
+	[28] = PINGROUP(28, qup0_se3, phase_flag, _, _, _, _, _, _, _),
+	[29] = PINGROUP(29, qup0_se4, cci_i2c_sda, cci_async, emac0_ptp_pps, tgu_ch2, _, _, _, _),
+	[30] = PINGROUP(30, qup0_se4, cci_i2c_scl, cci_async, emac0_ptp_pps, tgu_ch3, _, _, _, _),
+	[31] = PINGROUP(31, qup0_se4, cci_i2c_sda, cci_async, emac0_ptp_aux, _, _, _, _, _),
+	[32] = PINGROUP(32, qup0_se4, cci_i2c_scl, emac0_ptp_aux, mdp_vsync, _, _, _, _, _),
+	[33] = PINGROUP(33, qup0_se2, qdss_gpio, _, _, _, _, _, _, _),
+	[34] = PINGROUP(34, qup0_se2, qdss_gpio, _, _, _, _, _, _, _),
+	[35] = PINGROUP(35, qup0_se2, gcc_gp1, _, _, _, _, _, _, _),
+	[36] = PINGROUP(36, qup0_se2, gcc_gp2, qdss_gpio, _, _, _, _, _, _),
+	[37] = PINGROUP(37, qup1_se0, ibi_i3c, qup1_se1, aoss_cti, _, _, _, _, _),
+	[38] = PINGROUP(38, qup1_se0, ibi_i3c, qup1_se1, aoss_cti, _, _, _, _, _),
+	[39] = PINGROUP(39, qup1_se1, ibi_i3c, qup1_se0, aoss_cti, _, _, _, _, _),
+	[40] = PINGROUP(40, qup1_se1, ibi_i3c, qup1_se0, aoss_cti, _, _, _, _, _),
+	[41] = PINGROUP(41, qup1_se3, qup1_se3, _, _, _, _, _, _, _),
+	[42] = PINGROUP(42, qup1_se3, qup1_se3, mdp_vsync, _, _, _, _, _, _),
+	[43] = PINGROUP(43, qup0_se7, qup0_se7, tgu_ch0, _, _, _, _, _, _),
+	[44] = PINGROUP(44, qup0_se7, qup0_se7, tgu_ch1, _, _, _, _, _, _),
+	[45] = PINGROUP(45, qup1_se4, hs1_mi2s, _, _, _, _, _, _, _),
+	[46] = PINGROUP(46, qup1_se4, hs1_mi2s, _, _, _, _, _, _, _),
+	[47] = PINGROUP(47, qup1_se4, hs1_mi2s, _, _, _, _, _, _, _),
+	[48] = PINGROUP(48, qup1_se4, hs1_mi2s, edp0_lcd, _, _, _, _, _, _),
+	[49] = PINGROUP(49, qup1_se5, hs2_mi2s, cci_timer3, qdss_cti, edp1_lcd, ddr_pxi1, _, _, _),
+	[50] = PINGROUP(50, qup1_se5, hs2_mi2s, cci_timer4, qdss_cti, _, ddr_pxi1, _, _, _),
+	[51] = PINGROUP(51, qup1_se5, hs2_mi2s, qdss_cti, _, _, _, _, _, _),
+	[52] = PINGROUP(52, qup1_se5, hs2_mi2s, qdss_cti, mdp_vsync, ddr_pxi2, _, _, _, _),
+	[53] = PINGROUP(53, ddr_bist, _, _, _, _, _, _, _, _),
+	[54] = PINGROUP(54, cci_i2c_sda, phase_flag, ddr_bist, _,	_, _, _, _, _),
+	[55] = PINGROUP(55, cci_i2c_scl, phase_flag, ddr_bist, _, _, _, _, _, _),
+	[56] = PINGROUP(56, phase_flag, ddr_bist, _, _, _, _, _, _, _),
+	[57] = PINGROUP(57, cci_i2c_sda, prng_rosc0, qdss_gpio, _, _, _, _, _, _),
+	[58] = PINGROUP(58, cci_i2c_scl, prng_rosc1, qdss_gpio, _, _, _, _, _, _),
+	[59] = PINGROUP(59, cci_i2c_sda, prng_rosc2, qdss_gpio, _, _, _, _, _, _),
+	[60] = PINGROUP(60, cci_i2c_scl, prng_rosc3, qdss_gpio, _, _, _, _, _, _),
+	[61] = PINGROUP(61, cci_i2c_sda, qdss_gpio, _, _, _, _, _, _, _),
+	[62] = PINGROUP(62, cci_i2c_scl, qdss_gpio, _, _, _, _, _, _, _),
+	[63] = PINGROUP(63, cci_timer0, cci_async, qdss_gpio, atest_usb2, _, _, _, _, _),
+	[64] = PINGROUP(64, cci_timer1, cci_async, qdss_gpio, atest_usb2,	_, _, _, _, _),
+	[65] = PINGROUP(65, cci_timer2, cci_async, qdss_gpio, atest_usb2,	_, _, _, _, _),
+	[66] = PINGROUP(66, phase_flag, _, atest_char, _, _, _, _, _, _),
+	[67] = PINGROUP(67, cam_mclk, vsense_trigger, atest_usb2, _, _, _, _, _, _),
+	[68] = PINGROUP(68, cam_mclk, gcc_gp4, atest_usb2, ddr_pxi0, _, _, _, _, _),
+	[69] = PINGROUP(69, cam_mclk, gcc_gp3, atest_usb2, ddr_pxi0, _, _, _, _, _),
+	[70] = PINGROUP(70, qdss_gpio, atest_char, _, _, _, _, _, _, _),
+	[71] = PINGROUP(71, qdss_gpio, atest_char, _, _, _, _, _, _, _),
+	[72] = PINGROUP(72, qdss_gpio, atest_char, _, _, _, _, _, _, _),
+	[73] = PINGROUP(73, _, qdss_gpio, _, _, _, _, _, _, _),
+	[74] = PINGROUP(74, pll_clk, qdss_gpio, atest_usb2, _, _, _, _, _, _),
+	[75] = PINGROUP(75, _, dbg_out, qdss_gpio, atest_usb2, _, _, _, _, _),
+	[76] = PINGROUP(76, gcc_gp5, tsense_pwm4, _, _, _, _, _, _, _),
+	[77] = PINGROUP(77, gcc_gp5, tsense_pwm3, _, _, _, _, _, _, _),
+	[78] = PINGROUP(78, tsense_pwm2, _, _, _, _, _, _, _, _),
+	[79] = PINGROUP(79, emac0_ptp_aux, emac0_ptp_pps, emac0_mcg3, _, tsense_pwm1, _, _, _, _),
+	[80] = PINGROUP(80, qup0_se6, mdp0_vsync6, _, atest_usb2, ddr_pxi3, _, _, _, _),
+	[81] = PINGROUP(81, qup0_se6, mdp0_vsync7, gcc_gp2, _, atest_usb2, ddr_pxi3, _, _, _),
+	[82] = PINGROUP(82, qup0_se6, gcc_gp3, _, _, _, _, _, _, _),
+	[83] = PINGROUP(83, qup0_se6, gcc_gp4, _, atest_usb2, ddr_pxi2, _, _, _, _),
+	[84] = PINGROUP(84, qup1_se2, gcc_gp1, _, atest_usb2, _, _, _, _, _),
+	[85] = PINGROUP(85, qup1_se2, _, atest_usb2, _, _, _, _, _, _),
+	[86] = PINGROUP(86, qup1_se2, _, _, _, _, _, _, _, _),
+	[87] = PINGROUP(87, qup1_se2, _, atest_usb2, _, _, _, _, _, _),
+	[88] = PINGROUP(88, qup1_se2, _, _, _, _, _, _, _, _),
+	[89] = PINGROUP(89, qup1_se6, qup1_se7, mdp0_vsync0, _, _, _, _, _, _),
+	[90] = PINGROUP(90, qup1_se6, qup1_se7, mdp0_vsync1,	cri_trng0, _, _, _, _, _),
+	[91] = PINGROUP(91, qup1_se7, qup1_se6, mdp0_vsync3,	cri_trng1, _, _, _, _, _),
+	[92] = PINGROUP(92, qup1_se7, qup1_se6, cri_trng, _, atest_usb2,	_, _, _, _),
+	[93] = PINGROUP(93, atest_char, _, _, _, _, _, _, _, _),
+	[94] = PINGROUP(94, edp0_hot, _, _, _, _, _, _, _, _),
+	[95] = PINGROUP(95, _, _, _, _, _, _, _, _, _),
+	[96] = PINGROUP(96, _, _, _, _, _, _, _, _, _),
+	[97] = PINGROUP(97, mi2s_mclk0, jitter_bist, qdss_gpio, _, _, _, _, _, _),
+	[98] = PINGROUP(98, mi2s1_sck, phase_flag, _, qdss_gpio, _, _, _, _, _),
+	[99] = PINGROUP(99, mi2s1_ws, phase_flag, _, qdss_gpio, _, _, _, _, _),
+	[100] = PINGROUP(100, mi2s1_data0, phase_flag, _, qdss_gpio, _, _, _, _, _),
+	[101] = PINGROUP(101, mi2s1_data1, phase_flag, _, qdss_gpio, _, _, _, _, _),
+	[102] = PINGROUP(102, mi2s2_sck, phase_flag, _, qdss_gpio, _, _, _, _, _),
+	[103] = PINGROUP(103, mi2s2_ws, phase_flag, _, qdss_gpio, _, _, _, _, _),
+	[104] = PINGROUP(104, mi2s2_data0, phase_flag, _, qdss_gpio, _, _, _, _, _),
+	[105] = PINGROUP(105, mi2s2_data1, audio_ref, phase_flag, _, qdss_gpio, _, _, _, _),
+	[106] = PINGROUP(106, hs0_mi2s, phase_flag, _, qdss_gpio, _, _, _, _, _),
+	[107] = PINGROUP(107, hs0_mi2s, pll_bist, phase_flag, _, qdss_gpio, _, _, _, _),
+	[108] = PINGROUP(108, hs0_mi2s, phase_flag, _, qdss_gpio, _, _, _, _, _),
+	[109] = PINGROUP(109, hs0_mi2s, mi2s_mclk1, qdss_gpio, _, _, _, _, _, _),
+	[110] = PINGROUP(110, phase_flag, _, qdss_gpio, _, _, _, _, _, _),
+	[111] = PINGROUP(111, phase_flag, _, qdss_gpio, _, _, _, _, _, _),
+	[112] = PINGROUP(112, phase_flag, _, qdss_gpio, _, _, _, _, _, _),
+	[113] = PINGROUP(113, phase_flag, _, qdss_gpio, _, _, _, _, _, _),
+	[114] = PINGROUP(114, phase_flag, _, qdss_gpio, _, _, _, _, _, _),
+	[115] = PINGROUP(115, _, _, _, _, _, _, _, _, _),
+	[116] = PINGROUP(116, phase_flag, _, _, _, _, _, _, _, _),
+	[117] = PINGROUP(117, phase_flag, _, _, _, _, _, _, _, _),
+	[118] = PINGROUP(118, phase_flag, _, _, _, _, _, _, _, _),
+	[119] = PINGROUP(119, _, _, _, _, _, _, _, _, _),
+	[120] = PINGROUP(120, phase_flag, _, _, _, _, _, _, _, _),
+	[121] = PINGROUP(121, phase_flag, _, _, _, _, _, _, _, _),
+	[122] = PINGROUP(122, phase_flag, _, _, _, _, _, _, _, _),
+	[123] = PINGROUP(123, _, _, _, _, _, _, _, _, _),
+	[124] = PINGROUP(124, _, _, _, _, _, _, _, _, _),
+	[125] = PINGROUP(125, phase_flag, _, _, _, _, _, _, _, _),
+	[126] = PINGROUP(126, _, _, _, _, _, _, _, _, _),
+	[127] = PINGROUP(127, _, _, _, _, _, _, _, _, _),
+	[128] = PINGROUP(128, _, _, _, _, _, _, _, _, _),
+	[129] = PINGROUP(129, _, _, _, _, _, _, _, _, _),
+	[130] = PINGROUP(130, _, _, _, _, _, _, _, _, _),
+	[131] = PINGROUP(131, _, _, _, _, _, _, _, _, _),
+	[132] = PINGROUP(132, _, _, _, _, _, _, _, _, _),
+	[133] = UFS_RESET(ufs_reset, 0x192000),
+};
+
+static const struct msm_gpio_wakeirq_map sa7255_pdc_map[] = {
+	{ 0, 169 }, { 1, 174 }, { 2, 221 }, { 3, 176 }, { 4, 171 }, { 9, 198 },
+	{ 10, 187 }, { 11, 188 }, { 13, 211 }, { 16, 203 }, { 17, 213 }, { 18, 209 },
+	{ 19, 201 }, { 20, 230 }, { 21, 231 }, { 22, 175 }, { 23, 170 }, { 24, 232 },
+	{ 28, 235 }, { 29, 216 }, { 31, 208 }, { 32, 200 }, { 36, 212 }, { 37, 177 },
+	{ 38, 178 }, { 39, 184 }, { 40, 185 }, { 42, 186 }, { 44, 194 }, { 45, 173 },
+	{ 48, 195 }, { 51, 215 }, { 52, 197 }, { 53, 192 }, { 56, 193 }, { 66, 238 },
+	{ 67, 172 }, { 68, 182 }, { 69, 179 }, { 70, 181 }, { 71, 202 }, { 72, 183 },
+	{ 73, 189 }, { 74, 196 }, { 75, 190 }, { 76, 191 }, { 77, 204 }, { 78, 206 },
+	{ 79, 207 }, { 83, 214 }, { 84, 205 }, { 87, 237 }, { 89, 225 }, { 90, 217 },
+	{ 91, 218 }, { 92, 226 }, { 93, 227 }, { 94, 228 }, { 95, 236 }, { 97, 199 },
+	{ 98, 229 }, { 99, 180 }, { 100, 220 }, { 101, 239 }, { 102, 219 }, { 103, 233 },
+	{ 104, 234 }, { 105, 223 }, { 129, 210 }, { 130, 222 },
+};
+
+static const struct msm_pinctrl_soc_data sa7255p_pinctrl = {
+	.pins = sa7255p_pins,
+	.npins = ARRAY_SIZE(sa7255p_pins),
+	.functions = sa7255p_functions,
+	.nfunctions = ARRAY_SIZE(sa7255p_functions),
+	.groups = sa7255p_groups,
+	.ngroups = ARRAY_SIZE(sa7255p_groups),
+	.ngpios = 134,
+	.wakeirq_map = sa7255_pdc_map,
+	.nwakeirq_map = ARRAY_SIZE(sa7255_pdc_map),
+};
+
+static int sa7255p_pinctrl_probe(struct platform_device *pdev)
+{
+	return msm_pinctrl_probe(pdev, &sa7255p_pinctrl);
+}
+
+static const struct of_device_id sa7255p_pinctrl_of_match[] = {
+	{ .compatible = "qcom,sa7255p-tlmm", },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, sa7255p_pinctrl_of_match);
+
+static struct platform_driver sa7255p_pinctrl_driver = {
+	.driver = {
+		.name = "sa7255p-tlmm",
+		.of_match_table = sa7255p_pinctrl_of_match,
+	},
+	.probe = sa7255p_pinctrl_probe,
+	.remove_new = msm_pinctrl_remove,
+};
+
+static int __init sa7255p_pinctrl_init(void)
+{
+	return platform_driver_register(&sa7255p_pinctrl_driver);
+}
+arch_initcall(sa7255p_pinctrl_init);
+
+static void __exit sa7255p_pinctrl_exit(void)
+{
+	platform_driver_unregister(&sa7255p_pinctrl_driver);
+}
+module_exit(sa7255p_pinctrl_exit);
+
+MODULE_DESCRIPTION("QTI SA7255P pinctrl driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-sa8775p-lpass-lpi.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-sa8775p-lpass-lpi.c
@@ -0,0 +1,221 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * ALSA SoC platform-machine driver for QTi LPASS
+ */
+
+#include <linux/gpio/driver.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include "pinctrl-lpass-lpi.h"
+
+enum lpass_lpi_functions {
+	LPI_MUX_dmic1_clk,
+	LPI_MUX_dmic1_data,
+	LPI_MUX_dmic2_clk,
+	LPI_MUX_dmic2_data,
+	LPI_MUX_dmic3_clk,
+	LPI_MUX_dmic3_data,
+	LPI_MUX_dmic4_clk,
+	LPI_MUX_dmic4_data,
+	LPI_MUX_i2s1_clk,
+	LPI_MUX_i2s1_data,
+	LPI_MUX_i2s1_ws,
+	LPI_MUX_i2s2_clk,
+	LPI_MUX_i2s2_data,
+	LPI_MUX_i2s2_ws,
+	LPI_MUX_i2s3_clk,
+	LPI_MUX_i2s3_data,
+	LPI_MUX_i2s3_ws,
+	LPI_MUX_i2s4_clk,
+	LPI_MUX_i2s4_data,
+	LPI_MUX_i2s4_ws,
+	LPI_MUX_qua_mi2s_data,
+	LPI_MUX_qua_mi2s_sclk,
+	LPI_MUX_qua_mi2s_ws,
+	LPI_MUX_ext_mclk1_a,
+	LPI_MUX_ext_mclk1_b,
+	LPI_MUX_ext_mclk1_c,
+	LPI_MUX_ext_mclk1_d,
+	LPI_MUX_ext_mclk1_e,
+	LPI_MUX_gpio,
+	LPI_MUX__,
+};
+
+static int gpio0_pins[] = { 0 };
+static int gpio1_pins[] = { 1 };
+static int gpio2_pins[] = { 2 };
+static int gpio3_pins[] = { 3 };
+static int gpio4_pins[] = { 4 };
+static int gpio5_pins[] = { 5 };
+static int gpio6_pins[] = { 6 };
+static int gpio7_pins[] = { 7 };
+static int gpio8_pins[] = { 8 };
+static int gpio9_pins[] = { 9 };
+static int gpio10_pins[] = { 10 };
+static int gpio11_pins[] = { 11 };
+static int gpio12_pins[] = { 12 };
+static int gpio13_pins[] = { 13 };
+static int gpio14_pins[] = { 14 };
+static int gpio15_pins[] = { 15 };
+static int gpio16_pins[] = { 16 };
+static int gpio17_pins[] = { 17 };
+static int gpio18_pins[] = { 18 };
+static int gpio19_pins[] = { 19 };
+static int gpio20_pins[] = { 20 };
+static int gpio21_pins[] = { 21 };
+static int gpio22_pins[] = { 22 };
+
+static const struct pinctrl_pin_desc sa8775p_lpi_pins[] = {
+	PINCTRL_PIN(0, "gpio0"),
+	PINCTRL_PIN(1, "gpio1"),
+	PINCTRL_PIN(2, "gpio2"),
+	PINCTRL_PIN(3, "gpio3"),
+	PINCTRL_PIN(4, "gpio4"),
+	PINCTRL_PIN(5, "gpio5"),
+	PINCTRL_PIN(6, "gpio6"),
+	PINCTRL_PIN(7, "gpio7"),
+	PINCTRL_PIN(8, "gpio8"),
+	PINCTRL_PIN(9, "gpio9"),
+	PINCTRL_PIN(10, "gpio10"),
+	PINCTRL_PIN(11, "gpio11"),
+	PINCTRL_PIN(12, "gpio12"),
+	PINCTRL_PIN(13, "gpio13"),
+	PINCTRL_PIN(14, "gpio14"),
+	PINCTRL_PIN(15, "gpio15"),
+	PINCTRL_PIN(16, "gpio16"),
+	PINCTRL_PIN(17, "gpio17"),
+	PINCTRL_PIN(18, "gpio18"),
+	PINCTRL_PIN(19, "gpio19"),
+	PINCTRL_PIN(20, "gpio20"),
+	PINCTRL_PIN(21, "gpio21"),
+	PINCTRL_PIN(22, "gpio22"),
+};
+
+static const char * const dmic1_clk_groups[] = { "gpio6" };
+static const char * const dmic1_data_groups[] = { "gpio7" };
+static const char * const dmic2_clk_groups[] = { "gpio8" };
+static const char * const dmic2_data_groups[] = { "gpio9" };
+static const char * const i2s2_clk_groups[] = { "gpio10" };
+static const char * const i2s2_ws_groups[] = { "gpio11" };
+static const char * const dmic3_clk_groups[] = { "gpio12" };
+static const char * const dmic3_data_groups[] = { "gpio13" };
+static const char * const dmic4_clk_groups[] = { "gpio17" };
+static const char * const dmic4_data_groups[] = { "gpio18" };
+static const char * const qua_mi2s_sclk_groups[] = { "gpio0" };
+static const char * const qua_mi2s_ws_groups[] = { "gpio1" };
+static const char * const qua_mi2s_data_groups[] = { "gpio2", "gpio3", "gpio4", "gpio5" };
+static const char * const i2s1_clk_groups[] = { "gpio6" };
+static const char * const i2s1_ws_groups[] = { "gpio7" };
+static const char * const i2s1_data_groups[] = { "gpio8", "gpio9" };
+static const char * const i2s4_clk_groups[] = { "gpio12" };
+static const char * const i2s4_ws_groups[] = { "gpio13" };
+static const char * const i2s2_data_groups[] = { "gpio15", "gpio16" };
+static const char * const i2s3_clk_groups[] = { "gpio19" };
+static const char * const i2s3_ws_groups[] = { "gpio20" };
+static const char * const i2s3_data_groups[] = { "gpio21", "gpio22" };
+static const char * const i2s4_data_groups[] = { "gpio17", "gpio18" };
+static const char * const ext_mclk1_c_groups[] = { "gpio5" };
+static const char * const ext_mclk1_b_groups[] = { "gpio9" };
+static const char * const ext_mclk1_a_groups[] = { "gpio13" };
+static const char * const ext_mclk1_d_groups[] = { "gpio14" };
+static const char * const ext_mclk1_e_groups[] = { "gpio22" };
+
+static const struct lpi_pingroup sa8775p_groups[] = {
+	LPI_PINGROUP(0, LPI_NO_SLEW, _, qua_mi2s_sclk, _, _),
+	LPI_PINGROUP(1, LPI_NO_SLEW, _, qua_mi2s_ws, _, _),
+	LPI_PINGROUP(2, LPI_NO_SLEW, _, qua_mi2s_data, _, _),
+	LPI_PINGROUP(3, LPI_NO_SLEW, _, qua_mi2s_data, _, _),
+	LPI_PINGROUP(4, LPI_NO_SLEW, _, qua_mi2s_data, _, _),
+	LPI_PINGROUP(5, LPI_NO_SLEW, _, ext_mclk1_c, qua_mi2s_data, _),
+	LPI_PINGROUP(6, LPI_NO_SLEW, dmic1_clk, i2s1_clk, _, _),
+	LPI_PINGROUP(7, LPI_NO_SLEW, dmic1_data, i2s1_ws, _, _),
+	LPI_PINGROUP(8, LPI_NO_SLEW, dmic2_clk, i2s1_data, _, _),
+	LPI_PINGROUP(9, LPI_NO_SLEW, dmic2_data, i2s1_data, ext_mclk1_b, _),
+	LPI_PINGROUP(10, LPI_NO_SLEW, i2s2_clk, _, _, _),
+	LPI_PINGROUP(11, LPI_NO_SLEW, i2s2_ws, _, _, _),
+	LPI_PINGROUP(12, LPI_NO_SLEW, dmic3_clk, i2s4_clk, _, _),
+	LPI_PINGROUP(13, LPI_NO_SLEW, dmic3_data, i2s4_ws, ext_mclk1_a, _),
+	LPI_PINGROUP(14, LPI_NO_SLEW, ext_mclk1_d, _, _, _),
+	LPI_PINGROUP(15, LPI_NO_SLEW, i2s2_data, _, _, _),
+	LPI_PINGROUP(16, LPI_NO_SLEW, i2s2_data, _, _, _),
+	LPI_PINGROUP(17, LPI_NO_SLEW, dmic4_clk, i2s4_data, _, _),
+	LPI_PINGROUP(18, LPI_NO_SLEW, dmic4_data, i2s4_data, _, _),
+	LPI_PINGROUP(19, LPI_NO_SLEW, i2s3_clk, _, _, _),
+	LPI_PINGROUP(20, LPI_NO_SLEW, i2s3_ws, _, _, _),
+	LPI_PINGROUP(21, LPI_NO_SLEW, i2s3_data, _, _, _),
+	LPI_PINGROUP(22, LPI_NO_SLEW, i2s3_data, ext_mclk1_e, _, _),
+};
+
+static const struct lpi_function sa8775p_functions[] = {
+	LPI_FUNCTION(dmic1_clk),
+	LPI_FUNCTION(dmic1_data),
+	LPI_FUNCTION(dmic2_clk),
+	LPI_FUNCTION(dmic2_data),
+	LPI_FUNCTION(dmic3_clk),
+	LPI_FUNCTION(dmic3_data),
+	LPI_FUNCTION(dmic4_clk),
+	LPI_FUNCTION(dmic4_data),
+	LPI_FUNCTION(i2s1_clk),
+	LPI_FUNCTION(i2s1_data),
+	LPI_FUNCTION(i2s1_ws),
+	LPI_FUNCTION(i2s2_clk),
+	LPI_FUNCTION(i2s2_data),
+	LPI_FUNCTION(i2s2_ws),
+	LPI_FUNCTION(i2s3_clk),
+	LPI_FUNCTION(i2s3_data),
+	LPI_FUNCTION(i2s3_ws),
+	LPI_FUNCTION(i2s4_clk),
+	LPI_FUNCTION(i2s4_data),
+	LPI_FUNCTION(i2s4_ws),
+	LPI_FUNCTION(qua_mi2s_data),
+	LPI_FUNCTION(qua_mi2s_sclk),
+	LPI_FUNCTION(qua_mi2s_ws),
+	LPI_FUNCTION(ext_mclk1_a),
+	LPI_FUNCTION(ext_mclk1_b),
+	LPI_FUNCTION(ext_mclk1_c),
+	LPI_FUNCTION(ext_mclk1_d),
+	LPI_FUNCTION(ext_mclk1_e),
+};
+
+static const struct lpi_pinctrl_variant_data sa8775p_lpi_data = {
+	.pins = sa8775p_lpi_pins,
+	.npins = ARRAY_SIZE(sa8775p_lpi_pins),
+	.groups = sa8775p_groups,
+	.ngroups = ARRAY_SIZE(sa8775p_groups),
+	.functions = sa8775p_functions,
+	.nfunctions = ARRAY_SIZE(sa8775p_functions),
+};
+
+static const struct of_device_id lpi_pinctrl_of_match[] = {
+	{
+	       .compatible = "qcom,sa8775p-lpass-lpi-pinctrl",
+	       .data = &sa8775p_lpi_data,
+	},
+	{
+	       .compatible = "qcom,qcs9100-lpass-lpi-pinctrl",
+	       .data = &sa8775p_lpi_data,
+	},
+
+	{ }
+};
+MODULE_DEVICE_TABLE(of, lpi_pinctrl_of_match);
+
+static const struct dev_pm_ops lpi_pinctrl_pm_ops = {
+	SET_RUNTIME_PM_OPS(lpi_pinctrl_runtime_suspend, lpi_pinctrl_runtime_resume, NULL)
+};
+
+static struct platform_driver lpi_pinctrl_driver = {
+	.driver = {
+		   .name = "qcom-sa8775p-lpass-lpi-pinctrl",
+		   .of_match_table = lpi_pinctrl_of_match,
+		   .pm = &lpi_pinctrl_pm_ops,
+	},
+	.probe = lpi_pinctrl_probe,
+	.remove_new = lpi_pinctrl_remove,
+};
+
+module_platform_driver(lpi_pinctrl_driver);
+MODULE_DESCRIPTION("QTI SA8775p LPI GPIO pin control driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-sa8775p.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-sa8775p.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022,2024 Qualcomm Innovation Center, Inc. All rights reserved.
  * Copyright (c) 2023, Linaro Limited
  */
 
@@ -437,7 +437,22 @@
 	msm_mux_audio_ref,
 	msm_mux_cam_mclk,
 	msm_mux_cci_async,
-	msm_mux_cci_i2c,
+	msm_mux_cci_i2c_scl0,
+	msm_mux_cci_i2c_scl1,
+	msm_mux_cci_i2c_scl2,
+	msm_mux_cci_i2c_scl3,
+	msm_mux_cci_i2c_scl4,
+	msm_mux_cci_i2c_scl5,
+	msm_mux_cci_i2c_scl6,
+	msm_mux_cci_i2c_scl7,
+	msm_mux_cci_i2c_sda0,
+	msm_mux_cci_i2c_sda1,
+	msm_mux_cci_i2c_sda2,
+	msm_mux_cci_i2c_sda3,
+	msm_mux_cci_i2c_sda4,
+	msm_mux_cci_i2c_sda5,
+	msm_mux_cci_i2c_sda6,
+	msm_mux_cci_i2c_sda7,
 	msm_mux_cci_timer0,
 	msm_mux_cci_timer1,
 	msm_mux_cci_timer2,
@@ -467,6 +482,7 @@
 	msm_mux_edp2_lcd,
 	msm_mux_edp3_hot,
 	msm_mux_edp3_lcd,
+	msm_mux_egpio,
 	msm_mux_emac0_mcg0,
 	msm_mux_emac0_mcg1,
 	msm_mux_emac0_mcg2,
@@ -622,10 +638,69 @@
 	"gpio50", "gpio66", "gpio68", "gpio69", "gpio70", "gpio71",
 };
 
-static const char * const cci_i2c_groups[] = {
-	"gpio52", "gpio53", "gpio54", "gpio55", "gpio56", "gpio57", "gpio58",
-	"gpio59", "gpio60", "gpio61", "gpio62", "gpio63", "gpio64", "gpio65",
-	"gpio66", "gpio67",
+
+static const char *const cci_i2c_scl0_groups[] = {
+	"gpio61",
+};
+
+static const char *const cci_i2c_scl1_groups[] = {
+	"gpio53",
+};
+
+static const char *const cci_i2c_scl2_groups[] = {
+	"gpio63",
+};
+
+static const char *const cci_i2c_scl3_groups[] = {
+	"gpio55",
+};
+
+static const char *const cci_i2c_scl4_groups[] = {
+	"gpio65",
+};
+
+static const char *const cci_i2c_scl5_groups[] = {
+	"gpio57",
+};
+
+static const char *const cci_i2c_scl6_groups[] = {
+	"gpio67",
+};
+
+static const char *const cci_i2c_scl7_groups[] = {
+	"gpio59",
+};
+
+static const char *const cci_i2c_sda0_groups[] = {
+	"gpio60",
+};
+
+static const char *const cci_i2c_sda1_groups[] = {
+	"gpio52",
+};
+
+static const char *const cci_i2c_sda2_groups[] = {
+	"gpio62",
+};
+
+static const char *const cci_i2c_sda3_groups[] = {
+	"gpio54",
+};
+
+static const char *const cci_i2c_sda4_groups[] = {
+	"gpio64",
+};
+
+static const char *const cci_i2c_sda5_groups[] = {
+	"gpio56",
+};
+
+static const char *const cci_i2c_sda6_groups[] = {
+	"gpio66",
+};
+
+static const char *const cci_i2c_sda7_groups[] = {
+	"gpio58",
 };
 
 static const char * const cci_timer0_groups[] = {
@@ -744,6 +819,13 @@
 	"gpio49",
 };
 
+static const char *const egpio_groups[] = {
+	"gpio126", "gpio127", "gpio128", "gpio129", "gpio130", "gpio131",
+	"gpio132", "gpio133", "gpio134", "gpio135", "gpio136", "gpio137",
+	"gpio138", "gpio139", "gpio140", "gpio141", "gpio142", "gpio143",
+	"gpio144", "gpio145", "gpio146", "gpio147", "gpio148",
+};
+
 static const char * const emac0_mcg0_groups[] = {
 	"gpio12",
 };
@@ -1179,7 +1261,22 @@
 	MSM_PIN_FUNCTION(audio_ref),
 	MSM_PIN_FUNCTION(cam_mclk),
 	MSM_PIN_FUNCTION(cci_async),
-	MSM_PIN_FUNCTION(cci_i2c),
+	MSM_PIN_FUNCTION(cci_i2c_scl0),
+	MSM_PIN_FUNCTION(cci_i2c_scl1),
+	MSM_PIN_FUNCTION(cci_i2c_scl2),
+	MSM_PIN_FUNCTION(cci_i2c_scl3),
+	MSM_PIN_FUNCTION(cci_i2c_scl4),
+	MSM_PIN_FUNCTION(cci_i2c_scl5),
+	MSM_PIN_FUNCTION(cci_i2c_scl6),
+	MSM_PIN_FUNCTION(cci_i2c_scl7),
+	MSM_PIN_FUNCTION(cci_i2c_sda0),
+	MSM_PIN_FUNCTION(cci_i2c_sda1),
+	MSM_PIN_FUNCTION(cci_i2c_sda2),
+	MSM_PIN_FUNCTION(cci_i2c_sda3),
+	MSM_PIN_FUNCTION(cci_i2c_sda4),
+	MSM_PIN_FUNCTION(cci_i2c_sda5),
+	MSM_PIN_FUNCTION(cci_i2c_sda6),
+	MSM_PIN_FUNCTION(cci_i2c_sda7),
 	MSM_PIN_FUNCTION(cci_timer0),
 	MSM_PIN_FUNCTION(cci_timer1),
 	MSM_PIN_FUNCTION(cci_timer2),
@@ -1209,6 +1306,7 @@
 	MSM_PIN_FUNCTION(edp2_lcd),
 	MSM_PIN_FUNCTION(edp3_hot),
 	MSM_PIN_FUNCTION(edp3_lcd),
+	MSM_PIN_FUNCTION(egpio),
 	MSM_PIN_FUNCTION(emac0_mcg0),
 	MSM_PIN_FUNCTION(emac0_mcg1),
 	MSM_PIN_FUNCTION(emac0_mcg2),
@@ -1378,24 +1476,27 @@
 	[49] = PINGROUP(49, qup1_se4, qdss_cti, edp3_lcd, _, _, _, _, _, _),
 	[50] = PINGROUP(50, qup1_se4, cci_async, qdss_cti, mdp1_vsync8, _, _, _, _, _),
 	[51] = PINGROUP(51, qup1_se4, qdss_cti, mdp1_vsync6, gcc_gp1, _, _, _, _, _),
-	[52] = PINGROUP(52, qup1_se5, cci_timer4, cci_i2c, mdp1_vsync7,	gcc_gp2, _, ddr_pxi1, _, _),
-	[53] = PINGROUP(53, qup1_se5, cci_timer5, cci_i2c, gcc_gp3, _, ddr_pxi1, _, _, _),
-	[54] = PINGROUP(54, qup1_se5, cci_timer6, cci_i2c, _, _, _, _, _, _),
-	[55] = PINGROUP(55, qup1_se5, cci_timer7, cci_i2c, gcc_gp4, _, ddr_pxi2, _, _, _),
-	[56] = PINGROUP(56, qup1_se6, qup1_se6, cci_timer8, cci_i2c, phase_flag,
+	[52] = PINGROUP(52, qup1_se5, cci_timer4, cci_i2c_sda1, mdp1_vsync7, gcc_gp2, _,
+			ddr_pxi1, _, _),
+	[53] = PINGROUP(53, qup1_se5, cci_timer5, cci_i2c_scl1, gcc_gp3, _, ddr_pxi1, _, _, _),
+	[54] = PINGROUP(54, qup1_se5, cci_timer6, cci_i2c_sda3, _, _, _, _, _, _),
+	[55] = PINGROUP(55, qup1_se5, cci_timer7, cci_i2c_scl3, gcc_gp4, _, ddr_pxi2, _, _, _),
+	[56] = PINGROUP(56, qup1_se6, qup1_se6, cci_timer8, cci_i2c_sda5, phase_flag,
 			ddr_bist, _, _, _),
-	[57] = PINGROUP(57, qup1_se6, qup1_se6, cci_timer9, cci_i2c, mdp0_vsync0,
+	[57] = PINGROUP(57, qup1_se6, qup1_se6, cci_timer9, cci_i2c_scl5, mdp0_vsync0,
 			phase_flag, ddr_bist, _, _),
-	[58] = PINGROUP(58, cci_i2c, mdp0_vsync1, ddr_bist, _, atest_usb2, atest_char, _, _, _),
-	[59] = PINGROUP(59, cci_i2c, mdp0_vsync2, ddr_bist, _, atest_usb2, atest_char, _, _, _),
-	[60] = PINGROUP(60, cci_i2c, qdss_gpio, _, _, _, _, _, _, _),
-	[61] = PINGROUP(61, cci_i2c, qdss_gpio, _, _, _, _, _, _, _),
-	[62] = PINGROUP(62, cci_i2c, qdss_gpio, _, _, _, _, _, _, _),
-	[63] = PINGROUP(63, cci_i2c, qdss_gpio, _, _, _, _, _, _, _),
-	[64] = PINGROUP(64, cci_i2c, qdss_gpio, _, _, _, _, _, _, _),
-	[65] = PINGROUP(65, cci_i2c, qdss_gpio, _, _, _, _, _, _, _),
-	[66] = PINGROUP(66, cci_i2c, cci_async, qdss_gpio, _, _, _, _, _, _),
-	[67] = PINGROUP(67, cci_i2c, qdss_gpio, _, _, _, _, _, _, _),
+	[58] = PINGROUP(58, cci_i2c_sda7, mdp0_vsync1, ddr_bist, _, atest_usb2,
+			atest_char, _, _, _),
+	[59] = PINGROUP(59, cci_i2c_scl7, mdp0_vsync2, ddr_bist, _, atest_usb2,
+			atest_char, _, _, _),
+	[60] = PINGROUP(60, cci_i2c_sda0, qdss_gpio, _, _, _, _, _, _, _),
+	[61] = PINGROUP(61, cci_i2c_scl0, qdss_gpio, _, _, _, _, _, _, _),
+	[62] = PINGROUP(62, cci_i2c_sda2, qdss_gpio, _, _, _, _, _, _, _),
+	[63] = PINGROUP(63, cci_i2c_scl2, qdss_gpio, _, _, _, _, _, _, _),
+	[64] = PINGROUP(64, cci_i2c_sda4, qdss_gpio, _, _, _, _, _, _, _),
+	[65] = PINGROUP(65, cci_i2c_scl4, qdss_gpio, _, _, _, _, _, _, _),
+	[66] = PINGROUP(66, cci_i2c_sda6, cci_async, qdss_gpio, _, _, _, _, _, _),
+	[67] = PINGROUP(67, cci_i2c_scl6, qdss_gpio, _, _, _, _, _, _, _),
 	[68] = PINGROUP(68, cci_timer0, cci_async, _, _, _, _, _, _, _),
 	[69] = PINGROUP(69, cci_timer1, cci_async, _, _, _, _, _, _, _),
 	[70] = PINGROUP(70, cci_timer2, cci_async, _, _, _, _, _, _, _),
@@ -1454,29 +1555,29 @@
 	[123] = PINGROUP(123, hs2_mi2s, phase_flag, _, _, _, _, _, _, _),
 	[124] = PINGROUP(124, hs2_mi2s, phase_flag, _, _, _, _, _, _, _),
 	[125] = PINGROUP(125, hs2_mi2s, phase_flag, _, _, _, _, _, _, _),
-	[126] = PINGROUP(126, _, _, _, _, _, _, _, _, _),
-	[127] = PINGROUP(127, _, _, _, _, _, _, _, _, _),
-	[128] = PINGROUP(128, _, _, _, _, _, _, _, _, _),
-	[129] = PINGROUP(129, _, _, _, _, _, _, _, _, _),
-	[130] = PINGROUP(130, _, _, _, _, _, _, _, _, _),
-	[131] = PINGROUP(131, _, _, _, _, _, _, _, _, _),
-	[132] = PINGROUP(132, _, _, _, _, _, _, _, _, _),
-	[133] = PINGROUP(133, _, _, _, _, _, _, _, _, _),
-	[134] = PINGROUP(134, _, _, _, _, _, _, _, _, _),
-	[135] = PINGROUP(135, _, _, _, _, _, _, _, _, _),
-	[136] = PINGROUP(136, _, _, _, _, _, _, _, _, _),
-	[137] = PINGROUP(137, _, _, _, _, _, _, _, _, _),
-	[138] = PINGROUP(138, _, _, _, _, _, _, _, _, _),
-	[139] = PINGROUP(139, _, _, _, _, _, _, _, _, _),
-	[140] = PINGROUP(140, _, _, _, _, _, _, _, _, _),
-	[141] = PINGROUP(141, _, _, _, _, _, _, _, _, _),
-	[142] = PINGROUP(142, _, _, _, _, _, _, _, _, _),
-	[143] = PINGROUP(143, _, _, _, _, _, _, _, _, _),
-	[144] = PINGROUP(144, dbg_out, _, _, _, _, _, _, _, _),
-	[145] = PINGROUP(145, _, _, _, _, _, _, _, _, _),
-	[146] = PINGROUP(146, _, _, _, _, _, _, _, _, _),
-	[147] = PINGROUP(147, _, _, _, _, _, _, _, _, _),
-	[148] = PINGROUP(148, _, _, _, _, _, _, _, _, _),
+	[126] = PINGROUP(126, _, _, _, _, _, _, _, _, egpio),
+	[127] = PINGROUP(127, _, _, _, _, _, _, _, _, egpio),
+	[128] = PINGROUP(128, _, _, _, _, _, _, _, _, egpio),
+	[129] = PINGROUP(129, _, _, _, _, _, _, _, _, egpio),
+	[130] = PINGROUP(130, _, _, _, _, _, _, _, _, egpio),
+	[131] = PINGROUP(131, _, _, _, _, _, _, _, _, egpio),
+	[132] = PINGROUP(132, _, _, _, _, _, _, _, _, egpio),
+	[133] = PINGROUP(133, _, _, _, _, _, _, _, _, egpio),
+	[134] = PINGROUP(134, _, _, _, _, _, _, _, _, egpio),
+	[135] = PINGROUP(135, _, _, _, _, _, _, _, _, egpio),
+	[136] = PINGROUP(136, _, _, _, _, _, _, _, _, egpio),
+	[137] = PINGROUP(137, _, _, _, _, _, _, _, _, egpio),
+	[138] = PINGROUP(138, _, _, _, _, _, _, _, _, egpio),
+	[139] = PINGROUP(139, _, _, _, _, _, _, _, _, egpio),
+	[140] = PINGROUP(140, _, _, _, _, _, _, _, _, egpio),
+	[141] = PINGROUP(141, _, _, _, _, _, _, _, _, egpio),
+	[142] = PINGROUP(142, _, _, _, _, _, _, _, _, egpio),
+	[143] = PINGROUP(143, _, _, _, _, _, _, _, _, egpio),
+	[144] = PINGROUP(144, dbg_out, _, _, _, _, _, _, _, egpio),
+	[145] = PINGROUP(145, _, _, _, _, _, _, _, _, egpio),
+	[146] = PINGROUP(146, _, _, _, _, _, _, _, _, egpio),
+	[147] = PINGROUP(147, _, _, _, _, _, _, _, _, egpio),
+	[148] = PINGROUP(148, _, _, _, _, _, _, _, _, egpio),
 	[149] = UFS_RESET(ufs_reset, 0x1a2000),
 	[150] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x199000, 15, 0),
 	[151] = SDC_QDSD_PINGROUP(sdc1_clk, 0x199000, 13, 6),
@@ -1511,6 +1612,7 @@
 	.ngpios = 150,
 	.wakeirq_map = sa8775p_pdc_map,
 	.nwakeirq_map = ARRAY_SIZE(sa8775p_pdc_map),
+	.egpio_func = 9,
 };
 
 static int sa8775p_pinctrl_probe(struct platform_device *pdev)
@@ -1520,6 +1622,7 @@
 
 static const struct of_device_id sa8775p_pinctrl_of_match[] = {
 	{ .compatible = "qcom,sa8775p-tlmm", },
+	{ .compatible = "qcom,sa8255p-tlmm", },
 	{ },
 };
 MODULE_DEVICE_TABLE(of, sa8775p_pinctrl_of_match);
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-sc7280-lpass-lpi.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-sc7280-lpass-lpi.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  * ALSA SoC platform-machine driver for QTi LPASS
  */
 
@@ -136,10 +137,15 @@
 };
 MODULE_DEVICE_TABLE(of, lpi_pinctrl_of_match);
 
+static const struct dev_pm_ops lpi_pinctrl_pm_ops = {
+	SET_RUNTIME_PM_OPS(lpi_pinctrl_runtime_suspend, lpi_pinctrl_runtime_resume, NULL)
+};
+
 static struct platform_driver lpi_pinctrl_driver = {
 	.driver = {
 		   .name = "qcom-sc7280-lpass-lpi-pinctrl",
 		   .of_match_table = lpi_pinctrl_of_match,
+		   .pm = &lpi_pinctrl_pm_ops,
 	},
 	.probe = lpi_pinctrl_probe,
 	.remove_new = lpi_pinctrl_remove,
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-sm7150.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-sm7150.c
@@ -65,7 +65,7 @@
 		.intr_detection_width = 2,		\
 	}
 
-#define SDC_QDSD_PINGROUP(pg_name, ctl, pull, drv)	\
+#define SDC_QDSD_PINGROUP(pg_name, _tile, ctl, pull, drv) \
 	{						\
 		.grp = PINCTRL_PINGROUP(#pg_name, 	\
 			pg_name##_pins, 		\
@@ -75,7 +75,7 @@
 		.intr_cfg_reg = 0,			\
 		.intr_status_reg = 0,			\
 		.intr_target_reg = 0,			\
-		.tile = SOUTH,				\
+		.tile = _tile,				\
 		.mux_bit = -1,				\
 		.pull_bit = pull,			\
 		.drv_bit = drv,				\
@@ -101,7 +101,7 @@
 		.intr_cfg_reg = 0,			\
 		.intr_status_reg = 0,			\
 		.intr_target_reg = 0,			\
-		.tile = SOUTH,				\
+		.tile = WEST,				\
 		.mux_bit = -1,				\
 		.pull_bit = 3,				\
 		.drv_bit = 0,				\
@@ -1199,13 +1199,13 @@
 	[117] = PINGROUP(117, NORTH, _, _, _, _, _, _, _, _, _),
 	[118] = PINGROUP(118, NORTH, _, _, _, _, _, _, _, _, _),
 	[119] = UFS_RESET(ufs_reset, 0x9f000),
-	[120] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x9a000, 15, 0),
-	[121] = SDC_QDSD_PINGROUP(sdc1_clk, 0x9a000, 13, 6),
-	[122] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x9a000, 11, 3),
-	[123] = SDC_QDSD_PINGROUP(sdc1_data, 0x9a000, 9, 0),
-	[124] = SDC_QDSD_PINGROUP(sdc2_clk, 0x98000, 14, 6),
-	[125] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x98000, 11, 3),
-	[126] = SDC_QDSD_PINGROUP(sdc2_data, 0x98000, 9, 0),
+	[120] = SDC_QDSD_PINGROUP(sdc1_rclk, WEST, 0x9a000, 15, 0),
+	[121] = SDC_QDSD_PINGROUP(sdc1_clk, WEST, 0x9a000, 13, 6),
+	[122] = SDC_QDSD_PINGROUP(sdc1_cmd, WEST, 0x9a000, 11, 3),
+	[123] = SDC_QDSD_PINGROUP(sdc1_data, WEST, 0x9a000, 9, 0),
+	[124] = SDC_QDSD_PINGROUP(sdc2_clk, SOUTH, 0x98000, 14, 6),
+	[125] = SDC_QDSD_PINGROUP(sdc2_cmd, SOUTH, 0x98000, 11, 3),
+	[126] = SDC_QDSD_PINGROUP(sdc2_data, SOUTH, 0x98000, 9, 0),
 };
 
 static const struct msm_gpio_wakeirq_map sm7150_pdc_map[] = {
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2012-2014, 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/gpio/driver.h>
@@ -667,7 +667,7 @@
 		"push-pull", "open-drain", "open-source"
 	};
 	static const char *const strengths[] = {
-		"no", "high", "medium", "low"
+		"no", "low", "medium", "high"
 	};
 
 	pad = pctldev->desc->pins[pin].drv_data;
@@ -1204,9 +1204,9 @@
 	{ .compatible = "qcom,pm6350-gpio", .data = (void *) 9 },
 	{ .compatible = "qcom,pm7250b-gpio", .data = (void *) 12 },
 	{ .compatible = "qcom,pm7325-gpio", .data = (void *) 10 },
+	{ .compatible = "qcom,pm7325b-gpio", .data = (void *) 8 },
 	{ .compatible = "qcom,pm7550ba-gpio", .data = (void *) 8},
 	{ .compatible = "qcom,pm8005-gpio", .data = (void *) 4 },
-	{ .compatible = "qcom,pm8008-gpio", .data = (void *) 2 },
 	{ .compatible = "qcom,pm8019-gpio", .data = (void *) 6 },
 	/* pm8150 has 10 GPIOs with holes on 2, 5, 7 and 8 */
 	{ .compatible = "qcom,pm8150-gpio", .data = (void *) 10 },
@@ -1226,6 +1226,8 @@
 	{ .compatible = "qcom,pm8550ve-gpio", .data = (void *) 8 },
 	{ .compatible = "qcom,pm8550vs-gpio", .data = (void *) 6 },
 	{ .compatible = "qcom,pm8916-gpio", .data = (void *) 4 },
+	/* pm8937 has 8 GPIOs with holes on 3, 4 and 6 */
+	{ .compatible = "qcom,pm8937-gpio", .data = (void *) 8 },
 	{ .compatible = "qcom,pm8941-gpio", .data = (void *) 36 },
 	/* pm8950 has 8 GPIOs with holes on 3 */
 	{ .compatible = "qcom,pm8950-gpio", .data = (void *) 8 },
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
@@ -983,6 +983,7 @@
 	{ .compatible = "qcom,pm8226-mpp", .data = (void *) 8 },
 	{ .compatible = "qcom,pm8841-mpp", .data = (void *) 4 },
 	{ .compatible = "qcom,pm8916-mpp", .data = (void *) 4 },
+	{ .compatible = "qcom,pm8937-mpp", .data = (void *) 4 },
 	{ .compatible = "qcom,pm8941-mpp", .data = (void *) 8 },
 	{ .compatible = "qcom,pm8950-mpp", .data = (void *) 4 },
 	{ .compatible = "qcom,pmi8950-mpp", .data = (void *) 4 },
--- linux-qcom-6.8.0.orig/drivers/pinctrl/qcom/pinctrl-x1e80100.c
+++ linux-qcom-6.8.0/drivers/pinctrl/qcom/pinctrl-x1e80100.c
@@ -1805,26 +1805,29 @@
 	[235] = PINGROUP(235, aon_cci, qdss_gpio, _, _, _, _, _, _, _),
 	[236] = PINGROUP(236, aon_cci, qdss_gpio, _, _, _, _, _, _, _),
 	[237] = PINGROUP(237, _, _, _, _, _, _, _, _, _),
-	[238] = UFS_RESET(ufs_reset, 0x1f9000),
-	[239] = SDC_QDSD_PINGROUP(sdc2_clk, 0x1f2000, 14, 6),
-	[240] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x1f2000, 11, 3),
-	[241] = SDC_QDSD_PINGROUP(sdc2_data, 0x1f2000, 9, 0),
+	[238] = UFS_RESET(ufs_reset, 0xf9000),
+	[239] = SDC_QDSD_PINGROUP(sdc2_clk, 0xf2000, 14, 6),
+	[240] = SDC_QDSD_PINGROUP(sdc2_cmd, 0xf2000, 11, 3),
+	[241] = SDC_QDSD_PINGROUP(sdc2_data, 0xf2000, 9, 0),
 };
 
 static const struct msm_gpio_wakeirq_map x1e80100_pdc_map[] = {
 	{ 0, 72 }, { 2, 70 }, { 3, 71 }, { 6, 123 }, { 7, 67 }, { 11, 85 },
-	{ 15, 68 }, { 18, 122 }, { 19, 69 }, { 21, 158 }, { 23, 143 }, { 26, 129 },
-	{ 27, 144 }, { 28, 77 }, { 29, 78 }, { 30, 92 }, { 32, 145 }, { 33, 115 },
-	{ 34, 130 }, { 35, 146 }, { 36, 147 }, { 39, 80 }, { 43, 148 }, { 47, 149 },
-	{ 51, 79 }, { 53, 89 }, { 59, 87 }, { 64, 90 }, { 65, 106 }, { 66, 142 },
-	{ 67, 88 }, { 71, 91 }, { 75, 152 }, { 79, 153 }, { 80, 125 }, { 81, 128 },
-	{ 84, 137 }, { 85, 155 }, { 87, 156 }, { 91, 157 }, { 92, 138 }, { 94, 140 },
-	{ 95, 141 }, { 113, 84 }, { 121, 73 }, { 123, 74 }, { 129, 76 }, { 131, 82 },
-	{ 134, 83 }, { 141, 93 }, { 144, 94 }, { 147, 96 }, { 148, 97 }, { 150, 102 },
-	{ 151, 103 }, { 153, 104 }, { 156, 105 }, { 157, 107 }, { 163, 98 }, { 166, 112 },
-	{ 172, 99 }, { 181, 101 }, { 184, 116 }, { 193, 40 }, { 193, 117 }, { 196, 108 },
-	{ 203, 133 }, { 212, 120 }, { 213, 150 }, { 214, 121 }, { 215, 118 }, { 217, 109 },
-	{ 220, 110 }, { 221, 111 }, { 222, 124 }, { 224, 131 }, { 225, 132 },
+	{ 13, 86 }, { 15, 68 }, { 18, 122 }, { 19, 69 }, { 21, 158 }, { 23, 143 },
+	{ 24, 126 }, { 26, 129 }, { 27, 144 }, { 28, 77 }, { 29, 78 }, { 30, 92 },
+	{ 31, 159 }, { 32, 145 }, { 33, 115 }, { 34, 130 }, { 35, 146 }, { 36, 147 },
+	{ 38, 113 }, { 39, 80 }, { 43, 148 }, { 47, 149 }, { 51, 79 }, { 53, 89 },
+	{ 55, 81 }, { 59, 87 }, { 64, 90 }, { 65, 106 }, { 66, 142 }, { 67, 88 },
+	{ 68, 151 }, { 71, 91 }, { 75, 152 }, { 79, 153 }, { 80, 125 }, { 81, 128 },
+	{ 83, 154 }, { 84, 137 }, { 85, 155 }, { 87, 156 }, { 91, 157 }, { 92, 138 },
+	{ 93, 139 }, { 94, 140 }, { 95, 141 }, { 113, 84 }, { 121, 73 }, { 123, 74 },
+	{ 125, 75 }, { 129, 76 }, { 131, 82 }, { 134, 83 }, { 141, 93 }, { 144, 94 },
+	{ 145, 95 }, { 147, 96 }, { 148, 97 }, { 150, 102 }, { 151, 103 }, { 153, 104 },
+	{ 154, 100 }, { 156, 105 }, { 157, 107 }, { 163, 98 }, { 166, 112 }, { 172, 99 },
+	{ 175, 114 }, { 181, 101 }, { 184, 116 }, { 193, 117 }, { 196, 108 }, { 203, 133 },
+	{ 208, 134 }, { 212, 120 }, { 213, 150 }, { 214, 121 }, { 215, 118 }, { 217, 109 },
+	{ 219, 119 }, { 220, 110 }, { 221, 111 }, { 222, 124 }, { 224, 131 }, { 225, 132 },
+	{ 228, 135 }, { 230, 136 }, { 232, 162 },
 };
 
 static const struct msm_pinctrl_soc_data x1e80100_pinctrl = {
@@ -1836,7 +1839,9 @@
 	.ngroups = ARRAY_SIZE(x1e80100_groups),
 	.ngpios = 239,
 	.wakeirq_map = x1e80100_pdc_map,
-	.nwakeirq_map = ARRAY_SIZE(x1e80100_pdc_map),
+	/* TODO: Enabling PDC currently breaks GPIO interrupts */
+	.nwakeirq_map = 0,
+	/* .nwakeirq_map = ARRAY_SIZE(x1e80100_pdc_map), */
 	.egpio_func = 9,
 };
 
--- linux-qcom-6.8.0.orig/drivers/pinctrl/renesas/core.c
+++ linux-qcom-6.8.0/drivers/pinctrl/renesas/core.c
@@ -731,10 +731,12 @@
 		sh_pfc_walk_regs(pfc, sh_pfc_restore_reg);
 	return 0;
 }
+#define pm_psci_sleep_ptr(_ptr)	pm_sleep_ptr(_ptr)
 #else
 static int sh_pfc_suspend_init(struct sh_pfc *pfc) { return 0; }
 static int sh_pfc_suspend_noirq(struct device *dev) { return 0; }
 static int sh_pfc_resume_noirq(struct device *dev) { return 0; }
+#define pm_psci_sleep_ptr(_ptr)	PTR_IF(false, (_ptr))
 #endif	/* CONFIG_ARM_PSCI_FW */
 
 static DEFINE_NOIRQ_DEV_PM_OPS(sh_pfc_pm, sh_pfc_suspend_noirq, sh_pfc_resume_noirq);
@@ -907,9 +909,11 @@
 		sh_pfc_err("reg 0x%x: var_field_width declares %u instead of %u bits\n",
 			   cfg_reg->reg, rw, cfg_reg->reg_width);
 
-	if (n != cfg_reg->nr_enum_ids)
+	if (n != cfg_reg->nr_enum_ids) {
 		sh_pfc_err("reg 0x%x: enum_ids[] has %u instead of %u values\n",
 			   cfg_reg->reg, cfg_reg->nr_enum_ids, n);
+		n = cfg_reg->nr_enum_ids;
+	}
 
 check_enum_ids:
 	sh_pfc_check_reg_enums(drvname, cfg_reg->reg, cfg_reg->enum_ids, n);
@@ -1415,7 +1419,7 @@
 	.driver		= {
 		.name	= DRV_NAME,
 		.of_match_table = of_match_ptr(sh_pfc_of_table),
-		.pm	= pm_sleep_ptr(&sh_pfc_pm),
+		.pm	= pm_psci_sleep_ptr(&sh_pfc_pm),
 	},
 };
 
--- linux-qcom-6.8.0.orig/drivers/pinctrl/renesas/pfc-r8a779g0.c
+++ linux-qcom-6.8.0/drivers/pinctrl/renesas/pfc-r8a779g0.c
@@ -68,20 +68,20 @@
 #define GPSR0_9		F_(MSIOF5_SYNC,		IP1SR0_7_4)
 #define GPSR0_8		F_(MSIOF5_SS1,		IP1SR0_3_0)
 #define GPSR0_7		F_(MSIOF5_SS2,		IP0SR0_31_28)
-#define GPSR0_6		F_(IRQ0,		IP0SR0_27_24)
-#define GPSR0_5		F_(IRQ1,		IP0SR0_23_20)
-#define GPSR0_4		F_(IRQ2,		IP0SR0_19_16)
-#define GPSR0_3		F_(IRQ3,		IP0SR0_15_12)
+#define GPSR0_6		F_(IRQ0_A,		IP0SR0_27_24)
+#define GPSR0_5		F_(IRQ1_A,		IP0SR0_23_20)
+#define GPSR0_4		F_(IRQ2_A,		IP0SR0_19_16)
+#define GPSR0_3		F_(IRQ3_A,		IP0SR0_15_12)
 #define GPSR0_2		F_(GP0_02,		IP0SR0_11_8)
 #define GPSR0_1		F_(GP0_01,		IP0SR0_7_4)
 #define GPSR0_0		F_(GP0_00,		IP0SR0_3_0)
 
 /* GPSR1 */
-#define GPSR1_28	F_(HTX3,		IP3SR1_19_16)
-#define GPSR1_27	F_(HCTS3_N,		IP3SR1_15_12)
-#define GPSR1_26	F_(HRTS3_N,		IP3SR1_11_8)
-#define GPSR1_25	F_(HSCK3,		IP3SR1_7_4)
-#define GPSR1_24	F_(HRX3,		IP3SR1_3_0)
+#define GPSR1_28	F_(HTX3_A,		IP3SR1_19_16)
+#define GPSR1_27	F_(HCTS3_N_A,		IP3SR1_15_12)
+#define GPSR1_26	F_(HRTS3_N_A,		IP3SR1_11_8)
+#define GPSR1_25	F_(HSCK3_A,		IP3SR1_7_4)
+#define GPSR1_24	F_(HRX3_A,		IP3SR1_3_0)
 #define GPSR1_23	F_(GP1_23,		IP2SR1_31_28)
 #define GPSR1_22	F_(AUDIO_CLKIN,		IP2SR1_27_24)
 #define GPSR1_21	F_(AUDIO_CLKOUT,	IP2SR1_23_20)
@@ -119,14 +119,14 @@
 #define GPSR2_11	F_(CANFD0_RX,		IP1SR2_15_12)
 #define GPSR2_10	F_(CANFD0_TX,		IP1SR2_11_8)
 #define GPSR2_9		F_(CAN_CLK,		IP1SR2_7_4)
-#define GPSR2_8		F_(TPU0TO0,		IP1SR2_3_0)
-#define GPSR2_7		F_(TPU0TO1,		IP0SR2_31_28)
+#define GPSR2_8		F_(TPU0TO0_A,		IP1SR2_3_0)
+#define GPSR2_7		F_(TPU0TO1_A,		IP0SR2_31_28)
 #define GPSR2_6		F_(FXR_TXDB,		IP0SR2_27_24)
-#define GPSR2_5		F_(FXR_TXENB_N,		IP0SR2_23_20)
+#define GPSR2_5		F_(FXR_TXENB_N_A,	IP0SR2_23_20)
 #define GPSR2_4		F_(RXDB_EXTFXR,		IP0SR2_19_16)
 #define GPSR2_3		F_(CLK_EXTFXR,		IP0SR2_15_12)
 #define GPSR2_2		F_(RXDA_EXTFXR,		IP0SR2_11_8)
-#define GPSR2_1		F_(FXR_TXENA_N,		IP0SR2_7_4)
+#define GPSR2_1		F_(FXR_TXENA_N_A,	IP0SR2_7_4)
 #define GPSR2_0		F_(FXR_TXDA,		IP0SR2_3_0)
 
 /* GPSR3 */
@@ -275,13 +275,13 @@
 
 /* SR0 */
 /* IP0SR0 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
-#define IP0SR0_3_0	F_(0, 0)		FM(ERROROUTC_N_B)	FM(TCLK2_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR0_3_0	F_(0, 0)		FM(ERROROUTC_N_B)	FM(TCLK2_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP0SR0_7_4	F_(0, 0)		FM(MSIOF3_SS1)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP0SR0_11_8	F_(0, 0)		FM(MSIOF3_SS2)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR0_15_12	FM(IRQ3)		FM(MSIOF3_SCK)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR0_19_16	FM(IRQ2)		FM(MSIOF3_TXD)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR0_23_20	FM(IRQ1)		FM(MSIOF3_RXD)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR0_27_24	FM(IRQ0)		FM(MSIOF3_SYNC)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR0_15_12	FM(IRQ3_A)		FM(MSIOF3_SCK)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR0_19_16	FM(IRQ2_A)		FM(MSIOF3_TXD)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR0_23_20	FM(IRQ1_A)		FM(MSIOF3_RXD)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR0_27_24	FM(IRQ0_A)		FM(MSIOF3_SYNC)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP0SR0_31_28	FM(MSIOF5_SS2)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* IP1SR0 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
@@ -290,72 +290,72 @@
 #define IP1SR0_11_8	FM(MSIOF5_TXD)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP1SR0_15_12	FM(MSIOF5_SCK)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP1SR0_19_16	FM(MSIOF5_RXD)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR0_23_20	FM(MSIOF2_SS2)		FM(TCLK1)		FM(IRQ2_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR0_27_24	FM(MSIOF2_SS1)		FM(HTX1)		FM(TX1)			F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR0_31_28	FM(MSIOF2_SYNC)		FM(HRX1)		FM(RX1)			F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR0_23_20	FM(MSIOF2_SS2)		FM(TCLK1_A)		FM(IRQ2_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR0_27_24	FM(MSIOF2_SS1)		FM(HTX1_A)		FM(TX1_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR0_31_28	FM(MSIOF2_SYNC)		FM(HRX1_A)		FM(RX1_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* IP2SR0 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
-#define IP2SR0_3_0	FM(MSIOF2_TXD)		FM(HCTS1_N)		FM(CTS1_N)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP2SR0_7_4	FM(MSIOF2_SCK)		FM(HRTS1_N)		FM(RTS1_N)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP2SR0_11_8	FM(MSIOF2_RXD)		FM(HSCK1)		FM(SCK1)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP2SR0_3_0	FM(MSIOF2_TXD)		FM(HCTS1_N_A)		FM(CTS1_N_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP2SR0_7_4	FM(MSIOF2_SCK)		FM(HRTS1_N_A)		FM(RTS1_N_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP2SR0_11_8	FM(MSIOF2_RXD)		FM(HSCK1_A)		FM(SCK1_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* SR1 */
 /* IP0SR1 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
-#define IP0SR1_3_0	FM(MSIOF1_SS2)		FM(HTX3_A)		FM(TX3)			F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR1_7_4	FM(MSIOF1_SS1)		FM(HCTS3_N_A)		FM(RX3)			F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR1_11_8	FM(MSIOF1_SYNC)		FM(HRTS3_N_A)		FM(RTS3_N)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR1_15_12	FM(MSIOF1_SCK)		FM(HSCK3_A)		FM(CTS3_N)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR1_19_16	FM(MSIOF1_TXD)		FM(HRX3_A)		FM(SCK3)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR1_3_0	FM(MSIOF1_SS2)		FM(HTX3_B)		FM(TX3_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR1_7_4	FM(MSIOF1_SS1)		FM(HCTS3_N_B)		FM(RX3_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR1_11_8	FM(MSIOF1_SYNC)		FM(HRTS3_N_B)		FM(RTS3_N_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR1_15_12	FM(MSIOF1_SCK)		FM(HSCK3_B)		FM(CTS3_N_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR1_19_16	FM(MSIOF1_TXD)		FM(HRX3_B)		FM(SCK3_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP0SR1_23_20	FM(MSIOF1_RXD)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR1_27_24	FM(MSIOF0_SS2)		FM(HTX1_X)		FM(TX1_X)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR1_31_28	FM(MSIOF0_SS1)		FM(HRX1_X)		FM(RX1_X)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR1_27_24	FM(MSIOF0_SS2)		FM(HTX1_B)		FM(TX1_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR1_31_28	FM(MSIOF0_SS1)		FM(HRX1_B)		FM(RX1_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* IP1SR1 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
-#define IP1SR1_3_0	FM(MSIOF0_SYNC)		FM(HCTS1_N_X)		FM(CTS1_N_X)		FM(CANFD5_TX_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR1_7_4	FM(MSIOF0_TXD)		FM(HRTS1_N_X)		FM(RTS1_N_X)		FM(CANFD5_RX_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR1_11_8	FM(MSIOF0_SCK)		FM(HSCK1_X)		FM(SCK1_X)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR1_3_0	FM(MSIOF0_SYNC)		FM(HCTS1_N_B)		FM(CTS1_N_B)		FM(CANFD5_TX_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR1_7_4	FM(MSIOF0_TXD)		FM(HRTS1_N_B)		FM(RTS1_N_B)		FM(CANFD5_RX_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR1_11_8	FM(MSIOF0_SCK)		FM(HSCK1_B)		FM(SCK1_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP1SR1_15_12	FM(MSIOF0_RXD)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP1SR1_19_16	FM(HTX0)		FM(TX0)			F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR1_23_20	FM(HCTS0_N)		FM(CTS0_N)		FM(PWM8_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR1_27_24	FM(HRTS0_N)		FM(RTS0_N)		FM(PWM9_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR1_31_28	FM(HSCK0)		FM(SCK0)		FM(PWM0_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR1_23_20	FM(HCTS0_N)		FM(CTS0_N)		FM(PWM8)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR1_27_24	FM(HRTS0_N)		FM(RTS0_N)		FM(PWM9)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR1_31_28	FM(HSCK0)		FM(SCK0)		FM(PWM0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* IP2SR1 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
 #define IP2SR1_3_0	FM(HRX0)		FM(RX0)			F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP2SR1_7_4	FM(SCIF_CLK)		FM(IRQ4_A)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP2SR1_11_8	FM(SSI_SCK)		FM(TCLK3)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP2SR1_15_12	FM(SSI_WS)		FM(TCLK4)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP2SR1_19_16	FM(SSI_SD)		FM(IRQ0_A)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP2SR1_23_20	FM(AUDIO_CLKOUT)	FM(IRQ1_A)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP2SR1_11_8	FM(SSI_SCK)		FM(TCLK3_B)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP2SR1_15_12	FM(SSI_WS)		FM(TCLK4_B)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP2SR1_19_16	FM(SSI_SD)		FM(IRQ0_B)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP2SR1_23_20	FM(AUDIO_CLKOUT)	FM(IRQ1_B)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP2SR1_27_24	FM(AUDIO_CLKIN)		FM(PWM3_A)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP2SR1_31_28	F_(0, 0)		FM(TCLK2)		FM(MSIOF4_SS1)		FM(IRQ3_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP2SR1_31_28	F_(0, 0)		FM(TCLK2_A)		FM(MSIOF4_SS1)		FM(IRQ3_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* IP3SR1 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
-#define IP3SR1_3_0	FM(HRX3)		FM(SCK3_A)		FM(MSIOF4_SS2)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP3SR1_7_4	FM(HSCK3)		FM(CTS3_N_A)		FM(MSIOF4_SCK)		FM(TPU0TO0_A)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP3SR1_11_8	FM(HRTS3_N)		FM(RTS3_N_A)		FM(MSIOF4_TXD)		FM(TPU0TO1_A)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP3SR1_15_12	FM(HCTS3_N)		FM(RX3_A)		FM(MSIOF4_RXD)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP3SR1_19_16	FM(HTX3)		FM(TX3_A)		FM(MSIOF4_SYNC)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP3SR1_3_0	FM(HRX3_A)		FM(SCK3_A)		FM(MSIOF4_SS2)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP3SR1_7_4	FM(HSCK3_A)		FM(CTS3_N_A)		FM(MSIOF4_SCK)		FM(TPU0TO0_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP3SR1_11_8	FM(HRTS3_N_A)		FM(RTS3_N_A)		FM(MSIOF4_TXD)		FM(TPU0TO1_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP3SR1_15_12	FM(HCTS3_N_A)		FM(RX3_A)		FM(MSIOF4_RXD)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP3SR1_19_16	FM(HTX3_A)		FM(TX3_A)		FM(MSIOF4_SYNC)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* SR2 */
 /* IP0SR2 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
-#define IP0SR2_3_0	FM(FXR_TXDA)		FM(CANFD1_TX)		FM(TPU0TO2_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR2_7_4	FM(FXR_TXENA_N)		FM(CANFD1_RX)		FM(TPU0TO3_A)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR2_11_8	FM(RXDA_EXTFXR)		FM(CANFD5_TX)		FM(IRQ5)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR2_15_12	FM(CLK_EXTFXR)		FM(CANFD5_RX)		FM(IRQ4_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR2_3_0	FM(FXR_TXDA)		FM(CANFD1_TX)		FM(TPU0TO2_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR2_7_4	FM(FXR_TXENA_N_A)	FM(CANFD1_RX)		FM(TPU0TO3_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR2_11_8	FM(RXDA_EXTFXR)		FM(CANFD5_TX_A)		FM(IRQ5)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR2_15_12	FM(CLK_EXTFXR)		FM(CANFD5_RX_A)		FM(IRQ4_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP0SR2_19_16	FM(RXDB_EXTFXR)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR2_23_20	FM(FXR_TXENB_N)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR2_23_20	FM(FXR_TXENB_N_A)	F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP0SR2_27_24	FM(FXR_TXDB)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP0SR2_31_28	FM(TPU0TO1)		FM(CANFD6_TX)		F_(0, 0)		FM(TCLK2_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP0SR2_31_28	FM(TPU0TO1_A)		FM(CANFD6_TX)		F_(0, 0)		FM(TCLK2_C)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* IP1SR2 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
-#define IP1SR2_3_0	FM(TPU0TO0)		FM(CANFD6_RX)		F_(0, 0)		FM(TCLK1_A)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR2_7_4	FM(CAN_CLK)		FM(FXR_TXENA_N_X)	F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR2_11_8	FM(CANFD0_TX)		FM(FXR_TXENB_N_X)	F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR2_3_0	FM(TPU0TO0_A)		FM(CANFD6_RX)		F_(0, 0)		FM(TCLK1_B)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR2_7_4	FM(CAN_CLK)		FM(FXR_TXENA_N_B)	F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR2_11_8	FM(CANFD0_TX)		FM(FXR_TXENB_N_B)	F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP1SR2_15_12	FM(CANFD0_RX)		FM(STPWT_EXTFXR)	F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR2_19_16	FM(CANFD2_TX)		FM(TPU0TO2)		F_(0, 0)		FM(TCLK3_A)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR2_23_20	FM(CANFD2_RX)		FM(TPU0TO3)		FM(PWM1_B)		FM(TCLK4_A)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR2_27_24	FM(CANFD3_TX)		F_(0, 0)		FM(PWM2_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR2_19_16	FM(CANFD2_TX)		FM(TPU0TO2_A)		F_(0, 0)		FM(TCLK3_C)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR2_23_20	FM(CANFD2_RX)		FM(TPU0TO3_A)		FM(PWM1_B)		FM(TCLK4_C)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR2_27_24	FM(CANFD3_TX)		F_(0, 0)		FM(PWM2)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP1SR2_31_28	FM(CANFD3_RX)		F_(0, 0)		FM(PWM3_B)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* IP2SR2 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
@@ -381,8 +381,8 @@
 #define IP1SR3_11_8	FM(MMC_SD_CMD)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP1SR3_15_12	FM(SD_CD)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP1SR3_19_16	FM(SD_WP)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR3_23_20	FM(IPC_CLKIN)		FM(IPC_CLKEN_IN)	FM(PWM1_A)		FM(TCLK3_X)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
-#define IP1SR3_27_24	FM(IPC_CLKOUT)		FM(IPC_CLKEN_OUT)	FM(ERROROUTC_N_A)	FM(TCLK4_X)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR3_23_20	FM(IPC_CLKIN)		FM(IPC_CLKEN_IN)	FM(PWM1_A)		FM(TCLK3_A)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
+#define IP1SR3_27_24	FM(IPC_CLKOUT)		FM(IPC_CLKEN_OUT)	FM(ERROROUTC_N_A)	FM(TCLK4_A)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 #define IP1SR3_31_28	FM(QSPI0_SSL)		F_(0, 0)		F_(0, 0)		F_(0, 0)	F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0)
 
 /* IP2SR3 */		/* 0 */			/* 1 */			/* 2 */			/* 3		4	 5	  6	   7	    8	     9	      A	       B	C	 D	  E	   F */
@@ -718,22 +718,22 @@
 
 	/* IP0SR0 */
 	PINMUX_IPSR_GPSR(IP0SR0_3_0,	ERROROUTC_N_B),
-	PINMUX_IPSR_GPSR(IP0SR0_3_0,	TCLK2_A),
+	PINMUX_IPSR_GPSR(IP0SR0_3_0,	TCLK2_B),
 
 	PINMUX_IPSR_GPSR(IP0SR0_7_4,	MSIOF3_SS1),
 
 	PINMUX_IPSR_GPSR(IP0SR0_11_8,	MSIOF3_SS2),
 
-	PINMUX_IPSR_GPSR(IP0SR0_15_12,	IRQ3),
+	PINMUX_IPSR_GPSR(IP0SR0_15_12,	IRQ3_A),
 	PINMUX_IPSR_GPSR(IP0SR0_15_12,	MSIOF3_SCK),
 
-	PINMUX_IPSR_GPSR(IP0SR0_19_16,	IRQ2),
+	PINMUX_IPSR_GPSR(IP0SR0_19_16,	IRQ2_A),
 	PINMUX_IPSR_GPSR(IP0SR0_19_16,	MSIOF3_TXD),
 
-	PINMUX_IPSR_GPSR(IP0SR0_23_20,	IRQ1),
+	PINMUX_IPSR_GPSR(IP0SR0_23_20,	IRQ1_A),
 	PINMUX_IPSR_GPSR(IP0SR0_23_20,	MSIOF3_RXD),
 
-	PINMUX_IPSR_GPSR(IP0SR0_27_24,	IRQ0),
+	PINMUX_IPSR_GPSR(IP0SR0_27_24,	IRQ0_A),
 	PINMUX_IPSR_GPSR(IP0SR0_27_24,	MSIOF3_SYNC),
 
 	PINMUX_IPSR_GPSR(IP0SR0_31_28,	MSIOF5_SS2),
@@ -750,75 +750,75 @@
 	PINMUX_IPSR_GPSR(IP1SR0_19_16,	MSIOF5_RXD),
 
 	PINMUX_IPSR_GPSR(IP1SR0_23_20,	MSIOF2_SS2),
-	PINMUX_IPSR_GPSR(IP1SR0_23_20,	TCLK1),
-	PINMUX_IPSR_GPSR(IP1SR0_23_20,	IRQ2_A),
+	PINMUX_IPSR_GPSR(IP1SR0_23_20,	TCLK1_A),
+	PINMUX_IPSR_GPSR(IP1SR0_23_20,	IRQ2_B),
 
 	PINMUX_IPSR_GPSR(IP1SR0_27_24,	MSIOF2_SS1),
-	PINMUX_IPSR_GPSR(IP1SR0_27_24,	HTX1),
-	PINMUX_IPSR_GPSR(IP1SR0_27_24,	TX1),
+	PINMUX_IPSR_GPSR(IP1SR0_27_24,	HTX1_A),
+	PINMUX_IPSR_GPSR(IP1SR0_27_24,	TX1_A),
 
 	PINMUX_IPSR_GPSR(IP1SR0_31_28,	MSIOF2_SYNC),
-	PINMUX_IPSR_GPSR(IP1SR0_31_28,	HRX1),
-	PINMUX_IPSR_GPSR(IP1SR0_31_28,	RX1),
+	PINMUX_IPSR_GPSR(IP1SR0_31_28,	HRX1_A),
+	PINMUX_IPSR_GPSR(IP1SR0_31_28,	RX1_A),
 
 	/* IP2SR0 */
 	PINMUX_IPSR_GPSR(IP2SR0_3_0,	MSIOF2_TXD),
-	PINMUX_IPSR_GPSR(IP2SR0_3_0,	HCTS1_N),
-	PINMUX_IPSR_GPSR(IP2SR0_3_0,	CTS1_N),
+	PINMUX_IPSR_GPSR(IP2SR0_3_0,	HCTS1_N_A),
+	PINMUX_IPSR_GPSR(IP2SR0_3_0,	CTS1_N_A),
 
 	PINMUX_IPSR_GPSR(IP2SR0_7_4,	MSIOF2_SCK),
-	PINMUX_IPSR_GPSR(IP2SR0_7_4,	HRTS1_N),
-	PINMUX_IPSR_GPSR(IP2SR0_7_4,	RTS1_N),
+	PINMUX_IPSR_GPSR(IP2SR0_7_4,	HRTS1_N_A),
+	PINMUX_IPSR_GPSR(IP2SR0_7_4,	RTS1_N_A),
 
 	PINMUX_IPSR_GPSR(IP2SR0_11_8,	MSIOF2_RXD),
-	PINMUX_IPSR_GPSR(IP2SR0_11_8,	HSCK1),
-	PINMUX_IPSR_GPSR(IP2SR0_11_8,	SCK1),
+	PINMUX_IPSR_GPSR(IP2SR0_11_8,	HSCK1_A),
+	PINMUX_IPSR_GPSR(IP2SR0_11_8,	SCK1_A),
 
 	/* IP0SR1 */
 	PINMUX_IPSR_GPSR(IP0SR1_3_0,	MSIOF1_SS2),
-	PINMUX_IPSR_GPSR(IP0SR1_3_0,	HTX3_A),
-	PINMUX_IPSR_GPSR(IP0SR1_3_0,	TX3),
+	PINMUX_IPSR_GPSR(IP0SR1_3_0,	HTX3_B),
+	PINMUX_IPSR_GPSR(IP0SR1_3_0,	TX3_B),
 
 	PINMUX_IPSR_GPSR(IP0SR1_7_4,	MSIOF1_SS1),
-	PINMUX_IPSR_GPSR(IP0SR1_7_4,	HCTS3_N_A),
-	PINMUX_IPSR_GPSR(IP0SR1_7_4,	RX3),
+	PINMUX_IPSR_GPSR(IP0SR1_7_4,	HCTS3_N_B),
+	PINMUX_IPSR_GPSR(IP0SR1_7_4,	RX3_B),
 
 	PINMUX_IPSR_GPSR(IP0SR1_11_8,	MSIOF1_SYNC),
-	PINMUX_IPSR_GPSR(IP0SR1_11_8,	HRTS3_N_A),
-	PINMUX_IPSR_GPSR(IP0SR1_11_8,	RTS3_N),
+	PINMUX_IPSR_GPSR(IP0SR1_11_8,	HRTS3_N_B),
+	PINMUX_IPSR_GPSR(IP0SR1_11_8,	RTS3_N_B),
 
 	PINMUX_IPSR_GPSR(IP0SR1_15_12,	MSIOF1_SCK),
-	PINMUX_IPSR_GPSR(IP0SR1_15_12,	HSCK3_A),
-	PINMUX_IPSR_GPSR(IP0SR1_15_12,	CTS3_N),
+	PINMUX_IPSR_GPSR(IP0SR1_15_12,	HSCK3_B),
+	PINMUX_IPSR_GPSR(IP0SR1_15_12,	CTS3_N_B),
 
 	PINMUX_IPSR_GPSR(IP0SR1_19_16,	MSIOF1_TXD),
-	PINMUX_IPSR_GPSR(IP0SR1_19_16,	HRX3_A),
-	PINMUX_IPSR_GPSR(IP0SR1_19_16,	SCK3),
+	PINMUX_IPSR_GPSR(IP0SR1_19_16,	HRX3_B),
+	PINMUX_IPSR_GPSR(IP0SR1_19_16,	SCK3_B),
 
 	PINMUX_IPSR_GPSR(IP0SR1_23_20,	MSIOF1_RXD),
 
 	PINMUX_IPSR_GPSR(IP0SR1_27_24,	MSIOF0_SS2),
-	PINMUX_IPSR_GPSR(IP0SR1_27_24,	HTX1_X),
-	PINMUX_IPSR_GPSR(IP0SR1_27_24,	TX1_X),
+	PINMUX_IPSR_GPSR(IP0SR1_27_24,	HTX1_B),
+	PINMUX_IPSR_GPSR(IP0SR1_27_24,	TX1_B),
 
 	PINMUX_IPSR_GPSR(IP0SR1_31_28,	MSIOF0_SS1),
-	PINMUX_IPSR_GPSR(IP0SR1_31_28,	HRX1_X),
-	PINMUX_IPSR_GPSR(IP0SR1_31_28,	RX1_X),
+	PINMUX_IPSR_GPSR(IP0SR1_31_28,	HRX1_B),
+	PINMUX_IPSR_GPSR(IP0SR1_31_28,	RX1_B),
 
 	/* IP1SR1 */
 	PINMUX_IPSR_GPSR(IP1SR1_3_0,	MSIOF0_SYNC),
-	PINMUX_IPSR_GPSR(IP1SR1_3_0,	HCTS1_N_X),
-	PINMUX_IPSR_GPSR(IP1SR1_3_0,	CTS1_N_X),
+	PINMUX_IPSR_GPSR(IP1SR1_3_0,	HCTS1_N_B),
+	PINMUX_IPSR_GPSR(IP1SR1_3_0,	CTS1_N_B),
 	PINMUX_IPSR_GPSR(IP1SR1_3_0,	CANFD5_TX_B),
 
 	PINMUX_IPSR_GPSR(IP1SR1_7_4,	MSIOF0_TXD),
-	PINMUX_IPSR_GPSR(IP1SR1_7_4,	HRTS1_N_X),
-	PINMUX_IPSR_GPSR(IP1SR1_7_4,	RTS1_N_X),
+	PINMUX_IPSR_GPSR(IP1SR1_7_4,	HRTS1_N_B),
+	PINMUX_IPSR_GPSR(IP1SR1_7_4,	RTS1_N_B),
 	PINMUX_IPSR_GPSR(IP1SR1_7_4,	CANFD5_RX_B),
 
 	PINMUX_IPSR_GPSR(IP1SR1_11_8,	MSIOF0_SCK),
-	PINMUX_IPSR_GPSR(IP1SR1_11_8,	HSCK1_X),
-	PINMUX_IPSR_GPSR(IP1SR1_11_8,	SCK1_X),
+	PINMUX_IPSR_GPSR(IP1SR1_11_8,	HSCK1_B),
+	PINMUX_IPSR_GPSR(IP1SR1_11_8,	SCK1_B),
 
 	PINMUX_IPSR_GPSR(IP1SR1_15_12,	MSIOF0_RXD),
 
@@ -827,15 +827,15 @@
 
 	PINMUX_IPSR_GPSR(IP1SR1_23_20,	HCTS0_N),
 	PINMUX_IPSR_GPSR(IP1SR1_23_20,	CTS0_N),
-	PINMUX_IPSR_GPSR(IP1SR1_23_20,	PWM8_A),
+	PINMUX_IPSR_GPSR(IP1SR1_23_20,	PWM8),
 
 	PINMUX_IPSR_GPSR(IP1SR1_27_24,	HRTS0_N),
 	PINMUX_IPSR_GPSR(IP1SR1_27_24,	RTS0_N),
-	PINMUX_IPSR_GPSR(IP1SR1_27_24,	PWM9_A),
+	PINMUX_IPSR_GPSR(IP1SR1_27_24,	PWM9),
 
 	PINMUX_IPSR_GPSR(IP1SR1_31_28,	HSCK0),
 	PINMUX_IPSR_GPSR(IP1SR1_31_28,	SCK0),
-	PINMUX_IPSR_GPSR(IP1SR1_31_28,	PWM0_A),
+	PINMUX_IPSR_GPSR(IP1SR1_31_28,	PWM0),
 
 	/* IP2SR1 */
 	PINMUX_IPSR_GPSR(IP2SR1_3_0,	HRX0),
@@ -845,99 +845,99 @@
 	PINMUX_IPSR_GPSR(IP2SR1_7_4,	IRQ4_A),
 
 	PINMUX_IPSR_GPSR(IP2SR1_11_8,	SSI_SCK),
-	PINMUX_IPSR_GPSR(IP2SR1_11_8,	TCLK3),
+	PINMUX_IPSR_GPSR(IP2SR1_11_8,	TCLK3_B),
 
 	PINMUX_IPSR_GPSR(IP2SR1_15_12,	SSI_WS),
-	PINMUX_IPSR_GPSR(IP2SR1_15_12,	TCLK4),
+	PINMUX_IPSR_GPSR(IP2SR1_15_12,	TCLK4_B),
 
 	PINMUX_IPSR_GPSR(IP2SR1_19_16,	SSI_SD),
-	PINMUX_IPSR_GPSR(IP2SR1_19_16,	IRQ0_A),
+	PINMUX_IPSR_GPSR(IP2SR1_19_16,	IRQ0_B),
 
 	PINMUX_IPSR_GPSR(IP2SR1_23_20,	AUDIO_CLKOUT),
-	PINMUX_IPSR_GPSR(IP2SR1_23_20,	IRQ1_A),
+	PINMUX_IPSR_GPSR(IP2SR1_23_20,	IRQ1_B),
 
 	PINMUX_IPSR_GPSR(IP2SR1_27_24,	AUDIO_CLKIN),
 	PINMUX_IPSR_GPSR(IP2SR1_27_24,	PWM3_A),
 
-	PINMUX_IPSR_GPSR(IP2SR1_31_28,	TCLK2),
+	PINMUX_IPSR_GPSR(IP2SR1_31_28,	TCLK2_A),
 	PINMUX_IPSR_GPSR(IP2SR1_31_28,	MSIOF4_SS1),
 	PINMUX_IPSR_GPSR(IP2SR1_31_28,	IRQ3_B),
 
 	/* IP3SR1 */
-	PINMUX_IPSR_GPSR(IP3SR1_3_0,	HRX3),
+	PINMUX_IPSR_GPSR(IP3SR1_3_0,	HRX3_A),
 	PINMUX_IPSR_GPSR(IP3SR1_3_0,	SCK3_A),
 	PINMUX_IPSR_GPSR(IP3SR1_3_0,	MSIOF4_SS2),
 
-	PINMUX_IPSR_GPSR(IP3SR1_7_4,	HSCK3),
+	PINMUX_IPSR_GPSR(IP3SR1_7_4,	HSCK3_A),
 	PINMUX_IPSR_GPSR(IP3SR1_7_4,	CTS3_N_A),
 	PINMUX_IPSR_GPSR(IP3SR1_7_4,	MSIOF4_SCK),
-	PINMUX_IPSR_GPSR(IP3SR1_7_4,	TPU0TO0_A),
+	PINMUX_IPSR_GPSR(IP3SR1_7_4,	TPU0TO0_B),
 
-	PINMUX_IPSR_GPSR(IP3SR1_11_8,	HRTS3_N),
+	PINMUX_IPSR_GPSR(IP3SR1_11_8,	HRTS3_N_A),
 	PINMUX_IPSR_GPSR(IP3SR1_11_8,	RTS3_N_A),
 	PINMUX_IPSR_GPSR(IP3SR1_11_8,	MSIOF4_TXD),
-	PINMUX_IPSR_GPSR(IP3SR1_11_8,	TPU0TO1_A),
+	PINMUX_IPSR_GPSR(IP3SR1_11_8,	TPU0TO1_B),
 
-	PINMUX_IPSR_GPSR(IP3SR1_15_12,	HCTS3_N),
+	PINMUX_IPSR_GPSR(IP3SR1_15_12,	HCTS3_N_A),
 	PINMUX_IPSR_GPSR(IP3SR1_15_12,	RX3_A),
 	PINMUX_IPSR_GPSR(IP3SR1_15_12,	MSIOF4_RXD),
 
-	PINMUX_IPSR_GPSR(IP3SR1_19_16,	HTX3),
+	PINMUX_IPSR_GPSR(IP3SR1_19_16,	HTX3_A),
 	PINMUX_IPSR_GPSR(IP3SR1_19_16,	TX3_A),
 	PINMUX_IPSR_GPSR(IP3SR1_19_16,	MSIOF4_SYNC),
 
 	/* IP0SR2 */
 	PINMUX_IPSR_GPSR(IP0SR2_3_0,	FXR_TXDA),
 	PINMUX_IPSR_GPSR(IP0SR2_3_0,	CANFD1_TX),
-	PINMUX_IPSR_GPSR(IP0SR2_3_0,	TPU0TO2_A),
+	PINMUX_IPSR_GPSR(IP0SR2_3_0,	TPU0TO2_B),
 
-	PINMUX_IPSR_GPSR(IP0SR2_7_4,	FXR_TXENA_N),
+	PINMUX_IPSR_GPSR(IP0SR2_7_4,	FXR_TXENA_N_A),
 	PINMUX_IPSR_GPSR(IP0SR2_7_4,	CANFD1_RX),
-	PINMUX_IPSR_GPSR(IP0SR2_7_4,	TPU0TO3_A),
+	PINMUX_IPSR_GPSR(IP0SR2_7_4,	TPU0TO3_B),
 
 	PINMUX_IPSR_GPSR(IP0SR2_11_8,	RXDA_EXTFXR),
-	PINMUX_IPSR_GPSR(IP0SR2_11_8,	CANFD5_TX),
+	PINMUX_IPSR_GPSR(IP0SR2_11_8,	CANFD5_TX_A),
 	PINMUX_IPSR_GPSR(IP0SR2_11_8,	IRQ5),
 
 	PINMUX_IPSR_GPSR(IP0SR2_15_12,	CLK_EXTFXR),
-	PINMUX_IPSR_GPSR(IP0SR2_15_12,	CANFD5_RX),
+	PINMUX_IPSR_GPSR(IP0SR2_15_12,	CANFD5_RX_A),
 	PINMUX_IPSR_GPSR(IP0SR2_15_12,	IRQ4_B),
 
 	PINMUX_IPSR_GPSR(IP0SR2_19_16,	RXDB_EXTFXR),
 
-	PINMUX_IPSR_GPSR(IP0SR2_23_20,	FXR_TXENB_N),
+	PINMUX_IPSR_GPSR(IP0SR2_23_20,	FXR_TXENB_N_A),
 
 	PINMUX_IPSR_GPSR(IP0SR2_27_24,	FXR_TXDB),
 
-	PINMUX_IPSR_GPSR(IP0SR2_31_28,	TPU0TO1),
+	PINMUX_IPSR_GPSR(IP0SR2_31_28,	TPU0TO1_A),
 	PINMUX_IPSR_GPSR(IP0SR2_31_28,	CANFD6_TX),
-	PINMUX_IPSR_GPSR(IP0SR2_31_28,	TCLK2_B),
+	PINMUX_IPSR_GPSR(IP0SR2_31_28,	TCLK2_C),
 
 	/* IP1SR2 */
-	PINMUX_IPSR_GPSR(IP1SR2_3_0,	TPU0TO0),
+	PINMUX_IPSR_GPSR(IP1SR2_3_0,	TPU0TO0_A),
 	PINMUX_IPSR_GPSR(IP1SR2_3_0,	CANFD6_RX),
-	PINMUX_IPSR_GPSR(IP1SR2_3_0,	TCLK1_A),
+	PINMUX_IPSR_GPSR(IP1SR2_3_0,	TCLK1_B),
 
 	PINMUX_IPSR_GPSR(IP1SR2_7_4,	CAN_CLK),
-	PINMUX_IPSR_GPSR(IP1SR2_7_4,	FXR_TXENA_N_X),
+	PINMUX_IPSR_GPSR(IP1SR2_7_4,	FXR_TXENA_N_B),
 
 	PINMUX_IPSR_GPSR(IP1SR2_11_8,	CANFD0_TX),
-	PINMUX_IPSR_GPSR(IP1SR2_11_8,	FXR_TXENB_N_X),
+	PINMUX_IPSR_GPSR(IP1SR2_11_8,	FXR_TXENB_N_B),
 
 	PINMUX_IPSR_GPSR(IP1SR2_15_12,	CANFD0_RX),
 	PINMUX_IPSR_GPSR(IP1SR2_15_12,	STPWT_EXTFXR),
 
 	PINMUX_IPSR_GPSR(IP1SR2_19_16,	CANFD2_TX),
-	PINMUX_IPSR_GPSR(IP1SR2_19_16,	TPU0TO2),
-	PINMUX_IPSR_GPSR(IP1SR2_19_16,	TCLK3_A),
+	PINMUX_IPSR_GPSR(IP1SR2_19_16,	TPU0TO2_A),
+	PINMUX_IPSR_GPSR(IP1SR2_19_16,	TCLK3_C),
 
 	PINMUX_IPSR_GPSR(IP1SR2_23_20,	CANFD2_RX),
-	PINMUX_IPSR_GPSR(IP1SR2_23_20,	TPU0TO3),
+	PINMUX_IPSR_GPSR(IP1SR2_23_20,	TPU0TO3_A),
 	PINMUX_IPSR_GPSR(IP1SR2_23_20,	PWM1_B),
-	PINMUX_IPSR_GPSR(IP1SR2_23_20,	TCLK4_A),
+	PINMUX_IPSR_GPSR(IP1SR2_23_20,	TCLK4_C),
 
 	PINMUX_IPSR_GPSR(IP1SR2_27_24,	CANFD3_TX),
-	PINMUX_IPSR_GPSR(IP1SR2_27_24,	PWM2_B),
+	PINMUX_IPSR_GPSR(IP1SR2_27_24,	PWM2),
 
 	PINMUX_IPSR_GPSR(IP1SR2_31_28,	CANFD3_RX),
 	PINMUX_IPSR_GPSR(IP1SR2_31_28,	PWM3_B),
@@ -979,12 +979,12 @@
 	PINMUX_IPSR_GPSR(IP1SR3_23_20,	IPC_CLKIN),
 	PINMUX_IPSR_GPSR(IP1SR3_23_20,	IPC_CLKEN_IN),
 	PINMUX_IPSR_GPSR(IP1SR3_23_20,	PWM1_A),
-	PINMUX_IPSR_GPSR(IP1SR3_23_20,	TCLK3_X),
+	PINMUX_IPSR_GPSR(IP1SR3_23_20,	TCLK3_A),
 
 	PINMUX_IPSR_GPSR(IP1SR3_27_24,	IPC_CLKOUT),
 	PINMUX_IPSR_GPSR(IP1SR3_27_24,	IPC_CLKEN_OUT),
 	PINMUX_IPSR_GPSR(IP1SR3_27_24,	ERROROUTC_N_A),
-	PINMUX_IPSR_GPSR(IP1SR3_27_24,	TCLK4_X),
+	PINMUX_IPSR_GPSR(IP1SR3_27_24,	TCLK4_A),
 
 	PINMUX_IPSR_GPSR(IP1SR3_31_28,	QSPI0_SSL),
 
@@ -1531,15 +1531,14 @@
 };
 
 /* - CANFD5 ----------------------------------------------------------------- */
-static const unsigned int canfd5_data_pins[] = {
-	/* CANFD5_TX, CANFD5_RX */
+static const unsigned int canfd5_data_a_pins[] = {
+	/* CANFD5_TX_A, CANFD5_RX_A */
 	RCAR_GP_PIN(2, 2), RCAR_GP_PIN(2, 3),
 };
-static const unsigned int canfd5_data_mux[] = {
-	CANFD5_TX_MARK, CANFD5_RX_MARK,
+static const unsigned int canfd5_data_a_mux[] = {
+	CANFD5_TX_A_MARK, CANFD5_RX_A_MARK,
 };
 
-/* - CANFD5_B ----------------------------------------------------------------- */
 static const unsigned int canfd5_data_b_pins[] = {
 	/* CANFD5_TX_B, CANFD5_RX_B */
 	RCAR_GP_PIN(1, 8), RCAR_GP_PIN(1, 9),
@@ -1599,49 +1598,48 @@
 };
 
 /* - HSCIF1 ----------------------------------------------------------------- */
-static const unsigned int hscif1_data_pins[] = {
-	/* HRX1, HTX1 */
+static const unsigned int hscif1_data_a_pins[] = {
+	/* HRX1_A, HTX1_A */
 	RCAR_GP_PIN(0, 15), RCAR_GP_PIN(0, 14),
 };
-static const unsigned int hscif1_data_mux[] = {
-	HRX1_MARK, HTX1_MARK,
+static const unsigned int hscif1_data_a_mux[] = {
+	HRX1_A_MARK, HTX1_A_MARK,
 };
-static const unsigned int hscif1_clk_pins[] = {
-	/* HSCK1 */
+static const unsigned int hscif1_clk_a_pins[] = {
+	/* HSCK1_A */
 	RCAR_GP_PIN(0, 18),
 };
-static const unsigned int hscif1_clk_mux[] = {
-	HSCK1_MARK,
+static const unsigned int hscif1_clk_a_mux[] = {
+	HSCK1_A_MARK,
 };
-static const unsigned int hscif1_ctrl_pins[] = {
-	/* HRTS1_N, HCTS1_N */
+static const unsigned int hscif1_ctrl_a_pins[] = {
+	/* HRTS1_N_A, HCTS1_N_A */
 	RCAR_GP_PIN(0, 17), RCAR_GP_PIN(0, 16),
 };
-static const unsigned int hscif1_ctrl_mux[] = {
-	HRTS1_N_MARK, HCTS1_N_MARK,
+static const unsigned int hscif1_ctrl_a_mux[] = {
+	HRTS1_N_A_MARK, HCTS1_N_A_MARK,
 };
 
-/* - HSCIF1_X---------------------------------------------------------------- */
-static const unsigned int hscif1_data_x_pins[] = {
-	/* HRX1_X, HTX1_X */
+static const unsigned int hscif1_data_b_pins[] = {
+	/* HRX1_B, HTX1_B */
 	RCAR_GP_PIN(1, 7), RCAR_GP_PIN(1, 6),
 };
-static const unsigned int hscif1_data_x_mux[] = {
-	HRX1_X_MARK, HTX1_X_MARK,
+static const unsigned int hscif1_data_b_mux[] = {
+	HRX1_B_MARK, HTX1_B_MARK,
 };
-static const unsigned int hscif1_clk_x_pins[] = {
-	/* HSCK1_X */
+static const unsigned int hscif1_clk_b_pins[] = {
+	/* HSCK1_B */
 	RCAR_GP_PIN(1, 10),
 };
-static const unsigned int hscif1_clk_x_mux[] = {
-	HSCK1_X_MARK,
+static const unsigned int hscif1_clk_b_mux[] = {
+	HSCK1_B_MARK,
 };
-static const unsigned int hscif1_ctrl_x_pins[] = {
-	/* HRTS1_N_X, HCTS1_N_X */
+static const unsigned int hscif1_ctrl_b_pins[] = {
+	/* HRTS1_N_B, HCTS1_N_B */
 	RCAR_GP_PIN(1, 9), RCAR_GP_PIN(1, 8),
 };
-static const unsigned int hscif1_ctrl_x_mux[] = {
-	HRTS1_N_X_MARK, HCTS1_N_X_MARK,
+static const unsigned int hscif1_ctrl_b_mux[] = {
+	HRTS1_N_B_MARK, HCTS1_N_B_MARK,
 };
 
 /* - HSCIF2 ----------------------------------------------------------------- */
@@ -1668,49 +1666,48 @@
 };
 
 /* - HSCIF3 ----------------------------------------------------------------- */
-static const unsigned int hscif3_data_pins[] = {
-	/* HRX3, HTX3 */
+static const unsigned int hscif3_data_a_pins[] = {
+	/* HRX3_A, HTX3_A */
 	RCAR_GP_PIN(1, 24), RCAR_GP_PIN(1, 28),
 };
-static const unsigned int hscif3_data_mux[] = {
-	HRX3_MARK, HTX3_MARK,
+static const unsigned int hscif3_data_a_mux[] = {
+	HRX3_A_MARK, HTX3_A_MARK,
 };
-static const unsigned int hscif3_clk_pins[] = {
-	/* HSCK3 */
+static const unsigned int hscif3_clk_a_pins[] = {
+	/* HSCK3_A */
 	RCAR_GP_PIN(1, 25),
 };
-static const unsigned int hscif3_clk_mux[] = {
-	HSCK3_MARK,
+static const unsigned int hscif3_clk_a_mux[] = {
+	HSCK3_A_MARK,
 };
-static const unsigned int hscif3_ctrl_pins[] = {
-	/* HRTS3_N, HCTS3_N */
+static const unsigned int hscif3_ctrl_a_pins[] = {
+	/* HRTS3_N_A, HCTS3_N_A */
 	RCAR_GP_PIN(1, 26), RCAR_GP_PIN(1, 27),
 };
-static const unsigned int hscif3_ctrl_mux[] = {
-	HRTS3_N_MARK, HCTS3_N_MARK,
+static const unsigned int hscif3_ctrl_a_mux[] = {
+	HRTS3_N_A_MARK, HCTS3_N_A_MARK,
 };
 
-/* - HSCIF3_A ----------------------------------------------------------------- */
-static const unsigned int hscif3_data_a_pins[] = {
-	/* HRX3_A, HTX3_A */
+static const unsigned int hscif3_data_b_pins[] = {
+	/* HRX3_B, HTX3_B */
 	RCAR_GP_PIN(1, 4), RCAR_GP_PIN(1, 0),
 };
-static const unsigned int hscif3_data_a_mux[] = {
-	HRX3_A_MARK, HTX3_A_MARK,
+static const unsigned int hscif3_data_b_mux[] = {
+	HRX3_B_MARK, HTX3_B_MARK,
 };
-static const unsigned int hscif3_clk_a_pins[] = {
-	/* HSCK3_A */
+static const unsigned int hscif3_clk_b_pins[] = {
+	/* HSCK3_B */
 	RCAR_GP_PIN(1, 3),
 };
-static const unsigned int hscif3_clk_a_mux[] = {
-	HSCK3_A_MARK,
+static const unsigned int hscif3_clk_b_mux[] = {
+	HSCK3_B_MARK,
 };
-static const unsigned int hscif3_ctrl_a_pins[] = {
-	/* HRTS3_N_A, HCTS3_N_A */
+static const unsigned int hscif3_ctrl_b_pins[] = {
+	/* HRTS3_N_B, HCTS3_N_B */
 	RCAR_GP_PIN(1, 2), RCAR_GP_PIN(1, 1),
 };
-static const unsigned int hscif3_ctrl_a_mux[] = {
-	HRTS3_N_A_MARK, HCTS3_N_A_MARK,
+static const unsigned int hscif3_ctrl_b_mux[] = {
+	HRTS3_N_B_MARK, HCTS3_N_B_MARK,
 };
 
 /* - I2C0 ------------------------------------------------------------------- */
@@ -2093,13 +2090,13 @@
 	PCIE1_CLKREQ_N_MARK,
 };
 
-/* - PWM0_A ------------------------------------------------------------------- */
-static const unsigned int pwm0_a_pins[] = {
-	/* PWM0_A */
+/* - PWM0 ------------------------------------------------------------------- */
+static const unsigned int pwm0_pins[] = {
+	/* PWM0 */
 	RCAR_GP_PIN(1, 15),
 };
-static const unsigned int pwm0_a_mux[] = {
-	PWM0_A_MARK,
+static const unsigned int pwm0_mux[] = {
+	PWM0_MARK,
 };
 
 /* - PWM1_A ------------------------------------------------------------------- */
@@ -2120,13 +2117,13 @@
 	PWM1_B_MARK,
 };
 
-/* - PWM2_B ------------------------------------------------------------------- */
-static const unsigned int pwm2_b_pins[] = {
-	/* PWM2_B */
+/* - PWM2 ------------------------------------------------------------------- */
+static const unsigned int pwm2_pins[] = {
+	/* PWM2 */
 	RCAR_GP_PIN(2, 14),
 };
-static const unsigned int pwm2_b_mux[] = {
-	PWM2_B_MARK,
+static const unsigned int pwm2_mux[] = {
+	PWM2_MARK,
 };
 
 /* - PWM3_A ------------------------------------------------------------------- */
@@ -2183,22 +2180,22 @@
 	PWM7_MARK,
 };
 
-/* - PWM8_A ------------------------------------------------------------------- */
-static const unsigned int pwm8_a_pins[] = {
-	/* PWM8_A */
+/* - PWM8 ------------------------------------------------------------------- */
+static const unsigned int pwm8_pins[] = {
+	/* PWM8 */
 	RCAR_GP_PIN(1, 13),
 };
-static const unsigned int pwm8_a_mux[] = {
-	PWM8_A_MARK,
+static const unsigned int pwm8_mux[] = {
+	PWM8_MARK,
 };
 
-/* - PWM9_A ------------------------------------------------------------------- */
-static const unsigned int pwm9_a_pins[] = {
-	/* PWM9_A */
+/* - PWM9 ------------------------------------------------------------------- */
+static const unsigned int pwm9_pins[] = {
+	/* PWM9 */
 	RCAR_GP_PIN(1, 14),
 };
-static const unsigned int pwm9_a_mux[] = {
-	PWM9_A_MARK,
+static const unsigned int pwm9_mux[] = {
+	PWM9_MARK,
 };
 
 /* - QSPI0 ------------------------------------------------------------------ */
@@ -2261,75 +2258,51 @@
 };
 
 /* - SCIF1 ------------------------------------------------------------------ */
-static const unsigned int scif1_data_pins[] = {
-	/* RX1, TX1 */
+static const unsigned int scif1_data_a_pins[] = {
+	/* RX1_A, TX1_A */
 	RCAR_GP_PIN(0, 15), RCAR_GP_PIN(0, 14),
 };
-static const unsigned int scif1_data_mux[] = {
-	RX1_MARK, TX1_MARK,
+static const unsigned int scif1_data_a_mux[] = {
+	RX1_A_MARK, TX1_A_MARK,
 };
-static const unsigned int scif1_clk_pins[] = {
-	/* SCK1 */
+static const unsigned int scif1_clk_a_pins[] = {
+	/* SCK1_A */
 	RCAR_GP_PIN(0, 18),
 };
-static const unsigned int scif1_clk_mux[] = {
-	SCK1_MARK,
+static const unsigned int scif1_clk_a_mux[] = {
+	SCK1_A_MARK,
 };
-static const unsigned int scif1_ctrl_pins[] = {
-	/* RTS1_N, CTS1_N */
+static const unsigned int scif1_ctrl_a_pins[] = {
+	/* RTS1_N_A, CTS1_N_A */
 	RCAR_GP_PIN(0, 17), RCAR_GP_PIN(0, 16),
 };
-static const unsigned int scif1_ctrl_mux[] = {
-	RTS1_N_MARK, CTS1_N_MARK,
+static const unsigned int scif1_ctrl_a_mux[] = {
+	RTS1_N_A_MARK, CTS1_N_A_MARK,
 };
 
-/* - SCIF1_X ------------------------------------------------------------------ */
-static const unsigned int scif1_data_x_pins[] = {
-	/* RX1_X, TX1_X */
+static const unsigned int scif1_data_b_pins[] = {
+	/* RX1_B, TX1_B */
 	RCAR_GP_PIN(1, 7), RCAR_GP_PIN(1, 6),
 };
-static const unsigned int scif1_data_x_mux[] = {
-	RX1_X_MARK, TX1_X_MARK,
+static const unsigned int scif1_data_b_mux[] = {
+	RX1_B_MARK, TX1_B_MARK,
 };
-static const unsigned int scif1_clk_x_pins[] = {
-	/* SCK1_X */
+static const unsigned int scif1_clk_b_pins[] = {
+	/* SCK1_B */
 	RCAR_GP_PIN(1, 10),
 };
-static const unsigned int scif1_clk_x_mux[] = {
-	SCK1_X_MARK,
+static const unsigned int scif1_clk_b_mux[] = {
+	SCK1_B_MARK,
 };
-static const unsigned int scif1_ctrl_x_pins[] = {
-	/* RTS1_N_X, CTS1_N_X */
+static const unsigned int scif1_ctrl_b_pins[] = {
+	/* RTS1_N_B, CTS1_N_B */
 	RCAR_GP_PIN(1, 9), RCAR_GP_PIN(1, 8),
 };
-static const unsigned int scif1_ctrl_x_mux[] = {
-	RTS1_N_X_MARK, CTS1_N_X_MARK,
+static const unsigned int scif1_ctrl_b_mux[] = {
+	RTS1_N_B_MARK, CTS1_N_B_MARK,
 };
 
 /* - SCIF3 ------------------------------------------------------------------ */
-static const unsigned int scif3_data_pins[] = {
-	/* RX3, TX3 */
-	RCAR_GP_PIN(1, 1), RCAR_GP_PIN(1, 0),
-};
-static const unsigned int scif3_data_mux[] = {
-	RX3_MARK, TX3_MARK,
-};
-static const unsigned int scif3_clk_pins[] = {
-	/* SCK3 */
-	RCAR_GP_PIN(1, 4),
-};
-static const unsigned int scif3_clk_mux[] = {
-	SCK3_MARK,
-};
-static const unsigned int scif3_ctrl_pins[] = {
-	/* RTS3_N, CTS3_N */
-	RCAR_GP_PIN(1, 2), RCAR_GP_PIN(1, 3),
-};
-static const unsigned int scif3_ctrl_mux[] = {
-	RTS3_N_MARK, CTS3_N_MARK,
-};
-
-/* - SCIF3_A ------------------------------------------------------------------ */
 static const unsigned int scif3_data_a_pins[] = {
 	/* RX3_A, TX3_A */
 	RCAR_GP_PIN(1, 27), RCAR_GP_PIN(1, 28),
@@ -2352,6 +2325,28 @@
 	RTS3_N_A_MARK, CTS3_N_A_MARK,
 };
 
+static const unsigned int scif3_data_b_pins[] = {
+	/* RX3_B, TX3_B */
+	RCAR_GP_PIN(1, 1), RCAR_GP_PIN(1, 0),
+};
+static const unsigned int scif3_data_b_mux[] = {
+	RX3_B_MARK, TX3_B_MARK,
+};
+static const unsigned int scif3_clk_b_pins[] = {
+	/* SCK3_B */
+	RCAR_GP_PIN(1, 4),
+};
+static const unsigned int scif3_clk_b_mux[] = {
+	SCK3_B_MARK,
+};
+static const unsigned int scif3_ctrl_b_pins[] = {
+	/* RTS3_N_B, CTS3_N_B */
+	RCAR_GP_PIN(1, 2), RCAR_GP_PIN(1, 3),
+};
+static const unsigned int scif3_ctrl_b_mux[] = {
+	RTS3_N_B_MARK, CTS3_N_B_MARK,
+};
+
 /* - SCIF4 ------------------------------------------------------------------ */
 static const unsigned int scif4_data_pins[] = {
 	/* RX4, TX4 */
@@ -2384,6 +2379,14 @@
 	SCIF_CLK_MARK,
 };
 
+static const unsigned int scif_clk2_pins[] = {
+	/* SCIF_CLK2 */
+	RCAR_GP_PIN(8, 11),
+};
+static const unsigned int scif_clk2_mux[] = {
+	SCIF_CLK2_MARK,
+};
+
 /* - SSI ------------------------------------------------- */
 static const unsigned int ssi_data_pins[] = {
 	/* SSI_SD */
@@ -2400,64 +2403,63 @@
 	SSI_SCK_MARK, SSI_WS_MARK,
 };
 
-/* - TPU ------------------------------------------------------------------- */
-static const unsigned int tpu_to0_pins[] = {
-	/* TPU0TO0 */
+/* - TPU -------------------------------------------------------------------- */
+static const unsigned int tpu_to0_a_pins[] = {
+	/* TPU0TO0_A */
 	RCAR_GP_PIN(2, 8),
 };
-static const unsigned int tpu_to0_mux[] = {
-	TPU0TO0_MARK,
+static const unsigned int tpu_to0_a_mux[] = {
+	TPU0TO0_A_MARK,
 };
-static const unsigned int tpu_to1_pins[] = {
-	/* TPU0TO1 */
+static const unsigned int tpu_to1_a_pins[] = {
+	/* TPU0TO1_A */
 	RCAR_GP_PIN(2, 7),
 };
-static const unsigned int tpu_to1_mux[] = {
-	TPU0TO1_MARK,
+static const unsigned int tpu_to1_a_mux[] = {
+	TPU0TO1_A_MARK,
 };
-static const unsigned int tpu_to2_pins[] = {
-	/* TPU0TO2 */
+static const unsigned int tpu_to2_a_pins[] = {
+	/* TPU0TO2_A */
 	RCAR_GP_PIN(2, 12),
 };
-static const unsigned int tpu_to2_mux[] = {
-	TPU0TO2_MARK,
+static const unsigned int tpu_to2_a_mux[] = {
+	TPU0TO2_A_MARK,
 };
-static const unsigned int tpu_to3_pins[] = {
-	/* TPU0TO3 */
+static const unsigned int tpu_to3_a_pins[] = {
+	/* TPU0TO3_A */
 	RCAR_GP_PIN(2, 13),
 };
-static const unsigned int tpu_to3_mux[] = {
-	TPU0TO3_MARK,
+static const unsigned int tpu_to3_a_mux[] = {
+	TPU0TO3_A_MARK,
 };
 
-/* - TPU_A ------------------------------------------------------------------- */
-static const unsigned int tpu_to0_a_pins[] = {
-	/* TPU0TO0_A */
+static const unsigned int tpu_to0_b_pins[] = {
+	/* TPU0TO0_B */
 	RCAR_GP_PIN(1, 25),
 };
-static const unsigned int tpu_to0_a_mux[] = {
-	TPU0TO0_A_MARK,
+static const unsigned int tpu_to0_b_mux[] = {
+	TPU0TO0_B_MARK,
 };
-static const unsigned int tpu_to1_a_pins[] = {
-	/* TPU0TO1_A */
+static const unsigned int tpu_to1_b_pins[] = {
+	/* TPU0TO1_B */
 	RCAR_GP_PIN(1, 26),
 };
-static const unsigned int tpu_to1_a_mux[] = {
-	TPU0TO1_A_MARK,
+static const unsigned int tpu_to1_b_mux[] = {
+	TPU0TO1_B_MARK,
 };
-static const unsigned int tpu_to2_a_pins[] = {
-	/* TPU0TO2_A */
+static const unsigned int tpu_to2_b_pins[] = {
+	/* TPU0TO2_B */
 	RCAR_GP_PIN(2, 0),
 };
-static const unsigned int tpu_to2_a_mux[] = {
-	TPU0TO2_A_MARK,
+static const unsigned int tpu_to2_b_mux[] = {
+	TPU0TO2_B_MARK,
 };
-static const unsigned int tpu_to3_a_pins[] = {
-	/* TPU0TO3_A */
+static const unsigned int tpu_to3_b_pins[] = {
+	/* TPU0TO3_B */
 	RCAR_GP_PIN(2, 1),
 };
-static const unsigned int tpu_to3_a_mux[] = {
-	TPU0TO3_A_MARK,
+static const unsigned int tpu_to3_b_mux[] = {
+	TPU0TO3_B_MARK,
 };
 
 /* - TSN0 ------------------------------------------------ */
@@ -2570,8 +2572,8 @@
 	SH_PFC_PIN_GROUP(canfd2_data),
 	SH_PFC_PIN_GROUP(canfd3_data),
 	SH_PFC_PIN_GROUP(canfd4_data),
-	SH_PFC_PIN_GROUP(canfd5_data),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(canfd5_data_b),	/* suffix might be updated */
+	SH_PFC_PIN_GROUP(canfd5_data_a),
+	SH_PFC_PIN_GROUP(canfd5_data_b),
 	SH_PFC_PIN_GROUP(canfd6_data),
 	SH_PFC_PIN_GROUP(canfd7_data),
 	SH_PFC_PIN_GROUP(can_clk),
@@ -2579,21 +2581,21 @@
 	SH_PFC_PIN_GROUP(hscif0_data),
 	SH_PFC_PIN_GROUP(hscif0_clk),
 	SH_PFC_PIN_GROUP(hscif0_ctrl),
-	SH_PFC_PIN_GROUP(hscif1_data),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif1_clk),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif1_ctrl),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif1_data_x),	/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif1_clk_x),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif1_ctrl_x),	/* suffix might be updated */
+	SH_PFC_PIN_GROUP(hscif1_data_a),
+	SH_PFC_PIN_GROUP(hscif1_clk_a),
+	SH_PFC_PIN_GROUP(hscif1_ctrl_a),
+	SH_PFC_PIN_GROUP(hscif1_data_b),
+	SH_PFC_PIN_GROUP(hscif1_clk_b),
+	SH_PFC_PIN_GROUP(hscif1_ctrl_b),
 	SH_PFC_PIN_GROUP(hscif2_data),
 	SH_PFC_PIN_GROUP(hscif2_clk),
 	SH_PFC_PIN_GROUP(hscif2_ctrl),
-	SH_PFC_PIN_GROUP(hscif3_data),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif3_clk),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif3_ctrl),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif3_data_a),	/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif3_clk_a),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(hscif3_ctrl_a),	/* suffix might be updated */
+	SH_PFC_PIN_GROUP(hscif3_data_a),
+	SH_PFC_PIN_GROUP(hscif3_clk_a),
+	SH_PFC_PIN_GROUP(hscif3_ctrl_a),
+	SH_PFC_PIN_GROUP(hscif3_data_b),
+	SH_PFC_PIN_GROUP(hscif3_clk_b),
+	SH_PFC_PIN_GROUP(hscif3_ctrl_b),
 
 	SH_PFC_PIN_GROUP(i2c0),
 	SH_PFC_PIN_GROUP(i2c1),
@@ -2655,18 +2657,18 @@
 	SH_PFC_PIN_GROUP(pcie0_clkreq_n),
 	SH_PFC_PIN_GROUP(pcie1_clkreq_n),
 
-	SH_PFC_PIN_GROUP(pwm0_a),		/* suffix might be updated */
+	SH_PFC_PIN_GROUP(pwm0),
 	SH_PFC_PIN_GROUP(pwm1_a),
 	SH_PFC_PIN_GROUP(pwm1_b),
-	SH_PFC_PIN_GROUP(pwm2_b),		/* suffix might be updated */
+	SH_PFC_PIN_GROUP(pwm2),
 	SH_PFC_PIN_GROUP(pwm3_a),
 	SH_PFC_PIN_GROUP(pwm3_b),
 	SH_PFC_PIN_GROUP(pwm4),
 	SH_PFC_PIN_GROUP(pwm5),
 	SH_PFC_PIN_GROUP(pwm6),
 	SH_PFC_PIN_GROUP(pwm7),
-	SH_PFC_PIN_GROUP(pwm8_a),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(pwm9_a),		/* suffix might be updated */
+	SH_PFC_PIN_GROUP(pwm8),
+	SH_PFC_PIN_GROUP(pwm9),
 
 	SH_PFC_PIN_GROUP(qspi0_ctrl),
 	BUS_DATA_PIN_GROUP(qspi0_data, 2),
@@ -2678,34 +2680,35 @@
 	SH_PFC_PIN_GROUP(scif0_data),
 	SH_PFC_PIN_GROUP(scif0_clk),
 	SH_PFC_PIN_GROUP(scif0_ctrl),
-	SH_PFC_PIN_GROUP(scif1_data),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif1_clk),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif1_ctrl),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif1_data_x),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif1_clk_x),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif1_ctrl_x),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif3_data),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif3_clk),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif3_ctrl),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif3_data_a),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif3_clk_a),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(scif3_ctrl_a),		/* suffix might be updated */
+	SH_PFC_PIN_GROUP(scif1_data_a),
+	SH_PFC_PIN_GROUP(scif1_clk_a),
+	SH_PFC_PIN_GROUP(scif1_ctrl_a),
+	SH_PFC_PIN_GROUP(scif1_data_b),
+	SH_PFC_PIN_GROUP(scif1_clk_b),
+	SH_PFC_PIN_GROUP(scif1_ctrl_b),
+	SH_PFC_PIN_GROUP(scif3_data_a),
+	SH_PFC_PIN_GROUP(scif3_clk_a),
+	SH_PFC_PIN_GROUP(scif3_ctrl_a),
+	SH_PFC_PIN_GROUP(scif3_data_b),
+	SH_PFC_PIN_GROUP(scif3_clk_b),
+	SH_PFC_PIN_GROUP(scif3_ctrl_b),
 	SH_PFC_PIN_GROUP(scif4_data),
 	SH_PFC_PIN_GROUP(scif4_clk),
 	SH_PFC_PIN_GROUP(scif4_ctrl),
 	SH_PFC_PIN_GROUP(scif_clk),
+	SH_PFC_PIN_GROUP(scif_clk2),
 
 	SH_PFC_PIN_GROUP(ssi_data),
 	SH_PFC_PIN_GROUP(ssi_ctrl),
 
-	SH_PFC_PIN_GROUP(tpu_to0),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(tpu_to0_a),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(tpu_to1),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(tpu_to1_a),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(tpu_to2),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(tpu_to2_a),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(tpu_to3),		/* suffix might be updated */
-	SH_PFC_PIN_GROUP(tpu_to3_a),		/* suffix might be updated */
+	SH_PFC_PIN_GROUP(tpu_to0_a),
+	SH_PFC_PIN_GROUP(tpu_to0_b),
+	SH_PFC_PIN_GROUP(tpu_to1_a),
+	SH_PFC_PIN_GROUP(tpu_to1_b),
+	SH_PFC_PIN_GROUP(tpu_to2_a),
+	SH_PFC_PIN_GROUP(tpu_to2_b),
+	SH_PFC_PIN_GROUP(tpu_to3_a),
+	SH_PFC_PIN_GROUP(tpu_to3_b),
 
 	SH_PFC_PIN_GROUP(tsn0_link),
 	SH_PFC_PIN_GROUP(tsn0_phy_int),
@@ -2779,8 +2782,7 @@
 };
 
 static const char * const canfd5_groups[] = {
-	/* suffix might be updated */
-	"canfd5_data",
+	"canfd5_data_a",
 	"canfd5_data_b",
 };
 
@@ -2803,13 +2805,12 @@
 };
 
 static const char * const hscif1_groups[] = {
-	/* suffix might be updated */
-	"hscif1_data",
-	"hscif1_clk",
-	"hscif1_ctrl",
-	"hscif1_data_x",
-	"hscif1_clk_x",
-	"hscif1_ctrl_x",
+	"hscif1_data_a",
+	"hscif1_clk_a",
+	"hscif1_ctrl_a",
+	"hscif1_data_b",
+	"hscif1_clk_b",
+	"hscif1_ctrl_b",
 };
 
 static const char * const hscif2_groups[] = {
@@ -2819,13 +2820,12 @@
 };
 
 static const char * const hscif3_groups[] = {
-	/* suffix might be updated */
-	"hscif3_data",
-	"hscif3_clk",
-	"hscif3_ctrl",
 	"hscif3_data_a",
 	"hscif3_clk_a",
 	"hscif3_ctrl_a",
+	"hscif3_data_b",
+	"hscif3_clk_b",
+	"hscif3_ctrl_b",
 };
 
 static const char * const i2c0_groups[] = {
@@ -2922,8 +2922,7 @@
 };
 
 static const char * const pwm0_groups[] = {
-	/* suffix might be updated */
-	"pwm0_a",
+	"pwm0",
 };
 
 static const char * const pwm1_groups[] = {
@@ -2932,8 +2931,7 @@
 };
 
 static const char * const pwm2_groups[] = {
-	/* suffix might be updated */
-	"pwm2_b",
+	"pwm2",
 };
 
 static const char * const pwm3_groups[] = {
@@ -2958,13 +2956,11 @@
 };
 
 static const char * const pwm8_groups[] = {
-	/* suffix might be updated */
-	"pwm8_a",
+	"pwm8",
 };
 
 static const char * const pwm9_groups[] = {
-	/* suffix might be updated */
-	"pwm9_a",
+	"pwm9",
 };
 
 static const char * const qspi0_groups[] = {
@@ -2986,23 +2982,21 @@
 };
 
 static const char * const scif1_groups[] = {
-	/* suffix might be updated */
-	"scif1_data",
-	"scif1_clk",
-	"scif1_ctrl",
-	"scif1_data_x",
-	"scif1_clk_x",
-	"scif1_ctrl_x",
+	"scif1_data_a",
+	"scif1_clk_a",
+	"scif1_ctrl_a",
+	"scif1_data_b",
+	"scif1_clk_b",
+	"scif1_ctrl_b",
 };
 
 static const char * const scif3_groups[] = {
-	/* suffix might be updated */
-	"scif3_data",
-	"scif3_clk",
-	"scif3_ctrl",
 	"scif3_data_a",
 	"scif3_clk_a",
 	"scif3_ctrl_a",
+	"scif3_data_b",
+	"scif3_clk_b",
+	"scif3_ctrl_b",
 };
 
 static const char * const scif4_groups[] = {
@@ -3015,21 +3009,24 @@
 	"scif_clk",
 };
 
+static const char * const scif_clk2_groups[] = {
+	"scif_clk2",
+};
+
 static const char * const ssi_groups[] = {
 	"ssi_data",
 	"ssi_ctrl",
 };
 
 static const char * const tpu_groups[] = {
-	/* suffix might be updated */
-	"tpu_to0",
 	"tpu_to0_a",
-	"tpu_to1",
+	"tpu_to0_b",
 	"tpu_to1_a",
-	"tpu_to2",
+	"tpu_to1_b",
 	"tpu_to2_a",
-	"tpu_to3",
+	"tpu_to2_b",
 	"tpu_to3_a",
+	"tpu_to3_b",
 };
 
 static const char * const tsn0_groups[] = {
@@ -3102,6 +3099,7 @@
 	SH_PFC_FUNCTION(scif3),
 	SH_PFC_FUNCTION(scif4),
 	SH_PFC_FUNCTION(scif_clk),
+	SH_PFC_FUNCTION(scif_clk2),
 
 	SH_PFC_FUNCTION(ssi),
 
--- linux-qcom-6.8.0.orig/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+++ linux-qcom-6.8.0/drivers/pinctrl/renesas/pinctrl-rzg2l.c
@@ -447,6 +447,16 @@
 		name = np->name;
 	}
 
+	if (num_configs) {
+		ret = rzg2l_map_add_config(&maps[idx], name,
+					   PIN_MAP_TYPE_CONFIGS_GROUP,
+					   configs, num_configs);
+		if (ret < 0)
+			goto done;
+
+		idx++;
+	}
+
 	mutex_lock(&pctrl->mutex);
 
 	/* Register a single pin group listing all the pins we read from DT */
@@ -474,16 +484,6 @@
 	maps[idx].data.mux.function = name;
 	idx++;
 
-	if (num_configs) {
-		ret = rzg2l_map_add_config(&maps[idx], name,
-					   PIN_MAP_TYPE_CONFIGS_GROUP,
-					   configs, num_configs);
-		if (ret < 0)
-			goto remove_group;
-
-		idx++;
-	}
-
 	dev_dbg(pctrl->dev, "Parsed %pOF with %d pins\n", np, num_pinmux);
 	ret = 0;
 	goto done;
@@ -668,6 +668,8 @@
 		val = PVDD_1800;
 		break;
 	case 2500:
+		if (!(caps & (PIN_CFG_IO_VMC_ETH0 | PIN_CFG_IO_VMC_ETH1)))
+			return -EINVAL;
 		val = PVDD_2500;
 		break;
 	case 3300:
--- linux-qcom-6.8.0.orig/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c
+++ linux-qcom-6.8.0/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c
@@ -795,12 +795,12 @@
 	case IRQ_TYPE_LEVEL_HIGH:
 		irq_type  = 0;    /* 0: level triggered */
 		edge_both = 0;    /* 0: ignored */
-		polarity  = mask; /* 1: high level */
+		polarity  = 0;    /* 0: high level */
 		break;
 	case IRQ_TYPE_LEVEL_LOW:
 		irq_type  = 0;    /* 0: level triggered */
 		edge_both = 0;    /* 0: ignored */
-		polarity  = 0;    /* 0: low level */
+		polarity  = mask; /* 1: low level */
 		break;
 	default:
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ linux-qcom-6.8.0/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -1376,10 +1376,15 @@
 
 	for (i = 0; i < npins; i++) {
 		stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i);
-		if (stm32_pin && stm32_pin->pin.name)
+		if (stm32_pin && stm32_pin->pin.name) {
 			names[i] = devm_kasprintf(dev, GFP_KERNEL, "%s", stm32_pin->pin.name);
-		else
+			if (!names[i]) {
+				err = -ENOMEM;
+				goto err_clk;
+			}
+		} else {
 			names[i] = NULL;
+		}
 	}
 
 	bank->gpio_chip.names = (const char * const *)names;
--- linux-qcom-6.8.0.orig/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
+++ linux-qcom-6.8.0/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
@@ -274,6 +274,22 @@
 }
 
 /**
+ * ti_iodelay_pinconf_deinit_dev() - deinit the iodelay device
+ * @data:	IODelay device
+ *
+ * Deinitialize the IODelay device (basically just lock the region back up.
+ */
+static void ti_iodelay_pinconf_deinit_dev(void *data)
+{
+	struct ti_iodelay_device *iod = data;
+	const struct ti_iodelay_reg_data *reg = iod->reg_data;
+
+	/* lock the iodelay region back again */
+	regmap_update_bits(iod->regmap, reg->reg_global_lock_offset,
+			   reg->global_lock_mask, reg->global_lock_val);
+}
+
+/**
  * ti_iodelay_pinconf_init_dev() - Initialize IODelay device
  * @iod: iodelay device
  *
@@ -295,6 +311,11 @@
 	if (r)
 		return r;
 
+	r = devm_add_action_or_reset(iod->dev, ti_iodelay_pinconf_deinit_dev,
+				     iod);
+	if (r)
+		return r;
+
 	/* Read up Recalibration sequence done by bootloader */
 	r = regmap_read(iod->regmap, reg->reg_refclk_offset, &val);
 	if (r)
@@ -354,21 +375,6 @@
 }
 
 /**
- * ti_iodelay_pinconf_deinit_dev() - deinit the iodelay device
- * @iod:	IODelay device
- *
- * Deinitialize the IODelay device (basically just lock the region back up.
- */
-static void ti_iodelay_pinconf_deinit_dev(struct ti_iodelay_device *iod)
-{
-	const struct ti_iodelay_reg_data *reg = iod->reg_data;
-
-	/* lock the iodelay region back again */
-	regmap_update_bits(iod->regmap, reg->reg_global_lock_offset,
-			   reg->global_lock_mask, reg->global_lock_val);
-}
-
-/**
  * ti_iodelay_get_pingroup() - Find the group mapped by a group selector
  * @iod: iodelay device
  * @selector: Group Selector
@@ -822,53 +828,48 @@
 static int ti_iodelay_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	struct device_node *np = of_node_get(dev->of_node);
+	struct device_node *np __free(device_node) = of_node_get(dev->of_node);
 	struct resource *res;
 	struct ti_iodelay_device *iod;
-	int ret = 0;
+	int ret;
 
 	if (!np) {
-		ret = -EINVAL;
 		dev_err(dev, "No OF node\n");
-		goto exit_out;
+		return -EINVAL;
 	}
 
 	iod = devm_kzalloc(dev, sizeof(*iod), GFP_KERNEL);
-	if (!iod) {
-		ret = -ENOMEM;
-		goto exit_out;
-	}
+	if (!iod)
+		return -ENOMEM;
+
 	iod->dev = dev;
 	iod->reg_data = device_get_match_data(dev);
 	if (!iod->reg_data) {
-		ret = -EINVAL;
 		dev_err(dev, "No DATA match\n");
-		goto exit_out;
+		return -EINVAL;
 	}
 
 	/* So far We can assume there is only 1 bank of registers */
 	iod->reg_base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
-	if (IS_ERR(iod->reg_base)) {
-		ret = PTR_ERR(iod->reg_base);
-		goto exit_out;
-	}
+	if (IS_ERR(iod->reg_base))
+		return PTR_ERR(iod->reg_base);
+
 	iod->phys_base = res->start;
 
 	iod->regmap = devm_regmap_init_mmio(dev, iod->reg_base,
 					    iod->reg_data->regmap_config);
 	if (IS_ERR(iod->regmap)) {
 		dev_err(dev, "Regmap MMIO init failed.\n");
-		ret = PTR_ERR(iod->regmap);
-		goto exit_out;
+		return PTR_ERR(iod->regmap);
 	}
 
 	ret = ti_iodelay_pinconf_init_dev(iod);
 	if (ret)
-		goto exit_out;
+		return ret;
 
 	ret = ti_iodelay_alloc_pins(dev, iod, res->start);
 	if (ret)
-		goto exit_out;
+		return ret;
 
 	iod->desc.pctlops = &ti_iodelay_pinctrl_ops;
 	/* no pinmux ops - we are pinconf */
@@ -876,40 +877,17 @@
 	iod->desc.name = dev_name(dev);
 	iod->desc.owner = THIS_MODULE;
 
-	ret = pinctrl_register_and_init(&iod->desc, dev, iod, &iod->pctl);
+	ret = devm_pinctrl_register_and_init(dev, &iod->desc, iod, &iod->pctl);
 	if (ret) {
 		dev_err(dev, "Failed to register pinctrl\n");
-		goto exit_out;
+		return ret;
 	}
 
-	platform_set_drvdata(pdev, iod);
-
 	return pinctrl_enable(iod->pctl);
-
-exit_out:
-	of_node_put(np);
-	return ret;
-}
-
-/**
- * ti_iodelay_remove() - standard remove
- * @pdev: platform device
- */
-static void ti_iodelay_remove(struct platform_device *pdev)
-{
-	struct ti_iodelay_device *iod = platform_get_drvdata(pdev);
-
-	if (iod->pctl)
-		pinctrl_unregister(iod->pctl);
-
-	ti_iodelay_pinconf_deinit_dev(iod);
-
-	/* Expect other allocations to be freed by devm */
 }
 
 static struct platform_driver ti_iodelay_driver = {
 	.probe = ti_iodelay_probe,
-	.remove_new = ti_iodelay_remove,
 	.driver = {
 		   .name = DRIVER_NAME,
 		   .of_match_table = ti_iodelay_of_match,
--- linux-qcom-6.8.0.orig/drivers/platform/chrome/cros_ec.c
+++ linux-qcom-6.8.0/drivers/platform/chrome/cros_ec.c
@@ -432,6 +432,12 @@
 void cros_ec_resume_complete(struct cros_ec_device *ec_dev)
 {
 	cros_ec_send_resume_event(ec_dev);
+
+	/*
+	 * Let the mfd devices know about events that occur during
+	 * suspend. This way the clients know what to do with them.
+	 */
+	cros_ec_report_events_during_suspend(ec_dev);
 }
 EXPORT_SYMBOL(cros_ec_resume_complete);
 
@@ -442,12 +448,6 @@
 
 	if (ec_dev->wake_enabled)
 		disable_irq_wake(ec_dev->irq);
-
-	/*
-	 * Let the mfd devices know about events that occur during
-	 * suspend. This way the clients know what to do with them.
-	 */
-	cros_ec_report_events_during_suspend(ec_dev);
 }
 
 /**
@@ -475,8 +475,8 @@
  */
 int cros_ec_resume(struct cros_ec_device *ec_dev)
 {
-	cros_ec_enable_irq(ec_dev);
-	cros_ec_send_resume_event(ec_dev);
+	cros_ec_resume_early(ec_dev);
+	cros_ec_resume_complete(ec_dev);
 	return 0;
 }
 EXPORT_SYMBOL(cros_ec_resume);
--- linux-qcom-6.8.0.orig/drivers/platform/chrome/cros_ec_debugfs.c
+++ linux-qcom-6.8.0/drivers/platform/chrome/cros_ec_debugfs.c
@@ -329,6 +329,7 @@
 	if (!msg)
 		return 0;
 
+	msg->version = 1;
 	msg->command = EC_CMD_GET_CMD_VERSIONS + ec->cmd_offset;
 	msg->outsize = sizeof(*params);
 	msg->insize = sizeof(*response);
--- linux-qcom-6.8.0.orig/drivers/platform/chrome/cros_ec_lpc_mec.c
+++ linux-qcom-6.8.0/drivers/platform/chrome/cros_ec_lpc_mec.c
@@ -10,14 +10,66 @@
 
 #include "cros_ec_lpc_mec.h"
 
+#define ACPI_LOCK_DELAY_MS 500
+
 /*
  * This mutex must be held while accessing the EMI unit. We can't rely on the
  * EC mutex because memmap data may be accessed without it being held.
  */
 static DEFINE_MUTEX(io_mutex);
+/*
+ * An alternative mutex to be used when the ACPI AML code may also
+ * access memmap data.  When set, this mutex is used in preference to
+ * io_mutex.
+ */
+static acpi_handle aml_mutex;
+
 static u16 mec_emi_base, mec_emi_end;
 
 /**
+ * cros_ec_lpc_mec_lock() - Acquire mutex for EMI
+ *
+ * @return: Negative error code, or zero for success
+ */
+static int cros_ec_lpc_mec_lock(void)
+{
+	bool success;
+
+	if (!aml_mutex) {
+		mutex_lock(&io_mutex);
+		return 0;
+	}
+
+	success = ACPI_SUCCESS(acpi_acquire_mutex(aml_mutex,
+						  NULL, ACPI_LOCK_DELAY_MS));
+	if (!success)
+		return -EBUSY;
+
+	return 0;
+}
+
+/**
+ * cros_ec_lpc_mec_unlock() - Release mutex for EMI
+ *
+ * @return: Negative error code, or zero for success
+ */
+static int cros_ec_lpc_mec_unlock(void)
+{
+	bool success;
+
+	if (!aml_mutex) {
+		mutex_unlock(&io_mutex);
+		return 0;
+	}
+
+	success = ACPI_SUCCESS(acpi_release_mutex(aml_mutex, NULL));
+	if (!success)
+		return -EBUSY;
+
+	return 0;
+}
+
+/**
  * cros_ec_lpc_mec_emi_write_address() - Initialize EMI at a given address.
  *
  * @addr: Starting read / write address
@@ -77,6 +129,7 @@
 	int io_addr;
 	u8 sum = 0;
 	enum cros_ec_lpc_mec_emi_access_mode access, new_access;
+	int ret;
 
 	/* Return checksum of 0 if window is not initialized */
 	WARN_ON(mec_emi_base == 0 || mec_emi_end == 0);
@@ -92,7 +145,9 @@
 	else
 		access = ACCESS_TYPE_LONG_AUTO_INCREMENT;
 
-	mutex_lock(&io_mutex);
+	ret = cros_ec_lpc_mec_lock();
+	if (ret)
+		return ret;
 
 	/* Initialize I/O at desired address */
 	cros_ec_lpc_mec_emi_write_address(offset, access);
@@ -134,7 +189,9 @@
 	}
 
 done:
-	mutex_unlock(&io_mutex);
+	ret = cros_ec_lpc_mec_unlock();
+	if (ret)
+		return ret;
 
 	return sum;
 }
@@ -146,3 +203,18 @@
 	mec_emi_end = end;
 }
 EXPORT_SYMBOL(cros_ec_lpc_mec_init);
+
+int cros_ec_lpc_mec_acpi_mutex(struct acpi_device *adev, const char *pathname)
+{
+	int status;
+
+	if (!adev)
+		return -ENOENT;
+
+	status = acpi_get_handle(adev->handle, pathname, &aml_mutex);
+	if (ACPI_FAILURE(status))
+		return -ENOENT;
+
+	return 0;
+}
+EXPORT_SYMBOL(cros_ec_lpc_mec_acpi_mutex);
--- linux-qcom-6.8.0.orig/drivers/platform/chrome/cros_ec_lpc_mec.h
+++ linux-qcom-6.8.0/drivers/platform/chrome/cros_ec_lpc_mec.h
@@ -8,6 +8,8 @@
 #ifndef __CROS_EC_LPC_MEC_H
 #define __CROS_EC_LPC_MEC_H
 
+#include <linux/acpi.h>
+
 enum cros_ec_lpc_mec_emi_access_mode {
 	/* 8-bit access */
 	ACCESS_TYPE_BYTE = 0x0,
@@ -46,6 +48,15 @@
 void cros_ec_lpc_mec_init(unsigned int base, unsigned int end);
 
 /**
+ * cros_ec_lpc_mec_acpi_mutex() - Find and set ACPI mutex for MEC
+ *
+ * @adev:     Parent ACPI device
+ * @pathname: Name of AML mutex
+ * @return:   Negative error code, or zero for success
+ */
+int cros_ec_lpc_mec_acpi_mutex(struct acpi_device *adev, const char *pathname);
+
+/**
  * cros_ec_lpc_mec_in_range() - Determine if addresses are in MEC EMI range.
  *
  * @offset: Address offset
--- linux-qcom-6.8.0.orig/drivers/platform/chrome/cros_ec_proto.c
+++ linux-qcom-6.8.0/drivers/platform/chrome/cros_ec_proto.c
@@ -805,9 +805,11 @@
 	if (ret == -ENOPROTOOPT) {
 		dev_dbg(ec_dev->dev,
 			"GET_NEXT_EVENT returned invalid version error.\n");
+		mutex_lock(&ec_dev->lock);
 		ret = cros_ec_get_host_command_version_mask(ec_dev,
 							EC_CMD_GET_NEXT_EVENT,
 							&ver_mask);
+		mutex_unlock(&ec_dev->lock);
 		if (ret < 0 || ver_mask == 0)
 			/*
 			 * Do not change the MKBP supported version if we can't
--- linux-qcom-6.8.0.orig/drivers/platform/chrome/cros_ec_typec.c
+++ linux-qcom-6.8.0/drivers/platform/chrome/cros_ec_typec.c
@@ -390,6 +390,7 @@
 	return 0;
 
 unregister_ports:
+	fwnode_handle_put(fwnode);
 	cros_unregister_ports(typec);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/platform/chrome/cros_ec_uart.c
+++ linux-qcom-6.8.0/drivers/platform/chrome/cros_ec_uart.c
@@ -263,12 +263,6 @@
 	if (!ec_dev)
 		return -ENOMEM;
 
-	ret = devm_serdev_device_open(dev, serdev);
-	if (ret) {
-		dev_err(dev, "Unable to open UART device");
-		return ret;
-	}
-
 	serdev_device_set_drvdata(serdev, ec_dev);
 	init_waitqueue_head(&ec_uart->response.wait_queue);
 
@@ -280,14 +274,6 @@
 		return ret;
 	}
 
-	ret = serdev_device_set_baudrate(serdev, ec_uart->baudrate);
-	if (ret < 0) {
-		dev_err(dev, "Failed to set up host baud rate (%d)", ret);
-		return ret;
-	}
-
-	serdev_device_set_flow_control(serdev, ec_uart->flowcontrol);
-
 	/* Initialize ec_dev for cros_ec  */
 	ec_dev->phys_name = dev_name(dev);
 	ec_dev->dev = dev;
@@ -301,6 +287,20 @@
 
 	serdev_device_set_client_ops(serdev, &cros_ec_uart_client_ops);
 
+	ret = devm_serdev_device_open(dev, serdev);
+	if (ret) {
+		dev_err(dev, "Unable to open UART device");
+		return ret;
+	}
+
+	ret = serdev_device_set_baudrate(serdev, ec_uart->baudrate);
+	if (ret < 0) {
+		dev_err(dev, "Failed to set up host baud rate (%d)", ret);
+		return ret;
+	}
+
+	serdev_device_set_flow_control(serdev, ec_uart->flowcontrol);
+
 	return cros_ec_register(ec_dev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/platform/chrome/cros_usbpd_logger.c
+++ linux-qcom-6.8.0/drivers/platform/chrome/cros_usbpd_logger.c
@@ -7,6 +7,7 @@
 
 #include <linux/ktime.h>
 #include <linux/math64.h>
+#include <linux/mod_devicetable.h>
 #include <linux/module.h>
 #include <linux/platform_data/cros_ec_commands.h>
 #include <linux/platform_data/cros_ec_proto.h>
@@ -249,6 +250,12 @@
 static SIMPLE_DEV_PM_OPS(cros_usbpd_logger_pm_ops, cros_usbpd_logger_suspend,
 			 cros_usbpd_logger_resume);
 
+static const struct platform_device_id cros_usbpd_logger_id[] = {
+	{ DRV_NAME, 0 },
+	{}
+};
+MODULE_DEVICE_TABLE(platform, cros_usbpd_logger_id);
+
 static struct platform_driver cros_usbpd_logger_driver = {
 	.driver = {
 		.name = DRV_NAME,
@@ -256,10 +263,10 @@
 	},
 	.probe = cros_usbpd_logger_probe,
 	.remove_new = cros_usbpd_logger_remove,
+	.id_table = cros_usbpd_logger_id,
 };
 
 module_platform_driver(cros_usbpd_logger_driver);
 
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Logging driver for ChromeOS EC USBPD Charger.");
-MODULE_ALIAS("platform:" DRV_NAME);
--- linux-qcom-6.8.0.orig/drivers/platform/chrome/cros_usbpd_notify.c
+++ linux-qcom-6.8.0/drivers/platform/chrome/cros_usbpd_notify.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/acpi.h>
+#include <linux/mod_devicetable.h>
 #include <linux/module.h>
 #include <linux/platform_data/cros_ec_proto.h>
 #include <linux/platform_data/cros_usbpd_notify.h>
@@ -218,12 +219,19 @@
 					   &pdnotify->nb);
 }
 
+static const struct platform_device_id cros_usbpd_notify_id[] = {
+	{ DRV_NAME, 0 },
+	{}
+};
+MODULE_DEVICE_TABLE(platform, cros_usbpd_notify_id);
+
 static struct platform_driver cros_usbpd_notify_plat_driver = {
 	.driver = {
 		.name = DRV_NAME,
 	},
 	.probe = cros_usbpd_notify_probe_plat,
 	.remove_new = cros_usbpd_notify_remove_plat,
+	.id_table = cros_usbpd_notify_id,
 };
 
 static int __init cros_usbpd_notify_init(void)
@@ -258,4 +266,3 @@
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("ChromeOS power delivery notifier device");
 MODULE_AUTHOR("Jon Flatley <jflat@chromium.org>");
-MODULE_ALIAS("platform:" DRV_NAME);
--- linux-qcom-6.8.0.orig/drivers/platform/mellanox/mlxbf-pmc.c
+++ linux-qcom-6.8.0/drivers/platform/mellanox/mlxbf-pmc.c
@@ -99,8 +99,8 @@
  */
 struct mlxbf_pmc_attribute {
 	struct device_attribute dev_attr;
-	int index;
-	int nr;
+	unsigned int index;
+	unsigned int nr;
 };
 
 /**
@@ -121,7 +121,7 @@
 	void __iomem *mmio_base;
 	size_t blk_size;
 	size_t counters;
-	int type;
+	unsigned int type;
 	struct mlxbf_pmc_attribute *attr_counter;
 	struct mlxbf_pmc_attribute *attr_event;
 	struct mlxbf_pmc_attribute attr_event_list;
@@ -149,17 +149,17 @@
  */
 struct mlxbf_pmc_context {
 	struct platform_device *pdev;
-	uint32_t total_blocks;
-	uint32_t tile_count;
-	uint8_t llt_enable;
-	uint8_t mss_enable;
-	uint32_t group_num;
+	u32 total_blocks;
+	u32 tile_count;
+	u8 llt_enable;
+	u8 mss_enable;
+	u32 group_num;
 	struct device *hwmon_dev;
 	const char *block_name[MLXBF_PMC_MAX_BLOCKS];
 	struct mlxbf_pmc_block_info block[MLXBF_PMC_MAX_BLOCKS];
 	const struct attribute_group *groups[MLXBF_PMC_MAX_BLOCKS];
 	bool svc_sreg_support;
-	uint32_t sreg_tbl_perf;
+	u32 sreg_tbl_perf;
 	unsigned int event_set;
 };
 
@@ -169,7 +169,7 @@
  * @evt_name: Name of the event
  */
 struct mlxbf_pmc_events {
-	int evt_num;
+	u32 evt_num;
 	char *evt_name;
 };
 
@@ -865,8 +865,7 @@
 static const char *mlxbf_pmc_svc_uuid_str = "89c036b4-e7d7-11e6-8797-001aca00bfc4";
 
 /* Calls an SMC to access a performance register */
-static int mlxbf_pmc_secure_read(void __iomem *addr, uint32_t command,
-				 uint64_t *result)
+static int mlxbf_pmc_secure_read(void __iomem *addr, u32 command, u64 *result)
 {
 	struct arm_smccc_res res;
 	int status, err = 0;
@@ -892,8 +891,7 @@
 }
 
 /* Read from a performance counter */
-static int mlxbf_pmc_read(void __iomem *addr, uint32_t command,
-			  uint64_t *result)
+static int mlxbf_pmc_read(void __iomem *addr, u32 command, u64 *result)
 {
 	if (pmc->svc_sreg_support)
 		return mlxbf_pmc_secure_read(addr, command, result);
@@ -907,22 +905,21 @@
 }
 
 /* Convenience function for 32-bit reads */
-static int mlxbf_pmc_readl(void __iomem *addr, uint32_t *result)
+static int mlxbf_pmc_readl(void __iomem *addr, u32 *result)
 {
-	uint64_t read_out;
+	u64 read_out;
 	int status;
 
 	status = mlxbf_pmc_read(addr, MLXBF_PMC_READ_REG_32, &read_out);
 	if (status)
 		return status;
-	*result = (uint32_t)read_out;
+	*result = (u32)read_out;
 
 	return 0;
 }
 
 /* Calls an SMC to access a performance register */
-static int mlxbf_pmc_secure_write(void __iomem *addr, uint32_t command,
-				  uint64_t value)
+static int mlxbf_pmc_secure_write(void __iomem *addr, u32 command, u64 value)
 {
 	struct arm_smccc_res res;
 	int status, err = 0;
@@ -945,7 +942,7 @@
 }
 
 /* Write to a performance counter */
-static int mlxbf_pmc_write(void __iomem *addr, int command, uint64_t value)
+static int mlxbf_pmc_write(void __iomem *addr, int command, u64 value)
 {
 	if (pmc->svc_sreg_support)
 		return mlxbf_pmc_secure_write(addr, command, value);
@@ -959,7 +956,7 @@
 }
 
 /* Check if the register offset is within the mapped region for the block */
-static bool mlxbf_pmc_valid_range(int blk_num, uint32_t offset)
+static bool mlxbf_pmc_valid_range(unsigned int blk_num, u32 offset)
 {
 	if ((offset >= 0) && !(offset % MLXBF_PMC_REG_SIZE) &&
 	    (offset + MLXBF_PMC_REG_SIZE <= pmc->block[blk_num].blk_size))
@@ -969,8 +966,7 @@
 }
 
 /* Get the event list corresponding to a certain block */
-static const struct mlxbf_pmc_events *mlxbf_pmc_event_list(const char *blk,
-							   int *size)
+static const struct mlxbf_pmc_events *mlxbf_pmc_event_list(const char *blk, size_t *size)
 {
 	const struct mlxbf_pmc_events *events;
 
@@ -1047,7 +1043,8 @@
 static int mlxbf_pmc_get_event_num(const char *blk, const char *evt)
 {
 	const struct mlxbf_pmc_events *events;
-	int i, size;
+	unsigned int i;
+	size_t size;
 
 	events = mlxbf_pmc_event_list(blk, &size);
 	if (!events)
@@ -1062,10 +1059,11 @@
 }
 
 /* Get the event number given the name */
-static char *mlxbf_pmc_get_event_name(const char *blk, int evt)
+static char *mlxbf_pmc_get_event_name(const char *blk, u32 evt)
 {
 	const struct mlxbf_pmc_events *events;
-	int i, size;
+	unsigned int i;
+	size_t size;
 
 	events = mlxbf_pmc_event_list(blk, &size);
 	if (!events)
@@ -1080,9 +1078,9 @@
 }
 
 /* Method to enable/disable/reset l3cache counters */
-static int mlxbf_pmc_config_l3_counters(int blk_num, bool enable, bool reset)
+static int mlxbf_pmc_config_l3_counters(unsigned int blk_num, bool enable, bool reset)
 {
-	uint32_t perfcnt_cfg = 0;
+	u32 perfcnt_cfg = 0;
 
 	if (enable)
 		perfcnt_cfg |= MLXBF_PMC_L3C_PERF_CNT_CFG_EN;
@@ -1095,12 +1093,9 @@
 }
 
 /* Method to handle l3cache counter programming */
-static int mlxbf_pmc_program_l3_counter(int blk_num, uint32_t cnt_num,
-					uint32_t evt)
+static int mlxbf_pmc_program_l3_counter(unsigned int blk_num, u32 cnt_num, u32 evt)
 {
-	uint32_t perfcnt_sel_1 = 0;
-	uint32_t perfcnt_sel = 0;
-	uint32_t *wordaddr;
+	u32 perfcnt_sel_1 = 0, perfcnt_sel = 0, *wordaddr;
 	void __iomem *pmcaddr;
 	int ret;
 
@@ -1162,11 +1157,10 @@
 }
 
 /* Method to handle crspace counter programming */
-static int mlxbf_pmc_program_crspace_counter(int blk_num, uint32_t cnt_num,
-					     uint32_t evt)
+static int mlxbf_pmc_program_crspace_counter(unsigned int blk_num, u32 cnt_num, u32 evt)
 {
-	uint32_t word;
 	void *addr;
+	u32 word;
 	int ret;
 
 	addr = pmc->block[blk_num].mmio_base +
@@ -1187,7 +1181,7 @@
 }
 
 /* Method to clear crspace counter value */
-static int mlxbf_pmc_clear_crspace_counter(int blk_num, uint32_t cnt_num)
+static int mlxbf_pmc_clear_crspace_counter(unsigned int blk_num, u32 cnt_num)
 {
 	void *addr;
 
@@ -1199,10 +1193,9 @@
 }
 
 /* Method to program a counter to monitor an event */
-static int mlxbf_pmc_program_counter(int blk_num, uint32_t cnt_num,
-				     uint32_t evt, bool is_l3)
+static int mlxbf_pmc_program_counter(unsigned int blk_num, u32 cnt_num, u32 evt, bool is_l3)
 {
-	uint64_t perfctl, perfevt, perfmon_cfg;
+	u64 perfctl, perfevt, perfmon_cfg;
 
 	if (cnt_num >= pmc->block[blk_num].counters)
 		return -ENODEV;
@@ -1263,12 +1256,11 @@
 }
 
 /* Method to handle l3 counter reads */
-static int mlxbf_pmc_read_l3_counter(int blk_num, uint32_t cnt_num,
-				     uint64_t *result)
+static int mlxbf_pmc_read_l3_counter(unsigned int blk_num, u32 cnt_num, u64 *result)
 {
-	uint32_t perfcnt_low = 0, perfcnt_high = 0;
-	uint64_t value;
+	u32 perfcnt_low = 0, perfcnt_high = 0;
 	int status;
+	u64 value;
 
 	status = mlxbf_pmc_readl(pmc->block[blk_num].mmio_base +
 					 MLXBF_PMC_L3C_PERF_CNT_LOW +
@@ -1295,11 +1287,10 @@
 }
 
 /* Method to handle crspace counter reads */
-static int mlxbf_pmc_read_crspace_counter(int blk_num, uint32_t cnt_num,
-					  uint64_t *result)
+static int mlxbf_pmc_read_crspace_counter(unsigned int blk_num, u32 cnt_num, u64 *result)
 {
-	uint32_t value;
 	int status = 0;
+	u32 value;
 
 	status = mlxbf_pmc_readl(pmc->block[blk_num].mmio_base +
 		MLXBF_PMC_CRSPACE_PERFMON_VAL0(pmc->block[blk_num].counters) +
@@ -1313,11 +1304,10 @@
 }
 
 /* Method to read the counter value */
-static int mlxbf_pmc_read_counter(int blk_num, uint32_t cnt_num, bool is_l3,
-				  uint64_t *result)
+static int mlxbf_pmc_read_counter(unsigned int blk_num, u32 cnt_num, bool is_l3, u64 *result)
 {
-	uint32_t perfcfg_offset, perfval_offset;
-	uint64_t perfmon_cfg;
+	u32 perfcfg_offset, perfval_offset;
+	u64 perfmon_cfg;
 	int status;
 
 	if (cnt_num >= pmc->block[blk_num].counters)
@@ -1351,13 +1341,11 @@
 }
 
 /* Method to read L3 block event */
-static int mlxbf_pmc_read_l3_event(int blk_num, uint32_t cnt_num,
-				   uint64_t *result)
+static int mlxbf_pmc_read_l3_event(unsigned int blk_num, u32 cnt_num, u64 *result)
 {
-	uint32_t perfcnt_sel = 0, perfcnt_sel_1 = 0;
-	uint32_t *wordaddr;
+	u32 perfcnt_sel = 0, perfcnt_sel_1 = 0, *wordaddr;
 	void __iomem *pmcaddr;
-	uint64_t evt;
+	u64 evt;
 
 	/* Select appropriate register information */
 	switch (cnt_num) {
@@ -1405,10 +1393,9 @@
 }
 
 /* Method to read crspace block event */
-static int mlxbf_pmc_read_crspace_event(int blk_num, uint32_t cnt_num,
-					uint64_t *result)
+static int mlxbf_pmc_read_crspace_event(unsigned int blk_num, u32 cnt_num, u64 *result)
 {
-	uint32_t word, evt;
+	u32 word, evt;
 	void *addr;
 	int ret;
 
@@ -1429,11 +1416,10 @@
 }
 
 /* Method to find the event currently being monitored by a counter */
-static int mlxbf_pmc_read_event(int blk_num, uint32_t cnt_num, bool is_l3,
-				uint64_t *result)
+static int mlxbf_pmc_read_event(unsigned int blk_num, u32 cnt_num, bool is_l3, u64 *result)
 {
-	uint32_t perfcfg_offset, perfval_offset;
-	uint64_t perfmon_cfg, perfevt;
+	u32 perfcfg_offset, perfval_offset;
+	u64 perfmon_cfg, perfevt;
 
 	if (cnt_num >= pmc->block[blk_num].counters)
 		return -EINVAL;
@@ -1469,9 +1455,9 @@
 }
 
 /* Method to read a register */
-static int mlxbf_pmc_read_reg(int blk_num, uint32_t offset, uint64_t *result)
+static int mlxbf_pmc_read_reg(unsigned int blk_num, u32 offset, u64 *result)
 {
-	uint32_t ecc_out;
+	u32 ecc_out;
 
 	if (strstr(pmc->block_name[blk_num], "ecc")) {
 		if (mlxbf_pmc_readl(pmc->block[blk_num].mmio_base + offset,
@@ -1490,7 +1476,7 @@
 }
 
 /* Method to write to a register */
-static int mlxbf_pmc_write_reg(int blk_num, uint32_t offset, uint64_t data)
+static int mlxbf_pmc_write_reg(unsigned int blk_num, u32 offset, u64 data)
 {
 	if (strstr(pmc->block_name[blk_num], "ecc")) {
 		return mlxbf_pmc_write(pmc->block[blk_num].mmio_base + offset,
@@ -1510,9 +1496,10 @@
 {
 	struct mlxbf_pmc_attribute *attr_counter = container_of(
 		attr, struct mlxbf_pmc_attribute, dev_attr);
-	int blk_num, cnt_num, offset;
+	unsigned int blk_num, cnt_num;
 	bool is_l3 = false;
-	uint64_t value;
+	int offset;
+	u64 value;
 
 	blk_num = attr_counter->nr;
 	cnt_num = attr_counter->index;
@@ -1544,14 +1531,16 @@
 {
 	struct mlxbf_pmc_attribute *attr_counter = container_of(
 		attr, struct mlxbf_pmc_attribute, dev_attr);
-	int blk_num, cnt_num, offset, err, data;
+	unsigned int blk_num, cnt_num, data;
 	bool is_l3 = false;
-	uint64_t evt_num;
+	u64 evt_num;
+	int offset;
+	int err;
 
 	blk_num = attr_counter->nr;
 	cnt_num = attr_counter->index;
 
-	err = kstrtoint(buf, 0, &data);
+	err = kstrtouint(buf, 0, &data);
 	if (err < 0)
 		return err;
 
@@ -1580,7 +1569,7 @@
 		if (err)
 			return err;
 	} else if (pmc->block[blk_num].type == MLXBF_PMC_TYPE_CRSPACE) {
-		if (sscanf(attr->attr.name, "counter%d", &cnt_num) != 1)
+		if (sscanf(attr->attr.name, "counter%u", &cnt_num) != 1)
 			return -EINVAL;
 		err = mlxbf_pmc_clear_crspace_counter(blk_num, cnt_num);
 	} else
@@ -1595,10 +1584,11 @@
 {
 	struct mlxbf_pmc_attribute *attr_event = container_of(
 		attr, struct mlxbf_pmc_attribute, dev_attr);
-	int blk_num, cnt_num, err;
+	unsigned int blk_num, cnt_num;
 	bool is_l3 = false;
-	uint64_t evt_num;
 	char *evt_name;
+	u64 evt_num;
+	int err;
 
 	blk_num = attr_event->nr;
 	cnt_num = attr_event->index;
@@ -1624,8 +1614,10 @@
 {
 	struct mlxbf_pmc_attribute *attr_event = container_of(
 		attr, struct mlxbf_pmc_attribute, dev_attr);
-	int blk_num, cnt_num, evt_num, err;
+	unsigned int blk_num, cnt_num;
 	bool is_l3 = false;
+	int evt_num;
+	int err;
 
 	blk_num = attr_event->nr;
 	cnt_num = attr_event->index;
@@ -1636,7 +1628,7 @@
 		if (evt_num < 0)
 			return -EINVAL;
 	} else {
-		err = kstrtoint(buf, 0, &evt_num);
+		err = kstrtouint(buf, 0, &evt_num);
 		if (err < 0)
 			return err;
 	}
@@ -1658,9 +1650,11 @@
 {
 	struct mlxbf_pmc_attribute *attr_event_list = container_of(
 		attr, struct mlxbf_pmc_attribute, dev_attr);
-	int blk_num, i, size, len = 0, ret = 0;
 	const struct mlxbf_pmc_events *events;
 	char e_info[MLXBF_PMC_EVENT_INFO_LEN];
+	unsigned int blk_num, i, len = 0;
+	size_t size;
+	int ret = 0;
 
 	blk_num = attr_event_list->nr;
 
@@ -1686,8 +1680,8 @@
 {
 	struct mlxbf_pmc_attribute *attr_enable = container_of(
 		attr, struct mlxbf_pmc_attribute, dev_attr);
-	uint32_t perfcnt_cfg, word;
-	int blk_num, value;
+	unsigned int blk_num, value;
+	u32 perfcnt_cfg, word;
 
 	blk_num = attr_enable->nr;
 
@@ -1707,7 +1701,7 @@
 		value = FIELD_GET(MLXBF_PMC_L3C_PERF_CNT_CFG_EN, perfcnt_cfg);
 	}
 
-	return sysfs_emit(buf, "%d\n", value);
+	return sysfs_emit(buf, "%u\n", value);
 }
 
 /* Store function for "enable" sysfs files - only for l3cache & crspace */
@@ -1717,12 +1711,13 @@
 {
 	struct mlxbf_pmc_attribute *attr_enable = container_of(
 		attr, struct mlxbf_pmc_attribute, dev_attr);
-	int err, en, blk_num;
-	uint32_t word;
+	unsigned int en, blk_num;
+	u32 word;
+	int err;
 
 	blk_num = attr_enable->nr;
 
-	err = kstrtoint(buf, 0, &en);
+	err = kstrtouint(buf, 0, &en);
 	if (err < 0)
 		return err;
 
@@ -1760,13 +1755,14 @@
 }
 
 /* Populate attributes for blocks with counters to monitor performance */
-static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num)
+static int mlxbf_pmc_init_perftype_counter(struct device *dev, unsigned int blk_num)
 {
 	struct mlxbf_pmc_attribute *attr;
-	int i = 0, j = 0;
+	unsigned int i = 0, j = 0;
 
 	/* "event_list" sysfs to list events supported by the block */
 	attr = &pmc->block[blk_num].attr_event_list;
+	sysfs_attr_init(&attr->dev_attr.attr);
 	attr->dev_attr.attr.mode = 0444;
 	attr->dev_attr.show = mlxbf_pmc_event_list_show;
 	attr->nr = blk_num;
@@ -1780,6 +1776,7 @@
 	if (strstr(pmc->block_name[blk_num], "l3cache") ||
 	    ((pmc->block[blk_num].type == MLXBF_PMC_TYPE_CRSPACE))) {
 		attr = &pmc->block[blk_num].attr_enable;
+		sysfs_attr_init(&attr->dev_attr.attr);
 		attr->dev_attr.attr.mode = 0644;
 		attr->dev_attr.show = mlxbf_pmc_enable_show;
 		attr->dev_attr.store = mlxbf_pmc_enable_store;
@@ -1807,26 +1804,26 @@
 	/* "eventX" and "counterX" sysfs to program and read counter values */
 	for (j = 0; j < pmc->block[blk_num].counters; ++j) {
 		attr = &pmc->block[blk_num].attr_counter[j];
+		sysfs_attr_init(&attr->dev_attr.attr);
 		attr->dev_attr.attr.mode = 0644;
 		attr->dev_attr.show = mlxbf_pmc_counter_show;
 		attr->dev_attr.store = mlxbf_pmc_counter_store;
 		attr->index = j;
 		attr->nr = blk_num;
-		attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-							  "counter%d", j);
+		attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, "counter%u", j);
 		if (!attr->dev_attr.attr.name)
 			return -ENOMEM;
 		pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr;
 		attr = NULL;
 
 		attr = &pmc->block[blk_num].attr_event[j];
+		sysfs_attr_init(&attr->dev_attr.attr);
 		attr->dev_attr.attr.mode = 0644;
 		attr->dev_attr.show = mlxbf_pmc_event_show;
 		attr->dev_attr.store = mlxbf_pmc_event_store;
 		attr->index = j;
 		attr->nr = blk_num;
-		attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-							  "event%d", j);
+		attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, "event%u", j);
 		if (!attr->dev_attr.attr.name)
 			return -ENOMEM;
 		pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr;
@@ -1837,30 +1834,32 @@
 }
 
 /* Populate attributes for blocks with registers to monitor performance */
-static int mlxbf_pmc_init_perftype_reg(struct device *dev, int blk_num)
+static int mlxbf_pmc_init_perftype_reg(struct device *dev, unsigned int blk_num)
 {
-	struct mlxbf_pmc_attribute *attr;
 	const struct mlxbf_pmc_events *events;
-	int i = 0, j = 0;
+	struct mlxbf_pmc_attribute *attr;
+	unsigned int i = 0;
+	size_t count = 0;
 
-	events = mlxbf_pmc_event_list(pmc->block_name[blk_num], &j);
+	events = mlxbf_pmc_event_list(pmc->block_name[blk_num], &count);
 	if (!events)
 		return -EINVAL;
 
 	pmc->block[blk_num].attr_event = devm_kcalloc(
-		dev, j, sizeof(struct mlxbf_pmc_attribute), GFP_KERNEL);
+		dev, count, sizeof(struct mlxbf_pmc_attribute), GFP_KERNEL);
 	if (!pmc->block[blk_num].attr_event)
 		return -ENOMEM;
 
-	while (j > 0) {
-		--j;
-		attr = &pmc->block[blk_num].attr_event[j];
+	while (count > 0) {
+		--count;
+		attr = &pmc->block[blk_num].attr_event[count];
+		sysfs_attr_init(&attr->dev_attr.attr);
 		attr->dev_attr.attr.mode = 0644;
 		attr->dev_attr.show = mlxbf_pmc_counter_show;
 		attr->dev_attr.store = mlxbf_pmc_counter_store;
 		attr->nr = blk_num;
 		attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-							  events[j].evt_name);
+							  events[count].evt_name);
 		if (!attr->dev_attr.attr.name)
 			return -ENOMEM;
 		pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr;
@@ -1872,7 +1871,7 @@
 }
 
 /* Helper to create the bfperf sysfs sub-directories and files */
-static int mlxbf_pmc_create_groups(struct device *dev, int blk_num)
+static int mlxbf_pmc_create_groups(struct device *dev, unsigned int blk_num)
 {
 	int err;
 
@@ -1914,19 +1913,20 @@
 /* Helper to map the Performance Counters from the varios blocks */
 static int mlxbf_pmc_map_counters(struct device *dev)
 {
-	uint64_t info[MLXBF_PMC_INFO_SZ];
-	int i, tile_num, ret;
+	u64 info[MLXBF_PMC_INFO_SZ];
+	unsigned int tile_num, i;
+	int ret;
 
 	for (i = 0; i < pmc->total_blocks; ++i) {
 		/* Create sysfs for tiles only if block number <  tile_count */
 		if (strstr(pmc->block_name[i], "tilenet")) {
-			if (sscanf(pmc->block_name[i], "tilenet%d", &tile_num) != 1)
+			if (sscanf(pmc->block_name[i], "tilenet%u", &tile_num) != 1)
 				continue;
 
 			if (tile_num >= pmc->tile_count)
 				continue;
 		} else if (strstr(pmc->block_name[i], "tile")) {
-			if (sscanf(pmc->block_name[i], "tile%d", &tile_num) != 1)
+			if (sscanf(pmc->block_name[i], "tile%u", &tile_num) != 1)
 				continue;
 
 			if (tile_num >= pmc->tile_count)
@@ -1936,9 +1936,9 @@
 		/* Create sysfs only for enabled MSS blocks */
 		if (strstr(pmc->block_name[i], "mss") &&
 		    pmc->event_set == MLXBF_PMC_EVENT_SET_BF3) {
-			int mss_num;
+			unsigned int mss_num;
 
-			if (sscanf(pmc->block_name[i], "mss%d", &mss_num) != 1)
+			if (sscanf(pmc->block_name[i], "mss%u", &mss_num) != 1)
 				continue;
 
 			if (!((pmc->mss_enable >> mss_num) & 0x1))
@@ -1947,17 +1947,17 @@
 
 		/* Create sysfs only for enabled LLT blocks */
 		if (strstr(pmc->block_name[i], "llt_miss")) {
-			int llt_num;
+			unsigned int llt_num;
 
-			if (sscanf(pmc->block_name[i], "llt_miss%d", &llt_num) != 1)
+			if (sscanf(pmc->block_name[i], "llt_miss%u", &llt_num) != 1)
 				continue;
 
 			if (!((pmc->llt_enable >> llt_num) & 0x1))
 				continue;
 		} else if (strstr(pmc->block_name[i], "llt")) {
-			int llt_num;
+			unsigned int llt_num;
 
-			if (sscanf(pmc->block_name[i], "llt%d", &llt_num) != 1)
+			if (sscanf(pmc->block_name[i], "llt%u", &llt_num) != 1)
 				continue;
 
 			if (!((pmc->llt_enable >> llt_num) & 0x1))
--- linux-qcom-6.8.0.orig/drivers/platform/mellanox/nvsw-sn2201.c
+++ linux-qcom-6.8.0/drivers/platform/mellanox/nvsw-sn2201.c
@@ -1198,6 +1198,7 @@
 static int nvsw_sn2201_probe(struct platform_device *pdev)
 {
 	struct nvsw_sn2201 *nvsw_sn2201;
+	int ret;
 
 	nvsw_sn2201 = devm_kzalloc(&pdev->dev, sizeof(*nvsw_sn2201), GFP_KERNEL);
 	if (!nvsw_sn2201)
@@ -1205,8 +1206,10 @@
 
 	nvsw_sn2201->dev = &pdev->dev;
 	platform_set_drvdata(pdev, nvsw_sn2201);
-	platform_device_add_resources(pdev, nvsw_sn2201_lpc_io_resources,
+	ret = platform_device_add_resources(pdev, nvsw_sn2201_lpc_io_resources,
 				      ARRAY_SIZE(nvsw_sn2201_lpc_io_resources));
+	if (ret)
+		return ret;
 
 	nvsw_sn2201->main_mux_deferred_nr = NVSW_SN2201_MAIN_MUX_DEFER_NR;
 	nvsw_sn2201->main_mux_devs = nvsw_sn2201_main_mux_brdinfo;
--- linux-qcom-6.8.0.orig/drivers/platform/mips/cpu_hwmon.c
+++ linux-qcom-6.8.0/drivers/platform/mips/cpu_hwmon.c
@@ -139,6 +139,9 @@
 		csr_temp_enable = csr_readl(LOONGSON_CSR_FEATURES) &
 				  LOONGSON_CSRF_TEMP;
 
+	if (!csr_temp_enable && !loongson_chiptemp[0])
+		return -ENODEV;
+
 	nr_packages = loongson_sysconf.nr_cpus /
 		loongson_sysconf.cores_per_package;
 
--- linux-qcom-6.8.0.orig/drivers/platform/surface/aggregator/controller.c
+++ linux-qcom-6.8.0/drivers/platform/surface/aggregator/controller.c
@@ -1354,7 +1354,8 @@
 	if (ctrl->state == SSAM_CONTROLLER_UNINITIALIZED)
 		return;
 
-	WARN_ON(ctrl->state != SSAM_CONTROLLER_STOPPED);
+	WARN_ON(ctrl->state != SSAM_CONTROLLER_STOPPED &&
+		ctrl->state != SSAM_CONTROLLER_INITIALIZED);
 
 	/*
 	 * Note: New events could still have been received after the previous
--- linux-qcom-6.8.0.orig/drivers/platform/surface/surface_aggregator_registry.c
+++ linux-qcom-6.8.0/drivers/platform/surface/surface_aggregator_registry.c
@@ -298,7 +298,7 @@
 	NULL,
 };
 
-/* Devices for Surface Pro 9 */
+/* Devices for Surface Pro 9 and 10 */
 static const struct software_node *ssam_node_group_sp9[] = {
 	&ssam_node_root,
 	&ssam_node_hub_kip,
@@ -337,6 +337,9 @@
 	/* Surface Pro 9 */
 	{ "MSHW0343", (unsigned long)ssam_node_group_sp9 },
 
+	/* Surface Pro 10 */
+	{ "MSHW0510", (unsigned long)ssam_node_group_sp9 },
+
 	/* Surface Book 2 */
 	{ "MSHW0107", (unsigned long)ssam_node_group_gen5 },
 
@@ -367,6 +370,9 @@
 	/* Surface Laptop Go 2 */
 	{ "MSHW0290", (unsigned long)ssam_node_group_slg1 },
 
+	/* Surface Laptop Go 3 */
+	{ "MSHW0440", (unsigned long)ssam_node_group_slg1 },
+
 	/* Surface Laptop Studio */
 	{ "MSHW0123", (unsigned long)ssam_node_group_sls },
 
--- linux-qcom-6.8.0.orig/drivers/platform/x86/Kconfig
+++ linux-qcom-6.8.0/drivers/platform/x86/Kconfig
@@ -369,6 +369,20 @@
 	  This is a driver for enabling wifi on some Fujitsu-Siemens Amilo
 	  laptops.
 
+config DELL_UART_BACKLIGHT
+	tristate "Dell AIO UART Backlight driver"
+	depends on SERIAL_8250
+	depends on ACPI
+	help
+	  Say Y here if you want to support Dell AIO UART backlight interface.
+	  The Dell AIO machines released after 2017 come with a UART interface
+	  to communicate with the backlight scalar board. This driver creates
+	  a standard backlight interface and talks to the scalar board through
+	  UART to adjust the AIO screen brightness.
+
+	  To compile this driver as a module, choose M here: the module will
+	  be called dell_uart_backlight.
+
 config FUJITSU_LAPTOP
 	tristate "Fujitsu Laptop Extras"
 	depends on ACPI
@@ -464,10 +478,22 @@
 	  This is a driver for Lenovo IdeaPad netbooks contains drivers for
 	  rfkill switch, hotkey, fan control and backlight control.
 
+config LENOVO_WMI_HOTKEY_UTILITIES
+	tristate "Lenovo Hotkey Utility WMI extras driver"
+	depends on ACPI_WMI
+	select NEW_LEDS
+	select LEDS_CLASS
+	imply IDEAPAD_LAPTOP
+	help
+	  This driver provides WMI support for Lenovo customized hotkeys function,
+	  such as LED control for audio/mic mute event for Ideapad, YOGA, XiaoXin,
+	  Gaming, ThinkBook and so on.
+
 config LENOVO_YMC
 	tristate "Lenovo Yoga Tablet Mode Control"
 	depends on ACPI_WMI
 	depends on INPUT
+	depends on IDEAPAD_LAPTOP
 	select INPUT_SPARSEKMAP
 	help
 	  This driver maps the Tablet Mode Control switch to SW_TABLET_MODE input
--- linux-qcom-6.8.0.orig/drivers/platform/x86/Makefile
+++ linux-qcom-6.8.0/drivers/platform/x86/Makefile
@@ -61,6 +61,7 @@
 # IBM Thinkpad and Lenovo
 obj-$(CONFIG_IBM_RTL)		+= ibm_rtl.o
 obj-$(CONFIG_IDEAPAD_LAPTOP)	+= ideapad-laptop.o
+obj-$(CONFIG_LENOVO_WMI_HOTKEY_UTILITIES)	+= lenovo-wmi-hotkey-utilities.o
 obj-$(CONFIG_LENOVO_YMC)	+= lenovo-ymc.o
 obj-$(CONFIG_SENSORS_HDAPS)	+= hdaps.o
 obj-$(CONFIG_THINKPAD_ACPI)	+= thinkpad_acpi.o
--- linux-qcom-6.8.0.orig/drivers/platform/x86/acer-wmi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/acer-wmi.c
@@ -276,6 +276,7 @@
 static u16 commun_func_bitmap;
 static u8 commun_fn_key_number;
 static bool cycle_gaming_thermal_profile = true;
+static bool predator_v4;
 
 module_param(mailled, int, 0444);
 module_param(brightness, int, 0444);
@@ -284,6 +285,7 @@
 module_param(force_caps, int, 0444);
 module_param(ec_raw_mode, bool, 0444);
 module_param(cycle_gaming_thermal_profile, bool, 0644);
+module_param(predator_v4, bool, 0444);
 MODULE_PARM_DESC(mailled, "Set initial state of Mail LED");
 MODULE_PARM_DESC(brightness, "Set initial LCD backlight brightness");
 MODULE_PARM_DESC(threeg, "Set initial state of 3G hardware");
@@ -292,6 +294,8 @@
 MODULE_PARM_DESC(ec_raw_mode, "Enable EC raw mode");
 MODULE_PARM_DESC(cycle_gaming_thermal_profile,
 	"Set thermal mode key in cycle mode. Disabling it sets the mode key in turbo toggle mode");
+MODULE_PARM_DESC(predator_v4,
+	"Enable features for predator laptops that use predator sense v4");
 
 struct acer_data {
 	int mailled;
@@ -585,6 +589,24 @@
 		.driver_data = &quirk_acer_predator_v4,
 	},
 	{
+		.callback = dmi_matched,
+		.ident = "Acer Predator PH16-71",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Predator PH16-71"),
+		},
+		.driver_data = &quirk_acer_predator_v4,
+	},
+	{
+		.callback = dmi_matched,
+		.ident = "Acer Predator PH18-71",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Predator PH18-71"),
+		},
+		.driver_data = &quirk_acer_predator_v4,
+	},
+	{
 		.callback = set_force_caps,
 		.ident = "Acer Aspire Switch 10E SW3-016",
 		.matches = {
@@ -725,7 +747,9 @@
 /* Find which quirks are needed for a particular vendor/ model pair */
 static void __init find_quirks(void)
 {
-	if (!force_series) {
+	if (predator_v4) {
+		quirks = &quirk_acer_predator_v4;
+	} else if (!force_series) {
 		dmi_check_system(acer_quirks);
 		dmi_check_system(non_acer_quirks);
 	} else if (force_series == 2490) {
--- linux-qcom-6.8.0.orig/drivers/platform/x86/amd/pmc/pmc-quirks.c
+++ linux-qcom-6.8.0/drivers/platform/x86/amd/pmc/pmc-quirks.c
@@ -208,6 +208,15 @@
 			DMI_MATCH(DMI_BIOS_VERSION, "03.03"),
 		}
 	},
+	{
+		.ident = "Framework Laptop 13 (Phoenix)",
+		.driver_data = &quirk_spurious_8042,
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Framework"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Laptop 13 (AMD Ryzen 7040Series)"),
+			DMI_MATCH(DMI_BIOS_VERSION, "03.05"),
+		}
+	},
 	{}
 };
 
--- linux-qcom-6.8.0.orig/drivers/platform/x86/amd/pmc/pmc.c
+++ linux-qcom-6.8.0/drivers/platform/x86/amd/pmc/pmc.c
@@ -943,6 +943,10 @@
 {
 	struct amd_pmc_dev *pdev = dev_get_drvdata(dev);
 
+	/*
+	 * Must be called only from the same set of dev_pm_ops handlers
+	 * as i8042_pm_suspend() is called: currently just from .suspend.
+	 */
 	if (pdev->disable_8042_wakeup && !disable_workarounds) {
 		int rc = amd_pmc_wa_irq1(pdev);
 
@@ -955,7 +959,9 @@
 	return 0;
 }
 
-static DEFINE_SIMPLE_DEV_PM_OPS(amd_pmc_pm, amd_pmc_suspend_handler, NULL);
+static const struct dev_pm_ops amd_pmc_pm = {
+	.suspend = amd_pmc_suspend_handler,
+};
 
 static const struct pci_device_id pmc_pci_ids[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_PS) },
@@ -993,6 +999,11 @@
 	amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_LOW, &phys_addr_low, dev->s2d_msg_id, true);
 	amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_HIGH, &phys_addr_hi, dev->s2d_msg_id, true);
 
+	if (!phys_addr_hi && !phys_addr_low) {
+		dev_err(dev->dev, "STB is not enabled on the system; disable enable_stb or contact system vendor\n");
+		return -EINVAL;
+	}
+
 	stb_phys_addr = ((u64)phys_addr_hi << 32 | phys_addr_low);
 
 	/* Clear msg_port for other SMU operation */
--- linux-qcom-6.8.0.orig/drivers/platform/x86/amd/pmf/acpi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/amd/pmf/acpi.c
@@ -90,12 +90,96 @@
 	return err;
 }
 
+static union acpi_object *apts_if_call(struct amd_pmf_dev *pdev, u32 state_index)
+{
+	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+	acpi_handle ahandle = ACPI_HANDLE(pdev->dev);
+	struct acpi_object_list apts_if_arg_list;
+	union acpi_object apts_if_args[3];
+	acpi_status status;
+
+	apts_if_arg_list.count = 3;
+	apts_if_arg_list.pointer = &apts_if_args[0];
+
+	apts_if_args[0].type = ACPI_TYPE_INTEGER;
+	apts_if_args[0].integer.value = 1;
+	apts_if_args[1].type = ACPI_TYPE_INTEGER;
+	apts_if_args[1].integer.value = state_index;
+	apts_if_args[2].type = ACPI_TYPE_INTEGER;
+	apts_if_args[2].integer.value = 0;
+
+	status = acpi_evaluate_object(ahandle, "APTS", &apts_if_arg_list, &buffer);
+	if (ACPI_FAILURE(status)) {
+		dev_err(pdev->dev, "APTS state_idx:%u call failed\n", state_index);
+		kfree(buffer.pointer);
+		return NULL;
+	}
+
+	return buffer.pointer;
+}
+
+static int apts_if_call_store_buffer(struct amd_pmf_dev *pdev,
+				     u32 index, void *data, size_t out_sz)
+{
+	union acpi_object *info;
+	size_t size;
+	int err = 0;
+
+	info = apts_if_call(pdev, index);
+	if (!info)
+		return -EIO;
+
+	if (info->type != ACPI_TYPE_BUFFER) {
+		dev_err(pdev->dev, "object is not a buffer\n");
+		err = -EINVAL;
+		goto out;
+	}
+
+	size = *(u16 *)info->buffer.pointer;
+	if (info->buffer.length < size) {
+		dev_err(pdev->dev, "buffer smaller than header size %u < %zu\n",
+			info->buffer.length, size);
+		err = -EINVAL;
+		goto out;
+	}
+
+	if (size < out_sz) {
+		dev_err(pdev->dev, "buffer too small %zu\n", size);
+		err = -EINVAL;
+		goto out;
+	}
+
+	memcpy(data, info->buffer.pointer, out_sz);
+out:
+	kfree(info);
+	return err;
+}
+
 int is_apmf_func_supported(struct amd_pmf_dev *pdev, unsigned long index)
 {
 	/* If bit-n is set, that indicates function n+1 is supported */
 	return !!(pdev->supported_func & BIT(index - 1));
 }
 
+int apts_get_static_slider_granular_v2(struct amd_pmf_dev *pdev,
+				       struct amd_pmf_apts_granular_output *data, u32 apts_idx)
+{
+	if (!is_apmf_func_supported(pdev, APMF_FUNC_STATIC_SLIDER_GRANULAR))
+		return -EINVAL;
+
+	return apts_if_call_store_buffer(pdev, apts_idx, data, sizeof(*data));
+}
+
+int apmf_get_static_slider_granular_v2(struct amd_pmf_dev *pdev,
+				       struct apmf_static_slider_granular_output_v2 *data)
+{
+	if (!is_apmf_func_supported(pdev, APMF_FUNC_STATIC_SLIDER_GRANULAR))
+		return -EINVAL;
+
+	return apmf_if_call_store_buffer(pdev, APMF_FUNC_STATIC_SLIDER_GRANULAR,
+					 data, sizeof(*data));
+}
+
 int apmf_get_static_slider_granular(struct amd_pmf_dev *pdev,
 				    struct apmf_static_slider_granular_output *data)
 {
@@ -140,6 +224,43 @@
 	kfree(info);
 }
 
+int amd_pmf_notify_sbios_heartbeat_event_v2(struct amd_pmf_dev *dev, u8 flag)
+{
+	struct sbios_hb_event_v2 args = { };
+	struct acpi_buffer params;
+	union acpi_object *info;
+
+	args.size = sizeof(args);
+
+	switch (flag) {
+	case ON_LOAD:
+		args.load = 1;
+		break;
+	case ON_UNLOAD:
+		args.unload = 1;
+		break;
+	case ON_SUSPEND:
+		args.suspend = 1;
+		break;
+	case ON_RESUME:
+		args.resume = 1;
+		break;
+	default:
+		dev_dbg(dev->dev, "Failed to send v2 heartbeat event, flag:0x%x\n", flag);
+		return -EINVAL;
+	}
+
+	params.length = sizeof(args);
+	params.pointer = &args;
+
+	info = apmf_if_call(dev, APMF_FUNC_SBIOS_HEARTBEAT_V2, &params);
+	if (!info)
+		return -EIO;
+
+	kfree(info);
+	return 0;
+}
+
 int apmf_update_fan_idx(struct amd_pmf_dev *pdev, bool manual, u32 idx)
 {
 	union acpi_object *info;
@@ -166,6 +287,11 @@
 	return apmf_if_call_store_buffer(pdev, APMF_FUNC_AUTO_MODE, data, sizeof(*data));
 }
 
+int apmf_get_sbios_requests_v2(struct amd_pmf_dev *pdev, struct apmf_sbios_req_v2 *req)
+{
+	return apmf_if_call_store_buffer(pdev, APMF_FUNC_SBIOS_REQUESTS, req, sizeof(*req));
+}
+
 int apmf_get_sbios_requests(struct amd_pmf_dev *pdev, struct apmf_sbios_req *req)
 {
 	return apmf_if_call_store_buffer(pdev, APMF_FUNC_SBIOS_REQUESTS,
@@ -218,8 +344,10 @@
 		return err;
 
 	pdev->supported_func = output.supported_functions;
-	dev_dbg(pdev->dev, "supported functions:0x%x notifications:0x%x\n",
-		output.supported_functions, output.notification_mask);
+	dev_dbg(pdev->dev, "supported functions:0x%x notifications:0x%x version:%u\n",
+		output.supported_functions, output.notification_mask, output.version);
+
+	pdev->pmf_if_version = output.version;
 
 	return 0;
 }
@@ -309,7 +437,7 @@
 
 	status = acpi_walk_resources(ahandle, METHOD_NAME__CRS, apmf_walk_resources, pmf_dev);
 	if (ACPI_FAILURE(status)) {
-		dev_err(pmf_dev->dev, "acpi_walk_resources failed :%d\n", status);
+		dev_dbg(pmf_dev->dev, "acpi_walk_resources failed :%d\n", status);
 		return -EINVAL;
 	}
 
@@ -320,7 +448,7 @@
 {
 	acpi_handle ahandle = ACPI_HANDLE(pmf_dev->dev);
 
-	if (pmf_dev->hb_interval)
+	if (pmf_dev->hb_interval && pmf_dev->pmf_if_version == PMF_IF_V1)
 		cancel_delayed_work_sync(&pmf_dev->heart_beat);
 
 	if (is_apmf_func_supported(pmf_dev, APMF_FUNC_AUTO_MODE) &&
@@ -344,7 +472,7 @@
 		goto out;
 	}
 
-	if (pmf_dev->hb_interval) {
+	if (pmf_dev->hb_interval && pmf_dev->pmf_if_version == PMF_IF_V1) {
 		/* send heartbeats only if the interval is not zero */
 		INIT_DELAYED_WORK(&pmf_dev->heart_beat, apmf_sbios_heartbeat_notify);
 		schedule_delayed_work(&pmf_dev->heart_beat, 0);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/amd/pmf/core.c
+++ linux-qcom-6.8.0/drivers/platform/x86/amd/pmf/core.c
@@ -113,8 +113,9 @@
 static void amd_pmf_dbgfs_register(struct amd_pmf_dev *dev)
 {
 	dev->dbgfs_dir = debugfs_create_dir("amd_pmf", NULL);
-	debugfs_create_file("current_power_limits", 0644, dev->dbgfs_dir, dev,
-			    &current_power_limits_fops);
+	if (dev->pmf_if_version == PMF_IF_V1)
+		debugfs_create_file("current_power_limits", 0644, dev->dbgfs_dir, dev,
+				    &current_power_limits_fops);
 }
 
 int amd_pmf_get_power_source(void)
@@ -299,6 +300,9 @@
 	if (pdev->smart_pc_enabled)
 		cancel_delayed_work_sync(&pdev->pb_work);
 
+	if (is_apmf_func_supported(pdev, APMF_FUNC_SBIOS_HEARTBEAT_V2))
+		amd_pmf_notify_sbios_heartbeat_event_v2(pdev, ON_SUSPEND);
+
 	return 0;
 }
 
@@ -313,6 +317,9 @@
 			return ret;
 	}
 
+	if (is_apmf_func_supported(pdev, APMF_FUNC_SBIOS_HEARTBEAT_V2))
+		amd_pmf_notify_sbios_heartbeat_event_v2(pdev, ON_RESUME);
+
 	if (pdev->smart_pc_enabled)
 		schedule_delayed_work(&pdev->pb_work, msecs_to_jiffies(2000));
 
@@ -443,6 +450,8 @@
 	amd_pmf_dbgfs_register(dev);
 	amd_pmf_init_features(dev);
 	apmf_install_handler(dev);
+	if (is_apmf_func_supported(dev, APMF_FUNC_SBIOS_HEARTBEAT_V2))
+		amd_pmf_notify_sbios_heartbeat_event_v2(dev, ON_LOAD);
 
 	dev_info(dev->dev, "registered PMF device successfully\n");
 
@@ -454,6 +463,8 @@
 	struct amd_pmf_dev *dev = platform_get_drvdata(pdev);
 
 	amd_pmf_deinit_features(dev);
+	if (is_apmf_func_supported(dev, APMF_FUNC_SBIOS_HEARTBEAT_V2))
+		amd_pmf_notify_sbios_heartbeat_event_v2(dev, ON_UNLOAD);
 	apmf_acpi_deinit(dev);
 	amd_pmf_dbgfs_unregister(dev);
 	mutex_destroy(&dev->lock);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/amd/pmf/pmf.h
+++ linux-qcom-6.8.0/drivers/platform/x86/amd/pmf/pmf.h
@@ -30,6 +30,7 @@
 #define APMF_FUNC_STATIC_SLIDER_GRANULAR       9
 #define APMF_FUNC_DYN_SLIDER_AC				11
 #define APMF_FUNC_DYN_SLIDER_DC				12
+#define APMF_FUNC_SBIOS_HEARTBEAT_V2			16
 
 /* Message Definitions */
 #define SET_SPL				0x03 /* SPL: Sustained Power Limit */
@@ -50,6 +51,8 @@
 #define GET_STT_LIMIT_APU	0x20
 #define GET_STT_LIMIT_HS2	0x21
 #define SET_P3T				0x23 /* P3T: Peak Package Power Limit */
+#define SET_PMF_PPT            0x25
+#define SET_PMF_PPT_APU_ONLY   0x26
 
 /* OS slider update notification */
 #define DC_BEST_PERF		0
@@ -83,6 +86,47 @@
 #define TA_OUTPUT_RESERVED_MEM				906
 #define MAX_OPERATION_PARAMS					4
 
+#define PMF_IF_V1		1
+#define PMF_IF_V2		2
+
+#define APTS_MAX_STATES		16
+
+/* APTS PMF BIOS Interface */
+struct amd_pmf_apts_output {
+	u16 table_version;
+	u32 fan_table_idx;
+	u32 pmf_ppt;
+	u32 ppt_pmf_apu_only;
+	u32 stt_min_limit;
+	u8 stt_skin_temp_limit_apu;
+	u8 stt_skin_temp_limit_hs2;
+} __packed;
+
+struct amd_pmf_apts_granular_output {
+	u16 size;
+	struct amd_pmf_apts_output val;
+} __packed;
+
+struct amd_pmf_apts_granular {
+	u16 size;
+	struct amd_pmf_apts_output val[APTS_MAX_STATES];
+};
+
+struct sbios_hb_event_v2 {
+	u16 size;
+	u8 load;
+	u8 unload;
+	u8 suspend;
+	u8 resume;
+} __packed;
+
+enum sbios_hb_v2 {
+	ON_LOAD,
+	ON_UNLOAD,
+	ON_SUSPEND,
+	ON_RESUME,
+};
+
 /* AMD PMF BIOS interfaces */
 struct apmf_verify_interface {
 	u16 size;
@@ -114,6 +158,18 @@
 	u8 skin_temp_hs2;
 } __packed;
 
+struct apmf_sbios_req_v2 {
+	u16 size;
+	u32 pending_req;
+	u8 rsd;
+	u32 ppt_pmf;
+	u32 ppt_pmf_apu_only;
+	u32 stt_min_limit;
+	u8 skin_temp_apu;
+	u8 skin_temp_hs2;
+	u32 custom_policy[10];
+} __packed;
+
 struct apmf_fan_idx {
 	u16 size;
 	u8 fan_ctl_mode;
@@ -194,6 +250,14 @@
 	POWER_MODE_MAX,
 };
 
+enum power_modes_v2 {
+	POWER_MODE_BEST_PERFORMANCE,
+	POWER_MODE_BALANCED,
+	POWER_MODE_BEST_POWER_EFFICIENCY,
+	POWER_MODE_ENERGY_SAVE,
+	POWER_MODE_V2_MAX,
+};
+
 struct amd_pmf_dev {
 	void __iomem *regbase;
 	void __iomem *smu_virt_addr;
@@ -231,8 +295,13 @@
 	u64 policy_addr;
 	void *policy_base;
 	bool smart_pc_enabled;
+	u16 pmf_if_version;
 };
 
+struct apmf_sps_prop_granular_v2 {
+	u8 power_states[POWER_SOURCE_MAX][POWER_MODE_V2_MAX];
+} __packed;
+
 struct apmf_sps_prop_granular {
 	u32 fppt;
 	u32 sppt;
@@ -254,6 +323,16 @@
 	struct apmf_sps_prop_granular prop[POWER_SOURCE_MAX][POWER_MODE_MAX];
 };
 
+struct apmf_static_slider_granular_output_v2 {
+	u16 size;
+	struct apmf_sps_prop_granular_v2 sps_idx;
+} __packed;
+
+struct amd_pmf_static_slider_granular_v2 {
+	u16 size;
+	struct apmf_sps_prop_granular_v2 sps_idx;
+};
+
 struct os_power_slider {
 	u16 size;
 	u8 slider_event;
@@ -585,6 +664,7 @@
 int apmf_install_handler(struct amd_pmf_dev *pmf_dev);
 int apmf_os_power_slider_update(struct amd_pmf_dev *dev, u8 flag);
 int amd_pmf_set_dram_addr(struct amd_pmf_dev *dev, bool alloc_buffer);
+int amd_pmf_notify_sbios_heartbeat_event_v2(struct amd_pmf_dev *dev, u8 flag);
 
 /* SPS Layer */
 int amd_pmf_get_pprof_modes(struct amd_pmf_dev *pmf);
@@ -602,6 +682,10 @@
 
 int apmf_update_fan_idx(struct amd_pmf_dev *pdev, bool manual, u32 idx);
 int amd_pmf_set_sps_power_limits(struct amd_pmf_dev *pmf);
+int apmf_get_static_slider_granular_v2(struct amd_pmf_dev *dev,
+				       struct apmf_static_slider_granular_output_v2 *data);
+int apts_get_static_slider_granular_v2(struct amd_pmf_dev *pdev,
+				       struct amd_pmf_apts_granular_output *data, u32 apts_idx);
 
 /* Auto Mode Layer */
 int apmf_get_auto_mode_def(struct amd_pmf_dev *pdev, struct apmf_auto_mode *data);
@@ -609,6 +693,7 @@
 void amd_pmf_deinit_auto_mode(struct amd_pmf_dev *dev);
 void amd_pmf_trans_automode(struct amd_pmf_dev *dev, int socket_power, ktime_t time_elapsed_ms);
 int apmf_get_sbios_requests(struct amd_pmf_dev *pdev, struct apmf_sbios_req *req);
+int apmf_get_sbios_requests_v2(struct amd_pmf_dev *pdev, struct apmf_sbios_req_v2 *req);
 
 void amd_pmf_update_2_cql(struct amd_pmf_dev *dev, bool is_cql_event);
 int amd_pmf_reset_amt(struct amd_pmf_dev *dev);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/amd/pmf/spc.c
+++ linux-qcom-6.8.0/drivers/platform/x86/amd/pmf/spc.c
@@ -150,36 +150,26 @@
 	return 0;
 }
 
-static int amd_pmf_get_sensor_info(struct amd_pmf_dev *dev, struct ta_pmf_enact_table *in)
+static void amd_pmf_get_sensor_info(struct amd_pmf_dev *dev, struct ta_pmf_enact_table *in)
 {
 	struct amd_sfh_info sfh_info;
-	int ret;
+
+	/* Get the latest information from SFH */
+	in->ev_info.user_present = false;
 
 	/* Get ALS data */
-	ret = amd_get_sfh_info(&sfh_info, MT_ALS);
-	if (!ret)
+	if (!amd_get_sfh_info(&sfh_info, MT_ALS))
 		in->ev_info.ambient_light = sfh_info.ambient_light;
 	else
-		return ret;
+		dev_dbg(dev->dev, "ALS is not enabled/detected\n");
 
 	/* get HPD data */
-	ret = amd_get_sfh_info(&sfh_info, MT_HPD);
-	if (ret)
-		return ret;
-
-	switch (sfh_info.user_present) {
-	case SFH_NOT_DETECTED:
-		in->ev_info.user_present = 0xff; /* assume no sensors connected */
-		break;
-	case SFH_USER_PRESENT:
-		in->ev_info.user_present = 1;
-		break;
-	case SFH_USER_AWAY:
-		in->ev_info.user_present = 0;
-		break;
+	if (!amd_get_sfh_info(&sfh_info, MT_HPD)) {
+		if (sfh_info.user_present == SFH_USER_PRESENT)
+			in->ev_info.user_present = true;
+	} else {
+		dev_dbg(dev->dev, "HPD is not enabled/detected\n");
 	}
-
-	return 0;
 }
 
 void amd_pmf_populate_ta_inputs(struct amd_pmf_dev *dev, struct ta_pmf_enact_table *in)
--- linux-qcom-6.8.0.orig/drivers/platform/x86/amd/pmf/sps.c
+++ linux-qcom-6.8.0/drivers/platform/x86/amd/pmf/sps.c
@@ -10,9 +10,27 @@
 
 #include "pmf.h"
 
+static struct amd_pmf_static_slider_granular_v2 config_store_v2;
 static struct amd_pmf_static_slider_granular config_store;
+static struct amd_pmf_apts_granular apts_config_store;
 
 #ifdef CONFIG_AMD_PMF_DEBUG
+static const char *slider_v2_as_str(unsigned int state)
+{
+	switch (state) {
+	case POWER_MODE_BEST_PERFORMANCE:
+		return "Best Performance";
+	case POWER_MODE_BALANCED:
+		return "Balanced";
+	case POWER_MODE_BEST_POWER_EFFICIENCY:
+		return "Best Power Efficiency";
+	case POWER_MODE_ENERGY_SAVE:
+		return "Energy Save";
+	default:
+		return "Unknown Power Mode";
+	}
+}
+
 static const char *slider_as_str(unsigned int state)
 {
 	switch (state) {
@@ -63,10 +81,88 @@
 
 	pr_debug("Static Slider Data - END\n");
 }
+
+static void amd_pmf_dump_sps_defaults_v2(struct amd_pmf_static_slider_granular_v2 *data)
+{
+	unsigned int i, j;
+
+	pr_debug("Static Slider APTS state index data - BEGIN");
+	pr_debug("size: %u\n", data->size);
+
+	for (i = 0; i < POWER_SOURCE_MAX; i++)
+		for (j = 0; j < POWER_MODE_V2_MAX; j++)
+			pr_debug("%s %s: %u\n", amd_pmf_source_as_str(i), slider_v2_as_str(j),
+				 data->sps_idx.power_states[i][j]);
+
+	pr_debug("Static Slider APTS state index data - END\n");
+}
+
+static void amd_pmf_dump_apts_sps_defaults(struct amd_pmf_apts_granular *info)
+{
+	int i;
+
+	pr_debug("Static Slider APTS index default values data - BEGIN");
+
+	for (i = 0; i < APTS_MAX_STATES; i++) {
+		pr_debug("Table Version[%d] = %u\n", i, info->val[i].table_version);
+		pr_debug("Fan Index[%d] = %u\n", i, info->val[i].fan_table_idx);
+		pr_debug("PPT[%d] = %u\n", i, info->val[i].pmf_ppt);
+		pr_debug("PPT APU[%d] = %u\n", i, info->val[i].ppt_pmf_apu_only);
+		pr_debug("STT Min[%d] = %u\n", i, info->val[i].stt_min_limit);
+		pr_debug("STT APU[%d] = %u\n", i, info->val[i].stt_skin_temp_limit_apu);
+		pr_debug("STT HS2[%d] = %u\n", i, info->val[i].stt_skin_temp_limit_hs2);
+	}
+
+	pr_debug("Static Slider APTS index default values data - END");
+}
 #else
 static void amd_pmf_dump_sps_defaults(struct amd_pmf_static_slider_granular *data) {}
+static void amd_pmf_dump_sps_defaults_v2(struct amd_pmf_static_slider_granular_v2 *data) {}
+static void amd_pmf_dump_apts_sps_defaults(struct amd_pmf_apts_granular *info) {}
 #endif
 
+static void amd_pmf_load_apts_defaults_sps_v2(struct amd_pmf_dev *pdev)
+{
+	struct amd_pmf_apts_granular_output output;
+	struct amd_pmf_apts_output *ps;
+	int i;
+
+	memset(&apts_config_store, 0, sizeof(apts_config_store));
+
+	ps = apts_config_store.val;
+
+	for (i = 0; i < APTS_MAX_STATES; i++) {
+		apts_get_static_slider_granular_v2(pdev, &output, i);
+		ps[i].table_version = output.val.table_version;
+		ps[i].fan_table_idx = output.val.fan_table_idx;
+		ps[i].pmf_ppt = output.val.pmf_ppt;
+		ps[i].ppt_pmf_apu_only = output.val.ppt_pmf_apu_only;
+		ps[i].stt_min_limit = output.val.stt_min_limit;
+		ps[i].stt_skin_temp_limit_apu = output.val.stt_skin_temp_limit_apu;
+		ps[i].stt_skin_temp_limit_hs2 = output.val.stt_skin_temp_limit_hs2;
+	}
+
+	amd_pmf_dump_apts_sps_defaults(&apts_config_store);
+}
+
+static void amd_pmf_load_defaults_sps_v2(struct amd_pmf_dev *dev)
+{
+	struct apmf_static_slider_granular_output_v2 output;
+	unsigned int i, j;
+
+	memset(&config_store_v2, 0, sizeof(config_store_v2));
+	apmf_get_static_slider_granular_v2(dev, &output);
+
+	config_store_v2.size = output.size;
+
+	for (i = 0; i < POWER_SOURCE_MAX; i++)
+		for (j = 0; j < POWER_MODE_V2_MAX; j++)
+			config_store_v2.sps_idx.power_states[i][j] =
+							output.sps_idx.power_states[i][j];
+
+	amd_pmf_dump_sps_defaults_v2(&config_store_v2);
+}
+
 static void amd_pmf_load_defaults_sps(struct amd_pmf_dev *dev)
 {
 	struct apmf_static_slider_granular_output output;
@@ -94,6 +190,19 @@
 	amd_pmf_dump_sps_defaults(&config_store);
 }
 
+static void amd_pmf_update_slider_v2(struct amd_pmf_dev *dev, int idx)
+{
+	amd_pmf_send_cmd(dev, SET_PMF_PPT, false, apts_config_store.val[idx].pmf_ppt, NULL);
+	amd_pmf_send_cmd(dev, SET_PMF_PPT_APU_ONLY, false,
+			 apts_config_store.val[idx].ppt_pmf_apu_only, NULL);
+	amd_pmf_send_cmd(dev, SET_STT_MIN_LIMIT, false,
+			 apts_config_store.val[idx].stt_min_limit, NULL);
+	amd_pmf_send_cmd(dev, SET_STT_LIMIT_APU, false,
+			 apts_config_store.val[idx].stt_skin_temp_limit_apu, NULL);
+	amd_pmf_send_cmd(dev, SET_STT_LIMIT_HS2, false,
+			 apts_config_store.val[idx].stt_skin_temp_limit_hs2, NULL);
+}
+
 void amd_pmf_update_slider(struct amd_pmf_dev *dev, bool op, int idx,
 			   struct amd_pmf_static_slider_granular *table)
 {
@@ -126,6 +235,32 @@
 	}
 }
 
+static int amd_pmf_update_sps_power_limits_v2(struct amd_pmf_dev *pdev, int pwr_mode)
+{
+	int src, index;
+
+	src = amd_pmf_get_power_source();
+
+	switch (pwr_mode) {
+	case POWER_MODE_PERFORMANCE:
+		index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BEST_PERFORMANCE];
+		amd_pmf_update_slider_v2(pdev, index);
+		break;
+	case POWER_MODE_BALANCED_POWER:
+		index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BALANCED];
+		amd_pmf_update_slider_v2(pdev, index);
+		break;
+	case POWER_MODE_POWER_SAVER:
+		index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BEST_POWER_EFFICIENCY];
+		amd_pmf_update_slider_v2(pdev, index);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 int amd_pmf_set_sps_power_limits(struct amd_pmf_dev *pmf)
 {
 	int mode;
@@ -134,6 +269,9 @@
 	if (mode < 0)
 		return mode;
 
+	if (pmf->pmf_if_version == PMF_IF_V2)
+		return amd_pmf_update_sps_power_limits_v2(pmf, mode);
+
 	amd_pmf_update_slider(pmf, SLIDER_OP_SET, mode, NULL);
 
 	return 0;
@@ -256,7 +394,12 @@
 	dev->current_profile = PLATFORM_PROFILE_BALANCED;
 
 	if (is_apmf_func_supported(dev, APMF_FUNC_STATIC_SLIDER_GRANULAR)) {
-		amd_pmf_load_defaults_sps(dev);
+		if (dev->pmf_if_version == PMF_IF_V2) {
+			amd_pmf_load_defaults_sps_v2(dev);
+			amd_pmf_load_apts_defaults_sps_v2(dev);
+		} else {
+			amd_pmf_load_defaults_sps(dev);
+		}
 
 		/* update SPS balanced power mode thermals */
 		amd_pmf_set_sps_power_limits(dev);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/amd/pmf/tee-if.c
+++ linux-qcom-6.8.0/drivers/platform/x86/amd/pmf/tee-if.c
@@ -249,8 +249,8 @@
 	u32 cookie, length;
 	int res;
 
-	cookie = readl(dev->policy_buf + POLICY_COOKIE_OFFSET);
-	length = readl(dev->policy_buf + POLICY_COOKIE_LEN);
+	cookie = *(u32 *)(dev->policy_buf + POLICY_COOKIE_OFFSET);
+	length = *(u32 *)(dev->policy_buf + POLICY_COOKIE_LEN);
 
 	if (cookie != POLICY_SIGN_COOKIE || !length) {
 		dev_dbg(dev->dev, "cookie doesn't match\n");
--- linux-qcom-6.8.0.orig/drivers/platform/x86/asus-nb-wmi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/asus-nb-wmi.c
@@ -145,6 +145,10 @@
 	.wmi_ignore_fan = true,
 };
 
+static struct quirk_entry quirk_asus_zenbook_duo_kbd = {
+	.ignore_key_wlan = true,
+};
+
 static int dmi_matched(const struct dmi_system_id *dmi)
 {
 	pr_info("Identified laptop model '%s'\n", dmi->ident);
@@ -516,6 +520,15 @@
 		},
 		.driver_data = &quirk_asus_ignore_fan,
 	},
+	{
+		.callback = dmi_matched,
+		.ident = "ASUS Zenbook Duo UX8406MA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "UX8406MA"),
+		},
+		.driver_data = &quirk_asus_zenbook_duo_kbd,
+	},
 	{},
 };
 
@@ -610,6 +623,7 @@
 	{ KE_KEY, 0xC4, { KEY_KBDILLUMUP } },
 	{ KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } },
 	{ KE_IGNORE, 0xC6, },  /* Ambient Light Sensor notification */
+	{ KE_IGNORE, 0xCF, },	/* AC mode */
 	{ KE_KEY, 0xFA, { KEY_PROG2 } },           /* Lid flip action */
 	{ KE_KEY, 0xBD, { KEY_PROG2 } },           /* Lid flip action on ROG xflow laptops */
 	{ KE_END, 0},
@@ -630,7 +644,12 @@
 	case 0x32: /* Volume Mute */
 		if (atkbd_reports_vol_keys)
 			*code = ASUS_WMI_KEY_IGNORE;
-
+		break;
+	case 0x5D: /* Wireless console Toggle */
+	case 0x5E: /* Wireless console Enable */
+	case 0x5F: /* Wireless console Disable */
+		if (quirks->ignore_key_wlan)
+			*code = ASUS_WMI_KEY_IGNORE;
 		break;
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/platform/x86/asus-wmi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/asus-wmi.c
@@ -97,6 +97,12 @@
 #define ASUS_THROTTLE_THERMAL_POLICY_OVERBOOST	1
 #define ASUS_THROTTLE_THERMAL_POLICY_SILENT	2
 
+#define ASUS_THROTTLE_THERMAL_POLICY_DEFAULT_VIVO	0
+#define ASUS_THROTTLE_THERMAL_POLICY_SILENT_VIVO	1
+#define ASUS_THROTTLE_THERMAL_POLICY_OVERBOOST_VIVO	2
+
+#define PLATFORM_PROFILE_MAX 2
+
 #define USB_INTEL_XUSB2PR		0xD0
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI	0x9c31
 
@@ -281,8 +287,8 @@
 	bool kbd_rgb_mode_available;
 	bool kbd_rgb_state_available;
 
-	bool throttle_thermal_policy_available;
 	u8 throttle_thermal_policy_mode;
+	u32 throttle_thermal_policy_dev;
 
 	bool cpu_fan_curve_available;
 	bool gpu_fan_curve_available;
@@ -489,7 +495,17 @@
 
 static int asus_wmi_get_devstate(struct asus_wmi *asus, u32 dev_id, u32 *retval)
 {
-	return asus_wmi_evaluate_method(asus->dsts_id, dev_id, 0, retval);
+	int err;
+
+	err = asus_wmi_evaluate_method(asus->dsts_id, dev_id, 0, retval);
+
+	if (err)
+		return err;
+
+	if (*retval == ~0)
+		return -ENODEV;
+
+	return 0;
 }
 
 static int asus_wmi_set_devstate(u32 dev_id, u32 ctrl_param,
@@ -2927,7 +2943,7 @@
 	int err, fan_idx;
 	u8 mode = 0;
 
-	if (asus->throttle_thermal_policy_available)
+	if (asus->throttle_thermal_policy_dev)
 		mode = asus->throttle_thermal_policy_mode;
 	/* DEVID_<C/G>PU_FAN_CURVE is switched for OVERBOOST vs SILENT */
 	if (mode == 2)
@@ -3134,7 +3150,7 @@
 		 * For machines with throttle this is the only way to reset fans
 		 * to default mode of operation (does not erase curve data).
 		 */
-		if (asus->throttle_thermal_policy_available) {
+		if (asus->throttle_thermal_policy_dev) {
 			err = throttle_thermal_policy_write(asus);
 			if (err)
 				return err;
@@ -3351,8 +3367,8 @@
 __ATTRIBUTE_GROUPS(asus_fan_curve_attr);
 
 /*
- * Must be initialised after throttle_thermal_policy_check_present() as
- * we check the status of throttle_thermal_policy_available during init.
+ * Must be initialised after throttle_thermal_policy_dev is set as
+ * we check the status of throttle_thermal_policy_dev during init.
  */
 static int asus_wmi_custom_fan_curve_init(struct asus_wmi *asus)
 {
@@ -3393,39 +3409,31 @@
 }
 
 /* Throttle thermal policy ****************************************************/
-
-static int throttle_thermal_policy_check_present(struct asus_wmi *asus)
-{
-	u32 result;
-	int err;
-
-	asus->throttle_thermal_policy_available = false;
-
-	err = asus_wmi_get_devstate(asus,
-				    ASUS_WMI_DEVID_THROTTLE_THERMAL_POLICY,
-				    &result);
-	if (err) {
-		if (err == -ENODEV)
-			return 0;
-		return err;
-	}
-
-	if (result & ASUS_WMI_DSTS_PRESENCE_BIT)
-		asus->throttle_thermal_policy_available = true;
-
-	return 0;
-}
-
 static int throttle_thermal_policy_write(struct asus_wmi *asus)
 {
-	int err;
 	u8 value;
-	u32 retval;
+	int err;
 
-	value = asus->throttle_thermal_policy_mode;
+	if (asus->throttle_thermal_policy_dev == ASUS_WMI_DEVID_THROTTLE_THERMAL_POLICY_VIVO) {
+		switch (asus->throttle_thermal_policy_mode) {
+		case ASUS_THROTTLE_THERMAL_POLICY_DEFAULT:
+			value = ASUS_THROTTLE_THERMAL_POLICY_DEFAULT_VIVO;
+			break;
+		case ASUS_THROTTLE_THERMAL_POLICY_OVERBOOST:
+			value = ASUS_THROTTLE_THERMAL_POLICY_OVERBOOST_VIVO;
+			break;
+		case ASUS_THROTTLE_THERMAL_POLICY_SILENT:
+			value = ASUS_THROTTLE_THERMAL_POLICY_SILENT_VIVO;
+			break;
+		default:
+			return -EINVAL;
+		}
+	} else {
+		value = asus->throttle_thermal_policy_mode;
+	}
 
-	err = asus_wmi_set_devstate(ASUS_WMI_DEVID_THROTTLE_THERMAL_POLICY,
-				    value, &retval);
+	/* Some machines do not return an error code as a result, so we ignore it */
+	err = asus_wmi_set_devstate(asus->throttle_thermal_policy_dev, value, NULL);
 
 	sysfs_notify(&asus->platform_device->dev.kobj, NULL,
 			"throttle_thermal_policy");
@@ -3435,12 +3443,6 @@
 		return err;
 	}
 
-	if (retval != 1) {
-		pr_warn("Failed to set throttle thermal policy (retval): 0x%x\n",
-			retval);
-		return -EIO;
-	}
-
 	/* Must set to disabled if mode is toggled */
 	if (asus->cpu_fan_curve_available)
 		asus->custom_fan_curves[FAN_CURVE_DEV_CPU].enabled = false;
@@ -3454,7 +3456,7 @@
 
 static int throttle_thermal_policy_set_default(struct asus_wmi *asus)
 {
-	if (!asus->throttle_thermal_policy_available)
+	if (!asus->throttle_thermal_policy_dev)
 		return 0;
 
 	asus->throttle_thermal_policy_mode = ASUS_THROTTLE_THERMAL_POLICY_DEFAULT;
@@ -3466,7 +3468,7 @@
 	u8 new_mode = asus->throttle_thermal_policy_mode + 1;
 	int err;
 
-	if (new_mode > ASUS_THROTTLE_THERMAL_POLICY_SILENT)
+	if (new_mode > PLATFORM_PROFILE_MAX)
 		new_mode = ASUS_THROTTLE_THERMAL_POLICY_DEFAULT;
 
 	asus->throttle_thermal_policy_mode = new_mode;
@@ -3505,7 +3507,7 @@
 	if (result < 0)
 		return result;
 
-	if (new_mode > ASUS_THROTTLE_THERMAL_POLICY_SILENT)
+	if (new_mode > PLATFORM_PROFILE_MAX)
 		return -EINVAL;
 
 	asus->throttle_thermal_policy_mode = new_mode;
@@ -3522,7 +3524,9 @@
 	return count;
 }
 
-// Throttle thermal policy: 0 - default, 1 - overboost, 2 - silent
+/*
+ * Throttle thermal policy: 0 - default, 1 - overboost, 2 - silent
+ */
 static DEVICE_ATTR_RW(throttle_thermal_policy);
 
 /* Platform profile ***********************************************************/
@@ -3533,7 +3537,6 @@
 	int tp;
 
 	asus = container_of(pprof, struct asus_wmi, platform_profile_handler);
-
 	tp = asus->throttle_thermal_policy_mode;
 
 	switch (tp) {
@@ -3588,9 +3591,19 @@
 	 * Not an error if a component platform_profile relies on is unavailable
 	 * so early return, skipping the setup of platform_profile.
 	 */
-	if (!asus->throttle_thermal_policy_available)
+	if (!asus->throttle_thermal_policy_dev)
 		return 0;
 
+	/*
+	 * We need to set the default thermal profile during probe or otherwise
+	 * the system will often remain in silent mode, causing low performance.
+	 */
+	err = throttle_thermal_policy_set_default(asus);
+	if (err < 0) {
+		pr_warn("Failed to set default thermal profile\n");
+		return err;
+	}
+
 	dev_info(dev, "Using throttle_thermal_policy for platform_profile support\n");
 
 	asus->platform_profile_handler.profile_get = asus_wmi_platform_profile_get;
@@ -4003,7 +4016,7 @@
 	if (code == NOTIFY_KBD_FBM || code == NOTIFY_KBD_TTP) {
 		if (asus->fan_boost_mode_available)
 			fan_boost_mode_switch_next(asus);
-		if (asus->throttle_thermal_policy_available)
+		if (asus->throttle_thermal_policy_dev)
 			throttle_thermal_policy_switch_next(asus);
 		return;
 
@@ -4208,7 +4221,7 @@
 	else if (attr == &dev_attr_fan_boost_mode.attr)
 		ok = asus->fan_boost_mode_available;
 	else if (attr == &dev_attr_throttle_thermal_policy.attr)
-		ok = asus->throttle_thermal_policy_available;
+		ok = asus->throttle_thermal_policy_dev != 0;
 	else if (attr == &dev_attr_ppt_pl2_sppt.attr)
 		ok = asus->ppt_pl2_sppt_available;
 	else if (attr == &dev_attr_ppt_pl1_spl.attr)
@@ -4500,16 +4513,15 @@
 	asus->ally_mcu_usb_switch = acpi_has_method(NULL, ASUS_USB0_PWR_EC0_CSEE)
 						&& dmi_match(DMI_BOARD_NAME, "RC71L");
 
+	if (asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_THROTTLE_THERMAL_POLICY))
+		asus->throttle_thermal_policy_dev = ASUS_WMI_DEVID_THROTTLE_THERMAL_POLICY;
+	else if (asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_THROTTLE_THERMAL_POLICY_VIVO))
+		asus->throttle_thermal_policy_dev = ASUS_WMI_DEVID_THROTTLE_THERMAL_POLICY_VIVO;
+
 	err = fan_boost_mode_check_present(asus);
 	if (err)
 		goto fail_fan_boost_mode;
 
-	err = throttle_thermal_policy_check_present(asus);
-	if (err)
-		goto fail_throttle_thermal_policy;
-	else
-		throttle_thermal_policy_set_default(asus);
-
 	err = platform_profile_setup(asus);
 	if (err)
 		goto fail_platform_profile_setup;
@@ -4604,7 +4616,6 @@
 fail_input:
 	asus_wmi_sysfs_exit(asus->platform_device);
 fail_sysfs:
-fail_throttle_thermal_policy:
 fail_custom_fan_curve:
 fail_platform_profile_setup:
 	if (asus->platform_profile_support)
--- linux-qcom-6.8.0.orig/drivers/platform/x86/asus-wmi.h
+++ linux-qcom-6.8.0/drivers/platform/x86/asus-wmi.h
@@ -40,6 +40,7 @@
 	bool wmi_force_als_set;
 	bool wmi_ignore_fan;
 	bool filter_i8042_e1_extended_codes;
+	bool ignore_key_wlan;
 	enum asus_wmi_tablet_switch_mode tablet_switch_mode;
 	int wapf;
 	/*
--- linux-qcom-6.8.0.orig/drivers/platform/x86/dell/Makefile
+++ linux-qcom-6.8.0/drivers/platform/x86/dell/Makefile
@@ -14,6 +14,7 @@
 dell-smbios-$(CONFIG_DELL_SMBIOS_WMI)	+= dell-smbios-wmi.o
 dell-smbios-$(CONFIG_DELL_SMBIOS_SMM)	+= dell-smbios-smm.o
 obj-$(CONFIG_DELL_SMO8800)		+= dell-smo8800.o
+obj-$(CONFIG_DELL_UART_BACKLIGHT)	+= dell-uart-backlight.o
 obj-$(CONFIG_DELL_WMI)			+= dell-wmi.o
 dell-wmi-objs				:= dell-wmi-base.o
 dell-wmi-$(CONFIG_DELL_WMI_PRIVACY)	+= dell-wmi-privacy.o
--- linux-qcom-6.8.0.orig/drivers/platform/x86/dell/dell-smbios-base.c
+++ linux-qcom-6.8.0/drivers/platform/x86/dell/dell-smbios-base.c
@@ -11,6 +11,7 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/container_of.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/capability.h>
@@ -25,11 +26,16 @@
 static int da_num_tokens;
 static struct platform_device *platform_device;
 static struct calling_interface_token *da_tokens;
-static struct device_attribute *token_location_attrs;
-static struct device_attribute *token_value_attrs;
+static struct token_sysfs_data *token_entries;
 static struct attribute **token_attrs;
 static DEFINE_MUTEX(smbios_mutex);
 
+struct token_sysfs_data {
+	struct device_attribute location_attr;
+	struct device_attribute value_attr;
+	struct calling_interface_token *token;
+};
+
 struct smbios_device {
 	struct list_head list;
 	struct device *device;
@@ -416,47 +422,26 @@
 	}
 }
 
-static int match_attribute(struct device *dev,
-			   struct device_attribute *attr)
-{
-	int i;
-
-	for (i = 0; i < da_num_tokens * 2; i++) {
-		if (!token_attrs[i])
-			continue;
-		if (strcmp(token_attrs[i]->name, attr->attr.name) == 0)
-			return i/2;
-	}
-	dev_dbg(dev, "couldn't match: %s\n", attr->attr.name);
-	return -EINVAL;
-}
-
 static ssize_t location_show(struct device *dev,
 			     struct device_attribute *attr, char *buf)
 {
-	int i;
+	struct token_sysfs_data *data = container_of(attr, struct token_sysfs_data, location_attr);
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
-	i = match_attribute(dev, attr);
-	if (i > 0)
-		return sysfs_emit(buf, "%08x", da_tokens[i].location);
-	return 0;
+	return sysfs_emit(buf, "%08x", data->token->location);
 }
 
 static ssize_t value_show(struct device *dev,
 			  struct device_attribute *attr, char *buf)
 {
-	int i;
+	struct token_sysfs_data *data = container_of(attr, struct token_sysfs_data, value_attr);
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
-	i = match_attribute(dev, attr);
-	if (i > 0)
-		return sysfs_emit(buf, "%08x", da_tokens[i].value);
-	return 0;
+	return sysfs_emit(buf, "%08x", data->token->value);
 }
 
 static struct attribute_group smbios_attribute_group = {
@@ -473,22 +458,15 @@
 {
 	char *location_name;
 	char *value_name;
-	size_t size;
 	int ret;
 	int i, j;
 
-	/* (number of tokens  + 1 for null terminated */
-	size = sizeof(struct device_attribute) * (da_num_tokens + 1);
-	token_location_attrs = kzalloc(size, GFP_KERNEL);
-	if (!token_location_attrs)
+	token_entries = kcalloc(da_num_tokens, sizeof(*token_entries), GFP_KERNEL);
+	if (!token_entries)
 		return -ENOMEM;
-	token_value_attrs = kzalloc(size, GFP_KERNEL);
-	if (!token_value_attrs)
-		goto out_allocate_value;
 
 	/* need to store both location and value + terminator*/
-	size = sizeof(struct attribute *) * ((2 * da_num_tokens) + 1);
-	token_attrs = kzalloc(size, GFP_KERNEL);
+	token_attrs = kcalloc((2 * da_num_tokens) + 1, sizeof(*token_attrs), GFP_KERNEL);
 	if (!token_attrs)
 		goto out_allocate_attrs;
 
@@ -496,27 +474,32 @@
 		/* skip empty */
 		if (da_tokens[i].tokenID == 0)
 			continue;
+
+		token_entries[i].token = &da_tokens[i];
+
 		/* add location */
 		location_name = kasprintf(GFP_KERNEL, "%04x_location",
 					  da_tokens[i].tokenID);
 		if (location_name == NULL)
 			goto out_unwind_strings;
-		sysfs_attr_init(&token_location_attrs[i].attr);
-		token_location_attrs[i].attr.name = location_name;
-		token_location_attrs[i].attr.mode = 0444;
-		token_location_attrs[i].show = location_show;
-		token_attrs[j++] = &token_location_attrs[i].attr;
+
+		sysfs_attr_init(&token_entries[i].location_attr.attr);
+		token_entries[i].location_attr.attr.name = location_name;
+		token_entries[i].location_attr.attr.mode = 0444;
+		token_entries[i].location_attr.show = location_show;
+		token_attrs[j++] = &token_entries[i].location_attr.attr;
 
 		/* add value */
 		value_name = kasprintf(GFP_KERNEL, "%04x_value",
 				       da_tokens[i].tokenID);
 		if (value_name == NULL)
 			goto loop_fail_create_value;
-		sysfs_attr_init(&token_value_attrs[i].attr);
-		token_value_attrs[i].attr.name = value_name;
-		token_value_attrs[i].attr.mode = 0444;
-		token_value_attrs[i].show = value_show;
-		token_attrs[j++] = &token_value_attrs[i].attr;
+
+		sysfs_attr_init(&token_entries[i].value_attr.attr);
+		token_entries[i].value_attr.attr.name = value_name;
+		token_entries[i].value_attr.attr.mode = 0444;
+		token_entries[i].value_attr.show = value_show;
+		token_attrs[j++] = &token_entries[i].value_attr.attr;
 		continue;
 
 loop_fail_create_value:
@@ -532,14 +515,12 @@
 
 out_unwind_strings:
 	while (i--) {
-		kfree(token_location_attrs[i].attr.name);
-		kfree(token_value_attrs[i].attr.name);
+		kfree(token_entries[i].location_attr.attr.name);
+		kfree(token_entries[i].value_attr.attr.name);
 	}
 	kfree(token_attrs);
 out_allocate_attrs:
-	kfree(token_value_attrs);
-out_allocate_value:
-	kfree(token_location_attrs);
+	kfree(token_entries);
 
 	return -ENOMEM;
 }
@@ -551,12 +532,11 @@
 	sysfs_remove_group(&pdev->dev.kobj,
 				&smbios_attribute_group);
 	for (i = 0; i < da_num_tokens; i++) {
-		kfree(token_location_attrs[i].attr.name);
-		kfree(token_value_attrs[i].attr.name);
+		kfree(token_entries[i].location_attr.attr.name);
+		kfree(token_entries[i].value_attr.attr.name);
 	}
 	kfree(token_attrs);
-	kfree(token_value_attrs);
-	kfree(token_location_attrs);
+	kfree(token_entries);
 }
 
 static int __init dell_smbios_init(void)
@@ -564,6 +544,7 @@
 	int ret, wmi, smm;
 
 	if (!dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Dell System", NULL) &&
+	    !dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Alienware", NULL) &&
 	    !dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "www.dell.com", NULL)) {
 		pr_err("Unable to run on non-Dell system\n");
 		return -ENODEV;
@@ -610,7 +591,10 @@
 	return 0;
 
 fail_sysfs:
-	free_group(platform_device);
+	if (!wmi)
+		exit_dell_smbios_wmi();
+	if (!smm)
+		exit_dell_smbios_smm();
 
 fail_create_group:
 	platform_device_del(platform_device);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/dell/dell-uart-backlight.c
+++ linux-qcom-6.8.0/drivers/platform/x86/dell/dell-uart-backlight.c
@@ -0,0 +1,526 @@
+/*
+ *  Dell AIO Serial Backlight Driver
+ *
+ *  Copyright (C) 2017 AceLan Kao <acelan.kao@canonical.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/acpi.h>
+#include <linux/serial_8250.h>
+#include <linux/delay.h>
+#include <linux/backlight.h>
+#include <linux/dmi.h>
+#include <acpi/video.h>
+
+#include "dell-uart-backlight.h"
+
+struct dell_uart_backlight {
+	struct device *dev;
+	struct backlight_device *dell_uart_bd;
+	struct mutex brightness_mutex;
+	int line;
+	int bl_power;
+};
+struct uart_8250_port *serial8250_get_port(int line);
+static struct tty_struct *tty;
+static struct file *ftty;
+
+unsigned int (*io_serial_in)(struct uart_port *p, int offset);
+int (*uart_write)(struct tty_struct *tty, const unsigned char *buf, int count);
+void (*uart_flush_chars)(struct tty_struct *tty);
+
+
+static bool force;
+module_param(force, bool, 0444);
+MODULE_PARM_DESC(force, "load the driver regardless of the scalar status");
+
+static struct dell_uart_bl_cmd uart_cmd[] = {
+	/*
+	 * Get Firmware Version: Tool uses this command to get firmware version.
+	 * Command: 0x6A 0x06 0x8F (Length:3 Type: 0x0A, Cmd:6 Checksum:0x8F)
+	 * Return data: 0x0D 0x06 Data checksum (Length:13,Cmd:0x06,
+	 *              Data :F/W version(APRILIA=APR27-VXXX,PHINE=PHI23-VXXX),
+	 *              checksum:SUM(Length and Cmd and Data)xor 0xFF .
+	 */
+	[DELL_UART_GET_FIRMWARE_VER] = {
+		.cmd	= {0x6A, 0x06, 0x8F},
+		.tx_len	= 3,
+	},
+	/*
+	 * Get Brightness level: Application uses this command for scaler to
+	 *                       get brightness.
+	 * Command: 0x6A 0x0C 0x89
+	 *          (Length:3 Type: 0x0A, Cmd:0x0C, Checksum:0x89)
+	 * Return data: 0x04 0x0C Data checksum
+	 * (Length:4 Cmd: 0x0C Data: brightness level
+	 *           checksum: SUM(Length and Cmd and Data)xor 0xFF)
+	 *           brightness level which ranges from 0~100.
+	 */
+	[DELL_UART_GET_BRIGHTNESS] = {
+		.cmd	= {0x6A, 0x0C, 0x89},
+		.ret	= {0x04, 0x0C, 0x00, 0x00},
+		.tx_len	= 3,
+		.rx_len	= 4,
+	},
+	/* Set Brightness level: Application uses this command for scaler to
+	 *                       set brightness.
+	 * Command: 0x8A 0x0B Byte2 Checksum (Length:4 Type: 0x0A, Cmd:0x0B)
+	 *          where Byte2 is the brightness level which ranges from 0~100.
+	 * Return data: 0x03 0x0B 0xF1(Length:3,Cmd:B,checksum:0xF1)
+	 * Scaler must send the 3bytes ack within 1 second when success,
+	 * other value if error
+	 */
+	[DELL_UART_SET_BRIGHTNESS] = {
+		.cmd	= {0x8A, 0x0B, 0x0, 0x0},
+		.ret	= {0x03, 0x0B, 0xF1},
+		.tx_len	= 4,
+		.rx_len	= 3,
+	},
+	/*
+	 * Screen ON/OFF Control: Application uses this command to control
+	 *                        screen ON or OFF.
+	 * Command: 0x8A 0x0E Byte2 Checksum (Length:4 Type: 0x0A, Cmd:0x0E)
+	 *          where
+	 *          Byte2=0 to turn OFF the screen.
+	 *          Byte2=1 to turn ON the screen
+	 *          Other value of Byte2 is reserved and invalid.
+	 * Return data: 0x03 0x0E 0xEE(Length:3,Cmd:E,checksum:0xEE)
+	 */
+	[DELL_UART_SET_BACKLIGHT_POWER] = {
+		.cmd	= {0x8A, 0x0E, 0x00, 0x0},
+		.ret	= {0x03, 0x0E, 0xEE},
+		.tx_len	= 4,
+		.rx_len	= 3,
+	},
+	/*
+	 * Get display mode: Application uses this command to get scaler
+	 * 		     display mode.
+	 * Command: 0x6A 0x10 0x85 (Length:3 Type: 0x0A, Cmd:0x10)
+	 * Return data: 0x04 0x10 Data checksum
+	 * 		(Length:4 Cmd:0x10 Data: mode checksum: SUM
+	 *		mode =0 if PC mode
+	 *		mode =1 if AV(HDMI) mode
+	 */
+	[DELL_UART_GET_DISPLAY_MODE] = {
+		.cmd	= {0x6A, 0x10, 0x85},
+		.ret	= {0x04, 0x10, 0x00, 0x00},
+		.tx_len	= 3,
+		.rx_len	= 4,
+	},
+};
+
+static const struct dmi_system_id dell_uart_backlight_alpha_platform[] = {
+	{
+		.ident = "Dell Inspiron 7777 AIO",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7777 AIO"),
+		},
+	},
+	{
+		.ident = "Dell Inspiron 5477 AIO",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5477 AIO"),
+		},
+	},
+	{
+		.ident = "Dell OptiPlex 7769 AIO",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7769 AIO"),
+		},
+	},
+	{
+		.ident = "Dell OptiPlex 5260 AIO",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 5260 AIO"),
+		},
+	},
+	{ }
+};
+
+static int dell_uart_write(struct uart_8250_port *up, __u8 *buf, int len)
+{
+	int actual = 0;
+	struct uart_port *port = &up->port;
+
+	tty_port_tty_wakeup(&port->state->port);
+	tty = tty_port_tty_get(&port->state->port);
+	actual = uart_write(tty, buf, len);
+	uart_flush_chars(tty);
+
+	return actual;
+}
+
+static int dell_uart_read(struct uart_8250_port *up, __u8 *buf, int len)
+{
+	int i, retry;
+	unsigned long flags;
+
+	spin_lock_irqsave(&up->port.lock, flags);
+	for (i = 0; i < len; i++) {
+		retry = 10;
+		while (!(io_serial_in(&up->port, UART_LSR) & UART_LSR_DR)) {
+			if (--retry == 0)
+				break;
+			mdelay(20);
+		}
+
+		if (retry == 0)
+			break;
+		buf[i] = io_serial_in(&up->port, UART_RX);
+	}
+	spin_unlock_irqrestore(&up->port.lock, flags);
+
+	return i;
+}
+
+static void dell_uart_dump_cmd(const char *func, const char *prefix,
+			       const char *cmd, int len)
+{
+	char buf[80];
+
+	snprintf(buf, 80, "dell_uart_backlight:%s:%s", func, prefix);
+	if (len != 0)
+		print_hex_dump_debug(buf, DUMP_PREFIX_NONE,
+					16, 1, cmd, len, false);
+	else
+		pr_debug("dell_uart_backlight:%s:%sNULL\n", func, prefix);
+
+}
+
+/*
+ * checksum: SUM(Length and Cmd and Data)xor 0xFF)
+ */
+static unsigned char dell_uart_checksum(unsigned char *buf, int len)
+{
+	unsigned char val = 0;
+
+	while (len-- > 0)
+		val += buf[len];
+
+	return val ^ 0xff;
+}
+
+/*
+ * There is no command to get backlight power status,
+ * so we set the backlight power to "on" while initializing,
+ * and then track and report its status by bl_power variable
+ */
+static inline int dell_uart_get_bl_power(struct dell_uart_backlight *dell_pdata)
+{
+	return dell_pdata->bl_power;
+}
+
+static int dell_uart_set_bl_power(struct backlight_device *bd, int power)
+{
+	struct dell_uart_bl_cmd *bl_cmd =
+		&uart_cmd[DELL_UART_SET_BACKLIGHT_POWER];
+	struct dell_uart_backlight *dell_pdata = bl_get_data(bd);
+	struct uart_8250_port *uart = serial8250_get_port(dell_pdata->line);
+	int rx_len;
+
+	if (power != FB_BLANK_POWERDOWN)
+		power = FB_BLANK_UNBLANK;
+
+	bl_cmd->cmd[2] = power ? 0 : 1;
+	bl_cmd->cmd[3] = dell_uart_checksum(bl_cmd->cmd, bl_cmd->tx_len - 1);
+
+	dell_uart_dump_cmd(__func__, "tx: ", bl_cmd->cmd, bl_cmd->tx_len);
+
+	if (mutex_lock_killable(&dell_pdata->brightness_mutex) < 0) {
+		pr_debug("Failed to get mutex_lock");
+		return 0;
+	}
+
+	dell_uart_write(uart, bl_cmd->cmd, bl_cmd->tx_len);
+	rx_len = dell_uart_read(uart, bl_cmd->ret, bl_cmd->rx_len);
+
+	mutex_unlock(&dell_pdata->brightness_mutex);
+
+	dell_uart_dump_cmd(__func__, "rx: ", bl_cmd->ret, rx_len);
+
+	bd->props.power = power;
+	dell_pdata->bl_power = power;
+
+	return 0;
+}
+
+static int dell_uart_get_brightness(struct backlight_device *bd)
+{
+	struct dell_uart_bl_cmd *bl_cmd = &uart_cmd[DELL_UART_GET_BRIGHTNESS];
+	struct dell_uart_backlight *dell_pdata = bl_get_data(bd);
+	struct uart_8250_port *uart = serial8250_get_port(dell_pdata->line);
+	int rx_len, brightness = 0;
+
+	dell_uart_dump_cmd(__func__, "tx: ", bl_cmd->cmd, bl_cmd->tx_len);
+
+	if (mutex_lock_killable(&dell_pdata->brightness_mutex) < 0) {
+		pr_debug("Failed to get mutex_lock");
+		return 0;
+	}
+
+	dell_uart_write(uart, bl_cmd->cmd, bl_cmd->tx_len);
+	rx_len = dell_uart_read(uart, bl_cmd->ret, bl_cmd->rx_len);
+
+	mutex_unlock(&dell_pdata->brightness_mutex);
+
+	dell_uart_dump_cmd(__func__, "rx: ", bl_cmd->ret, rx_len);
+
+	brightness = (unsigned int)bl_cmd->ret[2];
+
+	return brightness;
+}
+
+static int dell_uart_update_status(struct backlight_device *bd)
+{
+	struct dell_uart_bl_cmd *bl_cmd = &uart_cmd[DELL_UART_SET_BRIGHTNESS];
+	struct dell_uart_backlight *dell_pdata = bl_get_data(bd);
+	struct uart_8250_port *uart = serial8250_get_port(dell_pdata->line);
+	int rx_len;
+
+	bl_cmd->cmd[2] = bd->props.brightness;
+	bl_cmd->cmd[3] = dell_uart_checksum(bl_cmd->cmd, bl_cmd->tx_len - 1);
+
+	dell_uart_dump_cmd(__func__, "tx: ", bl_cmd->cmd, bl_cmd->tx_len);
+
+	if (mutex_lock_killable(&dell_pdata->brightness_mutex) < 0) {
+		pr_debug("Failed to get mutex_lock");
+		return 0;
+	}
+
+	dell_uart_write(uart, bl_cmd->cmd, bl_cmd->tx_len);
+	rx_len = dell_uart_read(uart, bl_cmd->ret, bl_cmd->rx_len);
+
+	mutex_unlock(&dell_pdata->brightness_mutex);
+
+	dell_uart_dump_cmd(__func__, "rx: ", bl_cmd->ret, rx_len);
+
+	if (bd->props.power != dell_uart_get_bl_power(dell_pdata))
+		dell_uart_set_bl_power(bd, bd->props.power);
+
+	return 0;
+}
+
+static int dell_uart_show_firmware_ver(struct dell_uart_backlight *dell_pdata)
+{
+	struct dell_uart_bl_cmd *bl_cmd = &uart_cmd[DELL_UART_GET_FIRMWARE_VER];
+	struct uart_8250_port *uart = serial8250_get_port(dell_pdata->line);
+	int rx_len = 0, retry = 10;
+
+	dell_uart_dump_cmd(__func__, "tx: ", bl_cmd->cmd, bl_cmd->tx_len);
+
+	if (mutex_lock_killable(&dell_pdata->brightness_mutex) < 0) {
+		pr_debug("Failed to get mutex_lock");
+		return -1;
+	}
+
+	dell_uart_write(uart, bl_cmd->cmd, bl_cmd->tx_len);
+	while (retry-- > 0) {
+		/* first byte is data length */
+		dell_uart_read(uart, bl_cmd->ret, 1);
+		rx_len = (int)bl_cmd->ret[0];
+		if (bl_cmd->ret[0] > 80 || bl_cmd->ret[0] == 0) {
+			pr_debug("Failed to get firmware version\n");
+			if (retry == 0) {
+				mutex_unlock(&dell_pdata->brightness_mutex);
+				return -1;
+			}
+			msleep(100);
+			continue;
+		}
+
+		dell_uart_read(uart, bl_cmd->ret+1, rx_len-1);
+		break;
+	}
+	mutex_unlock(&dell_pdata->brightness_mutex);
+
+	dell_uart_dump_cmd(__func__, "rx: ", bl_cmd->ret, rx_len);
+
+	pr_debug("Firmare str(%d)= %s\n", (int)bl_cmd->ret[0], bl_cmd->ret+2);
+	return rx_len;
+}
+
+static int dell_uart_get_display_mode(struct dell_uart_backlight *dell_pdata)
+{
+	struct dell_uart_bl_cmd *bl_cmd = &uart_cmd[DELL_UART_GET_DISPLAY_MODE];
+	struct uart_8250_port *uart = serial8250_get_port(dell_pdata->line);
+	int rx_len;
+	int status = 0, retry = 10;
+
+	do {
+		dell_uart_dump_cmd(__func__, "tx: ", bl_cmd->cmd, bl_cmd->tx_len);
+
+		if (mutex_lock_killable(&dell_pdata->brightness_mutex) < 0) {
+			pr_debug("Failed to get mutex_lock");
+			return 0;
+		}
+
+		dell_uart_write(uart, bl_cmd->cmd, bl_cmd->tx_len);
+		rx_len = dell_uart_read(uart, bl_cmd->ret, bl_cmd->rx_len);
+
+		mutex_unlock(&dell_pdata->brightness_mutex);
+
+		dell_uart_dump_cmd(__func__, "rx: ", bl_cmd->ret, rx_len);
+		mdelay(1000);
+	} while (rx_len == 0 && --retry);
+
+	if (rx_len == 4)
+		status = ((unsigned int)bl_cmd->ret[2] == PC_MODE);
+
+	return status;
+}
+
+static const struct backlight_ops dell_uart_backlight_ops = {
+	.get_brightness = dell_uart_get_brightness,
+	.update_status = dell_uart_update_status,
+};
+
+static int dell_uart_startup(struct dell_uart_backlight *dell_pdata)
+{
+	struct uart_8250_port *uartp;
+	struct uart_port *port;
+
+	dell_pdata->line = 0;
+	uartp = serial8250_get_port(dell_pdata->line);
+	port = &uartp->port;
+	tty = port->state->port.tty;
+	io_serial_in = port->serial_in;
+	uart_write = tty->driver->ops->write;
+	uart_flush_chars = tty->driver->ops->flush_chars;
+
+	return 0;
+}
+
+static int dell_uart_bl_add(struct acpi_device *dev)
+{
+	struct dell_uart_backlight *dell_pdata;
+	struct backlight_properties props;
+	struct backlight_device *dell_uart_bd;
+
+	dell_pdata = kzalloc(sizeof(struct dell_uart_backlight), GFP_KERNEL);
+	if (!dell_pdata) {
+		pr_debug("Failed to allocate memory for dell_uart_backlight\n");
+		return -ENOMEM;
+	}
+	dell_pdata->dev = &dev->dev;
+	dell_uart_startup(dell_pdata);
+	dev->driver_data = dell_pdata;
+
+	mutex_init(&dell_pdata->brightness_mutex);
+
+	if (!force) {
+		if (dmi_check_system(dell_uart_backlight_alpha_platform)) {
+			/* try another command to make sure there is no scalar IC */
+			if (dell_uart_show_firmware_ver(dell_pdata) <= 4) {
+				pr_debug("Scalar is not in charge of brightness adjustment.\n");
+				kfree_sensitive(dell_pdata);
+				return -ENODEV;
+			}
+		}
+		else if (!dell_uart_get_display_mode(dell_pdata)) {
+			pr_debug("Scalar is not in charge of brightness adjustment.\n");
+			kfree_sensitive(dell_pdata);
+			return -ENODEV;
+		}
+	}
+
+	memset(&props, 0, sizeof(struct backlight_properties));
+	props.type = BACKLIGHT_PLATFORM;
+	props.max_brightness = 100;
+
+	dell_uart_bd = backlight_device_register("dell_uart_backlight",
+						 &dev->dev,
+						 dell_pdata,
+						 &dell_uart_backlight_ops,
+						 &props);
+	if (IS_ERR(dell_uart_bd)) {
+		kfree_sensitive(dell_pdata);
+		pr_debug("Backlight registration failed\n");
+		return PTR_ERR(dell_uart_bd);
+	}
+
+	dell_pdata->dell_uart_bd = dell_uart_bd;
+
+	dell_uart_set_bl_power(dell_uart_bd, FB_BLANK_UNBLANK);
+	dell_uart_bd->props.brightness = 100;
+	backlight_update_status(dell_uart_bd);
+
+	return 0;
+}
+
+static void dell_uart_bl_remove(struct acpi_device *dev)
+{
+	struct dell_uart_backlight *dell_pdata = dev->driver_data;
+
+	backlight_device_unregister(dell_pdata->dell_uart_bd);
+	kfree_sensitive(dell_pdata);
+}
+
+static int dell_uart_bl_suspend(struct device *dev)
+{
+	filp_close(ftty, NULL);
+	return 0;
+}
+
+static int dell_uart_bl_resume(struct device *dev)
+{
+	ftty = filp_open("/dev/ttyS0", O_RDWR | O_NOCTTY | O_NDELAY, 0);
+	return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(dell_uart_bl_pm, dell_uart_bl_suspend, dell_uart_bl_resume);
+
+static const struct acpi_device_id dell_uart_bl_ids[] = {
+	{"DELL0501", 0},
+	{"", 0},
+};
+
+static struct acpi_driver dell_uart_backlight_driver = {
+	.name = "Dell AIO serial backlight",
+	.ids = dell_uart_bl_ids,
+	.ops = {
+		.add = dell_uart_bl_add,
+		.remove = dell_uart_bl_remove,
+	},
+	.drv.pm = &dell_uart_bl_pm,
+};
+
+static int __init dell_uart_bl_init(void)
+{
+	ftty = filp_open("/dev/ttyS0", O_RDWR | O_NOCTTY | O_NDELAY, 0);
+	if (IS_ERR(ftty)) {
+		pr_debug("cannot open /dev/ttyS0\n");
+		return -EINVAL;
+	}
+
+	return acpi_bus_register_driver(&dell_uart_backlight_driver);
+}
+
+static void __exit dell_uart_bl_exit(void)
+{
+	filp_close(ftty, NULL);
+
+	acpi_bus_unregister_driver(&dell_uart_backlight_driver);
+}
+
+module_init(dell_uart_bl_init);
+module_exit(dell_uart_bl_exit);
+MODULE_DEVICE_TABLE(acpi, dell_uart_bl_ids);
+MODULE_DESCRIPTION("Dell AIO Serial Backlight module");
+MODULE_AUTHOR("AceLan Kao <acelan.kao@canonical.com>");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/platform/x86/dell/dell-uart-backlight.h
+++ linux-qcom-6.8.0/drivers/platform/x86/dell/dell-uart-backlight.h
@@ -0,0 +1,41 @@
+/*
+ *  Dell AIO Serial Backlight Driver
+ *
+ *  Copyright (C) 2017 AceLan Kao <acelan.kao@canonical.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _DELL_UART_BACKLIGHT_H_
+#define _DELL_UART_BACKLIGHT_H_
+
+enum {
+	DELL_UART_GET_FIRMWARE_VER,
+	DELL_UART_GET_BRIGHTNESS,
+	DELL_UART_SET_BRIGHTNESS,
+	DELL_UART_SET_BACKLIGHT_POWER,
+	DELL_UART_GET_DISPLAY_MODE,
+};
+
+enum {
+	PC_MODE,
+	AV_MODE,
+};
+
+struct dell_uart_bl_cmd {
+	unsigned char	cmd[10];
+	unsigned char	ret[80];
+	unsigned short	tx_len;
+	unsigned short	rx_len;
+};
+
+#endif /* _DELL_UART_BACKLIGHT_H_ */
--- linux-qcom-6.8.0.orig/drivers/platform/x86/dell/dell-wmi-base.c
+++ linux-qcom-6.8.0/drivers/platform/x86/dell/dell-wmi-base.c
@@ -80,6 +80,12 @@
 static const struct key_entry dell_wmi_keymap_type_0000[] = {
 	{ KE_IGNORE, 0x003a, { KEY_CAPSLOCK } },
 
+	/* Meta key lock */
+	{ KE_IGNORE, 0xe000, { KEY_RIGHTMETA } },
+
+	/* Meta key unlock */
+	{ KE_IGNORE, 0xe001, { KEY_RIGHTMETA } },
+
 	/* Key code is followed by brightness level */
 	{ KE_KEY,    0xe005, { KEY_BRIGHTNESSDOWN } },
 	{ KE_KEY,    0xe006, { KEY_BRIGHTNESSUP } },
@@ -264,6 +270,15 @@
 	/*Speaker Mute*/
 	{ KE_KEY, 0x109, { KEY_MUTE} },
 
+	/* S2Idle screen off */
+	{ KE_IGNORE, 0x120, { KEY_RESERVED }},
+
+	/* Leaving S4 or S2Idle suspend */
+	{ KE_IGNORE, 0x130, { KEY_RESERVED }},
+
+	/* Entering S2Idle suspend */
+	{ KE_IGNORE, 0x140, { KEY_RESERVED }},
+
 	/* Mic mute */
 	{ KE_KEY, 0x150, { KEY_MICMUTE } },
 
--- linux-qcom-6.8.0.orig/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c
+++ linux-qcom-6.8.0/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c
@@ -521,6 +521,7 @@
 	int ret = 0;
 
 	if (!dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Dell System", NULL) &&
+	    !dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Alienware", NULL) &&
 	    !dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "www.dell.com", NULL)) {
 		pr_err("Unable to run on non-Dell system\n");
 		return -ENODEV;
--- linux-qcom-6.8.0.orig/drivers/platform/x86/hp/Kconfig
+++ linux-qcom-6.8.0/drivers/platform/x86/hp/Kconfig
@@ -40,6 +40,7 @@
 	depends on ACPI_WMI
 	depends on INPUT
 	depends on RFKILL || RFKILL = n
+	select POWER_SUPPLY
 	select INPUT_SPARSEKMAP
 	select ACPI_PLATFORM_PROFILE
 	select HWMON
--- linux-qcom-6.8.0.orig/drivers/platform/x86/hp/hp-wmi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/hp/hp-wmi.c
@@ -24,6 +24,9 @@
 #include <linux/platform_profile.h>
 #include <linux/hwmon.h>
 #include <linux/acpi.h>
+#include <linux/mutex.h>
+#include <linux/cleanup.h>
+#include <linux/power_supply.h>
 #include <linux/rfkill.h>
 #include <linux/string.h>
 #include <linux/dmi.h>
@@ -37,7 +40,13 @@
 
 #define HPWMI_EVENT_GUID "95F24279-4D7B-4334-9387-ACCDC67EF61C"
 #define HPWMI_BIOS_GUID "5FB7F034-2C63-45e9-BE91-3D44E2C707E4"
+
+#define HP_OMEN_EC_THERMAL_PROFILE_FLAGS_OFFSET 0x62
+#define HP_OMEN_EC_THERMAL_PROFILE_TIMER_OFFSET 0x63
 #define HP_OMEN_EC_THERMAL_PROFILE_OFFSET 0x95
+
+#define ACPI_AC_CLASS "ac_adapter"
+
 #define zero_if_sup(tmp) (zero_insize_support?0:sizeof(tmp)) // use when zero insize is required
 
 /* DMI board names of devices that should use the omen specific path for
@@ -55,7 +64,7 @@
 	"874A", "8603", "8604", "8748", "886B", "886C", "878A", "878B", "878C",
 	"88C8", "88CB", "8786", "8787", "8788", "88D1", "88D2", "88F4", "88FD",
 	"88F5", "88F6", "88F7", "88FE", "88FF", "8900", "8901", "8902", "8912",
-	"8917", "8918", "8949", "894A", "89EB"
+	"8917", "8918", "8949", "894A", "89EB", "8BAD", "8A42", "8A15"
 };
 
 /* DMI Board names of Omen laptops that are specifically set to be thermal
@@ -66,6 +75,14 @@
 	"8607", "8746", "8747", "8749", "874A", "8748"
 };
 
+/* DMI board names of Omen laptops that have a thermal profile timer which will
+ * cause the embedded controller to set the thermal profile back to
+ * "balanced" when reaching zero.
+ */
+static const char * const omen_timed_thermal_profile_boards[] = {
+	"8BAD", "8A42", "8A15"
+};
+
 /* DMI Board names of Victus laptops */
 static const char * const victus_thermal_profile_boards[] = {
 	"8A25"
@@ -182,6 +199,12 @@
 	HP_OMEN_V1_THERMAL_PROFILE_COOL		= 0x50,
 };
 
+enum hp_thermal_profile_omen_flags {
+	HP_OMEN_EC_FLAGS_TURBO		= 0x04,
+	HP_OMEN_EC_FLAGS_NOTIMER	= 0x02,
+	HP_OMEN_EC_FLAGS_JUSTSET	= 0x01,
+};
+
 enum hp_thermal_profile_victus {
 	HP_VICTUS_THERMAL_PROFILE_DEFAULT		= 0x00,
 	HP_VICTUS_THERMAL_PROFILE_PERFORMANCE		= 0x01,
@@ -241,10 +264,18 @@
 	{ KE_END, 0 }
 };
 
+/*
+ * Mutex for the active_platform_profile variable,
+ * see omen_powersource_event.
+ */
+static DEFINE_MUTEX(active_platform_profile_lock);
+
 static struct input_dev *hp_wmi_input_dev;
 static struct input_dev *camera_shutter_input_dev;
 static struct platform_device *hp_wmi_platform_dev;
 static struct platform_profile_handler platform_profile_handler;
+static struct notifier_block platform_power_source_nb;
+static enum platform_profile_option active_platform_profile;
 static bool platform_profile_support;
 static bool zero_insize_support;
 
@@ -449,7 +480,11 @@
 
 static int omen_thermal_profile_set(int mode)
 {
-	char buffer[2] = {0, mode};
+	/* The Omen Control Center actively sets the first byte of the buffer to
+	 * 255, so let's mimic this behaviour to be as close as possible to
+	 * the original software.
+	 */
+	char buffer[2] = {-1, mode};
 	int ret;
 
 	ret = hp_wmi_perform_query(HPWMI_SET_PERFORMANCE_MODE, HPWMI_GM,
@@ -1172,8 +1207,7 @@
 	return err;
 }
 
-static int platform_profile_omen_get(struct platform_profile_handler *pprof,
-				     enum platform_profile_option *profile)
+static int platform_profile_omen_get_ec(enum platform_profile_option *profile)
 {
 	int tp;
 
@@ -1201,10 +1235,53 @@
 	return 0;
 }
 
-static int platform_profile_omen_set(struct platform_profile_handler *pprof,
-				     enum platform_profile_option profile)
+static int platform_profile_omen_get(struct platform_profile_handler *pprof,
+				     enum platform_profile_option *profile)
+{
+	/*
+	 * We directly return the stored platform profile, as the embedded
+	 * controller will not accept switching to the performance option when
+	 * the conditions are not met (e.g. the laptop is not plugged in).
+	 *
+	 * If we directly return what the EC reports, the platform profile will
+	 * immediately "switch back" to normal mode, which is against the
+	 * expected behaviour from a userspace point of view, as described in
+	 * the Platform Profile Section page of the kernel documentation.
+	 *
+	 * See also omen_powersource_event.
+	 */
+	guard(mutex)(&active_platform_profile_lock);
+	*profile = active_platform_profile;
+
+	return 0;
+}
+
+static bool has_omen_thermal_profile_ec_timer(void)
+{
+	const char *board_name = dmi_get_system_info(DMI_BOARD_NAME);
+
+	if (!board_name)
+		return false;
+
+	return match_string(omen_timed_thermal_profile_boards,
+			    ARRAY_SIZE(omen_timed_thermal_profile_boards),
+			    board_name) >= 0;
+}
+
+inline int omen_thermal_profile_ec_flags_set(enum hp_thermal_profile_omen_flags flags)
+{
+	return ec_write(HP_OMEN_EC_THERMAL_PROFILE_FLAGS_OFFSET, flags);
+}
+
+inline int omen_thermal_profile_ec_timer_set(u8 value)
+{
+	return ec_write(HP_OMEN_EC_THERMAL_PROFILE_TIMER_OFFSET, value);
+}
+
+static int platform_profile_omen_set_ec(enum platform_profile_option profile)
 {
 	int err, tp, tp_version;
+	enum hp_thermal_profile_omen_flags flags = 0;
 
 	tp_version = omen_get_thermal_policy_version();
 
@@ -1238,6 +1315,36 @@
 	if (err < 0)
 		return err;
 
+	if (has_omen_thermal_profile_ec_timer()) {
+		err = omen_thermal_profile_ec_timer_set(0);
+		if (err < 0)
+			return err;
+
+		if (profile == PLATFORM_PROFILE_PERFORMANCE)
+			flags = HP_OMEN_EC_FLAGS_NOTIMER |
+				HP_OMEN_EC_FLAGS_TURBO;
+
+		err = omen_thermal_profile_ec_flags_set(flags);
+		if (err < 0)
+			return err;
+	}
+
+	return 0;
+}
+
+static int platform_profile_omen_set(struct platform_profile_handler *pprof,
+				     enum platform_profile_option profile)
+{
+	int err;
+
+	guard(mutex)(&active_platform_profile_lock);
+
+	err = platform_profile_omen_set_ec(profile);
+	if (err < 0)
+		return err;
+
+	active_platform_profile = profile;
+
 	return 0;
 }
 
@@ -1322,8 +1429,7 @@
 			    board_name) >= 0;
 }
 
-static int platform_profile_victus_get(struct platform_profile_handler *pprof,
-				     enum platform_profile_option *profile)
+static int platform_profile_victus_get_ec(enum platform_profile_option *profile)
 {
 	int tp;
 
@@ -1348,8 +1454,14 @@
 	return 0;
 }
 
-static int platform_profile_victus_set(struct platform_profile_handler *pprof,
-				     enum platform_profile_option profile)
+static int platform_profile_victus_get(struct platform_profile_handler *pprof,
+				       enum platform_profile_option *profile)
+{
+	/* Same behaviour as platform_profile_omen_get */
+	return platform_profile_omen_get(pprof, profile);
+}
+
+static int platform_profile_victus_set_ec(enum platform_profile_option profile)
 {
 	int err, tp;
 
@@ -1374,21 +1486,113 @@
 	return 0;
 }
 
+static int platform_profile_victus_set(struct platform_profile_handler *pprof,
+				       enum platform_profile_option profile)
+{
+	int err;
+
+	guard(mutex)(&active_platform_profile_lock);
+
+	err = platform_profile_victus_set_ec(profile);
+	if (err < 0)
+		return err;
+
+	active_platform_profile = profile;
+
+	return 0;
+}
+
+static int omen_powersource_event(struct notifier_block *nb,
+				  unsigned long value,
+				  void *data)
+{
+	struct acpi_bus_event *event_entry = data;
+	enum platform_profile_option actual_profile;
+	int err;
+
+	if (strcmp(event_entry->device_class, ACPI_AC_CLASS) != 0)
+		return NOTIFY_DONE;
+
+	pr_debug("Received power source device event\n");
+
+	guard(mutex)(&active_platform_profile_lock);
+
+	/*
+	 * This handler can only be called on Omen and Victus models, so
+	 * there's no need to call is_victus_thermal_profile() here.
+	 */
+	if (is_omen_thermal_profile())
+		err = platform_profile_omen_get_ec(&actual_profile);
+	else
+		err = platform_profile_victus_get_ec(&actual_profile);
+
+	if (err < 0) {
+		/*
+		 * Although we failed to get the current platform profile, we
+		 * still want the other event consumers to process it.
+		 */
+		pr_warn("Failed to read current platform profile (%d)\n", err);
+		return NOTIFY_DONE;
+	}
+
+	/*
+	 * If we're back on AC and that the user-chosen power profile is
+	 * different from what the EC reports, we restore the user-chosen
+	 * one.
+	 */
+	if (power_supply_is_system_supplied() <= 0 ||
+	    active_platform_profile == actual_profile) {
+		pr_debug("Platform profile update skipped, conditions unmet\n");
+		return NOTIFY_DONE;
+	}
+
+	if (is_omen_thermal_profile())
+		err = platform_profile_omen_set_ec(active_platform_profile);
+	else
+		err = platform_profile_victus_set_ec(active_platform_profile);
+
+	if (err < 0) {
+		pr_warn("Failed to restore platform profile (%d)\n", err);
+		return NOTIFY_DONE;
+	}
+
+	return NOTIFY_OK;
+}
+
+static int omen_register_powersource_event_handler(void)
+{
+	int err;
+
+	platform_power_source_nb.notifier_call = omen_powersource_event;
+	err = register_acpi_notifier(&platform_power_source_nb);
+
+	if (err < 0) {
+		pr_warn("Failed to install ACPI power source notify handler\n");
+		return err;
+	}
+
+	return 0;
+}
+
+static inline void omen_unregister_powersource_event_handler(void)
+{
+	unregister_acpi_notifier(&platform_power_source_nb);
+}
+
 static int thermal_profile_setup(void)
 {
 	int err, tp;
 
 	if (is_omen_thermal_profile()) {
-		tp = omen_thermal_profile_get();
-		if (tp < 0)
-			return tp;
+		err = platform_profile_omen_get_ec(&active_platform_profile);
+		if (err < 0)
+			return err;
 
 		/*
 		 * call thermal profile write command to ensure that the
 		 * firmware correctly sets the OEM variables
 		 */
-
-		err = omen_thermal_profile_set(tp);
+		err = platform_profile_omen_set_ec(active_platform_profile);
 		if (err < 0)
 			return err;
 
@@ -1397,15 +1601,15 @@
 
 		set_bit(PLATFORM_PROFILE_COOL, platform_profile_handler.choices);
 	} else if (is_victus_thermal_profile()) {
-		tp = omen_thermal_profile_get();
-		if (tp < 0)
-			return tp;
+		err = platform_profile_victus_get_ec(&active_platform_profile);
+		if (err < 0)
+			return err;
 
 		/*
 		 * call thermal profile write command to ensure that the
 		 * firmware correctly sets the OEM variables
 		 */
-		err = omen_thermal_profile_set(tp);
+		err = platform_profile_victus_set_ec(active_platform_profile);
 		if (err < 0)
 			return err;
 
@@ -1699,6 +1903,12 @@
 			goto err_unregister_device;
 	}
 
+	if (is_omen_thermal_profile() || is_victus_thermal_profile()) {
+		err = omen_register_powersource_event_handler();
+		if (err)
+			goto err_unregister_device;
+	}
+
 	return 0;
 
 err_unregister_device:
@@ -1713,6 +1923,9 @@
 
 static void __exit hp_wmi_exit(void)
 {
+	if (is_omen_thermal_profile() || is_victus_thermal_profile())
+		omen_unregister_powersource_event_handler();
+
 	if (wmi_has_guid(HPWMI_EVENT_GUID))
 		hp_wmi_input_destroy();
 
--- linux-qcom-6.8.0.orig/drivers/platform/x86/ideapad-laptop.c
+++ linux-qcom-6.8.0/drivers/platform/x86/ideapad-laptop.c
@@ -125,6 +125,7 @@
 
 struct ideapad_private {
 	struct acpi_device *adev;
+	struct mutex vpc_mutex; /* protects the VPC calls */
 	struct rfkill *rfk[IDEAPAD_RFKILL_DEV_NUM];
 	struct ideapad_rfk_priv rfk_priv[IDEAPAD_RFKILL_DEV_NUM];
 	struct platform_device *platform_device;
@@ -145,6 +146,7 @@
 		bool touchpad_ctrl_via_ec : 1;
 		bool ctrl_ps2_aux_port    : 1;
 		bool usb_charging         : 1;
+		bool ymc_ec_trigger       : 1;
 	} features;
 	struct {
 		bool initialized;
@@ -188,6 +190,12 @@
 	"Enable registering a 'touchpad' sysfs-attribute which can be used to manually "
 	"tell the EC to enable/disable the touchpad. This may not work on all models.");
 
+static bool ymc_ec_trigger __read_mostly;
+module_param(ymc_ec_trigger, bool, 0444);
+MODULE_PARM_DESC(ymc_ec_trigger,
+	"Enable EC triggering work-around to force emitting tablet mode events. "
+	"If you need this please report this to: platform-driver-x86@vger.kernel.org");
+
 /*
  * shared data
  */
@@ -292,6 +300,8 @@
 	struct ideapad_private *priv = s->private;
 	unsigned long value;
 
+	guard(mutex)(&priv->vpc_mutex);
+
 	if (!read_ec_data(priv->adev->handle, VPCCMD_R_BL_MAX, &value))
 		seq_printf(s, "Backlight max:  %lu\n", value);
 	if (!read_ec_data(priv->adev->handle, VPCCMD_R_BL, &value))
@@ -407,12 +417,14 @@
 				 char *buf)
 {
 	struct ideapad_private *priv = dev_get_drvdata(dev);
-	unsigned long result;
+	unsigned long result = 0;
 	int err;
 
-	err = read_ec_data(priv->adev->handle, VPCCMD_R_CAMERA, &result);
-	if (err)
-		return err;
+	scoped_guard(mutex, &priv->vpc_mutex) {
+		err = read_ec_data(priv->adev->handle, VPCCMD_R_CAMERA, &result);
+		if (err)
+			return err;
+	}
 
 	return sysfs_emit(buf, "%d\n", !!result);
 }
@@ -429,9 +441,11 @@
 	if (err)
 		return err;
 
-	err = write_ec_cmd(priv->adev->handle, VPCCMD_W_CAMERA, state);
-	if (err)
-		return err;
+	scoped_guard(mutex, &priv->vpc_mutex) {
+		err = write_ec_cmd(priv->adev->handle, VPCCMD_W_CAMERA, state);
+		if (err)
+			return err;
+	}
 
 	return count;
 }
@@ -479,12 +493,14 @@
 			     char *buf)
 {
 	struct ideapad_private *priv = dev_get_drvdata(dev);
-	unsigned long result;
+	unsigned long result = 0;
 	int err;
 
-	err = read_ec_data(priv->adev->handle, VPCCMD_R_FAN, &result);
-	if (err)
-		return err;
+	scoped_guard(mutex, &priv->vpc_mutex) {
+		err = read_ec_data(priv->adev->handle, VPCCMD_R_FAN, &result);
+		if (err)
+			return err;
+	}
 
 	return sysfs_emit(buf, "%lu\n", result);
 }
@@ -504,9 +520,11 @@
 	if (state > 4 || state == 3)
 		return -EINVAL;
 
-	err = write_ec_cmd(priv->adev->handle, VPCCMD_W_FAN, state);
-	if (err)
-		return err;
+	scoped_guard(mutex, &priv->vpc_mutex) {
+		err = write_ec_cmd(priv->adev->handle, VPCCMD_W_FAN, state);
+		if (err)
+			return err;
+	}
 
 	return count;
 }
@@ -554,12 +572,14 @@
 			     char *buf)
 {
 	struct ideapad_private *priv = dev_get_drvdata(dev);
-	unsigned long result;
+	unsigned long result = 0;
 	int err;
 
-	err = read_ec_data(priv->adev->handle, VPCCMD_R_TOUCHPAD, &result);
-	if (err)
-		return err;
+	scoped_guard(mutex, &priv->vpc_mutex) {
+		err = read_ec_data(priv->adev->handle, VPCCMD_R_TOUCHPAD, &result);
+		if (err)
+			return err;
+	}
 
 	priv->r_touchpad_val = result;
 
@@ -578,9 +598,11 @@
 	if (err)
 		return err;
 
-	err = write_ec_cmd(priv->adev->handle, VPCCMD_W_TOUCHPAD, state);
-	if (err)
-		return err;
+	scoped_guard(mutex, &priv->vpc_mutex) {
+		err = write_ec_cmd(priv->adev->handle, VPCCMD_W_TOUCHPAD, state);
+		if (err)
+			return err;
+	}
 
 	priv->r_touchpad_val = state;
 
@@ -975,6 +997,8 @@
 	struct ideapad_rfk_priv *priv = data;
 	int opcode = ideapad_rfk_data[priv->dev].opcode;
 
+	guard(mutex)(&priv->priv->vpc_mutex);
+
 	return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
 }
 
@@ -988,6 +1012,8 @@
 	int i;
 
 	if (priv->features.hw_rfkill_switch) {
+		guard(mutex)(&priv->vpc_mutex);
+
 		if (read_ec_data(priv->adev->handle, VPCCMD_R_RF, &hw_blocked))
 			return;
 		hw_blocked = !hw_blocked;
@@ -1101,6 +1127,9 @@
 	{ KE_KEY,	0x27 | IDEAPAD_WMI_KEY, { KEY_HELP } },
 	/* Refresh Rate Toggle */
 	{ KE_KEY,	0x0a | IDEAPAD_WMI_KEY, { KEY_DISPLAYTOGGLE } },
+	/* Specific to some newer models */
+	{ KE_KEY,	0x3e | IDEAPAD_WMI_KEY, { KEY_MICMUTE } },
+	{ KE_KEY,	0x3f | IDEAPAD_WMI_KEY, { KEY_RFKILL } },
 
 	{ KE_END },
 };
@@ -1159,8 +1188,9 @@
 {
 	unsigned long long_pressed;
 
-	if (read_ec_data(priv->adev->handle, VPCCMD_R_NOVO, &long_pressed))
-		return;
+	scoped_guard(mutex, &priv->vpc_mutex)
+		if (read_ec_data(priv->adev->handle, VPCCMD_R_NOVO, &long_pressed))
+			return;
 
 	if (long_pressed)
 		ideapad_input_report(priv, 17);
@@ -1172,8 +1202,9 @@
 {
 	unsigned long bit, value;
 
-	if (read_ec_data(priv->adev->handle, VPCCMD_R_SPECIAL_BUTTONS, &value))
-		return;
+	scoped_guard(mutex, &priv->vpc_mutex)
+		if (read_ec_data(priv->adev->handle, VPCCMD_R_SPECIAL_BUTTONS, &value))
+			return;
 
 	for_each_set_bit (bit, &value, 16) {
 		switch (bit) {
@@ -1203,6 +1234,8 @@
 	unsigned long now;
 	int err;
 
+	guard(mutex)(&priv->vpc_mutex);
+
 	err = read_ec_data(priv->adev->handle, VPCCMD_R_BL, &now);
 	if (err)
 		return err;
@@ -1215,6 +1248,8 @@
 	struct ideapad_private *priv = bl_get_data(blightdev);
 	int err;
 
+	guard(mutex)(&priv->vpc_mutex);
+
 	err = write_ec_cmd(priv->adev->handle, VPCCMD_W_BL,
 			   blightdev->props.brightness);
 	if (err)
@@ -1292,6 +1327,8 @@
 	if (!blightdev)
 		return;
 
+	guard(mutex)(&priv->vpc_mutex);
+
 	if (read_ec_data(priv->adev->handle, VPCCMD_R_BL_POWER, &power))
 		return;
 
@@ -1304,7 +1341,8 @@
 
 	/* if we control brightness via acpi video driver */
 	if (!priv->blightdev)
-		read_ec_data(priv->adev->handle, VPCCMD_R_BL, &now);
+		scoped_guard(mutex, &priv->vpc_mutex)
+			read_ec_data(priv->adev->handle, VPCCMD_R_BL, &now);
 	else
 		backlight_force_update(priv->blightdev, BACKLIGHT_UPDATE_HOTKEY);
 }
@@ -1470,7 +1508,8 @@
 	int ret;
 
 	/* Without reading from EC touchpad LED doesn't switch state */
-	ret = read_ec_data(priv->adev->handle, VPCCMD_R_TOUCHPAD, &value);
+	scoped_guard(mutex, &priv->vpc_mutex)
+		ret = read_ec_data(priv->adev->handle, VPCCMD_R_TOUCHPAD, &value);
 	if (ret)
 		return;
 
@@ -1498,16 +1537,92 @@
 	priv->r_touchpad_val = value;
 }
 
+static const struct dmi_system_id ymc_ec_trigger_quirk_dmi_table[] = {
+	{
+		/* Lenovo Yoga 7 14ARB7 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "82QF"),
+		},
+	},
+	{
+		/* Lenovo Yoga 7 14ACN6 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "82N7"),
+		},
+	},
+	{ }
+};
+
+static void ideapad_laptop_trigger_ec(void)
+{
+	struct ideapad_private *priv;
+	int ret;
+
+	guard(mutex)(&ideapad_shared_mutex);
+
+	priv = ideapad_shared;
+	if (!priv)
+		return;
+
+	if (!priv->features.ymc_ec_trigger)
+		return;
+
+	scoped_guard(mutex, &priv->vpc_mutex)
+		ret = write_ec_cmd(priv->adev->handle, VPCCMD_W_YMC, 1);
+	if (ret)
+		dev_warn(&priv->platform_device->dev, "Could not write YMC: %d\n", ret);
+}
+
+static int ideapad_laptop_nb_notify(struct notifier_block *nb,
+				    unsigned long action, void *data)
+{
+	switch (action) {
+	case IDEAPAD_LAPTOP_YMC_EVENT:
+		ideapad_laptop_trigger_ec();
+		break;
+	}
+
+	return 0;
+}
+
+static struct notifier_block ideapad_laptop_notifier = {
+	.notifier_call = ideapad_laptop_nb_notify,
+};
+
+static BLOCKING_NOTIFIER_HEAD(ideapad_laptop_chain_head);
+
+int ideapad_laptop_register_notifier(struct notifier_block *nb)
+{
+	return blocking_notifier_chain_register(&ideapad_laptop_chain_head, nb);
+}
+EXPORT_SYMBOL_NS_GPL(ideapad_laptop_register_notifier, IDEAPAD_LAPTOP);
+
+int ideapad_laptop_unregister_notifier(struct notifier_block *nb)
+{
+	return blocking_notifier_chain_unregister(&ideapad_laptop_chain_head, nb);
+}
+EXPORT_SYMBOL_NS_GPL(ideapad_laptop_unregister_notifier, IDEAPAD_LAPTOP);
+
+void ideapad_laptop_call_notifier(unsigned long action, void *data)
+{
+	blocking_notifier_call_chain(&ideapad_laptop_chain_head, action, data);
+}
+EXPORT_SYMBOL_NS_GPL(ideapad_laptop_call_notifier, IDEAPAD_LAPTOP);
+
 static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data)
 {
 	struct ideapad_private *priv = data;
 	unsigned long vpc1, vpc2, bit;
 
-	if (read_ec_data(handle, VPCCMD_R_VPC1, &vpc1))
-		return;
+	scoped_guard(mutex, &priv->vpc_mutex) {
+		if (read_ec_data(handle, VPCCMD_R_VPC1, &vpc1))
+			return;
 
-	if (read_ec_data(handle, VPCCMD_R_VPC2, &vpc2))
-		return;
+		if (read_ec_data(handle, VPCCMD_R_VPC2, &vpc2))
+			return;
+	}
 
 	vpc1 = (vpc2 << 8) | vpc1;
 
@@ -1634,6 +1749,8 @@
 	priv->features.ctrl_ps2_aux_port =
 		ctrl_ps2_aux_port || dmi_check_system(ctrl_ps2_aux_port_list);
 	priv->features.touchpad_ctrl_via_ec = touchpad_ctrl_via_ec;
+	priv->features.ymc_ec_trigger =
+		ymc_ec_trigger || dmi_check_system(ymc_ec_trigger_quirk_dmi_table);
 
 	if (!read_ec_data(handle, VPCCMD_R_FAN, &val))
 		priv->features.fan_mode = true;
@@ -1809,6 +1926,10 @@
 	priv->adev = adev;
 	priv->platform_device = pdev;
 
+	err = devm_mutex_init(&pdev->dev, &priv->vpc_mutex);
+	if (err)
+		return err;
+
 	ideapad_check_features(priv);
 
 	err = ideapad_sysfs_init(priv);
@@ -1869,6 +1990,8 @@
 	if (err)
 		goto shared_init_failed;
 
+	ideapad_laptop_register_notifier(&ideapad_laptop_notifier);
+
 	return 0;
 
 shared_init_failed:
@@ -1900,6 +2023,8 @@
 	struct ideapad_private *priv = dev_get_drvdata(&pdev->dev);
 	int i;
 
+	ideapad_laptop_unregister_notifier(&ideapad_laptop_notifier);
+
 	ideapad_shared_exit(priv);
 
 	acpi_remove_notify_handler(priv->adev->handle,
--- linux-qcom-6.8.0.orig/drivers/platform/x86/ideapad-laptop.h
+++ linux-qcom-6.8.0/drivers/platform/x86/ideapad-laptop.h
@@ -12,6 +12,15 @@
 #include <linux/acpi.h>
 #include <linux/jiffies.h>
 #include <linux/errno.h>
+#include <linux/notifier.h>
+
+enum ideapad_laptop_notifier_actions {
+	IDEAPAD_LAPTOP_YMC_EVENT,
+};
+
+int ideapad_laptop_register_notifier(struct notifier_block *nb);
+int ideapad_laptop_unregister_notifier(struct notifier_block *nb);
+void ideapad_laptop_call_notifier(unsigned long action, void *data);
 
 enum {
 	VPCCMD_R_VPC1 = 0x10,
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/bxtwc_tmu.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/bxtwc_tmu.c
@@ -48,9 +48,8 @@
 static int bxt_wcove_tmu_probe(struct platform_device *pdev)
 {
 	struct intel_soc_pmic *pmic = dev_get_drvdata(pdev->dev.parent);
-	struct regmap_irq_chip_data *regmap_irq_chip;
 	struct wcove_tmu *wctmu;
-	int ret, virq, irq;
+	int ret;
 
 	wctmu = devm_kzalloc(&pdev->dev, sizeof(*wctmu), GFP_KERNEL);
 	if (!wctmu)
@@ -59,27 +58,18 @@
 	wctmu->dev = &pdev->dev;
 	wctmu->regmap = pmic->regmap;
 
-	irq = platform_get_irq(pdev, 0);
-	if (irq < 0)
-		return irq;
+	wctmu->irq = platform_get_irq(pdev, 0);
+	if (wctmu->irq < 0)
+		return wctmu->irq;
 
-	regmap_irq_chip = pmic->irq_chip_data_tmu;
-	virq = regmap_irq_get_virq(regmap_irq_chip, irq);
-	if (virq < 0) {
-		dev_err(&pdev->dev,
-			"failed to get virtual interrupt=%d\n", irq);
-		return virq;
-	}
-
-	ret = devm_request_threaded_irq(&pdev->dev, virq,
+	ret = devm_request_threaded_irq(&pdev->dev, wctmu->irq,
 					NULL, bxt_wcove_tmu_irq_handler,
 					IRQF_ONESHOT, "bxt_wcove_tmu", wctmu);
 	if (ret) {
 		dev_err(&pdev->dev, "request irq failed: %d,virq: %d\n",
-							ret, virq);
+			ret, wctmu->irq);
 		return ret;
 	}
-	wctmu->irq = virq;
 
 	/* Unmask TMU second level Wake & System alarm */
 	regmap_update_bits(wctmu->regmap, BXTWC_MTMUIRQ_REG,
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/hid.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/hid.c
@@ -504,6 +504,7 @@
 	struct platform_device *device = context;
 	struct intel_hid_priv *priv = dev_get_drvdata(&device->dev);
 	unsigned long long ev_index;
+	struct key_entry *ke;
 	int err;
 
 	/*
@@ -545,11 +546,15 @@
 		if (event == 0xc0 || !priv->array)
 			return;
 
-		if (!sparse_keymap_entry_from_scancode(priv->array, event)) {
+		ke = sparse_keymap_entry_from_scancode(priv->array, event);
+		if (!ke) {
 			dev_info(&device->dev, "unknown event 0x%x\n", event);
 			return;
 		}
 
+		if (ke->type == KE_IGNORE)
+			return;
+
 wakeup:
 		pm_wakeup_hard_event(&device->dev);
 
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/ifs/runtest.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/ifs/runtest.c
@@ -173,8 +173,8 @@
  */
 static void ifs_test_core(int cpu, struct device *dev)
 {
+	union ifs_status status = {};
 	union ifs_scan activate;
-	union ifs_status status;
 	unsigned long timeout;
 	struct ifs_data *ifsd;
 	int to_start, to_stop;
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/int3472/common.h
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/int3472/common.h
@@ -22,6 +22,7 @@
 #define INT3472_GPIO_TYPE_POWER_ENABLE				0x0b
 #define INT3472_GPIO_TYPE_CLK_ENABLE				0x0c
 #define INT3472_GPIO_TYPE_PRIVACY_LED				0x0d
+#define INT3472_GPIO_TYPE_HANDSHAKE				0x12
 
 #define INT3472_PDEV_MAX_NAME_LEN				23
 #define INT3472_MAX_SENSOR_GPIOS				3
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/int3472/discrete.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/int3472/discrete.c
@@ -148,6 +148,10 @@
 		*func = "power-enable";
 		*polarity = GPIO_ACTIVE_HIGH;
 		break;
+	case INT3472_GPIO_TYPE_HANDSHAKE:
+		*func = "handshake";
+		*polarity = GPIO_ACTIVE_HIGH;
+		break;
 	default:
 		*func = "unknown";
 		*polarity = GPIO_ACTIVE_HIGH;
@@ -239,6 +243,7 @@
 	switch (type) {
 	case INT3472_GPIO_TYPE_RESET:
 	case INT3472_GPIO_TYPE_POWERDOWN:
+	case INT3472_GPIO_TYPE_HANDSHAKE:
 		ret = skl_int3472_map_gpio_to_sensor(int3472, agpio, func, polarity);
 		if (ret)
 			err_msg = "Failed to map GPIO pin to sensor\n";
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/pmc/arl.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/pmc/arl.c
@@ -673,6 +673,7 @@
 };
 
 #define ARL_NPU_PCI_DEV			0xad1d
+#define ARL_GNA_PCI_DEV			0xae4c
 /*
  * Set power state of select devices that do not have drivers to D3
  * so that they do not block Package C entry.
@@ -680,6 +681,7 @@
 static void arl_d3_fixup(void)
 {
 	pmc_core_set_device_d3(ARL_NPU_PCI_DEV);
+	pmc_core_set_device_d3(ARL_GNA_PCI_DEV);
 }
 
 static int arl_resume(struct pmc_dev *pmcdev)
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/pmc/core_ssram.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/pmc/core_ssram.c
@@ -29,7 +29,7 @@
 #define LPM_REG_COUNT		28
 #define LPM_MODE_OFFSET		1
 
-DEFINE_FREE(pmc_core_iounmap, void __iomem *, iounmap(_T));
+DEFINE_FREE(pmc_core_iounmap, void __iomem *, if (_T) iounmap(_T))
 
 static u32 pmc_core_find_guid(struct pmc_info *list, const struct pmc_reg_map *map)
 {
@@ -262,13 +262,19 @@
 
 	ssram_base = ssram_pcidev->resource[0].start;
 	tmp_ssram = ioremap(ssram_base, SSRAM_HDR_SIZE);
+	if (!tmp_ssram)
+		return -ENOMEM;
 
 	if (pmc_idx != PMC_IDX_MAIN) {
 		/*
 		 * The secondary PMC BARS (which are behind hidden PCI devices)
 		 * are read from fixed offsets in MMIO of the primary PMC BAR.
+		 * If a device is not present, the value will be 0.
 		 */
 		ssram_base = get_base(tmp_ssram, offset);
+		if (!ssram_base)
+			return 0;
+
 		ssram = ioremap(ssram_base, SSRAM_HDR_SIZE);
 		if (!ssram)
 			return -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/pmc/lnl.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/pmc/lnl.c
@@ -13,21 +13,6 @@
 
 #include "core.h"
 
-#define SOCM_LPM_REQ_GUID	0x11594920
-
-#define PMC_DEVID_SOCM	0xa87f
-
-static const u8 LNL_LPM_REG_INDEX[] = {0, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16, 20};
-
-static struct pmc_info lnl_pmc_info_list[] = {
-	{
-		.guid	= SOCM_LPM_REQ_GUID,
-		.devid	= PMC_DEVID_SOCM,
-		.map	= &lnl_socm_reg_map,
-	},
-	{}
-};
-
 const struct pmc_bit_map lnl_ltr_show_map[] = {
 	{"SOUTHPORT_A",		CNP_PMC_LTR_SPA},
 	{"SOUTHPORT_B",		CNP_PMC_LTR_SPB},
@@ -490,7 +475,6 @@
 	.lpm_sts = lnl_lpm_maps,
 	.lpm_status_offset = MTL_LPM_STATUS_OFFSET,
 	.lpm_live_status_offset = MTL_LPM_LIVE_STATUS_OFFSET,
-	.lpm_reg_index = LNL_LPM_REG_INDEX,
 };
 
 #define LNL_NPU_PCI_DEV		0x643e
@@ -517,33 +501,19 @@
 int lnl_core_init(struct pmc_dev *pmcdev)
 {
 	int ret;
-	int func = 2;
-	bool ssram_init = true;
 	struct pmc *pmc = pmcdev->pmcs[PMC_IDX_SOC];
 
 	lnl_d3_fixup();
 
 	pmcdev->suspend = cnl_suspend;
 	pmcdev->resume = lnl_resume;
-	pmcdev->regmap_list = lnl_pmc_info_list;
-	ret = pmc_core_ssram_init(pmcdev, func);
 
-	/* If regbase not assigned, set map and discover using legacy method */
-	if (ret) {
-		ssram_init = false;
-		pmc->map = &lnl_socm_reg_map;
-		ret = get_primary_reg_base(pmc);
-		if (ret)
-			return ret;
-	}
+	pmc->map = &lnl_socm_reg_map;
+	ret = get_primary_reg_base(pmc);
+	if (ret)
+		return ret;
 
 	pmc_core_get_low_power_modes(pmcdev);
 
-	if (ssram_init) {
-		ret = pmc_core_ssram_get_lpm_reqs(pmcdev);
-		if (ret)
-			return ret;
-	}
-
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
@@ -316,7 +316,9 @@
 	    cpu >= nr_cpu_ids || cpu >= num_possible_cpus())
 		return NULL;
 
-	pkg_id = topology_physical_package_id(cpu);
+	pkg_id = topology_logical_package_id(cpu);
+	if (pkg_id >= topology_max_packages())
+		return NULL;
 
 	bus_number = isst_cpu_info[cpu].bus_info[bus_no];
 	if (bus_number < 0)
@@ -719,8 +721,11 @@
 };
 
 static const struct x86_cpu_id hpm_cpu_ids[] = {
+	X86_MATCH_INTEL_FAM6_MODEL(GRANITERAPIDS_D,	NULL),
 	X86_MATCH_INTEL_FAM6_MODEL(GRANITERAPIDS_X,	NULL),
+	X86_MATCH_INTEL_FAM6_MODEL(ATOM_CRESTMONT,	NULL),
 	X86_MATCH_INTEL_FAM6_MODEL(ATOM_CRESTMONT_X,	NULL),
+	X86_MATCH_INTEL_FAM6_MODEL(ATOM_DARKMONT_X,	NULL),
 	{}
 };
 
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/tpmi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/tpmi.c
@@ -96,7 +96,7 @@
  */
 struct intel_tpmi_pm_feature {
 	struct intel_tpmi_pfs_entry pfs_header;
-	unsigned int vsec_offset;
+	u64 vsec_offset;
 	struct intel_vsec_device *vsec_dev;
 };
 
@@ -376,7 +376,7 @@
 			read_blocked = feature_state.read_blocked ? 'Y' : 'N';
 			write_blocked = feature_state.write_blocked ? 'Y' : 'N';
 		}
-		seq_printf(s, "0x%02x\t\t0x%02x\t\t0x%04x\t\t0x%04x\t\t0x%02x\t\t0x%08x\t%c\t%c\t\t%c\t\t%c\n",
+		seq_printf(s, "0x%02x\t\t0x%02x\t\t0x%04x\t\t0x%04x\t\t0x%02x\t\t0x%016llx\t%c\t%c\t\t%c\t\t%c\n",
 			   pfs->pfs_header.tpmi_id, pfs->pfs_header.num_entries,
 			   pfs->pfs_header.entry_size, pfs->pfs_header.cap_offset,
 			   pfs->pfs_header.attribute, pfs->vsec_offset, locked, disabled,
@@ -395,7 +395,8 @@
 	struct intel_tpmi_pm_feature *pfs = s->private;
 	int count, ret = 0;
 	void __iomem *mem;
-	u32 off, size;
+	u32 size;
+	u64 off;
 	u8 *buffer;
 
 	size = TPMI_GET_SINGLE_ENTRY_SIZE(pfs);
@@ -411,7 +412,7 @@
 	mutex_lock(&tpmi_dev_lock);
 
 	for (count = 0; count < pfs->pfs_header.num_entries; ++count) {
-		seq_printf(s, "TPMI Instance:%d offset:0x%x\n", count, off);
+		seq_printf(s, "TPMI Instance:%d offset:0x%llx\n", count, off);
 
 		mem = ioremap(off, size);
 		if (!mem) {
@@ -762,8 +763,11 @@
 		 * when actual device nodes created outside this
 		 * loop via tpmi_create_devices().
 		 */
-		if (pfs->pfs_header.tpmi_id == TPMI_INFO_ID)
-			tpmi_process_info(tpmi_info, pfs);
+		if (pfs->pfs_header.tpmi_id == TPMI_INFO_ID) {
+			ret = tpmi_process_info(tpmi_info, pfs);
+			if (ret)
+				return ret;
+		}
 
 		if (pfs->pfs_header.tpmi_id == TPMI_CONTROL_ID)
 			tpmi_set_control_base(auxdev, tpmi_info, pfs);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
@@ -240,6 +240,7 @@
 	bool read_blocked = 0, write_blocked = 0;
 	struct intel_tpmi_plat_info *plat_info;
 	struct tpmi_uncore_struct *tpmi_uncore;
+	bool uncore_sysfs_added = false;
 	int ret, i, pkg = 0;
 	int num_resources;
 
@@ -384,9 +385,15 @@
 			}
 			/* Point to next cluster offset */
 			cluster_offset >>= UNCORE_MAX_CLUSTER_PER_DOMAIN;
+			uncore_sysfs_added = true;
 		}
 	}
 
+	if (!uncore_sysfs_added) {
+		ret = -ENODEV;
+		goto remove_clusters;
+	}
+
 	auxiliary_set_drvdata(auxdev, tpmi_uncore);
 
 	tpmi_uncore->root_cluster.root_domain = true;
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel/vbtn.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel/vbtn.c
@@ -7,11 +7,13 @@
  */
 
 #include <linux/acpi.h>
+#include <linux/cleanup.h>
 #include <linux/dmi.h>
 #include <linux/input.h>
 #include <linux/input/sparse-keymap.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/platform_device.h>
 #include <linux/suspend.h>
 #include "../dual_accel_detect.h"
@@ -65,6 +67,7 @@
 };
 
 struct intel_vbtn_priv {
+	struct mutex mutex; /* Avoid notify_handler() racing with itself */
 	struct input_dev *buttons_dev;
 	struct input_dev *switches_dev;
 	bool dual_accel;
@@ -136,8 +139,6 @@
 	priv->switches_dev->id.bustype = BUS_HOST;
 
 	if (priv->has_switches) {
-		detect_tablet_mode(&device->dev);
-
 		ret = input_register_device(priv->switches_dev);
 		if (ret)
 			return ret;
@@ -156,6 +157,8 @@
 	bool autorelease;
 	int ret;
 
+	guard(mutex)(&priv->mutex);
+
 	if ((ke = sparse_keymap_entry_from_scancode(priv->buttons_dev, event))) {
 		if (!priv->has_buttons) {
 			dev_warn(&device->dev, "Warning: received a button event on a device without buttons, please report this.\n");
@@ -294,6 +297,10 @@
 		return -ENOMEM;
 	dev_set_drvdata(&device->dev, priv);
 
+	err = devm_mutex_init(&device->dev, &priv->mutex);
+	if (err)
+		return err;
+
 	priv->dual_accel = dual_accel;
 	priv->has_buttons = has_buttons;
 	priv->has_switches = has_switches;
@@ -316,6 +323,9 @@
 		if (ACPI_FAILURE(status))
 			dev_err(&device->dev, "Error VBDL failed with ACPI status %d\n", status);
 	}
+	// Check switches after buttons since VBDL may have side effects.
+	if (has_switches)
+		detect_tablet_mode(&device->dev);
 
 	device_init_wakeup(&device->dev, true);
 	/*
--- linux-qcom-6.8.0.orig/drivers/platform/x86/intel_ips.c
+++ linux-qcom-6.8.0/drivers/platform/x86/intel_ips.c
@@ -1415,6 +1415,14 @@
 			DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook"),
 		},
 	},
+	{
+		.callback = ips_blacklist_callback,
+		.ident = "G60JX",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "G60JX"),
+		},
+	},
 	{ }	/* terminating entry */
 };
 
--- linux-qcom-6.8.0.orig/drivers/platform/x86/lenovo-wmi-hotkey-utilities.c
+++ linux-qcom-6.8.0/drivers/platform/x86/lenovo-wmi-hotkey-utilities.c
@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ *  Lenovo Super Hotkey Utility WMI extras driver for Ideapad laptop
+ *
+ *  Copyright (C) 2025	Lenovo
+ */
+
+#include <linux/cleanup.h>
+#include <linux/dev_printk.h>
+#include <linux/device.h>
+#include <linux/leds.h>
+#include <linux/module.h>
+#include <linux/wmi.h>
+
+/* Lenovo Super Hotkey WMI GUIDs */
+#define LUD_WMI_METHOD_GUID	"CE6C0974-0407-4F50-88BA-4FC3B6559AD8"
+
+/* Lenovo Utility Data WMI method_id */
+#define WMI_LUD_GET_SUPPORT 1
+#define WMI_LUD_SET_FEATURE 2
+
+#define WMI_LUD_GET_MICMUTE_LED_VER   20
+#define WMI_LUD_GET_AUDIOMUTE_LED_VER 26
+
+#define WMI_LUD_SUPPORT_MICMUTE_LED_VER   25
+#define WMI_LUD_SUPPORT_AUDIOMUTE_LED_VER 27
+
+/* Input parameters to mute/unmute audio LED and Mic LED */
+struct wmi_led_args {
+	u8 id;
+	u8 subid;
+	u16 value;
+};
+
+/* Values of input parameters to SetFeature of audio LED and Mic LED */
+enum hotkey_set_feature {
+	MIC_MUTE_LED_ON		= 1,
+	MIC_MUTE_LED_OFF	= 2,
+	AUDIO_MUTE_LED_ON	= 4,
+	AUDIO_MUTE_LED_OFF	= 5,
+};
+
+#define LSH_ACPI_LED_MAX 2
+
+struct lenovo_super_hotkey_wmi_private {
+	struct led_classdev cdev[LSH_ACPI_LED_MAX];
+	struct wmi_device *led_wdev;
+};
+
+enum mute_led_type {
+	MIC_MUTE,
+	AUDIO_MUTE,
+};
+
+static int lsh_wmi_mute_led_set(enum mute_led_type led_type, struct led_classdev *led_cdev,
+				enum led_brightness brightness)
+
+{
+	struct lenovo_super_hotkey_wmi_private *wpriv = container_of(led_cdev,
+			struct lenovo_super_hotkey_wmi_private, cdev[led_type]);
+	struct wmi_led_args led_arg = {0, 0, 0};
+	struct acpi_buffer input;
+	acpi_status status;
+
+	switch (led_type) {
+	case MIC_MUTE:
+		led_arg.id = brightness == LED_ON ? MIC_MUTE_LED_ON : MIC_MUTE_LED_OFF;
+		break;
+	case AUDIO_MUTE:
+		led_arg.id = brightness == LED_ON ? AUDIO_MUTE_LED_ON : AUDIO_MUTE_LED_OFF;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	input.length = sizeof(led_arg);
+	input.pointer = &led_arg;
+	status = wmidev_evaluate_method(wpriv->led_wdev, 0, WMI_LUD_SET_FEATURE, &input, NULL);
+	if (ACPI_FAILURE(status))
+		return -EIO;
+
+	return 0;
+}
+
+static int lsh_wmi_audiomute_led_set(struct led_classdev *led_cdev,
+				     enum led_brightness brightness)
+
+{
+	return lsh_wmi_mute_led_set(AUDIO_MUTE, led_cdev, brightness);
+}
+
+static int lsh_wmi_micmute_led_set(struct led_classdev *led_cdev,
+				   enum led_brightness brightness)
+{
+	return lsh_wmi_mute_led_set(MIC_MUTE, led_cdev, brightness);
+}
+
+static int lenovo_super_hotkey_wmi_led_init(enum mute_led_type led_type, struct device *dev)
+{
+	struct lenovo_super_hotkey_wmi_private *wpriv = dev_get_drvdata(dev);
+	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+	struct acpi_buffer input;
+	int led_version, err = 0;
+	unsigned int wmiarg;
+	acpi_status status;
+
+	switch (led_type) {
+	case MIC_MUTE:
+		wmiarg = WMI_LUD_GET_MICMUTE_LED_VER;
+		break;
+	case AUDIO_MUTE:
+		wmiarg = WMI_LUD_GET_AUDIOMUTE_LED_VER;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	input.length = sizeof(wmiarg);
+	input.pointer = &wmiarg;
+	status = wmidev_evaluate_method(wpriv->led_wdev, 0, WMI_LUD_GET_SUPPORT, &input, &output);
+	if (ACPI_FAILURE(status))
+		return -EIO;
+
+	union acpi_object *obj __free(kfree) = output.pointer;
+	if (obj && obj->type == ACPI_TYPE_INTEGER)
+		led_version = obj->integer.value;
+	else
+		return -EIO;
+
+	wpriv->cdev[led_type].max_brightness = LED_ON;
+	wpriv->cdev[led_type].flags = LED_CORE_SUSPENDRESUME;
+
+	switch (led_type) {
+	case MIC_MUTE:
+		if (led_version != WMI_LUD_SUPPORT_MICMUTE_LED_VER)
+			return -EIO;
+
+		wpriv->cdev[led_type].name = "platform::micmute";
+		wpriv->cdev[led_type].brightness_set_blocking = &lsh_wmi_micmute_led_set;
+		wpriv->cdev[led_type].default_trigger = "audio-micmute";
+		break;
+	case AUDIO_MUTE:
+		if (led_version != WMI_LUD_SUPPORT_AUDIOMUTE_LED_VER)
+			return -EIO;
+
+		wpriv->cdev[led_type].name = "platform::mute";
+		wpriv->cdev[led_type].brightness_set_blocking = &lsh_wmi_audiomute_led_set;
+		wpriv->cdev[led_type].default_trigger = "audio-mute";
+		break;
+	default:
+		dev_err(dev, "Unknown LED type %d\n", led_type);
+		return -EINVAL;
+	}
+
+	err = devm_led_classdev_register(dev, &wpriv->cdev[led_type]);
+	if (err < 0) {
+		dev_err(dev, "Could not register mute LED %d : %d\n", led_type, err);
+		return err;
+	}
+	return 0;
+}
+
+static int lenovo_super_hotkey_wmi_leds_setup(struct device *dev)
+{
+	int err;
+
+	err = lenovo_super_hotkey_wmi_led_init(MIC_MUTE, dev);
+	if (err)
+		return err;
+
+	err = lenovo_super_hotkey_wmi_led_init(AUDIO_MUTE, dev);
+	if (err)
+		return err;
+
+	return 0;
+}
+
+static int lenovo_super_hotkey_wmi_probe(struct wmi_device *wdev, const void *context)
+{
+	struct lenovo_super_hotkey_wmi_private *wpriv;
+
+	wpriv = devm_kzalloc(&wdev->dev, sizeof(*wpriv), GFP_KERNEL);
+	if (!wpriv)
+		return -ENOMEM;
+
+	dev_set_drvdata(&wdev->dev, wpriv);
+	wpriv->led_wdev = wdev;
+	return lenovo_super_hotkey_wmi_leds_setup(&wdev->dev);
+}
+
+static const struct wmi_device_id lenovo_super_hotkey_wmi_id_table[] = {
+	{ LUD_WMI_METHOD_GUID, NULL }, /* Utility data */
+	{ }
+};
+
+MODULE_DEVICE_TABLE(wmi, lenovo_super_hotkey_wmi_id_table);
+
+static struct wmi_driver lenovo_wmi_hotkey_utilities_driver = {
+	 .driver = {
+		 .name = "lenovo_wmi_hotkey_utilities",
+		 .probe_type = PROBE_PREFER_ASYNCHRONOUS
+	 },
+	 .id_table = lenovo_super_hotkey_wmi_id_table,
+	 .probe = lenovo_super_hotkey_wmi_probe,
+};
+
+module_wmi_driver(lenovo_wmi_hotkey_utilities_driver);
+
+MODULE_AUTHOR("Jackie Dong <dongeg1@lenovo.com>");
+MODULE_DESCRIPTION("Lenovo Super Hotkey Utility WMI extras driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/platform/x86/lenovo-ymc.c
+++ linux-qcom-6.8.0/drivers/platform/x86/lenovo-ymc.c
@@ -20,32 +20,10 @@
 #define LENOVO_YMC_QUERY_INSTANCE 0
 #define LENOVO_YMC_QUERY_METHOD 0x01
 
-static bool ec_trigger __read_mostly;
-module_param(ec_trigger, bool, 0444);
-MODULE_PARM_DESC(ec_trigger, "Enable EC triggering work-around to force emitting tablet mode events");
-
 static bool force;
 module_param(force, bool, 0444);
 MODULE_PARM_DESC(force, "Force loading on boards without a convertible DMI chassis-type");
 
-static const struct dmi_system_id ec_trigger_quirk_dmi_table[] = {
-	{
-		/* Lenovo Yoga 7 14ARB7 */
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "82QF"),
-		},
-	},
-	{
-		/* Lenovo Yoga 7 14ACN6 */
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "82N7"),
-		},
-	},
-	{ }
-};
-
 static const struct dmi_system_id allowed_chasis_types_dmi_table[] = {
 	{
 		.matches = {
@@ -62,22 +40,11 @@
 
 struct lenovo_ymc_private {
 	struct input_dev *input_dev;
-	struct acpi_device *ec_acpi_dev;
 };
 
-static void lenovo_ymc_trigger_ec(struct wmi_device *wdev, struct lenovo_ymc_private *priv)
-{
-	int err;
-
-	if (!priv->ec_acpi_dev)
-		return;
-
-	err = write_ec_cmd(priv->ec_acpi_dev->handle, VPCCMD_W_YMC, 1);
-	if (err)
-		dev_warn(&wdev->dev, "Could not write YMC: %d\n", err);
-}
-
 static const struct key_entry lenovo_ymc_keymap[] = {
+	/* Ignore the uninitialized state */
+	{ KE_IGNORE, 0x00 },
 	/* Laptop */
 	{ KE_SW, 0x01, { .sw = { SW_TABLET_MODE, 0 } } },
 	/* Tablet */
@@ -125,11 +92,9 @@
 
 free_obj:
 	kfree(obj);
-	lenovo_ymc_trigger_ec(wdev, priv);
+	ideapad_laptop_call_notifier(IDEAPAD_LAPTOP_YMC_EVENT, &code);
 }
 
-static void acpi_dev_put_helper(void *p) { acpi_dev_put(p); }
-
 static int lenovo_ymc_probe(struct wmi_device *wdev, const void *ctx)
 {
 	struct lenovo_ymc_private *priv;
@@ -143,29 +108,10 @@
 			return -ENODEV;
 	}
 
-	ec_trigger |= dmi_check_system(ec_trigger_quirk_dmi_table);
-
 	priv = devm_kzalloc(&wdev->dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;
 
-	if (ec_trigger) {
-		pr_debug("Lenovo YMC enable EC triggering.\n");
-		priv->ec_acpi_dev = acpi_dev_get_first_match_dev("VPC2004", NULL, -1);
-
-		if (!priv->ec_acpi_dev) {
-			dev_err(&wdev->dev, "Could not find EC ACPI device.\n");
-			return -ENODEV;
-		}
-		err = devm_add_action_or_reset(&wdev->dev,
-				acpi_dev_put_helper, priv->ec_acpi_dev);
-		if (err) {
-			dev_err(&wdev->dev,
-				"Could not clean up EC ACPI device: %d\n", err);
-			return err;
-		}
-	}
-
 	input_dev = devm_input_allocate_device(&wdev->dev);
 	if (!input_dev)
 		return -ENOMEM;
@@ -192,7 +138,6 @@
 	dev_set_drvdata(&wdev->dev, priv);
 
 	/* Report the state for the first time on probe */
-	lenovo_ymc_trigger_ec(wdev, priv);
 	lenovo_ymc_notify(wdev, NULL);
 	return 0;
 }
@@ -217,3 +162,4 @@
 MODULE_AUTHOR("Gergo Koteles <soyer@irl.hu>");
 MODULE_DESCRIPTION("Lenovo Yoga Mode Control driver");
 MODULE_LICENSE("GPL");
+MODULE_IMPORT_NS(IDEAPAD_LAPTOP);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/lg-laptop.c
+++ linux-qcom-6.8.0/drivers/platform/x86/lg-laptop.c
@@ -39,8 +39,6 @@
 #define WMI_METHOD_WMBB "2B4F501A-BD3C-4394-8DCF-00A7D2BC8210"
 #define WMI_EVENT_GUID  WMI_EVENT_GUID0
 
-#define WMAB_METHOD     "\\XINI.WMAB"
-#define WMBB_METHOD     "\\XINI.WMBB"
 #define SB_GGOV_METHOD  "\\_SB.GGOV"
 #define GOV_TLED        0x2020008
 #define WM_GET          1
@@ -74,7 +72,7 @@
 
 static int battery_limit_use_wmbb;
 static struct led_classdev kbd_backlight;
-static enum led_brightness get_kbd_backlight_level(void);
+static enum led_brightness get_kbd_backlight_level(struct device *dev);
 
 static const struct key_entry wmi_keymap[] = {
 	{KE_KEY, 0x70, {KEY_F15} },	 /* LG control panel (F1) */
@@ -84,7 +82,6 @@
 					  * this key both sends an event and
 					  * changes backlight level.
 					  */
-	{KE_KEY, 0x80, {KEY_RFKILL} },
 	{KE_END, 0}
 };
 
@@ -128,11 +125,10 @@
 	return res;
 }
 
-static union acpi_object *lg_wmab(u32 method, u32 arg1, u32 arg2)
+static union acpi_object *lg_wmab(struct device *dev, u32 method, u32 arg1, u32 arg2)
 {
 	union acpi_object args[3];
 	acpi_status status;
-	acpi_handle handle;
 	struct acpi_object_list arg;
 	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
 
@@ -143,29 +139,22 @@
 	args[2].type = ACPI_TYPE_INTEGER;
 	args[2].integer.value = arg2;
 
-	status = acpi_get_handle(NULL, (acpi_string) WMAB_METHOD, &handle);
-	if (ACPI_FAILURE(status)) {
-		pr_err("Cannot get handle");
-		return NULL;
-	}
-
 	arg.count = 3;
 	arg.pointer = args;
 
-	status = acpi_evaluate_object(handle, NULL, &arg, &buffer);
+	status = acpi_evaluate_object(ACPI_HANDLE(dev), "WMAB", &arg, &buffer);
 	if (ACPI_FAILURE(status)) {
-		acpi_handle_err(handle, "WMAB: call failed.\n");
+		dev_err(dev, "WMAB: call failed.\n");
 		return NULL;
 	}
 
 	return buffer.pointer;
 }
 
-static union acpi_object *lg_wmbb(u32 method_id, u32 arg1, u32 arg2)
+static union acpi_object *lg_wmbb(struct device *dev, u32 method_id, u32 arg1, u32 arg2)
 {
 	union acpi_object args[3];
 	acpi_status status;
-	acpi_handle handle;
 	struct acpi_object_list arg;
 	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
 	u8 buf[32];
@@ -181,18 +170,12 @@
 	args[2].buffer.length = 32;
 	args[2].buffer.pointer = buf;
 
-	status = acpi_get_handle(NULL, (acpi_string)WMBB_METHOD, &handle);
-	if (ACPI_FAILURE(status)) {
-		pr_err("Cannot get handle");
-		return NULL;
-	}
-
 	arg.count = 3;
 	arg.pointer = args;
 
-	status = acpi_evaluate_object(handle, NULL, &arg, &buffer);
+	status = acpi_evaluate_object(ACPI_HANDLE(dev), "WMBB", &arg, &buffer);
 	if (ACPI_FAILURE(status)) {
-		acpi_handle_err(handle, "WMAB: call failed.\n");
+		dev_err(dev, "WMBB: call failed.\n");
 		return NULL;
 	}
 
@@ -223,7 +206,7 @@
 
 		if (eventcode == 0x10000000) {
 			led_classdev_notify_brightness_hw_changed(
-				&kbd_backlight, get_kbd_backlight_level());
+				&kbd_backlight, get_kbd_backlight_level(kbd_backlight.dev->parent));
 		} else {
 			key = sparse_keymap_entry_from_scancode(
 				wmi_input_dev, eventcode);
@@ -272,14 +255,7 @@
 
 static void acpi_notify(struct acpi_device *device, u32 event)
 {
-	struct key_entry *key;
-
 	acpi_handle_debug(device->handle, "notify: %d\n", event);
-	if (inited & INIT_SPARSE_KEYMAP) {
-		key = sparse_keymap_entry_from_scancode(wmi_input_dev, 0x80);
-		if (key && key->type == KE_KEY)
-			sparse_keymap_report_entry(wmi_input_dev, key, 1, true);
-	}
 }
 
 static ssize_t fan_mode_store(struct device *dev,
@@ -295,7 +271,7 @@
 	if (ret)
 		return ret;
 
-	r = lg_wmab(WM_FAN_MODE, WM_GET, 0);
+	r = lg_wmab(dev, WM_FAN_MODE, WM_GET, 0);
 	if (!r)
 		return -EIO;
 
@@ -306,9 +282,9 @@
 
 	m = r->integer.value;
 	kfree(r);
-	r = lg_wmab(WM_FAN_MODE, WM_SET, (m & 0xffffff0f) | (value << 4));
+	r = lg_wmab(dev, WM_FAN_MODE, WM_SET, (m & 0xffffff0f) | (value << 4));
 	kfree(r);
-	r = lg_wmab(WM_FAN_MODE, WM_SET, (m & 0xfffffff0) | value);
+	r = lg_wmab(dev, WM_FAN_MODE, WM_SET, (m & 0xfffffff0) | value);
 	kfree(r);
 
 	return count;
@@ -320,7 +296,7 @@
 	unsigned int status;
 	union acpi_object *r;
 
-	r = lg_wmab(WM_FAN_MODE, WM_GET, 0);
+	r = lg_wmab(dev, WM_FAN_MODE, WM_GET, 0);
 	if (!r)
 		return -EIO;
 
@@ -347,7 +323,7 @@
 	if (ret)
 		return ret;
 
-	r = lg_wmbb(WMBB_USB_CHARGE, WM_SET, value);
+	r = lg_wmbb(dev, WMBB_USB_CHARGE, WM_SET, value);
 	if (!r)
 		return -EIO;
 
@@ -361,7 +337,7 @@
 	unsigned int status;
 	union acpi_object *r;
 
-	r = lg_wmbb(WMBB_USB_CHARGE, WM_GET, 0);
+	r = lg_wmbb(dev, WMBB_USB_CHARGE, WM_GET, 0);
 	if (!r)
 		return -EIO;
 
@@ -389,7 +365,7 @@
 	if (ret)
 		return ret;
 
-	r = lg_wmab(WM_READER_MODE, WM_SET, value);
+	r = lg_wmab(dev, WM_READER_MODE, WM_SET, value);
 	if (!r)
 		return -EIO;
 
@@ -403,7 +379,7 @@
 	unsigned int status;
 	union acpi_object *r;
 
-	r = lg_wmab(WM_READER_MODE, WM_GET, 0);
+	r = lg_wmab(dev, WM_READER_MODE, WM_GET, 0);
 	if (!r)
 		return -EIO;
 
@@ -431,7 +407,7 @@
 	if (ret)
 		return ret;
 
-	r = lg_wmab(WM_FN_LOCK, WM_SET, value);
+	r = lg_wmab(dev, WM_FN_LOCK, WM_SET, value);
 	if (!r)
 		return -EIO;
 
@@ -445,7 +421,7 @@
 	unsigned int status;
 	union acpi_object *r;
 
-	r = lg_wmab(WM_FN_LOCK, WM_GET, 0);
+	r = lg_wmab(dev, WM_FN_LOCK, WM_GET, 0);
 	if (!r)
 		return -EIO;
 
@@ -475,9 +451,9 @@
 		union acpi_object *r;
 
 		if (battery_limit_use_wmbb)
-			r = lg_wmbb(WMBB_BATT_LIMIT, WM_SET, value);
+			r = lg_wmbb(&pf_device->dev, WMBB_BATT_LIMIT, WM_SET, value);
 		else
-			r = lg_wmab(WM_BATT_LIMIT, WM_SET, value);
+			r = lg_wmab(&pf_device->dev, WM_BATT_LIMIT, WM_SET, value);
 		if (!r)
 			return -EIO;
 
@@ -496,7 +472,7 @@
 	union acpi_object *r;
 
 	if (battery_limit_use_wmbb) {
-		r = lg_wmbb(WMBB_BATT_LIMIT, WM_GET, 0);
+		r = lg_wmbb(&pf_device->dev, WMBB_BATT_LIMIT, WM_GET, 0);
 		if (!r)
 			return -EIO;
 
@@ -507,7 +483,7 @@
 
 		status = r->buffer.pointer[0x10];
 	} else {
-		r = lg_wmab(WM_BATT_LIMIT, WM_GET, 0);
+		r = lg_wmab(&pf_device->dev, WM_BATT_LIMIT, WM_GET, 0);
 		if (!r)
 			return -EIO;
 
@@ -586,7 +562,7 @@
 {
 	union acpi_object *r;
 
-	r = lg_wmab(WM_TLED, WM_SET, brightness > LED_OFF);
+	r = lg_wmab(cdev->dev->parent, WM_TLED, WM_SET, brightness > LED_OFF);
 	kfree(r);
 }
 
@@ -608,16 +584,16 @@
 		val = 0;
 	if (brightness >= LED_FULL)
 		val = 0x24;
-	r = lg_wmab(WM_KEY_LIGHT, WM_SET, val);
+	r = lg_wmab(cdev->dev->parent, WM_KEY_LIGHT, WM_SET, val);
 	kfree(r);
 }
 
-static enum led_brightness get_kbd_backlight_level(void)
+static enum led_brightness get_kbd_backlight_level(struct device *dev)
 {
 	union acpi_object *r;
 	int val;
 
-	r = lg_wmab(WM_KEY_LIGHT, WM_GET, 0);
+	r = lg_wmab(dev, WM_KEY_LIGHT, WM_GET, 0);
 
 	if (!r)
 		return LED_OFF;
@@ -645,7 +621,7 @@
 
 static enum led_brightness kbd_backlight_get(struct led_classdev *cdev)
 {
-	return get_kbd_backlight_level();
+	return get_kbd_backlight_level(cdev->dev->parent);
 }
 
 static LED_DEVICE(kbd_backlight, 255, LED_BRIGHT_HW_CHANGED);
@@ -672,6 +648,11 @@
 
 static int acpi_add(struct acpi_device *device)
 {
+	struct platform_device_info pdev_info = {
+		.fwnode = acpi_fwnode_handle(device),
+		.name = PLATFORM_NAME,
+		.id = PLATFORM_DEVID_NONE,
+	};
 	int ret;
 	const char *product;
 	int year = 2017;
@@ -683,9 +664,7 @@
 	if (ret)
 		return ret;
 
-	pf_device = platform_device_register_simple(PLATFORM_NAME,
-						    PLATFORM_DEVID_NONE,
-						    NULL, 0);
+	pf_device = platform_device_register_full(&pdev_info);
 	if (IS_ERR(pf_device)) {
 		ret = PTR_ERR(pf_device);
 		pf_device = NULL;
@@ -736,7 +715,7 @@
 		default:
 			year = 2019;
 		}
-	pr_info("product: %s  year: %d\n", product, year);
+	pr_info("product: %s  year: %d\n", product ?: "unknown", year);
 
 	if (year >= 2019)
 		battery_limit_use_wmbb = 1;
@@ -776,7 +755,7 @@
 }
 
 static const struct acpi_device_id device_ids[] = {
-	{"LGEX0815", 0},
+	{"LGEX0820", 0},
 	{"", 0}
 };
 MODULE_DEVICE_TABLE(acpi, device_ids);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/mlx-platform.c
+++ linux-qcom-6.8.0/drivers/platform/x86/mlx-platform.c
@@ -6237,6 +6237,7 @@
 fail_pci_request_regions:
 	pci_disable_device(pci_dev);
 fail_pci_enable_device:
+	pci_dev_put(pci_dev);
 	return err;
 }
 
@@ -6247,6 +6248,7 @@
 	iounmap(pci_bridge_addr);
 	pci_release_regions(pci_bridge);
 	pci_disable_device(pci_bridge);
+	pci_dev_put(pci_bridge);
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/platform/x86/p2sb.c
+++ linux-qcom-6.8.0/drivers/platform/x86/p2sb.c
@@ -42,8 +42,9 @@
 };
 
 static struct p2sb_res_cache p2sb_resources[NR_P2SB_RES_CACHE];
+static bool p2sb_hidden_by_bios;
 
-static int p2sb_get_devfn(unsigned int *devfn)
+static void p2sb_get_devfn(unsigned int *devfn)
 {
 	unsigned int fn = P2SB_DEVFN_DEFAULT;
 	const struct x86_cpu_id *id;
@@ -53,15 +54,11 @@
 		fn = (unsigned int)id->driver_data;
 
 	*devfn = fn;
-	return 0;
 }
 
-static bool p2sb_valid_resource(struct resource *res)
+static bool p2sb_valid_resource(const struct resource *res)
 {
-	if (res->flags)
-		return true;
-
-	return false;
+	return res->flags & ~IORESOURCE_UNSET;
 }
 
 /* Copy resource from the first BAR of the device in question */
@@ -100,6 +97,12 @@
 
 static int p2sb_scan_and_cache(struct pci_bus *bus, unsigned int devfn)
 {
+	/*
+	 * The BIOS prevents the P2SB device from being enumerated by the PCI
+	 * subsystem, so we need to unhide and hide it back to lookup the BAR.
+	 */
+	pci_bus_write_config_dword(bus, devfn, P2SBC, 0);
+
 	/* Scan the P2SB device and cache its BAR0 */
 	p2sb_scan_and_cache_devfn(bus, devfn);
 
@@ -107,6 +110,8 @@
 	if (devfn == P2SB_DEVFN_GOLDMONT)
 		p2sb_scan_and_cache_devfn(bus, SPI_DEVFN_GOLDMONT);
 
+	pci_bus_write_config_dword(bus, devfn, P2SBC, P2SBC_HIDE);
+
 	if (!p2sb_valid_resource(&p2sb_resources[PCI_FUNC(devfn)].res))
 		return -ENOENT;
 
@@ -132,12 +137,10 @@
 	u32 value = P2SBC_HIDE;
 	struct pci_bus *bus;
 	u16 class;
-	int ret;
+	int ret = 0;
 
 	/* Get devfn for P2SB device itself */
-	ret = p2sb_get_devfn(&devfn_p2sb);
-	if (ret)
-		return ret;
+	p2sb_get_devfn(&devfn_p2sb);
 
 	bus = p2sb_get_bus(NULL);
 	if (!bus)
@@ -157,22 +160,53 @@
 	 */
 	pci_lock_rescan_remove();
 
+	pci_bus_read_config_dword(bus, devfn_p2sb, P2SBC, &value);
+	p2sb_hidden_by_bios = value & P2SBC_HIDE;
+
 	/*
-	 * The BIOS prevents the P2SB device from being enumerated by the PCI
-	 * subsystem, so we need to unhide and hide it back to lookup the BAR.
-	 * Unhide the P2SB device here, if needed.
+	 * If the BIOS does not hide the P2SB device then its resources
+	 * are accesilble. Cache them only if the P2SB device is hidden.
 	 */
-	pci_bus_read_config_dword(bus, devfn_p2sb, P2SBC, &value);
-	if (value & P2SBC_HIDE)
-		pci_bus_write_config_dword(bus, devfn_p2sb, P2SBC, 0);
+	if (p2sb_hidden_by_bios)
+		ret = p2sb_scan_and_cache(bus, devfn_p2sb);
 
-	ret = p2sb_scan_and_cache(bus, devfn_p2sb);
+	pci_unlock_rescan_remove();
 
-	/* Hide the P2SB device, if it was hidden */
-	if (value & P2SBC_HIDE)
-		pci_bus_write_config_dword(bus, devfn_p2sb, P2SBC, P2SBC_HIDE);
+	return ret;
+}
 
-	pci_unlock_rescan_remove();
+static int p2sb_read_from_cache(struct pci_bus *bus, unsigned int devfn,
+				struct resource *mem)
+{
+	struct p2sb_res_cache *cache = &p2sb_resources[PCI_FUNC(devfn)];
+
+	if (cache->bus_dev_id != bus->dev.id)
+		return -ENODEV;
+
+	if (!p2sb_valid_resource(&cache->res))
+		return -ENOENT;
+
+	memcpy(mem, &cache->res, sizeof(*mem));
+
+	return 0;
+}
+
+static int p2sb_read_from_dev(struct pci_bus *bus, unsigned int devfn,
+			      struct resource *mem)
+{
+	struct pci_dev *pdev;
+	int ret = 0;
+
+	pdev = pci_get_slot(bus, devfn);
+	if (!pdev)
+		return -ENODEV;
+
+	if (p2sb_valid_resource(pci_resource_n(pdev, 0)))
+		p2sb_read_bar0(pdev, mem);
+	else
+		ret = -ENOENT;
+
+	pci_dev_put(pdev);
 
 	return ret;
 }
@@ -193,43 +227,36 @@
  */
 int p2sb_bar(struct pci_bus *bus, unsigned int devfn, struct resource *mem)
 {
-	struct p2sb_res_cache *cache;
-	int ret;
-
 	bus = p2sb_get_bus(bus);
 	if (!bus)
 		return -ENODEV;
 
-	if (!devfn) {
-		ret = p2sb_get_devfn(&devfn);
-		if (ret)
-			return ret;
-	}
-
-	cache = &p2sb_resources[PCI_FUNC(devfn)];
-	if (cache->bus_dev_id != bus->dev.id)
-		return -ENODEV;
+	if (!devfn)
+		p2sb_get_devfn(&devfn);
 
-	if (!p2sb_valid_resource(&cache->res))
-		return -ENOENT;
+	if (p2sb_hidden_by_bios)
+		return p2sb_read_from_cache(bus, devfn, mem);
 
-	memcpy(mem, &cache->res, sizeof(*mem));
-	return 0;
+	return p2sb_read_from_dev(bus, devfn, mem);
 }
 EXPORT_SYMBOL_GPL(p2sb_bar);
 
 static int __init p2sb_fs_init(void)
 {
-	p2sb_cache_resources();
-	return 0;
+	return p2sb_cache_resources();
 }
 
 /*
- * pci_rescan_remove_lock to avoid access to unhidden P2SB devices can
- * not be locked in sysfs pci bus rescan path because of deadlock. To
- * avoid the deadlock, access to P2SB devices with the lock at an early
- * step in kernel initialization and cache required resources. This
- * should happen after subsys_initcall which initializes PCI subsystem
- * and before device_initcall which requires P2SB resources.
+ * pci_rescan_remove_lock() can not be locked in sysfs PCI bus rescan path
+ * because of deadlock. To avoid the deadlock, access P2SB devices with the lock
+ * at an early step in kernel initialization and cache required resources.
+ *
+ * We want to run as early as possible. If the P2SB was assigned a bad BAR,
+ * we'll need to wait on pcibios_assign_resources() to fix it. So, our list of
+ * initcall dependencies looks something like this:
+ *
+ * ...
+ * subsys_initcall (pci_subsys_init)
+ * fs_initcall     (pcibios_assign_resources)
  */
-fs_initcall(p2sb_fs_init);
+fs_initcall_sync(p2sb_fs_init);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/panasonic-laptop.c
+++ linux-qcom-6.8.0/drivers/platform/x86/panasonic-laptop.c
@@ -337,7 +337,8 @@
 	}
 
 	if (pcc->num_sifr < hkey->package.count) {
-		pr_err("SQTY reports bad SINF length\n");
+		pr_err("SQTY reports bad SINF length SQTY: %lu SINF-pkg-count: %u\n",
+		       pcc->num_sifr, hkey->package.count);
 		status = AE_ERROR;
 		goto end;
 	}
@@ -601,8 +602,7 @@
 		result = 1;
 		break;
 	default:
-		result = -EIO;
-		break;
+		return -EIO;
 	}
 	return sysfs_emit(buf, "%u\n", result);
 }
@@ -748,7 +748,12 @@
 static ssize_t cdpower_show(struct device *dev, struct device_attribute *attr,
 			    char *buf)
 {
-	return sysfs_emit(buf, "%d\n", get_optd_power_state());
+	int state = get_optd_power_state();
+
+	if (state < 0)
+		return state;
+
+	return sysfs_emit(buf, "%d\n", state);
 }
 
 static ssize_t cdpower_store(struct device *dev, struct device_attribute *attr,
@@ -773,6 +778,24 @@
 static DEVICE_ATTR_RW(current_brightness);
 static DEVICE_ATTR_RW(cdpower);
 
+static umode_t pcc_sysfs_is_visible(struct kobject *kobj, struct attribute *attr, int idx)
+{
+	struct device *dev = kobj_to_dev(kobj);
+	struct acpi_device *acpi = to_acpi_device(dev);
+	struct pcc_acpi *pcc = acpi_driver_data(acpi);
+
+	if (attr == &dev_attr_mute.attr)
+		return (pcc->num_sifr > SINF_MUTE) ? attr->mode : 0;
+
+	if (attr == &dev_attr_eco_mode.attr)
+		return (pcc->num_sifr > SINF_ECO_MODE) ? attr->mode : 0;
+
+	if (attr == &dev_attr_current_brightness.attr)
+		return (pcc->num_sifr > SINF_CUR_BRIGHT) ? attr->mode : 0;
+
+	return attr->mode;
+}
+
 static struct attribute *pcc_sysfs_entries[] = {
 	&dev_attr_numbatt.attr,
 	&dev_attr_lcdtype.attr,
@@ -787,8 +810,9 @@
 };
 
 static const struct attribute_group pcc_attr_group = {
-	.name	= NULL,		/* put in device directory */
-	.attrs	= pcc_sysfs_entries,
+	.name		= NULL,		/* put in device directory */
+	.attrs		= pcc_sysfs_entries,
+	.is_visible	= pcc_sysfs_is_visible,
 };
 
 
@@ -941,12 +965,15 @@
 	if (!pcc)
 		return -EINVAL;
 
-	acpi_pcc_write_sset(pcc, SINF_MUTE, pcc->mute);
-	acpi_pcc_write_sset(pcc, SINF_ECO_MODE, pcc->eco_mode);
+	if (pcc->num_sifr > SINF_MUTE)
+		acpi_pcc_write_sset(pcc, SINF_MUTE, pcc->mute);
+	if (pcc->num_sifr > SINF_ECO_MODE)
+		acpi_pcc_write_sset(pcc, SINF_ECO_MODE, pcc->eco_mode);
 	acpi_pcc_write_sset(pcc, SINF_STICKY_KEY, pcc->sticky_key);
 	acpi_pcc_write_sset(pcc, SINF_AC_CUR_BRIGHT, pcc->ac_brightness);
 	acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, pcc->dc_brightness);
-	acpi_pcc_write_sset(pcc, SINF_CUR_BRIGHT, pcc->current_brightness);
+	if (pcc->num_sifr > SINF_CUR_BRIGHT)
+		acpi_pcc_write_sset(pcc, SINF_CUR_BRIGHT, pcc->current_brightness);
 
 	return 0;
 }
@@ -963,11 +990,21 @@
 
 	num_sifr = acpi_pcc_get_sqty(device);
 
-	if (num_sifr < 0 || num_sifr > 255) {
-		pr_err("num_sifr out of range");
+	/*
+	 * pcc->sinf is expected to at least have the AC+DC brightness entries.
+	 * Accesses to higher SINF entries are checked against num_sifr.
+	 */
+	if (num_sifr <= SINF_DC_CUR_BRIGHT || num_sifr > 255) {
+		pr_err("num_sifr %d out of range %d - 255\n", num_sifr, SINF_DC_CUR_BRIGHT + 1);
 		return -ENODEV;
 	}
 
+	/*
+	 * Some DSDT-s have an off-by-one bug where the SINF package count is
+	 * one higher than the SQTY reported value, allocate 1 entry extra.
+	 */
+	num_sifr++;
+
 	pcc = kzalloc(sizeof(struct pcc_acpi), GFP_KERNEL);
 	if (!pcc) {
 		pr_err("Couldn't allocate mem for pcc");
@@ -1020,11 +1057,14 @@
 	acpi_pcc_write_sset(pcc, SINF_STICKY_KEY, 0);
 	pcc->sticky_key = 0;
 
-	pcc->eco_mode = pcc->sinf[SINF_ECO_MODE];
-	pcc->mute = pcc->sinf[SINF_MUTE];
 	pcc->ac_brightness = pcc->sinf[SINF_AC_CUR_BRIGHT];
 	pcc->dc_brightness = pcc->sinf[SINF_DC_CUR_BRIGHT];
-	pcc->current_brightness = pcc->sinf[SINF_CUR_BRIGHT];
+	if (pcc->num_sifr > SINF_MUTE)
+		pcc->mute = pcc->sinf[SINF_MUTE];
+	if (pcc->num_sifr > SINF_ECO_MODE)
+		pcc->eco_mode = pcc->sinf[SINF_ECO_MODE];
+	if (pcc->num_sifr > SINF_CUR_BRIGHT)
+		pcc->current_brightness = pcc->sinf[SINF_CUR_BRIGHT];
 
 	/* add sysfs attributes */
 	result = sysfs_create_group(&device->dev.kobj, &pcc_attr_group);
--- linux-qcom-6.8.0.orig/drivers/platform/x86/thinkpad_acpi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/thinkpad_acpi.c
@@ -3042,10 +3042,9 @@
 
 static void hotkey_exit(void)
 {
-#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
 	mutex_lock(&hotkey_mutex);
+#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
 	hotkey_poll_stop_sync();
-	mutex_unlock(&hotkey_mutex);
 #endif
 	dbg_printk(TPACPI_DBG_EXIT | TPACPI_DBG_HKEY,
 		   "restoring original HKEY status and mask\n");
@@ -3055,6 +3054,8 @@
 	      hotkey_mask_set(hotkey_orig_mask)) |
 	     hotkey_status_set(false)) != 0)
 		pr_err("failed to restore hot key mask to BIOS defaults\n");
+
+	mutex_unlock(&hotkey_mutex);
 }
 
 static void __init hotkey_unmap(const unsigned int scancode)
@@ -8012,6 +8013,7 @@
 static int fan_watchdog_maxinterval;
 
 static bool fan_with_ns_addr;
+static bool ecfw_with_fan_dec_rpm;
 
 static struct mutex fan_mutex;
 
@@ -8654,7 +8656,11 @@
 	if (res < 0)
 		return res;
 
-	return sysfs_emit(buf, "%u\n", speed);
+	/* Check for fan speeds displayed in hexadecimal */
+	if (!ecfw_with_fan_dec_rpm)
+		return sysfs_emit(buf, "%u\n", speed);
+	else
+		return sysfs_emit(buf, "%x\n", speed);
 }
 
 static DEVICE_ATTR(fan1_input, S_IRUGO, fan_fan1_input_show, NULL);
@@ -8671,7 +8677,11 @@
 	if (res < 0)
 		return res;
 
-	return sysfs_emit(buf, "%u\n", speed);
+	/* Check for fan speeds displayed in hexadecimal */
+	if (!ecfw_with_fan_dec_rpm)
+		return sysfs_emit(buf, "%u\n", speed);
+	else
+		return sysfs_emit(buf, "%x\n", speed);
 }
 
 static DEVICE_ATTR(fan2_input, S_IRUGO, fan_fan2_input_show, NULL);
@@ -8747,6 +8757,7 @@
 #define TPACPI_FAN_2CTL		0x0004		/* selects fan2 control */
 #define TPACPI_FAN_NOFAN	0x0008		/* no fan available */
 #define TPACPI_FAN_NS		0x0010		/* For EC with non-Standard register addresses */
+#define TPACPI_FAN_DECRPM	0x0020		/* For ECFW's with RPM in register as decimal */
 
 static const struct tpacpi_quirk fan_quirk_table[] __initconst = {
 	TPACPI_QEC_IBM('1', 'Y', TPACPI_FAN_Q1),
@@ -8768,6 +8779,7 @@
 	TPACPI_Q_LNV3('R', '1', 'F', TPACPI_FAN_NS),	/* L13 Yoga Gen 2 */
 	TPACPI_Q_LNV3('N', '2', 'U', TPACPI_FAN_NS),	/* X13 Yoga Gen 2*/
 	TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN),	/* X1 Tablet (2nd gen) */
+	TPACPI_Q_LNV3('R', '0', 'Q', TPACPI_FAN_DECRPM),/* L480 */
 };
 
 static int __init fan_init(struct ibm_init_struct *iibm)
@@ -8808,6 +8820,13 @@
 		tp_features.fan_ctrl_status_undef = 1;
 	}
 
+	/* Check for the EC/BIOS with RPM reported in decimal*/
+	if (quirks & TPACPI_FAN_DECRPM) {
+		pr_info("ECFW with fan RPM as decimal in EC register\n");
+		ecfw_with_fan_dec_rpm = 1;
+		tp_features.fan_ctrl_status_undef = 1;
+	}
+
 	if (gfan_handle) {
 		/* 570, 600e/x, 770e, 770x */
 		fan_status_access_mode = TPACPI_FAN_RD_ACPI_GFAN;
@@ -9019,7 +9038,11 @@
 		if (rc < 0)
 			return rc;
 
-		seq_printf(m, "speed:\t\t%d\n", speed);
+		/* Check for fan speeds displayed in hexadecimal */
+		if (!ecfw_with_fan_dec_rpm)
+			seq_printf(m, "speed:\t\t%d\n", speed);
+		else
+			seq_printf(m, "speed:\t\t%x\n", speed);
 
 		if (fan_status_access_mode == TPACPI_FAN_RD_TPEC_NS) {
 			/*
--- linux-qcom-6.8.0.orig/drivers/platform/x86/toshiba_acpi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/toshiba_acpi.c
@@ -57,6 +57,11 @@
 MODULE_PARM_DESC(turn_on_panel_on_resume,
 	"Call HCI_PANEL_POWER_ON on resume (-1 = auto, 0 = no, 1 = yes");
 
+static int hci_hotkey_quickstart = -1;
+module_param(hci_hotkey_quickstart, int, 0644);
+MODULE_PARM_DESC(hci_hotkey_quickstart,
+		 "Call HCI_HOTKEY_EVENT with value 0x5 for quickstart button support (-1 = auto, 0 = no, 1 = yes");
+
 #define TOSHIBA_WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100"
 
 /* Scan code for Fn key on TOS1900 models */
@@ -136,6 +141,7 @@
 #define HCI_ACCEL_MASK			0x7fff
 #define HCI_ACCEL_DIRECTION_MASK	0x8000
 #define HCI_HOTKEY_DISABLE		0x0b
+#define HCI_HOTKEY_ENABLE_QUICKSTART	0x05
 #define HCI_HOTKEY_ENABLE		0x09
 #define HCI_HOTKEY_SPECIAL_FUNCTIONS	0x10
 #define HCI_LCD_BRIGHTNESS_BITS		3
@@ -2730,10 +2736,15 @@
 		return -ENODEV;
 
 	/*
+	 * Enable quickstart buttons if supported.
+	 *
 	 * Enable the "Special Functions" mode only if they are
 	 * supported and if they are activated.
 	 */
-	if (dev->kbd_function_keys_supported && dev->special_functions)
+	if (hci_hotkey_quickstart)
+		result = hci_write(dev, HCI_HOTKEY_EVENT,
+				   HCI_HOTKEY_ENABLE_QUICKSTART);
+	else if (dev->kbd_function_keys_supported && dev->special_functions)
 		result = hci_write(dev, HCI_HOTKEY_EVENT,
 				   HCI_HOTKEY_SPECIAL_FUNCTIONS);
 	else
@@ -3257,7 +3268,14 @@
  * works. toshiba_acpi_resume() uses HCI_PANEL_POWER_ON to avoid changing
  * the configured brightness level.
  */
-static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = {
+#define QUIRK_TURN_ON_PANEL_ON_RESUME		BIT(0)
+/*
+ * Some Toshibas use "quickstart" keys. On these, HCI_HOTKEY_EVENT must use
+ * the value HCI_HOTKEY_ENABLE_QUICKSTART.
+ */
+#define QUIRK_HCI_HOTKEY_QUICKSTART		BIT(1)
+
+static const struct dmi_system_id toshiba_dmi_quirks[] __initconst = {
 	{
 	 /* Toshiba Portégé R700 */
 	 /* https://bugzilla.kernel.org/show_bug.cgi?id=21012 */
@@ -3265,6 +3283,7 @@
 		DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 		DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE R700"),
 		},
+	 .driver_data = (void *)QUIRK_TURN_ON_PANEL_ON_RESUME,
 	},
 	{
 	 /* Toshiba Satellite/Portégé R830 */
@@ -3274,6 +3293,7 @@
 		DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 		DMI_MATCH(DMI_PRODUCT_NAME, "R830"),
 		},
+	 .driver_data = (void *)QUIRK_TURN_ON_PANEL_ON_RESUME,
 	},
 	{
 	 /* Toshiba Satellite/Portégé Z830 */
@@ -3281,7 +3301,9 @@
 		DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 		DMI_MATCH(DMI_PRODUCT_NAME, "Z830"),
 		},
+	 .driver_data = (void *)(QUIRK_TURN_ON_PANEL_ON_RESUME | QUIRK_HCI_HOTKEY_QUICKSTART),
 	},
+	{ }
 };
 
 static int toshiba_acpi_add(struct acpi_device *acpi_dev)
@@ -3441,9 +3463,6 @@
 	}
 #endif
 
-	if (turn_on_panel_on_resume == -1)
-		turn_on_panel_on_resume = dmi_check_system(turn_on_panel_on_resume_dmi_ids);
-
 	toshiba_wwan_available(dev);
 	if (dev->wwan_supported)
 		toshiba_acpi_setup_wwan_rfkill(dev);
@@ -3592,10 +3611,27 @@
 	.drv.pm	= &toshiba_acpi_pm,
 };
 
+static void __init toshiba_dmi_init(void)
+{
+	const struct dmi_system_id *dmi_id;
+	long quirks = 0;
+
+	dmi_id = dmi_first_match(toshiba_dmi_quirks);
+	if (dmi_id)
+		quirks = (long)dmi_id->driver_data;
+
+	if (turn_on_panel_on_resume == -1)
+		turn_on_panel_on_resume = !!(quirks & QUIRK_TURN_ON_PANEL_ON_RESUME);
+
+	if (hci_hotkey_quickstart == -1)
+		hci_hotkey_quickstart = !!(quirks & QUIRK_HCI_HOTKEY_QUICKSTART);
+}
+
 static int __init toshiba_acpi_init(void)
 {
 	int ret;
 
+	toshiba_dmi_init();
 	toshiba_proc_dir = proc_mkdir(PROC_TOSHIBA, acpi_root_dir);
 	if (!toshiba_proc_dir) {
 		pr_err("Unable to create proc dir " PROC_TOSHIBA "\n");
--- linux-qcom-6.8.0.orig/drivers/platform/x86/touchscreen_dmi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/touchscreen_dmi.c
@@ -880,6 +880,21 @@
 	.properties = rwc_nanote_p8_props,
 };
 
+static const struct property_entry rwc_nanote_next_props[] = {
+	PROPERTY_ENTRY_U32("touchscreen-min-x", 5),
+	PROPERTY_ENTRY_U32("touchscreen-min-y", 5),
+	PROPERTY_ENTRY_U32("touchscreen-size-x", 1785),
+	PROPERTY_ENTRY_U32("touchscreen-size-y", 1145),
+	PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"),
+	PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-rwc-nanote-next.fw"),
+	{ }
+};
+
+static const struct ts_dmi_data rwc_nanote_next_data = {
+	.acpi_name = "MSSL1680:00",
+	.properties = rwc_nanote_next_props,
+};
+
 static const struct property_entry schneider_sct101ctm_props[] = {
 	PROPERTY_ENTRY_U32("touchscreen-size-x", 1715),
 	PROPERTY_ENTRY_U32("touchscreen-size-y", 1140),
@@ -897,6 +912,22 @@
 	.properties	= schneider_sct101ctm_props,
 };
 
+static const struct property_entry globalspace_solt_ivw116_props[] = {
+	PROPERTY_ENTRY_U32("touchscreen-min-x", 7),
+	PROPERTY_ENTRY_U32("touchscreen-min-y", 22),
+	PROPERTY_ENTRY_U32("touchscreen-size-x", 1723),
+	PROPERTY_ENTRY_U32("touchscreen-size-y", 1077),
+	PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-globalspace-solt-ivw116.fw"),
+	PROPERTY_ENTRY_U32("silead,max-fingers", 10),
+	PROPERTY_ENTRY_BOOL("silead,home-button"),
+	{ }
+};
+
+static const struct ts_dmi_data globalspace_solt_ivw116_data = {
+	.acpi_name	= "MSSL1680:00",
+	.properties	= globalspace_solt_ivw116_props,
+};
+
 static const struct property_entry techbite_arc_11_6_props[] = {
 	PROPERTY_ENTRY_U32("touchscreen-min-x", 5),
 	PROPERTY_ENTRY_U32("touchscreen-min-y", 7),
@@ -1218,6 +1249,15 @@
 		},
 	},
 	{
+		/* Chuwi Vi8 dual-boot (CWI506) */
+		.driver_data = (void *)&chuwi_vi8_data,
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "i86"),
+			DMI_MATCH(DMI_BIOS_VERSION, "CHUWI2.D86JHBNR02"),
+		},
+	},
+	{
 		/* Chuwi Vi8 Plus (CWI519) */
 		.driver_data = (void *)&chuwi_vi8_plus_data,
 		.matches = {
@@ -1377,6 +1417,17 @@
 		},
 	},
 	{
+		/* Jumper EZpad 6s Pro */
+		.driver_data = (void *)&jumper_ezpad_6_pro_b_data,
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Jumper"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Ezpad"),
+			/* Above matches are too generic, add bios match */
+			DMI_MATCH(DMI_BIOS_VERSION, "E.WSA116_8.E1.042.bin"),
+			DMI_MATCH(DMI_BIOS_DATE, "01/08/2020"),
+		},
+	},
+	{
 		/* Jumper EZpad 6 m4 */
 		.driver_data = (void *)&jumper_ezpad_6_m4_data,
 		.matches = {
@@ -1608,6 +1659,17 @@
 		},
 	},
 	{
+		/* RWC NANOTE NEXT */
+		.driver_data = (void *)&rwc_nanote_next_data,
+		.matches = {
+			DMI_MATCH(DMI_PRODUCT_NAME, "To be filled by O.E.M."),
+			DMI_MATCH(DMI_BOARD_NAME, "To be filled by O.E.M."),
+			DMI_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
+			/* Above matches are too generic, add bios-version match */
+			DMI_MATCH(DMI_BIOS_VERSION, "S8A70R100-V005"),
+		},
+	},
+	{
 		/* Schneider SCT101CTM */
 		.driver_data = (void *)&schneider_sct101ctm_data,
 		.matches = {
@@ -1616,6 +1678,15 @@
 		},
 	},
 	{
+		/* GlobalSpace SoLT IVW 11.6" */
+		.driver_data = (void *)&globalspace_solt_ivw116_data,
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Globalspace Tech Pvt Ltd"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "SolTIVW"),
+			DMI_MATCH(DMI_PRODUCT_SKU, "PN20170413488"),
+		},
+	},
+	{
 		/* Techbite Arc 11.6 */
 		.driver_data = (void *)&techbite_arc_11_6_data,
 		.matches = {
--- linux-qcom-6.8.0.orig/drivers/platform/x86/wireless-hotkey.c
+++ linux-qcom-6.8.0/drivers/platform/x86/wireless-hotkey.c
@@ -19,6 +19,7 @@
 MODULE_ALIAS("acpi*:HPQ6001:*");
 MODULE_ALIAS("acpi*:WSTADEF:*");
 MODULE_ALIAS("acpi*:AMDI0051:*");
+MODULE_ALIAS("acpi*:LGEX0815:*");
 
 struct wl_button {
 	struct input_dev *input_dev;
@@ -29,6 +30,7 @@
 	{"HPQ6001", 0},
 	{"WSTADEF", 0},
 	{"AMDI0051", 0},
+	{"LGEX0815", 0},
 	{"", 0},
 };
 
--- linux-qcom-6.8.0.orig/drivers/platform/x86/x86-android-tablets/core.c
+++ linux-qcom-6.8.0/drivers/platform/x86/x86-android-tablets/core.c
@@ -278,25 +278,25 @@
 {
 	int i;
 
-	for (i = 0; i < serdev_count; i++) {
+	for (i = serdev_count - 1; i >= 0; i--) {
 		if (serdevs[i])
 			serdev_device_remove(serdevs[i]);
 	}
 
 	kfree(serdevs);
 
-	for (i = 0; i < pdev_count; i++)
+	for (i = pdev_count - 1; i >= 0; i--)
 		platform_device_unregister(pdevs[i]);
 
 	kfree(pdevs);
 	kfree(buttons);
 
-	for (i = 0; i < spi_dev_count; i++)
+	for (i = spi_dev_count - 1; i >= 0; i--)
 		spi_unregister_device(spi_devs[i]);
 
 	kfree(spi_devs);
 
-	for (i = 0; i < i2c_client_count; i++)
+	for (i = i2c_client_count - 1; i >= 0; i--)
 		i2c_unregister_device(i2c_clients[i]);
 
 	kfree(i2c_clients);
@@ -392,8 +392,9 @@
 	for (i = 0; i < pdev_count; i++) {
 		pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]);
 		if (IS_ERR(pdevs[i])) {
+			ret = PTR_ERR(pdevs[i]);
 			x86_android_tablet_remove(pdev);
-			return PTR_ERR(pdevs[i]);
+			return ret;
 		}
 	}
 
@@ -445,8 +446,9 @@
 								  PLATFORM_DEVID_AUTO,
 								  &pdata, sizeof(pdata));
 		if (IS_ERR(pdevs[pdev_count])) {
+			ret = PTR_ERR(pdevs[pdev_count]);
 			x86_android_tablet_remove(pdev);
-			return PTR_ERR(pdevs[pdev_count]);
+			return ret;
 		}
 		pdev_count++;
 	}
--- linux-qcom-6.8.0.orig/drivers/platform/x86/x86-android-tablets/dmi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/x86-android-tablets/dmi.c
@@ -106,6 +106,24 @@
 	},
 	{
 		/*
+		 * Lenovo Yoga Tablet 2 Pro 1380F/L (13") This has more or less
+		 * the same BIOS as the 830F/L or 1050F/L (8" and 10") below,
+		 * but unlike the 8" / 10" models which share the same mainboard
+		 * this model has a different mainboard.
+		 * This match for the 13" model MUST come before the 8" + 10"
+		 * match since that one will also match the 13" model!
+		 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Intel Corp."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "VALLEYVIEW C0 PLATFORM"),
+			DMI_MATCH(DMI_BOARD_NAME, "BYT-T FFD8"),
+			/* Full match so as to NOT match the 830/1050 BIOS */
+			DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21.X64.0005.R00.1504101516"),
+		},
+		.driver_data = (void *)&lenovo_yoga_tab2_1380_info,
+	},
+	{
+		/*
 		 * Lenovo Yoga Tablet 2 830F/L or 1050F/L (The 8" and 10"
 		 * Lenovo Yoga Tablet 2 use the same mainboard)
 		 */
@@ -122,7 +140,6 @@
 		/* Lenovo Yoga Tab 3 Pro YT3-X90F */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
 			DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"),
 		},
 		.driver_data = (void *)&lenovo_yt3_info,
--- linux-qcom-6.8.0.orig/drivers/platform/x86/x86-android-tablets/lenovo.c
+++ linux-qcom-6.8.0/drivers/platform/x86/x86-android-tablets/lenovo.c
@@ -19,6 +19,7 @@
 #include <linux/pinctrl/machine.h>
 #include <linux/platform_data/lp855x.h>
 #include <linux/platform_device.h>
+#include <linux/power/bq24190_charger.h>
 #include <linux/reboot.h>
 #include <linux/rmi.h>
 #include <linux/spi/spi.h>
@@ -565,6 +566,221 @@
 	}
 }
 
+/*
+ * Lenovo Yoga Tablet 2 Pro 1380F/L
+ *
+ * The Lenovo Yoga Tablet 2 Pro 1380F/L mostly has the same design as the 830F/L
+ * and the 1050F/L so this re-uses some of the handling for that from above.
+ */
+static const char * const lc824206xa_chg_det_psy[] = { "lc824206xa-charger-detect" };
+
+static const struct property_entry lenovo_yoga_tab2_1380_bq24190_props[] = {
+	PROPERTY_ENTRY_STRING_ARRAY("supplied-from", lc824206xa_chg_det_psy),
+	PROPERTY_ENTRY_REF("monitored-battery", &generic_lipo_hv_4v35_battery_node),
+	PROPERTY_ENTRY_BOOL("omit-battery-class"),
+	PROPERTY_ENTRY_BOOL("disable-reset"),
+	{ }
+};
+
+static const struct software_node lenovo_yoga_tab2_1380_bq24190_node = {
+	.properties = lenovo_yoga_tab2_1380_bq24190_props,
+};
+
+/* For enabling the bq24190 5V boost based on id-pin */
+static struct regulator_consumer_supply lc824206xa_consumer = {
+	.supply = "vbus",
+	.dev_name = "i2c-lc824206xa",
+};
+
+static const struct regulator_init_data lenovo_yoga_tab2_1380_bq24190_vbus_init_data = {
+	.constraints = {
+		.name = "bq24190_vbus",
+		.valid_ops_mask = REGULATOR_CHANGE_STATUS,
+	},
+	.consumer_supplies = &lc824206xa_consumer,
+	.num_consumer_supplies = 1,
+};
+
+struct bq24190_platform_data lenovo_yoga_tab2_1380_bq24190_pdata = {
+	.regulator_init_data = &lenovo_yoga_tab2_1380_bq24190_vbus_init_data,
+};
+
+static const struct property_entry lenovo_yoga_tab2_1380_lc824206xa_props[] = {
+	PROPERTY_ENTRY_BOOL("onnn,enable-miclr-for-dcp"),
+	{ }
+};
+
+static const struct software_node lenovo_yoga_tab2_1380_lc824206xa_node = {
+	.properties = lenovo_yoga_tab2_1380_lc824206xa_props,
+};
+
+static const char * const lenovo_yoga_tab2_1380_lms303d_mount_matrix[] = {
+	"0", "-1", "0",
+	"-1", "0", "0",
+	"0", "0", "1"
+};
+
+static const struct property_entry lenovo_yoga_tab2_1380_lms303d_props[] = {
+	PROPERTY_ENTRY_STRING_ARRAY("mount-matrix", lenovo_yoga_tab2_1380_lms303d_mount_matrix),
+	{ }
+};
+
+static const struct software_node lenovo_yoga_tab2_1380_lms303d_node = {
+	.properties = lenovo_yoga_tab2_1380_lms303d_props,
+};
+
+static const struct x86_i2c_client_info lenovo_yoga_tab2_1380_i2c_clients[] __initconst = {
+	{
+		/* BQ27541 fuel-gauge */
+		.board_info = {
+			.type = "bq27541",
+			.addr = 0x55,
+			.dev_name = "bq27541",
+			.swnode = &fg_bq24190_supply_node,
+		},
+		.adapter_path = "\\_SB_.I2C1",
+	}, {
+		/* bq24292i battery charger */
+		.board_info = {
+			.type = "bq24190",
+			.addr = 0x6b,
+			.dev_name = "bq24292i",
+			.swnode = &lenovo_yoga_tab2_1380_bq24190_node,
+			.platform_data = &lenovo_yoga_tab2_1380_bq24190_pdata,
+		},
+		.adapter_path = "\\_SB_.I2C1",
+		.irq_data = {
+			.type = X86_ACPI_IRQ_TYPE_GPIOINT,
+			.chip = "INT33FC:02",
+			.index = 2,
+			.trigger = ACPI_EDGE_SENSITIVE,
+			.polarity = ACPI_ACTIVE_HIGH,
+			.con_id = "bq24292i_irq",
+		},
+	}, {
+		/* LP8557 Backlight controller */
+		.board_info = {
+			.type = "lp8557",
+			.addr = 0x2c,
+			.dev_name = "lp8557",
+			.platform_data = &lenovo_lp8557_pwm_and_reg_pdata,
+		},
+		.adapter_path = "\\_SB_.I2C3",
+	}, {
+		/* LC824206XA Micro USB Switch */
+		.board_info = {
+			.type = "lc824206xa",
+			.addr = 0x48,
+			.dev_name = "lc824206xa",
+			.swnode = &lenovo_yoga_tab2_1380_lc824206xa_node,
+		},
+		.adapter_path = "\\_SB_.I2C3",
+		.irq_data = {
+			.type = X86_ACPI_IRQ_TYPE_GPIOINT,
+			.chip = "INT33FC:02",
+			.index = 1,
+			.trigger = ACPI_LEVEL_SENSITIVE,
+			.polarity = ACPI_ACTIVE_LOW,
+			.con_id = "lc824206xa_irq",
+		},
+	}, {
+		/* AL3320A ambient light sensor */
+		.board_info = {
+			.type = "al3320a",
+			.addr = 0x1c,
+			.dev_name = "al3320a",
+		},
+		.adapter_path = "\\_SB_.I2C5",
+	}, {
+		/* LSM303DA accelerometer + magnetometer */
+		.board_info = {
+			.type = "lsm303d",
+			.addr = 0x1d,
+			.dev_name = "lsm303d",
+			.swnode = &lenovo_yoga_tab2_1380_lms303d_node,
+		},
+		.adapter_path = "\\_SB_.I2C5",
+	}, {
+		/* Synaptics RMI touchscreen */
+		.board_info = {
+			.type = "rmi4_i2c",
+			.addr = 0x38,
+			.dev_name = "rmi4_i2c",
+			.platform_data = &lenovo_yoga_tab2_830_1050_rmi_pdata,
+		},
+		.adapter_path = "\\_SB_.I2C6",
+		.irq_data = {
+			.type = X86_ACPI_IRQ_TYPE_APIC,
+			.index = 0x45,
+			.trigger = ACPI_EDGE_SENSITIVE,
+			.polarity = ACPI_ACTIVE_HIGH,
+		},
+	}
+};
+
+static const struct platform_device_info lenovo_yoga_tab2_1380_pdevs[] __initconst = {
+	{
+		/* For the Tablet 2 Pro 1380's custom fast charging driver */
+		.name = "lenovo-yoga-tab2-pro-1380-fastcharger",
+		.id = PLATFORM_DEVID_NONE,
+	},
+};
+
+const char * const lenovo_yoga_tab2_1380_modules[] __initconst = {
+	"bq24190_charger",            /* For the Vbus regulator for lc824206xa */
+	NULL
+};
+
+static int __init lenovo_yoga_tab2_1380_init(void)
+{
+	int ret;
+
+	/* To verify that the DMI matching works vs the 830 / 1050 models */
+	pr_info("detected Lenovo Yoga Tablet 2 Pro 1380F/L\n");
+
+	ret = lenovo_yoga_tab2_830_1050_init_codec();
+	if (ret)
+		return ret;
+
+	/* SYS_OFF_PRIO_FIRMWARE + 1 so that it runs before acpi_power_off */
+	lenovo_yoga_tab2_830_1050_sys_off_handler =
+		register_sys_off_handler(SYS_OFF_MODE_POWER_OFF, SYS_OFF_PRIO_FIRMWARE + 1,
+					 lenovo_yoga_tab2_830_1050_power_off, NULL);
+	if (IS_ERR(lenovo_yoga_tab2_830_1050_sys_off_handler))
+		return PTR_ERR(lenovo_yoga_tab2_830_1050_sys_off_handler);
+
+	return 0;
+}
+
+static struct gpiod_lookup_table lenovo_yoga_tab2_1380_fc_gpios = {
+	.dev_id = "serial0-0",
+	.table = {
+		GPIO_LOOKUP("INT33FC:00", 57, "uart3_txd", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("INT33FC:00", 61, "uart3_rxd", GPIO_ACTIVE_HIGH),
+		{ }
+	},
+};
+
+static struct gpiod_lookup_table * const lenovo_yoga_tab2_1380_gpios[] = {
+	&lenovo_yoga_tab2_830_1050_codec_gpios,
+	&lenovo_yoga_tab2_1380_fc_gpios,
+	NULL
+};
+
+const struct x86_dev_info lenovo_yoga_tab2_1380_info __initconst = {
+	.i2c_client_info = lenovo_yoga_tab2_1380_i2c_clients,
+	.i2c_client_count = ARRAY_SIZE(lenovo_yoga_tab2_1380_i2c_clients),
+	.pdev_info = lenovo_yoga_tab2_1380_pdevs,
+	.pdev_count = ARRAY_SIZE(lenovo_yoga_tab2_1380_pdevs),
+	.gpio_button = &lenovo_yoga_tab2_830_1050_lid,
+	.gpio_button_count = 1,
+	.gpiod_lookup_tables = lenovo_yoga_tab2_1380_gpios,
+	.bat_swnode = &generic_lipo_hv_4v35_battery_node,
+	.modules = lenovo_yoga_tab2_1380_modules,
+	.init = lenovo_yoga_tab2_1380_init,
+	.exit = lenovo_yoga_tab2_830_1050_exit,
+};
+
 /* Lenovo Yoga Tab 3 Pro YT3-X90F */
 
 /*
--- linux-qcom-6.8.0.orig/drivers/platform/x86/x86-android-tablets/x86-android-tablets.h
+++ linux-qcom-6.8.0/drivers/platform/x86/x86-android-tablets/x86-android-tablets.h
@@ -112,6 +112,7 @@
 extern const struct x86_dev_info lenovo_yogabook_x90_info;
 extern const struct x86_dev_info lenovo_yogabook_x91_info;
 extern const struct x86_dev_info lenovo_yoga_tab2_830_1050_info;
+extern const struct x86_dev_info lenovo_yoga_tab2_1380_info;
 extern const struct x86_dev_info lenovo_yt3_info;
 extern const struct x86_dev_info medion_lifetab_s10346_info;
 extern const struct x86_dev_info nextbook_ares8_info;
--- linux-qcom-6.8.0.orig/drivers/platform/x86/xiaomi-wmi.c
+++ linux-qcom-6.8.0/drivers/platform/x86/xiaomi-wmi.c
@@ -2,8 +2,10 @@
 /* WMI driver for Xiaomi Laptops */
 
 #include <linux/acpi.h>
+#include <linux/device.h>
 #include <linux/input.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/wmi.h>
 
 #include <uapi/linux/input-event-codes.h>
@@ -20,12 +22,21 @@
 
 struct xiaomi_wmi {
 	struct input_dev *input_dev;
+	struct mutex key_lock;	/* Protects the key event sequence */
 	unsigned int key_code;
 };
 
+static void xiaomi_mutex_destroy(void *data)
+{
+	struct mutex *lock = data;
+
+	mutex_destroy(lock);
+}
+
 static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context)
 {
 	struct xiaomi_wmi *data;
+	int ret;
 
 	if (wdev == NULL || context == NULL)
 		return -EINVAL;
@@ -35,6 +46,11 @@
 		return -ENOMEM;
 	dev_set_drvdata(&wdev->dev, data);
 
+	mutex_init(&data->key_lock);
+	ret = devm_add_action_or_reset(&wdev->dev, xiaomi_mutex_destroy, &data->key_lock);
+	if (ret < 0)
+		return ret;
+
 	data->input_dev = devm_input_allocate_device(&wdev->dev);
 	if (data->input_dev == NULL)
 		return -ENOMEM;
@@ -59,10 +75,12 @@
 	if (data == NULL)
 		return;
 
+	mutex_lock(&data->key_lock);
 	input_report_key(data->input_dev, data->key_code, 1);
 	input_sync(data->input_dev);
 	input_report_key(data->input_dev, data->key_code, 0);
 	input_sync(data->input_dev);
+	mutex_unlock(&data->key_lock);
 }
 
 static const struct wmi_device_id xiaomi_wmi_id_table[] = {
--- linux-qcom-6.8.0.orig/drivers/pmdomain/arm/scmi_perf_domain.c
+++ linux-qcom-6.8.0/drivers/pmdomain/arm/scmi_perf_domain.c
@@ -125,7 +125,8 @@
 		scmi_pd->ph = ph;
 		scmi_pd->genpd.name = scmi_pd->info->name;
 		scmi_pd->genpd.flags = GENPD_FLAG_ALWAYS_ON |
-				       GENPD_FLAG_OPP_TABLE_FW;
+				       GENPD_FLAG_OPP_TABLE_FW |
+				       GENPD_FLAG_DEV_NAME_FW;
 		scmi_pd->genpd.set_performance_state = scmi_pd_set_perf_state;
 		scmi_pd->genpd.attach_dev = scmi_pd_attach_dev;
 		scmi_pd->genpd.detach_dev = scmi_pd_detach_dev;
--- linux-qcom-6.8.0.orig/drivers/pmdomain/core.c
+++ linux-qcom-6.8.0/drivers/pmdomain/core.c
@@ -7,6 +7,7 @@
 #define pr_fmt(fmt) "PM: " fmt
 
 #include <linux/delay.h>
+#include <linux/idr.h>
 #include <linux/kernel.h>
 #include <linux/io.h>
 #include <linux/platform_device.h>
@@ -23,6 +24,9 @@
 #include <linux/cpu.h>
 #include <linux/debugfs.h>
 
+/* Provides a unique ID for each genpd device */
+static DEFINE_IDA(genpd_ida);
+
 #define GENPD_RETRY_MAX_MS	250		/* Approximate */
 
 #define GENPD_DEV_CALLBACK(genpd, type, callback, dev)		\
@@ -129,6 +133,7 @@
 #define genpd_is_cpu_domain(genpd)	(genpd->flags & GENPD_FLAG_CPU_DOMAIN)
 #define genpd_is_rpm_always_on(genpd)	(genpd->flags & GENPD_FLAG_RPM_ALWAYS_ON)
 #define genpd_is_opp_table_fw(genpd)	(genpd->flags & GENPD_FLAG_OPP_TABLE_FW)
+#define genpd_is_dev_name_fw(genpd)	(genpd->flags & GENPD_FLAG_DEV_NAME_FW)
 
 static inline bool irq_safe_dev_in_sleep_domain(struct device *dev,
 		const struct generic_pm_domain *genpd)
@@ -147,7 +152,7 @@
 
 	if (ret)
 		dev_warn_once(dev, "PM domain %s will not be powered off\n",
-				genpd->name);
+			      dev_name(&genpd->dev));
 
 	return ret;
 }
@@ -184,6 +189,16 @@
 	return pd_to_genpd(dev->pm_domain);
 }
 
+struct device *dev_to_genpd_dev(struct device *dev)
+{
+	struct generic_pm_domain *genpd = dev_to_genpd(dev);
+
+	if (IS_ERR(genpd))
+		return ERR_CAST(genpd);
+
+	return &genpd->dev;
+}
+
 static int genpd_stop_dev(const struct generic_pm_domain *genpd,
 			  struct device *dev)
 {
@@ -222,7 +237,7 @@
 	if (!genpd_debugfs_dir)
 		return;
 
-	debugfs_lookup_and_remove(genpd->name, genpd_debugfs_dir);
+	debugfs_lookup_and_remove(dev_name(&genpd->dev), genpd_debugfs_dir);
 }
 
 static void genpd_update_accounting(struct generic_pm_domain *genpd)
@@ -587,7 +602,7 @@
 	genpd->states[state_idx].power_on_latency_ns = elapsed_ns;
 	genpd->gd->max_off_time_changed = true;
 	pr_debug("%s: Power-%s latency exceeded, new value %lld ns\n",
-		 genpd->name, "on", elapsed_ns);
+		 dev_name(&genpd->dev), "on", elapsed_ns);
 
 out:
 	raw_notifier_call_chain(&genpd->power_notifiers, GENPD_NOTIFY_ON, NULL);
@@ -638,7 +653,7 @@
 	genpd->states[state_idx].power_off_latency_ns = elapsed_ns;
 	genpd->gd->max_off_time_changed = true;
 	pr_debug("%s: Power-%s latency exceeded, new value %lld ns\n",
-		 genpd->name, "off", elapsed_ns);
+		 dev_name(&genpd->dev), "off", elapsed_ns);
 
 out:
 	raw_notifier_call_chain(&genpd->power_notifiers, GENPD_NOTIFY_OFF,
@@ -1652,7 +1667,6 @@
 	genpd_lock(genpd);
 
 	genpd_set_cpumask(genpd, gpd_data->cpu);
-	dev_pm_domain_set(dev, &genpd->domain);
 
 	genpd->device_count++;
 	if (gd)
@@ -1661,6 +1675,7 @@
 	list_add_tail(&gpd_data->base.list_node, &genpd->dev_list);
 
 	genpd_unlock(genpd);
+	dev_pm_domain_set(dev, &genpd->domain);
  out:
 	if (ret)
 		genpd_free_dev_data(dev, gpd_data);
@@ -1717,12 +1732,13 @@
 		genpd->gd->max_off_time_changed = true;
 
 	genpd_clear_cpumask(genpd, gpd_data->cpu);
-	dev_pm_domain_set(dev, NULL);
 
 	list_del_init(&pdd->list_node);
 
 	genpd_unlock(genpd);
 
+	dev_pm_domain_set(dev, NULL);
+
 	if (genpd->detach_dev)
 		genpd->detach_dev(genpd, dev);
 
@@ -1791,7 +1807,7 @@
 
 	if (ret) {
 		dev_warn(dev, "failed to add notifier for PM domain %s\n",
-			 genpd->name);
+			 dev_name(&genpd->dev));
 		return ret;
 	}
 
@@ -1838,7 +1854,7 @@
 
 	if (ret) {
 		dev_warn(dev, "failed to remove notifier for PM domain %s\n",
-			 genpd->name);
+			 dev_name(&genpd->dev));
 		return ret;
 	}
 
@@ -1864,7 +1880,7 @@
 	 */
 	if (!genpd_is_irq_safe(genpd) && genpd_is_irq_safe(subdomain)) {
 		WARN(1, "Parent %s of subdomain %s must be IRQ safe\n",
-				genpd->name, subdomain->name);
+		     dev_name(&genpd->dev), subdomain->name);
 		return -EINVAL;
 	}
 
@@ -1939,7 +1955,7 @@
 
 	if (!list_empty(&subdomain->parent_links) || subdomain->device_count) {
 		pr_warn("%s: unable to remove subdomain %s\n",
-			genpd->name, subdomain->name);
+			dev_name(&genpd->dev), subdomain->name);
 		ret = -EBUSY;
 		goto out;
 	}
@@ -1987,6 +2003,11 @@
 	return 0;
 }
 
+static void genpd_provider_release(struct device *dev)
+{
+	/* nothing to be done here */
+}
+
 static int genpd_alloc_data(struct generic_pm_domain *genpd)
 {
 	struct genpd_governor_data *gd = NULL;
@@ -2017,8 +2038,25 @@
 	}
 
 	genpd->gd = gd;
-	return 0;
+	device_initialize(&genpd->dev);
+	genpd->dev.release = genpd_provider_release;
+
+	if (!genpd_is_dev_name_fw(genpd)) {
+		dev_set_name(&genpd->dev, "%s", genpd->name);
+	} else {
+		ret = ida_alloc(&genpd_ida, GFP_KERNEL);
+		if (ret < 0)
+			goto put;
 
+		genpd->device_id = ret;
+		dev_set_name(&genpd->dev, "%s_%u", genpd->name, genpd->device_id);
+	}
+
+	return 0;
+put:
+	put_device(&genpd->dev);
+	if (genpd->free_states == genpd_free_default_power_state)
+		kfree(genpd->states);
 free:
 	if (genpd_is_cpu_domain(genpd))
 		free_cpumask_var(genpd->cpus);
@@ -2028,6 +2066,9 @@
 
 static void genpd_free_data(struct generic_pm_domain *genpd)
 {
+	put_device(&genpd->dev);
+	if (genpd->device_id != -ENXIO)
+		ida_free(&genpd_ida, genpd->device_id);
 	if (genpd_is_cpu_domain(genpd))
 		free_cpumask_var(genpd->cpus);
 	if (genpd->free_states)
@@ -2073,6 +2114,7 @@
 	genpd->status = is_off ? GENPD_STATE_OFF : GENPD_STATE_ON;
 	genpd->device_count = 0;
 	genpd->provider = NULL;
+	genpd->device_id = -ENXIO;
 	genpd->has_provider = false;
 	genpd->accounting_time = ktime_get_mono_fast_ns();
 	genpd->domain.ops.runtime_suspend = genpd_runtime_suspend;
@@ -2112,9 +2154,6 @@
 	if (ret)
 		return ret;
 
-	device_initialize(&genpd->dev);
-	dev_set_name(&genpd->dev, "%s", genpd->name);
-
 	mutex_lock(&gpd_list_lock);
 	list_add(&genpd->gpd_list_node, &gpd_list);
 	mutex_unlock(&gpd_list_lock);
@@ -2135,13 +2174,13 @@
 
 	if (genpd->has_provider) {
 		genpd_unlock(genpd);
-		pr_err("Provider present, unable to remove %s\n", genpd->name);
+		pr_err("Provider present, unable to remove %s\n", dev_name(&genpd->dev));
 		return -EBUSY;
 	}
 
 	if (!list_empty(&genpd->parent_links) || genpd->device_count) {
 		genpd_unlock(genpd);
-		pr_err("%s: unable to remove %s\n", __func__, genpd->name);
+		pr_err("%s: unable to remove %s\n", __func__, dev_name(&genpd->dev));
 		return -EBUSY;
 	}
 
@@ -2157,7 +2196,7 @@
 	cancel_work_sync(&genpd->power_off_work);
 	genpd_free_data(genpd);
 
-	pr_debug("%s: removed %s\n", __func__, genpd->name);
+	pr_debug("%s: removed %s\n", __func__, dev_name(&genpd->dev));
 
 	return 0;
 }
@@ -3075,7 +3114,7 @@
 	else
 		WARN_ON(1);
 
-	seq_printf(s, "%-25s  ", p);
+	seq_printf(s, "%-26s  ", p);
 }
 
 static void perf_status_str(struct seq_file *s, struct device *dev)
@@ -3094,7 +3133,6 @@
 		[GENPD_STATE_OFF] = "off"
 	};
 	struct pm_domain_data *pm_data;
-	const char *kobj_path;
 	struct gpd_link *link;
 	char state[16];
 	int ret;
@@ -3111,12 +3149,12 @@
 	else
 		snprintf(state, sizeof(state), "%s",
 			 status_lookup[genpd->status]);
-	seq_printf(s, "%-30s  %-50s %u", genpd->name, state, genpd->performance_state);
+	seq_printf(s, "%-30s  %-30s  %u", dev_name(&genpd->dev), state, genpd->performance_state);
 
 	/*
 	 * Modifications on the list require holding locks on both
 	 * parent and child, so we are safe.
-	 * Also genpd->name is immutable.
+	 * Also the device name is immutable.
 	 */
 	list_for_each_entry(link, &genpd->parent_links, parent_node) {
 		if (list_is_first(&link->parent_node, &genpd->parent_links))
@@ -3127,16 +3165,9 @@
 	}
 
 	list_for_each_entry(pm_data, &genpd->dev_list, list_node) {
-		kobj_path = kobject_get_path(&pm_data->dev->kobj,
-				genpd_is_irq_safe(genpd) ?
-				GFP_ATOMIC : GFP_KERNEL);
-		if (kobj_path == NULL)
-			continue;
-
-		seq_printf(s, "\n    %-50s  ", kobj_path);
+		seq_printf(s, "\n    %-30s  ", dev_name(pm_data->dev));
 		rtpm_status_str(s, pm_data->dev);
 		perf_status_str(s, pm_data->dev);
-		kfree(kobj_path);
 	}
 
 	seq_puts(s, "\n");
@@ -3151,9 +3182,9 @@
 	struct generic_pm_domain *genpd;
 	int ret = 0;
 
-	seq_puts(s, "domain                          status          children                           performance\n");
-	seq_puts(s, "    /device                                             runtime status\n");
-	seq_puts(s, "----------------------------------------------------------------------------------------------\n");
+	seq_puts(s, "domain                          status          children        performance\n");
+	seq_puts(s, "    /device                         runtime status\n");
+	seq_puts(s, "------------------------------------------------------------------------------\n");
 
 	ret = mutex_lock_interruptible(&gpd_list_lock);
 	if (ret)
@@ -3305,23 +3336,14 @@
 {
 	struct generic_pm_domain *genpd = s->private;
 	struct pm_domain_data *pm_data;
-	const char *kobj_path;
 	int ret = 0;
 
 	ret = genpd_lock_interruptible(genpd);
 	if (ret)
 		return -ERESTARTSYS;
 
-	list_for_each_entry(pm_data, &genpd->dev_list, list_node) {
-		kobj_path = kobject_get_path(&pm_data->dev->kobj,
-				genpd_is_irq_safe(genpd) ?
-				GFP_ATOMIC : GFP_KERNEL);
-		if (kobj_path == NULL)
-			continue;
-
-		seq_printf(s, "%s\n", kobj_path);
-		kfree(kobj_path);
-	}
+	list_for_each_entry(pm_data, &genpd->dev_list, list_node)
+		seq_printf(s, "%s\n", dev_name(pm_data->dev));
 
 	genpd_unlock(genpd);
 	return ret;
@@ -3356,7 +3378,7 @@
 	if (!genpd_debugfs_dir)
 		return;
 
-	d = debugfs_create_dir(genpd->name, genpd_debugfs_dir);
+	d = debugfs_create_dir(dev_name(&genpd->dev), genpd_debugfs_dir);
 
 	debugfs_create_file("current_state", 0444,
 			    d, genpd, &status_fops);
--- linux-qcom-6.8.0.orig/drivers/pmdomain/imx/gpcv2.c
+++ linux-qcom-6.8.0/drivers/pmdomain/imx/gpcv2.c
@@ -1447,12 +1447,12 @@
 		.max_register   = SZ_4K,
 	};
 	struct device *dev = &pdev->dev;
-	struct device_node *pgc_np, *np;
+	struct device_node *pgc_np __free(device_node) =
+		of_get_child_by_name(dev->of_node, "pgc");
 	struct regmap *regmap;
 	void __iomem *base;
 	int ret;
 
-	pgc_np = of_get_child_by_name(dev->of_node, "pgc");
 	if (!pgc_np) {
 		dev_err(dev, "No power domains specified in DT\n");
 		return -EINVAL;
@@ -1469,7 +1469,7 @@
 		return ret;
 	}
 
-	for_each_child_of_node(pgc_np, np) {
+	for_each_child_of_node_scoped(pgc_np, np) {
 		struct platform_device *pd_pdev;
 		struct imx_pgc_domain *domain;
 		u32 domain_index;
@@ -1480,7 +1480,6 @@
 		ret = of_property_read_u32(np, "reg", &domain_index);
 		if (ret) {
 			dev_err(dev, "Failed to read 'reg' property\n");
-			of_node_put(np);
 			return ret;
 		}
 
@@ -1495,7 +1494,6 @@
 						domain_index);
 		if (!pd_pdev) {
 			dev_err(dev, "Failed to allocate platform device\n");
-			of_node_put(np);
 			return -ENOMEM;
 		}
 
@@ -1504,7 +1502,6 @@
 					       sizeof(domain_data->domains[domain_index]));
 		if (ret) {
 			platform_device_put(pd_pdev);
-			of_node_put(np);
 			return ret;
 		}
 
@@ -1521,7 +1518,6 @@
 		ret = platform_device_add(pd_pdev);
 		if (ret) {
 			platform_device_put(pd_pdev);
-			of_node_put(np);
 			return ret;
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/pmdomain/imx/imx8mp-blk-ctrl.c
+++ linux-qcom-6.8.0/drivers/pmdomain/imx/imx8mp-blk-ctrl.c
@@ -55,7 +55,7 @@
 	const char *gpc_name;
 };
 
-#define DOMAIN_MAX_CLKS 2
+#define DOMAIN_MAX_CLKS 3
 #define DOMAIN_MAX_PATHS 3
 
 struct imx8mp_blk_ctrl_domain {
@@ -457,8 +457,8 @@
 	},
 	[IMX8MP_HDMIBLK_PD_LCDIF] = {
 		.name = "hdmiblk-lcdif",
-		.clk_names = (const char *[]){ "axi", "apb" },
-		.num_clks = 2,
+		.clk_names = (const char *[]){ "axi", "apb", "fdcc" },
+		.num_clks = 3,
 		.gpc_name = "lcdif",
 		.path_names = (const char *[]){"lcdif-hdmi"},
 		.num_paths = 1,
@@ -483,8 +483,8 @@
 	},
 	[IMX8MP_HDMIBLK_PD_HDMI_TX] = {
 		.name = "hdmiblk-hdmi-tx",
-		.clk_names = (const char *[]){ "apb", "ref_266m" },
-		.num_clks = 2,
+		.clk_names = (const char *[]){ "apb", "ref_266m", "fdcc" },
+		.num_clks = 3,
 		.gpc_name = "hdmi-tx",
 	},
 	[IMX8MP_HDMIBLK_PD_HDMI_TX_PHY] = {
@@ -767,7 +767,7 @@
 
 	of_genpd_del_provider(pdev->dev.of_node);
 
-	for (i = 0; bc->onecell_data.num_domains; i++) {
+	for (i = 0; i < bc->onecell_data.num_domains; i++) {
 		struct imx8mp_blk_ctrl_domain *domain = &bc->domains[i];
 
 		pm_genpd_remove(&domain->genpd);
--- linux-qcom-6.8.0.orig/drivers/pmdomain/imx/imx93-blk-ctrl.c
+++ linux-qcom-6.8.0/drivers/pmdomain/imx/imx93-blk-ctrl.c
@@ -313,7 +313,9 @@
 
 	of_genpd_del_provider(pdev->dev.of_node);
 
-	for (i = 0; bc->onecell_data.num_domains; i++) {
+	pm_runtime_disable(&pdev->dev);
+
+	for (i = 0; i < bc->onecell_data.num_domains; i++) {
 		struct imx93_blk_ctrl_domain *domain = &bc->domains[i];
 
 		pm_genpd_remove(&domain->genpd);
--- linux-qcom-6.8.0.orig/drivers/pmdomain/imx/imx93-pd.c
+++ linux-qcom-6.8.0/drivers/pmdomain/imx/imx93-pd.c
@@ -20,6 +20,7 @@
 #define FUNC_STAT_PSW_STAT_MASK		BIT(0)
 #define FUNC_STAT_RST_STAT_MASK		BIT(2)
 #define FUNC_STAT_ISO_STAT_MASK		BIT(4)
+#define FUNC_STAT_SSAR_STAT_MASK	BIT(8)
 
 struct imx93_power_domain {
 	struct generic_pm_domain genpd;
@@ -50,7 +51,7 @@
 	writel(val, addr + MIX_SLICE_SW_CTRL_OFF);
 
 	ret = readl_poll_timeout(addr + MIX_FUNC_STAT_OFF, val,
-				 !(val & FUNC_STAT_ISO_STAT_MASK), 1, 10000);
+				 !(val & FUNC_STAT_SSAR_STAT_MASK), 1, 10000);
 	if (ret) {
 		dev_err(domain->dev, "pd_on timeout: name: %s, stat: %x\n", genpd->name, val);
 		return ret;
@@ -72,7 +73,7 @@
 	writel(val, addr + MIX_SLICE_SW_CTRL_OFF);
 
 	ret = readl_poll_timeout(addr + MIX_FUNC_STAT_OFF, val,
-				 val & FUNC_STAT_PSW_STAT_MASK, 1, 1000);
+				 val & FUNC_STAT_PSW_STAT_MASK, 1, 10000);
 	if (ret) {
 		dev_err(domain->dev, "pd_off timeout: name: %s, stat: %x\n", genpd->name, val);
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/pmdomain/imx/scu-pd.c
+++ linux-qcom-6.8.0/drivers/pmdomain/imx/scu-pd.c
@@ -223,11 +223,6 @@
 	{ "lvds1-pwm", IMX_SC_R_LVDS_1_PWM_0, 1, false, 0 },
 	{ "lvds1-lpi2c", IMX_SC_R_LVDS_1_I2C_0, 2, true, 0 },
 
-	{ "mipi1", IMX_SC_R_MIPI_1, 1, 0 },
-	{ "mipi1-pwm0", IMX_SC_R_MIPI_1_PWM_0, 1, 0 },
-	{ "mipi1-i2c", IMX_SC_R_MIPI_1_I2C_0, 2, 1 },
-	{ "lvds1", IMX_SC_R_LVDS_1, 1, 0 },
-
 	/* DC SS */
 	{ "dc0", IMX_SC_R_DC_0, 1, false, 0 },
 	{ "dc0-pll", IMX_SC_R_DC_0_PLL_0, 2, true, 0 },
--- linux-qcom-6.8.0.orig/drivers/pmdomain/qcom/rpmhpd.c
+++ linux-qcom-6.8.0/drivers/pmdomain/qcom/rpmhpd.c
@@ -40,6 +40,7 @@
  * @addr:		Resource address as looped up using resource name from
  *			cmd-db
  * @state_synced:	Indicator that sync_state has been invoked for the rpmhpd resource
+ * @skip_retention_level: Indicate that retention level should not be used for the power domain
  */
 struct rpmhpd {
 	struct device	*dev;
@@ -56,6 +57,7 @@
 	const char	*res_name;
 	u32		addr;
 	bool		state_synced;
+	bool            skip_retention_level;
 };
 
 struct rpmhpd_desc {
@@ -173,6 +175,7 @@
 	.pd = { .name = "mxc", },
 	.peer = &mxc_ao,
 	.res_name = "mxc.lvl",
+	.skip_retention_level = true,
 };
 
 static struct rpmhpd mxc_ao = {
@@ -180,6 +183,7 @@
 	.active_only = true,
 	.peer = &mxc,
 	.res_name = "mxc.lvl",
+	.skip_retention_level = true,
 };
 
 static struct rpmhpd nsp = {
@@ -217,7 +221,6 @@
 	[SC8280XP_CX] = &cx,
 	[SC8280XP_CX_AO] = &cx_ao,
 	[SC8280XP_EBI] = &ebi,
-	[SC8280XP_GFX] = &gfx,
 	[SC8280XP_LCX] = &lcx,
 	[SC8280XP_LMX] = &lmx,
 	[SC8280XP_MMCX] = &mmcx,
@@ -620,7 +623,43 @@
 	.num_pds = ARRAY_SIZE(x1e80100_rpmhpds),
 };
 
+/* QCS8300 RPMH power domains */
+static struct rpmhpd *qcs8300_rpmhpds[] = {
+	[RPMHPD_CX] = &cx,
+	[RPMHPD_CX_AO] = &cx_ao,
+	[RPMHPD_EBI] = &ebi,
+	[RPMHPD_GFX] = &gfx,
+	[RPMHPD_LCX] = &lcx,
+	[RPMHPD_LMX] = &lmx,
+	[RPMHPD_MMCX] = &mmcx_w_cx_parent,
+	[RPMHPD_MMCX_AO] = &mmcx_ao_w_cx_parent,
+	[RPMHPD_MXC] = &mxc,
+	[RPMHPD_MXC_AO] = &mxc_ao,
+	[RPMHPD_MX] = &mx,
+	[RPMHPD_MX_AO] = &mx_ao,
+	[RPMHPD_NSP0] = &nsp0,
+	[RPMHPD_NSP1] = &nsp1,
+};
+
+static const struct rpmhpd_desc qcs8300_desc = {
+	.rpmhpds = qcs8300_rpmhpds,
+	.num_pds = ARRAY_SIZE(qcs8300_rpmhpds),
+};
+
+/* QCS615 RPMH powerdomains */
+static struct rpmhpd *qcs615_rpmhpds[] = {
+	[RPMHPD_CX] = &cx,
+	[RPMHPD_CX_AO] = &cx_ao,
+};
+
+static const struct rpmhpd_desc qcs615_desc = {
+	.rpmhpds = qcs615_rpmhpds,
+	.num_pds = ARRAY_SIZE(qcs615_rpmhpds),
+};
+
 static const struct of_device_id rpmhpd_match_table[] = {
+	{ .compatible = "qcom,qcs615-rpmhpd", .data = &qcs615_desc },
+	{ .compatible = "qcom,qcs8300-rpmhpd", .data = &qcs8300_desc },
 	{ .compatible = "qcom,qdu1000-rpmhpd", .data = &qdu1000_desc },
 	{ .compatible = "qcom,sa8155p-rpmhpd", .data = &sa8155p_desc },
 	{ .compatible = "qcom,sa8540p-rpmhpd", .data = &sa8540p_desc },
@@ -820,6 +859,9 @@
 		return -EINVAL;
 
 	for (i = 0; i < rpmhpd->level_count; i++) {
+		if (rpmhpd->skip_retention_level && buf[i] == RPMH_REGULATOR_LEVEL_RETENTION)
+			continue;
+
 		rpmhpd->level[i] = buf[i];
 
 		/* Remember the first corner with non-zero level */
--- linux-qcom-6.8.0.orig/drivers/pmdomain/ti/omap_prm.c
+++ linux-qcom-6.8.0/drivers/pmdomain/ti/omap_prm.c
@@ -695,6 +695,8 @@
 	data = prm->data;
 	name = devm_kasprintf(dev, GFP_KERNEL, "prm_%s",
 			      data->name);
+	if (!name)
+		return -ENOMEM;
 
 	prmd->dev = dev;
 	prmd->prm = prm;
--- linux-qcom-6.8.0.orig/drivers/pmdomain/ti/ti_sci_pm_domains.c
+++ linux-qcom-6.8.0/drivers/pmdomain/ti/ti_sci_pm_domains.c
@@ -114,6 +114,18 @@
 };
 MODULE_DEVICE_TABLE(of, ti_sci_pm_domain_matches);
 
+static bool ti_sci_pm_idx_exists(struct ti_sci_genpd_provider *pd_provider, u32 idx)
+{
+	struct ti_sci_pm_domain *pd;
+
+	list_for_each_entry(pd, &pd_provider->pd_list, node) {
+		if (pd->idx == idx)
+			return true;
+	}
+
+	return false;
+}
+
 static int ti_sci_pm_domain_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -149,8 +161,15 @@
 				break;
 
 			if (args.args_count >= 1 && args.np == dev->of_node) {
-				if (args.args[0] > max_id)
+				of_node_put(args.np);
+				if (args.args[0] > max_id) {
 					max_id = args.args[0];
+				} else {
+					if (ti_sci_pm_idx_exists(pd_provider, args.args[0])) {
+						index++;
+						continue;
+					}
+				}
 
 				pd = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL);
 				if (!pd) {
@@ -174,7 +193,10 @@
 				pm_genpd_init(&pd->pd, NULL, true);
 
 				list_add(&pd->node, &pd_provider->pd_list);
+			} else {
+				of_node_put(args.np);
 			}
+
 			index++;
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/pnp/base.h
+++ linux-qcom-6.8.0/drivers/pnp/base.h
@@ -6,6 +6,7 @@
 
 extern struct mutex pnp_lock;
 extern const struct attribute_group *pnp_dev_groups[];
+extern const struct bus_type pnp_bus_type;
 
 int pnp_register_protocol(struct pnp_protocol *protocol);
 void pnp_unregister_protocol(struct pnp_protocol *protocol);
--- linux-qcom-6.8.0.orig/drivers/pnp/isapnp/core.c
+++ linux-qcom-6.8.0/drivers/pnp/isapnp/core.c
@@ -27,6 +27,7 @@
 #include <linux/init.h>
 #include <linux/isapnp.h>
 #include <linux/mutex.h>
+#include <linux/async.h>
 #include <asm/io.h>
 
 #include "../base.h"
@@ -950,7 +951,7 @@
 	.disable = isapnp_disable_resources,
 };
 
-static int __init isapnp_init(void)
+static int __init real_isapnp_init(void)
 {
 	int cards;
 	struct pnp_card *card;
@@ -1044,6 +1045,16 @@
 	return 0;
 }
 
+static void __init async_isapnp_init(void *unused, async_cookie_t cookie)
+{
+	(void)real_isapnp_init();
+}
+
+static int __init isapnp_init(void)
+{
+	async_schedule(async_isapnp_init, NULL);
+	return 0;
+}
 device_initcall(isapnp_init);
 
 /* format is: noisapnp */
--- linux-qcom-6.8.0.orig/drivers/power/Kconfig
+++ linux-qcom-6.8.0/drivers/power/Kconfig
@@ -1,3 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0-only
 source "drivers/power/reset/Kconfig"
+source "drivers/power/sequencing/Kconfig"
 source "drivers/power/supply/Kconfig"
--- linux-qcom-6.8.0.orig/drivers/power/Makefile
+++ linux-qcom-6.8.0/drivers/power/Makefile
@@ -1,3 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0-only
 obj-$(CONFIG_POWER_RESET)	+= reset/
+obj-$(CONFIG_POWER_SEQUENCING)	+= sequencing/
 obj-$(CONFIG_POWER_SUPPLY)	+= supply/
--- linux-qcom-6.8.0.orig/drivers/power/reset/brcmstb-reboot.c
+++ linux-qcom-6.8.0/drivers/power/reset/brcmstb-reboot.c
@@ -62,9 +62,6 @@
 		return NOTIFY_DONE;
 	}
 
-	while (1)
-		;
-
 	return NOTIFY_DONE;
 }
 
--- linux-qcom-6.8.0.orig/drivers/power/sequencing/Kconfig
+++ linux-qcom-6.8.0/drivers/power/sequencing/Kconfig
@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+menuconfig POWER_SEQUENCING
+	tristate "Power Sequencing support"
+	help
+	  Say Y here to enable the Power Sequencing subsystem.
+
+	  This subsystem is designed to control power to devices that share
+	  complex resources and/or require specific power sequences to be run
+	  during power-up.
+
+	  If unsure, say no.
+
+if POWER_SEQUENCING
+
+config POWER_SEQUENCING_QCOM_WCN
+	tristate "Qualcomm WCN family PMU driver"
+	default m if ARCH_QCOM
+	help
+	  Say Y here to enable the power sequencing driver for Qualcomm
+	  WCN Bluetooth/WLAN chipsets.
+
+	  Typically, a package from the Qualcomm WCN family contains the BT
+	  and WLAN modules whose power is controlled by the PMU module. As the
+	  former two share the power-up sequence which is executed by the PMU,
+	  this driver is needed for correct power control or else we'd risk not
+	  respecting the required delays between enabling Bluetooth and WLAN.
+
+endif
--- linux-qcom-6.8.0.orig/drivers/power/sequencing/Makefile
+++ linux-qcom-6.8.0/drivers/power/sequencing/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0
+
+obj-$(CONFIG_POWER_SEQUENCING)		+= pwrseq-core.o
+pwrseq-core-y				:= core.o
+
+obj-$(CONFIG_POWER_SEQUENCING_QCOM_WCN)	+= pwrseq-qcom-wcn.o
--- linux-qcom-6.8.0.orig/drivers/power/sequencing/core.c
+++ linux-qcom-6.8.0/drivers/power/sequencing/core.c
@@ -0,0 +1,1105 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2024 Linaro Ltd.
+ */
+
+#include <linux/bug.h>
+#include <linux/cleanup.h>
+#include <linux/debugfs.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/export.h>
+#include <linux/idr.h>
+#include <linux/kernel.h>
+#include <linux/kref.h>
+#include <linux/list.h>
+#include <linux/lockdep.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/property.h>
+#include <linux/pwrseq/consumer.h>
+#include <linux/pwrseq/provider.h>
+#include <linux/radix-tree.h>
+#include <linux/rwsem.h>
+#include <linux/slab.h>
+
+/*
+ * Power-sequencing framework for linux.
+ *
+ * This subsystem allows power sequence providers to register a set of targets
+ * that consumers may request and power-up/down.
+ *
+ * Glossary:
+ *
+ * Unit - a unit is a discreet chunk of a power sequence. For instance one unit
+ * may enable a set of regulators, another may enable a specific GPIO. Units
+ * can define dependencies in the form of other units that must be enabled
+ * before it itself can be.
+ *
+ * Target - a target is a set of units (composed of the "final" unit and its
+ * dependencies) that a consumer selects by its name when requesting a handle
+ * to the power sequencer. Via the dependency system, multiple targets may
+ * share the same parts of a power sequence but ignore parts that are
+ * irrelevant.
+ *
+ * Descriptor - a handle passed by the pwrseq core to every consumer that
+ * serves as the entry point to the provider layer. It ensures coherence
+ * between different users and keeps reference counting consistent.
+ *
+ * Each provider must define a .match() callback whose role is to determine
+ * whether a potential consumer is in fact associated with this sequencer.
+ * This allows creating abstraction layers on top of regular device-tree
+ * resources like regulators, clocks and other nodes connected to the consumer
+ * via phandle.
+ */
+
+static DEFINE_IDA(pwrseq_ida);
+
+/*
+ * Protects the device list on the pwrseq bus from concurrent modifications
+ * but allows simultaneous read-only access.
+ */
+static DECLARE_RWSEM(pwrseq_sem);
+
+/**
+ * struct pwrseq_unit - Private power-sequence unit data.
+ * @ref: Reference count for this object. When it goes to 0, the object is
+ *       destroyed.
+ * @name: Name of this target.
+ * @list: Link to siblings on the list of all units of a single sequencer.
+ * @deps: List of units on which this unit depends.
+ * @enable: Callback running the part of the power-on sequence provided by
+ *          this unit.
+ * @disable: Callback running the part of the power-off sequence provided
+ *           by this unit.
+ * @enable_count: Current number of users that enabled this unit. May be the
+ *                consumer of the power sequencer or other units that depend
+ *                on this one.
+ */
+struct pwrseq_unit {
+	struct kref ref;
+	const char *name;
+	struct list_head list;
+	struct list_head deps;
+	pwrseq_power_state_func enable;
+	pwrseq_power_state_func disable;
+	unsigned int enable_count;
+};
+
+static struct pwrseq_unit *pwrseq_unit_new(const struct pwrseq_unit_data *data)
+{
+	struct pwrseq_unit *unit;
+
+	unit = kzalloc(sizeof(*unit), GFP_KERNEL);
+	if (!unit)
+		return NULL;
+
+	unit->name = kstrdup_const(data->name, GFP_KERNEL);
+	if (!unit->name) {
+		kfree(unit);
+		return NULL;
+	}
+
+	kref_init(&unit->ref);
+	INIT_LIST_HEAD(&unit->deps);
+	unit->enable = data->enable;
+	unit->disable = data->disable;
+
+	return unit;
+}
+
+static struct pwrseq_unit *pwrseq_unit_get(struct pwrseq_unit *unit)
+{
+	kref_get(&unit->ref);
+
+	return unit;
+}
+
+static void pwrseq_unit_release(struct kref *ref);
+
+static void pwrseq_unit_put(struct pwrseq_unit *unit)
+{
+	kref_put(&unit->ref, pwrseq_unit_release);
+}
+
+/**
+ * struct pwrseq_unit_dep - Wrapper around a reference to the unit structure
+ *                          allowing to keep it on multiple dependency lists
+ *                          in different units.
+ * @list: Siblings on the list.
+ * @unit: Address of the referenced unit.
+ */
+struct pwrseq_unit_dep {
+	struct list_head list;
+	struct pwrseq_unit *unit;
+};
+
+static struct pwrseq_unit_dep *pwrseq_unit_dep_new(struct pwrseq_unit *unit)
+{
+	struct pwrseq_unit_dep *dep;
+
+	dep = kzalloc(sizeof(*dep), GFP_KERNEL);
+	if (!dep)
+		return NULL;
+
+	dep->unit = unit;
+
+	return dep;
+}
+
+static void pwrseq_unit_dep_free(struct pwrseq_unit_dep *ref)
+{
+	pwrseq_unit_put(ref->unit);
+	kfree(ref);
+}
+
+static void pwrseq_unit_free_deps(struct list_head *list)
+{
+	struct pwrseq_unit_dep *dep, *next;
+
+	list_for_each_entry_safe(dep, next, list, list) {
+		list_del(&dep->list);
+		pwrseq_unit_dep_free(dep);
+	}
+}
+
+static void pwrseq_unit_release(struct kref *ref)
+{
+	struct pwrseq_unit *unit = container_of(ref, struct pwrseq_unit, ref);
+
+	pwrseq_unit_free_deps(&unit->deps);
+	list_del(&unit->list);
+	kfree_const(unit->name);
+	kfree(unit);
+}
+
+/**
+ * struct pwrseq_target - Private power-sequence target data.
+ * @list: Siblings on the list of all targets exposed by a power sequencer.
+ * @name: Name of the target.
+ * @unit: Final unit for this target.
+ * @post_enable: Callback run after the target unit has been enabled, *after*
+ *               the state lock has been released. It's useful for implementing
+ *               boot-up delays without blocking other users from powering up
+ *               using the same power sequencer.
+ */
+struct pwrseq_target {
+	struct list_head list;
+	const char *name;
+	struct pwrseq_unit *unit;
+	pwrseq_power_state_func post_enable;
+};
+
+static struct pwrseq_target *
+pwrseq_target_new(const struct pwrseq_target_data *data)
+{
+	struct pwrseq_target *target;
+
+	target = kzalloc(sizeof(*target), GFP_KERNEL);
+	if (!target)
+		return NULL;
+
+	target->name = kstrdup_const(data->name, GFP_KERNEL);
+	if (!target->name) {
+		kfree(target);
+		return NULL;
+	}
+
+	target->post_enable = data->post_enable;
+
+	return target;
+}
+
+static void pwrseq_target_free(struct pwrseq_target *target)
+{
+	pwrseq_unit_put(target->unit);
+	kfree_const(target->name);
+	kfree(target);
+}
+
+/**
+ * struct pwrseq_device - Private power sequencing data.
+ * @dev: Device struct associated with this sequencer.
+ * @id: Device ID.
+ * @owner: Prevents removal of active power sequencing providers.
+ * @rw_lock: Protects the device from being unregistered while in use.
+ * @state_lock: Prevents multiple users running the power sequence at the same
+ *              time.
+ * @match: Power sequencer matching callback.
+ * @targets: List of targets exposed by this sequencer.
+ * @units: List of all units supported by this sequencer.
+ */
+struct pwrseq_device {
+	struct device dev;
+	int id;
+	struct module *owner;
+	struct rw_semaphore rw_lock;
+	struct mutex state_lock;
+	pwrseq_match_func match;
+	struct list_head targets;
+	struct list_head units;
+};
+
+static struct pwrseq_device *to_pwrseq_device(struct device *dev)
+{
+	return container_of(dev, struct pwrseq_device, dev);
+}
+
+static struct pwrseq_device *pwrseq_device_get(struct pwrseq_device *pwrseq)
+{
+	get_device(&pwrseq->dev);
+
+	return pwrseq;
+}
+
+static void pwrseq_device_put(struct pwrseq_device *pwrseq)
+{
+	put_device(&pwrseq->dev);
+}
+
+/**
+ * struct pwrseq_desc - Wraps access to the pwrseq_device and ensures that one
+ *                      user cannot break the reference counting for others.
+ * @pwrseq: Reference to the power sequencing device.
+ * @target: Reference to the target this descriptor allows to control.
+ * @powered_on: Power state set by the holder of the descriptor (not necessarily
+ * corresponding to the actual power state of the device).
+ */
+struct pwrseq_desc {
+	struct pwrseq_device *pwrseq;
+	struct pwrseq_target *target;
+	bool powered_on;
+};
+
+static const struct bus_type pwrseq_bus = {
+	.name = "pwrseq",
+};
+
+static void pwrseq_release(struct device *dev)
+{
+	struct pwrseq_device *pwrseq = to_pwrseq_device(dev);
+	struct pwrseq_target *target, *pos;
+
+	list_for_each_entry_safe(target, pos, &pwrseq->targets, list) {
+		list_del(&target->list);
+		pwrseq_target_free(target);
+	}
+
+	mutex_destroy(&pwrseq->state_lock);
+	ida_free(&pwrseq_ida, pwrseq->id);
+	kfree(pwrseq);
+}
+
+static const struct device_type pwrseq_device_type = {
+	.name = "power_sequencer",
+	.release = pwrseq_release,
+};
+
+static int pwrseq_check_unit_deps(const struct pwrseq_unit_data *data,
+				  struct radix_tree_root *visited_units)
+{
+	const struct pwrseq_unit_data *tmp, **cur;
+	int ret;
+
+	ret = radix_tree_insert(visited_units, (unsigned long)data,
+				(void *)data);
+	if (ret)
+		return ret;
+
+	for (cur = data->deps; cur && *cur; cur++) {
+		tmp = radix_tree_lookup(visited_units, (unsigned long)*cur);
+		if (tmp) {
+			WARN(1, "Circular dependency in power sequencing flow detected!\n");
+			return -EINVAL;
+		}
+
+		ret = pwrseq_check_unit_deps(*cur, visited_units);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int pwrseq_check_target_deps(const struct pwrseq_target_data *data)
+{
+	struct radix_tree_root visited_units;
+	struct radix_tree_iter iter;
+	void __rcu **slot;
+	int ret;
+
+	if (!data->unit)
+		return -EINVAL;
+
+	INIT_RADIX_TREE(&visited_units, GFP_KERNEL);
+	ret = pwrseq_check_unit_deps(data->unit, &visited_units);
+	radix_tree_for_each_slot(slot, &visited_units, &iter, 0)
+		radix_tree_delete(&visited_units, iter.index);
+
+	return ret;
+}
+
+static int pwrseq_unit_setup_deps(const struct pwrseq_unit_data **data,
+				  struct list_head *dep_list,
+				  struct list_head *unit_list,
+				  struct radix_tree_root *processed_units);
+
+static struct pwrseq_unit *
+pwrseq_unit_setup(const struct pwrseq_unit_data *data,
+		  struct list_head *unit_list,
+		  struct radix_tree_root *processed_units)
+{
+	struct pwrseq_unit *unit;
+	int ret;
+
+	unit = radix_tree_lookup(processed_units, (unsigned long)data);
+	if (unit)
+		return pwrseq_unit_get(unit);
+
+	unit = pwrseq_unit_new(data);
+	if (!unit)
+		return ERR_PTR(-ENOMEM);
+
+	if (data->deps) {
+		ret = pwrseq_unit_setup_deps(data->deps, &unit->deps,
+					     unit_list, processed_units);
+		if (ret) {
+			pwrseq_unit_put(unit);
+			return ERR_PTR(ret);
+		}
+	}
+
+	ret = radix_tree_insert(processed_units, (unsigned long)data, unit);
+	if (ret) {
+		pwrseq_unit_put(unit);
+		return ERR_PTR(ret);
+	}
+
+	list_add_tail(&unit->list, unit_list);
+
+	return unit;
+}
+
+static int pwrseq_unit_setup_deps(const struct pwrseq_unit_data **data,
+				  struct list_head *dep_list,
+				  struct list_head *unit_list,
+				  struct radix_tree_root *processed_units)
+{
+	const struct pwrseq_unit_data *pos;
+	struct pwrseq_unit_dep *dep;
+	struct pwrseq_unit *unit;
+	int i;
+
+	for (i = 0; data[i]; i++) {
+		pos = data[i];
+
+		unit = pwrseq_unit_setup(pos, unit_list, processed_units);
+		if (IS_ERR(unit))
+			return PTR_ERR(unit);
+
+		dep = pwrseq_unit_dep_new(unit);
+		if (!dep) {
+			pwrseq_unit_put(unit);
+			return -ENOMEM;
+		}
+
+		list_add_tail(&dep->list, dep_list);
+	}
+
+	return 0;
+}
+
+static int pwrseq_do_setup_targets(const struct pwrseq_target_data **data,
+				   struct pwrseq_device *pwrseq,
+				   struct radix_tree_root *processed_units)
+{
+	const struct pwrseq_target_data *pos;
+	struct pwrseq_target *target;
+	int ret, i;
+
+	for (i = 0; data[i]; i++) {
+		pos = data[i];
+
+		ret = pwrseq_check_target_deps(pos);
+		if (ret)
+			return ret;
+
+		target = pwrseq_target_new(pos);
+		if (!target)
+			return -ENOMEM;
+
+		target->unit = pwrseq_unit_setup(pos->unit, &pwrseq->units,
+						 processed_units);
+		if (IS_ERR(target->unit)) {
+			ret = PTR_ERR(target->unit);
+			pwrseq_target_free(target);
+			return ret;
+		}
+
+		list_add_tail(&target->list, &pwrseq->targets);
+	}
+
+	return 0;
+}
+
+static int pwrseq_setup_targets(const struct pwrseq_target_data **targets,
+				struct pwrseq_device *pwrseq)
+{
+	struct radix_tree_root processed_units;
+	struct radix_tree_iter iter;
+	void __rcu **slot;
+	int ret;
+
+	INIT_RADIX_TREE(&processed_units, GFP_KERNEL);
+	ret = pwrseq_do_setup_targets(targets, pwrseq, &processed_units);
+	radix_tree_for_each_slot(slot, &processed_units, &iter, 0)
+		radix_tree_delete(&processed_units, iter.index);
+
+	return ret;
+}
+
+/**
+ * pwrseq_device_register() - Register a new power sequencer.
+ * @config: Configuration of the new power sequencing device.
+ *
+ * The config structure is only used during the call and can be freed after
+ * the function returns. The config structure *must* have the parent device
+ * as well as the match() callback and at least one target set.
+ *
+ * Returns:
+ * Returns the address of the new pwrseq device or ERR_PTR() on failure.
+ */
+struct pwrseq_device *
+pwrseq_device_register(const struct pwrseq_config *config)
+{
+	struct pwrseq_device *pwrseq;
+	int ret, id;
+
+	if (!config->parent || !config->match || !config->targets ||
+	    !config->targets[0])
+		return ERR_PTR(-EINVAL);
+
+	pwrseq = kzalloc(sizeof(*pwrseq), GFP_KERNEL);
+	if (!pwrseq)
+		return ERR_PTR(-ENOMEM);
+
+	pwrseq->dev.type = &pwrseq_device_type;
+	pwrseq->dev.bus = &pwrseq_bus;
+	pwrseq->dev.parent = config->parent;
+	device_set_node(&pwrseq->dev, dev_fwnode(config->parent));
+	dev_set_drvdata(&pwrseq->dev, config->drvdata);
+
+	id = ida_alloc(&pwrseq_ida, GFP_KERNEL);
+	if (id < 0) {
+		kfree(pwrseq);
+		return ERR_PTR(id);
+	}
+
+	pwrseq->id = id;
+
+	/*
+	 * From this point onwards the device's release() callback is
+	 * responsible for freeing resources.
+	 */
+	device_initialize(&pwrseq->dev);
+
+	ret = dev_set_name(&pwrseq->dev, "pwrseq.%d", pwrseq->id);
+	if (ret)
+		goto err_put_pwrseq;
+
+	pwrseq->owner = config->owner ?: THIS_MODULE;
+	pwrseq->match = config->match;
+
+	init_rwsem(&pwrseq->rw_lock);
+	mutex_init(&pwrseq->state_lock);
+	INIT_LIST_HEAD(&pwrseq->targets);
+	INIT_LIST_HEAD(&pwrseq->units);
+
+	ret = pwrseq_setup_targets(config->targets, pwrseq);
+	if (ret)
+		goto err_put_pwrseq;
+
+	scoped_guard(rwsem_write, &pwrseq_sem) {
+		ret = device_add(&pwrseq->dev);
+		if (ret)
+			goto err_put_pwrseq;
+	}
+
+	return pwrseq;
+
+err_put_pwrseq:
+	pwrseq_device_put(pwrseq);
+	return ERR_PTR(ret);
+}
+EXPORT_SYMBOL_GPL(pwrseq_device_register);
+
+/**
+ * pwrseq_device_unregister() - Unregister the power sequencer.
+ * @pwrseq: Power sequencer to unregister.
+ */
+void pwrseq_device_unregister(struct pwrseq_device *pwrseq)
+{
+	struct device *dev = &pwrseq->dev;
+	struct pwrseq_target *target;
+
+	scoped_guard(mutex, &pwrseq->state_lock) {
+		guard(rwsem_write)(&pwrseq->rw_lock);
+
+		list_for_each_entry(target, &pwrseq->targets, list)
+			WARN(target->unit->enable_count,
+			     "REMOVING POWER SEQUENCER WITH ACTIVE USERS\n");
+
+		guard(rwsem_write)(&pwrseq_sem);
+
+		device_del(dev);
+	}
+
+	pwrseq_device_put(pwrseq);
+}
+EXPORT_SYMBOL_GPL(pwrseq_device_unregister);
+
+static void devm_pwrseq_device_unregister(void *data)
+{
+	struct pwrseq_device *pwrseq = data;
+
+	pwrseq_device_unregister(pwrseq);
+}
+
+/**
+ * devm_pwrseq_device_register() - Managed variant of pwrseq_device_register().
+ * @dev: Managing device.
+ * @config: Configuration of the new power sequencing device.
+ *
+ * Returns:
+ * Returns the address of the new pwrseq device or ERR_PTR() on failure.
+ */
+struct pwrseq_device *
+devm_pwrseq_device_register(struct device *dev,
+			    const struct pwrseq_config *config)
+{
+	struct pwrseq_device *pwrseq;
+	int ret;
+
+	pwrseq = pwrseq_device_register(config);
+	if (IS_ERR(pwrseq))
+		return pwrseq;
+
+	ret = devm_add_action_or_reset(dev, devm_pwrseq_device_unregister,
+				       pwrseq);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return pwrseq;
+}
+EXPORT_SYMBOL_GPL(devm_pwrseq_device_register);
+
+/**
+ * pwrseq_device_get_drvdata() - Get the driver private data associated with
+ *                               this sequencer.
+ * @pwrseq: Power sequencer object.
+ *
+ * Returns:
+ * Address of the private driver data.
+ */
+void *pwrseq_device_get_drvdata(struct pwrseq_device *pwrseq)
+{
+	return dev_get_drvdata(&pwrseq->dev);
+}
+EXPORT_SYMBOL_GPL(pwrseq_device_get_drvdata);
+
+struct pwrseq_match_data {
+	struct pwrseq_desc *desc;
+	struct device *dev;
+	const char *target;
+};
+
+static int pwrseq_match_device(struct device *pwrseq_dev, void *data)
+{
+	struct pwrseq_device *pwrseq = to_pwrseq_device(pwrseq_dev);
+	struct pwrseq_match_data *match_data = data;
+	struct pwrseq_target *target;
+	int ret;
+
+	lockdep_assert_held_read(&pwrseq_sem);
+
+	guard(rwsem_read)(&pwrseq->rw_lock);
+	if (!device_is_registered(&pwrseq->dev))
+		return 0;
+
+	ret = pwrseq->match(pwrseq, match_data->dev);
+	if (ret <= 0)
+		return ret;
+
+	/* We got the matching device, let's find the right target. */
+	list_for_each_entry(target, &pwrseq->targets, list) {
+		if (strcmp(target->name, match_data->target))
+			continue;
+
+		match_data->desc->target = target;
+	}
+
+	/*
+	 * This device does not have this target. No point in deferring as it
+	 * will not get a new target dynamically later.
+	 */
+	if (!match_data->desc->target)
+		return -ENOENT;
+
+	if (!try_module_get(pwrseq->owner))
+		return -EPROBE_DEFER;
+
+	match_data->desc->pwrseq = pwrseq_device_get(pwrseq);
+
+	return 1;
+}
+
+/**
+ * pwrseq_get() - Get the power sequencer associated with this device.
+ * @dev: Device for which to get the sequencer.
+ * @target: Name of the target exposed by the sequencer this device wants to
+ *          reach.
+ *
+ * Returns:
+ * New power sequencer descriptor for use by the consumer driver or ERR_PTR()
+ * on failure.
+ */
+struct pwrseq_desc *pwrseq_get(struct device *dev, const char *target)
+{
+	struct pwrseq_match_data match_data;
+	int ret;
+
+	struct pwrseq_desc *desc __free(kfree) = kzalloc(sizeof(*desc),
+							 GFP_KERNEL);
+	if (!desc)
+		return ERR_PTR(-ENOMEM);
+
+	match_data.desc = desc;
+	match_data.dev = dev;
+	match_data.target = target;
+
+	guard(rwsem_read)(&pwrseq_sem);
+
+	ret = bus_for_each_dev(&pwrseq_bus, NULL, &match_data,
+			       pwrseq_match_device);
+	if (ret < 0)
+		return ERR_PTR(ret);
+	if (ret == 0)
+		/* No device matched. */
+		return ERR_PTR(-EPROBE_DEFER);
+
+	return no_free_ptr(desc);
+}
+EXPORT_SYMBOL_GPL(pwrseq_get);
+
+/**
+ * pwrseq_put() - Release the power sequencer descriptor.
+ * @desc: Descriptor to release.
+ */
+void pwrseq_put(struct pwrseq_desc *desc)
+{
+	struct pwrseq_device *pwrseq;
+
+	if (!desc)
+		return;
+
+	pwrseq = desc->pwrseq;
+
+	if (desc->powered_on)
+		pwrseq_power_off(desc);
+
+	kfree(desc);
+	module_put(pwrseq->owner);
+	pwrseq_device_put(pwrseq);
+}
+EXPORT_SYMBOL_GPL(pwrseq_put);
+
+static void devm_pwrseq_put(void *data)
+{
+	struct pwrseq_desc *desc = data;
+
+	pwrseq_put(desc);
+}
+
+/**
+ * devm_pwrseq_get() - Managed variant of pwrseq_get().
+ * @dev: Device for which to get the sequencer and which also manages its
+ *       lifetime.
+ * @target: Name of the target exposed by the sequencer this device wants to
+ *          reach.
+ *
+ * Returns:
+ * New power sequencer descriptor for use by the consumer driver or ERR_PTR()
+ * on failure.
+ */
+struct pwrseq_desc *devm_pwrseq_get(struct device *dev, const char *target)
+{
+	struct pwrseq_desc *desc;
+	int ret;
+
+	desc = pwrseq_get(dev, target);
+	if (IS_ERR(desc))
+		return desc;
+
+	ret = devm_add_action_or_reset(dev, devm_pwrseq_put, desc);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return desc;
+}
+EXPORT_SYMBOL_GPL(devm_pwrseq_get);
+
+static int pwrseq_unit_enable(struct pwrseq_device *pwrseq,
+			      struct pwrseq_unit *target);
+static int pwrseq_unit_disable(struct pwrseq_device *pwrseq,
+			       struct pwrseq_unit *target);
+
+static int pwrseq_unit_enable_deps(struct pwrseq_device *pwrseq,
+				   struct list_head *list)
+{
+	struct pwrseq_unit_dep *pos;
+	int ret = 0;
+
+	list_for_each_entry(pos, list, list) {
+		ret = pwrseq_unit_enable(pwrseq, pos->unit);
+		if (ret) {
+			list_for_each_entry_continue_reverse(pos, list, list)
+				pwrseq_unit_disable(pwrseq, pos->unit);
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static int pwrseq_unit_disable_deps(struct pwrseq_device *pwrseq,
+				    struct list_head *list)
+{
+	struct pwrseq_unit_dep *pos;
+	int ret = 0;
+
+	list_for_each_entry_reverse(pos, list, list) {
+		ret = pwrseq_unit_disable(pwrseq, pos->unit);
+		if (ret) {
+			list_for_each_entry_continue(pos, list, list)
+				pwrseq_unit_enable(pwrseq, pos->unit);
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static int pwrseq_unit_enable(struct pwrseq_device *pwrseq,
+			      struct pwrseq_unit *unit)
+{
+	int ret;
+
+	lockdep_assert_held_read(&pwrseq->rw_lock);
+	lockdep_assert_held(&pwrseq->state_lock);
+
+	if (unit->enable_count != 0) {
+		unit->enable_count++;
+		return 0;
+	}
+
+	ret = pwrseq_unit_enable_deps(pwrseq, &unit->deps);
+	if (ret) {
+		dev_err(&pwrseq->dev,
+			"Failed to enable dependencies before power-on for target '%s': %d\n",
+			unit->name, ret);
+		return ret;
+	}
+
+	if (unit->enable) {
+		ret = unit->enable(pwrseq);
+		if (ret) {
+			dev_err(&pwrseq->dev,
+				"Failed to enable target '%s': %d\n",
+				unit->name, ret);
+			pwrseq_unit_disable_deps(pwrseq, &unit->deps);
+			return ret;
+		}
+	}
+
+	unit->enable_count++;
+
+	return 0;
+}
+
+static int pwrseq_unit_disable(struct pwrseq_device *pwrseq,
+			       struct pwrseq_unit *unit)
+{
+	int ret;
+
+	lockdep_assert_held_read(&pwrseq->rw_lock);
+	lockdep_assert_held(&pwrseq->state_lock);
+
+	if (unit->enable_count == 0) {
+		WARN(1, "Unmatched power-off for target '%s'\n",
+		     unit->name);
+		return -EBUSY;
+	}
+
+	if (unit->enable_count != 1) {
+		unit->enable_count--;
+		return 0;
+	}
+
+	if (unit->disable) {
+		ret = unit->disable(pwrseq);
+		if (ret) {
+			dev_err(&pwrseq->dev,
+				"Failed to disable target '%s': %d\n",
+				unit->name, ret);
+			return ret;
+		}
+	}
+
+	ret = pwrseq_unit_disable_deps(pwrseq, &unit->deps);
+	if (ret) {
+		dev_err(&pwrseq->dev,
+			"Failed to disable dependencies after power-off for target '%s': %d\n",
+			unit->name, ret);
+		if (unit->enable)
+			unit->enable(pwrseq);
+		return ret;
+	}
+
+	unit->enable_count--;
+
+	return 0;
+}
+
+/**
+ * pwrseq_power_on() - Issue a power-on request on behalf of the consumer
+ *                     device.
+ * @desc: Descriptor referencing the power sequencer.
+ *
+ * This function tells the power sequencer that the consumer wants to be
+ * powered-up. The sequencer may already have powered-up the device in which
+ * case the function returns 0. If the power-up sequence is already in
+ * progress, the function will block until it's done and return 0. If this is
+ * the first request, the device will be powered up.
+ *
+ * Returns:
+ * 0 on success, negative error number on failure.
+ */
+int pwrseq_power_on(struct pwrseq_desc *desc)
+{
+	struct pwrseq_device *pwrseq;
+	struct pwrseq_target *target;
+	struct pwrseq_unit *unit;
+	int ret;
+
+	might_sleep();
+
+	if (!desc || desc->powered_on)
+		return 0;
+
+	pwrseq = desc->pwrseq;
+	target = desc->target;
+	unit = target->unit;
+
+	guard(rwsem_read)(&pwrseq->rw_lock);
+	if (!device_is_registered(&pwrseq->dev))
+		return -ENODEV;
+
+	scoped_guard(mutex, &pwrseq->state_lock) {
+		ret = pwrseq_unit_enable(pwrseq, unit);
+		if (!ret)
+			desc->powered_on = true;
+	}
+
+	if (target->post_enable) {
+		ret = target->post_enable(pwrseq);
+		if (ret) {
+			pwrseq_unit_disable(pwrseq, unit);
+			desc->powered_on = false;
+		}
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(pwrseq_power_on);
+
+/**
+ * pwrseq_power_off() - Issue a power-off request on behalf of the consumer
+ *                      device.
+ * @desc: Descriptor referencing the power sequencer.
+ *
+ * This undoes the effects of pwrseq_power_on(). It issues a power-off request
+ * on behalf of the consumer and when the last remaining user does so, the
+ * power-down sequence will be started. If one is in progress, the function
+ * will block until it's complete and then return.
+ *
+ * Returns:
+ * 0 on success, negative error number on failure.
+ */
+int pwrseq_power_off(struct pwrseq_desc *desc)
+{
+	struct pwrseq_device *pwrseq;
+	struct pwrseq_unit *unit;
+	int ret;
+
+	might_sleep();
+
+	if (!desc || !desc->powered_on)
+		return 0;
+
+	pwrseq = desc->pwrseq;
+	unit = desc->target->unit;
+
+	guard(rwsem_read)(&pwrseq->rw_lock);
+	if (!device_is_registered(&pwrseq->dev))
+		return -ENODEV;
+
+	guard(mutex)(&pwrseq->state_lock);
+
+	ret = pwrseq_unit_disable(pwrseq, unit);
+	if (!ret)
+		desc->powered_on = false;
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(pwrseq_power_off);
+
+#if IS_ENABLED(CONFIG_DEBUG_FS)
+
+struct pwrseq_debugfs_count_ctx {
+	struct device *dev;
+	loff_t index;
+};
+
+static int pwrseq_debugfs_seq_count(struct device *dev, void *data)
+{
+	struct pwrseq_debugfs_count_ctx *ctx = data;
+
+	ctx->dev = dev;
+
+	return ctx->index-- ? 0 : 1;
+}
+
+static void *pwrseq_debugfs_seq_start(struct seq_file *seq, loff_t *pos)
+{
+	struct pwrseq_debugfs_count_ctx ctx;
+
+	ctx.dev = NULL;
+	ctx.index = *pos;
+
+	/*
+	 * We're holding the lock for the entire printout so no need to fiddle
+	 * with device reference count.
+	 */
+	down_read(&pwrseq_sem);
+
+	bus_for_each_dev(&pwrseq_bus, NULL, &ctx, pwrseq_debugfs_seq_count);
+	if (!ctx.index)
+		return NULL;
+
+	return ctx.dev;
+}
+
+static void *pwrseq_debugfs_seq_next(struct seq_file *seq, void *data,
+				     loff_t *pos)
+{
+	struct device *curr = data;
+
+	++*pos;
+
+	struct device *next __free(put_device) =
+			bus_find_next_device(&pwrseq_bus, curr);
+	return next;
+}
+
+static void pwrseq_debugfs_seq_show_target(struct seq_file *seq,
+					   struct pwrseq_target *target)
+{
+	seq_printf(seq, "    target: [%s] (target unit: [%s])\n",
+		   target->name, target->unit->name);
+}
+
+static void pwrseq_debugfs_seq_show_unit(struct seq_file *seq,
+					 struct pwrseq_unit *unit)
+{
+	struct pwrseq_unit_dep *ref;
+
+	seq_printf(seq, "    unit: [%s] - enable count: %u\n",
+		   unit->name, unit->enable_count);
+
+	if (list_empty(&unit->deps))
+		return;
+
+	seq_puts(seq, "      dependencies:\n");
+	list_for_each_entry(ref, &unit->deps, list)
+		seq_printf(seq, "        [%s]\n", ref->unit->name);
+}
+
+static int pwrseq_debugfs_seq_show(struct seq_file *seq, void *data)
+{
+	struct device *dev = data;
+	struct pwrseq_device *pwrseq = to_pwrseq_device(dev);
+	struct pwrseq_target *target;
+	struct pwrseq_unit *unit;
+
+	seq_printf(seq, "%s:\n", dev_name(dev));
+
+	seq_puts(seq, "  targets:\n");
+	list_for_each_entry(target, &pwrseq->targets, list)
+		pwrseq_debugfs_seq_show_target(seq, target);
+
+	seq_puts(seq, "  units:\n");
+	list_for_each_entry(unit, &pwrseq->units, list)
+		pwrseq_debugfs_seq_show_unit(seq, unit);
+
+	return 0;
+}
+
+static void pwrseq_debugfs_seq_stop(struct seq_file *seq, void *data)
+{
+	up_read(&pwrseq_sem);
+}
+
+static const struct seq_operations pwrseq_debugfs_sops = {
+	.start = pwrseq_debugfs_seq_start,
+	.next = pwrseq_debugfs_seq_next,
+	.show = pwrseq_debugfs_seq_show,
+	.stop = pwrseq_debugfs_seq_stop,
+};
+DEFINE_SEQ_ATTRIBUTE(pwrseq_debugfs);
+
+static struct dentry *pwrseq_debugfs_dentry;
+
+#endif /* CONFIG_DEBUG_FS */
+
+static int __init pwrseq_init(void)
+{
+	int ret;
+
+	ret = bus_register(&pwrseq_bus);
+	if (ret) {
+		pr_err("Failed to register the power sequencer bus\n");
+		return ret;
+	}
+
+#if IS_ENABLED(CONFIG_DEBUG_FS)
+	pwrseq_debugfs_dentry = debugfs_create_file("pwrseq", 0444, NULL, NULL,
+						    &pwrseq_debugfs_fops);
+#endif  /* CONFIG_DEBUG_FS */
+
+	return 0;
+}
+subsys_initcall(pwrseq_init);
+
+static void __exit pwrseq_exit(void)
+{
+#if IS_ENABLED(CONFIG_DEBUG_FS)
+	debugfs_remove_recursive(pwrseq_debugfs_dentry);
+#endif  /* CONFIG_DEBUG_FS */
+
+	bus_unregister(&pwrseq_bus);
+}
+module_exit(pwrseq_exit);
+
+MODULE_AUTHOR("Bartosz Golaszewski <bartosz.golaszewski@linaro.org>");
+MODULE_DESCRIPTION("Power Sequencing subsystem core");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/power/sequencing/pwrseq-qcom-wcn.c
+++ linux-qcom-6.8.0/drivers/power/sequencing/pwrseq-qcom-wcn.c
@@ -0,0 +1,355 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2024 Linaro Ltd.
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/gpio/consumer.h>
+#include <linux/jiffies.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/pwrseq/provider.h>
+#include <linux/string.h>
+#include <linux/types.h>
+
+struct pwrseq_qcom_wcn_pdata {
+	const char *const *vregs;
+	size_t num_vregs;
+	unsigned int pwup_delay_ms;
+	unsigned int gpio_enable_delay_ms;
+};
+
+struct pwrseq_qcom_wcn_ctx {
+	struct pwrseq_device *pwrseq;
+	struct device_node *of_node;
+	const struct pwrseq_qcom_wcn_pdata *pdata;
+	struct regulator_bulk_data *regs;
+	struct gpio_desc *bt_gpio;
+	struct gpio_desc *wlan_gpio;
+	struct clk *clk;
+	unsigned long last_gpio_enable_jf;
+};
+
+static void pwrseq_qcom_wcn_ensure_gpio_delay(struct pwrseq_qcom_wcn_ctx *ctx)
+{
+	unsigned long diff_jiffies;
+	unsigned int diff_msecs;
+
+	if (!ctx->pdata->gpio_enable_delay_ms)
+		return;
+
+	diff_jiffies = jiffies - ctx->last_gpio_enable_jf;
+	diff_msecs = jiffies_to_msecs(diff_jiffies);
+
+	if (diff_msecs < ctx->pdata->gpio_enable_delay_ms)
+		msleep(ctx->pdata->gpio_enable_delay_ms - diff_msecs);
+}
+
+static int pwrseq_qcom_wcn_vregs_enable(struct pwrseq_device *pwrseq)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+
+	return regulator_bulk_enable(ctx->pdata->num_vregs, ctx->regs);
+}
+
+static int pwrseq_qcom_wcn_vregs_disable(struct pwrseq_device *pwrseq)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+
+	return regulator_bulk_disable(ctx->pdata->num_vregs, ctx->regs);
+}
+
+static const struct pwrseq_unit_data pwrseq_qcom_wcn_vregs_unit_data = {
+	.name = "regulators-enable",
+	.enable = pwrseq_qcom_wcn_vregs_enable,
+	.disable = pwrseq_qcom_wcn_vregs_disable,
+};
+
+static int pwrseq_qcom_wcn_clk_enable(struct pwrseq_device *pwrseq)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+
+	return clk_prepare_enable(ctx->clk);
+}
+
+static int pwrseq_qcom_wcn_clk_disable(struct pwrseq_device *pwrseq)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+
+	clk_disable_unprepare(ctx->clk);
+
+	return 0;
+}
+
+static const struct pwrseq_unit_data pwrseq_qcom_wcn_clk_unit_data = {
+	.name = "clock-enable",
+	.enable = pwrseq_qcom_wcn_clk_enable,
+	.disable = pwrseq_qcom_wcn_clk_disable,
+};
+
+static const struct pwrseq_unit_data *pwrseq_qcom_wcn_unit_deps[] = {
+	&pwrseq_qcom_wcn_vregs_unit_data,
+	&pwrseq_qcom_wcn_clk_unit_data,
+	NULL
+};
+
+static int pwrseq_qcom_wcn_bt_enable(struct pwrseq_device *pwrseq)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+
+	pwrseq_qcom_wcn_ensure_gpio_delay(ctx);
+	gpiod_set_value_cansleep(ctx->bt_gpio, 1);
+	ctx->last_gpio_enable_jf = jiffies;
+
+	return 0;
+}
+
+static int pwrseq_qcom_wcn_bt_disable(struct pwrseq_device *pwrseq)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+
+	gpiod_set_value_cansleep(ctx->bt_gpio, 0);
+
+	return 0;
+}
+
+static const struct pwrseq_unit_data pwrseq_qcom_wcn_bt_unit_data = {
+	.name = "bluetooth-enable",
+	.deps = pwrseq_qcom_wcn_unit_deps,
+	.enable = pwrseq_qcom_wcn_bt_enable,
+	.disable = pwrseq_qcom_wcn_bt_disable,
+};
+
+static int pwrseq_qcom_wcn_wlan_enable(struct pwrseq_device *pwrseq)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+
+	pwrseq_qcom_wcn_ensure_gpio_delay(ctx);
+	gpiod_set_value_cansleep(ctx->wlan_gpio, 1);
+	ctx->last_gpio_enable_jf = jiffies;
+
+	return 0;
+}
+
+static int pwrseq_qcom_wcn_wlan_disable(struct pwrseq_device *pwrseq)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+
+	gpiod_set_value_cansleep(ctx->wlan_gpio, 0);
+
+	return 0;
+}
+
+static const struct pwrseq_unit_data pwrseq_qcom_wcn_wlan_unit_data = {
+	.name = "wlan-enable",
+	.deps = pwrseq_qcom_wcn_unit_deps,
+	.enable = pwrseq_qcom_wcn_wlan_enable,
+	.disable = pwrseq_qcom_wcn_wlan_disable,
+};
+
+static int pwrseq_qcom_wcn_pwup_delay(struct pwrseq_device *pwrseq)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+
+	if (ctx->pdata->pwup_delay_ms)
+		msleep(ctx->pdata->pwup_delay_ms);
+
+	return 0;
+}
+
+static const struct pwrseq_target_data pwrseq_qcom_wcn_bt_target_data = {
+	.name = "bluetooth",
+	.unit = &pwrseq_qcom_wcn_bt_unit_data,
+	.post_enable = pwrseq_qcom_wcn_pwup_delay,
+};
+
+static const struct pwrseq_target_data pwrseq_qcom_wcn_wlan_target_data = {
+	.name = "wlan",
+	.unit = &pwrseq_qcom_wcn_wlan_unit_data,
+	.post_enable = pwrseq_qcom_wcn_pwup_delay,
+};
+
+static const struct pwrseq_target_data *pwrseq_qcom_wcn_targets[] = {
+	&pwrseq_qcom_wcn_bt_target_data,
+	&pwrseq_qcom_wcn_wlan_target_data,
+	NULL
+};
+
+static const char *const pwrseq_qca6390_vregs[] = {
+	"vddio",
+	"vddaon",
+	"vddpmu",
+	"vddrfa0p95",
+	"vddrfa1p3",
+	"vddrfa1p9",
+	"vddpcie1p3",
+	"vddpcie1p9",
+};
+
+static const struct pwrseq_qcom_wcn_pdata pwrseq_qca6390_of_data = {
+	.vregs = pwrseq_qca6390_vregs,
+	.num_vregs = ARRAY_SIZE(pwrseq_qca6390_vregs),
+	.pwup_delay_ms = 60,
+	.gpio_enable_delay_ms = 100,
+};
+
+static const char *const pwrseq_wcn6855_vregs[] = {
+	"vddaon",
+	"vddvm",
+	"vddvl",
+	"vddvh",
+};
+
+static const struct pwrseq_qcom_wcn_pdata pwrseq_wcn6855_of_data = {
+	.vregs = pwrseq_wcn6855_vregs,
+	.num_vregs = ARRAY_SIZE(pwrseq_wcn6855_vregs),
+	.pwup_delay_ms = 60,
+	.gpio_enable_delay_ms = 100,
+};
+
+
+static const char *const pwrseq_wcn7850_vregs[] = {
+	"vdd",
+	"vddio",
+	"vddio1p2",
+	"vddaon",
+	"vdddig",
+	"vddrfa1p2",
+	"vddrfa1p8",
+};
+
+static const struct pwrseq_qcom_wcn_pdata pwrseq_wcn7850_of_data = {
+	.vregs = pwrseq_wcn7850_vregs,
+	.num_vregs = ARRAY_SIZE(pwrseq_wcn7850_vregs),
+	.pwup_delay_ms = 50,
+};
+
+static int pwrseq_qcom_wcn_match(struct pwrseq_device *pwrseq,
+				 struct device *dev)
+{
+	struct pwrseq_qcom_wcn_ctx *ctx = pwrseq_device_get_drvdata(pwrseq);
+	struct device_node *dev_node = dev->of_node;
+
+	/*
+	 * The PMU supplies power to the Bluetooth and WLAN modules. both
+	 * consume the PMU AON output so check the presence of the
+	 * 'vddaon-supply' property and whether it leads us to the right
+	 * device.
+	 */
+	if (!of_property_present(dev_node, "vddaon-supply"))
+		return 0;
+
+	struct device_node *reg_node __free(device_node) =
+			of_parse_phandle(dev_node, "vddaon-supply", 0);
+	if (!reg_node)
+		return 0;
+
+	/*
+	 * `reg_node` is the PMU AON regulator, its parent is the `regulators`
+	 * node and finally its grandparent is the PMU device node that we're
+	 * looking for.
+	 */
+	if (!reg_node->parent || !reg_node->parent->parent ||
+	    reg_node->parent->parent != ctx->of_node)
+		return 0;
+
+	return 1;
+}
+
+static int pwrseq_qcom_wcn_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct pwrseq_qcom_wcn_ctx *ctx;
+	struct pwrseq_config config;
+	int i, ret;
+
+	ctx = devm_kzalloc(dev, sizeof(*ctx), GFP_KERNEL);
+	if (!ctx)
+		return -ENOMEM;
+
+	ctx->of_node = dev->of_node;
+
+	ctx->pdata = of_device_get_match_data(dev);
+	if (!ctx->pdata)
+		return dev_err_probe(dev, -ENODEV,
+				     "Failed to obtain platform data\n");
+
+	ctx->regs = devm_kcalloc(dev, ctx->pdata->num_vregs,
+				 sizeof(*ctx->regs), GFP_KERNEL);
+	if (!ctx->regs)
+		return -ENOMEM;
+
+	for (i = 0; i < ctx->pdata->num_vregs; i++)
+		ctx->regs[i].supply = ctx->pdata->vregs[i];
+
+	ret = devm_regulator_bulk_get(dev, ctx->pdata->num_vregs, ctx->regs);
+	if (ret < 0)
+		return dev_err_probe(dev, ret,
+				     "Failed to get all regulators\n");
+
+	ctx->bt_gpio = devm_gpiod_get_optional(dev, "bt-enable", GPIOD_OUT_LOW);
+	if (IS_ERR(ctx->bt_gpio))
+		return dev_err_probe(dev, PTR_ERR(ctx->bt_gpio),
+				     "Failed to get the Bluetooth enable GPIO\n");
+
+	ctx->wlan_gpio = devm_gpiod_get_optional(dev, "wlan-enable",
+						 GPIOD_OUT_LOW);
+	if (IS_ERR(ctx->wlan_gpio))
+		return dev_err_probe(dev, PTR_ERR(ctx->wlan_gpio),
+				     "Failed to get the WLAN enable GPIO\n");
+
+	ctx->clk = devm_clk_get_optional(dev, NULL);
+	if (IS_ERR(ctx->clk))
+		return dev_err_probe(dev, PTR_ERR(ctx->clk),
+				     "Failed to get the reference clock\n");
+
+	memset(&config, 0, sizeof(config));
+
+	config.parent = dev;
+	config.owner = THIS_MODULE;
+	config.drvdata = ctx;
+	config.match = pwrseq_qcom_wcn_match;
+	config.targets = pwrseq_qcom_wcn_targets;
+
+	ctx->pwrseq = devm_pwrseq_device_register(dev, &config);
+	if (IS_ERR(ctx->pwrseq))
+		return dev_err_probe(dev, PTR_ERR(ctx->pwrseq),
+				     "Failed to register the power sequencer\n");
+
+	return 0;
+}
+
+static const struct of_device_id pwrseq_qcom_wcn_of_match[] = {
+	{
+		.compatible = "qcom,qca6390-pmu",
+		.data = &pwrseq_qca6390_of_data,
+	},
+	{
+		.compatible = "qcom,wcn6855-pmu",
+		.data = &pwrseq_wcn6855_of_data,
+	},
+	{
+		.compatible = "qcom,wcn7850-pmu",
+		.data = &pwrseq_wcn7850_of_data,
+	},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, pwrseq_qcom_wcn_of_match);
+
+static struct platform_driver pwrseq_qcom_wcn_driver = {
+	.driver = {
+		.name = "pwrseq-qcom_wcn",
+		.of_match_table = pwrseq_qcom_wcn_of_match,
+	},
+	.probe = pwrseq_qcom_wcn_probe,
+};
+module_platform_driver(pwrseq_qcom_wcn_driver);
+
+MODULE_AUTHOR("Bartosz Golaszewski <bartosz.golaszewski@linaro.org>");
+MODULE_DESCRIPTION("Qualcomm WCN PMU power sequencing driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/power/supply/ab8500_charger.c
+++ linux-qcom-6.8.0/drivers/power/supply/ab8500_charger.c
@@ -488,8 +488,10 @@
 	/* Only measure voltage if the charger is connected */
 	if (di->ac.charger_connected) {
 		ret = iio_read_channel_processed(di->adc_main_charger_v, &vch);
-		if (ret < 0)
+		if (ret < 0) {
 			dev_err(di->dev, "%s ADC conv failed,\n", __func__);
+			return ret;
+		}
 	} else {
 		vch = 0;
 	}
@@ -540,8 +542,10 @@
 	/* Only measure voltage if the charger is connected */
 	if (di->usb.charger_connected) {
 		ret = iio_read_channel_processed(di->adc_vbus_v, &vch);
-		if (ret < 0)
+		if (ret < 0) {
 			dev_err(di->dev, "%s ADC conv failed,\n", __func__);
+			return ret;
+		}
 	} else {
 		vch = 0;
 	}
@@ -563,8 +567,10 @@
 	/* Only measure current if the charger is online */
 	if (di->usb.charger_online) {
 		ret = iio_read_channel_processed(di->adc_usb_charger_c, &ich);
-		if (ret < 0)
+		if (ret < 0) {
 			dev_err(di->dev, "%s ADC conv failed,\n", __func__);
+			return ret;
+		}
 	} else {
 		ich = 0;
 	}
@@ -586,8 +592,10 @@
 	/* Only measure current if the charger is online */
 	if (di->ac.charger_online) {
 		ret = iio_read_channel_processed(di->adc_main_charger_c, &ich);
-		if (ret < 0)
+		if (ret < 0) {
 			dev_err(di->dev, "%s ADC conv failed,\n", __func__);
+			return ret;
+		}
 	} else {
 		ich = 0;
 	}
--- linux-qcom-6.8.0.orig/drivers/power/supply/axp20x_battery.c
+++ linux-qcom-6.8.0/drivers/power/supply/axp20x_battery.c
@@ -303,11 +303,11 @@
 		val->intval = reg & AXP209_FG_PERCENT;
 		break;
 
-	case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN:
+	case POWER_SUPPLY_PROP_VOLTAGE_MAX:
 		return axp20x_batt->data->get_max_voltage(axp20x_batt,
 							  &val->intval);
 
-	case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN:
+	case POWER_SUPPLY_PROP_VOLTAGE_MIN:
 		ret = regmap_read(axp20x_batt->regmap, AXP20X_V_OFF, &reg);
 		if (ret)
 			return ret;
@@ -455,10 +455,10 @@
 	struct axp20x_batt_ps *axp20x_batt = power_supply_get_drvdata(psy);
 
 	switch (psp) {
-	case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN:
+	case POWER_SUPPLY_PROP_VOLTAGE_MIN:
 		return axp20x_set_voltage_min_design(axp20x_batt, val->intval);
 
-	case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN:
+	case POWER_SUPPLY_PROP_VOLTAGE_MAX:
 		return axp20x_batt->data->set_max_voltage(axp20x_batt, val->intval);
 
 	case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT:
@@ -493,8 +493,8 @@
 	POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT,
 	POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX,
 	POWER_SUPPLY_PROP_HEALTH,
-	POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN,
-	POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN,
+	POWER_SUPPLY_PROP_VOLTAGE_MAX,
+	POWER_SUPPLY_PROP_VOLTAGE_MIN,
 	POWER_SUPPLY_PROP_CAPACITY,
 };
 
@@ -502,8 +502,8 @@
 					 enum power_supply_property psp)
 {
 	return psp == POWER_SUPPLY_PROP_STATUS ||
-	       psp == POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN ||
-	       psp == POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN ||
+	       psp == POWER_SUPPLY_PROP_VOLTAGE_MIN ||
+	       psp == POWER_SUPPLY_PROP_VOLTAGE_MAX ||
 	       psp == POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT ||
 	       psp == POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX;
 }
--- linux-qcom-6.8.0.orig/drivers/power/supply/axp288_charger.c
+++ linux-qcom-6.8.0/drivers/power/supply/axp288_charger.c
@@ -178,18 +178,18 @@
 	u8 reg_val;
 	int ret;
 
-	if (cv <= CV_4100MV) {
-		reg_val = CHRG_CCCV_CV_4100MV;
-		cv = CV_4100MV;
-	} else if (cv <= CV_4150MV) {
-		reg_val = CHRG_CCCV_CV_4150MV;
-		cv = CV_4150MV;
-	} else if (cv <= CV_4200MV) {
+	if (cv >= CV_4350MV) {
+		reg_val = CHRG_CCCV_CV_4350MV;
+		cv = CV_4350MV;
+	} else if (cv >= CV_4200MV) {
 		reg_val = CHRG_CCCV_CV_4200MV;
 		cv = CV_4200MV;
+	} else if (cv >= CV_4150MV) {
+		reg_val = CHRG_CCCV_CV_4150MV;
+		cv = CV_4150MV;
 	} else {
-		reg_val = CHRG_CCCV_CV_4350MV;
-		cv = CV_4350MV;
+		reg_val = CHRG_CCCV_CV_4100MV;
+		cv = CV_4100MV;
 	}
 
 	reg_val = reg_val << CHRG_CCCV_CV_BIT_POS;
@@ -337,8 +337,8 @@
 		}
 		break;
 	case POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE:
-		scaled_val = min(val->intval, info->max_cv);
-		scaled_val = DIV_ROUND_CLOSEST(scaled_val, 1000);
+		scaled_val = DIV_ROUND_CLOSEST(val->intval, 1000);
+		scaled_val = min(scaled_val, info->max_cv);
 		ret = axp288_charger_set_cv(info, scaled_val);
 		if (ret < 0) {
 			dev_warn(&info->pdev->dev, "set charge voltage failed\n");
--- linux-qcom-6.8.0.orig/drivers/power/supply/bq24190_charger.c
+++ linux-qcom-6.8.0/drivers/power/supply/bq24190_charger.c
@@ -567,6 +567,7 @@
 
 static int bq24296_set_otg_vbus(struct bq24190_dev_info *bdi, bool enable)
 {
+	union power_supply_propval val = { .intval = bdi->charge_type };
 	int ret;
 
 	ret = pm_runtime_resume_and_get(bdi->dev);
@@ -587,13 +588,18 @@
 
 		ret = bq24190_write_mask(bdi, BQ24190_REG_POC,
 					 BQ24296_REG_POC_OTG_CONFIG_MASK,
-					 BQ24296_REG_POC_CHG_CONFIG_SHIFT,
+					 BQ24296_REG_POC_OTG_CONFIG_SHIFT,
 					 BQ24296_REG_POC_OTG_CONFIG_OTG);
-	} else
+	} else {
 		ret = bq24190_write_mask(bdi, BQ24190_REG_POC,
 					 BQ24296_REG_POC_OTG_CONFIG_MASK,
-					 BQ24296_REG_POC_CHG_CONFIG_SHIFT,
+					 BQ24296_REG_POC_OTG_CONFIG_SHIFT,
 					 BQ24296_REG_POC_OTG_CONFIG_DISABLE);
+		if (ret < 0)
+			goto out;
+
+		ret = bq24190_charger_set_charge_type(bdi, &val);
+	}
 
 out:
 	pm_runtime_mark_last_busy(bdi->dev);
--- linux-qcom-6.8.0.orig/drivers/power/supply/bq27xxx_battery.c
+++ linux-qcom-6.8.0/drivers/power/supply/bq27xxx_battery.c
@@ -449,9 +449,29 @@
 		[BQ27XXX_REG_AP] = 0x18,
 		BQ27XXX_DM_REG_ROWS,
 	},
+	bq27426_regs[BQ27XXX_REG_MAX] = {
+		[BQ27XXX_REG_CTRL] = 0x00,
+		[BQ27XXX_REG_TEMP] = 0x02,
+		[BQ27XXX_REG_INT_TEMP] = 0x1e,
+		[BQ27XXX_REG_VOLT] = 0x04,
+		[BQ27XXX_REG_AI] = 0x10,
+		[BQ27XXX_REG_FLAGS] = 0x06,
+		[BQ27XXX_REG_TTE] = INVALID_REG_ADDR,
+		[BQ27XXX_REG_TTF] = INVALID_REG_ADDR,
+		[BQ27XXX_REG_TTES] = INVALID_REG_ADDR,
+		[BQ27XXX_REG_TTECP] = INVALID_REG_ADDR,
+		[BQ27XXX_REG_NAC] = 0x08,
+		[BQ27XXX_REG_RC] = 0x0c,
+		[BQ27XXX_REG_FCC] = 0x0e,
+		[BQ27XXX_REG_CYCT] = INVALID_REG_ADDR,
+		[BQ27XXX_REG_AE] = INVALID_REG_ADDR,
+		[BQ27XXX_REG_SOC] = 0x1c,
+		[BQ27XXX_REG_DCAP] = INVALID_REG_ADDR,
+		[BQ27XXX_REG_AP] = 0x18,
+		BQ27XXX_DM_REG_ROWS,
+	},
 #define bq27411_regs bq27421_regs
 #define bq27425_regs bq27421_regs
-#define bq27426_regs bq27421_regs
 #define bq27441_regs bq27421_regs
 #define bq27621_regs bq27421_regs
 	bq27z561_regs[BQ27XXX_REG_MAX] = {
@@ -769,10 +789,23 @@
 };
 #define bq27411_props bq27421_props
 #define bq27425_props bq27421_props
-#define bq27426_props bq27421_props
 #define bq27441_props bq27421_props
 #define bq27621_props bq27421_props
 
+static enum power_supply_property bq27426_props[] = {
+	POWER_SUPPLY_PROP_STATUS,
+	POWER_SUPPLY_PROP_PRESENT,
+	POWER_SUPPLY_PROP_VOLTAGE_NOW,
+	POWER_SUPPLY_PROP_CURRENT_NOW,
+	POWER_SUPPLY_PROP_CAPACITY,
+	POWER_SUPPLY_PROP_CAPACITY_LEVEL,
+	POWER_SUPPLY_PROP_TEMP,
+	POWER_SUPPLY_PROP_TECHNOLOGY,
+	POWER_SUPPLY_PROP_CHARGE_FULL,
+	POWER_SUPPLY_PROP_CHARGE_NOW,
+	POWER_SUPPLY_PROP_MANUFACTURER,
+};
+
 static enum power_supply_property bq27z561_props[] = {
 	POWER_SUPPLY_PROP_STATUS,
 	POWER_SUPPLY_PROP_PRESENT,
--- linux-qcom-6.8.0.orig/drivers/power/supply/cros_usbpd-charger.c
+++ linux-qcom-6.8.0/drivers/power/supply/cros_usbpd-charger.c
@@ -5,6 +5,7 @@
  * Copyright (c) 2014 - 2018 Google, Inc
  */
 
+#include <linux/mod_devicetable.h>
 #include <linux/module.h>
 #include <linux/platform_data/cros_ec_commands.h>
 #include <linux/platform_data/cros_ec_proto.h>
@@ -711,16 +712,22 @@
 static SIMPLE_DEV_PM_OPS(cros_usbpd_charger_pm_ops, NULL,
 			 cros_usbpd_charger_resume);
 
+static const struct platform_device_id cros_usbpd_charger_id[] = {
+	{ DRV_NAME, 0 },
+	{}
+};
+MODULE_DEVICE_TABLE(platform, cros_usbpd_charger_id);
+
 static struct platform_driver cros_usbpd_charger_driver = {
 	.driver = {
 		.name = DRV_NAME,
 		.pm = &cros_usbpd_charger_pm_ops,
 	},
-	.probe = cros_usbpd_charger_probe
+	.probe = cros_usbpd_charger_probe,
+	.id_table = cros_usbpd_charger_id,
 };
 
 module_platform_driver(cros_usbpd_charger_driver);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("ChromeOS EC USBPD charger");
-MODULE_ALIAS("platform:" DRV_NAME);
--- linux-qcom-6.8.0.orig/drivers/power/supply/gpio-charger.c
+++ linux-qcom-6.8.0/drivers/power/supply/gpio-charger.c
@@ -67,6 +67,14 @@
 		if (gpio_charger->current_limit_map[i].limit_ua <= val)
 			break;
 	}
+
+	/*
+	 * If a valid charge current limit isn't found, default to smallest
+	 * current limitation for safety reasons.
+	 */
+	if (i >= gpio_charger->current_limit_map_size)
+		i = gpio_charger->current_limit_map_size - 1;
+
 	mapping = gpio_charger->current_limit_map[i];
 
 	for (i = 0; i < ndescs; i++) {
--- linux-qcom-6.8.0.orig/drivers/power/supply/ingenic-battery.c
+++ linux-qcom-6.8.0/drivers/power/supply/ingenic-battery.c
@@ -31,8 +31,9 @@
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_HEALTH:
-		ret = iio_read_channel_processed(bat->channel, &val->intval);
-		val->intval *= 1000;
+		ret = iio_read_channel_processed_scale(bat->channel,
+						       &val->intval,
+						       1000);
 		if (val->intval < info->voltage_min_design_uv)
 			val->intval = POWER_SUPPLY_HEALTH_DEAD;
 		else if (val->intval > info->voltage_max_design_uv)
@@ -41,8 +42,9 @@
 			val->intval = POWER_SUPPLY_HEALTH_GOOD;
 		return ret;
 	case POWER_SUPPLY_PROP_VOLTAGE_NOW:
-		ret = iio_read_channel_processed(bat->channel, &val->intval);
-		val->intval *= 1000;
+		ret = iio_read_channel_processed_scale(bat->channel,
+						       &val->intval,
+						       1000);
 		return ret;
 	case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN:
 		val->intval = info->voltage_min_design_uv;
--- linux-qcom-6.8.0.orig/drivers/power/supply/max17042_battery.c
+++ linux-qcom-6.8.0/drivers/power/supply/max17042_battery.c
@@ -853,7 +853,10 @@
 	/* program interrupt thresholds such that we should
 	 * get interrupt for every 'off' perc change in the soc
 	 */
-	regmap_read(map, MAX17042_RepSOC, &soc);
+	if (chip->pdata->enable_current_sense)
+		regmap_read(map, MAX17042_RepSOC, &soc);
+	else
+		regmap_read(map, MAX17042_VFSOC, &soc);
 	soc >>= 8;
 	soc_tr = (soc + off) << 8;
 	if (off < soc)
--- linux-qcom-6.8.0.orig/drivers/power/supply/mm8013.c
+++ linux-qcom-6.8.0/drivers/power/supply/mm8013.c
@@ -71,7 +71,6 @@
 
 static enum power_supply_property mm8013_battery_props[] = {
 	POWER_SUPPLY_PROP_CAPACITY,
-	POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR,
 	POWER_SUPPLY_PROP_CHARGE_FULL,
 	POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN,
 	POWER_SUPPLY_PROP_CHARGE_NOW,
@@ -103,16 +102,6 @@
 
 		val->intval = regval;
 		break;
-	case POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR:
-		ret = regmap_read(chip->regmap, REG_FLAGS, &regval);
-		if (ret < 0)
-			return ret;
-
-		if (regval & MM8013_FLAG_CHG_INH)
-			val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE;
-		else
-			val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO;
-		break;
 	case POWER_SUPPLY_PROP_CHARGE_FULL:
 		ret = regmap_read(chip->regmap, REG_FULL_CHARGE_CAPACITY, &regval);
 		if (ret < 0)
@@ -187,6 +176,8 @@
 
 		if (regval & MM8013_FLAG_DSG)
 			val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
+		else if (regval & MM8013_FLAG_CHG_INH)
+			val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
 		else if (regval & MM8013_FLAG_CHG)
 			val->intval = POWER_SUPPLY_STATUS_CHARGING;
 		else if (regval & MM8013_FLAG_FC)
--- linux-qcom-6.8.0.orig/drivers/power/supply/mt6360_charger.c
+++ linux-qcom-6.8.0/drivers/power/supply/mt6360_charger.c
@@ -588,7 +588,7 @@
 };
 
 static const struct regulator_desc mt6360_otg_rdesc = {
-	.of_match = "usb-otg-vbus",
+	.of_match = "usb-otg-vbus-regulator",
 	.name = "usb-otg-vbus",
 	.ops = &mt6360_chg_otg_ops,
 	.owner = THIS_MODULE,
--- linux-qcom-6.8.0.orig/drivers/power/supply/power_supply_core.c
+++ linux-qcom-6.8.0/drivers/power/supply/power_supply_core.c
@@ -479,8 +479,6 @@
  */
 void power_supply_put(struct power_supply *psy)
 {
-	might_sleep();
-
 	atomic_dec(&psy->use_cnt);
 	put_device(&psy->dev);
 }
@@ -1228,11 +1226,7 @@
 int power_supply_property_is_writeable(struct power_supply *psy,
 					enum power_supply_property psp)
 {
-	if (atomic_read(&psy->use_cnt) <= 0 ||
-			!psy->desc->property_is_writeable)
-		return -ENODEV;
-
-	return psy->desc->property_is_writeable(psy, psp);
+	return psy->desc->property_is_writeable && psy->desc->property_is_writeable(psy, psp);
 }
 EXPORT_SYMBOL_GPL(power_supply_property_is_writeable);
 
--- linux-qcom-6.8.0.orig/drivers/power/supply/power_supply_hwmon.c
+++ linux-qcom-6.8.0/drivers/power/supply/power_supply_hwmon.c
@@ -299,7 +299,8 @@
 			   HWMON_T_INPUT     |
 			   HWMON_T_MAX       |
 			   HWMON_T_MIN       |
-			   HWMON_T_MIN_ALARM,
+			   HWMON_T_MIN_ALARM |
+			   HWMON_T_MAX_ALARM,
 
 			   HWMON_T_LABEL     |
 			   HWMON_T_INPUT     |
--- linux-qcom-6.8.0.orig/drivers/power/supply/qcom_battmgr.c
+++ linux-qcom-6.8.0/drivers/power/supply/qcom_battmgr.c
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
  * Copyright (c) 2022, Linaro Ltd
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/auxiliary_bus.h>
 #include <linux/module.h>
@@ -11,6 +12,7 @@
 #include <linux/soc/qcom/pdr.h>
 #include <linux/soc/qcom/pmic_glink.h>
 #include <linux/math.h>
+#include <linux/thermal.h>
 #include <linux/units.h>
 
 #define BATTMGR_CHEMISTRY_LEN	4
@@ -256,6 +258,7 @@
 
 	unsigned int discharge_time;
 	unsigned int charge_time;
+	unsigned int max_charge_ctl_limit;
 };
 
 struct qcom_battmgr_ac {
@@ -294,9 +297,20 @@
 	enum qcom_battmgr_unit unit;
 
 	int error;
+
+	int curr_thermal_level;
+	int num_thermal_levels;
+
+	u32 *thermal_levels;
+	u32 thermal_fcc_ua;
+	u32 last_fcc_ua;
+
+	u32 usb_icl_ua;
+
 	struct completion ack;
 
 	bool service_up;
+	bool thermal_dev_registered;
 
 	struct qcom_battmgr_info info;
 	struct qcom_battmgr_status status;
@@ -418,6 +432,8 @@
 	[POWER_SUPPLY_PROP_TIME_TO_FULL_AVG] = BATT_TTF_AVG,
 	[POWER_SUPPLY_PROP_TIME_TO_EMPTY_AVG] = BATT_TTE_AVG,
 	[POWER_SUPPLY_PROP_POWER_NOW] = BATT_POWER_NOW,
+	[POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT] = BATT_CHG_CTRL_LIM,
+	[POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX] = BATT_CHG_CTRL_LIM_MAX,
 };
 
 static int qcom_battmgr_bat_sm8350_update(struct qcom_battmgr *battmgr,
@@ -486,7 +502,7 @@
 	int ret;
 
 	if (!battmgr->service_up)
-		return -ENODEV;
+		return -EAGAIN;
 
 	if (battmgr->variant == QCOM_BATTMGR_SC8280XP)
 		ret = qcom_battmgr_bat_sc8280xp_update(battmgr, psp);
@@ -578,6 +594,12 @@
 	case POWER_SUPPLY_PROP_CAPACITY:
 		val->intval = battmgr->status.percent;
 		break;
+	case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT:
+		val->intval = battmgr->curr_thermal_level;
+		break;
+	case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX:
+		val->intval = battmgr->num_thermal_levels;
+		break;
 	case POWER_SUPPLY_PROP_TEMP:
 		val->intval = battmgr->status.temperature;
 		break;
@@ -612,6 +634,82 @@
 	return 0;
 }
 
+static int __battery_psy_set_charge_current(struct qcom_battmgr *battmgr,
+					    u32 fcc_ua)
+{
+	int rc;
+
+	rc = qcom_battmgr_request_property(battmgr, BATTMGR_BAT_PROPERTY_SET,
+					   BATT_CHG_CTRL_LIM, fcc_ua);
+	if (rc < 0) {
+		dev_err(battmgr->dev, "Failed to set FCC %u, rc=%d\n", fcc_ua, rc);
+	} else {
+		dev_dbg(battmgr->dev, "Set FCC to %u uA\n", fcc_ua);
+		battmgr->last_fcc_ua = fcc_ua;
+	}
+
+	return rc;
+}
+
+static int battery_psy_set_charge_current(struct qcom_battmgr *battmgr,
+					  int val)
+{
+	u32 fcc_ua, prev_fcc_ua;
+	int rc;
+
+	if (!battmgr->num_thermal_levels)
+		return 0;
+
+	if (battmgr->num_thermal_levels < 0) {
+		dev_err(battmgr->dev, "Incorrect num_thermal_levels\n");
+		return -EINVAL;
+	}
+
+	if (val < 0 || val > battmgr->num_thermal_levels)
+		return -EINVAL;
+
+	fcc_ua = battmgr->thermal_levels[val];
+	prev_fcc_ua = battmgr->thermal_fcc_ua;
+	battmgr->thermal_fcc_ua = fcc_ua;
+
+	rc = __battery_psy_set_charge_current(battmgr, fcc_ua);
+	if (!rc)
+		battmgr->curr_thermal_level = val;
+	else
+		battmgr->thermal_fcc_ua = prev_fcc_ua;
+
+	return rc;
+}
+
+static int qcom_battmgr_bat_set_property(struct power_supply *psy,
+					 enum power_supply_property prop,
+					 const union power_supply_propval *pval)
+{
+	struct qcom_battmgr *battmgr = power_supply_get_drvdata(psy);
+
+	switch (prop) {
+	case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT:
+		return battery_psy_set_charge_current(battmgr, pval->intval);
+	default:
+		break;
+	}
+
+	return -EINVAL;
+}
+
+static int qcom_battmgr_prop_is_writeable(struct power_supply *psy,
+					  enum power_supply_property prop)
+{
+	switch (prop) {
+	case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT:
+		return 1;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
 static const enum power_supply_property sc8280xp_bat_props[] = {
 	POWER_SUPPLY_PROP_STATUS,
 	POWER_SUPPLY_PROP_PRESENT,
@@ -655,6 +753,8 @@
 	POWER_SUPPLY_PROP_VOLTAGE_NOW,
 	POWER_SUPPLY_PROP_VOLTAGE_MAX,
 	POWER_SUPPLY_PROP_CURRENT_NOW,
+	POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT,
+	POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX,
 	POWER_SUPPLY_PROP_TEMP,
 	POWER_SUPPLY_PROP_TECHNOLOGY,
 	POWER_SUPPLY_PROP_CHARGE_COUNTER,
@@ -673,6 +773,8 @@
 	.properties = sm8350_bat_props,
 	.num_properties = ARRAY_SIZE(sm8350_bat_props),
 	.get_property = qcom_battmgr_bat_get_property,
+	.set_property = qcom_battmgr_bat_set_property,
+	.property_is_writeable = qcom_battmgr_prop_is_writeable,
 };
 
 static int qcom_battmgr_ac_get_property(struct power_supply *psy,
@@ -683,7 +785,7 @@
 	int ret;
 
 	if (!battmgr->service_up)
-		return -ENODEV;
+		return -EAGAIN;
 
 	ret = qcom_battmgr_bat_sc8280xp_update(battmgr, psp);
 	if (ret)
@@ -740,6 +842,51 @@
 	return ret;
 }
 
+static int usb_psy_set_icl(struct qcom_battmgr *battmgr, u32 prop_id, int val)
+{
+	u32 temp;
+	int ret;
+
+	ret = qcom_battmgr_request_property(battmgr, BATTMGR_USB_PROPERTY_GET,
+					    USB_ADAP_TYPE, 0);
+	if (ret < 0) {
+		dev_err(battmgr->dev, "Failed to read prop USB_ADAP_TYPE, ret=%d\n", ret);
+		return ret;
+	}
+
+	/* Allow this only for SDP, CDP or USB_PD and not for other charger types */
+	switch (battmgr->usb.usb_type) {
+	case POWER_SUPPLY_USB_TYPE_SDP:
+	case POWER_SUPPLY_USB_TYPE_PD:
+	case POWER_SUPPLY_USB_TYPE_CDP:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/*
+	 * Input current limit (ICL) can be set by different clients. E.g. USB
+	 * driver can request for a current of 500/900 mA depending on the
+	 * port type. Also, clients like EUD driver can pass 0 or -22 to
+	 * suspend or unsuspend the input for its use case.
+	 */
+
+	temp = val;
+	if (val < 0)
+		temp = UINT_MAX;
+
+	ret = qcom_battmgr_request_property(battmgr, BATTMGR_USB_PROPERTY_SET, USB_INPUT_CURR_LIMIT,
+					   temp);
+	if (ret < 0) {
+		dev_err(battmgr->dev, "Failed to set ICL %u, ret=%d\n", val, ret);
+	} else {
+		dev_dbg(battmgr->dev, "Set ICL to %u uA\n", val);
+		battmgr->usb_icl_ua = val;
+	}
+
+	return ret;
+}
+
 static int qcom_battmgr_usb_get_property(struct power_supply *psy,
 					 enum power_supply_property psp,
 					 union power_supply_propval *val)
@@ -748,7 +895,7 @@
 	int ret;
 
 	if (!battmgr->service_up)
-		return -ENODEV;
+		return -EAGAIN;
 
 	if (battmgr->variant == QCOM_BATTMGR_SC8280XP)
 		ret = qcom_battmgr_bat_sc8280xp_update(battmgr, psp);
@@ -786,6 +933,37 @@
 	return 0;
 }
 
+static int qcom_battmgr_usb_set_property(struct power_supply *psy,
+					 enum power_supply_property prop,
+					 const union power_supply_propval *pval)
+{
+	struct qcom_battmgr *battmgr = power_supply_get_drvdata(psy);
+	int rc = -EINVAL;
+
+	switch (prop) {
+	case POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT:
+		rc = usb_psy_set_icl(battmgr, USB_INPUT_CURR_LIMIT, pval->intval);
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static int qcom_battmgr_usb_prop_is_writeable(struct power_supply *psy,
+					      enum power_supply_property prop)
+{
+	switch (prop) {
+	case POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT:
+		return 1;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
 static const enum power_supply_usb_type usb_psy_supported_types[] = {
 	POWER_SUPPLY_USB_TYPE_UNKNOWN,
 	POWER_SUPPLY_USB_TYPE_SDP,
@@ -829,6 +1007,8 @@
 	.properties = sm8350_usb_props,
 	.num_properties = ARRAY_SIZE(sm8350_usb_props),
 	.get_property = qcom_battmgr_usb_get_property,
+	.set_property = qcom_battmgr_usb_set_property,
+	.property_is_writeable  = qcom_battmgr_usb_prop_is_writeable,
 	.usb_types = usb_psy_supported_types,
 	.num_usb_types = ARRAY_SIZE(usb_psy_supported_types),
 };
@@ -867,7 +1047,7 @@
 	int ret;
 
 	if (!battmgr->service_up)
-		return -ENODEV;
+		return -EAGAIN;
 
 	if (battmgr->variant == QCOM_BATTMGR_SC8280XP)
 		ret = qcom_battmgr_bat_sc8280xp_update(battmgr, psp);
@@ -1140,6 +1320,11 @@
 		case BATT_CURR_NOW:
 			battmgr->status.current_now = le32_to_cpu(resp->intval.value);
 			break;
+		case BATT_CHG_CTRL_LIM:
+			break;
+		case BATT_CHG_CTRL_LIM_MAX:
+			battmgr->status.max_charge_ctl_limit = le32_to_cpu(resp->intval.value);
+			break;
 		case BATT_TEMP:
 			val = le32_to_cpu(resp->intval.value);
 			battmgr->status.temperature = DIV_ROUND_CLOSEST(val, 10);
@@ -1176,6 +1361,26 @@
 			break;
 		}
 		break;
+
+	case BATTMGR_BAT_PROPERTY_SET:
+	case BATTMGR_USB_PROPERTY_SET:
+		property = le32_to_cpu(resp->intval.property);
+		if (payload_len != sizeof(resp->intval)) {
+			dev_warn(battmgr->dev,
+				 "invalid payload length for %#x request: %zd\n",
+				 property, payload_len);
+			battmgr->error = -ENODATA;
+			return;
+		}
+
+		battmgr->error = le32_to_cpu(resp->intval.result);
+		if (battmgr->error) {
+			dev_err(battmgr->dev, "Error in response for opcode :%#x prop_id :%u, rc :%d\n",
+				opcode, property, battmgr->error);
+			goto out_complete;
+		}
+		break;
+
 	case BATTMGR_USB_PROPERTY_GET:
 		property = le32_to_cpu(resp->intval.property);
 		if (payload_len != sizeof(resp->intval)) {
@@ -1278,6 +1483,130 @@
 		qcom_battmgr_sm8350_callback(battmgr, data, len);
 }
 
+static int
+qcom_battmgr_chg_get_max_charge_cntl_limit(struct thermal_cooling_device *tcd,
+					   unsigned long *state)
+{
+	struct qcom_battmgr *battmgr = tcd->devdata;
+
+	*state = battmgr->num_thermal_levels;
+
+	return 0;
+}
+
+static int
+qcom_battmgr_chg_get_cur_charge_cntl_limit(struct thermal_cooling_device *tcd,
+					   unsigned long *state)
+{
+	struct qcom_battmgr *battmgr = tcd->devdata;
+
+	*state = battmgr->curr_thermal_level;
+
+	return 0;
+}
+
+static int
+qcom_battmgr_set_cur_charge_cntl_limit(struct thermal_cooling_device *tcd,
+				       unsigned long state)
+{
+	struct qcom_battmgr *battmgr = tcd->devdata;
+
+	return battery_psy_set_charge_current(battmgr, (int)state);
+}
+
+static const struct thermal_cooling_device_ops battery_tcd_ops = {
+	.get_max_state = qcom_battmgr_chg_get_max_charge_cntl_limit,
+	.get_cur_state = qcom_battmgr_chg_get_cur_charge_cntl_limit,
+	.set_cur_state = qcom_battmgr_set_cur_charge_cntl_limit,
+};
+
+static int qcom_battmgr_register_thermal_cooling_device(struct qcom_battmgr *battmgr)
+{
+	struct thermal_cooling_device *tcd;
+	u32 prev, val;
+	int rc, i;
+
+	/* Skip registering thermal cooling device if thermal levels are not defined */
+	if (!battmgr->num_thermal_levels)
+		return 0;
+
+	if (battmgr->thermal_dev_registered)
+		return 0;
+
+	mutex_lock(&battmgr->lock);
+	rc = qcom_battmgr_request_property(battmgr, BATTMGR_BAT_PROPERTY_GET,
+					   BATT_CHG_CTRL_LIM_MAX, 0);
+	mutex_unlock(&battmgr->lock);
+
+	if (rc < 0) {
+		dev_err(battmgr->dev, "Unable to read CHG_CTRL_LIMIT_MAX rc :%d\n", rc);
+		return rc;
+	}
+
+	prev = battmgr->status.max_charge_ctl_limit;
+
+	for (i = 1; i < battmgr->num_thermal_levels; i++) {
+		if (battmgr->thermal_levels[i] > prev) {
+			dev_err(battmgr->dev, "Thermal values not defined as expected\n");
+			return -EINVAL;
+		}
+		prev = val;
+	}
+
+	battmgr->thermal_levels[0] = battmgr->status.max_charge_ctl_limit;
+	battmgr->thermal_fcc_ua = battmgr->status.max_charge_ctl_limit;
+
+	/* Register Thermal Cooling Device */
+	tcd = devm_thermal_of_cooling_device_register(battmgr->dev,
+						      battmgr->dev->of_node,
+						      (char *)battmgr->bat_psy->desc->name,
+						      battmgr, &battery_tcd_ops);
+	if (IS_ERR_OR_NULL(tcd)) {
+		rc = PTR_ERR_OR_ZERO(tcd);
+		dev_err(battmgr->dev, "Failed to register thermal cooling device rc=%d\n", rc);
+	}
+
+	battmgr->thermal_dev_registered = true;
+
+	return rc;
+}
+
+static int qcom_battmgr_parse_dt(struct qcom_battmgr *battmgr)
+{
+	struct device_node *node = battmgr->dev->of_node;
+	int len, rc;
+
+	rc = of_property_count_elems_of_size(node, "qcom,thermal-mitigation", sizeof(u32));
+	if (rc <= 0)
+		return 0;
+
+	len = rc;
+
+	battmgr->thermal_levels = devm_kcalloc(battmgr->dev, len + 1,
+					       sizeof(*battmgr->thermal_levels),
+					       GFP_KERNEL);
+	if (!battmgr->thermal_levels)
+		return -ENOMEM;
+
+	/*
+	 * Element 0 is for normal charging current. Elements from index 1
+	 * onwards is for thermal mitigation charging currents.
+	 */
+
+	rc = of_property_read_u32_array(node, "qcom,thermal-mitigation",
+					&battmgr->thermal_levels[1], len);
+	if (rc < 0) {
+		dev_err(battmgr->dev, "Error in reading qcom,thermal-mitigation, rc=%d\n",
+			rc);
+
+		return rc;
+	}
+
+	battmgr->num_thermal_levels = len;
+
+	return rc;
+}
+
 static void qcom_battmgr_enable_worker(struct work_struct *work)
 {
 	struct qcom_battmgr *battmgr = container_of(work, struct qcom_battmgr, enable_work);
@@ -1291,6 +1620,25 @@
 	ret = qcom_battmgr_request(battmgr, &req, sizeof(req));
 	if (ret)
 		dev_err(battmgr->dev, "failed to request power notifications\n");
+
+	if (!battmgr->thermal_dev_registered) {
+		ret = qcom_battmgr_register_thermal_cooling_device(battmgr);
+		if (ret < 0)
+			dev_err(battmgr->dev, "failed to register thermal cooling device ret:%d\n",
+				ret);
+	} else if (battmgr->last_fcc_ua) {
+		ret = __battery_psy_set_charge_current(battmgr, battmgr->last_fcc_ua);
+		if (ret < 0)
+			dev_err(battmgr->dev, "Failed to set FCC (%u uA), ret:%d\n",
+				battmgr->last_fcc_ua, ret);
+	}
+
+	if (battmgr->usb_icl_ua) {
+		ret = usb_psy_set_icl(battmgr, USB_INPUT_CURR_LIMIT, battmgr->usb_icl_ua);
+		if (ret < 0)
+			dev_err(battmgr->dev, "failed to set ICL (%u uA), ret:%d\n",
+				battmgr->usb_icl_ua, ret);
+	}
 }
 
 static void qcom_battmgr_pdr_notify(void *priv, int state)
@@ -1322,6 +1670,7 @@
 	const struct of_device_id *match;
 	struct qcom_battmgr *battmgr;
 	struct device *dev = &adev->dev;
+	int ret;
 
 	battmgr = devm_kzalloc(dev, sizeof(*battmgr), GFP_KERNEL);
 	if (!battmgr)
@@ -1368,6 +1717,12 @@
 			return dev_err_probe(dev, PTR_ERR(battmgr->wls_psy),
 					     "failed to register wireless charing power supply\n");
 	} else {
+		ret = qcom_battmgr_parse_dt(battmgr);
+		if (ret < 0) {
+			dev_err(dev, "Failed to parse thermal mitigation levels rc:%d\n", ret);
+			return ret;
+		}
+
 		battmgr->bat_psy = devm_power_supply_register(dev, &sm8350_bat_psy_desc, &psy_cfg);
 		if (IS_ERR(battmgr->bat_psy))
 			return dev_err_probe(dev, PTR_ERR(battmgr->bat_psy),
@@ -1384,12 +1739,16 @@
 					     "failed to register wireless charing power supply\n");
 	}
 
-	battmgr->client = devm_pmic_glink_register_client(dev,
-							  PMIC_GLINK_OWNER_BATTMGR,
-							  qcom_battmgr_callback,
-							  qcom_battmgr_pdr_notify,
-							  battmgr);
-	return PTR_ERR_OR_ZERO(battmgr->client);
+	battmgr->client = devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_BATTMGR,
+						       qcom_battmgr_callback,
+						       qcom_battmgr_pdr_notify,
+						       battmgr);
+	if (IS_ERR(battmgr->client))
+		return PTR_ERR(battmgr->client);
+
+	pmic_glink_client_register(battmgr->client);
+
+	return 0;
 }
 
 static const struct auxiliary_device_id qcom_battmgr_id_table[] = {
--- linux-qcom-6.8.0.orig/drivers/power/supply/rt9455_charger.c
+++ linux-qcom-6.8.0/drivers/power/supply/rt9455_charger.c
@@ -192,6 +192,7 @@
 	4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000
 };
 
+#if IS_ENABLED(CONFIG_USB_PHY)
 /*
  * When the charger is in boost mode, REG02[7:2] represent boost output
  * voltage.
@@ -207,6 +208,7 @@
 	5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000,
 	5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000,
 };
+#endif
 
 /* REG07[3:0] (VMREG) in uV */
 static const int rt9455_vmreg_values[] = {
--- linux-qcom-6.8.0.orig/drivers/power/supply/rt9471.c
+++ linux-qcom-6.8.0/drivers/power/supply/rt9471.c
@@ -139,6 +139,19 @@
 	RT9471_PORTSTAT_DCP,
 };
 
+enum {
+	RT9471_ICSTAT_SLEEP = 0,
+	RT9471_ICSTAT_VBUSRDY,
+	RT9471_ICSTAT_TRICKLECHG,
+	RT9471_ICSTAT_PRECHG,
+	RT9471_ICSTAT_FASTCHG,
+	RT9471_ICSTAT_IEOC,
+	RT9471_ICSTAT_BGCHG,
+	RT9471_ICSTAT_CHGDONE,
+	RT9471_ICSTAT_CHGFAULT,
+	RT9471_ICSTAT_OTG = 15,
+};
+
 struct rt9471_chip {
 	struct device *dev;
 	struct regmap *regmap;
@@ -153,8 +166,8 @@
 };
 
 static const struct reg_field rt9471_reg_fields[F_MAX_FIELDS] = {
-	[F_WDT]		= REG_FIELD(RT9471_REG_TOP, 0, 0),
-	[F_WDT_RST]	= REG_FIELD(RT9471_REG_TOP, 1, 1),
+	[F_WDT]		= REG_FIELD(RT9471_REG_TOP, 0, 1),
+	[F_WDT_RST]	= REG_FIELD(RT9471_REG_TOP, 2, 2),
 	[F_CHG_EN]	= REG_FIELD(RT9471_REG_FUNC, 0, 0),
 	[F_HZ]		= REG_FIELD(RT9471_REG_FUNC, 5, 5),
 	[F_BATFET_DIS]	= REG_FIELD(RT9471_REG_FUNC, 7, 7),
@@ -255,31 +268,32 @@
 
 static int rt9471_get_status(struct rt9471_chip *chip, int *status)
 {
-	unsigned int chg_ready, chg_done, fault_stat;
+	unsigned int ic_stat;
 	int ret;
 
-	ret = regmap_field_read(chip->rm_fields[F_ST_CHG_RDY], &chg_ready);
-	if (ret)
-		return ret;
-
-	ret = regmap_field_read(chip->rm_fields[F_ST_CHG_DONE], &chg_done);
-	if (ret)
-		return ret;
-
-	ret = regmap_read(chip->regmap, RT9471_REG_STAT1, &fault_stat);
+	ret = regmap_field_read(chip->rm_fields[F_IC_STAT], &ic_stat);
 	if (ret)
 		return ret;
 
-	fault_stat &= RT9471_CHGFAULT_MASK;
-
-	if (chg_ready && chg_done)
-		*status = POWER_SUPPLY_STATUS_FULL;
-	else if (chg_ready && fault_stat)
+	switch (ic_stat) {
+	case RT9471_ICSTAT_VBUSRDY:
+	case RT9471_ICSTAT_CHGFAULT:
 		*status = POWER_SUPPLY_STATUS_NOT_CHARGING;
-	else if (chg_ready && !fault_stat)
+		break;
+	case RT9471_ICSTAT_TRICKLECHG ... RT9471_ICSTAT_BGCHG:
 		*status = POWER_SUPPLY_STATUS_CHARGING;
-	else
+		break;
+	case RT9471_ICSTAT_CHGDONE:
+		*status = POWER_SUPPLY_STATUS_FULL;
+		break;
+	case RT9471_ICSTAT_SLEEP:
+	case RT9471_ICSTAT_OTG:
 		*status = POWER_SUPPLY_STATUS_DISCHARGING;
+		break;
+	default:
+		*status = POWER_SUPPLY_STATUS_UNKNOWN;
+		break;
+	}
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/powercap/dtpm_cpu.c
+++ linux-qcom-6.8.0/drivers/powercap/dtpm_cpu.c
@@ -219,7 +219,7 @@
 	ret = freq_qos_add_request(&policy->constraints,
 				   &dtpm_cpu->qos_req, FREQ_QOS_MAX,
 				   pd->table[pd->nr_perf_states - 1].frequency);
-	if (ret)
+	if (ret < 0)
 		goto out_dtpm_unregister;
 
 	cpufreq_cpu_put(policy);
--- linux-qcom-6.8.0.orig/drivers/powercap/dtpm_devfreq.c
+++ linux-qcom-6.8.0/drivers/powercap/dtpm_devfreq.c
@@ -166,7 +166,7 @@
 	ret = dev_pm_qos_add_request(dev, &dtpm_devfreq->qos_req,
 				     DEV_PM_QOS_MAX_FREQUENCY,
 				     PM_QOS_MAX_FREQUENCY_DEFAULT_VALUE);
-	if (ret) {
+	if (ret < 0) {
 		pr_err("Failed to add QoS request: %d\n", ret);
 		goto out_dtpm_unregister;
 	}
--- linux-qcom-6.8.0.orig/drivers/powercap/intel_rapl_common.c
+++ linux-qcom-6.8.0/drivers/powercap/intel_rapl_common.c
@@ -5,6 +5,7 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/cleanup.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/list.h>
@@ -737,7 +738,7 @@
 {
 	struct rapl_primitive_info *rpi = rp->priv->rpi;
 
-	if (prim < 0 || prim > NR_RAPL_PRIMITIVES || !rpi)
+	if (prim < 0 || prim >= NR_RAPL_PRIMITIVES || !rpi)
 		return NULL;
 
 	return &rpi[prim];
@@ -759,6 +760,11 @@
 	default:
 		return -EINVAL;
 	}
+
+	/* defaults_msr can be NULL on unsupported platforms */
+	if (!rp->priv->defaults || !rp->priv->rpi)
+		return -ENODEV;
+
 	return 0;
 }
 
@@ -1256,6 +1262,9 @@
 	X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L,	&rapl_defaults_core),
 	X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X,	&rapl_defaults_spr_server),
 	X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X,	&rapl_defaults_spr_server),
+	X86_MATCH_INTEL_FAM6_MODEL(LUNARLAKE_M,		&rapl_defaults_core),
+	X86_MATCH_INTEL_FAM6_MODEL(ARROWLAKE_H,		&rapl_defaults_core),
+	X86_MATCH_INTEL_FAM6_MODEL(ARROWLAKE,		&rapl_defaults_core),
 	X86_MATCH_INTEL_FAM6_MODEL(LAKEFIELD,		&rapl_defaults_core),
 
 	X86_MATCH_INTEL_FAM6_MODEL(ATOM_SILVERMONT,	&rapl_defaults_byt),
@@ -1274,6 +1283,7 @@
 
 	X86_MATCH_VENDOR_FAM(AMD, 0x17, &rapl_defaults_amd),
 	X86_MATCH_VENDOR_FAM(AMD, 0x19, &rapl_defaults_amd),
+	X86_MATCH_VENDOR_FAM(AMD, 0x1A, &rapl_defaults_amd),
 	X86_MATCH_VENDOR_FAM(HYGON, 0x18, &rapl_defaults_amd),
 	{}
 };
@@ -1499,7 +1509,7 @@
 }
 
 /* called from CPU hotplug notifier, hotplug lock held */
-void rapl_remove_package(struct rapl_package *rp)
+void rapl_remove_package_cpuslocked(struct rapl_package *rp)
 {
 	struct rapl_domain *rd, *rd_package = NULL;
 
@@ -1528,16 +1538,45 @@
 	list_del(&rp->plist);
 	kfree(rp);
 }
+EXPORT_SYMBOL_GPL(rapl_remove_package_cpuslocked);
+
+void rapl_remove_package(struct rapl_package *rp)
+{
+	guard(cpus_read_lock)();
+	rapl_remove_package_cpuslocked(rp);
+}
 EXPORT_SYMBOL_GPL(rapl_remove_package);
 
+/*
+ * RAPL Package energy counter scope:
+ * 1. AMD/HYGON platforms use per-PKG package energy counter
+ * 2. For Intel platforms
+ *	2.1 CLX-AP platform has per-DIE package energy counter
+ *	2.2 Other platforms that uses MSR RAPL are single die systems so the
+ *          package energy counter can be considered as per-PKG/per-DIE,
+ *          here it is considered as per-DIE.
+ *	2.3 New platforms that use TPMI RAPL doesn't care about the
+ *	    scope because they are not MSR/CPU based.
+ */
+#define rapl_msrs_are_pkg_scope()				\
+	(boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||	\
+	 boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)
+
 /* caller to ensure CPU hotplug lock is held */
-struct rapl_package *rapl_find_package_domain(int id, struct rapl_if_priv *priv, bool id_is_cpu)
+struct rapl_package *rapl_find_package_domain_cpuslocked(int id, struct rapl_if_priv *priv,
+							 bool id_is_cpu)
 {
 	struct rapl_package *rp;
 	int uid;
 
-	if (id_is_cpu)
-		uid = topology_logical_die_id(id);
+	if (id_is_cpu) {
+		uid = rapl_msrs_are_pkg_scope() ?
+		      topology_physical_package_id(id) : topology_logical_die_id(id);
+		if (uid < 0) {
+			pr_err("topology_logical_(package/die)_id() returned a negative value");
+			return NULL;
+		}
+	}
 	else
 		uid = id;
 
@@ -1549,10 +1588,17 @@
 
 	return NULL;
 }
+EXPORT_SYMBOL_GPL(rapl_find_package_domain_cpuslocked);
+
+struct rapl_package *rapl_find_package_domain(int id, struct rapl_if_priv *priv, bool id_is_cpu)
+{
+	guard(cpus_read_lock)();
+	return rapl_find_package_domain_cpuslocked(id, priv, id_is_cpu);
+}
 EXPORT_SYMBOL_GPL(rapl_find_package_domain);
 
 /* called from CPU hotplug notifier, hotplug lock held */
-struct rapl_package *rapl_add_package(int id, struct rapl_if_priv *priv, bool id_is_cpu)
+struct rapl_package *rapl_add_package_cpuslocked(int id, struct rapl_if_priv *priv, bool id_is_cpu)
 {
 	struct rapl_package *rp;
 	int ret;
@@ -1562,9 +1608,14 @@
 		return ERR_PTR(-ENOMEM);
 
 	if (id_is_cpu) {
-		rp->id = topology_logical_die_id(id);
+		rp->id = rapl_msrs_are_pkg_scope() ?
+			 topology_physical_package_id(id) : topology_logical_die_id(id);
+		if ((int)(rp->id) < 0) {
+			pr_err("topology_logical_(package/die)_id() returned a negative value");
+			return ERR_PTR(-EINVAL);
+		}
 		rp->lead_cpu = id;
-		if (topology_max_die_per_package() > 1)
+		if (!rapl_msrs_are_pkg_scope() && topology_max_die_per_package() > 1)
 			snprintf(rp->name, PACKAGE_DOMAIN_NAME_LENGTH, "package-%d-die-%d",
 				 topology_physical_package_id(id), topology_die_id(id));
 		else
@@ -1598,6 +1649,13 @@
 	kfree(rp);
 	return ERR_PTR(ret);
 }
+EXPORT_SYMBOL_GPL(rapl_add_package_cpuslocked);
+
+struct rapl_package *rapl_add_package(int id, struct rapl_if_priv *priv, bool id_is_cpu)
+{
+	guard(cpus_read_lock)();
+	return rapl_add_package_cpuslocked(id, priv, id_is_cpu);
+}
 EXPORT_SYMBOL_GPL(rapl_add_package);
 
 static void power_limit_state_save(void)
--- linux-qcom-6.8.0.orig/drivers/powercap/intel_rapl_msr.c
+++ linux-qcom-6.8.0/drivers/powercap/intel_rapl_msr.c
@@ -73,9 +73,9 @@
 {
 	struct rapl_package *rp;
 
-	rp = rapl_find_package_domain(cpu, rapl_msr_priv, true);
+	rp = rapl_find_package_domain_cpuslocked(cpu, rapl_msr_priv, true);
 	if (!rp) {
-		rp = rapl_add_package(cpu, rapl_msr_priv, true);
+		rp = rapl_add_package_cpuslocked(cpu, rapl_msr_priv, true);
 		if (IS_ERR(rp))
 			return PTR_ERR(rp);
 	}
@@ -88,14 +88,14 @@
 	struct rapl_package *rp;
 	int lead_cpu;
 
-	rp = rapl_find_package_domain(cpu, rapl_msr_priv, true);
+	rp = rapl_find_package_domain_cpuslocked(cpu, rapl_msr_priv, true);
 	if (!rp)
 		return 0;
 
 	cpumask_clear_cpu(cpu, &rp->cpumask);
 	lead_cpu = cpumask_first(&rp->cpumask);
 	if (lead_cpu >= nr_cpu_ids)
-		rapl_remove_package(rp);
+		rapl_remove_package_cpuslocked(rp);
 	else if (rp->lead_cpu == cpu)
 		rp->lead_cpu = lead_cpu;
 	return 0;
@@ -147,6 +147,7 @@
 	X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, NULL),
 	X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE, NULL),
 	X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L, NULL),
+	X86_MATCH_INTEL_FAM6_MODEL(ARROWLAKE_U, NULL),
 	{}
 };
 
--- linux-qcom-6.8.0.orig/drivers/powercap/intel_rapl_tpmi.c
+++ linux-qcom-6.8.0/drivers/powercap/intel_rapl_tpmi.c
@@ -15,7 +15,8 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 
-#define TPMI_RAPL_VERSION 1
+#define TPMI_RAPL_MAJOR_VERSION 0
+#define TPMI_RAPL_MINOR_VERSION 1
 
 /* 1 header + 10 registers + 5 reserved. 8 bytes for each. */
 #define TPMI_RAPL_DOMAIN_SIZE 128
@@ -40,6 +41,7 @@
 	TPMI_RAPL_REG_ENERGY_STATUS,
 	TPMI_RAPL_REG_PERF_STATUS,
 	TPMI_RAPL_REG_POWER_INFO,
+	TPMI_RAPL_REG_DOMAIN_INFO,
 	TPMI_RAPL_REG_INTERRUPT,
 	TPMI_RAPL_REG_MAX = 15,
 };
@@ -130,6 +132,12 @@
 	mutex_unlock(&tpmi_rapl_lock);
 }
 
+/*
+ * Bit 0 of TPMI_RAPL_REG_DOMAIN_INFO indicates if the current package is a domain
+ * root or not. Only domain root packages can enumerate System (Psys) Domain.
+ */
+#define TPMI_RAPL_DOMAIN_ROOT	BIT(0)
+
 static int parse_one_domain(struct tpmi_rapl_package *trp, u32 offset)
 {
 	u8 tpmi_domain_version;
@@ -139,6 +147,7 @@
 	enum rapl_domain_reg_id reg_id;
 	int tpmi_domain_size, tpmi_domain_flags;
 	u64 tpmi_domain_header = readq(trp->base + offset);
+	u64 tpmi_domain_info;
 
 	/* Domain Parent bits are ignored for now */
 	tpmi_domain_version = tpmi_domain_header & 0xff;
@@ -146,11 +155,21 @@
 	tpmi_domain_size = tpmi_domain_header >> 16 & 0xff;
 	tpmi_domain_flags = tpmi_domain_header >> 32 & 0xffff;
 
-	if (tpmi_domain_version != TPMI_RAPL_VERSION) {
-		pr_warn(FW_BUG "Unsupported version:%d\n", tpmi_domain_version);
+	if (tpmi_domain_version == TPMI_VERSION_INVALID) {
+		pr_warn(FW_BUG "Invalid version\n");
+		return -ENODEV;
+	}
+
+	if (TPMI_MAJOR_VERSION(tpmi_domain_version) != TPMI_RAPL_MAJOR_VERSION) {
+		pr_warn(FW_BUG "Unsupported major version:%ld\n",
+			TPMI_MAJOR_VERSION(tpmi_domain_version));
 		return -ENODEV;
 	}
 
+	if (TPMI_MINOR_VERSION(tpmi_domain_version) > TPMI_RAPL_MINOR_VERSION)
+		pr_info("Ignore: Unsupported minor version:%ld\n",
+			TPMI_MINOR_VERSION(tpmi_domain_version));
+
 	/* Domain size: in unit of 128 Bytes */
 	if (tpmi_domain_size != 1) {
 		pr_warn(FW_BUG "Invalid Domain size %d\n", tpmi_domain_size);
@@ -169,6 +188,13 @@
 		domain_type = RAPL_DOMAIN_PACKAGE;
 		break;
 	case TPMI_RAPL_DOMAIN_SYSTEM:
+		if (!(tpmi_domain_flags & BIT(TPMI_RAPL_REG_DOMAIN_INFO))) {
+			pr_warn(FW_BUG "System domain must support Domain Info register\n");
+			return -ENODEV;
+		}
+		tpmi_domain_info = readq(trp->base + offset + TPMI_RAPL_REG_DOMAIN_INFO * 8);
+		if (!(tpmi_domain_info & TPMI_RAPL_DOMAIN_ROOT))
+			return 0;
 		domain_type = RAPL_DOMAIN_PLATFORM;
 		break;
 	case TPMI_RAPL_DOMAIN_MEMORY:
--- linux-qcom-6.8.0.orig/drivers/pps/clients/pps_parport.c
+++ linux-qcom-6.8.0/drivers/pps/clients/pps_parport.c
@@ -148,7 +148,10 @@
 		return;
 	}
 
-	index = ida_simple_get(&pps_client_index, 0, 0, GFP_KERNEL);
+	index = ida_alloc(&pps_client_index, GFP_KERNEL);
+	if (index < 0)
+		goto err_free_device;
+
 	memset(&pps_client_cb, 0, sizeof(pps_client_cb));
 	pps_client_cb.private = device;
 	pps_client_cb.irq_func = parport_irq;
@@ -159,7 +162,7 @@
 						    index);
 	if (!device->pardev) {
 		pr_err("couldn't register with %s\n", port->name);
-		goto err_free;
+		goto err_free_ida;
 	}
 
 	if (parport_claim_or_block(device->pardev) < 0) {
@@ -187,8 +190,9 @@
 	parport_release(device->pardev);
 err_unregister_dev:
 	parport_unregister_device(device->pardev);
-err_free:
-	ida_simple_remove(&pps_client_index, index);
+err_free_ida:
+	ida_free(&pps_client_index, index);
+err_free_device:
 	kfree(device);
 }
 
@@ -208,7 +212,7 @@
 	pps_unregister_source(device->pps);
 	parport_release(pardev);
 	parport_unregister_device(pardev);
-	ida_simple_remove(&pps_client_index, device->index);
+	ida_free(&pps_client_index, device->index);
 	kfree(device);
 }
 
--- linux-qcom-6.8.0.orig/drivers/ptp/Kconfig
+++ linux-qcom-6.8.0/drivers/ptp/Kconfig
@@ -212,4 +212,17 @@
 	  To compile this driver as a module, choose M here: the module
 	  will be called ptp_dfl_tod.
 
+config PTP_QCOM_CLOCK_TSC
+	tristate "QCOM  TSC as PTP clock"
+	depends on COMMON_CLK
+	help
+	  This driver adds support for using the TSC as a PTP clock.
+	  The hardware supports time stamping of PTP packets.
+
+	  This PTP driver also registers interrupts for ETU(Event Timestamp Unit)
+	  and updates the TSC timestamps to PTP clock.
+
+	  To compile this driver as a module, choose M here: the module
+	  will be called ptp_qcom_tsc.
+
 endmenu
--- linux-qcom-6.8.0.orig/drivers/ptp/Makefile
+++ linux-qcom-6.8.0/drivers/ptp/Makefile
@@ -20,3 +20,4 @@
 obj-$(CONFIG_PTP_1588_CLOCK_VMW)	+= ptp_vmw.o
 obj-$(CONFIG_PTP_1588_CLOCK_OCP)	+= ptp_ocp.o
 obj-$(CONFIG_PTP_DFL_TOD)		+= ptp_dfl_tod.o
+obj-$(CONFIG_PTP_QCOM_CLOCK_TSC)	+= ptp_qcom_tsc.o
--- linux-qcom-6.8.0.orig/drivers/ptp/ptp_chardev.c
+++ linux-qcom-6.8.0/drivers/ptp/ptp_chardev.c
@@ -85,7 +85,8 @@
 	}
 
 	if (info->verify(info, pin, func, chan)) {
-		pr_err("driver cannot use function %u on pin %u\n", func, chan);
+		pr_err("driver cannot use function %u and channel %u on pin %u\n",
+		       func, chan, pin);
 		return -EOPNOTSUPP;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/ptp/ptp_clock.c
+++ linux-qcom-6.8.0/drivers/ptp/ptp_clock.c
@@ -134,7 +134,8 @@
 		if (ppb > ops->max_adj || ppb < -ops->max_adj)
 			return -ERANGE;
 		err = ops->adjfine(ops, tx->freq);
-		ptp->dialed_frequency = tx->freq;
+		if (!err)
+			ptp->dialed_frequency = tx->freq;
 	} else if (tx->modes & ADJ_OFFSET) {
 		if (ops->adjphase) {
 			s32 max_phase_adj = ops->getmaxphase(ops);
@@ -175,6 +176,9 @@
 	struct timestamp_event_queue *tsevq;
 	unsigned long flags;
 
+	/* Release the clock's resources. */
+	if (ptp->pps_source)
+		pps_unregister_source(ptp->pps_source);
 	ptp_cleanup_pin_groups(ptp);
 	kfree(ptp->vclock_index);
 	mutex_destroy(&ptp->pincfg_mux);
@@ -394,11 +398,6 @@
 		kthread_cancel_delayed_work_sync(&ptp->aux_work);
 		kthread_destroy_worker(ptp->kworker);
 	}
-
-	/* Release the clock's resources. */
-	if (ptp->pps_source)
-		pps_unregister_source(ptp->pps_source);
-
 	posix_clock_unregister(&ptp->clock);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/ptp/ptp_kvm_x86.c
+++ linux-qcom-6.8.0/drivers/ptp/ptp_kvm_x86.c
@@ -26,7 +26,7 @@
 	long ret;
 
 	if (!kvm_para_available())
-		return -ENODEV;
+		return -EOPNOTSUPP;
 
 	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) {
 		p = alloc_page(GFP_KERNEL | __GFP_ZERO);
@@ -46,14 +46,14 @@
 
 	clock_pair_gpa = slow_virt_to_phys(clock_pair);
 	if (!pvclock_get_pvti_cpu0_va()) {
-		ret = -ENODEV;
+		ret = -EOPNOTSUPP;
 		goto err;
 	}
 
 	ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, clock_pair_gpa,
 			     KVM_CLOCK_PAIRING_WALLCLOCK);
 	if (ret == -KVM_ENOSYS) {
-		ret = -ENODEV;
+		ret = -EOPNOTSUPP;
 		goto err;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/ptp/ptp_ocp.c
+++ linux-qcom-6.8.0/drivers/ptp/ptp_ocp.c
@@ -306,6 +306,15 @@
 #define OCP_SERIAL_LEN			6
 #define OCP_SMA_NUM			4
 
+enum {
+	PORT_GNSS,
+	PORT_GNSS2,
+	PORT_MAC, /* miniature atomic clock */
+	PORT_NMEA,
+
+	__PORT_COUNT,
+};
+
 struct ptp_ocp {
 	struct pci_dev		*pdev;
 	struct device		dev;
@@ -347,10 +356,7 @@
 	struct delayed_work	sync_work;
 	int			id;
 	int			n_irqs;
-	struct ptp_ocp_serial_port	gnss_port;
-	struct ptp_ocp_serial_port	gnss2_port;
-	struct ptp_ocp_serial_port	mac_port;   /* miniature atomic clock */
-	struct ptp_ocp_serial_port	nmea_port;
+	struct ptp_ocp_serial_port	port[__PORT_COUNT];
 	bool			fw_loader;
 	u8			fw_tag;
 	u16			fw_version;
@@ -641,28 +647,28 @@
 		},
 	},
 	{
-		OCP_SERIAL_RESOURCE(gnss_port),
+		OCP_SERIAL_RESOURCE(port[PORT_GNSS]),
 		.offset = 0x00160000 + 0x1000, .irq_vec = 3,
 		.extra = &(struct ptp_ocp_serial_port) {
 			.baud = 115200,
 		},
 	},
 	{
-		OCP_SERIAL_RESOURCE(gnss2_port),
+		OCP_SERIAL_RESOURCE(port[PORT_GNSS2]),
 		.offset = 0x00170000 + 0x1000, .irq_vec = 4,
 		.extra = &(struct ptp_ocp_serial_port) {
 			.baud = 115200,
 		},
 	},
 	{
-		OCP_SERIAL_RESOURCE(mac_port),
+		OCP_SERIAL_RESOURCE(port[PORT_MAC]),
 		.offset = 0x00180000 + 0x1000, .irq_vec = 5,
 		.extra = &(struct ptp_ocp_serial_port) {
 			.baud = 57600,
 		},
 	},
 	{
-		OCP_SERIAL_RESOURCE(nmea_port),
+		OCP_SERIAL_RESOURCE(port[PORT_NMEA]),
 		.offset = 0x00190000 + 0x1000, .irq_vec = 10,
 	},
 	{
@@ -720,7 +726,7 @@
 		.offset = 0x01000000, .size = 0x10000,
 	},
 	{
-		OCP_SERIAL_RESOURCE(gnss_port),
+		OCP_SERIAL_RESOURCE(port[PORT_GNSS]),
 		.offset = 0x00160000 + 0x1000, .irq_vec = 3,
 		.extra = &(struct ptp_ocp_serial_port) {
 			.baud = 115200,
@@ -819,7 +825,7 @@
 		},
 	},
 	{
-		OCP_SERIAL_RESOURCE(mac_port),
+		OCP_SERIAL_RESOURCE(port[PORT_MAC]),
 		.offset = 0x00190000, .irq_vec = 7,
 		.extra = &(struct ptp_ocp_serial_port) {
 			.baud = 9600,
@@ -1441,6 +1447,15 @@
 	return gnss_name[idx];
 }
 
+static const char *
+ptp_ocp_tty_port_name(int idx)
+{
+	static const char * const tty_name[] = {
+		"GNSS", "GNSS2", "MAC", "NMEA"
+	};
+	return tty_name[idx];
+}
+
 struct ptp_ocp_nvmem_match_info {
 	struct ptp_ocp *bp;
 	const void * const tag;
@@ -3094,6 +3109,54 @@
 static EXT_ATTR_RO(freq, frequency, 3);
 
 static ssize_t
+ptp_ocp_tty_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct dev_ext_attribute *ea = to_ext_attr(attr);
+	struct ptp_ocp *bp = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "ttyS%d", bp->port[(uintptr_t)ea->var].line);
+}
+
+static umode_t
+ptp_ocp_timecard_tty_is_visible(struct kobject *kobj, struct attribute *attr, int n)
+{
+	struct ptp_ocp *bp = dev_get_drvdata(kobj_to_dev(kobj));
+	struct ptp_ocp_serial_port *port;
+	struct device_attribute *dattr;
+	struct dev_ext_attribute *ea;
+
+	if (strncmp(attr->name, "tty", 3))
+		return attr->mode;
+
+	dattr = container_of(attr, struct device_attribute, attr);
+	ea = container_of(dattr, struct dev_ext_attribute, attr);
+	port = &bp->port[(uintptr_t)ea->var];
+	return port->line == -1 ? 0 : 0444;
+}
+
+#define EXT_TTY_ATTR_RO(_name, _val)			\
+	struct dev_ext_attribute dev_attr_tty##_name =	\
+		{ __ATTR(tty##_name, 0444, ptp_ocp_tty_show, NULL), (void *)_val }
+
+static EXT_TTY_ATTR_RO(GNSS, PORT_GNSS);
+static EXT_TTY_ATTR_RO(GNSS2, PORT_GNSS2);
+static EXT_TTY_ATTR_RO(MAC, PORT_MAC);
+static EXT_TTY_ATTR_RO(NMEA, PORT_NMEA);
+static struct attribute *ptp_ocp_timecard_tty_attrs[] = {
+	&dev_attr_ttyGNSS.attr.attr,
+	&dev_attr_ttyGNSS2.attr.attr,
+	&dev_attr_ttyMAC.attr.attr,
+	&dev_attr_ttyNMEA.attr.attr,
+	NULL,
+};
+
+static const struct attribute_group ptp_ocp_timecard_tty_group = {
+	.name = "tty",
+	.attrs = ptp_ocp_timecard_tty_attrs,
+	.is_visible = ptp_ocp_timecard_tty_is_visible,
+};
+
+static ssize_t
 serialnum_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
 	struct ptp_ocp *bp = dev_get_drvdata(dev);
@@ -3522,6 +3585,7 @@
 
 static const struct ocp_attr_group fb_timecard_groups[] = {
 	{ .cap = OCP_CAP_BASIC,	    .group = &fb_timecard_group },
+	{ .cap = OCP_CAP_BASIC,	    .group = &ptp_ocp_timecard_tty_group },
 	{ .cap = OCP_CAP_SIGNAL,    .group = &fb_timecard_signal0_group },
 	{ .cap = OCP_CAP_SIGNAL,    .group = &fb_timecard_signal1_group },
 	{ .cap = OCP_CAP_SIGNAL,    .group = &fb_timecard_signal2_group },
@@ -3561,6 +3625,7 @@
 
 static const struct ocp_attr_group art_timecard_groups[] = {
 	{ .cap = OCP_CAP_BASIC,	    .group = &art_timecard_group },
+	{ .cap = OCP_CAP_BASIC,	    .group = &ptp_ocp_timecard_tty_group },
 	{ },
 };
 
@@ -3676,16 +3741,11 @@
 	bp = dev_get_drvdata(dev);
 
 	seq_printf(s, "%7s: /dev/ptp%d\n", "PTP", ptp_clock_index(bp->ptp));
-	if (bp->gnss_port.line != -1)
-		seq_printf(s, "%7s: /dev/ttyS%d\n", "GNSS1",
-			   bp->gnss_port.line);
-	if (bp->gnss2_port.line != -1)
-		seq_printf(s, "%7s: /dev/ttyS%d\n", "GNSS2",
-			   bp->gnss2_port.line);
-	if (bp->mac_port.line != -1)
-		seq_printf(s, "%7s: /dev/ttyS%d\n", "MAC", bp->mac_port.line);
-	if (bp->nmea_port.line != -1)
-		seq_printf(s, "%7s: /dev/ttyS%d\n", "NMEA", bp->nmea_port.line);
+	for (i = 0; i < __PORT_COUNT; i++) {
+		if (bp->port[i].line != -1)
+			seq_printf(s, "%7s: /dev/ttyS%d\n", ptp_ocp_tty_port_name(i),
+				   bp->port[i].line);
+	}
 
 	memset(sma_val, 0xff, sizeof(sma_val));
 	if (bp->sma_map1) {
@@ -3995,7 +4055,7 @@
 static int
 ptp_ocp_device_init(struct ptp_ocp *bp, struct pci_dev *pdev)
 {
-	int err;
+	int i, err;
 
 	mutex_lock(&ptp_ocp_lock);
 	err = idr_alloc(&ptp_ocp_idr, bp, 0, 0, GFP_KERNEL);
@@ -4008,10 +4068,10 @@
 
 	bp->ptp_info = ptp_ocp_clock_info;
 	spin_lock_init(&bp->lock);
-	bp->gnss_port.line = -1;
-	bp->gnss2_port.line = -1;
-	bp->mac_port.line = -1;
-	bp->nmea_port.line = -1;
+
+	for (i = 0; i < __PORT_COUNT; i++)
+		bp->port[i].line = -1;
+
 	bp->pdev = pdev;
 
 	device_initialize(&bp->dev);
@@ -4068,22 +4128,6 @@
 	struct pps_device *pps;
 	char buf[32];
 
-	if (bp->gnss_port.line != -1) {
-		sprintf(buf, "ttyS%d", bp->gnss_port.line);
-		ptp_ocp_link_child(bp, buf, "ttyGNSS");
-	}
-	if (bp->gnss2_port.line != -1) {
-		sprintf(buf, "ttyS%d", bp->gnss2_port.line);
-		ptp_ocp_link_child(bp, buf, "ttyGNSS2");
-	}
-	if (bp->mac_port.line != -1) {
-		sprintf(buf, "ttyS%d", bp->mac_port.line);
-		ptp_ocp_link_child(bp, buf, "ttyMAC");
-	}
-	if (bp->nmea_port.line != -1) {
-		sprintf(buf, "ttyS%d", bp->nmea_port.line);
-		ptp_ocp_link_child(bp, buf, "ttyNMEA");
-	}
 	sprintf(buf, "ptp%d", ptp_clock_index(bp->ptp));
 	ptp_ocp_link_child(bp, buf, "ptp");
 
@@ -4132,23 +4176,20 @@
 	};
 	struct device *dev = &bp->pdev->dev;
 	u32 reg;
+	int i;
 
 	ptp_ocp_phc_info(bp);
 
-	ptp_ocp_serial_info(dev, "GNSS", bp->gnss_port.line,
-			    bp->gnss_port.baud);
-	ptp_ocp_serial_info(dev, "GNSS2", bp->gnss2_port.line,
-			    bp->gnss2_port.baud);
-	ptp_ocp_serial_info(dev, "MAC", bp->mac_port.line, bp->mac_port.baud);
-	if (bp->nmea_out && bp->nmea_port.line != -1) {
-		bp->nmea_port.baud = -1;
-
-		reg = ioread32(&bp->nmea_out->uart_baud);
-		if (reg < ARRAY_SIZE(nmea_baud))
-			bp->nmea_port.baud = nmea_baud[reg];
-
-		ptp_ocp_serial_info(dev, "NMEA", bp->nmea_port.line,
-				    bp->nmea_port.baud);
+	for (i = 0; i < __PORT_COUNT; i++) {
+		if (i == PORT_NMEA && bp->nmea_out && bp->port[PORT_NMEA].line != -1) {
+			bp->port[PORT_NMEA].baud = -1;
+
+			reg = ioread32(&bp->nmea_out->uart_baud);
+			if (reg < ARRAY_SIZE(nmea_baud))
+				bp->port[PORT_NMEA].baud = nmea_baud[reg];
+		}
+		ptp_ocp_serial_info(dev, ptp_ocp_tty_port_name(i), bp->port[i].line,
+				    bp->port[i].baud);
 	}
 }
 
@@ -4157,9 +4198,6 @@
 {
 	struct device *dev = &bp->dev;
 
-	sysfs_remove_link(&dev->kobj, "ttyGNSS");
-	sysfs_remove_link(&dev->kobj, "ttyGNSS2");
-	sysfs_remove_link(&dev->kobj, "ttyMAC");
 	sysfs_remove_link(&dev->kobj, "ptp");
 	sysfs_remove_link(&dev->kobj, "pps");
 }
@@ -4189,14 +4227,9 @@
 	for (i = 0; i < 4; i++)
 		if (bp->signal_out[i])
 			ptp_ocp_unregister_ext(bp->signal_out[i]);
-	if (bp->gnss_port.line != -1)
-		serial8250_unregister_port(bp->gnss_port.line);
-	if (bp->gnss2_port.line != -1)
-		serial8250_unregister_port(bp->gnss2_port.line);
-	if (bp->mac_port.line != -1)
-		serial8250_unregister_port(bp->mac_port.line);
-	if (bp->nmea_port.line != -1)
-		serial8250_unregister_port(bp->nmea_port.line);
+	for (i = 0; i < __PORT_COUNT; i++)
+		if (bp->port[i].line != -1)
+			serial8250_unregister_port(bp->port[i].line);
 	platform_device_unregister(bp->spi_flash);
 	platform_device_unregister(bp->i2c_ctrl);
 	if (bp->i2c_clk)
@@ -4277,7 +4310,7 @@
 		return -EOPNOTSUPP;
 	mode = direction == DPLL_PIN_DIRECTION_INPUT ?
 			    SMA_MODE_IN : SMA_MODE_OUT;
-	return ptp_ocp_sma_store_val(bp, 0, mode, sma_nr);
+	return ptp_ocp_sma_store_val(bp, 0, mode, sma_nr + 1);
 }
 
 static int ptp_ocp_dpll_frequency_set(const struct dpll_pin *pin,
@@ -4298,7 +4331,7 @@
 	tbl = bp->sma_op->tbl[sma->mode];
 	for (i = 0; tbl[i].name; i++)
 		if (tbl[i].frequency == frequency)
-			return ptp_ocp_sma_store_val(bp, i, sma->mode, sma_nr);
+			return ptp_ocp_sma_store_val(bp, i, sma->mode, sma_nr + 1);
 	return -EINVAL;
 }
 
@@ -4315,7 +4348,7 @@
 	u32 val;
 	int i;
 
-	val = bp->sma_op->get(bp, sma_nr);
+	val = bp->sma_op->get(bp, sma_nr + 1);
 	tbl = bp->sma_op->tbl[sma->mode];
 	for (i = 0; tbl[i].name; i++)
 		if (val == tbl[i].value) {
--- linux-qcom-6.8.0.orig/drivers/ptp/ptp_qcom_tsc.c
+++ linux-qcom-6.8.0/drivers/ptp/ptp_qcom_tsc.c
@@ -0,0 +1,742 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * QCOM TSC PTP : Linux driver for Time Stamp Counter Hardware.
+ *
+ */
+
+#define pr_fmt(fmt) "qcom_tsc: %s: " fmt, __func__
+
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/ptp_clock_kernel.h>
+#include <linux/platform_device.h>
+#include <linux/of_irq.h>
+
+/* Register offset definitions */
+#define TSCSS_TSC_CONTROL_CNTCR			0x0
+#define TSCSS_TSC_CONTROL_CNTCV_LO		0x8
+#define TSCSS_TSC_CONTROL_CNTCV_HI		0xC
+#define TSCSS_TSC_CONTROL_CNTCV_FRAC		0x10
+#define TSCSS_TSC_SLEEP_INCR_VAL_LO		0x24
+#define TSCSS_TSC_SLEEP_INCR_VAL_HI		0x28
+#define TSCSS_TSC_DRIFT_CORRECT_INCR_VAL	0x2C
+#define TSCSS_TSC_DRIFT_CORRECT_DURATION	0x30
+#define TSCSS_TSC_DRIFT_CORRECT_CMD		0x34
+#define TSCSS_TSC_ROLLOVER_VAL			0x3C
+#define TSCSS_TSC_SPARE				0x40
+#define TSCSS_TSC_OFFSET_LO			0x50
+#define TSCSS_TSC_OFFSET_HI			0x54
+#define TSCSS_TSC_FUSA_CFG_STAT			0xF54
+#define TSCSS_TSC_READ_CNTCV_LO			0x1000
+#define TSCSS_TSC_READ_CNTCV_HI			0x1004
+#define TSCSS_TSC_HW_PRELOAD_VAL_LO		0x0060
+#define TSCSS_TSC_HW_PRELOAD_VAL_HI		0x0064
+
+#define TSCSS_TSC_SLICE_ETU_CFG			0x0
+#define TSCSS_TSC_SLICE_ETU_STATUS		0x4
+#define TSCSS_ETU_SLICE_TSC_TS_LO		0x8
+#define TSCSS_ETU_SLICE_TSC_TS_HI		0xC
+#define TSCSS_ETU_SLICE_TS_EVENT_TYPE		0x10
+#define TSCSS_ETU_SLICE_GCTR_TS_LO		0x20
+#define TSCSS_ETU_SLICE_GCTR_TS_HI		0x24
+#define TSCSS_ETU_SLICE_FIFO_CLR		0x30
+#define TSCSS_ETU_SLICE_SW_TRIG_CFG		0x34
+#define TSCSS_ETU_SLICE_TIMER_TRIG_PERIOD	0x38
+#define MAX_ETU_SLICE				16
+
+#define TSC_PRELOAD_POLLING_DELAY_MS		100
+#define NSEC_SHFT				32
+#define NSEC_MASK				GENMASK_ULL(31, 0)
+#define NSEC					1000000000ULL
+#define XO_MHZ					19200000
+#define TSCSS_TSC_ETU_SLICE_BASE(reg_base, num, offset)	\
+			(reg_base + num * 0x1000 + offset)
+
+struct qcom_etu_slice {
+	char name[10];
+	struct ptp_clock *ptp_clock;
+	void __iomem *etu_baseaddr;
+	u64 etu_tsc_timestamp;
+	u64 last_sec;
+	u64 global_qtimer;
+	int extts_enable;
+	int extts_irq;
+	int extts_index;
+	int extts_event_sel;
+	int extts_slice_num;
+	int extts_event_type;
+	u32 etu_tsc_sec;
+	u32 etu_tsc_nsec;
+	u32 etu_gctr_sec;
+	u32 etu_gctr_nsec;
+	bool extts_present;
+};
+
+struct qcom_ptp_tsc {
+	struct	device *dev;
+	void __iomem *baseaddr;
+	void __iomem *etu_baseaddr;
+	struct clk *tsc_cfg_ahb_clk;
+	struct clk *tsc_cntr_clk;
+	struct clk *tsc_etu_clk;
+	struct ptp_clock *ptp_clock;
+	struct ptp_clock_info  ptp_clock_info;
+	struct qcom_etu_slice etu_slice[MAX_ETU_SLICE];
+	int pps_enable;
+	int total_etu_cnt;
+	u32 incval;
+	bool tsc_nsec_update;
+	bool tsc_hw_preload;
+	spinlock_t reg_lock;
+	struct delayed_work tsc_preload_poll_work;
+};
+
+static void tsc_preload_poll(struct work_struct *work)
+{
+	struct qcom_ptp_tsc *timer = container_of(work, struct qcom_ptp_tsc,
+						tsc_preload_poll_work.work);
+	u32 regval;
+
+	regval = readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR);
+	/* Check for the HW_PRELOAD_STATUS and disable HW_PRELOAD */
+	if (!(regval & BIT(14))) {
+		regval &= ~BIT(2);
+		writel_relaxed(regval, timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR);
+		pr_info("TSC CNTCR: 0x%x HW_PRELOAD is disabled\n",
+			readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR));
+		return;
+	}
+
+	pr_debug("TSC CNTCR: 0x%x HW_PRELOAD_STATUS is not cleared\n", regval);
+	mod_delayed_work(system_highpri_wq, &timer->tsc_preload_poll_work,
+			msecs_to_jiffies(TSC_PRELOAD_POLLING_DELAY_MS));
+}
+
+static int qcom_ptp_tsc_is_enabled(void __iomem *addr)
+{
+	return readl_relaxed(addr + TSCSS_TSC_CONTROL_CNTCR) & BIT(0);
+}
+
+static void qcom_tod_read(struct qcom_ptp_tsc *timer, struct timespec64 *ts)
+{
+	u64 temp, final;
+	u32 sec, nsec;
+
+	if (!qcom_ptp_tsc_is_enabled(timer->baseaddr)) {
+		pr_debug("TSC is not enabled\n");
+		return;
+	}
+
+	sec = readl_relaxed(timer->baseaddr + TSCSS_TSC_READ_CNTCV_HI);
+	nsec = readl_relaxed(timer->baseaddr + TSCSS_TSC_READ_CNTCV_LO);
+
+	pr_debug("CNTR_HI: 0x%x, sec %lld\n",
+			readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_HI), sec);
+	pr_debug("CNTR_LO: 0x%x nsec %ld\n",
+			readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_LO), nsec);
+
+	if (timer->tsc_nsec_update) {
+		temp = sec;
+		final = (temp << NSEC_SHFT) | nsec;
+		sec = div_u64_rem(final, NSEC, &nsec);
+		pr_debug("tsc_nsec_update: %d, sec %lld, nsec %ld\n",
+						timer->tsc_nsec_update, sec, nsec);
+	}
+
+	ts->tv_sec = sec;
+	ts->tv_nsec = nsec;
+}
+
+static void qcom_ptp_enable_tsc_hw_preload(struct qcom_ptp_tsc *timer, struct timespec64 ts)
+{
+	u32 regval;
+	int timeout = 500;
+
+	/* Enable HW_PRELOAD */
+	regval = readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR);
+	regval |= BIT(2);
+	writel_relaxed(regval, timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR);
+
+	/* Program PRELOAD registers */
+	writel_relaxed(ts.tv_sec, timer->baseaddr + TSCSS_TSC_HW_PRELOAD_VAL_HI);
+	writel_relaxed(ts.tv_nsec, timer->baseaddr + TSCSS_TSC_HW_PRELOAD_VAL_LO);
+
+	pr_debug("HW_PRELOAD_VAL_HI: 0x%x\n",
+		readl_relaxed(timer->baseaddr + TSCSS_TSC_HW_PRELOAD_VAL_HI));
+	pr_debug("HW_PRELOAD_VAL_LO: 0x%x\n",
+		readl_relaxed(timer->baseaddr + TSCSS_TSC_HW_PRELOAD_VAL_LO));
+
+	/* Check for the HW_PRELOAD_STATUS and start poll thread */
+	while (timeout-- > 0) {
+		regval = readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR);
+		if (regval & BIT(14)) {
+			pr_debug("TSC CNTR: 0x%x HW_PRELOAD is enabled\n", regval);
+			mod_delayed_work(system_highpri_wq, &timer->tsc_preload_poll_work,
+					msecs_to_jiffies(TSC_PRELOAD_POLLING_DELAY_MS));
+			return;
+		}
+		udelay(1);
+	}
+
+	pr_warn("TSC CNTR: 0x%x HW_PRELOAD enable failed\n",
+		readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR));
+}
+
+static int qcom_ptp_update_tsc_cntr(struct qcom_ptp_tsc *timer,
+				struct timespec64 offset)
+{
+	u64 timestamp = 0;
+	u32 regval;
+
+	/* Update to 1ns resolution */
+	if (timer->tsc_nsec_update) {
+		timestamp =  offset.tv_sec * NSEC + offset.tv_nsec;
+		writel_relaxed((timestamp >> NSEC_SHFT),
+				timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_HI);
+		writel_relaxed(timestamp & NSEC_MASK, timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_LO);
+	} else {
+		writel_relaxed(offset.tv_sec, timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_HI);
+		writel_relaxed(offset.tv_nsec, timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_LO);
+	}
+
+	pr_debug("Timestamp %llu: sec: %lld, nsec: %ld\n", timestamp,
+							offset.tv_sec, offset.tv_nsec);
+
+	pr_debug("CNTR_HI: 0x%x\n", readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_HI));
+	pr_debug("CNTR_LO: 0x%x\n", readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_LO));
+
+	/* Enable the counter */
+	regval = readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR);
+	regval |= BIT(0);
+
+	writel_relaxed(regval, timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR);
+
+	return 0;
+}
+
+static void qcom_ptp_update_tsc_offset(struct qcom_ptp_tsc *timer,
+				struct timespec64 offset)
+{
+	u64 timestamp = 0;
+
+	if (timer->tsc_nsec_update) {
+		timestamp =  offset.tv_sec * NSEC + offset.tv_nsec;
+		writel_relaxed((timestamp >> NSEC_SHFT),
+				timer->baseaddr + TSCSS_TSC_OFFSET_HI);
+		writel_relaxed(timestamp & NSEC_MASK, timer->baseaddr + TSCSS_TSC_OFFSET_LO);
+	} else {
+		writel_relaxed(offset.tv_sec, timer->baseaddr + TSCSS_TSC_OFFSET_HI);
+		writel_relaxed(offset.tv_nsec, timer->baseaddr + TSCSS_TSC_OFFSET_LO);
+	}
+
+	pr_debug("CNTR_HI: 0x%x\n", readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_HI));
+	pr_debug("CNTR_LO: 0x%x\n", readl_relaxed(timer->baseaddr + TSCSS_TSC_CONTROL_CNTCV_LO));
+}
+
+/*
+ * PTP clock operations
+ */
+static int qcom_ptp_adjfreq(struct ptp_clock_info *ptp, long ppb)
+{
+	struct qcom_ptp_tsc *timer = container_of(ptp, struct qcom_ptp_tsc,
+			ptp_clock_info);
+
+	int neg_adj = 0;
+	u64 freq;
+	u32 diff, incval = timer->incval;
+
+	if (ppb < 0) {
+		neg_adj = 1;
+		ppb = -ppb;
+	}
+
+	freq = incval;
+	freq *= ppb;
+	diff = div_u64(freq, NSEC);
+
+	incval = neg_adj ? (incval - diff) : (incval + diff);
+
+	return 0;
+}
+
+static int qcom_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
+{
+	unsigned long flags;
+	struct qcom_ptp_tsc *timer = container_of(ptp, struct qcom_ptp_tsc,
+			ptp_clock_info);
+	struct timespec64 offset;
+
+	spin_lock_irqsave(&timer->reg_lock, flags);
+
+	offset = ns_to_timespec64(delta);
+	pr_debug("sec: %lld, nsec: %ld\n", offset.tv_sec, offset.tv_nsec);
+
+	qcom_ptp_update_tsc_offset(timer, offset);
+
+	spin_unlock_irqrestore(&timer->reg_lock, flags);
+
+	return 0;
+}
+
+static int qcom_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
+{
+	unsigned long flags;
+	struct qcom_ptp_tsc *timer = container_of(ptp, struct qcom_ptp_tsc,
+								ptp_clock_info);
+
+	spin_lock_irqsave(&timer->reg_lock, flags);
+	qcom_tod_read(timer, ts);
+	spin_unlock_irqrestore(&timer->reg_lock, flags);
+	return 0;
+}
+
+/**
+ * qcom_ptp_settime - Set the current time on the hardware clock
+ * @ptp: ptp clock structure
+ * @ts: timespec64 containing the new time for the cycle counter
+ */
+static int qcom_ptp_settime(struct ptp_clock_info *ptp, const struct timespec64 *ts)
+{
+	struct qcom_ptp_tsc *timer = container_of(ptp, struct qcom_ptp_tsc, ptp_clock_info);
+	struct timespec64 delta, tod;
+	struct timespec64 offset;
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&timer->reg_lock, flags);
+
+	pr_debug("TS.sec %lld TS.tv_nsec %ld\n", ts->tv_sec,  ts->tv_nsec);
+
+	if (!qcom_ptp_tsc_is_enabled(timer->baseaddr)) {
+		/* Update the Counter */
+		offset.tv_sec = ts->tv_sec;
+		offset.tv_nsec = ts->tv_nsec;
+
+		ret = qcom_ptp_update_tsc_cntr(timer, offset);
+
+		spin_unlock_irqrestore(&timer->reg_lock, flags);
+		return ret;
+	}
+
+	/* Get the current timer value */
+	qcom_tod_read(timer, &tod);
+
+	/* Subtract the current reported time from our desired time */
+	delta = timespec64_sub((struct timespec64)*ts, tod);
+
+	pr_debug("Delta.sec %lld delta.tv_nsec %ld\n", delta.tv_sec,  delta.tv_nsec);
+
+	/* Update the Counter */
+	qcom_ptp_update_tsc_offset(timer, delta);
+
+	spin_unlock_irqrestore(&timer->reg_lock, flags);
+	return 0;
+}
+
+static irqreturn_t qcom_etu_irq_handler(int irq, void *data)
+{
+	struct qcom_etu_slice *etu = (struct qcom_etu_slice *)data;
+	struct ptp_clock_event extts_event;
+	u32 regval, status;
+
+	status = readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_TSC_SLICE_ETU_STATUS));
+
+	pr_debug("Slice %d extts_enable %d status 0%x\n",
+					etu->extts_slice_num, etu->extts_enable, status);
+
+	if (etu->extts_enable && (status & GENMASK(5, 0))) {
+		u64 ts;
+
+		etu->etu_tsc_sec = readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_ETU_SLICE_TSC_TS_HI));
+
+		etu->etu_tsc_nsec = readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_ETU_SLICE_TSC_TS_LO));
+		ts  = etu->etu_tsc_sec * NSEC + etu->etu_tsc_nsec;
+
+		pr_debug("ts:%llu etu->etu_tsc_timestamp:%llu\n", ts, etu->etu_tsc_timestamp);
+
+		if (ts != etu->etu_tsc_timestamp) {
+			extts_event.type = PTP_CLOCK_EXTTS;
+			extts_event.index = etu->extts_index;
+			extts_event.timestamp = ts;
+
+			pr_debug("type:%d index:%d timestamp:%llu\n", extts_event.type,
+					extts_event.index, extts_event.timestamp);
+
+			ptp_clock_event(etu->ptp_clock, &extts_event);
+		}
+		etu->etu_tsc_timestamp = ts;
+
+		pr_debug("etu_tsc_sec:%u etu_tsc_nsec:%u etu_tsc_timestamp:%llu\n",
+				etu->etu_tsc_sec, etu->etu_tsc_nsec, etu->etu_tsc_timestamp);
+
+		etu->etu_gctr_sec = readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_ETU_SLICE_GCTR_TS_HI));
+
+		etu->etu_gctr_nsec = readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_ETU_SLICE_GCTR_TS_LO));
+
+		etu->extts_event_type = readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_ETU_SLICE_TS_EVENT_TYPE));
+
+		/* Concatenate GCTR_TS_HI(31:0) & GCTR_TS_LO(31:8) and divide with 19.2MHz */
+		etu->global_qtimer = (((u64)etu->etu_gctr_sec << 24) |
+				(etu->etu_gctr_nsec >> 8)) / XO_MHZ;
+
+		pr_debug("etu_gctr_sec:%u etu_gctr_nsec:%u global_qtimer:%x extts_event_type %d\n",
+				etu->etu_gctr_sec, etu->etu_gctr_nsec,
+				etu->global_qtimer, etu->extts_event_type);
+
+		regval = readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_TSC_SLICE_ETU_CFG));
+		regval &= ~BIT(17);
+		regval &= ~BIT(16);
+
+		writel_relaxed(regval, TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_TSC_SLICE_ETU_CFG));
+
+		/* FIFO CLR */
+		writel_relaxed(0x7, TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_ETU_SLICE_FIFO_CLR));
+
+		pr_debug("Status %x, sec: %u\n",
+				readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_TSC_SLICE_ETU_STATUS)),
+				readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_ETU_SLICE_TSC_TS_HI)));
+
+		/* Enable GCTR_TS_EN & TSCTR_TS_EN*/
+		regval |= BIT(16) | BIT(17);
+
+		writel_relaxed(regval, TSCSS_TSC_ETU_SLICE_BASE(etu->etu_baseaddr,
+					etu->extts_slice_num, TSCSS_TSC_SLICE_ETU_CFG));
+	}
+
+	return IRQ_HANDLED;
+}
+
+static void qcom_tsc_configure_etu(struct qcom_ptp_tsc *timer, int slice)
+{
+	void __iomem *base = timer->etu_baseaddr;
+	u32 regval;
+
+	/* Register for the IRQ */
+	regval = readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(base, slice, TSCSS_TSC_SLICE_ETU_CFG));
+	regval |= (timer->etu_slice[slice].extts_event_sel << 4) & GENMASK(9, 4);
+
+	writel_relaxed(regval, TSCSS_TSC_ETU_SLICE_BASE(base, slice, TSCSS_TSC_SLICE_ETU_CFG));
+
+	regval = readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(base, slice, TSCSS_TSC_SLICE_ETU_CFG));
+
+	/* Enable GCTR_TS_EN & TSCTR_TS_EN*/
+	regval |= BIT(16) | BIT(17);
+	/* Interrupt MASK enable */
+	regval |= BIT(31);
+
+	/* Enable rising edge config */
+	regval |= BIT(0);
+	writel_relaxed(regval, TSCSS_TSC_ETU_SLICE_BASE(base, slice, TSCSS_TSC_SLICE_ETU_CFG));
+
+	pr_debug("ETU_SLICE#%d: 0x%x\n", slice,
+		readl_relaxed(TSCSS_TSC_ETU_SLICE_BASE(base, slice, TSCSS_TSC_SLICE_ETU_CFG)));
+}
+
+static int qcom_ptp_enable(struct ptp_clock_info *ptp,
+			  struct ptp_clock_request *rq, int on)
+{
+	struct qcom_ptp_tsc *timer = container_of(ptp, struct qcom_ptp_tsc,
+							ptp_clock_info);
+	struct timespec64 ts;
+	int slice;
+
+	pr_debug("Request Type %d\n", rq->type);
+
+	switch (rq->type) {
+	case PTP_CLK_REQ_PPS:
+		timer->pps_enable = 1;
+		return 0;
+	case PTP_CLK_REQ_EXTTS:
+		pr_debug("PTP_CLK_REQ_EXTTS: Request external Index %d\n", rq->extts.index);
+
+		if (rq->extts.index > timer->total_etu_cnt)
+			return -EINVAL;
+		else if (!on)
+			return 0;
+
+		for (slice = 0; slice < MAX_ETU_SLICE; slice++) {
+			if (!timer->etu_slice[slice].extts_present)
+				continue;
+
+			if (rq->extts.index == timer->etu_slice[slice].extts_index) {
+				pr_debug("slice %d, index %d, etu_index %d\n", slice,
+					rq->extts.index, timer->etu_slice[slice].extts_index);
+				qcom_tsc_configure_etu(timer,
+					timer->etu_slice[slice].extts_slice_num);
+				timer->etu_slice[slice].extts_enable = true;
+			}
+
+		}
+		return 0;
+	case PTP_CLK_REQ_PEROUT:
+		if (timer->tsc_hw_preload) {
+			if (!rq->perout.period.sec) {
+				/* Get the current timer value */
+				qcom_tod_read(timer, &ts);
+			} else {
+				pr_debug("PTP_CLK_REQ_PEROUT: sec:%u nsec:%u\n",
+					rq->perout.period.sec, rq->perout.period.nsec);
+				ts.tv_sec = rq->perout.period.sec;
+				ts.tv_nsec = rq->perout.period.nsec;
+			}
+
+			/* Preload TSC with tv_sec += 1 and tv_nsec = 0 values */
+			ts.tv_sec += 1;
+			ts.tv_nsec = 0;
+			qcom_ptp_enable_tsc_hw_preload(timer, ts);
+		}
+		return 0;
+	default:
+		break;
+	}
+
+	return -EOPNOTSUPP;
+}
+
+static struct ptp_clock_info qcom_ptp_clock_info = {
+	.owner    = THIS_MODULE,
+	.name     = "QCOM TSC",
+	.max_adj  = 999999999,
+	/* The number of external time stamp channels. */
+	.n_ext_ts = 1,
+	.n_per_out = 1,
+	.pps = 1,
+	.adjfine  = qcom_ptp_adjfreq,
+	.adjtime  = qcom_ptp_adjtime,
+	.gettime64  = qcom_ptp_gettime,
+	.settime64 = qcom_ptp_settime,
+	.enable   = qcom_ptp_enable,
+};
+
+/* module operations */
+
+static int qcom_ptp_tsc_remove(struct platform_device *pdev)
+{
+	struct qcom_ptp_tsc *timer = platform_get_drvdata(pdev);
+
+	if (timer->ptp_clock) {
+		ptp_clock_unregister(timer->ptp_clock);
+		timer->ptp_clock = NULL;
+	}
+
+	return 0;
+}
+
+static int qcom_tsc_etu_get_data(struct platform_device *pdev,
+		 struct qcom_ptp_tsc *timer)
+{
+	struct device *dev = &pdev->dev;
+	struct resource *r_mem;
+	struct pinctrl *pinctrl;
+	int ret, cnt, i;
+
+	r_mem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	if (!r_mem) {
+		dev_err(&pdev->dev, "No ETU resource defined\n");
+		return 0;
+	}
+
+	timer->etu_baseaddr = devm_ioremap_resource(&pdev->dev, r_mem);
+	if (IS_ERR(timer->etu_baseaddr))
+		return PTR_ERR(timer->etu_baseaddr);
+
+	cnt = of_property_count_elems_of_size(dev->of_node, "qcom,etu-event-sel",
+						sizeof(u32));
+	pr_debug("Number of event-sel %d\n", cnt);
+
+	for (i = 0; i < cnt; i++) {
+		const char *name;
+		u32 sel, slice;
+
+		ret = of_property_read_u32_index(dev->of_node, "qcom,etu-event-sel", i, &sel);
+		if (ret)
+			break;
+
+		ret = of_property_read_u32_index(dev->of_node, "qcom,etu-slice", i, &slice);
+		if (ret) {
+			pr_debug("etu-slice property does not exist, configure using sel value\n");
+			slice = sel;
+		}
+
+		timer->etu_slice[slice].etu_baseaddr = timer->etu_baseaddr;
+		timer->etu_slice[slice].extts_index = i;
+		timer->etu_slice[slice].extts_event_sel = sel;
+		timer->etu_slice[slice].extts_slice_num = slice;
+		of_property_read_string_index(dev->of_node,
+				"qcom,etu-event-names", i, &name);
+
+		strscpy(timer->etu_slice[slice].name, name, sizeof(timer->etu_slice[slice].name));
+		timer->etu_slice[slice].extts_irq = platform_get_irq_byname(pdev, name);
+
+		pr_debug("sel: %d, index: %d, slice-num:%d slice-name: %s, IRQ: %d\n", sel,
+				timer->etu_slice[slice].extts_index, slice,
+				timer->etu_slice[slice].name, timer->etu_slice[slice].extts_irq);
+
+		if (timer->etu_slice[slice].extts_irq > 0) {
+			ret = devm_request_irq(dev, timer->etu_slice[slice].extts_irq,
+					qcom_etu_irq_handler, IRQF_TRIGGER_RISING,
+					timer->etu_slice[slice].name,
+					(void *)&timer->etu_slice[slice]);
+			if (ret)
+				pr_debug("Failed to request IRQ\n");
+			else
+				pr_debug("IRQ registered ret%d\n", ret);
+		}
+
+		timer->etu_slice[slice].extts_present = true;
+		timer->etu_slice[slice].ptp_clock = timer->ptp_clock;
+	}
+
+	timer->total_etu_cnt = cnt;
+	timer->ptp_clock_info.n_ext_ts = cnt;
+
+	pinctrl = devm_pinctrl_get_select_default(&pdev->dev);
+	if (IS_ERR(pinctrl))
+		dev_info(&pdev->dev, "No default pinctrl found\n");
+
+	return 0;
+}
+
+static int qcom_ptp_tsc_probe(struct platform_device *pdev)
+{
+	struct qcom_ptp_tsc *timer;
+	struct resource *r_mem;
+	u32 cntr_val;
+	int ret;
+
+	timer = devm_kzalloc(&pdev->dev, sizeof(*timer), GFP_KERNEL);
+	if (!timer)
+		return -ENOMEM;
+
+	timer->dev = &pdev->dev;
+
+	r_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!r_mem) {
+		dev_err(&pdev->dev, "no IO resource defined\n");
+		return -ENXIO;
+	}
+
+	timer->baseaddr = devm_ioremap_resource(&pdev->dev, r_mem);
+	if (IS_ERR(timer->baseaddr))
+		return PTR_ERR(timer->baseaddr);
+
+	spin_lock_init(&timer->reg_lock);
+
+	timer->tsc_cfg_ahb_clk = devm_clk_get(&pdev->dev, "cfg_ahb");
+	if (IS_ERR(timer->tsc_cfg_ahb_clk)) {
+		if (PTR_ERR(timer->tsc_cfg_ahb_clk) != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "Unable to get CFG AHB clock\n");
+		return PTR_ERR(timer->tsc_cfg_ahb_clk);
+	}
+
+	timer->tsc_cntr_clk = devm_clk_get(&pdev->dev, "cntr");
+	if (IS_ERR(timer->tsc_cntr_clk)) {
+		if (PTR_ERR(timer->tsc_cntr_clk) != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "Unable to get Counter clock\n");
+		return PTR_ERR(timer->tsc_cntr_clk);
+	}
+
+	timer->tsc_etu_clk = devm_clk_get(&pdev->dev, "etu");
+	if (IS_ERR(timer->tsc_etu_clk)) {
+		if (PTR_ERR(timer->tsc_etu_clk) != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "Unable to get ETU clock\n");
+		return PTR_ERR(timer->tsc_etu_clk);
+	}
+
+
+	ret = clk_prepare_enable(timer->tsc_cfg_ahb_clk);
+	if (ret) {
+		pr_debug("Failed to enable AHB clock\n");
+		return ret;
+	}
+
+	ret = clk_prepare_enable(timer->tsc_cntr_clk);
+	if (ret) {
+		pr_debug("Failed to enable counter clock\n");
+		return ret;
+	}
+
+	ret = clk_prepare_enable(timer->tsc_etu_clk);
+	if (ret) {
+		pr_debug("Failed to enable etu clock\n");
+		return ret;
+	}
+
+	timer->tsc_nsec_update = of_property_read_bool(pdev->dev.of_node,
+							"qcom,tsc-nsec-update");
+
+	timer->tsc_hw_preload = of_property_read_bool(pdev->dev.of_node,
+							"qcom,tsc-hw-preload");
+
+	if (timer->tsc_hw_preload)
+		INIT_DEFERRABLE_WORK(&timer->tsc_preload_poll_work, tsc_preload_poll);
+
+	timer->ptp_clock_info = qcom_ptp_clock_info;
+
+	timer->ptp_clock = ptp_clock_register(&timer->ptp_clock_info, &pdev->dev);
+	if (IS_ERR(timer->ptp_clock)) {
+		ret = PTR_ERR(timer->ptp_clock);
+		dev_err(&pdev->dev, "Failed to register ptp clock\n");
+		goto out;
+	}
+
+	qcom_tsc_etu_get_data(pdev, timer);
+
+	if (!timer->tsc_nsec_update) {
+		cntr_val = (timer->tsc_hw_preload ? 0x1D8 : 0x1CC);
+		writel_relaxed(0x3B9AC9FF, timer->baseaddr + TSCSS_TSC_ROLLOVER_VAL);
+	} else {
+		cntr_val = 0x1CC;
+	}
+
+	writel_relaxed(cntr_val, timer->baseaddr + TSCSS_TSC_CONTROL_CNTCR);
+
+	pr_info("TSC CNTR 0x%x tsc-nsec-update %d tsc-hw-preload %d\n",
+		readl_relaxed(timer->baseaddr), timer->tsc_nsec_update, timer->tsc_hw_preload);
+
+	platform_set_drvdata(pdev, timer);
+
+	return 0;
+out:
+	timer->ptp_clock = NULL;
+	return ret;
+}
+
+static const struct of_device_id tsc_of_match[] = {
+	{ .compatible = "qcom,tsc", },
+	{ /* end of table */ }
+};
+MODULE_DEVICE_TABLE(of, timer_tsc_of_match);
+
+static struct platform_driver qcom_ptp_tsc_driver = {
+	.probe  = qcom_ptp_tsc_probe,
+	.remove = qcom_ptp_tsc_remove,
+	.driver = {
+		.name = "qcom_ptp_tsc",
+		.of_match_table = tsc_of_match,
+	},
+};
+
+module_platform_driver(qcom_ptp_tsc_driver);
+
+MODULE_DESCRIPTION("PTP QCOM TSC driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/ptp/ptp_sysfs.c
+++ linux-qcom-6.8.0/drivers/ptp/ptp_sysfs.c
@@ -297,8 +297,7 @@
 	if (max < ptp->n_vclocks)
 		goto out;
 
-	size = sizeof(int) * max;
-	vclock_index = kzalloc(size, GFP_KERNEL);
+	vclock_index = kcalloc(max, sizeof(int), GFP_KERNEL);
 	if (!vclock_index) {
 		err = -ENOMEM;
 		goto out;
--- linux-qcom-6.8.0.orig/drivers/ptp/ptp_vmw.c
+++ linux-qcom-6.8.0/drivers/ptp/ptp_vmw.c
@@ -14,7 +14,6 @@
 #include <asm/hypervisor.h>
 #include <asm/vmware.h>
 
-#define VMWARE_MAGIC 0x564D5868
 #define VMWARE_CMD_PCLK(nr) ((nr << 16) | 97)
 #define VMWARE_CMD_PCLK_GETTIME VMWARE_CMD_PCLK(0)
 
@@ -24,15 +23,10 @@
 
 static int ptp_vmw_pclk_read(u64 *ns)
 {
-	u32 ret, nsec_hi, nsec_lo, unused1, unused2, unused3;
-
-	asm volatile (VMWARE_HYPERCALL :
-		"=a"(ret), "=b"(nsec_hi), "=c"(nsec_lo), "=d"(unused1),
-		"=S"(unused2), "=D"(unused3) :
-		"a"(VMWARE_MAGIC), "b"(0),
-		"c"(VMWARE_CMD_PCLK_GETTIME), "d"(0) :
-		"memory");
+	u32 ret, nsec_hi, nsec_lo;
 
+	ret = vmware_hypercall3(VMWARE_CMD_PCLK_GETTIME, 0,
+				&nsec_hi, &nsec_lo);
 	if (ret == 0)
 		*ns = ((u64)nsec_hi << 32) | nsec_lo;
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/pwm/core.c
+++ linux-qcom-6.8.0/drivers/pwm/core.c
@@ -24,310 +24,11 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/pwm.h>
 
-static DEFINE_MUTEX(pwm_lookup_lock);
-static LIST_HEAD(pwm_lookup_list);
-
 /* protects access to pwm_chips */
 static DEFINE_MUTEX(pwm_lock);
 
 static DEFINE_IDR(pwm_chips);
 
-static struct pwm_chip *pwmchip_find_by_name(const char *name)
-{
-	struct pwm_chip *chip;
-	unsigned long id, tmp;
-
-	if (!name)
-		return NULL;
-
-	mutex_lock(&pwm_lock);
-
-	idr_for_each_entry_ul(&pwm_chips, chip, tmp, id) {
-		const char *chip_name = dev_name(chip->dev);
-
-		if (chip_name && strcmp(chip_name, name) == 0) {
-			mutex_unlock(&pwm_lock);
-			return chip;
-		}
-	}
-
-	mutex_unlock(&pwm_lock);
-
-	return NULL;
-}
-
-static int pwm_device_request(struct pwm_device *pwm, const char *label)
-{
-	int err;
-	struct pwm_chip *chip = pwm->chip;
-	const struct pwm_ops *ops = chip->ops;
-
-	if (test_bit(PWMF_REQUESTED, &pwm->flags))
-		return -EBUSY;
-
-	if (!try_module_get(chip->owner))
-		return -ENODEV;
-
-	if (ops->request) {
-		err = ops->request(chip, pwm);
-		if (err) {
-			module_put(chip->owner);
-			return err;
-		}
-	}
-
-	if (ops->get_state) {
-		/*
-		 * Zero-initialize state because most drivers are unaware of
-		 * .usage_power. The other members of state are supposed to be
-		 * set by lowlevel drivers. We still initialize the whole
-		 * structure for simplicity even though this might paper over
-		 * faulty implementations of .get_state().
-		 */
-		struct pwm_state state = { 0, };
-
-		err = ops->get_state(chip, pwm, &state);
-		trace_pwm_get(pwm, &state, err);
-
-		if (!err)
-			pwm->state = state;
-
-		if (IS_ENABLED(CONFIG_PWM_DEBUG))
-			pwm->last = pwm->state;
-	}
-
-	set_bit(PWMF_REQUESTED, &pwm->flags);
-	pwm->label = label;
-
-	return 0;
-}
-
-struct pwm_device *
-of_pwm_xlate_with_flags(struct pwm_chip *chip, const struct of_phandle_args *args)
-{
-	struct pwm_device *pwm;
-
-	if (chip->of_pwm_n_cells < 2)
-		return ERR_PTR(-EINVAL);
-
-	/* flags in the third cell are optional */
-	if (args->args_count < 2)
-		return ERR_PTR(-EINVAL);
-
-	if (args->args[0] >= chip->npwm)
-		return ERR_PTR(-EINVAL);
-
-	pwm = pwm_request_from_chip(chip, args->args[0], NULL);
-	if (IS_ERR(pwm))
-		return pwm;
-
-	pwm->args.period = args->args[1];
-	pwm->args.polarity = PWM_POLARITY_NORMAL;
-
-	if (chip->of_pwm_n_cells >= 3) {
-		if (args->args_count > 2 && args->args[2] & PWM_POLARITY_INVERTED)
-			pwm->args.polarity = PWM_POLARITY_INVERSED;
-	}
-
-	return pwm;
-}
-EXPORT_SYMBOL_GPL(of_pwm_xlate_with_flags);
-
-struct pwm_device *
-of_pwm_single_xlate(struct pwm_chip *chip, const struct of_phandle_args *args)
-{
-	struct pwm_device *pwm;
-
-	if (chip->of_pwm_n_cells < 1)
-		return ERR_PTR(-EINVAL);
-
-	/* validate that one cell is specified, optionally with flags */
-	if (args->args_count != 1 && args->args_count != 2)
-		return ERR_PTR(-EINVAL);
-
-	pwm = pwm_request_from_chip(chip, 0, NULL);
-	if (IS_ERR(pwm))
-		return pwm;
-
-	pwm->args.period = args->args[0];
-	pwm->args.polarity = PWM_POLARITY_NORMAL;
-
-	if (args->args_count == 2 && args->args[1] & PWM_POLARITY_INVERTED)
-		pwm->args.polarity = PWM_POLARITY_INVERSED;
-
-	return pwm;
-}
-EXPORT_SYMBOL_GPL(of_pwm_single_xlate);
-
-static void of_pwmchip_add(struct pwm_chip *chip)
-{
-	if (!chip->dev || !chip->dev->of_node)
-		return;
-
-	if (!chip->of_xlate) {
-		u32 pwm_cells;
-
-		if (of_property_read_u32(chip->dev->of_node, "#pwm-cells",
-					 &pwm_cells))
-			pwm_cells = 2;
-
-		chip->of_xlate = of_pwm_xlate_with_flags;
-		chip->of_pwm_n_cells = pwm_cells;
-	}
-
-	of_node_get(chip->dev->of_node);
-}
-
-static void of_pwmchip_remove(struct pwm_chip *chip)
-{
-	if (chip->dev)
-		of_node_put(chip->dev->of_node);
-}
-
-static bool pwm_ops_check(const struct pwm_chip *chip)
-{
-	const struct pwm_ops *ops = chip->ops;
-
-	if (!ops->apply)
-		return false;
-
-	if (IS_ENABLED(CONFIG_PWM_DEBUG) && !ops->get_state)
-		dev_warn(chip->dev,
-			 "Please implement the .get_state() callback\n");
-
-	return true;
-}
-
-/**
- * __pwmchip_add() - register a new PWM chip
- * @chip: the PWM chip to add
- * @owner: reference to the module providing the chip.
- *
- * Register a new PWM chip. @owner is supposed to be THIS_MODULE, use the
- * pwmchip_add wrapper to do this right.
- *
- * Returns: 0 on success or a negative error code on failure.
- */
-int __pwmchip_add(struct pwm_chip *chip, struct module *owner)
-{
-	unsigned int i;
-	int ret;
-
-	if (!chip || !chip->dev || !chip->ops || !chip->npwm)
-		return -EINVAL;
-
-	if (!pwm_ops_check(chip))
-		return -EINVAL;
-
-	chip->owner = owner;
-
-	chip->pwms = kcalloc(chip->npwm, sizeof(*chip->pwms), GFP_KERNEL);
-	if (!chip->pwms)
-		return -ENOMEM;
-
-	mutex_lock(&pwm_lock);
-
-	ret = idr_alloc(&pwm_chips, chip, 0, 0, GFP_KERNEL);
-	if (ret < 0) {
-		mutex_unlock(&pwm_lock);
-		kfree(chip->pwms);
-		return ret;
-	}
-
-	chip->id = ret;
-
-	for (i = 0; i < chip->npwm; i++) {
-		struct pwm_device *pwm = &chip->pwms[i];
-
-		pwm->chip = chip;
-		pwm->hwpwm = i;
-	}
-
-	mutex_unlock(&pwm_lock);
-
-	if (IS_ENABLED(CONFIG_OF))
-		of_pwmchip_add(chip);
-
-	pwmchip_sysfs_export(chip);
-
-	return 0;
-}
-EXPORT_SYMBOL_GPL(__pwmchip_add);
-
-/**
- * pwmchip_remove() - remove a PWM chip
- * @chip: the PWM chip to remove
- *
- * Removes a PWM chip.
- */
-void pwmchip_remove(struct pwm_chip *chip)
-{
-	pwmchip_sysfs_unexport(chip);
-
-	if (IS_ENABLED(CONFIG_OF))
-		of_pwmchip_remove(chip);
-
-	mutex_lock(&pwm_lock);
-
-	idr_remove(&pwm_chips, chip->id);
-
-	mutex_unlock(&pwm_lock);
-
-	kfree(chip->pwms);
-}
-EXPORT_SYMBOL_GPL(pwmchip_remove);
-
-static void devm_pwmchip_remove(void *data)
-{
-	struct pwm_chip *chip = data;
-
-	pwmchip_remove(chip);
-}
-
-int __devm_pwmchip_add(struct device *dev, struct pwm_chip *chip, struct module *owner)
-{
-	int ret;
-
-	ret = __pwmchip_add(chip, owner);
-	if (ret)
-		return ret;
-
-	return devm_add_action_or_reset(dev, devm_pwmchip_remove, chip);
-}
-EXPORT_SYMBOL_GPL(__devm_pwmchip_add);
-
-/**
- * pwm_request_from_chip() - request a PWM device relative to a PWM chip
- * @chip: PWM chip
- * @index: per-chip index of the PWM to request
- * @label: a literal description string of this PWM
- *
- * Returns: A pointer to the PWM device at the given index of the given PWM
- * chip. A negative error code is returned if the index is not valid for the
- * specified PWM chip or if the PWM device cannot be requested.
- */
-struct pwm_device *pwm_request_from_chip(struct pwm_chip *chip,
-					 unsigned int index,
-					 const char *label)
-{
-	struct pwm_device *pwm;
-	int err;
-
-	if (!chip || index >= chip->npwm)
-		return ERR_PTR(-EINVAL);
-
-	mutex_lock(&pwm_lock);
-	pwm = &chip->pwms[index];
-
-	err = pwm_device_request(pwm, label);
-	if (err < 0)
-		pwm = ERR_PTR(err);
-
-	mutex_unlock(&pwm_lock);
-	return pwm;
-}
-EXPORT_SYMBOL_GPL(pwm_request_from_chip);
-
 static void pwm_apply_debug(struct pwm_device *pwm,
 			    const struct pwm_state *state)
 {
@@ -370,18 +71,22 @@
 
 	if (s2.polarity != state->polarity &&
 	    state->duty_cycle < state->period)
-		dev_warn(chip->dev, ".apply ignored .polarity\n");
+		dev_warn(pwmchip_parent(chip), ".apply ignored .polarity\n");
 
-	if (state->enabled &&
+	if (state->enabled && s2.enabled &&
 	    last->polarity == state->polarity &&
 	    last->period > s2.period &&
 	    last->period <= state->period)
-		dev_warn(chip->dev,
+		dev_warn(pwmchip_parent(chip),
 			 ".apply didn't pick the best available period (requested: %llu, applied: %llu, possible: %llu)\n",
 			 state->period, s2.period, last->period);
 
-	if (state->enabled && state->period < s2.period)
-		dev_warn(chip->dev,
+	/*
+	 * Rounding period up is fine only if duty_cycle is 0 then, because a
+	 * flat line doesn't have a characteristic period.
+	 */
+	if (state->enabled && s2.enabled && state->period < s2.period && s2.duty_cycle)
+		dev_warn(pwmchip_parent(chip),
 			 ".apply is supposed to round down period (requested: %llu, applied: %llu)\n",
 			 state->period, s2.period);
 
@@ -390,20 +95,20 @@
 	    last->period == s2.period &&
 	    last->duty_cycle > s2.duty_cycle &&
 	    last->duty_cycle <= state->duty_cycle)
-		dev_warn(chip->dev,
+		dev_warn(pwmchip_parent(chip),
 			 ".apply didn't pick the best available duty cycle (requested: %llu/%llu, applied: %llu/%llu, possible: %llu/%llu)\n",
 			 state->duty_cycle, state->period,
 			 s2.duty_cycle, s2.period,
 			 last->duty_cycle, last->period);
 
-	if (state->enabled && state->duty_cycle < s2.duty_cycle)
-		dev_warn(chip->dev,
+	if (state->enabled && s2.enabled && state->duty_cycle < s2.duty_cycle)
+		dev_warn(pwmchip_parent(chip),
 			 ".apply is supposed to round down duty_cycle (requested: %llu/%llu, applied: %llu/%llu)\n",
 			 state->duty_cycle, state->period,
 			 s2.duty_cycle, s2.period);
 
 	if (!state->enabled && s2.enabled && s2.duty_cycle > 0)
-		dev_warn(chip->dev,
+		dev_warn(pwmchip_parent(chip),
 			 "requested disabled, but yielded enabled with duty > 0\n");
 
 	/* reapply the state that the driver reported being configured. */
@@ -411,7 +116,7 @@
 	trace_pwm_apply(pwm, &s1, err);
 	if (err) {
 		*last = s1;
-		dev_err(chip->dev, "failed to reapply current setting\n");
+		dev_err(pwmchip_parent(chip), "failed to reapply current setting\n");
 		return;
 	}
 
@@ -426,7 +131,7 @@
 	    s1.polarity != last->polarity ||
 	    (s1.enabled && s1.period != last->period) ||
 	    (s1.enabled && s1.duty_cycle != last->duty_cycle)) {
-		dev_err(chip->dev,
+		dev_err(pwmchip_parent(chip),
 			".apply is not idempotent (ena=%d pol=%d %llu/%llu) -> (ena=%d pol=%d %llu/%llu)\n",
 			s1.enabled, s1.polarity, s1.duty_cycle, s1.period,
 			last->enabled, last->polarity, last->duty_cycle,
@@ -524,33 +229,6 @@
 EXPORT_SYMBOL_GPL(pwm_apply_atomic);
 
 /**
- * pwm_capture() - capture and report a PWM signal
- * @pwm: PWM device
- * @result: structure to fill with capture result
- * @timeout: time to wait, in milliseconds, before giving up on capture
- *
- * Returns: 0 on success or a negative error code on failure.
- */
-int pwm_capture(struct pwm_device *pwm, struct pwm_capture *result,
-		unsigned long timeout)
-{
-	int err;
-
-	if (!pwm || !pwm->chip->ops)
-		return -EINVAL;
-
-	if (!pwm->chip->ops->capture)
-		return -ENOSYS;
-
-	mutex_lock(&pwm_lock);
-	err = pwm->chip->ops->capture(pwm->chip, pwm, result, timeout);
-	mutex_unlock(&pwm_lock);
-
-	return err;
-}
-EXPORT_SYMBOL_GPL(pwm_capture);
-
-/**
  * pwm_adjust_config() - adjust the current PWM config to the PWM arguments
  * @pwm: PWM device
  *
@@ -606,24 +284,309 @@
 }
 EXPORT_SYMBOL_GPL(pwm_adjust_config);
 
-static struct pwm_chip *fwnode_to_pwmchip(struct fwnode_handle *fwnode)
+/**
+ * pwm_capture() - capture and report a PWM signal
+ * @pwm: PWM device
+ * @result: structure to fill with capture result
+ * @timeout: time to wait, in milliseconds, before giving up on capture
+ *
+ * Returns: 0 on success or a negative error code on failure.
+ */
+int pwm_capture(struct pwm_device *pwm, struct pwm_capture *result,
+		unsigned long timeout)
+{
+	int err;
+
+	if (!pwm || !pwm->chip->ops)
+		return -EINVAL;
+
+	if (!pwm->chip->ops->capture)
+		return -ENOSYS;
+
+	mutex_lock(&pwm_lock);
+	err = pwm->chip->ops->capture(pwm->chip, pwm, result, timeout);
+	mutex_unlock(&pwm_lock);
+
+	return err;
+}
+EXPORT_SYMBOL_GPL(pwm_capture);
+
+static struct pwm_chip *pwmchip_find_by_name(const char *name)
 {
 	struct pwm_chip *chip;
 	unsigned long id, tmp;
 
+	if (!name)
+		return NULL;
+
 	mutex_lock(&pwm_lock);
 
-	idr_for_each_entry_ul(&pwm_chips, chip, tmp, id)
-		if (chip->dev && device_match_fwnode(chip->dev, fwnode)) {
+	idr_for_each_entry_ul(&pwm_chips, chip, tmp, id) {
+		const char *chip_name = dev_name(pwmchip_parent(chip));
+
+		if (chip_name && strcmp(chip_name, name) == 0) {
 			mutex_unlock(&pwm_lock);
 			return chip;
 		}
+	}
 
 	mutex_unlock(&pwm_lock);
 
-	return ERR_PTR(-EPROBE_DEFER);
+	return NULL;
+}
+
+static int pwm_device_request(struct pwm_device *pwm, const char *label)
+{
+	int err;
+	struct pwm_chip *chip = pwm->chip;
+	const struct pwm_ops *ops = chip->ops;
+
+	if (test_bit(PWMF_REQUESTED, &pwm->flags))
+		return -EBUSY;
+
+	if (!try_module_get(chip->owner))
+		return -ENODEV;
+
+	if (ops->request) {
+		err = ops->request(chip, pwm);
+		if (err) {
+			module_put(chip->owner);
+			return err;
+		}
+	}
+
+	if (ops->get_state) {
+		/*
+		 * Zero-initialize state because most drivers are unaware of
+		 * .usage_power. The other members of state are supposed to be
+		 * set by lowlevel drivers. We still initialize the whole
+		 * structure for simplicity even though this might paper over
+		 * faulty implementations of .get_state().
+		 */
+		struct pwm_state state = { 0, };
+
+		err = ops->get_state(chip, pwm, &state);
+		trace_pwm_get(pwm, &state, err);
+
+		if (!err)
+			pwm->state = state;
+
+		if (IS_ENABLED(CONFIG_PWM_DEBUG))
+			pwm->last = pwm->state;
+	}
+
+	set_bit(PWMF_REQUESTED, &pwm->flags);
+	pwm->label = label;
+
+	return 0;
 }
 
+/**
+ * pwm_request_from_chip() - request a PWM device relative to a PWM chip
+ * @chip: PWM chip
+ * @index: per-chip index of the PWM to request
+ * @label: a literal description string of this PWM
+ *
+ * Returns: A pointer to the PWM device at the given index of the given PWM
+ * chip. A negative error code is returned if the index is not valid for the
+ * specified PWM chip or if the PWM device cannot be requested.
+ */
+struct pwm_device *pwm_request_from_chip(struct pwm_chip *chip,
+					 unsigned int index,
+					 const char *label)
+{
+	struct pwm_device *pwm;
+	int err;
+
+	if (!chip || index >= chip->npwm)
+		return ERR_PTR(-EINVAL);
+
+	mutex_lock(&pwm_lock);
+	pwm = &chip->pwms[index];
+
+	err = pwm_device_request(pwm, label);
+	if (err < 0)
+		pwm = ERR_PTR(err);
+
+	mutex_unlock(&pwm_lock);
+	return pwm;
+}
+EXPORT_SYMBOL_GPL(pwm_request_from_chip);
+
+
+struct pwm_device *
+of_pwm_xlate_with_flags(struct pwm_chip *chip, const struct of_phandle_args *args)
+{
+	struct pwm_device *pwm;
+
+	/* period in the second cell and flags in the third cell are optional */
+	if (args->args_count < 1)
+		return ERR_PTR(-EINVAL);
+
+	pwm = pwm_request_from_chip(chip, args->args[0], NULL);
+	if (IS_ERR(pwm))
+		return pwm;
+
+	if (args->args_count > 1)
+		pwm->args.period = args->args[1];
+
+	pwm->args.polarity = PWM_POLARITY_NORMAL;
+	if (args->args_count > 2 && args->args[2] & PWM_POLARITY_INVERTED)
+		pwm->args.polarity = PWM_POLARITY_INVERSED;
+
+	return pwm;
+}
+EXPORT_SYMBOL_GPL(of_pwm_xlate_with_flags);
+
+struct pwm_device *
+of_pwm_single_xlate(struct pwm_chip *chip, const struct of_phandle_args *args)
+{
+	struct pwm_device *pwm;
+
+	pwm = pwm_request_from_chip(chip, 0, NULL);
+	if (IS_ERR(pwm))
+		return pwm;
+
+	if (args->args_count > 0)
+		pwm->args.period = args->args[0];
+
+	pwm->args.polarity = PWM_POLARITY_NORMAL;
+	if (args->args_count > 1 && args->args[1] & PWM_POLARITY_INVERTED)
+		pwm->args.polarity = PWM_POLARITY_INVERSED;
+
+	return pwm;
+}
+EXPORT_SYMBOL_GPL(of_pwm_single_xlate);
+
+static void of_pwmchip_add(struct pwm_chip *chip)
+{
+	if (!pwmchip_parent(chip) || !pwmchip_parent(chip)->of_node)
+		return;
+
+	if (!chip->of_xlate)
+		chip->of_xlate = of_pwm_xlate_with_flags;
+
+	of_node_get(pwmchip_parent(chip)->of_node);
+}
+
+static void of_pwmchip_remove(struct pwm_chip *chip)
+{
+	if (pwmchip_parent(chip))
+		of_node_put(pwmchip_parent(chip)->of_node);
+}
+
+static bool pwm_ops_check(const struct pwm_chip *chip)
+{
+	const struct pwm_ops *ops = chip->ops;
+
+	if (!ops->apply)
+		return false;
+
+	if (IS_ENABLED(CONFIG_PWM_DEBUG) && !ops->get_state)
+		dev_warn(pwmchip_parent(chip),
+			 "Please implement the .get_state() callback\n");
+
+	return true;
+}
+
+/**
+ * __pwmchip_add() - register a new PWM chip
+ * @chip: the PWM chip to add
+ * @owner: reference to the module providing the chip.
+ *
+ * Register a new PWM chip. @owner is supposed to be THIS_MODULE, use the
+ * pwmchip_add wrapper to do this right.
+ *
+ * Returns: 0 on success or a negative error code on failure.
+ */
+int __pwmchip_add(struct pwm_chip *chip, struct module *owner)
+{
+	unsigned int i;
+	int ret;
+
+	if (!chip || !pwmchip_parent(chip) || !chip->ops || !chip->npwm)
+		return -EINVAL;
+
+	if (!pwm_ops_check(chip))
+		return -EINVAL;
+
+	chip->owner = owner;
+
+	chip->pwms = kcalloc(chip->npwm, sizeof(*chip->pwms), GFP_KERNEL);
+	if (!chip->pwms)
+		return -ENOMEM;
+
+	mutex_lock(&pwm_lock);
+
+	ret = idr_alloc(&pwm_chips, chip, 0, 0, GFP_KERNEL);
+	if (ret < 0) {
+		mutex_unlock(&pwm_lock);
+		kfree(chip->pwms);
+		return ret;
+	}
+
+	chip->id = ret;
+
+	for (i = 0; i < chip->npwm; i++) {
+		struct pwm_device *pwm = &chip->pwms[i];
+
+		pwm->chip = chip;
+		pwm->hwpwm = i;
+	}
+
+	mutex_unlock(&pwm_lock);
+
+	if (IS_ENABLED(CONFIG_OF))
+		of_pwmchip_add(chip);
+
+	pwmchip_sysfs_export(chip);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(__pwmchip_add);
+
+/**
+ * pwmchip_remove() - remove a PWM chip
+ * @chip: the PWM chip to remove
+ *
+ * Removes a PWM chip.
+ */
+void pwmchip_remove(struct pwm_chip *chip)
+{
+	pwmchip_sysfs_unexport(chip);
+
+	if (IS_ENABLED(CONFIG_OF))
+		of_pwmchip_remove(chip);
+
+	mutex_lock(&pwm_lock);
+
+	idr_remove(&pwm_chips, chip->id);
+
+	mutex_unlock(&pwm_lock);
+
+	kfree(chip->pwms);
+}
+EXPORT_SYMBOL_GPL(pwmchip_remove);
+
+static void devm_pwmchip_remove(void *data)
+{
+	struct pwm_chip *chip = data;
+
+	pwmchip_remove(chip);
+}
+
+int __devm_pwmchip_add(struct device *dev, struct pwm_chip *chip, struct module *owner)
+{
+	int ret;
+
+	ret = __pwmchip_add(chip, owner);
+	if (ret)
+		return ret;
+
+	return devm_add_action_or_reset(dev, devm_pwmchip_remove, chip);
+}
+EXPORT_SYMBOL_GPL(__devm_pwmchip_add);
+
 static struct device_link *pwm_device_link_add(struct device *dev,
 					       struct pwm_device *pwm)
 {
@@ -635,21 +598,39 @@
 		 * impact the PM sequence ordering: the PWM supplier may get
 		 * suspended before the consumer.
 		 */
-		dev_warn(pwm->chip->dev,
+		dev_warn(pwmchip_parent(pwm->chip),
 			 "No consumer device specified to create a link to\n");
 		return NULL;
 	}
 
-	dl = device_link_add(dev, pwm->chip->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
+	dl = device_link_add(dev, pwmchip_parent(pwm->chip), DL_FLAG_AUTOREMOVE_CONSUMER);
 	if (!dl) {
 		dev_err(dev, "failed to create device link to %s\n",
-			dev_name(pwm->chip->dev));
+			dev_name(pwmchip_parent(pwm->chip)));
 		return ERR_PTR(-EINVAL);
 	}
 
 	return dl;
 }
 
+static struct pwm_chip *fwnode_to_pwmchip(struct fwnode_handle *fwnode)
+{
+	struct pwm_chip *chip;
+	unsigned long id, tmp;
+
+	mutex_lock(&pwm_lock);
+
+	idr_for_each_entry_ul(&pwm_chips, chip, tmp, id)
+		if (pwmchip_parent(chip) && device_match_fwnode(pwmchip_parent(chip), fwnode)) {
+			mutex_unlock(&pwm_lock);
+			return chip;
+		}
+
+	mutex_unlock(&pwm_lock);
+
+	return ERR_PTR(-EPROBE_DEFER);
+}
+
 /**
  * of_pwm_get() - request a PWM via the PWM framework
  * @dev: device for PWM consumer
@@ -784,6 +765,9 @@
 	return pwm;
 }
 
+static DEFINE_MUTEX(pwm_lookup_lock);
+static LIST_HEAD(pwm_lookup_list);
+
 /**
  * pwm_add_table() - register PWM device consumers
  * @table: array of consumers to register
@@ -1105,8 +1089,8 @@
 
 	seq_printf(s, "%s%d: %s/%s, %d PWM device%s\n",
 		   (char *)s->private, chip->id,
-		   chip->dev->bus ? chip->dev->bus->name : "no-bus",
-		   dev_name(chip->dev), chip->npwm,
+		   pwmchip_parent(chip)->bus ? pwmchip_parent(chip)->bus->name : "no-bus",
+		   dev_name(pwmchip_parent(chip)), chip->npwm,
 		   (chip->npwm != 1) ? "s" : "");
 
 	pwm_dbg_show(chip, s);
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-atmel-hlcdc.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-atmel-hlcdc.c
@@ -185,7 +185,7 @@
 	struct atmel_hlcdc_pwm *atmel = dev_get_drvdata(dev);
 
 	/* Keep the periph clock enabled if the PWM is still running. */
-	if (pwm_is_enabled(&atmel->chip.pwms[0]))
+	if (!pwm_is_enabled(&atmel->chip.pwms[0]))
 		clk_disable_unprepare(atmel->hlcdc->periph_clk);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-atmel-tcb.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-atmel-tcb.c
@@ -82,7 +82,8 @@
 	tcbpwm->period = 0;
 	tcbpwm->div = 0;
 
-	spin_lock(&tcbpwmc->lock);
+	guard(spinlock)(&tcbpwmc->lock);
+
 	regmap_read(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), &cmr);
 	/*
 	 * Get init config from Timer Counter registers if
@@ -108,7 +109,6 @@
 
 	cmr |= ATMEL_TC_WAVE | ATMEL_TC_WAVESEL_UP_AUTO | ATMEL_TC_EEVT_XC0;
 	regmap_write(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), cmr);
-	spin_unlock(&tcbpwmc->lock);
 
 	return 0;
 }
@@ -138,7 +138,6 @@
 	if (tcbpwm->duty == 0)
 		polarity = !polarity;
 
-	spin_lock(&tcbpwmc->lock);
 	regmap_read(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), &cmr);
 
 	/* flush old setting and set the new one */
@@ -173,8 +172,6 @@
 			     ATMEL_TC_SWTRG);
 		tcbpwmc->bkup.enabled = 0;
 	}
-
-	spin_unlock(&tcbpwmc->lock);
 }
 
 static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm,
@@ -195,7 +192,6 @@
 	if (tcbpwm->duty == 0)
 		polarity = !polarity;
 
-	spin_lock(&tcbpwmc->lock);
 	regmap_read(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), &cmr);
 
 	/* flush old setting and set the new one */
@@ -257,7 +253,6 @@
 	regmap_write(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CCR),
 		     ATMEL_TC_SWTRG | ATMEL_TC_CLKEN);
 	tcbpwmc->bkup.enabled = 1;
-	spin_unlock(&tcbpwmc->lock);
 	return 0;
 }
 
@@ -342,9 +337,12 @@
 static int atmel_tcb_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 			       const struct pwm_state *state)
 {
+	struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip);
 	int duty_cycle, period;
 	int ret;
 
+	guard(spinlock)(&tcbpwmc->lock);
+
 	if (!state->enabled) {
 		atmel_tcb_pwm_disable(chip, pwm, state->polarity);
 		return 0;
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-clps711x.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-clps711x.c
@@ -103,7 +103,6 @@
 	priv->chip.dev = &pdev->dev;
 	priv->chip.npwm = 2;
 	priv->chip.of_xlate = clps711x_pwm_xlate;
-	priv->chip.of_pwm_n_cells = 1;
 
 	spin_lock_init(&priv->lock);
 
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-cros-ec.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-cros-ec.c
@@ -279,7 +279,6 @@
 	chip->dev = dev;
 	chip->ops = &cros_ec_pwm_ops;
 	chip->of_xlate = cros_ec_pwm_xlate;
-	chip->of_pwm_n_cells = 1;
 
 	if (ec_pwm->use_pwm_type) {
 		chip->npwm = CROS_EC_PWM_DT_COUNT;
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-dwc.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-dwc.c
@@ -120,7 +120,7 @@
 	.remove = dwc_pwm_remove,
 	.id_table = dwc_pwm_id_table,
 	.driver = {
-		.pm = pm_ptr(&dwc_pwm_pm_ops),
+		.pm = pm_sleep_ptr(&dwc_pwm_pm_ops),
 	},
 };
 
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-img.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-img.c
@@ -284,9 +284,9 @@
 		return PTR_ERR(imgchip->sys_clk);
 	}
 
-	imgchip->pwm_clk = devm_clk_get(&pdev->dev, "imgchip");
+	imgchip->pwm_clk = devm_clk_get(&pdev->dev, "pwm");
 	if (IS_ERR(imgchip->pwm_clk)) {
-		dev_err(&pdev->dev, "failed to get imgchip clock\n");
+		dev_err(&pdev->dev, "failed to get pwm clock\n");
 		return PTR_ERR(imgchip->pwm_clk);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-imx-tpm.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-imx-tpm.c
@@ -106,7 +106,9 @@
 	p->prescale = prescale;
 
 	period_count = (clock_unit + ((1 << prescale) >> 1)) >> prescale;
-	p->mod = period_count;
+	if (period_count == 0)
+		return -EINVAL;
+	p->mod = period_count - 1;
 
 	/* calculate real period HW can support */
 	tmp = (u64)period_count << prescale;
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-imx27.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-imx27.c
@@ -26,6 +26,7 @@
 #define MX3_PWMSR			0x04    /* PWM Status Register */
 #define MX3_PWMSAR			0x0C    /* PWM Sample Register */
 #define MX3_PWMPR			0x10    /* PWM Period Register */
+#define MX3_PWMCNR			0x14    /* PWM Counter Register */
 
 #define MX3_PWMCR_FWM			GENMASK(27, 26)
 #define MX3_PWMCR_STOPEN		BIT(25)
@@ -217,11 +218,13 @@
 static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 			   const struct pwm_state *state)
 {
-	unsigned long period_cycles, duty_cycles, prescale;
+	unsigned long period_cycles, duty_cycles, prescale, period_us, tmp;
 	struct pwm_imx27_chip *imx = to_pwm_imx27_chip(chip);
 	struct pwm_state cstate;
 	unsigned long long c;
 	unsigned long long clkrate;
+	unsigned long flags;
+	int val;
 	int ret;
 	u32 cr;
 
@@ -264,7 +267,98 @@
 		pwm_imx27_sw_reset(chip);
 	}
 
-	writel(duty_cycles, imx->mmio_base + MX3_PWMSAR);
+	val = readl(imx->mmio_base + MX3_PWMPR);
+	val = val >= MX3_PWMPR_MAX ? MX3_PWMPR_MAX : val;
+	cr = readl(imx->mmio_base + MX3_PWMCR);
+	tmp = NSEC_PER_SEC * (u64)(val + 2) * MX3_PWMCR_PRESCALER_GET(cr);
+	tmp = DIV_ROUND_UP_ULL(tmp, clkrate);
+	period_us = DIV_ROUND_UP_ULL(tmp, 1000);
+
+	/*
+	 * ERR051198:
+	 * PWM: PWM output may not function correctly if the FIFO is empty when
+	 * a new SAR value is programmed
+	 *
+	 * Description:
+	 * When the PWM FIFO is empty, a new value programmed to the PWM Sample
+	 * register (PWM_PWMSAR) will be directly applied even if the current
+	 * timer period has not expired.
+	 *
+	 * If the new SAMPLE value programmed in the PWM_PWMSAR register is
+	 * less than the previous value, and the PWM counter register
+	 * (PWM_PWMCNR) that contains the current COUNT value is greater than
+	 * the new programmed SAMPLE value, the current period will not flip
+	 * the level. This may result in an output pulse with a duty cycle of
+	 * 100%.
+	 *
+	 * Consider a change from
+	 *     ________
+	 *    /        \______/
+	 *    ^      *        ^
+	 * to
+	 *     ____
+	 *    /    \__________/
+	 *    ^               ^
+	 * At the time marked by *, the new write value will be directly applied
+	 * to SAR even the current period is not over if FIFO is empty.
+	 *
+	 *     ________        ____________________
+	 *    /        \______/                    \__________/
+	 *    ^               ^      *        ^               ^
+	 *    |<-- old SAR -->|               |<-- new SAR -->|
+	 *
+	 * That is the output is active for a whole period.
+	 *
+	 * Workaround:
+	 * Check new SAR less than old SAR and current counter is in errata
+	 * windows, write extra old SAR into FIFO and new SAR will effect at
+	 * next period.
+	 *
+	 * Sometime period is quite long, such as over 1 second. If add old SAR
+	 * into FIFO unconditional, new SAR have to wait for next period. It
+	 * may be too long.
+	 *
+	 * Turn off the interrupt to ensure that not IRQ and schedule happen
+	 * during above operations. If any irq and schedule happen, counter
+	 * in PWM will be out of data and take wrong action.
+	 *
+	 * Add a safety margin 1.5us because it needs some time to complete
+	 * IO write.
+	 *
+	 * Use writel_relaxed() to minimize the interval between two writes to
+	 * the SAR register to increase the fastest PWM frequency supported.
+	 *
+	 * When the PWM period is longer than 2us(or <500kHz), this workaround
+	 * can solve this problem. No software workaround is available if PWM
+	 * period is shorter than IO write. Just try best to fill old data
+	 * into FIFO.
+	 */
+	c = clkrate * 1500;
+	do_div(c, NSEC_PER_SEC);
+
+	local_irq_save(flags);
+	val = FIELD_GET(MX3_PWMSR_FIFOAV, readl_relaxed(imx->mmio_base + MX3_PWMSR));
+
+	if (duty_cycles < imx->duty_cycle && (cr & MX3_PWMCR_EN)) {
+		if (period_us < 2) { /* 2us = 500 kHz */
+			/* Best effort attempt to fix up >500 kHz case */
+			udelay(3 * period_us);
+			writel_relaxed(imx->duty_cycle, imx->mmio_base + MX3_PWMSAR);
+			writel_relaxed(imx->duty_cycle, imx->mmio_base + MX3_PWMSAR);
+		} else if (val < MX3_PWMSR_FIFOAV_2WORDS) {
+			val = readl_relaxed(imx->mmio_base + MX3_PWMCNR);
+			/*
+			 * If counter is close to period, controller may roll over when
+			 * next IO write.
+			 */
+			if ((val + c >= duty_cycles && val < imx->duty_cycle) ||
+			    val + c >= period_cycles)
+				writel_relaxed(imx->duty_cycle, imx->mmio_base + MX3_PWMSAR);
+		}
+	}
+	writel_relaxed(duty_cycles, imx->mmio_base + MX3_PWMSAR);
+	local_irq_restore(flags);
+
 	writel(period_cycles, imx->mmio_base + MX3_PWMPR);
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-meson.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-meson.c
@@ -122,7 +122,7 @@
 {
 	struct meson_pwm *meson = to_meson_pwm(chip);
 	struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm];
-	struct device *dev = chip->dev;
+	struct device *dev = pwmchip_parent(chip);
 	int err;
 
 	err = clk_prepare_enable(channel->clk);
@@ -143,12 +143,13 @@
 	clk_disable_unprepare(channel->clk);
 }
 
-static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm,
+static int meson_pwm_calc(struct pwm_chip *chip, struct pwm_device *pwm,
 			  const struct pwm_state *state)
 {
+	struct meson_pwm *meson = to_meson_pwm(chip);
 	struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm];
 	unsigned int cnt, duty_cnt;
-	unsigned long fin_freq;
+	long fin_freq;
 	u64 duty, period, freq;
 
 	duty = state->duty_cycle;
@@ -168,20 +169,21 @@
 		freq = ULONG_MAX;
 
 	fin_freq = clk_round_rate(channel->clk, freq);
-	if (fin_freq == 0) {
-		dev_err(meson->chip.dev, "invalid source clock frequency\n");
-		return -EINVAL;
+	if (fin_freq <= 0) {
+		dev_err(pwmchip_parent(chip),
+			"invalid source clock frequency %llu\n", freq);
+		return fin_freq ? fin_freq : -EINVAL;
 	}
 
-	dev_dbg(meson->chip.dev, "fin_freq: %lu Hz\n", fin_freq);
+	dev_dbg(pwmchip_parent(chip), "fin_freq: %ld Hz\n", fin_freq);
 
-	cnt = div_u64(fin_freq * period, NSEC_PER_SEC);
+	cnt = mul_u64_u64_div_u64(fin_freq, period, NSEC_PER_SEC);
 	if (cnt > 0xffff) {
-		dev_err(meson->chip.dev, "unable to get period cnt\n");
+		dev_err(pwmchip_parent(chip), "unable to get period cnt\n");
 		return -EINVAL;
 	}
 
-	dev_dbg(meson->chip.dev, "period=%llu cnt=%u\n", period, cnt);
+	dev_dbg(pwmchip_parent(chip), "period=%llu cnt=%u\n", period, cnt);
 
 	if (duty == period) {
 		channel->hi = cnt;
@@ -190,9 +192,9 @@
 		channel->hi = 0;
 		channel->lo = cnt;
 	} else {
-		duty_cnt = div_u64(fin_freq * duty, NSEC_PER_SEC);
+		duty_cnt = mul_u64_u64_div_u64(fin_freq, duty, NSEC_PER_SEC);
 
-		dev_dbg(meson->chip.dev, "duty=%llu duty_cnt=%u\n", duty, duty_cnt);
+		dev_dbg(pwmchip_parent(chip), "duty=%llu duty_cnt=%u\n", duty, duty_cnt);
 
 		channel->hi = duty_cnt;
 		channel->lo = cnt - duty_cnt;
@@ -203,8 +205,9 @@
 	return 0;
 }
 
-static void meson_pwm_enable(struct meson_pwm *meson, struct pwm_device *pwm)
+static void meson_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
 {
+	struct meson_pwm *meson = to_meson_pwm(chip);
 	struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm];
 	struct meson_pwm_channel_data *channel_data;
 	unsigned long flags;
@@ -215,7 +218,7 @@
 
 	err = clk_set_rate(channel->clk, channel->rate);
 	if (err)
-		dev_err(meson->chip.dev, "setting clock rate failed\n");
+		dev_err(pwmchip_parent(chip), "setting clock rate failed\n");
 
 	spin_lock_irqsave(&meson->lock, flags);
 
@@ -230,8 +233,9 @@
 	spin_unlock_irqrestore(&meson->lock, flags);
 }
 
-static void meson_pwm_disable(struct meson_pwm *meson, struct pwm_device *pwm)
+static void meson_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
 {
+	struct meson_pwm *meson = to_meson_pwm(chip);
 	unsigned long flags;
 	u32 value;
 
@@ -269,16 +273,16 @@
 			channel->hi = ~0;
 			channel->lo = 0;
 
-			meson_pwm_enable(meson, pwm);
+			meson_pwm_enable(chip, pwm);
 		} else {
-			meson_pwm_disable(meson, pwm);
+			meson_pwm_disable(chip, pwm);
 		}
 	} else {
-		err = meson_pwm_calc(meson, pwm, state);
+		err = meson_pwm_calc(chip, pwm, state);
 		if (err < 0)
 			return err;
 
-		meson_pwm_enable(meson, pwm);
+		meson_pwm_enable(chip, pwm);
 	}
 
 	return 0;
@@ -432,10 +436,11 @@
 };
 MODULE_DEVICE_TABLE(of, meson_pwm_matches);
 
-static int meson_pwm_init_channels(struct meson_pwm *meson)
+static int meson_pwm_init_channels(struct pwm_chip *chip)
 {
+	struct meson_pwm *meson = to_meson_pwm(chip);
 	struct clk_parent_data mux_parent_data[MESON_MAX_MUX_PARENTS] = {};
-	struct device *dev = meson->chip.dev;
+	struct device *dev = pwmchip_parent(chip);
 	unsigned int i;
 	char name[255];
 	int err;
@@ -445,7 +450,7 @@
 		mux_parent_data[i].name = meson->data->parent_names[i];
 	}
 
-	for (i = 0; i < meson->chip.npwm; i++) {
+	for (i = 0; i < chip->npwm; i++) {
 		struct meson_pwm_channel *channel = &meson->channels[i];
 		struct clk_parent_data div_parent = {}, gate_parent = {};
 		struct clk_init_data init = {};
@@ -543,7 +548,7 @@
 
 	meson->data = of_device_get_match_data(&pdev->dev);
 
-	err = meson_pwm_init_channels(meson);
+	err = meson_pwm_init_channels(&meson->chip);
 	if (err < 0)
 		return err;
 
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-pxa.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-pxa.c
@@ -180,10 +180,8 @@
 	pc->chip.ops = &pxa_pwm_ops;
 	pc->chip.npwm = (id->driver_data & HAS_SECONDARY_PWM) ? 2 : 1;
 
-	if (IS_ENABLED(CONFIG_OF)) {
+	if (IS_ENABLED(CONFIG_OF))
 		pc->chip.of_xlate = of_pwm_single_xlate;
-		pc->chip.of_pwm_n_cells = 1;
-	}
 
 	pc->mmio_base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(pc->mmio_base))
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-sti.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-sti.c
@@ -395,8 +395,17 @@
 static int sti_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 			 const struct pwm_state *state)
 {
+	struct sti_pwm_chip *pc = to_sti_pwmchip(chip);
+	struct sti_pwm_compat_data *cdata = pc->cdata;
+	struct device *dev = pc->dev;
 	int err;
 
+	if (pwm->hwpwm >= cdata->pwm_num_devs) {
+		dev_err(dev, "device %u is not valid for pwm mode\n",
+			pwm->hwpwm);
+		return -EINVAL;
+	}
+
 	if (state->polarity != PWM_POLARITY_NORMAL)
 		return -EINVAL;
 
@@ -561,6 +570,7 @@
 {
 	struct device *dev = &pdev->dev;
 	struct sti_pwm_compat_data *cdata;
+	struct pwm_chip *chip;
 	struct sti_pwm_chip *pc;
 	unsigned int i;
 	int irq, ret;
@@ -568,6 +578,7 @@
 	pc = devm_kzalloc(dev, sizeof(*pc), GFP_KERNEL);
 	if (!pc)
 		return -ENOMEM;
+	chip = &pc->chip;
 
 	cdata = devm_kzalloc(dev, sizeof(*cdata), GFP_KERNEL);
 	if (!cdata)
@@ -613,40 +624,28 @@
 		return ret;
 
 	if (cdata->pwm_num_devs) {
-		pc->pwm_clk = of_clk_get_by_name(dev->of_node, "pwm");
+		pc->pwm_clk = devm_clk_get_prepared(dev, "pwm");
 		if (IS_ERR(pc->pwm_clk)) {
 			dev_err(dev, "failed to get PWM clock\n");
 			return PTR_ERR(pc->pwm_clk);
 		}
-
-		ret = clk_prepare(pc->pwm_clk);
-		if (ret) {
-			dev_err(dev, "failed to prepare clock\n");
-			return ret;
-		}
 	}
 
 	if (cdata->cpt_num_devs) {
-		pc->cpt_clk = of_clk_get_by_name(dev->of_node, "capture");
+		pc->cpt_clk = devm_clk_get_prepared(dev, "capture");
 		if (IS_ERR(pc->cpt_clk)) {
 			dev_err(dev, "failed to get PWM capture clock\n");
 			return PTR_ERR(pc->cpt_clk);
 		}
 
-		ret = clk_prepare(pc->cpt_clk);
-		if (ret) {
-			dev_err(dev, "failed to prepare clock\n");
-			return ret;
-		}
-
 		cdata->ddata = devm_kzalloc(dev, cdata->cpt_num_devs * sizeof(*cdata->ddata), GFP_KERNEL);
 		if (!cdata->ddata)
 			return -ENOMEM;
 	}
 
-	pc->chip.dev = dev;
-	pc->chip.ops = &sti_pwm_ops;
-	pc->chip.npwm = pc->cdata->pwm_num_devs;
+	chip->dev = dev;
+	chip->ops = &sti_pwm_ops;
+	chip->npwm = max(cdata->pwm_num_devs, cdata->cpt_num_devs);
 
 	for (i = 0; i < cdata->cpt_num_devs; i++) {
 		struct sti_cpt_ddata *ddata = &cdata->ddata[i];
@@ -655,26 +654,7 @@
 		mutex_init(&ddata->lock);
 	}
 
-	ret = pwmchip_add(&pc->chip);
-	if (ret < 0) {
-		clk_unprepare(pc->pwm_clk);
-		clk_unprepare(pc->cpt_clk);
-		return ret;
-	}
-
-	platform_set_drvdata(pdev, pc);
-
-	return 0;
-}
-
-static void sti_pwm_remove(struct platform_device *pdev)
-{
-	struct sti_pwm_chip *pc = platform_get_drvdata(pdev);
-
-	pwmchip_remove(&pc->chip);
-
-	clk_unprepare(pc->pwm_clk);
-	clk_unprepare(pc->cpt_clk);
+	return devm_pwmchip_add(dev, chip);
 }
 
 static const struct of_device_id sti_pwm_of_match[] = {
@@ -689,7 +669,6 @@
 		.of_match_table = sti_pwm_of_match,
 	},
 	.probe = sti_pwm_probe,
-	.remove_new = sti_pwm_remove,
 };
 module_platform_driver(sti_pwm_driver);
 
--- linux-qcom-6.8.0.orig/drivers/pwm/pwm-stm32.c
+++ linux-qcom-6.8.0/drivers/pwm/pwm-stm32.c
@@ -1,5 +1,5 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
+	// SPDX-License-Identifier: GPL-2.0
+	/*
  * Copyright (C) STMicroelectronics 2016
  *
  * Author: Gerald Baeza <gerald.baeza@st.com>
@@ -309,27 +309,39 @@
 }
 
 static int stm32_pwm_config(struct stm32_pwm *priv, unsigned int ch,
-			    int duty_ns, int period_ns)
+			    u64 duty_ns, u64 period_ns)
 {
-	unsigned long long prd, div, dty;
-	unsigned int prescaler = 0;
+	unsigned long long prd, dty;
+	unsigned long long prescaler;
 	u32 ccmr, mask, shift;
 
-	/* Period and prescaler values depends on clock rate */
-	div = (unsigned long long)clk_get_rate(priv->clk) * period_ns;
-
-	do_div(div, NSEC_PER_SEC);
-	prd = div;
-
-	while (div > priv->max_arr) {
-		prescaler++;
-		div = prd;
-		do_div(div, prescaler + 1);
-	}
+	/*
+	 * .probe() asserted that clk_get_rate() is not bigger than 1 GHz, so
+	 * the calculations here won't overflow.
+	 * First we need to find the minimal value for prescaler such that
+	 *
+	 *        period_ns * clkrate
+	 *   ------------------------------ < max_arr + 1
+	 *   NSEC_PER_SEC * (prescaler + 1)
+	 *
+	 * This equation is equivalent to
+	 *
+	 *        period_ns * clkrate
+	 *   ---------------------------- < prescaler + 1
+	 *   NSEC_PER_SEC * (max_arr + 1)
+	 *
+	 * Using integer division and knowing that the right hand side is
+	 * integer, this is further equivalent to
+	 *
+	 *   (period_ns * clkrate) // (NSEC_PER_SEC * (max_arr + 1)) ≤ prescaler
+	 */
 
-	prd = div;
+	prescaler = mul_u64_u64_div_u64(period_ns, clk_get_rate(priv->clk),
+					(u64)NSEC_PER_SEC * ((u64)priv->max_arr + 1));
 
-	if (prescaler > MAX_TIM_PSC)
+	prd = mul_u64_u64_div_u64(period_ns, clk_get_rate(priv->clk),
+				  (u64)NSEC_PER_SEC * (prescaler + 1));
+	if (!prd)
 		return -EINVAL;
 
 	/*
@@ -351,8 +363,8 @@
 	regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE);
 
 	/* Calculate the duty cycles */
-	dty = prd * duty_ns;
-	do_div(dty, period_ns);
+	dty = mul_u64_u64_div_u64(duty_ns, clk_get_rate(priv->clk),
+				  (u64)NSEC_PER_SEC * (prescaler + 1));
 
 	regmap_write(priv->regmap, TIM_CCR1 + 4 * ch, dty);
 
@@ -438,8 +450,9 @@
 
 	enabled = pwm->state.enabled;
 
-	if (enabled && !state->enabled) {
-		stm32_pwm_disable(priv, pwm->hwpwm);
+	if (!state->enabled) {
+		if (enabled)
+			stm32_pwm_disable(priv, pwm->hwpwm);
 		return 0;
 	}
 
@@ -656,6 +669,19 @@
 	priv->chip.ops = &stm32pwm_ops;
 	priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled);
 
+	ret = devm_clk_rate_exclusive_get(dev, priv->clk);
+	if (ret)
+		return dev_err_probe(dev, ret, "Failed to lock clock\n");
+
+	/*
+	 * With the clk running with not more than 1 GHz the calculations in
+	 * .apply() won't overflow.
+	 */
+	if (clk_get_rate(priv->clk) > 1000000000)
+		return dev_err_probe(dev, -EINVAL, "Clock freq too high (%lu)\n",
+				     clk_get_rate(priv->clk));
+
+
 	/* Initialize clock refcount to number of enabled PWM channels. */
 	for (i = 0; i < num_enabled; i++)
 		clk_enable(priv->clk);
--- linux-qcom-6.8.0.orig/drivers/pwm/sysfs.c
+++ linux-qcom-6.8.0/drivers/pwm/sysfs.c
@@ -509,10 +509,10 @@
 	 * If device_create() fails the pwm_chip is still usable by
 	 * the kernel it's just not exported.
 	 */
-	parent = device_create(&pwm_class, chip->dev, MKDEV(0, 0), chip,
+	parent = device_create(&pwm_class, pwmchip_parent(chip), MKDEV(0, 0), chip,
 			       "pwmchip%d", chip->id);
 	if (IS_ERR(parent)) {
-		dev_warn(chip->dev,
+		dev_warn(pwmchip_parent(chip),
 			 "device_create failed for pwm_chip sysfs export\n");
 	}
 }
--- linux-qcom-6.8.0.orig/drivers/regulator/Kconfig
+++ linux-qcom-6.8.0/drivers/regulator/Kconfig
@@ -382,6 +382,15 @@
 	  This driver supports the voltage domain regulators controlled by the
 	  DB8500 PRCMU
 
+config REGULATOR_DEBUG_CONTROL
+	tristate "Regulator debug control support"
+	depends on DEBUG_FS
+	help
+	  This driver supports debugfs based control of regulators for testing
+	  purposes.  It provides a mechanism to vote on the enable state,
+	  voltage, mode, and load current of regulators that make use of its
+	  interface.  It also extends the monitoring interface for regulators.
+
 config REGULATOR_FAN53555
 	tristate "Fairchild FAN53555 Regulator"
 	depends on I2C
@@ -997,6 +1006,16 @@
 	  Say y here to support the regulators found on the Freescale
 	  PFUZE100/200/3000/3001 PMIC.
 
+config REGULATOR_PROXY_CONSUMER
+	tristate "Boot time regulator proxy consumer support"
+	help
+	  This library provides support for boot time regulator proxy requests.
+	  It can enforce a specified voltage range, set a minimum current,
+	  and/or keep a regulator enabled.  It is needed in circumstances where
+	  reducing one or more of these three quantities will cause hardware to
+	  stop working if performed before the driver managing the hardware has
+	  probed.
+
 config REGULATOR_PV88060
 	tristate "Powerventure Semiconductor PV88060 regulator"
 	depends on I2C
@@ -1027,6 +1046,15 @@
 	  This driver supports PWM controlled voltage regulators. PWM
 	  duty cycle can increase or decrease the voltage.
 
+config REGULATOR_QCOM_PM8008
+	tristate "Qualcomm Technologies, Inc. PM8008 PMIC regulators"
+	depends on MFD_I2C_PMIC
+	help
+	 This driver provides support for the voltage regulators and top-level
+	 chip enablement of Qualcomm Technologies, Inc. PM8008 PMIC chips.
+	 When all seven of the PM8008 LDO regulators are disabled, the PM8008
+	 is put into a low power state.
+
 config REGULATOR_QCOM_REFGEN
 	tristate "Qualcomm REFGEN regulator driver"
 	depends on ARCH_QCOM || COMPILE_TEST
@@ -1683,4 +1711,13 @@
 	  boost regulator and IBB can be used as a negative boost regulator
 	  for LCD display panel.
 
+config REGULATOR_QPNP_LCDB
+        tristate "Qualcomm Technologies, Inc. QPNP LCDB support"
+        depends on SPMI
+        help
+          Supports the LCDB module in the Qualcomm Technologies, Inc.
+          QPNP PMICs. Exposes regulators to control the positive and
+          negative voltage bias for the LCD display panel. It also
+          allows configurability for the various bias-voltage parameters.
+
 endif
--- linux-qcom-6.8.0.orig/drivers/regulator/Makefile
+++ linux-qcom-6.8.0/drivers/regulator/Makefile
@@ -46,6 +46,7 @@
 obj-$(CONFIG_REGULATOR_DA9211) += da9211-regulator.o
 obj-$(CONFIG_REGULATOR_DBX500_PRCMU) += dbx500-prcmu.o
 obj-$(CONFIG_REGULATOR_DB8500_PRCMU) += db8500-prcmu.o
+obj-$(CONFIG_REGULATOR_DEBUG_CONTROL) += debug-regulator.o
 obj-$(CONFIG_REGULATOR_FAN53555) += fan53555.o
 obj-$(CONFIG_REGULATOR_FAN53880) += fan53880.o
 obj-$(CONFIG_REGULATOR_GPIO) += gpio-regulator.o
@@ -112,16 +113,19 @@
 obj-$(CONFIG_REGULATOR_MT6397)	+= mt6397-regulator.o
 obj-$(CONFIG_REGULATOR_MTK_DVFSRC) += mtk-dvfsrc-regulator.o
 obj-$(CONFIG_REGULATOR_QCOM_LABIBB) += qcom-labibb-regulator.o
+obj-$(CONFIG_REGULATOR_QCOM_PM8008) += qcom_pm8008-regulator.o
 obj-$(CONFIG_REGULATOR_QCOM_REFGEN) += qcom-refgen-regulator.o
 obj-$(CONFIG_REGULATOR_QCOM_RPM) += qcom_rpm-regulator.o
 obj-$(CONFIG_REGULATOR_QCOM_RPMH) += qcom-rpmh-regulator.o
 obj-$(CONFIG_REGULATOR_QCOM_SMD_RPM) += qcom_smd-regulator.o
 obj-$(CONFIG_REGULATOR_QCOM_SPMI) += qcom_spmi-regulator.o
 obj-$(CONFIG_REGULATOR_QCOM_USB_VBUS) += qcom_usb_vbus-regulator.o
+obj-$(CONFIG_REGULATOR_QPNP_LCDB) += qpnp-lcdb-regulator.o
 obj-$(CONFIG_REGULATOR_PALMAS) += palmas-regulator.o
 obj-$(CONFIG_REGULATOR_PCA9450) += pca9450-regulator.o
 obj-$(CONFIG_REGULATOR_PF8X00) += pf8x00-regulator.o
 obj-$(CONFIG_REGULATOR_PFUZE100) += pfuze100-regulator.o
+obj-$(CONFIG_REGULATOR_PROXY_CONSUMER) += proxy-consumer.o
 obj-$(CONFIG_REGULATOR_PV88060) += pv88060-regulator.o
 obj-$(CONFIG_REGULATOR_PV88080) += pv88080-regulator.o
 obj-$(CONFIG_REGULATOR_PV88090) += pv88090-regulator.o
--- linux-qcom-6.8.0.orig/drivers/regulator/bd71815-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/bd71815-regulator.c
@@ -256,7 +256,7 @@
  * 10: 2.50mV/usec	10mV 4uS
  * 11: 1.25mV/usec	10mV 8uS
  */
-static const unsigned int bd7181x_ramp_table[] = { 1250, 2500, 5000, 10000 };
+static const unsigned int bd7181x_ramp_table[] = { 10000, 5000, 2500, 1250 };
 
 static int bd7181x_led_set_current_limit(struct regulator_dev *rdev,
 					int min_uA, int max_uA)
--- linux-qcom-6.8.0.orig/drivers/regulator/bd71828-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/bd71828-regulator.c
@@ -206,14 +206,11 @@
 			.suspend_reg = BD71828_REG_BUCK1_SUSP_VOLT,
 			.suspend_mask = BD71828_MASK_BUCK1267_VOLT,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
-			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
 			/*
 			 * LPSR voltage is same as SUSPEND voltage. Allow
-			 * setting it so that regulator can be set enabled at
-			 * LPSR state
+			 * only enabling/disabling regulator for LPSR state
 			 */
-			.lpsr_reg = BD71828_REG_BUCK1_SUSP_VOLT,
-			.lpsr_mask = BD71828_MASK_BUCK1267_VOLT,
+			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
 		},
 		.reg_inits = buck1_inits,
 		.reg_init_amnt = ARRAY_SIZE(buck1_inits),
@@ -288,13 +285,7 @@
 				     ROHM_DVS_LEVEL_SUSPEND |
 				     ROHM_DVS_LEVEL_LPSR,
 			.run_reg = BD71828_REG_BUCK3_VOLT,
-			.idle_reg = BD71828_REG_BUCK3_VOLT,
-			.suspend_reg = BD71828_REG_BUCK3_VOLT,
-			.lpsr_reg = BD71828_REG_BUCK3_VOLT,
 			.run_mask = BD71828_MASK_BUCK3_VOLT,
-			.idle_mask = BD71828_MASK_BUCK3_VOLT,
-			.suspend_mask = BD71828_MASK_BUCK3_VOLT,
-			.lpsr_mask = BD71828_MASK_BUCK3_VOLT,
 			.idle_on_mask = BD71828_MASK_IDLE_EN,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
 			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -329,13 +320,7 @@
 				     ROHM_DVS_LEVEL_SUSPEND |
 				     ROHM_DVS_LEVEL_LPSR,
 			.run_reg = BD71828_REG_BUCK4_VOLT,
-			.idle_reg = BD71828_REG_BUCK4_VOLT,
-			.suspend_reg = BD71828_REG_BUCK4_VOLT,
-			.lpsr_reg = BD71828_REG_BUCK4_VOLT,
 			.run_mask = BD71828_MASK_BUCK4_VOLT,
-			.idle_mask = BD71828_MASK_BUCK4_VOLT,
-			.suspend_mask = BD71828_MASK_BUCK4_VOLT,
-			.lpsr_mask = BD71828_MASK_BUCK4_VOLT,
 			.idle_on_mask = BD71828_MASK_IDLE_EN,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
 			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -370,13 +355,7 @@
 				     ROHM_DVS_LEVEL_SUSPEND |
 				     ROHM_DVS_LEVEL_LPSR,
 			.run_reg = BD71828_REG_BUCK5_VOLT,
-			.idle_reg = BD71828_REG_BUCK5_VOLT,
-			.suspend_reg = BD71828_REG_BUCK5_VOLT,
-			.lpsr_reg = BD71828_REG_BUCK5_VOLT,
 			.run_mask = BD71828_MASK_BUCK5_VOLT,
-			.idle_mask = BD71828_MASK_BUCK5_VOLT,
-			.suspend_mask = BD71828_MASK_BUCK5_VOLT,
-			.lpsr_mask = BD71828_MASK_BUCK5_VOLT,
 			.idle_on_mask = BD71828_MASK_IDLE_EN,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
 			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -493,13 +472,7 @@
 				     ROHM_DVS_LEVEL_SUSPEND |
 				     ROHM_DVS_LEVEL_LPSR,
 			.run_reg = BD71828_REG_LDO1_VOLT,
-			.idle_reg = BD71828_REG_LDO1_VOLT,
-			.suspend_reg = BD71828_REG_LDO1_VOLT,
-			.lpsr_reg = BD71828_REG_LDO1_VOLT,
 			.run_mask = BD71828_MASK_LDO_VOLT,
-			.idle_mask = BD71828_MASK_LDO_VOLT,
-			.suspend_mask = BD71828_MASK_LDO_VOLT,
-			.lpsr_mask = BD71828_MASK_LDO_VOLT,
 			.idle_on_mask = BD71828_MASK_IDLE_EN,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
 			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -533,13 +506,7 @@
 				     ROHM_DVS_LEVEL_SUSPEND |
 				     ROHM_DVS_LEVEL_LPSR,
 			.run_reg = BD71828_REG_LDO2_VOLT,
-			.idle_reg = BD71828_REG_LDO2_VOLT,
-			.suspend_reg = BD71828_REG_LDO2_VOLT,
-			.lpsr_reg = BD71828_REG_LDO2_VOLT,
 			.run_mask = BD71828_MASK_LDO_VOLT,
-			.idle_mask = BD71828_MASK_LDO_VOLT,
-			.suspend_mask = BD71828_MASK_LDO_VOLT,
-			.lpsr_mask = BD71828_MASK_LDO_VOLT,
 			.idle_on_mask = BD71828_MASK_IDLE_EN,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
 			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -573,13 +540,7 @@
 				     ROHM_DVS_LEVEL_SUSPEND |
 				     ROHM_DVS_LEVEL_LPSR,
 			.run_reg = BD71828_REG_LDO3_VOLT,
-			.idle_reg = BD71828_REG_LDO3_VOLT,
-			.suspend_reg = BD71828_REG_LDO3_VOLT,
-			.lpsr_reg = BD71828_REG_LDO3_VOLT,
 			.run_mask = BD71828_MASK_LDO_VOLT,
-			.idle_mask = BD71828_MASK_LDO_VOLT,
-			.suspend_mask = BD71828_MASK_LDO_VOLT,
-			.lpsr_mask = BD71828_MASK_LDO_VOLT,
 			.idle_on_mask = BD71828_MASK_IDLE_EN,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
 			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -614,13 +575,7 @@
 				     ROHM_DVS_LEVEL_SUSPEND |
 				     ROHM_DVS_LEVEL_LPSR,
 			.run_reg = BD71828_REG_LDO4_VOLT,
-			.idle_reg = BD71828_REG_LDO4_VOLT,
-			.suspend_reg = BD71828_REG_LDO4_VOLT,
-			.lpsr_reg = BD71828_REG_LDO4_VOLT,
 			.run_mask = BD71828_MASK_LDO_VOLT,
-			.idle_mask = BD71828_MASK_LDO_VOLT,
-			.suspend_mask = BD71828_MASK_LDO_VOLT,
-			.lpsr_mask = BD71828_MASK_LDO_VOLT,
 			.idle_on_mask = BD71828_MASK_IDLE_EN,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
 			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -655,13 +610,7 @@
 				     ROHM_DVS_LEVEL_SUSPEND |
 				     ROHM_DVS_LEVEL_LPSR,
 			.run_reg = BD71828_REG_LDO5_VOLT,
-			.idle_reg = BD71828_REG_LDO5_VOLT,
-			.suspend_reg = BD71828_REG_LDO5_VOLT,
-			.lpsr_reg = BD71828_REG_LDO5_VOLT,
 			.run_mask = BD71828_MASK_LDO_VOLT,
-			.idle_mask = BD71828_MASK_LDO_VOLT,
-			.suspend_mask = BD71828_MASK_LDO_VOLT,
-			.lpsr_mask = BD71828_MASK_LDO_VOLT,
 			.idle_on_mask = BD71828_MASK_IDLE_EN,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
 			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -720,9 +669,6 @@
 			.suspend_reg = BD71828_REG_LDO7_VOLT,
 			.lpsr_reg = BD71828_REG_LDO7_VOLT,
 			.run_mask = BD71828_MASK_LDO_VOLT,
-			.idle_mask = BD71828_MASK_LDO_VOLT,
-			.suspend_mask = BD71828_MASK_LDO_VOLT,
-			.lpsr_mask = BD71828_MASK_LDO_VOLT,
 			.idle_on_mask = BD71828_MASK_IDLE_EN,
 			.suspend_on_mask = BD71828_MASK_SUSP_EN,
 			.lpsr_on_mask = BD71828_MASK_LPSR_EN,
--- linux-qcom-6.8.0.orig/drivers/regulator/core.c
+++ linux-qcom-6.8.0/drivers/regulator/core.c
@@ -1911,19 +1911,24 @@
 		}
 	}
 
-	if (err != -EEXIST)
+	if (err != -EEXIST) {
 		regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs);
-	if (IS_ERR(regulator->debugfs))
-		rdev_dbg(rdev, "Failed to create debugfs directory\n");
+		if (IS_ERR(regulator->debugfs)) {
+			rdev_dbg(rdev, "Failed to create debugfs directory\n");
+			regulator->debugfs = NULL;
+		}
+	}
 
-	debugfs_create_u32("uA_load", 0444, regulator->debugfs,
-			   &regulator->uA_load);
-	debugfs_create_u32("min_uV", 0444, regulator->debugfs,
-			   &regulator->voltage[PM_SUSPEND_ON].min_uV);
-	debugfs_create_u32("max_uV", 0444, regulator->debugfs,
-			   &regulator->voltage[PM_SUSPEND_ON].max_uV);
-	debugfs_create_file("constraint_flags", 0444, regulator->debugfs,
-			    regulator, &constraint_flags_fops);
+	if (regulator->debugfs) {
+		debugfs_create_u32("uA_load", 0444, regulator->debugfs,
+				   &regulator->uA_load);
+		debugfs_create_u32("min_uV", 0444, regulator->debugfs,
+				   &regulator->voltage[PM_SUSPEND_ON].min_uV);
+		debugfs_create_u32("max_uV", 0444, regulator->debugfs,
+				   &regulator->voltage[PM_SUSPEND_ON].max_uV);
+		debugfs_create_file("constraint_flags", 0444, regulator->debugfs,
+				    regulator, &constraint_flags_fops);
+	}
 
 	/*
 	 * Check now if the regulator is an always on regulator - if
@@ -3331,6 +3336,7 @@
 
 	return map ? map : ERR_PTR(-EOPNOTSUPP);
 }
+EXPORT_SYMBOL_GPL(regulator_get_regmap);
 
 /**
  * regulator_get_hardware_vsel_register - get the HW voltage selector register
--- linux-qcom-6.8.0.orig/drivers/regulator/debug-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/debug-regulator.c
@@ -0,0 +1,737 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/bitops.h>
+#include <linux/debugfs.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/regulator/consumer.h>
+#include <linux/regulator/coupler.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/regulator/debug-regulator.h>
+
+#include <trace/events/power.h>
+
+#include "internal.h"
+
+struct debug_regulator {
+	struct list_head	list;
+	struct regulator	*reg;
+	struct device		*dev;
+	struct regulator_dev	*rdev;
+};
+
+static DEFINE_MUTEX(debug_reg_list_lock);
+static LIST_HEAD(debug_reg_list);
+
+static const char *rdev_name(struct regulator_dev *rdev)
+{
+	if (rdev->constraints && rdev->constraints->name)
+		return rdev->constraints->name;
+	else if (rdev->desc->name)
+		return rdev->desc->name;
+	else
+		return "";
+}
+
+#define dreg_err(dreg, fmt, ...)					\
+	pr_err("%s: %s: " fmt, __func__, rdev_name((dreg)->rdev), ##__VA_ARGS__)
+#define dreg_dbg(dreg, fmt, ...)					\
+	pr_debug("%s: %s: " fmt, __func__, rdev_name((dreg)->rdev),	\
+		##__VA_ARGS__)
+
+static struct regulator *reg_debug_get_consumer(struct debug_regulator *dreg)
+{
+	struct regulator *regulator;
+
+	if (dreg->reg)
+		return dreg->reg;
+
+	regulator = regulator_get(NULL, rdev_name(dreg->rdev));
+	if (IS_ERR(regulator)) {
+		dreg_dbg(dreg, "debug regulator get failed, ret=%ld\n",
+			PTR_ERR(regulator));
+		return NULL;
+	}
+	dreg->reg = regulator;
+
+	return regulator;
+}
+
+static int reg_debug_enable_get(void *data, u64 *val)
+{
+	struct debug_regulator *dreg = data;
+	struct regulator *regulator = reg_debug_get_consumer(dreg);
+
+	if (!regulator) {
+		dreg_err(dreg, "debug consumer missing\n");
+		return -ENODEV;
+	}
+
+	*val = regulator_is_enabled(regulator);
+
+	return 0;
+}
+
+static int reg_debug_enable_set(void *data, u64 val)
+{
+	struct debug_regulator *dreg = data;
+	struct regulator *regulator = reg_debug_get_consumer(dreg);
+	int ret;
+
+	if (!regulator) {
+		dreg_err(dreg, "debug consumer missing\n");
+		return -ENODEV;
+	}
+
+	if (val) {
+		ret = regulator_enable(regulator);
+		if (ret)
+			dreg_err(dreg, "enable failed, ret=%d\n", ret);
+	} else {
+		ret = regulator_disable(regulator);
+		if (ret)
+			dreg_err(dreg, "disable failed, ret=%d\n", ret);
+	}
+
+	return ret;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(reg_enable_fops, reg_debug_enable_get,
+			reg_debug_enable_set, "%llu\n");
+
+static int reg_debug_bypass_enable_get(void *data, u64 *val)
+{
+	struct debug_regulator *dreg = data;
+	struct regulator_dev *rdev = dreg->rdev;
+	bool enable = false;
+	int ret = 0;
+
+	ww_mutex_lock(&rdev->mutex, NULL);
+	if (rdev->desc->ops->get_bypass) {
+		ret = rdev->desc->ops->get_bypass(rdev, &enable);
+		if (ret)
+			dreg_err(dreg, "get_bypass() failed, ret=%d\n", ret);
+	} else {
+		enable = (rdev->bypass_count == rdev->open_count);
+	}
+	ww_mutex_unlock(&rdev->mutex);
+
+	*val = enable;
+
+	return ret;
+}
+
+static int reg_debug_bypass_enable_set(void *data, u64 val)
+{
+	struct debug_regulator *dreg = data;
+	struct regulator *regulator = reg_debug_get_consumer(dreg);
+
+	if (!regulator) {
+		dreg_err(dreg, "debug consumer missing\n");
+		return -ENODEV;
+	}
+
+	return regulator_allow_bypass(regulator, val);
+}
+DEFINE_DEBUGFS_ATTRIBUTE(reg_bypass_enable_fops, reg_debug_bypass_enable_get,
+			reg_debug_bypass_enable_set, "%llu\n");
+
+static int reg_debug_force_disable_set(void *data, u64 val)
+{
+	struct debug_regulator *dreg = data;
+	struct regulator *regulator = reg_debug_get_consumer(dreg);
+	int ret = 0;
+
+	if (!regulator) {
+		dreg_err(dreg, "debug consumer missing\n");
+		return -ENODEV;
+	}
+
+	if (val) {
+		ret = regulator_force_disable(regulator);
+		if (ret)
+			dreg_err(dreg, "force_disable failed, ret=%d\n", ret);
+	}
+
+	return ret;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(reg_force_disable_fops, reg_debug_enable_get,
+			reg_debug_force_disable_set, "%llu\n");
+
+#define MAX_DEBUG_BUF_LEN 50
+
+static ssize_t reg_debug_voltage_read(struct file *file, char __user *ubuf,
+					size_t count, loff_t *ppos)
+{
+	struct debug_regulator *dreg = file->private_data;
+	struct regulator *regulator = reg_debug_get_consumer(dreg);
+	char buf[MAX_DEBUG_BUF_LEN];
+	int voltage, ret;
+
+	if (!regulator) {
+		dreg_err(dreg, "debug consumer missing\n");
+		return -ENODEV;
+	}
+
+	voltage = regulator_get_voltage(regulator);
+	ret = scnprintf(buf, MAX_DEBUG_BUF_LEN, "%d\n", voltage);
+
+	return simple_read_from_buffer(ubuf, count, ppos, buf, ret);
+}
+
+static ssize_t reg_debug_voltage_write(struct file *file,
+			const char __user *ubuf, size_t count, loff_t *ppos)
+{
+	struct debug_regulator *dreg = file->private_data;
+	struct regulator *regulator = reg_debug_get_consumer(dreg);
+	char buf[MAX_DEBUG_BUF_LEN];
+	int ret, filled;
+	int min_uV, max_uV = -1;
+
+	if (!regulator) {
+		dreg_err(dreg, "debug consumer missing\n");
+		return -ENODEV;
+	}
+
+	if (count < MAX_DEBUG_BUF_LEN) {
+		if (copy_from_user(buf, ubuf, count))
+			return -EFAULT;
+
+		buf[count] = '\0';
+		filled = sscanf(buf, "%d %d", &min_uV, &max_uV);
+
+		/* Check that both min and max voltage were specified. */
+		if (filled < 2 || min_uV < 0 || max_uV < min_uV) {
+			dreg_err(dreg, "incorrect values specified: \"%s\"; should be: \"min_uV max_uV\"\n",
+				buf);
+			return -EINVAL;
+		}
+
+		ret = regulator_set_voltage(regulator, min_uV, max_uV);
+		if (ret) {
+			dreg_err(dreg, "set_voltage(%d, %d) failed, ret=%d\n",
+				min_uV, max_uV, ret);
+			return ret;
+		}
+	} else {
+		dreg_err(dreg, "voltage request string exceeds maximum buffer size\n");
+		return -EINVAL;
+	}
+
+	return count;
+}
+
+static const struct file_operations reg_voltage_fops = {
+	.open	= simple_open,
+	.read	= reg_debug_voltage_read,
+	.write	= reg_debug_voltage_write,
+};
+
+static int reg_debug_mode_get(void *data, u64 *val)
+{
+	struct debug_regulator *dreg = data;
+	struct regulator *regulator = reg_debug_get_consumer(dreg);
+	int mode;
+
+	if (!regulator) {
+		dreg_err(dreg, "debug consumer missing\n");
+		return -ENODEV;
+	}
+
+	mode = regulator_get_mode(regulator);
+	if (mode < 0) {
+		dreg_err(dreg, "get mode failed, ret=%d\n", mode);
+		return mode;
+	}
+
+	*val = mode;
+
+	return 0;
+}
+
+static int reg_debug_mode_set(void *data, u64 val)
+{
+	struct debug_regulator *dreg = data;
+	struct regulator *regulator = reg_debug_get_consumer(dreg);
+	unsigned int mode = val;
+	int ret;
+
+	if (!regulator) {
+		dreg_err(dreg, "debug consumer missing\n");
+		return -ENODEV;
+	}
+
+	ret = regulator_set_mode(regulator, mode);
+	if (ret)
+		dreg_err(dreg, "set mode=%u failed, ret=%d\n", mode, ret);
+
+	return ret;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(reg_mode_fops, reg_debug_mode_get, reg_debug_mode_set,
+			"%llu\n");
+
+static int reg_debug_set_load(void *data, u64 val)
+{
+	struct debug_regulator *dreg = data;
+	struct regulator *regulator = reg_debug_get_consumer(dreg);
+	int load = val;
+	int ret;
+
+	if (!regulator) {
+		dreg_err(dreg, "debug consumer missing\n");
+		return -ENODEV;
+	}
+
+	ret = regulator_set_load(regulator, load);
+	if (ret)
+		dreg_err(dreg, "set load=%d failed, ret=%d\n", load, ret);
+
+	return ret;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(reg_set_load_fops, reg_debug_mode_get,
+			reg_debug_set_load, "%llu\n");
+
+static int reg_debug_consumers_show(struct seq_file *m, void *v)
+{
+	struct regulator_dev *rdev = m->private;
+	struct regulator *reg;
+	const char *supply_name;
+
+	ww_mutex_lock(&rdev->mutex, NULL);
+
+	/* Print a header if there are consumers. */
+	if (rdev->open_count)
+		seq_printf(m, "%-32s EN    Min_uV   Max_uV  load_uA\n",
+			"Device-Supply");
+
+	list_for_each_entry(reg, &rdev->consumer_list, list) {
+		if (reg->supply_name)
+			supply_name = reg->supply_name;
+		else
+			supply_name = "(null)-(null)";
+
+		seq_printf(m, "%-32s %c   %8d %8d %8d\n", supply_name,
+			(reg->enable_count ? 'Y' : 'N'),
+			reg->voltage[PM_SUSPEND_ON].min_uV,
+			reg->voltage[PM_SUSPEND_ON].max_uV,
+			reg->uA_load);
+	}
+
+	ww_mutex_unlock(&rdev->mutex);
+
+	return 0;
+}
+
+static int reg_debug_consumers_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, reg_debug_consumers_show, inode->i_private);
+}
+
+static const struct file_operations reg_consumers_fops = {
+	.open		= reg_debug_consumers_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+/**
+ * regulator_debug_add() - register a debug regulator for the specified
+ *				regulator
+ * @dev:		Device pointer of the regulator
+ * @rdev:		Regulator dev pointer of the regulator
+ *
+ * This function adds various debugfs files for the 'rdev' regulator which
+ * provide a mechanism for userspace to vote and monitor the state of the
+ * regulator.  When one of these debugfs files is accessed,
+ * reg_debug_get_consumer() is called which uses regulator_get() to get a handle
+ * to the regulator.
+ *
+ * Returns 0 on success or an errno on failure.
+ */
+static struct debug_regulator *regulator_debug_add(struct device *dev,
+						   struct regulator_dev *rdev)
+{
+	struct debug_regulator *dreg = NULL;
+	const struct regulator_ops *ops;
+	struct dentry *dir;
+	mode_t mode;
+
+	if (!dev || !rdev) {
+		pr_err("%s: dev or rdev is NULL\n", __func__);
+		return ERR_PTR(-EINVAL);
+	}
+
+	dreg = kzalloc(sizeof(*dreg), GFP_KERNEL);
+	if (!dreg)
+		return ERR_PTR(-ENOMEM);
+
+	dreg->dev = dev;
+	dreg->rdev = rdev;
+
+	mutex_lock(&debug_reg_list_lock);
+	list_add(&dreg->list, &debug_reg_list);
+	mutex_unlock(&debug_reg_list_lock);
+
+	ops = rdev->desc->ops;
+	dir = rdev->debugfs;
+
+	debugfs_create_file_unsafe("enable", 0644, dir, dreg, &reg_enable_fops);
+	if (ops->set_bypass)
+		debugfs_create_file_unsafe("bypass", 0644, dir, dreg,
+						&reg_bypass_enable_fops);
+
+	mode = 0;
+	if (ops->is_enabled)
+		mode |= 0444;
+	if (ops->disable)
+		mode |= 0200;
+	if (mode)
+		debugfs_create_file_unsafe("force_disable", mode, dir, dreg,
+						&reg_force_disable_fops);
+
+	mode = 0;
+	if (ops->get_voltage || ops->get_voltage_sel)
+		mode |= 0444;
+	if (ops->set_voltage || ops->set_voltage_sel)
+		mode |= 0200;
+	if (mode)
+		debugfs_create_file_unsafe("voltage", mode, dir, dreg,
+						&reg_voltage_fops);
+
+	mode = 0;
+	if (ops->get_mode)
+		mode |= 0444;
+	if (ops->set_mode)
+		mode |= 0200;
+	if (mode)
+		debugfs_create_file_unsafe("mode", mode, dir, dreg,
+						&reg_mode_fops);
+
+	mode = 0;
+	if (ops->get_mode)
+		mode |= 0444;
+	if (ops->set_load || (ops->get_optimum_mode && ops->set_mode))
+		mode |= 0200;
+	if (mode)
+		debugfs_create_file_unsafe("load", mode, dir, dreg,
+						&reg_set_load_fops);
+
+	debugfs_create_file("consumers", 0444, dir, rdev, &reg_consumers_fops);
+
+	return dreg;
+}
+
+/**
+ * regulator_debug_register() - register a debug regulator for the specified
+ *				regulator
+ * @dev:		Device pointer of the regulator
+ * @rdev:		Regulator dev pointer of the regulator
+ *
+ * This function calls regulator_debug_add() which adds several debugfs files
+ * for the 'rdev' regulator which allow for userspace regulator state voting and
+ * monitoring.
+ *
+ * Returns 0 on success or an errno on failure.
+ */
+int regulator_debug_register(struct device *dev, struct regulator_dev *rdev)
+{
+	return PTR_ERR_OR_ZERO(regulator_debug_add(dev, rdev));
+}
+EXPORT_SYMBOL_GPL(regulator_debug_register);
+
+/* debug_reg_list_lock must be held by caller. */
+static void regulator_debug_remove(struct debug_regulator *dreg)
+{
+	regulator_put(dreg->reg);
+	list_del(&dreg->list);
+	kfree(dreg);
+}
+
+/**
+ * regulator_debug_unregister() - unregister the debug regulator associated with
+ *				  a regulator
+ * @rdev:		Regulator dev pointer of the regulator
+ *
+ * This function removes the debugfs consumer registered for 'rdev' and then
+ * frees the debug regulator's resources.
+ */
+void regulator_debug_unregister(struct regulator_dev *rdev)
+{
+	struct debug_regulator *dreg, *temp;
+
+	if (IS_ERR_OR_NULL(rdev)) {
+		pr_err("%s: invalid regulator device pointer\n", __func__);
+		return;
+	}
+
+	mutex_lock(&debug_reg_list_lock);
+	list_for_each_entry_safe(dreg, temp, &debug_reg_list, list) {
+		if (dreg->rdev == rdev)
+			regulator_debug_remove(dreg);
+	}
+	mutex_unlock(&debug_reg_list_lock);
+}
+EXPORT_SYMBOL_GPL(regulator_debug_unregister);
+
+/* debug_reg_list_lock must be held by caller. */
+static void _devm_regulator_debug_release(struct device *dev, void *res)
+{
+	struct debug_regulator *dreg = *(struct debug_regulator **)res;
+	struct debug_regulator *temp;
+	bool found = false;
+
+	/*
+	 * The debug regulator may have already been removed due to a
+	 * devm_regulator_debug_unregister() call.  Therefore, verify that it is
+	 * still in the list before attempting to remove it.
+	 */
+	list_for_each_entry(temp, &debug_reg_list, list) {
+		if (temp == dreg) {
+			found = true;
+			break;
+		}
+	}
+
+	if (found)
+		regulator_debug_remove(dreg);
+}
+
+static void devm_regulator_debug_release(struct device *dev, void *res)
+{
+	mutex_lock(&debug_reg_list_lock);
+	_devm_regulator_debug_release(dev, res);
+	mutex_unlock(&debug_reg_list_lock);
+}
+
+/**
+ * devm_regulator_debug_register() - resource managed version of
+ *					     regulator_debug_register()
+ * @dev:		Device pointer of the regulator
+ * @rdev:		Regulator dev pointer of the regulator
+ *
+ * This is a resource managed version of regulator_debug_register().
+ * The debugfs consumer added via this call is automatically removed via
+ * regulator_debug_unregister() on driver detach. See regulator_debug_register()
+ * for more details.
+ *
+ * Returns 0 on success or an errno on failure.
+ */
+int devm_regulator_debug_register(struct device *dev,
+				struct regulator_dev *rdev)
+{
+	struct debug_regulator *dreg;
+	struct debug_regulator **ptr;
+
+	ptr = devres_alloc(devm_regulator_debug_release, sizeof(*ptr),
+			   GFP_KERNEL);
+	if (!ptr)
+		return -ENOMEM;
+
+	dreg = regulator_debug_add(dev, rdev);
+	if (IS_ERR_OR_NULL(dreg)) {
+		devres_free(ptr);
+		return PTR_ERR(dreg);
+	}
+
+	*ptr = dreg;
+	devres_add(dev, ptr);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(devm_regulator_debug_register);
+
+static int devm_regulator_debug_match(struct device *dev, void *res, void *data)
+{
+	struct debug_regulator **dreg = res;
+
+	if (!dreg || !*dreg) {
+		WARN_ON(!dreg || !*dreg);
+		return 0;
+	}
+
+	return *dreg == data;
+}
+
+/**
+ * devm_regulator_debug_unregister() - resource managed version of
+ *					regulator_debug_unregister()
+ * @rdev:		Regulator dev pointer of the regulator
+ *
+ * Deallocate the debug regulator allocated for 'rdev' with
+ * devm_regulator_debug_register().  Normally this function will not
+ * need to be called and the resource management code will ensure that the
+ * resource is freed.
+ */
+void devm_regulator_debug_unregister(struct regulator_dev *rdev)
+{
+	struct debug_regulator *dreg, *temp;
+
+	if (IS_ERR_OR_NULL(rdev)) {
+		pr_err("%s: invalid regulator device pointer\n", __func__);
+		return;
+	}
+
+	mutex_lock(&debug_reg_list_lock);
+	list_for_each_entry_safe(dreg, temp, &debug_reg_list, list) {
+		if (dreg->rdev == rdev)
+			devres_release(dreg->dev, _devm_regulator_debug_release,
+					devm_regulator_debug_match, dreg);
+	}
+	mutex_unlock(&debug_reg_list_lock);
+}
+EXPORT_SYMBOL_GPL(devm_regulator_debug_unregister);
+
+static int _regulator_is_enabled(struct regulator_dev *rdev)
+{
+	if (rdev->ena_pin)
+		return rdev->ena_gpio_state;
+
+	if (!rdev->desc->ops->is_enabled)
+		return 1;
+
+	return rdev->desc->ops->is_enabled(rdev);
+}
+
+static void regulator_debug_print_enabled(struct regulator_dev *rdev)
+{
+	struct regulator *reg;
+	const char *supply_name;
+	int mode = -EPERM;
+	int uV = -EPERM;
+
+	if (_regulator_is_enabled(rdev) <= 0)
+		return;
+
+	uV = regulator_get_voltage_rdev(rdev);
+
+	if (rdev->desc->ops->get_mode)
+		mode = rdev->desc->ops->get_mode(rdev);
+
+	if (uV != -EPERM && mode != -EPERM)
+		pr_info("%s[%u] %d uV, mode=%d\n",
+			rdev_name(rdev), rdev->use_count, uV, mode);
+	else if (uV != -EPERM)
+		pr_info("%s[%u] %d uV\n",
+			rdev_name(rdev), rdev->use_count, uV);
+	else if (mode != -EPERM)
+		pr_info("%s[%u], mode=%d\n",
+			rdev_name(rdev), rdev->use_count, mode);
+	else
+		pr_info("%s[%u]\n", rdev_name(rdev), rdev->use_count);
+
+	/* Print a header if there are consumers. */
+	if (rdev->open_count)
+		pr_info("  %-32s EN    Min_uV   Max_uV  load_uA\n",
+			"Device-Supply");
+
+	list_for_each_entry(reg, &rdev->consumer_list, list) {
+		if (reg->supply_name)
+			supply_name = reg->supply_name;
+		else
+			supply_name = "(null)-(null)";
+
+		pr_info("  %-32s %d   %8d %8d %8d\n", supply_name,
+			reg->enable_count,
+			reg->voltage[PM_SUSPEND_ON].min_uV,
+			reg->voltage[PM_SUSPEND_ON].max_uV,
+			reg->uA_load);
+	}
+}
+
+static void regulator_debug_suspend_trace_probe(void *unused,
+					const char *action, int val, bool start)
+{
+	struct debug_regulator *dreg;
+
+	if (start && val > 0 && !strcmp("machine_suspend", action)) {
+		pr_info("Enabled regulators:\n");
+		list_for_each_entry(dreg, &debug_reg_list, list)
+			regulator_debug_print_enabled(dreg->rdev);
+	}
+}
+
+static bool debug_suspend;
+static struct dentry *regulator_suspend_debugfs;
+
+static int reg_debug_suspend_enable_get(void *data, u64 *val)
+{
+	*val = debug_suspend;
+
+	return 0;
+}
+
+static int reg_debug_suspend_enable_set(void *data, u64 val)
+{
+	int ret;
+
+	val = !!val;
+	if (val == debug_suspend)
+		return 0;
+
+	if (val)
+		ret = register_trace_suspend_resume(
+				regulator_debug_suspend_trace_probe, NULL);
+	else
+		ret = unregister_trace_suspend_resume(
+				regulator_debug_suspend_trace_probe, NULL);
+	if (ret) {
+		pr_err("%s: Failed to %sregister suspend trace callback, ret=%d\n",
+			__func__, val ? "" : "un", ret);
+		return ret;
+	}
+	debug_suspend = val;
+
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(reg_debug_suspend_enable_fops,
+	reg_debug_suspend_enable_get, reg_debug_suspend_enable_set, "%llu\n");
+
+static int __init regulator_debug_init(void)
+{
+	static struct dentry *dir;
+	int ret;
+
+	dir = debugfs_lookup("regulator", NULL);
+	if (IS_ERR_OR_NULL(dir)) {
+		ret = PTR_ERR(dir);
+		pr_err("%s: unable to find root regulator debugfs directory, ret=%d\n",
+			__func__, ret);
+		return 0;
+	}
+
+	regulator_suspend_debugfs = debugfs_create_file_unsafe("debug_suspend",
+						0644, dir, NULL,
+						&reg_debug_suspend_enable_fops);
+	dput(dir);
+	if (IS_ERR(regulator_suspend_debugfs)) {
+		ret = PTR_ERR(regulator_suspend_debugfs);
+		pr_err("%s: unable to create regulator debug_suspend debugfs directory, ret=%d\n",
+			__func__, ret);
+	}
+
+	return 0;
+}
+module_init(regulator_debug_init);
+
+static void __exit regulator_debug_exit(void)
+{
+	debugfs_remove(regulator_suspend_debugfs);
+	if (debug_suspend)
+		unregister_trace_suspend_resume(
+				regulator_debug_suspend_trace_probe, NULL);
+}
+module_exit(regulator_debug_exit);
+
+MODULE_DESCRIPTION("Regulator debug control library");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/regulator/helpers.c
+++ linux-qcom-6.8.0/drivers/regulator/helpers.c
@@ -161,6 +161,32 @@
 }
 EXPORT_SYMBOL_GPL(regulator_get_voltage_sel_pickable_regmap);
 
+static int write_separate_vsel_and_range(struct regulator_dev *rdev,
+					 unsigned int sel, unsigned int range)
+{
+	bool range_updated;
+	int ret;
+
+	ret = regmap_update_bits_base(rdev->regmap, rdev->desc->vsel_range_reg,
+				      rdev->desc->vsel_range_mask,
+				      range, &range_updated, false, false);
+	if (ret)
+		return ret;
+
+	/*
+	 * Some PMICs treat the vsel_reg same as apply-bit. Force it to be
+	 * written if the range changed, even if the old selector was same as
+	 * the new one
+	 */
+	if (rdev->desc->range_applied_by_vsel && range_updated)
+		return regmap_write_bits(rdev->regmap,
+					rdev->desc->vsel_reg,
+					rdev->desc->vsel_mask, sel);
+
+	return regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg,
+				  rdev->desc->vsel_mask, sel);
+}
+
 /**
  * regulator_set_voltage_sel_pickable_regmap - pickable range set_voltage_sel
  *
@@ -199,21 +225,12 @@
 	range = rdev->desc->linear_range_selectors_bitfield[i];
 	range <<= ffs(rdev->desc->vsel_range_mask) - 1;
 
-	if (rdev->desc->vsel_reg == rdev->desc->vsel_range_reg) {
-		ret = regmap_update_bits(rdev->regmap,
-					 rdev->desc->vsel_reg,
+	if (rdev->desc->vsel_reg == rdev->desc->vsel_range_reg)
+		ret = regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg,
 					 rdev->desc->vsel_range_mask |
 					 rdev->desc->vsel_mask, sel | range);
-	} else {
-		ret = regmap_update_bits(rdev->regmap,
-					 rdev->desc->vsel_range_reg,
-					 rdev->desc->vsel_range_mask, range);
-		if (ret)
-			return ret;
-
-		ret = regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg,
-				  rdev->desc->vsel_mask, sel);
-	}
+	else
+		ret = write_separate_vsel_and_range(rdev, sel, range);
 
 	if (ret)
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/regulator/irq_helpers.c
+++ linux-qcom-6.8.0/drivers/regulator/irq_helpers.c
@@ -352,6 +352,9 @@
 
 	h->irq = irq;
 	h->desc = *d;
+	h->desc.name = devm_kstrdup(dev, d->name, GFP_KERNEL);
+	if (!h->desc.name)
+		return ERR_PTR(-ENOMEM);
 
 	ret = init_rdev_state(dev, h, rdev, common_errs, per_rdev_errs,
 			      rdev_amount);
--- linux-qcom-6.8.0.orig/drivers/regulator/mt6360-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/mt6360-regulator.c
@@ -319,15 +319,15 @@
 	}
 }
 
-#define MT6360_REGULATOR_DESC(_name, _sname, ereg, emask, vreg,	vmask,	\
-			      mreg, mmask, streg, stmask, vranges,	\
-			      vcnts, offon_delay, irq_tbls)		\
+#define MT6360_REGULATOR_DESC(match, _name, _sname, ereg, emask, vreg,	\
+			      vmask, mreg, mmask, streg, stmask,	\
+			      vranges, vcnts, offon_delay, irq_tbls)	\
 {									\
 	.desc = {							\
 		.name = #_name,						\
 		.supply_name = #_sname,					\
 		.id =  MT6360_REGULATOR_##_name,			\
-		.of_match = of_match_ptr(#_name),			\
+		.of_match = of_match_ptr(match),			\
 		.regulators_node = of_match_ptr("regulator"),		\
 		.of_map_mode = mt6360_regulator_of_map_mode,		\
 		.owner = THIS_MODULE,					\
@@ -351,21 +351,29 @@
 }
 
 static const struct mt6360_regulator_desc mt6360_regulator_descs[] =  {
-	MT6360_REGULATOR_DESC(BUCK1, BUCK1_VIN, 0x117, 0x40, 0x110, 0xff, 0x117, 0x30, 0x117, 0x04,
+	MT6360_REGULATOR_DESC("buck1", BUCK1, BUCK1_VIN,
+			      0x117, 0x40, 0x110, 0xff, 0x117, 0x30, 0x117, 0x04,
 			      buck_vout_ranges, 256, 0, buck1_irq_tbls),
-	MT6360_REGULATOR_DESC(BUCK2, BUCK2_VIN, 0x127, 0x40, 0x120, 0xff, 0x127, 0x30, 0x127, 0x04,
+	MT6360_REGULATOR_DESC("buck2", BUCK2, BUCK2_VIN,
+			      0x127, 0x40, 0x120, 0xff, 0x127, 0x30, 0x127, 0x04,
 			      buck_vout_ranges, 256, 0, buck2_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO6, LDO_VIN3, 0x137, 0x40, 0x13B, 0xff, 0x137, 0x30, 0x137, 0x04,
+	MT6360_REGULATOR_DESC("ldo6", LDO6, LDO_VIN3,
+			      0x137, 0x40, 0x13B, 0xff, 0x137, 0x30, 0x137, 0x04,
 			      ldo_vout_ranges1, 256, 0, ldo6_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO7, LDO_VIN3, 0x131, 0x40, 0x135, 0xff, 0x131, 0x30, 0x131, 0x04,
+	MT6360_REGULATOR_DESC("ldo7", LDO7, LDO_VIN3,
+			      0x131, 0x40, 0x135, 0xff, 0x131, 0x30, 0x131, 0x04,
 			      ldo_vout_ranges1, 256, 0, ldo7_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO1, LDO_VIN1, 0x217, 0x40, 0x21B, 0xff, 0x217, 0x30, 0x217, 0x04,
+	MT6360_REGULATOR_DESC("ldo1", LDO1, LDO_VIN1,
+			      0x217, 0x40, 0x21B, 0xff, 0x217, 0x30, 0x217, 0x04,
 			      ldo_vout_ranges2, 256, 0, ldo1_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO2, LDO_VIN1, 0x211, 0x40, 0x215, 0xff, 0x211, 0x30, 0x211, 0x04,
+	MT6360_REGULATOR_DESC("ldo2", LDO2, LDO_VIN1,
+			      0x211, 0x40, 0x215, 0xff, 0x211, 0x30, 0x211, 0x04,
 			      ldo_vout_ranges2, 256, 0, ldo2_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO3, LDO_VIN1, 0x205, 0x40, 0x209, 0xff, 0x205, 0x30, 0x205, 0x04,
+	MT6360_REGULATOR_DESC("ldo3", LDO3, LDO_VIN1,
+			      0x205, 0x40, 0x209, 0xff, 0x205, 0x30, 0x205, 0x04,
 			      ldo_vout_ranges2, 256, 100, ldo3_irq_tbls),
-	MT6360_REGULATOR_DESC(LDO5, LDO_VIN2, 0x20B, 0x40, 0x20F, 0x7f, 0x20B, 0x30, 0x20B, 0x04,
+	MT6360_REGULATOR_DESC("ldo5", LDO5, LDO_VIN2,
+			      0x20B, 0x40, 0x20F, 0x7f, 0x20B, 0x30, 0x20B, 0x04,
 			      ldo_vout_ranges3, 128, 100, ldo5_irq_tbls),
 };
 
--- linux-qcom-6.8.0.orig/drivers/regulator/of_regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/of_regulator.c
@@ -777,7 +777,7 @@
 			name[i] = '\0';
 			tmp = regulator_get(dev, name);
 			if (IS_ERR(tmp)) {
-				ret = -EINVAL;
+				ret = PTR_ERR(tmp);
 				goto error;
 			}
 			(*consumers)[n].consumer = tmp;
--- linux-qcom-6.8.0.orig/drivers/regulator/proxy-consumer.c
+++ linux-qcom-6.8.0/drivers/regulator/proxy-consumer.c
@@ -0,0 +1,400 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "%s: " fmt, __func__
+
+#include <linux/bitops.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/regulator/consumer.h>
+#include <linux/regulator/proxy-consumer.h>
+
+struct proxy_consumer {
+	struct list_head	list;
+	struct regulator	*reg;
+	struct device		*dev;
+	bool			enable;
+	int			min_uV;
+	int			max_uV;
+	u32			current_uA;
+};
+
+static DEFINE_MUTEX(proxy_consumer_list_lock);
+static LIST_HEAD(proxy_consumer_list);
+static bool proxy_consumers_removed;
+
+/**
+ * regulator_proxy_consumer_add() - conditionally add a proxy consumer for the
+ *				    specified regulator and set its boot time
+ *				    parameters
+ * @dev:		Device pointer of the regulator
+ * @node:		Device node pointer of the regulator
+ *
+ * This function calls regulator_get() after first checking if any proxy
+ * consumer properties are present in the 'node' device node.  After that, the
+ * voltage, minimum current, and/or the enable state will be set based upon the
+ * device node property values.
+ *
+ * Returns a valid pointer on successfully proxy voting, NULL if no proxy voting
+ * is needed, or an ERR_PTR(errno) if an error occurred.
+ */
+static struct proxy_consumer *regulator_proxy_consumer_add(struct device *dev,
+						       struct device_node *node)
+{
+	struct proxy_consumer *consumer = NULL;
+	const char *reg_name = "";
+	const char *supply_name;
+	u32 voltage[2] = {0};
+	int ret;
+
+	if (!dev || !node) {
+		pr_err("dev or node is NULL\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	/* Return immediately if no proxy consumer properties are specified. */
+	if (!of_find_property(node, "qcom,proxy-consumer-enable", NULL)
+	    && !of_find_property(node, "qcom,proxy-consumer-voltage", NULL)
+	    && !of_find_property(node, "qcom,proxy-consumer-current", NULL))
+		return NULL;
+
+	mutex_lock(&proxy_consumer_list_lock);
+
+	/* Do not register new consumers if they cannot be removed later. */
+	if (proxy_consumers_removed) {
+		ret = -EPERM;
+		goto unlock_list;
+	}
+
+	if (node->name)
+		reg_name = node->name;
+
+	consumer = kzalloc(sizeof(*consumer), GFP_KERNEL);
+	if (!consumer) {
+		ret = -ENOMEM;
+		goto unlock_list;
+	}
+
+	consumer->dev = dev;
+	consumer->enable
+		= of_property_read_bool(node, "qcom,proxy-consumer-enable");
+	of_property_read_u32(node, "qcom,proxy-consumer-current",
+				&consumer->current_uA);
+	ret = of_property_read_u32_array(node, "qcom,proxy-consumer-voltage",
+					voltage, 2);
+	if (!ret) {
+		consumer->min_uV = voltage[0];
+		consumer->max_uV = voltage[1];
+	}
+
+	dev_dbg(dev, "proxy consumer request: enable=%d, voltage_range=[%d, %d] uV, min_current=%d uA\n",
+		consumer->enable, consumer->min_uV, consumer->max_uV,
+		consumer->current_uA);
+
+	supply_name = "proxy";
+	of_property_read_string(node, "qcom,proxy-consumer-name", &supply_name);
+
+	consumer->reg = regulator_get(dev, supply_name);
+	if (IS_ERR_OR_NULL(consumer->reg)) {
+		ret = PTR_ERR(consumer->reg);
+		pr_err("regulator_get(%s) failed for %s, ret=%d\n", supply_name,
+			reg_name, ret);
+		goto free_consumer;
+	}
+
+	if (consumer->max_uV > 0 && consumer->min_uV <= consumer->max_uV) {
+		ret = regulator_set_voltage(consumer->reg, consumer->min_uV,
+						consumer->max_uV);
+		if (ret) {
+			pr_err("regulator_set_voltage %s failed, ret=%d\n",
+				reg_name, ret);
+			goto free_regulator;
+		}
+	}
+
+	if (consumer->current_uA > 0) {
+		ret = regulator_set_load(consumer->reg, consumer->current_uA);
+		if (ret < 0) {
+			pr_err("regulator_set_load %s failed, ret=%d\n",
+				reg_name, ret);
+			goto remove_voltage;
+		}
+	}
+
+	if (consumer->enable) {
+		ret = regulator_enable(consumer->reg);
+		if (ret) {
+			pr_err("regulator_enable %s failed, ret=%d\n", reg_name,
+				ret);
+			goto remove_current;
+		}
+	}
+
+	list_add(&consumer->list, &proxy_consumer_list);
+	mutex_unlock(&proxy_consumer_list_lock);
+
+	return consumer;
+
+remove_current:
+	regulator_set_load(consumer->reg, 0);
+remove_voltage:
+	regulator_set_voltage(consumer->reg, 0, INT_MAX);
+free_regulator:
+	regulator_put(consumer->reg);
+free_consumer:
+	kfree(consumer);
+unlock_list:
+	mutex_unlock(&proxy_consumer_list_lock);
+
+	return ERR_PTR(ret);
+}
+
+/**
+ * regulator_proxy_consumer_register() - conditionally register a proxy consumer
+ *		 for the specified regulator and set its boot time parameters
+ * @dev:		Device pointer of the regulator
+ * @node:		Device node pointer of the regulator
+ *
+ * This function calls regulator_get() after first checking if any proxy
+ * consumer properties are present in the 'node' device node.  After that, the
+ * voltage, minimum current, and/or the enable state will be set based upon the
+ * device node property values.
+ *
+ * Returns 0 on successfully proxy voting or if no proxy voting is needed, or an
+ * errno if an error occurred.
+ */
+int regulator_proxy_consumer_register(struct device *dev,
+				      struct device_node *node)
+{
+	struct proxy_consumer *consumer;
+
+	consumer = regulator_proxy_consumer_add(dev, node);
+
+	return PTR_ERR_OR_ZERO(consumer);
+}
+EXPORT_SYMBOL_GPL(regulator_proxy_consumer_register);
+
+/* proxy_consumer_list_lock must be held by caller. */
+static int regulator_proxy_consumer_remove(struct proxy_consumer *consumer)
+{
+	int ret = 0;
+
+	if (consumer->enable) {
+		ret = regulator_disable(consumer->reg);
+		if (ret)
+			pr_err("regulator_disable failed, ret=%d\n", ret);
+	}
+
+	if (consumer->current_uA > 0) {
+		ret = regulator_set_load(consumer->reg, 0);
+		if (ret < 0)
+			pr_err("regulator_set_load failed, ret=%d\n",
+				ret);
+	}
+
+	if (consumer->max_uV > 0 && consumer->min_uV <= consumer->max_uV) {
+		ret = regulator_set_voltage(consumer->reg, 0, INT_MAX);
+		if (ret)
+			pr_err("regulator_set_voltage failed, ret=%d\n", ret);
+	}
+
+	regulator_put(consumer->reg);
+	list_del(&consumer->list);
+	kfree(consumer);
+
+	return ret;
+}
+
+/**
+ * regulator_proxy_consumer_unregister() - unregister the proxy consumers of a
+ *					   device and remove their boot time
+ *					   requests
+ * @dev:		Device pointer of the regulator
+ *
+ * This function removes all requests made by the proxy consumers of regulators
+ * in dev which where issued in regulator_proxy_consumer_register() and then
+ * frees the consumers' resources.
+ *
+ * Returns 0 on success or an errno on failure.
+ */
+void regulator_proxy_consumer_unregister(struct device *dev)
+{
+	struct proxy_consumer *consumer, *temp;
+
+	if (IS_ERR_OR_NULL(dev)) {
+		pr_err("invalid device pointer\n");
+		return;
+	}
+
+	mutex_lock(&proxy_consumer_list_lock);
+	list_for_each_entry_safe(consumer, temp, &proxy_consumer_list, list) {
+		if (consumer->dev == dev)
+			regulator_proxy_consumer_remove(consumer);
+	}
+	mutex_unlock(&proxy_consumer_list_lock);
+}
+EXPORT_SYMBOL_GPL(regulator_proxy_consumer_unregister);
+
+/* proxy_consumer_list_lock must be held by caller. */
+static void
+_devm_regulator_proxy_consumer_release(struct device *dev, void *res)
+{
+	struct proxy_consumer *consumer = *(struct proxy_consumer **)res;
+	struct proxy_consumer *temp;
+	bool found = false;
+
+	/*
+	 * The proxy consumer may have already been removed due to a
+	 * sync_state() or devm_regulator_proxy_consumer_unregister() call.
+	 * Therefore, verify that it is still in the list before attempting to
+	 * remove it.
+	 */
+	list_for_each_entry(temp, &proxy_consumer_list, list) {
+		if (temp == consumer) {
+			found = true;
+			break;
+		}
+	}
+
+	if (found)
+		regulator_proxy_consumer_remove(consumer);
+}
+
+static void devm_regulator_proxy_consumer_release(struct device *dev, void *res)
+{
+	mutex_lock(&proxy_consumer_list_lock);
+	_devm_regulator_proxy_consumer_release(dev, res);
+	mutex_unlock(&proxy_consumer_list_lock);
+}
+
+/**
+ * devm_regulator_proxy_consumer_register() - resource managed version of
+ *					     regulator_proxy_consumer_register()
+ * @dev:		Device pointer of the regulator
+ * @node:		Device node pointer of the regulator
+ *
+ * This is a resource managed version of regulator_proxy_consumer_register().
+ * Proxy consumer requests made via this call are automatically removed via
+ * regulator_proxy_consumer_unregister() on driver detach. See
+ * regulator_proxy_consumer_register() for more details.
+ *
+ * Returns 0 on success or an errno on failure.
+ */
+int devm_regulator_proxy_consumer_register(struct device *dev,
+					   struct device_node *node)
+{
+	struct proxy_consumer *consumer;
+	struct proxy_consumer **ptr;
+
+	ptr = devres_alloc(devm_regulator_proxy_consumer_release, sizeof(*ptr),
+			   GFP_KERNEL);
+	if (!ptr)
+		return -ENOMEM;
+
+	consumer = regulator_proxy_consumer_add(dev, node);
+	if (IS_ERR_OR_NULL(consumer)) {
+		devres_free(ptr);
+		return PTR_ERR(consumer);
+	}
+
+	*ptr = consumer;
+	devres_add(dev, ptr);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(devm_regulator_proxy_consumer_register);
+
+static int devm_regulator_proxy_consumer_match(struct device *dev, void *res,
+					       void *data)
+{
+	struct proxy_consumer **consumer = res;
+
+	if (!consumer || !*consumer) {
+		WARN_ON(!consumer || !*consumer);
+		return 0;
+	}
+
+	return *consumer == data;
+}
+
+/**
+ * devm_regulator_proxy_consumer_unregister() - resource managed version of
+ *					regulator_proxy_consumer_unregister()
+ * @dev:		Device pointer of the regulator
+ *
+ * Deallocate the proxy consumers allocated for 'dev' with
+ * devm_regulator_proxy_consumer_register().  Normally this function will not
+ * need to be called and the resource management code will ensure that the
+ * resource is freed.
+ *
+ * Returns 0 on success or an errno on failure.
+ */
+void devm_regulator_proxy_consumer_unregister(struct device *dev)
+{
+	struct proxy_consumer *consumer, *temp;
+
+	if (IS_ERR_OR_NULL(dev))
+		return;
+
+	mutex_lock(&proxy_consumer_list_lock);
+	list_for_each_entry_safe(consumer, temp, &proxy_consumer_list, list) {
+		if (consumer->dev == dev)
+			devres_release(dev,
+					_devm_regulator_proxy_consumer_release,
+					devm_regulator_proxy_consumer_match,
+					consumer);
+	}
+	mutex_unlock(&proxy_consumer_list_lock);
+}
+EXPORT_SYMBOL_GPL(devm_regulator_proxy_consumer_unregister);
+
+#ifndef CONFIG_REGULATOR_PROXY_CONSUMER_LEGACY
+
+void regulator_proxy_consumer_sync_state(struct device *dev)
+{
+	regulator_proxy_consumer_unregister(dev);
+}
+EXPORT_SYMBOL_GPL(regulator_proxy_consumer_sync_state);
+
+#else /* CONFIG_REGULATOR_PROXY_CONSUMER_LEGACY=y */
+
+void regulator_proxy_consumer_sync_state(struct device *dev) { }
+EXPORT_SYMBOL_GPL(regulator_proxy_consumer_sync_state);
+
+/*
+ * Remove all proxy requests at late_initcall_sync.  The assumption is that all
+ * devices have probed at this point and made their own regulator requests.
+ */
+static int __init regulator_proxy_consumer_remove_all(void)
+{
+	struct proxy_consumer *consumer;
+	struct proxy_consumer *temp;
+
+	mutex_lock(&proxy_consumer_list_lock);
+	proxy_consumers_removed = true;
+
+	if (!list_empty(&proxy_consumer_list))
+		pr_info("removing regulator proxy consumer requests\n");
+
+	list_for_each_entry_safe(consumer, temp, &proxy_consumer_list, list) {
+		regulator_proxy_consumer_remove(consumer);
+	}
+	mutex_unlock(&proxy_consumer_list_lock);
+
+	return 0;
+}
+late_initcall_sync(regulator_proxy_consumer_remove_all);
+
+#endif
+
+MODULE_DESCRIPTION("Regulator proxy consumer library");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/regulator/qcom-refgen-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/qcom-refgen-regulator.c
@@ -140,6 +140,7 @@
 	{ .compatible = "qcom,sm8250-refgen-regulator", .data = &sm8250_refgen_desc },
 	{ }
 };
+MODULE_DEVICE_TABLE(of, qcom_refgen_match_table);
 
 static struct platform_driver qcom_refgen_driver = {
 	.probe = qcom_refgen_probe,
--- linux-qcom-6.8.0.orig/drivers/regulator/qcom-rpmh-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/qcom-rpmh-regulator.c
@@ -13,6 +13,7 @@
 #include <linux/string.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
+#include <linux/regulator/debug-regulator.h>
 #include <linux/regulator/of_regulator.h>
 
 #include <soc/qcom/cmd-db.h>
@@ -489,6 +490,10 @@
 		return ret;
 	}
 
+	ret = devm_regulator_debug_register(dev, rdev);
+	if (ret)
+		dev_err(dev, "failed to register debug regulator ret=%d\n", ret);
+
 	dev_dbg(dev, "%pOFn regulator registered for RPMh resource %s @ 0x%05X\n",
 		node, rpmh_resource_name, vreg->addr);
 
@@ -843,26 +848,15 @@
 	.of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
 };
 
-static const struct rpmh_vreg_hw_data pmic5_ftsmps525_lv = {
+static const struct rpmh_vreg_hw_data pmic5_ftsmps525 = {
 	.regulator_type = VRM,
 	.ops = &rpmh_regulator_vrm_ops,
 	.voltage_ranges = (struct linear_range[]) {
 		REGULATOR_LINEAR_RANGE(300000, 0, 267, 4000),
+		REGULATOR_LINEAR_RANGE(1376000, 268, 438, 8000),
 	},
-	.n_linear_ranges = 1,
-	.n_voltages = 268,
-	.pmic_mode_map = pmic_mode_map_pmic5_smps,
-	.of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
-};
-
-static const struct rpmh_vreg_hw_data pmic5_ftsmps525_mv = {
-	.regulator_type = VRM,
-	.ops = &rpmh_regulator_vrm_ops,
-	.voltage_ranges = (struct linear_range[]) {
-		REGULATOR_LINEAR_RANGE(600000, 0, 267, 8000),
-	},
-	.n_linear_ranges = 1,
-	.n_voltages = 268,
+	.n_linear_ranges = 2,
+	.n_voltages = 439,
 	.pmic_mode_map = pmic_mode_map_pmic5_smps,
 	.of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
 };
@@ -1190,12 +1184,12 @@
 };
 
 static const struct rpmh_vreg_init_data pm8550vs_vreg_data[] = {
-	RPMH_VREG("smps1",  "smp%s1",  &pmic5_ftsmps525_lv, "vdd-s1"),
-	RPMH_VREG("smps2",  "smp%s2",  &pmic5_ftsmps525_lv, "vdd-s2"),
-	RPMH_VREG("smps3",  "smp%s3",  &pmic5_ftsmps525_lv, "vdd-s3"),
-	RPMH_VREG("smps4",  "smp%s4",  &pmic5_ftsmps525_lv, "vdd-s4"),
-	RPMH_VREG("smps5",  "smp%s5",  &pmic5_ftsmps525_lv, "vdd-s5"),
-	RPMH_VREG("smps6",  "smp%s6",  &pmic5_ftsmps525_mv, "vdd-s6"),
+	RPMH_VREG("smps1",  "smp%s1",  &pmic5_ftsmps525, "vdd-s1"),
+	RPMH_VREG("smps2",  "smp%s2",  &pmic5_ftsmps525, "vdd-s2"),
+	RPMH_VREG("smps3",  "smp%s3",  &pmic5_ftsmps525, "vdd-s3"),
+	RPMH_VREG("smps4",  "smp%s4",  &pmic5_ftsmps525, "vdd-s4"),
+	RPMH_VREG("smps5",  "smp%s5",  &pmic5_ftsmps525, "vdd-s5"),
+	RPMH_VREG("smps6",  "smp%s6",  &pmic5_ftsmps525, "vdd-s6"),
 	RPMH_VREG("ldo1",   "ldo%s1",  &pmic5_nldo515,   "vdd-l1"),
 	RPMH_VREG("ldo2",   "ldo%s2",  &pmic5_nldo515,   "vdd-l2"),
 	RPMH_VREG("ldo3",   "ldo%s3",  &pmic5_nldo515,   "vdd-l3"),
@@ -1203,14 +1197,14 @@
 };
 
 static const struct rpmh_vreg_init_data pm8550ve_vreg_data[] = {
-	RPMH_VREG("smps1", "smp%s1", &pmic5_ftsmps525_lv, "vdd-s1"),
-	RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps525_lv, "vdd-s2"),
-	RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps525_lv, "vdd-s3"),
-	RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps525_mv, "vdd-s4"),
-	RPMH_VREG("smps5", "smp%s5", &pmic5_ftsmps525_lv, "vdd-s5"),
-	RPMH_VREG("smps6", "smp%s6", &pmic5_ftsmps525_lv, "vdd-s6"),
-	RPMH_VREG("smps7", "smp%s7", &pmic5_ftsmps525_lv, "vdd-s7"),
-	RPMH_VREG("smps8", "smp%s8", &pmic5_ftsmps525_lv, "vdd-s8"),
+	RPMH_VREG("smps1", "smp%s1", &pmic5_ftsmps525, "vdd-s1"),
+	RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps525, "vdd-s2"),
+	RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps525, "vdd-s3"),
+	RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps525, "vdd-s4"),
+	RPMH_VREG("smps5", "smp%s5", &pmic5_ftsmps525, "vdd-s5"),
+	RPMH_VREG("smps6", "smp%s6", &pmic5_ftsmps525, "vdd-s6"),
+	RPMH_VREG("smps7", "smp%s7", &pmic5_ftsmps525, "vdd-s7"),
+	RPMH_VREG("smps8", "smp%s8", &pmic5_ftsmps525, "vdd-s8"),
 	RPMH_VREG("ldo1",  "ldo%s1", &pmic5_nldo515,   "vdd-l1"),
 	RPMH_VREG("ldo2",  "ldo%s2", &pmic5_nldo515,   "vdd-l2"),
 	RPMH_VREG("ldo3",  "ldo%s3", &pmic5_nldo515,   "vdd-l3"),
@@ -1218,14 +1212,14 @@
 };
 
 static const struct rpmh_vreg_init_data pmc8380_vreg_data[] = {
-	RPMH_VREG("smps1", "smp%s1", &pmic5_ftsmps525_lv, "vdd-s1"),
-	RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps525_lv, "vdd-s2"),
-	RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps525_lv, "vdd-s3"),
-	RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps525_mv, "vdd-s4"),
-	RPMH_VREG("smps5", "smp%s5", &pmic5_ftsmps525_lv, "vdd-s5"),
-	RPMH_VREG("smps6", "smp%s6", &pmic5_ftsmps525_lv, "vdd-s6"),
-	RPMH_VREG("smps7", "smp%s7", &pmic5_ftsmps525_lv, "vdd-s7"),
-	RPMH_VREG("smps8", "smp%s8", &pmic5_ftsmps525_lv, "vdd-s8"),
+	RPMH_VREG("smps1", "smp%s1", &pmic5_ftsmps525, "vdd-s1"),
+	RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps525, "vdd-s2"),
+	RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps525, "vdd-s3"),
+	RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps525, "vdd-s4"),
+	RPMH_VREG("smps5", "smp%s5", &pmic5_ftsmps525, "vdd-s5"),
+	RPMH_VREG("smps6", "smp%s6", &pmic5_ftsmps525, "vdd-s6"),
+	RPMH_VREG("smps7", "smp%s7", &pmic5_ftsmps525, "vdd-s7"),
+	RPMH_VREG("smps8", "smp%s8", &pmic5_ftsmps525, "vdd-s8"),
 	RPMH_VREG("ldo1",  "ldo%s1", &pmic5_nldo515,   "vdd-l1"),
 	RPMH_VREG("ldo2",  "ldo%s2", &pmic5_nldo515,   "vdd-l2"),
 	RPMH_VREG("ldo3",  "ldo%s3", &pmic5_nldo515,   "vdd-l3"),
@@ -1409,16 +1403,16 @@
 };
 
 static const struct rpmh_vreg_init_data pmx75_vreg_data[] = {
-	RPMH_VREG("smps1",   "smp%s1",    &pmic5_ftsmps525_lv, "vdd-s1"),
-	RPMH_VREG("smps2",   "smp%s2",    &pmic5_ftsmps525_lv, "vdd-s2"),
-	RPMH_VREG("smps3",   "smp%s3",    &pmic5_ftsmps525_lv, "vdd-s3"),
-	RPMH_VREG("smps4",   "smp%s4",    &pmic5_ftsmps525_mv, "vdd-s4"),
-	RPMH_VREG("smps5",   "smp%s5",    &pmic5_ftsmps525_lv, "vdd-s5"),
-	RPMH_VREG("smps6",   "smp%s6",    &pmic5_ftsmps525_lv, "vdd-s6"),
-	RPMH_VREG("smps7",   "smp%s7",    &pmic5_ftsmps525_lv, "vdd-s7"),
-	RPMH_VREG("smps8",   "smp%s8",    &pmic5_ftsmps525_lv, "vdd-s8"),
-	RPMH_VREG("smps9",   "smp%s9",    &pmic5_ftsmps525_lv, "vdd-s9"),
-	RPMH_VREG("smps10",  "smp%s10",   &pmic5_ftsmps525_lv, "vdd-s10"),
+	RPMH_VREG("smps1",   "smp%s1",    &pmic5_ftsmps525, "vdd-s1"),
+	RPMH_VREG("smps2",   "smp%s2",    &pmic5_ftsmps525, "vdd-s2"),
+	RPMH_VREG("smps3",   "smp%s3",    &pmic5_ftsmps525, "vdd-s3"),
+	RPMH_VREG("smps4",   "smp%s4",    &pmic5_ftsmps525, "vdd-s4"),
+	RPMH_VREG("smps5",   "smp%s5",    &pmic5_ftsmps525, "vdd-s5"),
+	RPMH_VREG("smps6",   "smp%s6",    &pmic5_ftsmps525, "vdd-s6"),
+	RPMH_VREG("smps7",   "smp%s7",    &pmic5_ftsmps525, "vdd-s7"),
+	RPMH_VREG("smps8",   "smp%s8",    &pmic5_ftsmps525, "vdd-s8"),
+	RPMH_VREG("smps9",   "smp%s9",    &pmic5_ftsmps525, "vdd-s9"),
+	RPMH_VREG("smps10",  "smp%s10",   &pmic5_ftsmps525, "vdd-s10"),
 	RPMH_VREG("ldo1",    "ldo%s1",    &pmic5_nldo515,   "vdd-l1"),
 	RPMH_VREG("ldo2",    "ldo%s2",    &pmic5_nldo515,   "vdd-l2-18"),
 	RPMH_VREG("ldo3",    "ldo%s3",    &pmic5_nldo515,   "vdd-l3"),
--- linux-qcom-6.8.0.orig/drivers/regulator/qcom_pm8008-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/qcom_pm8008-regulator.c
@@ -0,0 +1,1175 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "PM8008: %s: " fmt, __func__
+
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/regmap.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/of_irq.h>
+#include <linux/pm.h>
+#include <linux/regulator/debug-regulator.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/regulator/of_regulator.h>
+#include <linux/string.h>
+#include "internal.h"
+
+#define pm8008_err(reg, message, ...) \
+	pr_err("%s: " message, (reg)->rdesc.name, ##__VA_ARGS__)
+#define pm8008_debug(reg, message, ...) \
+	pr_debug("%s: " message, (reg)->rdesc.name, ##__VA_ARGS__)
+
+#define STARTUP_DELAY_USEC		20
+#define VSET_STEP_SIZE_MV		1
+#define VSET_STEP_MV			8
+#define VSET_STEP_UV			(VSET_STEP_MV * 1000)
+
+#define MISC_BASE			0x900
+
+#define MISC_CHIP_ENABLE_REG		(MISC_BASE + 0x50)
+#define CHIP_ENABLE_BIT			BIT(0)
+
+#define MISC_SHUTDOWN_CTRL_REG		(MISC_BASE + 0x59)
+#define IGNORE_LDO_OCP_SHUTDOWN		BIT(3)
+
+#define LDO_ENABLE_REG(base)		(base + 0x46)
+#define ENABLE_BIT			BIT(7)
+
+#define LDO_STATUS1_REG(base)		(base + 0x08)
+#define VREG_OCP_BIT			BIT(5)
+#define VREG_READY_BIT			BIT(7)
+#define MODE_STATE_MASK			GENMASK(1, 0)
+#define MODE_STATE_NPM			3
+#define MODE_STATE_LPM			2
+#define MODE_STATE_BYPASS		0
+
+#define LDO_VSET_LB_REG(base)		(base + 0x40)
+
+#define LDO_MODE_CTL1_REG(base)		(base + 0x45)
+#define MODE_PRIMARY_MASK		GENMASK(2, 0)
+#define LDO_MODE_NPM			7
+#define LDO_MODE_LPM			4
+#define FORCED_BYPASS			2
+
+#define LDO_OCP_CTL1_REG(base)		(base + 0x88)
+#define VREG_OCP_STATUS_CLR		BIT(1)
+#define LDO_OCP_BROADCAST_EN_BIT	BIT(2)
+
+#define LDO_STEPPER_CTL_REG(base)	(base + 0x3b)
+#define STEP_RATE_MASK			GENMASK(1, 0)
+/* Step rate in uV/us */
+#define PM8010_STEP_RATE		4800
+
+#define LDO_PD_CTL_REG(base)		(base + 0xA0)
+#define STRONG_PD_EN_BIT		BIT(7)
+
+#define PM8008_MAX_LDO			7
+
+enum pmic_subtype {
+	PM8008_SUBTYPE,
+	PM8010_SUBTYPE,
+};
+
+struct pm8008_chip {
+	struct device		*dev;
+	struct regmap		*regmap;
+	struct regulator_dev	*rdev;
+	struct regulator_desc	rdesc;
+	struct mutex		lock;
+	int			ocp_irq;
+	unsigned int		internal_enable_count;
+	bool			framework_enabled;
+	bool			aggr_enabled;
+	bool			suspended;
+};
+
+struct reg_init_data {
+	u8			offset;
+	u8			data;
+};
+
+struct regulator_data {
+	char				*name;
+	char				*supply_name;
+	int				min_uv;
+	int				max_uv;
+	int				hpm_min_load_ua;
+	int				min_dropout_uv;
+	const struct reg_init_data	*reg_init;
+	unsigned int			reg_init_size;
+};
+
+struct pm8008_regulator {
+	struct device		*dev;
+	struct regmap		*regmap;
+	struct regulator_desc	rdesc;
+	struct regulator_dev	*rdev;
+	struct regulator	*en_supply;
+	struct device_node	*of_node;
+	struct pm8008_chip	*chip;
+	struct notifier_block	nb;
+	u16			base;
+	int			hpm_min_load_ua;
+	int			step_rate;
+	bool			enable_ocp_broadcast;
+	bool			chip_enabled;
+	int			mode;
+	int			uv;
+	enum pmic_subtype	pmic_subtype;
+};
+
+static const struct regulator_data pm8008_reg_data[PM8008_MAX_LDO] = {
+	/* name  parent      min_uv  max_uv  hpm_load  headroom_uv */
+	{"l1", "vdd_l1_l2",  528000, 1504000, 30000, 225000},
+	{"l2", "vdd_l1_l2",  528000, 1504000, 30000, 225000},
+	{"l3", "vdd_l3_l4", 1504000, 3400000, 10000, 200000},
+	{"l4", "vdd_l3_l4", 1504000, 3400000, 10000, 200000},
+	{"l5", "vdd_l5",    1504000, 3400000, 10000, 300000},
+	{"l6", "vdd_l6",    1504000, 3400000, 10000, 300000},
+	{"l7", "vdd_l7",    1504000, 3400000, 10000, 300000},
+};
+
+static const struct reg_init_data pm8010_p300_reg_init_data[] = {
+	{0x55, 0x8A},
+	{0x77, 0x03},
+};
+
+static const struct reg_init_data pm8010_p600_reg_init_data[] = {
+	{0x76, 0x07},
+	{0x77, 0x03},
+};
+
+/*
+ * PM8010 LDOs 3, 4, and 6 can physically output a minimum of 1808 mV.  However,
+ * 1504 mV is specified here to match PM8008 and to avoid the parent supply of
+ * these regulators being stuck at an unnecessarily high voltage as a result of
+ * the framework maintaining a minimum vote of 1808 mV + headroom at all times
+ * (even when the LDOs are OFF).  This would waste power.  The LDO hardware
+ * automatically rounds up programmed voltages to supported set points.
+ */
+static const struct regulator_data pm8010_reg_data[PM8008_MAX_LDO] = {
+	/* name  parent      min_uv  max_uv  hpm_load  headroom_uv */
+	{"l1", "vdd_l1_l2",  528000, 1544000, 30000, 100000},
+	{"l2", "vdd_l1_l2",  528000, 1544000, 30000, 100000},
+	{"l3", "vdd_l3_l4", 1504000, 3312000, 10000, 300000,
+	 pm8010_p300_reg_init_data, ARRAY_SIZE(pm8010_p300_reg_init_data)},
+	{"l4", "vdd_l3_l4", 1504000, 3312000, 10000, 300000,
+	 pm8010_p300_reg_init_data, ARRAY_SIZE(pm8010_p300_reg_init_data)},
+	{"l5", "vdd_l5",    1504000, 3544000, 10000, 300000,
+	 pm8010_p600_reg_init_data, ARRAY_SIZE(pm8010_p600_reg_init_data)},
+	{"l6", "vdd_l6",    1504000, 3312000, 10000, 300000,
+	 pm8010_p300_reg_init_data, ARRAY_SIZE(pm8010_p300_reg_init_data)},
+	{"l7", "vdd_l7",    1504000, 3544000, 10000, 300000,
+	 pm8010_p600_reg_init_data, ARRAY_SIZE(pm8010_p600_reg_init_data)},
+};
+
+/* common functions */
+static int pm8008_read(struct regmap *regmap,  u16 reg, u8 *val, int count)
+{
+	int rc;
+
+	rc = regmap_bulk_read(regmap, reg, val, count);
+	if (rc < 0)
+		pr_err("failed to read 0x%04x\n", reg);
+
+	return rc;
+}
+
+static int pm8008_write(struct regmap *regmap, u16 reg, const u8 *val,
+			int count)
+{
+	int rc;
+
+	pr_debug("Writing 0x%02x to 0x%04x\n", val, reg);
+	rc = regmap_bulk_write(regmap, reg, val, count);
+	if (rc < 0)
+		pr_err("failed to write 0x%04x\n", reg);
+
+	return rc;
+}
+
+static int pm8008_masked_write(struct regmap *regmap, u16 reg, u8 mask,
+				u8 val)
+{
+	int rc;
+
+	pr_debug("Writing 0x%02x to 0x%04x with mask 0x%02x\n", val, reg, mask);
+	rc = regmap_update_bits(regmap, reg, mask, val);
+	if (rc < 0)
+		pr_err("failed to write 0x%02x to 0x%04x with mask 0x%02x\n",
+				val, reg, mask);
+
+	return rc;
+}
+
+static int pm8008_chip_aggregate(struct pm8008_chip *chip)
+{
+	bool enable;
+	int rc;
+
+	lockdep_assert_held_once(&chip->lock);
+
+	enable = chip->framework_enabled || chip->internal_enable_count;
+	if (enable == chip->aggr_enabled)
+		return 0;
+
+	rc = pm8008_masked_write(chip->regmap, MISC_CHIP_ENABLE_REG,
+				 CHIP_ENABLE_BIT, enable ? CHIP_ENABLE_BIT : 0);
+	if (rc  < 0) {
+		pm8008_err(chip, "failed to %s chip rc=%d\n",
+			   enable ? "enable" : "disable", rc);
+		return rc;
+	}
+
+	chip->aggr_enabled = enable;
+	pm8008_debug(chip, "chip %s\n", enable ? "enabled" : "disabled");
+
+	return 0;
+}
+
+static int pm8008_chip_internal_enable(struct pm8008_regulator *pm8008_reg)
+{
+	struct pm8008_chip *chip = pm8008_reg->chip;
+	int rc;
+
+	if (pm8008_reg->chip_enabled)
+		return 0;
+
+	mutex_lock(&pm8008_reg->chip->lock);
+	chip->internal_enable_count++;
+	rc = pm8008_chip_aggregate(chip);
+	if (rc < 0) {
+		chip->internal_enable_count--;
+		goto done;
+	}
+
+	pm8008_reg->chip_enabled = true;
+
+done:
+	mutex_unlock(&pm8008_reg->chip->lock);
+	return rc;
+}
+
+static int pm8008_chip_internal_disable(struct pm8008_regulator *pm8008_reg)
+{
+	struct pm8008_chip *chip = pm8008_reg->chip;
+	int rc;
+
+	if (!pm8008_reg->chip_enabled)
+		return 0;
+
+	mutex_lock(&pm8008_reg->chip->lock);
+	if (chip->internal_enable_count == 0) {
+		pm8008_err(chip, "unbalanced disable\n");
+		rc = -EINVAL;
+		goto done;
+	}
+
+	chip->internal_enable_count--;
+	rc = pm8008_chip_aggregate(chip);
+	if (rc < 0) {
+		chip->internal_enable_count++;
+		goto done;
+	}
+
+	pm8008_reg->chip_enabled = false;
+
+done:
+	mutex_unlock(&pm8008_reg->chip->lock);
+	return rc;
+}
+
+/* PM8008 LDO Regulator callbacks */
+static int pm8008_regulator_get_voltage(struct regulator_dev *rdev)
+{
+	struct pm8008_regulator *pm8008_reg = rdev_get_drvdata(rdev);
+	u8 vset_raw[2];
+	int rc;
+
+	if (pm8008_reg->chip->suspended)
+		return pm8008_reg->uv;
+
+	rc = pm8008_read(pm8008_reg->regmap,
+			LDO_VSET_LB_REG(pm8008_reg->base),
+			vset_raw, 2);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg,
+			"failed to read regulator voltage rc=%d\n", rc);
+		return rc;
+	}
+
+	pm8008_debug(pm8008_reg, "VSET read [%x][%x]\n",
+			vset_raw[1], vset_raw[0]);
+	return (vset_raw[1] << 8 | vset_raw[0]) * 1000;
+}
+
+static int _pm8008_regulator_is_enabled(struct pm8008_regulator *pm8008_reg)
+{
+	int rc;
+	u8 reg;
+
+	rc = pm8008_read(pm8008_reg->regmap,
+			LDO_ENABLE_REG(pm8008_reg->base), &reg, 1);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg, "failed to read enable reg rc=%d\n", rc);
+		return rc;
+	}
+
+	return !!(reg & ENABLE_BIT);
+}
+
+static int pm8008_regulator_is_enabled(struct regulator_dev *rdev)
+{
+	struct pm8008_regulator *pm8008_reg = rdev_get_drvdata(rdev);
+
+	if (pm8008_reg->chip->suspended)
+		return pm8008_reg->chip_enabled;
+
+	return _pm8008_regulator_is_enabled(pm8008_reg);
+}
+
+static int pm8008_regulator_enable(struct regulator_dev *rdev)
+{
+	struct pm8008_regulator *pm8008_reg = rdev_get_drvdata(rdev);
+	int rc, rc2, current_uv, delay_us, delay_ms, retry_count = 10;
+	u8 reg;
+
+	if (pm8008_reg->chip->suspended) {
+		if (pm8008_reg->chip_enabled)
+			return 0;
+		return -EPERM;
+	}
+
+	current_uv = pm8008_regulator_get_voltage(rdev);
+	if (current_uv < 0) {
+		pm8008_err(pm8008_reg, "failed to get current voltage rc=%d\n",
+			current_uv);
+		return current_uv;
+	}
+
+	rc = pm8008_chip_internal_enable(pm8008_reg);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg, "failed to enable chip rc=%d\n", rc);
+		return rc;
+	}
+
+	rc = pm8008_masked_write(pm8008_reg->regmap,
+				LDO_ENABLE_REG(pm8008_reg->base),
+				ENABLE_BIT, ENABLE_BIT);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg,
+			"failed to enable regulator rc=%d\n", rc);
+		goto remove_en;
+	}
+
+	/*
+	 * Wait for the VREG_READY status bit to be set using a timeout delay
+	 * calculated from the current commanded voltage.
+	 */
+	delay_us = STARTUP_DELAY_USEC
+			+ DIV_ROUND_UP(current_uv, pm8008_reg->step_rate);
+	delay_ms = DIV_ROUND_UP(delay_us, 1000);
+
+	/* Retry 10 times for VREG_READY before bailing out */
+	while (retry_count--) {
+		if (delay_ms > 20)
+			msleep(delay_ms);
+		else
+			usleep_range(delay_us, delay_us + 100);
+
+		rc = pm8008_read(pm8008_reg->regmap,
+				LDO_STATUS1_REG(pm8008_reg->base), &reg, 1);
+		if (rc < 0) {
+			pm8008_err(pm8008_reg,
+				"failed to read regulator status rc=%d\n", rc);
+			goto disable_ldo;
+		}
+		if (reg & VREG_READY_BIT) {
+			pm8008_debug(pm8008_reg, "regulator enabled\n");
+			return 0;
+		}
+	}
+
+	pm8008_err(pm8008_reg, "failed to enable regulator, VREG_READY not set\n");
+	rc = -ETIME;
+
+disable_ldo:
+	pm8008_masked_write(pm8008_reg->regmap,
+			LDO_ENABLE_REG(pm8008_reg->base), ENABLE_BIT, 0);
+
+remove_en:
+	rc2 = pm8008_chip_internal_disable(pm8008_reg);
+	if (rc2 < 0)
+		pm8008_err(pm8008_reg, "failed to disable chip rc=%d\n",
+			rc2);
+
+	return rc;
+}
+
+static int pm8008_regulator_disable(struct regulator_dev *rdev)
+{
+	struct pm8008_regulator *pm8008_reg = rdev_get_drvdata(rdev);
+	int rc;
+
+	if (pm8008_reg->chip->suspended) {
+		if (!pm8008_reg->chip_enabled)
+			return 0;
+		return -EPERM;
+	}
+
+	rc = pm8008_masked_write(pm8008_reg->regmap,
+				LDO_ENABLE_REG(pm8008_reg->base),
+				ENABLE_BIT, 0);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg,
+			"failed to disable regulator rc=%d\n", rc);
+		return rc;
+	}
+
+	/* remove vote from chip enable regulator */
+	rc = pm8008_chip_internal_disable(pm8008_reg);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg, "failed to disable chip rc=%d\n",
+			rc);
+		return rc;
+	}
+
+	pm8008_debug(pm8008_reg, "regulator disabled\n");
+	return 0;
+}
+
+static int pm8008_write_voltage(struct pm8008_regulator *pm8008_reg, int min_uv,
+				int max_uv)
+{
+	int rc = 0, mv;
+	u8 vset_raw[2];
+
+	mv = DIV_ROUND_UP(min_uv, 1000);
+	if (mv * 1000 > max_uv) {
+		pm8008_err(pm8008_reg,
+			"requested voltage above maximum limit\n");
+		return -EINVAL;
+	}
+
+	/*
+	 * Each LSB of regulator is 1mV and the voltage setpoint
+	 * should be multiple of 8mV(step).
+	 */
+	mv = DIV_ROUND_UP(DIV_ROUND_UP(mv, VSET_STEP_MV) * VSET_STEP_MV,
+				VSET_STEP_SIZE_MV);
+
+	vset_raw[0] = mv & 0xff;
+	vset_raw[1] = (mv & 0xff00) >> 8;
+	rc = pm8008_write(pm8008_reg->regmap, LDO_VSET_LB_REG(pm8008_reg->base),
+			vset_raw, 2);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg, "failed to write voltage rc=%d\n", rc);
+		return rc;
+	}
+
+	pm8008_reg->uv = mv * 1000;
+	pm8008_debug(pm8008_reg, "VSET=[%x][%x]\n", vset_raw[1], vset_raw[0]);
+	return 0;
+}
+
+static int pm8008_regulator_set_voltage_time(struct regulator_dev *rdev,
+				int old_uV, int new_uv)
+{
+	struct pm8008_regulator *pm8008_reg = rdev_get_drvdata(rdev);
+
+	return DIV_ROUND_UP(abs(new_uv - old_uV), pm8008_reg->step_rate);
+}
+
+static int pm8008_regulator_set_voltage(struct regulator_dev *rdev,
+				int min_uv, int max_uv, unsigned int *selector)
+{
+	struct pm8008_regulator *pm8008_reg = rdev_get_drvdata(rdev);
+	int rc;
+
+	if (pm8008_reg->chip->suspended) {
+		if (min_uv <= pm8008_reg->uv && pm8008_reg->uv <= max_uv)
+			return 0;
+		return -EPERM;
+	}
+
+	rc = pm8008_write_voltage(pm8008_reg, min_uv, max_uv);
+	if (rc < 0)
+		return rc;
+
+	*selector = DIV_ROUND_UP(min_uv - pm8008_reg->rdesc.min_uV,
+				VSET_STEP_UV);
+
+	pm8008_debug(pm8008_reg, "voltage set to %d\n", min_uv);
+	return 0;
+}
+
+static int pm8008_regulator_set_mode(struct regulator_dev *rdev,
+				unsigned int mode)
+{
+	struct pm8008_regulator *pm8008_reg = rdev_get_drvdata(rdev);
+	int rc;
+	u8 val = LDO_MODE_LPM;
+
+	if (pm8008_reg->chip->suspended) {
+		if (mode == pm8008_reg->mode)
+			return 0;
+		return -EPERM;
+	}
+
+	if (mode == REGULATOR_MODE_NORMAL)
+		val = LDO_MODE_NPM;
+	else if (mode == REGULATOR_MODE_IDLE)
+		val = LDO_MODE_LPM;
+
+	rc = pm8008_masked_write(pm8008_reg->regmap,
+				LDO_MODE_CTL1_REG(pm8008_reg->base),
+				MODE_PRIMARY_MASK, val);
+	if (!rc) {
+		pm8008_debug(pm8008_reg, "mode set to %d\n", val);
+		pm8008_reg->mode = mode;
+	}
+
+	return rc;
+}
+
+static unsigned int pm8008_regulator_get_mode(struct regulator_dev *rdev)
+{
+	struct pm8008_regulator *pm8008_reg = rdev_get_drvdata(rdev);
+	int rc;
+	u8 reg;
+
+	if (pm8008_reg->chip->suspended)
+		return pm8008_reg->mode;
+
+	rc = pm8008_read(pm8008_reg->regmap,
+			LDO_STATUS1_REG(pm8008_reg->base), &reg, 1);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg, "failed to get mode rc=%d\n", rc);
+		return rc;
+	}
+
+	return ((reg & MODE_STATE_MASK) == MODE_STATE_NPM)
+			? REGULATOR_MODE_NORMAL : REGULATOR_MODE_IDLE;
+}
+
+static int pm8008_regulator_set_load(struct regulator_dev *rdev, int load_uA)
+{
+	struct pm8008_regulator *pm8008_reg = rdev_get_drvdata(rdev);
+	int mode;
+
+	if (load_uA >= pm8008_reg->hpm_min_load_ua)
+		mode = REGULATOR_MODE_NORMAL;
+	else
+		mode = REGULATOR_MODE_IDLE;
+
+	return pm8008_regulator_set_mode(rdev, mode);
+}
+
+static const struct regulator_ops pm8008_regulator_ops = {
+	.enable			= pm8008_regulator_enable,
+	.disable		= pm8008_regulator_disable,
+	.is_enabled		= pm8008_regulator_is_enabled,
+	.set_voltage		= pm8008_regulator_set_voltage,
+	.get_voltage		= pm8008_regulator_get_voltage,
+	.list_voltage		= regulator_list_voltage_linear,
+	.set_mode		= pm8008_regulator_set_mode,
+	.get_mode		= pm8008_regulator_get_mode,
+	.set_load		= pm8008_regulator_set_load,
+	.set_voltage_time	= pm8008_regulator_set_voltage_time,
+};
+
+static int pm8008_ldo_cb(struct notifier_block *nb, ulong event, void *data)
+{
+	struct pm8008_regulator *pm8008_reg = container_of(nb,
+						struct pm8008_regulator, nb);
+	u8 val;
+	int rc;
+
+	if (event != REGULATOR_EVENT_OVER_CURRENT)
+		return NOTIFY_OK;
+
+	rc = pm8008_read(pm8008_reg->regmap,
+			 LDO_STATUS1_REG(pm8008_reg->base), &val, 1);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg,
+			"failed to read regulator status rc=%d\n", rc);
+		goto error;
+	}
+
+	if (!(val & VREG_OCP_BIT))
+		return NOTIFY_OK;
+
+	pr_err("OCP triggered on %s\n", pm8008_reg->rdesc.name);
+	/*
+	 * Toggle the OCP_STATUS_CLR bit to re-arm the OCP status for
+	 * the next OCP event
+	 */
+	rc = pm8008_masked_write(pm8008_reg->regmap,
+				 LDO_OCP_CTL1_REG(pm8008_reg->base),
+				 VREG_OCP_STATUS_CLR, VREG_OCP_STATUS_CLR);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg, "failed to write OCP_STATUS_CLR rc=%d\n",
+			   rc);
+		goto error;
+	}
+
+	rc = pm8008_masked_write(pm8008_reg->regmap,
+				 LDO_OCP_CTL1_REG(pm8008_reg->base),
+				 VREG_OCP_STATUS_CLR, 0);
+	if (rc < 0) {
+		pm8008_err(pm8008_reg, "failed to write OCP_STATUS_CLR rc=%d\n",
+			   rc);
+		goto error;
+	}
+
+	/* Notify the consumers about the OCP event */
+	regulator_notifier_call_chain(pm8008_reg->rdev,
+				REGULATOR_EVENT_OVER_CURRENT, NULL);
+
+error:
+	return NOTIFY_OK;
+}
+
+static int pm8008_regulator_register_init(struct pm8008_regulator *pm8008_reg,
+					  const struct regulator_data *reg_data)
+{
+	int i, rc;
+
+	if (!reg_data->reg_init)
+		return 0;
+
+	for (i = 0; i < reg_data->reg_init_size; i++) {
+		rc = pm8008_write(pm8008_reg->regmap,
+			pm8008_reg->base + reg_data->reg_init[i].offset,
+			&reg_data->reg_init[i].data, 1);
+		if (rc < 0)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int pm8008_register_ldo(struct pm8008_regulator *pm8008_reg,
+						const char *name)
+{
+	struct regulator_config reg_config = {};
+	struct regulator_init_data *init_data;
+	struct device *dev = pm8008_reg->dev;
+	struct device_node *reg_node = pm8008_reg->of_node;
+	const struct regulator_data *reg_data;
+	int rc, i, init_voltage, is_enabled;
+	u32 base = 0;
+	u8 reg;
+
+	reg_data = pm8008_reg->pmic_subtype == PM8008_SUBTYPE ? pm8008_reg_data
+							      : pm8010_reg_data;
+
+	/* get regulator data */
+	for (i = 0; i < PM8008_MAX_LDO; i++)
+		if (strnstr(name, reg_data[i].name, strlen(name)))
+			break;
+
+	if (i == PM8008_MAX_LDO) {
+		pr_err("Invalid regulator name %s\n", name);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32(reg_node, "reg", &base);
+	if (rc < 0) {
+		pr_err("%s: failed to get regulator base rc=%d\n", name, rc);
+		return rc;
+	}
+	pm8008_reg->base = base;
+
+	rc = pm8008_regulator_register_init(pm8008_reg, &reg_data[i]);
+	if (rc)
+		return rc;
+
+	pm8008_reg->hpm_min_load_ua = reg_data[i].hpm_min_load_ua;
+	of_property_read_u32(reg_node, "qcom,hpm-min-load",
+						&pm8008_reg->hpm_min_load_ua);
+	init_voltage = -EINVAL;
+	of_property_read_u32(reg_node, "qcom,init-voltage", &init_voltage);
+
+	if (of_property_read_bool(reg_node, "qcom,strong-pd")) {
+		rc = pm8008_masked_write(pm8008_reg->regmap,
+				LDO_PD_CTL_REG(pm8008_reg->base),
+				STRONG_PD_EN_BIT, STRONG_PD_EN_BIT);
+		if (rc < 0) {
+			pr_err("%s: failed to configure pull down rc=%d\n",
+				name, rc);
+			return rc;
+		}
+	}
+
+	if (pm8008_reg->enable_ocp_broadcast) {
+		rc = pm8008_masked_write(pm8008_reg->regmap,
+				LDO_OCP_CTL1_REG(pm8008_reg->base),
+				LDO_OCP_BROADCAST_EN_BIT,
+				LDO_OCP_BROADCAST_EN_BIT);
+		if (rc < 0) {
+			pr_err("%s: failed to configure ocp broadcast rc=%d\n",
+				name, rc);
+			return rc;
+		}
+	}
+
+	/* get slew rate */
+	if (pm8008_reg->pmic_subtype == PM8008_SUBTYPE) {
+		rc = pm8008_read(pm8008_reg->regmap,
+				LDO_STEPPER_CTL_REG(pm8008_reg->base), &reg, 1);
+		if (rc < 0) {
+			pr_err("%s: failed to read step rate configuration rc=%d\n",
+					name, rc);
+			return rc;
+		}
+		pm8008_reg->step_rate = 38400 >> (reg & STEP_RATE_MASK);
+	} else {
+		pm8008_reg->step_rate = PM8010_STEP_RATE;
+	}
+
+	init_data = of_get_regulator_init_data(dev, reg_node,
+						&pm8008_reg->rdesc);
+	if (init_data == NULL) {
+		pr_err("%s: failed to get regulator data\n", name);
+		return -ENODATA;
+	}
+	if (!init_data->constraints.name) {
+		pr_err("%s: regulator name missing\n", name);
+		return -EINVAL;
+	}
+
+	/* configure the initial voltage for the regulator */
+	if (init_voltage > 0) {
+		rc = pm8008_write_voltage(pm8008_reg, init_voltage,
+					init_data->constraints.max_uV);
+		if (rc < 0)
+			pr_err("%s: failed to set initial voltage rc=%d\n",
+					name, rc);
+	}
+
+	init_data->constraints.input_uV = init_data->constraints.max_uV;
+	init_data->constraints.valid_ops_mask |= REGULATOR_CHANGE_STATUS
+						| REGULATOR_CHANGE_VOLTAGE
+						| REGULATOR_CHANGE_MODE
+						| REGULATOR_CHANGE_DRMS;
+	reg_config.dev = dev;
+	reg_config.init_data = init_data;
+	reg_config.driver_data = pm8008_reg;
+	reg_config.of_node = reg_node;
+
+	pm8008_reg->rdesc.type = REGULATOR_VOLTAGE;
+	pm8008_reg->rdesc.ops = &pm8008_regulator_ops;
+	pm8008_reg->rdesc.name = init_data->constraints.name;
+	pm8008_reg->rdesc.supply_name = reg_data[i].supply_name;
+	pm8008_reg->rdesc.uV_step = VSET_STEP_UV;
+	pm8008_reg->rdesc.min_uV = reg_data[i].min_uv;
+	pm8008_reg->rdesc.n_voltages
+		= ((reg_data[i].max_uv - reg_data[i].min_uv)
+			/ pm8008_reg->rdesc.uV_step) + 1;
+
+	pm8008_reg->rdesc.min_dropout_uV = reg_data[i].min_dropout_uv;
+	of_property_read_u32(reg_node, "qcom,min-dropout-voltage",
+			     &pm8008_reg->rdesc.min_dropout_uV);
+
+	is_enabled = _pm8008_regulator_is_enabled(pm8008_reg);
+	if (is_enabled < 0) {
+		return is_enabled;
+	} else if (is_enabled) {
+		rc = pm8008_chip_internal_enable(pm8008_reg);
+		if (rc)
+			return rc;
+	}
+
+	pm8008_reg->rdev = devm_regulator_register(dev, &pm8008_reg->rdesc,
+						&reg_config);
+	if (IS_ERR(pm8008_reg->rdev)) {
+		rc = PTR_ERR(pm8008_reg->rdev);
+		pr_err("%s: failed to register regulator rc=%d\n",
+				pm8008_reg->rdesc.name, rc);
+		return rc;
+	}
+
+	pm8008_reg->uv = pm8008_regulator_get_voltage(pm8008_reg->rdev);
+	pm8008_reg->mode = pm8008_regulator_get_mode(pm8008_reg->rdev);
+
+	if (pm8008_reg->enable_ocp_broadcast) {
+		pm8008_reg->nb.notifier_call = pm8008_ldo_cb;
+		rc = devm_regulator_register_notifier(pm8008_reg->en_supply,
+						 &pm8008_reg->nb);
+		if (rc < 0) {
+			pr_err("Failed to register a regulator notifier rc=%d\n",
+				rc);
+			return rc;
+		}
+	}
+
+	rc = devm_regulator_debug_register(dev, pm8008_reg->rdev);
+	if (rc)
+		pr_err("failed to register debug regulator rc=%d\n", rc);
+
+	pr_debug("%s regulator registered\n", name);
+
+	return 0;
+}
+
+static const struct of_device_id pm8008_regulator_match_table[] = {
+	{
+		.compatible	= "qcom,pm8008-regulator",
+		.data		= (void *)(uintptr_t)PM8008_SUBTYPE,
+	},
+	{
+		.compatible	= "qcom,pm8010-regulator",
+		.data		= (void *)(uintptr_t)PM8010_SUBTYPE,
+	},
+	{ },
+};
+
+/* PMIC probe and helper function */
+static int pm8008_parse_regulator(struct regmap *regmap, struct device *dev)
+{
+	int rc = 0;
+	const char *name;
+	struct device_node *child;
+	struct pm8008_regulator *pm8008_reg;
+	struct regulator *en_supply;
+	struct pm8008_chip *chip;
+	const struct of_device_id *match;
+	enum pmic_subtype pmic_subtype;
+	bool ocp;
+
+	match = of_match_node(pm8008_regulator_match_table, dev->of_node);
+	if (match) {
+		pmic_subtype = (uintptr_t)match->data;
+	} else {
+		dev_err(dev, "could not find compatible string match\n");
+		return -ENODEV;
+	}
+
+	ocp = of_property_read_bool(dev->of_node, "qcom,enable-ocp-broadcast");
+
+	en_supply = devm_regulator_get(dev, "pm8008_en");
+	if (IS_ERR(en_supply)) {
+		rc = PTR_ERR(en_supply);
+		if (rc != -EPROBE_DEFER)
+			dev_err(dev, "failed to get pm8008_en supply\n");
+		return rc;
+	}
+
+	chip = rdev_get_drvdata(en_supply->rdev);
+	if (!chip) {
+		dev_err(dev, "failed to get pm8008_en supply data\n");
+		return -ENODATA;
+	}
+
+	/* parse each subnode and register regulator for regulator child */
+	for_each_available_child_of_node(dev->of_node, child) {
+		pm8008_reg = devm_kzalloc(dev, sizeof(*pm8008_reg), GFP_KERNEL);
+		if (!pm8008_reg)
+			return -ENOMEM;
+
+		pm8008_reg->regmap = regmap;
+		pm8008_reg->of_node = child;
+		pm8008_reg->dev = dev;
+		pm8008_reg->enable_ocp_broadcast = ocp;
+		pm8008_reg->en_supply = en_supply;
+		pm8008_reg->chip = chip;
+		pm8008_reg->pmic_subtype = pmic_subtype;
+
+		rc = of_property_read_string(child, "regulator-name", &name);
+		if (rc)
+			continue;
+
+		rc = pm8008_register_ldo(pm8008_reg, name);
+		if (rc < 0) {
+			pr_err("failed to register regulator %s rc=%d\n",
+					name, rc);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int pm8008_regulator_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+	struct regmap *regmap;
+
+	regmap = dev_get_regmap(pdev->dev.parent, NULL);
+	if (!regmap) {
+		pr_err("parent regmap is missing\n");
+		return -EINVAL;
+	}
+
+	rc = pm8008_parse_regulator(regmap, &pdev->dev);
+	if (rc < 0) {
+		pr_err("failed to parse device tree rc=%d\n", rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+/* PM8008 chip enable regulator callbacks */
+static int pm8008_chip_enable(struct regulator_dev *rdev)
+{
+	struct pm8008_chip *chip = rdev_get_drvdata(rdev);
+	int rc;
+
+	if (chip->suspended) {
+		if (chip->framework_enabled)
+			return 0;
+		return -EPERM;
+	}
+
+	mutex_lock(&chip->lock);
+	chip->framework_enabled = true;
+	rc = pm8008_chip_aggregate(chip);
+	if (rc < 0)
+		chip->framework_enabled = false;
+	mutex_unlock(&chip->lock);
+
+	return rc;
+}
+
+static int pm8008_chip_disable(struct regulator_dev *rdev)
+{
+	struct pm8008_chip *chip = rdev_get_drvdata(rdev);
+	int rc;
+
+	if (chip->suspended) {
+		if (!chip->framework_enabled)
+			return 0;
+		return -EPERM;
+	}
+
+	mutex_lock(&chip->lock);
+	chip->framework_enabled = false;
+	rc = pm8008_chip_aggregate(chip);
+	if (rc < 0)
+		chip->framework_enabled = true;
+	mutex_unlock(&chip->lock);
+
+	return rc;
+}
+
+static int pm8008_chip_is_enabled(struct regulator_dev *rdev)
+{
+	struct pm8008_chip *chip = rdev_get_drvdata(rdev);
+
+	return chip->framework_enabled;
+}
+
+static const struct regulator_ops pm8008_chip_ops = {
+	.enable = pm8008_chip_enable,
+	.disable = pm8008_chip_disable,
+	.is_enabled = pm8008_chip_is_enabled,
+};
+
+static int _pm8008_chip_is_enabled(struct pm8008_chip *chip)
+{
+	int rc;
+	u8 reg;
+
+	rc = pm8008_read(chip->regmap, MISC_CHIP_ENABLE_REG, &reg, 1);
+	if (rc < 0) {
+		pm8008_err(chip, "failed to get chip state rc=%d\n", rc);
+		return rc;
+	}
+
+	return !!(reg & CHIP_ENABLE_BIT);
+}
+
+static int pm8008_chip_init_regulator(struct pm8008_chip *chip)
+{
+	struct regulator_config cfg = {};
+	int rc = 0;
+
+	cfg.dev = chip->dev;
+	cfg.driver_data = chip;
+
+	chip->rdesc.type = REGULATOR_VOLTAGE;
+	chip->rdesc.ops = &pm8008_chip_ops;
+	chip->rdesc.of_match = "qcom,pm8008-chip-en";
+	chip->rdesc.name = "qcom,pm8008-chip-en";
+
+	/*
+	 * Cache the physical hardware state in framework_enabled and
+	 * aggr_enabled so that the regulator is automatically disabled if no
+	 * framework or internal enable requests are made.
+	 */
+	rc = _pm8008_chip_is_enabled(chip);
+	if (rc < 0)
+		return rc;
+	chip->framework_enabled = rc;
+	chip->aggr_enabled = chip->framework_enabled;
+
+	chip->rdev = devm_regulator_register(chip->dev, &chip->rdesc, &cfg);
+	if (IS_ERR(chip->rdev)) {
+		rc = PTR_ERR(chip->rdev);
+		chip->rdev = NULL;
+		return rc;
+	}
+
+	rc = devm_regulator_debug_register(chip->dev, chip->rdev);
+	if (rc)
+		pr_err("failed to register debug regulator rc=%d\n", rc);
+
+	return 0;
+}
+
+static irqreturn_t pm8008_ocp_irq(int irq, void *_chip)
+{
+	struct pm8008_chip *chip = _chip;
+
+	regulator_notifier_call_chain(chip->rdev, REGULATOR_EVENT_OVER_CURRENT,
+				      NULL);
+
+	return IRQ_HANDLED;
+}
+
+static int pm8008_chip_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+	struct pm8008_chip *chip;
+
+	chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
+	if (!chip)
+		return -ENOMEM;
+
+	chip->regmap = dev_get_regmap(pdev->dev.parent, NULL);
+	if (!chip->regmap) {
+		pr_err("parent regmap is missing\n");
+		return -EINVAL;
+	}
+	chip->dev = &pdev->dev;
+	mutex_init(&chip->lock);
+
+	/* Register chip enable regulator */
+	rc = pm8008_chip_init_regulator(chip);
+	if (rc < 0) {
+		pr_err("Failed to register chip enable regulator rc=%d\n", rc);
+		return rc;
+	}
+
+	chip->ocp_irq = of_irq_get_byname(chip->dev->of_node, "ocp");
+	if (chip->ocp_irq < 0) {
+		pr_debug("Failed to get pm8008-ocp-irq\n");
+	} else {
+		rc = devm_request_threaded_irq(chip->dev, chip->ocp_irq, NULL,
+				pm8008_ocp_irq, IRQF_ONESHOT,
+				"ocp", chip);
+		if (rc < 0) {
+			pr_err("Failed to request 'pm8008-ocp-irq' rc=%d\n",
+				rc);
+			return rc;
+		}
+
+		/* Ignore PMIC shutdown for LDO OCP event */
+		rc = pm8008_masked_write(chip->regmap, MISC_SHUTDOWN_CTRL_REG,
+			IGNORE_LDO_OCP_SHUTDOWN, IGNORE_LDO_OCP_SHUTDOWN);
+		if (rc < 0) {
+			pr_err("Failed to write MISC_SHUTDOWN register rc=%d\n",
+				rc);
+			return rc;
+		}
+	}
+
+	platform_set_drvdata(pdev, chip);
+	pr_debug("PM8008 chip registered\n");
+	return 0;
+}
+
+static int pm8008_chip_remove(struct platform_device *pdev)
+{
+	struct pm8008_chip *chip = platform_get_drvdata(pdev);
+	int rc;
+
+	rc = pm8008_masked_write(chip->regmap, MISC_CHIP_ENABLE_REG,
+				CHIP_ENABLE_BIT, 0);
+	if (rc  < 0)
+		pr_err("failed to disable chip rc=%d\n", rc);
+
+	return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int pm8008_chip_suspend(struct device *dev)
+{
+	struct pm8008_chip *chip = dev_get_drvdata(dev);
+
+	chip->suspended = true;
+
+	return 0;
+}
+
+static int pm8008_chip_resume(struct device *dev)
+{
+	struct pm8008_chip *chip = dev_get_drvdata(dev);
+
+	chip->suspended = false;
+
+	return 0;
+}
+#endif
+
+static struct platform_driver pm8008_regulator_driver = {
+	.driver	= {
+		.name		= "qcom,pm8008-regulator",
+		.of_match_table	= pm8008_regulator_match_table,
+	},
+	.probe		= pm8008_regulator_probe,
+};
+
+static const struct of_device_id pm8008_chip_match_table[] = {
+	{
+		.compatible	= "qcom,pm8008-chip",
+	},
+	{ },
+};
+
+static const struct dev_pm_ops pm8008_chip_pm_ops = {
+	SET_SYSTEM_SLEEP_PM_OPS(pm8008_chip_suspend, pm8008_chip_resume)
+};
+
+static struct platform_driver pm8008_chip_driver = {
+	.driver	= {
+		.name		= "qcom,pm8008-chip",
+		.pm		= &pm8008_chip_pm_ops,
+		.of_match_table	= pm8008_chip_match_table,
+	},
+	.probe		= pm8008_chip_probe,
+	.remove		= pm8008_chip_remove,
+};
+
+static int __init pm8008_regulator_init(void)
+{
+	int rc;
+
+	rc = platform_driver_register(&pm8008_chip_driver);
+	if (rc)
+		return rc;
+
+	return platform_driver_register(&pm8008_regulator_driver);
+}
+module_init(pm8008_regulator_init);
+
+static void __exit pm8008_regulator_exit(void)
+{
+	platform_driver_unregister(&pm8008_regulator_driver);
+	platform_driver_unregister(&pm8008_chip_driver);
+}
+module_exit(pm8008_regulator_exit);
+
+MODULE_DESCRIPTION("QPNP PM8008 PMIC Regulator Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/regulator/qpnp-lcdb-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/qpnp-lcdb-regulator.c
@@ -0,0 +1,2846 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt)	"LCDB: %s: " fmt, __func__
+
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/interrupt.h>
+#include <linux/ktime.h>
+#include <linux/module.h>
+#include <linux/of_irq.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <linux/of_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/of_regulator.h>
+#include <linux/regulator/machine.h>
+
+#define QPNP_LCDB_REGULATOR_DRIVER_NAME		"qcom,qpnp-lcdb-regulator"
+#define QPNP_LCDB_REGULATOR_DRIVER_660		"qcom,lcdb-pm660"
+#define QPNP_LCDB_REGULATOR_DRIVER_632	"qcom,lcdb-pmi632"
+#define QPNP_LCDB_REGULATOR_DRIVER_6150L	"qcom,lcdb-pm6150l"
+#define QPNP_LCDB_REGULATOR_DRIVER_7325B	"qcom,lcdb-pm7325b"
+
+/* LCDB */
+#define LCDB_REVISION3_REG			0x02
+#define LCDB_REVISION4_REG			0x03
+
+#define LCDB_STS1_REG			0x08
+
+#define INT_RT_STATUS_REG		0x10
+#define VREG_OK_RT_STS_BIT		BIT(0)
+#define SC_ERROR_RT_STS_BIT		BIT(1)
+
+#define LCDB_STS3_REG			0x0A
+#define LDO_VREG_OK_BIT			BIT(7)
+
+#define LCDB_STS4_REG			0x0B
+#define NCP_VREG_OK_BIT			BIT(7)
+
+#define LCDB_AUTO_TOUCH_WAKE_CTL_REG	0x40
+#define EN_AUTO_TOUCH_WAKE_BIT		BIT(7)
+#define ATTW_TOFF_TIME_MASK		GENMASK(3, 2)
+#define ATTW_TON_TIME_MASK		GENMASK(1, 0)
+#define ATTW_TOFF_TIME_SHIFT		2
+#define ATTW_MIN_MS			4
+#define ATTW_MAX_MS			32
+
+#define LCDB_BST_OUTPUT_VOLTAGE_REG	0x41
+#define PM660_BST_OUTPUT_VOLTAGE_MASK	GENMASK(4, 0)
+#define BST_OUTPUT_VOLTAGE_MASK		GENMASK(5, 0)
+#define PM7325B_BST_OUTPUT_VOLTAGE_MASK		GENMASK(7, 0)
+
+#define LCDB_STEPPER_VOUT_CTL_REG		0x42
+#define VOUT_STEP_DLY_2US		0x4
+
+#define LCDB_CONFIG_SEL_REG		0x43
+#define EN_FAST_STARTUP_BIT			BIT(7)
+#define PDN_CONFIG_SEL_BIT			BIT(4)
+#define PWRUP_CONFIG_SEL_MASK		GENMASK(2, 0)
+#define PWRUP_CONFIG_MAX		0x4
+
+#define LCDB_MODULE_RDY_REG		0x45
+#define MODULE_RDY_BIT			BIT(7)
+
+#define LCDB_ENABLE_CTL1_REG		0x46
+#define MODULE_EN_BIT			BIT(7)
+#define HWEN_RDY_BIT			BIT(6)
+
+/* BST */
+#define LCDB_BST_PD_CTL_REG		0x47
+#define BOOST_DIS_PULLDOWN_BIT		BIT(1)
+#define BOOST_PD_STRENGTH_BIT		BIT(0)
+#define PM7325B_BOOST_EN_PULLDOWN_BIT		BIT(7)
+
+#define LCDB_BST_ILIM_CTL_REG		0x4B
+#define EN_BST_ILIM_BIT			BIT(7)
+#define SET_BST_ILIM_MASK		GENMASK(2, 0)
+#define MIN_BST_ILIM_MA			200
+#define MAX_BST_ILIM_MA			1600
+#define PM7325B_MIN_BST_ILIM_MA			1130
+#define PM7325B_MAX_BST_ILIM_MA			2250
+#define PM7325B_BST_ILIM_MA_STEP			160
+
+#define LCDB_PS_CTL_REG			0x50
+#define EN_PS_BIT			BIT(7)
+#define PM660_PS_THRESH_MASK		GENMASK(1, 0)
+#define PS_THRESH_MASK			GENMASK(2, 0)
+#define MIN_BST_PS_MA			50
+#define MAX_BST_PS_MA			80
+#define PM7325B_MIN_BST_PS_MV			360
+#define PM7325B_MAX_BST_PS_MV			528
+
+#define LCDB_RDSON_MGMNT_REG		0x53
+#define NFET_SW_SIZE_MASK		GENMASK(3, 2)
+#define NFET_SW_SIZE_SHIFT		2
+#define PFET_SW_SIZE_MASK		GENMASK(1, 0)
+
+#define PM7325B_LCDB_P2_BLANK_TIMER_REG		0x54
+#define HIGH_P2_BLK_SEL_MASK		GENMASK(6, 4)
+#define HIGH_P2_BLK_SEL_SHIFT		4
+#define LOW_P2_BLK_SEL_MASK		GENMASK(2, 0)
+
+#define LCDB_BST_VREG_OK_CTL_REG	0x55
+#define BST_VREG_OK_DEB_MASK		GENMASK(1, 0)
+
+#define PM7325B_LCDB_BST_VREG_OK_CTL_REG	0x56
+
+#define LCDB_BST_SS_CTL_REG		0x5B
+#define BST_SS_TIME_MASK		GENMASK(1, 0)
+#define BST_PRECHG_SHORT_ALARM_SHIFT	2
+#define BST_PRECHARGE_DONE_DEB_BIT	BIT(4)
+#define BST_SS_TIME_OVERRIDE_SHIFT	5
+
+#define BST_SS_TIME_OVERRIDE_0MS	0
+#define BST_SS_TIME_OVERRIDE_0P5_MS	1
+#define BST_SS_TIME_OVERRIDE_1MS	2
+#define BST_SS_TIME_OVERRIDE_2MS	3
+
+#define EN_BST_PRECHG_SHORT_ALARM	0
+#define DIS_BST_PRECHG_SHORT_ALARM	1
+
+#define PM7325B_LCDB_WARMUP_DLY_SEL_1_REG		0x5C
+#define PM7325B_LCDB_WARMUP_DLY_SEL_2_REG		0x5D
+#define PM7325B_LCDB_PRECHARGE_CTL_REG		0x5E
+
+#define LCDB_SOFT_START_CTL_REG		0x5F
+
+#define LCDB_MISC_CTL_REG		0x60
+#define AUTO_GM_EN_BIT			BIT(4)
+#define EN_TOUCH_WAKE_BIT		BIT(3)
+#define DIS_SCP_BIT			BIT(0)
+
+#define PM7325B_LCDB_MPC_CTL_REG		0x60
+#define MPC_NCP_SD_SEL_MASK		GENMASK(2, 0)
+#define MPC_CURRENT_MIN		160
+#define MPC_CURRENT_MAX		440
+#define MPC_CURRENT_STEP		40
+
+#define LCDB_PFM_CTL_REG		0x62
+#define EN_PFM_BIT			BIT(7)
+#define BYP_BST_SOFT_START_COMP_BIT	BIT(0)
+#define PFM_HYSTERESIS_SHIFT		4
+#define PFM_CURRENT_SHIFT		2
+
+#define LCDB_PWRUP_PWRDN_CTL_REG	0x66
+#define PWRUP_DELAY_MASK		GENMASK(3, 2)
+#define PWRDN_DELAY_MASK		GENMASK(1, 0)
+#define PWRUP_DELAY_SHIFT				2
+#define PWRDN_DELAY_MIN_MS		0
+#define PWRDN_DELAY_MAX_MS		8
+
+/* LDO */
+#define LCDB_LDO_OUTPUT_VOLTAGE_REG	0x71
+#define SET_OUTPUT_VOLTAGE_MASK		GENMASK(4, 0)
+#define PM7325B_SET_OUTPUT_VOLTAGE_MASK	GENMASK(5, 0)
+
+#define LCDB_LDO_VREG_OK_CTL_REG	0x75
+#define VREG_OK_DEB_MASK		GENMASK(1, 0)
+
+#define LCDB_LDO_PD_CTL_REG		0x77
+#define LDO_DIS_PULLDOWN_BIT		BIT(1)
+#define LDO_PD_STRENGTH_BIT		BIT(0)
+#define PM7325B_LDO_EN_PULLDOWN_BIT		BIT(7)
+
+#define LCDB_LDO_FORCE_PD_CTL_REG	0x79
+#define LDO_FORCE_PD_EN_BIT		BIT(0)
+#define LDO_FORCE_PD_MODE		BIT(7)
+
+#define LCDB_LDO_ILIM_CTL1_REG		0x7B
+#define EN_LDO_ILIM_BIT			BIT(7)
+#define SET_LDO_ILIM_MASK		GENMASK(2, 0)
+#define SET_LDO_ILIM_MASK_SD		GENMASK(6, 4)
+#define SET_LDO_ILIM_MASK_SD_SHIFT	4
+#define MIN_LDO_ILIM_MA			110
+#define MAX_LDO_ILIM_MA			460
+#define PM7325B_MIN_LDO_ILIM_MA			35
+#define PM7325B_MAX_LDO_ILIM_MA			840
+#define LDO_ILIM_STEP_MA		50
+
+#define LCDB_LDO_ILIM_CTL2_REG		0x7C
+
+#define LCDB_LDO_SOFT_START_CTL_REG	0x7F
+#define SOFT_START_MASK			GENMASK(1, 0)
+
+/* NCP */
+#define LCDB_NCP_OUTPUT_VOLTAGE_REG	0x81
+#define EN_NCP_VOUT_SYMMETRY_BIT		BIT(7)
+
+#define LCDB_NCP_VREG_OK_CTL_REG	0x85
+
+#define LCDB_NCP_PD_CTL_REG		0x87
+#define NCP_DIS_PULLDOWN_BIT		BIT(1)
+#define NCP_PD_STRENGTH_BIT		BIT(0)
+#define PM7325B_EN_NCP_PULLDOWN_BIT		BIT(1)
+#define PM7325B_EN_PD_SYMMETRY_BIT			BIT(7)
+
+#define LCDB_NCP_ILIM_CTL1_REG		0x8B
+#define EN_NCP_ILIM_BIT			BIT(7)
+#define SET_NCP_ILIM_MASK		GENMASK(1, 0)
+#define PM7325B_SET_NCP_ILIM_SD_MASK		GENMASK(5, 4)
+#define MIN_NCP_ILIM_MA			260
+#define MAX_NCP_ILIM_MA			810
+#define PM7325B_MIN_NCP_ILIM_MA			700
+#define PM7325B_MAX_NCP_ILIM_MA			1000
+
+#define LCDB_NCP_ILIM_CTL2_REG		0x8C
+
+#define LCDB_NCP_SOFT_START_CTL_REG	0x8F
+
+/* common for BST/NCP/LDO */
+#define MIN_DBC_US			2
+#define MAX_DBC_US			32
+
+#define MIN_SOFT_START_US		0
+#define MAX_SOFT_START_US		2000
+
+#define PM660_BST_HEADROOM_DEFAULT_MV	200
+#define BST_HEADROOM_DEFAULT_MV		150
+
+#define PMIC5_LCDB_OFF_ON_DELAY_US	20000
+
+struct ldo_regulator {
+	struct regulator_desc		rdesc;
+	struct regulator_dev		*rdev;
+	struct device_node		*node;
+
+	/* LDO DT params */
+	int				pd;
+	int				pd_strength;
+	int				ilim_ma;
+	int				soft_start_us;
+	int				vreg_ok_dbc_us;
+	int				voltage_mv;
+	int				prev_voltage_mv;
+};
+
+struct ncp_regulator {
+	struct regulator_desc		rdesc;
+	struct regulator_dev		*rdev;
+	struct device_node		*node;
+
+	/* NCP DT params */
+	int				pd;
+	int				pd_strength;
+	int				ilim_ma;
+	int				soft_start_us;
+	int				vreg_ok_dbc_us;
+	int				voltage_mv;
+	int				prev_voltage_mv;
+};
+
+struct bst_params {
+	struct device_node		*node;
+
+	/* BST DT params */
+	int				pd;
+	int				pd_strength;
+	int				ilim_ma;
+	int				ps;
+	int				ps_threshold;
+	int				soft_start_us;
+	int				vreg_ok_dbc_us;
+	int				voltage_mv;
+	u16				headroom_mv;
+};
+
+enum pmic_type {
+	PM_DEFAULT,
+	PM660L,
+	PMI632,
+	PM6150L,
+	PM7325B,
+};
+
+struct qpnp_lcdb {
+	struct device			*dev;
+	struct platform_device		*pdev;
+	struct regmap			*regmap;
+	enum pmic_type			subtype;
+	u32				base;
+	u32				wa_flags;
+	int				sc_irq;
+	int				pwrdn_delay_ms;
+	int				pwrup_delay_ms;
+	int				min_voltage_mv;
+	int				max_voltage_mv;
+	int				pwrup_config;
+	int				high_p2_blk_ns;
+	int				low_p2_blk_ns;
+	int				mpc_current_thr_ma;
+	bool			ncp_symmetry;
+
+	/* TTW params */
+	bool				ttw_enable;
+	bool				ttw_mode_sw;
+
+	/* status parameters */
+	bool				lcdb_enabled;
+	bool				settings_saved;
+	bool				lcdb_sc_disable;
+	bool				voltage_step_ramp;
+	int				sc_count;
+	ktime_t				sc_module_enable_time;
+
+	struct mutex			lcdb_mutex;
+	struct mutex			read_write_mutex;
+	struct bst_params		bst;
+	struct ldo_regulator		ldo;
+	struct ncp_regulator		ncp;
+};
+
+struct settings {
+	u16	address;
+	u8	value;
+	bool	sec_access;
+	bool	valid;
+};
+
+enum lcdb_module {
+	LDO,
+	NCP,
+	BST,
+	LDO_NCP,
+};
+
+enum pfm_hysteresis {
+	PFM_HYST_15MV,
+	PFM_HYST_25MV,
+	PFM_HYST_35MV,
+	PFM_HYST_45MV,
+};
+
+enum pfm_peak_current {
+	PFM_PEAK_CURRENT_300MA,
+	PFM_PEAK_CURRENT_400MA,
+	PFM_PEAK_CURRENT_500MA,
+	PFM_PEAK_CURRENT_600MA,
+};
+
+enum rdson_fet_size {
+	RDSON_QUARTER,
+	RDSON_HALF,
+	RDSON_THREE_FOURTH,
+	RDSON_FULLSIZE,
+};
+
+enum lcdb_settings_index {
+	LCDB_BST_PD_CTL = 0,
+	LCDB_RDSON_MGMNT,
+	LCDB_MISC_CTL,
+	LCDB_SOFT_START_CTL,
+	LCDB_PFM_CTL,
+	LCDB_PWRUP_PWRDN_CTL,
+	LCDB_LDO_PD_CTL,
+	LCDB_LDO_SOFT_START_CTL,
+	LCDB_NCP_PD_CTL,
+	LCDB_NCP_SOFT_START_CTL,
+	LCDB_BST_SS_CTL,
+	LCDB_LDO_VREG_OK_CTL,
+	LCDB_STEPPER_VOUT_CTL,
+	LCDB_CONFIG_SEL,
+	PM7325B_LCDB_BST_VREG_OK_CTL,
+	PM7325B_LCDB_WARMUP_DLY_SEL_1,
+	PM7325B_LCDB_WARMUP_DLY_SEL_2,
+	PM7325B_LCDB_PRECHARGE_CTL,
+	LCDB_SETTING_MAX,
+};
+
+enum lcdb_wa_flags {
+	NCP_SCP_DISABLE_WA = BIT(0),
+	FORCE_PD_ENABLE_WA = BIT(1),
+};
+
+static const u32 soft_start_us[] = {
+	0,
+	500,
+	1000,
+	2000,
+};
+
+static const u32 dbc_us[] = {
+	2,
+	4,
+	16,
+	32,
+};
+
+static const u32 ncp_ilim_ma[] = {
+	260,
+	460,
+	640,
+	810,
+};
+
+static const u32 pwrup_pwrdn_ms[] = {
+	0,
+	1,
+	4,
+	8,
+};
+
+static const u32 ncp_dbc_us[] = {
+	64,
+	128,
+	256,
+	512,
+};
+
+static const u32 bst_dbc_us[] = {
+	4,
+	8,
+	16,
+	32,
+};
+
+static const u32 pm7325b_ncp_ilim_ma[] = {
+	700,
+	800,
+	900,
+	1000,
+};
+
+static const u32 pm7325b_ldo_ilim_ma[] = {
+	35,
+	175,
+	280,
+	420,
+	455,
+	595,
+	700,
+	840,
+};
+
+static const u32 pm7325b_p2_blk_ns[] = {
+	40,
+	69,
+	99,
+	129,
+	159,
+	189,
+	220,
+	250,
+};
+
+#define SETTING(_id, _sec_access, _valid)	\
+	[_id] = {				\
+		.address = _id##_REG,		\
+		.sec_access = _sec_access,	\
+		.valid = _valid			\
+	}					\
+
+static int qpnp_lcdb_set_voltage_step(struct qpnp_lcdb *lcdb,
+				      int voltage_start_mv, u8 type);
+
+static int qpnp_lcdb_set_voltage(struct qpnp_lcdb *lcdb,
+				 int voltage_mv, u8 type);
+
+static bool is_between(int value, int min, int max)
+{
+	if (value < min || value > max)
+		return false;
+	return true;
+}
+
+static int qpnp_lcdb_read(struct qpnp_lcdb *lcdb,
+			u16 addr, u8 *value, u8 count)
+{
+	int rc = 0;
+
+	mutex_lock(&lcdb->read_write_mutex);
+	rc = regmap_bulk_read(lcdb->regmap, addr, value, count);
+	if (rc < 0)
+		pr_err("Failed to read from addr=0x%02x rc=%d\n", addr, rc);
+	mutex_unlock(&lcdb->read_write_mutex);
+
+	return rc;
+}
+
+static int qpnp_lcdb_write(struct qpnp_lcdb *lcdb,
+			u16 addr, u8 *value, u8 count)
+{
+	int rc;
+
+	mutex_lock(&lcdb->read_write_mutex);
+	rc = regmap_bulk_write(lcdb->regmap, addr, value, count);
+	if (rc < 0)
+		pr_err("Failed to write to addr=0x%02x rc=%d\n", addr, rc);
+	mutex_unlock(&lcdb->read_write_mutex);
+
+	return rc;
+}
+
+#define SEC_ADDRESS_REG			0xD0
+#define SECURE_UNLOCK_VALUE		0xA5
+static int qpnp_lcdb_secure_write(struct qpnp_lcdb *lcdb,
+					u16 addr, u8 value)
+{
+	int rc;
+	u8 val = SECURE_UNLOCK_VALUE;
+
+	mutex_lock(&lcdb->read_write_mutex);
+	if (lcdb->subtype == PM660L) {
+		rc = regmap_write(lcdb->regmap, lcdb->base + SEC_ADDRESS_REG,
+				  val);
+		if (rc < 0) {
+			pr_err("Failed to unlock register rc=%d\n", rc);
+			goto fail_write;
+		}
+	}
+	rc = regmap_write(lcdb->regmap, addr, value);
+	if (rc < 0)
+		pr_err("Failed to write to addr=0x%02x rc=%d\n", addr, rc);
+
+fail_write:
+	mutex_unlock(&lcdb->read_write_mutex);
+	return rc;
+}
+
+static int qpnp_lcdb_masked_write(struct qpnp_lcdb *lcdb,
+				u16 addr, u8 mask, u8 value)
+{
+	int rc = 0;
+
+	mutex_lock(&lcdb->read_write_mutex);
+	rc = regmap_update_bits(lcdb->regmap, addr, mask, value);
+	if (rc < 0)
+		pr_err("Failed to write addr=0x%02x value=0x%02x rc=%d\n",
+			addr, value, rc);
+	mutex_unlock(&lcdb->read_write_mutex);
+
+	return rc;
+}
+
+static bool is_lcdb_enabled(struct qpnp_lcdb *lcdb)
+{
+	int rc;
+	u8 val = 0;
+
+	rc = qpnp_lcdb_read(lcdb, lcdb->base + LCDB_ENABLE_CTL1_REG, &val, 1);
+	if (rc < 0)
+		pr_err("Failed to read ENABLE_CTL1 rc=%d\n", rc);
+
+	return rc ? false : !!(val & MODULE_EN_BIT);
+}
+
+static int dump_status_registers(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0, len = (lcdb->subtype == PM7325B) ? 5 : 6;
+	u8 sts[6] = {0};
+
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_STS1_REG, &sts[0], len);
+	if (rc < 0) {
+		pr_err("Failed to write to STS registers rc=%d\n", rc);
+	} else {
+		rc = qpnp_lcdb_read(lcdb, lcdb->base + LCDB_STS1_REG, sts, len);
+		if (rc < 0)
+			pr_err("Failed to read lcdb status rc=%d\n", rc);
+		else {
+			pr_err("STS1=0x%02x STS2=0x%02x STS3=0x%02x STS4=0x%02x STS5=0x%02x\n",
+				sts[0], sts[1], sts[2], sts[3], sts[4]);
+			if (lcdb->subtype != PM7325B)
+				pr_err("STS6=0x%02x\n", sts[5]);
+		}
+	}
+
+	return rc;
+}
+
+static struct settings lcdb_settings_pm660l[] = {
+	SETTING(LCDB_BST_PD_CTL, false, true),
+	SETTING(LCDB_RDSON_MGMNT, false, true),
+	SETTING(LCDB_MISC_CTL, false, true),
+	SETTING(LCDB_SOFT_START_CTL, false, true),
+	SETTING(LCDB_PFM_CTL, false, true),
+	SETTING(LCDB_PWRUP_PWRDN_CTL, true, true),
+	SETTING(LCDB_LDO_PD_CTL, false, true),
+	SETTING(LCDB_LDO_SOFT_START_CTL, false, true),
+	SETTING(LCDB_NCP_PD_CTL, false, true),
+	SETTING(LCDB_NCP_SOFT_START_CTL, false, true),
+	SETTING(LCDB_BST_SS_CTL, false, false),
+	SETTING(LCDB_LDO_VREG_OK_CTL, false, false),
+};
+
+/* For PMICs like pmi632/pm8150L */
+static struct settings lcdb_settings[] = {
+	SETTING(LCDB_BST_PD_CTL, false, true),
+	SETTING(LCDB_RDSON_MGMNT, false, false),
+	SETTING(LCDB_MISC_CTL, false, false),
+	SETTING(LCDB_SOFT_START_CTL, false, false),
+	SETTING(LCDB_PFM_CTL, false, false),
+	SETTING(LCDB_PWRUP_PWRDN_CTL, false, true),
+	SETTING(LCDB_LDO_PD_CTL, false, true),
+	SETTING(LCDB_LDO_SOFT_START_CTL, false, true),
+	SETTING(LCDB_NCP_PD_CTL, false, true),
+	SETTING(LCDB_NCP_SOFT_START_CTL, false, true),
+	SETTING(LCDB_BST_SS_CTL, false, true),
+	SETTING(LCDB_LDO_VREG_OK_CTL, false, true),
+};
+
+static struct settings lcdb_settings_pm7325b[] = {
+	SETTING(LCDB_BST_PD_CTL, false, true),
+	SETTING(LCDB_RDSON_MGMNT, false, false),
+	SETTING(LCDB_MISC_CTL, false, false),
+	SETTING(LCDB_SOFT_START_CTL, false, false),
+	SETTING(LCDB_PFM_CTL, false, false),
+	SETTING(LCDB_PWRUP_PWRDN_CTL, false, false),
+	SETTING(LCDB_LDO_PD_CTL, false, true),
+	SETTING(LCDB_LDO_SOFT_START_CTL, false, true),
+	SETTING(LCDB_NCP_PD_CTL, false, true),
+	SETTING(LCDB_NCP_SOFT_START_CTL, false, true),
+	SETTING(LCDB_BST_SS_CTL, false, true),
+	SETTING(LCDB_LDO_VREG_OK_CTL, false, false),
+	SETTING(PM7325B_LCDB_BST_VREG_OK_CTL, false, true),
+	SETTING(LCDB_STEPPER_VOUT_CTL, false, true),
+	SETTING(LCDB_CONFIG_SEL, false, true),
+	SETTING(PM7325B_LCDB_WARMUP_DLY_SEL_1, false, true),
+	SETTING(PM7325B_LCDB_WARMUP_DLY_SEL_2, false, true),
+	SETTING(PM7325B_LCDB_PRECHARGE_CTL, false, true),
+};
+
+static int qpnp_lcdb_save_settings(struct qpnp_lcdb *lcdb)
+{
+	int i, size, rc = 0;
+	struct settings *setting;
+
+	switch (lcdb->subtype) {
+	case PM660L:
+		setting = lcdb_settings_pm660l;
+		size = ARRAY_SIZE(lcdb_settings_pm660l);
+		break;
+	case PM7325B:
+		setting = lcdb_settings_pm7325b;
+		size = ARRAY_SIZE(lcdb_settings_pm7325b);
+		break;
+	default:
+		setting = lcdb_settings;
+		size = ARRAY_SIZE(lcdb_settings);
+		break;
+	}
+
+	for (i = 0; i < size; i++) {
+		if (setting[i].valid) {
+			rc = qpnp_lcdb_read(lcdb, lcdb->base +
+					    setting[i].address,
+					    &setting[i].value, 1);
+			if (rc < 0) {
+				pr_err("Failed to read lcdb register address=%x\n",
+					setting[i].address);
+				return rc;
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int qpnp_lcdb_restore_settings(struct qpnp_lcdb *lcdb)
+{
+	int i, size, rc = 0;
+	struct settings *setting;
+
+	switch (lcdb->subtype) {
+	case PM660L:
+		setting = lcdb_settings_pm660l;
+		size = ARRAY_SIZE(lcdb_settings_pm660l);
+		break;
+	case PM7325B:
+		setting = lcdb_settings_pm7325b;
+		size = ARRAY_SIZE(lcdb_settings_pm7325b);
+		break;
+	default:
+		setting = lcdb_settings;
+		size = ARRAY_SIZE(lcdb_settings);
+		break;
+	}
+
+	for (i = 0; i < size; i++) {
+		if (setting[i].valid) {
+			if (setting[i].sec_access)
+				rc = qpnp_lcdb_secure_write(lcdb, lcdb->base +
+							    setting[i].address,
+							    setting[i].value);
+			else
+				rc = qpnp_lcdb_write(lcdb, lcdb->base +
+						     setting[i].address,
+						     &setting[i].value, 1);
+			if (rc < 0) {
+				pr_err("Failed to write register address=%x\n",
+					     setting[i].address);
+				return rc;
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int qpnp_lcdb_ttw_enter(struct qpnp_lcdb *lcdb)
+{
+	int rc;
+	u8 val;
+
+	if (!lcdb->settings_saved) {
+		rc = qpnp_lcdb_save_settings(lcdb);
+		if (rc < 0) {
+			pr_err("Failed to save LCDB settings rc=%d\n", rc);
+			return rc;
+		}
+		lcdb->settings_saved = true;
+	}
+
+	val = (BST_SS_TIME_OVERRIDE_1MS << BST_SS_TIME_OVERRIDE_SHIFT) |
+	      (DIS_BST_PRECHG_SHORT_ALARM << BST_PRECHG_SHORT_ALARM_SHIFT);
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_BST_SS_CTL_REG, &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_NCP_SOFT_START_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_LDO_SOFT_START_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_PWRUP_PWRDN_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_BST_VREG_OK_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = BOOST_DIS_PULLDOWN_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_BST_PD_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = LDO_DIS_PULLDOWN_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_LDO_PD_CTL_REG,
+							&val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = NCP_DIS_PULLDOWN_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_NCP_PD_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = HWEN_RDY_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_ENABLE_CTL1_REG,
+			     &val, 1);
+
+	return rc;
+}
+
+static int qpnp_lcdb_ttw_enter_pm660l(struct qpnp_lcdb *lcdb)
+{
+	int rc;
+	u8 val;
+
+	if (!lcdb->settings_saved) {
+		rc = qpnp_lcdb_save_settings(lcdb);
+		if (rc < 0) {
+			pr_err("Failed to save LCDB settings rc=%d\n", rc);
+			return rc;
+		}
+		lcdb->settings_saved = true;
+	}
+
+	val = BOOST_DIS_PULLDOWN_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_BST_PD_CTL_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to set BST PD rc=%d\n", rc);
+		return rc;
+	}
+
+	val = (RDSON_HALF << NFET_SW_SIZE_SHIFT) | RDSON_HALF;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_RDSON_MGMNT_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to set RDSON MGMT rc=%d\n", rc);
+		return rc;
+	}
+
+	val = AUTO_GM_EN_BIT | EN_TOUCH_WAKE_BIT | DIS_SCP_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_MISC_CTL_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to set MISC CTL rc=%d\n", rc);
+		return rc;
+	}
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_SOFT_START_CTL_REG,
+						&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to set LCDB_SOFT_START rc=%d\n", rc);
+		return rc;
+	}
+
+	val = EN_PFM_BIT | (PFM_HYST_25MV << PFM_HYSTERESIS_SHIFT) |
+		     (PFM_PEAK_CURRENT_400MA << PFM_CURRENT_SHIFT) |
+				BYP_BST_SOFT_START_COMP_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_PFM_CTL_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to set PFM_CTL rc=%d\n", rc);
+		return rc;
+	}
+
+	val = 0;
+	rc = qpnp_lcdb_secure_write(lcdb, lcdb->base + LCDB_PWRUP_PWRDN_CTL_REG,
+							val);
+	if (rc < 0) {
+		pr_err("Failed to set PWRUP_PWRDN_CTL rc=%d\n", rc);
+		return rc;
+	}
+
+	val = LDO_DIS_PULLDOWN_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_LDO_PD_CTL_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to set LDO_PD_CTL rc=%d\n", rc);
+		return rc;
+	}
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_LDO_SOFT_START_CTL_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to set LDO_SOFT_START rc=%d\n", rc);
+		return rc;
+	}
+
+	val = NCP_DIS_PULLDOWN_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_NCP_PD_CTL_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to set NCP_PD_CTL rc=%d\n", rc);
+		return rc;
+	}
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_NCP_SOFT_START_CTL_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to set NCP_SOFT_START rc=%d\n", rc);
+		return rc;
+	}
+
+	if (lcdb->ttw_mode_sw) {
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_AUTO_TOUCH_WAKE_CTL_REG,
+				EN_AUTO_TOUCH_WAKE_BIT,
+				EN_AUTO_TOUCH_WAKE_BIT);
+		if (rc < 0)
+			pr_err("Failed to enable auto(sw) TTW\n rc = %d\n", rc);
+	} else {
+		val = HWEN_RDY_BIT;
+		rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_ENABLE_CTL1_REG,
+							&val, 1);
+		if (rc < 0)
+			pr_err("Failed to hw_enable lcdb rc= %d\n", rc);
+	}
+
+	return rc;
+}
+
+static int qpnp_lcdb_ttw_enter_pm7325b(struct qpnp_lcdb *lcdb)
+{
+	int rc;
+	u8 val;
+
+	if (!lcdb->settings_saved) {
+		rc = qpnp_lcdb_save_settings(lcdb);
+		if (rc < 0) {
+			pr_err("Failed to save LCDB settings rc=%d\n", rc);
+			return rc;
+		}
+		lcdb->settings_saved = true;
+	}
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_BST_PD_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + PM7325B_LCDB_BST_VREG_OK_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + PM7325B_LCDB_WARMUP_DLY_SEL_1_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + PM7325B_LCDB_WARMUP_DLY_SEL_2_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + PM7325B_LCDB_PRECHARGE_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_BST_SS_CTL_REG, &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_LDO_PD_CTL_REG,
+							&val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_LDO_SOFT_START_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_NCP_PD_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_NCP_SOFT_START_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = VOUT_STEP_DLY_2US;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_STEPPER_VOUT_CTL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = EN_FAST_STARTUP_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_CONFIG_SEL_REG,
+			     &val, 1);
+	if (rc < 0)
+		return rc;
+
+	val = HWEN_RDY_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_ENABLE_CTL1_REG,
+			     &val, 1);
+
+	return rc;
+}
+
+static int qpnp_lcdb_ttw_exit(struct qpnp_lcdb *lcdb)
+{
+	int rc;
+
+	if (lcdb->settings_saved) {
+		rc = qpnp_lcdb_restore_settings(lcdb);
+		if (rc < 0) {
+			pr_err("Failed to restore lcdb settings rc=%d\n", rc);
+			return rc;
+		}
+		lcdb->settings_saved = false;
+	}
+
+	return 0;
+}
+
+static int qpnp_lcdb_enable_wa(struct qpnp_lcdb *lcdb)
+{
+	int rc;
+	u8 val = 0;
+
+	/* required only for PM660L */
+	if (lcdb->subtype != PM660L)
+		return 0;
+
+	val = MODULE_EN_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_ENABLE_CTL1_REG,
+						&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to enable lcdb rc= %d\n", rc);
+		return rc;
+	}
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_ENABLE_CTL1_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to disable lcdb rc= %d\n", rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+#define VOLTAGE_START_MV	4500
+#define VOLTAGE_STEP_MV		500
+
+static int qpnp_lcdb_enable(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0, timeout, delay;
+	int voltage_mv = VOLTAGE_START_MV;
+	u8 val = 0;
+
+	if (lcdb->lcdb_enabled || lcdb->lcdb_sc_disable) {
+		pr_debug("lcdb_enabled=%d lcdb_sc_disable=%d\n",
+			lcdb->lcdb_enabled, lcdb->lcdb_sc_disable);
+		return 0;
+	}
+
+	if (lcdb->ttw_enable) {
+		rc = qpnp_lcdb_ttw_exit(lcdb);
+		if (rc < 0) {
+			pr_err("Failed to exit TTW mode rc=%d\n", rc);
+			return rc;
+		}
+	}
+
+	rc = qpnp_lcdb_enable_wa(lcdb);
+	if (rc < 0) {
+		pr_err("Failed to execute enable_wa rc=%d\n", rc);
+		return rc;
+	}
+
+	if (lcdb->voltage_step_ramp) {
+		if (lcdb->ldo.voltage_mv < VOLTAGE_START_MV)
+			voltage_mv = lcdb->ldo.voltage_mv;
+
+		rc = qpnp_lcdb_set_voltage(lcdb, voltage_mv, LDO);
+		if (rc < 0)
+			return rc;
+
+		if (lcdb->ncp.voltage_mv < VOLTAGE_START_MV)
+			voltage_mv = lcdb->ncp.voltage_mv;
+
+		rc = qpnp_lcdb_set_voltage(lcdb, voltage_mv, NCP);
+		if (rc < 0)
+			return rc;
+	}
+
+	val = MODULE_EN_BIT;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_ENABLE_CTL1_REG,
+							&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to disable lcdb rc= %d\n", rc);
+		goto fail_enable;
+	}
+
+	/* poll for vreg_ok */
+	timeout = 10;
+	delay = lcdb->bst.soft_start_us + lcdb->ldo.soft_start_us +
+					lcdb->ncp.soft_start_us;
+	delay += lcdb->bst.vreg_ok_dbc_us + lcdb->ldo.vreg_ok_dbc_us +
+					lcdb->ncp.vreg_ok_dbc_us;
+	while (timeout--) {
+		rc = qpnp_lcdb_read(lcdb, lcdb->base + INT_RT_STATUS_REG,
+								&val, 1);
+		if (rc < 0) {
+			pr_err("Failed to poll for vreg-ok status rc=%d\n", rc);
+			break;
+		}
+		if (val & VREG_OK_RT_STS_BIT)
+			break;
+
+		usleep_range(delay, delay + 100);
+	}
+
+	if (rc || !timeout) {
+		if (!timeout) {
+			pr_err("lcdb-vreg-ok status failed to change\n");
+			rc = -ETIMEDOUT;
+		}
+		goto fail_enable;
+	}
+
+	lcdb->lcdb_enabled = true;
+	if (lcdb->voltage_step_ramp) {
+		usleep_range(10000, 11000);
+		rc = qpnp_lcdb_set_voltage_step(lcdb,
+						voltage_mv + VOLTAGE_STEP_MV,
+						LDO_NCP);
+		if (rc < 0) {
+			pr_err("Failed to set LCDB voltage rc=%d\n", rc);
+			return rc;
+		}
+	}
+
+	pr_debug("lcdb enabled successfully!\n");
+
+	return 0;
+
+fail_enable:
+	dump_status_registers(lcdb);
+	pr_err("Failed to enable lcdb rc=%d\n", rc);
+	return rc;
+}
+
+static int qpnp_lcdb_disable(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0;
+	u8 val = 0;
+
+	if (!lcdb->lcdb_enabled)
+		return 0;
+
+	if (lcdb->ttw_enable) {
+		switch (lcdb->subtype) {
+		case PM660L:
+			rc = qpnp_lcdb_ttw_enter_pm660l(lcdb);
+			break;
+		case PM7325B:
+			rc = qpnp_lcdb_ttw_enter_pm7325b(lcdb);
+			break;
+		default:
+			rc = qpnp_lcdb_ttw_enter(lcdb);
+			break;
+		}
+
+		if (rc < 0) {
+			pr_err("Failed to enable TTW mode rc=%d\n", rc);
+			return rc;
+		}
+		lcdb->lcdb_enabled = false;
+
+		return 0;
+	}
+
+	if (lcdb->wa_flags & FORCE_PD_ENABLE_WA) {
+		/*
+		 * force pull-down to enable quick discharge after
+		 * turning off
+		 */
+		val = LDO_FORCE_PD_EN_BIT | LDO_FORCE_PD_MODE;
+		rc = qpnp_lcdb_write(lcdb, lcdb->base +
+				     LCDB_LDO_FORCE_PD_CTL_REG, &val, 1);
+		if (rc < 0)
+			return rc;
+	}
+
+	val = 0;
+	rc = qpnp_lcdb_write(lcdb, lcdb->base + LCDB_ENABLE_CTL1_REG,
+							&val, 1);
+	if (rc < 0)
+		pr_err("Failed to disable lcdb rc= %d\n", rc);
+	else
+		lcdb->lcdb_enabled = false;
+
+	if (lcdb->wa_flags & FORCE_PD_ENABLE_WA) {
+		/* wait for 10 msec after module disable for LDO to discharge */
+		usleep_range(10000, 11000);
+
+		val = 0;
+		rc = qpnp_lcdb_write(lcdb, lcdb->base +
+				     LCDB_LDO_FORCE_PD_CTL_REG, &val, 1);
+		if (rc < 0)
+			return rc;
+	}
+
+	return rc;
+}
+
+#define LCDB_SC_RESET_CNT_DLY_US	1000000
+#define LCDB_SC_CNT_MAX			10
+static int qpnp_lcdb_handle_sc_event(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0;
+	s64 elapsed_time_us;
+
+	mutex_lock(&lcdb->lcdb_mutex);
+	rc = qpnp_lcdb_disable(lcdb);
+	if (rc < 0) {
+		pr_err("Failed to disable lcdb rc=%d\n", rc);
+		goto unlock_mutex;
+	}
+
+	/* Check if the SC re-occurred immediately */
+	elapsed_time_us = ktime_us_delta(ktime_get(),
+			lcdb->sc_module_enable_time);
+	if (elapsed_time_us > LCDB_SC_RESET_CNT_DLY_US) {
+		lcdb->sc_count = 0;
+	} else if (lcdb->sc_count > LCDB_SC_CNT_MAX) {
+		pr_err("SC triggered %d times, disabling LCDB forever!\n",
+						lcdb->sc_count);
+		lcdb->lcdb_sc_disable = true;
+		goto unlock_mutex;
+	}
+	lcdb->sc_count++;
+	lcdb->sc_module_enable_time = ktime_get();
+
+	/* delay for SC to clear */
+	usleep_range(10000, 10100);
+
+	rc = qpnp_lcdb_enable(lcdb);
+	if (rc < 0)
+		pr_err("Failed to enable lcdb rc=%d\n", rc);
+
+unlock_mutex:
+	mutex_unlock(&lcdb->lcdb_mutex);
+	return rc;
+}
+
+static irqreturn_t qpnp_lcdb_sc_irq_handler(int irq, void *data)
+{
+	struct qpnp_lcdb *lcdb = data;
+	int rc;
+	u8 val, val2[2] = {0};
+
+	mutex_lock(&lcdb->lcdb_mutex);
+	rc = qpnp_lcdb_read(lcdb, lcdb->base + INT_RT_STATUS_REG, &val, 1);
+	mutex_unlock(&lcdb->lcdb_mutex);
+	if (rc < 0)
+		goto irq_handled;
+
+	if (val & SC_ERROR_RT_STS_BIT) {
+		rc = qpnp_lcdb_read(lcdb,
+			lcdb->base + LCDB_MISC_CTL_REG, &val, 1);
+		if (rc < 0)
+			goto irq_handled;
+
+		if (lcdb->subtype == PM660L &&
+				(val & EN_TOUCH_WAKE_BIT)) {
+			/* blanking time */
+			usleep_range(300, 310);
+			/*
+			 * The status registers need to written with any value
+			 * before reading
+			 */
+			rc = qpnp_lcdb_write(lcdb,
+				lcdb->base + LCDB_STS3_REG, val2, 2);
+			if (rc < 0)
+				goto irq_handled;
+
+			rc = qpnp_lcdb_read(lcdb,
+				lcdb->base + LCDB_STS3_REG, val2, 2);
+			if (rc < 0)
+				goto irq_handled;
+
+			if (!(val2[0] & LDO_VREG_OK_BIT) ||
+					!(val2[1] & NCP_VREG_OK_BIT)) {
+				rc = qpnp_lcdb_handle_sc_event(lcdb);
+				if (rc < 0) {
+					pr_err("Failed to handle SC rc=%d\n",
+								rc);
+					goto irq_handled;
+				}
+			}
+		} else {
+			/* blanking time */
+			usleep_range(2000, 2100);
+			/* Read the SC status again to confirm true SC */
+			mutex_lock(&lcdb->lcdb_mutex);
+			/*
+			 * Wait for the completion of LCDB module enable,
+			 * which could be initiated in a previous SC event,
+			 * to avoid multiple module disable/enable calls.
+			 */
+			rc = qpnp_lcdb_read(lcdb,
+				lcdb->base + INT_RT_STATUS_REG, &val, 1);
+			mutex_unlock(&lcdb->lcdb_mutex);
+			if (rc < 0)
+				goto irq_handled;
+
+			if (val & SC_ERROR_RT_STS_BIT) {
+				rc = qpnp_lcdb_handle_sc_event(lcdb);
+				if (rc < 0) {
+					pr_err("Failed to handle SC rc=%d\n",
+								rc);
+					goto irq_handled;
+				}
+			}
+		}
+	}
+irq_handled:
+	return IRQ_HANDLED;
+}
+
+#define MIN_BST_VOLTAGE_MV			4700
+#define PM7325B_MIN_BST_VOLTAGE_MV		2000
+#define PM660_MAX_BST_VOLTAGE_MV		6250
+#define MAX_BST_VOLTAGE_MV			6275
+#define PM7325B_MAX_BST_VOLTAGE_MV			6400
+#define MIN_VOLTAGE_MV				4000
+#define MAX_VOLTAGE_MV				6000
+#define PM7325B_MIN_VOLTAGE_MV				4400
+#define PM7325B_MAX_VOLTAGE_MV				6000
+#define VOLTAGE_MIN_STEP_100_MV			4000
+#define VOLTAGE_MIN_STEP_50_MV			4950
+#define VOLTAGE_STEP_100_MV			100
+#define VOLTAGE_STEP_50_MV			50
+#define VOLTAGE_STEP_25_MV			25
+#define VOLTAGE_STEP_50MV_OFFSET		0xA
+static int qpnp_lcdb_set_bst_voltage(struct qpnp_lcdb *lcdb,
+					int voltage_mv, u8 type)
+{
+	int rc = 0;
+	u8 val, voltage_step, mask = 0;
+	int bst_voltage_mv, min_bst_voltage;
+	struct ldo_regulator *ldo = &lcdb->ldo;
+	struct ncp_regulator *ncp = &lcdb->ncp;
+	struct bst_params *bst = &lcdb->bst;
+
+	/* Vout_Boost = headroom_mv + max( Vout_LDO, abs (Vout_NCP)) */
+	bst_voltage_mv = max(voltage_mv, max(ldo->voltage_mv, ncp->voltage_mv));
+	bst_voltage_mv += bst->headroom_mv;
+
+	if (bst_voltage_mv < MIN_BST_VOLTAGE_MV)
+		bst_voltage_mv = MIN_BST_VOLTAGE_MV;
+
+	switch (lcdb->subtype) {
+	case PM660L:
+		if (bst_voltage_mv > PM660_MAX_BST_VOLTAGE_MV)
+			bst_voltage_mv = PM660_MAX_BST_VOLTAGE_MV;
+		break;
+	case PM7325B:
+		if (bst_voltage_mv > PM7325B_MAX_BST_VOLTAGE_MV)
+			bst_voltage_mv = PM7325B_MAX_BST_VOLTAGE_MV;
+		break;
+	default:
+		if (bst_voltage_mv > MAX_BST_VOLTAGE_MV)
+			bst_voltage_mv = MAX_BST_VOLTAGE_MV;
+		break;
+	}
+
+	if (bst_voltage_mv != bst->voltage_mv) {
+		switch (lcdb->subtype) {
+		case PM660L:
+			mask = PM660_BST_OUTPUT_VOLTAGE_MASK;
+			voltage_step = VOLTAGE_STEP_50_MV;
+			min_bst_voltage = MIN_BST_VOLTAGE_MV;
+			break;
+		case PM7325B:
+			mask =  PM7325B_BST_OUTPUT_VOLTAGE_MASK;
+			voltage_step = VOLTAGE_STEP_25_MV;
+			min_bst_voltage = PM7325B_MIN_BST_VOLTAGE_MV;
+			break;
+		default:
+			mask =  BST_OUTPUT_VOLTAGE_MASK;
+			voltage_step = VOLTAGE_STEP_25_MV;
+			min_bst_voltage = MIN_BST_VOLTAGE_MV;
+			break;
+		}
+
+		val = DIV_ROUND_UP(bst_voltage_mv - min_bst_voltage,
+							voltage_step);
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					LCDB_BST_OUTPUT_VOLTAGE_REG,
+					mask, val);
+		if (rc < 0) {
+			pr_err("Failed to set boost voltage %d mv rc=%d\n",
+				bst_voltage_mv, rc);
+		} else {
+			pr_debug("Boost voltage set = %d mv (0x%02x = 0x%02x)\n",
+			      bst_voltage_mv, LCDB_BST_OUTPUT_VOLTAGE_REG, val);
+			bst->voltage_mv = bst_voltage_mv;
+		}
+	}
+
+	return rc;
+}
+
+static int qpnp_lcdb_get_bst_voltage(struct qpnp_lcdb *lcdb,
+					int *voltage_mv)
+{
+	int rc, min_bst_voltage;
+	u8 val, voltage_step, mask = 0;
+
+	rc = qpnp_lcdb_read(lcdb, lcdb->base + LCDB_BST_OUTPUT_VOLTAGE_REG,
+						&val, 1);
+	if (rc < 0) {
+		pr_err("Failed to reat BST voltage rc=%d\n", rc);
+		return rc;
+	}
+
+	switch (lcdb->subtype) {
+	case PM660L:
+		mask = PM660_BST_OUTPUT_VOLTAGE_MASK;
+		voltage_step = VOLTAGE_STEP_50_MV;
+		min_bst_voltage = MIN_BST_VOLTAGE_MV;
+		break;
+	case PM7325B:
+		mask =  PM7325B_BST_OUTPUT_VOLTAGE_MASK;
+		voltage_step = VOLTAGE_STEP_25_MV;
+		min_bst_voltage = PM7325B_MIN_BST_VOLTAGE_MV;
+		break;
+	default:
+		mask =  BST_OUTPUT_VOLTAGE_MASK;
+		voltage_step = VOLTAGE_STEP_25_MV;
+		min_bst_voltage = MIN_BST_VOLTAGE_MV;
+	}
+
+	val &= mask;
+	*voltage_mv = (val * voltage_step) + min_bst_voltage;
+
+	return 0;
+}
+
+static int qpnp_lcdb_set_voltage(struct qpnp_lcdb *lcdb,
+					int voltage_mv, u8 type)
+{
+	int rc = 0;
+	u16 offset = LCDB_LDO_OUTPUT_VOLTAGE_REG;
+	u8 val = 0;
+	int voltage_mask = (lcdb->subtype == PM7325B) ?
+		PM7325B_SET_OUTPUT_VOLTAGE_MASK : SET_OUTPUT_VOLTAGE_MASK;
+
+	if (!is_between(voltage_mv, lcdb->min_voltage_mv, lcdb->max_voltage_mv)) {
+		pr_err("Invalid voltage %dmv (min=%d max=%d)\n",
+			voltage_mv, lcdb->min_voltage_mv, lcdb->max_voltage_mv);
+		return -EINVAL;
+	}
+
+	rc = qpnp_lcdb_set_bst_voltage(lcdb, voltage_mv, type);
+	if (rc < 0) {
+		pr_err("Failed to set boost voltage rc=%d\n", rc);
+		return rc;
+	}
+
+	/* Below logic is only valid for LDO and NCP type */
+	if (voltage_mv < VOLTAGE_MIN_STEP_50_MV) {
+		val = DIV_ROUND_UP(voltage_mv - VOLTAGE_MIN_STEP_100_MV,
+						VOLTAGE_STEP_100_MV);
+	} else {
+		val = DIV_ROUND_UP(voltage_mv - VOLTAGE_MIN_STEP_50_MV,
+						VOLTAGE_STEP_50_MV);
+		val += VOLTAGE_STEP_50MV_OFFSET;
+	}
+
+	if (type == NCP)
+		offset = LCDB_NCP_OUTPUT_VOLTAGE_REG;
+
+	rc = qpnp_lcdb_masked_write(lcdb, lcdb->base + offset,
+				voltage_mask, val);
+	if (rc < 0)
+		pr_err("Failed to set output voltage %d mv for %s rc=%d\n",
+			voltage_mv, (type == LDO) ? "LDO" : "NCP", rc);
+	else
+		pr_debug("%s voltage set = %d mv (0x%02x = 0x%02x)\n",
+			(type == LDO) ? "LDO" : "NCP", voltage_mv, offset, val);
+
+	return rc;
+}
+
+static int qpnp_lcdb_set_voltage_step(struct qpnp_lcdb *lcdb,
+				      int voltage_start_mv, u8 type)
+{
+	int i, ldo_voltage, ncp_voltage, voltage, rc = 0;
+
+	for (i = voltage_start_mv; i <= (MAX_VOLTAGE_MV + VOLTAGE_STEP_MV);
+						i += VOLTAGE_STEP_MV) {
+
+		ldo_voltage = (lcdb->ldo.voltage_mv < i) ?
+					lcdb->ldo.voltage_mv : i;
+
+		ncp_voltage = (lcdb->ncp.voltage_mv < i) ?
+					lcdb->ncp.voltage_mv : i;
+		if (type == LDO_NCP) {
+			rc = qpnp_lcdb_set_voltage(lcdb, ldo_voltage, LDO);
+			if (rc < 0)
+				return rc;
+
+			rc = qpnp_lcdb_set_voltage(lcdb, ncp_voltage, NCP);
+			if (rc < 0)
+				return rc;
+
+			pr_debug(" LDO voltage step %d NCP voltage step %d\n",
+					ldo_voltage, ncp_voltage);
+
+			if ((i >= lcdb->ncp.voltage_mv) &&
+					(i >= lcdb->ldo.voltage_mv))
+				break;
+		} else {
+			voltage = (type == LDO) ? ldo_voltage : ncp_voltage;
+			rc = qpnp_lcdb_set_voltage(lcdb, voltage, type);
+			if (rc < 0)
+				return rc;
+
+			pr_debug("%s voltage step %d\n",
+				 (type == LDO) ? "LDO" : "NCP", voltage);
+			if ((type == LDO) && (i >= lcdb->ldo.voltage_mv))
+				break;
+
+			if ((type == NCP) && (i >= lcdb->ncp.voltage_mv))
+				break;
+
+		}
+
+		usleep_range(1000, 1100);
+	}
+
+	return rc;
+}
+
+static int qpnp_lcdb_get_voltage(struct qpnp_lcdb *lcdb,
+					u32 *voltage_mv, u8 type)
+{
+	int rc = 0;
+	u16 offset = LCDB_LDO_OUTPUT_VOLTAGE_REG;
+	u8 val = 0;
+	int voltage_mask = (lcdb->subtype == PM7325B) ?
+		PM7325B_SET_OUTPUT_VOLTAGE_MASK : SET_OUTPUT_VOLTAGE_MASK;
+
+	if (type == BST)
+		return qpnp_lcdb_get_bst_voltage(lcdb, voltage_mv);
+
+	/* When symmetry is enabled, NCP voltage directly follows LDO voltage */
+	if (type == NCP && !lcdb->ncp_symmetry)
+		offset = LCDB_NCP_OUTPUT_VOLTAGE_REG;
+
+	rc = qpnp_lcdb_read(lcdb, lcdb->base + offset, &val, 1);
+	if (rc < 0) {
+		pr_err("Failed to read %s volatge rc=%d\n",
+			(type == LDO) ? "LDO" : "NCP", rc);
+		return rc;
+	}
+
+	val &= voltage_mask;
+	if (val < VOLTAGE_STEP_50MV_OFFSET) {
+		*voltage_mv = VOLTAGE_MIN_STEP_100_MV +
+				(val * VOLTAGE_STEP_100_MV);
+	} else {
+		*voltage_mv = VOLTAGE_MIN_STEP_50_MV +
+			((val - VOLTAGE_STEP_50MV_OFFSET) * VOLTAGE_STEP_50_MV);
+	}
+
+	if (!rc)
+		pr_debug("%s voltage read-back = %d mv (0x%02x = 0x%02x)\n",
+					(type == LDO) ? "LDO" : "NCP",
+					*voltage_mv, offset, val);
+
+	return rc;
+}
+
+static int qpnp_lcdb_set_soft_start(struct qpnp_lcdb *lcdb,
+					u32 ss_us, u8 type)
+{
+	int rc = 0, i = 0;
+	u16 offset = LCDB_LDO_SOFT_START_CTL_REG;
+	u8 val = 0;
+
+	if (type == NCP)
+		offset = LCDB_NCP_SOFT_START_CTL_REG;
+
+	if (!is_between(ss_us, MIN_SOFT_START_US, MAX_SOFT_START_US)) {
+		pr_err("Invalid soft_start_us %d (min=%d max=%d)\n",
+			ss_us, MIN_SOFT_START_US, MAX_SOFT_START_US);
+		return -EINVAL;
+	}
+
+	i = 0;
+	while (ss_us >= soft_start_us[i])
+		i++;
+	val = ((i == 0) ? 0 : i - 1) & SOFT_START_MASK;
+
+	rc = qpnp_lcdb_masked_write(lcdb,
+			lcdb->base + offset, SOFT_START_MASK, val);
+	if (rc < 0)
+		pr_err("Failed to write %s soft-start time %d rc=%d\n",
+			(type == LDO) ? "LDO" : "NCP", soft_start_us[i], rc);
+
+	return rc;
+}
+
+static int qpnp_lcdb_ldo_regulator_enable(struct regulator_dev *rdev)
+{
+	int rc = 0;
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	mutex_lock(&lcdb->lcdb_mutex);
+	rc = qpnp_lcdb_enable(lcdb);
+	if (rc < 0)
+		pr_err("Failed to enable lcdb rc=%d\n", rc);
+	mutex_unlock(&lcdb->lcdb_mutex);
+
+	return rc;
+}
+
+static int qpnp_lcdb_ldo_regulator_disable(struct regulator_dev *rdev)
+{
+	int rc = 0;
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	mutex_lock(&lcdb->lcdb_mutex);
+	rc = qpnp_lcdb_disable(lcdb);
+	if (rc < 0)
+		pr_err("Failed to disable lcdb rc=%d\n", rc);
+	mutex_unlock(&lcdb->lcdb_mutex);
+
+	return rc;
+}
+
+static int qpnp_lcdb_ldo_regulator_is_enabled(struct regulator_dev *rdev)
+{
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	return lcdb->lcdb_enabled;
+}
+
+static int qpnp_lcdb_ldo_regulator_set_voltage(struct regulator_dev *rdev,
+				int min_uV, int max_uV, unsigned int *selector)
+{
+	int rc = 0;
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	lcdb->ldo.voltage_mv = min_uV / 1000;
+	if (lcdb->voltage_step_ramp)
+		rc = qpnp_lcdb_set_voltage_step(lcdb,
+			lcdb->ldo.prev_voltage_mv + VOLTAGE_STEP_MV, LDO);
+	else
+		rc = qpnp_lcdb_set_voltage(lcdb, lcdb->ldo.voltage_mv, LDO);
+
+	if (rc < 0)
+		pr_err("Failed to set LDO voltage rc=%c\n", rc);
+	else
+		lcdb->ldo.prev_voltage_mv = lcdb->ldo.voltage_mv;
+
+	return rc;
+}
+
+static int qpnp_lcdb_ldo_regulator_get_voltage(struct regulator_dev *rdev)
+{
+	int rc = 0;
+	u32 voltage_mv = 0;
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	rc = qpnp_lcdb_get_voltage(lcdb, &voltage_mv, LDO);
+	if (rc < 0) {
+		pr_err("Failed to get ldo voltage rc=%d\n", rc);
+		return rc;
+	}
+
+	return voltage_mv * 1000;
+}
+
+static const struct regulator_ops qpnp_lcdb_ldo_ops = {
+	.enable			= qpnp_lcdb_ldo_regulator_enable,
+	.disable		= qpnp_lcdb_ldo_regulator_disable,
+	.is_enabled		= qpnp_lcdb_ldo_regulator_is_enabled,
+	.set_voltage		= qpnp_lcdb_ldo_regulator_set_voltage,
+	.get_voltage		= qpnp_lcdb_ldo_regulator_get_voltage,
+};
+
+static int qpnp_lcdb_ncp_regulator_enable(struct regulator_dev *rdev)
+{
+	int rc = 0;
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	mutex_lock(&lcdb->lcdb_mutex);
+	rc = qpnp_lcdb_enable(lcdb);
+	if (rc < 0)
+		pr_err("Failed to enable lcdb rc=%d\n", rc);
+	mutex_unlock(&lcdb->lcdb_mutex);
+
+	return rc;
+}
+
+static int qpnp_lcdb_ncp_regulator_disable(struct regulator_dev *rdev)
+{
+	int rc = 0;
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	mutex_lock(&lcdb->lcdb_mutex);
+	rc = qpnp_lcdb_disable(lcdb);
+	if (rc < 0)
+		pr_err("Failed to disable lcdb rc=%d\n", rc);
+	mutex_unlock(&lcdb->lcdb_mutex);
+
+	return rc;
+}
+
+static int qpnp_lcdb_ncp_regulator_is_enabled(struct regulator_dev *rdev)
+{
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	return lcdb->lcdb_enabled;
+}
+
+static int qpnp_lcdb_ncp_regulator_set_voltage(struct regulator_dev *rdev,
+				int min_uV, int max_uV, unsigned int *selector)
+{
+	int rc = 0;
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	lcdb->ncp.voltage_mv = min_uV / 1000;
+	if (lcdb->voltage_step_ramp)
+		rc = qpnp_lcdb_set_voltage_step(lcdb,
+			lcdb->ncp.prev_voltage_mv + VOLTAGE_STEP_MV, NCP);
+	else
+		rc = qpnp_lcdb_set_voltage(lcdb, lcdb->ncp.voltage_mv, NCP);
+
+	if (rc < 0)
+		pr_err("Failed to set NCP voltage rc=%c\n", rc);
+	else
+		lcdb->ncp.prev_voltage_mv = lcdb->ncp.voltage_mv;
+
+	return rc;
+}
+
+static int qpnp_lcdb_ncp_regulator_get_voltage(struct regulator_dev *rdev)
+{
+	int rc;
+	u32 voltage_mv = 0;
+	struct qpnp_lcdb *lcdb  = rdev_get_drvdata(rdev);
+
+	rc = qpnp_lcdb_get_voltage(lcdb, &voltage_mv, NCP);
+	if (rc < 0) {
+		pr_err("Failed to get ncp voltage rc=%d\n", rc);
+		return rc;
+	}
+
+	return voltage_mv * 1000;
+}
+
+static const struct regulator_ops qpnp_lcdb_ncp_ops = {
+	.enable			= qpnp_lcdb_ncp_regulator_enable,
+	.disable		= qpnp_lcdb_ncp_regulator_disable,
+	.is_enabled		= qpnp_lcdb_ncp_regulator_is_enabled,
+	.set_voltage		= qpnp_lcdb_ncp_regulator_set_voltage,
+	.get_voltage		= qpnp_lcdb_ncp_regulator_get_voltage,
+};
+
+static int qpnp_lcdb_regulator_register(struct qpnp_lcdb *lcdb, u8 type)
+{
+	int rc = 0, off_on_delay = 0, voltage_step = VOLTAGE_STEP_50_MV;
+	struct regulator_init_data *init_data;
+	struct regulator_config cfg = {};
+	struct regulator_desc *rdesc;
+	struct regulator_dev *rdev;
+	struct device_node *node;
+
+	if (lcdb->subtype != PM660L)
+		off_on_delay = PMIC5_LCDB_OFF_ON_DELAY_US;
+
+	if (type == LDO) {
+		node			= lcdb->ldo.node;
+		rdesc			= &lcdb->ldo.rdesc;
+		rdesc->ops		= &qpnp_lcdb_ldo_ops;
+		rdesc->off_on_delay	= off_on_delay;
+		rdesc->n_voltages = ((lcdb->max_voltage_mv - lcdb->min_voltage_mv)
+					/ voltage_step) + 1;
+		rdev			= lcdb->ldo.rdev;
+	} else if (type == NCP) {
+		node			= lcdb->ncp.node;
+		rdesc			= &lcdb->ncp.rdesc;
+		rdesc->ops		= &qpnp_lcdb_ncp_ops;
+		rdesc->off_on_delay	= off_on_delay;
+		rdesc->n_voltages = ((lcdb->max_voltage_mv - lcdb->min_voltage_mv)
+					/ voltage_step) + 1;
+		rdev			= lcdb->ncp.rdev;
+	} else {
+		pr_err("Invalid regulator type %d\n", type);
+		return -EINVAL;
+	}
+
+	init_data = of_get_regulator_init_data(lcdb->dev, node, rdesc);
+	if (!init_data) {
+		pr_err("Failed to get regulator_init_data for %s\n",
+					(type == LDO) ? "LDO" : "NCP");
+		return -ENOMEM;
+	}
+
+	if (init_data->constraints.name) {
+		rdesc->owner		= THIS_MODULE;
+		rdesc->type		= REGULATOR_VOLTAGE;
+		rdesc->name		= init_data->constraints.name;
+
+		cfg.dev = lcdb->dev;
+		cfg.init_data = init_data;
+		cfg.driver_data = lcdb;
+		cfg.of_node = node;
+
+		if (of_get_property(lcdb->dev->of_node, "parent-supply", NULL))
+			init_data->supply_regulator = "parent";
+
+		init_data->constraints.valid_ops_mask
+				|= REGULATOR_CHANGE_VOLTAGE
+				| REGULATOR_CHANGE_STATUS;
+
+		rdev = devm_regulator_register(lcdb->dev, rdesc, &cfg);
+		if (IS_ERR(rdev)) {
+			rc = PTR_ERR(rdev);
+			rdev = NULL;
+			pr_err("Failed to register lcdb_%s regulator rc = %d\n",
+				(type == LDO) ? "LDO" : "NCP", rc);
+			return rc;
+		}
+	} else {
+		pr_err("%s_regulator name missing\n",
+				(type == LDO) ? "LDO" : "NCP");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int qpnp_lcdb_parse_ttw(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0;
+	u32 temp;
+	u8 val = 0;
+	struct device_node *node = lcdb->dev->of_node;
+
+	/* LCDB_AUTO_TOUCH_WAKE_CTL_REG is removed for PM7325B, but TTW is supported */
+	if (lcdb->subtype == PM7325B)
+		return 0;
+
+	if (of_property_read_bool(node, "qcom,ttw-mode-sw")) {
+		lcdb->ttw_mode_sw = true;
+		rc = of_property_read_u32(node, "qcom,attw-toff-ms", &temp);
+		if (!rc) {
+			if (!is_between(temp, ATTW_MIN_MS, ATTW_MAX_MS)) {
+				pr_err("Invalid TOFF val %d (min=%d max=%d)\n",
+					temp, ATTW_MIN_MS, ATTW_MAX_MS);
+					return -EINVAL;
+			}
+			val = ilog2(temp / 4) << ATTW_TOFF_TIME_SHIFT;
+		} else {
+			pr_err("qcom,attw-toff-ms not specified for TTW SW mode\n");
+			return rc;
+		}
+
+		rc = of_property_read_u32(node, "qcom,attw-ton-ms", &temp);
+		if (!rc) {
+			if (!is_between(temp, ATTW_MIN_MS, ATTW_MAX_MS)) {
+				pr_err("Invalid TON value %d (min=%d max=%d)\n",
+					temp, ATTW_MIN_MS, ATTW_MAX_MS);
+				return -EINVAL;
+			}
+			val |= ilog2(temp / 4);
+		} else {
+			pr_err("qcom,attw-ton-ms not specified for TTW SW mode\n");
+			return rc;
+		}
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_AUTO_TOUCH_WAKE_CTL_REG,
+				ATTW_TON_TIME_MASK | ATTW_TOFF_TIME_MASK, val);
+		if (rc < 0) {
+			pr_err("Failed to write ATTW ON/OFF rc=%d\n", rc);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int qpnp_lcdb_ldo_dt_init(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0;
+	struct device_node *node = lcdb->ldo.node;
+	int ilim_min = (lcdb->subtype == PM7325B) ? PM7325B_MIN_LDO_ILIM_MA : MIN_LDO_ILIM_MA;
+	int ilim_max = (lcdb->subtype == PM7325B) ? PM7325B_MAX_LDO_ILIM_MA : MAX_LDO_ILIM_MA;
+
+	/* LDO output voltage */
+	lcdb->ldo.voltage_mv = -EINVAL;
+	rc = of_property_read_u32(node, "qcom,ldo-voltage-mv",
+					&lcdb->ldo.voltage_mv);
+	if (!rc && !is_between(lcdb->ldo.voltage_mv, lcdb->min_voltage_mv, lcdb->max_voltage_mv)) {
+		pr_err("Invalid LDO voltage %dmv (min=%d max=%d)\n",
+			lcdb->ldo.voltage_mv, lcdb->min_voltage_mv, lcdb->max_voltage_mv);
+		return -EINVAL;
+	}
+
+	/* LDO PD configuration */
+	lcdb->ldo.pd = -EINVAL;
+	of_property_read_u32(node, "qcom,ldo-pd", &lcdb->ldo.pd);
+
+	lcdb->ldo.pd_strength = -EINVAL;
+	of_property_read_u32(node, "qcom,ldo-pd-strength",
+					&lcdb->ldo.pd_strength);
+
+	/* LDO ILIM configuration */
+	lcdb->ldo.ilim_ma = -EINVAL;
+	rc = of_property_read_u32(node, "qcom,ldo-ilim-ma", &lcdb->ldo.ilim_ma);
+	if (!rc && !is_between(lcdb->ldo.ilim_ma, ilim_min, ilim_max)) {
+		pr_err("Invalid ilim_ma %d (min=%d, max=%d)\n",
+			lcdb->ldo.ilim_ma, ilim_min, ilim_max);
+		return -EINVAL;
+	}
+
+	/* LDO soft-start (SS) configuration */
+	lcdb->ldo.soft_start_us = -EINVAL;
+	of_property_read_u32(node, "qcom,ldo-soft-start-us",
+					&lcdb->ldo.soft_start_us);
+
+	return 0;
+}
+
+static int qpnp_lcdb_ncp_dt_init(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0;
+	struct device_node *node = lcdb->ncp.node;
+	int ilim_min = (lcdb->subtype == PM7325B) ? PM7325B_MIN_NCP_ILIM_MA : MIN_NCP_ILIM_MA;
+	int ilim_max = (lcdb->subtype == PM7325B) ? PM7325B_MAX_NCP_ILIM_MA : MAX_NCP_ILIM_MA;
+
+	/* NCP output voltage */
+	lcdb->ncp.voltage_mv = -EINVAL;
+	rc = of_property_read_u32(node, "qcom,ncp-voltage-mv",
+					&lcdb->ncp.voltage_mv);
+	if (!rc && !is_between(lcdb->ncp.voltage_mv, lcdb->min_voltage_mv, lcdb->max_voltage_mv)) {
+		pr_err("Invalid NCP voltage %dmv (min=%d max=%d)\n",
+			lcdb->ldo.voltage_mv, lcdb->min_voltage_mv, lcdb->max_voltage_mv);
+		return -EINVAL;
+	}
+
+	/* NCP PD configuration */
+	lcdb->ncp.pd = -EINVAL;
+	of_property_read_u32(node, "qcom,ncp-pd", &lcdb->ncp.pd);
+
+	lcdb->ncp.pd_strength = -EINVAL;
+	of_property_read_u32(node, "qcom,ncp-pd-strength",
+					&lcdb->ncp.pd_strength);
+
+	/* NCP ILIM configuration */
+	lcdb->ncp.ilim_ma = -EINVAL;
+	rc = of_property_read_u32(node, "qcom,ncp-ilim-ma", &lcdb->ncp.ilim_ma);
+	if (!rc && !is_between(lcdb->ncp.ilim_ma, ilim_min, ilim_max)) {
+		pr_err("Invalid ilim_ma %d (min=%d, max=%d)\n",
+			lcdb->ncp.ilim_ma, ilim_min, ilim_max);
+		return -EINVAL;
+	}
+
+	/* NCP soft-start (SS) configuration */
+	lcdb->ncp.soft_start_us = -EINVAL;
+	of_property_read_u32(node, "qcom,ncp-soft-start-us",
+					&lcdb->ncp.soft_start_us);
+
+	return 0;
+}
+
+static int qpnp_lcdb_bst_dt_init(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0;
+	struct device_node *node = lcdb->bst.node;
+	u16 default_headroom_mv;
+	int ilim_min = (lcdb->subtype == PM7325B) ? PM7325B_MIN_BST_ILIM_MA : MIN_BST_ILIM_MA;
+	int ilim_max = (lcdb->subtype == PM7325B) ? PM7325B_MAX_BST_ILIM_MA : MAX_BST_ILIM_MA;
+
+	/* Boost PD  configuration */
+	lcdb->bst.pd = -EINVAL;
+	of_property_read_u32(node, "qcom,bst-pd", &lcdb->bst.pd);
+
+	lcdb->bst.pd_strength = -EINVAL;
+	of_property_read_u32(node, "qcom,bst-pd-strength",
+					&lcdb->bst.pd_strength);
+
+	/* Boost ILIM */
+	lcdb->bst.ilim_ma = -EINVAL;
+	rc = of_property_read_u32(node, "qcom,bst-ilim-ma", &lcdb->bst.ilim_ma);
+	if (!rc && !is_between(lcdb->bst.ilim_ma, ilim_min, ilim_max)) {
+		pr_err("Invalid ilim_ma %d (min=%d, max=%d)\n",
+			lcdb->bst.ilim_ma, ilim_min, ilim_max);
+			return -EINVAL;
+	}
+
+	/* Boost PS configuration */
+	lcdb->bst.ps = -EINVAL;
+	of_property_read_u32(node, "qcom,bst-ps", &lcdb->bst.ps);
+
+	lcdb->bst.ps_threshold = -EINVAL;
+	if (lcdb->subtype == PM7325B) {
+		rc = of_property_read_u32(node, "qcom,bst-ps-threshold-mv",
+						&lcdb->bst.ps_threshold);
+		if (!rc && !is_between(lcdb->bst.ps_threshold,
+					PM7325B_MIN_BST_PS_MV, PM7325B_MAX_BST_PS_MV)) {
+			pr_err("Invalid bst ps_threshold %d mV (min=%d, max=%d)\n",
+				lcdb->bst.ps_threshold, PM7325B_MIN_BST_PS_MV,
+				PM7325B_MAX_BST_PS_MV);
+			return -EINVAL;
+		}
+	} else {
+		rc = of_property_read_u32(node, "qcom,bst-ps-threshold-ma",
+						&lcdb->bst.ps_threshold);
+		if (!rc && !is_between(lcdb->bst.ps_threshold,
+					MIN_BST_PS_MA, MAX_BST_PS_MA)) {
+			pr_err("Invalid bst ps_threshold %d mA (min=%d, max=%d)\n",
+				lcdb->bst.ps_threshold, MIN_BST_PS_MA, MAX_BST_PS_MA);
+			return -EINVAL;
+		}
+	}
+
+
+	default_headroom_mv = (lcdb->subtype == PM660L) ?
+			       PM660_BST_HEADROOM_DEFAULT_MV :
+			       BST_HEADROOM_DEFAULT_MV;
+	/* Boost head room configuration */
+	of_property_read_u16(node, "qcom,bst-headroom-mv",
+					&lcdb->bst.headroom_mv);
+	if (lcdb->bst.headroom_mv < default_headroom_mv)
+		lcdb->bst.headroom_mv = default_headroom_mv;
+
+	return 0;
+}
+
+static int qpnp_lcdb_init_ldo(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0, ilim_ma, i = 0;
+	u8 val = 0, pd_mask, pd_enable, ilim_ctl_reg, ilim_mask, ilim_sd_shift;
+
+	if (lcdb->subtype == PM7325B) {
+		pd_mask = (u8)PM7325B_LDO_EN_PULLDOWN_BIT;
+		pd_enable = (u8)PM7325B_LDO_EN_PULLDOWN_BIT;
+		ilim_ctl_reg = (u8)LCDB_LDO_ILIM_CTL1_REG;
+		ilim_mask = (u8)SET_LDO_ILIM_MASK_SD;
+		ilim_sd_shift = (u8)SET_LDO_ILIM_MASK_SD_SHIFT;
+	} else {
+		pd_mask = (u8)LDO_DIS_PULLDOWN_BIT;
+		pd_enable = (u8)~LDO_DIS_PULLDOWN_BIT;
+		ilim_ctl_reg = (u8)LCDB_LDO_ILIM_CTL2_REG;
+		ilim_mask = (u8)SET_LDO_ILIM_MASK;
+		ilim_sd_shift = 0;
+	}
+
+	/* configure parameters only if LCDB is disabled */
+	if (!is_lcdb_enabled(lcdb)) {
+		if (lcdb->ldo.voltage_mv != -EINVAL) {
+			rc = qpnp_lcdb_set_voltage(lcdb,
+					lcdb->ldo.voltage_mv, LDO);
+			if (rc < 0) {
+				pr_err("Failed to set voltage rc=%d\n", rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->ldo.pd != -EINVAL) {
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_LDO_PD_CTL_REG, pd_mask,
+				lcdb->ldo.pd ? pd_enable : ~pd_enable);
+			if (rc < 0) {
+				pr_err("Failed to configure LDO PD rc=%d\n",
+								rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->ldo.pd_strength != -EINVAL) {
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_LDO_PD_CTL_REG, LDO_PD_STRENGTH_BIT,
+				lcdb->ldo.pd_strength ?
+				LDO_PD_STRENGTH_BIT : 0);
+			if (rc < 0) {
+				pr_err("Failed to configure LDO PD strength %s rc=%d\n",
+						lcdb->ldo.pd_strength ?
+						"(strong)" : "(weak)", rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->ldo.ilim_ma != -EINVAL) {
+			if (lcdb->subtype == PM7325B) {
+				ilim_ma = lcdb->ldo.ilim_ma;
+				/*
+				 * Select the highest current available below the specified current
+				 * if there is no exact match.
+				 */
+				for (i = 0; i < ARRAY_SIZE(pm7325b_ldo_ilim_ma); i++)
+					if (ilim_ma < pm7325b_ldo_ilim_ma[i])
+						break;
+				val = (i == 0) ? 0 : i - 1;
+			} else {
+				ilim_ma = lcdb->ldo.ilim_ma - MIN_LDO_ILIM_MA;
+				ilim_ma /= LDO_ILIM_STEP_MA;
+				val = (ilim_ma & SET_LDO_ILIM_MASK);
+			}
+
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					LCDB_LDO_ILIM_CTL1_REG,
+					SET_LDO_ILIM_MASK | EN_LDO_ILIM_BIT,
+					(val | EN_LDO_ILIM_BIT));
+			if (rc < 0) {
+				pr_err("Failed to configure LDO ilim_ma (CTL1=%d) rc=%d\n",
+							val, rc);
+				return rc;
+			}
+
+			val = val << ilim_sd_shift;
+			rc = qpnp_lcdb_masked_write(lcdb,
+					lcdb->base + ilim_ctl_reg,
+					ilim_mask, val);
+			if (rc < 0) {
+				pr_err("Failed to configure LDO ilim_ma (CTL2=%d) rc=%d\n",
+							val, rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->ldo.soft_start_us != -EINVAL) {
+			rc = qpnp_lcdb_set_soft_start(lcdb,
+					lcdb->ldo.soft_start_us, LDO);
+			if (rc < 0) {
+				pr_err("Failed to set LDO soft_start rc=%d\n",
+									rc);
+				return rc;
+			}
+		}
+	}
+
+	rc = qpnp_lcdb_get_voltage(lcdb, &lcdb->ldo.voltage_mv, LDO);
+	if (rc < 0) {
+		pr_err("Failed to get LDO volatge rc=%d\n", rc);
+		return rc;
+	}
+
+	lcdb->ldo.prev_voltage_mv = lcdb->ldo.voltage_mv;
+
+	rc = qpnp_lcdb_read(lcdb, lcdb->base +
+			LCDB_LDO_VREG_OK_CTL_REG, &val, 1);
+	if (rc < 0) {
+		pr_err("Failed to read ldo_vreg_ok rc=%d\n", rc);
+		return rc;
+	}
+	lcdb->ldo.vreg_ok_dbc_us = dbc_us[val & VREG_OK_DEB_MASK];
+
+	rc = qpnp_lcdb_read(lcdb, lcdb->base +
+			LCDB_LDO_SOFT_START_CTL_REG, &val, 1);
+	if (rc < 0) {
+		pr_err("Failed to read ldo_soft_start_ctl rc=%d\n", rc);
+		return rc;
+	}
+	lcdb->ldo.soft_start_us = soft_start_us[val & SOFT_START_MASK];
+
+	return rc;
+}
+
+static int qpnp_lcdb_init_ncp(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0, i = 0;
+	const u32 *ncp_ilim, *dbc_ncp;
+	u8 val = 0, pd_enable, ilim_ctl_reg, ilim_mask, ilim_sd_shift;
+
+	if (lcdb->subtype == PM7325B) {
+		pd_enable = (u8)PM7325B_EN_NCP_PULLDOWN_BIT;
+		ilim_ctl_reg = (u8)LCDB_NCP_ILIM_CTL1_REG;
+		ilim_mask = (u8)PM7325B_SET_NCP_ILIM_SD_MASK;
+		ilim_sd_shift = (u8)SET_LDO_ILIM_MASK_SD_SHIFT;
+		ncp_ilim = pm7325b_ncp_ilim_ma;
+		dbc_ncp = ncp_dbc_us;
+	} else {
+		pd_enable = (u8)~NCP_DIS_PULLDOWN_BIT;
+		ilim_ctl_reg = (u8)LCDB_NCP_ILIM_CTL2_REG;
+		ilim_mask = (u8)SET_NCP_ILIM_MASK;
+		ilim_sd_shift = 0;
+		ncp_ilim = ncp_ilim_ma;
+		dbc_ncp = dbc_us;
+	}
+
+	/* configure parameters only if LCDB is disabled */
+	if (!is_lcdb_enabled(lcdb)) {
+		if (lcdb->ncp.voltage_mv != -EINVAL) {
+			rc = qpnp_lcdb_set_voltage(lcdb,
+					lcdb->ncp.voltage_mv, NCP);
+			if (rc < 0) {
+				pr_err("Failed to set voltage rc=%d\n", rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->ncp.pd != -EINVAL) {
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_NCP_PD_CTL_REG, NCP_DIS_PULLDOWN_BIT,
+				lcdb->ncp.pd ? pd_enable : ~pd_enable);
+			if (rc < 0) {
+				pr_err("Failed to configure NCP PD rc=%d\n",
+									rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->ncp.pd_strength != -EINVAL) {
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_NCP_PD_CTL_REG, NCP_PD_STRENGTH_BIT,
+				lcdb->ncp.pd_strength ?
+				NCP_PD_STRENGTH_BIT : 0);
+			if (rc < 0) {
+				pr_err("Failed to configure NCP PD strength %s rc=%d\n",
+					lcdb->ncp.pd_strength ?
+					"(strong)" : "(weak)", rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->ncp.ilim_ma != -EINVAL) {
+			while (lcdb->ncp.ilim_ma >= ncp_ilim[i])
+				i++;
+			val = (i == 0) ? 0 : i - 1;
+			val = (val & SET_NCP_ILIM_MASK);
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+						LCDB_NCP_ILIM_CTL1_REG,
+						SET_NCP_ILIM_MASK | EN_NCP_ILIM_BIT,
+						val | EN_NCP_ILIM_BIT);
+			if (rc < 0) {
+				pr_err("Failed to configure NCP ilim_ma (CTL1=%d) rc=%d\n",
+								val, rc);
+				return rc;
+			}
+			val = val << ilim_sd_shift;
+			rc = qpnp_lcdb_masked_write(lcdb,
+					lcdb->base + ilim_ctl_reg,
+					ilim_mask, val);
+			if (rc < 0) {
+				pr_err("Failed to configure NCP ilim_ma (CTL2=%d) rc=%d\n",
+							val, rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->ncp.soft_start_us != -EINVAL) {
+			rc = qpnp_lcdb_set_soft_start(lcdb,
+				lcdb->ncp.soft_start_us, NCP);
+			if (rc < 0) {
+				pr_err("Failed to set NCP soft_start rc=%d\n",
+								rc);
+				return rc;
+			}
+		}
+	}
+
+	rc = qpnp_lcdb_get_voltage(lcdb, &lcdb->ncp.voltage_mv, NCP);
+	if (rc < 0) {
+		pr_err("Failed to get NCP volatge rc=%d\n", rc);
+		return rc;
+	}
+
+	lcdb->ncp.prev_voltage_mv = lcdb->ncp.voltage_mv;
+
+	rc = qpnp_lcdb_read(lcdb, lcdb->base +
+			LCDB_NCP_VREG_OK_CTL_REG, &val, 1);
+	if (rc < 0) {
+		pr_err("Failed to read ncp_vreg_ok rc=%d\n", rc);
+		return rc;
+	}
+	lcdb->ncp.vreg_ok_dbc_us = dbc_ncp[val & VREG_OK_DEB_MASK];
+
+	rc = qpnp_lcdb_read(lcdb, lcdb->base +
+			LCDB_NCP_SOFT_START_CTL_REG, &val, 1);
+	if (rc < 0) {
+		pr_err("Failed to read ncp_soft_start_ctl rc=%d\n", rc);
+		return rc;
+	}
+	lcdb->ncp.soft_start_us = soft_start_us[val & SOFT_START_MASK];
+
+	return rc;
+}
+
+static int qpnp_lcdb_init_bst(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0, bst_ps_min, bst_ps_step;
+	const u32 *dbc_bst;
+	u8 val = 0, pd_mask, pd_enable, mask = 0, bst_ilim_en, bst_vreg_ok_reg;
+
+	if (lcdb->subtype == PM7325B) {
+		pd_mask = (u8)PM7325B_BOOST_EN_PULLDOWN_BIT;
+		pd_enable = (u8)PM7325B_BOOST_EN_PULLDOWN_BIT;
+		bst_ilim_en = 0;
+		bst_ps_step = 24;
+		bst_ps_min = PM7325B_MIN_BST_PS_MV;
+		dbc_bst = bst_dbc_us;
+		bst_vreg_ok_reg = (u8)PM7325B_LCDB_BST_VREG_OK_CTL_REG;
+	} else {
+		pd_mask = (u8)BOOST_DIS_PULLDOWN_BIT;
+		pd_enable = (u8)~BOOST_DIS_PULLDOWN_BIT;
+		bst_ilim_en = (u8)EN_BST_ILIM_BIT;
+		bst_ps_step = 10;
+		bst_ps_min = MIN_BST_PS_MA;
+		dbc_bst = dbc_us;
+		bst_vreg_ok_reg = (u8)LCDB_BST_VREG_OK_CTL_REG;
+	}
+
+	/* configure parameters only if LCDB is disabled */
+	if (!is_lcdb_enabled(lcdb)) {
+		if (lcdb->bst.pd != -EINVAL) {
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_BST_PD_CTL_REG, pd_mask,
+				lcdb->bst.pd ? pd_enable : ~pd_enable);
+			if (rc < 0) {
+				pr_err("Failed to configure BST PD rc=%d\n",
+									rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->bst.pd_strength != -EINVAL) {
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_BST_PD_CTL_REG, BOOST_PD_STRENGTH_BIT,
+				lcdb->bst.pd_strength ?
+				BOOST_PD_STRENGTH_BIT : 0);
+			if (rc < 0) {
+				pr_err("Failed to configure NCP PD strength %s rc=%d\n",
+					lcdb->bst.pd_strength ?
+					"(strong)" : "(weak)", rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->bst.ilim_ma != -EINVAL) {
+			if (lcdb->subtype == PM7325B) {
+				val = (lcdb->bst.ilim_ma - PM7325B_MIN_BST_ILIM_MA)
+					/ PM7325B_BST_ILIM_MA_STEP;
+			} else {
+				val = (lcdb->bst.ilim_ma / MIN_BST_ILIM_MA) - 1;
+			}
+			val = (val & SET_BST_ILIM_MASK) | bst_ilim_en;
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_BST_ILIM_CTL_REG,
+				SET_BST_ILIM_MASK | bst_ilim_en, val);
+			if (rc < 0) {
+				pr_err("Failed to configure BST ilim_ma rc=%d\n",
+									rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->bst.ps != -EINVAL) {
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					LCDB_PS_CTL_REG, EN_PS_BIT,
+					lcdb->bst.ps ? EN_PS_BIT : 0);
+			if (rc < 0) {
+				pr_err("Failed to disable BST PS rc=%d\n", rc);
+				return rc;
+			}
+		}
+
+		if (lcdb->bst.ps_threshold != -EINVAL) {
+			mask = (lcdb->subtype == PM660L) ?
+					PM660_PS_THRESH_MASK : PS_THRESH_MASK;
+			val = (lcdb->bst.ps_threshold - bst_ps_min) / bst_ps_step;
+			val = (val & mask) | EN_PS_BIT;
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+						LCDB_PS_CTL_REG,
+						mask | EN_PS_BIT, val);
+			if (rc < 0) {
+				pr_err("Failed to configure BST PS threshold rc=%d\n",
+								rc);
+				return rc;
+			}
+		}
+	}
+
+	rc = qpnp_lcdb_get_voltage(lcdb, &lcdb->bst.voltage_mv, BST);
+	if (rc < 0) {
+		pr_err("Failed to get BST voltage rc=%d\n", rc);
+		return rc;
+	}
+
+	rc = qpnp_lcdb_read(lcdb, lcdb->base +
+			bst_vreg_ok_reg, &val, 1);
+	if (rc < 0) {
+		pr_err("Failed to read bst_vreg_ok rc=%d\n", rc);
+		return rc;
+	}
+	lcdb->bst.vreg_ok_dbc_us = dbc_bst[val & VREG_OK_DEB_MASK];
+
+	if (lcdb->subtype == PM660L) {
+		rc = qpnp_lcdb_read(lcdb, lcdb->base +
+				    LCDB_SOFT_START_CTL_REG, &val, 1);
+		if (rc < 0) {
+			pr_err("Failed to read lcdb_soft_start_ctl rc=%d\n",
+									rc);
+			return rc;
+		}
+		lcdb->bst.soft_start_us = (val & SOFT_START_MASK) * 200 + 200;
+		if (!lcdb->bst.headroom_mv)
+			lcdb->bst.headroom_mv = PM660_BST_HEADROOM_DEFAULT_MV;
+	} else {
+		rc = qpnp_lcdb_read(lcdb, lcdb->base +
+				    LCDB_BST_SS_CTL_REG, &val, 1);
+		if (rc < 0) {
+			pr_err("Failed to read bst_soft_start_ctl rc=%d\n", rc);
+			return rc;
+		}
+		lcdb->bst.soft_start_us = soft_start_us[val & SOFT_START_MASK];
+		if (!lcdb->bst.headroom_mv)
+			lcdb->bst.headroom_mv = BST_HEADROOM_DEFAULT_MV;
+	}
+
+	return 0;
+}
+
+static void qpnp_lcdb_pmic_config(struct qpnp_lcdb *lcdb)
+{
+	switch (lcdb->subtype) {
+	case PMI632:
+	case PM6150L:
+	case PM7325B:
+		lcdb->wa_flags |= FORCE_PD_ENABLE_WA;
+		break;
+	default:
+		break;
+	}
+
+	pr_debug("LCDB wa_flags = 0x%2x\n", lcdb->wa_flags);
+}
+
+static int qpnp_lcdb_hw_init(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0;
+	u8 val = 0;
+
+	qpnp_lcdb_pmic_config(lcdb);
+
+	if (lcdb->pwrdn_delay_ms != -EINVAL) {
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					    LCDB_PWRUP_PWRDN_CTL_REG,
+					    PWRDN_DELAY_MASK,
+					    lcdb->pwrdn_delay_ms);
+		if (rc < 0)
+			return rc;
+	}
+
+	if (lcdb->pwrup_delay_ms != -EINVAL) {
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					    LCDB_PWRUP_PWRDN_CTL_REG,
+					    PWRUP_DELAY_MASK,
+					    lcdb->pwrup_delay_ms << PWRUP_DELAY_SHIFT);
+		if (rc < 0)
+			return rc;
+	}
+
+	if (lcdb->pwrup_config != -EINVAL) {
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					    LCDB_CONFIG_SEL_REG,
+					    PWRUP_CONFIG_SEL_MASK,
+					    lcdb->pwrup_config);
+		if (rc < 0)
+			return rc;
+	}
+
+	if (lcdb->high_p2_blk_ns != -EINVAL) {
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					    PM7325B_LCDB_P2_BLANK_TIMER_REG,
+					    HIGH_P2_BLK_SEL_MASK,
+					    lcdb->high_p2_blk_ns << HIGH_P2_BLK_SEL_SHIFT);
+		if (rc < 0)
+			return rc;
+	}
+
+	if (lcdb->low_p2_blk_ns != -EINVAL) {
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					    PM7325B_LCDB_P2_BLANK_TIMER_REG,
+					    LOW_P2_BLK_SEL_MASK,
+					    lcdb->low_p2_blk_ns);
+		if (rc < 0)
+			return rc;
+	}
+
+	if (lcdb->mpc_current_thr_ma != -EINVAL) {
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					    PM7325B_LCDB_MPC_CTL_REG,
+					    MPC_NCP_SD_SEL_MASK,
+					    lcdb->mpc_current_thr_ma);
+		if (rc < 0)
+			return rc;
+	}
+
+	if (lcdb->ncp_symmetry) {
+		rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+					    LCDB_NCP_OUTPUT_VOLTAGE_REG,
+					    EN_NCP_VOUT_SYMMETRY_BIT,
+					    EN_NCP_VOUT_SYMMETRY_BIT);
+		if (rc < 0)
+			return rc;
+	}
+
+	rc = qpnp_lcdb_init_bst(lcdb);
+	if (rc < 0) {
+		pr_err("Failed to initialize BOOST rc=%d\n", rc);
+		return rc;
+	}
+
+	rc = qpnp_lcdb_init_ldo(lcdb);
+	if (rc < 0) {
+		pr_err("Failed to initialize LDO rc=%d\n", rc);
+		return rc;
+	}
+
+	rc = qpnp_lcdb_init_ncp(lcdb);
+	if (rc < 0) {
+		pr_err("Failed to initialize NCP rc=%d\n", rc);
+		return rc;
+	}
+
+	if (lcdb->sc_irq >= 0) {
+		lcdb->sc_count = 0;
+		rc = devm_request_threaded_irq(lcdb->dev, lcdb->sc_irq,
+				NULL, qpnp_lcdb_sc_irq_handler, IRQF_ONESHOT,
+				"qpnp_lcdb_sc_irq", lcdb);
+		if (rc < 0) {
+			pr_err("Unable to request sc(%d) irq rc=%d\n",
+						lcdb->sc_irq, rc);
+			return rc;
+		}
+	}
+
+	if (!is_lcdb_enabled(lcdb)) {
+		rc = qpnp_lcdb_read(lcdb, lcdb->base +
+				LCDB_MODULE_RDY_REG, &val, 1);
+		if (rc < 0) {
+			pr_err("Failed to read MODULE_RDY rc=%d\n", rc);
+			return rc;
+		}
+		if (!(val & MODULE_RDY_BIT)) {
+			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
+				LCDB_MODULE_RDY_REG, MODULE_RDY_BIT,
+						MODULE_RDY_BIT);
+			if (rc < 0) {
+				pr_err("Failed to set MODULE RDY rc=%d\n", rc);
+				return rc;
+			}
+		}
+	} else {
+		/* module already enabled */
+		lcdb->lcdb_enabled = true;
+	}
+
+	return 0;
+}
+
+static int qpnp_lcdb_pwrup_dn_delay(int val, int *delay)
+{
+	int i;
+
+	if (!is_between(val, PWRDN_DELAY_MIN_MS, PWRDN_DELAY_MAX_MS)) {
+		pr_err("Invalid PWR_UP_DN_DLY val %d (min=%d max=%d)\n",
+			val, PWRDN_DELAY_MIN_MS, PWRDN_DELAY_MAX_MS);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(pwrup_pwrdn_ms); i++) {
+		if (val == pwrup_pwrdn_ms[i]) {
+			*delay = i;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int qpnp_lcdb_p2_blk_time(int val, int *time)
+{
+	int i;
+
+	if (!is_between(val, pm7325b_p2_blk_ns[0], pm7325b_p2_blk_ns[7])) {
+		pr_err("Invalid P2_BLK_TIME val %d (min=%d max=%d)\n",
+			val, pm7325b_p2_blk_ns[0], pm7325b_p2_blk_ns[7]);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(pm7325b_p2_blk_ns); i++) {
+		if (val == pm7325b_p2_blk_ns[i]) {
+			*time = i;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int qpnp_lcdb_mpc_current(int val, int *cur)
+{
+	if (!is_between(val, MPC_CURRENT_MIN, MPC_CURRENT_MAX)) {
+		pr_err("Invalid MPC_CURRENT val %d (min=%d max=%d)\n",
+			val, MPC_CURRENT_MIN, MPC_CURRENT_MAX);
+		return -EINVAL;
+	}
+
+	*cur = (val - MPC_CURRENT_MIN) / MPC_CURRENT_STEP;
+
+	return 0;
+}
+
+static int qpnp_lcdb_parse_dt(struct qpnp_lcdb *lcdb)
+{
+	int rc = 0;
+	u32 tmp;
+	const char *label;
+	struct device_node *temp, *node = lcdb->dev->of_node;
+
+	for_each_available_child_of_node(node, temp) {
+		rc = of_property_read_string(temp, "label", &label);
+		if (rc < 0) {
+			pr_err("Failed to read label rc=%d\n", rc);
+			return rc;
+		}
+
+		if (!strcmp(label, "ldo")) {
+			lcdb->ldo.node = temp;
+			rc = qpnp_lcdb_ldo_dt_init(lcdb);
+		} else if (!strcmp(label, "ncp")) {
+			lcdb->ncp.node = temp;
+			rc = qpnp_lcdb_ncp_dt_init(lcdb);
+		} else if (!strcmp(label, "bst")) {
+			lcdb->bst.node = temp;
+			rc = qpnp_lcdb_bst_dt_init(lcdb);
+		} else {
+			pr_err("Failed to identify label %s\n", label);
+			return -EINVAL;
+		}
+		if (rc < 0) {
+			pr_err("Failed to register %s module\n", label);
+			return rc;
+		}
+	}
+
+	if (of_property_read_bool(node, "qcom,ttw-enable")) {
+		rc = qpnp_lcdb_parse_ttw(lcdb);
+		if (rc < 0) {
+			pr_err("Failed to parse ttw-params rc=%d\n", rc);
+			return rc;
+		}
+		lcdb->ttw_enable = true;
+	}
+
+	lcdb->sc_irq = -EINVAL;
+	if (lcdb->subtype != PM660L) {
+		lcdb->sc_irq = platform_get_irq_byname(lcdb->pdev, "sc-irq");
+		if (lcdb->sc_irq < 0)
+			pr_debug("sc irq is not defined\n");
+	}
+
+	lcdb->voltage_step_ramp =
+			of_property_read_bool(node, "qcom,voltage-step-ramp");
+
+	lcdb->ncp_symmetry =
+			of_property_read_bool(node, "qcom,ncp-symmetry");
+
+	lcdb->pwrdn_delay_ms = -EINVAL;
+	lcdb->pwrup_delay_ms = -EINVAL;
+	lcdb->pwrup_config = -EINVAL;
+	lcdb->high_p2_blk_ns = -EINVAL;
+	lcdb->low_p2_blk_ns = -EINVAL;
+	lcdb->mpc_current_thr_ma = -EINVAL;
+	rc = of_property_read_u32(node, "qcom,pwrdn-delay-ms", &tmp);
+	if (!rc) {
+		rc = qpnp_lcdb_pwrup_dn_delay(tmp, &lcdb->pwrdn_delay_ms);
+		if (rc < 0)
+			return rc;
+	}
+
+	rc = of_property_read_u32(node, "qcom,pwrup-delay-ms", &tmp);
+	if (!rc) {
+		rc = qpnp_lcdb_pwrup_dn_delay(tmp, &lcdb->pwrup_delay_ms);
+		if (rc < 0)
+			return rc;
+	}
+
+	rc = of_property_read_u32(node, "qcom,pwrup-config", &lcdb->pwrup_config);
+	if (!rc && lcdb->pwrup_config > PWRUP_CONFIG_MAX) {
+		pr_err("Invalid pwrup config %d, max=%d\n",
+			lcdb->pwrup_config, PWRUP_CONFIG_MAX);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32(node, "qcom,high-p2-blank-time-ns", &tmp);
+	if (!rc) {
+		rc = qpnp_lcdb_p2_blk_time(tmp, &lcdb->high_p2_blk_ns);
+		if (rc < 0)
+			return rc;
+	}
+
+	rc = of_property_read_u32(node, "qcom,low-p2-blank-time-ns", &tmp);
+	if (!rc) {
+		rc = qpnp_lcdb_p2_blk_time(tmp, &lcdb->low_p2_blk_ns);
+		if (rc < 0)
+			return rc;
+	}
+
+	rc = of_property_read_u32(node, "qcom,mpc-current-thr-ma", &tmp);
+	if (!rc) {
+		rc = qpnp_lcdb_mpc_current(tmp, &lcdb->mpc_current_thr_ma);
+		if (rc < 0)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int qpnp_lcdb_regulator_probe(struct platform_device *pdev)
+{
+	int rc;
+	struct device_node *node;
+	struct qpnp_lcdb *lcdb;
+	const struct of_device_id *dev_id;
+
+	node = pdev->dev.of_node;
+	if (!node) {
+		pr_err("No nodes defined\n");
+		return -ENODEV;
+	}
+
+	lcdb = devm_kzalloc(&pdev->dev, sizeof(*lcdb), GFP_KERNEL);
+	if (!lcdb)
+		return -ENOMEM;
+
+	rc = of_property_read_u32(node, "reg", &lcdb->base);
+	if (rc < 0) {
+		pr_err("Failed to find reg node rc=%d\n", rc);
+		return rc;
+	}
+
+	lcdb->regmap = dev_get_regmap(pdev->dev.parent, NULL);
+	if (!lcdb->regmap) {
+		pr_err("Failed to get the regmap handle rc=%d\n", rc);
+		return -EINVAL;
+	}
+
+	lcdb->subtype = (u8)(unsigned long)of_device_get_match_data(&pdev->dev);
+	lcdb->dev = &pdev->dev;
+	lcdb->pdev = pdev;
+	dev_id = of_match_device(lcdb->dev->driver->of_match_table, lcdb->dev);
+
+	lcdb->min_voltage_mv = (lcdb->subtype == PM7325B) ?
+			       PM7325B_MIN_VOLTAGE_MV : MIN_VOLTAGE_MV;
+	lcdb->max_voltage_mv = (lcdb->subtype == PM7325B) ?
+			       PM7325B_MAX_VOLTAGE_MV : MAX_VOLTAGE_MV;
+
+	mutex_init(&lcdb->lcdb_mutex);
+	mutex_init(&lcdb->read_write_mutex);
+
+	rc = qpnp_lcdb_parse_dt(lcdb);
+	if (rc < 0) {
+		pr_err("Failed to parse dt rc=%d\n", rc);
+		return rc;
+	}
+
+	rc = qpnp_lcdb_hw_init(lcdb);
+	if (rc < 0) {
+		pr_err("Failed to initialize LCDB module rc=%d\n", rc);
+		return rc;
+	}
+
+	rc = qpnp_lcdb_regulator_register(lcdb, LDO);
+	if (rc < 0) {
+		pr_err("Failed to register LDO rc=%d\n", rc);
+		return rc;
+	}
+
+	rc = qpnp_lcdb_regulator_register(lcdb, NCP);
+	if (rc < 0) {
+		pr_err("Failed to register NCP rc=%d\n", rc);
+		return rc;
+	}
+
+	dev_set_drvdata(&pdev->dev, lcdb);
+
+	pr_info("LCDB module: %s successfully registered! lcdb_en=%d ldo_voltage=%dmV ncp_voltage=%dmV bst_voltage=%dmV\n",
+		dev_id->compatible, lcdb->lcdb_enabled, lcdb->ldo.voltage_mv,
+		lcdb->ncp.voltage_mv, lcdb->bst.voltage_mv);
+
+	return rc;
+}
+
+static int qpnp_lcdb_regulator_remove(struct platform_device *pdev)
+{
+	struct qpnp_lcdb *lcdb = dev_get_drvdata(&pdev->dev);
+
+	mutex_destroy(&lcdb->lcdb_mutex);
+	mutex_destroy(&lcdb->read_write_mutex);
+
+	return 0;
+}
+
+static const struct of_device_id lcdb_match_table[] = {
+	{ .compatible = QPNP_LCDB_REGULATOR_DRIVER_NAME,
+		.data = (void *)PM_DEFAULT,},
+	{ .compatible = QPNP_LCDB_REGULATOR_DRIVER_660,
+		.data = (void *)PM660L,},
+	{ .compatible = QPNP_LCDB_REGULATOR_DRIVER_632,
+		.data = (void *)PMI632,},
+	{ .compatible = QPNP_LCDB_REGULATOR_DRIVER_6150L,
+		.data = (void *)PM6150L,},
+	{ .compatible = QPNP_LCDB_REGULATOR_DRIVER_7325B,
+		.data = (void *)PM7325B,},
+	{ },
+};
+
+static int qpnp_lcdb_regulator_freeze(struct device *dev)
+{
+	struct qpnp_lcdb *lcdb = dev_get_drvdata(dev);
+
+	/* free sc irq */
+	if (lcdb->sc_irq >= 0)
+		devm_free_irq(lcdb->dev, lcdb->sc_irq, lcdb);
+
+	return 0;
+}
+
+static int qpnp_lcdb_regulator_restore(struct device *dev)
+{
+	struct qpnp_lcdb *lcdb = dev_get_drvdata(dev);
+
+	/* do hw init & request sc irq again */
+	return qpnp_lcdb_hw_init(lcdb);
+}
+
+static const struct dev_pm_ops qpnp_lcdb_regulator_pm_ops = {
+	.freeze = qpnp_lcdb_regulator_freeze,
+	.restore = qpnp_lcdb_regulator_restore,
+};
+
+static struct platform_driver qpnp_lcdb_regulator_driver = {
+	.driver		= {
+		.name		= QPNP_LCDB_REGULATOR_DRIVER_NAME,
+		.of_match_table	= lcdb_match_table,
+		.pm		= &qpnp_lcdb_regulator_pm_ops,
+	},
+	.probe		= qpnp_lcdb_regulator_probe,
+	.remove		= qpnp_lcdb_regulator_remove,
+};
+
+static int __init qpnp_lcdb_regulator_init(void)
+{
+	return platform_driver_register(&qpnp_lcdb_regulator_driver);
+}
+arch_initcall(qpnp_lcdb_regulator_init);
+
+static void __exit qpnp_lcdb_regulator_exit(void)
+{
+	platform_driver_unregister(&qpnp_lcdb_regulator_driver);
+}
+module_exit(qpnp_lcdb_regulator_exit);
+
+MODULE_DESCRIPTION("QPNP LCDB regulator driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/regulator/rk808-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/rk808-regulator.c
@@ -1284,6 +1284,8 @@
 		.n_linear_ranges = ARRAY_SIZE(rk817_buck1_voltage_ranges),
 		.vsel_reg = RK817_BUCK3_ON_VSEL_REG,
 		.vsel_mask = RK817_BUCK_VSEL_MASK,
+		.apply_reg = RK817_POWER_CONFIG,
+		.apply_bit = RK817_BUCK3_FB_RES_INTER,
 		.enable_reg = RK817_POWER_EN_REG(0),
 		.enable_mask = ENABLE_MASK(RK817_ID_DCDC3),
 		.enable_val = ENABLE_MASK(RK817_ID_DCDC3),
@@ -1645,7 +1647,7 @@
 		}
 
 		if (!pdata->dvs_gpio[i]) {
-			dev_info(dev, "there is no dvs%d gpio\n", i);
+			dev_dbg(dev, "there is no dvs%d gpio\n", i);
 			continue;
 		}
 
@@ -1681,12 +1683,6 @@
 	if (!pdata)
 		return -ENOMEM;
 
-	ret = rk808_regulator_dt_parse_pdata(&pdev->dev, regmap, pdata);
-	if (ret < 0)
-		return ret;
-
-	platform_set_drvdata(pdev, pdata);
-
 	switch (rk808->variant) {
 	case RK805_ID:
 		regulators = rk805_reg;
@@ -1697,6 +1693,11 @@
 		nregulators = ARRAY_SIZE(rk806_reg);
 		break;
 	case RK808_ID:
+		/* DVS0/1 GPIOs are supported on the RK808 only */
+		ret = rk808_regulator_dt_parse_pdata(&pdev->dev, regmap, pdata);
+		if (ret < 0)
+			return ret;
+
 		regulators = rk808_reg;
 		nregulators = RK808_NUM_REGULATORS;
 		break;
@@ -1718,6 +1719,8 @@
 		return -EINVAL;
 	}
 
+	platform_set_drvdata(pdev, pdata);
+
 	config.dev = &pdev->dev;
 	config.driver_data = pdata;
 	config.regmap = regmap;
--- linux-qcom-6.8.0.orig/drivers/regulator/rtq2208-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/rtq2208-regulator.c
@@ -513,7 +513,7 @@
 	struct regmap *regmap;
 	struct rtq2208_regulator_desc *rdesc[RTQ2208_LDO_MAX];
 	struct regulator_dev *rdev;
-	struct regulator_config cfg;
+	struct regulator_config cfg = {};
 	struct rtq2208_rdev_map *rdev_map;
 	int i, ret = 0, idx, n_regulator = 0;
 	unsigned int regulator_idx_table[RTQ2208_LDO_MAX],
--- linux-qcom-6.8.0.orig/drivers/regulator/tps6287x-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/tps6287x-regulator.c
@@ -115,6 +115,7 @@
 	.vsel_mask = 0xFF,
 	.vsel_range_reg = TPS6287X_CTRL2,
 	.vsel_range_mask = TPS6287X_CTRL2_VRANGE,
+	.range_applied_by_vsel = true,
 	.ramp_reg = TPS6287X_CTRL1,
 	.ramp_mask = TPS6287X_CTRL1_VRAMP,
 	.ramp_delay_table = tps6287x_ramp_table,
--- linux-qcom-6.8.0.orig/drivers/regulator/tps65132-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/tps65132-regulator.c
@@ -267,10 +267,17 @@
 };
 MODULE_DEVICE_TABLE(i2c, tps65132_id);
 
+static const struct of_device_id __maybe_unused tps65132_of_match[] = {
+	{ .compatible = "ti,tps65132" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, tps65132_of_match);
+
 static struct i2c_driver tps65132_i2c_driver = {
 	.driver = {
 		.name = "tps65132",
 		.probe_type = PROBE_PREFER_ASYNCHRONOUS,
+		.of_match_table = of_match_ptr(tps65132_of_match),
 	},
 	.probe = tps65132_probe,
 	.id_table = tps65132_id,
--- linux-qcom-6.8.0.orig/drivers/regulator/tps6594-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/tps6594-regulator.c
@@ -287,30 +287,30 @@
 static const struct regulator_desc multi_regs[] = {
 	TPS6594_REGULATOR("BUCK12", "buck12", TPS6594_BUCK_1,
 			  REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET,
-			  TPS6594_REG_BUCKX_VOUT_1(1),
+			  TPS6594_REG_BUCKX_VOUT_1(0),
 			  TPS6594_MASK_BUCKS_VSET,
-			  TPS6594_REG_BUCKX_CTRL(1),
+			  TPS6594_REG_BUCKX_CTRL(0),
 			  TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges,
 			  4, 4000, 0, NULL, 0, 0),
 	TPS6594_REGULATOR("BUCK34", "buck34", TPS6594_BUCK_3,
 			  REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET,
-			  TPS6594_REG_BUCKX_VOUT_1(3),
+			  TPS6594_REG_BUCKX_VOUT_1(2),
 			  TPS6594_MASK_BUCKS_VSET,
-			  TPS6594_REG_BUCKX_CTRL(3),
+			  TPS6594_REG_BUCKX_CTRL(2),
 			  TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges,
 			  4, 0, 0, NULL, 0, 0),
 	TPS6594_REGULATOR("BUCK123", "buck123", TPS6594_BUCK_1,
 			  REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET,
-			  TPS6594_REG_BUCKX_VOUT_1(1),
+			  TPS6594_REG_BUCKX_VOUT_1(0),
 			  TPS6594_MASK_BUCKS_VSET,
-			  TPS6594_REG_BUCKX_CTRL(1),
+			  TPS6594_REG_BUCKX_CTRL(0),
 			  TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges,
 			  4, 4000, 0, NULL, 0, 0),
 	TPS6594_REGULATOR("BUCK1234", "buck1234", TPS6594_BUCK_1,
 			  REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET,
-			  TPS6594_REG_BUCKX_VOUT_1(1),
+			  TPS6594_REG_BUCKX_VOUT_1(0),
 			  TPS6594_MASK_BUCKS_VSET,
-			  TPS6594_REG_BUCKX_CTRL(1),
+			  TPS6594_REG_BUCKX_CTRL(0),
 			  TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges,
 			  4, 4000, 0, NULL, 0, 0),
 };
--- linux-qcom-6.8.0.orig/drivers/regulator/userspace-consumer.c
+++ linux-qcom-6.8.0/drivers/regulator/userspace-consumer.c
@@ -208,6 +208,7 @@
 	{ .compatible = "regulator-output", },
 	{},
 };
+MODULE_DEVICE_TABLE(of, regulator_userspace_consumer_of_match);
 
 static struct platform_driver regulator_userspace_consumer_driver = {
 	.probe		= regulator_userspace_consumer_probe,
--- linux-qcom-6.8.0.orig/drivers/regulator/vqmmc-ipq4019-regulator.c
+++ linux-qcom-6.8.0/drivers/regulator/vqmmc-ipq4019-regulator.c
@@ -84,6 +84,7 @@
 	{ .compatible = "qcom,vqmmc-ipq4019-regulator", },
 	{},
 };
+MODULE_DEVICE_TABLE(of, regulator_ipq4019_of_match);
 
 static struct platform_driver ipq4019_regulator_driver = {
 	.probe = ipq4019_regulator_probe,
--- linux-qcom-6.8.0.orig/drivers/remoteproc/imx_rproc.c
+++ linux-qcom-6.8.0/drivers/remoteproc/imx_rproc.c
@@ -213,7 +213,7 @@
 	/* QSPI Code - alias */
 	{ 0x08000000, 0x08000000, 0x08000000, 0 },
 	/* DDR (Code) - alias */
-	{ 0x10000000, 0x80000000, 0x0FFE0000, 0 },
+	{ 0x10000000, 0x40000000, 0x0FFE0000, 0 },
 	/* TCML */
 	{ 0x1FFE0000, 0x007E0000, 0x00020000, ATT_OWN  | ATT_IOMEM},
 	/* TCMU */
@@ -669,6 +669,17 @@
 	return (struct resource_table *)priv->rsc_table;
 }
 
+static struct resource_table *
+imx_rproc_elf_find_loaded_rsc_table(struct rproc *rproc, const struct firmware *fw)
+{
+	struct imx_rproc *priv = rproc->priv;
+
+	if (priv->rsc_table)
+		return (struct resource_table *)priv->rsc_table;
+
+	return rproc_elf_find_loaded_rsc_table(rproc, fw);
+}
+
 static const struct rproc_ops imx_rproc_ops = {
 	.prepare	= imx_rproc_prepare,
 	.attach		= imx_rproc_attach,
@@ -679,7 +690,7 @@
 	.da_to_va       = imx_rproc_da_to_va,
 	.load		= rproc_elf_load_segments,
 	.parse_fw	= imx_rproc_parse_fw,
-	.find_loaded_rsc_table = rproc_elf_find_loaded_rsc_table,
+	.find_loaded_rsc_table = imx_rproc_elf_find_loaded_rsc_table,
 	.get_loaded_rsc_table = imx_rproc_get_loaded_rsc_table,
 	.sanity_check	= rproc_elf_sanity_check,
 	.get_boot_addr	= rproc_elf_get_boot_addr,
@@ -729,31 +740,37 @@
 		struct resource res;
 
 		node = of_parse_phandle(np, "memory-region", a);
+		if (!node)
+			continue;
 		/* Not map vdevbuffer, vdevring region */
 		if (!strncmp(node->name, "vdev", strlen("vdev"))) {
 			of_node_put(node);
 			continue;
 		}
 		err = of_address_to_resource(node, 0, &res);
-		of_node_put(node);
 		if (err) {
 			dev_err(dev, "unable to resolve memory region\n");
+			of_node_put(node);
 			return err;
 		}
 
-		if (b >= IMX_RPROC_MEM_MAX)
+		if (b >= IMX_RPROC_MEM_MAX) {
+			of_node_put(node);
 			break;
+		}
 
 		/* Not use resource version, because we might share region */
 		priv->mem[b].cpu_addr = devm_ioremap_wc(&pdev->dev, res.start, resource_size(&res));
 		if (!priv->mem[b].cpu_addr) {
 			dev_err(dev, "failed to remap %pr\n", &res);
+			of_node_put(node);
 			return -ENOMEM;
 		}
 		priv->mem[b].sys_addr = res.start;
 		priv->mem[b].size = resource_size(&res);
 		if (!strcmp(node->name, "rsc-table"))
 			priv->rsc_table = priv->mem[b].cpu_addr;
+		of_node_put(node);
 		b++;
 	}
 
@@ -1128,6 +1145,8 @@
 		goto err_put_rproc;
 	}
 
+	INIT_WORK(&priv->rproc_work, imx_rproc_vq_work);
+
 	ret = imx_rproc_xtr_mbox_init(rproc);
 	if (ret)
 		goto err_put_wkq;
@@ -1146,8 +1165,6 @@
 	if (ret)
 		goto err_put_scu;
 
-	INIT_WORK(&priv->rproc_work, imx_rproc_vq_work);
-
 	if (rproc->state != RPROC_DETACHED)
 		rproc->auto_boot = of_property_read_bool(np, "fsl,auto-boot");
 
--- linux-qcom-6.8.0.orig/drivers/remoteproc/mtk_scp.c
+++ linux-qcom-6.8.0/drivers/remoteproc/mtk_scp.c
@@ -132,7 +132,7 @@
 static int scp_ipi_init(struct mtk_scp *scp, const struct firmware *fw)
 {
 	int ret;
-	size_t offset;
+	size_t buf_sz, offset;
 
 	/* read the ipi buf addr from FW itself first */
 	ret = scp_elf_read_ipi_buf_addr(scp, fw, &offset);
@@ -144,6 +144,14 @@
 	}
 	dev_info(scp->dev, "IPI buf addr %#010zx\n", offset);
 
+	/* Make sure IPI buffer fits in the L2TCM range assigned to this core */
+	buf_sz = sizeof(*scp->recv_buf) + sizeof(*scp->send_buf);
+
+	if (scp->sram_size < buf_sz + offset) {
+		dev_err(scp->dev, "IPI buffer does not fit in SRAM.\n");
+		return -EOVERFLOW;
+	}
+
 	scp->recv_buf = (struct mtk_share_obj __iomem *)
 			(scp->sram_base + offset);
 	scp->send_buf = (struct mtk_share_obj __iomem *)
@@ -1188,14 +1196,12 @@
 
 	/* l1tcm is an optional memory region */
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "l1tcm");
-	scp_cluster->l1tcm_base = devm_ioremap_resource(dev, res);
-	if (IS_ERR(scp_cluster->l1tcm_base)) {
-		ret = PTR_ERR(scp_cluster->l1tcm_base);
-		if (ret != -EINVAL)
-			return dev_err_probe(dev, ret, "Failed to map l1tcm memory\n");
+	if (res) {
+		scp_cluster->l1tcm_base = devm_ioremap_resource(dev, res);
+		if (IS_ERR(scp_cluster->l1tcm_base))
+			return dev_err_probe(dev, PTR_ERR(scp_cluster->l1tcm_base),
+					     "Failed to map l1tcm memory\n");
 
-		scp_cluster->l1tcm_base = NULL;
-	} else {
 		scp_cluster->l1tcm_size = resource_size(res);
 		scp_cluster->l1tcm_phys = res->start;
 	}
--- linux-qcom-6.8.0.orig/drivers/remoteproc/qcom_common.c
+++ linux-qcom-6.8.0/drivers/remoteproc/qcom_common.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/firmware.h>
+#include <linux/iommu.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/notifier.h>
@@ -33,6 +34,8 @@
 #define MINIDUMP_SS_ENCR_DONE		('D' << 24 | 'O' << 16 | 'N' << 8 | 'E' << 0)
 #define MINIDUMP_SS_ENABLED		('E' << 24 | 'N' << 16 | 'B' << 8 | 'L' << 0)
 
+#define SID_MASK_DEFAULT	0xfUL
+
 /**
  * struct minidump_region - Minidump region
  * @name		: Name of the region to be dumped
@@ -519,5 +522,150 @@
 }
 EXPORT_SYMBOL_GPL(qcom_remove_ssr_subdev);
 
+/**
+ * qcom_map_unmap_carveout() - iommu map and unmap carveout region
+ *
+ * @rproc:	rproc handle
+ * @mem_phys:	starting physical address of carveout region
+ * @mem_size:	size of carveout region
+ * @map:	if true, map otherwise, unmap
+ * @use_sid:	decision to append sid to iova
+ * @sid:	SID value
+ */
+int qcom_map_unmap_carveout(struct rproc *rproc, phys_addr_t mem_phys, size_t mem_size,
+			    bool map, bool use_sid, unsigned long sid)
+{
+	unsigned long iova = mem_phys;
+	unsigned long sid_def_val;
+	int ret = 0;
+
+	if (!rproc->has_iommu)
+		return 0;
+
+	if (!rproc->domain)
+		return -EINVAL;
+
+	/*
+	 * Remote processor like ADSP supports up to 36 bit device
+	 * address space and some of its clients like fastrpc uses
+	 * upper 32-35 bits to keep lower 4 bits of its SID to use
+	 * larger address space. To keep this consistent across other
+	 * use cases add remoteproc SID configuration for firmware
+	 * to IOMMU for carveouts.
+	 */
+	if (use_sid && sid) {
+		sid_def_val = sid & SID_MASK_DEFAULT;
+		iova |= ((uint64_t)sid_def_val << 32);
+	}
+
+	if (map) {
+		ret = iommu_map(rproc->domain, iova, mem_phys, mem_size,
+				IOMMU_READ | IOMMU_WRITE, GFP_KERNEL);
+		if (ret)
+			dev_err(&rproc->dev, "Unable to map IOVA Memory, ret: %d\n", ret);
+	} else {
+		iommu_unmap(rproc->domain, iova, mem_size);
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_map_unmap_carveout);
+
+/**
+ * qcom_map_devmem() - Map the device memories needed by Remoteproc using IOMMU
+ *
+ * When Qualcomm EL2 hypervisor(QHEE) present, device memories needed for remoteproc
+ * processors is managed by it and Linux remoteproc drivers should not call
+ * this and its respective unmap function in such scenario. This function
+ * should only be called if remoteproc IOMMU translation need to be managed
+ * from Linux side.
+ *
+ * @rproc: rproc handle
+ * @devmem_table: list of devmem regions to map
+ * @use_sid: decision to append sid to iova
+ * @sid: SID value
+ */
+int qcom_map_devmem(struct rproc *rproc, struct qcom_devmem_table *devmem_table,
+		    bool use_sid, unsigned long sid)
+{
+	struct qcom_devmem_info *info;
+	unsigned long sid_def_val;
+	int ret;
+	int i;
+
+	if (!rproc->has_iommu)
+		return 0;
+
+	if (!rproc->domain)
+		return -EINVAL;
+
+	/* remoteproc may not have devmem data */
+	if (!devmem_table)
+		return 0;
+
+	if (use_sid && sid)
+		sid_def_val = sid & SID_MASK_DEFAULT;
+
+	info = &devmem_table->entries[0];
+	for (i = 0; i < devmem_table->num_entries; i++, info++) {
+		/*
+		 * Remote processor like ADSP supports up to 36 bit device
+		 * address space and some of its clients like fastrpc uses
+		 * upper 32-35 bits to keep lower 4 bits of its SID to use
+		 * larger address space. To keep this consistent across other
+		 * use cases add remoteproc SID configuration for firmware
+		 * to IOMMU for carveouts.
+		 */
+		if (use_sid)
+			info->da |= ((uint64_t)sid_def_val << 32);
+
+		ret = iommu_map(rproc->domain, info->da, info->pa, info->len, info->flags,
+				GFP_KERNEL);
+		if (ret) {
+			dev_err(&rproc->dev, "Unable to map devmem, ret: %d\n", ret);
+			if (use_sid)
+				info->da &= ~(SID_MASK_DEFAULT << 32);
+			goto undo_mapping;
+		}
+	}
+
+	return 0;
+
+undo_mapping:
+	for (i = i - 1; i >= 0; i--, info--) {
+		iommu_unmap(rproc->domain, info->da, info->len);
+		if (use_sid)
+			info->da &= ~(SID_MASK_DEFAULT << 32);
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_map_devmem);
+
+/**
+ * qcom_unmap_devmem() -  unmap the device memories needed by Remoteproc using IOMMU
+ *
+ * @rproc:		rproc handle
+ * @devmem_table:	list of devmem regions to unmap
+ * @use_sid:		decision to append sid to iova
+ */
+void qcom_unmap_devmem(struct rproc *rproc, struct qcom_devmem_table *devmem_table,
+		       bool use_sid)
+{
+	struct qcom_devmem_info *info;
+	int i;
+
+	if (!rproc->has_iommu || !rproc->domain || !devmem_table)
+		return;
+
+	info = &devmem_table->entries[0];
+	for (i = 0; i < devmem_table->num_entries; i++, info++) {
+		iommu_unmap(rproc->domain, info->da, info->len);
+		if (use_sid)
+			info->da &= ~(SID_MASK_DEFAULT << 32);
+	}
+}
+EXPORT_SYMBOL_GPL(qcom_unmap_devmem);
+
 MODULE_DESCRIPTION("Qualcomm Remoteproc helper driver");
 MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/drivers/remoteproc/qcom_common.h
+++ linux-qcom-6.8.0/drivers/remoteproc/qcom_common.h
@@ -34,6 +34,36 @@
 	struct qcom_ssr_subsystem *info;
 };
 
+/**
+ * struct qcom_devmem_info - iommu devmem region
+ * @da: device address
+ * @pa: physical address
+ * @len: length (in bytes)
+ * @flags: iommu protection flags
+ *
+ * The resource entry carries the device address to which a physical address is
+ * to be mapped with required permissions in flag. The pa, len is expected to
+ * be a physically contiguous memory region.
+ */
+struct qcom_devmem_info {
+	u64 da;
+	u64 pa;
+	u32 len;
+	u32 flags;
+};
+
+/**
+ * struct qcom_devmem_table - iommu devmem entries
+ * @num_entries: number of devmem entries
+ * @entries: devmem entries
+ *
+ * The table that carries each devmem resource entry.
+ */
+struct qcom_devmem_table {
+	int num_entries;
+	struct qcom_devmem_info entries[];
+};
+
 void qcom_minidump(struct rproc *rproc, unsigned int minidump_id,
 			void (*rproc_dumpfn_t)(struct rproc *rproc,
 				struct rproc_dump_segment *segment, void *dest, size_t offset,
@@ -52,6 +82,14 @@
 			 const char *ssr_name);
 void qcom_remove_ssr_subdev(struct rproc *rproc, struct qcom_rproc_ssr *ssr);
 
+int qcom_map_unmap_carveout(struct rproc *rproc, phys_addr_t mem_phys, size_t mem_size,
+			    bool map, bool use_sid, unsigned long sid);
+
+int qcom_map_devmem(struct rproc *rproc, struct qcom_devmem_table *table,
+		    bool use_sid, unsigned long sid);
+void qcom_unmap_devmem(struct rproc *rproc, struct qcom_devmem_table *table,
+		       bool use_sid);
+
 #if IS_ENABLED(CONFIG_QCOM_SYSMON)
 struct qcom_sysmon *qcom_add_sysmon_subdev(struct rproc *rproc,
 					   const char *name,
--- linux-qcom-6.8.0.orig/drivers/remoteproc/qcom_q6v5.c
+++ linux-qcom-6.8.0/drivers/remoteproc/qcom_q6v5.c
@@ -6,6 +6,7 @@
  * Copyright (C) 2014 Sony Mobile Communications AB
  * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.
  */
+#include <linux/of_platform.h>
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 #include <linux/interconnect.h>
@@ -107,6 +108,10 @@
 		dev_err(q6v5->dev, "watchdog without message\n");
 
 	q6v5->running = false;
+
+	if (!(q6v5->rproc->dump_conf))
+		panic("SSR: Resetting the SoC.\n");
+
 	rproc_report_crash(q6v5->rproc, RPROC_WATCHDOG);
 
 	return IRQ_HANDLED;
@@ -128,6 +133,10 @@
 		dev_err(q6v5->dev, "fatal error without message\n");
 
 	q6v5->running = false;
+
+	if (!(q6v5->rproc->dump_conf))
+		panic("SSR: Resetting the SoC.\n");
+
 	rproc_report_crash(q6v5->rproc, RPROC_FATAL_ERROR);
 
 	return IRQ_HANDLED;
@@ -349,6 +358,8 @@
 		return dev_err_probe(&pdev->dev, PTR_ERR(q6v5->path),
 				     "failed to acquire interconnect path\n");
 
+	of_platform_populate(q6v5->dev->of_node, NULL, NULL, q6v5->dev);
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(qcom_q6v5_init);
@@ -359,6 +370,7 @@
  */
 void qcom_q6v5_deinit(struct qcom_q6v5 *q6v5)
 {
+	of_platform_depopulate(q6v5->dev);
 	qmp_put(q6v5->qmp);
 }
 EXPORT_SYMBOL_GPL(qcom_q6v5_deinit);
--- linux-qcom-6.8.0.orig/drivers/remoteproc/qcom_q6v5_adsp.c
+++ linux-qcom-6.8.0/drivers/remoteproc/qcom_q6v5_adsp.c
@@ -743,15 +743,21 @@
 					      desc->ssctl_id);
 	if (IS_ERR(adsp->sysmon)) {
 		ret = PTR_ERR(adsp->sysmon);
-		goto disable_pm;
+		goto deinit_remove_glink_pdm_ssr;
 	}
 
 	ret = rproc_add(rproc);
 	if (ret)
-		goto disable_pm;
+		goto remove_sysmon;
 
 	return 0;
 
+remove_sysmon:
+	qcom_remove_sysmon_subdev(adsp->sysmon);
+deinit_remove_glink_pdm_ssr:
+	qcom_q6v5_deinit(&adsp->q6v5);
+	qcom_remove_glink_subdev(rproc, &adsp->glink_subdev);
+	qcom_remove_ssr_subdev(rproc, &adsp->ssr_subdev);
 disable_pm:
 	qcom_rproc_pds_detach(adsp, adsp->proxy_pds, adsp->proxy_pd_count);
 
--- linux-qcom-6.8.0.orig/drivers/remoteproc/qcom_q6v5_mss.c
+++ linux-qcom-6.8.0/drivers/remoteproc/qcom_q6v5_mss.c
@@ -230,7 +230,6 @@
 	struct qcom_rproc_subdev smd_subdev;
 	struct qcom_rproc_ssr ssr_subdev;
 	struct qcom_sysmon *sysmon;
-	struct platform_device *bam_dmux;
 	bool need_mem_protection;
 	bool has_alt_reset;
 	bool has_mba_logs;
@@ -1161,6 +1160,9 @@
 		goto disable_active_clks;
 	}
 
+	if (qproc->has_mba_logs)
+		qcom_pil_info_store("mba", qproc->mba_phys, MBA_LOG_SIZE);
+
 	writel(qproc->mba_phys, qproc->rmb_base + RMB_MBA_IMAGE_REG);
 	if (qproc->dp_size) {
 		writel(qproc->mba_phys + SZ_1M, qproc->rmb_base + RMB_PMI_CODE_START_REG);
@@ -1171,9 +1173,6 @@
 	if (ret)
 		goto reclaim_mba;
 
-	if (qproc->has_mba_logs)
-		qcom_pil_info_store("mba", qproc->mba_phys, MBA_LOG_SIZE);
-
 	ret = q6v5_rmb_mba_wait(qproc, 0, 5000);
 	if (ret == -ETIMEDOUT) {
 		dev_err(qproc->dev, "MBA boot timed out\n");
@@ -1969,7 +1968,6 @@
 static int q6v5_probe(struct platform_device *pdev)
 {
 	const struct rproc_hexagon_res *desc;
-	struct device_node *node;
 	struct q6v5 *qproc;
 	struct rproc *rproc;
 	const char *mba_image;
@@ -2113,10 +2111,6 @@
 	if (ret)
 		goto remove_sysmon_subdev;
 
-	node = of_get_compatible_child(pdev->dev.of_node, "qcom,bam-dmux");
-	qproc->bam_dmux = of_platform_device_create(node, NULL, &pdev->dev);
-	of_node_put(node);
-
 	return 0;
 
 remove_sysmon_subdev:
@@ -2138,8 +2132,6 @@
 	struct q6v5 *qproc = platform_get_drvdata(pdev);
 	struct rproc *rproc = qproc->rproc;
 
-	if (qproc->bam_dmux)
-		of_platform_device_destroy(&qproc->bam_dmux->dev, NULL);
 	rproc_del(rproc);
 
 	qcom_q6v5_deinit(&qproc->q6v5);
--- linux-qcom-6.8.0.orig/drivers/remoteproc/qcom_q6v5_pas.c
+++ linux-qcom-6.8.0/drivers/remoteproc/qcom_q6v5_pas.c
@@ -20,6 +20,7 @@
 #include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
 #include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/firmware/qcom/qcom_tzmem.h>
 #include <linux/regulator/consumer.h>
 #include <linux/remoteproc.h>
 #include <linux/soc/qcom/mdt_loader.h>
@@ -33,6 +34,9 @@
 
 #define ADSP_DECRYPT_SHUTDOWN_DELAY_MS	100
 
+#define MAX_ASSIGN_COUNT 3
+#define DEVMEM_ENTRY_SIZE 4
+
 struct adsp_data {
 	int crash_reason_smem;
 	const char *firmware_name;
@@ -49,8 +53,12 @@
 	const char *ssr_name;
 	const char *sysmon_name;
 	int ssctl_id;
+	unsigned int smem_host_id;
 
 	int region_assign_idx;
+	int region_assign_count;
+	bool region_assign_shared;
+	int region_assign_vmid;
 };
 
 struct qcom_adsp {
@@ -74,6 +82,7 @@
 	int dtb_pas_id;
 	unsigned int minidump_id;
 	int crash_reason_smem;
+	unsigned int smem_host_id;
 	bool decrypt_shutdown;
 	const char *info_name;
 
@@ -87,15 +96,18 @@
 	phys_addr_t dtb_mem_phys;
 	phys_addr_t mem_reloc;
 	phys_addr_t dtb_mem_reloc;
-	phys_addr_t region_assign_phys;
+	phys_addr_t region_assign_phys[MAX_ASSIGN_COUNT];
 	void *mem_region;
 	void *dtb_mem_region;
 	size_t mem_size;
 	size_t dtb_mem_size;
-	size_t region_assign_size;
+	size_t region_assign_size[MAX_ASSIGN_COUNT];
 
 	int region_assign_idx;
-	u64 region_assign_perms;
+	int region_assign_count;
+	bool region_assign_shared;
+	int region_assign_vmid;
+	u64 region_assign_owners[MAX_ASSIGN_COUNT];
 
 	struct qcom_rproc_glink glink_subdev;
 	struct qcom_rproc_subdev smd_subdev;
@@ -104,6 +116,10 @@
 
 	struct qcom_scm_pas_metadata pas_metadata;
 	struct qcom_scm_pas_metadata dtb_pas_metadata;
+
+	struct qcom_devmem_table *devmem;
+	struct qcom_tzmem_area *tzmem;
+	unsigned long sid;
 };
 
 static void adsp_segment_dump(struct rproc *rproc, struct rproc_dump_segment *segment,
@@ -243,6 +259,43 @@
 	return ret;
 }
 
+static int adsp_create_shmbridge(struct qcom_adsp *adsp)
+{
+	struct qcom_tzmem_area *rproc_tzmem;
+	struct rproc *rproc = adsp->rproc;
+	int ret;
+
+	if (!rproc->has_iommu)
+		return 0;
+
+	rproc_tzmem = devm_kzalloc(adsp->dev, sizeof(*rproc_tzmem), GFP_KERNEL);
+	if (!rproc_tzmem)
+		return -ENOMEM;
+
+	rproc_tzmem->size = PAGE_ALIGN(adsp->mem_size);
+	rproc_tzmem->paddr = adsp->mem_phys;
+	ret = qcom_tzmem_init_area(rproc_tzmem);
+	if (ret) {
+		dev_err(adsp->dev,
+			"failed to create shmbridge for carveout: %d\n", ret);
+		return ret;
+	}
+
+	adsp->tzmem = rproc_tzmem;
+
+	return ret;
+}
+
+static void adsp_delete_shmbridge(struct qcom_adsp *adsp)
+{
+	struct rproc *rproc = adsp->rproc;
+
+	if (!rproc->has_iommu)
+		return;
+
+	qcom_tzmem_cleanup_area(adsp->tzmem);
+}
+
 static int adsp_start(struct rproc *rproc)
 {
 	struct qcom_adsp *adsp = rproc->priv;
@@ -252,9 +305,21 @@
 	if (ret)
 		return ret;
 
+	ret = qcom_map_unmap_carveout(rproc, adsp->mem_phys, adsp->mem_size, true, true, adsp->sid);
+	if (ret) {
+		dev_err(adsp->dev, "iommu mapping failed, ret: %d\n", ret);
+		goto disable_irqs;
+	}
+
+	ret = qcom_map_devmem(rproc, adsp->devmem, true, adsp->sid);
+	if (ret) {
+		dev_err(adsp->dev, "devmem iommu mapping failed, ret: %d\n", ret);
+		goto unmap_carveout;
+	}
+
 	ret = adsp_pds_enable(adsp, adsp->proxy_pds, adsp->proxy_pd_count);
 	if (ret < 0)
-		goto disable_irqs;
+		goto unmap_devmem;
 
 	ret = clk_prepare_enable(adsp->xo);
 	if (ret)
@@ -298,6 +363,10 @@
 
 	qcom_pil_info_store(adsp->info_name, adsp->mem_phys, adsp->mem_size);
 
+	ret = adsp_create_shmbridge(adsp);
+	if (ret)
+		goto release_pas_metadata;
+
 	ret = qcom_scm_pas_auth_and_reset(adsp->pas_id);
 	if (ret) {
 		dev_err(adsp->dev,
@@ -305,6 +374,7 @@
 		goto release_pas_metadata;
 	}
 
+	adsp_delete_shmbridge(adsp);
 	ret = qcom_q6v5_wait_for_start(&adsp->q6v5, msecs_to_jiffies(5000));
 	if (ret == -ETIMEDOUT) {
 		dev_err(adsp->dev, "start timed out\n");
@@ -337,6 +407,10 @@
 	clk_disable_unprepare(adsp->xo);
 disable_proxy_pds:
 	adsp_pds_disable(adsp, adsp->proxy_pds, adsp->proxy_pd_count);
+unmap_devmem:
+	qcom_unmap_devmem(rproc, adsp->devmem, adsp->sid);
+unmap_carveout:
+	qcom_map_unmap_carveout(rproc, adsp->mem_phys, adsp->mem_size, false, true, adsp->sid);
 disable_irqs:
 	qcom_q6v5_unprepare(&adsp->q6v5);
 
@@ -382,10 +456,16 @@
 			dev_err(adsp->dev, "failed to shutdown dtb: %d\n", ret);
 	}
 
+	qcom_unmap_devmem(rproc, adsp->devmem, adsp->sid);
+	qcom_map_unmap_carveout(rproc, adsp->mem_phys, adsp->mem_size, false, true, adsp->sid);
+
 	handover = qcom_q6v5_unprepare(&adsp->q6v5);
 	if (handover)
 		qcom_pas_handover(&adsp->q6v5);
 
+	if (adsp->smem_host_id)
+		ret = qcom_smem_bust_hwspin_lock_by_host(adsp->smem_host_id);
+
 	return ret;
 }
 
@@ -590,37 +670,53 @@
 
 static int adsp_assign_memory_region(struct qcom_adsp *adsp)
 {
-	struct reserved_mem *rmem = NULL;
-	struct qcom_scm_vmperm perm;
+	struct qcom_scm_vmperm perm[MAX_ASSIGN_COUNT];
 	struct device_node *node;
+	unsigned int perm_size;
+	int offset;
 	int ret;
 
 	if (!adsp->region_assign_idx)
 		return 0;
 
-	node = of_parse_phandle(adsp->dev->of_node, "memory-region", adsp->region_assign_idx);
-	if (node)
-		rmem = of_reserved_mem_lookup(node);
-	of_node_put(node);
-	if (!rmem) {
-		dev_err(adsp->dev, "unable to resolve shareable memory-region\n");
-		return -EINVAL;
-	}
+	for (offset = 0; offset < adsp->region_assign_count; ++offset) {
+		struct reserved_mem *rmem = NULL;
 
-	perm.vmid = QCOM_SCM_VMID_MSS_MSA;
-	perm.perm = QCOM_SCM_PERM_RW;
+		node = of_parse_phandle(adsp->dev->of_node, "memory-region",
+					adsp->region_assign_idx + offset);
+		if (node)
+			rmem = of_reserved_mem_lookup(node);
+		of_node_put(node);
+		if (!rmem) {
+			dev_err(adsp->dev, "unable to resolve shareable memory-region index %d\n",
+				offset);
+			return -EINVAL;
+		}
 
-	adsp->region_assign_phys = rmem->base;
-	adsp->region_assign_size = rmem->size;
-	adsp->region_assign_perms = BIT(QCOM_SCM_VMID_HLOS);
-
-	ret = qcom_scm_assign_mem(adsp->region_assign_phys,
-				  adsp->region_assign_size,
-				  &adsp->region_assign_perms,
-				  &perm, 1);
-	if (ret < 0) {
-		dev_err(adsp->dev, "assign memory failed\n");
-		return ret;
+		if (adsp->region_assign_shared)  {
+			perm[0].vmid = QCOM_SCM_VMID_HLOS;
+			perm[0].perm = QCOM_SCM_PERM_RW;
+			perm[1].vmid = adsp->region_assign_vmid;
+			perm[1].perm = QCOM_SCM_PERM_RW;
+			perm_size = 2;
+		} else {
+			perm[0].vmid = adsp->region_assign_vmid;
+			perm[0].perm = QCOM_SCM_PERM_RW;
+			perm_size = 1;
+		}
+
+		adsp->region_assign_phys[offset] = rmem->base;
+		adsp->region_assign_size[offset] = rmem->size;
+		adsp->region_assign_owners[offset] = BIT(QCOM_SCM_VMID_HLOS);
+
+		ret = qcom_scm_assign_mem(adsp->region_assign_phys[offset],
+					  adsp->region_assign_size[offset],
+					  &adsp->region_assign_owners[offset],
+					  perm, perm_size);
+		if (ret < 0) {
+			dev_err(adsp->dev, "assign memory %d failed\n", offset);
+			return ret;
+		}
 	}
 
 	return 0;
@@ -629,20 +725,75 @@
 static void adsp_unassign_memory_region(struct qcom_adsp *adsp)
 {
 	struct qcom_scm_vmperm perm;
+	int offset;
 	int ret;
 
-	if (!adsp->region_assign_idx)
+	if (!adsp->region_assign_idx || adsp->region_assign_shared)
 		return;
 
-	perm.vmid = QCOM_SCM_VMID_HLOS;
-	perm.perm = QCOM_SCM_PERM_RW;
+	for (offset = 0; offset < adsp->region_assign_count; ++offset) {
+		perm.vmid = QCOM_SCM_VMID_HLOS;
+		perm.perm = QCOM_SCM_PERM_RW;
+
+		ret = qcom_scm_assign_mem(adsp->region_assign_phys[offset],
+					  adsp->region_assign_size[offset],
+					  &adsp->region_assign_owners[offset],
+					  &perm, 1);
+		if (ret < 0)
+			dev_err(adsp->dev, "unassign memory %d failed\n", offset);
+	}
+}
 
-	ret = qcom_scm_assign_mem(adsp->region_assign_phys,
-				  adsp->region_assign_size,
-				  &adsp->region_assign_perms,
-				  &perm, 1);
-	if (ret < 0)
-		dev_err(adsp->dev, "unassign memory failed\n");
+static int adsp_devmem_init(struct qcom_adsp *adsp)
+{
+	unsigned int entry_size = DEVMEM_ENTRY_SIZE;
+	struct qcom_devmem_table *devmem_table;
+	struct rproc *rproc = adsp->rproc;
+	struct device *dev = adsp->dev;
+	struct qcom_devmem_info *info;
+	char *pname = "qcom,devmem";
+	size_t table_size;
+	int num_entries;
+	u32 i;
+
+	if (!rproc->has_iommu)
+		return 0;
+
+	/* devmem property is a set of n-tuple */
+	num_entries = of_property_count_u32_elems(dev->of_node, pname);
+	if (num_entries < 0) {
+		dev_err(adsp->dev, "No '%s' property present\n", pname);
+		return num_entries;
+	}
+
+	if (!num_entries || (num_entries % entry_size)) {
+		dev_err(adsp->dev, "All '%s' list entries need %d vals\n", pname,
+			entry_size);
+		return -EINVAL;
+	}
+
+	num_entries /= entry_size;
+	table_size = sizeof(*devmem_table) + sizeof(*info) * num_entries;
+	devmem_table = devm_kzalloc(dev, table_size, GFP_KERNEL);
+	if (!devmem_table)
+		return -ENOMEM;
+
+	devmem_table->num_entries = num_entries;
+	info = &devmem_table->entries[0];
+	for (i = 0; i < num_entries; i++, info++) {
+		of_property_read_u32_index(dev->of_node, pname,
+					   i * entry_size, (u32 *)&info->da);
+		of_property_read_u32_index(dev->of_node, pname,
+					   i * entry_size + 1, (u32 *)&info->pa);
+		of_property_read_u32_index(dev->of_node, pname,
+					   i * entry_size + 2, &info->len);
+		of_property_read_u32_index(dev->of_node, pname,
+					   i * entry_size + 3, &info->flags);
+	}
+
+	adsp->devmem = devmem_table;
+
+	return 0;
 }
 
 static int adsp_probe(struct platform_device *pdev)
@@ -694,14 +845,38 @@
 	adsp->minidump_id = desc->minidump_id;
 	adsp->pas_id = desc->pas_id;
 	adsp->info_name = desc->sysmon_name;
+	adsp->smem_host_id = desc->smem_host_id;
 	adsp->decrypt_shutdown = desc->decrypt_shutdown;
 	adsp->region_assign_idx = desc->region_assign_idx;
+	adsp->region_assign_count = min_t(int, MAX_ASSIGN_COUNT, desc->region_assign_count);
+	adsp->region_assign_vmid = desc->region_assign_vmid;
+	adsp->region_assign_shared = desc->region_assign_shared;
 	if (dtb_fw_name) {
 		adsp->dtb_firmware_name = dtb_fw_name;
 		adsp->dtb_pas_id = desc->dtb_pas_id;
 	}
 	platform_set_drvdata(pdev, adsp);
 
+	if (of_property_present(pdev->dev.of_node, "iommus")) {
+		struct of_phandle_args args;
+
+		ret = of_parse_phandle_with_args(pdev->dev.of_node, "iommus", "#iommu-cells",
+						 0, &args);
+		if (ret < 0)
+			return ret;
+
+		rproc->has_iommu = true;
+		adsp->sid = args.args[0];
+		of_node_put(args.np);
+		ret = adsp_devmem_init(adsp);
+		if (ret)
+			return ret;
+
+		adsp->pas_metadata.shm_bridge_needed = true;
+	} else {
+		rproc->has_iommu = false;
+	}
+
 	ret = device_init_wakeup(adsp->dev, true);
 	if (ret)
 		goto free_rproc;
@@ -716,16 +891,16 @@
 
 	ret = adsp_init_clock(adsp);
 	if (ret)
-		goto free_rproc;
+		goto unassign_mem;
 
 	ret = adsp_init_regulator(adsp);
 	if (ret)
-		goto free_rproc;
+		goto unassign_mem;
 
 	ret = adsp_pds_attach(&pdev->dev, adsp->proxy_pds,
 			      desc->proxy_pd_names);
 	if (ret < 0)
-		goto free_rproc;
+		goto unassign_mem;
 	adsp->proxy_pd_count = ret;
 
 	ret = qcom_q6v5_init(&adsp->q6v5, pdev, rproc, desc->crash_reason_smem, desc->load_state,
@@ -740,18 +915,27 @@
 					      desc->ssctl_id);
 	if (IS_ERR(adsp->sysmon)) {
 		ret = PTR_ERR(adsp->sysmon);
-		goto detach_proxy_pds;
+		goto deinit_remove_pdm_smd_glink;
 	}
 
 	qcom_add_ssr_subdev(rproc, &adsp->ssr_subdev, desc->ssr_name);
 	ret = rproc_add(rproc);
 	if (ret)
-		goto detach_proxy_pds;
+		goto remove_ssr_sysmon;
 
 	return 0;
 
+remove_ssr_sysmon:
+	qcom_remove_ssr_subdev(rproc, &adsp->ssr_subdev);
+	qcom_remove_sysmon_subdev(adsp->sysmon);
+deinit_remove_pdm_smd_glink:
+	qcom_remove_smd_subdev(rproc, &adsp->smd_subdev);
+	qcom_remove_glink_subdev(rproc, &adsp->glink_subdev);
+	qcom_q6v5_deinit(&adsp->q6v5);
 detach_proxy_pds:
 	adsp_pds_detach(adsp, adsp->proxy_pds, adsp->proxy_pd_count);
+unassign_mem:
+	adsp_unassign_memory_region(adsp);
 free_rproc:
 	device_init_wakeup(adsp->dev, false);
 	rproc_free(rproc);
@@ -786,6 +970,23 @@
 		.ssctl_id = 0x14,
 };
 
+static const struct adsp_data sa8775p_adsp_resource = {
+	.crash_reason_smem = 423,
+	.firmware_name = "adsp.mbn",
+	.pas_id = 1,
+	.minidump_id = 5,
+	.auto_boot = true,
+	.proxy_pd_names = (char*[]){
+		"lcx",
+		"lmx",
+		NULL
+	},
+	.load_state = "adsp",
+	.ssr_name = "lpass",
+	.sysmon_name = "adsp",
+	.ssctl_id = 0x14,
+};
+
 static const struct adsp_data sdm845_adsp_resource_init = {
 		.crash_reason_smem = 423,
 		.firmware_name = "adsp.mdt",
@@ -797,6 +998,58 @@
 		.ssctl_id = 0x14,
 };
 
+static const struct adsp_data qcs8300_adsp_resource = {
+	.crash_reason_smem = 423,
+	.firmware_name = "adsp.mbn",
+	.pas_id = 1,
+	.minidump_id = 5,
+	.auto_boot = true,
+	.proxy_pd_names = (char*[]){
+		"lcx",
+		"lmx",
+		NULL
+	},
+	.load_state = "adsp",
+	.ssr_name = "lpass",
+	.sysmon_name = "adsp",
+	.ssctl_id = 0x14,
+};
+
+static const struct adsp_data qcs8300_cdsp_resource = {
+	.crash_reason_smem = 601,
+	.firmware_name = "cdsp.mdt",
+	.pas_id = 18,
+	.minidump_id = 7,
+	.auto_boot = true,
+	.proxy_pd_names = (char*[]){
+		"cx",
+		"mxc",
+		"nsp0",
+		NULL
+	},
+	.load_state = "cdsp",
+	.ssr_name = "cdsp",
+	.sysmon_name = "cdsp",
+	.ssctl_id = 0x17,
+};
+
+static const struct adsp_data qcs8300_gpdsp_resource = {
+	.crash_reason_smem = 640,
+	.firmware_name = "gpdsp0.mbn",
+	.pas_id = 39,
+	.minidump_id = 21,
+	.auto_boot = true,
+	.proxy_pd_names = (char*[]){
+		"cx",
+		"mxc",
+		NULL
+	},
+	.load_state = "gpdsp0",
+	.ssr_name = "gpdsp0",
+	.sysmon_name = "gpdsp0",
+	.ssctl_id = 0x21,
+};
+
 static const struct adsp_data sm6350_adsp_resource = {
 	.crash_reason_smem = 423,
 	.firmware_name = "adsp.mdt",
@@ -847,6 +1100,7 @@
 	.crash_reason_smem = 423,
 	.firmware_name = "adsp.mdt",
 	.pas_id = 1,
+	.minidump_id = 5,
 	.auto_boot = true,
 	.proxy_pd_names = (char*[]){
 		"lcx",
@@ -899,6 +1153,42 @@
 	.ssctl_id = 0x17,
 };
 
+static const struct adsp_data sa8775p_cdsp0_resource = {
+	.crash_reason_smem = 601,
+	.firmware_name = "cdsp0.mbn",
+	.pas_id = 18,
+	.minidump_id = 7,
+	.auto_boot = true,
+	.proxy_pd_names = (char*[]){
+		"cx",
+		"mxc",
+		"nsp",
+		NULL
+	},
+	.load_state = "cdsp",
+	.ssr_name = "cdsp",
+	.sysmon_name = "cdsp",
+	.ssctl_id = 0x17,
+};
+
+static const struct adsp_data sa8775p_cdsp1_resource = {
+	.crash_reason_smem = 633,
+	.firmware_name = "cdsp1.mbn",
+	.pas_id = 30,
+	.minidump_id = 20,
+	.auto_boot = true,
+	.proxy_pd_names = (char*[]){
+		"cx",
+		"mxc",
+		"nsp",
+		NULL
+	},
+	.load_state = "nsp",
+	.ssr_name = "cdsp1",
+	.sysmon_name = "cdsp1",
+	.ssctl_id = 0x20,
+};
+
 static const struct adsp_data sdm845_cdsp_resource_init = {
 	.crash_reason_smem = 601,
 	.firmware_name = "cdsp.mdt",
@@ -988,6 +1278,7 @@
 	.crash_reason_smem = 601,
 	.firmware_name = "cdsp.mdt",
 	.pas_id = 18,
+	.minidump_id = 7,
 	.auto_boot = true,
 	.proxy_pd_names = (char*[]){
 		"cx",
@@ -1000,6 +1291,40 @@
 	.ssctl_id = 0x17,
 };
 
+static const struct adsp_data sa8775p_gpdsp0_resource = {
+	.crash_reason_smem = 640,
+	.firmware_name = "gpdsp0.mbn",
+	.pas_id = 39,
+	.minidump_id = 21,
+	.auto_boot = true,
+	.proxy_pd_names = (char*[]){
+		"cx",
+		"mxc",
+		NULL
+	},
+	.load_state = "gpdsp0",
+	.ssr_name = "gpdsp0",
+	.sysmon_name = "gpdsp0",
+	.ssctl_id = 0x21,
+};
+
+static const struct adsp_data sa8775p_gpdsp1_resource = {
+	.crash_reason_smem = 641,
+	.firmware_name = "gpdsp1.mbn",
+	.pas_id = 40,
+	.minidump_id = 22,
+	.auto_boot = true,
+	.proxy_pd_names = (char*[]){
+		"cx",
+		"mxc",
+		NULL
+	},
+	.load_state = "gpdsp1",
+	.ssr_name = "gpdsp1",
+	.sysmon_name = "gpdsp1",
+	.ssctl_id = 0x22,
+};
+
 static const struct adsp_data mpss_resource_init = {
 	.crash_reason_smem = 421,
 	.firmware_name = "modem.mdt",
@@ -1122,6 +1447,7 @@
 	.ssr_name = "lpass",
 	.sysmon_name = "adsp",
 	.ssctl_id = 0x14,
+	.smem_host_id = 2,
 };
 
 static const struct adsp_data sm8550_cdsp_resource = {
@@ -1142,6 +1468,7 @@
 	.ssr_name = "cdsp",
 	.sysmon_name = "cdsp",
 	.ssctl_id = 0x17,
+	.smem_host_id = 5,
 };
 
 static const struct adsp_data sm8550_mpss_resource = {
@@ -1162,23 +1489,68 @@
 	.ssr_name = "mpss",
 	.sysmon_name = "modem",
 	.ssctl_id = 0x12,
+	.smem_host_id = 1,
 	.region_assign_idx = 2,
+	.region_assign_count = 1,
+	.region_assign_vmid = QCOM_SCM_VMID_MSS_MSA,
 };
 
 static const struct adsp_data sc7280_wpss_resource = {
-	.crash_reason_smem = 626,
+	.crash_reason_smem = 421,
 	.firmware_name = "wpss.mdt",
 	.pas_id = 6,
+	.auto_boot = false,
+	.load_state = "wpss",
+	.ssr_name = "wpss",
+	.sysmon_name = "wpss",
+	.ssctl_id = 0x12,
+};
+
+static const struct adsp_data sm8650_cdsp_resource = {
+	.crash_reason_smem = 601,
+	.firmware_name = "cdsp.mdt",
+	.dtb_firmware_name = "cdsp_dtb.mdt",
+	.pas_id = 18,
+	.dtb_pas_id = 0x25,
+	.minidump_id = 7,
 	.auto_boot = true,
 	.proxy_pd_names = (char*[]){
 		"cx",
-		"mx",
+		"mxc",
+		"nsp",
 		NULL
 	},
-	.load_state = "wpss",
-	.ssr_name = "wpss",
-	.sysmon_name = "wpss",
-	.ssctl_id = 0x19,
+	.load_state = "cdsp",
+	.ssr_name = "cdsp",
+	.sysmon_name = "cdsp",
+	.ssctl_id = 0x17,
+	.region_assign_idx = 2,
+	.region_assign_count = 1,
+	.region_assign_shared = true,
+	.region_assign_vmid = QCOM_SCM_VMID_CDSP,
+};
+
+static const struct adsp_data sm8650_mpss_resource = {
+	.crash_reason_smem = 421,
+	.firmware_name = "modem.mdt",
+	.dtb_firmware_name = "modem_dtb.mdt",
+	.pas_id = 4,
+	.dtb_pas_id = 0x26,
+	.minidump_id = 3,
+	.auto_boot = false,
+	.decrypt_shutdown = true,
+	.proxy_pd_names = (char*[]){
+		"cx",
+		"mss",
+		NULL
+	},
+	.load_state = "modem",
+	.ssr_name = "mpss",
+	.sysmon_name = "modem",
+	.ssctl_id = 0x12,
+	.region_assign_idx = 2,
+	.region_assign_count = 3,
+	.region_assign_vmid = QCOM_SCM_VMID_MSS_MSA,
 };
 
 static const struct of_device_id adsp_of_match[] = {
@@ -1192,10 +1564,19 @@
 	{ .compatible = "qcom,qcs404-adsp-pas", .data = &adsp_resource_init },
 	{ .compatible = "qcom,qcs404-cdsp-pas", .data = &cdsp_resource_init },
 	{ .compatible = "qcom,qcs404-wcss-pas", .data = &wcss_resource_init },
+	{ .compatible = "qcom,sa8775p-adsp-pas", .data = &sa8775p_adsp_resource},
+	{ .compatible = "qcom,sa8775p-cdsp0-pas", .data = &sa8775p_cdsp0_resource},
+	{ .compatible = "qcom,sa8775p-cdsp1-pas", .data = &sa8775p_cdsp1_resource},
+	{ .compatible = "qcom,sa8775p-gpdsp0-pas", .data = &sa8775p_gpdsp0_resource},
+	{ .compatible = "qcom,sa8775p-gpdsp1-pas", .data = &sa8775p_gpdsp1_resource},
+	{ .compatible = "qcom,sar2130p-adsp-pas", .data = &sm8350_adsp_resource},
 	{ .compatible = "qcom,sc7180-adsp-pas", .data = &sm8250_adsp_resource},
+	{ .compatible = "qcom,qcs8300-adsp-pas", .data = &qcs8300_adsp_resource},
+	{ .compatible = "qcom,qcs8300-cdsp-pas", .data = &qcs8300_cdsp_resource},
+	{ .compatible = "qcom,qcs8300-gpdsp-pas", .data = &qcs8300_gpdsp_resource},
 	{ .compatible = "qcom,sc7180-mpss-pas", .data = &mpss_resource_init},
-	{ .compatible = "qcom,sc7280-adsp-pas", .data = &sm8350_adsp_resource},
-	{ .compatible = "qcom,sc7280-cdsp-pas", .data = &sm6350_cdsp_resource},
+	{ .compatible = "qcom,sc7280-adsp-pas", .data = &sdm845_adsp_resource_init},
+	{ .compatible = "qcom,sc7280-cdsp-pas", .data = &sdm845_cdsp_resource_init},
 	{ .compatible = "qcom,sc7280-mpss-pas", .data = &mpss_resource_init},
 	{ .compatible = "qcom,sc7280-wpss-pas", .data = &sc7280_wpss_resource},
 	{ .compatible = "qcom,sc8180x-adsp-pas", .data = &sm8150_adsp_resource},
@@ -1236,6 +1617,9 @@
 	{ .compatible = "qcom,sm8550-adsp-pas", .data = &sm8550_adsp_resource},
 	{ .compatible = "qcom,sm8550-cdsp-pas", .data = &sm8550_cdsp_resource},
 	{ .compatible = "qcom,sm8550-mpss-pas", .data = &sm8550_mpss_resource},
+	{ .compatible = "qcom,sm8650-adsp-pas", .data = &sm8550_adsp_resource},
+	{ .compatible = "qcom,sm8650-cdsp-pas", .data = &sm8650_cdsp_resource},
+	{ .compatible = "qcom,sm8650-mpss-pas", .data = &sm8650_mpss_resource},
 	{ },
 };
 MODULE_DEVICE_TABLE(of, adsp_of_match);
--- linux-qcom-6.8.0.orig/drivers/remoteproc/remoteproc_virtio.c
+++ linux-qcom-6.8.0/drivers/remoteproc/remoteproc_virtio.c
@@ -351,6 +351,9 @@
 
 	kfree(vdev);
 
+	of_reserved_mem_device_release(&rvdev->pdev->dev);
+	dma_release_coherent_memory(&rvdev->pdev->dev);
+
 	put_device(&rvdev->pdev->dev);
 }
 
@@ -584,9 +587,6 @@
 	rproc_remove_subdev(rproc, &rvdev->subdev);
 	rproc_remove_rvdev(rvdev);
 
-	of_reserved_mem_device_release(&pdev->dev);
-	dma_release_coherent_memory(&pdev->dev);
-
 	put_device(&rproc->dev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/remoteproc/stm32_rproc.c
+++ linux-qcom-6.8.0/drivers/remoteproc/stm32_rproc.c
@@ -120,7 +120,7 @@
 	void *va;
 
 	dev_dbg(dev, "map memory: %pad+%zx\n", &mem->dma, mem->len);
-	va = ioremap_wc(mem->dma, mem->len);
+	va = (__force void *)ioremap_wc(mem->dma, mem->len);
 	if (IS_ERR_OR_NULL(va)) {
 		dev_err(dev, "Unable to map memory region: %pad+0x%zx\n",
 			&mem->dma, mem->len);
@@ -137,7 +137,7 @@
 				   struct rproc_mem_entry *mem)
 {
 	dev_dbg(rproc->dev.parent, "unmap memory: %pa\n", &mem->dma);
-	iounmap(mem->va);
+	iounmap((__force __iomem void *)mem->va);
 
 	return 0;
 }
@@ -294,7 +294,7 @@
 
 	mutex_lock(&rproc->lock);
 
-	if (rproc->state != RPROC_RUNNING)
+	if (rproc->state != RPROC_RUNNING && rproc->state != RPROC_ATTACHED)
 		goto unlock_mutex;
 
 	if (rproc_vq_interrupt(rproc, mb->vq_id) == IRQ_NONE)
@@ -657,7 +657,7 @@
 	 * entire area by overwriting it with the initial values stored in rproc->clean_table.
 	 */
 	*table_sz = RSC_TBL_SIZE;
-	return (struct resource_table *)ddata->rsc_va;
+	return (__force struct resource_table *)ddata->rsc_va;
 }
 
 static const struct rproc_ops st_rproc_ops = {
--- linux-qcom-6.8.0.orig/drivers/remoteproc/ti_k3_r5_remoteproc.c
+++ linux-qcom-6.8.0/drivers/remoteproc/ti_k3_r5_remoteproc.c
@@ -103,12 +103,14 @@
  * @dev: cached device pointer
  * @mode: Mode to configure the Cluster - Split or LockStep
  * @cores: list of R5 cores within the cluster
+ * @core_transition: wait queue to sync core state changes
  * @soc_data: SoC-specific feature data for a R5FSS
  */
 struct k3_r5_cluster {
 	struct device *dev;
 	enum cluster_mode mode;
 	struct list_head cores;
+	wait_queue_head_t core_transition;
 	const struct k3_r5_soc_data *soc_data;
 };
 
@@ -128,6 +130,7 @@
  * @atcm_enable: flag to control ATCM enablement
  * @btcm_enable: flag to control BTCM enablement
  * @loczrama: flag to dictate which TCM is at device address 0x0
+ * @released_from_reset: flag to signal when core is out of reset
  */
 struct k3_r5_core {
 	struct list_head elem;
@@ -144,6 +147,7 @@
 	u32 atcm_enable;
 	u32 btcm_enable;
 	u32 loczrama;
+	bool released_from_reset;
 };
 
 /**
@@ -190,6 +194,10 @@
 	const char *name = kproc->rproc->name;
 	u32 msg = omap_mbox_message(data);
 
+	/* Do not forward message from a detached core */
+	if (kproc->rproc->state == RPROC_DETACHED)
+		return;
+
 	dev_dbg(dev, "mbox msg: 0x%x\n", msg);
 
 	switch (msg) {
@@ -225,6 +233,10 @@
 	mbox_msg_t msg = (mbox_msg_t)vqid;
 	int ret;
 
+	/* Do not forward message to a detached core */
+	if (kproc->rproc->state == RPROC_DETACHED)
+		return;
+
 	/* send the index of the triggered virtqueue in the mailbox payload */
 	ret = mbox_send_message(kproc->mbox, (void *)msg);
 	if (ret < 0)
@@ -395,12 +407,9 @@
 	client->knows_txdone = false;
 
 	kproc->mbox = mbox_request_channel(client, 0);
-	if (IS_ERR(kproc->mbox)) {
-		ret = -EBUSY;
-		dev_err(dev, "mbox_request_channel failed: %ld\n",
-			PTR_ERR(kproc->mbox));
-		return ret;
-	}
+	if (IS_ERR(kproc->mbox))
+		return dev_err_probe(dev, PTR_ERR(kproc->mbox),
+				     "mbox_request_channel failed\n");
 
 	/*
 	 * Ping the remote processor, this is only for sanity-sake for now;
@@ -542,14 +551,10 @@
 	struct k3_r5_rproc *kproc = rproc->priv;
 	struct k3_r5_cluster *cluster = kproc->cluster;
 	struct device *dev = kproc->dev;
-	struct k3_r5_core *core;
+	struct k3_r5_core *core0, *core;
 	u32 boot_addr;
 	int ret;
 
-	ret = k3_r5_rproc_request_mbox(rproc);
-	if (ret)
-		return ret;
-
 	boot_addr = rproc->bootaddr;
 	/* TODO: add boot_addr sanity checking */
 	dev_dbg(dev, "booting R5F core using boot addr = 0x%x\n", boot_addr);
@@ -558,7 +563,7 @@
 	core = kproc->core;
 	ret = ti_sci_proc_set_config(core->tsp, boot_addr, 0, 0);
 	if (ret)
-		goto put_mbox;
+		return ret;
 
 	/* unhalt/run all applicable cores */
 	if (cluster->mode == CLUSTER_MODE_LOCKSTEP) {
@@ -568,9 +573,21 @@
 				goto unroll_core_run;
 		}
 	} else {
+		/* do not allow core 1 to start before core 0 */
+		core0 = list_first_entry(&cluster->cores, struct k3_r5_core,
+					 elem);
+		if (core != core0 && core0->rproc->state == RPROC_OFFLINE) {
+			dev_err(dev, "%s: can not start core 1 before core 0\n",
+				__func__);
+			return -EPERM;
+		}
+
 		ret = k3_r5_core_run(core);
 		if (ret)
-			goto put_mbox;
+			return ret;
+
+		core->released_from_reset = true;
+		wake_up_interruptible(&cluster->core_transition);
 	}
 
 	return 0;
@@ -580,8 +597,6 @@
 		if (k3_r5_core_halt(core))
 			dev_warn(core->dev, "core halt back failed\n");
 	}
-put_mbox:
-	mbox_free_channel(kproc->mbox);
 	return ret;
 }
 
@@ -613,7 +628,8 @@
 {
 	struct k3_r5_rproc *kproc = rproc->priv;
 	struct k3_r5_cluster *cluster = kproc->cluster;
-	struct k3_r5_core *core = kproc->core;
+	struct device *dev = kproc->dev;
+	struct k3_r5_core *core1, *core = kproc->core;
 	int ret;
 
 	/* halt all applicable cores */
@@ -626,13 +642,21 @@
 			}
 		}
 	} else {
+		/* do not allow core 0 to stop before core 1 */
+		core1 = list_last_entry(&cluster->cores, struct k3_r5_core,
+					elem);
+		if (core != core1 && core1->rproc->state != RPROC_OFFLINE) {
+			dev_err(dev, "%s: can not stop core 0 before core 1\n",
+				__func__);
+			ret = -EPERM;
+			goto out;
+		}
+
 		ret = k3_r5_core_halt(core);
 		if (ret)
 			goto out;
 	}
 
-	mbox_free_channel(kproc->mbox);
-
 	return 0;
 
 unroll_core_halt:
@@ -647,42 +671,22 @@
 /*
  * Attach to a running R5F remote processor (IPC-only mode)
  *
- * The R5F attach callback only needs to request the mailbox, the remote
- * processor is already booted, so there is no need to issue any TI-SCI
- * commands to boot the R5F cores in IPC-only mode. This callback is invoked
- * only in IPC-only mode.
+ * The R5F attach callback is a NOP. The remote processor is already booted, and
+ * all required resources have been acquired during probe routine, so there is
+ * no need to issue any TI-SCI commands to boot the R5F cores in IPC-only mode.
+ * This callback is invoked only in IPC-only mode and exists because
+ * rproc_validate() checks for its existence.
  */
-static int k3_r5_rproc_attach(struct rproc *rproc)
-{
-	struct k3_r5_rproc *kproc = rproc->priv;
-	struct device *dev = kproc->dev;
-	int ret;
-
-	ret = k3_r5_rproc_request_mbox(rproc);
-	if (ret)
-		return ret;
-
-	dev_info(dev, "R5F core initialized in IPC-only mode\n");
-	return 0;
-}
+static int k3_r5_rproc_attach(struct rproc *rproc) { return 0; }
 
 /*
  * Detach from a running R5F remote processor (IPC-only mode)
  *
- * The R5F detach callback performs the opposite operation to attach callback
- * and only needs to release the mailbox, the R5F cores are not stopped and
- * will be left in booted state in IPC-only mode. This callback is invoked
- * only in IPC-only mode.
+ * The R5F detach callback is a NOP. The R5F cores are not stopped and will be
+ * left in booted state in IPC-only mode. This callback is invoked only in
+ * IPC-only mode and exists for sanity sake.
  */
-static int k3_r5_rproc_detach(struct rproc *rproc)
-{
-	struct k3_r5_rproc *kproc = rproc->priv;
-	struct device *dev = kproc->dev;
-
-	mbox_free_channel(kproc->mbox);
-	dev_info(dev, "R5F core deinitialized in IPC-only mode\n");
-	return 0;
-}
+static int k3_r5_rproc_detach(struct rproc *rproc) { return 0; }
 
 /*
  * This function implements the .get_loaded_rsc_table() callback and is used
@@ -1117,6 +1121,7 @@
 	u32 atcm_enable, btcm_enable, loczrama;
 	struct k3_r5_core *core0;
 	enum cluster_mode mode = cluster->mode;
+	int reset_ctrl_status;
 	int ret;
 
 	core0 = list_first_entry(&cluster->cores, struct k3_r5_core, elem);
@@ -1133,13 +1138,19 @@
 			 r_state, c_state);
 	}
 
-	ret = reset_control_status(core->reset);
-	if (ret < 0) {
+	reset_ctrl_status = reset_control_status(core->reset);
+	if (reset_ctrl_status < 0) {
 		dev_err(cdev, "failed to get initial local reset status, ret = %d\n",
-			ret);
-		return ret;
+			reset_ctrl_status);
+		return reset_ctrl_status;
 	}
 
+	/*
+	 * Skip the waiting mechanism for sequential power-on of cores if the
+	 * core has already been booted by another entity.
+	 */
+	core->released_from_reset = c_state;
+
 	ret = ti_sci_proc_get_status(core->tsp, &boot_vec, &cfg, &ctrl,
 				     &stat);
 	if (ret < 0) {
@@ -1166,7 +1177,7 @@
 	 * irrelevant if module reset is asserted (POR value has local reset
 	 * deasserted), and is deemed as remoteproc mode
 	 */
-	if (c_state && !ret && !halted) {
+	if (c_state && !reset_ctrl_status && !halted) {
 		dev_info(cdev, "configured R5F for IPC-only mode\n");
 		kproc->rproc->state = RPROC_DETACHED;
 		ret = 1;
@@ -1184,7 +1195,7 @@
 		ret = 0;
 	} else {
 		dev_err(cdev, "mismatched mode: local_reset = %s, module_reset = %s, core_state = %s\n",
-			!ret ? "deasserted" : "asserted",
+			!reset_ctrl_status ? "deasserted" : "asserted",
 			c_state ? "deasserted" : "asserted",
 			halted ? "halted" : "unhalted");
 		ret = -EINVAL;
@@ -1244,6 +1255,10 @@
 		kproc->rproc = rproc;
 		core->rproc = rproc;
 
+		ret = k3_r5_rproc_request_mbox(rproc);
+		if (ret)
+			return ret;
+
 		ret = k3_r5_rproc_configure_mode(kproc);
 		if (ret < 0)
 			goto err_config;
@@ -1280,6 +1295,26 @@
 		    cluster->mode == CLUSTER_MODE_SINGLECPU ||
 		    cluster->mode == CLUSTER_MODE_SINGLECORE)
 			break;
+
+		/*
+		 * R5 cores require to be powered on sequentially, core0
+		 * should be in higher power state than core1 in a cluster
+		 * So, wait for current core to power up before proceeding
+		 * to next core and put timeout of 2sec for each core.
+		 *
+		 * This waiting mechanism is necessary because
+		 * rproc_auto_boot_callback() for core1 can be called before
+		 * core0 due to thread execution order.
+		 */
+		ret = wait_event_interruptible_timeout(cluster->core_transition,
+						       core->released_from_reset,
+						       msecs_to_jiffies(2000));
+		if (ret <= 0) {
+			dev_err(dev,
+				"Timed out waiting for %s core to power up!\n",
+				rproc->name);
+			goto err_powerup;
+		}
 	}
 
 	return 0;
@@ -1294,6 +1329,7 @@
 		}
 	}
 
+err_powerup:
 	rproc_del(rproc);
 err_add:
 	k3_r5_reserved_mem_exit(kproc);
@@ -1341,6 +1377,8 @@
 			}
 		}
 
+		mbox_free_channel(kproc->mbox);
+
 		rproc_del(rproc);
 
 		k3_r5_reserved_mem_exit(kproc);
@@ -1709,6 +1747,7 @@
 	cluster->dev = dev;
 	cluster->soc_data = data;
 	INIT_LIST_HEAD(&cluster->cores);
+	init_waitqueue_head(&cluster->core_transition);
 
 	ret = of_property_read_u32(np, "ti,cluster-mode", &cluster->mode);
 	if (ret < 0 && ret != -EINVAL) {
--- linux-qcom-6.8.0.orig/drivers/reset/reset-berlin.c
+++ linux-qcom-6.8.0/drivers/reset/reset-berlin.c
@@ -68,13 +68,14 @@
 
 static int berlin2_reset_probe(struct platform_device *pdev)
 {
-	struct device_node *parent_np = of_get_parent(pdev->dev.of_node);
+	struct device_node *parent_np;
 	struct berlin_reset_priv *priv;
 
 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;
 
+	parent_np = of_get_parent(pdev->dev.of_node);
 	priv->regmap = syscon_node_to_regmap(parent_np);
 	of_node_put(parent_np);
 	if (IS_ERR(priv->regmap))
--- linux-qcom-6.8.0.orig/drivers/reset/reset-k210.c
+++ linux-qcom-6.8.0/drivers/reset/reset-k210.c
@@ -90,7 +90,7 @@
 static int k210_rst_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	struct device_node *parent_np = of_get_parent(dev->of_node);
+	struct device_node *parent_np;
 	struct k210_rst *ksr;
 
 	dev_info(dev, "K210 reset controller\n");
@@ -99,6 +99,7 @@
 	if (!ksr)
 		return -ENOMEM;
 
+	parent_np = of_get_parent(dev->of_node);
 	ksr->map = syscon_node_to_regmap(parent_np);
 	of_node_put(parent_np);
 	if (IS_ERR(ksr->map))
--- linux-qcom-6.8.0.orig/drivers/reset/starfive/reset-starfive-jh71x0.c
+++ linux-qcom-6.8.0/drivers/reset/starfive/reset-starfive-jh71x0.c
@@ -94,6 +94,9 @@
 	void __iomem *reg_status = data->status + offset * sizeof(u32);
 	u32 value = readl(reg_status);
 
+	if (!data->asserted)
+		return !(value & mask);
+
 	return !((value ^ data->asserted[offset]) & mask);
 }
 
--- linux-qcom-6.8.0.orig/drivers/rpmsg/Makefile
+++ linux-qcom-6.8.0/drivers/rpmsg/Makefile
@@ -4,6 +4,7 @@
 obj-$(CONFIG_RPMSG_CTRL)	+= rpmsg_ctrl.o
 obj-$(CONFIG_RPMSG_NS)		+= rpmsg_ns.o
 obj-$(CONFIG_RPMSG_MTK_SCP)	+= mtk_rpmsg.o
+CFLAGS_qcom_glink_native.o	:= -I$(src)
 qcom_glink-objs			:= qcom_glink_native.o qcom_glink_ssr.o
 obj-$(CONFIG_RPMSG_QCOM_GLINK) += qcom_glink.o
 obj-$(CONFIG_RPMSG_QCOM_GLINK_RPM) += qcom_glink_rpm.o
--- linux-qcom-6.8.0.orig/drivers/rpmsg/qcom_glink_native.c
+++ linux-qcom-6.8.0/drivers/rpmsg/qcom_glink_native.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2016-2017, Linaro Ltd
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/idr.h>
@@ -23,6 +24,9 @@
 #include "rpmsg_internal.h"
 #include "qcom_glink_native.h"
 
+#define CREATE_TRACE_POINTS
+#include "qcom_glink_trace.h"
+
 #define GLINK_NAME_SIZE		32
 #define GLINK_VERSION_1		1
 
@@ -30,11 +34,16 @@
 #define RPM_GLINK_CID_MAX	65536
 
 struct glink_msg {
-	__le16 cmd;
-	__le16 param1;
-	__le32 param2;
+	/* New members MUST be added within the __struct_group() macro below. */
+	__struct_group(glink_msg_hdr, hdr, __packed,
+		__le16 cmd;
+		__le16 param1;
+		__le32 param2;
+	);
 	u8 data[];
 } __packed;
+static_assert(offsetof(struct glink_msg, data) == sizeof(struct glink_msg_hdr),
+	      "struct member likely outside of __struct_group()");
 
 /**
  * struct glink_defer_cmd - deferred incoming control message
@@ -48,7 +57,7 @@
 struct glink_defer_cmd {
 	struct list_head node;
 
-	struct glink_msg msg;
+	struct glink_msg_hdr msg;
 	u8 data[];
 };
 
@@ -70,6 +79,7 @@
 	size_t size;
 	bool reuse;
 	bool in_use;
+	bool advertised;
 	u32 offset;
 
 	struct list_head node;
@@ -78,6 +88,7 @@
 /**
  * struct qcom_glink - driver context, relates to one remote subsystem
  * @dev:	reference to the associated struct device
+ * @label:	identifier of the glink edge
  * @rx_pipe:	pipe object for receive FIFO
  * @tx_pipe:	pipe object for transmit FIFO
  * @rx_work:	worker for handling received control messages
@@ -96,6 +107,8 @@
 struct qcom_glink {
 	struct device *dev;
 
+	const char *label;
+
 	struct qcom_glink_pipe *rx_pipe;
 	struct qcom_glink_pipe *tx_pipe;
 
@@ -179,6 +192,7 @@
 	struct mutex intent_req_lock;
 	int intent_req_result;
 	bool intent_received;
+	bool channel_ready;
 	wait_queue_head_t intent_req_wq;
 };
 
@@ -282,6 +296,37 @@
 	kfree(channel);
 }
 
+static struct glink_channel *qcom_glink_channel_ref_get(struct qcom_glink *glink,
+						bool remote_channel, int cid)
+{
+	struct glink_channel *channel = NULL;
+	unsigned long flags;
+
+	if (!glink)
+		return NULL;
+
+	spin_lock_irqsave(&glink->idr_lock, flags);
+	if (remote_channel)
+		channel = idr_find(&glink->rcids, cid);
+	else
+		channel = idr_find(&glink->lcids, cid);
+
+	if (channel)
+		kref_get(&channel->refcount);
+
+	spin_unlock_irqrestore(&glink->idr_lock, flags);
+	return channel;
+}
+
+static void qcom_glink_channel_ref_put(struct glink_channel *channel)
+{
+
+	if (!channel)
+		return;
+
+	kref_put(&channel->refcount, qcom_glink_channel_release);
+}
+
 static size_t qcom_glink_rx_avail(struct qcom_glink *glink)
 {
 	return glink->rx_pipe->avail(glink->rx_pipe);
@@ -392,6 +437,8 @@
 	msg.param1 = cpu_to_le16(GLINK_VERSION_1);
 	msg.param2 = cpu_to_le32(glink->features);
 
+	trace_qcom_glink_cmd_version_tx(glink->label, GLINK_VERSION_1, glink->features);
+
 	return qcom_glink_tx(glink, &msg, sizeof(msg), NULL, 0, true);
 }
 
@@ -403,6 +450,8 @@
 	msg.param1 = cpu_to_le16(GLINK_VERSION_1);
 	msg.param2 = cpu_to_le32(glink->features);
 
+	trace_qcom_glink_cmd_version_ack_tx(glink->label, msg.param1, msg.param2);
+
 	qcom_glink_tx(glink, &msg, sizeof(msg), NULL, 0, true);
 }
 
@@ -415,6 +464,9 @@
 	msg.param1 = cpu_to_le16(channel->rcid);
 	msg.param2 = cpu_to_le32(0);
 
+	trace_qcom_glink_cmd_open_ack_tx(glink->label, channel->name,
+					 channel->lcid, channel->rcid);
+
 	qcom_glink_tx(glink, &msg, sizeof(msg), NULL, 0, true);
 }
 
@@ -422,11 +474,16 @@
 					     unsigned int cid, bool granted)
 {
 	struct glink_channel *channel;
-	unsigned long flags;
 
-	spin_lock_irqsave(&glink->idr_lock, flags);
-	channel = idr_find(&glink->rcids, cid);
-	spin_unlock_irqrestore(&glink->idr_lock, flags);
+	qcom_glink_rx_advance(glink, ALIGN(sizeof(struct glink_msg), 8));
+
+	channel = qcom_glink_channel_ref_get(glink, true, cid);
+
+	trace_qcom_glink_cmd_rx_intent_req_ack_rx(glink->label,
+						  channel ? channel->name : NULL,
+						  channel ? channel->lcid : 0,
+						  cid, granted);
+
 	if (!channel) {
 		dev_err(glink->dev, "unable to find channel\n");
 		return;
@@ -434,6 +491,7 @@
 
 	WRITE_ONCE(channel->intent_req_result, granted);
 	wake_up_all(&channel->intent_req_wq);
+	qcom_glink_channel_ref_put(channel);
 }
 
 static void qcom_glink_intent_req_abort(struct glink_channel *channel)
@@ -455,12 +513,9 @@
 static int qcom_glink_send_open_req(struct qcom_glink *glink,
 				    struct glink_channel *channel)
 {
-	struct {
-		struct glink_msg msg;
-		u8 name[GLINK_NAME_SIZE];
-	} __packed req;
+	DEFINE_RAW_FLEX(struct glink_msg, req, data, GLINK_NAME_SIZE);
 	int name_len = strlen(channel->name) + 1;
-	int req_len = ALIGN(sizeof(req.msg) + name_len, 8);
+	int req_len = ALIGN(sizeof(*req) + name_len, 8);
 	int ret;
 	unsigned long flags;
 
@@ -476,12 +531,15 @@
 
 	channel->lcid = ret;
 
-	req.msg.cmd = cpu_to_le16(GLINK_CMD_OPEN);
-	req.msg.param1 = cpu_to_le16(channel->lcid);
-	req.msg.param2 = cpu_to_le32(name_len);
-	strcpy(req.name, channel->name);
+	req->cmd = cpu_to_le16(GLINK_CMD_OPEN);
+	req->param1 = cpu_to_le16(channel->lcid);
+	req->param2 = cpu_to_le32(name_len);
+	strscpy(req->data, channel->name, GLINK_NAME_SIZE);
+
+	trace_qcom_glink_cmd_open_tx(glink->label, channel->name,
+				     channel->lcid, channel->rcid);
 
-	ret = qcom_glink_tx(glink, &req, req_len, NULL, 0, true);
+	ret = qcom_glink_tx(glink, req, req_len, NULL, 0, true);
 	if (ret)
 		goto remove_idr;
 
@@ -505,18 +563,24 @@
 	req.param1 = cpu_to_le16(channel->lcid);
 	req.param2 = 0;
 
+	trace_qcom_glink_cmd_close_tx(glink->label, channel->name,
+				      channel->lcid, channel->rcid);
+
 	qcom_glink_tx(glink, &req, sizeof(req), NULL, 0, true);
 }
 
 static void qcom_glink_send_close_ack(struct qcom_glink *glink,
-				      unsigned int rcid)
+				      struct glink_channel *channel)
 {
 	struct glink_msg req;
 
 	req.cmd = cpu_to_le16(GLINK_CMD_CLOSE_ACK);
-	req.param1 = cpu_to_le16(rcid);
+	req.param1 = cpu_to_le16(channel->rcid);
 	req.param2 = 0;
 
+	trace_qcom_glink_cmd_close_ack_tx(glink->label, channel->name,
+					  channel->lcid, channel->rcid);
+
 	qcom_glink_tx(glink, &req, sizeof(req), NULL, 0, true);
 }
 
@@ -548,6 +612,9 @@
 		cmd.lcid = cid;
 		cmd.liid = iid;
 
+		trace_qcom_glink_cmd_rx_done_tx(glink->label, channel->name,
+						channel->lcid, channel->rcid, cmd.liid, reuse);
+
 		qcom_glink_tx(glink, &cmd, sizeof(cmd), NULL, 0, true);
 		if (!reuse) {
 			kfree(intent->data);
@@ -598,6 +665,8 @@
 				       u32 version,
 				       u32 features)
 {
+	trace_qcom_glink_cmd_version_rx(glink->label, version, features);
+
 	switch (version) {
 	case 0:
 		break;
@@ -625,6 +694,8 @@
 					   u32 version,
 					   u32 features)
 {
+	trace_qcom_glink_cmd_version_ack_rx(glink->label, version, features);
+
 	switch (version) {
 	case 0:
 		/* Version negotiation failed */
@@ -656,6 +727,10 @@
 {
 	struct glink_msg msg;
 
+	trace_qcom_glink_cmd_rx_intent_req_ack_tx(glink->label, channel->name,
+						  channel->lcid, channel->rcid,
+						  granted);
+
 	msg.cmd = cpu_to_le16(GLINK_CMD_RX_INTENT_REQ_ACK);
 	msg.param1 = cpu_to_le16(channel->lcid);
 	msg.param2 = cpu_to_le32(granted);
@@ -686,6 +761,15 @@
 		__le32 liid;
 	} __packed;
 	struct command cmd;
+	unsigned long flags;
+
+	spin_lock_irqsave(&channel->intent_lock, flags);
+	if (intent->advertised) {
+		spin_unlock_irqrestore(&channel->intent_lock, flags);
+		return 0;
+	}
+	intent->advertised = true;
+	spin_unlock_irqrestore(&channel->intent_lock, flags);
 
 	cmd.id = cpu_to_le16(GLINK_CMD_INTENT);
 	cmd.lcid = cpu_to_le16(channel->lcid);
@@ -693,6 +777,10 @@
 	cmd.size = cpu_to_le32(intent->size);
 	cmd.liid = cpu_to_le32(intent->id);
 
+	trace_qcom_glink_cmd_intent_tx(glink->label, channel->name,
+				       channel->lcid, channel->rcid,
+				       cmd.count, cmd.size, cmd.liid);
+
 	qcom_glink_tx(glink, &cmd, sizeof(cmd), NULL, 0, true);
 
 	return 0;
@@ -745,9 +833,13 @@
 	struct glink_channel *channel;
 	unsigned long flags;
 
-	spin_lock_irqsave(&glink->idr_lock, flags);
-	channel = idr_find(&glink->rcids, cid);
-	spin_unlock_irqrestore(&glink->idr_lock, flags);
+	qcom_glink_rx_advance(glink, ALIGN(sizeof(struct glink_msg), 8));
+
+	channel = qcom_glink_channel_ref_get(glink, true, cid);
+
+	trace_qcom_glink_cmd_rx_done_rx(glink->label, channel ? channel->name : NULL,
+					channel ? channel->lcid : 0, cid, iid, reuse);
+
 	if (!channel) {
 		dev_err(glink->dev, "invalid channel id received\n");
 		return;
@@ -759,6 +851,7 @@
 	if (!intent) {
 		spin_unlock_irqrestore(&channel->intent_lock, flags);
 		dev_err(glink->dev, "invalid intent id received\n");
+		qcom_glink_channel_ref_put(channel);
 		return;
 	}
 
@@ -774,6 +867,8 @@
 		WRITE_ONCE(channel->intent_received, true);
 		wake_up_all(&channel->intent_req_wq);
 	}
+
+	qcom_glink_channel_ref_put(channel);
 }
 
 /**
@@ -791,22 +886,27 @@
 {
 	struct glink_core_rx_intent *intent;
 	struct glink_channel *channel;
+	struct rpmsg_endpoint *ept;
 	unsigned long flags;
 
-	spin_lock_irqsave(&glink->idr_lock, flags);
-	channel = idr_find(&glink->rcids, cid);
-	spin_unlock_irqrestore(&glink->idr_lock, flags);
+	channel = qcom_glink_channel_ref_get(glink, true, cid);
 
+	trace_qcom_glink_cmd_rx_intent_req_rx(glink->label,
+					      channel ? channel->name : NULL,
+					      channel ? channel->lcid : 0,
+					      cid, size);
 	if (!channel) {
 		pr_err("%s channel not found for cid %d\n", __func__, cid);
 		return;
 	}
 
+	ept = &channel->ept;
 	intent = qcom_glink_alloc_intent(glink, channel, size, false);
-	if (intent)
+	if (intent && channel->channel_ready)
 		qcom_glink_advertise_intent(glink, channel, intent);
 
 	qcom_glink_send_intent_req_ack(glink, channel, !!intent);
+	qcom_glink_channel_ref_put(channel);
 }
 
 static int qcom_glink_rx_defer(struct qcom_glink *glink, size_t extra)
@@ -826,7 +926,9 @@
 
 	INIT_LIST_HEAD(&dcmd->node);
 
-	qcom_glink_rx_peek(glink, &dcmd->msg, 0, sizeof(dcmd->msg) + extra);
+	qcom_glink_rx_peek(glink,
+			   container_of(&dcmd->msg, struct glink_msg, hdr), 0,
+			   sizeof(dcmd->msg) + extra);
 
 	spin_lock(&glink->rx_lock);
 	list_add_tail(&dcmd->node, &glink->rx_queue);
@@ -841,9 +943,9 @@
 static int qcom_glink_rx_data(struct qcom_glink *glink, size_t avail)
 {
 	struct glink_core_rx_intent *intent;
-	struct glink_channel *channel;
+	struct glink_channel *channel = NULL;
 	struct {
-		struct glink_msg msg;
+		struct glink_msg_hdr msg;
 		__le32 chunk_size;
 		__le32 left_size;
 	} __packed hdr;
@@ -869,27 +971,37 @@
 	}
 
 	rcid = le16_to_cpu(hdr.msg.param1);
-	spin_lock_irqsave(&glink->idr_lock, flags);
-	channel = idr_find(&glink->rcids, rcid);
-	spin_unlock_irqrestore(&glink->idr_lock, flags);
+	liid = le32_to_cpu(hdr.msg.param2);
+
+	channel = qcom_glink_channel_ref_get(glink, true, rcid);
+
+	trace_qcom_glink_cmd_tx_data_rx(glink->label, channel ? channel->name : NULL,
+					channel ? channel->lcid : 0, rcid,
+					liid, chunk_size, left_size,
+					hdr.msg.cmd == GLINK_CMD_TX_DATA_CONT);
+
 	if (!channel) {
 		dev_dbg(glink->dev, "Data on non-existing channel\n");
 
 		/* Drop the message */
-		goto advance_rx;
+		qcom_glink_rx_advance(glink, ALIGN(sizeof(hdr) + chunk_size, 8));
+		return -EINVAL;
 	}
 
 	if (glink->intentless) {
 		/* Might have an ongoing, fragmented, message to append */
 		if (!channel->buf) {
 			intent = kzalloc(sizeof(*intent), GFP_ATOMIC);
-			if (!intent)
+			if (!intent) {
+				qcom_glink_channel_ref_put(channel);
 				return -ENOMEM;
+			}
 
 			intent->data = kmalloc(chunk_size + left_size,
 					       GFP_ATOMIC);
 			if (!intent->data) {
 				kfree(intent);
+				qcom_glink_channel_ref_put(channel);
 				return -ENOMEM;
 			}
 
@@ -902,8 +1014,6 @@
 			intent = channel->buf;
 		}
 	} else {
-		liid = le32_to_cpu(hdr.msg.param2);
-
 		spin_lock_irqsave(&channel->intent_lock, flags);
 		intent = idr_find(&channel->liids, liid);
 		spin_unlock_irqrestore(&channel->intent_lock, flags);
@@ -948,10 +1058,18 @@
 
 advance_rx:
 	qcom_glink_rx_advance(glink, ALIGN(sizeof(hdr) + chunk_size, 8));
-
+	qcom_glink_channel_ref_put(channel);
 	return ret;
 }
 
+static void qcom_glink_rx_read_notif(struct qcom_glink *glink)
+{
+	trace_qcom_glink_cmd_read_notif_rx(glink->label);
+
+	qcom_glink_rx_advance(glink, ALIGN(sizeof(struct glink_msg), 8));
+	qcom_glink_tx_kick(glink);
+}
+
 static void qcom_glink_handle_intent(struct qcom_glink *glink,
 				     unsigned int cid,
 				     unsigned int count,
@@ -965,7 +1083,7 @@
 	};
 
 	struct {
-		struct glink_msg msg;
+		struct glink_msg_hdr msg;
 		struct intent_pair intents[];
 	} __packed * msg;
 
@@ -979,21 +1097,27 @@
 		return;
 	}
 
-	spin_lock_irqsave(&glink->idr_lock, flags);
-	channel = idr_find(&glink->rcids, cid);
-	spin_unlock_irqrestore(&glink->idr_lock, flags);
+	channel = qcom_glink_channel_ref_get(glink, true, cid);
 	if (!channel) {
+		trace_qcom_glink_cmd_intent_rx(glink->label, NULL, 0, cid, count, 0, 0);
 		dev_err(glink->dev, "intents for non-existing channel\n");
 		qcom_glink_rx_advance(glink, ALIGN(msglen, 8));
 		return;
 	}
 
 	msg = kmalloc(msglen, GFP_ATOMIC);
-	if (!msg)
+	if (!msg) {
+		qcom_glink_channel_ref_put(channel);
 		return;
+	}
 
 	qcom_glink_rx_peek(glink, msg, 0, msglen);
 
+	trace_qcom_glink_cmd_intent_rx(glink->label, channel->name,
+				       channel->lcid, cid, count,
+				       count > 0 ? msg->intents[0].size : 0,
+				       count > 0 ? msg->intents[0].iid : 0);
+
 	for (i = 0; i < count; ++i) {
 		intent = kzalloc(sizeof(*intent), GFP_ATOMIC);
 		if (!intent)
@@ -1016,22 +1140,27 @@
 
 	kfree(msg);
 	qcom_glink_rx_advance(glink, ALIGN(msglen, 8));
+	qcom_glink_channel_ref_put(channel);
 }
 
 static int qcom_glink_rx_open_ack(struct qcom_glink *glink, unsigned int lcid)
 {
 	struct glink_channel *channel;
 
-	spin_lock(&glink->idr_lock);
-	channel = idr_find(&glink->lcids, lcid);
-	spin_unlock(&glink->idr_lock);
+	qcom_glink_rx_advance(glink, ALIGN(sizeof(struct glink_msg), 8));
+
+	channel = qcom_glink_channel_ref_get(glink, false, lcid);
+
+	trace_qcom_glink_cmd_open_ack_rx(glink->label, channel ? channel->name : NULL,
+					 lcid, channel ? channel->rcid : 0);
+
 	if (!channel) {
 		dev_err(glink->dev, "Invalid open ack packet\n");
 		return -EINVAL;
 	}
 
 	complete_all(&channel->open_ack);
-
+	qcom_glink_channel_ref_put(channel);
 	return 0;
 }
 
@@ -1057,6 +1186,9 @@
 	msg.param1 = cpu_to_le16(channel->lcid);
 	msg.param2 = cpu_to_le32(sigs);
 
+	trace_qcom_glink_cmd_signal_tx(glink->label, channel->name,
+				       channel->lcid, channel->rcid, sigs);
+
 	return qcom_glink_tx(glink, &msg, sizeof(msg), NULL, 0, true);
 }
 
@@ -1064,12 +1196,15 @@
 				      unsigned int rcid, unsigned int sigs)
 {
 	struct glink_channel *channel;
-	unsigned long flags;
 	bool enable;
 
-	spin_lock_irqsave(&glink->idr_lock, flags);
-	channel = idr_find(&glink->rcids, rcid);
-	spin_unlock_irqrestore(&glink->idr_lock, flags);
+	qcom_glink_rx_advance(glink, ALIGN(sizeof(struct glink_msg), 8));
+
+	channel = qcom_glink_channel_ref_get(glink, true, rcid);
+
+	trace_qcom_glink_cmd_signal_rx(glink->label, channel ? channel->name : NULL,
+				       channel ? channel->lcid : 0, rcid, sigs);
+
 	if (!channel) {
 		dev_err(glink->dev, "signal for non-existing channel\n");
 		return;
@@ -1079,6 +1214,8 @@
 
 	if (channel->ept.flow_cb)
 		channel->ept.flow_cb(channel->ept.rpdev, channel->ept.priv, enable);
+
+	qcom_glink_channel_ref_put(channel);
 }
 
 void qcom_glink_native_rx(struct qcom_glink *glink)
@@ -1114,37 +1251,32 @@
 			break;
 		case GLINK_CMD_OPEN_ACK:
 			ret = qcom_glink_rx_open_ack(glink, param1);
-			qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8));
 			break;
 		case GLINK_CMD_OPEN:
-			ret = qcom_glink_rx_defer(glink, param2);
+			/* upper 16 bits of param2 are the "prio" field */
+			ret = qcom_glink_rx_defer(glink, param2 & 0xffff);
 			break;
 		case GLINK_CMD_TX_DATA:
 		case GLINK_CMD_TX_DATA_CONT:
 			ret = qcom_glink_rx_data(glink, avail);
 			break;
 		case GLINK_CMD_READ_NOTIF:
-			qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8));
-			qcom_glink_tx_kick(glink);
+			qcom_glink_rx_read_notif(glink);
 			break;
 		case GLINK_CMD_INTENT:
 			qcom_glink_handle_intent(glink, param1, param2, avail);
 			break;
 		case GLINK_CMD_RX_DONE:
 			qcom_glink_handle_rx_done(glink, param1, param2, false);
-			qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8));
 			break;
 		case GLINK_CMD_RX_DONE_W_REUSE:
 			qcom_glink_handle_rx_done(glink, param1, param2, true);
-			qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8));
 			break;
 		case GLINK_CMD_RX_INTENT_REQ_ACK:
 			qcom_glink_handle_intent_req_ack(glink, param1, param2);
-			qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8));
 			break;
 		case GLINK_CMD_SIGNALS:
 			qcom_glink_handle_signals(glink, param1, param2);
-			qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8));
 			break;
 		default:
 			dev_err(glink->dev, "unhandled rx cmd: %d\n", cmd);
@@ -1280,16 +1412,33 @@
 	struct device_node *np = rpdev->dev.of_node;
 	struct qcom_glink *glink = channel->glink;
 	struct glink_core_rx_intent *intent;
+	struct glink_core_rx_intent *tmp;
 	const struct property *prop = NULL;
 	__be32 defaults[] = { cpu_to_be32(SZ_1K), cpu_to_be32(5) };
 	int num_intents;
 	int num_groups = 1;
 	__be32 *val = defaults;
+	unsigned long flags;
+	int iid;
 	int size;
 
 	if (glink->intentless || !completion_done(&channel->open_ack))
 		return 0;
 
+	channel->channel_ready = true;
+
+	/*Serve any pending intent request*/
+	spin_lock_irqsave(&channel->intent_lock, flags);
+	idr_for_each_entry(&channel->liids, tmp, iid) {
+		if (!tmp->reuse && !tmp->advertised) {
+			intent = tmp;
+			spin_unlock_irqrestore(&channel->intent_lock, flags);
+			qcom_glink_advertise_intent(glink, channel, intent);
+			spin_lock_irqsave(&channel->intent_lock, flags);
+		}
+	}
+	spin_unlock_irqrestore(&channel->intent_lock, flags);
+
 	prop = of_find_property(np, "qcom,intents", NULL);
 	if (prop) {
 		val = prop->value;
@@ -1349,19 +1498,27 @@
 	cmd.cid = channel->lcid;
 	cmd.size = size;
 
+	trace_qcom_glink_cmd_rx_intent_req_tx(glink->label, channel->name,
+					      channel->lcid, channel->rcid,
+					      cmd.size);
+
 	ret = qcom_glink_tx(glink, &cmd, sizeof(cmd), NULL, 0, true);
 	if (ret)
 		goto unlock;
 
 	ret = wait_event_timeout(channel->intent_req_wq,
-				 READ_ONCE(channel->intent_req_result) >= 0 &&
-				 READ_ONCE(channel->intent_received),
+				 READ_ONCE(channel->intent_req_result) == 0 ||
+				 (READ_ONCE(channel->intent_req_result) > 0 &&
+				  READ_ONCE(channel->intent_received)) ||
+				 glink->abort_tx,
 				 10 * HZ);
 	if (!ret) {
 		dev_err(glink->dev, "intent request timed out\n");
 		ret = -ETIMEDOUT;
+	} else if (glink->abort_tx) {
+		ret = -ECANCELED;
 	} else {
-		ret = READ_ONCE(channel->intent_req_result) ? 0 : -ECANCELED;
+		ret = READ_ONCE(channel->intent_req_result) ? 0 : -EAGAIN;
 	}
 
 unlock:
@@ -1377,7 +1534,7 @@
 	struct glink_core_rx_intent *tmp;
 	int iid = 0;
 	struct {
-		struct glink_msg msg;
+		struct glink_msg_hdr msg;
 		__le32 chunk_size;
 		__le32 left_size;
 	} __packed req;
@@ -1429,6 +1586,12 @@
 		req.chunk_size = cpu_to_le32(chunk_size);
 		req.left_size = cpu_to_le32(len - offset - chunk_size);
 
+		trace_qcom_glink_cmd_tx_data_tx(glink->label, channel->name,
+						channel->lcid, channel->rcid,
+						iid, chunk_size,
+						len - offset - chunk_size,
+						offset > 0);
+
 		ret = qcom_glink_tx(glink, &req, sizeof(req), data + offset, chunk_size, wait);
 		if (ret) {
 			/* Mark intent available if we failed */
@@ -1544,6 +1707,8 @@
 		create_device = true;
 	}
 
+	trace_qcom_glink_cmd_open_rx(glink->label, name, channel->lcid, rcid);
+
 	spin_lock_irqsave(&glink->idr_lock, flags);
 	ret = idr_alloc(&glink->rcids, channel, rcid, rcid + 1, GFP_ATOMIC);
 	if (ret < 0) {
@@ -1605,6 +1770,9 @@
 	spin_lock_irqsave(&glink->idr_lock, flags);
 	channel = idr_find(&glink->rcids, rcid);
 	spin_unlock_irqrestore(&glink->idr_lock, flags);
+
+	trace_qcom_glink_cmd_close_rx(glink->label, channel ? channel->name : NULL,
+				      channel ? channel->lcid : 0, rcid);
 	if (WARN(!channel, "close request on unknown channel\n"))
 		return;
 
@@ -1620,7 +1788,7 @@
 	}
 	channel->rpdev = NULL;
 
-	qcom_glink_send_close_ack(glink, channel->rcid);
+	qcom_glink_send_close_ack(glink, channel);
 
 	spin_lock_irqsave(&glink->idr_lock, flags);
 	idr_remove(&glink->rcids, channel->rcid);
@@ -1641,6 +1809,9 @@
 
 	spin_lock_irqsave(&glink->idr_lock, flags);
 	channel = idr_find(&glink->lcids, lcid);
+
+	trace_qcom_glink_cmd_close_ack_rx(glink->label, channel ? channel->name : NULL,
+					  lcid, channel ? channel->rcid : 0);
 	if (WARN(!channel, "close ack on unknown channel\n")) {
 		spin_unlock_irqrestore(&glink->idr_lock, flags);
 		return;
@@ -1685,7 +1856,7 @@
 		list_del(&dcmd->node);
 		spin_unlock_irqrestore(&glink->rx_lock, flags);
 
-		msg = &dcmd->msg;
+		msg = container_of(&dcmd->msg, struct glink_msg, hdr);
 		cmd = le16_to_cpu(msg->cmd);
 		param1 = le16_to_cpu(msg->param1);
 		param2 = le32_to_cpu(msg->param2);
@@ -1815,6 +1986,10 @@
 	idr_init(&glink->lcids);
 	idr_init(&glink->rcids);
 
+	ret = of_property_read_string(dev->of_node, "label", &glink->label);
+	if (ret < 0)
+		glink->label = dev->of_node->name;
+
 	glink->dev->groups = qcom_glink_groups;
 
 	ret = device_add_groups(dev, qcom_glink_groups);
--- linux-qcom-6.8.0.orig/drivers/rpmsg/qcom_glink_smem.c
+++ linux-qcom-6.8.0/drivers/rpmsg/qcom_glink_smem.c
@@ -86,9 +86,14 @@
 	tail = le32_to_cpu(*pipe->tail);
 
 	if (head < tail)
-		return pipe->native.length - tail + head;
+		len = pipe->native.length - tail + head;
 	else
-		return head - tail;
+		len = head - tail;
+
+	if (WARN_ON_ONCE(len > pipe->native.length))
+		len = 0;
+
+	return len;
 }
 
 static void glink_smem_rx_peek(struct qcom_glink_pipe *np,
@@ -99,6 +104,10 @@
 	u32 tail;
 
 	tail = le32_to_cpu(*pipe->tail);
+
+	if (WARN_ON_ONCE(tail > pipe->native.length))
+		return;
+
 	tail += offset;
 	if (tail >= pipe->native.length)
 		tail -= pipe->native.length;
@@ -121,7 +130,7 @@
 
 	tail += count;
 	if (tail >= pipe->native.length)
-		tail -= pipe->native.length;
+		tail %= pipe->native.length;
 
 	*pipe->tail = cpu_to_le32(tail);
 }
@@ -146,6 +155,9 @@
 	else
 		avail -= FIFO_FULL_RESERVE + TX_BLOCKED_CMD_RESERVE;
 
+	if (WARN_ON_ONCE(avail > pipe->native.length))
+		avail = 0;
+
 	return avail;
 }
 
@@ -155,6 +167,9 @@
 {
 	size_t len;
 
+	if (WARN_ON_ONCE(head > pipe->native.length))
+		return head;
+
 	len = min_t(size_t, count, pipe->native.length - head);
 	if (len)
 		memcpy(pipe->fifo + head, data, len);
@@ -306,13 +321,14 @@
 
 	smem->irq = of_irq_get(smem->dev.of_node, 0);
 	ret = devm_request_irq(&smem->dev, smem->irq, qcom_glink_smem_intr,
-			       IRQF_NO_SUSPEND | IRQF_NO_AUTOEN,
-			       "glink-smem", smem);
+			       IRQF_NO_AUTOEN, "glink-smem", smem);
 	if (ret) {
 		dev_err(&smem->dev, "failed to request IRQ\n");
 		goto err_put_dev;
 	}
 
+	enable_irq_wake(smem->irq);
+
 	smem->mbox_client.dev = &smem->dev;
 	smem->mbox_client.knows_txdone = true;
 	smem->mbox_chan = mbox_request_channel(&smem->mbox_client, 0);
@@ -362,7 +378,11 @@
 
 void qcom_glink_smem_unregister(struct qcom_glink_smem *smem)
 {
-	struct qcom_glink *glink = smem->glink;
+	struct qcom_glink *glink;
+
+	if (!smem)
+		return;
+	glink = smem->glink;
 
 	disable_irq(smem->irq);
 
--- linux-qcom-6.8.0.orig/drivers/rpmsg/qcom_glink_trace.h
+++ linux-qcom-6.8.0/drivers/rpmsg/qcom_glink_trace.h
@@ -0,0 +1,406 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM qcom_glink
+
+#if !defined(__QCOM_GLINK_TRACE_H__) || defined(TRACE_HEADER_MULTI_READ)
+#define __QCOM_GLINK_TRACE_H__
+
+#include <linux/tracepoint.h>
+#include "qcom_glink_native.h"
+
+
+TRACE_EVENT(qcom_glink_cmd_version,
+	TP_PROTO(const char *remote, unsigned int version, unsigned int features, bool tx),
+	TP_ARGS(remote, version, features, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__field(u32, version)
+		__field(u32, features)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__entry->version = version;
+		__entry->features = features;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s version: %u features: %#x",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __entry->version,
+		  __entry->features
+	)
+);
+#define trace_qcom_glink_cmd_version_tx(...) trace_qcom_glink_cmd_version(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_version_rx(...) trace_qcom_glink_cmd_version(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_version_ack,
+	TP_PROTO(const char *remote, unsigned int version, unsigned int features, bool tx),
+	TP_ARGS(remote, version, features, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__field(u32, version)
+		__field(u32, features)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__entry->version = version;
+		__entry->features = features;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s version: %u features: %#x",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __entry->version,
+		  __entry->features
+	)
+);
+#define trace_qcom_glink_cmd_version_ack_tx(...) trace_qcom_glink_cmd_version_ack(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_version_ack_rx(...) trace_qcom_glink_cmd_version_ack(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_open,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u]",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid
+	)
+);
+#define trace_qcom_glink_cmd_open_tx(...) trace_qcom_glink_cmd_open(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_open_rx(...) trace_qcom_glink_cmd_open(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_close,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u]",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid
+	)
+);
+#define trace_qcom_glink_cmd_close_tx(...) trace_qcom_glink_cmd_close(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_close_rx(...) trace_qcom_glink_cmd_close(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_open_ack,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u]",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid
+	)
+);
+#define trace_qcom_glink_cmd_open_ack_tx(...) trace_qcom_glink_cmd_open_ack(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_open_ack_rx(...) trace_qcom_glink_cmd_open_ack(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_intent,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, size_t count, size_t size, u32 liid, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, count, size, liid, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(u32, count)
+		__field(u32, size)
+		__field(u32, liid)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->count = count;
+		__entry->size = size;
+		__entry->liid = liid;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u] count: %d [size: %d liid: %d]",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid,
+		  __entry->count,
+		  __entry->size,
+		  __entry->liid
+	)
+);
+#define trace_qcom_glink_cmd_intent_tx(...) trace_qcom_glink_cmd_intent(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_intent_rx(...) trace_qcom_glink_cmd_intent(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_rx_done,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, u32 iid, bool reuse, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, iid, reuse, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(u32, iid)
+		__field(bool, reuse)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->iid = iid;
+		__entry->reuse = reuse;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u] iid: %d reuse: %d",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid,
+		  __entry->iid,
+		  __entry->reuse
+	)
+);
+#define trace_qcom_glink_cmd_rx_done_tx(...) trace_qcom_glink_cmd_rx_done(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_rx_done_rx(...) trace_qcom_glink_cmd_rx_done(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_rx_intent_req,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, size_t size, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, size, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(u32, size)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->size = size;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u] size: %d",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid,
+		  __entry->size
+	)
+);
+#define trace_qcom_glink_cmd_rx_intent_req_tx(...) trace_qcom_glink_cmd_rx_intent_req(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_rx_intent_req_rx(...) trace_qcom_glink_cmd_rx_intent_req(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_rx_intent_req_ack,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, bool granted, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, granted, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(bool, granted)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->granted = granted;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u] granted: %d",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid,
+		  __entry->granted
+	)
+);
+#define trace_qcom_glink_cmd_rx_intent_req_ack_tx(...) trace_qcom_glink_cmd_rx_intent_req_ack(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_rx_intent_req_ack_rx(...) trace_qcom_glink_cmd_rx_intent_req_ack(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_tx_data,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, u32 iid, u32 chunk_size, u32 left_size, bool cont, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, iid, chunk_size, left_size, cont, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(u32, iid)
+		__field(u32, chunk_size)
+		__field(u32, left_size)
+		__field(bool, cont)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->iid = iid;
+		__entry->chunk_size = chunk_size;
+		__entry->left_size = left_size;
+		__entry->cont = cont;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u] iid: %d chunk_size: %d left_size: %d cont: %d",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid,
+		  __entry->iid,
+		  __entry->chunk_size,
+		  __entry->left_size,
+		  __entry->cont
+	)
+);
+#define trace_qcom_glink_cmd_tx_data_tx(...) trace_qcom_glink_cmd_tx_data(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_tx_data_rx(...) trace_qcom_glink_cmd_tx_data(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_close_ack,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u]",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid
+	)
+);
+#define trace_qcom_glink_cmd_close_ack_tx(...) trace_qcom_glink_cmd_close_ack(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_close_ack_rx(...) trace_qcom_glink_cmd_close_ack(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_read_notif,
+	TP_PROTO(const char *remote, bool tx),
+	TP_ARGS(remote, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote)
+	)
+);
+#define trace_qcom_glink_cmd_read_notif_tx(...) trace_qcom_glink_cmd_read_notif(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_read_notif_rx(...) trace_qcom_glink_cmd_read_notif(__VA_ARGS__, false)
+
+TRACE_EVENT(qcom_glink_cmd_signal,
+	TP_PROTO(const char *remote, const char *channel, u16 lcid, u16 rcid, unsigned int signals, bool tx),
+	TP_ARGS(remote, channel, lcid, rcid, signals, tx),
+	TP_STRUCT__entry(
+		__string(remote, remote)
+		__string(channel, channel)
+		__field(u16, lcid)
+		__field(u16, rcid)
+		__field(u32, signals)
+		__field(bool, tx)
+	),
+	TP_fast_assign(
+		__assign_str(remote, remote);
+		__assign_str(channel, channel);
+		__entry->lcid = lcid;
+		__entry->rcid = rcid;
+		__entry->signals = signals;
+		__entry->tx = tx;
+	),
+	TP_printk("%s remote: %s channel: %s[%u/%u] signals: %#x",
+		  __entry->tx ? "tx" : "rx",
+		  __get_str(remote),
+		  __get_str(channel),
+		  __entry->lcid,
+		  __entry->rcid,
+		  __entry->signals
+	)
+);
+#define trace_qcom_glink_cmd_signal_tx(...) trace_qcom_glink_cmd_signal(__VA_ARGS__, true)
+#define trace_qcom_glink_cmd_signal_rx(...) trace_qcom_glink_cmd_signal(__VA_ARGS__, false)
+
+#endif
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE qcom_glink_trace
+
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/rtc/Kconfig
+++ linux-qcom-6.8.0/drivers/rtc/Kconfig
@@ -1858,7 +1858,8 @@
 
 config RTC_DRV_MT6397
 	tristate "MediaTek PMIC based RTC"
-	depends on MFD_MT6397 || (COMPILE_TEST && IRQ_DOMAIN)
+	depends on MFD_MT6397 || COMPILE_TEST
+	select IRQ_DOMAIN
 	help
 	  This selects the MediaTek(R) RTC driver. RTC is part of MediaTek
 	  MT6397 PMIC. You should enable MT6397 PMIC MFD before select
--- linux-qcom-6.8.0.orig/drivers/rtc/interface.c
+++ linux-qcom-6.8.0/drivers/rtc/interface.c
@@ -274,10 +274,9 @@
 			return err;
 
 		/* full-function RTCs won't have such missing fields */
-		if (rtc_valid_tm(&alarm->time) == 0) {
-			rtc_add_offset(rtc, &alarm->time);
-			return 0;
-		}
+		err = rtc_valid_tm(&alarm->time);
+		if (!err)
+			goto done;
 
 		/* get the "after" timestamp, to detect wrapped fields */
 		err = rtc_read_time(rtc, &now);
@@ -379,6 +378,8 @@
 	if (err && alarm->enabled)
 		dev_warn(&rtc->dev, "invalid alarm value: %ptR\n",
 			 &alarm->time);
+	else
+		rtc_add_offset(rtc, &alarm->time);
 
 	return err;
 }
@@ -903,13 +904,18 @@
 	struct timerqueue_node *next;
 	ktime_t now;
 	struct rtc_time tm;
+	int err;
 
 	struct rtc_device *rtc =
 		container_of(work, struct rtc_device, irqwork);
 
 	mutex_lock(&rtc->ops_lock);
 again:
-	__rtc_read_time(rtc, &tm);
+	err = __rtc_read_time(rtc, &tm);
+	if (err) {
+		mutex_unlock(&rtc->ops_lock);
+		return;
+	}
 	now = rtc_tm_to_ktime(tm);
 	while ((next = timerqueue_getnext(&rtc->timerqueue))) {
 		if (next->expires > now)
--- linux-qcom-6.8.0.orig/drivers/rtc/lib_test.c
+++ linux-qcom-6.8.0/drivers/rtc/lib_test.c
@@ -54,7 +54,7 @@
 
 		days = div_s64(secs, 86400);
 
-		#define FAIL_MSG "%d/%02d/%02d (%2d) : %ld", \
+		#define FAIL_MSG "%d/%02d/%02d (%2d) : %lld", \
 			year, month, mday, yday, days
 
 		KUNIT_ASSERT_EQ_MSG(test, year - 1900, result.tm_year, FAIL_MSG);
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-ab-eoz9.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-ab-eoz9.c
@@ -396,13 +396,6 @@
 	if (ret < 0)
 		return ret;
 
-	if ((val & ABEOZ9_REG_CTRL_STATUS_V1F) ||
-	    (val & ABEOZ9_REG_CTRL_STATUS_V2F)) {
-		dev_err(dev,
-			"thermometer might be disabled due to low voltage\n");
-		return -EINVAL;
-	}
-
 	switch (attr) {
 	case hwmon_temp_input:
 		ret = regmap_read(regmap, ABEOZ9_REG_REG_TEMP, &val);
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-abx80x.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-abx80x.c
@@ -39,7 +39,7 @@
 #define ABX8XX_REG_STATUS	0x0f
 #define ABX8XX_STATUS_AF	BIT(2)
 #define ABX8XX_STATUS_BLF	BIT(4)
-#define ABX8XX_STATUS_WDT	BIT(6)
+#define ABX8XX_STATUS_WDT	BIT(5)
 
 #define ABX8XX_REG_CTRL1	0x10
 #define ABX8XX_CTRL_WRITE	BIT(0)
@@ -705,14 +705,18 @@
 		if (ret)
 			return ret;
 
-		if (write)
+		if (write) {
 			ret = i2c_smbus_write_i2c_block_data(priv->client, reg,
 							     len, val);
-		else
+			if (ret)
+				return ret;
+		} else {
 			ret = i2c_smbus_read_i2c_block_data(priv->client, reg,
 							    len, val);
-		if (ret)
-			return ret;
+			if (ret <= 0)
+				return ret ? ret : -EIO;
+			len = ret;
+		}
 
 		offset += len;
 		val += len;
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-at91sam9.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-at91sam9.c
@@ -368,6 +368,7 @@
 		return ret;
 
 	rtc->gpbr = syscon_node_to_regmap(args.np);
+	of_node_put(args.np);
 	rtc->gpbr_offset = args.args[0];
 	if (IS_ERR(rtc->gpbr)) {
 		dev_err(&pdev->dev, "failed to retrieve gpbr regmap, aborting.\n");
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-cmos.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-cmos.c
@@ -643,21 +643,19 @@
 			   size_t count)
 {
 	unsigned char *buf = val;
-	int	retval;
 
 	off += NVRAM_OFFSET;
-	spin_lock_irq(&rtc_lock);
-	for (retval = 0; count; count--, off++, retval++) {
+	for (; count; count--, off++, buf++) {
+		guard(spinlock_irq)(&rtc_lock);
 		if (off < 128)
-			*buf++ = CMOS_READ(off);
+			*buf = CMOS_READ(off);
 		else if (can_bank2)
-			*buf++ = cmos_read_bank2(off);
+			*buf = cmos_read_bank2(off);
 		else
-			break;
+			return -EIO;
 	}
-	spin_unlock_irq(&rtc_lock);
 
-	return retval;
+	return 0;
 }
 
 static int cmos_nvram_write(void *priv, unsigned int off, void *val,
@@ -665,7 +663,6 @@
 {
 	struct cmos_rtc	*cmos = priv;
 	unsigned char	*buf = val;
-	int		retval;
 
 	/* NOTE:  on at least PCs and Ataris, the boot firmware uses a
 	 * checksum on part of the NVRAM data.  That's currently ignored
@@ -673,23 +670,23 @@
 	 * NVRAM to update, updating checksums is also part of its job.
 	 */
 	off += NVRAM_OFFSET;
-	spin_lock_irq(&rtc_lock);
-	for (retval = 0; count; count--, off++, retval++) {
+	for (; count; count--, off++, buf++) {
 		/* don't trash RTC registers */
 		if (off == cmos->day_alrm
 				|| off == cmos->mon_alrm
 				|| off == cmos->century)
-			buf++;
-		else if (off < 128)
-			CMOS_WRITE(*buf++, off);
+			continue;
+
+		guard(spinlock_irq)(&rtc_lock);
+		if (off < 128)
+			CMOS_WRITE(*buf, off);
 		else if (can_bank2)
-			cmos_write_bank2(*buf++, off);
+			cmos_write_bank2(*buf, off);
 		else
-			break;
+			return -EIO;
 	}
-	spin_unlock_irq(&rtc_lock);
 
-	return retval;
+	return 0;
 }
 
 /*----------------------------------------------------------------*/
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-isl1208.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-isl1208.c
@@ -775,14 +775,13 @@
 {
 	struct isl1208_state *isl1208 = priv;
 	struct i2c_client *client = to_i2c_client(isl1208->rtc->dev.parent);
-	int ret;
 
 	/* nvmem sanitizes offset/count for us, but count==0 is possible */
 	if (!count)
 		return count;
-	ret = isl1208_i2c_read_regs(client, ISL1208_REG_USR1 + off, buf,
+
+	return isl1208_i2c_read_regs(client, ISL1208_REG_USR1 + off, buf,
 				    count);
-	return ret == 0 ? count : ret;
 }
 
 static int isl1208_nvmem_write(void *priv, unsigned int off, void *buf,
@@ -790,15 +789,13 @@
 {
 	struct isl1208_state *isl1208 = priv;
 	struct i2c_client *client = to_i2c_client(isl1208->rtc->dev.parent);
-	int ret;
 
 	/* nvmem sanitizes off/count for us, but count==0 is possible */
 	if (!count)
 		return count;
-	ret = isl1208_i2c_set_regs(client, ISL1208_REG_USR1 + off, buf,
-				   count);
 
-	return ret == 0 ? count : ret;
+	return isl1208_i2c_set_regs(client, ISL1208_REG_USR1 + off, buf,
+				   count);
 }
 
 static const struct nvmem_config isl1208_nvmem_config = {
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-max31335.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-max31335.c
@@ -204,7 +204,7 @@
 		return true;
 
 	/* interrupt status register */
-	if (reg == MAX31335_INT_EN1_A1IE)
+	if (reg == MAX31335_STATUS1)
 		return true;
 
 	/* temperature registers */
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-nct3018y.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-nct3018y.c
@@ -102,6 +102,8 @@
 		if (flags < 0)
 			return flags;
 		*alarm_enable = flags & NCT3018Y_BIT_AIE;
+		dev_dbg(&client->dev, "%s:alarm_enable:%x\n", __func__, *alarm_enable);
+
 	}
 
 	if (alarm_flag) {
@@ -110,11 +112,9 @@
 		if (flags < 0)
 			return flags;
 		*alarm_flag = flags & NCT3018Y_BIT_AF;
+		dev_dbg(&client->dev, "%s:alarm_flag:%x\n", __func__, *alarm_flag);
 	}
 
-	dev_dbg(&client->dev, "%s:alarm_enable:%x alarm_flag:%x\n",
-		__func__, *alarm_enable, *alarm_flag);
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-rzn1.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-rzn1.c
@@ -111,8 +111,8 @@
 	tm->tm_hour = bcd2bin(tm->tm_hour);
 	tm->tm_wday = bcd2bin(tm->tm_wday);
 	tm->tm_mday = bcd2bin(tm->tm_mday);
-	tm->tm_mon = bcd2bin(tm->tm_mon);
-	tm->tm_year = bcd2bin(tm->tm_year);
+	tm->tm_mon = bcd2bin(tm->tm_mon) - 1;
+	tm->tm_year = bcd2bin(tm->tm_year) + 100;
 
 	return 0;
 }
@@ -128,8 +128,8 @@
 	tm->tm_hour = bin2bcd(tm->tm_hour);
 	tm->tm_wday = bin2bcd(rzn1_rtc_tm_to_wday(tm));
 	tm->tm_mday = bin2bcd(tm->tm_mday);
-	tm->tm_mon = bin2bcd(tm->tm_mon);
-	tm->tm_year = bin2bcd(tm->tm_year);
+	tm->tm_mon = bin2bcd(tm->tm_mon + 1);
+	tm->tm_year = bin2bcd(tm->tm_year - 100);
 
 	val = readl(rtc->base + RZN1_RTC_CTL2);
 	if (!(val & RZN1_RTC_CTL2_STOPPED)) {
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-st-lpc.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-st-lpc.c
@@ -218,15 +218,14 @@
 		return -EINVAL;
 	}
 
-	ret = devm_request_irq(&pdev->dev, rtc->irq, st_rtc_handler, 0,
-			       pdev->name, rtc);
+	ret = devm_request_irq(&pdev->dev, rtc->irq, st_rtc_handler,
+			       IRQF_NO_AUTOEN, pdev->name, rtc);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to request irq %i\n", rtc->irq);
 		return ret;
 	}
 
 	enable_irq_wake(rtc->irq);
-	disable_irq(rtc->irq);
 
 	rtc->clk = devm_clk_get_enabled(&pdev->dev, NULL);
 	if (IS_ERR(rtc->clk))
--- linux-qcom-6.8.0.orig/drivers/rtc/rtc-tps6594.c
+++ linux-qcom-6.8.0/drivers/rtc/rtc-tps6594.c
@@ -360,10 +360,6 @@
 	int irq;
 	int ret;
 
-	rtc = devm_kzalloc(dev, sizeof(*rtc), GFP_KERNEL);
-	if (!rtc)
-		return -ENOMEM;
-
 	rtc = devm_rtc_allocate_device(dev);
 	if (IS_ERR(rtc))
 		return PTR_ERR(rtc);
--- linux-qcom-6.8.0.orig/drivers/s390/block/dasd.c
+++ linux-qcom-6.8.0/drivers/s390/block/dasd.c
@@ -8,9 +8,6 @@
  * Copyright IBM Corp. 1999, 2009
  */
 
-#define KMSG_COMPONENT "dasd"
-#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
-
 #include <linux/kmod.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
@@ -1598,9 +1595,15 @@
 	if (!sense)
 		return 0;
 
-	return !!(sense[1] & SNS1_NO_REC_FOUND) ||
-		!!(sense[1] & SNS1_FILE_PROTECTED) ||
-		scsw_cstat(&irb->scsw) == SCHN_STAT_INCORR_LEN;
+	if (sense[1] & SNS1_NO_REC_FOUND)
+		return 1;
+
+	if ((sense[1] & SNS1_INV_TRACK_FORMAT) &&
+	    scsw_is_tm(&irb->scsw) &&
+	    !(sense[2] & SNS2_ENV_DATA_PRESENT))
+		return 1;
+
+	return 0;
 }
 
 static int dasd_ese_oos_cond(u8 *sense)
@@ -1621,7 +1624,7 @@
 	struct dasd_device *device;
 	unsigned long now;
 	int nrf_suppressed = 0;
-	int fp_suppressed = 0;
+	int it_suppressed = 0;
 	struct request *req;
 	u8 *sense = NULL;
 	int expires;
@@ -1676,8 +1679,9 @@
 		 */
 		sense = dasd_get_sense(irb);
 		if (sense) {
-			fp_suppressed = (sense[1] & SNS1_FILE_PROTECTED) &&
-				test_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags);
+			it_suppressed =	(sense[1] & SNS1_INV_TRACK_FORMAT) &&
+				!(sense[2] & SNS2_ENV_DATA_PRESENT) &&
+				test_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags);
 			nrf_suppressed = (sense[1] & SNS1_NO_REC_FOUND) &&
 				test_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags);
 
@@ -1692,7 +1696,7 @@
 				return;
 			}
 		}
-		if (!(fp_suppressed || nrf_suppressed))
+		if (!(it_suppressed || nrf_suppressed))
 			device->discipline->dump_sense_dbf(device, irb, "int");
 
 		if (device->features & DASD_FEATURE_ERPLOG)
@@ -2464,14 +2468,17 @@
 	rc = 0;
 	list_for_each_entry_safe(cqr, n, ccw_queue, blocklist) {
 		/*
-		 * In some cases the 'File Protected' or 'Incorrect Length'
-		 * error might be expected and error recovery would be
-		 * unnecessary in these cases.	Check if the according suppress
-		 * bit is set.
+		 * In some cases certain errors might be expected and
+		 * error recovery would be unnecessary in these cases.
+		 * Check if the according suppress bit is set.
 		 */
 		sense = dasd_get_sense(&cqr->irb);
-		if (sense && sense[1] & SNS1_FILE_PROTECTED &&
-		    test_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags))
+		if (sense && (sense[1] & SNS1_INV_TRACK_FORMAT) &&
+		    !(sense[2] & SNS2_ENV_DATA_PRESENT) &&
+		    test_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags))
+			continue;
+		if (sense && (sense[1] & SNS1_NO_REC_FOUND) &&
+		    test_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags))
 			continue;
 		if (scsw_cstat(&cqr->irb.scsw) == 0x40 &&
 		    test_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags))
@@ -3402,8 +3409,7 @@
 
 	ret = ccw_device_set_online(cdev);
 	if (ret)
-		pr_warn("%s: Setting the DASD online failed with rc=%d\n",
-			dev_name(&cdev->dev), ret);
+		dev_warn(&cdev->dev, "Setting the DASD online failed with rc=%d\n", ret);
 }
 
 /*
@@ -3490,8 +3496,11 @@
 {
 	struct dasd_discipline *discipline;
 	struct dasd_device *device;
+	struct device *dev;
 	int rc;
 
+	dev = &cdev->dev;
+
 	/* first online clears initial online feature flag */
 	dasd_set_feature(cdev, DASD_FEATURE_INITIAL_ONLINE, 0);
 	device = dasd_create_device(cdev);
@@ -3504,11 +3513,10 @@
 			/* Try to load the required module. */
 			rc = request_module(DASD_DIAG_MOD);
 			if (rc) {
-				pr_warn("%s Setting the DASD online failed "
-					"because the required module %s "
-					"could not be loaded (rc=%d)\n",
-					dev_name(&cdev->dev), DASD_DIAG_MOD,
-					rc);
+				dev_warn(dev, "Setting the DASD online failed "
+					 "because the required module %s "
+					 "could not be loaded (rc=%d)\n",
+					 DASD_DIAG_MOD, rc);
 				dasd_delete_device(device);
 				return -ENODEV;
 			}
@@ -3516,8 +3524,7 @@
 		/* Module init could have failed, so check again here after
 		 * request_module(). */
 		if (!dasd_diag_discipline_pointer) {
-			pr_warn("%s Setting the DASD online failed because of missing DIAG discipline\n",
-				dev_name(&cdev->dev));
+			dev_warn(dev, "Setting the DASD online failed because of missing DIAG discipline\n");
 			dasd_delete_device(device);
 			return -ENODEV;
 		}
@@ -3527,37 +3534,33 @@
 		dasd_delete_device(device);
 		return -EINVAL;
 	}
+	device->base_discipline = base_discipline;
 	if (!try_module_get(discipline->owner)) {
-		module_put(base_discipline->owner);
 		dasd_delete_device(device);
 		return -EINVAL;
 	}
-	device->base_discipline = base_discipline;
 	device->discipline = discipline;
 
 	/* check_device will allocate block device if necessary */
 	rc = discipline->check_device(device);
 	if (rc) {
-		pr_warn("%s Setting the DASD online with discipline %s failed with rc=%i\n",
-			dev_name(&cdev->dev), discipline->name, rc);
-		module_put(discipline->owner);
-		module_put(base_discipline->owner);
+		dev_warn(dev, "Setting the DASD online with discipline %s failed with rc=%i\n",
+			 discipline->name, rc);
 		dasd_delete_device(device);
 		return rc;
 	}
 
 	dasd_set_target_state(device, DASD_STATE_ONLINE);
 	if (device->state <= DASD_STATE_KNOWN) {
-		pr_warn("%s Setting the DASD online failed because of a missing discipline\n",
-			dev_name(&cdev->dev));
+		dev_warn(dev, "Setting the DASD online failed because of a missing discipline\n");
 		rc = -ENODEV;
 		dasd_set_target_state(device, DASD_STATE_NEW);
 		if (device->block)
 			dasd_free_block(device->block);
 		dasd_delete_device(device);
-	} else
-		pr_debug("dasd_generic device %s found\n",
-				dev_name(&cdev->dev));
+	} else {
+		dev_dbg(dev, "dasd_generic device found\n");
+	}
 
 	wait_event(dasd_init_waitq, _wait_for_device(device));
 
@@ -3568,10 +3571,13 @@
 
 int dasd_generic_set_offline(struct ccw_device *cdev)
 {
+	int max_count, open_count, rc;
 	struct dasd_device *device;
 	struct dasd_block *block;
-	int max_count, open_count, rc;
 	unsigned long flags;
+	struct device *dev;
+
+	dev = &cdev->dev;
 
 	rc = 0;
 	spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
@@ -3592,11 +3598,10 @@
 		open_count = atomic_read(&device->block->open_count);
 		if (open_count > max_count) {
 			if (open_count > 0)
-				pr_warn("%s: The DASD cannot be set offline with open count %i\n",
-					dev_name(&cdev->dev), open_count);
+				dev_warn(dev, "The DASD cannot be set offline with open count %i\n",
+					 open_count);
 			else
-				pr_warn("%s: The DASD cannot be set offline while it is in use\n",
-					dev_name(&cdev->dev));
+				dev_warn(dev, "The DASD cannot be set offline while it is in use\n");
 			rc = -EBUSY;
 			goto out_err;
 		}
@@ -3956,8 +3961,8 @@
 	if (dasd_eer_enabled(device))
 		dasd_eer_write(device, NULL, DASD_EER_AUTOQUIESCE);
 
-	pr_info("%s: The DASD has been put in the quiesce state\n",
-		dev_name(&device->cdev->dev));
+	dev_info(&device->cdev->dev,
+		 "The DASD has been put in the quiesce state\n");
 	dasd_device_set_stop_bits(device, DASD_STOPPED_QUIESCE);
 
 	if (device->features & DASD_FEATURE_REQUEUEQUIESCE)
--- linux-qcom-6.8.0.orig/drivers/s390/block/dasd_3990_erp.c
+++ linux-qcom-6.8.0/drivers/s390/block/dasd_3990_erp.c
@@ -1406,14 +1406,8 @@
 
 	struct dasd_device *device = erp->startdev;
 
-	/*
-	 * In some cases the 'File Protected' error might be expected and
-	 * log messages shouldn't be written then.
-	 * Check if the according suppress bit is set.
-	 */
-	if (!test_bit(DASD_CQR_SUPPRESS_FP, &erp->flags))
-		dev_err(&device->cdev->dev,
-			"Accessing the DASD failed because of a hardware error\n");
+	dev_err(&device->cdev->dev,
+		"Accessing the DASD failed because of a hardware error\n");
 
 	return dasd_3990_erp_cleanup(erp, DASD_CQR_FAILED);
 
--- linux-qcom-6.8.0.orig/drivers/s390/block/dasd_devmap.c
+++ linux-qcom-6.8.0/drivers/s390/block/dasd_devmap.c
@@ -2258,13 +2258,19 @@
 
 	/* allocate primary devmap if needed */
 	prim_devmap = dasd_find_busid(prim_busid);
-	if (IS_ERR(prim_devmap))
+	if (IS_ERR(prim_devmap)) {
 		prim_devmap = dasd_add_busid(prim_busid, DASD_FEATURE_DEFAULT);
+		if (IS_ERR(prim_devmap))
+			return PTR_ERR(prim_devmap);
+	}
 
 	/* allocate secondary devmap if needed */
 	sec_devmap = dasd_find_busid(sec_busid);
-	if (IS_ERR(sec_devmap))
+	if (IS_ERR(sec_devmap)) {
 		sec_devmap = dasd_add_busid(sec_busid, DASD_FEATURE_DEFAULT);
+		if (IS_ERR(sec_devmap))
+			return PTR_ERR(sec_devmap);
+	}
 
 	/* setting copy relation is only allowed for offline secondary */
 	if (sec_devmap->device)
--- linux-qcom-6.8.0.orig/drivers/s390/block/dasd_diag.c
+++ linux-qcom-6.8.0/drivers/s390/block/dasd_diag.c
@@ -639,7 +639,6 @@
 	/* With page sized segments each segment can be translated into one idaw/tidaw */
 	blk_queue_max_segment_size(q, PAGE_SIZE);
 	blk_queue_segment_boundary(q, PAGE_SIZE - 1);
-	blk_queue_dma_alignment(q, PAGE_SIZE - 1);
 }
 
 static int dasd_diag_pe_handler(struct dasd_device *device,
--- linux-qcom-6.8.0.orig/drivers/s390/block/dasd_eckd.c
+++ linux-qcom-6.8.0/drivers/s390/block/dasd_eckd.c
@@ -2289,6 +2289,7 @@
 	cqr->status = DASD_CQR_FILLED;
 	/* Set flags to suppress output for expected errors */
 	set_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags);
+	set_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags);
 
 	return cqr;
 }
@@ -2570,7 +2571,6 @@
 	cqr->buildclk = get_tod_clock();
 	cqr->status = DASD_CQR_FILLED;
 	/* Set flags to suppress output for expected errors */
-	set_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags);
 	set_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags);
 
 	return cqr;
@@ -4146,8 +4146,6 @@
 
 	/* Set flags to suppress output for expected errors */
 	if (dasd_eckd_is_ese(basedev)) {
-		set_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags);
-		set_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags);
 		set_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags);
 	}
 
@@ -4649,9 +4647,8 @@
 
 	/* Set flags to suppress output for expected errors */
 	if (dasd_eckd_is_ese(basedev)) {
-		set_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags);
-		set_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags);
 		set_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags);
+		set_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags);
 	}
 
 	return cqr;
@@ -5820,36 +5817,32 @@
 {
 	u8 *sense = dasd_get_sense(irb);
 
-	if (scsw_is_tm(&irb->scsw)) {
-		/*
-		 * In some cases the 'File Protected' or 'Incorrect Length'
-		 * error might be expected and log messages shouldn't be written
-		 * then. Check if the according suppress bit is set.
-		 */
-		if (sense && (sense[1] & SNS1_FILE_PROTECTED) &&
-		    test_bit(DASD_CQR_SUPPRESS_FP, &req->flags))
-			return;
-		if (scsw_cstat(&irb->scsw) == 0x40 &&
-		    test_bit(DASD_CQR_SUPPRESS_IL, &req->flags))
-			return;
+	/*
+	 * In some cases certain errors might be expected and
+	 * log messages shouldn't be written then.
+	 * Check if the according suppress bit is set.
+	 */
+	if (sense && (sense[1] & SNS1_INV_TRACK_FORMAT) &&
+	    !(sense[2] & SNS2_ENV_DATA_PRESENT) &&
+	    test_bit(DASD_CQR_SUPPRESS_IT, &req->flags))
+		return;
 
-		dasd_eckd_dump_sense_tcw(device, req, irb);
-	} else {
-		/*
-		 * In some cases the 'Command Reject' or 'No Record Found'
-		 * error might be expected and log messages shouldn't be
-		 * written then. Check if the according suppress bit is set.
-		 */
-		if (sense && sense[0] & SNS0_CMD_REJECT &&
-		    test_bit(DASD_CQR_SUPPRESS_CR, &req->flags))
-			return;
+	if (sense && sense[0] & SNS0_CMD_REJECT &&
+	    test_bit(DASD_CQR_SUPPRESS_CR, &req->flags))
+		return;
 
-		if (sense && sense[1] & SNS1_NO_REC_FOUND &&
-		    test_bit(DASD_CQR_SUPPRESS_NRF, &req->flags))
-			return;
+	if (sense && sense[1] & SNS1_NO_REC_FOUND &&
+	    test_bit(DASD_CQR_SUPPRESS_NRF, &req->flags))
+		return;
 
+	if (scsw_cstat(&irb->scsw) == 0x40 &&
+	    test_bit(DASD_CQR_SUPPRESS_IL, &req->flags))
+		return;
+
+	if (scsw_is_tm(&irb->scsw))
+		dasd_eckd_dump_sense_tcw(device, req, irb);
+	else
 		dasd_eckd_dump_sense_ccw(device, req, irb);
-	}
 }
 
 static int dasd_eckd_reload_device(struct dasd_device *device)
@@ -6895,7 +6888,6 @@
 	/* With page sized segments each segment can be translated into one idaw/tidaw */
 	blk_queue_max_segment_size(q, PAGE_SIZE);
 	blk_queue_segment_boundary(q, PAGE_SIZE - 1);
-	blk_queue_dma_alignment(q, PAGE_SIZE - 1);
 }
 
 static struct ccw_driver dasd_eckd_driver = {
--- linux-qcom-6.8.0.orig/drivers/s390/block/dasd_int.h
+++ linux-qcom-6.8.0/drivers/s390/block/dasd_int.h
@@ -225,7 +225,7 @@
  * The following flags are used to suppress output of certain errors.
  */
 #define DASD_CQR_SUPPRESS_NRF	4	/* Suppress 'No Record Found' error */
-#define DASD_CQR_SUPPRESS_FP	5	/* Suppress 'File Protected' error*/
+#define DASD_CQR_SUPPRESS_IT	5	/* Suppress 'Invalid Track' error*/
 #define DASD_CQR_SUPPRESS_IL	6	/* Suppress 'Incorrect Length' error */
 #define DASD_CQR_SUPPRESS_CR	7	/* Suppress 'Command Reject' error */
 
--- linux-qcom-6.8.0.orig/drivers/s390/char/sclp.c
+++ linux-qcom-6.8.0/drivers/s390/char/sclp.c
@@ -1195,7 +1195,8 @@
 }
 
 static struct notifier_block sclp_reboot_notifier = {
-	.notifier_call = sclp_reboot_event
+	.notifier_call = sclp_reboot_event,
+	.priority      = INT_MIN,
 };
 
 static ssize_t con_pages_show(struct device_driver *dev, char *buf)
@@ -1293,6 +1294,7 @@
 fail_unregister_reboot_notifier:
 	unregister_reboot_notifier(&sclp_reboot_notifier);
 fail_init_state_uninitialized:
+	list_del(&sclp_state_change_event.list);
 	sclp_init_state = sclp_init_state_uninitialized;
 	free_page((unsigned long) sclp_read_sccb);
 	free_page((unsigned long) sclp_init_sccb);
--- linux-qcom-6.8.0.orig/drivers/s390/char/sclp_cmd.c
+++ linux-qcom-6.8.0/drivers/s390/char/sclp_cmd.c
@@ -18,6 +18,7 @@
 #include <linux/mm.h>
 #include <linux/mmzone.h>
 #include <linux/memory.h>
+#include <linux/memory_hotplug.h>
 #include <linux/module.h>
 #include <asm/ctlreg.h>
 #include <asm/chpid.h>
@@ -26,6 +27,7 @@
 #include <asm/sclp.h>
 #include <asm/numa.h>
 #include <asm/facility.h>
+#include <asm/page-states.h>
 
 #include "sclp.h"
 
@@ -340,16 +342,38 @@
 		if (contains_standby_increment(start, start + size))
 			rc = -EPERM;
 		break;
-	case MEM_ONLINE:
-	case MEM_CANCEL_OFFLINE:
-		break;
-	case MEM_GOING_ONLINE:
+	case MEM_PREPARE_ONLINE:
+		/*
+		 * Access the altmap_start_pfn and altmap_nr_pages fields
+		 * within the struct memory_notify specifically when dealing
+		 * with only MEM_PREPARE_ONLINE/MEM_FINISH_OFFLINE notifiers.
+		 *
+		 * When altmap is in use, take the specified memory range
+		 * online, which includes the altmap.
+		 */
+		if (arg->altmap_nr_pages) {
+			start = PFN_PHYS(arg->altmap_start_pfn);
+			size += PFN_PHYS(arg->altmap_nr_pages);
+		}
 		rc = sclp_mem_change_state(start, size, 1);
+		if (rc || !arg->altmap_nr_pages)
+			break;
+		/*
+		 * Set CMMA state to nodat here, since the struct page memory
+		 * at the beginning of the memory block will not go through the
+		 * buddy allocator later.
+		 */
+		__arch_set_page_nodat((void *)__va(start), arg->altmap_nr_pages);
 		break;
-	case MEM_CANCEL_ONLINE:
-		sclp_mem_change_state(start, size, 0);
-		break;
-	case MEM_OFFLINE:
+	case MEM_FINISH_OFFLINE:
+		/*
+		 * When altmap is in use, take the specified memory range
+		 * offline, which includes the altmap.
+		 */
+		if (arg->altmap_nr_pages) {
+			start = PFN_PHYS(arg->altmap_start_pfn);
+			size += PFN_PHYS(arg->altmap_nr_pages);
+		}
 		sclp_mem_change_state(start, size, 0);
 		break;
 	default:
@@ -400,7 +424,9 @@
 	if (!size)
 		goto skip_add;
 	for (addr = start; addr < start + size; addr += block_size)
-		add_memory(0, addr, block_size, MHP_NONE);
+		add_memory(0, addr, block_size,
+			   MACHINE_HAS_EDAT1 ?
+			   MHP_MEMMAP_ON_MEMORY | MHP_OFFLINE_INACCESSIBLE : MHP_NONE);
 skip_add:
 	first_rn = rn;
 	num = 1;
--- linux-qcom-6.8.0.orig/drivers/s390/char/sclp_sd.c
+++ linux-qcom-6.8.0/drivers/s390/char/sclp_sd.c
@@ -320,8 +320,14 @@
 			  &esize);
 	if (rc) {
 		/* Cancel running request if interrupted */
-		if (rc == -ERESTARTSYS)
-			sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL);
+		if (rc == -ERESTARTSYS) {
+			if (sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL)) {
+				pr_warn("Could not stop Store Data request - leaking at least %zu bytes\n",
+					(size_t)dsize * PAGE_SIZE);
+				data = NULL;
+				asce = 0;
+			}
+		}
 		vfree(data);
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/drivers/s390/char/sclp_vt220.c
+++ linux-qcom-6.8.0/drivers/s390/char/sclp_vt220.c
@@ -319,7 +319,7 @@
 	buffer = (void *) ((addr_t) sccb + sccb->header.length);
 
 	if (convertlf) {
-		/* Perform Linefeed conversion (0x0a -> 0x0a 0x0d)*/
+		/* Perform Linefeed conversion (0x0a -> 0x0d 0x0a)*/
 		for (from=0, to=0;
 		     (from < count) && (to < sclp_vt220_space_left(request));
 		     from++) {
@@ -328,8 +328,8 @@
 			/* Perform conversion */
 			if (c == 0x0a) {
 				if (to + 1 < sclp_vt220_space_left(request)) {
-					((unsigned char *) buffer)[to++] = c;
 					((unsigned char *) buffer)[to++] = 0x0d;
+					((unsigned char *) buffer)[to++] = c;
 				} else
 					break;
 
--- linux-qcom-6.8.0.orig/drivers/s390/cio/cio.c
+++ linux-qcom-6.8.0/drivers/s390/cio/cio.c
@@ -459,10 +459,14 @@
 {
 	struct schib schib;
 
-	if (stsch(sch->schid, &schib) || !css_sch_is_valid(&schib))
+	if (stsch(sch->schid, &schib))
 		return -ENODEV;
 
 	memcpy(&sch->schib, &schib, sizeof(schib));
+
+	if (!css_sch_is_valid(&schib))
+		return -EACCES;
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(cio_update_schib);
--- linux-qcom-6.8.0.orig/drivers/s390/cio/cio_inject.c
+++ linux-qcom-6.8.0/drivers/s390/cio/cio_inject.c
@@ -95,7 +95,7 @@
 		return -EINVAL;
 	}
 
-	buffer = vmemdup_user(buf, lbuf);
+	buffer = memdup_user_nul(buf, lbuf);
 	if (IS_ERR(buffer))
 		return -ENOMEM;
 
--- linux-qcom-6.8.0.orig/drivers/s390/cio/device.c
+++ linux-qcom-6.8.0/drivers/s390/cio/device.c
@@ -363,10 +363,8 @@
 
 	spin_lock_irq(cdev->ccwlock);
 	ret = ccw_device_online(cdev);
-	spin_unlock_irq(cdev->ccwlock);
-	if (ret == 0)
-		wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev));
-	else {
+	if (ret) {
+		spin_unlock_irq(cdev->ccwlock);
 		CIO_MSG_EVENT(0, "ccw_device_online returned %d, "
 			      "device 0.%x.%04x\n",
 			      ret, cdev->private->dev_id.ssid,
@@ -375,7 +373,12 @@
 		put_device(&cdev->dev);
 		return ret;
 	}
-	spin_lock_irq(cdev->ccwlock);
+	/* Wait until a final state is reached */
+	while (!dev_fsm_final_state(cdev)) {
+		spin_unlock_irq(cdev->ccwlock);
+		wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev));
+		spin_lock_irq(cdev->ccwlock);
+	}
 	/* Check if online processing was successful */
 	if ((cdev->private->state != DEV_STATE_ONLINE) &&
 	    (cdev->private->state != DEV_STATE_W4SENSE)) {
@@ -1384,14 +1387,18 @@
 	IO_SCH_VERIFY,
 	IO_SCH_DISC,
 	IO_SCH_NOP,
+	IO_SCH_ORPH_CDEV,
 };
 
 static enum io_sch_action sch_get_action(struct subchannel *sch)
 {
 	struct ccw_device *cdev;
+	int rc;
 
 	cdev = sch_get_cdev(sch);
-	if (cio_update_schib(sch)) {
+	rc = cio_update_schib(sch);
+
+	if (rc == -ENODEV) {
 		/* Not operational. */
 		if (!cdev)
 			return IO_SCH_UNREG;
@@ -1399,6 +1406,16 @@
 			return IO_SCH_UNREG;
 		return IO_SCH_ORPH_UNREG;
 	}
+
+	/* Avoid unregistering subchannels without working device. */
+	if (rc == -EACCES) {
+		if (!cdev)
+			return IO_SCH_NOP;
+		if (ccw_device_notify(cdev, CIO_GONE) != NOTIFY_OK)
+			return IO_SCH_UNREG_CDEV;
+		return IO_SCH_ORPH_CDEV;
+	}
+
 	/* Operational. */
 	if (!cdev)
 		return IO_SCH_ATTACH;
@@ -1468,6 +1485,7 @@
 		rc = 0;
 		goto out_unlock;
 	case IO_SCH_ORPH_UNREG:
+	case IO_SCH_ORPH_CDEV:
 	case IO_SCH_ORPH_ATTACH:
 		ccw_device_set_disconnected(cdev);
 		break;
@@ -1499,6 +1517,7 @@
 	/* Handle attached ccw device. */
 	switch (action) {
 	case IO_SCH_ORPH_UNREG:
+	case IO_SCH_ORPH_CDEV:
 	case IO_SCH_ORPH_ATTACH:
 		/* Move ccw device to orphanage. */
 		rc = ccw_device_move_to_orph(cdev);
--- linux-qcom-6.8.0.orig/drivers/s390/cio/idset.c
+++ linux-qcom-6.8.0/drivers/s390/cio/idset.c
@@ -16,20 +16,21 @@
 	unsigned long bitmap[];
 };
 
-static inline unsigned long bitmap_size(int num_ssid, int num_id)
+static inline unsigned long idset_bitmap_size(int num_ssid, int num_id)
 {
-	return BITS_TO_LONGS(num_ssid * num_id) * sizeof(unsigned long);
+	return bitmap_size(size_mul(num_ssid, num_id));
 }
 
 static struct idset *idset_new(int num_ssid, int num_id)
 {
 	struct idset *set;
 
-	set = vmalloc(sizeof(struct idset) + bitmap_size(num_ssid, num_id));
+	set = vmalloc(sizeof(struct idset) +
+		      idset_bitmap_size(num_ssid, num_id));
 	if (set) {
 		set->num_ssid = num_ssid;
 		set->num_id = num_id;
-		memset(set->bitmap, 0, bitmap_size(num_ssid, num_id));
+		memset(set->bitmap, 0, idset_bitmap_size(num_ssid, num_id));
 	}
 	return set;
 }
@@ -41,7 +42,8 @@
 
 void idset_fill(struct idset *set)
 {
-	memset(set->bitmap, 0xff, bitmap_size(set->num_ssid, set->num_id));
+	memset(set->bitmap, 0xff,
+	       idset_bitmap_size(set->num_ssid, set->num_id));
 }
 
 static inline void idset_add(struct idset *set, int ssid, int id)
--- linux-qcom-6.8.0.orig/drivers/s390/cio/qdio_main.c
+++ linux-qcom-6.8.0/drivers/s390/cio/qdio_main.c
@@ -722,8 +722,8 @@
 	lgr_info_log();
 }
 
-static void qdio_establish_handle_irq(struct qdio_irq *irq_ptr, int cstat,
-				      int dstat)
+static int qdio_establish_handle_irq(struct qdio_irq *irq_ptr, int cstat,
+				     int dstat, int dcc)
 {
 	DBF_DEV_EVENT(DBF_INFO, irq_ptr, "qest irq");
 
@@ -731,15 +731,18 @@
 		goto error;
 	if (dstat & ~(DEV_STAT_DEV_END | DEV_STAT_CHN_END))
 		goto error;
+	if (dcc == 1)
+		return -EAGAIN;
 	if (!(dstat & DEV_STAT_DEV_END))
 		goto error;
 	qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ESTABLISHED);
-	return;
+	return 0;
 
 error:
 	DBF_ERROR("%4x EQ:error", irq_ptr->schid.sch_no);
 	DBF_ERROR("ds: %2x cs:%2x", dstat, cstat);
 	qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ERR);
+	return -EIO;
 }
 
 /* qdio interrupt handler */
@@ -748,7 +751,7 @@
 {
 	struct qdio_irq *irq_ptr = cdev->private->qdio_data;
 	struct subchannel_id schid;
-	int cstat, dstat;
+	int cstat, dstat, rc, dcc;
 
 	if (!intparm || !irq_ptr) {
 		ccw_device_get_schid(cdev, &schid);
@@ -768,10 +771,12 @@
 	qdio_irq_check_sense(irq_ptr, irb);
 	cstat = irb->scsw.cmd.cstat;
 	dstat = irb->scsw.cmd.dstat;
+	dcc   = scsw_cmd_is_valid_cc(&irb->scsw) ? irb->scsw.cmd.cc : 0;
+	rc    = 0;
 
 	switch (irq_ptr->state) {
 	case QDIO_IRQ_STATE_INACTIVE:
-		qdio_establish_handle_irq(irq_ptr, cstat, dstat);
+		rc = qdio_establish_handle_irq(irq_ptr, cstat, dstat, dcc);
 		break;
 	case QDIO_IRQ_STATE_CLEANUP:
 		qdio_set_state(irq_ptr, QDIO_IRQ_STATE_INACTIVE);
@@ -785,12 +790,25 @@
 		if (cstat || dstat)
 			qdio_handle_activate_check(irq_ptr, intparm, cstat,
 						   dstat);
+		else if (dcc == 1)
+			rc = -EAGAIN;
 		break;
 	case QDIO_IRQ_STATE_STOPPED:
 		break;
 	default:
 		WARN_ON_ONCE(1);
 	}
+
+	if (rc == -EAGAIN) {
+		DBF_DEV_EVENT(DBF_INFO, irq_ptr, "qint retry");
+		rc = ccw_device_start(cdev, irq_ptr->ccw, intparm, 0, 0);
+		if (!rc)
+			return;
+		DBF_ERROR("%4x RETRY ERR", irq_ptr->schid.sch_no);
+		DBF_ERROR("rc:%4x", rc);
+		qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ERR);
+	}
+
 	wake_up(&cdev->private->wait_q);
 }
 
--- linux-qcom-6.8.0.orig/drivers/s390/cio/trace.h
+++ linux-qcom-6.8.0/drivers/s390/cio/trace.h
@@ -50,7 +50,7 @@
 		__entry->devno = schib->pmcw.dev;
 		__entry->schib = *schib;
 		__entry->pmcw_ena = schib->pmcw.ena;
-		__entry->pmcw_st = schib->pmcw.ena;
+		__entry->pmcw_st = schib->pmcw.st;
 		__entry->pmcw_dnv = schib->pmcw.dnv;
 		__entry->pmcw_dev = schib->pmcw.dev;
 		__entry->pmcw_lpm = schib->pmcw.lpm;
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/ap_bus.c
+++ linux-qcom-6.8.0/drivers/s390/crypto/ap_bus.c
@@ -83,14 +83,11 @@
 DEFINE_MUTEX(ap_perms_mutex);
 EXPORT_SYMBOL(ap_perms_mutex);
 
-/* # of bus scans since init */
-static atomic64_t ap_scan_bus_count;
-
 /* # of bindings complete since init */
 static atomic64_t ap_bindings_complete_count = ATOMIC64_INIT(0);
 
-/* completion for initial APQN bindings complete */
-static DECLARE_COMPLETION(ap_init_apqn_bindings_complete);
+/* completion for APQN bindings complete */
+static DECLARE_COMPLETION(ap_apqn_bindings_complete);
 
 static struct ap_config_info *ap_qci_info;
 static struct ap_config_info *ap_qci_info_old;
@@ -101,12 +98,17 @@
 debug_info_t *ap_dbf_info;
 
 /*
- * Workqueue timer for bus rescan.
+ * AP bus rescan related things.
  */
-static struct timer_list ap_config_timer;
-static int ap_config_time = AP_CONFIG_TIME;
-static void ap_scan_bus(struct work_struct *);
-static DECLARE_WORK(ap_scan_work, ap_scan_bus);
+static bool ap_scan_bus(void);
+static bool ap_scan_bus_result; /* result of last ap_scan_bus() */
+static DEFINE_MUTEX(ap_scan_bus_mutex); /* mutex ap_scan_bus() invocations */
+static struct task_struct *ap_scan_bus_task; /* thread holding the scan mutex */
+static atomic64_t ap_scan_bus_count; /* counter ap_scan_bus() invocations */
+static int ap_scan_bus_time = AP_CONFIG_TIME;
+static struct timer_list ap_scan_bus_timer;
+static void ap_scan_bus_wq_callback(struct work_struct *);
+static DECLARE_WORK(ap_scan_bus_work, ap_scan_bus_wq_callback);
 
 /*
  * Tasklet & timer for AP request polling and interrupts
@@ -753,7 +755,7 @@
 }
 
 /*
- * After initial ap bus scan do check if all existing APQNs are
+ * After ap bus scan do check if all existing APQNs are
  * bound to device drivers.
  */
 static void ap_check_bindings_complete(void)
@@ -763,11 +765,11 @@
 	if (atomic64_read(&ap_scan_bus_count) >= 1) {
 		ap_calc_bound_apqns(&apqns, &bound);
 		if (bound == apqns) {
-			if (!completion_done(&ap_init_apqn_bindings_complete)) {
-				complete_all(&ap_init_apqn_bindings_complete);
-				AP_DBF_INFO("%s complete\n", __func__);
+			if (!completion_done(&ap_apqn_bindings_complete)) {
+				complete_all(&ap_apqn_bindings_complete);
+				ap_send_bindings_complete_uevent();
+				pr_debug("%s all apqn bindings complete\n", __func__);
 			}
-			ap_send_bindings_complete_uevent();
 		}
 	}
 }
@@ -782,27 +784,29 @@
  * -ETIME is returned. On failures negative return values are
  * returned to the caller.
  */
-int ap_wait_init_apqn_bindings_complete(unsigned long timeout)
+int ap_wait_apqn_bindings_complete(unsigned long timeout)
 {
+	int rc = 0;
 	long l;
 
-	if (completion_done(&ap_init_apqn_bindings_complete))
+	if (completion_done(&ap_apqn_bindings_complete))
 		return 0;
 
 	if (timeout)
 		l = wait_for_completion_interruptible_timeout(
-			&ap_init_apqn_bindings_complete, timeout);
+			&ap_apqn_bindings_complete, timeout);
 	else
 		l = wait_for_completion_interruptible(
-			&ap_init_apqn_bindings_complete);
+			&ap_apqn_bindings_complete);
 	if (l < 0)
-		return l == -ERESTARTSYS ? -EINTR : l;
+		rc = l == -ERESTARTSYS ? -EINTR : l;
 	else if (l == 0 && timeout)
-		return -ETIME;
+		rc = -ETIME;
 
-	return 0;
+	pr_debug("%s rc=%d\n", __func__, rc);
+	return rc;
 }
-EXPORT_SYMBOL(ap_wait_init_apqn_bindings_complete);
+EXPORT_SYMBOL(ap_wait_apqn_bindings_complete);
 
 static int __ap_queue_devices_with_id_unregister(struct device *dev, void *data)
 {
@@ -826,8 +830,8 @@
 		drvres = to_ap_drv(dev->driver)->flags
 			& AP_DRIVER_FLAG_DEFAULT;
 		if (!!devres != !!drvres) {
-			AP_DBF_DBG("%s reprobing queue=%02x.%04x\n",
-				   __func__, card, queue);
+			pr_debug("%s reprobing queue=%02x.%04x\n",
+				 __func__, card, queue);
 			rc = device_reprobe(dev);
 			if (rc)
 				AP_DBF_WARN("%s reprobing queue=%02x.%04x failed\n",
@@ -925,6 +929,12 @@
 			goto out;
 	}
 
+	/*
+	 * Rearm the bindings complete completion to trigger
+	 * bindings complete when all devices are bound again
+	 */
+	reinit_completion(&ap_apqn_bindings_complete);
+
 	/* Add queue/card to list of active queues/cards */
 	spin_lock_bh(&ap_queues_lock);
 	if (is_queue_dev(dev))
@@ -939,8 +949,6 @@
 		if (is_queue_dev(dev))
 			hash_del(&to_ap_queue(dev)->hnode);
 		spin_unlock_bh(&ap_queues_lock);
-	} else {
-		ap_check_bindings_complete();
 	}
 
 out:
@@ -998,11 +1006,16 @@
 		       char *name)
 {
 	struct device_driver *drv = &ap_drv->driver;
+	int rc;
 
 	drv->bus = &ap_bus_type;
 	drv->owner = owner;
 	drv->name = name;
-	return driver_register(drv);
+	rc = driver_register(drv);
+
+	ap_check_bindings_complete();
+
+	return rc;
 }
 EXPORT_SYMBOL(ap_driver_register);
 
@@ -1012,16 +1025,61 @@
 }
 EXPORT_SYMBOL(ap_driver_unregister);
 
-void ap_bus_force_rescan(void)
+/*
+ * Enforce a synchronous AP bus rescan.
+ * Returns true if the bus scan finds a change in the AP configuration
+ * and AP devices have been added or deleted when this function returns.
+ */
+bool ap_bus_force_rescan(void)
 {
+	unsigned long scan_counter = atomic64_read(&ap_scan_bus_count);
+	bool rc = false;
+
+	pr_debug(">%s scan counter=%lu\n", __func__, scan_counter);
+
 	/* Only trigger AP bus scans after the initial scan is done */
-	if (atomic64_read(&ap_scan_bus_count) <= 0)
-		return;
+	if (scan_counter <= 0)
+		goto out;
+
+	/*
+	 * There is one unlikely but nevertheless valid scenario where the
+	 * thread holding the mutex may try to send some crypto load but
+	 * all cards are offline so a rescan is triggered which causes
+	 * a recursive call of ap_bus_force_rescan(). A simple return if
+	 * the mutex is already locked by this thread solves this.
+	 */
+	if (mutex_is_locked(&ap_scan_bus_mutex)) {
+		if (ap_scan_bus_task == current)
+			goto out;
+	}
+
+	/* Try to acquire the AP scan bus mutex */
+	if (mutex_trylock(&ap_scan_bus_mutex)) {
+		/* mutex acquired, run the AP bus scan */
+		ap_scan_bus_task = current;
+		ap_scan_bus_result = ap_scan_bus();
+		rc = ap_scan_bus_result;
+		ap_scan_bus_task = NULL;
+		mutex_unlock(&ap_scan_bus_mutex);
+		goto out;
+	}
 
-	/* processing a asynchronous bus rescan */
-	del_timer(&ap_config_timer);
-	queue_work(system_long_wq, &ap_scan_work);
-	flush_work(&ap_scan_work);
+	/*
+	 * Mutex acquire failed. So there is currently another task
+	 * already running the AP bus scan. Then let's simple wait
+	 * for the lock which means the other task has finished and
+	 * stored the result in ap_scan_bus_result.
+	 */
+	if (mutex_lock_interruptible(&ap_scan_bus_mutex)) {
+		/* some error occurred, ignore and go out */
+		goto out;
+	}
+	rc = ap_scan_bus_result;
+	mutex_unlock(&ap_scan_bus_mutex);
+
+out:
+	pr_debug("%s rc=%d\n", __func__, rc);
+	return rc;
 }
 EXPORT_SYMBOL(ap_bus_force_rescan);
 
@@ -1030,7 +1088,7 @@
  */
 void ap_bus_cfg_chg(void)
 {
-	AP_DBF_DBG("%s config change, forcing bus rescan\n", __func__);
+	pr_debug("%s config change, forcing bus rescan\n", __func__);
 
 	ap_bus_force_rescan();
 }
@@ -1090,7 +1148,7 @@
  */
 static int modify_bitmap(const char *str, unsigned long *bitmap, int bits)
 {
-	int a, i, z;
+	unsigned long a, i, z;
 	char *np, sign;
 
 	/* bits needs to be a multiple of 8 */
@@ -1250,7 +1308,7 @@
 
 static ssize_t config_time_show(const struct bus_type *bus, char *buf)
 {
-	return sysfs_emit(buf, "%d\n", ap_config_time);
+	return sysfs_emit(buf, "%d\n", ap_scan_bus_time);
 }
 
 static ssize_t config_time_store(const struct bus_type *bus,
@@ -1260,8 +1318,8 @@
 
 	if (sscanf(buf, "%d\n", &time) != 1 || time < 5 || time > 120)
 		return -EINVAL;
-	ap_config_time = time;
-	mod_timer(&ap_config_timer, jiffies + ap_config_time * HZ);
+	ap_scan_bus_time = time;
+	mod_timer(&ap_scan_bus_timer, jiffies + ap_scan_bus_time * HZ);
 	return count;
 }
 
@@ -1838,13 +1896,12 @@
 		}
 		/* if no queue device exists, create a new one */
 		if (!aq) {
-			aq = ap_queue_create(qid, ac->ap_dev.device_type);
+			aq = ap_queue_create(qid, ac);
 			if (!aq) {
 				AP_DBF_WARN("%s(%d,%d) ap_queue_create() failed\n",
 					    __func__, ac->id, dom);
 				continue;
 			}
-			aq->card = ac;
 			aq->config = !decfg;
 			aq->chkstop = chkstop;
 			aq->se_bstate = hwinfo.bs;
@@ -1888,8 +1945,8 @@
 				aq->last_err_rc = AP_RESPONSE_CHECKSTOPPED;
 			}
 			spin_unlock_bh(&aq->lock);
-			AP_DBF_DBG("%s(%d,%d) queue dev checkstop on\n",
-				   __func__, ac->id, dom);
+			pr_debug("%s(%d,%d) queue dev checkstop on\n",
+				 __func__, ac->id, dom);
 			/* 'receive' pending messages with -EAGAIN */
 			ap_flush_queue(aq);
 			goto put_dev_and_continue;
@@ -1899,8 +1956,8 @@
 			if (aq->dev_state > AP_DEV_STATE_UNINITIATED)
 				_ap_queue_init_state(aq);
 			spin_unlock_bh(&aq->lock);
-			AP_DBF_DBG("%s(%d,%d) queue dev checkstop off\n",
-				   __func__, ac->id, dom);
+			pr_debug("%s(%d,%d) queue dev checkstop off\n",
+				 __func__, ac->id, dom);
 			goto put_dev_and_continue;
 		}
 		/* config state change */
@@ -1912,8 +1969,8 @@
 				aq->last_err_rc = AP_RESPONSE_DECONFIGURED;
 			}
 			spin_unlock_bh(&aq->lock);
-			AP_DBF_DBG("%s(%d,%d) queue dev config off\n",
-				   __func__, ac->id, dom);
+			pr_debug("%s(%d,%d) queue dev config off\n",
+				 __func__, ac->id, dom);
 			ap_send_config_uevent(&aq->ap_dev, aq->config);
 			/* 'receive' pending messages with -EAGAIN */
 			ap_flush_queue(aq);
@@ -1924,8 +1981,8 @@
 			if (aq->dev_state > AP_DEV_STATE_UNINITIATED)
 				_ap_queue_init_state(aq);
 			spin_unlock_bh(&aq->lock);
-			AP_DBF_DBG("%s(%d,%d) queue dev config on\n",
-				   __func__, ac->id, dom);
+			pr_debug("%s(%d,%d) queue dev config on\n",
+				 __func__, ac->id, dom);
 			ap_send_config_uevent(&aq->ap_dev, aq->config);
 			goto put_dev_and_continue;
 		}
@@ -1997,8 +2054,8 @@
 			ap_scan_rm_card_dev_and_queue_devs(ac);
 			put_device(dev);
 		} else {
-			AP_DBF_DBG("%s(%d) no type info (no APQN found), ignored\n",
-				   __func__, ap);
+			pr_debug("%s(%d) no type info (no APQN found), ignored\n",
+				 __func__, ap);
 		}
 		return;
 	}
@@ -2010,8 +2067,8 @@
 			ap_scan_rm_card_dev_and_queue_devs(ac);
 			put_device(dev);
 		} else {
-			AP_DBF_DBG("%s(%d) no valid type (0) info, ignored\n",
-				   __func__, ap);
+			pr_debug("%s(%d) no valid type (0) info, ignored\n",
+				 __func__, ap);
 		}
 		return;
 	}
@@ -2135,23 +2192,80 @@
 		      sizeof(struct ap_config_info)) != 0;
 }
 
+/*
+ * ap_config_has_new_aps - Check current against old qci info if
+ * new adapters have appeared. Returns true if at least one new
+ * adapter in the apm mask is showing up. Existing adapters or
+ * receding adapters are not counted.
+ */
+static bool ap_config_has_new_aps(void)
+{
+
+	unsigned long m[BITS_TO_LONGS(AP_DEVICES)];
+
+	if (!ap_qci_info)
+		return false;
+
+	bitmap_andnot(m, (unsigned long *)ap_qci_info->apm,
+		      (unsigned long *)ap_qci_info_old->apm, AP_DEVICES);
+	if (!bitmap_empty(m, AP_DEVICES))
+		return true;
+
+	return false;
+}
+
+/*
+ * ap_config_has_new_doms - Check current against old qci info if
+ * new (usage) domains have appeared. Returns true if at least one
+ * new domain in the aqm mask is showing up. Existing domains or
+ * receding domains are not counted.
+ */
+static bool ap_config_has_new_doms(void)
+{
+	unsigned long m[BITS_TO_LONGS(AP_DOMAINS)];
+
+	if (!ap_qci_info)
+		return false;
+
+	bitmap_andnot(m, (unsigned long *)ap_qci_info->aqm,
+		      (unsigned long *)ap_qci_info_old->aqm, AP_DOMAINS);
+	if (!bitmap_empty(m, AP_DOMAINS))
+		return true;
+
+	return false;
+}
+
 /**
  * ap_scan_bus(): Scan the AP bus for new devices
- * Runs periodically, workqueue timer (ap_config_time)
- * @unused: Unused pointer.
+ * Always run under mutex ap_scan_bus_mutex protection
+ * which needs to get locked/unlocked by the caller!
+ * Returns true if any config change has been detected
+ * during the scan, otherwise false.
  */
-static void ap_scan_bus(struct work_struct *unused)
+static bool ap_scan_bus(void)
 {
-	int ap, config_changed = 0;
+	bool config_changed;
+	int ap;
 
-	/* config change notify */
+	pr_debug(">%s\n", __func__);
+
+	/* (re-)fetch configuration via QCI */
 	config_changed = ap_get_configuration();
-	if (config_changed)
+	if (config_changed) {
+		if (ap_config_has_new_aps() || ap_config_has_new_doms()) {
+			/*
+			 * Appearance of new adapters and/or domains need to
+			 * build new ap devices which need to get bound to an
+			 * device driver. Thus reset the APQN bindings complete
+			 * completion.
+			 */
+			reinit_completion(&ap_apqn_bindings_complete);
+		}
+		/* post a config change notify */
 		notify_config_changed();
+	}
 	ap_select_domain();
 
-	AP_DBF_DBG("%s running\n", __func__);
-
 	/* loop over all possible adapters */
 	for (ap = 0; ap <= ap_max_adapter_id; ap++)
 		ap_scan_adapter(ap);
@@ -2174,23 +2288,58 @@
 	}
 
 	if (atomic64_inc_return(&ap_scan_bus_count) == 1) {
-		AP_DBF_DBG("%s init scan complete\n", __func__);
+		pr_debug("%s init scan complete\n", __func__);
 		ap_send_init_scan_done_uevent();
-		ap_check_bindings_complete();
 	}
 
-	mod_timer(&ap_config_timer, jiffies + ap_config_time * HZ);
+	ap_check_bindings_complete();
+
+	mod_timer(&ap_scan_bus_timer, jiffies + ap_scan_bus_time * HZ);
+
+	pr_debug("<%s config_changed=%d\n", __func__, config_changed);
+
+	return config_changed;
+}
+
+/*
+ * Callback for the ap_scan_bus_timer
+ * Runs periodically, workqueue timer (ap_scan_bus_time)
+ */
+static void ap_scan_bus_timer_callback(struct timer_list *unused)
+{
+	/*
+	 * schedule work into the system long wq which when
+	 * the work is finally executed, calls the AP bus scan.
+	 */
+	queue_work(system_long_wq, &ap_scan_bus_work);
 }
 
-static void ap_config_timeout(struct timer_list *unused)
+/*
+ * Callback for the ap_scan_bus_work
+ */
+static void ap_scan_bus_wq_callback(struct work_struct *unused)
 {
-	queue_work(system_long_wq, &ap_scan_work);
+	/*
+	 * Try to invoke an ap_scan_bus(). If the mutex acquisition
+	 * fails there is currently another task already running the
+	 * AP scan bus and there is no need to wait and re-trigger the
+	 * scan again. Please note at the end of the scan bus function
+	 * the AP scan bus timer is re-armed which triggers then the
+	 * ap_scan_bus_timer_callback which enqueues a work into the
+	 * system_long_wq which invokes this function here again.
+	 */
+	if (mutex_trylock(&ap_scan_bus_mutex)) {
+		ap_scan_bus_task = current;
+		ap_scan_bus_result = ap_scan_bus();
+		ap_scan_bus_task = NULL;
+		mutex_unlock(&ap_scan_bus_mutex);
+	}
 }
 
 static int __init ap_debug_init(void)
 {
 	ap_dbf_info = debug_register("ap", 2, 1,
-				     DBF_MAX_SPRINTF_ARGS * sizeof(long));
+				     AP_DBF_MAX_SPRINTF_ARGS * sizeof(long));
 	debug_register_view(ap_dbf_info, &debug_sprintf_view);
 	debug_set_level(ap_dbf_info, DBF_ERR);
 
@@ -2274,7 +2423,7 @@
 	ap_root_device->bus = &ap_bus_type;
 
 	/* Setup the AP bus rescan timer. */
-	timer_setup(&ap_config_timer, ap_config_timeout, 0);
+	timer_setup(&ap_scan_bus_timer, ap_scan_bus_timer_callback, 0);
 
 	/*
 	 * Setup the high resolution poll timer.
@@ -2292,7 +2441,7 @@
 			goto out_work;
 	}
 
-	queue_work(system_long_wq, &ap_scan_work);
+	queue_work(system_long_wq, &ap_scan_bus_work);
 
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/ap_bus.h
+++ linux-qcom-6.8.0/drivers/s390/crypto/ap_bus.h
@@ -266,13 +266,13 @@
 bool ap_is_se_guest(void);
 void ap_wait(enum ap_sm_wait wait);
 void ap_request_timeout(struct timer_list *t);
-void ap_bus_force_rescan(void);
+bool ap_bus_force_rescan(void);
 
 int ap_test_config_usage_domain(unsigned int domain);
 int ap_test_config_ctrl_domain(unsigned int domain);
 
 void ap_queue_init_reply(struct ap_queue *aq, struct ap_message *ap_msg);
-struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type);
+struct ap_queue *ap_queue_create(ap_qid_t qid, struct ap_card *ac);
 void ap_queue_prepare_remove(struct ap_queue *aq);
 void ap_queue_remove(struct ap_queue *aq);
 void ap_queue_init_state(struct ap_queue *aq);
@@ -352,8 +352,12 @@
  * the return value is 0. If the timeout (in jiffies) hits instead
  * -ETIME is returned. On failures negative return values are
  * returned to the caller.
+ * It may be that the AP bus scan finds new devices. Then the
+ * condition that all APQNs are bound to their device drivers
+ * is reset to false and this call again blocks until either all
+ * APQNs are bound to a device driver or the timeout hits again.
  */
-int ap_wait_init_apqn_bindings_complete(unsigned long timeout);
+int ap_wait_apqn_bindings_complete(unsigned long timeout);
 
 void ap_send_config_uevent(struct ap_device *ap_dev, bool cfg);
 void ap_send_online_uevent(struct ap_device *ap_dev, int online);
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/ap_debug.h
+++ linux-qcom-6.8.0/drivers/s390/crypto/ap_debug.h
@@ -16,7 +16,7 @@
 #define RC2ERR(rc) ((rc) ? DBF_ERR : DBF_INFO)
 #define RC2WARN(rc) ((rc) ? DBF_WARN : DBF_INFO)
 
-#define DBF_MAX_SPRINTF_ARGS 6
+#define AP_DBF_MAX_SPRINTF_ARGS 6
 
 #define AP_DBF(...)					\
 	debug_sprintf_event(ap_dbf_info, ##__VA_ARGS__)
@@ -26,8 +26,6 @@
 	debug_sprintf_event(ap_dbf_info, DBF_WARN, ##__VA_ARGS__)
 #define AP_DBF_INFO(...)					\
 	debug_sprintf_event(ap_dbf_info, DBF_INFO, ##__VA_ARGS__)
-#define AP_DBF_DBG(...)					\
-	debug_sprintf_event(ap_dbf_info, DBF_DEBUG, ##__VA_ARGS__)
 
 extern debug_info_t *ap_dbf_info;
 
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/ap_queue.c
+++ linux-qcom-6.8.0/drivers/s390/crypto/ap_queue.c
@@ -22,6 +22,11 @@
  * some AP queue helper functions
  */
 
+static inline bool ap_q_supported_in_se(struct ap_queue *aq)
+{
+	return aq->card->hwinfo.ep11 || aq->card->hwinfo.accel;
+}
+
 static inline bool ap_q_supports_bind(struct ap_queue *aq)
 {
 	return aq->card->hwinfo.ep11 || aq->card->hwinfo.accel;
@@ -136,6 +141,8 @@
 
 	switch (status.response_code) {
 	case AP_RESPONSE_NORMAL:
+		print_hex_dump_debug("aprpl: ", DUMP_PREFIX_ADDRESS, 16, 1,
+				     aq->reply->msg, aq->reply->len, false);
 		aq->queue_count = max_t(int, 0, aq->queue_count - 1);
 		if (!status.queue_empty && !aq->queue_count)
 			aq->queue_count++;
@@ -169,6 +176,9 @@
 		aq->queue_count = 0;
 		list_splice_init(&aq->pendingq, &aq->requestq);
 		aq->requestq_count += aq->pendingq_count;
+		pr_debug("%s queue 0x%02x.%04x rescheduled %d reqs (new req %d)\n",
+			 __func__, AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid),
+			 aq->pendingq_count, aq->requestq_count);
 		aq->pendingq_count = 0;
 		break;
 	default:
@@ -243,6 +253,8 @@
 
 	/* Start the next request on the queue. */
 	ap_msg = list_entry(aq->requestq.next, struct ap_message, list);
+	print_hex_dump_debug("apreq: ", DUMP_PREFIX_ADDRESS, 16, 1,
+			     ap_msg->msg, ap_msg->len, false);
 	status = __ap_send(qid, ap_msg->psmid,
 			   ap_msg->msg, ap_msg->len,
 			   ap_msg->flags & AP_MSG_FLAG_SPECIAL);
@@ -446,9 +458,9 @@
 	case AP_BS_Q_USABLE:
 		/* association is through */
 		aq->sm_state = AP_SM_STATE_IDLE;
-		AP_DBF_DBG("%s queue 0x%02x.%04x associated with %u\n",
-			   __func__, AP_QID_CARD(aq->qid),
-			   AP_QID_QUEUE(aq->qid), aq->assoc_idx);
+		pr_debug("%s queue 0x%02x.%04x associated with %u\n",
+			 __func__, AP_QID_CARD(aq->qid),
+			 AP_QID_QUEUE(aq->qid), aq->assoc_idx);
 		return AP_SM_WAIT_NONE;
 	case AP_BS_Q_USABLE_NO_SECURE_KEY:
 		/* association still pending */
@@ -690,9 +702,9 @@
 
 	status = ap_test_queue(aq->qid, 1, &hwinfo);
 	if (status.response_code > AP_RESPONSE_BUSY) {
-		AP_DBF_DBG("%s RC 0x%02x on tapq(0x%02x.%04x)\n",
-			   __func__, status.response_code,
-			   AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
+		pr_debug("%s RC 0x%02x on tapq(0x%02x.%04x)\n",
+			 __func__, status.response_code,
+			 AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
 		return -EIO;
 	}
 
@@ -846,9 +858,9 @@
 
 	status = ap_test_queue(aq->qid, 1, &hwinfo);
 	if (status.response_code > AP_RESPONSE_BUSY) {
-		AP_DBF_DBG("%s RC 0x%02x on tapq(0x%02x.%04x)\n",
-			   __func__, status.response_code,
-			   AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
+		pr_debug("%s RC 0x%02x on tapq(0x%02x.%04x)\n",
+			 __func__, status.response_code,
+			 AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
 		return -EIO;
 	}
 
@@ -974,9 +986,9 @@
 
 	status = ap_test_queue(aq->qid, 1, &hwinfo);
 	if (status.response_code > AP_RESPONSE_BUSY) {
-		AP_DBF_DBG("%s RC 0x%02x on tapq(0x%02x.%04x)\n",
-			   __func__, status.response_code,
-			   AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
+		pr_debug("%s RC 0x%02x on tapq(0x%02x.%04x)\n",
+			 __func__, status.response_code,
+			 AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
 		return -EIO;
 	}
 
@@ -1097,18 +1109,19 @@
 	kfree(aq);
 }
 
-struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
+struct ap_queue *ap_queue_create(ap_qid_t qid, struct ap_card *ac)
 {
 	struct ap_queue *aq;
 
 	aq = kzalloc(sizeof(*aq), GFP_KERNEL);
 	if (!aq)
 		return NULL;
+	aq->card = ac;
 	aq->ap_dev.device.release = ap_queue_device_release;
 	aq->ap_dev.device.type = &ap_queue_type;
-	aq->ap_dev.device_type = device_type;
-	// add optional SE secure binding attributes group
-	if (ap_sb_available() && is_prot_virt_guest())
+	aq->ap_dev.device_type = ac->ap_dev.device_type;
+	/* in SE environment add bind/associate attributes group */
+	if (ap_is_se_guest() && ap_q_supported_in_se(aq))
 		aq->ap_dev.device.groups = ap_queue_dev_sb_attr_groups;
 	aq->qid = qid;
 	spin_lock_init(&aq->lock);
@@ -1189,10 +1202,16 @@
 	}
 
 	/* SE guest's queues additionally need to be bound */
-	if (ap_q_needs_bind(aq) &&
-	    !(aq->se_bstate == AP_BS_Q_USABLE ||
-	      aq->se_bstate == AP_BS_Q_USABLE_NO_SECURE_KEY))
-		rc = false;
+	if (ap_is_se_guest()) {
+		if (!ap_q_supported_in_se(aq)) {
+			rc = false;
+			goto unlock_and_out;
+		}
+		if (ap_q_needs_bind(aq) &&
+		    !(aq->se_bstate == AP_BS_Q_USABLE ||
+		      aq->se_bstate == AP_BS_Q_USABLE_NO_SECURE_KEY))
+			rc = false;
+	}
 
 unlock_and_out:
 	spin_unlock_bh(&aq->lock);
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/pkey_api.c
+++ linux-qcom-6.8.0/drivers/s390/crypto/pkey_api.c
@@ -42,24 +42,23 @@
  * debug feature data and functions
  */
 
-static debug_info_t *debug_info;
+static debug_info_t *pkey_dbf_info;
 
-#define DEBUG_DBG(...)	debug_sprintf_event(debug_info, 6, ##__VA_ARGS__)
-#define DEBUG_INFO(...) debug_sprintf_event(debug_info, 5, ##__VA_ARGS__)
-#define DEBUG_WARN(...) debug_sprintf_event(debug_info, 4, ##__VA_ARGS__)
-#define DEBUG_ERR(...)	debug_sprintf_event(debug_info, 3, ##__VA_ARGS__)
+#define PKEY_DBF_INFO(...) debug_sprintf_event(pkey_dbf_info, 5, ##__VA_ARGS__)
+#define PKEY_DBF_WARN(...) debug_sprintf_event(pkey_dbf_info, 4, ##__VA_ARGS__)
+#define PKEY_DBF_ERR(...)  debug_sprintf_event(pkey_dbf_info, 3, ##__VA_ARGS__)
 
 static void __init pkey_debug_init(void)
 {
 	/* 5 arguments per dbf entry (including the format string ptr) */
-	debug_info = debug_register("pkey", 1, 1, 5 * sizeof(long));
-	debug_register_view(debug_info, &debug_sprintf_view);
-	debug_set_level(debug_info, 3);
+	pkey_dbf_info = debug_register("pkey", 1, 1, 5 * sizeof(long));
+	debug_register_view(pkey_dbf_info, &debug_sprintf_view);
+	debug_set_level(pkey_dbf_info, 3);
 }
 
 static void __exit pkey_debug_exit(void)
 {
-	debug_unregister(debug_info);
+	debug_unregister(pkey_dbf_info);
 }
 
 /* inside view of a protected key token (only type 0x00 version 0x01) */
@@ -163,14 +162,14 @@
 		fc = CPACF_PCKMO_ENC_ECC_ED448_KEY;
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported keytype %u\n",
-			  __func__, keytype);
+		PKEY_DBF_ERR("%s unknown/unsupported keytype %u\n",
+			     __func__, keytype);
 		return -EINVAL;
 	}
 
 	if (*protkeylen < keysize + AES_WK_VP_SIZE) {
-		DEBUG_ERR("%s prot key buffer size too small: %u < %d\n",
-			  __func__, *protkeylen, keysize + AES_WK_VP_SIZE);
+		PKEY_DBF_ERR("%s prot key buffer size too small: %u < %d\n",
+			     __func__, *protkeylen, keysize + AES_WK_VP_SIZE);
 		return -EINVAL;
 	}
 
@@ -182,7 +181,7 @@
 	}
 	/* check for the pckmo subfunction we need now */
 	if (!cpacf_test_func(&pckmo_functions, fc)) {
-		DEBUG_ERR("%s pckmo functions not available\n", __func__);
+		PKEY_DBF_ERR("%s pckmo functions not available\n", __func__);
 		return -ENODEV;
 	}
 
@@ -244,7 +243,7 @@
 	}
 
 	if (rc)
-		DEBUG_DBG("%s failed rc=%d\n", __func__, rc);
+		pr_debug("%s failed rc=%d\n", __func__, rc);
 
 	return rc;
 }
@@ -283,7 +282,7 @@
 out:
 	kfree(apqns);
 	if (rc)
-		DEBUG_DBG("%s failed rc=%d\n", __func__, rc);
+		pr_debug("%s failed rc=%d\n", __func__, rc);
 	return rc;
 }
 
@@ -294,33 +293,36 @@
 			     u8 *protkey, u32 *protkeylen, u32 *protkeytype)
 {
 	u32 nr_apqns, *apqns = NULL;
+	int i, j, rc = -ENODEV;
 	u16 card, dom;
-	int i, rc;
 
 	zcrypt_wait_api_operational();
 
-	/* build a list of apqns suitable for this key */
-	rc = ep11_findcard2(&apqns, &nr_apqns, 0xFFFF, 0xFFFF,
-			    ZCRYPT_CEX7,
-			    ap_is_se_guest() ? EP11_API_V6 : EP11_API_V4,
-			    ep11_kb_wkvp(key, keylen));
-	if (rc)
-		goto out;
+	/* try two times in case of failure */
+	for (i = 0; i < 2 && rc; i++) {
 
-	/* go through the list of apqns and try to derive an pkey */
-	for (rc = -ENODEV, i = 0; i < nr_apqns; i++) {
-		card = apqns[i] >> 16;
-		dom = apqns[i] & 0xFFFF;
-		rc = ep11_kblob2protkey(card, dom, key, keylen,
-					protkey, protkeylen, protkeytype);
-		if (rc == 0)
-			break;
+		/* build a list of apqns suitable for this key */
+		rc = ep11_findcard2(&apqns, &nr_apqns, 0xFFFF, 0xFFFF,
+				    ZCRYPT_CEX7,
+				    ap_is_se_guest() ? EP11_API_V6 : EP11_API_V4,
+				    ep11_kb_wkvp(key, keylen));
+		if (rc)
+			continue; /* retry findcard on failure */
+
+		/* go through the list of apqns and try to derive an pkey */
+		for (rc = -ENODEV, j = 0; j < nr_apqns && rc; j++) {
+			card = apqns[j] >> 16;
+			dom = apqns[j] & 0xFFFF;
+			rc = ep11_kblob2protkey(card, dom, key, keylen,
+						protkey, protkeylen, protkeytype);
+		}
+
+		kfree(apqns);
 	}
 
-out:
-	kfree(apqns);
 	if (rc)
-		DEBUG_DBG("%s failed rc=%d\n", __func__, rc);
+		pr_debug("%s failed rc=%d\n", __func__, rc);
+
 	return rc;
 }
 
@@ -336,7 +338,7 @@
 	int rc;
 
 	/* check the secure key for valid AES secure key */
-	rc = cca_check_secaeskeytoken(debug_info, 3, (u8 *)seckey, 0);
+	rc = cca_check_secaeskeytoken(pkey_dbf_info, 3, (u8 *)seckey, 0);
 	if (rc)
 		goto out;
 	if (pattributes)
@@ -351,7 +353,7 @@
 
 	if (rc > 0) {
 		/* key mkvp matches to old master key mkvp */
-		DEBUG_DBG("%s secure key has old mkvp\n", __func__);
+		pr_debug("%s secure key has old mkvp\n", __func__);
 		if (pattributes)
 			*pattributes |= PKEY_VERIFY_ATTR_OLD_MKVP;
 		rc = 0;
@@ -363,7 +365,7 @@
 		*pdomain = domain;
 
 out:
-	DEBUG_DBG("%s rc=%d\n", __func__, rc);
+	pr_debug("%s rc=%d\n", __func__, rc);
 	return rc;
 }
 
@@ -379,8 +381,8 @@
 
 	keysize = pkey_keytype_aes_to_size(keytype);
 	if (!keysize) {
-		DEBUG_ERR("%s unknown/unsupported keytype %d\n", __func__,
-			  keytype);
+		PKEY_DBF_ERR("%s unknown/unsupported keytype %d\n", __func__,
+			     keytype);
 		return -EINVAL;
 	}
 
@@ -428,13 +430,13 @@
 		fc = CPACF_KMC_PAES_256;
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported keytype %u\n", __func__,
-			  protkeytype);
+		PKEY_DBF_ERR("%s unknown/unsupported keytype %u\n", __func__,
+			     protkeytype);
 		return -EINVAL;
 	}
 	if (protkeylen != pkeylen) {
-		DEBUG_ERR("%s invalid protected key size %u for keytype %u\n",
-			  __func__, protkeylen, protkeytype);
+		PKEY_DBF_ERR("%s invalid protected key size %u for keytype %u\n",
+			     __func__, protkeylen, protkeytype);
 		return -EINVAL;
 	}
 
@@ -446,7 +448,7 @@
 	k = cpacf_kmc(fc | CPACF_ENCRYPT, &param, null_msg, dest_buf,
 		      sizeof(null_msg));
 	if (k != sizeof(null_msg)) {
-		DEBUG_ERR("%s protected key is not valid\n", __func__);
+		PKEY_DBF_ERR("%s protected key is not valid\n", __func__);
 		return -EKEYREJECTED;
 	}
 
@@ -464,13 +466,13 @@
 
 	keysize = pkey_keytype_aes_to_size(t->keytype);
 	if (!keysize) {
-		DEBUG_ERR("%s unknown/unsupported keytype %u\n",
-			  __func__, t->keytype);
+		PKEY_DBF_ERR("%s unknown/unsupported keytype %u\n",
+			     __func__, t->keytype);
 		return -EINVAL;
 	}
 	if (t->len != keysize) {
-		DEBUG_ERR("%s non clear key aes token: invalid key len %u\n",
-			  __func__, t->len);
+		PKEY_DBF_ERR("%s non clear key aes token: invalid key len %u\n",
+			     __func__, t->len);
 		return -EINVAL;
 	}
 
@@ -505,7 +507,7 @@
 		goto out;
 
 failure:
-	DEBUG_ERR("%s unable to build protected key from clear", __func__);
+	PKEY_DBF_ERR("%s unable to build protected key from clear", __func__);
 
 out:
 	kfree(tmpbuf);
@@ -536,14 +538,14 @@
 		keylen = 64;
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported keytype %u\n",
-			  __func__, t->keytype);
+		PKEY_DBF_ERR("%s unknown/unsupported keytype %u\n",
+			     __func__, t->keytype);
 		return -EINVAL;
 	}
 
 	if (t->len != keylen) {
-		DEBUG_ERR("%s non clear key ecc token: invalid key len %u\n",
-			  __func__, t->len);
+		PKEY_DBF_ERR("%s non clear key ecc token: invalid key len %u\n",
+			     __func__, t->len);
 		return -EINVAL;
 	}
 
@@ -551,8 +553,8 @@
 	rc = pkey_clr2protkey(t->keytype, t->clearkey,
 			      protkey, protkeylen, protkeytype);
 	if (rc) {
-		DEBUG_ERR("%s unable to build protected key from clear",
-			  __func__);
+		PKEY_DBF_ERR("%s unable to build protected key from clear",
+			     __func__);
 	}
 
 	return rc;
@@ -604,15 +606,15 @@
 					       protkeylen, protkeytype);
 			break;
 		default:
-			DEBUG_ERR("%s unknown/unsupported non cca clear key type %u\n",
-				  __func__, t->keytype);
+			PKEY_DBF_ERR("%s unknown/unsupported non cca clear key type %u\n",
+				     __func__, t->keytype);
 			return -EINVAL;
 		}
 		break;
 	}
 	case TOKVER_EP11_AES: {
 		/* check ep11 key for exportable as protected key */
-		rc = ep11_check_aes_key(debug_info, 3, key, keylen, 1);
+		rc = ep11_check_aes_key(pkey_dbf_info, 3, key, keylen, 1);
 		if (rc)
 			goto out;
 		rc = pkey_ep11key2pkey(key, keylen,
@@ -621,15 +623,16 @@
 	}
 	case TOKVER_EP11_AES_WITH_HEADER:
 		/* check ep11 key with header for exportable as protected key */
-		rc = ep11_check_aes_key_with_hdr(debug_info, 3, key, keylen, 1);
+		rc = ep11_check_aes_key_with_hdr(pkey_dbf_info,
+						 3, key, keylen, 1);
 		if (rc)
 			goto out;
 		rc = pkey_ep11key2pkey(key, keylen,
 				       protkey, protkeylen, protkeytype);
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported non-CCA token version %d\n",
-			  __func__, hdr->version);
+		PKEY_DBF_ERR("%s unknown/unsupported non-CCA token version %d\n",
+			     __func__, hdr->version);
 	}
 
 out:
@@ -654,8 +657,8 @@
 			return -EINVAL;
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported CCA internal token version %d\n",
-			  __func__, hdr->version);
+		PKEY_DBF_ERR("%s unknown/unsupported CCA internal token version %d\n",
+			     __func__, hdr->version);
 		return -EINVAL;
 	}
 
@@ -672,7 +675,7 @@
 	int rc;
 
 	if (keylen < sizeof(struct keytoken_header)) {
-		DEBUG_ERR("%s invalid keylen %d\n", __func__, keylen);
+		PKEY_DBF_ERR("%s invalid keylen %d\n", __func__, keylen);
 		return -EINVAL;
 	}
 
@@ -686,12 +689,12 @@
 					 protkey, protkeylen, protkeytype);
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported blob type %d\n",
-			  __func__, hdr->type);
+		PKEY_DBF_ERR("%s unknown/unsupported blob type %d\n",
+			     __func__, hdr->type);
 		return -EINVAL;
 	}
 
-	DEBUG_DBG("%s rc=%d\n", __func__, rc);
+	pr_debug("%s rc=%d\n", __func__, rc);
 	return rc;
 }
 EXPORT_SYMBOL(pkey_keyblob2pkey);
@@ -839,7 +842,7 @@
 	    hdr->version == TOKVER_CCA_AES) {
 		struct secaeskeytoken *t = (struct secaeskeytoken *)key;
 
-		rc = cca_check_secaeskeytoken(debug_info, 3, key, 0);
+		rc = cca_check_secaeskeytoken(pkey_dbf_info, 3, key, 0);
 		if (rc)
 			goto out;
 		if (ktype)
@@ -869,7 +872,7 @@
 		   hdr->version == TOKVER_CCA_VLSC) {
 		struct cipherkeytoken *t = (struct cipherkeytoken *)key;
 
-		rc = cca_check_secaescipherkey(debug_info, 3, key, 0, 1);
+		rc = cca_check_secaescipherkey(pkey_dbf_info, 3, key, 0, 1);
 		if (rc)
 			goto out;
 		if (ktype)
@@ -907,7 +910,7 @@
 		struct ep11keyblob *kb = (struct ep11keyblob *)key;
 		int api;
 
-		rc = ep11_check_aes_key(debug_info, 3, key, keylen, 1);
+		rc = ep11_check_aes_key(pkey_dbf_info, 3, key, keylen, 1);
 		if (rc)
 			goto out;
 		if (ktype)
@@ -933,8 +936,8 @@
 		struct ep11kblob_header *kh = (struct ep11kblob_header *)key;
 		int api;
 
-		rc = ep11_check_aes_key_with_hdr(debug_info, 3,
-						 key, keylen, 1);
+		rc = ep11_check_aes_key_with_hdr(pkey_dbf_info,
+						 3, key, keylen, 1);
 		if (rc)
 			goto out;
 		if (ktype)
@@ -981,25 +984,27 @@
 		if (hdr->version == TOKVER_CCA_AES) {
 			if (keylen != sizeof(struct secaeskeytoken))
 				return -EINVAL;
-			if (cca_check_secaeskeytoken(debug_info, 3, key, 0))
+			if (cca_check_secaeskeytoken(pkey_dbf_info, 3, key, 0))
 				return -EINVAL;
 		} else if (hdr->version == TOKVER_CCA_VLSC) {
 			if (keylen < hdr->len || keylen > MAXCCAVLSCTOKENSIZE)
 				return -EINVAL;
-			if (cca_check_secaescipherkey(debug_info, 3, key, 0, 1))
+			if (cca_check_secaescipherkey(pkey_dbf_info,
+						      3, key, 0, 1))
 				return -EINVAL;
 		} else {
-			DEBUG_ERR("%s unknown CCA internal token version %d\n",
-				  __func__, hdr->version);
+			PKEY_DBF_ERR("%s unknown CCA internal token version %d\n",
+				     __func__, hdr->version);
 			return -EINVAL;
 		}
 	} else if (hdr->type == TOKTYPE_NON_CCA) {
 		if (hdr->version == TOKVER_EP11_AES) {
-			if (ep11_check_aes_key(debug_info, 3, key, keylen, 1))
+			if (ep11_check_aes_key(pkey_dbf_info,
+					       3, key, keylen, 1))
 				return -EINVAL;
 		} else if (hdr->version == TOKVER_EP11_AES_WITH_HEADER) {
-			if (ep11_check_aes_key_with_hdr(debug_info, 3,
-							key, keylen, 1))
+			if (ep11_check_aes_key_with_hdr(pkey_dbf_info,
+							3, key, keylen, 1))
 				return -EINVAL;
 		} else {
 			return pkey_nonccatok2pkey(key, keylen,
@@ -1007,8 +1012,8 @@
 						   protkeytype);
 		}
 	} else {
-		DEBUG_ERR("%s unknown/unsupported blob type %d\n",
-			  __func__, hdr->type);
+		PKEY_DBF_ERR("%s unknown/unsupported blob type %d\n",
+			     __func__, hdr->type);
 		return -EINVAL;
 	}
 
@@ -1234,50 +1239,53 @@
 	    hdr->version == TOKVER_EP11_AES_WITH_HEADER &&
 	    is_ep11_keyblob(key + sizeof(struct ep11kblob_header))) {
 		/* EP11 AES key blob with header */
-		if (ep11_check_aes_key_with_hdr(debug_info, 3, key, keylen, 1))
+		if (ep11_check_aes_key_with_hdr(pkey_dbf_info,
+						3, key, keylen, 1))
 			return -EINVAL;
 	} else if (hdr->type == TOKTYPE_NON_CCA &&
 		   hdr->version == TOKVER_EP11_ECC_WITH_HEADER &&
 		   is_ep11_keyblob(key + sizeof(struct ep11kblob_header))) {
 		/* EP11 ECC key blob with header */
-		if (ep11_check_ecc_key_with_hdr(debug_info, 3, key, keylen, 1))
+		if (ep11_check_ecc_key_with_hdr(pkey_dbf_info,
+						3, key, keylen, 1))
 			return -EINVAL;
 	} else if (hdr->type == TOKTYPE_NON_CCA &&
 		   hdr->version == TOKVER_EP11_AES &&
 		   is_ep11_keyblob(key)) {
 		/* EP11 AES key blob with header in session field */
-		if (ep11_check_aes_key(debug_info, 3, key, keylen, 1))
+		if (ep11_check_aes_key(pkey_dbf_info, 3, key, keylen, 1))
 			return -EINVAL;
 	} else	if (hdr->type == TOKTYPE_CCA_INTERNAL) {
 		if (hdr->version == TOKVER_CCA_AES) {
 			/* CCA AES data key */
 			if (keylen != sizeof(struct secaeskeytoken))
 				return -EINVAL;
-			if (cca_check_secaeskeytoken(debug_info, 3, key, 0))
+			if (cca_check_secaeskeytoken(pkey_dbf_info, 3, key, 0))
 				return -EINVAL;
 		} else if (hdr->version == TOKVER_CCA_VLSC) {
 			/* CCA AES cipher key */
 			if (keylen < hdr->len || keylen > MAXCCAVLSCTOKENSIZE)
 				return -EINVAL;
-			if (cca_check_secaescipherkey(debug_info, 3, key, 0, 1))
+			if (cca_check_secaescipherkey(pkey_dbf_info,
+						      3, key, 0, 1))
 				return -EINVAL;
 		} else {
-			DEBUG_ERR("%s unknown CCA internal token version %d\n",
-				  __func__, hdr->version);
+			PKEY_DBF_ERR("%s unknown CCA internal token version %d\n",
+				     __func__, hdr->version);
 			return -EINVAL;
 		}
 	} else if (hdr->type == TOKTYPE_CCA_INTERNAL_PKA) {
 		/* CCA ECC (private) key */
 		if (keylen < sizeof(struct eccprivkeytoken))
 			return -EINVAL;
-		if (cca_check_sececckeytoken(debug_info, 3, key, keylen, 1))
+		if (cca_check_sececckeytoken(pkey_dbf_info, 3, key, keylen, 1))
 			return -EINVAL;
 	} else if (hdr->type == TOKTYPE_NON_CCA) {
 		return pkey_nonccatok2pkey(key, keylen,
 					   protkey, protkeylen, protkeytype);
 	} else {
-		DEBUG_ERR("%s unknown/unsupported blob type %d\n",
-			  __func__, hdr->type);
+		PKEY_DBF_ERR("%s unknown/unsupported blob type %d\n",
+			     __func__, hdr->type);
 		return -EINVAL;
 	}
 
@@ -1350,11 +1358,10 @@
 			return -EFAULT;
 		rc = cca_genseckey(kgs.cardnr, kgs.domain,
 				   kgs.keytype, kgs.seckey.seckey);
-		DEBUG_DBG("%s cca_genseckey()=%d\n", __func__, rc);
-		if (rc)
-			break;
-		if (copy_to_user(ugs, &kgs, sizeof(kgs)))
-			return -EFAULT;
+		pr_debug("%s cca_genseckey()=%d\n", __func__, rc);
+		if (!rc && copy_to_user(ugs, &kgs, sizeof(kgs)))
+			rc = -EFAULT;
+		memzero_explicit(&kgs, sizeof(kgs));
 		break;
 	}
 	case PKEY_CLR2SECK: {
@@ -1365,11 +1372,9 @@
 			return -EFAULT;
 		rc = cca_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype,
 				    kcs.clrkey.clrkey, kcs.seckey.seckey);
-		DEBUG_DBG("%s cca_clr2seckey()=%d\n", __func__, rc);
-		if (rc)
-			break;
-		if (copy_to_user(ucs, &kcs, sizeof(kcs)))
-			return -EFAULT;
+		pr_debug("%s cca_clr2seckey()=%d\n", __func__, rc);
+		if (!rc && copy_to_user(ucs, &kcs, sizeof(kcs)))
+			rc = -EFAULT;
 		memzero_explicit(&kcs, sizeof(kcs));
 		break;
 	}
@@ -1383,11 +1388,10 @@
 		rc = cca_sec2protkey(ksp.cardnr, ksp.domain,
 				     ksp.seckey.seckey, ksp.protkey.protkey,
 				     &ksp.protkey.len, &ksp.protkey.type);
-		DEBUG_DBG("%s cca_sec2protkey()=%d\n", __func__, rc);
-		if (rc)
-			break;
-		if (copy_to_user(usp, &ksp, sizeof(ksp)))
-			return -EFAULT;
+		pr_debug("%s cca_sec2protkey()=%d\n", __func__, rc);
+		if (!rc && copy_to_user(usp, &ksp, sizeof(ksp)))
+			rc = -EFAULT;
+		memzero_explicit(&ksp, sizeof(ksp));
 		break;
 	}
 	case PKEY_CLR2PROTK: {
@@ -1400,11 +1404,9 @@
 		rc = pkey_clr2protkey(kcp.keytype, kcp.clrkey.clrkey,
 				      kcp.protkey.protkey,
 				      &kcp.protkey.len, &kcp.protkey.type);
-		DEBUG_DBG("%s pkey_clr2protkey()=%d\n", __func__, rc);
-		if (rc)
-			break;
-		if (copy_to_user(ucp, &kcp, sizeof(kcp)))
-			return -EFAULT;
+		pr_debug("%s pkey_clr2protkey()=%d\n", __func__, rc);
+		if (!rc && copy_to_user(ucp, &kcp, sizeof(kcp)))
+			rc = -EFAULT;
 		memzero_explicit(&kcp, sizeof(kcp));
 		break;
 	}
@@ -1416,7 +1418,7 @@
 			return -EFAULT;
 		rc = cca_findcard(kfc.seckey.seckey,
 				  &kfc.cardnr, &kfc.domain, 1);
-		DEBUG_DBG("%s cca_findcard()=%d\n", __func__, rc);
+		pr_debug("%s cca_findcard()=%d\n", __func__, rc);
 		if (rc < 0)
 			break;
 		if (copy_to_user(ufc, &kfc, sizeof(kfc)))
@@ -1432,11 +1434,10 @@
 		ksp.protkey.len = sizeof(ksp.protkey.protkey);
 		rc = pkey_skey2pkey(ksp.seckey.seckey, ksp.protkey.protkey,
 				    &ksp.protkey.len, &ksp.protkey.type);
-		DEBUG_DBG("%s pkey_skey2pkey()=%d\n", __func__, rc);
-		if (rc)
-			break;
-		if (copy_to_user(usp, &ksp, sizeof(ksp)))
-			return -EFAULT;
+		pr_debug("%s pkey_skey2pkey()=%d\n", __func__, rc);
+		if (!rc && copy_to_user(usp, &ksp, sizeof(ksp)))
+			rc = -EFAULT;
+		memzero_explicit(&ksp, sizeof(ksp));
 		break;
 	}
 	case PKEY_VERIFYKEY: {
@@ -1447,11 +1448,10 @@
 			return -EFAULT;
 		rc = pkey_verifykey(&kvk.seckey, &kvk.cardnr, &kvk.domain,
 				    &kvk.keysize, &kvk.attributes);
-		DEBUG_DBG("%s pkey_verifykey()=%d\n", __func__, rc);
-		if (rc)
-			break;
-		if (copy_to_user(uvk, &kvk, sizeof(kvk)))
-			return -EFAULT;
+		pr_debug("%s pkey_verifykey()=%d\n", __func__, rc);
+		if (!rc && copy_to_user(uvk, &kvk, sizeof(kvk)))
+			rc = -EFAULT;
+		memzero_explicit(&kvk, sizeof(kvk));
 		break;
 	}
 	case PKEY_GENPROTK: {
@@ -1463,11 +1463,10 @@
 		kgp.protkey.len = sizeof(kgp.protkey.protkey);
 		rc = pkey_genprotkey(kgp.keytype, kgp.protkey.protkey,
 				     &kgp.protkey.len, &kgp.protkey.type);
-		DEBUG_DBG("%s pkey_genprotkey()=%d\n", __func__, rc);
-		if (rc)
-			break;
-		if (copy_to_user(ugp, &kgp, sizeof(kgp)))
-			return -EFAULT;
+		pr_debug("%s pkey_genprotkey()=%d\n", __func__, rc);
+		if (!rc && copy_to_user(ugp, &kgp, sizeof(kgp)))
+			rc = -EFAULT;
+		memzero_explicit(&kgp, sizeof(kgp));
 		break;
 	}
 	case PKEY_VERIFYPROTK: {
@@ -1478,7 +1477,8 @@
 			return -EFAULT;
 		rc = pkey_verifyprotkey(kvp.protkey.protkey,
 					kvp.protkey.len, kvp.protkey.type);
-		DEBUG_DBG("%s pkey_verifyprotkey()=%d\n", __func__, rc);
+		pr_debug("%s pkey_verifyprotkey()=%d\n", __func__, rc);
+		memzero_explicit(&kvp, sizeof(kvp));
 		break;
 	}
 	case PKEY_KBLOB2PROTK: {
@@ -1494,13 +1494,11 @@
 		ktp.protkey.len = sizeof(ktp.protkey.protkey);
 		rc = pkey_keyblob2pkey(kkey, ktp.keylen, ktp.protkey.protkey,
 				       &ktp.protkey.len, &ktp.protkey.type);
-		DEBUG_DBG("%s pkey_keyblob2pkey()=%d\n", __func__, rc);
-		memzero_explicit(kkey, ktp.keylen);
-		kfree(kkey);
-		if (rc)
-			break;
-		if (copy_to_user(utp, &ktp, sizeof(ktp)))
-			return -EFAULT;
+		pr_debug("%s pkey_keyblob2pkey()=%d\n", __func__, rc);
+		kfree_sensitive(kkey);
+		if (!rc && copy_to_user(utp, &ktp, sizeof(ktp)))
+			rc = -EFAULT;
+		memzero_explicit(&ktp, sizeof(ktp));
 		break;
 	}
 	case PKEY_GENSECK2: {
@@ -1523,26 +1521,26 @@
 		rc = pkey_genseckey2(apqns, kgs.apqn_entries,
 				     kgs.type, kgs.size, kgs.keygenflags,
 				     kkey, &klen);
-		DEBUG_DBG("%s pkey_genseckey2()=%d\n", __func__, rc);
+		pr_debug("%s pkey_genseckey2()=%d\n", __func__, rc);
 		kfree(apqns);
 		if (rc) {
-			kfree(kkey);
+			kfree_sensitive(kkey);
 			break;
 		}
 		if (kgs.key) {
 			if (kgs.keylen < klen) {
-				kfree(kkey);
+				kfree_sensitive(kkey);
 				return -EINVAL;
 			}
 			if (copy_to_user(kgs.key, kkey, klen)) {
-				kfree(kkey);
+				kfree_sensitive(kkey);
 				return -EFAULT;
 			}
 		}
 		kgs.keylen = klen;
 		if (copy_to_user(ugs, &kgs, sizeof(kgs)))
 			rc = -EFAULT;
-		kfree(kkey);
+		kfree_sensitive(kkey);
 		break;
 	}
 	case PKEY_CLR2SECK2: {
@@ -1555,29 +1553,35 @@
 		if (copy_from_user(&kcs, ucs, sizeof(kcs)))
 			return -EFAULT;
 		apqns = _copy_apqns_from_user(kcs.apqns, kcs.apqn_entries);
-		if (IS_ERR(apqns))
+		if (IS_ERR(apqns)) {
+			memzero_explicit(&kcs, sizeof(kcs));
 			return PTR_ERR(apqns);
+		}
 		kkey = kzalloc(klen, GFP_KERNEL);
 		if (!kkey) {
 			kfree(apqns);
+			memzero_explicit(&kcs, sizeof(kcs));
 			return -ENOMEM;
 		}
 		rc = pkey_clr2seckey2(apqns, kcs.apqn_entries,
 				      kcs.type, kcs.size, kcs.keygenflags,
 				      kcs.clrkey.clrkey, kkey, &klen);
-		DEBUG_DBG("%s pkey_clr2seckey2()=%d\n", __func__, rc);
+		pr_debug("%s pkey_clr2seckey2()=%d\n", __func__, rc);
 		kfree(apqns);
 		if (rc) {
-			kfree(kkey);
+			kfree_sensitive(kkey);
+			memzero_explicit(&kcs, sizeof(kcs));
 			break;
 		}
 		if (kcs.key) {
 			if (kcs.keylen < klen) {
-				kfree(kkey);
+				kfree_sensitive(kkey);
+				memzero_explicit(&kcs, sizeof(kcs));
 				return -EINVAL;
 			}
 			if (copy_to_user(kcs.key, kkey, klen)) {
-				kfree(kkey);
+				kfree_sensitive(kkey);
+				memzero_explicit(&kcs, sizeof(kcs));
 				return -EFAULT;
 			}
 		}
@@ -1585,7 +1589,7 @@
 		if (copy_to_user(ucs, &kcs, sizeof(kcs)))
 			rc = -EFAULT;
 		memzero_explicit(&kcs, sizeof(kcs));
-		kfree(kkey);
+		kfree_sensitive(kkey);
 		break;
 	}
 	case PKEY_VERIFYKEY2: {
@@ -1601,8 +1605,8 @@
 		rc = pkey_verifykey2(kkey, kvk.keylen,
 				     &kvk.cardnr, &kvk.domain,
 				     &kvk.type, &kvk.size, &kvk.flags);
-		DEBUG_DBG("%s pkey_verifykey2()=%d\n", __func__, rc);
-		kfree(kkey);
+		pr_debug("%s pkey_verifykey2()=%d\n", __func__, rc);
+		kfree_sensitive(kkey);
 		if (rc)
 			break;
 		if (copy_to_user(uvk, &kvk, sizeof(kvk)))
@@ -1630,14 +1634,12 @@
 					kkey, ktp.keylen,
 					ktp.protkey.protkey, &ktp.protkey.len,
 					&ktp.protkey.type);
-		DEBUG_DBG("%s pkey_keyblob2pkey2()=%d\n", __func__, rc);
+		pr_debug("%s pkey_keyblob2pkey2()=%d\n", __func__, rc);
 		kfree(apqns);
-		memzero_explicit(kkey, ktp.keylen);
-		kfree(kkey);
-		if (rc)
-			break;
-		if (copy_to_user(utp, &ktp, sizeof(ktp)))
-			return -EFAULT;
+		kfree_sensitive(kkey);
+		if (!rc && copy_to_user(utp, &ktp, sizeof(ktp)))
+			rc = -EFAULT;
+		memzero_explicit(&ktp, sizeof(ktp));
 		break;
 	}
 	case PKEY_APQNS4K: {
@@ -1664,8 +1666,8 @@
 		}
 		rc = pkey_apqns4key(kkey, kak.keylen, kak.flags,
 				    apqns, &nr_apqns);
-		DEBUG_DBG("%s pkey_apqns4key()=%d\n", __func__, rc);
-		kfree(kkey);
+		pr_debug("%s pkey_apqns4key()=%d\n", __func__, rc);
+		kfree_sensitive(kkey);
 		if (rc && rc != -ENOSPC) {
 			kfree(apqns);
 			break;
@@ -1707,7 +1709,7 @@
 		}
 		rc = pkey_apqns4keytype(kat.type, kat.cur_mkvp, kat.alt_mkvp,
 					kat.flags, apqns, &nr_apqns);
-		DEBUG_DBG("%s pkey_apqns4keytype()=%d\n", __func__, rc);
+		pr_debug("%s pkey_apqns4keytype()=%d\n", __func__, rc);
 		if (rc && rc != -ENOSPC) {
 			kfree(apqns);
 			break;
@@ -1751,31 +1753,30 @@
 		protkey = kmalloc(protkeylen, GFP_KERNEL);
 		if (!protkey) {
 			kfree(apqns);
-			kfree(kkey);
+			kfree_sensitive(kkey);
 			return -ENOMEM;
 		}
 		rc = pkey_keyblob2pkey3(apqns, ktp.apqn_entries,
 					kkey, ktp.keylen,
 					protkey, &protkeylen, &ktp.pkeytype);
-		DEBUG_DBG("%s pkey_keyblob2pkey3()=%d\n", __func__, rc);
+		pr_debug("%s pkey_keyblob2pkey3()=%d\n", __func__, rc);
 		kfree(apqns);
-		memzero_explicit(kkey, ktp.keylen);
-		kfree(kkey);
+		kfree_sensitive(kkey);
 		if (rc) {
-			kfree(protkey);
+			kfree_sensitive(protkey);
 			break;
 		}
 		if (ktp.pkey && ktp.pkeylen) {
 			if (protkeylen > ktp.pkeylen) {
-				kfree(protkey);
+				kfree_sensitive(protkey);
 				return -EINVAL;
 			}
 			if (copy_to_user(ktp.pkey, protkey, protkeylen)) {
-				kfree(protkey);
+				kfree_sensitive(protkey);
 				return -EFAULT;
 			}
 		}
-		kfree(protkey);
+		kfree_sensitive(protkey);
 		ktp.pkeylen = protkeylen;
 		if (copy_to_user(utp, &ktp, sizeof(ktp)))
 			return -EFAULT;
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/zcrypt_api.c
+++ linux-qcom-6.8.0/drivers/s390/crypto/zcrypt_api.c
@@ -12,6 +12,9 @@
  *  Multiple device nodes: Harald Freudenberger <freude@linux.ibm.com>
  */
 
+#define KMSG_COMPONENT "zcrypt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
@@ -57,10 +60,6 @@
 LIST_HEAD(zcrypt_card_list);
 
 static atomic_t zcrypt_open_count = ATOMIC_INIT(0);
-static atomic_t zcrypt_rescan_count = ATOMIC_INIT(0);
-
-atomic_t zcrypt_rescan_req = ATOMIC_INIT(0);
-EXPORT_SYMBOL(zcrypt_rescan_req);
 
 static LIST_HEAD(zcrypt_ops_list);
 
@@ -69,20 +68,15 @@
 
 /*
  * Process a rescan of the transport layer.
- *
- * Returns 1, if the rescan has been processed, otherwise 0.
+ * Runs a synchronous AP bus rescan.
+ * Returns true if something has changed (for example the
+ * bus scan has found and build up new devices) and it is
+ * worth to do a retry. Otherwise false is returned meaning
+ * no changes on the AP bus level.
  */
-static inline int zcrypt_process_rescan(void)
+static inline bool zcrypt_process_rescan(void)
 {
-	if (atomic_read(&zcrypt_rescan_req)) {
-		atomic_set(&zcrypt_rescan_req, 0);
-		atomic_inc(&zcrypt_rescan_count);
-		ap_bus_force_rescan();
-		ZCRYPT_DBF_INFO("%s rescan count=%07d\n", __func__,
-				atomic_inc_return(&zcrypt_rescan_count));
-		return 1;
-	}
-	return 0;
+	return ap_bus_force_rescan();
 }
 
 void zcrypt_msgtype_register(struct zcrypt_ops *zops)
@@ -579,6 +573,7 @@
 {
 	if (!zq || !try_module_get(zq->queue->ap_dev.device.driver->owner))
 		return NULL;
+	zcrypt_card_get(zc);
 	zcrypt_queue_get(zq);
 	get_device(&zq->queue->ap_dev.device);
 	atomic_add(weight, &zc->load);
@@ -598,6 +593,7 @@
 	atomic_sub(weight, &zq->load);
 	put_device(&zq->queue->ap_dev.device);
 	zcrypt_queue_put(zq);
+	zcrypt_card_put(zc);
 	module_put(mod);
 }
 
@@ -715,8 +711,7 @@
 	spin_unlock(&zcrypt_list_lock);
 
 	if (!pref_zq) {
-		ZCRYPT_DBF_DBG("%s no matching queue found => ENODEV\n",
-			       __func__);
+		pr_debug("%s no matching queue found => ENODEV\n", __func__);
 		rc = -ENODEV;
 		goto out;
 	}
@@ -820,8 +815,7 @@
 	spin_unlock(&zcrypt_list_lock);
 
 	if (!pref_zq) {
-		ZCRYPT_DBF_DBG("%s no matching queue found => ENODEV\n",
-			       __func__);
+		pr_debug("%s no matching queue found => ENODEV\n", __func__);
 		rc = -ENODEV;
 		goto out;
 	}
@@ -865,6 +859,8 @@
 	rc = prep_cca_ap_msg(userspace, xcrb, &ap_msg, &func_code, &domain);
 	if (rc)
 		goto out;
+	print_hex_dump_debug("ccareq: ", DUMP_PREFIX_ADDRESS, 16, 1,
+			     ap_msg.msg, ap_msg.len, false);
 
 	tdom = *domain;
 	if (perms != &ap_perms && tdom < AP_DOMAINS) {
@@ -940,8 +936,8 @@
 	spin_unlock(&zcrypt_list_lock);
 
 	if (!pref_zq) {
-		ZCRYPT_DBF_DBG("%s no match for address %02x.%04x => ENODEV\n",
-			       __func__, xcrb->user_defined, *domain);
+		pr_debug("%s no match for address %02x.%04x => ENODEV\n",
+			 __func__, xcrb->user_defined, *domain);
 		rc = -ENODEV;
 		goto out;
 	}
@@ -952,6 +948,10 @@
 		*domain = AP_QID_QUEUE(qid);
 
 	rc = pref_zq->ops->send_cprb(userspace, pref_zq, xcrb, &ap_msg);
+	if (!rc) {
+		print_hex_dump_debug("ccarpl: ", DUMP_PREFIX_ADDRESS, 16, 1,
+				     ap_msg.msg, ap_msg.len, false);
+	}
 
 	spin_lock(&zcrypt_list_lock);
 	zcrypt_drop_queue(pref_zc, pref_zq, mod, wgt);
@@ -970,7 +970,26 @@
 
 long zcrypt_send_cprb(struct ica_xcRB *xcrb)
 {
-	return _zcrypt_send_cprb(false, &ap_perms, NULL, xcrb);
+	struct zcrypt_track tr;
+	int rc;
+
+	memset(&tr, 0, sizeof(tr));
+
+	do {
+		rc = _zcrypt_send_cprb(false, &ap_perms, &tr, xcrb);
+	} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+
+	/* on ENODEV failure: retry once again after a requested rescan */
+	if (rc == -ENODEV && zcrypt_process_rescan())
+		do {
+			rc = _zcrypt_send_cprb(false, &ap_perms, &tr, xcrb);
+		} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+	if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
+		rc = -EIO;
+	if (rc)
+		pr_debug("%s rc=%d\n", __func__, rc);
+
+	return rc;
 }
 EXPORT_SYMBOL(zcrypt_send_cprb);
 
@@ -1045,6 +1064,8 @@
 	rc = prep_ep11_ap_msg(userspace, xcrb, &ap_msg, &func_code, &domain);
 	if (rc)
 		goto out_free;
+	print_hex_dump_debug("ep11req: ", DUMP_PREFIX_ADDRESS, 16, 1,
+			     ap_msg.msg, ap_msg.len, false);
 
 	if (perms != &ap_perms && domain < AUTOSEL_DOM) {
 		if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
@@ -1113,15 +1134,15 @@
 
 	if (!pref_zq) {
 		if (targets && target_num == 1) {
-			ZCRYPT_DBF_DBG("%s no match for address %02x.%04x => ENODEV\n",
-				       __func__, (int)targets->ap_id,
-				       (int)targets->dom_id);
+			pr_debug("%s no match for address %02x.%04x => ENODEV\n",
+				 __func__, (int)targets->ap_id,
+				 (int)targets->dom_id);
 		} else if (targets) {
-			ZCRYPT_DBF_DBG("%s no match for %d target addrs => ENODEV\n",
-				       __func__, (int)target_num);
+			pr_debug("%s no match for %d target addrs => ENODEV\n",
+				 __func__, (int)target_num);
 		} else {
-			ZCRYPT_DBF_DBG("%s no match for address ff.ffff => ENODEV\n",
-				       __func__);
+			pr_debug("%s no match for address ff.ffff => ENODEV\n",
+				 __func__);
 		}
 		rc = -ENODEV;
 		goto out_free;
@@ -1129,6 +1150,10 @@
 
 	qid = pref_zq->queue->qid;
 	rc = pref_zq->ops->send_ep11_cprb(userspace, pref_zq, xcrb, &ap_msg);
+	if (!rc) {
+		print_hex_dump_debug("ep11rpl: ", DUMP_PREFIX_ADDRESS, 16, 1,
+				     ap_msg.msg, ap_msg.len, false);
+	}
 
 	spin_lock(&zcrypt_list_lock);
 	zcrypt_drop_queue(pref_zc, pref_zq, mod, wgt);
@@ -1149,7 +1174,26 @@
 
 long zcrypt_send_ep11_cprb(struct ep11_urb *xcrb)
 {
-	return _zcrypt_send_ep11_cprb(false, &ap_perms, NULL, xcrb);
+	struct zcrypt_track tr;
+	int rc;
+
+	memset(&tr, 0, sizeof(tr));
+
+	do {
+		rc = _zcrypt_send_ep11_cprb(false, &ap_perms, &tr, xcrb);
+	} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+
+	/* on ENODEV failure: retry once again after a requested rescan */
+	if (rc == -ENODEV && zcrypt_process_rescan())
+		do {
+			rc = _zcrypt_send_ep11_cprb(false, &ap_perms, &tr, xcrb);
+		} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+	if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
+		rc = -EIO;
+	if (rc)
+		pr_debug("%s rc=%d\n", __func__, rc);
+
+	return rc;
 }
 EXPORT_SYMBOL(zcrypt_send_ep11_cprb);
 
@@ -1199,8 +1243,7 @@
 	spin_unlock(&zcrypt_list_lock);
 
 	if (!pref_zq) {
-		ZCRYPT_DBF_DBG("%s no matching queue found => ENODEV\n",
-			       __func__);
+		pr_debug("%s no matching queue found => ENODEV\n", __func__);
 		rc = -ENODEV;
 		goto out;
 	}
@@ -1431,20 +1474,17 @@
 
 	do {
 		rc = zcrypt_rsa_modexpo(perms, &tr, &mex);
-		if (rc == -EAGAIN)
-			tr.again_counter++;
-	} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
-	/* on failure: retry once again after a requested rescan */
-	if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+	} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+
+	/* on ENODEV failure: retry once again after a requested rescan */
+	if (rc == -ENODEV && zcrypt_process_rescan())
 		do {
 			rc = zcrypt_rsa_modexpo(perms, &tr, &mex);
-			if (rc == -EAGAIN)
-				tr.again_counter++;
-		} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
+		} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
 	if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
 		rc = -EIO;
 	if (rc) {
-		ZCRYPT_DBF_DBG("ioctl ICARSAMODEXPO rc=%d\n", rc);
+		pr_debug("ioctl ICARSAMODEXPO rc=%d\n", rc);
 		return rc;
 	}
 	return put_user(mex.outputdatalength, &umex->outputdatalength);
@@ -1463,20 +1503,17 @@
 
 	do {
 		rc = zcrypt_rsa_crt(perms, &tr, &crt);
-		if (rc == -EAGAIN)
-			tr.again_counter++;
-	} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
-	/* on failure: retry once again after a requested rescan */
-	if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+	} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+
+	/* on ENODEV failure: retry once again after a requested rescan */
+	if (rc == -ENODEV && zcrypt_process_rescan())
 		do {
 			rc = zcrypt_rsa_crt(perms, &tr, &crt);
-			if (rc == -EAGAIN)
-				tr.again_counter++;
-		} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
+		} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
 	if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
 		rc = -EIO;
 	if (rc) {
-		ZCRYPT_DBF_DBG("ioctl ICARSACRT rc=%d\n", rc);
+		pr_debug("ioctl ICARSACRT rc=%d\n", rc);
 		return rc;
 	}
 	return put_user(crt.outputdatalength, &ucrt->outputdatalength);
@@ -1495,21 +1532,18 @@
 
 	do {
 		rc = _zcrypt_send_cprb(true, perms, &tr, &xcrb);
-		if (rc == -EAGAIN)
-			tr.again_counter++;
-	} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
-	/* on failure: retry once again after a requested rescan */
-	if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+	} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+
+	/* on ENODEV failure: retry once again after a requested rescan */
+	if (rc == -ENODEV && zcrypt_process_rescan())
 		do {
 			rc = _zcrypt_send_cprb(true, perms, &tr, &xcrb);
-			if (rc == -EAGAIN)
-				tr.again_counter++;
-		} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
+		} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
 	if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
 		rc = -EIO;
 	if (rc)
-		ZCRYPT_DBF_DBG("ioctl ZSENDCPRB rc=%d status=0x%x\n",
-			       rc, xcrb.status);
+		pr_debug("ioctl ZSENDCPRB rc=%d status=0x%x\n",
+			 rc, xcrb.status);
 	if (copy_to_user(uxcrb, &xcrb, sizeof(xcrb)))
 		return -EFAULT;
 	return rc;
@@ -1528,20 +1562,17 @@
 
 	do {
 		rc = _zcrypt_send_ep11_cprb(true, perms, &tr, &xcrb);
-		if (rc == -EAGAIN)
-			tr.again_counter++;
-	} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
-	/* on failure: retry once again after a requested rescan */
-	if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+	} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+
+	/* on ENODEV failure: retry once again after a requested rescan */
+	if (rc == -ENODEV && zcrypt_process_rescan())
 		do {
 			rc = _zcrypt_send_ep11_cprb(true, perms, &tr, &xcrb);
-			if (rc == -EAGAIN)
-				tr.again_counter++;
-		} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
+		} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
 	if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
 		rc = -EIO;
 	if (rc)
-		ZCRYPT_DBF_DBG("ioctl ZSENDEP11CPRB rc=%d\n", rc);
+		pr_debug("ioctl ZSENDEP11CPRB rc=%d\n", rc);
 	if (copy_to_user(uxcrb, &xcrb, sizeof(xcrb)))
 		return -EFAULT;
 	return rc;
@@ -1670,7 +1701,7 @@
 	}
 	/* unknown ioctl number */
 	default:
-		ZCRYPT_DBF_DBG("unknown ioctl 0x%08x\n", cmd);
+		pr_debug("unknown ioctl 0x%08x\n", cmd);
 		return -ENOIOCTLCMD;
 	}
 }
@@ -1708,16 +1739,13 @@
 	mex64.n_modulus = compat_ptr(mex32.n_modulus);
 	do {
 		rc = zcrypt_rsa_modexpo(perms, &tr, &mex64);
-		if (rc == -EAGAIN)
-			tr.again_counter++;
-	} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
-	/* on failure: retry once again after a requested rescan */
-	if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+	} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+
+	/* on ENODEV failure: retry once again after a requested rescan */
+	if (rc == -ENODEV && zcrypt_process_rescan())
 		do {
 			rc = zcrypt_rsa_modexpo(perms, &tr, &mex64);
-			if (rc == -EAGAIN)
-				tr.again_counter++;
-		} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
+		} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
 	if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
 		rc = -EIO;
 	if (rc)
@@ -1761,16 +1789,13 @@
 	crt64.u_mult_inv = compat_ptr(crt32.u_mult_inv);
 	do {
 		rc = zcrypt_rsa_crt(perms, &tr, &crt64);
-		if (rc == -EAGAIN)
-			tr.again_counter++;
-	} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
-	/* on failure: retry once again after a requested rescan */
-	if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+	} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+
+	/* on ENODEV failure: retry once again after a requested rescan */
+	if (rc == -ENODEV && zcrypt_process_rescan())
 		do {
 			rc = zcrypt_rsa_crt(perms, &tr, &crt64);
-			if (rc == -EAGAIN)
-				tr.again_counter++;
-		} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
+		} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
 	if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
 		rc = -EIO;
 	if (rc)
@@ -1833,16 +1858,13 @@
 	xcrb64.status = xcrb32.status;
 	do {
 		rc = _zcrypt_send_cprb(true, perms, &tr, &xcrb64);
-		if (rc == -EAGAIN)
-			tr.again_counter++;
-	} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
-	/* on failure: retry once again after a requested rescan */
-	if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+	} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
+
+	/* on ENODEV failure: retry once again after a requested rescan */
+	if (rc == -ENODEV && zcrypt_process_rescan())
 		do {
 			rc = _zcrypt_send_cprb(true, perms, &tr, &xcrb64);
-			if (rc == -EAGAIN)
-				tr.again_counter++;
-		} while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
+		} while (rc == -EAGAIN && ++tr.again_counter < TRACK_AGAIN_MAX);
 	if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
 		rc = -EIO;
 	xcrb32.reply_control_blk_length = xcrb64.reply_control_blk_length;
@@ -1914,8 +1936,8 @@
 	 */
 	if (zcrypt_rng_buffer_index == 0) {
 		rc = zcrypt_rng((char *)zcrypt_rng_buffer);
-		/* on failure: retry once again after a requested rescan */
-		if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+		/* on ENODEV failure: retry once again after an AP bus rescan */
+		if (rc == -ENODEV && zcrypt_process_rescan())
 			rc = zcrypt_rng((char *)zcrypt_rng_buffer);
 		if (rc < 0)
 			return -EIO;
@@ -1977,7 +1999,7 @@
  * an asynchronous job. This function waits until these initial jobs
  * are done and so the zcrypt api should be ready to serve crypto
  * requests - if there are resources available. The function uses an
- * internal timeout of 60s. The very first caller will either wait for
+ * internal timeout of 30s. The very first caller will either wait for
  * ap bus bindings complete or the timeout happens. This state will be
  * remembered for further callers which will only be blocked until a
  * decision is made (timeout or bindings complete).
@@ -1996,8 +2018,8 @@
 	switch (zcrypt_wait_api_state) {
 	case 0:
 		/* initial state, invoke wait for the ap bus complete */
-		rc = ap_wait_init_apqn_bindings_complete(
-			msecs_to_jiffies(60 * 1000));
+		rc = ap_wait_apqn_bindings_complete(
+			msecs_to_jiffies(ZCRYPT_WAIT_BINDINGS_COMPLETE_MS));
 		switch (rc) {
 		case 0:
 			/* ap bus bindings are complete */
@@ -2014,8 +2036,8 @@
 			break;
 		default:
 			/* other failure */
-			ZCRYPT_DBF_DBG("%s ap_wait_init_apqn_bindings_complete()=%d\n",
-				       __func__, rc);
+			pr_debug("%s ap_wait_init_apqn_bindings_complete()=%d\n",
+				 __func__, rc);
 			break;
 		}
 		break;
@@ -2038,7 +2060,7 @@
 int __init zcrypt_debug_init(void)
 {
 	zcrypt_dbf_info = debug_register("zcrypt", 2, 1,
-					 DBF_MAX_SPRINTF_ARGS * sizeof(long));
+					 ZCRYPT_DBF_MAX_SPRINTF_ARGS * sizeof(long));
 	debug_register_view(zcrypt_dbf_info, &debug_sprintf_view);
 	debug_set_level(zcrypt_dbf_info, DBF_ERR);
 
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/zcrypt_api.h
+++ linux-qcom-6.8.0/drivers/s390/crypto/zcrypt_api.h
@@ -38,6 +38,15 @@
  */
 #define ZCRYPT_RNG_BUFFER_SIZE	4096
 
+/**
+ * The zcrypt_wait_api_operational() function waits this
+ * amount in milliseconds for ap_wait_aqpn_bindings_complete().
+ * Also on a cprb send failure with ENODEV the send functions
+ * trigger an ap bus rescan and wait this time in milliseconds
+ * for ap_wait_aqpn_bindings_complete() before resending.
+ */
+#define ZCRYPT_WAIT_BINDINGS_COMPLETE_MS 30000
+
 /*
  * Identifier for Crypto Request Performance Index
  */
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/zcrypt_ccamisc.c
+++ linux-qcom-6.8.0/drivers/s390/crypto/zcrypt_ccamisc.c
@@ -23,11 +23,6 @@
 #include "zcrypt_msgtype6.h"
 #include "zcrypt_ccamisc.h"
 
-#define DEBUG_DBG(...)	ZCRYPT_DBF(DBF_DEBUG, ##__VA_ARGS__)
-#define DEBUG_INFO(...) ZCRYPT_DBF(DBF_INFO, ##__VA_ARGS__)
-#define DEBUG_WARN(...) ZCRYPT_DBF(DBF_WARN, ##__VA_ARGS__)
-#define DEBUG_ERR(...)	ZCRYPT_DBF(DBF_ERR, ##__VA_ARGS__)
-
 /* Size of parameter block used for all cca requests/replies */
 #define PARMBSIZE 512
 
@@ -367,8 +362,8 @@
 		memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported keybitsize %d\n",
-			  __func__, keybitsize);
+		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
+			       __func__, keybitsize);
 		rc = -EINVAL;
 		goto out;
 	}
@@ -386,15 +381,15 @@
 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
 	rc = zcrypt_send_cprb(&xcrb);
 	if (rc) {
-		DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n",
-			  __func__, (int)cardnr, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n",
+			       __func__, (int)cardnr, (int)domain, rc);
 		goto out;
 	}
 
 	/* check response returncode and reasoncode */
 	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR("%s secure key generate failure, card response %d/%d\n",
-			  __func__,
+		ZCRYPT_DBF_ERR("%s secure key generate failure, card response %d/%d\n",
+			       __func__,
 			  (int)prepcblk->ccp_rtcode,
 			  (int)prepcblk->ccp_rscode);
 		rc = -EIO;
@@ -411,8 +406,8 @@
 		- sizeof(prepparm->lv3.keyblock.toklen)
 		- sizeof(prepparm->lv3.keyblock.tokattr);
 	if (seckeysize != SECKEYBLOBSIZE) {
-		DEBUG_ERR("%s secure token size mismatch %d != %d bytes\n",
-			  __func__, seckeysize, SECKEYBLOBSIZE);
+		ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n",
+			       __func__, seckeysize, SECKEYBLOBSIZE);
 		rc = -EIO;
 		goto out;
 	}
@@ -505,8 +500,8 @@
 		keysize = 32;
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported keybitsize %d\n",
-			  __func__, keybitsize);
+		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
+			       __func__, keybitsize);
 		rc = -EINVAL;
 		goto out;
 	}
@@ -524,17 +519,17 @@
 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
 	rc = zcrypt_send_cprb(&xcrb);
 	if (rc) {
-		DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
-			  __func__, (int)cardnr, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
+			       __func__, (int)cardnr, (int)domain, rc);
 		goto out;
 	}
 
 	/* check response returncode and reasoncode */
 	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR("%s clear key import failure, card response %d/%d\n",
-			  __func__,
-			  (int)prepcblk->ccp_rtcode,
-			  (int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_ERR("%s clear key import failure, card response %d/%d\n",
+			       __func__,
+			       (int)prepcblk->ccp_rtcode,
+			       (int)prepcblk->ccp_rscode);
 		rc = -EIO;
 		goto out;
 	}
@@ -549,8 +544,8 @@
 		- sizeof(prepparm->lv3.keyblock.toklen)
 		- sizeof(prepparm->lv3.keyblock.tokattr);
 	if (seckeysize != SECKEYBLOBSIZE) {
-		DEBUG_ERR("%s secure token size mismatch %d != %d bytes\n",
-			  __func__, seckeysize, SECKEYBLOBSIZE);
+		ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n",
+			       __func__, seckeysize, SECKEYBLOBSIZE);
 		rc = -EIO;
 		goto out;
 	}
@@ -651,17 +646,17 @@
 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
 	rc = zcrypt_send_cprb(&xcrb);
 	if (rc) {
-		DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
-			  __func__, (int)cardnr, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
+			       __func__, (int)cardnr, (int)domain, rc);
 		goto out;
 	}
 
 	/* check response returncode and reasoncode */
 	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR("%s unwrap secure key failure, card response %d/%d\n",
-			  __func__,
-			  (int)prepcblk->ccp_rtcode,
-			  (int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
+			       __func__,
+			       (int)prepcblk->ccp_rtcode,
+			       (int)prepcblk->ccp_rscode);
 		if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
 			rc = -EAGAIN;
 		else
@@ -669,10 +664,10 @@
 		goto out;
 	}
 	if (prepcblk->ccp_rscode != 0) {
-		DEBUG_WARN("%s unwrap secure key warning, card response %d/%d\n",
-			   __func__,
-			   (int)prepcblk->ccp_rtcode,
-			   (int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
+				__func__,
+				(int)prepcblk->ccp_rtcode,
+				(int)prepcblk->ccp_rscode);
 	}
 
 	/* process response cprb param block */
@@ -683,8 +678,8 @@
 	/* check the returned keyblock */
 	if (prepparm->lv3.ckb.version != 0x01 &&
 	    prepparm->lv3.ckb.version != 0x02) {
-		DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x\n",
-			  __func__, (int)prepparm->lv3.ckb.version);
+		ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n",
+			       __func__, (int)prepparm->lv3.ckb.version);
 		rc = -EIO;
 		goto out;
 	}
@@ -707,8 +702,8 @@
 			*protkeytype = PKEY_KEYTYPE_AES_256;
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported keylen %d\n",
-			  __func__, prepparm->lv3.ckb.len);
+		ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n",
+			       __func__, prepparm->lv3.ckb.len);
 		rc = -EIO;
 		goto out;
 	}
@@ -840,9 +835,8 @@
 	case 256:
 		break;
 	default:
-		DEBUG_ERR(
-			"%s unknown/unsupported keybitsize %d\n",
-			__func__, keybitsize);
+		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
+			       __func__, keybitsize);
 		rc = -EINVAL;
 		goto out;
 	}
@@ -880,19 +874,17 @@
 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
 	rc = zcrypt_send_cprb(&xcrb);
 	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
-			__func__, (int)cardnr, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
+			       __func__, (int)cardnr, (int)domain, rc);
 		goto out;
 	}
 
 	/* check response returncode and reasoncode */
 	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR(
-			"%s cipher key generate failure, card response %d/%d\n",
-			__func__,
-			(int)prepcblk->ccp_rtcode,
-			(int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_ERR("%s cipher key generate failure, card response %d/%d\n",
+			       __func__,
+			       (int)prepcblk->ccp_rtcode,
+			       (int)prepcblk->ccp_rscode);
 		rc = -EIO;
 		goto out;
 	}
@@ -905,8 +897,8 @@
 	/* do some plausibility checks on the key block */
 	if (prepparm->kb.len < 120 + 5 * sizeof(uint16_t) ||
 	    prepparm->kb.len > 136 + 5 * sizeof(uint16_t)) {
-		DEBUG_ERR("%s reply with invalid or unknown key block\n",
-			  __func__);
+		ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n",
+			       __func__);
 		rc = -EIO;
 		goto out;
 	}
@@ -1048,19 +1040,17 @@
 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
 	rc = zcrypt_send_cprb(&xcrb);
 	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
-			__func__, (int)cardnr, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
+			       __func__, (int)cardnr, (int)domain, rc);
 		goto out;
 	}
 
 	/* check response returncode and reasoncode */
 	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR(
-			"%s CSNBKPI2 failure, card response %d/%d\n",
-			__func__,
-			(int)prepcblk->ccp_rtcode,
-			(int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_ERR("%s CSNBKPI2 failure, card response %d/%d\n",
+			       __func__,
+			       (int)prepcblk->ccp_rtcode,
+			       (int)prepcblk->ccp_rscode);
 		rc = -EIO;
 		goto out;
 	}
@@ -1073,8 +1063,8 @@
 	/* do some plausibility checks on the key block */
 	if (prepparm->kb.len < 120 + 3 * sizeof(uint16_t) ||
 	    prepparm->kb.len > 136 + 3 * sizeof(uint16_t)) {
-		DEBUG_ERR("%s reply with invalid or unknown key block\n",
-			  __func__);
+		ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n",
+			       __func__);
 		rc = -EIO;
 		goto out;
 	}
@@ -1132,33 +1122,29 @@
 	rc = _ip_cprb_helper(card, dom, "AES     ", "FIRST   ", "MIN3PART",
 			     exorbuf, keybitsize, token, &tokensize);
 	if (rc) {
-		DEBUG_ERR(
-			"%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
-			__func__, rc);
+		ZCRYPT_DBF_ERR("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
+			       __func__, rc);
 		goto out;
 	}
 	rc = _ip_cprb_helper(card, dom, "AES     ", "ADD-PART", NULL,
 			     clrkey, keybitsize, token, &tokensize);
 	if (rc) {
-		DEBUG_ERR(
-			"%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
-			__func__, rc);
+		ZCRYPT_DBF_ERR("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
+			       __func__, rc);
 		goto out;
 	}
 	rc = _ip_cprb_helper(card, dom, "AES     ", "ADD-PART", NULL,
 			     exorbuf, keybitsize, token, &tokensize);
 	if (rc) {
-		DEBUG_ERR(
-			"%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
-			__func__, rc);
+		ZCRYPT_DBF_ERR("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
+			       __func__, rc);
 		goto out;
 	}
 	rc = _ip_cprb_helper(card, dom, "AES     ", "COMPLETE", NULL,
 			     NULL, keybitsize, token, &tokensize);
 	if (rc) {
-		DEBUG_ERR(
-			"%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
-			__func__, rc);
+		ZCRYPT_DBF_ERR("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
+			       __func__, rc);
 		goto out;
 	}
 
@@ -1265,19 +1251,17 @@
 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
 	rc = zcrypt_send_cprb(&xcrb);
 	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
-			__func__, (int)cardnr, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
+			       __func__, (int)cardnr, (int)domain, rc);
 		goto out;
 	}
 
 	/* check response returncode and reasoncode */
 	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR(
-			"%s unwrap secure key failure, card response %d/%d\n",
-			__func__,
-			(int)prepcblk->ccp_rtcode,
-			(int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
+			       __func__,
+			       (int)prepcblk->ccp_rtcode,
+			       (int)prepcblk->ccp_rscode);
 		if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
 			rc = -EAGAIN;
 		else
@@ -1285,11 +1269,10 @@
 		goto out;
 	}
 	if (prepcblk->ccp_rscode != 0) {
-		DEBUG_WARN(
-			"%s unwrap secure key warning, card response %d/%d\n",
-			__func__,
-			(int)prepcblk->ccp_rtcode,
-			(int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
+				__func__,
+				(int)prepcblk->ccp_rtcode,
+				(int)prepcblk->ccp_rscode);
 	}
 
 	/* process response cprb param block */
@@ -1300,15 +1283,14 @@
 	/* check the returned keyblock */
 	if (prepparm->vud.ckb.version != 0x01 &&
 	    prepparm->vud.ckb.version != 0x02) {
-		DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x\n",
-			  __func__, (int)prepparm->vud.ckb.version);
+		ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n",
+			       __func__, (int)prepparm->vud.ckb.version);
 		rc = -EIO;
 		goto out;
 	}
 	if (prepparm->vud.ckb.algo != 0x02) {
-		DEBUG_ERR(
-			"%s reply param keyblock algo mismatch 0x%02x != 0x02\n",
-			__func__, (int)prepparm->vud.ckb.algo);
+		ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x02\n",
+			       __func__, (int)prepparm->vud.ckb.algo);
 		rc = -EIO;
 		goto out;
 	}
@@ -1331,8 +1313,8 @@
 			*protkeytype = PKEY_KEYTYPE_AES_256;
 		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported keylen %d\n",
-			  __func__, prepparm->vud.ckb.keylen);
+		ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n",
+			       __func__, prepparm->vud.ckb.keylen);
 		rc = -EIO;
 		goto out;
 	}
@@ -1432,19 +1414,17 @@
 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
 	rc = zcrypt_send_cprb(&xcrb);
 	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
-			__func__, (int)cardnr, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
+			       __func__, (int)cardnr, (int)domain, rc);
 		goto out;
 	}
 
 	/* check response returncode and reasoncode */
 	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR(
-			"%s unwrap secure key failure, card response %d/%d\n",
-			__func__,
-			(int)prepcblk->ccp_rtcode,
-			(int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
+			       __func__,
+			       (int)prepcblk->ccp_rtcode,
+			       (int)prepcblk->ccp_rscode);
 		if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
 			rc = -EAGAIN;
 		else
@@ -1452,11 +1432,10 @@
 		goto out;
 	}
 	if (prepcblk->ccp_rscode != 0) {
-		DEBUG_WARN(
-			"%s unwrap secure key warning, card response %d/%d\n",
-			__func__,
-			(int)prepcblk->ccp_rtcode,
-			(int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
+				__func__,
+				(int)prepcblk->ccp_rtcode,
+				(int)prepcblk->ccp_rscode);
 	}
 
 	/* process response cprb param block */
@@ -1466,23 +1445,22 @@
 
 	/* check the returned keyblock */
 	if (prepparm->vud.ckb.version != 0x02) {
-		DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n",
-			  __func__, (int)prepparm->vud.ckb.version);
+		ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n",
+			       __func__, (int)prepparm->vud.ckb.version);
 		rc = -EIO;
 		goto out;
 	}
 	if (prepparm->vud.ckb.algo != 0x81) {
-		DEBUG_ERR(
-			"%s reply param keyblock algo mismatch 0x%02x != 0x81\n",
-			__func__, (int)prepparm->vud.ckb.algo);
+		ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x81\n",
+			       __func__, (int)prepparm->vud.ckb.algo);
 		rc = -EIO;
 		goto out;
 	}
 
 	/* copy the translated protected key */
 	if (prepparm->vud.ckb.keylen > *protkeylen) {
-		DEBUG_ERR("%s prot keylen mismatch %d > buffersize %u\n",
-			  __func__, prepparm->vud.ckb.keylen, *protkeylen);
+		ZCRYPT_DBF_ERR("%s prot keylen mismatch %d > buffersize %u\n",
+			       __func__, prepparm->vud.ckb.keylen, *protkeylen);
 		rc = -EIO;
 		goto out;
 	}
@@ -1550,17 +1528,17 @@
 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
 	rc = zcrypt_send_cprb(&xcrb);
 	if (rc) {
-		DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
-			  __func__, (int)cardnr, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
+			       __func__, (int)cardnr, (int)domain, rc);
 		goto out;
 	}
 
 	/* check response returncode and reasoncode */
 	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR("%s unwrap secure key failure, card response %d/%d\n",
-			  __func__,
-			  (int)prepcblk->ccp_rtcode,
-			  (int)prepcblk->ccp_rscode);
+		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
+			       __func__,
+			       (int)prepcblk->ccp_rtcode,
+			       (int)prepcblk->ccp_rscode);
 		rc = -EIO;
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/zcrypt_debug.h
+++ linux-qcom-6.8.0/drivers/s390/crypto/zcrypt_debug.h
@@ -17,7 +17,7 @@
 #define RC2ERR(rc) ((rc) ? DBF_ERR : DBF_INFO)
 #define RC2WARN(rc) ((rc) ? DBF_WARN : DBF_INFO)
 
-#define DBF_MAX_SPRINTF_ARGS 6
+#define ZCRYPT_DBF_MAX_SPRINTF_ARGS 6
 
 #define ZCRYPT_DBF(...)					\
 	debug_sprintf_event(zcrypt_dbf_info, ##__VA_ARGS__)
@@ -27,8 +27,6 @@
 	debug_sprintf_event(zcrypt_dbf_info, DBF_WARN, ##__VA_ARGS__)
 #define ZCRYPT_DBF_INFO(...)					\
 	debug_sprintf_event(zcrypt_dbf_info, DBF_INFO, ##__VA_ARGS__)
-#define ZCRYPT_DBF_DBG(...)					\
-	debug_sprintf_event(zcrypt_dbf_info, DBF_DEBUG, ##__VA_ARGS__)
 
 extern debug_info_t *zcrypt_dbf_info;
 
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/zcrypt_ep11misc.c
+++ linux-qcom-6.8.0/drivers/s390/crypto/zcrypt_ep11misc.c
@@ -24,11 +24,6 @@
 #include "zcrypt_ep11misc.h"
 #include "zcrypt_ccamisc.h"
 
-#define DEBUG_DBG(...)	ZCRYPT_DBF(DBF_DEBUG, ##__VA_ARGS__)
-#define DEBUG_INFO(...) ZCRYPT_DBF(DBF_INFO, ##__VA_ARGS__)
-#define DEBUG_WARN(...) ZCRYPT_DBF(DBF_WARN, ##__VA_ARGS__)
-#define DEBUG_ERR(...)	ZCRYPT_DBF(DBF_ERR, ##__VA_ARGS__)
-
 #define EP11_PINBLOB_V1_BYTES 56
 
 /* default iv used here */
@@ -510,7 +505,7 @@
 
 	/* start tag */
 	if (*pl++ != 0x30) {
-		DEBUG_ERR("%s reply start tag mismatch\n", func);
+		ZCRYPT_DBF_ERR("%s reply start tag mismatch\n", func);
 		return -EIO;
 	}
 
@@ -527,40 +522,41 @@
 		len = *((u16 *)pl);
 		pl += 2;
 	} else {
-		DEBUG_ERR("%s reply start tag lenfmt mismatch 0x%02hhx\n",
-			  func, *pl);
+		ZCRYPT_DBF_ERR("%s reply start tag lenfmt mismatch 0x%02hhx\n",
+			       func, *pl);
 		return -EIO;
 	}
 
 	/* len should cover at least 3 fields with 32 bit value each */
 	if (len < 3 * 6) {
-		DEBUG_ERR("%s reply length %d too small\n", func, len);
+		ZCRYPT_DBF_ERR("%s reply length %d too small\n", func, len);
 		return -EIO;
 	}
 
 	/* function tag, length and value */
 	if (pl[0] != 0x04 || pl[1] != 0x04) {
-		DEBUG_ERR("%s function tag or length mismatch\n", func);
+		ZCRYPT_DBF_ERR("%s function tag or length mismatch\n", func);
 		return -EIO;
 	}
 	pl += 6;
 
 	/* dom tag, length and value */
 	if (pl[0] != 0x04 || pl[1] != 0x04) {
-		DEBUG_ERR("%s dom tag or length mismatch\n", func);
+		ZCRYPT_DBF_ERR("%s dom tag or length mismatch\n", func);
 		return -EIO;
 	}
 	pl += 6;
 
 	/* return value tag, length and value */
 	if (pl[0] != 0x04 || pl[1] != 0x04) {
-		DEBUG_ERR("%s return value tag or length mismatch\n", func);
+		ZCRYPT_DBF_ERR("%s return value tag or length mismatch\n",
+			       func);
 		return -EIO;
 	}
 	pl += 2;
 	ret = *((u32 *)pl);
 	if (ret != 0) {
-		DEBUG_ERR("%s return value 0x%04x != 0\n", func, ret);
+		ZCRYPT_DBF_ERR("%s return value 0x%04x != 0\n", func, ret);
 		return -EIO;
 	}
 
@@ -626,9 +622,8 @@
 
 	rc = zcrypt_send_ep11_cprb(urb);
 	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
-			__func__, (int)cardnr, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
+			       __func__, (int)cardnr, (int)domain, rc);
 		goto out;
 	}
 
@@ -636,13 +631,13 @@
 	if (rc)
 		goto out;
 	if (rep_pl->data_tag != 0x04 || rep_pl->data_lenfmt != 0x82) {
-		DEBUG_ERR("%s unknown reply data format\n", __func__);
+		ZCRYPT_DBF_ERR("%s unknown reply data format\n", __func__);
 		rc = -EIO;
 		goto out;
 	}
 	if (rep_pl->data_len > buflen) {
-		DEBUG_ERR("%s mismatch between reply data len and buffer len\n",
-			  __func__);
+		ZCRYPT_DBF_ERR("%s mismatch between reply data len and buffer len\n",
+			       __func__);
 		rc = -ENOSPC;
 		goto out;
 	}
@@ -816,9 +811,8 @@
 	case 256:
 		break;
 	default:
-		DEBUG_ERR(
-			"%s unknown/unsupported keybitsize %d\n",
-			__func__, keybitsize);
+		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
+			       __func__, keybitsize);
 		rc = -EINVAL;
 		goto out;
 	}
@@ -878,9 +872,8 @@
 
 	rc = zcrypt_send_ep11_cprb(urb);
 	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
-			__func__, (int)card, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
+			       __func__, (int)card, (int)domain, rc);
 		goto out;
 	}
 
@@ -888,13 +881,13 @@
 	if (rc)
 		goto out;
 	if (rep_pl->data_tag != 0x04 || rep_pl->data_lenfmt != 0x82) {
-		DEBUG_ERR("%s unknown reply data format\n", __func__);
+		ZCRYPT_DBF_ERR("%s unknown reply data format\n", __func__);
 		rc = -EIO;
 		goto out;
 	}
 	if (rep_pl->data_len > *keybufsize) {
-		DEBUG_ERR("%s mismatch reply data len / key buffer len\n",
-			  __func__);
+		ZCRYPT_DBF_ERR("%s mismatch reply data len / key buffer len\n",
+			       __func__);
 		rc = -ENOSPC;
 		goto out;
 	}
@@ -1030,9 +1023,8 @@
 
 	rc = zcrypt_send_ep11_cprb(urb);
 	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
-			__func__, (int)card, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
+			       __func__, (int)card, (int)domain, rc);
 		goto out;
 	}
 
@@ -1040,7 +1032,7 @@
 	if (rc)
 		goto out;
 	if (rep_pl->data_tag != 0x04) {
-		DEBUG_ERR("%s unknown reply data format\n", __func__);
+		ZCRYPT_DBF_ERR("%s unknown reply data format\n", __func__);
 		rc = -EIO;
 		goto out;
 	}
@@ -1053,14 +1045,14 @@
 		n = *((u16 *)p);
 		p += 2;
 	} else {
-		DEBUG_ERR("%s unknown reply data length format 0x%02hhx\n",
-			  __func__, rep_pl->data_lenfmt);
+		ZCRYPT_DBF_ERR("%s unknown reply data length format 0x%02hhx\n",
+			       __func__, rep_pl->data_lenfmt);
 		rc = -EIO;
 		goto out;
 	}
 	if (n > *outbufsize) {
-		DEBUG_ERR("%s mismatch reply data len %d / output buffer %zu\n",
-			  __func__, n, *outbufsize);
+		ZCRYPT_DBF_ERR("%s mismatch reply data len %d / output buffer %zu\n",
+			       __func__, n, *outbufsize);
 		rc = -ENOSPC;
 		goto out;
 	}
@@ -1188,9 +1180,8 @@
 
 	rc = zcrypt_send_ep11_cprb(urb);
 	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
-			__func__, (int)card, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
+			       __func__, (int)card, (int)domain, rc);
 		goto out;
 	}
 
@@ -1198,13 +1189,13 @@
 	if (rc)
 		goto out;
 	if (rep_pl->data_tag != 0x04 || rep_pl->data_lenfmt != 0x82) {
-		DEBUG_ERR("%s unknown reply data format\n", __func__);
+		ZCRYPT_DBF_ERR("%s unknown reply data format\n", __func__);
 		rc = -EIO;
 		goto out;
 	}
 	if (rep_pl->data_len > *keybufsize) {
-		DEBUG_ERR("%s mismatch reply data len / key buffer len\n",
-			  __func__);
+		ZCRYPT_DBF_ERR("%s mismatch reply data len / key buffer len\n",
+			       __func__);
 		rc = -ENOSPC;
 		goto out;
 	}
@@ -1343,9 +1334,8 @@
 
 	rc = zcrypt_send_ep11_cprb(urb);
 	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
-			__func__, (int)card, (int)domain, rc);
+		ZCRYPT_DBF_ERR("%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
+			       __func__, (int)card, (int)domain, rc);
 		goto out;
 	}
 
@@ -1353,13 +1343,13 @@
 	if (rc)
 		goto out;
 	if (rep_pl->data_tag != 0x04 || rep_pl->data_lenfmt != 0x82) {
-		DEBUG_ERR("%s unknown reply data format\n", __func__);
+		ZCRYPT_DBF_ERR("%s unknown reply data format\n", __func__);
 		rc = -EIO;
 		goto out;
 	}
 	if (rep_pl->data_len > *datasize) {
-		DEBUG_ERR("%s mismatch reply data len / data buffer len\n",
-			  __func__);
+		ZCRYPT_DBF_ERR("%s mismatch reply data len / data buffer len\n",
+			       __func__);
 		rc = -ENOSPC;
 		goto out;
 	}
@@ -1386,9 +1376,8 @@
 	if (keybitsize == 128 || keybitsize == 192 || keybitsize == 256) {
 		clrkeylen = keybitsize / 8;
 	} else {
-		DEBUG_ERR(
-			"%s unknown/unsupported keybitsize %d\n",
-			__func__, keybitsize);
+		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
+			       __func__, keybitsize);
 		return -EINVAL;
 	}
 
@@ -1405,9 +1394,8 @@
 			     0x00006c00, /* EN/DECRYPT, WRAP/UNWRAP */
 			     kek, &keklen);
 	if (rc) {
-		DEBUG_ERR(
-			"%s generate kek key failed, rc=%d\n",
-			__func__, rc);
+		ZCRYPT_DBF_ERR("%s generate kek key failed, rc=%d\n",
+			       __func__, rc);
 		goto out;
 	}
 
@@ -1415,9 +1403,8 @@
 	rc = ep11_cryptsingle(card, domain, 0, 0, def_iv, kek, keklen,
 			      clrkey, clrkeylen, encbuf, &encbuflen);
 	if (rc) {
-		DEBUG_ERR(
-			"%s encrypting key value with kek key failed, rc=%d\n",
-			__func__, rc);
+		ZCRYPT_DBF_ERR("%s encrypting key value with kek key failed, rc=%d\n",
+			       __func__, rc);
 		goto out;
 	}
 
@@ -1426,9 +1413,8 @@
 			    encbuf, encbuflen, 0, def_iv,
 			    keybitsize, 0, keybuf, keybufsize, keytype);
 	if (rc) {
-		DEBUG_ERR(
-			"%s importing key value as new key failed,, rc=%d\n",
-			__func__, rc);
+		ZCRYPT_DBF_ERR("%s importing key value as new key failed,, rc=%d\n",
+			       __func__, rc);
 		goto out;
 	}
 
@@ -1476,17 +1462,16 @@
 	rc = _ep11_wrapkey(card, dom, (u8 *)key, keylen,
 			   0, def_iv, wkbuf, &wkbuflen);
 	if (rc) {
-		DEBUG_ERR(
-			"%s rewrapping ep11 key to pkey failed, rc=%d\n",
-			__func__, rc);
+		ZCRYPT_DBF_ERR("%s rewrapping ep11 key to pkey failed, rc=%d\n",
+			       __func__, rc);
 		goto out;
 	}
 	wki = (struct wk_info *)wkbuf;
 
 	/* check struct version and pkey type */
 	if (wki->version != 1 || wki->pkeytype < 1 || wki->pkeytype > 5) {
-		DEBUG_ERR("%s wk info version %d or pkeytype %d mismatch.\n",
-			  __func__, (int)wki->version, (int)wki->pkeytype);
+		ZCRYPT_DBF_ERR("%s wk info version %d or pkeytype %d mismatch.\n",
+			       __func__, (int)wki->version, (int)wki->pkeytype);
 		rc = -EIO;
 		goto out;
 	}
@@ -1511,8 +1496,8 @@
 				*protkeytype = PKEY_KEYTYPE_AES_256;
 			break;
 		default:
-			DEBUG_ERR("%s unknown/unsupported AES pkeysize %d\n",
-				  __func__, (int)wki->pkeysize);
+			ZCRYPT_DBF_ERR("%s unknown/unsupported AES pkeysize %d\n",
+				       __func__, (int)wki->pkeysize);
 			rc = -EIO;
 			goto out;
 		}
@@ -1525,16 +1510,16 @@
 		break;
 	case 2: /* TDES */
 	default:
-		DEBUG_ERR("%s unknown/unsupported key type %d\n",
-			  __func__, (int)wki->pkeytype);
+		ZCRYPT_DBF_ERR("%s unknown/unsupported key type %d\n",
+			       __func__, (int)wki->pkeytype);
 		rc = -EIO;
 		goto out;
 	}
 
 	/* copy the translated protected key */
 	if (wki->pkeysize > *protkeylen) {
-		DEBUG_ERR("%s wk info pkeysize %llu > protkeysize %u\n",
-			  __func__, wki->pkeysize, *protkeylen);
+		ZCRYPT_DBF_ERR("%s wk info pkeysize %llu > protkeysize %u\n",
+			       __func__, wki->pkeysize, *protkeylen);
 		rc = -EINVAL;
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/zcrypt_error.h
+++ linux-qcom-6.8.0/drivers/s390/crypto/zcrypt_error.h
@@ -119,10 +119,9 @@
 	case REP82_ERROR_MESSAGE_TYPE:		 /* 0x20 */
 	case REP82_ERROR_TRANSPORT_FAIL:	 /* 0x90 */
 		/*
-		 * Msg to wrong type or card/infrastructure failure.
-		 * Trigger rescan of the ap bus, trigger retry request.
+		 * Msg to wrong type or card/infrastructure failure. Return
+		 * EAGAIN, the upper layer may do a retry on the request.
 		 */
-		atomic_set(&zcrypt_rescan_req, 1);
 		/* For type 86 response show the apfs value (failure reason) */
 		if (ehdr->reply_code == REP82_ERROR_TRANSPORT_FAIL &&
 		    ehdr->type == TYPE86_RSP_CODE) {
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/zcrypt_msgtype50.c
+++ linux-qcom-6.8.0/drivers/s390/crypto/zcrypt_msgtype50.c
@@ -427,7 +427,7 @@
 		len = t80h->len;
 		if (len > reply->bufsize || len > msg->bufsize ||
 		    len != reply->len) {
-			ZCRYPT_DBF_DBG("%s len mismatch => EMSGSIZE\n", __func__);
+			pr_debug("%s len mismatch => EMSGSIZE\n", __func__);
 			msg->rc = -EMSGSIZE;
 			goto out;
 		}
@@ -487,9 +487,9 @@
 out:
 	ap_msg->private = NULL;
 	if (rc)
-		ZCRYPT_DBF_DBG("%s send me cprb at dev=%02x.%04x rc=%d\n",
-			       __func__, AP_QID_CARD(zq->queue->qid),
-			       AP_QID_QUEUE(zq->queue->qid), rc);
+		pr_debug("%s send me cprb at dev=%02x.%04x rc=%d\n",
+			 __func__, AP_QID_CARD(zq->queue->qid),
+			 AP_QID_QUEUE(zq->queue->qid), rc);
 	return rc;
 }
 
@@ -537,9 +537,9 @@
 out:
 	ap_msg->private = NULL;
 	if (rc)
-		ZCRYPT_DBF_DBG("%s send crt cprb at dev=%02x.%04x rc=%d\n",
-			       __func__, AP_QID_CARD(zq->queue->qid),
-			       AP_QID_QUEUE(zq->queue->qid), rc);
+		pr_debug("%s send crt cprb at dev=%02x.%04x rc=%d\n",
+			 __func__, AP_QID_CARD(zq->queue->qid),
+			 AP_QID_QUEUE(zq->queue->qid), rc);
 	return rc;
 }
 
--- linux-qcom-6.8.0.orig/drivers/s390/crypto/zcrypt_msgtype6.c
+++ linux-qcom-6.8.0/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -437,9 +437,9 @@
 		ap_msg->flags |= AP_MSG_FLAG_ADMIN;
 		break;
 	default:
-		ZCRYPT_DBF_DBG("%s unknown CPRB minor version '%c%c'\n",
-			       __func__, msg->cprbx.func_id[0],
-			       msg->cprbx.func_id[1]);
+		pr_debug("%s unknown CPRB minor version '%c%c'\n",
+			 __func__, msg->cprbx.func_id[0],
+			 msg->cprbx.func_id[1]);
 	}
 
 	/* copy data block */
@@ -629,9 +629,9 @@
 
 	/* Copy CPRB to user */
 	if (xcrb->reply_control_blk_length < msg->fmt2.count1) {
-		ZCRYPT_DBF_DBG("%s reply_control_blk_length %u < required %u => EMSGSIZE\n",
-			       __func__, xcrb->reply_control_blk_length,
-			       msg->fmt2.count1);
+		pr_debug("%s reply_control_blk_length %u < required %u => EMSGSIZE\n",
+			 __func__, xcrb->reply_control_blk_length,
+			 msg->fmt2.count1);
 		return -EMSGSIZE;
 	}
 	if (z_copy_to_user(userspace, xcrb->reply_control_blk_addr,
@@ -642,9 +642,9 @@
 	/* Copy data buffer to user */
 	if (msg->fmt2.count2) {
 		if (xcrb->reply_data_length < msg->fmt2.count2) {
-			ZCRYPT_DBF_DBG("%s reply_data_length %u < required %u => EMSGSIZE\n",
-				       __func__, xcrb->reply_data_length,
-				       msg->fmt2.count2);
+			pr_debug("%s reply_data_length %u < required %u => EMSGSIZE\n",
+				 __func__, xcrb->reply_data_length,
+				 msg->fmt2.count2);
 			return -EMSGSIZE;
 		}
 		if (z_copy_to_user(userspace, xcrb->reply_data_addr,
@@ -673,9 +673,9 @@
 	char *data = reply->msg;
 
 	if (xcrb->resp_len < msg->fmt2.count1) {
-		ZCRYPT_DBF_DBG("%s resp_len %u < required %u => EMSGSIZE\n",
-			       __func__, (unsigned int)xcrb->resp_len,
-			       msg->fmt2.count1);
+		pr_debug("%s resp_len %u < required %u => EMSGSIZE\n",
+			 __func__, (unsigned int)xcrb->resp_len,
+			 msg->fmt2.count1);
 		return -EMSGSIZE;
 	}
 
@@ -875,7 +875,8 @@
 			len = sizeof(struct type86x_reply) + t86r->length;
 			if (len > reply->bufsize || len > msg->bufsize ||
 			    len != reply->len) {
-				ZCRYPT_DBF_DBG("%s len mismatch => EMSGSIZE\n", __func__);
+				pr_debug("%s len mismatch => EMSGSIZE\n",
+					 __func__);
 				msg->rc = -EMSGSIZE;
 				goto out;
 			}
@@ -889,7 +890,8 @@
 				len = t86r->fmt2.offset1 + t86r->fmt2.count1;
 			if (len > reply->bufsize || len > msg->bufsize ||
 			    len != reply->len) {
-				ZCRYPT_DBF_DBG("%s len mismatch => EMSGSIZE\n", __func__);
+				pr_debug("%s len mismatch => EMSGSIZE\n",
+					 __func__);
 				msg->rc = -EMSGSIZE;
 				goto out;
 			}
@@ -939,7 +941,8 @@
 			len = t86r->fmt2.offset1 + t86r->fmt2.count1;
 			if (len > reply->bufsize || len > msg->bufsize ||
 			    len != reply->len) {
-				ZCRYPT_DBF_DBG("%s len mismatch => EMSGSIZE\n", __func__);
+				pr_debug("%s len mismatch => EMSGSIZE\n",
+					 __func__);
 				msg->rc = -EMSGSIZE;
 				goto out;
 			}
@@ -1151,9 +1154,9 @@
 
 out:
 	if (rc)
-		ZCRYPT_DBF_DBG("%s send cprb at dev=%02x.%04x rc=%d\n",
-			       __func__, AP_QID_CARD(zq->queue->qid),
-			       AP_QID_QUEUE(zq->queue->qid), rc);
+		pr_debug("%s send cprb at dev=%02x.%04x rc=%d\n",
+			 __func__, AP_QID_CARD(zq->queue->qid),
+			 AP_QID_QUEUE(zq->queue->qid), rc);
 	return rc;
 }
 
@@ -1274,9 +1277,9 @@
 
 out:
 	if (rc)
-		ZCRYPT_DBF_DBG("%s send cprb at dev=%02x.%04x rc=%d\n",
-			       __func__, AP_QID_CARD(zq->queue->qid),
-			       AP_QID_QUEUE(zq->queue->qid), rc);
+		pr_debug("%s send cprb at dev=%02x.%04x rc=%d\n",
+			 __func__, AP_QID_CARD(zq->queue->qid),
+			 AP_QID_QUEUE(zq->queue->qid), rc);
 	return rc;
 }
 
--- linux-qcom-6.8.0.orig/drivers/s390/net/ism_drv.c
+++ linux-qcom-6.8.0/drivers/s390/net/ism_drv.c
@@ -292,13 +292,16 @@
 static void ism_free_dmb(struct ism_dev *ism, struct ism_dmb *dmb)
 {
 	clear_bit(dmb->sba_idx, ism->sba_bitmap);
-	dma_free_coherent(&ism->pdev->dev, dmb->dmb_len,
-			  dmb->cpu_addr, dmb->dma_addr);
+	dma_unmap_page(&ism->pdev->dev, dmb->dma_addr, dmb->dmb_len,
+		       DMA_FROM_DEVICE);
+	folio_put(virt_to_folio(dmb->cpu_addr));
 }
 
 static int ism_alloc_dmb(struct ism_dev *ism, struct ism_dmb *dmb)
 {
+	struct folio *folio;
 	unsigned long bit;
+	int rc;
 
 	if (PAGE_ALIGN(dmb->dmb_len) > dma_get_max_seg_size(&ism->pdev->dev))
 		return -EINVAL;
@@ -315,14 +318,30 @@
 	    test_and_set_bit(dmb->sba_idx, ism->sba_bitmap))
 		return -EINVAL;
 
-	dmb->cpu_addr = dma_alloc_coherent(&ism->pdev->dev, dmb->dmb_len,
-					   &dmb->dma_addr,
-					   GFP_KERNEL | __GFP_NOWARN |
-					   __GFP_NOMEMALLOC | __GFP_NORETRY);
-	if (!dmb->cpu_addr)
-		clear_bit(dmb->sba_idx, ism->sba_bitmap);
+	folio = folio_alloc(GFP_KERNEL | __GFP_NOWARN | __GFP_NOMEMALLOC |
+			    __GFP_NORETRY, get_order(dmb->dmb_len));
 
-	return dmb->cpu_addr ? 0 : -ENOMEM;
+	if (!folio) {
+		rc = -ENOMEM;
+		goto out_bit;
+	}
+
+	dmb->cpu_addr = folio_address(folio);
+	dmb->dma_addr = dma_map_page(&ism->pdev->dev,
+				     virt_to_page(dmb->cpu_addr), 0,
+				     dmb->dmb_len, DMA_FROM_DEVICE);
+	if (dma_mapping_error(&ism->pdev->dev, dmb->dma_addr)) {
+		rc = -ENOMEM;
+		goto out_free;
+	}
+
+	return 0;
+
+out_free:
+	kfree(dmb->cpu_addr);
+out_bit:
+	clear_bit(dmb->sba_idx, ism->sba_bitmap);
+	return rc;
 }
 
 int ism_register_dmb(struct ism_dev *ism, struct ism_dmb *dmb,
--- linux-qcom-6.8.0.orig/drivers/s390/net/qeth_core.h
+++ linux-qcom-6.8.0/drivers/s390/net/qeth_core.h
@@ -956,7 +956,7 @@
 	struct dst_entry *dst = skb_dst(skb);
 	struct rt6_info *rt;
 
-	rt = (struct rt6_info *) dst;
+	rt = dst_rt6_info(dst);
 	if (dst) {
 		if (proto == htons(ETH_P_IPV6))
 			dst = dst_check(dst, rt6_get_cookie(rt));
@@ -970,15 +970,14 @@
 static inline __be32 qeth_next_hop_v4_rcu(struct sk_buff *skb,
 					  struct dst_entry *dst)
 {
-	struct rtable *rt = (struct rtable *) dst;
-
-	return (rt) ? rt_nexthop(rt, ip_hdr(skb)->daddr) : ip_hdr(skb)->daddr;
+	return (dst) ? rt_nexthop(dst_rtable(dst), ip_hdr(skb)->daddr) :
+		       ip_hdr(skb)->daddr;
 }
 
 static inline struct in6_addr *qeth_next_hop_v6_rcu(struct sk_buff *skb,
 						    struct dst_entry *dst)
 {
-	struct rt6_info *rt = (struct rt6_info *) dst;
+	struct rt6_info *rt = dst_rt6_info(dst);
 
 	if (rt && !ipv6_addr_any(&rt->rt6i_gateway))
 		return &rt->rt6i_gateway;
--- linux-qcom-6.8.0.orig/drivers/s390/net/qeth_core_main.c
+++ linux-qcom-6.8.0/drivers/s390/net/qeth_core_main.c
@@ -364,30 +364,33 @@
 	return rc;
 }
 
+static void qeth_free_cq(struct qeth_card *card)
+{
+	if (card->qdio.c_q) {
+		qeth_free_qdio_queue(card->qdio.c_q);
+		card->qdio.c_q = NULL;
+	}
+}
+
 static int qeth_alloc_cq(struct qeth_card *card)
 {
 	if (card->options.cq == QETH_CQ_ENABLED) {
 		QETH_CARD_TEXT(card, 2, "cqon");
-		card->qdio.c_q = qeth_alloc_qdio_queue();
 		if (!card->qdio.c_q) {
-			dev_err(&card->gdev->dev, "Failed to create completion queue\n");
-			return -ENOMEM;
+			card->qdio.c_q = qeth_alloc_qdio_queue();
+			if (!card->qdio.c_q) {
+				dev_err(&card->gdev->dev,
+					"Failed to create completion queue\n");
+				return -ENOMEM;
+			}
 		}
 	} else {
 		QETH_CARD_TEXT(card, 2, "nocq");
-		card->qdio.c_q = NULL;
+		qeth_free_cq(card);
 	}
 	return 0;
 }
 
-static void qeth_free_cq(struct qeth_card *card)
-{
-	if (card->qdio.c_q) {
-		qeth_free_qdio_queue(card->qdio.c_q);
-		card->qdio.c_q = NULL;
-	}
-}
-
 static enum iucv_tx_notify qeth_compute_cq_notification(int sbalf15,
 							int delayed)
 {
@@ -1179,6 +1182,20 @@
 	}
 }
 
+/**
+ * qeth_irq() - qeth interrupt handler
+ * @cdev: ccw device
+ * @intparm: expect pointer to iob
+ * @irb: Interruption Response Block
+ *
+ * In the good path:
+ * corresponding qeth channel is locked with last used iob as active_cmd.
+ * But this function is also called for error interrupts.
+ *
+ * Caller ensures that:
+ * Interrupts are disabled; ccw device lock is held;
+ *
+ */
 static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
 		struct irb *irb)
 {
@@ -1220,11 +1237,10 @@
 		iob = (struct qeth_cmd_buffer *) (addr_t)intparm;
 	}
 
-	qeth_unlock_channel(card, channel);
-
 	rc = qeth_check_irb_error(card, cdev, irb);
 	if (rc) {
 		/* IO was terminated, free its resources. */
+		qeth_unlock_channel(card, channel);
 		if (iob)
 			qeth_cancel_cmd(iob, rc);
 		return;
@@ -1268,6 +1284,7 @@
 		rc = qeth_get_problem(card, cdev, irb);
 		if (rc) {
 			card->read_or_write_problem = 1;
+			qeth_unlock_channel(card, channel);
 			if (iob)
 				qeth_cancel_cmd(iob, rc);
 			qeth_clear_ipacmd_list(card);
@@ -1276,6 +1293,26 @@
 		}
 	}
 
+	if (scsw_cmd_is_valid_cc(&irb->scsw) && irb->scsw.cmd.cc == 1 && iob) {
+		/* channel command hasn't started: retry.
+		 * active_cmd is still set to last iob
+		 */
+		QETH_CARD_TEXT(card, 2, "irqcc1");
+		rc = ccw_device_start_timeout(cdev, __ccw_from_cmd(iob),
+					      (addr_t)iob, 0, 0, iob->timeout);
+		if (rc) {
+			QETH_DBF_MESSAGE(2,
+					 "ccw retry on %x failed, rc = %i\n",
+					 CARD_DEVID(card), rc);
+			QETH_CARD_TEXT_(card, 2, " err%d", rc);
+			qeth_unlock_channel(card, channel);
+			qeth_cancel_cmd(iob, rc);
+		}
+		return;
+	}
+
+	qeth_unlock_channel(card, channel);
+
 	if (iob) {
 		/* sanity check: */
 		if (irb->scsw.cmd.count > iob->length) {
@@ -2594,6 +2631,10 @@
 
 	QETH_CARD_TEXT(card, 2, "allcqdbf");
 
+	/* completion */
+	if (qeth_alloc_cq(card))
+		goto out_err;
+
 	if (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_UNINITIALIZED,
 		QETH_QDIO_ALLOCATED) != QETH_QDIO_UNINITIALIZED)
 		return 0;
@@ -2629,10 +2670,6 @@
 		queue->priority = QETH_QIB_PQUE_PRIO_DEFAULT;
 	}
 
-	/* completion */
-	if (qeth_alloc_cq(card))
-		goto out_freeoutq;
-
 	return 0;
 
 out_freeoutq:
@@ -2643,6 +2680,8 @@
 	qeth_free_buffer_pool(card);
 out_buffer_pool:
 	atomic_set(&card->qdio.state, QETH_QDIO_UNINITIALIZED);
+	qeth_free_cq(card);
+out_err:
 	return -ENOMEM;
 }
 
@@ -2650,11 +2689,12 @@
 {
 	int i, j;
 
+	qeth_free_cq(card);
+
 	if (atomic_xchg(&card->qdio.state, QETH_QDIO_UNINITIALIZED) ==
 		QETH_QDIO_UNINITIALIZED)
 		return;
 
-	qeth_free_cq(card);
 	for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j) {
 		if (card->qdio.in_q->bufs[j].rx_skb) {
 			consume_skb(card->qdio.in_q->bufs[j].rx_skb);
@@ -3708,24 +3748,11 @@
 
 int qeth_configure_cq(struct qeth_card *card, enum qeth_cq cq)
 {
-	int rc;
-
-	if (card->options.cq ==  QETH_CQ_NOTAVAILABLE) {
-		rc = -1;
-		goto out;
-	} else {
-		if (card->options.cq == cq) {
-			rc = 0;
-			goto out;
-		}
-
-		qeth_free_qdio_queues(card);
-		card->options.cq = cq;
-		rc = 0;
-	}
-out:
-	return rc;
+	if (card->options.cq == QETH_CQ_NOTAVAILABLE)
+		return -1;
 
+	card->options.cq = cq;
+	return 0;
 }
 EXPORT_SYMBOL_GPL(qeth_configure_cq);
 
--- linux-qcom-6.8.0.orig/drivers/scsi/NCR5380.c
+++ linux-qcom-6.8.0/drivers/scsi/NCR5380.c
@@ -1485,6 +1485,7 @@
 				unsigned char **data)
 {
 	struct NCR5380_hostdata *hostdata = shost_priv(instance);
+	struct NCR5380_cmd *ncmd = NCR5380_to_ncmd(hostdata->connected);
 	int c = *count;
 	unsigned char p = *phase;
 	unsigned char *d = *data;
@@ -1496,7 +1497,7 @@
 		return -1;
 	}
 
-	NCR5380_to_ncmd(hostdata->connected)->phase = p;
+	ncmd->phase = p;
 
 	if (p & SR_IO) {
 		if (hostdata->read_overruns)
@@ -1608,45 +1609,44 @@
  * request.
  */
 
-	if (hostdata->flags & FLAG_DMA_FIXUP) {
-		if (p & SR_IO) {
-			/*
-			 * The workaround was to transfer fewer bytes than we
-			 * intended to with the pseudo-DMA read function, wait for
-			 * the chip to latch the last byte, read it, and then disable
-			 * pseudo-DMA mode.
-			 *
-			 * After REQ is asserted, the NCR5380 asserts DRQ and ACK.
-			 * REQ is deasserted when ACK is asserted, and not reasserted
-			 * until ACK goes false.  Since the NCR5380 won't lower ACK
-			 * until DACK is asserted, which won't happen unless we twiddle
-			 * the DMA port or we take the NCR5380 out of DMA mode, we
-			 * can guarantee that we won't handshake another extra
-			 * byte.
-			 */
-
-			if (NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
-			                          BASR_DRQ, BASR_DRQ, 0) < 0) {
-				result = -1;
-				shost_printk(KERN_ERR, instance, "PDMA read: DRQ timeout\n");
-			}
-			if (NCR5380_poll_politely(hostdata, STATUS_REG,
-			                          SR_REQ, 0, 0) < 0) {
-				result = -1;
-				shost_printk(KERN_ERR, instance, "PDMA read: !REQ timeout\n");
-			}
-			d[*count - 1] = NCR5380_read(INPUT_DATA_REG);
-		} else {
-			/*
-			 * Wait for the last byte to be sent.  If REQ is being asserted for
-			 * the byte we're interested, we'll ACK it and it will go false.
-			 */
-			if (NCR5380_poll_politely2(hostdata,
-			     BUS_AND_STATUS_REG, BASR_DRQ, BASR_DRQ,
-			     BUS_AND_STATUS_REG, BASR_PHASE_MATCH, 0, 0) < 0) {
-				result = -1;
-				shost_printk(KERN_ERR, instance, "PDMA write: DRQ and phase timeout\n");
+	if ((hostdata->flags & FLAG_DMA_FIXUP) &&
+	    (NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH)) {
+		/*
+		 * The workaround was to transfer fewer bytes than we
+		 * intended to with the pseudo-DMA receive function, wait for
+		 * the chip to latch the last byte, read it, and then disable
+		 * DMA mode.
+		 *
+		 * After REQ is asserted, the NCR5380 asserts DRQ and ACK.
+		 * REQ is deasserted when ACK is asserted, and not reasserted
+		 * until ACK goes false. Since the NCR5380 won't lower ACK
+		 * until DACK is asserted, which won't happen unless we twiddle
+		 * the DMA port or we take the NCR5380 out of DMA mode, we
+		 * can guarantee that we won't handshake another extra
+		 * byte.
+		 *
+		 * If sending, wait for the last byte to be sent. If REQ is
+		 * being asserted for the byte we're interested, we'll ACK it
+		 * and it will go false.
+		 */
+		if (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
+					   BASR_DRQ, BASR_DRQ, 0)) {
+			if ((p & SR_IO) &&
+			    (NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH)) {
+				if (!NCR5380_poll_politely(hostdata, STATUS_REG,
+							   SR_REQ, 0, 0)) {
+					d[c] = NCR5380_read(INPUT_DATA_REG);
+					--ncmd->this_residual;
+				} else {
+					result = -1;
+					scmd_printk(KERN_ERR, hostdata->connected,
+						    "PDMA fixup: !REQ timeout\n");
+				}
 			}
+		} else if (NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH) {
+			result = -1;
+			scmd_printk(KERN_ERR, hostdata->connected,
+				    "PDMA fixup: DRQ timeout\n");
 		}
 	}
 
@@ -1807,8 +1807,11 @@
 				return;
 			case PHASE_MSGIN:
 				len = 1;
+				tmp = 0xff;
 				data = &tmp;
 				NCR5380_transfer_pio(instance, &phase, &len, &data, 0);
+				if (tmp == 0xff)
+					break;
 				ncmd->message = tmp;
 
 				switch (tmp) {
@@ -1996,6 +1999,7 @@
 				break;
 			case PHASE_STATIN:
 				len = 1;
+				tmp = ncmd->status;
 				data = &tmp;
 				NCR5380_transfer_pio(instance, &phase, &len, &data, 0);
 				ncmd->status = tmp;
--- linux-qcom-6.8.0.orig/drivers/scsi/aacraid/aachba.c
+++ linux-qcom-6.8.0/drivers/scsi/aacraid/aachba.c
@@ -1267,7 +1267,7 @@
 			return ret;
 		command = ContainerRawIo;
 		fibsize = sizeof(struct aac_raw_io) +
-			((le32_to_cpu(readcmd->sg.count)-1) * sizeof(struct sgentryraw));
+			(le32_to_cpu(readcmd->sg.count) * sizeof(struct sgentryraw));
 	}
 
 	BUG_ON(fibsize > (fib->dev->max_fib_size - sizeof(struct aac_fibhdr)));
@@ -1302,7 +1302,7 @@
 	if (ret < 0)
 		return ret;
 	fibsize = sizeof(struct aac_read64) +
-		((le32_to_cpu(readcmd->sg.count) - 1) *
+		(le32_to_cpu(readcmd->sg.count) *
 		 sizeof (struct sgentry64));
 	BUG_ON (fibsize > (fib->dev->max_fib_size -
 				sizeof(struct aac_fibhdr)));
@@ -1337,7 +1337,7 @@
 	if (ret < 0)
 		return ret;
 	fibsize = sizeof(struct aac_read) +
-			((le32_to_cpu(readcmd->sg.count) - 1) *
+			(le32_to_cpu(readcmd->sg.count) *
 			 sizeof (struct sgentry));
 	BUG_ON (fibsize > (fib->dev->max_fib_size -
 				sizeof(struct aac_fibhdr)));
@@ -1401,7 +1401,7 @@
 			return ret;
 		command = ContainerRawIo;
 		fibsize = sizeof(struct aac_raw_io) +
-			((le32_to_cpu(writecmd->sg.count)-1) * sizeof (struct sgentryraw));
+			(le32_to_cpu(writecmd->sg.count) * sizeof(struct sgentryraw));
 	}
 
 	BUG_ON(fibsize > (fib->dev->max_fib_size - sizeof(struct aac_fibhdr)));
@@ -1436,7 +1436,7 @@
 	if (ret < 0)
 		return ret;
 	fibsize = sizeof(struct aac_write64) +
-		((le32_to_cpu(writecmd->sg.count) - 1) *
+		(le32_to_cpu(writecmd->sg.count) *
 		 sizeof (struct sgentry64));
 	BUG_ON (fibsize > (fib->dev->max_fib_size -
 				sizeof(struct aac_fibhdr)));
@@ -1473,7 +1473,7 @@
 	if (ret < 0)
 		return ret;
 	fibsize = sizeof(struct aac_write) +
-		((le32_to_cpu(writecmd->sg.count) - 1) *
+		(le32_to_cpu(writecmd->sg.count) *
 		 sizeof (struct sgentry));
 	BUG_ON (fibsize > (fib->dev->max_fib_size -
 				sizeof(struct aac_fibhdr)));
@@ -1592,9 +1592,9 @@
 	/*
 	 *	Build Scatter/Gather list
 	 */
-	fibsize = sizeof (struct aac_srb) - sizeof (struct sgentry) +
+	fibsize = sizeof(struct aac_srb) +
 		((le32_to_cpu(srbcmd->sg.count) & 0xff) *
-		 sizeof (struct sgentry64));
+		 sizeof(struct sgentry64));
 	BUG_ON (fibsize > (fib->dev->max_fib_size -
 				sizeof(struct aac_fibhdr)));
 
@@ -1624,7 +1624,7 @@
 	 *	Build Scatter/Gather list
 	 */
 	fibsize = sizeof (struct aac_srb) +
-		(((le32_to_cpu(srbcmd->sg.count) & 0xff) - 1) *
+		((le32_to_cpu(srbcmd->sg.count) & 0xff) *
 		 sizeof (struct sgentry));
 	BUG_ON (fibsize > (fib->dev->max_fib_size -
 				sizeof(struct aac_fibhdr)));
@@ -1693,8 +1693,7 @@
 	fibptr->hw_fib_va->header.XferState &=
 		~cpu_to_le32(FastResponseCapable);
 
-	fibsize  = sizeof(struct aac_srb) - sizeof(struct sgentry) +
-						sizeof(struct sgentry64);
+	fibsize = sizeof(struct aac_srb) + sizeof(struct sgentry64);
 
 	/* allocate DMA buffer for response */
 	addr = dma_map_single(&dev->pdev->dev, xfer_buf, xfer_len,
@@ -1833,7 +1832,7 @@
 	struct aac_ciss_phys_luns_resp *phys_luns;
 
 	datasize = sizeof(struct aac_ciss_phys_luns_resp) +
-		(AAC_MAX_TARGETS - 1) * sizeof(struct _ciss_lun);
+		AAC_MAX_TARGETS * sizeof(struct _ciss_lun);
 	phys_luns = kmalloc(datasize, GFP_KERNEL);
 	if (phys_luns == NULL)
 		goto out;
@@ -2267,7 +2266,7 @@
 		dev->a_ops.adapter_bounds = aac_bounds_32;
 		dev->scsi_host_ptr->sg_tablesize = (dev->max_fib_size -
 			sizeof(struct aac_fibhdr) -
-			sizeof(struct aac_write) + sizeof(struct sgentry)) /
+			sizeof(struct aac_write)) /
 				sizeof(struct sgentry);
 		if (dev->dac_support) {
 			dev->a_ops.adapter_read = aac_read_block64;
@@ -2278,8 +2277,7 @@
 			dev->scsi_host_ptr->sg_tablesize =
 				(dev->max_fib_size -
 				sizeof(struct aac_fibhdr) -
-				sizeof(struct aac_write64) +
-				sizeof(struct sgentry64)) /
+				sizeof(struct aac_write64)) /
 					sizeof(struct sgentry64);
 		} else {
 			dev->a_ops.adapter_read = aac_read_block;
--- linux-qcom-6.8.0.orig/drivers/scsi/aacraid/aacraid.h
+++ linux-qcom-6.8.0/drivers/scsi/aacraid/aacraid.h
@@ -322,7 +322,7 @@
 		u8	level3[2];
 		u8	level2[2];
 		u8	node_ident[16];	/* phys. node identifier */
-	} lun[1];			/* List of phys. devices */
+	} lun[];			/* List of phys. devices */
 };
 
 /*
@@ -507,32 +507,27 @@
 
 struct sgmap {
 	__le32		count;
-	struct sgentry	sg[1];
+	struct sgentry	sg[];
 };
 
 struct user_sgmap {
 	u32		count;
-	struct user_sgentry	sg[1];
+	struct user_sgentry	sg[];
 };
 
 struct sgmap64 {
 	__le32		count;
-	struct sgentry64 sg[1];
+	struct sgentry64 sg[];
 };
 
 struct user_sgmap64 {
 	u32		count;
-	struct user_sgentry64 sg[1];
+	struct user_sgentry64 sg[];
 };
 
 struct sgmapraw {
 	__le32		  count;
-	struct sgentryraw sg[1];
-};
-
-struct user_sgmapraw {
-	u32		  count;
-	struct user_sgentryraw sg[1];
+	struct sgentryraw sg[];
 };
 
 struct creation_info
@@ -873,7 +868,7 @@
 			__le16	element_count;
 			__le16	comp_thresh;
 			__le16	unused;
-		} rrq[1];		/* up to 64 RRQ addresses */
+		} rrq[] __counted_by_le(rr_queue_count); /* up to 64 RRQ addresses */
 	} r8;
 };
 
@@ -2029,8 +2024,8 @@
 };
 
 struct aac_srb_unit {
-	struct aac_srb		srb;
 	struct aac_srb_reply	srb_reply;
+	struct aac_srb		srb;
 };
 
 /*
--- linux-qcom-6.8.0.orig/drivers/scsi/aacraid/commctrl.c
+++ linux-qcom-6.8.0/drivers/scsi/aacraid/commctrl.c
@@ -523,7 +523,7 @@
 		goto cleanup;
 	}
 
-	if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) ||
+	if ((fibsize < sizeof(struct user_aac_srb)) ||
 	    (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) {
 		rcode = -EINVAL;
 		goto cleanup;
@@ -561,7 +561,7 @@
 		rcode = -EINVAL;
 		goto cleanup;
 	}
-	actual_fibsize = sizeof(struct aac_srb) - sizeof(struct sgentry) +
+	actual_fibsize = sizeof(struct aac_srb) +
 		((user_srbcmd->sg.count & 0xff) * sizeof(struct sgentry));
 	actual_fibsize64 = actual_fibsize + (user_srbcmd->sg.count & 0xff) *
 	  (sizeof(struct sgentry64) - sizeof(struct sgentry));
--- linux-qcom-6.8.0.orig/drivers/scsi/aacraid/comminit.c
+++ linux-qcom-6.8.0/drivers/scsi/aacraid/comminit.c
@@ -522,8 +522,7 @@
 	spin_lock_init(&dev->iq_lock);
 	dev->max_fib_size = sizeof(struct hw_fib);
 	dev->sg_tablesize = host->sg_tablesize = (dev->max_fib_size
-		- sizeof(struct aac_fibhdr)
-		- sizeof(struct aac_write) + sizeof(struct sgentry))
+		- sizeof(struct aac_fibhdr) - sizeof(struct aac_write))
 			/ sizeof(struct sgentry);
 	dev->comm_interface = AAC_COMM_PRODUCER;
 	dev->raw_io_interface = dev->raw_io_64 = 0;
@@ -642,6 +641,7 @@
 
 	if (aac_comm_init(dev)<0){
 		kfree(dev->queues);
+		dev->queues = NULL;
 		return NULL;
 	}
 	/*
@@ -649,6 +649,7 @@
 	 */
 	if (aac_fib_setup(dev) < 0) {
 		kfree(dev->queues);
+		dev->queues = NULL;
 		return NULL;
 	}
 		
--- linux-qcom-6.8.0.orig/drivers/scsi/aacraid/commsup.c
+++ linux-qcom-6.8.0/drivers/scsi/aacraid/commsup.c
@@ -2327,8 +2327,9 @@
 	sg64->sg[0].addr[0] = cpu_to_le32((u32)(addr & 0xffffffff));
 	sg64->sg[0].count = cpu_to_le32(datasize);
 
-	ret = aac_fib_send(ScsiPortCommand64, fibptr, sizeof(struct aac_srb),
-				FsaNormal, 1, 1, NULL, NULL);
+	ret = aac_fib_send(ScsiPortCommand64, fibptr,
+			   sizeof(struct aac_srb) + sizeof(struct sgentry),
+			   FsaNormal, 1, 1, NULL, NULL);
 
 	dma_free_coherent(&dev->pdev->dev, datasize, dma_buf, addr);
 
--- linux-qcom-6.8.0.orig/drivers/scsi/aacraid/src.c
+++ linux-qcom-6.8.0/drivers/scsi/aacraid/src.c
@@ -410,7 +410,7 @@
 			lower_32_bits(dev->init_pa),
 			upper_32_bits(dev->init_pa),
 			sizeof(struct _r8) +
-			(AAC_MAX_HRRQ - 1) * sizeof(struct _rrq),
+			AAC_MAX_HRRQ * sizeof(struct _rrq),
 			0, 0, 0, NULL, NULL, NULL, NULL, NULL);
 	} else {
 		init->r7.host_elapsed_seconds =
--- linux-qcom-6.8.0.orig/drivers/scsi/bfa/bfa.h
+++ linux-qcom-6.8.0/drivers/scsi/bfa/bfa.h
@@ -20,7 +20,6 @@
 struct bfa_s;
 
 typedef void (*bfa_isr_func_t) (struct bfa_s *bfa, struct bfi_msg_s *m);
-typedef void (*bfa_cb_cbfn_status_t) (void *cbarg, bfa_status_t status);
 
 /*
  * Interrupt message handlers
@@ -435,6 +434,14 @@
 	(__qe)->hcb_qe.cbarg = (__cbarg);			\
 	(__qe)->hcb_qe.pre_rmv = BFA_TRUE;			\
 	(__qe)->data = (__data);				\
+} while (0)
+
+#define bfa_pending_q_init_status(__qe, __cbfn, __cbarg, __data) do {	\
+	bfa_q_qe_init(&((__qe)->hcb_qe.qe));			\
+	(__qe)->hcb_qe.cbfn_status = (__cbfn);			\
+	(__qe)->hcb_qe.cbarg = (__cbarg);			\
+	(__qe)->hcb_qe.pre_rmv = BFA_TRUE;			\
+	(__qe)->data = (__data);				\
 } while (0)
 
 #endif /* __BFA_H__ */
--- linux-qcom-6.8.0.orig/drivers/scsi/bfa/bfa_core.c
+++ linux-qcom-6.8.0/drivers/scsi/bfa/bfa_core.c
@@ -1907,15 +1907,13 @@
 	struct list_head		*qe;
 	struct list_head		*qen;
 	struct bfa_cb_qe_s	*hcb_qe;
-	bfa_cb_cbfn_status_t	cbfn;
 
 	list_for_each_safe(qe, qen, comp_q) {
 		hcb_qe = (struct bfa_cb_qe_s *) qe;
 		if (hcb_qe->pre_rmv) {
 			/* qe is invalid after return, dequeue before cbfn() */
 			list_del(qe);
-			cbfn = (bfa_cb_cbfn_status_t)(hcb_qe->cbfn);
-			cbfn(hcb_qe->cbarg, hcb_qe->fw_status);
+			hcb_qe->cbfn_status(hcb_qe->cbarg, hcb_qe->fw_status);
 		} else
 			hcb_qe->cbfn(hcb_qe->cbarg, BFA_TRUE);
 	}
--- linux-qcom-6.8.0.orig/drivers/scsi/bfa/bfa_ioc.h
+++ linux-qcom-6.8.0/drivers/scsi/bfa/bfa_ioc.h
@@ -361,14 +361,18 @@
 	void	*cbarg;
 };
 
-typedef void	(*bfa_cb_cbfn_t) (void *cbarg, bfa_boolean_t complete);
+typedef void (*bfa_cb_cbfn_t) (void *cbarg, bfa_boolean_t complete);
+typedef void (*bfa_cb_cbfn_status_t) (void *cbarg, bfa_status_t status);
 
 /*
  * Generic BFA callback element.
  */
 struct bfa_cb_qe_s {
 	struct list_head	qe;
-	bfa_cb_cbfn_t	cbfn;
+	union {
+		bfa_cb_cbfn_status_t	cbfn_status;
+		bfa_cb_cbfn_t		cbfn;
+	};
 	bfa_boolean_t	once;
 	bfa_boolean_t	pre_rmv;	/* set for stack based qe(s) */
 	bfa_status_t	fw_status;	/* to access fw status in comp proc */
--- linux-qcom-6.8.0.orig/drivers/scsi/bfa/bfad.c
+++ linux-qcom-6.8.0/drivers/scsi/bfa/bfad.c
@@ -1693,9 +1693,8 @@
 
 	error = bfad_im_module_init();
 	if (error) {
-		error = -ENOMEM;
 		printk(KERN_WARNING "bfad_im_module_init failure\n");
-		goto ext;
+		return -ENOMEM;
 	}
 
 	if (strcmp(FCPI_NAME, " fcpim") == 0)
--- linux-qcom-6.8.0.orig/drivers/scsi/bfa/bfad_bsg.c
+++ linux-qcom-6.8.0/drivers/scsi/bfa/bfad_bsg.c
@@ -2135,8 +2135,7 @@
 	struct bfa_cb_pending_q_s cb_qe;
 
 	init_completion(&fcomp.comp);
-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp,
-			   &fcomp, &iocmd->stats);
+	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, &iocmd->stats);
 	spin_lock_irqsave(&bfad->bfad_lock, flags);
 	iocmd->status = bfa_fcport_get_stats(&bfad->bfa, &cb_qe);
 	spin_unlock_irqrestore(&bfad->bfad_lock, flags);
@@ -2159,7 +2158,7 @@
 	struct bfa_cb_pending_q_s cb_qe;
 
 	init_completion(&fcomp.comp);
-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp, &fcomp, NULL);
+	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, NULL);
 
 	spin_lock_irqsave(&bfad->bfad_lock, flags);
 	iocmd->status = bfa_fcport_clear_stats(&bfad->bfa, &cb_qe);
@@ -2443,8 +2442,7 @@
 	struct bfa_fcport_s *fcport = BFA_FCPORT_MOD(&bfad->bfa);
 
 	init_completion(&fcomp.comp);
-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp,
-			   &fcomp, &iocmd->stats);
+	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, &iocmd->stats);
 
 	spin_lock_irqsave(&bfad->bfad_lock, flags);
 	WARN_ON(!bfa_ioc_get_fcmode(&bfad->bfa.ioc));
@@ -2474,8 +2472,7 @@
 	struct bfa_fcport_s *fcport = BFA_FCPORT_MOD(&bfad->bfa);
 
 	init_completion(&fcomp.comp);
-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp,
-			   &fcomp, NULL);
+	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, NULL);
 
 	spin_lock_irqsave(&bfad->bfad_lock, flags);
 	WARN_ON(!bfa_ioc_get_fcmode(&bfad->bfa.ioc));
--- linux-qcom-6.8.0.orig/drivers/scsi/bfa/bfad_debugfs.c
+++ linux-qcom-6.8.0/drivers/scsi/bfa/bfad_debugfs.c
@@ -250,7 +250,7 @@
 	unsigned long flags;
 	void *kern_buf;
 
-	kern_buf = memdup_user(buf, nbytes);
+	kern_buf = memdup_user_nul(buf, nbytes);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 
@@ -317,7 +317,7 @@
 	unsigned long flags;
 	void *kern_buf;
 
-	kern_buf = memdup_user(buf, nbytes);
+	kern_buf = memdup_user_nul(buf, nbytes);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 
--- linux-qcom-6.8.0.orig/drivers/scsi/bnx2fc/bnx2fc_tgt.c
+++ linux-qcom-6.8.0/drivers/scsi/bnx2fc/bnx2fc_tgt.c
@@ -833,7 +833,6 @@
 
 	BNX2FC_TGT_DBG(tgt, "Freeing up session resources\n");
 
-	spin_lock_bh(&tgt->cq_lock);
 	ctx_base_ptr = tgt->ctx_base;
 	tgt->ctx_base = NULL;
 
@@ -889,7 +888,6 @@
 				    tgt->sq, tgt->sq_dma);
 		tgt->sq = NULL;
 	}
-	spin_unlock_bh(&tgt->cq_lock);
 
 	if (ctx_base_ptr)
 		iounmap(ctx_base_ptr);
--- linux-qcom-6.8.0.orig/drivers/scsi/csiostor/csio_defs.h
+++ linux-qcom-6.8.0/drivers/scsi/csiostor/csio_defs.h
@@ -73,7 +73,21 @@
 #define csio_list_prev(elem)	(((struct list_head *)(elem))->prev)
 
 /* State machine */
-typedef void (*csio_sm_state_t)(void *, uint32_t);
+struct csio_lnode;
+
+/* State machine evets */
+enum csio_ln_ev {
+	CSIO_LNE_NONE = (uint32_t)0,
+	CSIO_LNE_LINKUP,
+	CSIO_LNE_FAB_INIT_DONE,
+	CSIO_LNE_LINK_DOWN,
+	CSIO_LNE_DOWN_LINK,
+	CSIO_LNE_LOGO,
+	CSIO_LNE_CLOSE,
+	CSIO_LNE_MAX_EVENT,
+};
+
+typedef void (*csio_sm_state_t)(struct csio_lnode *ln, enum csio_ln_ev evt);
 
 struct csio_sm {
 	struct list_head	sm_list;
@@ -83,7 +97,7 @@
 static inline void
 csio_set_state(void *smp, void *state)
 {
-	((struct csio_sm *)smp)->sm_state = (csio_sm_state_t)state;
+	((struct csio_sm *)smp)->sm_state = state;
 }
 
 static inline void
--- linux-qcom-6.8.0.orig/drivers/scsi/csiostor/csio_lnode.c
+++ linux-qcom-6.8.0/drivers/scsi/csiostor/csio_lnode.c
@@ -1095,7 +1095,7 @@
 int
 csio_is_lnode_ready(struct csio_lnode *ln)
 {
-	return (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready));
+	return (csio_get_state(ln) == csio_lns_ready);
 }
 
 /*****************************************************************************/
@@ -1366,15 +1366,15 @@
 void
 csio_lnode_state_to_str(struct csio_lnode *ln, int8_t *str)
 {
-	if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_uninit)) {
+	if (csio_get_state(ln) == csio_lns_uninit) {
 		strcpy(str, "UNINIT");
 		return;
 	}
-	if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready)) {
+	if (csio_get_state(ln) == csio_lns_ready) {
 		strcpy(str, "READY");
 		return;
 	}
-	if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_offline)) {
+	if (csio_get_state(ln) == csio_lns_offline) {
 		strcpy(str, "OFFLINE");
 		return;
 	}
--- linux-qcom-6.8.0.orig/drivers/scsi/csiostor/csio_lnode.h
+++ linux-qcom-6.8.0/drivers/scsi/csiostor/csio_lnode.h
@@ -53,19 +53,6 @@
 extern int csio_fcoe_rnodes;
 extern int csio_fdmi_enable;
 
-/* State machine evets */
-enum csio_ln_ev {
-	CSIO_LNE_NONE = (uint32_t)0,
-	CSIO_LNE_LINKUP,
-	CSIO_LNE_FAB_INIT_DONE,
-	CSIO_LNE_LINK_DOWN,
-	CSIO_LNE_DOWN_LINK,
-	CSIO_LNE_LOGO,
-	CSIO_LNE_CLOSE,
-	CSIO_LNE_MAX_EVENT,
-};
-
-
 struct csio_fcf_info {
 	struct list_head	list;
 	uint8_t			priority;
--- linux-qcom-6.8.0.orig/drivers/scsi/device_handler/scsi_dh_alua.c
+++ linux-qcom-6.8.0/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -414,28 +414,40 @@
 	}
 }
 
-static enum scsi_disposition alua_check_sense(struct scsi_device *sdev,
-					      struct scsi_sense_hdr *sense_hdr)
+static void alua_handle_state_transition(struct scsi_device *sdev)
 {
 	struct alua_dh_data *h = sdev->handler_data;
 	struct alua_port_group *pg;
 
+	rcu_read_lock();
+	pg = rcu_dereference(h->pg);
+	if (pg)
+		pg->state = SCSI_ACCESS_STATE_TRANSITIONING;
+	rcu_read_unlock();
+	alua_check(sdev, false);
+}
+
+static enum scsi_disposition alua_check_sense(struct scsi_device *sdev,
+					      struct scsi_sense_hdr *sense_hdr)
+{
 	switch (sense_hdr->sense_key) {
 	case NOT_READY:
 		if (sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x0a) {
 			/*
 			 * LUN Not Accessible - ALUA state transition
 			 */
-			rcu_read_lock();
-			pg = rcu_dereference(h->pg);
-			if (pg)
-				pg->state = SCSI_ACCESS_STATE_TRANSITIONING;
-			rcu_read_unlock();
-			alua_check(sdev, false);
+			alua_handle_state_transition(sdev);
 			return NEEDS_RETRY;
 		}
 		break;
 	case UNIT_ATTENTION:
+		if (sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x0a) {
+			/*
+			 * LUN Not Accessible - ALUA state transition
+			 */
+			alua_handle_state_transition(sdev);
+			return NEEDS_RETRY;
+		}
 		if (sense_hdr->asc == 0x29 && sense_hdr->ascq == 0x00) {
 			/*
 			 * Power On, Reset, or Bus Device Reset.
@@ -502,7 +514,8 @@
 
 	retval = scsi_test_unit_ready(sdev, ALUA_FAILOVER_TIMEOUT * HZ,
 				      ALUA_FAILOVER_RETRIES, &sense_hdr);
-	if (sense_hdr.sense_key == NOT_READY &&
+	if ((sense_hdr.sense_key == NOT_READY ||
+	     sense_hdr.sense_key == UNIT_ATTENTION) &&
 	    sense_hdr.asc == 0x04 && sense_hdr.ascq == 0x0a)
 		return SCSI_DH_RETRY;
 	else if (retval)
--- linux-qcom-6.8.0.orig/drivers/scsi/elx/libefc/efc_nport.c
+++ linux-qcom-6.8.0/drivers/scsi/elx/libefc/efc_nport.c
@@ -705,9 +705,9 @@
 	spin_lock_irqsave(&efc->lock, flags);
 	list_for_each_entry(nport, &domain->nport_list, list_entry) {
 		if (nport->wwpn == wwpn && nport->wwnn == wwnn) {
-			kref_put(&nport->ref, nport->release);
 			/* Shutdown this NPORT */
 			efc_sm_post_event(&nport->sm, EFC_EVT_SHUTDOWN, NULL);
+			kref_put(&nport->ref, nport->release);
 			break;
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/scsi/fnic/fnic_main.c
+++ linux-qcom-6.8.0/drivers/scsi/fnic/fnic_main.c
@@ -830,7 +830,6 @@
 		spin_lock_init(&fnic->vlans_lock);
 		INIT_WORK(&fnic->fip_frame_work, fnic_handle_fip_frame);
 		INIT_WORK(&fnic->event_work, fnic_handle_event);
-		INIT_WORK(&fnic->flush_work, fnic_flush_tx);
 		skb_queue_head_init(&fnic->fip_frame_queue);
 		INIT_LIST_HEAD(&fnic->evlist);
 		INIT_LIST_HEAD(&fnic->vlans);
@@ -948,6 +947,7 @@
 
 	INIT_WORK(&fnic->link_work, fnic_handle_link);
 	INIT_WORK(&fnic->frame_work, fnic_handle_frame);
+	INIT_WORK(&fnic->flush_work, fnic_flush_tx);
 	skb_queue_head_init(&fnic->frame_queue);
 	skb_queue_head_init(&fnic->tx_queue);
 
--- linux-qcom-6.8.0.orig/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ linux-qcom-6.8.0/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -1539,10 +1539,16 @@
 	/* Init and wait for PHYs to come up and all libsas event finished. */
 	for (phy_no = 0; phy_no < hisi_hba->n_phy; phy_no++) {
 		struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
+		struct asd_sas_phy *sas_phy = &phy->sas_phy;
 
-		if (!(hisi_hba->phy_state & BIT(phy_no)))
+		if (!sas_phy->phy->enabled)
 			continue;
 
+		if (!(hisi_hba->phy_state & BIT(phy_no))) {
+			hisi_sas_phy_enable(hisi_hba, phy_no, 1);
+			continue;
+		}
+
 		async_schedule_domain(hisi_sas_async_init_wait_phyup,
 				      phy, &async);
 	}
@@ -1573,7 +1579,7 @@
 		return -EPERM;
 	}
 
-	if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct)
+	if (hisi_sas_debugfs_enable)
 		hisi_hba->hw->debugfs_snapshot_regs(hisi_hba);
 
 	return 0;
@@ -1792,7 +1798,7 @@
 	if (dev_is_sata(device)) {
 		struct ata_link *link = &device->sata_dev.ap->link;
 
-		rc = ata_wait_after_reset(link, HISI_SAS_WAIT_PHYUP_TIMEOUT,
+		rc = ata_wait_after_reset(link, jiffies + HISI_SAS_WAIT_PHYUP_TIMEOUT,
 					  smp_ata_check_ready_type);
 	} else {
 		msleep(2000);
@@ -1961,10 +1967,18 @@
 	struct hisi_hba *hisi_hba = dev_to_hisi_hba(device);
 	struct hisi_sas_internal_abort_data *timeout = data;
 
-	if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct) {
-		down(&hisi_hba->sem);
+	if (hisi_sas_debugfs_enable) {
+		/*
+		 * If timeout occurs in device gone scenario, to avoid
+		 * circular dependency like:
+		 * hisi_sas_dev_gone() -> down() -> ... ->
+		 * hisi_sas_internal_abort_timeout() -> down().
+		 */
+		if (!timeout->rst_ha_timeout)
+			down(&hisi_hba->sem);
 		hisi_hba->hw->debugfs_snapshot_regs(hisi_hba);
-		up(&hisi_hba->sem);
+		if (!timeout->rst_ha_timeout)
+			up(&hisi_hba->sem);
 	}
 
 	if (task->task_state_flags & SAS_TASK_STATE_DONE) {
--- linux-qcom-6.8.0.orig/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ linux-qcom-6.8.0/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2244,7 +2244,15 @@
 	case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:
 		if ((dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) &&
 		    (sipc_rx_err_type & RX_FIS_STATUS_ERR_MSK)) {
-			ts->stat = SAS_PROTO_RESPONSE;
+			if (task->ata_task.use_ncq) {
+				struct domain_device *device = task->dev;
+				struct hisi_sas_device *sas_dev = device->lldd_dev;
+
+				sas_dev->dev_status = HISI_SAS_DEV_NCQ_ERR;
+				slot->abort = 1;
+			} else {
+				ts->stat = SAS_PROTO_RESPONSE;
+			}
 		} else if (dma_rx_err_type & RX_DATA_LEN_UNDERFLOW_MSK) {
 			ts->residual = trans_tx_fail_type;
 			ts->stat = SAS_DATA_UNDERRUN;
@@ -2485,6 +2493,7 @@
 	/* update rd_point */
 	cq->rd_point = rd_point;
 	hisi_sas_write32(hisi_hba, COMPL_Q_0_RD_PTR + (0x14 * queue), rd_point);
+	cond_resched();
 
 	return completed;
 }
@@ -3551,6 +3560,11 @@
 	return NULL;
 }
 
+static bool debugfs_dump_is_generated_v3_hw(void *p)
+{
+	return p ? true : false;
+}
+
 static void debugfs_print_reg_v3_hw(u32 *regs_val, struct seq_file *s,
 				    const struct hisi_sas_debugfs_reg *reg)
 {
@@ -3576,6 +3590,9 @@
 {
 	struct hisi_sas_debugfs_regs *global = s->private;
 
+	if (!debugfs_dump_is_generated_v3_hw(global->data))
+		return -EPERM;
+
 	debugfs_print_reg_v3_hw(global->data, s,
 				&debugfs_global_reg);
 
@@ -3587,6 +3604,9 @@
 {
 	struct hisi_sas_debugfs_regs *axi = s->private;
 
+	if (!debugfs_dump_is_generated_v3_hw(axi->data))
+		return -EPERM;
+
 	debugfs_print_reg_v3_hw(axi->data, s,
 				&debugfs_axi_reg);
 
@@ -3598,6 +3618,9 @@
 {
 	struct hisi_sas_debugfs_regs *ras = s->private;
 
+	if (!debugfs_dump_is_generated_v3_hw(ras->data))
+		return -EPERM;
+
 	debugfs_print_reg_v3_hw(ras->data, s,
 				&debugfs_ras_reg);
 
@@ -3610,6 +3633,9 @@
 	struct hisi_sas_debugfs_port *port = s->private;
 	const struct hisi_sas_debugfs_reg *reg_port = &debugfs_port_reg;
 
+	if (!debugfs_dump_is_generated_v3_hw(port->data))
+		return -EPERM;
+
 	debugfs_print_reg_v3_hw(port->data, s, reg_port);
 
 	return 0;
@@ -3665,6 +3691,9 @@
 	struct hisi_sas_debugfs_cq *debugfs_cq = s->private;
 	int slot;
 
+	if (!debugfs_dump_is_generated_v3_hw(debugfs_cq->complete_hdr))
+		return -EPERM;
+
 	for (slot = 0; slot < HISI_SAS_QUEUE_SLOTS; slot++)
 		debugfs_cq_show_slot_v3_hw(s, slot, debugfs_cq);
 
@@ -3686,8 +3715,12 @@
 
 static int debugfs_dq_v3_hw_show(struct seq_file *s, void *p)
 {
+	struct hisi_sas_debugfs_dq *debugfs_dq = s->private;
 	int slot;
 
+	if (!debugfs_dump_is_generated_v3_hw(debugfs_dq->hdr))
+		return -EPERM;
+
 	for (slot = 0; slot < HISI_SAS_QUEUE_SLOTS; slot++)
 		debugfs_dq_show_slot_v3_hw(s, slot, s->private);
 
@@ -3701,6 +3734,9 @@
 	struct hisi_sas_iost *iost = debugfs_iost->iost;
 	int i, max_command_entries = HISI_SAS_MAX_COMMANDS;
 
+	if (!debugfs_dump_is_generated_v3_hw(iost))
+		return -EPERM;
+
 	for (i = 0; i < max_command_entries; i++, iost++) {
 		__le64 *data = &iost->qw0;
 
@@ -3720,6 +3756,9 @@
 	int i, tab_idx;
 	__le64 *iost;
 
+	if (!debugfs_dump_is_generated_v3_hw(iost_cache))
+		return -EPERM;
+
 	for (i = 0; i < HISI_SAS_IOST_ITCT_CACHE_NUM; i++, iost_cache++) {
 		/*
 		 * Data struct of IOST cache:
@@ -3743,6 +3782,9 @@
 	struct hisi_sas_debugfs_itct *debugfs_itct = s->private;
 	struct hisi_sas_itct *itct = debugfs_itct->itct;
 
+	if (!debugfs_dump_is_generated_v3_hw(itct))
+		return -EPERM;
+
 	for (i = 0; i < HISI_SAS_MAX_ITCT_ENTRIES; i++, itct++) {
 		__le64 *data = &itct->qw0;
 
@@ -3762,6 +3804,9 @@
 	int i, tab_idx;
 	__le64 *itct;
 
+	if (!debugfs_dump_is_generated_v3_hw(itct_cache))
+		return -EPERM;
+
 	for (i = 0; i < HISI_SAS_IOST_ITCT_CACHE_NUM; i++, itct_cache++) {
 		/*
 		 * Data struct of ITCT cache:
@@ -3779,10 +3824,9 @@
 }
 DEFINE_SHOW_ATTRIBUTE(debugfs_itct_cache_v3_hw);
 
-static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)
+static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba, int index)
 {
 	u64 *debugfs_timestamp;
-	int dump_index = hisi_hba->debugfs_dump_index;
 	struct dentry *dump_dentry;
 	struct dentry *dentry;
 	char name[256];
@@ -3790,17 +3834,17 @@
 	int c;
 	int d;
 
-	snprintf(name, 256, "%d", dump_index);
+	snprintf(name, 256, "%d", index);
 
 	dump_dentry = debugfs_create_dir(name, hisi_hba->debugfs_dump_dentry);
 
-	debugfs_timestamp = &hisi_hba->debugfs_timestamp[dump_index];
+	debugfs_timestamp = &hisi_hba->debugfs_timestamp[index];
 
 	debugfs_create_u64("timestamp", 0400, dump_dentry,
 			   debugfs_timestamp);
 
 	debugfs_create_file("global", 0400, dump_dentry,
-			    &hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL],
+			    &hisi_hba->debugfs_regs[index][DEBUGFS_GLOBAL],
 			    &debugfs_global_v3_hw_fops);
 
 	/* Create port dir and files */
@@ -3809,7 +3853,7 @@
 		snprintf(name, 256, "%d", p);
 
 		debugfs_create_file(name, 0400, dentry,
-				    &hisi_hba->debugfs_port_reg[dump_index][p],
+				    &hisi_hba->debugfs_port_reg[index][p],
 				    &debugfs_port_v3_hw_fops);
 	}
 
@@ -3819,7 +3863,7 @@
 		snprintf(name, 256, "%d", c);
 
 		debugfs_create_file(name, 0400, dentry,
-				    &hisi_hba->debugfs_cq[dump_index][c],
+				    &hisi_hba->debugfs_cq[index][c],
 				    &debugfs_cq_v3_hw_fops);
 	}
 
@@ -3829,32 +3873,32 @@
 		snprintf(name, 256, "%d", d);
 
 		debugfs_create_file(name, 0400, dentry,
-				    &hisi_hba->debugfs_dq[dump_index][d],
+				    &hisi_hba->debugfs_dq[index][d],
 				    &debugfs_dq_v3_hw_fops);
 	}
 
 	debugfs_create_file("iost", 0400, dump_dentry,
-			    &hisi_hba->debugfs_iost[dump_index],
+			    &hisi_hba->debugfs_iost[index],
 			    &debugfs_iost_v3_hw_fops);
 
 	debugfs_create_file("iost_cache", 0400, dump_dentry,
-			    &hisi_hba->debugfs_iost_cache[dump_index],
+			    &hisi_hba->debugfs_iost_cache[index],
 			    &debugfs_iost_cache_v3_hw_fops);
 
 	debugfs_create_file("itct", 0400, dump_dentry,
-			    &hisi_hba->debugfs_itct[dump_index],
+			    &hisi_hba->debugfs_itct[index],
 			    &debugfs_itct_v3_hw_fops);
 
 	debugfs_create_file("itct_cache", 0400, dump_dentry,
-			    &hisi_hba->debugfs_itct_cache[dump_index],
+			    &hisi_hba->debugfs_itct_cache[index],
 			    &debugfs_itct_cache_v3_hw_fops);
 
 	debugfs_create_file("axi", 0400, dump_dentry,
-			    &hisi_hba->debugfs_regs[dump_index][DEBUGFS_AXI],
+			    &hisi_hba->debugfs_regs[index][DEBUGFS_AXI],
 			    &debugfs_axi_v3_hw_fops);
 
 	debugfs_create_file("ras", 0400, dump_dentry,
-			    &hisi_hba->debugfs_regs[dump_index][DEBUGFS_RAS],
+			    &hisi_hba->debugfs_regs[index][DEBUGFS_RAS],
 			    &debugfs_ras_v3_hw_fops);
 }
 
@@ -4517,22 +4561,34 @@
 	int i;
 
 	devm_kfree(dev, hisi_hba->debugfs_iost_cache[dump_index].cache);
+	hisi_hba->debugfs_iost_cache[dump_index].cache = NULL;
 	devm_kfree(dev, hisi_hba->debugfs_itct_cache[dump_index].cache);
+	hisi_hba->debugfs_itct_cache[dump_index].cache = NULL;
 	devm_kfree(dev, hisi_hba->debugfs_iost[dump_index].iost);
+	hisi_hba->debugfs_iost[dump_index].iost = NULL;
 	devm_kfree(dev, hisi_hba->debugfs_itct[dump_index].itct);
+	hisi_hba->debugfs_itct[dump_index].itct = NULL;
 
-	for (i = 0; i < hisi_hba->queue_count; i++)
+	for (i = 0; i < hisi_hba->queue_count; i++) {
 		devm_kfree(dev, hisi_hba->debugfs_dq[dump_index][i].hdr);
+		hisi_hba->debugfs_dq[dump_index][i].hdr = NULL;
+	}
 
-	for (i = 0; i < hisi_hba->queue_count; i++)
+	for (i = 0; i < hisi_hba->queue_count; i++) {
 		devm_kfree(dev,
 			   hisi_hba->debugfs_cq[dump_index][i].complete_hdr);
+		hisi_hba->debugfs_cq[dump_index][i].complete_hdr = NULL;
+	}
 
-	for (i = 0; i < DEBUGFS_REGS_NUM; i++)
+	for (i = 0; i < DEBUGFS_REGS_NUM; i++) {
 		devm_kfree(dev, hisi_hba->debugfs_regs[dump_index][i].data);
+		hisi_hba->debugfs_regs[dump_index][i].data = NULL;
+	}
 
-	for (i = 0; i < hisi_hba->n_phy; i++)
+	for (i = 0; i < hisi_hba->n_phy; i++) {
 		devm_kfree(dev, hisi_hba->debugfs_port_reg[dump_index][i].data);
+		hisi_hba->debugfs_port_reg[dump_index][i].data = NULL;
+	}
 }
 
 static const struct hisi_sas_debugfs_reg *debugfs_reg_array_v3_hw[DEBUGFS_REGS_NUM] = {
@@ -4659,8 +4715,6 @@
 	debugfs_snapshot_itct_reg_v3_hw(hisi_hba);
 	debugfs_snapshot_iost_reg_v3_hw(hisi_hba);
 
-	debugfs_create_files_v3_hw(hisi_hba);
-
 	debugfs_snapshot_restore_v3_hw(hisi_hba);
 	hisi_hba->debugfs_dump_index++;
 
@@ -4744,6 +4798,17 @@
 	hisi_hba->debugfs_bist_linkrate = SAS_LINK_RATE_1_5_GBPS;
 }
 
+static void debugfs_dump_init_v3_hw(struct hisi_hba *hisi_hba)
+{
+	int i;
+
+	hisi_hba->debugfs_dump_dentry =
+			debugfs_create_dir("dump", hisi_hba->debugfs_dir);
+
+	for (i = 0; i < hisi_sas_debugfs_dump_count; i++)
+		debugfs_create_files_v3_hw(hisi_hba, i);
+}
+
 static void debugfs_exit_v3_hw(struct hisi_hba *hisi_hba)
 {
 	debugfs_remove_recursive(hisi_hba->debugfs_dir);
@@ -4764,8 +4829,7 @@
 	/* create bist structures */
 	debugfs_bist_init_v3_hw(hisi_hba);
 
-	hisi_hba->debugfs_dump_dentry =
-			debugfs_create_dir("dump", hisi_hba->debugfs_dir);
+	debugfs_dump_init_v3_hw(hisi_hba);
 
 	debugfs_phy_down_cnt_init_v3_hw(hisi_hba);
 	debugfs_fifo_init_v3_hw(hisi_hba);
--- linux-qcom-6.8.0.orig/drivers/scsi/hosts.c
+++ linux-qcom-6.8.0/drivers/scsi/hosts.c
@@ -353,12 +353,13 @@
 
 	if (shost->shost_state == SHOST_CREATED) {
 		/*
-		 * Free the shost_dev device name here if scsi_host_alloc()
-		 * and scsi_host_put() have been called but neither
+		 * Free the shost_dev device name and remove the proc host dir
+		 * here if scsi_host_{alloc,put}() have been called but neither
 		 * scsi_host_add() nor scsi_remove_host() has been called.
 		 * This avoids that the memory allocated for the shost_dev
-		 * name is leaked.
+		 * name as well as the proc dir structure are leaked.
 		 */
+		scsi_proc_hostdir_rm(shost->hostt);
 		kfree(dev_name(&shost->shost_dev));
 	}
 
--- linux-qcom-6.8.0.orig/drivers/scsi/hpsa.c
+++ linux-qcom-6.8.0/drivers/scsi/hpsa.c
@@ -5850,7 +5850,7 @@
 {
 	struct Scsi_Host *sh;
 
-	sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info));
+	sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info *));
 	if (sh == NULL) {
 		dev_err(&h->pdev->dev, "scsi_host_alloc failed\n");
 		return -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/scsi/libsas/sas_ata.c
+++ linux-qcom-6.8.0/drivers/scsi/libsas/sas_ata.c
@@ -610,15 +610,15 @@
 
 	rc = ata_sas_tport_add(ata_host->dev, ap);
 	if (rc)
-		goto destroy_port;
+		goto free_port;
 
 	found_dev->sata_dev.ata_host = ata_host;
 	found_dev->sata_dev.ap = ap;
 
 	return 0;
 
-destroy_port:
-	kfree(ap);
+free_port:
+	ata_port_free(ap);
 free_host:
 	ata_host_put(ata_host);
 	return rc;
--- linux-qcom-6.8.0.orig/drivers/scsi/libsas/sas_discover.c
+++ linux-qcom-6.8.0/drivers/scsi/libsas/sas_discover.c
@@ -301,7 +301,7 @@
 
 	if (dev_is_sata(dev) && dev->sata_dev.ap) {
 		ata_sas_tport_delete(dev->sata_dev.ap);
-		kfree(dev->sata_dev.ap);
+		ata_port_free(dev->sata_dev.ap);
 		ata_host_put(dev->sata_dev.ata_host);
 		dev->sata_dev.ata_host = NULL;
 		dev->sata_dev.ap = NULL;
--- linux-qcom-6.8.0.orig/drivers/scsi/libsas/sas_expander.c
+++ linux-qcom-6.8.0/drivers/scsi/libsas/sas_expander.c
@@ -135,7 +135,7 @@
 
 static inline void *alloc_smp_req(int size)
 {
-	u8 *p = kzalloc(size, GFP_KERNEL);
+	u8 *p = kzalloc(ALIGN(size, ARCH_DMA_MINALIGN), GFP_KERNEL);
 	if (p)
 		p[0] = SMP_REQUEST;
 	return p;
@@ -239,8 +239,7 @@
 	/* help some expanders that fail to zero sas_address in the 'no
 	 * device' case
 	 */
-	if (phy->attached_dev_type == SAS_PHY_UNUSED ||
-	    phy->linkrate < SAS_LINK_RATE_1_5_GBPS)
+	if (phy->attached_dev_type == SAS_PHY_UNUSED)
 		memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
 	else
 		memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
@@ -1621,6 +1620,16 @@
 
 /* ---------- Domain revalidation ---------- */
 
+static void sas_get_sas_addr_and_dev_type(struct smp_disc_resp *disc_resp,
+					  u8 *sas_addr,
+					  enum sas_device_type *type)
+{
+	memcpy(sas_addr, disc_resp->disc.attached_sas_addr, SAS_ADDR_SIZE);
+	*type = to_dev_type(&disc_resp->disc);
+	if (*type == SAS_PHY_UNUSED)
+		memset(sas_addr, 0, SAS_ADDR_SIZE);
+}
+
 static int sas_get_phy_discover(struct domain_device *dev,
 				int phy_id, struct smp_disc_resp *disc_resp)
 {
@@ -1674,13 +1683,8 @@
 		return -ENOMEM;
 
 	res = sas_get_phy_discover(dev, phy_id, disc_resp);
-	if (res == 0) {
-		memcpy(sas_addr, disc_resp->disc.attached_sas_addr,
-		       SAS_ADDR_SIZE);
-		*type = to_dev_type(&disc_resp->disc);
-		if (*type == 0)
-			memset(sas_addr, 0, SAS_ADDR_SIZE);
-	}
+	if (res == 0)
+		sas_get_sas_addr_and_dev_type(disc_resp, sas_addr, type);
 	kfree(disc_resp);
 	return res;
 }
@@ -1940,6 +1944,7 @@
 	struct expander_device *ex = &dev->ex_dev;
 	struct ex_phy *phy = &ex->ex_phy[phy_id];
 	enum sas_device_type type = SAS_PHY_UNUSED;
+	struct smp_disc_resp *disc_resp;
 	u8 sas_addr[SAS_ADDR_SIZE];
 	char msg[80] = "";
 	int res;
@@ -1951,33 +1956,41 @@
 		 SAS_ADDR(dev->sas_addr), phy_id, msg);
 
 	memset(sas_addr, 0, SAS_ADDR_SIZE);
-	res = sas_get_phy_attached_dev(dev, phy_id, sas_addr, &type);
+	disc_resp = alloc_smp_resp(DISCOVER_RESP_SIZE);
+	if (!disc_resp)
+		return -ENOMEM;
+
+	res = sas_get_phy_discover(dev, phy_id, disc_resp);
 	switch (res) {
 	case SMP_RESP_NO_PHY:
 		phy->phy_state = PHY_NOT_PRESENT;
 		sas_unregister_devs_sas_addr(dev, phy_id, last);
-		return res;
+		goto out_free_resp;
 	case SMP_RESP_PHY_VACANT:
 		phy->phy_state = PHY_VACANT;
 		sas_unregister_devs_sas_addr(dev, phy_id, last);
-		return res;
+		goto out_free_resp;
 	case SMP_RESP_FUNC_ACC:
 		break;
 	case -ECOMM:
 		break;
 	default:
-		return res;
+		goto out_free_resp;
 	}
 
+	if (res == 0)
+		sas_get_sas_addr_and_dev_type(disc_resp, sas_addr, &type);
+
 	if ((SAS_ADDR(sas_addr) == 0) || (res == -ECOMM)) {
 		phy->phy_state = PHY_EMPTY;
 		sas_unregister_devs_sas_addr(dev, phy_id, last);
 		/*
-		 * Even though the PHY is empty, for convenience we discover
-		 * the PHY to update the PHY info, like negotiated linkrate.
+		 * Even though the PHY is empty, for convenience we update
+		 * the PHY info, like negotiated linkrate.
 		 */
-		sas_ex_phy_discover(dev, phy_id);
-		return res;
+		if (res == 0)
+			sas_set_ex_phy(dev, phy_id, disc_resp);
+		goto out_free_resp;
 	} else if (SAS_ADDR(sas_addr) == SAS_ADDR(phy->attached_sas_addr) &&
 		   dev_type_flutter(type, phy->attached_dev_type)) {
 		struct domain_device *ata_dev = sas_ex_to_ata(dev, phy_id);
@@ -1989,7 +2002,7 @@
 			action = ", needs recovery";
 		pr_debug("ex %016llx phy%02d broadcast flutter%s\n",
 			 SAS_ADDR(dev->sas_addr), phy_id, action);
-		return res;
+		goto out_free_resp;
 	}
 
 	/* we always have to delete the old device when we went here */
@@ -1998,7 +2011,10 @@
 		SAS_ADDR(phy->attached_sas_addr));
 	sas_unregister_devs_sas_addr(dev, phy_id, last);
 
-	return sas_discover_new(dev, phy_id);
+	res = sas_discover_new(dev, phy_id);
+out_free_resp:
+	kfree(disc_resp);
+	return res;
 }
 
 /**
--- linux-qcom-6.8.0.orig/drivers/scsi/libsas/sas_internal.h
+++ linux-qcom-6.8.0/drivers/scsi/libsas/sas_internal.h
@@ -145,6 +145,20 @@
 		func, dev->parent ? "exp-attached" :
 		"direct-attached",
 		SAS_ADDR(dev->sas_addr), err);
+
+	/*
+	 * If the device probe failed, the expander phy attached address
+	 * needs to be reset so that the phy will not be treated as flutter
+	 * in the next revalidation
+	 */
+	if (dev->parent && !dev_is_expander(dev->dev_type)) {
+		struct sas_phy *phy = dev->phy;
+		struct domain_device *parent = dev->parent;
+		struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number];
+
+		memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+	}
+
 	sas_unregister_dev(dev->port, dev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/scsi/libsas/sas_scsi_host.c
+++ linux-qcom-6.8.0/drivers/scsi/libsas/sas_scsi_host.c
@@ -431,6 +431,9 @@
 	struct sas_internal *i = to_sas_internal(host->transportt);
 	unsigned long flags;
 
+	if (current != host->ehandler)
+		return FAILED;
+
 	if (!i->dft->lldd_abort_task)
 		return FAILED;
 
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc.h
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc.h
@@ -306,6 +306,14 @@
 
 struct lpfc_hba;
 
+/* Data structure to keep withheld FLOGI_ACC information */
+struct lpfc_defer_flogi_acc {
+	bool flag;
+	u16 rx_id;
+	u16 ox_id;
+	struct lpfc_nodelist *ndlp;
+
+};
 
 #define LPFC_VMID_TIMER   300	/* timer interval in seconds */
 
@@ -1325,7 +1333,6 @@
 	struct timer_list fabric_block_timer;
 	unsigned long bit_flags;
 	atomic_t num_rsrc_err;
-	atomic_t num_cmd_success;
 	unsigned long last_rsrc_error_time;
 	unsigned long last_ramp_down_time;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
@@ -1419,9 +1426,7 @@
 	uint16_t vlan_id;
 	struct list_head fcf_conn_rec_list;
 
-	bool defer_flogi_acc_flag;
-	uint16_t defer_flogi_acc_rx_id;
-	uint16_t defer_flogi_acc_ox_id;
+	struct lpfc_defer_flogi_acc defer_flogi_acc;
 
 	spinlock_t ct_ev_lock; /* synchronize access to ct_ev_waiters */
 	struct list_head ct_ev_waiters;
@@ -1430,6 +1435,7 @@
 	struct timer_list inactive_vmid_poll;
 
 	/* RAS Support */
+	spinlock_t ras_fwlog_lock; /* do not take while holding another lock */
 	struct lpfc_ras_fwlog ras_fwlog;
 
 	uint32_t iocb_cnt;
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_attr.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_attr.c
@@ -1904,6 +1904,11 @@
 
 	/* Get transceiver information */
 	rdp_context = kmalloc(sizeof(*rdp_context), GFP_KERNEL);
+	if (!rdp_context) {
+		len = scnprintf(buf, PAGE_SIZE - len,
+				"SPF info NA: alloc failure\n");
+		return len;
+	}
 
 	rc = lpfc_get_sfp_info_wait(phba, rdp_context);
 	if (rc) {
@@ -5864,9 +5869,9 @@
 	if (phba->cfg_ras_fwlog_func != PCI_FUNC(phba->pcidev->devfn))
 		return -EINVAL;
 
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	state = phba->ras_fwlog.state;
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 
 	if (state == REG_INPROGRESS) {
 		lpfc_printf_log(phba, KERN_ERR, LOG_SLI, "6147 RAS Logging "
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_bsg.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_bsg.c
@@ -3169,10 +3169,10 @@
 	}
 
 	cmdwqe = &cmdiocbq->wqe;
-	memset(cmdwqe, 0, sizeof(union lpfc_wqe));
+	memset(cmdwqe, 0, sizeof(*cmdwqe));
 	if (phba->sli_rev < LPFC_SLI_REV4) {
 		rspwqe = &rspiocbq->wqe;
-		memset(rspwqe, 0, sizeof(union lpfc_wqe));
+		memset(rspwqe, 0, sizeof(*rspwqe));
 	}
 
 	INIT_LIST_HEAD(&head);
@@ -5070,12 +5070,12 @@
 		bsg_reply->reply_data.vendor_reply.vendor_rsp;
 
 	/* Current logging state */
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	if (ras_fwlog->state == ACTIVE)
 		ras_reply->state = LPFC_RASLOG_STATE_RUNNING;
 	else
 		ras_reply->state = LPFC_RASLOG_STATE_STOPPED;
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 
 	ras_reply->log_level = phba->ras_fwlog.fw_loglevel;
 	ras_reply->log_buff_sz = phba->cfg_ras_fwlog_buffsize;
@@ -5132,13 +5132,13 @@
 
 	if (action == LPFC_RASACTION_STOP_LOGGING) {
 		/* Check if already disabled */
-		spin_lock_irq(&phba->hbalock);
+		spin_lock_irq(&phba->ras_fwlog_lock);
 		if (ras_fwlog->state != ACTIVE) {
-			spin_unlock_irq(&phba->hbalock);
+			spin_unlock_irq(&phba->ras_fwlog_lock);
 			rc = -ESRCH;
 			goto ras_job_error;
 		}
-		spin_unlock_irq(&phba->hbalock);
+		spin_unlock_irq(&phba->ras_fwlog_lock);
 
 		/* Disable logging */
 		lpfc_ras_stop_fwlog(phba);
@@ -5149,10 +5149,10 @@
 		 * FW-logging with new log-level. Return status
 		 * "Logging already Running" to caller.
 		 **/
-		spin_lock_irq(&phba->hbalock);
+		spin_lock_irq(&phba->ras_fwlog_lock);
 		if (ras_fwlog->state != INACTIVE)
 			action_status = -EINPROGRESS;
-		spin_unlock_irq(&phba->hbalock);
+		spin_unlock_irq(&phba->ras_fwlog_lock);
 
 		/* Enable logging */
 		rc = lpfc_sli4_ras_fwlog_init(phba, log_level,
@@ -5268,13 +5268,13 @@
 		goto ras_job_error;
 
 	/* Logging to be stopped before reading */
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	if (ras_fwlog->state == ACTIVE) {
-		spin_unlock_irq(&phba->hbalock);
+		spin_unlock_irq(&phba->ras_fwlog_lock);
 		rc = -EINPROGRESS;
 		goto ras_job_error;
 	}
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 
 	if (job->request_len <
 	    sizeof(struct fc_bsg_request) +
@@ -5409,7 +5409,7 @@
 	struct get_cgnbuf_info_req *cgnbuf_req;
 	struct lpfc_cgn_info *cp;
 	uint8_t *cgn_buff;
-	int size, cinfosz;
+	size_t size, cinfosz;
 	int  rc = 0;
 
 	if (job->request_len < sizeof(struct fc_bsg_request) +
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_ct.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_ct.c
@@ -1596,8 +1596,8 @@
 			}
 		}
 	} else
-		lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
-				 "3065 GFT_ID failed x%08x\n", ulp_status);
+		lpfc_vlog_msg(vport, KERN_WARNING, LOG_DISCOVERY,
+			      "3065 GFT_ID status x%08x\n", ulp_status);
 
 out:
 	lpfc_ct_free_iocb(phba, cmdiocb);
@@ -1671,6 +1671,18 @@
 	}
 
 out:
+	/* If the caller wanted a synchronous DA_ID completion, signal the
+	 * wait obj and clear flag to reset the vport.
+	 */
+	if (ndlp->save_flags & NLP_WAIT_FOR_DA_ID) {
+		if (ndlp->da_id_waitq)
+			wake_up(ndlp->da_id_waitq);
+	}
+
+	spin_lock_irq(&ndlp->lock);
+	ndlp->save_flags &= ~NLP_WAIT_FOR_DA_ID;
+	spin_unlock_irq(&ndlp->lock);
+
 	lpfc_ct_free_iocb(phba, cmdiocb);
 	lpfc_nlp_put(ndlp);
 	return;
@@ -2238,6 +2250,11 @@
 		ulp_status, ulp_word4, latt);
 
 	if (latt || ulp_status) {
+		lpfc_printf_vlog(vport, KERN_WARNING, LOG_DISCOVERY,
+				 "0229 FDMI cmd %04x failed, latt = %d "
+				 "ulp_status: (x%x/x%x), sli_flag x%x\n",
+				 be16_to_cpu(fdmi_cmd), latt, ulp_status,
+				 ulp_word4, phba->sli.sli_flag);
 
 		/* Look for a retryable error */
 		if (ulp_status == IOSTAT_LOCAL_REJECT) {
@@ -2246,8 +2263,16 @@
 			case IOERR_SLI_DOWN:
 				/* Driver aborted this IO.  No retry as error
 				 * is likely Offline->Online or some adapter
-				 * error.  Recovery will try again.
+				 * error.  Recovery will try again, but if port
+				 * is not active there's no point to continue
+				 * issuing follow up FDMI commands.
 				 */
+				if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE)) {
+					free_ndlp = cmdiocb->ndlp;
+					lpfc_ct_free_iocb(phba, cmdiocb);
+					lpfc_nlp_put(free_ndlp);
+					return;
+				}
 				break;
 			case IOERR_ABORT_IN_PROGRESS:
 			case IOERR_SEQUENCE_TIMEOUT:
@@ -2268,12 +2293,6 @@
 				break;
 			}
 		}
-
-		lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
-				 "0229 FDMI cmd %04x failed, latt = %d "
-				 "ulp_status: x%x, rid x%x\n",
-				 be16_to_cpu(fdmi_cmd), latt, ulp_status,
-				 ulp_word4);
 	}
 
 	free_ndlp = cmdiocb->ndlp;
@@ -2287,9 +2306,9 @@
 	/* Check for a CT LS_RJT response */
 	cmd =  be16_to_cpu(fdmi_cmd);
 	if (be16_to_cpu(fdmi_rsp) == SLI_CT_RESPONSE_FS_RJT) {
-		/* FDMI rsp failed */
+		/* Log FDMI reject */
 		lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY | LOG_ELS,
-				 "0220 FDMI cmd failed FS_RJT Data: x%x", cmd);
+				 "0220 FDMI cmd FS_RJT Data: x%x", cmd);
 
 		/* Should we fallback to FDMI-2 / FDMI-1 ? */
 		switch (cmd) {
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_debugfs.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -2196,12 +2196,12 @@
 
 	memset(buffer, 0, size);
 
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	if (phba->ras_fwlog.state != ACTIVE) {
-		spin_unlock_irq(&phba->hbalock);
+		spin_unlock_irq(&phba->ras_fwlog_lock);
 		return -EINVAL;
 	}
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 
 	list_for_each_entry_safe(dmabuf, next,
 				 &phba->ras_fwlog.fwlog_buff_list, list) {
@@ -2252,13 +2252,13 @@
 	int size;
 	int rc = -ENOMEM;
 
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	if (phba->ras_fwlog.state != ACTIVE) {
-		spin_unlock_irq(&phba->hbalock);
+		spin_unlock_irq(&phba->ras_fwlog_lock);
 		rc = -EINVAL;
 		goto out;
 	}
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 
 	if (check_mul_overflow(LPFC_RAS_MIN_BUFF_POST_SIZE,
 			       phba->cfg_ras_fwlog_buffsize, &size))
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_disc.h
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_disc.h
@@ -90,6 +90,8 @@
 	NLP_IN_RECOV_POST_DEV_LOSS	= 0x1,
 	/* wait for outstanding LOGO to cmpl */
 	NLP_WAIT_FOR_LOGO		= 0x2,
+	/* wait for outstanding DA_ID to finish */
+	NLP_WAIT_FOR_DA_ID              = 0x4
 };
 
 struct lpfc_nodelist {
@@ -159,7 +161,12 @@
 	uint32_t nvme_fb_size; /* NVME target's supported byte cnt */
 #define NVME_FB_BIT_SHIFT 9    /* PRLI Rsp first burst in 512B units. */
 	uint32_t nlp_defer_did;
+
+	/* These wait objects are NPIV specific.  These IOs must complete
+	 * synchronously.
+	 */
 	wait_queue_head_t *logo_waitq;
+	wait_queue_head_t *da_id_waitq;
 };
 
 struct lpfc_node_rrq {
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_els.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_els.c
@@ -1007,7 +1007,7 @@
 				phba->fcoe_cvl_eventtag_attn =
 					phba->fcoe_cvl_eventtag;
 			lpfc_printf_log(phba, KERN_WARNING, LOG_FIP | LOG_ELS,
-					"2611 FLOGI failed on FCF (x%x), "
+					"2611 FLOGI FCF (x%x), "
 					"status:x%x/x%x, tmo:x%x, perform "
 					"roundrobin FCF failover\n",
 					phba->fcf.current_rec.fcf_indx,
@@ -1025,11 +1025,11 @@
 		if (!(ulp_status == IOSTAT_LOCAL_REJECT &&
 		      ((ulp_word4 & IOERR_PARAM_MASK) ==
 					IOERR_LOOP_OPEN_FAILURE)))
-			lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
-					 "2858 FLOGI failure Status:x%x/x%x TMO"
-					 ":x%x Data x%x x%x\n",
-					 ulp_status, ulp_word4, tmo,
-					 phba->hba_flag, phba->fcf.fcf_flag);
+			lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+				      "2858 FLOGI Status:x%x/x%x TMO"
+				      ":x%x Data x%x x%x\n",
+				      ulp_status, ulp_word4, tmo,
+				      phba->hba_flag, phba->fcf.fcf_flag);
 
 		/* Check for retry */
 		if (lpfc_els_retry(phba, cmdiocb, rspiocb)) {
@@ -1051,7 +1051,7 @@
 			lpfc_nlp_put(ndlp);
 
 		lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS,
-				 "0150 FLOGI failure Status:x%x/x%x "
+				 "0150 FLOGI Status:x%x/x%x "
 				 "xri x%x TMO:x%x refcnt %d\n",
 				 ulp_status, ulp_word4, cmdiocb->sli4_xritag,
 				 tmo, kref_read(&ndlp->kref));
@@ -1060,11 +1060,11 @@
 		if (!(ulp_status == IOSTAT_LOCAL_REJECT &&
 		      ((ulp_word4 & IOERR_PARAM_MASK) ==
 					IOERR_LOOP_OPEN_FAILURE))) {
-			/* FLOGI failure */
-			lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
-					 "0100 FLOGI failure Status:x%x/x%x "
-					 "TMO:x%x\n",
-					 ulp_status, ulp_word4, tmo);
+			/* Warn FLOGI status */
+			lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+				      "0100 FLOGI Status:x%x/x%x "
+				      "TMO:x%x\n",
+				      ulp_status, ulp_word4, tmo);
 			goto flogifail;
 		}
 
@@ -1418,7 +1418,7 @@
 	phba->link_flag &= ~LS_EXTERNAL_LOOPBACK;
 
 	/* Check for a deferred FLOGI ACC condition */
-	if (phba->defer_flogi_acc_flag) {
+	if (phba->defer_flogi_acc.flag) {
 		/* lookup ndlp for received FLOGI */
 		ndlp = lpfc_findnode_did(vport, 0);
 		if (!ndlp)
@@ -1432,34 +1432,38 @@
 		if (phba->sli_rev == LPFC_SLI_REV4) {
 			bf_set(wqe_ctxt_tag,
 			       &defer_flogi_acc.wqe.xmit_els_rsp.wqe_com,
-			       phba->defer_flogi_acc_rx_id);
+			       phba->defer_flogi_acc.rx_id);
 			bf_set(wqe_rcvoxid,
 			       &defer_flogi_acc.wqe.xmit_els_rsp.wqe_com,
-			       phba->defer_flogi_acc_ox_id);
+			       phba->defer_flogi_acc.ox_id);
 		} else {
 			icmd = &defer_flogi_acc.iocb;
-			icmd->ulpContext = phba->defer_flogi_acc_rx_id;
+			icmd->ulpContext = phba->defer_flogi_acc.rx_id;
 			icmd->unsli3.rcvsli3.ox_id =
-				phba->defer_flogi_acc_ox_id;
+				phba->defer_flogi_acc.ox_id;
 		}
 
 		lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
 				 "3354 Xmit deferred FLOGI ACC: rx_id: x%x,"
 				 " ox_id: x%x, hba_flag x%x\n",
-				 phba->defer_flogi_acc_rx_id,
-				 phba->defer_flogi_acc_ox_id, phba->hba_flag);
+				 phba->defer_flogi_acc.rx_id,
+				 phba->defer_flogi_acc.ox_id, phba->hba_flag);
 
 		/* Send deferred FLOGI ACC */
 		lpfc_els_rsp_acc(vport, ELS_CMD_FLOGI, &defer_flogi_acc,
 				 ndlp, NULL);
 
-		phba->defer_flogi_acc_flag = false;
-		vport->fc_myDID = did;
+		phba->defer_flogi_acc.flag = false;
 
-		/* Decrement ndlp reference count to indicate the node can be
-		 * released when other references are removed.
+		/* Decrement the held ndlp that was incremented when the
+		 * deferred flogi acc flag was set.
 		 */
-		lpfc_nlp_put(ndlp);
+		if (phba->defer_flogi_acc.ndlp) {
+			lpfc_nlp_put(phba->defer_flogi_acc.ndlp);
+			phba->defer_flogi_acc.ndlp = NULL;
+		}
+
+		vport->fc_myDID = did;
 	}
 
 	return 0;
@@ -1973,16 +1977,16 @@
 
 	if (ulp_status) {
 		/* Check for retry */
-		/* RRQ failed Don't print the vport to vport rjts */
+		/* Warn RRQ status Don't print the vport to vport rjts */
 		if (ulp_status != IOSTAT_LS_RJT ||
 		    (((ulp_word4) >> 16 != LSRJT_INVALID_CMD) &&
 		     ((ulp_word4) >> 16 != LSRJT_UNABLE_TPC)) ||
 		    (phba)->pport->cfg_log_verbose & LOG_ELS)
-			lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
-					 "2881 RRQ failure DID:%06X Status:"
-					 "x%x/x%x\n",
-					 ndlp->nlp_DID, ulp_status,
-					 ulp_word4);
+			lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+				      "2881 RRQ DID:%06X Status:"
+				      "x%x/x%x\n",
+				      ndlp->nlp_DID, ulp_status,
+				      ulp_word4);
 	}
 
 	lpfc_clr_rrq_active(phba, rrq->xritag, rrq);
@@ -2087,16 +2091,16 @@
 			}
 			goto out;
 		}
-		/* PLOGI failed Don't print the vport to vport rjts */
+		/* Warn PLOGI status Don't print the vport to vport rjts */
 		if (ulp_status != IOSTAT_LS_RJT ||
 		    (((ulp_word4) >> 16 != LSRJT_INVALID_CMD) &&
 		     ((ulp_word4) >> 16 != LSRJT_UNABLE_TPC)) ||
 		    (phba)->pport->cfg_log_verbose & LOG_ELS)
-			lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
-					 "2753 PLOGI failure DID:%06X "
-					 "Status:x%x/x%x\n",
-					 ndlp->nlp_DID, ulp_status,
-					 ulp_word4);
+			lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+				      "2753 PLOGI DID:%06X "
+				      "Status:x%x/x%x\n",
+				      ndlp->nlp_DID, ulp_status,
+				      ulp_word4);
 
 		/* Do not call DSM for lpfc_els_abort'ed ELS cmds */
 		if (!lpfc_error_lost_link(vport, ulp_status, ulp_word4))
@@ -2334,7 +2338,6 @@
 	struct lpfc_vport *vport = cmdiocb->vport;
 	struct lpfc_nodelist *ndlp;
 	char *mode;
-	u32 loglevel;
 	u32 ulp_status;
 	u32 ulp_word4;
 	bool release_node = false;
@@ -2383,17 +2386,14 @@
 		 * could be expected.
 		 */
 		if ((vport->fc_flag & FC_FABRIC) ||
-		    (vport->cfg_enable_fc4_type != LPFC_ENABLE_BOTH)) {
-			mode = KERN_ERR;
-			loglevel =  LOG_TRACE_EVENT;
-		} else {
+		    vport->cfg_enable_fc4_type != LPFC_ENABLE_BOTH)
+			mode = KERN_WARNING;
+		else
 			mode = KERN_INFO;
-			loglevel =  LOG_ELS;
-		}
 
-		/* PRLI failed */
-		lpfc_printf_vlog(vport, mode, loglevel,
-				 "2754 PRLI failure DID:%06X Status:x%x/x%x, "
+		/* Warn PRLI status */
+		lpfc_printf_vlog(vport, mode, LOG_ELS,
+				 "2754 PRLI DID:%06X Status:x%x/x%x, "
 				 "data: x%x x%x x%x\n",
 				 ndlp->nlp_DID, ulp_status,
 				 ulp_word4, ndlp->nlp_state,
@@ -2867,11 +2867,11 @@
 			}
 			goto out;
 		}
-		/* ADISC failed */
-		lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
-				 "2755 ADISC failure DID:%06X Status:x%x/x%x\n",
-				 ndlp->nlp_DID, ulp_status,
-				 ulp_word4);
+		/* Warn ADISC status */
+		lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+			      "2755 ADISC DID:%06X Status:x%x/x%x\n",
+			      ndlp->nlp_DID, ulp_status,
+			      ulp_word4);
 		lpfc_disc_state_machine(vport, ndlp, cmdiocb,
 					NLP_EVT_CMPL_ADISC);
 
@@ -3058,12 +3058,12 @@
 	 * discovery.  The PLOGI will retry.
 	 */
 	if (ulp_status) {
-		/* LOGO failed */
-		lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
-				 "2756 LOGO failure, No Retry DID:%06X "
-				 "Status:x%x/x%x\n",
-				 ndlp->nlp_DID, ulp_status,
-				 ulp_word4);
+		/* Warn LOGO status */
+		lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+			      "2756 LOGO, No Retry DID:%06X "
+			      "Status:x%x/x%x\n",
+			      ndlp->nlp_DID, ulp_status,
+			      ulp_word4);
 
 		if (lpfc_error_lost_link(vport, ulp_status, ulp_word4))
 			skip_recovery = 1;
@@ -4462,23 +4462,23 @@
 	unsigned long flags;
 	struct lpfc_work_evt  *evtp = &ndlp->els_retry_evt;
 
+	/* Hold a node reference for outstanding queued work */
+	if (!lpfc_nlp_get(ndlp))
+		return;
+
 	spin_lock_irqsave(&phba->hbalock, flags);
 	if (!list_empty(&evtp->evt_listp)) {
 		spin_unlock_irqrestore(&phba->hbalock, flags);
+		lpfc_nlp_put(ndlp);
 		return;
 	}
 
-	/* We need to hold the node by incrementing the reference
-	 * count until the queued work is done
-	 */
-	evtp->evt_arg1  = lpfc_nlp_get(ndlp);
-	if (evtp->evt_arg1) {
-		evtp->evt = LPFC_EVT_ELS_RETRY;
-		list_add_tail(&evtp->evt_listp, &phba->work_list);
-		lpfc_worker_wake_up(phba);
-	}
+	evtp->evt_arg1 = ndlp;
+	evtp->evt = LPFC_EVT_ELS_RETRY;
+	list_add_tail(&evtp->evt_listp, &phba->work_list);
 	spin_unlock_irqrestore(&phba->hbalock, flags);
-	return;
+
+	lpfc_worker_wake_up(phba);
 }
 
 /**
@@ -4852,11 +4852,10 @@
 			if ((phba->sli3_options & LPFC_SLI3_NPIV_ENABLED) &&
 			  (cmd == ELS_CMD_FDISC) &&
 			  (stat.un.b.lsRjtRsnCodeExp == LSEXP_OUT_OF_RESOURCE)){
-				lpfc_printf_vlog(vport, KERN_ERR,
-						 LOG_TRACE_EVENT,
-						 "0125 FDISC Failed (x%x). "
-						 "Fabric out of resources\n",
-						 stat.un.lsRjtError);
+				lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+					      "0125 FDISC (x%x). "
+					      "Fabric out of resources\n",
+					      stat.un.lsRjtError);
 				lpfc_vport_set_state(vport,
 						     FC_VPORT_NO_FABRIC_RSCS);
 			}
@@ -4892,11 +4891,10 @@
 						LSEXP_NOTHING_MORE) {
 				vport->fc_sparam.cmn.bbRcvSizeMsb &= 0xf;
 				retry = 1;
-				lpfc_printf_vlog(vport, KERN_ERR,
-						 LOG_TRACE_EVENT,
-						 "0820 FLOGI Failed (x%x). "
-						 "BBCredit Not Supported\n",
-						 stat.un.lsRjtError);
+				lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+					      "0820 FLOGI (x%x). "
+					      "BBCredit Not Supported\n",
+					      stat.un.lsRjtError);
 			}
 			break;
 
@@ -4906,11 +4904,10 @@
 			  ((stat.un.b.lsRjtRsnCodeExp == LSEXP_INVALID_PNAME) ||
 			  (stat.un.b.lsRjtRsnCodeExp == LSEXP_INVALID_NPORT_ID))
 			  ) {
-				lpfc_printf_vlog(vport, KERN_ERR,
-						 LOG_TRACE_EVENT,
-						 "0122 FDISC Failed (x%x). "
-						 "Fabric Detected Bad WWN\n",
-						 stat.un.lsRjtError);
+				lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+					      "0122 FDISC (x%x). "
+					      "Fabric Detected Bad WWN\n",
+					      stat.un.lsRjtError);
 				lpfc_vport_set_state(vport,
 						     FC_VPORT_FABRIC_REJ_WWN);
 			}
@@ -5261,9 +5258,10 @@
 	/* ACC to LOGO completes to NPort <nlp_DID> */
 	lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
 			 "0109 ACC to LOGO completes to NPort x%x refcnt %d "
-			 "Data: x%x x%x x%x\n",
-			 ndlp->nlp_DID, kref_read(&ndlp->kref), ndlp->nlp_flag,
-			 ndlp->nlp_state, ndlp->nlp_rpi);
+			 "last els x%x Data: x%x x%x x%x\n",
+			 ndlp->nlp_DID, kref_read(&ndlp->kref),
+			 ndlp->nlp_last_elscmd, ndlp->nlp_flag, ndlp->nlp_state,
+			 ndlp->nlp_rpi);
 
 	/* This clause allows the LOGO ACC to complete and free resources
 	 * for the Fabric Domain Controller.  It does deliberately skip
@@ -5275,18 +5273,22 @@
 		goto out;
 
 	if (ndlp->nlp_state == NLP_STE_NPR_NODE) {
-		/* If PLOGI is being retried, PLOGI completion will cleanup the
-		 * node. The NLP_NPR_2B_DISC flag needs to be retained to make
-		 * progress on nodes discovered from last RSCN.
-		 */
-		if ((ndlp->nlp_flag & NLP_DELAY_TMO) &&
-		    (ndlp->nlp_last_elscmd == ELS_CMD_PLOGI))
-			goto out;
-
 		if (ndlp->nlp_flag & NLP_RPI_REGISTERED)
 			lpfc_unreg_rpi(vport, ndlp);
 
+		/* If came from PRLO, then PRLO_ACC is done.
+		 * Start rediscovery now.
+		 */
+		if (ndlp->nlp_last_elscmd == ELS_CMD_PRLO) {
+			spin_lock_irq(&ndlp->lock);
+			ndlp->nlp_flag |= NLP_NPR_2B_DISC;
+			spin_unlock_irq(&ndlp->lock);
+			ndlp->nlp_prev_state = ndlp->nlp_state;
+			lpfc_nlp_set_state(vport, ndlp, NLP_STE_PLOGI_ISSUE);
+			lpfc_issue_els_plogi(vport, ndlp->nlp_DID, 0);
+		}
 	}
+
  out:
 	/*
 	 * The driver received a LOGO from the rport and has ACK'd it.
@@ -5365,8 +5367,8 @@
 	u32 ulp_status, ulp_word4, tmo, did, iotag;
 
 	if (!vport) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
-				"3177 ELS response failed\n");
+		lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
+				"3177 null vport in ELS rsp\n");
 		goto out;
 	}
 	if (cmdiocb->context_un.mbox)
@@ -7338,12 +7340,13 @@
 	mbox->vport = phba->pport;
 	mbox->ctx_ndlp = (struct lpfc_rdp_context *)rdp_context;
 
-	rc = lpfc_sli_issue_mbox_wait(phba, mbox, 30);
+	rc = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_SLI4_CONFIG_TMO);
 	if (rc == MBX_NOT_FINISHED) {
 		rc = 1;
 		goto error;
 	}
-
+	if (rc == MBX_TIMEOUT)
+		goto error;
 	if (phba->sli_rev == LPFC_SLI_REV4)
 		mp = (struct lpfc_dmabuf *)(mbox->ctx_buf);
 	else
@@ -7397,7 +7400,10 @@
 	}
 
 	mbox->ctx_ndlp = (struct lpfc_rdp_context *)rdp_context;
-	rc = lpfc_sli_issue_mbox_wait(phba, mbox, 30);
+	rc = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_SLI4_CONFIG_TMO);
+
+	if (rc == MBX_TIMEOUT)
+		goto error;
 	if (bf_get(lpfc_mqe_status, &mbox->u.mqe)) {
 		rc = 1;
 		goto error;
@@ -7408,8 +7414,10 @@
 			     DMP_SFF_PAGE_A2_SIZE);
 
 error:
-	mbox->ctx_buf = mpsave;
-	lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED);
+	if (mbox->mbox_flag & LPFC_MBX_WAKE) {
+		mbox->ctx_buf = mpsave;
+		lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED);
+	}
 
 	return rc;
 
@@ -8489,9 +8497,9 @@
 
 	/* Defer ACC response until AFTER we issue a FLOGI */
 	if (!(phba->hba_flag & HBA_FLOGI_ISSUED)) {
-		phba->defer_flogi_acc_rx_id = bf_get(wqe_ctxt_tag,
+		phba->defer_flogi_acc.rx_id = bf_get(wqe_ctxt_tag,
 						     &wqe->xmit_els_rsp.wqe_com);
-		phba->defer_flogi_acc_ox_id = bf_get(wqe_rcvoxid,
+		phba->defer_flogi_acc.ox_id = bf_get(wqe_rcvoxid,
 						     &wqe->xmit_els_rsp.wqe_com);
 
 		vport->fc_myDID = did;
@@ -8499,11 +8507,17 @@
 		lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
 				 "3344 Deferring FLOGI ACC: rx_id: x%x,"
 				 " ox_id: x%x, hba_flag x%x\n",
-				 phba->defer_flogi_acc_rx_id,
-				 phba->defer_flogi_acc_ox_id, phba->hba_flag);
+				 phba->defer_flogi_acc.rx_id,
+				 phba->defer_flogi_acc.ox_id, phba->hba_flag);
 
-		phba->defer_flogi_acc_flag = true;
+		phba->defer_flogi_acc.flag = true;
 
+		/* This nlp_get is paired with nlp_puts that reset the
+		 * defer_flogi_acc.flag back to false.  We need to retain
+		 * a kref on the ndlp until the deferred FLOGI ACC is
+		 * processed or cancelled.
+		 */
+		phba->defer_flogi_acc.ndlp = lpfc_nlp_get(ndlp);
 		return 0;
 	}
 
@@ -9677,11 +9691,12 @@
 		if (piocb->cmd_flag & LPFC_DRIVER_ABORTED && !mbx_tmo_err)
 			continue;
 
-		/* On the ELS ring we can have ELS_REQUESTs or
-		 * GEN_REQUESTs waiting for a response.
+		/* On the ELS ring we can have ELS_REQUESTs, ELS_RSPs,
+		 * or GEN_REQUESTs waiting for a CQE response.
 		 */
 		ulp_command = get_job_cmnd(phba, piocb);
-		if (ulp_command == CMD_ELS_REQUEST64_CR) {
+		if (ulp_command == CMD_ELS_REQUEST64_WQE ||
+		    ulp_command == CMD_XMIT_ELS_RSP64_WQE) {
 			list_add_tail(&piocb->dlist, &abort_list);
 
 			/* If the link is down when flushing ELS commands
@@ -10537,7 +10552,7 @@
 
 		lpfc_els_rcv_flogi(vport, elsiocb, ndlp);
 		/* retain node if our response is deferred */
-		if (phba->defer_flogi_acc_flag)
+		if (phba->defer_flogi_acc.flag)
 			break;
 		if (newnode)
 			lpfc_disc_state_machine(vport, ndlp, NULL,
@@ -11358,10 +11373,10 @@
 		/* Check for retry */
 		if (lpfc_els_retry(phba, cmdiocb, rspiocb))
 			goto out;
-		/* FDISC failed */
-		lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
-				 "0126 FDISC failed. (x%x/x%x)\n",
-				 ulp_status, ulp_word4);
+		/* Warn FDISC status */
+		lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+			      "0126 FDISC cmpl status: x%x/x%x)\n",
+			      ulp_status, ulp_word4);
 		goto fdisc_failed;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -155,6 +155,7 @@
 	struct lpfc_hba   *phba;
 	struct lpfc_work_evt *evtp;
 	unsigned long iflags;
+	bool nvme_reg = false;
 
 	ndlp = ((struct lpfc_rport_data *)rport->dd_data)->pnode;
 	if (!ndlp)
@@ -175,39 +176,51 @@
 			 ndlp->nlp_state, ndlp->fc4_xpt_flags);
 
 	/* Don't schedule a worker thread event if the vport is going down. */
-	if (vport->load_flag & FC_UNLOADING) {
+	if ((vport->load_flag & FC_UNLOADING) ||
+	    !(phba->hba_flag & HBA_SETUP)) {
+
 		spin_lock_irqsave(&ndlp->lock, iflags);
 		ndlp->rport = NULL;
 
+		if (ndlp->fc4_xpt_flags & NVME_XPT_REGD)
+			nvme_reg = true;
+
 		/* The scsi_transport is done with the rport so lpfc cannot
-		 * call to unregister. Remove the scsi transport reference
-		 * and clean up the SCSI transport node details.
+		 * call to unregister.
 		 */
-		if (ndlp->fc4_xpt_flags & (NLP_XPT_REGD | SCSI_XPT_REGD)) {
+		if (ndlp->fc4_xpt_flags & SCSI_XPT_REGD) {
 			ndlp->fc4_xpt_flags &= ~SCSI_XPT_REGD;
 
-			/* NVME transport-registered rports need the
-			 * NLP_XPT_REGD flag to complete an unregister.
+			/* If NLP_XPT_REGD was cleared in lpfc_nlp_unreg_node,
+			 * unregister calls were made to the scsi and nvme
+			 * transports and refcnt was already decremented. Clear
+			 * the NLP_XPT_REGD flag only if the NVME Rport is
+			 * confirmed unregistered.
 			 */
-			if (!(ndlp->fc4_xpt_flags & NVME_XPT_REGD))
+			if (!nvme_reg && ndlp->fc4_xpt_flags & NLP_XPT_REGD) {
 				ndlp->fc4_xpt_flags &= ~NLP_XPT_REGD;
+				spin_unlock_irqrestore(&ndlp->lock, iflags);
+				lpfc_nlp_put(ndlp); /* may free ndlp */
+			} else {
+				spin_unlock_irqrestore(&ndlp->lock, iflags);
+			}
+		} else {
 			spin_unlock_irqrestore(&ndlp->lock, iflags);
-			lpfc_nlp_put(ndlp);
-			spin_lock_irqsave(&ndlp->lock, iflags);
 		}
 
+		spin_lock_irqsave(&ndlp->lock, iflags);
+
 		/* Only 1 thread can drop the initial node reference.  If
 		 * another thread has set NLP_DROPPED, this thread is done.
 		 */
-		if (!(ndlp->fc4_xpt_flags & NVME_XPT_REGD) &&
-		    !(ndlp->nlp_flag & NLP_DROPPED)) {
-			ndlp->nlp_flag |= NLP_DROPPED;
+		if (nvme_reg || (ndlp->nlp_flag & NLP_DROPPED)) {
 			spin_unlock_irqrestore(&ndlp->lock, iflags);
-			lpfc_nlp_put(ndlp);
 			return;
 		}
 
+		ndlp->nlp_flag |= NLP_DROPPED;
 		spin_unlock_irqrestore(&ndlp->lock, iflags);
+		lpfc_nlp_put(ndlp);
 		return;
 	}
 
@@ -257,7 +270,9 @@
 		if (evtp->evt_arg1) {
 			evtp->evt = LPFC_EVT_DEV_LOSS;
 			list_add_tail(&evtp->evt_listp, &phba->work_list);
+			spin_unlock_irqrestore(&phba->hbalock, iflags);
 			lpfc_worker_wake_up(phba);
+			return;
 		}
 		spin_unlock_irqrestore(&phba->hbalock, iflags);
 	} else {
@@ -275,10 +290,7 @@
 			lpfc_disc_state_machine(vport, ndlp, NULL,
 						NLP_EVT_DEVICE_RM);
 		}
-
 	}
-
-	return;
 }
 
 /**
@@ -1253,7 +1265,14 @@
 	lpfc_scsi_dev_block(phba);
 	offline = pci_channel_offline(phba->pcidev);
 
-	phba->defer_flogi_acc_flag = false;
+	/* Decrement the held ndlp if there is a deferred flogi acc */
+	if (phba->defer_flogi_acc.flag) {
+		if (phba->defer_flogi_acc.ndlp) {
+			lpfc_nlp_put(phba->defer_flogi_acc.ndlp);
+			phba->defer_flogi_acc.ndlp = NULL;
+		}
+	}
+	phba->defer_flogi_acc.flag = false;
 
 	/* Clear external loopback plug detected flag */
 	phba->link_flag &= ~LS_EXTERNAL_LOOPBACK;
@@ -1381,7 +1400,7 @@
 				   FCH_EVT_LINKUP, 0);
 
 	spin_lock_irq(shost->host_lock);
-	if (phba->defer_flogi_acc_flag)
+	if (phba->defer_flogi_acc.flag)
 		vport->fc_flag &= ~(FC_ABORT_DISCOVERY | FC_RSCN_MODE |
 				    FC_NLP_MORE | FC_RSCN_DISCOVERY);
 	else
@@ -5783,7 +5802,7 @@
 				return NULL;
 
 			if (ndlp->nlp_state > NLP_STE_UNUSED_NODE &&
-			    ndlp->nlp_state < NLP_STE_PRLI_ISSUE) {
+			    ndlp->nlp_state <= NLP_STE_PRLI_ISSUE) {
 				lpfc_disc_state_machine(vport, ndlp, NULL,
 							NLP_EVT_DEVICE_RECOVERY);
 			}
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_init.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_init.c
@@ -7698,6 +7698,9 @@
 				"NVME" : " "),
 			(phba->nvmet_support ? "NVMET" : " "));
 
+	/* ras_fwlog state */
+	spin_lock_init(&phba->ras_fwlog_lock);
+
 	/* Initialize the IO buffer list used by driver for SLI3 SCSI */
 	spin_lock_init(&phba->scsi_buf_list_get_lock);
 	INIT_LIST_HEAD(&phba->lpfc_scsi_buf_list_get);
@@ -13047,7 +13050,7 @@
 		rc = request_threaded_irq(eqhdl->irq,
 					  &lpfc_sli4_hba_intr_handler,
 					  &lpfc_sli4_hba_intr_handler_th,
-					  IRQF_ONESHOT, name, eqhdl);
+					  0, name, eqhdl);
 		if (rc) {
 			lpfc_printf_log(phba, KERN_WARNING, LOG_INIT,
 					"0486 MSI-X fast-path (%d) "
@@ -13506,6 +13509,8 @@
 	/* Disable FW logging to host memory */
 	lpfc_ras_stop_fwlog(phba);
 
+	lpfc_sli4_queue_unset(phba);
+
 	/* Reset SLI4 HBA FCoE function */
 	lpfc_pci_function_reset(phba);
 
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -748,8 +748,10 @@
 				/* Save the ELS cmd */
 				elsiocb->drvrTimeout = cmd;
 
-				lpfc_sli4_resume_rpi(ndlp,
-					lpfc_mbx_cmpl_resume_rpi, elsiocb);
+				if (lpfc_sli4_resume_rpi(ndlp,
+						lpfc_mbx_cmpl_resume_rpi,
+						elsiocb))
+					kfree(elsiocb);
 				goto out;
 			}
 		}
@@ -2643,8 +2645,26 @@
 	/* flush the target */
 	lpfc_sli_abort_iocb(vport, ndlp->nlp_sid, 0, LPFC_CTX_TGT);
 
-	/* Treat like rcv logo */
-	lpfc_rcv_logo(vport, ndlp, cmdiocb, ELS_CMD_PRLO);
+	/* Send PRLO_ACC */
+	spin_lock_irq(&ndlp->lock);
+	ndlp->nlp_flag |= NLP_LOGO_ACC;
+	spin_unlock_irq(&ndlp->lock);
+	lpfc_els_rsp_acc(vport, ELS_CMD_PRLO, cmdiocb, ndlp, NULL);
+
+	/* Save ELS_CMD_PRLO as the last elscmd and then set to NPR.
+	 * lpfc_cmpl_els_logo_acc is expected to restart discovery.
+	 */
+	ndlp->nlp_last_elscmd = ELS_CMD_PRLO;
+	ndlp->nlp_prev_state = ndlp->nlp_state;
+
+	lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE | LOG_ELS | LOG_DISCOVERY,
+			 "3422 DID x%06x nflag x%x lastels x%x ref cnt %u\n",
+			 ndlp->nlp_DID, ndlp->nlp_flag,
+			 ndlp->nlp_last_elscmd,
+			 kref_read(&ndlp->kref));
+
+	lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
+
 	return ndlp->nlp_state;
 }
 
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_nvme.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_nvme.c
@@ -2616,9 +2616,9 @@
 		/* No concern about the role change on the nvme remoteport.
 		 * The transport will update it.
 		 */
-		spin_lock_irq(&vport->phba->hbalock);
+		spin_lock_irq(&ndlp->lock);
 		ndlp->fc4_xpt_flags |= NVME_XPT_UNREG_WAIT;
-		spin_unlock_irq(&vport->phba->hbalock);
+		spin_unlock_irq(&ndlp->lock);
 
 		/* Don't let the host nvme transport keep sending keep-alives
 		 * on this remoteport. Vport is unloading, no recovery. The
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_nvmet.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1586,7 +1586,7 @@
 		wqe = &nvmewqe->wqe;
 
 		/* Initialize WQE */
-		memset(wqe, 0, sizeof(union lpfc_wqe));
+		memset(wqe, 0, sizeof(*wqe));
 
 		ctx_buf->iocbq->cmd_dmabuf = NULL;
 		spin_lock(&phba->sli4_hba.sgl_list_lock);
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_scsi.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_scsi.c
@@ -167,11 +167,10 @@
 	struct Scsi_Host  *shost;
 	struct scsi_device *sdev;
 	unsigned long new_queue_depth;
-	unsigned long num_rsrc_err, num_cmd_success;
+	unsigned long num_rsrc_err;
 	int i;
 
 	num_rsrc_err = atomic_read(&phba->num_rsrc_err);
-	num_cmd_success = atomic_read(&phba->num_cmd_success);
 
 	/*
 	 * The error and success command counters are global per
@@ -186,20 +185,16 @@
 		for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) {
 			shost = lpfc_shost_from_vport(vports[i]);
 			shost_for_each_device(sdev, shost) {
-				new_queue_depth =
-					sdev->queue_depth * num_rsrc_err /
-					(num_rsrc_err + num_cmd_success);
-				if (!new_queue_depth)
-					new_queue_depth = sdev->queue_depth - 1;
+				if (num_rsrc_err >= sdev->queue_depth)
+					new_queue_depth = 1;
 				else
 					new_queue_depth = sdev->queue_depth -
-								new_queue_depth;
+						num_rsrc_err;
 				scsi_change_queue_depth(sdev, new_queue_depth);
 			}
 		}
 	lpfc_destroy_vport_work_array(phba, vports);
 	atomic_set(&phba->num_rsrc_err, 0);
-	atomic_set(&phba->num_cmd_success, 0);
 }
 
 /**
@@ -5551,11 +5546,20 @@
 
 	iocb = &lpfc_cmd->cur_iocbq;
 	if (phba->sli_rev == LPFC_SLI_REV4) {
-		pring_s4 = phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq->pring;
-		if (!pring_s4) {
+		/* if the io_wq & pring are gone, the port was reset. */
+		if (!phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq ||
+		    !phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq->pring) {
+			lpfc_printf_vlog(vport, KERN_WARNING, LOG_FCP,
+					 "2877 SCSI Layer I/O Abort Request "
+					 "IO CMPL Status x%x ID %d LUN %llu "
+					 "HBA_SETUP %d\n", FAILED,
+					 cmnd->device->id,
+					 (u64)cmnd->device->lun,
+					 (phba->hba_flag & HBA_SETUP));
 			ret = FAILED;
 			goto out_unlock_hba;
 		}
+		pring_s4 = phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq->pring;
 		spin_lock(&pring_s4->ring_lock);
 	}
 	/* the command is in process of being cancelled */
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_sli.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_sli.c
@@ -1217,9 +1217,9 @@
 	empty = list_empty(&phba->active_rrq_list);
 	list_add_tail(&rrq->list, &phba->active_rrq_list);
 	phba->hba_flag |= HBA_RRQ_ACTIVE;
+	spin_unlock_irqrestore(&phba->hbalock, iflags);
 	if (empty)
 		lpfc_worker_wake_up(phba);
-	spin_unlock_irqrestore(&phba->hbalock, iflags);
 	return 0;
 out:
 	spin_unlock_irqrestore(&phba->hbalock, iflags);
@@ -4689,6 +4689,17 @@
 	/* Look on all the FCP Rings for the iotag */
 	if (phba->sli_rev >= LPFC_SLI_REV4) {
 		for (i = 0; i < phba->cfg_hdw_queue; i++) {
+			if (!phba->sli4_hba.hdwq ||
+			    !phba->sli4_hba.hdwq[i].io_wq) {
+				lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+						"7777 hdwq's deleted %x "
+						"%x %x %x\n",
+						phba->pport->load_flag,
+						phba->hba_flag,
+						phba->link_state,
+						phba->sli.sli_flag);
+				return;
+			}
 			pring = phba->sli4_hba.hdwq[i].io_wq->pring;
 
 			spin_lock_irq(&pring->ring_lock);
@@ -5279,6 +5290,8 @@
 			"0296 Restart HBA Data: x%x x%x\n",
 			phba->pport->port_state, psli->sli_flag);
 
+	lpfc_sli4_queue_unset(phba);
+
 	rc = lpfc_sli4_brdreset(phba);
 	if (rc) {
 		phba->link_state = LPFC_HBA_ERROR;
@@ -6849,9 +6862,9 @@
 {
 	struct lpfc_ras_fwlog *ras_fwlog = &phba->ras_fwlog;
 
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	ras_fwlog->state = INACTIVE;
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 
 	/* Disable FW logging to host memory */
 	writel(LPFC_CTL_PDEV_CTL_DDL_RAS,
@@ -6894,9 +6907,9 @@
 		ras_fwlog->lwpd.virt = NULL;
 	}
 
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	ras_fwlog->state = INACTIVE;
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 }
 
 /**
@@ -6998,9 +7011,9 @@
 		goto disable_ras;
 	}
 
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	ras_fwlog->state = ACTIVE;
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 	mempool_free(pmb, phba->mbox_mem_pool);
 
 	return;
@@ -7032,9 +7045,9 @@
 	uint32_t len = 0, fwlog_buffsize, fwlog_entry_count;
 	int rc = 0;
 
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	ras_fwlog->state = INACTIVE;
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 
 	fwlog_buffsize = (LPFC_RAS_MIN_BUFF_POST_SIZE *
 			  phba->cfg_ras_fwlog_buffsize);
@@ -7095,9 +7108,9 @@
 	mbx_fwlog->u.request.lwpd.addr_lo = putPaddrLow(ras_fwlog->lwpd.phys);
 	mbx_fwlog->u.request.lwpd.addr_hi = putPaddrHigh(ras_fwlog->lwpd.phys);
 
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irq(&phba->ras_fwlog_lock);
 	ras_fwlog->state = REG_INPROGRESS;
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irq(&phba->ras_fwlog_lock);
 	mbox->vport = phba->pport;
 	mbox->mbox_cmpl = lpfc_sli4_ras_mbox_cmpl;
 
@@ -7582,7 +7595,7 @@
 	struct lpfc_sglq *sglq_entry = NULL;
 	struct lpfc_sglq *sglq_entry_next = NULL;
 	struct lpfc_sglq *sglq_entry_first = NULL;
-	int status, total_cnt;
+	int status = 0, total_cnt;
 	int post_cnt = 0, num_posted = 0, block_cnt = 0;
 	int last_xritag = NO_XRI;
 	LIST_HEAD(prep_sgl_list);
@@ -11373,18 +11386,18 @@
 	unsigned long iflags;
 	struct lpfc_work_evt  *evtp = &ndlp->recovery_evt;
 
+	/* Hold a node reference for outstanding queued work */
+	if (!lpfc_nlp_get(ndlp))
+		return;
+
 	spin_lock_irqsave(&phba->hbalock, iflags);
 	if (!list_empty(&evtp->evt_listp)) {
 		spin_unlock_irqrestore(&phba->hbalock, iflags);
+		lpfc_nlp_put(ndlp);
 		return;
 	}
 
-	/* Incrementing the reference count until the queued work is done. */
-	evtp->evt_arg1  = lpfc_nlp_get(ndlp);
-	if (!evtp->evt_arg1) {
-		spin_unlock_irqrestore(&phba->hbalock, iflags);
-		return;
-	}
+	evtp->evt_arg1 = ndlp;
 	evtp->evt = LPFC_EVT_RECOVER_PORT;
 	list_add_tail(&evtp->evt_listp, &phba->work_list);
 	spin_unlock_irqrestore(&phba->hbalock, iflags);
@@ -17623,6 +17636,9 @@
 	if (!eq)
 		return -ENODEV;
 
+	if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+		goto list_remove;
+
 	mbox = mempool_alloc(eq->phba->mbox_mem_pool, GFP_KERNEL);
 	if (!mbox)
 		return -ENOMEM;
@@ -17649,10 +17665,12 @@
 				shdr_status, shdr_add_status, rc);
 		status = -ENXIO;
 	}
+	mempool_free(mbox, eq->phba->mbox_mem_pool);
 
+list_remove:
 	/* Remove eq from any list */
 	list_del_init(&eq->list);
-	mempool_free(mbox, eq->phba->mbox_mem_pool);
+
 	return status;
 }
 
@@ -17680,6 +17698,10 @@
 	/* sanity check on queue memory */
 	if (!cq)
 		return -ENODEV;
+
+	if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+		goto list_remove;
+
 	mbox = mempool_alloc(cq->phba->mbox_mem_pool, GFP_KERNEL);
 	if (!mbox)
 		return -ENOMEM;
@@ -17705,9 +17727,11 @@
 				shdr_status, shdr_add_status, rc);
 		status = -ENXIO;
 	}
+	mempool_free(mbox, cq->phba->mbox_mem_pool);
+
+list_remove:
 	/* Remove cq from any list */
 	list_del_init(&cq->list);
-	mempool_free(mbox, cq->phba->mbox_mem_pool);
 	return status;
 }
 
@@ -17735,6 +17759,10 @@
 	/* sanity check on queue memory */
 	if (!mq)
 		return -ENODEV;
+
+	if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+		goto list_remove;
+
 	mbox = mempool_alloc(mq->phba->mbox_mem_pool, GFP_KERNEL);
 	if (!mbox)
 		return -ENOMEM;
@@ -17760,9 +17788,11 @@
 				shdr_status, shdr_add_status, rc);
 		status = -ENXIO;
 	}
+	mempool_free(mbox, mq->phba->mbox_mem_pool);
+
+list_remove:
 	/* Remove mq from any list */
 	list_del_init(&mq->list);
-	mempool_free(mbox, mq->phba->mbox_mem_pool);
 	return status;
 }
 
@@ -17790,6 +17820,10 @@
 	/* sanity check on queue memory */
 	if (!wq)
 		return -ENODEV;
+
+	if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+		goto list_remove;
+
 	mbox = mempool_alloc(wq->phba->mbox_mem_pool, GFP_KERNEL);
 	if (!mbox)
 		return -ENOMEM;
@@ -17814,11 +17848,13 @@
 				shdr_status, shdr_add_status, rc);
 		status = -ENXIO;
 	}
+	mempool_free(mbox, wq->phba->mbox_mem_pool);
+
+list_remove:
 	/* Remove wq from any list */
 	list_del_init(&wq->list);
 	kfree(wq->pring);
 	wq->pring = NULL;
-	mempool_free(mbox, wq->phba->mbox_mem_pool);
 	return status;
 }
 
@@ -17848,6 +17884,10 @@
 	/* sanity check on queue memory */
 	if (!hrq || !drq)
 		return -ENODEV;
+
+	if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+		goto list_remove;
+
 	mbox = mempool_alloc(hrq->phba->mbox_mem_pool, GFP_KERNEL);
 	if (!mbox)
 		return -ENOMEM;
@@ -17888,9 +17928,11 @@
 				shdr_status, shdr_add_status, rc);
 		status = -ENXIO;
 	}
+	mempool_free(mbox, hrq->phba->mbox_mem_pool);
+
+list_remove:
 	list_del_init(&hrq->list);
 	list_del_init(&drq->list);
-	mempool_free(mbox, hrq->phba->mbox_mem_pool);
 	return status;
 }
 
--- linux-qcom-6.8.0.orig/drivers/scsi/lpfc/lpfc_vport.c
+++ linux-qcom-6.8.0/drivers/scsi/lpfc/lpfc_vport.c
@@ -633,6 +633,7 @@
 	struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
 	struct lpfc_hba  *phba = vport->phba;
 	int rc;
+	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(waitq);
 
 	if (vport->port_type == LPFC_PHYSICAL_PORT) {
 		lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
@@ -683,30 +684,54 @@
 	lpfc_free_sysfs_attr(vport);
 	lpfc_debugfs_terminate(vport);
 
-	/* Remove FC host to break driver binding. */
-	fc_remove_host(shost);
-	scsi_remove_host(shost);
-
 	/* Send the DA_ID and Fabric LOGO to cleanup Nameserver entries. */
 	ndlp = lpfc_findnode_did(vport, Fabric_DID);
 	if (!ndlp)
 		goto skip_logo;
 
+	/* Send the DA_ID and Fabric LOGO to cleanup the NPIV fabric entries. */
 	if (ndlp && ndlp->nlp_state == NLP_STE_UNMAPPED_NODE &&
 	    phba->link_state >= LPFC_LINK_UP &&
 	    phba->fc_topology != LPFC_TOPOLOGY_LOOP) {
 		if (vport->cfg_enable_da_id) {
-			/* Send DA_ID and wait for a completion. */
+			/* Send DA_ID and wait for a completion.  This is best
+			 * effort.  If the DA_ID fails, likely the fabric will
+			 * "leak" NportIDs but at least the driver issued the
+			 * command.
+			 */
+			ndlp = lpfc_findnode_did(vport, NameServer_DID);
+			if (!ndlp)
+				goto issue_logo;
+
+			spin_lock_irq(&ndlp->lock);
+			ndlp->da_id_waitq = &waitq;
+			ndlp->save_flags |= NLP_WAIT_FOR_DA_ID;
+			spin_unlock_irq(&ndlp->lock);
+
 			rc = lpfc_ns_cmd(vport, SLI_CTNS_DA_ID, 0, 0);
-			if (rc) {
-				lpfc_printf_log(vport->phba, KERN_WARNING,
-						LOG_VPORT,
-						"1829 CT command failed to "
-						"delete objects on fabric, "
-						"rc %d\n", rc);
+			if (!rc) {
+				wait_event_timeout(waitq,
+				   !(ndlp->save_flags & NLP_WAIT_FOR_DA_ID),
+				   msecs_to_jiffies(phba->fc_ratov * 2000));
 			}
+
+			lpfc_printf_vlog(vport, KERN_INFO, LOG_VPORT | LOG_ELS,
+					 "1829 DA_ID issue status %d. "
+					 "SFlag x%x NState x%x, NFlag x%x "
+					 "Rpi x%x\n",
+					 rc, ndlp->save_flags, ndlp->nlp_state,
+					 ndlp->nlp_flag, ndlp->nlp_rpi);
+
+			/* Remove the waitq and save_flags.  It no
+			 * longer matters if the wake happened.
+			 */
+			spin_lock_irq(&ndlp->lock);
+			ndlp->da_id_waitq = NULL;
+			ndlp->save_flags &= ~NLP_WAIT_FOR_DA_ID;
+			spin_unlock_irq(&ndlp->lock);
 		}
 
+issue_logo:
 		/*
 		 * If the vpi is not registered, then a valid FDISC doesn't
 		 * exist and there is no need for a ELS LOGO.  Just cleanup
@@ -730,6 +755,10 @@
 
 skip_logo:
 
+	/* Remove FC host to break driver binding. */
+	fc_remove_host(shost);
+	scsi_remove_host(shost);
+
 	lpfc_cleanup(vport);
 
 	/* Remove scsi host now.  The nodes are cleaned up. */
--- linux-qcom-6.8.0.orig/drivers/scsi/mac_scsi.c
+++ linux-qcom-6.8.0/drivers/scsi/mac_scsi.c
@@ -102,11 +102,15 @@
  * Linux SCSI drivers lack knowledge of the timing behaviour of SCSI targets
  * so bus errors are unavoidable.
  *
- * If a MOVE.B instruction faults, we assume that zero bytes were transferred
- * and simply retry. That assumption probably depends on target behaviour but
- * seems to hold up okay. The NOP provides synchronization: without it the
- * fault can sometimes occur after the program counter has moved past the
- * offending instruction. Post-increment addressing can't be used.
+ * If a MOVE.B instruction faults during a receive operation, we assume the
+ * target sent nothing and try again. That assumption probably depends on
+ * target firmware but it seems to hold up okay. If a fault happens during a
+ * send operation, the target may or may not have seen /ACK and got the byte.
+ * It's uncertain so the whole SCSI command gets retried.
+ *
+ * The NOP is needed for synchronization because the fault address in the
+ * exception stack frame may or may not be the instruction that actually
+ * caused the bus error. Post-increment addressing can't be used.
  */
 
 #define MOVE_BYTE(operands) \
@@ -208,8 +212,6 @@
 		".previous                     \n" \
 		: "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
 
-#define MAC_PDMA_DELAY		32
-
 static inline int mac_pdma_recv(void __iomem *io, unsigned char *start, int n)
 {
 	unsigned char *addr = start;
@@ -245,22 +247,21 @@
 	if (n >= 1) {
 		MOVE_BYTE("%0@,%3@");
 		if (result)
-			goto out;
+			return -1;
 	}
 	if (n >= 1 && ((unsigned long)addr & 1)) {
 		MOVE_BYTE("%0@,%3@");
 		if (result)
-			goto out;
+			return -2;
 	}
 	while (n >= 32)
 		MOVE_16_WORDS("%0@+,%3@");
 	while (n >= 2)
 		MOVE_WORD("%0@+,%3@");
 	if (result)
-		return start - addr; /* Negated to indicate uncertain length */
+		return start - addr - 1; /* Negated to indicate uncertain length */
 	if (n == 1)
 		MOVE_BYTE("%0@,%3@");
-out:
 	return addr - start;
 }
 
@@ -274,25 +275,56 @@
 	out_be32(hostdata->io + (CTRL_REG << 4), value);
 }
 
+static inline int macscsi_wait_for_drq(struct NCR5380_hostdata *hostdata)
+{
+	unsigned int n = 1; /* effectively multiplies NCR5380_REG_POLL_TIME */
+	unsigned char basr;
+
+again:
+	basr = NCR5380_read(BUS_AND_STATUS_REG);
+
+	if (!(basr & BASR_PHASE_MATCH))
+		return 1;
+
+	if (basr & BASR_IRQ)
+		return -1;
+
+	if (basr & BASR_DRQ)
+		return 0;
+
+	if (n-- == 0) {
+		NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
+		dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
+			 "%s: DRQ timeout\n", __func__);
+		return -1;
+	}
+
+	NCR5380_poll_politely2(hostdata,
+			       BUS_AND_STATUS_REG, BASR_DRQ, BASR_DRQ,
+			       BUS_AND_STATUS_REG, BASR_PHASE_MATCH, 0, 0);
+	goto again;
+}
+
 static inline int macscsi_pread(struct NCR5380_hostdata *hostdata,
                                 unsigned char *dst, int len)
 {
 	u8 __iomem *s = hostdata->pdma_io + (INPUT_DATA_REG << 4);
 	unsigned char *d = dst;
-	int result = 0;
 
 	hostdata->pdma_residual = len;
 
-	while (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
-	                              BASR_DRQ | BASR_PHASE_MATCH,
-	                              BASR_DRQ | BASR_PHASE_MATCH, 0)) {
-		int bytes;
+	while (macscsi_wait_for_drq(hostdata) == 0) {
+		int bytes, chunk_bytes;
 
 		if (macintosh_config->ident == MAC_MODEL_IIFX)
 			write_ctrl_reg(hostdata, CTRL_HANDSHAKE_MODE |
 			                         CTRL_INTERRUPTS_ENABLE);
 
-		bytes = mac_pdma_recv(s, d, min(hostdata->pdma_residual, 512));
+		chunk_bytes = min(hostdata->pdma_residual, 512);
+		bytes = mac_pdma_recv(s, d, chunk_bytes);
+
+		if (macintosh_config->ident == MAC_MODEL_IIFX)
+			write_ctrl_reg(hostdata, CTRL_INTERRUPTS_ENABLE);
 
 		if (bytes > 0) {
 			d += bytes;
@@ -300,37 +332,25 @@
 		}
 
 		if (hostdata->pdma_residual == 0)
-			goto out;
+			break;
 
-		if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
-		                           BUS_AND_STATUS_REG, BASR_ACK,
-		                           BASR_ACK, 0) < 0)
-			scmd_printk(KERN_DEBUG, hostdata->connected,
-			            "%s: !REQ and !ACK\n", __func__);
-		if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
-			goto out;
+		if (bytes > 0)
+			continue;
 
-		if (bytes == 0)
-			udelay(MAC_PDMA_DELAY);
+		NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
+		dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
+			 "%s: bus error [%d/%d] (%d/%d)\n",
+			 __func__, d - dst, len, bytes, chunk_bytes);
 
-		if (bytes >= 0)
+		if (bytes == 0)
 			continue;
 
-		dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
-		         "%s: bus error (%d/%d)\n", __func__, d - dst, len);
-		NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
-		result = -1;
-		goto out;
+		if (macscsi_wait_for_drq(hostdata) <= 0)
+			set_host_byte(hostdata->connected, DID_ERROR);
+		break;
 	}
 
-	scmd_printk(KERN_ERR, hostdata->connected,
-	            "%s: phase mismatch or !DRQ\n", __func__);
-	NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
-	result = -1;
-out:
-	if (macintosh_config->ident == MAC_MODEL_IIFX)
-		write_ctrl_reg(hostdata, CTRL_INTERRUPTS_ENABLE);
-	return result;
+	return 0;
 }
 
 static inline int macscsi_pwrite(struct NCR5380_hostdata *hostdata,
@@ -338,67 +358,47 @@
 {
 	unsigned char *s = src;
 	u8 __iomem *d = hostdata->pdma_io + (OUTPUT_DATA_REG << 4);
-	int result = 0;
 
 	hostdata->pdma_residual = len;
 
-	while (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
-	                              BASR_DRQ | BASR_PHASE_MATCH,
-	                              BASR_DRQ | BASR_PHASE_MATCH, 0)) {
-		int bytes;
+	while (macscsi_wait_for_drq(hostdata) == 0) {
+		int bytes, chunk_bytes;
 
 		if (macintosh_config->ident == MAC_MODEL_IIFX)
 			write_ctrl_reg(hostdata, CTRL_HANDSHAKE_MODE |
 			                         CTRL_INTERRUPTS_ENABLE);
 
-		bytes = mac_pdma_send(s, d, min(hostdata->pdma_residual, 512));
+		chunk_bytes = min(hostdata->pdma_residual, 512);
+		bytes = mac_pdma_send(s, d, chunk_bytes);
+
+		if (macintosh_config->ident == MAC_MODEL_IIFX)
+			write_ctrl_reg(hostdata, CTRL_INTERRUPTS_ENABLE);
 
 		if (bytes > 0) {
 			s += bytes;
 			hostdata->pdma_residual -= bytes;
 		}
 
-		if (hostdata->pdma_residual == 0) {
-			if (NCR5380_poll_politely(hostdata, TARGET_COMMAND_REG,
-			                          TCR_LAST_BYTE_SENT,
-			                          TCR_LAST_BYTE_SENT,
-			                          0) < 0) {
-				scmd_printk(KERN_ERR, hostdata->connected,
-				            "%s: Last Byte Sent timeout\n", __func__);
-				result = -1;
-			}
-			goto out;
-		}
+		if (hostdata->pdma_residual == 0)
+			break;
 
-		if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
-		                           BUS_AND_STATUS_REG, BASR_ACK,
-		                           BASR_ACK, 0) < 0)
-			scmd_printk(KERN_DEBUG, hostdata->connected,
-			            "%s: !REQ and !ACK\n", __func__);
-		if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
-			goto out;
+		if (bytes > 0)
+			continue;
 
-		if (bytes == 0)
-			udelay(MAC_PDMA_DELAY);
+		NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
+		dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
+			 "%s: bus error [%d/%d] (%d/%d)\n",
+			 __func__, s - src, len, bytes, chunk_bytes);
 
-		if (bytes >= 0)
+		if (bytes == 0)
 			continue;
 
-		dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
-		         "%s: bus error (%d/%d)\n", __func__, s - src, len);
-		NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
-		result = -1;
-		goto out;
+		if (macscsi_wait_for_drq(hostdata) <= 0)
+			set_host_byte(hostdata->connected, DID_ERROR);
+		break;
 	}
 
-	scmd_printk(KERN_ERR, hostdata->connected,
-	            "%s: phase mismatch or !DRQ\n", __func__);
-	NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
-	result = -1;
-out:
-	if (macintosh_config->ident == MAC_MODEL_IIFX)
-		write_ctrl_reg(hostdata, CTRL_INTERRUPTS_ENABLE);
-	return result;
+	return 0;
 }
 
 static int macscsi_dma_xfer_len(struct NCR5380_hostdata *hostdata,
--- linux-qcom-6.8.0.orig/drivers/scsi/megaraid/megaraid_sas_base.c
+++ linux-qcom-6.8.0/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -8904,8 +8904,11 @@
 						   (ld_target_id / MEGASAS_MAX_DEV_PER_CHANNEL),
 						   (ld_target_id % MEGASAS_MAX_DEV_PER_CHANNEL),
 						   0);
-			if (sdev1)
+			if (sdev1) {
+				mutex_unlock(&instance->reset_mutex);
 				megasas_remove_scsi_device(sdev1);
+				mutex_lock(&instance->reset_mutex);
+			}
 
 			event_type = SCAN_VD_CHANNEL;
 			break;
--- linux-qcom-6.8.0.orig/drivers/scsi/mpi3mr/mpi/mpi30_tool.h
+++ linux-qcom-6.8.0/drivers/scsi/mpi3mr/mpi/mpi30_tool.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *  Copyright 2016-2024 Broadcom Inc. All rights reserved.
+ */
+#ifndef MPI30_TOOL_H
+#define MPI30_TOOL_H     1
+
+#define MPI3_DIAG_BUFFER_TYPE_TRACE	(0x01)
+#define MPI3_DIAG_BUFFER_TYPE_FW	(0x02)
+#define MPI3_DIAG_BUFFER_ACTION_RELEASE	(0x01)
+
+struct mpi3_diag_buffer_post_request {
+	__le16                     host_tag;
+	u8                         ioc_use_only02;
+	u8                         function;
+	__le16                     ioc_use_only04;
+	u8                         ioc_use_only06;
+	u8                         msg_flags;
+	__le16                     change_count;
+	__le16                     reserved0a;
+	u8                         type;
+	u8                         reserved0d;
+	__le16                     reserved0e;
+	__le64                     address;
+	__le32                     length;
+	__le32                     reserved1c;
+};
+
+struct mpi3_diag_buffer_manage_request {
+	__le16                     host_tag;
+	u8                         ioc_use_only02;
+	u8                         function;
+	__le16                     ioc_use_only04;
+	u8                         ioc_use_only06;
+	u8                         msg_flags;
+	__le16                     change_count;
+	__le16                     reserved0a;
+	u8                         type;
+	u8                         action;
+	__le16                     reserved0e;
+};
+
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/scsi/mpi3mr/mpi3mr.h
+++ linux-qcom-6.8.0/drivers/scsi/mpi3mr/mpi3mr.h
@@ -23,6 +23,7 @@
 #include <linux/miscdevice.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/aer.h>
 #include <linux/poll.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -47,6 +48,7 @@
 #include "mpi/mpi30_ioc.h"
 #include "mpi/mpi30_sas.h"
 #include "mpi/mpi30_pci.h"
+#include "mpi/mpi30_tool.h"
 #include "mpi3mr_debug.h"
 
 /* Global list and lock for storing multiple adapters managed by the driver */
@@ -55,8 +57,8 @@
 extern int prot_mask;
 extern atomic64_t event_counter;
 
-#define MPI3MR_DRIVER_VERSION	"8.5.1.0.0"
-#define MPI3MR_DRIVER_RELDATE	"5-December-2023"
+#define MPI3MR_DRIVER_VERSION	"8.9.1.0.51"
+#define MPI3MR_DRIVER_RELDATE	"29-May-2024"
 
 #define MPI3MR_DRIVER_NAME	"mpi3mr"
 #define MPI3MR_DRIVER_LICENSE	"GPL"
@@ -128,11 +130,10 @@
 #define MPI3MR_PREPARE_FOR_RESET_TIMEOUT	180
 #define MPI3MR_RESET_ACK_TIMEOUT		30
 #define MPI3MR_MUR_TIMEOUT			120
+#define MPI3MR_RESET_TIMEOUT			510
 
 #define MPI3MR_WATCHDOG_INTERVAL		1000 /* in milli seconds */
 
-#define MPI3MR_DEFAULT_CFG_PAGE_SZ		1024 /* in bytes */
-
 #define MPI3MR_RESET_TOPOLOGY_SETTLE_TIME	10
 
 #define MPI3MR_SCMD_TIMEOUT    (60 * HZ)
@@ -187,6 +188,30 @@
 #define MPI3MR_HARD_SECURE_DEVICE		0x08
 #define MPI3MR_TAMPERED_DEVICE			0x0C
 
+#define MPI3MR_DEFAULT_HDB_MAX_SZ       (4 * 1024 * 1024)
+#define MPI3MR_DEFAULT_HDB_DEC_SZ       (1 * 1024 * 1024)
+#define MPI3MR_DEFAULT_HDB_MIN_SZ       (2 * 1024 * 1024)
+#define MPI3MR_MAX_NUM_HDB      2
+
+#define MPI3MR_HDB_TRIGGER_TYPE_UNKNOWN		0
+#define MPI3MR_HDB_TRIGGER_TYPE_FAULT		1
+#define MPI3MR_HDB_TRIGGER_TYPE_ELEMENT		2
+#define MPI3MR_HDB_TRIGGER_TYPE_GLOBAL          3
+#define MPI3MR_HDB_TRIGGER_TYPE_SOFT_RESET	4
+#define MPI3MR_HDB_TRIGGER_TYPE_FW_RELEASED	5
+
+#define MPI3MR_HDB_REFRESH_TYPE_RESERVED       0
+#define MPI3MR_HDB_REFRESH_TYPE_CURRENT                1
+#define MPI3MR_HDB_REFRESH_TYPE_DEFAULT                2
+#define MPI3MR_HDB_HDB_REFRESH_TYPE_PERSISTENT 3
+
+#define MPI3MR_DEFAULT_HDB_SZ  (4 * 1024 * 1024)
+#define MPI3MR_MAX_NUM_HDB     2
+
+#define MPI3MR_HDB_QUERY_ELEMENT_TRIGGER_FORMAT_INDEX   0
+#define MPI3MR_HDB_QUERY_ELEMENT_TRIGGER_FORMAT_DATA    1
+
+
 /* SGE Flag definition */
 #define MPI3MR_SGEFLAGS_SYSTEM_SIMPLE_END_OF_LIST \
 	(MPI3_SGE_FLAGS_ELEMENT_TYPE_SIMPLE | MPI3_SGE_FLAGS_DLAS_SYSTEM | \
@@ -210,6 +235,8 @@
 #define MPI3MR_WRITE_SAME_MAX_LEN_256_BLKS 256
 #define MPI3MR_WRITE_SAME_MAX_LEN_2048_BLKS 2048
 
+#define MPI3MR_DRIVER_EVENT_PROCESS_TRIGGER    (0xFFFD)
+
 /**
  * struct mpi3mr_nvme_pt_sge -  Structure to store SGEs for NVMe
  * Encapsulated commands.
@@ -289,9 +316,12 @@
 	MPI3MR_RESET_FROM_PELABORT_TIMEOUT = 22,
 	MPI3MR_RESET_FROM_SYSFS = 23,
 	MPI3MR_RESET_FROM_SYSFS_TIMEOUT = 24,
+	MPI3MR_RESET_FROM_DIAG_BUFFER_POST_TIMEOUT = 25,
+	MPI3MR_RESET_FROM_DIAG_BUFFER_RELEASE_TIMEOUT = 26,
 	MPI3MR_RESET_FROM_FIRMWARE = 27,
 	MPI3MR_RESET_FROM_CFG_REQ_TIMEOUT = 29,
 	MPI3MR_RESET_FROM_SAS_TRANSPORT_TIMEOUT = 30,
+	MPI3MR_RESET_FROM_TRIGGER = 31,
 };
 
 /* Queue type definitions */
@@ -323,6 +353,9 @@
 	u32 ioc_capabilities;
 	struct mpi3mr_compimg_ver fw_ver;
 	u32 mpi_version;
+	u32 diag_trace_sz;
+	u32 diag_fw_sz;
+	u32 diag_drvr_sz;
 	u16 max_reqs;
 	u16 product_id;
 	u16 op_req_sz;
@@ -480,6 +513,7 @@
 
 /* HBA port flags */
 #define MPI3MR_HBA_PORT_FLAG_DIRTY	0x01
+#define MPI3MR_HBA_PORT_FLAG_NEW       0x02
 
 /* IOCTL data transfer sge*/
 #define MPI3MR_NUM_IOCTL_SGE		256
@@ -501,8 +535,8 @@
  * @port_list: List of ports belonging to a SAS node
  * @num_phys: Number of phys associated with port
  * @marked_responding: used while refresing the sas ports
- * @lowest_phy: lowest phy ID of current sas port
- * @phy_mask: phy_mask of current sas port
+ * @lowest_phy: lowest phy ID of current sas port, valid for controller port
+ * @phy_mask: phy_mask of current sas port, valid for controller port
  * @hba_port: HBA port entry
  * @remote_identify: Attached device identification
  * @rphy: SAS transport layer rphy object
@@ -849,6 +883,59 @@
 };
 
 /**
+ * union mpi3mr_trigger_data - Trigger data information
+ * @fault: Fault code
+ * @global: Global trigger data
+ * @element: element trigger data
+ */
+union mpi3mr_trigger_data {
+	u16 fault;
+	u64 global;
+	union mpi3_driver2_trigger_element element;
+};
+
+/**
+ * struct trigger_event_data - store trigger related
+ * information.
+ *
+ * @trace_hdb: Trace diag buffer descriptor reference
+ * @fw_hdb: FW diag buffer descriptor reference
+ * @trigger_type: Trigger type
+ * @trigger_specific_data: Trigger specific data
+ * @snapdump: Snapdump enable or disable flag
+ */
+struct trigger_event_data {
+	struct diag_buffer_desc *trace_hdb;
+	struct diag_buffer_desc *fw_hdb;
+	u8 trigger_type;
+	union mpi3mr_trigger_data trigger_specific_data;
+	bool snapdump;
+};
+
+/**
+ * struct diag_buffer_desc - memory descriptor structure to
+ * store virtual, dma addresses, size, buffer status for host
+ * diagnostic buffers.
+ *
+ * @type: Buffer type
+ * @trigger_data: Trigger data
+ * @trigger_type: Trigger type
+ * @status: Buffer status
+ * @size: Buffer size
+ * @addr: Virtual address
+ * @dma_addr: Buffer DMA address
+ */
+struct diag_buffer_desc {
+	u8 type;
+	union mpi3mr_trigger_data trigger_data;
+	u8 trigger_type;
+	u8 status;
+	u32 size;
+	void *addr;
+	dma_addr_t dma_addr;
+};
+
+/**
  * struct dma_memory_desc - memory descriptor structure to store
  * virtual address, dma address and size for any generic dma
  * memory allocations in the driver.
@@ -1039,9 +1126,6 @@
  * @io_throttle_low: I/O size to stop throttle in 512b blocks
  * @num_io_throttle_group: Maximum number of throttle groups
  * @throttle_groups: Pointer to throttle group info structures
- * @cfg_page: Default memory for configuration pages
- * @cfg_page_dma: Configuration page DMA address
- * @cfg_page_sz: Default configuration page memory size
  * @sas_transport_enabled: SAS transport enabled or not
  * @scsi_device_channel: Channel ID for SCSI devices
  * @transport_cmds: Command tracker for SAS transport commands
@@ -1050,11 +1134,21 @@
  * @sas_node_lock: Lock to protect SAS node list
  * @hba_port_table_list: List of HBA Ports
  * @enclosure_list: List of Enclosure objects
+ * @diag_buffers: Host diagnostic buffers
+ * @driver_pg2:  Driver page 2 pointer
+ * @reply_trigger_present: Reply trigger present flag
+ * @event_trigger_present: Event trigger present flag
+ * @scsisense_trigger_present: Scsi sense trigger present flag
  * @ioctl_dma_pool: DMA pool for IOCTL data buffers
  * @ioctl_sge: DMA buffer descriptors for IOCTL data
  * @ioctl_chain_sge: DMA buffer descriptor for IOCTL chain
  * @ioctl_resp_sge: DMA buffer descriptor for Mgmt cmd response
  * @ioctl_sges_allocated: Flag for IOCTL SGEs allocated or not
+ * @trace_release_trigger_active: Trace trigger active flag
+ * @fw_release_trigger_active: Fw release trigger active flag
+ * @snapdump_trigger_active: Snapdump trigger active flag
+ * @pci_err_recovery: PCI error recovery in progress
+ * @block_on_pci_err: Block IO during PCI error recovery
  */
 struct mpi3mr_ioc {
 	struct list_head list;
@@ -1228,10 +1322,6 @@
 	u16 num_io_throttle_group;
 	struct mpi3mr_throttle_group_info *throttle_groups;
 
-	void *cfg_page;
-	dma_addr_t cfg_page_dma;
-	u16 cfg_page_sz;
-
 	u8 sas_transport_enabled;
 	u8 scsi_device_channel;
 	struct mpi3mr_drv_cmd transport_cmds;
@@ -1246,6 +1336,17 @@
 	struct dma_memory_desc ioctl_chain_sge;
 	struct dma_memory_desc ioctl_resp_sge;
 	bool ioctl_sges_allocated;
+	bool reply_trigger_present;
+	bool event_trigger_present;
+	bool scsisense_trigger_present;
+	struct diag_buffer_desc diag_buffers[MPI3MR_MAX_NUM_HDB];
+	struct mpi3_driver_page2 *driver_pg2;
+	spinlock_t trigger_lock;
+	bool snapdump_trigger_active;
+	bool trace_release_trigger_active;
+	bool fw_release_trigger_active;
+	bool pci_err_recovery;
+	bool block_on_pci_err;
 };
 
 /**
@@ -1403,6 +1504,8 @@
 	struct mpi3_sas_io_unit_page1 *sas_io_unit_pg1, u16 pg_sz);
 int mpi3mr_cfg_get_driver_pg1(struct mpi3mr_ioc *mrioc,
 	struct mpi3_driver_page1 *driver_pg1, u16 pg_sz);
+int mpi3mr_cfg_get_driver_pg2(struct mpi3mr_ioc *mrioc,
+	struct mpi3_driver_page2 *driver_pg2, u16 pg_sz, u8 page_type);
 
 u8 mpi3mr_is_expander_device(u16 device_info);
 int mpi3mr_expander_add(struct mpi3mr_ioc *mrioc, u16 handle);
@@ -1436,4 +1539,28 @@
 int mpi3mr_process_admin_reply_q(struct mpi3mr_ioc *mrioc);
 void mpi3mr_expander_node_remove(struct mpi3mr_ioc *mrioc,
 	struct mpi3mr_sas_node *sas_expander);
+void mpi3mr_alloc_diag_bufs(struct mpi3mr_ioc *mrioc);
+int mpi3mr_post_diag_bufs(struct mpi3mr_ioc *mrioc);
+int mpi3mr_issue_diag_buf_release(struct mpi3mr_ioc *mrioc,
+	struct diag_buffer_desc *diag_buffer);
+void mpi3mr_release_diag_bufs(struct mpi3mr_ioc *mrioc, u8 skip_rel_action);
+void mpi3mr_set_trigger_data_in_hdb(struct diag_buffer_desc *hdb,
+	u8 type, union mpi3mr_trigger_data *trigger_data, bool force);
+int mpi3mr_refresh_trigger(struct mpi3mr_ioc *mrioc, u8 page_type);
+struct diag_buffer_desc *mpi3mr_diag_buffer_for_type(struct mpi3mr_ioc *mrioc,
+	u8 buf_type);
+int mpi3mr_issue_diag_buf_post(struct mpi3mr_ioc *mrioc,
+	struct diag_buffer_desc *diag_buffer);
+void mpi3mr_set_trigger_data_in_all_hdb(struct mpi3mr_ioc *mrioc,
+	u8 type, union mpi3mr_trigger_data *trigger_data, bool force);
+void mpi3mr_reply_trigger(struct mpi3mr_ioc *mrioc, u16 iocstatus,
+	u32 iocloginfo);
+void mpi3mr_hdb_trigger_data_event(struct mpi3mr_ioc *mrioc,
+	struct trigger_event_data *event_data);
+void mpi3mr_scsisense_trigger(struct mpi3mr_ioc *mrioc, u8 senseky, u8 asc,
+	u8 ascq);
+void mpi3mr_event_trigger(struct mpi3mr_ioc *mrioc, u8 event);
+void mpi3mr_global_trigger(struct mpi3mr_ioc *mrioc, u64 trigger_data);
+void mpi3mr_hdbstatuschg_evt_th(struct mpi3mr_ioc *mrioc,
+	struct mpi3_event_notification_reply *event_reply);
 #endif /*MPI3MR_H_INCLUDED*/
--- linux-qcom-6.8.0.orig/drivers/scsi/mpi3mr/mpi3mr_app.c
+++ linux-qcom-6.8.0/drivers/scsi/mpi3mr/mpi3mr_app.c
@@ -12,6 +12,821 @@
 #include <uapi/scsi/scsi_bsg_mpi3mr.h>
 
 /**
+ * mpi3mr_alloc_trace_buffer:	Allocate trace buffer
+ * @mrioc: Adapter instance reference
+ * @trace_size: Trace buffer size
+ *
+ * Allocate trace buffer
+ * Return: 0 on success, non-zero on failure.
+ */
+static int mpi3mr_alloc_trace_buffer(struct mpi3mr_ioc *mrioc, u32 trace_size)
+{
+	struct diag_buffer_desc *diag_buffer = &mrioc->diag_buffers[0];
+
+	diag_buffer->addr = dma_alloc_coherent(&mrioc->pdev->dev,
+	    trace_size, &diag_buffer->dma_addr, GFP_KERNEL);
+	if (diag_buffer->addr) {
+		dprint_init(mrioc, "trace diag buffer is allocated successfully\n");
+		return 0;
+	}
+	return -1;
+}
+
+/**
+ * mpi3mr_alloc_diag_bufs - Allocate memory for diag buffers
+ * @mrioc: Adapter instance reference
+ *
+ * This functions checks whether the driver defined buffer sizes
+ * are greater than IOCFacts provided controller local buffer
+ * sizes and if the driver defined sizes are more then the
+ * driver allocates the specific buffer by reading driver page1
+ *
+ * Return: Nothing.
+ */
+void mpi3mr_alloc_diag_bufs(struct mpi3mr_ioc *mrioc)
+{
+	struct diag_buffer_desc *diag_buffer;
+	struct mpi3_driver_page1 driver_pg1;
+	u32 trace_dec_size, trace_min_size, fw_dec_size, fw_min_size,
+		trace_size, fw_size;
+	u16 pg_sz = sizeof(driver_pg1);
+	int retval = 0;
+	bool retry = false;
+
+	if (mrioc->diag_buffers[0].addr || mrioc->diag_buffers[1].addr)
+		return;
+
+	retval = mpi3mr_cfg_get_driver_pg1(mrioc, &driver_pg1, pg_sz);
+	if (retval) {
+		ioc_warn(mrioc,
+		    "%s: driver page 1 read failed, allocating trace\n"
+		    "and firmware diag buffers of default size\n", __func__);
+		trace_size = fw_size = MPI3MR_DEFAULT_HDB_MAX_SZ;
+		trace_dec_size = fw_dec_size = MPI3MR_DEFAULT_HDB_DEC_SZ;
+		trace_min_size = fw_min_size = MPI3MR_DEFAULT_HDB_MIN_SZ;
+
+	} else {
+		trace_size = driver_pg1.host_diag_trace_max_size * 1024;
+		trace_dec_size = driver_pg1.host_diag_trace_decrement_size
+			 * 1024;
+		trace_min_size = driver_pg1.host_diag_trace_min_size * 1024;
+		fw_size = driver_pg1.host_diag_fw_max_size * 1024;
+		fw_dec_size = driver_pg1.host_diag_fw_decrement_size * 1024;
+		fw_min_size = driver_pg1.host_diag_fw_min_size * 1024;
+		dprint_init(mrioc,
+		    "%s:trace diag buffer sizes read from driver\n"
+		    "page1: maximum size = %dKB, decrement size = %dKB\n"
+		    ", minimum size = %dKB\n", __func__, driver_pg1.host_diag_trace_max_size,
+		    driver_pg1.host_diag_trace_decrement_size,
+		    driver_pg1.host_diag_trace_min_size);
+		dprint_init(mrioc,
+		    "%s:firmware diag buffer sizes read from driver\n"
+		    "page1: maximum size = %dKB, decrement size = %dKB\n"
+		    ", minimum size = %dKB\n", __func__, driver_pg1.host_diag_fw_max_size,
+		    driver_pg1.host_diag_fw_decrement_size,
+		    driver_pg1.host_diag_fw_min_size);
+		if ((trace_size == 0) && (fw_size == 0))
+			return;
+	}
+
+
+retry_trace:
+	diag_buffer = &mrioc->diag_buffers[0];
+	diag_buffer->type = MPI3_DIAG_BUFFER_TYPE_TRACE;
+	diag_buffer->status = MPI3MR_HDB_BUFSTATUS_NOT_ALLOCATED;
+	if ((mrioc->facts.diag_trace_sz < trace_size) && (trace_size >=
+		trace_min_size)) {
+		if (!retry)
+			dprint_init(mrioc,
+			    "trying to allocate trace diag buffer of size = %dKB\n",
+			    trace_size / 1024);
+		if (mpi3mr_alloc_trace_buffer(mrioc, trace_size)) {
+			retry = true;
+			trace_size -= trace_dec_size;
+			dprint_init(mrioc, "trace diag buffer allocation failed\n"
+			"retrying smaller size %dKB\n", trace_size / 1024);
+			goto retry_trace;
+		} else
+			diag_buffer->size = trace_size;
+	}
+
+	retry = false;
+retry_fw:
+
+	diag_buffer = &mrioc->diag_buffers[1];
+
+	diag_buffer->type = MPI3_DIAG_BUFFER_TYPE_FW;
+	diag_buffer->status = MPI3MR_HDB_BUFSTATUS_NOT_ALLOCATED;
+	if ((mrioc->facts.diag_fw_sz < fw_size) && (fw_size >= fw_min_size)) {
+		diag_buffer->addr = dma_alloc_coherent(&mrioc->pdev->dev,
+		    fw_size, &diag_buffer->dma_addr, GFP_KERNEL);
+		if (!retry)
+			dprint_init(mrioc,
+			    "%s:trying to allocate firmware diag buffer of size = %dKB\n",
+			    __func__, fw_size / 1024);
+		if (diag_buffer->addr) {
+			dprint_init(mrioc, "%s:firmware diag buffer allocated successfully\n",
+			    __func__);
+			diag_buffer->size = fw_size;
+		} else {
+			retry = true;
+			fw_size -= fw_dec_size;
+			dprint_init(mrioc, "%s:trace diag buffer allocation failed,\n"
+					"retrying smaller size %dKB\n",
+					__func__, fw_size / 1024);
+			goto retry_fw;
+		}
+	}
+}
+
+/**
+ * mpi3mr_issue_diag_buf_post - Send diag buffer post req
+ * @mrioc: Adapter instance reference
+ * @diag_buffer: Diagnostic buffer descriptor
+ *
+ * Issue diagnostic buffer post MPI request through admin queue
+ * and wait for the completion of it or time out.
+ *
+ * Return: 0 on success, non-zero on failures.
+ */
+int mpi3mr_issue_diag_buf_post(struct mpi3mr_ioc *mrioc,
+	struct diag_buffer_desc *diag_buffer)
+{
+	struct mpi3_diag_buffer_post_request diag_buf_post_req;
+	u8 prev_status;
+	int retval = 0;
+
+	memset(&diag_buf_post_req, 0, sizeof(diag_buf_post_req));
+	mutex_lock(&mrioc->init_cmds.mutex);
+	if (mrioc->init_cmds.state & MPI3MR_CMD_PENDING) {
+		dprint_bsg_err(mrioc, "%s: command is in use\n", __func__);
+		mutex_unlock(&mrioc->init_cmds.mutex);
+		return -1;
+	}
+	mrioc->init_cmds.state = MPI3MR_CMD_PENDING;
+	mrioc->init_cmds.is_waiting = 1;
+	mrioc->init_cmds.callback = NULL;
+	diag_buf_post_req.host_tag = cpu_to_le16(MPI3MR_HOSTTAG_INITCMDS);
+	diag_buf_post_req.function = MPI3_FUNCTION_DIAG_BUFFER_POST;
+	diag_buf_post_req.type = diag_buffer->type;
+	diag_buf_post_req.address = le64_to_cpu(diag_buffer->dma_addr);
+	diag_buf_post_req.length = le32_to_cpu(diag_buffer->size);
+
+	dprint_bsg_info(mrioc, "%s: posting diag buffer type %d\n", __func__,
+	    diag_buffer->type);
+	prev_status = diag_buffer->status;
+	diag_buffer->status = MPI3MR_HDB_BUFSTATUS_POSTED_UNPAUSED;
+	init_completion(&mrioc->init_cmds.done);
+	retval = mpi3mr_admin_request_post(mrioc, &diag_buf_post_req,
+	    sizeof(diag_buf_post_req), 1);
+	if (retval) {
+		dprint_bsg_err(mrioc, "%s: admin request post failed\n",
+		    __func__);
+		goto out_unlock;
+	}
+	wait_for_completion_timeout(&mrioc->init_cmds.done,
+	    (MPI3MR_INTADMCMD_TIMEOUT * HZ));
+	if (!(mrioc->init_cmds.state & MPI3MR_CMD_COMPLETE)) {
+		mrioc->init_cmds.is_waiting = 0;
+		dprint_bsg_err(mrioc, "%s: command timedout\n", __func__);
+		mpi3mr_check_rh_fault_ioc(mrioc,
+		    MPI3MR_RESET_FROM_DIAG_BUFFER_POST_TIMEOUT);
+		retval = -1;
+		goto out_unlock;
+	}
+	if ((mrioc->init_cmds.ioc_status & MPI3_IOCSTATUS_STATUS_MASK)
+	    != MPI3_IOCSTATUS_SUCCESS) {
+		dprint_bsg_err(mrioc,
+		    "%s: command failed, buffer_type (%d) ioc_status(0x%04x) log_info(0x%08x)\n",
+		    __func__, diag_buffer->type,
+		    (mrioc->init_cmds.ioc_status & MPI3_IOCSTATUS_STATUS_MASK),
+		    mrioc->init_cmds.ioc_loginfo);
+		retval = -1;
+		goto out_unlock;
+	}
+	dprint_bsg_info(mrioc, "%s: diag buffer type %d posted successfully\n",
+	    __func__, diag_buffer->type);
+
+out_unlock:
+	if (retval)
+		diag_buffer->status = prev_status;
+	mrioc->init_cmds.state = MPI3MR_CMD_NOTUSED;
+	mutex_unlock(&mrioc->init_cmds.mutex);
+	return retval;
+}
+
+/**
+ * mpi3mr_post_diag_bufs - Post diag buffers to the controller
+ * @mrioc: Adapter instance reference
+ *
+ * This function calls helper function to post both trace and
+ * firmware buffers to the controller.
+ *
+ * Return: None
+ */
+int mpi3mr_post_diag_bufs(struct mpi3mr_ioc *mrioc)
+{
+	u8 i;
+	struct diag_buffer_desc *diag_buffer;
+
+	for (i = 0; i < MPI3MR_MAX_NUM_HDB; i++) {
+		diag_buffer = &mrioc->diag_buffers[i];
+		if (!(diag_buffer->addr))
+			continue;
+		if (mpi3mr_issue_diag_buf_post(mrioc, diag_buffer))
+			return -1;
+	}
+	return 0;
+}
+
+/**
+ * mpi3mr_issue_diag_buf_release - Send diag buffer release req
+ * @mrioc: Adapter instance reference
+ * @diag_buffer: Diagnostic buffer descriptor
+ *
+ * Issue diagnostic buffer manage MPI request with release
+ * action request through admin queue and wait for the
+ * completion of it or time out.
+ *
+ * Return: 0 on success, non-zero on failures.
+ */
+int mpi3mr_issue_diag_buf_release(struct mpi3mr_ioc *mrioc,
+	struct diag_buffer_desc *diag_buffer)
+{
+	struct mpi3_diag_buffer_manage_request diag_buf_manage_req;
+	int retval = 0;
+
+	if ((diag_buffer->status != MPI3MR_HDB_BUFSTATUS_POSTED_UNPAUSED) &&
+	    (diag_buffer->status != MPI3MR_HDB_BUFSTATUS_POSTED_PAUSED))
+		return retval;
+
+	memset(&diag_buf_manage_req, 0, sizeof(diag_buf_manage_req));
+	mutex_lock(&mrioc->init_cmds.mutex);
+	if (mrioc->init_cmds.state & MPI3MR_CMD_PENDING) {
+		dprint_reset(mrioc, "%s: command is in use\n", __func__);
+		mutex_unlock(&mrioc->init_cmds.mutex);
+		return -1;
+	}
+	mrioc->init_cmds.state = MPI3MR_CMD_PENDING;
+	mrioc->init_cmds.is_waiting = 1;
+	mrioc->init_cmds.callback = NULL;
+	diag_buf_manage_req.host_tag = cpu_to_le16(MPI3MR_HOSTTAG_INITCMDS);
+	diag_buf_manage_req.function = MPI3_FUNCTION_DIAG_BUFFER_MANAGE;
+	diag_buf_manage_req.type = diag_buffer->type;
+	diag_buf_manage_req.action = MPI3_DIAG_BUFFER_ACTION_RELEASE;
+
+
+	dprint_reset(mrioc, "%s: releasing diag buffer type %d\n", __func__,
+	    diag_buffer->type);
+	init_completion(&mrioc->init_cmds.done);
+	retval = mpi3mr_admin_request_post(mrioc, &diag_buf_manage_req,
+	    sizeof(diag_buf_manage_req), 1);
+	if (retval) {
+		dprint_reset(mrioc, "%s: admin request post failed\n", __func__);
+		mpi3mr_set_trigger_data_in_hdb(diag_buffer,
+		    MPI3MR_HDB_TRIGGER_TYPE_UNKNOWN, NULL, 1);
+		goto out_unlock;
+	}
+	wait_for_completion_timeout(&mrioc->init_cmds.done,
+	    (MPI3MR_INTADMCMD_TIMEOUT * HZ));
+	if (!(mrioc->init_cmds.state & MPI3MR_CMD_COMPLETE)) {
+		mrioc->init_cmds.is_waiting = 0;
+		dprint_reset(mrioc, "%s: command timedout\n", __func__);
+		mpi3mr_check_rh_fault_ioc(mrioc,
+		    MPI3MR_RESET_FROM_DIAG_BUFFER_RELEASE_TIMEOUT);
+		retval = -1;
+		goto out_unlock;
+	}
+	if ((mrioc->init_cmds.ioc_status & MPI3_IOCSTATUS_STATUS_MASK)
+	    != MPI3_IOCSTATUS_SUCCESS) {
+		dprint_reset(mrioc,
+		    "%s: command failed, buffer_type (%d) ioc_status(0x%04x) log_info(0x%08x)\n",
+		    __func__, diag_buffer->type,
+		    (mrioc->init_cmds.ioc_status & MPI3_IOCSTATUS_STATUS_MASK),
+		    mrioc->init_cmds.ioc_loginfo);
+		retval = -1;
+		goto out_unlock;
+	}
+	dprint_reset(mrioc, "%s: diag buffer type %d released successfully\n",
+	    __func__, diag_buffer->type);
+
+out_unlock:
+	mrioc->init_cmds.state = MPI3MR_CMD_NOTUSED;
+	mutex_unlock(&mrioc->init_cmds.mutex);
+	return retval;
+}
+
+/**
+ * mpi3mr_process_trigger - Generic HDB Trigger handler
+ * @mrioc: Adapter instance reference
+ * @trigger_type: Trigger type
+ * @trigger_data: Trigger data
+ * @trigger_flags: Trigger flags
+ *
+ * This function checks validity of HDB, triggers and based on
+ * trigger information, creates an event to be processed in the
+ * firmware event worker thread .
+ *
+ * This function should be called with trigger spinlock held
+ *
+ * Return: Nothing
+ */
+static void mpi3mr_process_trigger(struct mpi3mr_ioc *mrioc, u8 trigger_type,
+	union mpi3mr_trigger_data *trigger_data, u8 trigger_flags)
+{
+	struct trigger_event_data event_data;
+	struct diag_buffer_desc *trace_hdb = NULL;
+	struct diag_buffer_desc *fw_hdb = NULL;
+	u64 global_trigger;
+
+	trace_hdb = mpi3mr_diag_buffer_for_type(mrioc,
+	    MPI3_DIAG_BUFFER_TYPE_TRACE);
+	if (trace_hdb &&
+	    (trace_hdb->status != MPI3MR_HDB_BUFSTATUS_POSTED_UNPAUSED) &&
+	    (trace_hdb->status != MPI3MR_HDB_BUFSTATUS_POSTED_PAUSED))
+		trace_hdb =  NULL;
+
+	fw_hdb = mpi3mr_diag_buffer_for_type(mrioc, MPI3_DIAG_BUFFER_TYPE_FW);
+
+	if (fw_hdb &&
+	    (fw_hdb->status != MPI3MR_HDB_BUFSTATUS_POSTED_UNPAUSED) &&
+	    (fw_hdb->status != MPI3MR_HDB_BUFSTATUS_POSTED_PAUSED))
+		fw_hdb = NULL;
+
+	if (mrioc->snapdump_trigger_active || (mrioc->fw_release_trigger_active
+	    && mrioc->trace_release_trigger_active) ||
+	    (!trace_hdb && !fw_hdb) || (!mrioc->driver_pg2) ||
+	    ((trigger_type == MPI3MR_HDB_TRIGGER_TYPE_ELEMENT)
+	     && (!mrioc->driver_pg2->num_triggers)))
+		return;
+
+	memset(&event_data, 0, sizeof(event_data));
+	event_data.trigger_type = trigger_type;
+	memcpy(&event_data.trigger_specific_data, trigger_data,
+	    sizeof(*trigger_data));
+	global_trigger = le64_to_cpu(mrioc->driver_pg2->global_trigger);
+
+	if (global_trigger & MPI3_DRIVER2_GLOBALTRIGGER_SNAPDUMP_ENABLED) {
+		event_data.snapdump = true;
+		event_data.trace_hdb = trace_hdb;
+		event_data.fw_hdb = fw_hdb;
+		mrioc->snapdump_trigger_active = true;
+	} else if (trigger_type == MPI3MR_HDB_TRIGGER_TYPE_GLOBAL) {
+		if ((trace_hdb) && (global_trigger &
+		    MPI3_DRIVER2_GLOBALTRIGGER_DIAG_TRACE_RELEASE) &&
+		    (!mrioc->trace_release_trigger_active)) {
+			event_data.trace_hdb = trace_hdb;
+			mrioc->trace_release_trigger_active = true;
+		}
+		if ((fw_hdb) && (global_trigger &
+		    MPI3_DRIVER2_GLOBALTRIGGER_DIAG_FW_RELEASE) &&
+		    (!mrioc->fw_release_trigger_active)) {
+			event_data.fw_hdb = fw_hdb;
+			mrioc->fw_release_trigger_active = true;
+		}
+	} else if (trigger_type == MPI3MR_HDB_TRIGGER_TYPE_ELEMENT) {
+		if ((trace_hdb) && (trigger_flags &
+		    MPI3_DRIVER2_TRIGGER_FLAGS_DIAG_TRACE_RELEASE) &&
+		    (!mrioc->trace_release_trigger_active)) {
+			event_data.trace_hdb = trace_hdb;
+			mrioc->trace_release_trigger_active = true;
+		}
+		if ((fw_hdb) && (trigger_flags &
+		    MPI3_DRIVER2_TRIGGER_FLAGS_DIAG_FW_RELEASE) &&
+		    (!mrioc->fw_release_trigger_active)) {
+			event_data.fw_hdb = fw_hdb;
+			mrioc->fw_release_trigger_active = true;
+		}
+	}
+
+	if (event_data.trace_hdb || event_data.fw_hdb)
+		mpi3mr_hdb_trigger_data_event(mrioc, &event_data);
+}
+
+/**
+ * mpi3mr_global_trigger - Global HDB trigger handler
+ * @mrioc: Adapter instance reference
+ * @trigger_data: Trigger data
+ *
+ * This function checks whether the given global trigger is
+ * enabled in the driver page 2 and if so calls generic trigger
+ * handler to queue event for HDB release.
+ *
+ * Return: Nothing
+ */
+void mpi3mr_global_trigger(struct mpi3mr_ioc *mrioc, u64 trigger_data)
+{
+	unsigned long flags;
+	union mpi3mr_trigger_data trigger_specific_data;
+
+	spin_lock_irqsave(&mrioc->trigger_lock, flags);
+	if (le64_to_cpu(mrioc->driver_pg2->global_trigger) & trigger_data) {
+		memset(&trigger_specific_data, 0,
+		    sizeof(trigger_specific_data));
+		trigger_specific_data.global = trigger_data;
+		mpi3mr_process_trigger(mrioc, MPI3MR_HDB_TRIGGER_TYPE_GLOBAL,
+		    &trigger_specific_data, 0);
+	}
+	spin_unlock_irqrestore(&mrioc->trigger_lock, flags);
+}
+
+/**
+ * mpi3mr_scsisense_trigger - SCSI sense HDB trigger handler
+ * @mrioc: Adapter instance reference
+ * @sensekey: Sense Key
+ * @asc: Additional Sense Code
+ * @ascq: Additional Sense Code Qualifier
+ *
+ * This function compares SCSI sense trigger values with driver
+ * page 2 values and calls generic trigger handler to release
+ * HDBs if match found
+ *
+ * Return: Nothing
+ */
+void mpi3mr_scsisense_trigger(struct mpi3mr_ioc *mrioc, u8 sensekey, u8 asc,
+	u8 ascq)
+{
+	struct mpi3_driver2_trigger_scsi_sense *scsi_sense_trigger = NULL;
+	u64 i = 0;
+	unsigned long flags;
+	u8 num_triggers, trigger_flags;
+
+	if (mrioc->scsisense_trigger_present) {
+		spin_lock_irqsave(&mrioc->trigger_lock, flags);
+		scsi_sense_trigger = (struct mpi3_driver2_trigger_scsi_sense *)
+			mrioc->driver_pg2->trigger;
+		num_triggers = mrioc->driver_pg2->num_triggers;
+		for (i = 0; i < num_triggers; i++, scsi_sense_trigger++) {
+			if (scsi_sense_trigger->type !=
+			    MPI3_DRIVER2_TRIGGER_TYPE_SCSI_SENSE)
+				continue;
+			if (!(scsi_sense_trigger->sense_key ==
+			    MPI3_DRIVER2_TRIGGER_SCSI_SENSE_SENSE_KEY_MATCH_ALL
+			      || scsi_sense_trigger->sense_key == sensekey))
+				continue;
+			if (!(scsi_sense_trigger->asc ==
+			    MPI3_DRIVER2_TRIGGER_SCSI_SENSE_ASC_MATCH_ALL ||
+			    scsi_sense_trigger->asc == asc))
+				continue;
+			if (!(scsi_sense_trigger->ascq ==
+			    MPI3_DRIVER2_TRIGGER_SCSI_SENSE_ASCQ_MATCH_ALL ||
+			    scsi_sense_trigger->ascq == ascq))
+				continue;
+			trigger_flags = scsi_sense_trigger->flags;
+			mpi3mr_process_trigger(mrioc,
+			    MPI3MR_HDB_TRIGGER_TYPE_ELEMENT,
+			    (union mpi3mr_trigger_data *)scsi_sense_trigger,
+			    trigger_flags);
+			break;
+		}
+		spin_unlock_irqrestore(&mrioc->trigger_lock, flags);
+	}
+}
+
+/**
+ * mpi3mr_event_trigger - MPI event HDB trigger handler
+ * @mrioc: Adapter instance reference
+ * @event: MPI Event
+ *
+ * This function compares event trigger values with driver page
+ * 2 values and calls generic trigger handler to release
+ * HDBs if match found.
+ *
+ * Return: Nothing
+ */
+void mpi3mr_event_trigger(struct mpi3mr_ioc *mrioc, u8 event)
+{
+	struct mpi3_driver2_trigger_event *event_trigger = NULL;
+	u64 i = 0;
+	unsigned long flags;
+	u8 num_triggers, trigger_flags;
+
+	if (mrioc->event_trigger_present) {
+		spin_lock_irqsave(&mrioc->trigger_lock, flags);
+		event_trigger = (struct mpi3_driver2_trigger_event *)
+			mrioc->driver_pg2->trigger;
+		num_triggers = mrioc->driver_pg2->num_triggers;
+
+		for (i = 0; i < num_triggers; i++, event_trigger++) {
+			if (event_trigger->type !=
+			    MPI3_DRIVER2_TRIGGER_TYPE_EVENT)
+				continue;
+			if (event_trigger->event != event)
+				continue;
+			trigger_flags = event_trigger->flags;
+			mpi3mr_process_trigger(mrioc,
+			    MPI3MR_HDB_TRIGGER_TYPE_ELEMENT,
+			    (union mpi3mr_trigger_data *)event_trigger,
+			    trigger_flags);
+			break;
+		}
+		spin_unlock_irqrestore(&mrioc->trigger_lock, flags);
+	}
+}
+
+/**
+ * mpi3mr_reply_trigger - MPI Reply HDB trigger handler
+ * @mrioc: Adapter instance reference
+ * @ioc_status: Masked value of IOC Status from MPI Reply
+ * @ioc_loginfo: IOC Log Info from MPI Reply
+ *
+ * This function compares IOC status and IOC log info trigger
+ * values with driver page 2 values and calls generic trigger
+ * handler to release HDBs if match found.
+ *
+ * Return: Nothing
+ */
+void mpi3mr_reply_trigger(struct mpi3mr_ioc *mrioc, u16 ioc_status,
+	u32 ioc_loginfo)
+{
+	struct mpi3_driver2_trigger_reply *reply_trigger = NULL;
+	u64 i = 0;
+	unsigned long flags;
+	u8 num_triggers, trigger_flags;
+
+	if (mrioc->reply_trigger_present) {
+		spin_lock_irqsave(&mrioc->trigger_lock, flags);
+		reply_trigger = (struct mpi3_driver2_trigger_reply *)
+			mrioc->driver_pg2->trigger;
+		num_triggers = mrioc->driver_pg2->num_triggers;
+		for (i = 0; i < num_triggers; i++, reply_trigger++) {
+			if (reply_trigger->type !=
+			    MPI3_DRIVER2_TRIGGER_TYPE_REPLY)
+				continue;
+			if ((le16_to_cpu(reply_trigger->ioc_status) !=
+			     ioc_status)
+			    && (le16_to_cpu(reply_trigger->ioc_status) !=
+			    MPI3_DRIVER2_TRIGGER_REPLY_IOCSTATUS_MATCH_ALL))
+				continue;
+			if ((le32_to_cpu(reply_trigger->ioc_log_info) !=
+			    (le32_to_cpu(reply_trigger->ioc_log_info_mask) &
+			     ioc_loginfo)))
+				continue;
+			trigger_flags = reply_trigger->flags;
+			mpi3mr_process_trigger(mrioc,
+			    MPI3MR_HDB_TRIGGER_TYPE_ELEMENT,
+			    (union mpi3mr_trigger_data *)reply_trigger,
+			    trigger_flags);
+			break;
+		}
+		spin_unlock_irqrestore(&mrioc->trigger_lock, flags);
+	}
+}
+
+/**
+ * mpi3mr_get_num_trigger - Gets number of HDB triggers
+ * @mrioc: Adapter instance reference
+ * @num_triggers: Number of triggers
+ * @page_action: Page action
+ *
+ * This function reads number of triggers by reading driver page
+ * 2
+ *
+ * Return: 0 on success and proper error codes on failure
+ */
+static int mpi3mr_get_num_trigger(struct mpi3mr_ioc *mrioc, u8 *num_triggers,
+	u8 page_action)
+{
+	struct mpi3_driver_page2 drvr_page2;
+	int retval = 0;
+
+	*num_triggers = 0;
+
+	retval = mpi3mr_cfg_get_driver_pg2(mrioc, &drvr_page2,
+	    sizeof(struct mpi3_driver_page2), page_action);
+
+	if (retval) {
+		dprint_init(mrioc, "%s: driver page 2 read failed\n", __func__);
+		return retval;
+	}
+	*num_triggers = drvr_page2.num_triggers;
+	return retval;
+}
+
+/**
+ * mpi3mr_refresh_trigger - Handler for Refresh trigger BSG
+ * @mrioc: Adapter instance reference
+ * @page_action: Page action
+ *
+ * This function caches the driver page 2 in the driver's memory
+ * by reading driver page 2 from the controller for a given page
+ * type and updates the HDB trigger values
+ *
+ * Return: 0 on success and proper error codes on failure
+ */
+int mpi3mr_refresh_trigger(struct mpi3mr_ioc *mrioc, u8 page_action)
+{
+	u16 pg_sz = sizeof(struct mpi3_driver_page2);
+	struct mpi3_driver_page2 *drvr_page2 = NULL;
+	u8 trigger_type, num_triggers;
+	int retval;
+	int i = 0;
+	unsigned long flags;
+
+	retval = mpi3mr_get_num_trigger(mrioc, &num_triggers, page_action);
+
+	if (retval)
+		goto out;
+
+	pg_sz = offsetof(struct mpi3_driver_page2, trigger) +
+		(num_triggers * sizeof(union mpi3_driver2_trigger_element));
+	drvr_page2 = kzalloc(pg_sz, GFP_KERNEL);
+	if (!drvr_page2) {
+		retval = -ENOMEM;
+		goto out;
+	}
+
+	retval = mpi3mr_cfg_get_driver_pg2(mrioc, drvr_page2, pg_sz, page_action);
+	if (retval) {
+		dprint_init(mrioc, "%s: driver page 2 read failed\n", __func__);
+		kfree(drvr_page2);
+		goto out;
+	}
+	spin_lock_irqsave(&mrioc->trigger_lock, flags);
+	kfree(mrioc->driver_pg2);
+	mrioc->driver_pg2 = drvr_page2;
+	mrioc->reply_trigger_present = false;
+	mrioc->event_trigger_present = false;
+	mrioc->scsisense_trigger_present = false;
+
+	for (i = 0; (i < mrioc->driver_pg2->num_triggers); i++) {
+		trigger_type = mrioc->driver_pg2->trigger[i].event.type;
+		switch (trigger_type) {
+		case MPI3_DRIVER2_TRIGGER_TYPE_REPLY:
+			mrioc->reply_trigger_present = true;
+			break;
+		case MPI3_DRIVER2_TRIGGER_TYPE_EVENT:
+			mrioc->event_trigger_present = true;
+			break;
+		case MPI3_DRIVER2_TRIGGER_TYPE_SCSI_SENSE:
+			mrioc->scsisense_trigger_present = true;
+			break;
+		default:
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&mrioc->trigger_lock, flags);
+out:
+	return retval;
+}
+
+/**
+ * mpi3mr_release_diag_bufs - Release diag buffers
+ * @mrioc: Adapter instance reference
+ * @skip_rel_action: Skip release action and set buffer state
+ *
+ * This function calls helper function to release both trace and
+ * firmware buffers from the controller.
+ *
+ * Return: None
+ */
+void mpi3mr_release_diag_bufs(struct mpi3mr_ioc *mrioc, u8 skip_rel_action)
+{
+	u8 i;
+	struct diag_buffer_desc *diag_buffer;
+
+	for (i = 0; i < MPI3MR_MAX_NUM_HDB; i++) {
+		diag_buffer = &mrioc->diag_buffers[i];
+		if (!(diag_buffer->addr))
+			continue;
+		if (diag_buffer->status == MPI3MR_HDB_BUFSTATUS_RELEASED)
+			continue;
+		if (!skip_rel_action)
+			mpi3mr_issue_diag_buf_release(mrioc, diag_buffer);
+		diag_buffer->status = MPI3MR_HDB_BUFSTATUS_RELEASED;
+		atomic64_inc(&event_counter);
+	}
+}
+
+/**
+ * mpi3mr_set_trigger_data_in_hdb - Updates HDB trigger type and
+ * trigger data
+ *
+ * @hdb: HDB pointer
+ * @type: Trigger type
+ * @data: Trigger data
+ * @force: Trigger overwrite flag
+ * @trigger_data: Pointer to trigger data information
+ *
+ * Updates trigger type and trigger data based on parameter
+ * passed to this function
+ *
+ * Return: Nothing
+ */
+void mpi3mr_set_trigger_data_in_hdb(struct diag_buffer_desc *hdb,
+	u8 type, union mpi3mr_trigger_data *trigger_data, bool force)
+{
+	if ((!force) && (hdb->trigger_type != MPI3MR_HDB_TRIGGER_TYPE_UNKNOWN))
+		return;
+	hdb->trigger_type = type;
+	if (!trigger_data)
+		memset(&hdb->trigger_data, 0, sizeof(*trigger_data));
+	else
+		memcpy(&hdb->trigger_data, trigger_data, sizeof(*trigger_data));
+}
+
+/**
+ * mpi3mr_set_trigger_data_in_all_hdb - Updates HDB trigger type
+ * and trigger data for all HDB
+ *
+ * @mrioc: Adapter instance reference
+ * @type: Trigger type
+ * @data: Trigger data
+ * @force: Trigger overwrite flag
+ * @trigger_data: Pointer to trigger data information
+ *
+ * Updates trigger type and trigger data based on parameter
+ * passed to this function
+ *
+ * Return: Nothing
+ */
+void mpi3mr_set_trigger_data_in_all_hdb(struct mpi3mr_ioc *mrioc,
+	u8 type, union mpi3mr_trigger_data *trigger_data, bool force)
+{
+	struct diag_buffer_desc *hdb = NULL;
+
+	hdb = mpi3mr_diag_buffer_for_type(mrioc, MPI3_DIAG_BUFFER_TYPE_TRACE);
+	if (hdb)
+		mpi3mr_set_trigger_data_in_hdb(hdb, type, trigger_data, force);
+	hdb = mpi3mr_diag_buffer_for_type(mrioc, MPI3_DIAG_BUFFER_TYPE_FW);
+	if (hdb)
+		mpi3mr_set_trigger_data_in_hdb(hdb, type, trigger_data, force);
+}
+
+/**
+ * mpi3mr_hdbstatuschg_evt_th - HDB status change evt tophalf
+ * @mrioc: Adapter instance reference
+ * @event_reply: event data
+ *
+ * Modifies the status of the applicable diag buffer descriptors
+ *
+ * Return: Nothing
+ */
+void mpi3mr_hdbstatuschg_evt_th(struct mpi3mr_ioc *mrioc,
+	struct mpi3_event_notification_reply *event_reply)
+{
+	struct mpi3_event_data_diag_buffer_status_change *evtdata;
+	struct diag_buffer_desc *diag_buffer;
+
+	evtdata = (struct mpi3_event_data_diag_buffer_status_change *)
+	    event_reply->event_data;
+
+	diag_buffer = mpi3mr_diag_buffer_for_type(mrioc, evtdata->type);
+	if (!diag_buffer)
+		return;
+	if ((diag_buffer->status != MPI3MR_HDB_BUFSTATUS_POSTED_UNPAUSED) &&
+	    (diag_buffer->status != MPI3MR_HDB_BUFSTATUS_POSTED_PAUSED))
+		return;
+	switch (evtdata->reason_code) {
+	case MPI3_EVENT_DIAG_BUFFER_STATUS_CHANGE_RC_RELEASED:
+	{
+		diag_buffer->status = MPI3MR_HDB_BUFSTATUS_RELEASED;
+		mpi3mr_set_trigger_data_in_hdb(diag_buffer,
+		    MPI3MR_HDB_TRIGGER_TYPE_FW_RELEASED, NULL, 0);
+		atomic64_inc(&event_counter);
+		break;
+	}
+	case MPI3_EVENT_DIAG_BUFFER_STATUS_CHANGE_RC_RESUMED:
+	{
+		diag_buffer->status = MPI3MR_HDB_BUFSTATUS_POSTED_UNPAUSED;
+		break;
+	}
+	case MPI3_EVENT_DIAG_BUFFER_STATUS_CHANGE_RC_PAUSED:
+	{
+		diag_buffer->status = MPI3MR_HDB_BUFSTATUS_POSTED_PAUSED;
+		break;
+	}
+	default:
+		dprint_event_th(mrioc, "%s: unknown reason_code(%d)\n",
+		    __func__, evtdata->reason_code);
+		break;
+	}
+}
+
+/**
+ * mpi3mr_diag_buffer_for_type - returns buffer desc for type
+ * @mrioc: Adapter instance reference
+ * @buf_type: Diagnostic buffer type
+ *
+ * Identifies matching diag descriptor from mrioc for given diag
+ * buffer type.
+ *
+ * Return: diag buffer descriptor on success, NULL on failures.
+ */
+
+struct diag_buffer_desc *
+mpi3mr_diag_buffer_for_type(struct mpi3mr_ioc *mrioc, u8 buf_type)
+{
+	u8 i;
+
+	for (i = 0; i < MPI3MR_MAX_NUM_HDB; i++) {
+		if (mrioc->diag_buffers[i].type == buf_type)
+			return &mrioc->diag_buffers[i];
+	}
+	return NULL;
+}
+
+/**
  * mpi3mr_bsg_pel_abort - sends PEL abort request
  * @mrioc: Adapter instance reference
  *
@@ -31,7 +846,7 @@
 		dprint_bsg_err(mrioc, "%s: reset in progress\n", __func__);
 		return -1;
 	}
-	if (mrioc->stop_bsgs) {
+	if (mrioc->stop_bsgs || mrioc->block_on_pci_err) {
 		dprint_bsg_err(mrioc, "%s: bsgs are blocked\n", __func__);
 		return -1;
 	}
@@ -126,6 +941,259 @@
 }
 
 /**
+ * mpi3mr_bsg_refresh_hdb_triggers - Refresh HDB trigger data
+ * @mrioc: Adapter instance reference
+ * @job: BSG Job pointer
+ *
+ * This function reads the controller trigger config page as
+ * defined by the input page type and refreshes the driver's
+ * local trigger information structures with the controller's
+ * config page data.
+ *
+ * Return: 0 on success and proper error codes on failure
+ */
+static long
+mpi3mr_bsg_refresh_hdb_triggers(struct mpi3mr_ioc *mrioc,
+				struct bsg_job *job)
+{
+	struct mpi3mr_bsg_out_refresh_hdb_triggers refresh_triggers;
+	uint32_t data_out_sz;
+	u8 page_action;
+	long rval = -EINVAL;
+
+	data_out_sz = job->request_payload.payload_len;
+
+	if (data_out_sz != sizeof(refresh_triggers)) {
+		dprint_bsg_err(mrioc, "%s: invalid size argument\n",
+		    __func__);
+		return rval;
+	}
+
+	if (mrioc->unrecoverable) {
+		dprint_bsg_err(mrioc, "%s: unrecoverable controller\n",
+		    __func__);
+		return -EFAULT;
+	}
+	if (mrioc->reset_in_progress) {
+		dprint_bsg_err(mrioc, "%s: reset in progress\n", __func__);
+		return -EAGAIN;
+	}
+
+	sg_copy_to_buffer(job->request_payload.sg_list,
+	    job->request_payload.sg_cnt,
+	    &refresh_triggers, sizeof(refresh_triggers));
+
+	switch (refresh_triggers.page_type) {
+	case MPI3MR_HDB_REFRESH_TYPE_CURRENT:
+		page_action = MPI3_CONFIG_ACTION_READ_CURRENT;
+		break;
+	case MPI3MR_HDB_REFRESH_TYPE_DEFAULT:
+		page_action = MPI3_CONFIG_ACTION_READ_DEFAULT;
+		break;
+	case MPI3MR_HDB_HDB_REFRESH_TYPE_PERSISTENT:
+		page_action = MPI3_CONFIG_ACTION_READ_PERSISTENT;
+		break;
+	default:
+		dprint_bsg_err(mrioc,
+		    "%s: unsupported refresh trigger, page_type %d\n",
+		    __func__, refresh_triggers.page_type);
+		return rval;
+	}
+	rval = mpi3mr_refresh_trigger(mrioc, page_action);
+
+	return rval;
+}
+
+/**
+ * mpi3mr_bsg_upload_hdb - Upload a specific HDB to user space
+ * @mrioc: Adapter instance reference
+ * @job: BSG Job pointer
+ *
+ * Return: 0 on success and proper error codes on failure
+ */
+static long mpi3mr_bsg_upload_hdb(struct mpi3mr_ioc *mrioc,
+				  struct bsg_job *job)
+{
+	struct mpi3mr_bsg_out_upload_hdb upload_hdb;
+	struct diag_buffer_desc *diag_buffer;
+	uint32_t data_out_size;
+	uint32_t data_in_size;
+
+	data_out_size = job->request_payload.payload_len;
+	data_in_size = job->reply_payload.payload_len;
+
+	if (data_out_size != sizeof(upload_hdb)) {
+		dprint_bsg_err(mrioc, "%s: invalid size argument\n",
+		    __func__);
+		return -EINVAL;
+	}
+
+	sg_copy_to_buffer(job->request_payload.sg_list,
+			  job->request_payload.sg_cnt,
+			  &upload_hdb, sizeof(upload_hdb));
+
+	if ((!upload_hdb.length) || (data_in_size != upload_hdb.length)) {
+		dprint_bsg_err(mrioc, "%s: invalid length argument\n",
+		    __func__);
+		return -EINVAL;
+	}
+	diag_buffer = mpi3mr_diag_buffer_for_type(mrioc, upload_hdb.buf_type);
+	if ((!diag_buffer) || (!diag_buffer->addr)) {
+		dprint_bsg_err(mrioc, "%s: invalid buffer type %d\n",
+		    __func__, upload_hdb.buf_type);
+		return -EINVAL;
+	}
+
+	if ((diag_buffer->status != MPI3MR_HDB_BUFSTATUS_RELEASED) &&
+	    (diag_buffer->status != MPI3MR_HDB_BUFSTATUS_POSTED_PAUSED)) {
+		dprint_bsg_err(mrioc,
+		    "%s: invalid buffer status %d for type %d\n",
+		    __func__, diag_buffer->status, upload_hdb.buf_type);
+		return -EINVAL;
+	}
+
+	if ((upload_hdb.start_offset + upload_hdb.length) > diag_buffer->size) {
+		dprint_bsg_err(mrioc,
+		    "%s: invalid start offset %d, length %d for type %d\n",
+		    __func__, upload_hdb.start_offset, upload_hdb.length,
+		    upload_hdb.buf_type);
+		return -EINVAL;
+	}
+	sg_copy_from_buffer(job->reply_payload.sg_list,
+			    job->reply_payload.sg_cnt,
+	    (diag_buffer->addr + upload_hdb.start_offset),
+	    data_in_size);
+	return 0;
+}
+
+/**
+ * mpi3mr_bsg_repost_hdb - Re-post HDB
+ * @mrioc: Adapter instance reference
+ * @job: BSG job pointer
+ *
+ * This function retrieves the HDB descriptor corresponding to a
+ * given buffer type and if the HDB is in released status then
+ * posts the HDB with the firmware.
+ *
+ * Return: 0 on success and proper error codes on failure
+ */
+static long mpi3mr_bsg_repost_hdb(struct mpi3mr_ioc *mrioc,
+				  struct bsg_job *job)
+{
+	struct mpi3mr_bsg_out_repost_hdb repost_hdb;
+	struct diag_buffer_desc *diag_buffer;
+	uint32_t data_out_sz;
+
+	data_out_sz = job->request_payload.payload_len;
+
+	if (data_out_sz != sizeof(repost_hdb)) {
+		dprint_bsg_err(mrioc, "%s: invalid size argument\n",
+		    __func__);
+		return -EINVAL;
+	}
+	if (mrioc->unrecoverable) {
+		dprint_bsg_err(mrioc, "%s: unrecoverable controller\n",
+		    __func__);
+		return -EFAULT;
+	}
+	if (mrioc->reset_in_progress) {
+		dprint_bsg_err(mrioc, "%s: reset in progress\n", __func__);
+		return -EAGAIN;
+	}
+
+	sg_copy_to_buffer(job->request_payload.sg_list,
+			  job->request_payload.sg_cnt,
+			  &repost_hdb, sizeof(repost_hdb));
+
+	diag_buffer = mpi3mr_diag_buffer_for_type(mrioc, repost_hdb.buf_type);
+	if ((!diag_buffer) || (!diag_buffer->addr)) {
+		dprint_bsg_err(mrioc, "%s: invalid buffer type %d\n",
+		    __func__, repost_hdb.buf_type);
+		return -EINVAL;
+	}
+
+	if (diag_buffer->status != MPI3MR_HDB_BUFSTATUS_RELEASED) {
+		dprint_bsg_err(mrioc,
+		    "%s: invalid buffer status %d for type %d\n",
+		    __func__, diag_buffer->status, repost_hdb.buf_type);
+		return -EINVAL;
+	}
+
+	if (mpi3mr_issue_diag_buf_post(mrioc, diag_buffer)) {
+		dprint_bsg_err(mrioc, "%s: post failed for type %d\n",
+		    __func__, repost_hdb.buf_type);
+		return -EFAULT;
+	}
+	mpi3mr_set_trigger_data_in_hdb(diag_buffer,
+	    MPI3MR_HDB_TRIGGER_TYPE_UNKNOWN, NULL, 1);
+
+	return 0;
+}
+
+/**
+ * mpi3mr_bsg_query_hdb - Handler for query HDB command
+ * @mrioc: Adapter instance reference
+ * @job: BSG job pointer
+ *
+ * This function prepares and copies the host diagnostic buffer
+ * entries to the user buffer.
+ *
+ * Return: 0 on success and proper error codes on failure
+ */
+static long mpi3mr_bsg_query_hdb(struct mpi3mr_ioc *mrioc,
+				 struct bsg_job *job)
+{
+	long rval = 0;
+	struct mpi3mr_bsg_in_hdb_status *hbd_status;
+	struct mpi3mr_hdb_entry *hbd_status_entry;
+	u32 length, min_length;
+	u8 i;
+	struct diag_buffer_desc *diag_buffer;
+	uint32_t data_in_sz = 0;
+
+	data_in_sz = job->request_payload.payload_len;
+
+	length = (sizeof(*hbd_status) + ((MPI3MR_MAX_NUM_HDB - 1) *
+		    sizeof(*hbd_status_entry)));
+	hbd_status = kmalloc(length, GFP_KERNEL);
+	if (!hbd_status)
+		return -ENOMEM;
+	hbd_status_entry = &hbd_status->entry[0];
+
+	hbd_status->num_hdb_types = MPI3MR_MAX_NUM_HDB;
+	for (i = 0; i < MPI3MR_MAX_NUM_HDB; i++) {
+		diag_buffer = &mrioc->diag_buffers[i];
+		hbd_status_entry->buf_type = diag_buffer->type;
+		hbd_status_entry->status = diag_buffer->status;
+		hbd_status_entry->trigger_type = diag_buffer->trigger_type;
+		memcpy(&hbd_status_entry->trigger_data,
+		    &diag_buffer->trigger_data,
+		    sizeof(hbd_status_entry->trigger_data));
+		hbd_status_entry->size = (diag_buffer->size / 1024);
+		hbd_status_entry++;
+	}
+	hbd_status->element_trigger_format =
+		MPI3MR_HDB_QUERY_ELEMENT_TRIGGER_FORMAT_DATA;
+
+	if (data_in_sz < 4) {
+		dprint_bsg_err(mrioc, "%s: invalid size passed\n", __func__);
+		rval = -EINVAL;
+		goto out;
+	}
+	min_length = min(data_in_sz, length);
+	if (job->request_payload.payload_len >= min_length) {
+		sg_copy_from_buffer(job->request_payload.sg_list,
+				    job->request_payload.sg_cnt,
+				    hbd_status, min_length);
+		rval = 0;
+	}
+out:
+	kfree(hbd_status);
+	return rval;
+}
+
+
+/**
  * mpi3mr_enable_logdata - Handler for log data enable
  * @mrioc: Adapter instance reference
  * @job: BSG job reference
@@ -424,6 +1492,9 @@
 		goto out;
 	}
 
+	if (mrioc->unrecoverable || mrioc->block_on_pci_err)
+		return -EINVAL;
+
 	sg_copy_to_buffer(job->request_payload.sg_list,
 			  job->request_payload.sg_cnt,
 			  &adpreset, sizeof(adpreset));
@@ -553,6 +1624,18 @@
 	case MPI3MR_DRVBSG_OPCODE_PELENABLE:
 		rval = mpi3mr_bsg_pel_enable(mrioc, job);
 		break;
+	case MPI3MR_DRVBSG_OPCODE_QUERY_HDB:
+		rval = mpi3mr_bsg_query_hdb(mrioc, job);
+		break;
+	case MPI3MR_DRVBSG_OPCODE_REPOST_HDB:
+		rval = mpi3mr_bsg_repost_hdb(mrioc, job);
+		break;
+	case MPI3MR_DRVBSG_OPCODE_UPLOAD_HDB:
+		rval = mpi3mr_bsg_upload_hdb(mrioc, job);
+		break;
+	case MPI3MR_DRVBSG_OPCODE_REFRESH_HDB_TRIGGERS:
+		rval = mpi3mr_bsg_refresh_hdb_triggers(mrioc, job);
+		break;
 	case MPI3MR_DRVBSG_OPCODE_UNKNOWN:
 	default:
 		pr_err("%s: unsupported driver command opcode %d\n",
@@ -1241,6 +2324,15 @@
 	if (!mrioc)
 		return -ENODEV;
 
+	if (mutex_lock_interruptible(&mrioc->bsg_cmds.mutex))
+		return -ERESTARTSYS;
+
+	if (mrioc->bsg_cmds.state & MPI3MR_CMD_PENDING) {
+		dprint_bsg_err(mrioc, "%s: command is in use\n", __func__);
+		mutex_unlock(&mrioc->bsg_cmds.mutex);
+		return -EAGAIN;
+	}
+
 	if (!mrioc->ioctl_sges_allocated) {
 		dprint_bsg_err(mrioc, "%s: DMA memory was not allocated\n",
 			       __func__);
@@ -1251,13 +2343,16 @@
 		karg->timeout = MPI3MR_APP_DEFAULT_TIMEOUT;
 
 	mpi_req = kzalloc(MPI3MR_ADMIN_REQ_FRAME_SZ, GFP_KERNEL);
-	if (!mpi_req)
+	if (!mpi_req) {
+		mutex_unlock(&mrioc->bsg_cmds.mutex);
 		return -ENOMEM;
+	}
 	mpi_header = (struct mpi3_request_header *)mpi_req;
 
 	bufcnt = karg->buf_entry_list.num_of_entries;
 	drv_bufs = kzalloc((sizeof(*drv_bufs) * bufcnt), GFP_KERNEL);
 	if (!drv_bufs) {
+		mutex_unlock(&mrioc->bsg_cmds.mutex);
 		rval = -ENOMEM;
 		goto out;
 	}
@@ -1265,6 +2360,7 @@
 	dout_buf = kzalloc(job->request_payload.payload_len,
 				      GFP_KERNEL);
 	if (!dout_buf) {
+		mutex_unlock(&mrioc->bsg_cmds.mutex);
 		rval = -ENOMEM;
 		goto out;
 	}
@@ -1272,6 +2368,7 @@
 	din_buf = kzalloc(job->reply_payload.payload_len,
 				     GFP_KERNEL);
 	if (!din_buf) {
+		mutex_unlock(&mrioc->bsg_cmds.mutex);
 		rval = -ENOMEM;
 		goto out;
 	}
@@ -1347,6 +2444,7 @@
 					(mpi_msg_size > MPI3MR_ADMIN_REQ_FRAME_SZ)) {
 				dprint_bsg_err(mrioc, "%s: invalid MPI message size\n",
 					__func__);
+				mutex_unlock(&mrioc->bsg_cmds.mutex);
 				rval = -EINVAL;
 				goto out;
 			}
@@ -1359,6 +2457,7 @@
 		if (invalid_be) {
 			dprint_bsg_err(mrioc, "%s: invalid buffer entries passed\n",
 				__func__);
+			mutex_unlock(&mrioc->bsg_cmds.mutex);
 			rval = -EINVAL;
 			goto out;
 		}
@@ -1366,12 +2465,14 @@
 		if (sgl_dout_iter > (dout_buf + job->request_payload.payload_len)) {
 			dprint_bsg_err(mrioc, "%s: data_out buffer length mismatch\n",
 				       __func__);
+			mutex_unlock(&mrioc->bsg_cmds.mutex);
 			rval = -EINVAL;
 			goto out;
 		}
 		if (sgl_din_iter > (din_buf + job->reply_payload.payload_len)) {
 			dprint_bsg_err(mrioc, "%s: data_in buffer length mismatch\n",
 				       __func__);
+			mutex_unlock(&mrioc->bsg_cmds.mutex);
 			rval = -EINVAL;
 			goto out;
 		}
@@ -1384,6 +2485,7 @@
 		dprint_bsg_err(mrioc, "%s:%d: invalid data transfer size passed for function 0x%x din_size = %d, dout_size = %d\n",
 			       __func__, __LINE__, mpi_header->function, din_size,
 			       dout_size);
+		mutex_unlock(&mrioc->bsg_cmds.mutex);
 		rval = -EINVAL;
 		goto out;
 	}
@@ -1392,6 +2494,7 @@
 		dprint_bsg_err(mrioc,
 		    "%s:%d: invalid data transfer size passed for function 0x%x din_size=%d\n",
 		    __func__, __LINE__, mpi_header->function, din_size);
+		mutex_unlock(&mrioc->bsg_cmds.mutex);
 		rval = -EINVAL;
 		goto out;
 	}
@@ -1399,6 +2502,7 @@
 		dprint_bsg_err(mrioc,
 		    "%s:%d: invalid data transfer size passed for function 0x%x dout_size = %d\n",
 		    __func__, __LINE__, mpi_header->function, dout_size);
+		mutex_unlock(&mrioc->bsg_cmds.mutex);
 		rval = -EINVAL;
 		goto out;
 	}
@@ -1409,6 +2513,7 @@
 			dprint_bsg_err(mrioc, "%s:%d: invalid message size passed:%d:%d:%d:%d\n",
 				       __func__, __LINE__, din_cnt, dout_cnt, din_size,
 			    dout_size);
+			mutex_unlock(&mrioc->bsg_cmds.mutex);
 			rval = -EINVAL;
 			goto out;
 		}
@@ -1456,6 +2561,7 @@
 				continue;
 			if (mpi3mr_map_data_buffer_dma(mrioc, drv_buf_iter, desc_count)) {
 				rval = -ENOMEM;
+				mutex_unlock(&mrioc->bsg_cmds.mutex);
 				dprint_bsg_err(mrioc, "%s:%d: mapping data buffers failed\n",
 					       __func__, __LINE__);
 			goto out;
@@ -1468,20 +2574,11 @@
 		sense_buff_k = kzalloc(erbsz, GFP_KERNEL);
 		if (!sense_buff_k) {
 			rval = -ENOMEM;
+			mutex_unlock(&mrioc->bsg_cmds.mutex);
 			goto out;
 		}
 	}
 
-	if (mutex_lock_interruptible(&mrioc->bsg_cmds.mutex)) {
-		rval = -ERESTARTSYS;
-		goto out;
-	}
-	if (mrioc->bsg_cmds.state & MPI3MR_CMD_PENDING) {
-		rval = -EAGAIN;
-		dprint_bsg_err(mrioc, "%s: command is in use\n", __func__);
-		mutex_unlock(&mrioc->bsg_cmds.mutex);
-		goto out;
-	}
 	if (mrioc->unrecoverable) {
 		dprint_bsg_err(mrioc, "%s: unrecoverable controller\n",
 		    __func__);
@@ -1495,7 +2592,7 @@
 		mutex_unlock(&mrioc->bsg_cmds.mutex);
 		goto out;
 	}
-	if (mrioc->stop_bsgs) {
+	if (mrioc->stop_bsgs || mrioc->block_on_pci_err) {
 		dprint_bsg_err(mrioc, "%s: bsgs are blocked\n", __func__);
 		rval = -EAGAIN;
 		mutex_unlock(&mrioc->bsg_cmds.mutex);
@@ -1644,7 +2741,7 @@
 	if ((mpirep_offset != 0xFF) &&
 	    drv_bufs[mpirep_offset].bsg_buf_len) {
 		drv_buf_iter = &drv_bufs[mpirep_offset];
-		drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 +
+		drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) +
 					   mrioc->reply_sz);
 		bsg_reply_buf = kzalloc(drv_buf_iter->kern_buf_len, GFP_KERNEL);
 
@@ -2023,7 +3120,8 @@
 	ioc_state = mpi3mr_get_iocstate(mrioc);
 	if (ioc_state == MRIOC_STATE_UNRECOVERABLE)
 		adp_state = MPI3MR_BSG_ADPSTATE_UNRECOVERABLE;
-	else if ((mrioc->reset_in_progress) || (mrioc->stop_bsgs))
+	else if (mrioc->reset_in_progress || mrioc->stop_bsgs ||
+		 mrioc->block_on_pci_err)
 		adp_state = MPI3MR_BSG_ADPSTATE_IN_RESET;
 	else if (ioc_state == MRIOC_STATE_FAULT)
 		adp_state = MPI3MR_BSG_ADPSTATE_FAULT;
@@ -2158,10 +3256,72 @@
 }
 static DEVICE_ATTR_RO(persistent_id);
 
+/**
+ * sas_ncq_prio_supported_show - Indicate if device supports NCQ priority
+ * @dev: pointer to embedded device
+ * @attr: sas_ncq_prio_supported attribute descriptor
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read-only' sdev attribute, only works with SATA devices
+ */
+static ssize_t
+sas_ncq_prio_supported_show(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	struct scsi_device *sdev = to_scsi_device(dev);
+
+	return sysfs_emit(buf, "%d\n", sas_ata_ncq_prio_supported(sdev));
+}
+static DEVICE_ATTR_RO(sas_ncq_prio_supported);
+
+/**
+ * sas_ncq_prio_enable_show - send prioritized io commands to device
+ * @dev: pointer to embedded device
+ * @attr: sas_ncq_prio_enable attribute descriptor
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read/write' sdev attribute, only works with SATA devices
+ */
+static ssize_t
+sas_ncq_prio_enable_show(struct device *dev,
+				 struct device_attribute *attr, char *buf)
+{
+	struct scsi_device *sdev = to_scsi_device(dev);
+	struct mpi3mr_sdev_priv_data *sdev_priv_data =  sdev->hostdata;
+
+	if (!sdev_priv_data)
+		return 0;
+
+	return sysfs_emit(buf, "%d\n", sdev_priv_data->ncq_prio_enable);
+}
+
+static ssize_t
+sas_ncq_prio_enable_store(struct device *dev,
+				  struct device_attribute *attr,
+				  const char *buf, size_t count)
+{
+	struct scsi_device *sdev = to_scsi_device(dev);
+	struct mpi3mr_sdev_priv_data *sdev_priv_data =  sdev->hostdata;
+	bool ncq_prio_enable = 0;
+
+	if (kstrtobool(buf, &ncq_prio_enable))
+		return -EINVAL;
+
+	if (!sas_ata_ncq_prio_supported(sdev))
+		return -EINVAL;
+
+	sdev_priv_data->ncq_prio_enable = ncq_prio_enable;
+
+	return strlen(buf);
+}
+static DEVICE_ATTR_RW(sas_ncq_prio_enable);
+
 static struct attribute *mpi3mr_dev_attrs[] = {
 	&dev_attr_sas_address.attr,
 	&dev_attr_device_handle.attr,
 	&dev_attr_persistent_id.attr,
+	&dev_attr_sas_ncq_prio_supported.attr,
+	&dev_attr_sas_ncq_prio_enable.attr,
 	NULL,
 };
 
--- linux-qcom-6.8.0.orig/drivers/scsi/mpi3mr/mpi3mr_fw.c
+++ linux-qcom-6.8.0/drivers/scsi/mpi3mr/mpi3mr_fw.c
@@ -274,6 +274,9 @@
 	case MPI3_EVENT_PREPARE_FOR_RESET:
 		desc = "Prepare For Reset";
 		break;
+	case MPI3_EVENT_DIAGNOSTIC_BUFFER_STATUS_CHANGE:
+		desc = "Diagnostic Buffer Status Change";
+		break;
 	}
 
 	if (!desc)
@@ -342,13 +345,14 @@
 {
 	u16 reply_desc_type, host_tag = 0;
 	u16 ioc_status = MPI3_IOCSTATUS_SUCCESS;
-	u32 ioc_loginfo = 0;
+	u32 ioc_loginfo = 0, sense_count = 0;
 	struct mpi3_status_reply_descriptor *status_desc;
 	struct mpi3_address_reply_descriptor *addr_desc;
 	struct mpi3_success_reply_descriptor *success_desc;
 	struct mpi3_default_reply *def_reply = NULL;
 	struct mpi3mr_drv_cmd *cmdptr = NULL;
 	struct mpi3_scsi_io_reply *scsi_reply;
+	struct scsi_sense_hdr sshdr;
 	u8 *sense_buf = NULL;
 
 	*reply_dma = 0;
@@ -363,6 +367,7 @@
 		    MPI3_REPLY_DESCRIPT_STATUS_IOCSTATUS_LOGINFOAVAIL)
 			ioc_loginfo = le32_to_cpu(status_desc->ioc_log_info);
 		ioc_status &= MPI3_REPLY_DESCRIPT_STATUS_IOCSTATUS_STATUS_MASK;
+		mpi3mr_reply_trigger(mrioc, ioc_status, ioc_loginfo);
 		break;
 	case MPI3_REPLY_DESCRIPT_FLAGS_TYPE_ADDRESS_REPLY:
 		addr_desc = (struct mpi3_address_reply_descriptor *)reply_desc;
@@ -380,7 +385,15 @@
 			scsi_reply = (struct mpi3_scsi_io_reply *)def_reply;
 			sense_buf = mpi3mr_get_sensebuf_virt_addr(mrioc,
 			    le64_to_cpu(scsi_reply->sense_data_buffer_address));
+			sense_count = le32_to_cpu(scsi_reply->sense_count);
+			if (sense_buf) {
+				scsi_normalize_sense(sense_buf, sense_count,
+				    &sshdr);
+				mpi3mr_scsisense_trigger(mrioc, sshdr.sense_key,
+				    sshdr.asc, sshdr.ascq);
+			}
 		}
+		mpi3mr_reply_trigger(mrioc, ioc_status, ioc_loginfo);
 		break;
 	case MPI3_REPLY_DESCRIPT_FLAGS_TYPE_SUCCESS:
 		success_desc = (struct mpi3_success_reply_descriptor *)reply_desc;
@@ -595,7 +608,7 @@
 	mrioc = (struct mpi3mr_ioc *)shost->hostdata;
 
 	if ((mrioc->reset_in_progress || mrioc->prepare_for_reset ||
-	    mrioc->unrecoverable))
+	    mrioc->unrecoverable || mrioc->pci_err_recovery))
 		return 0;
 
 	num_entries = mpi3mr_process_op_reply_q(mrioc,
@@ -938,6 +951,14 @@
 	},
 	{ MPI3MR_RESET_FROM_SYSFS, "sysfs invocation" },
 	{ MPI3MR_RESET_FROM_SYSFS_TIMEOUT, "sysfs TM timeout" },
+	{
+		MPI3MR_RESET_FROM_DIAG_BUFFER_POST_TIMEOUT,
+		"diagnostic buffer post timeout"
+	},
+	{
+		MPI3MR_RESET_FROM_DIAG_BUFFER_RELEASE_TIMEOUT,
+		"diagnostic buffer release timeout"
+	},
 	{ MPI3MR_RESET_FROM_FIRMWARE, "firmware asynchronous reset" },
 	{ MPI3MR_RESET_FROM_CFG_REQ_TIMEOUT, "configuration request timeout"},
 	{ MPI3MR_RESET_FROM_SAS_TRANSPORT_TIMEOUT, "timeout of a SAS transport layer request" },
@@ -997,6 +1018,31 @@
 }
 
 /**
+ * mpi3mr_is_fault_recoverable - Read fault code and decide
+ * whether the controller can be recoverable
+ * @mrioc: Adapter instance reference
+ * Return: true if fault is recoverable, false otherwise.
+ */
+static inline bool mpi3mr_is_fault_recoverable(struct mpi3mr_ioc *mrioc)
+{
+	u32 fault;
+
+	fault = (readl(&mrioc->sysif_regs->fault) &
+		      MPI3_SYSIF_FAULT_CODE_MASK);
+
+	switch (fault) {
+	case MPI3_SYSIF_FAULT_CODE_COMPLETE_RESET_NEEDED:
+	case MPI3_SYSIF_FAULT_CODE_POWER_CYCLE_REQUIRED:
+		ioc_warn(mrioc,
+		    "controller requires system power cycle, marking controller as unrecoverable\n");
+		return false;
+	default:
+		break;
+	}
+	return true;
+}
+
+/**
  * mpi3mr_print_fault_info - Display fault information
  * @mrioc: Adapter instance reference
  *
@@ -1326,6 +1372,11 @@
 	ioc_info(mrioc, "ioc_status(0x%08x), ioc_config(0x%08x), ioc_info(0x%016llx) at the bringup\n",
 	    ioc_status, ioc_config, base_info);
 
+	if (!mpi3mr_is_fault_recoverable(mrioc)) {
+		mrioc->unrecoverable = 1;
+		goto out_device_not_present;
+	}
+
 	/*The timeout value is in 2sec unit, changing it to seconds*/
 	mrioc->ready_timeout =
 	    ((base_info & MPI3_SYSIF_IOC_INFO_LOW_TIMEOUT_MASK) >>
@@ -1665,6 +1716,12 @@
 		retval = -EAGAIN;
 		goto out;
 	}
+	if (mrioc->pci_err_recovery) {
+		ioc_err(mrioc, "admin request queue submission failed due to pci error recovery in progress\n");
+		retval = -EAGAIN;
+		goto out;
+	}
+
 	areq_entry = (u8 *)mrioc->admin_req_base +
 	    (areq_pi * MPI3MR_ADMIN_REQ_FRAME_SZ);
 	memset(areq_entry, 0, MPI3MR_ADMIN_REQ_FRAME_SZ);
@@ -2335,6 +2392,11 @@
 		retval = -EAGAIN;
 		goto out;
 	}
+	if (mrioc->pci_err_recovery) {
+		ioc_err(mrioc, "operational request queue submission failed due to pci error recovery in progress\n");
+		retval = -EAGAIN;
+		goto out;
+	}
 
 	segment_base_addr = segments[pi / op_req_q->segment_qd].segment;
 	req_entry = (u8 *)segment_base_addr +
@@ -2380,6 +2442,7 @@
 void mpi3mr_check_rh_fault_ioc(struct mpi3mr_ioc *mrioc, u32 reason_code)
 {
 	u32 ioc_status, host_diagnostic, timeout;
+	union mpi3mr_trigger_data trigger_data;
 
 	if (mrioc->unrecoverable) {
 		ioc_err(mrioc, "controller is unrecoverable\n");
@@ -2391,16 +2454,30 @@
 		ioc_err(mrioc, "controller is not present\n");
 		return;
 	}
-
+	memset(&trigger_data, 0, sizeof(trigger_data));
 	ioc_status = readl(&mrioc->sysif_regs->ioc_status);
-	if ((ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) ||
-	    (ioc_status & MPI3_SYSIF_IOC_STATUS_FAULT)) {
+
+	if (ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) {
+		mpi3mr_set_trigger_data_in_all_hdb(mrioc,
+		    MPI3MR_HDB_TRIGGER_TYPE_FW_RELEASED, NULL, 0);
+		return;
+	} else if (ioc_status & MPI3_SYSIF_IOC_STATUS_FAULT) {
+		trigger_data.fault = (readl(&mrioc->sysif_regs->fault) &
+		      MPI3_SYSIF_FAULT_CODE_MASK);
+
+		mpi3mr_set_trigger_data_in_all_hdb(mrioc,
+		    MPI3MR_HDB_TRIGGER_TYPE_FAULT, &trigger_data, 0);
 		mpi3mr_print_fault_info(mrioc);
 		return;
 	}
+
 	mpi3mr_set_diagsave(mrioc);
 	mpi3mr_issue_reset(mrioc, MPI3_SYSIF_HOST_DIAG_RESET_ACTION_DIAG_FAULT,
 	    reason_code);
+	trigger_data.fault = (readl(&mrioc->sysif_regs->fault) &
+		      MPI3_SYSIF_FAULT_CODE_MASK);
+	mpi3mr_set_trigger_data_in_all_hdb(mrioc, MPI3MR_HDB_TRIGGER_TYPE_FAULT,
+	    &trigger_data, 0);
 	timeout = MPI3_SYSIF_DIAG_SAVE_TIMEOUT * 10;
 	do {
 		host_diagnostic = readl(&mrioc->sysif_regs->host_diagnostic);
@@ -2580,10 +2657,11 @@
 	    container_of(work, struct mpi3mr_ioc, watchdog_work.work);
 	unsigned long flags;
 	enum mpi3mr_iocstate ioc_state;
-	u32 fault, host_diagnostic, ioc_status;
-	u32 reset_reason = MPI3MR_RESET_FROM_FAULT_WATCH;
+	u32 host_diagnostic, ioc_status;
+	union mpi3mr_trigger_data trigger_data;
+	u16 reset_reason = MPI3MR_RESET_FROM_FAULT_WATCH;
 
-	if (mrioc->reset_in_progress)
+	if (mrioc->reset_in_progress || mrioc->pci_err_recovery)
 		return;
 
 	if (!mrioc->unrecoverable && !pci_device_is_present(mrioc->pdev)) {
@@ -2611,8 +2689,11 @@
 		return;
 	}
 
+	memset(&trigger_data, 0, sizeof(trigger_data));
 	ioc_status = readl(&mrioc->sysif_regs->ioc_status);
 	if (ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) {
+		mpi3mr_set_trigger_data_in_all_hdb(mrioc,
+		    MPI3MR_HDB_TRIGGER_TYPE_FW_RELEASED, NULL, 0);
 		mpi3mr_soft_reset_handler(mrioc, MPI3MR_RESET_FROM_FIRMWARE, 0);
 		return;
 	}
@@ -2622,7 +2703,9 @@
 	if (ioc_state != MRIOC_STATE_FAULT)
 		goto schedule_work;
 
-	fault = readl(&mrioc->sysif_regs->fault) & MPI3_SYSIF_FAULT_CODE_MASK;
+	trigger_data.fault = readl(&mrioc->sysif_regs->fault) & MPI3_SYSIF_FAULT_CODE_MASK;
+	mpi3mr_set_trigger_data_in_all_hdb(mrioc,
+	    MPI3MR_HDB_TRIGGER_TYPE_FAULT, &trigger_data, 0);
 	host_diagnostic = readl(&mrioc->sysif_regs->host_diagnostic);
 	if (host_diagnostic & MPI3_SYSIF_HOST_DIAG_SAVE_IN_PROGRESS) {
 		if (!mrioc->diagsave_timeout) {
@@ -2636,7 +2719,12 @@
 	mpi3mr_print_fault_info(mrioc);
 	mrioc->diagsave_timeout = 0;
 
-	switch (fault) {
+	if (!mpi3mr_is_fault_recoverable(mrioc)) {
+		mrioc->unrecoverable = 1;
+		goto schedule_work;
+	}
+
+	switch (trigger_data.fault) {
 	case MPI3_SYSIF_FAULT_CODE_COMPLETE_RESET_NEEDED:
 	case MPI3_SYSIF_FAULT_CODE_POWER_CYCLE_REQUIRED:
 		ioc_warn(mrioc,
@@ -2996,7 +3084,11 @@
 	mrioc->facts.sge_mod_shift = facts_data->sge_modifier_shift;
 	mrioc->facts.shutdown_timeout =
 	    le16_to_cpu(facts_data->shutdown_timeout);
-
+	mrioc->facts.diag_trace_sz =
+	    le32_to_cpu(facts_data->diag_trace_size);
+	mrioc->facts.diag_fw_sz =
+	    le32_to_cpu(facts_data->diag_fw_size);
+	mrioc->facts.diag_drvr_sz = le32_to_cpu(facts_data->diag_driver_size);
 	mrioc->facts.max_dev_per_tg =
 	    facts_data->max_devices_per_throttle_group;
 	mrioc->facts.io_throttle_data_length =
@@ -3673,6 +3765,94 @@
 };
 
 /**
+ * mpi3mr_repost_diag_bufs - repost host diag buffers
+ * @mrioc: Adapter instance reference
+ *
+ * repost firmware and trace diag buffers based on global
+ * trigger flag from driver page 2
+ *
+ * Return: 0 on success, non-zero on failures.
+ */
+static int mpi3mr_repost_diag_bufs(struct mpi3mr_ioc *mrioc)
+{
+	u64 global_trigger;
+	union mpi3mr_trigger_data prev_trigger_data;
+	struct diag_buffer_desc *trace_hdb = NULL;
+	struct diag_buffer_desc *fw_hdb = NULL;
+	int retval = 0;
+	bool trace_repost_needed = false;
+	bool fw_repost_needed = false;
+	u8 prev_trigger_type;
+
+	retval = mpi3mr_refresh_trigger(mrioc, MPI3_CONFIG_ACTION_READ_CURRENT);
+	if (retval)
+		return -1;
+
+	trace_hdb = mpi3mr_diag_buffer_for_type(mrioc,
+	    MPI3_DIAG_BUFFER_TYPE_TRACE);
+
+	if (trace_hdb &&
+	    trace_hdb->status != MPI3MR_HDB_BUFSTATUS_NOT_ALLOCATED &&
+	    trace_hdb->trigger_type != MPI3MR_HDB_TRIGGER_TYPE_GLOBAL &&
+	    trace_hdb->trigger_type != MPI3MR_HDB_TRIGGER_TYPE_ELEMENT)
+		trace_repost_needed = true;
+
+	fw_hdb = mpi3mr_diag_buffer_for_type(mrioc, MPI3_DIAG_BUFFER_TYPE_FW);
+
+	if (fw_hdb && fw_hdb->status != MPI3MR_HDB_BUFSTATUS_NOT_ALLOCATED &&
+	    fw_hdb->trigger_type != MPI3MR_HDB_TRIGGER_TYPE_GLOBAL &&
+	    fw_hdb->trigger_type != MPI3MR_HDB_TRIGGER_TYPE_ELEMENT)
+		fw_repost_needed = true;
+
+	if (trace_repost_needed || fw_repost_needed) {
+		global_trigger = le64_to_cpu(mrioc->driver_pg2->global_trigger);
+		if (global_trigger &
+		      MPI3_DRIVER2_GLOBALTRIGGER_POST_DIAG_TRACE_DISABLED)
+			trace_repost_needed = false;
+		if (global_trigger &
+		     MPI3_DRIVER2_GLOBALTRIGGER_POST_DIAG_FW_DISABLED)
+			fw_repost_needed = false;
+	}
+
+	if (trace_repost_needed) {
+		prev_trigger_type = trace_hdb->trigger_type;
+		memcpy(&prev_trigger_data, &trace_hdb->trigger_data,
+		    sizeof(trace_hdb->trigger_data));
+		retval = mpi3mr_issue_diag_buf_post(mrioc, trace_hdb);
+		if (!retval) {
+			dprint_init(mrioc, "trace diag buffer reposted");
+			mpi3mr_set_trigger_data_in_hdb(trace_hdb,
+				    MPI3MR_HDB_TRIGGER_TYPE_UNKNOWN, NULL, 1);
+		} else {
+			trace_hdb->trigger_type = prev_trigger_type;
+			memcpy(&trace_hdb->trigger_data, &prev_trigger_data,
+			    sizeof(prev_trigger_data));
+			ioc_err(mrioc, "trace diag buffer repost failed");
+			return -1;
+		}
+	}
+
+	if (fw_repost_needed) {
+		prev_trigger_type = fw_hdb->trigger_type;
+		memcpy(&prev_trigger_data, &fw_hdb->trigger_data,
+		    sizeof(fw_hdb->trigger_data));
+		retval = mpi3mr_issue_diag_buf_post(mrioc, fw_hdb);
+		if (!retval) {
+			dprint_init(mrioc, "firmware diag buffer reposted");
+			mpi3mr_set_trigger_data_in_hdb(fw_hdb,
+				    MPI3MR_HDB_TRIGGER_TYPE_UNKNOWN, NULL, 1);
+		} else {
+			fw_hdb->trigger_type = prev_trigger_type;
+			memcpy(&fw_hdb->trigger_data, &prev_trigger_data,
+			    sizeof(prev_trigger_data));
+			ioc_err(mrioc, "firmware diag buffer repost failed");
+			return -1;
+		}
+	}
+	return retval;
+}
+
+/**
  * mpi3mr_print_ioc_info - Display controller information
  * @mrioc: Adapter instance reference
  *
@@ -3889,6 +4069,7 @@
 	mpi3mr_unmask_events(mrioc, MPI3_EVENT_PREPARE_FOR_RESET);
 	mpi3mr_unmask_events(mrioc, MPI3_EVENT_CABLE_MGMT);
 	mpi3mr_unmask_events(mrioc, MPI3_EVENT_ENERGY_PACK_CHANGE);
+	mpi3mr_unmask_events(mrioc, MPI3_EVENT_DIAGNOSTIC_BUFFER_STATUS_CHANGE);
 
 	retval = mpi3mr_issue_event_notification(mrioc);
 	if (retval)
@@ -3969,20 +4150,18 @@
 
 	mpi3mr_print_ioc_info(mrioc);
 
-	if (!mrioc->cfg_page) {
-		dprint_init(mrioc, "allocating config page buffers\n");
-		mrioc->cfg_page_sz = MPI3MR_DEFAULT_CFG_PAGE_SZ;
-		mrioc->cfg_page = dma_alloc_coherent(&mrioc->pdev->dev,
-		    mrioc->cfg_page_sz, &mrioc->cfg_page_dma, GFP_KERNEL);
-		if (!mrioc->cfg_page) {
-			retval = -1;
-			goto out_failed_noretry;
-		}
-	}
+	dprint_init(mrioc, "allocating host diag buffers\n");
+	mpi3mr_alloc_diag_bufs(mrioc);
 
 	dprint_init(mrioc, "allocating ioctl dma buffers\n");
 	mpi3mr_alloc_ioctl_dma_memory(mrioc);
 
+	dprint_init(mrioc, "posting host diag buffers\n");
+	retval = mpi3mr_post_diag_bufs(mrioc);
+
+	if (retval)
+		ioc_warn(mrioc, "failed to post host diag buffers\n");
+
 	if (!mrioc->init_cmds.reply) {
 		retval = mpi3mr_alloc_reply_sense_bufs(mrioc);
 		if (retval) {
@@ -4058,6 +4237,12 @@
 		goto out_failed;
 	}
 
+	retval = mpi3mr_refresh_trigger(mrioc, MPI3_CONFIG_ACTION_READ_CURRENT);
+	if (retval) {
+		ioc_err(mrioc, "failed to refresh triggers\n");
+		goto out_failed;
+	}
+
 	ioc_info(mrioc, "controller initialization completed successfully\n");
 	return retval;
 out_failed:
@@ -4109,7 +4294,7 @@
 		goto out_failed_noretry;
 	}
 
-	if (is_resume) {
+	if (is_resume || mrioc->block_on_pci_err) {
 		dprint_reset(mrioc, "setting up single ISR\n");
 		retval = mpi3mr_setup_isr(mrioc, 1);
 		if (retval) {
@@ -4135,6 +4320,17 @@
 
 	mpi3mr_print_ioc_info(mrioc);
 
+	if (is_resume) {
+		dprint_reset(mrioc, "posting host diag buffers\n");
+		retval = mpi3mr_post_diag_bufs(mrioc);
+		if (retval)
+			ioc_warn(mrioc, "failed to post host diag buffers\n");
+	} else {
+		retval = mpi3mr_repost_diag_bufs(mrioc);
+		if (retval)
+			ioc_warn(mrioc, "failed to re post host diag buffers\n");
+	}
+
 	dprint_reset(mrioc, "sending ioc_init\n");
 	retval = mpi3mr_issue_iocinit(mrioc);
 	if (retval) {
@@ -4149,7 +4345,7 @@
 		goto out_failed;
 	}
 
-	if (is_resume) {
+	if (is_resume || mrioc->block_on_pci_err) {
 		dprint_reset(mrioc, "setting up multiple ISR\n");
 		retval = mpi3mr_setup_isr(mrioc, 0);
 		if (retval) {
@@ -4400,6 +4596,7 @@
 {
 	u16 i;
 	struct mpi3mr_intr_info *intr_info;
+	struct diag_buffer_desc *diag_buffer;
 
 	mpi3mr_free_enclosure_list(mrioc);
 	mpi3mr_free_ioctl_dma_memory(mrioc);
@@ -4523,17 +4720,26 @@
 		    mrioc->admin_req_base, mrioc->admin_req_dma);
 		mrioc->admin_req_base = NULL;
 	}
-	if (mrioc->cfg_page) {
-		dma_free_coherent(&mrioc->pdev->dev, mrioc->cfg_page_sz,
-		    mrioc->cfg_page, mrioc->cfg_page_dma);
-		mrioc->cfg_page = NULL;
-	}
+
 	if (mrioc->pel_seqnum_virt) {
 		dma_free_coherent(&mrioc->pdev->dev, mrioc->pel_seqnum_sz,
 		    mrioc->pel_seqnum_virt, mrioc->pel_seqnum_dma);
 		mrioc->pel_seqnum_virt = NULL;
 	}
 
+	for (i = 0; i < MPI3MR_MAX_NUM_HDB; i++) {
+		diag_buffer = &mrioc->diag_buffers[i];
+		if (diag_buffer->addr) {
+			dma_free_coherent(&mrioc->pdev->dev,
+			    diag_buffer->size, diag_buffer->addr,
+			    diag_buffer->dma_addr);
+			diag_buffer->addr = NULL;
+			diag_buffer->size = 0;
+			diag_buffer->type = 0;
+			diag_buffer->status = 0;
+		}
+	}
+
 	kfree(mrioc->throttle_groups);
 	mrioc->throttle_groups = NULL;
 
@@ -4623,7 +4829,8 @@
 
 	ioc_state = mpi3mr_get_iocstate(mrioc);
 
-	if ((!mrioc->unrecoverable) && (!mrioc->reset_in_progress) &&
+	if (!mrioc->unrecoverable && !mrioc->reset_in_progress &&
+	    !mrioc->pci_err_recovery &&
 	    (ioc_state == MRIOC_STATE_READY)) {
 		if (mpi3mr_issue_and_process_mur(mrioc,
 		    MPI3MR_RESET_FROM_CTLR_CLEANUP))
@@ -4971,6 +5178,7 @@
 	int retval = 0, i;
 	unsigned long flags;
 	u32 host_diagnostic, timeout = MPI3_SYSIF_DIAG_SAVE_TIMEOUT * 10;
+	union mpi3mr_trigger_data trigger_data;
 
 	/* Block the reset handler until diag save in progress*/
 	dprint_reset(mrioc,
@@ -5003,10 +5211,16 @@
 	mrioc->reset_in_progress = 1;
 	mrioc->stop_bsgs = 1;
 	mrioc->prev_reset_result = -1;
+	memset(&trigger_data, 0, sizeof(trigger_data));
 
 	if ((!snapdump) && (reset_reason != MPI3MR_RESET_FROM_FAULT_WATCH) &&
 	    (reset_reason != MPI3MR_RESET_FROM_FIRMWARE) &&
 	    (reset_reason != MPI3MR_RESET_FROM_CIACTIV_FAULT)) {
+		mpi3mr_set_trigger_data_in_all_hdb(mrioc,
+		    MPI3MR_HDB_TRIGGER_TYPE_SOFT_RESET, NULL, 0);
+		dprint_reset(mrioc,
+		    "soft_reset_handler: releasing host diagnostic buffers\n");
+		mpi3mr_release_diag_bufs(mrioc, 0);
 		for (i = 0; i < MPI3_EVENT_NOTIFY_EVENTMASK_WORDS; i++)
 			mrioc->event_masks[i] = -1;
 
@@ -5023,6 +5237,8 @@
 		retval = mpi3mr_issue_reset(mrioc,
 		    MPI3_SYSIF_HOST_DIAG_RESET_ACTION_DIAG_FAULT, reset_reason);
 		if (!retval) {
+			trigger_data.fault = (readl(&mrioc->sysif_regs->fault) &
+				      MPI3_SYSIF_FAULT_CODE_MASK);
 			do {
 				host_diagnostic =
 				    readl(&mrioc->sysif_regs->host_diagnostic);
@@ -5031,6 +5247,8 @@
 					break;
 				msleep(100);
 			} while (--timeout);
+			mpi3mr_set_trigger_data_in_all_hdb(mrioc,
+			    MPI3MR_HDB_TRIGGER_TYPE_FAULT, &trigger_data, 0);
 		}
 	}
 
@@ -5066,6 +5284,15 @@
 		mrioc->prepare_for_reset_timeout_counter = 0;
 	}
 	mpi3mr_memset_buffers(mrioc);
+	mpi3mr_release_diag_bufs(mrioc, 1);
+	mrioc->fw_release_trigger_active = false;
+	mrioc->trace_release_trigger_active = false;
+	mrioc->snapdump_trigger_active = false;
+	mpi3mr_set_trigger_data_in_all_hdb(mrioc,
+	    MPI3MR_HDB_TRIGGER_TYPE_SOFT_RESET, NULL, 0);
+
+	dprint_reset(mrioc,
+	    "soft_reset_handler: reinitializing the controller\n");
 	retval = mpi3mr_reinit_ioc(mrioc, 0);
 	if (retval) {
 		pr_err(IOCNAME "reinit after soft reset failed: reason %d\n",
@@ -5112,55 +5339,6 @@
 	return retval;
 }
 
-
-/**
- * mpi3mr_free_config_dma_memory - free memory for config page
- * @mrioc: Adapter instance reference
- * @mem_desc: memory descriptor structure
- *
- * Check whether the size of the buffer specified by the memory
- * descriptor is greater than the default page size if so then
- * free the memory pointed by the descriptor.
- *
- * Return: Nothing.
- */
-static void mpi3mr_free_config_dma_memory(struct mpi3mr_ioc *mrioc,
-	struct dma_memory_desc *mem_desc)
-{
-	if ((mem_desc->size > mrioc->cfg_page_sz) && mem_desc->addr) {
-		dma_free_coherent(&mrioc->pdev->dev, mem_desc->size,
-		    mem_desc->addr, mem_desc->dma_addr);
-		mem_desc->addr = NULL;
-	}
-}
-
-/**
- * mpi3mr_alloc_config_dma_memory - Alloc memory for config page
- * @mrioc: Adapter instance reference
- * @mem_desc: Memory descriptor to hold dma memory info
- *
- * This function allocates new dmaable memory or provides the
- * default config page dmaable memory based on the memory size
- * described by the descriptor.
- *
- * Return: 0 on success, non-zero on failure.
- */
-static int mpi3mr_alloc_config_dma_memory(struct mpi3mr_ioc *mrioc,
-	struct dma_memory_desc *mem_desc)
-{
-	if (mem_desc->size > mrioc->cfg_page_sz) {
-		mem_desc->addr = dma_alloc_coherent(&mrioc->pdev->dev,
-		    mem_desc->size, &mem_desc->dma_addr, GFP_KERNEL);
-		if (!mem_desc->addr)
-			return -ENOMEM;
-	} else {
-		mem_desc->addr = mrioc->cfg_page;
-		mem_desc->dma_addr = mrioc->cfg_page_dma;
-		memset(mem_desc->addr, 0, mrioc->cfg_page_sz);
-	}
-	return 0;
-}
-
 /**
  * mpi3mr_post_cfg_req - Issue config requests and wait
  * @mrioc: Adapter instance reference
@@ -5316,8 +5494,12 @@
 		cfg_req->page_length = cfg_hdr->page_length;
 		cfg_req->page_version = cfg_hdr->page_version;
 	}
-	if (mpi3mr_alloc_config_dma_memory(mrioc, &mem_desc))
-		goto out;
+
+	mem_desc.addr = dma_alloc_coherent(&mrioc->pdev->dev,
+		mem_desc.size, &mem_desc.dma_addr, GFP_KERNEL);
+
+	if (!mem_desc.addr)
+		return retval;
 
 	mpi3mr_add_sg_single(&cfg_req->sgl, sgl_flags, mem_desc.size,
 	    mem_desc.dma_addr);
@@ -5346,7 +5528,12 @@
 	}
 
 out:
-	mpi3mr_free_config_dma_memory(mrioc, &mem_desc);
+	if (mem_desc.addr) {
+		dma_free_coherent(&mrioc->pdev->dev, mem_desc.size,
+			mem_desc.addr, mem_desc.dma_addr);
+		mem_desc.addr = NULL;
+	}
+
 	return retval;
 }
 
@@ -5944,3 +6131,64 @@
 out_failed:
 	return -1;
 }
+
+/**
+ * mpi3mr_cfg_get_driver_pg2 - Read current driver page2
+ * @mrioc: Adapter instance reference
+ * @driver_pg2: Pointer to return driver page 2
+ * @pg_sz: Size of the memory allocated to the page pointer
+ * @page_action: Page action
+ *
+ * This is handler for config page read for the driver page2.
+ * This routine checks ioc_status to decide whether the page
+ * read is success or not.
+ *
+ * Return: 0 on success, non-zero on failure.
+ */
+int mpi3mr_cfg_get_driver_pg2(struct mpi3mr_ioc *mrioc,
+	struct mpi3_driver_page2 *driver_pg2, u16 pg_sz, u8 page_action)
+{
+	struct mpi3_config_page_header cfg_hdr;
+	struct mpi3_config_request cfg_req;
+	u16 ioc_status = 0;
+
+	memset(driver_pg2, 0, pg_sz);
+	memset(&cfg_hdr, 0, sizeof(cfg_hdr));
+	memset(&cfg_req, 0, sizeof(cfg_req));
+
+	cfg_req.function = MPI3_FUNCTION_CONFIG;
+	cfg_req.action = MPI3_CONFIG_ACTION_PAGE_HEADER;
+	cfg_req.page_type = MPI3_CONFIG_PAGETYPE_DRIVER;
+	cfg_req.page_number = 2;
+	cfg_req.page_address = 0;
+	cfg_req.page_version = MPI3_DRIVER2_PAGEVERSION;
+
+	if (mpi3mr_process_cfg_req(mrioc, &cfg_req, NULL,
+	    MPI3MR_INTADMCMD_TIMEOUT, &ioc_status, &cfg_hdr, sizeof(cfg_hdr))) {
+		ioc_err(mrioc, "driver page2 header read failed\n");
+		goto out_failed;
+	}
+	if (ioc_status != MPI3_IOCSTATUS_SUCCESS) {
+		ioc_err(mrioc, "driver page2 header read failed with\n"
+			       "ioc_status(0x%04x)\n",
+		    ioc_status);
+		goto out_failed;
+	}
+	cfg_req.action = page_action;
+
+	if (mpi3mr_process_cfg_req(mrioc, &cfg_req, &cfg_hdr,
+	    MPI3MR_INTADMCMD_TIMEOUT, &ioc_status, driver_pg2, pg_sz)) {
+		ioc_err(mrioc, "driver page2 read failed\n");
+		goto out_failed;
+	}
+	if (ioc_status != MPI3_IOCSTATUS_SUCCESS) {
+		ioc_err(mrioc, "driver page2 read failed with\n"
+			       "ioc_status(0x%04x)\n",
+		    ioc_status);
+		goto out_failed;
+	}
+	return 0;
+out_failed:
+	return -1;
+}
+
--- linux-qcom-6.8.0.orig/drivers/scsi/mpi3mr/mpi3mr_os.c
+++ linux-qcom-6.8.0/drivers/scsi/mpi3mr/mpi3mr_os.c
@@ -8,11 +8,12 @@
  */
 
 #include "mpi3mr.h"
+#include <linux/idr.h>
 
 /* global driver scop variables */
 LIST_HEAD(mrioc_list);
 DEFINE_SPINLOCK(mrioc_list_lock);
-static int mrioc_ids;
+static DEFINE_IDA(mrioc_ida);
 static int warn_non_secure_ctlr;
 atomic64_t event_counter;
 
@@ -241,6 +242,40 @@
 }
 
 /**
+ * mpi3mr_hdb_trigger_data_event - Add hdb trigger data event to
+ * the list
+ * @mrioc: Adapter instance reference
+ * @event_data: Event data
+ *
+ * Add the given hdb trigger data event to the firmware event
+ * list.
+ *
+ * Return: Nothing.
+ */
+void mpi3mr_hdb_trigger_data_event(struct mpi3mr_ioc *mrioc,
+	struct trigger_event_data *event_data)
+{
+	struct mpi3mr_fwevt *fwevt;
+	u16 sz = sizeof(*event_data);
+
+	fwevt = mpi3mr_alloc_fwevt(sz);
+	if (!fwevt) {
+		ioc_warn(mrioc, "failed to queue hdb trigger data event\n");
+		return;
+	}
+
+	fwevt->mrioc = mrioc;
+	fwevt->event_id = MPI3MR_DRIVER_EVENT_PROCESS_TRIGGER;
+	fwevt->send_ack = 0;
+	fwevt->process_evt = 1;
+	fwevt->evt_ctx = 0;
+	fwevt->event_data_size = sz;
+	memcpy(fwevt->event_data, event_data, sz);
+
+	mpi3mr_fwevt_add_to_list(mrioc, fwevt);
+}
+
+/**
  * mpi3mr_fwevt_del_from_list - Delete firmware event from list
  * @mrioc: Adapter instance reference
  * @fwevt: Firmware event reference
@@ -897,6 +932,8 @@
 		}
 	} else
 		mpi3mr_remove_tgtdev_from_sas_transport(mrioc, tgtdev);
+	mpi3mr_global_trigger(mrioc,
+	    MPI3_DRIVER2_GLOBALTRIGGER_DEVICE_REMOVAL_ENABLED);
 
 	ioc_info(mrioc, "%s :Removed handle(0x%04x), wwid(0x%016llx)\n",
 	    __func__, tgtdev->dev_handle, (unsigned long long)tgtdev->wwid);
@@ -919,7 +956,7 @@
 	int retval = 0;
 	struct mpi3mr_tgt_dev *tgtdev;
 
-	if (mrioc->reset_in_progress)
+	if (mrioc->reset_in_progress || mrioc->pci_err_recovery)
 		return -1;
 
 	tgtdev = mpi3mr_get_tgtdev_by_perst_id(mrioc, perst_id);
@@ -1429,6 +1466,62 @@
 }
 
 /**
+ * mpi3mr_process_trigger_data_event_bh - Process trigger event
+ * data
+ * @mrioc: Adapter instance reference
+ * @event_data: Event data
+ *
+ * This function releases diage buffers or issues diag fault
+ * based on trigger conditions
+ *
+ * Return: Nothing
+ */
+static void mpi3mr_process_trigger_data_event_bh(struct mpi3mr_ioc *mrioc,
+	struct trigger_event_data *event_data)
+{
+	struct diag_buffer_desc *trace_hdb = event_data->trace_hdb;
+	struct diag_buffer_desc *fw_hdb = event_data->fw_hdb;
+	unsigned long flags;
+	int retval = 0;
+	u8 trigger_type = event_data->trigger_type;
+	union mpi3mr_trigger_data *trigger_data =
+		&event_data->trigger_specific_data;
+
+	if (event_data->snapdump)  {
+		if (trace_hdb)
+			mpi3mr_set_trigger_data_in_hdb(trace_hdb, trigger_type,
+			    trigger_data, 1);
+		if (fw_hdb)
+			mpi3mr_set_trigger_data_in_hdb(fw_hdb, trigger_type,
+			    trigger_data, 1);
+		mpi3mr_soft_reset_handler(mrioc,
+			    MPI3MR_RESET_FROM_TRIGGER, 1);
+		return;
+	}
+
+	if (trace_hdb) {
+		retval = mpi3mr_issue_diag_buf_release(mrioc, trace_hdb);
+		if (!retval) {
+			mpi3mr_set_trigger_data_in_hdb(trace_hdb, trigger_type,
+			    trigger_data, 1);
+		}
+		spin_lock_irqsave(&mrioc->trigger_lock, flags);
+		mrioc->trace_release_trigger_active = false;
+		spin_unlock_irqrestore(&mrioc->trigger_lock, flags);
+	}
+	if (fw_hdb) {
+		retval = mpi3mr_issue_diag_buf_release(mrioc, fw_hdb);
+		if (!retval) {
+			mpi3mr_set_trigger_data_in_hdb(fw_hdb, trigger_type,
+		    trigger_data, 1);
+		}
+		spin_lock_irqsave(&mrioc->trigger_lock, flags);
+		mrioc->fw_release_trigger_active = false;
+		spin_unlock_irqrestore(&mrioc->trigger_lock, flags);
+	}
+}
+
+/**
  * mpi3mr_encldev_add_chg_evt_debug - debug for enclosure event
  * @mrioc: Adapter instance reference
  * @encl_pg0: Enclosure page 0.
@@ -1910,6 +2003,7 @@
 	struct mpi3_device_page0 *dev_pg0 = NULL;
 	u16 perst_id, handle, dev_info;
 	struct mpi3_device0_sas_sata_format *sasinf = NULL;
+	unsigned int timeout;
 
 	mpi3mr_fwevt_del_from_list(mrioc, fwevt);
 	mrioc->current_event = fwevt;
@@ -2000,8 +2094,18 @@
 	}
 	case MPI3_EVENT_WAIT_FOR_DEVICES_TO_REFRESH:
 	{
-		while (mrioc->device_refresh_on)
+		timeout = MPI3MR_RESET_TIMEOUT * 2;
+		while ((mrioc->device_refresh_on || mrioc->block_on_pci_err) &&
+		    !mrioc->unrecoverable && !mrioc->pci_err_recovery) {
 			msleep(500);
+			if (!timeout--) {
+				mrioc->unrecoverable = 1;
+				break;
+			}
+		}
+
+		if (mrioc->unrecoverable || mrioc->pci_err_recovery)
+			break;
 
 		dprint_event_bh(mrioc,
 		    "scan for non responding and newly added devices after soft reset started\n");
@@ -2014,6 +2118,12 @@
 		    "scan for non responding and newly added devices after soft reset completed\n");
 		break;
 	}
+	case MPI3MR_DRIVER_EVENT_PROCESS_TRIGGER:
+	{
+		mpi3mr_process_trigger_data_event_bh(mrioc,
+		    (struct trigger_event_data *)fwevt->event_data);
+		break;
+	}
 	default:
 		break;
 	}
@@ -2852,6 +2962,7 @@
 		ack_req = 1;
 
 	evt_type = event_reply->event;
+	mpi3mr_event_trigger(mrioc, event_reply->event);
 
 	switch (evt_type) {
 	case MPI3_EVENT_DEVICE_ADDED:
@@ -2890,6 +3001,11 @@
 		ack_req = 0;
 		break;
 	}
+	case MPI3_EVENT_DIAGNOSTIC_BUFFER_STATUS_CHANGE:
+	{
+		mpi3mr_hdbstatuschg_evt_th(mrioc, event_reply);
+		break;
+	}
 	case MPI3_EVENT_DEVICE_INFO_CHANGED:
 	case MPI3_EVENT_LOG_DATA:
 	case MPI3_EVENT_ENCL_DEVICE_STATUS_CHANGE:
@@ -3153,6 +3269,7 @@
 		    MPI3_REPLY_DESCRIPT_STATUS_IOCSTATUS_LOGINFOAVAIL)
 			ioc_loginfo = le32_to_cpu(status_desc->ioc_log_info);
 		ioc_status &= MPI3_REPLY_DESCRIPT_STATUS_IOCSTATUS_STATUS_MASK;
+		mpi3mr_reply_trigger(mrioc, ioc_status, ioc_loginfo);
 		break;
 	case MPI3_REPLY_DESCRIPT_FLAGS_TYPE_ADDRESS_REPLY:
 		addr_desc = (struct mpi3_address_reply_descriptor *)reply_desc;
@@ -3181,6 +3298,12 @@
 		ioc_status &= MPI3_REPLY_DESCRIPT_STATUS_IOCSTATUS_STATUS_MASK;
 		if (sense_state == MPI3_SCSI_STATE_SENSE_BUFF_Q_EMPTY)
 			panic("%s: Ran out of sense buffers\n", mrioc->name);
+		if (sense_buf) {
+			scsi_normalize_sense(sense_buf, sense_count, &sshdr);
+			mpi3mr_scsisense_trigger(mrioc, sshdr.sense_key,
+			    sshdr.asc, sshdr.ascq);
+		}
+		mpi3mr_reply_trigger(mrioc, ioc_status, ioc_loginfo);
 		break;
 	case MPI3_REPLY_DESCRIPT_FLAGS_TYPE_SUCCESS:
 		success_desc = (struct mpi3_success_reply_descriptor *)reply_desc;
@@ -3448,6 +3571,17 @@
 		    scmd->sc_data_direction);
 		priv->meta_sg_valid = 1; /* To unmap meta sg DMA */
 	} else {
+		/*
+		 * Some firmware versions byte-swap the REPORT ZONES command
+		 * reply from ATA-ZAC devices by directly accessing in the host
+		 * buffer. This does not respect the default command DMA
+		 * direction and causes IOMMU page faults on some architectures
+		 * with an IOMMU enforcing write mappings (e.g. AMD hosts).
+		 * Avoid such issue by making the REPORT ZONES buffer mapping
+		 * bi-directional.
+		 */
+		if (scmd->cmnd[0] == ZBC_IN && scmd->cmnd[1] == ZI_REPORT_ZONES)
+			scmd->sc_data_direction = DMA_BIDIRECTIONAL;
 		sg_scmd = scsi_sglist(scmd);
 		sges_left = scsi_dma_map(scmd);
 	}
@@ -3680,6 +3814,13 @@
 		mutex_unlock(&drv_cmd->mutex);
 		goto out;
 	}
+	if (mrioc->block_on_pci_err) {
+		retval = -1;
+		dprint_tm(mrioc, "sending task management failed due to\n"
+				"pci error recovery in progress\n");
+		mutex_unlock(&drv_cmd->mutex);
+		goto out;
+	}
 
 	drv_cmd->state = MPI3MR_CMD_PENDING;
 	drv_cmd->is_waiting = 1;
@@ -3806,6 +3947,8 @@
 	default:
 		break;
 	}
+	mpi3mr_global_trigger(mrioc,
+	    MPI3_DRIVER2_GLOBALTRIGGER_TASK_MANAGEMENT_ENABLED);
 
 out_unlock:
 	drv_cmd->state = MPI3MR_CMD_NOTUSED;
@@ -4063,6 +4206,7 @@
 	struct mpi3mr_sdev_priv_data *sdev_priv_data;
 	u8 dev_type = MPI3_DEVICE_DEVFORM_VD;
 	int retval = FAILED;
+	unsigned int timeout = MPI3MR_RESET_TIMEOUT;
 
 	sdev_priv_data = scmd->device->hostdata;
 	if (sdev_priv_data && sdev_priv_data->tgt_priv_data) {
@@ -4073,12 +4217,24 @@
 	if (dev_type == MPI3_DEVICE_DEVFORM_VD) {
 		mpi3mr_wait_for_host_io(mrioc,
 			MPI3MR_RAID_ERRREC_RESET_TIMEOUT);
-		if (!mpi3mr_get_fw_pending_ios(mrioc))
+		if (!mpi3mr_get_fw_pending_ios(mrioc)) {
+			while (mrioc->reset_in_progress ||
+			       mrioc->prepare_for_reset ||
+			       mrioc->block_on_pci_err) {
+				ssleep(1);
+				if (!timeout--) {
+					retval = FAILED;
+					goto out;
+				}
+			}
 			retval = SUCCESS;
+			goto out;
+		}
 	}
 	if (retval == FAILED)
 		mpi3mr_print_pending_host_io(mrioc);
 
+out:
 	sdev_printk(KERN_INFO, scmd->device,
 		"Bus reset is %s for scmd(%p)\n",
 		((retval == SUCCESS) ? "SUCCESS" : "FAILED"), scmd);
@@ -4779,7 +4935,8 @@
 		goto out;
 	}
 
-	if (mrioc->reset_in_progress) {
+	if (mrioc->reset_in_progress || mrioc->prepare_for_reset
+	    || mrioc->block_on_pci_err) {
 		retval = SCSI_MLQUEUE_HOST_BUSY;
 		goto out;
 	}
@@ -5072,7 +5229,10 @@
 	}
 
 	mrioc = shost_priv(shost);
-	mrioc->id = mrioc_ids++;
+	retval = ida_alloc_range(&mrioc_ida, 0, U8_MAX, GFP_KERNEL);
+	if (retval < 0)
+		goto id_alloc_failed;
+	mrioc->id = (u8)retval;
 	sprintf(mrioc->driver_name, "%s", MPI3MR_DRIVER_NAME);
 	sprintf(mrioc->name, "%s%d", mrioc->driver_name, mrioc->id);
 	INIT_LIST_HEAD(&mrioc->list);
@@ -5222,9 +5382,11 @@
 resource_alloc_failed:
 	destroy_workqueue(mrioc->fwevt_worker_thread);
 fwevtthread_failed:
+	ida_free(&mrioc_ida, mrioc->id);
 	spin_lock(&mrioc_list_lock);
 	list_del(&mrioc->list);
 	spin_unlock(&mrioc_list_lock);
+id_alloc_failed:
 	scsi_host_put(shost);
 shost_failed:
 	return retval;
@@ -5257,7 +5419,14 @@
 	while (mrioc->reset_in_progress || mrioc->is_driver_loading)
 		ssleep(1);
 
-	if (!pci_device_is_present(mrioc->pdev)) {
+	if (mrioc->block_on_pci_err) {
+		mrioc->block_on_pci_err = false;
+		scsi_unblock_requests(shost);
+		mrioc->unrecoverable = 1;
+	}
+
+	if (!pci_device_is_present(mrioc->pdev) ||
+	    mrioc->pci_err_recovery) {
 		mrioc->unrecoverable = 1;
 		mpi3mr_flush_cmds_for_unrecovered_controller(mrioc);
 	}
@@ -5310,6 +5479,7 @@
 		mrioc->sas_hba.num_phys = 0;
 	}
 
+	ida_free(&mrioc_ida, mrioc->id);
 	spin_lock(&mrioc_list_lock);
 	list_del(&mrioc->list);
 	spin_unlock(&mrioc_list_lock);
@@ -5440,6 +5610,197 @@
 	return 0;
 }
 
+/**
+ * mpi3mr_pcierr_error_detected - PCI error detected callback
+ * @pdev: PCI device instance
+ * @state: channel state
+ *
+ * This function is called by the PCI error recovery driver and
+ * based on the state passed the driver decides what actions to
+ * be recommended back to PCI driver.
+ *
+ * For all of the states if there is no valid mrioc or scsi host
+ * references in the PCI device then this function will return
+ * the result as disconnect.
+ *
+ * For normal state, this function will return the result as can
+ * recover.
+ *
+ * For frozen state, this function will block for any pending
+ * controller initialization or re-initialization to complete,
+ * stop any new interactions with the controller and return
+ * status as reset required.
+ *
+ * For permanent failure state, this function will mark the
+ * controller as unrecoverable and return status as disconnect.
+ *
+ * Returns: PCI_ERS_RESULT_NEED_RESET or CAN_RECOVER or
+ * DISCONNECT based on the controller state.
+ */
+static pci_ers_result_t
+mpi3mr_pcierr_error_detected(struct pci_dev *pdev, pci_channel_state_t state)
+{
+	struct Scsi_Host *shost;
+	struct mpi3mr_ioc *mrioc;
+	unsigned int timeout = MPI3MR_RESET_TIMEOUT;
+
+	dev_info(&pdev->dev, "%s: callback invoked state(%d)\n", __func__,
+	    state);
+
+	shost = pci_get_drvdata(pdev);
+	mrioc = shost_priv(shost);
+
+	switch (state) {
+	case pci_channel_io_normal:
+		return PCI_ERS_RESULT_CAN_RECOVER;
+	case pci_channel_io_frozen:
+		mrioc->pci_err_recovery = true;
+		mrioc->block_on_pci_err = true;
+		do {
+			if (mrioc->reset_in_progress || mrioc->is_driver_loading)
+				ssleep(1);
+			else
+				break;
+		} while (--timeout);
+
+		if (!timeout) {
+			mrioc->pci_err_recovery = true;
+			mrioc->block_on_pci_err = true;
+			mrioc->unrecoverable = 1;
+			mpi3mr_stop_watchdog(mrioc);
+			mpi3mr_flush_cmds_for_unrecovered_controller(mrioc);
+			return PCI_ERS_RESULT_DISCONNECT;
+		}
+
+		scsi_block_requests(mrioc->shost);
+		mpi3mr_stop_watchdog(mrioc);
+		mpi3mr_cleanup_resources(mrioc);
+		return PCI_ERS_RESULT_NEED_RESET;
+	case pci_channel_io_perm_failure:
+		mrioc->pci_err_recovery = true;
+		mrioc->block_on_pci_err = true;
+		mrioc->unrecoverable = 1;
+		mpi3mr_stop_watchdog(mrioc);
+		mpi3mr_flush_cmds_for_unrecovered_controller(mrioc);
+		return PCI_ERS_RESULT_DISCONNECT;
+	default:
+		return PCI_ERS_RESULT_DISCONNECT;
+	}
+}
+
+/**
+ * mpi3mr_pcierr_slot_reset - Post slot reset callback
+ * @pdev: PCI device instance
+ *
+ * This function is called by the PCI error recovery driver
+ * after a slot or link reset issued by it for the recovery, the
+ * driver is expected to bring back the controller and
+ * initialize it.
+ *
+ * This function restores PCI state and reinitializes controller
+ * resources and the controller, this blocks for any pending
+ * reset to complete.
+ *
+ * Returns: PCI_ERS_RESULT_DISCONNECT on failure or
+ * PCI_ERS_RESULT_RECOVERED
+ */
+static pci_ers_result_t mpi3mr_pcierr_slot_reset(struct pci_dev *pdev)
+{
+	struct Scsi_Host *shost;
+	struct mpi3mr_ioc *mrioc;
+	unsigned int timeout = MPI3MR_RESET_TIMEOUT;
+
+	dev_info(&pdev->dev, "%s: callback invoked\n", __func__);
+
+	shost = pci_get_drvdata(pdev);
+	mrioc = shost_priv(shost);
+
+	do {
+		if (mrioc->reset_in_progress)
+			ssleep(1);
+		else
+			break;
+	} while (--timeout);
+
+	if (!timeout)
+		goto out_failed;
+
+	pci_restore_state(pdev);
+
+	if (mpi3mr_setup_resources(mrioc)) {
+		ioc_err(mrioc, "setup resources failed\n");
+		goto out_failed;
+	}
+	mrioc->unrecoverable = 0;
+	mrioc->pci_err_recovery = false;
+
+	if (mpi3mr_soft_reset_handler(mrioc, MPI3MR_RESET_FROM_FIRMWARE, 0))
+		goto out_failed;
+
+	return PCI_ERS_RESULT_RECOVERED;
+
+out_failed:
+	mrioc->unrecoverable = 1;
+	mrioc->block_on_pci_err = false;
+	scsi_unblock_requests(shost);
+	mpi3mr_start_watchdog(mrioc);
+	return PCI_ERS_RESULT_DISCONNECT;
+}
+
+/**
+ * mpi3mr_pcierr_resume - PCI error recovery resume
+ * callback
+ * @pdev: PCI device instance
+ *
+ * This function enables all I/O and IOCTLs post reset issued as
+ * part of the PCI error recovery
+ *
+ * Return: Nothing.
+ */
+static void mpi3mr_pcierr_resume(struct pci_dev *pdev)
+{
+	struct Scsi_Host *shost;
+	struct mpi3mr_ioc *mrioc;
+
+	dev_info(&pdev->dev, "%s: callback invoked\n", __func__);
+
+	shost = pci_get_drvdata(pdev);
+	mrioc = shost_priv(shost);
+
+	if (mrioc->block_on_pci_err) {
+		mrioc->block_on_pci_err = false;
+		scsi_unblock_requests(shost);
+		mpi3mr_start_watchdog(mrioc);
+	}
+}
+
+/**
+ * mpi3mr_pcierr_mmio_enabled - PCI error recovery callback
+ * @pdev: PCI device instance
+ *
+ * This is called only if mpi3mr_pcierr_error_detected returns
+ * PCI_ERS_RESULT_CAN_RECOVER.
+ *
+ * Return: PCI_ERS_RESULT_DISCONNECT when the controller is
+ * unrecoverable or when the shost/mrioc reference cannot be
+ * found, else return PCI_ERS_RESULT_RECOVERED
+ */
+static pci_ers_result_t mpi3mr_pcierr_mmio_enabled(struct pci_dev *pdev)
+{
+	struct Scsi_Host *shost;
+	struct mpi3mr_ioc *mrioc;
+
+	dev_info(&pdev->dev, "%s: callback invoked\n", __func__);
+
+	shost = pci_get_drvdata(pdev);
+	mrioc = shost_priv(shost);
+
+	if (mrioc->unrecoverable)
+		return PCI_ERS_RESULT_DISCONNECT;
+
+	return PCI_ERS_RESULT_RECOVERED;
+}
+
 static const struct pci_device_id mpi3mr_pci_id_table[] = {
 	{
 		PCI_DEVICE_SUB(MPI3_MFGPAGE_VENDORID_BROADCOM,
@@ -5457,6 +5818,13 @@
 };
 MODULE_DEVICE_TABLE(pci, mpi3mr_pci_id_table);
 
+static struct pci_error_handlers mpi3mr_err_handler = {
+	.error_detected = mpi3mr_pcierr_error_detected,
+	.mmio_enabled = mpi3mr_pcierr_mmio_enabled,
+	.slot_reset = mpi3mr_pcierr_slot_reset,
+	.resume = mpi3mr_pcierr_resume,
+};
+
 static SIMPLE_DEV_PM_OPS(mpi3mr_pm_ops, mpi3mr_suspend, mpi3mr_resume);
 
 static struct pci_driver mpi3mr_pci_driver = {
@@ -5465,6 +5833,7 @@
 	.probe = mpi3mr_probe,
 	.remove = mpi3mr_remove,
 	.shutdown = mpi3mr_shutdown,
+	.err_handler = &mpi3mr_err_handler,
 	.driver.pm = &mpi3mr_pm_ops,
 };
 
@@ -5525,6 +5894,7 @@
 			   &driver_attr_event_counter);
 	pci_unregister_driver(&mpi3mr_pci_driver);
 	sas_release_transport(mpi3mr_transport_template);
+	ida_destroy(&mrioc_ida);
 }
 
 module_init(mpi3mr_init);
--- linux-qcom-6.8.0.orig/drivers/scsi/mpi3mr/mpi3mr_transport.c
+++ linux-qcom-6.8.0/drivers/scsi/mpi3mr/mpi3mr_transport.c
@@ -149,6 +149,11 @@
 		return -EFAULT;
 	}
 
+	if (mrioc->pci_err_recovery) {
+		ioc_err(mrioc, "%s: pci error recovery in progress!\n", __func__);
+		return -EFAULT;
+	}
+
 	data_out_sz = sizeof(struct rep_manu_request);
 	data_in_sz = sizeof(struct rep_manu_reply);
 	data_out = dma_alloc_coherent(&mrioc->pdev->dev,
@@ -587,12 +592,13 @@
  * @mrioc: Adapter instance reference
  * @mr_sas_port: Internal Port object
  * @mr_sas_phy: Internal Phy object
+ * @host_node: Flag to indicate this is a host_node
  *
  * Return: None.
  */
 static void mpi3mr_delete_sas_phy(struct mpi3mr_ioc *mrioc,
 	struct mpi3mr_sas_port *mr_sas_port,
-	struct mpi3mr_sas_phy *mr_sas_phy)
+	struct mpi3mr_sas_phy *mr_sas_phy, u8 host_node)
 {
 	u64 sas_address = mr_sas_port->remote_identify.sas_address;
 
@@ -602,9 +608,13 @@
 
 	list_del(&mr_sas_phy->port_siblings);
 	mr_sas_port->num_phys--;
-	mr_sas_port->phy_mask &= ~(1 << mr_sas_phy->phy_id);
-	if (mr_sas_port->lowest_phy == mr_sas_phy->phy_id)
-		mr_sas_port->lowest_phy = ffs(mr_sas_port->phy_mask) - 1;
+
+	if (host_node) {
+		mr_sas_port->phy_mask &= ~(1 << mr_sas_phy->phy_id);
+
+		if (mr_sas_port->lowest_phy == mr_sas_phy->phy_id)
+			mr_sas_port->lowest_phy = ffs(mr_sas_port->phy_mask) - 1;
+	}
 	sas_port_delete_phy(mr_sas_port->port, mr_sas_phy->phy);
 	mr_sas_phy->phy_belongs_to_port = 0;
 }
@@ -614,12 +624,13 @@
  * @mrioc: Adapter instance reference
  * @mr_sas_port: Internal Port object
  * @mr_sas_phy: Internal Phy object
+ * @host_node: Flag to indicate this is a host_node
  *
  * Return: None.
  */
 static void mpi3mr_add_sas_phy(struct mpi3mr_ioc *mrioc,
 	struct mpi3mr_sas_port *mr_sas_port,
-	struct mpi3mr_sas_phy *mr_sas_phy)
+	struct mpi3mr_sas_phy *mr_sas_phy, u8 host_node)
 {
 	u64 sas_address = mr_sas_port->remote_identify.sas_address;
 
@@ -629,9 +640,12 @@
 
 	list_add_tail(&mr_sas_phy->port_siblings, &mr_sas_port->phy_list);
 	mr_sas_port->num_phys++;
-	mr_sas_port->phy_mask |= (1 << mr_sas_phy->phy_id);
-	if (mr_sas_phy->phy_id < mr_sas_port->lowest_phy)
-		mr_sas_port->lowest_phy = ffs(mr_sas_port->phy_mask) - 1;
+	if (host_node) {
+		mr_sas_port->phy_mask |= (1 << mr_sas_phy->phy_id);
+
+		if (mr_sas_phy->phy_id < mr_sas_port->lowest_phy)
+			mr_sas_port->lowest_phy = ffs(mr_sas_port->phy_mask) - 1;
+	}
 	sas_port_add_phy(mr_sas_port->port, mr_sas_phy->phy);
 	mr_sas_phy->phy_belongs_to_port = 1;
 }
@@ -672,7 +686,7 @@
 			if (srch_phy == mr_sas_phy)
 				return;
 		}
-		mpi3mr_add_sas_phy(mrioc, mr_sas_port, mr_sas_phy);
+		mpi3mr_add_sas_phy(mrioc, mr_sas_port, mr_sas_phy, mr_sas_node->host_node);
 		return;
 	}
 }
@@ -733,7 +747,7 @@
 				mpi3mr_delete_sas_port(mrioc, mr_sas_port);
 			else
 				mpi3mr_delete_sas_phy(mrioc, mr_sas_port,
-				    mr_sas_phy);
+				    mr_sas_phy, mr_sas_node->host_node);
 			return;
 		}
 	}
@@ -792,6 +806,12 @@
 		return -EFAULT;
 	}
 
+	if (mrioc->pci_err_recovery) {
+		ioc_err(mrioc, "%s: pci error recovery in progress!\n",
+		    __func__);
+		return -EFAULT;
+	}
+
 	if ((mpi3mr_cfg_get_dev_pg0(mrioc, &ioc_status, &device_pg0,
 	    sizeof(device_pg0), MPI3_DEVICE_PGAD_FORM_HANDLE, handle))) {
 		ioc_err(mrioc, "%s: device page0 read failed\n", __func__);
@@ -1009,6 +1029,9 @@
 	hba_port->port_id = port_id;
 	ioc_info(mrioc, "hba_port entry: %p, port: %d is added to hba_port list\n",
 	    hba_port, hba_port->port_id);
+	if (mrioc->reset_in_progress ||
+		mrioc->pci_err_recovery)
+		hba_port->flags = MPI3MR_HBA_PORT_FLAG_NEW;
 	list_add_tail(&hba_port->list, &mrioc->hba_port_table_list);
 	return hba_port;
 }
@@ -1016,7 +1039,7 @@
 /**
  * mpi3mr_get_hba_port_by_id - find hba port by id
  * @mrioc: Adapter instance reference
- * @port_id - Port ID to search
+ * @port_id: Port ID to search
  *
  * Return: mpi3mr_hba_port reference for the matched port
  */
@@ -1057,7 +1080,7 @@
 	struct mpi3mr_sas_node *mr_sas_node;
 	struct mpi3mr_sas_phy *mr_sas_phy;
 
-	if (mrioc->reset_in_progress)
+	if (mrioc->reset_in_progress || mrioc->pci_err_recovery)
 		return;
 
 	spin_lock_irqsave(&mrioc->sas_node_lock, flags);
@@ -1355,15 +1378,27 @@
 	mpi3mr_sas_port_sanity_check(mrioc, mr_sas_node,
 	    mr_sas_port->remote_identify.sas_address, hba_port);
 
+	if (mr_sas_node->host_node && mr_sas_node->num_phys >=
+			sizeof(mr_sas_port->phy_mask) * 8)
+		ioc_info(mrioc, "max port count %u could be too high\n",
+		    mr_sas_node->num_phys);
+
 	for (i = 0; i < mr_sas_node->num_phys; i++) {
 		if ((mr_sas_node->phy[i].remote_identify.sas_address !=
 		    mr_sas_port->remote_identify.sas_address) ||
 		    (mr_sas_node->phy[i].hba_port != hba_port))
 			continue;
+
+		if (mr_sas_node->host_node && (i >= sizeof(mr_sas_port->phy_mask) * 8)) {
+			ioc_warn(mrioc, "skipping port %u, max allowed value is %zu\n",
+			    i, sizeof(mr_sas_port->phy_mask) * 8);
+			goto out_fail;
+		}
 		list_add_tail(&mr_sas_node->phy[i].port_siblings,
 		    &mr_sas_port->phy_list);
 		mr_sas_port->num_phys++;
-		mr_sas_port->phy_mask |= (1 << i);
+		if (mr_sas_node->host_node)
+			mr_sas_port->phy_mask |= (1 << i);
 	}
 
 	if (!mr_sas_port->num_phys) {
@@ -1372,7 +1407,8 @@
 		goto out_fail;
 	}
 
-	mr_sas_port->lowest_phy = ffs(mr_sas_port->phy_mask) - 1;
+	if (mr_sas_node->host_node)
+		mr_sas_port->lowest_phy = ffs(mr_sas_port->phy_mask) - 1;
 
 	if (mr_sas_port->remote_identify.device_type == SAS_END_DEVICE) {
 		tgtdev = mpi3mr_get_tgtdev_by_addr(mrioc,
@@ -1970,7 +2006,7 @@
 	if (!handle)
 		return -1;
 
-	if (mrioc->reset_in_progress)
+	if (mrioc->reset_in_progress || mrioc->pci_err_recovery)
 		return -1;
 
 	if ((mpi3mr_cfg_get_sas_exp_pg0(mrioc, &ioc_status, &expander_pg0,
@@ -2176,7 +2212,7 @@
 	/* remove sibling ports attached to this expander */
 	list_for_each_entry_safe(mr_sas_port, next,
 	   &sas_expander->sas_port_list, port_list) {
-		if (mrioc->reset_in_progress)
+		if (mrioc->reset_in_progress || mrioc->pci_err_recovery)
 			return;
 		if (mr_sas_port->remote_identify.device_type ==
 		    SAS_END_DEVICE)
@@ -2226,7 +2262,7 @@
 	struct mpi3mr_sas_node *sas_expander;
 	unsigned long flags;
 
-	if (mrioc->reset_in_progress)
+	if (mrioc->reset_in_progress || mrioc->pci_err_recovery)
 		return;
 
 	if (!hba_port)
@@ -2537,6 +2573,11 @@
 		return -EFAULT;
 	}
 
+	if (mrioc->pci_err_recovery) {
+		ioc_err(mrioc, "%s: pci error recovery in progress!\n", __func__);
+		return -EFAULT;
+	}
+
 	data_out_sz = sizeof(struct phy_error_log_request);
 	data_in_sz = sizeof(struct phy_error_log_reply);
 	sz = data_out_sz + data_in_sz;
@@ -2796,6 +2837,12 @@
 		return -EFAULT;
 	}
 
+	if (mrioc->pci_err_recovery) {
+		ioc_err(mrioc, "%s: pci error recovery in progress!\n",
+		    __func__);
+		return -EFAULT;
+	}
+
 	data_out_sz = sizeof(struct phy_control_request);
 	data_in_sz = sizeof(struct phy_control_reply);
 	sz = data_out_sz + data_in_sz;
@@ -3218,6 +3265,12 @@
 		rc = -EFAULT;
 		goto out;
 	}
+
+	if (mrioc->pci_err_recovery) {
+		ioc_err(mrioc, "%s: pci error recovery in progress!\n", __func__);
+		rc = -EFAULT;
+		goto out;
+	}
 
 	rc = mpi3mr_map_smp_buffer(&mrioc->pdev->dev, &job->request_payload,
 	    &dma_addr_out, &dma_len_out, &addr_out);
--- linux-qcom-6.8.0.orig/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ linux-qcom-6.8.0/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -2671,6 +2671,22 @@
 	_base_add_sg_single_ieee(paddr, sgl_flags, 0, 0, -1);
 }
 
+static inline int _base_scsi_dma_map(struct scsi_cmnd *cmd)
+{
+	/*
+	 * Some firmware versions byte-swap the REPORT ZONES command reply from
+	 * ATA-ZAC devices by directly accessing in the host buffer. This does
+	 * not respect the default command DMA direction and causes IOMMU page
+	 * faults on some architectures with an IOMMU enforcing write mappings
+	 * (e.g. AMD hosts). Avoid such issue by making the report zones buffer
+	 * mapping bi-directional.
+	 */
+	if (cmd->cmnd[0] == ZBC_IN && cmd->cmnd[1] == ZI_REPORT_ZONES)
+		cmd->sc_data_direction = DMA_BIDIRECTIONAL;
+
+	return scsi_dma_map(cmd);
+}
+
 /**
  * _base_build_sg_scmd - main sg creation routine
  *		pcie_device is unused here!
@@ -2717,7 +2733,7 @@
 	sgl_flags = sgl_flags << MPI2_SGE_FLAGS_SHIFT;
 
 	sg_scmd = scsi_sglist(scmd);
-	sges_left = scsi_dma_map(scmd);
+	sges_left = _base_scsi_dma_map(scmd);
 	if (sges_left < 0)
 		return -ENOMEM;
 
@@ -2861,7 +2877,7 @@
 	}
 
 	sg_scmd = scsi_sglist(scmd);
-	sges_left = scsi_dma_map(scmd);
+	sges_left = _base_scsi_dma_map(scmd);
 	if (sges_left < 0)
 		return -ENOMEM;
 
@@ -7025,11 +7041,12 @@
 	int i;
 	u8 failed;
 	__le32 *mfp;
+	int ret_val;
 
 	/* make sure doorbell is not in use */
 	if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) {
 		ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__);
-		return -EFAULT;
+		goto doorbell_diag_reset;
 	}
 
 	/* clear pending doorbell interrupts from previous state changes */
@@ -7119,6 +7136,10 @@
 			    le32_to_cpu(mfp[i]));
 	}
 	return 0;
+
+doorbell_diag_reset:
+	ret_val = _base_diag_reset(ioc);
+	return ret_val;
 }
 
 /**
@@ -8477,6 +8498,12 @@
 	ioc->pd_handles_sz = (ioc->facts.MaxDevHandle / 8);
 	if (ioc->facts.MaxDevHandle % 8)
 		ioc->pd_handles_sz++;
+	/*
+	 * pd_handles_sz should have, at least, the minimal room for
+	 * set_bit()/test_bit(), otherwise out-of-memory touch may occur.
+	 */
+	ioc->pd_handles_sz = ALIGN(ioc->pd_handles_sz, sizeof(unsigned long));
+
 	ioc->pd_handles = kzalloc(ioc->pd_handles_sz,
 	    GFP_KERNEL);
 	if (!ioc->pd_handles) {
@@ -8494,6 +8521,13 @@
 	ioc->pend_os_device_add_sz = (ioc->facts.MaxDevHandle / 8);
 	if (ioc->facts.MaxDevHandle % 8)
 		ioc->pend_os_device_add_sz++;
+
+	/*
+	 * pend_os_device_add_sz should have, at least, the minimal room for
+	 * set_bit()/test_bit(), otherwise out-of-memory may occur.
+	 */
+	ioc->pend_os_device_add_sz = ALIGN(ioc->pend_os_device_add_sz,
+					   sizeof(unsigned long));
 	ioc->pend_os_device_add = kzalloc(ioc->pend_os_device_add_sz,
 	    GFP_KERNEL);
 	if (!ioc->pend_os_device_add) {
@@ -8785,6 +8819,12 @@
 		if (ioc->facts.MaxDevHandle % 8)
 			pd_handles_sz++;
 
+		/*
+		 * pd_handles should have, at least, the minimal room for
+		 * set_bit()/test_bit(), otherwise out-of-memory touch may
+		 * occur.
+		 */
+		pd_handles_sz = ALIGN(pd_handles_sz, sizeof(unsigned long));
 		pd_handles = krealloc(ioc->pd_handles, pd_handles_sz,
 		    GFP_KERNEL);
 		if (!pd_handles) {
--- linux-qcom-6.8.0.orig/drivers/scsi/mpt3sas/mpt3sas_base.h
+++ linux-qcom-6.8.0/drivers/scsi/mpt3sas/mpt3sas_base.h
@@ -2044,9 +2044,6 @@
 mpt3sas_setup_direct_io(struct MPT3SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
 	struct _raid_device *raid_device, Mpi25SCSIIORequest_t *mpi_request);
 
-/* NCQ Prio Handling Check */
-bool scsih_ncq_prio_supp(struct scsi_device *sdev);
-
 void mpt3sas_setup_debugfs(struct MPT3SAS_ADAPTER *ioc);
 void mpt3sas_destroy_debugfs(struct MPT3SAS_ADAPTER *ioc);
 void mpt3sas_init_debugfs(void);
--- linux-qcom-6.8.0.orig/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+++ linux-qcom-6.8.0/drivers/scsi/mpt3sas/mpt3sas_ctl.c
@@ -4034,7 +4034,7 @@
 {
 	struct scsi_device *sdev = to_scsi_device(dev);
 
-	return sysfs_emit(buf, "%d\n", scsih_ncq_prio_supp(sdev));
+	return sysfs_emit(buf, "%d\n", sas_ata_ncq_prio_supported(sdev));
 }
 static DEVICE_ATTR_RO(sas_ncq_prio_supported);
 
@@ -4069,7 +4069,7 @@
 	if (kstrtobool(buf, &ncq_prio_enable))
 		return -EINVAL;
 
-	if (!scsih_ncq_prio_supp(sdev))
+	if (!sas_ata_ncq_prio_supported(sdev))
 		return -EINVAL;
 
 	sas_device_priv_data->ncq_prio_enable = ncq_prio_enable;
--- linux-qcom-6.8.0.orig/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ linux-qcom-6.8.0/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -12572,29 +12572,6 @@
 	return PCI_ERS_RESULT_RECOVERED;
 }
 
-/**
- * scsih_ncq_prio_supp - Check for NCQ command priority support
- * @sdev: scsi device struct
- *
- * This is called when a user indicates they would like to enable
- * ncq command priorities. This works only on SATA devices.
- */
-bool scsih_ncq_prio_supp(struct scsi_device *sdev)
-{
-	struct scsi_vpd *vpd;
-	bool ncq_prio_supp = false;
-
-	rcu_read_lock();
-	vpd = rcu_dereference(sdev->vpd_pg89);
-	if (!vpd || vpd->len < 214)
-		goto out;
-
-	ncq_prio_supp = (vpd->data[213] >> 4) & 1;
-out:
-	rcu_read_unlock();
-
-	return ncq_prio_supp;
-}
 /*
  * The pci device ids are defined in mpi/mpi2_cnfg.h.
  */
--- linux-qcom-6.8.0.orig/drivers/scsi/myrb.c
+++ linux-qcom-6.8.0/drivers/scsi/myrb.c
@@ -1775,9 +1775,9 @@
 
 		name = myrb_devstate_name(ldev_info->state);
 		if (name)
-			ret = snprintf(buf, 32, "%s\n", name);
+			ret = snprintf(buf, 64, "%s\n", name);
 		else
-			ret = snprintf(buf, 32, "Invalid (%02X)\n",
+			ret = snprintf(buf, 64, "Invalid (%02X)\n",
 				       ldev_info->state);
 	} else {
 		struct myrb_pdev_state *pdev_info = sdev->hostdata;
@@ -1796,9 +1796,9 @@
 		else
 			name = myrb_devstate_name(pdev_info->state);
 		if (name)
-			ret = snprintf(buf, 32, "%s\n", name);
+			ret = snprintf(buf, 64, "%s\n", name);
 		else
-			ret = snprintf(buf, 32, "Invalid (%02X)\n",
+			ret = snprintf(buf, 64, "Invalid (%02X)\n",
 				       pdev_info->state);
 	}
 	return ret;
@@ -1886,11 +1886,11 @@
 
 		name = myrb_raidlevel_name(ldev_info->raid_level);
 		if (!name)
-			return snprintf(buf, 32, "Invalid (%02X)\n",
+			return snprintf(buf, 64, "Invalid (%02X)\n",
 					ldev_info->state);
-		return snprintf(buf, 32, "%s\n", name);
+		return snprintf(buf, 64, "%s\n", name);
 	}
-	return snprintf(buf, 32, "Physical Drive\n");
+	return snprintf(buf, 64, "Physical Drive\n");
 }
 static DEVICE_ATTR_RO(raid_level);
 
@@ -1903,15 +1903,15 @@
 	unsigned char status;
 
 	if (sdev->channel < myrb_logical_channel(sdev->host))
-		return snprintf(buf, 32, "physical device - not rebuilding\n");
+		return snprintf(buf, 64, "physical device - not rebuilding\n");
 
 	status = myrb_get_rbld_progress(cb, &rbld_buf);
 
 	if (rbld_buf.ldev_num != sdev->id ||
 	    status != MYRB_STATUS_SUCCESS)
-		return snprintf(buf, 32, "not rebuilding\n");
+		return snprintf(buf, 64, "not rebuilding\n");
 
-	return snprintf(buf, 32, "rebuilding block %u of %u\n",
+	return snprintf(buf, 64, "rebuilding block %u of %u\n",
 			rbld_buf.ldev_size - rbld_buf.blocks_left,
 			rbld_buf.ldev_size);
 }
--- linux-qcom-6.8.0.orig/drivers/scsi/myrs.c
+++ linux-qcom-6.8.0/drivers/scsi/myrs.c
@@ -947,9 +947,9 @@
 
 		name = myrs_devstate_name(ldev_info->dev_state);
 		if (name)
-			ret = snprintf(buf, 32, "%s\n", name);
+			ret = snprintf(buf, 64, "%s\n", name);
 		else
-			ret = snprintf(buf, 32, "Invalid (%02X)\n",
+			ret = snprintf(buf, 64, "Invalid (%02X)\n",
 				       ldev_info->dev_state);
 	} else {
 		struct myrs_pdev_info *pdev_info;
@@ -958,9 +958,9 @@
 		pdev_info = sdev->hostdata;
 		name = myrs_devstate_name(pdev_info->dev_state);
 		if (name)
-			ret = snprintf(buf, 32, "%s\n", name);
+			ret = snprintf(buf, 64, "%s\n", name);
 		else
-			ret = snprintf(buf, 32, "Invalid (%02X)\n",
+			ret = snprintf(buf, 64, "Invalid (%02X)\n",
 				       pdev_info->dev_state);
 	}
 	return ret;
@@ -1066,13 +1066,13 @@
 		ldev_info = sdev->hostdata;
 		name = myrs_raid_level_name(ldev_info->raid_level);
 		if (!name)
-			return snprintf(buf, 32, "Invalid (%02X)\n",
+			return snprintf(buf, 64, "Invalid (%02X)\n",
 					ldev_info->dev_state);
 
 	} else
 		name = myrs_raid_level_name(MYRS_RAID_PHYSICAL);
 
-	return snprintf(buf, 32, "%s\n", name);
+	return snprintf(buf, 64, "%s\n", name);
 }
 static DEVICE_ATTR_RO(raid_level);
 
@@ -1086,7 +1086,7 @@
 	unsigned char status;
 
 	if (sdev->channel < cs->ctlr_info->physchan_present)
-		return snprintf(buf, 32, "physical device - not rebuilding\n");
+		return snprintf(buf, 64, "physical device - not rebuilding\n");
 
 	ldev_info = sdev->hostdata;
 	ldev_num = ldev_info->ldev_num;
@@ -1098,11 +1098,11 @@
 		return -EIO;
 	}
 	if (ldev_info->rbld_active) {
-		return snprintf(buf, 32, "rebuilding block %zu of %zu\n",
+		return snprintf(buf, 64, "rebuilding block %zu of %zu\n",
 				(size_t)ldev_info->rbld_lba,
 				(size_t)ldev_info->cfg_devsize);
 	} else
-		return snprintf(buf, 32, "not rebuilding\n");
+		return snprintf(buf, 64, "not rebuilding\n");
 }
 
 static ssize_t rebuild_store(struct device *dev,
@@ -1190,7 +1190,7 @@
 	unsigned short ldev_num;
 
 	if (sdev->channel < cs->ctlr_info->physchan_present)
-		return snprintf(buf, 32, "physical device - not checking\n");
+		return snprintf(buf, 64, "physical device - not checking\n");
 
 	ldev_info = sdev->hostdata;
 	if (!ldev_info)
@@ -1198,11 +1198,11 @@
 	ldev_num = ldev_info->ldev_num;
 	myrs_get_ldev_info(cs, ldev_num, ldev_info);
 	if (ldev_info->cc_active)
-		return snprintf(buf, 32, "checking block %zu of %zu\n",
+		return snprintf(buf, 64, "checking block %zu of %zu\n",
 				(size_t)ldev_info->cc_lba,
 				(size_t)ldev_info->cfg_devsize);
 	else
-		return snprintf(buf, 32, "not checking\n");
+		return snprintf(buf, 64, "not checking\n");
 }
 
 static ssize_t consistency_check_store(struct device *dev,
--- linux-qcom-6.8.0.orig/drivers/scsi/pm8001/pm8001_init.c
+++ linux-qcom-6.8.0/drivers/scsi/pm8001/pm8001_init.c
@@ -100,10 +100,12 @@
 	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
 	struct blk_mq_queue_map *qmap = &shost->tag_set.map[HCTX_TYPE_DEFAULT];
 
-	if (pm8001_ha->number_of_intr > 1)
+	if (pm8001_ha->number_of_intr > 1) {
 		blk_mq_pci_map_queues(qmap, pm8001_ha->pdev, 1);
+		return;
+	}
 
-	return blk_mq_map_queues(qmap);
+	blk_mq_map_queues(qmap);
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/scsi/pm8001/pm8001_sas.c
+++ linux-qcom-6.8.0/drivers/scsi/pm8001/pm8001_sas.c
@@ -166,7 +166,6 @@
 	unsigned long flags;
 	pm8001_ha = sas_phy->ha->lldd_ha;
 	phy = &pm8001_ha->phy[phy_id];
-	pm8001_ha->phy[phy_id].enable_completion = &completion;
 
 	if (PM8001_CHIP_DISP->fatal_errors(pm8001_ha)) {
 		/*
@@ -190,6 +189,7 @@
 				rates->maximum_linkrate;
 		}
 		if (pm8001_ha->phy[phy_id].phy_state ==  PHY_LINK_DISABLE) {
+			pm8001_ha->phy[phy_id].enable_completion = &completion;
 			PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
 			wait_for_completion(&completion);
 		}
@@ -198,6 +198,7 @@
 		break;
 	case PHY_FUNC_HARD_RESET:
 		if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
+			pm8001_ha->phy[phy_id].enable_completion = &completion;
 			PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
 			wait_for_completion(&completion);
 		}
@@ -206,6 +207,7 @@
 		break;
 	case PHY_FUNC_LINK_RESET:
 		if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
+			pm8001_ha->phy[phy_id].enable_completion = &completion;
 			PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
 			wait_for_completion(&completion);
 		}
--- linux-qcom-6.8.0.orig/drivers/scsi/qedf/qedf.h
+++ linux-qcom-6.8.0/drivers/scsi/qedf/qedf.h
@@ -363,6 +363,7 @@
 #define QEDF_IN_RECOVERY		5
 #define QEDF_DBG_STOP_IO		6
 #define QEDF_PROBING			8
+#define QEDF_STAG_IN_PROGRESS		9
 	unsigned long flags; /* Miscellaneous state flags */
 	int fipvlan_retries;
 	u8 num_queues;
--- linux-qcom-6.8.0.orig/drivers/scsi/qedf/qedf_debugfs.c
+++ linux-qcom-6.8.0/drivers/scsi/qedf/qedf_debugfs.c
@@ -170,7 +170,7 @@
 	if (!count || *ppos)
 		return 0;
 
-	kern_buf = memdup_user(buffer, count);
+	kern_buf = memdup_user_nul(buffer, count);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 
--- linux-qcom-6.8.0.orig/drivers/scsi/qedf/qedf_io.c
+++ linux-qcom-6.8.0/drivers/scsi/qedf/qedf_io.c
@@ -2324,9 +2324,6 @@
 	io_req->fcport = fcport;
 	io_req->cmd_type = QEDF_TASK_MGMT_CMD;
 
-	/* Record which cpu this request is associated with */
-	io_req->cpu = smp_processor_id();
-
 	/* Set TM flags */
 	io_req->io_req_flags = QEDF_READ;
 	io_req->data_xfer_len = 0;
@@ -2349,6 +2346,9 @@
 
 	spin_lock_irqsave(&fcport->rport_lock, flags);
 
+	/* Record which cpu this request is associated with */
+	io_req->cpu = smp_processor_id();
+
 	sqe_idx = qedf_get_sqe_idx(fcport);
 	sqe = &fcport->sq[sqe_idx];
 	memset(sqe, 0, sizeof(struct fcoe_wqe));
--- linux-qcom-6.8.0.orig/drivers/scsi/qedf/qedf_main.c
+++ linux-qcom-6.8.0/drivers/scsi/qedf/qedf_main.c
@@ -318,11 +318,18 @@
 	 */
 	if (resp == fc_lport_flogi_resp) {
 		qedf->flogi_cnt++;
+		qedf->flogi_pending++;
+
+		if (test_bit(QEDF_UNLOADING, &qedf->flags)) {
+			QEDF_ERR(&qedf->dbg_ctx, "Driver unloading\n");
+			qedf->flogi_pending = 0;
+		}
+
 		if (qedf->flogi_pending >= QEDF_FLOGI_RETRY_CNT) {
 			schedule_delayed_work(&qedf->stag_work, 2);
 			return NULL;
 		}
-		qedf->flogi_pending++;
+
 		return fc_elsct_send(lport, did, fp, op, qedf_flogi_resp,
 		    arg, timeout);
 	}
@@ -912,13 +919,14 @@
 	struct qedf_ctx *qedf;
 	struct qed_link_output if_link;
 
+	qedf = lport_priv(lport);
+
 	if (lport->vport) {
+		clear_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags);
 		printk_ratelimited("Cannot issue host reset on NPIV port.\n");
 		return;
 	}
 
-	qedf = lport_priv(lport);
-
 	qedf->flogi_pending = 0;
 	/* For host reset, essentially do a soft link up/down */
 	atomic_set(&qedf->link_state, QEDF_LINK_DOWN);
@@ -938,6 +946,7 @@
 	if (!if_link.link_up) {
 		QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC,
 			  "Physical link is not up.\n");
+		clear_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags);
 		return;
 	}
 	/* Flush and wait to make sure link down is processed */
@@ -950,6 +959,7 @@
 		  "Queue link up work.\n");
 	queue_delayed_work(qedf->link_update_wq, &qedf->link_update,
 	    0);
+	clear_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags);
 }
 
 /* Reset the host by gracefully logging out and then logging back in */
@@ -2728,6 +2738,7 @@
 	    sb_id, QED_SB_TYPE_STORAGE);
 
 	if (ret) {
+		dma_free_coherent(&qedf->pdev->dev, sizeof(*sb_virt), sb_virt, sb_phys);
 		QEDF_ERR(&qedf->dbg_ctx,
 			 "Status block initialization failed (0x%x) for id = %d.\n",
 			 ret, sb_id);
@@ -3463,6 +3474,7 @@
 	}
 
 	/* Start the Slowpath-process */
+	memset(&slowpath_params, 0, sizeof(struct qed_slowpath_params));
 	slowpath_params.int_mode = QED_INT_MODE_MSIX;
 	slowpath_params.drv_major = QEDF_DRIVER_MAJOR_VER;
 	slowpath_params.drv_minor = QEDF_DRIVER_MINOR_VER;
@@ -3721,6 +3733,7 @@
 {
 	struct qedf_ctx *qedf;
 	int rc;
+	int cnt = 0;
 
 	if (!pdev) {
 		QEDF_ERR(NULL, "pdev is NULL.\n");
@@ -3738,6 +3751,17 @@
 		return;
 	}
 
+stag_in_prog:
+	if (test_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags)) {
+		QEDF_ERR(&qedf->dbg_ctx, "Stag in progress, cnt=%d.\n", cnt);
+		cnt++;
+
+		if (cnt < 5) {
+			msleep(500);
+			goto stag_in_prog;
+		}
+	}
+
 	if (mode != QEDF_MODE_RECOVERY)
 		set_bit(QEDF_UNLOADING, &qedf->flags);
 
@@ -3997,6 +4021,24 @@
 	struct qedf_ctx *qedf =
 	    container_of(work, struct qedf_ctx, stag_work.work);
 
+	if (!qedf) {
+		QEDF_ERR(&qedf->dbg_ctx, "qedf is NULL");
+		return;
+	}
+
+	if (test_bit(QEDF_IN_RECOVERY, &qedf->flags)) {
+		QEDF_ERR(&qedf->dbg_ctx,
+			 "Already is in recovery, hence not calling software context reset.\n");
+		return;
+	}
+
+	if (test_bit(QEDF_UNLOADING, &qedf->flags)) {
+		QEDF_ERR(&qedf->dbg_ctx, "Driver unloading\n");
+		return;
+	}
+
+	set_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags);
+
 	printk_ratelimited("[%s]:[%s:%d]:%d: Performing software context reset.",
 			dev_name(&qedf->pdev->dev), __func__, __LINE__,
 			qedf->dbg_ctx.host_no);
--- linux-qcom-6.8.0.orig/drivers/scsi/qedi/qedi_debugfs.c
+++ linux-qcom-6.8.0/drivers/scsi/qedi/qedi_debugfs.c
@@ -120,15 +120,11 @@
 qedi_dbg_do_not_recover_cmd_read(struct file *filp, char __user *buffer,
 				 size_t count, loff_t *ppos)
 {
-	size_t cnt = 0;
+	char buf[64];
+	int len;
 
-	if (*ppos)
-		return 0;
-
-	cnt = sprintf(buffer, "do_not_recover=%d\n", qedi_do_not_recover);
-	cnt = min_t(int, count, cnt - *ppos);
-	*ppos += cnt;
-	return cnt;
+	len = sprintf(buf, "do_not_recover=%d\n", qedi_do_not_recover);
+	return simple_read_from_buffer(buffer, count, ppos, buf, len);
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/scsi/qedi/qedi_main.c
+++ linux-qcom-6.8.0/drivers/scsi/qedi/qedi_main.c
@@ -369,6 +369,7 @@
 	ret = qedi_ops->common->sb_init(qedi->cdev, sb_info, sb_virt, sb_phys,
 				       sb_id, QED_SB_TYPE_STORAGE);
 	if (ret) {
+		dma_free_coherent(&qedi->pdev->dev, sizeof(*sb_virt), sb_virt, sb_phys);
 		QEDI_ERR(&qedi->dbg_ctx,
 			 "Status block initialization failed for id = %d.\n",
 			  sb_id);
--- linux-qcom-6.8.0.orig/drivers/scsi/qla1280.h
+++ linux-qcom-6.8.0/drivers/scsi/qla1280.h
@@ -116,12 +116,12 @@
 	uint16_t id_h;		/* ID high */
 	uint16_t cfg_0;		/* Configuration 0 */
 #define ISP_CFG0_HWMSK   0x000f	/* Hardware revision mask */
-#define ISP_CFG0_1020    BIT_0	/* ISP1020 */
-#define ISP_CFG0_1020A	 BIT_1	/* ISP1020A */
-#define ISP_CFG0_1040	 BIT_2	/* ISP1040 */
-#define ISP_CFG0_1040A	 BIT_3	/* ISP1040A */
-#define ISP_CFG0_1040B	 BIT_4	/* ISP1040B */
-#define ISP_CFG0_1040C	 BIT_5	/* ISP1040C */
+#define ISP_CFG0_1020	 1	/* ISP1020 */
+#define ISP_CFG0_1020A	 2	/* ISP1020A */
+#define ISP_CFG0_1040	 3	/* ISP1040 */
+#define ISP_CFG0_1040A	 4	/* ISP1040A */
+#define ISP_CFG0_1040B	 5	/* ISP1040B */
+#define ISP_CFG0_1040C	 6	/* ISP1040C */
 	uint16_t cfg_1;		/* Configuration 1 */
 #define ISP_CFG1_F128    BIT_6  /* 128-byte FIFO threshold */
 #define ISP_CFG1_F64     BIT_4|BIT_5 /* 128-byte FIFO threshold */
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_attr.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_attr.c
@@ -2741,7 +2741,13 @@
 		return;
 
 	if (unlikely(pci_channel_offline(fcport->vha->hw->pdev))) {
-		qla2x00_abort_all_cmds(fcport->vha, DID_NO_CONNECT << 16);
+		/* Will wait for wind down of adapter */
+		ql_dbg(ql_dbg_aer, fcport->vha, 0x900c,
+		    "%s pci offline detected (id %06x)\n", __func__,
+		    fcport->d_id.b24);
+		qla_pci_set_eeh_busy(fcport->vha);
+		qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24,
+		    0, WAIT_TARGET);
 		return;
 	}
 }
@@ -2763,7 +2769,11 @@
 	vha = fcport->vha;
 
 	if (unlikely(pci_channel_offline(fcport->vha->hw->pdev))) {
-		qla2x00_abort_all_cmds(fcport->vha, DID_NO_CONNECT << 16);
+		/* Will wait for wind down of adapter */
+		ql_dbg(ql_dbg_aer, fcport->vha, 0x900b,
+		    "%s pci offline detected (id %06x)\n", __func__,
+		    fcport->d_id.b24);
+		qla_pci_set_eeh_busy(vha);
 		qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24,
 			0, WAIT_TARGET);
 		return;
@@ -3301,6 +3311,7 @@
 	.show_host_node_name = 1,
 	.show_host_port_name = 1,
 	.show_host_supported_classes = 1,
+	.show_host_supported_speeds = 1,
 
 	.get_host_port_id = qla2x00_get_host_port_id,
 	.show_host_port_id = 1,
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_bsg.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_bsg.c
@@ -24,6 +24,7 @@
 {
 	struct bsg_job *bsg_job = sp->u.bsg_job;
 	struct fc_bsg_reply *bsg_reply = bsg_job->reply;
+	struct completion *comp = sp->comp;
 
 	ql_dbg(ql_dbg_user, sp->vha, 0x7009,
 	    "%s: sp hdl %x, result=%x bsg ptr %p\n",
@@ -35,6 +36,9 @@
 	bsg_reply->result = res;
 	bsg_job_done(bsg_job, bsg_reply->result,
 		       bsg_reply->reply_payload_rcv_len);
+
+	if (comp)
+		complete(comp);
 }
 
 void qla2x00_bsg_sp_free(srb_t *sp)
@@ -324,7 +328,7 @@
 		    "request_sg_cnt=%x reply_sg_cnt=%x.\n",
 		    bsg_job->request_payload.sg_cnt,
 		    bsg_job->reply_payload.sg_cnt);
-		rval = -EPERM;
+		rval = -ENOBUFS;
 		goto done;
 	}
 
@@ -490,16 +494,6 @@
 		goto done;
 	}
 
-	if ((req_sg_cnt !=  bsg_job->request_payload.sg_cnt) ||
-	    (rsp_sg_cnt != bsg_job->reply_payload.sg_cnt)) {
-		ql_log(ql_log_warn, vha, 0x7011,
-		    "request_sg_cnt: %x dma_request_sg_cnt: %x reply_sg_cnt:%x "
-		    "dma_reply_sg_cnt: %x\n", bsg_job->request_payload.sg_cnt,
-		    req_sg_cnt, bsg_job->reply_payload.sg_cnt, rsp_sg_cnt);
-		rval = -EAGAIN;
-		goto done_unmap_sg;
-	}
-
 	if (!vha->flags.online) {
 		ql_log(ql_log_warn, vha, 0x7012,
 		    "Host is not online.\n");
@@ -3059,19 +3053,130 @@
 	return ret;
 }
 
-int
-qla24xx_bsg_timeout(struct bsg_job *bsg_job)
+static bool qla_bsg_found(struct qla_qpair *qpair, struct bsg_job *bsg_job)
 {
+	bool found, do_bsg_done;
 	struct fc_bsg_reply *bsg_reply = bsg_job->reply;
 	scsi_qla_host_t *vha = shost_priv(fc_bsg_to_shost(bsg_job));
 	struct qla_hw_data *ha = vha->hw;
-	srb_t *sp;
-	int cnt, que;
+	srb_t *sp = NULL;
+	int cnt;
 	unsigned long flags;
 	struct req_que *req;
+	int rval;
+	DECLARE_COMPLETION_ONSTACK(comp);
+	uint32_t ratov_j;
+
+	found = do_bsg_done = false;
+
+	spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+	req = qpair->req;
+
+	for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
+		sp = req->outstanding_cmds[cnt];
+		if (sp &&
+		    (sp->type == SRB_CT_CMD ||
+		     sp->type == SRB_ELS_CMD_HST ||
+		     sp->type == SRB_ELS_CMD_HST_NOLOGIN) &&
+		    sp->u.bsg_job == bsg_job) {
+
+			found = true;
+			sp->comp = &comp;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+	if (!found)
+		return false;
+
+	if (ha->flags.eeh_busy) {
+		/* skip over abort.  EEH handling will return the bsg. Wait for it */
+		rval = QLA_SUCCESS;
+		ql_dbg(ql_dbg_user, vha, 0x802c,
+			"eeh encounter. bsg %p sp=%p handle=%x \n",
+			bsg_job, sp, sp->handle);
+	} else {
+		rval = ha->isp_ops->abort_command(sp);
+		ql_dbg(ql_dbg_user, vha, 0x802c,
+			"Aborting bsg %p sp=%p handle=%x rval=%x\n",
+			bsg_job, sp, sp->handle, rval);
+	}
+
+	switch (rval) {
+	case QLA_SUCCESS:
+		/* Wait for the command completion. */
+		ratov_j = ha->r_a_tov / 10 * 4 * 1000;
+		ratov_j = msecs_to_jiffies(ratov_j);
+
+		if (!wait_for_completion_timeout(&comp, ratov_j)) {
+			ql_log(ql_log_info, vha, 0x7089,
+				"bsg abort timeout.  bsg=%p sp=%p handle %#x .\n",
+				bsg_job, sp, sp->handle);
+
+			do_bsg_done = true;
+		} else {
+			/* fw had returned the bsg */
+			ql_dbg(ql_dbg_user, vha, 0x708a,
+				"bsg abort success. bsg %p sp=%p handle=%#x\n",
+				bsg_job, sp, sp->handle);
+			do_bsg_done = false;
+		}
+		break;
+	default:
+		ql_log(ql_log_info, vha, 0x704f,
+			"bsg abort fail.  bsg=%p sp=%p rval=%x.\n",
+			bsg_job, sp, rval);
+
+		do_bsg_done = true;
+		break;
+	}
+
+	if (!do_bsg_done)
+		return true;
 
-	ql_log(ql_log_info, vha, 0x708b, "%s CMD timeout. bsg ptr %p.\n",
-	    __func__, bsg_job);
+	spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+	/*
+	 * recheck to make sure it's still the same bsg_job due to
+	 * qp_lock_ptr was released earlier.
+	 */
+	if (req->outstanding_cmds[cnt] &&
+	    req->outstanding_cmds[cnt]->u.bsg_job != bsg_job) {
+		/* fw had returned the bsg */
+		spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+		return true;
+	}
+	req->outstanding_cmds[cnt] = NULL;
+	spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+	/* ref: INIT */
+	sp->comp = NULL;
+	kref_put(&sp->cmd_kref, qla2x00_sp_release);
+	bsg_reply->result = -ENXIO;
+	bsg_reply->reply_payload_rcv_len = 0;
+
+	ql_dbg(ql_dbg_user, vha, 0x7051,
+	       "%s bsg_job_done : bsg %p result %#x sp %p.\n",
+	       __func__, bsg_job, bsg_reply->result, sp);
+
+	bsg_job_done(bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);
+
+	return true;
+}
+
+int
+qla24xx_bsg_timeout(struct bsg_job *bsg_job)
+{
+	struct fc_bsg_request *bsg_request = bsg_job->request;
+	scsi_qla_host_t *vha = shost_priv(fc_bsg_to_shost(bsg_job));
+	struct qla_hw_data *ha = vha->hw;
+	int i;
+	struct qla_qpair *qpair;
+
+	ql_log(ql_log_info, vha, 0x708b,
+	       "%s CMD timeout. bsg ptr %p msgcode %x vendor cmd %x\n",
+	       __func__, bsg_job, bsg_request->msgcode,
+	       bsg_request->rqst_data.h_vendor.vendor_cmd[0]);
 
 	if (qla2x00_isp_reg_stat(ha)) {
 		ql_log(ql_log_info, vha, 0x9007,
@@ -3079,48 +3184,21 @@
 		qla_pci_set_eeh_busy(vha);
 	}
 
+	if (qla_bsg_found(ha->base_qpair, bsg_job))
+		goto done;
+
 	/* find the bsg job from the active list of commands */
-	spin_lock_irqsave(&ha->hardware_lock, flags);
-	for (que = 0; que < ha->max_req_queues; que++) {
-		req = ha->req_q_map[que];
-		if (!req)
+	for (i = 0; i < ha->max_qpairs; i++) {
+		qpair = vha->hw->queue_pair_map[i];
+		if (!qpair)
 			continue;
-
-		for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
-			sp = req->outstanding_cmds[cnt];
-			if (sp &&
-			    (sp->type == SRB_CT_CMD ||
-			     sp->type == SRB_ELS_CMD_HST ||
-			     sp->type == SRB_ELS_CMD_HST_NOLOGIN ||
-			     sp->type == SRB_FXIOCB_BCMD) &&
-			    sp->u.bsg_job == bsg_job) {
-				req->outstanding_cmds[cnt] = NULL;
-				spin_unlock_irqrestore(&ha->hardware_lock, flags);
-
-				if (!ha->flags.eeh_busy && ha->isp_ops->abort_command(sp)) {
-					ql_log(ql_log_warn, vha, 0x7089,
-					    "mbx abort_command failed.\n");
-					bsg_reply->result = -EIO;
-				} else {
-					ql_dbg(ql_dbg_user, vha, 0x708a,
-					    "mbx abort_command success.\n");
-					bsg_reply->result = 0;
-				}
-				spin_lock_irqsave(&ha->hardware_lock, flags);
-				goto done;
-
-			}
-		}
+		if (qla_bsg_found(qpair, bsg_job))
+			goto done;
 	}
-	spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
 	ql_log(ql_log_info, vha, 0x708b, "SRB not found to abort.\n");
-	bsg_reply->result = -ENXIO;
-	return 0;
 
 done:
-	spin_unlock_irqrestore(&ha->hardware_lock, flags);
-	/* ref: INIT */
-	kref_put(&sp->cmd_kref, qla2x00_sp_release);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_def.h
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_def.h
@@ -82,7 +82,7 @@
 #include "qla_nvme.h"
 #define QLA2XXX_DRIVER_NAME	"qla2xxx"
 #define QLA2XXX_APIDEV		"ql2xapidev"
-#define QLA2XXX_MANUFACTURER	"Marvell Semiconductor, Inc."
+#define QLA2XXX_MANUFACTURER	"Marvell"
 
 /*
  * We have MAILBOX_REGISTER_COUNT sized arrays in a few places,
@@ -3309,9 +3309,20 @@
 	u8 node_name[8];
 };
 
+enum scan_step {
+	FAB_SCAN_START,
+	FAB_SCAN_GPNFT_FCP,
+	FAB_SCAN_GNNFT_FCP,
+	FAB_SCAN_GPNFT_NVME,
+	FAB_SCAN_GNNFT_NVME,
+};
+
 struct fab_scan {
 	struct fab_scan_rp *l;
 	u32 size;
+	u32 rscn_gen_start;
+	u32 rscn_gen_end;
+	enum scan_step step;
 	u16 scan_retry;
 #define MAX_SCAN_RETRIES 5
 	enum scan_flags_t scan_flags;
@@ -3537,9 +3548,8 @@
 	QLA_EVT_RELOGIN,
 	QLA_EVT_ASYNC_PRLO,
 	QLA_EVT_ASYNC_PRLO_DONE,
-	QLA_EVT_GPNFT,
-	QLA_EVT_GPNFT_DONE,
-	QLA_EVT_GNNFT_DONE,
+	QLA_EVT_SCAN_CMD,
+	QLA_EVT_SCAN_FINISH,
 	QLA_EVT_GFPNID,
 	QLA_EVT_SP_RETRY,
 	QLA_EVT_IIDMA,
@@ -5030,6 +5040,7 @@
 
 	/* Counter to detect races between ELS and RSCN events */
 	atomic_t		generation_tick;
+	atomic_t		rscn_gen;
 	/* Time when global fcport update has been scheduled */
 	int			total_fcport_update_gen;
 	/* List of pending LOGOs, protected by tgt_mutex */
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_dfs.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_dfs.c
@@ -274,7 +274,7 @@
 		seq_printf(s, "Driver: estimate iocb used [%d] high water limit [%d]\n",
 			   iocbs_used, ha->base_qpair->fwres.iocbs_limit);
 
-		seq_printf(s, "estimate exchange used[%d] high water limit [%d] n",
+		seq_printf(s, "estimate exchange used[%d] high water limit [%d]\n",
 			   exch_used, ha->base_qpair->fwres.exch_limit);
 
 		if (ql2xenforce_iocb_limit == 2) {
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_edif.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_edif.c
@@ -1100,7 +1100,7 @@
 
 		list_for_each_entry_safe(fcport, tf, &vha->vp_fcports, list) {
 			if (fcport->edif.enable) {
-				if (pcnt > app_req.num_ports)
+				if (pcnt >= app_req.num_ports)
 					break;
 
 				app_reply->elem[pcnt].rekey_count =
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_gbl.h
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_gbl.h
@@ -44,7 +44,7 @@
 extern int qla2x00_local_device_login(scsi_qla_host_t *, fc_port_t *);
 
 extern int qla24xx_els_dcmd_iocb(scsi_qla_host_t *, int, port_id_t);
-extern int qla24xx_els_dcmd2_iocb(scsi_qla_host_t *, int, fc_port_t *, bool);
+extern int qla24xx_els_dcmd2_iocb(scsi_qla_host_t *, int, fc_port_t *);
 extern void qla2x00_els_dcmd2_free(scsi_qla_host_t *vha,
 				   struct els_plogi *els_plogi);
 
@@ -728,9 +728,9 @@
 void qla24xx_handle_gpsc_event(scsi_qla_host_t *, struct event_arg *);
 int qla2x00_mgmt_svr_login(scsi_qla_host_t *);
 int qla24xx_async_gffid(scsi_qla_host_t *vha, fc_port_t *fcport, bool);
-int qla24xx_async_gpnft(scsi_qla_host_t *, u8, srb_t *);
-void qla24xx_async_gpnft_done(scsi_qla_host_t *, srb_t *);
-void qla24xx_async_gnnft_done(scsi_qla_host_t *, srb_t *);
+int qla_fab_async_scan(scsi_qla_host_t *, srb_t *);
+void qla_fab_scan_start(struct scsi_qla_host *);
+void qla_fab_scan_finish(scsi_qla_host_t *, srb_t *);
 int qla24xx_post_gfpnid_work(struct scsi_qla_host *, fc_port_t *);
 int qla24xx_async_gfpnid(scsi_qla_host_t *, fc_port_t *);
 void qla24xx_handle_gfpnid_event(scsi_qla_host_t *, struct event_arg *);
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_gs.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_gs.c
@@ -1710,7 +1710,7 @@
 	eiter->type = cpu_to_be16(FDMI_HBA_OPTION_ROM_VERSION);
 	alen = scnprintf(
 		eiter->a.orom_version, sizeof(eiter->a.orom_version),
-		"%d.%02d", ha->bios_revision[1], ha->bios_revision[0]);
+		"%d.%02d", ha->efi_revision[1], ha->efi_revision[0]);
 	alen += FDMI_ATTR_ALIGNMENT(alen);
 	alen += FDMI_ATTR_TYPELEN(eiter);
 	eiter->len = cpu_to_be16(alen);
@@ -3168,7 +3168,30 @@
 	return rc;
 }
 
-void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+static bool qla_ok_to_clear_rscn(scsi_qla_host_t *vha, fc_port_t *fcport)
+{
+	u32 rscn_gen;
+
+	rscn_gen = atomic_read(&vha->rscn_gen);
+	ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x2017,
+	    "%s %d %8phC rscn_gen %x start %x end %x current %x\n",
+	    __func__, __LINE__, fcport->port_name, fcport->rscn_gen,
+	    vha->scan.rscn_gen_start, vha->scan.rscn_gen_end, rscn_gen);
+
+	if (val_is_in_range(fcport->rscn_gen, vha->scan.rscn_gen_start,
+	    vha->scan.rscn_gen_end))
+		/* rscn came in before fabric scan */
+		return true;
+
+	if (val_is_in_range(fcport->rscn_gen, vha->scan.rscn_gen_end, rscn_gen))
+		/* rscn came in after fabric scan */
+		return false;
+
+	/* rare: fcport's scan_needed + rscn_gen must be stale */
+	return true;
+}
+
+void qla_fab_scan_finish(scsi_qla_host_t *vha, srb_t *sp)
 {
 	fc_port_t *fcport;
 	u32 i, rc;
@@ -3281,10 +3304,10 @@
 				   (fcport->scan_needed &&
 				    fcport->port_type != FCT_INITIATOR &&
 				    fcport->port_type != FCT_NVME_INITIATOR)) {
+				fcport->scan_needed = 0;
 				qlt_schedule_sess_for_deletion(fcport);
 			}
 			fcport->d_id.b24 = rp->id.b24;
-			fcport->scan_needed = 0;
 			break;
 		}
 
@@ -3325,7 +3348,9 @@
 				do_delete = true;
 			}
 
-			fcport->scan_needed = 0;
+			if (qla_ok_to_clear_rscn(vha, fcport))
+				fcport->scan_needed = 0;
+
 			if (((qla_dual_mode_enabled(vha) ||
 			      qla_ini_mode_enabled(vha)) &&
 			    atomic_read(&fcport->state) == FCS_ONLINE) ||
@@ -3355,7 +3380,9 @@
 					    fcport->port_name, fcport->loop_id,
 					    fcport->login_retry);
 				}
-				fcport->scan_needed = 0;
+
+				if (qla_ok_to_clear_rscn(vha, fcport))
+					fcport->scan_needed = 0;
 				qla24xx_fcport_handle_login(vha, fcport);
 			}
 		}
@@ -3379,14 +3406,11 @@
 	}
 }
 
-static int qla2x00_post_gnnft_gpnft_done_work(struct scsi_qla_host *vha,
+static int qla2x00_post_next_scan_work(struct scsi_qla_host *vha,
     srb_t *sp, int cmd)
 {
 	struct qla_work_evt *e;
 
-	if (cmd != QLA_EVT_GPNFT_DONE && cmd != QLA_EVT_GNNFT_DONE)
-		return QLA_PARAMETER_ERROR;
-
 	e = qla2x00_alloc_work(vha, cmd);
 	if (!e)
 		return QLA_FUNCTION_FAILED;
@@ -3396,37 +3420,15 @@
 	return qla2x00_post_work(vha, e);
 }
 
-static int qla2x00_post_nvme_gpnft_work(struct scsi_qla_host *vha,
-    srb_t *sp, int cmd)
-{
-	struct qla_work_evt *e;
-
-	if (cmd != QLA_EVT_GPNFT)
-		return QLA_PARAMETER_ERROR;
-
-	e = qla2x00_alloc_work(vha, cmd);
-	if (!e)
-		return QLA_FUNCTION_FAILED;
-
-	e->u.gpnft.fc4_type = FC4_TYPE_NVME;
-	e->u.gpnft.sp = sp;
-
-	return qla2x00_post_work(vha, e);
-}
-
 static void qla2x00_find_free_fcp_nvme_slot(struct scsi_qla_host *vha,
 	struct srb *sp)
 {
 	struct qla_hw_data *ha = vha->hw;
 	int num_fibre_dev = ha->max_fibre_devices;
-	struct ct_sns_req *ct_req =
-		(struct ct_sns_req *)sp->u.iocb_cmd.u.ctarg.req;
 	struct ct_sns_gpnft_rsp *ct_rsp =
 		(struct ct_sns_gpnft_rsp *)sp->u.iocb_cmd.u.ctarg.rsp;
 	struct ct_sns_gpn_ft_data *d;
 	struct fab_scan_rp *rp;
-	u16 cmd = be16_to_cpu(ct_req->command);
-	u8 fc4_type = sp->gen2;
 	int i, j, k;
 	port_id_t id;
 	u8 found;
@@ -3445,85 +3447,83 @@
 		if (id.b24 == 0 || wwn == 0)
 			continue;
 
-		if (fc4_type == FC4_TYPE_FCP_SCSI) {
-			if (cmd == GPN_FT_CMD) {
-				rp = &vha->scan.l[j];
-				rp->id = id;
-				memcpy(rp->port_name, d->port_name, 8);
-				j++;
-				rp->fc4type = FS_FC4TYPE_FCP;
-			} else {
-				for (k = 0; k < num_fibre_dev; k++) {
-					rp = &vha->scan.l[k];
-					if (id.b24 == rp->id.b24) {
-						memcpy(rp->node_name,
-						    d->port_name, 8);
-						break;
-					}
+		ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x2025,
+		       "%s %06x %8ph \n",
+		       __func__, id.b24, d->port_name);
+
+		switch (vha->scan.step) {
+		case FAB_SCAN_GPNFT_FCP:
+			rp = &vha->scan.l[j];
+			rp->id = id;
+			memcpy(rp->port_name, d->port_name, 8);
+			j++;
+			rp->fc4type = FS_FC4TYPE_FCP;
+			break;
+		case FAB_SCAN_GNNFT_FCP:
+			for (k = 0; k < num_fibre_dev; k++) {
+				rp = &vha->scan.l[k];
+				if (id.b24 == rp->id.b24) {
+					memcpy(rp->node_name,
+					    d->port_name, 8);
+					break;
 				}
 			}
-		} else {
-			/* Search if the fibre device supports FC4_TYPE_NVME */
-			if (cmd == GPN_FT_CMD) {
-				found = 0;
+			break;
+		case FAB_SCAN_GPNFT_NVME:
+			found = 0;
 
-				for (k = 0; k < num_fibre_dev; k++) {
-					rp = &vha->scan.l[k];
-					if (!memcmp(rp->port_name,
-					    d->port_name, 8)) {
-						/*
-						 * Supports FC-NVMe & FCP
-						 */
-						rp->fc4type |= FS_FC4TYPE_NVME;
-						found = 1;
-						break;
-					}
+			for (k = 0; k < num_fibre_dev; k++) {
+				rp = &vha->scan.l[k];
+				if (!memcmp(rp->port_name, d->port_name, 8)) {
+					/*
+					 * Supports FC-NVMe & FCP
+					 */
+					rp->fc4type |= FS_FC4TYPE_NVME;
+					found = 1;
+					break;
 				}
+			}
 
-				/* We found new FC-NVMe only port */
-				if (!found) {
-					for (k = 0; k < num_fibre_dev; k++) {
-						rp = &vha->scan.l[k];
-						if (wwn_to_u64(rp->port_name)) {
-							continue;
-						} else {
-							rp->id = id;
-							memcpy(rp->port_name,
-							    d->port_name, 8);
-							rp->fc4type =
-							    FS_FC4TYPE_NVME;
-							break;
-						}
-					}
-				}
-			} else {
+			/* We found new FC-NVMe only port */
+			if (!found) {
 				for (k = 0; k < num_fibre_dev; k++) {
 					rp = &vha->scan.l[k];
-					if (id.b24 == rp->id.b24) {
-						memcpy(rp->node_name,
-						    d->port_name, 8);
+					if (wwn_to_u64(rp->port_name)) {
+						continue;
+					} else {
+						rp->id = id;
+						memcpy(rp->port_name, d->port_name, 8);
+						rp->fc4type = FS_FC4TYPE_NVME;
 						break;
 					}
 				}
 			}
+			break;
+		case FAB_SCAN_GNNFT_NVME:
+			for (k = 0; k < num_fibre_dev; k++) {
+				rp = &vha->scan.l[k];
+				if (id.b24 == rp->id.b24) {
+					memcpy(rp->node_name, d->port_name, 8);
+					break;
+				}
+			}
+			break;
+		default:
+			break;
 		}
 	}
 }
 
-static void qla2x00_async_gpnft_gnnft_sp_done(srb_t *sp, int res)
+static void qla_async_scan_sp_done(srb_t *sp, int res)
 {
 	struct scsi_qla_host *vha = sp->vha;
-	struct ct_sns_req *ct_req =
-		(struct ct_sns_req *)sp->u.iocb_cmd.u.ctarg.req;
-	u16 cmd = be16_to_cpu(ct_req->command);
-	u8 fc4_type = sp->gen2;
 	unsigned long flags;
 	int rc;
 
 	/* gen2 field is holding the fc4type */
-	ql_dbg(ql_dbg_disc, vha, 0xffff,
-	    "Async done-%s res %x FC4Type %x\n",
-	    sp->name, res, sp->gen2);
+	ql_dbg(ql_dbg_disc, vha, 0x2026,
+	    "Async done-%s res %x step %x\n",
+	    sp->name, res, vha->scan.step);
 
 	sp->rc = res;
 	if (res) {
@@ -3547,8 +3547,7 @@
 		 * sp for GNNFT_DONE work. This will allow all
 		 * the resource to get freed up.
 		 */
-		rc = qla2x00_post_gnnft_gpnft_done_work(vha, sp,
-		    QLA_EVT_GNNFT_DONE);
+		rc = qla2x00_post_next_scan_work(vha, sp, QLA_EVT_SCAN_FINISH);
 		if (rc) {
 			/* Cleanup here to prevent memory leak */
 			qla24xx_sp_unmap(vha, sp);
@@ -3573,28 +3572,30 @@
 
 	qla2x00_find_free_fcp_nvme_slot(vha, sp);
 
-	if ((fc4_type == FC4_TYPE_FCP_SCSI) && vha->flags.nvme_enabled &&
-	    cmd == GNN_FT_CMD) {
-		spin_lock_irqsave(&vha->work_lock, flags);
-		vha->scan.scan_flags &= ~SF_SCANNING;
-		spin_unlock_irqrestore(&vha->work_lock, flags);
+	spin_lock_irqsave(&vha->work_lock, flags);
+	vha->scan.scan_flags &= ~SF_SCANNING;
+	spin_unlock_irqrestore(&vha->work_lock, flags);
 
-		sp->rc = res;
-		rc = qla2x00_post_nvme_gpnft_work(vha, sp, QLA_EVT_GPNFT);
-		if (rc) {
-			qla24xx_sp_unmap(vha, sp);
-			set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
-			set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
-		}
-		return;
-	}
+	switch (vha->scan.step) {
+	case FAB_SCAN_GPNFT_FCP:
+	case FAB_SCAN_GPNFT_NVME:
+		rc = qla2x00_post_next_scan_work(vha, sp, QLA_EVT_SCAN_CMD);
+		break;
+	case  FAB_SCAN_GNNFT_FCP:
+		if (vha->flags.nvme_enabled)
+			rc = qla2x00_post_next_scan_work(vha, sp, QLA_EVT_SCAN_CMD);
+		else
+			rc = qla2x00_post_next_scan_work(vha, sp, QLA_EVT_SCAN_FINISH);
 
-	if (cmd == GPN_FT_CMD) {
-		rc = qla2x00_post_gnnft_gpnft_done_work(vha, sp,
-		    QLA_EVT_GPNFT_DONE);
-	} else {
-		rc = qla2x00_post_gnnft_gpnft_done_work(vha, sp,
-		    QLA_EVT_GNNFT_DONE);
+		break;
+	case  FAB_SCAN_GNNFT_NVME:
+		rc = qla2x00_post_next_scan_work(vha, sp, QLA_EVT_SCAN_FINISH);
+		break;
+	default:
+		/* should not be here */
+		WARN_ON(1);
+		rc = QLA_FUNCTION_FAILED;
+		break;
 	}
 
 	if (rc) {
@@ -3605,127 +3606,16 @@
 	}
 }
 
-/*
- * Get WWNN list for fc4_type
- *
- * It is assumed the same SRB is re-used from GPNFT to avoid
- * mem free & re-alloc
- */
-static int qla24xx_async_gnnft(scsi_qla_host_t *vha, struct srb *sp,
-    u8 fc4_type)
-{
-	int rval = QLA_FUNCTION_FAILED;
-	struct ct_sns_req *ct_req;
-	struct ct_sns_pkt *ct_sns;
-	unsigned long flags;
-
-	if (!vha->flags.online) {
-		spin_lock_irqsave(&vha->work_lock, flags);
-		vha->scan.scan_flags &= ~SF_SCANNING;
-		spin_unlock_irqrestore(&vha->work_lock, flags);
-		goto done_free_sp;
-	}
-
-	if (!sp->u.iocb_cmd.u.ctarg.req || !sp->u.iocb_cmd.u.ctarg.rsp) {
-		ql_log(ql_log_warn, vha, 0xffff,
-		    "%s: req %p rsp %p are not setup\n",
-		    __func__, sp->u.iocb_cmd.u.ctarg.req,
-		    sp->u.iocb_cmd.u.ctarg.rsp);
-		spin_lock_irqsave(&vha->work_lock, flags);
-		vha->scan.scan_flags &= ~SF_SCANNING;
-		spin_unlock_irqrestore(&vha->work_lock, flags);
-		WARN_ON(1);
-		set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
-		set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
-		goto done_free_sp;
-	}
-
-	ql_dbg(ql_dbg_disc, vha, 0xfffff,
-	    "%s: FC4Type %x, CT-PASSTHRU %s command ctarg rsp size %d, ctarg req size %d\n",
-	    __func__, fc4_type, sp->name, sp->u.iocb_cmd.u.ctarg.rsp_size,
-	     sp->u.iocb_cmd.u.ctarg.req_size);
-
-	sp->type = SRB_CT_PTHRU_CMD;
-	sp->name = "gnnft";
-	sp->gen1 = vha->hw->base_qpair->chip_reset;
-	sp->gen2 = fc4_type;
-	qla2x00_init_async_sp(sp, qla2x00_get_async_timeout(vha) + 2,
-			      qla2x00_async_gpnft_gnnft_sp_done);
-
-	memset(sp->u.iocb_cmd.u.ctarg.rsp, 0, sp->u.iocb_cmd.u.ctarg.rsp_size);
-	memset(sp->u.iocb_cmd.u.ctarg.req, 0, sp->u.iocb_cmd.u.ctarg.req_size);
-
-	ct_sns = (struct ct_sns_pkt *)sp->u.iocb_cmd.u.ctarg.req;
-	/* CT_IU preamble  */
-	ct_req = qla2x00_prep_ct_req(ct_sns, GNN_FT_CMD,
-	    sp->u.iocb_cmd.u.ctarg.rsp_size);
-
-	/* GPN_FT req */
-	ct_req->req.gpn_ft.port_type = fc4_type;
-
-	sp->u.iocb_cmd.u.ctarg.req_size = GNN_FT_REQ_SIZE;
-	sp->u.iocb_cmd.u.ctarg.nport_handle = NPH_SNS;
-
-	ql_dbg(ql_dbg_disc, vha, 0xffff,
-	    "Async-%s hdl=%x FC4Type %x.\n", sp->name,
-	    sp->handle, ct_req->req.gpn_ft.port_type);
-
-	rval = qla2x00_start_sp(sp);
-	if (rval != QLA_SUCCESS) {
-		goto done_free_sp;
-	}
-
-	return rval;
-
-done_free_sp:
-	if (sp->u.iocb_cmd.u.ctarg.req) {
-		dma_free_coherent(&vha->hw->pdev->dev,
-		    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
-		    sp->u.iocb_cmd.u.ctarg.req,
-		    sp->u.iocb_cmd.u.ctarg.req_dma);
-		sp->u.iocb_cmd.u.ctarg.req = NULL;
-	}
-	if (sp->u.iocb_cmd.u.ctarg.rsp) {
-		dma_free_coherent(&vha->hw->pdev->dev,
-		    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
-		    sp->u.iocb_cmd.u.ctarg.rsp,
-		    sp->u.iocb_cmd.u.ctarg.rsp_dma);
-		sp->u.iocb_cmd.u.ctarg.rsp = NULL;
-	}
-	/* ref: INIT */
-	kref_put(&sp->cmd_kref, qla2x00_sp_release);
-
-	spin_lock_irqsave(&vha->work_lock, flags);
-	vha->scan.scan_flags &= ~SF_SCANNING;
-	if (vha->scan.scan_flags == 0) {
-		ql_dbg(ql_dbg_disc, vha, 0xffff,
-		    "%s: schedule\n", __func__);
-		vha->scan.scan_flags |= SF_QUEUED;
-		schedule_delayed_work(&vha->scan.scan_work, 5);
-	}
-	spin_unlock_irqrestore(&vha->work_lock, flags);
-
-
-	return rval;
-} /* GNNFT */
-
-void qla24xx_async_gpnft_done(scsi_qla_host_t *vha, srb_t *sp)
-{
-	ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0xffff,
-	    "%s enter\n", __func__);
-	qla24xx_async_gnnft(vha, sp, sp->gen2);
-}
-
 /* Get WWPN list for certain fc4_type */
-int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
+int qla_fab_async_scan(scsi_qla_host_t *vha, srb_t *sp)
 {
 	int rval = QLA_FUNCTION_FAILED;
 	struct ct_sns_req       *ct_req;
 	struct ct_sns_pkt *ct_sns;
-	u32 rspsz;
+	u32 rspsz = 0;
 	unsigned long flags;
 
-	ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0xffff,
+	ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x200c,
 	    "%s enter\n", __func__);
 
 	if (!vha->flags.online)
@@ -3734,22 +3624,21 @@
 	spin_lock_irqsave(&vha->work_lock, flags);
 	if (vha->scan.scan_flags & SF_SCANNING) {
 		spin_unlock_irqrestore(&vha->work_lock, flags);
-		ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0xffff,
+		ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x2012,
 		    "%s: scan active\n", __func__);
 		return rval;
 	}
 	vha->scan.scan_flags |= SF_SCANNING;
+	if (!sp)
+		vha->scan.step = FAB_SCAN_START;
+
 	spin_unlock_irqrestore(&vha->work_lock, flags);
 
-	if (fc4_type == FC4_TYPE_FCP_SCSI) {
-		ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0xffff,
+	switch (vha->scan.step) {
+	case FAB_SCAN_START:
+		ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x2018,
 		    "%s: Performing FCP Scan\n", __func__);
 
-		if (sp) {
-			/* ref: INIT */
-			kref_put(&sp->cmd_kref, qla2x00_sp_release);
-		}
-
 		/* ref: INIT */
 		sp = qla2x00_get_sp(vha, NULL, GFP_KERNEL);
 		if (!sp) {
@@ -3765,7 +3654,7 @@
 								GFP_KERNEL);
 		sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
 		if (!sp->u.iocb_cmd.u.ctarg.req) {
-			ql_log(ql_log_warn, vha, 0xffff,
+			ql_log(ql_log_warn, vha, 0x201a,
 			    "Failed to allocate ct_sns request.\n");
 			spin_lock_irqsave(&vha->work_lock, flags);
 			vha->scan.scan_flags &= ~SF_SCANNING;
@@ -3773,7 +3662,6 @@
 			qla2x00_rel_sp(sp);
 			return rval;
 		}
-		sp->u.iocb_cmd.u.ctarg.req_size = GPN_FT_REQ_SIZE;
 
 		rspsz = sizeof(struct ct_sns_gpnft_rsp) +
 			vha->hw->max_fibre_devices *
@@ -3785,7 +3673,7 @@
 								GFP_KERNEL);
 		sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = rspsz;
 		if (!sp->u.iocb_cmd.u.ctarg.rsp) {
-			ql_log(ql_log_warn, vha, 0xffff,
+			ql_log(ql_log_warn, vha, 0x201b,
 			    "Failed to allocate ct_sns request.\n");
 			spin_lock_irqsave(&vha->work_lock, flags);
 			vha->scan.scan_flags &= ~SF_SCANNING;
@@ -3805,35 +3693,95 @@
 		    "%s scan list size %d\n", __func__, vha->scan.size);
 
 		memset(vha->scan.l, 0, vha->scan.size);
-	} else if (!sp) {
-		ql_dbg(ql_dbg_disc, vha, 0xffff,
-		    "NVME scan did not provide SP\n");
+
+		vha->scan.step = FAB_SCAN_GPNFT_FCP;
+		break;
+	case FAB_SCAN_GPNFT_FCP:
+		vha->scan.step = FAB_SCAN_GNNFT_FCP;
+		break;
+	case FAB_SCAN_GNNFT_FCP:
+		vha->scan.step = FAB_SCAN_GPNFT_NVME;
+		break;
+	case FAB_SCAN_GPNFT_NVME:
+		vha->scan.step = FAB_SCAN_GNNFT_NVME;
+		break;
+	case FAB_SCAN_GNNFT_NVME:
+	default:
+		/* should not be here */
+		WARN_ON(1);
+		goto done_free_sp;
+	}
+
+	if (!sp) {
+		ql_dbg(ql_dbg_disc, vha, 0x201c,
+		    "scan did not provide SP\n");
 		return rval;
 	}
+	if (!sp->u.iocb_cmd.u.ctarg.req || !sp->u.iocb_cmd.u.ctarg.rsp) {
+		ql_log(ql_log_warn, vha, 0x201d,
+		    "%s: req %p rsp %p are not setup\n",
+		    __func__, sp->u.iocb_cmd.u.ctarg.req,
+		    sp->u.iocb_cmd.u.ctarg.rsp);
+		spin_lock_irqsave(&vha->work_lock, flags);
+		vha->scan.scan_flags &= ~SF_SCANNING;
+		spin_unlock_irqrestore(&vha->work_lock, flags);
+		WARN_ON(1);
+		set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+		set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+		goto done_free_sp;
+	}
+
+	rspsz = sp->u.iocb_cmd.u.ctarg.rsp_size;
+	memset(sp->u.iocb_cmd.u.ctarg.req, 0, sp->u.iocb_cmd.u.ctarg.req_size);
+	memset(sp->u.iocb_cmd.u.ctarg.rsp, 0, sp->u.iocb_cmd.u.ctarg.rsp_size);
+
 
 	sp->type = SRB_CT_PTHRU_CMD;
-	sp->name = "gpnft";
 	sp->gen1 = vha->hw->base_qpair->chip_reset;
-	sp->gen2 = fc4_type;
 	qla2x00_init_async_sp(sp, qla2x00_get_async_timeout(vha) + 2,
-			      qla2x00_async_gpnft_gnnft_sp_done);
-
-	rspsz = sp->u.iocb_cmd.u.ctarg.rsp_size;
-	memset(sp->u.iocb_cmd.u.ctarg.rsp, 0, sp->u.iocb_cmd.u.ctarg.rsp_size);
-	memset(sp->u.iocb_cmd.u.ctarg.req, 0, sp->u.iocb_cmd.u.ctarg.req_size);
+			      qla_async_scan_sp_done);
 
 	ct_sns = (struct ct_sns_pkt *)sp->u.iocb_cmd.u.ctarg.req;
-	/* CT_IU preamble  */
-	ct_req = qla2x00_prep_ct_req(ct_sns, GPN_FT_CMD, rspsz);
 
-	/* GPN_FT req */
-	ct_req->req.gpn_ft.port_type = fc4_type;
+	/* CT_IU preamble  */
+	switch (vha->scan.step) {
+	case FAB_SCAN_GPNFT_FCP:
+		sp->name = "gpnft";
+		ct_req = qla2x00_prep_ct_req(ct_sns, GPN_FT_CMD, rspsz);
+		ct_req->req.gpn_ft.port_type = FC4_TYPE_FCP_SCSI;
+		sp->u.iocb_cmd.u.ctarg.req_size = GPN_FT_REQ_SIZE;
+		break;
+	case FAB_SCAN_GNNFT_FCP:
+		sp->name = "gnnft";
+		ct_req = qla2x00_prep_ct_req(ct_sns, GNN_FT_CMD, rspsz);
+		ct_req->req.gpn_ft.port_type = FC4_TYPE_FCP_SCSI;
+		sp->u.iocb_cmd.u.ctarg.req_size = GNN_FT_REQ_SIZE;
+		break;
+	case FAB_SCAN_GPNFT_NVME:
+		sp->name = "gpnft";
+		ct_req = qla2x00_prep_ct_req(ct_sns, GPN_FT_CMD, rspsz);
+		ct_req->req.gpn_ft.port_type = FC4_TYPE_NVME;
+		sp->u.iocb_cmd.u.ctarg.req_size = GPN_FT_REQ_SIZE;
+		break;
+	case FAB_SCAN_GNNFT_NVME:
+		sp->name = "gnnft";
+		ct_req = qla2x00_prep_ct_req(ct_sns, GNN_FT_CMD, rspsz);
+		ct_req->req.gpn_ft.port_type = FC4_TYPE_NVME;
+		sp->u.iocb_cmd.u.ctarg.req_size = GNN_FT_REQ_SIZE;
+		break;
+	default:
+		/* should not be here */
+		WARN_ON(1);
+		goto done_free_sp;
+	}
 
 	sp->u.iocb_cmd.u.ctarg.nport_handle = NPH_SNS;
 
-	ql_dbg(ql_dbg_disc, vha, 0xffff,
-	    "Async-%s hdl=%x FC4Type %x.\n", sp->name,
-	    sp->handle, ct_req->req.gpn_ft.port_type);
+	ql_dbg(ql_dbg_disc, vha, 0x2003,
+	       "%s: step %d, rsp size %d, req size %d hdl %x %s FC4TYPE %x \n",
+	       __func__, vha->scan.step, sp->u.iocb_cmd.u.ctarg.rsp_size,
+	       sp->u.iocb_cmd.u.ctarg.req_size, sp->handle, sp->name,
+	       ct_req->req.gpn_ft.port_type);
 
 	rval = qla2x00_start_sp(sp);
 	if (rval != QLA_SUCCESS) {
@@ -3864,7 +3812,7 @@
 	spin_lock_irqsave(&vha->work_lock, flags);
 	vha->scan.scan_flags &= ~SF_SCANNING;
 	if (vha->scan.scan_flags == 0) {
-		ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0xffff,
+		ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x2007,
 		    "%s: Scan scheduled.\n", __func__);
 		vha->scan.scan_flags |= SF_QUEUED;
 		schedule_delayed_work(&vha->scan.scan_work, 5);
@@ -3875,6 +3823,15 @@
 	return rval;
 }
 
+void qla_fab_scan_start(struct scsi_qla_host *vha)
+{
+	int rval;
+
+	rval = qla_fab_async_scan(vha, NULL);
+	if (rval)
+		set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+}
+
 void qla_scan_work_fn(struct work_struct *work)
 {
 	struct fab_scan *s = container_of(to_delayed_work(work),
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_init.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_init.c
@@ -1193,8 +1193,12 @@
 	return rval;
 
 done_free_sp:
-	/* ref: INIT */
-	kref_put(&sp->cmd_kref, qla2x00_sp_release);
+	/*
+	 * use qla24xx_async_gnl_sp_done to purge all pending gnl request.
+	 * kref_put is call behind the scene.
+	 */
+	sp->u.iocb_cmd.u.mbx.in_mb[0] = MBS_COMMAND_ERROR;
+	qla24xx_async_gnl_sp_done(sp, QLA_COMMAND_ERROR);
 	fcport->flags &= ~(FCF_ASYNC_SENT);
 done:
 	fcport->flags &= ~(FCF_ASYNC_ACTIVE);
@@ -1838,10 +1842,18 @@
 	return qla2x00_post_work(vha, e);
 }
 
+static void qla_rscn_gen_tick(scsi_qla_host_t *vha, u32 *ret_rscn_gen)
+{
+	*ret_rscn_gen = atomic_inc_return(&vha->rscn_gen);
+	/* memory barrier */
+	wmb();
+}
+
 void qla2x00_handle_rscn(scsi_qla_host_t *vha, struct event_arg *ea)
 {
 	fc_port_t *fcport;
 	unsigned long flags;
+	u32 rscn_gen;
 
 	switch (ea->id.b.rsvd_1) {
 	case RSCN_PORT_ADDR:
@@ -1871,15 +1883,16 @@
 					 * Otherwise we're already in the middle of a relogin
 					 */
 					fcport->scan_needed = 1;
-					fcport->rscn_gen++;
+					qla_rscn_gen_tick(vha, &fcport->rscn_gen);
 				}
 			} else {
 				fcport->scan_needed = 1;
-				fcport->rscn_gen++;
+				qla_rscn_gen_tick(vha, &fcport->rscn_gen);
 			}
 		}
 		break;
 	case RSCN_AREA_ADDR:
+		qla_rscn_gen_tick(vha, &rscn_gen);
 		list_for_each_entry(fcport, &vha->vp_fcports, list) {
 			if (fcport->flags & FCF_FCP2_DEVICE &&
 			    atomic_read(&fcport->state) == FCS_ONLINE)
@@ -1887,11 +1900,12 @@
 
 			if ((ea->id.b24 & 0xffff00) == (fcport->d_id.b24 & 0xffff00)) {
 				fcport->scan_needed = 1;
-				fcport->rscn_gen++;
+				fcport->rscn_gen = rscn_gen;
 			}
 		}
 		break;
 	case RSCN_DOM_ADDR:
+		qla_rscn_gen_tick(vha, &rscn_gen);
 		list_for_each_entry(fcport, &vha->vp_fcports, list) {
 			if (fcport->flags & FCF_FCP2_DEVICE &&
 			    atomic_read(&fcport->state) == FCS_ONLINE)
@@ -1899,19 +1913,20 @@
 
 			if ((ea->id.b24 & 0xff0000) == (fcport->d_id.b24 & 0xff0000)) {
 				fcport->scan_needed = 1;
-				fcport->rscn_gen++;
+				fcport->rscn_gen = rscn_gen;
 			}
 		}
 		break;
 	case RSCN_FAB_ADDR:
 	default:
+		qla_rscn_gen_tick(vha, &rscn_gen);
 		list_for_each_entry(fcport, &vha->vp_fcports, list) {
 			if (fcport->flags & FCF_FCP2_DEVICE &&
 			    atomic_read(&fcport->state) == FCS_ONLINE)
 				continue;
 
 			fcport->scan_needed = 1;
-			fcport->rscn_gen++;
+			fcport->rscn_gen = rscn_gen;
 		}
 		break;
 	}
@@ -1920,6 +1935,7 @@
 	if (vha->scan.scan_flags == 0) {
 		ql_dbg(ql_dbg_disc, vha, 0xffff, "%s: schedule\n", __func__);
 		vha->scan.scan_flags |= SF_QUEUED;
+		vha->scan.rscn_gen_start = atomic_read(&vha->rscn_gen);
 		schedule_delayed_work(&vha->scan.scan_work, 5);
 	}
 	spin_unlock_irqrestore(&vha->work_lock, flags);
@@ -2665,6 +2681,40 @@
 	return rval;
 }
 
+static void qla_enable_fce_trace(scsi_qla_host_t *vha)
+{
+	int rval;
+	struct qla_hw_data *ha = vha->hw;
+
+	if (ha->fce) {
+		ha->flags.fce_enabled = 1;
+		memset(ha->fce, 0, fce_calc_size(ha->fce_bufs));
+		rval = qla2x00_enable_fce_trace(vha,
+		    ha->fce_dma, ha->fce_bufs, ha->fce_mb, &ha->fce_bufs);
+
+		if (rval) {
+			ql_log(ql_log_warn, vha, 0x8033,
+			    "Unable to reinitialize FCE (%d).\n", rval);
+			ha->flags.fce_enabled = 0;
+		}
+	}
+}
+
+static void qla_enable_eft_trace(scsi_qla_host_t *vha)
+{
+	int rval;
+	struct qla_hw_data *ha = vha->hw;
+
+	if (ha->eft) {
+		memset(ha->eft, 0, EFT_SIZE);
+		rval = qla2x00_enable_eft_trace(vha, ha->eft_dma, EFT_NUM_BUFFERS);
+
+		if (rval) {
+			ql_log(ql_log_warn, vha, 0x8034,
+			    "Unable to reinitialize EFT (%d).\n", rval);
+		}
+	}
+}
 /*
 * qla2x00_initialize_adapter
 *      Initialize board.
@@ -3668,9 +3718,8 @@
 }
 
 static void
-qla2x00_init_fce_trace(scsi_qla_host_t *vha)
+qla2x00_alloc_fce_trace(scsi_qla_host_t *vha)
 {
-	int rval;
 	dma_addr_t tc_dma;
 	void *tc;
 	struct qla_hw_data *ha = vha->hw;
@@ -3699,27 +3748,17 @@
 		return;
 	}
 
-	rval = qla2x00_enable_fce_trace(vha, tc_dma, FCE_NUM_BUFFERS,
-					ha->fce_mb, &ha->fce_bufs);
-	if (rval) {
-		ql_log(ql_log_warn, vha, 0x00bf,
-		       "Unable to initialize FCE (%d).\n", rval);
-		dma_free_coherent(&ha->pdev->dev, FCE_SIZE, tc, tc_dma);
-		return;
-	}
-
 	ql_dbg(ql_dbg_init, vha, 0x00c0,
 	       "Allocated (%d KB) for FCE...\n", FCE_SIZE / 1024);
 
-	ha->flags.fce_enabled = 1;
 	ha->fce_dma = tc_dma;
 	ha->fce = tc;
+	ha->fce_bufs = FCE_NUM_BUFFERS;
 }
 
 static void
-qla2x00_init_eft_trace(scsi_qla_host_t *vha)
+qla2x00_alloc_eft_trace(scsi_qla_host_t *vha)
 {
-	int rval;
 	dma_addr_t tc_dma;
 	void *tc;
 	struct qla_hw_data *ha = vha->hw;
@@ -3744,14 +3783,6 @@
 		return;
 	}
 
-	rval = qla2x00_enable_eft_trace(vha, tc_dma, EFT_NUM_BUFFERS);
-	if (rval) {
-		ql_log(ql_log_warn, vha, 0x00c2,
-		       "Unable to initialize EFT (%d).\n", rval);
-		dma_free_coherent(&ha->pdev->dev, EFT_SIZE, tc, tc_dma);
-		return;
-	}
-
 	ql_dbg(ql_dbg_init, vha, 0x00c3,
 	       "Allocated (%d KB) EFT ...\n", EFT_SIZE / 1024);
 
@@ -3759,13 +3790,6 @@
 	ha->eft = tc;
 }
 
-static void
-qla2x00_alloc_offload_mem(scsi_qla_host_t *vha)
-{
-	qla2x00_init_fce_trace(vha);
-	qla2x00_init_eft_trace(vha);
-}
-
 void
 qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
 {
@@ -3820,10 +3844,10 @@
 		if (ha->tgt.atio_ring)
 			mq_size += ha->tgt.atio_q_length * sizeof(request_t);
 
-		qla2x00_init_fce_trace(vha);
+		qla2x00_alloc_fce_trace(vha);
 		if (ha->fce)
 			fce_size = sizeof(struct qla2xxx_fce_chain) + FCE_SIZE;
-		qla2x00_init_eft_trace(vha);
+		qla2x00_alloc_eft_trace(vha);
 		if (ha->eft)
 			eft_size = EFT_SIZE;
 	}
@@ -4253,7 +4277,6 @@
 	struct qla_hw_data *ha = vha->hw;
 	struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
 	unsigned long flags;
-	uint16_t fw_major_version;
 	int done_once = 0;
 
 	if (IS_P3P_TYPE(ha)) {
@@ -4320,7 +4343,6 @@
 					goto failed;
 
 enable_82xx_npiv:
-				fw_major_version = ha->fw_major_version;
 				if (IS_P3P_TYPE(ha))
 					qla82xx_check_md_needed(vha);
 				else
@@ -4349,12 +4371,11 @@
 				if (rval != QLA_SUCCESS)
 					goto failed;
 
-				if (!fw_major_version && !(IS_P3P_TYPE(ha)))
-					qla2x00_alloc_offload_mem(vha);
-
 				if (ql2xallocfwdump && !(IS_P3P_TYPE(ha)))
 					qla2x00_alloc_fw_dump(vha);
 
+				qla_enable_fce_trace(vha);
+				qla_enable_eft_trace(vha);
 			} else {
 				goto failed;
 			}
@@ -6384,10 +6405,9 @@
 		qlt_do_generation_tick(vha, &discovery_gen);
 
 		if (USE_ASYNC_SCAN(ha)) {
-			rval = qla24xx_async_gpnft(vha, FC4_TYPE_FCP_SCSI,
-			    NULL);
-			if (rval)
-				set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+			/* start of scan begins here */
+			vha->scan.rscn_gen_end = atomic_read(&vha->rscn_gen);
+			qla_fab_scan_start(vha);
 		} else  {
 			list_for_each_entry(fcport, &vha->vp_fcports, list)
 				fcport->scan_state = QLA_FCPORT_SCAN;
@@ -7487,12 +7507,12 @@
 int
 qla2x00_abort_isp(scsi_qla_host_t *vha)
 {
-	int rval;
 	uint8_t        status = 0;
 	struct qla_hw_data *ha = vha->hw;
 	struct scsi_qla_host *vp, *tvp;
 	struct req_que *req = ha->req_q_map[0];
 	unsigned long flags;
+	fc_port_t *fcport;
 
 	if (vha->flags.online) {
 		qla2x00_abort_isp_cleanup(vha);
@@ -7561,6 +7581,15 @@
 			       "ISP Abort - ISP reg disconnect post nvmram config, exiting.\n");
 			return status;
 		}
+
+		/* User may have updated [fcp|nvme] prefer in flash */
+		list_for_each_entry(fcport, &vha->vp_fcports, list) {
+			if (NVME_PRIORITY(ha, fcport))
+				fcport->do_prli_nvme = 1;
+			else
+				fcport->do_prli_nvme = 0;
+		}
+
 		if (!qla2x00_restart_isp(vha)) {
 			clear_bit(RESET_MARKER_NEEDED, &vha->dpc_flags);
 
@@ -7581,31 +7610,7 @@
 
 			if (IS_QLA81XX(ha) || IS_QLA8031(ha))
 				qla2x00_get_fw_version(vha);
-			if (ha->fce) {
-				ha->flags.fce_enabled = 1;
-				memset(ha->fce, 0,
-				    fce_calc_size(ha->fce_bufs));
-				rval = qla2x00_enable_fce_trace(vha,
-				    ha->fce_dma, ha->fce_bufs, ha->fce_mb,
-				    &ha->fce_bufs);
-				if (rval) {
-					ql_log(ql_log_warn, vha, 0x8033,
-					    "Unable to reinitialize FCE "
-					    "(%d).\n", rval);
-					ha->flags.fce_enabled = 0;
-				}
-			}
 
-			if (ha->eft) {
-				memset(ha->eft, 0, EFT_SIZE);
-				rval = qla2x00_enable_eft_trace(vha,
-				    ha->eft_dma, EFT_NUM_BUFFERS);
-				if (rval) {
-					ql_log(ql_log_warn, vha, 0x8034,
-					    "Unable to reinitialize EFT "
-					    "(%d).\n", rval);
-				}
-			}
 		} else {	/* failed the ISP abort */
 			vha->flags.online = 1;
 			if (test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
@@ -7655,6 +7660,14 @@
 				atomic_inc(&vp->vref_count);
 				spin_unlock_irqrestore(&ha->vport_slock, flags);
 
+				/* User may have updated [fcp|nvme] prefer in flash */
+				list_for_each_entry(fcport, &vp->vp_fcports, list) {
+					if (NVME_PRIORITY(ha, fcport))
+						fcport->do_prli_nvme = 1;
+					else
+						fcport->do_prli_nvme = 0;
+				}
+
 				qla2x00_vp_abort_isp(vp);
 
 				spin_lock_irqsave(&ha->vport_slock, flags);
@@ -8205,15 +8218,21 @@
 	struct qla27xx_image_status pri_aux_image_status, sec_aux_image_status;
 	bool valid_pri_image = false, valid_sec_image = false;
 	bool active_pri_image = false, active_sec_image = false;
+	int rc;
 
 	if (!ha->flt_region_aux_img_status_pri) {
 		ql_dbg(ql_dbg_init, vha, 0x018a, "Primary aux image not addressed\n");
 		goto check_sec_image;
 	}
 
-	qla24xx_read_flash_data(vha, (uint32_t *)&pri_aux_image_status,
+	rc = qla24xx_read_flash_data(vha, (uint32_t *)&pri_aux_image_status,
 	    ha->flt_region_aux_img_status_pri,
 	    sizeof(pri_aux_image_status) >> 2);
+	if (rc) {
+		ql_log(ql_log_info, vha, 0x01a1,
+		    "Unable to read Primary aux image(%x).\n", rc);
+		goto check_sec_image;
+	}
 	qla27xx_print_image(vha, "Primary aux image", &pri_aux_image_status);
 
 	if (qla28xx_check_aux_image_status_signature(&pri_aux_image_status)) {
@@ -8244,9 +8263,15 @@
 		goto check_valid_image;
 	}
 
-	qla24xx_read_flash_data(vha, (uint32_t *)&sec_aux_image_status,
+	rc = qla24xx_read_flash_data(vha, (uint32_t *)&sec_aux_image_status,
 	    ha->flt_region_aux_img_status_sec,
 	    sizeof(sec_aux_image_status) >> 2);
+	if (rc) {
+		ql_log(ql_log_info, vha, 0x01a2,
+		    "Unable to read Secondary aux image(%x).\n", rc);
+		goto check_valid_image;
+	}
+
 	qla27xx_print_image(vha, "Secondary aux image", &sec_aux_image_status);
 
 	if (qla28xx_check_aux_image_status_signature(&sec_aux_image_status)) {
@@ -8304,6 +8329,7 @@
 	struct qla27xx_image_status pri_image_status, sec_image_status;
 	bool valid_pri_image = false, valid_sec_image = false;
 	bool active_pri_image = false, active_sec_image = false;
+	int rc;
 
 	if (!ha->flt_region_img_status_pri) {
 		ql_dbg(ql_dbg_init, vha, 0x018a, "Primary image not addressed\n");
@@ -8345,8 +8371,14 @@
 		goto check_valid_image;
 	}
 
-	qla24xx_read_flash_data(vha, (uint32_t *)(&sec_image_status),
+	rc = qla24xx_read_flash_data(vha, (uint32_t *)(&sec_image_status),
 	    ha->flt_region_img_status_sec, sizeof(sec_image_status) >> 2);
+	if (rc) {
+		ql_log(ql_log_info, vha, 0x01a3,
+		    "Unable to read Secondary image status(%x).\n", rc);
+		goto check_valid_image;
+	}
+
 	qla27xx_print_image(vha, "Secondary image", &sec_image_status);
 
 	if (qla27xx_check_image_status_signature(&sec_image_status)) {
@@ -8418,11 +8450,10 @@
 	    "FW: Loading firmware from flash (%x).\n", faddr);
 
 	dcode = (uint32_t *)req->ring;
-	qla24xx_read_flash_data(vha, dcode, faddr, 8);
-	if (qla24xx_risc_firmware_invalid(dcode)) {
+	rval = qla24xx_read_flash_data(vha, dcode, faddr, 8);
+	if (rval || qla24xx_risc_firmware_invalid(dcode)) {
 		ql_log(ql_log_fatal, vha, 0x008c,
-		    "Unable to verify the integrity of flash firmware "
-		    "image.\n");
+		    "Unable to verify the integrity of flash firmware image (rval %x).\n", rval);
 		ql_log(ql_log_fatal, vha, 0x008d,
 		    "Firmware data: %08x %08x %08x %08x.\n",
 		    dcode[0], dcode[1], dcode[2], dcode[3]);
@@ -8436,7 +8467,12 @@
 	for (j = 0; j < segments; j++) {
 		ql_dbg(ql_dbg_init, vha, 0x008d,
 		    "-> Loading segment %u...\n", j);
-		qla24xx_read_flash_data(vha, dcode, faddr, 10);
+		rval = qla24xx_read_flash_data(vha, dcode, faddr, 10);
+		if (rval) {
+			ql_log(ql_log_fatal, vha, 0x016a,
+			    "-> Unable to read segment addr + size .\n");
+			return QLA_FUNCTION_FAILED;
+		}
 		risc_addr = be32_to_cpu((__force __be32)dcode[2]);
 		risc_size = be32_to_cpu((__force __be32)dcode[3]);
 		if (!*srisc_addr) {
@@ -8452,7 +8488,13 @@
 			ql_dbg(ql_dbg_init, vha, 0x008e,
 			    "-> Loading fragment %u: %#x <- %#x (%#lx dwords)...\n",
 			    fragment, risc_addr, faddr, dlen);
-			qla24xx_read_flash_data(vha, dcode, faddr, dlen);
+			rval = qla24xx_read_flash_data(vha, dcode, faddr, dlen);
+			if (rval) {
+				ql_log(ql_log_fatal, vha, 0x016b,
+				    "-> Unable to read fragment(faddr %#x dlen %#lx).\n",
+				    faddr, dlen);
+				return QLA_FUNCTION_FAILED;
+			}
 			for (i = 0; i < dlen; i++)
 				dcode[i] = swab32(dcode[i]);
 
@@ -8481,7 +8523,14 @@
 		fwdt->length = 0;
 
 		dcode = (uint32_t *)req->ring;
-		qla24xx_read_flash_data(vha, dcode, faddr, 7);
+
+		rval = qla24xx_read_flash_data(vha, dcode, faddr, 7);
+		if (rval) {
+			ql_log(ql_log_fatal, vha, 0x016c,
+			    "-> Unable to read template size.\n");
+			goto failed;
+		}
+
 		risc_size = be32_to_cpu((__force __be32)dcode[2]);
 		ql_dbg(ql_dbg_init, vha, 0x0161,
 		    "-> fwdt%u template array at %#x (%#x dwords)\n",
@@ -8507,11 +8556,12 @@
 		}
 
 		dcode = fwdt->template;
-		qla24xx_read_flash_data(vha, dcode, faddr, risc_size);
+		rval = qla24xx_read_flash_data(vha, dcode, faddr, risc_size);
 
-		if (!qla27xx_fwdt_template_valid(dcode)) {
+		if (rval || !qla27xx_fwdt_template_valid(dcode)) {
 			ql_log(ql_log_warn, vha, 0x0165,
-			    "-> fwdt%u failed template validate\n", j);
+			    "-> fwdt%u failed template validate (rval %x)\n",
+			    j, rval);
 			goto failed;
 		}
 
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_inline.h
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_inline.h
@@ -631,3 +631,11 @@
 	}
 	return 0;
 }
+
+static inline bool val_is_in_range(u32 val, u32 start, u32 end)
+{
+	if (val >= start && val <= end)
+		return true;
+	else
+		return false;
+}
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_iocb.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_iocb.c
@@ -2587,6 +2587,33 @@
 qla2x00_sp_release(struct kref *kref)
 {
 	struct srb *sp = container_of(kref, struct srb, cmd_kref);
+	struct scsi_qla_host *vha = sp->vha;
+
+	switch (sp->type) {
+	case SRB_CT_PTHRU_CMD:
+		/* GPSC & GFPNID use fcport->ct_desc.ct_sns for both req & rsp */
+		if (sp->u.iocb_cmd.u.ctarg.req &&
+			(!sp->fcport ||
+			 sp->u.iocb_cmd.u.ctarg.req != sp->fcport->ct_desc.ct_sns)) {
+			dma_free_coherent(&vha->hw->pdev->dev,
+			    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+			    sp->u.iocb_cmd.u.ctarg.req,
+			    sp->u.iocb_cmd.u.ctarg.req_dma);
+			sp->u.iocb_cmd.u.ctarg.req = NULL;
+		}
+		if (sp->u.iocb_cmd.u.ctarg.rsp &&
+			(!sp->fcport ||
+			 sp->u.iocb_cmd.u.ctarg.rsp != sp->fcport->ct_desc.ct_sns)) {
+			dma_free_coherent(&vha->hw->pdev->dev,
+			    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+			    sp->u.iocb_cmd.u.ctarg.rsp,
+			    sp->u.iocb_cmd.u.ctarg.rsp_dma);
+			sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+		}
+		break;
+	default:
+		break;
+	}
 
 	sp->free(sp);
 }
@@ -2610,7 +2637,8 @@
 {
 	struct srb_iocb *elsio = &sp->u.iocb_cmd;
 
-	kfree(sp->fcport);
+	if (sp->fcport)
+		qla2x00_free_fcport(sp->fcport);
 
 	if (elsio->u.els_logo.els_logo_pyld)
 		dma_free_coherent(&sp->vha->hw->pdev->dev, DMA_POOL_SIZE,
@@ -2692,7 +2720,7 @@
 	 */
 	sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
 	if (!sp) {
-		kfree(fcport);
+		qla2x00_free_fcport(fcport);
 		ql_log(ql_log_info, vha, 0x70e6,
 		 "SRB allocation failed\n");
 		return -ENOMEM;
@@ -2723,6 +2751,7 @@
 	if (!elsio->u.els_logo.els_logo_pyld) {
 		/* ref: INIT */
 		kref_put(&sp->cmd_kref, qla2x00_sp_release);
+		qla2x00_free_fcport(fcport);
 		return QLA_FUNCTION_FAILED;
 	}
 
@@ -2747,6 +2776,7 @@
 	if (rval != QLA_SUCCESS) {
 		/* ref: INIT */
 		kref_put(&sp->cmd_kref, qla2x00_sp_release);
+		qla2x00_free_fcport(fcport);
 		return QLA_FUNCTION_FAILED;
 	}
 
@@ -3012,7 +3042,7 @@
 
 int
 qla24xx_els_dcmd2_iocb(scsi_qla_host_t *vha, int els_opcode,
-    fc_port_t *fcport, bool wait)
+			fc_port_t *fcport)
 {
 	srb_t *sp;
 	struct srb_iocb *elsio = NULL;
@@ -3027,8 +3057,7 @@
 	if (!sp) {
 		ql_log(ql_log_info, vha, 0x70e6,
 		 "SRB allocation failed\n");
-		fcport->flags &= ~FCF_ASYNC_ACTIVE;
-		return -ENOMEM;
+		goto done;
 	}
 
 	fcport->flags |= FCF_ASYNC_SENT;
@@ -3037,9 +3066,6 @@
 	ql_dbg(ql_dbg_io, vha, 0x3073,
 	       "%s Enter: PLOGI portid=%06x\n", __func__, fcport->d_id.b24);
 
-	if (wait)
-		sp->flags = SRB_WAKEUP_ON_COMP;
-
 	sp->type = SRB_ELS_DCMD;
 	sp->name = "ELS_DCMD";
 	sp->fcport = fcport;
@@ -3055,7 +3081,7 @@
 
 	if (!elsio->u.els_plogi.els_plogi_pyld) {
 		rval = QLA_FUNCTION_FAILED;
-		goto out;
+		goto done_free_sp;
 	}
 
 	resp_ptr = elsio->u.els_plogi.els_resp_pyld =
@@ -3064,7 +3090,7 @@
 
 	if (!elsio->u.els_plogi.els_resp_pyld) {
 		rval = QLA_FUNCTION_FAILED;
-		goto out;
+		goto done_free_sp;
 	}
 
 	ql_dbg(ql_dbg_io, vha, 0x3073, "PLOGI %p %p\n", ptr, resp_ptr);
@@ -3080,7 +3106,6 @@
 
 	if (els_opcode == ELS_DCMD_PLOGI && DBELL_ACTIVE(vha)) {
 		struct fc_els_flogi *p = ptr;
-
 		p->fl_csp.sp_features |= cpu_to_be16(FC_SP_FT_SEC);
 	}
 
@@ -3089,10 +3114,11 @@
 	    (uint8_t *)elsio->u.els_plogi.els_plogi_pyld,
 	    sizeof(*elsio->u.els_plogi.els_plogi_pyld));
 
-	init_completion(&elsio->u.els_plogi.comp);
 	rval = qla2x00_start_sp(sp);
 	if (rval != QLA_SUCCESS) {
-		rval = QLA_FUNCTION_FAILED;
+		fcport->flags |= FCF_LOGIN_NEEDED;
+		set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+		goto done_free_sp;
 	} else {
 		ql_dbg(ql_dbg_disc, vha, 0x3074,
 		    "%s PLOGI sent, hdl=%x, loopid=%x, to port_id %06x from port_id %06x\n",
@@ -3100,21 +3126,15 @@
 		    fcport->d_id.b24, vha->d_id.b24);
 	}
 
-	if (wait) {
-		wait_for_completion(&elsio->u.els_plogi.comp);
-
-		if (elsio->u.els_plogi.comp_status != CS_COMPLETE)
-			rval = QLA_FUNCTION_FAILED;
-	} else {
-		goto done;
-	}
+	return rval;
 
-out:
-	fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+done_free_sp:
 	qla2x00_els_dcmd2_free(vha, &elsio->u.els_plogi);
 	/* ref: INIT */
 	kref_put(&sp->cmd_kref, qla2x00_sp_release);
 done:
+	fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+	qla2x00_set_fcport_disc_state(fcport, DSC_DELETED);
 	return rval;
 }
 
@@ -3918,7 +3938,7 @@
 		return -EAGAIN;
 	}
 
-	pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
+	pkt = qla2x00_alloc_iocbs_ready(sp->qpair, sp);
 	if (!pkt) {
 		rval = -EAGAIN;
 		ql_log(ql_log_warn, vha, 0x700c,
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_mbx.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_mbx.c
@@ -194,7 +194,7 @@
 	if (ha->flags.purge_mbox || chip_reset != ha->chip_reset ||
 	    ha->flags.eeh_busy) {
 		ql_log(ql_log_warn, vha, 0xd035,
-		       "Error detected: purge[%d] eeh[%d] cmd=0x%x, Exiting.\n",
+		       "Purge mbox: purge[%d] eeh[%d] cmd=0x%x, Exiting.\n",
 		       ha->flags.purge_mbox, ha->flags.eeh_busy, mcp->mb[0]);
 		rval = QLA_ABORTED;
 		goto premature_exit;
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_mid.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_mid.c
@@ -180,7 +180,7 @@
 	atomic_set(&vha->loop_state, LOOP_DOWN);
 	atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME);
 	list_for_each_entry(fcport, &vha->vp_fcports, list)
-		fcport->logout_on_delete = 0;
+		fcport->logout_on_delete = 1;
 
 	if (!vha->hw->flags.edif_enabled)
 		qla2x00_wait_for_sess_deletion(vha);
@@ -506,6 +506,7 @@
 		return(NULL);
 	}
 
+	vha->irq_offset = QLA_BASE_VECTORS;
 	host = vha->host;
 	fc_vport->dd_data = vha;
 	/* New host info */
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_nvme.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_nvme.c
@@ -49,7 +49,10 @@
 		return 0;
 	}
 
-	if (!vha->nvme_local_port && qla_nvme_register_hba(vha))
+	if (qla_nvme_register_hba(vha))
+		return 0;
+
+	if (!vha->nvme_local_port)
 		return 0;
 
 	if (!(fcport->nvme_prli_service_param &
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_os.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_os.c
@@ -1875,14 +1875,9 @@
 	for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
 		sp = req->outstanding_cmds[cnt];
 		if (sp) {
-			/*
-			 * perform lockless completion during driver unload
-			 */
 			if (qla2x00_chip_is_down(vha)) {
 				req->outstanding_cmds[cnt] = NULL;
-				spin_unlock_irqrestore(qp->qp_lock_ptr, flags);
 				sp->done(sp, res);
-				spin_lock_irqsave(qp->qp_lock_ptr, flags);
 				continue;
 			}
 
@@ -4602,6 +4597,7 @@
 	ha->init_cb_dma = 0;
 fail_free_vp_map:
 	kfree(ha->vp_map);
+	ha->vp_map = NULL;
 fail:
 	ql_log(ql_log_fatal, NULL, 0x0030,
 	    "Memory allocation failure.\n");
@@ -4688,7 +4684,7 @@
 qla2x00_number_of_exch(scsi_qla_host_t *vha, u32 *ret_cnt, u16 max_cnt)
 {
 	u32 temp;
-	struct init_cb_81xx *icb = (struct init_cb_81xx *)&vha->hw->init_cb;
+	struct init_cb_81xx *icb = (struct init_cb_81xx *)vha->hw->init_cb;
 	*ret_cnt = FW_DEF_EXCHANGES_CNT;
 
 	if (max_cnt > vha->hw->max_exchg)
@@ -5562,15 +5558,11 @@
 			qla2x00_async_prlo_done(vha, e->u.logio.fcport,
 			    e->u.logio.data);
 			break;
-		case QLA_EVT_GPNFT:
-			qla24xx_async_gpnft(vha, e->u.gpnft.fc4_type,
-			    e->u.gpnft.sp);
-			break;
-		case QLA_EVT_GPNFT_DONE:
-			qla24xx_async_gpnft_done(vha, e->u.iosb.sp);
+		case QLA_EVT_SCAN_CMD:
+			qla_fab_async_scan(vha, e->u.iosb.sp);
 			break;
-		case QLA_EVT_GNNFT_DONE:
-			qla24xx_async_gnnft_done(vha, e->u.iosb.sp);
+		case QLA_EVT_SCAN_FINISH:
+			qla_fab_scan_finish(vha, e->u.iosb.sp);
 			break;
 		case QLA_EVT_GFPNID:
 			qla24xx_async_gfpnid(vha, e->u.fcport.fcport);
@@ -5583,7 +5575,7 @@
 			break;
 		case QLA_EVT_ELS_PLOGI:
 			qla24xx_els_dcmd2_iocb(vha, ELS_DCMD_PLOGI,
-			    e->u.fcport.fcport, false);
+			    e->u.fcport.fcport);
 			break;
 		case QLA_EVT_SA_REPLACE:
 			rc = qla24xx_issue_sa_replace_iocb(vha, e);
@@ -6908,12 +6900,15 @@
 	set_user_nice(current, MIN_NICE);
 
 	set_current_state(TASK_INTERRUPTIBLE);
-	while (!kthread_should_stop()) {
+	while (1) {
 		ql_dbg(ql_dbg_dpc, base_vha, 0x4000,
 		    "DPC handler sleeping.\n");
 
 		schedule();
 
+		if (kthread_should_stop())
+			break;
+
 		if (test_and_clear_bit(DO_EEH_RECOVERY, &base_vha->dpc_flags))
 			qla_pci_set_eeh_busy(base_vha);
 
@@ -6926,15 +6921,16 @@
 			goto end_loop;
 		}
 
+		if (test_bit(UNLOADING, &base_vha->dpc_flags))
+			/* don't do any work. Wait to be terminated by kthread_stop */
+			goto end_loop;
+
 		ha->dpc_active = 1;
 
 		ql_dbg(ql_dbg_dpc + ql_dbg_verbose, base_vha, 0x4001,
 		    "DPC handler waking up, dpc_flags=0x%lx.\n",
 		    base_vha->dpc_flags);
 
-		if (test_bit(UNLOADING, &base_vha->dpc_flags))
-			break;
-
 		if (IS_P3P_TYPE(ha)) {
 			if (IS_QLA8044(ha)) {
 				if (test_and_clear_bit(ISP_UNRECOVERABLE,
@@ -7247,9 +7243,6 @@
 	 */
 	ha->dpc_active = 0;
 
-	/* Cleanup any residual CTX SRBs. */
-	qla2x00_abort_all_cmds(base_vha, DID_NO_CONNECT << 16);
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_sup.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_sup.c
@@ -555,6 +555,7 @@
 	struct qla_flt_location *fltl = (void *)req->ring;
 	uint32_t *dcode = (uint32_t *)req->ring;
 	uint8_t *buf = (void *)req->ring, *bcode,  last_image;
+	int rc;
 
 	/*
 	 * FLT-location structure resides after the last PCI region.
@@ -584,14 +585,24 @@
 	pcihdr = 0;
 	do {
 		/* Verify PCI expansion ROM header. */
-		qla24xx_read_flash_data(vha, dcode, pcihdr >> 2, 0x20);
+		rc = qla24xx_read_flash_data(vha, dcode, pcihdr >> 2, 0x20);
+		if (rc) {
+			ql_log(ql_log_info, vha, 0x016d,
+			    "Unable to read PCI Expansion Rom Header (%x).\n", rc);
+			return QLA_FUNCTION_FAILED;
+		}
 		bcode = buf + (pcihdr % 4);
 		if (bcode[0x0] != 0x55 || bcode[0x1] != 0xaa)
 			goto end;
 
 		/* Locate PCI data structure. */
 		pcids = pcihdr + ((bcode[0x19] << 8) | bcode[0x18]);
-		qla24xx_read_flash_data(vha, dcode, pcids >> 2, 0x20);
+		rc = qla24xx_read_flash_data(vha, dcode, pcids >> 2, 0x20);
+		if (rc) {
+			ql_log(ql_log_info, vha, 0x0179,
+			    "Unable to read PCI Data Structure (%x).\n", rc);
+			return QLA_FUNCTION_FAILED;
+		}
 		bcode = buf + (pcihdr % 4);
 
 		/* Validate signature of PCI data structure. */
@@ -606,7 +617,12 @@
 	} while (!last_image);
 
 	/* Now verify FLT-location structure. */
-	qla24xx_read_flash_data(vha, dcode, pcihdr >> 2, sizeof(*fltl) >> 2);
+	rc = qla24xx_read_flash_data(vha, dcode, pcihdr >> 2, sizeof(*fltl) >> 2);
+	if (rc) {
+		ql_log(ql_log_info, vha, 0x017a,
+		    "Unable to read FLT (%x).\n", rc);
+		return QLA_FUNCTION_FAILED;
+	}
 	if (memcmp(fltl->sig, "QFLT", 4))
 		goto end;
 
@@ -2605,13 +2621,18 @@
     uint32_t offset, uint32_t length)
 {
 	struct qla_hw_data *ha = vha->hw;
+	int rc;
 
 	/* Suspend HBA. */
 	scsi_block_requests(vha->host);
 	set_bit(MBX_UPDATE_FLASH_ACTIVE, &ha->mbx_cmd_flags);
 
 	/* Go with read. */
-	qla24xx_read_flash_data(vha, buf, offset >> 2, length >> 2);
+	rc = qla24xx_read_flash_data(vha, buf, offset >> 2, length >> 2);
+	if (rc) {
+		ql_log(ql_log_info, vha, 0x01a0,
+		    "Unable to perform optrom read(%x).\n", rc);
+	}
 
 	/* Resume HBA. */
 	clear_bit(MBX_UPDATE_FLASH_ACTIVE, &ha->mbx_cmd_flags);
@@ -3412,7 +3433,7 @@
 	struct active_regions active_regions = { };
 
 	if (IS_P3P_TYPE(ha))
-		return ret;
+		return QLA_SUCCESS;
 
 	if (!mbuf)
 		return QLA_FUNCTION_FAILED;
@@ -3432,20 +3453,31 @@
 
 	do {
 		/* Verify PCI expansion ROM header. */
-		qla24xx_read_flash_data(vha, dcode, pcihdr >> 2, 0x20);
+		ret = qla24xx_read_flash_data(vha, dcode, pcihdr >> 2, 0x20);
+		if (ret) {
+			ql_log(ql_log_info, vha, 0x017d,
+			    "Unable to read PCI EXP Rom Header(%x).\n", ret);
+			return QLA_FUNCTION_FAILED;
+		}
+
 		bcode = mbuf + (pcihdr % 4);
 		if (memcmp(bcode, "\x55\xaa", 2)) {
 			/* No signature */
 			ql_log(ql_log_fatal, vha, 0x0059,
 			    "No matching ROM signature.\n");
-			ret = QLA_FUNCTION_FAILED;
-			break;
+			return QLA_FUNCTION_FAILED;
 		}
 
 		/* Locate PCI data structure. */
 		pcids = pcihdr + ((bcode[0x19] << 8) | bcode[0x18]);
 
-		qla24xx_read_flash_data(vha, dcode, pcids >> 2, 0x20);
+		ret = qla24xx_read_flash_data(vha, dcode, pcids >> 2, 0x20);
+		if (ret) {
+			ql_log(ql_log_info, vha, 0x018e,
+			    "Unable to read PCI Data Structure (%x).\n", ret);
+			return QLA_FUNCTION_FAILED;
+		}
+
 		bcode = mbuf + (pcihdr % 4);
 
 		/* Validate signature of PCI data structure. */
@@ -3454,8 +3486,7 @@
 			ql_log(ql_log_fatal, vha, 0x005a,
 			    "PCI data struct not found pcir_adr=%x.\n", pcids);
 			ql_dump_buffer(ql_dbg_init, vha, 0x0059, dcode, 32);
-			ret = QLA_FUNCTION_FAILED;
-			break;
+			return QLA_FUNCTION_FAILED;
 		}
 
 		/* Read version */
@@ -3507,20 +3538,26 @@
 			faddr = ha->flt_region_fw_sec;
 	}
 
-	qla24xx_read_flash_data(vha, dcode, faddr, 8);
-	if (qla24xx_risc_firmware_invalid(dcode)) {
-		ql_log(ql_log_warn, vha, 0x005f,
-		    "Unrecognized fw revision at %x.\n",
-		    ha->flt_region_fw * 4);
-		ql_dump_buffer(ql_dbg_init, vha, 0x005f, dcode, 32);
+	ret = qla24xx_read_flash_data(vha, dcode, faddr, 8);
+	if (ret) {
+		ql_log(ql_log_info, vha, 0x019e,
+		    "Unable to read FW version (%x).\n", ret);
+		return ret;
 	} else {
-		for (i = 0; i < 4; i++)
-			ha->fw_revision[i] =
+		if (qla24xx_risc_firmware_invalid(dcode)) {
+			ql_log(ql_log_warn, vha, 0x005f,
+			    "Unrecognized fw revision at %x.\n",
+			    ha->flt_region_fw * 4);
+			ql_dump_buffer(ql_dbg_init, vha, 0x005f, dcode, 32);
+		} else {
+			for (i = 0; i < 4; i++)
+				ha->fw_revision[i] =
 				be32_to_cpu((__force __be32)dcode[4+i]);
-		ql_dbg(ql_dbg_init, vha, 0x0060,
-		    "Firmware revision (flash) %u.%u.%u (%x).\n",
-		    ha->fw_revision[0], ha->fw_revision[1],
-		    ha->fw_revision[2], ha->fw_revision[3]);
+			ql_dbg(ql_dbg_init, vha, 0x0060,
+			    "Firmware revision (flash) %u.%u.%u (%x).\n",
+			    ha->fw_revision[0], ha->fw_revision[1],
+			    ha->fw_revision[2], ha->fw_revision[3]);
+		}
 	}
 
 	/* Check for golden firmware and get version if available */
@@ -3531,18 +3568,23 @@
 
 	memset(ha->gold_fw_version, 0, sizeof(ha->gold_fw_version));
 	faddr = ha->flt_region_gold_fw;
-	qla24xx_read_flash_data(vha, dcode, ha->flt_region_gold_fw, 8);
-	if (qla24xx_risc_firmware_invalid(dcode)) {
-		ql_log(ql_log_warn, vha, 0x0056,
-		    "Unrecognized golden fw at %#x.\n", faddr);
-		ql_dump_buffer(ql_dbg_init, vha, 0x0056, dcode, 32);
+	ret = qla24xx_read_flash_data(vha, dcode, ha->flt_region_gold_fw, 8);
+	if (ret) {
+		ql_log(ql_log_info, vha, 0x019f,
+		    "Unable to read Gold FW version (%x).\n", ret);
 		return ret;
-	}
-
-	for (i = 0; i < 4; i++)
-		ha->gold_fw_version[i] =
-			be32_to_cpu((__force __be32)dcode[4+i]);
+	} else {
+		if (qla24xx_risc_firmware_invalid(dcode)) {
+			ql_log(ql_log_warn, vha, 0x0056,
+			    "Unrecognized golden fw at %#x.\n", faddr);
+			ql_dump_buffer(ql_dbg_init, vha, 0x0056, dcode, 32);
+			return QLA_FUNCTION_FAILED;
+		}
 
+		for (i = 0; i < 4; i++)
+			ha->gold_fw_version[i] =
+			   be32_to_cpu((__force __be32)dcode[4+i]);
+	}
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/scsi/qla2xxx/qla_target.c
+++ linux-qcom-6.8.0/drivers/scsi/qla2xxx/qla_target.c
@@ -1062,6 +1062,16 @@
 		    "%s: sess %p logout completed\n", __func__, sess);
 	}
 
+	/* check for any straggling io left behind */
+	if (!(sess->flags & FCF_FCP2_DEVICE) &&
+	    qla2x00_eh_wait_for_pending_commands(sess->vha, sess->d_id.b24, 0, WAIT_TARGET)) {
+		ql_log(ql_log_warn, vha, 0x3027,
+		    "IO not return. Resetting.\n");
+		set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+		qla2xxx_wake_dpc(vha);
+		qla2x00_wait_for_chip_reset(vha);
+	}
+
 	if (sess->logo_ack_needed) {
 		sess->logo_ack_needed = 0;
 		qla24xx_async_notify_ack(vha, sess,
--- linux-qcom-6.8.0.orig/drivers/scsi/scsi.c
+++ linux-qcom-6.8.0/drivers/scsi/scsi.c
@@ -350,6 +350,13 @@
 		if (result < SCSI_VPD_HEADER_SIZE)
 			return 0;
 
+		if (result > sizeof(vpd)) {
+			dev_warn_once(&sdev->sdev_gendev,
+				      "%s: long VPD page 0 length: %d bytes\n",
+				      __func__, result);
+			result = sizeof(vpd);
+		}
+
 		result -= SCSI_VPD_HEADER_SIZE;
 		if (!memchr(&vpd[SCSI_VPD_HEADER_SIZE], page, result))
 			return 0;
@@ -664,6 +671,13 @@
 		sdev->use_10_for_rw = 0;
 
 		sdev->cdl_supported = 1;
+
+		/*
+		 * If the device supports CDL, make sure that the current drive
+		 * feature status is consistent with the user controlled
+		 * cdl_enable state.
+		 */
+		scsi_cdl_enable(sdev, sdev->cdl_enable);
 	} else {
 		sdev->cdl_supported = 0;
 	}
--- linux-qcom-6.8.0.orig/drivers/scsi/scsi_debug.c
+++ linux-qcom-6.8.0/drivers/scsi/scsi_debug.c
@@ -6009,7 +6009,7 @@
 	}
 	sd_dp = &sqcp->sd_dp;
 
-	if (polled)
+	if (polled || (ndelay > 0 && ndelay < INCLUSIVE_TIMING_MAX_NS))
 		ns_from_boot = ktime_get_boottime_ns();
 
 	/* one of the resp_*() response functions is called here */
--- linux-qcom-6.8.0.orig/drivers/scsi/scsi_lib.c
+++ linux-qcom-6.8.0/drivers/scsi/scsi_lib.c
@@ -543,10 +543,9 @@
 	if (blk_queue_add_random(q))
 		add_disk_randomness(req->q->disk);
 
-	if (!blk_rq_is_passthrough(req)) {
-		WARN_ON_ONCE(!(cmd->flags & SCMD_INITIALIZED));
-		cmd->flags &= ~SCMD_INITIALIZED;
-	}
+	WARN_ON_ONCE(!blk_rq_is_passthrough(req) &&
+		     !(cmd->flags & SCMD_INITIALIZED));
+	cmd->flags = 0;
 
 	/*
 	 * Calling rcu_barrier() is not necessary here because the
--- linux-qcom-6.8.0.orig/drivers/scsi/scsi_scan.c
+++ linux-qcom-6.8.0/drivers/scsi/scsi_scan.c
@@ -1619,6 +1619,40 @@
 }
 EXPORT_SYMBOL(scsi_add_device);
 
+int scsi_resume_device(struct scsi_device *sdev)
+{
+	struct device *dev = &sdev->sdev_gendev;
+	int ret = 0;
+
+	device_lock(dev);
+
+	/*
+	 * Bail out if the device or its queue are not running. Otherwise,
+	 * the rescan may block waiting for commands to be executed, with us
+	 * holding the device lock. This can result in a potential deadlock
+	 * in the power management core code when system resume is on-going.
+	 */
+	if (sdev->sdev_state != SDEV_RUNNING ||
+	    blk_queue_pm_only(sdev->request_queue)) {
+		ret = -EWOULDBLOCK;
+		goto unlock;
+	}
+
+	if (dev->driver && try_module_get(dev->driver->owner)) {
+		struct scsi_driver *drv = to_scsi_driver(dev->driver);
+
+		if (drv->resume)
+			ret = drv->resume(dev);
+		module_put(dev->driver->owner);
+	}
+
+unlock:
+	device_unlock(dev);
+
+	return ret;
+}
+EXPORT_SYMBOL(scsi_resume_device);
+
 int scsi_rescan_device(struct scsi_device *sdev)
 {
 	struct device *dev = &sdev->sdev_gendev;
--- linux-qcom-6.8.0.orig/drivers/scsi/scsi_transport_fc.c
+++ linux-qcom-6.8.0/drivers/scsi/scsi_transport_fc.c
@@ -1255,7 +1255,7 @@
 		 */
 		if (rport->port_state == FC_PORTSTATE_ONLINE)
 			rport->port_state = port_state;
-		else
+		else if (port_state != rport->port_state)
 			return -EINVAL;
 	} else if (port_state == FC_PORTSTATE_ONLINE) {
 		/*
@@ -1265,7 +1265,7 @@
 		 */
 		if (rport->port_state == FC_PORTSTATE_MARGINAL)
 			rport->port_state = port_state;
-		else
+		else if (port_state != rport->port_state)
 			return -EINVAL;
 	} else
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/scsi/scsi_transport_iscsi.c
+++ linux-qcom-6.8.0/drivers/scsi/scsi_transport_iscsi.c
@@ -4103,7 +4103,7 @@
 		}
 		do {
 			/*
-			 * special case for GET_STATS:
+			 * special case for GET_STATS, GET_CHAP and GET_HOST_STATS:
 			 * on success - sending reply and stats from
 			 * inside of if_recv_msg(),
 			 * on error - fall through.
@@ -4112,6 +4112,8 @@
 				break;
 			if (ev->type == ISCSI_UEVENT_GET_CHAP && !err)
 				break;
+			if (ev->type == ISCSI_UEVENT_GET_HOST_STATS && !err)
+				break;
 			err = iscsi_if_send_reply(portid, nlh->nlmsg_type,
 						  ev, sizeof(*ev));
 			if (err == -EAGAIN && --retries < 0) {
--- linux-qcom-6.8.0.orig/drivers/scsi/scsi_transport_sas.c
+++ linux-qcom-6.8.0/drivers/scsi/scsi_transport_sas.c
@@ -416,6 +416,29 @@
 }
 EXPORT_SYMBOL_GPL(sas_is_tlr_enabled);
 
+/**
+ * sas_ata_ncq_prio_supported - Check for ATA NCQ command priority support
+ * @sdev: SCSI device
+ *
+ * Check if an ATA device supports NCQ priority using VPD page 89h (ATA
+ * Information). Since this VPD page is implemented only for ATA devices,
+ * this function always returns false for SCSI devices.
+ */
+bool sas_ata_ncq_prio_supported(struct scsi_device *sdev)
+{
+	struct scsi_vpd *vpd;
+	bool ncq_prio_supported = false;
+
+	rcu_read_lock();
+	vpd = rcu_dereference(sdev->vpd_pg89);
+	if (vpd && vpd->len >= 214)
+		ncq_prio_supported = (vpd->data[213] >> 4) & 1;
+	rcu_read_unlock();
+
+	return ncq_prio_supported;
+}
+EXPORT_SYMBOL_GPL(sas_ata_ncq_prio_supported);
+
 /*
  * SAS Phy attributes
  */
--- linux-qcom-6.8.0.orig/drivers/scsi/sd.c
+++ linux-qcom-6.8.0/drivers/scsi/sd.c
@@ -1691,13 +1691,15 @@
 			    (sshdr.asc == 0x74 && sshdr.ascq == 0x71))	/* drive is password locked */
 				/* this is no error here */
 				return 0;
+
 			/*
-			 * This drive doesn't support sync and there's not much
-			 * we can do because this is called during shutdown
-			 * or suspend so just return success so those operations
-			 * can proceed.
+			 * If a format is in progress or if the drive does not
+			 * support sync, there is not much we can do because
+			 * this is called during shutdown or suspend so just
+			 * return success so those operations can proceed.
 			 */
-			if (sshdr.sense_key == ILLEGAL_REQUEST)
+			if ((sshdr.asc == 0x04 && sshdr.ascq == 0x04) ||
+			    sshdr.sense_key == ILLEGAL_REQUEST)
 				return 0;
 		}
 
@@ -3121,7 +3123,7 @@
 	rcu_read_lock();
 	vpd = rcu_dereference(sdkp->device->vpd_pgb1);
 
-	if (!vpd || vpd->len < 8) {
+	if (!vpd || vpd->len <= 8) {
 		rcu_read_unlock();
 	        return;
 	}
@@ -3409,16 +3411,23 @@
 
 static void sd_read_block_zero(struct scsi_disk *sdkp)
 {
-	unsigned int buf_len = sdkp->device->sector_size;
-	char *buffer, cmd[10] = { };
+	struct scsi_device *sdev = sdkp->device;
+	unsigned int buf_len = sdev->sector_size;
+	u8 *buffer, cmd[16] = { };
 
 	buffer = kmalloc(buf_len, GFP_KERNEL);
 	if (!buffer)
 		return;
 
-	cmd[0] = READ_10;
-	put_unaligned_be32(0, &cmd[2]); /* Logical block address 0 */
-	put_unaligned_be16(1, &cmd[7]);	/* Transfer 1 logical block */
+	if (sdev->use_16_for_rw) {
+		cmd[0] = READ_16;
+		put_unaligned_be64(0, &cmd[2]); /* Logical block address 0 */
+		put_unaligned_be32(1, &cmd[10]);/* Transfer 1 logical block */
+	} else {
+		cmd[0] = READ_10;
+		put_unaligned_be32(0, &cmd[2]); /* Logical block address 0 */
+		put_unaligned_be16(1, &cmd[7]);	/* Transfer 1 logical block */
+	}
 
 	scsi_execute_cmd(sdkp->device, cmd, REQ_OP_DRV_IN, buffer, buf_len,
 			 SD_TIMEOUT, sdkp->max_retries, NULL);
@@ -3542,8 +3551,10 @@
 	 */
 	if (sdkp->first_scan ||
 	    q->limits.max_sectors > q->limits.max_dev_sectors ||
-	    q->limits.max_sectors > q->limits.max_hw_sectors)
+	    q->limits.max_sectors > q->limits.max_hw_sectors) {
 		q->limits.max_sectors = rw_max;
+		q->limits.max_user_sectors = rw_max;
+	}
 
 	sdkp->first_scan = 0;
 
@@ -3757,7 +3768,7 @@
 
 	error = device_add_disk(dev, gd, NULL);
 	if (error) {
-		put_device(&sdkp->disk_dev);
+		device_unregister(&sdkp->disk_dev);
 		put_disk(gd);
 		goto out;
 	}
@@ -3945,7 +3956,21 @@
 	return sd_suspend_common(dev, true);
 }
 
-static int sd_resume(struct device *dev, bool runtime)
+static int sd_resume(struct device *dev)
+{
+	struct scsi_disk *sdkp = dev_get_drvdata(dev);
+
+	sd_printk(KERN_NOTICE, sdkp, "Starting disk\n");
+
+	if (opal_unlock_from_suspend(sdkp->opal_dev)) {
+		sd_printk(KERN_NOTICE, sdkp, "OPAL unlock failed\n");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static int sd_resume_common(struct device *dev, bool runtime)
 {
 	struct scsi_disk *sdkp = dev_get_drvdata(dev);
 	int ret;
@@ -3961,7 +3986,7 @@
 	sd_printk(KERN_NOTICE, sdkp, "Starting disk\n");
 	ret = sd_start_stop_device(sdkp, 1);
 	if (!ret) {
-		opal_unlock_from_suspend(sdkp->opal_dev);
+		sd_resume(dev);
 		sdkp->suspended = false;
 	}
 
@@ -3980,7 +4005,7 @@
 		return 0;
 	}
 
-	return sd_resume(dev, false);
+	return sd_resume_common(dev, false);
 }
 
 static int sd_resume_runtime(struct device *dev)
@@ -4007,7 +4032,7 @@
 				  "Failed to clear sense data\n");
 	}
 
-	return sd_resume(dev, true);
+	return sd_resume_common(dev, true);
 }
 
 static const struct dev_pm_ops sd_pm_ops = {
@@ -4030,6 +4055,7 @@
 		.pm		= &sd_pm_ops,
 	},
 	.rescan			= sd_rescan,
+	.resume			= sd_resume,
 	.init_command		= sd_init_command,
 	.uninit_command		= sd_uninit_command,
 	.done			= sd_done,
--- linux-qcom-6.8.0.orig/drivers/scsi/sd_zbc.c
+++ linux-qcom-6.8.0/drivers/scsi/sd_zbc.c
@@ -221,8 +221,7 @@
 	bufsize = min_t(size_t, bufsize, queue_max_segments(q) << PAGE_SHIFT);
 
 	while (bufsize >= SECTOR_SIZE) {
-		buf = __vmalloc(bufsize,
-				GFP_KERNEL | __GFP_ZERO | __GFP_NORETRY);
+		buf = kvzalloc(bufsize, GFP_KERNEL | __GFP_NORETRY);
 		if (buf) {
 			*buflen = bufsize;
 			return buf;
--- linux-qcom-6.8.0.orig/drivers/scsi/sg.c
+++ linux-qcom-6.8.0/drivers/scsi/sg.c
@@ -285,6 +285,7 @@
 	int dev = iminor(inode);
 	int flags = filp->f_flags;
 	struct request_queue *q;
+	struct scsi_device *device;
 	Sg_device *sdp;
 	Sg_fd *sfp;
 	int retval;
@@ -301,22 +302,19 @@
 
 	/* This driver's module count bumped by fops_get in <linux/fs.h> */
 	/* Prevent the device driver from vanishing while we sleep */
-	retval = scsi_device_get(sdp->device);
+	device = sdp->device;
+	retval = scsi_device_get(device);
 	if (retval)
 		goto sg_put;
 
-	retval = scsi_autopm_get_device(sdp->device);
-	if (retval)
-		goto sdp_put;
-
 	/* scsi_block_when_processing_errors() may block so bypass
 	 * check if O_NONBLOCK. Permits SCSI commands to be issued
 	 * during error recovery. Tread carefully. */
 	if (!((flags & O_NONBLOCK) ||
-	      scsi_block_when_processing_errors(sdp->device))) {
+	      scsi_block_when_processing_errors(device))) {
 		retval = -ENXIO;
 		/* we are in error recovery for this device */
-		goto error_out;
+		goto sdp_put;
 	}
 
 	mutex_lock(&sdp->open_rel_lock);
@@ -344,7 +342,7 @@
 
 	if (sdp->open_cnt < 1) {  /* no existing opens */
 		sdp->sgdebug = 0;
-		q = sdp->device->request_queue;
+		q = device->request_queue;
 		sdp->sg_tablesize = queue_max_segments(q);
 	}
 	sfp = sg_add_sfp(sdp);
@@ -369,11 +367,10 @@
 	}
 error_mutex_locked:
 	mutex_unlock(&sdp->open_rel_lock);
-error_out:
-	scsi_autopm_put_device(sdp->device);
 sdp_put:
-	scsi_device_put(sdp->device);
-	goto sg_put;
+	kref_put(&sdp->d_ref, sg_device_destroy);
+	scsi_device_put(device);
+	return retval;
 }
 
 /* Release resources associated with a successful sg_open()
@@ -389,8 +386,6 @@
 	SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, "sg_release\n"));
 
 	mutex_lock(&sdp->open_rel_lock);
-	scsi_autopm_put_device(sdp->device);
-	kref_put(&sfp->f_ref, sg_remove_sfp);
 	sdp->open_cnt--;
 
 	/* possibly many open()s waiting on exlude clearing, start many;
@@ -402,6 +397,7 @@
 		wake_up_interruptible(&sdp->open_wait);
 	}
 	mutex_unlock(&sdp->open_rel_lock);
+	kref_put(&sfp->f_ref, sg_remove_sfp);
 	return 0;
 }
 
@@ -2207,6 +2203,7 @@
 {
 	struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work);
 	struct sg_device *sdp = sfp->parentdp;
+	struct scsi_device *device = sdp->device;
 	Sg_request *srp;
 	unsigned long iflags;
 
@@ -2232,8 +2229,8 @@
 			"sg_remove_sfp: sfp=0x%p\n", sfp));
 	kfree(sfp);
 
-	scsi_device_put(sdp->device);
 	kref_put(&sdp->d_ref, sg_device_destroy);
+	scsi_device_put(device);
 	module_put(THIS_MODULE);
 }
 
--- linux-qcom-6.8.0.orig/drivers/scsi/smartpqi/smartpqi_init.c
+++ linux-qcom-6.8.0/drivers/scsi/smartpqi/smartpqi_init.c
@@ -2355,14 +2355,6 @@
 	scsi3addr[3] |= 0xc0;
 }
 
-static inline bool pqi_is_multipath_device(struct pqi_scsi_dev *device)
-{
-	if (pqi_is_logical_device(device))
-		return false;
-
-	return (device->path_map & (device->path_map - 1)) != 0;
-}
-
 static inline bool pqi_expose_device(struct pqi_scsi_dev *device)
 {
 	return !device->is_physical_device || !pqi_skip_device(device->scsi3addr);
@@ -3259,14 +3251,12 @@
 	int residual_count;
 	int xfer_count;
 	bool device_offline;
-	struct pqi_scsi_dev *device;
 
 	scmd = io_request->scmd;
 	error_info = io_request->error_info;
 	host_byte = DID_OK;
 	sense_data_length = 0;
 	device_offline = false;
-	device = scmd->device->hostdata;
 
 	switch (error_info->service_response) {
 	case PQI_AIO_SERV_RESPONSE_COMPLETE:
@@ -3291,14 +3281,8 @@
 			break;
 		case PQI_AIO_STATUS_AIO_PATH_DISABLED:
 			pqi_aio_path_disabled(io_request);
-			if (pqi_is_multipath_device(device)) {
-				pqi_device_remove_start(device);
-				host_byte = DID_NO_CONNECT;
-				scsi_status = SAM_STAT_CHECK_CONDITION;
-			} else {
-				scsi_status = SAM_STAT_GOOD;
-				io_request->status = -EAGAIN;
-			}
+			scsi_status = SAM_STAT_GOOD;
+			io_request->status = -EAGAIN;
 			break;
 		case PQI_AIO_STATUS_NO_PATH_TO_DEVICE:
 		case PQI_AIO_STATUS_INVALID_DEVICE:
@@ -5934,7 +5918,7 @@
 	int rc;
 	struct pqi_scsi_dev *device;
 	struct pqi_stream_data *pqi_stream_data;
-	struct pqi_scsi_dev_raid_map_data rmd;
+	struct pqi_scsi_dev_raid_map_data rmd = { 0 };
 
 	if (!ctrl_info->enable_stream_detection)
 		return false;
@@ -9452,6 +9436,10 @@
 	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x193d, 0x0462)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x193d, 0x1104)
 	},
 	{
@@ -9480,6 +9468,10 @@
 	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x193d, 0x1110)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x193d, 0x8460)
 	},
 	{
@@ -9488,6 +9480,10 @@
 	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x193d, 0x8462)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x193d, 0xc460)
 	},
 	{
@@ -9596,6 +9592,14 @@
 	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x00a1)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1f3a, 0x0104)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x19e5, 0xd227)
 	},
 	{
@@ -10188,6 +10192,110 @@
 	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1137, 0x02fe)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1137, 0x02ff)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1137, 0x0300)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0045)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0046)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0047)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0048)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x004a)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x004b)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x004c)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x004f)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0051)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0052)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0053)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0054)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x006b)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x006c)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x006d)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x006f)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0070)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0071)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0072)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0086)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0087)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0088)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x0089)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 				0x1e93, 0x1000)
 	},
 	{
@@ -10272,6 +10380,10 @@
 	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1ff9, 0x00a3)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       PCI_ANY_ID, PCI_ANY_ID)
 	},
 	{ 0 }
--- linux-qcom-6.8.0.orig/drivers/scsi/sr.h
+++ linux-qcom-6.8.0/drivers/scsi/sr.h
@@ -65,7 +65,7 @@
 int sr_get_last_session(struct cdrom_device_info *, struct cdrom_multisession *);
 int sr_get_mcn(struct cdrom_device_info *, struct cdrom_mcn *);
 int sr_reset(struct cdrom_device_info *);
-int sr_select_speed(struct cdrom_device_info *cdi, int speed);
+int sr_select_speed(struct cdrom_device_info *cdi, unsigned long speed);
 int sr_audio_ioctl(struct cdrom_device_info *, unsigned int, void *);
 
 int sr_is_xa(Scsi_CD *);
--- linux-qcom-6.8.0.orig/drivers/scsi/sr_ioctl.c
+++ linux-qcom-6.8.0/drivers/scsi/sr_ioctl.c
@@ -425,11 +425,14 @@
 	return 0;
 }
 
-int sr_select_speed(struct cdrom_device_info *cdi, int speed)
+int sr_select_speed(struct cdrom_device_info *cdi, unsigned long speed)
 {
 	Scsi_CD *cd = cdi->handle;
 	struct packet_command cgc;
 
+	/* avoid exceeding the max speed or overflowing integer bounds */
+	speed = clamp(speed, 0, 0xffff / 177);
+
 	if (speed == 0)
 		speed = 0xffff;	/* set to max */
 	else
--- linux-qcom-6.8.0.orig/drivers/scsi/st.c
+++ linux-qcom-6.8.0/drivers/scsi/st.c
@@ -835,6 +835,9 @@
 	int backspace, result;
 	struct st_partstat *STps;
 
+	if (STp->ready != ST_READY)
+		return 0;
+
 	/*
 	 * If there was a bus reset, block further access
 	 * to this device.
@@ -842,8 +845,6 @@
 	if (STp->pos_unknown)
 		return (-EIO);
 
-	if (STp->ready != ST_READY)
-		return 0;
 	STps = &(STp->ps[STp->partition]);
 	if (STps->rw == ST_WRITING)	/* Writing */
 		return st_flush_write_buffer(STp);
@@ -3506,6 +3507,7 @@
 	int i, cmd_nr, cmd_type, bt;
 	int retval = 0;
 	unsigned int blk;
+	bool cmd_mtiocget;
 	struct scsi_tape *STp = file->private_data;
 	struct st_modedef *STm;
 	struct st_partstat *STps;
@@ -3619,6 +3621,7 @@
 			 */
 			if (mtc.mt_op != MTREW &&
 			    mtc.mt_op != MTOFFL &&
+			    mtc.mt_op != MTLOAD &&
 			    mtc.mt_op != MTRETEN &&
 			    mtc.mt_op != MTERASE &&
 			    mtc.mt_op != MTSEEK &&
@@ -3732,17 +3735,28 @@
 		goto out;
 	}
 
+	cmd_mtiocget = cmd_type == _IOC_TYPE(MTIOCGET) && cmd_nr == _IOC_NR(MTIOCGET);
+
 	if ((i = flush_buffer(STp, 0)) < 0) {
-		retval = i;
-		goto out;
-	}
-	if (STp->can_partitions &&
-	    (i = switch_partition(STp)) < 0) {
-		retval = i;
-		goto out;
+		if (cmd_mtiocget && STp->pos_unknown) {
+			/* flush fails -> modify status accordingly */
+			reset_state(STp);
+			STp->pos_unknown = 1;
+		} else { /* return error */
+			retval = i;
+			goto out;
+		}
+	} else { /* flush_buffer succeeds */
+		if (STp->can_partitions) {
+			i = switch_partition(STp);
+			if (i < 0) {
+				retval = i;
+				goto out;
+			}
+		}
 	}
 
-	if (cmd_type == _IOC_TYPE(MTIOCGET) && cmd_nr == _IOC_NR(MTIOCGET)) {
+	if (cmd_mtiocget) {
 		struct mtget mt_status;
 
 		if (_IOC_SIZE(cmd_in) != sizeof(struct mtget)) {
@@ -3756,7 +3770,7 @@
 		    ((STp->density << MT_ST_DENSITY_SHIFT) & MT_ST_DENSITY_MASK);
 		mt_status.mt_blkno = STps->drv_block;
 		mt_status.mt_fileno = STps->drv_file;
-		if (STp->block_size != 0) {
+		if (STp->block_size != 0 && mt_status.mt_blkno >= 0) {
 			if (STps->rw == ST_WRITING)
 				mt_status.mt_blkno +=
 				    (STp->buffer)->buffer_bytes / STp->block_size;
--- linux-qcom-6.8.0.orig/drivers/scsi/storvsc_drv.c
+++ linux-qcom-6.8.0/drivers/scsi/storvsc_drv.c
@@ -149,6 +149,8 @@
 */
 static int vmstor_proto_version;
 
+static bool hv_dev_is_fc(struct hv_device *hv_dev);
+
 #define STORVSC_LOGGING_NONE	0
 #define STORVSC_LOGGING_ERROR	1
 #define STORVSC_LOGGING_WARN	2
@@ -169,6 +171,12 @@
 		dev_warn(&(dev)->device, fmt, ##__VA_ARGS__);	\
 } while (0)
 
+#define storvsc_log_ratelimited(dev, level, fmt, ...)				\
+do {										\
+	if (do_logging(level))							\
+		dev_warn_ratelimited(&(dev)->device, fmt, ##__VA_ARGS__);	\
+} while (0)
+
 struct vmscsi_request {
 	u16 length;
 	u8 srb_status;
@@ -1138,6 +1146,7 @@
 	 * not correctly handle:
 	 * INQUIRY command with page code parameter set to 0x80
 	 * MODE_SENSE command with cmd[2] == 0x1c
+	 * MAINTENANCE_IN is not supported by HyperV FC passthrough
 	 *
 	 * Setup srb and scsi status so this won't be fatal.
 	 * We do this so we can distinguish truly fatal failues
@@ -1145,7 +1154,9 @@
 	 */
 
 	if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) ||
-	   (stor_pkt->vm_srb.cdb[0] == MODE_SENSE)) {
+	   (stor_pkt->vm_srb.cdb[0] == MODE_SENSE) ||
+	   (stor_pkt->vm_srb.cdb[0] == MAINTENANCE_IN &&
+	   hv_dev_is_fc(device))) {
 		vstor_packet->vm_srb.scsi_status = 0;
 		vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS;
 	}
@@ -1172,7 +1183,7 @@
 		int loglevel = (stor_pkt->vm_srb.cdb[0] == TEST_UNIT_READY) ?
 			STORVSC_LOGGING_WARN : STORVSC_LOGGING_ERROR;
 
-		storvsc_log(device, loglevel,
+		storvsc_log_ratelimited(device, loglevel,
 			"tag#%d cmd 0x%x status: scsi 0x%x srb 0x%x hv 0x%x\n",
 			scsi_cmd_to_rq(request->cmd)->tag,
 			stor_pkt->vm_srb.cdb[0],
--- linux-qcom-6.8.0.orig/drivers/scsi/wd33c93.c
+++ linux-qcom-6.8.0/drivers/scsi/wd33c93.c
@@ -831,7 +831,7 @@
 		/* construct an IDENTIFY message with correct disconnect bit */
 
 		hostdata->outgoing_msg[0] = IDENTIFY(0, cmd->device->lun);
-		if (scsi_pointer->phase)
+		if (WD33C93_scsi_pointer(cmd)->phase)
 			hostdata->outgoing_msg[0] |= 0x40;
 
 		if (hostdata->sync_stat[cmd->device->id] == SS_FIRST) {
--- linux-qcom-6.8.0.orig/drivers/sh/intc/core.c
+++ linux-qcom-6.8.0/drivers/sh/intc/core.c
@@ -209,7 +209,6 @@
 		goto err0;
 
 	INIT_LIST_HEAD(&d->list);
-	list_add_tail(&d->list, &intc_list);
 
 	raw_spin_lock_init(&d->lock);
 	INIT_RADIX_TREE(&d->tree, GFP_ATOMIC);
@@ -369,6 +368,7 @@
 
 	d->skip_suspend = desc->skip_syscore_suspend;
 
+	list_add_tail(&d->list, &intc_list);
 	nr_intc_controllers++;
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/slimbus/core.c
+++ linux-qcom-6.8.0/drivers/slimbus/core.c
@@ -436,8 +436,8 @@
 		if (ret < 0)
 			goto err;
 	} else if (report_present) {
-		ret = ida_simple_get(&ctrl->laddr_ida,
-				     0, SLIM_LA_MANAGER - 1, GFP_KERNEL);
+		ret = ida_alloc_max(&ctrl->laddr_ida,
+				    SLIM_LA_MANAGER - 1, GFP_KERNEL);
 		if (ret < 0)
 			goto err;
 
--- linux-qcom-6.8.0.orig/drivers/slimbus/messaging.c
+++ linux-qcom-6.8.0/drivers/slimbus/messaging.c
@@ -147,8 +147,9 @@
 	}
 
 	ret = ctrl->xfer_msg(ctrl, txn);
-
-	if (!ret && need_tid && !txn->msg->comp) {
+	if (ret == -ETIMEDOUT) {
+		slim_free_txn_tid(ctrl, txn);
+	} else if (!ret && need_tid && !txn->msg->comp) {
 		unsigned long ms = txn->rl + HZ;
 
 		timeout = wait_for_completion_timeout(txn->comp,
--- linux-qcom-6.8.0.orig/drivers/slimbus/qcom-ngd-ctrl.c
+++ linux-qcom-6.8.0/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1451,7 +1451,11 @@
 	ctrl = container_of(work, struct qcom_slim_ngd_ctrl, ngd_up_work);
 
 	/* Make sure qmi service is up before continuing */
-	wait_for_completion_interruptible(&ctrl->qmi_up);
+	if (!wait_for_completion_interruptible_timeout(&ctrl->qmi_up,
+						       msecs_to_jiffies(MSEC_PER_SEC))) {
+		dev_err(ctrl->dev, "QMI wait timeout\n");
+		return;
+	}
 
 	mutex_lock(&ctrl->ssr_lock);
 	qcom_slim_ngd_enable(ctrl, true);
--- linux-qcom-6.8.0.orig/drivers/soc/fsl/dpio/dpio-service.c
+++ linux-qcom-6.8.0/drivers/soc/fsl/dpio/dpio-service.c
@@ -523,7 +523,7 @@
 	struct qbman_eq_desc *ed;
 	int i, ret;
 
-	ed = kcalloc(sizeof(struct qbman_eq_desc), 32, GFP_KERNEL);
+	ed = kcalloc(32, sizeof(struct qbman_eq_desc), GFP_KERNEL);
 	if (!ed)
 		return -ENOMEM;
 
--- linux-qcom-6.8.0.orig/drivers/soc/fsl/qbman/qman.c
+++ linux-qcom-6.8.0/drivers/soc/fsl/qbman/qman.c
@@ -991,7 +991,7 @@
 	/* linked-list of CSCN handlers. */
 	struct list_head cgr_cbs;
 	/* list lock */
-	spinlock_t cgr_lock;
+	raw_spinlock_t cgr_lock;
 	struct work_struct congestion_work;
 	struct work_struct mr_work;
 	char irqname[MAX_IRQNAME];
@@ -1281,7 +1281,7 @@
 		/* if the given mask is NULL, assume all CGRs can be seen */
 		qman_cgrs_fill(&portal->cgrs[0]);
 	INIT_LIST_HEAD(&portal->cgr_cbs);
-	spin_lock_init(&portal->cgr_lock);
+	raw_spin_lock_init(&portal->cgr_lock);
 	INIT_WORK(&portal->congestion_work, qm_congestion_task);
 	INIT_WORK(&portal->mr_work, qm_mr_process_task);
 	portal->bits = 0;
@@ -1456,11 +1456,14 @@
 	union qm_mc_result *mcr;
 	struct qman_cgr *cgr;
 
-	spin_lock(&p->cgr_lock);
+	/*
+	 * FIXME: QM_MCR_TIMEOUT is 10ms, which is too long for a raw spinlock!
+	 */
+	raw_spin_lock_irq(&p->cgr_lock);
 	qm_mc_start(&p->p);
 	qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION);
 	if (!qm_mc_result_timeout(&p->p, &mcr)) {
-		spin_unlock(&p->cgr_lock);
+		raw_spin_unlock_irq(&p->cgr_lock);
 		dev_crit(p->config->dev, "QUERYCONGESTION timeout\n");
 		qman_p_irqsource_add(p, QM_PIRQ_CSCI);
 		return;
@@ -1476,7 +1479,7 @@
 	list_for_each_entry(cgr, &p->cgr_cbs, node)
 		if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid))
 			cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid));
-	spin_unlock(&p->cgr_lock);
+	raw_spin_unlock_irq(&p->cgr_lock);
 	qman_p_irqsource_add(p, QM_PIRQ_CSCI);
 }
 
@@ -2440,7 +2443,7 @@
 	preempt_enable();
 
 	cgr->chan = p->config->channel;
-	spin_lock(&p->cgr_lock);
+	raw_spin_lock_irq(&p->cgr_lock);
 
 	if (opts) {
 		struct qm_mcc_initcgr local_opts = *opts;
@@ -2477,7 +2480,7 @@
 	    qman_cgrs_get(&p->cgrs[1], cgr->cgrid))
 		cgr->cb(p, cgr, 1);
 out:
-	spin_unlock(&p->cgr_lock);
+	raw_spin_unlock_irq(&p->cgr_lock);
 	put_affine_portal();
 	return ret;
 }
@@ -2512,7 +2515,7 @@
 		return -EINVAL;
 
 	memset(&local_opts, 0, sizeof(struct qm_mcc_initcgr));
-	spin_lock_irqsave(&p->cgr_lock, irqflags);
+	raw_spin_lock_irqsave(&p->cgr_lock, irqflags);
 	list_del(&cgr->node);
 	/*
 	 * If there are no other CGR objects for this CGRID in the list,
@@ -2537,7 +2540,7 @@
 		/* add back to the list */
 		list_add(&cgr->node, &p->cgr_cbs);
 release_lock:
-	spin_unlock_irqrestore(&p->cgr_lock, irqflags);
+	raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags);
 	put_affine_portal();
 	return ret;
 }
@@ -2577,9 +2580,9 @@
 	if (!p)
 		return -EINVAL;
 
-	spin_lock_irqsave(&p->cgr_lock, irqflags);
+	raw_spin_lock_irqsave(&p->cgr_lock, irqflags);
 	ret = qm_modify_cgr(cgr, 0, opts);
-	spin_unlock_irqrestore(&p->cgr_lock, irqflags);
+	raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags);
 	put_affine_portal();
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/soc/fsl/qe/qmc.c
+++ linux-qcom-6.8.0/drivers/soc/fsl/qe/qmc.c
@@ -262,7 +262,6 @@
 	qmc_write32(addr, qmc_read32(addr) | set);
 }
 
-
 int qmc_chan_get_info(struct qmc_chan *chan, struct qmc_chan_info *info)
 {
 	struct tsa_serial_info tsa_info;
@@ -940,11 +939,13 @@
 		goto end;
 	}
 
-	ret = qmc_setup_chan_trnsync(chan->qmc, chan);
-	if (ret) {
-		dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n",
-			chan->id, ret);
-		goto end;
+	if (chan->mode == QMC_TRANSPARENT) {
+		ret = qmc_setup_chan_trnsync(chan->qmc, chan);
+		if (ret) {
+			dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n",
+				chan->id, ret);
+			goto end;
+		}
 	}
 
 	/* Restart the receiver */
@@ -982,11 +983,13 @@
 		goto end;
 	}
 
-	ret = qmc_setup_chan_trnsync(chan->qmc, chan);
-	if (ret) {
-		dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n",
-			chan->id, ret);
-		goto end;
+	if (chan->mode == QMC_TRANSPARENT) {
+		ret = qmc_setup_chan_trnsync(chan->qmc, chan);
+		if (ret) {
+			dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n",
+				chan->id, ret);
+			goto end;
+		}
 	}
 
 	/*
@@ -1385,7 +1388,7 @@
 		qmc_write32(chan->s_param + QMC_SPE_ZDSTATE, 0x00000080);
 		qmc_write16(chan->s_param + QMC_SPE_MFLR, 60);
 		qmc_write16(chan->s_param + QMC_SPE_CHAMR,
-			QMC_SPE_CHAMR_MODE_HDLC | QMC_SPE_CHAMR_HDLC_IDLM);
+			    QMC_SPE_CHAMR_MODE_HDLC | QMC_SPE_CHAMR_HDLC_IDLM);
 	}
 
 	/* Do not enable interrupts now. They will be enabled later */
@@ -1558,27 +1561,14 @@
 	return IRQ_HANDLED;
 }
 
-static int qmc_probe(struct platform_device *pdev)
+static int qmc_cpm1_init_resources(struct qmc *qmc, struct platform_device *pdev)
 {
-	struct device_node *np = pdev->dev.of_node;
-	unsigned int nb_chans;
 	struct resource *res;
-	struct qmc *qmc;
-	int irq;
-	int ret;
-
-	qmc = devm_kzalloc(&pdev->dev, sizeof(*qmc), GFP_KERNEL);
-	if (!qmc)
-		return -ENOMEM;
-
-	qmc->dev = &pdev->dev;
-	INIT_LIST_HEAD(&qmc->chan_head);
 
 	qmc->scc_regs = devm_platform_ioremap_resource_byname(pdev, "scc_regs");
 	if (IS_ERR(qmc->scc_regs))
 		return PTR_ERR(qmc->scc_regs);
 
-
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "scc_pram");
 	if (!res)
 		return -EINVAL;
@@ -1591,44 +1581,91 @@
 	if (IS_ERR(qmc->dpram))
 		return PTR_ERR(qmc->dpram);
 
+	return 0;
+}
+
+static int qmc_init_resources(struct qmc *qmc, struct platform_device *pdev)
+{
+	return qmc_cpm1_init_resources(qmc, pdev);
+}
+
+static int qmc_cpm1_init_scc(struct qmc *qmc)
+{
+	u32 val;
+	int ret;
+
+	/* Connect the serial (SCC) to TSA */
+	ret = tsa_serial_connect(qmc->tsa_serial);
+	if (ret)
+		return dev_err_probe(qmc->dev, ret, "Failed to connect TSA serial\n");
+
+	/* Init GMSR_H and GMSR_L registers */
+	val = SCC_GSMRH_CDS | SCC_GSMRH_CTSS | SCC_GSMRH_CDP | SCC_GSMRH_CTSP;
+	qmc_write32(qmc->scc_regs + SCC_GSMRH, val);
+
+	/* enable QMC mode */
+	qmc_write32(qmc->scc_regs + SCC_GSMRL, SCC_GSMRL_MODE_QMC);
+
+	/* Disable and clear interrupts */
+	qmc_write16(qmc->scc_regs + SCC_SCCM, 0x0000);
+	qmc_write16(qmc->scc_regs + SCC_SCCE, 0x000F);
+
+	return 0;
+}
+
+static int qmc_init_xcc(struct qmc *qmc)
+{
+	return qmc_cpm1_init_scc(qmc);
+}
+
+static void qmc_exit_xcc(struct qmc *qmc)
+{
+	/* Disconnect the serial from TSA */
+	tsa_serial_disconnect(qmc->tsa_serial);
+}
+
+static int qmc_probe(struct platform_device *pdev)
+{
+	struct device_node *np = pdev->dev.of_node;
+	unsigned int nb_chans;
+	struct qmc *qmc;
+	int irq;
+	int ret;
+
+	qmc = devm_kzalloc(&pdev->dev, sizeof(*qmc), GFP_KERNEL);
+	if (!qmc)
+		return -ENOMEM;
+
+	qmc->dev = &pdev->dev;
+	INIT_LIST_HEAD(&qmc->chan_head);
+
 	qmc->tsa_serial = devm_tsa_serial_get_byphandle(qmc->dev, np, "fsl,tsa-serial");
 	if (IS_ERR(qmc->tsa_serial)) {
 		return dev_err_probe(qmc->dev, PTR_ERR(qmc->tsa_serial),
 				     "Failed to get TSA serial\n");
 	}
 
-	/* Connect the serial (SCC) to TSA */
-	ret = tsa_serial_connect(qmc->tsa_serial);
-	if (ret) {
-		dev_err(qmc->dev, "Failed to connect TSA serial\n");
+	ret = qmc_init_resources(qmc, pdev);
+	if (ret)
 		return ret;
-	}
 
 	/* Parse channels informationss */
 	ret = qmc_of_parse_chans(qmc, np);
 	if (ret)
-		goto err_tsa_serial_disconnect;
+		return ret;
 
 	nb_chans = qmc_nb_chans(qmc);
 
-	/* Init GMSR_H and GMSR_L registers */
-	qmc_write32(qmc->scc_regs + SCC_GSMRH,
-		    SCC_GSMRH_CDS | SCC_GSMRH_CTSS | SCC_GSMRH_CDP | SCC_GSMRH_CTSP);
-
-	/* enable QMC mode */
-	qmc_write32(qmc->scc_regs + SCC_GSMRL, SCC_GSMRL_MODE_QMC);
-
 	/*
 	 * Allocate the buffer descriptor table
 	 * 8 rx and 8 tx descriptors per channel
 	 */
 	qmc->bd_size = (nb_chans * (QMC_NB_TXBDS + QMC_NB_RXBDS)) * sizeof(cbd_t);
 	qmc->bd_table = dmam_alloc_coherent(qmc->dev, qmc->bd_size,
-		&qmc->bd_dma_addr, GFP_KERNEL);
+					    &qmc->bd_dma_addr, GFP_KERNEL);
 	if (!qmc->bd_table) {
 		dev_err(qmc->dev, "Failed to allocate bd table\n");
-		ret = -ENOMEM;
-		goto err_tsa_serial_disconnect;
+		return -ENOMEM;
 	}
 	memset(qmc->bd_table, 0, qmc->bd_size);
 
@@ -1637,11 +1674,10 @@
 	/* Allocate the interrupt table */
 	qmc->int_size = QMC_NB_INTS * sizeof(u16);
 	qmc->int_table = dmam_alloc_coherent(qmc->dev, qmc->int_size,
-		&qmc->int_dma_addr, GFP_KERNEL);
+					     &qmc->int_dma_addr, GFP_KERNEL);
 	if (!qmc->int_table) {
 		dev_err(qmc->dev, "Failed to allocate interrupt table\n");
-		ret = -ENOMEM;
-		goto err_tsa_serial_disconnect;
+		return -ENOMEM;
 	}
 	memset(qmc->int_table, 0, qmc->int_size);
 
@@ -1660,32 +1696,37 @@
 
 	ret = qmc_init_tsa(qmc);
 	if (ret)
-		goto err_tsa_serial_disconnect;
+		return ret;
 
 	qmc_write16(qmc->scc_pram + QMC_GBL_QMCSTATE, 0x8000);
 
 	ret = qmc_setup_chans(qmc);
 	if (ret)
-		goto err_tsa_serial_disconnect;
+		return ret;
 
 	/* Init interrupts table */
 	ret = qmc_setup_ints(qmc);
 	if (ret)
-		goto err_tsa_serial_disconnect;
+		return ret;
 
-	/* Disable and clear interrupts,  set the irq handler */
-	qmc_write16(qmc->scc_regs + SCC_SCCM, 0x0000);
-	qmc_write16(qmc->scc_regs + SCC_SCCE, 0x000F);
+	/* Init SCC */
+	ret = qmc_init_xcc(qmc);
+	if (ret)
+		return ret;
+
+	/* Set the irq handler */
 	irq = platform_get_irq(pdev, 0);
-	if (irq < 0)
-		goto err_tsa_serial_disconnect;
+	if (irq < 0) {
+		ret = irq;
+		goto err_exit_xcc;
+	}
 	ret = devm_request_irq(qmc->dev, irq, qmc_irq_handler, 0, "qmc", qmc);
 	if (ret < 0)
-		goto err_tsa_serial_disconnect;
+		goto err_exit_xcc;
 
 	/* Enable interrupts */
 	qmc_write16(qmc->scc_regs + SCC_SCCM,
-		SCC_SCCE_IQOV | SCC_SCCE_GINT | SCC_SCCE_GUN | SCC_SCCE_GOV);
+		    SCC_SCCE_IQOV | SCC_SCCE_GINT | SCC_SCCE_GUN | SCC_SCCE_GOV);
 
 	ret = qmc_finalize_chans(qmc);
 	if (ret < 0)
@@ -1709,8 +1750,8 @@
 err_disable_intr:
 	qmc_write16(qmc->scc_regs + SCC_SCCM, 0);
 
-err_tsa_serial_disconnect:
-	tsa_serial_disconnect(qmc->tsa_serial);
+err_exit_xcc:
+	qmc_exit_xcc(qmc);
 	return ret;
 }
 
@@ -1724,8 +1765,8 @@
 	/* Disable interrupts */
 	qmc_write16(qmc->scc_regs + SCC_SCCM, 0);
 
-	/* Disconnect the serial from TSA */
-	tsa_serial_disconnect(qmc->tsa_serial);
+	/* Exit SCC */
+	qmc_exit_xcc(qmc);
 }
 
 static const struct of_device_id qmc_id_table[] = {
--- linux-qcom-6.8.0.orig/drivers/soc/fsl/qe/tsa.c
+++ linux-qcom-6.8.0/drivers/soc/fsl/qe/tsa.c
@@ -140,7 +140,7 @@
 	iowrite32be(val, addr);
 }
 
-static inline void tsa_write8(void __iomem *addr, u32 val)
+static inline void tsa_write8(void __iomem *addr, u8 val)
 {
 	iowrite8(val, addr);
 }
--- linux-qcom-6.8.0.orig/drivers/soc/fsl/rcpm.c
+++ linux-qcom-6.8.0/drivers/soc/fsl/rcpm.c
@@ -36,6 +36,7 @@
 		return;
 
 	regs = of_iomap(np, 0);
+	of_node_put(np);
 	if (!regs)
 		return;
 
--- linux-qcom-6.8.0.orig/drivers/soc/imx/soc-imx8m.c
+++ linux-qcom-6.8.0/drivers/soc/imx/soc-imx8m.c
@@ -30,7 +30,7 @@
 
 struct imx8_soc_data {
 	char *name;
-	u32 (*soc_revision)(void);
+	int (*soc_revision)(u32 *socrev);
 };
 
 static u64 soc_uid;
@@ -51,24 +51,29 @@
 static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; };
 #endif
 
-static u32 __init imx8mq_soc_revision(void)
+static int imx8mq_soc_revision(u32 *socrev)
 {
 	struct device_node *np;
 	void __iomem *ocotp_base;
 	u32 magic;
 	u32 rev;
 	struct clk *clk;
+	int ret;
 
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp");
 	if (!np)
-		return 0;
+		return -EINVAL;
 
 	ocotp_base = of_iomap(np, 0);
-	WARN_ON(!ocotp_base);
+	if (!ocotp_base) {
+		ret = -EINVAL;
+		goto err_iomap;
+	}
+
 	clk = of_clk_get_by_name(np, NULL);
 	if (IS_ERR(clk)) {
-		WARN_ON(IS_ERR(clk));
-		return 0;
+		ret = PTR_ERR(clk);
+		goto err_clk;
 	}
 
 	clk_prepare_enable(clk);
@@ -88,32 +93,45 @@
 	soc_uid <<= 32;
 	soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW);
 
+	*socrev = rev;
+
 	clk_disable_unprepare(clk);
 	clk_put(clk);
 	iounmap(ocotp_base);
 	of_node_put(np);
 
-	return rev;
+	return 0;
+
+err_clk:
+	iounmap(ocotp_base);
+err_iomap:
+	of_node_put(np);
+	return ret;
 }
 
-static void __init imx8mm_soc_uid(void)
+static int imx8mm_soc_uid(void)
 {
 	void __iomem *ocotp_base;
 	struct device_node *np;
 	struct clk *clk;
+	int ret = 0;
 	u32 offset = of_machine_is_compatible("fsl,imx8mp") ?
 		     IMX8MP_OCOTP_UID_OFFSET : 0;
 
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp");
 	if (!np)
-		return;
+		return -EINVAL;
 
 	ocotp_base = of_iomap(np, 0);
-	WARN_ON(!ocotp_base);
+	if (!ocotp_base) {
+		ret = -EINVAL;
+		goto err_iomap;
+	}
+
 	clk = of_clk_get_by_name(np, NULL);
 	if (IS_ERR(clk)) {
-		WARN_ON(IS_ERR(clk));
-		return;
+		ret = PTR_ERR(clk);
+		goto err_clk;
 	}
 
 	clk_prepare_enable(clk);
@@ -124,31 +142,41 @@
 
 	clk_disable_unprepare(clk);
 	clk_put(clk);
+
+err_clk:
 	iounmap(ocotp_base);
+err_iomap:
 	of_node_put(np);
+
+	return ret;
 }
 
-static u32 __init imx8mm_soc_revision(void)
+static int imx8mm_soc_revision(u32 *socrev)
 {
 	struct device_node *np;
 	void __iomem *anatop_base;
-	u32 rev;
+	int ret;
 
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop");
 	if (!np)
-		return 0;
+		return -EINVAL;
 
 	anatop_base = of_iomap(np, 0);
-	WARN_ON(!anatop_base);
+	if (!anatop_base) {
+		ret = -EINVAL;
+		goto err_iomap;
+	}
 
-	rev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM);
+	*socrev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM);
 
 	iounmap(anatop_base);
 	of_node_put(np);
 
-	imx8mm_soc_uid();
+	return imx8mm_soc_uid();
 
-	return rev;
+err_iomap:
+	of_node_put(np);
+	return ret;
 }
 
 static const struct imx8_soc_data imx8mq_soc_data = {
@@ -184,7 +212,7 @@
 	kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf,  soc_rev & 0xf) : \
 	"unknown"
 
-static int __init imx8_soc_init(void)
+static int imx8m_soc_probe(struct platform_device *pdev)
 {
 	struct soc_device_attribute *soc_dev_attr;
 	struct soc_device *soc_dev;
@@ -212,8 +240,11 @@
 	data = id->data;
 	if (data) {
 		soc_dev_attr->soc_id = data->name;
-		if (data->soc_revision)
-			soc_rev = data->soc_revision();
+		if (data->soc_revision) {
+			ret = data->soc_revision(&soc_rev);
+			if (ret)
+				goto free_soc;
+		}
 	}
 
 	soc_dev_attr->revision = imx8_revision(soc_rev);
@@ -251,5 +282,37 @@
 	kfree(soc_dev_attr);
 	return ret;
 }
+
+static struct platform_driver imx8m_soc_driver = {
+	.probe = imx8m_soc_probe,
+	.driver = {
+		.name = "imx8m-soc",
+	},
+};
+
+static int __init imx8_soc_init(void)
+{
+	struct platform_device *pdev;
+	int ret;
+
+	/* No match means this is non-i.MX8M hardware, do nothing. */
+	if (!of_match_node(imx8_soc_match, of_root))
+		return 0;
+
+	ret = platform_driver_register(&imx8m_soc_driver);
+	if (ret) {
+		pr_err("Failed to register imx8m-soc platform driver: %d\n", ret);
+		return ret;
+	}
+
+	pdev = platform_device_register_simple("imx8m-soc", -1, NULL, 0);
+	if (IS_ERR(pdev)) {
+		pr_err("Failed to register imx8m-soc platform device: %ld\n", PTR_ERR(pdev));
+		platform_driver_unregister(&imx8m_soc_driver);
+		return PTR_ERR(pdev);
+	}
+
+	return 0;
+}
 device_initcall(imx8_soc_init);
 MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/soc/mediatek/mtk-cmdq-helper.c
+++ linux-qcom-6.8.0/drivers/soc/mediatek/mtk-cmdq-helper.c
@@ -14,7 +14,8 @@
 #define CMDQ_POLL_ENABLE_MASK	BIT(0)
 #define CMDQ_EOC_IRQ_EN		BIT(0)
 #define CMDQ_REG_TYPE		1
-#define CMDQ_JUMP_RELATIVE	1
+#define CMDQ_JUMP_RELATIVE	0
+#define CMDQ_JUMP_ABSOLUTE	1
 
 struct cmdq_instruction {
 	union {
@@ -397,7 +398,7 @@
 	struct cmdq_instruction inst = {};
 
 	inst.op = CMDQ_CODE_JUMP;
-	inst.offset = CMDQ_JUMP_RELATIVE;
+	inst.offset = CMDQ_JUMP_ABSOLUTE;
 	inst.value = addr >>
 		cmdq_get_shift_pa(((struct cmdq_client *)pkt->cl)->chan);
 	return cmdq_pkt_append_command(pkt, inst);
--- linux-qcom-6.8.0.orig/drivers/soc/mediatek/mtk-svs.c
+++ linux-qcom-6.8.0/drivers/soc/mediatek/mtk-svs.c
@@ -1768,6 +1768,7 @@
 	const struct svs_bank_pdata *bdata;
 	struct svs_bank *svsb;
 	struct dev_pm_opp *opp;
+	char tz_name_buf[20];
 	unsigned long freq;
 	int count, ret;
 	u32 idx, i;
@@ -1819,10 +1820,12 @@
 		}
 
 		if (!IS_ERR_OR_NULL(bdata->tzone_name)) {
-			svsb->tzd = thermal_zone_get_zone_by_name(bdata->tzone_name);
+			snprintf(tz_name_buf, ARRAY_SIZE(tz_name_buf),
+				 "%s-thermal", bdata->tzone_name);
+			svsb->tzd = thermal_zone_get_zone_by_name(tz_name_buf);
 			if (IS_ERR(svsb->tzd)) {
 				dev_err(svsb->dev, "cannot get \"%s\" thermal zone\n",
-					bdata->tzone_name);
+					tz_name_buf);
 				return PTR_ERR(svsb->tzd);
 			}
 		}
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/Kconfig
+++ linux-qcom-6.8.0/drivers/soc/qcom/Kconfig
@@ -62,6 +62,14 @@
 	tristate
 	select QCOM_SCM
 
+config QCOM_MEMORY_DUMP_V2
+	tristate "QCOM Memory Dump V2 Support"
+	help
+	  This enables memory dump feature. It allows various client
+	  subsystems to register respective dump regions. At the time
+	  of deadlocks or cpu hangs these dump regions are captured to
+	  give a snapshot of the system at the time of the crash.
+
 config QCOM_OCMEM
 	tristate "Qualcomm On Chip Memory (OCMEM) driver"
 	depends on ARCH_QCOM
@@ -72,6 +80,16 @@
 	  requirements. This is typically used by the GPU, camera/video, and
 	  audio components on some Snapdragon SoCs.
 
+config QCOM_PANEL_EVENT_NOTIFIER
+        tristate "panel event notifier"
+        depends on DRM
+        help
+          Enabling this option adds panel event notifier driver.
+          This driver is responsible for notifying clients interested in display
+          panel events such as panel on , panel off, fps change etc.  Clients
+          can use these notifications for power saving or align its operations
+          with display panel power state.
+
 config QCOM_PDR_HELPERS
 	tristate
 	select QCOM_QMI_HELPERS
@@ -201,6 +219,16 @@
 	  Say yes here to support the Qualcomm Shared Memory State Machine.
 	  The state machine is represented by bits in shared memory.
 
+config QCOM_SMP2P_SLEEPSTATE
+	tristate "SMP2P Sleepstate notifier"
+	depends on QCOM_SMP2P
+	help
+	  When this option is enabled, notifications are sent to remote procs
+	  for the power state changes on the local processor. The notifications
+	  are sent through the smp2p framework. This driver can also receive
+	  notifications from the remote to prevent suspend on the local
+	  processor.
+
 config QCOM_SOCINFO
 	tristate "Qualcomm socinfo driver"
 	depends on QCOM_SMEM
@@ -268,4 +296,102 @@
 	tristate
 	select QCOM_SCM
 
+config QCOM_WDT_CORE
+       tristate "Qualcomm Technologies, Inc. Watchdog Support"
+       depends on ARCH_QCOM
+       help
+          This enables the watchdog framework for Qualcomm Technologies, Inc.
+          devices. It causes a kernel panic if the watchdog times out. It allows
+          for the detection of cpu hangs and deadlocks. It does not run during the
+          bootup process, so it will not catch any early lockups. Enabling this
+          only enables the framework, an individual Qualcomm Technologies, Inc.
+          watchdog module must be loaded along with this for watchdog
+          functionality.
+
+config QCOM_FORCE_WDOG_BITE_ON_PANIC
+       bool "QCOM force watchdog bite on panic"
+       depends on QCOM_WDT_CORE
+       help
+         This forces a watchdog bite when the device restarts
+         due to a kernel panic. On certain MSM SoCs,
+         this provides additional debugging
+         information.
+
+config QCOM_WDOG_BITE_EARLY_PANIC
+       bool "QCOM early panic watchdog bite"
+       depends on QCOM_WDT_CORE && QCOM_FORCE_WDOG_BITE_ON_PANIC
+       help
+         This forces a watchdog bite early in panic sequence. On certain
+         MSM SoCs, this provides us additional debugging information at the
+         context of the crash. If this option is disabled, then bite occurs
+         later in panic, which permits more of the restart sequence to run
+         (e.g. more dmesg to flushed to console).
+
+config QCOM_WATCHDOG_BARK_TIME
+       depends on QCOM_WDT_CORE
+       int "Qualcomm Technologies, Inc. Watchdog bark time in ms"
+       default 11000
+       range 11000 11000
+       help
+         The amount of time, in milliseconds, that should elapse after
+         a watchdog timer reset before a bark interrupt is sent from the
+         watchdog.
+
+config QCOM_WATCHDOG_PET_TIME
+       depends on QCOM_WDT_CORE
+       int "Qualcomm Technologies, Inc. Watchdog pet time in ms"
+       default 9360
+       range 9360 9360
+       help
+         The amount of time, in milliseconds, that should elapse before
+         a watchdog pet is initiated to reset the watchdog timer to 0.
+
+config QCOM_WATCHDOG_IPI_PING
+       depends on QCOM_WDT_CORE
+       bool "Qualcomm Technologies, Inc. Watchdog ipi ping"
+       default y
+       help
+         This boolean flag gives the watchdog driver the ability to send a
+         keep-alive ping to other cpu's if it is set to 1. Otherwise, when
+         it is set to 0 no keep alive pings will be sent.
+
+config QCOM_SOC_DEBUG
+       depends on RANDOMIZE_BASE
+       bool "SOC Debug Module"
+       help
+	 This module will write kaslr address to imem to enable debug of
+	 crashes which require loading of vmlinux and ramdumps. It also
+	 keeps SoC watchdog device node enabled when Linux is booted in
+	 hyp mode.
+
+config QCOM_SECURE_BUFFER
+	tristate "Helper functions for secure buffers through TZ"
+	depends on QCOM_SCM
+	help
+	 Enable for targets that need to call into TZ to secure
+	 memory buffers. This ensures that only the correct clients can
+	 use this memory and no unauthorized access is made to the
+	 buffer.
+
+config QCOM_KVM_ENABLED
+       bool "ENABLE KVM support"
+       help
+	 During the build process difference between Gunyah and KVM hypervisors
+	 isn't necessary, but exception like watchdog and PIL loading demand
+	 device tree adjustments based on the hypervisor.
+	 To address this, the QCOM_KVM_ENABLED config is introduced since the
+	 device tree cannot detect Kbuild configurations.
+
+source "drivers/soc/qcom/mem_buf/Kconfig"
+source "drivers/soc/qcom/smcinvoke/Kconfig"
+
+config USB_F_QDSS
+	tristate "QDSS driver"
+	depends on USB_CONFIGFS
+	help
+	  QDSS is a usb function driver aimed for faster debug
+	  functionality by merging interleaving traces and
+	  application SW messaging and transferring it to the host machine
+	  to which the device is connected.
+
 endmenu
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/Makefile
+++ linux-qcom-6.8.0/drivers/soc/qcom/Makefile
@@ -1,11 +1,15 @@
 # SPDX-License-Identifier: GPL-2.0
 CFLAGS_rpmh-rsc.o := -I$(src)
+CFLAGS_qcom_aoss.o := -I$(src)
+obj-$(CONFIG_QCOM_WDT_CORE) += wdt_core.o
 obj-$(CONFIG_QCOM_AOSS_QMP) +=	qcom_aoss.o
 obj-$(CONFIG_QCOM_GENI_SE) +=	qcom-geni-se.o
 obj-$(CONFIG_QCOM_COMMAND_DB) += cmd-db.o
 obj-$(CONFIG_QCOM_GSBI)	+=	qcom_gsbi.o
 obj-$(CONFIG_QCOM_MDT_LOADER)	+= mdt_loader.o
+obj-$(CONFIG_QCOM_MEMORY_DUMP_V2) += memory_dump_v2.o
 obj-$(CONFIG_QCOM_OCMEM)	+= ocmem.o
+obj-$(CONFIG_QCOM_PANEL_EVENT_NOTIFIER)	+= panel_event_notifier.o
 obj-$(CONFIG_QCOM_PDR_HELPERS)	+= pdr_interface.o
 obj-$(CONFIG_QCOM_PMIC_GLINK)	+= pmic_glink.o
 obj-$(CONFIG_QCOM_PMIC_GLINK)	+= pmic_glink_altmode.o
@@ -22,8 +26,10 @@
 obj-$(CONFIG_QCOM_SMD_RPM)	+= rpm-proc.o smd-rpm.o
 obj-$(CONFIG_QCOM_SMEM) +=	smem.o
 obj-$(CONFIG_QCOM_SMEM_STATE) += smem_state.o
+CFLAGS_smp2p.o := -I$(src)
 obj-$(CONFIG_QCOM_SMP2P)	+= smp2p.o
 obj-$(CONFIG_QCOM_SMSM)	+= smsm.o
+obj-$(CONFIG_QCOM_SMP2P_SLEEPSTATE) += smp2p_sleepstate.o
 obj-$(CONFIG_QCOM_SOCINFO)	+= socinfo.o
 obj-$(CONFIG_QCOM_SPM)		+= spm.o
 obj-$(CONFIG_QCOM_STATS)	+= qcom_stats.o
@@ -34,3 +40,9 @@
 obj-$(CONFIG_QCOM_ICC_BWMON)	+= icc-bwmon.o
 qcom_ice-objs			+= ice.o
 obj-$(CONFIG_QCOM_INLINE_CRYPTO_ENGINE)	+= qcom_ice.o
+obj-$(CONFIG_QCOM_MEM_BUF) += mem_buf/
+obj-$(CONFIG_QCOM_SMCINVOKE) += smcinvoke/
+obj-$(CONFIG_QCOM_SOC_DEBUG) += qcom_soc_debug.o
+obj-$(CONFIG_QCOM_SECURE_BUFFER) += secure_buffer.o
+usb_f_qdss-y			:= f_qdss.o
+obj-$(CONFIG_USB_F_QDSS)	+= usb_f_qdss.o
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/apr.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/apr.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
 // Copyright (c) 2018, Linaro Limited
+// Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -298,6 +299,17 @@
 
 	spin_lock_irqsave(&gpr->svcs_lock, flags);
 	svc = idr_find(&gpr->svcs_idr, hdr->dest_port);
+	/*
+	 * dest_port is not fixed for gpr_packet sent from userspace.
+	 * For packets not associated with dest_port, they needs to be
+	 * routed to audio_pkt gpr client.
+	 */
+	if (!svc) {
+		dev_dbg(gpr->dev, "GPR: Port(%x) is not registered, trying with audio_pkt\n",
+				hdr->dest_port);
+		svc = idr_find(&gpr->svcs_idr, 4);
+	}
+
 	spin_unlock_irqrestore(&gpr->svcs_lock, flags);
 
 	if (!svc) {
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/cmd-db.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/cmd-db.c
@@ -1,6 +1,10 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Copyright (c) 2016-2018, 2020, The Linux Foundation. All rights reserved. */
+/*
+ * Copyright (c) 2016-2018, 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
 
+#include <linux/bitfield.h>
 #include <linux/debugfs.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -17,6 +21,8 @@
 #define MAX_SLV_ID		8
 #define SLAVE_ID_MASK		0x7
 #define SLAVE_ID_SHIFT		16
+#define SLAVE_ID(addr)		FIELD_GET(GENMASK(19, 16), addr)
+#define VRM_ADDR(addr)		FIELD_GET(GENMASK(19, 4), addr)
 
 /**
  * struct entry_header: header for each entry in cmddb
@@ -221,6 +227,30 @@
 EXPORT_SYMBOL_GPL(cmd_db_read_aux_data);
 
 /**
+ * cmd_db_match_resource_addr() - Compare if both Resource addresses are same
+ *
+ * @addr1: Resource address to compare
+ * @addr2: Resource address to compare
+ *
+ * Return: true if two addresses refer to the same resource, false otherwise
+ */
+bool cmd_db_match_resource_addr(u32 addr1, u32 addr2)
+{
+	/*
+	 * Each RPMh VRM accelerator resource has 3 or 4 contiguous 4-byte
+	 * aligned addresses associated with it. Ignore the offset to check
+	 * for VRM requests.
+	 */
+	if (addr1 == addr2)
+		return true;
+	else if (SLAVE_ID(addr1) == CMD_DB_HW_VRM && VRM_ADDR(addr1) == VRM_ADDR(addr2))
+		return true;
+
+	return false;
+}
+EXPORT_SYMBOL_GPL(cmd_db_match_resource_addr);
+
+/**
  * cmd_db_read_slave_id - Get the slave ID for a given resource address
  *
  * @id: Resource id to query the DB for version
@@ -324,7 +354,7 @@
 		return -EINVAL;
 	}
 
-	cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WB);
+	cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WC);
 	if (!cmd_db_header) {
 		ret = -ENOMEM;
 		cmd_db_header = NULL;
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/f_qdss.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/f_qdss.c
@@ -0,0 +1,794 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * f_qdss.c -- QDSS function Driver
+ *
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/usb/cdc.h>
+
+#include "f_qdss.h"
+
+static DEFINE_SPINLOCK(channel_lock);
+static LIST_HEAD(usb_qdss_ch_list);
+
+static struct usb_interface_descriptor qdss_data_intf_desc = {
+	.bLength            =	sizeof(qdss_data_intf_desc),
+	.bDescriptorType    =	USB_DT_INTERFACE,
+	.bAlternateSetting  =   0,
+	.bNumEndpoints      =	1,
+	.bInterfaceClass    =	USB_CLASS_VENDOR_SPEC,
+	.bInterfaceSubClass =	USB_SUBCLASS_VENDOR_SPEC,
+	.bInterfaceProtocol =	0x70,
+};
+
+static struct usb_endpoint_descriptor qdss_hs_data_desc = {
+	.bLength              =	 USB_DT_ENDPOINT_SIZE,
+	.bDescriptorType      =	 USB_DT_ENDPOINT,
+	.bEndpointAddress     =	 USB_DIR_IN,
+	.bmAttributes         =	 USB_ENDPOINT_XFER_BULK,
+	.wMaxPacketSize       =	 cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor qdss_ss_data_desc = {
+	.bLength              =	 USB_DT_ENDPOINT_SIZE,
+	.bDescriptorType      =	 USB_DT_ENDPOINT,
+	.bEndpointAddress     =	 USB_DIR_IN,
+	.bmAttributes         =  USB_ENDPOINT_XFER_BULK,
+	.wMaxPacketSize       =	 cpu_to_le16(1024),
+};
+
+static struct usb_ss_ep_comp_descriptor qdss_data_ep_comp_desc = {
+	.bLength              =	 sizeof(qdss_data_ep_comp_desc),
+	.bDescriptorType      =	 USB_DT_SS_ENDPOINT_COMP,
+	.bMaxBurst            =	 1,
+	.bmAttributes         =	 0,
+	.wBytesPerInterval    =	 0,
+};
+
+static struct usb_endpoint_descriptor qdss_fs_data_desc = {
+	.bLength            =	USB_DT_ENDPOINT_SIZE,
+	.bDescriptorType    =	USB_DT_ENDPOINT,
+	.bEndpointAddress   =	USB_DIR_IN,
+	.bmAttributes       =	USB_ENDPOINT_XFER_BULK,
+	.wMaxPacketSize     =	cpu_to_le16(64),
+};
+
+static struct usb_descriptor_header *qdss_fs_data_only_desc[] = {
+	(struct usb_descriptor_header *) &qdss_data_intf_desc,
+	(struct usb_descriptor_header *) &qdss_fs_data_desc,
+	NULL,
+};
+
+static struct usb_descriptor_header *qdss_hs_data_only_desc[] = {
+	(struct usb_descriptor_header *) &qdss_data_intf_desc,
+	(struct usb_descriptor_header *) &qdss_hs_data_desc,
+	NULL,
+};
+
+static struct usb_descriptor_header *qdss_ss_data_only_desc[] = {
+	(struct usb_descriptor_header *) &qdss_data_intf_desc,
+	(struct usb_descriptor_header *) &qdss_ss_data_desc,
+	(struct usb_descriptor_header *) &qdss_data_ep_comp_desc,
+	NULL,
+};
+
+/* string descriptors: */
+#define QDSS_DATA_IDX	0
+
+static struct usb_string qdss_string_defs[] = {
+	[QDSS_DATA_IDX].s = "QDSS DATA",
+	{}, /* end of list */
+};
+
+static struct usb_gadget_strings qdss_string_table = {
+	.language =		0x0409,
+	.strings =		qdss_string_defs,
+};
+
+static struct usb_gadget_strings *qdss_strings[] = {
+	&qdss_string_table,
+	NULL,
+};
+
+static void qdss_disable(struct usb_function *f);
+
+static inline struct f_qdss *func_to_qdss(struct usb_function *f)
+{
+	return container_of(f, struct f_qdss, port.function);
+}
+
+static
+struct usb_qdss_opts *to_fi_usb_qdss_opts(struct usb_function_instance *fi)
+{
+	return container_of(fi, struct usb_qdss_opts, func_inst);
+}
+
+/*----------------------------------------------------------------------*/
+
+static void qdss_write_complete(struct usb_ep *ep,
+				struct usb_request *req)
+{
+	struct f_qdss *qdss = ep->driver_data;
+	struct qdss_req *qreq = req->context;
+	struct qdss_request *d_req = qreq->qdss_req;
+	unsigned long flags;
+
+	spin_lock_irqsave(&qdss->lock, flags);
+	list_move_tail(&qreq->list, &qdss->data_write_pool);
+
+	/*
+	 * When channel is closed, we move all queued requests to
+	 * dequeued_data_pool list and wait for it to be drained.
+	 * Signal the completion here if the channel is closed
+	 * and both queued & dequeued lists are empty.
+	 */
+	if (!qdss->opened && list_empty(&qdss->dequeued_data_pool) &&
+			list_empty(&qdss->queued_data_pool))
+		complete(&qdss->dequeue_done);
+
+	if (req->length != 0) {
+		d_req->actual = req->actual;
+		d_req->status = req->status;
+	}
+	spin_unlock_irqrestore(&qdss->lock, flags);
+
+	if (qdss->ch.notify)
+		qdss->ch.notify(qdss->ch.priv,
+			USB_QDSS_DATA_WRITE_DONE, d_req, NULL);
+}
+
+static void qdss_free_reqs(struct f_qdss *qdss)
+{
+	struct list_head *act, *tmp;
+	struct qdss_req *qreq;
+	unsigned long flags;
+
+	lockdep_assert_held(&qdss->mutex);
+	/* These are critical list operations which can race
+	 * with qdss_write/write_complete, therefore protect
+	 * them under spin_lock.
+	 */
+	spin_lock_irqsave(&qdss->lock, flags);
+
+	list_for_each_safe(act, tmp, &qdss->data_write_pool) {
+		qreq = list_entry(act, struct qdss_req, list);
+		list_del(&qreq->list);
+		usb_ep_free_request(qdss->port.data, qreq->usb_req);
+		kfree(qreq);
+	}
+
+	spin_unlock_irqrestore(&qdss->lock, flags);
+}
+
+void usb_qdss_free_req(struct usb_qdss_ch *ch)
+{
+	struct f_qdss *qdss = container_of(ch, struct f_qdss, ch);
+
+	if (!ch) {
+		pr_err("%s: ch is NULL\n", __func__);
+		return;
+	}
+
+	mutex_lock(&qdss->mutex);
+	if (!qdss->opened)
+		pr_err("%s: channel %s closed\n", __func__, ch->name);
+	else
+		qdss_free_reqs(qdss);
+	mutex_unlock(&qdss->mutex);
+}
+EXPORT_SYMBOL_GPL(usb_qdss_free_req);
+
+int usb_qdss_alloc_req(struct usb_qdss_ch *ch, int no_write_buf)
+{
+	struct f_qdss *qdss = container_of(ch, struct f_qdss, ch);
+	struct usb_request *req;
+	struct usb_ep *in;
+	struct list_head *list_pool;
+	int i;
+	struct qdss_req *qreq;
+	unsigned long flags;
+
+	if (!ch) {
+		pr_err("%s: ch is NULL\n", __func__);
+		return -EINVAL;
+	}
+
+	if (!qdss) {
+		pr_err("%s: %s closed\n", __func__, ch->name);
+		return -ENODEV;
+	}
+
+	mutex_lock(&qdss->mutex);
+
+	in = qdss->port.data;
+	list_pool = &qdss->data_write_pool;
+
+	for (i = 0; i < no_write_buf; i++) {
+		qreq = kzalloc(sizeof(struct qdss_req), GFP_KERNEL);
+		if (!qreq)
+			goto fail;
+
+		req = usb_ep_alloc_request(in, GFP_KERNEL);
+		if (!req) {
+			pr_err("%s: data in allocation err\n", __func__);
+			kfree(qreq);
+			goto fail;
+		}
+		/* Insure qreq is protected while assigning the request
+		 * This can potentially race with free_req
+		 */
+
+		spin_lock_irqsave(&qdss->lock, flags);
+		qreq->usb_req = req;
+		req->context = qreq;
+		req->complete = qdss_write_complete;
+		list_add_tail(&qreq->list, list_pool);
+		spin_unlock_irqrestore(&qdss->lock, flags);
+	}
+
+	mutex_unlock(&qdss->mutex);
+	return 0;
+
+fail:
+	qdss_free_reqs(qdss);
+	mutex_unlock(&qdss->mutex);
+	return -ENOMEM;
+}
+EXPORT_SYMBOL_GPL(usb_qdss_alloc_req);
+
+static void clear_eps(struct usb_function *f)
+{
+	struct f_qdss *qdss = func_to_qdss(f);
+
+	if (qdss->port.data)
+		qdss->port.data->driver_data = NULL;
+}
+
+static int qdss_bind(struct usb_configuration *c, struct usb_function *f)
+{
+	struct usb_gadget *gadget = c->cdev->gadget;
+	struct f_qdss *qdss = func_to_qdss(f);
+	struct usb_ep *ep;
+	int iface, id, ret;
+
+	/* Allocate data I/F */
+	iface = usb_interface_id(c, f);
+	if (iface < 0) {
+		pr_err("interface allocation error\n");
+		return iface;
+	}
+	qdss_data_intf_desc.bInterfaceNumber = iface;
+	qdss->data_iface_id = iface;
+
+	if (!qdss_string_defs[QDSS_DATA_IDX].id) {
+		id = usb_string_id(c->cdev);
+		if (id < 0)
+			return id;
+
+		qdss_string_defs[QDSS_DATA_IDX].id = id;
+		qdss_data_intf_desc.iInterface = id;
+	}
+
+	ep = usb_ep_autoconfig(gadget, &qdss_fs_data_desc);
+	if (!ep) {
+		pr_err("%s: ep_autoconfig error\n", __func__);
+		return -EOPNOTSUPP;
+	}
+	qdss->port.data = ep;
+	ep->driver_data = qdss;
+
+	/* update hs/ss descriptors */
+	qdss_hs_data_desc.bEndpointAddress =
+		qdss_ss_data_desc.bEndpointAddress =
+			qdss_fs_data_desc.bEndpointAddress;
+
+	ret = usb_assign_descriptors(f, qdss_fs_data_only_desc,
+			qdss_hs_data_only_desc, qdss_ss_data_only_desc,
+			qdss_ss_data_only_desc);
+
+	if (ret)
+		goto clear_ep;
+
+	return 0;
+
+clear_ep:
+	clear_eps(f);
+
+	return -EOPNOTSUPP;
+}
+
+
+static void qdss_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+	struct f_qdss  *qdss = func_to_qdss(f);
+
+	qdss_disable(f);
+	flush_workqueue(qdss->wq);
+
+	/* Reset string ids */
+	qdss_string_defs[QDSS_DATA_IDX].id = 0;
+
+	clear_eps(f);
+	usb_free_all_descriptors(f);
+}
+
+static void qdss_eps_disable(struct usb_function *f)
+{
+	struct f_qdss  *qdss = func_to_qdss(f);
+
+	if (qdss->data_enabled) {
+		usb_ep_disable(qdss->port.data);
+		qdss->data_enabled = 0;
+	}
+}
+
+static void usb_qdss_disconnect_work(struct work_struct *work)
+{
+	struct f_qdss *qdss = container_of(work, struct f_qdss, disconnect_w);
+
+	/* Notify qdss to cancel all active transfers */
+	if (qdss->ch.notify)
+		qdss->ch.notify(qdss->ch.priv,
+			USB_QDSS_DISCONNECT, NULL, NULL);
+}
+
+static void qdss_disable(struct usb_function *f)
+{
+	struct f_qdss	*qdss = func_to_qdss(f);
+	unsigned long flags;
+
+	spin_lock_irqsave(&qdss->lock, flags);
+
+	if (!qdss->usb_connected) {
+		spin_unlock_irqrestore(&qdss->lock, flags);
+		return;
+	}
+
+	qdss->usb_connected = 0;
+	/*cancell all active xfers*/
+	spin_unlock_irqrestore(&qdss->lock, flags);
+	qdss_eps_disable(f);
+	queue_work(qdss->wq, &qdss->disconnect_w);
+}
+
+static void usb_qdss_connect_work(struct work_struct *work)
+{
+	struct f_qdss *qdss = container_of(work, struct f_qdss, connect_w);
+
+	/* If cable is already removed, discard connect_work */
+	if (qdss->usb_connected == 0) {
+		cancel_work_sync(&qdss->disconnect_w);
+		return;
+	}
+
+	if (qdss->opened && qdss->ch.notify)
+		qdss->ch.notify(qdss->ch.priv, USB_QDSS_CONNECT,
+						NULL, &qdss->ch);
+}
+
+static int qdss_set_alt(struct usb_function *f, unsigned int intf,
+				unsigned int alt)
+{
+	struct f_qdss  *qdss = func_to_qdss(f);
+	struct usb_gadget *gadget = f->config->cdev->gadget;
+	int ret = 0;
+
+	qdss->gadget = gadget;
+
+	if (alt != 0)
+		return -EINVAL;
+
+	if (gadget->speed < USB_SPEED_HIGH) {
+		pr_err("%s: qdss doesn't support USB full or low speed\n",
+								__func__);
+		return -EINVAL;
+	}
+
+	if (intf == qdss->data_iface_id && !qdss->data_enabled) {
+
+		ret = config_ep_by_speed(gadget, f, qdss->port.data);
+		if (ret) {
+			pr_err("%s: failed config_ep_by_speed ret:%d\n",
+							__func__, ret);
+			return ret;
+		}
+
+		ret = usb_ep_enable(qdss->port.data);
+		if (ret) {
+			pr_err("%s: failed to enable ep ret:%d\n",
+							__func__, ret);
+			return ret;
+		}
+
+		qdss->port.data->driver_data = qdss;
+		qdss->data_enabled = 1;
+	}
+
+	if (qdss->data_enabled)
+		qdss->usb_connected = 1;
+
+	if (qdss->usb_connected)
+		queue_work(qdss->wq, &qdss->connect_w);
+
+	return 0;
+}
+
+static struct f_qdss *alloc_usb_qdss(char *channel_name)
+{
+	struct f_qdss *qdss;
+	int found = 0;
+	struct usb_qdss_ch *ch;
+	unsigned long flags;
+
+	spin_lock_irqsave(&channel_lock, flags);
+	list_for_each_entry(ch, &usb_qdss_ch_list, list) {
+		if (!strcmp(channel_name, ch->name)) {
+			found = 1;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&channel_lock, flags);
+
+	if (found) {
+		pr_err("%s: (%s) is already available.\n",
+				__func__, channel_name);
+		return ERR_PTR(-EEXIST);
+	}
+
+	qdss = kzalloc(sizeof(struct f_qdss), GFP_KERNEL);
+	if (!qdss)
+		return ERR_PTR(-ENOMEM);
+
+	qdss->wq = create_singlethread_workqueue(channel_name);
+	if (!qdss->wq) {
+		kfree(qdss);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	spin_lock_irqsave(&channel_lock, flags);
+	ch = &qdss->ch;
+	ch->name = channel_name;
+
+	list_add_tail(&ch->list, &usb_qdss_ch_list);
+	spin_unlock_irqrestore(&channel_lock, flags);
+
+	spin_lock_init(&qdss->lock);
+	INIT_LIST_HEAD(&qdss->data_write_pool);
+	INIT_LIST_HEAD(&qdss->queued_data_pool);
+	INIT_LIST_HEAD(&qdss->dequeued_data_pool);
+	INIT_WORK(&qdss->connect_w, usb_qdss_connect_work);
+	INIT_WORK(&qdss->disconnect_w, usb_qdss_disconnect_work);
+	mutex_init(&qdss->mutex);
+	init_completion(&qdss->dequeue_done);
+
+	return qdss;
+}
+
+int usb_qdss_write(struct usb_qdss_ch *ch, struct qdss_request *d_req)
+{
+	struct f_qdss *qdss = container_of(ch, struct f_qdss, ch);
+	unsigned long flags;
+	struct usb_request *req = NULL;
+	struct qdss_req *qreq;
+
+	if (!ch) {
+		pr_err("%s: ch is NULL\n", __func__);
+		return -EINVAL;
+	}
+
+	/* There is a possible scenario where the qdss_write &
+	 * qdss_close can race if the close call is made in
+	 * between a write request. This will result in all
+	 * requests freed during the write operations leaving
+	 * the driver with stale list.
+	 */
+	mutex_lock(&qdss->mutex);
+	/* Possible race with qdss_close corrupting the
+	 * data_write_pool.
+	 */
+
+	spin_lock_irqsave(&qdss->lock, flags);
+
+	if (!qdss->opened || !qdss->usb_connected) {
+		spin_unlock_irqrestore(&qdss->lock, flags);
+		mutex_unlock(&qdss->mutex);
+		return -EIO;
+	}
+
+	if (list_empty(&qdss->data_write_pool)) {
+		pr_err("error: usb_qdss_data_write list is empty\n");
+		spin_unlock_irqrestore(&qdss->lock, flags);
+		mutex_unlock(&qdss->mutex);
+		return -EAGAIN;
+	}
+
+	qreq = list_first_entry(&qdss->data_write_pool, struct qdss_req,
+		list);
+	list_move_tail(&qreq->list, &qdss->queued_data_pool);
+	spin_unlock_irqrestore(&qdss->lock, flags);
+
+	qreq->qdss_req = d_req;
+	req = qreq->usb_req;
+	req->buf = d_req->buf;
+	req->length = d_req->length;
+	req->sg = d_req->sg;
+	req->num_sgs = d_req->num_sgs;
+
+	if (usb_ep_queue(qdss->port.data, req, GFP_KERNEL)) {
+		spin_lock_irqsave(&qdss->lock, flags);
+		/* Remove from queued pool and add back to data pool.
+		 * Protech the list operation inside spinlock to avoid
+		 * the list getting corrupted.
+		 */
+		list_move_tail(&qreq->list, &qdss->data_write_pool);
+		spin_unlock_irqrestore(&qdss->lock, flags);
+		pr_err("qdss usb_ep_queue failed\n");
+		mutex_unlock(&qdss->mutex);
+		return -EIO;
+	}
+
+	mutex_unlock(&qdss->mutex);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(usb_qdss_write);
+
+struct usb_qdss_ch *usb_qdss_open(const char *name, void *priv,
+	void (*notify)(void *priv, unsigned int event,
+		struct qdss_request *d_req, struct usb_qdss_ch *))
+{
+	struct usb_qdss_ch *ch = NULL;
+	struct usb_qdss_ch *tmp_ch;
+	struct f_qdss *qdss = NULL;
+	unsigned long flags;
+
+	if (!notify) {
+		pr_err("%s: notification func is missing\n", __func__);
+		return NULL;
+	}
+	/* Protech qdss instance from getting freed */
+	spin_lock_irqsave(&channel_lock, flags);
+
+	list_for_each_entry(tmp_ch, &usb_qdss_ch_list, list) {
+		if (!strcmp(name, tmp_ch->name)) {
+			ch = tmp_ch;
+			qdss = container_of(ch, struct f_qdss, ch);
+			break;
+		}
+	}
+
+	spin_unlock_irqrestore(&channel_lock, flags);
+	if (!ch || !qdss)
+		return NULL;
+
+	mutex_lock(&qdss->mutex);
+	ch->priv = priv;
+	ch->notify = notify;
+	qdss->opened = true;
+	reinit_completion(&qdss->dequeue_done);
+
+	/* the case USB cabel was connected before qdss called qdss_open */
+	if (qdss->usb_connected)
+		queue_work(qdss->wq, &qdss->connect_w);
+
+	mutex_unlock(&qdss->mutex);
+	return ch;
+}
+EXPORT_SYMBOL_GPL(usb_qdss_open);
+
+void usb_qdss_close(struct usb_qdss_ch *ch)
+{
+	struct f_qdss *qdss = container_of(ch, struct f_qdss, ch);
+	unsigned long flags;
+	struct qdss_req *qreq;
+	bool do_wait;
+
+	if (!ch) {
+		pr_err("%s: ch is NULL\n", __func__);
+		return;
+	}
+
+	mutex_lock(&qdss->mutex);
+	if (!qdss->opened) {
+		pr_err("%s: channel %s closed\n", __func__, ch->name);
+		mutex_unlock(&qdss->mutex);
+		return;
+	}
+
+	spin_lock_irqsave(&qdss->lock, flags);
+	qdss->opened = false;
+	/*
+	 * Some UDCs like DWC3 stop the endpoint transfer upon dequeue
+	 * of a request and retire all the previously *started* requests.
+	 * This introduces a race between the below dequeue loop and
+	 * retiring of all started requests. As soon as we drop the lock
+	 * here before dequeue, the request gets retired and UDC thinks
+	 * we are dequeuing a request that was not queued before. To
+	 * avoid this problem, lets dequeue the requests in the reverse
+	 * order.
+	 */
+	while (!list_empty(&qdss->queued_data_pool)) {
+		qreq = list_last_entry(&qdss->queued_data_pool,
+				struct qdss_req, list);
+		list_move_tail(&qreq->list, &qdss->dequeued_data_pool);
+		spin_unlock_irqrestore(&qdss->lock, flags);
+		/* Perform dequeue operation outside spinlock */
+		usb_ep_dequeue(qdss->port.data, qreq->usb_req);
+		spin_lock_irqsave(&qdss->lock, flags);
+	}
+
+	/*
+	 * It's possible that requests may be completed synchronously during
+	 * usb_ep_dequeue() and would have already been moved back to
+	 * data_write_pool.  So make sure to check that our dequeued_data_pool
+	 * is empty. If not, wait for it to happen. The request completion
+	 * handler would signal us when this list is empty and channel close
+	 * is in progress.
+	 */
+	do_wait = !list_empty(&qdss->dequeued_data_pool);
+	spin_unlock_irqrestore(&qdss->lock, flags);
+
+	if (do_wait)
+		wait_for_completion(&qdss->dequeue_done);
+
+	WARN_ON(!list_empty(&qdss->dequeued_data_pool));
+
+	qdss_free_reqs(qdss);
+	ch->notify = NULL;
+	mutex_unlock(&qdss->mutex);
+}
+EXPORT_SYMBOL_GPL(usb_qdss_close);
+
+static void qdss_cleanup(void)
+{
+	struct f_qdss *qdss;
+	struct list_head *act, *tmp;
+	struct usb_qdss_ch *_ch;
+	unsigned long flags;
+
+	list_for_each_safe(act, tmp, &usb_qdss_ch_list) {
+		_ch = list_entry(act, struct usb_qdss_ch, list);
+		qdss = container_of(_ch, struct f_qdss, ch);
+		destroy_workqueue(qdss->wq);
+		/* Protect the channel with channel_lock to
+		 * avoid races with alloc & open functions
+		 */
+
+		spin_lock_irqsave(&channel_lock, flags);
+		if (!_ch->priv) {
+			list_del(&_ch->list);
+			kfree(qdss);
+		}
+		spin_unlock_irqrestore(&channel_lock, flags);
+	}
+}
+
+static void qdss_free_func(struct usb_function *f)
+{ }
+
+static inline struct usb_qdss_opts *to_f_qdss_opts(struct config_item *item)
+{
+	return container_of(to_config_group(item), struct usb_qdss_opts,
+			func_inst.group);
+}
+
+
+static void qdss_attr_release(struct config_item *item)
+{
+	struct usb_qdss_opts *opts = to_f_qdss_opts(item);
+
+	usb_put_function_instance(&opts->func_inst);
+}
+
+static struct configfs_item_operations qdss_item_ops = {
+	.release	= qdss_attr_release,
+};
+
+static struct config_item_type qdss_func_type = {
+	.ct_item_ops	= &qdss_item_ops,
+	.ct_owner	= THIS_MODULE,
+};
+
+static void usb_qdss_free_inst(struct usb_function_instance *fi)
+{
+	struct usb_qdss_opts *opts;
+
+	opts = container_of(fi, struct usb_qdss_opts, func_inst);
+	kfree(opts->usb_qdss);
+	kfree(opts);
+}
+
+static int usb_qdss_set_inst_name(struct usb_function_instance *f,
+				const char *name)
+{
+	struct usb_qdss_opts *opts =
+		container_of(f, struct usb_qdss_opts, func_inst);
+	char *ptr;
+	size_t name_len;
+	struct f_qdss *usb_qdss;
+
+	/* get channel_name as expected input qdss.<channel_name> */
+	name_len = strlen(name) + 1;
+	if (name_len > 15)
+		return -ENAMETOOLONG;
+
+	/* get channel name */
+	ptr = kstrndup(name, name_len, GFP_KERNEL);
+	if (!ptr) {
+		pr_err("error:%ld\n", PTR_ERR(ptr));
+		return -ENOMEM;
+	}
+
+	opts->channel_name = ptr;
+
+	usb_qdss = alloc_usb_qdss(opts->channel_name);
+	if (IS_ERR(usb_qdss)) {
+		pr_err("Failed to create usb_qdss port(%s)\n",
+				opts->channel_name);
+		return -ENOMEM;
+	}
+
+	opts->usb_qdss = usb_qdss;
+	return 0;
+}
+
+static struct usb_function_instance *qdss_alloc_inst(void)
+{
+	struct usb_qdss_opts *opts;
+
+	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
+	if (!opts)
+		return ERR_PTR(-ENOMEM);
+
+	opts->func_inst.free_func_inst = usb_qdss_free_inst;
+	opts->func_inst.set_inst_name = usb_qdss_set_inst_name;
+
+	config_group_init_type_name(&opts->func_inst.group, "",
+				    &qdss_func_type);
+	return &opts->func_inst;
+}
+
+static struct usb_function *qdss_alloc(struct usb_function_instance *fi)
+{
+	struct usb_qdss_opts *opts = to_fi_usb_qdss_opts(fi);
+	struct f_qdss *usb_qdss = opts->usb_qdss;
+
+	usb_qdss->port.function.name = "usb_qdss";
+	usb_qdss->port.function.strings = qdss_strings;
+	usb_qdss->port.function.bind = qdss_bind;
+	usb_qdss->port.function.unbind = qdss_unbind;
+	usb_qdss->port.function.set_alt = qdss_set_alt;
+	usb_qdss->port.function.disable = qdss_disable;
+	usb_qdss->port.function.setup = NULL;
+	usb_qdss->port.function.free_func = qdss_free_func;
+
+	return &usb_qdss->port.function;
+}
+
+DECLARE_USB_FUNCTION(qdss, qdss_alloc_inst, qdss_alloc);
+static int __init usb_qdss_init(void)
+{
+	int ret = 0;
+
+	INIT_LIST_HEAD(&usb_qdss_ch_list);
+	ret = usb_function_register(&qdssusb_func);
+	if (ret)
+		pr_err("%s: failed to register qdss %d\n", __func__, ret);
+
+	return ret;
+}
+
+static void __exit usb_qdss_exit(void)
+{
+	usb_function_unregister(&qdssusb_func);
+	qdss_cleanup();
+}
+
+module_init(usb_qdss_init);
+module_exit(usb_qdss_exit);
+MODULE_DESCRIPTION("USB QDSS Function Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/f_qdss.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/f_qdss.h
@@ -0,0 +1,113 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _F_QDSS_H
+#define _F_QDSS_H
+
+#include <linux/completion.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+#include <linux/usb/composite.h>
+#include <linux/soc/qcom/usb_qdss.h>
+
+/**
+ *  struct usb_qdss_ch - Usb qdss channel structure
+ *  @name: Used to store channel name.
+ *  @list: Current active list in a function.
+ *  @notify: usb_notifier use to notify the coresight driver.
+ *  @priv: Private data of the channel used for referencing tmc.
+ */
+struct usb_qdss_ch {
+	const char *name;
+	struct list_head list;
+	void (*notify)(void *priv, unsigned int event,
+		struct qdss_request *d_req, struct usb_qdss_ch *ch);
+	void *priv;
+};
+
+/**
+ *  struct gqdss - Structure of qdss saving the function & ep instance
+ *  @function: Reference to usb_function  for configfs linkage.
+ *  @data: Usb endpoint reference used to data transfer.
+ */
+struct gqdss {
+	struct usb_function function;
+	struct usb_ep *data;
+};
+
+/**
+ *  struct f_qdss - Usb qdss function driver structure
+ *  @port: Contains the function & ep data info.
+ *  @gadget: Reference to usb_gadget driver.
+ *  @data_iface_id: Saves the usb_interface_id to data transfers.
+ *  @usb_connected: Indicated if usb is connected.
+ *  @ch: Reference to the channel used by coresight for data transfer.
+ *  @data_write_pool: Used during allocation to save the requests to be used.
+ *  @queued_data_pool: Used to mark the request in process state, waiting for
+ *		       completion.
+ *  @dequeued_data_pool: Used when channel is closed to wait for request to be
+ *			 drained.
+ *  @connect_w: Connect workqueue used to send notification to coresight driver.
+ *  @disconnect_w: Disconnect workqueue used to send notification to coresight
+ *		   driver.
+ *  @lock: Spinlock used to protect the port instance from racing.
+ *  @data_enabled: Used to mark if data flow enabled.
+ *  @wq: Workqueue to carry out the conect/disconnect works.
+ *  @mutex: Used to protect the data_write_pool & open variable.
+ *  @opened: Used to mark channel open/close.
+ *  @dequeue_done: Completion marker for dequeue completion.
+ */
+struct f_qdss {
+	struct gqdss port;
+	struct usb_gadget *gadget;
+	u8 data_iface_id;
+	int usb_connected;
+	struct usb_qdss_ch ch;
+
+	struct list_head data_write_pool;
+	struct list_head queued_data_pool;
+	struct list_head dequeued_data_pool;
+
+	struct work_struct connect_w;
+	struct work_struct disconnect_w;
+	spinlock_t lock;
+	unsigned int data_enabled:1;
+	struct workqueue_struct *wq;
+
+	struct mutex mutex;
+	bool opened;	/* protected by 'mutex' */
+	struct completion dequeue_done;
+};
+
+/**
+ *  struct usb_qdss_opts - Usb qdss ops structure used for functionality
+ *			   with configfs.
+ *  @func_inst: usb function instacne reference to the driver.
+ *  @usb_qdss: References to f_qdss variable.
+ *  @channel_name: Name of the active channel.
+ */
+struct usb_qdss_opts {
+	struct usb_function_instance func_inst;
+	struct f_qdss *usb_qdss;
+	char *channel_name;
+};
+
+/**
+ *  struct qdss_req - Usb qdss request structure for write operation
+ *		      by coresight driver.
+ *  @usb_req: Reference to the usb requests to be queued.
+ *  @qdss_req: Reference to the qdss_request used by coresight.
+ *  @list: List head to save the request during ops for moving from
+ *	   one pool to another.
+ */
+struct qdss_req {
+	struct usb_request *usb_req;
+	struct qdss_request *qdss_req;
+	struct list_head list;
+};
+
+#endif /* _F_QDSS_H */
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/icc-bwmon.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/icc-bwmon.c
@@ -565,7 +565,7 @@
 	int window;
 
 	/* No need to check for errors, as this must have succeeded before. */
-	dev_pm_opp_find_bw_ceil(bwmon->dev, &bw_low, 0);
+	dev_pm_opp_put(dev_pm_opp_find_bw_ceil(bwmon->dev, &bw_low, 0));
 
 	bwmon_clear_counters(bwmon, true);
 
@@ -772,18 +772,25 @@
 	opp = dev_pm_opp_find_bw_floor(dev, &bwmon->max_bw_kbps, 0);
 	if (IS_ERR(opp))
 		return dev_err_probe(dev, PTR_ERR(opp), "failed to find max peak bandwidth\n");
+	dev_pm_opp_put(opp);
 
 	bwmon->min_bw_kbps = 0;
 	opp = dev_pm_opp_find_bw_ceil(dev, &bwmon->min_bw_kbps, 0);
 	if (IS_ERR(opp))
 		return dev_err_probe(dev, PTR_ERR(opp), "failed to find min peak bandwidth\n");
+	dev_pm_opp_put(opp);
 
 	bwmon->dev = dev;
 
 	bwmon_disable(bwmon);
-	ret = devm_request_threaded_irq(dev, bwmon->irq, bwmon_intr,
-					bwmon_intr_thread,
-					IRQF_ONESHOT, dev_name(dev), bwmon);
+
+	/*
+	 * SoCs with multiple cpu-bwmon instances can end up using a shared interrupt
+	 * line. Using the devm_ variant might result in the IRQ handler being executed
+	 * after bwmon_disable in bwmon_remove()
+	 */
+	ret = request_threaded_irq(bwmon->irq, bwmon_intr, bwmon_intr_thread,
+				   IRQF_ONESHOT | IRQF_SHARED, dev_name(dev), bwmon);
 	if (ret)
 		return dev_err_probe(dev, ret, "failed to request IRQ\n");
 
@@ -798,6 +805,7 @@
 	struct icc_bwmon *bwmon = platform_get_drvdata(pdev);
 
 	bwmon_disable(bwmon);
+	free_irq(bwmon->irq, bwmon);
 }
 
 static const struct icc_bwmon_data msm8998_bwmon_data = {
@@ -815,7 +823,7 @@
 static const struct icc_bwmon_data sdm845_cpu_bwmon_data = {
 	.sample_ms = 4,
 	.count_unit_kb = 64,
-	.zone1_thres_count = 16,
+	.zone1_thres_count = 3,
 	.zone3_thres_count = 1,
 	.quirks = BWMON_HAS_GLOBAL_IRQ,
 	.regmap_fields = sdm845_cpu_bwmon_reg_fields,
@@ -834,7 +842,7 @@
 static const struct icc_bwmon_data sc7280_llcc_bwmon_data = {
 	.sample_ms = 4,
 	.count_unit_kb = 64,
-	.zone1_thres_count = 16,
+	.zone1_thres_count = 3,
 	.zone3_thres_count = 1,
 	.quirks = BWMON_NEEDS_FORCE_CLEAR,
 	.regmap_fields = sdm845_llcc_bwmon_reg_fields,
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/ice.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/ice.c
@@ -5,6 +5,7 @@
  * Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.
  * Copyright (c) 2019, Google LLC
  * Copyright (c) 2023, Linaro Limited
+ * Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/bitfield.h>
@@ -15,17 +16,41 @@
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
 
+#include <linux/of_address.h>
 #include <linux/firmware/qcom/qcom_scm.h>
 
 #include <soc/qcom/ice.h>
 
 #define AES_256_XTS_KEY_SIZE			64
 
+/*
+ * Wrapped key sizes from HWKm is different for different versions of
+ * HW. It is not expected to change again in the future.
+ */
+#define QCOM_ICE_HWKM_WRAPPED_KEY_SIZE(v)	\
+	((v) == 1 ? 68 : 100)
+
 /* QCOM ICE registers */
 #define QCOM_ICE_REG_VERSION			0x0008
 #define QCOM_ICE_REG_FUSE_SETTING		0x0010
 #define QCOM_ICE_REG_BIST_STATUS		0x0070
 #define QCOM_ICE_REG_ADVANCED_CONTROL		0x1000
+#define QCOM_ICE_REG_CONTROL			0x0
+#define QCOM_ICE_LUT_KEYS_CRYPTOCFG_R16		0x4040
+
+/* QCOM ICE HWKM registers */
+#define QCOM_ICE_REG_HWKM_TZ_KM_CTL			0x1000
+#define QCOM_ICE_REG_HWKM_TZ_KM_STATUS			0x1004
+#define QCOM_ICE_REG_HWKM_BANK0_BANKN_IRQ_STATUS	0x2008
+#define QCOM_ICE_REG_HWKM_BANK0_BBAC_0			0x5000
+#define QCOM_ICE_REG_HWKM_BANK0_BBAC_1			0x5004
+#define QCOM_ICE_REG_HWKM_BANK0_BBAC_2			0x5008
+#define QCOM_ICE_REG_HWKM_BANK0_BBAC_3			0x500C
+#define QCOM_ICE_REG_HWKM_BANK0_BBAC_4			0x5010
+
+/* QCOM ICE HWKM BIST vals */
+#define QCOM_ICE_HWKM_BIST_DONE_V1_VAL		0x14007
+#define QCOM_ICE_HWKM_BIST_DONE_V2_VAL		0x287
 
 /* BIST ("built-in self-test") status flags */
 #define QCOM_ICE_BIST_STATUS_MASK		GENMASK(31, 28)
@@ -34,18 +59,40 @@
 #define QCOM_ICE_FORCE_HW_KEY0_SETTING_MASK	0x2
 #define QCOM_ICE_FORCE_HW_KEY1_SETTING_MASK	0x4
 
+#define QCOM_ICE_LUT_KEYS_CRYPTOCFG_OFFSET	0x80
+
+#define QCOM_ICE_HWKM_REG_OFFSET	0x8000
+#define HWKM_OFFSET(reg)		((reg) + QCOM_ICE_HWKM_REG_OFFSET)
+
 #define qcom_ice_writel(engine, val, reg)	\
 	writel((val), (engine)->base + (reg))
 
 #define qcom_ice_readl(engine, reg)	\
 	readl((engine)->base + (reg))
 
+static bool qcom_ice_create_error;
+
 struct qcom_ice {
 	struct device *dev;
 	void __iomem *base;
 	struct device_link *link;
 
 	struct clk *core_clk;
+	u8 hwkm_version;
+	bool use_hwkm;
+	bool hwkm_init_complete;
+	uint32_t max_freq;
+	uint32_t min_freq;
+};
+
+union crypto_cfg {
+	__le32 regval;
+	struct {
+		u8 dusize;
+		u8 capidx;
+		u8 reserved;
+		u8 cfge;
+	};
 };
 
 static bool qcom_ice_check_supported(struct qcom_ice *ice)
@@ -63,8 +110,26 @@
 		return false;
 	}
 
+	if (major >= 4 || (major == 3 && minor == 2 && step >= 1))
+		ice->hwkm_version = 2;
+	else if (major == 3 && minor == 2)
+		ice->hwkm_version = 1;
+	else
+		ice->hwkm_version = 0;
+
+	if (ice->hwkm_version == 0)
+		ice->use_hwkm = false;
+
 	dev_info(dev, "Found QC Inline Crypto Engine (ICE) v%d.%d.%d\n",
 		 major, minor, step);
+	if (!ice->hwkm_version)
+		dev_info(dev, "QC ICE HWKM (Hardware Key Manager) not supported");
+	else
+		dev_info(dev, "QC ICE HWKM (Hardware Key Manager) version = %d",
+			 ice->hwkm_version);
+
+	if (!ice->use_hwkm)
+		dev_info(dev, "QC ICE HWKM (Hardware Key Manager) not used\n");
 
 	/* If fuses are blown, ICE might not work in the standard way. */
 	regval = qcom_ice_readl(ice, QCOM_ICE_REG_FUSE_SETTING);
@@ -113,10 +178,14 @@
  * fails, so we needn't do it in software too, and (c) properly testing
  * storage encryption requires testing the full storage stack anyway,
  * and not relying on hardware-level self-tests.
+ *
+ * However, we still care about if HWKM BIST failed (when supported) as
+ * important functionality would fail later, so disable hwkm on failure.
  */
 static int qcom_ice_wait_bist_status(struct qcom_ice *ice)
 {
 	u32 regval;
+	u32 bist_done_val;
 	int err;
 
 	err = readl_poll_timeout(ice->base + QCOM_ICE_REG_BIST_STATUS,
@@ -125,15 +194,97 @@
 	if (err)
 		dev_err(ice->dev, "Timed out waiting for ICE self-test to complete\n");
 
+	if (ice->use_hwkm) {
+		bist_done_val = (ice->hwkm_version == 1) ?
+				 QCOM_ICE_HWKM_BIST_DONE_V1_VAL :
+				 QCOM_ICE_HWKM_BIST_DONE_V2_VAL;
+		if (qcom_ice_readl(ice,
+				   HWKM_OFFSET(QCOM_ICE_REG_HWKM_TZ_KM_STATUS)) !=
+				   bist_done_val) {
+			dev_warn(ice->dev, "HWKM BIST error\n");
+			ice->use_hwkm = false;
+		}
+	}
 	return err;
 }
 
+static void qcom_ice_enable_standard_mode(struct qcom_ice *ice)
+{
+	u32 val = 0;
+
+	if (!ice->use_hwkm)
+		return;
+
+	/*
+	 * When ICE is in standard (hwkm) mode, it supports HW wrapped
+	 * keys, and when it is in legacy mode, it only supports standard
+	 * (non HW wrapped) keys.
+	 *
+	 * Put ICE in standard mode, ICE defaults to legacy mode.
+	 * Legacy mode - ICE HWKM slave not supported.
+	 * Standard mode - ICE HWKM slave supported.
+	 *
+	 * Depending on the version of HWKM, it is controlled by different
+	 * registers in ICE.
+	 */
+	if (ice->hwkm_version >= 2) {
+		val = qcom_ice_readl(ice, QCOM_ICE_REG_CONTROL);
+		val = val & 0xFFFFFFFE;
+		qcom_ice_writel(ice, val, QCOM_ICE_REG_CONTROL);
+	} else {
+		qcom_ice_writel(ice, 0x7,
+				HWKM_OFFSET(QCOM_ICE_REG_HWKM_TZ_KM_CTL));
+	}
+}
+
+static void qcom_ice_hwkm_init(struct qcom_ice *ice)
+{
+	if (!ice->use_hwkm)
+		return;
+
+	/* Disable CRC checks. This HWKM feature is not used. */
+	qcom_ice_writel(ice, 0x6,
+			HWKM_OFFSET(QCOM_ICE_REG_HWKM_TZ_KM_CTL));
+
+	/*
+	 * Give register bank of the HWKM slave access to read and modify
+	 * the keyslots in ICE HWKM slave. Without this, trustzone will not
+	 * be able to program keys into ICE.
+	 */
+	qcom_ice_writel(ice, 0xFFFFFFFF,
+			HWKM_OFFSET(QCOM_ICE_REG_HWKM_BANK0_BBAC_0));
+	qcom_ice_writel(ice, 0xFFFFFFFF,
+			HWKM_OFFSET(QCOM_ICE_REG_HWKM_BANK0_BBAC_1));
+	qcom_ice_writel(ice, 0xFFFFFFFF,
+			HWKM_OFFSET(QCOM_ICE_REG_HWKM_BANK0_BBAC_2));
+	qcom_ice_writel(ice, 0xFFFFFFFF,
+			HWKM_OFFSET(QCOM_ICE_REG_HWKM_BANK0_BBAC_3));
+	qcom_ice_writel(ice, 0xFFFFFFFF,
+			HWKM_OFFSET(QCOM_ICE_REG_HWKM_BANK0_BBAC_4));
+
+	/* Clear HWKM response FIFO before doing anything */
+	qcom_ice_writel(ice, 0x8,
+			HWKM_OFFSET(QCOM_ICE_REG_HWKM_BANK0_BANKN_IRQ_STATUS));
+
+	ice->hwkm_init_complete = true;
+}
+
 int qcom_ice_enable(struct qcom_ice *ice)
 {
+	int err;
+
 	qcom_ice_low_power_mode_enable(ice);
 	qcom_ice_optimization_enable(ice);
 
-	return qcom_ice_wait_bist_status(ice);
+	qcom_ice_enable_standard_mode(ice);
+
+	err = qcom_ice_wait_bist_status(ice);
+	if (err)
+		return err;
+
+	qcom_ice_hwkm_init(ice);
+
+	return err;
 }
 EXPORT_SYMBOL_GPL(qcom_ice_enable);
 
@@ -149,6 +300,8 @@
 		return err;
 	}
 
+	qcom_ice_enable_standard_mode(ice);
+	qcom_ice_hwkm_init(ice);
 	return qcom_ice_wait_bist_status(ice);
 }
 EXPORT_SYMBOL_GPL(qcom_ice_resume);
@@ -161,10 +314,55 @@
 }
 EXPORT_SYMBOL_GPL(qcom_ice_suspend);
 
+/*
+ * HW dictates the internal mapping between the ICE and HWKM slots,
+ * which are different for different versions, make the translation
+ * here. For v1 however, the translation is done in trustzone.
+ */
+static int translate_hwkm_slot(struct qcom_ice *ice, int slot)
+{
+	return (ice->hwkm_version == 1) ? slot : (slot * 2);
+}
+
+static int qcom_ice_program_wrapped_key(struct qcom_ice *ice,
+					const struct blk_crypto_key *key,
+					u8 data_unit_size, int slot)
+{
+	int hwkm_slot;
+	int err;
+	union crypto_cfg cfg;
+
+	hwkm_slot = translate_hwkm_slot(ice, slot);
+
+	memset(&cfg, 0, sizeof(cfg));
+	cfg.dusize = data_unit_size;
+	cfg.capidx = QCOM_SCM_ICE_CIPHER_AES_256_XTS;
+	cfg.cfge = 0x80;
+
+	/* Clear CFGE */
+	qcom_ice_writel(ice, 0x0, QCOM_ICE_LUT_KEYS_CRYPTOCFG_R16 +
+				  QCOM_ICE_LUT_KEYS_CRYPTOCFG_OFFSET * slot);
+
+	/* Call trustzone to program the wrapped key using hwkm */
+	err = qcom_scm_ice_set_key(hwkm_slot, key->raw, key->size,
+				   QCOM_SCM_ICE_CIPHER_AES_256_XTS, data_unit_size);
+	if (err) {
+		pr_err("%s:SCM call Error: 0x%x slot %d\n", __func__, err,
+		       slot);
+		return err;
+	}
+
+	/* Enable CFGE after programming key */
+	qcom_ice_writel(ice, cfg.regval, QCOM_ICE_LUT_KEYS_CRYPTOCFG_R16 +
+					 QCOM_ICE_LUT_KEYS_CRYPTOCFG_OFFSET * slot);
+
+	return err;
+}
+
 int qcom_ice_program_key(struct qcom_ice *ice,
 			 u8 algorithm_id, u8 key_size,
-			 const u8 crypto_key[], u8 data_unit_size,
-			 int slot)
+			 const struct blk_crypto_key *bkey,
+			 u8 data_unit_size, int slot)
 {
 	struct device *dev = ice->dev;
 	union {
@@ -176,24 +374,31 @@
 
 	/* Only AES-256-XTS has been tested so far. */
 	if (algorithm_id != QCOM_ICE_CRYPTO_ALG_AES_XTS ||
-	    key_size != QCOM_ICE_CRYPTO_KEY_SIZE_256) {
+	    (key_size != QCOM_ICE_CRYPTO_KEY_SIZE_256 &&
+	    key_size != QCOM_ICE_CRYPTO_KEY_SIZE_WRAPPED)) {
 		dev_err_ratelimited(dev,
 				    "Unhandled crypto capability; algorithm_id=%d, key_size=%d\n",
 				    algorithm_id, key_size);
 		return -EINVAL;
 	}
 
-	memcpy(key.bytes, crypto_key, AES_256_XTS_KEY_SIZE);
-
-	/* The SCM call requires that the key words are encoded in big endian */
-	for (i = 0; i < ARRAY_SIZE(key.words); i++)
-		__cpu_to_be32s(&key.words[i]);
-
-	err = qcom_scm_ice_set_key(slot, key.bytes, AES_256_XTS_KEY_SIZE,
-				   QCOM_SCM_ICE_CIPHER_AES_256_XTS,
-				   data_unit_size);
-
-	memzero_explicit(&key, sizeof(key));
+	if (bkey->crypto_cfg.key_type == BLK_CRYPTO_KEY_TYPE_HW_WRAPPED) {
+		if (!ice->use_hwkm)
+			return -EINVAL;
+		err = qcom_ice_program_wrapped_key(ice, bkey, data_unit_size,
+				slot);
+	} else {
+		memcpy(key.bytes, bkey->raw, AES_256_XTS_KEY_SIZE);
+
+		/* The SCM call requires that the key words are encoded in big endian */
+		for (i = 0; i < ARRAY_SIZE(key.words); i++)
+			__cpu_to_be32s(&key.words[i]);
+
+		err = qcom_scm_ice_set_key(slot, key.bytes, AES_256_XTS_KEY_SIZE,
+					   QCOM_SCM_ICE_CIPHER_AES_256_XTS,
+					   data_unit_size);
+		memzero_explicit(&key, sizeof(key));
+	}
 
 	return err;
 }
@@ -201,10 +406,130 @@
 
 int qcom_ice_evict_key(struct qcom_ice *ice, int slot)
 {
-	return qcom_scm_ice_invalidate_key(slot);
+	int hwkm_slot = slot;
+
+
+	if (ice->use_hwkm) {
+		hwkm_slot = translate_hwkm_slot(ice, slot);
+	/*
+	 * Ignore calls to evict key when HWKM is supported and hwkm init
+	 * is not yet done. This is to avoid the clearing all slots call
+	 * during a storage reset when ICE is still in legacy mode. HWKM slave
+	 * in ICE takes care of zeroing out the keytable on reset.
+	 */
+		if (!ice->hwkm_init_complete)
+			return 0;
+	}
+
+	return qcom_scm_ice_invalidate_key(hwkm_slot);
 }
 EXPORT_SYMBOL_GPL(qcom_ice_evict_key);
 
+bool qcom_ice_hwkm_supported(struct qcom_ice *ice)
+{
+	return ice->use_hwkm;
+}
+EXPORT_SYMBOL_GPL(qcom_ice_hwkm_supported);
+
+int qcom_ice_derive_sw_secret(struct qcom_ice *ice, const u8 wkey[],
+			      unsigned int wkey_size,
+			      u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE])
+{
+	return qcom_scm_derive_sw_secret(wkey, wkey_size,
+					 sw_secret, BLK_CRYPTO_SW_SECRET_SIZE);
+}
+EXPORT_SYMBOL_GPL(qcom_ice_derive_sw_secret);
+
+/**
+ * qcom_ice_generate_key() - Generate a wrapped key for inline encryption
+ * @lt_key: longterm wrapped key that is generated, which is
+ *          BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE in size.
+ *
+ * Make a scm call into trustzone to generate a wrapped key for storage
+ * encryption using hwkm.
+ *
+ * Return: Keysize on success; err on failure.
+ */
+int qcom_ice_generate_key(struct qcom_ice *ice,
+			  u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	int ret;
+
+	ret = qcom_scm_generate_ice_key(lt_key,
+					 QCOM_ICE_HWKM_WRAPPED_KEY_SIZE(ice->hwkm_version));
+	if (!ret)
+		return QCOM_ICE_HWKM_WRAPPED_KEY_SIZE(ice->hwkm_version);
+	else
+		return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_ice_generate_key);
+
+/**
+ * qcom_ice_prepare_key() - Prepare a longterm wrapped key for inline encryption
+ * @lt_key: longterm wrapped key that is generated or imported.
+ * @lt_key_size: size of the longterm wrapped_key
+ * @eph_key: wrapped key returned which has been wrapped with a per-boot ephemeral key,
+ *           size of which is BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE in size.
+ *
+ * Make a scm call into trustzone to prepare a wrapped key for storage
+ * encryption by rewrapping the longterm wrapped key with a per boot ephemeral
+ * key using hwkm.
+ *
+ * Return: Keysize on success; err on failure.
+ */
+int qcom_ice_prepare_key(struct qcom_ice *ice, const u8 *lt_key, size_t lt_key_size,
+			 u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	int ret;
+
+	ret = qcom_scm_prepare_ice_key(lt_key, lt_key_size, eph_key,
+					QCOM_ICE_HWKM_WRAPPED_KEY_SIZE(ice->hwkm_version));
+	if (!ret)
+		return QCOM_ICE_HWKM_WRAPPED_KEY_SIZE(ice->hwkm_version);
+	else
+		return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_ice_prepare_key);
+
+/**
+ * qcom_ice_import_key() - Import a raw key for inline encryption
+ * @imp_key: raw key that has to be imported
+ * @imp_key_size: size of the imported key
+ * @lt_key: longterm wrapped key that is imported, which is
+ *          BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE in size.
+ *
+ * Make a scm call into trustzone to import a raw key for storage encryption
+ * and generate a longterm wrapped key using hwkm.
+ *
+ * Return: Keysize on success; err on failure.
+ */
+int qcom_ice_import_key(struct qcom_ice *ice, const u8 *imp_key, size_t imp_key_size,
+			u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	int ret;
+
+	ret = qcom_scm_import_ice_key(imp_key, imp_key_size, lt_key,
+				       QCOM_ICE_HWKM_WRAPPED_KEY_SIZE(ice->hwkm_version));
+	if (!ret)
+		return QCOM_ICE_HWKM_WRAPPED_KEY_SIZE(ice->hwkm_version);
+	else
+		return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_ice_import_key);
+
+int qcom_ice_scale_clk(struct qcom_ice *ice, bool scale_up)
+{
+	int ret = 0;
+
+	if (scale_up && ice->max_freq)
+		ret = clk_set_rate(ice->core_clk, ice->max_freq);
+	else if (!scale_up && ice->min_freq)
+		ret = clk_set_rate(ice->core_clk, ice->min_freq);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_ice_scale_clk);
+
 static struct qcom_ice *qcom_ice_create(struct device *dev,
 					void __iomem *base)
 {
@@ -215,7 +540,7 @@
 
 	if (!qcom_scm_ice_available()) {
 		dev_warn(dev, "ICE SCM interface not found\n");
-		return NULL;
+		return ERR_PTR(-EOPNOTSUPP);
 	}
 
 	engine = devm_kzalloc(dev, sizeof(*engine), GFP_KERNEL);
@@ -239,6 +564,8 @@
 		engine->core_clk = devm_clk_get_enabled(dev, NULL);
 	if (IS_ERR(engine->core_clk))
 		return ERR_CAST(engine->core_clk);
+	engine->use_hwkm = of_property_read_bool(dev->of_node,
+						 "qcom,ice-use-hwkm");
 
 	if (!qcom_ice_check_supported(engine))
 		return ERR_PTR(-EOPNOTSUPP);
@@ -268,6 +595,9 @@
 	struct device_node *node;
 	struct resource *res;
 	void __iomem *base;
+	const __be32 *prop;
+	int len;
+
 
 	if (!dev || !dev->of_node)
 		return ERR_PTR(-ENODEV);
@@ -294,7 +624,7 @@
 	 */
 	node = of_parse_phandle(dev->of_node, "qcom,ice", 0);
 	if (!node)
-		return NULL;
+		return ERR_PTR(-EOPNOTSUPP);
 
 	pdev = of_find_device_by_node(node);
 	if (!pdev) {
@@ -308,10 +638,21 @@
 		dev_err(dev, "Cannot get ice instance from %s\n",
 			dev_name(&pdev->dev));
 		platform_device_put(pdev);
-		ice = ERR_PTR(-EPROBE_DEFER);
+		if (qcom_ice_create_error)
+			ice = ERR_PTR(-EOPNOTSUPP);
+		else
+			ice = ERR_PTR(-EPROBE_DEFER);
 		goto out;
 	}
 
+	prop = of_get_property(node, "freq-table-hz", &len);
+	if (!prop || len < 2 * sizeof(uint32_t))
+		pr_err("Property not found or invalid length\n");
+	else {
+		ice->min_freq = be32_to_cpu(prop);
+		ice->max_freq = be32_to_cpu(prop);
+	}
+
 	ice->link = device_link_add(dev, &pdev->dev, DL_FLAG_AUTOREMOVE_SUPPLIER);
 	if (!ice->link) {
 		dev_err(&pdev->dev,
@@ -323,7 +664,6 @@
 
 out:
 	of_node_put(node);
-
 	return ice;
 }
 EXPORT_SYMBOL_GPL(of_qcom_ice_get);
@@ -340,8 +680,11 @@
 	}
 
 	engine = qcom_ice_create(&pdev->dev, base);
-	if (IS_ERR(engine))
+
+	if (IS_ERR(engine)) {
+		qcom_ice_create_error = true;
 		return PTR_ERR(engine);
+	}
 
 	platform_set_drvdata(pdev, engine);
 
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/llcc-qcom.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/llcc-qcom.c
@@ -135,9 +135,12 @@
 	const struct llcc_slice_config *sct_data;
 	const u32 *reg_offset;
 	const struct llcc_edac_reg_offset *edac_reg_offset;
+	u32 max_cap_shift; /* instead of ATTR1_MAX_CAP_SHIFT */
+	u32 num_banks;
 	int size;
 	bool need_llcc_cfg;
 	bool no_edac;
+	bool irq_configured;
 };
 
 struct qcom_sct_config {
@@ -150,6 +153,427 @@
 	LLCC_COMMON_STATUS0,
 };
 
+static const struct llcc_slice_config sa8775p_data[] =  {
+	{LLCC_CPUSS,    1, 2048, 1, 0, 0x00FF, 0x0, 0, 0, 0, 1, 1, 0, 0},
+	{LLCC_VIDSC0,   2, 512, 3, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+	{LLCC_CPUSS1,   3, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+	{LLCC_CPUHWT,   5, 512, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+	{LLCC_AUDIO,    6, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 0, 0, 0, 0},
+	{LLCC_CMPT,     10, 4096, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+	{LLCC_GPUHTW,   11, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+	{LLCC_GPU,      12, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 1, 0},
+	{LLCC_MMUHWT,   13, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 0, 1, 0, 0},
+	{LLCC_CMPTDMA,  15, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+	{LLCC_DISP,     16, 4096, 2, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+	{LLCC_VIDFW,    17, 3072, 1, 0, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+	{LLCC_AUDHW,    22, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 0, 0, 0, 0},
+	{LLCC_CVP,      28, 256, 3, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+	{LLCC_APTCM,    30, 1024, 3, 1, 0x0, 0xF0, 1, 0, 0, 1, 0, 0, 0},
+	{LLCC_WRCACHE,    31, 512, 1, 1, 0x00FF, 0x0, 0, 0, 0, 0, 1, 0, 0},
+};
+
+static const struct llcc_slice_config sar1130p_data[] = {
+	{
+		.usecase_id = LLCC_CPUSS,
+		.slice_id = 1,
+		.max_cap = 4096,
+		.priority = 1,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+		.activate_on_init = true,
+	}, {
+		.usecase_id = LLCC_VIDSC0,
+		.slice_id = 2,
+		.max_cap = 512,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_AUDIO,
+		.slice_id = 6,
+		.max_cap = 1024,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_CMPT,
+		.slice_id = 10,
+		.max_cap = 1024,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_GPUHTW,
+		.slice_id = 11,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_GPU,
+		.slice_id = 12,
+		.max_cap = 3072,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+		.write_scid_en = true,
+	}, {
+		.usecase_id = LLCC_MMUHWT,
+		.slice_id = 13,
+		.max_cap = 512,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+	}, {
+		.usecase_id = LLCC_DISP,
+		.slice_id = 16,
+		.max_cap = 12800,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_CVP,
+		.slice_id = 28,
+		.max_cap = 256,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_APTCM,
+		.slice_id = 26,
+		.max_cap = 2048,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x3,
+		.cache_mode = true,
+		.dis_cap_alloc = true,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_WRCACHE,
+		.slice_id = 31,
+		.max_cap = 256,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.activate_on_init = true,
+	}, {
+		.usecase_id = LLCC_AENPU,
+		.slice_id = 30,
+		.max_cap = 3072,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0x1fff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_DISP_LEFT,
+		.slice_id = 17,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_DISP_RIGHT,
+		.slice_id = 18,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_EVCS_LEFT,
+		.slice_id = 22,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_EVCS_RIGHT,
+		.slice_id = 23,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	},
+};
+
+static const struct llcc_slice_config sar2130p_data[] = {
+	{
+		.usecase_id = LLCC_CPUSS,
+		.slice_id = 1,
+		.max_cap = 6144,
+		.priority = 1,
+		.fixed_size = 0,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+		.activate_on_init = true,
+	}, {
+		.usecase_id = LLCC_VIDSC0,
+		.slice_id = 2,
+		.max_cap = 128,
+		.priority = 2,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_AUDIO,
+		.slice_id = 6,
+		.max_cap = 1024,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_CMPT,
+		.slice_id = 10,
+		.max_cap = 1024,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_GPUHTW,
+		.slice_id = 11,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_GPU,
+		.slice_id = 12,
+		.max_cap = 1536,
+		.priority = 2,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+		.write_scid_en = true,
+	}, {
+		.usecase_id = LLCC_MMUHWT,
+		.slice_id = 13,
+		.max_cap = 1024,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.activate_on_init = true,
+	}, {
+		.usecase_id = LLCC_DISP,
+		.slice_id = 16,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_APTCM,
+		.slice_id = 26,
+		.max_cap = 2048,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x3,
+		.cache_mode = true,
+		.dis_cap_alloc = true,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_WRCACHE,
+		.slice_id = 31,
+		.max_cap = 256,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.activate_on_init = true,
+	}, {
+		.usecase_id = LLCC_VIEYE,
+		.slice_id = 7,
+		.max_cap = 7168,
+		.priority = 4,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_VIDPTH,
+		.slice_id = 8,
+		.max_cap = 7168,
+		.priority = 4,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_GPUMV,
+		.slice_id = 9,
+		.max_cap = 2048,
+		.priority = 2,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_EVA_LEFT,
+		.slice_id = 20,
+		.max_cap = 7168,
+		.priority = 5,
+		.fixed_size = true,
+		.bonus_ways = 0x3ffffffc,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_EVA_RIGHT,
+		.slice_id = 21,
+		.max_cap = 7168,
+		.priority = 5,
+		.fixed_size = true,
+		.bonus_ways = 0x3ffffffc,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_EVAGAIN,
+		.slice_id = 25,
+		.max_cap = 1024,
+		.priority = 2,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_AENPU,
+		.slice_id = 30,
+		.max_cap = 3072,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_VIPTH,
+		.slice_id = 29,
+		.max_cap = 1024,
+		.priority = 4,
+		.fixed_size = true,
+		.bonus_ways = 0x3fffffff,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_DISP_LEFT,
+		.slice_id = 17,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_DISP_RIGHT,
+		.slice_id = 18,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_EVCS_LEFT,
+		.slice_id = 22,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_EVCS_RIGHT,
+		.slice_id = 23,
+		.max_cap = 0,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_SPAD,
+		.slice_id = 24,
+		.max_cap = 7168,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0x0,
+		.res_ways = 0x0,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	},
+};
+
 static const struct llcc_slice_config sc7180_data[] =  {
 	{ LLCC_CPUSS,    1,  256, 1, 0, 0xf, 0x0, 0, 0, 0, 1, 1 },
 	{ LLCC_MDM,      8,  128, 1, 0, 0xf, 0x0, 0, 0, 0, 1, 0 },
@@ -402,6 +826,95 @@
 	{LLCC_VIDVSP,   28,  256, 3, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
 };
 
+static const struct llcc_slice_config qcs615_data[] = {
+	{
+		.usecase_id = LLCC_CPUSS,
+		.slice_id = 1,
+		.max_cap = 128,
+		.priority = 1,
+		.bonus_ways = 0xf,
+		.cache_mode = 0,
+		.activate_on_init = true,
+		.write_scid_en = true,
+	}, {
+		.usecase_id = LLCC_MDM,
+		.slice_id = 8,
+		.max_cap = 256,
+		.priority = 0,
+		.fixed_size = true,
+		.bonus_ways = 0xf,
+		.cache_mode = 0,
+		.activate_on_init = true,
+	}, {
+		.usecase_id = LLCC_GPUHTW,
+		.slice_id = 11,
+		.max_cap = 128,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0xf,
+		.cache_mode = 0,
+		.activate_on_init = true,
+	}, {
+		.usecase_id = LLCC_GPU,
+		.slice_id = 12,
+		.max_cap = 128,
+		.priority = 1,
+		.bonus_ways = 0xf,
+		.cache_mode = 0,
+		.activate_on_init = true,
+	},
+};
+
+static const struct llcc_slice_config qcs8300_data[] = {
+	{
+		.usecase_id = LLCC_GPUHTW,
+		.slice_id = 11,
+		.max_cap = 128,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0xf,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+	}, {
+		.usecase_id = LLCC_GPU,
+		.slice_id = 12,
+		.max_cap = 512,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0xf,
+		.cache_mode = 0,
+		.retain_on_pc = true,
+		.write_scid_en = true,
+	}, {
+		.usecase_id = LLCC_MMUHWT,
+		.slice_id = 13,
+		.max_cap = 128,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0xf,
+		.cache_mode = 0,
+		.activate_on_init = true,
+	}, {
+		.usecase_id = LLCC_ECC,
+		.slice_id = 26,
+		.max_cap = 256,
+		.priority = 3,
+		.fixed_size = true,
+		.bonus_ways = 0xf,
+		.cache_mode = 0,
+		.activate_on_init = true,
+	}, {
+		.usecase_id = LLCC_WRCACHE,
+		.slice_id = 31,
+		.max_cap = 128,
+		.priority = 1,
+		.fixed_size = true,
+		.bonus_ways = 0xf,
+		.cache_mode = 0,
+		.activate_on_init = true,
+	},
+};
+
 static const struct llcc_slice_config qdu1000_data_2ch[] = {
 	{ LLCC_MDMHPGRW, 7, 512, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
 	{ LLCC_MODHW,    9, 256, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
@@ -521,6 +1034,27 @@
 	[LLCC_COMMON_STATUS0]	= 0x0003400c,
 };
 
+static const struct qcom_llcc_config qcs615_cfg[] = {
+	{
+		.sct_data	= qcs615_data,
+		.size		= ARRAY_SIZE(qcs615_data),
+		.need_llcc_cfg	= true,
+		.reg_offset	= llcc_v1_reg_offset,
+		.edac_reg_offset = &llcc_v1_edac_reg_offset,
+	},
+};
+
+static const struct qcom_llcc_config qcs8300_cfg[] = {
+	{
+		.sct_data	= qcs8300_data,
+		.size		= ARRAY_SIZE(qcs8300_data),
+		.need_llcc_cfg	= true,
+		.reg_offset	= llcc_v2_1_reg_offset,
+		.edac_reg_offset = &llcc_v2_1_edac_reg_offset,
+		.num_banks	= 4,
+	},
+};
+
 static const struct qcom_llcc_config qdu1000_cfg[] = {
 	{
 		.sct_data       = qdu1000_data_8ch,
@@ -552,6 +1086,40 @@
 	},
 };
 
+static const struct qcom_llcc_config sa8775p_cfg[] = {
+	{
+		.sct_data	= sa8775p_data,
+		.size		= ARRAY_SIZE(sa8775p_data),
+		.need_llcc_cfg	= true,
+		.reg_offset	= llcc_v2_1_reg_offset,
+		.edac_reg_offset = &llcc_v2_1_edac_reg_offset,
+	},
+};
+
+static const struct qcom_llcc_config sar1130p_cfg[] = {
+	{
+		.sct_data	= sar1130p_data,
+		.size		= ARRAY_SIZE(sar1130p_data),
+		.need_llcc_cfg	= true,
+		.reg_offset	= llcc_v2_1_reg_offset,
+		.edac_reg_offset = &llcc_v2_1_edac_reg_offset,
+		.max_cap_shift	= 14,
+		.num_banks	= 2,
+	},
+};
+
+static const struct qcom_llcc_config sar2130p_cfg[] = {
+	{
+		.sct_data	= sar2130p_data,
+		.size		= ARRAY_SIZE(sar2130p_data),
+		.need_llcc_cfg	= true,
+		.reg_offset	= llcc_v2_1_reg_offset,
+		.edac_reg_offset = &llcc_v2_1_edac_reg_offset,
+		.max_cap_shift	= 14,
+		.num_banks	= 2,
+	},
+};
+
 static const struct qcom_llcc_config sc7180_cfg[] = {
 	{
 		.sct_data	= sc7180_data,
@@ -690,14 +1258,40 @@
 		.need_llcc_cfg	= true,
 		.reg_offset	= llcc_v2_1_reg_offset,
 		.edac_reg_offset = &llcc_v2_1_edac_reg_offset,
+		.irq_configured = true,
 	},
 };
 
+static const struct qcom_sct_config qcs615_cfgs = {
+	.llcc_config	= qcs615_cfg,
+	.num_config	= ARRAY_SIZE(qcs615_cfg),
+};
+
+static const struct qcom_sct_config qcs8300_cfgs = {
+	.llcc_config	= qcs8300_cfg,
+	.num_config	= ARRAY_SIZE(qcs8300_cfg),
+};
+
 static const struct qcom_sct_config qdu1000_cfgs = {
 	.llcc_config	= qdu1000_cfg,
 	.num_config	= ARRAY_SIZE(qdu1000_cfg),
 };
 
+static const struct qcom_sct_config sa8775p_cfgs = {
+	.llcc_config	= sa8775p_cfg,
+	.num_config	= ARRAY_SIZE(sa8775p_cfg),
+};
+
+static const struct qcom_sct_config sar1130p_cfgs = {
+	.llcc_config	= sar1130p_cfg,
+	.num_config	= ARRAY_SIZE(sar1130p_cfg),
+};
+
+static const struct qcom_sct_config sar2130p_cfgs = {
+	.llcc_config	= sar2130p_cfg,
+	.num_config	= ARRAY_SIZE(sar2130p_cfg),
+};
+
 static const struct qcom_sct_config sc7180_cfgs = {
 	.llcc_config	= sc7180_cfg,
 	.num_config	= ARRAY_SIZE(sc7180_cfg),
@@ -859,6 +1453,8 @@
 	ret = regmap_read_poll_timeout(drv_data->bcast_regmap, status_reg,
 				      slice_status, !(slice_status & status),
 				      0, LLCC_STATUS_READ_DELAY);
+	if (ret)
+		return ret;
 
 	if (drv_data->version >= LLCC_VERSION_4_1_0_0)
 		ret = regmap_write(drv_data->bcast_regmap, act_clear_reg,
@@ -1001,7 +1597,10 @@
 	 */
 	max_cap_cacheline = max_cap_cacheline / drv_data->num_banks;
 	max_cap_cacheline >>= CACHE_LINE_SIZE_SHIFT;
-	attr1_val |= max_cap_cacheline << ATTR1_MAX_CAP_SHIFT;
+	if (cfg->max_cap_shift)
+		attr1_val |= max_cap_cacheline << cfg->max_cap_shift;
+	else
+		attr1_val |= max_cap_cacheline << ATTR1_MAX_CAP_SHIFT;
 
 	attr1_cfg = LLCC_TRP_ATTR1_CFGn(config->slice_id);
 
@@ -1238,12 +1837,17 @@
 		goto err;
 	cfg = &cfgs->llcc_config[cfg_index];
 
-	ret = regmap_read(regmap, cfg->reg_offset[LLCC_COMMON_STATUS0], &num_banks);
-	if (ret)
-		goto err;
+	if (cfg->num_banks) {
+		num_banks = cfg->num_banks;
+	} else {
+		ret = regmap_read(regmap, cfg->reg_offset[LLCC_COMMON_STATUS0], &num_banks);
+		if (ret)
+			goto err;
+
+		num_banks &= LLCC_LB_CNT_MASK;
+		num_banks >>= LLCC_LB_CNT_SHIFT;
+	}
 
-	num_banks &= LLCC_LB_CNT_MASK;
-	num_banks >>= LLCC_LB_CNT_SHIFT;
 	drv_data->num_banks = num_banks;
 
 	drv_data->regmaps = devm_kcalloc(dev, num_banks, sizeof(*drv_data->regmaps), GFP_KERNEL);
@@ -1299,6 +1903,7 @@
 	drv_data->cfg = llcc_cfg;
 	drv_data->cfg_size = sz;
 	drv_data->edac_reg_offset = cfg->edac_reg_offset;
+	drv_data->ecc_irq_configured = cfg->irq_configured;
 	mutex_init(&drv_data->lock);
 	platform_set_drvdata(pdev, drv_data);
 
@@ -1329,7 +1934,12 @@
 }
 
 static const struct of_device_id qcom_llcc_of_match[] = {
+	{ .compatible = "qcom,qcs615-llcc", .data = &qcs615_cfgs},
+	{ .compatible = "qcom,qcs8300-llcc", .data = &qcs8300_cfgs},
 	{ .compatible = "qcom,qdu1000-llcc", .data = &qdu1000_cfgs},
+	{ .compatible = "qcom,sa8775p-llcc", .data = &sa8775p_cfgs },
+	{ .compatible = "qcom,sar1130p-llcc", .data = &sar1130p_cfgs },
+	{ .compatible = "qcom,sar2130p-llcc", .data = &sar2130p_cfgs },
 	{ .compatible = "qcom,sc7180-llcc", .data = &sc7180_cfgs },
 	{ .compatible = "qcom,sc7280-llcc", .data = &sc7280_cfgs },
 	{ .compatible = "qcom,sc8180x-llcc", .data = &sc8180x_cfgs },
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mdt_loader.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/mdt_loader.c
@@ -145,6 +145,11 @@
 	if (phdrs[0].p_type == PT_LOAD)
 		return ERR_PTR(-EINVAL);
 
+	if (((size_t)(phdrs + ehdr->e_phnum)) > ((size_t)ehdr + fw->size)) {
+		dev_err(dev, "Invalid phdrs access: %s\n", fw_name);
+		return ERR_PTR(-EINVAL);
+	}
+
 	for (i = 1; i < ehdr->e_phnum; i++) {
 		if ((phdrs[i].p_flags & QCOM_MDT_TYPE_MASK) == QCOM_MDT_TYPE_HASH) {
 			hash_segment = i;
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/Kconfig
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/Kconfig
@@ -0,0 +1,39 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+config QCOM_MEM_BUF
+	tristate "Qualcomm Technologies, Inc. Memory Buffer Sharing Driver"
+	select QCOM_MEM_BUF_DEV
+	help
+	  Add support for lending memory from one virtual machine to another.
+	  This driver communicates with the hypervisor, as well as other
+	  virtual machines, to request and lend memory from and to VMs
+	  respectively.
+	  If unsure, say N
+
+config QCOM_MEM_BUF_GH
+	bool "Qualcomm Technologies, Inc. Memory Buffer Gunyah Hypervisor Support"
+	depends on GH_RM_DRV
+	select QCOM_MEM_BUF_DEV_GH
+	help
+	  Enables additional support for sharing memory with VMs that have their own
+	  operating systems, as opposed to peripheral VMs, which do not have their
+	  own operating systems. These VMs are managed by the Gunyah Hypervisor, and thus
+	  sharing memory with them requires interacting with the Gunyah Hypervisor.
+	  If unsure, say N.
+
+config QCOM_MEM_BUF_DEV
+	tristate
+
+config QCOM_MEM_BUF_DEV_GH
+	bool
+
+config QCOM_MEM_BUF_MSGQ
+	tristate "Qualcomm Technologies, Inc. Memory Buffer Message Queue Support"
+	depends on GH_MSGQ && QCOM_MEM_BUF_DEV_GH
+	help
+	  Enables support for communicating with VMs over message queues. The communication
+	  with the VMs follows a specific communication format that is defined by the mem-buf
+	  message queue protocol. The protocol allows for allocation requests to be submitted
+	  between VMs, and relinquished when a VM is finished with the memory that it
+	  requested from another VM.
+	  If unsure, say N.
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/Makefile
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/Makefile
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0-only
+obj-$(CONFIG_QCOM_MEM_BUF) += mem_buf.o
+mem_buf-y += mem-buf.o
+mem_buf-$(CONFIG_QCOM_MEM_BUF_GH) += mem-buf-gh.o
+obj-$(CONFIG_QCOM_MEM_BUF_DEV) += mem_buf_dev.o
+mem_buf_dev-y += mem-buf-dev.o mem_buf_dma_buf.o mem-buf-ids.o
+mem_buf_dev-$(CONFIG_QCOM_MEM_BUF_DEV_GH) += mem-buf-dev-gh.o
+obj-$(CONFIG_QCOM_MEM_BUF_MSGQ) += mem_buf_msgq.o
+mem_buf_msgq-y += mem-buf-msgq.o
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf-dev-gh.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf-dev-gh.c
@@ -0,0 +1,390 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+
+#include <soc/qcom/secure_buffer.h>
+
+#include "mem-buf-dev.h"
+#include "mem-buf-ids.h"
+
+#define CREATE_TRACE_POINTS
+#include "trace-mem-buf.h"
+EXPORT_TRACEPOINT_SYMBOL(send_alloc_req);
+EXPORT_TRACEPOINT_SYMBOL(receive_alloc_req);
+EXPORT_TRACEPOINT_SYMBOL(send_relinquish_msg);
+EXPORT_TRACEPOINT_SYMBOL(receive_relinquish_msg);
+EXPORT_TRACEPOINT_SYMBOL(send_alloc_resp_msg);
+EXPORT_TRACEPOINT_SYMBOL(receive_alloc_resp_msg);
+EXPORT_TRACEPOINT_SYMBOL(mem_buf_alloc_info);
+EXPORT_TRACEPOINT_SYMBOL(send_relinquish_resp_msg);
+EXPORT_TRACEPOINT_SYMBOL(receive_relinquish_resp_msg);
+
+struct gh_acl_desc *mem_buf_vmid_perm_list_to_gh_acl(int *vmids, int *perms,
+						     unsigned int nr_acl_entries)
+{
+	struct gh_acl_desc *gh_acl;
+	size_t size;
+	unsigned int i;
+
+	size = offsetof(struct gh_acl_desc, acl_entries[nr_acl_entries]);
+	gh_acl = kmalloc(size, GFP_KERNEL);
+	if (!gh_acl)
+		return ERR_PTR(-ENOMEM);
+
+	gh_acl->n_acl_entries = nr_acl_entries;
+	for (i = 0; i < nr_acl_entries; i++) {
+		gh_acl->acl_entries[i].vmid = vmids[i];
+		gh_acl->acl_entries[i].perms = perms[i];
+	}
+
+	return gh_acl;
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmid_perm_list_to_gh_acl);
+
+struct gh_sgl_desc *mem_buf_sgt_to_gh_sgl_desc(struct sg_table *sgt)
+{
+	struct gh_sgl_desc *gh_sgl;
+	size_t size;
+	int i;
+	struct scatterlist *sg;
+
+	/* gh_sgl_desc uses u16. Use struct scatterlist instead in future */
+	if (WARN(sgt->orig_nents > U16_MAX, "Too many sgl_entries\n"))
+		return ERR_PTR(-EINVAL);
+
+	size = offsetof(struct gh_sgl_desc, sgl_entries[sgt->orig_nents]);
+	gh_sgl = kvmalloc(size, GFP_KERNEL);
+	if (!gh_sgl)
+		return ERR_PTR(-ENOMEM);
+
+	gh_sgl->n_sgl_entries = sgt->orig_nents;
+	for_each_sgtable_sg(sgt, sg, i) {
+		gh_sgl->sgl_entries[i].ipa_base = sg_phys(sg);
+		gh_sgl->sgl_entries[i].size = sg->length;
+	}
+
+	return gh_sgl;
+}
+EXPORT_SYMBOL_GPL(mem_buf_sgt_to_gh_sgl_desc);
+
+int mem_buf_gh_acl_desc_to_vmid_perm_list(struct gh_acl_desc *acl_desc,
+				       int **vmids, int **perms)
+{
+	int *vmids_arr = NULL, *perms_arr = NULL;
+	u32 nr_acl_entries = acl_desc->n_acl_entries;
+	unsigned int i;
+
+	if (!vmids || !perms)
+		return -EINVAL;
+
+	vmids_arr = kmalloc_array(nr_acl_entries, sizeof(*vmids_arr),
+				  GFP_KERNEL);
+	if (!vmids_arr)
+		return -ENOMEM;
+
+	perms_arr = kmalloc_array(nr_acl_entries, sizeof(*perms_arr),
+				  GFP_KERNEL);
+	if (!perms_arr) {
+		kfree(vmids_arr);
+		return -ENOMEM;
+	}
+
+	*vmids = vmids_arr;
+	*perms = perms_arr;
+
+	for (i = 0; i < nr_acl_entries; i++) {
+		vmids_arr[i] = acl_desc->acl_entries[i].vmid;
+		perms_arr[i] = acl_desc->acl_entries[i].perms;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mem_buf_gh_acl_desc_to_vmid_perm_list);
+
+struct sg_table *dup_gh_sgl_desc_to_sgt(struct gh_sgl_desc *sgl_desc)
+{
+	struct sg_table *new_table;
+	int ret, i;
+	struct scatterlist *sg;
+
+	if (!sgl_desc || !sgl_desc->n_sgl_entries)
+		return ERR_PTR(-EINVAL);
+
+	new_table = kzalloc(sizeof(*new_table), GFP_KERNEL);
+	if (!new_table)
+		return ERR_PTR(-ENOMEM);
+
+	ret = sg_alloc_table(new_table, sgl_desc->n_sgl_entries, GFP_KERNEL);
+	if (ret) {
+		kfree(new_table);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	for_each_sg(new_table->sgl, sg, new_table->nents, i) {
+		sg_set_page(sg, phys_to_page(sgl_desc->sgl_entries[i].ipa_base),
+			    sgl_desc->sgl_entries[i].size, 0);
+		sg_dma_address(sg) = 0;
+		sg_dma_len(sg) = 0;
+	}
+
+	return new_table;
+}
+EXPORT_SYMBOL_GPL(dup_gh_sgl_desc_to_sgt);
+
+struct gh_sgl_desc *dup_gh_sgl_desc(struct gh_sgl_desc *sgl_desc)
+{
+	size_t size;
+	struct gh_sgl_desc *copy;
+
+	if (!sgl_desc)
+		return NULL;
+
+	size = offsetof(struct gh_sgl_desc, sgl_entries[sgl_desc->n_sgl_entries]);
+	copy = kvmalloc(size, GFP_KERNEL);
+	if (!copy)
+		return ERR_PTR(-ENOMEM);
+
+	memcpy(copy, sgl_desc, size);
+	return copy;
+}
+EXPORT_SYMBOL_GPL(dup_gh_sgl_desc);
+
+size_t mem_buf_get_sgl_buf_size(struct gh_sgl_desc *sgl_desc)
+{
+	size_t size = 0;
+	unsigned int i;
+
+	for (i = 0; i < sgl_desc->n_sgl_entries; i++)
+		size += sgl_desc->sgl_entries[i].size;
+
+	return size;
+}
+EXPORT_SYMBOL_GPL(mem_buf_get_sgl_buf_size);
+
+static int __mem_buf_map_mem_s2_cleanup_donate(struct gh_sgl_desc *sgl_desc,
+			int src_vmid, gh_memparcel_handle_t *handle)
+{
+	int ret;
+	int src_perms = PERM_READ | PERM_WRITE | PERM_EXEC;
+	struct mem_buf_lend_kernel_arg arg = {
+		.nr_acl_entries = 1,
+		.vmids = &src_vmid,
+		.perms = &src_perms,
+		.flags = 0, //No sanitize as buffer unmodified.
+		.label = 0,
+	};
+	struct sg_table *sgt;
+
+	sgt = dup_gh_sgl_desc_to_sgt(sgl_desc);
+	if (IS_ERR(sgt))
+		return PTR_ERR(sgt);
+
+	ret = mem_buf_assign_mem_gunyah(GH_RM_TRANS_TYPE_DONATE, sgt, &arg);
+	if (!ret)
+		*handle = arg.memparcel_hdl;
+
+	sg_free_table(sgt);
+	kfree(sgt);
+	return ret;
+}
+
+static int mem_buf_hyp_assign_table_gh(struct gh_sgl_desc *sgl_desc, int src_vmid,
+			struct gh_acl_desc *acl_desc);
+
+/*
+ * @memparcel_hdl:
+ *	GH_RM_TRANS_TYPE_DONATE - memparcel_hdl will be set to MEM_BUF_MEMPARCEL_INVALID
+ *	on success, and (possibly) set to a different valid memparcel on error. This is
+ *	because accepting a donated memparcel handle destroys that handle.
+ *	GH_RM_TRANS_TYPE_LEND - unmodified.
+ *	GH_RM_TRANS_TYPE_SHARE - unmodified.
+ * @sgl_desc:
+ *	If *sgl_desc is not NULL, request specific IPA address(es). Otherwise, hypervisor
+ *	will choose the IPA address, and return it here.
+ */
+int mem_buf_map_mem_s2(u32 op, gh_memparcel_handle_t *__memparcel_hdl,
+			struct gh_acl_desc *acl_desc, struct gh_sgl_desc **__sgl_desc,
+			int src_vmid)
+{
+	int ret, ret2;
+	struct gh_sgl_desc *sgl_desc;
+	u8 flags = GH_RM_MEM_ACCEPT_VALIDATE_ACL_ATTRS |
+		   GH_RM_MEM_ACCEPT_DONE;
+	gh_memparcel_handle_t memparcel_hdl = *__memparcel_hdl;
+
+	if (!acl_desc || !__sgl_desc)
+		return -EINVAL;
+
+	/*
+	 * memory returns to its original IPA address when accepted by HLOS. For example,
+	 * scattered memory returns to being scattered memory.
+	 */
+	if (current_vmid != VMID_HLOS || (*__sgl_desc && (*__sgl_desc)->n_sgl_entries == 1))
+		flags |= GH_RM_MEM_ACCEPT_MAP_IPA_CONTIGUOUS;
+
+	pr_debug("%s: adding CPU MMU stage 2 mappings\n", __func__);
+	sgl_desc = gh_rm_mem_accept(memparcel_hdl, GH_RM_MEM_TYPE_NORMAL, op,
+				    flags, 0, acl_desc, *__sgl_desc,
+				    NULL, 0);
+	if (IS_ERR(sgl_desc)) {
+		pr_err("%s failed to map memory in stage 2 rc: %ld\n", __func__,
+		       PTR_ERR(sgl_desc));
+		return PTR_ERR(sgl_desc);
+	}
+
+	if (op == GH_RM_TRANS_TYPE_DONATE)
+		*__memparcel_hdl = MEM_BUF_MEMPARCEL_INVALID;
+
+	ret = mem_buf_hyp_assign_table_gh(sgl_desc, src_vmid, acl_desc);
+	if (ret)
+		goto err_relinquish;
+
+	trace_map_mem_s2(memparcel_hdl, sgl_desc);
+	*__sgl_desc = sgl_desc;
+	return 0;
+
+err_relinquish:
+	if (op == GH_RM_TRANS_TYPE_DONATE)
+		ret2 = __mem_buf_map_mem_s2_cleanup_donate(sgl_desc, src_vmid,
+					__memparcel_hdl);
+	else
+		ret2 = mem_buf_unmap_mem_s2(memparcel_hdl);
+
+	/*
+	 * Only free sgl_desc if caller passed NULL in *__sgl_desc to request
+	 * gh_rm_mem_accept to allocate new IPA/sgl_desc.
+	 */
+	if (sgl_desc != *__sgl_desc)
+		kvfree(sgl_desc);
+	if (ret2) {
+		pr_err("%s failed to recover\n", __func__);
+		return -EADDRNOTAVAIL;
+	}
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_map_mem_s2);
+
+int mem_buf_unmap_mem_s2(gh_memparcel_handle_t memparcel_hdl)
+{
+	int ret;
+
+	pr_debug("%s: removing CPU MMU stage 2 mappings\n", __func__);
+	ret = gh_rm_mem_release(memparcel_hdl, 0);
+
+	if (ret < 0)
+		pr_err("%s: Failed to release memparcel hdl: 0x%x rc: %d\n",
+		       __func__, memparcel_hdl, ret);
+	else
+		pr_debug("%s: CPU MMU stage 2 mappings removed\n", __func__);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_unmap_mem_s2);
+
+static int mem_buf_hyp_assign_table_gh(struct gh_sgl_desc *sgl_desc, int src_vmid,
+			struct gh_acl_desc *acl_desc)
+{
+	struct sg_table *sgt;
+	int *dst_vmids, *dst_perms;
+	int ret;
+
+	sgt = dup_gh_sgl_desc_to_sgt(sgl_desc);
+	if (IS_ERR(sgt))
+		return PTR_ERR(sgt);
+
+	ret = mem_buf_gh_acl_desc_to_vmid_perm_list(acl_desc, &dst_vmids, &dst_perms);
+	if (ret)
+		goto err_free_sgt;
+
+	ret = mem_buf_hyp_assign_table(sgt, &src_vmid, 1, dst_vmids, dst_perms,
+				acl_desc->n_acl_entries);
+	kfree(dst_vmids);
+	kfree(dst_perms);
+err_free_sgt:
+	sg_free_table(sgt);
+	kfree(sgt);
+	return ret;
+}
+
+int mem_buf_assign_mem_gunyah(u32 op, struct sg_table *sgt,
+			      struct mem_buf_lend_kernel_arg *arg)
+{
+	int ret;
+	struct gh_sgl_desc *gh_sgl;
+	struct gh_acl_desc *gh_acl;
+
+	arg->memparcel_hdl = MEM_BUF_MEMPARCEL_INVALID;
+	ret = mem_buf_vm_uses_gunyah(arg->vmids, arg->nr_acl_entries);
+	if (ret <= 0)
+		return ret;
+
+	gh_sgl = mem_buf_sgt_to_gh_sgl_desc(sgt);
+	if (IS_ERR(gh_sgl))
+		return PTR_ERR(gh_sgl);
+
+	gh_acl = mem_buf_vmid_perm_list_to_gh_acl(arg->vmids, arg->perms,
+						  arg->nr_acl_entries);
+	if (IS_ERR(gh_acl)) {
+		ret = PTR_ERR(gh_acl);
+		goto err_gh_acl;
+	}
+
+	pr_debug("%s: Invoking Gunyah Lend/Share\n", __func__);
+	if (op == GH_RM_TRANS_TYPE_LEND) {
+		ret = ghd_rm_mem_lend(GH_RM_MEM_TYPE_NORMAL, arg->flags,
+				     arg->label, gh_acl, gh_sgl,
+				     NULL /* Default memory attributes */,
+				     &arg->memparcel_hdl);
+	} else if (op == GH_RM_TRANS_TYPE_SHARE) {
+		ret = ghd_rm_mem_share(GH_RM_MEM_TYPE_NORMAL, arg->flags,
+				     arg->label, gh_acl, gh_sgl,
+				     NULL /* Default memory attributes */,
+				     &arg->memparcel_hdl);
+	} else if (op == GH_RM_TRANS_TYPE_DONATE) {
+		ret = gh_rm_mem_donate(GH_RM_MEM_TYPE_NORMAL, arg->flags,
+				     arg->label, gh_acl, gh_sgl,
+				     NULL /* Default memory attributes */,
+				     &arg->memparcel_hdl);
+	} else {
+		pr_err("%s: Unrecognized op %d\n", __func__, op);
+		ret = -EINVAL;
+	}
+
+	if (ret < 0) {
+		pr_err("%s: Gunyah lend/share failed rc:%d\n",
+		       __func__, ret);
+		goto err_gunyah;
+	}
+
+	kfree(gh_acl);
+	kvfree(gh_sgl);
+	return 0;
+
+err_gunyah:
+	kfree(gh_acl);
+err_gh_acl:
+	kvfree(gh_sgl);
+
+	return ret;
+}
+
+int mem_buf_unassign_mem_gunyah(gh_memparcel_handle_t memparcel_hdl)
+{
+	int ret;
+
+	pr_debug("%s: Beginning gunyah reclaim\n", __func__);
+	ret = ghd_rm_mem_reclaim(memparcel_hdl, 0);
+	if (ret) {
+		pr_err("%s: Gunyah reclaim failed\n", __func__);
+		return ret;
+	}
+	pr_debug("%s: Finished gunyah reclaim\n", __func__);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf-dev.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf-dev.c
@@ -0,0 +1,180 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/of_reserved_mem.h>
+#include <soc/qcom/secure_buffer.h>
+
+#include <linux/mem-buf.h>
+#include "mem-buf-dev.h"
+#include "mem-buf-ids.h"
+
+struct device *mem_buf_dev;
+EXPORT_SYMBOL_GPL(mem_buf_dev);
+
+unsigned char mem_buf_capability;
+EXPORT_SYMBOL_GPL(mem_buf_capability);
+
+int mem_buf_hyp_assign_table(struct sg_table *sgt, u32 *src_vmid, int source_nelems,
+			     int *dest_vmids, int *dest_perms, int dest_nelems)
+{
+	char *verb;
+	int ret;
+
+	if (!mem_buf_vm_uses_hyp_assign())
+		return 0;
+
+	verb = *src_vmid == current_vmid ? "Assign" : "Unassign";
+
+	pr_debug("%s memory to target VMIDs\n", verb);
+	ret = hyp_assign_table(sgt, src_vmid, source_nelems, dest_vmids, dest_perms, dest_nelems);
+	if (ret < 0)
+		pr_err("Failed to %s memory for rmt allocation rc: %d\n", verb, ret);
+	else
+		pr_debug("Memory %s to target VMIDs\n", verb);
+
+	return ret;
+}
+
+int mem_buf_assign_mem(u32 op, struct sg_table *sgt,
+		       struct mem_buf_lend_kernel_arg *arg)
+{
+	int src_vmid[] = {current_vmid};
+	int src_perms[] = {PERM_READ | PERM_WRITE | PERM_EXEC};
+	int ret, ret2;
+
+	if (!sgt || !arg->nr_acl_entries || !arg->vmids || !arg->perms)
+		return -EINVAL;
+
+	ret = mem_buf_hyp_assign_table(sgt, src_vmid, ARRAY_SIZE(src_vmid), arg->vmids, arg->perms,
+					arg->nr_acl_entries);
+	if (ret)
+		return ret;
+
+	ret = mem_buf_assign_mem_gunyah(op, sgt, arg);
+	if (ret) {
+		ret2 = mem_buf_hyp_assign_table(sgt, arg->vmids, arg->nr_acl_entries,
+					src_vmid, src_perms, ARRAY_SIZE(src_vmid));
+		if (ret2 < 0) {
+			pr_err("hyp_assign failed while recovering from another error: %d\n",
+			       ret2);
+			return -EADDRNOTAVAIL;
+		}
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_assign_mem);
+
+int mem_buf_unassign_mem(struct sg_table *sgt, int *src_vmids,
+			 unsigned int nr_acl_entries,
+			 gh_memparcel_handle_t memparcel_hdl)
+{
+	int dst_vmid[] = {current_vmid};
+	int dst_perm[] = {PERM_READ | PERM_WRITE | PERM_EXEC};
+	int ret;
+
+	if (!sgt || !src_vmids || !nr_acl_entries)
+		return -EINVAL;
+
+	if (memparcel_hdl != MEM_BUF_MEMPARCEL_INVALID) {
+		ret = mem_buf_unassign_mem_gunyah(memparcel_hdl);
+		if (ret)
+			return ret;
+	}
+
+	ret = mem_buf_hyp_assign_table(sgt, src_vmids, nr_acl_entries,
+			       dst_vmid, dst_perm, ARRAY_SIZE(dst_vmid));
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_unassign_mem);
+
+static int mem_buf_probe(struct platform_device *pdev)
+{
+	int ret, unused;
+	struct device *dev = &pdev->dev;
+	u64 dma_mask = IS_ENABLED(CONFIG_ARM64) ? DMA_BIT_MASK(64) :
+		DMA_BIT_MASK(32);
+
+	if (of_property_match_string(dev->of_node, "qcom,mem-buf-capabilities",
+				     "supplier") >= 0)
+		mem_buf_capability = MEM_BUF_CAP_SUPPLIER;
+	else if (of_property_match_string(dev->of_node,
+					    "qcom,mem-buf-capabilities",
+					    "consumer") >= 0)
+		mem_buf_capability = MEM_BUF_CAP_CONSUMER;
+	else if (of_property_match_string(dev->of_node,
+					    "qcom,mem-buf-capabilities",
+					    "dual") >= 0)
+		mem_buf_capability = MEM_BUF_CAP_DUAL;
+	else
+		mem_buf_capability = 0;
+
+	ret = dma_set_mask_and_coherent(dev, dma_mask);
+	if (ret) {
+		dev_err(dev, "Unable to set dma mask: %d\n", ret);
+		return ret;
+	}
+
+	if (of_find_property(dev->of_node, "memory-region", &unused)) {
+		ret = of_reserved_mem_device_init_by_idx(dev, dev->of_node, 0);
+		if (ret) {
+			dev_err(dev, "Failed to get memory-region property %d\n", ret);
+			return ret;
+		}
+	}
+
+	ret = mem_buf_vm_init(dev);
+	if (ret) {
+		dev_err(dev, "mem_buf_vm_init failed %d\n", ret);
+		return ret;
+	}
+
+	mem_buf_dev = dev;
+	return 0;
+}
+
+static int mem_buf_remove(struct platform_device *pdev)
+{
+	mem_buf_dev = NULL;
+	return 0;
+}
+
+static const struct of_device_id mem_buf_match_tbl[] = {
+	 {.compatible = "qcom,mem-buf"},
+	 {},
+};
+
+static struct platform_driver mem_buf_driver = {
+	.probe = mem_buf_probe,
+	.remove = mem_buf_remove,
+	.driver = {
+		.name = "mem-buf",
+		.of_match_table = of_match_ptr(mem_buf_match_tbl),
+	},
+};
+
+static int __init mem_buf_dev_init(void)
+{
+	return platform_driver_register(&mem_buf_driver);
+}
+module_init(mem_buf_dev_init);
+
+static void __exit mem_buf_dev_exit(void)
+{
+	mem_buf_vm_exit();
+	platform_driver_unregister(&mem_buf_driver);
+}
+module_exit(mem_buf_dev_exit);
+
+MODULE_DESCRIPTION("Qualcomm Technologies, Inc. Memory Buffer Sharing driver");
+MODULE_LICENSE("GPL");
+MODULE_IMPORT_NS(DMA_BUF);
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf-dev.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf-dev.h
@@ -0,0 +1,105 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef MEM_BUF_PRIVATE_H
+#define MEM_BUF_PRIVATE_H
+
+#include <linux/device.h>
+#include <linux/dma-buf.h>
+#include <linux/mem-buf.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+
+#define MEM_BUF_MEMPARCEL_INVALID (U32_MAX)
+
+#define MEM_BUF_CAP_SUPPLIER	BIT(0)
+#define MEM_BUF_CAP_CONSUMER	BIT(1)
+#define MEM_BUF_CAP_DUAL (MEM_BUF_CAP_SUPPLIER | MEM_BUF_CAP_CONSUMER)
+extern unsigned char mem_buf_capability;
+extern struct device *mem_buf_dev;
+
+/* Hypervisor Interface */
+int mem_buf_assign_mem(u32 op, struct sg_table *sgt,
+		       struct mem_buf_lend_kernel_arg *arg);
+int mem_buf_unassign_mem(struct sg_table *sgt, int *src_vmids,
+			 unsigned int nr_acl_entries,
+			 gh_memparcel_handle_t hdl);
+int mem_buf_hyp_assign_table(struct sg_table *sgt, u32 *src_vmid, int source_nelems,
+			     int *dest_vmids, int *dest_perms, int dest_nelems);
+
+#ifdef CONFIG_QCOM_MEM_BUF_DEV_GH
+struct gh_acl_desc *mem_buf_vmid_perm_list_to_gh_acl(int *vmids, int *perms,
+						     unsigned int nr_acl_entries);
+struct gh_sgl_desc *mem_buf_sgt_to_gh_sgl_desc(struct sg_table *sgt);
+int mem_buf_map_mem_s2(u32 op, gh_memparcel_handle_t *__memparcel_hdl,
+			struct gh_acl_desc *acl_desc, struct gh_sgl_desc **sgl_desc,
+			int src_vmid);
+int mem_buf_unmap_mem_s2(gh_memparcel_handle_t memparcel_hdl);
+int mem_buf_gh_acl_desc_to_vmid_perm_list(struct gh_acl_desc *acl_desc,
+					  int **vmids, int **perms);
+size_t mem_buf_get_sgl_buf_size(struct gh_sgl_desc *sgl_desc);
+struct sg_table *dup_gh_sgl_desc_to_sgt(struct gh_sgl_desc *sgl_desc);
+struct gh_sgl_desc *dup_gh_sgl_desc(struct gh_sgl_desc *sgl_desc);
+int mem_buf_assign_mem_gunyah(u32 op, struct sg_table *sgt,
+			      struct mem_buf_lend_kernel_arg *arg);
+int mem_buf_unassign_mem_gunyah(gh_memparcel_handle_t memparcel_hdl);
+#else
+static inline struct gh_acl_desc *mem_buf_vmid_perm_list_to_gh_acl(int *vmids, int *perms,
+								   unsigned int nr_acl_entries)
+{
+	return ERR_PTR(-EINVAL);
+}
+
+static inline struct gh_sgl_desc *mem_buf_sgt_to_gh_sgl_desc(struct sg_table *sgt)
+{
+	return ERR_PTR(-EINVAL);
+}
+
+static inline int mem_buf_map_mem_s2(u32 op, gh_memparcel_handle_t *__memparcel_hdl,
+				     struct gh_acl_desc *acl_desc, struct gh_sgl_desc **__sgl_desc,
+				     int src_vmid)
+{
+	return -EINVAL;
+}
+
+static inline int mem_buf_unmap_mem_s2(gh_memparcel_handle_t memparcel_hdl)
+{
+	return -EINVAL;
+}
+
+static inline int mem_buf_gh_acl_desc_to_vmid_perm_list(struct gh_acl_desc *acl_desc,
+							int **vmids, int **perms)
+{
+	return -EINVAL;
+}
+
+static inline size_t mem_buf_get_sgl_buf_size(struct gh_sgl_desc *sgl_desc)
+{
+	return 0;
+}
+
+static inline struct sg_table *dup_gh_sgl_desc_to_sgt(struct gh_sgl_desc *sgl_desc)
+{
+	return ERR_PTR(-EINVAL);
+}
+
+static inline struct gh_sgl_desc *dup_gh_sgl_desc(struct gh_sgl_desc *sgl_desc)
+{
+	return ERR_PTR(-EINVAL);
+}
+
+static inline int mem_buf_assign_mem_gunyah(u32 op, struct sg_table *sgt,
+					    struct mem_buf_lend_kernel_arg *arg)
+{
+	return 0;
+}
+
+static inline int mem_buf_unassign_mem_gunyah(gh_memparcel_handle_t memparcel_hdl)
+{
+	return 0;
+}
+#endif
+#endif
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf-gh.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf-gh.c
@@ -0,0 +1,1441 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/anon_inodes.h>
+#include <linux/gunyah/gh_msgq.h>
+#include <linux/kthread.h>
+#include <linux/memory_hotplug.h>
+#include <linux/module.h>
+#include <linux/qcom_dma_heap.h>
+#include <linux/qcom_tui_heap.h>
+#include <linux/dma-map-ops.h>
+#include <linux/memremap.h>
+#include <linux/cma.h>
+
+#include "../../../../drivers/dma-buf/heaps/qcom_sg_ops.h"
+#include "mem-buf-gh.h"
+#include "mem-buf-msgq.h"
+#include "mem-buf-ids.h"
+#include "trace-mem-buf.h"
+
+#define MEM_BUF_MHP_ALIGNMENT (1UL << SUBSECTION_SHIFT)
+#define MEM_BUF_TIMEOUT_MS 3500
+#define to_rmt_msg(_work) container_of(_work, struct mem_buf_rmt_msg, work)
+
+/* Maintains a list of memory buffers requested from other VMs */
+static DEFINE_MUTEX(mem_buf_list_lock);
+static LIST_HEAD(mem_buf_list);
+
+/* Data structures for tracking message queue usage. */
+static struct workqueue_struct *mem_buf_wq;
+static void *mem_buf_msgq_hdl;
+
+/* Maintains a list of memory buffers lent out to other VMs */
+static DEFINE_MUTEX(mem_buf_xfer_mem_list_lock);
+static LIST_HEAD(mem_buf_xfer_mem_list);
+
+/**
+ * struct mem_buf_rmt_msg: Represents a message sent from a remote VM
+ * @msg: A pointer to the message buffer
+ * @msg_size: The size of the message
+ * @work: work structure for dispatching the message processing to a worker
+ * thread, so as to not block the message queue receiving thread.
+ */
+struct mem_buf_rmt_msg {
+	void *msg;
+	size_t msg_size;
+	struct work_struct work;
+};
+
+/**
+ * struct mem_buf_xfer_mem: Represents a memory buffer lent out or transferred
+ * to another VM.
+ * @size: The size of the memory buffer
+ * @mem_type: The type of memory that was allocated and transferred
+ * @mem_type_data: Data associated with the type of memory
+ * @mem_sgt: An SG-Table representing the memory transferred
+ * @secure_alloc: Denotes if the memory was assigned to the targeted VMs as part
+ * of the allocation step
+ * @hdl: The memparcel handle associated with the memory
+ * @trans_type: The type of memory transfer associated with the memory (donation,
+ * share, lend).
+ * @entry: List entry for maintaining a list of memory buffers that are lent
+ * out.
+ * @nr_acl_entries: The number of VMIDs and permissions associated with the
+ * memory
+ * @dst_vmids: The VMIDs that have access to the memory
+ * @dst_perms: The access permissions for the VMIDs that can access the memory
+ * @obj_id: Uniquely identifies this object.
+ */
+struct mem_buf_xfer_mem {
+	size_t size;
+	enum mem_buf_mem_type mem_type;
+	void *mem_type_data;
+	struct sg_table *mem_sgt;
+	bool secure_alloc;
+	u32 trans_type;
+	gh_memparcel_handle_t hdl;
+	struct list_head entry;
+	u32 nr_acl_entries;
+	int *dst_vmids;
+	int *dst_perms;
+	u32 obj_id;
+};
+
+/**
+ * struct mem_buf_desc - Internal data structure, which contains information
+ * about a particular memory buffer.
+ * @size: The size of the memory buffer
+ * @acl_desc: A GH ACL descriptor that describes the VMIDs that have access to
+ * the memory, as well as the permissions each VMID has.
+ * @sgl_desc: An GH SG-List descriptor that describes the IPAs of the memory
+ * associated with the memory buffer that was allocated from another VM.
+ * @memparcel_hdl: The handle associated with the memparcel that represents the
+ * memory buffer.
+ * @trans_type: The type of memory transfer associated with the memory (donation,
+ * share, lend).
+ * @src_mem_type: The type of memory that was allocated on the remote VM
+ * @src_data: Memory type specific data used by the remote VM when performing
+ * the allocation.
+ * @dst_mem_type: The memory type of the memory buffer on the native VM
+ * @dst_data: Memory type specific data used by the native VM when adding the
+ * memory to the system.
+ * @filp: Pointer to the file structure for the membuf
+ * @entry: List head for maintaing a list of memory buffers that have been
+ * provided by remote VMs.
+ * @obj_id: Uniquely identifies this object.
+ */
+struct mem_buf_desc {
+	size_t size;
+	struct gh_acl_desc *acl_desc;
+	struct gh_sgl_desc *sgl_desc;
+	gh_memparcel_handle_t memparcel_hdl;
+	u32 trans_type;
+	enum mem_buf_mem_type src_mem_type;
+	void *src_data;
+	enum mem_buf_mem_type dst_mem_type;
+	void *dst_data;
+	struct file *filp;
+	struct list_head entry;
+	u32 obj_id;
+};
+static DEFINE_IDR(mem_buf_obj_idr);
+static DEFINE_MUTEX(mem_buf_idr_mutex);
+
+struct mem_buf_xfer_dmaheap_mem {
+	char name[MEM_BUF_MAX_DMAHEAP_NAME_LEN];
+	struct dma_buf *dmabuf;
+	struct dma_buf_attachment *attachment;
+};
+
+/*
+ * mem_buf_dmabuf_obj
+ * A dmabuf object representing memory shared/lent by another Virtual machine
+ * and obtained via mem_buf_retrieve().
+ * @buffer: data type expected by qcom_sg_buf_ops
+ * @pgmap: Arguments to memremap_pages
+ */
+struct mem_buf_dmabuf_obj {
+	struct qcom_sg_buffer buffer;
+	struct dev_pagemap pgmap;
+};
+
+static int mem_buf_alloc_obj_id(void)
+{
+	int ret;
+
+	mutex_lock(&mem_buf_idr_mutex);
+	ret = idr_alloc_cyclic(&mem_buf_obj_idr, NULL, 0, INT_MAX, GFP_KERNEL);
+	mutex_unlock(&mem_buf_idr_mutex);
+	if (ret < 0) {
+		pr_err("%s: failed to allocate obj id rc: %d\n",
+		       __func__, ret);
+		return ret;
+	}
+	return ret;
+}
+
+static void mem_buf_destroy_obj_id(u32 obj_id)
+{
+	mutex_lock(&mem_buf_idr_mutex);
+	idr_remove(&mem_buf_obj_idr, obj_id);
+	mutex_unlock(&mem_buf_idr_mutex);
+}
+
+/* Functions invoked when treating allocation requests from other VMs. */
+static int mem_buf_rmt_alloc_dmaheap_mem(struct mem_buf_xfer_mem *xfer_mem)
+{
+	struct dma_buf *dmabuf;
+	struct dma_buf_attachment *attachment;
+	struct sg_table *mem_sgt;
+	struct mem_buf_xfer_dmaheap_mem *dmaheap_mem_data = xfer_mem->mem_type_data;
+	int flags = O_RDWR | O_CLOEXEC;
+	struct dma_heap *heap;
+	char *name = dmaheap_mem_data->name;
+
+	pr_debug("%s: Starting DMAHEAP allocation\n", __func__);
+	heap = dma_heap_find(name);
+	if (!heap) {
+		pr_err("%s no such heap %s\n", __func__, name);
+		return -EINVAL;
+	}
+
+	dmabuf = dma_heap_buffer_alloc(heap, xfer_mem->size, flags, 0);
+	if (IS_ERR(dmabuf)) {
+		pr_err("%s dmaheap_alloc failure sz: 0x%zx heap: %s flags: 0x%x rc: %ld\n",
+		       __func__, xfer_mem->size, name, flags,
+		       PTR_ERR(dmabuf));
+		return PTR_ERR(dmabuf);
+	}
+
+	attachment = dma_buf_attach(dmabuf, mem_buf_dev);
+	if (IS_ERR(attachment)) {
+		pr_err("%s dma_buf_attach failure rc: %ld\n",  __func__,
+		       PTR_ERR(attachment));
+		dma_buf_put(dmabuf);
+		return PTR_ERR(attachment);
+	}
+
+	mem_sgt = dma_buf_map_attachment_unlocked(attachment, DMA_BIDIRECTIONAL);
+	if (IS_ERR(mem_sgt)) {
+		pr_err("%s dma_buf_map_attachment failure rc: %ld\n", __func__,
+		       PTR_ERR(mem_sgt));
+		dma_buf_detach(dmabuf, attachment);
+		dma_buf_put(dmabuf);
+		return PTR_ERR(mem_sgt);
+	}
+
+	dmaheap_mem_data->dmabuf = dmabuf;
+	dmaheap_mem_data->attachment = attachment;
+	xfer_mem->mem_sgt = mem_sgt;
+	xfer_mem->secure_alloc = false;
+
+	pr_debug("%s: DMAHEAP allocation complete\n", __func__);
+	return 0;
+}
+
+/*
+ * See __iommu_dma_alloc_pages() @ dma-iommu.c
+ * GFP_NORETRY allows some direct reclaim for large order pages.
+ * GFP_ZERO to avoid leaking prior contents to another VM.
+ */
+static int mem_buf_rmt_alloc_pages(struct sg_table *sgt, unsigned int count)
+{
+	int ret, i = 0;
+	struct page **pages;
+	size_t size = count << PAGE_SHIFT;
+	unsigned long order_mask = (1U << MAX_ORDER) - 1;
+
+	pages = kvcalloc(count, sizeof(*pages), GFP_KERNEL);
+	if (!pages)
+		return -ENOMEM;
+
+	while (count) {
+		struct page *page = NULL;
+		unsigned int order_size;
+
+		for (order_mask &= (2 << __fls(count)) - 1;
+		     order_mask; order_mask &= ~order_size) {
+			unsigned int order = __fls(order_mask);
+			gfp_t alloc_flags = GFP_KERNEL | __GFP_ZERO;
+
+			order_size = 1U << order;
+			if (order_mask > order_size)
+				alloc_flags |= __GFP_NORETRY | __GFP_NOWARN;
+
+			page = alloc_pages(alloc_flags, order);
+			if (!page)
+				continue;
+			if (order)
+				split_page(page, order);
+			break;
+		}
+		if (!page) {
+			ret = -ENOMEM;
+			goto err_alloc_pages;
+		}
+
+		count -= order_size;
+		while (order_size--)
+			pages[i++] = page++;
+	}
+
+	count = i;
+	ret = sg_alloc_table_from_pages(sgt, pages, count, 0, size, GFP_KERNEL);
+	if (ret)
+		goto err_alloc_table;
+
+	kvfree(pages);
+	return 0;
+
+err_alloc_table:
+err_alloc_pages:
+	while (i--)
+		__free_page(pages[i]);
+	kvfree(pages);
+	return ret;
+}
+
+static int mem_buf_rmt_alloc_cma(struct sg_table *sgt, unsigned int count)
+{
+	struct cma *cma;
+	struct page *page;
+	int ret;
+	u32 align;
+
+	/*
+	 * For the common case of 4Mb transfer, we want it to be nicely aligned
+	 * to allow for 2Mb block mappings in S2 pagetable.
+	 */
+	align = min(get_order(count << PAGE_SHIFT), get_order(SZ_2M));
+
+	/*
+	 * Don't use dev_get_cma_area() as we don't want to fall back to
+	 * dma_contiguous_default_area.
+	 */
+	cma = mem_buf_dev->cma_area;
+	if (!cma)
+		return -ENOMEM;
+
+	ret = sg_alloc_table(sgt, 1, GFP_KERNEL);
+	if (ret)
+		return ret;
+
+	page = cma_alloc(cma, count, align, false);
+	if (!page) {
+		ret = -ENOMEM;
+		goto err_cma_alloc;
+	}
+
+	sg_set_page(sgt->sgl, page, count << PAGE_SHIFT, 0);
+
+	/* Zero memory before transferring to Guest VM */
+	memset(page_address(page), 0, count << PAGE_SHIFT);
+
+	return 0;
+
+err_cma_alloc:
+	sg_free_table(sgt);
+	return ret;
+}
+
+static int mem_buf_rmt_alloc_buddy_mem(struct mem_buf_xfer_mem *xfer_mem)
+{
+	struct sg_table *sgt;
+	int ret;
+	unsigned int count = PAGE_ALIGN(xfer_mem->size) >> PAGE_SHIFT;
+
+	pr_debug("%s: Starting DMAHEAP-BUDDY allocation\n", __func__);
+	sgt = kzalloc(sizeof(*sgt), GFP_KERNEL);
+	if (!sgt)
+		return -ENOMEM;
+
+	if (mem_buf_dev->cma_area)
+		ret = mem_buf_rmt_alloc_cma(sgt, count);
+	else
+		ret = mem_buf_rmt_alloc_pages(sgt, count);
+	if (ret)
+		goto err_alloc_pages;
+
+	xfer_mem->mem_sgt = sgt;
+	xfer_mem->secure_alloc = false;
+	pr_debug("%s: DMAHEAP-BUDDY allocation complete\n", __func__);
+	return 0;
+
+err_alloc_pages:
+	kfree(sgt);
+	return ret;
+}
+
+static int mem_buf_rmt_alloc_mem(struct mem_buf_xfer_mem *xfer_mem)
+{
+	int ret = -EINVAL;
+
+	if (xfer_mem->mem_type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		ret = mem_buf_rmt_alloc_dmaheap_mem(xfer_mem);
+	else if (xfer_mem->mem_type == MEM_BUF_BUDDY_MEM_TYPE)
+		ret = mem_buf_rmt_alloc_buddy_mem(xfer_mem);
+
+	return ret;
+}
+
+static void mem_buf_rmt_free_dmaheap_mem(struct mem_buf_xfer_mem *xfer_mem)
+{
+	struct mem_buf_xfer_dmaheap_mem *dmaheap_mem_data = xfer_mem->mem_type_data;
+	struct dma_buf *dmabuf = dmaheap_mem_data->dmabuf;
+	struct dma_buf_attachment *attachment = dmaheap_mem_data->attachment;
+	struct sg_table *mem_sgt = xfer_mem->mem_sgt;
+
+	pr_debug("%s: Freeing DMAHEAP memory\n", __func__);
+	dma_buf_unmap_attachment_unlocked(attachment, mem_sgt, DMA_BIDIRECTIONAL);
+	dma_buf_detach(dmabuf, attachment);
+	dma_buf_put(dmaheap_mem_data->dmabuf);
+	/*
+	 * No locks should be held at this point, as flush_delayed_fput may call the
+	 * release callbacks of arbitrary files. It should be safe for us since we
+	 * know this function is called only from our recv kthread, so we have control
+	 * over what locks are currently held.
+	 */
+	flush_delayed_fput();
+	pr_debug("%s: DMAHEAP memory freed\n", __func__);
+}
+
+static void mem_buf_rmt_free_buddy_mem(struct mem_buf_xfer_mem *xfer_mem)
+{
+	struct sg_table *table = xfer_mem->mem_sgt;
+	struct sg_page_iter sgiter;
+	bool is_cma;
+
+	pr_debug("%s: Freeing DMAHEAP-BUDDY memory\n", __func__);
+
+	/* Returns false when called on !cma memory */
+	is_cma = cma_release(mem_buf_dev->cma_area, sg_page(table->sgl),
+				table->sgl->length >> PAGE_SHIFT);
+	if (!is_cma)
+		for_each_sg_page(table->sgl, &sgiter, table->nents, 0)
+			__free_page(sg_page_iter_page(&sgiter));
+
+	sg_free_table(table);
+	kfree(table);
+	pr_debug("%s: DMAHEAP-BUDDY memory freed\n", __func__);
+}
+
+static void mem_buf_rmt_free_mem(struct mem_buf_xfer_mem *xfer_mem)
+{
+	if (xfer_mem->mem_type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		mem_buf_rmt_free_dmaheap_mem(xfer_mem);
+	else if (xfer_mem->mem_type == MEM_BUF_BUDDY_MEM_TYPE)
+		mem_buf_rmt_free_buddy_mem(xfer_mem);
+}
+
+static
+struct mem_buf_xfer_dmaheap_mem *mem_buf_alloc_dmaheap_xfer_mem_type_data(
+								void *rmt_data)
+{
+	struct mem_buf_xfer_dmaheap_mem *dmaheap_mem_data;
+
+	dmaheap_mem_data = kzalloc(sizeof(*dmaheap_mem_data), GFP_KERNEL);
+	if (!dmaheap_mem_data)
+		return ERR_PTR(-ENOMEM);
+
+	strscpy(dmaheap_mem_data->name, (char *)rmt_data,
+		MEM_BUF_MAX_DMAHEAP_NAME_LEN);
+	pr_debug("%s: DMAHEAP source heap: %s\n", __func__,
+		dmaheap_mem_data->name);
+	return dmaheap_mem_data;
+}
+
+static void *mem_buf_alloc_xfer_mem_type_data(enum mem_buf_mem_type type,
+					      void *rmt_data)
+{
+	void *data = ERR_PTR(-EINVAL);
+
+	if (type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		data = mem_buf_alloc_dmaheap_xfer_mem_type_data(rmt_data);
+	else if (type == MEM_BUF_BUDDY_MEM_TYPE)
+		data = NULL;
+
+	return data;
+}
+
+static
+void mem_buf_free_dmaheap_xfer_mem_type_data(struct mem_buf_xfer_dmaheap_mem *mem)
+{
+	kfree(mem);
+}
+
+static void mem_buf_free_xfer_mem_type_data(enum mem_buf_mem_type type,
+					    void *data)
+{
+	if (type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		mem_buf_free_dmaheap_xfer_mem_type_data(data);
+	/* Do nothing for MEM_BUF_BUDDY_MEM_TYPE */
+}
+
+static
+struct mem_buf_xfer_mem *mem_buf_prep_xfer_mem(void *req_msg)
+{
+	int ret;
+	struct mem_buf_xfer_mem *xfer_mem;
+	u32 nr_acl_entries;
+	void *arb_payload;
+	enum mem_buf_mem_type mem_type;
+	void *mem_type_data;
+
+	nr_acl_entries = get_alloc_req_nr_acl_entries(req_msg);
+	if (nr_acl_entries != 1)
+		return ERR_PTR(-EINVAL);
+
+	arb_payload = get_alloc_req_arb_payload(req_msg);
+	if (!arb_payload)
+		return ERR_PTR(-EINVAL);
+
+	mem_type = get_alloc_req_src_mem_type(req_msg);
+
+	xfer_mem = kzalloc(sizeof(*xfer_mem), GFP_KERNEL);
+	if (!xfer_mem)
+		return ERR_PTR(-ENOMEM);
+
+	ret = mem_buf_alloc_obj_id();
+	if (ret < 0) {
+		pr_err("%s failed to allocate obj_id: %d\n", __func__, ret);
+		goto err_idr_alloc;
+	}
+	xfer_mem->obj_id = ret;
+
+	xfer_mem->size = get_alloc_req_size(req_msg);
+	xfer_mem->mem_type = mem_type;
+	xfer_mem->nr_acl_entries = nr_acl_entries;
+	ret = mem_buf_gh_acl_desc_to_vmid_perm_list(get_alloc_req_gh_acl_desc(req_msg),
+						    &xfer_mem->dst_vmids,
+						    &xfer_mem->dst_perms);
+	if (ret) {
+		pr_err("%s failed to create VMID and permissions list: %d\n",
+		       __func__, ret);
+		goto err_alloc_vmid_perm_list;
+	}
+	mem_type_data = mem_buf_alloc_xfer_mem_type_data(mem_type, arb_payload);
+	if (IS_ERR(mem_type_data)) {
+		pr_err("%s: failed to allocate mem type specific data: %ld\n",
+		       __func__, PTR_ERR(mem_type_data));
+		ret = PTR_ERR(mem_type_data);
+		goto err_alloc_xfer_mem_type_data;
+	}
+	xfer_mem->mem_type_data = mem_type_data;
+	INIT_LIST_HEAD(&xfer_mem->entry);
+	return xfer_mem;
+
+err_alloc_xfer_mem_type_data:
+	kfree(xfer_mem->dst_vmids);
+	kfree(xfer_mem->dst_perms);
+err_alloc_vmid_perm_list:
+	mem_buf_destroy_obj_id(xfer_mem->obj_id);
+err_idr_alloc:
+	kfree(xfer_mem);
+	return ERR_PTR(ret);
+}
+
+static void mem_buf_free_xfer_mem(struct mem_buf_xfer_mem *xfer_mem)
+{
+	mem_buf_free_xfer_mem_type_data(xfer_mem->mem_type,
+					xfer_mem->mem_type_data);
+	kfree(xfer_mem->dst_vmids);
+	kfree(xfer_mem->dst_perms);
+	mem_buf_destroy_obj_id(xfer_mem->obj_id);
+	kfree(xfer_mem);
+}
+
+/*
+ * @owner_vmid: Owner of the memparcel handle which has @vmids and @perms
+ */
+static int __maybe_unused mem_buf_get_mem_xfer_type(int *vmids, int *perms,
+						    unsigned int nr_acl_entries, int owner_vmid)
+{
+	u32 i;
+
+	for (i = 0; i < nr_acl_entries; i++)
+		if (vmids[i] == owner_vmid &&
+		    perms[i] != 0)
+			return GH_RM_TRANS_TYPE_SHARE;
+
+	return GH_RM_TRANS_TYPE_LEND;
+}
+
+/*
+ * @owner_vmid: Owner of the memparcel handle which has @acl_desc
+ */
+static int mem_buf_get_mem_xfer_type_gh(struct gh_acl_desc *acl_desc, int owner_vmid)
+{
+	u32 i, nr_acl_entries = acl_desc->n_acl_entries;
+
+	for (i = 0; i < nr_acl_entries; i++)
+		if (acl_desc->acl_entries[i].vmid == owner_vmid &&
+		    acl_desc->acl_entries[i].perms != 0)
+			return GH_RM_TRANS_TYPE_SHARE;
+
+	return GH_RM_TRANS_TYPE_LEND;
+}
+
+static struct mem_buf_xfer_mem *mem_buf_process_alloc_req(void *req)
+{
+	int ret;
+	u32 xfer_type;
+	struct mem_buf_xfer_mem *xfer_mem;
+	struct mem_buf_lend_kernel_arg arg = {0};
+
+	xfer_mem = mem_buf_prep_xfer_mem(req);
+	if (IS_ERR(xfer_mem))
+		return xfer_mem;
+
+	ret = mem_buf_rmt_alloc_mem(xfer_mem);
+	if (ret < 0)
+		goto err_rmt_alloc;
+
+	if (!xfer_mem->secure_alloc) {
+		xfer_type = get_alloc_req_xfer_type(req);
+
+		arg.nr_acl_entries = xfer_mem->nr_acl_entries;
+		arg.vmids = xfer_mem->dst_vmids;
+		arg.perms = xfer_mem->dst_perms;
+		ret = mem_buf_assign_mem(xfer_type, xfer_mem->mem_sgt, &arg);
+		if (ret < 0)
+			goto err_assign_mem;
+
+		xfer_mem->hdl = arg.memparcel_hdl;
+		xfer_mem->trans_type = xfer_type;
+	}
+
+	mutex_lock(&mem_buf_xfer_mem_list_lock);
+	list_add(&xfer_mem->entry, &mem_buf_xfer_mem_list);
+	mutex_unlock(&mem_buf_xfer_mem_list_lock);
+
+	return xfer_mem;
+
+err_assign_mem:
+	if (ret != -EADDRNOTAVAIL)
+		mem_buf_rmt_free_mem(xfer_mem);
+err_rmt_alloc:
+	mem_buf_free_xfer_mem(xfer_mem);
+	return ERR_PTR(ret);
+}
+
+static void mem_buf_cleanup_alloc_req(struct mem_buf_xfer_mem *xfer_mem,
+				      gh_memparcel_handle_t memparcel_hdl)
+{
+	int ret;
+
+	if (!xfer_mem->secure_alloc) {
+		if (memparcel_hdl == xfer_mem->hdl) {
+			ret = mem_buf_unassign_mem(xfer_mem->mem_sgt,
+						   xfer_mem->dst_vmids,
+						   xfer_mem->nr_acl_entries,
+						   xfer_mem->hdl);
+			if (ret < 0)
+				return;
+		} else {
+			struct gh_sgl_desc *sgl_desc = NULL;
+			struct gh_acl_desc *acl_desc;
+			size_t size;
+
+			size = struct_size(acl_desc, acl_entries, 1);
+			acl_desc = kzalloc(size, GFP_KERNEL);
+			if (!acl_desc)
+				return;
+
+			acl_desc->n_acl_entries = 1;
+			acl_desc->acl_entries[0].vmid = VMID_HLOS;
+			acl_desc->acl_entries[0].perms = GH_RM_ACL_X | GH_RM_ACL_W | GH_RM_ACL_R;
+
+			ret = mem_buf_map_mem_s2(GH_RM_TRANS_TYPE_DONATE, &memparcel_hdl,
+						      acl_desc, &sgl_desc, VMID_TVM);
+			if (ret) {
+				kfree(acl_desc);
+				return;
+			}
+			kvfree(sgl_desc);
+			kfree(acl_desc);
+		}
+	}
+	mem_buf_rmt_free_mem(xfer_mem);
+	mem_buf_free_xfer_mem(xfer_mem);
+}
+
+static void mem_buf_alloc_req_work(struct work_struct *work)
+{
+	struct mem_buf_rmt_msg *rmt_msg = to_rmt_msg(work);
+	void *req_msg = rmt_msg->msg;
+	void *resp_msg;
+	struct mem_buf_xfer_mem *xfer_mem;
+	gh_memparcel_handle_t hdl = 0;
+	u32 obj_id = 0;
+	int ret;
+
+	trace_receive_alloc_req(req_msg);
+	xfer_mem = mem_buf_process_alloc_req(req_msg);
+	if (IS_ERR(xfer_mem)) {
+		ret = PTR_ERR(xfer_mem);
+		pr_err("%s: failed to process rmt memory alloc request: %d\n",
+		       __func__, ret);
+		xfer_mem = NULL;
+	} else {
+		ret = 0;
+		hdl = xfer_mem->hdl;
+		obj_id = xfer_mem->obj_id;
+	}
+
+	resp_msg = mem_buf_construct_alloc_resp(req_msg, ret, hdl, obj_id);
+
+	kfree(rmt_msg->msg);
+	kfree(rmt_msg);
+	if (IS_ERR(resp_msg))
+		goto out_err;
+
+	trace_send_alloc_resp_msg(resp_msg);
+	ret = mem_buf_msgq_send(mem_buf_msgq_hdl, resp_msg);
+	/*
+	 * Free the buffer regardless of the return value as the hypervisor
+	 * would have consumed the data in the case of a success.
+	 */
+	kfree(resp_msg);
+	if (ret < 0) {
+		pr_err("%s: failed to send memory allocation response rc: %d\n",
+		       __func__, ret);
+		goto out_err;
+	}
+	pr_debug("%s: Allocation response sent\n", __func__);
+	return;
+
+out_err:
+	if (xfer_mem) {
+		mutex_lock(&mem_buf_xfer_mem_list_lock);
+		list_del(&xfer_mem->entry);
+		mutex_unlock(&mem_buf_xfer_mem_list_lock);
+		mem_buf_cleanup_alloc_req(xfer_mem, xfer_mem->hdl);
+	}
+}
+
+static void mem_buf_relinquish_work(struct work_struct *work)
+{
+	struct mem_buf_xfer_mem *xfer_mem_iter, *tmp, *xfer_mem = NULL;
+	struct mem_buf_rmt_msg *rmt_msg = to_rmt_msg(work);
+	struct mem_buf_alloc_relinquish *relinquish_msg = rmt_msg->msg;
+	u32 obj_id = get_relinquish_req_obj_id(relinquish_msg);
+	void *resp_msg;
+
+	trace_receive_relinquish_msg(relinquish_msg);
+	mutex_lock(&mem_buf_xfer_mem_list_lock);
+	list_for_each_entry_safe(xfer_mem_iter, tmp, &mem_buf_xfer_mem_list,
+				 entry)
+		if (xfer_mem_iter->obj_id == obj_id) {
+			xfer_mem = xfer_mem_iter;
+			list_del(&xfer_mem->entry);
+			break;
+		}
+	mutex_unlock(&mem_buf_xfer_mem_list_lock);
+
+	if (xfer_mem)
+		mem_buf_cleanup_alloc_req(xfer_mem, relinquish_msg->hdl);
+	else
+		pr_err("%s: transferred memory with obj_id 0x%x not found\n",
+		       __func__, obj_id);
+
+	resp_msg = mem_buf_construct_relinquish_resp(relinquish_msg);
+	if (!IS_ERR(resp_msg)) {
+		trace_send_relinquish_resp_msg(resp_msg);
+		mem_buf_msgq_send(mem_buf_msgq_hdl, resp_msg);
+		kfree(resp_msg);
+	}
+
+	kfree(rmt_msg->msg);
+	kfree(rmt_msg);
+}
+
+static int mem_buf_alloc_resp_hdlr(void *hdlr_data, void *msg_buf, size_t size, void *out_buf)
+{
+	struct mem_buf_alloc_resp *alloc_resp = msg_buf;
+	struct mem_buf_desc *membuf = out_buf;
+	int ret;
+
+	trace_receive_alloc_resp_msg(alloc_resp);
+	if (!(mem_buf_capability & MEM_BUF_CAP_CONSUMER))
+		return -EPERM;
+
+	ret = get_alloc_resp_retval(alloc_resp);
+	if (ret < 0) {
+		pr_err("%s remote allocation failed rc: %d\n", __func__, ret);
+	} else {
+		membuf->memparcel_hdl = get_alloc_resp_hdl(alloc_resp);
+		membuf->obj_id = get_alloc_resp_obj_id(alloc_resp);
+	}
+
+	return ret;
+}
+
+/* Functions invoked when treating allocation requests to other VMs. */
+static void mem_buf_alloc_req_hdlr(void *hdlr_data, void *_buf, size_t size)
+{
+	struct mem_buf_rmt_msg *rmt_msg;
+	void *buf;
+
+	if (!(mem_buf_capability & MEM_BUF_CAP_SUPPLIER))
+		return;
+
+	rmt_msg = kmalloc(sizeof(*rmt_msg), GFP_KERNEL);
+	if (!rmt_msg)
+		return;
+
+	buf = kmemdup(_buf, size, GFP_KERNEL);
+	if (!buf) {
+		kfree(rmt_msg);
+		return;
+	}
+
+	rmt_msg->msg = buf;
+	rmt_msg->msg_size = size;
+	INIT_WORK(&rmt_msg->work, mem_buf_alloc_req_work);
+	queue_work(mem_buf_wq, &rmt_msg->work);
+}
+
+static void mem_buf_relinquish_hdlr(void *hdlr_data, void *_buf, size_t size)
+{
+	struct mem_buf_rmt_msg *rmt_msg;
+	void *buf;
+
+	if (!(mem_buf_capability & MEM_BUF_CAP_SUPPLIER))
+		return;
+
+	rmt_msg = kmalloc(sizeof(*rmt_msg), GFP_KERNEL);
+	if (!rmt_msg)
+		return;
+
+	buf = kmemdup(_buf, size, GFP_KERNEL);
+	if (!buf) {
+		kfree(rmt_msg);
+		return;
+	}
+
+	rmt_msg->msg = buf;
+	rmt_msg->msg_size = size;
+	INIT_WORK(&rmt_msg->work, mem_buf_relinquish_work);
+	queue_work(mem_buf_wq, &rmt_msg->work);
+}
+
+static int mem_buf_request_mem(struct mem_buf_desc *membuf)
+{
+	struct mem_buf_txn *txn;
+	void *alloc_req_msg;
+	int ret;
+
+	txn = mem_buf_init_txn(mem_buf_msgq_hdl, membuf);
+	if (IS_ERR(txn))
+		return PTR_ERR(txn);
+
+	alloc_req_msg = mem_buf_construct_alloc_req(txn, membuf->size, membuf->acl_desc,
+						    membuf->src_mem_type, membuf->src_data,
+						    membuf->trans_type);
+	if (IS_ERR(alloc_req_msg)) {
+		ret = PTR_ERR(alloc_req_msg);
+		goto out;
+	}
+
+	ret = mem_buf_msgq_send(mem_buf_msgq_hdl, alloc_req_msg);
+
+	/*
+	 * Free the buffer regardless of the return value as the hypervisor
+	 * would have consumed the data in the case of a success.
+	 */
+	kfree(alloc_req_msg);
+
+	if (ret < 0)
+		goto out;
+
+	ret = mem_buf_txn_wait(mem_buf_msgq_hdl, txn);
+	if (ret < 0)
+		goto out;
+
+out:
+	mem_buf_destroy_txn(mem_buf_msgq_hdl, txn);
+	return ret;
+}
+
+static void __mem_buf_relinquish_mem(u32 obj_id, u32 memparcel_hdl)
+{
+	void *relinquish_msg, *txn;
+	int ret;
+
+	txn = mem_buf_init_txn(mem_buf_msgq_hdl, NULL);
+	if (IS_ERR(txn))
+		return;
+
+	relinquish_msg = mem_buf_construct_relinquish_msg(txn, obj_id, memparcel_hdl);
+	if (IS_ERR(relinquish_msg))
+		goto err_construct_relinquish_msg;
+
+	trace_send_relinquish_msg(relinquish_msg);
+	ret = mem_buf_msgq_send(mem_buf_msgq_hdl, relinquish_msg);
+
+	/*
+	 * Free the buffer regardless of the return value as the hypervisor
+	 * would have consumed the data in the case of a success.
+	 */
+	kfree(relinquish_msg);
+
+	if (ret < 0)
+		pr_err("%s failed to send memory relinquish message rc: %d\n",
+		       __func__, ret);
+	else
+		pr_debug("%s: allocation relinquish message sent\n", __func__);
+
+	/* Wait for response */
+	mem_buf_txn_wait(mem_buf_msgq_hdl, txn);
+
+err_construct_relinquish_msg:
+	mem_buf_destroy_txn(mem_buf_msgq_hdl, txn);
+}
+
+/*
+ * Check if membuf already has a valid handle. If it doesn't, then create one.
+ */
+static void mem_buf_relinquish_mem(struct mem_buf_desc *membuf)
+{
+	int ret;
+	int vmids[] = {VMID_HLOS};
+	int perms[] = {PERM_READ | PERM_WRITE | PERM_EXEC};
+	struct sg_table *sgt;
+	struct mem_buf_lend_kernel_arg arg;
+
+	if (membuf->memparcel_hdl != MEM_BUF_MEMPARCEL_INVALID) {
+		if (membuf->trans_type != GH_RM_TRANS_TYPE_DONATE) {
+			ret = mem_buf_unmap_mem_s2(membuf->memparcel_hdl);
+			if (ret)
+				return;
+		}
+
+		return __mem_buf_relinquish_mem(membuf->obj_id, membuf->memparcel_hdl);
+	}
+
+	sgt = dup_gh_sgl_desc_to_sgt(membuf->sgl_desc);
+	if (IS_ERR(sgt))
+		return;
+
+	arg.nr_acl_entries = 1;
+	arg.vmids = vmids;
+	arg.perms = perms;
+	arg.flags = GH_RM_MEM_DONATE_SANITIZE;
+	arg.label = 0;
+
+	ret = mem_buf_assign_mem(GH_RM_TRANS_TYPE_DONATE, sgt, &arg);
+	if (ret)
+		goto err_free_sgt;
+
+	membuf->memparcel_hdl = arg.memparcel_hdl;
+	__mem_buf_relinquish_mem(membuf->obj_id, membuf->memparcel_hdl);
+err_free_sgt:
+	sg_free_table(sgt);
+	kfree(sgt);
+}
+
+static void mem_buf_relinquish_memparcel_hdl(void *hdlr_data, u32 obj_id, gh_memparcel_handle_t hdl)
+{
+	__mem_buf_relinquish_mem(obj_id, hdl);
+}
+
+static void *mem_buf_retrieve_dmaheap_mem_type_data_user(
+				struct mem_buf_dmaheap_data __user *udata)
+{
+	char *buf;
+	int ret;
+	struct mem_buf_dmaheap_data data;
+
+	ret = copy_struct_from_user(&data, sizeof(data),
+				    udata,
+				    sizeof(data));
+	if (ret)
+		return ERR_PTR(-EINVAL);
+
+	buf = kcalloc(MEM_BUF_MAX_DMAHEAP_NAME_LEN, sizeof(*buf), GFP_KERNEL);
+	if (!buf)
+		return ERR_PTR(-ENOMEM);
+
+	ret = strncpy_from_user(buf, (const void __user *)data.heap_name,
+			MEM_BUF_MAX_DMAHEAP_NAME_LEN);
+	if (ret < 0 || ret == MEM_BUF_MAX_DMAHEAP_NAME_LEN) {
+		kfree(buf);
+		return ERR_PTR(-EINVAL);
+	}
+	return buf;
+}
+
+static void *mem_buf_retrieve_mem_type_data_user(enum mem_buf_mem_type mem_type,
+						 void __user *mem_type_data)
+{
+	void *data = ERR_PTR(-EINVAL);
+
+	if (mem_type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		data = mem_buf_retrieve_dmaheap_mem_type_data_user(mem_type_data);
+	else if (mem_type == MEM_BUF_BUDDY_MEM_TYPE)
+		data = NULL;
+
+	return data;
+}
+
+static void *mem_buf_retrieve_dmaheap_mem_type_data(char *dmaheap_name)
+{
+	return kstrdup(dmaheap_name, GFP_KERNEL);
+}
+
+static void *mem_buf_retrieve_mem_type_data(enum mem_buf_mem_type mem_type,
+					    void *mem_type_data)
+{
+	void *data = ERR_PTR(-EINVAL);
+
+	if (mem_type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		data = mem_buf_retrieve_dmaheap_mem_type_data(mem_type_data);
+	else if (mem_type == MEM_BUF_BUDDY_MEM_TYPE)
+		data = NULL;
+
+	return data;
+}
+
+static void mem_buf_free_dmaheap_mem_type_data(char *dmaheap_name)
+{
+	kfree(dmaheap_name);
+}
+
+static void mem_buf_free_mem_type_data(enum mem_buf_mem_type mem_type,
+				       void *mem_type_data)
+{
+	if (mem_type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		mem_buf_free_dmaheap_mem_type_data(mem_type_data);
+	/* Do nothing for MEM_BUF_BUDDY_MEM_TYPE */
+}
+
+static bool is_valid_mem_type(enum mem_buf_mem_type mem_type)
+{
+	return (mem_type == MEM_BUF_DMAHEAP_MEM_TYPE) ||
+		(mem_type == MEM_BUF_BUDDY_MEM_TYPE);
+}
+
+static bool is_valid_ioctl_mem_type(enum mem_buf_mem_type mem_type)
+{
+	return (mem_type == MEM_BUF_DMAHEAP_MEM_TYPE);
+}
+
+void *mem_buf_alloc(struct mem_buf_allocation_data *alloc_data)
+{
+	int ret;
+	struct mem_buf_desc *membuf;
+	int perms = PERM_READ | PERM_WRITE | PERM_EXEC;
+
+	if (!(mem_buf_capability & MEM_BUF_CAP_CONSUMER))
+		return ERR_PTR(-EOPNOTSUPP);
+
+	if (!alloc_data || !alloc_data->size || alloc_data->nr_acl_entries != 1 ||
+	    !alloc_data->vmids || !alloc_data->perms ||
+	    !is_valid_mem_type(alloc_data->src_mem_type) ||
+	    !is_valid_mem_type(alloc_data->dst_mem_type))
+		return ERR_PTR(-EINVAL);
+
+	membuf = kzalloc(sizeof(*membuf), GFP_KERNEL);
+	if (!membuf)
+		return ERR_PTR(-ENOMEM);
+
+	pr_debug("%s: mem buf alloc begin\n", __func__);
+	membuf->size = alloc_data->size;
+
+	/* Create copies of data structures from alloc_data as they may be on-stack */
+	membuf->acl_desc = mem_buf_vmid_perm_list_to_gh_acl(
+				alloc_data->vmids, &perms,
+				alloc_data->nr_acl_entries);
+	if (IS_ERR(membuf->acl_desc)) {
+		ret = PTR_ERR(membuf->acl_desc);
+		goto err_alloc_acl_list;
+	}
+
+	if (alloc_data->sgl_desc) {
+		membuf->sgl_desc = dup_gh_sgl_desc(alloc_data->sgl_desc);
+		if (IS_ERR(membuf->sgl_desc)) {
+			ret = PTR_ERR(membuf->sgl_desc);
+			goto err_alloc_sgl_desc;
+		}
+	}
+
+	membuf->trans_type = alloc_data->trans_type;
+	membuf->src_mem_type = alloc_data->src_mem_type;
+	membuf->dst_mem_type = alloc_data->dst_mem_type;
+
+	membuf->src_data =
+		mem_buf_retrieve_mem_type_data(alloc_data->src_mem_type,
+					       alloc_data->src_data);
+	if (IS_ERR(membuf->src_data)) {
+		ret = PTR_ERR(membuf->src_data);
+		goto err_alloc_src_data;
+	}
+
+	membuf->dst_data =
+		mem_buf_retrieve_mem_type_data(alloc_data->dst_mem_type,
+					       alloc_data->dst_data);
+	if (IS_ERR(membuf->dst_data)) {
+		ret = PTR_ERR(membuf->dst_data);
+		goto err_alloc_dst_data;
+	}
+
+	trace_mem_buf_alloc_info(membuf->size, membuf->src_mem_type,
+				 membuf->dst_mem_type, membuf->acl_desc);
+	ret = mem_buf_request_mem(membuf);
+	if (ret)
+		goto err_mem_req;
+
+	ret = mem_buf_map_mem_s2(membuf->trans_type, &membuf->memparcel_hdl,
+				 membuf->acl_desc, &membuf->sgl_desc, VMID_HLOS);
+	if (ret)
+		goto err_map_mem_s2;
+
+	mutex_lock(&mem_buf_list_lock);
+	list_add_tail(&membuf->entry, &mem_buf_list);
+	mutex_unlock(&mem_buf_list_lock);
+
+	pr_debug("%s: mem buf alloc success\n", __func__);
+	return membuf;
+
+err_map_mem_s2:
+	mem_buf_relinquish_mem(membuf);
+err_mem_req:
+	mem_buf_free_mem_type_data(membuf->dst_mem_type, membuf->dst_data);
+err_alloc_dst_data:
+	mem_buf_free_mem_type_data(membuf->src_mem_type, membuf->src_data);
+err_alloc_src_data:
+	if (membuf->sgl_desc)
+		kvfree(membuf->sgl_desc);
+err_alloc_sgl_desc:
+	kfree(membuf->acl_desc);
+err_alloc_acl_list:
+	kfree(membuf);
+	return ERR_PTR(ret);
+}
+
+void mem_buf_free(void *__membuf)
+{
+	struct mem_buf_desc *membuf = __membuf;
+
+	mutex_lock(&mem_buf_list_lock);
+	list_del(&membuf->entry);
+	mutex_unlock(&mem_buf_list_lock);
+
+	mem_buf_relinquish_mem(membuf);
+	kvfree(membuf->sgl_desc);
+	mem_buf_free_mem_type_data(membuf->dst_mem_type, membuf->dst_data);
+	mem_buf_free_mem_type_data(membuf->src_mem_type, membuf->src_data);
+	kfree(membuf->acl_desc);
+	kfree(membuf);
+}
+EXPORT_SYMBOL_GPL(mem_buf_free);
+
+struct gh_sgl_desc *mem_buf_get_sgl(void *__membuf)
+{
+	struct mem_buf_desc *membuf = __membuf;
+
+	return membuf->sgl_desc;
+}
+EXPORT_SYMBOL_GPL(mem_buf_get_sgl);
+
+static void mem_buf_retrieve_release(struct qcom_sg_buffer *buffer)
+{
+	struct mem_buf_dmabuf_obj *obj;
+
+	obj = container_of(buffer, struct mem_buf_dmabuf_obj, buffer);
+
+	memunmap_pages(&obj->pgmap);
+	sg_free_table(&buffer->sg_table);
+	kfree(obj);
+}
+
+struct dma_buf *mem_buf_retrieve(struct mem_buf_retrieve_kernel_arg *arg)
+{
+	int ret, op;
+	struct mem_buf_dmabuf_obj *obj;
+	struct qcom_sg_buffer *buffer;
+	struct gh_acl_desc *acl_desc;
+	/* Hypervisor picks the IPA address */
+	struct gh_sgl_desc *sgl_desc = NULL;
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	struct dma_buf *dmabuf;
+	struct sg_table *sgt;
+	void *kva;
+
+	if (arg->fd_flags & ~MEM_BUF_VALID_FD_FLAGS)
+		return ERR_PTR(-EINVAL);
+
+	if (!arg->nr_acl_entries || !arg->vmids || !arg->perms)
+		return ERR_PTR(-EINVAL);
+
+	obj = kzalloc(sizeof(*obj), GFP_KERNEL);
+	if (!obj)
+		return ERR_PTR(-ENOMEM);
+	buffer = &obj->buffer;
+
+	acl_desc = mem_buf_vmid_perm_list_to_gh_acl(arg->vmids, arg->perms,
+				arg->nr_acl_entries);
+	if (IS_ERR(acl_desc)) {
+		ret = PTR_ERR(acl_desc);
+		goto err_gh_acl;
+	}
+
+	op = mem_buf_get_mem_xfer_type_gh(acl_desc, arg->sender_vmid);
+	ret = mem_buf_map_mem_s2(op, &arg->memparcel_hdl, acl_desc, &sgl_desc,
+					arg->sender_vmid);
+	if (ret)
+		goto err_map_s2;
+
+	if (sgl_desc->n_sgl_entries != 1) {
+		pr_err("%s: Expected contiguous IPA\n", __func__);
+		ret = -EINVAL;
+		goto err_memremap;
+	}
+
+	obj->pgmap.type = MEMORY_DEVICE_GENERIC;
+	obj->pgmap.nr_range = 1;
+	obj->pgmap.range.start = sgl_desc->sgl_entries[0].ipa_base;
+	obj->pgmap.range.end = sgl_desc->sgl_entries[0].ipa_base +
+			       sgl_desc->sgl_entries[0].size - 1;
+	kva = memremap_pages(&obj->pgmap, 0);
+	if (IS_ERR(kva)) {
+		ret = PTR_ERR(kva);
+		goto err_memremap;
+	}
+
+	sgt = dup_gh_sgl_desc_to_sgt(sgl_desc);
+	if (IS_ERR(sgt)) {
+		ret = PTR_ERR(sgt);
+		goto err_dup_sgt;
+	}
+	buffer->sg_table = *sgt;
+	kfree(sgt);
+
+	INIT_LIST_HEAD(&buffer->attachments);
+	mutex_init(&buffer->lock);
+	buffer->heap = NULL;
+	buffer->len = mem_buf_get_sgl_buf_size(sgl_desc);
+	buffer->uncached = false;
+	buffer->free = mem_buf_retrieve_release;
+	buffer->vmperm = mem_buf_vmperm_alloc_accept(&buffer->sg_table,
+						     arg->memparcel_hdl,
+						     arg->vmids, arg->perms,
+						     arg->nr_acl_entries);
+
+	exp_info.size = buffer->len;
+	exp_info.flags = arg->fd_flags;
+	exp_info.priv = buffer;
+
+	dmabuf = qcom_dma_buf_export(&exp_info, &qcom_sg_buf_ops);
+	if (IS_ERR(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
+		goto err_export_dma_buf;
+	}
+
+	/* sgt & qcom_sg_buffer will be freed by mem_buf_retrieve_release */
+	kvfree(sgl_desc);
+	kfree(acl_desc);
+	return dmabuf;
+
+err_export_dma_buf:
+	sg_free_table(&buffer->sg_table);
+err_dup_sgt:
+	memunmap_pages(&obj->pgmap);
+err_memremap:
+	kvfree(sgl_desc);
+	mem_buf_unmap_mem_s2(arg->memparcel_hdl);
+err_map_s2:
+	kfree(acl_desc);
+err_gh_acl:
+	kfree(obj);
+	return ERR_PTR(ret);
+}
+EXPORT_SYMBOL_GPL(mem_buf_retrieve);
+
+static int mem_buf_prep_alloc_data(struct mem_buf_allocation_data *alloc_data,
+				struct mem_buf_alloc_ioctl_arg *allocation_args)
+{
+	unsigned int nr_acl_entries = allocation_args->nr_acl_entries;
+	int ret;
+
+	alloc_data->size = allocation_args->size;
+	alloc_data->nr_acl_entries = nr_acl_entries;
+
+	ret = mem_buf_acl_to_vmid_perms_list(nr_acl_entries,
+				(const void __user *)allocation_args->acl_list,
+				&alloc_data->vmids, &alloc_data->perms);
+	if (ret)
+		goto err_acl;
+
+	/* alloc_data->trans_type set later according to src&dest_mem_type */
+	alloc_data->sgl_desc = NULL;
+	alloc_data->src_mem_type = allocation_args->src_mem_type;
+	alloc_data->dst_mem_type = allocation_args->dst_mem_type;
+
+	alloc_data->src_data =
+		mem_buf_retrieve_mem_type_data_user(
+						allocation_args->src_mem_type,
+				(void __user *)allocation_args->src_data);
+	if (IS_ERR(alloc_data->src_data)) {
+		ret = PTR_ERR(alloc_data->src_data);
+		goto err_alloc_src_data;
+	}
+
+	alloc_data->dst_data =
+		mem_buf_retrieve_mem_type_data_user(
+						allocation_args->dst_mem_type,
+				(void __user *)allocation_args->dst_data);
+	if (IS_ERR(alloc_data->dst_data)) {
+		ret = PTR_ERR(alloc_data->dst_data);
+		goto err_alloc_dst_data;
+	}
+
+	return 0;
+
+err_alloc_dst_data:
+	mem_buf_free_mem_type_data(alloc_data->src_mem_type,
+				   alloc_data->src_data);
+err_alloc_src_data:
+	kfree(alloc_data->vmids);
+	kfree(alloc_data->perms);
+err_acl:
+	return ret;
+}
+
+static void mem_buf_free_alloc_data(struct mem_buf_allocation_data *alloc_data)
+{
+	mem_buf_free_mem_type_data(alloc_data->dst_mem_type,
+				   alloc_data->dst_data);
+	mem_buf_free_mem_type_data(alloc_data->src_mem_type,
+				   alloc_data->src_data);
+	kfree(alloc_data->vmids);
+	kfree(alloc_data->perms);
+}
+
+/* FIXME - remove is_valid_ioctl_mem_type. Its already handled */
+int mem_buf_alloc_fd(struct mem_buf_alloc_ioctl_arg *allocation_args)
+{
+	struct mem_buf_allocation_data alloc_data;
+	int ret;
+
+	if (!allocation_args->size || !allocation_args->nr_acl_entries ||
+	    !allocation_args->acl_list ||
+	    (allocation_args->nr_acl_entries > MEM_BUF_MAX_NR_ACL_ENTS) ||
+	    !is_valid_ioctl_mem_type(allocation_args->src_mem_type) ||
+	    !is_valid_ioctl_mem_type(allocation_args->dst_mem_type) ||
+	    allocation_args->reserved0 || allocation_args->reserved1 ||
+	    allocation_args->reserved2)
+		return -EINVAL;
+
+	ret = mem_buf_prep_alloc_data(&alloc_data, allocation_args);
+	if (ret < 0)
+		return ret;
+
+	if (alloc_data.dst_mem_type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		ret = qcom_tui_heap_add_pool_fd(&alloc_data);
+	else
+		ret = -EINVAL;
+
+	mem_buf_free_alloc_data(&alloc_data);
+	return ret;
+}
+
+int mem_buf_retrieve_user(struct mem_buf_retrieve_ioctl_arg *uarg)
+{
+	int ret, fd;
+	int *vmids, *perms;
+	struct dma_buf *dmabuf;
+	struct mem_buf_retrieve_kernel_arg karg = {0};
+
+	if (!uarg->nr_acl_entries || !uarg->acl_list ||
+	    uarg->nr_acl_entries > MEM_BUF_MAX_NR_ACL_ENTS ||
+	    uarg->reserved0 || uarg->reserved1 ||
+	    uarg->reserved2 ||
+	    uarg->fd_flags & ~MEM_BUF_VALID_FD_FLAGS)
+		return -EINVAL;
+
+	ret = mem_buf_acl_to_vmid_perms_list(uarg->nr_acl_entries,
+			(void *)uarg->acl_list, &vmids, &perms);
+	if (ret)
+		return ret;
+
+	karg.sender_vmid = mem_buf_fd_to_vmid(uarg->sender_vm_fd);
+	if (karg.sender_vmid < 0) {
+		pr_err_ratelimited("%s: Invalid sender_vmid %d\n", __func__, uarg->sender_vm_fd);
+		goto err_sender_vmid;
+	}
+
+	karg.nr_acl_entries = uarg->nr_acl_entries;
+	karg.vmids = vmids;
+	karg.perms = perms;
+	karg.memparcel_hdl = uarg->memparcel_hdl;
+	karg.fd_flags = uarg->fd_flags;
+	dmabuf = mem_buf_retrieve(&karg);
+	if (IS_ERR(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
+		goto err_retrieve;
+	}
+
+	fd = dma_buf_fd(dmabuf, karg.fd_flags);
+	if (fd < 0) {
+		ret = fd;
+		goto err_fd;
+	}
+
+	uarg->dma_buf_import_fd = fd;
+	kfree(vmids);
+	kfree(perms);
+	return 0;
+err_fd:
+	dma_buf_put(dmabuf);
+err_sender_vmid:
+err_retrieve:
+	kfree(vmids);
+	kfree(perms);
+	return ret;
+}
+
+static const struct mem_buf_msgq_ops msgq_ops = {
+	.alloc_req_hdlr = mem_buf_alloc_req_hdlr,
+	.alloc_resp_hdlr = mem_buf_alloc_resp_hdlr,
+	.relinquish_hdlr = mem_buf_relinquish_hdlr,
+	.relinquish_memparcel_hdl = mem_buf_relinquish_memparcel_hdl,
+};
+
+int mem_buf_msgq_alloc(struct device *dev)
+{
+	struct mem_buf_msgq_hdlr_info info = {
+		.msgq_ops = &msgq_ops,
+	};
+	int ret;
+
+	/* No msgq if neither a consumer nor a supplier */
+	if (!(mem_buf_capability & MEM_BUF_CAP_DUAL))
+		return 0;
+
+	mem_buf_wq = alloc_workqueue("mem_buf_wq", WQ_HIGHPRI | WQ_UNBOUND, 0);
+	if (!mem_buf_wq) {
+		dev_err(dev, "Unable to initialize workqueue\n");
+		return -EINVAL;
+	}
+
+	mem_buf_msgq_hdl = mem_buf_msgq_register("trusted_vm", &info);
+	if (IS_ERR(mem_buf_msgq_hdl)) {
+		ret = PTR_ERR(mem_buf_msgq_hdl);
+		dev_err(dev, "Unable to register for mem-buf message queue\n");
+		goto err_msgq_register;
+	}
+
+	return 0;
+
+err_msgq_register:
+	destroy_workqueue(mem_buf_wq);
+	mem_buf_wq = NULL;
+	return ret;
+}
+
+void mem_buf_msgq_free(struct device *dev)
+{
+	if (!(mem_buf_capability & MEM_BUF_CAP_DUAL))
+		return;
+
+	mutex_lock(&mem_buf_list_lock);
+	if (!list_empty(&mem_buf_list))
+		dev_err(mem_buf_dev,
+			"Removing mem-buf driver while there are membufs\n");
+	mutex_unlock(&mem_buf_list_lock);
+
+	mutex_lock(&mem_buf_xfer_mem_list_lock);
+	if (!list_empty(&mem_buf_xfer_mem_list))
+		dev_err(mem_buf_dev,
+			"Removing mem-buf driver while memory is still lent\n");
+	mutex_unlock(&mem_buf_xfer_mem_list_lock);
+	mem_buf_msgq_unregister(mem_buf_msgq_hdl);
+	mem_buf_msgq_hdl = NULL;
+	destroy_workqueue(mem_buf_wq);
+	mem_buf_wq = NULL;
+}
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf-gh.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf-gh.h
@@ -0,0 +1,65 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef MEM_BUF_GH_H
+#define MEM_BUF_GH_H
+
+#include <linux/dma-buf.h>
+#include <linux/mem-buf.h>
+#include <linux/platform_device.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/uaccess.h>
+#include <linux/memremap.h>
+#include <linux/mem-buf-exporter.h>
+#include <soc/qcom/secure_buffer.h>
+#include <uapi/linux/mem-buf.h>
+
+#include "mem-buf-dev.h"
+
+int mem_buf_acl_to_vmid_perms_list(unsigned int nr_acl_entries, const void __user *acl_entries,
+				   int **dst_vmids, int **dst_perms);
+
+#if IS_ENABLED(CONFIG_QCOM_MEM_BUF_GH)
+#include <linux/gunyah/gh_rm_drv.h>
+
+int mem_buf_alloc_fd(struct mem_buf_alloc_ioctl_arg *allocation_args);
+int mem_buf_retrieve_user(struct mem_buf_retrieve_ioctl_arg *uarg);
+int mem_buf_msgq_alloc(struct device *dev);
+void mem_buf_msgq_free(struct device *dev);
+#else
+static inline int mem_buf_alloc_fd(struct mem_buf_alloc_ioctl_arg *allocation_args)
+{
+	return -EOPNOTSUPP;
+}
+
+static inline int mem_buf_retrieve_user(struct mem_buf_retrieve_ioctl_arg *uarg)
+{
+	return -EOPNOTSUPP;
+}
+
+static inline int mem_buf_msgq_alloc(struct device *dev)
+{
+	return 0;
+}
+
+static inline void mem_buf_msgq_free(struct device *dev)
+{
+}
+#endif
+
+/*
+ * Use stub APIs on PVM until ZONE_DEVICE is available.
+ */
+#ifndef CONFIG_ZONE_DEVICE
+static inline void *memremap_pages(struct dev_pagemap *pgmap, int nid)
+{
+	return ERR_PTR(-EINVAL);
+}
+static inline void memunmap_pages(struct dev_pagemap *pgmap) {}
+#endif
+#endif
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf-ids.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf-ids.c
@@ -0,0 +1,346 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "mem_buf_vm: " fmt
+
+#include <linux/of.h>
+#include <linux/xarray.h>
+#include <soc/qcom/secure_buffer.h>
+#include "mem-buf-dev.h"
+#include "mem-buf-ids.h"
+
+#define DEVNAME "mem_buf_vm"
+#define NUM_MEM_BUF_VM_MINORS 128
+
+static dev_t mem_buf_vm_devt;
+static struct class *mem_buf_vm_class;
+
+/*
+ * VM objects have the same lifetime as this module.
+ */
+static DEFINE_XARRAY_ALLOC(mem_buf_vm_minors);
+static DEFINE_XARRAY(mem_buf_vms);
+int current_vmid;
+
+#define PERIPHERAL_VM(_uname, _lname)		\
+static struct mem_buf_vm vm_ ## _lname = {	\
+	.name = "qcom," #_lname,		\
+	.vmid = VMID_ ## _uname,		\
+	.allowed_api = 0,			\
+}
+
+PERIPHERAL_VM(CP_TOUCH, cp_touch);
+PERIPHERAL_VM(CP_BITSTREAM, cp_bitstream);
+PERIPHERAL_VM(CP_PIXEL, cp_pixel);
+PERIPHERAL_VM(CP_NON_PIXEL, cp_non_pixel);
+PERIPHERAL_VM(CP_CAMERA, cp_camera);
+PERIPHERAL_VM(CP_SEC_DISPLAY, cp_sec_display);
+PERIPHERAL_VM(CP_SPSS_SP, cp_spss_sp);
+PERIPHERAL_VM(CP_CAMERA_PREVIEW, cp_camera_preview);
+PERIPHERAL_VM(CP_SPSS_SP_SHARED, cp_spss_sp_shared);
+PERIPHERAL_VM(CP_SPSS_HLOS_SHARED, cp_spss_hlos_shared);
+PERIPHERAL_VM(CP_CDSP, cp_cdsp);
+PERIPHERAL_VM(CP_APP, cp_app);
+
+static struct mem_buf_vm vm_trusted_vm = {
+	.name = "qcom,trusted_vm",
+	.vmid = VMID_TVM,
+	.allowed_api = MEM_BUF_API_GUNYAH,
+};
+
+static struct mem_buf_vm vm_oemvm = {
+	.name = "qcom,oemvm",
+	.vmid = VMID_OEMVM,
+	.allowed_api = MEM_BUF_API_GUNYAH,
+};
+
+static struct mem_buf_vm vm_hlos = {
+	.name = "qcom,hlos",
+	.vmid = VMID_HLOS,
+	.allowed_api = 0,
+};
+
+struct mem_buf_vm *pdata_array[] = {
+	&vm_trusted_vm,
+	&vm_oemvm,
+	&vm_hlos,
+	&vm_cp_touch,
+	&vm_cp_bitstream,
+	&vm_cp_pixel,
+	&vm_cp_non_pixel,
+	&vm_cp_camera,
+	&vm_cp_sec_display,
+	&vm_cp_spss_sp,
+	&vm_cp_camera_preview,
+	&vm_cp_spss_sp_shared,
+	&vm_cp_spss_hlos_shared,
+	&vm_cp_cdsp,
+	&vm_cp_app,
+	NULL,
+};
+
+int mem_buf_current_vmid(void)
+{
+	return current_vmid;
+}
+EXPORT_SYMBOL_GPL(mem_buf_current_vmid);
+
+/*
+ * Opening this file acquires a refcount on vm->dev's kobject - see
+ * chrdev_open(). So private data won't be free'd out from
+ * under us.
+ */
+static int mem_buf_vm_open(struct inode *inode, struct file *file)
+{
+	struct mem_buf_vm *vm;
+
+	vm = container_of(inode->i_cdev, struct mem_buf_vm, cdev);
+	file->private_data = vm;
+	return 0;
+}
+
+static const struct file_operations mem_buf_vm_fops = {
+	.open = mem_buf_vm_open,
+};
+
+bool mem_buf_vm_uses_hyp_assign(void)
+{
+	return current_vmid == VMID_HLOS;
+}
+EXPORT_SYMBOL_GPL(mem_buf_vm_uses_hyp_assign);
+
+/*
+ * Use Gunyah API if any vm in the source or destination requires it.
+ */
+int mem_buf_vm_uses_gunyah(int *vmids, unsigned int nr_acl_entries)
+{
+	struct mem_buf_vm *vm;
+	int i;
+
+	for (i = 0; i < nr_acl_entries; i++) {
+		vm = xa_load(&mem_buf_vms, vmids[i]);
+		if (!vm) {
+			pr_err_ratelimited("No vm with vmid=0x%x\n", vmids[i]);
+			return -EINVAL;
+		}
+
+		if (vm->allowed_api & MEM_BUF_API_GUNYAH)
+			return true;
+	}
+
+	vm = xa_load(&mem_buf_vms, current_vmid);
+	if (!vm) {
+		pr_err_ratelimited("No vm with vmid=0x%x\n", current_vmid);
+		return PTR_ERR(vm);
+	}
+
+	if (vm->allowed_api & MEM_BUF_API_GUNYAH)
+		return true;
+
+	return false;
+}
+EXPORT_SYMBOL_GPL(mem_buf_vm_uses_gunyah);
+
+int mem_buf_fd_to_vmid(int fd)
+{
+	int ret = -EINVAL;
+	struct mem_buf_vm *vm;
+	struct file *file;
+
+	file = fget(fd);
+	if (!file)
+		return -EINVAL;
+
+	if (file->f_op != &mem_buf_vm_fops) {
+		pr_err_ratelimited("Invalid vm file type\n");
+		fput(file);
+		return -EINVAL;
+	}
+
+	vm = file->private_data;
+	ret = vm->vmid;
+	fput(file);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_fd_to_vmid);
+
+static void mem_buf_vm_device_release(struct device *dev)
+{
+	struct mem_buf_vm *vm;
+
+	vm = container_of(dev, struct mem_buf_vm, dev);
+	kfree(vm);
+}
+
+/*
+ * caller must fill in all fields of new_vm except for cdev & dev.
+ */
+static int mem_buf_vm_add(struct mem_buf_vm *new_vm)
+{
+	struct mem_buf_vm *vm;
+	struct device *dev;
+	int minor, ret;
+	unsigned long idx;
+
+	xa_for_each(&mem_buf_vm_minors, idx, vm) {
+		if (!strcmp(vm->name, new_vm->name)) {
+			pr_err("duplicate vm %s\n", vm->name);
+			ret = -EINVAL;
+			goto err_duplicate;
+		}
+	}
+
+	ret = xa_alloc(&mem_buf_vm_minors, &minor, new_vm,
+		       XA_LIMIT(0, NUM_MEM_BUF_VM_MINORS - 1), GFP_KERNEL);
+	if (ret < 0) {
+		pr_err("no more minors\n");
+		goto err_devt;
+	}
+
+	cdev_init(&new_vm->cdev, &mem_buf_vm_fops);
+	dev = &new_vm->dev;
+	device_initialize(dev);
+	dev->devt = MKDEV(MAJOR(mem_buf_vm_devt), minor);
+	dev->class = mem_buf_vm_class;
+	dev->parent = NULL;
+	dev->release = mem_buf_vm_device_release;
+	dev_set_drvdata(dev, new_vm);
+	dev_set_name(dev, "%s", new_vm->name);
+
+	ret = xa_err(xa_store(&mem_buf_vms, new_vm->vmid, new_vm, GFP_KERNEL));
+	if (ret)
+		goto err_xa_store;
+
+	ret = cdev_device_add(&new_vm->cdev, dev);
+	if (ret) {
+		pr_err("Adding cdev %s failed\n", new_vm->name);
+		goto err_cdev_add;
+	}
+	return 0;
+
+err_cdev_add:
+	xa_erase(&mem_buf_vms, new_vm->vmid);
+err_xa_store:
+	xa_erase(&mem_buf_vm_minors, minor);
+	put_device(dev);
+err_devt:
+err_duplicate:
+	return ret;
+}
+
+static int mem_buf_vm_add_pdata(struct mem_buf_vm *pdata)
+{
+	struct mem_buf_vm *vm;
+	int ret;
+
+	vm = kmemdup(pdata, sizeof(*vm), GFP_KERNEL);
+	if (!vm)
+		return -ENOMEM;
+
+	ret = mem_buf_vm_add(vm);
+	if (ret) {
+		kfree(vm);
+		return ret;
+	}
+	return 0;
+}
+
+static int mem_buf_vm_add_self(void)
+{
+	struct mem_buf_vm *vm, *self;
+	int ret;
+
+	vm = xa_load(&mem_buf_vms, current_vmid);
+	if (!vm)
+		return PTR_ERR(vm);
+
+	self = kzalloc(sizeof(*self), GFP_KERNEL);
+	if (!self)
+		return -ENOMEM;
+
+	/* Create an aliased name */
+	self->name = "qcom,self";
+	self->vmid = vm->vmid;
+	self->allowed_api = vm->allowed_api;
+
+	ret = mem_buf_vm_add(self);
+	if (ret) {
+		kfree(self);
+		return ret;
+	}
+	return 0;
+}
+
+static char *mem_buf_vm_devnode(const struct device *dev, umode_t *mode)
+{
+	return kasprintf(GFP_KERNEL, "mem_buf_vm/%s", dev_name(dev));
+}
+
+static int mem_buf_vm_put_class_device_cb(struct device *dev, void *data)
+{
+	struct mem_buf_vm *vm = container_of(dev, struct mem_buf_vm, dev);
+
+	cdev_device_del(&vm->cdev, dev);
+	return 0;
+}
+
+int mem_buf_vm_init(struct device *dev)
+{
+	struct mem_buf_vm **p;
+	int ret, vmid;
+
+	ret = of_property_read_u32(dev->of_node, "qcom,vmid", &vmid);
+	if (ret) {
+		dev_err(dev, "missing qcom,vmid property\n");
+		return ret;
+	}
+	current_vmid = vmid;
+
+	ret = alloc_chrdev_region(&mem_buf_vm_devt, 0, NUM_MEM_BUF_VM_MINORS,
+				DEVNAME);
+	if (ret)
+		return ret;
+
+	mem_buf_vm_class = class_create(DEVNAME);
+	if (IS_ERR(mem_buf_vm_class)) {
+		ret = PTR_ERR(mem_buf_vm_class);
+		goto err_class_create;
+	}
+	mem_buf_vm_class->devnode = mem_buf_vm_devnode;
+
+	for (p = pdata_array; *p; p++) {
+		ret = mem_buf_vm_add_pdata(*p);
+		if (ret)
+			goto err_pdata;
+	}
+
+	ret = mem_buf_vm_add_self();
+	if (ret)
+		goto err_self;
+
+	return 0;
+
+err_self:
+err_pdata:
+	xa_destroy(&mem_buf_vms);
+	xa_destroy(&mem_buf_vm_minors);
+	class_for_each_device(mem_buf_vm_class, NULL, NULL,
+		mem_buf_vm_put_class_device_cb);
+	class_destroy(mem_buf_vm_class);
+err_class_create:
+	unregister_chrdev_region(mem_buf_vm_devt, NUM_MEM_BUF_VM_MINORS);
+	return ret;
+}
+
+void mem_buf_vm_exit(void)
+{
+	xa_destroy(&mem_buf_vms);
+	xa_destroy(&mem_buf_vm_minors);
+	class_for_each_device(mem_buf_vm_class, NULL, NULL,
+		mem_buf_vm_put_class_device_cb);
+	class_destroy(mem_buf_vm_class);
+	unregister_chrdev_region(mem_buf_vm_devt, NUM_MEM_BUF_VM_MINORS);
+}
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf-ids.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf-ids.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef MEM_BUF_IDS_H
+#define MEM_BUF_IDS_H
+
+#include <linux/cdev.h>
+#include <linux/gunyah/gh_common.h>
+
+#define MEM_BUF_API_HYP_ASSIGN BIT(0)
+#define MEM_BUF_API_GUNYAH BIT(1)
+
+/*
+ * @vmid - id assigned by hypervisor to uniquely identify a VM
+ * @allowed_api - Some vms may use a different hypervisor interface.
+ */
+struct mem_buf_vm {
+	const char *name;
+	u16 vmid;
+	u32 allowed_api;
+	struct cdev cdev;
+	struct device dev;
+};
+
+extern int current_vmid;
+int mem_buf_vm_init(struct device *dev);
+void mem_buf_vm_exit(void);
+
+bool mem_buf_vm_uses_hyp_assign(void);
+/*
+ * Returns a negative number for invalid arguments, otherwise a positive value
+ * if gunyah APIs are required.
+ */
+int mem_buf_vm_uses_gunyah(int *vmids, unsigned int nr_acl_entries);
+
+/* @Return: A negative number on failure, or vmid on success */
+int mem_buf_fd_to_vmid(int fd);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf-msgq.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf-msgq.c
@@ -0,0 +1,521 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/completion.h>
+#include <linux/gunyah/gh_msgq.h>
+#include <linux/idr.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/sched/mm.h>
+
+#include "mem-buf-msgq.h"
+#include "trace-mem-buf.h"
+
+#define MEM_BUF_TIMEOUT_MS 3500
+
+/*
+ * Data structures for tracking request/reply transactions, as well as message
+ * queue usage
+ */
+static DEFINE_MUTEX(mem_buf_msgq_list_lock);
+static LIST_HEAD(mem_buf_msgq_list);
+
+struct mem_buf_msgq_id {
+	const char *name;
+	int label;
+};
+
+static struct mem_buf_msgq_id mem_buf_msgqs[] = {
+	{
+		.name = "trusted_vm",
+		.label = GH_MSGQ_LABEL_MEMBUF,
+	},
+	{
+	},
+};
+
+/**
+ * struct mem_buf_txn: Represents a transaction (request/response pair) in the
+ * mem-buf-msgq driver.
+ * @txn_id: Transaction ID used to match requests and responses (i.e. a new ID
+ * is allocated per request, and the response will have a matching ID).
+ * @txn_ret: The return value of the transaction.
+ * @txn_done: Signals that a response has arrived.
+ * @resp_buf: A pointer to a buffer where the response should be decoded into.
+ */
+struct mem_buf_txn {
+	int txn_id;
+	int txn_ret;
+	struct completion txn_done;
+	void *resp_buf;
+};
+
+struct mem_buf_msgq_desc {
+	const struct mem_buf_msgq_ops *msgq_ops;
+	void *hdlr_data;
+	struct mutex idr_mutex;
+	struct idr txn_idr;
+	void *msgq_hdl;
+	struct task_struct *recv_thr;
+	struct list_head list;
+};
+
+static size_t mem_buf_get_mem_type_alloc_req_size(enum mem_buf_mem_type type)
+{
+	if (type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		return MEM_BUF_MAX_DMAHEAP_NAME_LEN;
+	/* Do nothing for MEM_BUF_BUDDY_MEM_TYPE */
+
+	return 0;
+}
+
+static void mem_buf_populate_alloc_req_arb_payload(void *dst, void *src,
+						   enum mem_buf_mem_type type)
+{
+	if (type == MEM_BUF_DMAHEAP_MEM_TYPE)
+		strscpy(dst, src, MEM_BUF_MAX_DMAHEAP_NAME_LEN);
+	/* Do nothing for MEM_BUF_BUDDY_MEM_TYPE */
+}
+
+/*
+ * mem_buf_construct_alloc_req: Constructs an allocation request message.
+ * @mem_buf_txn: A valid transaction structure allocated by a call to mem_buf_init_txn().
+ * @alloc_size: The size of the allocation to be requested.
+ * @acl_desc: A GH ACL descriptor that describes who will have access to the memory allocated and
+ *            with what permissions.
+ * @src_mem_type: The type of memory that will be used to satisfy the allocation.
+ * @src_data: A pointer to auxiliary data required to satisfy the allocation.
+ * @trans_type: One of GH_RM_TRANS_TYPE_DONATE/LEND/SHARE
+ */
+void *mem_buf_construct_alloc_req(void *mem_buf_txn, size_t alloc_size,
+				  struct gh_acl_desc *acl_desc,
+				  enum mem_buf_mem_type src_mem_type, void *src_data,
+				  u32 trans_type)
+{
+	size_t tot_size, alloc_req_size, acl_desc_size;
+	void *req_buf, *arb_payload;
+	unsigned int nr_acl_entries = acl_desc->n_acl_entries;
+	struct mem_buf_alloc_req *req;
+	struct mem_buf_txn *txn = mem_buf_txn;
+	int txn_id = txn->txn_id;
+
+
+	alloc_req_size = offsetof(struct mem_buf_alloc_req,
+				  acl_desc.acl_entries[nr_acl_entries]);
+	tot_size = alloc_req_size +
+		   mem_buf_get_mem_type_alloc_req_size(src_mem_type);
+
+	req_buf = kzalloc(tot_size, GFP_KERNEL);
+	if (!req_buf)
+		return ERR_PTR(-ENOMEM);
+
+	req = req_buf;
+	req->hdr.txn_id = txn_id;
+	req->hdr.msg_type = MEM_BUF_ALLOC_REQ;
+	req->hdr.msg_size = tot_size;
+	req->size = alloc_size;
+	req->src_mem_type = src_mem_type;
+	req->trans_type = trans_type;
+	acl_desc_size = offsetof(struct gh_acl_desc,
+				 acl_entries[nr_acl_entries]);
+	memcpy(&req->acl_desc, acl_desc, acl_desc_size);
+
+	arb_payload = req_buf + alloc_req_size;
+	mem_buf_populate_alloc_req_arb_payload(arb_payload, src_data,
+					       src_mem_type);
+
+	trace_send_alloc_req(req);
+	return req_buf;
+}
+EXPORT_SYMBOL_GPL(mem_buf_construct_alloc_req);
+
+/*
+ * mem_buf_construct_alloc_resp: Construct a response message to an allocation request.
+ * @req_msg: The request message that is being replied to.
+ * @alloc_ret: The return code of the allocation.
+ * @memparcel_hdl: The memparcel handle that corresponds to the memory that was allocated.
+ * sharing, or lending).
+ */
+void *mem_buf_construct_alloc_resp(void *req_msg, s32 alloc_ret,
+				   gh_memparcel_handle_t memparcel_hdl,
+				   u32 obj_id)
+{
+	struct mem_buf_alloc_req *req = req_msg;
+	struct mem_buf_alloc_resp *resp_msg = kzalloc(sizeof(*resp_msg), GFP_KERNEL);
+
+	if (!resp_msg)
+		return ERR_PTR(-ENOMEM);
+
+	resp_msg->hdr.txn_id = req->hdr.txn_id;
+	resp_msg->hdr.msg_type = MEM_BUF_ALLOC_RESP;
+	resp_msg->hdr.msg_size = sizeof(*resp_msg);
+	resp_msg->ret = alloc_ret;
+	resp_msg->hdl = memparcel_hdl;
+	resp_msg->obj_id = obj_id;
+
+	return resp_msg;
+}
+EXPORT_SYMBOL_GPL(mem_buf_construct_alloc_resp);
+
+/*
+ * mem_buf_construct_relinquish_msg: Construct a relinquish message.
+ * @mem_buf_txn: The transaction object.
+ * @obj_id: Uniquely identifies an object.
+ * @memparcel_hdl: The memparcel that corresponds to the memory that is being relinquished.
+ */
+void *mem_buf_construct_relinquish_msg(void *mem_buf_txn, u32 obj_id,
+				       gh_memparcel_handle_t memparcel_hdl)
+{
+	struct mem_buf_alloc_relinquish *relinquish_msg;
+	struct mem_buf_txn *txn = mem_buf_txn;
+
+	relinquish_msg = kzalloc(sizeof(*relinquish_msg), GFP_KERNEL);
+	if (!relinquish_msg)
+		return ERR_PTR(-ENOMEM);
+
+	relinquish_msg->hdr.msg_type = MEM_BUF_ALLOC_RELINQUISH;
+	relinquish_msg->hdr.msg_size = sizeof(*relinquish_msg);
+	relinquish_msg->hdr.txn_id = txn->txn_id;
+	relinquish_msg->obj_id = obj_id;
+	relinquish_msg->hdl = memparcel_hdl;
+
+	return relinquish_msg;
+}
+EXPORT_SYMBOL_GPL(mem_buf_construct_relinquish_msg);
+
+/*
+ * mem_buf_construct_relinquish_resp: Construct a relinquish resp message.
+ * @msg: The msg to reply to.
+ */
+void *mem_buf_construct_relinquish_resp(void *_msg)
+{
+	struct mem_buf_alloc_relinquish *msg = _msg;
+	struct mem_buf_alloc_relinquish *resp;
+
+	resp = kzalloc(sizeof(*resp), GFP_KERNEL);
+	if (!resp)
+		return ERR_PTR(-ENOMEM);
+
+	resp->hdr.msg_type = MEM_BUF_ALLOC_RELINQUISH_RESP;
+	resp->hdr.msg_size = sizeof(*resp);
+	resp->hdr.txn_id = msg->hdr.txn_id;
+
+	return resp;
+}
+EXPORT_SYMBOL_GPL(mem_buf_construct_relinquish_resp);
+
+int mem_buf_retrieve_txn_id(void *mem_buf_txn)
+{
+	struct mem_buf_txn *txn = mem_buf_txn;
+
+	return txn->txn_id;
+}
+EXPORT_SYMBOL_GPL(mem_buf_retrieve_txn_id);
+
+/*
+ * mem_buf_init_txn: Allocates a mem-buf transaction that is used in request-response
+ *                   message pairs.
+ * @mem_buf_msgq_hdl: The handle for the message queue that will be used to transmit the message.
+ * @resp_buf: The buffer that will store the output of the response from the recipient of the
+ *            request.
+ */
+void *mem_buf_init_txn(void *mem_buf_msgq_hdl, void *resp_buf)
+{
+	struct mem_buf_txn *txn;
+	struct mem_buf_msgq_desc *desc = mem_buf_msgq_hdl;
+	int ret;
+
+	txn = kzalloc(sizeof(*txn), GFP_KERNEL);
+	if (!txn)
+		return ERR_PTR(-ENOMEM);
+
+	mutex_lock(&desc->idr_mutex);
+	ret = idr_alloc_cyclic(&desc->txn_idr, txn, 0, INT_MAX, GFP_KERNEL);
+	if (ret < 0) {
+		pr_err("%s: failed to allocate transaction id rc: %d\n", __func__, ret);
+		mutex_unlock(&desc->idr_mutex);
+		kfree(txn);
+		return ERR_PTR(ret);
+	}
+
+	txn->txn_id = ret;
+	init_completion(&txn->txn_done);
+	txn->resp_buf = resp_buf;
+	mutex_unlock(&desc->idr_mutex);
+
+	return txn;
+}
+EXPORT_SYMBOL_GPL(mem_buf_init_txn);
+
+/*
+ * mem_buf_msgq_send: Send a mem-buf message over a particular message queue.
+ * @mem_buf_msgq_hdl: The handle for the message queue that will be used to send the message.
+ * @msg: The message to be sent. This message must be a mem-buf allocation request, response, or
+ *       relinquish request.
+ */
+int mem_buf_msgq_send(void *mem_buf_msgq_hdl, void *msg)
+{
+	struct mem_buf_msgq_desc *desc = mem_buf_msgq_hdl;
+	struct mem_buf_msg_hdr *hdr = msg;
+	int ret;
+
+	if (!(hdr->msg_type >= MEM_BUF_ALLOC_REQ && hdr->msg_type < MEM_BUF_ALLOC_REQ_MAX)) {
+		pr_err("%s: message type invalid\n", __func__);
+		return -EINVAL;
+	}
+
+	ret = gh_msgq_send(desc->msgq_hdl, msg, hdr->msg_size, 0);
+	if (ret < 0)
+		pr_err("%s: failed to send allocation request rc: %d\n", __func__, ret);
+	else
+		pr_debug("%s: alloc request sent\n", __func__);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_msgq_send);
+
+/*
+ * mem_buf_txn_wait: Wait for a response for a particular request.
+ * @mem_buf_msgq_hdl: The handle that corresponds to the message queue used for messaging.
+ * @mem_buf_txn: A valid transaction which corresponds to a request that was sent.
+ *
+ * When this function returns successfully, the output of the response will be in the @resp_buf
+ * parameter that was passed into mem_buf_txn_init().
+ */
+int mem_buf_txn_wait(void *mem_buf_msgq_hdl, void *mem_buf_txn)
+{
+	struct mem_buf_msgq_desc *desc = mem_buf_msgq_hdl;
+	struct mem_buf_txn *txn = mem_buf_txn;
+	int ret;
+
+	pr_debug("%s: waiting for allocation response\n", __func__);
+	ret = wait_for_completion_timeout(&txn->txn_done,
+					  msecs_to_jiffies(MEM_BUF_TIMEOUT_MS));
+
+	/*
+	 * Recheck under lock.
+	 * Handle race condition where we receive a message immediately after
+	 * timing out above as complete() is called under idr_mutex.
+	 */
+	mutex_lock(&desc->idr_mutex);
+	if (!ret && !try_wait_for_completion(&txn->txn_done)) {
+		pr_err("%s: timed out waiting for allocation response\n",
+		       __func__);
+		ret = -ETIMEDOUT;
+	} else {
+		pr_debug("%s: alloc response received\n", __func__);
+		ret = 0;
+	}
+
+	idr_remove(&desc->txn_idr, txn->txn_id);
+	mutex_unlock(&desc->idr_mutex);
+
+	return ret ? ret : txn->txn_ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_txn_wait);
+
+/*
+ * mem_buf_destroy_txn: Releases all resources associated with a mem-buf transaction.
+ * @mem_buf_msgq_hdl: The handle that corresponds to the message queue used for messaging.
+ * @mem_buf_txn: The transaction structure that was involved in the messaging.
+ */
+void mem_buf_destroy_txn(void *mem_buf_msgq_hdl, void *mem_buf_txn)
+{
+	struct mem_buf_txn *txn = mem_buf_txn;
+
+	kfree(txn);
+}
+EXPORT_SYMBOL_GPL(mem_buf_destroy_txn);
+
+static void mem_buf_process_alloc_resp(struct mem_buf_msgq_desc *desc, void *buf, size_t size)
+{
+	struct mem_buf_msg_hdr *hdr = buf;
+	struct mem_buf_alloc_resp *alloc_resp = buf;
+	struct mem_buf_txn *txn;
+	unsigned int noreclaim_flag;
+
+	mutex_lock(&desc->idr_mutex);
+	noreclaim_flag = memalloc_noreclaim_save();
+	txn = idr_find(&desc->txn_idr, hdr->txn_id);
+	if (!txn) {
+		pr_err("%s no txn associated with id: %d\n", __func__, hdr->txn_id);
+		/*
+		 * If this was a legitimate allocation, we should let the
+		 * allocator know that the memory is not in use, so that
+		 * it can be reclaimed.
+		 */
+		if (!alloc_resp->ret) {
+			desc->msgq_ops->relinquish_memparcel_hdl(desc->hdlr_data,
+								 alloc_resp->obj_id,
+								 alloc_resp->hdl);
+		}
+	} else {
+		txn->txn_ret = desc->msgq_ops->alloc_resp_hdlr(desc->hdlr_data, buf, size,
+							       txn->resp_buf);
+		complete(&txn->txn_done);
+	}
+	memalloc_noreclaim_restore(noreclaim_flag);
+	mutex_unlock(&desc->idr_mutex);
+}
+
+static void mem_buf_process_relinquish_resp(struct mem_buf_msgq_desc *desc,
+					    void *buf, size_t size)
+{
+	struct mem_buf_txn *txn;
+	struct mem_buf_alloc_relinquish *relinquish_resp_msg = buf;
+
+	if (size != sizeof(*relinquish_resp_msg)) {
+		pr_err("%s response received is not of correct size\n",
+		       __func__);
+		return;
+	}
+	trace_receive_relinquish_resp_msg(relinquish_resp_msg);
+
+	mutex_lock(&desc->idr_mutex);
+	txn = idr_find(&desc->txn_idr, relinquish_resp_msg->hdr.txn_id);
+	if (!txn)
+		pr_err("%s no txn associated with id: %d\n", __func__,
+		       relinquish_resp_msg->hdr.txn_id);
+	else
+		complete(&txn->txn_done);
+	mutex_unlock(&desc->idr_mutex);
+}
+
+static void mem_buf_process_msg(struct mem_buf_msgq_desc *desc, void *buf, size_t size)
+{
+	struct mem_buf_msg_hdr *hdr = buf;
+
+	pr_debug("%s: mem-buf message received\n", __func__);
+	if (size < sizeof(*hdr) || hdr->msg_size != size) {
+		pr_err("%s: message received is not of a proper size: 0x%lx\n",
+		       __func__, size);
+		return;
+	}
+
+	switch (hdr->msg_type) {
+	case MEM_BUF_ALLOC_REQ:
+		desc->msgq_ops->alloc_req_hdlr(desc->hdlr_data, buf, size);
+		break;
+	case MEM_BUF_ALLOC_RESP:
+		mem_buf_process_alloc_resp(desc, buf, size);
+		break;
+	case MEM_BUF_ALLOC_RELINQUISH:
+		desc->msgq_ops->relinquish_hdlr(desc->hdlr_data, buf, size);
+		break;
+	case MEM_BUF_ALLOC_RELINQUISH_RESP:
+		mem_buf_process_relinquish_resp(desc, buf, size);
+		break;
+	default:
+		pr_err("%s: received message of unknown type: %d\n", __func__,
+		       hdr->msg_type);
+	}
+}
+
+static int mem_buf_msgq_name_to_msgq_label(const char *name)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(mem_buf_msgqs); i++)
+		if (!strcmp(name, mem_buf_msgqs[i].name))
+			return mem_buf_msgqs[i].label;
+
+	return -EINVAL;
+}
+
+static int mem_buf_msgq_recv_fn(void *data)
+{
+	struct mem_buf_msgq_desc *desc = data;
+	void *buf;
+	size_t size;
+	int ret;
+
+	buf = kzalloc(GH_MSGQ_MAX_MSG_SIZE_BYTES, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	while (!kthread_should_stop()) {
+		ret = gh_msgq_recv(desc->msgq_hdl, buf, GH_MSGQ_MAX_MSG_SIZE_BYTES, &size, 0);
+		if (ret < 0)
+			pr_err_ratelimited("%s failed to receive message rc: %d\n", __func__, ret);
+		else
+			mem_buf_process_msg(desc, buf, size);
+	}
+
+	kfree(buf);
+	return 0;
+}
+
+void *mem_buf_msgq_register(const char *msgq_name, struct mem_buf_msgq_hdlr_info *info)
+{
+	struct mem_buf_msgq_desc *desc = kzalloc(sizeof(*desc), GFP_KERNEL);
+	int label;
+	void *ret;
+
+	if (!desc)
+		return ERR_PTR(-ENOMEM);
+	else if (!info || !info->msgq_ops || !info->msgq_ops->alloc_req_hdlr ||
+		 !info->msgq_ops->alloc_resp_hdlr || !info->msgq_ops->relinquish_hdlr)
+		return ERR_PTR(-EINVAL);
+
+	label = mem_buf_msgq_name_to_msgq_label(msgq_name);
+	if (label < 0)
+		return ERR_PTR(label);
+
+	INIT_LIST_HEAD(&desc->list);
+	desc->msgq_ops = info->msgq_ops;
+	desc->hdlr_data = info->hdlr_data;
+	mutex_init(&desc->idr_mutex);
+	idr_init(&desc->txn_idr);
+
+	desc->msgq_hdl = gh_msgq_register(label);
+	if (IS_ERR(desc->msgq_hdl)) {
+		ret = desc->msgq_hdl;
+		pr_err("Message queue registration failed: rc: %ld\n", PTR_ERR(desc->msgq_hdl));
+		goto err_msgq_register;
+	}
+
+	mutex_lock(&mem_buf_msgq_list_lock);
+	list_add_tail(&desc->list, &mem_buf_msgq_list);
+	mutex_unlock(&mem_buf_msgq_list_lock);
+
+	desc->recv_thr = kthread_run(mem_buf_msgq_recv_fn, desc, "mem_buf_%s_rcvr", msgq_name);
+	if (IS_ERR(desc->recv_thr)) {
+		ret = desc->recv_thr;
+		pr_err("Failed to create msgq receiver thread rc: %ld\n", PTR_ERR(desc->recv_thr));
+		goto err_thr_create;
+	}
+
+	return desc;
+
+err_thr_create:
+	gh_msgq_unregister(desc->msgq_hdl);
+err_msgq_register:
+	idr_destroy(&desc->txn_idr);
+	mutex_destroy(&desc->idr_mutex);
+	kfree(desc);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_msgq_register);
+
+void mem_buf_msgq_unregister(void *mem_buf_msgq_hdl)
+{
+	struct mem_buf_msgq_desc *desc = mem_buf_msgq_hdl;
+
+	kthread_stop(desc->recv_thr);
+	mutex_lock(&mem_buf_msgq_list_lock);
+	list_del(&desc->list);
+	mutex_unlock(&mem_buf_msgq_list_lock);
+	gh_msgq_unregister(desc->msgq_hdl);
+	idr_destroy(&desc->txn_idr);
+	mutex_destroy(&desc->idr_mutex);
+	kfree(desc);
+}
+EXPORT_SYMBOL_GPL(mem_buf_msgq_unregister);
+
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf-msgq.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf-msgq.h
@@ -0,0 +1,279 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef MEM_BUF_MSGQ_H
+#define MEM_BUF_MSGQ_H
+
+#include <linux/mem-buf.h>
+#include <linux/types.h>
+
+/**
+ * enum mem_buf_msg_type: Message types used by the membuf driver for
+ * communication.
+ * @MEM_BUF_ALLOC_REQ: The message is an allocation request from another VM to
+ * the receiving VM
+ * @MEM_BUF_ALLOC_RESP: The message is a response from a remote VM to an
+ * allocation request issued by the receiving VM
+ * @MEM_BUF_ALLOC_RELINQUISH: The message is a notification from another VM
+ * that the receiving VM can reclaim the memory.
+ * @MEM_BUF_ALLOC_RELINQUISH_RESP: Indicates completion of MEM_BUF_ALLOC_RELINQUISH.
+ */
+enum mem_buf_msg_type {
+	MEM_BUF_ALLOC_REQ,
+	MEM_BUF_ALLOC_RESP,
+	MEM_BUF_ALLOC_RELINQUISH,
+	MEM_BUF_ALLOC_RELINQUISH_RESP,
+	MEM_BUF_ALLOC_REQ_MAX,
+};
+
+/**
+ * struct mem_buf_msg_hdr: The header for all membuf messages
+ * @txn_id: The transaction ID for the message. This field is only meaningful
+ * for request/response type of messages.
+ * @msg_type: The type of message.
+ * @msg_size: The size of message.
+ */
+struct mem_buf_msg_hdr {
+	u32 txn_id;
+	u32 msg_type;
+	u32 msg_size;
+} __packed;
+
+/**
+ * struct mem_buf_alloc_req: The message format for a memory allocation request
+ * to another VM.
+ * @hdr: Message header
+ * @size: The size of the memory allocation to be performed on the remote VM.
+ * @src_mem_type: The type of memory that the remote VM should allocate.
+ * @trans_type: One of GH_RM_TRANS_TYPE_DONATE/SHARE/LEND
+ * @acl_desc: A GH ACL descriptor that describes the VMIDs that will be
+ * accessing the memory, as well as what permissions each VMID will have.
+ *
+ * NOTE: Certain memory types require additional information for the remote VM
+ * to interpret. That information should be concatenated with this structure
+ * prior to sending the allocation request to the remote VM. For example,
+ * with memory type DMAHEAP, the allocation request message will consist of this
+ * structure, as well as the name of the heap that will source the allocation.
+ */
+struct mem_buf_alloc_req {
+	struct mem_buf_msg_hdr hdr;
+	u64 size;
+	u32 src_mem_type;
+	u32 trans_type;
+	struct gh_acl_desc acl_desc;
+} __packed;
+
+/**
+ * struct mem_buf_alloc_resp: The message format for a memory allocation
+ * request response.
+ * @hdr: Message header
+ * @ret: Return code from remote VM
+ * @hdl: The memparcel handle associated with the memory allocated to the
+ * receiving VM. This field is only meaningful if the allocation on the remote
+ * VM was carried out successfully, as denoted by @ret.
+ * (i.e. memory donation, sharing, or lending).
+ * @obj_id: Unique identifier for the memory object associated with handle.
+ */
+struct mem_buf_alloc_resp {
+	struct mem_buf_msg_hdr hdr;
+	s32 ret;
+	u32 hdl;
+	u32 obj_id;
+} __packed;
+
+/**
+ * struct mem_buf_alloc_relinquish: The message format for a notification
+ * that the current VM has relinquished access to the memory lent to it by
+ * another VM.
+ * @hdr: Message header
+ * @hdl: The memparcel handle associated with the memory.
+ * @obj_id: Unique identifier for the memory object associated with handle.
+ */
+struct mem_buf_alloc_relinquish {
+	struct mem_buf_msg_hdr hdr;
+	u32 hdl;
+	u32 obj_id;
+} __packed;
+
+/*
+ * mem_buf_msgq_ops: A set of ops that are invoked when a message of particular
+ * types are received by a mem-buf message queue.
+ *
+ * The handlers are responsible for freeing the msg buffer that is passed to
+ * them.
+ *
+ * @alloc_req_hdlr: The handler for messages of type MEM_BUF_ALLOC_REQ.
+ * @alloc_resp_hdlr: The handler for messages of type MEM_BUF_ALLOC_RESP.
+ * @relinquish_hdlr: The handler for messages of type MEM_BUF_ALLOC_RELINQUISH.
+ * @relinquish_memparcel_hdl: Callback for relinquishing a memparcel. This is typically used in
+ *                            case an allocation request times out, and the response arrives late.
+ *                            In this case, the transaction will have been aborted, but the memory
+ *                            still needs to be relinquished.
+ */
+struct mem_buf_msgq_ops {
+	void (*alloc_req_hdlr)(void *hdlr_data, void *msg, size_t size);
+	int (*alloc_resp_hdlr)(void *hdlr_data, void *msg, size_t size, void *resp_buf);
+	void (*relinquish_hdlr)(void *hdlr_data, void *msg, size_t size);
+	void (*relinquish_memparcel_hdl)(void *hdlr_data, u32 obj_id,
+					 gh_memparcel_handle_t memparcel_hdl);
+};
+
+struct mem_buf_msgq_hdlr_info {
+	const struct mem_buf_msgq_ops *msgq_ops;
+	void *hdlr_data;
+};
+
+static inline u32 get_alloc_req_nr_acl_entries(struct mem_buf_alloc_req *req)
+{
+	return req->acl_desc.n_acl_entries;
+}
+
+static inline struct gh_acl_desc *get_alloc_req_gh_acl_desc(struct mem_buf_alloc_req *req)
+{
+	return &req->acl_desc;
+}
+
+static inline enum mem_buf_mem_type get_alloc_req_src_mem_type(struct mem_buf_alloc_req *req)
+{
+	return req->src_mem_type;
+}
+
+static inline u64 get_alloc_req_size(struct mem_buf_alloc_req *req)
+{
+	return req->size;
+}
+
+static inline u64 get_alloc_req_xfer_type(struct mem_buf_alloc_req *req)
+{
+	return req->trans_type;
+}
+
+static inline void *get_alloc_req_arb_payload(struct mem_buf_alloc_req *req)
+{
+	void *buf = req;
+	size_t nr_acl_entries;
+	size_t payload_offset;
+
+	nr_acl_entries = req->acl_desc.n_acl_entries;
+	if (nr_acl_entries != 1)
+		return NULL;
+
+	payload_offset = offsetof(struct mem_buf_alloc_req,
+				  acl_desc.acl_entries[nr_acl_entries]);
+
+	return buf + payload_offset;
+}
+
+static inline u32 get_alloc_req_txn_id(struct mem_buf_alloc_req *req)
+{
+	return req->hdr.txn_id;
+}
+
+static inline s32 get_alloc_resp_retval(struct mem_buf_alloc_resp *resp)
+{
+	return resp->ret;
+}
+
+static inline u32 get_alloc_resp_hdl(struct mem_buf_alloc_resp *resp)
+{
+	return resp->hdl;
+}
+
+static inline u32 get_alloc_resp_obj_id(struct mem_buf_alloc_resp *resp)
+{
+	return resp->obj_id;
+}
+
+static inline u32 get_relinquish_req_obj_id(struct mem_buf_alloc_relinquish *relinquish_msg)
+{
+	return relinquish_msg->obj_id;
+}
+
+#if IS_ENABLED(CONFIG_QCOM_MEM_BUF_MSGQ)
+void *mem_buf_msgq_register(const char *msgq_name, struct mem_buf_msgq_hdlr_info *info);
+void mem_buf_msgq_unregister(void *mem_buf_msgq_hdl);
+void *mem_buf_init_txn(void *mem_buf_msgq_hdl, void *resp_buf);
+int mem_buf_msgq_send(void *mem_buf_msgq_hdl, void *msg);
+int mem_buf_txn_wait(void *mem_buf_msgq_hdl, void *mem_buf_txn);
+void mem_buf_destroy_txn(void *mem_buf_msgq_hdl, void *mem_buf_txn);
+int mem_buf_retrieve_txn_id(void *mem_buf_txn);
+/*
+ * It is the caller's responsibility to free the messages returned by
+ * any functions invoked to construct them via a call to kfree().
+ */
+void *mem_buf_construct_alloc_req(void *mem_buf_txn, size_t alloc_size,
+				  struct gh_acl_desc *acl_desc,
+				  enum mem_buf_mem_type src_mem_type, void *src_data,
+				  u32 trans_type);
+void *mem_buf_construct_alloc_resp(void *req_msg, s32 alloc_ret,
+				   gh_memparcel_handle_t memparcel_hdl,
+				   u32 obj_id);
+void *mem_buf_construct_relinquish_msg(void *mem_buf_txn, u32 obj_id,
+				       gh_memparcel_handle_t memparcel_hdl);
+void *mem_buf_construct_relinquish_resp(void *_msg);
+#else
+static inline void *mem_buf_msgq_register(const char *msgq_name,
+					  struct mem_buf_msgq_hdlr_info *info)
+{
+	return ERR_PTR(-EOPNOTSUPP);
+}
+
+static inline void mem_buf_msgq_unregister(void *mem_buf_msgq_hdl)
+{
+}
+
+static inline void *mem_buf_init_txn(void *mem_buf_msgq_hdl, void *resp_buf)
+{
+	return ERR_PTR(-EOPNOTSUPP);
+}
+
+static inline int mem_buf_msgq_send(void *mem_buf_msgq_hdl, void *msg)
+{
+	return -EOPNOTSUPP;
+}
+
+static inline int mem_buf_txn_wait(void *mem_buf_msgq_hdl, void *mem_buf_txn)
+{
+	return -EOPNOTSUPP;
+}
+
+static inline void mem_buf_destroy_txn(void *mem_buf_msgq_hdl, void *mem_buf_txn)
+{
+}
+
+static inline void *mem_buf_construct_alloc_req(void *mem_buf_txn, size_t alloc_size,
+						struct gh_acl_desc *acl_desc,
+						enum mem_buf_mem_type src_mem_type, void *src_data,
+						u32 trans_type)
+
+{
+	return ERR_PTR(-ENODEV);
+}
+
+static inline void *mem_buf_construct_alloc_resp(void *req_msg, s32 alloc_ret,
+				   gh_memparcel_handle_t memparcel_hdl,
+				   u32 obj_id)
+{
+	return ERR_PTR(-ENODEV);
+}
+
+static inline void *mem_buf_construct_relinquish_msg(void *mem_buf_txn, u32 obj_id,
+						gh_memparcel_handle_t memparcel_hdl)
+{
+	return ERR_PTR(-ENODEV);
+}
+
+static inline void *mem_buf_construct_relinquish_resp(void *_msg)
+{
+	return ERR_PTR(-ENODEV);
+}
+
+static inline int mem_buf_retrieve_txn_id(void *mem_buf_txn)
+{
+	return -ENODEV;
+}
+#endif
+#endif
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem-buf.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem-buf.c
@@ -0,0 +1,430 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/cdev.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/idr.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/mem-buf.h>
+#include <linux/module.h>
+#include <linux/of.h>
+
+#include "mem-buf-gh.h"
+#include "mem-buf-ids.h"
+
+#define MEM_BUF_MAX_DEVS 1
+static dev_t mem_buf_dev_no;
+static struct class *mem_buf_class;
+static struct cdev mem_buf_char_dev;
+
+union mem_buf_ioctl_arg {
+	struct mem_buf_alloc_ioctl_arg allocation;
+	struct mem_buf_lend_ioctl_arg lend;
+	struct mem_buf_retrieve_ioctl_arg retrieve;
+	struct mem_buf_reclaim_ioctl_arg reclaim;
+	struct mem_buf_share_ioctl_arg share;
+	struct mem_buf_exclusive_owner_ioctl_arg get_ownership;
+	struct mem_buf_get_memparcel_hdl_ioctl_arg get_memparcel_hdl;
+};
+
+static bool is_valid_mem_buf_perms(u32 mem_buf_perms)
+{
+	if (mem_buf_perms & ~MEM_BUF_PERM_VALID_FLAGS) {
+		pr_err_ratelimited("%s: Invalid mem-buf permissions detected\n",
+				   __func__);
+		return false;
+	}
+	return true;
+}
+
+static int mem_buf_perms_to_perms(u32 mem_buf_perms)
+{
+	int perms = 0;
+
+	if (!is_valid_mem_buf_perms(mem_buf_perms))
+		return -EINVAL;
+
+	if (mem_buf_perms & MEM_BUF_PERM_FLAG_READ)
+		perms |= PERM_READ;
+	if (mem_buf_perms & MEM_BUF_PERM_FLAG_WRITE)
+		perms |= PERM_WRITE;
+	if (mem_buf_perms & MEM_BUF_PERM_FLAG_EXEC)
+		perms |= PERM_EXEC;
+
+	return perms;
+}
+
+int mem_buf_acl_to_vmid_perms_list(unsigned int nr_acl_entries, const void __user *acl_entries,
+				   int **dst_vmids, int **dst_perms)
+{
+	int ret, i, *vmids, *perms;
+	struct acl_entry entry;
+
+	if (!nr_acl_entries || !acl_entries)
+		return -EINVAL;
+
+	vmids = kmalloc_array(nr_acl_entries, sizeof(*vmids), GFP_KERNEL);
+	if (!vmids)
+		return -ENOMEM;
+
+	perms = kmalloc_array(nr_acl_entries, sizeof(*perms), GFP_KERNEL);
+	if (!perms) {
+		kfree(vmids);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < nr_acl_entries; i++) {
+		ret = copy_struct_from_user(&entry, sizeof(entry),
+					    acl_entries + (sizeof(entry) * i),
+					    sizeof(entry));
+		if (ret < 0)
+			goto out;
+
+		vmids[i] = mem_buf_fd_to_vmid(entry.vmid);
+		perms[i] = mem_buf_perms_to_perms(entry.perms);
+		if (vmids[i] < 0 || perms[i] < 0) {
+			ret = -EINVAL;
+			goto out;
+		}
+	}
+
+	*dst_vmids = vmids;
+	*dst_perms = perms;
+	return ret;
+
+out:
+	kfree(perms);
+	kfree(vmids);
+	return ret;
+}
+
+static int mem_buf_lend_user(struct mem_buf_lend_ioctl_arg *uarg, bool is_lend)
+{
+	int *vmids, *perms;
+	int ret;
+	struct dma_buf *dmabuf;
+	struct mem_buf_lend_kernel_arg karg = {0};
+
+	if (!uarg->nr_acl_entries || !uarg->acl_list ||
+	    uarg->nr_acl_entries > MEM_BUF_MAX_NR_ACL_ENTS ||
+	    uarg->reserved0 || uarg->reserved1 || uarg->reserved2)
+		return -EINVAL;
+
+	dmabuf = dma_buf_get(uarg->dma_buf_fd);
+	if (IS_ERR(dmabuf))
+		return PTR_ERR(dmabuf);
+
+	ret = mem_buf_acl_to_vmid_perms_list(uarg->nr_acl_entries,
+			(void *)uarg->acl_list, &vmids, &perms);
+	if (ret)
+		goto err_acl;
+
+	karg.nr_acl_entries = uarg->nr_acl_entries;
+	karg.vmids = vmids;
+	karg.perms = perms;
+
+	if (is_lend) {
+		ret = mem_buf_lend(dmabuf, &karg);
+		if (ret)
+			goto err_lend;
+	} else {
+		ret = mem_buf_share(dmabuf, &karg);
+		if (ret)
+			goto err_lend;
+	}
+
+	uarg->memparcel_hdl = karg.memparcel_hdl;
+err_lend:
+	kfree(perms);
+	kfree(vmids);
+err_acl:
+	dma_buf_put(dmabuf);
+	return ret;
+}
+
+static int mem_buf_reclaim_user(struct mem_buf_reclaim_ioctl_arg *uarg)
+{
+	struct dma_buf *dmabuf;
+	int ret;
+
+	if (uarg->reserved0 || uarg->reserved1 || uarg->reserved2)
+		return -EINVAL;
+
+	dmabuf = dma_buf_get(uarg->dma_buf_fd);
+	if (IS_ERR(dmabuf))
+		return PTR_ERR(dmabuf);
+
+	ret = mem_buf_reclaim(dmabuf);
+	dma_buf_put(dmabuf);
+	return ret;
+}
+
+static int mem_buf_get_exclusive_ownership(struct mem_buf_exclusive_owner_ioctl_arg *uarg)
+{
+	struct dma_buf *dmabuf;
+	int ret = 0;
+
+	dmabuf = dma_buf_get(uarg->dma_buf_fd);
+	if (IS_ERR(dmabuf))
+		return PTR_ERR(dmabuf);
+
+	if (IS_ERR(to_mem_buf_vmperm(dmabuf))) {
+		ret = -EINVAL;
+		goto put_dma_buf;
+	}
+
+	uarg->is_exclusive_owner = mem_buf_dma_buf_exclusive_owner(dmabuf);
+
+put_dma_buf:
+	dma_buf_put(dmabuf);
+
+	return ret;
+}
+
+static int mem_buf_get_memparcel_hdl(struct mem_buf_get_memparcel_hdl_ioctl_arg *uarg)
+{
+	struct dma_buf *dmabuf;
+	int ret = 0;
+	gh_memparcel_handle_t memparcel_hdl;
+
+	dmabuf = dma_buf_get(uarg->dma_buf_fd);
+	if (IS_ERR(dmabuf))
+		return PTR_ERR(dmabuf);
+
+	ret = mem_buf_dma_buf_get_memparcel_hdl(dmabuf, &memparcel_hdl);
+	if (ret) {
+		ret = -EINVAL;
+		goto put_dma_buf;
+	}
+
+	uarg->memparcel_hdl = memparcel_hdl;
+
+put_dma_buf:
+	dma_buf_put(dmabuf);
+
+	return ret;
+}
+
+static long mem_buf_dev_ioctl(struct file *filp, unsigned int cmd,
+			      unsigned long arg)
+{
+	int fd;
+	unsigned int dir = _IOC_DIR(cmd);
+	union mem_buf_ioctl_arg ioctl_arg;
+
+	if (_IOC_SIZE(cmd) > sizeof(ioctl_arg))
+		return -EINVAL;
+
+	if (copy_from_user(&ioctl_arg, (void __user *)arg, _IOC_SIZE(cmd)))
+		return -EFAULT;
+
+	if (!(dir & _IOC_WRITE))
+		memset(&ioctl_arg, 0, sizeof(ioctl_arg));
+
+	switch (cmd) {
+	case MEM_BUF_IOC_ALLOC:
+	{
+		struct mem_buf_alloc_ioctl_arg *allocation =
+			&ioctl_arg.allocation;
+
+		if (!(mem_buf_capability & MEM_BUF_CAP_CONSUMER))
+			return -EOPNOTSUPP;
+
+		fd = mem_buf_alloc_fd(allocation);
+
+		if (fd < 0)
+			return fd;
+
+		allocation->mem_buf_fd = fd;
+		break;
+	}
+	case MEM_BUF_IOC_LEND:
+	{
+		struct mem_buf_lend_ioctl_arg *lend = &ioctl_arg.lend;
+		int ret;
+
+		ret = mem_buf_lend_user(lend, true);
+		if (ret)
+			return ret;
+
+		break;
+	}
+	case MEM_BUF_IOC_RETRIEVE:
+	{
+		struct mem_buf_retrieve_ioctl_arg *retrieve =
+			&ioctl_arg.retrieve;
+		int ret;
+
+		ret = mem_buf_retrieve_user(retrieve);
+		if (ret)
+			return ret;
+		break;
+	}
+	case MEM_BUF_IOC_RECLAIM:
+	{
+		struct mem_buf_reclaim_ioctl_arg *reclaim =
+			&ioctl_arg.reclaim;
+		int ret;
+
+		ret = mem_buf_reclaim_user(reclaim);
+		if (ret)
+			return ret;
+		break;
+	}
+	case MEM_BUF_IOC_SHARE:
+	{
+		struct mem_buf_share_ioctl_arg *share = &ioctl_arg.share;
+		int ret;
+
+		/* The two formats are currently identical */
+		ret = mem_buf_lend_user((struct mem_buf_lend_ioctl_arg *)share,
+					 false);
+		if (ret)
+			return ret;
+
+		break;
+	}
+	case MEM_BUF_IOC_EXCLUSIVE_OWNER:
+	{
+		struct mem_buf_exclusive_owner_ioctl_arg *get_ownership = &ioctl_arg.get_ownership;
+		int ret;
+
+		ret = mem_buf_get_exclusive_ownership(get_ownership);
+		if (ret)
+			return ret;
+
+		break;
+	}
+	case MEM_BUF_IOC_GET_MEMPARCEL_HDL:
+	{
+		struct mem_buf_get_memparcel_hdl_ioctl_arg *get_memparcel_hdl;
+		int ret;
+
+		get_memparcel_hdl = &ioctl_arg.get_memparcel_hdl;
+		ret = mem_buf_get_memparcel_hdl(get_memparcel_hdl);
+		if (ret)
+			return ret;
+
+		break;
+	}
+
+	default:
+		return -ENOTTY;
+	}
+
+	if (dir & _IOC_READ) {
+		if (copy_to_user((void __user *)arg, &ioctl_arg,
+				 _IOC_SIZE(cmd)))
+			return -EFAULT;
+	}
+
+	return 0;
+}
+
+static const struct file_operations mem_buf_dev_fops = {
+	.unlocked_ioctl = mem_buf_dev_ioctl,
+	.compat_ioctl = compat_ptr_ioctl,
+};
+
+static int mem_buf_msgq_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct device *dev = &pdev->dev;
+	struct device *class_dev;
+
+	if (!mem_buf_dev)
+		return -EPROBE_DEFER;
+
+	ret = mem_buf_msgq_alloc(dev);
+	if (ret)
+		return ret;
+
+	cdev_init(&mem_buf_char_dev, &mem_buf_dev_fops);
+	ret = cdev_add(&mem_buf_char_dev, mem_buf_dev_no, MEM_BUF_MAX_DEVS);
+	if (ret < 0)
+		goto err_cdev_add;
+
+	class_dev = device_create(mem_buf_class, NULL, mem_buf_dev_no, NULL,
+				  "membuf");
+	if (IS_ERR(class_dev)) {
+		ret = PTR_ERR(class_dev);
+		goto err_dev_create;
+	}
+
+	return 0;
+
+err_dev_create:
+	cdev_del(&mem_buf_char_dev);
+err_cdev_add:
+	mem_buf_msgq_free(dev);
+	return ret;
+}
+
+static int mem_buf_msgq_remove(struct platform_device *pdev)
+{
+	device_destroy(mem_buf_class, mem_buf_dev_no);
+	cdev_del(&mem_buf_char_dev);
+	mem_buf_msgq_free(&pdev->dev);
+	return 0;
+}
+
+static const struct of_device_id mem_buf_msgq_match_tbl[] = {
+	 {.compatible = "qcom,mem-buf-msgq"},
+	 {},
+};
+
+static struct platform_driver mem_buf_msgq_driver = {
+	.probe = mem_buf_msgq_probe,
+	.remove = mem_buf_msgq_remove,
+	.driver = {
+		.name = "mem-buf-msgq",
+		.of_match_table = of_match_ptr(mem_buf_msgq_match_tbl),
+	},
+};
+
+static int __init mem_buf_init(void)
+{
+	int ret;
+
+	ret = alloc_chrdev_region(&mem_buf_dev_no, 0, MEM_BUF_MAX_DEVS,
+				  "membuf");
+	if (ret < 0)
+		goto err_chrdev_region;
+
+	mem_buf_class = class_create("membuf");
+	if (IS_ERR(mem_buf_class)) {
+		ret = PTR_ERR(mem_buf_class);
+		goto err_class_create;
+	}
+
+	ret = platform_driver_register(&mem_buf_msgq_driver);
+	if (ret < 0)
+		goto err_platform_drvr_register;
+
+	return 0;
+
+err_platform_drvr_register:
+	class_destroy(mem_buf_class);
+err_class_create:
+	unregister_chrdev_region(mem_buf_dev_no, MEM_BUF_MAX_DEVS);
+err_chrdev_region:
+	return ret;
+}
+module_init(mem_buf_init);
+
+static void __exit mem_buf_exit(void)
+{
+	platform_driver_unregister(&mem_buf_msgq_driver);
+	class_destroy(mem_buf_class);
+	unregister_chrdev_region(mem_buf_dev_no, MEM_BUF_MAX_DEVS);
+}
+module_exit(mem_buf_exit);
+
+MODULE_DESCRIPTION("Qualcomm Technologies, Inc. Memory Buffer Sharing driver");
+MODULE_LICENSE("GPL");
+MODULE_IMPORT_NS(DMA_BUF);
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/mem_buf_dma_buf.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/mem_buf_dma_buf.c
@@ -0,0 +1,724 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "mem_buf_vmperm: " fmt
+
+#include <linux/highmem.h>
+#include <linux/mem-buf-exporter.h>
+#include "mem-buf-dev.h"
+#include "mem-buf-gh.h"
+#include "mem-buf-ids.h"
+
+struct mem_buf_vmperm {
+	u32 flags;
+	int current_vm_perms;
+	u32 mapcount;
+	int *vmids;
+	int *perms;
+	unsigned int nr_acl_entries;
+	unsigned int max_acl_entries;
+	struct dma_buf *dmabuf;
+	struct sg_table *sgt;
+	gh_memparcel_handle_t memparcel_hdl;
+	struct mutex lock;
+	mem_buf_dma_buf_destructor dtor;
+	void *dtor_data;
+};
+
+/*
+ * Ensures the vmperm can hold at least nr_acl_entries.
+ * Caller must hold vmperm->lock.
+ */
+static int mem_buf_vmperm_resize(struct mem_buf_vmperm *vmperm,
+					u32 new_size)
+{
+	int *vmids_copy, *perms_copy, *vmids, *perms;
+	u32 old_size;
+
+	old_size = vmperm->max_acl_entries;
+	if (old_size >= new_size)
+		return 0;
+
+	vmids = vmperm->vmids;
+	perms = vmperm->perms;
+	vmids_copy = kcalloc(new_size, sizeof(*vmids), GFP_KERNEL);
+	if (!vmids_copy)
+		return -ENOMEM;
+	perms_copy = kcalloc(new_size, sizeof(*perms), GFP_KERNEL);
+	if (!perms_copy)
+		goto out_perms;
+
+	if (vmperm->vmids) {
+		memcpy(vmids_copy, vmids, sizeof(*vmids) * old_size);
+		kfree(vmids);
+	}
+	if (vmperm->perms) {
+		memcpy(perms_copy, perms, sizeof(*perms) * old_size);
+		kfree(perms);
+	}
+	vmperm->vmids = vmids_copy;
+	vmperm->perms = perms_copy;
+	vmperm->max_acl_entries = new_size;
+	return 0;
+
+out_perms:
+	kfree(vmids_copy);
+	return -ENOMEM;
+}
+
+/*
+ * Caller should hold vmperm->lock.
+ */
+static void mem_buf_vmperm_update_state(struct mem_buf_vmperm *vmperm, int *vmids,
+			 int *perms, u32 nr_acl_entries)
+{
+	int i;
+	size_t size = sizeof(*vmids) * nr_acl_entries;
+
+	WARN_ON(vmperm->max_acl_entries < nr_acl_entries);
+
+	memcpy(vmperm->vmids, vmids, size);
+	memcpy(vmperm->perms, perms, size);
+	vmperm->nr_acl_entries = nr_acl_entries;
+
+	vmperm->current_vm_perms = 0;
+	for (i = 0; i < nr_acl_entries; i++) {
+		if (vmids[i] == current_vmid)
+			vmperm->current_vm_perms = perms[i];
+	}
+}
+
+/*
+ * Some types of errors may leave the memory in an unknown state.
+ * Since we cannot guarantee that accessing this memory is safe,
+ * acquire an extra reference count to the underlying dmabuf to
+ * prevent it from being freed.
+ * If this error occurs during dma_buf_release(), the file refcount
+ * will already be zero. In this case handling the error is the caller's
+ * responsibility.
+ */
+static void mem_buf_vmperm_set_err(struct mem_buf_vmperm *vmperm)
+{
+	get_dma_buf(vmperm->dmabuf);
+	vmperm->flags |= MEM_BUF_WRAPPER_FLAG_ERR;
+}
+
+static struct mem_buf_vmperm *mem_buf_vmperm_alloc_flags(
+	struct sg_table *sgt, u32 flags,
+	int *vmids, int *perms, u32 nr_acl_entries)
+{
+	struct mem_buf_vmperm *vmperm;
+	int ret;
+
+	vmperm = kzalloc(sizeof(*vmperm), GFP_KERNEL);
+	if (!vmperm)
+		return ERR_PTR(-ENOMEM);
+
+	mutex_init(&vmperm->lock);
+	mutex_lock(&vmperm->lock);
+	ret = mem_buf_vmperm_resize(vmperm, nr_acl_entries);
+	if (ret)
+		goto err_resize_state;
+
+	mem_buf_vmperm_update_state(vmperm, vmids, perms,
+					nr_acl_entries);
+	mutex_unlock(&vmperm->lock);
+	vmperm->sgt = sgt;
+	vmperm->flags = flags;
+	vmperm->memparcel_hdl = MEM_BUF_MEMPARCEL_INVALID;
+
+	return vmperm;
+
+err_resize_state:
+	mutex_unlock(&vmperm->lock);
+	kfree(vmperm);
+	return ERR_PTR(-ENOMEM);
+}
+
+/* Must be freed via mem_buf_vmperm_release. */
+struct mem_buf_vmperm *mem_buf_vmperm_alloc_accept(struct sg_table *sgt,
+	gh_memparcel_handle_t memparcel_hdl, int *vmids, int *perms,
+	unsigned int nr_acl_entries)
+{
+	struct mem_buf_vmperm *vmperm;
+
+	vmperm = mem_buf_vmperm_alloc_flags(sgt,
+		MEM_BUF_WRAPPER_FLAG_ACCEPT,
+		vmids, perms, nr_acl_entries);
+	if (IS_ERR(vmperm))
+		return vmperm;
+
+	vmperm->memparcel_hdl = memparcel_hdl;
+	return vmperm;
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmperm_alloc_accept);
+
+struct mem_buf_vmperm *mem_buf_vmperm_alloc_staticvm(struct sg_table *sgt,
+	int *vmids, int *perms, u32 nr_acl_entries)
+{
+	return mem_buf_vmperm_alloc_flags(sgt,
+		MEM_BUF_WRAPPER_FLAG_STATIC_VM,
+		vmids, perms, nr_acl_entries);
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmperm_alloc_staticvm);
+
+struct mem_buf_vmperm *mem_buf_vmperm_alloc(struct sg_table *sgt)
+{
+	int vmids[1];
+	int perms[1];
+
+	vmids[0] = current_vmid;
+	perms[0] = PERM_READ | PERM_WRITE | PERM_EXEC;
+	return mem_buf_vmperm_alloc_flags(sgt, 0,
+		vmids, perms, 1);
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmperm_alloc);
+
+static int __mem_buf_vmperm_reclaim(struct mem_buf_vmperm *vmperm,
+				    bool leak_memory_on_reclaim_fail)
+{
+	int ret;
+	int new_vmids[] = {current_vmid};
+	int new_perms[] = {PERM_READ | PERM_WRITE | PERM_EXEC};
+
+	ret = mem_buf_unassign_mem(vmperm->sgt, vmperm->vmids,
+				   vmperm->nr_acl_entries,
+				   vmperm->memparcel_hdl);
+	if (ret) {
+		pr_err_ratelimited("Reclaim failed\n");
+		if (leak_memory_on_reclaim_fail)
+			mem_buf_vmperm_set_err(vmperm);
+		return ret;
+	}
+
+	mem_buf_vmperm_update_state(vmperm, new_vmids, new_perms, 1);
+	vmperm->flags &= ~MEM_BUF_WRAPPER_FLAG_LENDSHARE;
+	vmperm->memparcel_hdl = MEM_BUF_MEMPARCEL_INVALID;
+	return 0;
+}
+
+static int mem_buf_vmperm_relinquish(struct mem_buf_vmperm *vmperm)
+{
+	/*
+	 * mem_buf_retrieve_release() uses memunmap_pages() to remove
+	 * this from the linux page tables. This occurs after the
+	 * stage 2 pagetable mapping is removed below.
+	 */
+	return mem_buf_unmap_mem_s2(vmperm->memparcel_hdl);
+}
+
+int mem_buf_vmperm_release(struct mem_buf_vmperm *vmperm)
+{
+	int ret = 0;
+
+	if (vmperm->dtor) {
+		ret = vmperm->dtor(vmperm->dtor_data);
+		if (ret)
+			goto exit;
+	}
+
+	mutex_lock(&vmperm->lock);
+	if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_LENDSHARE)
+		ret = __mem_buf_vmperm_reclaim(vmperm, true);
+	else if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_ACCEPT)
+		ret = mem_buf_vmperm_relinquish(vmperm);
+
+	mutex_unlock(&vmperm->lock);
+exit:
+	kfree(vmperm->perms);
+	kfree(vmperm->vmids);
+	mutex_destroy(&vmperm->lock);
+	kfree(vmperm);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmperm_release);
+
+int mem_buf_dma_buf_attach(struct dma_buf *dmabuf, struct dma_buf_attachment *attachment)
+{
+	struct mem_buf_dma_buf_ops *ops;
+
+	ops  = container_of(dmabuf->ops, struct mem_buf_dma_buf_ops, dma_ops);
+	return ops->attach(dmabuf, attachment);
+}
+EXPORT_SYMBOL_GPL(mem_buf_dma_buf_attach);
+
+struct mem_buf_vmperm *to_mem_buf_vmperm(struct dma_buf *dmabuf)
+{
+	struct mem_buf_dma_buf_ops *ops;
+
+	if (dmabuf->ops->attach != mem_buf_dma_buf_attach)
+		return ERR_PTR(-EINVAL);
+
+	ops = container_of(dmabuf->ops, struct mem_buf_dma_buf_ops, dma_ops);
+	return ops->lookup(dmabuf);
+}
+EXPORT_SYMBOL_GPL(to_mem_buf_vmperm);
+
+int mem_buf_dma_buf_set_destructor(struct dma_buf *buf,
+				   mem_buf_dma_buf_destructor dtor,
+				   void *dtor_data)
+{
+	struct mem_buf_vmperm *vmperm = to_mem_buf_vmperm(buf);
+
+	if (IS_ERR(vmperm))
+		return PTR_ERR(vmperm);
+
+	vmperm->dtor = dtor;
+	vmperm->dtor_data = dtor_data;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mem_buf_dma_buf_set_destructor);
+
+/*
+ * With CFI enabled, ops->attach must be set from *this* modules in order
+ * for the comparison test in to_mem_buf_vmperm() to work.
+ */
+struct dma_buf *
+mem_buf_dma_buf_export(struct dma_buf_export_info *exp_info,
+		       struct mem_buf_dma_buf_ops *ops)
+{
+	struct mem_buf_vmperm *vmperm;
+	struct dma_buf *dmabuf;
+	struct dma_buf_ops *dma_ops = &ops->dma_ops;
+
+	if (dma_ops->attach != mem_buf_dma_buf_attach) {
+		if (!dma_ops->attach) {
+			dma_ops->attach = mem_buf_dma_buf_attach;
+		} else {
+			pr_err("Attach callback must be null! %ps\n", exp_info->ops);
+			return ERR_PTR(-EINVAL);
+		}
+	}
+	exp_info->ops = dma_ops;
+
+	dmabuf = dma_buf_export(exp_info);
+	if (IS_ERR(dmabuf))
+		return dmabuf;
+
+	vmperm = to_mem_buf_vmperm(dmabuf);
+	if (WARN_ON(IS_ERR(vmperm))) {
+		dma_buf_put(dmabuf);
+		return ERR_PTR(-EINVAL);
+	}
+
+	vmperm->dmabuf = dmabuf;
+	return dmabuf;
+}
+EXPORT_SYMBOL_GPL(mem_buf_dma_buf_export);
+
+void mem_buf_vmperm_pin(struct mem_buf_vmperm *vmperm)
+{
+	mutex_lock(&vmperm->lock);
+	vmperm->mapcount++;
+	mutex_unlock(&vmperm->lock);
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmperm_pin);
+
+void mem_buf_vmperm_unpin(struct mem_buf_vmperm *vmperm)
+{
+	mutex_lock(&vmperm->lock);
+	if (!WARN_ON(vmperm->mapcount == 0))
+		vmperm->mapcount--;
+	mutex_unlock(&vmperm->lock);
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmperm_unpin);
+
+static bool mem_buf_check_rw_perm(struct mem_buf_vmperm *vmperm)
+{
+	u32 perms = PERM_READ | PERM_WRITE;
+	bool ret = false;
+
+	mutex_lock(&vmperm->lock);
+	if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_ERR)
+		goto unlock;
+	if (!(((vmperm->current_vm_perms & perms) == perms) && vmperm->mapcount))
+		goto unlock;
+	ret = true;
+unlock:
+	mutex_unlock(&vmperm->lock);
+	return ret;
+}
+
+/*
+ * DC IVAC requires write permission, so no CMO on read-only buffers.
+ * We allow mapping to iommu regardless of permissions.
+ * Caller must have previously called mem_buf_vmperm_pin
+ */
+bool mem_buf_vmperm_can_cmo(struct mem_buf_vmperm *vmperm)
+{
+	return mem_buf_check_rw_perm(vmperm);
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmperm_can_cmo);
+
+bool mem_buf_vmperm_can_vmap(struct mem_buf_vmperm *vmperm)
+{
+	return mem_buf_check_rw_perm(vmperm);
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmperm_can_vmap);
+
+bool mem_buf_vmperm_can_mmap(struct mem_buf_vmperm *vmperm, struct vm_area_struct *vma)
+{
+	bool ret = false;
+
+	mutex_lock(&vmperm->lock);
+	if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_ERR)
+		goto unlock;
+	if (!vmperm->mapcount)
+		goto unlock;
+	if (!(vmperm->current_vm_perms & PERM_READ))
+		goto unlock;
+	if (!(vmperm->current_vm_perms & PERM_WRITE) &&
+		vma->vm_flags & VM_WRITE)
+		goto unlock;
+	if (!(vmperm->current_vm_perms & PERM_EXEC) &&
+		vma->vm_flags & VM_EXEC)
+		goto unlock;
+	ret = true;
+unlock:
+	mutex_unlock(&vmperm->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_vmperm_can_mmap);
+
+static int validate_lend_vmids(struct mem_buf_lend_kernel_arg *arg,
+				u32 op)
+{
+	int i;
+	bool found = false;
+
+	for (i = 0; i < arg->nr_acl_entries; i++) {
+		if (arg->vmids[i] == current_vmid) {
+			found = true;
+			break;
+		}
+	}
+
+	if (found && op == GH_RM_TRANS_TYPE_LEND) {
+		pr_err_ratelimited("Lend cannot target the current VM\n");
+		return -EINVAL;
+	} else if (!found && op == GH_RM_TRANS_TYPE_SHARE) {
+		pr_err_ratelimited("Share must target the current VM\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+/*
+ * Allow sharing buffers which are not mapped by either mmap, vmap, or dma.
+ * Also allow sharing mapped buffers if the new S2 permissions are at least
+ * as permissive as the old S2 permissions. Currently differences in
+ * executable permission are ignored, under the assumption the memory will
+ * not be used for this purpose.
+ */
+static bool validate_lend_mapcount(struct mem_buf_vmperm *vmperm,
+				   struct mem_buf_lend_kernel_arg *arg)
+{
+	int i;
+	int perms = PERM_READ | PERM_WRITE;
+
+	if (!vmperm->mapcount)
+		return true;
+
+	for (i = 0; i < arg->nr_acl_entries; i++) {
+		if (arg->vmids[i] == current_vmid &&
+		    (arg->perms[i] & perms) == perms)
+			return true;
+	}
+
+	pr_err_ratelimited("%s: dma-buf is pinned, dumping permissions!\n", __func__);
+	for (i = 0; i < arg->nr_acl_entries; i++)
+		pr_err_ratelimited("%s: VMID=%d PERM=%d\n", __func__,
+				    arg->vmids[i], arg->perms[i]);
+	return false;
+}
+
+static int mem_buf_lend_internal(struct dma_buf *dmabuf,
+			struct mem_buf_lend_kernel_arg *arg,
+			u32 op)
+{
+	struct mem_buf_vmperm *vmperm;
+	struct sg_table *sgt;
+	int ret;
+
+	if (!arg->nr_acl_entries || !arg->vmids || !arg->perms)
+		return -EINVAL;
+
+	if (!mem_buf_dev) {
+		pr_err("%s: mem-buf driver not probed!\n", __func__);
+		return -ENODEV;
+	}
+
+	vmperm = to_mem_buf_vmperm(dmabuf);
+	if (IS_ERR(vmperm)) {
+		pr_err_ratelimited("dmabuf ops %ps are not a mem_buf_dma_buf_ops\n",
+				dmabuf->ops);
+		return -EINVAL;
+	}
+	sgt = vmperm->sgt;
+
+	ret = validate_lend_vmids(arg, op);
+	if (ret)
+		return ret;
+
+	mutex_lock(&vmperm->lock);
+	if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_ERR) {
+		pr_err_ratelimited("dma-buf is not in a usable state!\n");
+		mutex_unlock(&vmperm->lock);
+		return -EINVAL;
+	}
+
+	if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_STATIC_VM) {
+		pr_err_ratelimited("dma-buf is staticvm type!\n");
+		mutex_unlock(&vmperm->lock);
+		return -EINVAL;
+	}
+
+	if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_LENDSHARE) {
+		pr_err_ratelimited("dma-buf already lent or shared!\n");
+		mutex_unlock(&vmperm->lock);
+		return -EINVAL;
+	}
+
+	if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_ACCEPT) {
+		pr_err_ratelimited("dma-buf not owned by current vm!\n");
+		mutex_unlock(&vmperm->lock);
+		return -EINVAL;
+	}
+
+	if (!validate_lend_mapcount(vmperm, arg)) {
+		mutex_unlock(&vmperm->lock);
+		return -EINVAL;
+	}
+
+	/*
+	 * Although it would be preferrable to require clients to decide
+	 * whether they require cache maintenance prior to caling this function
+	 * for backwards compatibility with ion we will always do CMO.
+	 */
+	dma_map_sgtable(mem_buf_dev, vmperm->sgt, DMA_TO_DEVICE, 0);
+	dma_unmap_sgtable(mem_buf_dev, vmperm->sgt, DMA_TO_DEVICE, 0);
+
+	ret = mem_buf_vmperm_resize(vmperm, arg->nr_acl_entries);
+	if (ret)
+		goto err_resize;
+
+	ret = mem_buf_assign_mem(op, vmperm->sgt, arg);
+	if (ret) {
+		if (ret == -EADDRNOTAVAIL)
+			mem_buf_vmperm_set_err(vmperm);
+		goto err_assign;
+	}
+
+	mem_buf_vmperm_update_state(vmperm, arg->vmids, arg->perms,
+			arg->nr_acl_entries);
+	vmperm->flags |= MEM_BUF_WRAPPER_FLAG_LENDSHARE;
+	vmperm->memparcel_hdl = arg->memparcel_hdl;
+
+	mutex_unlock(&vmperm->lock);
+	return 0;
+
+err_assign:
+err_resize:
+	mutex_unlock(&vmperm->lock);
+	return ret;
+}
+
+/*
+ * Kernel API for Sharing, Lending, Receiving or Reclaiming
+ * a dma-buf from a remote Virtual Machine.
+ */
+int mem_buf_lend(struct dma_buf *dmabuf,
+			struct mem_buf_lend_kernel_arg *arg)
+{
+	return mem_buf_lend_internal(dmabuf, arg, GH_RM_TRANS_TYPE_LEND);
+}
+EXPORT_SYMBOL_GPL(mem_buf_lend);
+
+int mem_buf_share(struct dma_buf *dmabuf,
+			struct mem_buf_lend_kernel_arg *arg)
+{
+	int i, ret, len, found = false;
+	int *orig_vmids, *vmids = NULL;
+	int *orig_perms, *perms = NULL;
+
+	len = arg->nr_acl_entries;
+	for (i = 0; i < len; i++) {
+		if (arg->vmids[i] == current_vmid) {
+			found = true;
+			break;
+		}
+	}
+
+	if (found)
+		return mem_buf_lend_internal(dmabuf, arg, GH_RM_TRANS_TYPE_SHARE);
+
+	vmids = kmalloc_array(len + 1, sizeof(*vmids), GFP_KERNEL);
+	if (!vmids)
+		return -ENOMEM;
+
+	perms = kmalloc_array(len + 1, sizeof(*perms), GFP_KERNEL);
+	if (!perms) {
+		kfree(vmids);
+		return -ENOMEM;
+	}
+
+	/* Add current vmid with RWX permissions to the list */
+	memcpy(vmids, arg->vmids, sizeof(*vmids) * len);
+	memcpy(perms, arg->perms, sizeof(*perms) * len);
+	vmids[len] = current_vmid;
+	perms[len] = PERM_READ | PERM_WRITE | PERM_EXEC;
+
+	/* Temporarily switch out the old arrays */
+	orig_vmids = arg->vmids;
+	orig_perms = arg->perms;
+	arg->vmids = vmids;
+	arg->perms = perms;
+	arg->nr_acl_entries += 1;
+
+	ret = mem_buf_lend_internal(dmabuf, arg, GH_RM_TRANS_TYPE_SHARE);
+	/* Swap back */
+	arg->vmids = orig_vmids;
+	arg->perms = orig_perms;
+	arg->nr_acl_entries -= 1;
+
+	kfree(vmids);
+	kfree(perms);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_share);
+
+int mem_buf_reclaim(struct dma_buf *dmabuf)
+{
+	struct mem_buf_vmperm *vmperm;
+	int ret;
+
+	vmperm = to_mem_buf_vmperm(dmabuf);
+	if (IS_ERR(vmperm)) {
+		pr_err_ratelimited("dmabuf ops %ps are not a mem_buf_dma_buf_ops\n",
+				dmabuf->ops);
+		return -EINVAL;
+	}
+
+	mutex_lock(&vmperm->lock);
+	if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_STATIC_VM) {
+		pr_err_ratelimited("dma-buf is staticvm type!\n");
+		mutex_unlock(&vmperm->lock);
+		return -EINVAL;
+	}
+
+	if (!(vmperm->flags & MEM_BUF_WRAPPER_FLAG_LENDSHARE)) {
+		pr_err_ratelimited("dma-buf isn't lent or shared!\n");
+		mutex_unlock(&vmperm->lock);
+		return -EINVAL;
+	}
+
+	if (vmperm->flags & MEM_BUF_WRAPPER_FLAG_ACCEPT) {
+		pr_err_ratelimited("dma-buf not owned by current vm!\n");
+		mutex_unlock(&vmperm->lock);
+		return -EINVAL;
+	}
+
+	ret = __mem_buf_vmperm_reclaim(vmperm, false);
+	mutex_unlock(&vmperm->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_reclaim);
+
+bool mem_buf_dma_buf_exclusive_owner(struct dma_buf *dmabuf)
+{
+	struct mem_buf_vmperm *vmperm;
+	bool ret = false;
+
+	vmperm = to_mem_buf_vmperm(dmabuf);
+	if (WARN_ON(IS_ERR(vmperm)))
+		return false;
+
+	mutex_lock(&vmperm->lock);
+	ret = !vmperm->flags;
+	mutex_unlock(&vmperm->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_dma_buf_exclusive_owner);
+
+int mem_buf_dma_buf_get_vmperm(struct dma_buf *dmabuf, const int **vmids,
+		const int **perms, int *nr_acl_entries)
+{
+	struct mem_buf_vmperm *vmperm;
+
+	vmperm = to_mem_buf_vmperm(dmabuf);
+	if (IS_ERR(vmperm))
+		return PTR_ERR(vmperm);
+
+	mutex_lock(&vmperm->lock);
+
+	*vmids = vmperm->vmids;
+	*perms = vmperm->perms;
+	*nr_acl_entries = vmperm->nr_acl_entries;
+
+	mutex_unlock(&vmperm->lock);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mem_buf_dma_buf_get_vmperm);
+
+int mem_buf_dma_buf_copy_vmperm(struct dma_buf *dmabuf, int **vmids,
+		int **perms, int *nr_acl_entries)
+{
+	struct mem_buf_vmperm *vmperm;
+	size_t size;
+	int *vmids_copy, *perms_copy;
+	int ret;
+
+	vmperm = to_mem_buf_vmperm(dmabuf);
+	if (IS_ERR(vmperm))
+		return PTR_ERR(vmperm);
+
+	mutex_lock(&vmperm->lock);
+	size = sizeof(*vmids_copy) * vmperm->nr_acl_entries;
+	vmids_copy = kmemdup(vmperm->vmids, size, GFP_KERNEL);
+	if (!vmids_copy) {
+		ret = -ENOMEM;
+		goto err_vmids;
+	}
+
+	perms_copy = kmemdup(vmperm->perms, size, GFP_KERNEL);
+	if (!perms_copy) {
+		ret = -ENOMEM;
+		goto err_perms;
+	}
+
+	*vmids = vmids_copy;
+	*perms = perms_copy;
+	*nr_acl_entries = vmperm->nr_acl_entries;
+
+	mutex_unlock(&vmperm->lock);
+	return 0;
+
+err_perms:
+	kfree(vmids_copy);
+err_vmids:
+	mutex_unlock(&vmperm->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mem_buf_dma_buf_copy_vmperm);
+
+int mem_buf_dma_buf_get_memparcel_hdl(struct dma_buf *dmabuf,
+				      gh_memparcel_handle_t *memparcel_hdl)
+{
+	struct mem_buf_vmperm *vmperm;
+
+	vmperm = to_mem_buf_vmperm(dmabuf);
+	if (IS_ERR(vmperm))
+		return PTR_ERR(vmperm);
+
+	if (vmperm->memparcel_hdl == MEM_BUF_MEMPARCEL_INVALID)
+		return -EINVAL;
+
+	*memparcel_hdl = vmperm->memparcel_hdl;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mem_buf_dma_buf_get_memparcel_hdl);
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/mem_buf/trace-mem-buf.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/mem_buf/trace-mem-buf.h
@@ -0,0 +1,336 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM mem_buf
+
+#if !defined(_TRACE_MEM_BUF_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_MEM_BUF_H
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+#include <linux/mem-buf.h>
+
+#include "mem-buf-msgq.h"
+
+#ifdef CREATE_TRACE_POINTS
+static void __maybe_unused gh_acl_to_vmid_perms(struct gh_acl_desc *acl_desc,
+						u16 *vmids, u8 *perms)
+{
+	unsigned int i;
+
+	for (i = 0; i < acl_desc->n_acl_entries; i++) {
+		vmids[i] = acl_desc->acl_entries[i].vmid;
+		perms[i] = acl_desc->acl_entries[i].perms;
+	}
+}
+
+static void __maybe_unused
+gh_sgl_to_ipa_bases_sizes(struct gh_sgl_desc *sgl_desc,
+			  u64 *ipa_bases, u64 *sizes)
+{
+	unsigned int i;
+
+	for (i = 0; i < sgl_desc->n_sgl_entries; i++) {
+		ipa_bases[i] = sgl_desc->sgl_entries[i].ipa_base;
+		sizes[i] = sgl_desc->sgl_entries[i].size;
+	}
+}
+
+static char __maybe_unused *mem_type_to_str(enum mem_buf_mem_type type)
+{
+	if (type == MEM_BUF_ION_MEM_TYPE)
+		return "ION_MEM_TYPE";
+
+	return NULL;
+}
+
+static char __maybe_unused *msg_type_to_str(enum mem_buf_msg_type type)
+{
+	if (type == MEM_BUF_ALLOC_REQ)
+		return "MEM_BUF_ALLOC_REQ";
+	else if (type == MEM_BUF_ALLOC_RESP)
+		return "MEM_BUF_ALLOC_RESP";
+	else if (type == MEM_BUF_ALLOC_RELINQUISH)
+		return "MEM_BUF_ALLOC_RELINQUISH";
+	else if (type == MEM_BUF_ALLOC_RELINQUISH_RESP)
+		return "MEM_BUF_ALLOC_RELINQUISH_RESP";
+
+	return NULL;
+}
+#endif /* CREATE_TRACE_POINTS */
+
+TRACE_EVENT(mem_buf_alloc_info,
+
+	TP_PROTO(size_t size, enum mem_buf_mem_type src_mem_type,
+		 enum mem_buf_mem_type dst_mem_type,
+		 struct gh_acl_desc *acl_desc),
+
+	TP_ARGS(size, src_mem_type, dst_mem_type, acl_desc),
+
+	TP_STRUCT__entry(
+		__field(size_t, size)
+		__field(u32, nr_acl_entries)
+		__string(src_type, mem_type_to_str(src_mem_type))
+		__string(dst_type, mem_type_to_str(dst_mem_type))
+		__dynamic_array(u16, vmids, acl_desc->n_acl_entries)
+		__dynamic_array(u8, perms, acl_desc->n_acl_entries)
+	),
+
+	TP_fast_assign(
+		__entry->size = size;
+		__assign_str(src_type, mem_type_to_str(src_mem_type));
+		__assign_str(dst_type, mem_type_to_str(dst_mem_type));
+		__entry->nr_acl_entries = acl_desc->n_acl_entries;
+		gh_acl_to_vmid_perms(acl_desc, __get_dynamic_array(vmids),
+				     __get_dynamic_array(perms));
+	),
+
+	TP_printk("size: 0x%lx src mem type: %s dst mem type: %s nr ACL entries: %d ACL VMIDs: %s ACL Perms: %s",
+		  __entry->size, __get_str(src_type), __get_str(dst_type),
+		  __entry->nr_acl_entries,
+		  __print_array(__get_dynamic_array(vmids),
+				__entry->nr_acl_entries, sizeof(u16)),
+		  __print_array(__get_dynamic_array(perms),
+				__entry->nr_acl_entries, sizeof(u8))
+	)
+);
+
+DECLARE_EVENT_CLASS(alloc_req_msg_class,
+
+	TP_PROTO(struct mem_buf_alloc_req *req),
+
+	TP_ARGS(req),
+
+	TP_STRUCT__entry(
+		__field(u32, txn_id)
+		__string(msg_type, msg_type_to_str(req->hdr.msg_type))
+		__field(u64, size)
+		__string(src_type, mem_type_to_str(req->src_mem_type))
+		__field(u32, nr_acl_entries)
+		__dynamic_array(u16, vmids, req->acl_desc.n_acl_entries)
+		__dynamic_array(u8, perms, req->acl_desc.n_acl_entries)
+	),
+
+	TP_fast_assign(
+		__entry->txn_id = req->hdr.txn_id;
+		__assign_str(msg_type, msg_type_to_str(req->hdr.msg_type));
+		__entry->size = req->size;
+		__assign_str(src_type, mem_type_to_str(req->src_mem_type));
+		__entry->nr_acl_entries = req->acl_desc.n_acl_entries;
+		gh_acl_to_vmid_perms(&req->acl_desc, __get_dynamic_array(vmids),
+				     __get_dynamic_array(perms));
+	),
+
+	TP_printk("txn_id: %d msg_type: %s alloc_sz: 0x%llx src_mem_type: %s nr ACL entries: %d ACL VMIDs: %s ACL Perms: %s",
+		  __entry->txn_id, __get_str(msg_type), __entry->size,
+		  __get_str(src_type), __entry->nr_acl_entries,
+		  __print_array(__get_dynamic_array(vmids),
+				__entry->nr_acl_entries, sizeof(u16)),
+		  __print_array(__get_dynamic_array(perms),
+				__entry->nr_acl_entries, sizeof(u8))
+	)
+);
+
+DEFINE_EVENT(alloc_req_msg_class, send_alloc_req,
+
+	TP_PROTO(struct mem_buf_alloc_req *req),
+
+	TP_ARGS(req)
+);
+
+DEFINE_EVENT(alloc_req_msg_class, receive_alloc_req,
+
+	TP_PROTO(struct mem_buf_alloc_req *req),
+
+	TP_ARGS(req)
+);
+
+DECLARE_EVENT_CLASS(relinquish_req_msg_class,
+
+	TP_PROTO(struct mem_buf_alloc_relinquish *rel_req),
+
+	TP_ARGS(rel_req),
+
+	TP_STRUCT__entry(
+		__string(msg_type, msg_type_to_str(rel_req->hdr.msg_type))
+		__field(gh_memparcel_handle_t, hdl)
+		__field(u32, txn_id)
+	),
+
+	TP_fast_assign(
+		__assign_str(msg_type, msg_type_to_str(rel_req->hdr.msg_type));
+		__entry->hdl = rel_req->hdl;
+		__entry->txn_id = rel_req->hdr.txn_id;
+	),
+
+	TP_printk("msg_type: %s memparcel_hdl: 0x%x txn_id: 0x%x",
+		  __get_str(msg_type), __entry->hdl, __entry->txn_id)
+);
+
+DEFINE_EVENT(relinquish_req_msg_class, send_relinquish_msg,
+
+	TP_PROTO(struct mem_buf_alloc_relinquish *rel_req),
+
+	TP_ARGS(rel_req)
+);
+
+
+DEFINE_EVENT(relinquish_req_msg_class, receive_relinquish_msg,
+
+	TP_PROTO(struct mem_buf_alloc_relinquish *rel_req),
+
+	TP_ARGS(rel_req)
+);
+
+DECLARE_EVENT_CLASS(alloc_resp_class,
+
+	TP_PROTO(struct mem_buf_alloc_resp *resp),
+
+	TP_ARGS(resp),
+
+	TP_STRUCT__entry(
+		__field(u32, txn_id)
+		__string(msg_type, msg_type_to_str(resp->hdr.msg_type))
+		__field(s32, ret)
+		__field(gh_memparcel_handle_t, hdl)
+	),
+
+	TP_fast_assign(
+		__entry->txn_id = resp->hdr.txn_id;
+		__assign_str(msg_type, msg_type_to_str(resp->hdr.msg_type));
+		__entry->ret = resp->ret;
+		__entry->hdl = resp->hdl;
+	),
+
+	TP_printk("txn_id: %d msg_type: %s ret: %d memparcel_hdl: 0x%x",
+		  __entry->txn_id, __get_str(msg_type), __entry->ret,
+		  __entry->hdl
+	)
+);
+
+DEFINE_EVENT(alloc_resp_class, send_alloc_resp_msg,
+
+	TP_PROTO(struct mem_buf_alloc_resp *resp),
+
+	TP_ARGS(resp)
+);
+
+DEFINE_EVENT(alloc_resp_class, receive_alloc_resp_msg,
+
+	TP_PROTO(struct mem_buf_alloc_resp *resp),
+
+	TP_ARGS(resp)
+);
+
+DECLARE_EVENT_CLASS(relinquish_resp_class,
+
+	TP_PROTO(struct mem_buf_alloc_relinquish *resp),
+
+	TP_ARGS(resp),
+
+	TP_STRUCT__entry(
+		__field(u32, txn_id)
+		__string(msg_type, msg_type_to_str(resp->hdr.msg_type))
+	),
+
+	TP_fast_assign(
+		__entry->txn_id = resp->hdr.txn_id;
+		__assign_str(msg_type, msg_type_to_str(resp->hdr.msg_type));
+	),
+
+	TP_printk("txn_id: %d msg_type: %s",
+		  __entry->txn_id, __get_str(msg_type)
+	)
+);
+
+DEFINE_EVENT(relinquish_resp_class, send_relinquish_resp_msg,
+
+	TP_PROTO(struct mem_buf_alloc_relinquish *resp),
+
+	TP_ARGS(resp)
+);
+
+DEFINE_EVENT(relinquish_resp_class, receive_relinquish_resp_msg,
+
+	TP_PROTO(struct mem_buf_alloc_relinquish *resp),
+
+	TP_ARGS(resp)
+);
+
+TRACE_EVENT(lookup_sgl,
+
+	TP_PROTO(struct gh_sgl_desc *sgl_desc, int ret,
+		     gh_memparcel_handle_t hdl),
+
+	TP_ARGS(sgl_desc, ret, hdl),
+
+	TP_STRUCT__entry(
+		__field(u16, nr_sgl_entries)
+		__dynamic_array(u64, ipa_bases, sgl_desc->n_sgl_entries)
+		__dynamic_array(u64, sizes, sgl_desc->n_sgl_entries)
+		__field(int, ret)
+		__field(gh_memparcel_handle_t, hdl)
+	),
+
+	TP_fast_assign(
+		__entry->nr_sgl_entries = sgl_desc->n_sgl_entries;
+		gh_sgl_to_ipa_bases_sizes(sgl_desc,
+					  __get_dynamic_array(ipa_bases),
+					  __get_dynamic_array(sizes));
+		__entry->ret = ret;
+		__entry->hdl = hdl;
+	),
+
+	TP_printk("SGL entries: %d SGL IPA bases: %s SGL sizes: %s ret: %d memparcel_hdl: 0x%x",
+		  __entry->nr_sgl_entries,
+		  __print_array(__get_dynamic_array(ipa_bases),
+				__entry->nr_sgl_entries, sizeof(u64)),
+		  __print_array(__get_dynamic_array(sizes),
+				__entry->nr_sgl_entries, sizeof(u64)),
+		  __entry->ret, __entry->hdl
+	)
+);
+
+TRACE_EVENT(map_mem_s2,
+
+	TP_PROTO(gh_memparcel_handle_t hdl, struct gh_sgl_desc *sgl_desc),
+
+	TP_ARGS(hdl, sgl_desc),
+
+	TP_STRUCT__entry(
+		__field(gh_memparcel_handle_t, hdl)
+		__field(u16, nr_sgl_entries)
+		__dynamic_array(u64, ipa_bases, sgl_desc->n_sgl_entries)
+		__dynamic_array(u64, sizes, sgl_desc->n_sgl_entries)
+	),
+
+	TP_fast_assign(
+		__entry->hdl = hdl;
+		__entry->nr_sgl_entries = sgl_desc->n_sgl_entries;
+		gh_sgl_to_ipa_bases_sizes(sgl_desc,
+					  __get_dynamic_array(ipa_bases),
+					  __get_dynamic_array(sizes));
+	),
+
+	TP_printk("MEM_ACCEPT successful memparcel hdl: 0x%x SGL entries: %d SGL IPA bases: %s SGL sizes: %s",
+		  __entry->hdl, __entry->nr_sgl_entries,
+		  __print_array(__get_dynamic_array(ipa_bases),
+				__entry->nr_sgl_entries, sizeof(u64)),
+		  __print_array(__get_dynamic_array(sizes),
+				__entry->nr_sgl_entries, sizeof(u64))
+	)
+);
+
+#endif /* _TRACE_MEM_BUF_H */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH ../../../drivers/soc/qcom/mem_buf/
+
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace-mem-buf
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/memory_dump_v2.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/memory_dump_v2.c
@@ -0,0 +1,1147 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2017, 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/io.h>
+#include <linux/init.h>
+#include <linux/export.h>
+#include <linux/err.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/platform_device.h>
+#include <linux/firmware/qcom/qcom_tzmem.h>
+#include <soc/qcom/memory_dump.h>
+#include <soc/qcom/secure_buffer.h>
+#include <linux/of_device.h>
+#include <linux/dma-mapping.h>
+#include <linux/module.h>
+#include <linux/of_reserved_mem.h>
+
+#define MSM_DUMP_TABLE_VERSION		MSM_DUMP_MAKE_VERSION(2, 0)
+
+#define SCM_CMD_DEBUG_LAR_UNLOCK	0x4
+
+#define CPUSS_REGDUMP			0xEF
+#define SPR_DUMP_CPU0			0x1F0
+#define SPR_DUMP_CPU1			0x1F1
+#define SPR_DUMP_CPU2			0x1F2
+#define SPR_DUMP_CPU3			0x1F3
+#define SPR_DUMP_CPU4			0x1F4
+#define SPR_DUMP_CPU5			0x1F5
+#define SPR_DUMP_CPU6			0x1F6
+#define SPR_DUMP_CPU7			0x1F7
+#define SPR_DATA_HEADER_SIZE	5
+#define SPR_DATA_HEADER_TAIL_SIZE	1
+#define SPR_INPUT_DATA_TAIL_SIZE	1
+#define SPR_INPUT_DATA_SIZE		1
+#define SPR_OUTPUT_DATA_SIZE	2
+#define MAX_CORE_NUM			8
+
+#define INPUT_DATA_BY_HLOS		0x00C0FFEE
+#define FORMAT_VERSION_1		0x1
+#define FORMAT_VERSION_2		0x2
+#define CORE_REG_NUM_DEFAULT		0x1
+
+#define MAGIC_INDEX			0
+#define FORMAT_VERSION_INDEX		1
+#define SYS_REG_INPUT_INDEX		2
+#define OUTPUT_DUMP_INDEX		3
+#define PERCORE_INDEX			4
+#define SYSTEM_REGS_INPUT_INDEX	5
+
+#define CMD_REPEAT_READ			(0x2 << 24)
+#define CMD_DELAY			(0x1 << 24)
+#define CMD_READ			0x0
+#define CMD_READ_WORD			0x1
+#define CMD_WRITE			0x2
+#define CMD_EXTRA			0x3
+
+#define CMD_MASK			0x3
+#define OFFSET_MASK			GENMASK(31, 2)
+#define EXTRA_CMD_MASK			GENMASK(31, 24)
+#define EXTRA_VALUE_MASK		GENMASK(23, 0)
+#define MAX_EXTRA_VALUE			0xffffff
+
+struct sprs_dump_data {
+	void *dump_vaddr;
+	u32 size;
+	u32 sprs_data_index;
+	u32 used_memory;
+};
+
+struct cpuss_regdump_data {
+	void *dump_vaddr;
+	u32 size;
+	u32 core_reg_num;
+	u32 core_reg_used_num;
+	u32 core_reg_end_index;
+	u32 sys_reg_size;
+	u32 used_memory;
+};
+
+struct cpuss_dump_data {
+	struct mutex mutex;
+	struct cpuss_regdump_data *cpussregdata;
+	struct sprs_dump_data *sprdata[MAX_CORE_NUM];
+};
+
+struct reg_dump_data {
+	uint32_t magic;
+	uint32_t version;
+	uint32_t system_regs_input_index;
+	uint32_t regdump_output_byte_offset;
+};
+
+struct msm_dump_table {
+	uint32_t version;
+	uint32_t num_entries;
+	struct msm_dump_entry entries[MAX_NUM_ENTRIES];
+};
+
+struct msm_memory_dump {
+	uint64_t table_phys;
+	struct msm_dump_table *table;
+};
+
+/**
+ * Set bit 0 if percore reg dump initialized.
+ * Set bit 1 if spr dump initialized.
+ */
+#define PERCORE_REG_INITIALIZED BIT(0)
+#define SPRS_INITIALIZED BIT(1)
+
+static struct msm_memory_dump memdump;
+
+/**
+ * reset_sprs_dump_table - reset the sprs dump table
+ *
+ * This function calculates system_regs_input_index and
+ * regdump_output_byte_offset to store into the dump memory.
+ * It also updates members of cpudata by the parameter core_reg_num.
+ *
+ * Returns 0 on success, or -ENOMEM on error of no enough memory.
+ */
+static int reset_sprs_dump_table(struct device *dev)
+{
+	int ret = 0;
+	struct reg_dump_data *p;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+	int i = 0;
+
+	if (!cpudata)
+		return -EFAULT;
+
+	mutex_lock(&cpudata->mutex);
+
+	for (i = 0; i < MAX_CORE_NUM; i++) {
+		if (cpudata->sprdata[i]) {
+			cpudata->sprdata[i]->sprs_data_index = 0;
+			cpudata->sprdata[i]->used_memory = (SPR_DATA_HEADER_SIZE +
+				SPR_INPUT_DATA_TAIL_SIZE) * sizeof(uint32_t);
+			memset(cpudata->sprdata[i]->dump_vaddr, 0xDE,
+				cpudata->sprdata[i]->size);
+			p = (struct reg_dump_data *)cpudata->sprdata[i]->dump_vaddr;
+			p->magic = INPUT_DATA_BY_HLOS;
+			p->version = FORMAT_VERSION_1;
+			p->system_regs_input_index = SYSTEM_REGS_INPUT_INDEX;
+			p->regdump_output_byte_offset = (SPR_DATA_HEADER_SIZE +
+				SPR_INPUT_DATA_TAIL_SIZE) * sizeof(uint32_t);
+			memset((uint32_t *)cpudata->sprdata[i]->dump_vaddr +
+				PERCORE_INDEX, 0x0, (SPR_DATA_HEADER_TAIL_SIZE +
+				SPR_INPUT_DATA_TAIL_SIZE) * sizeof(uint32_t));
+		}
+	}
+
+	mutex_unlock(&cpudata->mutex);
+	return ret;
+}
+
+
+/**
+ * update_reg_dump_table - update the register dump table
+ * @core_reg_num: the number of per-core registers
+ *
+ * This function calculates system_regs_input_index and
+ * regdump_output_byte_offset to store into the dump memory.
+ * It also updates members of cpudata by the parameter core_reg_num.
+ *
+ * Returns 0 on success, or -ENOMEM on error of no enough memory.
+ */
+static int update_reg_dump_table(struct device *dev, u32 core_reg_num)
+{
+	int ret = 0;
+	u32 system_regs_input_index = SYSTEM_REGS_INPUT_INDEX +
+			core_reg_num * 2;
+	u32 regdump_output_byte_offset = (system_regs_input_index + 1)
+			* sizeof(uint32_t);
+	struct reg_dump_data *p;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+
+	mutex_lock(&cpudata->mutex);
+
+	if (regdump_output_byte_offset >= cpudata->cpussregdata->size ||
+			regdump_output_byte_offset / sizeof(uint32_t)
+			< system_regs_input_index + 1) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	cpudata->cpussregdata->core_reg_num = core_reg_num;
+	cpudata->cpussregdata->core_reg_used_num = 0;
+	cpudata->cpussregdata->core_reg_end_index = PERCORE_INDEX;
+	cpudata->cpussregdata->sys_reg_size = 0;
+	cpudata->cpussregdata->used_memory = regdump_output_byte_offset;
+
+	memset(cpudata->cpussregdata->dump_vaddr, 0xDE, cpudata->cpussregdata->size);
+	p = (struct reg_dump_data *)cpudata->cpussregdata->dump_vaddr;
+	p->magic = INPUT_DATA_BY_HLOS;
+	p->version = FORMAT_VERSION_2;
+	p->system_regs_input_index = system_regs_input_index;
+	p->regdump_output_byte_offset = regdump_output_byte_offset;
+	memset((uint32_t *)cpudata->cpussregdata->dump_vaddr + PERCORE_INDEX, 0x0,
+			(system_regs_input_index - PERCORE_INDEX + 1)
+			* sizeof(uint32_t));
+
+err:
+	mutex_unlock(&cpudata->mutex);
+	return ret;
+}
+
+static ssize_t core_reg_num_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	int ret;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+
+	if (!cpudata)
+		return -EFAULT;
+
+	mutex_lock(&cpudata->mutex);
+
+	ret = scnprintf(buf, PAGE_SIZE, "%u\n", cpudata->cpussregdata->core_reg_num);
+
+	mutex_unlock(&cpudata->mutex);
+	return ret;
+}
+
+static ssize_t core_reg_num_store(struct device *dev,
+			struct device_attribute *attr,
+			const char *buf, size_t size)
+{
+	int ret;
+	unsigned int val;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+
+	if (kstrtouint(buf, 16, &val))
+		return -EINVAL;
+
+	mutex_lock(&cpudata->mutex);
+
+	if (cpudata->cpussregdata->core_reg_used_num || cpudata->cpussregdata->sys_reg_size) {
+		dev_err(dev, "Couldn't set core_reg_num, register available in list\n");
+		ret = -EPERM;
+		goto err;
+	}
+	if (val == cpudata->cpussregdata->core_reg_num) {
+		mutex_unlock(&cpudata->mutex);
+		return size;
+	}
+
+	mutex_unlock(&cpudata->mutex);
+
+	ret = update_reg_dump_table(dev, val);
+	if (ret) {
+		dev_err(dev, "Couldn't set core_reg_num, no enough memory\n");
+		return ret;
+	}
+
+	return size;
+
+err:
+	mutex_unlock(&cpudata->mutex);
+	return ret;
+}
+static DEVICE_ATTR_RW(core_reg_num);
+
+/**
+ * This function shows configs of per-core and system registers.
+ */
+static ssize_t register_config_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	char local_buf[64];
+	int len = 0, count = 0;
+	int index, system_index_start, index_end;
+	uint32_t register_offset, val;
+	uint32_t *p, cmd;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+
+	buf[0] = '\0';
+
+	if (!cpudata)
+		return -EFAULT;
+
+	mutex_lock(&cpudata->mutex);
+
+	p = (uint32_t *)cpudata->cpussregdata->dump_vaddr;
+
+	/* print per-core & system registers */
+	len = scnprintf(local_buf, 64, "per-core registers:\n");
+	strlcat(buf, local_buf, PAGE_SIZE);
+	count += len;
+
+	system_index_start = *(p + SYS_REG_INPUT_INDEX);
+	index_end = system_index_start +
+			cpudata->cpussregdata->sys_reg_size / sizeof(uint32_t) + 1;
+	for (index = PERCORE_INDEX; index < index_end;) {
+		if (index == system_index_start) {
+			len = scnprintf(local_buf, 64, "system registers:\n");
+			if ((count + len) > PAGE_SIZE) {
+				dev_err(dev, "Couldn't write complete config\n");
+				break;
+			}
+
+			strlcat(buf, local_buf, PAGE_SIZE);
+			count += len;
+		}
+
+		register_offset = *(p + index);
+		if (register_offset == 0) {
+			index++;
+			continue;
+		}
+
+		cmd = register_offset & CMD_MASK;
+		register_offset &= OFFSET_MASK;
+
+		switch (cmd) {
+		case CMD_READ:
+			val = *(p + index + 1);
+			len = scnprintf(local_buf, 64,
+			"0x%x, 0x%x, r\n",
+			register_offset, val);
+			index += 2;
+		break;
+		case CMD_READ_WORD:
+			len = scnprintf(local_buf, 64,
+			"0x%x, 0x%x, r\n",
+			register_offset, 0x4);
+			index++;
+		break;
+		case CMD_WRITE:
+			val = *(p + index + 1);
+			len = scnprintf(local_buf, 64,
+			"0x%x, 0x%x, w\n",
+			register_offset, val);
+			index += 2;
+		break;
+		case CMD_EXTRA:
+			val = *(p + index + 1);
+			cmd = val & EXTRA_CMD_MASK;
+			val &= EXTRA_VALUE_MASK;
+			if (cmd == CMD_DELAY)
+				len = scnprintf(local_buf, 64,
+				"0x%x, 0x%x, d\n",
+				register_offset, val);
+			else
+				len = scnprintf(local_buf, 64,
+				"0x%x, 0x%x, R\n",
+				register_offset, val);
+			index += 2;
+		break;
+		}
+
+		if ((count + len) > PAGE_SIZE) {
+			dev_err(dev, "Couldn't write complete config\n");
+			break;
+		}
+
+		strlcat(buf, local_buf, PAGE_SIZE);
+		count += len;
+	}
+
+	mutex_unlock(&cpudata->mutex);
+	return count;
+}
+
+static int config_cpuss_register(struct device *dev,
+		uint32_t *p, uint32_t index, char cmd,
+		uint32_t register_offset, uint32_t val)
+{
+	int ret = 0;
+
+	switch (cmd) {
+	case 'r':
+		if (val > 4) {
+			*(p + index) = register_offset;
+			*(p + index + 1) = val;
+		} else {
+			*(p + index) = register_offset | CMD_READ_WORD;
+		}
+	break;
+	case 'R':
+		if (val > MAX_EXTRA_VALUE) {
+			dev_err(dev, "repeat read time exceeded the limit\n");
+			ret = -EINVAL;
+			return ret;
+		}
+		*(p + index) = register_offset | CMD_EXTRA;
+		*(p + index + 1) = val | CMD_REPEAT_READ;
+	break;
+	case 'd':
+		if (val > MAX_EXTRA_VALUE) {
+			dev_err(dev, "sleep time exceeded the limit\n");
+			ret = -EINVAL;
+			return ret;
+		}
+		*(p + index) = CMD_EXTRA;
+		*(p + index + 1) = val | CMD_DELAY;
+	break;
+	case 'w':
+		*(p + index) = register_offset | CMD_WRITE;
+		*(p + index + 1) = val;
+	break;
+	default:
+		dev_err(dev, "Don't support this command\n");
+		ret = -EINVAL;
+	}
+	return ret;
+}
+/**
+ * This function sets configs of per-core or system registers.
+ */
+static ssize_t register_config_store(struct device *dev,
+			struct device_attribute *attr,
+			const char *buf, size_t size)
+{
+	int ret;
+	uint32_t register_offset, val, reserve_size = 4, per_core = 0;
+	int nval;
+	char cmd;
+	uint32_t num_cores;
+	u32 extra_memory;
+	u32 used_memory;
+	u32 system_reg_end_index;
+	uint32_t *p;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+
+	nval = sscanf(buf, "%x %x %c %u", &register_offset,
+				&val, &cmd, &per_core);
+	if (nval < 2)
+		return -EINVAL;
+	if (nval == 2)
+		cmd = 'r';
+	if (per_core > 1)
+		return -EINVAL;
+	if (register_offset & 0x3) {
+		dev_err(dev, "Invalid address, must be 4 byte aligned\n");
+		return -EINVAL;
+	}
+
+	if (cmd == 'r' || cmd == 'R') {
+		if (val == 0) {
+			dev_err(dev, "Invalid length of 0\n");
+			return -EINVAL;
+		}
+		if (cmd == 'r' && val & 0x3) {
+			dev_err(dev, "Invalid length, must be 4 byte aligned\n");
+			return -EINVAL;
+		}
+		if (cmd == 'R')
+			reserve_size = val * 4;
+		else
+			reserve_size = val;
+	}
+
+	mutex_lock(&cpudata->mutex);
+
+	p = (uint32_t *)cpudata->cpussregdata->dump_vaddr;
+	if (per_core) { /* per-core register */
+		if (cpudata->cpussregdata->core_reg_used_num ==
+				cpudata->cpussregdata->core_reg_num) {
+			dev_err(dev, "Couldn't add per-core config, out of range\n");
+			ret = -EINVAL;
+			goto err;
+		}
+
+		num_cores = num_possible_cpus();
+		extra_memory = reserve_size * num_cores;
+		used_memory = cpudata->cpussregdata->used_memory + extra_memory;
+		if (extra_memory / num_cores < reserve_size ||
+			used_memory > cpudata->cpussregdata->size ||
+			used_memory < cpudata->cpussregdata->used_memory) {
+			dev_err(dev, "Couldn't add per-core reg config, no enough memory\n");
+			ret = -ENOMEM;
+			goto err;
+		}
+
+		ret = config_cpuss_register(dev, p, cpudata->cpussregdata->core_reg_end_index,
+				cmd, register_offset, val);
+		if (ret)
+			goto err;
+
+		if (cmd == 'r' && val == 4)
+			cpudata->cpussregdata->core_reg_end_index++;
+		else
+			cpudata->cpussregdata->core_reg_end_index += 2;
+
+		cpudata->cpussregdata->core_reg_used_num++;
+		cpudata->cpussregdata->used_memory = used_memory;
+	} else { /* system register */
+		system_reg_end_index = *(p + SYS_REG_INPUT_INDEX) +
+				cpudata->cpussregdata->sys_reg_size / sizeof(uint32_t);
+
+		if (cmd == 'r' && reserve_size == 4)
+			extra_memory = sizeof(uint32_t) + reserve_size;
+		else
+			extra_memory = sizeof(uint32_t) * 2 + reserve_size;
+
+		used_memory = cpudata->cpussregdata->used_memory + extra_memory;
+		if (extra_memory < reserve_size ||
+				used_memory > cpudata->cpussregdata->size ||
+				used_memory < cpudata->cpussregdata->used_memory) {
+			dev_err(dev, "Couldn't add system reg config, no enough memory\n");
+			ret = -ENOMEM;
+			goto err;
+		}
+
+		ret = config_cpuss_register(dev, p, system_reg_end_index,
+				cmd, register_offset, val);
+		if (ret)
+			goto err;
+
+		if (cmd == 'r' && val == 4) {
+			system_reg_end_index++;
+			cpudata->cpussregdata->sys_reg_size += sizeof(uint32_t);
+		} else {
+			system_reg_end_index += 2;
+			cpudata->cpussregdata->sys_reg_size += sizeof(uint32_t) * 2;
+		}
+
+		cpudata->cpussregdata->used_memory = used_memory;
+		*(p + system_reg_end_index) = 0x0;
+		*(p + OUTPUT_DUMP_INDEX) = (system_reg_end_index + 1)
+				* sizeof(uint32_t);
+	}
+
+	ret = size;
+
+err:
+	mutex_unlock(&cpudata->mutex);
+	return ret;
+}
+static DEVICE_ATTR_RW(register_config);
+
+static ssize_t format_version_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	int ret;
+	struct reg_dump_data *p;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+
+	if (!cpudata)
+		return -EFAULT;
+
+	mutex_lock(&cpudata->mutex);
+	p = (struct reg_dump_data *)cpudata->cpussregdata->dump_vaddr;
+	ret = scnprintf(buf, PAGE_SIZE, "%u\n", p->version);
+
+	mutex_unlock(&cpudata->mutex);
+	return ret;
+}
+static DEVICE_ATTR_RO(format_version);
+/**
+ * This function resets the register dump table.
+ */
+static ssize_t register_reset_store(struct device *dev,
+			struct device_attribute *attr,
+			const char *buf, size_t size)
+{
+	unsigned int val;
+
+	if (kstrtouint(buf, 16, &val))
+		return -EINVAL;
+	if (val != 1)
+		return -EINVAL;
+
+	update_reg_dump_table(dev, CORE_REG_NUM_DEFAULT);
+
+	return size;
+}
+static DEVICE_ATTR_WO(register_reset);
+
+/**
+ * This function shows configs of per-core spr dump.
+ */
+static ssize_t spr_config_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	char local_buf[64];
+	int len = 0, count = 0;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+	int i = 0, index = 0;
+	uint32_t *p;
+
+	buf[0] = '\0';
+
+	if (!cpudata)
+		return -EFAULT;
+
+	mutex_lock(&cpudata->mutex);
+
+	len = scnprintf(local_buf, 64, "spr data list below:\n");
+	strlcat(buf, local_buf, PAGE_SIZE);
+	count += len;
+
+	for (i = 0; i < MAX_CORE_NUM; i++) {
+		if (count > PAGE_SIZE) {
+			dev_err(dev, "Couldn't write complete config\n");
+			break;
+		}
+		if (!cpudata->sprdata[i]) {
+			dev_err(dev, "SPR data pinter for CPU%d is empty\n", i);
+			continue;
+		}
+		p = (uint32_t *)cpudata->sprdata[i]->dump_vaddr;
+		len = scnprintf(local_buf, 64, "spr data for CPU[%d] below:\n", i);
+		strlcat(buf, local_buf, PAGE_SIZE);
+		count += len;
+		index = 0;
+		while (index < cpudata->sprdata[i]->sprs_data_index) {
+			if (count > PAGE_SIZE) {
+				dev_err(dev, "Couldn't write complete config\n");
+				break;
+			}
+			len = scnprintf(local_buf, 64, "%d\n", *(p + SPR_DATA_HEADER_SIZE + index));
+			strlcat(buf, local_buf, PAGE_SIZE);
+			count += len;
+			index++;
+		}
+	}
+
+	mutex_unlock(&cpudata->mutex);
+	return count;
+}
+
+/**
+ * This function sets configs for sprs dump.
+ */
+static ssize_t spr_config_store(struct device *dev,
+			struct device_attribute *attr,
+			const char *buf, size_t size)
+{
+	int ret = 0;
+	uint32_t spr_data, cpu_num;
+	uint32_t index;
+	int nval;
+	uint32_t *p;
+	u32 reserved = 0;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+
+	nval = sscanf(buf, "%d %d", &spr_data, &cpu_num);
+	if (nval != 2)
+		return -EINVAL;
+	if (!cpudata)
+		return -EFAULT;
+
+	if (cpu_num >= MAX_CORE_NUM) {
+		dev_err(dev, "Input the wrong CPU number\n");
+		return -EINVAL;
+	}
+	reserved = (SPR_INPUT_DATA_SIZE + SPR_OUTPUT_DATA_SIZE) * sizeof(uint32_t);
+
+	mutex_lock(&cpudata->mutex);
+	if (cpudata->sprdata[cpu_num]) {
+		p = (uint32_t *)cpudata->sprdata[cpu_num]->dump_vaddr;
+		index = cpudata->sprdata[cpu_num]->sprs_data_index;
+
+		if (cpudata->sprdata[cpu_num]->size >
+				cpudata->sprdata[cpu_num]->used_memory + reserved) {
+			p = (uint32_t *)cpudata->sprdata[cpu_num]->dump_vaddr;
+			*(p + OUTPUT_DUMP_INDEX) = (SPR_DATA_HEADER_SIZE +
+				index + SPR_INPUT_DATA_TAIL_SIZE + 1) * sizeof(uint32_t);
+			*(p + SPR_DATA_HEADER_SIZE + index) = spr_data;
+			*(p + SPR_DATA_HEADER_SIZE + index + 1) = 0;
+			cpudata->sprdata[cpu_num]->sprs_data_index++;
+			cpudata->sprdata[cpu_num]->used_memory =
+				cpudata->sprdata[cpu_num]->used_memory + reserved;
+		} else {
+			dev_err(dev, "Couldn't add SPR config, no enough memory\n");
+			ret = -ENOMEM;
+			goto err;
+		}
+	}
+	ret = size;
+
+err:
+	mutex_unlock(&cpudata->mutex);
+	return ret;
+}
+static DEVICE_ATTR_RW(spr_config);
+
+/**
+ * This function resets the sprs dump table.
+ */
+static ssize_t sprs_register_reset_store(struct device *dev,
+			struct device_attribute *attr,
+			const char *buf, size_t size)
+{
+	unsigned int val;
+
+	if (kstrtouint(buf, 16, &val))
+		return -EINVAL;
+	if (val != 1)
+		return -EINVAL;
+
+	reset_sprs_dump_table(dev);
+
+	return size;
+}
+static DEVICE_ATTR_WO(sprs_register_reset);
+
+static ssize_t sprs_format_version_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	char local_buf[64];
+	int len = 0, count = 0, i = 0;
+	struct reg_dump_data *p;
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+
+	buf[0] = '\0';
+
+	if (!cpudata)
+		return -EFAULT;
+
+	mutex_lock(&cpudata->mutex);
+
+	for (i = 0; i < MAX_CORE_NUM; i++) {
+		if (cpudata->sprdata[i]) {
+			p = (struct reg_dump_data *)cpudata->sprdata[i]->dump_vaddr;
+			len = scnprintf(local_buf, 64,
+				"SPR data format version for cpu%d is %d\n", i, p->version);
+			strlcat(buf, local_buf, PAGE_SIZE);
+			count += len;
+		}
+	}
+
+	mutex_unlock(&cpudata->mutex);
+	return count;
+}
+static DEVICE_ATTR_RO(sprs_format_version);
+
+
+static const struct device_attribute *register_dump_attrs[] = {
+	&dev_attr_core_reg_num,
+	&dev_attr_register_config,
+	&dev_attr_register_reset,
+	&dev_attr_format_version,
+	NULL,
+};
+
+static const struct device_attribute *spr_dump_attrs[] = {
+	&dev_attr_spr_config,
+	&dev_attr_sprs_register_reset,
+	&dev_attr_sprs_format_version,
+	NULL,
+};
+
+static int memory_dump_create_files(struct device *dev,
+			const struct device_attribute **attrs)
+{
+	int ret = 0;
+	int i, j;
+
+	for (i = 0; attrs[i] != NULL; i++) {
+		ret = device_create_file(dev, attrs[i]);
+		if (ret) {
+			dev_err(dev, "Couldn't create sysfs attribute: %s\n",
+				attrs[i]->attr.name);
+			for (j = 0; j < i; j++)
+				device_remove_file(dev, attrs[j]);
+			break;
+		}
+	}
+	return ret;
+}
+
+static void cpuss_create_nodes(struct platform_device *pdev,
+			int initialized)
+{
+	if (initialized & PERCORE_REG_INITIALIZED) {
+		if (memory_dump_create_files(&pdev->dev, register_dump_attrs))
+			dev_err(&pdev->dev, "Fail to create files for cpuss register dump\n");
+	}
+	if (initialized & SPRS_INITIALIZED) {
+		if (memory_dump_create_files(&pdev->dev, spr_dump_attrs))
+			dev_err(&pdev->dev, "Fail to create files for spr dump\n");
+	}
+}
+
+uint32_t msm_dump_table_version(void)
+{
+	return MSM_DUMP_TABLE_VERSION;
+}
+EXPORT_SYMBOL_GPL(msm_dump_table_version);
+
+static int msm_dump_table_register(struct msm_dump_entry *entry)
+{
+	struct msm_dump_entry *e;
+	struct msm_dump_table *table = memdump.table;
+
+	if (!table || table->num_entries >= MAX_NUM_ENTRIES)
+		return -EINVAL;
+
+	e = &table->entries[table->num_entries];
+	e->id = entry->id;
+	e->type = MSM_DUMP_TYPE_TABLE;
+	e->addr = entry->addr;
+	table->num_entries++;
+
+	return 0;
+}
+
+static struct msm_dump_table *msm_dump_get_table(enum msm_dump_table_ids id)
+{
+	struct msm_dump_table *table = memdump.table;
+	int i;
+	unsigned long offset;
+
+	if (!table) {
+		pr_err("mem dump base table does not exist\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	for (i = 0; i < MAX_NUM_ENTRIES; i++) {
+		if (table->entries[i].id == id)
+			break;
+	}
+	if (i == MAX_NUM_ENTRIES || !table->entries[i].addr) {
+		pr_err("mem dump base table entry %d invalid\n", id);
+		return ERR_PTR(-EINVAL);
+	}
+
+	offset = table->entries[i].addr - memdump.table_phys;
+	/* Get the apps table pointer */
+	table = (void *)memdump.table + offset;
+
+	return table;
+}
+
+static int register_dump_table_entry(enum msm_dump_table_ids id,
+					struct msm_dump_entry *entry)
+{
+	struct msm_dump_entry *e;
+	struct msm_dump_table *table;
+
+	table = msm_dump_get_table(id);
+	if (IS_ERR(table))
+		return PTR_ERR(table);
+
+	if (!table || table->num_entries >= MAX_NUM_ENTRIES)
+		return -EINVAL;
+
+	e = &table->entries[table->num_entries];
+	e->id = entry->id;
+	e->type = MSM_DUMP_TYPE_DATA;
+	e->addr = entry->addr;
+	table->num_entries++;
+
+	return 0;
+}
+
+/**
+ * msm_dump_data_register_nominidump - register to dump data framework
+ * @id: ID of the dump table.
+ * @entry: dump entry to be registered
+ * This api will register the entry passed to dump table only
+ */
+int msm_dump_data_register_nominidump(enum msm_dump_table_ids id,
+			   struct msm_dump_entry *entry)
+{
+	return register_dump_table_entry(id, entry);
+}
+EXPORT_SYMBOL_GPL(msm_dump_data_register_nominidump);
+
+#define MSM_DUMP_TOTAL_SIZE_OFFSET	0x724
+static int init_memdump_imem_area(size_t size)
+{
+	struct device_node *np;
+	void __iomem *imem_base;
+
+	np = of_find_compatible_node(NULL, NULL,
+				     "qcom,msm-imem-mem-dump-table");
+	if (!np) {
+		pr_err("mem dump base table DT node does not exist\n");
+		return -ENODEV;
+	}
+
+	imem_base = of_iomap(np, 0);
+	if (!imem_base) {
+		pr_err("mem dump base table imem offset mapping failed\n");
+		return -ENOMEM;
+	}
+
+	memcpy_toio(imem_base, &memdump.table_phys,
+			sizeof(memdump.table_phys));
+	memcpy_toio(imem_base + MSM_DUMP_TOTAL_SIZE_OFFSET,
+			&size, sizeof(size_t));
+
+	/* Ensure write to imem_base is complete before unmapping */
+	mb();
+	pr_info("MSM Memory Dump base table set up in IMEM\n");
+
+	iounmap(imem_base);
+	return 0;
+}
+
+static int init_memory_dump(void *dump_vaddr, phys_addr_t phys_addr)
+{
+	struct msm_dump_table *table;
+	struct msm_dump_entry entry;
+	int ret;
+
+	memdump.table = dump_vaddr;
+	memdump.table->version = MSM_DUMP_TABLE_VERSION;
+	memdump.table_phys = phys_addr;
+	dump_vaddr +=  sizeof(*table);
+	phys_addr += sizeof(*table);
+	table = dump_vaddr;
+	table->version = MSM_DUMP_TABLE_VERSION;
+	entry.id = MSM_DUMP_TABLE_APPS;
+	entry.addr = phys_addr;
+	ret = msm_dump_table_register(&entry);
+	if (ret) {
+		pr_err("mem dump apps data table register failed\n");
+		return ret;
+	}
+	pr_info("MSM Memory Dump apps data table set up\n");
+
+	return 0;
+}
+
+static int mem_dump_reserve_mem(struct device *dev)
+{
+	struct device_node *mem_node;
+	int ret;
+
+	mem_node = of_parse_phandle(dev->of_node, "memory-region", 0);
+	if (mem_node) {
+		ret = of_reserved_mem_device_init_by_idx(dev,
+				dev->of_node, 0);
+		of_node_put(dev->of_node);
+		if (ret) {
+			dev_err(dev,
+				"Failed to initialize reserved mem, ret %d\n",
+				ret);
+			return ret;
+		}
+	}
+	return 0;
+}
+
+static int cpuss_regdump_init(struct device *dev,
+		void *dump_vaddr, u32 size)
+{
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+
+	cpudata->cpussregdata = devm_kzalloc(dev,
+		sizeof(struct cpuss_regdump_data), GFP_KERNEL);
+
+	if (cpudata->cpussregdata) {
+		cpudata->cpussregdata->dump_vaddr = dump_vaddr;
+		cpudata->cpussregdata->size = size;
+		return 0;
+	}
+	return -ENOMEM;
+}
+
+static int sprs_dump_init(struct device *dev,
+		void *dump_vaddr, u32 size, u32 id)
+{
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(dev);
+	int core_num = 0;
+
+	core_num = id - SPR_DUMP_CPU0;
+
+	cpudata->sprdata[core_num] = devm_kzalloc(dev,
+		sizeof(struct sprs_dump_data), GFP_KERNEL);
+	if (cpudata->sprdata[core_num]) {
+		cpudata->sprdata[core_num]->dump_vaddr = dump_vaddr;
+		cpudata->sprdata[core_num]->size = size;
+		return 0;
+	}
+	return -ENOMEM;
+}
+
+static int cpuss_dump_init(struct platform_device *pdev,
+		void *dump_vaddr, u32 size, u32 id)
+{
+	struct cpuss_dump_data *cpudata = dev_get_drvdata(&pdev->dev);
+	static int initialized;
+
+	if (!cpudata) {
+		cpudata = devm_kzalloc(&pdev->dev,
+				sizeof(struct cpuss_dump_data), GFP_KERNEL);
+		if (cpudata) {
+			mutex_init(&cpudata->mutex);
+			platform_set_drvdata(pdev, cpudata);
+		} else
+			return initialized;
+	}
+
+	if (id == CPUSS_REGDUMP) {
+		if (!cpuss_regdump_init(&pdev->dev, dump_vaddr, size))
+			initialized |= PERCORE_REG_INITIALIZED;
+	} else {
+		if (!sprs_dump_init(&pdev->dev, dump_vaddr, size, id))
+			initialized |= SPRS_INITIALIZED;
+	}
+
+	return initialized;
+}
+
+#define MSM_DUMP_DATA_SIZE sizeof(struct msm_dump_data)
+static int mem_dump_alloc(struct platform_device *pdev)
+{
+	struct device_node *child_node;
+	const struct device_node *node = pdev->dev.of_node;
+	struct msm_dump_data *dump_data;
+	struct msm_dump_entry dump_entry;
+	size_t total_size;
+	u32 size, id;
+	int ret, no_of_nodes;
+	dma_addr_t dma_handle;
+	phys_addr_t phys_addr;
+	struct sg_table mem_dump_sgt;
+	void *dump_vaddr;
+	uint32_t ns_vmids[] = {VMID_HLOS};
+	uint32_t ns_vm_perms[] = {PERM_READ | PERM_WRITE};
+	u64 shm_bridge_handle;
+	int initialized = 0;
+
+	if (mem_dump_reserve_mem(&pdev->dev) != 0)
+		return -ENOMEM;
+	total_size = size = ret = no_of_nodes = 0;
+	/* For dump table registration with IMEM */
+	total_size = sizeof(struct msm_dump_table) * 2;
+	for_each_available_child_of_node(node, child_node) {
+		ret = of_property_read_u32(child_node, "qcom,dump-size", &size);
+		if (ret) {
+			dev_err(&pdev->dev, "Unable to find size for %s\n",
+					child_node->name);
+			continue;
+		}
+
+		total_size += size;
+		no_of_nodes++;
+	}
+
+	total_size += (MSM_DUMP_DATA_SIZE * no_of_nodes);
+	total_size = ALIGN(total_size, SZ_4K);
+	dump_vaddr = dmam_alloc_coherent(&pdev->dev, total_size,
+						&dma_handle, GFP_KERNEL);
+	if (!dump_vaddr)
+		return -ENOMEM;
+
+	dma_get_sgtable(&pdev->dev, &mem_dump_sgt, dump_vaddr,
+						dma_handle, total_size);
+	phys_addr = page_to_phys(sg_page(mem_dump_sgt.sgl));
+	sg_free_table(&mem_dump_sgt);
+
+	memset(dump_vaddr, 0x0, total_size);
+	ret = qcom_tzmem_register(phys_addr, total_size, ns_vmids,
+			ns_vm_perms, 1, PERM_READ|PERM_WRITE, &shm_bridge_handle);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to create shm bridge.ret=%d\n", ret);
+		return ret;
+	}
+
+	ret = init_memory_dump(dump_vaddr, phys_addr);
+	if (ret) {
+		dev_err(&pdev->dev, "Memory Dump table set up is failed\n");
+		qcom_tzmem_deregister(shm_bridge_handle);
+		return ret;
+	}
+
+	ret = init_memdump_imem_area(total_size);
+	if (ret) {
+		qcom_tzmem_deregister(shm_bridge_handle);
+		return ret;
+	}
+
+	dump_vaddr += (sizeof(struct msm_dump_table) * 2);
+	phys_addr += (sizeof(struct msm_dump_table) * 2);
+	for_each_available_child_of_node(node, child_node) {
+		ret = of_property_read_u32(child_node, "qcom,dump-size", &size);
+		if (ret)
+			continue;
+
+		ret = of_property_read_u32(child_node, "qcom,dump-id", &id);
+		if (ret) {
+			dev_err(&pdev->dev, "Unable to find id for %s\n",
+					child_node->name);
+			continue;
+		}
+
+		dump_data = dump_vaddr;
+		dump_data->addr = phys_addr + MSM_DUMP_DATA_SIZE;
+		dump_data->len = size;
+		dump_entry.id = id;
+		strscpy(dump_data->name, child_node->name,
+					sizeof(dump_data->name));
+		dump_entry.addr = phys_addr;
+		ret = msm_dump_data_register_nominidump(MSM_DUMP_TABLE_APPS,
+					&dump_entry);
+		if (ret)
+			dev_err(&pdev->dev, "Data dump setup failed, id = %d\n",
+				id);
+
+		if ((id == CPUSS_REGDUMP) ||
+				((id >= SPR_DUMP_CPU0) && (id <= SPR_DUMP_CPU7)))
+			initialized = cpuss_dump_init(pdev,
+				(dump_vaddr + MSM_DUMP_DATA_SIZE), size, id);
+
+		dump_vaddr += (size + MSM_DUMP_DATA_SIZE);
+		phys_addr += (size  + MSM_DUMP_DATA_SIZE);
+	}
+
+	cpuss_create_nodes(pdev, initialized);
+
+	if (initialized & SPRS_INITIALIZED)
+		reset_sprs_dump_table(&pdev->dev);
+
+	return ret;
+}
+
+static int mem_dump_probe(struct platform_device *pdev)
+{
+	int ret;
+
+	ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+	if (ret < 0)
+		return ret;
+
+	ret = mem_dump_alloc(pdev);
+	return ret;
+}
+
+static const struct of_device_id mem_dump_match_table[] = {
+	{.compatible = "qcom,mem-dump",},
+	{}
+};
+
+static struct platform_driver mem_dump_driver = {
+	.probe = mem_dump_probe,
+	.driver = {
+		.name = "msm_mem_dump",
+		.of_match_table = mem_dump_match_table,
+	},
+};
+
+module_platform_driver(mem_dump_driver);
+
+MODULE_DESCRIPTION("Memory Dump V2 Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/panel_event_notifier.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/panel_event_notifier.c
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/module.h>
+#include <linux/soc/qcom/panel_event_notifier.h>
+
+struct panel_event_notifier_entry {
+	panel_event_notifier_handler handler;
+	void *pvt_data;
+	struct drm_panel *panel;
+	enum panel_event_notifier_tag tag;
+};
+
+static DEFINE_MUTEX(panel_event_notifier_entries_lock);
+static struct panel_event_notifier_entry
+		panel_event_notifier_entries[PANEL_EVENT_NOTIFIER_CLIENT_MAX];
+
+static bool panel_event_notifier_tag_valid(enum panel_event_notifier_tag tag)
+{
+	return tag > PANEL_EVENT_NOTIFICATION_NONE &&
+			tag < PANEL_EVENT_NOTIFICATION_MAX;
+}
+
+/**
+ * panel_event_notifier_register: responsible for registering clients
+ *                                 interested in panel event notifications.
+ *                                 clients register with a client handle and tag
+ *                                 suggesting the notifications they are
+ *                                 interested in and a callback which is
+ *                                 triggered when the interested panel
+ *                                 notifications are received.
+ *
+ * @tag: The tag for which the caller would like to receive panel events for.
+ *
+ * @client_handle: handle to recongnize the client registering for
+ *                 notifications.
+ *
+ * @panel: struct drm_panel for which the panel events are requested for.
+ *
+ * @handler: The handler that will be invoked when a panel event notification is
+ *           received pertaining to @tag. The handler will be invoked with a
+ *           pointer to private data registered by the client that is needed
+ *           for servicing the notification.
+ *
+ * @pvt_data: The data that should be passed to @handler when a notification
+ *            occurs
+ *
+ * On success, the function will return a cookie.
+ *
+ */
+void *panel_event_notifier_register(enum panel_event_notifier_tag tag,
+		enum panel_event_notifier_client client_handle,
+		struct drm_panel *panel,
+		panel_event_notifier_handler handler, void *pvt_data)
+{
+	struct panel_event_notifier_entry *entry;
+
+	if (!panel_event_notifier_tag_valid(tag) || !handler) {
+		pr_err("Invalid tag or handler found while registering\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	if (client_handle < 0 ||
+			client_handle >= PANEL_EVENT_NOTIFIER_CLIENT_MAX) {
+		pr_err("Invalid client handle used for registering\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	mutex_lock(&panel_event_notifier_entries_lock);
+	entry = &panel_event_notifier_entries[client_handle];
+	if (entry->handler) {
+		mutex_unlock(&panel_event_notifier_entries_lock);
+		return ERR_PTR(-EEXIST);
+	}
+	entry->panel = panel;
+	entry->handler = handler;
+	entry->pvt_data = pvt_data;
+	entry->tag = tag;
+	mutex_unlock(&panel_event_notifier_entries_lock);
+
+	pr_debug("client %d registered successfully\n", client_handle);
+	return entry;
+}
+EXPORT_SYMBOL_GPL(panel_event_notifier_register);
+
+/**
+ * panel_event_notifier_unregister: responsible for unregistering clients.
+ *
+ * @cookie: cookie used for unregistering client.
+ */
+void panel_event_notifier_unregister(void *cookie)
+{
+	struct panel_event_notifier_entry *entry = cookie;
+
+	if (!cookie)
+		return;
+
+	mutex_lock(&panel_event_notifier_entries_lock);
+	entry->panel = NULL;
+	entry->handler = NULL;
+	entry->pvt_data = NULL;
+	entry->tag = PANEL_EVENT_NOTIFICATION_NONE;
+	mutex_unlock(&panel_event_notifier_entries_lock);
+}
+EXPORT_SYMBOL_GPL(panel_event_notifier_unregister);
+
+/**
+ * panel_event_notifion_trigger: responsible for triggering notifications.
+ *                               Contains tag which notifies the panel
+ *                               notification is on premiary or secondary
+ *                               display and a notifcation carrying necessary
+ *                               data for clients to consume while servicing the
+ *                               notification. A handler registered by the
+ *                               client will be triggered to notify the event.
+ *
+ * @tag: tag suggesting the panel on which notification is triggered.
+ *
+ * @notification: contains data required for client to address the notification.
+ */
+void panel_event_notification_trigger(enum panel_event_notifier_tag tag,
+		 struct panel_event_notification *notification)
+{
+	struct panel_event_notifier_entry *entry;
+	panel_event_notifier_handler handler = NULL;
+	void *pvt_data;
+	int i;
+
+	if (!panel_event_notifier_tag_valid(tag)) {
+		pr_err("Invalid panel notifier tag\n");
+		return;
+	}
+
+	for (i = 0; i < PANEL_EVENT_NOTIFIER_CLIENT_MAX; i++) {
+		mutex_lock(&panel_event_notifier_entries_lock);
+		entry = &panel_event_notifier_entries[i];
+		if (notification->panel != entry->panel) {
+			pr_debug("invalid panel found notification_panel:0x%x entry_panel:0x%x\n",
+					notification->panel, entry->panel);
+			mutex_unlock(&panel_event_notifier_entries_lock);
+			continue;
+		}
+
+		/* skip client entries not subscribed to tag */
+		if (entry->tag != tag) {
+			pr_err("tag mismatch entry->tag:%d tag:%d\n", entry->tag, tag);
+			mutex_unlock(&panel_event_notifier_entries_lock);
+			continue;
+		}
+
+		handler = entry->handler;
+		pvt_data = entry->pvt_data;
+		mutex_unlock(&panel_event_notifier_entries_lock);
+
+		pr_debug("triggering notification for tag:%d, type:%d\n",
+				tag, notification->notif_type);
+
+		if (handler)
+			handler(tag, notification, pvt_data);
+
+	}
+}
+EXPORT_SYMBOL_GPL(panel_event_notification_trigger);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Qualcomm Technologies, Inc. Panel event notifier");
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/pdr_interface.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/pdr_interface.c
@@ -76,12 +76,12 @@
 					      locator_hdl);
 	struct pdr_service *pds;
 
+	mutex_lock(&pdr->lock);
 	/* Create a local client port for QMI communication */
 	pdr->locator_addr.sq_family = AF_QIPCRTR;
 	pdr->locator_addr.sq_node = svc->node;
 	pdr->locator_addr.sq_port = svc->port;
 
-	mutex_lock(&pdr->lock);
 	pdr->locator_init_complete = true;
 	mutex_unlock(&pdr->lock);
 
@@ -104,10 +104,10 @@
 
 	mutex_lock(&pdr->lock);
 	pdr->locator_init_complete = false;
-	mutex_unlock(&pdr->lock);
 
 	pdr->locator_addr.sq_node = 0;
 	pdr->locator_addr.sq_port = 0;
+	mutex_unlock(&pdr->lock);
 }
 
 static const struct qmi_ops pdr_locator_ops = {
@@ -365,12 +365,14 @@
 	if (ret < 0)
 		return ret;
 
+	mutex_lock(&pdr->lock);
 	ret = qmi_send_request(&pdr->locator_hdl,
 			       &pdr->locator_addr,
 			       &txn, SERVREG_GET_DOMAIN_LIST_REQ,
 			       SERVREG_GET_DOMAIN_LIST_REQ_MAX_LEN,
 			       servreg_get_domain_list_req_ei,
 			       req);
+	mutex_unlock(&pdr->lock);
 	if (ret < 0) {
 		qmi_txn_cancel(&txn);
 		return ret;
@@ -415,7 +417,7 @@
 		if (ret < 0)
 			goto out;
 
-		for (i = domains_read; i < resp->domain_list_len; i++) {
+		for (i = 0; i < resp->domain_list_len; i++) {
 			entry = &resp->domain_list[i];
 
 			if (strnlen(entry->name, sizeof(entry->name)) == sizeof(entry->name))
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/pmic_glink.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/pmic_glink.c
@@ -4,6 +4,7 @@
  * Copyright (c) 2022, Linaro Ltd
  */
 #include <linux/auxiliary_bus.h>
+#include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
@@ -11,6 +12,9 @@
 #include <linux/slab.h>
 #include <linux/soc/qcom/pdr.h>
 #include <linux/soc/qcom/pmic_glink.h>
+#include <linux/spinlock.h>
+
+#define PMIC_GLINK_SEND_TIMEOUT (5 * HZ)
 
 enum {
 	PMIC_GLINK_CLIENT_BATT = 0,
@@ -36,7 +40,7 @@
 	unsigned int pdr_state;
 
 	/* serializing clients list updates */
-	struct mutex client_lock;
+	spinlock_t client_lock;
 	struct list_head clients;
 };
 
@@ -58,17 +62,18 @@
 {
 	struct pmic_glink_client *client = (struct pmic_glink_client *)res;
 	struct pmic_glink *pg = client->pg;
+	unsigned long flags;
 
-	mutex_lock(&pg->client_lock);
+	spin_lock_irqsave(&pg->client_lock, flags);
 	list_del(&client->node);
-	mutex_unlock(&pg->client_lock);
+	spin_unlock_irqrestore(&pg->client_lock, flags);
 }
 
-struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev,
-							  unsigned int id,
-							  void (*cb)(const void *, size_t, void *),
-							  void (*pdr)(void *, int),
-							  void *priv)
+struct pmic_glink_client *devm_pmic_glink_client_alloc(struct device *dev,
+						       unsigned int id,
+						       void (*cb)(const void *, size_t, void *),
+						       void (*pdr)(void *, int),
+						       void *priv)
 {
 	struct pmic_glink_client *client;
 	struct pmic_glink *pg = dev_get_drvdata(dev->parent);
@@ -82,22 +87,60 @@
 	client->cb = cb;
 	client->pdr_notify = pdr;
 	client->priv = priv;
-
-	mutex_lock(&pg->client_lock);
-	list_add(&client->node, &pg->clients);
-	mutex_unlock(&pg->client_lock);
+	INIT_LIST_HEAD(&client->node);
 
 	devres_add(dev, client);
 
 	return client;
 }
-EXPORT_SYMBOL_GPL(devm_pmic_glink_register_client);
+EXPORT_SYMBOL_GPL(devm_pmic_glink_client_alloc);
+
+void pmic_glink_client_register(struct pmic_glink_client *client)
+{
+	struct pmic_glink *pg = client->pg;
+	unsigned long flags;
+
+	mutex_lock(&pg->state_lock);
+	spin_lock_irqsave(&pg->client_lock, flags);
+
+	list_add(&client->node, &pg->clients);
+	client->pdr_notify(client->priv, pg->client_state);
+
+	spin_unlock_irqrestore(&pg->client_lock, flags);
+	mutex_unlock(&pg->state_lock);
+
+}
+EXPORT_SYMBOL_GPL(pmic_glink_client_register);
 
 int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len)
 {
 	struct pmic_glink *pg = client->pg;
+	bool timeout_reached = false;
+	unsigned long start;
+	int ret;
+
+	mutex_lock(&pg->state_lock);
+	if (!pg->ept) {
+		ret = -ECONNRESET;
+	} else {
+		start = jiffies;
+		for (;;) {
+			ret = rpmsg_send(pg->ept, data, len);
+			if (ret != -EAGAIN)
+				break;
+
+			if (timeout_reached) {
+				ret = -ETIMEDOUT;
+				break;
+			}
+
+			usleep_range(1000, 5000);
+			timeout_reached = time_after(jiffies, start + PMIC_GLINK_SEND_TIMEOUT);
+		}
+	}
+	mutex_unlock(&pg->state_lock);
 
-	return rpmsg_send(pg->ept, data, len);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(pmic_glink_send);
 
@@ -107,6 +150,7 @@
 	struct pmic_glink_client *client;
 	struct pmic_glink_hdr *hdr;
 	struct pmic_glink *pg = dev_get_drvdata(&rpdev->dev);
+	unsigned long flags;
 
 	if (len < sizeof(*hdr)) {
 		dev_warn(pg->dev, "ignoring truncated message\n");
@@ -115,10 +159,12 @@
 
 	hdr = data;
 
+	spin_lock_irqsave(&pg->client_lock, flags);
 	list_for_each_entry(client, &pg->clients, node) {
 		if (client->id == le32_to_cpu(hdr->owner))
 			client->cb(data, len, client->priv);
 	}
+	spin_unlock_irqrestore(&pg->client_lock, flags);
 
 	return 0;
 }
@@ -158,18 +204,21 @@
 {
 	struct pmic_glink_client *client;
 	unsigned int new_state = pg->client_state;
+	unsigned long flags;
 
 	if (pg->client_state != SERVREG_SERVICE_STATE_UP) {
 		if (pg->pdr_state == SERVREG_SERVICE_STATE_UP && pg->ept)
 			new_state = SERVREG_SERVICE_STATE_UP;
 	} else {
-		if (pg->pdr_state == SERVREG_SERVICE_STATE_UP && pg->ept)
+		if (pg->pdr_state == SERVREG_SERVICE_STATE_DOWN || !pg->ept)
 			new_state = SERVREG_SERVICE_STATE_DOWN;
 	}
 
 	if (new_state != pg->client_state) {
+		spin_lock_irqsave(&pg->client_lock, flags);
 		list_for_each_entry(client, &pg->clients, node)
 			client->pdr_notify(client->priv, new_state);
+		spin_unlock_irqrestore(&pg->client_lock, flags);
 		pg->client_state = new_state;
 	}
 }
@@ -189,11 +238,24 @@
 {
 	struct pmic_glink *pg = __pmic_glink;
 	int ret = 0;
+	int i = 0;
+
+	do {
+		mutex_lock(&__pmic_glink_lock);
+		pg = __pmic_glink;
+		mutex_unlock(&__pmic_glink_lock);
+		if (pg)
+			break;
+
+		usleep_range(1000, 5000);
+		i++;
+
+	} while (i < 10000 && !pg);
 
-	mutex_lock(&__pmic_glink_lock);
 	if (!pg) {
 		ret = dev_err_probe(&rpdev->dev, -ENODEV, "no pmic_glink device to attach to\n");
-		goto out_unlock;
+		pr_err("%s: FAILED - pg = %p ", __func__, pg);
+		return ret;
 	}
 
 	dev_set_drvdata(&rpdev->dev, pg);
@@ -203,8 +265,6 @@
 	pmic_glink_state_notify_clients(pg);
 	mutex_unlock(&pg->state_lock);
 
-out_unlock:
-	mutex_unlock(&__pmic_glink_lock);
 	return ret;
 }
 
@@ -256,7 +316,7 @@
 	pg->dev = &pdev->dev;
 
 	INIT_LIST_HEAD(&pg->clients);
-	mutex_init(&pg->client_lock);
+	spin_lock_init(&pg->client_lock);
 	mutex_init(&pg->state_lock);
 
 	match_data = (unsigned long *)of_device_get_match_data(&pdev->dev);
@@ -360,8 +420,17 @@
 
 static int pmic_glink_init(void)
 {
-	platform_driver_register(&pmic_glink_driver);
-	register_rpmsg_driver(&pmic_glink_rpmsg_driver);
+	int ret;
+
+	ret = platform_driver_register(&pmic_glink_driver);
+	if (ret < 0)
+		return ret;
+
+	ret = register_rpmsg_driver(&pmic_glink_rpmsg_driver);
+	if (ret < 0) {
+		platform_driver_unregister(&pmic_glink_driver);
+		return ret;
+	}
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/pmic_glink_altmode.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/pmic_glink_altmode.c
@@ -49,6 +49,11 @@
 	__le32 reserved[2];
 };
 
+struct pmic_glink_altmode_client_data {
+	void *data;
+	void (*cb)(void *priv, struct typec_displayport_data data, int orientation);
+};
+
 enum pmic_glink_altmode_pin_assignment {
 	DPAM_HPD_OUT,
 	DPAM_HPD_A,
@@ -98,12 +103,31 @@
 
 	struct completion pan_ack;
 	struct pmic_glink_client *client;
+	struct pmic_glink_altmode_client_data dp_client;
 
 	struct work_struct enable_work;
 
 	struct pmic_glink_altmode_port ports[PMIC_GLINK_MAX_PORTS];
 };
 
+static struct pmic_glink_altmode *__altmode;
+
+int pmic_glink_altmode_register_client(void (*cb)(void *priv, struct typec_displayport_data data,
+					int orientation),
+					void *priv)
+{
+	if (!__altmode) {
+		pr_debug("pmic_glink_altmode is not yet registered\n");
+		return -EPROBE_DEFER;
+	}
+
+	__altmode->dp_client.cb = cb;
+	__altmode->dp_client.data = priv;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(pmic_glink_altmode_register_client);
+
 static int pmic_glink_altmode_request(struct pmic_glink_altmode *altmode, u32 cmd, u32 arg)
 {
 	struct usbc_write_req req = {};
@@ -169,6 +193,9 @@
 	ret = typec_retimer_set(port->typec_retimer, &port->retimer_state);
 	if (ret)
 		dev_err(altmode->dev, "failed to setup retimer to DP: %d\n", ret);
+
+	if (altmode->dp_client.cb)
+		altmode->dp_client.cb(altmode->dp_client.data, dp_data, port->orientation);
 }
 
 static void pmic_glink_altmode_enable_usb(struct pmic_glink_altmode *altmode,
@@ -196,6 +223,7 @@
 static void pmic_glink_altmode_safe(struct pmic_glink_altmode *altmode,
 				    struct pmic_glink_altmode_port *port)
 {
+	struct typec_displayport_data dp_data = {};
 	int ret;
 
 	port->state.alt = NULL;
@@ -213,6 +241,16 @@
 	ret = typec_retimer_set(port->typec_retimer, &port->retimer_state);
 	if (ret)
 		dev_err(altmode->dev, "failed to setup retimer to USB: %d\n", ret);
+
+	dp_data.status = DP_STATUS_CON_DISABLED;
+	if (port->hpd_state)
+		dp_data.status |= DP_STATUS_HPD_STATE;
+	if (port->hpd_irq)
+		dp_data.status |= DP_STATUS_IRQ_HPD;
+	dp_data.conf = DP_CONF_SET_PIN_ASSIGN(port->mode);
+
+	if (altmode->dp_client.cb)
+		altmode->dp_client.cb(altmode->dp_client.data, dp_data, port->orientation);
 }
 
 static void pmic_glink_altmode_worker(struct work_struct *work)
@@ -520,12 +558,19 @@
 			return ret;
 	}
 
-	altmode->client = devm_pmic_glink_register_client(dev,
-							  altmode->owner_id,
-							  pmic_glink_altmode_callback,
-							  pmic_glink_altmode_pdr_notify,
-							  altmode);
-	return PTR_ERR_OR_ZERO(altmode->client);
+	altmode->client = devm_pmic_glink_client_alloc(dev,
+						       altmode->owner_id,
+						       pmic_glink_altmode_callback,
+						       pmic_glink_altmode_pdr_notify,
+						       altmode);
+	if (IS_ERR(altmode->client))
+		return PTR_ERR(altmode->client);
+
+	pmic_glink_client_register(altmode->client);
+
+	__altmode = altmode;
+
+	return 0;
 }
 
 static const struct auxiliary_device_id pmic_glink_altmode_id_table[] = {
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/qcom-geni-se.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/qcom-geni-se.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+// Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 /* Disable MMIO tracing to prevent excessive logging of unwanted MMIO traces */
 #define __DISABLE_TRACE_MMIO__
@@ -15,6 +16,7 @@
 #include <linux/pinctrl/consumer.h>
 #include <linux/platform_device.h>
 #include <linux/soc/qcom/geni-se.h>
+#include <soc/qcom/qup_fw_load.h>
 
 /**
  * DOC: Overview
@@ -81,7 +83,7 @@
  */
 
 #define MAX_CLK_PERF_LEVEL 32
-#define MAX_CLKS 2
+#define MAX_SE_CLKS 2
 
 /**
  * struct geni_wrapper - Data structure to represent the QUP Wrapper Core
@@ -89,15 +91,18 @@
  * @base:		Base address of this instance of QUP wrapper core
  * @clks:		Handle to the primary & optional secondary AHB clocks
  * @num_clks:		Count of clocks
- * @to_core:		Core ICC path
  */
 struct geni_wrapper {
 	struct device *dev;
 	void __iomem *base;
-	struct clk_bulk_data clks[MAX_CLKS];
+	struct clk_bulk_data clks[MAX_SE_CLKS];
 	unsigned int num_clks;
 };
 
+/* elf file should be at /lib/firmware/ */
+#define QUP_FW_ELF_FILE		"qupv3fw.elf"
+
+
 /**
  * struct geni_se_desc - Data structure to represent the QUP Wrapper resources
  * @clks:		Name of the primary & optional secondary AHB clocks
@@ -111,6 +116,15 @@
 static const char * const icc_path_names[] = {"qup-core", "qup-config",
 						"qup-memory"};
 
+static const char * const protocol_name[] = {
+	"None",
+	"SPI",
+	"UART",
+	"I2C",
+	"I3C",
+	"SPI SLAVE",
+};
+
 #define QUP_HW_VER_REG			0x4
 
 /* Common SE registers */
@@ -483,13 +497,14 @@
 }
 EXPORT_SYMBOL_GPL(geni_se_config_packing);
 
-static void geni_se_clks_off(struct geni_se *se)
+void geni_se_clks_off(struct geni_se *se)
 {
 	struct geni_wrapper *wrapper = se->wrapper;
 
 	clk_disable_unprepare(se->clk);
 	clk_bulk_disable_unprepare(wrapper->num_clks, wrapper->clks);
 }
+EXPORT_SYMBOL_GPL(geni_se_clks_off);
 
 /**
  * geni_se_resources_off() - Turn off resources associated with the serial
@@ -586,7 +601,8 @@
 
 	for (i = 0; i < MAX_CLK_PERF_LEVEL; i++) {
 		freq = clk_round_rate(se->clk, freq + 1);
-		if (freq <= 0 || freq == se->clk_perf_tbl[i - 1])
+		if (freq <= 0 ||
+		    (i > 0 && freq == se->clk_perf_tbl[i - 1]))
 			break;
 		se->clk_perf_tbl[i] = freq;
 	}
@@ -891,6 +907,443 @@
 }
 EXPORT_SYMBOL_GPL(geni_icc_disable);
 
+/**
+ * elf_phdr_valid: Function to validate elf header.
+ * @phdr: A pointer to a elf header.
+ *
+ * This function validates elf header by comparing fields
+ * stored in p_flags and payload type.
+ *
+ * return: true for success and false for failure/error case.
+ */
+static bool elf_phdr_valid(const struct elf32_phdr *phdr)
+{
+	if (phdr->p_type != PT_LOAD || !phdr->p_memsz)
+		return false;
+
+	if (phdr->p_type == PT_LOAD &&
+	    (MI_PBT_PAGE_MODE_VALUE(phdr->p_flags) == MI_PBT_NON_PAGED_SEGMENT) &&
+	    (MI_PBT_SEGMENT_TYPE_VALUE(phdr->p_flags) != MI_PBT_HASH_SEGMENT) &&
+	    (MI_PBT_ACCESS_TYPE_VALUE(phdr->p_flags) != MI_PBT_NOTUSED_SEGMENT) &&
+	    (MI_PBT_ACCESS_TYPE_VALUE(phdr->p_flags) != MI_PBT_SHARED_SEGMENT))
+		return true;
+
+	return false;
+}
+
+/**
+ * valid_seg_size: Function to validate segment size.
+ * @pelfseg: A pointer to a elf header.
+ * @p_filesz: A pointer to file size.
+ *
+ * This function validates elf segment size by comparing file size
+ *
+ * return: Return true if segment is valid and false if segment is invalid.
+ */
+static bool valid_seg_size(struct elf_se_hdr *pelfseg, Elf32_Word p_filesz)
+{
+	if (p_filesz >= pelfseg->fw_offset +
+			pelfseg->fw_size_in_items * sizeof(u32) &&
+	    p_filesz >= pelfseg->cfg_idx_offset +
+			pelfseg->cfg_size_in_items * sizeof(u8) &&
+	    p_filesz >= pelfseg->cfg_val_offset +
+			pelfseg->cfg_size_in_items * sizeof(u32))
+		return true;
+	return false;
+}
+
+/**
+ * read_elf: Function to read elf file.
+ * @rsc: A pointer to SE resources structure.
+ * @fw: A pointer to the fw buffer.
+ * @pelfseg: A pointer to SE specific elf header.
+ * @phdr: pointer to one of the valid headers from list from fw buffer.
+ *
+ * This function reads the ELF file and outputs the pointer to header
+ * data which contains the FW data and any other details.
+ *
+ * return: Return 0 if no error, else return error value.
+ */
+static int read_elf(struct qup_se_rsc *rsc, const struct firmware *fw,
+		    struct elf_se_hdr **pelfseg, struct elf32_phdr **phdr)
+{
+	int i, ret = -EINVAL;
+	const struct elf32_phdr *phdrs;
+	const struct elf32_hdr *ehdr;
+	const u8 *addr;
+
+	ehdr = (struct elf32_hdr *)fw->data;
+
+	if (ehdr->e_phnum < 2)
+		return -EINVAL;
+
+	phdrs = (struct elf32_phdr *)(ehdr + 1);
+
+	for (i = 0; i < ehdr->e_phnum; i++) {
+		*phdr = &phdrs[i];
+		if (!elf_phdr_valid(*phdr))
+			continue;
+
+		if ((*phdr)->p_filesz >= sizeof(struct elf_se_hdr)) {
+			addr =  fw->data + (*phdr)->p_offset;
+			*pelfseg = (struct elf_se_hdr *)addr;
+
+			if ((*pelfseg)->magic == MAGIC_NUM_SE &&
+			    (*pelfseg)->version == 1 &&
+			    valid_seg_size(*pelfseg, (*phdr)->p_filesz))
+				if ((*pelfseg)->serial_protocol == rsc->protocol &&
+				    (*pelfseg)->serial_protocol != GENI_SE_NONE)
+					return 0;
+		}
+	}
+	return ret;
+}
+
+/**
+ * geni_config_common_control: Function to configure common cgc
+ * and disable high priority interrupt.
+ * @rsc: A pointer to a structure representing SE related resources.
+ *
+ * This function configures cgc and disables high priority interrupt
+ * until current low priority interrupts are handled.
+ *
+ * return: None.
+ */
+static void geni_config_common_control(struct qup_se_rsc *rsc)
+{
+	/*
+	 * Disable high priority interrupt until current
+	 * low priority interrupts are handled.
+	 */
+	setbits32(rsc->se->wrapper->base + QUPV3_COMMON_CFG,
+		  FAST_SWITCH_TO_HIGH_DISABLE_BMASK);
+
+	/*
+	 * Set AHB_M_CLK_CGC_ON to indicate hardware controls
+	 * se-wrapper cgc clock.
+	 */
+	setbits32(rsc->se->wrapper->base + QUPV3_SE_AHB_M_CFG,
+		  AHB_M_CLK_CGC_ON_BMASK);
+
+	/* Let hardware to control common cgc. */
+	setbits32(rsc->se->wrapper->base + QUPV3_COMMON_CGC_CTRL,
+		  COMMON_CSR_SLV_CLK_CGC_ON_BMASK);
+}
+
+/**
+ * geni_configure_xfer_mode: Function to set transfer mode.
+ * @rsc: A pointer to a structure representing SE related resources.
+ *
+ * This function sets transfer mode FIFO or DMA according to mode
+ * specified by protocol driver..
+ *
+ * return: Return 0 if no error, else return error value.
+ */
+static int geni_configure_xfer_mode(struct qup_se_rsc *rsc)
+{
+	/* Configure SE FIFO, DMA or GSI mode. */
+	switch (rsc->mode) {
+	case GENI_GPI_DMA:
+		setbits32(rsc->se->base + QUPV3_SE_GENI_DMA_MODE_EN,
+			  GENI_DMA_MODE_EN_GENI_DMA_MODE_EN_BMSK);
+		writel_relaxed(0x0, rsc->se->base + SE_IRQ_EN);
+		writel_relaxed(SE_GSI_EVENT_EN_BMSK, rsc->se->base + SE_GSI_EVENT_EN);
+		break;
+
+	case GENI_SE_FIFO:
+		clrbits32(rsc->se->base + QUPV3_SE_GENI_DMA_MODE_EN,
+			  GENI_DMA_MODE_EN_GENI_DMA_MODE_EN_BMSK);
+		writel_relaxed(SE_IRQ_EN_RMSK, rsc->se->base + SE_IRQ_EN);
+		writel_relaxed(0x0, rsc->se->base + SE_GSI_EVENT_EN);
+		break;
+
+	case GENI_SE_DMA:
+		setbits32(rsc->se->base + QUPV3_SE_GENI_DMA_MODE_EN,
+			  GENI_DMA_MODE_EN_GENI_DMA_MODE_EN_BMSK);
+		writel_relaxed(SE_IRQ_EN_RMSK, rsc->se->base + SE_IRQ_EN);
+		writel_relaxed(0x0, rsc->se->base + SE_GSI_EVENT_EN);
+		break;
+
+	default:
+		dev_err(rsc->se->dev, "invalid se mode: %d\n", rsc->mode);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+/**
+ * geni_enable_interrupts: Function to enable interrupts
+ * @rsc: A pointer to a structure representing SE related resources.
+ *
+ * This function enables required interrupt during firmware load process.
+ *
+ * return: None.
+ */
+static void geni_enable_interrupts(struct qup_se_rsc *rsc)
+{
+	u32 reg_value;
+
+	/* Enable required interrupts. */
+	writel_relaxed(M_COMMON_GENI_M_IRQ_EN, rsc->se->base + GENI_M_IRQ_ENABLE);
+
+	reg_value = S_CMD_OVERRUN_EN | S_ILLEGAL_CMD_EN |
+				S_CMD_CANCEL_EN | S_CMD_ABORT_EN |
+				S_GP_IRQ_0_EN | S_GP_IRQ_1_EN |
+				S_GP_IRQ_2_EN | S_GP_IRQ_3_EN |
+				S_RX_FIFO_WR_ERR_EN | S_RX_FIFO_RD_ERR_EN;
+	writel_relaxed(reg_value, rsc->se->base + GENI_S_IRQ_ENABLE);
+
+	/* DMA mode configuration. */
+	reg_value = DMA_TX_IRQ_EN_SET_RESET_DONE_EN_SET_BMSK |
+		    DMA_TX_IRQ_EN_SET_SBE_EN_SET_BMSK |
+		    DMA_TX_IRQ_EN_SET_DMA_DONE_EN_SET_BMSK;
+	writel_relaxed(reg_value, rsc->se->base + DMA_TX_IRQ_EN_SET);
+	reg_value = DMA_RX_IRQ_EN_SET_FLUSH_DONE_EN_SET_BMSK |
+		    DMA_RX_IRQ_EN_SET_RESET_DONE_EN_SET_BMSK |
+		    DMA_RX_IRQ_EN_SET_SBE_EN_SET_BMSK |
+		    DMA_RX_IRQ_EN_SET_DMA_DONE_EN_SET_BMSK;
+	writel_relaxed(reg_value, rsc->se->base + DMA_RX_IRQ_EN_SET);
+}
+
+/**
+ * geni_flash_fw_revision: Function to flash revision
+ * @rsc: A pointer to a structure representing SE related resources.
+ * @hdr: A pointer to ELF header of Serial Engine.
+ * This function flash firmware revision and protocol in respective register.
+ *
+ * return: None.
+ */
+static void geni_flash_fw_revision(struct qup_se_rsc *rsc, struct elf_se_hdr *hdr)
+{
+	u32 reg_value;
+
+	/* Flash firmware revision register. */
+	reg_value = (hdr->serial_protocol << FW_REV_PROTOCOL_SHFT) |
+		    (hdr->fw_version & 0xFF << FW_REV_VERSION_SHFT);
+	writel_relaxed(reg_value, rsc->se->base + SE_GENI_FW_REVISION);
+
+	reg_value = (hdr->serial_protocol << FW_REV_PROTOCOL_SHFT) |
+		    (hdr->fw_version & 0xFF << FW_REV_VERSION_SHFT);
+
+	writel_relaxed(reg_value, rsc->se->base + SE_S_FW_REVISION);
+}
+/**
+ * geni_load_se_fw: Function to load serial engine specific firmware
+ * @rsc: A pointer to a structure representing SE related resources.
+ * @fw: A pointer to Firmware structure.
+ *
+ * This function loads the protocol FW at the IRAM of the SE.
+ *
+ * return: Return 0 if no error, else return error value.
+ */
+static int geni_load_se_fw(struct qup_se_rsc *rsc, const struct firmware *fw)
+{
+	const u32 *fw_val_arr, *cfg_val_arr;
+	const u8 *cfg_idx_arr;
+	u32 i, reg_value, mask, ramn_cnt;
+	int ret = 0;
+	struct elf_se_hdr *hdr;
+	struct elf32_phdr *phdr;
+
+	ret = geni_icc_set_bw(rsc->se);
+	if (ret) {
+		dev_err(rsc->se->dev, "%s:Failed to set ICC BW %d\n",  __func__, ret);
+		return ret;
+	}
+
+	ret = geni_icc_enable(rsc->se);
+	if (ret) {
+		dev_err(rsc->se->dev, "%s:Failed to enable ICC %d\n",  __func__, ret);
+		return ret;
+	}
+
+	ret =  geni_se_resources_on(rsc->se);
+	if (ret) {
+		dev_err(rsc->se->dev, "%s:Failed to enable common clocks %d\n",  __func__, ret);
+		goto err;
+	}
+
+	ret = read_elf(rsc, fw, &hdr, &phdr);
+	if (ret) {
+		dev_err(rsc->se->dev, "%s: Error %d elf parsing failed\n",  __func__, ret);
+		goto err;
+	}
+
+	fw_val_arr = (const u32 *)((u8 *)hdr + hdr->fw_offset);
+	cfg_idx_arr = (const u8 *)hdr + hdr->cfg_idx_offset;
+	cfg_val_arr = (const u32 *)((u8 *)hdr + hdr->cfg_val_offset);
+
+	geni_config_common_control(rsc);
+
+	/* Allows to drive corresponding data according to hardware value. */
+	writel_relaxed(0x0, rsc->se->base + GENI_OUTPUT_CTRL);
+
+	/* Set SCLK and HCLK to program RAM */
+	setbits32(rsc->se->base + GENI_CGC_CTRL, GENI_CGC_CTRL_PROG_RAM_SCLK_OFF_BMSK
+			| GENI_CGC_CTRL_PROG_RAM_HCLK_OFF_BMSK);
+	writel_relaxed(0x0, rsc->se->base + SE_GENI_CLK_CTRL);
+	clrbits32(rsc->se->base + GENI_CGC_CTRL, GENI_CGC_CTRL_PROG_RAM_SCLK_OFF_BMSK
+			| GENI_CGC_CTRL_PROG_RAM_HCLK_OFF_BMSK);
+
+	/* Enable required clocks for DMA CSR, TX and RX. */
+	reg_value |= DMA_GENERAL_CFG_AHB_SEC_SLV_CLK_CGC_ON_BMSK |
+		       DMA_GENERAL_CFG_DMA_AHB_SLV_CLK_CGC_ON_BMSK |
+		       DMA_GENERAL_CFG_DMA_TX_CLK_CGC_ON_BMSK |
+		       DMA_GENERAL_CFG_DMA_RX_CLK_CGC_ON_BMSK;
+
+	setbits32(rsc->se->base + DMA_GENERAL_CFG, reg_value);
+
+	/* Let hardware to control CGC by default. */
+	writel_relaxed(DEFAULT_CGC_EN, rsc->se->base + GENI_CGC_CTRL);
+
+	/* Set version of the configuration register part of firmware. */
+	writel_relaxed(hdr->cfg_version, rsc->se->base + GENI_INIT_CFG_REVISION);
+	writel_relaxed(hdr->cfg_version, rsc->se->base + GENI_S_INIT_CFG_REVISION);
+
+	/* Configure geni primitive table. */
+	for (i = 0; i < hdr->cfg_size_in_items; i++)
+		writel_relaxed(cfg_val_arr[i], rsc->se->base +
+			       GENI_CFG_REG0 + (cfg_idx_arr[i] * sizeof(u32)));
+
+	/* Configure condition for assertion of RX_RFR_WATERMARK condition. */
+	reg_value = readl_relaxed(rsc->se->base + QUPV3_SE_HW_PARAM_1);
+	mask = (reg_value >> RX_FIFO_WIDTH_BIT) & RX_FIFO_WIDTH_MASK;
+	writel_relaxed(mask - 2, rsc->se->base + GENI_RX_RFR_WATERMARK_REG);
+
+	/* Let hardware to control CGC */
+	setbits32(rsc->se->base + GENI_OUTPUT_CTRL, DEFAULT_IO_OUTPUT_CTRL_MSK);
+
+	ret = geni_configure_xfer_mode(rsc);
+	if (ret)
+		goto err_resource;
+
+	geni_enable_interrupts(rsc);
+
+	geni_flash_fw_revision(rsc, hdr);
+
+	ramn_cnt = hdr->fw_size_in_items;
+	if (hdr->fw_size_in_items % 2 != 0)
+		ramn_cnt++;
+
+	if (ramn_cnt >= MAX_GENI_CFG_RAMn_CNT)
+		goto err_resource;
+
+	/* Program RAM address space. */
+	memcpy((rsc->se->base + SE_GENI_CFG_RAMN), fw_val_arr,
+	       ramn_cnt * sizeof(u32));
+
+	/* Put default values on GENI's output pads. */
+	writel_relaxed(0x1, rsc->se->base + GENI_FORCE_DEFAULT_REG);
+
+	/* High to low SCLK and HCLK to finish RAM. */
+	setbits32(rsc->se->base + GENI_CGC_CTRL, GENI_CGC_CTRL_PROG_RAM_SCLK_OFF_BMSK
+				| GENI_CGC_CTRL_PROG_RAM_HCLK_OFF_BMSK);
+	setbits32(rsc->se->base + SE_GENI_CLK_CTRL, GENI_CLK_CTRL_SER_CLK_SEL_BMSK);
+	clrbits32(rsc->se->base + GENI_CGC_CTRL,
+		  (GENI_CGC_CTRL_PROG_RAM_SCLK_OFF_BMSK |
+		   GENI_CGC_CTRL_PROG_RAM_HCLK_OFF_BMSK));
+
+	/* Serial engine DMA interface is enabled. */
+	setbits32(rsc->se->base + SE_DMA_IF_EN,
+		  DMA_IF_EN_DMA_IF_EN_BMSK);
+
+	/* Enable or disable FIFO interface of the serial engine. */
+	if (rsc->mode == GENI_SE_FIFO)
+		clrbits32(rsc->se->base + SE_FIFO_IF_DISABLE, FIFO_IF_DISABLE);
+	else
+		setbits32(rsc->se->base + SE_FIFO_IF_DISABLE, FIFO_IF_DISABLE);
+
+err_resource:
+	geni_se_resources_off(rsc->se);
+err:
+	geni_icc_disable(rsc->se);
+	return ret;
+}
+
+/**
+ * qup_fw_load: Function to initiate firmware load
+ * @rsc: A pointer to a structure representing SE related resources.
+ *
+ * This function is called for loading the firmware into a particular
+ * SE. This is achieved by reading the associated ELF file, copying
+ * the data in the ELF file into buffer in kernel space using
+ * request_firmware API's. The data is then written in the SE's
+ * IRAM register and the buffers are freed after.  Overall, this
+ * function handles firmware loading and parsing for a specific protocol.
+ *
+ * return: Return 0 if no error, else return error value.
+ */
+int qup_fw_load(struct qup_se_rsc *rsc)
+{
+	int ret;
+	const struct firmware *fw;
+	struct device *dev = rsc->se->dev;
+
+	ret = request_firmware(&fw, QUP_FW_ELF_FILE, dev);
+	if (ret) {
+		dev_err(dev, "request_firmware failed for %d: %d\n", rsc->protocol, ret);
+		return ret;
+	}
+
+	ret = (rsc->protocol != GENI_SE_NONE) ? geni_load_se_fw(rsc, fw) : -EINVAL;
+
+	release_firmware(fw);
+
+	return ret;
+}
+
+/**
+ * geni_load_se_firmware: Function to initiate firmware loading.
+ * @se: Serial engine details.
+ * @protocol: protocol from spi, i2c or uart for which firmware to
+ * be loaded
+ *
+ * This function is called from the probe function of protocol driver.
+ * if dtsi properties are configured to load QUP firmware and firmware
+ * is already not loaded, it will start firmware loading. if dtsi
+ * properties are not defined,it will skip loading firmware assuming
+ * it is already loaded by TZ.
+ *
+ * return: Return 0 if no error, else return error value.
+ */
+int geni_load_se_firmware(struct geni_se *se,
+			  enum geni_se_protocol_type protocol)
+{
+	struct qup_se_rsc rsc;
+	int ret;
+
+	if (device_property_read_bool(se->dev, "qcom,load-firmware")) {
+		rsc.se = se;
+		rsc.protocol = protocol;
+
+		/* Set default xfer mode to FIFO*/
+		rsc.mode = GENI_SE_FIFO;
+		of_property_read_u32(se->dev->of_node, "qcom,xfer-mode", &rsc.mode);
+		switch (rsc.mode) {
+		case GENI_SE_FIFO:
+		case GENI_SE_DMA:
+		case GENI_GPI_DMA:
+			break;
+		default:
+			dev_err(se->dev, "Invalid xfer mode specified: %d\n", rsc.mode);
+			return -EINVAL;
+		}
+
+		ret = qup_fw_load(&rsc);
+		if (ret) {
+			dev_err(se->dev,  "Firmware Loading failed for proto: %s Error: %d\n",
+				protocol_name[rsc.protocol], ret);
+			return ret;
+		}
+
+		dev_info(se->dev, "Firmware load for %s protocol is Success for xfer mode %d\n",
+			 protocol_name[rsc.protocol], rsc.mode);
+		return ret;
+	}
+	return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(geni_load_se_firmware);
+
 static int geni_se_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -914,7 +1367,7 @@
 		if (!desc)
 			return -EINVAL;
 
-		wrapper->num_clks = min_t(unsigned int, desc->num_clks, MAX_CLKS);
+		wrapper->num_clks = min_t(unsigned int, desc->num_clks, MAX_SE_CLKS);
 
 		for (i = 0; i < wrapper->num_clks; ++i)
 			wrapper->clks[i].id = desc->clks[i];
@@ -980,3 +1433,4 @@
 
 MODULE_DESCRIPTION("GENI Serial Engine Driver");
 MODULE_LICENSE("GPL v2");
+MODULE_FIRMWARE(QUP_FW_ELF_FILE);
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/qcom_aoss.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/qcom_aoss.c
@@ -3,6 +3,7 @@
  * Copyright (c) 2019, Linaro Ltd
  */
 #include <linux/clk-provider.h>
+#include <linux/debugfs.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/mailbox_client.h>
@@ -13,6 +14,9 @@
 #include <linux/slab.h>
 #include <linux/soc/qcom/qcom_aoss.h>
 
+#define CREATE_TRACE_POINTS
+#include "trace-aoss.h"
+
 #define QMP_DESC_MAGIC			0x0
 #define QMP_DESC_VERSION		0x4
 #define QMP_DESC_FEATURES		0x8
@@ -44,6 +48,8 @@
 
 #define QMP_NUM_COOLING_RESOURCES	2
 
+#define QMP_DEBUGFS_FILES		4
+
 static bool qmp_cdev_max_state = 1;
 
 struct qmp_cooling_device {
@@ -82,6 +88,8 @@
 
 	struct clk_hw qdss_clk;
 	struct qmp_cooling_device *cooling_devs;
+	struct dentry *debugfs_root;
+	struct dentry *debugfs_files[QMP_DEBUGFS_FILES];
 };
 
 static void qmp_kick(struct qmp *qmp)
@@ -235,6 +243,8 @@
 
 	mutex_lock(&qmp->tx_lock);
 
+	trace_aoss_send(buf);
+
 	/* The message RAM only implements 32-bit accesses */
 	__iowrite32_copy(qmp->msgram + qmp->offset + sizeof(u32),
 			 buf, sizeof(buf) / sizeof(u32));
@@ -256,6 +266,8 @@
 		ret = 0;
 	}
 
+	trace_aoss_send_done(buf, ret);
+
 	mutex_unlock(&qmp->tx_lock);
 
 	return ret;
@@ -475,6 +487,91 @@
 }
 EXPORT_SYMBOL_GPL(qmp_put);
 
+struct qmp_debugfs_entry {
+	const char *name;
+	const char *fmt;
+	bool is_bool;
+	const char *true_val;
+	const char *false_val;
+};
+
+static const struct qmp_debugfs_entry qmp_debugfs_entries[QMP_DEBUGFS_FILES] = {
+	{ "ddr_frequency_mhz", "{class: ddr, res: fixed, val: %u}", false },
+	{ "prevent_aoss_sleep", "{class: aoss_slp, res: sleep: %s}", true, "enable", "disable" },
+	{ "prevent_cx_collapse", "{class: cx_mol, res: cx, val: %s}", true, "mol", "off" },
+	{ "prevent_ddr_collapse", "{class: ddr_mol, res: ddr, val: %s}", true, "mol", "off" },
+};
+
+static ssize_t qmp_debugfs_write(struct file *file, const char __user *user_buf,
+			size_t count, loff_t *pos)
+{
+	const struct qmp_debugfs_entry *entry = NULL;
+	struct qmp *qmp = file->private_data;
+	char buf[QMP_MSG_LEN];
+	unsigned int uint_val;
+	const char *str_val;
+	bool bool_val;
+	int ret;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(qmp->debugfs_files); i++) {
+		if (qmp->debugfs_files[i] == file->f_path.dentry) {
+			entry = &qmp_debugfs_entries[i];
+			break;
+		}
+	}
+	if (WARN_ON(!entry))
+		return -EFAULT;
+
+	if (entry->is_bool) {
+		ret = kstrtobool_from_user(user_buf, count, &bool_val);
+		if (ret)
+			return ret;
+
+		str_val = bool_val ? entry->true_val : entry->false_val;
+
+		ret = snprintf(buf, sizeof(buf), entry->fmt, str_val);
+		if (ret >= sizeof(buf))
+			return -EINVAL;
+	} else {
+		ret = kstrtou32_from_user(user_buf, count, 0, &uint_val);
+		if (ret)
+			return ret;
+
+		ret = snprintf(buf, sizeof(buf), entry->fmt, uint_val);
+		if (ret >= sizeof(buf))
+			return -EINVAL;
+	}
+
+	ret = qmp_send(qmp, buf);
+	if (ret < 0)
+		return ret;
+
+	return count;
+}
+
+static const struct file_operations qmp_debugfs_fops = {
+	.open = simple_open,
+	.write = qmp_debugfs_write,
+};
+
+static void qmp_debugfs_create(struct qmp *qmp)
+{
+	const struct qmp_debugfs_entry *entry;
+	int i;
+
+	qmp->debugfs_root = debugfs_create_dir("qcom_aoss", NULL);
+
+	for (i = 0; i < ARRAY_SIZE(qmp->debugfs_files); i++) {
+		entry = &qmp_debugfs_entries[i];
+
+		qmp->debugfs_files[i] = debugfs_create_file(entry->name, 0220,
+			qmp->debugfs_root,
+			qmp,
+			&qmp_debugfs_fops);
+	}
+}
+
 static int qmp_probe(struct platform_device *pdev)
 {
 	struct qmp *qmp;
@@ -523,6 +620,8 @@
 
 	platform_set_drvdata(pdev, qmp);
 
+	qmp_debugfs_create(qmp);
+
 	return 0;
 
 err_close_qmp:
@@ -537,6 +636,8 @@
 {
 	struct qmp *qmp = platform_get_drvdata(pdev);
 
+	debugfs_remove_recursive(qmp->debugfs_root);
+
 	qmp_qdss_clk_remove(qmp);
 	qmp_cooling_devices_remove(qmp);
 
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/qcom_soc_debug.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/qcom_soc_debug.c
@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/of_address.h>
+#include <linux/panic_notifier.h>
+#include <soc/qcom/wdt_core.h>
+
+#include <asm/virt.h>
+
+#define KASLR_IMEM_ADDR_NAME	"qcom,msm-imem-kaslr_offset"
+#define KASLR_IMEM_MAGIC	0xdead4ead
+#define KASLR_OFFSET_MASK	0x00000000FFFFFFFF
+
+struct notifier_block panic_notifier;
+
+static int panic_handler(struct notifier_block *this,
+			      unsigned long event, void *ptr)
+{
+	pr_info("Triggering bite\n");
+	qcom_wdt_trigger_bite();
+	return NOTIFY_DONE;
+}
+
+static void __iomem *get_iomap_addr(const char *prop_name)
+{
+	struct device_node *node;
+	void __iomem *ioaddr;
+
+	node = of_find_compatible_node(NULL, NULL, prop_name);
+	if (!node) {
+		pr_err("DT property - read error: %s\n", prop_name);
+		return NULL;
+	}
+
+	ioaddr = of_iomap(node, 0);
+	if (!ioaddr)
+		pr_err("DT property - map fail: %s\n", prop_name);
+
+	return ioaddr;
+}
+
+static void store_kaslr_offset(void)
+{
+	void __iomem *imem_kaslr_addr = get_iomap_addr(KASLR_IMEM_ADDR_NAME);
+
+	if (!imem_kaslr_addr)
+		return;
+
+	__raw_writel(KASLR_IMEM_MAGIC, imem_kaslr_addr);
+	__raw_writel(kaslr_offset() & KASLR_OFFSET_MASK,
+		     imem_kaslr_addr + 4);
+	__raw_writel((kaslr_offset() >> 32) & KASLR_OFFSET_MASK,
+		     imem_kaslr_addr + 8);
+
+	iounmap(imem_kaslr_addr);
+}
+
+static void update_soc_wdt_node(void)
+{
+	struct device_node *soc_wdt;
+	struct property *newprop;
+	const char *status_string;
+	int ret;
+
+
+	/*
+	 * The watchdog is emulated by gunyah hypervisor on some targets. The below
+	 * status flipping is not needed on these targets. Both KVM and Gunyah hypervisor
+	 * configurations use SoC WDT.
+	 */
+
+	soc_wdt = of_find_compatible_node(NULL, NULL, "qcom,apss-wdt-sc7280");
+	if (!soc_wdt)
+		return;
+
+	/*
+	 * If Linux is not booted in hyp mode, assume that Gunyah is active
+	 * and removed SoC watchdog I/O access to Linux. Disable SoC
+	 * watchdog device node by marking it "reserved", otherwise enable it.
+	 */
+
+	if (is_hyp_mode_available())
+		status_string = "okay";
+	else
+		status_string = "reserved";
+
+	/* Disable the node by flipping the status to disabled */
+	newprop = kzalloc(sizeof(*newprop), GFP_KERNEL);
+	if (!newprop)
+		goto put_node;
+
+	newprop->name = kstrdup("status", GFP_KERNEL);
+	if (!newprop->name)
+		goto free_prop;
+
+	newprop->value = kstrdup(status_string, GFP_KERNEL);
+	if (!newprop->value)
+		goto free_prop;
+
+	newprop->length = strlen(status_string) + 1;
+	ret = of_update_property(soc_wdt, newprop);
+	if (ret) {
+		pr_err("Failed to update SoC watchdog node with err %d\n", ret);
+		goto free_prop;
+	}
+
+	/* newprop has references in dt structures, so don't free it */
+	of_node_put(soc_wdt);
+	return;
+free_prop:
+	kfree(newprop->value);
+	kfree(newprop->name);
+	kfree(newprop);
+put_node:
+	of_node_put(soc_wdt);
+}
+
+static int __init qcom_soc_debug_init(void)
+{
+	store_kaslr_offset();
+	update_soc_wdt_node();
+
+	panic_notifier.priority = INT_MAX - 1;
+	panic_notifier.notifier_call = panic_handler;
+	atomic_notifier_chain_register(&panic_notifier_list,
+				       &panic_notifier);
+	return 0;
+}
+pure_initcall(qcom_soc_debug_init);
+
+MODULE_DESCRIPTION("QCOM SOC Debug Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/qcom_stats.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/qcom_stats.c
@@ -35,11 +35,15 @@
 	{ "wpss", 605, 13 },
 	{ "adsp", 606, 2 },
 	{ "cdsp", 607, 5 },
+	{ "cdsp1", 607, 12 },
+	{ "gpdsp0", 607, 17 },
+	{ "gpdsp1", 607, 18 },
 	{ "slpi", 608, 3 },
 	{ "gpu", 609, 0 },
 	{ "display", 610, 0 },
 	{ "adsp_island", 613, 2 },
 	{ "slpi_island", 613, 3 },
+	{ "apss", 631, QCOM_SMEM_HOST_ANY },
 };
 
 struct stats_config {
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/qmi_encdec.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/qmi_encdec.c
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
  * Copyright (C) 2017 Linaro Ltd.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/slab.h>
 #include <linux/uaccess.h>
@@ -427,6 +428,7 @@
  * @buf_src: Buffer containing the elements in QMI wire format.
  * @elem_len: Number of elements to be decoded.
  * @elem_size: Size of a single instance of the element to be decoded.
+ * @src_len: Source buffer length.
  *
  * This function decodes the "elem_len" number of elements in QMI wire format,
  * each of size "elem_size" bytes from the source buffer "buf_src" and stores
@@ -437,10 +439,13 @@
  * Return: The total size of the decoded data elements, in bytes.
  */
 static int qmi_decode_basic_elem(void *buf_dst, const void *buf_src,
-				 u32 elem_len, u32 elem_size)
+				 u32 elem_len, u32 elem_size, u32 src_len)
 {
 	u32 i, rc = 0;
 
+	if (elem_len * elem_size > src_len)
+		return -EINVAL;
+
 	for (i = 0; i < elem_len; i++) {
 		QMI_ENCDEC_DECODE_N_BYTES(buf_dst, buf_src, elem_size);
 		rc += elem_size;
@@ -458,6 +463,7 @@
  * @tlv_len: Total size of the encoded information corresponding to
  *           this struct element.
  * @dec_level: Depth of the nested structure from the main structure.
+ * @src_len: Source buffer length.
  *
  * This function decodes the "elem_len" number of elements in QMI wire format,
  * each of size "(tlv_len/elem_len)" bytes from the source buffer "buf_src"
@@ -471,16 +477,20 @@
 static int qmi_decode_struct_elem(const struct qmi_elem_info *ei_array,
 				  void *buf_dst, const void *buf_src,
 				  u32 elem_len, u32 tlv_len,
-				  int dec_level)
+				  int dec_level, u32 src_len)
 {
 	int i, rc, decoded_bytes = 0;
 	const struct qmi_elem_info *temp_ei = ei_array;
 
+	if (tlv_len > src_len)
+		return -EINVAL;
+
 	for (i = 0; i < elem_len && decoded_bytes < tlv_len; i++) {
 		rc = qmi_decode(temp_ei->ei_array, buf_dst, buf_src,
 				tlv_len - decoded_bytes, dec_level);
 		if (rc < 0)
 			return rc;
+
 		buf_src = buf_src + rc;
 		buf_dst = buf_dst + temp_ei->elem_size;
 		decoded_bytes += rc;
@@ -505,6 +515,7 @@
  * @tlv_len: Total size of the encoded information corresponding to
  *           this string element.
  * @dec_level: Depth of the string element from the main structure.
+ * @src_len: Source buffer length.
  *
  * This function decodes the string element of maximum length
  * "ei_array->elem_len" from the source buffer "buf_src" and puts it into
@@ -516,7 +527,7 @@
  */
 static int qmi_decode_string_elem(const struct qmi_elem_info *ei_array,
 				  void *buf_dst, const void *buf_src,
-				  u32 tlv_len, int dec_level)
+				  u32 tlv_len, int dec_level, u32 src_len)
 {
 	int rc;
 	int decoded_bytes = 0;
@@ -530,7 +541,10 @@
 		string_len_sz = temp_ei->elem_len <= U8_MAX ?
 				sizeof(u8) : sizeof(u16);
 		rc = qmi_decode_basic_elem(&string_len, buf_src,
-					   1, string_len_sz);
+					   1, string_len_sz, src_len);
+		if (rc < 0)
+			return rc;
+
 		decoded_bytes += rc;
 	}
 
@@ -545,7 +559,11 @@
 	}
 
 	rc = qmi_decode_basic_elem(buf_dst, buf_src + decoded_bytes,
-				   string_len, temp_ei->elem_size);
+				   string_len, temp_ei->elem_size,
+				   src_len - decoded_bytes);
+	if (rc < 0)
+		return rc;
+
 	*((char *)buf_dst + string_len) = '\0';
 	decoded_bytes += rc;
 
@@ -611,6 +629,9 @@
 
 		if (dec_level == 1) {
 			tlv_pointer = buf_src;
+			if (decoded_bytes + TLV_TYPE_SIZE + TLV_LEN_SIZE > in_buf_len)
+				return -EINVAL;
+
 			QMI_ENCDEC_DECODE_TLV(&tlv_type,
 					      &tlv_len, tlv_pointer);
 			buf_src += (TLV_TYPE_SIZE + TLV_LEN_SIZE);
@@ -643,7 +664,11 @@
 			data_len_sz = temp_ei->elem_size == sizeof(u8) ?
 					sizeof(u8) : sizeof(u16);
 			rc = qmi_decode_basic_elem(&data_len_value, buf_src,
-						   1, data_len_sz);
+						   1, data_len_sz,
+						   in_buf_len - decoded_bytes);
+			if (rc < 0)
+				return rc;
+
 			memcpy(buf_dst, &data_len_value, sizeof(u32));
 			temp_ei = temp_ei + 1;
 			buf_dst = out_c_struct + temp_ei->offset;
@@ -670,24 +695,32 @@
 		case QMI_SIGNED_4_BYTE_ENUM:
 			rc = qmi_decode_basic_elem(buf_dst, buf_src,
 						   data_len_value,
-						   temp_ei->elem_size);
+						   temp_ei->elem_size,
+						   in_buf_len - decoded_bytes);
+			if (rc < 0)
+				return rc;
+
 			UPDATE_DECODE_VARIABLES(buf_src, decoded_bytes, rc);
 			break;
 
 		case QMI_STRUCT:
 			rc = qmi_decode_struct_elem(temp_ei, buf_dst, buf_src,
 						    data_len_value, tlv_len,
-						    dec_level + 1);
+						    dec_level + 1,
+						    in_buf_len - decoded_bytes);
 			if (rc < 0)
 				return rc;
+
 			UPDATE_DECODE_VARIABLES(buf_src, decoded_bytes, rc);
 			break;
 
 		case QMI_STRING:
 			rc = qmi_decode_string_elem(temp_ei, buf_dst, buf_src,
-						    tlv_len, dec_level);
+						    tlv_len, dec_level,
+						    in_buf_len - decoded_bytes);
 			if (rc < 0)
 				return rc;
+
 			UPDATE_DECODE_VARIABLES(buf_src, decoded_bytes, rc);
 			break;
 
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/rpmh-rsc.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/rpmh-rsc.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #define pr_fmt(fmt) "%s " fmt, KBUILD_MODNAME
@@ -557,7 +558,7 @@
 		for_each_set_bit(j, &curr_enabled, MAX_CMDS_PER_TCS) {
 			addr = read_tcs_cmd(drv, drv->regs[RSC_DRV_CMD_ADDR], i, j);
 			for (k = 0; k < msg->num_cmds; k++) {
-				if (addr == msg->cmds[k].addr)
+				if (cmd_db_match_resource_addr(msg->cmds[k].addr, addr))
 					return -EBUSY;
 			}
 		}
@@ -645,13 +646,14 @@
 {
 	struct tcs_group *tcs;
 	int tcs_id;
-	unsigned long flags;
+
+	might_sleep();
 
 	tcs = get_tcs_for_msg(drv, msg);
 	if (IS_ERR(tcs))
 		return PTR_ERR(tcs);
 
-	spin_lock_irqsave(&drv->lock, flags);
+	spin_lock_irq(&drv->lock);
 
 	/* Wait forever for a free tcs. It better be there eventually! */
 	wait_event_lock_irq(drv->tcs_wait,
@@ -669,7 +671,7 @@
 		write_tcs_reg_sync(drv, drv->regs[RSC_DRV_CMD_ENABLE], tcs_id, 0);
 		enable_tcs_irq(drv, tcs_id, true);
 	}
-	spin_unlock_irqrestore(&drv->lock, flags);
+	spin_unlock_irq(&drv->lock);
 
 	/*
 	 * These two can be done after the lock is released because:
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/rpmh.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/rpmh.c
@@ -183,7 +183,6 @@
 	}
 
 	if (state == RPMH_ACTIVE_ONLY_STATE) {
-		WARN_ON(irqs_disabled());
 		ret = rpmh_rsc_send_data(ctrlr_to_drv(ctrlr), &rpm_msg->msg);
 	} else {
 		/* Clean up our call by spoofing tx_done */
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/secure_buffer.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/secure_buffer.c
@@ -0,0 +1,707 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2011 Google, Inc
+ * Copyright (c) 2011-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/highmem.h>
+#include <linux/kernel.h>
+#include <linux/kref.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <soc/qcom/secure_buffer.h>
+
+#define CREATE_TRACE_POINTS
+#include "trace_secure_buffer.h"
+
+#include <linux/stackdepot.h>
+
+
+#define BATCH_MAX_SIZE SZ_2M
+#define BATCH_MAX_SECTIONS 32
+
+#define HLOS_DEST_ARR_SIZE 1
+
+static struct device *qcom_secure_buffer_dev;
+static bool vmid_cp_camera_preview_ro;
+
+struct hyp_assign_debug_track {
+	depot_stack_handle_t hdl;
+	int vmids[10];
+	int perms[10];
+	int nr_acl_entries;
+	u32 refcount;
+};
+
+#if IS_ENABLED(CONFIG_HYP_ASSIGN_DEBUG)
+/*
+ * Contains a pointer to struct hyp_assign_debug_track for each pfn which
+ * is in an assigned state.
+ */
+static DEFINE_XARRAY(xa_pfns);
+static DEFINE_MUTEX(xarray_lock);
+static depot_stack_handle_t failure_handle;
+#define HYP_ASSIGN_STACK_DEPTH (16)
+
+static depot_stack_handle_t create_dummy_stack(void)
+{
+	unsigned long entries[4];
+	unsigned int nr_entries;
+
+	nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 0);
+	return stack_depot_save(entries, nr_entries, GFP_KERNEL);
+}
+
+static void hyp_assign_show_err(const char *msg, unsigned long pfn,
+			struct hyp_assign_debug_track *track)
+{
+	int i;
+	unsigned long *stack_entries;
+	unsigned int nr_stack_entries;
+
+	pr_err("HYP_ASSIGN_DEBUG: %s pfn=0x%llx\n", msg, pfn);
+	if (!track)
+		goto out;
+	pr_err("currently assigned to:\n");
+	nr_stack_entries = stack_depot_fetch(track->hdl, &stack_entries);
+	stack_trace_print(stack_entries, nr_stack_entries, 0);
+
+	for (i = 0; i < track->nr_acl_entries; i++) {
+		pr_err("VMID: %d %s%s%s\n",
+			track->vmids[i],
+			track->perms[i] & PERM_READ ? "R" : " ",
+			track->perms[i] & PERM_WRITE ? "W" : " ",
+			track->perms[i] & PERM_EXEC ? "X" : " ");
+	}
+
+out:
+	BUG();
+}
+
+static struct hyp_assign_debug_track *
+alloc_debug_tracking(int *dst_vmids, int *dst_perms, int dest_nelems)
+{
+	unsigned long stack_entries[HYP_ASSIGN_STACK_DEPTH];
+	u32 nr_stack_entries;
+	struct hyp_assign_debug_track *track;
+	u32 nr_acl_entries;
+
+	track = kzalloc(sizeof(*track), GFP_KERNEL);
+	if (!track)
+		return NULL;
+
+	nr_acl_entries = min_t(u32, dest_nelems, ARRAY_SIZE(track->vmids));
+	track->nr_acl_entries = nr_acl_entries;
+	memcpy(track->vmids, dst_vmids, nr_acl_entries * sizeof(*dst_vmids));
+	memcpy(track->perms, dst_perms, nr_acl_entries * sizeof(*dst_perms));
+
+	nr_stack_entries = stack_trace_save(stack_entries, ARRAY_SIZE(stack_entries), 2);
+	track->hdl = stack_depot_save(stack_entries, nr_stack_entries, GFP_KERNEL);
+	if (!track->hdl)
+		track->hdl = failure_handle;
+
+	track->refcount = 1;
+	return track;
+}
+
+/* caller holds xarray_lock */
+static void get_track(struct hyp_assign_debug_track *track)
+{
+	track->refcount++;
+}
+
+/* caller holds xarray_lock */
+static void put_track(struct hyp_assign_debug_track *track)
+{
+	if (!track)
+		return;
+
+	track->refcount--;
+	if (!track->refcount)
+		kfree(track);
+}
+
+static bool is_reclaim(struct qcom_scm_current_perm_info *newvms, size_t newvms_sz)
+{
+	int vmid;
+	int perm;
+
+	vmid = le32_to_cpu(newvms->vmid);
+	perm = le32_to_cpu(newvms->perm);
+	return (newvms_sz == sizeof(*newvms)) &&
+		(vmid == VMID_HLOS) &&
+		(perm == (PERM_READ | PERM_WRITE | PERM_EXEC));
+}
+
+static void check_debug_tracking(struct qcom_scm_mem_map_info *mem_regions,
+				size_t mem_regions_sz,
+				struct qcom_scm_current_perm_info *newvms,
+				size_t newvms_sz)
+{
+	struct qcom_scm_mem_map_info *p, *mem_regions_end;
+	unsigned long pfn;
+	bool reclaim = is_reclaim(newvms, newvms_sz);
+	struct hyp_assign_debug_track *track;
+
+	mem_regions_end = mem_regions + mem_regions_sz/sizeof(*mem_regions);
+
+	mutex_lock(&xarray_lock);
+	for (p = mem_regions; p < mem_regions_end; p++) {
+		unsigned long start_pfn;
+		unsigned long nr_pages;
+
+		start_pfn = PHYS_PFN(le64_to_cpu(p->mem_addr));
+		nr_pages = le64_to_cpu(p->mem_size) >> PAGE_SHIFT;
+
+		for (pfn = start_pfn; pfn < start_pfn + nr_pages; pfn++) {
+			track = xa_load(&xa_pfns, pfn);
+			if (reclaim && !track) {
+				hyp_assign_show_err("PFN not assigned",
+						    pfn, NULL);
+				break;
+			} else if (!reclaim && track) {
+				hyp_assign_show_err("PFN already assigned",
+						    pfn, track);
+				break;
+			}
+		}
+	}
+	mutex_unlock(&xarray_lock);
+}
+
+static void update_debug_tracking(struct qcom_scm_mem_map_info *mem_regions,
+				size_t mem_regions_sz,
+				struct qcom_scm_current_perm_info *newvms,
+				size_t newvms_sz,
+				struct hyp_assign_debug_track *new)
+{
+	struct qcom_scm_mem_map_info *p, *mem_regions_end;
+	unsigned long pfn;
+	bool reclaim = is_reclaim(newvms, newvms_sz);
+	struct hyp_assign_debug_track *track;
+
+	mem_regions_end = mem_regions + mem_regions_sz/sizeof(*mem_regions);
+
+	mutex_lock(&xarray_lock);
+	for (p = mem_regions; p < mem_regions_end; p++) {
+		unsigned long start_pfn;
+		unsigned long nr_pages;
+
+		start_pfn = PHYS_PFN(le64_to_cpu(p->mem_addr));
+		nr_pages = le64_to_cpu(p->mem_size) >> PAGE_SHIFT;
+
+		for (pfn = start_pfn; pfn < start_pfn + nr_pages; pfn++) {
+			if (reclaim) {
+				track = xa_erase(&xa_pfns, pfn);
+				put_track(track);
+			} else {
+				get_track(new);
+				xa_store(&xa_pfns, pfn, new, GFP_KERNEL);
+			}
+		}
+	}
+	mutex_unlock(&xarray_lock);
+}
+#else /* CONFIG_HYP_ASSIGN_DEBUG */
+static struct hyp_assign_debug_track *
+alloc_debug_tracking(int *dst_vmids, int *dst_perms, int dest_nelems)
+{
+	return NULL;
+}
+static void put_track(struct hyp_assign_debug_track *track)
+{
+}
+static void check_debug_tracking(struct qcom_scm_mem_map_info *mem_regions,
+				size_t mem_regions_sz,
+				struct qcom_scm_current_perm_info *newvms,
+				size_t newvms_sz)
+{
+}
+static void update_debug_tracking(struct qcom_scm_mem_map_info *mem_regions,
+				size_t mem_regions_sz,
+				struct qcom_scm_current_perm_info *newvms,
+				size_t newvms_sz,
+				struct hyp_assign_debug_track *new)
+{
+}
+#endif /* CONFIG_HYP_ASSIGN_DEBUG */
+
+static struct qcom_scm_current_perm_info *
+populate_dest_info(int *dest_vmids, int nelements, int *dest_perms,
+		   size_t *size_in_bytes)
+{
+	struct qcom_scm_current_perm_info *dest_info;
+	int i;
+	size_t size;
+
+	/* Ensure allocated size is less than PAGE_ALLOC_COSTLY_ORDER */
+	size = nelements * sizeof(*dest_info);
+	if (size > PAGE_SIZE)
+		return NULL;
+
+	dest_info = kzalloc(size, GFP_KERNEL);
+	if (!dest_info)
+		return NULL;
+
+	for (i = 0; i < nelements; i++)
+		qcom_scm_populate_vmperm_info(&dest_info[i], dest_vmids[i],
+					      dest_perms[i]);
+
+	*size_in_bytes = size;
+	return dest_info;
+}
+
+static unsigned int get_batches_from_sgl(struct qcom_scm_mem_map_info *sgt_copy,
+					 struct scatterlist *sgl,
+					 struct scatterlist **next_sgl)
+{
+	u64 batch_size = 0;
+	unsigned int i = 0;
+	struct scatterlist *curr_sgl = sgl;
+
+	/* Ensure no zero size batches */
+	do {
+		qcom_scm_populate_mem_map_info(&sgt_copy[i],
+					       page_to_phys(sg_page(curr_sgl)),
+					       curr_sgl->length);
+		batch_size += curr_sgl->length;
+		curr_sgl = sg_next(curr_sgl);
+		i++;
+	} while (curr_sgl && i < BATCH_MAX_SECTIONS &&
+		 curr_sgl->length + batch_size < BATCH_MAX_SIZE);
+
+	*next_sgl = curr_sgl;
+	return i;
+}
+
+static inline int _hyp_assign_table(struct sg_table *table, unsigned int sg_nents_to_assign,
+				    u32 *source_vm_list, int source_nelems,
+				    int *dest_vmids, int *dest_perms,
+				    int dest_nelems,
+				    bool rollback_on_assign_failure);
+
+static inline int rollback_batched_assign(struct sg_table *table, unsigned int nents_assigned,
+					  struct qcom_scm_current_perm_info *destvms,
+					  size_t destvms_size_bytes)
+{
+	u32 *new_source_vm_list;
+	int new_source_nelems;
+
+	/* Hard-coded to work with HLOS as the source */
+	int hlos_dest[HLOS_DEST_ARR_SIZE] = {VMID_HLOS};
+	int hlos_perms[HLOS_DEST_ARR_SIZE] = {PERM_READ | PERM_WRITE | PERM_EXEC};
+
+	int ret;
+
+	new_source_nelems = sizeof(*destvms) / destvms_size_bytes;
+	new_source_vm_list = kmalloc_array(new_source_nelems,
+					   sizeof(*new_source_vm_list),
+					   GFP_KERNEL);
+	if (!new_source_vm_list)
+		return -ENOMEM;
+
+	for (int i = 0; i < new_source_nelems; i++)
+		new_source_vm_list[i] = le32_to_cpu(destvms[i].vmid);
+
+	ret = _hyp_assign_table(table, nents_assigned,
+				new_source_vm_list, new_source_nelems,
+				hlos_dest, hlos_perms, HLOS_DEST_ARR_SIZE,
+				false);
+
+	kfree(new_source_vm_list);
+
+	return ret;
+}
+
+/*
+ * batched_hyp_assign() - assigns memory to destvms in batches
+ * @table: sg_table of memory to assign
+ * @nents: the number of entries in @table in the range [0, nents - 1)
+ *	   that we want to assign
+ * @source_vmids: array of source VMIDs
+ * @source_size_bytes: size of @source_vmids in _bytes_, pass directly into
+ *		       qcom_scm_assign_mem()
+ * @destvms: array of VMIDs + permissions for each VMID that we're assigning to
+ * @destvms_size_bytes: size of @destvms in bytes
+ * @track: debug structure used for tracking which pages are and aren't
+ *	   assigned
+ * @rollback_on_assign_failureue: indicates if we should try rolling back an
+ *				  assign attempt
+ */
+static int batched_hyp_assign(struct sg_table *table, unsigned int nents,
+			      u32 *source_vmids, size_t source_size_bytes,
+			      struct qcom_scm_current_perm_info *destvms,
+			      size_t destvms_size_bytes,
+			      struct hyp_assign_debug_track *track,
+			      bool rollback_on_assign_failure)
+{
+	unsigned int batch_start = 0;
+	unsigned int batches_processed;
+	unsigned int i = 0;
+	u64 total_delta;
+	struct scatterlist *curr_sgl = table->sgl;
+	struct scatterlist *next_sgl;
+	int ret = 0;
+	ktime_t batch_assign_start_ts;
+	ktime_t first_assign_ts;
+	struct qcom_scm_mem_map_info *mem_regions_buf =
+		kcalloc(BATCH_MAX_SECTIONS, sizeof(*mem_regions_buf),
+			GFP_KERNEL);
+	dma_addr_t entries_dma_addr;
+	size_t mem_regions_buf_size;
+
+	if (!mem_regions_buf)
+		return -ENOMEM;
+
+	first_assign_ts = ktime_get();
+	while (batch_start < nents) {
+		batches_processed = get_batches_from_sgl(mem_regions_buf,
+							 curr_sgl, &next_sgl);
+		curr_sgl = next_sgl;
+		mem_regions_buf_size = batches_processed *
+				       sizeof(*mem_regions_buf);
+		entries_dma_addr = dma_map_single(qcom_secure_buffer_dev,
+						  mem_regions_buf,
+						  mem_regions_buf_size,
+						  DMA_TO_DEVICE);
+		if (dma_mapping_error(qcom_secure_buffer_dev,
+				      entries_dma_addr)) {
+			ret = -EADDRNOTAVAIL;
+			break;
+		}
+
+		check_debug_tracking(mem_regions_buf, mem_regions_buf_size,
+				     destvms, destvms_size_bytes);
+
+		trace_hyp_assign_batch_start(mem_regions_buf,
+					     batches_processed);
+		batch_assign_start_ts = ktime_get();
+		ret = qcom_scm_assign_mem_regions(mem_regions_buf,
+						  mem_regions_buf_size,
+						  source_vmids, source_size_bytes,
+						  destvms, destvms_size_bytes);
+
+		trace_hyp_assign_batch_end(ret, ktime_us_delta(ktime_get(),
+					   batch_assign_start_ts));
+		dma_unmap_single(qcom_secure_buffer_dev, entries_dma_addr,
+				 mem_regions_buf_size, DMA_TO_DEVICE);
+
+		if (ret) {
+			int reclaim_ret;
+
+			pr_err("%s: Failed to assign memory protection, ret = %d, batch = %d\n",
+			       __func__, ret, i);
+
+			if (!rollback_on_assign_failure)
+				/*
+				 * Only called from outer invocation of batched_hyp_assign(),
+				 * user will get -EADDRNOTAVAIL
+				 */
+				break;
+
+			/*
+			 * If we haven't assigned anything yet, there's nothing to roll back,
+			 * don't return -EADDRNOTAVAIL
+			 */
+			if (batch_start == 0)
+				break;
+
+			/* We shouldn't roll back if the source VM is not HLOS */
+			if (source_size_bytes > sizeof(*source_vmids) ||
+			    source_vmids[0] != VMID_HLOS) {
+				pr_err("%s: Can only reclaim memory coming from HLOS\n",
+				       __func__);
+				ret = -EADDRNOTAVAIL;
+				break;
+			}
+
+			/* Attempt to reclaim the i - 1 entries we already assigned */
+			reclaim_ret = rollback_batched_assign(table, batch_start - 1, destvms,
+							      destvms_size_bytes);
+
+			if (reclaim_ret) {
+				pr_err("%s: Failed to reclaim memory, ret = %d\n", __func__,
+				       reclaim_ret);
+				/*
+				 * Make it clear to clients that the memory may no
+				 * longer be in a usable state.
+				 */
+				ret = -EADDRNOTAVAIL;
+			} else {
+				pr_err("%s: Reclaimed memory\n", __func__);
+			}
+
+			break;
+		}
+
+		i++;
+
+		update_debug_tracking(mem_regions_buf, mem_regions_buf_size,
+				      destvms, destvms_size_bytes, track);
+		batch_start += batches_processed;
+	}
+	total_delta = ktime_us_delta(ktime_get(), first_assign_ts);
+	trace_hyp_assign_end(total_delta, div64_u64(total_delta, i));
+	kfree(mem_regions_buf);
+	return ret;
+}
+
+static inline void set_each_page_of_sg(struct sg_table *table, u64 flag)
+{
+	struct scatterlist *sg;
+	int npages;
+	int i = 0;
+
+	for_each_sg(table->sgl, sg, table->nents, i) {
+		npages = sg->length / PAGE_SIZE;
+		if (sg->length % PAGE_SIZE)
+			npages++;
+		while (npages--)
+			set_page_private(nth_page(sg_page(sg), npages), flag);
+	}
+}
+
+#define SECURE_PAGE_MAGIC 0xEEEEEEEE
+int page_accessible(unsigned long pfn)
+{
+	struct page *page = pfn_to_page(pfn);
+
+	if (page->private == SECURE_PAGE_MAGIC)
+		return 0;
+	else
+		return 1;
+}
+
+/*
+ *  When -EADDRNOTAVAIL is returned the memory may no longer be in
+ *  a usable state and should no longer be accessed by the HLOS.
+ */
+static inline int _hyp_assign_table(struct sg_table *table, unsigned int sg_nents_to_assign,
+				    u32 *source_vm_list, int source_nelems,
+				    int *dest_vmids, int *dest_perms,
+				    int dest_nelems,
+				    bool rollback_on_assign_failure)
+{
+	int ret = 0;
+	u32 *source_vm_copy;
+	size_t source_vm_copy_size;
+	struct qcom_scm_current_perm_info *dest_vm_copy;
+	size_t dest_vm_copy_size;
+	dma_addr_t source_dma_addr, dest_dma_addr;
+	struct hyp_assign_debug_track *track;
+
+	if (!qcom_secure_buffer_dev)
+		return -EPROBE_DEFER;
+
+	if (!table || !table->sgl || !source_vm_list || !source_nelems ||
+	    !dest_vmids || !dest_perms || !dest_nelems || !table->nents)
+		return -EINVAL;
+
+	/*
+	 * We can only pass cache-aligned sizes to hypervisor, so we need
+	 * to kmalloc and memcpy the source_vm_list here.
+	 */
+	source_vm_copy_size = sizeof(*source_vm_copy) * source_nelems;
+	source_vm_copy = kmemdup(source_vm_list, source_vm_copy_size,
+				 GFP_KERNEL);
+	if (!source_vm_copy)
+		return -ENOMEM;
+
+	source_dma_addr = dma_map_single(qcom_secure_buffer_dev, source_vm_copy,
+					 source_vm_copy_size, DMA_TO_DEVICE);
+	if (dma_mapping_error(qcom_secure_buffer_dev, source_dma_addr)) {
+		ret = -ENOMEM;
+		goto out_free_source;
+	}
+
+	dest_vm_copy = populate_dest_info(dest_vmids, dest_nelems, dest_perms,
+					  &dest_vm_copy_size);
+	if (!dest_vm_copy) {
+		ret = -ENOMEM;
+		goto out_unmap_source;
+	}
+
+	dest_dma_addr = dma_map_single(qcom_secure_buffer_dev, dest_vm_copy,
+				       dest_vm_copy_size, DMA_TO_DEVICE);
+	if (dma_mapping_error(qcom_secure_buffer_dev, dest_dma_addr)) {
+		ret = -ENOMEM;
+		goto out_free_dest;
+	}
+
+	/* Save stacktrace & hyp_assign parameters */
+	track = alloc_debug_tracking(dest_vmids, dest_perms, dest_nelems);
+#if IS_ENABLED(CONFIG_HYP_ASSIGN_DEBUG)
+	if (!track) {
+		ret = -ENOMEM;
+		dma_unmap_single(qcom_secure_buffer_dev, dest_dma_addr,
+				 dest_vm_copy_size, DMA_TO_DEVICE);
+		goto out_free_dest;
+	}
+#endif /* CONFIG_HYP_ASSIGN_DEBUG */
+
+	trace_hyp_assign_info(source_vm_list, source_nelems, dest_vmids,
+			      dest_perms, dest_nelems);
+
+
+	ret = batched_hyp_assign(table, sg_nents_to_assign, source_vm_copy,
+				 source_vm_copy_size, dest_vm_copy,
+				 dest_vm_copy_size, track,
+				 rollback_on_assign_failure);
+
+	if (!ret) {
+		while (dest_nelems--) {
+			if (dest_vmids[dest_nelems] == VMID_HLOS)
+				break;
+		}
+
+		if (dest_nelems == -1)
+			set_each_page_of_sg(table, SECURE_PAGE_MAGIC);
+		else
+			set_each_page_of_sg(table, 0);
+	}
+
+
+	dma_unmap_single(qcom_secure_buffer_dev, dest_dma_addr,
+			 dest_vm_copy_size, DMA_TO_DEVICE);
+
+	/* Drop initial refcount from alloc_debug_tracking */
+	put_track(track);
+out_free_dest:
+	kfree(dest_vm_copy);
+out_unmap_source:
+	dma_unmap_single(qcom_secure_buffer_dev, source_dma_addr,
+			 source_vm_copy_size, DMA_TO_DEVICE);
+out_free_source:
+	kfree(source_vm_copy);
+	return ret;
+}
+
+int hyp_assign_table(struct sg_table *table,
+		     u32 *source_vm_list, int source_nelems,
+		     int *dest_vmids, int *dest_perms,
+		     int dest_nelems)
+{
+	return _hyp_assign_table(table, table->nents, source_vm_list, source_nelems,
+				 dest_vmids, dest_perms, dest_nelems, true);
+}
+EXPORT_SYMBOL_GPL(hyp_assign_table);
+
+const char *msm_secure_vmid_to_string(int secure_vmid)
+{
+	switch (secure_vmid) {
+	case VMID_TZ:
+		return "VMID_TZ";
+	case VMID_HLOS:
+		return "VMID_HLOS";
+	case VMID_CP_TOUCH:
+		return "VMID_CP_TOUCH";
+	case VMID_CP_BITSTREAM:
+		return "VMID_CP_BITSTREAM";
+	case VMID_CP_PIXEL:
+		return "VMID_CP_PIXEL";
+	case VMID_CP_NON_PIXEL:
+		return "VMID_CP_NON_PIXEL";
+	case VMID_CP_CAMERA:
+		return "VMID_CP_CAMERA";
+	case VMID_HLOS_FREE:
+		return "VMID_HLOS_FREE";
+	case VMID_MSS_MSA:
+		return "VMID_MSS_MSA";
+	case VMID_MSS_NONMSA:
+		return "VMID_MSS_NONMSA";
+	case VMID_CP_SEC_DISPLAY:
+		return "VMID_CP_SEC_DISPLAY";
+	case VMID_CP_APP:
+		return "VMID_CP_APP";
+	case VMID_LPASS:
+		return "VMID_LPASS";
+	case VMID_WLAN:
+		return "VMID_WLAN";
+	case VMID_WLAN_CE:
+		return "VMID_WLAN_CE";
+	case VMID_CP_CAMERA_PREVIEW:
+		return "VMID_CP_CAMERA_PREVIEW";
+	case VMID_CP_SPSS_SP:
+		return "VMID_CP_SPSS_SP";
+	case VMID_CP_SPSS_SP_SHARED:
+		return "VMID_CP_SPSS_SP_SHARED";
+	case VMID_CP_SPSS_HLOS_SHARED:
+		return "VMID_CP_SPSS_HLOS_SHARED";
+	case VMID_ADSP_HEAP:
+		return "VMID_ADSP_HEAP";
+	case VMID_INVAL:
+		return "VMID_INVAL";
+	case VMID_NAV:
+		return "VMID_NAV";
+	default:
+		return "Unknown VMID";
+	}
+}
+EXPORT_SYMBOL_GPL(msm_secure_vmid_to_string);
+
+u32 msm_secure_get_vmid_perms(u32 vmid)
+{
+	if (vmid == VMID_CP_SEC_DISPLAY || (vmid == VMID_CP_CAMERA_PREVIEW &&
+					    vmid_cp_camera_preview_ro))
+		return PERM_READ;
+	else if (vmid == VMID_CP_CDSP)
+		return PERM_READ | PERM_WRITE | PERM_EXEC;
+	else
+		return PERM_READ | PERM_WRITE;
+}
+EXPORT_SYMBOL_GPL(msm_secure_get_vmid_perms);
+
+static int qcom_secure_buffer_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	int ret;
+
+	if (IS_ENABLED(CONFIG_ARM64)) {
+		ret = dma_set_mask(dev, DMA_BIT_MASK(64));
+		if (ret)
+			return ret;
+	}
+
+	qcom_secure_buffer_dev = dev;
+	vmid_cp_camera_preview_ro = of_property_read_bool(dev->of_node,
+					"qcom,vmid-cp-camera-preview-ro");
+	return 0;
+}
+
+static const struct of_device_id qcom_secure_buffer_of_match[] = {
+	{.compatible = "qcom,secure-buffer"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, qcom_secure_buffer_of_match);
+
+static struct platform_driver qcom_secure_buffer_driver = {
+	.probe = qcom_secure_buffer_probe,
+	.driver = {
+		.name = "qcom_secure_buffer",
+		.of_match_table = qcom_secure_buffer_of_match,
+	},
+};
+
+static int __init qcom_secure_buffer_init(void)
+{
+#if IS_ENABLED(CONFIG_HYP_ASSIGN_DEBUG)
+	failure_handle = create_dummy_stack();
+#endif
+
+	return platform_driver_register(&qcom_secure_buffer_driver);
+}
+subsys_initcall(qcom_secure_buffer_init);
+
+static void __exit qcom_secure_buffer_exit(void)
+{
+	return platform_driver_unregister(&qcom_secure_buffer_driver);
+}
+module_exit(qcom_secure_buffer_exit);
+
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smcinvoke/Kconfig
+++ linux-qcom-6.8.0/drivers/soc/qcom/smcinvoke/Kconfig
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# QCOM Smcinvoke driver
+#
+config QCOM_SMCINVOKE
+	tristate "Secure QSEE Support"
+	depends on QTEE_SHM_BRIDGE && QCOM_SCM_ADDON
+	help
+	  Enable SMCInvoke driver which supports capability based secure
+	  communication between QTI Secure Execution Environment (QSEE)
+	  and high level operating system. It exposes APIs for both
+	  userspace and kernel clients.
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smcinvoke/Makefile
+++ linux-qcom-6.8.0/drivers/soc/qcom/smcinvoke/Makefile
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+obj-$(CONFIG_QCOM_SMCINVOKE) += qcom_smcinvoke.o
+qcom_smcinvoke-objs	+= smcinvoke_kernel.o smcinvoke.o
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smcinvoke/smci_internal.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/smcinvoke/smci_internal.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _SMCI_INTERNAL_H_
+#define _SMCI_INTERNAL_H_
+
+#include <soc/qcom/smci_object.h>
+#include <soc/qcom/smci_clientenv.h>
+#include <uapi/linux/smcinvoke.h>
+
+extern struct device *class_dev;
+
+#endif /* _SMCI_INTERNAL_H_ */
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smcinvoke/smci_qseecomcompat.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/smcinvoke/smci_qseecomcompat.h
@@ -0,0 +1,76 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __SMCI_QSEECOMCOMPAT_H
+#define __SMCI_QSEECOMCOMPAT_H
+
+#include <soc/qcom/smci_object.h>
+
+#define IQSEEComCompat_ERROR_APP_UNAVAILABLE INT32_C(10)
+#define IQSEEComCompat_OP_sendRequest 0
+#define IQSEEComCompat_OP_disconnect 1
+#define IQSEEComCompat_OP_unload 2
+
+
+static inline int32_t
+IQSEEComCompat_release(struct Object self)
+{
+	return Object_invoke(self, Object_OP_release, 0, 0);
+}
+
+static inline int32_t
+IQSEEComCompat_retain(struct Object self)
+{
+	return Object_invoke(self, Object_OP_retain, 0, 0);
+}
+
+static inline int32_t
+IQSEEComCompat_sendRequest(struct Object self,
+		const void *reqIn_ptr, size_t reqIn_len,
+		const void *rspIn_ptr, size_t rspIn_len,
+		void *reqOut_ptr, size_t reqOut_len, size_t *reqOut_lenout,
+		void *rspOut_ptr, size_t rspOut_len, size_t *rspOut_lenout,
+		const uint32_t *embeddedBufOffsets_ptr,
+		size_t embeddedBufOffsets_len, uint32_t is64_val,
+		struct Object smo1_val, struct Object smo2_val,
+		struct Object smo3_val, struct Object smo4_val)
+{
+	union ObjectArg a[10];
+	int32_t result;
+
+	a[0].bi = (struct ObjectBufIn) { reqIn_ptr, reqIn_len * 1 };
+	a[1].bi = (struct ObjectBufIn) { rspIn_ptr, rspIn_len * 1 };
+	a[4].b = (struct ObjectBuf) { reqOut_ptr, reqOut_len * 1 };
+	a[5].b = (struct ObjectBuf) { rspOut_ptr, rspOut_len * 1 };
+	a[2].bi = (struct ObjectBufIn) { embeddedBufOffsets_ptr,
+			embeddedBufOffsets_len * sizeof(uint32_t) };
+	a[3].b = (struct ObjectBuf) { &is64_val, sizeof(uint32_t) };
+	a[6].o = smo1_val;
+	a[7].o = smo2_val;
+	a[8].o = smo3_val;
+	a[9].o = smo4_val;
+
+	result = Object_invoke(self, IQSEEComCompat_OP_sendRequest, a,
+			ObjectCounts_pack(4, 2, 4, 0));
+
+	*reqOut_lenout = a[4].b.size / 1;
+	*rspOut_lenout = a[5].b.size / 1;
+
+	return result;
+}
+
+static inline int32_t
+IQSEEComCompat_disconnect(struct Object self)
+{
+	return Object_invoke(self, IQSEEComCompat_OP_disconnect, 0, 0);
+}
+
+static inline int32_t
+IQSEEComCompat_unload(struct Object self)
+{
+	return Object_invoke(self, IQSEEComCompat_OP_unload, 0, 0);
+}
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smcinvoke/smci_qseecomcompatapploader.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/smcinvoke/smci_qseecomcompatapploader.h
@@ -0,0 +1,109 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __SMCI_QSEECOMCOMPATAPPLOADER_H
+#define __SMCI_QSEECOMCOMPATAPPLOADER_H
+
+#include <soc/qcom/smci_object.h>
+
+#define IQSEEComCompatAppLoader_MAX_FILENAME_LEN UINT32_C(64)
+#define IQSEEComCompatAppLoader_ELFCLASS32 UINT32_C(1)
+#define IQSEEComCompatAppLoader_ELFCLASS64 UINT32_C(2)
+
+#define IQSEEComCompatAppLoader_ERROR_INVALID_BUFFER INT32_C(10)
+#define IQSEEComCompatAppLoader_ERROR_PIL_ROLLBACK_FAILURE INT32_C(11)
+#define IQSEEComCompatAppLoader_ERROR_ELF_SIGNATURE_ERROR INT32_C(12)
+#define IQSEEComCompatAppLoader_ERROR_METADATA_INVALID INT32_C(13)
+#define IQSEEComCompatAppLoader_ERROR_MAX_NUM_APPS INT32_C(14)
+#define IQSEEComCompatAppLoader_ERROR_NO_NAME_IN_METADATA INT32_C(15)
+#define IQSEEComCompatAppLoader_ERROR_ALREADY_LOADED INT32_C(16)
+#define IQSEEComCompatAppLoader_ERROR_EMBEDDED_IMAGE_NOT_FOUND INT32_C(17)
+#define IQSEEComCompatAppLoader_ERROR_TZ_HEAP_MALLOC_FAILURE INT32_C(18)
+#define IQSEEComCompatAppLoader_ERROR_TA_APP_REGION_MALLOC_FAILURE INT32_C(19)
+#define IQSEEComCompatAppLoader_ERROR_CLIENT_CRED_PARSING_FAILURE INT32_C(20)
+#define IQSEEComCompatAppLoader_ERROR_APP_UNTRUSTED_CLIENT INT32_C(21)
+#define IQSEEComCompatAppLoader_ERROR_APP_BLACKLISTED INT32_C(22)
+#define IQSEEComCompatAppLoader_ERROR_APP_NOT_LOADED INT32_C(23)
+#define IQSEEComCompatAppLoader_ERROR_NOT_QSEECOM_COMPAT_APP INT32_C(24)
+#define IQSEEComCompatAppLoader_ERROR_FILENAME_TOO_LONG INT32_C(25)
+#define IQSEEComCompatAppLoader_ERROR_APP_ARCH_NOT_SUPPORTED INT32_C(26)
+
+#define IQSEEComCompatAppLoader_OP_loadFromRegion 0
+#define IQSEEComCompatAppLoader_OP_loadFromBuffer 1
+#define IQSEEComCompatAppLoader_OP_lookupTA 2
+
+
+static inline int32_t
+IQSEEComCompatAppLoader_release(struct Object self)
+{
+	return Object_invoke(self, Object_OP_release, 0, 0);
+}
+
+static inline int32_t
+IQSEEComCompatAppLoader_retain(struct Object self)
+{
+	return Object_invoke(self, Object_OP_retain, 0, 0);
+}
+
+static inline int32_t
+IQSEEComCompatAppLoader_loadFromRegion(struct Object self,
+			struct Object appElf_val, const void *filename_ptr,
+			size_t filename_len, struct Object *appCompat_ptr)
+{
+	union ObjectArg a[3];
+	int32_t result;
+
+	a[1].o = appElf_val;
+	a[0].bi = (struct ObjectBufIn) { filename_ptr, filename_len * 1 };
+
+	result = Object_invoke(self, IQSEEComCompatAppLoader_OP_loadFromRegion, a,
+			ObjectCounts_pack(1, 0, 1, 1));
+
+	*appCompat_ptr = a[2].o;
+
+	return result;
+}
+
+static inline int32_t
+IQSEEComCompatAppLoader_loadFromBuffer(struct Object self,
+			const void *appElf_ptr, size_t appElf_len,
+			const void *filename_ptr, size_t filename_len,
+			void *distName_ptr, size_t distName_len,
+			size_t *distName_lenout, struct Object *appCompat_ptr)
+{
+	union ObjectArg a[4];
+	int32_t result;
+
+	a[0].bi = (struct ObjectBufIn) { appElf_ptr, appElf_len * 1 };
+	a[1].bi = (struct ObjectBufIn) { filename_ptr, filename_len * 1 };
+	a[2].b = (struct ObjectBuf) { distName_ptr, distName_len * 1 };
+
+	result = Object_invoke(self, IQSEEComCompatAppLoader_OP_loadFromBuffer,
+			a, ObjectCounts_pack(2, 1, 0, 1));
+
+	*distName_lenout = a[2].b.size / 1;
+	*appCompat_ptr = a[3].o;
+
+	return result;
+}
+
+static inline int32_t
+IQSEEComCompatAppLoader_lookupTA(struct Object self, const void *appName_ptr,
+			size_t appName_len, struct Object *appCompat_ptr)
+{
+	union ObjectArg a[2];
+	int32_t result;
+
+	a[0].bi = (struct ObjectBufIn) { appName_ptr, appName_len * 1 };
+
+	result = Object_invoke(self, IQSEEComCompatAppLoader_OP_lookupTA,
+			a, ObjectCounts_pack(1, 0, 0, 1));
+
+	*appCompat_ptr = a[1].o;
+
+	return result;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smcinvoke/smcinvoke.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/smcinvoke/smcinvoke.c
@@ -0,0 +1,3322 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "smcinvoke: %s: " fmt, __func__
+
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/anon_inodes.h>
+#include <linux/hashtable.h>
+#include <linux/cdev.h>
+#include <linux/uaccess.h>
+#include <linux/dma-buf.h>
+#include <linux/delay.h>
+#include <linux/kref.h>
+#include <linux/signal.h>
+#include <linux/mem-buf.h>
+#include <linux/of_platform.h>
+#include <linux/firmware.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/freezer.h>
+#include <linux/ratelimit.h>
+#include <linux/qtee_shmbridge.h>
+#include <linux/kthread.h>
+
+#include "smci_internal.h"
+
+/*
+ * QSEECOM is not enabled, so keeping related stuff under feature flag.
+ * Upstream community enabled qseecom under flag CONFIG_QCOM_QSEECOM.
+ */
+#if IS_ENABLED(CONFIG_QSEECOM)
+#include <linux/qseecom_kernel.h>
+#endif
+
+
+#define CREATE_TRACE_POINTS
+#include "trace_smcinvoke.h"
+
+#define SMCINVOKE_DEV				"smcinvoke"
+#define SMCINVOKE_TZ_ROOT_OBJ			1
+#define SMCINVOKE_TZ_OBJ_NULL			0
+#define SMCINVOKE_ARGS_ALIGN_SIZE		(sizeof(uint64_t))
+#define SMCINVOKE_NEXT_AVAILABLE_TXN		0
+#define SMCINVOKE_REQ_PLACED			1
+#define SMCINVOKE_REQ_PROCESSING		2
+#define SMCINVOKE_REQ_PROCESSED			3
+#define SMCINVOKE_INCREMENT			1
+#define SMCINVOKE_DECREMENT			0
+#define SMCINVOKE_OBJ_TYPE_TZ_OBJ		0
+#define SMCINVOKE_OBJ_TYPE_SERVER		1
+#define SMCINVOKE_OBJ_TYPE_TZ_OBJ_FOR_KERNEL	2
+#define SMCINVOKE_MEM_MAP_OBJ			0
+#define SMCINVOKE_MEM_RGN_OBJ			1
+#define SMCINVOKE_MEM_PERM_RW			6
+#define SMCINVOKE_SCM_EBUSY_WAIT_MS		30
+#define SMCINVOKE_SCM_EBUSY_MAX_RETRY		200
+#define TZCB_ERR_RATELIMIT_INTERVAL		(1*HZ)
+#define TZCB_ERR_RATELIMIT_BURST		1
+
+//print tzcb err per sec
+#define tzcb_err_ratelimited(fmt, ...)	do {		\
+	static DEFINE_RATELIMIT_STATE(_rs,		\
+			TZCB_ERR_RATELIMIT_INTERVAL,	\
+			TZCB_ERR_RATELIMIT_BURST);	\
+	if (__ratelimit(&_rs))				\
+		pr_err(fmt, ##__VA_ARGS__);		\
+} while (0)
+
+
+
+/* TZ defined values - Start */
+#define SMCINVOKE_INVOKE_PARAM_ID		0x224
+#define SMCINVOKE_CB_RSP_PARAM_ID		0x22
+#define SMCINVOKE_INVOKE_CMD_LEGACY		0x32000600
+#define SMCINVOKE_INVOKE_CMD			0x32000602
+#define SMCINVOKE_CB_RSP_CMD			0x32000601
+#define SMCINVOKE_RESULT_INBOUND_REQ_NEEDED	3
+/* TZ defined values - End */
+
+/* Asynchronous protocol values */
+/* Driver async version is set to match the minimal TZ version that supports async memory object */
+#define SMCINVOKE_ASYNC_VERSION          (0x00010002)
+#define SMCINVOKE_ASYNC_OP_MEMORY_OBJECT (0x00000003)
+
+/*
+ * This is the state when server FD has been closed but
+ * TZ still has refs of CBOBjs served by this server
+ */
+#define SMCINVOKE_SERVER_STATE_DEFUNCT		1
+
+#define CBOBJ_MAX_RETRIES 50
+#define FOR_ARGS(ndxvar, counts, section) \
+	for (ndxvar = OBJECT_COUNTS_INDEX_##section(counts); \
+		ndxvar < (OBJECT_COUNTS_INDEX_##section(counts) \
+		+ OBJECT_COUNTS_NUM_##section(counts)); \
+		++ndxvar)
+
+#define TZCB_BUF_OFFSET(tzcb_req) (sizeof(tzcb_req->result) + \
+			sizeof(struct smcinvoke_msg_hdr) + \
+			sizeof(union smcinvoke_tz_args) * \
+			OBJECT_COUNTS_TOTAL(tzcb_req->hdr.counts))
+
+/*
+ * +ve uhandle : either remote obj or mem obj, decided by f_ops
+ * -ve uhandle : either Obj NULL or CBObj
+ *	- -1: OBJ NULL
+ *	- < -1: CBObj
+ */
+#define UHANDLE_IS_FD(h) ((h) >= 0)
+#define UHANDLE_IS_NULL(h) ((h) == SMCINVOKE_USERSPACE_OBJ_NULL)
+#define UHANDLE_IS_CB_OBJ(h) (h < SMCINVOKE_USERSPACE_OBJ_NULL)
+#define UHANDLE_NULL (SMCINVOKE_USERSPACE_OBJ_NULL)
+/*
+ * MAKE => create handle for other domain i.e. TZ or userspace
+ * GET => retrieve obj from incoming handle
+ */
+#define UHANDLE_GET_CB_OBJ(h) (-2-(h))
+#define UHANDLE_MAKE_CB_OBJ(o) (-2-(o))
+#define UHANDLE_GET_FD(h) (h)
+
+/*
+ * +ve tzhandle : remote object i.e. owned by TZ
+ * -ve tzhandle : local object i.e. owned by linux
+ * --------------------------------------------------
+ *| 1 (1 bit) | Obj Id (15 bits) | srvr id (16 bits) |
+ * ---------------------------------------------------
+ * Server ids are defined below for various local objects
+ * server id 0 : Kernel Obj
+ * server id 1 : Memory region Obj
+ * server id 2 : Memory map Obj
+ * server id 3-15: Reserverd
+ * server id 16 & up: Callback Objs
+ */
+#define KRNL_SRVR_ID 0
+#define MEM_RGN_SRVR_ID 1
+#define MEM_MAP_SRVR_ID 2
+#define CBOBJ_SERVER_ID_START 0x10
+#define CBOBJ_SERVER_ID_END ((1<<16) - 1)
+/* local obj id is represented by 15 bits */
+#define MAX_LOCAL_OBJ_ID ((1<<15) - 1)
+/* CBOBJs will be served by server id 0x10 onwards */
+#define TZHANDLE_GET_SERVER(h) ((uint16_t)((h) & 0xFFFF))
+#define TZHANDLE_GET_OBJID(h) (((h) >> 16) & 0x7FFF)
+#define TZHANDLE_MAKE_LOCAL(s, o) (((0x8000 | (o)) << 16) | s)
+#define SET_BIT(s, b) (s | (1 << b))
+#define UNSET_BIT(s, b) (s & (~(1 << b)))
+
+#define TZHANDLE_IS_NULL(h) ((h) == SMCINVOKE_TZ_OBJ_NULL)
+#define TZHANDLE_IS_LOCAL(h) ((h) & 0x80000000)
+#define TZHANDLE_IS_REMOTE(h) (!TZHANDLE_IS_NULL(h) && !TZHANDLE_IS_LOCAL(h))
+
+#define TZHANDLE_IS_KERNEL_OBJ(h) (TZHANDLE_IS_LOCAL(h) && \
+				TZHANDLE_GET_SERVER(h) == KRNL_SRVR_ID)
+#define TZHANDLE_IS_MEM_RGN_OBJ(h) (TZHANDLE_IS_LOCAL(h) && \
+				TZHANDLE_GET_SERVER(h) == MEM_RGN_SRVR_ID)
+#define TZHANDLE_IS_MEM_MAP_OBJ(h) (TZHANDLE_IS_LOCAL(h) && \
+				TZHANDLE_GET_SERVER(h) == MEM_MAP_SRVR_ID)
+#define TZHANDLE_IS_MEM_OBJ(h) (TZHANDLE_IS_MEM_RGN_OBJ(h) || \
+				TZHANDLE_IS_MEM_MAP_OBJ(h))
+#define TZHANDLE_IS_CB_OBJ(h) (TZHANDLE_IS_LOCAL(h) && \
+				TZHANDLE_GET_SERVER(h) >= CBOBJ_SERVER_ID_START)
+
+#define FILE_IS_REMOTE_OBJ(f) ((f)->f_op && (f)->f_op == &g_smcinvoke_fops)
+
+static DEFINE_MUTEX(g_smcinvoke_lock);
+#define NO_LOCK 0
+#define TAKE_LOCK 1
+#define MUTEX_LOCK(x) { if (x) mutex_lock(&g_smcinvoke_lock); }
+#define MUTEX_UNLOCK(x) { if (x) mutex_unlock(&g_smcinvoke_lock); }
+
+#define POST_KT_SLEEP           0
+#define POST_KT_WAKEUP          1
+#define MAX_CHAR_NAME           50
+
+enum worker_thread_type {
+	SHMB_WORKER_THREAD      = 0,
+	OBJECT_WORKER_THREAD,
+	ADCI_WORKER_THREAD,
+	MAX_THREAD_NUMBER
+};
+
+static DEFINE_HASHTABLE(g_cb_servers, 8);
+static LIST_HEAD(g_mem_objs);
+static uint16_t g_last_cb_server_id = CBOBJ_SERVER_ID_START;
+static uint16_t g_last_mem_rgn_id, g_last_mem_map_obj_id;
+static size_t g_max_cb_buf_size = SMCINVOKE_TZ_MIN_BUF_SIZE;
+static unsigned int cb_reqs_inflight;
+static bool legacy_smc_call;
+static int invoke_cmd;
+
+static long smcinvoke_ioctl(struct file *, unsigned int, unsigned long);
+static int smcinvoke_open(struct inode *, struct file *);
+static int smcinvoke_release(struct inode *, struct file *);
+static int release_cb_server(uint16_t);
+
+static const struct file_operations g_smcinvoke_fops = {
+	.owner		= THIS_MODULE,
+	.unlocked_ioctl	= smcinvoke_ioctl,
+	.compat_ioctl	= smcinvoke_ioctl,
+	.open		= smcinvoke_open,
+	.release	= smcinvoke_release,
+};
+
+static dev_t smcinvoke_device_no;
+static struct cdev smcinvoke_cdev;
+static struct class *driver_class;
+struct device *class_dev;
+static struct platform_device *smcinvoke_pdev;
+static bool smci_support_hyp;
+
+/* We disable async memory object support by default,
+ * until we receive the first message from TZ over the
+ * async channel and can determine TZ async version.
+ */
+static bool mem_obj_async_support;
+static uint32_t tz_async_version;
+
+struct smcinvoke_buf_hdr {
+	uint32_t offset;
+	uint32_t size;
+};
+
+union smcinvoke_tz_args {
+	struct smcinvoke_buf_hdr b;
+	int32_t handle;
+};
+
+struct smcinvoke_msg_hdr {
+	uint32_t tzhandle;
+	uint32_t op;
+	uint32_t counts;
+};
+
+/* Inbound reqs from TZ */
+struct smcinvoke_tzcb_req {
+	int32_t result;
+	struct smcinvoke_msg_hdr hdr;
+	union smcinvoke_tz_args args[];
+};
+
+struct smcinvoke_file_data {
+	uint32_t context_type;
+	union {
+		uint32_t tzhandle;
+		uint16_t server_id;
+	};
+};
+
+struct smcinvoke_piggyback_msg {
+	uint32_t version;
+	uint32_t op;
+	uint32_t counts;
+	int32_t objs[];
+};
+
+/* Mapped memory object data
+ *
+ * memObjRef		Handle reference for the memory object
+ * mapObjRef		Handle reference for the map object
+ * addr				Mapped memory address
+ * size				Size of mapped memory
+ * perm				Access rights for the memory
+ */
+struct smcinvoke_mem_obj_info {
+	uint32_t memObjRef;
+	uint32_t mapObjRef;
+	uint64_t addr;
+	uint64_t size;
+	uint32_t perm;
+};
+
+/* Memory object info to be written into the async buffer
+ *
+ * version		Async protocol version
+ * op			Async protocol operation
+ * count		Number of memory objects passed
+ * mo			Mapped memory object data
+ */
+struct smcinvoke_mem_obj_msg {
+	uint32_t version;
+	uint32_t op;
+	uint32_t count;
+	struct smcinvoke_mem_obj_info mo[];
+};
+
+struct smcinvoke_mem_obj_pending_async {
+	struct smcinvoke_mem_obj *mem_obj;
+	struct list_head list;
+};
+
+/* Data structure to hold request coming from TZ */
+struct smcinvoke_cb_txn {
+	uint32_t txn_id;
+	int32_t state;
+	struct smcinvoke_tzcb_req *cb_req;
+	size_t cb_req_bytes;
+	struct file **filp_to_release;
+	struct hlist_node hash;
+	struct kref ref_cnt;
+};
+
+struct smcinvoke_server_info {
+	uint16_t server_id;
+	uint16_t state;
+	uint32_t txn_id;
+	struct kref ref_cnt;
+	wait_queue_head_t req_wait_q;
+	wait_queue_head_t rsp_wait_q;
+	size_t cb_buf_size;
+	DECLARE_HASHTABLE(reqs_table, 4);
+	DECLARE_HASHTABLE(responses_table, 4);
+	struct hlist_node hash;
+	struct list_head pending_cbobjs;
+	uint8_t is_server_suspended;
+};
+
+struct smcinvoke_cbobj {
+	uint16_t cbobj_id;
+	struct kref ref_cnt;
+	struct smcinvoke_server_info *server;
+	struct list_head list;
+};
+
+/*
+ * We require couple of objects, one for mem region & another
+ * for mapped mem_obj once mem region has been mapped. It is
+ * possible that TZ can release either independent of other.
+ */
+struct smcinvoke_mem_obj {
+	/* these ids are objid part of tzhandle */
+	uint16_t mem_region_id;
+	uint16_t mem_map_obj_id;
+	struct dma_buf *dma_buf;
+	struct dma_buf_attachment *buf_attach;
+	struct sg_table *sgt;
+	struct kref mem_regn_ref_cnt;
+	struct kref mem_map_obj_ref_cnt;
+	uint64_t p_addr;
+	size_t p_addr_len;
+	struct list_head list;
+	uint64_t shmbridge_handle;
+	struct smcinvoke_server_info *server;
+	int32_t mem_obj_user_fd;
+};
+
+static LIST_HEAD(g_bridge_postprocess);
+DEFINE_MUTEX(bridge_postprocess_lock);
+
+static LIST_HEAD(g_object_postprocess);
+DEFINE_MUTEX(object_postprocess_lock);
+
+struct bridge_deregister {
+	uint64_t shmbridge_handle;
+	struct dma_buf *dmabuf_to_free;
+};
+
+struct object_release {
+	uint32_t tzhandle;
+	uint32_t context_type;
+};
+
+
+struct smcinvoke_shmbridge_deregister_pending_list {
+	struct list_head list;
+	struct bridge_deregister data;
+};
+
+struct smcinvoke_object_release_pending_list {
+	struct list_head list;
+	struct object_release data;
+};
+
+struct smcinvoke_worker_thread {
+	enum worker_thread_type type;
+	atomic_t postprocess_kthread_state;
+	wait_queue_head_t postprocess_kthread_wq;
+	struct task_struct *postprocess_kthread_task;
+};
+
+static struct smcinvoke_worker_thread smcinvoke[MAX_THREAD_NUMBER];
+static const char thread_name[MAX_THREAD_NUMBER][MAX_CHAR_NAME] = {
+	"smcinvoke_shmbridge_postprocess", "smcinvoke_object_postprocess", "smcinvoke_adci_thread"};
+static struct Object adci_rootEnv = Object_NULL;
+
+static int prepare_send_scm_msg(const uint8_t *in_buf, phys_addr_t in_paddr,
+		size_t in_buf_len,
+		uint8_t *out_buf, phys_addr_t out_paddr,
+		size_t out_buf_len,
+		struct smcinvoke_cmd_req *req,
+		union smcinvoke_arg *args_buf,
+		bool *tz_acked, uint32_t context_type,
+		struct qtee_shm *in_shm, struct qtee_shm *out_shm, bool retry);
+
+static void process_piggyback_data(void *buf, size_t buf_size);
+static void add_mem_obj_info_to_async_side_channel_locked(void *buf, size_t buf_size,
+		struct list_head *l_pending_mem_obj);
+static void delete_pending_async_list_locked(struct list_head *l_pending_mem_obj);
+
+static void destroy_cb_server(struct kref *kref)
+{
+	struct smcinvoke_server_info *server = container_of(kref,
+			struct smcinvoke_server_info, ref_cnt);
+	if (server) {
+		hash_del(&server->hash);
+		kfree(server);
+	}
+}
+
+/*
+ *  A separate find func is reqd mainly for couple of cases:
+ *  next_cb_server_id_locked which checks if server id had been utilized or not.
+ *      - It would be overhead if we do ref_cnt for this case
+ *  smcinvoke_release: which is called when server is closed from userspace.
+ *      - During server creation we init ref count, now put it back
+ */
+static struct smcinvoke_server_info *find_cb_server_locked(uint16_t server_id)
+{
+	struct smcinvoke_server_info *data = NULL;
+
+	hash_for_each_possible(g_cb_servers, data, hash, server_id) {
+		if (data->server_id == server_id)
+			return data;
+	}
+	return NULL;
+}
+
+static struct smcinvoke_server_info *get_cb_server_locked(uint16_t server_id)
+{
+	struct smcinvoke_server_info *server = find_cb_server_locked(server_id);
+
+	if (server)
+		kref_get(&server->ref_cnt);
+
+	return server;
+}
+
+static uint16_t next_cb_server_id_locked(void)
+{
+	if (g_last_cb_server_id == CBOBJ_SERVER_ID_END)
+		g_last_cb_server_id = CBOBJ_SERVER_ID_START;
+
+	while (find_cb_server_locked(++g_last_cb_server_id))
+		;
+
+	return g_last_cb_server_id;
+}
+
+static inline void release_filp(struct file **filp_to_release, size_t arr_len)
+{
+	size_t i = 0;
+
+	for (i = 0; i < arr_len; i++) {
+		if (filp_to_release[i]) {
+			fput(filp_to_release[i]);
+			filp_to_release[i] = NULL;
+		}
+	}
+}
+
+static struct smcinvoke_mem_obj *find_mem_obj_locked(uint16_t mem_obj_id,
+							bool is_mem_rgn_obj)
+{
+	struct smcinvoke_mem_obj *mem_obj = NULL;
+
+	if (list_empty(&g_mem_objs))
+		return NULL;
+
+	list_for_each_entry(mem_obj, &g_mem_objs, list) {
+		if ((is_mem_rgn_obj && (mem_obj->mem_region_id == mem_obj_id)) ||
+			(!is_mem_rgn_obj && (mem_obj->mem_map_obj_id == mem_obj_id)))
+			return mem_obj;
+	}
+	return NULL;
+}
+
+static uint32_t next_mem_region_obj_id_locked(void)
+{
+	if (g_last_mem_rgn_id == MAX_LOCAL_OBJ_ID)
+		g_last_mem_rgn_id = 0;
+
+	while (find_mem_obj_locked(++g_last_mem_rgn_id, SMCINVOKE_MEM_RGN_OBJ))
+		;
+
+	return g_last_mem_rgn_id;
+}
+
+static uint32_t next_mem_map_obj_id_locked(void)
+{
+	if (g_last_mem_map_obj_id == MAX_LOCAL_OBJ_ID)
+		g_last_mem_map_obj_id = 0;
+
+	while (find_mem_obj_locked(++g_last_mem_map_obj_id,
+			SMCINVOKE_MEM_MAP_OBJ))
+		;
+
+	return g_last_mem_map_obj_id;
+}
+
+static void smcinvoke_shmbridge_post_process(void)
+{
+	struct smcinvoke_shmbridge_deregister_pending_list *entry = NULL;
+	struct list_head *pos;
+	int ret = 0;
+	uint64_t handle = 0;
+	struct dma_buf *dmabuf_to_free = NULL;
+
+	do {
+		mutex_lock(&bridge_postprocess_lock);
+		if (list_empty(&g_bridge_postprocess)) {
+			mutex_unlock(&bridge_postprocess_lock);
+			break;
+		}
+		pos = g_bridge_postprocess.next;
+		entry = list_entry(pos,
+				struct smcinvoke_shmbridge_deregister_pending_list,
+				list);
+		if (entry) {
+			handle = entry->data.shmbridge_handle;
+			dmabuf_to_free = entry->data.dmabuf_to_free;
+		} else {
+			pr_err("entry is NULL, pos:%#llx\n", (uint64_t)pos);
+		}
+		list_del(pos);
+		kfree_sensitive(entry);
+		mutex_unlock(&bridge_postprocess_lock);
+
+		if (entry) {
+			do {
+				ret = qtee_shmbridge_deregister(handle);
+				if (unlikely(ret)) {
+					pr_err_ratelimited("SHM failed: ret:%d ptr:0x%p h:%#llx\n",
+							ret,
+							dmabuf_to_free,
+							handle);
+				} else {
+					pr_debug("SHM deletion: Handle:%#llx\n",
+							handle);
+					dma_buf_put(dmabuf_to_free);
+				}
+			} while (-EBUSY == ret);
+		}
+	} while (1);
+}
+
+static int smcinvoke_release_tz_object(struct qtee_shm *in_shm, struct qtee_shm *out_shm,
+		uint32_t tzhandle, uint32_t context_type)
+{
+	int ret = 0;
+	bool release_handles;
+	uint8_t *in_buf = NULL;
+	uint8_t *out_buf = NULL;
+	struct smcinvoke_msg_hdr hdr = {0};
+	struct smcinvoke_cmd_req req = {0};
+
+	in_buf = in_shm->vaddr;
+	out_buf = out_shm->vaddr;
+	hdr.tzhandle = tzhandle;
+	hdr.op = OBJECT_OP_RELEASE;
+	hdr.counts = 0;
+	*(struct smcinvoke_msg_hdr *)in_buf = hdr;
+
+	ret = prepare_send_scm_msg(in_buf, in_shm->paddr,
+			SMCINVOKE_TZ_MIN_BUF_SIZE, out_buf, out_shm->paddr,
+			SMCINVOKE_TZ_MIN_BUF_SIZE, &req, NULL,
+			&release_handles, context_type, in_shm, out_shm, false);
+	process_piggyback_data(out_buf, SMCINVOKE_TZ_MIN_BUF_SIZE);
+	if (ret) {
+		pr_err_ratelimited("Failed to release object(0x%x), ret:%d\n",
+				hdr.tzhandle, ret);
+	} else {
+		pr_debug("Released object(0x%x) successfully.\n",
+				hdr.tzhandle);
+	}
+
+	return ret;
+}
+
+
+static int smcinvoke_object_post_process(void)
+{
+	struct smcinvoke_object_release_pending_list *entry = NULL;
+	struct list_head *pos;
+	int ret = 0;
+	struct qtee_shm in_shm = {0}, out_shm = {0};
+
+	ret = qtee_shmbridge_allocate_shm(SMCINVOKE_TZ_MIN_BUF_SIZE, &in_shm);
+	if (ret) {
+		ret = -ENOMEM;
+		pr_err("shmbridge alloc failed for in msg in object release\n");
+		goto out;
+	}
+
+	ret = qtee_shmbridge_allocate_shm(SMCINVOKE_TZ_MIN_BUF_SIZE, &out_shm);
+	if (ret) {
+		ret = -ENOMEM;
+		pr_err("shmbridge alloc failed for out msg in object release\n");
+		goto out;
+	}
+
+	do {
+		mutex_lock(&object_postprocess_lock);
+		if (list_empty(&g_object_postprocess)) {
+			mutex_unlock(&object_postprocess_lock);
+			break;
+		}
+		pos = g_object_postprocess.next;
+		entry = list_entry(pos, struct smcinvoke_object_release_pending_list, list);
+
+		list_del(pos);
+		mutex_unlock(&object_postprocess_lock);
+
+		if (entry) {
+			do {
+				ret = smcinvoke_release_tz_object(&in_shm, &out_shm,
+						entry->data.tzhandle,  entry->data.context_type);
+			} while (-EBUSY == ret);
+		} else {
+			pr_err("entry is NULL, pos:%#llx\n", (uint64_t)pos);
+		}
+		kfree_sensitive(entry);
+	} while (1);
+
+out:
+	qtee_shmbridge_free_shm(&in_shm);
+	qtee_shmbridge_free_shm(&out_shm);
+
+	return ret;
+}
+
+static void smcinvoke_start_adci_thread(void)
+{
+
+	int32_t  ret = OBJECT_ERROR;
+	int retry_count = 0;
+
+	ret = get_root_obj(&adci_rootEnv);
+	if (ret) {
+		pr_err("failed to get rootEnv for ADCI invoke thread. ret = %d\n", ret);
+		/*
+		 * Marking it Object_NULL in case of failure scenario in order to avoid
+		 * undefined behavior while relasing garbage adci_rootEnv object.
+		 */
+		adci_rootEnv = Object_NULL;
+		goto out;
+	}
+	/* Invoke call to QTEE which should never return if ADCI is supported */
+	pr_debug("Invoking adciAccept method in QTEE\n");
+	do {
+		ret = IClientEnv_adciAccept(adci_rootEnv);
+		if (ret == OBJECT_ERROR_BUSY) {
+			pr_err_ratelimited("Secure side is busy,will retry after 5 ms, retry_count = %d\n",
+							   retry_count);
+			msleep(SMCINVOKE_INTERFACE_BUSY_WAIT_MS);
+		}
+	} while ((ret == OBJECT_ERROR_BUSY) && (retry_count++ < SMCINVOKE_INTERFACE_MAX_RETRY));
+
+	if (ret == OBJECT_ERROR_INVALID)
+		pr_err("ADCI feature is not supported on this chipsets, ret = %d\n", ret);
+	else
+		pr_debug("Received response from QTEE, ret = %d\n", ret);
+out:
+	/*
+	 * Control should reach to this point only if ADCI feature is not supported
+	 * by QTEE (or) ADCI thread held in QTEE is released.
+	 */
+	Object_ASSIGN_NULL(adci_rootEnv);
+}
+
+static void __wakeup_postprocess_kthread(struct smcinvoke_worker_thread *smcinvoke)
+{
+	if (smcinvoke) {
+		atomic_set(&smcinvoke->postprocess_kthread_state,
+				POST_KT_WAKEUP);
+		wake_up_interruptible(&smcinvoke->postprocess_kthread_wq);
+	} else {
+		pr_err("Invalid smcinvoke pointer.\n");
+	}
+}
+
+
+static int smcinvoke_postprocess_kthread_func(void *data)
+{
+	struct smcinvoke_worker_thread *smcinvoke_wrk_trd = data;
+	static const char *const tag[] = {"shmbridge", "object", "adci", "invalid"};
+
+	if (!smcinvoke_wrk_trd) {
+		pr_err("Bad input.\n");
+		return -EINVAL;
+	}
+
+	while (!kthread_should_stop()) {
+		wait_event_interruptible(
+			smcinvoke_wrk_trd->postprocess_kthread_wq,
+			kthread_should_stop() ||
+			(atomic_read(&smcinvoke_wrk_trd->postprocess_kthread_state)
+			== POST_KT_WAKEUP));
+		switch (smcinvoke_wrk_trd->type) {
+		case SHMB_WORKER_THREAD:
+			pr_debug("kthread to %s postprocess is called %d\n",
+					tag[SHMB_WORKER_THREAD],
+					atomic_read(&smcinvoke_wrk_trd->postprocess_kthread_state));
+			smcinvoke_shmbridge_post_process();
+			break;
+		case OBJECT_WORKER_THREAD:
+			pr_debug("kthread to %s postprocess is called %d\n",
+					tag[OBJECT_WORKER_THREAD],
+					atomic_read(&smcinvoke_wrk_trd->postprocess_kthread_state));
+			smcinvoke_object_post_process();
+			break;
+		case ADCI_WORKER_THREAD:
+			pr_debug("kthread to %s postprocess is called %d\n",
+					tag[ADCI_WORKER_THREAD],
+					atomic_read(&smcinvoke_wrk_trd->postprocess_kthread_state));
+			smcinvoke_start_adci_thread();
+			break;
+		default:
+			pr_err("Invalid thread type(%d), do nothing.\n",
+					(int)smcinvoke_wrk_trd->type);
+			break;
+		}
+		/* For ADCI thread, if control reaches here, that indicates either ADCI
+		 * thread is not supported (or) released by QTEE. Since ADCI thread is
+		 * getting signaled only during the smcinvoke driver initialization,
+		 * there is no point of putting the thread into sleep state again. All the
+		 * required post-processing will be taken care by object and shmbridge threads.
+		 */
+		if (smcinvoke_wrk_trd->type == ADCI_WORKER_THREAD)
+			break;
+
+		atomic_set(&smcinvoke_wrk_trd->postprocess_kthread_state,
+			POST_KT_SLEEP);
+	}
+	pr_warn("kthread(worker_thread) processed, worker_thread type is %d\n",
+			smcinvoke_wrk_trd->type);
+
+	return 0;
+}
+
+static int smcinvoke_create_kthreads(void)
+{
+	int i, rc = 0;
+	const enum worker_thread_type thread_type[MAX_THREAD_NUMBER] = {
+		SHMB_WORKER_THREAD, OBJECT_WORKER_THREAD, ADCI_WORKER_THREAD};
+
+	for (i = 0; i < MAX_THREAD_NUMBER; i++) {
+		init_waitqueue_head(&smcinvoke[i].postprocess_kthread_wq);
+		smcinvoke[i].type = thread_type[i];
+		smcinvoke[i].postprocess_kthread_task = kthread_run(
+				smcinvoke_postprocess_kthread_func,
+				&smcinvoke[i], thread_name[i]);
+		if (IS_ERR(smcinvoke[i].postprocess_kthread_task)) {
+			rc = PTR_ERR(smcinvoke[i].postprocess_kthread_task);
+			pr_err("fail to create kthread to postprocess, rc = %x\n", rc);
+			return rc;
+		}
+		atomic_set(&smcinvoke[i].postprocess_kthread_state,
+				POST_KT_SLEEP);
+	}
+	return rc;
+}
+
+static void smcinvoke_destroy_kthreads(void)
+{
+	int i;
+	int32_t  ret = OBJECT_ERROR;
+	int retry_count = 0;
+
+	if (!Object_isNull(adci_rootEnv)) {
+		pr_debug("Invoking adciShutdown method in QTEE\n");
+		do {
+			ret = IClientEnv_adciShutdown(adci_rootEnv);
+			if (ret == OBJECT_ERROR_BUSY) {
+				pr_err_ratelimited(
+						"Secure side is busy,will retry after 5 ms, retry_count = %d\n",
+						retry_count);
+				msleep(SMCINVOKE_INTERFACE_BUSY_WAIT_MS);
+			}
+		} while ((ret == OBJECT_ERROR_BUSY) &&
+				 (retry_count++ < SMCINVOKE_INTERFACE_MAX_RETRY));
+		if (OBJECT_isERROR(ret))
+			pr_err("adciShutdown in QTEE failed with error = %d\n", ret);
+
+		Object_ASSIGN_NULL(adci_rootEnv);
+	}
+
+	for (i = 0; i < MAX_THREAD_NUMBER; i++)
+		kthread_stop(smcinvoke[i].postprocess_kthread_task);
+}
+
+/* Queue newly created memory object to l_pending_mem_obj list.
+ * Later, the mapping information for objects in this list will be sent to TZ
+ * over the async side channel.
+ *
+ * No return value as TZ is always able to explicitly ask for this information
+ * in case this function fails and the memory object is not added to this list.
+ */
+static void queue_mem_obj_pending_async_locked(struct smcinvoke_mem_obj *mem_obj,
+		struct list_head *l_pending_mem_obj)
+{
+	struct smcinvoke_mem_obj_pending_async *t_mem_obj_pending =
+			kzalloc(sizeof(*t_mem_obj_pending), GFP_KERNEL);
+
+	/*
+	 * We are not failing execution in case of a failure here,
+	 * since TZ can always ask for this information explicitly
+	 * if it's not available in the side channel.
+	 */
+	if (!t_mem_obj_pending) {
+		pr_err("Unable to allocate memory\n");
+		return;
+	}
+
+	t_mem_obj_pending->mem_obj = mem_obj;
+	list_add(&t_mem_obj_pending->list, l_pending_mem_obj);
+}
+
+static inline void free_mem_obj_locked(struct smcinvoke_mem_obj *mem_obj)
+{
+	int ret = 0;
+	struct dma_buf *dmabuf_to_free = mem_obj->dma_buf;
+	uint64_t shmbridge_handle = mem_obj->shmbridge_handle;
+	struct smcinvoke_shmbridge_deregister_pending_list *entry = NULL;
+
+	list_del(&mem_obj->list);
+	kfree(mem_obj->server);
+	kfree(mem_obj);
+	mem_obj = NULL;
+	mutex_unlock(&g_smcinvoke_lock);
+
+	if (shmbridge_handle)
+		ret = qtee_shmbridge_deregister(shmbridge_handle);
+	if (ret) {
+		pr_err("Error:%d delete bridge failed leaking memory 0x%p\n",
+				ret, dmabuf_to_free);
+		if (ret == -EBUSY) {
+			pr_err("EBUSY: we postpone it 0x%p\n",
+					dmabuf_to_free);
+			entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+			if (entry) {
+				entry->data.shmbridge_handle = shmbridge_handle;
+				entry->data.dmabuf_to_free = dmabuf_to_free;
+				mutex_lock(&bridge_postprocess_lock);
+				list_add_tail(&entry->list, &g_bridge_postprocess);
+				mutex_unlock(&bridge_postprocess_lock);
+				pr_debug("SHMBridge list: added a Handle:%#llx\n",
+						shmbridge_handle);
+				__wakeup_postprocess_kthread(
+						&smcinvoke[SHMB_WORKER_THREAD]);
+			}
+		}
+	} else {
+		dma_buf_put(dmabuf_to_free);
+	}
+
+	mutex_lock(&g_smcinvoke_lock);
+}
+
+static void del_mem_regn_obj_locked(struct kref *kref)
+{
+	struct smcinvoke_mem_obj *mem_obj = container_of(kref,
+			struct smcinvoke_mem_obj, mem_regn_ref_cnt);
+
+	/*
+	 * mem_regn obj and mem_map obj are held into mem_obj structure which
+	 * can't be released until both kinds of objs have been released.
+	 * So check whether mem_map iobj has ref 0 and only then release mem_obj
+	 */
+	if (kref_read(&mem_obj->mem_map_obj_ref_cnt) == 0)
+		free_mem_obj_locked(mem_obj);
+}
+
+static void del_mem_map_obj_locked(struct kref *kref)
+{
+	struct smcinvoke_mem_obj *mem_obj = container_of(kref,
+			struct smcinvoke_mem_obj, mem_map_obj_ref_cnt);
+
+	mem_obj->p_addr_len = 0;
+	mem_obj->p_addr = 0;
+	if (mem_obj->sgt)
+		dma_buf_unmap_attachment(mem_obj->buf_attach,
+				mem_obj->sgt, DMA_BIDIRECTIONAL);
+	if (mem_obj->buf_attach)
+		dma_buf_detach(mem_obj->dma_buf, mem_obj->buf_attach);
+
+	/*
+	 * mem_regn obj and mem_map obj are held into mem_obj structure which
+	 * can't be released until both kinds of objs have been released.
+	 * So check if mem_regn obj has ref 0 and only then release mem_obj
+	 */
+	if (kref_read(&mem_obj->mem_regn_ref_cnt) == 0)
+		free_mem_obj_locked(mem_obj);
+}
+
+static int release_mem_obj_locked(int32_t tzhandle)
+{
+	int is_mem_regn_obj = TZHANDLE_IS_MEM_RGN_OBJ(tzhandle);
+	struct smcinvoke_mem_obj *mem_obj = find_mem_obj_locked(
+			TZHANDLE_GET_OBJID(tzhandle), is_mem_regn_obj);
+
+	if (!mem_obj) {
+		pr_err("memory object not found\n");
+		return OBJECT_ERROR_BADOBJ;
+	}
+
+	if (is_mem_regn_obj)
+		kref_put(&mem_obj->mem_regn_ref_cnt, del_mem_regn_obj_locked);
+	else
+		kref_put(&mem_obj->mem_map_obj_ref_cnt, del_mem_map_obj_locked);
+	return OBJECT_OK;
+}
+
+static void free_pending_cbobj_locked(struct kref *kref)
+{
+	struct smcinvoke_server_info *server = NULL;
+	struct smcinvoke_cbobj *obj = container_of(kref,
+			struct smcinvoke_cbobj, ref_cnt);
+	list_del(&obj->list);
+	server = obj->server;
+	kfree(obj);
+	if (server)
+		kref_put(&server->ref_cnt, destroy_cb_server);
+}
+
+static int get_pending_cbobj_locked(uint16_t srvr_id, int16_t obj_id)
+{
+	int ret = 0;
+	bool release_server = true;
+	struct list_head *head = NULL;
+	struct smcinvoke_cbobj *cbobj = NULL;
+	struct smcinvoke_cbobj *obj = NULL;
+	struct smcinvoke_server_info *server = get_cb_server_locked(srvr_id);
+
+	if (!server) {
+		pr_err("%s, server id : %u not found\n", __func__, srvr_id);
+		return OBJECT_ERROR_BADOBJ;
+	}
+
+	head = &server->pending_cbobjs;
+	list_for_each_entry(cbobj, head, list)
+		if (cbobj->cbobj_id == obj_id) {
+			kref_get(&cbobj->ref_cnt);
+			goto out;
+		}
+
+	obj = kzalloc(sizeof(*obj), GFP_KERNEL);
+	if (!obj) {
+		ret = OBJECT_ERROR_KMEM;
+		goto out;
+	}
+
+	obj->cbobj_id = obj_id;
+	kref_init(&obj->ref_cnt);
+	obj->server = server;
+	/*
+	 * we are holding server ref in cbobj; we will
+	 * release server ref when cbobj is destroyed
+	 */
+	release_server = false;
+	list_add_tail(&obj->list, head);
+out:
+	if (release_server)
+		kref_put(&server->ref_cnt, destroy_cb_server);
+	return ret;
+}
+
+static int put_pending_cbobj_locked(uint16_t srvr_id, int16_t obj_id)
+{
+	int ret = -EINVAL;
+	struct smcinvoke_server_info *srvr_info =
+			get_cb_server_locked(srvr_id);
+	struct list_head *head = NULL;
+	struct smcinvoke_cbobj *cbobj = NULL;
+
+	if (!srvr_info) {
+		pr_err("%s, server id : %u not found\n", __func__, srvr_id);
+		return ret;
+	}
+
+	trace_put_pending_cbobj_locked(srvr_id, obj_id);
+
+	head = &srvr_info->pending_cbobjs;
+	list_for_each_entry(cbobj, head, list)
+		if (cbobj->cbobj_id == obj_id) {
+			kref_put(&cbobj->ref_cnt, free_pending_cbobj_locked);
+			ret = 0;
+			break;
+		}
+	kref_put(&srvr_info->ref_cnt, destroy_cb_server);
+	return ret;
+}
+
+static int release_tzhandle_locked(int32_t tzhandle)
+{
+	if (TZHANDLE_IS_MEM_OBJ(tzhandle))
+		return release_mem_obj_locked(tzhandle);
+	else if (TZHANDLE_IS_CB_OBJ(tzhandle))
+		return put_pending_cbobj_locked(TZHANDLE_GET_SERVER(tzhandle),
+				TZHANDLE_GET_OBJID(tzhandle));
+	return OBJECT_ERROR;
+}
+
+static void release_tzhandles(const int32_t *tzhandles, size_t len)
+{
+	size_t i;
+
+	mutex_lock(&g_smcinvoke_lock);
+	for (i = 0; i < len; i++)
+		release_tzhandle_locked(tzhandles[i]);
+	mutex_unlock(&g_smcinvoke_lock);
+}
+
+static void delete_cb_txn_locked(struct kref *kref)
+{
+	struct smcinvoke_cb_txn *cb_txn = container_of(kref,
+			struct smcinvoke_cb_txn, ref_cnt);
+
+	if (OBJECT_OP_METHODID(cb_txn->cb_req->hdr.op) == OBJECT_OP_RELEASE)
+		release_tzhandle_locked(cb_txn->cb_req->hdr.tzhandle);
+
+	kfree(cb_txn->cb_req);
+	hash_del(&cb_txn->hash);
+	kfree(cb_txn);
+}
+
+static struct smcinvoke_cb_txn *find_cbtxn_locked(
+		struct smcinvoke_server_info *server,
+		uint32_t txn_id, int32_t state)
+{
+	int i = 0;
+	struct smcinvoke_cb_txn *cb_txn = NULL;
+
+	/*
+	 * Since HASH_BITS() does not work on pointers, we can't select hash
+	 * table using state and loop over it.
+	 */
+	if (state == SMCINVOKE_REQ_PLACED) {
+		/* pick up 1st req */
+		hash_for_each(server->reqs_table, i, cb_txn, hash) {
+			kref_get(&cb_txn->ref_cnt);
+			hash_del(&cb_txn->hash);
+			return cb_txn;
+		}
+	} else if (state == SMCINVOKE_REQ_PROCESSING) {
+		hash_for_each_possible(
+				server->responses_table, cb_txn, hash, txn_id) {
+			if (cb_txn->txn_id == txn_id) {
+				kref_get(&cb_txn->ref_cnt);
+				hash_del(&cb_txn->hash);
+				return cb_txn;
+			}
+		}
+	}
+	return NULL;
+}
+
+/*
+ * size_add_ saturates at SIZE_MAX. If integer overflow is detected,
+ * this function would return SIZE_MAX otherwise normal a+b is returned.
+ */
+static inline size_t size_add_(size_t a, size_t b)
+{
+	return (b > (SIZE_MAX - a)) ? SIZE_MAX : a + b;
+}
+/*
+ * pad_size is used along with size_align to define a buffer overflow
+ * protected version of ALIGN
+ */
+static inline size_t pad_size(size_t a, size_t b)
+{
+	return (~a + 1) % b;
+}
+
+/*
+ * size_align saturates at SIZE_MAX. If integer overflow is detected, this
+ * function would return SIZE_MAX otherwise next aligned size is returned.
+ */
+static inline size_t size_align(size_t a, size_t b)
+{
+	return size_add_(a, pad_size(a, b));
+}
+
+static uint16_t get_server_id(int cb_server_fd)
+{
+	uint16_t server_id = 0;
+	struct smcinvoke_file_data *svr_cxt = NULL;
+	struct file *tmp_filp = fget(cb_server_fd);
+
+	if (!tmp_filp || !FILE_IS_REMOTE_OBJ(tmp_filp))
+		return server_id;
+
+	svr_cxt = tmp_filp->private_data;
+	if (svr_cxt && svr_cxt->context_type == SMCINVOKE_OBJ_TYPE_SERVER)
+		server_id = svr_cxt->server_id;
+	fput(tmp_filp);
+
+	return server_id;
+}
+
+static bool is_dma_fd(int32_t uhandle, struct dma_buf **dma_buf)
+{
+	*dma_buf = dma_buf_get(uhandle);
+	return IS_ERR_OR_NULL(*dma_buf) ? false : true;
+}
+
+static bool is_remote_obj(int32_t uhandle, struct smcinvoke_file_data **tzobj,
+		struct file **filp)
+{
+	bool ret = false;
+	struct file *tmp_filp = fget(uhandle);
+
+	if (!tmp_filp)
+		return ret;
+
+	if (FILE_IS_REMOTE_OBJ(tmp_filp)) {
+		*tzobj = tmp_filp->private_data;
+		if ((*tzobj)->context_type == SMCINVOKE_OBJ_TYPE_TZ_OBJ) {
+			*filp = tmp_filp;
+			tmp_filp = NULL;
+			ret = true;
+		}
+	}
+
+	if (tmp_filp)
+		fput(tmp_filp);
+	return ret;
+}
+
+static int smcinvoke_create_bridge(struct smcinvoke_mem_obj *mem_obj)
+{
+	int ret = 0;
+	uint32_t *vmid_list = NULL;
+	uint32_t *perms_list = NULL;
+	uint32_t nelems = 0;
+	uint32_t ns_vm_ids_hyp[] = {};
+	uint32_t ns_vm_ids_hlos[] = {QCOM_SCM_VMID_HLOS};
+	uint32_t ns_vm_perms[] = {QCOM_SCM_PERM_RW};
+	struct dma_buf *dmabuf = mem_obj->dma_buf;
+	phys_addr_t phys = mem_obj->p_addr;
+	size_t size = mem_obj->p_addr_len;
+	bool allocation_from_mem_buf = false;
+
+	if (!qtee_shmbridge_is_enabled())
+		return 0;
+
+	/*
+	 * 1. Check mem-buf is available or not.
+	 * 2. If mem-buf API fails, then read the DT property.
+	 *	2.1 If property is defined, pick HYP(0x0) VM for automotive targets.
+	 *	2.2 If undefined, pick HLOS(0x3) VM and then pass value to QTEE.
+	 */
+	ret = mem_buf_dma_buf_copy_vmperm(dmabuf, (int **)&vmid_list,
+					 (int **)&perms_list, (int *)&nelems);
+	if (ret) {
+		pr_debug("mem_buf copy_vmperm failure, ret=%d, registering with single VM\n", ret);
+		if (smci_support_hyp) {
+			vmid_list = ns_vm_ids_hyp;
+		} else {
+			nelems = 1;
+			vmid_list = ns_vm_ids_hlos;
+		}
+		perms_list = ns_vm_perms;
+	} else {
+		allocation_from_mem_buf = true;
+		if (mem_buf_dma_buf_exclusive_owner(dmabuf))
+			perms_list[0] = QCOM_SCM_PERM_RW;
+	}
+
+	ret = qtee_shmbridge_register(phys, size, vmid_list, perms_list, nelems,
+				      QCOM_SCM_PERM_RW, &mem_obj->shmbridge_handle);
+	if (ret) {
+		pr_err("creation of shm bridge for mem_region_id %d failed ret %d\n",
+				mem_obj->mem_region_id, ret);
+		goto exit;
+	}
+
+	trace_smcinvoke_create_bridge(mem_obj->shmbridge_handle, mem_obj->mem_region_id);
+exit:
+	if (allocation_from_mem_buf) {
+		kfree(perms_list);
+		kfree(vmid_list);
+	}
+	return ret;
+}
+
+/* Map memory region for a given memory object.
+ * Mapping information will be saved as part of the memory object structure.
+ */
+static int32_t smcinvoke_map_mem_region_locked(struct smcinvoke_mem_obj *mem_obj)
+{
+	int ret = OBJECT_OK;
+	struct dma_buf_attachment *buf_attach = NULL;
+	struct sg_table *sgt = NULL;
+
+	if (!mem_obj) {
+		pr_err("Invalid memory object\n");
+		return OBJECT_ERROR_BADOBJ;
+	}
+
+	if (!mem_obj->p_addr) {
+		kref_init(&mem_obj->mem_map_obj_ref_cnt);
+		buf_attach = dma_buf_attach(mem_obj->dma_buf,
+				&smcinvoke_pdev->dev);
+		if (IS_ERR(buf_attach)) {
+			ret = OBJECT_ERROR_KMEM;
+			pr_err("dma buf attach failed, ret: %d\n", ret);
+			goto out;
+		}
+		mem_obj->buf_attach = buf_attach;
+
+		sgt = dma_buf_map_attachment(buf_attach, DMA_BIDIRECTIONAL);
+		if (IS_ERR(sgt)) {
+			pr_err("mapping dma buffers failed, ret: %ld\n",
+					PTR_ERR(sgt));
+			ret = OBJECT_ERROR_KMEM;
+			goto out;
+		}
+		mem_obj->sgt = sgt;
+
+		/* contiguous only => nents=1 */
+		if (sgt->nents != 1) {
+			ret = OBJECT_ERROR_INVALID;
+			pr_err("sg enries are not contigous, ret: %d\n", ret);
+			goto out;
+		}
+		mem_obj->p_addr = sg_dma_address(sgt->sgl);
+		mem_obj->p_addr_len = sgt->sgl->length;
+		if (!mem_obj->p_addr) {
+			ret = OBJECT_ERROR_INVALID;
+			pr_err("invalid physical address, ret: %d\n", ret);
+			goto out;
+		}
+
+		/* Increase reference count as we are feeding the memobj to
+		 * smcinvoke and unlock the mutex. No need to hold the mutex in
+		 * case of shmbridge creation.
+		 */
+		kref_get(&mem_obj->mem_map_obj_ref_cnt);
+		mutex_unlock(&g_smcinvoke_lock);
+
+		ret = smcinvoke_create_bridge(mem_obj);
+
+		/* Take lock again and decrease the reference count which we
+		 * increased for shmbridge but before proceeding further we
+		 * have to check again if the memobj is still valid or not
+		 * after decreasing the reference.
+		 */
+		mutex_lock(&g_smcinvoke_lock);
+		kref_put(&mem_obj->mem_map_obj_ref_cnt, del_mem_map_obj_locked);
+
+		if (ret) {
+			ret = OBJECT_ERROR_INVALID;
+			pr_err("Unable to create shm bridge, ret: %d\n", ret);
+			goto out;
+		}
+
+		if (!find_mem_obj_locked(mem_obj->mem_region_id,
+				SMCINVOKE_MEM_RGN_OBJ)) {
+			pr_err("Memory object not found\n");
+			return OBJECT_ERROR_BADOBJ;
+		}
+
+		mem_obj->mem_map_obj_id = next_mem_map_obj_id_locked();
+	}
+
+out:
+	if (ret != OBJECT_OK)
+		kref_put(&mem_obj->mem_map_obj_ref_cnt, del_mem_map_obj_locked);
+	return ret;
+}
+
+static int create_mem_obj(struct dma_buf *dma_buf, int32_t *tzhandle,
+			struct smcinvoke_mem_obj **mem_obj, int32_t server_id, int32_t user_handle)
+{
+	struct smcinvoke_mem_obj *t_mem_obj = NULL;
+	struct smcinvoke_server_info *server_i = NULL;
+
+	t_mem_obj = kzalloc(sizeof(struct smcinvoke_mem_obj), GFP_KERNEL);
+	if (!t_mem_obj) {
+		dma_buf_put(dma_buf);
+		return -ENOMEM;
+	}
+	server_i = kzalloc(sizeof(struct smcinvoke_server_info), GFP_KERNEL);
+	if (!server_i) {
+		kfree(t_mem_obj);
+		dma_buf_put(dma_buf);
+		return -ENOMEM;
+	}
+	kref_init(&t_mem_obj->mem_regn_ref_cnt);
+	t_mem_obj->dma_buf = dma_buf;
+	mutex_lock(&g_smcinvoke_lock);
+	t_mem_obj->mem_region_id = next_mem_region_obj_id_locked();
+	server_i->server_id = server_id;
+	t_mem_obj->server = server_i;
+	t_mem_obj->mem_obj_user_fd = user_handle;
+	list_add_tail(&t_mem_obj->list, &g_mem_objs);
+	mutex_unlock(&g_smcinvoke_lock);
+	*mem_obj = t_mem_obj;
+	*tzhandle = TZHANDLE_MAKE_LOCAL(MEM_RGN_SRVR_ID,
+			t_mem_obj->mem_region_id);
+	return 0;
+}
+
+/*
+ * This function retrieves file pointer corresponding to FD provided. It stores
+ * retrieved file pointer until IOCTL call is concluded. Once call is completed,
+ * all stored file pointers are released. file pointers are stored to prevent
+ * other threads from releasing that FD while IOCTL is in progress.
+ */
+static int get_tzhandle_from_uhandle(int32_t uhandle, int32_t server_fd,
+		struct file **filp, uint32_t *tzhandle, struct list_head *l_pending_mem_obj)
+{
+	int ret = -EBADF;
+	uint16_t server_id = 0;
+	struct smcinvoke_mem_obj *mem_obj = NULL;
+
+	if (UHANDLE_IS_NULL(uhandle)) {
+		*tzhandle = SMCINVOKE_TZ_OBJ_NULL;
+		ret = 0;
+	} else if (UHANDLE_IS_CB_OBJ(uhandle)) {
+		server_id = get_server_id(server_fd);
+		if (server_id < CBOBJ_SERVER_ID_START)
+			goto out;
+
+		mutex_lock(&g_smcinvoke_lock);
+		ret = get_pending_cbobj_locked(server_id,
+					UHANDLE_GET_CB_OBJ(uhandle));
+		mutex_unlock(&g_smcinvoke_lock);
+		if (ret)
+			goto out;
+		*tzhandle = TZHANDLE_MAKE_LOCAL(server_id,
+				UHANDLE_GET_CB_OBJ(uhandle));
+		ret = 0;
+	} else if (UHANDLE_IS_FD(uhandle)) {
+		struct dma_buf *dma_buf = NULL;
+		struct smcinvoke_file_data *tzobj = NULL;
+
+		if (is_dma_fd(UHANDLE_GET_FD(uhandle), &dma_buf)) {
+			server_id = get_server_id(server_fd);
+			ret = create_mem_obj(dma_buf, tzhandle, &mem_obj, server_id, uhandle);
+			if (!ret && mem_obj_async_support && l_pending_mem_obj) {
+				mutex_lock(&g_smcinvoke_lock);
+				/* Map the newly created memory object and add it
+				 * to l_pending_mem_obj list.
+				 * Before returning to TZ, add the mapping data
+				 * to the async side channel so it's available to TZ
+				 * together with the memory object.
+				 */
+				if (!smcinvoke_map_mem_region_locked(mem_obj))
+					queue_mem_obj_pending_async_locked(mem_obj,
+							l_pending_mem_obj);
+				else
+					pr_err("Failed to map memory region\n");
+
+				mutex_unlock(&g_smcinvoke_lock);
+			}
+
+		} else if (is_remote_obj(UHANDLE_GET_FD(uhandle),
+				&tzobj, filp)) {
+			*tzhandle = tzobj->tzhandle;
+			ret = 0;
+		}
+	}
+out:
+	return ret;
+}
+
+static int get_fd_for_obj(uint32_t obj_type, uint32_t obj, int32_t *fd)
+{
+	int unused_fd = -1, ret = -EINVAL;
+	struct file *f = NULL;
+	struct smcinvoke_file_data *cxt = NULL;
+
+	cxt = kzalloc(sizeof(*cxt), GFP_KERNEL);
+	if (!cxt) {
+		ret = -ENOMEM;
+		goto out;
+	}
+	if (obj_type == SMCINVOKE_OBJ_TYPE_TZ_OBJ ||
+		obj_type == SMCINVOKE_OBJ_TYPE_TZ_OBJ_FOR_KERNEL) {
+		cxt->context_type = obj_type;
+		cxt->tzhandle = obj;
+	} else if (obj_type == SMCINVOKE_OBJ_TYPE_SERVER) {
+		cxt->context_type = SMCINVOKE_OBJ_TYPE_SERVER;
+		cxt->server_id = obj;
+	} else {
+		goto out;
+	}
+
+	unused_fd = get_unused_fd_flags(O_RDWR);
+	if (unused_fd < 0)
+		goto out;
+
+	if (fd == NULL)
+		goto out;
+
+	f = anon_inode_getfile(SMCINVOKE_DEV, &g_smcinvoke_fops, cxt, O_RDWR);
+	if (IS_ERR(f))
+		goto out;
+
+	*fd = unused_fd;
+	fd_install(*fd, f);
+	return 0;
+out:
+	if (unused_fd >= 0)
+		put_unused_fd(unused_fd);
+	kfree(cxt);
+
+	return ret;
+}
+
+static int get_uhandle_from_tzhandle(int32_t tzhandle, int32_t srvr_id,
+		int32_t *uhandle, bool lock, uint32_t context_type)
+{
+	int ret = -1;
+
+	if (TZHANDLE_IS_NULL(tzhandle)) {
+		*uhandle = UHANDLE_NULL;
+		ret = 0;
+	} else if (TZHANDLE_IS_CB_OBJ(tzhandle)) {
+		if (srvr_id != TZHANDLE_GET_SERVER(tzhandle))
+			goto out;
+		*uhandle = UHANDLE_MAKE_CB_OBJ(TZHANDLE_GET_OBJID(tzhandle));
+		MUTEX_LOCK(lock)
+		ret = get_pending_cbobj_locked(TZHANDLE_GET_SERVER(tzhandle),
+				TZHANDLE_GET_OBJID(tzhandle));
+		MUTEX_UNLOCK(lock)
+	} else if (TZHANDLE_IS_MEM_RGN_OBJ(tzhandle)) {
+		struct smcinvoke_mem_obj *mem_obj = NULL;
+
+		MUTEX_LOCK(lock)
+		mem_obj = find_mem_obj_locked(TZHANDLE_GET_OBJID(tzhandle),
+				SMCINVOKE_MEM_RGN_OBJ);
+
+		if (mem_obj != NULL) {
+			int fd;
+
+			fd = mem_obj->mem_obj_user_fd;
+			if (fd < 0)
+				goto exit_lock;
+			*uhandle = fd;
+			ret = 0;
+		}
+exit_lock:
+		MUTEX_UNLOCK(lock)
+	} else if (TZHANDLE_IS_REMOTE(tzhandle)) {
+		/* if execution comes here => tzhandle is an unsigned int */
+		ret = get_fd_for_obj(context_type,
+				(uint32_t)tzhandle, uhandle);
+	}
+out:
+	return ret;
+}
+
+static int32_t smcinvoke_release_mem_obj_locked(void *buf, size_t buf_len)
+{
+	struct smcinvoke_tzcb_req *msg = buf;
+
+	if (msg->hdr.counts != OBJECT_COUNTS_PACK(0, 0, 0, 0)) {
+		pr_err("Invalid object count in %s\n", __func__);
+		return OBJECT_ERROR_INVALID;
+	}
+
+	trace_release_mem_obj_locked(msg->hdr.tzhandle, buf_len);
+
+	return release_tzhandle_locked(msg->hdr.tzhandle);
+}
+
+static int32_t smcinvoke_process_map_mem_region_req(void *buf, size_t buf_len)
+{
+	int ret = OBJECT_OK;
+	struct smcinvoke_tzcb_req *msg = buf;
+	struct {
+		uint64_t p_addr;
+		uint64_t len;
+		uint32_t perms;
+	} *ob = NULL;
+	int32_t *oo = NULL;
+	struct smcinvoke_mem_obj *mem_obj = NULL;
+
+	if (msg->hdr.counts != OBJECT_COUNTS_PACK(0, 1, 1, 1) ||
+			(buf_len - msg->args[0].b.offset < msg->args[0].b.size)) {
+		pr_err("Invalid counts received for mapping mem obj\n");
+		return OBJECT_ERROR_INVALID;
+	}
+	/* args[0] = BO, args[1] = OI, args[2] = OO */
+	ob = buf + msg->args[0].b.offset;
+	oo = &msg->args[2].handle;
+
+	mutex_lock(&g_smcinvoke_lock);
+	mem_obj = find_mem_obj_locked(TZHANDLE_GET_OBJID(msg->args[1].handle),
+			SMCINVOKE_MEM_RGN_OBJ);
+	if (!mem_obj) {
+		mutex_unlock(&g_smcinvoke_lock);
+		pr_err("Memory object not found\n");
+		return OBJECT_ERROR_BADOBJ;
+	}
+
+	if (!mem_obj->p_addr)
+		ret = smcinvoke_map_mem_region_locked(mem_obj);
+	else
+		kref_get(&mem_obj->mem_map_obj_ref_cnt);
+
+	if (!ret) {
+		ob->p_addr = mem_obj->p_addr;
+		ob->len = mem_obj->p_addr_len;
+		ob->perms = SMCINVOKE_MEM_PERM_RW;
+		*oo = TZHANDLE_MAKE_LOCAL(MEM_MAP_SRVR_ID, mem_obj->mem_map_obj_id);
+	}
+
+	mutex_unlock(&g_smcinvoke_lock);
+
+	return ret;
+}
+
+static int32_t smcinvoke_sleep(void *buf, size_t buf_len)
+{
+	struct smcinvoke_tzcb_req *msg = buf;
+	uint32_t sleepTimeMs_val = 0;
+
+	if (msg->hdr.counts != OBJECT_COUNTS_PACK(1, 0, 0, 0) ||
+		(buf_len - msg->args[0].b.offset < msg->args[0].b.size)) {
+		pr_err("Invalid counts received for sleeping in hlos\n");
+		return OBJECT_ERROR_INVALID;
+	}
+
+	/* Time in miliseconds is expected from tz */
+	sleepTimeMs_val = *((uint32_t *)(buf + msg->args[0].b.offset));
+	msleep(sleepTimeMs_val);
+	return OBJECT_OK;
+}
+
+static void process_kernel_obj(void *buf, size_t buf_len)
+{
+	struct smcinvoke_tzcb_req *cb_req = buf;
+
+	switch (cb_req->hdr.op) {
+	case OBJECT_OP_MAP_REGION:
+		if (mem_obj_async_support) {
+			/* Mapping requests are not supposed to come
+			 * from TZ once memory object async support
+			 * is enabled.
+			 * If they are still coming, we would like to
+			 * know about it.
+			 */
+			pr_info("Received a request to map memory region\n");
+		}
+		cb_req->result = smcinvoke_process_map_mem_region_req(buf, buf_len);
+		break;
+	case OBJECT_OP_YIELD:
+		cb_req->result = OBJECT_OK;
+		break;
+	case OBJECT_OP_SLEEP:
+		cb_req->result = smcinvoke_sleep(buf, buf_len);
+		break;
+	default:
+		pr_err(" invalid operation for tz kernel object\n");
+		cb_req->result = OBJECT_ERROR_INVALID;
+		break;
+	}
+}
+
+static void process_mem_obj(void *buf, size_t buf_len)
+{
+	struct smcinvoke_tzcb_req *cb_req = buf;
+
+	mutex_lock(&g_smcinvoke_lock);
+	cb_req->result = (cb_req->hdr.op == OBJECT_OP_RELEASE) ?
+			smcinvoke_release_mem_obj_locked(buf, buf_len) :
+			OBJECT_ERROR_INVALID;
+	mutex_unlock(&g_smcinvoke_lock);
+}
+
+static int invoke_cmd_handler(int cmd, phys_addr_t in_paddr, size_t in_buf_len,
+		uint8_t *out_buf, phys_addr_t out_paddr,
+		size_t out_buf_len, int32_t *result, u64 *response_type,
+		unsigned int *data, struct qtee_shm *in_shm,
+		struct qtee_shm *out_shm)
+{
+	int ret = 0;
+
+	switch (cmd) {
+	case SMCINVOKE_INVOKE_CMD_LEGACY:
+		qtee_shmbridge_flush_shm_buf(in_shm);
+		qtee_shmbridge_flush_shm_buf(out_shm);
+		ret = qcom_scm_invoke_smc_legacy(in_paddr, in_buf_len, out_paddr, out_buf_len,
+				result, response_type, data);
+		qtee_shmbridge_inv_shm_buf(in_shm);
+		qtee_shmbridge_inv_shm_buf(out_shm);
+		break;
+
+	case SMCINVOKE_INVOKE_CMD:
+		ret = qcom_scm_invoke_smc(in_paddr, in_buf_len, out_paddr, out_buf_len,
+				result, response_type, data);
+		break;
+
+	case SMCINVOKE_CB_RSP_CMD:
+		if (legacy_smc_call)
+			qtee_shmbridge_flush_shm_buf(out_shm);
+		ret = qcom_scm_invoke_callback_response(virt_to_phys(out_buf), out_buf_len,
+				result, response_type, data);
+		if (legacy_smc_call) {
+			qtee_shmbridge_inv_shm_buf(in_shm);
+			qtee_shmbridge_inv_shm_buf(out_shm);
+		}
+		break;
+
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	trace_invoke_cmd_handler(cmd, *response_type, *result, ret);
+	return ret;
+}
+/*
+ * Buf should be aligned to struct smcinvoke_tzcb_req
+ */
+static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp)
+{
+	/* ret is going to TZ. Provide values from OBJECT_ERROR_<> */
+	int ret = OBJECT_ERROR_DEFUNCT;
+	int cbobj_retries = 0;
+	long timeout_jiff;
+	bool wait_interrupted = false;
+	struct smcinvoke_cb_txn *cb_txn = NULL;
+	struct smcinvoke_tzcb_req *cb_req = NULL, *tmp_cb_req = NULL;
+	struct smcinvoke_server_info *srvr_info = NULL;
+	struct smcinvoke_mem_obj *mem_obj = NULL;
+	uint16_t server_id = 0;
+
+	if (buf_len < sizeof(struct smcinvoke_tzcb_req)) {
+		pr_err("smaller buffer length : %zu\n", buf_len);
+		return;
+	}
+
+	cb_req = buf;
+
+	/* check whether it is to be served by kernel or userspace */
+	if (TZHANDLE_IS_KERNEL_OBJ(cb_req->hdr.tzhandle)) {
+		return process_kernel_obj(buf, buf_len);
+	} else if (TZHANDLE_IS_MEM_MAP_OBJ(cb_req->hdr.tzhandle)) {
+		/*
+		 * MEM_MAP memory object is created and owned by kernel,
+		 * hence its processing(handling deletion) is done in
+		 * kernel context.
+		 */
+		return process_mem_obj(buf, buf_len);
+	} else if (TZHANDLE_IS_MEM_RGN_OBJ(cb_req->hdr.tzhandle)) {
+		/*
+		 * MEM_RGN memory objects are created and owned by userspace,
+		 * and hence their deletion/handling requires going back to the
+		 * userspace, similar to that of callback objects. If we enter
+		 * this 'if' condition, its no-op here, and proceed similar to
+		 * case of callback objects.
+		 */
+	} else if (!TZHANDLE_IS_CB_OBJ(cb_req->hdr.tzhandle)) {
+		pr_err("Request object is not a callback object %x\n",
+			cb_req->hdr.tzhandle);
+		cb_req->result = OBJECT_ERROR_INVALID;
+		return;
+	}
+
+	/*
+	 * We need a copy of req that could be sent to server. Otherwise, if
+	 * someone kills invoke caller, buf would go away and server would be
+	 * working on already freed buffer, causing a device crash.
+	 */
+	tmp_cb_req = kmemdup(buf, buf_len, GFP_KERNEL);
+	if (!tmp_cb_req) {
+		/* we need to return error to caller so fill up result */
+		cb_req->result = OBJECT_ERROR_KMEM;
+		pr_err("failed to create copy of request, set result: %d\n",
+				cb_req->result);
+		return;
+	}
+
+	cb_txn = kzalloc(sizeof(*cb_txn), GFP_KERNEL);
+	if (!cb_txn) {
+		cb_req->result = OBJECT_ERROR_KMEM;
+		pr_err("failed to allocate memory for request, result: %d\n",
+				cb_req->result);
+		kfree(tmp_cb_req);
+		return;
+	}
+	/* no need for memcpy as we did kmemdup() above */
+	cb_req = tmp_cb_req;
+
+	trace_process_tzcb_req_handle(cb_req->hdr.tzhandle, cb_req->hdr.op, cb_req->hdr.counts);
+
+	cb_txn->state = SMCINVOKE_REQ_PLACED;
+	cb_txn->cb_req = cb_req;
+	cb_txn->cb_req_bytes = buf_len;
+	cb_txn->filp_to_release = arr_filp;
+	kref_init(&cb_txn->ref_cnt);
+
+	mutex_lock(&g_smcinvoke_lock);
+	++cb_reqs_inflight;
+
+	if (TZHANDLE_IS_MEM_RGN_OBJ(cb_req->hdr.tzhandle)) {
+		mem_obj = find_mem_obj_locked(TZHANDLE_GET_OBJID(cb_req->hdr.tzhandle),
+				SMCINVOKE_MEM_RGN_OBJ);
+		if (!mem_obj) {
+			pr_err("mem obj with tzhandle : %d not found\n", cb_req->hdr.tzhandle);
+			mutex_unlock(&g_smcinvoke_lock);
+			goto out;
+		}
+		server_id = mem_obj->server->server_id;
+	} else
+		server_id = TZHANDLE_GET_SERVER(cb_req->hdr.tzhandle);
+
+	srvr_info = get_cb_server_locked(server_id);
+	if (!srvr_info || srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT) {
+		/* ret equals Object_ERROR_DEFUNCT, at this point go to out */
+		if (!srvr_info)
+			pr_err("server is invalid\n");
+		else
+			pr_err("server is defunct, state= %d tzhandle = %d\n",
+					srvr_info->state, cb_req->hdr.tzhandle);
+
+		mutex_unlock(&g_smcinvoke_lock);
+		goto out;
+	}
+
+	cb_txn->txn_id = ++srvr_info->txn_id;
+	hash_add(srvr_info->reqs_table, &cb_txn->hash, cb_txn->txn_id);
+	mutex_unlock(&g_smcinvoke_lock);
+
+	trace_process_tzcb_req_wait(cb_req->hdr.tzhandle, cbobj_retries, cb_txn->txn_id,
+			current->pid, current->tgid, srvr_info->state, srvr_info->server_id,
+			cb_reqs_inflight);
+	/*
+	 * we need not worry that server_info will be deleted because as long
+	 * as this CBObj is served by this server, srvr_info will be valid.
+	 */
+	wake_up_interruptible_all(&srvr_info->req_wait_q);
+	/* timeout before 1s otherwise tzbusy would come */
+	timeout_jiff = msecs_to_jiffies(100);
+
+	while (cbobj_retries < CBOBJ_MAX_RETRIES) {
+		if (wait_interrupted) {
+			ret = wait_event_timeout(srvr_info->rsp_wait_q,
+					(cb_txn->state == SMCINVOKE_REQ_PROCESSED) ||
+					(srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT),
+					timeout_jiff);
+		} else {
+			ret = wait_event_interruptible_timeout(srvr_info->rsp_wait_q,
+					(cb_txn->state == SMCINVOKE_REQ_PROCESSED) ||
+					(srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT),
+					timeout_jiff);
+		}
+		if (ret == 0) {
+			if (srvr_info->is_server_suspended == 0) {
+				tzcb_err_ratelimited("CBobj timed out waiting on cbtxn :%d,cb-tzhandle:%d, retry:%d, op:%d counts :%d\n",
+						cb_txn->txn_id, cb_req->hdr.tzhandle, cbobj_retries,
+						cb_req->hdr.op, cb_req->hdr.counts);
+				tzcb_err_ratelimited("CBobj %d timedout pid %x,tid %x, srvr state=%d, srvr id:%u\n",
+						cb_req->hdr.tzhandle, current->pid,
+						current->tgid, srvr_info->state,
+						srvr_info->server_id);
+			}
+		} else {
+			/* wait_event returned due to a signal */
+			if (srvr_info->state != SMCINVOKE_SERVER_STATE_DEFUNCT &&
+					cb_txn->state != SMCINVOKE_REQ_PROCESSED) {
+				wait_interrupted = true;
+			} else
+				break;
+		}
+		/*
+		 * If bit corresponding to any accept thread is set, invoke threads
+		 * should wait infinitely for the accept thread to come back with
+		 * response.
+		 */
+		if (srvr_info->is_server_suspended > 0)
+			cbobj_retries = 0;
+		else
+			cbobj_retries++;
+	}
+
+out:
+	/*
+	 * we could be here because of either:
+	 * a. Req is PROCESSED
+	 * b. Server was killed
+	 * c. Invoke thread is killed
+	 * sometime invoke thread and server are part of same process.
+	 */
+	mutex_lock(&g_smcinvoke_lock);
+	hash_del(&cb_txn->hash);
+	if (ret == 0) {
+		pr_err("CBObj timed out! No more retries\n");
+		cb_req->result = Object_ERROR_TIMEOUT;
+	} else if (ret == -ERESTARTSYS) {
+		pr_err("wait event interruped, ret: %d\n", ret);
+		cb_req->result = OBJECT_ERROR_ABORT;
+	} else {
+		if (cb_txn->state == SMCINVOKE_REQ_PROCESSED) {
+			/*
+			 * it is possible that server was killed immediately
+			 * after CB Req was processed but who cares now!
+			 */
+		} else if (!srvr_info ||
+			srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT) {
+			cb_req->result = OBJECT_ERROR_DEFUNCT;
+			pr_err("server invalid, res: %d\n", cb_req->result);
+		} else {
+			pr_err("%s: unexpected event happened, ret:%d\n", __func__, ret);
+			cb_req->result = OBJECT_ERROR_ABORT;
+		}
+	}
+	--cb_reqs_inflight;
+
+	trace_process_tzcb_req_result(cb_req->result, cb_req->hdr.tzhandle, cb_req->hdr.op,
+			cb_req->hdr.counts, cb_reqs_inflight);
+
+	memcpy(buf, cb_req, buf_len);
+
+	kref_put(&cb_txn->ref_cnt, delete_cb_txn_locked);
+	if (srvr_info)
+		kref_put(&srvr_info->ref_cnt, destroy_cb_server);
+	mutex_unlock(&g_smcinvoke_lock);
+}
+
+static int marshal_out_invoke_req(const uint8_t *buf, uint32_t buf_size,
+		struct smcinvoke_cmd_req *req,
+		union smcinvoke_arg *args_buf,
+		uint32_t context_type)
+{
+	int ret = -EINVAL, i = 0;
+	int32_t temp_fd = UHANDLE_NULL;
+	union smcinvoke_tz_args *tz_args = NULL;
+	size_t offset = sizeof(struct smcinvoke_msg_hdr) +
+			OBJECT_COUNTS_TOTAL(req->counts) *
+			sizeof(union smcinvoke_tz_args);
+
+	if (offset > buf_size)
+		goto out;
+
+	tz_args = (union smcinvoke_tz_args *)
+			(buf + sizeof(struct smcinvoke_msg_hdr));
+
+	tz_args += OBJECT_COUNTS_NUM_BI(req->counts);
+
+	if (args_buf == NULL)
+		return 0;
+
+	FOR_ARGS(i, req->counts, BO) {
+		args_buf[i].b.size = tz_args->b.size;
+		if ((buf_size - tz_args->b.offset < tz_args->b.size) ||
+				tz_args->b.offset > buf_size) {
+			pr_err("%s: buffer overflow detected\n", __func__);
+			goto out;
+		}
+		if (context_type == SMCINVOKE_OBJ_TYPE_TZ_OBJ) {
+			if (copy_to_user((void __user *)
+					(uintptr_t)(args_buf[i].b.addr),
+					(uint8_t *)(buf) + tz_args->b.offset,
+					tz_args->b.size)) {
+				pr_err("Error %d copying ctxt to user\n", ret);
+				goto out;
+			}
+		} else {
+			memcpy((uint8_t *)(args_buf[i].b.addr),
+					(uint8_t *)(buf) + tz_args->b.offset,
+					tz_args->b.size);
+		}
+		tz_args++;
+	}
+	tz_args += OBJECT_COUNTS_NUM_OI(req->counts);
+
+	FOR_ARGS(i, req->counts, OO) {
+		/*
+		 * create a new FD and assign to output object's context.
+		 * We are passing cb_server_fd from output param in case OO
+		 * is a CBObj. For CBObj, we have to ensure that it is sent
+		 * to server who serves it and that info comes from USpace.
+		 */
+		temp_fd = UHANDLE_NULL;
+
+		ret = get_uhandle_from_tzhandle(tz_args->handle,
+				TZHANDLE_GET_SERVER(tz_args->handle),
+				&temp_fd, NO_LOCK, context_type);
+
+		args_buf[i].o.fd = temp_fd;
+
+		if (ret)
+			goto out;
+
+		trace_marshal_out_invoke_req(i, tz_args->handle,
+				TZHANDLE_GET_SERVER(tz_args->handle), temp_fd);
+
+		tz_args++;
+	}
+	ret = 0;
+out:
+	return ret;
+}
+
+static bool is_inbound_req(int val)
+{
+	return (val == SMCINVOKE_RESULT_INBOUND_REQ_NEEDED
+#if IS_ENABLED(CONFIG_QSEECOM)
+		|| val == QSEOS_RESULT_INCOMPLETE
+		|| val == QSEOS_RESULT_BLOCKED_ON_LISTENER
+#endif
+	);
+}
+
+static void process_piggyback_cb_data(uint8_t *outbuf, size_t buf_len)
+{
+	struct smcinvoke_tzcb_req *msg = NULL;
+	uint32_t max_offset = 0;
+	uint32_t buffer_size_max_offset = 0;
+	void *piggyback_buf = NULL;
+	size_t piggyback_buf_size;
+	size_t piggyback_offset = 0;
+	int i = 0;
+
+	if (outbuf == NULL) {
+		pr_err("%s: outbuf is NULL\n", __func__);
+		return;
+	}
+
+	msg = (void *) outbuf;
+	if ((buf_len < msg->args[0].b.offset) ||
+		(buf_len - msg->args[0].b.offset < msg->args[0].b.size)) {
+		pr_err("%s: invalid scenario\n", __func__);
+		return;
+	}
+
+	FOR_ARGS(i, msg->hdr.counts, BI)
+	{
+		if (msg->args[i].b.offset > max_offset) {
+			max_offset = msg->args[i].b.offset;
+			buffer_size_max_offset = msg->args[i].b.size;
+		}
+	}
+
+	FOR_ARGS(i, msg->hdr.counts, BO)
+	{
+		if (msg->args[i].b.offset > max_offset) {
+			max_offset = msg->args[i].b.offset;
+			buffer_size_max_offset = msg->args[i].b.size;
+		}
+	}
+
+	//Take out the offset after BI and BO objects end
+	if (max_offset)
+		piggyback_offset = max_offset + buffer_size_max_offset;
+	else
+		piggyback_offset = TZCB_BUF_OFFSET(msg);
+
+	piggyback_offset = size_align(piggyback_offset, SMCINVOKE_ARGS_ALIGN_SIZE);
+
+	// Jump to piggy back data offset
+	piggyback_buf = (uint8_t *)msg + piggyback_offset;
+	piggyback_buf_size = g_max_cb_buf_size - piggyback_offset;
+
+	process_piggyback_data(piggyback_buf, piggyback_buf_size);
+}
+
+static int prepare_send_scm_msg(const uint8_t *in_buf, phys_addr_t in_paddr,
+		size_t in_buf_len,
+		uint8_t *out_buf, phys_addr_t out_paddr,
+		size_t out_buf_len,
+		struct smcinvoke_cmd_req *req,
+		union smcinvoke_arg *args_buf,
+		bool *tz_acked, uint32_t context_type,
+		struct qtee_shm *in_shm, struct qtee_shm *out_shm,
+		bool retry)
+{
+	int ret = 0, cmd, retry_count = 0;
+	u64 response_type;
+	unsigned int data;
+	struct file *arr_filp[OBJECT_COUNTS_MAX_OO] = {NULL};
+
+	*tz_acked = false;
+	/* buf size should be page aligned */
+	if ((in_buf_len % PAGE_SIZE) != 0 || (out_buf_len % PAGE_SIZE) != 0)
+		return -EINVAL;
+
+	cmd = invoke_cmd;
+
+	while (1) {
+		do {
+			ret = invoke_cmd_handler(cmd, in_paddr, in_buf_len, out_buf,
+					out_paddr, out_buf_len, &req->result,
+					&response_type, &data, in_shm, out_shm);
+
+			if (ret == -EBUSY) {
+				pr_err_ratelimited("Secure side is busy,will retry after 30 ms, retry_count = %d\n",
+						retry_count);
+				msleep(SMCINVOKE_SCM_EBUSY_WAIT_MS);
+			}
+
+		} while (retry && (ret == -EBUSY) &&
+				(retry_count++ < SMCINVOKE_SCM_EBUSY_MAX_RETRY));
+
+		if (!ret && !is_inbound_req(response_type)) {
+			/* dont marshal if Obj returns an error */
+			if (!req->result) {
+				if (args_buf != NULL)
+					ret = marshal_out_invoke_req(in_buf,
+							in_buf_len, req, args_buf,
+							context_type);
+			}
+			*tz_acked = true;
+		}
+
+		if (cmd == SMCINVOKE_CB_RSP_CMD)
+			release_filp(arr_filp, OBJECT_COUNTS_MAX_OO);
+
+		if (ret || !is_inbound_req(response_type))
+			break;
+
+#if IS_ENABLED(CONFIG_QSEECOM)
+		/* process listener request */
+		if (response_type == QSEOS_RESULT_INCOMPLETE ||
+				response_type == QSEOS_RESULT_BLOCKED_ON_LISTENER) {
+
+			ret = qseecom_process_listener_from_smcinvoke(
+					&req->result, &response_type, &data);
+
+			trace_prepare_send_scm_msg(response_type, req->result);
+
+			if (!req->result &&
+			response_type != SMCINVOKE_RESULT_INBOUND_REQ_NEEDED) {
+				ret = marshal_out_invoke_req(in_buf,
+						in_buf_len, req, args_buf,
+						context_type);
+			}
+			*tz_acked = true;
+		}
+#endif
+		/*
+		 * qseecom does not understand smcinvoke's callback object &&
+		 * erringly sets ret value as -EINVAL :( We need to handle it.
+		 */
+		if (response_type != SMCINVOKE_RESULT_INBOUND_REQ_NEEDED)
+			break;
+
+		if (response_type == SMCINVOKE_RESULT_INBOUND_REQ_NEEDED) {
+			trace_status(__func__, "looks like inbnd req reqd");
+			process_piggyback_cb_data(out_buf, out_buf_len);
+			process_tzcb_req(out_buf, out_buf_len, arr_filp);
+			cmd = SMCINVOKE_CB_RSP_CMD;
+		}
+	}
+	return ret;
+}
+/*
+ * SMC expects arguments in following format
+ * ---------------------------------------------------------------------------
+ * | cxt | op | counts | ptr|size |ptr|size...|ORef|ORef|...| rest of payload |
+ * ---------------------------------------------------------------------------
+ * cxt: target, op: operation, counts: total arguments
+ * offset: offset is from beginning of buffer i.e. cxt
+ * size: size is 8 bytes aligned value
+ */
+static size_t compute_in_msg_size(const struct smcinvoke_cmd_req *req,
+		const union smcinvoke_arg *args_buf)
+{
+	uint32_t i = 0;
+
+	size_t total_size = sizeof(struct smcinvoke_msg_hdr) +
+			OBJECT_COUNTS_TOTAL(req->counts) *
+			sizeof(union smcinvoke_tz_args);
+
+	/* Computed total_size should be 8 bytes aligned from start of buf */
+	total_size = ALIGN(total_size, SMCINVOKE_ARGS_ALIGN_SIZE);
+
+	/* each buffer has to be 8 bytes aligned */
+	while (i < OBJECT_COUNTS_NUM_buffers(req->counts))
+		total_size = size_add_(total_size,
+				size_align(args_buf[i++].b.size,
+				SMCINVOKE_ARGS_ALIGN_SIZE));
+
+	return PAGE_ALIGN(total_size);
+}
+
+static int marshal_in_invoke_req(const struct smcinvoke_cmd_req *req,
+		const union smcinvoke_arg *args_buf, uint32_t tzhandle,
+		uint8_t *buf, size_t buf_size, struct file **arr_filp,
+		int32_t *tzhandles_to_release, uint32_t context_type,
+		struct list_head *l_pending_mem_obj)
+{
+	int ret = -EINVAL, i = 0, j = 0, k = 0;
+	const struct smcinvoke_msg_hdr msg_hdr = {
+			tzhandle, req->op, req->counts};
+	uint32_t offset = sizeof(struct smcinvoke_msg_hdr) +
+			sizeof(union smcinvoke_tz_args) *
+			OBJECT_COUNTS_TOTAL(req->counts);
+	union smcinvoke_tz_args *tz_args = NULL;
+
+	if (buf_size < offset)
+		goto out;
+
+	*(struct smcinvoke_msg_hdr *)buf = msg_hdr;
+	tz_args = (union smcinvoke_tz_args *)(buf +
+			sizeof(struct smcinvoke_msg_hdr));
+
+	if (args_buf == NULL)
+		return 0;
+
+	FOR_ARGS(i, req->counts, BI) {
+		offset = size_align(offset, SMCINVOKE_ARGS_ALIGN_SIZE);
+		if ((offset > buf_size) ||
+			(args_buf[i].b.size > (buf_size - offset)))
+			goto out;
+
+		tz_args[i].b.offset = offset;
+		tz_args[i].b.size = args_buf[i].b.size;
+		if (context_type != SMCINVOKE_OBJ_TYPE_TZ_OBJ_FOR_KERNEL) {
+			if (copy_from_user(buf + offset,
+					(void __user *)(uintptr_t)(args_buf[i].b.addr),
+					args_buf[i].b.size))
+				goto out;
+		} else {
+			memcpy(buf + offset, (void *)(args_buf[i].b.addr),
+					args_buf[i].b.size);
+		}
+		offset += args_buf[i].b.size;
+	}
+	FOR_ARGS(i, req->counts, BO) {
+		offset = size_align(offset, SMCINVOKE_ARGS_ALIGN_SIZE);
+		if ((offset > buf_size) ||
+				(args_buf[i].b.size > (buf_size - offset)))
+			goto out;
+
+		tz_args[i].b.offset = offset;
+		tz_args[i].b.size = args_buf[i].b.size;
+		offset += args_buf[i].b.size;
+	}
+	FOR_ARGS(i, req->counts, OI) {
+		ret = get_tzhandle_from_uhandle(args_buf[i].o.fd,
+				args_buf[i].o.cb_server_fd, &arr_filp[j++],
+				&(tz_args[i].handle), l_pending_mem_obj);
+		if (ret)
+			goto out;
+
+		trace_marshal_in_invoke_req(i, args_buf[i].o.fd,
+				args_buf[i].o.cb_server_fd, tz_args[i].handle);
+
+		tzhandles_to_release[k++] = tz_args[i].handle;
+	}
+	ret = 0;
+out:
+	return ret;
+}
+
+static int marshal_in_tzcb_req(const struct smcinvoke_cb_txn *cb_txn,
+				struct smcinvoke_accept *user_req, int srvr_id)
+{
+	int ret = 0, i = 0;
+	int32_t temp_fd = UHANDLE_NULL;
+	union smcinvoke_arg tmp_arg;
+	struct smcinvoke_tzcb_req *tzcb_req = cb_txn->cb_req;
+	union smcinvoke_tz_args *tz_args = tzcb_req->args;
+	size_t tzcb_req_len = cb_txn->cb_req_bytes;
+	size_t tz_buf_offset = TZCB_BUF_OFFSET(tzcb_req);
+	size_t user_req_buf_offset = sizeof(union smcinvoke_arg) *
+			OBJECT_COUNTS_TOTAL(tzcb_req->hdr.counts);
+
+	if (tz_buf_offset > tzcb_req_len) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	user_req->txn_id = cb_txn->txn_id;
+	if (get_uhandle_from_tzhandle(tzcb_req->hdr.tzhandle, srvr_id,
+			(int32_t *)(&user_req->cbobj_id), TAKE_LOCK,
+			SMCINVOKE_OBJ_TYPE_TZ_OBJ)) {
+		ret = -EINVAL;
+		goto out;
+	}
+	user_req->op = tzcb_req->hdr.op;
+	user_req->counts = tzcb_req->hdr.counts;
+	user_req->argsize = sizeof(union smcinvoke_arg);
+
+	trace_marshal_in_tzcb_req_handle(tzcb_req->hdr.tzhandle, srvr_id,
+			user_req->cbobj_id, user_req->op, user_req->counts);
+
+	FOR_ARGS(i, tzcb_req->hdr.counts, BI) {
+		user_req_buf_offset = size_align(user_req_buf_offset,
+				SMCINVOKE_ARGS_ALIGN_SIZE);
+		tmp_arg.b.size = tz_args[i].b.size;
+		if ((tz_args[i].b.offset > tzcb_req_len) ||
+				(tz_args[i].b.size > tzcb_req_len - tz_args[i].b.offset) ||
+				(user_req_buf_offset > user_req->buf_len) ||
+				(tmp_arg.b.size >
+				user_req->buf_len - user_req_buf_offset)) {
+			ret = -EINVAL;
+			pr_err("%s: buffer overflow detected\n", __func__);
+			goto out;
+		}
+		tmp_arg.b.addr = user_req->buf_addr + user_req_buf_offset;
+
+		if (copy_to_user(u64_to_user_ptr
+				(user_req->buf_addr + i * sizeof(tmp_arg)),
+				&tmp_arg, sizeof(tmp_arg)) ||
+				copy_to_user(u64_to_user_ptr(tmp_arg.b.addr),
+				(uint8_t *)(tzcb_req) + tz_args[i].b.offset,
+				tz_args[i].b.size)) {
+			ret = -EFAULT;
+			goto out;
+		}
+		user_req_buf_offset += tmp_arg.b.size;
+	}
+	FOR_ARGS(i, tzcb_req->hdr.counts, BO) {
+		user_req_buf_offset = size_align(user_req_buf_offset,
+				SMCINVOKE_ARGS_ALIGN_SIZE);
+
+		tmp_arg.b.size = tz_args[i].b.size;
+		if ((user_req_buf_offset > user_req->buf_len) ||
+				(tmp_arg.b.size >
+				user_req->buf_len - user_req_buf_offset)) {
+			ret = -EINVAL;
+			pr_err("%s: buffer overflow detected\n", __func__);
+			goto out;
+		}
+		tmp_arg.b.addr = user_req->buf_addr + user_req_buf_offset;
+
+		if (copy_to_user(u64_to_user_ptr
+				(user_req->buf_addr + i * sizeof(tmp_arg)),
+				&tmp_arg, sizeof(tmp_arg))) {
+			ret = -EFAULT;
+			goto out;
+		}
+		user_req_buf_offset += tmp_arg.b.size;
+	}
+	FOR_ARGS(i, tzcb_req->hdr.counts, OI) {
+		/*
+		 * create a new FD and assign to output object's
+		 * context
+		 */
+		temp_fd = UHANDLE_NULL;
+
+		ret = get_uhandle_from_tzhandle(tz_args[i].handle, srvr_id,
+				&temp_fd, TAKE_LOCK, SMCINVOKE_OBJ_TYPE_TZ_OBJ);
+
+		tmp_arg.o.fd = temp_fd;
+
+		if (ret) {
+			ret = -EINVAL;
+			goto out;
+		}
+		if (copy_to_user(u64_to_user_ptr
+				(user_req->buf_addr + i * sizeof(tmp_arg)),
+				&tmp_arg, sizeof(tmp_arg))) {
+			ret = -EFAULT;
+			goto out;
+		}
+
+		trace_marshal_in_tzcb_req_fd(i, tz_args[i].handle, srvr_id, temp_fd);
+	}
+out:
+	return ret;
+}
+
+static int marshal_out_tzcb_req(const struct smcinvoke_accept *user_req,
+		struct smcinvoke_cb_txn *cb_txn,
+		struct file **arr_filp)
+{
+	int ret = -EINVAL, i = 0;
+	int32_t tzhandles_to_release[OBJECT_COUNTS_MAX_OO] = {0};
+	struct smcinvoke_tzcb_req *tzcb_req = cb_txn->cb_req;
+	union smcinvoke_tz_args *tz_args = tzcb_req->args;
+	size_t tz_buf_offset = TZCB_BUF_OFFSET(tzcb_req);
+	/* Holds new memory objects, to be later sent to TZ */
+	LIST_HEAD(l_mem_objs_pending_async);
+
+	uint32_t max_offset = 0;
+	uint32_t buffer_size_max_offset = 0;
+	void *async_buf_begin;
+	size_t async_buf_size;
+	uint32_t offset = 0;
+
+	/* We assume 'marshal_in_tzcb_req' increases the ref-count of the CBOBJs.
+	 * It should be the case for mem-obj as well. However, it does not do that.
+	 * It is easier to filter out the 'release_tzhandles' for mem-obj here rather
+	 * than increases its ref-count on 'marshal_in_tzcb_req'. Because, there is no
+	 * reliable error handling and cleanup in 'marshal_in_tzcb_req'. So if it fails
+	 * mem-obj may not get released.  **/
+
+	if (!TZHANDLE_IS_MEM_OBJ(cb_txn->cb_req->hdr.tzhandle))
+		release_tzhandles(&cb_txn->cb_req->hdr.tzhandle, 1);
+
+	tzcb_req->result = user_req->result;
+	/*
+	 * Return without marshaling user args if destination callback invocation
+	 * was unsuccessful.
+	 */
+	if (tzcb_req->result != 0) {
+		ret = 0;
+		goto out;
+	}
+
+	FOR_ARGS(i, tzcb_req->hdr.counts, BI) {
+		/* Find the max offset and the size of the buffer in that offset */
+		if (tz_args[i].b.offset > max_offset) {
+			max_offset = tz_args[i].b.offset;
+			buffer_size_max_offset = tz_args[i].b.size;
+		}
+	}
+
+	FOR_ARGS(i, tzcb_req->hdr.counts, BO) {
+		union smcinvoke_arg tmp_arg;
+
+		if (copy_from_user((uint8_t *)&tmp_arg,
+			u64_to_user_ptr(user_req->buf_addr + i * sizeof(union smcinvoke_arg)),
+			sizeof(union smcinvoke_arg))) {
+			ret = -EFAULT;
+			goto out;
+		}
+		if (tmp_arg.b.size > tz_args[i].b.size)
+			goto out;
+		if (copy_from_user((uint8_t *)(tzcb_req) + tz_args[i].b.offset,
+			u64_to_user_ptr(tmp_arg.b.addr), tmp_arg.b.size)) {
+			ret = -EFAULT;
+			goto out;
+		}
+
+		/* Find the max offset and the size of the buffer in that offset */
+		if (tz_args[i].b.offset > max_offset) {
+			max_offset = tz_args[i].b.offset;
+			buffer_size_max_offset = tz_args[i].b.size;
+		}
+	}
+
+	FOR_ARGS(i, tzcb_req->hdr.counts, OO) {
+		union smcinvoke_arg tmp_arg;
+
+		if (copy_from_user((uint8_t *)&tmp_arg,
+			u64_to_user_ptr(user_req->buf_addr + i * sizeof(union smcinvoke_arg)),
+			sizeof(union smcinvoke_arg))) {
+			ret = -EFAULT;
+			goto out;
+		}
+		ret = get_tzhandle_from_uhandle(tmp_arg.o.fd,
+				tmp_arg.o.cb_server_fd, &arr_filp[i],
+				&(tz_args[i].handle), &l_mem_objs_pending_async);
+
+		if (ret)
+			goto out;
+		tzhandles_to_release[i] = tz_args[i].handle;
+
+		trace_marshal_out_tzcb_req(i, tmp_arg.o.fd,
+				tmp_arg.o.cb_server_fd, tz_args[i].handle);
+	}
+	ret = 0;
+out:
+	FOR_ARGS(i, tzcb_req->hdr.counts, OI) {
+		if (TZHANDLE_IS_CB_OBJ(tz_args[i].handle))
+			release_tzhandles(&tz_args[i].handle, 1);
+	}
+
+	do {
+		if (mem_obj_async_support) {
+			/*
+			 * We will be able to add the async information to the buffer
+			 * beyond the data in the max offset, if exists.  If doesn't exist,
+			 * we can add the async information after the header and the args.
+			 */
+			offset = (max_offset ?
+					(max_offset + buffer_size_max_offset) : tz_buf_offset);
+			offset = size_align(offset, SMCINVOKE_ARGS_ALIGN_SIZE);
+			async_buf_begin = (uint8_t *)tzcb_req + offset;
+
+			if (async_buf_begin - (void *)tzcb_req <= g_max_cb_buf_size)
+				async_buf_size =
+					g_max_cb_buf_size - (async_buf_begin - (void *)tzcb_req);
+			else {
+				pr_err("Unable to add memory object info to the async channel\n");
+				break;
+			}
+
+			mutex_lock(&g_smcinvoke_lock);
+			add_mem_obj_info_to_async_side_channel_locked(async_buf_begin,
+						async_buf_size, &l_mem_objs_pending_async);
+			delete_pending_async_list_locked(&l_mem_objs_pending_async);
+			mutex_unlock(&g_smcinvoke_lock);
+		}
+	} while (0);
+
+	if (ret)
+		release_tzhandles(tzhandles_to_release, OBJECT_COUNTS_MAX_OO);
+
+	return ret;
+}
+
+static void set_tz_version(uint32_t tz_version)
+{
+	tz_async_version = tz_version;
+
+	/* We enable async memory object support when TZ async
+	 * version is equal or larger than the driver version.
+	 * It is expected that if the protocol changes in later
+	 * TZ versions, TZ will support backward compatibility
+	 * so this condition should still be valid.
+	 */
+	if (tz_version >= SMCINVOKE_ASYNC_VERSION) {
+		mem_obj_async_support = true;
+		pr_debug("Enabled asynchronous memory object support\n");
+	}
+}
+
+static void process_piggyback_data(void *buf, size_t buf_size)
+{
+	int i;
+	struct smcinvoke_tzcb_req req = {0};
+	struct smcinvoke_piggyback_msg *msg = buf;
+	int32_t *objs = msg->objs;
+
+	if (msg->version == 0) {
+		/* QTEE reset the buffer if it is unused. */
+		return;
+	}
+
+	for (i = 0; i < msg->counts; i++) {
+		if (msg->op != OBJECT_OP_RELEASE) {
+			/* We only support release handler. */
+			break;
+		}
+
+		req.hdr.op = msg->op;
+		req.hdr.counts = 0; /* release op does not require any args */
+		req.hdr.tzhandle = objs[i];
+		if (tz_async_version == 0)
+			set_tz_version(msg->version);
+		process_tzcb_req(&req, sizeof(struct smcinvoke_tzcb_req), NULL);
+		/* cbobjs_in_flight will be adjusted during CB processing */
+	}
+
+	/* Reset output buffer after processing.*/
+	memset(buf, 0, buf_size);
+}
+
+
+/* Add memory object mapped data to the async side channel, so it's available
+ * to TZ together with the memory object.
+ *
+ * No return value as TZ is always able to explicitly ask for this information
+ * in case this function fails.
+ */
+static void add_mem_obj_info_to_async_side_channel_locked(
+		void *buf, size_t buf_size, struct list_head *l_pending_mem_obj)
+{
+	struct smcinvoke_mem_obj_msg *msg = buf;
+	struct smcinvoke_mem_obj_pending_async *mem_obj_pending = NULL;
+	size_t header_size = 0;
+	size_t mo_size = 0;
+	size_t used = 0;
+	size_t index = 0;
+
+	if (list_empty(l_pending_mem_obj))
+		return;
+
+	header_size = sizeof(struct smcinvoke_mem_obj_msg);
+	mo_size = sizeof(struct smcinvoke_mem_obj_info);
+
+	/* Minimal size required is the header data + one mem obj info */
+	if (buf_size < header_size + mo_size) {
+		pr_err("Unable to add memory object info to async channel\n");
+		return;
+	}
+
+	msg->version = SMCINVOKE_ASYNC_VERSION;
+	msg->op = SMCINVOKE_ASYNC_OP_MEMORY_OBJECT;
+	msg->count = 0;
+
+	used = header_size;
+	index = 0;
+
+	list_for_each_entry(mem_obj_pending, l_pending_mem_obj, list) {
+		if (mem_obj_pending->mem_obj == NULL) {
+			pr_err("Memory object is no longer valid\n");
+			continue;
+		}
+
+		if (used + mo_size > buf_size) {
+			pr_err("Not all memory object info was added to the async channel\n");
+			break;
+		}
+
+		msg->mo[index].memObjRef = TZHANDLE_MAKE_LOCAL(MEM_RGN_SRVR_ID,
+					mem_obj_pending->mem_obj->mem_region_id);
+		msg->mo[index].mapObjRef = TZHANDLE_MAKE_LOCAL(MEM_MAP_SRVR_ID,
+					mem_obj_pending->mem_obj->mem_map_obj_id);
+		msg->mo[index].addr = mem_obj_pending->mem_obj->p_addr;
+		msg->mo[index].size = mem_obj_pending->mem_obj->p_addr_len;
+		msg->mo[index].perm = SMCINVOKE_MEM_PERM_RW;
+
+		used += sizeof(msg->mo[index]);
+		index++;
+	}
+
+	msg->count = index;
+
+	pr_debug("Added %lu memory objects to the side channel, total size = %zu\n", index, used);
+}
+
+/*
+ * Delete entire pending async list.
+ */
+static void delete_pending_async_list_locked(struct list_head *l_pending_mem_obj)
+{
+	struct smcinvoke_mem_obj_pending_async *mem_obj_pending = NULL;
+	struct smcinvoke_mem_obj_pending_async *temp = NULL;
+
+	if (list_empty(l_pending_mem_obj))
+		return;
+
+	list_for_each_entry_safe(mem_obj_pending, temp, l_pending_mem_obj, list) {
+		mem_obj_pending->mem_obj = NULL;
+		list_del(&mem_obj_pending->list);
+		kfree(mem_obj_pending);
+	}
+}
+
+
+/*
+ * Unmap/release the mapped objects from  pending async list.
+ */
+static void release_map_obj_pending_async_list_locked(struct list_head *l_pending_mem_obj)
+{
+	struct smcinvoke_mem_obj_pending_async *mem_obj_pending = NULL;
+	struct smcinvoke_mem_obj_pending_async *temp = NULL;
+
+	if (list_empty(l_pending_mem_obj))
+		return;
+
+	list_for_each_entry_safe(mem_obj_pending, temp, l_pending_mem_obj, list) {
+		kref_put(&mem_obj_pending->mem_obj->mem_map_obj_ref_cnt, del_mem_map_obj_locked);
+	}
+}
+
+static long process_ack_local_obj(struct file *filp, unsigned int cmd,
+						unsigned long arg)
+{
+	int ret = -1;
+	int32_t local_obj = SMCINVOKE_USERSPACE_OBJ_NULL;
+	struct smcinvoke_file_data *filp_data = filp->private_data;
+
+	if (_IOC_SIZE(cmd) != sizeof(int32_t))
+		return -EINVAL;
+
+	ret = copy_from_user(&local_obj, (void __user *)(uintptr_t)arg,
+			sizeof(int32_t));
+	if (ret)
+		return -EFAULT;
+
+	mutex_lock(&g_smcinvoke_lock);
+	if (UHANDLE_IS_CB_OBJ(local_obj))
+		ret = put_pending_cbobj_locked(filp_data->server_id,
+				UHANDLE_GET_CB_OBJ(local_obj));
+	mutex_unlock(&g_smcinvoke_lock);
+
+	return ret;
+}
+
+static long process_server_req(struct file *filp, unsigned int cmd,
+		unsigned long arg)
+{
+	int ret = -1;
+	int32_t server_fd = -1;
+	struct smcinvoke_server server_req = {0};
+	struct smcinvoke_server_info *server_info = NULL;
+
+	if (_IOC_SIZE(cmd) != sizeof(server_req)) {
+		pr_err("invalid command size received for server request\n");
+		return -EINVAL;
+	}
+	ret = copy_from_user(&server_req, (void __user *)(uintptr_t)arg,
+					sizeof(server_req));
+	if (ret) {
+		pr_err("copying server request from user failed\n");
+		return -EFAULT;
+	}
+	server_info = kzalloc(sizeof(*server_info), GFP_KERNEL);
+	if (!server_info)
+		return -ENOMEM;
+
+	kref_init(&server_info->ref_cnt);
+	init_waitqueue_head(&server_info->req_wait_q);
+	init_waitqueue_head(&server_info->rsp_wait_q);
+	server_info->cb_buf_size = server_req.cb_buf_size;
+	hash_init(server_info->reqs_table);
+	hash_init(server_info->responses_table);
+	INIT_LIST_HEAD(&server_info->pending_cbobjs);
+	server_info->is_server_suspended = 0;
+
+	mutex_lock(&g_smcinvoke_lock);
+
+	server_info->server_id = next_cb_server_id_locked();
+	hash_add(g_cb_servers, &server_info->hash,
+			server_info->server_id);
+	if (g_max_cb_buf_size < server_req.cb_buf_size)
+		g_max_cb_buf_size = server_req.cb_buf_size;
+
+	mutex_unlock(&g_smcinvoke_lock);
+	ret = get_fd_for_obj(SMCINVOKE_OBJ_TYPE_SERVER,
+			server_info->server_id, &server_fd);
+
+	if (ret)
+		release_cb_server(server_info->server_id);
+
+	return server_fd;
+}
+
+static long process_accept_req(struct file *filp, unsigned int cmd,
+		unsigned long arg)
+{
+	int ret = -1;
+	struct smcinvoke_file_data *server_obj = filp->private_data;
+	struct smcinvoke_accept user_args = {0};
+	struct smcinvoke_cb_txn *cb_txn = NULL;
+	struct smcinvoke_server_info *server_info = NULL;
+
+	if (_IOC_SIZE(cmd) != sizeof(struct smcinvoke_accept)) {
+		pr_err("command size invalid for accept request\n");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&user_args, (void __user *)arg,
+			sizeof(struct smcinvoke_accept))) {
+		pr_err("copying accept request from user failed\n");
+		return -EFAULT;
+	}
+
+	if (user_args.argsize != sizeof(union smcinvoke_arg)) {
+		pr_err("arguments size is invalid for accept thread\n");
+		return -EINVAL;
+	}
+
+	/* ACCEPT is available only on server obj */
+	if (server_obj->context_type != SMCINVOKE_OBJ_TYPE_SERVER) {
+		pr_err("invalid object type received for accept req\n");
+		return -EPERM;
+	}
+
+	mutex_lock(&g_smcinvoke_lock);
+	server_info = get_cb_server_locked(server_obj->server_id);
+
+	if (!server_info) {
+		pr_err("No matching server with server id : %u found\n",
+				server_obj->server_id);
+		mutex_unlock(&g_smcinvoke_lock);
+		return -EINVAL;
+	}
+
+	if (server_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT)
+		server_info->state = 0;
+
+	server_info->is_server_suspended = UNSET_BIT(server_info->is_server_suspended,
+				(current->pid)%DEFAULT_CB_OBJ_THREAD_CNT);
+
+	mutex_unlock(&g_smcinvoke_lock);
+
+	/* First check if it has response otherwise wait for req */
+	if (user_args.has_resp) {
+		trace_process_accept_req_has_response(current->pid, current->tgid);
+
+		mutex_lock(&g_smcinvoke_lock);
+		cb_txn = find_cbtxn_locked(server_info, user_args.txn_id,
+				SMCINVOKE_REQ_PROCESSING);
+		mutex_unlock(&g_smcinvoke_lock);
+		/*
+		 * cb_txn can be null if userspace provides wrong txn id OR
+		 * invoke thread died while server was processing cb req.
+		 * if invoke thread dies, it would remove req from Q. So
+		 * no matching cb_txn would be on Q and hence NULL cb_txn.
+		 * In this case, we want this thread to start waiting
+		 * new cb requests.
+		 */
+		if (!cb_txn) {
+			pr_err_ratelimited("%s txn %llu either invalid or removed from Q\n",
+					__func__, user_args.txn_id);
+			goto start_waiting_for_requests;
+		}
+		ret = marshal_out_tzcb_req(&user_args, cb_txn,
+				cb_txn->filp_to_release);
+		/*
+		 * if client did not set error and we get error locally,
+		 * we return local error to TA
+		 */
+		if (ret && cb_txn->cb_req->result == 0)
+			cb_txn->cb_req->result = OBJECT_ERROR_UNAVAIL;
+
+		cb_txn->state = SMCINVOKE_REQ_PROCESSED;
+		mutex_lock(&g_smcinvoke_lock);
+
+		kref_put(&cb_txn->ref_cnt, delete_cb_txn_locked);
+		mutex_unlock(&g_smcinvoke_lock);
+		wake_up(&server_info->rsp_wait_q);
+		/*
+		 * if marshal_out fails, we should let userspace release
+		 * any ref/obj it created for CB processing
+		 */
+		if (ret && OBJECT_COUNTS_NUM_OO(user_args.counts))
+			goto out;
+	}
+start_waiting_for_requests:
+	/*
+	 * Once response has been delivered, thread will wait for another
+	 * callback req to process.
+	 */
+	do {
+		ret = wait_event_interruptible(server_info->req_wait_q,
+				!hash_empty(server_info->reqs_table));
+		if (ret) {
+			trace_process_accept_req_ret(current->pid, current->tgid, ret);
+			/*
+			 * Ideally, we should destroy server if accept threads
+			 * are returning due to client being killed or device
+			 * going down (Shutdown/Reboot) but that would make
+			 * server_info invalid. Other accept/invoke threads are
+			 * using server_info and would crash. So dont do that.
+			 */
+			mutex_lock(&g_smcinvoke_lock);
+
+			if (freezing(current)) {
+				pr_err_ratelimited("Server id :%d interrupted probaby due to suspend, pid:%d\n",
+					server_info->server_id, current->pid);
+				/*
+				 * Each accept thread is identified by bits ranging from
+				 * 0 to DEFAULT_CBOBJ_THREAD_CNT-1. When an accept thread is
+				 * interrupted by a signal other than SIGUSR1,SIGKILL,SIGTERM,
+				 * set the corresponding bit of accept thread, indicating that
+				 * current accept thread's state to be "suspended"/ or something
+				 * that needs infinite timeout for invoke thread.
+				 */
+				server_info->is_server_suspended =
+						SET_BIT(server_info->is_server_suspended,
+							(current->pid)%DEFAULT_CB_OBJ_THREAD_CNT);
+			} else {
+				pr_err_ratelimited("Setting pid:%d, server id : %d state to defunct\n",
+						current->pid, server_info->server_id);
+						server_info->state = SMCINVOKE_SERVER_STATE_DEFUNCT;
+			}
+			mutex_unlock(&g_smcinvoke_lock);
+			wake_up_interruptible(&server_info->rsp_wait_q);
+			goto out;
+		}
+		mutex_lock(&g_smcinvoke_lock);
+		cb_txn = find_cbtxn_locked(server_info,
+				SMCINVOKE_NEXT_AVAILABLE_TXN,
+				SMCINVOKE_REQ_PLACED);
+		mutex_unlock(&g_smcinvoke_lock);
+		if (cb_txn) {
+			cb_txn->state = SMCINVOKE_REQ_PROCESSING;
+			ret = marshal_in_tzcb_req(cb_txn, &user_args,
+					server_obj->server_id);
+			if (ret) {
+				pr_err("failed to marshal in the callback request\n");
+				cb_txn->cb_req->result = OBJECT_ERROR_UNAVAIL;
+				cb_txn->state = SMCINVOKE_REQ_PROCESSED;
+				mutex_lock(&g_smcinvoke_lock);
+				kref_put(&cb_txn->ref_cnt, delete_cb_txn_locked);
+				mutex_unlock(&g_smcinvoke_lock);
+				wake_up_interruptible(&server_info->rsp_wait_q);
+				continue;
+			}
+			mutex_lock(&g_smcinvoke_lock);
+			hash_add(server_info->responses_table, &cb_txn->hash,
+					cb_txn->txn_id);
+			kref_put(&cb_txn->ref_cnt, delete_cb_txn_locked);
+			mutex_unlock(&g_smcinvoke_lock);
+
+			trace_process_accept_req_placed(current->pid, current->tgid);
+
+			ret = copy_to_user((void __user *)arg, &user_args,
+					sizeof(struct smcinvoke_accept));
+		}
+	} while (!cb_txn);
+out:
+	if (server_info) {
+		mutex_lock(&g_smcinvoke_lock);
+		kref_put(&server_info->ref_cnt, destroy_cb_server);
+		mutex_unlock(&g_smcinvoke_lock);
+	}
+
+	if (ret && ret != -ERESTARTSYS)
+		pr_err("accept thread returning with ret: %d\n", ret);
+
+	return ret;
+}
+
+static long process_invoke_req(struct file *filp, unsigned int cmd,
+		unsigned long arg)
+{
+	int    ret = -1, nr_args = 0;
+	struct smcinvoke_cmd_req req = {0};
+	void   *in_msg = NULL, *out_msg = NULL;
+	size_t inmsg_size = 0, outmsg_size = SMCINVOKE_TZ_MIN_BUF_SIZE;
+	union  smcinvoke_arg *args_buf = NULL;
+	struct smcinvoke_file_data *tzobj = filp->private_data;
+	struct qtee_shm in_shm = {0}, out_shm = {0};
+	LIST_HEAD(l_mem_objs_pending_async); /* Holds new memory objects, to be later sent to TZ */
+
+	/*
+	 * Hold reference to remote object until invoke op is not
+	 * completed. Release once invoke is done.
+	 */
+	struct file *filp_to_release[OBJECT_COUNTS_MAX_OO] = {NULL};
+	/*
+	 * If anything goes wrong, release alloted tzhandles for
+	 * local objs which could be either CBObj or MemObj.
+	 */
+	int32_t tzhandles_to_release[OBJECT_COUNTS_MAX_OO] = {0};
+	bool tz_acked = false;
+	uint32_t context_type = tzobj->context_type;
+
+	if (context_type == SMCINVOKE_OBJ_TYPE_TZ_OBJ &&
+			_IOC_SIZE(cmd) != sizeof(req)) {
+		pr_err("command size for invoke req is invalid\n");
+		return -EINVAL;
+	}
+
+	if (context_type != SMCINVOKE_OBJ_TYPE_TZ_OBJ &&
+			context_type != SMCINVOKE_OBJ_TYPE_TZ_OBJ_FOR_KERNEL) {
+		pr_err("invalid context_type %d\n", context_type);
+		return -EPERM;
+	}
+	if (context_type != SMCINVOKE_OBJ_TYPE_TZ_OBJ_FOR_KERNEL) {
+		ret = copy_from_user(&req, (void __user *)arg, sizeof(req));
+		if (ret) {
+			pr_err("copying invoke req failed\n");
+			return -EFAULT;
+		}
+	} else {
+		req = *(struct smcinvoke_cmd_req *)arg;
+	}
+	if (req.argsize != sizeof(union smcinvoke_arg)) {
+		pr_err("arguments size for invoke req is invalid\n");
+		return -EINVAL;
+	}
+
+	if (context_type == SMCINVOKE_OBJ_TYPE_TZ_OBJ &&
+			tzobj->tzhandle == SMCINVOKE_TZ_ROOT_OBJ &&
+			(req.op == IClientEnv_OP_notifyDomainChange ||
+			req.op == IClientEnv_OP_registerWithCredentials ||
+			req.op == IClientEnv_OP_adciAccept ||
+			req.op == IClientEnv_OP_adciShutdown)) {
+		pr_err("invalid rootenv op\n");
+		return -EINVAL;
+	}
+
+	nr_args = OBJECT_COUNTS_NUM_buffers(req.counts) +
+			OBJECT_COUNTS_NUM_objects(req.counts);
+
+	if (nr_args) {
+		args_buf = kcalloc(nr_args, req.argsize, GFP_KERNEL);
+		if (!args_buf)
+			return -ENOMEM;
+		if (context_type == SMCINVOKE_OBJ_TYPE_TZ_OBJ) {
+			ret = copy_from_user(args_buf,
+					u64_to_user_ptr(req.args),
+					nr_args * req.argsize);
+			if (ret) {
+				ret = -EFAULT;
+				goto out;
+			}
+		} else {
+			memcpy(args_buf, (void *)(req.args),
+					nr_args * req.argsize);
+		}
+	}
+
+	inmsg_size = compute_in_msg_size(&req, args_buf);
+	ret = qtee_shmbridge_allocate_shm(inmsg_size, &in_shm);
+	if (ret) {
+		ret = -ENOMEM;
+		pr_err("shmbridge alloc failed for in msg in invoke req\n");
+		goto out;
+	}
+	in_msg = in_shm.vaddr;
+
+	mutex_lock(&g_smcinvoke_lock);
+	outmsg_size = PAGE_ALIGN(g_max_cb_buf_size);
+	mutex_unlock(&g_smcinvoke_lock);
+	ret = qtee_shmbridge_allocate_shm(outmsg_size, &out_shm);
+	if (ret) {
+		ret = -ENOMEM;
+		pr_err("shmbridge alloc failed for out msg in invoke req\n");
+		goto out;
+	}
+	out_msg = out_shm.vaddr;
+
+	trace_process_invoke_req_tzhandle(tzobj->tzhandle, req.op, req.counts);
+
+	ret = marshal_in_invoke_req(&req, args_buf, tzobj->tzhandle, in_msg,
+			inmsg_size, filp_to_release, tzhandles_to_release,
+			context_type, &l_mem_objs_pending_async);
+	if (ret) {
+		pr_err("failed to marshal in invoke req, ret :%d\n", ret);
+		goto out;
+	}
+
+	if (mem_obj_async_support) {
+		mutex_lock(&g_smcinvoke_lock);
+		add_mem_obj_info_to_async_side_channel_locked(
+				out_msg,
+				outmsg_size,
+				&l_mem_objs_pending_async);
+		mutex_unlock(&g_smcinvoke_lock);
+	}
+
+	ret = prepare_send_scm_msg(in_msg, in_shm.paddr, inmsg_size,
+			out_msg, out_shm.paddr, outmsg_size,
+			&req, args_buf, &tz_acked, context_type,
+			&in_shm, &out_shm, true);
+
+	/*
+	 * If scm_call is success, TZ owns responsibility to release
+	 * refs for local objs.
+	 */
+	if (!tz_acked) {
+		trace_status(__func__, "scm call successful");
+		goto out;
+	}
+	memset(tzhandles_to_release, 0, sizeof(tzhandles_to_release));
+
+	/*
+	 * if invoke op results in an err, no need to marshal_out and
+	 * copy args buf to user space
+	 */
+	if (!req.result) {
+		/*
+		 * Dont check ret of marshal_out because there might be a
+		 * FD for OO which userspace must release even if an error
+		 * occurs. Releasing FD from user space is much simpler than
+		 * doing here. ORing of ret is reqd not to miss past error
+		 */
+		if (context_type == SMCINVOKE_OBJ_TYPE_TZ_OBJ)
+			ret |= copy_to_user(u64_to_user_ptr(req.args),
+					args_buf, nr_args * req.argsize);
+		else
+			memcpy((void *)(req.args), args_buf,
+					nr_args * req.argsize);
+
+	}
+	/* copy result of invoke op */
+	if (context_type == SMCINVOKE_OBJ_TYPE_TZ_OBJ) {
+		ret |= copy_to_user((void __user *)arg, &req, sizeof(req));
+		if (ret)
+			goto out;
+	} else {
+		memcpy((void *)arg, (void *)&req, sizeof(req));
+	}
+
+	/* Outbuf could be carrying local objs to be released. */
+	process_piggyback_data(out_msg, outmsg_size);
+out:
+	trace_process_invoke_req_result(ret, req.result, tzobj->tzhandle,
+			req.op, req.counts);
+
+	release_filp(filp_to_release, OBJECT_COUNTS_MAX_OO);
+	if (ret) {
+		release_map_obj_pending_async_list_locked(&l_mem_objs_pending_async);
+		release_tzhandles(tzhandles_to_release, OBJECT_COUNTS_MAX_OO);
+	}
+	delete_pending_async_list_locked(&l_mem_objs_pending_async);
+	qtee_shmbridge_free_shm(&in_shm);
+	qtee_shmbridge_free_shm(&out_shm);
+	kfree(args_buf);
+
+	if (ret)
+		pr_err("invoke thread returning with ret = %d\n", ret);
+
+	return ret;
+}
+
+static long process_log_info(struct file *filp, unsigned int cmd,
+					unsigned long arg)
+{
+	int ret = 0;
+	char buf[SMCINVOKE_LOG_BUF_SIZE];
+	struct smcinvoke_file_data *tzobj = filp->private_data;
+
+	ret = copy_from_user(buf, (void __user *)arg, SMCINVOKE_LOG_BUF_SIZE);
+	if (ret) {
+		pr_err("logging HLOS info copy failed\n");
+		return -EFAULT;
+	}
+	buf[SMCINVOKE_LOG_BUF_SIZE - 1] = '\0';
+
+	trace_process_log_info(buf, tzobj->context_type, tzobj->tzhandle);
+
+	return ret;
+}
+
+static long smcinvoke_ioctl(struct file *filp, unsigned int cmd,
+						unsigned long arg)
+{
+	long ret = 0;
+
+	switch (cmd) {
+	case SMCINVOKE_IOCTL_INVOKE_REQ:
+		ret = process_invoke_req(filp, cmd, arg);
+		break;
+	case SMCINVOKE_IOCTL_ACCEPT_REQ:
+		ret = process_accept_req(filp, cmd, arg);
+		break;
+	case SMCINVOKE_IOCTL_SERVER_REQ:
+		ret = process_server_req(filp, cmd, arg);
+		break;
+	case SMCINVOKE_IOCTL_ACK_LOCAL_OBJ:
+		ret = process_ack_local_obj(filp, cmd, arg);
+		break;
+	case SMCINVOKE_IOCTL_LOG:
+		ret = process_log_info(filp, cmd, arg);
+		break;
+	default:
+		ret = -ENOIOCTLCMD;
+		break;
+	}
+	trace_smcinvoke_ioctl(cmd, ret);
+	return ret;
+}
+
+int get_root_fd(int *root_fd)
+{
+	if (!root_fd)
+		return -EINVAL;
+	else
+		return get_fd_for_obj(SMCINVOKE_OBJ_TYPE_TZ_OBJ_FOR_KERNEL,
+				SMCINVOKE_TZ_ROOT_OBJ, root_fd);
+}
+
+int process_invoke_request_from_kernel_client(int fd,
+			struct smcinvoke_cmd_req *req)
+{
+	struct file *filp = NULL;
+	int ret = 0;
+
+	if (!req) {
+		pr_err("NULL req\n");
+		return -EINVAL;
+	}
+
+	filp = fget(fd);
+	if (!filp) {
+		pr_err("Invalid fd %d\n", fd);
+		return -EINVAL;
+	}
+	ret = process_invoke_req(filp, 0, (uintptr_t)req);
+	fput(filp);
+	trace_process_invoke_request_from_kernel_client(fd, filp, file_count(filp));
+	return ret;
+}
+
+static int smcinvoke_open(struct inode *nodp, struct file *filp)
+{
+	struct smcinvoke_file_data *tzcxt = NULL;
+
+	tzcxt = kzalloc(sizeof(*tzcxt), GFP_KERNEL);
+	if (!tzcxt)
+		return -ENOMEM;
+
+	tzcxt->tzhandle = SMCINVOKE_TZ_ROOT_OBJ;
+	tzcxt->context_type = SMCINVOKE_OBJ_TYPE_TZ_OBJ;
+	filp->private_data = tzcxt;
+
+	return 0;
+}
+
+static int release_cb_server(uint16_t server_id)
+{
+	struct smcinvoke_server_info *server = NULL;
+
+	mutex_lock(&g_smcinvoke_lock);
+	server = find_cb_server_locked(server_id);
+	if (server)
+		kref_put(&server->ref_cnt, destroy_cb_server);
+	mutex_unlock(&g_smcinvoke_lock);
+	return 0;
+}
+
+int smcinvoke_release_filp(struct file *filp)
+{
+	int ret = 0;
+	struct smcinvoke_file_data *file_data = filp->private_data;
+	uint32_t tzhandle = 0;
+	struct smcinvoke_object_release_pending_list *entry = NULL;
+	struct qtee_shm in_shm = {0}, out_shm = {0};
+
+	trace_smcinvoke_release_filp(current->files, filp,
+			file_count(filp), file_data->context_type);
+
+	if (file_data->context_type == SMCINVOKE_OBJ_TYPE_SERVER) {
+		ret = release_cb_server(file_data->server_id);
+		goto out;
+	}
+
+	tzhandle = file_data->tzhandle;
+	/* Root object is special in sense it is indestructible */
+	if (!tzhandle || tzhandle == SMCINVOKE_TZ_ROOT_OBJ) {
+		if (!tzhandle)
+			pr_err("tzhandle not valid in object release\n");
+		goto out;
+	}
+
+	ret = qtee_shmbridge_allocate_shm(SMCINVOKE_TZ_MIN_BUF_SIZE, &in_shm);
+	if (ret) {
+		pr_err("shmbridge alloc failed for in msg in object release with ret %d\n", ret);
+		goto out;
+	}
+
+	ret = qtee_shmbridge_allocate_shm(SMCINVOKE_TZ_MIN_BUF_SIZE, &out_shm);
+	if (ret) {
+		pr_err("shmbridge alloc failed for out msg in object release with ret:%d\n", ret);
+		goto out;
+	}
+
+	ret = smcinvoke_release_tz_object(&in_shm, &out_shm,
+		tzhandle, file_data->context_type);
+
+	if (-EBUSY == ret) {
+		pr_debug("failed to release handle in sync adding to list\n");
+		entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+		if (!entry) {
+			ret = -ENOMEM;
+			goto out;
+		}
+		ret = 0;
+		entry->data.tzhandle = tzhandle;
+		entry->data.context_type = file_data->context_type;
+		mutex_lock(&object_postprocess_lock);
+		list_add_tail(&entry->list, &g_object_postprocess);
+		mutex_unlock(&object_postprocess_lock);
+		pr_debug("Object release list: added a handle:%u\n", tzhandle);
+		__wakeup_postprocess_kthread(&smcinvoke[OBJECT_WORKER_THREAD]);
+	}
+
+out:
+	qtee_shmbridge_free_shm(&in_shm);
+	qtee_shmbridge_free_shm(&out_shm);
+	kfree(filp->private_data);
+	filp->private_data = NULL;
+
+	if (ret != 0)
+		pr_err("Object release failed with ret %d\n", ret);
+	return ret;
+}
+
+int smcinvoke_release_from_kernel_client(int fd)
+{
+	struct file *filp = NULL;
+
+	/* use fget() to get filp, but this will increase file ref_cnt to 1,
+	 * then decrease file ref_cnt to 0 with fput().
+	 */
+	filp = fget(fd);
+	if (!filp) {
+		pr_err("invalid fd %d to release\n", fd);
+		return -EINVAL;
+	}
+	trace_smcinvoke_release_from_kernel_client(current->files, filp,
+			file_count(filp));
+	/* free filp, notify TZ to release object */
+	smcinvoke_release_filp(filp);
+	fput(filp);
+	return 0;
+}
+
+static int smcinvoke_release(struct inode *nodp, struct file *filp)
+{
+	trace_smcinvoke_release(current->files, filp, file_count(filp),
+			filp->private_data);
+
+	if (filp->private_data)
+		return smcinvoke_release_filp(filp);
+	else
+		return 0;
+}
+
+static int smcinvoke_probe(struct platform_device *pdev)
+{
+	unsigned int baseminor = 0;
+	unsigned int count = 1;
+	int rc = 0;
+
+	/* Defer if qcom_scm is not available */
+	if (!qcom_scm_is_available())
+		return dev_err_probe(&pdev->dev, -EPROBE_DEFER, "qcom_scm is not up!\n");
+
+	rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+	if (rc) {
+		pr_err("dma_set_mask_and_coherent failed %d\n", rc);
+		return rc;
+	}
+	legacy_smc_call = of_property_read_bool((&pdev->dev)->of_node,
+			"qcom,support-legacy_smc");
+	invoke_cmd = legacy_smc_call ? SMCINVOKE_INVOKE_CMD_LEGACY : SMCINVOKE_INVOKE_CMD;
+
+	smci_support_hyp = of_property_read_bool((&pdev->dev)->of_node,
+			"qcom,support-hypervisor");
+
+	rc = smcinvoke_create_kthreads();
+	if (rc) {
+		pr_err("smcinvoke_create_kthreads failed %d\n", rc);
+		return rc;
+	}
+
+	rc = alloc_chrdev_region(&smcinvoke_device_no, baseminor, count,
+							SMCINVOKE_DEV);
+	if (rc < 0) {
+		pr_err("chrdev_region failed %d for %s\n", rc, SMCINVOKE_DEV);
+		goto exit_destroy_wkthread;
+	}
+	driver_class = class_create(SMCINVOKE_DEV);
+	if (IS_ERR(driver_class)) {
+		rc = -ENOMEM;
+		pr_err("class_create failed %d\n", rc);
+		goto exit_unreg_chrdev_region;
+	}
+	class_dev = device_create(driver_class, NULL, smcinvoke_device_no,
+						NULL, SMCINVOKE_DEV);
+	if (!class_dev) {
+		pr_err("class_device_create failed %d\n", rc);
+		rc = -ENOMEM;
+		goto exit_destroy_class;
+	}
+
+	cdev_init(&smcinvoke_cdev, &g_smcinvoke_fops);
+	smcinvoke_cdev.owner = THIS_MODULE;
+
+	rc = cdev_add(&smcinvoke_cdev, MKDEV(MAJOR(smcinvoke_device_no), 0),
+								count);
+	if (rc < 0) {
+		pr_err("cdev_add failed %d for %s\n", rc, SMCINVOKE_DEV);
+		goto exit_destroy_device;
+	}
+	smcinvoke_pdev = pdev;
+
+	__wakeup_postprocess_kthread(&smcinvoke[ADCI_WORKER_THREAD]);
+	return 0;
+
+exit_destroy_device:
+	device_destroy(driver_class, smcinvoke_device_no);
+exit_destroy_class:
+	class_destroy(driver_class);
+exit_unreg_chrdev_region:
+	unregister_chrdev_region(smcinvoke_device_no, count);
+exit_destroy_wkthread:
+	smcinvoke_destroy_kthreads();
+	return rc;
+}
+
+static int smcinvoke_remove(struct platform_device *pdev)
+{
+	int count = 1;
+
+	smcinvoke_destroy_kthreads();
+	cdev_del(&smcinvoke_cdev);
+	device_destroy(driver_class, smcinvoke_device_no);
+	class_destroy(driver_class);
+	unregister_chrdev_region(smcinvoke_device_no, count);
+	return 0;
+}
+
+static int __maybe_unused smcinvoke_suspend(struct platform_device *pdev,
+					pm_message_t state)
+{
+	int ret = 0;
+
+	mutex_lock(&g_smcinvoke_lock);
+	if (cb_reqs_inflight) {
+		pr_err("Failed to suspend smcinvoke driver\n");
+		ret = -EIO;
+	}
+	mutex_unlock(&g_smcinvoke_lock);
+	return ret;
+}
+
+static int __maybe_unused smcinvoke_resume(struct platform_device *pdev)
+{
+	return 0;
+}
+
+static const struct of_device_id smcinvoke_match[] = {
+	{
+		.compatible = "qcom,smcinvoke",
+	},
+	{},
+};
+
+static struct platform_driver smcinvoke_plat_driver = {
+	.probe = smcinvoke_probe,
+	.remove = smcinvoke_remove,
+	.suspend = smcinvoke_suspend,
+	.resume = smcinvoke_resume,
+	.driver = {
+		.name = "smcinvoke",
+		.of_match_table = smcinvoke_match,
+	},
+};
+
+static int smcinvoke_init(void)
+{
+	return platform_driver_register(&smcinvoke_plat_driver);
+}
+
+static void smcinvoke_exit(void)
+{
+	platform_driver_unregister(&smcinvoke_plat_driver);
+}
+
+module_init(smcinvoke_init);
+module_exit(smcinvoke_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("SMC Invoke driver");
+MODULE_IMPORT_NS(VFS_internal_I_am_really_a_filesystem_and_am_NOT_a_driver);
+MODULE_IMPORT_NS(DMA_BUF);
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smcinvoke/smcinvoke_kernel.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/smcinvoke/smcinvoke_kernel.c
@@ -0,0 +1,602 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/fdtable.h>
+#include <linux/anon_inodes.h>
+#include <linux/delay.h>
+#include <linux/kref.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/firmware.h>
+#include <linux/elf.h>
+
+#include "smci_internal.h"
+
+#if IS_ENABLED(CONFIG_QSEECOM_COMPAT)
+#include "smci_qseecomcompat.h"
+#include "smci_qseecomcompatapploader.h"
+/* TODO: Add below headers once qseecom compat is enabled. */
+//#include <linux/qseecom_api.h>
+//#include <linux/qseecom_kernel.h>
+#endif
+
+#define MAX_FW_APP_SIZE	256		//Application name size.
+#define FILE_EXT_SIZE	5		//File extension like .mbn etc
+
+const uint32_t CQSEEComCompatAppLoader_UID = 122;
+
+struct qseecom_compat_context {
+	void *dev; /* in/out */
+	unsigned char *sbuf; /* in/out */
+	uint32_t sbuf_len; /* in/out */
+	struct qtee_shm shm;
+	uint8_t app_arch;
+	struct Object client_env;
+	struct Object app_loader;
+	struct Object app_controller;
+};
+
+struct tzobject_context {
+	int fd;
+	struct kref refs;
+};
+
+static int invoke_over_smcinvoke(void *cxt,
+			uint32_t op,
+			union ObjectArg *args,
+			uint32_t counts);
+
+static struct Object tzobject_new(int fd)
+{
+	struct tzobject_context *me =
+			kzalloc(sizeof(struct tzobject_context), GFP_KERNEL);
+	if (!me)
+		return Object_NULL;
+
+	kref_init(&me->refs);
+	me->fd = fd;
+	pr_debug("%s: me->fd = %d, me->refs = %u\n", __func__,
+			me->fd, kref_read(&me->refs));
+	return (struct Object) { invoke_over_smcinvoke, me };
+}
+
+static void tzobject_delete(struct kref *refs)
+{
+	struct tzobject_context *me = container_of(refs,
+				struct tzobject_context, refs);
+
+	pr_info("%s: me->fd = %d, me->refs = %d, files = %p\n",
+		__func__, me->fd, kref_read(&me->refs), current->files);
+	/*
+	 * after _close_fd(), ref_cnt will be 0,
+	 * but smcinvoke_release() was still not called,
+	 * so we first call smcinvoke_release_from_kernel_client() to
+	 * free filp and ask TZ to release object, then call _close_fd()
+	 */
+	smcinvoke_release_from_kernel_client(me->fd);
+	close_fd(me->fd);
+	kfree(me);
+}
+
+static int getObjectFromHandle(int handle, struct Object *obj)
+{
+	int ret = 0;
+
+	if (handle == SMCINVOKE_USERSPACE_OBJ_NULL) {
+		/* NULL object*/
+		Object_ASSIGN_NULL(*obj);
+	} else if (handle > SMCINVOKE_USERSPACE_OBJ_NULL) {
+		*obj = tzobject_new(handle);
+		if (Object_isNull(*obj))
+			ret = OBJECT_ERROR_BADOBJ;
+	} else {
+		pr_err("CBobj not supported for handle %d\n", handle);
+		ret = OBJECT_ERROR_BADOBJ;
+	}
+
+	return ret;
+}
+
+static int getHandleFromObject(struct Object obj, int *handle)
+{
+	int ret = 0;
+
+	if (Object_isNull(obj)) {
+	/* set NULL Object's fd to be -1 */
+		*handle = SMCINVOKE_USERSPACE_OBJ_NULL;
+		return ret;
+	}
+
+	if (obj.invoke == invoke_over_smcinvoke) {
+		struct tzobject_context *ctx = (struct tzobject_context *)(obj.context);
+
+		if (ctx != NULL) {
+			*handle = ctx->fd;
+		} else {
+			pr_err("Failed to get tzobject_context obj handle, ret = %d\n", ret);
+			ret = OBJECT_ERROR_BADOBJ;
+		}
+	} else {
+		pr_err("CBobj not supported\n");
+		ret = OBJECT_ERROR_BADOBJ;
+	}
+
+	return ret;
+}
+
+static int marshalIn(struct smcinvoke_cmd_req *req,
+			union smcinvoke_arg *argptr,
+			uint32_t op, union ObjectArg *args,
+			uint32_t counts)
+{
+	size_t i = 0;
+
+	req->op = op;
+	req->counts = counts;
+	req->argsize = sizeof(union smcinvoke_arg);
+	req->args = (uintptr_t)argptr;
+
+	FOR_ARGS(i, counts, buffers) {
+		argptr[i].b.addr = (uintptr_t) args[i].b.ptr;
+		argptr[i].b.size = args[i].b.size;
+	}
+
+	FOR_ARGS(i, counts, OI) {
+		int handle = -1, ret;
+
+		ret = getHandleFromObject(args[i].o, &handle);
+		if (ret) {
+			pr_err("invalid OI[%zu]\n", i);
+			return OBJECT_ERROR_BADOBJ;
+		}
+		argptr[i].o.fd = handle;
+	}
+
+	FOR_ARGS(i, counts, OO) {
+		argptr[i].o.fd = SMCINVOKE_USERSPACE_OBJ_NULL;
+	}
+	return OBJECT_OK;
+}
+
+static int marshalOut(struct smcinvoke_cmd_req *req,
+			union smcinvoke_arg *argptr,
+			union ObjectArg *args, uint32_t counts,
+			struct tzobject_context *me)
+{
+	int ret = req->result;
+	bool failed = false;
+	size_t i = 0;
+
+	argptr = (union smcinvoke_arg *)(uintptr_t)(req->args);
+
+	FOR_ARGS(i, counts, BO) {
+		args[i].b.size = argptr[i].b.size;
+	}
+
+	FOR_ARGS(i, counts, OO) {
+		ret = getObjectFromHandle(argptr[i].o.fd, &(args[i].o));
+		if (ret) {
+			pr_err("Failed to get OO[%zu] from handle = %d\n",
+				i, (int)argptr[i].o.fd);
+			failed = true;
+			break;
+		}
+		pr_debug("Succeed to create OO for args[%zu].o, fd = %d\n",
+			i, (int)argptr[i].o.fd);
+	}
+	if (failed) {
+		FOR_ARGS(i, counts, OO) {
+			Object_ASSIGN_NULL(args[i].o);
+		}
+		/* Only overwrite ret value if invoke result is 0 */
+		if (ret == 0)
+			ret = OBJECT_ERROR_BADOBJ;
+	}
+	return ret;
+}
+
+static int invoke_over_smcinvoke(void *cxt,
+			uint32_t op,
+			union ObjectArg *args,
+			uint32_t counts)
+{
+	int ret = OBJECT_OK;
+	struct smcinvoke_cmd_req req = {0, 0, 0, 0, 0};
+	size_t i = 0;
+	struct tzobject_context *me = NULL;
+	uint32_t method;
+	union smcinvoke_arg *argptr = NULL;
+
+	FOR_ARGS(i, counts, OO) {
+		args[i].o = Object_NULL;
+	}
+
+	me = (struct tzobject_context *)cxt;
+	method = ObjectOp_methodID(op);
+	pr_debug("%s: cxt = %p, fd = %d, op = %u, cnt = %x, refs = %u\n",
+			__func__, me, me->fd, op, counts, kref_read(&me->refs));
+
+	if (ObjectOp_isLocal(op)) {
+		switch (method) {
+		case Object_OP_retain:
+			kref_get(&me->refs);
+			return OBJECT_OK;
+		case Object_OP_release:
+			kref_put(&me->refs, tzobject_delete);
+			return OBJECT_OK;
+		}
+		return OBJECT_ERROR_REMOTE;
+	}
+
+	argptr = kcalloc(OBJECT_COUNTS_TOTAL(counts),
+			sizeof(union smcinvoke_arg), GFP_KERNEL);
+	if (argptr == NULL)
+		return OBJECT_ERROR_KMEM;
+
+	ret = marshalIn(&req, argptr, op, args, counts);
+	if (ret)
+		goto exit;
+
+	ret = process_invoke_request_from_kernel_client(me->fd, &req);
+	if (ret) {
+		pr_err("INVOKE failed with ret = %d, result = %d\n"
+			"obj.context = %p, fd = %d, op = %d, counts = 0x%x\n",
+			ret, req.result, me, me->fd, op, counts);
+		FOR_ARGS(i, counts, OO) {
+			struct smcinvoke_obj obj = argptr[i].o;
+
+			if (obj.fd >= 0) {
+				pr_err("Close OO[%zu].fd = %lld\n", i, obj.fd);
+				close_fd(obj.fd);
+			}
+		}
+		if (ret == -EBUSY)
+			ret = OBJECT_ERROR_BUSY;
+		else if (ret == -ENOMEM)
+			ret = OBJECT_ERROR_KMEM;
+		else
+			ret = OBJECT_ERROR_UNAVAIL;
+
+		goto exit;
+	}
+
+	if (!req.result)
+		ret = marshalOut(&req, argptr, args, counts, me);
+exit:
+	kfree(argptr);
+	return ret | req.result;
+}
+
+int get_root_obj(struct Object *rootObj)
+{
+	int ret = 0;
+	int root_fd = -1;
+
+	ret = get_root_fd(&root_fd);
+	if (ret) {
+		pr_err("Failed to get root fd, ret = %d\n", ret);
+		return ret;
+	}
+	*rootObj = tzobject_new(root_fd);
+	if (Object_isNull(*rootObj)) {
+		close_fd(root_fd);
+		ret = -ENOMEM;
+	}
+	return ret;
+}
+
+/*
+ * Get a client environment using a NULL credentials Object
+ */
+int32_t get_client_env_object(struct Object *clientEnvObj)
+{
+	int32_t  ret = OBJECT_ERROR;
+	int retry_count = 0;
+	struct Object rootObj = Object_NULL;
+
+	/* get rootObj */
+	ret = get_root_obj(&rootObj);
+	if (ret) {
+		pr_err("Failed to create rootobj\n");
+		return ret;
+	}
+
+	/* get client env */
+	do {
+		ret = IClientEnv_registerWithCredentials(rootObj,
+			Object_NULL, clientEnvObj);
+		if (ret == OBJECT_ERROR_BUSY) {
+			pr_err("Secure side is busy,will retry after 5 ms, retry_count = %d\n",
+					retry_count);
+			msleep(SMCINVOKE_INTERFACE_BUSY_WAIT_MS);
+		}
+	} while ((ret == OBJECT_ERROR_BUSY) && (retry_count++ < SMCINVOKE_INTERFACE_MAX_RETRY));
+
+	if (ret)
+		pr_err("Failed to get ClientEnvObject, ret = %d\n", ret);
+
+	Object_release(rootObj);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(get_client_env_object);
+
+#if IS_ENABLED(CONFIG_QSEECOM_COMPAT)
+
+static int load_app(struct qseecom_compat_context *cxt, const char *app_name)
+{
+	size_t fw_size = 0;
+	u8 *imgbuf_va = NULL;
+	int ret = 0;
+	char dist_name[MAX_FW_APP_SIZE] = {0};
+	size_t dist_name_len = 0;
+	struct qtee_shm shm = {0};
+
+	if (strnlen(app_name, MAX_FW_APP_SIZE) == MAX_FW_APP_SIZE) {
+		pr_err("The app_name (%s) with length %zu is not valid\n",
+			app_name, strnlen(app_name, MAX_FW_APP_SIZE));
+		return -EINVAL;
+	}
+
+	ret = IQSEEComCompatAppLoader_lookupTA(cxt->app_loader,
+		app_name, strlen(app_name), &cxt->app_controller);
+	if (!ret) {
+		pr_info("app %s exists\n", app_name);
+		return ret;
+	}
+
+	imgbuf_va = firmware_request_from_smcinvoke(app_name, &fw_size, &shm);
+	if (imgbuf_va == NULL) {
+		pr_err("Failed on firmware_request_from_smcinvoke\n");
+		return -EINVAL;
+	}
+
+	ret = IQSEEComCompatAppLoader_loadFromBuffer(
+			cxt->app_loader, imgbuf_va, fw_size,
+			app_name, strlen(app_name),
+			dist_name, MAX_FW_APP_SIZE, &dist_name_len,
+			&cxt->app_controller);
+	if (ret) {
+		pr_err("loadFromBuffer failed for app %s, ret = %d\n",
+				app_name, ret);
+		goto exit_release_shm;
+	}
+	cxt->app_arch = *(uint8_t *)(imgbuf_va + EI_CLASS);
+
+	pr_info("%s %d, loaded app %s, dist_name %s, dist_name_len %zu\n",
+		__func__, __LINE__, app_name, dist_name, dist_name_len);
+
+exit_release_shm:
+	qtee_shmbridge_free_shm(&shm);
+	return ret;
+}
+
+int qseecom_start_app(struct qseecom_handle **handle,
+					char *app_name, uint32_t size)
+{
+	int ret = 0;
+	struct qseecom_compat_context *cxt = NULL;
+
+	pr_warn("%s, start app %s, size %u\n",
+		__func__, app_name, size);
+	if (app_name == NULL || handle == NULL) {
+		pr_err("app_name is null or invalid handle\n");
+		return -EINVAL;
+	}
+	/* allocate qseecom_compat_context */
+	cxt = kzalloc(sizeof(struct qseecom_compat_context), GFP_KERNEL);
+	if (!cxt)
+		return -ENOMEM;
+
+	/* get client env */
+	ret = get_client_env_object(&cxt->client_env);
+	if (ret) {
+		pr_err("failed to get clientEnv when loading app %s, ret %d\n",
+			app_name, ret);
+		ret = -EINVAL;
+		goto exit_free_cxt;
+	}
+	/* get apploader with CQSEEComCompatAppLoader_UID */
+	ret = IClientEnv_open(cxt->client_env, CQSEEComCompatAppLoader_UID,
+				&cxt->app_loader);
+	if (ret) {
+		pr_err("failed to get apploader when loading app %s, ret %d\n",
+			app_name, ret);
+		ret = -EINVAL;
+		goto exit_release_clientenv;
+	}
+
+	/* load app*/
+	ret = load_app(cxt, app_name);
+	if (ret) {
+		pr_err("failed to load app %s, ret = %d\n",
+			app_name, ret);
+		ret = -EINVAL;
+		goto exit_release_apploader;
+	}
+
+	/* Get the physical address of the req/resp buffer */
+	ret = qtee_shmbridge_allocate_shm(size, &cxt->shm);
+
+	if (ret) {
+		pr_err("qtee_shmbridge_allocate_shm failed, ret :%d\n", ret);
+		ret = -EINVAL;
+		goto exit_release_appcontroller;
+	}
+	cxt->sbuf = cxt->shm.vaddr;
+	cxt->sbuf_len = size;
+	*handle = (struct qseecom_handle *)cxt;
+
+	return ret;
+
+exit_release_appcontroller:
+	Object_release(cxt->app_controller);
+exit_release_apploader:
+	Object_release(cxt->app_loader);
+exit_release_clientenv:
+	Object_release(cxt->client_env);
+exit_free_cxt:
+	kfree(cxt);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qseecom_start_app);
+
+int qseecom_shutdown_app(struct qseecom_handle **handle)
+{
+	struct qseecom_compat_context *cxt = NULL;
+
+	if ((handle == NULL)  || (*handle == NULL)) {
+		pr_err("Handle is NULL\n");
+		return -EINVAL;
+	}
+
+	cxt = (struct qseecom_compat_context *)(*handle);
+
+	qtee_shmbridge_free_shm(&cxt->shm);
+	Object_release(cxt->app_controller);
+	Object_release(cxt->app_loader);
+	Object_release(cxt->client_env);
+	kfree(cxt);
+	*handle = NULL;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(qseecom_shutdown_app);
+
+int qseecom_send_command(struct qseecom_handle *handle, void *send_buf,
+			uint32_t sbuf_len, void *resp_buf, uint32_t rbuf_len)
+{
+	struct qseecom_compat_context *cxt =
+			(struct qseecom_compat_context *)handle;
+	size_t out_len = 0;
+
+	pr_debug("%s, sbuf_len %u, rbuf_len %u\n",
+		__func__, sbuf_len, rbuf_len);
+
+	if (!handle || !send_buf || !resp_buf || !sbuf_len || !rbuf_len) {
+		pr_err("One of params is invalid. %s, handle %p, send_buf %p,resp_buf %p,sbuf_len %u, rbuf_len %u\n",
+			 __func__, handle, send_buf, resp_buf, sbuf_len, rbuf_len);
+		return -EINVAL;
+	}
+	return IQSEEComCompat_sendRequest(cxt->app_controller,
+				  send_buf, sbuf_len,
+				  resp_buf, rbuf_len,
+				  send_buf, sbuf_len, &out_len,
+				  resp_buf, rbuf_len, &out_len,
+				  NULL, 0, /* embedded offset array */
+				  (cxt->app_arch == ELFCLASS64),
+				  Object_NULL, Object_NULL,
+				  Object_NULL, Object_NULL);
+}
+EXPORT_SYMBOL_GPL(qseecom_send_command);
+#endif
+
+char *firmware_request_from_smcinvoke(const char *appname, size_t *fw_size, struct qtee_shm *shm)
+{
+
+	int rc = 0;
+	const struct firmware *fw_entry = NULL, *fw_entry00 = NULL, *fw_entrylast = NULL;
+	char fw_name[MAX_FW_APP_SIZE + FILE_EXT_SIZE] = "\0";
+	int num_images = 0, phi = 0;
+	unsigned char app_arch = 0;
+	u8 *img_data_ptr = NULL;
+	size_t bufferOffset = 0, phdr_table_offset = 0;
+	size_t *offset = NULL;
+	Elf32_Phdr phdr32;
+	Elf64_Phdr phdr64;
+	struct elf32_hdr *ehdr = NULL;
+	struct elf64_hdr *ehdr64 = NULL;
+
+
+	/* load b00*/
+	snprintf(fw_name, sizeof(fw_name), "%s.b00", appname);
+	rc = firmware_request_nowarn(&fw_entry00, fw_name, class_dev);
+	if (rc) {
+		pr_err("Load %s failed, ret:%d\n", fw_name, rc);
+		return NULL;
+	}
+
+	app_arch = *(unsigned char *)(fw_entry00->data + EI_CLASS);
+
+	/*Get the offsets for split images header*/
+	if (app_arch == ELFCLASS32) {
+
+		ehdr = (struct elf32_hdr *)fw_entry00->data;
+		num_images = ehdr->e_phnum;
+		offset = kcalloc(num_images, sizeof(size_t), GFP_KERNEL);
+		if (offset == NULL)
+			goto release_fw_entry00;
+		phdr_table_offset = (size_t) ehdr->e_phoff;
+		for (phi = 1; phi < num_images; ++phi) {
+			bufferOffset = phdr_table_offset + phi * sizeof(Elf32_Phdr);
+			phdr32 = *(Elf32_Phdr *)(fw_entry00->data + bufferOffset);
+			offset[phi] = (size_t)phdr32.p_offset;
+		}
+
+	} else if (app_arch == ELFCLASS64) {
+
+		ehdr64 = (struct elf64_hdr *)fw_entry00->data;
+		num_images = ehdr64->e_phnum;
+		offset = kcalloc(num_images, sizeof(size_t), GFP_KERNEL);
+		if (offset == NULL)
+			goto release_fw_entry00;
+		phdr_table_offset = (size_t) ehdr64->e_phoff;
+		for (phi = 1; phi < num_images; ++phi) {
+			bufferOffset = phdr_table_offset + phi * sizeof(Elf64_Phdr);
+			phdr64 = *(Elf64_Phdr *)(fw_entry00->data + bufferOffset);
+			offset[phi] = (size_t)phdr64.p_offset;
+		}
+
+	} else {
+
+		pr_err("QSEE %s app, arch %u is not supported\n", appname, app_arch);
+		goto release_fw_entry00;
+	}
+
+	/*Find the size of last split bin image*/
+	snprintf(fw_name, ARRAY_SIZE(fw_name), "%s.b%02d", appname, num_images-1);
+	rc = firmware_request_nowarn(&fw_entrylast, fw_name, class_dev);
+	if (rc) {
+		pr_err("Failed to locate blob %s\n", fw_name);
+		goto release_fw_entry00;
+	}
+
+	/*Total size of image will be the offset of last image + the size of last split image*/
+	*fw_size = fw_entrylast->size + offset[num_images-1];
+
+	/*Allocate memory for the buffer that will hold the split image*/
+	rc = qtee_shmbridge_allocate_shm((*fw_size), shm);
+	if (rc) {
+		pr_err("smbridge alloc failed for size: %zu\n", *fw_size);
+		goto release_fw_entrylast;
+	}
+	img_data_ptr = shm->vaddr;
+	/*
+	 * Copy contents of split bins to the buffer
+	 */
+	memcpy(img_data_ptr, fw_entry00->data, fw_entry00->size);
+	for (phi = 1; phi < num_images-1; phi++) {
+		snprintf(fw_name, ARRAY_SIZE(fw_name), "%s.b%02d", appname, phi);
+		rc = firmware_request_nowarn(&fw_entry, fw_name, class_dev);
+		if (rc) {
+			pr_err("Failed to locate blob %s\n", fw_name);
+			qtee_shmbridge_free_shm(shm);
+			img_data_ptr = NULL;
+			goto release_fw_entrylast;
+		}
+		memcpy(img_data_ptr + offset[phi], fw_entry->data, fw_entry->size);
+		release_firmware(fw_entry);
+		fw_entry = NULL;
+	}
+	memcpy(img_data_ptr + offset[phi], fw_entrylast->data, fw_entrylast->size);
+
+release_fw_entrylast:
+	release_firmware(fw_entrylast);
+release_fw_entry00:
+	release_firmware(fw_entry00);
+	kfree(offset);
+	return img_data_ptr;
+}
+EXPORT_SYMBOL_GPL(firmware_request_from_smcinvoke);
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smcinvoke/trace_smcinvoke.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/smcinvoke/trace_smcinvoke.h
@@ -0,0 +1,495 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM smcinvoke
+
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace_smcinvoke
+
+#if !defined(_TRACE_SMCINVOKE) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_SMCINVOKE_H
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+#include <linux/smcinvoke.h>
+
+TRACE_EVENT(put_pending_cbobj_locked,
+	TP_PROTO(uint16_t srvr_id, uint16_t obj_id),
+	TP_ARGS(srvr_id, obj_id),
+	TP_STRUCT__entry(
+		__field(uint16_t,	srvr_id)
+		__field(uint16_t,	obj_id)
+	),
+	TP_fast_assign(
+		__entry->srvr_id	= srvr_id;
+		__entry->obj_id		= obj_id;
+	),
+	TP_printk("srvr_id=0x%x obj_id=0x%x",
+			__entry->srvr_id, __entry->obj_id)
+);
+
+TRACE_EVENT(release_mem_obj_locked,
+	TP_PROTO(uint32_t tzhandle, size_t buf_len),
+	TP_ARGS(tzhandle, buf_len),
+	TP_STRUCT__entry(
+		__field(uint32_t,	tzhandle)
+		__field(size_t,		buf_len)
+	),
+	TP_fast_assign(
+		__entry->tzhandle	= tzhandle;
+		__entry->buf_len	= buf_len;
+	),
+	TP_printk("tzhandle=0x%08x, buf_len=%zu",
+			__entry->tzhandle, __entry->buf_len)
+);
+
+TRACE_EVENT(invoke_cmd_handler,
+	TP_PROTO(int cmd, uint64_t response_type, int32_t result, int ret),
+	TP_ARGS(cmd, response_type, result, ret),
+	TP_STRUCT__entry(
+		__field(int,		cmd)
+		__field(uint64_t,	response_type)
+		__field(int32_t,	result)
+		__field(int,		ret)
+	),
+	TP_fast_assign(
+		__entry->response_type	= response_type;
+		__entry->result		= result;
+		__entry->ret		= ret;
+		__entry->cmd		= cmd;
+	),
+	TP_printk("cmd=0x%x (%d), response_type=%llu, result=0x%x (%d), ret=%d",
+			__entry->cmd, __entry->cmd, __entry->response_type,
+			__entry->result, __entry->result, __entry->ret)
+);
+
+TRACE_EVENT(process_tzcb_req_handle,
+	TP_PROTO(uint32_t tzhandle, uint32_t op, uint32_t counts),
+	TP_ARGS(tzhandle, op, counts),
+	TP_STRUCT__entry(
+		__field(uint32_t,	tzhandle)
+		__field(uint32_t,	op)
+		__field(uint32_t,	counts)
+	),
+	TP_fast_assign(
+		__entry->tzhandle	= tzhandle;
+		__entry->op		= op;
+		__entry->counts		= counts;
+	),
+	TP_printk("tzhandle=0x%08x op=0x%02x counts=0x%04x",
+			__entry->tzhandle, __entry->op, __entry->counts)
+);
+
+TRACE_EVENT(process_tzcb_req_wait,
+	TP_PROTO(uint32_t tzhandle, int cbobj_retries, uint32_t txn_id, pid_t pid, pid_t tgid,
+			uint16_t server_state, uint16_t server_id, unsigned int cb_reqs_inflight),
+	TP_ARGS(tzhandle, cbobj_retries, txn_id, pid, tgid, server_state, server_id,
+			cb_reqs_inflight),
+	TP_STRUCT__entry(
+		__field(uint32_t,	tzhandle)
+		__field(int,		cbobj_retries)
+		__field(uint32_t,	txn_id)
+		__field(pid_t,		pid)
+		__field(pid_t,		tgid)
+		__field(uint16_t,	server_state)
+		__field(uint16_t,	server_id)
+		__field(unsigned int,	cb_reqs_inflight)
+	),
+	TP_fast_assign(
+		__entry->tzhandle		= tzhandle;
+		__entry->cbobj_retries		= cbobj_retries;
+		__entry->txn_id			= txn_id;
+		__entry->pid			= pid;
+		__entry->tgid			= tgid;
+		__entry->server_state		= server_state;
+		__entry->server_id		= server_id;
+		__entry->cb_reqs_inflight	= cb_reqs_inflight;
+	),
+	TP_printk("tzhandle=0x%08x, retries=%d, txn_id=%d, pid %x,tid %x, srvr state=%d, server_id=0x%x, cb_reqs_inflight=%d",
+			__entry->tzhandle, __entry->cbobj_retries, __entry->txn_id,
+			__entry->pid, __entry->tgid, __entry->server_state,
+			__entry->server_id, __entry->cb_reqs_inflight)
+);
+
+TRACE_EVENT(process_tzcb_req_result,
+	TP_PROTO(int32_t result, uint32_t tzhandle, uint32_t op, uint32_t counts,
+			unsigned int cb_reqs_inflight),
+	TP_ARGS(result, tzhandle, op, counts, cb_reqs_inflight),
+	TP_STRUCT__entry(
+		__field(int32_t,	result)
+		__field(uint32_t,	tzhandle)
+		__field(uint32_t,	op)
+		__field(uint32_t,	counts)
+		__field(unsigned int,	cb_reqs_inflight)
+	),
+	TP_fast_assign(
+		__entry->result			= result;
+		__entry->tzhandle		= tzhandle;
+		__entry->op			= op;
+		__entry->counts			= counts;
+		__entry->cb_reqs_inflight	= cb_reqs_inflight;
+	),
+	TP_printk("result=%d tzhandle=0x%08x op=0x%02x counts=0x%04x, cb_reqs_inflight=%d",
+			__entry->result, __entry->tzhandle, __entry->op, __entry->counts,
+			__entry->cb_reqs_inflight)
+);
+
+TRACE_EVENT(marshal_out_invoke_req,
+	TP_PROTO(int i, uint32_t tzhandle, uint16_t server, uint32_t fd),
+	TP_ARGS(i, tzhandle, server, fd),
+	TP_STRUCT__entry(
+		__field(int,		i)
+		__field(uint32_t,	tzhandle)
+		__field(uint16_t,	server)
+		__field(uint32_t,	fd)
+	),
+	TP_fast_assign(
+		__entry->i		= i;
+		__entry->tzhandle	= tzhandle;
+		__entry->server		= server;
+		__entry->fd		= fd;
+	),
+	TP_printk("OO[%d]: tzhandle=0x%x server=0x%x fd=0x%x",
+			__entry->i, __entry->tzhandle, __entry->server, __entry->fd)
+);
+
+TRACE_EVENT(prepare_send_scm_msg,
+	TP_PROTO(uint64_t response_type, int32_t result),
+	TP_ARGS(response_type, result),
+	TP_STRUCT__entry(
+		__field(uint64_t,	response_type)
+		__field(int32_t,	result)
+	),
+	TP_fast_assign(
+		__entry->response_type	= response_type;
+		__entry->result		= result;
+	),
+	TP_printk("response_type=%llu (%llu), result=0x%x (%d)",
+			__entry->response_type, __entry->response_type,
+			__entry->result, __entry->result)
+);
+
+TRACE_EVENT(marshal_in_invoke_req,
+	TP_PROTO(int i, int64_t fd, int32_t cb_server_fd, uint32_t tzhandle),
+	TP_ARGS(i, fd, cb_server_fd, tzhandle),
+	TP_STRUCT__entry(
+		__field(int,		i)
+		__field(int64_t,	fd)
+		__field(int32_t,	cb_server_fd)
+		__field(uint32_t,	tzhandle)
+	),
+	TP_fast_assign(
+		__entry->i		= i;
+		__entry->fd		= fd;
+		__entry->cb_server_fd	= cb_server_fd;
+		__entry->tzhandle	= tzhandle;
+	),
+	TP_printk("OI[%d]: fd=%lld cb_server_fd=0x%x tzhandle=0x%x",
+			__entry->i, __entry->fd, __entry->cb_server_fd, __entry->tzhandle)
+);
+
+TRACE_EVENT(marshal_in_tzcb_req_handle,
+	TP_PROTO(uint32_t tzhandle, int srvr_id, int32_t cbobj_id, uint32_t op, uint32_t counts),
+	TP_ARGS(tzhandle, srvr_id, cbobj_id, op, counts),
+	TP_STRUCT__entry(
+		__field(uint32_t,	tzhandle)
+		__field(int,		srvr_id)
+		__field(int32_t,	cbobj_id)
+		__field(uint32_t,	op)
+		__field(uint32_t,	counts)
+	),
+	TP_fast_assign(
+		__entry->tzhandle	= tzhandle;
+		__entry->srvr_id	= srvr_id;
+		__entry->cbobj_id	= cbobj_id;
+		__entry->op		= op;
+		__entry->counts		= counts;
+	),
+	TP_printk("tzhandle=0x%x srvr_id=0x%x cbobj_id=0x%08x op=0x%02x counts=0x%04x",
+			__entry->tzhandle, __entry->srvr_id, __entry->cbobj_id,
+			__entry->op, __entry->counts)
+);
+
+TRACE_EVENT(marshal_in_tzcb_req_fd,
+	TP_PROTO(int i, uint32_t tzhandle, int srvr_id, int32_t fd),
+	TP_ARGS(i, tzhandle, srvr_id, fd),
+	TP_STRUCT__entry(
+		__field(int,		i)
+		__field(uint32_t,	tzhandle)
+		__field(int,		srvr_id)
+		__field(int32_t,	fd)
+	),
+	TP_fast_assign(
+		__entry->i		= i;
+		__entry->tzhandle	= tzhandle;
+		__entry->srvr_id	= srvr_id;
+		__entry->fd		= fd;
+	),
+	TP_printk("OI[%d]: tzhandle=0x%x srvr_id=0x%x fd=0x%x",
+			__entry->i, __entry->tzhandle, __entry->srvr_id, __entry->fd)
+);
+
+TRACE_EVENT(marshal_out_tzcb_req,
+	TP_PROTO(uint32_t i, int32_t fd, int32_t cb_server_fd, uint32_t tzhandle),
+	TP_ARGS(i, fd, cb_server_fd, tzhandle),
+	TP_STRUCT__entry(
+		__field(int,		i)
+		__field(int32_t,	fd)
+		__field(int32_t,	cb_server_fd)
+		__field(uint32_t,	tzhandle)
+	),
+	TP_fast_assign(
+		__entry->i		= i;
+		__entry->fd		= fd;
+		__entry->cb_server_fd	= cb_server_fd;
+		__entry->tzhandle	= tzhandle;
+	),
+	TP_printk("OO[%d]: fd=0x%x cb_server_fd=0x%x tzhandle=0x%x",
+			__entry->i, __entry->fd, __entry->cb_server_fd, __entry->tzhandle)
+);
+
+TRACE_EVENT(process_invoke_req_tzhandle,
+	TP_PROTO(uint32_t tzhandle, uint32_t op, uint32_t counts),
+	TP_ARGS(tzhandle, op, counts),
+	TP_STRUCT__entry(
+		__field(uint32_t, tzhandle)
+		__field(uint32_t, op)
+		__field(uint32_t, counts)
+	),
+	TP_fast_assign(
+		__entry->tzhandle	= tzhandle;
+		__entry->op		= op;
+		__entry->counts		= counts;
+	),
+	TP_printk("tzhandle=0x%08x op=0x%02x counts=0x%04x",
+			__entry->tzhandle, __entry->op, __entry->counts)
+);
+
+TRACE_EVENT(process_invoke_req_result,
+	TP_PROTO(int ret, int32_t result, uint32_t tzhandle, uint32_t op, uint32_t counts),
+	TP_ARGS(ret, result, tzhandle, op, counts),
+	TP_STRUCT__entry(
+		__field(int,		ret)
+		__field(int32_t,	result)
+		__field(uint32_t,	tzhandle)
+		__field(uint32_t,	op)
+		__field(uint32_t,	counts)
+	),
+	TP_fast_assign(
+		__entry->ret		= ret;
+		__entry->result		= result;
+		__entry->tzhandle	= tzhandle;
+		__entry->op		= op;
+		__entry->counts		= counts;
+	),
+	TP_printk("ret=%d result=%d tzhandle=0x%08x op=0x%02x counts=0x%04x",
+			__entry->ret, __entry->result, __entry->tzhandle,
+			__entry->op, __entry->counts)
+);
+
+TRACE_EVENT(process_log_info,
+	TP_PROTO(char *buf, uint32_t context_type, uint32_t tzhandle),
+	TP_ARGS(buf, context_type, tzhandle),
+	TP_STRUCT__entry(
+		__string(str,		buf)
+		__field(uint32_t,	context_type)
+		__field(uint32_t,	tzhandle)
+	),
+	TP_fast_assign(
+		__assign_str(str, buf);
+		__entry->context_type	= context_type;
+		__entry->tzhandle	= tzhandle;
+	),
+	TP_printk("%s context_type=%d tzhandle=0x%08x",
+			__get_str(str),
+			__entry->context_type, __entry->tzhandle)
+);
+
+TRACE_EVENT_CONDITION(smcinvoke_ioctl,
+	TP_PROTO(unsigned int cmd, long ret),
+	TP_ARGS(cmd, ret),
+	TP_CONDITION(ret),
+	TP_STRUCT__entry(
+		__field(unsigned int,	cmd)
+		__field(long,		ret)
+	),
+	TP_fast_assign(
+		__entry->cmd = cmd;
+		__entry->ret = ret;
+	),
+	TP_printk("cmd=%s ret=%ld",
+			__print_symbolic(__entry->cmd,
+				{SMCINVOKE_IOCTL_INVOKE_REQ,	"SMCINVOKE_IOCTL_INVOKE_REQ"},
+				{SMCINVOKE_IOCTL_ACCEPT_REQ,	"SMCINVOKE_IOCTL_ACCEPT_REQ"},
+				{SMCINVOKE_IOCTL_SERVER_REQ,	"SMCINVOKE_IOCTL_SERVER_REQ"},
+				{SMCINVOKE_IOCTL_ACK_LOCAL_OBJ,	"SMCINVOKE_IOCTL_ACK_LOCAL_OBJ"},
+				{SMCINVOKE_IOCTL_LOG,		"SMCINVOKE_IOCTL_LOG"}
+			), __entry->ret)
+);
+
+TRACE_EVENT(smcinvoke_create_bridge,
+	TP_PROTO(uint64_t shmbridge_handle, uint16_t mem_region_id),
+	TP_ARGS(shmbridge_handle, mem_region_id),
+	TP_STRUCT__entry(
+		__field(uint64_t,	shmbridge_handle)
+		__field(uint16_t,	mem_region_id)
+	),
+	TP_fast_assign(
+		__entry->shmbridge_handle	= shmbridge_handle;
+		__entry->mem_region_id		= mem_region_id;
+	),
+	TP_printk("created shm bridge handle %llu for mem_region_id %u",
+			__entry->shmbridge_handle, __entry->mem_region_id)
+);
+
+TRACE_EVENT(status,
+	TP_PROTO(const char *func, const char *status),
+	TP_ARGS(func, status),
+	TP_STRUCT__entry(
+		__string(str,	func)
+		__string(str2,	status)
+	),
+	TP_fast_assign(
+		__assign_str(str,	func);
+		__assign_str(str2,	status);
+	),
+	TP_printk("%s status=%s", __get_str(str), __get_str(str2))
+);
+
+TRACE_EVENT(process_accept_req_has_response,
+	TP_PROTO(pid_t pid, pid_t tgid),
+	TP_ARGS(pid, tgid),
+	TP_STRUCT__entry(
+		__field(pid_t,	pid)
+		__field(pid_t,	tgid)
+	),
+	TP_fast_assign(
+		__entry->pid	= pid;
+		__entry->tgid	= tgid;
+	),
+	TP_printk("pid=0x%x, tgid=0x%x", __entry->pid, __entry->tgid)
+);
+
+TRACE_EVENT(process_accept_req_ret,
+	TP_PROTO(pid_t pid, pid_t tgid, int ret),
+	TP_ARGS(pid, tgid, ret),
+	TP_STRUCT__entry(
+		__field(pid_t,	pid)
+		__field(pid_t,	tgid)
+		__field(int,	ret)
+	),
+	TP_fast_assign(
+		__entry->pid	= pid;
+		__entry->tgid	= tgid;
+		__entry->ret	= ret;
+	),
+	TP_printk("pid=0x%x tgid=0x%x ret=%d", __entry->pid, __entry->tgid, __entry->ret)
+);
+
+TRACE_EVENT(process_accept_req_placed,
+	TP_PROTO(pid_t pid, pid_t tgid),
+	TP_ARGS(pid, tgid),
+	TP_STRUCT__entry(
+		__field(pid_t,	pid)
+		__field(pid_t,	tgid)
+	),
+	TP_fast_assign(
+		__entry->pid	= pid;
+		__entry->tgid	= tgid;
+	),
+	TP_printk("pid=0x%x, tgid=0x%x", __entry->pid, __entry->tgid)
+);
+
+TRACE_EVENT(process_invoke_request_from_kernel_client,
+	TP_PROTO(int fd, struct file *filp, int f_count),
+	TP_ARGS(fd, filp, f_count),
+	TP_STRUCT__entry(
+		__field(int,		fd)
+		__field(struct file*,	filp)
+		__field(int,		f_count)
+	),
+	TP_fast_assign(
+		__entry->fd		= fd;
+		__entry->filp		= filp;
+		__entry->f_count	= f_count;
+	),
+	TP_printk("fd=%d, filp=%p, f_count=%d",
+			__entry->fd,
+			__entry->filp,
+			__entry->f_count)
+);
+
+TRACE_EVENT(smcinvoke_release_filp,
+	TP_PROTO(struct files_struct *files, struct file *filp,
+			int f_count, uint32_t context_type),
+	TP_ARGS(files, filp, f_count, context_type),
+	TP_STRUCT__entry(
+		__field(struct files_struct*,	files)
+		__field(struct file*,		filp)
+		__field(int,			f_count)
+		__field(uint32_t,		context_type)
+	),
+	TP_fast_assign(
+		__entry->files		= files;
+		__entry->filp		= filp;
+		__entry->f_count	= f_count;
+		__entry->context_type	= context_type;
+	),
+	TP_printk("files=%p, filp=%p, f_count=%u, cxt_type=%d",
+			__entry->files,
+			__entry->filp,
+			__entry->f_count,
+			__entry->context_type)
+);
+
+TRACE_EVENT(smcinvoke_release_from_kernel_client,
+	TP_PROTO(struct files_struct *files, struct file *filp, int f_count),
+	TP_ARGS(files, filp, f_count),
+	TP_STRUCT__entry(
+		__field(struct files_struct*,	files)
+		__field(struct file*,		filp)
+		__field(int,			f_count)
+	),
+	TP_fast_assign(
+		__entry->files		= files;
+		__entry->filp		= filp;
+		__entry->f_count	= f_count;
+	),
+	TP_printk("files=%p, filp=%p, f_count=%u",
+			__entry->files,
+			__entry->filp,
+			__entry->f_count)
+);
+
+TRACE_EVENT(smcinvoke_release,
+	TP_PROTO(struct files_struct *files, struct file *filp,
+			int f_count, void *private_data),
+	TP_ARGS(files, filp, f_count, private_data),
+	TP_STRUCT__entry(
+		__field(struct files_struct*,	files)
+		__field(struct file*,		filp)
+		__field(int,			f_count)
+		__field(void*,			private_data)
+	),
+	TP_fast_assign(
+		__entry->files		= files;
+		__entry->filp		= filp;
+		__entry->f_count	= f_count;
+		__entry->private_data	= private_data;
+	),
+	TP_printk("files=%p, filp=%p, f_count=%d, private_data=%p",
+			__entry->files,
+			__entry->filp,
+			__entry->f_count,
+			__entry->private_data)
+);
+
+#endif /* _TRACE_SMCINVOKE_H */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH ../../drivers/soc/qcom/smcinvoke
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smd-rpm.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/smd-rpm.c
@@ -196,9 +196,6 @@
 {
 	struct qcom_smd_rpm *rpm;
 
-	if (!rpdev->dev.of_node)
-		return -EINVAL;
-
 	rpm = devm_kzalloc(&rpdev->dev, sizeof(*rpm), GFP_KERNEL);
 	if (!rpm)
 		return -ENOMEM;
@@ -218,18 +215,38 @@
 	of_platform_depopulate(&rpdev->dev);
 }
 
-static const struct rpmsg_device_id qcom_smd_rpm_id_table[] = {
-	{ .name = "rpm_requests", },
-	{ /* sentinel */ }
+static const struct of_device_id qcom_smd_rpm_of_match[] = {
+	{ .compatible = "qcom,rpm-apq8084" },
+	{ .compatible = "qcom,rpm-ipq6018" },
+	{ .compatible = "qcom,rpm-ipq9574" },
+	{ .compatible = "qcom,rpm-msm8226" },
+	{ .compatible = "qcom,rpm-msm8909" },
+	{ .compatible = "qcom,rpm-msm8916" },
+	{ .compatible = "qcom,rpm-msm8936" },
+	{ .compatible = "qcom,rpm-msm8953" },
+	{ .compatible = "qcom,rpm-msm8974" },
+	{ .compatible = "qcom,rpm-msm8976" },
+	{ .compatible = "qcom,rpm-msm8994" },
+	{ .compatible = "qcom,rpm-msm8996" },
+	{ .compatible = "qcom,rpm-msm8998" },
+	{ .compatible = "qcom,rpm-sdm660" },
+	{ .compatible = "qcom,rpm-sm6115" },
+	{ .compatible = "qcom,rpm-sm6125" },
+	{ .compatible = "qcom,rpm-sm6375" },
+	{ .compatible = "qcom,rpm-qcm2290" },
+	{ .compatible = "qcom,rpm-qcs404" },
+	{}
 };
-MODULE_DEVICE_TABLE(rpmsg, qcom_smd_rpm_id_table);
+MODULE_DEVICE_TABLE(of, qcom_smd_rpm_of_match);
 
 static struct rpmsg_driver qcom_smd_rpm_driver = {
 	.probe = qcom_smd_rpm_probe,
 	.remove = qcom_smd_rpm_remove,
 	.callback = qcom_smd_rpm_callback,
-	.id_table = qcom_smd_rpm_id_table,
-	.drv.name = "qcom_smd_rpm",
+	.drv  = {
+		.name  = "qcom_smd_rpm",
+		.of_match_table = qcom_smd_rpm_of_match,
+	},
 };
 
 static int __init qcom_smd_rpm_init(void)
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smem.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/smem.c
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2015, Sony Mobile Communications AB.
  * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/hwspinlock.h>
@@ -85,8 +86,19 @@
 /* Processor/host identifier for the global partition */
 #define SMEM_GLOBAL_HOST	0xfffe
 
-/* Max number of processors/hosts in a system */
-#define SMEM_HOST_COUNT		20
+/* Processor/host identifier for multi host partition */
+#define SMEM_MULTI_HOST		0xfffc
+
+/* Entry range check
+ * ptr >= start : Checks if ptr is greater than the start of access region
+ * ptr + size >= ptr: Check for integer overflow (On 32bit system where ptr
+ * and size are 32bits, ptr + size can wrap around to be a small integer)
+ * ptr + size <= end: Checks if ptr+size is less than the end of access region
+ */
+#define IN_PARTITION_RANGE(ptr, size, start, end)		\
+	(((void *)(ptr) >= (void *)(start)) &&			\
+	 (((void *)(ptr) + (size)) >= (void *)(ptr)) &&	\
+	 (((void *)(ptr) + (size)) <= (void *)(end)))
 
 /**
   * struct smem_proc_comm - proc_comm communication struct (legacy)
@@ -282,7 +294,7 @@
 	struct platform_device *socinfo;
 	struct smem_ptable *ptable;
 	struct smem_partition global_partition;
-	struct smem_partition partitions[SMEM_HOST_COUNT];
+	struct xarray partitions;
 
 	unsigned num_regions;
 	struct smem_region regions[] __counted_by(num_regions);
@@ -359,6 +371,32 @@
 /* Timeout (ms) for the trylock of remote spinlocks */
 #define HWSPINLOCK_TIMEOUT	1000
 
+/* The qcom hwspinlock id is always plus one from the smem host id */
+#define SMEM_HOST_ID_TO_HWSPINLOCK_ID(__x) ((__x) + 1)
+
+/**
+ * qcom_smem_bust_hwspin_lock_by_host() - bust the smem hwspinlock for a host
+ * @host:	remote processor id
+ *
+ * Busts the hwspin_lock for the given smem host id. This helper is intended
+ * for remoteproc drivers that manage remoteprocs with an equivalent smem
+ * driver instance in the remote firmware. Drivers can force a release of the
+ * smem hwspin_lock if the rproc unexpectedly goes into a bad state.
+ *
+ * Context: Process context.
+ *
+ * Returns: 0 on success, otherwise negative errno.
+ */
+int qcom_smem_bust_hwspin_lock_by_host(unsigned int host)
+{
+	/* This function is for remote procs, so ignore SMEM_HOST_APPS */
+	if (host == SMEM_HOST_APPS || !xa_load(&__smem->partitions, host))
+		return -EINVAL;
+
+	return hwspin_lock_bust(__smem->hwlock, SMEM_HOST_ID_TO_HWSPINLOCK_ID(host));
+}
+EXPORT_SYMBOL_GPL(qcom_smem_bust_hwspin_lock_by_host);
+
 /**
  * qcom_smem_is_available() - Check if SMEM is available
  *
@@ -376,6 +414,7 @@
 				   size_t size)
 {
 	struct smem_private_entry *hdr, *end;
+	struct smem_private_entry *next_hdr;
 	struct smem_partition_header *phdr;
 	size_t alloc_size;
 	void *cached;
@@ -388,19 +427,25 @@
 	end = phdr_to_last_uncached_entry(phdr);
 	cached = phdr_to_last_cached_entry(phdr);
 
-	if (WARN_ON((void *)end > p_end || cached > p_end))
+	if (WARN_ON(!IN_PARTITION_RANGE(end, 0, phdr, cached) ||
+						cached > p_end))
 		return -EINVAL;
 
-	while (hdr < end) {
+	while ((hdr < end) && ((hdr + 1) < end)) {
 		if (hdr->canary != SMEM_PRIVATE_CANARY)
 			goto bad_canary;
 		if (le16_to_cpu(hdr->item) == item)
 			return -EEXIST;
 
-		hdr = uncached_entry_next(hdr);
+		next_hdr = uncached_entry_next(hdr);
+
+		if (WARN_ON(next_hdr <= hdr))
+			return -EINVAL;
+
+		hdr = next_hdr;
 	}
 
-	if (WARN_ON((void *)hdr > p_end))
+	if (WARN_ON((void *)hdr > (void *)end))
 		return -EINVAL;
 
 	/* Check that we don't grow into the cached region */
@@ -498,8 +543,8 @@
 	if (ret)
 		return ret;
 
-	if (host < SMEM_HOST_COUNT && __smem->partitions[host].virt_base) {
-		part = &__smem->partitions[host];
+	part = xa_load(&__smem->partitions, host);
+	if (part) {
 		ret = qcom_smem_alloc_private(__smem, part, item, size);
 	} else if (__smem->global_partition.virt_base) {
 		part = &__smem->global_partition;
@@ -558,9 +603,11 @@
 				   unsigned item,
 				   size_t *size)
 {
-	struct smem_private_entry *e, *end;
+	struct smem_private_entry *e, *uncached_end, *cached_end;
+	struct smem_private_entry *next_e;
 	struct smem_partition_header *phdr;
 	void *item_ptr, *p_end;
+	size_t entry_size = 0;
 	u32 padding_data;
 	u32 e_size;
 
@@ -568,67 +615,85 @@
 	p_end = (void *)phdr + part->size;
 
 	e = phdr_to_first_uncached_entry(phdr);
-	end = phdr_to_last_uncached_entry(phdr);
+	uncached_end = phdr_to_last_uncached_entry(phdr);
+	cached_end = phdr_to_last_cached_entry(phdr);
 
-	while (e < end) {
+	if (WARN_ON(!IN_PARTITION_RANGE(uncached_end, 0, phdr, cached_end)
+					|| (void *)cached_end > p_end))
+		return ERR_PTR(-EINVAL);
+
+	while ((e < uncached_end) && ((e + 1) < uncached_end)) {
 		if (e->canary != SMEM_PRIVATE_CANARY)
 			goto invalid_canary;
 
 		if (le16_to_cpu(e->item) == item) {
-			if (size != NULL) {
-				e_size = le32_to_cpu(e->size);
-				padding_data = le16_to_cpu(e->padding_data);
+			e_size = le32_to_cpu(e->size);
+			padding_data = le16_to_cpu(e->padding_data);
 
-				if (WARN_ON(e_size > part->size || padding_data > e_size))
-					return ERR_PTR(-EINVAL);
+			if (e_size < part->size && padding_data < e_size)
+				entry_size = e_size - padding_data;
+			else
+				return ERR_PTR(-EINVAL);
 
-				*size = e_size - padding_data;
-			}
+			item_ptr =  uncached_entry_to_item(e);
 
-			item_ptr = uncached_entry_to_item(e);
-			if (WARN_ON(item_ptr > p_end))
+			if (WARN_ON(!IN_PARTITION_RANGE(item_ptr, entry_size, e, uncached_end)))
 				return ERR_PTR(-EINVAL);
 
+			if (size != NULL)
+				*size = entry_size;
+
 			return item_ptr;
 		}
 
-		e = uncached_entry_next(e);
-	}
+		next_e = uncached_entry_next(e);
+		if (WARN_ON(next_e <= e))
+			return ERR_PTR(-EINVAL);
 
-	if (WARN_ON((void *)e > p_end))
+		e = next_e;
+	}
+	if (WARN_ON((void *)e > (void *)uncached_end))
 		return ERR_PTR(-EINVAL);
 
 	/* Item was not found in the uncached list, search the cached list */
 
+	if (cached_end == p_end)
+		return ERR_PTR(-ENOENT);
+
 	e = phdr_to_first_cached_entry(phdr, part->cacheline);
-	end = phdr_to_last_cached_entry(phdr);
 
-	if (WARN_ON((void *)e < (void *)phdr || (void *)end > p_end))
+	if (WARN_ON(!IN_PARTITION_RANGE(cached_end, 0, uncached_end, p_end) ||
+			!IN_PARTITION_RANGE(e, sizeof(*e), cached_end, p_end)))
 		return ERR_PTR(-EINVAL);
 
-	while (e > end) {
+	while (e > cached_end) {
 		if (e->canary != SMEM_PRIVATE_CANARY)
 			goto invalid_canary;
 
 		if (le16_to_cpu(e->item) == item) {
-			if (size != NULL) {
-				e_size = le32_to_cpu(e->size);
-				padding_data = le16_to_cpu(e->padding_data);
-
-				if (WARN_ON(e_size > part->size || padding_data > e_size))
-					return ERR_PTR(-EINVAL);
+			e_size = le32_to_cpu(e->size);
+			padding_data = le16_to_cpu(e->padding_data);
 
-				*size = e_size - padding_data;
-			}
+			if (e_size < part->size && padding_data < e_size)
+				entry_size  = e_size - padding_data;
+			else
+				return ERR_PTR(-EINVAL);
 
-			item_ptr = cached_entry_to_item(e);
-			if (WARN_ON(item_ptr < (void *)phdr))
+			item_ptr =  cached_entry_to_item(e);
+			if (WARN_ON(!IN_PARTITION_RANGE(item_ptr, entry_size, cached_end, e)))
 				return ERR_PTR(-EINVAL);
 
+			if (size != NULL)
+				*size = entry_size;
+
 			return item_ptr;
 		}
 
-		e = cached_entry_next(e, part->cacheline);
+		next_e = cached_entry_next(e, part->cacheline);
+		if (WARN_ON(next_e >= e))
+			return ERR_PTR(-EINVAL);
+
+		e = next_e;
 	}
 
 	if (WARN_ON((void *)e < (void *)phdr))
@@ -671,8 +736,8 @@
 	if (ret)
 		return ERR_PTR(ret);
 
-	if (host < SMEM_HOST_COUNT && __smem->partitions[host].virt_base) {
-		part = &__smem->partitions[host];
+	part = xa_load(&__smem->partitions, host);
+	if (part) {
 		ptr = qcom_smem_get_private(__smem, part, item, size);
 	} else if (__smem->global_partition.virt_base) {
 		part = &__smem->global_partition;
@@ -705,8 +770,8 @@
 	if (!__smem)
 		return -EPROBE_DEFER;
 
-	if (host < SMEM_HOST_COUNT && __smem->partitions[host].virt_base) {
-		part = &__smem->partitions[host];
+	part = xa_load(&__smem->partitions, host);
+	if (part) {
 		phdr = part->virt_base;
 		ret = le32_to_cpu(phdr->offset_free_cached) -
 		      le32_to_cpu(phdr->offset_free_uncached);
@@ -749,12 +814,11 @@
 {
 	struct smem_partition *part;
 	struct smem_region *area;
+	unsigned long index;
 	u64 offset;
 	u32 i;
 
-	for (i = 0; i < SMEM_HOST_COUNT; i++) {
-		part = &__smem->partitions[i];
-
+	xa_for_each(&__smem->partitions, index, part) {
 		if (addr_in_range(part->virt_base, part->size, p)) {
 			offset = p - part->virt_base;
 
@@ -958,16 +1022,20 @@
 qcom_smem_enumerate_partitions(struct qcom_smem *smem, u16 local_host)
 {
 	struct smem_partition_header *header;
+	struct smem_partition *part;
 	struct smem_ptable_entry *entry;
 	struct smem_ptable *ptable;
 	u16 remote_host;
 	u16 host0, host1;
+	int ret;
 	int i;
 
 	ptable = qcom_smem_get_ptable(smem);
 	if (IS_ERR(ptable))
 		return PTR_ERR(ptable);
 
+	xa_init(&smem->partitions);
+
 	for (i = 0; i < le32_to_cpu(ptable->num_entries); i++) {
 		entry = &ptable->entry[i];
 		if (!le32_to_cpu(entry->offset))
@@ -984,12 +1052,10 @@
 		else
 			continue;
 
-		if (remote_host >= SMEM_HOST_COUNT) {
-			dev_err(smem->dev, "bad host %u\n", remote_host);
-			return -EINVAL;
-		}
+		if (remote_host == SMEM_MULTI_HOST)
+			continue;
 
-		if (smem->partitions[remote_host].virt_base) {
+		if (xa_load(&smem->partitions, remote_host)) {
 			dev_err(smem->dev, "duplicate host %u\n", remote_host);
 			return -EINVAL;
 		}
@@ -998,11 +1064,20 @@
 		if (!header)
 			return -EINVAL;
 
-		smem->partitions[remote_host].virt_base = (void __iomem *)header;
-		smem->partitions[remote_host].phys_base = smem->regions[0].aux_base +
-										le32_to_cpu(entry->offset);
-		smem->partitions[remote_host].size = le32_to_cpu(entry->size);
-		smem->partitions[remote_host].cacheline = le32_to_cpu(entry->cacheline);
+		part = devm_kzalloc(smem->dev, sizeof(struct smem_partition), GFP_KERNEL);
+		if (!part)
+			return -ENOMEM;
+
+		part->virt_base = (void __iomem *)header;
+		part->phys_base = smem->regions[0].aux_base + le32_to_cpu(entry->offset);
+		part->size = le32_to_cpu(entry->size);
+		part->cacheline = le32_to_cpu(entry->cacheline);
+
+		ret = xa_insert(&smem->partitions, remote_host, part, GFP_KERNEL);
+		if (ret) {
+			dev_err(smem->dev, "fail to insert host %u\n", remote_host);
+			return ret;
+		}
 	}
 
 	return 0;
@@ -1171,7 +1246,6 @@
 		return -EINVAL;
 	}
 
-	BUILD_BUG_ON(SMEM_HOST_APPS >= SMEM_HOST_COUNT);
 	ret = qcom_smem_enumerate_partitions(smem, SMEM_HOST_APPS);
 	if (ret < 0 && ret != -ENOENT)
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smp2p.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/smp2p.c
@@ -16,6 +16,7 @@
 #include <linux/platform_device.h>
 #include <linux/pm_wakeirq.h>
 #include <linux/regmap.h>
+#include <linux/seq_file.h>
 #include <linux/soc/qcom/smem.h>
 #include <linux/soc/qcom/smem_state.h>
 #include <linux/spinlock.h>
@@ -58,8 +59,8 @@
  * @valid_entries:	number of allocated entries
  * @flags:
  * @entries:		individual communication entries
- *     @name:		name of the entry
- *     @value:		content of the entry
+ * @entries.name:	name of the entry
+ * @entries.value:	content of the entry
  */
 struct smp2p_smem_item {
 	u32 magic;
@@ -160,6 +161,9 @@
 	struct list_head outbound;
 };
 
+#define CREATE_TRACE_POINTS
+#include "trace-smp2p.h"
+
 static void qcom_smp2p_kick(struct qcom_smp2p *smp2p)
 {
 	/* Make sure any updated data is written before the kick */
@@ -191,6 +195,7 @@
 	struct smp2p_smem_item *out = smp2p->out;
 	u32 val;
 
+	trace_smp2p_ssr_ack(smp2p->dev);
 	smp2p->ssr_ack = !smp2p->ssr_ack;
 
 	val = out->flags & ~BIT(SMP2P_FLAGS_RESTART_ACK_BIT);
@@ -213,6 +218,7 @@
 			smp2p->ssr_ack_enabled = true;
 
 		smp2p->negotiation_done = true;
+		trace_smp2p_negotiate(smp2p->dev, out->features);
 	}
 }
 
@@ -251,6 +257,8 @@
 		status = val ^ entry->last_value;
 		entry->last_value = val;
 
+		trace_smp2p_notify_in(entry, status, val);
+
 		/* No changes of this entry? */
 		if (!status)
 			continue;
@@ -275,6 +283,8 @@
  *
  * Handle notifications from the remote side to handle newly allocated entries
  * or any changes to the state bits of existing entries.
+ *
+ * Return: %IRQ_HANDLED
  */
 static irqreturn_t qcom_smp2p_intr(int irq, void *data)
 {
@@ -351,11 +361,19 @@
 	return 0;
 }
 
+static void smp2p_irq_print_chip(struct irq_data *irqd, struct seq_file *p)
+{
+	struct smp2p_entry *entry = irq_data_get_irq_chip_data(irqd);
+
+	seq_printf(p, " %8s", dev_name(entry->smp2p->dev));
+}
+
 static struct irq_chip smp2p_irq_chip = {
 	.name           = "smp2p",
 	.irq_mask       = smp2p_mask_irq,
 	.irq_unmask     = smp2p_unmask_irq,
 	.irq_set_type	= smp2p_set_irq_type,
+	.irq_print_chip = smp2p_irq_print_chip,
 };
 
 static int smp2p_irq_map(struct irq_domain *d,
@@ -404,6 +422,8 @@
 	writel(val, entry->value);
 	spin_unlock_irqrestore(&entry->lock, flags);
 
+	trace_smp2p_update_bits(entry, orig, val);
+
 	if (val != orig)
 		qcom_smp2p_kick(entry->smp2p);
 
@@ -519,7 +539,6 @@
 static int qcom_smp2p_probe(struct platform_device *pdev)
 {
 	struct smp2p_entry *entry;
-	struct device_node *node;
 	struct qcom_smp2p *smp2p;
 	const char *key;
 	int irq;
@@ -573,11 +592,10 @@
 	if (ret < 0)
 		goto release_mbox;
 
-	for_each_available_child_of_node(pdev->dev.of_node, node) {
+	for_each_available_child_of_node_scoped(pdev->dev.of_node, node) {
 		entry = devm_kzalloc(&pdev->dev, sizeof(*entry), GFP_KERNEL);
 		if (!entry) {
 			ret = -ENOMEM;
-			of_node_put(node);
 			goto unwind_interfaces;
 		}
 
@@ -585,25 +603,19 @@
 		spin_lock_init(&entry->lock);
 
 		ret = of_property_read_string(node, "qcom,entry-name", &entry->name);
-		if (ret < 0) {
-			of_node_put(node);
+		if (ret < 0)
 			goto unwind_interfaces;
-		}
 
 		if (of_property_read_bool(node, "interrupt-controller")) {
 			ret = qcom_smp2p_inbound_entry(smp2p, entry, node);
-			if (ret < 0) {
-				of_node_put(node);
+			if (ret < 0)
 				goto unwind_interfaces;
-			}
 
 			list_add(&entry->node, &smp2p->inbound);
 		} else  {
 			ret = qcom_smp2p_outbound_entry(smp2p, entry, node);
-			if (ret < 0) {
-				of_node_put(node);
+			if (ret < 0)
 				goto unwind_interfaces;
-			}
 
 			list_add(&entry->node, &smp2p->outbound);
 		}
@@ -615,7 +627,7 @@
 	ret = devm_request_threaded_irq(&pdev->dev, irq,
 					NULL, qcom_smp2p_intr,
 					IRQF_ONESHOT,
-					"smp2p", (void *)smp2p);
+					NULL, (void *)smp2p);
 	if (ret) {
 		dev_err(&pdev->dev, "failed to request interrupt\n");
 		goto unwind_interfaces;
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/smp2p_sleepstate.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/smp2p_sleepstate.c
@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/module.h>
+#include <linux/suspend.h>
+#include <linux/platform_device.h>
+#include <linux/soc/qcom/smem_state.h>
+#include <linux/interrupt.h>
+#include <linux/irqreturn.h>
+#include <linux/of_irq.h>
+#include <linux/of.h>
+#include <linux/pm_wakeup.h>
+
+#define PROC_AWAKE_ID 12 /* 12th bit */
+#define AWAKE_BIT BIT(PROC_AWAKE_ID)
+static struct wakeup_source *notify_ws;
+
+struct smp2p_state {
+	struct qcom_smem_state *state;
+	struct notifier_block nb;
+};
+
+/**
+ * sleepstate_pm_notifier() - PM notifier callback function.
+ * @nb:		Pointer to the notifier block.
+ * @event:	Suspend state event from PM module.
+ * @unused:	Null pointer from PM module.
+ *
+ * This function is register as callback function to get notifications
+ * from the PM module on the system suspend state.
+ */
+static int sleepstate_pm_notifier(struct notifier_block *nb,
+				  unsigned long event, void *unused)
+{
+	struct smp2p_state *smp2p_info = container_of(nb, struct smp2p_state, nb);
+
+	switch (event) {
+	case PM_SUSPEND_PREPARE:
+		qcom_smem_state_update_bits(smp2p_info->state, AWAKE_BIT, 0);
+		break;
+
+	case PM_POST_SUSPEND:
+		qcom_smem_state_update_bits(smp2p_info->state, AWAKE_BIT, AWAKE_BIT);
+		break;
+	}
+
+	return NOTIFY_DONE;
+}
+
+static irqreturn_t smp2p_sleepstate_handler(int irq, void *ctxt)
+{
+	__pm_wakeup_event(notify_ws, 200);
+	return IRQ_HANDLED;
+}
+
+static int smp2p_sleepstate_probe(struct platform_device *pdev)
+{
+	int ret;
+	int irq;
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct smp2p_state *smp2p_info;
+
+	smp2p_info = devm_kzalloc(dev, sizeof(*smp2p_info), GFP_KERNEL);
+	if (!smp2p_info)
+		return PTR_ERR(smp2p_info);
+
+	smp2p_info->state = qcom_smem_state_get(&pdev->dev, NULL, &ret);
+	if (IS_ERR(smp2p_info->state))
+		return PTR_ERR(smp2p_info->state);
+	qcom_smem_state_update_bits(smp2p_info->state, AWAKE_BIT, AWAKE_BIT);
+
+	smp2p_info->nb.notifier_call = sleepstate_pm_notifier;
+	smp2p_info->nb.priority = INT_MAX;
+
+	ret = register_pm_notifier(&smp2p_info->nb);
+	if (ret) {
+		dev_err(dev, "%s: power state notif error %d\n", __func__, ret);
+		return ret;
+	}
+
+	notify_ws = wakeup_source_register(&pdev->dev, "smp2p-sleepstate");
+	if (!notify_ws) {
+		return -ENOMEM;
+		goto err_ws;
+	}
+
+	irq = of_irq_get_byname(node, "smp2p-sleepstate-in");
+	if (irq <= 0) {
+		dev_err(dev, "failed to get irq for smp2p_sleep_state\n");
+		ret = -EPROBE_DEFER;
+		goto err;
+	}
+	dev_dbg(dev, "got smp2p-sleepstate-in irq %d\n", irq);
+	ret = devm_request_threaded_irq(dev, irq, NULL,
+					smp2p_sleepstate_handler,
+					IRQF_ONESHOT | IRQF_TRIGGER_RISING,
+					"smp2p_sleepstate", dev);
+	if (ret) {
+		dev_err(dev, "fail to register smp2p threaded_irq=%d\n", irq);
+		goto err;
+	}
+	return 0;
+err:
+	wakeup_source_unregister(notify_ws);
+err_ws:
+	unregister_pm_notifier(&smp2p_info->nb);
+	return ret;
+}
+
+static const struct of_device_id smp2p_slst_match_table[] = {
+	{.compatible = "qcom,smp2p-sleepstate"},
+	{},
+};
+
+static struct platform_driver smp2p_sleepstate_driver = {
+	.probe = smp2p_sleepstate_probe,
+	.driver = {
+		.name = "smp2p_sleepstate",
+		.of_match_table = smp2p_slst_match_table,
+	},
+};
+
+static int __init smp2p_sleepstate_init(void)
+{
+	int ret;
+
+	ret = platform_driver_register(&smp2p_sleepstate_driver);
+	if (ret) {
+		pr_err("%s: register failed %d\n", __func__, ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+module_init(smp2p_sleepstate_init);
+MODULE_DESCRIPTION("SMP2P SLEEP STATE");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/socinfo.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/socinfo.c
@@ -124,7 +124,7 @@
 	[50] = "PM8350B",
 	[51] = "PMR735A",
 	[52] = "PMR735B",
-	[55] = "PM2250",
+	[55] = "PM4125",
 	[58] = "PM8450",
 	[65] = "PM8010",
 	[69] = "PM8550VS",
@@ -410,6 +410,7 @@
 	{ qcom_board_id(SC7280) },
 	{ qcom_board_id(SC7180P) },
 	{ qcom_board_id(QCM6490) },
+	{ qcom_board_id(QCS6490) },
 	{ qcom_board_id(IPQ5000) },
 	{ qcom_board_id(IPQ0509) },
 	{ qcom_board_id(IPQ0518) },
@@ -424,11 +425,13 @@
 	{ qcom_board_id(IPQ9510) },
 	{ qcom_board_id(QRB4210) },
 	{ qcom_board_id(QRB2210) },
+	{ qcom_board_id(SA8255P) },
 	{ qcom_board_id(SA8775P) },
 	{ qcom_board_id(QRU1000) },
 	{ qcom_board_id(QDU1000) },
 	{ qcom_board_id(SM8650) },
 	{ qcom_board_id(SM4450) },
+	{ qcom_board_id(SM8650P) },
 	{ qcom_board_id(QDU1010) },
 	{ qcom_board_id(QRU1032) },
 	{ qcom_board_id(QRU1052) },
@@ -437,7 +440,19 @@
 	{ qcom_board_id(IPQ5322) },
 	{ qcom_board_id(IPQ5312) },
 	{ qcom_board_id(IPQ5302) },
+	{ qcom_board_id(QCS8550) },
+	{ qcom_board_id(QCM8550) },
+	{ qcom_board_id(SA7255P) },
 	{ qcom_board_id(IPQ5300) },
+	{ qcom_board_id(SA8797P) },
+	{ qcom_board_id(IPQ5321) },
+	{ qcom_board_id(QCS9100) },
+	{ qcom_board_id(QCS8300) },
+	{ qcom_board_id(QCS8275) },
+	{ qcom_board_id(QCS9075) },
+	{ qcom_board_id(QCS615) },
+	{ qcom_board_id(QAM8397P) },
+	{ qcom_board_id(QAM8797P) },
 };
 
 static const char *socinfo_machine(struct device *dev, unsigned int id)
@@ -779,10 +794,16 @@
 	qs->attr.revision = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%u.%u",
 					   SOCINFO_MAJOR(le32_to_cpu(info->ver)),
 					   SOCINFO_MINOR(le32_to_cpu(info->ver)));
-	if (offsetof(struct socinfo, serial_num) <= item_size)
+	if (!qs->attr.soc_id || !qs->attr.revision)
+		return -ENOMEM;
+
+	if (offsetof(struct socinfo, serial_num) <= item_size) {
 		qs->attr.serial_number = devm_kasprintf(&pdev->dev, GFP_KERNEL,
 							"%u",
 							le32_to_cpu(info->serial_num));
+		if (!qs->attr.serial_number)
+			return -ENOMEM;
+	}
 
 	qs->soc_dev = soc_device_register(&qs->attr);
 	if (IS_ERR(qs->soc_dev))
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/trace-aoss.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/trace-aoss.h
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM qcom_aoss
+
+#if !defined(_TRACE_QCOM_AOSS_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_QCOM_AOSS_H
+
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(aoss_send,
+	TP_PROTO(const char *msg),
+	TP_ARGS(msg),
+	TP_STRUCT__entry(
+		__string(msg, msg)
+	),
+	TP_fast_assign(
+		__assign_str(msg, msg);
+	),
+	TP_printk("%s", __get_str(msg))
+);
+
+TRACE_EVENT(aoss_send_done,
+	TP_PROTO(const char *msg, int ret),
+	TP_ARGS(msg, ret),
+	TP_STRUCT__entry(
+		__string(msg, msg)
+		__field(int, ret)
+	),
+	TP_fast_assign(
+		__assign_str(msg, msg);
+		__entry->ret = ret;
+	),
+	TP_printk("%s: %d", __get_str(msg), __entry->ret)
+);
+
+#endif /* _TRACE_QCOM_AOSS_H */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace-aoss
+
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/trace-smp2p.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/trace-smp2p.h
@@ -0,0 +1,98 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM qcom_smp2p
+
+#if !defined(__QCOM_SMP2P_TRACE_H__) || defined(TRACE_HEADER_MULTI_READ)
+#define __QCOM_SMP2P_TRACE_H__
+
+#include <linux/device.h>
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(smp2p_ssr_ack,
+	TP_PROTO(const struct device *dev),
+	TP_ARGS(dev),
+	TP_STRUCT__entry(
+		__string(dev_name, dev_name(dev))
+	),
+	TP_fast_assign(
+		__assign_str(dev_name, dev_name(dev));
+	),
+	TP_printk("%s: SSR detected", __get_str(dev_name))
+);
+
+TRACE_EVENT(smp2p_negotiate,
+	TP_PROTO(const struct device *dev, unsigned int features),
+	TP_ARGS(dev, features),
+	TP_STRUCT__entry(
+		__string(dev_name, dev_name(dev))
+		__field(u32, out_features)
+	),
+	TP_fast_assign(
+		__assign_str(dev_name, dev_name(dev));
+		__entry->out_features = features;
+	),
+	TP_printk("%s: state=open out_features=%s", __get_str(dev_name),
+		__print_flags(__entry->out_features, "|",
+			{SMP2P_FEATURE_SSR_ACK, "SMP2P_FEATURE_SSR_ACK"})
+	)
+);
+
+TRACE_EVENT(smp2p_notify_in,
+	TP_PROTO(struct smp2p_entry *smp2p_entry, unsigned long status, u32 val),
+	TP_ARGS(smp2p_entry, status, val),
+	TP_STRUCT__entry(
+		__string(dev_name, dev_name(smp2p_entry->smp2p->dev))
+		__string(client_name, smp2p_entry->name)
+		__field(unsigned long, status)
+		__field(u32, val)
+	),
+	TP_fast_assign(
+		__assign_str(dev_name, dev_name(smp2p_entry->smp2p->dev));
+		__assign_str(client_name, smp2p_entry->name);
+		__entry->status = status;
+		__entry->val = val;
+	),
+	TP_printk("%s: %s: status:0x%0lx val:0x%0x",
+		__get_str(dev_name),
+		__get_str(client_name),
+		__entry->status,
+		__entry->val
+	)
+);
+
+TRACE_EVENT(smp2p_update_bits,
+	TP_PROTO(struct smp2p_entry *smp2p_entry, u32 orig, u32 val),
+	TP_ARGS(smp2p_entry, orig, val),
+	TP_STRUCT__entry(
+		__string(dev_name, dev_name(smp2p_entry->smp2p->dev))
+		__string(client_name, smp2p_entry->name)
+		__field(u32, orig)
+		__field(u32, val)
+	),
+	TP_fast_assign(
+		__assign_str(dev_name, dev_name(smp2p_entry->smp2p->dev));
+		__assign_str(client_name, smp2p_entry->name);
+		__entry->orig = orig;
+		__entry->val = val;
+	),
+	TP_printk("%s: %s: orig:0x%0x new:0x%0x",
+		__get_str(dev_name),
+		__get_str(client_name),
+		__entry->orig,
+		__entry->val
+	)
+);
+
+#endif /* __QCOM_SMP2P_TRACE_H__ */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace-smp2p
+
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/trace_secure_buffer.h
+++ linux-qcom-6.8.0/drivers/soc/qcom/trace_secure_buffer.h
@@ -0,0 +1,141 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM secure_buffer
+
+#if !defined(_TRACE_SECURE_BUFFER_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_SECURE_BUFFER_H
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+#include <soc/qcom/secure_buffer.h>
+
+TRACE_EVENT(hyp_assign_info,
+
+	TP_PROTO(u32 *source_vm_list,
+		 int source_nelems, int *dest_vmids, int *dest_perms,
+		 int dest_nelems),
+
+	TP_ARGS(source_vm_list, source_nelems, dest_vmids,
+		dest_perms, dest_nelems),
+
+	TP_STRUCT__entry(
+		__field(int, source_nelems)
+		__field(int, dest_nelems)
+		__dynamic_array(u32, source_vm_list, source_nelems)
+		__dynamic_array(int, dest_vmids, dest_nelems)
+		__dynamic_array(int, dest_perms, dest_nelems)
+	),
+
+	TP_fast_assign(
+		__entry->source_nelems = source_nelems;
+		__entry->dest_nelems = dest_nelems;
+		memcpy(__get_dynamic_array(source_vm_list), source_vm_list,
+		       source_nelems * sizeof(*source_vm_list));
+		memcpy(__get_dynamic_array(dest_vmids), dest_vmids,
+		       dest_nelems * sizeof(*dest_vmids));
+		memcpy(__get_dynamic_array(dest_perms), dest_perms,
+		       dest_nelems * sizeof(*dest_perms));
+	),
+
+	TP_printk("srcVMIDs: %s dstVMIDs: %s dstPerms: %s",
+		  __print_array(__get_dynamic_array(source_vm_list),
+				__entry->source_nelems, sizeof(u32)),
+		  __print_array(__get_dynamic_array(dest_vmids),
+				__entry->dest_nelems, sizeof(int)),
+		  __print_array(__get_dynamic_array(dest_perms),
+				__entry->dest_nelems, sizeof(int))
+	)
+);
+
+TRACE_EVENT(hyp_assign_batch_start,
+
+	TP_PROTO(struct qcom_scm_mem_map_info *info, int info_nelems),
+
+	TP_ARGS(info, info_nelems),
+
+	TP_STRUCT__entry(
+		__field(int, info_nelems)
+		__field(u64, batch_size)
+		__dynamic_array(u64, addrs, info_nelems)
+		__dynamic_array(u64, sizes, info_nelems)
+	),
+
+	TP_fast_assign(
+		unsigned int i;
+		u64 *addr_arr_ptr = __get_dynamic_array(addrs);
+		u64 *sizes_arr_ptr = __get_dynamic_array(sizes);
+
+		__entry->info_nelems = info_nelems;
+		__entry->batch_size = 0;
+
+		for (i = 0; i < info_nelems; i++) {
+			addr_arr_ptr[i] = le64_to_cpu(info[i].mem_addr);
+			sizes_arr_ptr[i] = le64_to_cpu(info[i].mem_size);
+			__entry->batch_size += le64_to_cpu(info[i].mem_size);
+		}
+	),
+
+	TP_printk("num entries: %d batch size: %llu phys addrs: %s sizes: %s",
+		  __entry->info_nelems, __entry->batch_size,
+		  __print_array(__get_dynamic_array(addrs),
+				__entry->info_nelems, sizeof(u64)),
+		  __print_array(__get_dynamic_array(sizes),
+				__entry->info_nelems, sizeof(u64))
+	)
+);
+
+TRACE_EVENT(hyp_assign_batch_end,
+
+	TP_PROTO(int ret, u64 delta),
+
+	TP_ARGS(ret, delta),
+
+	TP_STRUCT__entry(
+		__field(int, ret)
+		__field(u64, delta)
+	),
+
+	TP_fast_assign(
+		__entry->ret = ret;
+		__entry->delta = delta;
+	),
+
+	TP_printk("ret: %d time delta: %lld us",
+		  __entry->ret, __entry->delta
+	)
+);
+
+TRACE_EVENT(hyp_assign_end,
+
+	TP_PROTO(u64 tot_delta, u64 avg_delta),
+
+	TP_ARGS(tot_delta, avg_delta),
+
+	TP_STRUCT__entry(
+		__field(u64, tot_delta)
+		__field(u64, avg_delta)
+	),
+
+	TP_fast_assign(
+		__entry->tot_delta = tot_delta;
+		__entry->avg_delta = avg_delta;
+	),
+
+	TP_printk("total time delta: %lld us avg batch delta: %lld us",
+		  __entry->tot_delta, __entry->avg_delta
+	)
+);
+#endif /* _TRACE_SECURE_BUFFER_H */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH ../../drivers/soc/qcom/
+
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace_secure_buffer
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/soc/qcom/wdt_core.c
+++ linux-qcom-6.8.0/drivers/soc/qcom/wdt_core.c
@@ -0,0 +1,715 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <asm/hardirq.h>
+#include <linux/cpu_pm.h>
+#include <linux/cpumask.h>
+#include <linux/delay.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/irqdomain.h>
+#include <linux/jiffies.h>
+#include <linux/kallsyms.h>
+#include <linux/kdebug.h>
+#include <linux/kernel.h>
+#include <linux/kernel_stat.h>
+#include <linux/kthread.h>
+#include <linux/module.h>
+#include <linux/notifier.h>
+#include <linux/of.h>
+#include <linux/panic_notifier.h>
+#include <linux/percpu.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <linux/sched.h>
+#include <linux/sched/clock.h>
+#include <linux/sort.h>
+#include <linux/suspend.h>
+#include <linux/wait.h>
+#include <soc/qcom/wdt_core.h>
+#include <uapi/linux/sched/types.h>
+
+#define MASK_SIZE        32
+
+static struct msm_watchdog_data *wdog_data;
+
+static void qcom_wdt_dump_cpu_alive_mask(struct msm_watchdog_data *wdog_dd)
+{
+	static char alive_mask_buf[MASK_SIZE];
+
+	scnprintf(alive_mask_buf, MASK_SIZE, "%*pb1",
+		  cpumask_pr_args(&wdog_dd->alive_mask));
+	dev_info(wdog_dd->dev, "cpu alive mask from last pet %s\n",
+		 alive_mask_buf);
+}
+
+static int qcom_wdt_hibernation_notifier(struct notifier_block *nb,
+					 unsigned long event, void *dummy)
+{
+	if (event == PM_HIBERNATION_PREPARE)
+		wdog_data->hibernate = true;
+	else if (event == PM_POST_HIBERNATION)
+		wdog_data->hibernate = false;
+	return NOTIFY_OK;
+}
+
+static struct notifier_block qcom_wdt_notif_block = {
+	.notifier_call = qcom_wdt_hibernation_notifier,
+};
+
+#ifdef CONFIG_PM_SLEEP
+/**
+ *  qcom_wdt_pet_suspend() - Suspends qcom watchdog functionality.
+ *
+ *  @dev: qcom watchdog device structure
+ *
+ *  All watchdogs should have the ability to be suspended, this
+ *  will cause the watchdog counter to reset and HW counter will
+ *  freeze when deepest low power mode is entered.
+ *
+ */
+int qcom_wdt_pet_suspend(struct device *dev)
+{
+	struct msm_watchdog_data *wdog_data =
+			(struct msm_watchdog_data *)dev_get_drvdata(dev);
+
+	if (wdog_data->user_pet_enabled)
+		del_timer_sync(&wdog_data->user_pet_timer);
+
+	spin_lock(&wdog_data->freeze_lock);
+	wdog_data->freeze_in_progress = true;
+	spin_unlock(&wdog_data->freeze_lock);
+	wdog_data->ops->reset_wdt(wdog_data);
+	del_timer_sync(&wdog_data->pet_timer);
+	if (wdog_data->wakeup_irq_enable) {
+		if (wdog_data->hibernate) {
+			wdog_data->ops->disable_wdt(wdog_data);
+			wdog_data->enabled = false;
+		}
+		wdog_data->last_pet = sched_clock();
+		return 0;
+	}
+
+	wdog_data->ops->disable_wdt(wdog_data);
+	wdog_data->enabled = false;
+	wdog_data->last_pet = sched_clock();
+	return 0;
+}
+EXPORT_SYMBOL_GPL(qcom_wdt_pet_suspend);
+
+/**
+ *  qcom_wdt_pet_resume() - Resumes qcom watchdog after a suspend.
+ *
+ *  @dev: qcom watchdog device structure
+ *
+ *  All watchdogs should have the ability to be resumed after a suspend.
+ *  This will cause the watchdog counter to be reset and resumed.
+ *
+ */
+int qcom_wdt_pet_resume(struct device *dev)
+{
+	uint32_t val;
+	struct msm_watchdog_data *wdog_data =
+			(struct msm_watchdog_data *)dev_get_drvdata(dev);
+	unsigned long delay_time = 0;
+
+	if (!wdog_data)
+		return 0;
+
+	val = BIT(ENABLE_WDT);
+	if (wdog_data->user_pet_enabled) {
+		delay_time = msecs_to_jiffies(wdog_data->bark_time + 3 * 1000);
+		wdog_data->user_pet_timer.expires = jiffies + delay_time;
+		add_timer(&wdog_data->user_pet_timer);
+	}
+
+	delay_time = msecs_to_jiffies(wdog_data->pet_time);
+	spin_lock(&wdog_data->freeze_lock);
+	wdog_data->pet_timer.expires = jiffies + delay_time;
+	add_timer(&wdog_data->pet_timer);
+	wdog_data->freeze_in_progress = false;
+	spin_unlock(&wdog_data->freeze_lock);
+	if (wdog_data->wakeup_irq_enable) {
+		if (wdog_data->hibernate) {
+			val |= BIT(UNMASKED_INT_EN);
+			wdog_data->ops->enable_wdt(val, wdog_data);
+			wdog_data->enabled = true;
+		}
+		wdog_data->ops->reset_wdt(wdog_data);
+		wdog_data->last_pet = sched_clock();
+		return 0;
+	}
+
+	wdog_data->ops->enable_wdt(val, wdog_data);
+	wdog_data->ops->reset_wdt(wdog_data);
+	wdog_data->enabled = true;
+	wdog_data->last_pet = sched_clock();
+	return 0;
+}
+EXPORT_SYMBOL_GPL(qcom_wdt_pet_resume);
+#endif
+
+static void qcom_wdt_reset_on_oops(struct msm_watchdog_data *wdog_dd,
+				   int timeout)
+{
+	wdog_dd->ops->reset_wdt(wdog_dd);
+	wdog_dd->ops->set_bark_time((timeout + 10) * 1000,
+					wdog_dd);
+	wdog_dd->ops->set_bite_time((timeout + 10) * 1000,
+					wdog_dd);
+}
+
+static int qcom_wdt_panic_handler(struct notifier_block *this,
+				  unsigned long event, void *ptr)
+{
+	struct msm_watchdog_data *wdog_dd;
+
+	wdog_dd = container_of(this, struct msm_watchdog_data, panic_blk);
+
+	wdog_dd->in_panic = true;
+
+	if (WDOG_BITE_EARLY_PANIC) {
+		pr_info("Triggering early bite\n");
+		qcom_wdt_trigger_bite();
+	}
+
+	if (panic_timeout == 0)
+		wdog_dd->ops->disable_wdt(wdog_dd);
+	else
+		qcom_wdt_reset_on_oops(wdog_dd, panic_timeout);
+
+	return NOTIFY_DONE;
+}
+
+static void qcom_wdt_disable(struct msm_watchdog_data *wdog_dd)
+{
+	wdog_dd->ops->disable_wdt(wdog_dd);
+
+	if (wdog_dd->irq_ppi) {
+		disable_percpu_irq(wdog_dd->bark_irq);
+		free_percpu_irq(wdog_dd->bark_irq,
+				(void __percpu *)wdog_dd->wdog_cpu_dd);
+	} else {
+		devm_free_irq(wdog_dd->dev, wdog_dd->bark_irq, wdog_dd);
+	}
+
+	wdog_dd->enabled = false;
+	/* Ensure all cpus see update to enable */
+	smp_mb();
+	atomic_notifier_chain_unregister(&panic_notifier_list,
+					 &wdog_dd->panic_blk);
+	unregister_restart_handler(&wdog_dd->restart_blk);
+	del_timer_sync(&wdog_dd->pet_timer);
+	if (wdog_dd->user_pet_enabled)
+		del_timer_sync(&wdog_dd->user_pet_timer);
+	wdog_dd->ops->disable_wdt(wdog_dd);
+	dev_err(wdog_dd->dev, "QCOM Apps Watchdog deactivated\n");
+}
+
+static int restart_wdog_handler(struct notifier_block *this,
+				unsigned long event, void *ptr)
+{
+	struct msm_watchdog_data *wdog_dd;
+
+	wdog_dd = container_of(this, struct msm_watchdog_data, restart_blk);
+	#ifdef CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC
+	if (wdog_dd->in_panic) {
+		/*
+		 * Trigger a watchdog bite here and if this fails,
+		 * device will take the usual restart path.
+		 */
+		pr_info("Triggering late bite\n");
+		qcom_wdt_trigger_bite();
+	}
+	#endif
+	return NOTIFY_DONE;
+}
+
+static ssize_t qcom_wdt_disable_get(struct device *dev,
+				    struct device_attribute *attr, char *buf)
+{
+	struct msm_watchdog_data *wdog_dd = dev_get_drvdata(dev);
+	int disable_val;
+
+	mutex_lock(&wdog_dd->disable_lock);
+	disable_val  = wdog_dd->enabled ? 0 : 1;
+	mutex_unlock(&wdog_dd->disable_lock);
+
+	return sysfs_emit(buf, "%d\n", disable_val);
+}
+
+static ssize_t qcom_wdt_disable_set(struct device *dev,
+				    struct device_attribute *attr,
+					const char *buf, size_t count)
+{
+	struct msm_watchdog_data *wdog_dd = dev_get_drvdata(dev);
+	u8 disable;
+	int ret;
+
+	ret = kstrtou8(buf, 10, &disable);
+	if (ret) {
+		dev_err(wdog_dd->dev, "invalid user input\n");
+		return ret;
+	}
+	if (disable == 1) {
+		mutex_lock(&wdog_dd->disable_lock);
+		if (!wdog_dd->enabled) {
+			dev_dbg(wdog_dd->dev, "MSM Apps Watchdog already disabled\n");
+			mutex_unlock(&wdog_dd->disable_lock);
+			return count;
+		}
+		ret = qcom_scm_sec_wdog_deactivate();
+		if (ret) {
+			dev_err(wdog_dd->dev,
+				"Failed to deactivate secure wdog, ret = %d\n",
+				 ret);
+		}
+		qcom_wdt_disable(wdog_dd);
+		mutex_unlock(&wdog_dd->disable_lock);
+	} else {
+		dev_err(wdog_dd->dev, "invalid operation, only disable = 1 supported\n");
+		return -EINVAL;
+	}
+	return count;
+}
+
+static DEVICE_ATTR(disable, MODE_FOR_DISABLE, qcom_wdt_disable_get, qcom_wdt_disable_set);
+
+static ssize_t wakeup_enable_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct msm_watchdog_data *wdog_dd = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%d\n", wdog_dd->wakeup_irq_enable);
+}
+
+static ssize_t wakeup_enable_store(struct device *dev, struct device_attribute *attr,
+				   const char *buf, size_t count)
+{
+	struct msm_watchdog_data *wdog_dd = dev_get_drvdata(dev);
+	u8 enable;
+	int ret;
+
+	ret = kstrtou8(buf, 10, &enable);
+	if (ret || enable > 1) {
+		dev_err(wdog_dd->dev, "invalid user input\n");
+		return ret ? : -EINVAL;
+	}
+	mutex_lock(&wdog_dd->disable_lock);
+	/* echo 1 > wakeup_enable means wakeup irq is enabled */
+	wdog_dd->wakeup_irq_enable = enable;
+	if (wdog_dd->enabled) {
+		u8 val = BIT(ENABLE_WDT);
+
+		if (wdog_dd->wakeup_irq_enable)
+			val |= BIT(UNMASKED_INT_EN);
+		wdog_dd->ops->enable_wdt(val, wdog_dd);
+	}
+	mutex_unlock(&wdog_dd->disable_lock);
+	return count;
+}
+static DEVICE_ATTR_ADMIN_RW(wakeup_enable);
+
+static void qcom_wdt_keep_alive_response(void *info)
+{
+	struct msm_watchdog_data *wdog_dd = info;
+	int cpu = smp_processor_id();
+
+	cpumask_set_cpu(cpu, &wdog_dd->alive_mask);
+	wdog_dd->ping_end[cpu] = sched_clock();
+	/* Make sure alive mask is cleared and set in order */
+	smp_mb();
+}
+
+/*
+ * If this function does not return, it implies one of the
+ * other cpu's is not responsive.
+ */
+static void qcom_wdt_ping_other_cpus(struct msm_watchdog_data *wdog_dd)
+{
+	int cpu;
+
+	cpumask_clear(&wdog_dd->alive_mask);
+	/* Make sure alive mask is cleared and set in order */
+	smp_mb();
+	for_each_cpu(cpu, cpu_online_mask) {
+		if (!wdog_dd->cpu_idle_pc_state[cpu]) {
+			wdog_dd->ping_start[cpu] = sched_clock();
+			smp_call_function_single(cpu,
+						 qcom_wdt_keep_alive_response,
+						 wdog_dd, 1);
+		}
+	}
+}
+
+static void qcom_wdt_pet_task_wakeup(struct timer_list *t)
+{
+	struct msm_watchdog_data *wdog_dd =
+		from_timer(wdog_dd, t, pet_timer);
+
+	wdog_dd->timer_expired = true;
+	wdog_dd->timer_fired = sched_clock();
+	wake_up(&wdog_dd->pet_complete);
+}
+
+static void qcom_wdt_user_pet_bite(struct timer_list *t)
+{
+	struct msm_watchdog_data *wdog_dd;
+
+	wdog_dd = from_timer(wdog_dd, t, user_pet_timer);
+	if (!wdog_dd->user_pet_complete) {
+		dev_info(wdog_dd->dev, "QCOM Apps Watchdog user pet timeout!\n");
+		qcom_wdt_trigger_bite();
+	}
+}
+
+static __ref int qcom_wdt_kthread(void *arg)
+{
+	struct msm_watchdog_data *wdog_dd = arg;
+	unsigned long delay_time = 0;
+	struct sched_param param = {.sched_priority = MAX_RT_PRIO - 1};
+	int ret, cpu;
+
+	sched_setscheduler(current, SCHED_FIFO, &param);
+	while (!kthread_should_stop()) {
+		do {
+			ret = wait_event_interruptible(wdog_dd->pet_complete,
+						       wdog_dd->timer_expired);
+		} while (ret != 0);
+
+		wdog_dd->thread_start = sched_clock();
+		for_each_cpu(cpu, cpu_present_mask)
+			wdog_dd->ping_start[cpu] = wdog_dd->ping_end[cpu] = 0;
+
+		if (wdog_dd->do_ipi_ping)
+			qcom_wdt_ping_other_cpus(wdog_dd);
+
+		do {
+			ret = wait_event_interruptible(wdog_dd->pet_complete,
+						       wdog_dd->user_pet_complete);
+		} while (ret != 0);
+
+		wdog_dd->timer_expired = false;
+		wdog_dd->user_pet_complete = !wdog_dd->user_pet_enabled;
+
+		if (wdog_dd->enabled) {
+			delay_time = msecs_to_jiffies(wdog_dd->pet_time);
+			wdog_dd->ops->reset_wdt(wdog_dd);
+			wdog_dd->last_pet = sched_clock();
+		}
+		/*
+		 * Check again before scheduling
+		 * Could have been changed on other cpu
+		 */
+		if (!kthread_should_stop()) {
+			spin_lock(&wdog_dd->freeze_lock);
+			if (!wdog_dd->freeze_in_progress)
+				mod_timer(&wdog_dd->pet_timer,
+					  jiffies + delay_time);
+			spin_unlock(&wdog_dd->freeze_lock);
+		}
+	}
+	return 0;
+}
+
+static int qcom_wdt_cpu_pm_notify(struct notifier_block *this,
+				  unsigned long action, void *v)
+{
+	struct msm_watchdog_data *wdog_dd;
+	int cpu;
+
+	wdog_dd = container_of(this, struct msm_watchdog_data, wdog_cpu_pm_nb);
+
+	cpu = raw_smp_processor_id();
+
+	switch (action) {
+	case CPU_PM_ENTER:
+		wdog_dd->cpu_idle_pc_state[cpu] = 1;
+		break;
+	case CPU_PM_ENTER_FAILED:
+	case CPU_PM_EXIT:
+		wdog_dd->cpu_idle_pc_state[cpu] = 0;
+		break;
+	}
+
+	return NOTIFY_OK;
+}
+
+/**
+ * qcom_wdt_remove() - Removes the watchdog and stops it's kthread.
+ *
+ *  @pdev: watchdog platform_device
+ *
+ *  Upon the removal of the module all watchdog data along with the kthread
+ *  will be cleaned up and the watchdog device will be removed from memory.
+ *
+ */
+int qcom_wdt_remove(struct platform_device *pdev)
+{
+	struct msm_watchdog_data *wdog_dd = platform_get_drvdata(pdev);
+
+	if (!IPI_CORES_IN_LPM)
+		cpu_pm_unregister_notifier(&wdog_dd->wdog_cpu_pm_nb);
+
+	mutex_lock(&wdog_dd->disable_lock);
+	if (wdog_dd->enabled)
+		qcom_wdt_disable(wdog_dd);
+
+	mutex_unlock(&wdog_dd->disable_lock);
+	device_remove_file(wdog_dd->dev, &dev_attr_disable);
+	if (wdog_dd->irq_ppi)
+		free_percpu((void __percpu *)wdog_dd->wdog_cpu_dd);
+	irq_dispose_mapping(wdog_dd->bark_irq);
+	dev_info(wdog_dd->dev, "QCOM Apps Watchdog Exit - Deactivated\n");
+	del_timer_sync(&wdog_dd->pet_timer);
+	if (wdog_dd->user_pet_enabled)
+		del_timer_sync(&wdog_dd->user_pet_timer);
+	wdog_dd->timer_expired = true;
+	wdog_dd->user_pet_complete = true;
+	kthread_stop(wdog_dd->watchdog_task);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(qcom_wdt_remove);
+
+/**
+ * qcom_wdt_trigger_bite - Executes a watchdog bite.
+ *
+ * Return: function will not return, to allow for the bite to occur
+ */
+void qcom_wdt_trigger_bite(void)
+{
+	if (!wdog_data)
+		return;
+
+	dev_err(wdog_data->dev, "Causing a QCOM Apps Watchdog bite!\n");
+	wdog_data->ops->show_wdt_status(wdog_data);
+	wdog_data->ops->set_bite_time(1, wdog_data);
+	wdog_data->ops->reset_wdt(wdog_data);
+	/* Delay to make sure bite occurs */
+	mdelay(10000);
+	/*
+	 * This function induces the non-secure bite and control
+	 * should not return to the calling function. Non-secure
+	 * bite interrupt is affined to all the cores and it may
+	 * not be handled by the same cores which configured
+	 * non-secure bite. So add forever loop here.
+	 */
+	while (1)
+		udelay(1);
+}
+EXPORT_SYMBOL_GPL(qcom_wdt_trigger_bite);
+
+static irqreturn_t qcom_wdt_bark_handler(int irq, void *dev_id)
+{
+	struct msm_watchdog_data *wdog_dd = dev_id;
+	unsigned long nanosec_rem;
+	unsigned long long t = sched_clock();
+
+	nanosec_rem = do_div(t, 1000000000);
+	dev_info(wdog_dd->dev, "QCOM Apps Watchdog bark! Now = %lu.%06lu\n",
+		 (unsigned long)t, nanosec_rem / 1000);
+
+	nanosec_rem = do_div(wdog_dd->last_pet, 1000000000);
+	dev_info(wdog_dd->dev, "QCOM Apps Watchdog last pet at %lu.%06lu\n",
+		 (unsigned long)wdog_dd->last_pet, nanosec_rem / 1000);
+
+	if (wdog_dd->do_ipi_ping)
+		qcom_wdt_dump_cpu_alive_mask(wdog_dd);
+
+	if (wdog_dd->freeze_in_progress)
+		dev_info(wdog_dd->dev, "Suspend in progress\n");
+
+	qcom_wdt_trigger_bite();
+
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t qcom_wdt_ppi_bark(int irq, void *dev_id_percpu)
+{
+	void *dev_id = raw_cpu_ptr((void __percpu *)dev_id_percpu);
+	struct msm_watchdog_data *wdog_dd = *((struct msm_watchdog_data **)dev_id);
+
+	return qcom_wdt_bark_handler(irq, wdog_dd);
+}
+
+static int qcom_wdt_init_sysfs(struct msm_watchdog_data *wdog_dd)
+{
+	int error = 0;
+
+	error |= device_create_file(wdog_dd->dev, &dev_attr_disable);
+	error |= device_create_file(wdog_dd->dev, &dev_attr_wakeup_enable);
+
+	if (error)
+		dev_err(wdog_dd->dev, "cannot create sysfs attribute\n");
+
+	return error;
+}
+
+static int qcom_wdt_init(struct msm_watchdog_data *wdog_dd, struct platform_device *pdev)
+{
+	unsigned long delay_time;
+	uint32_t val;
+	int ret;
+	void *wdog_cpu_dd_v;
+
+	if (wdog_dd->irq_ppi) {
+		wdog_dd->wdog_cpu_dd = alloc_percpu(struct msm_watchdog_data *);
+		if (!wdog_dd->wdog_cpu_dd) {
+			dev_err(wdog_dd->dev, "failed to allocate cpu data\n");
+			return -ENOMEM;
+		}
+		wdog_cpu_dd_v = raw_cpu_ptr((void __percpu *)wdog_dd->wdog_cpu_dd);
+		*((struct msm_watchdog_data **)wdog_cpu_dd_v) = wdog_dd;
+		ret = request_percpu_irq(wdog_dd->bark_irq, qcom_wdt_ppi_bark,
+					 "apps_wdog_bark",
+					 (void __percpu *)wdog_dd->wdog_cpu_dd);
+		if (ret) {
+			dev_err(wdog_dd->dev, "failed to request bark irq\n");
+			free_percpu((void __percpu *)wdog_dd->wdog_cpu_dd);
+			return ret;
+		}
+	} else {
+		ret = devm_request_irq(wdog_dd->dev, wdog_dd->bark_irq,
+				       qcom_wdt_bark_handler,
+				       IRQF_TRIGGER_RISING | IRQF_NO_SUSPEND,
+					"apps_wdog_bark", wdog_dd);
+
+		if (ret) {
+			dev_err(wdog_dd->dev, "failed to request bark irq: %d\n", ret);
+			return -EINVAL;
+		}
+	}
+
+	wdog_data->hibernate = false;
+	ret = register_pm_notifier(&qcom_wdt_notif_block);
+	if (ret)
+		return ret;
+
+	delay_time = msecs_to_jiffies(wdog_dd->pet_time);
+	wdog_dd->ops->set_bark_time(wdog_dd->bark_time, wdog_dd);
+	wdog_dd->ops->set_bite_time(wdog_dd->bark_time + 3 * 1000, wdog_dd);
+	wdog_dd->panic_blk.priority = INT_MAX - 1;
+	wdog_dd->panic_blk.notifier_call = qcom_wdt_panic_handler;
+	atomic_notifier_chain_register(&panic_notifier_list,
+				       &wdog_dd->panic_blk);
+	wdog_dd->restart_blk.priority = 255;
+	wdog_dd->restart_blk.notifier_call = restart_wdog_handler;
+	register_restart_handler(&wdog_dd->restart_blk);
+	mutex_init(&wdog_dd->disable_lock);
+	init_waitqueue_head(&wdog_dd->pet_complete);
+	wdog_dd->timer_expired = false;
+	wdog_dd->user_pet_complete = true;
+	wdog_dd->user_pet_enabled = false;
+	spin_lock_init(&wdog_dd->freeze_lock);
+	wdog_dd->freeze_in_progress = false;
+	wake_up_process(wdog_dd->watchdog_task);
+	timer_setup(&wdog_dd->pet_timer, qcom_wdt_pet_task_wakeup, 0);
+	wdog_dd->pet_timer.expires = jiffies + delay_time;
+	add_timer(&wdog_dd->pet_timer);
+	timer_setup(&wdog_dd->user_pet_timer, qcom_wdt_user_pet_bite, 0);
+	val = BIT(ENABLE_WDT);
+	if (wdog_dd->wakeup_irq_enable)
+		val |= BIT(UNMASKED_INT_EN);
+
+	ret = wdog_dd->ops->enable_wdt(val, wdog_dd);
+	if (ret) {
+		atomic_notifier_chain_unregister(&panic_notifier_list,
+						 &wdog_dd->panic_blk);
+		unregister_restart_handler(&wdog_dd->restart_blk);
+
+		if (wdog_dd->irq_ppi) {
+			free_percpu_irq(wdog_dd->bark_irq,
+					(void __percpu *)wdog_dd->wdog_cpu_dd);
+			free_percpu((void __percpu *)wdog_dd->wdog_cpu_dd);
+		}
+
+		del_timer_sync(&wdog_dd->pet_timer);
+		dev_err(wdog_dd->dev, "Failed Initializing QCOM Apps Watchdog\n");
+		return ret;
+	}
+
+	wdog_dd->ops->reset_wdt(wdog_dd);
+	wdog_dd->last_pet = sched_clock();
+	wdog_dd->enabled = true;
+
+	qcom_wdt_init_sysfs(wdog_dd);
+
+	if (wdog_dd->irq_ppi)
+		enable_percpu_irq(wdog_dd->bark_irq, 0);
+	if (!IPI_CORES_IN_LPM) {
+		wdog_dd->wdog_cpu_pm_nb.notifier_call = qcom_wdt_cpu_pm_notify;
+		cpu_pm_register_notifier(&wdog_dd->wdog_cpu_pm_nb);
+	}
+	dev_info(wdog_dd->dev, "QCOM Apps Watchdog Initialized\n");
+
+	return 0;
+}
+
+static void qcom_wdt_dt_to_pdata(struct platform_device *pdev,
+				 struct msm_watchdog_data *pdata)
+{
+	pdata->bark_irq = platform_get_irq(pdev, 0);
+	pdata->irq_ppi = irq_is_percpu(pdata->bark_irq);
+	pdata->bark_time = QCOM_WATCHDOG_BARK_TIME;
+	pdata->pet_time = QCOM_WATCHDOG_PET_TIME;
+	pdata->do_ipi_ping = QCOM_WATCHDOG_IPI_PING;
+	pdata->wakeup_irq_enable = QCOM_WATCHDOG_WAKEUP_ENABLE;
+
+	dev_dbg(pdata->dev, " wdog bark_time: %d\n"
+				"wdog pet_time: %d\n"
+				"wdog perform ipi ping: %d\n"
+				"wdog base address: 0x%lx ",
+		pdata->bark_time, pdata->pet_time, pdata->do_ipi_ping,
+		(unsigned long)pdata->base);
+}
+
+/**
+ *  qcom_wdt_register() - Creates QCOM Apps watchdog device.
+ *
+ *  @pdev: watchdog platform_device
+ *  @ops:  watchdog operations
+ *
+ *  All QCOM Apps watchdogs should be created the same way, this acts
+ *  as a framework for this purpose.
+ *
+ *  0 on success, negative errno on failure.
+ */
+int qcom_wdt_register(struct platform_device *pdev,
+		      struct msm_watchdog_data *wdog_dd,
+		      char *wdog_dd_name)
+{
+	int ret;
+
+	if (!pdev || !wdog_dd || !wdog_dd_name) {
+		pr_err("wdt_register input incorrect\n");
+		return -EINVAL;
+	}
+
+	qcom_wdt_dt_to_pdata(pdev, wdog_dd);
+	wdog_data = wdog_dd;
+	wdog_dd->dev = &pdev->dev;
+	platform_set_drvdata(pdev, wdog_dd);
+	cpumask_clear(&wdog_dd->alive_mask);
+	wdog_dd->watchdog_task = kthread_create(qcom_wdt_kthread, wdog_dd,
+						wdog_dd_name);
+	if (IS_ERR(wdog_dd->watchdog_task)) {
+		ret = PTR_ERR(wdog_dd->watchdog_task);
+		goto err;
+	}
+	ret = qcom_wdt_init(wdog_dd, pdev);
+	if (ret) {
+		kthread_stop(wdog_dd->watchdog_task);
+		goto err;
+	}
+
+	return 0;
+err:
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_wdt_register);
+
+MODULE_DESCRIPTION("QCOM Watchdog Driver Core");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/soc/ti/smartreflex.c
+++ linux-qcom-6.8.0/drivers/soc/ti/smartreflex.c
@@ -202,10 +202,10 @@
 
 	if (sr_class->notify && sr_class->notify_flags && sr_info->irq) {
 		ret = devm_request_irq(&sr_info->pdev->dev, sr_info->irq,
-				       sr_interrupt, 0, sr_info->name, sr_info);
+				       sr_interrupt, IRQF_NO_AUTOEN,
+				       sr_info->name, sr_info);
 		if (ret)
 			goto error;
-		disable_irq(sr_info->irq);
 	}
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/soc/ti/wkup_m3_ipc.c
+++ linux-qcom-6.8.0/drivers/soc/ti/wkup_m3_ipc.c
@@ -16,7 +16,6 @@
 #include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/of.h>
-#include <linux/omap-mailbox.h>
 #include <linux/platform_device.h>
 #include <linux/remoteproc.h>
 #include <linux/suspend.h>
@@ -314,7 +313,6 @@
 static int wkup_m3_ping(struct wkup_m3_ipc *m3_ipc)
 {
 	struct device *dev = m3_ipc->dev;
-	mbox_msg_t dummy_msg = 0;
 	int ret;
 
 	if (!m3_ipc->mbox) {
@@ -330,7 +328,7 @@
 	 * the RX callback to avoid multiple interrupts being received
 	 * by the CM3.
 	 */
-	ret = mbox_send_message(m3_ipc->mbox, &dummy_msg);
+	ret = mbox_send_message(m3_ipc->mbox, NULL);
 	if (ret < 0) {
 		dev_err(dev, "%s: mbox_send_message() failed: %d\n",
 			__func__, ret);
@@ -352,7 +350,6 @@
 static int wkup_m3_ping_noirq(struct wkup_m3_ipc *m3_ipc)
 {
 	struct device *dev = m3_ipc->dev;
-	mbox_msg_t dummy_msg = 0;
 	int ret;
 
 	if (!m3_ipc->mbox) {
@@ -361,7 +358,7 @@
 		return -EIO;
 	}
 
-	ret = mbox_send_message(m3_ipc->mbox, &dummy_msg);
+	ret = mbox_send_message(m3_ipc->mbox, NULL);
 	if (ret < 0) {
 		dev_err(dev, "%s: mbox_send_message() failed: %d\n",
 			__func__, ret);
--- linux-qcom-6.8.0.orig/drivers/soc/versatile/soc-integrator.c
+++ linux-qcom-6.8.0/drivers/soc/versatile/soc-integrator.c
@@ -113,6 +113,7 @@
 		return -ENODEV;
 
 	syscon_regmap = syscon_node_to_regmap(np);
+	of_node_put(np);
 	if (IS_ERR(syscon_regmap))
 		return PTR_ERR(syscon_regmap);
 
--- linux-qcom-6.8.0.orig/drivers/soc/versatile/soc-realview.c
+++ linux-qcom-6.8.0/drivers/soc/versatile/soc-realview.c
@@ -4,6 +4,7 @@
  *
  * Author: Linus Walleij <linus.walleij@linaro.org>
  */
+#include <linux/device.h>
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/slab.h>
@@ -81,6 +82,13 @@
 
 ATTRIBUTE_GROUPS(realview);
 
+static void realview_soc_socdev_release(void *data)
+{
+	struct soc_device *soc_dev = data;
+
+	soc_device_unregister(soc_dev);
+}
+
 static int realview_soc_probe(struct platform_device *pdev)
 {
 	struct regmap *syscon_regmap;
@@ -93,7 +101,7 @@
 	if (IS_ERR(syscon_regmap))
 		return PTR_ERR(syscon_regmap);
 
-	soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL);
+	soc_dev_attr = devm_kzalloc(&pdev->dev, sizeof(*soc_dev_attr), GFP_KERNEL);
 	if (!soc_dev_attr)
 		return -ENOMEM;
 
@@ -106,10 +114,14 @@
 	soc_dev_attr->family = "Versatile";
 	soc_dev_attr->custom_attr_group = realview_groups[0];
 	soc_dev = soc_device_register(soc_dev_attr);
-	if (IS_ERR(soc_dev)) {
-		kfree(soc_dev_attr);
+	if (IS_ERR(soc_dev))
 		return -ENODEV;
-	}
+
+	ret = devm_add_action_or_reset(&pdev->dev, realview_soc_socdev_release,
+				       soc_dev);
+	if (ret)
+		return ret;
+
 	ret = regmap_read(syscon_regmap, REALVIEW_SYS_ID_OFFSET,
 			  &realview_coreid);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/soc/xilinx/xlnx_event_manager.c
+++ linux-qcom-6.8.0/drivers/soc/xilinx/xlnx_event_manager.c
@@ -3,6 +3,7 @@
  * Xilinx Event Management Driver
  *
  *  Copyright (C) 2021 Xilinx, Inc.
+ *  Copyright (C) 2024 Advanced Micro Devices, Inc.
  *
  *  Abhyuday Godhasara <abhyuday.godhasara@xilinx.com>
  */
@@ -19,7 +20,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
-static DEFINE_PER_CPU_READ_MOSTLY(int, cpu_number1);
+static DEFINE_PER_CPU_READ_MOSTLY(int, dummy_cpu_number);
 
 static int virq_sgi;
 static int event_manager_availability = -EACCES;
@@ -188,8 +189,10 @@
 	INIT_LIST_HEAD(&eve_data->cb_list_head);
 
 	cb_data = kmalloc(sizeof(*cb_data), GFP_KERNEL);
-	if (!cb_data)
+	if (!cb_data) {
+		kfree(eve_data);
 		return -ENOMEM;
+	}
 	cb_data->eve_cb = cb_fun;
 	cb_data->agent_data = data;
 
@@ -570,7 +573,6 @@
 static int xlnx_event_init_sgi(struct platform_device *pdev)
 {
 	int ret = 0;
-	int cpu;
 	/*
 	 * IRQ related structures are used for the following:
 	 * for each SGI interrupt ensure its mapped by GIC IRQ domain
@@ -607,11 +609,8 @@
 	sgi_fwspec.param[0] = sgi_num;
 	virq_sgi = irq_create_fwspec_mapping(&sgi_fwspec);
 
-	cpu = get_cpu();
-	per_cpu(cpu_number1, cpu) = cpu;
 	ret = request_percpu_irq(virq_sgi, xlnx_event_handler, "xlnx_event_mgmt",
-				 &cpu_number1);
-	put_cpu();
+				 &dummy_cpu_number);
 
 	WARN_ON(ret);
 	if (ret) {
@@ -627,16 +626,12 @@
 
 static void xlnx_event_cleanup_sgi(struct platform_device *pdev)
 {
-	int cpu = smp_processor_id();
-
-	per_cpu(cpu_number1, cpu) = cpu;
-
 	cpuhp_remove_state(CPUHP_AP_ONLINE_DYN);
 
 	on_each_cpu(xlnx_disable_percpu_irq, NULL, 1);
 
 	irq_clear_status_flags(virq_sgi, IRQ_PER_CPU);
-	free_percpu_irq(virq_sgi, &cpu_number1);
+	free_percpu_irq(virq_sgi, &dummy_cpu_number);
 	irq_dispose_mapping(virq_sgi);
 }
 
--- linux-qcom-6.8.0.orig/drivers/soc/xilinx/zynqmp_power.c
+++ linux-qcom-6.8.0/drivers/soc/xilinx/zynqmp_power.c
@@ -190,7 +190,9 @@
 	u32 pm_api_version;
 	struct mbox_client *client;
 
-	zynqmp_pm_get_api_version(&pm_api_version);
+	ret = zynqmp_pm_get_api_version(&pm_api_version);
+	if (ret)
+		return ret;
 
 	/* Check PM API version number */
 	if (pm_api_version < ZYNQMP_PM_VERSION)
--- linux-qcom-6.8.0.orig/drivers/soundwire/amd_manager.c
+++ linux-qcom-6.8.0/drivers/soundwire/amd_manager.c
@@ -148,6 +148,19 @@
 	writel(frame_size, amd_manager->mmio + ACP_SW_FRAMESIZE);
 }
 
+static void amd_sdw_wake_enable(struct amd_sdw_manager *amd_manager, bool enable)
+{
+	u32 wake_ctrl;
+
+	wake_ctrl = readl(amd_manager->mmio + ACP_SW_STATE_CHANGE_STATUS_MASK_8TO11);
+	if (enable)
+		wake_ctrl |= AMD_SDW_WAKE_INTR_MASK;
+	else
+		wake_ctrl &= ~AMD_SDW_WAKE_INTR_MASK;
+
+	writel(wake_ctrl, amd_manager->mmio + ACP_SW_STATE_CHANGE_STATUS_MASK_8TO11);
+}
+
 static void amd_sdw_ctl_word_prep(u32 *lower_word, u32 *upper_word, struct sdw_msg *msg,
 				  int cmd_offset)
 {
@@ -1122,6 +1135,7 @@
 	}
 
 	if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) {
+		amd_sdw_wake_enable(amd_manager, false);
 		return amd_sdw_clock_stop(amd_manager);
 	} else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) {
 		/*
@@ -1148,6 +1162,7 @@
 		return 0;
 	}
 	if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) {
+		amd_sdw_wake_enable(amd_manager, true);
 		return amd_sdw_clock_stop(amd_manager);
 	} else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) {
 		ret = amd_sdw_clock_stop(amd_manager);
--- linux-qcom-6.8.0.orig/drivers/soundwire/amd_manager.h
+++ linux-qcom-6.8.0/drivers/soundwire/amd_manager.h
@@ -152,7 +152,7 @@
 #define AMD_SDW0_EXT_INTR_MASK		0x200000
 #define AMD_SDW1_EXT_INTR_MASK		4
 #define AMD_SDW_IRQ_MASK_0TO7		0x77777777
-#define AMD_SDW_IRQ_MASK_8TO11		0x000d7777
+#define AMD_SDW_IRQ_MASK_8TO11		0x000c7777
 #define AMD_SDW_IRQ_ERROR_MASK		0xff
 #define AMD_SDW_MAX_FREQ_NUM		1
 #define AMD_SDW0_MAX_TX_PORTS		3
@@ -190,6 +190,7 @@
 #define AMD_SDW_CLK_RESUME_REQ				2
 #define AMD_SDW_CLK_RESUME_DONE				3
 #define AMD_SDW_WAKE_STAT_MASK				BIT(16)
+#define AMD_SDW_WAKE_INTR_MASK				BIT(16)
 
 static u32 amd_sdw_freq_tbl[AMD_SDW_MAX_FREQ_NUM] = {
 	AMD_SDW_DEFAULT_CLK_FREQ,
--- linux-qcom-6.8.0.orig/drivers/soundwire/cadence_master.c
+++ linux-qcom-6.8.0/drivers/soundwire/cadence_master.c
@@ -891,8 +891,14 @@
 		}
 	}
 
-	if (is_slave)
-		return sdw_handle_slave_status(&cdns->bus, status);
+	if (is_slave) {
+		int ret;
+
+		mutex_lock(&cdns->status_update_lock);
+		ret = sdw_handle_slave_status(&cdns->bus, status);
+		mutex_unlock(&cdns->status_update_lock);
+		return ret;
+	}
 
 	return 0;
 }
@@ -989,6 +995,31 @@
 }
 EXPORT_SYMBOL(sdw_cdns_irq);
 
+static void cdns_check_attached_status_dwork(struct work_struct *work)
+{
+	struct sdw_cdns *cdns =
+		container_of(work, struct sdw_cdns, attach_dwork.work);
+	enum sdw_slave_status status[SDW_MAX_DEVICES + 1];
+	u32 val;
+	int ret;
+	int i;
+
+	val = cdns_readl(cdns, CDNS_MCP_SLAVE_STAT);
+
+	for (i = 0; i <= SDW_MAX_DEVICES; i++) {
+		status[i] = val & 0x3;
+		if (status[i])
+			dev_dbg(cdns->dev, "Peripheral %d status: %d\n", i, status[i]);
+		val >>= 2;
+	}
+
+	mutex_lock(&cdns->status_update_lock);
+	ret = sdw_handle_slave_status(&cdns->bus, status);
+	mutex_unlock(&cdns->status_update_lock);
+	if (ret < 0)
+		dev_err(cdns->dev, "%s: sdw_handle_slave_status failed: %d\n", __func__, ret);
+}
+
 /**
  * cdns_update_slave_status_work - update slave status in a work since we will need to handle
  * other interrupts eg. CDNS_MCP_INT_RX_WL during the update slave
@@ -1745,7 +1776,11 @@
 	init_completion(&cdns->tx_complete);
 	cdns->bus.port_ops = &cdns_port_ops;
 
+	mutex_init(&cdns->status_update_lock);
+
 	INIT_WORK(&cdns->work, cdns_update_slave_status_work);
+	INIT_DELAYED_WORK(&cdns->attach_dwork, cdns_check_attached_status_dwork);
+
 	return 0;
 }
 EXPORT_SYMBOL(sdw_cdns_probe);
@@ -1880,7 +1915,7 @@
 
 	/* check if we found a PDI, else find in bi-directional */
 	if (!pdi)
-		pdi = cdns_find_pdi(cdns, 2, stream->num_bd, stream->bd,
+		pdi = cdns_find_pdi(cdns, 0, stream->num_bd, stream->bd,
 				    dai_id);
 
 	if (pdi) {
--- linux-qcom-6.8.0.orig/drivers/soundwire/cadence_master.h
+++ linux-qcom-6.8.0/drivers/soundwire/cadence_master.h
@@ -117,6 +117,8 @@
  * @link_up: Link status
  * @msg_count: Messages sent on bus
  * @dai_runtime_array: runtime context for each allocated DAI.
+ * @status_update_lock: protect concurrency between interrupt-based and delayed work
+ * status update
  */
 struct sdw_cdns {
 	struct device *dev;
@@ -148,10 +150,13 @@
 	bool interrupt_enabled;
 
 	struct work_struct work;
+	struct delayed_work attach_dwork;
 
 	struct list_head list;
 
 	struct sdw_cdns_dai_runtime **dai_runtime_array;
+
+	struct mutex status_update_lock; /* add mutual exclusion to sdw_handle_slave_status() */
 };
 
 #define bus_to_cdns(_bus) container_of(_bus, struct sdw_cdns, bus)
--- linux-qcom-6.8.0.orig/drivers/soundwire/dmi-quirks.c
+++ linux-qcom-6.8.0/drivers/soundwire/dmi-quirks.c
@@ -131,6 +131,14 @@
 		.driver_data = (void *)intel_rooks_county,
 	},
 	{
+		/* quirk used for NUC15 LAPRC710 skew */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
+			DMI_MATCH(DMI_BOARD_NAME, "LAPRC710"),
+		},
+		.driver_data = (void *)intel_rooks_county,
+	},
+	{
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A3E")
--- linux-qcom-6.8.0.orig/drivers/soundwire/intel.h
+++ linux-qcom-6.8.0/drivers/soundwire/intel.h
@@ -91,6 +91,8 @@
 
 #define INTEL_MASTER_RESET_ITERATIONS	10
 
+#define SDW_INTEL_DELAYED_ENUMERATION_MS	100
+
 #define SDW_INTEL_CHECK_OPS(sdw, cb)	((sdw) && (sdw)->link_res && (sdw)->link_res->hw_ops && \
 					 (sdw)->link_res->hw_ops->cb)
 #define SDW_INTEL_OPS(sdw, cb)		((sdw)->link_res->hw_ops->cb)
--- linux-qcom-6.8.0.orig/drivers/soundwire/intel_ace2x.c
+++ linux-qcom-6.8.0/drivers/soundwire/intel_ace2x.c
@@ -314,11 +314,12 @@
 static int intel_prepare(struct snd_pcm_substream *substream,
 			 struct snd_soc_dai *dai)
 {
+	struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
 	struct sdw_cdns *cdns = snd_soc_dai_get_drvdata(dai);
 	struct sdw_intel *sdw = cdns_to_intel(cdns);
 	struct sdw_cdns_dai_runtime *dai_runtime;
+	struct snd_pcm_hw_params *hw_params;
 	int ch, dir;
-	int ret = 0;
 
 	dai_runtime = cdns->dai_runtime_array[dai->id];
 	if (!dai_runtime) {
@@ -327,12 +328,8 @@
 		return -EIO;
 	}
 
+	hw_params = &rtd->dpcm[substream->stream].hw_params;
 	if (dai_runtime->suspended) {
-		struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
-		struct snd_pcm_hw_params *hw_params;
-
-		hw_params = &rtd->dpcm[substream->stream].hw_params;
-
 		dai_runtime->suspended = false;
 
 		/*
@@ -353,15 +350,11 @@
 		/* the SHIM will be configured in the callback functions */
 
 		sdw_cdns_config_stream(cdns, ch, dir, dai_runtime->pdi);
-
-		/* Inform DSP about PDI stream number */
-		ret = intel_params_stream(sdw, substream, dai,
-					  hw_params,
-					  sdw->instance,
-					  dai_runtime->pdi->intel_alh_id);
 	}
 
-	return ret;
+	/* Inform DSP about PDI stream number */
+	return intel_params_stream(sdw, substream, dai, hw_params, sdw->instance,
+				   dai_runtime->pdi->intel_alh_id);
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/soundwire/intel_auxdevice.c
+++ linux-qcom-6.8.0/drivers/soundwire/intel_auxdevice.c
@@ -398,6 +398,7 @@
 	 */
 	if (!bus->prop.hw_disabled) {
 		sdw_intel_debugfs_exit(sdw);
+		cancel_delayed_work_sync(&cdns->attach_dwork);
 		sdw_cdns_enable_interrupt(cdns, false);
 	}
 	sdw_bus_master_delete(bus);
--- linux-qcom-6.8.0.orig/drivers/soundwire/intel_bus_common.c
+++ linux-qcom-6.8.0/drivers/soundwire/intel_bus_common.c
@@ -45,21 +45,24 @@
 		return ret;
 	}
 
-	ret = sdw_cdns_exit_reset(cdns);
+	ret = sdw_cdns_enable_interrupt(cdns, true);
 	if (ret < 0) {
-		dev_err(dev, "%s: unable to exit bus reset sequence: %d\n", __func__, ret);
+		dev_err(dev, "%s: cannot enable interrupts: %d\n", __func__, ret);
 		return ret;
 	}
 
-	ret = sdw_cdns_enable_interrupt(cdns, true);
+	ret = sdw_cdns_exit_reset(cdns);
 	if (ret < 0) {
-		dev_err(dev, "%s: cannot enable interrupts: %d\n", __func__, ret);
+		dev_err(dev, "%s: unable to exit bus reset sequence: %d\n", __func__, ret);
 		return ret;
 	}
 
 	sdw_cdns_check_self_clearing_bits(cdns, __func__,
 					  true, INTEL_MASTER_RESET_ITERATIONS);
 
+	schedule_delayed_work(&cdns->attach_dwork,
+			      msecs_to_jiffies(SDW_INTEL_DELAYED_ENUMERATION_MS));
+
 	return 0;
 }
 
@@ -136,21 +139,24 @@
 			return ret;
 		}
 
-		ret = sdw_cdns_exit_reset(cdns);
+		ret = sdw_cdns_enable_interrupt(cdns, true);
 		if (ret < 0) {
-			dev_err(dev, "unable to exit bus reset sequence during resume\n");
+			dev_err(dev, "cannot enable interrupts during resume\n");
 			return ret;
 		}
 
-		ret = sdw_cdns_enable_interrupt(cdns, true);
+		ret = sdw_cdns_exit_reset(cdns);
 		if (ret < 0) {
-			dev_err(dev, "cannot enable interrupts during resume\n");
+			dev_err(dev, "unable to exit bus reset sequence during resume\n");
 			return ret;
 		}
 
 	}
 	sdw_cdns_check_self_clearing_bits(cdns, __func__, true, INTEL_MASTER_RESET_ITERATIONS);
 
+	schedule_delayed_work(&cdns->attach_dwork,
+			      msecs_to_jiffies(SDW_INTEL_DELAYED_ENUMERATION_MS));
+
 	return 0;
 }
 
@@ -184,6 +190,9 @@
 
 	sdw_cdns_check_self_clearing_bits(cdns, __func__, true, INTEL_MASTER_RESET_ITERATIONS);
 
+	schedule_delayed_work(&cdns->attach_dwork,
+			      msecs_to_jiffies(SDW_INTEL_DELAYED_ENUMERATION_MS));
+
 	return 0;
 }
 
@@ -194,6 +203,8 @@
 	bool wake_enable = false;
 	int ret;
 
+	cancel_delayed_work_sync(&cdns->attach_dwork);
+
 	if (clock_stop) {
 		ret = sdw_cdns_clock_stop(cdns, true);
 		if (ret < 0)
--- linux-qcom-6.8.0.orig/drivers/soundwire/qcom.c
+++ linux-qcom-6.8.0/drivers/soundwire/qcom.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2019, Linaro Limited
+// Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/clk.h>
 #include <linux/completion.h>
@@ -156,6 +157,7 @@
 	u8 word_length;
 	u8 blk_group_count;
 	u8 lane_control;
+	u8 chan_mask;
 };
 
 /*
@@ -1037,8 +1039,14 @@
 {
 	u32 reg = SWRM_DP_PORT_CTRL_BANK(enable_ch->port_num, bank);
 	struct qcom_swrm_ctrl *ctrl = to_qcom_sdw(bus);
+	struct qcom_swrm_port_config *pcfg;
 	u32 val;
 
+	pcfg = &ctrl->pconfig[enable_ch->port_num];
+
+	if (pcfg->chan_mask != SWR_INVALID_PARAM && pcfg->chan_mask != 0)
+		enable_ch->ch_mask = pcfg->chan_mask;
+
 	ctrl->reg_read(ctrl, reg, &val);
 
 	if (enable_ch->enable)
@@ -1261,7 +1269,10 @@
 			     struct snd_soc_dai *dai)
 {
 	struct qcom_swrm_ctrl *ctrl = dev_get_drvdata(dai->dev);
-	int ret;
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct sdw_stream_runtime *sruntime;
+	struct snd_soc_dai *codec_dai;
+	int ret, i;
 
 	ret = pm_runtime_get_sync(ctrl->dev);
 	if (ret < 0 && ret != -EACCES) {
@@ -1272,7 +1283,33 @@
 		return ret;
 	}
 
+	sruntime = sdw_alloc_stream(dai->name);
+	if (!sruntime) {
+		ret = -ENOMEM;
+		goto err_alloc;
+	}
+
+	ctrl->sruntime[dai->id] = sruntime;
+
+	for_each_rtd_codec_dais(rtd, i, codec_dai) {
+		ret = snd_soc_dai_set_stream(codec_dai, sruntime,
+					     substream->stream);
+		if (ret < 0 && ret != -ENOTSUPP) {
+			dev_err(dai->dev, "Failed to set sdw stream on %s\n",
+				codec_dai->name);
+			goto err_set_stream;
+		}
+	}
+
 	return 0;
+
+err_set_stream:
+	sdw_release_stream(sruntime);
+err_alloc:
+	pm_runtime_mark_last_busy(ctrl->dev);
+	pm_runtime_put_autosuspend(ctrl->dev);
+
+	return ret;
 }
 
 static void qcom_swrm_shutdown(struct snd_pcm_substream *substream,
@@ -1281,6 +1318,8 @@
 	struct qcom_swrm_ctrl *ctrl = dev_get_drvdata(dai->dev);
 
 	swrm_wait_for_wr_fifo_done(ctrl);
+	sdw_release_stream(ctrl->sruntime[dai->id]);
+	ctrl->sruntime[dai->id] = NULL;
 	pm_runtime_mark_last_busy(ctrl->dev);
 	pm_runtime_put_autosuspend(ctrl->dev);
 
@@ -1324,7 +1363,7 @@
 
 		stream->channels_min = 1;
 		stream->channels_max = 1;
-		stream->rates = SNDRV_PCM_RATE_48000;
+		stream->rates = SNDRV_PCM_RATE_8000_384000;
 		stream->formats = SNDRV_PCM_FMTBIT_S16_LE;
 
 		dais[i].ops = &qcom_swrm_pdm_dai_ops;
@@ -1348,30 +1387,21 @@
 	u8 word_length[QCOM_SDW_MAX_PORTS];
 	u8 blk_group_count[QCOM_SDW_MAX_PORTS];
 	u8 lane_control[QCOM_SDW_MAX_PORTS];
+	u8 chan_mask[QCOM_SDW_MAX_PORTS];
 	int i, ret, nports, val;
 	bool si_16 = false;
 
-	ctrl->reg_read(ctrl, SWRM_COMP_PARAMS, &val);
-
-	ctrl->num_dout_ports = FIELD_GET(SWRM_COMP_PARAMS_DOUT_PORTS_MASK, val);
-	ctrl->num_din_ports = FIELD_GET(SWRM_COMP_PARAMS_DIN_PORTS_MASK, val);
 
 	ret = of_property_read_u32(np, "qcom,din-ports", &val);
 	if (ret)
 		return ret;
 
-	if (val > ctrl->num_din_ports)
-		return -EINVAL;
-
 	ctrl->num_din_ports = val;
 
 	ret = of_property_read_u32(np, "qcom,dout-ports", &val);
 	if (ret)
 		return ret;
 
-	if (val > ctrl->num_dout_ports)
-		return -EINVAL;
-
 	ctrl->num_dout_ports = val;
 
 	nports = ctrl->num_dout_ports + ctrl->num_din_ports;
@@ -1426,6 +1456,9 @@
 	memset(lane_control, SWR_INVALID_PARAM, QCOM_SDW_MAX_PORTS);
 	of_property_read_u8_array(np, "qcom,ports-lane-control", lane_control, nports);
 
+	memset(chan_mask, SWR_INVALID_PARAM, QCOM_SDW_MAX_PORTS);
+	of_property_read_u8_array(np, "qcom,ports-chmask", chan_mask, nports);
+
 	for (i = 0; i < nports; i++) {
 		/* Valid port number range is from 1-14 */
 		if (si_16)
@@ -1440,6 +1473,7 @@
 		ctrl->pconfig[i + 1].word_length = word_length[i];
 		ctrl->pconfig[i + 1].blk_group_count = blk_group_count[i];
 		ctrl->pconfig[i + 1].lane_control = lane_control[i];
+		ctrl->pconfig[i + 1].chan_mask = chan_mask[i];
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/soundwire/stream.c
+++ linux-qcom-6.8.0/drivers/soundwire/stream.c
@@ -31,6 +31,17 @@
 int sdw_cols[SDW_FRAME_COLS] = {2, 4, 6, 8, 10, 12, 14, 16};
 EXPORT_SYMBOL(sdw_cols);
 
+static bool is_native_on;
+
+void sdw_native_notify(bool native_rate_status)
+{
+	if (native_rate_status)
+		is_native_on = true;
+	else
+		is_native_on = false;
+}
+EXPORT_SYMBOL_GPL(sdw_native_notify);
+
 int sdw_find_col_index(int col)
 {
 	int i;
@@ -1364,10 +1375,13 @@
 		prop = &bus->prop;
 		memcpy(&params, &bus->params, sizeof(params));
 
-		/* TODO: Support Asynchronous mode */
-		if ((prop->max_clk_freq % stream->params.rate) != 0) {
-			dev_err(bus->dev, "Async mode not supported\n");
-			return -EINVAL;
+		/*Skip Async mode support for native playback*/
+		if (!is_native_on) {
+			/* TODO: Support Asynchronous mode */
+			if ((prop->max_clk_freq % stream->params.rate) != 0) {
+				dev_err(bus->dev, "Async mode not supported\n");
+				return -EINVAL;
+			}
 		}
 
 		if (update_params) {
--- linux-qcom-6.8.0.orig/drivers/spi/atmel-quadspi.c
+++ linux-qcom-6.8.0/drivers/spi/atmel-quadspi.c
@@ -183,7 +183,7 @@
 	case QSPI_MR:
 		return "MR";
 	case QSPI_RD:
-		return "MR";
+		return "RD";
 	case QSPI_TD:
 		return "TD";
 	case QSPI_SR:
@@ -375,9 +375,9 @@
 	 * If the QSPI controller is set in regular SPI mode, set it in
 	 * Serial Memory Mode (SMM).
 	 */
-	if (aq->mr != QSPI_MR_SMM) {
-		atmel_qspi_write(QSPI_MR_SMM, aq, QSPI_MR);
-		aq->mr = QSPI_MR_SMM;
+	if (!(aq->mr & QSPI_MR_SMM)) {
+		aq->mr |= QSPI_MR_SMM;
+		atmel_qspi_write(aq->mr, aq, QSPI_MR);
 	}
 
 	/* Clear pending interrupts */
@@ -501,7 +501,8 @@
 	if (ret < 0)
 		return ret;
 
-	aq->scr = QSPI_SCR_SCBR(scbr);
+	aq->scr &= ~QSPI_SCR_SCBR_MASK;
+	aq->scr |= QSPI_SCR_SCBR(scbr);
 	atmel_qspi_write(aq->scr, aq, QSPI_SCR);
 
 	pm_runtime_mark_last_busy(ctrl->dev.parent);
@@ -534,6 +535,7 @@
 	if (ret < 0)
 		return ret;
 
+	aq->scr &= ~QSPI_SCR_DLYBS_MASK;
 	aq->scr |= QSPI_SCR_DLYBS(cs_setup);
 	atmel_qspi_write(aq->scr, aq, QSPI_SCR);
 
@@ -549,8 +551,8 @@
 	atmel_qspi_write(QSPI_CR_SWRST, aq, QSPI_CR);
 
 	/* Set the QSPI controller by default in Serial Memory Mode */
-	atmel_qspi_write(QSPI_MR_SMM, aq, QSPI_MR);
-	aq->mr = QSPI_MR_SMM;
+	aq->mr |= QSPI_MR_SMM;
+	atmel_qspi_write(aq->mr, aq, QSPI_MR);
 
 	/* Enable the QSPI controller */
 	atmel_qspi_write(QSPI_CR_QSPIEN, aq, QSPI_CR);
@@ -726,6 +728,7 @@
 	clk_unprepare(aq->pclk);
 
 	pm_runtime_disable(&pdev->dev);
+	pm_runtime_dont_use_autosuspend(&pdev->dev);
 	pm_runtime_put_noidle(&pdev->dev);
 }
 
@@ -756,8 +759,15 @@
 	struct atmel_qspi *aq = spi_controller_get_devdata(ctrl);
 	int ret;
 
-	clk_prepare(aq->pclk);
-	clk_prepare(aq->qspick);
+	ret = clk_prepare(aq->pclk);
+	if (ret)
+		return ret;
+
+	ret = clk_prepare(aq->qspick);
+	if (ret) {
+		clk_unprepare(aq->pclk);
+		return ret;
+	}
 
 	ret = pm_runtime_force_resume(dev);
 	if (ret < 0)
--- linux-qcom-6.8.0.orig/drivers/spi/spi-aspeed-smc.c
+++ linux-qcom-6.8.0/drivers/spi/spi-aspeed-smc.c
@@ -239,7 +239,7 @@
 
 	ret = aspeed_spi_send_cmd_addr(chip, op->addr.nbytes, offset, op->cmd.opcode);
 	if (ret < 0)
-		return ret;
+		goto stop_user;
 
 	if (op->dummy.buswidth && op->dummy.nbytes) {
 		for (i = 0; i < op->dummy.nbytes / op->dummy.buswidth; i++)
@@ -249,8 +249,9 @@
 	aspeed_spi_set_io_mode(chip, io_mode);
 
 	aspeed_spi_read_from_ahb(buf, chip->ahb_base, len);
+stop_user:
 	aspeed_spi_stop_user(chip);
-	return 0;
+	return ret;
 }
 
 static ssize_t aspeed_spi_write_user(struct aspeed_spi_chip *chip,
@@ -261,10 +262,11 @@
 	aspeed_spi_start_user(chip);
 	ret = aspeed_spi_send_cmd_addr(chip, op->addr.nbytes, op->addr.val, op->cmd.opcode);
 	if (ret < 0)
-		return ret;
+		goto stop_user;
 	aspeed_spi_write_to_ahb(chip->ahb_base, op->data.buf.out, op->data.nbytes);
+stop_user:
 	aspeed_spi_stop_user(chip);
-	return 0;
+	return ret;
 }
 
 /* support for 1-1-1, 1-1-2 or 1-1-4 */
--- linux-qcom-6.8.0.orig/drivers/spi/spi-axi-spi-engine.c
+++ linux-qcom-6.8.0/drivers/spi/spi-axi-spi-engine.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/clk.h>
+#include <linux/fpga/adi-axi-common.h>
 #include <linux/idr.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
@@ -15,12 +16,6 @@
 #include <linux/spi/spi.h>
 #include <linux/timer.h>
 
-#define SPI_ENGINE_VERSION_MAJOR(x)	((x >> 16) & 0xff)
-#define SPI_ENGINE_VERSION_MINOR(x)	((x >> 8) & 0xff)
-#define SPI_ENGINE_VERSION_PATCH(x)	(x & 0xff)
-
-#define SPI_ENGINE_REG_VERSION			0x00
-
 #define SPI_ENGINE_REG_RESET			0x40
 
 #define SPI_ENGINE_REG_INT_ENABLE		0x80
@@ -171,16 +166,20 @@
 }
 
 static void spi_engine_gen_sleep(struct spi_engine_program *p, bool dry,
-				 int delay_ns, u32 sclk_hz)
+				 int delay_ns, int inst_ns, u32 sclk_hz)
 {
 	unsigned int t;
 
-	/* negative delay indicates error, e.g. from spi_delay_to_ns() */
-	if (delay_ns <= 0)
+	/*
+	 * Negative delay indicates error, e.g. from spi_delay_to_ns(). And if
+	 * delay is less that the instruction execution time, there is no need
+	 * for an extra sleep instruction since the instruction execution time
+	 * will already cover the required delay.
+	 */
+	if (delay_ns < 0 || delay_ns <= inst_ns)
 		return;
 
-	/* rounding down since executing the instruction adds a couple of ticks delay */
-	t = DIV_ROUND_DOWN_ULL((u64)delay_ns * sclk_hz, NSEC_PER_SEC);
+	t = DIV_ROUND_UP_ULL((u64)(delay_ns - inst_ns) * sclk_hz, NSEC_PER_SEC);
 	while (t) {
 		unsigned int n = min(t, 256U);
 
@@ -227,10 +226,16 @@
 	struct spi_device *spi = msg->spi;
 	struct spi_controller *host = spi->controller;
 	struct spi_transfer *xfer;
-	int clk_div, new_clk_div;
+	int clk_div, new_clk_div, inst_ns;
 	bool keep_cs = false;
 	u8 bits_per_word = 0;
 
+	/*
+	 * Take into account instruction execution time for more accurate sleep
+	 * times, especially when the delay is small.
+	 */
+	inst_ns = DIV_ROUND_UP(NSEC_PER_SEC, host->max_speed_hz);
+
 	clk_div = 1;
 
 	spi_engine_program_add_cmd(p, dry,
@@ -259,7 +264,7 @@
 
 		spi_engine_gen_xfer(p, dry, xfer);
 		spi_engine_gen_sleep(p, dry, spi_delay_to_ns(&xfer->delay, xfer),
-				     xfer->effective_speed_hz);
+				     inst_ns, xfer->effective_speed_hz);
 
 		if (xfer->cs_change) {
 			if (list_is_last(&xfer->transfer_list, &msg->transfers)) {
@@ -269,7 +274,7 @@
 					spi_engine_gen_cs(p, dry, spi, false);
 
 				spi_engine_gen_sleep(p, dry, spi_delay_to_ns(
-					&xfer->cs_change_delay, xfer),
+					&xfer->cs_change_delay, xfer), inst_ns,
 					xfer->effective_speed_hz);
 
 				if (!list_next_entry(xfer, transfer_list)->cs_off)
@@ -661,12 +666,12 @@
 	if (IS_ERR(spi_engine->base))
 		return PTR_ERR(spi_engine->base);
 
-	version = readl(spi_engine->base + SPI_ENGINE_REG_VERSION);
-	if (SPI_ENGINE_VERSION_MAJOR(version) != 1) {
-		dev_err(&pdev->dev, "Unsupported peripheral version %u.%u.%c\n",
-			SPI_ENGINE_VERSION_MAJOR(version),
-			SPI_ENGINE_VERSION_MINOR(version),
-			SPI_ENGINE_VERSION_PATCH(version));
+	version = readl(spi_engine->base + ADI_AXI_REG_VERSION);
+	if (ADI_AXI_PCORE_VER_MAJOR(version) != 1) {
+		dev_err(&pdev->dev, "Unsupported peripheral version %u.%u.%u\n",
+			ADI_AXI_PCORE_VER_MAJOR(version),
+			ADI_AXI_PCORE_VER_MINOR(version),
+			ADI_AXI_PCORE_VER_PATCH(version));
 		return -ENODEV;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/spi/spi-bcm63xx.c
+++ linux-qcom-6.8.0/drivers/spi/spi-bcm63xx.c
@@ -466,12 +466,14 @@
 	{
 	},
 };
+MODULE_DEVICE_TABLE(platform, bcm63xx_spi_dev_match);
 
 static const struct of_device_id bcm63xx_spi_of_match[] = {
 	{ .compatible = "brcm,bcm6348-spi", .data = &bcm6348_spi_reg_offsets },
 	{ .compatible = "brcm,bcm6358-spi", .data = &bcm6358_spi_reg_offsets },
 	{ },
 };
+MODULE_DEVICE_TABLE(of, bcm63xx_spi_of_match);
 
 static int bcm63xx_spi_probe(struct platform_device *pdev)
 {
@@ -582,13 +584,15 @@
 
 	bcm_spi_writeb(bs, SPI_INTR_CLEAR_ALL, SPI_INT_STATUS);
 
-	pm_runtime_enable(&pdev->dev);
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		goto out_clk_disable;
 
 	/* register and we are done */
 	ret = devm_spi_register_controller(dev, host);
 	if (ret) {
 		dev_err(dev, "spi register failed\n");
-		goto out_pm_disable;
+		goto out_clk_disable;
 	}
 
 	dev_info(dev, "at %pr (irq %d, FIFOs size %d)\n",
@@ -596,8 +600,6 @@
 
 	return 0;
 
-out_pm_disable:
-	pm_runtime_disable(&pdev->dev);
 out_clk_disable:
 	clk_disable_unprepare(clk);
 out_err:
--- linux-qcom-6.8.0.orig/drivers/spi/spi-bcmbca-hsspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-bcmbca-hsspi.c
@@ -546,12 +546,14 @@
 			goto out_put_host;
 	}
 
-	pm_runtime_enable(&pdev->dev);
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		goto out_put_host;
 
 	ret = sysfs_create_group(&pdev->dev.kobj, &bcmbca_hsspi_group);
 	if (ret) {
 		dev_err(&pdev->dev, "couldn't register sysfs group\n");
-		goto out_pm_disable;
+		goto out_put_host;
 	}
 
 	/* register and we are done */
@@ -565,8 +567,6 @@
 
 out_sysgroup_disable:
 	sysfs_remove_group(&pdev->dev.kobj, &bcmbca_hsspi_group);
-out_pm_disable:
-	pm_runtime_disable(&pdev->dev);
 out_put_host:
 	spi_controller_put(host);
 out_disable_pll_clk:
--- linux-qcom-6.8.0.orig/drivers/spi/spi-cadence-quadspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-cadence-quadspi.c
@@ -40,6 +40,7 @@
 #define CQSPI_NO_SUPPORT_WR_COMPLETION	BIT(3)
 #define CQSPI_SLOW_SRAM		BIT(4)
 #define CQSPI_NEEDS_APB_AHB_HAZARD_WAR	BIT(5)
+#define CQSPI_DISABLE_STIG_MODE		BIT(7)
 
 /* Capabilities */
 #define CQSPI_SUPPORTS_OCTAL		BIT(0)
@@ -100,6 +101,7 @@
 	bool			apb_ahb_hazard;
 
 	bool			is_jh7110; /* Flag for StarFive JH7110 SoC */
+	bool			disable_stig_mode;
 };
 
 struct cqspi_driver_platdata {
@@ -1395,7 +1397,8 @@
 	 * reads, prefer STIG mode for such small reads.
 	 */
 		if (!op->addr.nbytes ||
-		    op->data.nbytes <= CQSPI_STIG_DATA_LEN_MAX)
+		    (op->data.nbytes <= CQSPI_STIG_DATA_LEN_MAX &&
+		     !cqspi->disable_stig_mode))
 			return cqspi_command_read(f_pdata, op);
 
 		return cqspi_read(f_pdata, op);
@@ -1842,6 +1845,8 @@
 			if (ret)
 				goto probe_reset_failed;
 		}
+		if (ddata->quirks & CQSPI_DISABLE_STIG_MODE)
+			cqspi->disable_stig_mode = true;
 
 		if (of_device_is_compatible(pdev->dev.of_node,
 					    "xlnx,versal-ospi-1.0")) {
@@ -1952,13 +1957,25 @@
 static int cqspi_suspend(struct device *dev)
 {
 	struct cqspi_st *cqspi = dev_get_drvdata(dev);
+	int ret;
 
-	return spi_controller_suspend(cqspi->host);
+	ret = spi_controller_suspend(cqspi->host);
+	if (ret)
+		return ret;
+
+	return pm_runtime_force_suspend(dev);
 }
 
 static int cqspi_resume(struct device *dev)
 {
 	struct cqspi_st *cqspi = dev_get_drvdata(dev);
+	int ret;
+
+	ret = pm_runtime_force_resume(dev);
+	if (ret) {
+		dev_err(dev, "pm_runtime_force_resume failed on resume\n");
+		return ret;
+	}
 
 	return spi_controller_resume(cqspi->host);
 }
@@ -1988,7 +2005,8 @@
 static const struct cqspi_driver_platdata socfpga_qspi = {
 	.quirks = CQSPI_DISABLE_DAC_MODE
 			| CQSPI_NO_SUPPORT_WR_COMPLETION
-			| CQSPI_SLOW_SRAM,
+			| CQSPI_SLOW_SRAM
+			| CQSPI_DISABLE_STIG_MODE,
 };
 
 static const struct cqspi_driver_platdata versal_ospi = {
--- linux-qcom-6.8.0.orig/drivers/spi/spi-cadence-xspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-cadence-xspi.c
@@ -145,6 +145,9 @@
 #define CDNS_XSPI_STIG_DONE_FLAG		BIT(0)
 #define CDNS_XSPI_TRD_STATUS			0x0104
 
+#define MODE_NO_OF_BYTES			GENMASK(25, 24)
+#define MODEBYTES_COUNT			1
+
 /* Helper macros for filling command registers */
 #define CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_1(op, data_phase) ( \
 	FIELD_PREP(CDNS_XSPI_CMD_INSTR_TYPE, (data_phase) ? \
@@ -157,9 +160,10 @@
 	FIELD_PREP(CDNS_XSPI_CMD_P1_R2_ADDR3, ((op)->addr.val >> 24) & 0xFF) | \
 	FIELD_PREP(CDNS_XSPI_CMD_P1_R2_ADDR4, ((op)->addr.val >> 32) & 0xFF))
 
-#define CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_3(op) ( \
+#define CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_3(op, modebytes) ( \
 	FIELD_PREP(CDNS_XSPI_CMD_P1_R3_ADDR5, ((op)->addr.val >> 40) & 0xFF) | \
 	FIELD_PREP(CDNS_XSPI_CMD_P1_R3_CMD, (op)->cmd.opcode) | \
+	FIELD_PREP(MODE_NO_OF_BYTES, modebytes) | \
 	FIELD_PREP(CDNS_XSPI_CMD_P1_R3_NUM_ADDR_BYTES, (op)->addr.nbytes))
 
 #define CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_4(op, chipsel) ( \
@@ -173,12 +177,12 @@
 #define CDNS_XSPI_CMD_FLD_DSEQ_CMD_2(op) \
 	FIELD_PREP(CDNS_XSPI_CMD_DSEQ_R2_DCNT_L, (op)->data.nbytes & 0xFFFF)
 
-#define CDNS_XSPI_CMD_FLD_DSEQ_CMD_3(op) ( \
+#define CDNS_XSPI_CMD_FLD_DSEQ_CMD_3(op, dummybytes) ( \
 	FIELD_PREP(CDNS_XSPI_CMD_DSEQ_R3_DCNT_H, \
 		((op)->data.nbytes >> 16) & 0xffff) | \
 	FIELD_PREP(CDNS_XSPI_CMD_DSEQ_R3_NUM_OF_DUMMY, \
 		  (op)->dummy.buswidth != 0 ? \
-		  (((op)->dummy.nbytes * 8) / (op)->dummy.buswidth) : \
+		  (((dummybytes) * 8) / (op)->dummy.buswidth) : \
 		  0))
 
 #define CDNS_XSPI_CMD_FLD_DSEQ_CMD_4(op, chipsel) ( \
@@ -351,6 +355,7 @@
 	u32 cmd_regs[6];
 	u32 cmd_status;
 	int ret;
+	int dummybytes = op->dummy.nbytes;
 
 	ret = cdns_xspi_wait_for_controller_idle(cdns_xspi);
 	if (ret < 0)
@@ -365,7 +370,12 @@
 	memset(cmd_regs, 0, sizeof(cmd_regs));
 	cmd_regs[1] = CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_1(op, data_phase);
 	cmd_regs[2] = CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_2(op);
-	cmd_regs[3] = CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_3(op);
+	if (dummybytes != 0) {
+		cmd_regs[3] = CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_3(op, 1);
+		dummybytes--;
+	} else {
+		cmd_regs[3] = CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_3(op, 0);
+	}
 	cmd_regs[4] = CDNS_XSPI_CMD_FLD_P1_INSTR_CMD_4(op,
 						       cdns_xspi->cur_cs);
 
@@ -375,7 +385,7 @@
 		cmd_regs[0] = CDNS_XSPI_STIG_DONE_FLAG;
 		cmd_regs[1] = CDNS_XSPI_CMD_FLD_DSEQ_CMD_1(op);
 		cmd_regs[2] = CDNS_XSPI_CMD_FLD_DSEQ_CMD_2(op);
-		cmd_regs[3] = CDNS_XSPI_CMD_FLD_DSEQ_CMD_3(op);
+		cmd_regs[3] = CDNS_XSPI_CMD_FLD_DSEQ_CMD_3(op, dummybytes);
 		cmd_regs[4] = CDNS_XSPI_CMD_FLD_DSEQ_CMD_4(op,
 							   cdns_xspi->cur_cs);
 
--- linux-qcom-6.8.0.orig/drivers/spi/spi-cadence.c
+++ linux-qcom-6.8.0/drivers/spi/spi-cadence.c
@@ -665,8 +665,8 @@
 
 clk_dis_all:
 	if (!spi_controller_is_target(ctlr)) {
-		pm_runtime_set_suspended(&pdev->dev);
 		pm_runtime_disable(&pdev->dev);
+		pm_runtime_set_suspended(&pdev->dev);
 	}
 remove_ctlr:
 	spi_controller_put(ctlr);
@@ -688,8 +688,10 @@
 
 	cdns_spi_write(xspi, CDNS_SPI_ER, CDNS_SPI_ER_DISABLE);
 
-	pm_runtime_set_suspended(&pdev->dev);
-	pm_runtime_disable(&pdev->dev);
+	if (!spi_controller_is_target(ctlr)) {
+		pm_runtime_disable(&pdev->dev);
+		pm_runtime_set_suspended(&pdev->dev);
+	}
 
 	spi_unregister_controller(ctlr);
 }
--- linux-qcom-6.8.0.orig/drivers/spi/spi-cs42l43.c
+++ linux-qcom-6.8.0/drivers/spi/spi-cs42l43.c
@@ -19,7 +19,7 @@
 #include <linux/units.h>
 
 #define CS42L43_FIFO_SIZE		16
-#define CS42L43_SPI_ROOT_HZ		(40 * HZ_PER_MHZ)
+#define CS42L43_SPI_ROOT_HZ		49152000
 #define CS42L43_SPI_MAX_LENGTH		65532
 
 enum cs42l43_spi_cmd {
--- linux-qcom-6.8.0.orig/drivers/spi/spi-davinci.c
+++ linux-qcom-6.8.0/drivers/spi/spi-davinci.c
@@ -984,6 +984,9 @@
 	return ret;
 
 free_dma:
+	/* This bit needs to be cleared to disable dpsi->clk */
+	clear_io_bits(dspi->base + SPIGCR1, SPIGCR1_POWERDOWN_MASK);
+
 	if (dspi->dma_rx) {
 		dma_release_channel(dspi->dma_rx);
 		dma_release_channel(dspi->dma_tx);
@@ -1013,6 +1016,9 @@
 
 	spi_bitbang_stop(&dspi->bitbang);
 
+	/* This bit needs to be cleared to disable dpsi->clk */
+	clear_io_bits(dspi->base + SPIGCR1, SPIGCR1_POWERDOWN_MASK);
+
 	if (dspi->dma_rx) {
 		dma_release_channel(dspi->dma_rx);
 		dma_release_channel(dspi->dma_tx);
--- linux-qcom-6.8.0.orig/drivers/spi/spi-fsl-dspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-fsl-dspi.c
@@ -1008,6 +1008,7 @@
 	u32 cs_sck_delay = 0, sck_cs_delay = 0;
 	struct fsl_dspi_platform_data *pdata;
 	unsigned char pasc = 0, asc = 0;
+	struct gpio_desc *gpio_cs;
 	struct chip_data *chip;
 	unsigned long clkrate;
 	bool cs = true;
@@ -1073,7 +1074,10 @@
 			chip->ctar_val |= SPI_CTAR_LSBFE;
 	}
 
-	gpiod_direction_output(spi_get_csgpiod(spi, 0), false);
+	gpio_cs = spi_get_csgpiod(spi, 0);
+	if (gpio_cs)
+		gpiod_direction_output(gpio_cs, false);
+
 	dspi_deassert_cs(spi, &cs);
 
 	spi_set_ctldata(spi, chip);
--- linux-qcom-6.8.0.orig/drivers/spi/spi-fsl-lpspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-fsl-lpspi.c
@@ -82,6 +82,10 @@
 #define TCR_RXMSK	BIT(19)
 #define TCR_TXMSK	BIT(18)
 
+struct fsl_lpspi_devtype_data {
+	u8 prescale_max;
+};
+
 struct lpspi_config {
 	u8 bpw;
 	u8 chip_select;
@@ -119,10 +123,25 @@
 	bool usedma;
 	struct completion dma_rx_completion;
 	struct completion dma_tx_completion;
+
+	const struct fsl_lpspi_devtype_data *devtype_data;
+};
+
+/*
+ * ERR051608 fixed or not:
+ * https://www.nxp.com/docs/en/errata/i.MX93_1P87f.pdf
+ */
+static struct fsl_lpspi_devtype_data imx93_lpspi_devtype_data = {
+	.prescale_max = 1,
+};
+
+static struct fsl_lpspi_devtype_data imx7ulp_lpspi_devtype_data = {
+	.prescale_max = 7,
 };
 
 static const struct of_device_id fsl_lpspi_dt_ids[] = {
-	{ .compatible = "fsl,imx7ulp-spi", },
+	{ .compatible = "fsl,imx7ulp-spi", .data = &imx7ulp_lpspi_devtype_data,},
+	{ .compatible = "fsl,imx93-spi", .data = &imx93_lpspi_devtype_data,},
 	{ /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, fsl_lpspi_dt_ids);
@@ -296,10 +315,13 @@
 static int fsl_lpspi_set_bitrate(struct fsl_lpspi_data *fsl_lpspi)
 {
 	struct lpspi_config config = fsl_lpspi->config;
-	unsigned int perclk_rate, scldiv;
+	unsigned int perclk_rate, div;
+	u8 prescale_max;
 	u8 prescale;
+	int scldiv;
 
 	perclk_rate = clk_get_rate(fsl_lpspi->clk_per);
+	prescale_max = fsl_lpspi->devtype_data->prescale_max;
 
 	if (!config.speed_hz) {
 		dev_err(fsl_lpspi->dev,
@@ -313,15 +335,17 @@
 		return -EINVAL;
 	}
 
-	for (prescale = 0; prescale < 8; prescale++) {
-		scldiv = perclk_rate / config.speed_hz / (1 << prescale) - 2;
-		if (scldiv < 256) {
+	div = DIV_ROUND_UP(perclk_rate, config.speed_hz);
+
+	for (prescale = 0; prescale <= prescale_max; prescale++) {
+		scldiv = div / (1 << prescale) - 2;
+		if (scldiv >= 0 && scldiv < 256) {
 			fsl_lpspi->config.prescale = prescale;
 			break;
 		}
 	}
 
-	if (scldiv >= 256)
+	if (scldiv < 0 || scldiv >= 256)
 		return -EINVAL;
 
 	writel(scldiv | (scldiv << 8) | ((scldiv >> 1) << 16),
@@ -820,6 +844,7 @@
 
 static int fsl_lpspi_probe(struct platform_device *pdev)
 {
+	const struct fsl_lpspi_devtype_data *devtype_data;
 	struct fsl_lpspi_data *fsl_lpspi;
 	struct spi_controller *controller;
 	struct resource *res;
@@ -828,13 +853,17 @@
 	u32 temp;
 	bool is_target;
 
+	devtype_data = of_device_get_match_data(&pdev->dev);
+	if (!devtype_data)
+		return -ENODEV;
+
 	is_target = of_property_read_bool((&pdev->dev)->of_node, "spi-slave");
 	if (is_target)
-		controller = spi_alloc_target(&pdev->dev,
-					      sizeof(struct fsl_lpspi_data));
+		controller = devm_spi_alloc_target(&pdev->dev,
+						   sizeof(struct fsl_lpspi_data));
 	else
-		controller = spi_alloc_host(&pdev->dev,
-					    sizeof(struct fsl_lpspi_data));
+		controller = devm_spi_alloc_host(&pdev->dev,
+						 sizeof(struct fsl_lpspi_data));
 
 	if (!controller)
 		return -ENOMEM;
@@ -846,45 +875,46 @@
 	fsl_lpspi->is_target = is_target;
 	fsl_lpspi->is_only_cs1 = of_property_read_bool((&pdev->dev)->of_node,
 						"fsl,spi-only-use-cs1-sel");
+	fsl_lpspi->devtype_data = devtype_data;
 
 	init_completion(&fsl_lpspi->xfer_done);
 
 	fsl_lpspi->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
 	if (IS_ERR(fsl_lpspi->base)) {
 		ret = PTR_ERR(fsl_lpspi->base);
-		goto out_controller_put;
+		return ret;
 	}
 	fsl_lpspi->base_phys = res->start;
 
 	irq = platform_get_irq(pdev, 0);
 	if (irq < 0) {
 		ret = irq;
-		goto out_controller_put;
+		return ret;
 	}
 
-	ret = devm_request_irq(&pdev->dev, irq, fsl_lpspi_isr, 0,
+	ret = devm_request_irq(&pdev->dev, irq, fsl_lpspi_isr, IRQF_NO_AUTOEN,
 			       dev_name(&pdev->dev), fsl_lpspi);
 	if (ret) {
 		dev_err(&pdev->dev, "can't get irq%d: %d\n", irq, ret);
-		goto out_controller_put;
+		return ret;
 	}
 
 	fsl_lpspi->clk_per = devm_clk_get(&pdev->dev, "per");
 	if (IS_ERR(fsl_lpspi->clk_per)) {
 		ret = PTR_ERR(fsl_lpspi->clk_per);
-		goto out_controller_put;
+		return ret;
 	}
 
 	fsl_lpspi->clk_ipg = devm_clk_get(&pdev->dev, "ipg");
 	if (IS_ERR(fsl_lpspi->clk_ipg)) {
 		ret = PTR_ERR(fsl_lpspi->clk_ipg);
-		goto out_controller_put;
+		return ret;
 	}
 
 	/* enable the clock */
 	ret = fsl_lpspi_init_rpm(fsl_lpspi);
 	if (ret)
-		goto out_controller_put;
+		return ret;
 
 	ret = pm_runtime_get_sync(fsl_lpspi->dev);
 	if (ret < 0) {
@@ -919,14 +949,10 @@
 	ret = fsl_lpspi_dma_init(&pdev->dev, fsl_lpspi, controller);
 	if (ret == -EPROBE_DEFER)
 		goto out_pm_get;
-	if (ret < 0)
+	if (ret < 0) {
 		dev_warn(&pdev->dev, "dma setup error %d, use pio\n", ret);
-	else
-		/*
-		 * disable LPSPI module IRQ when enable DMA mode successfully,
-		 * to prevent the unexpected LPSPI module IRQ events.
-		 */
-		disable_irq(irq);
+		enable_irq(irq);
+	}
 
 	ret = devm_spi_register_controller(&pdev->dev, controller);
 	if (ret < 0) {
@@ -945,8 +971,6 @@
 	pm_runtime_dont_use_autosuspend(fsl_lpspi->dev);
 	pm_runtime_put_sync(fsl_lpspi->dev);
 	pm_runtime_disable(fsl_lpspi->dev);
-out_controller_put:
-	spi_controller_put(controller);
 
 	return ret;
 }
@@ -959,6 +983,7 @@
 
 	fsl_lpspi_dma_exit(controller);
 
+	pm_runtime_dont_use_autosuspend(fsl_lpspi->dev);
 	pm_runtime_disable(fsl_lpspi->dev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/spi/spi-geni-qcom.c
+++ linux-qcom-6.8.0/drivers/spi/spi-geni-qcom.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2017-2018, The Linux foundation. All rights reserved.
+// Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/clk.h>
 #include <linux/dmaengine.h>
@@ -75,6 +76,23 @@
 #define GSI_CPHA		BIT(4)
 #define GSI_CPOL		BIT(5)
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/qup_buses_trace.h>
+
+void spi_trace_log(struct device *dev, const char *fmt, ...)
+{
+	struct va_format vaf = {
+		.fmt = fmt,
+	};
+
+	va_list args;
+
+	va_start(args, fmt);
+	vaf.va = &args;
+	trace_buses_log_info(dev_name(dev), &vaf);
+	va_end(args);
+}
+
 struct spi_geni_master {
 	struct geni_se se;
 	struct device *dev;
@@ -134,8 +152,8 @@
 	*clk_div = DIV_ROUND_UP(sclk_freq, mas->oversampling * speed_hz);
 	actual_hz = sclk_freq / (mas->oversampling * *clk_div);
 
-	dev_dbg(mas->dev, "req %u=>%u sclk %lu, idx %d, div %d\n", speed_hz,
-				actual_hz, sclk_freq, *clk_idx, *clk_div);
+	spi_trace_log(mas->dev, "req %u=>%u sclk %lu, idx %d, div %d\n", speed_hz,
+		      actual_hz, sclk_freq, *clk_idx, *clk_div);
 	ret = dev_pm_opp_set_rate(mas->dev, sclk_freq);
 	if (ret)
 		dev_err(mas->dev, "dev_pm_opp_set_rate failed %d\n", ret);
@@ -353,6 +371,8 @@
 								true, true);
 	word_len = (bits_per_word - MIN_WORD_LEN) & WORD_LEN_MSK;
 	writel(word_len, se->base + SE_SPI_WORD_LEN);
+	spi_trace_log(mas->dev, "%s: bits_per_word: %d, pack_words: %d, word_len: %d",
+		      __func__, bits_per_word, pack_words, word_len);
 }
 
 static int geni_spi_set_clock_and_bw(struct spi_geni_master *mas,
@@ -428,6 +448,9 @@
 		mas->last_mode = spi_slv->mode;
 	}
 
+	spi_trace_log(mas->dev,
+		      "%s: loopback_cfg: %d, demux_sel: %d, cpha: %d, cpol: %d demux_output_inv: %d\n",
+		      __func__, loopback_cfg, demux_sel, cpha, cpol, demux_output_inv);
 	return geni_spi_set_clock_and_bw(mas, spi_slv->max_speed_hz);
 }
 
@@ -445,7 +468,7 @@
 
 	if (!result->residue) {
 		spi->cur_msg->status = 0;
-		dev_dbg(&spi->dev, "DMA txn completed\n");
+		spi_trace_log(&spi->dev, "DMA txn completed\n");
 	} else {
 		dev_err(&spi->dev, "DMA xfer has pending: %d\n", result->residue);
 	}
@@ -472,11 +495,20 @@
 		mas->cur_speed_hz = xfer->speed_hz;
 	}
 
+	/*
+	 * Setting QCOM_GPI_IMMEDIATE_DMA flag for SPI transfer with data
+	 * up to 8 bytes in length and so GPI DMA will make sure to
+	 * directly copy SPI transfers data into DMA TRE buffers.
+	 */
 	if (xfer->tx_buf && xfer->rx_buf) {
 		peripheral.cmd = SPI_DUPLEX;
+		if (xfer->len <= QCOM_GPI_IMMEDIATE_DMA_LEN)
+			peripheral.flags |= QCOM_GPI_IMMEDIATE_DMA;
 	} else if (xfer->tx_buf) {
 		peripheral.cmd = SPI_TX;
 		peripheral.rx_len = 0;
+		if (xfer->len <= QCOM_GPI_IMMEDIATE_DMA_LEN)
+			peripheral.flags |= QCOM_GPI_IMMEDIATE_DMA;
 	} else if (xfer->rx_buf) {
 		peripheral.cmd = SPI_RX;
 		if (!(mas->cur_bits_per_word % MIN_WORD_LEN)) {
@@ -604,6 +636,21 @@
 	return -EINVAL;
 }
 
+static void spi_geni_release_dma_chan(void *data)
+{
+	struct spi_geni_master *mas = data;
+
+	if (mas->rx) {
+		dma_release_channel(mas->rx);
+		mas->rx = NULL;
+	}
+
+	if (mas->tx) {
+		dma_release_channel(mas->tx);
+		mas->tx = NULL;
+	}
+}
+
 static int spi_geni_grab_gpi_chan(struct spi_geni_master *mas)
 {
 	int ret;
@@ -622,6 +669,12 @@
 		goto err_rx;
 	}
 
+	ret = devm_add_action_or_reset(mas->dev, spi_geni_release_dma_chan, mas);
+	if (ret) {
+		dev_err(mas->dev, "Unable to add action.\n");
+		return ret;
+	}
+
 	return 0;
 
 err_rx:
@@ -632,22 +685,9 @@
 	return ret;
 }
 
-static void spi_geni_release_dma_chan(struct spi_geni_master *mas)
-{
-	if (mas->rx) {
-		dma_release_channel(mas->rx);
-		mas->rx = NULL;
-	}
-
-	if (mas->tx) {
-		dma_release_channel(mas->tx);
-		mas->tx = NULL;
-	}
-}
-
 static int spi_geni_init(struct spi_geni_master *mas)
 {
-	struct spi_master *spi = dev_get_drvdata(mas->dev);
+	struct spi_controller *spi = dev_get_drvdata(mas->dev);
 	struct geni_se *se = &mas->se;
 	unsigned int proto, major, minor, ver;
 	u32 spi_tx_cfg, fifo_disable;
@@ -664,8 +704,11 @@
 		}
 		spi_slv_setup(mas);
 	} else if (proto != GENI_SE_SPI) {
-		dev_err(mas->dev, "Invalid proto %d\n", proto);
-		goto out_pm;
+		ret = geni_load_se_firmware(se, GENI_SE_SPI);
+		if (ret) {
+			dev_err(mas->dev, "Cannot load firmware from linux error: %d\n", ret);
+			goto out_pm;
+		}
 	}
 	mas->tx_fifo_depth = geni_se_get_tx_fifo_depth(se);
 
@@ -695,7 +738,7 @@
 		if (!ret) { /* success case */
 			mas->cur_xfer_mode = GENI_GPI_DMA;
 			geni_se_select_mode(se, GENI_GPI_DMA);
-			dev_dbg(mas->dev, "Using GPI DMA mode for SPI\n");
+			spi_trace_log(mas->dev, "Using GPI DMA mode for SPI\n");
 			break;
 		} else if (ret == -EPROBE_DEFER) {
 			goto out_pm;
@@ -1108,27 +1151,31 @@
 	init_completion(&mas->tx_reset_done);
 	init_completion(&mas->rx_reset_done);
 	spin_lock_init(&mas->lock);
+
+	ret = geni_icc_get(&mas->se, NULL);
+	if (ret)
+		return ret;
+
 	pm_runtime_use_autosuspend(&pdev->dev);
 	pm_runtime_set_autosuspend_delay(&pdev->dev, 250);
-	pm_runtime_enable(dev);
+	ret = devm_pm_runtime_enable(dev);
+	if (ret)
+		return ret;
 
 	if (device_property_read_bool(&pdev->dev, "spi-slave"))
 		spi->target = true;
 
-	ret = geni_icc_get(&mas->se, NULL);
-	if (ret)
-		goto spi_geni_probe_runtime_disable;
 	/* Set the bus quota to a reasonable value for register access */
 	mas->se.icc_paths[GENI_TO_CORE].avg_bw = Bps_to_icc(CORE_2X_50_MHZ);
 	mas->se.icc_paths[CPU_TO_GENI].avg_bw = GENI_DEFAULT_BW;
 
 	ret = geni_icc_set_bw(&mas->se);
 	if (ret)
-		goto spi_geni_probe_runtime_disable;
+		return ret;
 
 	ret = spi_geni_init(mas);
 	if (ret)
-		goto spi_geni_probe_runtime_disable;
+		return ret;
 
 	/*
 	 * check the mode supported and set_cs for fifo mode only
@@ -1144,36 +1191,11 @@
 	if (mas->cur_xfer_mode == GENI_GPI_DMA)
 		spi->flags = SPI_CONTROLLER_MUST_TX;
 
-	ret = request_irq(mas->irq, geni_spi_isr, 0, dev_name(dev), spi);
-	if (ret)
-		goto spi_geni_release_dma;
-
-	ret = spi_register_controller(spi);
+	ret = devm_request_irq(dev, mas->irq, geni_spi_isr, 0, dev_name(dev), spi);
 	if (ret)
-		goto spi_geni_probe_free_irq;
-
-	return 0;
-spi_geni_probe_free_irq:
-	free_irq(mas->irq, spi);
-spi_geni_release_dma:
-	spi_geni_release_dma_chan(mas);
-spi_geni_probe_runtime_disable:
-	pm_runtime_disable(dev);
-	return ret;
-}
-
-static void spi_geni_remove(struct platform_device *pdev)
-{
-	struct spi_controller *spi = platform_get_drvdata(pdev);
-	struct spi_geni_master *mas = spi_controller_get_devdata(spi);
-
-	/* Unregister _before_ disabling pm_runtime() so we stop transfers */
-	spi_unregister_controller(spi);
-
-	spi_geni_release_dma_chan(mas);
+		return ret;
 
-	free_irq(mas->irq, spi);
-	pm_runtime_disable(&pdev->dev);
+	return devm_spi_register_controller(dev, spi);
 }
 
 static int __maybe_unused spi_geni_runtime_suspend(struct device *dev)
@@ -1182,6 +1204,7 @@
 	struct spi_geni_master *mas = spi_controller_get_devdata(spi);
 	int ret;
 
+	trace_spi_info(mas->dev, __func__, "start");
 	/* Drop the performance state vote */
 	dev_pm_opp_set_rate(dev, 0);
 
@@ -1198,6 +1221,7 @@
 	struct spi_geni_master *mas = spi_controller_get_devdata(spi);
 	int ret;
 
+	trace_spi_info(mas->dev, __func__, "start");
 	ret = geni_icc_enable(&mas->se);
 	if (ret)
 		return ret;
@@ -1214,6 +1238,7 @@
 	struct spi_controller *spi = dev_get_drvdata(dev);
 	int ret;
 
+	trace_spi_info(dev, __func__, "start");
 	ret = spi_controller_suspend(spi);
 	if (ret)
 		return ret;
@@ -1230,6 +1255,7 @@
 	struct spi_controller *spi = dev_get_drvdata(dev);
 	int ret;
 
+	trace_spi_info(dev, __func__, "start");
 	ret = pm_runtime_force_resume(dev);
 	if (ret)
 		return ret;
@@ -1255,7 +1281,6 @@
 
 static struct platform_driver spi_geni_driver = {
 	.probe  = spi_geni_probe,
-	.remove_new = spi_geni_remove,
 	.driver = {
 		.name = "geni_spi",
 		.pm = &spi_geni_pm_ops,
--- linux-qcom-6.8.0.orig/drivers/spi/spi-hisi-kunpeng.c
+++ linux-qcom-6.8.0/drivers/spi/spi-hisi-kunpeng.c
@@ -151,8 +151,6 @@
 	HISI_SPI_DBGFS_REG("ENR", HISI_SPI_ENR),
 	HISI_SPI_DBGFS_REG("FIFOC", HISI_SPI_FIFOC),
 	HISI_SPI_DBGFS_REG("IMR", HISI_SPI_IMR),
-	HISI_SPI_DBGFS_REG("DIN", HISI_SPI_DIN),
-	HISI_SPI_DBGFS_REG("DOUT", HISI_SPI_DOUT),
 	HISI_SPI_DBGFS_REG("SR", HISI_SPI_SR),
 	HISI_SPI_DBGFS_REG("RISR", HISI_SPI_RISR),
 	HISI_SPI_DBGFS_REG("ISR", HISI_SPI_ISR),
@@ -483,6 +481,9 @@
 		return -EINVAL;
 	}
 
+	if (host->max_speed_hz == 0)
+		return dev_err_probe(dev, -EINVAL, "spi-max-frequency can't be 0\n");
+
 	ret = device_property_read_u16(dev, "num-cs",
 					&host->num_chipselect);
 	if (ret)
@@ -497,6 +498,7 @@
 	host->transfer_one = hisi_spi_transfer_one;
 	host->handle_err = hisi_spi_handle_err;
 	host->dev.fwnode = dev->fwnode;
+	host->min_speed_hz = DIV_ROUND_UP(host->max_speed_hz, CLK_DIV_MAX);
 
 	hisi_spi_hw_init(hs);
 
--- linux-qcom-6.8.0.orig/drivers/spi/spi-imx.c
+++ linux-qcom-6.8.0/drivers/spi/spi-imx.c
@@ -660,18 +660,8 @@
 		ctrl |= (spi_imx->target_burst * 8 - 1)
 			<< MX51_ECSPI_CTRL_BL_OFFSET;
 	else {
-		if (spi_imx->usedma) {
-			ctrl |= (spi_imx->bits_per_word - 1)
-				<< MX51_ECSPI_CTRL_BL_OFFSET;
-		} else {
-			if (spi_imx->count >= MX51_ECSPI_CTRL_MAX_BURST)
-				ctrl |= (MX51_ECSPI_CTRL_MAX_BURST * BITS_PER_BYTE - 1)
-						<< MX51_ECSPI_CTRL_BL_OFFSET;
-			else
-				ctrl |= spi_imx->count / DIV_ROUND_UP(spi_imx->bits_per_word,
-						BITS_PER_BYTE) * spi_imx->bits_per_word
-						<< MX51_ECSPI_CTRL_BL_OFFSET;
-		}
+		ctrl |= (spi_imx->bits_per_word - 1)
+			<< MX51_ECSPI_CTRL_BL_OFFSET;
 	}
 
 	/* set clock speed */
@@ -1060,7 +1050,7 @@
 	.rx_available = mx31_rx_available,
 	.reset = mx31_reset,
 	.fifo_size = 8,
-	.has_dmamode = true,
+	.has_dmamode = false,
 	.dynamic_burst = false,
 	.has_targetmode = false,
 	.devtype = IMX35_CSPI,
@@ -1880,8 +1870,8 @@
 		spi_imx_sdma_exit(spi_imx);
 out_runtime_pm_put:
 	pm_runtime_dont_use_autosuspend(spi_imx->dev);
-	pm_runtime_set_suspended(&pdev->dev);
 	pm_runtime_disable(spi_imx->dev);
+	pm_runtime_set_suspended(&pdev->dev);
 
 	clk_disable_unprepare(spi_imx->clk_ipg);
 out_put_per:
--- linux-qcom-6.8.0.orig/drivers/spi/spi-intel-pci.c
+++ linux-qcom-6.8.0/drivers/spi/spi-intel-pci.c
@@ -86,6 +86,8 @@
 	{ PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info },
 	{ PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info },
 	{ PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0xe323), (unsigned long)&cnl_info },
+	{ PCI_VDEVICE(INTEL, 0xe423), (unsigned long)&cnl_info },
 	{ },
 };
 MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids);
--- linux-qcom-6.8.0.orig/drivers/spi/spi-mem.c
+++ linux-qcom-6.8.0/drivers/spi/spi-mem.c
@@ -297,6 +297,49 @@
 		pm_runtime_put(ctlr->dev.parent);
 }
 
+static void spi_mem_add_op_stats(struct spi_statistics __percpu *pcpu_stats,
+				 const struct spi_mem_op *op, int exec_op_ret)
+{
+	struct spi_statistics *stats;
+	u64 len, l2len;
+
+	get_cpu();
+	stats = this_cpu_ptr(pcpu_stats);
+	u64_stats_update_begin(&stats->syncp);
+
+	/*
+	 * We do not have the concept of messages or transfers. Let's consider
+	 * that one operation is equivalent to one message and one transfer.
+	 */
+	u64_stats_inc(&stats->messages);
+	u64_stats_inc(&stats->transfers);
+
+	/* Use the sum of all lengths as bytes count and histogram value. */
+	len = op->cmd.nbytes + op->addr.nbytes;
+	len += op->dummy.nbytes + op->data.nbytes;
+	u64_stats_add(&stats->bytes, len);
+	l2len = min(fls(len), SPI_STATISTICS_HISTO_SIZE) - 1;
+	u64_stats_inc(&stats->transfer_bytes_histo[l2len]);
+
+	/* Only account for data bytes as transferred bytes. */
+	if (op->data.nbytes && op->data.dir == SPI_MEM_DATA_OUT)
+		u64_stats_add(&stats->bytes_tx, op->data.nbytes);
+	if (op->data.nbytes && op->data.dir == SPI_MEM_DATA_IN)
+		u64_stats_add(&stats->bytes_rx, op->data.nbytes);
+
+	/*
+	 * A timeout is not an error, following the same behavior as
+	 * spi_transfer_one_message().
+	 */
+	if (exec_op_ret == -ETIMEDOUT)
+		u64_stats_inc(&stats->timedout);
+	else if (exec_op_ret)
+		u64_stats_inc(&stats->errors);
+
+	u64_stats_update_end(&stats->syncp);
+	put_cpu();
+}
+
 /**
  * spi_mem_exec_op() - Execute a memory operation
  * @mem: the SPI memory
@@ -339,8 +382,12 @@
 		 * read path) and expect the core to use the regular SPI
 		 * interface in other cases.
 		 */
-		if (!ret || ret != -ENOTSUPP || ret != -EOPNOTSUPP)
+		if (!ret || (ret != -ENOTSUPP && ret != -EOPNOTSUPP)) {
+			spi_mem_add_op_stats(ctlr->pcpu_statistics, op, ret);
+			spi_mem_add_op_stats(mem->spi->pcpu_statistics, op, ret);
+
 			return ret;
+		}
 	}
 
 	tmpbufsize = op->cmd.nbytes + op->addr.nbytes + op->dummy.nbytes;
--- linux-qcom-6.8.0.orig/drivers/spi/spi-microchip-core-qspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-microchip-core-qspi.c
@@ -283,6 +283,7 @@
 	}
 
 	control = readl_relaxed(qspi->regs + REG_CONTROL);
+	control &= ~CONTROL_CLKRATE_MASK;
 	control |= baud_rate_val << CONTROL_CLKRATE_SHIFT;
 	writel_relaxed(control, qspi->regs + REG_CONTROL);
 	control = readl_relaxed(qspi->regs + REG_CONTROL);
--- linux-qcom-6.8.0.orig/drivers/spi/spi-microchip-core.c
+++ linux-qcom-6.8.0/drivers/spi/spi-microchip-core.c
@@ -21,7 +21,7 @@
 #include <linux/spi/spi.h>
 
 #define MAX_LEN				(0xffff)
-#define MAX_CS				(8)
+#define MAX_CS				(1)
 #define DEFAULT_FRAMESIZE		(8)
 #define FIFO_DEPTH			(32)
 #define CLK_GEN_MODE1_MAX		(255)
@@ -75,6 +75,7 @@
 
 #define REG_CONTROL		(0x00)
 #define REG_FRAME_SIZE		(0x04)
+#define  FRAME_SIZE_MASK	GENMASK(5, 0)
 #define REG_STATUS		(0x08)
 #define REG_INT_CLEAR		(0x0c)
 #define REG_RX_DATA		(0x10)
@@ -89,6 +90,9 @@
 #define REG_RIS			(0x24)
 #define REG_CONTROL2		(0x28)
 #define REG_COMMAND		(0x2c)
+#define  COMMAND_CLRFRAMECNT	BIT(4)
+#define  COMMAND_TXFIFORST		BIT(3)
+#define  COMMAND_RXFIFORST		BIT(2)
 #define REG_PKTSIZE		(0x30)
 #define REG_CMD_SIZE		(0x34)
 #define REG_HWSTATUS		(0x38)
@@ -103,6 +107,7 @@
 	u8 *rx_buf;
 	u32 clk_gen; /* divider for spi output clock generated by the controller */
 	u32 clk_mode;
+	u32 pending_slave_select;
 	int irq;
 	int tx_len;
 	int rx_len;
@@ -148,62 +153,59 @@
 
 static void mchp_corespi_enable_ints(struct mchp_corespi *spi)
 {
-	u32 control, mask = INT_ENABLE_MASK;
-
-	mchp_corespi_disable(spi);
-
-	control = mchp_corespi_read(spi, REG_CONTROL);
-
-	control |= mask;
-	mchp_corespi_write(spi, REG_CONTROL, control);
+	u32 control = mchp_corespi_read(spi, REG_CONTROL);
 
-	control |= CONTROL_ENABLE;
+	control |= INT_ENABLE_MASK;
 	mchp_corespi_write(spi, REG_CONTROL, control);
 }
 
 static void mchp_corespi_disable_ints(struct mchp_corespi *spi)
 {
-	u32 control, mask = INT_ENABLE_MASK;
-
-	mchp_corespi_disable(spi);
-
-	control = mchp_corespi_read(spi, REG_CONTROL);
-	control &= ~mask;
-	mchp_corespi_write(spi, REG_CONTROL, control);
+	u32 control = mchp_corespi_read(spi, REG_CONTROL);
 
-	control |= CONTROL_ENABLE;
+	control &= ~INT_ENABLE_MASK;
 	mchp_corespi_write(spi, REG_CONTROL, control);
 }
 
 static inline void mchp_corespi_set_xfer_size(struct mchp_corespi *spi, int len)
 {
 	u32 control;
-	u16 lenpart;
+	u32 lenpart;
+	u32 frames = mchp_corespi_read(spi, REG_FRAMESUP);
 
 	/*
-	 * Disable the SPI controller. Writes to transfer length have
-	 * no effect when the controller is enabled.
+	 * Writing to FRAMECNT in REG_CONTROL will reset the frame count, taking
+	 * a shortcut requires an explicit clear.
 	 */
-	mchp_corespi_disable(spi);
+	if (frames == len) {
+		mchp_corespi_write(spi, REG_COMMAND, COMMAND_CLRFRAMECNT);
+		return;
+	}
 
 	/*
 	 * The lower 16 bits of the frame count are stored in the control reg
 	 * for legacy reasons, but the upper 16 written to a different register:
 	 * FRAMESUP. While both the upper and lower bits can be *READ* from the
-	 * FRAMESUP register, writing to the lower 16 bits is a NOP
+	 * FRAMESUP register, writing to the lower 16 bits is (supposedly) a NOP.
+	 *
+	 * The driver used to disable the controller while modifying the frame
+	 * count, and mask off the lower 16 bits of len while writing to
+	 * FRAMES_UP. When the driver was changed to disable the controller as
+	 * infrequently as possible, it was discovered that the logic of
+	 * lenpart = len & 0xffff_0000
+	 * write(REG_FRAMESUP, lenpart)
+	 * would actually write zeros into the lower 16 bits on an mpfs250t-es,
+	 * despite documentation stating these bits were read-only.
+	 * Writing len unmasked into FRAMES_UP ensures those bits aren't zeroed
+	 * on an mpfs250t-es and will be a NOP for the lower 16 bits on hardware
+	 * that matches the documentation.
 	 */
 	lenpart = len & 0xffff;
-
 	control = mchp_corespi_read(spi, REG_CONTROL);
 	control &= ~CONTROL_FRAMECNT_MASK;
 	control |= lenpart << CONTROL_FRAMECNT_SHIFT;
 	mchp_corespi_write(spi, REG_CONTROL, control);
-
-	lenpart = len & 0xffff0000;
-	mchp_corespi_write(spi, REG_FRAMESUP, lenpart);
-
-	control |= CONTROL_ENABLE;
-	mchp_corespi_write(spi, REG_CONTROL, control);
+	mchp_corespi_write(spi, REG_FRAMESUP, len);
 }
 
 static inline void mchp_corespi_write_fifo(struct mchp_corespi *spi)
@@ -226,17 +228,22 @@
 
 static inline void mchp_corespi_set_framesize(struct mchp_corespi *spi, int bt)
 {
+	u32 frame_size = mchp_corespi_read(spi, REG_FRAME_SIZE);
 	u32 control;
 
+	if ((frame_size & FRAME_SIZE_MASK) == bt)
+		return;
+
 	/*
 	 * Disable the SPI controller. Writes to the frame size have
 	 * no effect when the controller is enabled.
 	 */
-	mchp_corespi_disable(spi);
+	control = mchp_corespi_read(spi, REG_CONTROL);
+	control &= ~CONTROL_ENABLE;
+	mchp_corespi_write(spi, REG_CONTROL, control);
 
 	mchp_corespi_write(spi, REG_FRAME_SIZE, bt);
 
-	control = mchp_corespi_read(spi, REG_CONTROL);
 	control |= CONTROL_ENABLE;
 	mchp_corespi_write(spi, REG_CONTROL, control);
 }
@@ -249,8 +256,18 @@
 	reg = mchp_corespi_read(corespi, REG_SLAVE_SELECT);
 	reg &= ~BIT(spi_get_chipselect(spi, 0));
 	reg |= !disable << spi_get_chipselect(spi, 0);
+	corespi->pending_slave_select = reg;
 
-	mchp_corespi_write(corespi, REG_SLAVE_SELECT, reg);
+	/*
+	 * Only deassert chip select immediately. Writing to some registers
+	 * requires the controller to be disabled, which results in the
+	 * output pins being tristated and can cause the SCLK and MOSI lines
+	 * to transition. Therefore asserting the chip select is deferred
+	 * until just before writing to the TX FIFO, to ensure the device
+	 * doesn't see any spurious clock transitions whilst CS is enabled.
+	 */
+	if (((spi->mode & SPI_CS_HIGH) == 0) == disable)
+		mchp_corespi_write(corespi, REG_SLAVE_SELECT, reg);
 }
 
 static int mchp_corespi_setup(struct spi_device *spi)
@@ -266,6 +283,7 @@
 	if (spi->mode & SPI_CS_HIGH) {
 		reg = mchp_corespi_read(corespi, REG_SLAVE_SELECT);
 		reg |= BIT(spi_get_chipselect(spi, 0));
+		corespi->pending_slave_select = reg;
 		mchp_corespi_write(corespi, REG_SLAVE_SELECT, reg);
 	}
 	return 0;
@@ -276,17 +294,13 @@
 	unsigned long clk_hz;
 	u32 control = mchp_corespi_read(spi, REG_CONTROL);
 
-	control |= CONTROL_MASTER;
+	control &= ~CONTROL_ENABLE;
+	mchp_corespi_write(spi, REG_CONTROL, control);
 
+	control |= CONTROL_MASTER;
 	control &= ~CONTROL_MODE_MASK;
 	control |= MOTOROLA_MODE;
 
-	mchp_corespi_set_framesize(spi, DEFAULT_FRAMESIZE);
-
-	/* max. possible spi clock rate is the apb clock rate */
-	clk_hz = clk_get_rate(spi->clk);
-	host->max_speed_hz = clk_hz;
-
 	/*
 	 * The controller must be configured so that it doesn't remove Chip
 	 * Select until the entire message has been transferred, even if at
@@ -295,11 +309,16 @@
 	 * BIGFIFO mode is also enabled, which sets the fifo depth to 32 frames
 	 * for the 8 bit transfers that this driver uses.
 	 */
-	control = mchp_corespi_read(spi, REG_CONTROL);
 	control |= CONTROL_SPS | CONTROL_BIGFIFO;
 
 	mchp_corespi_write(spi, REG_CONTROL, control);
 
+	mchp_corespi_set_framesize(spi, DEFAULT_FRAMESIZE);
+
+	/* max. possible spi clock rate is the apb clock rate */
+	clk_hz = clk_get_rate(spi->clk);
+	host->max_speed_hz = clk_hz;
+
 	mchp_corespi_enable_ints(spi);
 
 	/*
@@ -307,7 +326,8 @@
 	 * select is relinquished to the hardware. SSELOUT is enabled too so we
 	 * can deal with active high targets.
 	 */
-	mchp_corespi_write(spi, REG_SLAVE_SELECT, SSELOUT | SSEL_DIRECT);
+	spi->pending_slave_select = SSELOUT | SSEL_DIRECT;
+	mchp_corespi_write(spi, REG_SLAVE_SELECT, spi->pending_slave_select);
 
 	control = mchp_corespi_read(spi, REG_CONTROL);
 
@@ -321,8 +341,6 @@
 {
 	u32 control;
 
-	mchp_corespi_disable(spi);
-
 	control = mchp_corespi_read(spi, REG_CONTROL);
 	if (spi->clk_mode)
 		control |= CONTROL_CLKMODE;
@@ -331,12 +349,12 @@
 
 	mchp_corespi_write(spi, REG_CLK_GEN, spi->clk_gen);
 	mchp_corespi_write(spi, REG_CONTROL, control);
-	mchp_corespi_write(spi, REG_CONTROL, control | CONTROL_ENABLE);
 }
 
 static inline void mchp_corespi_set_mode(struct mchp_corespi *spi, unsigned int mode)
 {
-	u32 control, mode_val;
+	u32 mode_val;
+	u32 control = mchp_corespi_read(spi, REG_CONTROL);
 
 	switch (mode & SPI_MODE_X_MASK) {
 	case SPI_MODE_0:
@@ -354,12 +372,13 @@
 	}
 
 	/*
-	 * Disable the SPI controller. Writes to the frame size have
+	 * Disable the SPI controller. Writes to the frame protocol have
 	 * no effect when the controller is enabled.
 	 */
-	mchp_corespi_disable(spi);
 
-	control = mchp_corespi_read(spi, REG_CONTROL);
+	control &= ~CONTROL_ENABLE;
+	mchp_corespi_write(spi, REG_CONTROL, control);
+
 	control &= ~(SPI_MODE_X_MASK << MODE_X_MASK_SHIFT);
 	control |= mode_val;
 
@@ -380,21 +399,18 @@
 	if (intfield == 0)
 		return IRQ_NONE;
 
-	if (intfield & INT_TXDONE) {
+	if (intfield & INT_TXDONE)
 		mchp_corespi_write(spi, REG_INT_CLEAR, INT_TXDONE);
 
+	if (intfield & INT_RXRDY) {
+		mchp_corespi_write(spi, REG_INT_CLEAR, INT_RXRDY);
+
 		if (spi->rx_len)
 			mchp_corespi_read_fifo(spi);
-
-		if (spi->tx_len)
-			mchp_corespi_write_fifo(spi);
-
-		if (!spi->rx_len)
-			finalise = true;
 	}
 
-	if (intfield & INT_RXRDY)
-		mchp_corespi_write(spi, REG_INT_CLEAR, INT_RXRDY);
+	if (!spi->rx_len && !spi->tx_len)
+		finalise = true;
 
 	if (intfield & INT_RX_CHANNEL_OVERFLOW) {
 		mchp_corespi_write(spi, REG_INT_CLEAR, INT_RX_CHANNEL_OVERFLOW);
@@ -479,8 +495,13 @@
 	mchp_corespi_set_xfer_size(spi, (spi->tx_len > FIFO_DEPTH)
 				   ? FIFO_DEPTH : spi->tx_len);
 
-	if (spi->tx_len)
+	mchp_corespi_write(spi, REG_COMMAND, COMMAND_RXFIFORST | COMMAND_TXFIFORST);
+
+	mchp_corespi_write(spi, REG_SLAVE_SELECT, spi->pending_slave_select);
+
+	while (spi->tx_len)
 		mchp_corespi_write_fifo(spi);
+
 	return 1;
 }
 
--- linux-qcom-6.8.0.orig/drivers/spi/spi-mpc52xx.c
+++ linux-qcom-6.8.0/drivers/spi/spi-mpc52xx.c
@@ -520,6 +520,7 @@
 	struct mpc52xx_spi *ms = spi_controller_get_devdata(host);
 	int i;
 
+	cancel_work_sync(&ms->work);
 	free_irq(ms->irq0, ms);
 	free_irq(ms->irq1, ms);
 
--- linux-qcom-6.8.0.orig/drivers/spi/spi-mt65xx.c
+++ linux-qcom-6.8.0/drivers/spi/spi-mt65xx.c
@@ -787,17 +787,19 @@
 		mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len);
 		mtk_spi_setup_packet(host);
 
-		cnt = mdata->xfer_len / 4;
-		iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
-				trans->tx_buf + mdata->num_xfered, cnt);
+		if (trans->tx_buf) {
+			cnt = mdata->xfer_len / 4;
+			iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
+					trans->tx_buf + mdata->num_xfered, cnt);
 
-		remainder = mdata->xfer_len % 4;
-		if (remainder > 0) {
-			reg_val = 0;
-			memcpy(&reg_val,
-				trans->tx_buf + (cnt * 4) + mdata->num_xfered,
-				remainder);
-			writel(reg_val, mdata->base + SPI_TX_DATA_REG);
+			remainder = mdata->xfer_len % 4;
+			if (remainder > 0) {
+				reg_val = 0;
+				memcpy(&reg_val,
+					trans->tx_buf + (cnt * 4) + mdata->num_xfered,
+					remainder);
+				writel(reg_val, mdata->base + SPI_TX_DATA_REG);
+			}
 		}
 
 		mtk_spi_enable_transfer(host);
--- linux-qcom-6.8.0.orig/drivers/spi/spi-mux.c
+++ linux-qcom-6.8.0/drivers/spi/spi-mux.c
@@ -156,6 +156,7 @@
 	/* supported modes are the same as our parent's */
 	ctlr->mode_bits = spi->controller->mode_bits;
 	ctlr->flags = spi->controller->flags;
+	ctlr->bits_per_word_mask = spi->controller->bits_per_word_mask;
 	ctlr->transfer_one_message = spi_mux_transfer_one_message;
 	ctlr->setup = spi_mux_setup;
 	ctlr->num_chipselect = mux_control_states(priv->mux);
--- linux-qcom-6.8.0.orig/drivers/spi/spi-nxp-fspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-nxp-fspi.c
@@ -57,13 +57,6 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/spi-mem.h>
 
-/*
- * The driver only uses one single LUT entry, that is updated on
- * each call of exec_op(). Index 0 is preset at boot with a basic
- * read operation, so let's use the last entry (31).
- */
-#define	SEQID_LUT			31
-
 /* Registers used by the driver */
 #define FSPI_MCR0			0x00
 #define FSPI_MCR0_AHB_TIMEOUT(x)	((x) << 24)
@@ -263,9 +256,6 @@
 #define FSPI_TFDR			0x180
 
 #define FSPI_LUT_BASE			0x200
-#define FSPI_LUT_OFFSET			(SEQID_LUT * 4 * 4)
-#define FSPI_LUT_REG(idx) \
-	(FSPI_LUT_BASE + FSPI_LUT_OFFSET + (idx) * 4)
 
 /* register map end */
 
@@ -341,6 +331,7 @@
 	unsigned int txfifo;
 	unsigned int ahb_buf_size;
 	unsigned int quirks;
+	unsigned int lut_num;
 	bool little_endian;
 };
 
@@ -349,6 +340,7 @@
 	.txfifo = SZ_1K,        /* (128 * 64 bits)  */
 	.ahb_buf_size = SZ_2K,  /* (256 * 64 bits)  */
 	.quirks = 0,
+	.lut_num = 32,
 	.little_endian = true,  /* little-endian    */
 };
 
@@ -357,6 +349,7 @@
 	.txfifo = SZ_1K,        /* (128 * 64 bits)  */
 	.ahb_buf_size = SZ_2K,  /* (256 * 64 bits)  */
 	.quirks = 0,
+	.lut_num = 32,
 	.little_endian = true,  /* little-endian    */
 };
 
@@ -365,6 +358,7 @@
 	.txfifo = SZ_1K,        /* (128 * 64 bits)  */
 	.ahb_buf_size = SZ_2K,  /* (256 * 64 bits)  */
 	.quirks = 0,
+	.lut_num = 32,
 	.little_endian = true,  /* little-endian    */
 };
 
@@ -373,6 +367,16 @@
 	.txfifo = SZ_1K,        /* (128 * 64 bits)  */
 	.ahb_buf_size = SZ_2K,  /* (256 * 64 bits)  */
 	.quirks = FSPI_QUIRK_USE_IP_ONLY,
+	.lut_num = 32,
+	.little_endian = true,  /* little-endian    */
+};
+
+static struct nxp_fspi_devtype_data imx8ulp_data = {
+	.rxfifo = SZ_512,       /* (64  * 64 bits)  */
+	.txfifo = SZ_1K,        /* (128 * 64 bits)  */
+	.ahb_buf_size = SZ_2K,  /* (256 * 64 bits)  */
+	.quirks = 0,
+	.lut_num = 16,
 	.little_endian = true,  /* little-endian    */
 };
 
@@ -544,6 +548,8 @@
 	void __iomem *base = f->iobase;
 	u32 lutval[4] = {};
 	int lutidx = 1, i;
+	u32 lut_offset = (f->devtype_data->lut_num - 1) * 4 * 4;
+	u32 target_lut_reg;
 
 	/* cmd */
 	lutval[0] |= LUT_DEF(0, LUT_CMD, LUT_PAD(op->cmd.buswidth),
@@ -588,8 +594,10 @@
 	fspi_writel(f, FSPI_LCKER_UNLOCK, f->iobase + FSPI_LCKCR);
 
 	/* fill LUT */
-	for (i = 0; i < ARRAY_SIZE(lutval); i++)
-		fspi_writel(f, lutval[i], base + FSPI_LUT_REG(i));
+	for (i = 0; i < ARRAY_SIZE(lutval); i++) {
+		target_lut_reg = FSPI_LUT_BASE + lut_offset + i * 4;
+		fspi_writel(f, lutval[i], base + target_lut_reg);
+	}
 
 	dev_dbg(f->dev, "CMD[%x] lutval[0:%x \t 1:%x \t 2:%x \t 3:%x], size: 0x%08x\n",
 		op->cmd.opcode, lutval[0], lutval[1], lutval[2], lutval[3], op->data.nbytes);
@@ -805,14 +813,15 @@
 	if (i < op->data.nbytes) {
 		u32 data = 0;
 		int j;
+		int remaining = op->data.nbytes - i;
 		/* Wait for TXFIFO empty */
 		ret = fspi_readl_poll_tout(f, f->iobase + FSPI_INTR,
 					   FSPI_INTR_IPTXWE, 0,
 					   POLL_TOUT, true);
 		WARN_ON(ret);
 
-		for (j = 0; j < ALIGN(op->data.nbytes - i, 4); j += 4) {
-			memcpy(&data, buf + i + j, 4);
+		for (j = 0; j < ALIGN(remaining, 4); j += 4) {
+			memcpy(&data, buf + i + j, min_t(int, 4, remaining - j));
 			fspi_writel(f, data, base + FSPI_TFDR + j);
 		}
 		fspi_writel(f, FSPI_INTR_IPTXWE, base + FSPI_INTR);
@@ -875,7 +884,7 @@
 	void __iomem *base = f->iobase;
 	int seqnum = 0;
 	int err = 0;
-	u32 reg;
+	u32 reg, seqid_lut;
 
 	reg = fspi_readl(f, base + FSPI_IPRXFCR);
 	/* invalid RXFIFO first */
@@ -891,8 +900,9 @@
 	 * the LUT at each exec_op() call. And also specify the DATA
 	 * length, since it's has not been specified in the LUT.
 	 */
+	seqid_lut = f->devtype_data->lut_num - 1;
 	fspi_writel(f, op->data.nbytes |
-		 (SEQID_LUT << FSPI_IPCR1_SEQID_SHIFT) |
+		 (seqid_lut << FSPI_IPCR1_SEQID_SHIFT) |
 		 (seqnum << FSPI_IPCR1_SEQNUM_SHIFT),
 		 base + FSPI_IPCR1);
 
@@ -1016,7 +1026,7 @@
 {
 	void __iomem *base = f->iobase;
 	int ret, i;
-	u32 reg;
+	u32 reg, seqid_lut;
 
 	/* disable and unprepare clock to avoid glitch pass to controller */
 	nxp_fspi_clk_disable_unprep(f);
@@ -1091,11 +1101,17 @@
 	fspi_writel(f, reg, base + FSPI_FLSHB1CR1);
 	fspi_writel(f, reg, base + FSPI_FLSHB2CR1);
 
+	/*
+	 * The driver only uses one single LUT entry, that is updated on
+	 * each call of exec_op(). Index 0 is preset at boot with a basic
+	 * read operation, so let's use the last entry.
+	 */
+	seqid_lut = f->devtype_data->lut_num - 1;
 	/* AHB Read - Set lut sequence ID for all CS. */
-	fspi_writel(f, SEQID_LUT, base + FSPI_FLSHA1CR2);
-	fspi_writel(f, SEQID_LUT, base + FSPI_FLSHA2CR2);
-	fspi_writel(f, SEQID_LUT, base + FSPI_FLSHB1CR2);
-	fspi_writel(f, SEQID_LUT, base + FSPI_FLSHB2CR2);
+	fspi_writel(f, seqid_lut, base + FSPI_FLSHA1CR2);
+	fspi_writel(f, seqid_lut, base + FSPI_FLSHA2CR2);
+	fspi_writel(f, seqid_lut, base + FSPI_FLSHB1CR2);
+	fspi_writel(f, seqid_lut, base + FSPI_FLSHB2CR2);
 
 	f->selected = -1;
 
@@ -1290,6 +1306,7 @@
 	{ .compatible = "nxp,imx8mp-fspi", .data = (void *)&imx8mm_data, },
 	{ .compatible = "nxp,imx8qxp-fspi", .data = (void *)&imx8qxp_data, },
 	{ .compatible = "nxp,imx8dxl-fspi", .data = (void *)&imx8dxl_data, },
+	{ .compatible = "nxp,imx8ulp-fspi", .data = (void *)&imx8ulp_data, },
 	{ /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, nxp_fspi_dt_ids);
--- linux-qcom-6.8.0.orig/drivers/spi/spi-omap2-mcspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-omap2-mcspi.c
@@ -1521,10 +1521,10 @@
 	}
 
 	mcspi->ref_clk = devm_clk_get_optional_enabled(&pdev->dev, NULL);
-	if (mcspi->ref_clk)
-		mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk);
-	else
+	if (IS_ERR(mcspi->ref_clk))
 		mcspi->ref_clk_hz = OMAP2_MCSPI_MAX_FREQ;
+	else
+		mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk);
 	ctlr->max_speed_hz = mcspi->ref_clk_hz;
 	ctlr->min_speed_hz = mcspi->ref_clk_hz >> 15;
 
--- linux-qcom-6.8.0.orig/drivers/spi/spi-pci1xxxx.c
+++ linux-qcom-6.8.0/drivers/spi/spi-pci1xxxx.c
@@ -275,6 +275,8 @@
 		spi_bus->spi_int[iter] = devm_kzalloc(&pdev->dev,
 						      sizeof(struct pci1xxxx_spi_internal),
 						      GFP_KERNEL);
+		if (!spi_bus->spi_int[iter])
+			return -ENOMEM;
 		spi_sub_ptr = spi_bus->spi_int[iter];
 		spi_sub_ptr->spi_host = devm_spi_alloc_host(dev, sizeof(struct spi_controller));
 		if (!spi_sub_ptr->spi_host)
--- linux-qcom-6.8.0.orig/drivers/spi/spi-ppc4xx.c
+++ linux-qcom-6.8.0/drivers/spi/spi-ppc4xx.c
@@ -27,7 +27,6 @@
 #include <linux/wait.h>
 #include <linux/platform_device.h>
 #include <linux/of_address.h>
-#include <linux/of_irq.h>
 #include <linux/of_platform.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
@@ -412,7 +411,11 @@
 	}
 
 	/* Request IRQ */
-	hw->irqnum = irq_of_parse_and_map(np, 0);
+	ret = platform_get_irq(op, 0);
+	if (ret < 0)
+		goto free_host;
+	hw->irqnum = ret;
+
 	ret = request_irq(hw->irqnum, spi_ppc4xx_int,
 			  0, "spi_ppc4xx_of", (void *)hw);
 	if (ret) {
--- linux-qcom-6.8.0.orig/drivers/spi/spi-rockchip.c
+++ linux-qcom-6.8.0/drivers/spi/spi-rockchip.c
@@ -954,14 +954,16 @@
 {
 	int ret;
 	struct spi_controller *ctlr = dev_get_drvdata(dev);
-	struct rockchip_spi *rs = spi_controller_get_devdata(ctlr);
 
 	ret = spi_controller_suspend(ctlr);
 	if (ret < 0)
 		return ret;
 
-	clk_disable_unprepare(rs->spiclk);
-	clk_disable_unprepare(rs->apb_pclk);
+	ret = pm_runtime_force_suspend(dev);
+	if (ret < 0) {
+		spi_controller_resume(ctlr);
+		return ret;
+	}
 
 	pinctrl_pm_select_sleep_state(dev);
 
@@ -972,25 +974,14 @@
 {
 	int ret;
 	struct spi_controller *ctlr = dev_get_drvdata(dev);
-	struct rockchip_spi *rs = spi_controller_get_devdata(ctlr);
 
 	pinctrl_pm_select_default_state(dev);
 
-	ret = clk_prepare_enable(rs->apb_pclk);
+	ret = pm_runtime_force_resume(dev);
 	if (ret < 0)
 		return ret;
 
-	ret = clk_prepare_enable(rs->spiclk);
-	if (ret < 0)
-		clk_disable_unprepare(rs->apb_pclk);
-
-	ret = spi_controller_resume(ctlr);
-	if (ret < 0) {
-		clk_disable_unprepare(rs->spiclk);
-		clk_disable_unprepare(rs->apb_pclk);
-	}
-
-	return 0;
+	return spi_controller_resume(ctlr);
 }
 #endif /* CONFIG_PM_SLEEP */
 
--- linux-qcom-6.8.0.orig/drivers/spi/spi-rpc-if.c
+++ linux-qcom-6.8.0/drivers/spi/spi-rpc-if.c
@@ -198,9 +198,16 @@
 
 static SIMPLE_DEV_PM_OPS(rpcif_spi_pm_ops, rpcif_spi_suspend, rpcif_spi_resume);
 
+static const struct platform_device_id rpc_if_spi_id_table[] = {
+	{ .name = "rpc-if-spi" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(platform, rpc_if_spi_id_table);
+
 static struct platform_driver rpcif_spi_driver = {
 	.probe	= rpcif_spi_probe,
 	.remove_new = rpcif_spi_remove,
+	.id_table = rpc_if_spi_id_table,
 	.driver = {
 		.name	= "rpc-if-spi",
 #ifdef CONFIG_PM_SLEEP
--- linux-qcom-6.8.0.orig/drivers/spi/spi-s3c64xx.c
+++ linux-qcom-6.8.0/drivers/spi/spi-s3c64xx.c
@@ -3,19 +3,20 @@
 // Copyright (c) 2009 Samsung Electronics Co., Ltd.
 //      Jaswinder Singh <jassi.brar@samsung.com>
 
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/interrupt.h>
-#include <linux/delay.h>
+#include <linux/bitops.h>
+#include <linux/bits.h>
 #include <linux/clk.h>
+#include <linux/delay.h>
 #include <linux/dma-mapping.h>
 #include <linux/dmaengine.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_data/spi-s3c64xx.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
 #include <linux/spi/spi.h>
-#include <linux/of.h>
-
-#include <linux/platform_data/spi-s3c64xx.h>
 
 #define MAX_SPI_PORTS		12
 #define S3C64XX_SPI_QUIRK_CS_AUTO	(1 << 1)
@@ -76,6 +77,7 @@
 #define S3C64XX_SPI_INT_RX_FIFORDY_EN		(1<<1)
 #define S3C64XX_SPI_INT_TX_FIFORDY_EN		(1<<0)
 
+#define S3C64XX_SPI_ST_TX_FIFO_LVL_SHIFT	6
 #define S3C64XX_SPI_ST_RX_OVERRUN_ERR		(1<<5)
 #define S3C64XX_SPI_ST_RX_UNDERRUN_ERR		(1<<4)
 #define S3C64XX_SPI_ST_TX_OVERRUN_ERR		(1<<3)
@@ -106,9 +108,11 @@
 #define FIFO_LVL_MASK(i) ((i)->port_conf->fifo_lvl_mask[i->port_id])
 #define S3C64XX_SPI_ST_TX_DONE(v, i) (((v) & \
 				(1 << (i)->port_conf->tx_st_done)) ? 1 : 0)
-#define TX_FIFO_LVL(v, i) (((v) >> 6) & FIFO_LVL_MASK(i))
-#define RX_FIFO_LVL(v, i) (((v) >> (i)->port_conf->rx_lvl_offset) & \
-					FIFO_LVL_MASK(i))
+#define TX_FIFO_LVL(v, sdd)	(((v) & (sdd)->tx_fifomask) >>		\
+				 __ffs((sdd)->tx_fifomask))
+#define RX_FIFO_LVL(v, sdd)	(((v) & (sdd)->rx_fifomask) >>		\
+				 __ffs((sdd)->rx_fifomask))
+#define FIFO_DEPTH(i) ((FIFO_LVL_MASK(i) >> 1) + 1)
 
 #define S3C64XX_SPI_MAX_TRAILCNT	0x3ff
 #define S3C64XX_SPI_TRAILCNT_OFF	19
@@ -133,6 +137,10 @@
  * struct s3c64xx_spi_port_config - SPI Controller hardware info
  * @fifo_lvl_mask: Bit-mask for {TX|RX}_FIFO_LVL bits in SPI_STATUS register.
  * @rx_lvl_offset: Bit offset of RX_FIFO_LVL bits in SPI_STATUS regiter.
+ * @rx_fifomask: SPI_STATUS.RX_FIFO_LVL mask. Shifted mask defining the field's
+ *               length and position.
+ * @tx_fifomask: SPI_STATUS.TX_FIFO_LVL mask. Shifted mask defining the field's
+ *               length and position.
  * @tx_st_done: Bit offset of TX_DONE bit in SPI_STATUS regiter.
  * @clk_div: Internal clock divider
  * @quirks: Bitmask of known quirks
@@ -150,6 +158,8 @@
 struct s3c64xx_spi_port_config {
 	int	fifo_lvl_mask[MAX_SPI_PORTS];
 	int	rx_lvl_offset;
+	u32	rx_fifomask;
+	u32	tx_fifomask;
 	int	tx_st_done;
 	int	quirks;
 	int	clk_div;
@@ -179,6 +189,11 @@
  * @tx_dma: Local transmit DMA data (e.g. chan and direction)
  * @port_conf: Local SPI port configuartion data
  * @port_id: Port identification number
+ * @fifo_depth: depth of the FIFO.
+ * @rx_fifomask: SPI_STATUS.RX_FIFO_LVL mask. Shifted mask defining the field's
+ *               length and position.
+ * @tx_fifomask: SPI_STATUS.TX_FIFO_LVL mask. Shifted mask defining the field's
+ *               length and position.
  */
 struct s3c64xx_spi_driver_data {
 	void __iomem                    *regs;
@@ -198,6 +213,9 @@
 	struct s3c64xx_spi_dma_data	tx_dma;
 	const struct s3c64xx_spi_port_config	*port_conf;
 	unsigned int			port_id;
+	unsigned int			fifo_depth;
+	u32				rx_fifomask;
+	u32				tx_fifomask;
 };
 
 static void s3c64xx_flush_fifo(struct s3c64xx_spi_driver_data *sdd)
@@ -221,7 +239,7 @@
 	loops = msecs_to_loops(1);
 	do {
 		val = readl(regs + S3C64XX_SPI_STATUS);
-	} while (TX_FIFO_LVL(val, sdd) && loops--);
+	} while (TX_FIFO_LVL(val, sdd) && --loops);
 
 	if (loops == 0)
 		dev_warn(&sdd->pdev->dev, "Timed out flushing TX FIFO\n");
@@ -234,7 +252,7 @@
 			readl(regs + S3C64XX_SPI_RX_DATA);
 		else
 			break;
-	} while (loops--);
+	} while (--loops);
 
 	if (loops == 0)
 		dev_warn(&sdd->pdev->dev, "Timed out flushing RX FIFO\n");
@@ -405,12 +423,10 @@
 {
 	struct s3c64xx_spi_driver_data *sdd = spi_controller_get_devdata(host);
 
-	if (sdd->rx_dma.ch && sdd->tx_dma.ch) {
-		return xfer->len > (FIFO_LVL_MASK(sdd) >> 1) + 1;
-	} else {
-		return false;
-	}
+	if (sdd->rx_dma.ch && sdd->tx_dma.ch)
+		return xfer->len >= sdd->fifo_depth;
 
+	return false;
 }
 
 static int s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd,
@@ -495,9 +511,7 @@
 	void __iomem *regs = sdd->regs;
 	unsigned long val = 1;
 	u32 status;
-
-	/* max fifo depth available */
-	u32 max_fifo = (FIFO_LVL_MASK(sdd) >> 1) + 1;
+	u32 max_fifo = sdd->fifo_depth;
 
 	if (timeout_ms)
 		val = msecs_to_loops(timeout_ms);
@@ -604,7 +618,7 @@
 	 * For any size less than the fifo size the below code is
 	 * executed atleast once.
 	 */
-	loops = xfer->len / ((FIFO_LVL_MASK(sdd) >> 1) + 1);
+	loops = xfer->len / sdd->fifo_depth;
 	buf = xfer->rx_buf;
 	do {
 		/* wait for data to be received in the fifo */
@@ -741,7 +755,7 @@
 				    struct spi_transfer *xfer)
 {
 	struct s3c64xx_spi_driver_data *sdd = spi_controller_get_devdata(host);
-	const unsigned int fifo_len = (FIFO_LVL_MASK(sdd) >> 1) + 1;
+	const unsigned int fifo_len = sdd->fifo_depth;
 	const void *tx_buf = NULL;
 	void *rx_buf = NULL;
 	int target_len = 0, origin_len = 0;
@@ -769,10 +783,9 @@
 			return status;
 	}
 
-	if (!is_polling(sdd) && (xfer->len > fifo_len) &&
+	if (!is_polling(sdd) && xfer->len >= fifo_len &&
 	    sdd->rx_dma.ch && sdd->tx_dma.ch) {
 		use_dma = 1;
-
 	} else if (xfer->len >= fifo_len) {
 		tx_buf = xfer->tx_buf;
 		rx_buf = xfer->rx_buf;
@@ -1146,6 +1159,23 @@
 	return (const struct s3c64xx_spi_port_config *)platform_get_device_id(pdev)->driver_data;
 }
 
+static void s3c64xx_spi_set_fifomask(struct s3c64xx_spi_driver_data *sdd)
+{
+	const struct s3c64xx_spi_port_config *port_conf = sdd->port_conf;
+
+	if (port_conf->rx_fifomask)
+		sdd->rx_fifomask = port_conf->rx_fifomask;
+	else
+		sdd->rx_fifomask = FIFO_LVL_MASK(sdd) <<
+			port_conf->rx_lvl_offset;
+
+	if (port_conf->tx_fifomask)
+		sdd->tx_fifomask = port_conf->tx_fifomask;
+	else
+		sdd->tx_fifomask = FIFO_LVL_MASK(sdd) <<
+			S3C64XX_SPI_ST_TX_FIFO_LVL_SHIFT;
+}
+
 static int s3c64xx_spi_probe(struct platform_device *pdev)
 {
 	struct resource	*mem_res;
@@ -1191,6 +1221,10 @@
 		sdd->port_id = pdev->id;
 	}
 
+	sdd->fifo_depth = FIFO_DEPTH(sdd);
+
+	s3c64xx_spi_set_fifomask(sdd);
+
 	sdd->cur_bpw = 8;
 
 	sdd->tx_dma.direction = DMA_MEM_TO_DEV;
@@ -1280,7 +1314,7 @@
 	dev_dbg(&pdev->dev, "Samsung SoC SPI Driver loaded for Bus SPI-%d with %d Targets attached\n",
 					sdd->port_id, host->num_chipselect);
 	dev_dbg(&pdev->dev, "\tIOmem=[%pR]\tFIFO %dbytes\n",
-					mem_res, (FIFO_LVL_MASK(sdd) >> 1) + 1);
+		mem_res, sdd->fifo_depth);
 
 	pm_runtime_mark_last_busy(&pdev->dev);
 	pm_runtime_put_autosuspend(&pdev->dev);
--- linux-qcom-6.8.0.orig/drivers/spi/spi-stm32-qspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-stm32-qspi.c
@@ -349,7 +349,7 @@
 
 static int stm32_qspi_get_mode(u8 buswidth)
 {
-	if (buswidth == 4)
+	if (buswidth >= 4)
 		return CCR_BUSWIDTH_4;
 
 	return buswidth;
@@ -653,9 +653,7 @@
 		return -EINVAL;
 
 	mode = spi->mode & (SPI_TX_OCTAL | SPI_RX_OCTAL);
-	if ((mode == SPI_TX_OCTAL || mode == SPI_RX_OCTAL) ||
-	    ((mode == (SPI_TX_OCTAL | SPI_RX_OCTAL)) &&
-	    gpiod_count(qspi->dev, "cs") == -ENOENT)) {
+	if (mode && gpiod_count(qspi->dev, "cs") == -ENOENT) {
 		dev_err(qspi->dev, "spi-rx-bus-width\\/spi-tx-bus-width\\/cs-gpios\n");
 		dev_err(qspi->dev, "configuration not supported\n");
 
@@ -676,10 +674,10 @@
 	qspi->cr_reg = CR_APMS | 3 << CR_FTHRES_SHIFT | CR_SSHIFT | CR_EN;
 
 	/*
-	 * Dual flash mode is only enable in case SPI_TX_OCTAL and SPI_TX_OCTAL
-	 * are both set in spi->mode and "cs-gpios" properties is found in DT
+	 * Dual flash mode is only enable in case SPI_TX_OCTAL or SPI_RX_OCTAL
+	 * is set in spi->mode and "cs-gpios" properties is found in DT
 	 */
-	if (mode == (SPI_TX_OCTAL | SPI_RX_OCTAL)) {
+	if (mode) {
 		qspi->cr_reg |= CR_DFM;
 		dev_dbg(qspi->dev, "Dual flash mode enable");
 	}
--- linux-qcom-6.8.0.orig/drivers/spi/spi-stm32.c
+++ linux-qcom-6.8.0/drivers/spi/spi-stm32.c
@@ -1057,7 +1057,7 @@
 		mask |= STM32H7_SPI_SR_TXP | STM32H7_SPI_SR_RXP;
 
 	if (!(sr & mask)) {
-		dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n",
+		dev_vdbg(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n",
 			 sr, ier);
 		spin_unlock_irqrestore(&spi->lock, flags);
 		return IRQ_NONE;
@@ -2043,6 +2043,7 @@
 	.baud_rate_div_max = STM32H7_SPI_MBR_DIV_MAX,
 	.has_fifo = true,
 	.prevent_dma_burst = true,
+	.has_device_mode = true,
 };
 
 static const struct of_device_id stm32_spi_of_match[] = {
--- linux-qcom-6.8.0.orig/drivers/spi/spi-tegra210-quad.c
+++ linux-qcom-6.8.0/drivers/spi/spi-tegra210-quad.c
@@ -341,7 +341,7 @@
 		for (count = 0; count < max_n_32bit; count++) {
 			u32 x = 0;
 
-			for (i = 0; len && (i < bytes_per_word); i++, len--)
+			for (i = 0; len && (i < min(4, bytes_per_word)); i++, len--)
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tegra_qspi_writel(tqspi, x, QSPI_TX_FIFO);
 		}
--- linux-qcom-6.8.0.orig/drivers/spi/spi-zynqmp-gqspi.c
+++ linux-qcom-6.8.0/drivers/spi/spi-zynqmp-gqspi.c
@@ -1033,6 +1033,18 @@
 	return 0;
 }
 
+static unsigned long zynqmp_qspi_timeout(struct zynqmp_qspi *xqspi, u8 bits,
+					 unsigned long bytes)
+{
+	unsigned long timeout;
+
+	/* Assume we are at most 2x slower than the nominal bus speed */
+	timeout = mult_frac(bytes, 2 * 8 * MSEC_PER_SEC,
+			    bits * xqspi->speed_hz);
+	/* And add 100 ms for scheduling delays */
+	return msecs_to_jiffies(timeout + 100);
+}
+
 /**
  * zynqmp_qspi_exec_op() - Initiates the QSPI transfer
  * @mem: The SPI memory
@@ -1049,6 +1061,7 @@
 {
 	struct zynqmp_qspi *xqspi = spi_controller_get_devdata
 				    (mem->spi->controller);
+	unsigned long timeout;
 	int err = 0, i;
 	u32 genfifoentry = 0;
 	u16 opcode = op->cmd.opcode;
@@ -1077,8 +1090,10 @@
 		zynqmp_gqspi_write(xqspi, GQSPI_IER_OFST,
 				   GQSPI_IER_GENFIFOEMPTY_MASK |
 				   GQSPI_IER_TXNOT_FULL_MASK);
-		if (!wait_for_completion_timeout
-		    (&xqspi->data_completion, msecs_to_jiffies(1000))) {
+		timeout = zynqmp_qspi_timeout(xqspi, op->cmd.buswidth,
+					      op->cmd.nbytes);
+		if (!wait_for_completion_timeout(&xqspi->data_completion,
+						 timeout)) {
 			err = -ETIMEDOUT;
 			goto return_err;
 		}
@@ -1104,8 +1119,10 @@
 				   GQSPI_IER_TXEMPTY_MASK |
 				   GQSPI_IER_GENFIFOEMPTY_MASK |
 				   GQSPI_IER_TXNOT_FULL_MASK);
-		if (!wait_for_completion_timeout
-		    (&xqspi->data_completion, msecs_to_jiffies(1000))) {
+		timeout = zynqmp_qspi_timeout(xqspi, op->addr.buswidth,
+					      op->addr.nbytes);
+		if (!wait_for_completion_timeout(&xqspi->data_completion,
+						 timeout)) {
 			err = -ETIMEDOUT;
 			goto return_err;
 		}
@@ -1173,8 +1190,9 @@
 						   GQSPI_IER_RXEMPTY_MASK);
 			}
 		}
-		if (!wait_for_completion_timeout
-		    (&xqspi->data_completion, msecs_to_jiffies(1000)))
+		timeout = zynqmp_qspi_timeout(xqspi, op->data.buswidth,
+					      op->data.nbytes);
+		if (!wait_for_completion_timeout(&xqspi->data_completion, timeout))
 			err = -ETIMEDOUT;
 	}
 
@@ -1341,6 +1359,7 @@
 
 clk_dis_all:
 	pm_runtime_disable(&pdev->dev);
+	pm_runtime_dont_use_autosuspend(&pdev->dev);
 	pm_runtime_put_noidle(&pdev->dev);
 	pm_runtime_set_suspended(&pdev->dev);
 	clk_disable_unprepare(xqspi->refclk);
@@ -1371,6 +1390,7 @@
 	zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, 0x0);
 
 	pm_runtime_disable(&pdev->dev);
+	pm_runtime_dont_use_autosuspend(&pdev->dev);
 	pm_runtime_put_noidle(&pdev->dev);
 	pm_runtime_set_suspended(&pdev->dev);
 	clk_disable_unprepare(xqspi->refclk);
--- linux-qcom-6.8.0.orig/drivers/spi/spi.c
+++ linux-qcom-6.8.0/drivers/spi/spi.c
@@ -426,6 +426,16 @@
 			spi->irq = 0;
 	}
 
+	if (has_acpi_companion(dev) && spi->irq < 0) {
+		struct acpi_device *adev = to_acpi_device_node(dev->fwnode);
+
+		spi->irq = acpi_dev_gpio_irq_get(adev, 0);
+		if (spi->irq == -EPROBE_DEFER)
+			return -EPROBE_DEFER;
+		if (spi->irq < 0)
+			spi->irq = 0;
+	}
+
 	ret = dev_pm_domain_attach(dev, true);
 	if (ret)
 		return ret;
@@ -608,23 +618,35 @@
 		     spi_get_chipselect(spi, 0));
 }
 
+static inline int spi_dev_check_cs(struct device *dev,
+				   struct spi_device *spi, u8 idx,
+				   struct spi_device *new_spi, u8 new_idx)
+{
+	u8 cs, cs_new;
+	u8 idx_new;
+
+	cs = spi_get_chipselect(spi, idx);
+	for (idx_new = new_idx; idx_new < SPI_CS_CNT_MAX; idx_new++) {
+		cs_new = spi_get_chipselect(new_spi, idx_new);
+		if (cs != 0xFF && cs_new != 0xFF && cs == cs_new) {
+			dev_err(dev, "chipselect %u already in use\n", cs_new);
+			return -EBUSY;
+		}
+	}
+	return 0;
+}
+
 static int spi_dev_check(struct device *dev, void *data)
 {
 	struct spi_device *spi = to_spi_device(dev);
 	struct spi_device *new_spi = data;
-	int idx, nw_idx;
-	u8 cs, cs_nw;
+	int status, idx;
 
 	if (spi->controller == new_spi->controller) {
 		for (idx = 0; idx < SPI_CS_CNT_MAX; idx++) {
-			cs = spi_get_chipselect(spi, idx);
-			for (nw_idx = 0; nw_idx < SPI_CS_CNT_MAX; nw_idx++) {
-				cs_nw = spi_get_chipselect(new_spi, nw_idx);
-				if (cs != 0xFF && cs_nw != 0xFF && cs == cs_nw) {
-					dev_err(dev, "chipselect %d already in use\n", cs_nw);
-					return -EBUSY;
-				}
-			}
+			status = spi_dev_check_cs(dev, spi, idx, new_spi, 0);
+			if (status)
+				return status;
 		}
 	}
 	return 0;
@@ -640,8 +662,8 @@
 {
 	struct spi_controller *ctlr = spi->controller;
 	struct device *dev = ctlr->dev.parent;
-	int status, idx, nw_idx;
-	u8 cs, nw_cs;
+	int status, idx;
+	u8 cs;
 
 	for (idx = 0; idx < SPI_CS_CNT_MAX; idx++) {
 		/* Chipselects are numbered 0..max; validate. */
@@ -657,14 +679,11 @@
 	 * Make sure that multiple logical CS doesn't map to the same physical CS.
 	 * For example, spi->chip_select[0] != spi->chip_select[1] and so on.
 	 */
-	for (idx = 0; idx < SPI_CS_CNT_MAX; idx++) {
-		cs = spi_get_chipselect(spi, idx);
-		for (nw_idx = idx + 1; nw_idx < SPI_CS_CNT_MAX; nw_idx++) {
-			nw_cs = spi_get_chipselect(spi, nw_idx);
-			if (cs != 0xFF && nw_cs != 0xFF && cs == nw_cs) {
-				dev_err(dev, "chipselect %d already in use\n", nw_cs);
-				return -EBUSY;
-			}
+	if (!spi_controller_is_target(ctlr)) {
+		for (idx = 0; idx < SPI_CS_CNT_MAX; idx++) {
+			status = spi_dev_check_cs(dev, spi, idx, spi, idx + 1);
+			if (status)
+				return status;
 		}
 	}
 
@@ -1042,10 +1061,14 @@
 	if (spi->mode & SPI_CS_HIGH)
 		enable = !enable;
 
-	if (spi_is_csgpiod(spi)) {
-		if (!spi->controller->set_cs_timing && !activate)
-			spi_delay_exec(&spi->cs_hold, NULL);
+	/*
+	 * Handle chip select delays for GPIO based CS or controllers without
+	 * programmable chip select timing.
+	 */
+	if ((spi_is_csgpiod(spi) || !spi->controller->set_cs_timing) && !activate)
+		spi_delay_exec(&spi->cs_hold, NULL);
 
+	if (spi_is_csgpiod(spi)) {
 		if (!(spi->mode & SPI_NO_CS)) {
 			/*
 			 * Historically ACPI has no means of the GPIO polarity and
@@ -1079,16 +1102,16 @@
 		if ((spi->controller->flags & SPI_CONTROLLER_GPIO_SS) &&
 		    spi->controller->set_cs)
 			spi->controller->set_cs(spi, !enable);
-
-		if (!spi->controller->set_cs_timing) {
-			if (activate)
-				spi_delay_exec(&spi->cs_setup, NULL);
-			else
-				spi_delay_exec(&spi->cs_inactive, NULL);
-		}
 	} else if (spi->controller->set_cs) {
 		spi->controller->set_cs(spi, !enable);
 	}
+
+	if (spi_is_csgpiod(spi) || !spi->controller->set_cs_timing) {
+		if (activate)
+			spi_delay_exec(&spi->cs_setup, NULL);
+		else
+			spi_delay_exec(&spi->cs_inactive, NULL);
+	}
 }
 
 #ifdef CONFIG_HAS_DMA
@@ -1218,6 +1241,7 @@
 	else
 		rx_dev = ctlr->dev.parent;
 
+	ret = -ENOMSG;
 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
 		/* The sync is done before each transfer. */
 		unsigned long attrs = DMA_ATTR_SKIP_CPU_SYNC;
@@ -1247,6 +1271,9 @@
 			}
 		}
 	}
+	/* No transfer has been mapped, bail out with success */
+	if (ret)
+		return 0;
 
 	ctlr->cur_rx_dma_dev = rx_dev;
 	ctlr->cur_tx_dma_dev = tx_dev;
@@ -1747,13 +1774,37 @@
 
 	trace_spi_message_start(msg);
 
-	ret = spi_split_transfers_maxsize(ctlr, msg,
-					  spi_max_transfer_size(msg->spi),
-					  GFP_KERNEL | GFP_DMA);
-	if (ret) {
-		msg->status = ret;
-		spi_finalize_current_message(ctlr);
-		return ret;
+	/*
+	 * If an SPI controller does not support toggling the CS line on each
+	 * transfer (indicated by the SPI_CS_WORD flag) or we are using a GPIO
+	 * for the CS line, we can emulate the CS-per-word hardware function by
+	 * splitting transfers into one-word transfers and ensuring that
+	 * cs_change is set for each transfer.
+	 */
+	if ((msg->spi->mode & SPI_CS_WORD) && (!(ctlr->mode_bits & SPI_CS_WORD) ||
+					       spi_is_csgpiod(msg->spi))) {
+		ret = spi_split_transfers_maxwords(ctlr, msg, 1, GFP_KERNEL);
+		if (ret) {
+			msg->status = ret;
+			spi_finalize_current_message(ctlr);
+			return ret;
+		}
+
+		list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+			/* Don't change cs_change on the last entry in the list */
+			if (list_is_last(&xfer->transfer_list, &msg->transfers))
+				break;
+			xfer->cs_change = 1;
+		}
+	} else {
+		ret = spi_split_transfers_maxsize(ctlr, msg,
+						  spi_max_transfer_size(msg->spi),
+						  GFP_KERNEL | GFP_DMA);
+		if (ret) {
+			msg->status = ret;
+			spi_finalize_current_message(ctlr);
+			return ret;
+		}
 	}
 
 	if (ctlr->prepare_message) {
@@ -2872,9 +2923,6 @@
 	acpi_set_modalias(adev, acpi_device_hid(adev), spi->modalias,
 			  sizeof(spi->modalias));
 
-	if (spi->irq < 0)
-		spi->irq = acpi_dev_gpio_irq_get(adev, 0);
-
 	acpi_device_set_enumerated(adev);
 
 	adev->power.flags.ignore_parent = true;
@@ -4063,33 +4111,7 @@
 	if (list_empty(&message->transfers))
 		return -EINVAL;
 
-	/*
-	 * If an SPI controller does not support toggling the CS line on each
-	 * transfer (indicated by the SPI_CS_WORD flag) or we are using a GPIO
-	 * for the CS line, we can emulate the CS-per-word hardware function by
-	 * splitting transfers into one-word transfers and ensuring that
-	 * cs_change is set for each transfer.
-	 */
-	if ((spi->mode & SPI_CS_WORD) && (!(ctlr->mode_bits & SPI_CS_WORD) ||
-					  spi_is_csgpiod(spi))) {
-		size_t maxsize = BITS_TO_BYTES(spi->bits_per_word);
-		int ret;
-
-		/* spi_split_transfers_maxsize() requires message->spi */
-		message->spi = spi;
-
-		ret = spi_split_transfers_maxsize(ctlr, message, maxsize,
-						  GFP_KERNEL);
-		if (ret)
-			return ret;
-
-		list_for_each_entry(xfer, &message->transfers, transfer_list) {
-			/* Don't change cs_change on the last entry in the list */
-			if (list_is_last(&xfer->transfer_list, &message->transfers))
-				break;
-			xfer->cs_change = 1;
-		}
-	}
+	message->spi = spi;
 
 	/*
 	 * Half-duplex links include original MicroWire, and ones with
@@ -4168,7 +4190,8 @@
 				return -EINVAL;
 			if (xfer->tx_nbits != SPI_NBITS_SINGLE &&
 				xfer->tx_nbits != SPI_NBITS_DUAL &&
-				xfer->tx_nbits != SPI_NBITS_QUAD)
+				xfer->tx_nbits != SPI_NBITS_QUAD &&
+				xfer->tx_nbits != SPI_NBITS_OCTAL)
 				return -EINVAL;
 			if ((xfer->tx_nbits == SPI_NBITS_DUAL) &&
 				!(spi->mode & (SPI_TX_DUAL | SPI_TX_QUAD)))
@@ -4183,7 +4206,8 @@
 				return -EINVAL;
 			if (xfer->rx_nbits != SPI_NBITS_SINGLE &&
 				xfer->rx_nbits != SPI_NBITS_DUAL &&
-				xfer->rx_nbits != SPI_NBITS_QUAD)
+				xfer->rx_nbits != SPI_NBITS_QUAD &&
+				xfer->rx_nbits != SPI_NBITS_OCTAL)
 				return -EINVAL;
 			if ((xfer->rx_nbits == SPI_NBITS_DUAL) &&
 				!(spi->mode & (SPI_RX_DUAL | SPI_RX_QUAD)))
@@ -4214,8 +4238,6 @@
 	if (!ctlr->transfer)
 		return -ENOTSUPP;
 
-	message->spi = spi;
-
 	SPI_STATISTICS_INCREMENT_FIELD(ctlr->pcpu_statistics, spi_async);
 	SPI_STATISTICS_INCREMENT_FIELD(spi->pcpu_statistics, spi_async);
 
@@ -4395,8 +4417,6 @@
 	if (status != 0)
 		return status;
 
-	message->spi = spi;
-
 	SPI_STATISTICS_INCREMENT_FIELD(ctlr->pcpu_statistics, spi_sync);
 	SPI_STATISTICS_INCREMENT_FIELD(spi->pcpu_statistics, spi_sync);
 
@@ -4433,6 +4453,7 @@
 		wait_for_completion(&done);
 		status = message->status;
 	}
+	message->complete = NULL;
 	message->context = NULL;
 
 	return status;
--- linux-qcom-6.8.0.orig/drivers/spi/spidev.c
+++ linux-qcom-6.8.0/drivers/spi/spidev.c
@@ -700,7 +700,9 @@
 };
 
 static const struct spi_device_id spidev_spi_ids[] = {
+	{ .name = "bh2228fv" },
 	{ .name = "dh2228fv" },
+	{ .name = "jg10309-01" },
 	{ .name = "ltc2488" },
 	{ .name = "sx1301" },
 	{ .name = "bk4" },
@@ -730,10 +732,12 @@
 static const struct of_device_id spidev_dt_ids[] = {
 	{ .compatible = "cisco,spi-petra", .data = &spidev_of_check },
 	{ .compatible = "dh,dhcom-board", .data = &spidev_of_check },
+	{ .compatible = "elgin,jg10309-01", .data = &spidev_of_check },
 	{ .compatible = "lineartechnology,ltc2488", .data = &spidev_of_check },
 	{ .compatible = "lwn,bk4", .data = &spidev_of_check },
 	{ .compatible = "menlo,m53cpld", .data = &spidev_of_check },
 	{ .compatible = "micron,spi-authenta", .data = &spidev_of_check },
+	{ .compatible = "rohm,bh2228fv", .data = &spidev_of_check },
 	{ .compatible = "rohm,dh2228fv", .data = &spidev_of_check },
 	{ .compatible = "semtech,sx1301", .data = &spidev_of_check },
 	{ .compatible = "silabs,em3581", .data = &spidev_of_check },
--- linux-qcom-6.8.0.orig/drivers/spmi/hisi-spmi-controller.c
+++ linux-qcom-6.8.0/drivers/spmi/hisi-spmi-controller.c
@@ -300,7 +300,6 @@
 
 	spin_lock_init(&spmi_controller->lock);
 
-	ctrl->nr = spmi_controller->channel;
 	ctrl->dev.parent = pdev->dev.parent;
 	ctrl->dev.of_node = of_node_get(pdev->dev.of_node);
 
--- linux-qcom-6.8.0.orig/drivers/spmi/spmi-pmic-arb.c
+++ linux-qcom-6.8.0/drivers/spmi/spmi-pmic-arb.c
@@ -1462,8 +1462,8 @@
 	 */
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "core");
 	core = devm_ioremap(&ctrl->dev, res->start, resource_size(res));
-	if (IS_ERR(core))
-		return PTR_ERR(core);
+	if (!core)
+		return -ENOMEM;
 
 	pmic_arb->core_size = resource_size(res);
 
@@ -1495,15 +1495,15 @@
 						   "obsrvr");
 		pmic_arb->rd_base = devm_ioremap(&ctrl->dev, res->start,
 						 resource_size(res));
-		if (IS_ERR(pmic_arb->rd_base))
-			return PTR_ERR(pmic_arb->rd_base);
+		if (!pmic_arb->rd_base)
+			return -ENOMEM;
 
 		res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
 						   "chnls");
 		pmic_arb->wr_base = devm_ioremap(&ctrl->dev, res->start,
 						 resource_size(res));
-		if (IS_ERR(pmic_arb->wr_base))
-			return PTR_ERR(pmic_arb->wr_base);
+		if (!pmic_arb->wr_base)
+			return -ENOMEM;
 	}
 
 	pmic_arb->max_periphs = PMIC_ARB_MAX_PERIPHS;
--- linux-qcom-6.8.0.orig/drivers/ssb/main.c
+++ linux-qcom-6.8.0/drivers/ssb/main.c
@@ -341,11 +341,13 @@
 
 static int ssb_device_uevent(const struct device *dev, struct kobj_uevent_env *env)
 {
-	const struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+	const struct ssb_device *ssb_dev;
 
 	if (!dev)
 		return -ENODEV;
 
+	ssb_dev = dev_to_ssb_dev(dev);
+
 	return add_uevent_var(env,
 			     "MODALIAS=ssb:v%04Xid%04Xrev%02X",
 			     ssb_dev->id.vendor, ssb_dev->id.coreid,
--- linux-qcom-6.8.0.orig/drivers/staging/greybus/arche-apb-ctrl.c
+++ linux-qcom-6.8.0/drivers/staging/greybus/arche-apb-ctrl.c
@@ -466,6 +466,7 @@
 	{ .compatible = "usbffff,2", },
 	{ },
 };
+MODULE_DEVICE_TABLE(of, arche_apb_ctrl_of_match);
 
 static struct platform_driver arche_apb_ctrl_device_driver = {
 	.probe		= arche_apb_ctrl_probe,
--- linux-qcom-6.8.0.orig/drivers/staging/greybus/arche-platform.c
+++ linux-qcom-6.8.0/drivers/staging/greybus/arche-platform.c
@@ -619,14 +619,7 @@
 	{ .compatible = "google,arche-platform", },
 	{ },
 };
-
-static const struct of_device_id arche_combined_id[] = {
-	/* Use PID/VID of SVC device */
-	{ .compatible = "google,arche-platform", },
-	{ .compatible = "usbffff,2", },
-	{ },
-};
-MODULE_DEVICE_TABLE(of, arche_combined_id);
+MODULE_DEVICE_TABLE(of, arche_platform_of_match);
 
 static struct platform_driver arche_platform_device_driver = {
 	.probe		= arche_platform_probe,
--- linux-qcom-6.8.0.orig/drivers/staging/greybus/light.c
+++ linux-qcom-6.8.0/drivers/staging/greybus/light.c
@@ -100,15 +100,15 @@
 static struct gb_channel *get_channel_from_mode(struct gb_light *light,
 						u32 mode)
 {
-	struct gb_channel *channel = NULL;
+	struct gb_channel *channel;
 	int i;
 
 	for (i = 0; i < light->channels_count; i++) {
 		channel = &light->channels[i];
-		if (channel && channel->mode == mode)
-			break;
+		if (channel->mode == mode)
+			return channel;
 	}
-	return channel;
+	return NULL;
 }
 
 static int __gb_lights_flash_intensity_set(struct gb_channel *channel,
@@ -147,6 +147,9 @@
 		channel = get_channel_from_mode(channel->light,
 						GB_CHANNEL_MODE_TORCH);
 
+	if (!channel)
+		return -EINVAL;
+
 	/* For not flash we need to convert brightness to intensity */
 	intensity = channel->intensity_uA.min +
 			(channel->intensity_uA.step * channel->led->brightness);
@@ -549,7 +552,10 @@
 	}
 
 	channel_flash = get_channel_from_mode(light, GB_CHANNEL_MODE_FLASH);
-	WARN_ON(!channel_flash);
+	if (!channel_flash) {
+		dev_err(dev, "failed to get flash channel from mode\n");
+		return -EINVAL;
+	}
 
 	fled = &channel_flash->fled;
 
--- linux-qcom-6.8.0.orig/drivers/staging/iio/frequency/ad9832.c
+++ linux-qcom-6.8.0/drivers/staging/iio/frequency/ad9832.c
@@ -129,12 +129,15 @@
 static int ad9832_write_frequency(struct ad9832_state *st,
 				  unsigned int addr, unsigned long fout)
 {
+	unsigned long clk_freq;
 	unsigned long regval;
 
-	if (fout > (clk_get_rate(st->mclk) / 2))
+	clk_freq = clk_get_rate(st->mclk);
+
+	if (!clk_freq || fout > (clk_freq / 2))
 		return -EINVAL;
 
-	regval = ad9832_calc_freqreg(clk_get_rate(st->mclk), fout);
+	regval = ad9832_calc_freqreg(clk_freq, fout);
 
 	st->freq_data[0] = cpu_to_be16((AD9832_CMD_FRE8BITSW << CMD_SHIFT) |
 					(addr << ADD_SHIFT) |
@@ -155,7 +158,7 @@
 static int ad9832_write_phase(struct ad9832_state *st,
 			      unsigned long addr, unsigned long phase)
 {
-	if (phase > BIT(AD9832_PHASE_BITS))
+	if (phase >= BIT(AD9832_PHASE_BITS))
 		return -EINVAL;
 
 	st->phase_data[0] = cpu_to_be16((AD9832_CMD_PHA8BITSW << CMD_SHIFT) |
--- linux-qcom-6.8.0.orig/drivers/staging/iio/frequency/ad9834.c
+++ linux-qcom-6.8.0/drivers/staging/iio/frequency/ad9834.c
@@ -114,7 +114,7 @@
 
 	clk_freq = clk_get_rate(st->mclk);
 
-	if (fout > (clk_freq / 2))
+	if (!clk_freq || fout > (clk_freq / 2))
 		return -EINVAL;
 
 	regval = ad9834_calc_freqreg(clk_freq, fout);
@@ -131,7 +131,7 @@
 static int ad9834_write_phase(struct ad9834_state *st,
 			      unsigned long addr, unsigned long phase)
 {
-	if (phase > BIT(AD9834_PHASE_BITS))
+	if (phase >= BIT(AD9834_PHASE_BITS))
 		return -EINVAL;
 	st->data = cpu_to_be16(addr | phase);
 
--- linux-qcom-6.8.0.orig/drivers/staging/media/atomisp/pci/sh_css.c
+++ linux-qcom-6.8.0/drivers/staging/media/atomisp/pci/sh_css.c
@@ -4719,6 +4719,7 @@
 						  sizeof(struct ia_css_binary),
 						  GFP_KERNEL);
 		if (!mycs->yuv_scaler_binary) {
+			mycs->num_yuv_scaler = 0;
 			err = -ENOMEM;
 			return err;
 		}
--- linux-qcom-6.8.0.orig/drivers/staging/media/atomisp/pci/sh_css_frac.h
+++ linux-qcom-6.8.0/drivers/staging/media/atomisp/pci/sh_css_frac.h
@@ -30,12 +30,24 @@
 #define uISP_VAL_MAX		      ((unsigned int)((1 << uISP_REG_BIT) - 1))
 
 /* a:fraction bits for 16bit precision, b:fraction bits for ISP precision */
-#define sDIGIT_FITTING(v, a, b) \
-	min_t(int, max_t(int, (((v) >> sSHIFT) >> max(sFRACTION_BITS_FITTING(a) - (b), 0)), \
-	  sISP_VAL_MIN), sISP_VAL_MAX)
-#define uDIGIT_FITTING(v, a, b) \
-	min((unsigned int)max((unsigned)(((v) >> uSHIFT) \
-	>> max((int)(uFRACTION_BITS_FITTING(a) - (b)), 0)), \
-	  uISP_VAL_MIN), uISP_VAL_MAX)
+static inline int sDIGIT_FITTING(int v, int a, int b)
+{
+	int fit_shift = sFRACTION_BITS_FITTING(a) - b;
+
+	v >>= sSHIFT;
+	v >>= fit_shift > 0 ? fit_shift : 0;
+
+	return clamp_t(int, v, sISP_VAL_MIN, sISP_VAL_MAX);
+}
+
+static inline unsigned int uDIGIT_FITTING(unsigned int v, int a, int b)
+{
+	int fit_shift = uFRACTION_BITS_FITTING(a) - b;
+
+	v >>= uSHIFT;
+	v >>= fit_shift > 0 ? fit_shift : 0;
+
+	return clamp_t(unsigned int, v, uISP_VAL_MIN, uISP_VAL_MAX);
+}
 
 #endif /* __SH_CSS_FRAC_H */
--- linux-qcom-6.8.0.orig/drivers/staging/media/atomisp/pci/sh_css_params.c
+++ linux-qcom-6.8.0/drivers/staging/media/atomisp/pci/sh_css_params.c
@@ -4181,6 +4181,8 @@
 		goto err;
 	/* No weighted histogram, no structure, treat the histogram data as a byte dump in a byte array */
 	me->rgby_data = kvmalloc(sizeof_hmem(HMEM0_ID), GFP_KERNEL);
+	if (!me->rgby_data)
+		goto err;
 
 	IA_CSS_LEAVE("return=%p", me);
 	return me;
--- linux-qcom-6.8.0.orig/drivers/staging/media/av7110/av7110.h
+++ linux-qcom-6.8.0/drivers/staging/media/av7110/av7110.h
@@ -86,6 +86,8 @@
 	u32			ir_config;
 };
 
+#define MAX_CI_SLOTS	2
+
 /* place to store all the necessary device information */
 struct av7110 {
 
@@ -166,7 +168,7 @@
 
 	/* CA */
 
-	struct ca_slot_info	ci_slot[2];
+	struct ca_slot_info	ci_slot[MAX_CI_SLOTS];
 
 	enum av7110_video_mode	vidmode;
 	struct dmxdev		dmxdev;
--- linux-qcom-6.8.0.orig/drivers/staging/media/av7110/av7110_ca.c
+++ linux-qcom-6.8.0/drivers/staging/media/av7110/av7110_ca.c
@@ -18,6 +18,7 @@
 #include <linux/timer.h>
 #include <linux/poll.h>
 #include <linux/gfp.h>
+#include <linux/nospec.h>
 
 #include "av7110.h"
 #include "av7110_hw.h"
@@ -26,23 +27,28 @@
 
 void CI_handle(struct av7110 *av7110, u8 *data, u16 len)
 {
+	unsigned slot_num;
+
 	dprintk(8, "av7110:%p\n",av7110);
 
 	if (len < 3)
 		return;
 	switch (data[0]) {
 	case CI_MSG_CI_INFO:
-		if (data[2] != 1 && data[2] != 2)
+		if (data[2] != 1 && data[2] != MAX_CI_SLOTS)
 			break;
+
+		slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS);
+
 		switch (data[1]) {
 		case 0:
-			av7110->ci_slot[data[2] - 1].flags = 0;
+			av7110->ci_slot[slot_num].flags = 0;
 			break;
 		case 1:
-			av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT;
+			av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT;
 			break;
 		case 2:
-			av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY;
+			av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY;
 			break;
 		}
 		break;
@@ -264,15 +270,19 @@
 	case CA_GET_SLOT_INFO:
 	{
 		struct ca_slot_info *info=(struct ca_slot_info *)parg;
+		unsigned int slot_num;
 
 		if (info->num < 0 || info->num > 1) {
 			mutex_unlock(&av7110->ioctl_mutex);
 			return -EINVAL;
 		}
-		av7110->ci_slot[info->num].num = info->num;
-		av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
-							CA_CI_LINK : CA_CI;
-		memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info));
+		slot_num = array_index_nospec(info->num, MAX_CI_SLOTS);
+
+		av7110->ci_slot[slot_num].num = info->num;
+		av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
+						 CA_CI_LINK : CA_CI;
+		memcpy(info, &av7110->ci_slot[slot_num],
+		       sizeof(struct ca_slot_info));
 		break;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/staging/media/imx/imx-media-csc-scaler.c
+++ linux-qcom-6.8.0/drivers/staging/media/imx/imx-media-csc-scaler.c
@@ -803,6 +803,7 @@
 
 	dev_dbg(priv->dev, "Releasing instance %p\n", ctx);
 
+	v4l2_ctrl_handler_free(&ctx->ctrl_hdlr);
 	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
 	v4l2_fh_del(&ctx->fh);
 	v4l2_fh_exit(&ctx->fh);
--- linux-qcom-6.8.0.orig/drivers/staging/media/ipu3/ipu3-v4l2.c
+++ linux-qcom-6.8.0/drivers/staging/media/ipu3/ipu3-v4l2.c
@@ -1069,6 +1069,11 @@
 	struct imgu_media_pipe *imgu_pipe = &imgu->imgu_pipe[pipe];
 
 	/* Initialize subdev media entity */
+	imgu_sd->subdev.entity.ops = &imgu_media_ops;
+	for (i = 0; i < IMGU_NODE_NUM; i++) {
+		imgu_sd->subdev_pads[i].flags = imgu_pipe->nodes[i].output ?
+			MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE;
+	}
 	r = media_entity_pads_init(&imgu_sd->subdev.entity, IMGU_NODE_NUM,
 				   imgu_sd->subdev_pads);
 	if (r) {
@@ -1076,11 +1081,6 @@
 			"failed initialize subdev media entity (%d)\n", r);
 		return r;
 	}
-	imgu_sd->subdev.entity.ops = &imgu_media_ops;
-	for (i = 0; i < IMGU_NODE_NUM; i++) {
-		imgu_sd->subdev_pads[i].flags = imgu_pipe->nodes[i].output ?
-			MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE;
-	}
 
 	/* Initialize subdev */
 	v4l2_subdev_init(&imgu_sd->subdev, &imgu_subdev_ops);
@@ -1177,15 +1177,15 @@
 	}
 
 	/* Initialize media entities */
+	node->vdev_pad.flags = node->output ?
+		MEDIA_PAD_FL_SOURCE : MEDIA_PAD_FL_SINK;
+	vdev->entity.ops = NULL;
 	r = media_entity_pads_init(&vdev->entity, 1, &node->vdev_pad);
 	if (r) {
 		dev_err(dev, "failed initialize media entity (%d)\n", r);
 		mutex_destroy(&node->lock);
 		return r;
 	}
-	node->vdev_pad.flags = node->output ?
-		MEDIA_PAD_FL_SOURCE : MEDIA_PAD_FL_SINK;
-	vdev->entity.ops = NULL;
 
 	/* Initialize vbq */
 	vbq->type = node->vdev_fmt.type;
--- linux-qcom-6.8.0.orig/drivers/staging/media/starfive/camss/stf-camss.c
+++ linux-qcom-6.8.0/drivers/staging/media/starfive/camss/stf-camss.c
@@ -162,6 +162,12 @@
 
 static void stfcamss_unregister_devs(struct stfcamss *stfcamss)
 {
+	struct stf_capture *cap_yuv = &stfcamss->captures[STF_CAPTURE_YUV];
+	struct stf_isp_dev *isp_dev = &stfcamss->isp_dev;
+
+	media_entity_remove_links(&isp_dev->subdev.entity);
+	media_entity_remove_links(&cap_yuv->video.vdev.entity);
+
 	stf_isp_unregister(&stfcamss->isp_dev);
 	stf_capture_unregister(stfcamss);
 }
@@ -352,8 +358,6 @@
 /*
  * stfcamss_remove - Remove STFCAMSS platform device
  * @pdev: Pointer to STFCAMSS platform device
- *
- * Always returns 0.
  */
 static int stfcamss_remove(struct platform_device *pdev)
 {
--- linux-qcom-6.8.0.orig/drivers/staging/media/starfive/camss/stf-capture.c
+++ linux-qcom-6.8.0/drivers/staging/media/starfive/camss/stf-capture.c
@@ -20,28 +20,28 @@
 		.pixelformat = V4L2_PIX_FMT_SRGGB10,
 		.planes = 1,
 		.vsub = { 1 },
-		.bpp = 10,
+		.bpp = 16,
 	},
 	{
 		.code = MEDIA_BUS_FMT_SGRBG10_1X10,
 		.pixelformat = V4L2_PIX_FMT_SGRBG10,
 		.planes = 1,
 		.vsub = { 1 },
-		.bpp = 10,
+		.bpp = 16,
 	},
 	{
 		.code = MEDIA_BUS_FMT_SGBRG10_1X10,
 		.pixelformat = V4L2_PIX_FMT_SGBRG10,
 		.planes = 1,
 		.vsub = { 1 },
-		.bpp = 10,
+		.bpp = 16,
 	},
 	{
 		.code = MEDIA_BUS_FMT_SBGGR10_1X10,
 		.pixelformat = V4L2_PIX_FMT_SBGGR10,
 		.planes = 1,
 		.vsub = { 1 },
-		.bpp = 10,
+		.bpp = 16,
 	},
 };
 
--- linux-qcom-6.8.0.orig/drivers/staging/media/sunxi/cedrus/cedrus_h265.c
+++ linux-qcom-6.8.0/drivers/staging/media/sunxi/cedrus/cedrus_h265.c
@@ -427,11 +427,11 @@
 	unsigned int ctb_addr_x, ctb_addr_y;
 	struct cedrus_buffer *cedrus_buf;
 	dma_addr_t src_buf_addr;
-	dma_addr_t src_buf_end_addr;
 	u32 chroma_log2_weight_denom;
 	u32 num_entry_point_offsets;
 	u32 output_pic_list_index;
 	u32 pic_order_cnt[2];
+	size_t slice_bytes;
 	u8 padding;
 	int count;
 	u32 reg;
@@ -443,6 +443,7 @@
 	pred_weight_table = &slice_params->pred_weight_table;
 	num_entry_point_offsets = slice_params->num_entry_point_offsets;
 	cedrus_buf = vb2_to_cedrus_buffer(&run->dst->vb2_buf);
+	slice_bytes = vb2_get_plane_payload(&run->src->vb2_buf, 0);
 
 	/*
 	 * If entry points offsets are present, we should get them
@@ -490,7 +491,7 @@
 
 	cedrus_write(dev, VE_DEC_H265_BITS_OFFSET, 0);
 
-	reg = slice_params->bit_size;
+	reg = slice_bytes * 8;
 	cedrus_write(dev, VE_DEC_H265_BITS_LEN, reg);
 
 	/* Source beginning and end addresses. */
@@ -504,10 +505,7 @@
 
 	cedrus_write(dev, VE_DEC_H265_BITS_ADDR, reg);
 
-	src_buf_end_addr = src_buf_addr +
-			   DIV_ROUND_UP(slice_params->bit_size, 8);
-
-	reg = VE_DEC_H265_BITS_END_ADDR_BASE(src_buf_end_addr);
+	reg = VE_DEC_H265_BITS_END_ADDR_BASE(src_buf_addr + slice_bytes);
 	cedrus_write(dev, VE_DEC_H265_BITS_END_ADDR, reg);
 
 	/* Coding tree block address */
--- linux-qcom-6.8.0.orig/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ linux-qcom-6.8.0/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -118,11 +118,6 @@
 	int first_connect;
 };
 
-struct vchiq_2835_state {
-	int inited;
-	struct vchiq_arm_state arm_state;
-};
-
 struct vchiq_pagelist_info {
 	struct pagelist *pagelist;
 	size_t pagelist_buffer_size;
@@ -581,29 +576,21 @@
 int
 vchiq_platform_init_state(struct vchiq_state *state)
 {
-	struct vchiq_2835_state *platform_state;
+	struct vchiq_arm_state *platform_state;
 
-	state->platform_state = kzalloc(sizeof(*platform_state), GFP_KERNEL);
-	if (!state->platform_state)
+	platform_state = devm_kzalloc(state->dev, sizeof(*platform_state), GFP_KERNEL);
+	if (!platform_state)
 		return -ENOMEM;
 
-	platform_state = (struct vchiq_2835_state *)state->platform_state;
-
-	platform_state->inited = 1;
-	vchiq_arm_init_state(state, &platform_state->arm_state);
+	vchiq_arm_init_state(state, platform_state);
+	state->platform_state = (struct opaque_platform_state *)platform_state;
 
 	return 0;
 }
 
 static struct vchiq_arm_state *vchiq_platform_get_arm_state(struct vchiq_state *state)
 {
-	struct vchiq_2835_state *platform_state;
-
-	platform_state   = (struct vchiq_2835_state *)state->platform_state;
-
-	WARN_ON_ONCE(!platform_state->inited);
-
-	return &platform_state->arm_state;
+	return (struct vchiq_arm_state *)state->platform_state;
 }
 
 void
--- linux-qcom-6.8.0.orig/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
+++ linux-qcom-6.8.0/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
@@ -503,16 +503,21 @@
  * routines where switched to the "interruptible" family of functions, as the
  * former was deemed unjustified and the use "killable" set all VCHIQ's
  * threads in D state.
+ *
+ * Returns: 0 on success, a negative error code on failure
  */
 static inline int
 remote_event_wait(wait_queue_head_t *wq, struct remote_event *event)
 {
+	int ret = 0;
+
 	if (!event->fired) {
 		event->armed = 1;
 		dsb(sy);
-		if (wait_event_interruptible(*wq, event->fired)) {
+		ret = wait_event_interruptible(*wq, event->fired);
+		if (ret) {
 			event->armed = 0;
-			return 0;
+			return ret;
 		}
 		event->armed = 0;
 		/* Ensure that the peer sees that we are not waiting (armed == 0). */
@@ -520,7 +525,7 @@
 	}
 
 	event->fired = 0;
-	return 1;
+	return ret;
 }
 
 /*
@@ -1141,6 +1146,7 @@
 	struct vchiq_header *header;
 	ssize_t callback_result;
 	int svc_fourcc;
+	int ret;
 
 	local = state->local;
 
@@ -1148,7 +1154,9 @@
 	    mutex_lock_killable(&state->sync_mutex))
 		return -EAGAIN;
 
-	remote_event_wait(&state->sync_release_event, &local->sync_release);
+	ret = remote_event_wait(&state->sync_release_event, &local->sync_release);
+	if (ret)
+		return ret;
 
 	/* Ensure that reads don't overtake the remote_event_wait. */
 	rmb();
@@ -1933,13 +1941,16 @@
 {
 	struct vchiq_state *state = v;
 	struct vchiq_shared_state *local = state->local;
+	int ret;
 
 	DEBUG_INITIALISE(local);
 
 	while (1) {
 		DEBUG_COUNT(SLOT_HANDLER_COUNT);
 		DEBUG_TRACE(SLOT_HANDLER_LINE);
-		remote_event_wait(&state->trigger_event, &local->trigger);
+		ret = remote_event_wait(&state->trigger_event, &local->trigger);
+		if (ret)
+			return ret;
 
 		/* Ensure that reads don't overtake the remote_event_wait. */
 		rmb();
@@ -1970,6 +1981,7 @@
 	struct vchiq_shared_state *local = state->local;
 	u32 *found;
 	size_t length;
+	int ret;
 
 	length = sizeof(*found) * BITSET_SIZE(VCHIQ_MAX_SERVICES);
 
@@ -1979,7 +1991,9 @@
 		return -ENOMEM;
 
 	while (1) {
-		remote_event_wait(&state->recycle_event, &local->recycle);
+		ret = remote_event_wait(&state->recycle_event, &local->recycle);
+		if (ret)
+			return ret;
 
 		process_free_queue(state, found, length);
 	}
@@ -1996,6 +2010,7 @@
 		(struct vchiq_header *)SLOT_DATA_FROM_INDEX(state,
 			state->remote->slot_sync);
 	int svc_fourcc;
+	int ret;
 
 	while (1) {
 		struct vchiq_service *service;
@@ -2003,7 +2018,9 @@
 		int type;
 		unsigned int localport, remoteport;
 
-		remote_event_wait(&state->sync_trigger_event, &local->sync_trigger);
+		ret = remote_event_wait(&state->sync_trigger_event, &local->sync_trigger);
+		if (ret)
+			return ret;
 
 		/* Ensure that reads don't overtake the remote_event_wait. */
 		rmb();
--- linux-qcom-6.8.0.orig/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ linux-qcom-6.8.0/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -937,8 +937,9 @@
 	/* build component create message */
 	m.h.type = MMAL_MSG_TYPE_COMPONENT_CREATE;
 	m.u.component_create.client_component = component->client_component;
-	strncpy(m.u.component_create.name, name,
-		sizeof(m.u.component_create.name));
+	strscpy_pad(m.u.component_create.name, name,
+		    sizeof(m.u.component_create.name));
+	m.u.component_create.pid = 0;
 
 	ret = send_synchronous_mmal_msg(instance, &m,
 					sizeof(m.u.component_create),
--- linux-qcom-6.8.0.orig/drivers/staging/vme_user/vme_fake.c
+++ linux-qcom-6.8.0/drivers/staging/vme_user/vme_fake.c
@@ -1059,6 +1059,12 @@
 	struct vme_slave_resource *slave_image;
 	struct vme_lm_resource *lm;
 
+	if (geoid < 0 || geoid >= VME_MAX_SLOTS) {
+		pr_err("VME geographical address must be between 0 and %d (exclusive), but got %d\n",
+			VME_MAX_SLOTS, geoid);
+		return -EINVAL;
+	}
+
 	/* We need a fake parent device */
 	vme_root = root_device_register("vme");
 	if (IS_ERR(vme_root))
--- linux-qcom-6.8.0.orig/drivers/staging/vme_user/vme_tsi148.c
+++ linux-qcom-6.8.0/drivers/staging/vme_user/vme_tsi148.c
@@ -2253,6 +2253,12 @@
 	struct vme_dma_resource *dma_ctrlr;
 	struct vme_lm_resource *lm;
 
+	if (geoid < 0 || geoid >= VME_MAX_SLOTS) {
+		dev_err(&pdev->dev, "VME geographical address must be between 0 and %d (exclusive), but got %d\n",
+			VME_MAX_SLOTS, geoid);
+		return -EINVAL;
+	}
+
 	/* If we want to support more than one of each bridge, we need to
 	 * dynamically generate this so we get one per device
 	 */
--- linux-qcom-6.8.0.orig/drivers/target/target_core_configfs.c
+++ linux-qcom-6.8.0/drivers/target/target_core_configfs.c
@@ -3672,6 +3672,8 @@
 {
 	struct configfs_subsystem *subsys = &target_core_fabrics;
 	struct t10_alua_lu_gp *lu_gp;
+	struct cred *kern_cred;
+	const struct cred *old_cred;
 	int ret;
 
 	pr_debug("TARGET_CORE[0]: Loading Generic Kernel Storage"
@@ -3748,11 +3750,21 @@
 	if (ret < 0)
 		goto out;
 
+	/* We use the kernel credentials to access the target directory */
+	kern_cred = prepare_kernel_cred(&init_task);
+	if (!kern_cred) {
+		ret = -ENOMEM;
+		goto out;
+	}
+	old_cred = override_creds(kern_cred);
 	target_init_dbroot();
+	revert_creds(old_cred);
+	put_cred(kern_cred);
 
 	return 0;
 
 out:
+	target_xcopy_release_pt();
 	configfs_unregister_subsystem(subsys);
 	core_dev_release_virtual_lun0();
 	rd_module_exit();
--- linux-qcom-6.8.0.orig/drivers/target/target_core_device.c
+++ linux-qcom-6.8.0/drivers/target/target_core_device.c
@@ -692,7 +692,7 @@
 
 	dev->queues = kcalloc(nr_cpu_ids, sizeof(*dev->queues), GFP_KERNEL);
 	if (!dev->queues) {
-		dev->transport->free_device(dev);
+		hba->backend->ops->free_device(dev);
 		return NULL;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/target/target_core_user.c
+++ linux-qcom-6.8.0/drivers/target/target_core_user.c
@@ -2130,7 +2130,7 @@
 	}
 
 	ret = genlmsg_multicast_allns(&tcmu_genl_family, skb, 0,
-				      TCMU_MCGRP_CONFIG, GFP_KERNEL);
+				      TCMU_MCGRP_CONFIG);
 
 	/* Wait during an add as the listener may not be up yet */
 	if (ret == 0 ||
--- linux-qcom-6.8.0.orig/drivers/tee/optee/ffa_abi.c
+++ linux-qcom-6.8.0/drivers/tee/optee/ffa_abi.c
@@ -660,7 +660,9 @@
 					const struct ffa_ops *ops)
 {
 	const struct ffa_msg_ops *msg_ops = ops->msg_ops;
-	struct ffa_send_direct_data data = { OPTEE_FFA_GET_API_VERSION };
+	struct ffa_send_direct_data data = {
+		.data0 = OPTEE_FFA_GET_API_VERSION,
+	};
 	int rc;
 
 	msg_ops->mode_32bit_set(ffa_dev);
@@ -677,7 +679,9 @@
 		return false;
 	}
 
-	data = (struct ffa_send_direct_data){ OPTEE_FFA_GET_OS_VERSION };
+	data = (struct ffa_send_direct_data){
+		.data0 = OPTEE_FFA_GET_OS_VERSION,
+	};
 	rc = msg_ops->sync_send_receive(ffa_dev, &data);
 	if (rc) {
 		pr_err("Unexpected error %d\n", rc);
@@ -698,7 +702,9 @@
 				    unsigned int *rpc_param_count,
 				    unsigned int *max_notif_value)
 {
-	struct ffa_send_direct_data data = { OPTEE_FFA_EXCHANGE_CAPABILITIES };
+	struct ffa_send_direct_data data = {
+		.data0 = OPTEE_FFA_EXCHANGE_CAPABILITIES,
+	};
 	int rc;
 
 	rc = ops->msg_ops->sync_send_receive(ffa_dev, &data);
--- linux-qcom-6.8.0.orig/drivers/thermal/broadcom/bcm2835_thermal.c
+++ linux-qcom-6.8.0/drivers/thermal/broadcom/bcm2835_thermal.c
@@ -185,7 +185,7 @@
 		return err;
 	}
 
-	data->clk = devm_clk_get(&pdev->dev, NULL);
+	data->clk = devm_clk_get_enabled(&pdev->dev, NULL);
 	if (IS_ERR(data->clk)) {
 		err = PTR_ERR(data->clk);
 		if (err != -EPROBE_DEFER)
@@ -193,10 +193,6 @@
 		return err;
 	}
 
-	err = clk_prepare_enable(data->clk);
-	if (err)
-		return err;
-
 	rate = clk_get_rate(data->clk);
 	if ((rate < 1920000) || (rate > 5000000))
 		dev_warn(&pdev->dev,
@@ -211,7 +207,7 @@
 		dev_err(&pdev->dev,
 			"Failed to register the thermal device: %d\n",
 			err);
-		goto err_clk;
+		return err;
 	}
 
 	/*
@@ -236,7 +232,7 @@
 			dev_err(&pdev->dev,
 				"Not able to read trip_temp: %d\n",
 				err);
-			goto err_tz;
+			return err;
 		}
 
 		/* set bandgap reference voltage and enable voltage regulator */
@@ -269,17 +265,11 @@
 	 */
 	err = thermal_add_hwmon_sysfs(tz);
 	if (err)
-		goto err_tz;
+		return err;
 
 	bcm2835_thermal_debugfs(pdev);
 
 	return 0;
-err_tz:
-	devm_thermal_of_zone_unregister(&pdev->dev, tz);
-err_clk:
-	clk_disable_unprepare(data->clk);
-
-	return err;
 }
 
 static void bcm2835_thermal_remove(struct platform_device *pdev)
@@ -287,7 +277,6 @@
 	struct bcm2835_thermal_data *data = platform_get_drvdata(pdev);
 
 	debugfs_remove_recursive(data->debugfsdir);
-	clk_disable_unprepare(data->clk);
 }
 
 static struct platform_driver bcm2835_thermal_driver = {
--- linux-qcom-6.8.0.orig/drivers/thermal/devfreq_cooling.c
+++ linux-qcom-6.8.0/drivers/thermal/devfreq_cooling.c
@@ -201,7 +201,7 @@
 
 		res = dfc->power_ops->get_real_power(df, power, freq, voltage);
 		if (!res) {
-			state = dfc->capped_state;
+			state = dfc->max_state - dfc->capped_state;
 
 			/* Convert EM power into milli-Watts first */
 			dfc->res_util = dfc->em_pd->table[state].power;
--- linux-qcom-6.8.0.orig/drivers/thermal/gov_power_allocator.c
+++ linux-qcom-6.8.0/drivers/thermal/gov_power_allocator.c
@@ -606,7 +606,7 @@
 
 	/* There might be no cooling devices yet. */
 	if (!num_actors) {
-		ret = -EINVAL;
+		ret = 0;
 		goto clean_state;
 	}
 
@@ -679,11 +679,6 @@
 		return -ENOMEM;
 
 	get_governor_trips(tz, params);
-	if (!params->trip_max) {
-		dev_warn(&tz->device, "power_allocator: missing trip_max\n");
-		kfree(params);
-		return -EINVAL;
-	}
 
 	ret = check_power_actors(tz, params);
 	if (ret < 0) {
@@ -712,9 +707,10 @@
 	if (!tz->tzp->sustainable_power)
 		dev_warn(&tz->device, "power_allocator: sustainable_power will be estimated\n");
 
-	estimate_pid_constants(tz, tz->tzp->sustainable_power,
-			       params->trip_switch_on,
-			       params->trip_max->temperature);
+	if (params->trip_max)
+		estimate_pid_constants(tz, tz->tzp->sustainable_power,
+				       params->trip_switch_on,
+				       params->trip_max->temperature);
 
 	reset_pid_controller(params);
 
--- linux-qcom-6.8.0.orig/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
+++ linux-qcom-6.8.0/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
@@ -144,7 +144,7 @@
 	struct int3400_thermal_priv *priv = dev_get_drvdata(dev);
 	int i, length = 0;
 
-	if (priv->current_uuid_index > 0)
+	if (priv->current_uuid_index >= 0)
 		return sprintf(buf, "%s\n",
 			       int3400_thermal_uuids[priv->current_uuid_index]);
 
--- linux-qcom-6.8.0.orig/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ linux-qcom-6.8.0/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -176,14 +176,14 @@
 					 int *temp)
 {
 	int cpu;
-	int curr_temp;
+	int curr_temp, ret;
 
 	*temp = 0;
 
 	for_each_online_cpu(cpu) {
-		curr_temp = intel_tcc_get_temp(cpu, false);
-		if (curr_temp < 0)
-			return curr_temp;
+		ret = intel_tcc_get_temp(cpu, &curr_temp, false);
+		if (ret < 0)
+			return ret;
 		if (!*temp || curr_temp > *temp)
 			*temp = curr_temp;
 	}
--- linux-qcom-6.8.0.orig/drivers/thermal/intel/int340x_thermal/processor_thermal_device.h
+++ linux-qcom-6.8.0/drivers/thermal/intel/int340x_thermal/processor_thermal_device.h
@@ -25,6 +25,7 @@
 #define PCI_DEVICE_ID_INTEL_HSB_THERMAL	0x0A03
 #define PCI_DEVICE_ID_INTEL_ICL_THERMAL	0x8a03
 #define PCI_DEVICE_ID_INTEL_JSL_THERMAL	0x4E03
+#define PCI_DEVICE_ID_INTEL_LNLM_THERMAL	0x641D
 #define PCI_DEVICE_ID_INTEL_MTLP_THERMAL	0x7D03
 #define PCI_DEVICE_ID_INTEL_RPL_THERMAL	0xA71D
 #define PCI_DEVICE_ID_INTEL_SKL_THERMAL	0x1903
--- linux-qcom-6.8.0.orig/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c
+++ linux-qcom-6.8.0/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c
@@ -150,7 +150,7 @@
 {
 	struct proc_thermal_pci *pci_info = devid;
 	struct proc_thermal_device *proc_priv;
-	int ret = IRQ_HANDLED;
+	int ret = IRQ_NONE;
 	u32 status;
 
 	proc_priv = pci_info->proc_priv;
@@ -175,6 +175,7 @@
 		/* Disable enable interrupt flag */
 		proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_INT_ENABLE_0, 0);
 		pkg_thermal_schedule_work(&pci_info->work);
+		ret = IRQ_HANDLED;
 	}
 
 	pci_write_config_byte(pci_info->pdev, 0xdc, 0x01);
@@ -336,7 +337,6 @@
 	if (!pci_info->no_legacy)
 		proc_thermal_remove(proc_priv);
 	proc_thermal_mmio_remove(pdev, proc_priv);
-	pci_disable_device(pdev);
 
 	return ret;
 }
@@ -358,7 +358,6 @@
 	proc_thermal_mmio_remove(pdev, pci_info->proc_priv);
 	if (!pci_info->no_legacy)
 		proc_thermal_remove(proc_priv);
-	pci_disable_device(pdev);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -407,6 +406,7 @@
 static const struct pci_device_id proc_thermal_pci_ids[] = {
 	{ PCI_DEVICE_DATA(INTEL, ADL_THERMAL, PROC_THERMAL_FEATURE_RAPL |
 	  PROC_THERMAL_FEATURE_FIVR | PROC_THERMAL_FEATURE_DVFS | PROC_THERMAL_FEATURE_WT_REQ) },
+	{ PCI_DEVICE_DATA(INTEL, LNLM_THERMAL, PROC_THERMAL_FEATURE_RAPL) },
 	{ PCI_DEVICE_DATA(INTEL, MTLP_THERMAL, PROC_THERMAL_FEATURE_RAPL |
 	  PROC_THERMAL_FEATURE_FIVR | PROC_THERMAL_FEATURE_DVFS | PROC_THERMAL_FEATURE_DLVR |
 	  PROC_THERMAL_FEATURE_WT_HINT | PROC_THERMAL_FEATURE_POWER_FLOOR) },
--- linux-qcom-6.8.0.orig/drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.c
+++ linux-qcom-6.8.0/drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.c
@@ -13,48 +13,12 @@
 
 static const struct rapl_mmio_regs rapl_mmio_default = {
 	.reg_unit = 0x5938,
-	.regs[RAPL_DOMAIN_PACKAGE] = { 0x59a0, 0x593c, 0x58f0, 0, 0x5930},
+	.regs[RAPL_DOMAIN_PACKAGE] = { 0x59a0, 0x593c, 0x58f0, 0, 0x5930, 0x59b0},
 	.regs[RAPL_DOMAIN_DRAM] = { 0x58e0, 0x58e8, 0x58ec, 0, 0},
-	.limits[RAPL_DOMAIN_PACKAGE] = BIT(POWER_LIMIT2),
+	.limits[RAPL_DOMAIN_PACKAGE] = BIT(POWER_LIMIT2) | BIT(POWER_LIMIT4),
 	.limits[RAPL_DOMAIN_DRAM] = BIT(POWER_LIMIT2),
 };
 
-static int rapl_mmio_cpu_online(unsigned int cpu)
-{
-	struct rapl_package *rp;
-
-	/* mmio rapl supports package 0 only for now */
-	if (topology_physical_package_id(cpu))
-		return 0;
-
-	rp = rapl_find_package_domain(cpu, &rapl_mmio_priv, true);
-	if (!rp) {
-		rp = rapl_add_package(cpu, &rapl_mmio_priv, true);
-		if (IS_ERR(rp))
-			return PTR_ERR(rp);
-	}
-	cpumask_set_cpu(cpu, &rp->cpumask);
-	return 0;
-}
-
-static int rapl_mmio_cpu_down_prep(unsigned int cpu)
-{
-	struct rapl_package *rp;
-	int lead_cpu;
-
-	rp = rapl_find_package_domain(cpu, &rapl_mmio_priv, true);
-	if (!rp)
-		return 0;
-
-	cpumask_clear_cpu(cpu, &rp->cpumask);
-	lead_cpu = cpumask_first(&rp->cpumask);
-	if (lead_cpu >= nr_cpu_ids)
-		rapl_remove_package(rp);
-	else if (rp->lead_cpu == cpu)
-		rp->lead_cpu = lead_cpu;
-	return 0;
-}
-
 static int rapl_mmio_read_raw(int cpu, struct reg_action *ra)
 {
 	if (!ra->reg.mmio)
@@ -82,6 +46,7 @@
 int proc_thermal_rapl_add(struct pci_dev *pdev, struct proc_thermal_device *proc_priv)
 {
 	const struct rapl_mmio_regs *rapl_regs = &rapl_mmio_default;
+	struct rapl_package *rp;
 	enum rapl_domain_reg_id reg;
 	enum rapl_domain_type domain;
 	int ret;
@@ -109,25 +74,38 @@
 		return PTR_ERR(rapl_mmio_priv.control_type);
 	}
 
-	ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "powercap/rapl:online",
-				rapl_mmio_cpu_online, rapl_mmio_cpu_down_prep);
-	if (ret < 0) {
-		powercap_unregister_control_type(rapl_mmio_priv.control_type);
-		rapl_mmio_priv.control_type = NULL;
-		return ret;
+	/* Register a RAPL package device for package 0 which is always online */
+	rp = rapl_find_package_domain(0, &rapl_mmio_priv, false);
+	if (rp) {
+		ret = -EEXIST;
+		goto err;
+	}
+
+	rp = rapl_add_package(0, &rapl_mmio_priv, false);
+	if (IS_ERR(rp)) {
+		ret = PTR_ERR(rp);
+		goto err;
 	}
-	rapl_mmio_priv.pcap_rapl_online = ret;
 
 	return 0;
+
+err:
+	powercap_unregister_control_type(rapl_mmio_priv.control_type);
+	rapl_mmio_priv.control_type = NULL;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(proc_thermal_rapl_add);
 
 void proc_thermal_rapl_remove(void)
 {
+	struct rapl_package *rp;
+
 	if (IS_ERR_OR_NULL(rapl_mmio_priv.control_type))
 		return;
 
-	cpuhp_remove_state(rapl_mmio_priv.pcap_rapl_online);
+	rp = rapl_find_package_domain(0, &rapl_mmio_priv, false);
+	if (rp)
+		rapl_remove_package(rp);
 	powercap_unregister_control_type(rapl_mmio_priv.control_type);
 }
 EXPORT_SYMBOL_GPL(proc_thermal_rapl_remove);
--- linux-qcom-6.8.0.orig/drivers/thermal/intel/intel_hfi.c
+++ linux-qcom-6.8.0/drivers/thermal/intel/intel_hfi.c
@@ -400,10 +400,10 @@
  * intel_hfi_online() - Enable HFI on @cpu
  * @cpu:	CPU in which the HFI will be enabled
  *
- * Enable the HFI to be used in @cpu. The HFI is enabled at the die/package
- * level. The first CPU in the die/package to come online does the full HFI
+ * Enable the HFI to be used in @cpu. The HFI is enabled at the package
+ * level. The first CPU in the package to come online does the full HFI
  * initialization. Subsequent CPUs will just link themselves to the HFI
- * instance of their die/package.
+ * instance of their package.
  *
  * This function is called before enabling the thermal vector in the local APIC
  * in order to ensure that @cpu has an associated HFI instance when it receives
@@ -413,31 +413,31 @@
 {
 	struct hfi_instance *hfi_instance;
 	struct hfi_cpu_info *info;
-	u16 die_id;
+	u16 pkg_id;
 
 	/* Nothing to do if hfi_instances are missing. */
 	if (!hfi_instances)
 		return;
 
 	/*
-	 * Link @cpu to the HFI instance of its package/die. It does not
+	 * Link @cpu to the HFI instance of its package. It does not
 	 * matter whether the instance has been initialized.
 	 */
 	info = &per_cpu(hfi_cpu_info, cpu);
-	die_id = topology_logical_die_id(cpu);
+	pkg_id = topology_logical_package_id(cpu);
 	hfi_instance = info->hfi_instance;
 	if (!hfi_instance) {
-		if (die_id >= max_hfi_instances)
+		if (pkg_id >= max_hfi_instances)
 			return;
 
-		hfi_instance = &hfi_instances[die_id];
+		hfi_instance = &hfi_instances[pkg_id];
 		info->hfi_instance = hfi_instance;
 	}
 
 	init_hfi_cpu_index(info);
 
 	/*
-	 * Now check if the HFI instance of the package/die of @cpu has been
+	 * Now check if the HFI instance of the package of @cpu has been
 	 * initialized (by checking its header). In such case, all we have to
 	 * do is to add @cpu to this instance's cpumask and enable the instance
 	 * if needed.
@@ -500,7 +500,7 @@
  *
  * On some processors, hardware remembers previous programming settings even
  * after being reprogrammed. Thus, keep HFI enabled even if all CPUs in the
- * die/package of @cpu are offline. See note in intel_hfi_online().
+ * package of @cpu are offline. See note in intel_hfi_online().
  */
 void intel_hfi_offline(unsigned int cpu)
 {
@@ -605,9 +605,13 @@
 	if (hfi_parse_features())
 		return;
 
-	/* There is one HFI instance per die/package. */
-	max_hfi_instances = topology_max_packages() *
-			    topology_max_die_per_package();
+	/*
+	 * Note: HFI resources are managed at the physical package scope.
+	 * There could be platforms that enumerate packages as Linux dies.
+	 * Special handling would be needed if this happens on an HFI-capable
+	 * platform.
+	 */
+	max_hfi_instances = topology_max_packages();
 
 	/*
 	 * This allocation may fail. CPU hotplug callbacks must check
--- linux-qcom-6.8.0.orig/drivers/thermal/intel/intel_tcc.c
+++ linux-qcom-6.8.0/drivers/thermal/intel/intel_tcc.c
@@ -6,9 +6,171 @@
 
 #include <linux/errno.h>
 #include <linux/intel_tcc.h>
+#include <asm/cpu_device_id.h>
+#include <asm/intel-family.h>
 #include <asm/msr.h>
 
 /**
+ * struct temp_masks - Bitmasks for temperature readings
+ * @tcc_offset:			TCC offset in MSR_TEMPERATURE_TARGET
+ * @digital_readout:		Digital readout in MSR_IA32_THERM_STATUS
+ * @pkg_digital_readout:	Digital readout in MSR_IA32_PACKAGE_THERM_STATUS
+ *
+ * Bitmasks to extract the fields of the MSR_TEMPERATURE and IA32_[PACKAGE]_
+ * THERM_STATUS registers for different processor models.
+ *
+ * The bitmask of TjMax is not included in this structure. It is always 0xff.
+ */
+struct temp_masks {
+	u32 tcc_offset;
+	u32 digital_readout;
+	u32 pkg_digital_readout;
+};
+
+#define TCC_MODEL_TEMP_MASKS(model, _tcc_offset, _digital_readout,	\
+			     _pkg_digital_readout)			\
+	static const struct temp_masks temp_##model __initconst = {	\
+		.tcc_offset = _tcc_offset,				\
+		.digital_readout = _digital_readout,			\
+		.pkg_digital_readout = _pkg_digital_readout		\
+	}
+
+TCC_MODEL_TEMP_MASKS(nehalem, 0, 0x7f, 0x7f);
+TCC_MODEL_TEMP_MASKS(haswell_x, 0xf, 0x7f, 0x7f);
+TCC_MODEL_TEMP_MASKS(broadwell, 0x3f, 0x7f, 0x7f);
+TCC_MODEL_TEMP_MASKS(goldmont, 0x7f, 0x7f, 0x7f);
+TCC_MODEL_TEMP_MASKS(tigerlake, 0x3f, 0xff, 0xff);
+TCC_MODEL_TEMP_MASKS(sapphirerapids, 0x3f, 0x7f, 0xff);
+
+/* Use these masks for processors not included in @tcc_cpu_ids. */
+static struct temp_masks intel_tcc_temp_masks __ro_after_init = {
+	.tcc_offset = 0x7f,
+	.digital_readout = 0xff,
+	.pkg_digital_readout = 0xff,
+};
+
+static const struct x86_cpu_id intel_tcc_cpu_ids[] __initconst = {
+	X86_MATCH_VFM(INTEL_CORE_YONAH,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_CORE2_MEROM,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_CORE2_MEROM_L,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_CORE2_PENRYN,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_CORE2_DUNNINGTON,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_NEHALEM,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_NEHALEM_G,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_NEHALEM_EP,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_NEHALEM_EX,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_WESTMERE,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_WESTMERE_EP,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_WESTMERE_EX,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_SANDYBRIDGE,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_SANDYBRIDGE_X,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_IVYBRIDGE,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_IVYBRIDGE_X,		&temp_haswell_x),
+	X86_MATCH_VFM(INTEL_HASWELL,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_HASWELL_X,			&temp_haswell_x),
+	X86_MATCH_VFM(INTEL_HASWELL_L,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_HASWELL_G,			&temp_nehalem),
+	X86_MATCH_VFM(INTEL_BROADWELL,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_BROADWELL_G,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_BROADWELL_X,		&temp_haswell_x),
+	X86_MATCH_VFM(INTEL_BROADWELL_D,		&temp_haswell_x),
+	X86_MATCH_VFM(INTEL_SKYLAKE_L,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_SKYLAKE,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_SKYLAKE_X,			&temp_haswell_x),
+	X86_MATCH_VFM(INTEL_KABYLAKE_L,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_KABYLAKE,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_COMETLAKE,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_COMETLAKE_L,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_CANNONLAKE_L,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ICELAKE_X,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ICELAKE_D,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ICELAKE,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ICELAKE_L,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ICELAKE_NNPI,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ROCKETLAKE,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_TIGERLAKE_L,		&temp_tigerlake),
+	X86_MATCH_VFM(INTEL_TIGERLAKE,			&temp_tigerlake),
+	X86_MATCH_VFM(INTEL_SAPPHIRERAPIDS_X,		&temp_sapphirerapids),
+	X86_MATCH_VFM(INTEL_EMERALDRAPIDS_X,		&temp_sapphirerapids),
+	X86_MATCH_VFM(INTEL_LAKEFIELD,			&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ALDERLAKE,			&temp_tigerlake),
+	X86_MATCH_VFM(INTEL_ALDERLAKE_L,		&temp_tigerlake),
+	X86_MATCH_VFM(INTEL_RAPTORLAKE,			&temp_tigerlake),
+	X86_MATCH_VFM(INTEL_RAPTORLAKE_P,		&temp_tigerlake),
+	X86_MATCH_VFM(INTEL_RAPTORLAKE_S,		&temp_tigerlake),
+	X86_MATCH_VFM(INTEL_ATOM_BONNELL,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_ATOM_BONNELL_MID,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_ATOM_SALTWELL,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_ATOM_SALTWELL_MID,		&temp_nehalem),
+	X86_MATCH_VFM(INTEL_ATOM_SILVERMONT,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_D,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_MID,	&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ATOM_AIRMONT,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ATOM_AIRMONT_MID,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ATOM_AIRMONT_NP,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ATOM_GOLDMONT,		&temp_goldmont),
+	X86_MATCH_VFM(INTEL_ATOM_GOLDMONT_D,		&temp_goldmont),
+	X86_MATCH_VFM(INTEL_ATOM_GOLDMONT_PLUS,		&temp_goldmont),
+	X86_MATCH_VFM(INTEL_ATOM_TREMONT_D,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ATOM_TREMONT,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ATOM_TREMONT_L,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_ATOM_GRACEMONT,		&temp_tigerlake),
+	X86_MATCH_VFM(INTEL_XEON_PHI_KNL,		&temp_broadwell),
+	X86_MATCH_VFM(INTEL_XEON_PHI_KNM,		&temp_broadwell),
+	{}
+};
+
+static int __init intel_tcc_init(void)
+{
+	const struct x86_cpu_id *id;
+
+	id = x86_match_cpu(intel_tcc_cpu_ids);
+	if (id)
+		memcpy(&intel_tcc_temp_masks, (const void *)id->driver_data,
+		       sizeof(intel_tcc_temp_masks));
+
+	return 0;
+}
+/*
+ * Use subsys_initcall to ensure temperature bitmasks are initialized before
+ * the drivers that use this library.
+ */
+subsys_initcall(intel_tcc_init);
+
+/**
+ * intel_tcc_get_offset_mask() - Returns the bitmask to read TCC offset
+ *
+ * Get the model-specific bitmask to extract TCC_OFFSET from the MSR
+ * TEMPERATURE_TARGET register. If the mask is 0, it means the processor does
+ * not support TCC offset.
+ *
+ * Return: The model-specific bitmask for TCC offset.
+ */
+u32 intel_tcc_get_offset_mask(void)
+{
+	return intel_tcc_temp_masks.tcc_offset;
+}
+EXPORT_SYMBOL_NS(intel_tcc_get_offset_mask, INTEL_TCC);
+
+/**
+ * get_temp_mask() - Returns the model-specific bitmask for temperature
+ *
+ * @pkg: true: Package Thermal Sensor. false: Core Thermal Sensor.
+ *
+ * Get the model-specific bitmask to extract the temperature reading from the
+ * MSR_IA32_[PACKAGE]_THERM_STATUS register.
+ *
+ * Callers must check if the thermal status registers are supported.
+ *
+ * Return: The model-specific bitmask for temperature reading
+ */
+static u32 get_temp_mask(bool pkg)
+{
+	return pkg ? intel_tcc_temp_masks.pkg_digital_readout :
+	       intel_tcc_temp_masks.digital_readout;
+}
+
+/**
  * intel_tcc_get_tjmax() - returns the default TCC activation Temperature
  * @cpu: cpu that the MSR should be run on, nagative value means any cpu.
  *
@@ -56,7 +218,7 @@
 	if (err)
 		return err;
 
-	return (low >> 24) & 0x3f;
+	return (low >> 24) & intel_tcc_temp_masks.tcc_offset;
 }
 EXPORT_SYMBOL_NS_GPL(intel_tcc_get_offset, INTEL_TCC);
 
@@ -76,7 +238,10 @@
 	u32 low, high;
 	int err;
 
-	if (offset < 0 || offset > 0x3f)
+	if (!intel_tcc_temp_masks.tcc_offset)
+		return -ENODEV;
+
+	if (offset < 0 || offset > intel_tcc_temp_masks.tcc_offset)
 		return -EINVAL;
 
 	if (cpu < 0)
@@ -90,7 +255,7 @@
 	if (low & BIT(31))
 		return -EPERM;
 
-	low &= ~(0x3f << 24);
+	low &= ~(intel_tcc_temp_masks.tcc_offset << 24);
 	low |= offset << 24;
 
 	if (cpu < 0)
@@ -103,18 +268,19 @@
 /**
  * intel_tcc_get_temp() - returns the current temperature
  * @cpu: cpu that the MSR should be run on, nagative value means any cpu.
+ * @temp: pointer to the memory for saving cpu temperature.
  * @pkg: true: Package Thermal Sensor. false: Core Thermal Sensor.
  *
  * Get the current temperature returned by the CPU core/package level
  * thermal sensor, in degrees C.
  *
- * Return: Temperature in degrees C on success, negative error code otherwise.
+ * Return: 0 on success, negative error code otherwise.
  */
-int intel_tcc_get_temp(int cpu, bool pkg)
+int intel_tcc_get_temp(int cpu, int *temp, bool pkg)
 {
-	u32 low, high;
 	u32 msr = pkg ? MSR_IA32_PACKAGE_THERM_STATUS : MSR_IA32_THERM_STATUS;
-	int tjmax, temp, err;
+	u32 low, high, mask;
+	int tjmax, err;
 
 	tjmax = intel_tcc_get_tjmax(cpu);
 	if (tjmax < 0)
@@ -131,9 +297,10 @@
 	if (!(low & BIT(31)))
 		return -ENODATA;
 
-	temp = tjmax - ((low >> 16) & 0x7f);
+	mask = get_temp_mask(pkg);
+
+	*temp = tjmax - ((low >> 16) & mask);
 
-	/* Do not allow negative CPU temperature */
-	return temp >= 0 ? temp : -ENODATA;
+	return 0;
 }
 EXPORT_SYMBOL_NS_GPL(intel_tcc_get_temp, INTEL_TCC);
--- linux-qcom-6.8.0.orig/drivers/thermal/intel/intel_tcc_cooling.c
+++ linux-qcom-6.8.0/drivers/thermal/intel/intel_tcc_cooling.c
@@ -20,7 +20,7 @@
 static int tcc_get_max_state(struct thermal_cooling_device *cdev, unsigned long
 			     *state)
 {
-	*state = 0x3f;
+	*state = intel_tcc_get_offset_mask();
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/thermal/intel/x86_pkg_temp_thermal.c
+++ linux-qcom-6.8.0/drivers/thermal/intel/x86_pkg_temp_thermal.c
@@ -108,11 +108,11 @@
 static int sys_get_curr_temp(struct thermal_zone_device *tzd, int *temp)
 {
 	struct zone_device *zonedev = thermal_zone_device_priv(tzd);
-	int val;
+	int val, ret;
 
-	val = intel_tcc_get_temp(zonedev->cpu, true);
-	if (val < 0)
-		return val;
+	ret = intel_tcc_get_temp(zonedev->cpu, &val, true);
+	if (ret < 0)
+		return ret;
 
 	*temp = val * 1000;
 	pr_debug("sys_get_curr_temp %d\n", *temp);
--- linux-qcom-6.8.0.orig/drivers/thermal/mediatek/auxadc_thermal.c
+++ linux-qcom-6.8.0/drivers/thermal/mediatek/auxadc_thermal.c
@@ -690,6 +690,9 @@
 	.adcpnp = mt7986_adcpnp,
 	.sensor_mux_values = mt7986_mux_values,
 	.version = MTK_THERMAL_V3,
+	.apmixed_buffer_ctl_reg = APMIXED_SYS_TS_CON1,
+	.apmixed_buffer_ctl_mask = GENMASK(31, 6) | BIT(3),
+	.apmixed_buffer_ctl_set = BIT(0),
 };
 
 static bool mtk_thermal_temp_is_valid(int temp)
--- linux-qcom-6.8.0.orig/drivers/thermal/mediatek/lvts_thermal.c
+++ linux-qcom-6.8.0/drivers/thermal/mediatek/lvts_thermal.c
@@ -719,8 +719,10 @@
 
 		lvts_td->calib = devm_krealloc(dev, lvts_td->calib,
 					       lvts_td->calib_len + len, GFP_KERNEL);
-		if (!lvts_td->calib)
+		if (!lvts_td->calib) {
+			kfree(efuse);
 			return -ENOMEM;
+		}
 
 		memcpy(lvts_td->calib + lvts_td->calib_len, efuse, len);
 
@@ -738,7 +740,11 @@
 
 	gt = (*value) >> 24;
 
-	if (gt && gt < LVTS_GOLDEN_TEMP_MAX)
+	/* A zero value for gt means that device has invalid efuse data */
+	if (!gt)
+		return -ENODATA;
+
+	if (gt < LVTS_GOLDEN_TEMP_MAX)
 		golden_temp = gt;
 
 	golden_temp_offset = golden_temp * 500 + temp_offset;
@@ -1244,6 +1250,8 @@
 		return -ENOMEM;
 
 	lvts_data = of_device_get_match_data(dev);
+	if (!lvts_data)
+		return -ENODEV;
 
 	lvts_td->clk = devm_clk_get_enabled(dev, NULL);
 	if (IS_ERR(lvts_td->clk))
@@ -1528,11 +1536,15 @@
 static const struct lvts_data mt8192_lvts_mcu_data = {
 	.lvts_ctrl	= mt8192_lvts_mcu_data_ctrl,
 	.num_lvts_ctrl	= ARRAY_SIZE(mt8192_lvts_mcu_data_ctrl),
+	.temp_factor	= LVTS_COEFF_A_MT8195,
+	.temp_offset	= LVTS_COEFF_B_MT8195,
 };
 
 static const struct lvts_data mt8192_lvts_ap_data = {
 	.lvts_ctrl	= mt8192_lvts_ap_data_ctrl,
 	.num_lvts_ctrl	= ARRAY_SIZE(mt8192_lvts_ap_data_ctrl),
+	.temp_factor	= LVTS_COEFF_A_MT8195,
+	.temp_offset	= LVTS_COEFF_B_MT8195,
 };
 
 static const struct lvts_data mt8195_lvts_mcu_data = {
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/Kconfig
+++ linux-qcom-6.8.0/drivers/thermal/qcom/Kconfig
@@ -21,6 +21,17 @@
 	  Thermal client sets threshold temperature for both warm and cool and
 	  gets updated when a threshold is reached.
 
+config QCOM_SPMI_MBG_TM
+	tristate "Qualcomm Technologies, Inc. SPMI PMIC MBG Temperature monitor"
+	depends on OF && SPMI && IIO
+	select REGMAP_SPMI
+	help
+	 This enables a thermal driver for the MBG thermal monitoring device.
+	 It shows up in sysfs as a thermal sensor with two trip points.
+	 It notifies the thermal framework when level 1 high threshold is
+	 violated. The temperature reported by the thermal sensor reflects
+	 the real time die temperature through ADC channel.
+
 config QCOM_SPMI_TEMP_ALARM
 	tristate "Qualcomm SPMI PMIC Temperature Alarm"
 	depends on OF && SPMI && IIO
@@ -41,3 +52,35 @@
 	  input from temperature and current sensors.  On many newer Qualcomm SoCs
 	  LMh is configured in the firmware and this feature need not be enabled.
 	  However, on certain SoCs like sdm845 LMh has to be configured from kernel.
+
+config QCOM_QMI_COOLING
+	tristate "Qualcomm QMI cooling drivers"
+	depends on QCOM_RPROC_COMMON
+	depends on ARCH_QCOM || COMPILE_TEST
+	select QCOM_QMI_HELPERS
+	help
+	   This enables the remote subsystem cooling devices. These cooling
+	   devices will be used by Qualcomm chipset to place various remote
+	   subsystem mitigations like remote processor passive mitigation,
+	   remote subsystem voltage restriction at low temperatures etc.
+	   The QMI cooling device will interface with remote subsystem
+	   using Qualcomm remoteproc interface.
+
+config QTI_BCL_PMIC5
+	tristate "BCL driver for BCL peripherals in PMIC5"
+	depends on SPMI && THERMAL
+	help
+	  This driver provides routines to configure and monitor the BCL
+	  PMIC peripheral. This driver registers the battery current and
+	  voltage sensors with the thermal core framework and can take
+	  threshold input and notify the thermal core when the threshold is
+	  reached.
+
+config QTI_DEVFREQ_CDEV
+	tristate "QTI Devfreq cooling device"
+	depends on PM_DEVFREQ && THERMAL && PM_OPP
+	help
+	   This enables the QTI devfreq cooling device, which
+	   will help register the devfreq cooling devices with
+	   thermal framework and allow limiting the devfreq
+	   frequency.
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/Makefile
+++ linux-qcom-6.8.0/drivers/thermal/qcom/Makefile
@@ -4,5 +4,9 @@
 qcom_tsens-y			+= tsens.o tsens-v2.o tsens-v1.o tsens-v0_1.o \
 				   tsens-8960.o
 obj-$(CONFIG_QCOM_SPMI_ADC_TM5)	+= qcom-spmi-adc-tm5.o
+obj-$(CONFIG_QCOM_SPMI_MBG_TM)	+= qcom-spmi-mbg-tm.o
 obj-$(CONFIG_QCOM_SPMI_TEMP_ALARM)	+= qcom-spmi-temp-alarm.o
 obj-$(CONFIG_QCOM_LMH)		+= lmh.o
+obj-$(CONFIG_QCOM_QMI_COOLING) += qmi-cooling.o
+obj-$(CONFIG_QTI_BCL_PMIC5) += bcl_pmic5.o
+obj-$(CONFIG_QTI_DEVFREQ_CDEV) += qti_devfreq_cdev.o
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/bcl_pmic5.c
+++ linux-qcom-6.8.0/drivers/thermal/qcom/bcl_pmic5.c
@@ -0,0 +1,958 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "%s:%s " fmt, KBUILD_MODNAME, __func__
+
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/workqueue.h>
+#include <linux/kernel.h>
+#include <linux/regmap.h>
+#include <linux/io.h>
+#include <linux/err.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/spmi.h>
+#include <linux/platform_device.h>
+#include <linux/mutex.h>
+#include <linux/thermal.h>
+#include <linux/slab.h>
+#include <linux/nvmem-consumer.h>
+
+#define BCL_DRIVER_NAME       "bcl_pmic5"
+#define BCL_MONITOR_EN        0x46
+#define BCL_IRQ_STATUS        0x08
+#define BCL_REVISION1         0x0
+#define BCL_REVISION2         0x01
+#define BCL_PARAM_1           0x0e
+#define BCL_PARAM_2           0x0f
+
+#define BCL_IBAT_HIGH         0x4B
+#define BCL_IBAT_TOO_HIGH     0x4C
+#define BCL_IBAT_TOO_HIGH_REV4 0x4D
+#define BCL_IBAT_READ         0x86
+#define BCL_IBAT_SCALING_UA   78127
+#define BCL_IBAT_CCM_SCALING_UA   15625
+#define BCL_IBAT_SCALING_REV4_UA  93753
+
+#define BCL_VBAT_READ         0x76
+#define BCL_VBAT_ADC_LOW      0x48
+#define BCL_VBAT_COMP_LOW     0x49
+#define BCL_VBAT_COMP_TLOW    0x4A
+#define BCL_VBAT_CONV_REQ     0x72
+
+#define BCL_GEN3_MAJOR_REV    4
+#define BCL_PARAM_HAS_ADC      BIT(0)
+#define BCL_PARAM_HAS_IBAT_ADC BIT(2)
+
+#define BCL_IRQ_L0       0x1
+#define BCL_IRQ_L1       0x2
+#define BCL_IRQ_L2       0x4
+
+/*
+ * 49827 = 64.879uV (one bit value) * 3 (voltage divider)
+ *		* 256 (8 bit shift for MSB)
+ */
+#define BCL_VBAT_SCALING_UV   49827
+#define BCL_VBAT_NO_READING   127
+#define BCL_VBAT_BASE_MV      2000
+#define BCL_VBAT_INC_MV       25
+#define BCL_VBAT_MAX_MV       3600
+#define BCL_VBAT_THRESH_BASE  0x8CA
+
+#define BCL_IBAT_CCM_OFFSET   800
+#define BCL_IBAT_CCM_LSB      100
+#define BCL_IBAT_CCM_MAX_VAL  14
+
+#define MAX_PERPH_COUNT       2
+
+enum bcl_dev_type {
+	BCL_IBAT_LVL0,
+	BCL_IBAT_LVL1,
+	BCL_VBAT_LVL0,
+	BCL_VBAT_LVL1,
+	BCL_VBAT_LVL2,
+	BCL_LVL0,
+	BCL_LVL1,
+	BCL_LVL2,
+	BCL_2S_IBAT_LVL0,
+	BCL_2S_IBAT_LVL1,
+	BCL_TYPE_MAX,
+};
+
+static char bcl_int_names[BCL_TYPE_MAX][25] = {
+	"bcl-ibat-lvl0",
+	"bcl-ibat-lvl1",
+	"bcl-vbat-lvl0",
+	"bcl-vbat-lvl1",
+	"bcl-vbat-lvl2",
+	"bcl-lvl0",
+	"bcl-lvl1",
+	"bcl-lvl2",
+	"bcl-2s-ibat-lvl0",
+	"bcl-2s-ibat-lvl1",
+};
+
+enum bcl_ibat_ext_range_type {
+	BCL_IBAT_RANGE_LVL0,
+	BCL_IBAT_RANGE_LVL1,
+	BCL_IBAT_RANGE_LVL2,
+	BCL_IBAT_RANGE_MAX,
+};
+
+static uint32_t bcl_ibat_ext_ranges[BCL_IBAT_RANGE_MAX] = {
+	10,		/* default range factor */
+	20,
+	25
+};
+
+struct bcl_device;
+
+struct bcl_peripheral_data {
+	int                     irq_num;
+	int                     status_bit_idx;
+	long			trip_thresh;
+	int                     last_val;
+	struct mutex            state_trans_lock;
+	bool			irq_enabled;
+	enum bcl_dev_type	type;
+	struct thermal_zone_device_ops ops;
+	struct thermal_zone_device *tz_dev;
+	struct bcl_device	*dev;
+};
+
+struct bcl_device {
+	struct device			*dev;
+	struct regmap			*regmap;
+	uint16_t			fg_bcl_addr;
+	uint8_t				dig_major;
+	uint8_t				dig_minor;
+	uint8_t				bcl_param_1;
+	uint8_t				bcl_type;
+	void				*ipc_log;
+	bool				ibat_ccm_enabled;
+	bool				ibat_use_qg_adc;
+	bool				no_bit_shift;
+	uint32_t			ibat_ext_range_factor;
+	struct bcl_peripheral_data	param[BCL_TYPE_MAX];
+};
+
+static struct bcl_device *bcl_devices[MAX_PERPH_COUNT];
+static int bcl_device_ct;
+
+static int bcl_read_register(struct bcl_device *bcl_perph, int16_t reg_offset,
+				unsigned int *data)
+{
+	int ret = 0;
+
+	if (!bcl_perph) {
+		pr_err("BCL device not initialized\n");
+		return -EINVAL;
+	}
+	ret = regmap_read(bcl_perph->regmap,
+			       (bcl_perph->fg_bcl_addr + reg_offset),
+			       data);
+	if (ret < 0)
+		pr_err("Error reading register 0x%04x err:%d\n",
+				bcl_perph->fg_bcl_addr + reg_offset, ret);
+	else
+		pr_debug("Read register:0x%04x value:0x%02x\n",
+				bcl_perph->fg_bcl_addr + reg_offset,
+				*data);
+
+	return ret;
+}
+
+static int bcl_write_register(struct bcl_device *bcl_perph,
+				int16_t reg_offset, uint8_t data)
+{
+	int  ret = 0;
+	uint8_t *write_buf = &data;
+	uint16_t base;
+
+	if (!bcl_perph) {
+		pr_err("BCL device not initialized\n");
+		return -EINVAL;
+	}
+	base = bcl_perph->fg_bcl_addr;
+	ret = regmap_write(bcl_perph->regmap, (base + reg_offset), *write_buf);
+	if (ret < 0) {
+		pr_err("Error reading register:0x%04x val:0x%02x err:%d\n",
+				base + reg_offset, data, ret);
+		return ret;
+	}
+	pr_debug("wrote 0x%02x to 0x%04x\n", data, base + reg_offset);
+
+	return ret;
+}
+
+static void convert_adc_to_vbat_thresh_val(struct bcl_device *bcl_perph, int *val)
+{
+	/*
+	 * Threshold register can be bit shifted from ADC MSB.
+	 * So the scaling factor is half in those cases.
+	 */
+	if (bcl_perph->no_bit_shift)
+		*val = (*val * BCL_VBAT_SCALING_UV) / 1000;
+	else
+		*val = (*val * BCL_VBAT_SCALING_UV) / 2000;
+}
+
+static void convert_adc_to_vbat_val(int *val)
+{
+	*val = (*val * BCL_VBAT_SCALING_UV) / 1000;
+}
+
+static void convert_ibat_to_adc_val(struct bcl_device *bcl_perph, int *val, int scaling_factor)
+{
+	/*
+	 * Threshold register can be bit shifted from ADC MSB.
+	 * So the scaling factor is half in those cases.
+	 */
+	if (bcl_perph->ibat_use_qg_adc)
+		*val = (int)div_s64(*val * 2000 * 2, scaling_factor);
+	else if (bcl_perph->no_bit_shift)
+		*val = (int)div_s64(*val * 1000 * bcl_ibat_ext_ranges[BCL_IBAT_RANGE_LVL0],
+				scaling_factor);
+	else
+		*val = (int)div_s64(*val * 2000 * bcl_ibat_ext_ranges[BCL_IBAT_RANGE_LVL0],
+				scaling_factor);
+
+}
+
+static void convert_adc_to_ibat_val(struct bcl_device *bcl_perph, int *val, int scaling_factor)
+{
+	/* Scaling factor will be half if ibat_use_qg_adc is true */
+	if (bcl_perph->ibat_use_qg_adc)
+		*val = (int)div_s64(*val * scaling_factor, 2 * 1000);
+	else
+		*val = (int)div_s64(*val * scaling_factor,
+				1000 * bcl_ibat_ext_ranges[BCL_IBAT_RANGE_LVL0]);
+}
+
+static int8_t convert_ibat_to_ccm_val(int ibat)
+{
+	int8_t val = BCL_IBAT_CCM_MAX_VAL;
+
+	val = (int8_t)((ibat - BCL_IBAT_CCM_OFFSET) / BCL_IBAT_CCM_LSB);
+
+	if (val > BCL_IBAT_CCM_MAX_VAL) {
+		pr_err(
+		"CCM thresh:%d is invalid, use MAX supported threshold\n",
+			ibat);
+		val = BCL_IBAT_CCM_MAX_VAL;
+	}
+
+	return val;
+}
+
+static int bcl_set_ibat(struct thermal_zone_device *tz, int low, int high)
+{
+	int ret = 0, ibat_ua, thresh_value;
+	int8_t val = 0;
+	int16_t addr;
+	struct bcl_peripheral_data *bat_data =
+		(struct bcl_peripheral_data *)tz->devdata;
+
+	mutex_lock(&bat_data->state_trans_lock);
+	thresh_value = high;
+	if (bat_data->trip_thresh == thresh_value)
+		goto set_trip_exit;
+
+	if (bat_data->irq_num && bat_data->irq_enabled) {
+		disable_irq_nosync(bat_data->irq_num);
+		bat_data->irq_enabled = false;
+	}
+	if (thresh_value == INT_MAX) {
+		bat_data->trip_thresh = thresh_value;
+		goto set_trip_exit;
+	}
+
+	ibat_ua = thresh_value;
+	if (bat_data->dev->ibat_ccm_enabled)
+		convert_ibat_to_adc_val(bat_data->dev, &thresh_value,
+				BCL_IBAT_CCM_SCALING_UA *
+				bat_data->dev->ibat_ext_range_factor);
+	else if (bat_data->dev->dig_major >= BCL_GEN3_MAJOR_REV)
+		convert_ibat_to_adc_val(bat_data->dev, &thresh_value,
+				BCL_IBAT_SCALING_REV4_UA *
+				bat_data->dev->ibat_ext_range_factor);
+	else
+		convert_ibat_to_adc_val(bat_data->dev, &thresh_value,
+				BCL_IBAT_SCALING_UA *
+				bat_data->dev->ibat_ext_range_factor);
+	val = (int8_t)thresh_value;
+	switch (bat_data->type) {
+	case BCL_IBAT_LVL0:
+	case BCL_2S_IBAT_LVL0:
+		addr = BCL_IBAT_HIGH;
+		pr_debug("ibat high threshold:%d mA ADC:0x%02x\n",
+				ibat_ua, val);
+		break;
+	case BCL_IBAT_LVL1:
+	case BCL_2S_IBAT_LVL1:
+		addr = BCL_IBAT_TOO_HIGH;
+		if (bat_data->dev->dig_major >= BCL_GEN3_MAJOR_REV &&
+			bat_data->dev->bcl_param_1 & BCL_PARAM_HAS_IBAT_ADC)
+			addr = BCL_IBAT_TOO_HIGH_REV4;
+		if (bat_data->dev->ibat_ccm_enabled)
+			val = convert_ibat_to_ccm_val(ibat_ua);
+		pr_debug("ibat too high threshold:%d mA ADC:0x%02x\n",
+				ibat_ua, val);
+		break;
+	default:
+		goto set_trip_exit;
+	}
+	ret = bcl_write_register(bat_data->dev, addr, val);
+	if (ret)
+		goto set_trip_exit;
+	bat_data->trip_thresh = ibat_ua;
+
+	if (bat_data->irq_num && !bat_data->irq_enabled) {
+		enable_irq(bat_data->irq_num);
+		bat_data->irq_enabled = true;
+	}
+
+set_trip_exit:
+	mutex_unlock(&bat_data->state_trans_lock);
+
+	return ret;
+}
+
+static int bcl_read_ibat(struct thermal_zone_device *tz, int *adc_value)
+{
+	int ret = 0;
+	unsigned int val = 0;
+	struct bcl_peripheral_data *bat_data =
+		(struct bcl_peripheral_data *)tz->devdata;
+
+	*adc_value = val;
+	ret = bcl_read_register(bat_data->dev, BCL_IBAT_READ, &val);
+	if (ret)
+		goto bcl_read_exit;
+	/* IBat ADC reading is in 2's compliment form */
+	*adc_value = sign_extend32(val, 7);
+	if (val == 0) {
+		/*
+		 * The sensor sometime can read a value 0 if there is
+		 * consequtive reads
+		 */
+		*adc_value = bat_data->last_val;
+	} else {
+		if (bat_data->dev->ibat_ccm_enabled)
+			convert_adc_to_ibat_val(bat_data->dev, adc_value,
+				BCL_IBAT_CCM_SCALING_UA * bat_data->dev->ibat_ext_range_factor);
+		else if (bat_data->dev->dig_major >= BCL_GEN3_MAJOR_REV)
+			convert_adc_to_ibat_val(bat_data->dev, adc_value,
+				BCL_IBAT_SCALING_REV4_UA *
+					bat_data->dev->ibat_ext_range_factor);
+		else
+			convert_adc_to_ibat_val(bat_data->dev, adc_value,
+				BCL_IBAT_SCALING_UA * bat_data->dev->ibat_ext_range_factor);
+		bat_data->last_val = *adc_value;
+	}
+	pr_debug("ibat:%d mA ADC:0x%02x\n", bat_data->last_val, val);
+
+bcl_read_exit:
+	return ret;
+}
+
+static struct thermal_trip *bcl_get_vbat_trip(struct bcl_peripheral_data *bat_data)
+{
+	int ret = 0, i;
+	unsigned int val = 0;
+	int16_t addr;
+	struct thermal_trip *zone_trips;
+	int trip;
+
+	zone_trips = kzalloc((sizeof(*zone_trips) * 3), GFP_KERNEL);
+	if (!zone_trips) {
+		ret = -ENOMEM;
+		return NULL;
+	}
+
+
+	for (i = 0; i < 3; i++) {
+		if (i == 0)
+			addr = BCL_VBAT_ADC_LOW;
+		else if (i == 1)
+			addr = BCL_VBAT_COMP_LOW;
+		else
+			addr = BCL_VBAT_COMP_TLOW;
+
+		ret = bcl_read_register(bat_data->dev, addr, &val);
+		if (ret)
+			return NULL;
+
+		if (addr == BCL_VBAT_ADC_LOW) {
+			trip = val;
+			convert_adc_to_vbat_thresh_val(bat_data->dev, &trip);
+			pr_debug("vbat trip: %d mV ADC:0x%02x\n", trip, val);
+		} else {
+			trip = BCL_VBAT_THRESH_BASE + val * 25;
+			if (trip > BCL_VBAT_MAX_MV)
+				trip = BCL_VBAT_MAX_MV;
+			pr_debug("vbat-%s-low trip: %d mV ADC:0x%02x\n",
+					(addr == BCL_VBAT_COMP_LOW) ?
+					"too" : "critical",
+					trip, val);
+		}
+		zone_trips[i].temperature = trip;
+		zone_trips[i].type = THERMAL_TRIP_PASSIVE;
+	}
+	return zone_trips;
+}
+
+static int bcl_read_vbat_tz(struct thermal_zone_device *tzd, int *adc_value)
+{
+	int ret = 0;
+	unsigned int val = 0;
+	struct bcl_peripheral_data *bat_data =
+		(struct bcl_peripheral_data *)tzd->devdata;
+
+	*adc_value = val;
+	ret = bcl_read_register(bat_data->dev, BCL_VBAT_READ, &val);
+	if (ret)
+		goto bcl_read_exit;
+	*adc_value = val;
+	if (*adc_value == BCL_VBAT_NO_READING) {
+		*adc_value = bat_data->last_val;
+	} else {
+		convert_adc_to_vbat_val(adc_value);
+		bat_data->last_val = *adc_value;
+	}
+	pr_debug("vbat:%d mv\n", bat_data->last_val);
+
+bcl_read_exit:
+	return ret;
+}
+
+
+static struct thermal_zone_device_ops vbat_tzd_ops = {
+	.get_temp = bcl_read_vbat_tz,
+};
+
+static struct thermal_zone_params vbat_tzp = {
+	.governor_name = "step_wise",
+	.no_hwmon = true,
+	.sustainable_power = 0,
+	.k_po = 0,
+	.k_pu = 0,
+	.k_i = 0,
+	.k_d = 0,
+	.integral_cutoff = 0,
+	.slope = 1,
+	.offset = 0
+};
+
+static int bcl_get_trend(struct thermal_zone_device *tz, const struct thermal_trip *trips,
+			enum thermal_trend *trend)
+{
+	struct bcl_peripheral_data *bat_data =
+		(struct bcl_peripheral_data *)tz->devdata;
+
+	mutex_lock(&bat_data->state_trans_lock);
+	if (!bat_data->last_val)
+		*trend = THERMAL_TREND_DROPPING;
+	else
+		*trend = THERMAL_TREND_RAISING;
+	mutex_unlock(&bat_data->state_trans_lock);
+
+	return 0;
+}
+
+static int bcl_set_lbat(struct thermal_zone_device *tz, int low, int high)
+{
+	struct bcl_peripheral_data *bat_data =
+		(struct bcl_peripheral_data *)tz->devdata;
+
+	mutex_lock(&bat_data->state_trans_lock);
+
+	if (high == INT_MAX &&
+		bat_data->irq_num && bat_data->irq_enabled) {
+		disable_irq_nosync(bat_data->irq_num);
+		disable_irq_wake(bat_data->irq_num);
+		bat_data->irq_enabled = false;
+		pr_debug("lbat[%d]: disable irq:%d\n",
+				bat_data->type,
+				bat_data->irq_num);
+	} else if (high != INT_MAX &&
+		bat_data->irq_num && !bat_data->irq_enabled) {
+		enable_irq(bat_data->irq_num);
+		enable_irq_wake(bat_data->irq_num);
+		bat_data->irq_enabled = true;
+		pr_debug("lbat[%d]: enable irq:%d\n",
+				bat_data->type,
+				bat_data->irq_num);
+	}
+
+	mutex_unlock(&bat_data->state_trans_lock);
+
+	return 0;
+}
+
+static int bcl_read_lbat(struct thermal_zone_device *tz, int *adc_value)
+{
+	int ret = 0;
+	int ibat = 0, vbat = 0;
+	unsigned int val = 0;
+	struct bcl_peripheral_data *bat_data =
+		(struct bcl_peripheral_data *)tz->devdata;
+	struct bcl_device *bcl_perph = bat_data->dev;
+
+	*adc_value = val;
+	ret = bcl_read_register(bcl_perph, BCL_IRQ_STATUS, &val);
+	if (ret)
+		goto bcl_read_exit;
+	switch (bat_data->type) {
+	case BCL_LVL0:
+		*adc_value = val & BCL_IRQ_L0;
+		break;
+	case BCL_LVL1:
+		*adc_value = val & BCL_IRQ_L1;
+		break;
+	case BCL_LVL2:
+		*adc_value = val & BCL_IRQ_L2;
+		break;
+	default:
+		pr_err("Invalid sensor type:%d\n", bat_data->type);
+		ret = -ENODEV;
+		goto bcl_read_exit;
+	}
+	bat_data->last_val = *adc_value;
+	pr_debug("lbat:%d val:%d\n", bat_data->type,
+			bat_data->last_val);
+	if (bcl_perph->param[BCL_IBAT_LVL0].tz_dev)
+		bcl_read_ibat(bcl_perph->param[BCL_IBAT_LVL0].tz_dev, &ibat);
+	else if (bcl_perph->param[BCL_2S_IBAT_LVL0].tz_dev)
+		bcl_read_ibat(bcl_perph->param[BCL_2S_IBAT_LVL0].tz_dev, &ibat);
+	if (bcl_perph->param[BCL_VBAT_LVL0].tz_dev)
+		bcl_read_vbat_tz(bcl_perph->param[BCL_VBAT_LVL0].tz_dev, &vbat);
+
+bcl_read_exit:
+	return ret;
+}
+
+static irqreturn_t bcl_handle_irq(int irq, void *data)
+{
+	struct bcl_peripheral_data *perph_data =
+		(struct bcl_peripheral_data *)data;
+	unsigned int irq_status = 0;
+	int ibat = 0, vbat = 0;
+	struct bcl_device *bcl_perph;
+
+	if (!perph_data->tz_dev)
+		return IRQ_HANDLED;
+	bcl_perph = perph_data->dev;
+	bcl_read_register(bcl_perph, BCL_IRQ_STATUS, &irq_status);
+	if (bcl_perph->param[BCL_IBAT_LVL0].tz_dev)
+		bcl_read_ibat(bcl_perph->param[BCL_IBAT_LVL0].tz_dev, &ibat);
+	else if (bcl_perph->param[BCL_2S_IBAT_LVL0].tz_dev)
+		bcl_read_ibat(bcl_perph->param[BCL_2S_IBAT_LVL0].tz_dev, &ibat);
+	if (bcl_perph->param[BCL_VBAT_LVL0].tz_dev)
+		bcl_read_vbat_tz(bcl_perph->param[BCL_VBAT_LVL0].tz_dev, &vbat);
+
+	if (irq_status & perph_data->status_bit_idx) {
+		pr_debug(
+		"Irq:%d triggered for bcl type:%s. status:%u ibat=%d vbat=%d\n",
+			irq, bcl_int_names[perph_data->type],
+			irq_status, ibat, vbat);
+		thermal_zone_device_update(perph_data->tz_dev,
+				THERMAL_TRIP_VIOLATED);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int bcl_get_ibat_ext_range_factor(struct platform_device *pdev,
+		uint32_t *ibat_range_factor)
+{
+	int ret = 0;
+	const char *name;
+	struct nvmem_cell *cell;
+	size_t len;
+	char *buf;
+	uint32_t ext_range_index = 0;
+
+	ret = of_property_read_string(pdev->dev.of_node, "nvmem-cell-names", &name);
+	if (ret) {
+		*ibat_range_factor = bcl_ibat_ext_ranges[BCL_IBAT_RANGE_LVL0];
+		pr_debug("Default ibat range factor enabled %u\n", *ibat_range_factor);
+		return 0;
+	}
+
+	cell = nvmem_cell_get(&pdev->dev, name);
+	if (IS_ERR(cell)) {
+		dev_err(&pdev->dev, "failed to get nvmem cell %s\n", name);
+		return PTR_ERR(cell);
+	}
+
+	buf = nvmem_cell_read(cell, &len);
+	nvmem_cell_put(cell);
+	if (IS_ERR_OR_NULL(buf)) {
+		dev_err(&pdev->dev, "failed to read nvmem cell %s\n", name);
+		return PTR_ERR(buf);
+	}
+
+	if (len <= 0 || len > sizeof(uint32_t)) {
+		dev_err(&pdev->dev, "nvmem cell length out of range %zu\n", len);
+		kfree(buf);
+		return -EINVAL;
+	}
+	memcpy(&ext_range_index, buf, min(len, sizeof(ext_range_index)));
+	kfree(buf);
+
+	if (ext_range_index >= BCL_IBAT_RANGE_MAX) {
+		dev_err(&pdev->dev, "invalid BCL ibat scaling factor %d\n", ext_range_index);
+		return -EINVAL;
+	}
+
+	*ibat_range_factor = bcl_ibat_ext_ranges[ext_range_index];
+	pr_debug("ext_range_index %u, ibat range factor %u\n",
+			ext_range_index, *ibat_range_factor);
+
+	return 0;
+}
+
+static int bcl_get_devicetree_data(struct platform_device *pdev,
+					struct bcl_device *bcl_perph)
+{
+	int ret = 0;
+	const __be32 *prop = NULL;
+	struct device_node *dev_node = pdev->dev.of_node;
+
+	prop = of_get_address(dev_node, 0, NULL, NULL);
+	if (prop) {
+		bcl_perph->fg_bcl_addr = be32_to_cpu(*prop);
+		pr_debug("fg_bcl@%04x\n", bcl_perph->fg_bcl_addr);
+	} else {
+		dev_err(&pdev->dev, "No fg_bcl registers found\n");
+		return -ENODEV;
+	}
+
+	bcl_perph->ibat_use_qg_adc =  of_property_read_bool(dev_node,
+				"qcom,ibat-use-qg-adc-5a");
+	bcl_perph->no_bit_shift =  of_property_read_bool(dev_node,
+				"qcom,pmic7-threshold");
+	bcl_perph->ibat_ccm_enabled =  of_property_read_bool(dev_node,
+						"qcom,ibat-ccm-hw-support");
+
+	ret = bcl_get_ibat_ext_range_factor(pdev,
+					&bcl_perph->ibat_ext_range_factor);
+
+	return ret;
+}
+
+static void bcl_fetch_trip(struct platform_device *pdev, enum bcl_dev_type type,
+		struct bcl_peripheral_data *data,
+		irqreturn_t (*handle)(int, void *))
+{
+	int ret = 0, irq_num = 0;
+	char *int_name = bcl_int_names[type];
+
+	mutex_lock(&data->state_trans_lock);
+	data->irq_num = 0;
+	data->irq_enabled = false;
+	irq_num = platform_get_irq_byname(pdev, int_name);
+	if (irq_num > 0 && handle) {
+		ret = devm_request_threaded_irq(&pdev->dev,
+				irq_num, NULL, handle,
+				IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+				int_name, data);
+		if (ret) {
+			dev_err(&pdev->dev,
+				"Error requesting trip irq. err:%d\n",
+				ret);
+			mutex_unlock(&data->state_trans_lock);
+			return;
+		}
+		disable_irq_nosync(irq_num);
+		data->irq_num = irq_num;
+	} else if (irq_num > 0 && !handle) {
+		disable_irq_nosync(irq_num);
+		data->irq_num = irq_num;
+	}
+	mutex_unlock(&data->state_trans_lock);
+}
+
+static void bcl_vbat_init(struct platform_device *pdev,
+		enum bcl_dev_type type, struct bcl_device *bcl_perph)
+{
+	struct bcl_peripheral_data *vbat = &bcl_perph->param[type];
+	unsigned int val = 0;
+	int ret;
+
+	mutex_init(&vbat->state_trans_lock);
+	vbat->dev = bcl_perph;
+	vbat->irq_num = 0;
+	vbat->irq_enabled = false;
+	vbat->tz_dev = NULL;
+
+	/* If revision 4 or above && bcl support adc, then only enable vbat */
+	if (bcl_perph->dig_major >= BCL_GEN3_MAJOR_REV) {
+		if (!(bcl_perph->bcl_param_1 & BCL_PARAM_HAS_ADC))
+			return;
+	} else {
+		ret = bcl_read_register(bcl_perph, BCL_VBAT_CONV_REQ, &val);
+		if (ret || !val)
+			return;
+	}
+	vbat->tz_dev = thermal_zone_device_register_with_trips("vbat",
+			bcl_get_vbat_trip(vbat), 3, 0, vbat,
+			&vbat_tzd_ops, &vbat_tzp, 0, 0);
+	if (IS_ERR(vbat->tz_dev)) {
+		pr_debug("vbat[%s] register failed. err:%ld\n",
+				bcl_int_names[type],
+				PTR_ERR(vbat->tz_dev));
+		vbat->tz_dev = NULL;
+		return;
+	}
+
+	ret = thermal_zone_device_enable(vbat->tz_dev);
+	if (ret) {
+		thermal_zone_device_unregister(vbat->tz_dev);
+		vbat->tz_dev = NULL;
+	}
+}
+
+static void bcl_probe_vbat(struct platform_device *pdev,
+					struct bcl_device *bcl_perph)
+{
+	bcl_vbat_init(pdev, BCL_VBAT_LVL0, bcl_perph);
+}
+
+static void bcl_ibat_init(struct platform_device *pdev,
+			enum bcl_dev_type type, struct bcl_device *bcl_perph)
+{
+	struct bcl_peripheral_data *ibat = &bcl_perph->param[type];
+
+	mutex_init(&ibat->state_trans_lock);
+	ibat->type = type;
+	ibat->dev = bcl_perph;
+	ibat->irq_num = 0;
+	ibat->irq_enabled = false;
+	ibat->ops.get_temp = bcl_read_ibat;
+	ibat->ops.set_trips = bcl_set_ibat;
+	ibat->tz_dev = devm_thermal_of_zone_register(&pdev->dev,
+				type, ibat, &ibat->ops);
+	if (IS_ERR(ibat->tz_dev)) {
+		pr_debug("ibat:[%s] register failed. err:%ld\n",
+				bcl_int_names[type],
+				PTR_ERR(ibat->tz_dev));
+		ibat->tz_dev = NULL;
+		return;
+	}
+	thermal_zone_device_update(ibat->tz_dev, THERMAL_DEVICE_UP);
+}
+
+static int bcl_get_ibat_config(struct platform_device *pdev,
+		uint32_t *ibat_config)
+{
+	int ret = 0;
+	const char *name;
+	struct nvmem_cell *cell;
+	size_t len;
+	char *buf;
+
+	ret = of_property_read_string(pdev->dev.of_node, "nvmem-cell-names", &name);
+	if (ret) {
+		*ibat_config = 0;
+		pr_debug("Default ibat config enabled %u\n", *ibat_config);
+		return 0;
+	}
+
+	cell = nvmem_cell_get(&pdev->dev, name);
+	if (IS_ERR(cell)) {
+		dev_err(&pdev->dev, "failed to get nvmem cell %s\n", name);
+		return PTR_ERR(cell);
+	}
+
+	buf = nvmem_cell_read(cell, &len);
+	nvmem_cell_put(cell);
+	if (IS_ERR_OR_NULL(buf)) {
+		dev_err(&pdev->dev, "failed to read nvmem cell %s\n", name);
+		return PTR_ERR(buf);
+	}
+
+	if (len <= 0 || len > sizeof(uint32_t)) {
+		dev_err(&pdev->dev, "nvmem cell length out of range %zu\n", len);
+		kfree(buf);
+		return -EINVAL;
+	}
+	memcpy(ibat_config, buf, min(len, sizeof(*ibat_config)));
+	kfree(buf);
+
+	return 0;
+}
+static void bcl_probe_ibat(struct platform_device *pdev,
+					struct bcl_device *bcl_perph)
+{
+	uint32_t bcl_config = 0;
+
+	bcl_get_ibat_config(pdev, &bcl_config);
+
+	if (bcl_config == 1) {
+		bcl_ibat_init(pdev, BCL_2S_IBAT_LVL0, bcl_perph);
+		bcl_ibat_init(pdev, BCL_2S_IBAT_LVL1, bcl_perph);
+	} else {
+		bcl_ibat_init(pdev, BCL_IBAT_LVL0, bcl_perph);
+		bcl_ibat_init(pdev, BCL_IBAT_LVL1, bcl_perph);
+	}
+}
+
+static void bcl_lvl_init(struct platform_device *pdev,
+	enum bcl_dev_type type, int sts_bit_idx, struct bcl_device *bcl_perph)
+{
+	struct bcl_peripheral_data *lbat = &bcl_perph->param[type];
+
+	mutex_init(&lbat->state_trans_lock);
+	lbat->type = type;
+	lbat->dev = bcl_perph;
+	lbat->status_bit_idx = sts_bit_idx;
+	bcl_fetch_trip(pdev, type, lbat, bcl_handle_irq);
+	if (lbat->irq_num <= 0)
+		return;
+
+	lbat->ops.get_temp = bcl_read_lbat;
+	lbat->ops.set_trips = bcl_set_lbat;
+	lbat->ops.get_trend = bcl_get_trend;
+
+	lbat->tz_dev = devm_thermal_of_zone_register(&pdev->dev,
+				type, lbat, &lbat->ops);
+	if (IS_ERR(lbat->tz_dev)) {
+		pr_debug("lbat:[%s] register failed. err:%ld\n",
+				bcl_int_names[type],
+				PTR_ERR(lbat->tz_dev));
+		lbat->tz_dev = NULL;
+		return;
+	}
+	thermal_zone_device_update(lbat->tz_dev, THERMAL_DEVICE_UP);
+}
+
+static void bcl_probe_lvls(struct platform_device *pdev,
+					struct bcl_device *bcl_perph)
+{
+	bcl_lvl_init(pdev, BCL_LVL0, BCL_IRQ_L0, bcl_perph);
+	bcl_lvl_init(pdev, BCL_LVL1, BCL_IRQ_L1, bcl_perph);
+	bcl_lvl_init(pdev, BCL_LVL2, BCL_IRQ_L2, bcl_perph);
+}
+
+static int bcl_version_init(struct bcl_device *bcl_perph)
+{
+	int ret = 0;
+	unsigned int val = 0;
+
+	ret = bcl_read_register(bcl_perph, BCL_REVISION2, &val);
+	if (ret < 0)
+		return ret;
+
+	bcl_perph->dig_major = val;
+	ret = bcl_read_register(bcl_perph, BCL_REVISION1, &val);
+	if (ret >= 0)
+		bcl_perph->dig_minor = val;
+
+	if (bcl_perph->dig_major >= BCL_GEN3_MAJOR_REV) {
+		ret = bcl_read_register(bcl_perph, BCL_PARAM_1, &val);
+		if (ret < 0)
+			return ret;
+		bcl_perph->bcl_param_1 = val;
+
+		val = 0;
+		bcl_read_register(bcl_perph, BCL_PARAM_2, &val);
+		bcl_perph->bcl_type = val;
+	} else {
+		bcl_perph->bcl_param_1 = 0;
+		bcl_perph->bcl_type = 0;
+	}
+
+	return 0;
+}
+
+static void bcl_configure_bcl_peripheral(struct bcl_device *bcl_perph)
+{
+	bcl_write_register(bcl_perph, BCL_MONITOR_EN, BIT(7));
+}
+
+static int bcl_remove(struct platform_device *pdev)
+{
+	int i = 0;
+	struct bcl_device *bcl_perph =
+		(struct bcl_device *)dev_get_drvdata(&pdev->dev);
+
+	for (; i < BCL_TYPE_MAX; i++) {
+		if (!bcl_perph->param[i].tz_dev)
+			continue;
+	}
+
+	return 0;
+}
+
+static int bcl_probe(struct platform_device *pdev)
+{
+	struct bcl_device *bcl_perph = NULL;
+	char bcl_name[40];
+	int err = 0;
+
+	if (bcl_device_ct >= MAX_PERPH_COUNT) {
+		dev_err(&pdev->dev, "Max bcl peripheral supported already.\n");
+		return -EINVAL;
+	}
+	bcl_devices[bcl_device_ct] = devm_kzalloc(&pdev->dev,
+					sizeof(*bcl_devices[0]), GFP_KERNEL);
+	if (!bcl_devices[bcl_device_ct])
+		return -ENOMEM;
+	bcl_perph = bcl_devices[bcl_device_ct];
+	bcl_perph->dev = &pdev->dev;
+
+	bcl_perph->regmap = dev_get_regmap(pdev->dev.parent, NULL);
+	if (!bcl_perph->regmap) {
+		dev_err(&pdev->dev, "Couldn't get parent's regmap\n");
+		return -EINVAL;
+	}
+
+	bcl_device_ct++;
+	err = bcl_get_devicetree_data(pdev, bcl_perph);
+	if (err) {
+		bcl_device_ct--;
+		return err;
+	}
+	err = bcl_version_init(bcl_perph);
+	if (err) {
+		bcl_device_ct--;
+		return err;
+	}
+	bcl_probe_vbat(pdev, bcl_perph);
+	bcl_probe_ibat(pdev, bcl_perph);
+	bcl_probe_lvls(pdev, bcl_perph);
+	bcl_configure_bcl_peripheral(bcl_perph);
+
+	dev_set_drvdata(&pdev->dev, bcl_perph);
+
+	snprintf(bcl_name, sizeof(bcl_name), "bcl_0x%04x_%d",
+					bcl_perph->fg_bcl_addr,
+					bcl_device_ct - 1);
+
+	return 0;
+}
+
+static const struct of_device_id bcl_match[] = {
+	{
+		.compatible = "qcom,bcl-v5",
+	},
+	{},
+};
+
+static struct platform_driver bcl_driver = {
+	.probe  = bcl_probe,
+	.remove = bcl_remove,
+	.driver = {
+		.name           = BCL_DRIVER_NAME,
+		.of_match_table = bcl_match,
+	},
+};
+
+module_platform_driver(bcl_driver);
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/lmh.c
+++ linux-qcom-6.8.0/drivers/thermal/qcom/lmh.c
@@ -73,7 +73,14 @@
 static int lmh_irq_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw)
 {
 	struct lmh_hw_data *lmh_data = d->host_data;
+	static struct lock_class_key lmh_lock_key;
+	static struct lock_class_key lmh_request_key;
 
+	/*
+	 * This lock class tells lockdep that GPIO irqs are in a different
+	 * category than their parents, so it won't report false recursion.
+	 */
+	irq_set_lockdep_class(irq, &lmh_lock_key, &lmh_request_key);
 	irq_set_chip_and_handler(irq, &lmh_irq_chip, handle_simple_irq);
 	irq_set_chip_data(irq, lmh_data);
 
@@ -95,6 +102,9 @@
 	unsigned int enable_alg;
 	u32 node_id;
 
+	if (!qcom_scm_is_available())
+		return -EPROBE_DEFER;
+
 	lmh_data = devm_kzalloc(dev, sizeof(*lmh_data), GFP_KERNEL);
 	if (!lmh_data)
 		return -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/qcom-spmi-mbg-tm.c
+++ linux-qcom-6.8.0/drivers/thermal/qcom/qcom-spmi-mbg-tm.c
@@ -0,0 +1,264 @@
+// SPDX-License-Identifier: GPL-2.0-only
+//Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <linux/thermal.h>
+#include <linux/iio/consumer.h>
+
+#include "../thermal_core.h"
+
+#define MBG_TEMP_MON_MM_MON2_FAULT_STATUS 0x50
+
+#define MON_FAULT_STATUS_MASK	GENMASK(7, 6)
+#define MON_FAULT_STATUS_SHIFT	6
+#define MON2_LVL1_ERR		0x1
+
+#define MON2_LVL1_UP_THRESH	0x59
+
+#define MBG_TEMP_MON_MM_MON2_MISC_CFG	0x5f
+#define UP_THRESH_EN			BIT(1)
+
+#define STEP_MV				8
+#define MBG_DEFAULT_TEMP_MV		600
+#define MBG_TEMP_CONSTANT		1000
+
+struct mbg_tm_chip {
+	struct regmap			*map;
+	struct device			*dev;
+	struct thermal_zone_device	*tz_dev;
+	struct mutex                    lock;
+	unsigned int			base;
+	int				irq;
+	int				last_temp;
+	bool				last_temp_set;
+	struct iio_channel		*adc;
+};
+
+struct mbg_map_table {
+	int min_temp;
+	int max_temp;
+	int vtemp0;
+	int tc;
+	int t0;
+};
+
+static const struct mbg_map_table map_table[] = {
+	/* minT	maxT	vtemp0	tc	t0 */
+	{ -60000, -40000, 4337, 1967, -60000 },
+	{ -40000, -20000, 4731, 1964, -40000 },
+	{ -20000, 0, 5124, 1957, -20000  },
+	{ 0, 20000, 5515, 1949, 0 },
+	{ 20000, 40000, 5905, 1940, 20000 },
+	{ 40000, 60000, 6293, 1930, 40000 },
+	{ 60000, 80000, 6679, 1921, 60000 },
+	{ 80000, 100000, 7064, 1910, 80000 },
+	{ 100000, 120000, 7446, 1896, 100000 },
+	{ 120000, 140000, 7825, 1878, 120000 },
+	{ 140000, 160000, 8201, 1859, 140000 },
+};
+
+static int mbg_tm_read(struct mbg_tm_chip *chip, u16 addr, int *data)
+{
+	return regmap_read(chip->map, chip->base + addr, data);
+}
+
+static int mbg_tm_write(struct mbg_tm_chip *chip, u16 addr, int data)
+{
+	return regmap_write(chip->map, chip->base + addr, data);
+}
+
+static int mbg_tm_reg_update(struct mbg_tm_chip *chip, u16 addr, u8 mask, u8 val)
+{
+	return regmap_write_bits(chip->map, chip->base + addr, mask, val);
+}
+
+static int mbg_tm_get_temp(struct thermal_zone_device *tz, int *temp)
+{
+	struct mbg_tm_chip *chip = thermal_zone_device_priv(tz);
+	int ret, milli_celsius;
+
+	if (!temp)
+		return -EINVAL;
+
+	if (chip->last_temp_set) {
+		pr_debug("last_temp: %d\n", chip->last_temp);
+		chip->last_temp_set = false;
+		*temp = chip->last_temp;
+		return 0;
+	}
+
+	ret = iio_read_channel_processed(chip->adc, &milli_celsius);
+	if (ret < 0) {
+		dev_err(chip->dev, "failed to read iio channel %d\n", ret);
+		return ret;
+	}
+
+	*temp = milli_celsius;
+
+	return 0;
+}
+
+static int temp_to_vtemp(int temp)
+{
+
+	int idx, vtemp, tc = 0, t0 = 0, vtemp0 = 0;
+
+	for (idx = 0; idx < ARRAY_SIZE(map_table); idx++)
+		if (temp >= map_table[idx].min_temp &&
+				temp < map_table[idx].max_temp) {
+			tc = map_table[idx].tc;
+			t0 = map_table[idx].t0;
+			vtemp0 = map_table[idx].vtemp0;
+			break;
+		}
+
+	/*
+	 * Formula to calculate vtemp from a given temp
+	 * vtemp = (t - t0) * tc + vtemp0
+	 * tc, t0 and vtemp0 values are mentioned in the map_table array.
+	 */
+	vtemp = (temp - t0) / 1000 * tc / 1000 + vtemp0 / 10;
+
+	return abs(vtemp - MBG_DEFAULT_TEMP_MV) / STEP_MV;
+}
+
+static int mbg_tm_set_trip_temp(struct thermal_zone_device *tz, int trip_id, int temp)
+{
+	struct mbg_tm_chip *chip = thermal_zone_device_priv(tz);
+	int ret = 0, vtemp = 0;
+
+	mutex_lock(&chip->lock);
+
+	if (temp != INT_MAX) {
+		mbg_tm_reg_update(chip, MBG_TEMP_MON_MM_MON2_MISC_CFG,
+					 UP_THRESH_EN, UP_THRESH_EN);
+		vtemp = temp_to_vtemp(temp);
+		ret = mbg_tm_write(chip, MON2_LVL1_UP_THRESH, vtemp);
+		if (ret < 0) {
+			mutex_unlock(&chip->lock);
+			return ret;
+		}
+	} else {
+		mbg_tm_reg_update(chip, MBG_TEMP_MON_MM_MON2_MISC_CFG,
+					UP_THRESH_EN, 0);
+	}
+
+	mutex_unlock(&chip->lock);
+
+	/*
+	 * Configure the last_temp one degree higher, to ensure the
+	 * violated temp is returned to thermal framework after the
+	 * violation happens. This is needed to account for the
+	 * inaccuracy in the conversion formula used which leads
+	 * to the thermal framework setting back the same thresholds
+	 * in case the temperature it reads does not show violation.
+	 */
+	chip->last_temp = temp + MBG_TEMP_CONSTANT;
+
+	return ret;
+}
+
+static const struct thermal_zone_device_ops mbg_tm_ops = {
+	.get_temp = mbg_tm_get_temp,
+	.set_trips = mbg_tm_set_trip_temp,
+};
+
+static irqreturn_t mbg_tm_isr(int irq, void *data)
+{
+	struct mbg_tm_chip *chip = data;
+	int ret;
+	int val = 0;
+
+	mutex_lock(&chip->lock);
+
+	ret = mbg_tm_read(chip, MBG_TEMP_MON_MM_MON2_FAULT_STATUS, &val);
+
+	mutex_unlock(&chip->lock);
+
+	if (ret < 0)
+		return IRQ_HANDLED;
+
+	val &= MON_FAULT_STATUS_MASK;
+	if ((val >> MON_FAULT_STATUS_SHIFT) & MON2_LVL1_ERR) {
+		chip->last_temp_set = true;
+		thermal_zone_device_update(chip->tz_dev,
+					THERMAL_TRIP_VIOLATED);
+		pr_debug("Notifying Thermal, val=%d\n", val);
+	} else {
+		pr_debug("High trip not violated, ignoring IRQ\n");
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int mbg_tm_probe(struct platform_device *pdev)
+{
+	struct mbg_tm_chip *chip;
+	struct device_node *node;
+	u32 res;
+	int ret = 0;
+
+	node = pdev->dev.of_node;
+
+	chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
+	if (!chip)
+		return -ENOMEM;
+
+	chip->dev = &pdev->dev;
+
+	mutex_init(&chip->lock);
+
+	chip->map = dev_get_regmap(pdev->dev.parent, NULL);
+	if (!chip->map)
+		return -ENXIO;
+
+	ret = of_property_read_u32(node, "reg", &res);
+	if (ret < 0)
+		return ret;
+
+	chip->base = res;
+
+	chip->irq = platform_get_irq(pdev, 0);
+	if (chip->irq < 0)
+		return chip->irq;
+
+	chip->adc = devm_iio_channel_get(&pdev->dev, "thermal");
+	if (IS_ERR(chip->adc))
+		return PTR_ERR(chip->adc);
+
+	chip->tz_dev = devm_thermal_of_zone_register(&pdev->dev,
+				 0, chip, &mbg_tm_ops);
+	if (IS_ERR(chip->tz_dev)) {
+		dev_err(&pdev->dev, "failed to register sensor\n");
+		return PTR_ERR(chip->tz_dev);
+	}
+
+	ret = devm_request_threaded_irq(&pdev->dev, chip->irq, NULL,
+			mbg_tm_isr, IRQF_ONESHOT, node->name, chip);
+
+	return ret;
+}
+
+static const struct of_device_id mbg_tm_match_table[] = {
+	{ .compatible = "qcom,spmi-mgb-tm" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, mbg_tm_match_table);
+
+static struct platform_driver mbg_tm_driver = {
+	.driver = {
+		.name = "qcom-spmi-mbg-tm",
+		.of_match_table = mbg_tm_match_table,
+	},
+	.probe  = mbg_tm_probe,
+};
+module_platform_driver(mbg_tm_driver);
+
+MODULE_DESCRIPTION("PMIC MBG Temperature monitor driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/qmi-cooling.c
+++ linux-qcom-6.8.0/drivers/thermal/qcom/qmi-cooling.c
@@ -0,0 +1,504 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2017, The Linux Foundation
+ * Copyright (c) 2023, Linaro Limited
+ *
+ * QMI Thermal Mitigation Device (TMD) client driver.
+ * This driver provides an in-kernel client to handle hot and cold thermal
+ * mitigations for remote subsystems (modem and DSPs) running the TMD service.
+ * It doesn't implement any handling of reports from remote subsystems.
+ */
+
+#include <linux/cleanup.h>
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/net.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/remoteproc/qcom_rproc.h>
+#include <linux/slab.h>
+#include <linux/soc/qcom/qmi.h>
+#include <linux/thermal.h>
+
+#include "qmi-cooling.h"
+
+#define MODEM0_INSTANCE_ID	0x0
+#define ADSP_INSTANCE_ID	0x1
+#define CDSP_INSTANCE_ID	0x43
+#define CDSP1_INSTANCE_ID	0x44
+#define SLPI_INSTANCE_ID	0x53
+
+#define QMI_TMD_RESP_TIMEOUT msecs_to_jiffies(100)
+
+/**
+ * struct qmi_instance_id - QMI instance ID and name
+ * @id:		The QMI instance ID
+ * @name:	Friendly name for this instance
+ */
+struct qmi_instance_id {
+	u32 id;
+	const char *name;
+};
+
+/**
+ * struct qmi_tmd_client - TMD client state
+ * @dev:	Device associated with this client
+ * @name:	Friendly name for the remote TMD service
+ * @handle:	QMI connection handle
+ * @mutex:	Lock to synchronise QMI communication
+ * @id:		The QMI TMD service instance ID
+ * @cdev_list:	The list of cooling devices (controls) enabled for this instance
+ * @svc_arrive_work: Work item for initialising the client when the TMD service
+ *		     starts.
+ * @connection_active: Whether or not we're connected to the QMI TMD service
+ */
+struct qmi_tmd_client {
+	struct device *dev;
+	const char *name;
+	struct qmi_handle handle;
+	struct mutex mutex;
+	u32 id;
+	struct list_head cdev_list;
+	struct work_struct svc_arrive_work;
+	bool connection_active;
+};
+
+/**
+ * struct qmi_tmd - A TMD cooling device
+ * @np:		OF node associated with this control
+ * @type:	The control type (exposed via sysfs)
+ * @qmi_name:	The common name of this control shared by the remote subsystem
+ * @cdev:	Thermal framework cooling device handle
+ * @cur_state:	The current cooling/warming/mitigation state
+ * @max_state:	The maximum state
+ * @client:	The TMD client instance this control is associated with
+ */
+struct qmi_tmd {
+	struct device_node *np;
+	const char *type;
+	char qmi_name[QMI_TMD_MITIGATION_DEV_ID_LENGTH_MAX_V01 + 1];
+	struct list_head node;
+	struct thermal_cooling_device *cdev;
+	unsigned int cur_state;
+	unsigned int max_state;
+	struct qmi_tmd_client *client;
+};
+
+/* Notify the remote subsystem of the requested cooling state */
+static int qmi_tmd_send_state_request(struct qmi_tmd *tmd)
+{
+	struct tmd_set_mitigation_level_resp_msg_v01 tmd_resp = { 0 };
+	struct tmd_set_mitigation_level_req_msg_v01 req = { 0 };
+	struct qmi_tmd_client *client;
+	struct qmi_txn txn;
+	int ret = 0;
+
+	client = tmd->client;
+
+	if (!client->connection_active)
+		return 0;
+
+	strscpy(req.mitigation_dev_id.mitigation_dev_id, tmd->qmi_name,
+		QMI_TMD_MITIGATION_DEV_ID_LENGTH_MAX_V01 + 1);
+	req.mitigation_level = tmd->cur_state;
+
+	guard(mutex)(&client->mutex);
+
+	ret = qmi_txn_init(&client->handle, &txn,
+			   tmd_set_mitigation_level_resp_msg_v01_ei, &tmd_resp);
+	if (ret < 0) {
+		dev_err(client->dev, "qmi set state %d txn init failed for %s ret %d\n",
+			tmd->cur_state, tmd->type, ret);
+		return ret;
+	}
+
+	ret = qmi_send_request(&client->handle, NULL, &txn,
+			       QMI_TMD_SET_MITIGATION_LEVEL_REQ_V01,
+			       TMD_SET_MITIGATION_LEVEL_REQ_MSG_V01_MAX_MSG_LEN,
+			       tmd_set_mitigation_level_req_msg_v01_ei, &req);
+	if (ret < 0) {
+		dev_err(client->dev, "qmi set state %d txn send failed for %s ret %d\n",
+			tmd->cur_state, tmd->type, ret);
+		qmi_txn_cancel(&txn);
+		return ret;
+	}
+
+	ret = qmi_txn_wait(&txn, QMI_TMD_RESP_TIMEOUT);
+	if (ret < 0) {
+		dev_err(client->dev, "qmi set state %d txn wait failed for %s ret %d\n",
+			tmd->cur_state, tmd->type, ret);
+		return ret;
+	}
+
+	if (tmd_resp.resp.result != QMI_RESULT_SUCCESS_V01) {
+		ret = -tmd_resp.resp.result;
+		dev_err(client->dev, "qmi set state %d NOT success for %s ret %d\n",
+			tmd->cur_state, tmd->type, ret);
+		return ret;
+	}
+
+	dev_dbg(client->dev, "Requested state %d/%d for %s\n", tmd->cur_state,
+		tmd->max_state, tmd->type);
+
+	return 0;
+}
+
+static int qmi_get_max_state(struct thermal_cooling_device *cdev, unsigned long *state)
+{
+	struct qmi_tmd *tmd = cdev->devdata;
+
+	if (!tmd)
+		return -EINVAL;
+
+	*state = tmd->max_state;
+
+	return 0;
+}
+
+static int qmi_get_cur_state(struct thermal_cooling_device *cdev, unsigned long *state)
+{
+	struct qmi_tmd *tmd = cdev->devdata;
+
+	if (!tmd)
+		return -EINVAL;
+
+	*state = tmd->cur_state;
+
+	return 0;
+}
+
+static int qmi_set_cur_state(struct thermal_cooling_device *cdev, unsigned long state)
+{
+	struct qmi_tmd *tmd = cdev->devdata;
+
+	if (!tmd)
+		return -EINVAL;
+
+	if (state > tmd->max_state)
+		return -EINVAL;
+
+	if (tmd->cur_state == state)
+		return 0;
+
+	tmd->cur_state = state;
+
+	return qmi_tmd_send_state_request(tmd);
+}
+
+static struct thermal_cooling_device_ops qmi_device_ops = {
+	.get_max_state = qmi_get_max_state,
+	.get_cur_state = qmi_get_cur_state,
+	.set_cur_state = qmi_set_cur_state,
+};
+
+static int qmi_register_cooling_device(struct qmi_tmd *tmd)
+{
+	struct thermal_cooling_device *cdev;
+
+	cdev = thermal_of_cooling_device_register(tmd->np, tmd->type, tmd,
+						  &qmi_device_ops);
+
+	if (IS_ERR(cdev))
+		return dev_err_probe(tmd->client->dev, PTR_ERR(cdev),
+				     "Failed to register cooling device %s\n",
+				     tmd->qmi_name);
+
+	tmd->cdev = cdev;
+	return 0;
+}
+
+/*
+ * Init a single TMD control by registering a cooling device for it, or
+ * synchronising state with the remote subsystem if recovering from a service
+ * restart. This is called when the TMD service starts up.
+ */
+static int qmi_tmd_init_control(struct qmi_tmd_client *client, const char *label,
+				u8 max_state)
+{
+	struct qmi_tmd *tmd = NULL;
+
+	list_for_each_entry(tmd, &client->cdev_list, node)
+		if (!strncasecmp(tmd->qmi_name, label,
+				 QMI_TMD_MITIGATION_DEV_ID_LENGTH_MAX_V01 + 1))
+			goto found;
+
+	dev_dbg(client->dev,
+		"TMD '%s' available in firmware but not specified in DT\n",
+		label);
+	return 0;
+
+found:
+	tmd->max_state = max_state;
+	/*
+	 * If the cooling device already exists then the QMI service went away and
+	 * came back. So just make sure the current cooling device state is
+	 * reflected on the remote side and then return.
+	 */
+	if (tmd->cdev)
+		return qmi_tmd_send_state_request(tmd);
+
+	return qmi_register_cooling_device(tmd);
+}
+
+/*
+ * When the QMI service starts up on a remote subsystem this function will fetch
+ * the list of TMDs on the subsystem, match it to the TMDs specified in devicetree
+ * and call qmi_tmd_init_control() for each
+ */
+static void qmi_tmd_svc_arrive(struct work_struct *work)
+{
+	struct qmi_tmd_client *client =
+		container_of(work, struct qmi_tmd_client, svc_arrive_work);
+
+	struct tmd_get_mitigation_device_list_req_msg_v01 req = { 0 };
+	struct tmd_get_mitigation_device_list_resp_msg_v01 *resp __free(kfree);
+	int ret = 0, i;
+	struct qmi_txn txn;
+
+	/* resp struct is 1.1kB, allocate it on the heap. */
+	resp = kzalloc(sizeof(*resp), GFP_KERNEL);
+	if (!resp)
+		return;
+
+	/* Get a list of TMDs supported by the remoteproc */
+	scoped_guard(mutex, &client->mutex) {
+		ret = qmi_txn_init(&client->handle, &txn,
+				tmd_get_mitigation_device_list_resp_msg_v01_ei, resp);
+		if (ret < 0) {
+			dev_err(client->dev,
+				"Transaction init error for instance_id: %#x ret %d\n",
+				client->id, ret);
+			return;
+		}
+
+		ret = qmi_send_request(&client->handle, NULL, &txn,
+				QMI_TMD_GET_MITIGATION_DEVICE_LIST_REQ_V01,
+				TMD_GET_MITIGATION_DEVICE_LIST_REQ_MSG_V01_MAX_MSG_LEN,
+				tmd_get_mitigation_device_list_req_msg_v01_ei, &req);
+		if (ret < 0) {
+			qmi_txn_cancel(&txn);
+			return;
+		}
+
+		ret = qmi_txn_wait(&txn, QMI_TMD_RESP_TIMEOUT);
+		if (ret < 0) {
+			dev_err(client->dev, "Transaction wait error for client %#x ret:%d\n",
+				client->id, ret);
+			return;
+		}
+		if (resp->resp.result != QMI_RESULT_SUCCESS_V01) {
+			ret = resp->resp.result;
+			dev_err(client->dev, "Failed to get device list for client %#x ret:%d\n",
+				client->id, ret);
+			return;
+		}
+	}
+
+	client->connection_active = true;
+
+	for (i = 0; i < resp->mitigation_device_list_len; i++) {
+		struct tmd_mitigation_dev_list_type_v01 *device =
+			&resp->mitigation_device_list[i];
+
+		ret = qmi_tmd_init_control(client,
+					   device->mitigation_dev_id.mitigation_dev_id,
+					   device->max_mitigation_level);
+		if (ret)
+			break;
+	}
+}
+
+static void thermal_qmi_net_reset(struct qmi_handle *qmi)
+{
+	struct qmi_tmd_client *client = container_of(qmi, struct qmi_tmd_client, handle);
+	struct qmi_tmd *tmd = NULL;
+
+	list_for_each_entry(tmd, &client->cdev_list, node) {
+		qmi_tmd_send_state_request(tmd);
+	}
+}
+
+static void thermal_qmi_del_server(struct qmi_handle *qmi, struct qmi_service *service)
+{
+	struct qmi_tmd_client *client = container_of(qmi, struct qmi_tmd_client, handle);
+
+	client->connection_active = false;
+}
+
+static int thermal_qmi_new_server(struct qmi_handle *qmi, struct qmi_service *service)
+{
+	struct qmi_tmd_client *client = container_of(qmi, struct qmi_tmd_client, handle);
+	struct sockaddr_qrtr sq = { AF_QIPCRTR, service->node, service->port };
+
+	scoped_guard(mutex, &client->mutex)
+		kernel_connect(qmi->sock, (struct sockaddr *)&sq, sizeof(sq), 0);
+
+	queue_work(system_highpri_wq, &client->svc_arrive_work);
+
+	return 0;
+}
+
+static struct qmi_ops thermal_qmi_event_ops = {
+	.new_server = thermal_qmi_new_server,
+	.del_server = thermal_qmi_del_server,
+	.net_reset = thermal_qmi_net_reset,
+};
+
+static void qmi_tmd_cleanup(struct qmi_tmd_client *client)
+{
+	struct qmi_tmd *tmd, *c_next;
+
+	client->connection_active = false;
+
+	guard(mutex)(&client->mutex);
+
+	qmi_handle_release(&client->handle);
+	cancel_work(&client->svc_arrive_work);
+	list_for_each_entry_safe(tmd, c_next, &client->cdev_list, node) {
+		if (tmd->cdev)
+			thermal_cooling_device_unregister(tmd->cdev);
+
+		list_del(&tmd->node);
+	}
+}
+
+/* Parse the controls and allocate a qmi_tmd for each of them */
+static int qmi_tmd_alloc_cdevs(struct qmi_tmd_client *client)
+{
+	struct device *dev = client->dev;
+	struct qmi_tmd *tmd;
+	struct device_node *subnode, *node = dev->of_node;
+	int ret;
+
+	for_each_available_child_of_node(node, subnode) {
+		const char *name;
+
+		tmd = devm_kzalloc(dev, sizeof(*tmd), GFP_KERNEL);
+		if (!tmd)
+			return dev_err_probe(client->dev, -ENOMEM,
+					     "Couldn't allocate tmd\n");
+
+		tmd->type = devm_kasprintf(client->dev, GFP_KERNEL, "%s:%s",
+						client->name, subnode->name);
+		if (!tmd->type)
+			return dev_err_probe(dev, -ENOMEM,
+					     "Couldn't allocate cooling device name\n");
+
+		if (of_property_read_string(subnode, "label", &name)) {
+			return dev_err_probe(client->dev, -EINVAL,
+					     "Failed to parse dev name for %s\n",
+					     subnode->name);
+		}
+
+		ret = strscpy(tmd->qmi_name, name,
+			      QMI_TMD_MITIGATION_DEV_ID_LENGTH_MAX_V01 + 1);
+		if (ret == -E2BIG) {
+			return dev_err_probe(dev, -EINVAL, "TMD label %s is too long\n",
+					     name);
+		}
+
+		tmd->client = client;
+		tmd->np = subnode;
+		tmd->cur_state = 0;
+		list_add(&tmd->node, &client->cdev_list);
+	}
+
+	if (list_empty(&client->cdev_list))
+		return dev_err_probe(client->dev, -EINVAL,
+				     "No cooling devices specified for client %s (%#x)\n",
+				     client->name, client->id);
+
+	return 0;
+}
+
+static int qmi_tmd_client_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct qmi_tmd_client *client;
+	const struct qmi_instance_id *match;
+	int ret;
+
+	client = devm_kzalloc(dev, sizeof(*client), GFP_KERNEL);
+	if (!client)
+		return -ENOMEM;
+
+	client->dev = dev;
+
+	match = of_device_get_match_data(dev);
+	if (!match)
+		return dev_err_probe(dev, -EINVAL, "No match data\n");
+
+	client->id = match->id;
+	client->name = match->name;
+
+	mutex_init(&client->mutex);
+	INIT_LIST_HEAD(&client->cdev_list);
+	INIT_WORK(&client->svc_arrive_work, qmi_tmd_svc_arrive);
+
+	ret = qmi_tmd_alloc_cdevs(client);
+	if (ret)
+		return ret;
+
+	platform_set_drvdata(pdev, client);
+
+	ret = qmi_handle_init(&client->handle,
+			      TMD_GET_MITIGATION_DEVICE_LIST_RESP_MSG_V01_MAX_MSG_LEN,
+			      &thermal_qmi_event_ops, NULL);
+	if (ret < 0)
+		return dev_err_probe(client->dev, ret, "QMI handle init failed for client %#x\n",
+			      client->id);
+
+	ret = qmi_add_lookup(&client->handle, TMD_SERVICE_ID_V01, TMD_SERVICE_VERS_V01,
+			     client->id);
+	if (ret < 0) {
+		qmi_handle_release(&client->handle);
+		return dev_err_probe(client->dev, ret, "QMI register failed for client 0x%x\n",
+			      client->id);
+	}
+
+	return 0;
+}
+
+static int qmi_tmd_client_remove(struct platform_device *pdev)
+{
+	struct qmi_tmd_client *client = platform_get_drvdata(pdev);
+
+	qmi_tmd_cleanup(client);
+
+	return 0;
+}
+
+static const struct of_device_id qmi_tmd_device_table[] = {
+	{
+		.compatible = "qcom,qmi-cooling-modem",
+		.data = &((struct qmi_instance_id) { MODEM0_INSTANCE_ID, "modem" }),
+	}, {
+		.compatible = "qcom,qmi-cooling-adsp",
+		.data = &((struct qmi_instance_id) { ADSP_INSTANCE_ID, "adsp" }),
+	}, {
+		.compatible = "qcom,qmi-cooling-cdsp",
+		.data = &((struct qmi_instance_id) { CDSP_INSTANCE_ID, "cdsp" }),
+	}, {
+		.compatible = "qcom,qmi-cooling-cdsp",
+		.data = &((struct qmi_instance_id) { CDSP1_INSTANCE_ID, "cdsp1" }),
+	}, {
+		.compatible = "qcom,qmi-cooling-slpi",
+		.data = &((struct qmi_instance_id) { SLPI_INSTANCE_ID, "slpi" }),
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, qmi_tmd_device_table);
+
+static struct platform_driver qmi_tmd_device_driver = {
+	.probe          = qmi_tmd_client_probe,
+	.remove         = qmi_tmd_client_remove,
+	.driver         = {
+		.name   = "qcom-qmi-cooling",
+		.of_match_table = qmi_tmd_device_table,
+	},
+};
+
+module_platform_driver(qmi_tmd_device_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Qualcomm QMI Thermal Mitigation Device driver");
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/qmi-cooling.h
+++ linux-qcom-6.8.0/drivers/thermal/qcom/qmi-cooling.h
@@ -0,0 +1,428 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017, The Linux Foundation
+ * Copyright (c) 2023, Linaro Limited
+ */
+
+#ifndef __QCOM_COOLING_H__
+#define __QCOM_COOLING_H__
+
+#include <linux/soc/qcom/qmi.h>
+
+#define TMD_SERVICE_ID_V01 0x18
+#define TMD_SERVICE_VERS_V01 0x01
+
+#define QMI_TMD_GET_MITIGATION_DEVICE_LIST_RESP_V01 0x0020
+#define QMI_TMD_GET_MITIGATION_LEVEL_REQ_V01 0x0022
+#define QMI_TMD_GET_SUPPORTED_MSGS_REQ_V01 0x001E
+#define QMI_TMD_SET_MITIGATION_LEVEL_REQ_V01 0x0021
+#define QMI_TMD_REGISTER_NOTIFICATION_MITIGATION_LEVEL_RESP_V01 0x0023
+#define QMI_TMD_GET_SUPPORTED_MSGS_RESP_V01 0x001E
+#define QMI_TMD_SET_MITIGATION_LEVEL_RESP_V01 0x0021
+#define QMI_TMD_DEREGISTER_NOTIFICATION_MITIGATION_LEVEL_RESP_V01 0x0024
+#define QMI_TMD_MITIGATION_LEVEL_REPORT_IND_V01 0x0025
+#define QMI_TMD_GET_MITIGATION_LEVEL_RESP_V01 0x0022
+#define QMI_TMD_GET_SUPPORTED_FIELDS_REQ_V01 0x001F
+#define QMI_TMD_GET_MITIGATION_DEVICE_LIST_REQ_V01 0x0020
+#define QMI_TMD_REGISTER_NOTIFICATION_MITIGATION_LEVEL_REQ_V01 0x0023
+#define QMI_TMD_DEREGISTER_NOTIFICATION_MITIGATION_LEVEL_REQ_V01 0x0024
+#define QMI_TMD_GET_SUPPORTED_FIELDS_RESP_V01 0x001F
+
+#define QMI_TMD_MITIGATION_DEV_ID_LENGTH_MAX_V01 32
+#define QMI_TMD_MITIGATION_DEV_LIST_MAX_V01 32
+
+struct tmd_mitigation_dev_id_type_v01 {
+	char mitigation_dev_id[QMI_TMD_MITIGATION_DEV_ID_LENGTH_MAX_V01 + 1];
+};
+
+static const struct qmi_elem_info tmd_mitigation_dev_id_type_v01_ei[] = {
+	{
+		.data_type = QMI_STRING,
+		.elem_len = QMI_TMD_MITIGATION_DEV_ID_LENGTH_MAX_V01 + 1,
+		.elem_size = sizeof(char),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0,
+		.offset = offsetof(struct tmd_mitigation_dev_id_type_v01,
+				   mitigation_dev_id),
+	},
+	{
+		.data_type = QMI_EOTI,
+		.array_type = NO_ARRAY,
+		.tlv_type = QMI_COMMON_TLV_TYPE,
+	},
+};
+
+struct tmd_mitigation_dev_list_type_v01 {
+	struct tmd_mitigation_dev_id_type_v01 mitigation_dev_id;
+	uint8_t max_mitigation_level;
+};
+
+static const struct qmi_elem_info tmd_mitigation_dev_list_type_v01_ei[] = {
+	{
+		.data_type = QMI_STRUCT,
+		.elem_len = 1,
+		.elem_size = sizeof(struct tmd_mitigation_dev_id_type_v01),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0,
+		.offset = offsetof(struct tmd_mitigation_dev_list_type_v01,
+				   mitigation_dev_id),
+		.ei_array = tmd_mitigation_dev_id_type_v01_ei,
+	},
+	{
+		.data_type = QMI_UNSIGNED_1_BYTE,
+		.elem_len = 1,
+		.elem_size = sizeof(uint8_t),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0,
+		.offset = offsetof(struct tmd_mitigation_dev_list_type_v01,
+				   max_mitigation_level),
+	},
+	{
+		.data_type = QMI_EOTI,
+		.array_type = NO_ARRAY,
+		.tlv_type = QMI_COMMON_TLV_TYPE,
+	},
+};
+
+struct tmd_get_mitigation_device_list_req_msg_v01 {
+	char placeholder;
+};
+
+#define TMD_GET_MITIGATION_DEVICE_LIST_REQ_MSG_V01_MAX_MSG_LEN 0
+const struct qmi_elem_info tmd_get_mitigation_device_list_req_msg_v01_ei[] = {
+	{
+		.data_type = QMI_EOTI,
+		.array_type = NO_ARRAY,
+		.tlv_type = QMI_COMMON_TLV_TYPE,
+	},
+};
+
+struct tmd_get_mitigation_device_list_resp_msg_v01 {
+	struct qmi_response_type_v01 resp;
+	uint8_t mitigation_device_list_valid;
+	uint32_t mitigation_device_list_len;
+	struct tmd_mitigation_dev_list_type_v01
+		mitigation_device_list[QMI_TMD_MITIGATION_DEV_LIST_MAX_V01];
+};
+
+#define TMD_GET_MITIGATION_DEVICE_LIST_RESP_MSG_V01_MAX_MSG_LEN 1099
+static const struct qmi_elem_info tmd_get_mitigation_device_list_resp_msg_v01_ei[] = {
+	{
+		.data_type = QMI_STRUCT,
+		.elem_len = 1,
+		.elem_size = sizeof(struct qmi_response_type_v01),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x02,
+		.offset = offsetof(struct tmd_get_mitigation_device_list_resp_msg_v01,
+				   resp),
+		.ei_array = qmi_response_type_v01_ei,
+	},
+	{
+		.data_type = QMI_OPT_FLAG,
+		.elem_len = 1,
+		.elem_size = sizeof(uint8_t),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x10,
+		.offset = offsetof(struct tmd_get_mitigation_device_list_resp_msg_v01,
+				   mitigation_device_list_valid),
+	},
+	{
+		.data_type = QMI_DATA_LEN,
+		.elem_len = 1,
+		.elem_size = sizeof(uint8_t),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x10,
+		.offset = offsetof(struct tmd_get_mitigation_device_list_resp_msg_v01,
+				   mitigation_device_list_len),
+	},
+	{
+		.data_type = QMI_STRUCT,
+		.elem_len = QMI_TMD_MITIGATION_DEV_LIST_MAX_V01,
+		.elem_size = sizeof(struct tmd_mitigation_dev_list_type_v01),
+		.array_type = VAR_LEN_ARRAY,
+		.tlv_type = 0x10,
+		.offset = offsetof(struct tmd_get_mitigation_device_list_resp_msg_v01,
+				   mitigation_device_list),
+		.ei_array = tmd_mitigation_dev_list_type_v01_ei,
+	},
+	{
+		.data_type = QMI_EOTI,
+		.array_type = NO_ARRAY,
+		.tlv_type = QMI_COMMON_TLV_TYPE,
+	},
+};
+
+struct tmd_set_mitigation_level_req_msg_v01 {
+	struct tmd_mitigation_dev_id_type_v01 mitigation_dev_id;
+	uint8_t mitigation_level;
+};
+
+#define TMD_SET_MITIGATION_LEVEL_REQ_MSG_V01_MAX_MSG_LEN 40
+static const struct qmi_elem_info tmd_set_mitigation_level_req_msg_v01_ei[] = {
+	{
+		.data_type = QMI_STRUCT,
+		.elem_len = 1,
+		.elem_size = sizeof(struct tmd_mitigation_dev_id_type_v01),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x01,
+		.offset = offsetof(struct tmd_set_mitigation_level_req_msg_v01,
+				   mitigation_dev_id),
+		.ei_array = tmd_mitigation_dev_id_type_v01_ei,
+	},
+	{
+		.data_type = QMI_UNSIGNED_1_BYTE,
+		.elem_len = 1,
+		.elem_size = sizeof(uint8_t),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x02,
+		.offset = offsetof(struct tmd_set_mitigation_level_req_msg_v01,
+				   mitigation_level),
+	},
+	{
+		.data_type = QMI_EOTI,
+		.array_type = NO_ARRAY,
+		.tlv_type = QMI_COMMON_TLV_TYPE,
+	},
+};
+
+struct tmd_set_mitigation_level_resp_msg_v01 {
+	struct qmi_response_type_v01 resp;
+};
+
+#define TMD_SET_MITIGATION_LEVEL_RESP_MSG_V01_MAX_MSG_LEN 7
+static const struct qmi_elem_info tmd_set_mitigation_level_resp_msg_v01_ei[] = {
+	{
+		.data_type = QMI_STRUCT,
+		.elem_len = 1,
+		.elem_size = sizeof(struct qmi_response_type_v01),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x02,
+		.offset = offsetof(struct tmd_set_mitigation_level_resp_msg_v01, resp),
+		.ei_array = qmi_response_type_v01_ei,
+	},
+	{
+		.data_type = QMI_EOTI,
+		.array_type = NO_ARRAY,
+		.tlv_type = QMI_COMMON_TLV_TYPE,
+	},
+};
+
+struct tmd_get_mitigation_level_req_msg_v01 {
+	struct tmd_mitigation_dev_id_type_v01 mitigation_device;
+};
+#define TMD_GET_MITIGATION_LEVEL_REQ_MSG_V01_MAX_MSG_LEN 36
+
+static const struct qmi_elem_info tmd_get_mitigation_level_req_msg_v01_ei[] = {
+	{
+		.data_type = QMI_STRUCT,
+		.elem_len = 1,
+		.elem_size = sizeof(struct tmd_mitigation_dev_id_type_v01),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x01,
+		.offset = offsetof(struct tmd_get_mitigation_level_req_msg_v01,
+				   mitigation_device),
+		.ei_array = tmd_mitigation_dev_id_type_v01_ei,
+	},
+	{
+		.data_type = QMI_EOTI,
+		.array_type = NO_ARRAY,
+		.tlv_type = QMI_COMMON_TLV_TYPE,
+	},
+};
+
+struct tmd_get_mitigation_level_resp_msg_v01 {
+	struct qmi_response_type_v01 resp;
+	uint8_t current_mitigation_level_valid;
+	uint8_t current_mitigation_level;
+	uint8_t requested_mitigation_level_valid;
+	uint8_t requested_mitigation_level;
+};
+
+#define TMD_GET_MITIGATION_LEVEL_RESP_MSG_V01_MAX_MSG_LEN 15
+static const struct qmi_elem_info tmd_get_mitigation_level_resp_msg_ei[] = {
+	{
+		.data_type = QMI_STRUCT,
+		.elem_len = 1,
+		.elem_size = sizeof(struct qmi_response_type_v01),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x02,
+		.offset = offsetof(struct tmd_get_mitigation_level_resp_msg_v01, resp),
+		.ei_array = qmi_response_type_v01_ei,
+	},
+	{
+		.data_type = QMI_OPT_FLAG,
+		.elem_len = 1,
+		.elem_size = sizeof(uint8_t),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x10,
+		.offset = offsetof(struct tmd_get_mitigation_level_resp_msg_v01,
+				   current_mitigation_level_valid),
+	},
+	{
+		.data_type = QMI_UNSIGNED_1_BYTE,
+		.elem_len = 1,
+		.elem_size = sizeof(uint8_t),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x10,
+		.offset = offsetof(struct tmd_get_mitigation_level_resp_msg_v01,
+				   current_mitigation_level),
+	},
+	{
+		.data_type = QMI_OPT_FLAG,
+		.elem_len = 1,
+		.elem_size = sizeof(uint8_t),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x11,
+		.offset = offsetof(struct tmd_get_mitigation_level_resp_msg_v01,
+				   requested_mitigation_level_valid),
+	},
+	{
+		.data_type = QMI_UNSIGNED_1_BYTE,
+		.elem_len = 1,
+		.elem_size = sizeof(uint8_t),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x11,
+		.offset = offsetof(struct tmd_get_mitigation_level_resp_msg_v01,
+				   requested_mitigation_level),
+	},
+	{
+		.data_type = QMI_EOTI,
+		.array_type = NO_ARRAY,
+		.tlv_type = QMI_COMMON_TLV_TYPE,
+	},
+};
+
+struct tmd_register_notification_mitigation_level_req_msg_v01 {
+	struct tmd_mitigation_dev_id_type_v01 mitigation_device;
+};
+
+#define TMD_REGISTER_NOTIFICATION_MITIGATION_LEVEL_REQ_MSG_V01_MAX_MSG_LEN 36
+static const struct qmi_elem_info
+	tmd_register_notification_mitigation_level_req_msg_v01_ei[] = {
+		{
+			.data_type = QMI_STRUCT,
+			.elem_len = 1,
+			.elem_size = sizeof(struct tmd_mitigation_dev_id_type_v01),
+			.array_type = NO_ARRAY,
+			.tlv_type = 0x01,
+			.offset = offsetof(
+				struct tmd_register_notification_mitigation_level_req_msg_v01,
+				mitigation_device),
+			.ei_array = tmd_mitigation_dev_id_type_v01_ei,
+		},
+		{
+			.data_type = QMI_EOTI,
+			.array_type = NO_ARRAY,
+			.tlv_type = QMI_COMMON_TLV_TYPE,
+		},
+	};
+
+struct tmd_register_notification_mitigation_level_resp_msg_v01 {
+	struct qmi_response_type_v01 resp;
+};
+
+#define TMD_REGISTER_NOTIFICATION_MITIGATION_LEVEL_RESP_MSG_V01_MAX_MSG_LEN 7
+static const struct qmi_elem_info
+	tmd_register_notification_mitigation_level_resp_msg_v01_ei[] = {
+		{
+			.data_type = QMI_STRUCT,
+			.elem_len = 1,
+			.elem_size = sizeof(struct qmi_response_type_v01),
+			.array_type = NO_ARRAY,
+			.tlv_type = 0x02,
+			.offset = offsetof(
+				struct tmd_register_notification_mitigation_level_resp_msg_v01,
+				resp),
+			.ei_array = qmi_response_type_v01_ei,
+		},
+		{
+			.data_type = QMI_EOTI,
+			.array_type = NO_ARRAY,
+			.tlv_type = QMI_COMMON_TLV_TYPE,
+		},
+	};
+
+struct tmd_deregister_notification_mitigation_level_req_msg_v01 {
+	struct tmd_mitigation_dev_id_type_v01 mitigation_device;
+};
+
+#define TMD_DEREGISTER_NOTIFICATION_MITIGATION_LEVEL_REQ_MSG_V01_MAX_MSG_LEN 36
+static const struct qmi_elem_info
+	tmd_deregister_notification_mitigation_level_req_msg_v01_ei[] = {
+		{
+			.data_type = QMI_STRUCT,
+			.elem_len = 1,
+			.elem_size = sizeof(struct tmd_mitigation_dev_id_type_v01),
+			.array_type = NO_ARRAY,
+			.tlv_type = 0x01,
+			.offset = offsetof(
+				struct tmd_deregister_notification_mitigation_level_req_msg_v01,
+				mitigation_device),
+			.ei_array = tmd_mitigation_dev_id_type_v01_ei,
+		},
+		{
+			.data_type = QMI_EOTI,
+			.array_type = NO_ARRAY,
+			.tlv_type = QMI_COMMON_TLV_TYPE,
+		},
+	};
+
+struct tmd_deregister_notification_mitigation_level_resp_msg_v01 {
+	struct qmi_response_type_v01 resp;
+};
+
+#define TMD_DEREGISTER_NOTIFICATION_MITIGATION_LEVEL_RESP_MSG_V01_MAX_MSG_LEN 7
+static const struct qmi_elem_info
+	tmd_deregister_notification_mitigation_level_resp_msg_v01_ei[] = {
+		{
+			.data_type = QMI_STRUCT,
+			.elem_len = 1,
+			.elem_size = sizeof(struct qmi_response_type_v01),
+			.array_type = NO_ARRAY,
+			.tlv_type = 0x02,
+			.offset = offsetof(
+				struct tmd_deregister_notification_mitigation_level_resp_msg_v01,
+				resp),
+			.ei_array = qmi_response_type_v01_ei,
+		},
+		{
+			.data_type = QMI_EOTI,
+			.array_type = NO_ARRAY,
+			.tlv_type = QMI_COMMON_TLV_TYPE,
+		},
+	};
+
+struct tmd_mitigation_level_report_ind_msg_v01 {
+	struct tmd_mitigation_dev_id_type_v01 mitigation_device;
+	uint8_t current_mitigation_level;
+};
+
+#define TMD_MITIGATION_LEVEL_REPORT_IND_MSG_V01_MAX_MSG_LEN 40
+static const struct qmi_elem_info tmd_mitigation_level_report_ind_msg_v01_ei[] = {
+	{
+		.data_type = QMI_STRUCT,
+		.elem_len = 1,
+		.elem_size = sizeof(struct tmd_mitigation_dev_id_type_v01),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x01,
+		.offset = offsetof(struct tmd_mitigation_level_report_ind_msg_v01,
+				   mitigation_device),
+		.ei_array = tmd_mitigation_dev_id_type_v01_ei,
+	},
+	{
+		.data_type = QMI_UNSIGNED_1_BYTE,
+		.elem_len = 1,
+		.elem_size = sizeof(uint8_t),
+		.array_type = NO_ARRAY,
+		.tlv_type = 0x02,
+		.offset = offsetof(struct tmd_mitigation_level_report_ind_msg_v01,
+				   current_mitigation_level),
+	},
+	{
+		.data_type = QMI_EOTI,
+		.array_type = NO_ARRAY,
+		.tlv_type = QMI_COMMON_TLV_TYPE,
+	},
+};
+
+#endif /* __QMI_COOLING_INTERNAL_H__ */
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/qti_devfreq_cdev.c
+++ linux-qcom-6.8.0/drivers/thermal/qcom/qti_devfreq_cdev.c
@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "%s:%s " fmt, KBUILD_MODNAME, __func__
+
+#include <linux/devfreq.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pm_opp.h>
+#include <linux/pm_qos.h>
+#include <linux/slab.h>
+#include <linux/thermal.h>
+#include <linux/workqueue.h>
+
+#define MAX_RETRY_CNT 20
+#define RETRY_DELAY msecs_to_jiffies(1000)
+#define DEVFREQ_CDEV_NAME "gpu"
+#define DEVFREQ_CDEV "qcom-devfreq-cdev"
+
+struct devfreq_cdev_device {
+	struct device_node *np;
+	struct devfreq *devfreq;
+	struct device *dev;
+	unsigned long *freq_table;
+	int cur_state;
+	int max_state;
+	int retry_cnt;
+	struct dev_pm_qos_request qos_max_freq_req;
+	struct delayed_work register_work;
+	struct thermal_cooling_device *cdev;
+};
+
+static struct devfreq_cdev_device *devfreq_cdev;
+
+static int devfreq_cdev_set_state(struct thermal_cooling_device *cdev,
+					unsigned long state)
+{
+	struct devfreq_cdev_device *cdev_data = cdev->devdata;
+	int ret = 0;
+	unsigned long freq;
+
+	if (state > cdev_data->max_state)
+		return -EINVAL;
+	if (state == cdev_data->cur_state)
+		return 0;
+	freq = cdev_data->freq_table[state];
+	pr_debug("cdev:%s Limit:%lu\n", cdev->type, freq);
+	ret = dev_pm_qos_update_request(&cdev_data->qos_max_freq_req, freq);
+	if (ret < 0) {
+		pr_err("Error placing qos request:%lu. cdev:%s err:%d\n",
+				freq, cdev->type, ret);
+		return ret;
+	}
+	cdev_data->cur_state = state;
+
+	return 0;
+}
+
+static int devfreq_cdev_get_state(struct thermal_cooling_device *cdev,
+					unsigned long *state)
+{
+	struct devfreq_cdev_device *cdev_data = cdev->devdata;
+
+	*state = cdev_data->cur_state;
+	return 0;
+}
+
+static int devfreq_cdev_get_max_state(struct thermal_cooling_device *cdev,
+					unsigned long *state)
+{
+	struct devfreq_cdev_device *cdev_data = cdev->devdata;
+
+	*state = cdev_data->max_state;
+	return 0;
+}
+
+static struct thermal_cooling_device_ops devfreq_cdev_ops = {
+	.set_cur_state = devfreq_cdev_set_state,
+	.get_cur_state = devfreq_cdev_get_state,
+	.get_max_state = devfreq_cdev_get_max_state,
+};
+
+static void devfreq_cdev_work(struct work_struct *work)
+{
+	struct devfreq *df = NULL;
+	unsigned long freq = ULONG_MAX;
+	unsigned long *freq_table;
+	struct dev_pm_opp *opp;
+	int ret = 0, freq_ct, i;
+	struct devfreq_cdev_device *cdev_data = container_of(work,
+						struct devfreq_cdev_device,
+						register_work.work);
+
+	df = devfreq_get_devfreq_by_node(cdev_data->np);
+	if (IS_ERR(df)) {
+		ret = PTR_ERR(df);
+		pr_debug("Devfreq not available:%d\n", ret);
+		if (--cdev_data->retry_cnt)
+			queue_delayed_work(system_highpri_wq,
+					&cdev_data->register_work,
+					RETRY_DELAY);
+		return;
+	}
+
+	cdev_data->dev = df->dev.parent;
+	cdev_data->devfreq = df;
+	freq_ct = dev_pm_opp_get_opp_count(cdev_data->dev);
+	freq_table = kcalloc(freq_ct, sizeof(*freq_table), GFP_KERNEL);
+	if (!freq_table) {
+		ret = -ENOMEM;
+		return;
+	}
+
+	for (i = 0, freq = ULONG_MAX; i < freq_ct; i++, freq--) {
+
+		opp = dev_pm_opp_find_freq_floor(cdev_data->dev, &freq);
+		if (IS_ERR(opp)) {
+			ret = PTR_ERR(opp);
+			goto qos_exit;
+		}
+		dev_pm_opp_put(opp);
+
+		freq_table[i] = DIV_ROUND_UP(freq, 1000); //hz to khz
+		pr_debug("%d. freq table:%lu\n", i, freq_table[i]);
+	}
+	cdev_data->max_state = freq_ct-1;
+	cdev_data->freq_table = freq_table;
+	ret = dev_pm_qos_add_request(cdev_data->dev,
+					&cdev_data->qos_max_freq_req,
+					DEV_PM_QOS_MAX_FREQUENCY,
+					PM_QOS_MAX_FREQUENCY_DEFAULT_VALUE);
+	if (ret < 0)
+		goto qos_exit;
+	cdev_data->cdev = thermal_cooling_device_register(DEVFREQ_CDEV_NAME,
+						cdev_data, &devfreq_cdev_ops);
+	if (IS_ERR(cdev_data->cdev)) {
+		pr_err("Cdev register failed for gpu, ret:%ld\n",
+			PTR_ERR(cdev_data->cdev));
+		cdev_data->cdev = NULL;
+		goto qos_exit;
+	}
+
+	return;
+
+qos_exit:
+	kfree(cdev_data->freq_table);
+	dev_pm_qos_remove_request(&cdev_data->qos_max_freq_req);
+}
+
+static int devfreq_cdev_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+
+	devfreq_cdev = devm_kzalloc(dev, sizeof(*devfreq_cdev), GFP_KERNEL);
+	if (!devfreq_cdev)
+		return -ENOMEM;
+
+	devfreq_cdev->np = of_parse_phandle(pdev->dev.of_node,
+				"qcom,devfreq", 0);
+	devfreq_cdev->retry_cnt = MAX_RETRY_CNT;
+
+	INIT_DEFERRABLE_WORK(&devfreq_cdev->register_work, devfreq_cdev_work);
+	queue_delayed_work(system_highpri_wq, &devfreq_cdev->register_work, 0);
+
+	return 0;
+}
+
+static int devfreq_cdev_remove(struct platform_device *pdev)
+{
+	if (devfreq_cdev->cdev) {
+		thermal_cooling_device_unregister(devfreq_cdev->cdev);
+		dev_pm_qos_remove_request(&devfreq_cdev->qos_max_freq_req);
+		kfree(devfreq_cdev->freq_table);
+		devfreq_cdev->cdev = NULL;
+	}
+
+	return 0;
+}
+
+static const struct of_device_id devfreq_cdev_match[] = {
+	{.compatible = "qcom,devfreq-cdev"},
+	{}
+};
+
+static struct platform_driver devfreq_cdev_driver = {
+	.probe          = devfreq_cdev_probe,
+	.remove         = devfreq_cdev_remove,
+	.driver         = {
+		.name   = DEVFREQ_CDEV,
+		.of_match_table = devfreq_cdev_match,
+	},
+};
+
+static int __init devfreq_cdev_init(void)
+{
+	return platform_driver_register(&devfreq_cdev_driver);
+}
+module_init(devfreq_cdev_init);
+
+static void __exit devfreq_cdev_exit(void)
+{
+	platform_driver_unregister(&devfreq_cdev_driver);
+}
+module_exit(devfreq_cdev_exit);
+
+MODULE_DESCRIPTION("Qualcomm Technologies, Inc. devfreq cooling device driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/tsens-v1.c
+++ linux-qcom-6.8.0/drivers/thermal/qcom/tsens-v1.c
@@ -162,28 +162,35 @@
 	.fields	= tsens_v1_regfields,
 };
 
-static const struct tsens_ops ops_8956 = {
-	.init		= init_8956,
+static const struct tsens_ops ops_common = {
+	.init		= init_common,
 	.calibrate	= tsens_calibrate_common,
 	.get_temp	= get_temp_tsens_valid,
 };
 
-struct tsens_plat_data data_8956 = {
+struct tsens_plat_data data_8937 = {
 	.num_sensors	= 11,
-	.ops		= &ops_8956,
+	.ops		= &ops_common,
 	.feat		= &tsens_v1_feat,
 	.fields		= tsens_v1_regfields,
 };
 
-static const struct tsens_ops ops_8976 = {
-	.init		= init_common,
+static const struct tsens_ops ops_8956 = {
+	.init		= init_8956,
 	.calibrate	= tsens_calibrate_common,
 	.get_temp	= get_temp_tsens_valid,
 };
 
+struct tsens_plat_data data_8956 = {
+	.num_sensors	= 11,
+	.ops		= &ops_8956,
+	.feat		= &tsens_v1_feat,
+	.fields		= tsens_v1_regfields,
+};
+
 struct tsens_plat_data data_8976 = {
 	.num_sensors	= 11,
-	.ops		= &ops_8976,
+	.ops		= &ops_common,
 	.feat		= &tsens_v1_feat,
 	.fields		= tsens_v1_regfields,
 };
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/tsens-v2.c
+++ linux-qcom-6.8.0/drivers/thermal/qcom/tsens-v2.c
@@ -107,6 +107,7 @@
 static const struct tsens_ops ops_generic_v2 = {
 	.init		= init_common,
 	.get_temp	= get_temp_tsens_valid,
+	.resume		= tsens_resume_common,
 };
 
 struct tsens_plat_data data_tsens_v2 = {
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/tsens.c
+++ linux-qcom-6.8.0/drivers/thermal/qcom/tsens.c
@@ -17,6 +17,7 @@
 #include <linux/pm.h>
 #include <linux/regmap.h>
 #include <linux/slab.h>
+#include <linux/suspend.h>
 #include <linux/thermal.h>
 #include "../thermal_hwmon.h"
 #include "tsens.h"
@@ -264,7 +265,7 @@
 	for (i = 0; i < priv->num_sensors; i++) {
 		dev_dbg(priv->dev,
 			"%s: sensor%d - data_point1:%#x data_point2:%#x\n",
-			__func__, i, p1[i], p2[i]);
+			__func__, i, p1[i], p2 ? p2[i] : 0);
 
 		if (!priv->sensor[i].slope)
 			priv->sensor[i].slope = SLOPE_DEFAULT;
@@ -1069,6 +1070,13 @@
 	return ret;
 }
 
+/* WA to add writable trip_temp_*_hyst sysfs node till core has proper fix */
+static int tsens_set_trip_hyst(
+		struct thermal_zone_device *tz, int trip, int hysteresis)
+{
+	return 0;
+};
+
 static int tsens_get_temp(struct thermal_zone_device *tz, int *temp)
 {
 	struct tsens_sensor *s = thermal_zone_device_priv(tz);
@@ -1119,6 +1127,9 @@
 		.compatible = "qcom,msm8916-tsens",
 		.data = &data_8916,
 	}, {
+		.compatible = "qcom,msm8937-tsens",
+		.data = &data_8937,
+	}, {
 		.compatible = "qcom,msm8939-tsens",
 		.data = &data_8939,
 	}, {
@@ -1150,6 +1161,7 @@
 static const struct thermal_zone_device_ops tsens_of_ops = {
 	.get_temp = tsens_get_temp,
 	.set_trips = tsens_set_trips,
+	.set_trip_hyst = tsens_set_trip_hyst,
 };
 
 static int tsens_register_irq(struct tsens_priv *priv, char *irqname,
@@ -1193,11 +1205,124 @@
 	return ret;
 }
 
+#ifdef CONFIG_SUSPEND
+static int tsens_reinit(struct tsens_priv *priv)
+{
+	if (tsens_version(priv) >= VER_2_X) {
+		/*
+		 * Re-enable the watchdog, unmask the bark.
+		 * Disable cycle completion monitoring
+		 */
+		if (priv->feat->has_watchdog) {
+			regmap_field_write(priv->rf[WDOG_BARK_MASK], 0);
+			regmap_field_write(priv->rf[CC_MON_MASK], 1);
+		}
+
+		/* Re-enable interrupts */
+		tsens_enable_irq(priv);
+	}
+
+	return 0;
+}
+
+int tsens_resume_common(struct tsens_priv *priv)
+{
+	if (pm_suspend_target_state == PM_SUSPEND_MEM)
+		tsens_reinit(priv);
+
+	return 0;
+}
+
+#endif /* !CONFIG_SUSPEND */
+
+static void tsens_thermal_zone_trip_update(struct thermal_zone_device *tz,
+					  unsigned long trip_id)
+{
+	struct tsens_sensor *s = thermal_zone_device_priv(tz);
+	struct tsens_priv *priv = s->priv;
+	struct thermal_trip trip;
+	int ret;
+	u32 trip_delta = 0;
+
+	ret = __thermal_zone_get_trip(tz, trip_id, &trip);
+	if (ret) {
+		dev_err(priv->dev, "%s: failed to get trip %ld for %s\n",
+			__func__, trip_id, tz->type);
+		return;
+	}
+
+	if (trip.type == THERMAL_TRIP_CRITICAL)
+		return;
+
+	if (strnstr(tz->type, "cpu", sizeof(tz->type)))
+		trip_delta = TSENS_ELEVATE_CPU_DELTA;
+	else
+		trip_delta = TSENS_ELEVATE_DELTA;
+
+	trip.temperature += trip_delta;
+	ret = thermal_zone_set_trip(tz, trip_id, &trip);
+	if (ret) {
+		dev_err(priv->dev, "%s: failed to set trip %ld for %s\n",
+			__func__, trip_id, tz->type);
+	}
+}
+
+static int tsens_nvmem_trip_update(struct thermal_zone_device *tz)
+{
+	int i, num_trips = 0;
+
+	if (strnstr(tz->type, "mdmss", sizeof(tz->type)))
+		return 0;
+
+	num_trips = thermal_zone_get_num_trips(tz);
+	/* First trip is for userspace, update all other trips. */
+	for (i = 1; i < num_trips; i++) {
+		mutex_lock(&tz->lock);
+		tsens_thermal_zone_trip_update(tz, i);
+		mutex_unlock(&tz->lock);
+	}
+
+	return 0;
+}
+
+static bool tsens_is_nvmem_trip_update_needed(struct tsens_priv *priv)
+{
+	int ret;
+	u32 chipinfo, tsens_jtag;
+	u8 tsens_feat_id;
+
+	if (!of_property_read_bool(priv->dev->of_node, "nvmem-cells"))
+		return false;
+
+	ret = nvmem_cell_read_variable_le_u32(priv->dev,
+			"tsens_chipinfo", &chipinfo);
+	if (ret) {
+		dev_err(priv->dev,
+			"%s: Not able to read tsens_chipinfo nvmem, ret:%d\n",
+			__func__, ret);
+		return false;
+	}
+
+	tsens_jtag = chipinfo & GENMASK(19, 0);
+	tsens_feat_id = (chipinfo >> TSENS_FEAT_OFFSET) & GENMASK(7, 0);
+	dev_dbg(priv->dev, "chipinfo:0x%x tsens_jtag: 0x%x tsens_feat_id:0x%x",
+		chipinfo, tsens_jtag, tsens_feat_id);
+	if ((tsens_jtag == TSENS_CHIP_ID0 && tsens_feat_id == TSENS_FEAT_ID3) ||
+	    (tsens_jtag == TSENS_CHIP_ID1 && tsens_feat_id == TSENS_FEAT_ID4) ||
+	    (tsens_jtag == TSENS_CHIP_ID2 && tsens_feat_id == TSENS_FEAT_ID3) ||
+	    (tsens_jtag == TSENS_CHIP_ID3 && tsens_feat_id == TSENS_FEAT_ID2))
+		return true;
+
+	return false;
+}
+
 static int tsens_register(struct tsens_priv *priv)
 {
 	int i, ret;
 	struct thermal_zone_device *tzd;
 
+	priv->need_trip_update = tsens_is_nvmem_trip_update_needed(priv);
+
 	for (i = 0;  i < priv->num_sensors; i++) {
 		priv->sensor[i].priv = priv;
 		tzd = devm_thermal_of_zone_register(priv->dev, priv->sensor[i].hw_id,
@@ -1209,6 +1334,10 @@
 		if (priv->ops->enable)
 			priv->ops->enable(priv, i);
 
+		/* update tsens trip based on fuse register */
+		if (priv->need_trip_update)
+			ret = tsens_nvmem_trip_update(tzd);
+
 		devm_thermal_add_hwmon_sysfs(priv->dev, tzd);
 	}
 
--- linux-qcom-6.8.0.orig/drivers/thermal/qcom/tsens.h
+++ linux-qcom-6.8.0/drivers/thermal/qcom/tsens.h
@@ -20,6 +20,17 @@
 #define THRESHOLD_MAX_ADC_CODE	0x3ff
 #define THRESHOLD_MIN_ADC_CODE	0x0
 
+#define TSENS_FEAT_OFFSET	20
+#define TSENS_CHIP_ID0		0x197
+#define TSENS_CHIP_ID1		0x198
+#define TSENS_CHIP_ID2		0x20e
+#define TSENS_CHIP_ID3		0x20f
+#define TSENS_FEAT_ID2		0x2
+#define TSENS_FEAT_ID3		0x3
+#define TSENS_FEAT_ID4		0x4
+#define TSENS_ELEVATE_DELTA	10000
+#define TSENS_ELEVATE_CPU_DELTA	5000
+
 #define MAX_SENSORS 16
 
 #include <linux/interrupt.h>
@@ -572,6 +583,7 @@
 	struct regmap			*tm_map;
 	struct regmap			*srot_map;
 	u32				tm_offset;
+	bool				need_trip_update;
 
 	/* lock for upper/lower threshold interrupts */
 	spinlock_t			ul_lock;
@@ -634,6 +646,11 @@
 int init_common(struct tsens_priv *priv);
 int get_temp_tsens_valid(const struct tsens_sensor *s, int *temp);
 int get_temp_common(const struct tsens_sensor *s, int *temp);
+#ifdef CONFIG_SUSPEND
+int tsens_resume_common(struct tsens_priv *priv);
+#else
+#define tsens_resume_common            NULL
+#endif
 
 /* TSENS target */
 extern struct tsens_plat_data data_8960;
@@ -642,7 +659,7 @@
 extern struct tsens_plat_data data_8226, data_8909, data_8916, data_8939, data_8974, data_9607;
 
 /* TSENS v1 targets */
-extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956;
+extern struct tsens_plat_data data_tsens_v1, data_8937, data_8976, data_8956;
 
 /* TSENS v2 targets */
 extern struct tsens_plat_data data_8996, data_ipq8074, data_tsens_v2;
--- linux-qcom-6.8.0.orig/drivers/thermal/qoriq_thermal.c
+++ linux-qcom-6.8.0/drivers/thermal/qoriq_thermal.c
@@ -57,6 +57,9 @@
 #define REGS_TTRnCR(n)	(0xf10 + 4 * (n)) /* Temperature Range n
 					   * Control Register
 					   */
+#define NUM_TTRCR_V1	4
+#define NUM_TTRCR_MAX	16
+
 #define REGS_IPBRR(n)		(0xbf8 + 4 * (n)) /* IP Block Revision
 						   * Register n
 						   */
@@ -71,6 +74,7 @@
 
 struct qoriq_tmu_data {
 	int ver;
+	u32 ttrcr[NUM_TTRCR_MAX];
 	struct regmap *regmap;
 	struct clk *clk;
 	struct qoriq_sensor	sensor[SITES_MAX];
@@ -182,17 +186,17 @@
 				 struct qoriq_tmu_data *data)
 {
 	int i, val, len;
-	u32 range[4];
 	const u32 *calibration;
 	struct device_node *np = dev->of_node;
 
 	len = of_property_count_u32_elems(np, "fsl,tmu-range");
-	if (len < 0 || len > 4) {
+	if (len < 0 || (data->ver == TMU_VER1 && len > NUM_TTRCR_V1) ||
+	    (data->ver > TMU_VER1 && len > NUM_TTRCR_MAX)) {
 		dev_err(dev, "invalid range data.\n");
 		return len;
 	}
 
-	val = of_property_read_u32_array(np, "fsl,tmu-range", range, len);
+	val = of_property_read_u32_array(np, "fsl,tmu-range", data->ttrcr, len);
 	if (val != 0) {
 		dev_err(dev, "failed to read range data.\n");
 		return val;
@@ -200,7 +204,7 @@
 
 	/* Init temperature range registers */
 	for (i = 0; i < len; i++)
-		regmap_write(data->regmap, REGS_TTRnCR(i), range[i]);
+		regmap_write(data->regmap, REGS_TTRnCR(i), data->ttrcr[i]);
 
 	calibration = of_get_property(np, "fsl,tmu-calibration", &len);
 	if (calibration == NULL || len % 8) {
--- linux-qcom-6.8.0.orig/drivers/thermal/thermal_core.c
+++ linux-qcom-6.8.0/drivers/thermal/thermal_core.c
@@ -39,6 +39,8 @@
 
 static struct thermal_governor *def_governor;
 
+static bool thermal_pm_suspended;
+
 /*
  * Governor section: set of functions to handle thermal governors
  *
@@ -271,6 +273,22 @@
 	return ret;
 }
 
+static int __thermal_zone_device_set_mode(struct thermal_zone_device *tz,
+					  enum thermal_device_mode mode)
+{
+	if (tz->ops->change_mode) {
+		int ret;
+
+		ret = tz->ops->change_mode(tz, mode);
+		if (ret)
+			return ret;
+	}
+
+	tz->mode = mode;
+
+	return 0;
+}
+
 /*
  * Zone update section: main control loop applied to each zone while monitoring
  *
@@ -285,11 +303,15 @@
 static void thermal_zone_device_set_polling(struct thermal_zone_device *tz,
 					    unsigned long delay)
 {
-	if (delay)
-		mod_delayed_work(system_freezable_power_efficient_wq,
-				 &tz->poll_queue, delay);
-	else
+	if (!delay) {
 		cancel_delayed_work(&tz->poll_queue);
+		return;
+	}
+
+	if (delay > HZ)
+		delay = round_jiffies_relative(delay);
+
+	mod_delayed_work(system_freezable_power_efficient_wq, &tz->poll_queue, delay);
 }
 
 static void monitor_thermal_zone(struct thermal_zone_device *tz)
@@ -432,7 +454,6 @@
 	trace_thermal_temperature(tz);
 
 	thermal_genl_sampling_temp(tz->id, temp);
-	thermal_debug_update_temp(tz);
 }
 
 static void thermal_zone_device_check(struct work_struct *work)
@@ -461,10 +482,7 @@
 {
 	struct thermal_trip *trip;
 
-	if (tz->suspended)
-		return;
-
-	if (!thermal_zone_device_is_enabled(tz))
+	if (tz->state != TZ_STATE_READY || tz->mode != THERMAL_DEVICE_ENABLED)
 		return;
 
 	update_temperature(tz);
@@ -476,13 +494,15 @@
 	for_each_trip(tz, trip)
 		handle_thermal_trip(tz, trip);
 
+	thermal_debug_update_temp(tz);
+
 	monitor_thermal_zone(tz);
 }
 
 static int thermal_zone_device_set_mode(struct thermal_zone_device *tz,
 					enum thermal_device_mode mode)
 {
-	int ret = 0;
+	int ret;
 
 	mutex_lock(&tz->lock);
 
@@ -490,14 +510,15 @@
 	if (mode == tz->mode) {
 		mutex_unlock(&tz->lock);
 
-		return ret;
+		return 0;
 	}
 
-	if (tz->ops->change_mode)
-		ret = tz->ops->change_mode(tz, mode);
+	ret = __thermal_zone_device_set_mode(tz, mode);
+	if (ret) {
+		mutex_unlock(&tz->lock);
 
-	if (!ret)
-		tz->mode = mode;
+		return ret;
+	}
 
 	__thermal_zone_device_update(tz, THERMAL_EVENT_UNSPECIFIED);
 
@@ -508,7 +529,7 @@
 	else
 		thermal_notify_tz_disable(tz);
 
-	return ret;
+	return 0;
 }
 
 int thermal_zone_device_enable(struct thermal_zone_device *tz)
@@ -523,13 +544,6 @@
 }
 EXPORT_SYMBOL_GPL(thermal_zone_device_disable);
 
-int thermal_zone_device_is_enabled(struct thermal_zone_device *tz)
-{
-	lockdep_assert_held(&tz->lock);
-
-	return tz->mode == THERMAL_DEVICE_ENABLED;
-}
-
 static bool thermal_zone_is_present(struct thermal_zone_device *tz)
 {
 	return !list_empty(&tz->node);
@@ -603,6 +617,7 @@
 	mutex_lock(&thermal_list_lock);
 	list_for_each_entry(tz, &thermal_tz_list, node) {
 		if (tz->id == id) {
+			get_device(&tz->device);
 			match = tz;
 			break;
 		}
@@ -861,20 +876,6 @@
 		tz->type, cdev->type, ret);
 }
 
-static void bind_cdev(struct thermal_cooling_device *cdev)
-{
-	int ret;
-	struct thermal_zone_device *pos = NULL;
-
-	list_for_each_entry(pos, &thermal_tz_list, node) {
-		if (pos->ops->bind) {
-			ret = pos->ops->bind(pos, cdev);
-			if (ret)
-				print_bind_err_msg(pos, cdev, ret);
-		}
-	}
-}
-
 /**
  * __thermal_cooling_device_register() - register a new thermal cooling device
  * @np:		a pointer to a device tree node.
@@ -898,6 +899,7 @@
 {
 	struct thermal_cooling_device *cdev;
 	struct thermal_zone_device *pos = NULL;
+	unsigned long current_state;
 	int id, ret;
 
 	if (!ops || !ops->get_max_state || !ops->get_cur_state ||
@@ -935,6 +937,18 @@
 	if (ret)
 		goto out_cdev_type;
 
+	/*
+	 * The cooling device's current state is only needed for debug
+	 * initialization below, so a failure to get it does not cause
+	 * the entire cooling device initialization to fail.  However,
+	 * the debug will not work for the device if its initial state
+	 * cannot be determined and drivers are responsible for ensuring
+	 * that this will not happen.
+	 */
+	ret = cdev->ops->get_cur_state(cdev, &current_state);
+	if (ret)
+		current_state = ULONG_MAX;
+
 	thermal_cooling_device_setup_sysfs(cdev);
 
 	ret = dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
@@ -948,13 +962,22 @@
 		return ERR_PTR(ret);
 	}
 
+	if (current_state <= cdev->max_state)
+		thermal_debug_cdev_add(cdev, current_state);
+
 	/* Add 'this' new cdev to the global cdev list */
 	mutex_lock(&thermal_list_lock);
 
 	list_add(&cdev->node, &thermal_cdev_list);
 
 	/* Update binding information for 'this' new cdev */
-	bind_cdev(cdev);
+	list_for_each_entry(pos, &thermal_tz_list, node) {
+		if (pos->ops->bind) {
+			ret = pos->ops->bind(pos, cdev);
+			if (ret)
+				print_bind_err_msg(pos, cdev, ret);
+		}
+	}
 
 	list_for_each_entry(pos, &thermal_tz_list, node)
 		if (atomic_cmpxchg(&pos->need_update, 1, 0))
@@ -963,8 +986,6 @@
 
 	mutex_unlock(&thermal_list_lock);
 
-	thermal_debug_cdev_add(cdev);
-
 	return cdev;
 
 out_cooling_dev:
@@ -1194,32 +1215,6 @@
 }
 EXPORT_SYMBOL_GPL(thermal_cooling_device_unregister);
 
-static void bind_tz(struct thermal_zone_device *tz)
-{
-	int ret;
-	struct thermal_cooling_device *pos = NULL;
-
-	if (!tz->ops->bind)
-		return;
-
-	mutex_lock(&thermal_list_lock);
-
-	list_for_each_entry(pos, &thermal_cdev_list, node) {
-		ret = tz->ops->bind(tz, pos);
-		if (ret)
-			print_bind_err_msg(tz, pos, ret);
-	}
-
-	mutex_unlock(&thermal_list_lock);
-}
-
-static void thermal_set_delay_jiffies(unsigned long *delay_jiffies, int delay_ms)
-{
-	*delay_jiffies = msecs_to_jiffies(delay_ms);
-	if (delay_ms > 1000)
-		*delay_jiffies = round_jiffies(*delay_jiffies);
-}
-
 int thermal_zone_get_crit_temp(struct thermal_zone_device *tz, int *temp)
 {
 	int i, ret = -EINVAL;
@@ -1246,6 +1241,24 @@
 }
 EXPORT_SYMBOL_GPL(thermal_zone_get_crit_temp);
 
+static void thermal_zone_init_complete(struct thermal_zone_device *tz)
+{
+	mutex_lock(&tz->lock);
+
+	tz->state &= ~TZ_STATE_FLAG_INIT;
+	/*
+	 * If system suspend or resume is in progress at this point, the
+	 * new thermal zone needs to be marked as suspended because
+	 * thermal_pm_notify() has run already.
+	 */
+	if (thermal_pm_suspended)
+		tz->state |= TZ_STATE_FLAG_SUSPENDED;
+
+	__thermal_zone_device_update(tz, THERMAL_EVENT_UNSPECIFIED);
+
+	mutex_unlock(&tz->lock);
+}
+
 /**
  * thermal_zone_device_register_with_trips() - register a new thermal zone device
  * @type:	the thermal zone device type
@@ -1339,6 +1352,7 @@
 	ida_init(&tz->ida);
 	mutex_init(&tz->lock);
 	init_completion(&tz->removal);
+	init_completion(&tz->resume);
 	id = ida_alloc(&thermal_tz_ida, GFP_KERNEL);
 	if (id < 0) {
 		result = id;
@@ -1357,8 +1371,10 @@
 	tz->trips = trips;
 	tz->num_trips = num_trips;
 
-	thermal_set_delay_jiffies(&tz->passive_delay_jiffies, passive_delay);
-	thermal_set_delay_jiffies(&tz->polling_delay_jiffies, polling_delay);
+	tz->polling_delay_jiffies = msecs_to_jiffies(polling_delay);
+	tz->passive_delay_jiffies = msecs_to_jiffies(passive_delay);
+
+	tz->state = TZ_STATE_FLAG_INIT;
 
 	/* sys I/F */
 	/* Add nodes that are always present via .groups */
@@ -1374,6 +1390,7 @@
 		thermal_zone_destroy_device_groups(tz);
 		goto remove_id;
 	}
+	thermal_zone_device_init(tz);
 	result = device_register(&tz->device);
 	if (result)
 		goto release_device;
@@ -1401,18 +1418,25 @@
 	}
 
 	mutex_lock(&thermal_list_lock);
+
 	mutex_lock(&tz->lock);
 	list_add_tail(&tz->node, &thermal_tz_list);
 	mutex_unlock(&tz->lock);
-	mutex_unlock(&thermal_list_lock);
 
 	/* Bind cooling devices for this zone */
-	bind_tz(tz);
+	if (tz->ops->bind) {
+		struct thermal_cooling_device *cdev;
 
-	thermal_zone_device_init(tz);
-	/* Update the new thermal zone and mark it as already updated. */
-	if (atomic_cmpxchg(&tz->need_update, 1, 0))
-		thermal_zone_device_update(tz, THERMAL_EVENT_UNSPECIFIED);
+		list_for_each_entry(cdev, &thermal_cdev_list, node) {
+			result = tz->ops->bind(tz, cdev);
+			if (result)
+				print_bind_err_msg(tz, cdev, result);
+		}
+	}
+
+	thermal_zone_init_complete(tz);
+
+	mutex_unlock(&thermal_list_lock);
 
 	thermal_notify_tz_create(tz);
 
@@ -1513,14 +1537,12 @@
 	ida_destroy(&tz->ida);
 
 	device_del(&tz->device);
-
-	kfree(tz->tzp);
-
 	put_device(&tz->device);
 
 	thermal_notify_tz_delete(tz);
 
 	wait_for_completion(&tz->removal);
+	kfree(tz->tzp);
 	kfree(tz);
 }
 EXPORT_SYMBOL_GPL(thermal_zone_device_unregister);
@@ -1571,11 +1593,55 @@
 
 	mutex_lock(&tz->lock);
 
-	tz->suspended = false;
+	tz->state &= ~(TZ_STATE_FLAG_SUSPENDED | TZ_STATE_FLAG_RESUMING);
 
 	thermal_zone_device_init(tz);
 	__thermal_zone_device_update(tz, THERMAL_EVENT_UNSPECIFIED);
 
+	complete(&tz->resume);
+
+	mutex_unlock(&tz->lock);
+}
+
+static void thermal_zone_pm_prepare(struct thermal_zone_device *tz)
+{
+	mutex_lock(&tz->lock);
+
+	if (tz->state & TZ_STATE_FLAG_RESUMING) {
+		/*
+		 * thermal_zone_device_resume() queued up for this zone has not
+		 * acquired the lock yet, so release it to let the function run
+		 * and wait util it has done the work.
+		 */
+		mutex_unlock(&tz->lock);
+
+		wait_for_completion(&tz->resume);
+
+		mutex_lock(&tz->lock);
+	}
+
+	tz->state |= TZ_STATE_FLAG_SUSPENDED;
+
+	mutex_unlock(&tz->lock);
+}
+
+static void thermal_zone_pm_complete(struct thermal_zone_device *tz)
+{
+	mutex_lock(&tz->lock);
+
+	cancel_delayed_work(&tz->poll_queue);
+
+	reinit_completion(&tz->resume);
+	tz->state |= TZ_STATE_FLAG_RESUMING;
+
+	/*
+	 * Replace the work function with the resume one, which will restore the
+	 * original work function and schedule the polling work if needed.
+	 */
+	INIT_DELAYED_WORK(&tz->poll_queue, thermal_zone_device_resume);
+	/* Queue up the work without a delay. */
+	mod_delayed_work(system_freezable_power_efficient_wq, &tz->poll_queue, 0);
+
 	mutex_unlock(&tz->lock);
 }
 
@@ -1590,13 +1656,10 @@
 	case PM_SUSPEND_PREPARE:
 		mutex_lock(&thermal_list_lock);
 
-		list_for_each_entry(tz, &thermal_tz_list, node) {
-			mutex_lock(&tz->lock);
+		thermal_pm_suspended = true;
 
-			tz->suspended = true;
-
-			mutex_unlock(&tz->lock);
-		}
+		list_for_each_entry(tz, &thermal_tz_list, node)
+			thermal_zone_pm_prepare(tz);
 
 		mutex_unlock(&thermal_list_lock);
 		break;
@@ -1605,24 +1668,10 @@
 	case PM_POST_SUSPEND:
 		mutex_lock(&thermal_list_lock);
 
-		list_for_each_entry(tz, &thermal_tz_list, node) {
-			mutex_lock(&tz->lock);
-
-			cancel_delayed_work(&tz->poll_queue);
-
-			/*
-			 * Replace the work function with the resume one, which
-			 * will restore the original work function and schedule
-			 * the polling work if needed.
-			 */
-			INIT_DELAYED_WORK(&tz->poll_queue,
-					  thermal_zone_device_resume);
-			/* Queue up the work without a delay. */
-			mod_delayed_work(system_freezable_power_efficient_wq,
-					 &tz->poll_queue, 0);
+		thermal_pm_suspended = false;
 
-			mutex_unlock(&tz->lock);
-		}
+		list_for_each_entry(tz, &thermal_tz_list, node)
+			thermal_zone_pm_complete(tz);
 
 		mutex_unlock(&thermal_list_lock);
 		break;
@@ -1634,6 +1683,12 @@
 
 static struct notifier_block thermal_pm_nb = {
 	.notifier_call = thermal_pm_notify,
+	/*
+	 * Run at the lowest priority to avoid interference between the thermal
+	 * zone resume work items spawned by thermal_pm_notify() and the other
+	 * PM notifiers.
+	 */
+	.priority = INT_MIN,
 };
 
 static int __init thermal_init(void)
--- linux-qcom-6.8.0.orig/drivers/thermal/thermal_core.h
+++ linux-qcom-6.8.0/drivers/thermal/thermal_core.h
@@ -57,6 +57,9 @@
 
 struct thermal_zone_device *thermal_zone_get_by_id(int id);
 
+DEFINE_CLASS(thermal_zone_get_by_id, struct thermal_zone_device *,
+	     if (_T) put_device(&_T->device), thermal_zone_get_by_id(id), int id)
+
 struct thermal_attr {
 	struct device_attribute attr;
 	char name[THERMAL_NAME_LENGTH];
@@ -151,7 +154,4 @@
 				    unsigned long new_state) {}
 #endif /* CONFIG_THERMAL_STATISTICS */
 
-/* device tree support */
-int thermal_zone_device_is_enabled(struct thermal_zone_device *tz);
-
 #endif /* __THERMAL_CORE_H__ */
--- linux-qcom-6.8.0.orig/drivers/thermal/thermal_debugfs.c
+++ linux-qcom-6.8.0/drivers/thermal/thermal_debugfs.c
@@ -139,11 +139,13 @@
  * we keep track of the current position in the history array.
  *
  * @tz_episodes: a list of thermal mitigation episodes
+ * @tz: thermal zone this object belongs to
  * @trips_crossed: an array of trip points crossed by id
  * @nr_trips: the number of trip points currently being crossed
  */
 struct tz_debugfs {
 	struct list_head tz_episodes;
+	struct thermal_zone_device *tz;
 	int *trips_crossed;
 	int nr_trips;
 };
@@ -172,11 +174,11 @@
 void thermal_debug_init(void)
 {
 	d_root = debugfs_create_dir("thermal", NULL);
-	if (!d_root)
+	if (IS_ERR(d_root))
 		return;
 
 	d_cdev = debugfs_create_dir("cooling_devices", d_root);
-	if (!d_cdev)
+	if (IS_ERR(d_cdev))
 		return;
 
 	d_tz = debugfs_create_dir("thermal_zones", d_root);
@@ -196,7 +198,7 @@
 	snprintf(ids, IDSLENGTH, "%d", id);
 
 	thermal_dbg->d_top = debugfs_create_dir(ids, d);
-	if (!thermal_dbg->d_top) {
+	if (IS_ERR(thermal_dbg->d_top)) {
 		kfree(thermal_dbg);
 		return NULL;
 	}
@@ -433,6 +435,14 @@
 	}
 
 	cdev_dbg->current_state = new_state;
+
+	/*
+	 * Create a record for the new state if it is not there, so its
+	 * duration will be printed by cdev_dt_seq_show() as expected if it
+	 * runs before the next state transition.
+	 */
+	thermal_debugfs_cdev_record_get(thermal_dbg, cdev_dbg->durations, new_state);
+
 	transition = (old_state << 16) | new_state;
 
 	/*
@@ -458,8 +468,9 @@
  * Allocates a cooling device object for debug, initializes the
  * statistics and create the entries in sysfs.
  * @cdev: a pointer to a cooling device
+ * @state: current state of the cooling device
  */
-void thermal_debug_cdev_add(struct thermal_cooling_device *cdev)
+void thermal_debug_cdev_add(struct thermal_cooling_device *cdev, int state)
 {
 	struct thermal_debugfs *thermal_dbg;
 	struct cdev_debugfs *cdev_dbg;
@@ -476,9 +487,16 @@
 		INIT_LIST_HEAD(&cdev_dbg->durations[i]);
 	}
 
-	cdev_dbg->current_state = 0;
+	cdev_dbg->current_state = state;
 	cdev_dbg->timestamp = ktime_get();
 
+	/*
+	 * Create a record for the initial cooling device state, so its
+	 * duration will be printed by cdev_dt_seq_show() as expected if it
+	 * runs before the first state transition.
+	 */
+	thermal_debugfs_cdev_record_get(thermal_dbg, cdev_dbg->durations, state);
+
 	debugfs_create_file("trans_table", 0400, thermal_dbg->d_top,
 			    thermal_dbg, &tt_fops);
 
@@ -503,15 +521,23 @@
  */
 void thermal_debug_cdev_remove(struct thermal_cooling_device *cdev)
 {
-	struct thermal_debugfs *thermal_dbg = cdev->debugfs;
+	struct thermal_debugfs *thermal_dbg;
 
-	if (!thermal_dbg)
+	mutex_lock(&cdev->lock);
+
+	thermal_dbg = cdev->debugfs;
+	if (!thermal_dbg) {
+		mutex_unlock(&cdev->lock);
 		return;
+	}
+
+	cdev->debugfs = NULL;
+
+	mutex_unlock(&cdev->lock);
 
 	mutex_lock(&thermal_dbg->lock);
 
 	thermal_debugfs_cdev_clear(&thermal_dbg->cdev_dbg);
-	cdev->debugfs = NULL;
 
 	mutex_unlock(&thermal_dbg->lock);
 
@@ -545,7 +571,6 @@
 	struct tz_episode *tze;
 	struct tz_debugfs *tz_dbg;
 	struct thermal_debugfs *thermal_dbg = tz->debugfs;
-	int temperature = tz->temperature;
 	int trip_id = thermal_zone_trip_id(tz, trip);
 	ktime_t now = ktime_get();
 
@@ -614,11 +639,6 @@
 
 	tze = list_first_entry(&tz_dbg->tz_episodes, struct tz_episode, node);
 	tze->trip_stats[trip_id].timestamp = now;
-	tze->trip_stats[trip_id].max = max(tze->trip_stats[trip_id].max, temperature);
-	tze->trip_stats[trip_id].min = min(tze->trip_stats[trip_id].min, temperature);
-	tze->trip_stats[trip_id].avg = tze->trip_stats[trip_id].avg +
-		(temperature - tze->trip_stats[trip_id].avg) /
-		tze->trip_stats[trip_id].count;
 
 unlock:
 	mutex_unlock(&thermal_dbg->lock);
@@ -715,8 +735,7 @@
 
 static void *tze_seq_start(struct seq_file *s, loff_t *pos)
 {
-	struct thermal_zone_device *tz = s->private;
-	struct thermal_debugfs *thermal_dbg = tz->debugfs;
+	struct thermal_debugfs *thermal_dbg = s->private;
 	struct tz_debugfs *tz_dbg = &thermal_dbg->tz_dbg;
 
 	mutex_lock(&thermal_dbg->lock);
@@ -726,8 +745,7 @@
 
 static void *tze_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-	struct thermal_zone_device *tz = s->private;
-	struct thermal_debugfs *thermal_dbg = tz->debugfs;
+	struct thermal_debugfs *thermal_dbg = s->private;
 	struct tz_debugfs *tz_dbg = &thermal_dbg->tz_dbg;
 
 	return seq_list_next(v, &tz_dbg->tz_episodes, pos);
@@ -735,15 +753,15 @@
 
 static void tze_seq_stop(struct seq_file *s, void *v)
 {
-	struct thermal_zone_device *tz = s->private;
-	struct thermal_debugfs *thermal_dbg = tz->debugfs;
+	struct thermal_debugfs *thermal_dbg = s->private;
 
 	mutex_unlock(&thermal_dbg->lock);
 }
 
 static int tze_seq_show(struct seq_file *s, void *v)
 {
-	struct thermal_zone_device *tz = s->private;
+	struct thermal_debugfs *thermal_dbg = s->private;
+	struct thermal_zone_device *tz = thermal_dbg->tz_dbg.tz;
 	struct thermal_trip *trip;
 	struct tz_episode *tze;
 	const char *type;
@@ -809,6 +827,8 @@
 
 	tz_dbg = &thermal_dbg->tz_dbg;
 
+	tz_dbg->tz = tz;
+
 	tz_dbg->trips_crossed = kzalloc(sizeof(int) * tz->num_trips, GFP_KERNEL);
 	if (!tz_dbg->trips_crossed) {
 		thermal_debugfs_remove_id(thermal_dbg);
@@ -817,23 +837,44 @@
 
 	INIT_LIST_HEAD(&tz_dbg->tz_episodes);
 
-	debugfs_create_file("mitigations", 0400, thermal_dbg->d_top, tz, &tze_fops);
+	debugfs_create_file("mitigations", 0400, thermal_dbg->d_top,
+			    thermal_dbg, &tze_fops);
 
 	tz->debugfs = thermal_dbg;
 }
 
 void thermal_debug_tz_remove(struct thermal_zone_device *tz)
 {
-	struct thermal_debugfs *thermal_dbg = tz->debugfs;
+	struct thermal_debugfs *thermal_dbg;
+	struct tz_episode *tze, *tmp;
+	struct tz_debugfs *tz_dbg;
+	int *trips_crossed;
 
-	if (!thermal_dbg)
+	mutex_lock(&tz->lock);
+
+	thermal_dbg = tz->debugfs;
+	if (!thermal_dbg) {
+		mutex_unlock(&tz->lock);
 		return;
+	}
+
+	tz->debugfs = NULL;
+
+	mutex_unlock(&tz->lock);
+
+	tz_dbg = &thermal_dbg->tz_dbg;
 
 	mutex_lock(&thermal_dbg->lock);
 
-	tz->debugfs = NULL;
+	trips_crossed = tz_dbg->trips_crossed;
+
+	list_for_each_entry_safe(tze, tmp, &tz_dbg->tz_episodes, node) {
+		list_del(&tze->node);
+		kfree(tze);
+	}
 
 	mutex_unlock(&thermal_dbg->lock);
 
 	thermal_debugfs_remove_id(thermal_dbg);
+	kfree(trips_crossed);
 }
--- linux-qcom-6.8.0.orig/drivers/thermal/thermal_debugfs.h
+++ linux-qcom-6.8.0/drivers/thermal/thermal_debugfs.h
@@ -2,7 +2,7 @@
 
 #ifdef CONFIG_THERMAL_DEBUGFS
 void thermal_debug_init(void);
-void thermal_debug_cdev_add(struct thermal_cooling_device *cdev);
+void thermal_debug_cdev_add(struct thermal_cooling_device *cdev, int state);
 void thermal_debug_cdev_remove(struct thermal_cooling_device *cdev);
 void thermal_debug_cdev_state_update(const struct thermal_cooling_device *cdev, int state);
 void thermal_debug_tz_add(struct thermal_zone_device *tz);
@@ -14,7 +14,7 @@
 void thermal_debug_update_temp(struct thermal_zone_device *tz);
 #else
 static inline void thermal_debug_init(void) {}
-static inline void thermal_debug_cdev_add(struct thermal_cooling_device *cdev) {}
+static inline void thermal_debug_cdev_add(struct thermal_cooling_device *cdev, int state) {}
 static inline void thermal_debug_cdev_remove(struct thermal_cooling_device *cdev) {}
 static inline void thermal_debug_cdev_state_update(const struct thermal_cooling_device *cdev,
 						   int state) {}
--- linux-qcom-6.8.0.orig/drivers/thermal/thermal_netlink.c
+++ linux-qcom-6.8.0/drivers/thermal/thermal_netlink.c
@@ -446,7 +446,6 @@
 {
 	struct sk_buff *msg = p->msg;
 	const struct thermal_trip *trip;
-	struct thermal_zone_device *tz;
 	struct nlattr *start_trip;
 	int id;
 
@@ -455,7 +454,7 @@
 
 	id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
 
-	tz = thermal_zone_get_by_id(id);
+	CLASS(thermal_zone_get_by_id, tz)(id);
 	if (!tz)
 		return -EINVAL;
 
@@ -489,7 +488,6 @@
 static int thermal_genl_cmd_tz_get_temp(struct param *p)
 {
 	struct sk_buff *msg = p->msg;
-	struct thermal_zone_device *tz;
 	int temp, ret, id;
 
 	if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
@@ -497,7 +495,7 @@
 
 	id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
 
-	tz = thermal_zone_get_by_id(id);
+	CLASS(thermal_zone_get_by_id, tz)(id);
 	if (!tz)
 		return -EINVAL;
 
@@ -515,7 +513,6 @@
 static int thermal_genl_cmd_tz_get_gov(struct param *p)
 {
 	struct sk_buff *msg = p->msg;
-	struct thermal_zone_device *tz;
 	int id, ret = 0;
 
 	if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
@@ -523,7 +520,7 @@
 
 	id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
 
-	tz = thermal_zone_get_by_id(id);
+	CLASS(thermal_zone_get_by_id, tz)(id);
 	if (!tz)
 		return -EINVAL;
 
--- linux-qcom-6.8.0.orig/drivers/thermal/thermal_of.c
+++ linux-qcom-6.8.0/drivers/thermal/thermal_of.c
@@ -123,21 +123,18 @@
 static struct thermal_trip *thermal_of_trips_init(struct device_node *np, int *ntrips)
 {
 	struct thermal_trip *tt;
-	struct device_node *trips, *trip;
+	struct device_node *trips;
 	int ret, count;
 
+	*ntrips = 0;
+	
 	trips = of_get_child_by_name(np, "trips");
-	if (!trips) {
-		pr_err("Failed to find 'trips' node\n");
-		return ERR_PTR(-EINVAL);
-	}
+	if (!trips)
+		return NULL;
 
 	count = of_get_child_count(trips);
-	if (!count) {
-		pr_err("No trip point defined\n");
-		ret = -EINVAL;
-		goto out_of_node_put;
-	}
+	if (!count)
+		return NULL;
 
 	tt = kzalloc(sizeof(*tt) * count, GFP_KERNEL);
 	if (!tt) {
@@ -148,7 +145,7 @@
 	*ntrips = count;
 
 	count = 0;
-	for_each_child_of_node(trips, trip) {
+	for_each_child_of_node_scoped(trips, trip) {
 		ret = thermal_of_populate_trip(trip, &tt[count++]);
 		if (ret)
 			goto out_kfree;
@@ -160,7 +157,6 @@
 
 out_kfree:
 	kfree(tt);
-	*ntrips = 0;
 out_of_node_put:
 	of_node_put(trips);
 
@@ -182,14 +178,14 @@
 	 * Search for each thermal zone, a defined sensor
 	 * corresponding to the one passed as parameter
 	 */
-	for_each_available_child_of_node(np, tz) {
+	for_each_available_child_of_node_scoped(np, child) {
 
 		int count, i;
 
-		count = of_count_phandle_with_args(tz, "thermal-sensors",
+		count = of_count_phandle_with_args(child, "thermal-sensors",
 						   "#thermal-sensor-cells");
 		if (count <= 0) {
-			pr_err("%pOFn: missing thermal sensor\n", tz);
+			pr_err("%pOFn: missing thermal sensor\n", child);
 			tz = ERR_PTR(-EINVAL);
 			goto out;
 		}
@@ -198,18 +194,20 @@
 
 			int ret;
 
-			ret = of_parse_phandle_with_args(tz, "thermal-sensors",
+			ret = of_parse_phandle_with_args(child, "thermal-sensors",
 							 "#thermal-sensor-cells",
 							 i, &sensor_specs);
 			if (ret < 0) {
-				pr_err("%pOFn: Failed to read thermal-sensors cells: %d\n", tz, ret);
+				pr_err("%pOFn: Failed to read thermal-sensors cells: %d\n", child, ret);
 				tz = ERR_PTR(ret);
 				goto out;
 			}
 
+			of_node_put(sensor_specs.np);
 			if ((sensor == sensor_specs.np) && id == (sensor_specs.args_count ?
 								  sensor_specs.args[0] : 0)) {
-				pr_debug("sensor %pOFn id=%d belongs to %pOFn\n", sensor, id, tz);
+				pr_debug("sensor %pOFn id=%d belongs to %pOFn\n", sensor, id, child);
+				tz = no_free_ptr(child);
 				goto out;
 			}
 		}
@@ -225,14 +223,18 @@
 	int ret;
 
 	ret = of_property_read_u32(np, "polling-delay-passive", pdelay);
-	if (ret < 0) {
-		pr_err("%pOFn: missing polling-delay-passive property\n", np);
+	if (ret == -EINVAL) {
+		*pdelay = 0;
+	} else if (ret < 0) {
+		pr_err("%pOFn: Couldn't get polling-delay-passive: %d\n", np, ret);
 		return ret;
 	}
 
 	ret = of_property_read_u32(np, "polling-delay", delay);
-	if (ret < 0) {
-		pr_err("%pOFn: missing polling-delay property\n", np);
+	if (ret == -EINVAL) {
+		*delay = 0;
+	} else if (ret < 0) {
+		pr_err("%pOFn: Couldn't get polling-delay: %d\n", np, ret);
 		return ret;
 	}
 
@@ -494,11 +496,14 @@
 
 	trips = thermal_of_trips_init(np, &ntrips);
 	if (IS_ERR(trips)) {
-		pr_err("Failed to find trip points for %pOFn id=%d\n", sensor, id);
+		pr_err("Failed to parse trip points for %pOFn id=%d\n", sensor, id);
 		ret = PTR_ERR(trips);
-		goto out_kfree_of_ops;
+		goto out_of_node_put;
 	}
 
+	if (!trips)
+		pr_info("No trip points found for %pOFn id=%d\n", sensor, id);
+
 	ret = thermal_of_monitor_init(np, &delay, &pdelay);
 	if (ret) {
 		pr_err("Failed to initialize monitoring delays from %pOFn\n", np);
@@ -526,6 +531,8 @@
 		goto out_kfree_trips;
 	}
 
+	of_node_put(np);
+
 	ret = thermal_zone_device_enable(tz);
 	if (ret) {
 		pr_err("Failed to enabled thermal zone '%s', id=%d: %d\n",
@@ -538,6 +545,10 @@
 
 out_kfree_trips:
 	kfree(trips);
+
+out_of_node_put:
+	of_node_put(np);
+
 out_kfree_of_ops:
 	kfree(of_ops);
 
--- linux-qcom-6.8.0.orig/drivers/thermal/thermal_sysfs.c
+++ linux-qcom-6.8.0/drivers/thermal/thermal_sysfs.c
@@ -52,7 +52,7 @@
 	int enabled;
 
 	mutex_lock(&tz->lock);
-	enabled = thermal_zone_device_is_enabled(tz);
+	enabled = tz->mode == THERMAL_DEVICE_ENABLED;
 	mutex_unlock(&tz->lock);
 
 	return sprintf(buf, "%s\n", enabled ? "enabled" : "disabled");
@@ -150,7 +150,7 @@
 	if (sscanf(attr->attr.name, "trip_point_%d_temp", &trip_id) != 1)
 		return -EINVAL;
 
-	return sprintf(buf, "%d\n", tz->trips[trip_id].temperature);
+	return sprintf(buf, "%d\n", READ_ONCE(tz->trips[trip_id].temperature));
 }
 
 static ssize_t
@@ -180,7 +180,7 @@
 				goto unlock;
 		}
 
-		trip->hysteresis = hyst;
+		WRITE_ONCE(trip->hysteresis, hyst);
 
 		thermal_zone_trip_updated(tz, trip);
 	}
@@ -201,7 +201,7 @@
 	if (sscanf(attr->attr.name, "trip_point_%d_hyst", &trip_id) != 1)
 		return -EINVAL;
 
-	return sprintf(buf, "%d\n", tz->trips[trip_id].hysteresis);
+	return sprintf(buf, "%d\n", READ_ONCE(tz->trips[trip_id].hysteresis));
 }
 
 static ssize_t
@@ -474,7 +474,8 @@
 					tz->trip_hyst_attrs[indx].name;
 		tz->trip_hyst_attrs[indx].attr.attr.mode = S_IRUGO;
 		tz->trip_hyst_attrs[indx].attr.show = trip_point_hyst_show;
-		if (tz->ops->set_trip_hyst) {
+		if (IS_ENABLED(CONFIG_THERMAL_WRITABLE_TRIPS) &&
+		    mask & (1 << indx)) {
 			tz->trip_hyst_attrs[indx].attr.attr.mode |= S_IWUSR;
 			tz->trip_hyst_attrs[indx].attr.store =
 					trip_point_hyst_store;
--- linux-qcom-6.8.0.orig/drivers/thermal/thermal_trip.c
+++ linux-qcom-6.8.0/drivers/thermal/thermal_trip.c
@@ -65,7 +65,6 @@
 {
 	const struct thermal_trip *trip;
 	int low = -INT_MAX, high = INT_MAX;
-	bool same_trip = false;
 	int ret;
 
 	lockdep_assert_held(&tz->lock);
@@ -74,36 +73,22 @@
 		return;
 
 	for_each_trip(tz, trip) {
-		bool low_set = false;
 		int trip_low;
 
 		trip_low = trip->temperature - trip->hysteresis;
 
-		if (trip_low < tz->temperature && trip_low > low) {
+		if (trip_low < tz->temperature && trip_low > low)
 			low = trip_low;
-			low_set = true;
-			same_trip = false;
-		}
 
 		if (trip->temperature > tz->temperature &&
-		    trip->temperature < high) {
+		    trip->temperature < high)
 			high = trip->temperature;
-			same_trip = low_set;
-		}
 	}
 
 	/* No need to change trip points */
 	if (tz->prev_low_trip == low && tz->prev_high_trip == high)
 		return;
 
-	/*
-	 * If "high" and "low" are the same, skip the change unless this is the
-	 * first time.
-	 */
-	if (same_trip && (tz->prev_low_trip != -INT_MAX ||
-	    tz->prev_high_trip != INT_MAX))
-		return;
-
 	tz->prev_low_trip = low;
 	tz->prev_high_trip = high;
 
@@ -143,6 +128,45 @@
 }
 EXPORT_SYMBOL_GPL(thermal_zone_get_trip);
 
+int thermal_zone_set_trip(struct thermal_zone_device *tz, int trip_id,
+			  const struct thermal_trip *trip)
+{
+	struct thermal_trip t;
+	int ret;
+
+	if (!tz->ops->set_trip_temp && !tz->ops->set_trip_hyst && !tz->trips)
+		return -EINVAL;
+
+	ret = __thermal_zone_get_trip(tz, trip_id, &t);
+	if (ret)
+		return ret;
+
+	if (t.type != trip->type)
+		return -EINVAL;
+
+	if (t.temperature != trip->temperature && tz->ops->set_trip_temp) {
+		ret = tz->ops->set_trip_temp(tz, trip_id, trip->temperature);
+		if (ret)
+			return ret;
+	}
+
+	if (t.hysteresis != trip->hysteresis && tz->ops->set_trip_hyst) {
+		ret = tz->ops->set_trip_hyst(tz, trip_id, trip->hysteresis);
+		if (ret)
+			return ret;
+	}
+
+	if (tz->trips && (t.temperature != trip->temperature || t.hysteresis != trip->hysteresis))
+		tz->trips[trip_id] = *trip;
+
+	thermal_notify_tz_trip_change(tz, trip);
+
+	__thermal_zone_device_update(tz, THERMAL_TRIP_CHANGED);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(thermal_zone_set_trip);
+
 int thermal_zone_trip_id(const struct thermal_zone_device *tz,
 			 const struct thermal_trip *trip)
 {
@@ -165,7 +189,7 @@
 	if (trip->temperature == temp)
 		return;
 
-	trip->temperature = temp;
+	WRITE_ONCE(trip->temperature, temp);
 	thermal_notify_tz_trip_change(tz, trip);
 }
 EXPORT_SYMBOL_GPL(thermal_zone_set_trip_temp);
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/debugfs.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/debugfs.c
@@ -943,8 +943,9 @@
 	debugfs_create_file("run", 0600, dir, port, &margining_run_fops);
 	debugfs_create_file("results", 0600, dir, port, &margining_results_fops);
 	debugfs_create_file("test", 0600, dir, port, &margining_test_fops);
-	if (independent_voltage_margins(usb4) ||
-	    (supports_time(usb4) && independent_time_margins(usb4)))
+	if (independent_voltage_margins(usb4) == USB4_MARGIN_CAP_0_VOLTAGE_HL ||
+	    (supports_time(usb4) &&
+	     independent_time_margins(usb4) == USB4_MARGIN_CAP_1_TIME_LR))
 		debugfs_create_file("margin", 0600, dir, port, &margining_margin_fops);
 }
 
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/domain.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/domain.c
@@ -423,6 +423,7 @@
 /**
  * tb_domain_add() - Add domain to the system
  * @tb: Domain to add
+ * @reset: Issue reset to the host router
  *
  * Starts the domain and adds it to the system. Hotplugging devices will
  * work after this has been returned successfully. In order to remove
@@ -431,7 +432,7 @@
  *
  * Return: %0 in case of success and negative errno in case of error
  */
-int tb_domain_add(struct tb *tb)
+int tb_domain_add(struct tb *tb, bool reset)
 {
 	int ret;
 
@@ -460,7 +461,7 @@
 
 	/* Start the domain */
 	if (tb->cm_ops->start) {
-		ret = tb->cm_ops->start(tb);
+		ret = tb->cm_ops->start(tb, reset);
 		if (ret)
 			goto err_domain_del;
 	}
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/icm.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/icm.c
@@ -2144,7 +2144,7 @@
 	return 0;
 }
 
-static int icm_start(struct tb *tb)
+static int icm_start(struct tb *tb, bool not_used)
 {
 	struct icm *icm = tb_priv(tb);
 	int ret;
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/lc.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/lc.c
@@ -6,6 +6,8 @@
  * Author: Mika Westerberg <mika.westerberg@linux.intel.com>
  */
 
+#include <linux/delay.h>
+
 #include "tb.h"
 
 /**
@@ -45,6 +47,49 @@
 	return sw->cap_lc + start + phys * size;
 }
 
+/**
+ * tb_lc_reset_port() - Trigger downstream port reset through LC
+ * @port: Port that is reset
+ *
+ * Triggers downstream port reset through link controller registers.
+ * Returns %0 in case of success negative errno otherwise. Only supports
+ * non-USB4 routers with link controller (that's Thunderbolt 2 and
+ * Thunderbolt 3).
+ */
+int tb_lc_reset_port(struct tb_port *port)
+{
+	struct tb_switch *sw = port->sw;
+	int cap, ret;
+	u32 mode;
+
+	if (sw->generation < 2)
+		return -EINVAL;
+
+	cap = find_port_lc_cap(port);
+	if (cap < 0)
+		return cap;
+
+	ret = tb_sw_read(sw, &mode, TB_CFG_SWITCH, cap + TB_LC_PORT_MODE, 1);
+	if (ret)
+		return ret;
+
+	mode |= TB_LC_PORT_MODE_DPR;
+
+	ret = tb_sw_write(sw, &mode, TB_CFG_SWITCH, cap + TB_LC_PORT_MODE, 1);
+	if (ret)
+		return ret;
+
+	fsleep(10000);
+
+	ret = tb_sw_read(sw, &mode, TB_CFG_SWITCH, cap + TB_LC_PORT_MODE, 1);
+	if (ret)
+		return ret;
+
+	mode &= ~TB_LC_PORT_MODE_DPR;
+
+	return tb_sw_write(sw, &mode, TB_CFG_SWITCH, cap + TB_LC_PORT_MODE, 1);
+}
+
 static int tb_lc_set_port_configured(struct tb_port *port, bool configured)
 {
 	bool upstream = tb_is_upstream_port(port);
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/nhi.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/nhi.c
@@ -1221,7 +1221,7 @@
 		str_enabled_disabled(port_ok));
 }
 
-static void nhi_reset(struct tb_nhi *nhi)
+static bool nhi_reset(struct tb_nhi *nhi)
 {
 	ktime_t timeout;
 	u32 val;
@@ -1229,11 +1229,11 @@
 	val = ioread32(nhi->iobase + REG_CAPS);
 	/* Reset only v2 and later routers */
 	if (FIELD_GET(REG_CAPS_VERSION_MASK, val) < REG_CAPS_VERSION_2)
-		return;
+		return false;
 
 	if (!host_reset) {
 		dev_dbg(&nhi->pdev->dev, "skipping host router reset\n");
-		return;
+		return false;
 	}
 
 	iowrite32(REG_RESET_HRR, nhi->iobase + REG_RESET);
@@ -1244,12 +1244,14 @@
 		val = ioread32(nhi->iobase + REG_RESET);
 		if (!(val & REG_RESET_HRR)) {
 			dev_warn(&nhi->pdev->dev, "host router reset successful\n");
-			return;
+			return true;
 		}
 		usleep_range(10, 20);
 	} while (ktime_before(ktime_get(), timeout));
 
 	dev_warn(&nhi->pdev->dev, "timeout resetting host router\n");
+
+	return false;
 }
 
 static int nhi_init_msi(struct tb_nhi *nhi)
@@ -1331,6 +1333,7 @@
 	struct device *dev = &pdev->dev;
 	struct tb_nhi *nhi;
 	struct tb *tb;
+	bool reset;
 	int res;
 
 	if (!nhi_imr_valid(pdev))
@@ -1365,7 +1368,11 @@
 	nhi_check_quirks(nhi);
 	nhi_check_iommu(nhi);
 
-	nhi_reset(nhi);
+	/*
+	 * Only USB4 v2 hosts support host reset so if we already did
+	 * that then don't do it again when the domain is initialized.
+	 */
+	reset = nhi_reset(nhi) ? false : host_reset;
 
 	res = nhi_init_msi(nhi);
 	if (res)
@@ -1392,7 +1399,7 @@
 
 	dev_dbg(dev, "NHI initialized, starting thunderbolt\n");
 
-	res = tb_domain_add(tb);
+	res = tb_domain_add(tb, reset);
 	if (res) {
 		/*
 		 * At this point the RX/TX rings might already have been
@@ -1521,6 +1528,14 @@
 	  .driver_data = (kernel_ulong_t)&icl_nhi_ops },
 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_LNL_NHI1),
 	  .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_M_NHI0),
+	  .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_M_NHI1),
+	  .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI0),
+	  .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1),
+	  .driver_data = (kernel_ulong_t)&icl_nhi_ops },
 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) },
 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },
 
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/nhi.h
+++ linux-qcom-6.8.0/drivers/thunderbolt/nhi.h
@@ -92,6 +92,10 @@
 #define PCI_DEVICE_ID_INTEL_RPL_NHI1			0xa76d
 #define PCI_DEVICE_ID_INTEL_LNL_NHI0			0xa833
 #define PCI_DEVICE_ID_INTEL_LNL_NHI1			0xa834
+#define PCI_DEVICE_ID_INTEL_PTL_M_NHI0			0xe333
+#define PCI_DEVICE_ID_INTEL_PTL_M_NHI1			0xe334
+#define PCI_DEVICE_ID_INTEL_PTL_P_NHI0			0xe433
+#define PCI_DEVICE_ID_INTEL_PTL_P_NHI1			0xe434
 
 #define PCI_CLASS_SERIAL_USB_USB4			0x0c0340
 
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/path.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/path.c
@@ -446,6 +446,19 @@
 	return -ETIMEDOUT;
 }
 
+/**
+ * tb_path_deactivate_hop() - Deactivate one path in path config space
+ * @port: Lane or protocol adapter
+ * @hop_index: HopID of the path to be cleared
+ *
+ * This deactivates or clears a single path config space entry at
+ * @hop_index. Returns %0 in success and negative errno otherwise.
+ */
+int tb_path_deactivate_hop(struct tb_port *port, int hop_index)
+{
+	return __tb_path_deactivate_hop(port, hop_index, true);
+}
+
 static void __tb_path_deactivate_hops(struct tb_path *path, int first_hop)
 {
 	int i, res;
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/quirks.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/quirks.c
@@ -43,6 +43,12 @@
 	}
 }
 
+static void quirk_block_rpm_in_redrive(struct tb_switch *sw)
+{
+	sw->quirks |= QUIRK_KEEP_POWER_IN_DP_REDRIVE;
+	tb_sw_dbg(sw, "preventing runtime PM in DP redrive mode\n");
+}
+
 struct tb_quirk {
 	u16 hw_vendor_id;
 	u16 hw_device_id;
@@ -87,6 +93,14 @@
 	{ 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE, 0x0000, 0x0000,
 		  quirk_usb3_maximum_bandwidth },
 	/*
+	 * Block Runtime PM in DP redrive mode for Intel Barlow Ridge host
+	 * controllers.
+	 */
+	{ 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI, 0x0000, 0x0000,
+		  quirk_block_rpm_in_redrive },
+	{ 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI, 0x0000, 0x0000,
+		  quirk_block_rpm_in_redrive },
+	/*
 	 * CLx is not supported on AMD USB4 Yellow Carp and Pink Sardine platforms.
 	 */
 	{ 0x0438, 0x0208, 0x0000, 0x0000, quirk_clx_disable },
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/retimer.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/retimer.c
@@ -99,6 +99,7 @@
 
 err_nvm:
 	dev_dbg(&rt->dev, "NVM upgrade disabled\n");
+	rt->no_nvm_upgrade = true;
 	if (!IS_ERR(nvm))
 		tb_nvm_free(nvm);
 
@@ -178,8 +179,6 @@
 
 	if (!rt->nvm)
 		ret = -EAGAIN;
-	else if (rt->no_nvm_upgrade)
-		ret = -EOPNOTSUPP;
 	else
 		ret = sysfs_emit(buf, "%#x\n", rt->auth_status);
 
@@ -332,6 +331,19 @@
 }
 static DEVICE_ATTR_RO(vendor);
 
+static umode_t retimer_is_visible(struct kobject *kobj, struct attribute *attr,
+				  int n)
+{
+	struct device *dev = kobj_to_dev(kobj);
+	struct tb_retimer *rt = tb_to_retimer(dev);
+
+	if (attr == &dev_attr_nvm_authenticate.attr ||
+	    attr == &dev_attr_nvm_version.attr)
+		return rt->no_nvm_upgrade ? 0 : attr->mode;
+
+	return attr->mode;
+}
+
 static struct attribute *retimer_attrs[] = {
 	&dev_attr_device.attr,
 	&dev_attr_nvm_authenticate.attr,
@@ -341,6 +353,7 @@
 };
 
 static const struct attribute_group retimer_group = {
+	.is_visible = retimer_is_visible,
 	.attrs = retimer_attrs,
 };
 
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/switch.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/switch.c
@@ -676,6 +676,13 @@
 	return __tb_port_enable(port, false);
 }
 
+static int tb_port_reset(struct tb_port *port)
+{
+	if (tb_switch_is_usb4(port->sw))
+		return port->cap_usb4 ? usb4_port_reset(port) : 0;
+	return tb_lc_reset_port(port);
+}
+
 /*
  * tb_init_port() - initialize a port
  *
@@ -1534,29 +1541,124 @@
 	       regs->__unknown1, regs->__unknown4);
 }
 
+static int tb_switch_reset_host(struct tb_switch *sw)
+{
+	if (sw->generation > 1) {
+		struct tb_port *port;
+
+		tb_switch_for_each_port(sw, port) {
+			int i, ret;
+
+			/*
+			 * For lane adapters we issue downstream port
+			 * reset and clear up path config spaces.
+			 *
+			 * For protocol adapters we disable the path and
+			 * clear path config space one by one (from 8 to
+			 * Max Input HopID of the adapter).
+			 */
+			if (tb_port_is_null(port) && !tb_is_upstream_port(port)) {
+				ret = tb_port_reset(port);
+				if (ret)
+					return ret;
+			} else if (tb_port_is_usb3_down(port) ||
+				   tb_port_is_usb3_up(port)) {
+				tb_usb3_port_enable(port, false);
+			} else if (tb_port_is_dpin(port) ||
+				   tb_port_is_dpout(port)) {
+				tb_dp_port_enable(port, false);
+			} else if (tb_port_is_pcie_down(port) ||
+				   tb_port_is_pcie_up(port)) {
+				tb_pci_port_enable(port, false);
+			} else {
+				continue;
+			}
+
+			/* Cleanup path config space of protocol adapter */
+			for (i = TB_PATH_MIN_HOPID;
+			     i <= port->config.max_in_hop_id; i++) {
+				ret = tb_path_deactivate_hop(port, i);
+				if (ret)
+					return ret;
+			}
+		}
+	} else {
+		struct tb_cfg_result res;
+
+		/* Thunderbolt 1 uses the "reset" config space packet */
+		res.err = tb_sw_write(sw, ((u32 *) &sw->config) + 2,
+				      TB_CFG_SWITCH, 2, 2);
+		if (res.err)
+			return res.err;
+		res = tb_cfg_reset(sw->tb->ctl, tb_route(sw));
+		if (res.err > 0)
+			return -EIO;
+		else if (res.err < 0)
+			return res.err;
+	}
+
+	return 0;
+}
+
+static int tb_switch_reset_device(struct tb_switch *sw)
+{
+	return tb_port_reset(tb_switch_downstream_port(sw));
+}
+
+static bool tb_switch_enumerated(struct tb_switch *sw)
+{
+	u32 val;
+	int ret;
+
+	/*
+	 * Read directly from the hardware because we use this also
+	 * during system sleep where sw->config.enabled is already set
+	 * by us.
+	 */
+	ret = tb_sw_read(sw, &val, TB_CFG_SWITCH, ROUTER_CS_3, 1);
+	if (ret)
+		return false;
+
+	return !!(val & ROUTER_CS_3_V);
+}
+
 /**
- * tb_switch_reset() - reconfigure route, enable and send TB_CFG_PKG_RESET
- * @sw: Switch to reset
+ * tb_switch_reset() - Perform reset to the router
+ * @sw: Router to reset
  *
- * Return: Returns 0 on success or an error code on failure.
+ * Issues reset to the router @sw. Can be used for any router. For host
+ * routers, resets all the downstream ports and cleans up path config
+ * spaces accordingly. For device routers issues downstream port reset
+ * through the parent router, so as side effect there will be unplug
+ * soon after this is finished.
+ *
+ * If the router is not enumerated does nothing.
+ *
+ * Returns %0 on success or negative errno in case of failure.
  */
 int tb_switch_reset(struct tb_switch *sw)
 {
-	struct tb_cfg_result res;
+	int ret;
 
-	if (sw->generation > 1)
+	/*
+	 * We cannot access the port config spaces unless the router is
+	 * already enumerated. If the router is not enumerated it is
+	 * equal to being reset so we can skip that here.
+	 */
+	if (!tb_switch_enumerated(sw))
 		return 0;
 
-	tb_sw_dbg(sw, "resetting switch\n");
+	tb_sw_dbg(sw, "resetting\n");
+
+	if (tb_route(sw))
+		ret = tb_switch_reset_device(sw);
+	else
+		ret = tb_switch_reset_host(sw);
 
-	res.err = tb_sw_write(sw, ((u32 *) &sw->config) + 2,
-			      TB_CFG_SWITCH, 2, 2);
-	if (res.err)
-		return res.err;
-	res = tb_cfg_reset(sw->tb->ctl, tb_route(sw));
-	if (res.err > 0)
-		return -EIO;
-	return res.err;
+	if (ret)
+		tb_sw_warn(sw, "failed to reset\n");
+
+	return ret;
 }
 
 /**
@@ -3078,22 +3180,29 @@
 {
 	struct tb_port *up, *down;
 
-	if (sw->is_unplugged)
-		return;
 	if (!tb_route(sw) || tb_switch_is_icm(sw))
 		return;
 
+	/*
+	 * Unconfigure downstream port so that wake-on-connect can be
+	 * configured after router unplug. No need to unconfigure upstream port
+	 * since its router is unplugged.
+	 */
 	up = tb_upstream_port(sw);
-	if (tb_switch_is_usb4(up->sw))
-		usb4_port_unconfigure(up);
-	else
-		tb_lc_unconfigure_port(up);
-
 	down = up->remote;
 	if (tb_switch_is_usb4(down->sw))
 		usb4_port_unconfigure(down);
 	else
 		tb_lc_unconfigure_port(down);
+
+	if (sw->is_unplugged)
+		return;
+
+	up = tb_upstream_port(sw);
+	if (tb_switch_is_usb4(up->sw))
+		usb4_port_unconfigure(up);
+	else
+		tb_lc_unconfigure_port(up);
 }
 
 static void tb_switch_credits_init(struct tb_switch *sw)
@@ -3283,6 +3392,7 @@
 			tb_switch_remove(port->remote->sw);
 			port->remote = NULL;
 		} else if (port->xdomain) {
+			port->xdomain->is_unplugged = true;
 			tb_xdomain_remove(port->xdomain);
 			port->xdomain = NULL;
 		}
@@ -3339,7 +3449,26 @@
 	return tb_lc_set_wake(sw, flags);
 }
 
-int tb_switch_resume(struct tb_switch *sw)
+static void tb_switch_check_wakes(struct tb_switch *sw)
+{
+	if (device_may_wakeup(&sw->dev)) {
+		if (tb_switch_is_usb4(sw))
+			usb4_switch_check_wakes(sw);
+	}
+}
+
+/**
+ * tb_switch_resume() - Resume a switch after sleep
+ * @sw: Switch to resume
+ * @runtime: Is this resume from runtime suspend or system sleep
+ *
+ * Resumes and re-enumerates router (and all its children), if still plugged
+ * after suspend. Don't enumerate device router whose UID was changed during
+ * suspend. If this is resume from system sleep, notifies PM core about the
+ * wakes occurred during suspend. Disables all wakes, except USB4 wake of
+ * upstream port for USB4 routers that shall be always enabled.
+ */
+int tb_switch_resume(struct tb_switch *sw, bool runtime)
 {
 	struct tb_port *port;
 	int err;
@@ -3388,6 +3517,9 @@
 	if (err)
 		return err;
 
+	if (!runtime)
+		tb_switch_check_wakes(sw);
+
 	/* Disable wakes */
 	tb_switch_set_wake(sw, 0);
 
@@ -3417,7 +3549,8 @@
 			 */
 			if (tb_port_unlock(port))
 				tb_port_warn(port, "failed to unlock port\n");
-			if (port->remote && tb_switch_resume(port->remote->sw)) {
+			if (port->remote &&
+			    tb_switch_resume(port->remote->sw, runtime)) {
 				tb_port_warn(port,
 					     "lost during suspend, disconnecting\n");
 				tb_sw_set_unplugged(port->remote->sw);
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/tb.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/tb.c
@@ -393,6 +393,24 @@
 	device_for_each_child(&sw->dev, NULL, tb_increase_switch_tmu_accuracy);
 }
 
+static int tb_switch_tmu_hifi_uni_required(struct device *dev, void *not_used)
+{
+	struct tb_switch *sw = tb_to_switch(dev);
+
+	if (sw && tb_switch_tmu_is_enabled(sw) &&
+	    tb_switch_tmu_is_configured(sw, TB_SWITCH_TMU_MODE_HIFI_UNI))
+		return 1;
+
+	return device_for_each_child(dev, NULL,
+				     tb_switch_tmu_hifi_uni_required);
+}
+
+static bool tb_tmu_hifi_uni_required(struct tb *tb)
+{
+	return device_for_each_child(&tb->dev, NULL,
+				     tb_switch_tmu_hifi_uni_required) == 1;
+}
+
 static int tb_enable_tmu(struct tb_switch *sw)
 {
 	int ret;
@@ -407,12 +425,30 @@
 	ret = tb_switch_tmu_configure(sw,
 			TB_SWITCH_TMU_MODE_MEDRES_ENHANCED_UNI);
 	if (ret == -EOPNOTSUPP) {
-		if (tb_switch_clx_is_enabled(sw, TB_CL1))
-			ret = tb_switch_tmu_configure(sw,
-					TB_SWITCH_TMU_MODE_LOWRES);
-		else
-			ret = tb_switch_tmu_configure(sw,
-					TB_SWITCH_TMU_MODE_HIFI_BI);
+		if (tb_switch_clx_is_enabled(sw, TB_CL1)) {
+			/*
+			 * Figure out uni-directional HiFi TMU requirements
+			 * currently in the domain. If there are no
+			 * uni-directional HiFi requirements we can put the TMU
+			 * into LowRes mode.
+			 *
+			 * Deliberately skip bi-directional HiFi links
+			 * as these work independently of other links
+			 * (and they do not allow any CL states anyway).
+			 */
+			if (tb_tmu_hifi_uni_required(sw->tb))
+				ret = tb_switch_tmu_configure(sw,
+						TB_SWITCH_TMU_MODE_HIFI_UNI);
+			else
+				ret = tb_switch_tmu_configure(sw,
+						TB_SWITCH_TMU_MODE_LOWRES);
+		} else {
+			ret = tb_switch_tmu_configure(sw, TB_SWITCH_TMU_MODE_HIFI_BI);
+		}
+
+		/* If not supported, fallback to bi-directional HiFi */
+		if (ret == -EOPNOTSUPP)
+			ret = tb_switch_tmu_configure(sw, TB_SWITCH_TMU_MODE_HIFI_BI);
 	}
 	if (ret)
 		return ret;
@@ -1717,6 +1753,12 @@
 			continue;
 		}
 
+		/* Needs to be on different routers */
+		if (in->sw == port->sw) {
+			tb_port_dbg(port, "skipping DP OUT on same router\n");
+			continue;
+		}
+
 		tb_port_dbg(port, "DP OUT available\n");
 
 		/*
@@ -1737,49 +1779,15 @@
 	return NULL;
 }
 
-static bool tb_tunnel_one_dp(struct tb *tb)
+static bool tb_tunnel_one_dp(struct tb *tb, struct tb_port *in,
+			     struct tb_port *out)
 {
 	int available_up, available_down, ret, link_nr;
 	struct tb_cm *tcm = tb_priv(tb);
-	struct tb_port *port, *in, *out;
 	int consumed_up, consumed_down;
 	struct tb_tunnel *tunnel;
 
 	/*
-	 * Find pair of inactive DP IN and DP OUT adapters and then
-	 * establish a DP tunnel between them.
-	 */
-	tb_dbg(tb, "looking for DP IN <-> DP OUT pairs:\n");
-
-	in = NULL;
-	out = NULL;
-	list_for_each_entry(port, &tcm->dp_resources, list) {
-		if (!tb_port_is_dpin(port))
-			continue;
-
-		if (tb_port_is_enabled(port)) {
-			tb_port_dbg(port, "DP IN in use\n");
-			continue;
-		}
-
-		in = port;
-		tb_port_dbg(in, "DP IN available\n");
-
-		out = tb_find_dp_out(tb, port);
-		if (out)
-			break;
-	}
-
-	if (!in) {
-		tb_dbg(tb, "no suitable DP IN adapter available, not tunneling\n");
-		return false;
-	}
-	if (!out) {
-		tb_dbg(tb, "no suitable DP OUT adapter available, not tunneling\n");
-		return false;
-	}
-
-	/*
 	 * This is only applicable to links that are not bonded (so
 	 * when Thunderbolt 1 hardware is involved somewhere in the
 	 * topology). For these try to share the DP bandwidth between
@@ -1839,15 +1847,19 @@
 		goto err_free;
 	}
 
+	/* If fail reading tunnel's consumed bandwidth, tear it down */
+	ret = tb_tunnel_consumed_bandwidth(tunnel, &consumed_up, &consumed_down);
+	if (ret)
+		goto err_deactivate;
+
 	list_add_tail(&tunnel->list, &tcm->tunnel_list);
-	tb_reclaim_usb3_bandwidth(tb, in, out);
 
+	tb_reclaim_usb3_bandwidth(tb, in, out);
 	/*
 	 * Transition the links to asymmetric if the consumption exceeds
 	 * the threshold.
 	 */
-	if (!tb_tunnel_consumed_bandwidth(tunnel, &consumed_up, &consumed_down))
-		tb_configure_asym(tb, in, out, consumed_up, consumed_down);
+	tb_configure_asym(tb, in, out, consumed_up, consumed_down);
 
 	/* Update the domain with the new bandwidth estimation */
 	tb_recalc_estimated_bandwidth(tb);
@@ -1859,6 +1871,8 @@
 	tb_increase_tmu_accuracy(tunnel);
 	return true;
 
+err_deactivate:
+	tb_tunnel_deactivate(tunnel);
 err_free:
 	tb_tunnel_free(tunnel);
 err_reclaim_usb:
@@ -1878,13 +1892,117 @@
 
 static void tb_tunnel_dp(struct tb *tb)
 {
+	struct tb_cm *tcm = tb_priv(tb);
+	struct tb_port *port, *in, *out;
+
 	if (!tb_acpi_may_tunnel_dp()) {
 		tb_dbg(tb, "DP tunneling disabled, not creating tunnel\n");
 		return;
 	}
 
-	while (tb_tunnel_one_dp(tb))
-		;
+	/*
+	 * Find pair of inactive DP IN and DP OUT adapters and then
+	 * establish a DP tunnel between them.
+	 */
+	tb_dbg(tb, "looking for DP IN <-> DP OUT pairs:\n");
+
+	in = NULL;
+	out = NULL;
+	list_for_each_entry(port, &tcm->dp_resources, list) {
+		if (!tb_port_is_dpin(port))
+			continue;
+
+		if (tb_port_is_enabled(port)) {
+			tb_port_dbg(port, "DP IN in use\n");
+			continue;
+		}
+
+		in = port;
+		tb_port_dbg(in, "DP IN available\n");
+
+		out = tb_find_dp_out(tb, port);
+		if (out)
+			tb_tunnel_one_dp(tb, in, out);
+		else
+			tb_port_dbg(in, "no suitable DP OUT adapter available, not tunneling\n");
+	}
+
+	if (!in)
+		tb_dbg(tb, "no suitable DP IN adapter available, not tunneling\n");
+}
+
+static void tb_enter_redrive(struct tb_port *port)
+{
+	struct tb_switch *sw = port->sw;
+
+	if (!(sw->quirks & QUIRK_KEEP_POWER_IN_DP_REDRIVE))
+		return;
+
+	/*
+	 * If we get hot-unplug for the DP IN port of the host router
+	 * and the DP resource is not available anymore it means there
+	 * is a monitor connected directly to the Type-C port and we are
+	 * in "redrive" mode. For this to work we cannot enter RTD3 so
+	 * we bump up the runtime PM reference count here.
+	 */
+	if (!tb_port_is_dpin(port))
+		return;
+	if (tb_route(sw))
+		return;
+	if (!tb_switch_query_dp_resource(sw, port)) {
+		port->redrive = true;
+		pm_runtime_get(&sw->dev);
+		tb_port_dbg(port, "enter redrive mode, keeping powered\n");
+	}
+}
+
+static void tb_exit_redrive(struct tb_port *port)
+{
+	struct tb_switch *sw = port->sw;
+
+	if (!(sw->quirks & QUIRK_KEEP_POWER_IN_DP_REDRIVE))
+		return;
+
+	if (!tb_port_is_dpin(port))
+		return;
+	if (tb_route(sw))
+		return;
+	if (port->redrive && tb_switch_query_dp_resource(sw, port)) {
+		port->redrive = false;
+		pm_runtime_put(&sw->dev);
+		tb_port_dbg(port, "exit redrive mode\n");
+	}
+}
+
+static void tb_switch_enter_redrive(struct tb_switch *sw)
+{
+	struct tb_port *port;
+
+	tb_switch_for_each_port(sw, port)
+		tb_enter_redrive(port);
+}
+
+/*
+ * Called during system and runtime suspend to forcefully exit redrive
+ * mode without querying whether the resource is available.
+ */
+static void tb_switch_exit_redrive(struct tb_switch *sw)
+{
+	struct tb_port *port;
+
+	if (!(sw->quirks & QUIRK_KEEP_POWER_IN_DP_REDRIVE))
+		return;
+
+	tb_switch_for_each_port(sw, port) {
+		if (!tb_port_is_dpin(port))
+			continue;
+
+		if (port->redrive) {
+			port->redrive = false;
+			pm_runtime_put(&sw->dev);
+			tb_port_dbg(port, "exit redrive mode\n");
+		}
+	}
 }
 
 static void tb_dp_resource_unavailable(struct tb *tb, struct tb_port *port)
@@ -1903,7 +2021,10 @@
 	}
 
 	tunnel = tb_find_tunnel(tb, TB_TUNNEL_DP, in, out);
-	tb_deactivate_and_free_tunnel(tunnel);
+	if (tunnel)
+		tb_deactivate_and_free_tunnel(tunnel);
+	else
+		tb_enter_redrive(port);
 	list_del_init(&port->list);
 
 	/*
@@ -1930,6 +2051,7 @@
 	tb_port_dbg(port, "DP %s resource available after hotplug\n",
 		    tb_port_is_dpin(port) ? "IN" : "OUT");
 	list_add_tail(&port->list, &tcm->dp_resources);
+	tb_exit_redrive(port);
 
 	/* Look for suitable DP IN <-> DP OUT pairs now */
 	tb_tunnel_dp(tb);
@@ -2581,7 +2703,7 @@
 	return 0;
 }
 
-static int tb_start(struct tb *tb)
+static int tb_start(struct tb *tb, bool reset)
 {
 	struct tb_cm *tcm = tb_priv(tb);
 	int ret;
@@ -2622,12 +2744,24 @@
 	tb_switch_tmu_configure(tb->root_switch, TB_SWITCH_TMU_MODE_LOWRES);
 	/* Enable TMU if it is off */
 	tb_switch_tmu_enable(tb->root_switch);
-	/* Full scan to discover devices added before the driver was loaded. */
-	tb_scan_switch(tb->root_switch);
-	/* Find out tunnels created by the boot firmware */
-	tb_discover_tunnels(tb);
-	/* Add DP resources from the DP tunnels created by the boot firmware */
-	tb_discover_dp_resources(tb);
+
+	/*
+	 * Boot firmware might have created tunnels of its own. Since we
+	 * cannot be sure they are usable for us, tear them down and
+	 * reset the ports to handle it as new hotplug for USB4 v1
+	 * routers (for USB4 v2 and beyond we already do host reset).
+	 */
+	if (reset && usb4_switch_version(tb->root_switch) == 1) {
+		tb_switch_reset(tb->root_switch);
+	} else {
+		/* Full scan to discover devices added before the driver was loaded. */
+		tb_scan_switch(tb->root_switch);
+		/* Find out tunnels created by the boot firmware */
+		tb_discover_tunnels(tb);
+		/* Add DP resources from the DP tunnels created by the boot firmware */
+		tb_discover_dp_resources(tb);
+	}
+
 	/*
 	 * If the boot firmware did not create USB 3.x tunnels create them
 	 * now for the whole topology.
@@ -2635,6 +2769,7 @@
 	tb_create_usb3_tunnels(tb->root_switch);
 	/* Add DP IN resources for the root switch */
 	tb_add_dp_resources(tb->root_switch);
+	tb_switch_enter_redrive(tb->root_switch);
 	/* Make the discovered switches available to the userspace */
 	device_for_each_child(&tb->root_switch->dev, NULL,
 			      tb_scan_finalize_switch);
@@ -2650,6 +2785,7 @@
 
 	tb_dbg(tb, "suspending...\n");
 	tb_disconnect_and_release_dp(tb);
+	tb_switch_exit_redrive(tb->root_switch);
 	tb_switch_suspend(tb->root_switch, false);
 	tcm->hotplug_active = false; /* signal tb_handle_hotplug to quit */
 	tb_dbg(tb, "suspend finished\n");
@@ -2698,10 +2834,14 @@
 
 	tb_dbg(tb, "resuming...\n");
 
-	/* remove any pci devices the firmware might have setup */
-	tb_switch_reset(tb->root_switch);
+	/*
+	 * For non-USB4 hosts (Apple systems) remove any PCIe devices
+	 * the firmware might have setup.
+	 */
+	if (!tb_switch_is_usb4(tb->root_switch))
+		tb_switch_reset(tb->root_switch);
 
-	tb_switch_resume(tb->root_switch);
+	tb_switch_resume(tb->root_switch, false);
 	tb_free_invalid_tunnels(tb);
 	tb_free_unplugged_children(tb->root_switch);
 	tb_restore_children(tb->root_switch);
@@ -2738,6 +2878,7 @@
 		tb_dbg(tb, "tunnels restarted, sleeping for 100ms\n");
 		msleep(100);
 	}
+	tb_switch_enter_redrive(tb->root_switch);
 	 /* Allow tb_handle_hotplug to progress events */
 	tcm->hotplug_active = true;
 	tb_dbg(tb, "resume finished\n");
@@ -2801,6 +2942,12 @@
 	struct tb_cm *tcm = tb_priv(tb);
 
 	mutex_lock(&tb->lock);
+	/*
+	 * The below call only releases DP resources to allow exiting and
+	 * re-entering redrive mode.
+	 */
+	tb_disconnect_and_release_dp(tb);
+	tb_switch_exit_redrive(tb->root_switch);
 	tb_switch_suspend(tb->root_switch, true);
 	tcm->hotplug_active = false;
 	mutex_unlock(&tb->lock);
@@ -2827,11 +2974,12 @@
 	struct tb_tunnel *tunnel, *n;
 
 	mutex_lock(&tb->lock);
-	tb_switch_resume(tb->root_switch);
+	tb_switch_resume(tb->root_switch, true);
 	tb_free_invalid_tunnels(tb);
 	tb_restore_children(tb->root_switch);
 	list_for_each_entry_safe(tunnel, n, &tcm->tunnel_list, list)
 		tb_tunnel_restart(tunnel);
+	tb_switch_enter_redrive(tb->root_switch);
 	tcm->hotplug_active = true;
 	mutex_unlock(&tb->lock);
 
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/tb.h
+++ linux-qcom-6.8.0/drivers/thunderbolt/tb.h
@@ -23,6 +23,8 @@
 #define QUIRK_FORCE_POWER_LINK_CONTROLLER		BIT(0)
 /* Disable CLx if not supported */
 #define QUIRK_NO_CLX					BIT(1)
+/* Need to keep power on while USB4 port is in redrive mode */
+#define QUIRK_KEEP_POWER_IN_DP_REDRIVE			BIT(2)
 
 /**
  * struct tb_nvm - Structure holding NVM information
@@ -258,6 +260,7 @@
  * @group_list: The adapter is linked to the group's list of ports through this
  * @max_bw: Maximum possible bandwidth through this adapter if set to
  *	    non-zero.
+ * @redrive: For DP IN, if true the adapter is in redrive mode.
  *
  * In USB4 terminology this structure represents an adapter (protocol or
  * lane adapter).
@@ -286,6 +289,7 @@
 	struct tb_bandwidth_group *group;
 	struct list_head group_list;
 	unsigned int max_bw;
+	bool redrive;
 };
 
 /**
@@ -483,7 +487,7 @@
  */
 struct tb_cm_ops {
 	int (*driver_ready)(struct tb *tb);
-	int (*start)(struct tb *tb);
+	int (*start)(struct tb *tb, bool reset);
 	void (*stop)(struct tb *tb);
 	int (*suspend_noirq)(struct tb *tb);
 	int (*resume_noirq)(struct tb *tb);
@@ -746,7 +750,7 @@
 void tb_xdomain_exit(void);
 
 struct tb *tb_domain_alloc(struct tb_nhi *nhi, int timeout_msec, size_t privsize);
-int tb_domain_add(struct tb *tb);
+int tb_domain_add(struct tb *tb, bool reset);
 void tb_domain_remove(struct tb *tb);
 int tb_domain_suspend_noirq(struct tb *tb);
 int tb_domain_resume_noirq(struct tb *tb);
@@ -813,7 +817,7 @@
 int tb_switch_add(struct tb_switch *sw);
 void tb_switch_remove(struct tb_switch *sw);
 void tb_switch_suspend(struct tb_switch *sw, bool runtime);
-int tb_switch_resume(struct tb_switch *sw);
+int tb_switch_resume(struct tb_switch *sw, bool runtime);
 int tb_switch_reset(struct tb_switch *sw);
 int tb_switch_wait_for_bit(struct tb_switch *sw, u32 offset, u32 bit,
 			   u32 value, int timeout_msec);
@@ -1150,6 +1154,7 @@
 void tb_path_free(struct tb_path *path);
 int tb_path_activate(struct tb_path *path);
 void tb_path_deactivate(struct tb_path *path);
+int tb_path_deactivate_hop(struct tb_port *port, int hop_index);
 bool tb_path_is_invalid(struct tb_path *path);
 bool tb_path_port_on_path(const struct tb_path *path,
 			  const struct tb_port *port);
@@ -1169,6 +1174,7 @@
 int tb_drom_read_uid_only(struct tb_switch *sw, u64 *uid);
 
 int tb_lc_read_uuid(struct tb_switch *sw, u32 *uuid);
+int tb_lc_reset_port(struct tb_port *port);
 int tb_lc_configure_port(struct tb_port *port);
 void tb_lc_unconfigure_port(struct tb_port *port);
 int tb_lc_configure_xdomain(struct tb_port *port);
@@ -1272,6 +1278,7 @@
 	return usb4_switch_version(sw) > 0;
 }
 
+void usb4_switch_check_wakes(struct tb_switch *sw);
 int usb4_switch_setup(struct tb_switch *sw);
 int usb4_switch_configuration_valid(struct tb_switch *sw);
 int usb4_switch_read_uid(struct tb_switch *sw, u64 *uid);
@@ -1301,6 +1308,7 @@
 
 int usb4_port_unlock(struct tb_port *port);
 int usb4_port_hotplug_enable(struct tb_port *port);
+int usb4_port_reset(struct tb_port *port);
 int usb4_port_configure(struct tb_port *port);
 void usb4_port_unconfigure(struct tb_port *port);
 int usb4_port_configure_xdomain(struct tb_port *port, struct tb_xdomain *xd);
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/tb_regs.h
+++ linux-qcom-6.8.0/drivers/thunderbolt/tb_regs.h
@@ -194,6 +194,8 @@
 #define USB4_VERSION_MAJOR_MASK			GENMASK(7, 5)
 
 #define ROUTER_CS_1				0x01
+#define ROUTER_CS_3				0x03
+#define ROUTER_CS_3_V				BIT(31)
 #define ROUTER_CS_4				0x04
 /* Used with the router cmuv field */
 #define ROUTER_CS_4_CMUV_V1			0x10
@@ -389,6 +391,7 @@
 #define PORT_CS_18_CSA				BIT(22)
 #define PORT_CS_18_TIP				BIT(24)
 #define PORT_CS_19				0x13
+#define PORT_CS_19_DPR				BIT(0)
 #define PORT_CS_19_PC				BIT(3)
 #define PORT_CS_19_PID				BIT(4)
 #define PORT_CS_19_WOC				BIT(16)
@@ -584,6 +587,9 @@
 #define TB_LC_POWER				0x740
 
 /* Link controller registers */
+#define TB_LC_PORT_MODE				0x26
+#define TB_LC_PORT_MODE_DPR			BIT(0)
+
 #define TB_LC_CS_42				0x2a
 #define TB_LC_CS_42_USB_PLUGGED			BIT(31)
 
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/tunnel.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/tunnel.c
@@ -1196,17 +1196,13 @@
 		/*
 		 * Then see if the DPRX negotiation is ready and if yes
 		 * return that bandwidth (it may be smaller than the
-		 * reduced one). Otherwise return the remote (possibly
-		 * reduced) caps.
+		 * reduced one). According to VESA spec, the DPRX
+		 * negotiation shall compete in 5 seconds after tunnel
+		 * established. We give it 100ms extra just in case.
 		 */
-		ret = tb_dp_wait_dprx(tunnel, 150);
-		if (ret) {
-			if (ret == -ETIMEDOUT)
-				ret = tb_dp_read_cap(tunnel, DP_REMOTE_CAP,
-						     &rate, &lanes);
-			if (ret)
-				return ret;
-		}
+		ret = tb_dp_wait_dprx(tunnel, 5100);
+		if (ret)
+			return ret;
 		ret = tb_dp_read_cap(tunnel, DP_COMMON_CAP, &rate, &lanes);
 		if (ret)
 			return ret;
--- linux-qcom-6.8.0.orig/drivers/thunderbolt/usb4.c
+++ linux-qcom-6.8.0/drivers/thunderbolt/usb4.c
@@ -155,7 +155,13 @@
 				tx_dwords, rx_data, rx_dwords);
 }
 
-static void usb4_switch_check_wakes(struct tb_switch *sw)
+/**
+ * usb4_switch_check_wakes() - Check for wakes and notify PM core about them
+ * @sw: Router whose wakes to check
+ *
+ * Checks wakes occurred during suspend and notify the PM core about them.
+ */
+void usb4_switch_check_wakes(struct tb_switch *sw)
 {
 	bool wakeup_usb4 = false;
 	struct usb4_port *usb4;
@@ -163,9 +169,6 @@
 	bool wakeup = false;
 	u32 val;
 
-	if (!device_may_wakeup(&sw->dev))
-		return;
-
 	if (tb_route(sw)) {
 		if (tb_sw_read(sw, &val, TB_CFG_SWITCH, ROUTER_CS_6, 1))
 			return;
@@ -244,8 +247,6 @@
 	u32 val = 0;
 	int ret;
 
-	usb4_switch_check_wakes(sw);
-
 	if (!tb_route(sw))
 		return 0;
 
@@ -1113,6 +1114,45 @@
 	return tb_port_write(port, &val, TB_CFG_PORT, ADP_CS_5, 1);
 }
 
+/**
+ * usb4_port_reset() - Issue downstream port reset
+ * @port: USB4 port to reset
+ *
+ * Issues downstream port reset to @port.
+ */
+int usb4_port_reset(struct tb_port *port)
+{
+	int ret;
+	u32 val;
+
+	if (!port->cap_usb4)
+		return -EINVAL;
+
+	ret = tb_port_read(port, &val, TB_CFG_PORT,
+			   port->cap_usb4 + PORT_CS_19, 1);
+	if (ret)
+		return ret;
+
+	val |= PORT_CS_19_DPR;
+
+	ret = tb_port_write(port, &val, TB_CFG_PORT,
+			    port->cap_usb4 + PORT_CS_19, 1);
+	if (ret)
+		return ret;
+
+	fsleep(10000);
+
+	ret = tb_port_read(port, &val, TB_CFG_PORT,
+			   port->cap_usb4 + PORT_CS_19, 1);
+	if (ret)
+		return ret;
+
+	val &= ~PORT_CS_19_DPR;
+
+	return tb_port_write(port, &val, TB_CFG_PORT,
+			     port->cap_usb4 + PORT_CS_19, 1);
+}
+
 static int usb4_port_set_configured(struct tb_port *port, bool configured)
 {
 	int ret;
--- linux-qcom-6.8.0.orig/drivers/tty/mips_ejtag_fdc.c
+++ linux-qcom-6.8.0/drivers/tty/mips_ejtag_fdc.c
@@ -309,7 +309,7 @@
 	unsigned int i, buf_len, cpu;
 	bool done_cr = false;
 	char buf[4];
-	const char *buf_ptr = buf;
+	const u8 *buf_ptr = buf;
 	/* Number of bytes of input data encoded up to each byte in buf */
 	u8 inc[4];
 
--- linux-qcom-6.8.0.orig/drivers/tty/mxser.c
+++ linux-qcom-6.8.0/drivers/tty/mxser.c
@@ -288,7 +288,7 @@
 	enum mxser_must_hwid must_hwid;
 	speed_t max_baud;
 
-	struct mxser_port ports[] __counted_by(nports);
+	struct mxser_port ports[] /* __counted_by(nports) */;
 };
 
 static DECLARE_BITMAP(mxser_boards, MXSER_BOARDS);
--- linux-qcom-6.8.0.orig/drivers/tty/n_gsm.c
+++ linux-qcom-6.8.0/drivers/tty/n_gsm.c
@@ -245,16 +245,18 @@
 
 enum gsm_mux_state {
 	GSM_SEARCH,
-	GSM_START,
-	GSM_ADDRESS,
-	GSM_CONTROL,
-	GSM_LEN,
-	GSM_DATA,
-	GSM_FCS,
-	GSM_OVERRUN,
-	GSM_LEN0,
-	GSM_LEN1,
-	GSM_SSOF,
+	GSM0_ADDRESS,
+	GSM0_CONTROL,
+	GSM0_LEN0,
+	GSM0_LEN1,
+	GSM0_DATA,
+	GSM0_FCS,
+	GSM0_SSOF,
+	GSM1_START,
+	GSM1_ADDRESS,
+	GSM1_CONTROL,
+	GSM1_DATA,
+	GSM1_OVERRUN,
 };
 
 /*
@@ -2847,6 +2849,30 @@
 	return;
 }
 
+/**
+ * gsm0_receive_state_check_and_fix	-	check and correct receive state
+ * @gsm: gsm data for this ldisc instance
+ *
+ * Ensures that the current receive state is valid for basic option mode.
+ */
+
+static void gsm0_receive_state_check_and_fix(struct gsm_mux *gsm)
+{
+	switch (gsm->state) {
+	case GSM_SEARCH:
+	case GSM0_ADDRESS:
+	case GSM0_CONTROL:
+	case GSM0_LEN0:
+	case GSM0_LEN1:
+	case GSM0_DATA:
+	case GSM0_FCS:
+	case GSM0_SSOF:
+		break;
+	default:
+		gsm->state = GSM_SEARCH;
+		break;
+	}
+}
 
 /**
  *	gsm0_receive	-	perform processing for non-transparency
@@ -2860,26 +2886,27 @@
 {
 	unsigned int len;
 
+	gsm0_receive_state_check_and_fix(gsm);
 	switch (gsm->state) {
 	case GSM_SEARCH:	/* SOF marker */
 		if (c == GSM0_SOF) {
-			gsm->state = GSM_ADDRESS;
+			gsm->state = GSM0_ADDRESS;
 			gsm->address = 0;
 			gsm->len = 0;
 			gsm->fcs = INIT_FCS;
 		}
 		break;
-	case GSM_ADDRESS:	/* Address EA */
+	case GSM0_ADDRESS:	/* Address EA */
 		gsm->fcs = gsm_fcs_add(gsm->fcs, c);
 		if (gsm_read_ea(&gsm->address, c))
-			gsm->state = GSM_CONTROL;
+			gsm->state = GSM0_CONTROL;
 		break;
-	case GSM_CONTROL:	/* Control Byte */
+	case GSM0_CONTROL:	/* Control Byte */
 		gsm->fcs = gsm_fcs_add(gsm->fcs, c);
 		gsm->control = c;
-		gsm->state = GSM_LEN0;
+		gsm->state = GSM0_LEN0;
 		break;
-	case GSM_LEN0:		/* Length EA */
+	case GSM0_LEN0:		/* Length EA */
 		gsm->fcs = gsm_fcs_add(gsm->fcs, c);
 		if (gsm_read_ea(&gsm->len, c)) {
 			if (gsm->len > gsm->mru) {
@@ -2889,14 +2916,14 @@
 			}
 			gsm->count = 0;
 			if (!gsm->len)
-				gsm->state = GSM_FCS;
+				gsm->state = GSM0_FCS;
 			else
-				gsm->state = GSM_DATA;
+				gsm->state = GSM0_DATA;
 			break;
 		}
-		gsm->state = GSM_LEN1;
+		gsm->state = GSM0_LEN1;
 		break;
-	case GSM_LEN1:
+	case GSM0_LEN1:
 		gsm->fcs = gsm_fcs_add(gsm->fcs, c);
 		len = c;
 		gsm->len |= len << 7;
@@ -2907,26 +2934,29 @@
 		}
 		gsm->count = 0;
 		if (!gsm->len)
-			gsm->state = GSM_FCS;
+			gsm->state = GSM0_FCS;
 		else
-			gsm->state = GSM_DATA;
+			gsm->state = GSM0_DATA;
 		break;
-	case GSM_DATA:		/* Data */
+	case GSM0_DATA:		/* Data */
 		gsm->buf[gsm->count++] = c;
-		if (gsm->count == gsm->len) {
+		if (gsm->count >= MAX_MRU) {
+			gsm->bad_size++;
+			gsm->state = GSM_SEARCH;
+		} else if (gsm->count >= gsm->len) {
 			/* Calculate final FCS for UI frames over all data */
 			if ((gsm->control & ~PF) != UIH) {
 				gsm->fcs = gsm_fcs_add_block(gsm->fcs, gsm->buf,
 							     gsm->count);
 			}
-			gsm->state = GSM_FCS;
+			gsm->state = GSM0_FCS;
 		}
 		break;
-	case GSM_FCS:		/* FCS follows the packet */
+	case GSM0_FCS:		/* FCS follows the packet */
 		gsm->fcs = gsm_fcs_add(gsm->fcs, c);
-		gsm->state = GSM_SSOF;
+		gsm->state = GSM0_SSOF;
 		break;
-	case GSM_SSOF:
+	case GSM0_SSOF:
 		gsm->state = GSM_SEARCH;
 		if (c == GSM0_SOF)
 			gsm_queue(gsm);
@@ -2940,6 +2970,29 @@
 }
 
 /**
+ * gsm1_receive_state_check_and_fix	-	check and correct receive state
+ * @gsm: gsm data for this ldisc instance
+ *
+ * Ensures that the current receive state is valid for advanced option mode.
+ */
+
+static void gsm1_receive_state_check_and_fix(struct gsm_mux *gsm)
+{
+	switch (gsm->state) {
+	case GSM_SEARCH:
+	case GSM1_START:
+	case GSM1_ADDRESS:
+	case GSM1_CONTROL:
+	case GSM1_DATA:
+	case GSM1_OVERRUN:
+		break;
+	default:
+		gsm->state = GSM_SEARCH;
+		break;
+	}
+}
+
+/**
  *	gsm1_receive	-	perform processing for non-transparency
  *	@gsm: gsm data for this ldisc instance
  *	@c: character
@@ -2949,6 +3002,7 @@
 
 static void gsm1_receive(struct gsm_mux *gsm, u8 c)
 {
+	gsm1_receive_state_check_and_fix(gsm);
 	/* handle XON/XOFF */
 	if ((c & ISO_IEC_646_MASK) == XON) {
 		gsm->constipated = true;
@@ -2961,11 +3015,11 @@
 	}
 	if (c == GSM1_SOF) {
 		/* EOF is only valid in frame if we have got to the data state */
-		if (gsm->state == GSM_DATA) {
+		if (gsm->state == GSM1_DATA) {
 			if (gsm->count < 1) {
 				/* Missing FSC */
 				gsm->malformed++;
-				gsm->state = GSM_START;
+				gsm->state = GSM1_START;
 				return;
 			}
 			/* Remove the FCS from data */
@@ -2981,14 +3035,14 @@
 			gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->buf[gsm->count]);
 			gsm->len = gsm->count;
 			gsm_queue(gsm);
-			gsm->state  = GSM_START;
+			gsm->state  = GSM1_START;
 			return;
 		}
 		/* Any partial frame was a runt so go back to start */
-		if (gsm->state != GSM_START) {
+		if (gsm->state != GSM1_START) {
 			if (gsm->state != GSM_SEARCH)
 				gsm->malformed++;
-			gsm->state = GSM_START;
+			gsm->state = GSM1_START;
 		}
 		/* A SOF in GSM_START means we are still reading idling or
 		   framing bytes */
@@ -3009,30 +3063,30 @@
 		gsm->escape = false;
 	}
 	switch (gsm->state) {
-	case GSM_START:		/* First byte after SOF */
+	case GSM1_START:		/* First byte after SOF */
 		gsm->address = 0;
-		gsm->state = GSM_ADDRESS;
+		gsm->state = GSM1_ADDRESS;
 		gsm->fcs = INIT_FCS;
 		fallthrough;
-	case GSM_ADDRESS:	/* Address continuation */
+	case GSM1_ADDRESS:	/* Address continuation */
 		gsm->fcs = gsm_fcs_add(gsm->fcs, c);
 		if (gsm_read_ea(&gsm->address, c))
-			gsm->state = GSM_CONTROL;
+			gsm->state = GSM1_CONTROL;
 		break;
-	case GSM_CONTROL:	/* Control Byte */
+	case GSM1_CONTROL:	/* Control Byte */
 		gsm->fcs = gsm_fcs_add(gsm->fcs, c);
 		gsm->control = c;
 		gsm->count = 0;
-		gsm->state = GSM_DATA;
+		gsm->state = GSM1_DATA;
 		break;
-	case GSM_DATA:		/* Data */
-		if (gsm->count > gsm->mru) {	/* Allow one for the FCS */
-			gsm->state = GSM_OVERRUN;
+	case GSM1_DATA:		/* Data */
+		if (gsm->count > gsm->mru || gsm->count > MAX_MRU) {	/* Allow one for the FCS */
+			gsm->state = GSM1_OVERRUN;
 			gsm->bad_size++;
 		} else
 			gsm->buf[gsm->count++] = c;
 		break;
-	case GSM_OVERRUN:	/* Over-long - eg a dropped SOF */
+	case GSM1_OVERRUN:	/* Over-long - eg a dropped SOF */
 		break;
 	default:
 		pr_debug("%s: unhandled state: %d\n", __func__, gsm->state);
@@ -3103,6 +3157,8 @@
 	mutex_unlock(&gsm->mutex);
 	/* Now wipe the queues */
 	tty_ldisc_flush(gsm->tty);
+
+	guard(spinlock_irqsave)(&gsm->tx_lock);
 	list_for_each_entry_safe(txq, ntxq, &gsm->tx_ctrl_list, list)
 		kfree(txq);
 	INIT_LIST_HEAD(&gsm->tx_ctrl_list);
--- linux-qcom-6.8.0.orig/drivers/tty/n_tty.c
+++ linux-qcom-6.8.0/drivers/tty/n_tty.c
@@ -1619,15 +1619,25 @@
 	else if (ldata->raw || (L_EXTPROC(tty) && !preops))
 		n_tty_receive_buf_raw(tty, cp, fp, count);
 	else if (tty->closing && !L_EXTPROC(tty)) {
-		if (la_count > 0)
+		if (la_count > 0) {
 			n_tty_receive_buf_closing(tty, cp, fp, la_count, true);
-		if (count > la_count)
-			n_tty_receive_buf_closing(tty, cp, fp, count - la_count, false);
+			cp += la_count;
+			if (fp)
+				fp += la_count;
+			count -= la_count;
+		}
+		if (count > 0)
+			n_tty_receive_buf_closing(tty, cp, fp, count, false);
 	} else {
-		if (la_count > 0)
+		if (la_count > 0) {
 			n_tty_receive_buf_standard(tty, cp, fp, la_count, true);
-		if (count > la_count)
-			n_tty_receive_buf_standard(tty, cp, fp, count - la_count, false);
+			cp += la_count;
+			if (fp)
+				fp += la_count;
+			count -= la_count;
+		}
+		if (count > 0)
+			n_tty_receive_buf_standard(tty, cp, fp, count, false);
 
 		flush_echoes(tty);
 		if (tty->ops->flush_chars)
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_bcm7271.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_bcm7271.c
@@ -676,18 +676,46 @@
 	clk_set_rate(priv->baud_mux_clk, priv->default_mux_rate);
 }
 
+static u32 find_quot(struct device *dev, u32 freq, u32 baud, u32 *percent)
+{
+	u32 quot;
+	u32 rate;
+	u64 hires_rate;
+	u64 hires_baud;
+	u64 hires_err;
+
+	rate = freq / 16;
+	quot = DIV_ROUND_CLOSEST(rate, baud);
+	if (!quot)
+		return 0;
+
+	/* increase resolution to get xx.xx percent */
+	hires_rate = div_u64((u64)rate * 10000, (u64)quot);
+	hires_baud = (u64)baud * 10000;
+
+	/* get the delta */
+	if (hires_rate > hires_baud)
+		hires_err = (hires_rate - hires_baud);
+	else
+		hires_err = (hires_baud - hires_rate);
+
+	*percent = (unsigned long)DIV_ROUND_CLOSEST_ULL(hires_err, baud);
+
+	dev_dbg(dev, "Baud rate: %u, MUX Clk: %u, Error: %u.%u%%\n",
+		baud, freq, *percent / 100, *percent % 100);
+
+	return quot;
+}
+
 static void set_clock_mux(struct uart_port *up, struct brcmuart_priv *priv,
 			u32 baud)
 {
 	u32 percent;
 	u32 best_percent = UINT_MAX;
 	u32 quot;
+	u32 freq;
 	u32 best_quot = 1;
-	u32 rate;
-	int best_index = -1;
-	u64 hires_rate;
-	u64 hires_baud;
-	u64 hires_err;
+	u32 best_freq = 0;
 	int rc;
 	int i;
 	int real_baud;
@@ -696,44 +724,35 @@
 	if (priv->baud_mux_clk == NULL)
 		return;
 
-	/* Find the closest match for specified baud */
-	for (i = 0; i < ARRAY_SIZE(priv->real_rates); i++) {
-		if (priv->real_rates[i] == 0)
-			continue;
-		rate = priv->real_rates[i] / 16;
-		quot = DIV_ROUND_CLOSEST(rate, baud);
-		if (!quot)
-			continue;
-
-		/* increase resolution to get xx.xx percent */
-		hires_rate = (u64)rate * 10000;
-		hires_baud = (u64)baud * 10000;
-
-		hires_err = div_u64(hires_rate, (u64)quot);
-
-		/* get the delta */
-		if (hires_err > hires_baud)
-			hires_err = (hires_err - hires_baud);
-		else
-			hires_err = (hires_baud - hires_err);
-
-		percent = (unsigned long)DIV_ROUND_CLOSEST_ULL(hires_err, baud);
-		dev_dbg(up->dev,
-			"Baud rate: %u, MUX Clk: %u, Error: %u.%u%%\n",
-			baud, priv->real_rates[i], percent / 100,
-			percent % 100);
-		if (percent < best_percent) {
-			best_percent = percent;
-			best_index = i;
-			best_quot = quot;
+	/* Try default_mux_rate first */
+	quot = find_quot(up->dev, priv->default_mux_rate, baud, &percent);
+	if (quot) {
+		best_percent = percent;
+		best_freq = priv->default_mux_rate;
+		best_quot = quot;
+	}
+	/* If more than 1% error, find the closest match for specified baud */
+	if (best_percent > 100) {
+		for (i = 0; i < ARRAY_SIZE(priv->real_rates); i++) {
+			freq = priv->real_rates[i];
+			if (freq == 0 || freq == priv->default_mux_rate)
+				continue;
+			quot = find_quot(up->dev, freq, baud, &percent);
+			if (!quot)
+				continue;
+
+			if (percent < best_percent) {
+				best_percent = percent;
+				best_freq = freq;
+				best_quot = quot;
+			}
 		}
 	}
-	if (best_index == -1) {
+	if (!best_freq) {
 		dev_err(up->dev, "Error, %d BAUD rate is too fast.\n", baud);
 		return;
 	}
-	rate = priv->real_rates[best_index];
-	rc = clk_set_rate(priv->baud_mux_clk, rate);
+	rc = clk_set_rate(priv->baud_mux_clk, best_freq);
 	if (rc)
 		dev_err(up->dev, "Error selecting BAUD MUX clock\n");
 
@@ -742,8 +761,8 @@
 		dev_err(up->dev, "Error, baud: %d has %u.%u%% error\n",
 			baud, percent / 100, percent % 100);
 
-	real_baud = rate / 16 / best_quot;
-	dev_dbg(up->dev, "Selecting BAUD MUX rate: %u\n", rate);
+	real_baud = best_freq / 16 / best_quot;
+	dev_dbg(up->dev, "Selecting BAUD MUX rate: %u\n", best_freq);
 	dev_dbg(up->dev, "Requested baud: %u, Actual baud: %u\n",
 		baud, real_baud);
 
@@ -752,7 +771,7 @@
 	i += (i / 2);
 	priv->char_wait = ns_to_ktime(i);
 
-	up->uartclk = rate;
+	up->uartclk = best_freq;
 }
 
 static void brcmstb_set_termios(struct uart_port *up,
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_core.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_core.c
@@ -1130,6 +1130,9 @@
 			uart->dl_write = up->dl_write;
 
 		if (uart->port.type != PORT_8250_CIR) {
+			if (uart_console_registered(&uart->port))
+				pm_runtime_get_sync(uart->port.dev);
+
 			if (serial8250_isa_config != NULL)
 				serial8250_isa_config(0, &uart->port,
 						&uart->capabilities);
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_dw.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_dw.c
@@ -9,7 +9,6 @@
  * LCR is written whilst busy.  If it is, then a busy detect interrupt is
  * raised, the LCR needs to be rewritten and the uart status register read.
  */
-#include <linux/acpi.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/device.h>
@@ -17,7 +16,6 @@
 #include <linux/mod_devicetable.h>
 #include <linux/module.h>
 #include <linux/notifier.h>
-#include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
 #include <linux/property.h>
@@ -56,6 +54,35 @@
 #define DW_UART_QUIRK_ARMADA_38X	BIT(1)
 #define DW_UART_QUIRK_SKIP_SET_RATE	BIT(2)
 #define DW_UART_QUIRK_IS_DMA_FC		BIT(3)
+#define DW_UART_QUIRK_APMC0D08		BIT(4)
+#define DW_UART_QUIRK_CPR_VALUE		BIT(5)
+
+struct dw8250_platform_data {
+	u8 usr_reg;
+	u32 cpr_value;
+	unsigned int quirks;
+};
+
+struct dw8250_data {
+	struct dw8250_port_data	data;
+	const struct dw8250_platform_data *pdata;
+
+	int			msr_mask_on;
+	int			msr_mask_off;
+	struct clk		*clk;
+	struct clk		*pclk;
+	struct notifier_block	clk_notifier;
+	struct work_struct	clk_work;
+	struct reset_control	*rst;
+
+	unsigned int		skip_autocfg:1;
+	unsigned int		uart_16550_compatible:1;
+};
+
+static inline struct dw8250_data *to_dw8250_data(struct dw8250_port_data *data)
+{
+	return container_of(data, struct dw8250_data, data);
+}
 
 static inline struct dw8250_data *clk_to_dw8250_data(struct notifier_block *nb)
 {
@@ -357,9 +384,9 @@
 	long rate;
 	int ret;
 
+	clk_disable_unprepare(d->clk);
 	rate = clk_round_rate(d->clk, newrate);
-	if (rate > 0 && p->uartclk != rate) {
-		clk_disable_unprepare(d->clk);
+	if (rate > 0) {
 		/*
 		 * Note that any clock-notifer worker will block in
 		 * serial8250_update_uartclk() until we are done.
@@ -367,8 +394,8 @@
 		ret = clk_set_rate(d->clk, newrate);
 		if (!ret)
 			p->uartclk = rate;
-		clk_prepare_enable(d->clk);
 	}
+	clk_prepare_enable(d->clk);
 
 	dw8250_do_set_termios(p, termios, old);
 }
@@ -445,44 +472,33 @@
 
 static void dw8250_quirks(struct uart_port *p, struct dw8250_data *data)
 {
-	struct device_node *np = p->dev->of_node;
+	unsigned int quirks = data->pdata ? data->pdata->quirks : 0;
+	u32 cpr_value = data->pdata ? data->pdata->cpr_value : 0;
+
+	if (quirks & DW_UART_QUIRK_CPR_VALUE)
+		data->data.cpr_value = cpr_value;
 
-	if (np) {
-		unsigned int quirks = data->pdata->quirks;
-		int id;
-
-		/* get index of serial line, if found in DT aliases */
-		id = of_alias_get_id(np, "serial");
-		if (id >= 0)
-			p->line = id;
 #ifdef CONFIG_64BIT
-		if (quirks & DW_UART_QUIRK_OCTEON) {
-			p->serial_in = dw8250_serial_inq;
-			p->serial_out = dw8250_serial_outq;
-			p->flags = UPF_SKIP_TEST | UPF_SHARE_IRQ | UPF_FIXED_TYPE;
-			p->type = PORT_OCTEON;
-			data->skip_autocfg = true;
-		}
+	if (quirks & DW_UART_QUIRK_OCTEON) {
+		p->serial_in = dw8250_serial_inq;
+		p->serial_out = dw8250_serial_outq;
+		p->flags = UPF_SKIP_TEST | UPF_SHARE_IRQ | UPF_FIXED_TYPE;
+		p->type = PORT_OCTEON;
+		data->skip_autocfg = true;
+	}
 #endif
 
-		if (of_device_is_big_endian(np)) {
-			p->iotype = UPIO_MEM32BE;
-			p->serial_in = dw8250_serial_in32be;
-			p->serial_out = dw8250_serial_out32be;
-		}
-
-		if (quirks & DW_UART_QUIRK_ARMADA_38X)
-			p->serial_out = dw8250_serial_out38x;
-		if (quirks & DW_UART_QUIRK_SKIP_SET_RATE)
-			p->set_termios = dw8250_do_set_termios;
-		if (quirks & DW_UART_QUIRK_IS_DMA_FC) {
-			data->data.dma.txconf.device_fc = 1;
-			data->data.dma.rxconf.device_fc = 1;
-			data->data.dma.prepare_tx_dma = dw8250_prepare_tx_dma;
-			data->data.dma.prepare_rx_dma = dw8250_prepare_rx_dma;
-		}
-
-	} else if (acpi_dev_present("APMC0D08", NULL, -1)) {
+	if (quirks & DW_UART_QUIRK_ARMADA_38X)
+		p->serial_out = dw8250_serial_out38x;
+	if (quirks & DW_UART_QUIRK_SKIP_SET_RATE)
+		p->set_termios = dw8250_do_set_termios;
+	if (quirks & DW_UART_QUIRK_IS_DMA_FC) {
+		data->data.dma.txconf.device_fc = 1;
+		data->data.dma.rxconf.device_fc = 1;
+		data->data.dma.prepare_tx_dma = dw8250_prepare_tx_dma;
+		data->data.dma.prepare_rx_dma = dw8250_prepare_rx_dma;
+	}
+	if (quirks & DW_UART_QUIRK_APMC0D08) {
 		p->iotype = UPIO_MEM32;
 		p->regshift = 2;
 		p->serial_in = dw8250_serial_in32;
@@ -510,39 +526,21 @@
 	struct device *dev = &pdev->dev;
 	struct dw8250_data *data;
 	struct resource *regs;
-	int irq;
 	int err;
-	u32 val;
 
 	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!regs)
 		return dev_err_probe(dev, -EINVAL, "no registers defined\n");
 
-	irq = platform_get_irq_optional(pdev, 0);
-	/* no interrupt -> fall back to polling */
-	if (irq == -ENXIO)
-		irq = 0;
-	if (irq < 0)
-		return irq;
-
 	spin_lock_init(&p->lock);
-	p->mapbase	= regs->start;
-	p->irq		= irq;
 	p->handle_irq	= dw8250_handle_irq;
 	p->pm		= dw8250_do_pm;
 	p->type		= PORT_8250;
-	p->flags	= UPF_SHARE_IRQ | UPF_FIXED_PORT;
+	p->flags	= UPF_FIXED_PORT;
 	p->dev		= dev;
-	p->iotype	= UPIO_MEM;
-	p->serial_in	= dw8250_serial_in;
-	p->serial_out	= dw8250_serial_out;
 	p->set_ldisc	= dw8250_set_ldisc;
 	p->set_termios	= dw8250_set_termios;
 
-	p->membase = devm_ioremap(dev, regs->start, resource_size(regs));
-	if (!p->membase)
-		return -ENOMEM;
-
 	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
@@ -554,15 +552,35 @@
 	data->uart_16550_compatible = device_property_read_bool(dev,
 						"snps,uart-16550-compatible");
 
-	err = device_property_read_u32(dev, "reg-shift", &val);
-	if (!err)
-		p->regshift = val;
+	p->mapbase = regs->start;
+	p->mapsize = resource_size(regs);
 
-	err = device_property_read_u32(dev, "reg-io-width", &val);
-	if (!err && val == 4) {
-		p->iotype = UPIO_MEM32;
+	p->membase = devm_ioremap(dev, p->mapbase, p->mapsize);
+	if (!p->membase)
+		return -ENOMEM;
+
+	err = uart_read_port_properties(p);
+	/* no interrupt -> fall back to polling */
+	if (err == -ENXIO)
+		err = 0;
+	if (err)
+		return err;
+
+	switch (p->iotype) {
+	case UPIO_MEM:
+		p->serial_in = dw8250_serial_in;
+		p->serial_out = dw8250_serial_out;
+		break;
+	case UPIO_MEM32:
 		p->serial_in = dw8250_serial_in32;
 		p->serial_out = dw8250_serial_out32;
+		break;
+	case UPIO_MEM32BE:
+		p->serial_in = dw8250_serial_in32be;
+		p->serial_out = dw8250_serial_out32be;
+		break;
+	default:
+		return -ENODEV;
 	}
 
 	if (device_property_read_bool(dev, "dcd-override")) {
@@ -589,9 +607,6 @@
 		data->msr_mask_off |= UART_MSR_TERI;
 	}
 
-	/* Always ask for fixed clock rate from a property. */
-	device_property_read_u32(dev, "clock-frequency", &p->uartclk);
-
 	/* If there is separate baudclk, get the rate from it. */
 	data->clk = devm_clk_get_optional_enabled(dev, "baudclk");
 	if (data->clk == NULL)
@@ -743,11 +758,11 @@
 
 static const struct dw8250_platform_data dw8250_renesas_rzn1_data = {
 	.usr_reg = DW_UART_USR,
-	.cpr_val = 0x00012f32,
-	.quirks = DW_UART_QUIRK_IS_DMA_FC,
+	.cpr_value = 0x00012f32,
+	.quirks = DW_UART_QUIRK_CPR_VALUE | DW_UART_QUIRK_IS_DMA_FC,
 };
 
-static const struct dw8250_platform_data dw8250_starfive_jh7100_data = {
+static const struct dw8250_platform_data dw8250_skip_set_rate_data = {
 	.usr_reg = DW_UART_USR,
 	.quirks = DW_UART_QUIRK_SKIP_SET_RATE,
 };
@@ -757,18 +772,24 @@
 	{ .compatible = "cavium,octeon-3860-uart", .data = &dw8250_octeon_3860_data },
 	{ .compatible = "marvell,armada-38x-uart", .data = &dw8250_armada_38x_data },
 	{ .compatible = "renesas,rzn1-uart", .data = &dw8250_renesas_rzn1_data },
-	{ .compatible = "starfive,jh7100-uart", .data = &dw8250_starfive_jh7100_data },
+	{ .compatible = "sophgo,sg2044-uart", .data = &dw8250_skip_set_rate_data },
+	{ .compatible = "starfive,jh7100-uart", .data = &dw8250_skip_set_rate_data },
 	{ /* Sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, dw8250_of_match);
 
+static const struct dw8250_platform_data dw8250_apmc0d08 = {
+	.usr_reg = DW_UART_USR,
+	.quirks = DW_UART_QUIRK_APMC0D08,
+};
+
 static const struct acpi_device_id dw8250_acpi_match[] = {
 	{ "80860F0A", (kernel_ulong_t)&dw8250_dw_apb },
 	{ "8086228A", (kernel_ulong_t)&dw8250_dw_apb },
 	{ "AMD0020", (kernel_ulong_t)&dw8250_dw_apb },
 	{ "AMDI0020", (kernel_ulong_t)&dw8250_dw_apb },
 	{ "AMDI0022", (kernel_ulong_t)&dw8250_dw_apb },
-	{ "APMC0D08", (kernel_ulong_t)&dw8250_dw_apb},
+	{ "APMC0D08", (kernel_ulong_t)&dw8250_apmc0d08 },
 	{ "BRCM2032", (kernel_ulong_t)&dw8250_dw_apb },
 	{ "HISI0031", (kernel_ulong_t)&dw8250_dw_apb },
 	{ "INT33C4", (kernel_ulong_t)&dw8250_dw_apb },
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_dwlib.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_dwlib.c
@@ -242,7 +242,6 @@
 void dw8250_setup_port(struct uart_port *p)
 {
 	struct dw8250_port_data *pd = p->private_data;
-	struct dw8250_data *data = to_dw8250_data(pd);
 	struct uart_8250_port *up = up_to_u8250p(p);
 	u32 reg, old_dlf;
 
@@ -278,7 +277,7 @@
 
 	reg = dw8250_readl_ext(p, DW_UART_CPR);
 	if (!reg) {
-		reg = data->pdata->cpr_val;
+		reg = pd->cpr_value;
 		dev_dbg(p->dev, "CPR is not available, using 0x%08x instead\n", reg);
 	}
 	if (!reg)
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_dwlib.h
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_dwlib.h
@@ -2,15 +2,10 @@
 /* Synopsys DesignWare 8250 library header file. */
 
 #include <linux/io.h>
-#include <linux/notifier.h>
 #include <linux/types.h>
-#include <linux/workqueue.h>
 
 #include "8250.h"
 
-struct clk;
-struct reset_control;
-
 struct dw8250_port_data {
 	/* Port properties */
 	int			line;
@@ -19,42 +14,16 @@
 	struct uart_8250_dma	dma;
 
 	/* Hardware configuration */
+	u32			cpr_value;
 	u8			dlf_size;
 
 	/* RS485 variables */
 	bool			hw_rs485_support;
 };
 
-struct dw8250_platform_data {
-	u8 usr_reg;
-	u32 cpr_val;
-	unsigned int quirks;
-};
-
-struct dw8250_data {
-	struct dw8250_port_data	data;
-	const struct dw8250_platform_data *pdata;
-
-	int			msr_mask_on;
-	int			msr_mask_off;
-	struct clk		*clk;
-	struct clk		*pclk;
-	struct notifier_block	clk_notifier;
-	struct work_struct	clk_work;
-	struct reset_control	*rst;
-
-	unsigned int		skip_autocfg:1;
-	unsigned int		uart_16550_compatible:1;
-};
-
 void dw8250_do_set_termios(struct uart_port *p, struct ktermios *termios, const struct ktermios *old);
 void dw8250_setup_port(struct uart_port *p);
 
-static inline struct dw8250_data *to_dw8250_data(struct dw8250_port_data *data)
-{
-	return container_of(data, struct dw8250_data, data);
-}
-
 static inline u32 dw8250_readl_ext(struct uart_port *p, int offset)
 {
 	if (p->iotype == UPIO_MEM32BE)
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_exar.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_exar.c
@@ -40,8 +40,50 @@
 #define PCI_DEVICE_ID_COMMTECH_4228PCIE		0x0021
 #define PCI_DEVICE_ID_COMMTECH_4222PCIE		0x0022
 
+#define PCI_VENDOR_ID_CONNECT_TECH				0x12c4
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_SP_OPTO        0x0340
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_SP_OPTO_A      0x0341
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_SP_OPTO_B      0x0342
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XPRS           0x0350
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_A         0x0351
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_B         0x0352
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS           0x0353
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_16_XPRS_A        0x0354
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_16_XPRS_B        0x0355
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XPRS_OPTO      0x0360
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_OPTO_A    0x0361
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_OPTO_B    0x0362
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP             0x0370
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_232         0x0371
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_485         0x0372
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_4_SP           0x0373
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_6_2_SP           0x0374
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_6_SP           0x0375
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_232_NS      0x0376
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XP_OPTO_LEFT   0x0380
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XP_OPTO_RIGHT  0x0381
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XP_OPTO        0x0382
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_4_XPRS_OPTO    0x0392
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP        0x03A0
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_232    0x03A1
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_485    0x03A2
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_232_NS 0x03A3
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XEG001               0x0602
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_BASE           0x1000
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_2              0x1002
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_4              0x1004
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_8              0x1008
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_12             0x100C
+#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_16             0x1010
+#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_12_XIG00X          0x110c
+#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_12_XIG01X          0x110d
+#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_16                 0x1110
+
 #define PCI_DEVICE_ID_EXAR_XR17V4358		0x4358
 #define PCI_DEVICE_ID_EXAR_XR17V8358		0x8358
+#define PCI_DEVICE_ID_EXAR_XR17V252		0x0252
+#define PCI_DEVICE_ID_EXAR_XR17V254		0x0254
+#define PCI_DEVICE_ID_EXAR_XR17V258		0x0258
 
 #define PCI_SUBDEVICE_ID_USR_2980		0x0128
 #define PCI_SUBDEVICE_ID_USR_2981		0x0129
@@ -753,6 +795,7 @@
 	for (i = 0; i < priv->nr; i++)
 		serial8250_unregister_port(priv->line[i]);
 
+	/* Ensure that every init quirk is properly torn down */
 	if (priv->board->exit)
 		priv->board->exit(pcidev);
 }
@@ -767,10 +810,6 @@
 		if (priv->line[i] >= 0)
 			serial8250_suspend_port(priv->line[i]);
 
-	/* Ensure that every init quirk is properly torn down */
-	if (priv->board->exit)
-		priv->board->exit(pcidev);
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_fintek.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_fintek.c
@@ -21,6 +21,7 @@
 #define CHIP_ID_F81866 0x1010
 #define CHIP_ID_F81966 0x0215
 #define CHIP_ID_F81216AD 0x1602
+#define CHIP_ID_F81216E 0x1617
 #define CHIP_ID_F81216H 0x0501
 #define CHIP_ID_F81216 0x0802
 #define VENDOR_ID1 0x23
@@ -158,6 +159,7 @@
 	case CHIP_ID_F81866:
 	case CHIP_ID_F81966:
 	case CHIP_ID_F81216AD:
+	case CHIP_ID_F81216E:
 	case CHIP_ID_F81216H:
 	case CHIP_ID_F81216:
 		break;
@@ -181,6 +183,7 @@
 		return 0;
 
 	case CHIP_ID_F81216AD:
+	case CHIP_ID_F81216E:
 	case CHIP_ID_F81216H:
 	case CHIP_ID_F81216:
 		*min = F81216_LDN_LOW;
@@ -250,6 +253,7 @@
 		break;
 
 	case CHIP_ID_F81216AD:
+	case CHIP_ID_F81216E:
 	case CHIP_ID_F81216H:
 	case CHIP_ID_F81216:
 		sio_write_mask_reg(pdata, FINTEK_IRQ_MODE, IRQ_SHARE,
@@ -263,7 +267,8 @@
 static void fintek_8250_set_max_fifo(struct fintek_8250 *pdata)
 {
 	switch (pdata->pid) {
-	case CHIP_ID_F81216H: /* 128Bytes FIFO */
+	case CHIP_ID_F81216E: /* 128Bytes FIFO */
+	case CHIP_ID_F81216H:
 	case CHIP_ID_F81966:
 	case CHIP_ID_F81866:
 		sio_write_mask_reg(pdata, FIFO_CTRL,
@@ -297,6 +302,7 @@
 		goto exit;
 
 	switch (pdata->pid) {
+	case CHIP_ID_F81216E:
 	case CHIP_ID_F81216H:
 		reg = RS485;
 		break;
@@ -346,6 +352,7 @@
 	struct fintek_8250 *pdata = uart->port.private_data;
 
 	switch (pdata->pid) {
+	case CHIP_ID_F81216E:
 	case CHIP_ID_F81216H:
 	case CHIP_ID_F81966:
 	case CHIP_ID_F81866:
@@ -438,6 +445,11 @@
 			uart->port.rs485_supported = fintek_8250_rs485_supported;
 		break;
 
+	case CHIP_ID_F81216E: /* F81216E does not support RS485 delays */
+		uart->port.rs485_config = fintek_8250_rs485_config;
+		uart->port.rs485_supported = fintek_8250_rs485_supported;
+		break;
+
 	default: /* No RS485 Auto direction functional */
 		break;
 	}
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_mtk.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_mtk.c
@@ -209,15 +209,19 @@
 
 static void mtk8250_shutdown(struct uart_port *port)
 {
-#ifdef CONFIG_SERIAL_8250_DMA
 	struct uart_8250_port *up = up_to_u8250p(port);
 	struct mtk8250_data *data = port->private_data;
+	int irq = data->rx_wakeup_irq;
 
+#ifdef CONFIG_SERIAL_8250_DMA
 	if (up->dma)
 		data->rx_status = DMA_RX_SHUTDOWN;
 #endif
 
-	return serial8250_do_shutdown(port);
+	serial8250_do_shutdown(port);
+
+	if (irq >= 0)
+		serial8250_do_set_mctrl(&up->port, TIOCM_RTS);
 }
 
 static void mtk8250_disable_intrs(struct uart_8250_port *up, int mask)
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_of.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_of.c
@@ -4,7 +4,10 @@
  *
  *    Copyright (C) 2006 Arnd Bergmann <arnd@arndb.de>, IBM Corp.
  */
+
+#include <linux/bits.h>
 #include <linux/console.h>
+#include <linux/math.h>
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/serial_core.h>
@@ -25,6 +28,36 @@
 	int line;
 };
 
+/* Nuvoton NPCM timeout register */
+#define UART_NPCM_TOR          7
+#define UART_NPCM_TOIE         BIT(7)  /* Timeout Interrupt Enable */
+
+static int npcm_startup(struct uart_port *port)
+{
+	/*
+	 * Nuvoton calls the scratch register 'UART_TOR' (timeout
+	 * register). Enable it, and set TIOC (timeout interrupt
+	 * comparator) to be 0x20 for correct operation.
+	 */
+	serial_port_out(port, UART_NPCM_TOR, UART_NPCM_TOIE | 0x20);
+
+	return serial8250_do_startup(port);
+}
+
+/* Nuvoton NPCM UARTs have a custom divisor calculation */
+static unsigned int npcm_get_divisor(struct uart_port *port, unsigned int baud,
+				     unsigned int *frac)
+{
+	return DIV_ROUND_CLOSEST(port->uartclk, 16 * baud + 2) - 2;
+}
+
+static int npcm_setup(struct uart_port *port)
+{
+	port->get_divisor = npcm_get_divisor;
+	port->startup = npcm_startup;
+	return 0;
+}
+
 /*
  * Fill a struct uart_port for a given device node
  */
@@ -164,10 +197,17 @@
 	switch (type) {
 	case PORT_RT2880:
 		ret = rt288x_setup(port);
-		if (ret)
-			goto err_pmruntime;
+		break;
+	case PORT_NPCM:
+		ret = npcm_setup(port);
+		break;
+	default:
+		/* Nothing to do */
+		ret = 0;
 		break;
 	}
+	if (ret)
+		goto err_pmruntime;
 
 	if (IS_REACHABLE(CONFIG_SERIAL_8250_FSL) &&
 	    (of_device_is_compatible(np, "fsl,ns16550") ||
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_omap.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_omap.c
@@ -28,7 +28,6 @@
 #include <linux/pm_wakeirq.h>
 #include <linux/dma-mapping.h>
 #include <linux/sys_soc.h>
-#include <linux/pm_domain.h>
 
 #include "8250.h"
 
@@ -116,12 +115,6 @@
 /* RX FIFO occupancy indicator */
 #define UART_OMAP_RX_LVL		0x19
 
-/*
- * Copy of the genpd flags for the console.
- * Only used if console suspend is disabled
- */
-static unsigned int genpd_flags_console;
-
 struct omap8250_priv {
 	void __iomem *membase;
 	int line;
@@ -174,6 +167,10 @@
 	return readl(priv->membase + (reg << OMAP_UART_REGSHIFT));
 }
 
+/* Timeout low and High */
+#define UART_OMAP_TO_L                 0x26
+#define UART_OMAP_TO_H                 0x27
+
 /*
  * Called on runtime PM resume path from omap8250_restore_regs(), and
  * omap8250_set_mctrl().
@@ -664,13 +661,25 @@
 
 	/*
 	 * On K3 SoCs, it is observed that RX TIMEOUT is signalled after
-	 * FIFO has been drained, in which case a dummy read of RX FIFO
-	 * is required to clear RX TIMEOUT condition.
+	 * FIFO has been drained or erroneously.
+	 * So apply solution of Errata i2310 as mentioned in
+	 * https://www.ti.com/lit/pdf/sprz536
 	 */
 	if (priv->habit & UART_RX_TIMEOUT_QUIRK &&
 	    (iir & UART_IIR_RX_TIMEOUT) == UART_IIR_RX_TIMEOUT &&
 	    serial_port_in(port, UART_OMAP_RX_LVL) == 0) {
-		serial_port_in(port, UART_RX);
+		unsigned char efr2, timeout_h, timeout_l;
+
+		efr2 = serial_in(up, UART_OMAP_EFR2);
+		timeout_h = serial_in(up, UART_OMAP_TO_H);
+		timeout_l = serial_in(up, UART_OMAP_TO_L);
+		serial_out(up, UART_OMAP_TO_H, 0xFF);
+		serial_out(up, UART_OMAP_TO_L, 0xFF);
+		serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE);
+		serial_in(up, UART_IIR);
+		serial_out(up, UART_OMAP_EFR2, efr2);
+		serial_out(up, UART_OMAP_TO_H, timeout_h);
+		serial_out(up, UART_OMAP_TO_L, timeout_l);
 	}
 
 	/* Stop processing interrupts on input overrun */
@@ -769,12 +778,12 @@
 	struct uart_8250_port *up = up_to_u8250p(port);
 	struct omap8250_priv *priv = port->private_data;
 
+	pm_runtime_get_sync(port->dev);
+
 	flush_work(&priv->qos_work);
 	if (up->dma)
 		omap_8250_rx_dma_flush(up);
 
-	pm_runtime_get_sync(port->dev);
-
 	serial_out(up, UART_OMAP_WER, 0);
 	if (priv->habit & UART_HAS_EFR2)
 		serial_out(up, UART_OMAP_EFR2, 0x0);
@@ -1564,7 +1573,7 @@
 	ret = devm_request_irq(&pdev->dev, irq, omap8250_irq, 0,
 			       dev_name(&pdev->dev), priv);
 	if (ret < 0)
-		return ret;
+		goto err;
 
 	priv->wakeirq = irq_of_parse_and_map(np, 1);
 
@@ -1631,7 +1640,6 @@
 {
 	struct omap8250_priv *priv = dev_get_drvdata(dev);
 	struct uart_8250_port *up = serial8250_get_port(priv->line);
-	struct generic_pm_domain *genpd = pd_to_genpd(dev->pm_domain);
 	int err = 0;
 
 	serial8250_suspend_port(priv->line);
@@ -1642,19 +1650,8 @@
 	if (!device_may_wakeup(dev))
 		priv->wer = 0;
 	serial_out(up, UART_OMAP_WER, priv->wer);
-	if (uart_console(&up->port)) {
-		if (console_suspend_enabled)
-			err = pm_runtime_force_suspend(dev);
-		else {
-			/*
-			 * The pd shall not be powered-off (no console suspend).
-			 * Make copy of genpd flags before to set it always on.
-			 * The original value is restored during the resume.
-			 */
-			genpd_flags_console = genpd->flags;
-			genpd->flags |= GENPD_FLAG_ALWAYS_ON;
-		}
-	}
+	if (uart_console(&up->port) && console_suspend_enabled)
+		err = pm_runtime_force_suspend(dev);
 	flush_work(&priv->qos_work);
 
 	return err;
@@ -1664,16 +1661,12 @@
 {
 	struct omap8250_priv *priv = dev_get_drvdata(dev);
 	struct uart_8250_port *up = serial8250_get_port(priv->line);
-	struct generic_pm_domain *genpd = pd_to_genpd(dev->pm_domain);
 	int err;
 
 	if (uart_console(&up->port) && console_suspend_enabled) {
-		if (console_suspend_enabled) {
-			err = pm_runtime_force_resume(dev);
-			if (err)
-				return err;
-		} else
-			genpd->flags = genpd_flags_console;
+		err = pm_runtime_force_resume(dev);
+		if (err)
+			return err;
 	}
 
 	serial8250_resume_port(priv->line);
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_pci.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_pci.c
@@ -1985,6 +1985,17 @@
 	MOXA_SUPP_RS485 = BIT(2),
 };
 
+static unsigned short moxa_get_nports(unsigned short device)
+{
+	switch (device) {
+	case PCI_DEVICE_ID_MOXA_CP116E_A_A:
+	case PCI_DEVICE_ID_MOXA_CP116E_A_B:
+		return 8;
+	}
+
+	return FIELD_GET(0x00F0, device);
+}
+
 static bool pci_moxa_is_mini_pcie(unsigned short device)
 {
 	if (device == PCI_DEVICE_ID_MOXA_CP102N	||
@@ -2038,7 +2049,7 @@
 {
 	unsigned short device = dev->device;
 	resource_size_t iobar_addr = pci_resource_start(dev, 2);
-	unsigned int num_ports = (device & 0x00F0) >> 4, i;
+	unsigned int i, num_ports = moxa_get_nports(device);
 	u8 val, init_mode = MOXA_RS232;
 
 	if (!(pci_moxa_supported_rs(dev) & MOXA_SUPP_RS232)) {
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_port.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_port.c
@@ -38,10 +38,6 @@
 
 #include "8250.h"
 
-/* Nuvoton NPCM timeout register */
-#define UART_NPCM_TOR          7
-#define UART_NPCM_TOIE         BIT(7)  /* Timeout Interrupt Enable */
-
 /*
  * Debugging.
  */
@@ -1329,9 +1325,6 @@
 		inb_p(ICP);
 	}
 
-	if (uart_console(port))
-		console_lock();
-
 	/* forget possible initially masked and pending IRQ */
 	probe_irq_off(probe_irq_on());
 	save_mcr = serial8250_in_MCR(up);
@@ -1371,9 +1364,6 @@
 	if (port->flags & UPF_FOURPORT)
 		outb_p(save_ICP, ICP);
 
-	if (uart_console(port))
-		console_unlock();
-
 	port->irq = (irq > 0) ? irq : 0;
 }
 
@@ -2235,15 +2225,6 @@
 				UART_DA830_PWREMU_MGMT_FREE);
 	}
 
-	if (port->type == PORT_NPCM) {
-		/*
-		 * Nuvoton calls the scratch register 'UART_TOR' (timeout
-		 * register). Enable it, and set TIOC (timeout interrupt
-		 * comparator) to be 0x20 for correct operation.
-		 */
-		serial_port_out(port, UART_NPCM_TOR, UART_NPCM_TOIE | 0x20);
-	}
-
 #ifdef CONFIG_SERIAL_8250_RSA
 	/*
 	 * If this is an RSA port, see if we can kick it up to the
@@ -2545,15 +2526,6 @@
 		serial8250_do_shutdown(port);
 }
 
-/* Nuvoton NPCM UARTs have a custom divisor calculation */
-static unsigned int npcm_get_divisor(struct uart_8250_port *up,
-		unsigned int baud)
-{
-	struct uart_port *port = &up->port;
-
-	return DIV_ROUND_CLOSEST(port->uartclk, 16 * baud + 2) - 2;
-}
-
 static unsigned int serial8250_do_get_divisor(struct uart_port *port,
 					      unsigned int baud,
 					      unsigned int *frac)
@@ -2598,8 +2570,6 @@
 		quot = 0x8001;
 	else if (magic_multiplier && baud >= port->uartclk / 12)
 		quot = 0x8002;
-	else if (up->port.type == PORT_NPCM)
-		quot = npcm_get_divisor(up, baud);
 	else
 		quot = uart_get_divisor(port, baud);
 
--- linux-qcom-6.8.0.orig/drivers/tty/serial/8250/8250_pxa.c
+++ linux-qcom-6.8.0/drivers/tty/serial/8250/8250_pxa.c
@@ -124,6 +124,7 @@
 	uart.port.regshift = 2;
 	uart.port.irq = irq;
 	uart.port.fifosize = 64;
+	uart.tx_loadsz = 32;
 	uart.port.flags = UPF_IOREMAP | UPF_SKIP_TEST | UPF_FIXED_TYPE;
 	uart.port.dev = &pdev->dev;
 	uart.port.uartclk = clk_get_rate(data->clk);
--- linux-qcom-6.8.0.orig/drivers/tty/serial/amba-pl011.c
+++ linux-qcom-6.8.0/drivers/tty/serial/amba-pl011.c
@@ -1831,6 +1831,13 @@
 
 	pl011_write(uap->im, uap, REG_IMSC);
 
+#ifdef CONFIG_DMA_ENGINE
+	if (uap->using_rx_dma) {
+		uap->dmacr |= UART011_RXDMAE;
+		pl011_write(uap->dmacr, uap, REG_DMACR);
+	}
+#endif
+
 	uart_port_unlock_irqrestore(&uap->port, flags);
 }
 
--- linux-qcom-6.8.0.orig/drivers/tty/serial/atmel_serial.c
+++ linux-qcom-6.8.0/drivers/tty/serial/atmel_serial.c
@@ -2530,7 +2530,7 @@
 };
 
 static const struct serial_rs485 atmel_rs485_supported = {
-	.flags = SER_RS485_ENABLED | SER_RS485_RTS_AFTER_SEND | SER_RS485_RX_DURING_TX,
+	.flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RX_DURING_TX,
 	.delay_rts_before_send = 1,
 	.delay_rts_after_send = 1,
 };
--- linux-qcom-6.8.0.orig/drivers/tty/serial/bcm63xx_uart.c
+++ linux-qcom-6.8.0/drivers/tty/serial/bcm63xx_uart.c
@@ -309,8 +309,8 @@
 
 	val = bcm_uart_readl(port, UART_MCTL_REG);
 	val = (val & UART_MCTL_TXFIFOFILL_MASK) >> UART_MCTL_TXFIFOFILL_SHIFT;
-
-	pending = uart_port_tx_limited(port, ch, port->fifosize - val,
+	pending = uart_port_tx_limited_flags(port, ch, UART_TX_NOSTOP,
+		port->fifosize - val,
 		true,
 		bcm_uart_writel(port, ch, UART_FIFO_REG),
 		({}));
@@ -321,6 +321,9 @@
 	val = bcm_uart_readl(port, UART_IR_REG);
 	val &= ~UART_TX_INT_MASK;
 	bcm_uart_writel(port, val, UART_IR_REG);
+
+	if (uart_tx_stopped(port))
+		bcm_uart_stop_tx(port);
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/tty/serial/fsl_lpuart.c
+++ linux-qcom-6.8.0/drivers/tty/serial/fsl_lpuart.c
@@ -2930,6 +2930,7 @@
 	pm_runtime_set_autosuspend_delay(&pdev->dev, UART_AUTOSUSPEND_TIMEOUT);
 	pm_runtime_set_active(&pdev->dev);
 	pm_runtime_enable(&pdev->dev);
+	pm_runtime_mark_last_busy(&pdev->dev);
 
 	ret = lpuart_global_reset(sport);
 	if (ret)
--- linux-qcom-6.8.0.orig/drivers/tty/serial/imx.c
+++ linux-qcom-6.8.0/drivers/tty/serial/imx.c
@@ -26,6 +26,7 @@
 #include <linux/slab.h>
 #include <linux/of.h>
 #include <linux/io.h>
+#include <linux/iopoll.h>
 #include <linux/dma-mapping.h>
 
 #include <asm/irq.h>
@@ -118,6 +119,7 @@
 #define UCR4_OREN	(1<<1)	/* Receiver overrun interrupt enable */
 #define UCR4_DREN	(1<<0)	/* Recv data ready interrupt enable */
 #define UFCR_RXTL_SHF	0	/* Receiver trigger level shift */
+#define UFCR_RXTL_MASK	0x3F	/* Receiver trigger 6 bits wide */
 #define UFCR_DCEDTE	(1<<6)	/* DCE/DTE mode select */
 #define UFCR_RFDIV	(7<<7)	/* Reference freq divider mask */
 #define UFCR_RFDIV_REG(x)	(((x) < 7 ? 6 - (x) : 6) << 7)
@@ -763,6 +765,21 @@
 
 	imx_uart_writel(sport, USR1_RTSD, USR1);
 	usr1 = imx_uart_readl(sport, USR1) & USR1_RTSS;
+	/*
+	 * Update sport->old_status here, so any follow-up calls to
+	 * imx_uart_mctrl_check() will be able to recognize that RTS
+	 * state changed since last imx_uart_mctrl_check() call.
+	 *
+	 * In case RTS has been detected as asserted here and later on
+	 * deasserted by the time imx_uart_mctrl_check() was called,
+	 * imx_uart_mctrl_check() can detect the RTS state change and
+	 * trigger uart_handle_cts_change() to unblock the port for
+	 * further TX transfers.
+	 */
+	if (usr1 & USR1_RTSS)
+		sport->old_status |= TIOCM_CTS;
+	else
+		sport->old_status &= ~TIOCM_CTS;
 	uart_handle_cts_change(&sport->port, usr1);
 	wake_up_interruptible(&sport->port.state->port.delta_msr_wait);
 
@@ -1312,7 +1329,7 @@
 
 }
 
-#define TXTL_DEFAULT 2 /* reset default */
+#define TXTL_DEFAULT 8
 #define RXTL_DEFAULT 8 /* 8 characters or aging timer */
 #define TXTL_DMA 8 /* DMA burst setting */
 #define RXTL_DMA 9 /* DMA burst setting */
@@ -1558,6 +1575,7 @@
 	struct imx_port *sport = (struct imx_port *)port;
 	unsigned long flags;
 	u32 ucr1, ucr2, ucr4, uts;
+	int loops;
 
 	if (sport->dma_is_enabled) {
 		dmaengine_terminate_sync(sport->dma_chan_tx);
@@ -1620,6 +1638,56 @@
 	ucr4 &= ~UCR4_TCEN;
 	imx_uart_writel(sport, ucr4, UCR4);
 
+	/*
+	 * We have to ensure the tx state machine ends up in OFF. This
+	 * is especially important for rs485 where we must not leave
+	 * the RTS signal high, blocking the bus indefinitely.
+	 *
+	 * All interrupts are now disabled, so imx_uart_stop_tx() will
+	 * no longer be called from imx_uart_transmit_buffer(). It may
+	 * still be called via the hrtimers, and if those are in play,
+	 * we have to honour the delays.
+	 */
+	if (sport->tx_state == WAIT_AFTER_RTS || sport->tx_state == SEND)
+		imx_uart_stop_tx(port);
+
+	/*
+	 * In many cases (rs232 mode, or if tx_state was
+	 * WAIT_AFTER_RTS, or if tx_state was SEND and there is no
+	 * delay_rts_after_send), this will have moved directly to
+	 * OFF. In rs485 mode, tx_state might already have been
+	 * WAIT_AFTER_SEND and the hrtimer thus already started, or
+	 * the above imx_uart_stop_tx() call could have started it. In
+	 * those cases, we have to wait for the hrtimer to fire and
+	 * complete the transition to OFF.
+	 */
+	loops = port->rs485.flags & SER_RS485_ENABLED ?
+		port->rs485.delay_rts_after_send : 0;
+	while (sport->tx_state != OFF && loops--) {
+		uart_port_unlock_irqrestore(&sport->port, flags);
+		msleep(1);
+		uart_port_lock_irqsave(&sport->port, &flags);
+	}
+
+	if (sport->tx_state != OFF) {
+		dev_warn(sport->port.dev, "unexpected tx_state %d\n",
+			 sport->tx_state);
+		/*
+		 * This machine may be busted, but ensure the RTS
+		 * signal is inactive in order not to block other
+		 * devices.
+		 */
+		if (port->rs485.flags & SER_RS485_ENABLED) {
+			ucr2 = imx_uart_readl(sport, UCR2);
+			if (port->rs485.flags & SER_RS485_RTS_AFTER_SEND)
+				imx_uart_rts_active(sport, &ucr2);
+			else
+				imx_uart_rts_inactive(sport, &ucr2);
+			imx_uart_writel(sport, ucr2, UCR2);
+		}
+		sport->tx_state = OFF;
+	}
+
 	uart_port_unlock_irqrestore(&sport->port, flags);
 
 	clk_disable_unprepare(sport->clk_per);
@@ -1940,7 +2008,7 @@
 				 struct serial_rs485 *rs485conf)
 {
 	struct imx_port *sport = (struct imx_port *)port;
-	u32 ucr2;
+	u32 ucr2, ufcr;
 
 	if (rs485conf->flags & SER_RS485_ENABLED) {
 		/* Enable receiver if low-active RTS signal is requested */
@@ -1959,8 +2027,13 @@
 
 	/* Make sure Rx is enabled in case Tx is active with Rx disabled */
 	if (!(rs485conf->flags & SER_RS485_ENABLED) ||
-	    rs485conf->flags & SER_RS485_RX_DURING_TX)
+	    rs485conf->flags & SER_RS485_RX_DURING_TX) {
+		/* If the receiver trigger is 0, set it to a default value */
+		ufcr = imx_uart_readl(sport, UFCR);
+		if ((ufcr & UFCR_RXTL_MASK) == 0)
+			imx_uart_setup_ufcr(sport, TXTL_DEFAULT, RXTL_DEFAULT);
 		imx_uart_start_rx(port);
+	}
 
 	return 0;
 }
@@ -2010,7 +2083,7 @@
 	struct imx_port *sport = imx_uart_ports[co->index];
 	struct imx_port_ucrs old_ucr;
 	unsigned long flags;
-	unsigned int ucr1;
+	unsigned int ucr1, usr2;
 	int locked = 1;
 
 	if (sport->port.sysrq)
@@ -2041,8 +2114,8 @@
 	 *	Finally, wait for transmitter to become empty
 	 *	and restore UCR1/2/3
 	 */
-	while (!(imx_uart_readl(sport, USR2) & USR2_TXDC));
-
+	read_poll_timeout_atomic(imx_uart_readl, usr2, usr2 & USR2_TXDC,
+				 0, USEC_PER_SEC, false, sport, USR2);
 	imx_uart_ucrs_restore(sport, &old_ucr);
 
 	if (locked)
--- linux-qcom-6.8.0.orig/drivers/tty/serial/kgdboc.c
+++ linux-qcom-6.8.0/drivers/tty/serial/kgdboc.c
@@ -19,6 +19,7 @@
 #include <linux/console.h>
 #include <linux/vt_kern.h>
 #include <linux/input.h>
+#include <linux/irq_work.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/serial_core.h>
@@ -48,6 +49,25 @@
 static int                      (*earlycon_orig_exit)(struct console *con);
 #endif /* IS_BUILTIN(CONFIG_KGDB_SERIAL_CONSOLE) */
 
+/*
+ * When we leave the debug trap handler we need to reset the keyboard status
+ * (since the original keyboard state gets partially clobbered by kdb use of
+ * the keyboard).
+ *
+ * The path to deliver the reset is somewhat circuitous.
+ *
+ * To deliver the reset we register an input handler, reset the keyboard and
+ * then deregister the input handler. However, to get this done right, we do
+ * have to carefully manage the calling context because we can only register
+ * input handlers from task context.
+ *
+ * In particular we need to trigger the action from the debug trap handler with
+ * all its NMI and/or NMI-like oddities. To solve this the kgdboc trap exit code
+ * (the "post_exception" callback) uses irq_work_queue(), which is NMI-safe, to
+ * schedule a callback from a hardirq context. From there we have to defer the
+ * work again, this time using schedule_work(), to get a callback using the
+ * system workqueue, which runs in task context.
+ */
 #ifdef CONFIG_KDB_KEYBOARD
 static int kgdboc_reset_connect(struct input_handler *handler,
 				struct input_dev *dev,
@@ -99,10 +119,17 @@
 
 static DECLARE_WORK(kgdboc_restore_input_work, kgdboc_restore_input_helper);
 
+static void kgdboc_queue_restore_input_helper(struct irq_work *unused)
+{
+	schedule_work(&kgdboc_restore_input_work);
+}
+
+static DEFINE_IRQ_WORK(kgdboc_restore_input_irq_work, kgdboc_queue_restore_input_helper);
+
 static void kgdboc_restore_input(void)
 {
 	if (likely(system_state == SYSTEM_RUNNING))
-		schedule_work(&kgdboc_restore_input_work);
+		irq_work_queue(&kgdboc_restore_input_irq_work);
 }
 
 static int kgdboc_register_kbd(char **cptr)
@@ -133,6 +160,7 @@
 			i--;
 		}
 	}
+	irq_work_sync(&kgdboc_restore_input_irq_work);
 	flush_work(&kgdboc_restore_input_work);
 }
 #else /* ! CONFIG_KDB_KEYBOARD */
--- linux-qcom-6.8.0.orig/drivers/tty/serial/ma35d1_serial.c
+++ linux-qcom-6.8.0/drivers/tty/serial/ma35d1_serial.c
@@ -688,12 +688,13 @@
 	struct uart_ma35d1_port *up;
 	int ret = 0;
 
-	if (pdev->dev.of_node) {
-		ret = of_alias_get_id(pdev->dev.of_node, "serial");
-		if (ret < 0) {
-			dev_err(&pdev->dev, "failed to get alias/pdev id, errno %d\n", ret);
-			return ret;
-		}
+	if (!pdev->dev.of_node)
+		return -ENODEV;
+
+	ret = of_alias_get_id(pdev->dev.of_node, "serial");
+	if (ret < 0) {
+		dev_err(&pdev->dev, "failed to get alias/pdev id, errno %d\n", ret);
+		return ret;
 	}
 	up = &ma35d1serial_ports[ret];
 	up->port.line = ret;
--- linux-qcom-6.8.0.orig/drivers/tty/serial/max3100.c
+++ linux-qcom-6.8.0/drivers/tty/serial/max3100.c
@@ -45,6 +45,9 @@
 #include <linux/freezer.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
+#include <linux/types.h>
+
+#include <asm/unaligned.h>
 
 #include <linux/serial_max3100.h>
 
@@ -191,7 +194,7 @@
 static int max3100_sr(struct max3100_port *s, u16 tx, u16 *rx)
 {
 	struct spi_message message;
-	u16 etx, erx;
+	__be16 etx, erx;
 	int status;
 	struct spi_transfer tran = {
 		.tx_buf = &etx,
@@ -213,7 +216,7 @@
 	return 0;
 }
 
-static int max3100_handlerx(struct max3100_port *s, u16 rx)
+static int max3100_handlerx_unlocked(struct max3100_port *s, u16 rx)
 {
 	unsigned int status = 0;
 	int ret = 0, cts;
@@ -254,6 +257,17 @@
 	return ret;
 }
 
+static int max3100_handlerx(struct max3100_port *s, u16 rx)
+{
+	unsigned long flags;
+	int ret;
+
+	uart_port_lock_irqsave(&s->port, &flags);
+	ret = max3100_handlerx_unlocked(s, rx);
+	uart_port_unlock_irqrestore(&s->port, flags);
+	return ret;
+}
+
 static void max3100_work(struct work_struct *w)
 {
 	struct max3100_port *s = container_of(w, struct max3100_port, work);
@@ -738,13 +752,14 @@
 	mutex_lock(&max3100s_lock);
 
 	if (!uart_driver_registered) {
-		uart_driver_registered = 1;
 		retval = uart_register_driver(&max3100_uart_driver);
 		if (retval) {
 			printk(KERN_ERR "Couldn't register max3100 uart driver\n");
 			mutex_unlock(&max3100s_lock);
 			return retval;
 		}
+
+		uart_driver_registered = 1;
 	}
 
 	for (i = 0; i < MAX_MAX3100; i++)
@@ -830,6 +845,7 @@
 		}
 	pr_debug("removing max3100 driver\n");
 	uart_unregister_driver(&max3100_uart_driver);
+	uart_driver_registered = 0;
 
 	mutex_unlock(&max3100s_lock);
 }
--- linux-qcom-6.8.0.orig/drivers/tty/serial/max310x.c
+++ linux-qcom-6.8.0/drivers/tty/serial/max310x.c
@@ -1461,7 +1461,7 @@
 	if (!ret)
 		return 0;
 
-	dev_err(dev, "Unable to reguest IRQ %i\n", irq);
+	dev_err(dev, "Unable to request IRQ %i\n", irq);
 
 out_uart:
 	for (i = 0; i < devtype->nr; i++) {
@@ -1635,13 +1635,16 @@
 
 static int max310x_i2c_probe(struct i2c_client *client)
 {
-	const struct max310x_devtype *devtype =
-			device_get_match_data(&client->dev);
+	const struct max310x_devtype *devtype;
 	struct i2c_client *port_client;
 	struct regmap *regmaps[4];
 	unsigned int i;
 	u8 port_addr;
 
+	devtype = device_get_match_data(&client->dev);
+	if (!devtype)
+		return dev_err_probe(&client->dev, -ENODEV, "Failed to match device\n");
+
 	if (client->addr < devtype->slave_addr.min ||
 		client->addr > devtype->slave_addr.max)
 		return dev_err_probe(&client->dev, -EINVAL,
--- linux-qcom-6.8.0.orig/drivers/tty/serial/mcf.c
+++ linux-qcom-6.8.0/drivers/tty/serial/mcf.c
@@ -462,7 +462,7 @@
 	.verify_port	= mcf_verify_port,
 };
 
-static struct mcf_uart mcf_ports[4];
+static struct mcf_uart mcf_ports[10];
 
 #define	MCF_MAXPORTS	ARRAY_SIZE(mcf_ports)
 
--- linux-qcom-6.8.0.orig/drivers/tty/serial/mxs-auart.c
+++ linux-qcom-6.8.0/drivers/tty/serial/mxs-auart.c
@@ -1086,11 +1086,13 @@
 
 static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
 {
-	u32 istat;
+	u32 istat, stat;
 	struct mxs_auart_port *s = context;
 	u32 mctrl_temp = s->mctrl_prev;
-	u32 stat = mxs_read(s, REG_STAT);
 
+	uart_port_lock(&s->port);
+
+	stat = mxs_read(s, REG_STAT);
 	istat = mxs_read(s, REG_INTR);
 
 	/* ack irq */
@@ -1126,6 +1128,8 @@
 		istat &= ~AUART_INTR_TXIS;
 	}
 
+	uart_port_unlock(&s->port);
+
 	return IRQ_HANDLED;
 }
 
--- linux-qcom-6.8.0.orig/drivers/tty/serial/pmac_zilog.c
+++ linux-qcom-6.8.0/drivers/tty/serial/pmac_zilog.c
@@ -210,7 +210,6 @@
 {
 	struct tty_port *port;
 	unsigned char ch, r1, drop, flag;
-	int loops = 0;
 
 	/* Sanity check, make sure the old bug is no longer happening */
 	if (uap->port.state == NULL) {
@@ -291,25 +290,12 @@
 		if (r1 & Rx_OVR)
 			tty_insert_flip_char(port, 0, TTY_OVERRUN);
 	next_char:
-		/* We can get stuck in an infinite loop getting char 0 when the
-		 * line is in a wrong HW state, we break that here.
-		 * When that happens, I disable the receive side of the driver.
-		 * Note that what I've been experiencing is a real irq loop where
-		 * I'm getting flooded regardless of the actual port speed.
-		 * Something strange is going on with the HW
-		 */
-		if ((++loops) > 1000)
-			goto flood;
 		ch = read_zsreg(uap, R0);
 		if (!(ch & Rx_CH_AV))
 			break;
 	}
 
 	return true;
- flood:
-	pmz_interrupt_control(uap, 0);
-	pmz_error("pmz: rx irq flood !\n");
-	return true;
 }
 
 static void pmz_status_handle(struct uart_pmac_port *uap)
--- linux-qcom-6.8.0.orig/drivers/tty/serial/qcom_geni_serial.c
+++ linux-qcom-6.8.0/drivers/tty/serial/qcom_geni_serial.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2017-2018, The Linux foundation. All rights reserved.
+// Copyright (c) 2023-2025 Qualcomm Innovation Center, Inc. All rights reserved.
 
 /* Disable MMIO tracing to prevent excessive logging of unwanted MMIO traces */
 #define __DISABLE_TRACE_MMIO__
@@ -21,8 +22,26 @@
 #include <linux/slab.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
+#include <soc/qcom/qup_fw_load.h>
 #include <dt-bindings/interconnect/qcom,icc.h>
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/qup_buses_trace.h>
+
+void serial_trace_log(struct device *dev, const char *fmt, ...)
+{
+	struct va_format vaf = {
+		.fmt = fmt,
+	};
+
+	va_list args;
+
+	va_start(args, fmt);
+	vaf.va = &args;
+	trace_buses_log_info(dev_name(dev), &vaf);
+	va_end(args);
+}
+
 /* UART specific GENI registers */
 #define SE_UART_LOOPBACK_CFG		0x22c
 #define SE_UART_IO_MACRO_CTRL		0x240
@@ -76,7 +95,7 @@
 #define STALE_TIMEOUT			16
 #define DEFAULT_BITS_PER_CHAR		10
 #define GENI_UART_CONS_PORTS		1
-#define GENI_UART_PORTS			3
+#define GENI_UART_PORTS			5
 #define DEF_FIFO_DEPTH_WORDS		16
 #define DEF_TX_WM			2
 #define DEF_FIFO_WIDTH_BITS		32
@@ -124,7 +143,7 @@
 	dma_addr_t tx_dma_addr;
 	dma_addr_t rx_dma_addr;
 	bool setup;
-	unsigned int baud;
+	unsigned long poll_timeout_us;
 	unsigned long clk_rate;
 	void *rx_buf;
 	u32 loopback;
@@ -143,38 +162,24 @@
 static const struct uart_ops qcom_geni_uart_pops;
 static struct uart_driver qcom_geni_console_driver;
 static struct uart_driver qcom_geni_uart_driver;
+static struct qcom_geni_serial_port qcom_geni_uart_ports[GENI_UART_PORTS];
+
+static int qcom_geni_serial_port_setup(struct uart_port *uport);
 
 static inline struct qcom_geni_serial_port *to_dev_port(struct uart_port *uport)
 {
 	return container_of(uport, struct qcom_geni_serial_port, uport);
 }
 
-static struct qcom_geni_serial_port qcom_geni_uart_ports[GENI_UART_PORTS] = {
-	[0] = {
-		.uport = {
-			.iotype = UPIO_MEM,
-			.ops = &qcom_geni_uart_pops,
-			.flags = UPF_BOOT_AUTOCONF,
-			.line = 0,
-		},
-	},
-	[1] = {
-		.uport = {
-			.iotype = UPIO_MEM,
-			.ops = &qcom_geni_uart_pops,
-			.flags = UPF_BOOT_AUTOCONF,
-			.line = 1,
-		},
-	},
-	[2] = {
-		.uport = {
-			.iotype = UPIO_MEM,
-			.ops = &qcom_geni_uart_pops,
-			.flags = UPF_BOOT_AUTOCONF,
-			.line = 2,
-		},
-	},
-};
+static void qcom_geni_serial_port_init(void)
+{
+	for (int i = 0; i < GENI_UART_PORTS; i++) {
+		qcom_geni_uart_ports[i].uport.iotype = UPIO_MEM;
+		qcom_geni_uart_ports[i].uport.ops = &qcom_geni_uart_pops;
+		qcom_geni_uart_ports[i].uport.flags = UPF_BOOT_AUTOCONF;
+		qcom_geni_uart_ports[i].uport.line = i;
+	}
+}
 
 static struct qcom_geni_serial_port qcom_geni_console_port = {
 	.uport = {
@@ -185,6 +190,19 @@
 	},
 };
 
+static const struct serial_rs485 qcom_geni_rs485_supported = {
+	.flags = SER_RS485_ENABLED | SER_RS485_RTS_AFTER_SEND | SER_RS485_RTS_ON_SEND,
+};
+
+static void qcom_geni_set_rts_pin(struct uart_port *uport, bool pin_state)
+{
+	u32 rfr = UART_MANUAL_RFR_EN;
+
+	/* Set the logical level of RTS GPIO pin based on the bool variable. */
+	rfr |= pin_state ? UART_RFR_NOT_READY : UART_RFR_READY;
+	writel(rfr, uport->membase + SE_UART_MANUAL_RFR);
+}
+
 static int qcom_geni_serial_request_port(struct uart_port *uport)
 {
 	struct platform_device *pdev = to_platform_device(uport->dev);
@@ -208,16 +226,19 @@
 static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport)
 {
 	unsigned int mctrl = TIOCM_DSR | TIOCM_CAR;
+	struct qcom_geni_serial_port *port = to_dev_port(uport);
 	u32 geni_ios;
 
 	if (uart_console(uport)) {
 		mctrl |= TIOCM_CTS;
 	} else {
 		geni_ios = readl(uport->membase + SE_GENI_IOS);
-		if (!(geni_ios & IO2_DATA_IN))
+		if (!(geni_ios & IO2_DATA_IN) || port->loopback)
 			mctrl |= TIOCM_CTS;
 	}
 
+	serial_trace_log(uport->dev, "%s: geni_ios: %d, mctrl:%d\n",
+			 __func__, geni_ios, mctrl);
 	return mctrl;
 }
 
@@ -236,6 +257,7 @@
 	if (!(mctrl & TIOCM_RTS) && !uport->suspended)
 		uart_manual_rfr = UART_MANUAL_RFR_EN | UART_RFR_NOT_READY;
 	writel(uart_manual_rfr, uport->membase + SE_UART_MANUAL_RFR);
+	serial_trace_log(uport->dev, "%s: uart_manual_rfr: %0x%x\n", __func__, uart_manual_rfr);
 }
 
 static const char *qcom_geni_serial_get_type(struct uart_port *uport)
@@ -265,27 +287,18 @@
 	return readl(uport->membase + SE_GENI_STATUS) & S_GENI_CMD_ACTIVE;
 }
 
-static bool qcom_geni_serial_poll_bit(struct uart_port *uport,
-				int offset, int field, bool set)
+static bool qcom_geni_serial_poll_bitfield(struct uart_port *uport,
+					   unsigned int offset, u32 field, u32 val)
 {
 	u32 reg;
 	struct qcom_geni_serial_port *port;
-	unsigned int baud;
-	unsigned int fifo_bits;
 	unsigned long timeout_us = 20000;
 	struct qcom_geni_private_data *private_data = uport->private_data;
 
 	if (private_data->drv) {
 		port = to_dev_port(uport);
-		baud = port->baud;
-		if (!baud)
-			baud = 115200;
-		fifo_bits = port->tx_fifo_depth * port->tx_fifo_width;
-		/*
-		 * Total polling iterations based on FIFO worth of bytes to be
-		 * sent at current baud. Add a little fluff to the wait.
-		 */
-		timeout_us = ((fifo_bits * USEC_PER_SEC) / baud) + 500;
+		if (port->poll_timeout_us)
+			timeout_us = port->poll_timeout_us;
 	}
 
 	/*
@@ -295,7 +308,7 @@
 	timeout_us = DIV_ROUND_UP(timeout_us, 10) * 10;
 	while (timeout_us) {
 		reg = readl(uport->membase + offset);
-		if ((bool)(reg & field) == set)
+		if ((reg & field) == val)
 			return true;
 		udelay(10);
 		timeout_us -= 10;
@@ -303,6 +316,12 @@
 	return false;
 }
 
+static bool qcom_geni_serial_poll_bit(struct uart_port *uport,
+				      unsigned int offset, u32 field, bool set)
+{
+	return qcom_geni_serial_poll_bitfield(uport, offset, field, set ? field : 0);
+}
+
 static void qcom_geni_serial_setup_tx(struct uart_port *uport, u32 xmit_size)
 {
 	u32 m_cmd;
@@ -315,18 +334,16 @@
 static void qcom_geni_serial_poll_tx_done(struct uart_port *uport)
 {
 	int done;
-	u32 irq_clear = M_CMD_DONE_EN;
 
 	done = qcom_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
 						M_CMD_DONE_EN, true);
 	if (!done) {
 		writel(M_GENI_CMD_ABORT, uport->membase +
 						SE_GENI_M_CMD_CTRL_REG);
-		irq_clear |= M_CMD_ABORT_EN;
 		qcom_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
 							M_CMD_ABORT_EN, true);
+		writel(M_CMD_ABORT_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
 	}
-	writel(irq_clear, uport->membase + SE_GENI_M_IRQ_CLEAR);
 }
 
 static void qcom_geni_serial_abort_rx(struct uart_port *uport)
@@ -387,6 +404,7 @@
 							unsigned char c)
 {
 	writel(DEF_TX_WM, uport->membase + SE_GENI_TX_WATERMARK_REG);
+	writel(M_CMD_DONE_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
 	qcom_geni_serial_setup_tx(uport, 1);
 	WARN_ON(!qcom_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
 						M_TX_FIFO_WATERMARK_EN, true));
@@ -394,6 +412,23 @@
 	writel(M_TX_FIFO_WATERMARK_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
 	qcom_geni_serial_poll_tx_done(uport);
 }
+
+static int qcom_geni_serial_poll_init(struct uart_port *uport)
+{
+	struct qcom_geni_serial_port *port = to_dev_port(uport);
+	int ret;
+
+	if (!port->setup) {
+		ret = qcom_geni_serial_port_setup(uport);
+		if (ret)
+			return ret;
+	}
+
+	if (!qcom_geni_serial_secondary_active(uport))
+		geni_se_setup_s_cmd(&port->se, UART_START_READ, 0);
+
+	return 0;
+}
 #endif
 
 #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE
@@ -431,6 +466,7 @@
 	}
 
 	writel(DEF_TX_WM, uport->membase + SE_GENI_TX_WATERMARK_REG);
+	writel(M_CMD_DONE_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
 	qcom_geni_serial_setup_tx(uport, bytes_to_send);
 	for (i = 0; i < count; ) {
 		size_t chars_to_write = 0;
@@ -472,7 +508,6 @@
 	bool locked = true;
 	unsigned long flags;
 	u32 geni_status;
-	u32 irq_en;
 
 	WARN_ON(co->index < 0 || co->index >= GENI_UART_CONS_PORTS);
 
@@ -506,12 +541,6 @@
 		 * has been sent, in which case we need to look for done first.
 		 */
 		qcom_geni_serial_poll_tx_done(uport);
-
-		if (!uart_circ_empty(&uport->state->xmit)) {
-			irq_en = readl(uport->membase + SE_GENI_M_IRQ_EN);
-			writel(irq_en | M_TX_FIFO_WATERMARK_EN,
-					uport->membase + SE_GENI_M_IRQ_EN);
-		}
 	}
 
 	__qcom_geni_serial_console_write(uport, s, count);
@@ -580,6 +609,8 @@
 	}
 	uport->icount.rx += ret;
 	tty_flip_buffer_push(tport);
+
+	trace_serial_transmit_data_rx(uport->dev, port->rx_buf, bytes);
 }
 
 static unsigned int qcom_geni_serial_tx_empty(struct uart_port *uport)
@@ -616,15 +647,19 @@
 	}
 
 	writel(M_CMD_CANCEL_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
+	trace_serial_info(uport->dev, __func__, "Done");
 }
 
 static void qcom_geni_serial_start_tx_dma(struct uart_port *uport)
 {
 	struct qcom_geni_serial_port *port = to_dev_port(uport);
 	struct circ_buf *xmit = &uport->state->xmit;
+	size_t pending = uart_circ_chars_pending(xmit);
 	unsigned int xmit_size;
+	bool pin_state;
 	int ret;
 
+	trace_serial_info(uport->dev, __func__, "Start");
 	if (port->tx_dma_addr)
 		return;
 
@@ -633,6 +668,11 @@
 
 	xmit_size = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
 
+	if (uport->rs485.flags & SER_RS485_ENABLED) {
+		/* For RS485 mode, the RTS can be set/cleared before transmission */
+		pin_state = !!(uport->rs485.flags & SER_RS485_RTS_ON_SEND);
+		qcom_geni_set_rts_pin(uport, pin_state);
+	}
 	qcom_geni_serial_setup_tx(uport, xmit_size);
 
 	ret = geni_se_tx_dma_prep(&port->se, &xmit->buf[xmit->tail],
@@ -643,6 +683,11 @@
 		return;
 	}
 
+	if (pending) {
+		serial_trace_log(uport->dev, "%s: TX transfer length: %d\n",
+				 __func__, pending);
+		trace_serial_transmit_data_tx(uport->dev, (char *)&xmit->buf[xmit->tail], pending);
+	}
 	port->tx_remaining = xmit_size;
 }
 
@@ -765,22 +810,33 @@
 static void qcom_geni_serial_stop_rx_dma(struct uart_port *uport)
 {
 	struct qcom_geni_serial_port *port = to_dev_port(uport);
+	bool done;
 
 	if (!qcom_geni_serial_secondary_active(uport))
 		return;
 
 	geni_se_cancel_s_cmd(&port->se);
-	qcom_geni_serial_poll_bit(uport, SE_GENI_S_IRQ_STATUS,
-				  S_CMD_CANCEL_EN, true);
-
-	if (qcom_geni_serial_secondary_active(uport))
+	done = qcom_geni_serial_poll_bit(uport, SE_DMA_RX_IRQ_STAT,
+			RX_EOT, true);
+	if (done) {
+		writel(RX_EOT | RX_DMA_DONE,
+				uport->membase + SE_DMA_RX_IRQ_CLR);
+	} else {
 		qcom_geni_serial_abort_rx(uport);
 
+		writel(1, uport->membase + SE_DMA_RX_FSM_RST);
+		qcom_geni_serial_poll_bit(uport, SE_DMA_RX_IRQ_STAT,
+				RX_RESET_DONE, true);
+		writel(RX_RESET_DONE | RX_DMA_DONE,
+				uport->membase + SE_DMA_RX_IRQ_CLR);
+	}
+
 	if (port->rx_dma_addr) {
 		geni_se_rx_dma_unprep(&port->se, port->rx_dma_addr,
 				      DMA_RX_BUF_SIZE);
 		port->rx_dma_addr = 0;
 	}
+	trace_serial_info(uport->dev, __func__, "Done");
 }
 
 static void qcom_geni_serial_start_rx_dma(struct uart_port *uport)
@@ -788,6 +844,7 @@
 	struct qcom_geni_serial_port *port = to_dev_port(uport);
 	int ret;
 
+	trace_serial_info(uport->dev, __func__, "start");
 	if (qcom_geni_serial_secondary_active(uport))
 		qcom_geni_serial_stop_rx_dma(uport);
 
@@ -966,6 +1023,7 @@
 	u32 dma_rx_status;
 	struct uart_port *uport = dev;
 	bool drop_rx = false;
+	bool pin_state;
 	struct tty_port *tport = &uport->state->port;
 	struct qcom_geni_serial_port *port = to_dev_port(uport);
 
@@ -986,26 +1044,46 @@
 	writel(dma_tx_status, uport->membase + SE_DMA_TX_IRQ_CLR);
 	writel(dma_rx_status, uport->membase + SE_DMA_RX_IRQ_CLR);
 
+	serial_trace_log(uport->dev, "%s: s_irq_status: 0x%x, m_irq_status: 0x%x",
+			 __func__, s_irq_status, m_irq_status);
 	if (WARN_ON(m_irq_status & M_ILLEGAL_CMD_EN))
 		goto out_unlock;
 
 	if (s_irq_status & S_RX_FIFO_WR_ERR_EN) {
 		uport->icount.overrun++;
 		tty_insert_flip_char(tport, 0, TTY_OVERRUN);
+		if (!uart_console(uport))
+			serial_trace_log(uport->dev, "%s: overrun: %d\n",
+					 __func__,  uport->icount.overrun);
 	}
 
 	if (s_irq_status & (S_GP_IRQ_0_EN | S_GP_IRQ_1_EN)) {
 		if (s_irq_status & S_GP_IRQ_0_EN)
 			uport->icount.parity++;
+		if (!uart_console(uport))
+			serial_trace_log(uport->dev, "%s: parity: %d\n",
+					 __func__, uport->icount.parity);
+
 		drop_rx = true;
 	} else if (s_irq_status & (S_GP_IRQ_2_EN | S_GP_IRQ_3_EN)) {
 		uport->icount.brk++;
 		port->brk = true;
+		if (!uart_console(uport))
+			serial_trace_log(uport->dev, "%s: break: %d\n",
+					 __func__, uport->icount.brk);
 	}
 
 	if (dma) {
-		if (dma_tx_status & TX_DMA_DONE)
+		serial_trace_log(uport->dev, "%s: dma_tx_status: 0x%x, dma_rx_status: 0x%x",
+				 __func__, dma_tx_status, dma_rx_status);
+		if (dma_tx_status & TX_DMA_DONE) {
 			qcom_geni_serial_handle_tx_dma(uport);
+			if (uport->rs485.flags & SER_RS485_ENABLED) {
+				/* For RS485 mode, the RTS can be set/cleared after transmission */
+				pin_state = !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND);
+				qcom_geni_set_rts_pin(uport, pin_state);
+			}
+		}
 
 		if (dma_rx_status) {
 			if (dma_rx_status & RX_RESET_DONE)
@@ -1075,8 +1153,10 @@
 	if (uart_console(uport))
 		return;
 
+	uart_port_lock_irq(uport);
 	qcom_geni_serial_stop_tx(uport);
 	qcom_geni_serial_stop_rx(uport);
+	uart_port_unlock_irq(uport);
 }
 
 static int qcom_geni_serial_port_setup(struct uart_port *uport)
@@ -1089,8 +1169,13 @@
 
 	proto = geni_se_read_proto(&port->se);
 	if (proto != GENI_SE_UART) {
-		dev_err(uport->dev, "Invalid FW loaded, proto: %d\n", proto);
-		return -ENXIO;
+		ret = geni_load_se_firmware(&port->se, GENI_SE_UART);
+		if (ret) {
+			dev_err(uport->dev,
+				"Cannot load firmware from linux for uart proto: %d error: %d\n",
+				proto, ret);
+			return -ENXIO;
+		}
 	}
 
 	qcom_geni_serial_stop_rx(uport);
@@ -1124,7 +1209,6 @@
 			       false, true, true);
 	geni_se_init(&port->se, UART_RX_WM, port->rx_fifo_depth - 2);
 	geni_se_select_mode(&port->se, port->dev_data->mode);
-	qcom_geni_serial_start_rx(uport);
 	port->setup = true;
 
 	return 0;
@@ -1140,6 +1224,11 @@
 		if (ret)
 			return ret;
 	}
+
+	uart_port_lock_irq(uport);
+	qcom_geni_serial_start_rx(uport);
+	uart_port_unlock_irq(uport);
+
 	enable_irq(uport->irq);
 
 	return 0;
@@ -1223,11 +1312,10 @@
 	unsigned long clk_rate;
 	u32 ver, sampling_rate;
 	unsigned int avg_bw_core;
+	unsigned long timeout;
 
-	qcom_geni_serial_stop_rx(uport);
 	/* baud rate */
 	baud = uart_get_baud_rate(uport, termios, old, 300, 4000000);
-	port->baud = baud;
 
 	sampling_rate = UART_OVERSAMPLING;
 	/* Sampling rate is halved for IP versions >= 2.5 */
@@ -1241,11 +1329,11 @@
 		dev_err(port->se.dev,
 			"Couldn't find suitable clock rate for %u\n",
 			baud * sampling_rate);
-		goto out_restart_rx;
+		return;
 	}
 
-	dev_dbg(port->se.dev, "desired_rate = %u, clk_rate = %lu, clk_div = %u\n",
-			baud * sampling_rate, clk_rate, clk_div);
+	serial_trace_log(port->se.dev, "baud: %u, desired_rate: %u, clk_rate: %lu, clk_div: %u\n",
+			 baud, baud * sampling_rate, clk_rate, clk_div);
 
 	uport->uartclk = clk_rate;
 	port->clk_rate = clk_rate;
@@ -1305,9 +1393,21 @@
 	else
 		tx_trans_cfg |= UART_CTS_MASK;
 
-	if (baud)
+	if (baud) {
 		uart_update_timeout(uport, termios->c_cflag, baud);
 
+		/*
+		 * Make sure that qcom_geni_serial_poll_bitfield() waits for
+		 * the FIFO, two-word intermediate transfer register and shift
+		 * register to clear.
+		 *
+		 * Note that uart_fifo_timeout() also adds a 20 ms margin.
+		 */
+		timeout = jiffies_to_usecs(uart_fifo_timeout(uport));
+		timeout += 3 * timeout / port->tx_fifo_depth;
+		WRITE_ONCE(port->poll_timeout_us, timeout);
+	}
+
 	if (!uart_console(uport))
 		writel(port->loopback,
 				uport->membase + SE_UART_LOOPBACK_CFG);
@@ -1320,8 +1420,6 @@
 	writel(stop_bit_len, uport->membase + SE_UART_TX_STOP_BIT_LEN);
 	writel(ser_clk_cfg, uport->membase + GENI_SER_M_CLK_CFG);
 	writel(ser_clk_cfg, uport->membase + GENI_SER_S_CLK_CFG);
-out_restart_rx:
-	qcom_geni_serial_start_rx(uport);
 }
 
 #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE
@@ -1524,6 +1622,21 @@
 	}
 }
 
+static int qcom_geni_rs485_config(struct uart_port *uport,
+				  struct ktermios *termios, struct serial_rs485 *rs485)
+{
+	/* When RS485 is enabled, keep the RTS pin in ACTIVE state
+	 * and revert back to auto flow control mode, i.e. flow control
+	 * managed by the QUP HW once RS485 is disabled.
+	 */
+	if (rs485->flags & SER_RS485_ENABLED)
+		qcom_geni_set_rts_pin(uport, true);
+	else
+		writel(0, uport->membase + SE_UART_MANUAL_RFR);
+
+	return 0;
+}
+
 static const struct uart_ops qcom_geni_console_pops = {
 	.tx_empty = qcom_geni_serial_tx_empty,
 	.stop_tx = qcom_geni_serial_stop_tx_fifo,
@@ -1541,7 +1654,7 @@
 #ifdef CONFIG_CONSOLE_POLL
 	.poll_get_char	= qcom_geni_serial_get_char,
 	.poll_put_char	= qcom_geni_serial_poll_put_char,
-	.poll_init = qcom_geni_serial_port_setup,
+	.poll_init = qcom_geni_serial_poll_init,
 #endif
 	.pm = qcom_geni_serial_pm,
 };
@@ -1615,6 +1728,8 @@
 		return -EINVAL;
 	uport->mapbase = res->start;
 
+	uport->rs485_config = qcom_geni_rs485_config;
+	uport->rs485_supported = qcom_geni_rs485_supported;
 	port->tx_fifo_depth = DEF_FIFO_DEPTH_WORDS;
 	port->rx_fifo_depth = DEF_FIFO_DEPTH_WORDS;
 	port->tx_fifo_width = DEF_FIFO_WIDTH_BITS;
@@ -1680,6 +1795,12 @@
 		return ret;
 	}
 
+	ret = uart_get_rs485_mode(uport);
+	if (ret) {
+		dev_err(uport->dev, "Failed to get rs485 mode %d\n", ret);
+		return ret;
+	}
+
 	ret = uart_add_one_port(drv, uport);
 	if (ret)
 		return ret;
@@ -1714,6 +1835,7 @@
 	struct uart_port *uport = &port->uport;
 	struct qcom_geni_private_data *private_data = uport->private_data;
 
+	trace_serial_info(uport->dev, __func__, "Start");
 	/*
 	 * This is done so we can hit the lowest possible state in suspend
 	 * even with no_console_suspend
@@ -1732,6 +1854,7 @@
 	struct uart_port *uport = &port->uport;
 	struct qcom_geni_private_data *private_data = uport->private_data;
 
+	trace_serial_info(uport->dev, __func__, "Start");
 	ret = uart_resume_port(private_data->drv, uport);
 	if (uart_console(uport)) {
 		geni_icc_set_tag(&port->se, QCOM_ICC_TAG_ALWAYS);
@@ -1740,38 +1863,6 @@
 	return ret;
 }
 
-static int qcom_geni_serial_sys_hib_resume(struct device *dev)
-{
-	int ret = 0;
-	struct uart_port *uport;
-	struct qcom_geni_private_data *private_data;
-	struct qcom_geni_serial_port *port = dev_get_drvdata(dev);
-
-	uport = &port->uport;
-	private_data = uport->private_data;
-
-	if (uart_console(uport)) {
-		geni_icc_set_tag(&port->se, QCOM_ICC_TAG_ALWAYS);
-		geni_icc_set_bw(&port->se);
-		ret = uart_resume_port(private_data->drv, uport);
-		/*
-		 * For hibernation usecase clients for
-		 * console UART won't call port setup during restore,
-		 * hence call port setup for console uart.
-		 */
-		qcom_geni_serial_port_setup(uport);
-	} else {
-		/*
-		 * Peripheral register settings are lost during hibernation.
-		 * Update setup flag such that port setup happens again
-		 * during next session. Clients of HS-UART will close and
-		 * open the port during hibernation.
-		 */
-		port->setup = false;
-	}
-	return ret;
-}
-
 static const struct qcom_geni_device_data qcom_geni_console_data = {
 	.console = true,
 	.mode = GENI_SE_FIFO,
@@ -1783,12 +1874,8 @@
 };
 
 static const struct dev_pm_ops qcom_geni_serial_pm_ops = {
-	.suspend = pm_sleep_ptr(qcom_geni_serial_sys_suspend),
-	.resume = pm_sleep_ptr(qcom_geni_serial_sys_resume),
-	.freeze = pm_sleep_ptr(qcom_geni_serial_sys_suspend),
-	.poweroff = pm_sleep_ptr(qcom_geni_serial_sys_suspend),
-	.restore = pm_sleep_ptr(qcom_geni_serial_sys_hib_resume),
-	.thaw = pm_sleep_ptr(qcom_geni_serial_sys_hib_resume),
+	SYSTEM_SLEEP_PM_OPS(qcom_geni_serial_sys_suspend,
+					qcom_geni_serial_sys_resume)
 };
 
 static const struct of_device_id qcom_geni_serial_match_table[] = {
@@ -1818,6 +1905,8 @@
 {
 	int ret;
 
+	qcom_geni_serial_port_init();
+
 	ret = console_register(&qcom_geni_console_driver);
 	if (ret)
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/tty/serial/rp2.c
+++ linux-qcom-6.8.0/drivers/tty/serial/rp2.c
@@ -577,8 +577,8 @@
 	u32 clk_cfg;
 
 	writew(1, base + RP2_GLOBAL_CMD);
-	readw(base + RP2_GLOBAL_CMD);
 	msleep(100);
+	readw(base + RP2_GLOBAL_CMD);
 	writel(0, base + RP2_CLK_PRESCALER);
 
 	/* TDM clock configuration */
--- linux-qcom-6.8.0.orig/drivers/tty/serial/samsung_tty.c
+++ linux-qcom-6.8.0/drivers/tty/serial/samsung_tty.c
@@ -987,11 +987,10 @@
 		if ((ufstat & info->tx_fifomask) != 0 ||
 		    (ufstat & info->tx_fifofull))
 			return 0;
-
-		return 1;
+		return TIOCSER_TEMT;
 	}
 
-	return s3c24xx_serial_txempty_nofifo(port);
+	return s3c24xx_serial_txempty_nofifo(port) ? TIOCSER_TEMT : 0;
 }
 
 /* no modem control lines */
--- linux-qcom-6.8.0.orig/drivers/tty/serial/sc16is7xx.c
+++ linux-qcom-6.8.0/drivers/tty/serial/sc16is7xx.c
@@ -18,6 +18,7 @@
 #include <linux/module.h>
 #include <linux/property.h>
 #include <linux/regmap.h>
+#include <linux/sched.h>
 #include <linux/serial_core.h>
 #include <linux/serial.h>
 #include <linux/tty.h>
@@ -25,7 +26,6 @@
 #include <linux/spi/spi.h>
 #include <linux/uaccess.h>
 #include <linux/units.h>
-#include <uapi/linux/sched/types.h>
 
 #define SC16IS7XX_NAME			"sc16is7xx"
 #define SC16IS7XX_MAX_DEVS		8
@@ -554,16 +554,28 @@
 	return reg == SC16IS7XX_RHR_REG;
 }
 
+/*
+ * Configure programmable baud rate generator (divisor) according to the
+ * desired baud rate.
+ *
+ * From the datasheet, the divisor is computed according to:
+ *
+ *              XTAL1 input frequency
+ *             -----------------------
+ *                    prescaler
+ * divisor = ---------------------------
+ *            baud-rate x sampling-rate
+ */
 static int sc16is7xx_set_baud(struct uart_port *port, int baud)
 {
 	struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
 	u8 lcr;
-	u8 prescaler = 0;
+	unsigned int prescaler = 1;
 	unsigned long clk = port->uartclk, div = clk / 16 / baud;
 
 	if (div >= BIT(16)) {
-		prescaler = SC16IS7XX_MCR_CLKSEL_BIT;
-		div /= 4;
+		prescaler = 4;
+		div /= prescaler;
 	}
 
 	/* Enable enhanced features */
@@ -573,9 +585,12 @@
 			      SC16IS7XX_EFR_ENABLE_BIT);
 	sc16is7xx_efr_unlock(port);
 
+	/* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */
 	sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
 			      SC16IS7XX_MCR_CLKSEL_BIT,
-			      prescaler);
+			      prescaler == 1 ? 0 : SC16IS7XX_MCR_CLKSEL_BIT);
+
+	mutex_lock(&one->efr_lock);
 
 	/* Backup LCR and access special register set (DLL/DLH) */
 	lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);
@@ -591,7 +606,9 @@
 	/* Restore LCR and access to general register set */
 	sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
 
-	return DIV_ROUND_CLOSEST(clk / 16, div);
+	mutex_unlock(&one->efr_lock);
+
+	return DIV_ROUND_CLOSEST((clk / prescaler) / 16, div);
 }
 
 static void sc16is7xx_handle_rx(struct uart_port *port, unsigned int rxlen,
--- linux-qcom-6.8.0.orig/drivers/tty/serial/serial_base.h
+++ linux-qcom-6.8.0/drivers/tty/serial/serial_base.h
@@ -22,6 +22,7 @@
 struct serial_port_device {
 	struct device dev;
 	struct uart_port *port;
+	unsigned int tx_enabled:1;
 };
 
 int serial_base_ctrl_init(void);
@@ -30,6 +31,9 @@
 int serial_base_port_init(void);
 void serial_base_port_exit(void);
 
+void serial_base_port_startup(struct uart_port *port);
+void serial_base_port_shutdown(struct uart_port *port);
+
 int serial_base_driver_register(struct device_driver *driver);
 void serial_base_driver_unregister(struct device_driver *driver);
 
--- linux-qcom-6.8.0.orig/drivers/tty/serial/serial_core.c
+++ linux-qcom-6.8.0/drivers/tty/serial/serial_core.c
@@ -156,7 +156,7 @@
 	 * enabled, serial_port_runtime_resume() calls start_tx() again
 	 * after enabling the device.
 	 */
-	if (pm_runtime_active(&port_dev->dev))
+	if (!pm_runtime_enabled(port->dev) || pm_runtime_active(&port_dev->dev))
 		port->ops->start_tx(port);
 	pm_runtime_mark_last_busy(&port_dev->dev);
 	pm_runtime_put_autosuspend(&port_dev->dev);
@@ -323,16 +323,26 @@
 			bool init_hw)
 {
 	struct tty_port *port = &state->port;
+	struct uart_port *uport;
 	int retval;
 
 	if (tty_port_initialized(port))
-		return 0;
+		goto out_base_port_startup;
 
 	retval = uart_port_startup(tty, state, init_hw);
-	if (retval)
+	if (retval) {
 		set_bit(TTY_IO_ERROR, &tty->flags);
+		return retval;
+	}
 
-	return retval;
+out_base_port_startup:
+	uport = uart_port_check(state);
+	if (!uport)
+		return -EIO;
+
+	serial_base_port_startup(uport);
+
+	return 0;
 }
 
 /*
@@ -355,20 +365,25 @@
 	if (tty)
 		set_bit(TTY_IO_ERROR, &tty->flags);
 
+	if (uport)
+		serial_base_port_shutdown(uport);
+
 	if (tty_port_initialized(port)) {
 		tty_port_set_initialized(port, false);
 
 		/*
 		 * Turn off DTR and RTS early.
 		 */
-		if (uport && uart_console(uport) && tty) {
-			uport->cons->cflag = tty->termios.c_cflag;
-			uport->cons->ispeed = tty->termios.c_ispeed;
-			uport->cons->ospeed = tty->termios.c_ospeed;
-		}
+		if (uport) {
+			if (uart_console(uport) && tty) {
+				uport->cons->cflag = tty->termios.c_cflag;
+				uport->cons->ispeed = tty->termios.c_ispeed;
+				uport->cons->ospeed = tty->termios.c_ospeed;
+			}
 
-		if (!tty || C_HUPCL(tty))
-			uart_port_dtr_rts(uport, false);
+			if (!tty || C_HUPCL(tty))
+				uart_port_dtr_rts(uport, false);
+		}
 
 		uart_port_shutdown(port);
 	}
@@ -863,6 +878,14 @@
 	new_flags = (__force upf_t)new_info->flags;
 	old_custom_divisor = uport->custom_divisor;
 
+	if (!(uport->flags & UPF_FIXED_PORT)) {
+		unsigned int uartclk = new_info->baud_base * 16;
+		/* check needs to be done here before other settings made */
+		if (uartclk == 0) {
+			retval = -EINVAL;
+			goto exit;
+		}
+	}
 	if (!capable(CAP_SYS_ADMIN)) {
 		retval = -EPERM;
 		if (change_irq || change_port ||
@@ -1775,6 +1798,7 @@
 	uport->ops->stop_rx(uport);
 	uart_port_unlock_irq(uport);
 
+	serial_base_port_shutdown(uport);
 	uart_port_shutdown(port);
 
 	/*
@@ -1788,6 +1812,7 @@
 	 * Free the transmit buffer.
 	 */
 	uart_port_lock_irq(uport);
+	uart_circ_clear(&state->xmit);
 	buf = state->xmit.buf;
 	state->xmit.buf = NULL;
 	uart_port_unlock_irq(uport);
@@ -2608,7 +2633,12 @@
 			port->type = PORT_UNKNOWN;
 			flags |= UART_CONFIG_TYPE;
 		}
+		/* Synchronize with possible boot console. */
+		if (uart_console(port))
+			console_lock();
 		port->ops->config_port(port, flags);
+		if (uart_console(port))
+			console_unlock();
 	}
 
 	if (port->type != PORT_UNKNOWN) {
@@ -2616,6 +2646,10 @@
 
 		uart_report_port(drv, port);
 
+		/* Synchronize with possible boot console. */
+		if (uart_console(port))
+			console_lock();
+
 		/* Power up port for set_mctrl() */
 		uart_change_pm(state, UART_PM_STATE_ON);
 
@@ -2632,6 +2666,9 @@
 
 		uart_rs485_config(port);
 
+		if (uart_console(port))
+			console_unlock();
+
 		/*
 		 * If this driver supports console, and it hasn't been
 		 * successfully registered yet, try to re-register it.
@@ -2665,14 +2702,13 @@
 	int ret = 0;
 
 	tport = &state->port;
-	mutex_lock(&tport->mutex);
+
+	guard(mutex)(&tport->mutex);
 
 	port = uart_port_check(state);
 	if (!port || port->type == PORT_UNKNOWN ||
-	    !(port->ops->poll_get_char && port->ops->poll_put_char)) {
-		ret = -1;
-		goto out;
-	}
+	    !(port->ops->poll_get_char && port->ops->poll_put_char))
+		return -1;
 
 	pm_state = state->pm_state;
 	uart_change_pm(state, UART_PM_STATE_ON);
@@ -2692,10 +2728,10 @@
 		ret = uart_set_options(port, NULL, baud, parity, bits, flow);
 		console_list_unlock();
 	}
-out:
+
 	if (ret)
 		uart_change_pm(state, pm_state);
-	mutex_unlock(&tport->mutex);
+
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/tty/serial/serial_port.c
+++ linux-qcom-6.8.0/drivers/tty/serial/serial_port.c
@@ -8,7 +8,10 @@
 
 #include <linux/device.h>
 #include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/property.h>
 #include <linux/serial_core.h>
 #include <linux/spinlock.h>
 
@@ -36,8 +39,12 @@
 
 	/* Flush any pending TX for the port */
 	uart_port_lock_irqsave(port, &flags);
+	if (!port_dev->tx_enabled)
+		goto unlock;
 	if (__serial_port_busy(port))
 		port->ops->start_tx(port);
+
+unlock:
 	uart_port_unlock_irqrestore(port, flags);
 
 out:
@@ -56,7 +63,19 @@
 	if (port->flags & UPF_DEAD)
 		return 0;
 
+	/*
+	 * Nothing to do on pm_runtime_force_suspend(), see
+	 * DEFINE_RUNTIME_DEV_PM_OPS.
+	 */
+	if (!pm_runtime_enabled(dev))
+		return 0;
+
 	uart_port_lock_irqsave(port, &flags);
+	if (!port_dev->tx_enabled) {
+		uart_port_unlock_irqrestore(port, flags);
+		return 0;
+	}
+
 	busy = __serial_port_busy(port);
 	if (busy)
 		port->ops->start_tx(port);
@@ -68,6 +87,31 @@
 	return busy ? -EBUSY : 0;
 }
 
+static void serial_base_port_set_tx(struct uart_port *port,
+				    struct serial_port_device *port_dev,
+				    bool enabled)
+{
+	unsigned long flags;
+
+	uart_port_lock_irqsave(port, &flags);
+	port_dev->tx_enabled = enabled;
+	uart_port_unlock_irqrestore(port, flags);
+}
+
+void serial_base_port_startup(struct uart_port *port)
+{
+	struct serial_port_device *port_dev = port->port_dev;
+
+	serial_base_port_set_tx(port, port_dev, true);
+}
+
+void serial_base_port_shutdown(struct uart_port *port)
+{
+	struct serial_port_device *port_dev = port->port_dev;
+
+	serial_base_port_set_tx(port, port_dev, false);
+}
+
 static DEFINE_RUNTIME_DEV_PM_OPS(serial_port_pm,
 				 serial_port_runtime_suspend,
 				 serial_port_runtime_resume, NULL);
@@ -105,6 +149,148 @@
 }
 EXPORT_SYMBOL(uart_remove_one_port);
 
+/**
+ * __uart_read_properties - read firmware properties of the given UART port
+ * @port: corresponding port
+ * @use_defaults: apply defaults (when %true) or validate the values (when %false)
+ *
+ * The following device properties are supported:
+ *   - clock-frequency (optional)
+ *   - fifo-size (optional)
+ *   - no-loopback-test (optional)
+ *   - reg-shift (defaults may apply)
+ *   - reg-offset (value may be validated)
+ *   - reg-io-width (defaults may apply or value may be validated)
+ *   - interrupts (OF only)
+ *   - serial [alias ID] (OF only)
+ *
+ * If the port->dev is of struct platform_device type the interrupt line
+ * will be retrieved via platform_get_irq() call against that device.
+ * Otherwise it will be assigned by fwnode_irq_get() call. In both cases
+ * the index 0 of the resource is used.
+ *
+ * The caller is responsible to initialize the following fields of the @port
+ *   ->dev (must be valid)
+ *   ->flags
+ *   ->mapbase
+ *   ->mapsize
+ *   ->regshift (if @use_defaults is false)
+ * before calling this function. Alternatively the above mentioned fields
+ * may be zeroed, in such case the only ones, that have associated properties
+ * found, will be set to the respective values.
+ *
+ * If no error happened, the ->irq, ->mapbase, ->mapsize will be altered.
+ * The ->iotype is always altered.
+ *
+ * When @use_defaults is true and the respective property is not found
+ * the following values will be applied:
+ *   ->regshift = 0
+ * In this case IRQ must be provided, otherwise an error will be returned.
+ *
+ * When @use_defaults is false and the respective property is found
+ * the following values will be validated:
+ *   - reg-io-width (->iotype)
+ *   - reg-offset (->mapsize against ->mapbase)
+ *
+ * Returns: 0 on success or negative errno on failure
+ */
+static int __uart_read_properties(struct uart_port *port, bool use_defaults)
+{
+	struct device *dev = port->dev;
+	u32 value;
+	int ret;
+
+	/* Read optional UART functional clock frequency */
+	device_property_read_u32(dev, "clock-frequency", &port->uartclk);
+
+	/* Read the registers alignment (default: 8-bit) */
+	ret = device_property_read_u32(dev, "reg-shift", &value);
+	if (ret)
+		port->regshift = use_defaults ? 0 : port->regshift;
+	else
+		port->regshift = value;
+
+	/* Read the registers I/O access type (default: MMIO 8-bit) */
+	ret = device_property_read_u32(dev, "reg-io-width", &value);
+	if (ret) {
+		port->iotype = UPIO_MEM;
+	} else {
+		switch (value) {
+		case 1:
+			port->iotype = UPIO_MEM;
+			break;
+		case 2:
+			port->iotype = UPIO_MEM16;
+			break;
+		case 4:
+			port->iotype = device_is_big_endian(dev) ? UPIO_MEM32BE : UPIO_MEM32;
+			break;
+		default:
+			if (!use_defaults) {
+				dev_err(dev, "Unsupported reg-io-width (%u)\n", value);
+				return -EINVAL;
+			}
+			port->iotype = UPIO_UNKNOWN;
+			break;
+		}
+	}
+
+	/* Read the address mapping base offset (default: no offset) */
+	ret = device_property_read_u32(dev, "reg-offset", &value);
+	if (ret)
+		value = 0;
+
+	/* Check for shifted address mapping overflow */
+	if (!use_defaults && port->mapsize < value) {
+		dev_err(dev, "reg-offset %u exceeds region size %pa\n", value, &port->mapsize);
+		return -EINVAL;
+	}
+
+	port->mapbase += value;
+	port->mapsize -= value;
+
+	/* Read optional FIFO size */
+	device_property_read_u32(dev, "fifo-size", &port->fifosize);
+
+	if (device_property_read_bool(dev, "no-loopback-test"))
+		port->flags |= UPF_SKIP_TEST;
+
+	/* Get index of serial line, if found in DT aliases */
+	ret = of_alias_get_id(dev_of_node(dev), "serial");
+	if (ret >= 0)
+		port->line = ret;
+
+	if (dev_is_platform(dev))
+		ret = platform_get_irq(to_platform_device(dev), 0);
+	else
+		ret = fwnode_irq_get(dev_fwnode(dev), 0);
+	if (ret == -EPROBE_DEFER)
+		return ret;
+	if (ret > 0)
+		port->irq = ret;
+	else if (use_defaults)
+		/* By default IRQ support is mandatory */
+		return ret;
+	else
+		port->irq = 0;
+
+	port->flags |= UPF_SHARE_IRQ;
+
+	return 0;
+}
+
+int uart_read_port_properties(struct uart_port *port)
+{
+	return __uart_read_properties(port, true);
+}
+EXPORT_SYMBOL_GPL(uart_read_port_properties);
+
+int uart_read_and_validate_port_properties(struct uart_port *port)
+{
+	return __uart_read_properties(port, false);
+}
+EXPORT_SYMBOL_GPL(uart_read_and_validate_port_properties);
+
 static struct device_driver serial_port_driver = {
 	.name = "port",
 	.suppress_bind_attrs = true,
--- linux-qcom-6.8.0.orig/drivers/tty/serial/sh-sci.c
+++ linux-qcom-6.8.0/drivers/tty/serial/sh-sci.c
@@ -157,6 +157,7 @@
 
 	bool has_rtscts;
 	bool autorts;
+	bool tx_occurred;
 };
 
 #define SCI_NPORTS CONFIG_SERIAL_SH_SCI_NR_UARTS
@@ -820,6 +821,7 @@
 {
 	struct circ_buf *xmit = &port->state->xmit;
 	unsigned int stopped = uart_tx_stopped(port);
+	struct sci_port *s = to_sci_port(port);
 	unsigned short status;
 	unsigned short ctrl;
 	int count;
@@ -856,6 +858,7 @@
 		}
 
 		serial_port_out(port, SCxTDR, c);
+		s->tx_occurred = true;
 
 		port->icount.tx++;
 	} while (--count > 0);
@@ -1212,6 +1215,8 @@
 	if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
 		uart_write_wakeup(port);
 
+	s->tx_occurred = true;
+
 	if (!uart_circ_empty(xmit)) {
 		s->cookie_tx = 0;
 		schedule_work(&s->work_tx);
@@ -1272,9 +1277,14 @@
 static void sci_dma_rx_release(struct sci_port *s)
 {
 	struct dma_chan *chan = s->chan_rx_saved;
+	struct uart_port *port = &s->port;
+	unsigned long flags;
 
+	uart_port_lock_irqsave(port, &flags);
 	s->chan_rx_saved = NULL;
 	sci_dma_rx_chan_invalidate(s);
+	uart_port_unlock_irqrestore(port, flags);
+
 	dmaengine_terminate_sync(chan);
 	dma_free_coherent(chan->device->dev, s->buf_len_rx * 2, s->rx_buf[0],
 			  sg_dma_address(&s->sg_rx[0]));
@@ -1695,6 +1705,19 @@
 		s->cookie_tx = -EINVAL;
 	}
 }
+
+static void sci_dma_check_tx_occurred(struct sci_port *s)
+{
+	struct dma_tx_state state;
+	enum dma_status status;
+
+	if (!s->chan_tx)
+		return;
+
+	status = dmaengine_tx_status(s->chan_tx, s->cookie_tx, &state);
+	if (status == DMA_COMPLETE || status == DMA_IN_PROGRESS)
+		s->tx_occurred = true;
+}
 #else /* !CONFIG_SERIAL_SH_SCI_DMA */
 static inline void sci_request_dma(struct uart_port *port)
 {
@@ -1704,6 +1727,10 @@
 {
 }
 
+static void sci_dma_check_tx_occurred(struct sci_port *s)
+{
+}
+
 #define sci_flush_buffer	NULL
 #endif /* !CONFIG_SERIAL_SH_SCI_DMA */
 
@@ -2040,6 +2067,12 @@
 {
 	unsigned short status = serial_port_in(port, SCxSR);
 	unsigned short in_tx_fifo = sci_txfill(port);
+	struct sci_port *s = to_sci_port(port);
+
+	sci_dma_check_tx_occurred(s);
+
+	if (!s->tx_occurred)
+		return TIOCSER_TEMT;
 
 	return (status & SCxSR_TEND(port)) && !in_tx_fifo ? TIOCSER_TEMT : 0;
 }
@@ -2210,6 +2243,7 @@
 
 	dev_dbg(port->dev, "%s(%d)\n", __func__, port->line);
 
+	s->tx_occurred = false;
 	sci_request_dma(port);
 
 	ret = sci_request_irq(s);
--- linux-qcom-6.8.0.orig/drivers/tty/serial/stm32-usart.c
+++ linux-qcom-6.8.0/drivers/tty/serial/stm32-usart.c
@@ -857,6 +857,7 @@
 	const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
 	u32 sr;
 	unsigned int size;
+	irqreturn_t ret = IRQ_NONE;
 
 	sr = readl_relaxed(port->membase + ofs->isr);
 
@@ -865,11 +866,14 @@
 	    (sr & USART_SR_TC)) {
 		stm32_usart_tc_interrupt_disable(port);
 		stm32_usart_rs485_rts_disable(port);
+		ret = IRQ_HANDLED;
 	}
 
-	if ((sr & USART_SR_RTOF) && ofs->icr != UNDEF_REG)
+	if ((sr & USART_SR_RTOF) && ofs->icr != UNDEF_REG) {
 		writel_relaxed(USART_ICR_RTOCF,
 			       port->membase + ofs->icr);
+		ret = IRQ_HANDLED;
+	}
 
 	if ((sr & USART_SR_WUF) && ofs->icr != UNDEF_REG) {
 		/* Clear wake up flag and disable wake up interrupt */
@@ -878,6 +882,7 @@
 		stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_WUFIE);
 		if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
 			pm_wakeup_event(tport->tty->dev, 0);
+		ret = IRQ_HANDLED;
 	}
 
 	/*
@@ -892,6 +897,7 @@
 			uart_unlock_and_check_sysrq(port);
 			if (size)
 				tty_flip_buffer_push(tport);
+			ret = IRQ_HANDLED;
 		}
 	}
 
@@ -899,6 +905,7 @@
 		uart_port_lock(port);
 		stm32_usart_transmit_chars(port);
 		uart_port_unlock(port);
+		ret = IRQ_HANDLED;
 	}
 
 	/* Receiver timeout irq for DMA RX */
@@ -908,9 +915,10 @@
 		uart_unlock_and_check_sysrq(port);
 		if (size)
 			tty_flip_buffer_push(tport);
+		ret = IRQ_HANDLED;
 	}
 
-	return IRQ_HANDLED;
+	return ret;
 }
 
 static void stm32_usart_set_mctrl(struct uart_port *port, unsigned int mctrl)
@@ -1051,14 +1059,14 @@
 	const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
 	unsigned long flags;
 
-	spin_lock_irqsave(&port->lock, flags);
+	uart_port_lock_irqsave(port, &flags);
 
 	if (break_state)
 		stm32_usart_set_bits(port, ofs->rqr, USART_RQR_SBKRQ);
 	else
 		stm32_usart_clr_bits(port, ofs->rqr, USART_RQR_SBKRQ);
 
-	spin_unlock_irqrestore(&port->lock, flags);
+	uart_port_unlock_irqrestore(port, flags);
 }
 
 static int stm32_usart_startup(struct uart_port *port)
@@ -1080,6 +1088,7 @@
 		val |= USART_CR2_SWAP;
 		writel_relaxed(val, port->membase + ofs->cr2);
 	}
+	stm32_port->throttled = false;
 
 	/* RX FIFO Flush */
 	if (ofs->rqr != UNDEF_REG)
--- linux-qcom-6.8.0.orig/drivers/tty/tty_io.c
+++ linux-qcom-6.8.0/drivers/tty/tty_io.c
@@ -3631,7 +3631,7 @@
 		.data		= &tty_ldisc_autoload,
 		.maxlen		= sizeof(tty_ldisc_autoload),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
 		.extra1		= SYSCTL_ZERO,
 		.extra2		= SYSCTL_ONE,
 	},
--- linux-qcom-6.8.0.orig/drivers/tty/tty_ldisc.c
+++ linux-qcom-6.8.0/drivers/tty/tty_ldisc.c
@@ -545,6 +545,12 @@
 		goto out;
 	}
 
+	if (tty->ops->ldisc_ok) {
+		retval = tty->ops->ldisc_ok(tty, disc);
+		if (retval)
+			goto out;
+	}
+
 	old_ldisc = tty->ldisc;
 
 	/* Shutdown the old discipline. */
--- linux-qcom-6.8.0.orig/drivers/tty/vt/vt.c
+++ linux-qcom-6.8.0/drivers/tty/vt/vt.c
@@ -2469,7 +2469,7 @@
 		}
 		return;
 	case EScsiignore:
-		if (c >= 20 && c <= 0x3f)
+		if (c >= 0x20 && c <= 0x3f)
 			return;
 		vc->vc_state = ESnormal;
 		return;
@@ -3396,6 +3396,15 @@
 	tty_port_put(&vc->port);
 }
 
+/*
+ * We can't deal with anything but the N_TTY ldisc,
+ * because we can sleep in our write() routine.
+ */
+static int con_ldisc_ok(struct tty_struct *tty, int ldisc)
+{
+	return ldisc == N_TTY ? 0 : -EINVAL;
+}
+
 static int default_color           = 7; /* white */
 static int default_italic_color    = 2; // green (ASCII)
 static int default_underline_color = 3; // cyan (ASCII)
@@ -3515,6 +3524,7 @@
 	.resize = vt_resize,
 	.shutdown = con_shutdown,
 	.cleanup = con_cleanup,
+	.ldisc_ok = con_ldisc_ok,
 };
 
 static struct cdev vc0_cdev;
@@ -4545,7 +4555,7 @@
 		return -EINVAL;
 
 	if (op->data) {
-		font.data = kvmalloc(max_font_size, GFP_KERNEL);
+		font.data = kvzalloc(max_font_size, GFP_KERNEL);
 		if (!font.data)
 			return -ENOMEM;
 	} else
--- linux-qcom-6.8.0.orig/drivers/ufs/core/ufs-mcq.c
+++ linux-qcom-6.8.0/drivers/ufs/core/ufs-mcq.c
@@ -94,7 +94,7 @@
 
 	val = ufshcd_readl(hba, REG_UFS_MCQ_CFG);
 	val &= ~MCQ_CFG_MAC_MASK;
-	val |= FIELD_PREP(MCQ_CFG_MAC_MASK, max_active_cmds);
+	val |= FIELD_PREP(MCQ_CFG_MAC_MASK, max_active_cmds - 1);
 	ufshcd_writel(hba, val, REG_UFS_MCQ_CFG);
 }
 EXPORT_SYMBOL_GPL(ufshcd_mcq_config_mac);
@@ -105,16 +105,15 @@
  * @hba: per adapter instance
  * @req: pointer to the request to be issued
  *
- * Return: the hardware queue instance on which the request would
- * be queued.
+ * Return: the hardware queue instance on which the request will be or has
+ * been queued. %NULL if the request has already been freed.
  */
 struct ufs_hw_queue *ufshcd_mcq_req_to_hwq(struct ufs_hba *hba,
 					 struct request *req)
 {
-	u32 utag = blk_mq_unique_tag(req);
-	u32 hwq = blk_mq_unique_tag_to_hwq(utag);
+	struct blk_mq_hw_ctx *hctx = READ_ONCE(req->mq_hctx);
 
-	return &hba->uhq[hwq];
+	return hctx ? &hba->uhq[hctx->queue_num] : NULL;
 }
 
 /**
@@ -231,8 +230,6 @@
 
 /* Operation and runtime registers configuration */
 #define MCQ_CFG_n(r, i)	((r) + MCQ_QCFG_SIZE * (i))
-#define MCQ_OPR_OFFSET_n(p, i) \
-	(hba->mcq_opr[(p)].offset + hba->mcq_opr[(p)].stride * (i))
 
 static void __iomem *mcq_opr_base(struct ufs_hba *hba,
 					 enum ufshcd_mcq_opr n, int i)
@@ -345,10 +342,10 @@
 		ufsmcq_writelx(hba, upper_32_bits(hwq->sqe_dma_addr),
 			      MCQ_CFG_n(REG_SQUBA, i));
 		/* Submission Queue Doorbell Address Offset */
-		ufsmcq_writelx(hba, MCQ_OPR_OFFSET_n(OPR_SQD, i),
+		ufsmcq_writelx(hba, ufshcd_mcq_opr_offset(hba, OPR_SQD, i),
 			      MCQ_CFG_n(REG_SQDAO, i));
 		/* Submission Queue Interrupt Status Address Offset */
-		ufsmcq_writelx(hba, MCQ_OPR_OFFSET_n(OPR_SQIS, i),
+		ufsmcq_writelx(hba, ufshcd_mcq_opr_offset(hba, OPR_SQIS, i),
 			      MCQ_CFG_n(REG_SQISAO, i));
 
 		/* Completion Queue Lower Base Address */
@@ -358,10 +355,10 @@
 		ufsmcq_writelx(hba, upper_32_bits(hwq->cqe_dma_addr),
 			      MCQ_CFG_n(REG_CQUBA, i));
 		/* Completion Queue Doorbell Address Offset */
-		ufsmcq_writelx(hba, MCQ_OPR_OFFSET_n(OPR_CQD, i),
+		ufsmcq_writelx(hba, ufshcd_mcq_opr_offset(hba, OPR_CQD, i),
 			      MCQ_CFG_n(REG_CQDAO, i));
 		/* Completion Queue Interrupt Status Address Offset */
-		ufsmcq_writelx(hba, MCQ_OPR_OFFSET_n(OPR_CQIS, i),
+		ufsmcq_writelx(hba, ufshcd_mcq_opr_offset(hba, OPR_CQIS, i),
 			      MCQ_CFG_n(REG_CQISAO, i));
 
 		/* Save the base addresses for quicker access */
@@ -501,7 +498,7 @@
 	struct scsi_cmnd *cmd = lrbp->cmd;
 	struct ufs_hw_queue *hwq;
 	void __iomem *reg, *opr_sqd_base;
-	u32 nexus, id, val;
+	u32 nexus, id, val, rtc;
 	int err;
 
 	if (hba->quirks & UFSHCD_QUIRK_MCQ_BROKEN_RTC)
@@ -511,6 +508,8 @@
 		if (!cmd)
 			return -EINVAL;
 		hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd));
+		if (!hwq)
+			return 0;
 	} else {
 		hwq = hba->dev_cmd_queue;
 	}
@@ -529,17 +528,18 @@
 	opr_sqd_base = mcq_opr_base(hba, OPR_SQD, id);
 	writel(nexus, opr_sqd_base + REG_SQCTI);
 
-	/* SQRTCy.ICU = 1 */
-	writel(SQ_ICU, opr_sqd_base + REG_SQRTC);
+	/* Initiate Cleanup */
+	writel(readl(opr_sqd_base + REG_SQRTC) | SQ_ICU,
+		opr_sqd_base + REG_SQRTC);
 
 	/* Poll SQRTSy.CUS = 1. Return result from SQRTSy.RTC */
 	reg = opr_sqd_base + REG_SQRTS;
 	err = read_poll_timeout(readl, val, val & SQ_CUS, 20,
 				MCQ_POLL_US, false, reg);
-	if (err)
-		dev_err(hba->dev, "%s: failed. hwq=%d, tag=%d err=%ld\n",
-			__func__, id, task_tag,
-			FIELD_GET(SQ_ICU_ERR_CODE_MASK, readl(reg)));
+	rtc = FIELD_GET(SQ_ICU_ERR_CODE_MASK, readl(reg));
+	if (err || rtc)
+		dev_err(hba->dev, "%s: failed. hwq=%d, tag=%d err=%d RTC=%d\n",
+			__func__, id, task_tag, err, rtc);
 
 	if (ufshcd_mcq_sq_start(hba, hwq))
 		err = -ETIMEDOUT;
@@ -597,8 +597,7 @@
 	addr = le64_to_cpu(cmd_desc_base_addr) & CQE_UCD_BA;
 
 	while (sq_head_slot != hwq->sq_tail_slot) {
-		utrd = hwq->sqe_base_addr +
-				sq_head_slot * sizeof(struct utp_transfer_req_desc);
+		utrd = hwq->sqe_base_addr + sq_head_slot;
 		match = le64_to_cpu(utrd->command_desc_base_addr) & CQE_UCD_BA;
 		if (addr == match) {
 			ufshcd_mcq_nullify_sqe(utrd);
@@ -631,20 +630,20 @@
 	struct ufshcd_lrb *lrbp = &hba->lrb[tag];
 	struct ufs_hw_queue *hwq;
 	unsigned long flags;
-	int err = FAILED;
+	int err;
 
 	if (!ufshcd_cmd_inflight(lrbp->cmd)) {
 		dev_err(hba->dev,
 			"%s: skip abort. cmd at tag %d already completed.\n",
 			__func__, tag);
-		goto out;
+		return FAILED;
 	}
 
 	/* Skip task abort in case previous aborts failed and report failure */
 	if (lrbp->req_abort_skip) {
 		dev_err(hba->dev, "%s: skip abort. tag %d failed earlier\n",
 			__func__, tag);
-		goto out;
+		return FAILED;
 	}
 
 	hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd));
@@ -656,7 +655,7 @@
 		 */
 		dev_err(hba->dev, "%s: cmd found in sq. hwq=%d, tag=%d\n",
 			__func__, hwq->id, tag);
-		goto out;
+		return FAILED;
 	}
 
 	/*
@@ -664,18 +663,17 @@
 	 * in the completion queue either. Query the device to see if
 	 * the command is being processed in the device.
 	 */
-	if (ufshcd_try_to_abort_task(hba, tag)) {
+	err = ufshcd_try_to_abort_task(hba, tag);
+	if (err) {
 		dev_err(hba->dev, "%s: device abort failed %d\n", __func__, err);
 		lrbp->req_abort_skip = true;
-		goto out;
+		return FAILED;
 	}
 
-	err = SUCCESS;
 	spin_lock_irqsave(&hwq->cq_lock, flags);
 	if (ufshcd_cmd_inflight(lrbp->cmd))
 		ufshcd_release_scsi_cmd(hba, lrbp);
 	spin_unlock_irqrestore(&hwq->cq_lock, flags);
 
-out:
-	return err;
+	return SUCCESS;
 }
--- linux-qcom-6.8.0.orig/drivers/ufs/core/ufs-sysfs.c
+++ linux-qcom-6.8.0/drivers/ufs/core/ufs-sysfs.c
@@ -405,6 +405,53 @@
 	return count;
 }
 
+/**
+ * pm_qos_enable_show - sysfs handler to show pm qos enable value
+ * @dev: device associated with the UFS controller
+ * @attr: sysfs attribute handle
+ * @buf: buffer for sysfs file
+ *
+ * Print 1 if PM QoS feature is enabled, 0 if disabled.
+ *
+ * Returns number of characters written to @buf.
+ */
+static ssize_t pm_qos_enable_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct ufs_hba *hba = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%d\n", hba->pm_qos_enabled);
+}
+
+/**
+ * pm_qos_enable_store - sysfs handler to store value
+ * @dev: device associated with the UFS controller
+ * @attr: sysfs attribute handle
+ * @buf: buffer for sysfs file
+ * @count: stores buffer characters count
+ *
+ * Input 0 to disable PM QoS and 1 value to enable.
+ * Default state: 1
+ *
+ * Return: number of characters written to @buf on success, < 0 upon failure.
+ */
+static ssize_t pm_qos_enable_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct ufs_hba *hba = dev_get_drvdata(dev);
+	bool value;
+
+	if (kstrtobool(buf, &value))
+		return -EINVAL;
+
+	if (value)
+		ufshcd_pm_qos_init(hba);
+	else
+		ufshcd_pm_qos_exit(hba);
+
+	return count;
+}
+
 static DEVICE_ATTR_RW(rpm_lvl);
 static DEVICE_ATTR_RO(rpm_target_dev_state);
 static DEVICE_ATTR_RO(rpm_target_link_state);
@@ -416,6 +463,7 @@
 static DEVICE_ATTR_RW(enable_wb_buf_flush);
 static DEVICE_ATTR_RW(wb_flush_threshold);
 static DEVICE_ATTR_RW(rtc_update_ms);
+static DEVICE_ATTR_RW(pm_qos_enable);
 
 static struct attribute *ufs_sysfs_ufshcd_attrs[] = {
 	&dev_attr_rpm_lvl.attr,
@@ -429,6 +477,7 @@
 	&dev_attr_enable_wb_buf_flush.attr,
 	&dev_attr_wb_flush_threshold.attr,
 	&dev_attr_rtc_update_ms.attr,
+	&dev_attr_pm_qos_enable.attr,
 	NULL
 };
 
@@ -563,6 +612,9 @@
 	struct ufs_hba *hba = dev_get_drvdata(dev);
 	struct ufs_hba_monitor *m = &hba->monitor;
 
+	if (!m->nr_req[READ])
+		return sysfs_emit(buf, "0\n");
+
 	return sysfs_emit(buf, "%llu\n", div_u64(ktime_to_us(m->lat_sum[READ]),
 						 m->nr_req[READ]));
 }
@@ -630,6 +682,9 @@
 	struct ufs_hba *hba = dev_get_drvdata(dev);
 	struct ufs_hba_monitor *m = &hba->monitor;
 
+	if (!m->nr_req[WRITE])
+		return sysfs_emit(buf, "0\n");
+
 	return sysfs_emit(buf, "%llu\n", div_u64(ktime_to_us(m->lat_sum[WRITE]),
 						 m->nr_req[WRITE]));
 }
--- linux-qcom-6.8.0.orig/drivers/ufs/core/ufs_bsg.c
+++ linux-qcom-6.8.0/drivers/ufs/core/ufs_bsg.c
@@ -170,7 +170,7 @@
 		break;
 	case UPIU_TRANSACTION_UIC_CMD:
 		memcpy(&uc, &bsg_request->upiu_req.uc, UIC_CMD_SIZE);
-		ret = ufshcd_send_uic_cmd(hba, &uc);
+		ret = ufshcd_send_bsg_uic_cmd(hba, &uc);
 		if (ret)
 			dev_err(hba->dev, "send uic cmd: error code %d\n", ret);
 
--- linux-qcom-6.8.0.orig/drivers/ufs/core/ufshcd-crypto.c
+++ linux-qcom-6.8.0/drivers/ufs/core/ufshcd-crypto.c
@@ -18,6 +18,7 @@
 };
 
 static int ufshcd_program_key(struct ufs_hba *hba,
+			      const struct blk_crypto_key *bkey,
 			      const union ufs_crypto_cfg_entry *cfg, int slot)
 {
 	int i;
@@ -27,7 +28,7 @@
 	ufshcd_hold(hba);
 
 	if (hba->vops && hba->vops->program_key) {
-		err = hba->vops->program_key(hba, cfg, slot);
+		err = hba->vops->program_key(hba, bkey, cfg, slot);
 		goto out;
 	}
 
@@ -80,16 +81,18 @@
 	cfg.crypto_cap_idx = cap_idx;
 	cfg.config_enable = UFS_CRYPTO_CONFIGURATION_ENABLE;
 
-	if (ccap_array[cap_idx].algorithm_id == UFS_CRYPTO_ALG_AES_XTS) {
-		/* In XTS mode, the blk_crypto_key's size is already doubled */
-		memcpy(cfg.crypto_key, key->raw, key->size/2);
-		memcpy(cfg.crypto_key + UFS_CRYPTO_KEY_MAX_SIZE/2,
-		       key->raw + key->size/2, key->size/2);
-	} else {
-		memcpy(cfg.crypto_key, key->raw, key->size);
+	if (key->crypto_cfg.key_type != BLK_CRYPTO_KEY_TYPE_HW_WRAPPED) {
+		if (ccap_array[cap_idx].algorithm_id == UFS_CRYPTO_ALG_AES_XTS) {
+			/* In XTS mode, the blk_crypto_key's size is already doubled */
+			memcpy(cfg.crypto_key, key->raw, key->size/2);
+			memcpy(cfg.crypto_key + UFS_CRYPTO_KEY_MAX_SIZE/2,
+			       key->raw + key->size/2, key->size/2);
+		} else {
+			memcpy(cfg.crypto_key, key->raw, key->size);
+		}
 	}
 
-	err = ufshcd_program_key(hba, &cfg, slot);
+	err = ufshcd_program_key(hba, key, &cfg, slot);
 
 	memzero_explicit(&cfg, sizeof(cfg));
 	return err;
@@ -103,7 +106,7 @@
 	 */
 	union ufs_crypto_cfg_entry cfg = {};
 
-	return ufshcd_program_key(hba, &cfg, slot);
+	return ufshcd_program_key(hba, NULL, &cfg, slot);
 }
 
 static int ufshcd_crypto_keyslot_evict(struct blk_crypto_profile *profile,
@@ -126,9 +129,66 @@
 	return true;
 }
 
+
+static int ufshcd_crypto_derive_sw_secret(struct blk_crypto_profile *profile,
+				const u8 wrapped_key[], size_t wrapped_key_size,
+				u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE])
+{
+	struct ufs_hba *hba =
+		container_of(profile, struct ufs_hba, crypto_profile);
+
+	if (hba->vops && hba->vops->derive_sw_secret)
+		return  hba->vops->derive_sw_secret(hba, wrapped_key,
+						 wrapped_key_size, sw_secret);
+
+	return -EOPNOTSUPP;
+}
+
+static int ufshcd_crypto_generate_key(struct blk_crypto_profile *profile,
+				      u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct ufs_hba *hba =
+		container_of(profile, struct ufs_hba, crypto_profile);
+
+	if (hba->vops && hba->vops->generate_key)
+		return  hba->vops->generate_key(hba, lt_key);
+
+	return -EOPNOTSUPP;
+}
+
+static int ufshcd_crypto_prepare_key(struct blk_crypto_profile *profile,
+				     const u8 *lt_key, size_t lt_key_size,
+				     u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct ufs_hba *hba =
+		container_of(profile, struct ufs_hba, crypto_profile);
+
+	if (hba->vops && hba->vops->prepare_key)
+		return  hba->vops->prepare_key(hba, lt_key, lt_key_size, eph_key);
+
+	return -EOPNOTSUPP;
+}
+
+static int ufshcd_crypto_import_key(struct blk_crypto_profile *profile,
+				    const u8 *imp_key, size_t imp_key_size,
+				    u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct ufs_hba *hba =
+		container_of(profile, struct ufs_hba, crypto_profile);
+
+	if (hba->vops && hba->vops->import_key)
+		return  hba->vops->import_key(hba, imp_key, imp_key_size, lt_key);
+
+	return -EOPNOTSUPP;
+}
+
 static const struct blk_crypto_ll_ops ufshcd_crypto_ops = {
 	.keyslot_program	= ufshcd_crypto_keyslot_program,
 	.keyslot_evict		= ufshcd_crypto_keyslot_evict,
+	.derive_sw_secret	= ufshcd_crypto_derive_sw_secret,
+	.generate_key		= ufshcd_crypto_generate_key,
+	.prepare_key		= ufshcd_crypto_prepare_key,
+	.import_key		= ufshcd_crypto_import_key,
 };
 
 static enum blk_crypto_mode_num
@@ -190,6 +250,13 @@
 	hba->crypto_profile.ll_ops = ufshcd_crypto_ops;
 	/* UFS only supports 8 bytes for any DUN */
 	hba->crypto_profile.max_dun_bytes_supported = 8;
+	if (hba->quirks & UFSHCD_QUIRK_USES_WRAPPED_CRYPTO_KEYS)
+		hba->crypto_profile.key_types_supported =
+				BLK_CRYPTO_KEY_TYPE_HW_WRAPPED;
+	else
+		hba->crypto_profile.key_types_supported =
+				BLK_CRYPTO_KEY_TYPE_STANDARD;
+
 	hba->crypto_profile.dev = hba->dev;
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/ufs/core/ufshcd-priv.h
+++ linux-qcom-6.8.0/drivers/ufs/core/ufshcd-priv.h
@@ -89,6 +89,7 @@
 			    u8 **buf, bool ascii);
 
 int ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd);
+int ufshcd_send_bsg_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd);
 
 int ufshcd_exec_raw_upiu_cmd(struct ufs_hba *hba,
 			     struct utp_upiu_req *req_upiu,
@@ -241,12 +242,6 @@
 		hba->vops->config_scaling_param(hba, p, data);
 }
 
-static inline void ufshcd_vops_reinit_notify(struct ufs_hba *hba)
-{
-	if (hba->vops && hba->vops->reinit_notify)
-		hba->vops->reinit_notify(hba);
-}
-
 static inline int ufshcd_vops_mcq_config_resource(struct ufs_hba *hba)
 {
 	if (hba->vops && hba->vops->mcq_config_resource)
@@ -329,6 +324,11 @@
 	return pm_runtime_get_sync(&hba->ufs_device_wlun->sdev_gendev);
 }
 
+static inline int ufshcd_rpm_get_if_active(struct ufs_hba *hba)
+{
+	return pm_runtime_get_if_active(&hba->ufs_device_wlun->sdev_gendev);
+}
+
 static inline int ufshcd_rpm_put_sync(struct ufs_hba *hba)
 {
 	return pm_runtime_put_sync(&hba->ufs_device_wlun->sdev_gendev);
--- linux-qcom-6.8.0.orig/drivers/ufs/core/ufshcd.c
+++ linux-qcom-6.8.0/drivers/ufs/core/ufshcd.c
@@ -1015,6 +1015,48 @@
 }
 
 /**
+ * ufshcd_pm_qos_init - initialize PM QoS request
+ * @hba: per adapter instance
+ */
+void ufshcd_pm_qos_init(struct ufs_hba *hba)
+{
+
+	if (hba->pm_qos_enabled)
+		return;
+
+	cpu_latency_qos_add_request(&hba->pm_qos_req, PM_QOS_DEFAULT_VALUE);
+
+	if (cpu_latency_qos_request_active(&hba->pm_qos_req))
+		hba->pm_qos_enabled = true;
+}
+
+/**
+ * ufshcd_pm_qos_exit - remove request from PM QoS
+ * @hba: per adapter instance
+ */
+void ufshcd_pm_qos_exit(struct ufs_hba *hba)
+{
+	if (!hba->pm_qos_enabled)
+		return;
+
+	cpu_latency_qos_remove_request(&hba->pm_qos_req);
+	hba->pm_qos_enabled = false;
+}
+
+/**
+ * ufshcd_pm_qos_update - update PM QoS request
+ * @hba: per adapter instance
+ * @on: If True, vote for perf PM QoS mode otherwise power save mode
+ */
+static void ufshcd_pm_qos_update(struct ufs_hba *hba, bool on)
+{
+	if (!hba->pm_qos_enabled)
+		return;
+
+	cpu_latency_qos_update_request(&hba->pm_qos_req, on ? 0 : PM_QOS_DEFAULT_VALUE);
+}
+
+/**
  * ufshcd_set_clk_freq - set UFS controller clock frequencies
  * @hba: per adapter instance
  * @scale_up: If True, set max possible frequency othewise set low frequency
@@ -1160,8 +1202,11 @@
 					    hba->devfreq->previous_freq);
 		else
 			ufshcd_set_clk_freq(hba, !scale_up);
+		goto out;
 	}
 
+	ufshcd_pm_qos_update(hba, scale_up);
+
 out:
 	trace_ufshcd_profile_clk_scaling(dev_name(hba->dev),
 			(scale_up ? "up" : "down"),
@@ -1347,7 +1392,7 @@
 	 * make sure that there are no outstanding requests when
 	 * clock scaling is in progress
 	 */
-	ufshcd_scsi_block_requests(hba);
+	blk_mq_quiesce_tagset(&hba->host->tag_set);
 	mutex_lock(&hba->wb_mutex);
 	down_write(&hba->clk_scaling_lock);
 
@@ -1356,7 +1401,7 @@
 		ret = -EBUSY;
 		up_write(&hba->clk_scaling_lock);
 		mutex_unlock(&hba->wb_mutex);
-		ufshcd_scsi_unblock_requests(hba);
+		blk_mq_unquiesce_tagset(&hba->host->tag_set);
 		goto out;
 	}
 
@@ -1377,7 +1422,7 @@
 
 	mutex_unlock(&hba->wb_mutex);
 
-	ufshcd_scsi_unblock_requests(hba);
+	blk_mq_unquiesce_tagset(&hba->host->tag_set);
 	ufshcd_release(hba);
 }
 
@@ -2377,8 +2422,6 @@
 	int err;
 
 	hba->capabilities = ufshcd_readl(hba, REG_CONTROLLER_CAPABILITIES);
-	if (hba->quirks & UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS)
-		hba->capabilities &= ~MASK_64_ADDRESSING_SUPPORT;
 
 	/* nutrs and nutmrs are 0 based values */
 	hba->nutrs = (hba->capabilities & MASK_TRANSFER_REQUESTS_SLOTS) + 1;
@@ -2393,7 +2436,17 @@
 		return err;
 	}
 
+	/*
+	 * The UFSHCI 3.0 specification does not define MCQ_SUPPORT and
+	 * LSDB_SUPPORT, but [31:29] as reserved bits with reset value 0s, which
+	 * means we can simply read values regardless of version.
+	 */
 	hba->mcq_sup = FIELD_GET(MASK_MCQ_SUPPORT, hba->capabilities);
+	/*
+	 * 0h: legacy single doorbell support is available
+	 * 1h: indicate that legacy single doorbell support has been removed
+	 */
+	hba->lsdb_sup = !FIELD_GET(MASK_LSDB_SUPPORT, hba->capabilities);
 	if (!hba->mcq_sup)
 		return 0;
 
@@ -2501,13 +2554,11 @@
  * __ufshcd_send_uic_cmd - Send UIC commands and retrieve the result
  * @hba: per adapter instance
  * @uic_cmd: UIC command
- * @completion: initialize the completion only if this is set to true
  *
  * Return: 0 only if success.
  */
 static int
-__ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd,
-		      bool completion)
+__ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd)
 {
 	lockdep_assert_held(&hba->uic_cmd_mutex);
 
@@ -2517,8 +2568,7 @@
 		return -EIO;
 	}
 
-	if (completion)
-		init_completion(&uic_cmd->done);
+	init_completion(&uic_cmd->done);
 
 	uic_cmd->cmd_active = 1;
 	ufshcd_dispatch_uic_cmd(hba, uic_cmd);
@@ -2544,7 +2594,7 @@
 	mutex_lock(&hba->uic_cmd_mutex);
 	ufshcd_add_delay_before_dme_cmd(hba);
 
-	ret = __ufshcd_send_uic_cmd(hba, uic_cmd, true);
+	ret = __ufshcd_send_uic_cmd(hba, uic_cmd);
 	if (!ret)
 		ret = ufshcd_wait_for_uic_cmd(hba, uic_cmd);
 
@@ -2904,9 +2954,8 @@
 	struct utp_transfer_req_desc *utrdlp = hba->utrdl_base_addr;
 	dma_addr_t cmd_desc_element_addr = hba->ucdl_dma_addr +
 		i * ufshcd_get_ucd_size(hba);
-	u16 response_offset = offsetof(struct utp_transfer_cmd_desc,
-				       response_upiu);
-	u16 prdt_offset = offsetof(struct utp_transfer_cmd_desc, prd_table);
+	u16 response_offset = le16_to_cpu(utrdlp[i].response_upiu_offset);
+	u16 prdt_offset = le16_to_cpu(utrdlp[i].prd_table_offset);
 
 	lrb->utr_descriptor_ptr = utrdlp + i;
 	lrb->utrd_dma_addr = hba->utrdl_dma_addr +
@@ -3172,7 +3221,9 @@
 
 		/* MCQ mode */
 		if (is_mcq_enabled(hba)) {
-			err = ufshcd_clear_cmd(hba, lrbp->task_tag);
+			/* successfully cleared the command, retry if needed */
+			if (ufshcd_clear_cmd(hba, lrbp->task_tag) == 0)
+				err = -EAGAIN;
 			hba->dev_cmd.complete = NULL;
 			return err;
 		}
@@ -4077,11 +4128,16 @@
 			min_sleep_time_us =
 				MIN_DELAY_BEFORE_DME_CMDS_US - delta;
 		else
-			return; /* no more delay required */
+			min_sleep_time_us = 0; /* no more delay required */
+	}
+
+	if (min_sleep_time_us > 0) {
+		/* allow sleep for extra 50us if needed */
+		usleep_range(min_sleep_time_us, min_sleep_time_us + 50);
 	}
 
-	/* allow sleep for extra 50us if needed */
-	usleep_range(min_sleep_time_us, min_sleep_time_us + 50);
+	/* update the last_dme_cmd_tstamp */
+	hba->last_dme_cmd_tstamp = ktime_get();
 }
 
 /**
@@ -4242,11 +4298,11 @@
 		 * Make sure UIC command completion interrupt is disabled before
 		 * issuing UIC command.
 		 */
-		wmb();
+		ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
 		reenable_intr = true;
 	}
 	spin_unlock_irqrestore(hba->host->host_lock, flags);
-	ret = __ufshcd_send_uic_cmd(hba, cmd, false);
+	ret = __ufshcd_send_uic_cmd(hba, cmd);
 	if (ret) {
 		dev_err(hba->dev,
 			"pwr ctrl cmd 0x%x with mode 0x%x uic error %d\n",
@@ -4302,6 +4358,42 @@
 }
 
 /**
+ * ufshcd_send_bsg_uic_cmd - Send UIC commands requested via BSG layer and retrieve the result
+ * @hba: per adapter instance
+ * @uic_cmd: UIC command
+ *
+ * Return: 0 only if success.
+ */
+int ufshcd_send_bsg_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd)
+{
+	int ret;
+
+	if (hba->quirks & UFSHCD_QUIRK_BROKEN_UIC_CMD)
+		return 0;
+
+	ufshcd_hold(hba);
+
+	if (uic_cmd->argument1 == UIC_ARG_MIB(PA_PWRMODE) &&
+	    uic_cmd->command == UIC_CMD_DME_SET) {
+		ret = ufshcd_uic_pwr_ctrl(hba, uic_cmd);
+		goto out;
+	}
+
+	mutex_lock(&hba->uic_cmd_mutex);
+	ufshcd_add_delay_before_dme_cmd(hba);
+
+	ret = __ufshcd_send_uic_cmd(hba, uic_cmd);
+	if (!ret)
+		ret = ufshcd_wait_for_uic_cmd(hba, uic_cmd);
+
+	mutex_unlock(&hba->uic_cmd_mutex);
+
+out:
+	ufshcd_release(hba);
+	return ret;
+}
+
+/**
  * ufshcd_uic_change_pwr_mode - Perform the UIC power mode chage
  *				using DME_SET primitives.
  * @hba: per adapter instance
@@ -4606,9 +4698,6 @@
 		dev_err(hba->dev,
 			"%s: power mode change failed %d\n", __func__, ret);
 	} else {
-		ufshcd_vops_pwr_change_notify(hba, POST_CHANGE, NULL,
-								pwr_mode);
-
 		memcpy(&hba->pwr_info, pwr_mode,
 			sizeof(struct ufs_pa_layer_attr));
 	}
@@ -4637,6 +4726,10 @@
 
 	ret = ufshcd_change_power_mode(hba, &final_params);
 
+	if (!ret)
+		ufshcd_vops_pwr_change_notify(hba, POST_CHANGE, NULL,
+					&final_params);
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(ufshcd_config_pwr_mode);
@@ -5378,10 +5471,12 @@
 		}
 		break;
 	case OCS_ABORTED:
-		result |= DID_ABORT << 16;
-		break;
 	case OCS_INVALID_COMMAND_STATUS:
 		result |= DID_REQUEUE << 16;
+		dev_warn(hba->dev,
+				"OCS %s from controller for tag %d\n",
+				(ocs == OCS_ABORTED ? "aborted" : "invalid"),
+				lrbp->task_tag);
 		break;
 	case OCS_INVALID_CMD_TABLE_ATTR:
 	case OCS_INVALID_PRDT_ATTR:
@@ -5493,6 +5588,7 @@
 
 	lrbp = &hba->lrb[task_tag];
 	lrbp->compl_time_stamp = ktime_get();
+	lrbp->compl_time_stamp_local_clock = local_clock();
 	cmd = lrbp->cmd;
 	if (cmd) {
 		if (unlikely(ufshcd_should_inform_monitor(hba, lrbp)))
@@ -6450,24 +6546,12 @@
 	struct scsi_device *sdev = cmd->device;
 	struct Scsi_Host *shost = sdev->host;
 	struct ufs_hba *hba = shost_priv(shost);
-	struct ufshcd_lrb *lrbp = &hba->lrb[tag];
-	struct ufs_hw_queue *hwq;
-	unsigned long flags;
 
 	*ret = ufshcd_try_to_abort_task(hba, tag);
 	dev_err(hba->dev, "Aborting tag %d / CDB %#02x %s\n", tag,
 		hba->lrb[tag].cmd ? hba->lrb[tag].cmd->cmnd[0] : -1,
 		*ret ? "failed" : "succeeded");
 
-	/* Release cmd in MCQ mode if abort succeeds */
-	if (is_mcq_enabled(hba) && (*ret == 0)) {
-		hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(lrbp->cmd));
-		spin_lock_irqsave(&hwq->cq_lock, flags);
-		if (ufshcd_cmd_inflight(lrbp->cmd))
-			ufshcd_release_scsi_cmd(hba, lrbp);
-		spin_unlock_irqrestore(&hwq->cq_lock, flags);
-	}
-
 	return *ret == 0;
 }
 
@@ -6549,7 +6633,8 @@
 	if (ufshcd_err_handling_should_stop(hba))
 		goto skip_err_handling;
 
-	if (hba->dev_quirks & UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS) {
+	if ((hba->dev_quirks & UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS) &&
+	    !hba->force_reset) {
 		bool ret;
 
 		spin_unlock_irqrestore(hba->host->host_lock, flags);
@@ -8223,10 +8308,13 @@
 	 */
 	val = ts64.tv_sec - hba->dev_info.rtc_time_baseline;
 
-	ufshcd_rpm_get_sync(hba);
+	/* Skip update RTC if RPM state is not RPM_ACTIVE */
+	if (ufshcd_rpm_get_if_active(hba) <= 0)
+		return;
+
 	err = ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_WRITE_ATTR, QUERY_ATTR_IDN_SECONDS_PASSED,
 				0, 0, &val);
-	ufshcd_rpm_put_sync(hba);
+	ufshcd_rpm_put(hba);
 
 	if (err)
 		dev_err(hba->dev, "%s: Failed to update rtc %d\n", __func__, err);
@@ -8724,6 +8812,14 @@
 		ufshcd_init_clk_scaling_sysfs(hba);
 	}
 
+	/*
+	 * The RTC update code accesses the hba->ufs_device_wlun->sdev_gendev
+	 * pointer and hence must only be started after the WLUN pointer has
+	 * been initialized by ufshcd_scsi_add_wlus().
+	 */
+	schedule_delayed_work(&hba->ufs_rtc_update_work,
+			      msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS));
+
 	ufs_bsg_probe(hba);
 	scsi_scan_host(hba->host);
 
@@ -8883,8 +8979,6 @@
 	ufshcd_force_reset_auto_bkops(hba);
 
 	ufshcd_set_timestamp_attr(hba);
-	schedule_delayed_work(&hba->ufs_rtc_update_work,
-			      msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS));
 
 	/* Gear up to HS gear if supported */
 	if (hba->max_pwr_info.is_valid) {
@@ -8928,8 +9022,8 @@
 	    (hba->quirks & UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH)) {
 		/* Reset the device and controller before doing reinit */
 		ufshcd_device_reset(hba);
+		ufs_put_device_desc(hba);
 		ufshcd_hba_stop(hba);
-		ufshcd_vops_reinit_notify(hba);
 		ret = ufshcd_hba_enable(hba);
 		if (ret) {
 			dev_err(hba->dev, "Host controller enable failed\n");
@@ -9280,6 +9374,8 @@
 	if (ret)
 		return ret;
 
+	if (!ufshcd_is_clkscaling_supported(hba))
+		ufshcd_pm_qos_update(hba, on);
 out:
 	if (ret) {
 		list_for_each_entry(clki, head, list) {
@@ -9457,6 +9553,7 @@
 static void ufshcd_hba_exit(struct ufs_hba *hba)
 {
 	if (hba->is_powered) {
+		ufshcd_pm_qos_exit(hba);
 		ufshcd_exit_clk_scaling(hba);
 		ufshcd_exit_clk_gating(hba);
 		if (hba->eh_wq)
@@ -9745,7 +9842,10 @@
 
 	/* UFS device & link must be active before we enter in this function */
 	if (!ufshcd_is_ufs_dev_active(hba) || !ufshcd_is_link_active(hba)) {
-		ret = -EINVAL;
+		/*  Wait err handler finish or trigger err recovery */
+		if (!ufshcd_eh_in_progress(hba))
+			ufshcd_force_error_recovery(hba);
+		ret = -EBUSY;
 		goto enable_scaling;
 	}
 
@@ -10109,6 +10209,7 @@
 	ufshcd_vreg_set_lpm(hba);
 	/* Put the host controller in low power mode if possible */
 	ufshcd_hba_vreg_set_lpm(hba);
+	ufshcd_pm_qos_update(hba, false);
 	return ret;
 }
 
@@ -10278,7 +10379,9 @@
 	shost_for_each_device(sdev, hba->host) {
 		if (sdev == hba->ufs_device_wlun)
 			continue;
-		scsi_device_quiesce(sdev);
+		mutex_lock(&sdev->state_mutex);
+		scsi_device_set_state(sdev, SDEV_OFFLINE);
+		mutex_unlock(&sdev->state_mutex);
 	}
 	__ufshcd_wl_suspend(hba, UFS_SHUTDOWN_PM);
 
@@ -10304,10 +10407,12 @@
 	ufs_hwmon_remove(hba);
 	ufs_bsg_remove(hba);
 	ufs_sysfs_remove_nodes(hba->dev);
+	cancel_delayed_work_sync(&hba->ufs_rtc_update_work);
 	blk_mq_destroy_queue(hba->tmf_queue);
 	blk_put_queue(hba->tmf_queue);
 	blk_mq_free_tag_set(&hba->tmf_tag_set);
-	scsi_remove_host(hba->host);
+	if (hba->scsi_host_added)
+		scsi_remove_host(hba->host);
 	/* disable interrupts */
 	ufshcd_disable_intr(hba, hba->intr_mask);
 	ufshcd_hba_stop(hba);
@@ -10348,10 +10453,7 @@
 	 * are updated with the latest queue addresses. Only after
 	 * updating these addresses, we can queue the new commands.
 	 */
-	mb();
-
-	/* Resuming from hibernate, assume that link was OFF */
-	ufshcd_set_link_off(hba);
+	ufshcd_readl(hba, REG_UTP_TASK_REQ_LIST_BASE_H);
 
 	return 0;
 
@@ -10384,6 +10486,8 @@
  */
 static int ufshcd_set_dma_mask(struct ufs_hba *hba)
 {
+	if (hba->vops && hba->vops->set_dma_mask)
+		return hba->vops->set_dma_mask(hba);
 	if (hba->capabilities & MASK_64_ADDRESSING_SUPPORT) {
 		if (!dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(64)))
 			return 0;
@@ -10565,7 +10669,7 @@
 	 * Make sure that UFS interrupts are disabled and any pending interrupt
 	 * status is cleared before registering UFS interrupt handler.
 	 */
-	mb();
+	ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
 
 	/* IRQ registration */
 	err = devm_request_irq(dev, irq, ufshcd_intr, IRQF_SHARED, UFSHCD, hba);
@@ -10577,11 +10681,18 @@
 	}
 
 	if (!is_mcq_supported(hba)) {
+		if (!hba->lsdb_sup) {
+			dev_err(hba->dev, "%s: failed to initialize (legacy doorbell mode not supported)\n",
+				__func__);
+			err = -EINVAL;
+			goto out_disable;
+		}
 		err = scsi_add_host(host, hba->dev);
 		if (err) {
 			dev_err(hba->dev, "scsi_add_host failed\n");
 			goto out_disable;
 		}
+		hba->scsi_host_added = true;
 	}
 
 	hba->tmf_tag_set = (struct blk_mq_tag_set) {
@@ -10620,14 +10731,17 @@
 	}
 
 	/*
-	 * Set the default power management level for runtime and system PM.
+	 * Set the default power management level for runtime and system PM if
+	 * not set by the host controller drivers.
 	 * Default power saving mode is to keep UFS link in Hibern8 state
 	 * and UFS device in sleep state.
 	 */
-	hba->rpm_lvl = ufs_get_desired_pm_lvl_for_dev_link_state(
+	if (!hba->rpm_lvl)
+		hba->rpm_lvl = ufs_get_desired_pm_lvl_for_dev_link_state(
 						UFS_SLEEP_PWR_MODE,
 						UIC_LINK_HIBERN8_STATE);
-	hba->spm_lvl = ufs_get_desired_pm_lvl_for_dev_link_state(
+	if (!hba->spm_lvl)
+		hba->spm_lvl = ufs_get_desired_pm_lvl_for_dev_link_state(
 						UFS_SLEEP_PWR_MODE,
 						UIC_LINK_HIBERN8_STATE);
 
@@ -10655,6 +10769,7 @@
 	ufs_sysfs_add_nodes(hba->dev);
 
 	device_enable_async_suspend(dev);
+	ufshcd_pm_qos_init(hba);
 	return 0;
 
 free_tmf_queue:
@@ -10663,7 +10778,8 @@
 free_tmf_tag_set:
 	blk_mq_free_tag_set(&hba->tmf_tag_set);
 out_remove_scsi_host:
-	scsi_remove_host(hba->host);
+	if (hba->scsi_host_added)
+		scsi_remove_host(hba->host);
 out_disable:
 	hba->is_irq_enabled = false;
 	ufshcd_hba_exit(hba);
--- linux-qcom-6.8.0.orig/drivers/ufs/host/cdns-pltfrm.c
+++ linux-qcom-6.8.0/drivers/ufs/host/cdns-pltfrm.c
@@ -136,7 +136,7 @@
 	 * Make sure the register was updated,
 	 * UniPro layer will not work with an incorrect value.
 	 */
-	mb();
+	ufshcd_readl(hba, CDNS_UFS_REG_HCLKDIV);
 
 	return 0;
 }
@@ -307,9 +307,7 @@
  */
 static void cdns_ufs_pltfrm_remove(struct platform_device *pdev)
 {
-	struct ufs_hba *hba =  platform_get_drvdata(pdev);
-
-	ufshcd_remove(hba);
+	ufshcd_pltfrm_remove(pdev);
 }
 
 static const struct dev_pm_ops cdns_ufs_dev_pm_ops = {
--- linux-qcom-6.8.0.orig/drivers/ufs/host/tc-dwc-g210-pltfrm.c
+++ linux-qcom-6.8.0/drivers/ufs/host/tc-dwc-g210-pltfrm.c
@@ -76,10 +76,7 @@
  */
 static void tc_dwc_g210_pltfm_remove(struct platform_device *pdev)
 {
-	struct ufs_hba *hba =  platform_get_drvdata(pdev);
-
-	pm_runtime_get_sync(&(pdev)->dev);
-	ufshcd_remove(hba);
+	ufshcd_pltfrm_remove(pdev);
 }
 
 static const struct dev_pm_ops tc_dwc_g210_pltfm_pm_ops = {
--- linux-qcom-6.8.0.orig/drivers/ufs/host/ufs-exynos.c
+++ linux-qcom-6.8.0/drivers/ufs/host/ufs-exynos.c
@@ -1227,12 +1227,12 @@
 	hci_writel(ufs, 1 << 0, HCI_GPIO_OUT);
 }
 
-static void exynos_ufs_pre_hibern8(struct ufs_hba *hba, u8 enter)
+static void exynos_ufs_pre_hibern8(struct ufs_hba *hba, enum uic_cmd_dme cmd)
 {
 	struct exynos_ufs *ufs = ufshcd_get_variant(hba);
 	struct exynos_ufs_uic_attr *attr = ufs->drv_data->uic_attr;
 
-	if (!enter) {
+	if (cmd == UIC_CMD_DME_HIBER_EXIT) {
 		if (ufs->opts & EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL)
 			exynos_ufs_disable_auto_ctrl_hcc(ufs);
 		exynos_ufs_ungate_clks(ufs);
@@ -1260,11 +1260,11 @@
 	}
 }
 
-static void exynos_ufs_post_hibern8(struct ufs_hba *hba, u8 enter)
+static void exynos_ufs_post_hibern8(struct ufs_hba *hba, enum uic_cmd_dme cmd)
 {
 	struct exynos_ufs *ufs = ufshcd_get_variant(hba);
 
-	if (!enter) {
+	if (cmd == UIC_CMD_DME_HIBER_EXIT) {
 		u32 cur_mode = 0;
 		u32 pwrmode;
 
@@ -1283,7 +1283,7 @@
 
 		if (!(ufs->opts & EXYNOS_UFS_OPT_SKIP_CONNECTION_ESTAB))
 			exynos_ufs_establish_connt(ufs);
-	} else {
+	} else if (cmd == UIC_CMD_DME_HIBER_ENTER) {
 		ufs->entry_hibern8_t = ktime_get();
 		exynos_ufs_gate_clks(ufs);
 		if (ufs->opts & EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL)
@@ -1370,15 +1370,15 @@
 }
 
 static void exynos_ufs_hibern8_notify(struct ufs_hba *hba,
-				     enum uic_cmd_dme enter,
+				     enum uic_cmd_dme cmd,
 				     enum ufs_notify_change_status notify)
 {
 	switch ((u8)notify) {
 	case PRE_CHANGE:
-		exynos_ufs_pre_hibern8(hba, enter);
+		exynos_ufs_pre_hibern8(hba, cmd);
 		break;
 	case POST_CHANGE:
-		exynos_ufs_post_hibern8(hba, enter);
+		exynos_ufs_post_hibern8(hba, cmd);
 		break;
 	}
 }
@@ -1615,8 +1615,7 @@
 	struct ufs_hba *hba =  platform_get_drvdata(pdev);
 	struct exynos_ufs *ufs = ufshcd_get_variant(hba);
 
-	pm_runtime_get_sync(&(pdev)->dev);
-	ufshcd_remove(hba);
+	ufshcd_pltfrm_remove(pdev);
 
 	phy_power_off(ufs->phy);
 	phy_exit(ufs->phy);
--- linux-qcom-6.8.0.orig/drivers/ufs/host/ufs-hisi.c
+++ linux-qcom-6.8.0/drivers/ufs/host/ufs-hisi.c
@@ -576,9 +576,7 @@
 
 static void ufs_hisi_remove(struct platform_device *pdev)
 {
-	struct ufs_hba *hba =  platform_get_drvdata(pdev);
-
-	ufshcd_remove(hba);
+	ufshcd_pltfrm_remove(pdev);
 }
 
 static const struct dev_pm_ops ufs_hisi_pm_ops = {
--- linux-qcom-6.8.0.orig/drivers/ufs/host/ufs-mediatek.c
+++ linux-qcom-6.8.0/drivers/ufs/host/ufs-mediatek.c
@@ -1748,10 +1748,7 @@
  */
 static void ufs_mtk_remove(struct platform_device *pdev)
 {
-	struct ufs_hba *hba =  platform_get_drvdata(pdev);
-
-	pm_runtime_get_sync(&(pdev)->dev);
-	ufshcd_remove(hba);
+	ufshcd_pltfrm_remove(pdev);
 }
 
 #ifdef CONFIG_PM_SLEEP
--- linux-qcom-6.8.0.orig/drivers/ufs/host/ufs-qcom.c
+++ linux-qcom-6.8.0/drivers/ufs/host/ufs-qcom.c
@@ -47,7 +47,7 @@
 	TSTBUS_MAX,
 };
 
-#define QCOM_UFS_MAX_GEAR 4
+#define QCOM_UFS_MAX_GEAR 5
 #define QCOM_UFS_MAX_LANE 2
 
 enum {
@@ -67,27 +67,33 @@
 	[MODE_PWM][UFS_PWM_G2][UFS_LANE_1] = { 1844,		1000 },
 	[MODE_PWM][UFS_PWM_G3][UFS_LANE_1] = { 3688,		1000 },
 	[MODE_PWM][UFS_PWM_G4][UFS_LANE_1] = { 7376,		1000 },
+	[MODE_PWM][UFS_PWM_G5][UFS_LANE_1] = { 14752,		1000 },
 	[MODE_PWM][UFS_PWM_G1][UFS_LANE_2] = { 1844,		1000 },
 	[MODE_PWM][UFS_PWM_G2][UFS_LANE_2] = { 3688,		1000 },
 	[MODE_PWM][UFS_PWM_G3][UFS_LANE_2] = { 7376,		1000 },
 	[MODE_PWM][UFS_PWM_G4][UFS_LANE_2] = { 14752,		1000 },
+	[MODE_PWM][UFS_PWM_G5][UFS_LANE_2] = { 29504,		1000 },
 	[MODE_HS_RA][UFS_HS_G1][UFS_LANE_1] = { 127796,		1000 },
 	[MODE_HS_RA][UFS_HS_G2][UFS_LANE_1] = { 255591,		1000 },
 	[MODE_HS_RA][UFS_HS_G3][UFS_LANE_1] = { 1492582,	102400 },
 	[MODE_HS_RA][UFS_HS_G4][UFS_LANE_1] = { 2915200,	204800 },
+	[MODE_HS_RA][UFS_HS_G5][UFS_LANE_1] = { 5836800,	409600 },
 	[MODE_HS_RA][UFS_HS_G1][UFS_LANE_2] = { 255591,		1000 },
 	[MODE_HS_RA][UFS_HS_G2][UFS_LANE_2] = { 511181,		1000 },
 	[MODE_HS_RA][UFS_HS_G3][UFS_LANE_2] = { 1492582,	204800 },
 	[MODE_HS_RA][UFS_HS_G4][UFS_LANE_2] = { 2915200,	409600 },
+	[MODE_HS_RA][UFS_HS_G5][UFS_LANE_2] = { 5836800,	819200 },
 	[MODE_HS_RB][UFS_HS_G1][UFS_LANE_1] = { 149422,		1000 },
 	[MODE_HS_RB][UFS_HS_G2][UFS_LANE_1] = { 298189,		1000 },
 	[MODE_HS_RB][UFS_HS_G3][UFS_LANE_1] = { 1492582,	102400 },
 	[MODE_HS_RB][UFS_HS_G4][UFS_LANE_1] = { 2915200,	204800 },
+	[MODE_HS_RB][UFS_HS_G5][UFS_LANE_1] = { 5836800,	409600 },
 	[MODE_HS_RB][UFS_HS_G1][UFS_LANE_2] = { 298189,		1000 },
 	[MODE_HS_RB][UFS_HS_G2][UFS_LANE_2] = { 596378,		1000 },
 	[MODE_HS_RB][UFS_HS_G3][UFS_LANE_2] = { 1492582,	204800 },
 	[MODE_HS_RB][UFS_HS_G4][UFS_LANE_2] = { 2915200,	409600 },
-	[MODE_MAX][0][0]		    = { 7643136,	307200 },
+	[MODE_HS_RB][UFS_HS_G5][UFS_LANE_2] = { 5836800,	819200 },
+	[MODE_MAX][0][0]		    = { 7643136,	819200 },
 };
 
 static void ufs_qcom_get_default_testbus_cfg(struct ufs_qcom_host *host);
@@ -123,6 +129,8 @@
 
 	host->ice = ice;
 	hba->caps |= UFSHCD_CAP_CRYPTO;
+	if (qcom_ice_hwkm_supported(host->ice))
+		hba->quirks |= UFSHCD_QUIRK_USES_WRAPPED_CRYPTO_KEYS;
 
 	return 0;
 }
@@ -144,6 +152,7 @@
 }
 
 static int ufs_qcom_ice_program_key(struct ufs_hba *hba,
+				    const struct blk_crypto_key *bkey,
 				    const union ufs_crypto_cfg_entry *cfg,
 				    int slot)
 {
@@ -151,6 +160,10 @@
 	union ufs_crypto_cap_entry cap;
 	bool config_enable =
 		cfg->config_enable & UFS_CRYPTO_CONFIGURATION_ENABLE;
+	u8 ice_key_size;
+
+	if (!config_enable)
+		return qcom_ice_evict_key(host->ice, slot);
 
 	/* Only AES-256-XTS has been tested so far. */
 	cap = hba->crypto_cap_array[cfg->crypto_cap_idx];
@@ -158,19 +171,73 @@
 	    cap.key_size != UFS_CRYPTO_KEY_SIZE_256)
 		return -EOPNOTSUPP;
 
-	if (config_enable)
-		return qcom_ice_program_key(host->ice,
-					    QCOM_ICE_CRYPTO_ALG_AES_XTS,
-					    QCOM_ICE_CRYPTO_KEY_SIZE_256,
-					    cfg->crypto_key,
-					    cfg->data_unit_size, slot);
+	if (bkey->crypto_cfg.key_type == BLK_CRYPTO_KEY_TYPE_HW_WRAPPED)
+		ice_key_size = QCOM_ICE_CRYPTO_KEY_SIZE_WRAPPED;
 	else
-		return qcom_ice_evict_key(host->ice, slot);
+		ice_key_size = QCOM_ICE_CRYPTO_KEY_SIZE_256;
+
+	return qcom_ice_program_key(host->ice,
+				    QCOM_ICE_CRYPTO_ALG_AES_XTS,
+				    ice_key_size, bkey,
+				    cfg->data_unit_size, slot);
+}
+
+/*
+ * Derive a SW secret from the wrapped key. The key is unwrapped in Trustzone
+ * and a SW key is then derived from it.
+ */
+int ufs_qcom_ice_derive_sw_secret(struct ufs_hba *hba, const u8 wrapped_key[],
+				  unsigned int wrapped_key_size,
+				  u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE])
+{
+	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
+
+	return qcom_ice_derive_sw_secret(host->ice, wrapped_key,
+					wrapped_key_size, sw_secret);
+}
+
+int ufs_qcom_ice_generate_key(struct ufs_hba *hba,
+			      u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
+
+	return qcom_ice_generate_key(host->ice, lt_key);
+}
+
+int ufs_qcom_ice_prepare_key(struct ufs_hba *hba,
+			     const u8 *lt_key, size_t lt_key_size,
+			     u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
+
+	return qcom_ice_prepare_key(host->ice, lt_key, lt_key_size,
+				    eph_key);
+}
+
+int ufs_qcom_ice_import_key(struct ufs_hba *hba,
+			    const u8 *imp_key, size_t imp_key_size,
+			    u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE])
+{
+	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
+
+	return qcom_ice_import_key(host->ice, imp_key, imp_key_size,
+				   lt_key);
+}
+
+static int ufs_qcom_ice_scale_clk(struct ufs_qcom_host *host, bool scale_up)
+{
+	if (host->hba->caps & UFSHCD_CAP_CRYPTO)
+		return qcom_ice_scale_clk(host->ice, scale_up);
+	return 0;
 }
 
 #else
 
 #define ufs_qcom_ice_program_key NULL
+#define ufs_qcom_ice_derive_sw_secret NULL
+#define ufs_qcom_ice_generate_key NULL
+#define ufs_qcom_ice_prepare_key NULL
+#define ufs_qcom_ice_import_key NULL
 
 static inline void ufs_qcom_ice_enable(struct ufs_qcom_host *host)
 {
@@ -190,6 +257,11 @@
 {
 	return 0;
 }
+
+static inline int  ufs_qcom_ice_scale_clk(struct ufs_qcom_host *host, bool scale_up)
+{
+	return 0;
+}
 #endif
 
 static void ufs_qcom_disable_lane_clks(struct ufs_qcom_host *host)
@@ -206,6 +278,9 @@
 {
 	int err;
 
+	if (host->is_lane_clks_enabled)
+		return 0;
+
 	err = clk_bulk_prepare_enable(host->num_clks, host->clks);
 	if (err)
 		return err;
@@ -278,9 +353,6 @@
 
 	if (host->hw_ver.major >= 0x05)
 		ufshcd_rmwl(host->hba, QUNIPRO_G4_SEL, 0, REG_UFS_CFG0);
-
-	/* make sure above configuration is applied before we return */
-	mb();
 }
 
 /*
@@ -365,6 +437,11 @@
 	if (ret)
 		return ret;
 
+	if (phy->power_count) {
+		phy_power_off(phy);
+		phy_exit(phy);
+	}
+
 	/* phy initialization - calibrate the phy */
 	ret = phy_init(phy);
 	if (ret) {
@@ -409,7 +486,7 @@
 		    REG_UFS_CFG2);
 
 	/* Ensure that HW clock gating is enabled before next operations */
-	mb();
+	ufshcd_readl(hba, REG_UFS_CFG2);
 }
 
 static int ufs_qcom_hce_enable_notify(struct ufs_hba *hba,
@@ -501,7 +578,7 @@
 		 * make sure above write gets applied before we return from
 		 * this function.
 		 */
-		mb();
+		ufshcd_readl(hba, REG_UFS_SYS1CLK_1US);
 	}
 
 	return 0;
@@ -738,8 +815,17 @@
 		 * the second init can program the optimal PHY settings. This allows one to start
 		 * the first init with either the minimum or the maximum support gear.
 		 */
-		if (hba->ufshcd_state == UFSHCD_STATE_RESET)
-			host->phy_gear = dev_req_params->gear_tx;
+		if (hba->ufshcd_state == UFSHCD_STATE_RESET) {
+			/*
+			 * Skip REINIT if the negotiated gear matches with the
+			 * initial phy_gear. Otherwise, update the phy_gear to
+			 * program the optimal gear setting during REINIT.
+			 */
+			if (host->phy_gear == dev_req_params->gear_tx)
+				hba->quirks &= ~UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH;
+			else
+				host->phy_gear = dev_req_params->gear_tx;
+		}
 
 		/* enable the device ref clock before changing to HS mode */
 		if (!ufshcd_is_hs_mode(&hba->pwr_info) &&
@@ -1196,8 +1282,10 @@
 
 	list_for_each_entry(clki, head, list) {
 		if (!IS_ERR_OR_NULL(clki->clk) &&
-			!strcmp(clki->name, "core_clk_unipro")) {
-			if (is_scale_up)
+		    !strcmp(clki->name, "core_clk_unipro")) {
+			if (!clki->max_freq)
+				cycles_in_1us = 150; /* default for backwards compatibility */
+			else if (is_scale_up)
 				cycles_in_1us = ceil(clki->max_freq, (1000 * 1000));
 			else
 				cycles_in_1us = ceil(clk_get_rate(clki->clk), (1000 * 1000));
@@ -1299,6 +1387,7 @@
 		err = ufshcd_uic_hibern8_enter(hba);
 		if (err)
 			return err;
+
 		if (scale_up)
 			err = ufs_qcom_clk_scale_up_pre_change(hba);
 		else
@@ -1314,6 +1403,8 @@
 		else
 			err = ufs_qcom_clk_scale_down_post_change(hba);
 
+		if (!err)
+			err = ufs_qcom_ice_scale_clk(host, scale_up);
 
 		if (err) {
 			ufshcd_uic_hibern8_exit(hba);
@@ -1524,7 +1615,7 @@
 	p->polling_ms = 60;
 	p->timer = DEVFREQ_TIMER_DELAYED;
 	d->upthreshold = 70;
-	d->downdifferential = 5;
+	d->downdifferential = 65;
 }
 #else
 static void ufs_qcom_config_scaling_param(struct ufs_hba *hba,
@@ -1534,13 +1625,6 @@
 }
 #endif
 
-static void ufs_qcom_reinit_notify(struct ufs_hba *hba)
-{
-	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
-
-	phy_power_off(host->generic_phy);
-}
-
 /* Resources */
 static const struct ufshcd_res_info ufs_res_info[RES_MAX] = {
 	{.name = "ufs_mem",},
@@ -1779,7 +1863,10 @@
 	.device_reset		= ufs_qcom_device_reset,
 	.config_scaling_param = ufs_qcom_config_scaling_param,
 	.program_key		= ufs_qcom_ice_program_key,
-	.reinit_notify		= ufs_qcom_reinit_notify,
+	.derive_sw_secret	= ufs_qcom_ice_derive_sw_secret,
+	.generate_key		= ufs_qcom_ice_generate_key,
+	.prepare_key		= ufs_qcom_ice_prepare_key,
+	.import_key		= ufs_qcom_ice_import_key,
 	.mcq_config_resource	= ufs_qcom_mcq_config_resource,
 	.get_hba_mac		= ufs_qcom_get_hba_mac,
 	.op_runtime_config	= ufs_qcom_op_runtime_config,
@@ -1815,10 +1902,11 @@
 static void ufs_qcom_remove(struct platform_device *pdev)
 {
 	struct ufs_hba *hba =  platform_get_drvdata(pdev);
+	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
 
-	pm_runtime_get_sync(&(pdev)->dev);
-	ufshcd_remove(hba);
-	platform_msi_domain_free_irqs(hba->dev);
+	ufshcd_pltfrm_remove(pdev);
+	if (host->esi_enabled)
+		platform_msi_domain_free_irqs(hba->dev);
 }
 
 static const struct of_device_id ufs_qcom_of_match[] __maybe_unused = {
--- linux-qcom-6.8.0.orig/drivers/ufs/host/ufs-qcom.h
+++ linux-qcom-6.8.0/drivers/ufs/host/ufs-qcom.h
@@ -151,10 +151,10 @@
 	ufshcd_rmwl(hba, UFS_PHY_SOFT_RESET, UFS_PHY_SOFT_RESET, REG_UFS_CFG1);
 
 	/*
-	 * Make sure assertion of ufs phy reset is written to
-	 * register before returning
+	 * Dummy read to ensure the write takes effect before doing any sort
+	 * of delay
 	 */
-	mb();
+	ufshcd_readl(hba, REG_UFS_CFG1);
 }
 
 static inline void ufs_qcom_deassert_reset(struct ufs_hba *hba)
@@ -162,10 +162,10 @@
 	ufshcd_rmwl(hba, UFS_PHY_SOFT_RESET, 0, REG_UFS_CFG1);
 
 	/*
-	 * Make sure de-assertion of ufs phy reset is written to
-	 * register before returning
+	 * Dummy read to ensure the write takes effect before doing any sort
+	 * of delay
 	 */
-	mb();
+	ufshcd_readl(hba, REG_UFS_CFG1);
 }
 
 /* Host controller hardware version: major.minor.step */
--- linux-qcom-6.8.0.orig/drivers/ufs/host/ufs-renesas.c
+++ linux-qcom-6.8.0/drivers/ufs/host/ufs-renesas.c
@@ -7,6 +7,7 @@
 
 #include <linux/clk.h>
 #include <linux/delay.h>
+#include <linux/dma-mapping.h>
 #include <linux/err.h>
 #include <linux/iopoll.h>
 #include <linux/kernel.h>
@@ -364,14 +365,20 @@
 		return -ENOMEM;
 	ufshcd_set_variant(hba, priv);
 
-	hba->quirks |= UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS | UFSHCD_QUIRK_HIBERN_FASTAUTO;
+	hba->quirks |= UFSHCD_QUIRK_HIBERN_FASTAUTO;
 
 	return 0;
 }
 
+static int ufs_renesas_set_dma_mask(struct ufs_hba *hba)
+{
+	return dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(32));
+}
+
 static const struct ufs_hba_variant_ops ufs_renesas_vops = {
 	.name		= "renesas",
 	.init		= ufs_renesas_init,
+	.set_dma_mask	= ufs_renesas_set_dma_mask,
 	.setup_clocks	= ufs_renesas_setup_clocks,
 	.hce_enable_notify = ufs_renesas_hce_enable_notify,
 	.dbg_register_dump = ufs_renesas_dbg_register_dump,
@@ -390,9 +397,7 @@
 
 static void ufs_renesas_remove(struct platform_device *pdev)
 {
-	struct ufs_hba *hba = platform_get_drvdata(pdev);
-
-	ufshcd_remove(hba);
+	ufshcd_pltfrm_remove(pdev);
 }
 
 static struct platform_driver ufs_renesas_platform = {
--- linux-qcom-6.8.0.orig/drivers/ufs/host/ufs-sprd.c
+++ linux-qcom-6.8.0/drivers/ufs/host/ufs-sprd.c
@@ -427,10 +427,7 @@
 
 static void ufs_sprd_remove(struct platform_device *pdev)
 {
-	struct ufs_hba *hba =  platform_get_drvdata(pdev);
-
-	pm_runtime_get_sync(&(pdev)->dev);
-	ufshcd_remove(hba);
+	ufshcd_pltfrm_remove(pdev);
 }
 
 static const struct dev_pm_ops ufs_sprd_pm_ops = {
--- linux-qcom-6.8.0.orig/drivers/ufs/host/ufshcd-pltfrm.c
+++ linux-qcom-6.8.0/drivers/ufs/host/ufshcd-pltfrm.c
@@ -528,6 +528,22 @@
 }
 EXPORT_SYMBOL_GPL(ufshcd_pltfrm_init);
 
+/**
+ * ufshcd_pltfrm_remove - Remove ufshcd platform
+ * @pdev: pointer to Platform device handle
+ */
+void ufshcd_pltfrm_remove(struct platform_device *pdev)
+{
+	struct ufs_hba *hba =  platform_get_drvdata(pdev);
+
+	pm_runtime_get_sync(&pdev->dev);
+	ufshcd_remove(hba);
+	ufshcd_dealloc_host(hba);
+	pm_runtime_disable(&pdev->dev);
+	pm_runtime_put_noidle(&pdev->dev);
+}
+EXPORT_SYMBOL_GPL(ufshcd_pltfrm_remove);
+
 MODULE_AUTHOR("Santosh Yaragnavi <santosh.sy@samsung.com>");
 MODULE_AUTHOR("Vinayak Holikatti <h.vinayak@samsung.com>");
 MODULE_DESCRIPTION("UFS host controller Platform bus based glue driver");
--- linux-qcom-6.8.0.orig/drivers/ufs/host/ufshcd-pltfrm.h
+++ linux-qcom-6.8.0/drivers/ufs/host/ufshcd-pltfrm.h
@@ -31,6 +31,7 @@
 void ufshcd_init_host_params(struct ufs_host_params *host_params);
 int ufshcd_pltfrm_init(struct platform_device *pdev,
 		       const struct ufs_hba_variant_ops *vops);
+void ufshcd_pltfrm_remove(struct platform_device *pdev);
 int ufshcd_populate_vreg(struct device *dev, const char *name,
 			 struct ufs_vreg **out_vreg, bool skip_current);
 
--- linux-qcom-6.8.0.orig/drivers/uio/uio_hv_generic.c
+++ linux-qcom-6.8.0/drivers/uio/uio_hv_generic.c
@@ -104,10 +104,11 @@
 
 /*
  * Callback from vmbus_event when channel is rescinded.
+ * It is meant for rescind of primary channels only.
  */
 static void hv_uio_rescind(struct vmbus_channel *channel)
 {
-	struct hv_device *hv_dev = channel->primary_channel->device_obj;
+	struct hv_device *hv_dev = channel->device_obj;
 	struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
 
 	/*
@@ -118,6 +119,14 @@
 
 	/* Wake up reader */
 	uio_event_notify(&pdata->info);
+
+	/*
+	 * With rescind callback registered, rescind path will not unregister the device
+	 * from vmbus when the primary channel is rescinded.
+	 * Without it, rescind handling is incomplete and next onoffer msg does not come.
+	 * Unregister the device from vmbus here.
+	 */
+	vmbus_device_unregister(channel->device_obj);
 }
 
 /* Sysfs API to allow mmap of the ring buffers
@@ -181,12 +190,14 @@
 {
 	if (pdata->send_gpadl.gpadl_handle) {
 		vmbus_teardown_gpadl(dev->channel, &pdata->send_gpadl);
-		vfree(pdata->send_buf);
+		if (!pdata->send_gpadl.decrypted)
+			vfree(pdata->send_buf);
 	}
 
 	if (pdata->recv_gpadl.gpadl_handle) {
 		vmbus_teardown_gpadl(dev->channel, &pdata->recv_gpadl);
-		vfree(pdata->recv_buf);
+		if (!pdata->recv_gpadl.decrypted)
+			vfree(pdata->recv_buf);
 	}
 }
 
@@ -295,7 +306,8 @@
 	ret = vmbus_establish_gpadl(channel, pdata->recv_buf,
 				    RECV_BUFFER_SIZE, &pdata->recv_gpadl);
 	if (ret) {
-		vfree(pdata->recv_buf);
+		if (!pdata->recv_gpadl.decrypted)
+			vfree(pdata->recv_buf);
 		goto fail_close;
 	}
 
@@ -317,7 +329,8 @@
 	ret = vmbus_establish_gpadl(channel, pdata->send_buf,
 				    SEND_BUFFER_SIZE, &pdata->send_gpadl);
 	if (ret) {
-		vfree(pdata->send_buf);
+		if (!pdata->send_gpadl.decrypted)
+			vfree(pdata->send_buf);
 		goto fail_close;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/usb/Makefile
+++ linux-qcom-6.8.0/drivers/usb/Makefile
@@ -35,6 +35,7 @@
 obj-$(CONFIG_USB_FSL_USB2)	+= host/
 obj-$(CONFIG_USB_FOTG210_HCD)	+= host/
 obj-$(CONFIG_USB_MAX3421_HCD)	+= host/
+obj-$(CONFIG_USB_XEN_HCD)	+= host/
 
 obj-$(CONFIG_USB_C67X00_HCD)	+= c67x00/
 
--- linux-qcom-6.8.0.orig/drivers/usb/atm/cxacru.c
+++ linux-qcom-6.8.0/drivers/usb/atm/cxacru.c
@@ -1131,6 +1131,7 @@
 	struct cxacru_data *instance;
 	struct usb_device *usb_dev = interface_to_usbdev(intf);
 	struct usb_host_endpoint *cmd_ep = usb_dev->ep_in[CXACRU_EP_CMD];
+	struct usb_endpoint_descriptor *in, *out;
 	int ret;
 
 	/* instance init */
@@ -1176,6 +1177,19 @@
 		ret = -ENODEV;
 		goto fail;
 	}
+
+	if (usb_endpoint_xfer_int(&cmd_ep->desc))
+		ret = usb_find_common_endpoints(intf->cur_altsetting,
+						NULL, NULL, &in, &out);
+	else
+		ret = usb_find_common_endpoints(intf->cur_altsetting,
+						&in, &out, NULL, NULL);
+
+	if (ret) {
+		usb_err(usbatm_instance, "cxacru_bind: interface has incorrect endpoints\n");
+		ret = -ENODEV;
+		goto fail;
+	}
 
 	if ((cmd_ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
 			== USB_ENDPOINT_XFER_INT) {
--- linux-qcom-6.8.0.orig/drivers/usb/cdns3/cdns3-ti.c
+++ linux-qcom-6.8.0/drivers/usb/cdns3/cdns3-ti.c
@@ -16,6 +16,7 @@
 #include <linux/of_platform.h>
 #include <linux/pm_runtime.h>
 #include <linux/property.h>
+#include "core.h"
 
 /* USB Wrapper register offsets */
 #define USBSS_PID		0x0
@@ -85,6 +86,18 @@
 	writel(value, data->usbss + offset);
 }
 
+static struct cdns3_platform_data cdns_ti_pdata = {
+	.quirks = CDNS3_DRD_SUSPEND_RESIDENCY_ENABLE,   /* Errata i2409 */
+};
+
+static const struct of_dev_auxdata cdns_ti_auxdata[] = {
+	{
+		.compatible = "cdns,usb3",
+		.platform_data = &cdns_ti_pdata,
+	},
+	{},
+};
+
 static int cdns_ti_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -176,7 +189,7 @@
 	reg |= USBSS_W1_PWRUP_RST;
 	cdns_ti_writel(data, USBSS_W1, reg);
 
-	error = of_platform_populate(node, NULL, NULL, dev);
+	error = of_platform_populate(node, NULL, cdns_ti_auxdata, dev);
 	if (error) {
 		dev_err(dev, "failed to create children: %d\n", error);
 		goto err;
--- linux-qcom-6.8.0.orig/drivers/usb/cdns3/cdnsp-gadget.h
+++ linux-qcom-6.8.0/drivers/usb/cdns3/cdnsp-gadget.h
@@ -811,6 +811,7 @@
  *        generate Missed Service Error Event.
  *        Set skip flag when receive a Missed Service Error Event and
  *        process the missed tds on the endpoint ring.
+ * @wa1_nop_trb: hold pointer to NOP trb.
  */
 struct cdnsp_ep {
 	struct usb_ep endpoint;
@@ -838,6 +839,8 @@
 #define EP_UNCONFIGURED		BIT(7)
 
 	bool skip;
+	union cdnsp_trb	 *wa1_nop_trb;
+
 };
 
 /**
--- linux-qcom-6.8.0.orig/drivers/usb/cdns3/cdnsp-ring.c
+++ linux-qcom-6.8.0/drivers/usb/cdns3/cdnsp-ring.c
@@ -402,7 +402,7 @@
 	struct cdnsp_stream_ctx *st_ctx;
 	struct cdnsp_ep *pep;
 
-	pep = &pdev->eps[stream_id];
+	pep = &pdev->eps[ep_index];
 
 	if (pep->ep_state & EP_HAS_STREAMS) {
 		st_ctx = &pep->stream_info.stream_ctx_array[stream_id];
@@ -718,7 +718,8 @@
 	seg = cdnsp_trb_in_td(pdev, cur_td->start_seg, cur_td->first_trb,
 			      cur_td->last_trb, hw_deq);
 
-	if (seg && (pep->ep_state & EP_ENABLED))
+	if (seg && (pep->ep_state & EP_ENABLED) &&
+	    !(pep->ep_state & EP_DIS_IN_RROGRESS))
 		cdnsp_find_new_dequeue_state(pdev, pep, preq->request.stream_id,
 					     cur_td, &deq_state);
 	else
@@ -736,7 +737,8 @@
 	 * During disconnecting all endpoint will be disabled so we don't
 	 * have to worry about updating dequeue pointer.
 	 */
-	if (pdev->cdnsp_state & CDNSP_STATE_DISCONNECT_PENDING) {
+	if (pdev->cdnsp_state & CDNSP_STATE_DISCONNECT_PENDING ||
+	    pep->ep_state & EP_DIS_IN_RROGRESS) {
 		status = -ESHUTDOWN;
 		ret = cdnsp_cmd_set_deq(pdev, pep, &deq_state);
 	}
@@ -1905,6 +1907,23 @@
 		return ret;
 
 	/*
+	 * workaround 1: STOP EP command on LINK TRB with TC bit set to 1
+	 * causes that internal cycle bit can have incorrect state after
+	 * command complete. In consequence empty transfer ring can be
+	 * incorrectly detected when EP is resumed.
+	 * NOP TRB before LINK TRB avoid such scenario. STOP EP command is
+	 * then on NOP TRB and internal cycle bit is not changed and have
+	 * correct value.
+	 */
+	if (pep->wa1_nop_trb) {
+		field = le32_to_cpu(pep->wa1_nop_trb->trans_event.flags);
+		field ^= TRB_CYCLE;
+
+		pep->wa1_nop_trb->trans_event.flags = cpu_to_le32(field);
+		pep->wa1_nop_trb = NULL;
+	}
+
+	/*
 	 * Don't give the first TRB to the hardware (by toggling the cycle bit)
 	 * until we've finished creating all the other TRBs. The ring's cycle
 	 * state may change as we enqueue the other TRBs, so save it too.
@@ -1999,6 +2018,17 @@
 		send_addr = addr;
 	}
 
+	if (cdnsp_trb_is_link(ring->enqueue + 1)) {
+		field = TRB_TYPE(TRB_TR_NOOP) | TRB_IOC;
+		if (!ring->cycle_state)
+			field |= TRB_CYCLE;
+
+		pep->wa1_nop_trb = ring->enqueue;
+
+		cdnsp_queue_trb(pdev, ring, 0, 0x0, 0x0,
+				TRB_INTR_TARGET(0), field);
+	}
+
 	cdnsp_check_trb_math(preq, enqd_len);
 	ret = cdnsp_giveback_first_trb(pdev, pep, preq->request.stream_id,
 				       start_cycle, start_trb);
--- linux-qcom-6.8.0.orig/drivers/usb/cdns3/core.h
+++ linux-qcom-6.8.0/drivers/usb/cdns3/core.h
@@ -44,6 +44,7 @@
 			bool suspend, bool wakeup);
 	unsigned long quirks;
 #define CDNS3_DEFAULT_PM_RUNTIME_ALLOW	BIT(0)
+#define CDNS3_DRD_SUSPEND_RESIDENCY_ENABLE	BIT(1)
 };
 
 /**
--- linux-qcom-6.8.0.orig/drivers/usb/cdns3/drd.c
+++ linux-qcom-6.8.0/drivers/usb/cdns3/drd.c
@@ -389,7 +389,7 @@
 int cdns_drd_init(struct cdns *cdns)
 {
 	void __iomem *regs;
-	u32 state;
+	u32 state, reg;
 	int ret;
 
 	regs = devm_ioremap_resource(cdns->dev, &cdns->otg_res);
@@ -433,6 +433,14 @@
 			cdns->otg_irq_regs = (struct cdns_otg_irq_regs __iomem *)
 					      &cdns->otg_v1_regs->ien;
 			writel(1, &cdns->otg_v1_regs->simulate);
+
+			if (cdns->pdata &&
+			    (cdns->pdata->quirks & CDNS3_DRD_SUSPEND_RESIDENCY_ENABLE)) {
+				reg = readl(&cdns->otg_v1_regs->susp_ctrl);
+				reg |= SUSP_CTRL_SUSPEND_RESIDENCY_ENABLE;
+				writel(reg, &cdns->otg_v1_regs->susp_ctrl);
+			}
+
 			cdns->version  = CDNS3_CONTROLLER_V1;
 		} else {
 			dev_err(cdns->dev, "not supporte DID=0x%08x\n", state);
--- linux-qcom-6.8.0.orig/drivers/usb/cdns3/drd.h
+++ linux-qcom-6.8.0/drivers/usb/cdns3/drd.h
@@ -193,6 +193,9 @@
 /* OTGREFCLK - bitmasks */
 #define OTGREFCLK_STB_CLK_SWITCH_EN	BIT(31)
 
+/* SUPS_CTRL - bitmasks */
+#define SUSP_CTRL_SUSPEND_RESIDENCY_ENABLE	BIT(17)
+
 /* OVERRIDE - bitmasks */
 #define OVERRIDE_IDPULLUP		BIT(0)
 /* Only for CDNS3_CONTROLLER_V0 version */
--- linux-qcom-6.8.0.orig/drivers/usb/cdns3/host.c
+++ linux-qcom-6.8.0/drivers/usb/cdns3/host.c
@@ -62,7 +62,9 @@
 	.resume_quirk = xhci_cdns3_resume_quirk,
 };
 
-static const struct xhci_plat_priv xhci_plat_cdnsp_xhci;
+static const struct xhci_plat_priv xhci_plat_cdnsp_xhci = {
+	.quirks = XHCI_CDNS_SCTX_QUIRK,
+};
 
 static int __cdns_host_init(struct cdns *cdns)
 {
--- linux-qcom-6.8.0.orig/drivers/usb/chipidea/ci.h
+++ linux-qcom-6.8.0/drivers/usb/chipidea/ci.h
@@ -25,6 +25,7 @@
 #define TD_PAGE_COUNT      5
 #define CI_HDRC_PAGE_SIZE  4096ul /* page size for TD's */
 #define ENDPT_MAX          32
+#define CI_MAX_REQ_SIZE	(4 * CI_HDRC_PAGE_SIZE)
 #define CI_MAX_BUF_SIZE	(TD_PAGE_COUNT * CI_HDRC_PAGE_SIZE)
 
 /******************************************************************************
@@ -260,6 +261,7 @@
 	bool				b_sess_valid_event;
 	bool				imx28_write_fix;
 	bool				has_portsc_pec_bug;
+	bool				has_short_pkt_limit;
 	bool				supports_runtime_pm;
 	bool				in_lpm;
 	bool				wakeup_int;
--- linux-qcom-6.8.0.orig/drivers/usb/chipidea/ci_hdrc_imx.c
+++ linux-qcom-6.8.0/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -342,6 +342,7 @@
 	struct ci_hdrc_platform_data pdata = {
 		.name		= dev_name(&pdev->dev),
 		.capoffset	= DEF_CAPOFFSET,
+		.flags		= CI_HDRC_HAS_SHORT_PKT_LIMIT,
 		.notify_event	= ci_hdrc_imx_notify_event,
 	};
 	int ret;
@@ -369,25 +370,29 @@
 		data->pinctrl = devm_pinctrl_get(dev);
 		if (PTR_ERR(data->pinctrl) == -ENODEV)
 			data->pinctrl = NULL;
-		else if (IS_ERR(data->pinctrl))
-			return dev_err_probe(dev, PTR_ERR(data->pinctrl),
+		else if (IS_ERR(data->pinctrl)) {
+			ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),
 					     "pinctrl get failed\n");
+			goto err_put;
+		}
 
 		data->hsic_pad_regulator =
 				devm_regulator_get_optional(dev, "hsic");
 		if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) {
 			/* no pad regulator is needed */
 			data->hsic_pad_regulator = NULL;
-		} else if (IS_ERR(data->hsic_pad_regulator))
-			return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
+		} else if (IS_ERR(data->hsic_pad_regulator)) {
+			ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
 					     "Get HSIC pad regulator error\n");
+			goto err_put;
+		}
 
 		if (data->hsic_pad_regulator) {
 			ret = regulator_enable(data->hsic_pad_regulator);
 			if (ret) {
 				dev_err(dev,
 					"Failed to enable HSIC pad regulator\n");
-				return ret;
+				goto err_put;
 			}
 		}
 	}
@@ -401,13 +406,14 @@
 			dev_err(dev,
 				"pinctrl_hsic_idle lookup failed, err=%ld\n",
 					PTR_ERR(pinctrl_hsic_idle));
-			return PTR_ERR(pinctrl_hsic_idle);
+			ret = PTR_ERR(pinctrl_hsic_idle);
+			goto err_put;
 		}
 
 		ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle);
 		if (ret) {
 			dev_err(dev, "hsic_idle select failed, err=%d\n", ret);
-			return ret;
+			goto err_put;
 		}
 
 		data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl,
@@ -416,7 +422,8 @@
 			dev_err(dev,
 				"pinctrl_hsic_active lookup failed, err=%ld\n",
 					PTR_ERR(data->pinctrl_hsic_active));
-			return PTR_ERR(data->pinctrl_hsic_active);
+			ret = PTR_ERR(data->pinctrl_hsic_active);
+			goto err_put;
 		}
 	}
 
@@ -526,6 +533,8 @@
 	if (pdata.flags & CI_HDRC_PMQOS)
 		cpu_latency_qos_remove_request(&data->pm_qos_req);
 	data->ci_pdev = NULL;
+err_put:
+	put_device(data->usbmisc_data->dev);
 	return ret;
 }
 
@@ -550,6 +559,7 @@
 		if (data->hsic_pad_regulator)
 			regulator_disable(data->hsic_pad_regulator);
 	}
+	put_device(data->usbmisc_data->dev);
 }
 
 static void ci_hdrc_imx_shutdown(struct platform_device *pdev)
--- linux-qcom-6.8.0.orig/drivers/usb/chipidea/core.c
+++ linux-qcom-6.8.0/drivers/usb/chipidea/core.c
@@ -1076,6 +1076,8 @@
 		CI_HDRC_SUPPORTS_RUNTIME_PM);
 	ci->has_portsc_pec_bug = !!(ci->platdata->flags &
 		CI_HDRC_HAS_PORTSC_PEC_MISSED);
+	ci->has_short_pkt_limit = !!(ci->platdata->flags &
+		CI_HDRC_HAS_SHORT_PKT_LIMIT);
 	platform_set_drvdata(pdev, ci);
 
 	ret = hw_device_init(ci, base);
--- linux-qcom-6.8.0.orig/drivers/usb/chipidea/udc.c
+++ linux-qcom-6.8.0/drivers/usb/chipidea/udc.c
@@ -10,6 +10,7 @@
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/dmapool.h>
+#include <linux/dma-direct.h>
 #include <linux/err.h>
 #include <linux/irqreturn.h>
 #include <linux/kernel.h>
@@ -86,7 +87,7 @@
 		hw_write(ci, OP_ENDPTLISTADDR, ~0, dma);
 		/* interrupt, error, port change, reset, sleep/suspend */
 		hw_write(ci, OP_USBINTR, ~0,
-			     USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI);
+			     USBi_UI|USBi_UEI|USBi_PCI|USBi_URI);
 	} else {
 		hw_write(ci, OP_USBINTR, ~0, 0);
 	}
@@ -540,6 +541,126 @@
 	return ret;
 }
 
+/*
+ * Verify if the scatterlist is valid by iterating each sg entry.
+ * Return invalid sg entry index which is less than num_sgs.
+ */
+static int sglist_get_invalid_entry(struct device *dma_dev, u8 dir,
+			struct usb_request *req)
+{
+	int i;
+	struct scatterlist *s = req->sg;
+
+	if (req->num_sgs == 1)
+		return 1;
+
+	dir = dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
+
+	for (i = 0; i < req->num_sgs; i++, s = sg_next(s)) {
+		/* Only small sg (generally last sg) may be bounced. If
+		 * that happens. we can't ensure the addr is page-aligned
+		 * after dma map.
+		 */
+		if (dma_kmalloc_needs_bounce(dma_dev, s->length, dir))
+			break;
+
+		/* Make sure each sg start address (except first sg) is
+		 * page-aligned and end address (except last sg) is also
+		 * page-aligned.
+		 */
+		if (i == 0) {
+			if (!IS_ALIGNED(s->offset + s->length,
+						CI_HDRC_PAGE_SIZE))
+				break;
+		} else {
+			if (s->offset)
+				break;
+			if (!sg_is_last(s) && !IS_ALIGNED(s->length,
+						CI_HDRC_PAGE_SIZE))
+				break;
+		}
+	}
+
+	return i;
+}
+
+static int sglist_do_bounce(struct ci_hw_req *hwreq, int index,
+			bool copy, unsigned int *bounced)
+{
+	void *buf;
+	int i, ret, nents, num_sgs;
+	unsigned int rest, rounded;
+	struct scatterlist *sg, *src, *dst;
+
+	nents = index + 1;
+	ret = sg_alloc_table(&hwreq->sgt, nents, GFP_KERNEL);
+	if (ret)
+		return ret;
+
+	sg = src = hwreq->req.sg;
+	num_sgs = hwreq->req.num_sgs;
+	rest = hwreq->req.length;
+	dst = hwreq->sgt.sgl;
+
+	for (i = 0; i < index; i++) {
+		memcpy(dst, src, sizeof(*src));
+		rest -= src->length;
+		src = sg_next(src);
+		dst = sg_next(dst);
+	}
+
+	/* create one bounce buffer */
+	rounded = round_up(rest, CI_HDRC_PAGE_SIZE);
+	buf = kmalloc(rounded, GFP_KERNEL);
+	if (!buf) {
+		sg_free_table(&hwreq->sgt);
+		return -ENOMEM;
+	}
+
+	sg_set_buf(dst, buf, rounded);
+
+	hwreq->req.sg = hwreq->sgt.sgl;
+	hwreq->req.num_sgs = nents;
+	hwreq->sgt.sgl = sg;
+	hwreq->sgt.nents = num_sgs;
+
+	if (copy)
+		sg_copy_to_buffer(src, num_sgs - index, buf, rest);
+
+	*bounced = rest;
+
+	return 0;
+}
+
+static void sglist_do_debounce(struct ci_hw_req *hwreq, bool copy)
+{
+	void *buf;
+	int i, nents, num_sgs;
+	struct scatterlist *sg, *src, *dst;
+
+	sg = hwreq->req.sg;
+	num_sgs = hwreq->req.num_sgs;
+	src = sg_last(sg, num_sgs);
+	buf = sg_virt(src);
+
+	if (copy) {
+		dst = hwreq->sgt.sgl;
+		for (i = 0; i < num_sgs - 1; i++)
+			dst = sg_next(dst);
+
+		nents = hwreq->sgt.nents - num_sgs + 1;
+		sg_copy_from_buffer(dst, nents, buf, sg_dma_len(src));
+	}
+
+	hwreq->req.sg = hwreq->sgt.sgl;
+	hwreq->req.num_sgs = hwreq->sgt.nents;
+	hwreq->sgt.sgl = sg;
+	hwreq->sgt.nents = num_sgs;
+
+	kfree(buf);
+	sg_free_table(&hwreq->sgt);
+}
+
 /**
  * _hardware_enqueue: configures a request at hardware level
  * @hwep:   endpoint
@@ -552,6 +673,8 @@
 	struct ci_hdrc *ci = hwep->ci;
 	int ret = 0;
 	struct td_node *firstnode, *lastnode;
+	unsigned int bounced_size;
+	struct scatterlist *sg;
 
 	/* don't queue twice */
 	if (hwreq->req.status == -EALREADY)
@@ -559,11 +682,29 @@
 
 	hwreq->req.status = -EALREADY;
 
+	if (hwreq->req.num_sgs && hwreq->req.length &&
+		ci->has_short_pkt_limit) {
+		ret = sglist_get_invalid_entry(ci->dev->parent, hwep->dir,
+					&hwreq->req);
+		if (ret < hwreq->req.num_sgs) {
+			ret = sglist_do_bounce(hwreq, ret, hwep->dir == TX,
+					&bounced_size);
+			if (ret)
+				return ret;
+		}
+	}
+
 	ret = usb_gadget_map_request_by_dev(ci->dev->parent,
 					    &hwreq->req, hwep->dir);
 	if (ret)
 		return ret;
 
+	if (hwreq->sgt.sgl) {
+		/* We've mapped a bigger buffer, now recover the actual size */
+		sg = sg_last(hwreq->req.sg, hwreq->req.num_sgs);
+		sg_dma_len(sg) = min(sg_dma_len(sg), bounced_size);
+	}
+
 	if (hwreq->req.num_mapped_sgs)
 		ret = prepare_td_for_sg(hwep, hwreq);
 	else
@@ -733,6 +874,10 @@
 	usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent,
 					&hwreq->req, hwep->dir);
 
+	/* sglist bounced */
+	if (hwreq->sgt.sgl)
+		sglist_do_debounce(hwreq, hwep->dir == RX);
+
 	hwreq->req.actual += actual;
 
 	if (hwreq->req.status)
@@ -877,6 +1022,7 @@
 __acquires(ci->lock)
 {
 	int retval;
+	u32 intr;
 
 	spin_unlock(&ci->lock);
 	if (ci->gadget.speed != USB_SPEED_UNKNOWN)
@@ -890,6 +1036,11 @@
 	if (retval)
 		goto done;
 
+	/* clear SLI */
+	hw_write(ci, OP_USBSTS, USBi_SLI, USBi_SLI);
+	intr = hw_read(ci, OP_USBINTR, ~0);
+	hw_write(ci, OP_USBINTR, ~0, intr | USBi_SLI);
+
 	ci->status = usb_ep_alloc_request(&ci->ep0in->ep, GFP_ATOMIC);
 	if (ci->status == NULL)
 		retval = -ENOMEM;
@@ -954,6 +1105,12 @@
 		return -EMSGSIZE;
 	}
 
+	if (ci->has_short_pkt_limit &&
+		hwreq->req.length > CI_MAX_REQ_SIZE) {
+		dev_err(hwep->ci->dev, "request length too big (max 16KB)\n");
+		return -EMSGSIZE;
+	}
+
 	/* first nuke then test link, e.g. previous status has not sent */
 	if (!list_empty(&hwreq->queue)) {
 		dev_err(hwep->ci->dev, "request already in queue\n");
@@ -1568,6 +1725,9 @@
 
 	usb_gadget_unmap_request(&hwep->ci->gadget, req, hwep->dir);
 
+	if (hwreq->sgt.sgl)
+		sglist_do_debounce(hwreq, false);
+
 	req->status = -ECONNRESET;
 
 	if (hwreq->req.complete != NULL) {
@@ -2057,7 +2217,7 @@
 			}
 		}
 
-		if (USBi_UI  & intr)
+		if ((USBi_UI | USBi_UEI) & intr)
 			isr_tr_complete_handler(ci);
 
 		if ((USBi_SLI & intr) && !(ci->suspended)) {
--- linux-qcom-6.8.0.orig/drivers/usb/chipidea/udc.h
+++ linux-qcom-6.8.0/drivers/usb/chipidea/udc.h
@@ -69,11 +69,13 @@
  * @req: request structure for gadget drivers
  * @queue: link to QH list
  * @tds: link to TD list
+ * @sgt: hold original sglist when bounce sglist
  */
 struct ci_hw_req {
 	struct usb_request	req;
 	struct list_head	queue;
 	struct list_head	tds;
+	struct sg_table		sgt;
 };
 
 #ifdef CONFIG_USB_CHIPIDEA_UDC
--- linux-qcom-6.8.0.orig/drivers/usb/class/cdc-acm.c
+++ linux-qcom-6.8.0/drivers/usb/class/cdc-acm.c
@@ -962,10 +962,12 @@
 	struct acm *acm = tty->driver_data;
 
 	ss->line = acm->minor;
+	mutex_lock(&acm->port.mutex);
 	ss->close_delay	= jiffies_to_msecs(acm->port.close_delay) / 10;
 	ss->closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
 				ASYNC_CLOSING_WAIT_NONE :
 				jiffies_to_msecs(acm->port.closing_wait) / 10;
+	mutex_unlock(&acm->port.mutex);
 	return 0;
 }
 
@@ -1761,6 +1763,9 @@
 	{ USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */
 	.driver_info = SINGLE_RX_URB,
 	},
+	{ USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */
+	.driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
+	},
 	{ USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */
 	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
 	},
@@ -1987,6 +1992,20 @@
 	.driver_info = IGNORE_DEVICE,
 	},
 
+	/* Exclude Exar USB serial ports */
+	{ USB_DEVICE(0x04e2, 0x1400), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1401), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1402), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1403), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1410), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1411), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1412), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1414), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1420), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1421), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1422), .driver_info = IGNORE_DEVICE, },
+	{ USB_DEVICE(0x04e2, 0x1424), .driver_info = IGNORE_DEVICE, },
+
 	/* control interfaces without any protocol set */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_PROTO_NONE) },
--- linux-qcom-6.8.0.orig/drivers/usb/class/cdc-wdm.c
+++ linux-qcom-6.8.0/drivers/usb/class/cdc-wdm.c
@@ -266,14 +266,14 @@
 			dev_err(&desc->intf->dev, "Stall on int endpoint\n");
 			goto sw; /* halt is cleared in work */
 		default:
-			dev_err(&desc->intf->dev,
+			dev_err_ratelimited(&desc->intf->dev,
 				"nonzero urb status received: %d\n", status);
 			break;
 		}
 	}
 
 	if (urb->actual_length < sizeof(struct usb_cdc_notification)) {
-		dev_err(&desc->intf->dev, "wdm_int_callback - %d bytes\n",
+		dev_err_ratelimited(&desc->intf->dev, "wdm_int_callback - %d bytes\n",
 			urb->actual_length);
 		goto exit;
 	}
--- linux-qcom-6.8.0.orig/drivers/usb/class/usblp.c
+++ linux-qcom-6.8.0/drivers/usb/class/usblp.c
@@ -1337,11 +1337,12 @@
 	if (protocol < USBLP_FIRST_PROTOCOL || protocol > USBLP_LAST_PROTOCOL)
 		return -EINVAL;
 
+	alts = usblp->protocol[protocol].alt_setting;
+	if (alts < 0)
+		return -EINVAL;
+
 	/* Don't unnecessarily set the interface if there's a single alt. */
 	if (usblp->intf->num_altsetting > 1) {
-		alts = usblp->protocol[protocol].alt_setting;
-		if (alts < 0)
-			return -EINVAL;
 		r = usb_set_interface(usblp->dev, usblp->ifnum, alts);
 		if (r < 0) {
 			printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n",
--- linux-qcom-6.8.0.orig/drivers/usb/class/usbtmc.c
+++ linux-qcom-6.8.0/drivers/usb/class/usbtmc.c
@@ -754,7 +754,7 @@
 	if (!urb)
 		return NULL;
 
-	dmabuf = kmalloc(bufsize, GFP_KERNEL);
+	dmabuf = kzalloc(bufsize, GFP_KERNEL);
 	if (!dmabuf) {
 		usb_free_urb(urb);
 		return NULL;
--- linux-qcom-6.8.0.orig/drivers/usb/core/config.c
+++ linux-qcom-6.8.0/drivers/usb/core/config.c
@@ -291,6 +291,20 @@
 	if (ifp->desc.bNumEndpoints >= num_ep)
 		goto skip_to_next_endpoint_or_interface_descriptor;
 
+	/* Save a copy of the descriptor and use it instead of the original */
+	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
+	memcpy(&endpoint->desc, d, n);
+	d = &endpoint->desc;
+
+	/* Clear the reserved bits in bEndpointAddress */
+	i = d->bEndpointAddress &
+			(USB_ENDPOINT_DIR_MASK | USB_ENDPOINT_NUMBER_MASK);
+	if (i != d->bEndpointAddress) {
+		dev_notice(ddev, "config %d interface %d altsetting %d has an endpoint descriptor with address 0x%X, changing to 0x%X\n",
+		    cfgno, inum, asnum, d->bEndpointAddress, i);
+		endpoint->desc.bEndpointAddress = i;
+	}
+
 	/* Check for duplicate endpoint addresses */
 	if (config_endpoint_is_duplicate(config, inum, asnum, d)) {
 		dev_notice(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
@@ -308,10 +322,8 @@
 		}
 	}
 
-	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
+	/* Accept this endpoint */
 	++ifp->desc.bNumEndpoints;
-
-	memcpy(&endpoint->desc, d, n);
 	INIT_LIST_HEAD(&endpoint->urb_list);
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/usb/core/hcd.c
+++ linux-qcom-6.8.0/drivers/usb/core/hcd.c
@@ -1625,6 +1625,7 @@
 	struct usb_hcd *hcd = bus_to_hcd(urb->dev->bus);
 	struct usb_anchor *anchor = urb->anchor;
 	int status = urb->unlinked;
+	unsigned long flags;
 
 	urb->hcpriv = NULL;
 	if (unlikely((urb->transfer_flags & URB_SHORT_NOT_OK) &&
@@ -1642,13 +1643,14 @@
 	/* pass ownership to the completion handler */
 	urb->status = status;
 	/*
-	 * This function can be called in task context inside another remote
-	 * coverage collection section, but kcov doesn't support that kind of
-	 * recursion yet. Only collect coverage in softirq context for now.
+	 * Only collect coverage in the softirq context and disable interrupts
+	 * to avoid scenarios with nested remote coverage collection sections
+	 * that KCOV does not support.
+	 * See the comment next to kcov_remote_start_usb_softirq() for details.
 	 */
-	kcov_remote_start_usb_softirq((u64)urb->dev->bus->busnum);
+	flags = kcov_remote_start_usb_softirq((u64)urb->dev->bus->busnum);
 	urb->complete(urb);
-	kcov_remote_stop_softirq();
+	kcov_remote_stop_softirq(flags);
 
 	usb_anchor_resume_wakeups(anchor);
 	atomic_dec(&urb->use_count);
--- linux-qcom-6.8.0.orig/drivers/usb/core/hub.c
+++ linux-qcom-6.8.0/drivers/usb/core/hub.c
@@ -129,7 +129,6 @@
 #define HUB_DEBOUNCE_STEP	  25
 #define HUB_DEBOUNCE_STABLE	 100
 
-static void hub_release(struct kref *kref);
 static int usb_reset_and_verify_device(struct usb_device *udev);
 static int hub_port_disable(struct usb_hub *hub, int port1, int set_state);
 static bool hub_port_warm_reset_required(struct usb_hub *hub, int port1,
@@ -691,14 +690,14 @@
 	 */
 	intf = to_usb_interface(hub->intfdev);
 	usb_autopm_get_interface_no_resume(intf);
-	kref_get(&hub->kref);
+	hub_get(hub);
 
 	if (queue_work(hub_wq, &hub->events))
 		return;
 
 	/* the work has already been scheduled */
 	usb_autopm_put_interface_async(intf);
-	kref_put(&hub->kref, hub_release);
+	hub_put(hub);
 }
 
 void usb_kick_hub_wq(struct usb_device *hdev)
@@ -1066,7 +1065,7 @@
 			goto init2;
 		goto init3;
 	}
-	kref_get(&hub->kref);
+	hub_get(hub);
 
 	/* The superspeed hub except for root hub has to use Hub Depth
 	 * value as an offset into the route string to locate the bits
@@ -1314,7 +1313,7 @@
 		device_unlock(&hdev->dev);
 	}
 
-	kref_put(&hub->kref, hub_release);
+	hub_put(hub);
 }
 
 /* Implement the continuations for the delays above */
@@ -1730,6 +1729,16 @@
 	kfree(hub);
 }
 
+void hub_get(struct usb_hub *hub)
+{
+	kref_get(&hub->kref);
+}
+
+void hub_put(struct usb_hub *hub)
+{
+	kref_put(&hub->kref, hub_release);
+}
+
 static unsigned highspeed_hubs;
 
 static void hub_disconnect(struct usb_interface *intf)
@@ -1778,7 +1787,7 @@
 
 	onboard_hub_destroy_pdevs(&hub->onboard_hub_devs);
 
-	kref_put(&hub->kref, hub_release);
+	hub_put(hub);
 }
 
 static bool hub_descriptor_is_sane(struct usb_host_interface *desc)
@@ -2626,13 +2635,13 @@
 		err = sysfs_create_link(&udev->dev.kobj,
 				&port_dev->dev.kobj, "port");
 		if (err)
-			goto fail;
+			goto out_del_dev;
 
 		err = sysfs_create_link(&port_dev->dev.kobj,
 				&udev->dev.kobj, "device");
 		if (err) {
 			sysfs_remove_link(&udev->dev.kobj, "port");
-			goto fail;
+			goto out_del_dev;
 		}
 
 		if (!test_and_set_bit(port1, hub->child_usage_bits))
@@ -2646,6 +2655,8 @@
 	pm_runtime_put_sync_autosuspend(&udev->dev);
 	return err;
 
+out_del_dev:
+	device_del(&udev->dev);
 fail:
 	usb_set_device_state(udev, USB_STATE_NOTATTACHED);
 	pm_runtime_disable(&udev->dev);
@@ -5072,9 +5083,10 @@
 	}
 	if (usb_endpoint_maxp(&udev->ep0.desc) == i) {
 		;	/* Initial ep0 maxpacket guess is right */
-	} else if ((udev->speed == USB_SPEED_FULL ||
+	} else if (((udev->speed == USB_SPEED_FULL ||
 				udev->speed == USB_SPEED_HIGH) &&
-			(i == 8 || i == 16 || i == 32 || i == 64)) {
+			(i == 8 || i == 16 || i == 32 || i == 64)) ||
+			(udev->speed >= USB_SPEED_SUPER && i > 0)) {
 		/* Initial guess is wrong; use the descriptor's value */
 		if (udev->speed == USB_SPEED_FULL)
 			dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
@@ -5905,7 +5917,7 @@
 
 	/* Balance the stuff in kick_hub_wq() and allow autosuspend */
 	usb_autopm_put_interface(intf);
-	kref_put(&hub->kref, hub_release);
+	hub_put(hub);
 
 	kcov_remote_stop();
 }
--- linux-qcom-6.8.0.orig/drivers/usb/core/hub.h
+++ linux-qcom-6.8.0/drivers/usb/core/hub.h
@@ -129,6 +129,8 @@
 extern int usb_hub_set_port_power(struct usb_device *hdev, struct usb_hub *hub,
 		int port1, bool set);
 extern struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev);
+extern void hub_get(struct usb_hub *hub);
+extern void hub_put(struct usb_hub *hub);
 extern int hub_port_debounce(struct usb_hub *hub, int port1,
 		bool must_be_connected);
 extern int usb_clear_port_feature(struct usb_device *hdev,
--- linux-qcom-6.8.0.orig/drivers/usb/core/port.c
+++ linux-qcom-6.8.0/drivers/usb/core/port.c
@@ -50,16 +50,29 @@
 	struct usb_port *port_dev = to_usb_port(dev);
 	struct usb_device *hdev = to_usb_device(dev->parent->parent);
 	struct usb_hub *hub = usb_hub_to_struct_hub(hdev);
-	struct usb_interface *intf = to_usb_interface(hub->intfdev);
+	struct usb_interface *intf = to_usb_interface(dev->parent);
 	int port1 = port_dev->portnum;
 	u16 portstatus, unused;
 	bool disabled;
 	int rc;
+	struct kernfs_node *kn;
 
+	if (!hub)
+		return -ENODEV;
+	hub_get(hub);
 	rc = usb_autopm_get_interface(intf);
 	if (rc < 0)
-		return rc;
+		goto out_hub_get;
 
+	/*
+	 * Prevent deadlock if another process is concurrently
+	 * trying to unregister hdev.
+	 */
+	kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
+	if (!kn) {
+		rc = -ENODEV;
+		goto out_autopm;
+	}
 	usb_lock_device(hdev);
 	if (hub->disconnected) {
 		rc = -ENODEV;
@@ -69,9 +82,13 @@
 	usb_hub_port_status(hub, port1, &portstatus, &unused);
 	disabled = !usb_port_is_power_on(hub, portstatus);
 
-out_hdev_lock:
+ out_hdev_lock:
 	usb_unlock_device(hdev);
+	sysfs_unbreak_active_protection(kn);
+ out_autopm:
 	usb_autopm_put_interface(intf);
+ out_hub_get:
+	hub_put(hub);
 
 	if (rc)
 		return rc;
@@ -85,19 +102,32 @@
 	struct usb_port *port_dev = to_usb_port(dev);
 	struct usb_device *hdev = to_usb_device(dev->parent->parent);
 	struct usb_hub *hub = usb_hub_to_struct_hub(hdev);
-	struct usb_interface *intf = to_usb_interface(hub->intfdev);
+	struct usb_interface *intf = to_usb_interface(dev->parent);
 	int port1 = port_dev->portnum;
 	bool disabled;
 	int rc;
+	struct kernfs_node *kn;
 
+	if (!hub)
+		return -ENODEV;
 	rc = kstrtobool(buf, &disabled);
 	if (rc)
 		return rc;
 
+	hub_get(hub);
 	rc = usb_autopm_get_interface(intf);
 	if (rc < 0)
-		return rc;
+		goto out_hub_get;
 
+	/*
+	 * Prevent deadlock if another process is concurrently
+	 * trying to unregister hdev.
+	 */
+	kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
+	if (!kn) {
+		rc = -ENODEV;
+		goto out_autopm;
+	}
 	usb_lock_device(hdev);
 	if (hub->disconnected) {
 		rc = -ENODEV;
@@ -118,9 +148,13 @@
 	if (!rc)
 		rc = count;
 
-out_hdev_lock:
+ out_hdev_lock:
 	usb_unlock_device(hdev);
+	sysfs_unbreak_active_protection(kn);
+ out_autopm:
 	usb_autopm_put_interface(intf);
+ out_hub_get:
+	hub_put(hub);
 
 	return rc;
 }
@@ -417,9 +451,12 @@
 static void usb_port_shutdown(struct device *dev)
 {
 	struct usb_port *port_dev = to_usb_port(dev);
+	struct usb_device *udev = port_dev->child;
 
-	if (port_dev->child)
-		usb_disable_usb2_hardware_lpm(port_dev->child);
+	if (udev && !udev->port_is_suspended) {
+		usb_disable_usb2_hardware_lpm(udev);
+		usb_unlocked_disable_lpm(udev);
+	}
 }
 
 static const struct dev_pm_ops usb_port_pm_ops = {
--- linux-qcom-6.8.0.orig/drivers/usb/core/quirks.c
+++ linux-qcom-6.8.0/drivers/usb/core/quirks.c
@@ -506,6 +506,9 @@
 	{ USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT |
 	  USB_QUIRK_DELAY_CTRL_MSG },
 
+	/* START BP-850k Printer */
+	{ USB_DEVICE(0x1bc3, 0x0003), .driver_info = USB_QUIRK_NO_SET_INTF },
+
 	/* MIDI keyboard WORLDE MINI */
 	{ USB_DEVICE(0x1c75, 0x0204), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },
--- linux-qcom-6.8.0.orig/drivers/usb/core/sysfs.c
+++ linux-qcom-6.8.0/drivers/usb/core/sysfs.c
@@ -668,6 +668,7 @@
 
 static void remove_power_attributes(struct device *dev)
 {
+	sysfs_unmerge_group(&dev->kobj, &usb3_hardware_lpm_attr_group);
 	sysfs_unmerge_group(&dev->kobj, &usb2_hardware_lpm_attr_group);
 	sysfs_unmerge_group(&dev->kobj, &power_attr_group);
 }
@@ -1168,14 +1169,24 @@
 {
 	struct usb_interface *intf = to_usb_interface(dev);
 	bool val;
+	struct kernfs_node *kn;
 
 	if (kstrtobool(buf, &val) != 0)
 		return -EINVAL;
 
-	if (val)
+	if (val) {
 		usb_authorize_interface(intf);
-	else
-		usb_deauthorize_interface(intf);
+	} else {
+		/*
+		 * Prevent deadlock if another process is concurrently
+		 * trying to unregister intf.
+		 */
+		kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
+		if (kn) {
+			usb_deauthorize_interface(intf);
+			sysfs_unbreak_active_protection(kn);
+		}
+	}
 
 	return count;
 }
--- linux-qcom-6.8.0.orig/drivers/usb/dwc2/core.h
+++ linux-qcom-6.8.0/drivers/usb/dwc2/core.h
@@ -729,8 +729,14 @@
  * struct dwc2_hregs_backup - Holds host registers state before
  * entering partial power down
  * @hcfg:		Backup of HCFG register
+ * @hflbaddr:		Backup of HFLBADDR register
  * @haintmsk:		Backup of HAINTMSK register
+ * @hcchar:		Backup of HCCHAR register
+ * @hcsplt:		Backup of HCSPLT register
  * @hcintmsk:		Backup of HCINTMSK register
+ * @hctsiz:		Backup of HCTSIZ register
+ * @hdma:		Backup of HCDMA register
+ * @hcdmab:		Backup of HCDMAB register
  * @hprt0:		Backup of HPTR0 register
  * @hfir:		Backup of HFIR register
  * @hptxfsiz:		Backup of HPTXFSIZ register
@@ -738,8 +744,14 @@
  */
 struct dwc2_hregs_backup {
 	u32 hcfg;
+	u32 hflbaddr;
 	u32 haintmsk;
+	u32 hcchar[MAX_EPS_CHANNELS];
+	u32 hcsplt[MAX_EPS_CHANNELS];
 	u32 hcintmsk[MAX_EPS_CHANNELS];
+	u32 hctsiz[MAX_EPS_CHANNELS];
+	u32 hcidma[MAX_EPS_CHANNELS];
+	u32 hcidmab[MAX_EPS_CHANNELS];
 	u32 hprt0;
 	u32 hfir;
 	u32 hptxfsiz;
@@ -1086,6 +1098,7 @@
 	bool needs_byte_swap;
 
 	/* DWC OTG HW Release versions */
+#define DWC2_CORE_REV_4_30a	0x4f54430a
 #define DWC2_CORE_REV_2_71a	0x4f54271a
 #define DWC2_CORE_REV_2_72a     0x4f54272a
 #define DWC2_CORE_REV_2_80a	0x4f54280a
@@ -1323,6 +1336,7 @@
 int dwc2_restore_global_registers(struct dwc2_hsotg *hsotg);
 
 void dwc2_enable_acg(struct dwc2_hsotg *hsotg);
+void dwc2_wakeup_from_lpm_l1(struct dwc2_hsotg *hsotg, bool remotewakeup);
 
 /* This function should be called on every hardware interrupt. */
 irqreturn_t dwc2_handle_common_intr(int irq, void *dev);
--- linux-qcom-6.8.0.orig/drivers/usb/dwc2/core_intr.c
+++ linux-qcom-6.8.0/drivers/usb/dwc2/core_intr.c
@@ -297,7 +297,8 @@
 
 			/* Exit gadget mode clock gating. */
 			if (hsotg->params.power_down ==
-			    DWC2_POWER_DOWN_PARAM_NONE && hsotg->bus_suspended)
+			    DWC2_POWER_DOWN_PARAM_NONE && hsotg->bus_suspended &&
+			    !hsotg->params.no_clock_gating)
 				dwc2_gadget_exit_clock_gating(hsotg, 0);
 		}
 
@@ -322,10 +323,11 @@
  * @hsotg: Programming view of DWC_otg controller
  *
  */
-static void dwc2_wakeup_from_lpm_l1(struct dwc2_hsotg *hsotg)
+void dwc2_wakeup_from_lpm_l1(struct dwc2_hsotg *hsotg, bool remotewakeup)
 {
 	u32 glpmcfg;
-	u32 i = 0;
+	u32 pcgctl;
+	u32 dctl;
 
 	if (hsotg->lx_state != DWC2_L1) {
 		dev_err(hsotg->dev, "Core isn't in DWC2_L1 state\n");
@@ -334,37 +336,57 @@
 
 	glpmcfg = dwc2_readl(hsotg, GLPMCFG);
 	if (dwc2_is_device_mode(hsotg)) {
-		dev_dbg(hsotg->dev, "Exit from L1 state\n");
+		dev_dbg(hsotg->dev, "Exit from L1 state, remotewakeup=%d\n", remotewakeup);
 		glpmcfg &= ~GLPMCFG_ENBLSLPM;
-		glpmcfg &= ~GLPMCFG_HIRD_THRES_EN;
+		glpmcfg &= ~GLPMCFG_HIRD_THRES_MASK;
 		dwc2_writel(hsotg, glpmcfg, GLPMCFG);
 
-		do {
-			glpmcfg = dwc2_readl(hsotg, GLPMCFG);
+		pcgctl = dwc2_readl(hsotg, PCGCTL);
+		pcgctl &= ~PCGCTL_ENBL_SLEEP_GATING;
+		dwc2_writel(hsotg, pcgctl, PCGCTL);
+
+		glpmcfg = dwc2_readl(hsotg, GLPMCFG);
+		if (glpmcfg & GLPMCFG_ENBESL) {
+			glpmcfg |= GLPMCFG_RSTRSLPSTS;
+			dwc2_writel(hsotg, glpmcfg, GLPMCFG);
+		}
 
-			if (!(glpmcfg & (GLPMCFG_COREL1RES_MASK |
-					 GLPMCFG_L1RESUMEOK | GLPMCFG_SLPSTS)))
-				break;
+		if (remotewakeup) {
+			if (dwc2_hsotg_wait_bit_set(hsotg, GLPMCFG, GLPMCFG_L1RESUMEOK, 1000)) {
+				dev_warn(hsotg->dev, "%s: timeout GLPMCFG_L1RESUMEOK\n", __func__);
+				goto fail;
+				return;
+			}
 
-			udelay(1);
-		} while (++i < 200);
+			dctl = dwc2_readl(hsotg, DCTL);
+			dctl |= DCTL_RMTWKUPSIG;
+			dwc2_writel(hsotg, dctl, DCTL);
+
+			if (dwc2_hsotg_wait_bit_set(hsotg, GINTSTS, GINTSTS_WKUPINT, 1000)) {
+				dev_warn(hsotg->dev, "%s: timeout GINTSTS_WKUPINT\n", __func__);
+				goto fail;
+				return;
+			}
+		}
 
-		if (i == 200) {
-			dev_err(hsotg->dev, "Failed to exit L1 sleep state in 200us.\n");
+		glpmcfg = dwc2_readl(hsotg, GLPMCFG);
+		if (glpmcfg & GLPMCFG_COREL1RES_MASK || glpmcfg & GLPMCFG_SLPSTS ||
+		    glpmcfg & GLPMCFG_L1RESUMEOK) {
+			goto fail;
 			return;
 		}
-		dwc2_gadget_init_lpm(hsotg);
+
+		/* Inform gadget to exit from L1 */
+		call_gadget(hsotg, resume);
+		/* Change to L0 state */
+		hsotg->lx_state = DWC2_L0;
+		hsotg->bus_suspended = false;
+fail:		dwc2_gadget_init_lpm(hsotg);
 	} else {
 		/* TODO */
 		dev_err(hsotg->dev, "Host side LPM is not supported.\n");
 		return;
 	}
-
-	/* Change to L0 state */
-	hsotg->lx_state = DWC2_L0;
-
-	/* Inform gadget to exit from L1 */
-	call_gadget(hsotg, resume);
 }
 
 /*
@@ -385,7 +407,7 @@
 	dev_dbg(hsotg->dev, "%s lxstate = %d\n", __func__, hsotg->lx_state);
 
 	if (hsotg->lx_state == DWC2_L1) {
-		dwc2_wakeup_from_lpm_l1(hsotg);
+		dwc2_wakeup_from_lpm_l1(hsotg, false);
 		return;
 	}
 
@@ -408,7 +430,8 @@
 
 			/* Exit gadget mode clock gating. */
 			if (hsotg->params.power_down ==
-			    DWC2_POWER_DOWN_PARAM_NONE && hsotg->bus_suspended)
+			    DWC2_POWER_DOWN_PARAM_NONE && hsotg->bus_suspended &&
+			    !hsotg->params.no_clock_gating)
 				dwc2_gadget_exit_clock_gating(hsotg, 0);
 		} else {
 			/* Change to L0 state */
@@ -425,7 +448,8 @@
 			}
 
 			if (hsotg->params.power_down ==
-			    DWC2_POWER_DOWN_PARAM_NONE && hsotg->bus_suspended)
+			    DWC2_POWER_DOWN_PARAM_NONE && hsotg->bus_suspended &&
+			    !hsotg->params.no_clock_gating)
 				dwc2_host_exit_clock_gating(hsotg, 1);
 
 			/*
--- linux-qcom-6.8.0.orig/drivers/usb/dwc2/drd.c
+++ linux-qcom-6.8.0/drivers/usb/dwc2/drd.c
@@ -127,6 +127,15 @@
 			role = USB_ROLE_DEVICE;
 	}
 
+	if ((IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) ||
+	     IS_ENABLED(CONFIG_USB_DWC2_DUAL_ROLE)) &&
+	     dwc2_is_device_mode(hsotg) &&
+	     hsotg->lx_state == DWC2_L2 &&
+	     hsotg->params.power_down == DWC2_POWER_DOWN_PARAM_NONE &&
+	     hsotg->bus_suspended &&
+	     !hsotg->params.no_clock_gating)
+		dwc2_gadget_exit_clock_gating(hsotg, 0);
+
 	if (role == USB_ROLE_HOST) {
 		already = dwc2_ovr_avalid(hsotg, true);
 	} else if (role == USB_ROLE_DEVICE) {
--- linux-qcom-6.8.0.orig/drivers/usb/dwc2/gadget.c
+++ linux-qcom-6.8.0/drivers/usb/dwc2/gadget.c
@@ -885,10 +885,10 @@
 	}
 
 	/* DMA sg buffer */
-	for_each_sg(ureq->sg, sg, ureq->num_sgs, i) {
+	for_each_sg(ureq->sg, sg, ureq->num_mapped_sgs, i) {
 		dwc2_gadget_fill_nonisoc_xfer_ddma_one(hs_ep, &desc,
 			sg_dma_address(sg) + sg->offset, sg_dma_len(sg),
-			sg_is_last(sg));
+			(i == (ureq->num_mapped_sgs - 1)));
 		desc_count += hs_ep->desc_count;
 	}
 
@@ -1415,6 +1415,10 @@
 		ep->name, req, req->length, req->buf, req->no_interrupt,
 		req->zero, req->short_not_ok);
 
+	if (hs->lx_state == DWC2_L1) {
+		dwc2_wakeup_from_lpm_l1(hs, true);
+	}
+
 	/* Prevent new request submission when controller is suspended */
 	if (hs->lx_state != DWC2_L0) {
 		dev_dbg(hs->dev, "%s: submit request only in active state\n",
@@ -3727,6 +3731,12 @@
 		if (hsotg->in_ppd && hsotg->lx_state == DWC2_L2)
 			dwc2_exit_partial_power_down(hsotg, 0, true);
 
+		/* Exit gadget mode clock gating. */
+		if (hsotg->params.power_down ==
+		    DWC2_POWER_DOWN_PARAM_NONE && hsotg->bus_suspended &&
+		    !hsotg->params.no_clock_gating)
+			dwc2_gadget_exit_clock_gating(hsotg, 0);
+
 		hsotg->lx_state = DWC2_L0;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/usb/dwc2/hcd.c
+++ linux-qcom-6.8.0/drivers/usb/dwc2/hcd.c
@@ -2701,8 +2701,11 @@
 			hsotg->available_host_channels--;
 		}
 		qh = list_entry(qh_ptr, struct dwc2_qh, qh_list_entry);
-		if (dwc2_assign_and_init_hc(hsotg, qh))
+		if (dwc2_assign_and_init_hc(hsotg, qh)) {
+			if (hsotg->params.uframe_sched)
+				hsotg->available_host_channels++;
 			break;
+		}
 
 		/*
 		 * Move the QH from the periodic ready schedule to the
@@ -2735,8 +2738,11 @@
 			hsotg->available_host_channels--;
 		}
 
-		if (dwc2_assign_and_init_hc(hsotg, qh))
+		if (dwc2_assign_and_init_hc(hsotg, qh)) {
+			if (hsotg->params.uframe_sched)
+				hsotg->available_host_channels++;
 			break;
+		}
 
 		/*
 		 * Move the QH from the non-periodic inactive schedule to the
@@ -3540,11 +3546,9 @@
 			port_status |= USB_PORT_STAT_C_OVERCURRENT << 16;
 		}
 
-		if (!hsotg->flags.b.port_connect_status) {
+		if (dwc2_is_device_mode(hsotg)) {
 			/*
-			 * The port is disconnected, which means the core is
-			 * either in device mode or it soon will be. Just
-			 * return 0's for the remainder of the port status
+			 * Just return 0's for the remainder of the port status
 			 * since the port register can't be read if the core
 			 * is in device mode.
 			 */
@@ -3614,13 +3618,11 @@
 		if (wvalue != USB_PORT_FEAT_TEST && (!windex || windex > 1))
 			goto error;
 
-		if (!hsotg->flags.b.port_connect_status) {
+		if (dwc2_is_device_mode(hsotg)) {
 			/*
-			 * The port is disconnected, which means the core is
-			 * either in device mode or it soon will be. Just
-			 * return without doing anything since the port
-			 * register can't be written if the core is in device
-			 * mode.
+			 * Just return 0's for the remainder of the port status
+			 * since the port register can't be read if the core
+			 * is in device mode.
 			 */
 			break;
 		}
@@ -4143,6 +4145,8 @@
 			 urb->actual_length);
 
 	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		if (!hsotg->params.dma_desc_enable)
+			urb->start_frame = qtd->qh->start_active_frame;
 		urb->error_count = dwc2_hcd_urb_get_error_count(qtd->urb);
 		for (i = 0; i < urb->number_of_packets; ++i) {
 			urb->iso_frame_desc[i].actual_length =
@@ -4341,7 +4345,7 @@
 	if (hsotg->bus_suspended)
 		goto skip_power_saving;
 
-	if (hsotg->flags.b.port_connect_status == 0)
+	if (!(dwc2_read_hprt0(hsotg) & HPRT0_CONNSTS))
 		goto skip_power_saving;
 
 	switch (hsotg->params.power_down) {
@@ -4423,6 +4427,7 @@
 	 * Power Down mode.
 	 */
 	if (hprt0 & HPRT0_CONNSTS) {
+		set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
 		hsotg->lx_state = DWC2_L0;
 		goto unlock;
 	}
@@ -4649,7 +4654,7 @@
 	}
 
 	if (hsotg->params.power_down == DWC2_POWER_DOWN_PARAM_NONE &&
-	    hsotg->bus_suspended) {
+	    hsotg->bus_suspended && !hsotg->params.no_clock_gating) {
 		if (dwc2_is_device_mode(hsotg))
 			dwc2_gadget_exit_clock_gating(hsotg, 0);
 		else
@@ -5406,9 +5411,16 @@
 	/* Backup Host regs */
 	hr = &hsotg->hr_backup;
 	hr->hcfg = dwc2_readl(hsotg, HCFG);
+	hr->hflbaddr = dwc2_readl(hsotg, HFLBADDR);
 	hr->haintmsk = dwc2_readl(hsotg, HAINTMSK);
-	for (i = 0; i < hsotg->params.host_channels; ++i)
+	for (i = 0; i < hsotg->params.host_channels; ++i) {
+		hr->hcchar[i] = dwc2_readl(hsotg, HCCHAR(i));
+		hr->hcsplt[i] = dwc2_readl(hsotg, HCSPLT(i));
 		hr->hcintmsk[i] = dwc2_readl(hsotg, HCINTMSK(i));
+		hr->hctsiz[i] = dwc2_readl(hsotg, HCTSIZ(i));
+		hr->hcidma[i] = dwc2_readl(hsotg, HCDMA(i));
+		hr->hcidmab[i] = dwc2_readl(hsotg, HCDMAB(i));
+	}
 
 	hr->hprt0 = dwc2_read_hprt0(hsotg);
 	hr->hfir = dwc2_readl(hsotg, HFIR);
@@ -5442,10 +5454,17 @@
 	hr->valid = false;
 
 	dwc2_writel(hsotg, hr->hcfg, HCFG);
+	dwc2_writel(hsotg, hr->hflbaddr, HFLBADDR);
 	dwc2_writel(hsotg, hr->haintmsk, HAINTMSK);
 
-	for (i = 0; i < hsotg->params.host_channels; ++i)
+	for (i = 0; i < hsotg->params.host_channels; ++i) {
+		dwc2_writel(hsotg, hr->hcchar[i], HCCHAR(i));
+		dwc2_writel(hsotg, hr->hcsplt[i], HCSPLT(i));
 		dwc2_writel(hsotg, hr->hcintmsk[i], HCINTMSK(i));
+		dwc2_writel(hsotg, hr->hctsiz[i], HCTSIZ(i));
+		dwc2_writel(hsotg, hr->hcidma[i], HCDMA(i));
+		dwc2_writel(hsotg, hr->hcidmab[i], HCDMAB(i));
+	}
 
 	dwc2_writel(hsotg, hr->hprt0, HPRT0);
 	dwc2_writel(hsotg, hr->hfir, HFIR);
@@ -5610,10 +5629,12 @@
 	dwc2_writel(hsotg, hr->hcfg, HCFG);
 
 	/* De-assert Wakeup Logic */
-	gpwrdn = dwc2_readl(hsotg, GPWRDN);
-	gpwrdn &= ~GPWRDN_PMUACTV;
-	dwc2_writel(hsotg, gpwrdn, GPWRDN);
-	udelay(10);
+	if (!(rem_wakeup && hsotg->hw_params.snpsid >= DWC2_CORE_REV_4_30a)) {
+		gpwrdn = dwc2_readl(hsotg, GPWRDN);
+		gpwrdn &= ~GPWRDN_PMUACTV;
+		dwc2_writel(hsotg, gpwrdn, GPWRDN);
+		udelay(10);
+	}
 
 	hprt0 = hr->hprt0;
 	hprt0 |= HPRT0_PWR;
@@ -5638,6 +5659,13 @@
 		hprt0 |= HPRT0_RES;
 		dwc2_writel(hsotg, hprt0, HPRT0);
 
+		/* De-assert Wakeup Logic */
+		if ((rem_wakeup && hsotg->hw_params.snpsid >= DWC2_CORE_REV_4_30a)) {
+			gpwrdn = dwc2_readl(hsotg, GPWRDN);
+			gpwrdn &= ~GPWRDN_PMUACTV;
+			dwc2_writel(hsotg, gpwrdn, GPWRDN);
+			udelay(10);
+		}
 		/* Wait for Resume time and then program HPRT again */
 		mdelay(100);
 		hprt0 &= ~HPRT0_RES;
--- linux-qcom-6.8.0.orig/drivers/usb/dwc2/hcd_ddma.c
+++ linux-qcom-6.8.0/drivers/usb/dwc2/hcd_ddma.c
@@ -559,7 +559,7 @@
 	idx = qh->td_last;
 	inc = qh->host_interval;
 	hsotg->frame_number = dwc2_hcd_get_frame_number(hsotg);
-	cur_idx = dwc2_frame_list_idx(hsotg->frame_number);
+	cur_idx = idx;
 	next_idx = dwc2_desclist_idx_inc(qh->td_last, inc, qh->dev_speed);
 
 	/*
@@ -866,20 +866,27 @@
 {
 	struct dwc2_dma_desc *dma_desc;
 	struct dwc2_hcd_iso_packet_desc *frame_desc;
+	u16 frame_desc_idx;
+	struct urb *usb_urb;
 	u16 remain = 0;
 	int rc = 0;
 
 	if (!qtd->urb)
 		return -EINVAL;
 
+	usb_urb = qtd->urb->priv;
+
 	dma_sync_single_for_cpu(hsotg->dev, qh->desc_list_dma + (idx *
 				sizeof(struct dwc2_dma_desc)),
 				sizeof(struct dwc2_dma_desc),
 				DMA_FROM_DEVICE);
 
 	dma_desc = &qh->desc_list[idx];
+	frame_desc_idx = (idx - qtd->isoc_td_first) & (usb_urb->number_of_packets - 1);
 
-	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index_last];
+	frame_desc = &qtd->urb->iso_descs[frame_desc_idx];
+	if (idx == qtd->isoc_td_first)
+		usb_urb->start_frame = dwc2_hcd_get_frame_number(hsotg);
 	dma_desc->buf = (u32)(qtd->urb->dma + frame_desc->offset);
 	if (chan->ep_is_in)
 		remain = (dma_desc->status & HOST_DMA_ISOC_NBYTES_MASK) >>
@@ -900,7 +907,7 @@
 		frame_desc->status = 0;
 	}
 
-	if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
+	if (++qtd->isoc_frame_index == usb_urb->number_of_packets) {
 		/*
 		 * urb->status is not used for isoc transfers here. The
 		 * individual frame_desc status are used instead.
@@ -1005,11 +1012,11 @@
 				return;
 			idx = dwc2_desclist_idx_inc(idx, qh->host_interval,
 						    chan->speed);
-			if (!rc)
+			if (rc == 0)
 				continue;
 
-			if (rc == DWC2_CMPL_DONE)
-				break;
+			if (rc == DWC2_CMPL_DONE || rc == DWC2_CMPL_STOP)
+				goto stop_scan;
 
 			/* rc == DWC2_CMPL_STOP */
 
--- linux-qcom-6.8.0.orig/drivers/usb/dwc2/hw.h
+++ linux-qcom-6.8.0/drivers/usb/dwc2/hw.h
@@ -698,7 +698,7 @@
 #define TXSTS_QTOP_TOKEN_MASK		(0x3 << 25)
 #define TXSTS_QTOP_TOKEN_SHIFT		25
 #define TXSTS_QTOP_TERMINATE		BIT(24)
-#define TXSTS_QSPCAVAIL_MASK		(0xff << 16)
+#define TXSTS_QSPCAVAIL_MASK		(0x7f << 16)
 #define TXSTS_QSPCAVAIL_SHIFT		16
 #define TXSTS_FSPCAVAIL_MASK		(0xffff << 0)
 #define TXSTS_FSPCAVAIL_SHIFT		0
--- linux-qcom-6.8.0.orig/drivers/usb/dwc2/platform.c
+++ linux-qcom-6.8.0/drivers/usb/dwc2/platform.c
@@ -331,7 +331,7 @@
 
 	/* Exit clock gating when driver is removed. */
 	if (hsotg->params.power_down == DWC2_POWER_DOWN_PARAM_NONE &&
-	    hsotg->bus_suspended) {
+	    hsotg->bus_suspended && !hsotg->params.no_clock_gating) {
 		if (dwc2_is_device_mode(hsotg))
 			dwc2_gadget_exit_clock_gating(hsotg, 0);
 		else
@@ -469,18 +469,6 @@
 
 	spin_lock_init(&hsotg->lock);
 
-	hsotg->irq = platform_get_irq(dev, 0);
-	if (hsotg->irq < 0)
-		return hsotg->irq;
-
-	dev_dbg(hsotg->dev, "registering common handler for irq%d\n",
-		hsotg->irq);
-	retval = devm_request_irq(hsotg->dev, hsotg->irq,
-				  dwc2_handle_common_intr, IRQF_SHARED,
-				  dev_name(hsotg->dev), hsotg);
-	if (retval)
-		return retval;
-
 	hsotg->vbus_supply = devm_regulator_get_optional(hsotg->dev, "vbus");
 	if (IS_ERR(hsotg->vbus_supply)) {
 		retval = PTR_ERR(hsotg->vbus_supply);
@@ -524,6 +512,20 @@
 	if (retval)
 		goto error;
 
+	hsotg->irq = platform_get_irq(dev, 0);
+	if (hsotg->irq < 0) {
+		retval = hsotg->irq;
+		goto error;
+	}
+
+	dev_dbg(hsotg->dev, "registering common handler for irq%d\n",
+		hsotg->irq);
+	retval = devm_request_irq(hsotg->dev, hsotg->irq,
+				  dwc2_handle_common_intr, IRQF_SHARED,
+				  dev_name(hsotg->dev), hsotg);
+	if (retval)
+		goto error;
+
 	/*
 	 * For OTG cores, set the force mode bits to reflect the value
 	 * of dr_mode. Force mode bits should not be touched at any
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/core.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/core.c
@@ -104,6 +104,27 @@
 	return 0;
 }
 
+void dwc3_enable_susphy(struct dwc3 *dwc, bool enable)
+{
+	u32 reg;
+
+	reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
+	if (enable && !dwc->dis_u3_susphy_quirk)
+		reg |= DWC3_GUSB3PIPECTL_SUSPHY;
+	else
+		reg &= ~DWC3_GUSB3PIPECTL_SUSPHY;
+
+	dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), reg);
+
+	reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+	if (enable && !dwc->dis_u2_susphy_quirk)
+		reg |= DWC3_GUSB2PHYCFG_SUSPHY;
+	else
+		reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
+
+	dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+}
+
 void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode)
 {
 	u32 reg;
@@ -120,7 +141,7 @@
 {
 	struct dwc3 *dwc = work_to_dwc(work);
 	unsigned long flags;
-	int ret;
+	int ret = 0;
 	u32 reg;
 	u32 desired_dr_role;
 
@@ -137,6 +158,9 @@
 	if (!desired_dr_role)
 		goto out;
 
+	if (!dwc->cable_disconnected)
+		dwc3_notify_set_mode(dwc, desired_dr_role);
+
 	if (desired_dr_role == dwc->current_dr_role)
 		goto out;
 
@@ -194,6 +218,11 @@
 
 	switch (desired_dr_role) {
 	case DWC3_GCTL_PRTCAP_HOST:
+		if (dwc->dwc3_guctl_resbwhseps_quirk) {
+			reg = dwc3_readl(dwc->regs, DWC3_GUCTL);
+			reg |= DWC3_GUCTL_RESBWHSEPS;
+			dwc3_writel(dwc->regs, DWC3_GUCTL, reg);
+		}
 		ret = dwc3_host_init(dwc);
 		if (ret) {
 			dev_err(dwc->dev, "failed to initialize host\n");
@@ -231,6 +260,9 @@
 		break;
 	}
 
+	if (!ret)
+		dwc3_notify_mode_changed(dwc, dwc->current_dr_role);
+
 out:
 	pm_runtime_mark_last_busy(dwc->dev);
 	pm_runtime_put_autosuspend(dwc->dev);
@@ -465,7 +497,7 @@
  * dwc3_free_event_buffers - frees all allocated event buffers
  * @dwc: Pointer to our controller context structure
  */
-static void dwc3_free_event_buffers(struct dwc3 *dwc)
+void dwc3_free_event_buffers(struct dwc3 *dwc)
 {
 	struct dwc3_event_buffer	*evt;
 
@@ -473,6 +505,7 @@
 	if (evt)
 		dwc3_free_one_event_buffer(dwc, evt);
 }
+EXPORT_SYMBOL_GPL(dwc3_free_event_buffers);
 
 /**
  * dwc3_alloc_event_buffers - Allocates @num event buffers of size @length
@@ -485,6 +518,13 @@
 static int dwc3_alloc_event_buffers(struct dwc3 *dwc, unsigned int length)
 {
 	struct dwc3_event_buffer *evt;
+	unsigned int hw_mode;
+
+	hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0);
+	if (hw_mode == DWC3_GHWPARAMS0_MODE_HOST) {
+		dwc->ev_buf = NULL;
+		return 0;
+	}
 
 	evt = dwc3_alloc_one_event_buffer(dwc, length);
 	if (IS_ERR(evt)) {
@@ -505,6 +545,10 @@
 int dwc3_event_buffers_setup(struct dwc3 *dwc)
 {
 	struct dwc3_event_buffer	*evt;
+	u32				reg;
+
+	if (!dwc->ev_buf)
+		return 0;
 
 	evt = dwc->ev_buf;
 	evt->lpos = 0;
@@ -514,14 +558,27 @@
 			upper_32_bits(evt->dma));
 	dwc3_writel(dwc->regs, DWC3_GEVNTSIZ(0),
 			DWC3_GEVNTSIZ_SIZE(evt->length));
-	dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), 0);
 
+	/* Clear any stale event */
+	reg = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
+	dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), reg);
 	return 0;
 }
 
 void dwc3_event_buffers_cleanup(struct dwc3 *dwc)
 {
 	struct dwc3_event_buffer	*evt;
+	u32				reg;
+
+	if (!dwc->ev_buf)
+		return;
+	/*
+	 * Exynos platforms may not be able to access event buffer if the
+	 * controller failed to halt on dwc3_core_exit().
+	 */
+	reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+	if (!(reg & DWC3_DSTS_DEVCTRLHLT))
+		return;
 
 	evt = dwc->ev_buf;
 
@@ -531,7 +588,10 @@
 	dwc3_writel(dwc->regs, DWC3_GEVNTADRHI(0), 0);
 	dwc3_writel(dwc->regs, DWC3_GEVNTSIZ(0), DWC3_GEVNTSIZ_INTMASK
 			| DWC3_GEVNTSIZ_SIZE(0));
-	dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), 0);
+
+	/* Clear any stale event */
+	reg = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
+	dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), reg);
 }
 
 static void dwc3_core_num_eps(struct dwc3 *dwc)
@@ -585,11 +645,8 @@
  */
 static int dwc3_phy_setup(struct dwc3 *dwc)
 {
-	unsigned int hw_mode;
 	u32 reg;
 
-	hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0);
-
 	reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
 
 	/*
@@ -599,21 +656,16 @@
 	reg &= ~DWC3_GUSB3PIPECTL_UX_EXIT_PX;
 
 	/*
-	 * Above 1.94a, it is recommended to set DWC3_GUSB3PIPECTL_SUSPHY
-	 * to '0' during coreConsultant configuration. So default value
-	 * will be '0' when the core is reset. Application needs to set it
-	 * to '1' after the core initialization is completed.
-	 */
-	if (!DWC3_VER_IS_WITHIN(DWC3, ANY, 194A))
-		reg |= DWC3_GUSB3PIPECTL_SUSPHY;
-
-	/*
-	 * For DRD controllers, GUSB3PIPECTL.SUSPENDENABLE must be cleared after
-	 * power-on reset, and it can be set after core initialization, which is
-	 * after device soft-reset during initialization.
+	 * Above DWC_usb3.0 1.94a, it is recommended to set
+	 * DWC3_GUSB3PIPECTL_SUSPHY to '0' during coreConsultant configuration.
+	 * So default value will be '0' when the core is reset. Application
+	 * needs to set it to '1' after the core initialization is completed.
+	 *
+	 * Similarly for DRD controllers, GUSB3PIPECTL.SUSPENDENABLE must be
+	 * cleared after power-on reset, and it can be set after core
+	 * initialization.
 	 */
-	if (hw_mode == DWC3_GHWPARAMS0_MODE_DRD)
-		reg &= ~DWC3_GUSB3PIPECTL_SUSPHY;
+	reg &= ~DWC3_GUSB3PIPECTL_SUSPHY;
 
 	if (dwc->u2ss_inp3_quirk)
 		reg |= DWC3_GUSB3PIPECTL_U2SSINP3OK;
@@ -639,9 +691,6 @@
 	if (dwc->tx_de_emphasis_quirk)
 		reg |= DWC3_GUSB3PIPECTL_TX_DEEPH(dwc->tx_de_emphasis);
 
-	if (dwc->dis_u3_susphy_quirk)
-		reg &= ~DWC3_GUSB3PIPECTL_SUSPHY;
-
 	if (dwc->dis_del_phy_power_chg_quirk)
 		reg &= ~DWC3_GUSB3PIPECTL_DEPOCHANGE;
 
@@ -689,24 +738,15 @@
 	}
 
 	/*
-	 * Above 1.94a, it is recommended to set DWC3_GUSB2PHYCFG_SUSPHY to
-	 * '0' during coreConsultant configuration. So default value will
-	 * be '0' when the core is reset. Application needs to set it to
-	 * '1' after the core initialization is completed.
-	 */
-	if (!DWC3_VER_IS_WITHIN(DWC3, ANY, 194A))
-		reg |= DWC3_GUSB2PHYCFG_SUSPHY;
-
-	/*
-	 * For DRD controllers, GUSB2PHYCFG.SUSPHY must be cleared after
-	 * power-on reset, and it can be set after core initialization, which is
-	 * after device soft-reset during initialization.
+	 * Above DWC_usb3.0 1.94a, it is recommended to set
+	 * DWC3_GUSB2PHYCFG_SUSPHY to '0' during coreConsultant configuration.
+	 * So default value will be '0' when the core is reset. Application
+	 * needs to set it to '1' after the core initialization is completed.
+	 *
+	 * Similarly for DRD controllers, GUSB2PHYCFG.SUSPHY must be cleared
+	 * after power-on reset, and it can be set after core initialization.
 	 */
-	if (hw_mode == DWC3_GHWPARAMS0_MODE_DRD)
-		reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
-
-	if (dwc->dis_u2_susphy_quirk)
-		reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
+	reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
 
 	if (dwc->dis_enblslpm_quirk)
 		reg &= ~DWC3_GUSB2PHYCFG_ENBLSLPM;
@@ -878,12 +918,16 @@
 
 static void dwc3_core_setup_global_control(struct dwc3 *dwc)
 {
+	unsigned int power_opt;
+	unsigned int hw_mode;
 	u32 reg;
 
 	reg = dwc3_readl(dwc->regs, DWC3_GCTL);
 	reg &= ~DWC3_GCTL_SCALEDOWN_MASK;
+	hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0);
+	power_opt = DWC3_GHWPARAMS1_EN_PWROPT(dwc->hwparams.hwparams1);
 
-	switch (DWC3_GHWPARAMS1_EN_PWROPT(dwc->hwparams.hwparams1)) {
+	switch (power_opt) {
 	case DWC3_GHWPARAMS1_EN_PWROPT_CLK:
 		/**
 		 * WORKAROUND: DWC3 revisions between 2.10a and 2.50a have an
@@ -916,6 +960,20 @@
 		break;
 	}
 
+	/*
+	 * This is a workaround for STAR#4846132, which only affects
+	 * DWC_usb31 version2.00a operating in host mode.
+	 *
+	 * There is a problem in DWC_usb31 version 2.00a operating
+	 * in host mode that would cause a CSR read timeout When CSR
+	 * read coincides with RAM Clock Gating Entry. By disable
+	 * Clock Gating, sacrificing power consumption for normal
+	 * operation.
+	 */
+	if (power_opt != DWC3_GHWPARAMS1_EN_PWROPT_NO &&
+	    hw_mode != DWC3_GHWPARAMS0_MODE_GADGET && DWC3_VER_IS(DWC31, 200A))
+		reg |= DWC3_GCTL_DSBLCLKGTNG;
+
 	/* check if current dwc3 is on simulation board */
 	if (dwc->hwparams.hwparams6 & DWC3_GHWPARAMS6_EN_FPGA) {
 		dev_info(dwc->dev, "Running with FPGA optimizations\n");
@@ -1227,21 +1285,6 @@
 	if (ret)
 		goto err_exit_phy;
 
-	if (hw_mode == DWC3_GHWPARAMS0_MODE_DRD &&
-	    !DWC3_VER_IS_WITHIN(DWC3, ANY, 194A)) {
-		if (!dwc->dis_u3_susphy_quirk) {
-			reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
-			reg |= DWC3_GUSB3PIPECTL_SUSPHY;
-			dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), reg);
-		}
-
-		if (!dwc->dis_u2_susphy_quirk) {
-			reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
-			reg |= DWC3_GUSB2PHYCFG_SUSPHY;
-			dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
-		}
-	}
-
 	dwc3_core_setup_global_control(dwc);
 	dwc3_core_num_eps(dwc);
 
@@ -1278,6 +1321,21 @@
 	}
 
 	/*
+	 * STAR 9001285599: This issue affects DWC_usb3 version 3.20a
+	 * only. If the PM TIMER ECM is enabled through GUCTL2[19], the
+	 * link compliance test (TD7.21) may fail. If the ECN is not
+	 * enabled (GUCTL2[19] = 0), the controller will use the old timer
+	 * value (5us), which is still acceptable for the link compliance
+	 * test. Therefore, do not enable PM TIMER ECM in 3.20a by
+	 * setting GUCTL2[19] by default; instead, use GUCTL2[19] = 0.
+	 */
+	if (DWC3_VER_IS(DWC3, 320A)) {
+		reg = dwc3_readl(dwc->regs, DWC3_GUCTL2);
+		reg &= ~DWC3_GUCTL2_LC_TIMER;
+		dwc3_writel(dwc->regs, DWC3_GUCTL2, reg);
+	}
+
+	/*
 	 * When configured in HOST mode, after issuing U3/L2 exit controller
 	 * fails to send proper CRC checksum in CRC5 feild. Because of this
 	 * behaviour Transaction Error is generated, resulting in reset and
@@ -1330,18 +1388,6 @@
 
 	dwc3_config_threshold(dwc);
 
-	/*
-	 * Modify this for all supported Super Speed ports when
-	 * multiport support is added.
-	 */
-	if (hw_mode != DWC3_GHWPARAMS0_MODE_GADGET &&
-	    (DWC3_IP_IS(DWC31)) &&
-	    dwc->maximum_speed == USB_SPEED_SUPER) {
-		reg = dwc3_readl(dwc->regs, DWC3_LLUCTL);
-		reg |= DWC3_LLUCTL_FORCE_GEN1;
-		dwc3_writel(dwc->regs, DWC3_LLUCTL, reg);
-	}
-
 	return 0;
 
 err_power_off_phy:
@@ -1409,6 +1455,7 @@
 {
 	struct device *dev = dwc->dev;
 	int ret;
+	u32 reg;
 
 	switch (dwc->dr_mode) {
 	case USB_DR_MODE_PERIPHERAL:
@@ -1431,6 +1478,11 @@
 		phy_set_mode(dwc->usb2_generic_phy, PHY_MODE_USB_HOST);
 		phy_set_mode(dwc->usb3_generic_phy, PHY_MODE_USB_HOST);
 
+		if (dwc->dwc3_guctl_resbwhseps_quirk) {
+			reg = dwc3_readl(dwc->regs, DWC3_GUCTL);
+			reg |= DWC3_GUCTL_RESBWHSEPS;
+			dwc3_writel(dwc->regs, DWC3_GUCTL, reg);
+		}
 		ret = dwc3_host_init(dwc);
 		if (ret)
 			return dev_err_probe(dev, ret, "failed to initialize host\n");
@@ -1449,7 +1501,7 @@
 	return 0;
 }
 
-static void dwc3_core_exit_mode(struct dwc3 *dwc)
+void dwc3_core_exit_mode(struct dwc3 *dwc)
 {
 	switch (dwc->dr_mode) {
 	case USB_DR_MODE_PERIPHERAL:
@@ -1469,6 +1521,7 @@
 	/* de-assert DRVVBUS for HOST and OTG mode */
 	dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE);
 }
+EXPORT_SYMBOL_GPL(dwc3_core_exit_mode);
 
 static void dwc3_get_properties(struct dwc3 *dwc)
 {
@@ -1519,6 +1572,8 @@
 	else
 		dwc->sysdev = dwc->dev;
 
+	dwc->sys_wakeup = device_may_wakeup(dwc->sysdev);
+
 	ret = device_property_read_string(dev, "usb-psy-name", &usb_psy_name);
 	if (ret >= 0) {
 		dwc->usb_psy = power_supply_get_by_name(usb_psy_name);
@@ -1608,6 +1663,8 @@
 				"snps,parkmode-disable-hs-quirk");
 	dwc->gfladj_refclk_lpm_sel = device_property_read_bool(dev,
 				"snps,gfladj-refclk-lpm-sel-quirk");
+	dwc->dwc3_guctl_resbwhseps_quirk = device_property_read_bool(dev,
+				"snps,dwc3_guctl_resbwhseps_quirk");
 
 	dwc->tx_de_emphasis_quirk = device_property_read_bool(dev,
 				"snps,tx_de_emphasis_quirk");
@@ -1879,19 +1936,19 @@
 	return 0;
 }
 
-static int dwc3_probe(struct platform_device *pdev)
+int dwc3_probe(struct dwc3 *dwc,
+			struct dwc3_glue_data *glue_data)
 {
-	struct device		*dev = &pdev->dev;
+	struct platform_device	*pdev = to_platform_device(dwc->dev);
+	struct device		*dev = dwc->dev;
 	struct resource		*res, dwc_res;
 	void __iomem		*regs;
-	struct dwc3		*dwc;
 	int			ret;
 
-	dwc = devm_kzalloc(dev, sizeof(*dwc), GFP_KERNEL);
-	if (!dwc)
-		return -ENOMEM;
-
-	dwc->dev = dev;
+	if (glue_data) {
+		dwc->glue_data = glue_data->glue_data;
+		dwc->glue_ops = glue_data->ops;
+	}
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!res) {
@@ -1911,6 +1968,7 @@
 	 */
 	dwc_res = *res;
 	dwc_res.start += DWC3_GLOBALS_REGS_START;
+	dwc_res.end = res->start + DWC3_OTG_REGS_END;
 
 	if (dev->of_node) {
 		struct device_node *parent = of_get_parent(dev->of_node);
@@ -1918,14 +1976,15 @@
 		if (of_device_is_compatible(parent, "realtek,rtd-dwc3")) {
 			dwc_res.start -= DWC3_GLOBALS_REGS_START;
 			dwc_res.start += DWC3_RTK_RTD_GLOBALS_REGS_START;
+			dwc_res.end = dwc_res.start + DWC3_OTG_REGS_END;
 		}
 
 		of_node_put(parent);
 	}
 
 	regs = devm_ioremap_resource(dev, &dwc_res);
-	if (IS_ERR(regs))
-		return PTR_ERR(regs);
+	if (!regs)
+		return -EINVAL;
 
 	dwc->regs	= regs;
 	dwc->regs_size	= resource_size(&dwc_res);
@@ -1956,7 +2015,6 @@
 		goto err_disable_clks;
 	}
 
-	platform_set_drvdata(pdev, dwc);
 	dwc3_cache_hwparams(dwc);
 
 	if (!dwc->sysdev_is_parent &&
@@ -2037,12 +2095,28 @@
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(dwc3_probe);
 
-static void dwc3_remove(struct platform_device *pdev)
+static int dwc3_plat_probe(struct platform_device *pdev)
 {
-	struct dwc3	*dwc = platform_get_drvdata(pdev);
+	struct dwc3 *dwc;
 
-	pm_runtime_get_sync(&pdev->dev);
+	dwc = devm_kzalloc(&pdev->dev, sizeof(*dwc), GFP_KERNEL);
+	if (!dwc)
+		return -ENOMEM;
+
+	dwc->dev = &pdev->dev;
+	platform_set_drvdata(pdev, dwc);
+
+	return dwc3_probe(dwc, NULL);
+}
+
+void dwc3_remove(struct dwc3 *dwc)
+{
+	dwc->glue_data = NULL;
+	dwc->glue_ops = NULL;
+
+	pm_runtime_get_sync(dwc->dev);
 
 	dwc3_core_exit_mode(dwc);
 	dwc3_debugfs_exit(dwc);
@@ -2050,22 +2124,28 @@
 	dwc3_core_exit(dwc);
 	dwc3_ulpi_exit(dwc);
 
-	pm_runtime_allow(&pdev->dev);
-	pm_runtime_disable(&pdev->dev);
-	pm_runtime_dont_use_autosuspend(&pdev->dev);
-	pm_runtime_put_noidle(&pdev->dev);
+	pm_runtime_allow(dwc->dev);
+	pm_runtime_disable(dwc->dev);
+	pm_runtime_dont_use_autosuspend(dwc->dev);
+	pm_runtime_put_noidle(dwc->dev);
 	/*
 	 * HACK: Clear the driver data, which is currently accessed by parent
 	 * glue drivers, before allowing the parent to suspend.
 	 */
-	platform_set_drvdata(pdev, NULL);
-	pm_runtime_set_suspended(&pdev->dev);
+	dev_set_drvdata(dwc->dev, NULL);
+	pm_runtime_set_suspended(dwc->dev);
 
 	dwc3_free_event_buffers(dwc);
 
 	if (dwc->usb_psy)
 		power_supply_put(dwc->usb_psy);
 }
+EXPORT_SYMBOL_GPL(dwc3_remove);
+
+static void dwc3_plat_remove(struct platform_device *pdev)
+{
+	dwc3_remove(platform_get_drvdata(pdev));
+}
 
 #ifdef CONFIG_PM
 static int dwc3_core_init_for_resume(struct dwc3 *dwc)
@@ -2096,9 +2176,21 @@
 
 static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
 {
-	unsigned long	flags;
 	u32 reg;
 
+	if (!pm_runtime_suspended(dwc->dev) && !PMSG_IS_AUTO(msg)) {
+		dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) &
+				    DWC3_GUSB2PHYCFG_SUSPHY) ||
+				    (dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)) &
+				    DWC3_GUSB3PIPECTL_SUSPHY);
+		/*
+		 * TI AM62 platform requires SUSPHY to be
+		 * enabled for system suspend to work.
+		 */
+		if (!dwc->susphy_state)
+			dwc3_enable_susphy(dwc, true);
+	}
+
 	switch (dwc->current_dr_role) {
 	case DWC3_GCTL_PRTCAP_DEVICE:
 		if (pm_runtime_suspended(dwc->dev))
@@ -2134,9 +2226,7 @@
 			break;
 
 		if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
-			spin_lock_irqsave(&dwc->lock, flags);
 			dwc3_gadget_suspend(dwc);
-			spin_unlock_irqrestore(&dwc->lock, flags);
 			synchronize_irq(dwc->irq_gadget);
 		}
 
@@ -2153,7 +2243,6 @@
 
 static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
 {
-	unsigned long	flags;
 	int		ret;
 	u32		reg;
 
@@ -2202,9 +2291,7 @@
 		if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) {
 			dwc3_otg_host_init(dwc);
 		} else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
-			spin_lock_irqsave(&dwc->lock, flags);
 			dwc3_gadget_resume(dwc);
-			spin_unlock_irqrestore(&dwc->lock, flags);
 		}
 
 		break;
@@ -2213,6 +2300,11 @@
 		break;
 	}
 
+	if (!PMSG_IS_AUTO(msg)) {
+		/* restore SUSPHY state to that before system suspend. */
+		dwc3_enable_susphy(dwc, dwc->susphy_state);
+	}
+
 	return 0;
 }
 
@@ -2232,9 +2324,8 @@
 	return 0;
 }
 
-static int dwc3_runtime_suspend(struct device *dev)
+int dwc3_runtime_suspend(struct dwc3 *dwc)
 {
-	struct dwc3     *dwc = dev_get_drvdata(dev);
 	int		ret;
 
 	if (dwc3_runtime_checks(dwc))
@@ -2246,10 +2337,10 @@
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(dwc3_runtime_suspend);
 
-static int dwc3_runtime_resume(struct device *dev)
+int dwc3_runtime_resume(struct dwc3 *dwc)
 {
-	struct dwc3     *dwc = dev_get_drvdata(dev);
 	int		ret;
 
 	ret = dwc3_resume_common(dwc, PMSG_AUTO_RESUME);
@@ -2258,7 +2349,11 @@
 
 	switch (dwc->current_dr_role) {
 	case DWC3_GCTL_PRTCAP_DEVICE:
-		dwc3_gadget_process_pending_events(dwc);
+		if (dwc->pending_events) {
+			pm_runtime_put(dwc->dev);
+			dwc->pending_events = false;
+			enable_irq(dwc->irq_gadget);
+		}
 		break;
 	case DWC3_GCTL_PRTCAP_HOST:
 	default:
@@ -2266,15 +2361,14 @@
 		break;
 	}
 
-	pm_runtime_mark_last_busy(dev);
+	pm_runtime_mark_last_busy(dwc->dev);
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(dwc3_runtime_resume);
 
-static int dwc3_runtime_idle(struct device *dev)
+int dwc3_runtime_idle(struct dwc3 *dwc)
 {
-	struct dwc3     *dwc = dev_get_drvdata(dev);
-
 	switch (dwc->current_dr_role) {
 	case DWC3_GCTL_PRTCAP_DEVICE:
 		if (dwc3_runtime_checks(dwc))
@@ -2286,52 +2380,65 @@
 		break;
 	}
 
-	pm_runtime_mark_last_busy(dev);
-	pm_runtime_autosuspend(dev);
+	pm_runtime_mark_last_busy(dwc->dev);
+	pm_runtime_autosuspend(dwc->dev);
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(dwc3_runtime_idle);
+
+static int dwc3_plat_runtime_suspend(struct device *dev)
+{
+	return dwc3_runtime_suspend(dev_get_drvdata(dev));
+}
+
+static int dwc3_plat_runtime_resume(struct device *dev)
+{
+	return dwc3_runtime_resume(dev_get_drvdata(dev));
+}
+
+static int dwc3_plat_runtime_idle(struct device *dev)
+{
+	return dwc3_runtime_idle(dev_get_drvdata(dev));
+}
 #endif /* CONFIG_PM */
 
 #ifdef CONFIG_PM_SLEEP
-static int dwc3_suspend(struct device *dev)
+int dwc3_suspend(struct dwc3 *dwc)
 {
-	struct dwc3	*dwc = dev_get_drvdata(dev);
 	int		ret;
 
 	ret = dwc3_suspend_common(dwc, PMSG_SUSPEND);
 	if (ret)
 		return ret;
 
-	pinctrl_pm_select_sleep_state(dev);
+	pinctrl_pm_select_sleep_state(dwc->dev);
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(dwc3_suspend);
 
-static int dwc3_resume(struct device *dev)
+int dwc3_resume(struct dwc3 *dwc)
 {
-	struct dwc3	*dwc = dev_get_drvdata(dev);
-	int		ret;
+	int		ret = 0;
 
-	pinctrl_pm_select_default_state(dev);
+	pinctrl_pm_select_default_state(dwc->dev);
 
-	pm_runtime_disable(dev);
-	pm_runtime_set_active(dev);
+	pm_runtime_disable(dwc->dev);
+	pm_runtime_set_active(dwc->dev);
 
 	ret = dwc3_resume_common(dwc, PMSG_RESUME);
-	if (ret) {
-		pm_runtime_set_suspended(dev);
-		return ret;
-	}
+	if (ret)
+		pm_runtime_set_suspended(dwc->dev);
 
-	pm_runtime_enable(dev);
+	pm_runtime_enable(dwc->dev);
 
-	return 0;
+	return ret;
 }
+EXPORT_SYMBOL_GPL(dwc3_resume);
 
-static void dwc3_complete(struct device *dev)
+void dwc3_complete(struct dwc3 *dwc)
 {
-	struct dwc3	*dwc = dev_get_drvdata(dev);
 	u32		reg;
 
 	if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST &&
@@ -2341,15 +2448,37 @@
 		dwc3_writel(dwc->regs, DWC3_GUCTL3, reg);
 	}
 }
+EXPORT_SYMBOL_GPL(dwc3_complete);
+
+static int dwc3_plat_suspend(struct device *dev)
+{
+	return dwc3_suspend(dev_get_drvdata(dev));
+}
+
+static int dwc3_plat_resume(struct device *dev)
+{
+	return dwc3_resume(dev_get_drvdata(dev));
+}
+
+static void dwc3_plat_complete(struct device *dev)
+{
+	dwc3_complete(dev_get_drvdata(dev));
+}
 #else
-#define dwc3_complete NULL
+#define dwc3_plat_complete NULL
 #endif /* CONFIG_PM_SLEEP */
 
 static const struct dev_pm_ops dwc3_dev_pm_ops = {
-	SET_SYSTEM_SLEEP_PM_OPS(dwc3_suspend, dwc3_resume)
-	.complete = dwc3_complete,
-	SET_RUNTIME_PM_OPS(dwc3_runtime_suspend, dwc3_runtime_resume,
-			dwc3_runtime_idle)
+	SET_SYSTEM_SLEEP_PM_OPS(dwc3_plat_suspend, dwc3_plat_resume)
+	.complete = dwc3_plat_complete,
+
+	/*
+	 * Runtime suspend halts the controller on disconnection. It relies on
+	 * platforms with custom connection notification to start the controller
+	 * again.
+	 */
+	SET_RUNTIME_PM_OPS(dwc3_plat_runtime_suspend, dwc3_plat_runtime_resume,
+			   dwc3_plat_runtime_idle)
 };
 
 #ifdef CONFIG_OF
@@ -2377,8 +2506,8 @@
 #endif
 
 static struct platform_driver dwc3_driver = {
-	.probe		= dwc3_probe,
-	.remove_new	= dwc3_remove,
+	.probe		= dwc3_plat_probe,
+	.remove_new	= dwc3_plat_remove,
 	.driver		= {
 		.name	= "dwc3",
 		.of_match_table	= of_match_ptr(of_dwc3_match),
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/core.h
+++ linux-qcom-6.8.0/drivers/usb/dwc3/core.h
@@ -172,8 +172,6 @@
 #define DWC3_OEVTEN		0xcc0C
 #define DWC3_OSTS		0xcc10
 
-#define DWC3_LLUCTL		0xd024
-
 /* Bit fields */
 
 /* Global SoC Bus Configuration INCRx Register 0 */
@@ -272,6 +270,9 @@
 #define DWC3_GUCTL1_PARKMODE_DISABLE_HS		BIT(16)
 #define DWC3_GUCTL1_RESUME_OPMODE_HS_HOST	BIT(10)
 
+/* Global User Control Register */
+#define DWC3_GUCTL_RESBWHSEPS			BIT(16)
+
 /* Global Status Register */
 #define DWC3_GSTS_OTG_IP	BIT(10)
 #define DWC3_GSTS_BC_IP		BIT(9)
@@ -410,6 +411,7 @@
 
 /* Global User Control Register 2 */
 #define DWC3_GUCTL2_RST_ACTBITLATER		BIT(14)
+#define DWC3_GUCTL2_LC_TIMER			BIT(19)
 
 /* Global User Control Register 3 */
 #define DWC3_GUCTL3_SPLITDISABLE		BIT(14)
@@ -452,6 +454,7 @@
 #define DWC3_DCTL_TRGTULST_SS_INACT	(DWC3_DCTL_TRGTULST(6))
 
 /* These apply for core versions 1.94a and later */
+#define DWC3_DCTL_NYET_THRES_MASK	(0xf << 20)
 #define DWC3_DCTL_NYET_THRES(n)		(((n) & 0xf) << 20)
 
 #define DWC3_DCTL_KEEP_CONNECT		BIT(19)
@@ -659,9 +662,6 @@
 #define DWC3_OSTS_VBUSVLD		BIT(1)
 #define DWC3_OSTS_CONIDSTS		BIT(0)
 
-/* Force Gen1 speed on Gen2 link */
-#define DWC3_LLUCTL_FORCE_GEN1		BIT(10)
-
 /* Structures */
 
 struct dwc3_trb;
@@ -755,6 +755,7 @@
 #define DWC3_EP_PENDING_CLEAR_STALL	BIT(11)
 #define DWC3_EP_TXFIFO_RESIZED		BIT(12)
 #define DWC3_EP_DELAY_STOP             BIT(13)
+#define DWC3_EP_RESOURCE_ALLOCATED	BIT(14)
 
 	/* This last one is specific to EP0 */
 #define DWC3_EP0_DIR_IN			BIT(31)
@@ -902,6 +903,7 @@
 #define DWC3_MODE(n)		((n) & 0x7)
 
 /* HWPARAMS1 */
+#define DWC3_SPRAM_TYPE(n)	(((n) >> 23) & 1)
 #define DWC3_NUM_INT(n)		(((n) & (0x3f << 15)) >> 15)
 
 /* HWPARAMS3 */
@@ -912,6 +914,9 @@
 #define DWC3_NUM_IN_EPS(p)	(((p)->hwparams3 &		\
 			(DWC3_NUM_IN_EPS_MASK)) >> 18)
 
+/* HWPARAMS6 */
+#define DWC3_RAM0_DEPTH(n)	(((n) & (0xffff0000)) >> 16)
+
 /* HWPARAMS7 */
 #define DWC3_RAM1_DEPTH(n)	((n) & 0xffff)
 
@@ -978,6 +983,27 @@
 	__le64	dma_adr[DWC3_MAX_HIBER_SCRATCHBUFS];
 };
 
+/*
+ * struct dwc3_glue_ops - The ops indicate the notifications that
+ *				need to be passed on to glue layer.
+ * @notify_cable_disconnect: Notify glue of cable removal
+ *				irrespective of host or device mode.
+ * @set_mode: Notify glue before mode change is about to happen.
+ * @mode_changed: Notify glue that mode change was done successfully
+ */
+struct dwc3_glue_ops {
+	int	(*notify_cable_disconnect)(void *glue_data);
+	void	(*set_mode)(void *glue_data, u32 desired_dr_role);
+	void	(*mode_changed)(void *glue_data, u32 current_dr_role);
+	void    (*notify_run_stop)(void *glue_data, bool enable);
+	void    (*post_conndone)(void *glue_data);
+};
+
+struct dwc3_glue_data {
+	void			*glue_data;
+	struct dwc3_glue_ops	*ops;
+};
+
 /**
  * struct dwc3 - representation of our controller
  * @drd_work: workqueue used for role swapping
@@ -1132,8 +1158,11 @@
  *	3	- Reserved
  * @dis_metastability_quirk: set to disable metastability quirk.
  * @dis_split_quirk: set to disable split boundary.
+ * @sys_wakeup: set if the device may do system wakeup.
  * @wakeup_configured: set if the device is configured for remote wakeup.
  * @suspended: set to track suspend event due to U3/L2.
+ * @susphy_state: state of DWC3_GUSB2PHYCFG_SUSPHY + DWC3_GUSB3PIPECTL_SUSPHY
+ *		  before PM suspend.
  * @imod_interval: set the interrupt moderation interval in 250ns
  *			increments or 0 to disable.
  * @max_cfg_eps: current max number of IN eps used across all USB configs.
@@ -1142,6 +1171,9 @@
  * @num_ep_resized: carries the current number endpoints which have had its tx
  *		    fifo resized.
  * @debug_root: root debugfs directory for this device to put its files in.
+ * @glue_data: Private data stored by core to be passed on to glue during
+ *		role switch notifications.
+ * @glue_ops: Store pointers to glue notifcation callbacks.
  */
 struct dwc3 {
 	struct work_struct	drd_work;
@@ -1248,6 +1280,7 @@
 #define DWC3_REVISION_290A	0x5533290a
 #define DWC3_REVISION_300A	0x5533300a
 #define DWC3_REVISION_310A	0x5533310a
+#define DWC3_REVISION_320A	0x5533320a
 #define DWC3_REVISION_330A	0x5533330a
 
 #define DWC31_REVISION_ANY	0x0
@@ -1257,6 +1290,7 @@
 #define DWC31_REVISION_170A	0x3137302a
 #define DWC31_REVISION_180A	0x3138302a
 #define DWC31_REVISION_190A	0x3139302a
+#define DWC31_REVISION_200A	0x3230302a
 
 #define DWC32_REVISION_ANY	0x0
 #define DWC32_REVISION_100A	0x3130302a
@@ -1355,8 +1389,10 @@
 
 	unsigned		dis_split_quirk:1;
 	unsigned		async_callbacks:1;
+	unsigned		sys_wakeup:1;
 	unsigned		wakeup_configured:1;
 	unsigned		suspended:1;
+	unsigned		susphy_state:1;
 
 	u16			imod_interval;
 
@@ -1364,6 +1400,12 @@
 	int			last_fifo_depth;
 	int			num_ep_resized;
 	struct dentry		*debug_root;
+
+	void			*glue_data;
+	const struct dwc3_glue_ops *glue_ops;
+
+	bool			cable_disconnected;
+	bool			dwc3_guctl_resbwhseps_quirk;
 };
 
 #define INCRX_BURST_MODE 0
@@ -1574,8 +1616,54 @@
 
 int dwc3_event_buffers_setup(struct dwc3 *dwc);
 void dwc3_event_buffers_cleanup(struct dwc3 *dwc);
-
+void dwc3_core_exit_mode(struct dwc3 *dwc);
+void dwc3_free_event_buffers(struct dwc3 *dwc);
 int dwc3_core_soft_reset(struct dwc3 *dwc);
+void dwc3_enable_susphy(struct dwc3 *dwc, bool enable);
+
+int dwc3_probe(struct dwc3 *dwc,
+			struct dwc3_glue_data *glue_data);
+void dwc3_remove(struct dwc3 *dwc);
+
+int dwc3_runtime_suspend(struct dwc3 *dwc);
+int dwc3_runtime_resume(struct dwc3 *dwc);
+int dwc3_runtime_idle(struct dwc3 *dwc);
+int dwc3_suspend(struct dwc3 *dwc);
+int dwc3_resume(struct dwc3 *dwc);
+void dwc3_complete(struct dwc3 *dwc);
+
+static inline int dwc3_notify_cable_disconnect(struct dwc3 *dwc)
+{
+	if (dwc->glue_ops && dwc->glue_ops->notify_cable_disconnect)
+		return dwc->glue_ops->notify_cable_disconnect(dwc->glue_data);
+	return 0;
+}
+
+static inline void dwc3_notify_set_mode(struct dwc3 *dwc,
+					u32 desired_dr_role)
+{
+	if (dwc->glue_ops && dwc->glue_ops->set_mode)
+		dwc->glue_ops->set_mode(dwc->glue_data, desired_dr_role);
+}
+
+static inline void dwc3_notify_mode_changed(struct dwc3 *dwc,
+					    u32 current_dr_role)
+{
+	if (dwc->glue_ops && dwc->glue_ops->mode_changed)
+		dwc->glue_ops->mode_changed(dwc->glue_data, current_dr_role);
+}
+
+static inline void dwc3_notify_run_stop(struct dwc3 *dwc, bool enable)
+{
+	if (dwc->glue_ops && dwc->glue_ops->notify_run_stop)
+		dwc->glue_ops->notify_run_stop(dwc->glue_data, enable);
+}
+
+static inline void dwc3_notify_post_conndone(struct dwc3 *dwc)
+{
+	if (dwc->glue_ops && dwc->glue_ops->post_conndone)
+		dwc->glue_ops->post_conndone(dwc->glue_data);
+}
 
 #if IS_ENABLED(CONFIG_USB_DWC3_HOST) || IS_ENABLED(CONFIG_USB_DWC3_DUAL_ROLE)
 int dwc3_host_init(struct dwc3 *dwc);
@@ -1648,7 +1736,6 @@
 #if !IS_ENABLED(CONFIG_USB_DWC3_HOST)
 int dwc3_gadget_suspend(struct dwc3 *dwc);
 int dwc3_gadget_resume(struct dwc3 *dwc);
-void dwc3_gadget_process_pending_events(struct dwc3 *dwc);
 #else
 static inline int dwc3_gadget_suspend(struct dwc3 *dwc)
 {
@@ -1660,9 +1747,6 @@
 	return 0;
 }
 
-static inline void dwc3_gadget_process_pending_events(struct dwc3 *dwc)
-{
-}
 #endif /* !IS_ENABLED(CONFIG_USB_DWC3_HOST) */
 
 #if IS_ENABLED(CONFIG_USB_DWC3_ULPI)
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/drd.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/drd.c
@@ -445,6 +445,9 @@
 {
 	struct dwc3 *dwc = usb_role_switch_get_drvdata(sw);
 	u32 mode;
+	int ret = 0;
+
+	dwc->cable_disconnected = false;
 
 	switch (role) {
 	case USB_ROLE_HOST:
@@ -461,6 +464,19 @@
 		break;
 	}
 
+	/*
+	 * When cable is removed, the role changes to default mode.
+	 * In the case we are in device mode and removed the cable, the
+	 * glue needs to know that we are disconnected. It must not notify
+	 * the change of mode to default mode.
+	 */
+	if (role == USB_ROLE_NONE) {
+		dwc->cable_disconnected = true;
+		ret = dwc3_notify_cable_disconnect(dwc);
+		if (ret < 0)
+			return ret;
+	}
+
 	dwc3_set_mode(dwc, mode);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/dwc3-am62.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/dwc3-am62.c
@@ -267,21 +267,15 @@
 	return ret;
 }
 
-static int dwc3_ti_remove_core(struct device *dev, void *c)
-{
-	struct platform_device *pdev = to_platform_device(dev);
-
-	platform_device_unregister(pdev);
-	return 0;
-}
-
 static void dwc3_ti_remove(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct dwc3_am62 *am62 = platform_get_drvdata(pdev);
 	u32 reg;
 
-	device_for_each_child(dev, NULL, dwc3_ti_remove_core);
+	pm_runtime_get_sync(dev);
+	device_init_wakeup(dev, false);
+	of_platform_depopulate(dev);
 
 	/* Clear mode valid bit */
 	reg = dwc3_ti_readl(am62, USBSS_MODE_CONTROL);
@@ -289,8 +283,8 @@
 	dwc3_ti_writel(am62, USBSS_MODE_CONTROL, reg);
 
 	pm_runtime_put_sync(dev);
-	clk_disable_unprepare(am62->usb2_refclk);
 	pm_runtime_disable(dev);
+	pm_runtime_dont_use_autosuspend(dev);
 	pm_runtime_set_suspended(dev);
 }
 
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/dwc3-omap.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/dwc3-omap.c
@@ -522,11 +522,13 @@
 	if (ret) {
 		dev_err(dev, "failed to request IRQ #%d --> %d\n",
 			omap->irq, ret);
-		goto err1;
+		goto err2;
 	}
 	dwc3_omap_enable_irqs(omap);
 	return 0;
 
+err2:
+	of_platform_depopulate(dev);
 err1:
 	pm_runtime_put_sync(dev);
 	pm_runtime_disable(dev);
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/dwc3-pci.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/dwc3-pci.c
@@ -8,6 +8,7 @@
  *	    Sebastian Andrzej Siewior <bigeasy@linutronix.de>
  */
 
+#include <linux/dmi.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -51,9 +52,12 @@
 #define PCI_DEVICE_ID_INTEL_MTLP		0x7ec1
 #define PCI_DEVICE_ID_INTEL_MTLS		0x7f6f
 #define PCI_DEVICE_ID_INTEL_MTL			0x7e7e
-#define PCI_DEVICE_ID_INTEL_ARLH		0x7ec1
 #define PCI_DEVICE_ID_INTEL_ARLH_PCH		0x777e
 #define PCI_DEVICE_ID_INTEL_TGL			0x9a15
+#define PCI_DEVICE_ID_INTEL_PTLH		0xe332
+#define PCI_DEVICE_ID_INTEL_PTLH_PCH		0xe37e
+#define PCI_DEVICE_ID_INTEL_PTLU		0xe432
+#define PCI_DEVICE_ID_INTEL_PTLU_PCH		0xe47e
 #define PCI_DEVICE_ID_AMD_MR			0x163a
 
 #define PCI_INTEL_BXT_DSM_GUID		"732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
@@ -221,6 +225,7 @@
 
 		if (pdev->device == PCI_DEVICE_ID_INTEL_BYT) {
 			struct gpio_desc *gpio;
+			const char *bios_ver;
 			int ret;
 
 			/* On BYT the FW does not always enable the refclock */
@@ -278,8 +283,12 @@
 			 * detection. These can be identified by them _not_
 			 * using the standard ACPI battery and ac drivers.
 			 */
+			bios_ver = dmi_get_system_info(DMI_BIOS_VERSION);
 			if (acpi_dev_present("INT33FD", "1", 2) &&
-			    acpi_quirk_skip_acpi_ac_and_battery()) {
+			    acpi_quirk_skip_acpi_ac_and_battery() &&
+			    /* Lenovo Yoga Tablet 2 Pro 1380 uses LC824206XA instead */
+			    !(bios_ver &&
+			      strstarts(bios_ver, "BLADE_21.X64.0005.R00.1504101516"))) {
 				dev_info(&pdev->dev, "Using TUSB1211 phy for charger detection\n");
 				swnode = &dwc3_pci_intel_phy_charger_detect_swnode;
 			}
@@ -423,9 +432,12 @@
 	{ PCI_DEVICE_DATA(INTEL, MTLP, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, MTL, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, MTLS, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, ARLH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, ARLH_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, TGL, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, PTLH, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, PTLH_PCH, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, PTLU, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, PTLU_PCH, &dwc3_pci_intel_swnode) },
 
 	{ PCI_DEVICE_DATA(AMD, NL_USB, &dwc3_pci_amd_swnode) },
 	{ PCI_DEVICE_DATA(AMD, MR, &dwc3_pci_amd_mr_swnode) },
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/dwc3-qcom.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/dwc3-qcom.c
@@ -49,14 +49,13 @@
 #define USB_MEMORY_AVG_HS_BW MBps_to_icc(240)
 #define USB_MEMORY_PEAK_HS_BW MBps_to_icc(700)
 #define USB_MEMORY_AVG_SS_BW  MBps_to_icc(1000)
-#define USB_MEMORY_PEAK_SS_BW MBps_to_icc(2500)
+#define USB_MEMORY_PEAK_SS_BW MBps_to_icc(3500)
 #define APPS_USB_AVG_BW 0
 #define APPS_USB_PEAK_BW MBps_to_icc(40)
 
+#define dwc3_to_qcom(dwc)	container_of(dwc, struct dwc3 *, dwc)
+
 struct dwc3_acpi_pdata {
-	u32			qscratch_base_offset;
-	u32			qscratch_base_size;
-	u32			dwc3_core_base_size;
 	int			qusb2_phy_irq_index;
 	int			dp_hs_phy_irq_index;
 	int			dm_hs_phy_irq_index;
@@ -67,13 +66,18 @@
 struct dwc3_qcom {
 	struct device		*dev;
 	void __iomem		*qscratch_base;
-	struct platform_device	*dwc3;
-	struct platform_device	*urs_usb;
+	struct platform_device	*dwc_dev; /* only used when core is separate device */
+	struct dwc3		dwc; /* not used when core is separate device */
 	struct clk		**clks;
 	int			num_clocks;
 	struct reset_control	*resets;
 
 	int			qusb2_phy_irq;
+
+	/* VBUS regulator for host mode */
+	struct regulator	*vbus_reg;
+	bool			is_vbus_enabled;
+
 	int			dp_hs_phy_irq;
 	int			dm_hs_phy_irq;
 	int			ss_phy_irq;
@@ -91,6 +95,10 @@
 	bool			pm_suspended;
 	struct icc_path		*icc_path_ddr;
 	struct icc_path		*icc_path_apps;
+
+	bool			enable_rt;
+	enum usb_role		current_role;
+	struct notifier_block	xhci_nb;
 };
 
 static inline void dwc3_qcom_setbits(void __iomem *base, u32 offset, u32 val)
@@ -236,6 +244,16 @@
 	return ret;
 }
 
+static bool dwc3_qcom_has_separate_dwc3_of_node(struct device *dev)
+{
+	struct device_node *np;
+
+	np = of_get_compatible_child(dev->of_node, "snps,dwc3");
+	of_node_put(np);
+
+	return !!np;
+}
+
 /**
  * dwc3_qcom_interconnect_init() - Get interconnect path handles
  * and set bandwidth.
@@ -246,11 +264,14 @@
 {
 	enum usb_device_speed max_speed;
 	struct device *dev = qcom->dev;
+	bool legacy_binding;
 	int ret;
 
 	if (has_acpi_companion(dev))
 		return 0;
 
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(qcom->dev);
+
 	qcom->icc_path_ddr = of_icc_get(dev, "usb-ddr");
 	if (IS_ERR(qcom->icc_path_ddr)) {
 		return dev_err_probe(dev, PTR_ERR(qcom->icc_path_ddr),
@@ -264,7 +285,11 @@
 		goto put_path_ddr;
 	}
 
-	max_speed = usb_get_maximum_speed(&qcom->dwc3->dev);
+	if (legacy_binding)
+		max_speed = usb_get_maximum_speed(&qcom->dwc_dev->dev);
+	else
+		max_speed = usb_get_maximum_speed(qcom->dev);
+
 	if (max_speed >= USB_SPEED_SUPER || max_speed == USB_SPEED_UNKNOWN) {
 		ret = icc_set_bw(qcom->icc_path_ddr,
 				USB_MEMORY_AVG_SS_BW, USB_MEMORY_PEAK_SS_BW);
@@ -307,12 +332,16 @@
 /* Only usable in contexts where the role can not change. */
 static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom)
 {
+	bool legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(qcom->dev);
 	struct dwc3 *dwc;
 
 	/*
 	 * FIXME: Fix this layering violation.
 	 */
-	dwc = platform_get_drvdata(qcom->dwc3);
+	if (legacy_binding)
+		dwc = platform_get_drvdata(qcom->dwc_dev);
+	else
+		dwc = &qcom->dwc;
 
 	/* Core driver may not have probed yet. */
 	if (!dwc)
@@ -323,9 +352,15 @@
 
 static enum usb_device_speed dwc3_qcom_read_usb2_speed(struct dwc3_qcom *qcom)
 {
-	struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3);
-	struct usb_device *udev;
+	bool legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(qcom->dev);
 	struct usb_hcd __maybe_unused *hcd;
+	struct usb_device *udev;
+	struct dwc3 *dwc;
+
+	if (legacy_binding)
+		dwc = platform_get_drvdata(qcom->dwc_dev);
+	else
+		dwc = &qcom->dwc;
 
 	/*
 	 * FIXME: Fix this layering violation.
@@ -417,6 +452,20 @@
 	dwc3_qcom_enable_wakeup_irq(qcom->ss_phy_irq, 0);
 }
 
+static void dwc3_qcom_vbus_regulator_enable(struct dwc3_qcom *qcom, bool on)
+{
+	if (!qcom->vbus_reg)
+		return;
+
+	if (!qcom->is_vbus_enabled && on) {
+		regulator_enable(qcom->vbus_reg);
+		qcom->is_vbus_enabled = true;
+	} else if (qcom->is_vbus_enabled && !on) {
+		regulator_disable(qcom->vbus_reg);
+		qcom->is_vbus_enabled = false;
+	}
+}
+
 static int dwc3_qcom_suspend(struct dwc3_qcom *qcom, bool wakeup)
 {
 	u32 val;
@@ -446,18 +495,28 @@
 	}
 
 	qcom->is_suspended = true;
+	pm_relax(qcom->dev);
 
 	return 0;
 }
 
 static int dwc3_qcom_resume(struct dwc3_qcom *qcom, bool wakeup)
 {
+	bool legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(qcom->dev);
 	int ret;
 	int i;
 
 	if (!qcom->is_suspended)
 		return 0;
 
+	pm_stay_awake(qcom->dev);
+
+	if (!legacy_binding) {
+		ret = reset_control_deassert(qcom->dwc.reset);
+		if (ret)
+			return ret;
+	}
+
 	if (dwc3_qcom_is_host(qcom) && wakeup)
 		dwc3_qcom_disable_interrupts(qcom);
 
@@ -486,12 +545,20 @@
 static irqreturn_t qcom_dwc3_resume_irq(int irq, void *data)
 {
 	struct dwc3_qcom *qcom = data;
-	struct dwc3	*dwc = platform_get_drvdata(qcom->dwc3);
+	bool legacy_binding;
+	struct dwc3 *dwc;
+
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(qcom->dev);
 
 	/* If pm_suspended then let pm_resume take care of resuming h/w */
 	if (qcom->pm_suspended)
 		return IRQ_HANDLED;
 
+	if (legacy_binding)
+		dwc = platform_get_drvdata(qcom->dwc_dev);
+	else
+		dwc = &qcom->dwc;
+
 	/*
 	 * This is safe as role switching is done from a freezable workqueue
 	 * and the wakeup interrupts are disabled as part of resume.
@@ -522,26 +589,43 @@
 static int dwc3_qcom_get_irq(struct platform_device *pdev,
 			     const char *name, int num)
 {
-	struct dwc3_qcom *qcom = platform_get_drvdata(pdev);
-	struct platform_device *pdev_irq = qcom->urs_usb ? qcom->urs_usb : pdev;
 	struct device_node *np = pdev->dev.of_node;
 	int ret;
 
 	if (np)
-		ret = platform_get_irq_byname_optional(pdev_irq, name);
+		ret = platform_get_irq_byname_optional(pdev, name);
 	else
-		ret = platform_get_irq_optional(pdev_irq, num);
+		ret = platform_get_irq_optional(pdev, num);
 
 	return ret;
 }
 
+static struct dwc3_qcom *get_dwc3_qcom(struct device *dev)
+{
+	bool legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(dev);
+	struct dwc3_qcom *qcom;
+	struct dwc3 *dwc;
+
+	if (!legacy_binding) {
+		dwc = dev_get_drvdata(dev);
+		qcom = container_of(dwc, struct dwc3_qcom, dwc);
+	} else {
+		qcom = dev_get_drvdata(dev);
+	}
+
+	return qcom;
+}
+
 static int dwc3_qcom_setup_irq(struct platform_device *pdev)
 {
-	struct dwc3_qcom *qcom = platform_get_drvdata(pdev);
-	const struct dwc3_acpi_pdata *pdata = qcom->acpi_pdata;
+	const struct dwc3_acpi_pdata *pdata;
+	struct dwc3_qcom *qcom;
 	int irq;
 	int ret;
 
+	qcom = get_dwc3_qcom(&pdev->dev);
+	pdata = qcom->acpi_pdata;
+
 	irq = dwc3_qcom_get_irq(pdev, "qusb2_phy",
 				pdata ? pdata->qusb2_phy_irq_index : -1);
 	if (irq > 0) {
@@ -658,77 +742,134 @@
 	.properties = dwc3_qcom_acpi_properties,
 };
 
-static int dwc3_qcom_acpi_register_core(struct platform_device *pdev)
+static int dwc3_xhci_event_notifier(struct notifier_block *nb,
+				    unsigned long event, void *ptr)
 {
-	struct dwc3_qcom	*qcom = platform_get_drvdata(pdev);
-	struct device		*dev = &pdev->dev;
-	struct resource		*res, *child_res = NULL;
-	struct platform_device	*pdev_irq = qcom->urs_usb ? qcom->urs_usb :
-							    pdev;
-	int			irq;
-	int			ret;
+	struct usb_device *udev = ptr;
 
-	qcom->dwc3 = platform_device_alloc("dwc3", PLATFORM_DEVID_AUTO);
-	if (!qcom->dwc3)
-		return -ENOMEM;
+	if (event != USB_DEVICE_ADD)
+		return NOTIFY_DONE;
 
-	qcom->dwc3->dev.parent = dev;
-	qcom->dwc3->dev.type = dev->type;
-	qcom->dwc3->dev.dma_mask = dev->dma_mask;
-	qcom->dwc3->dev.dma_parms = dev->dma_parms;
-	qcom->dwc3->dev.coherent_dma_mask = dev->coherent_dma_mask;
-
-	child_res = kcalloc(2, sizeof(*child_res), GFP_KERNEL);
-	if (!child_res) {
-		platform_device_put(qcom->dwc3);
-		return -ENOMEM;
+	/*
+	 * If this is a roothub corresponding to this controller, enable autosuspend
+	 */
+	if (!udev->parent) {
+		pm_runtime_use_autosuspend(&udev->dev);
+		pm_runtime_set_autosuspend_delay(&udev->dev, 1000);
 	}
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	if (!res) {
-		dev_err(&pdev->dev, "failed to get memory resource\n");
-		ret = -ENODEV;
-		goto out;
-	}
+	usb_mark_last_busy(udev);
 
-	child_res[0].flags = res->flags;
-	child_res[0].start = res->start;
-	child_res[0].end = child_res[0].start +
-		qcom->acpi_pdata->dwc3_core_base_size;
+	return NOTIFY_DONE;
+}
 
-	irq = platform_get_irq(pdev_irq, 0);
-	if (irq < 0) {
-		ret = irq;
-		goto out;
-	}
-	child_res[1].flags = IORESOURCE_IRQ;
-	child_res[1].start = child_res[1].end = irq;
+static int dwc3_qcom_handle_cable_disconnect(void *data)
+{
+	struct dwc3_qcom *qcom = (struct dwc3_qcom *)data;
+	int ret = 0;
 
-	ret = platform_device_add_resources(qcom->dwc3, child_res, 2);
-	if (ret) {
-		dev_err(&pdev->dev, "failed to add resources\n");
-		goto out;
+	/*
+	 * If we are in device mode and get a cable disconnect,
+	 * handle it by clearing OTG_VBUS_VALID bit in wrapper.
+	 * The next set_mode to default role can be ignored.
+	 */
+	if (qcom->current_role == USB_ROLE_DEVICE) {
+		ret = pm_runtime_get_sync(qcom->dev);
+		if ((ret < 0) || (qcom->is_suspended))
+			return ret;
+		dwc3_qcom_vbus_override_enable(qcom, false);
+		pm_runtime_put_autosuspend(qcom->dev);
+	} else if (qcom->current_role == USB_ROLE_HOST) {
+		dwc3_qcom_vbus_regulator_enable(qcom, false);
+		usb_unregister_notify(&qcom->xhci_nb);
 	}
 
-	ret = device_add_software_node(&qcom->dwc3->dev, &dwc3_qcom_swnode);
-	if (ret < 0) {
-		dev_err(&pdev->dev, "failed to add properties\n");
-		goto out;
+	pm_runtime_mark_last_busy(qcom->dev);
+	qcom->current_role = USB_ROLE_NONE;
+
+	return 0;
+}
+
+static void dwc3_qcom_handle_set_mode(void *data, u32 desired_dr_role)
+{
+	struct dwc3_qcom *qcom = (struct dwc3_qcom *)data;
+
+	/*
+	 * If we are in device mode and get a cable disconnect,
+	 * handle it by clearing OTG_VBUS_VALID bit in wrapper.
+	 * The next set_mode to default role can be ignored and
+	 * so the OTG_VBUS_VALID should be set iff the current role
+	 * is NONE and we need to enter DEVICE mode.
+	 */
+	if ((qcom->current_role == USB_ROLE_NONE) &&
+	    (desired_dr_role == DWC3_GCTL_PRTCAP_DEVICE)) {
+		dwc3_qcom_vbus_override_enable(qcom, true);
+		qcom->current_role = USB_ROLE_DEVICE;
+	} else if ((desired_dr_role == DWC3_GCTL_PRTCAP_HOST) &&
+		   (qcom->current_role != USB_ROLE_HOST)) {
+		qcom->xhci_nb.notifier_call = dwc3_xhci_event_notifier;
+		usb_register_notify(&qcom->xhci_nb);
+		qcom->current_role = USB_ROLE_HOST;
+		dwc3_qcom_vbus_regulator_enable(qcom, true);
 	}
 
-	ret = platform_device_add(qcom->dwc3);
-	if (ret) {
-		dev_err(&pdev->dev, "failed to add device\n");
-		device_remove_software_node(&qcom->dwc3->dev);
-		goto out;
+	pm_runtime_mark_last_busy(qcom->dev);
+}
+
+static void dwc3_qcom_handle_mode_changed(void *data, u32 current_dr_role)
+{
+	struct dwc3_qcom *qcom = (struct dwc3_qcom *)data;
+
+	/*
+	 * XHCI platform device is allocated upon host init.
+	 * So ensure we are in host mode before enabling autosuspend.
+	 */
+	if ((current_dr_role == DWC3_GCTL_PRTCAP_HOST) &&
+	    (qcom->current_role == USB_ROLE_HOST)) {
+		pm_runtime_use_autosuspend(&qcom->dwc.xhci->dev);
+		pm_runtime_set_autosuspend_delay(&qcom->dwc.xhci->dev, 0);
 	}
-	kfree(child_res);
-	return 0;
+}
 
-out:
-	platform_device_put(qcom->dwc3);
-	kfree(child_res);
-	return ret;
+static void dwc3_post_conndone_notification(void *data)
+{
+	struct dwc3_qcom *qcom = (struct dwc3_qcom *)data;
+
+	qcom->dwc.cable_disconnected = false;
+	qcom->current_role = USB_ROLE_DEVICE;
+}
+
+static void dwc3_qcom_handle_run_stop_notification(void *data, bool enable)
+{
+	struct dwc3_qcom *qcom = (struct dwc3_qcom *)data;
+
+	if (enable)
+		dwc3_qcom_vbus_override_enable(qcom, true);
+}
+
+struct dwc3_glue_ops dwc3_qcom_glue_hooks = {
+	.notify_cable_disconnect = dwc3_qcom_handle_cable_disconnect,
+	.set_mode = dwc3_qcom_handle_set_mode,
+	.mode_changed = dwc3_qcom_handle_mode_changed,
+	.notify_run_stop = dwc3_qcom_handle_run_stop_notification,
+	.post_conndone = dwc3_post_conndone_notification,
+};
+
+static int dwc3_qcom_probe_core(struct platform_device *pdev, struct dwc3_qcom *qcom)
+{
+	int ret;
+
+	struct dwc3_glue_data qcom_glue_data = {
+		.glue_data	= qcom,
+		.ops		= &dwc3_qcom_glue_hooks,
+	};
+
+	ret = dwc3_probe(&qcom->dwc,
+			 qcom->enable_rt ? &qcom_glue_data : NULL);
+	if (ret)
+		return ret;
+
+	return 0;
 }
 
 static int dwc3_qcom_of_register_core(struct platform_device *pdev)
@@ -750,11 +891,10 @@
 		goto node_put;
 	}
 
-	qcom->dwc3 = of_find_device_by_node(dwc3_np);
-	if (!qcom->dwc3) {
+	qcom->dwc_dev = of_find_device_by_node(dwc3_np);
+	if (!qcom->dwc_dev) {
 		ret = -ENODEV;
 		dev_err(dev, "failed to get dwc3 platform device\n");
-		of_platform_depopulate(dev);
 	}
 
 node_put:
@@ -763,48 +903,90 @@
 	return ret;
 }
 
-static struct platform_device *dwc3_qcom_create_urs_usb_platdev(struct device *dev)
+static int dwc3_qcom_acpi_merge_urs_resources(struct platform_device *pdev)
 {
-	struct platform_device *urs_usb = NULL;
+	struct device *dev = &pdev->dev;
+	struct list_head resource_list;
+	struct resource_entry *rentry;
+	struct resource *resources;
 	struct fwnode_handle *fwh;
 	struct acpi_device *adev;
 	char name[8];
+	int count;
 	int ret;
 	int id;
+	int i;
 
 	/* Figure out device id */
 	ret = sscanf(fwnode_get_name(dev->fwnode), "URS%d", &id);
 	if (!ret)
-		return NULL;
+		return -EINVAL;
 
 	/* Find the child using name */
 	snprintf(name, sizeof(name), "USB%d", id);
 	fwh = fwnode_get_named_child_node(dev->fwnode, name);
 	if (!fwh)
-		return NULL;
+		return 0;
 
 	adev = to_acpi_device_node(fwh);
 	if (!adev)
-		goto err_put_handle;
+		return -EINVAL;
+
+	INIT_LIST_HEAD(&resource_list);
+
+	count = acpi_dev_get_resources(adev, &resource_list, NULL, NULL);
+	if (count <= 0)
+		return count;
+
+	count += pdev->num_resources;
+
+	resources = kcalloc(count, sizeof(*resources), GFP_KERNEL);
+	if (!resources) {
+		acpi_dev_free_resource_list(&resource_list);
+		return -ENOMEM;
+	}
 
-	urs_usb = acpi_create_platform_device(adev, NULL);
-	if (IS_ERR_OR_NULL(urs_usb))
-		goto err_put_handle;
+	memcpy(resources, pdev->resource, sizeof(struct resource) * pdev->num_resources);
+	count = pdev->num_resources;
+	list_for_each_entry(rentry, &resource_list, node) {
+		/* Avoid inserting duplicate entries, in case this is called more than once */
+		for (i = 0; i < count; i++) {
+			if (resource_type(&resources[i]) == resource_type(rentry->res) &&
+			    resources[i].start == rentry->res->start &&
+			    resources[i].end == rentry->res->end)
+				break;
+		}
 
-	return urs_usb;
+		if (i == count)
+			resources[count++] = *rentry->res;
+	}
 
-err_put_handle:
-	fwnode_handle_put(fwh);
+	ret = platform_device_add_resources(pdev, resources, count);
+	if (ret)
+		dev_err(&pdev->dev, "failed to add resources\n");
+
+	acpi_dev_free_resource_list(&resource_list);
+	kfree(resources);
 
-	return urs_usb;
+	return ret;
 }
 
-static void dwc3_qcom_destroy_urs_usb_platdev(struct platform_device *urs_usb)
+static void dwc3_qcom_vbus_regulator_get(struct dwc3_qcom *qcom)
 {
-	struct fwnode_handle *fwh = urs_usb->dev.fwnode;
-
-	platform_device_unregister(urs_usb);
-	fwnode_handle_put(fwh);
+	/*
+	 * The vbus_reg pointer could have multiple values
+	 * NULL: regulator_get() hasn't been called, or was previously deferred
+	 * IS_ERR: regulator could not be obtained, so skip using it
+	 * Valid pointer otherwise
+	 */
+	qcom->vbus_reg = devm_regulator_get_optional(qcom->dev,
+						"vbus_dwc3");
+	if (IS_ERR(qcom->vbus_reg)) {
+		dev_err(qcom->dev, "Unable to get vbus regulator err: %ld\n",
+							PTR_ERR(qcom->vbus_reg));
+		qcom->vbus_reg = NULL;
+		return;
+	}
 }
 
 static int dwc3_qcom_probe(struct platform_device *pdev)
@@ -817,13 +999,21 @@
 	int			ret, i;
 	bool			ignore_pipe_clk;
 	bool			wakeup_source;
+	bool			legacy_binding;
 
 	qcom = devm_kzalloc(&pdev->dev, sizeof(*qcom), GFP_KERNEL);
 	if (!qcom)
 		return -ENOMEM;
 
-	platform_set_drvdata(pdev, qcom);
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(dev);
+
+	if (!legacy_binding)
+		platform_set_drvdata(pdev, &qcom->dwc);
+	else
+		platform_set_drvdata(pdev, qcom);
+
 	qcom->dev = &pdev->dev;
+	qcom->dwc.dev = qcom->dev;
 
 	if (has_acpi_companion(dev)) {
 		qcom->acpi_pdata = acpi_device_get_match_data(dev);
@@ -831,26 +1021,40 @@
 			dev_err(&pdev->dev, "no supporting ACPI device data\n");
 			return -EINVAL;
 		}
-	}
 
-	qcom->resets = devm_reset_control_array_get_optional_exclusive(dev);
-	if (IS_ERR(qcom->resets)) {
-		return dev_err_probe(&pdev->dev, PTR_ERR(qcom->resets),
-				     "failed to get resets\n");
-	}
+		ret = device_add_software_node(&pdev->dev, &dwc3_qcom_swnode);
+		if (ret < 0) {
+			dev_err(&pdev->dev, "failed to add properties\n");
+			return ret;
+		}
 
-	ret = reset_control_assert(qcom->resets);
-	if (ret) {
-		dev_err(&pdev->dev, "failed to assert resets, err=%d\n", ret);
-		return ret;
+		if (qcom->acpi_pdata->is_urs) {
+			ret = dwc3_qcom_acpi_merge_urs_resources(pdev);
+			if (ret < 0)
+				goto clk_disable;
+		}
 	}
 
-	usleep_range(10, 1000);
+	if (legacy_binding) {
+		qcom->resets = devm_reset_control_array_get_optional_exclusive(dev);
+		if (IS_ERR(qcom->resets)) {
+			return dev_err_probe(&pdev->dev, PTR_ERR(qcom->resets),
+					     "failed to get resets\n");
+		}
 
-	ret = reset_control_deassert(qcom->resets);
-	if (ret) {
-		dev_err(&pdev->dev, "failed to deassert resets, err=%d\n", ret);
-		goto reset_assert;
+		ret = reset_control_assert(qcom->resets);
+		if (ret) {
+			dev_err(&pdev->dev, "failed to assert resets, err=%d\n", ret);
+			return ret;
+		}
+
+		usleep_range(10, 1000);
+
+		ret = reset_control_deassert(qcom->resets);
+		if (ret) {
+			dev_err(&pdev->dev, "failed to deassert resets, err=%d\n", ret);
+			goto reset_assert;
+		}
 	}
 
 	ret = dwc3_qcom_clk_init(qcom, of_clk_get_parent_count(np));
@@ -861,40 +1065,26 @@
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 
-	if (np) {
+	if (legacy_binding) {
 		parent_res = res;
 	} else {
 		memcpy(&local_res, res, sizeof(struct resource));
 		parent_res = &local_res;
 
-		parent_res->start = res->start +
-			qcom->acpi_pdata->qscratch_base_offset;
-		parent_res->end = parent_res->start +
-			qcom->acpi_pdata->qscratch_base_size;
-
-		if (qcom->acpi_pdata->is_urs) {
-			qcom->urs_usb = dwc3_qcom_create_urs_usb_platdev(dev);
-			if (IS_ERR_OR_NULL(qcom->urs_usb)) {
-				dev_err(dev, "failed to create URS USB platdev\n");
-				if (!qcom->urs_usb)
-					ret = -ENODEV;
-				else
-					ret = PTR_ERR(qcom->urs_usb);
-				goto clk_disable;
-			}
-		}
+		parent_res->start = res->start + SDM845_QSCRATCH_BASE_OFFSET;
+		parent_res->end = parent_res->start + SDM845_QSCRATCH_SIZE;
 	}
 
 	qcom->qscratch_base = devm_ioremap_resource(dev, parent_res);
 	if (IS_ERR(qcom->qscratch_base)) {
 		ret = PTR_ERR(qcom->qscratch_base);
-		goto free_urs;
+		goto clk_disable;
 	}
 
 	ret = dwc3_qcom_setup_irq(pdev);
 	if (ret) {
 		dev_err(dev, "failed to setup IRQs, err=%d\n", ret);
-		goto free_urs;
+		goto clk_disable;
 	}
 
 	/*
@@ -906,55 +1096,79 @@
 	if (ignore_pipe_clk)
 		dwc3_qcom_select_utmi_clk(qcom);
 
-	if (np)
+	qcom->enable_rt = device_property_read_bool(dev,
+				"qcom,enable-rt");
+	if (!legacy_binding) {
+		/*
+		 * If we are enabling runtime, then we are using flattened
+		 * device implementation.
+		 */
+		qcom->mode = usb_get_dr_mode(dev);
+
+		if (qcom->mode == USB_DR_MODE_HOST)
+			qcom->current_role = USB_ROLE_HOST;
+		else if (qcom->mode == USB_DR_MODE_PERIPHERAL)
+			qcom->current_role = USB_ROLE_DEVICE;
+		else
+			qcom->current_role = USB_ROLE_NONE;
+	}
+
+	if (legacy_binding)
 		ret = dwc3_qcom_of_register_core(pdev);
 	else
-		ret = dwc3_qcom_acpi_register_core(pdev);
+		ret = dwc3_qcom_probe_core(pdev, qcom);
 
 	if (ret) {
 		dev_err(dev, "failed to register DWC3 Core, err=%d\n", ret);
-		goto free_urs;
+		goto clk_disable;
 	}
 
 	ret = dwc3_qcom_interconnect_init(qcom);
 	if (ret)
 		goto depopulate;
 
-	qcom->mode = usb_get_dr_mode(&qcom->dwc3->dev);
+	if (legacy_binding) {
+		qcom->mode = usb_get_dr_mode(&qcom->dwc_dev->dev);
 
-	/* enable vbus override for device mode */
-	if (qcom->mode != USB_DR_MODE_HOST)
-		dwc3_qcom_vbus_override_enable(qcom, true);
+		/* enable vbus override for device mode */
+		if (qcom->mode != USB_DR_MODE_HOST)
+			dwc3_qcom_vbus_override_enable(qcom, true);
 
-	/* register extcon to override sw_vbus on Vbus change later */
-	ret = dwc3_qcom_register_extcon(qcom);
-	if (ret)
-		goto interconnect_exit;
+		/* register extcon to override sw_vbus on Vbus change later */
+		ret = dwc3_qcom_register_extcon(qcom);
+		if (ret)
+			goto interconnect_exit;
+	}
+
+	dwc3_qcom_vbus_regulator_get(qcom);
+
+	if (qcom->mode == USB_DR_MODE_HOST) {
+		dwc3_qcom_vbus_regulator_enable(qcom, true);
+		qcom->is_vbus_enabled = true;
+	}
 
 	wakeup_source = of_property_read_bool(dev->of_node, "wakeup-source");
 	device_init_wakeup(&pdev->dev, wakeup_source);
-	device_init_wakeup(&qcom->dwc3->dev, wakeup_source);
 
 	qcom->is_suspended = false;
-	pm_runtime_set_active(dev);
-	pm_runtime_enable(dev);
-	pm_runtime_forbid(dev);
+
+	if (legacy_binding) {
+		device_init_wakeup(&qcom->dwc_dev->dev, wakeup_source);
+		pm_runtime_set_active(dev);
+		pm_runtime_enable(dev);
+		pm_runtime_forbid(dev);
+	}
 
 	return 0;
 
 interconnect_exit:
 	dwc3_qcom_interconnect_exit(qcom);
 depopulate:
-	if (np) {
+	platform_set_drvdata(pdev, NULL);
+	if (legacy_binding)
 		of_platform_depopulate(&pdev->dev);
-	} else {
-		device_remove_software_node(&qcom->dwc3->dev);
-		platform_device_del(qcom->dwc3);
-	}
-	platform_device_put(qcom->dwc3);
-free_urs:
-	if (qcom->urs_usb)
-		dwc3_qcom_destroy_urs_usb_platdev(qcom->urs_usb);
+	else
+		dwc3_remove(&qcom->dwc);
 clk_disable:
 	for (i = qcom->num_clocks - 1; i >= 0; i--) {
 		clk_disable_unprepare(qcom->clks[i]);
@@ -968,21 +1182,57 @@
 
 static void dwc3_qcom_remove(struct platform_device *pdev)
 {
-	struct dwc3_qcom *qcom = platform_get_drvdata(pdev);
 	struct device_node *np = pdev->dev.of_node;
 	struct device *dev = &pdev->dev;
+	struct dwc3_qcom *qcom;
+	bool legacy_binding;
 	int i;
 
-	if (np) {
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(dev);
+	qcom = get_dwc3_qcom(dev);
+
+	if (!legacy_binding)
+		dwc3_remove(&qcom->dwc);
+	else
+		device_remove_software_node(&qcom->dwc_dev->dev);
+
+	if (np)
 		of_platform_depopulate(&pdev->dev);
-	} else {
-		device_remove_software_node(&qcom->dwc3->dev);
-		platform_device_del(qcom->dwc3);
+	else
+		platform_device_put(pdev);
+
+	for (i = qcom->num_clocks - 1; i >= 0; i--) {
+		clk_disable_unprepare(qcom->clks[i]);
+		clk_put(qcom->clks[i]);
 	}
-	platform_device_put(qcom->dwc3);
+	qcom->num_clocks = 0;
 
-	if (qcom->urs_usb)
-		dwc3_qcom_destroy_urs_usb_platdev(qcom->urs_usb);
+	dwc3_qcom_interconnect_exit(qcom);
+	reset_control_assert(qcom->resets);
+
+	if (qcom->dwc_dev) {
+		pm_runtime_allow(dev);
+		pm_runtime_disable(dev);
+	}
+}
+
+static void dwc3_qcom_shutdown(struct platform_device *pdev)
+{
+	struct device_node *np = pdev->dev.of_node;
+	struct device *dev = &pdev->dev;
+	struct dwc3_qcom *qcom;
+	bool legacy_binding;
+	int i;
+
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(dev);
+	qcom = get_dwc3_qcom(dev);
+
+	if (legacy_binding)
+		return;
+
+	pm_runtime_get_sync(qcom->dev);
+	dwc3_core_exit_mode(&qcom->dwc);
+	dwc3_free_event_buffers(&qcom->dwc);
 
 	for (i = qcom->num_clocks - 1; i >= 0; i--) {
 		clk_disable_unprepare(qcom->clks[i]);
@@ -993,16 +1243,28 @@
 	dwc3_qcom_interconnect_exit(qcom);
 	reset_control_assert(qcom->resets);
 
-	pm_runtime_allow(dev);
-	pm_runtime_disable(dev);
+	pm_runtime_allow(qcom->dev);
+	pm_runtime_disable(qcom->dev);
+	pm_runtime_dont_use_autosuspend(qcom->dev);
+	pm_runtime_put_noidle(qcom->dev);
 }
 
 static int __maybe_unused dwc3_qcom_pm_suspend(struct device *dev)
 {
-	struct dwc3_qcom *qcom = dev_get_drvdata(dev);
 	bool wakeup = device_may_wakeup(dev);
+	struct dwc3_qcom *qcom;
+	bool legacy_binding;
 	int ret;
 
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(dev);
+	qcom = get_dwc3_qcom(dev);
+
+	if (!legacy_binding) {
+		ret = dwc3_suspend(&qcom->dwc);
+		if (ret)
+			return ret;
+	}
+
 	ret = dwc3_qcom_suspend(qcom, wakeup);
 	if (ret)
 		return ret;
@@ -1014,35 +1276,86 @@
 
 static int __maybe_unused dwc3_qcom_pm_resume(struct device *dev)
 {
-	struct dwc3_qcom *qcom = dev_get_drvdata(dev);
 	bool wakeup = device_may_wakeup(dev);
+	struct dwc3_qcom *qcom;
+	bool legacy_binding;
 	int ret;
 
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(dev);
+	qcom = get_dwc3_qcom(dev);
+
+	if ((!legacy_binding) && (pm_runtime_suspended(qcom->dev))) {
+		qcom->pm_suspended = false;
+		return 0;
+	}
+
 	ret = dwc3_qcom_resume(qcom, wakeup);
 	if (ret)
 		return ret;
 
 	qcom->pm_suspended = false;
 
+	if (!legacy_binding) {
+		ret = dwc3_resume(&qcom->dwc);
+		if (ret)
+			return ret;
+	}
+
 	return 0;
 }
 
+static void dwc3_qcom_complete(struct device *dev)
+{
+	struct dwc3_qcom *qcom;
+	bool legacy_binding;
+
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(dev);
+	qcom = get_dwc3_qcom(dev);
+
+	if (!legacy_binding)
+		dwc3_complete(&qcom->dwc);
+}
+
 static int __maybe_unused dwc3_qcom_runtime_suspend(struct device *dev)
 {
-	struct dwc3_qcom *qcom = dev_get_drvdata(dev);
+	struct dwc3_qcom *qcom;
+	bool legacy_binding;
+	int ret;
+
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(dev);
+	qcom = get_dwc3_qcom(dev);
+
+	if (!legacy_binding) {
+		ret = dwc3_runtime_suspend(&qcom->dwc);
+		if (ret)
+			return ret;
+	}
 
 	return dwc3_qcom_suspend(qcom, true);
 }
 
 static int __maybe_unused dwc3_qcom_runtime_resume(struct device *dev)
 {
-	struct dwc3_qcom *qcom = dev_get_drvdata(dev);
+	struct dwc3_qcom *qcom;
+	bool legacy_binding;
+	int ret;
 
-	return dwc3_qcom_resume(qcom, true);
+	legacy_binding = dwc3_qcom_has_separate_dwc3_of_node(dev);
+	qcom = get_dwc3_qcom(dev);
+
+	ret = dwc3_qcom_resume(qcom, true);
+	if (ret)
+		return ret;
+
+	if (!legacy_binding)
+		return dwc3_runtime_resume(&qcom->dwc);
+
+	return 0;
 }
 
 static const struct dev_pm_ops dwc3_qcom_dev_pm_ops = {
 	SET_SYSTEM_SLEEP_PM_OPS(dwc3_qcom_pm_suspend, dwc3_qcom_pm_resume)
+	.complete = dwc3_qcom_complete,
 	SET_RUNTIME_PM_OPS(dwc3_qcom_runtime_suspend, dwc3_qcom_runtime_resume,
 			   NULL)
 };
@@ -1055,9 +1368,6 @@
 
 #ifdef CONFIG_ACPI
 static const struct dwc3_acpi_pdata sdm845_acpi_pdata = {
-	.qscratch_base_offset = SDM845_QSCRATCH_BASE_OFFSET,
-	.qscratch_base_size = SDM845_QSCRATCH_SIZE,
-	.dwc3_core_base_size = SDM845_DWC3_CORE_SIZE,
 	.qusb2_phy_irq_index = 1,
 	.dp_hs_phy_irq_index = 4,
 	.dm_hs_phy_irq_index = 3,
@@ -1065,9 +1375,6 @@
 };
 
 static const struct dwc3_acpi_pdata sdm845_acpi_urs_pdata = {
-	.qscratch_base_offset = SDM845_QSCRATCH_BASE_OFFSET,
-	.qscratch_base_size = SDM845_QSCRATCH_SIZE,
-	.dwc3_core_base_size = SDM845_DWC3_CORE_SIZE,
 	.qusb2_phy_irq_index = 1,
 	.dp_hs_phy_irq_index = 4,
 	.dm_hs_phy_irq_index = 3,
@@ -1088,6 +1395,7 @@
 static struct platform_driver dwc3_qcom_driver = {
 	.probe		= dwc3_qcom_probe,
 	.remove_new	= dwc3_qcom_remove,
+	.shutdown	= dwc3_qcom_shutdown,
 	.driver		= {
 		.name	= "dwc3-qcom",
 		.pm	= &dwc3_qcom_dev_pm_ops,
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/dwc3-st.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/dwc3-st.c
@@ -219,10 +219,8 @@
 	dwc3_data->regmap = regmap;
 
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg");
-	if (!res) {
-		ret = -ENXIO;
-		goto undo_platform_dev_alloc;
-	}
+	if (!res)
+		return -ENXIO;
 
 	dwc3_data->syscfg_reg_off = res->start;
 
@@ -233,8 +231,7 @@
 		devm_reset_control_get_exclusive(dev, "powerdown");
 	if (IS_ERR(dwc3_data->rstc_pwrdn)) {
 		dev_err(&pdev->dev, "could not get power controller\n");
-		ret = PTR_ERR(dwc3_data->rstc_pwrdn);
-		goto undo_platform_dev_alloc;
+		return PTR_ERR(dwc3_data->rstc_pwrdn);
 	}
 
 	/* Manage PowerDown */
@@ -269,7 +266,7 @@
 	if (!child_pdev) {
 		dev_err(dev, "failed to find dwc3 core device\n");
 		ret = -ENODEV;
-		goto err_node_put;
+		goto depopulate;
 	}
 
 	dwc3_data->dr_mode = usb_get_dr_mode(&child_pdev->dev);
@@ -285,6 +282,7 @@
 	ret = st_dwc3_drd_init(dwc3_data);
 	if (ret) {
 		dev_err(dev, "drd initialisation failed\n");
+		of_platform_depopulate(dev);
 		goto undo_softreset;
 	}
 
@@ -294,14 +292,14 @@
 	platform_set_drvdata(pdev, dwc3_data);
 	return 0;
 
+depopulate:
+	of_platform_depopulate(dev);
 err_node_put:
 	of_node_put(child);
 undo_softreset:
 	reset_control_assert(dwc3_data->rstc_rst);
 undo_powerdown:
 	reset_control_assert(dwc3_data->rstc_pwrdn);
-undo_platform_dev_alloc:
-	platform_device_put(pdev);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/dwc3-xilinx.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/dwc3-xilinx.c
@@ -121,8 +121,11 @@
 	 * in use but the usb3-phy entry is missing from the device tree.
 	 * Therefore, skip these operations in this case.
 	 */
-	if (!priv_data->usb3_phy)
+	if (!priv_data->usb3_phy) {
+		/* Deselect the PIPE Clock Select bit in FPD PIPE Clock register */
+		writel(PIPE_CLK_DESELECT, priv_data->regs + XLNX_USB_FPD_PIPE_CLK);
 		goto skip_usb3_phy;
+	}
 
 	crst = devm_reset_control_get_exclusive(dev, "usb_crst");
 	if (IS_ERR(crst)) {
@@ -298,9 +301,14 @@
 		goto err_pm_set_suspended;
 
 	pm_suspend_ignore_children(dev, false);
-	return pm_runtime_resume_and_get(dev);
+	ret = pm_runtime_resume_and_get(dev);
+	if (ret < 0)
+		goto err_pm_set_suspended;
+
+	return 0;
 
 err_pm_set_suspended:
+	of_platform_depopulate(dev);
 	pm_runtime_set_suspended(dev);
 
 err_clk_put:
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/ep0.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/ep0.c
@@ -226,12 +226,14 @@
 
 	/* reinitialize physical ep1 */
 	dep = dwc->eps[1];
-	dep->flags = DWC3_EP_ENABLED;
+	dep->flags &= DWC3_EP_RESOURCE_ALLOCATED;
+	dep->flags |= DWC3_EP_ENABLED;
 
 	/* stall is always issued on EP0 */
 	dep = dwc->eps[0];
 	__dwc3_gadget_ep_set_halt(dep, 1, false);
-	dep->flags = DWC3_EP_ENABLED;
+	dep->flags &= DWC3_EP_RESOURCE_ALLOCATED | DWC3_EP_TRANSFER_STARTED;
+	dep->flags |= DWC3_EP_ENABLED;
 	dwc->delayed_status = false;
 
 	if (!list_empty(&dep->pending_list)) {
@@ -646,6 +648,7 @@
 		return -EINVAL;
 
 	case USB_STATE_ADDRESS:
+		dwc3_gadget_start_config(dwc, 2);
 		dwc3_gadget_clear_tx_fifos(dwc);
 
 		ret = dwc3_ep0_delegate_req(dwc, ctrl);
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/gadget.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/gadget.c
@@ -287,6 +287,23 @@
  *
  * Caller should handle locking. This function will issue @cmd with given
  * @params to @dep and wait for its completion.
+ *
+ * According to the programming guide, if the link state is in L1/L2/U3,
+ * then sending the Start Transfer command may not complete. The
+ * programming guide suggested to bring the link state back to ON/U0 by
+ * performing remote wakeup prior to sending the command. However, don't
+ * initiate remote wakeup when the user/function does not send wakeup
+ * request via wakeup ops. Send the command when it's allowed.
+ *
+ * Notes:
+ * For L1 link state, issuing a command requires the clearing of
+ * GUSB2PHYCFG.SUSPENDUSB2, which turns on the signal required to complete
+ * the given command (usually within 50us). This should happen within the
+ * command timeout set by driver. No additional step is needed.
+ *
+ * For L2 or U3 link state, the gadget is in USB suspend. Care should be
+ * taken when sending Start Transfer command to ensure that it's done after
+ * USB resume.
  */
 int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd,
 		struct dwc3_gadget_ep_cmd_params *params)
@@ -327,30 +344,6 @@
 			dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
 	}
 
-	if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) {
-		int link_state;
-
-		/*
-		 * Initiate remote wakeup if the link state is in U3 when
-		 * operating in SS/SSP or L1/L2 when operating in HS/FS. If the
-		 * link state is in U1/U2, no remote wakeup is needed. The Start
-		 * Transfer command will initiate the link recovery.
-		 */
-		link_state = dwc3_gadget_get_link_state(dwc);
-		switch (link_state) {
-		case DWC3_LINK_STATE_U2:
-			if (dwc->gadget->speed >= USB_SPEED_SUPER)
-				break;
-
-			fallthrough;
-		case DWC3_LINK_STATE_U3:
-			ret = __dwc3_gadget_wakeup(dwc, false);
-			dev_WARN_ONCE(dwc->dev, ret, "wakeup failed --> %d\n",
-					ret);
-			break;
-		}
-	}
-
 	/*
 	 * For some commands such as Update Transfer command, DEPCMDPARn
 	 * registers are reserved. Since the driver often sends Update Transfer
@@ -445,6 +438,10 @@
 			dwc3_gadget_ep_get_transfer_index(dep);
 	}
 
+	if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER &&
+	    !(cmd & DWC3_DEPCMD_CMDIOC))
+		mdelay(1);
+
 	if (saved_config) {
 		reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
 		reg |= saved_config;
@@ -519,77 +516,56 @@
 static int dwc3_gadget_set_xfer_resource(struct dwc3_ep *dep)
 {
 	struct dwc3_gadget_ep_cmd_params params;
+	int ret;
+
+	if (dep->flags & DWC3_EP_RESOURCE_ALLOCATED)
+		return 0;
 
 	memset(&params, 0x00, sizeof(params));
 
 	params.param0 = DWC3_DEPXFERCFG_NUM_XFER_RES(1);
 
-	return dwc3_send_gadget_ep_cmd(dep, DWC3_DEPCMD_SETTRANSFRESOURCE,
+	ret = dwc3_send_gadget_ep_cmd(dep, DWC3_DEPCMD_SETTRANSFRESOURCE,
 			&params);
+	if (ret)
+		return ret;
+
+	dep->flags |= DWC3_EP_RESOURCE_ALLOCATED;
+	return 0;
 }
 
 /**
- * dwc3_gadget_start_config - configure ep resources
- * @dep: endpoint that is being enabled
- *
- * Issue a %DWC3_DEPCMD_DEPSTARTCFG command to @dep. After the command's
- * completion, it will set Transfer Resource for all available endpoints.
- *
- * The assignment of transfer resources cannot perfectly follow the data book
- * due to the fact that the controller driver does not have all knowledge of the
- * configuration in advance. It is given this information piecemeal by the
- * composite gadget framework after every SET_CONFIGURATION and
- * SET_INTERFACE. Trying to follow the databook programming model in this
- * scenario can cause errors. For two reasons:
- *
- * 1) The databook says to do %DWC3_DEPCMD_DEPSTARTCFG for every
- * %USB_REQ_SET_CONFIGURATION and %USB_REQ_SET_INTERFACE (8.1.5). This is
- * incorrect in the scenario of multiple interfaces.
- *
- * 2) The databook does not mention doing more %DWC3_DEPCMD_DEPXFERCFG for new
- * endpoint on alt setting (8.1.6).
- *
- * The following simplified method is used instead:
+ * dwc3_gadget_start_config - reset endpoint resources
+ * @dwc: pointer to the DWC3 context
+ * @resource_index: DEPSTARTCFG.XferRscIdx value (must be 0 or 2)
  *
- * All hardware endpoints can be assigned a transfer resource and this setting
- * will stay persistent until either a core reset or hibernation. So whenever we
- * do a %DWC3_DEPCMD_DEPSTARTCFG(0) we can go ahead and do
- * %DWC3_DEPCMD_DEPXFERCFG for every hardware endpoint as well. We are
- * guaranteed that there are as many transfer resources as endpoints.
+ * Set resource_index=0 to reset all endpoints' resources allocation. Do this as
+ * part of the power-on/soft-reset initialization.
  *
- * This function is called for each endpoint when it is being enabled but is
- * triggered only when called for EP0-out, which always happens first, and which
- * should only happen in one of the above conditions.
+ * Set resource_index=2 to reset only non-control endpoints' resources. Do this
+ * on receiving the SET_CONFIGURATION request or hibernation resume.
  */
-static int dwc3_gadget_start_config(struct dwc3_ep *dep)
+int dwc3_gadget_start_config(struct dwc3 *dwc, unsigned int resource_index)
 {
 	struct dwc3_gadget_ep_cmd_params params;
-	struct dwc3		*dwc;
 	u32			cmd;
 	int			i;
 	int			ret;
 
-	if (dep->number)
-		return 0;
+	if (resource_index != 0 && resource_index != 2)
+		return -EINVAL;
 
 	memset(&params, 0x00, sizeof(params));
 	cmd = DWC3_DEPCMD_DEPSTARTCFG;
-	dwc = dep->dwc;
+	cmd |= DWC3_DEPCMD_PARAM(resource_index);
 
-	ret = dwc3_send_gadget_ep_cmd(dep, cmd, &params);
+	ret = dwc3_send_gadget_ep_cmd(dwc->eps[0], cmd, &params);
 	if (ret)
 		return ret;
 
-	for (i = 0; i < DWC3_ENDPOINTS_NUM; i++) {
-		struct dwc3_ep *dep = dwc->eps[i];
-
-		if (!dep)
-			continue;
-
-		ret = dwc3_gadget_set_xfer_resource(dep);
-		if (ret)
-			return ret;
-	}
+	/* Reset resource allocation flags */
+	for (i = resource_index; i < dwc->num_eps && dwc->eps[i]; i++)
+		dwc->eps[i]->flags &= ~DWC3_EP_RESOURCE_ALLOCATED;
 
 	return 0;
 }
@@ -712,6 +688,44 @@
 }
 
 /**
+ * dwc3_gadget_calc_ram_depth - calculates the ram depth for txfifo
+ * @dwc: pointer to the DWC3 context
+ */
+static int dwc3_gadget_calc_ram_depth(struct dwc3 *dwc)
+{
+	int ram_depth;
+	int fifo_0_start;
+	bool is_single_port_ram;
+
+	/* Check supporting RAM type by HW */
+	is_single_port_ram = DWC3_SPRAM_TYPE(dwc->hwparams.hwparams1);
+
+	/*
+	 * If a single port RAM is utilized, then allocate TxFIFOs from
+	 * RAM0. otherwise, allocate them from RAM1.
+	 */
+	ram_depth = is_single_port_ram ? DWC3_RAM0_DEPTH(dwc->hwparams.hwparams6) :
+			DWC3_RAM1_DEPTH(dwc->hwparams.hwparams7);
+
+	/*
+	 * In a single port RAM configuration, the available RAM is shared
+	 * between the RX and TX FIFOs. This means that the txfifo can begin
+	 * at a non-zero address.
+	 */
+	if (is_single_port_ram) {
+		u32 reg;
+
+		/* Check if TXFIFOs start at non-zero addr */
+		reg = dwc3_readl(dwc->regs, DWC3_GTXFIFOSIZ(0));
+		fifo_0_start = DWC3_GTXFIFOSIZ_TXFSTADDR(reg);
+
+		ram_depth -= (fifo_0_start >> 16);
+	}
+
+	return ram_depth;
+}
+
+/**
  * dwc3_gadget_clear_tx_fifos - Clears txfifo allocation
  * @dwc: pointer to the DWC3 context
  *
@@ -777,7 +791,7 @@
 {
 	struct dwc3 *dwc = dep->dwc;
 	int fifo_0_start;
-	int ram1_depth;
+	int ram_depth;
 	int fifo_size;
 	int min_depth;
 	int num_in_ep;
@@ -797,7 +811,7 @@
 	if (dep->flags & DWC3_EP_TXFIFO_RESIZED)
 		return 0;
 
-	ram1_depth = DWC3_RAM1_DEPTH(dwc->hwparams.hwparams7);
+	ram_depth = dwc3_gadget_calc_ram_depth(dwc);
 
 	if ((dep->endpoint.maxburst > 1 &&
 	     usb_endpoint_xfer_bulk(dep->endpoint.desc)) ||
@@ -818,7 +832,7 @@
 
 	/* Reserve at least one FIFO for the number of IN EPs */
 	min_depth = num_in_ep * (fifo + 1);
-	remaining = ram1_depth - min_depth - dwc->last_fifo_depth;
+	remaining = ram_depth - min_depth - dwc->last_fifo_depth;
 	remaining = max_t(int, 0, remaining);
 	/*
 	 * We've already reserved 1 FIFO per EP, so check what we can fit in
@@ -844,9 +858,9 @@
 		dwc->last_fifo_depth += DWC31_GTXFIFOSIZ_TXFDEP(fifo_size);
 
 	/* Check fifo size allocation doesn't exceed available RAM size. */
-	if (dwc->last_fifo_depth >= ram1_depth) {
+	if (dwc->last_fifo_depth >= ram_depth) {
 		dev_err(dwc->dev, "Fifosize(%d) > RAM size(%d) %s depth:%d\n",
-			dwc->last_fifo_depth, ram1_depth,
+			dwc->last_fifo_depth, ram_depth,
 			dep->endpoint.name, fifo_size);
 		if (DWC3_IP_IS(DWC3))
 			fifo_size = DWC3_GTXFIFOSIZ_TXFDEP(fifo_size);
@@ -884,16 +898,18 @@
 		ret = dwc3_gadget_resize_tx_fifos(dep);
 		if (ret)
 			return ret;
-
-		ret = dwc3_gadget_start_config(dep);
-		if (ret)
-			return ret;
 	}
 
 	ret = dwc3_gadget_set_ep_config(dep, action);
 	if (ret)
 		return ret;
 
+	if (!(dep->flags & DWC3_EP_RESOURCE_ALLOCATED)) {
+		ret = dwc3_gadget_set_xfer_resource(dep);
+		if (ret)
+			return ret;
+	}
+
 	if (!(dep->flags & DWC3_EP_ENABLED)) {
 		struct dwc3_trb	*trb_st_hw;
 		struct dwc3_trb	*trb_link;
@@ -1047,7 +1063,7 @@
 
 	dep->stream_capable = false;
 	dep->type = 0;
-	mask = DWC3_EP_TXFIFO_RESIZED;
+	mask = DWC3_EP_TXFIFO_RESIZED | DWC3_EP_RESOURCE_ALLOCATED;
 	/*
 	 * dwc3_remove_requests() can exit early if DWC3 EP delayed stop is
 	 * set.  Do not clear DEP flags, so that the end transfer command will
@@ -1199,11 +1215,14 @@
 	 * pending to be processed by the driver.
 	 */
 	if (dep->trb_enqueue == dep->trb_dequeue) {
+		struct dwc3_request *req;
+
 		/*
-		 * If there is any request remained in the started_list at
-		 * this point, that means there is no TRB available.
+		 * If there is any request remained in the started_list with
+		 * active TRBs at this point, then there is no TRB available.
 		 */
-		if (!list_empty(&dep->started_list))
+		req = next_request(&dep->started_list);
+		if (req && req->num_trbs)
 			return 0;
 
 		return DWC3_TRB_NUM - 1;
@@ -1436,8 +1455,8 @@
 	struct scatterlist *s;
 	int		i;
 	unsigned int length = req->request.length;
-	unsigned int remaining = req->request.num_mapped_sgs
-		- req->num_queued_sgs;
+	unsigned int remaining = req->num_pending_sgs;
+	unsigned int num_queued_sgs = req->request.num_mapped_sgs - remaining;
 	unsigned int num_trbs = req->num_trbs;
 	bool needs_extra_trb = dwc3_needs_extra_trb(dep, req);
 
@@ -1445,7 +1464,7 @@
 	 * If we resume preparing the request, then get the remaining length of
 	 * the request and resume where we left off.
 	 */
-	for_each_sg(req->request.sg, s, req->num_queued_sgs, i)
+	for_each_sg(req->request.sg, s, num_queued_sgs, i)
 		length -= sg_dma_len(s);
 
 	for_each_sg(sg, s, remaining, i) {
@@ -1718,7 +1737,6 @@
  */
 static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool interrupt)
 {
-	struct dwc3 *dwc = dep->dwc;
 	struct dwc3_gadget_ep_cmd_params params;
 	u32 cmd;
 	int ret;
@@ -1742,13 +1760,10 @@
 	WARN_ON_ONCE(ret);
 	dep->resource_index = 0;
 
-	if (!interrupt) {
-		if (!DWC3_IP_IS(DWC3) || DWC3_VER_IS_PRIOR(DWC3, 310A))
-			mdelay(1);
+	if (!interrupt)
 		dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
-	} else if (!ret) {
+	else if (!ret)
 		dep->flags |= DWC3_EP_END_TRANSFER_PENDING;
-	}
 
 	dep->flags &= ~DWC3_EP_DELAY_STOP;
 	return ret;
@@ -2607,6 +2622,8 @@
 	if (pm_runtime_suspended(dwc->dev))
 		return 0;
 
+	dwc3_notify_run_stop(dwc, is_on);
+
 	reg = dwc3_readl(dwc->regs, DWC3_DCTL);
 	if (is_on) {
 		if (DWC3_VER_IS_WITHIN(DWC3, ANY, 187A)) {
@@ -2913,6 +2930,12 @@
 	/* Start with SuperSpeed Default */
 	dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(512);
 
+	ret = dwc3_gadget_start_config(dwc, 0);
+	if (ret) {
+		dev_err(dwc->dev, "failed to config endpoints\n");
+		return ret;
+	}
+
 	dep = dwc->eps[0];
 	dep->flags = 0;
 	ret = __dwc3_gadget_ep_enable(dep, DWC3_DEPCFG_ACTION_INIT);
@@ -2937,6 +2960,7 @@
 	dwc3_ep0_out_start(dwc);
 
 	dwc3_gadget_enable_irq(dwc);
+	dwc3_enable_susphy(dwc, true);
 
 	return 0;
 
@@ -2968,6 +2992,9 @@
 	dwc->gadget_driver	= driver;
 	spin_unlock_irqrestore(&dwc->lock, flags);
 
+	if (dwc->sys_wakeup)
+		device_wakeup_enable(dwc->sysdev);
+
 	return 0;
 }
 
@@ -2983,6 +3010,9 @@
 	struct dwc3		*dwc = gadget_to_dwc(g);
 	unsigned long		flags;
 
+	if (dwc->sys_wakeup)
+		device_wakeup_disable(dwc->sysdev);
+
 	spin_lock_irqsave(&dwc->lock, flags);
 	dwc->gadget_driver	= NULL;
 	dwc->max_cfg_eps = 0;
@@ -3088,7 +3118,7 @@
 	struct dwc3 *dwc = gadget_to_dwc(g);
 	struct usb_ep *ep;
 	int fifo_size = 0;
-	int ram1_depth;
+	int ram_depth;
 	int ep_num = 0;
 
 	if (!dwc->do_fifo_resize)
@@ -3111,8 +3141,8 @@
 	fifo_size += dwc->max_cfg_eps;
 
 	/* Check if we can fit a single fifo per endpoint */
-	ram1_depth = DWC3_RAM1_DEPTH(dwc->hwparams.hwparams7);
-	if (fifo_size > ram1_depth)
+	ram_depth = dwc3_gadget_calc_ram_depth(dwc);
+	if (fifo_size > ram_depth)
 		return -ENOMEM;
 
 	return 0;
@@ -4180,8 +4210,10 @@
 		WARN_ONCE(DWC3_VER_IS_PRIOR(DWC3, 240A) && dwc->has_lpm_erratum,
 				"LPM Erratum not available on dwc3 revisions < 2.40a\n");
 
-		if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A))
+		if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) {
+			reg &= ~DWC3_DCTL_NYET_THRES_MASK;
 			reg |= DWC3_DCTL_NYET_THRES(dwc->lpm_nyet_threshold);
+		}
 
 		dwc3_gadget_dctl_write_safe(dwc, reg);
 	} else {
@@ -4196,6 +4228,8 @@
 		dwc3_gadget_dctl_write_safe(dwc, reg);
 	}
 
+	dwc3_notify_post_conndone(dwc);
+
 	dep = dwc->eps[0];
 	ret = __dwc3_gadget_ep_enable(dep, DWC3_DEPCFG_ACTION_MODIFY);
 	if (ret) {
@@ -4664,6 +4698,10 @@
 	else
 		dwc3_gadget_set_speed(dwc->gadget, dwc->maximum_speed);
 
+	/* No system wakeup if no gadget driver bound */
+	if (dwc->sys_wakeup)
+		device_wakeup_disable(dwc->sysdev);
+
 	return 0;
 
 err5:
@@ -4693,6 +4731,7 @@
 	if (!dwc->gadget)
 		return;
 
+	dwc3_enable_susphy(dwc, false);
 	usb_del_gadget(dwc->gadget);
 	dwc3_gadget_free_endpoints(dwc);
 	usb_put_gadget(dwc->gadget);
@@ -4738,14 +4777,3 @@
 
 	return dwc3_gadget_soft_connect(dwc);
 }
-
-void dwc3_gadget_process_pending_events(struct dwc3 *dwc)
-{
-	if (dwc->pending_events) {
-		dwc3_interrupt(dwc->irq_gadget, dwc->ev_buf);
-		dwc3_thread_interrupt(dwc->irq_gadget, dwc->ev_buf);
-		pm_runtime_put(dwc->dev);
-		dwc->pending_events = false;
-		enable_irq(dwc->irq_gadget);
-	}
-}
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/gadget.h
+++ linux-qcom-6.8.0/drivers/usb/dwc3/gadget.h
@@ -119,6 +119,7 @@
 int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol);
 void dwc3_ep0_send_delayed_status(struct dwc3 *dwc);
 void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool interrupt);
+int dwc3_gadget_start_config(struct dwc3 *dwc, unsigned int resource_index);
 
 /**
  * dwc3_gadget_ep_get_transfer_index - Gets transfer index from HW
--- linux-qcom-6.8.0.orig/drivers/usb/dwc3/host.c
+++ linux-qcom-6.8.0/drivers/usb/dwc3/host.c
@@ -10,9 +10,30 @@
 #include <linux/irq.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
 
+#include "../host/xhci-plat.h"
 #include "core.h"
 
+static void dwc3_xhci_plat_start(struct usb_hcd *hcd)
+{
+	struct platform_device *pdev;
+	struct dwc3 *dwc;
+
+	if (!usb_hcd_is_primary_hcd(hcd))
+		return;
+
+	pdev = to_platform_device(hcd->self.controller);
+	dwc = dev_get_drvdata(pdev->dev.parent);
+
+	dwc3_enable_susphy(dwc, true);
+}
+
+static const struct xhci_plat_priv dwc3_xhci_plat_quirk = {
+	.plat_start = dwc3_xhci_plat_start,
+};
+
 static void dwc3_host_fill_xhci_irq_res(struct dwc3 *dwc,
 					int irq, char *name)
 {
@@ -117,12 +138,25 @@
 		}
 	}
 
+	ret = platform_device_add_data(xhci, &dwc3_xhci_plat_quirk,
+				       sizeof(struct xhci_plat_priv));
+	if (ret)
+		goto err;
+
 	ret = platform_device_add(xhci);
 	if (ret) {
 		dev_err(dwc->dev, "failed to register xHCI device\n");
 		goto err;
 	}
 
+	if (dwc->sys_wakeup) {
+		/* Restore wakeup setting if switched from device */
+		device_wakeup_enable(dwc->sysdev);
+
+		/* Pass on wakeup setting to the new xhci platform device */
+		device_init_wakeup(&xhci->dev, true);
+	}
+
 	return 0;
 err:
 	platform_device_put(xhci);
@@ -131,6 +165,10 @@
 
 void dwc3_host_exit(struct dwc3 *dwc)
 {
+	if (dwc->sys_wakeup)
+		device_init_wakeup(&dwc->xhci->dev, false);
+
+	dwc3_enable_susphy(dwc, false);
 	platform_device_unregister(dwc->xhci);
 	dwc->xhci = NULL;
 }
--- linux-qcom-6.8.0.orig/drivers/usb/fotg210/fotg210-core.c
+++ linux-qcom-6.8.0/drivers/usb/fotg210/fotg210-core.c
@@ -95,6 +95,7 @@
 
 /**
  * fotg210_vbus() - Called by gadget driver to enable/disable VBUS
+ * @fotg: pointer to a private fotg210 object
  * @enable: true to enable VBUS, false to disable VBUS
  */
 void fotg210_vbus(struct fotg210 *fotg, bool enable)
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/Kconfig
+++ linux-qcom-6.8.0/drivers/usb/gadget/Kconfig
@@ -210,6 +210,8 @@
 
 config USB_F_MIDI2
 	tristate
+	select SND_UMP
+	select SND_UMP_LEGACY_RAWMIDI
 
 config USB_F_HID
 	tristate
@@ -444,8 +446,6 @@
 	depends on USB_CONFIGFS
 	depends on SND
 	select USB_LIBCOMPOSITE
-	select SND_UMP
-	select SND_UMP_LEGACY_RAWMIDI
 	select USB_F_MIDI2
 	help
 	  The MIDI 2.0 function driver provides the generic emulated
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/composite.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/composite.c
@@ -2111,6 +2111,18 @@
 			memset(buf, 0, w_length);
 			buf[5] = 0x01;
 			switch (ctrl->bRequestType & USB_RECIP_MASK) {
+			/*
+			 * The Microsoft CompatID OS Descriptor Spec(w_index = 0x4) and
+			 * Extended Prop OS Desc Spec(w_index = 0x5) state that the
+			 * HighByte of wValue is the InterfaceNumber and the LowByte is
+			 * the PageNumber. This high/low byte ordering is incorrectly
+			 * documented in the Spec. USB analyzer output on the below
+			 * request packets show the high/low byte inverted i.e LowByte
+			 * is the InterfaceNumber and the HighByte is the PageNumber.
+			 * Since we dont support >64KB CompatID/ExtendedProp descriptors,
+			 * PageNumber is set to 0. Hence verify that the HighByte is 0
+			 * for below two cases.
+			 */
 			case USB_RECIP_DEVICE:
 				if (w_index != 0x4 || (w_value >> 8))
 					break;
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/configfs.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/configfs.c
@@ -115,9 +115,12 @@
 	int ret;
 	char *str;
 	char *copy = *s_copy;
+
 	ret = strlen(s);
 	if (ret > USB_MAX_STRING_LEN)
 		return -EOVERFLOW;
+	if (ret < 1)
+		return -EINVAL;
 
 	if (copy) {
 		str = copy;
@@ -824,11 +827,15 @@
 {
 	struct gadget_string *string = to_gadget_string(item);
 	int size = min(sizeof(string->string), len + 1);
+	ssize_t cpy_len;
 
 	if (len > USB_MAX_STRING_LEN)
 		return -EINVAL;
 
-	return strscpy(string->string, page, size);
+	cpy_len = strscpy(string->string, page, size);
+	if (cpy_len > 0 && string->string[cpy_len - 1] == '\n')
+		string->string[cpy_len - 1] = 0;
+	return len;
 }
 CONFIGFS_ATTR(gadget_string_, s);
 
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/f_fs.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/f_fs.c
@@ -821,6 +821,7 @@
 						   work);
 	int ret = io_data->status;
 	bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
+	unsigned long flags;
 
 	if (io_data->read && ret > 0) {
 		kthread_use_mm(io_data->mm);
@@ -833,6 +834,11 @@
 	if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
 		eventfd_signal(io_data->ffs->ffs_eventfd);
 
+	spin_lock_irqsave(&io_data->ffs->eps_lock, flags);
+	usb_ep_free_request(io_data->ep, io_data->req);
+	io_data->req = NULL;
+	spin_unlock_irqrestore(&io_data->ffs->eps_lock, flags);
+
 	if (io_data->read)
 		kfree(io_data->to_free);
 	ffs_free_buffer(io_data);
@@ -846,7 +852,6 @@
 	struct ffs_data *ffs = io_data->ffs;
 
 	io_data->status = req->status ? req->status : req->actual;
-	usb_ep_free_request(_ep, req);
 
 	INIT_WORK(&io_data->work, ffs_user_copy_worker);
 	queue_work(ffs->io_completion_wq, &io_data->work);
@@ -1805,7 +1810,7 @@
 	struct usb_gadget_strings **lang;
 	int first_id;
 
-	if (WARN_ON(ffs->state != FFS_ACTIVE
+	if ((ffs->state != FFS_ACTIVE
 		 || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
 		return -EBADFD;
 
@@ -3330,7 +3335,7 @@
 	__ffs_event_add(ffs, FUNCTIONFS_SETUP);
 	spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
 
-	return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
+	return ffs->ev.setup.wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
 }
 
 static bool ffs_func_req_match(struct usb_function *f,
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/f_hid.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/f_hid.c
@@ -1029,9 +1029,9 @@
 {
 	int ret;
 
-	ret = ida_simple_get(&hidg_ida, 0, 0, GFP_KERNEL);
+	ret = ida_alloc(&hidg_ida, GFP_KERNEL);
 	if (ret >= HIDG_MINORS) {
-		ida_simple_remove(&hidg_ida, ret);
+		ida_free(&hidg_ida, ret);
 		ret = -ENODEV;
 	}
 
@@ -1176,7 +1176,7 @@
 
 static inline void hidg_put_minor(int minor)
 {
-	ida_simple_remove(&hidg_ida, minor);
+	ida_free(&hidg_ida, minor);
 }
 
 static void hidg_free_inst(struct usb_function_instance *f)
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/f_midi2.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/f_midi2.c
@@ -150,6 +150,9 @@
 
 #define func_to_midi2(f)	container_of(f, struct f_midi2, func)
 
+/* convert from MIDI protocol number (1 or 2) to SNDRV_UMP_EP_INFO_PROTO_* */
+#define to_ump_protocol(v)	(((v) & 3) << 8)
+
 /* get EP name string */
 static const char *ump_ep_name(const struct f_midi2_ep *ep)
 {
@@ -564,8 +567,7 @@
 		.status = UMP_STREAM_MSG_STATUS_STREAM_CFG,
 	};
 
-	if ((ep->info.protocol & SNDRV_UMP_EP_INFO_PROTO_MIDI_MASK) ==
-	    SNDRV_UMP_EP_INFO_PROTO_MIDI2)
+	if (ep->info.protocol == 2)
 		rep.protocol = UMP_STREAM_MSG_EP_INFO_CAP_MIDI2 >> 8;
 	else
 		rep.protocol = UMP_STREAM_MSG_EP_INFO_CAP_MIDI1 >> 8;
@@ -627,25 +629,34 @@
 		return;
 	case UMP_STREAM_MSG_STATUS_STREAM_CFG_REQUEST:
 		if (*data & UMP_STREAM_MSG_EP_INFO_CAP_MIDI2) {
-			ep->info.protocol = SNDRV_UMP_EP_INFO_PROTO_MIDI2;
+			ep->info.protocol = 2;
 			DBG(midi2, "Switching Protocol to MIDI2\n");
 		} else {
-			ep->info.protocol = SNDRV_UMP_EP_INFO_PROTO_MIDI1;
+			ep->info.protocol = 1;
 			DBG(midi2, "Switching Protocol to MIDI1\n");
 		}
-		snd_ump_switch_protocol(ep->ump, ep->info.protocol);
+		snd_ump_switch_protocol(ep->ump, to_ump_protocol(ep->info.protocol));
 		reply_ump_stream_ep_config(ep);
 		return;
 	case UMP_STREAM_MSG_STATUS_FB_DISCOVERY:
 		if (format)
 			return; // invalid
 		blk = (*data >> 8) & 0xff;
-		if (blk >= ep->num_blks)
-			return;
-		if (*data & UMP_STREAM_MSG_REQUEST_FB_INFO)
-			reply_ump_stream_fb_info(ep, blk);
-		if (*data & UMP_STREAM_MSG_REQUEST_FB_NAME)
-			reply_ump_stream_fb_name(ep, blk);
+		if (blk == 0xff) {
+			/* inquiry for all blocks */
+			for (blk = 0; blk < ep->num_blks; blk++) {
+				if (*data & UMP_STREAM_MSG_REQUEST_FB_INFO)
+					reply_ump_stream_fb_info(ep, blk);
+				if (*data & UMP_STREAM_MSG_REQUEST_FB_NAME)
+					reply_ump_stream_fb_name(ep, blk);
+			}
+		} else if (blk < ep->num_blks) {
+			/* only the specified block */
+			if (*data & UMP_STREAM_MSG_REQUEST_FB_INFO)
+				reply_ump_stream_fb_info(ep, blk);
+			if (*data & UMP_STREAM_MSG_REQUEST_FB_NAME)
+				reply_ump_stream_fb_name(ep, blk);
+		}
 		return;
 	}
 }
@@ -1065,7 +1076,8 @@
 		group = midi2->out_cable_mapping[cable].group;
 		bytes = midi1_packet_bytes[*buf & 0x0f];
 		for (c = 0; c < bytes; c++) {
-			snd_ump_convert_to_ump(cvt, group, ep->info.protocol,
+			snd_ump_convert_to_ump(cvt, group,
+					       to_ump_protocol(ep->info.protocol),
 					       buf[c + 1]);
 			if (cvt->ump_bytes) {
 				snd_ump_receive(ep->ump, cvt->ump,
@@ -1375,7 +1387,7 @@
 			desc->nNumGroupTrm = b->num_groups;
 			desc->iBlockItem = ep->blks[blk].string_id;
 
-			if (ep->info.protocol & SNDRV_UMP_EP_INFO_PROTO_MIDI2)
+			if (ep->info.protocol == 2)
 				desc->bMIDIProtocol = USB_MS_MIDI_PROTO_2_0;
 			else
 				desc->bMIDIProtocol = USB_MS_MIDI_PROTO_1_0_128;
@@ -1552,7 +1564,7 @@
 		if (midi2->info.static_block)
 			ump->info.flags |= SNDRV_UMP_EP_INFO_STATIC_BLOCKS;
 		ump->info.protocol_caps = (ep->info.protocol_caps & 3) << 8;
-		ump->info.protocol = (ep->info.protocol & 3) << 8;
+		ump->info.protocol = to_ump_protocol(ep->info.protocol);
 		ump->info.version = 0x0101;
 		ump->info.family_id = ep->info.family;
 		ump->info.model_id = ep->info.model;
@@ -1581,7 +1593,11 @@
 			fb->info.midi_ci_version = b->midi_ci_version;
 			fb->info.ui_hint = reverse_dir(b->ui_hint);
 			fb->info.sysex8_streams = b->sysex8_streams;
-			fb->info.flags |= b->is_midi1;
+			if (b->is_midi1 < 2)
+				fb->info.flags |= b->is_midi1;
+			else
+				fb->info.flags |= SNDRV_UMP_BLOCK_IS_MIDI1 |
+					SNDRV_UMP_BLOCK_IS_LOWSPEED;
 			strscpy(fb->info.name, ump_fb_name(b),
 				sizeof(fb->info.name));
 		}
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/f_ncm.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/f_ncm.c
@@ -878,7 +878,7 @@
 		if (alt > 1)
 			goto fail;
 
-		if (ncm->port.in_ep->enabled) {
+		if (ncm->netdev) {
 			DBG(cdev, "reset ncm\n");
 			ncm->netdev = NULL;
 			gether_disconnect(&ncm->port);
@@ -1367,7 +1367,7 @@
 
 	DBG(cdev, "ncm deactivated\n");
 
-	if (ncm->port.in_ep->enabled) {
+	if (ncm->netdev) {
 		ncm->netdev = NULL;
 		gether_disconnect(&ncm->port);
 	}
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/f_printer.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/f_printer.c
@@ -213,6 +213,7 @@
 					struct usb_endpoint_descriptor *ss)
 {
 	switch (gadget->speed) {
+	case USB_SPEED_SUPER_PLUS:
 	case USB_SPEED_SUPER:
 		return ss;
 	case USB_SPEED_HIGH:
@@ -449,11 +450,8 @@
 	mutex_lock(&dev->lock_printer_io);
 	spin_lock_irqsave(&dev->lock, flags);
 
-	if (dev->interface < 0) {
-		spin_unlock_irqrestore(&dev->lock, flags);
-		mutex_unlock(&dev->lock_printer_io);
-		return -ENODEV;
-	}
+	if (dev->interface < 0)
+		goto out_disabled;
 
 	/* We will use this flag later to check if a printer reset happened
 	 * after we turn interrupts back on.
@@ -461,6 +459,9 @@
 	dev->reset_printer = 0;
 
 	setup_rx_reqs(dev);
+	/* this dropped the lock - need to retest */
+	if (dev->interface < 0)
+		goto out_disabled;
 
 	bytes_copied = 0;
 	current_rx_req = dev->current_rx_req;
@@ -494,6 +495,8 @@
 		wait_event_interruptible(dev->rx_wait,
 				(likely(!list_empty(&dev->rx_buffers))));
 		spin_lock_irqsave(&dev->lock, flags);
+		if (dev->interface < 0)
+			goto out_disabled;
 	}
 
 	/* We have data to return then copy it to the caller's buffer.*/
@@ -537,6 +540,9 @@
 			return -EAGAIN;
 		}
 
+		if (dev->interface < 0)
+			goto out_disabled;
+
 		/* If we not returning all the data left in this RX request
 		 * buffer then adjust the amount of data left in the buffer.
 		 * Othewise if we are done with this RX request buffer then
@@ -566,6 +572,11 @@
 		return bytes_copied;
 	else
 		return -EAGAIN;
+
+out_disabled:
+	spin_unlock_irqrestore(&dev->lock, flags);
+	mutex_unlock(&dev->lock_printer_io);
+	return -ENODEV;
 }
 
 static ssize_t
@@ -586,11 +597,8 @@
 	mutex_lock(&dev->lock_printer_io);
 	spin_lock_irqsave(&dev->lock, flags);
 
-	if (dev->interface < 0) {
-		spin_unlock_irqrestore(&dev->lock, flags);
-		mutex_unlock(&dev->lock_printer_io);
-		return -ENODEV;
-	}
+	if (dev->interface < 0)
+		goto out_disabled;
 
 	/* Check if a printer reset happens while we have interrupts on */
 	dev->reset_printer = 0;
@@ -613,6 +621,8 @@
 		wait_event_interruptible(dev->tx_wait,
 				(likely(!list_empty(&dev->tx_reqs))));
 		spin_lock_irqsave(&dev->lock, flags);
+		if (dev->interface < 0)
+			goto out_disabled;
 	}
 
 	while (likely(!list_empty(&dev->tx_reqs)) && len) {
@@ -662,6 +672,9 @@
 			return -EAGAIN;
 		}
 
+		if (dev->interface < 0)
+			goto out_disabled;
+
 		list_add(&req->list, &dev->tx_reqs_active);
 
 		/* here, we unlock, and only unlock, to avoid deadlock. */
@@ -674,6 +687,8 @@
 			mutex_unlock(&dev->lock_printer_io);
 			return -EAGAIN;
 		}
+		if (dev->interface < 0)
+			goto out_disabled;
 	}
 
 	spin_unlock_irqrestore(&dev->lock, flags);
@@ -685,6 +700,11 @@
 		return bytes_copied;
 	else
 		return -EAGAIN;
+
+out_disabled:
+	spin_unlock_irqrestore(&dev->lock, flags);
+	mutex_unlock(&dev->lock_printer_io);
+	return -ENODEV;
 }
 
 static int
@@ -1312,9 +1332,9 @@
 {
 	int ret;
 
-	ret = ida_simple_get(&printer_ida, 0, 0, GFP_KERNEL);
+	ret = ida_alloc(&printer_ida, GFP_KERNEL);
 	if (ret >= PRINTER_MINORS) {
-		ida_simple_remove(&printer_ida, ret);
+		ida_free(&printer_ida, ret);
 		ret = -ENODEV;
 	}
 
@@ -1323,7 +1343,7 @@
 
 static inline void gprinter_put_minor(int minor)
 {
-	ida_simple_remove(&printer_ida, minor);
+	ida_free(&printer_ida, minor);
 }
 
 static int gprinter_setup(int);
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/f_uac2.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/f_uac2.c
@@ -1179,6 +1179,7 @@
 		uac2->as_in_alt = 0;
 	}
 
+	std_ac_if_desc.bNumEndpoints = 0;
 	if (FUOUT_EN(uac2_opts) || FUIN_EN(uac2_opts)) {
 		uac2->int_ep = usb_ep_autoconfig(gadget, &fs_ep_int_desc);
 		if (!uac2->int_ep) {
@@ -2055,7 +2056,7 @@
 					  const char *page, size_t len)	\
 {									\
 	struct f_uac2_opts *opts = to_f_uac2_opts(item);		\
-	int ret = 0;							\
+	int ret = len;							\
 									\
 	mutex_lock(&opts->lock);					\
 	if (opts->refcnt) {						\
@@ -2063,8 +2064,11 @@
 		goto end;						\
 	}								\
 									\
-	ret = scnprintf(opts->name, min(sizeof(opts->name), len),	\
-			"%s", page);					\
+	if (len && page[len - 1] == '\n')				\
+		len--;							\
+									\
+	scnprintf(opts->name, min(sizeof(opts->name), len + 1),		\
+		  "%s", page);						\
 									\
 end:									\
 	mutex_unlock(&opts->lock);					\
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/rndis.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/rndis.c
@@ -869,12 +869,12 @@
 
 static inline int rndis_get_nr(void)
 {
-	return ida_simple_get(&rndis_ida, 0, 1000, GFP_KERNEL);
+	return ida_alloc_max(&rndis_ida, 999, GFP_KERNEL);
 }
 
 static inline void rndis_put_nr(int nr)
 {
-	ida_simple_remove(&rndis_ida, nr);
+	ida_free(&rndis_ida, nr);
 }
 
 struct rndis_params *rndis_register(void (*resp_avail)(void *v), void *v)
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/u_audio.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/u_audio.c
@@ -57,13 +57,13 @@
 
   /* Volume/Mute controls and their state */
   int fu_id; /* Feature Unit ID */
-  struct snd_kcontrol *snd_kctl_volume;
-  struct snd_kcontrol *snd_kctl_mute;
+  struct snd_ctl_elem_id snd_kctl_volume_id;
+  struct snd_ctl_elem_id snd_kctl_mute_id;
   s16 volume_min, volume_max, volume_res;
   s16 volume;
   int mute;
 
-	struct snd_kcontrol *snd_kctl_rate; /* read-only current rate */
+	struct snd_ctl_elem_id snd_kctl_rate_id; /* read-only current rate */
 	int srate; /* selected samplerate */
 	int active; /* playback/capture running */
 
@@ -494,14 +494,13 @@
 static void set_active(struct uac_rtd_params *prm, bool active)
 {
 	// notifying through the Rate ctrl
-	struct snd_kcontrol *kctl = prm->snd_kctl_rate;
 	unsigned long flags;
 
 	spin_lock_irqsave(&prm->lock, flags);
 	if (prm->active != active) {
 		prm->active = active;
 		snd_ctl_notify(prm->uac->card, SNDRV_CTL_EVENT_MASK_VALUE,
-				&kctl->id);
+				&prm->snd_kctl_rate_id);
 	}
 	spin_unlock_irqrestore(&prm->lock, flags);
 }
@@ -593,16 +592,25 @@
 	struct usb_ep *ep, *ep_fback;
 	struct uac_rtd_params *prm;
 	struct uac_params *params = &audio_dev->params;
-	int req_len, i;
+	int req_len, i, ret;
 
 	prm = &uac->c_prm;
 	dev_dbg(dev, "start capture with rate %d\n", prm->srate);
 	ep = audio_dev->out_ep;
-	config_ep_by_speed(gadget, &audio_dev->func, ep);
+	ret = config_ep_by_speed(gadget, &audio_dev->func, ep);
+	if (ret < 0) {
+		dev_err(dev, "config_ep_by_speed for out_ep failed (%d)\n", ret);
+		return ret;
+	}
+
 	req_len = ep->maxpacket;
 
 	prm->ep_enabled = true;
-	usb_ep_enable(ep);
+	ret = usb_ep_enable(ep);
+	if (ret < 0) {
+		dev_err(dev, "usb_ep_enable failed for out_ep (%d)\n", ret);
+		return ret;
+	}
 
 	for (i = 0; i < params->req_number; i++) {
 		if (!prm->reqs[i]) {
@@ -630,9 +638,18 @@
 		return 0;
 
 	/* Setup feedback endpoint */
-	config_ep_by_speed(gadget, &audio_dev->func, ep_fback);
+	ret = config_ep_by_speed(gadget, &audio_dev->func, ep_fback);
+	if (ret < 0) {
+		dev_err(dev, "config_ep_by_speed in_ep_fback failed (%d)\n", ret);
+		return ret; // TODO: Clean up out_ep
+	}
+
 	prm->fb_ep_enabled = true;
-	usb_ep_enable(ep_fback);
+	ret = usb_ep_enable(ep_fback);
+	if (ret < 0) {
+		dev_err(dev, "usb_ep_enable failed for in_ep_fback (%d)\n", ret);
+		return ret; // TODO: Clean up out_ep
+	}
 	req_len = ep_fback->maxpacket;
 
 	req_fback = usb_ep_alloc_request(ep_fback, GFP_ATOMIC);
@@ -688,13 +705,17 @@
 	struct uac_params *params = &audio_dev->params;
 	unsigned int factor;
 	const struct usb_endpoint_descriptor *ep_desc;
-	int req_len, i;
+	int req_len, i, ret;
 	unsigned int p_pktsize;
 
 	prm = &uac->p_prm;
 	dev_dbg(dev, "start playback with rate %d\n", prm->srate);
 	ep = audio_dev->in_ep;
-	config_ep_by_speed(gadget, &audio_dev->func, ep);
+	ret = config_ep_by_speed(gadget, &audio_dev->func, ep);
+	if (ret < 0) {
+		dev_err(dev, "config_ep_by_speed for in_ep failed (%d)\n", ret);
+		return ret;
+	}
 
 	ep_desc = ep->desc;
 	/*
@@ -721,7 +742,11 @@
 	uac->p_residue_mil = 0;
 
 	prm->ep_enabled = true;
-	usb_ep_enable(ep);
+	ret = usb_ep_enable(ep);
+	if (ret < 0) {
+		dev_err(dev, "usb_ep_enable failed for in_ep (%d)\n", ret);
+		return ret;
+	}
 
 	for (i = 0; i < params->req_number; i++) {
 		if (!prm->reqs[i]) {
@@ -807,7 +832,7 @@
 
 	if (change)
 		snd_ctl_notify(uac->card, SNDRV_CTL_EVENT_MASK_VALUE,
-				&prm->snd_kctl_volume->id);
+				&prm->snd_kctl_volume_id);
 
 	return 0;
 }
@@ -856,7 +881,7 @@
 
 	if (change)
 		snd_ctl_notify(uac->card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &prm->snd_kctl_mute->id);
+			       &prm->snd_kctl_mute_id);
 
 	return 0;
 }
@@ -1331,7 +1356,7 @@
 			err = snd_ctl_add(card, kctl);
 			if (err < 0)
 				goto snd_fail;
-			prm->snd_kctl_mute = kctl;
+			prm->snd_kctl_mute_id = kctl->id;
 			prm->mute = 0;
 		}
 
@@ -1359,7 +1384,7 @@
 			err = snd_ctl_add(card, kctl);
 			if (err < 0)
 				goto snd_fail;
-			prm->snd_kctl_volume = kctl;
+			prm->snd_kctl_volume_id = kctl->id;
 			prm->volume = fu->volume_max;
 			prm->volume_max = fu->volume_max;
 			prm->volume_min = fu->volume_min;
@@ -1383,7 +1408,7 @@
 		err = snd_ctl_add(card, kctl);
 		if (err < 0)
 			goto snd_fail;
-		prm->snd_kctl_rate = kctl;
+		prm->snd_kctl_rate_id = kctl->id;
 	}
 
 	strscpy(card->driver, card_name, sizeof(card->driver));
@@ -1420,6 +1445,8 @@
 		return;
 
 	uac = g_audio->uac;
+	g_audio->uac = NULL;
+
 	card = uac->card;
 	if (card)
 		snd_card_free_when_closed(card);
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/u_ether.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/u_ether.c
@@ -1163,8 +1163,6 @@
 		if (netif_running(dev->net))
 			eth_start(dev, GFP_ATOMIC);
 
-		netif_device_attach(dev->net);
-
 	/* on error, disable any endpoints  */
 	} else {
 		(void) usb_ep_disable(link->out_ep);
@@ -1202,7 +1200,7 @@
 
 	DBG(dev, "%s\n", __func__);
 
-	netif_device_detach(dev->net);
+	netif_stop_queue(dev->net);
 	netif_carrier_off(dev->net);
 
 	/* disable endpoints, forcing (synchronous) completion
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/u_serial.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/u_serial.c
@@ -575,9 +575,12 @@
 		 * we didn't in gs_start_tx() */
 		tty_wakeup(port->port.tty);
 	} else {
-		gs_free_requests(ep, head, &port->read_allocated);
-		gs_free_requests(port->port_usb->in, &port->write_pool,
-			&port->write_allocated);
+		/* Free reqs only if we are still connected */
+		if (port->port_usb) {
+			gs_free_requests(ep, head, &port->read_allocated);
+			gs_free_requests(port->port_usb->in, &port->write_pool,
+				&port->write_allocated);
+		}
 		status = -EIO;
 	}
 
@@ -1441,6 +1444,7 @@
 	spin_lock(&port->port_lock);
 	spin_unlock(&serial_port_lock);
 	port->suspended = true;
+	port->start_delayed = true;
 	spin_unlock_irqrestore(&port->port_lock, flags);
 }
 EXPORT_SYMBOL_GPL(gserial_suspend);
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/uvc_configfs.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/uvc_configfs.c
@@ -13,6 +13,7 @@
 #include "uvc_configfs.h"
 
 #include <linux/sort.h>
+#include <linux/usb/uvc.h>
 #include <linux/usb/video.h>
 
 /* -----------------------------------------------------------------------------
@@ -92,10 +93,10 @@
 
 	while (pg - page < len) {
 		i = 0;
-		while (i < sizeof(buf) && (pg - page < len) &&
+		while (i < bufsize && (pg - page < len) &&
 		       *pg != '\0' && *pg != '\n')
 			buf[i++] = *pg++;
-		if (i == sizeof(buf)) {
+		if (i == bufsize) {
 			ret = -EINVAL;
 			goto out_free_buf;
 		}
@@ -2260,6 +2261,8 @@
 	struct f_uvc_opts *opts;
 	struct config_item *opts_item;
 	struct mutex *su_mutex = &ch->fmt.group.cg_subsys->su_mutex;
+	const struct uvc_format_desc *format;
+	u8 tmpguidFormat[sizeof(ch->desc.guidFormat)];
 	int ret;
 
 	mutex_lock(su_mutex); /* for navigating configfs hierarchy */
@@ -2273,7 +2276,16 @@
 		goto end;
 	}
 
-	memcpy(ch->desc.guidFormat, page,
+	memcpy(tmpguidFormat, page,
+	       min(sizeof(tmpguidFormat), len));
+
+	format = uvc_format_by_guid(tmpguidFormat);
+	if (!format) {
+		ret = -EINVAL;
+		goto end;
+	}
+
+	memcpy(ch->desc.guidFormat, tmpguidFormat,
 	       min(sizeof(ch->desc.guidFormat), len));
 	ret = sizeof(ch->desc.guidFormat);
 
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/uvc_v4l2.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/uvc_v4l2.c
@@ -121,6 +121,9 @@
 	list_for_each_entry(format, &uvc->header->formats, entry) {
 		const struct uvc_format_desc *fmtdesc = to_uvc_format(format->fmt);
 
+		if (IS_ERR(fmtdesc))
+			continue;
+
 		if (fmtdesc->fcc == pixelformat) {
 			uformat = format->fmt;
 			break;
@@ -240,6 +243,7 @@
 	struct uvc_video *video = &uvc->video;
 	struct uvcg_format *uformat;
 	struct uvcg_frame *uframe;
+	const struct uvc_format_desc *fmtdesc;
 	u8 *fcc;
 
 	if (fmt->type != video->queue.queue.type)
@@ -265,7 +269,10 @@
 	fmt->fmt.pix.field = V4L2_FIELD_NONE;
 	fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(uformat, uframe);
 	fmt->fmt.pix.sizeimage = uvc_get_frame_size(uformat, uframe);
-	fmt->fmt.pix.pixelformat = to_uvc_format(uformat)->fcc;
+	fmtdesc = to_uvc_format(uformat);
+	if (IS_ERR(fmtdesc))
+		return PTR_ERR(fmtdesc);
+	fmt->fmt.pix.pixelformat = fmtdesc->fcc;
 	fmt->fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
 	fmt->fmt.pix.priv = 0;
 
@@ -375,6 +382,9 @@
 		return -EINVAL;
 
 	fmtdesc = to_uvc_format(uformat);
+	if (IS_ERR(fmtdesc))
+		return PTR_ERR(fmtdesc);
+
 	f->pixelformat = fmtdesc->fcc;
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/function/uvc_video.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/function/uvc_video.c
@@ -35,6 +35,9 @@
 
 	data[1] = UVC_STREAM_EOH | video->fid;
 
+	if (video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE)
+		data[1] |= UVC_STREAM_ERR;
+
 	if (video->queue.buf_used == 0 && ts.tv_sec) {
 		/* dwClockFrequency is 48 MHz */
 		u32 pts = ((u64)ts.tv_sec * USEC_PER_SEC + ts.tv_nsec / NSEC_PER_USEC) * 48;
@@ -470,6 +473,10 @@
 			 * up later.
 			 */
 			list_add_tail(&to_queue->list, &video->req_free);
+			/*
+			 * There is a new free request - wake up the pump.
+			 */
+			queue_work(video->async_wq, &video->pump);
 		}
 	} else {
 		uvc_video_free_request(ureq, ep);
@@ -594,10 +601,7 @@
 		 */
 		spin_lock_irqsave(&queue->irqlock, flags);
 		buf = uvcg_queue_head(queue);
-
-		if (buf != NULL) {
-			video->encode(req, video, buf);
-		} else {
+		if (!buf) {
 			/*
 			 * Either the queue has been disconnected or no video buffer
 			 * available for bulk transfer. Either way, stop processing
@@ -607,6 +611,8 @@
 			break;
 		}
 
+		video->encode(req, video, buf);
+
 		spin_unlock_irqrestore(&queue->irqlock, flags);
 
 		spin_lock_irqsave(&video->req_lock, flags);
@@ -756,6 +762,7 @@
 	video->req_int_count = 0;
 
 	uvc_video_ep_queue_initial_requests(video);
+	queue_work(video->async_wq, &video->pump);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/udc/aspeed_udc.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/udc/aspeed_udc.c
@@ -66,8 +66,8 @@
 #define USB_UPSTREAM_EN			BIT(0)
 
 /* Main config reg */
-#define UDC_CFG_SET_ADDR(x)		((x) & 0x3f)
-#define UDC_CFG_ADDR_MASK		(0x3f)
+#define UDC_CFG_SET_ADDR(x)		((x) & UDC_CFG_ADDR_MASK)
+#define UDC_CFG_ADDR_MASK		GENMASK(6, 0)
 
 /* Interrupt ctrl & status reg */
 #define UDC_IRQ_EP_POOL_NAK		BIT(17)
@@ -1009,6 +1009,8 @@
 		break;
 	case USB_RECIP_ENDPOINT:
 		epnum = crq.wIndex & USB_ENDPOINT_NUMBER_MASK;
+		if (epnum >= AST_UDC_NUM_ENDPOINTS)
+			goto stall;
 		status = udc->ep[epnum].stopped;
 		break;
 	default:
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c
@@ -2251,7 +2251,6 @@
 {
 	u32 max_speed;
 	void *buf;
-	int val;
 	int ret;
 
 	pdev->usb_regs = pdev->regs;
@@ -2261,14 +2260,9 @@
 	pdev->adma_regs = pdev->regs + CDNS2_ADMA_REGS_OFFSET;
 
 	/* Reset controller. */
-	set_reg_bit_8(&pdev->usb_regs->cpuctrl, CPUCTRL_SW_RST);
-
-	ret = readl_poll_timeout_atomic(&pdev->usb_regs->cpuctrl, val,
-					!(val & CPUCTRL_SW_RST), 1, 10000);
-	if (ret) {
-		dev_err(pdev->dev, "Error: reset controller timeout\n");
-		return -EINVAL;
-	}
+	writeb(CPUCTRL_SW_RST | CPUCTRL_UPCLK | CPUCTRL_WUEN,
+	       &pdev->usb_regs->cpuctrl);
+	usleep_range(5, 10);
 
 	usb_initialize_gadget(pdev->dev, &pdev->gadget, NULL);
 
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/udc/cdns2/cdns2-gadget.h
+++ linux-qcom-6.8.0/drivers/usb/gadget/udc/cdns2/cdns2-gadget.h
@@ -292,8 +292,17 @@
 #define SPEEDCTRL_HSDISABLE	BIT(7)
 
 /* CPUCTRL- bitmasks. */
+/* UP clock enable */
+#define CPUCTRL_UPCLK		BIT(0)
 /* Controller reset bit. */
 #define CPUCTRL_SW_RST		BIT(1)
+/**
+ * If the wuen bit is ‘1’, the upclken is automatically set to ‘1’ after
+ * detecting rising edge of wuintereq interrupt. If the wuen bit is ‘0’,
+ * the wuintereq interrupt is ignored.
+ */
+#define CPUCTRL_WUEN		BIT(7)
+
 
 /**
  * struct cdns2_adma_regs - ADMA controller registers.
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/udc/core.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/udc/core.c
@@ -118,12 +118,10 @@
 		goto out;
 
 	/* UDC drivers can't handle endpoints with maxpacket size 0 */
-	if (usb_endpoint_maxp(ep->desc) == 0) {
-		/*
-		 * We should log an error message here, but we can't call
-		 * dev_err() because there's no way to find the gadget
-		 * given only ep.
-		 */
+	if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) {
+		WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name,
+			  (!ep->desc) ? "NULL descriptor" : "maxpacket 0");
+
 		ret = -EINVAL;
 		goto out;
 	}
@@ -292,7 +290,9 @@
 {
 	int ret = 0;
 
-	if (WARN_ON_ONCE(!ep->enabled && ep->address)) {
+	if (!ep->enabled && ep->address) {
+		pr_debug("USB gadget: queue request to disabled ep 0x%x (%s)\n",
+				 ep->address, ep->name);
 		ret = -ESHUTDOWN;
 		goto out;
 	}
@@ -1682,6 +1682,7 @@
 	driver->driver.bus = &gadget_bus_type;
 	driver->driver.owner = owner;
 	driver->driver.mod_name = mod_name;
+	driver->driver.probe_type = PROBE_FORCE_SYNCHRONOUS;
 	ret = driver_register(&driver->driver);
 	if (ret) {
 		pr_warn("%s: driver registration failed: %d\n",
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/udc/dummy_hcd.c
@@ -30,7 +30,7 @@
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/init.h>
-#include <linux/timer.h>
+#include <linux/hrtimer.h>
 #include <linux/list.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
@@ -50,6 +50,8 @@
 #define POWER_BUDGET	500	/* in mA; use 8 for low-power port testing */
 #define POWER_BUDGET_3	900	/* in mA */
 
+#define DUMMY_TIMER_INT_NSECS	125000 /* 1 microframe */
+
 static const char	driver_name[] = "dummy_hcd";
 static const char	driver_desc[] = "USB Host+Gadget Emulator";
 
@@ -240,7 +242,7 @@
 struct dummy_hcd {
 	struct dummy			*dum;
 	enum dummy_rh_state		rh_state;
-	struct timer_list		timer;
+	struct hrtimer			timer;
 	u32				port_status;
 	u32				old_status;
 	unsigned long			re_timeout;
@@ -252,6 +254,7 @@
 	u32				stream_en_ep;
 	u8				num_stream[30 / 2];
 
+	unsigned			timer_pending:1;
 	unsigned			active:1;
 	unsigned			old_active:1;
 	unsigned			resuming:1;
@@ -1301,8 +1304,11 @@
 		urb->error_count = 1;		/* mark as a new urb */
 
 	/* kick the scheduler, it'll do the rest */
-	if (!timer_pending(&dum_hcd->timer))
-		mod_timer(&dum_hcd->timer, jiffies + 1);
+	if (!dum_hcd->timer_pending) {
+		dum_hcd->timer_pending = 1;
+		hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS),
+				HRTIMER_MODE_REL_SOFT);
+	}
 
  done:
 	spin_unlock_irqrestore(&dum_hcd->dum->lock, flags);
@@ -1321,9 +1327,10 @@
 	spin_lock_irqsave(&dum_hcd->dum->lock, flags);
 
 	rc = usb_hcd_check_unlink_urb(hcd, urb, status);
-	if (!rc && dum_hcd->rh_state != DUMMY_RH_RUNNING &&
-			!list_empty(&dum_hcd->urbp_list))
-		mod_timer(&dum_hcd->timer, jiffies);
+	if (rc == 0 && !dum_hcd->timer_pending) {
+		dum_hcd->timer_pending = 1;
+		hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL_SOFT);
+	}
 
 	spin_unlock_irqrestore(&dum_hcd->dum->lock, flags);
 	return rc;
@@ -1777,7 +1784,7 @@
  * drivers except that the callbacks are invoked from soft interrupt
  * context.
  */
-static void dummy_timer(struct timer_list *t)
+static enum hrtimer_restart dummy_timer(struct hrtimer *t)
 {
 	struct dummy_hcd	*dum_hcd = from_timer(dum_hcd, t, timer);
 	struct dummy		*dum = dum_hcd->dum;
@@ -1808,16 +1815,15 @@
 		break;
 	}
 
-	/* FIXME if HZ != 1000 this will probably misbehave ... */
-
 	/* look at each urb queued by the host side driver */
 	spin_lock_irqsave(&dum->lock, flags);
+	dum_hcd->timer_pending = 0;
 
 	if (!dum_hcd->udev) {
 		dev_err(dummy_dev(dum_hcd),
 				"timer fired with no URBs pending?\n");
 		spin_unlock_irqrestore(&dum->lock, flags);
-		return;
+		return HRTIMER_NORESTART;
 	}
 	dum_hcd->next_frame_urbp = NULL;
 
@@ -1993,12 +1999,17 @@
 	if (list_empty(&dum_hcd->urbp_list)) {
 		usb_put_dev(dum_hcd->udev);
 		dum_hcd->udev = NULL;
-	} else if (dum_hcd->rh_state == DUMMY_RH_RUNNING) {
+	} else if (!dum_hcd->timer_pending &&
+			dum_hcd->rh_state == DUMMY_RH_RUNNING) {
 		/* want a 1 msec delay here */
-		mod_timer(&dum_hcd->timer, jiffies + msecs_to_jiffies(1));
+		dum_hcd->timer_pending = 1;
+		hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS),
+				HRTIMER_MODE_REL_SOFT);
 	}
 
 	spin_unlock_irqrestore(&dum->lock, flags);
+
+	return HRTIMER_NORESTART;
 }
 
 /*-------------------------------------------------------------------------*/
@@ -2386,8 +2397,10 @@
 	} else {
 		dum_hcd->rh_state = DUMMY_RH_RUNNING;
 		set_link_state(dum_hcd);
-		if (!list_empty(&dum_hcd->urbp_list))
-			mod_timer(&dum_hcd->timer, jiffies);
+		if (!list_empty(&dum_hcd->urbp_list)) {
+			dum_hcd->timer_pending = 1;
+			hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL_SOFT);
+		}
 		hcd->state = HC_STATE_RUNNING;
 	}
 	spin_unlock_irq(&dum_hcd->dum->lock);
@@ -2465,7 +2478,8 @@
 
 static int dummy_start_ss(struct dummy_hcd *dum_hcd)
 {
-	timer_setup(&dum_hcd->timer, dummy_timer, 0);
+	hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
+	dum_hcd->timer.function = dummy_timer;
 	dum_hcd->rh_state = DUMMY_RH_RUNNING;
 	dum_hcd->stream_en_ep = 0;
 	INIT_LIST_HEAD(&dum_hcd->urbp_list);
@@ -2494,7 +2508,8 @@
 		return dummy_start_ss(dum_hcd);
 
 	spin_lock_init(&dum_hcd->dum->lock);
-	timer_setup(&dum_hcd->timer, dummy_timer, 0);
+	hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
+	dum_hcd->timer.function = dummy_timer;
 	dum_hcd->rh_state = DUMMY_RH_RUNNING;
 
 	INIT_LIST_HEAD(&dum_hcd->urbp_list);
@@ -2513,8 +2528,12 @@
 
 static void dummy_stop(struct usb_hcd *hcd)
 {
-	device_remove_file(dummy_dev(hcd_to_dummy_hcd(hcd)), &dev_attr_urbs);
-	dev_info(dummy_dev(hcd_to_dummy_hcd(hcd)), "stopped\n");
+	struct dummy_hcd	*dum_hcd = hcd_to_dummy_hcd(hcd);
+
+	hrtimer_cancel(&dum_hcd->timer);
+	dum_hcd->timer_pending = 0;
+	device_remove_file(dummy_dev(dum_hcd), &dev_attr_urbs);
+	dev_info(dummy_dev(dum_hcd), "stopped\n");
 }
 
 /*-------------------------------------------------------------------------*/
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/udc/fsl_udc_core.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/udc/fsl_udc_core.c
@@ -2486,7 +2486,7 @@
 	/* setup the udc->eps[] for non-control endpoints and link
 	 * to gadget.ep_list */
 	for (i = 1; i < (int)(udc_controller->max_ep / 2); i++) {
-		char name[14];
+		char name[16];
 
 		sprintf(name, "ep%dout", i);
 		struct_ep_setup(udc_controller, i * 2, name, 1);
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/udc/net2272.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/udc/net2272.c
@@ -2650,7 +2650,7 @@
 		goto err_req;
 	}
 
-	ret = net2272_probe_fin(dev, IRQF_TRIGGER_LOW);
+	ret = net2272_probe_fin(dev, irqflags);
 	if (ret)
 		goto err_io;
 
--- linux-qcom-6.8.0.orig/drivers/usb/gadget/udc/tegra-xudc.c
+++ linux-qcom-6.8.0/drivers/usb/gadget/udc/tegra-xudc.c
@@ -3491,8 +3491,8 @@
 
 static int tegra_xudc_phy_get(struct tegra_xudc *xudc)
 {
-	int err = 0, usb3;
-	unsigned int i;
+	int err = 0, usb3_companion_port;
+	unsigned int i, j;
 
 	xudc->utmi_phy = devm_kcalloc(xudc->dev, xudc->soc->num_phys,
 					   sizeof(*xudc->utmi_phy), GFP_KERNEL);
@@ -3520,7 +3520,7 @@
 		if (IS_ERR(xudc->utmi_phy[i])) {
 			err = PTR_ERR(xudc->utmi_phy[i]);
 			dev_err_probe(xudc->dev, err,
-				      "failed to get usb2-%d PHY\n", i);
+				"failed to get PHY for phy-name usb2-%d\n", i);
 			goto clean_up;
 		} else if (xudc->utmi_phy[i]) {
 			/* Get usb-phy, if utmi phy is available */
@@ -3539,19 +3539,30 @@
 		}
 
 		/* Get USB3 phy */
-		usb3 = tegra_xusb_padctl_get_usb3_companion(xudc->padctl, i);
-		if (usb3 < 0)
+		usb3_companion_port = tegra_xusb_padctl_get_usb3_companion(xudc->padctl, i);
+		if (usb3_companion_port < 0)
 			continue;
 
-		snprintf(phy_name, sizeof(phy_name), "usb3-%d", usb3);
-		xudc->usb3_phy[i] = devm_phy_optional_get(xudc->dev, phy_name);
-		if (IS_ERR(xudc->usb3_phy[i])) {
-			err = PTR_ERR(xudc->usb3_phy[i]);
-			dev_err_probe(xudc->dev, err,
-				      "failed to get usb3-%d PHY\n", usb3);
-			goto clean_up;
-		} else if (xudc->usb3_phy[i])
-			dev_dbg(xudc->dev, "usb3-%d PHY registered", usb3);
+		for (j = 0; j < xudc->soc->num_phys; j++) {
+			snprintf(phy_name, sizeof(phy_name), "usb3-%d", j);
+			xudc->usb3_phy[i] = devm_phy_optional_get(xudc->dev, phy_name);
+			if (IS_ERR(xudc->usb3_phy[i])) {
+				err = PTR_ERR(xudc->usb3_phy[i]);
+				dev_err_probe(xudc->dev, err,
+					"failed to get PHY for phy-name usb3-%d\n", j);
+				goto clean_up;
+			} else if (xudc->usb3_phy[i]) {
+				int usb2_port =
+					tegra_xusb_padctl_get_port_number(xudc->utmi_phy[i]);
+				int usb3_port =
+					tegra_xusb_padctl_get_port_number(xudc->usb3_phy[i]);
+				if (usb3_port == usb3_companion_port) {
+					dev_dbg(xudc->dev, "USB2 port %d is paired with USB3 port %d for device mode port %d\n",
+					 usb2_port, usb3_port, i);
+					break;
+				}
+			}
+		}
 	}
 
 	return err;
--- linux-qcom-6.8.0.orig/drivers/usb/host/ehci-sh.c
+++ linux-qcom-6.8.0/drivers/usb/host/ehci-sh.c
@@ -119,8 +119,12 @@
 	if (IS_ERR(priv->iclk))
 		priv->iclk = NULL;
 
-	clk_enable(priv->fclk);
-	clk_enable(priv->iclk);
+	ret = clk_enable(priv->fclk);
+	if (ret)
+		goto fail_request_resource;
+	ret = clk_enable(priv->iclk);
+	if (ret)
+		goto fail_iclk;
 
 	ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
 	if (ret != 0) {
@@ -136,6 +140,7 @@
 
 fail_add_hcd:
 	clk_disable(priv->iclk);
+fail_iclk:
 	clk_disable(priv->fclk);
 
 fail_request_resource:
--- linux-qcom-6.8.0.orig/drivers/usb/host/ehci-spear.c
+++ linux-qcom-6.8.0/drivers/usb/host/ehci-spear.c
@@ -105,7 +105,9 @@
 	/* registers start at offset 0x0 */
 	hcd_to_ehci(hcd)->caps = hcd->regs;
 
-	clk_prepare_enable(sehci->clk);
+	retval = clk_prepare_enable(sehci->clk);
+	if (retval)
+		goto err_put_hcd;
 	retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
 	if (retval)
 		goto err_stop_ehci;
@@ -130,8 +132,7 @@
 
 	usb_remove_hcd(hcd);
 
-	if (sehci->clk)
-		clk_disable_unprepare(sehci->clk);
+	clk_disable_unprepare(sehci->clk);
 	usb_put_hcd(hcd);
 }
 
--- linux-qcom-6.8.0.orig/drivers/usb/host/max3421-hcd.c
+++ linux-qcom-6.8.0/drivers/usb/host/max3421-hcd.c
@@ -779,11 +779,17 @@
 				retval = 1;
 				dev_dbg(&spi->dev, "%s: URB %p unlinked=%d",
 					__func__, urb, urb->unlinked);
-				usb_hcd_unlink_urb_from_ep(hcd, urb);
-				spin_unlock_irqrestore(&max3421_hcd->lock,
-						       flags);
-				usb_hcd_giveback_urb(hcd, urb, 0);
-				spin_lock_irqsave(&max3421_hcd->lock, flags);
+				if (urb == max3421_hcd->curr_urb) {
+					max3421_hcd->urb_done = 1;
+					max3421_hcd->hien &= ~(BIT(MAX3421_HI_HXFRDN_BIT) |
+							       BIT(MAX3421_HI_RCVDAV_BIT));
+				} else {
+					usb_hcd_unlink_urb_from_ep(hcd, urb);
+					spin_unlock_irqrestore(&max3421_hcd->lock,
+							       flags);
+					usb_hcd_giveback_urb(hcd, urb, 0);
+					spin_lock_irqsave(&max3421_hcd->lock, flags);
+				}
 			}
 		}
 	}
--- linux-qcom-6.8.0.orig/drivers/usb/host/ohci-hcd.c
+++ linux-qcom-6.8.0/drivers/usb/host/ohci-hcd.c
@@ -888,6 +888,7 @@
 	/* Check for an all 1's result which is a typical consequence
 	 * of dead, unclocked, or unplugged (CardBus...) devices
 	 */
+again:
 	if (ints == ~(u32)0) {
 		ohci->rh_state = OHCI_RH_HALTED;
 		ohci_dbg (ohci, "device removed!\n");
@@ -982,6 +983,13 @@
 	}
 	spin_unlock(&ohci->lock);
 
+	/* repeat until all enabled interrupts are handled */
+	if (ohci->rh_state != OHCI_RH_HALTED) {
+		ints = ohci_readl(ohci, &regs->intrstatus);
+		if (ints && (ints & ohci_readl(ohci, &regs->intrenable)))
+			goto again;
+	}
+
 	return IRQ_HANDLED;
 }
 
--- linux-qcom-6.8.0.orig/drivers/usb/host/pci-quirks.c
+++ linux-qcom-6.8.0/drivers/usb/host/pci-quirks.c
@@ -1272,6 +1272,11 @@
 			return;
 	}
 
+	/* Skip handoff for Renesas PCI USB controller on QCOM SOC */
+	if ((pdev->vendor == PCI_VENDOR_ID_RENESAS) &&
+		(pcie_find_root_port(pdev)->vendor == PCI_VENDOR_ID_QCOM))
+		return;
+
 	if (pdev->class != PCI_CLASS_SERIAL_USB_UHCI &&
 			pdev->class != PCI_CLASS_SERIAL_USB_OHCI &&
 			pdev->class != PCI_CLASS_SERIAL_USB_EHCI &&
--- linux-qcom-6.8.0.orig/drivers/usb/host/sl811-hcd.c
+++ linux-qcom-6.8.0/drivers/usb/host/sl811-hcd.c
@@ -585,6 +585,7 @@
 		finish_request(sl811, ep, urb, urbstat);
 }
 
+#ifdef QUIRK2
 static inline u8 checkdone(struct sl811 *sl811)
 {
 	u8	ctl;
@@ -616,6 +617,7 @@
 #endif
 	return irqstat;
 }
+#endif
 
 static irqreturn_t sl811h_irq(struct usb_hcd *hcd)
 {
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-caps.h
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-caps.h
@@ -0,0 +1,85 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/* hc_capbase bitmasks */
+/* bits 7:0 - how long is the Capabilities register */
+#define HC_LENGTH(p)		XHCI_HC_LENGTH(p)
+/* bits 31:16	*/
+#define HC_VERSION(p)		(((p) >> 16) & 0xffff)
+
+/* HCSPARAMS1 - hcs_params1 - bitmasks */
+/* bits 0:7, Max Device Slots */
+#define HCS_MAX_SLOTS(p)	(((p) >> 0) & 0xff)
+#define HCS_SLOTS_MASK		0xff
+/* bits 8:18, Max Interrupters */
+#define HCS_MAX_INTRS(p)	(((p) >> 8) & 0x7ff)
+/* bits 24:31, Max Ports - max value is 0x7F = 127 ports */
+#define HCS_MAX_PORTS(p)	(((p) >> 24) & 0x7f)
+
+/* HCSPARAMS2 - hcs_params2 - bitmasks */
+/* bits 0:3, frames or uframes that SW needs to queue transactions
+ * ahead of the HW to meet periodic deadlines */
+#define HCS_IST(p)		(((p) >> 0) & 0xf)
+/* bits 4:7, max number of Event Ring segments */
+#define HCS_ERST_MAX(p)		(((p) >> 4) & 0xf)
+/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */
+/* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
+/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */
+#define HCS_MAX_SCRATCHPAD(p)   ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f))
+
+/* HCSPARAMS3 - hcs_params3 - bitmasks */
+/* bits 0:7, Max U1 to U0 latency for the roothub ports */
+#define HCS_U1_LATENCY(p)	(((p) >> 0) & 0xff)
+/* bits 16:31, Max U2 to U0 latency for the roothub ports */
+#define HCS_U2_LATENCY(p)	(((p) >> 16) & 0xffff)
+
+/* HCCPARAMS - hcc_params - bitmasks */
+/* true: HC can use 64-bit address pointers */
+#define HCC_64BIT_ADDR(p)	((p) & (1 << 0))
+/* true: HC can do bandwidth negotiation */
+#define HCC_BANDWIDTH_NEG(p)	((p) & (1 << 1))
+/* true: HC uses 64-byte Device Context structures
+ * FIXME 64-byte context structures aren't supported yet.
+ */
+#define HCC_64BYTE_CONTEXT(p)	((p) & (1 << 2))
+/* true: HC has port power switches */
+#define HCC_PPC(p)		((p) & (1 << 3))
+/* true: HC has port indicators */
+#define HCS_INDICATOR(p)	((p) & (1 << 4))
+/* true: HC has Light HC Reset Capability */
+#define HCC_LIGHT_RESET(p)	((p) & (1 << 5))
+/* true: HC supports latency tolerance messaging */
+#define HCC_LTC(p)		((p) & (1 << 6))
+/* true: no secondary Stream ID Support */
+#define HCC_NSS(p)		((p) & (1 << 7))
+/* true: HC supports Stopped - Short Packet */
+#define HCC_SPC(p)		((p) & (1 << 9))
+/* true: HC has Contiguous Frame ID Capability */
+#define HCC_CFC(p)		((p) & (1 << 11))
+/* Max size for Primary Stream Arrays - 2^(n+1), where n is bits 12:15 */
+#define HCC_MAX_PSA(p)		(1 << ((((p) >> 12) & 0xf) + 1))
+/* Extended Capabilities pointer from PCI base - section 5.3.6 */
+#define HCC_EXT_CAPS(p)		XHCI_HCC_EXT_CAPS(p)
+
+#define CTX_SIZE(_hcc)		(HCC_64BYTE_CONTEXT(_hcc) ? 64 : 32)
+
+/* db_off bitmask - bits 0:1 reserved */
+#define	DBOFF_MASK	(~0x3)
+
+/* run_regs_off bitmask - bits 0:4 reserved */
+#define	RTSOFF_MASK	(~0x1f)
+
+/* HCCPARAMS2 - hcc_params2 - bitmasks */
+/* true: HC supports U3 entry Capability */
+#define	HCC2_U3C(p)		((p) & (1 << 0))
+/* true: HC supports Configure endpoint command Max exit latency too large */
+#define	HCC2_CMC(p)		((p) & (1 << 1))
+/* true: HC supports Force Save context Capability */
+#define	HCC2_FSC(p)		((p) & (1 << 2))
+/* true: HC supports Compliance Transition Capability */
+#define	HCC2_CTC(p)		((p) & (1 << 3))
+/* true: HC support Large ESIT payload Capability > 48k */
+#define	HCC2_LEC(p)		((p) & (1 << 4))
+/* true: HC support Configuration Information Capability */
+#define	HCC2_CIC(p)		((p) & (1 << 5))
+/* true: HC support Extended TBC Capability, Isoc burst count > 65535 */
+#define	HCC2_ETC(p)		((p) & (1 << 6))
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-dbgcap.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-dbgcap.c
@@ -173,16 +173,18 @@
 	spin_lock(&dbc->lock);
 }
 
-static void xhci_dbc_flush_single_request(struct dbc_request *req)
+static void trb_to_noop(union xhci_trb *trb)
 {
-	union xhci_trb	*trb = req->trb;
-
 	trb->generic.field[0]	= 0;
 	trb->generic.field[1]	= 0;
 	trb->generic.field[2]	= 0;
 	trb->generic.field[3]	&= cpu_to_le32(TRB_CYCLE);
 	trb->generic.field[3]	|= cpu_to_le32(TRB_TYPE(TRB_TR_NOOP));
+}
 
+static void xhci_dbc_flush_single_request(struct dbc_request *req)
+{
+	trb_to_noop(req->trb);
 	xhci_dbc_giveback(req, -ESHUTDOWN);
 }
 
@@ -648,7 +650,6 @@
 	case DS_DISABLED:
 		return;
 	case DS_CONFIGURED:
-	case DS_STALLED:
 		if (dbc->driver->disconnect)
 			dbc->driver->disconnect(dbc);
 		break;
@@ -669,6 +670,23 @@
 }
 
 static void
+handle_ep_halt_changes(struct xhci_dbc *dbc, struct dbc_ep *dep, bool halted)
+{
+	if (halted) {
+		dev_info(dbc->dev, "DbC Endpoint halted\n");
+		dep->halted = 1;
+
+	} else if (dep->halted) {
+		dev_info(dbc->dev, "DbC Endpoint halt cleared\n");
+		dep->halted = 0;
+
+		if (!list_empty(&dep->list_pending))
+			writel(DBC_DOOR_BELL_TARGET(dep->direction),
+			       &dbc->regs->doorbell);
+	}
+}
+
+static void
 dbc_handle_port_status(struct xhci_dbc *dbc, union xhci_trb *event)
 {
 	u32			portsc;
@@ -696,6 +714,7 @@
 	struct xhci_ring	*ring;
 	int			ep_id;
 	int			status;
+	struct xhci_ep_ctx	*ep_ctx;
 	u32			comp_code;
 	size_t			remain_length;
 	struct dbc_request	*req = NULL, *r;
@@ -705,8 +724,30 @@
 	ep_id		= TRB_TO_EP_ID(le32_to_cpu(event->generic.field[3]));
 	dep		= (ep_id == EPID_OUT) ?
 				get_out_ep(dbc) : get_in_ep(dbc);
+	ep_ctx		= (ep_id == EPID_OUT) ?
+				dbc_bulkout_ctx(dbc) : dbc_bulkin_ctx(dbc);
 	ring		= dep->ring;
 
+	/* Match the pending request: */
+	list_for_each_entry(r, &dep->list_pending, list_pending) {
+		if (r->trb_dma == event->trans_event.buffer) {
+			req = r;
+			break;
+		}
+		if (r->status == -COMP_STALL_ERROR) {
+			dev_warn(dbc->dev, "Give back stale stalled req\n");
+			ring->num_trbs_free++;
+			xhci_dbc_giveback(r, 0);
+		}
+	}
+
+	if (!req) {
+		dev_warn(dbc->dev, "no matched request\n");
+		return;
+	}
+
+	trace_xhci_dbc_handle_transfer(ring, &req->trb->generic);
+
 	switch (comp_code) {
 	case COMP_SUCCESS:
 		remain_length = 0;
@@ -717,31 +758,49 @@
 	case COMP_TRB_ERROR:
 	case COMP_BABBLE_DETECTED_ERROR:
 	case COMP_USB_TRANSACTION_ERROR:
-	case COMP_STALL_ERROR:
 		dev_warn(dbc->dev, "tx error %d detected\n", comp_code);
 		status = -comp_code;
 		break;
+	case COMP_STALL_ERROR:
+		dev_warn(dbc->dev, "Stall error at bulk TRB %llx, remaining %zu, ep deq %llx\n",
+			 event->trans_event.buffer, remain_length, ep_ctx->deq);
+		status = 0;
+		dep->halted = 1;
+
+		/*
+		 * xHC DbC may trigger a STALL bulk xfer event when host sends a
+		 * ClearFeature(ENDPOINT_HALT) request even if there wasn't an
+		 * active bulk transfer.
+		 *
+		 * Don't give back this transfer request as hardware will later
+		 * start processing TRBs starting from this 'STALLED' TRB,
+		 * causing TRBs and requests to be out of sync.
+		 *
+		 * If STALL event shows some bytes were transferred then assume
+		 * it's an actual transfer issue and give back the request.
+		 * In this case mark the TRB as No-Op to avoid hw from using the
+		 * TRB again.
+		 */
+
+		if ((ep_ctx->deq & ~TRB_CYCLE) == event->trans_event.buffer) {
+			dev_dbg(dbc->dev, "Ep stopped on Stalled TRB\n");
+			if (remain_length == req->length) {
+				dev_dbg(dbc->dev, "Spurious stall event, keep req\n");
+				req->status = -COMP_STALL_ERROR;
+				req->actual = 0;
+				return;
+			}
+			dev_dbg(dbc->dev, "Give back stalled req, but turn TRB to No-op\n");
+			trb_to_noop(req->trb);
+		}
+		break;
+
 	default:
 		dev_err(dbc->dev, "unknown tx error %d\n", comp_code);
 		status = -comp_code;
 		break;
 	}
 
-	/* Match the pending request: */
-	list_for_each_entry(r, &dep->list_pending, list_pending) {
-		if (r->trb_dma == event->trans_event.buffer) {
-			req = r;
-			break;
-		}
-	}
-
-	if (!req) {
-		dev_warn(dbc->dev, "no matched request\n");
-		return;
-	}
-
-	trace_xhci_dbc_handle_transfer(ring, &req->trb->generic);
-
 	ring->num_trbs_free++;
 	req->actual = req->length - remain_length;
 	xhci_dbc_giveback(req, status);
@@ -761,7 +820,6 @@
 static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)
 {
 	dma_addr_t		deq;
-	struct dbc_ep		*dep;
 	union xhci_trb		*evt;
 	u32			ctrl, portsc;
 	bool			update_erdp = false;
@@ -813,43 +871,17 @@
 			return EVT_DISC;
 		}
 
-		/* Handle endpoint stall event: */
+		/* Check and handle changes in endpoint halt status */
 		ctrl = readl(&dbc->regs->control);
-		if ((ctrl & DBC_CTRL_HALT_IN_TR) ||
-		    (ctrl & DBC_CTRL_HALT_OUT_TR)) {
-			dev_info(dbc->dev, "DbC Endpoint stall\n");
-			dbc->state = DS_STALLED;
-
-			if (ctrl & DBC_CTRL_HALT_IN_TR) {
-				dep = get_in_ep(dbc);
-				xhci_dbc_flush_endpoint_requests(dep);
-			}
-
-			if (ctrl & DBC_CTRL_HALT_OUT_TR) {
-				dep = get_out_ep(dbc);
-				xhci_dbc_flush_endpoint_requests(dep);
-			}
-
-			return EVT_DONE;
-		}
+		handle_ep_halt_changes(dbc, get_in_ep(dbc), ctrl & DBC_CTRL_HALT_IN_TR);
+		handle_ep_halt_changes(dbc, get_out_ep(dbc), ctrl & DBC_CTRL_HALT_OUT_TR);
 
 		/* Clear DbC run change bit: */
 		if (ctrl & DBC_CTRL_DBC_RUN_CHANGE) {
 			writel(ctrl, &dbc->regs->control);
 			ctrl = readl(&dbc->regs->control);
 		}
-
 		break;
-	case DS_STALLED:
-		ctrl = readl(&dbc->regs->control);
-		if (!(ctrl & DBC_CTRL_HALT_IN_TR) &&
-		    !(ctrl & DBC_CTRL_HALT_OUT_TR) &&
-		    (ctrl & DBC_CTRL_DBC_RUN)) {
-			dbc->state = DS_CONFIGURED;
-			break;
-		}
-
-		return EVT_DONE;
 	default:
 		dev_err(dbc->dev, "Unknown DbC state %d\n", dbc->state);
 		break;
@@ -931,7 +963,6 @@
 	[DS_ENABLED] = "enabled",
 	[DS_CONNECTED] = "connected",
 	[DS_CONFIGURED] = "configured",
-	[DS_STALLED] = "stalled",
 };
 
 static ssize_t dbc_show(struct device *dev,
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-dbgcap.h
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-dbgcap.h
@@ -81,7 +81,6 @@
 	DS_ENABLED,
 	DS_CONNECTED,
 	DS_CONFIGURED,
-	DS_STALLED,
 	DS_MAX
 };
 
@@ -90,6 +89,7 @@
 	struct list_head		list_pending;
 	struct xhci_ring		*ring;
 	unsigned int			direction:1;
+	unsigned int			halted:1;
 };
 
 #define DBC_QUEUE_SIZE			16
@@ -109,7 +109,7 @@
 	struct tasklet_struct		push;
 
 	struct list_head		write_pool;
-	struct kfifo			write_fifo;
+	unsigned int			tx_boundary;
 
 	bool				registered;
 };
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-dbgtty.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-dbgtty.c
@@ -25,16 +25,26 @@
 }
 
 static unsigned int
-dbc_send_packet(struct dbc_port *port, char *packet, unsigned int size)
+dbc_kfifo_to_req(struct dbc_port *port, char *packet)
 {
-	unsigned int		len;
+	unsigned int	len;
 
-	len = kfifo_len(&port->write_fifo);
-	if (len < size)
-		size = len;
-	if (size != 0)
-		size = kfifo_out(&port->write_fifo, packet, size);
-	return size;
+	len = kfifo_len(&port->port.xmit_fifo);
+
+	if (len == 0)
+		return 0;
+
+	len = min(len, DBC_MAX_PACKET);
+
+	if (port->tx_boundary)
+		len = min(port->tx_boundary, len);
+
+	len = kfifo_out(&port->port.xmit_fifo, packet, len);
+
+	if (port->tx_boundary)
+		port->tx_boundary -= len;
+
+	return len;
 }
 
 static int dbc_start_tx(struct dbc_port *port)
@@ -49,7 +59,7 @@
 
 	while (!list_empty(pool)) {
 		req = list_entry(pool->next, struct dbc_request, list_pool);
-		len = dbc_send_packet(port, req->buf, DBC_MAX_PACKET);
+		len = dbc_kfifo_to_req(port, req->buf);
 		if (len == 0)
 			break;
 		do_tty_wake = true;
@@ -213,14 +223,32 @@
 {
 	struct dbc_port		*port = tty->driver_data;
 	unsigned long		flags;
+	unsigned int		written = 0;
 
 	spin_lock_irqsave(&port->port_lock, flags);
-	if (count)
-		count = kfifo_in(&port->write_fifo, buf, count);
-	dbc_start_tx(port);
+
+	/*
+	 * Treat tty write as one usb transfer. Make sure the writes are turned
+	 * into TRB request having the same size boundaries as the tty writes.
+	 * Don't add data to kfifo before previous write is turned into TRBs
+	 */
+	if (port->tx_boundary) {
+		spin_unlock_irqrestore(&port->port_lock, flags);
+		return 0;
+	}
+
+	if (count) {
+		written = kfifo_in(&port->port.xmit_fifo, buf, count);
+
+		if (written == count)
+			port->tx_boundary = kfifo_len(&port->port.xmit_fifo);
+
+		dbc_start_tx(port);
+	}
+
 	spin_unlock_irqrestore(&port->port_lock, flags);
 
-	return count;
+	return written;
 }
 
 static int dbc_tty_put_char(struct tty_struct *tty, u8 ch)
@@ -230,7 +258,7 @@
 	int			status;
 
 	spin_lock_irqsave(&port->port_lock, flags);
-	status = kfifo_put(&port->write_fifo, ch);
+	status = kfifo_put(&port->port.xmit_fifo, ch);
 	spin_unlock_irqrestore(&port->port_lock, flags);
 
 	return status;
@@ -253,7 +281,11 @@
 	unsigned int		room;
 
 	spin_lock_irqsave(&port->port_lock, flags);
-	room = kfifo_avail(&port->write_fifo);
+	room = kfifo_avail(&port->port.xmit_fifo);
+
+	if (port->tx_boundary)
+		room = 0;
+
 	spin_unlock_irqrestore(&port->port_lock, flags);
 
 	return room;
@@ -266,7 +298,7 @@
 	unsigned int		chars;
 
 	spin_lock_irqsave(&port->port_lock, flags);
-	chars = kfifo_len(&port->write_fifo);
+	chars = kfifo_len(&port->port.xmit_fifo);
 	spin_unlock_irqrestore(&port->port_lock, flags);
 
 	return chars;
@@ -424,7 +456,8 @@
 		goto err_idr;
 	}
 
-	ret = kfifo_alloc(&port->write_fifo, DBC_WRITE_BUF_SIZE, GFP_KERNEL);
+	ret = kfifo_alloc(&port->port.xmit_fifo, DBC_WRITE_BUF_SIZE,
+			  GFP_KERNEL);
 	if (ret)
 		goto err_exit_port;
 
@@ -453,7 +486,7 @@
 	xhci_dbc_free_requests(&port->read_pool);
 	xhci_dbc_free_requests(&port->write_pool);
 err_free_fifo:
-	kfifo_free(&port->write_fifo);
+	kfifo_free(&port->port.xmit_fifo);
 err_exit_port:
 	idr_remove(&dbc_tty_minors, port->minor);
 err_idr:
@@ -478,7 +511,7 @@
 	idr_remove(&dbc_tty_minors, port->minor);
 	mutex_unlock(&dbc_tty_minors_lock);
 
-	kfifo_free(&port->write_fifo);
+	kfifo_free(&port->port.xmit_fifo);
 	xhci_dbc_free_requests(&port->read_pool);
 	xhci_dbc_free_requests(&port->read_queue);
 	xhci_dbc_free_requests(&port->write_pool);
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-mem.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-mem.c
@@ -1888,7 +1888,7 @@
 
 	cancel_delayed_work_sync(&xhci->cmd_timer);
 
-	for (i = 0; i < xhci->max_interrupters; i++) {
+	for (i = 0; xhci->interrupters && i < xhci->max_interrupters; i++) {
 		if (xhci->interrupters[i]) {
 			xhci_remove_interrupter(xhci, xhci->interrupters[i]);
 			xhci_free_interrupter(xhci, xhci->interrupters[i]);
@@ -2280,24 +2280,24 @@
 }
 
 static struct xhci_interrupter *
-xhci_alloc_interrupter(struct xhci_hcd *xhci, int segs, gfp_t flags)
+xhci_alloc_interrupter(struct xhci_hcd *xhci, unsigned int segs, gfp_t flags)
 {
 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
 	struct xhci_interrupter *ir;
-	unsigned int num_segs = segs;
+	unsigned int max_segs;
 	int ret;
 
+	if (!segs)
+		segs = ERST_DEFAULT_SEGS;
+
+	max_segs = BIT(HCS_ERST_MAX(xhci->hcs_params2));
+	segs = min(segs, max_segs);
+
 	ir = kzalloc_node(sizeof(*ir), flags, dev_to_node(dev));
 	if (!ir)
 		return NULL;
 
-	/* number of ring segments should be greater than 0 */
-	if (segs <= 0)
-		num_segs = min_t(unsigned int, 1 << HCS_ERST_MAX(xhci->hcs_params2),
-			 ERST_MAX_SEGS);
-
-	ir->event_ring = xhci_ring_alloc(xhci, num_segs, 1, TYPE_EVENT, 0,
-					 flags);
+	ir->event_ring = xhci_ring_alloc(xhci, segs, 1, TYPE_EVENT, 0, flags);
 	if (!ir->event_ring) {
 		xhci_warn(xhci, "Failed to allocate interrupter event ring\n");
 		kfree(ir);
@@ -2346,7 +2346,10 @@
 	erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base);
 	erst_base &= ERST_BASE_RSVDP;
 	erst_base |= ir->erst.erst_dma_addr & ~ERST_BASE_RSVDP;
-	xhci_write_64(xhci, erst_base, &ir->ir_set->erst_base);
+	if (xhci->quirks & XHCI_WRITE_64_HI_LO)
+		hi_lo_writeq(erst_base, &ir->ir_set->erst_base);
+	else
+		xhci_write_64(xhci, erst_base, &ir->ir_set->erst_base);
 
 	/* Set the event ring dequeue address of this interrupter */
 	xhci_set_hc_event_deq(xhci, ir);
@@ -2355,7 +2358,7 @@
 }
 
 struct xhci_interrupter *
-xhci_create_secondary_interrupter(struct usb_hcd *hcd, int num_seg)
+xhci_create_secondary_interrupter(struct usb_hcd *hcd, unsigned int segs)
 {
 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 	struct xhci_interrupter *ir;
@@ -2365,7 +2368,7 @@
 	if (!xhci->interrupters || xhci->max_interrupters <= 1)
 		return NULL;
 
-	ir = xhci_alloc_interrupter(xhci, num_seg, GFP_KERNEL);
+	ir = xhci_alloc_interrupter(xhci, segs, GFP_KERNEL);
 	if (!ir)
 		return NULL;
 
@@ -2533,7 +2536,7 @@
 	if (xhci_add_interrupter(xhci, ir, 0))
 		goto fail;
 
-	xhci->isoc_bei_interval = AVOID_BEI_INTERVAL_MAX;
+	ir->isoc_bei_interval = AVOID_BEI_INTERVAL_MAX;
 
 	/*
 	 * XXX: Might need to set the Interrupter Moderation Register to
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-pci.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-pci.c
@@ -36,6 +36,7 @@
 
 #define PCI_VENDOR_ID_ETRON		0x1b6f
 #define PCI_DEVICE_ID_EJ168		0x7023
+#define PCI_DEVICE_ID_EJ188		0x7052
 
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI	0x8c31
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI	0x9c31
@@ -59,9 +60,13 @@
 #define PCI_DEVICE_ID_INTEL_CML_XHCI			0xa3af
 #define PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI		0x9a13
 #define PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI		0x1138
+#define PCI_DEVICE_ID_INTEL_TIGER_LAKE_PCH_XHCI		0xa0ed
 #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI		0x51ed
 #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_PCH_XHCI	0x54ed
 
+#define PCI_VENDOR_ID_PHYTIUM		0x1db7
+#define PCI_DEVICE_ID_PHYTIUM_XHCI			0xdc27
+
 #define PCI_DEVICE_ID_AMD_RENOIR_XHCI			0x1639
 #define PCI_DEVICE_ID_AMD_PROMONTORYA_4			0x43b9
 #define PCI_DEVICE_ID_AMD_PROMONTORYA_3			0x43ba
@@ -72,8 +77,12 @@
 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI		0x1142
 #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI			0x1242
 #define PCI_DEVICE_ID_ASMEDIA_2142_XHCI			0x2142
+#define PCI_DEVICE_ID_ASMEDIA_3042_XHCI			0x3042
 #define PCI_DEVICE_ID_ASMEDIA_3242_XHCI			0x3242
 
+#define PCI_DEVICE_ID_CADENCE				0x17CD
+#define PCI_DEVICE_ID_CADENCE_SSP			0x0200
+
 static const char hcd_name[] = "xhci_hcd";
 
 static struct hc_driver __read_mostly xhci_pci_hc_driver;
@@ -270,17 +279,12 @@
 				"QUIRK: Fresco Logic revision %u "
 				"has broken MSI implementation",
 				pdev->revision);
-		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 	}
 
 	if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
 			pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009)
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
 
-	if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
-			pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100)
-		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
-
 	if (pdev->vendor == PCI_VENDOR_ID_NEC)
 		xhci->quirks |= XHCI_NEC_HOST;
 
@@ -307,8 +311,8 @@
 		xhci->quirks |= XHCI_RESET_ON_RESUME;
 	}
 
-	if (pdev->vendor == PCI_VENDOR_ID_AMD)
-		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+	if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x43f7)
+		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
 
 	if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
 		((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
@@ -375,7 +379,8 @@
 		xhci->quirks |= XHCI_MISSING_CAS;
 
 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
-	    (pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI ||
+	    (pdev->device == PCI_DEVICE_ID_INTEL_TIGER_LAKE_PCH_XHCI ||
+	     pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI ||
 	     pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_PCH_XHCI))
 		xhci->quirks |= XHCI_RESET_TO_DEFAULT;
 
@@ -394,14 +399,16 @@
 		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
 
 	if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
-			pdev->device == PCI_DEVICE_ID_EJ168) {
+	    (pdev->device == PCI_DEVICE_ID_EJ168 ||
+	     pdev->device == PCI_DEVICE_ID_EJ188)) {
+		xhci->quirks |= XHCI_ETRON_HOST;
 		xhci->quirks |= XHCI_RESET_ON_RESUME;
-		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
+		xhci->quirks |= XHCI_NO_SOFT_RETRY;
 	}
+
 	if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
 	    pdev->device == 0x0014) {
-		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 		xhci->quirks |= XHCI_ZERO_64B_REGS;
 	}
 	if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
@@ -412,6 +419,10 @@
 	if (pdev->vendor == PCI_VENDOR_ID_VIA)
 		xhci->quirks |= XHCI_RESET_ON_RESUME;
 
+	if (pdev->vendor == PCI_VENDOR_ID_PHYTIUM &&
+	    pdev->device == PCI_DEVICE_ID_PHYTIUM_XHCI)
+		xhci->quirks |= XHCI_RESET_ON_RESUME;
+
 	/* See https://bugzilla.kernel.org/show_bug.cgi?id=79511 */
 	if (pdev->vendor == PCI_VENDOR_ID_VIA &&
 			pdev->device == 0x3432)
@@ -431,7 +442,6 @@
 	}
 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) {
-		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 		xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
 	}
 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
@@ -444,6 +454,10 @@
 		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
 		xhci->quirks |= XHCI_ASMEDIA_MODIFY_FLOWCONTROL;
 
+	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+	    pdev->device == PCI_DEVICE_ID_ASMEDIA_3042_XHCI)
+		xhci->quirks |= XHCI_RESET_ON_RESUME;
+
 	if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
 		xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
 
@@ -470,6 +484,10 @@
 			xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
 	}
 
+	if (pdev->vendor == PCI_DEVICE_ID_CADENCE &&
+	    pdev->device == PCI_DEVICE_ID_CADENCE_SSP)
+		xhci->quirks |= XHCI_CDNS_SCTX_QUIRK;
+
 	/* xHC spec requires PCI devices to support D3hot and D3cold */
 	if (xhci->hci_version >= 0x120)
 		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
@@ -632,7 +650,7 @@
 	pm_runtime_put_noidle(&dev->dev);
 
 	if (pci_choose_state(dev, PMSG_SUSPEND) == PCI_D0)
-		pm_runtime_forbid(&dev->dev);
+		pm_runtime_get(&dev->dev);
 	else if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW)
 		pm_runtime_allow(&dev->dev);
 
@@ -652,12 +670,16 @@
 static void xhci_pci_remove(struct pci_dev *dev)
 {
 	struct xhci_hcd *xhci;
+	bool set_power_d3;
 
 	xhci = hcd_to_xhci(pci_get_drvdata(dev));
+	set_power_d3 = xhci->quirks & XHCI_SPURIOUS_WAKEUP;
 
 	xhci->xhc_state |= XHCI_STATE_REMOVING;
 
-	if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW)
+	if (pci_choose_state(dev, PMSG_SUSPEND) == PCI_D0)
+		pm_runtime_put(&dev->dev);
+	else if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW)
 		pm_runtime_forbid(&dev->dev);
 
 	if (xhci->shared_hcd) {
@@ -666,11 +688,11 @@
 		xhci->shared_hcd = NULL;
 	}
 
+	usb_hcd_pci_remove(dev);
+
 	/* Workaround for spurious wakeups at shutdown with HSW */
-	if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+	if (set_power_d3)
 		pci_set_power_state(dev, PCI_D3hot);
-
-	usb_hcd_pci_remove(dev);
 }
 
 /*
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-plat.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-plat.c
@@ -256,6 +256,12 @@
 		if (device_property_read_bool(tmpdev, "xhci-sg-trb-cache-size-quirk"))
 			xhci->quirks |= XHCI_SG_TRB_CACHE_SIZE_QUIRK;
 
+		if (device_property_read_bool(tmpdev, "xhci-missing-cas-quirk"))
+			xhci->quirks |= XHCI_MISSING_CAS;
+
+		if (device_property_read_bool(tmpdev, "xhci-skip-phy-init-quirk"))
+			xhci->quirks |= XHCI_SKIP_PHY_INIT;
+
 		device_property_read_u32(tmpdev, "imod-interval-ns",
 					 &xhci->imod_interval);
 	}
@@ -281,7 +287,8 @@
 
 	hcd->tpl_support = of_usb_host_tpl_support(sysdev->of_node);
 
-	if (priv && (priv->quirks & XHCI_SKIP_PHY_INIT))
+	if ((priv && (priv->quirks & XHCI_SKIP_PHY_INIT)) ||
+	    (xhci->quirks & XHCI_SKIP_PHY_INIT))
 		hcd->skip_phy_initialization = 1;
 
 	if (priv && (priv->quirks & XHCI_SG_TRB_CACHE_SIZE_QUIRK))
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-plat.h
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-plat.h
@@ -8,7 +8,9 @@
 #ifndef _XHCI_PLAT_H
 #define _XHCI_PLAT_H
 
-#include "xhci.h"	/* for hcd_to_xhci() */
+struct device;
+struct platform_device;
+struct usb_hcd;
 
 struct xhci_plat_priv {
 	const char *firmware_name;
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-port.h
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-port.h
@@ -0,0 +1,176 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/* PORTSC - Port Status and Control Register - port_status_base bitmasks */
+/* true: device connected */
+#define PORT_CONNECT	(1 << 0)
+/* true: port enabled */
+#define PORT_PE		(1 << 1)
+/* bit 2 reserved and zeroed */
+/* true: port has an over-current condition */
+#define PORT_OC		(1 << 3)
+/* true: port reset signaling asserted */
+#define PORT_RESET	(1 << 4)
+/* Port Link State - bits 5:8
+ * A read gives the current link PM state of the port,
+ * a write with Link State Write Strobe set sets the link state.
+ */
+#define PORT_PLS_MASK	(0xf << 5)
+#define XDEV_U0		(0x0 << 5)
+#define XDEV_U1		(0x1 << 5)
+#define XDEV_U2		(0x2 << 5)
+#define XDEV_U3		(0x3 << 5)
+#define XDEV_DISABLED	(0x4 << 5)
+#define XDEV_RXDETECT	(0x5 << 5)
+#define XDEV_INACTIVE	(0x6 << 5)
+#define XDEV_POLLING	(0x7 << 5)
+#define XDEV_RECOVERY	(0x8 << 5)
+#define XDEV_HOT_RESET	(0x9 << 5)
+#define XDEV_COMP_MODE	(0xa << 5)
+#define XDEV_TEST_MODE	(0xb << 5)
+#define XDEV_RESUME	(0xf << 5)
+
+/* true: port has power (see HCC_PPC) */
+#define PORT_POWER	(1 << 9)
+/* bits 10:13 indicate device speed:
+ * 0 - undefined speed - port hasn't be initialized by a reset yet
+ * 1 - full speed
+ * 2 - low speed
+ * 3 - high speed
+ * 4 - super speed
+ * 5-15 reserved
+ */
+#define DEV_SPEED_MASK		(0xf << 10)
+#define	XDEV_FS			(0x1 << 10)
+#define	XDEV_LS			(0x2 << 10)
+#define	XDEV_HS			(0x3 << 10)
+#define	XDEV_SS			(0x4 << 10)
+#define	XDEV_SSP		(0x5 << 10)
+#define DEV_UNDEFSPEED(p)	(((p) & DEV_SPEED_MASK) == (0x0<<10))
+#define DEV_FULLSPEED(p)	(((p) & DEV_SPEED_MASK) == XDEV_FS)
+#define DEV_LOWSPEED(p)		(((p) & DEV_SPEED_MASK) == XDEV_LS)
+#define DEV_HIGHSPEED(p)	(((p) & DEV_SPEED_MASK) == XDEV_HS)
+#define DEV_SUPERSPEED(p)	(((p) & DEV_SPEED_MASK) == XDEV_SS)
+#define DEV_SUPERSPEEDPLUS(p)	(((p) & DEV_SPEED_MASK) == XDEV_SSP)
+#define DEV_SUPERSPEED_ANY(p)	(((p) & DEV_SPEED_MASK) >= XDEV_SS)
+#define DEV_PORT_SPEED(p)	(((p) >> 10) & 0x0f)
+
+/* Bits 20:23 in the Slot Context are the speed for the device */
+#define	SLOT_SPEED_FS		(XDEV_FS << 10)
+#define	SLOT_SPEED_LS		(XDEV_LS << 10)
+#define	SLOT_SPEED_HS		(XDEV_HS << 10)
+#define	SLOT_SPEED_SS		(XDEV_SS << 10)
+#define	SLOT_SPEED_SSP		(XDEV_SSP << 10)
+/* Port Indicator Control */
+#define PORT_LED_OFF	(0 << 14)
+#define PORT_LED_AMBER	(1 << 14)
+#define PORT_LED_GREEN	(2 << 14)
+#define PORT_LED_MASK	(3 << 14)
+/* Port Link State Write Strobe - set this when changing link state */
+#define PORT_LINK_STROBE	(1 << 16)
+/* true: connect status change */
+#define PORT_CSC	(1 << 17)
+/* true: port enable change */
+#define PORT_PEC	(1 << 18)
+/* true: warm reset for a USB 3.0 device is done.  A "hot" reset puts the port
+ * into an enabled state, and the device into the default state.  A "warm" reset
+ * also resets the link, forcing the device through the link training sequence.
+ * SW can also look at the Port Reset register to see when warm reset is done.
+ */
+#define PORT_WRC	(1 << 19)
+/* true: over-current change */
+#define PORT_OCC	(1 << 20)
+/* true: reset change - 1 to 0 transition of PORT_RESET */
+#define PORT_RC		(1 << 21)
+/* port link status change - set on some port link state transitions:
+ *  Transition				Reason
+ *  ------------------------------------------------------------------------------
+ *  - U3 to Resume			Wakeup signaling from a device
+ *  - Resume to Recovery to U0		USB 3.0 device resume
+ *  - Resume to U0			USB 2.0 device resume
+ *  - U3 to Recovery to U0		Software resume of USB 3.0 device complete
+ *  - U3 to U0				Software resume of USB 2.0 device complete
+ *  - U2 to U0				L1 resume of USB 2.1 device complete
+ *  - U0 to U0 (???)			L1 entry rejection by USB 2.1 device
+ *  - U0 to disabled			L1 entry error with USB 2.1 device
+ *  - Any state to inactive		Error on USB 3.0 port
+ */
+#define PORT_PLC	(1 << 22)
+/* port configure error change - port failed to configure its link partner */
+#define PORT_CEC	(1 << 23)
+#define PORT_CHANGE_MASK	(PORT_CSC | PORT_PEC | PORT_WRC | PORT_OCC | \
+				 PORT_RC | PORT_PLC | PORT_CEC)
+
+
+/* Cold Attach Status - xHC can set this bit to report device attached during
+ * Sx state. Warm port reset should be perfomed to clear this bit and move port
+ * to connected state.
+ */
+#define PORT_CAS	(1 << 24)
+/* wake on connect (enable) */
+#define PORT_WKCONN_E	(1 << 25)
+/* wake on disconnect (enable) */
+#define PORT_WKDISC_E	(1 << 26)
+/* wake on over-current (enable) */
+#define PORT_WKOC_E	(1 << 27)
+/* bits 28:29 reserved */
+/* true: device is non-removable - for USB 3.0 roothub emulation */
+#define PORT_DEV_REMOVE	(1 << 30)
+/* Initiate a warm port reset - complete when PORT_WRC is '1' */
+#define PORT_WR		(1 << 31)
+
+/* We mark duplicate entries with -1 */
+#define DUPLICATE_ENTRY ((u8)(-1))
+
+/* Port Power Management Status and Control - port_power_base bitmasks */
+/* Inactivity timer value for transitions into U1, in microseconds.
+ * Timeout can be up to 127us.  0xFF means an infinite timeout.
+ */
+#define PORT_U1_TIMEOUT(p)	((p) & 0xff)
+#define PORT_U1_TIMEOUT_MASK	0xff
+/* Inactivity timer value for transitions into U2 */
+#define PORT_U2_TIMEOUT(p)	(((p) & 0xff) << 8)
+#define PORT_U2_TIMEOUT_MASK	(0xff << 8)
+/* Bits 24:31 for port testing */
+
+/* USB2 Protocol PORTSPMSC */
+#define	PORT_L1S_MASK		7
+#define	PORT_L1S_SUCCESS	1
+#define	PORT_RWE		(1 << 3)
+#define	PORT_HIRD(p)		(((p) & 0xf) << 4)
+#define	PORT_HIRD_MASK		(0xf << 4)
+#define	PORT_L1DS_MASK		(0xff << 8)
+#define	PORT_L1DS(p)		(((p) & 0xff) << 8)
+#define	PORT_HLE		(1 << 16)
+#define PORT_TEST_MODE_SHIFT	28
+
+/* USB3 Protocol PORTLI  Port Link Information */
+#define PORT_RX_LANES(p)	(((p) >> 16) & 0xf)
+#define PORT_TX_LANES(p)	(((p) >> 20) & 0xf)
+
+/* USB2 Protocol PORTHLPMC */
+#define PORT_HIRDM(p)((p) & 3)
+#define PORT_L1_TIMEOUT(p)(((p) & 0xff) << 2)
+#define PORT_BESLD(p)(((p) & 0xf) << 10)
+
+/* use 512 microseconds as USB2 LPM L1 default timeout. */
+#define XHCI_L1_TIMEOUT		512
+
+/* Set default HIRD/BESL value to 4 (350/400us) for USB2 L1 LPM resume latency.
+ * Safe to use with mixed HIRD and BESL systems (host and device) and is used
+ * by other operating systems.
+ *
+ * XHCI 1.0 errata 8/14/12 Table 13 notes:
+ * "Software should choose xHC BESL/BESLD field values that do not violate a
+ * device's resume latency requirements,
+ * e.g. not program values > '4' if BLC = '1' and a HIRD device is attached,
+ * or not program values < '4' if BLC = '0' and a BESL device is attached.
+ */
+#define XHCI_DEFAULT_BESL	4
+
+/*
+ * USB3 specification define a 360ms tPollingLFPSTiemout for USB3 ports
+ * to complete link training. usually link trainig completes much faster
+ * so check status 10 times with 36ms sleep in places we need to wait for
+ * polling to complete.
+ */
+#define XHCI_PORT_POLLING_LFPS_TIME  36
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-rcar.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-rcar.c
@@ -214,8 +214,7 @@
  */
 #define SET_XHCI_PLAT_PRIV_FOR_RCAR(firmware)				\
 	.firmware_name = firmware,					\
-	.quirks = XHCI_NO_64BIT_SUPPORT | XHCI_TRUST_TX_LENGTH |	\
-		  XHCI_SLOW_SUSPEND,					\
+	.quirks = XHCI_NO_64BIT_SUPPORT |  XHCI_SLOW_SUSPEND,		\
 	.init_quirk = xhci_rcar_init_quirk,				\
 	.plat_start = xhci_rcar_start,					\
 	.resume_quirk = xhci_rcar_resume_quirk,
@@ -229,8 +228,7 @@
 };
 
 static const struct xhci_plat_priv xhci_plat_renesas_rzv2m = {
-	.quirks = XHCI_NO_64BIT_SUPPORT | XHCI_TRUST_TX_LENGTH |
-		  XHCI_SLOW_SUSPEND,
+	.quirks = XHCI_NO_64BIT_SUPPORT | XHCI_SLOW_SUSPEND,
 	.init_quirk = xhci_rzv2m_init_quirk,
 	.plat_start = xhci_rzv2m_start,
 };
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-ring.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-ring.c
@@ -52,6 +52,7 @@
  *   endpoint rings; it generates events on the event ring for these.
  */
 
+#include <linux/jiffies.h>
 #include <linux/scatterlist.h>
 #include <linux/slab.h>
 #include <linux/dma-mapping.h>
@@ -995,6 +996,13 @@
 	unsigned int		slot_id = ep->vdev->slot_id;
 	int			err;
 
+	/*
+	 * This is not going to work if the hardware is changing its dequeue
+	 * pointers as we look at them. Completion handler will call us later.
+	 */
+	if (ep->ep_state & SET_DEQ_PENDING)
+		return 0;
+
 	xhci = ep->xhci;
 
 	list_for_each_entry_safe(td, tmp_td, &ep->cancelled_td_list, cancelled_td_list) {
@@ -1028,13 +1036,27 @@
 				break;
 			case TD_DIRTY: /* TD is cached, clear it */
 			case TD_HALTED:
+			case TD_CLEARING_CACHE_DEFERRED:
+				if (cached_td) {
+					if (cached_td->urb->stream_id != td->urb->stream_id) {
+						/* Multiple streams case, defer move dq */
+						xhci_dbg(xhci,
+							 "Move dq deferred: stream %u URB %p\n",
+							 td->urb->stream_id, td->urb);
+						td->cancel_status = TD_CLEARING_CACHE_DEFERRED;
+						break;
+					}
+
+					/* Should never happen, but clear the TD if it does */
+					xhci_warn(xhci,
+						  "Found multiple active URBs %p and %p in stream %u?\n",
+						  td->urb, cached_td->urb,
+						  td->urb->stream_id);
+					td_to_noop(xhci, ring, cached_td, false);
+					cached_td->cancel_status = TD_CLEARED;
+				}
+				td_to_noop(xhci, ring, td, false);
 				td->cancel_status = TD_CLEARING_CACHE;
-				if (cached_td)
-					/* FIXME  stream case, several stopped rings */
-					xhci_dbg(xhci,
-						 "Move dq past stream %u URB %p instead of stream %u URB %p\n",
-						 td->urb->stream_id, td->urb,
-						 cached_td->urb->stream_id, cached_td->urb);
 				cached_td = td;
 				break;
 			}
@@ -1054,10 +1076,16 @@
 	if (err) {
 		/* Failed to move past cached td, just set cached TDs to no-op */
 		list_for_each_entry_safe(td, tmp_td, &ep->cancelled_td_list, cancelled_td_list) {
-			if (td->cancel_status != TD_CLEARING_CACHE)
+			/*
+			 * Deferred TDs need to have the deq pointer set after the above command
+			 * completes, so if that failed we just give up on all of them (and
+			 * complain loudly since this could cause issues due to caching).
+			 */
+			if (td->cancel_status != TD_CLEARING_CACHE &&
+			    td->cancel_status != TD_CLEARING_CACHE_DEFERRED)
 				continue;
-			xhci_dbg(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n",
-				 td->urb);
+			xhci_warn(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n",
+				  td->urb);
 			td_to_noop(xhci, ring, td, false);
 			td->cancel_status = TD_CLEARED;
 		}
@@ -1066,6 +1094,19 @@
 }
 
 /*
+ * Erase queued TDs from transfer ring(s) and give back those the xHC didn't
+ * stop on. If necessary, queue commands to move the xHC off cancelled TDs it
+ * stopped on. Those will be given back later when the commands complete.
+ *
+ * Call under xhci->lock on a stopped endpoint.
+ */
+void xhci_process_cancelled_tds(struct xhci_virt_ep *ep)
+{
+	xhci_invalidate_cancelled_tds(ep);
+	xhci_giveback_invalidated_tds(ep);
+}
+
+/*
  * Returns the TD the endpoint ring halted on.
  * Only call for non-running rings without streams.
  */
@@ -1154,9 +1195,35 @@
 				break;
 			ep->ep_state &= ~EP_STOP_CMD_PENDING;
 			return;
+		case EP_STATE_STOPPED:
+			/*
+			 * Per xHCI 4.6.9, Stop Endpoint command on a Stopped
+			 * EP is a Context State Error, and EP stays Stopped.
+			 *
+			 * But maybe it failed on Halted, and somebody ran Reset
+			 * Endpoint later. EP state is now Stopped and EP_HALTED
+			 * still set because Reset EP handler will run after us.
+			 */
+			if (ep->ep_state & EP_HALTED)
+				break;
+			/*
+			 * On some HCs EP state remains Stopped for some tens of
+			 * us to a few ms or more after a doorbell ring, and any
+			 * new Stop Endpoint fails without aborting the restart.
+			 * This handler may run quickly enough to still see this
+			 * Stopped state, but it will soon change to Running.
+			 *
+			 * Assume this bug on unexpected Stop Endpoint failures.
+			 * Keep retrying until the EP starts and stops again, on
+			 * chips where this is known to help. Wait for 100ms.
+			 */
+			if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+				break;
+			fallthrough;
 		case EP_STATE_RUNNING:
 			/* Race, HW handled stop ep cmd before ep was running */
-			xhci_dbg(xhci, "Stop ep completion ctx error, ep is running\n");
+			xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
+					GET_EP_CTX_STATE(ep_ctx));
 
 			command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
 			if (!command) {
@@ -1394,6 +1461,20 @@
 			struct xhci_stream_ctx *ctx =
 				&ep->stream_info->stream_ctx_array[stream_id];
 			deq = le64_to_cpu(ctx->stream_ring) & SCTX_DEQ_MASK;
+
+			/*
+			 * Cadence xHCI controllers store some endpoint state
+			 * information within Rsvd0 fields of Stream Endpoint
+			 * context. This field is not cleared during Set TR
+			 * Dequeue Pointer command which causes XDMA to skip
+			 * over transfer ring and leads to data loss on stream
+			 * pipe.
+			 * To fix this issue driver must clear Rsvd0 field.
+			 */
+			if (xhci->quirks & XHCI_CDNS_SCTX_QUIRK) {
+				ctx->reserved[0] = 0;
+				ctx->reserved[1] = 0;
+			}
 		} else {
 			deq = le64_to_cpu(ep_ctx->deq) & ~EP_CTX_CYCLE_MASK;
 		}
@@ -1430,8 +1511,21 @@
 	ep->ep_state &= ~SET_DEQ_PENDING;
 	ep->queued_deq_seg = NULL;
 	ep->queued_deq_ptr = NULL;
-	/* Restart any rings with pending URBs */
-	ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+
+	/* Check for deferred or newly cancelled TDs */
+	if (!list_empty(&ep->cancelled_td_list)) {
+		xhci_dbg(ep->xhci, "%s: Pending TDs to clear, continuing with invalidation\n",
+			 __func__);
+		xhci_invalidate_cancelled_tds(ep);
+		/* Try to restart the endpoint if all is done */
+		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+		/* Start giving back any TDs invalidated above */
+		xhci_giveback_invalidated_tds(ep);
+	} else {
+		/* Restart any rings with pending URBs */
+		xhci_dbg(ep->xhci, "%s: All TDs cleared, ring doorbell\n", __func__);
+		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+	}
 }
 
 static void xhci_handle_cmd_reset_ep(struct xhci_hcd *xhci, int slot_id,
@@ -1689,6 +1783,14 @@
 
 	trace_xhci_handle_command(xhci->cmd_ring, &cmd_trb->generic);
 
+	cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
+
+	/* If CMD ring stopped we own the trbs between enqueue and dequeue */
+	if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) {
+		complete_all(&xhci->cmd_ring_stop_completion);
+		return;
+	}
+
 	cmd_dequeue_dma = xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
 			cmd_trb);
 	/*
@@ -1705,14 +1807,6 @@
 
 	cancel_delayed_work(&xhci->cmd_timer);
 
-	cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
-
-	/* If CMD ring stopped we own the trbs between enqueue and dequeue */
-	if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) {
-		complete_all(&xhci->cmd_ring_stop_completion);
-		return;
-	}
-
 	if (cmd->command_trb != xhci->cmd_ring->dequeue) {
 		xhci_err(xhci,
 			 "Command completion event does not match command\n");
@@ -2387,8 +2481,7 @@
 			break;
 		if (remaining) {
 			frame->status = short_framestatus;
-			if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
-				sum_trbs_for_length = true;
+			sum_trbs_for_length = true;
 			break;
 		}
 		frame->status = 0;
@@ -2523,9 +2616,8 @@
 		goto finish_td;
 	case COMP_STOPPED_LENGTH_INVALID:
 		/* stopped on ep trb with invalid length, exclude it */
-		ep_trb_len	= 0;
-		remaining	= 0;
-		break;
+		td->urb->actual_length = sum_trb_lengths(xhci, ep_ring, ep_trb);
+		goto finish_td;
 	case COMP_USB_TRANSACTION_ERROR:
 		if (xhci->quirks & XHCI_NO_SOFT_RETRY ||
 		    (ep->err_count++ > MAX_SOFT_RETRY) ||
@@ -2638,15 +2730,11 @@
 	 * transfer type
 	 */
 	case COMP_SUCCESS:
-		if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
-			break;
-		if (xhci->quirks & XHCI_TRUST_TX_LENGTH ||
-		    ep_ring->last_td_was_short)
+		if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
 			trb_comp_code = COMP_SHORT_PACKET;
-		else
-			xhci_warn_ratelimited(xhci,
-					      "WARN Successful completion on short TX for slot %u ep %u: needs XHCI_TRUST_TX_LENGTH quirk?\n",
-					      slot_id, ep_index);
+			xhci_dbg(xhci, "Successful completion on short TX for slot %u ep %u with last td short %d\n",
+				 slot_id, ep_index, ep_ring->last_td_was_short);
+		}
 		break;
 	case COMP_SHORT_PACKET:
 		break;
@@ -3022,9 +3110,6 @@
 		return 0;
 	}
 
-	/* Update SW event ring dequeue pointer */
-	inc_deq(xhci, ir->event_ring);
-
 	/* Are there more items on the event ring?  Caller will call us again to
 	 * check.
 	 */
@@ -3038,30 +3123,26 @@
  */
 static void xhci_update_erst_dequeue(struct xhci_hcd *xhci,
 				     struct xhci_interrupter *ir,
-				     union xhci_trb *event_ring_deq,
 				     bool clear_ehb)
 {
 	u64 temp_64;
 	dma_addr_t deq;
 
 	temp_64 = xhci_read_64(xhci, &ir->ir_set->erst_dequeue);
-	/* If necessary, update the HW's version of the event ring deq ptr. */
-	if (event_ring_deq != ir->event_ring->dequeue) {
-		deq = xhci_trb_virt_to_dma(ir->event_ring->deq_seg,
-				ir->event_ring->dequeue);
-		if (deq == 0)
-			xhci_warn(xhci, "WARN something wrong with SW event ring dequeue ptr\n");
-		/*
-		 * Per 4.9.4, Software writes to the ERDP register shall
-		 * always advance the Event Ring Dequeue Pointer value.
-		 */
-		if ((temp_64 & ERST_PTR_MASK) == (deq & ERST_PTR_MASK))
-			return;
+	deq = xhci_trb_virt_to_dma(ir->event_ring->deq_seg,
+				   ir->event_ring->dequeue);
+	if (deq == 0)
+		xhci_warn(xhci, "WARN something wrong with SW event ring dequeue ptr\n");
+	/*
+	 * Per 4.9.4, Software writes to the ERDP register shall always advance
+	 * the Event Ring Dequeue Pointer value.
+	 */
+	if ((temp_64 & ERST_PTR_MASK) == (deq & ERST_PTR_MASK) && !clear_ehb)
+		return;
 
-		/* Update HC event ring dequeue pointer */
-		temp_64 = ir->event_ring->deq_seg->num & ERST_DESI_MASK;
-		temp_64 |= deq & ERST_PTR_MASK;
-	}
+	/* Update HC event ring dequeue pointer */
+	temp_64 = ir->event_ring->deq_seg->num & ERST_DESI_MASK;
+	temp_64 |= deq & ERST_PTR_MASK;
 
 	/* Clear the event handler busy flag (RW1C) */
 	if (clear_ehb)
@@ -3069,6 +3150,59 @@
 	xhci_write_64(xhci, temp_64, &ir->ir_set->erst_dequeue);
 }
 
+/* Clear the interrupt pending bit for a specific interrupter. */
+static void xhci_clear_interrupt_pending(struct xhci_hcd *xhci,
+					 struct xhci_interrupter *ir)
+{
+	if (!ir->ip_autoclear) {
+		u32 irq_pending;
+
+		irq_pending = readl(&ir->ir_set->irq_pending);
+		irq_pending |= IMAN_IP;
+		writel(irq_pending, &ir->ir_set->irq_pending);
+	}
+}
+
+static int xhci_handle_events(struct xhci_hcd *xhci, struct xhci_interrupter *ir)
+{
+	int event_loop = 0;
+	u64 temp;
+
+	xhci_clear_interrupt_pending(xhci, ir);
+
+	if (xhci->xhc_state & XHCI_STATE_DYING ||
+	    xhci->xhc_state & XHCI_STATE_HALTED) {
+		xhci_dbg(xhci, "xHCI dying, ignoring interrupt. Shouldn't IRQs be disabled?\n");
+
+		/* Clear the event handler busy flag (RW1C) */
+		temp = xhci_read_64(xhci, &ir->ir_set->erst_dequeue);
+		xhci_write_64(xhci, temp | ERST_EHB, &ir->ir_set->erst_dequeue);
+		return -ENODEV;
+	}
+
+	while (xhci_handle_event(xhci, ir) > 0) {
+		/*
+		 * If half a segment of events have been handled in one go then
+		 * update ERDP, and force isoc trbs to interrupt more often
+		 */
+		if (event_loop++ > TRBS_PER_SEGMENT / 2) {
+			xhci_update_erst_dequeue(xhci, ir, false);
+
+			if (ir->isoc_bei_interval > AVOID_BEI_INTERVAL_MIN)
+				ir->isoc_bei_interval = ir->isoc_bei_interval / 2;
+
+			event_loop = 0;
+		}
+
+		/* Update SW event ring dequeue pointer */
+		inc_deq(xhci, ir->event_ring);
+	}
+
+	xhci_update_erst_dequeue(xhci, ir, true);
+
+	return 0;
+}
+
 /*
  * xHCI spec says we can get an interrupt, and if the HC has an error condition,
  * we might get bad data out of the event ring.  Section 4.10.2.7 has a list of
@@ -3077,24 +3211,21 @@
 irqreturn_t xhci_irq(struct usb_hcd *hcd)
 {
 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-	union xhci_trb *event_ring_deq;
-	struct xhci_interrupter *ir;
-	irqreturn_t ret = IRQ_NONE;
-	u64 temp_64;
+	irqreturn_t ret = IRQ_HANDLED;
 	u32 status;
-	int event_loop = 0;
 
 	spin_lock(&xhci->lock);
 	/* Check if the xHC generated the interrupt, or the irq is shared */
 	status = readl(&xhci->op_regs->status);
 	if (status == ~(u32)0) {
 		xhci_hc_died(xhci);
-		ret = IRQ_HANDLED;
 		goto out;
 	}
 
-	if (!(status & STS_EINT))
+	if (!(status & STS_EINT)) {
+		ret = IRQ_NONE;
 		goto out;
+	}
 
 	if (status & STS_HCE) {
 		xhci_warn(xhci, "WARNING: Host Controller Error\n");
@@ -3104,7 +3235,6 @@
 	if (status & STS_FATAL) {
 		xhci_warn(xhci, "WARNING: Host System Error\n");
 		xhci_halt(xhci);
-		ret = IRQ_HANDLED;
 		goto out;
 	}
 
@@ -3117,48 +3247,7 @@
 	writel(status, &xhci->op_regs->status);
 
 	/* This is the handler of the primary interrupter */
-	ir = xhci->interrupters[0];
-	if (!hcd->msi_enabled) {
-		u32 irq_pending;
-		irq_pending = readl(&ir->ir_set->irq_pending);
-		irq_pending |= IMAN_IP;
-		writel(irq_pending, &ir->ir_set->irq_pending);
-	}
-
-	if (xhci->xhc_state & XHCI_STATE_DYING ||
-	    xhci->xhc_state & XHCI_STATE_HALTED) {
-		xhci_dbg(xhci, "xHCI dying, ignoring interrupt. "
-				"Shouldn't IRQs be disabled?\n");
-		/* Clear the event handler busy flag (RW1C);
-		 * the event ring should be empty.
-		 */
-		temp_64 = xhci_read_64(xhci, &ir->ir_set->erst_dequeue);
-		xhci_write_64(xhci, temp_64 | ERST_EHB,
-				&ir->ir_set->erst_dequeue);
-		ret = IRQ_HANDLED;
-		goto out;
-	}
-
-	event_ring_deq = ir->event_ring->dequeue;
-	/* FIXME this should be a delayed service routine
-	 * that clears the EHB.
-	 */
-	while (xhci_handle_event(xhci, ir) > 0) {
-		if (event_loop++ < TRBS_PER_SEGMENT / 2)
-			continue;
-		xhci_update_erst_dequeue(xhci, ir, event_ring_deq, false);
-		event_ring_deq = ir->event_ring->dequeue;
-
-		/* ring is half-full, force isoc trbs to interrupt more often */
-		if (xhci->isoc_bei_interval > AVOID_BEI_INTERVAL_MIN)
-			xhci->isoc_bei_interval = xhci->isoc_bei_interval / 2;
-
-		event_loop = 0;
-	}
-
-	xhci_update_erst_dequeue(xhci, ir, event_ring_deq, true);
-	ret = IRQ_HANDLED;
-
+	xhci_handle_events(xhci, xhci->interrupters[0]);
 out:
 	spin_unlock(&xhci->lock);
 
@@ -3764,6 +3853,20 @@
 	if (!urb->setup_packet)
 		return -EINVAL;
 
+	if ((xhci->quirks & XHCI_ETRON_HOST) &&
+	    urb->dev->speed >= USB_SPEED_SUPER) {
+		/*
+		 * If next available TRB is the Link TRB in the ring segment then
+		 * enqueue a No Op TRB, this can prevent the Setup and Data Stage
+		 * TRB to be breaked by the Link TRB.
+		 */
+		if (trb_is_link(ep_ring->enqueue + 1)) {
+			field = TRB_TYPE(TRB_TR_NOOP) | ep_ring->cycle_state;
+			queue_trb(xhci, ep_ring, false, 0, 0,
+					TRB_INTR_TARGET(0), field);
+		}
+	}
+
 	/* 1 TRB for setup, 1 for status */
 	num_trbs = 2;
 	/*
@@ -4019,7 +4122,8 @@
 }
 
 /* Check if we should generate event interrupt for a TD in an isoc URB */
-static bool trb_block_event_intr(struct xhci_hcd *xhci, int num_tds, int i)
+static bool trb_block_event_intr(struct xhci_hcd *xhci, int num_tds, int i,
+				 struct xhci_interrupter *ir)
 {
 	if (xhci->hci_version < 0x100)
 		return false;
@@ -4030,8 +4134,8 @@
 	 * If AVOID_BEI is set the host handles full event rings poorly,
 	 * generate an event at least every 8th TD to clear the event ring
 	 */
-	if (i && xhci->quirks & XHCI_AVOID_BEI)
-		return !!(i % xhci->isoc_bei_interval);
+	if (i && ir->isoc_bei_interval && xhci->quirks & XHCI_AVOID_BEI)
+		return !!(i % ir->isoc_bei_interval);
 
 	return true;
 }
@@ -4040,6 +4144,7 @@
 static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 		struct urb *urb, int slot_id, unsigned int ep_index)
 {
+	struct xhci_interrupter *ir;
 	struct xhci_ring *ep_ring;
 	struct urb_priv *urb_priv;
 	struct xhci_td *td;
@@ -4057,6 +4162,7 @@
 
 	xep = &xhci->devs[slot_id]->eps[ep_index];
 	ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
+	ir = xhci->interrupters[0];
 
 	num_tds = urb->number_of_packets;
 	if (num_tds < 1) {
@@ -4144,7 +4250,7 @@
 				td->last_trb = ep_ring->enqueue;
 				td->last_trb_seg = ep_ring->enq_seg;
 				field |= TRB_IOC;
-				if (trb_block_event_intr(xhci, num_tds, i))
+				if (trb_block_event_intr(xhci, num_tds, i, ir))
 					field |= TRB_BEI;
 			}
 			/* Calculate TRB length */
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-rzv2m.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-rzv2m.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/usb/rzv2m_usb3drd.h>
+#include "xhci.h"
 #include "xhci-plat.h"
 #include "xhci-rzv2m.h"
 
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci-tegra.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci-tegra.c
@@ -2183,7 +2183,7 @@
 		goto out;
 	}
 
-	for (i = 0; i < tegra->num_usb_phys; i++) {
+	for (i = 0; i < xhci->usb2_rhub.num_ports; i++) {
 		if (!xhci->usb2_rhub.ports[i])
 			continue;
 		portsc = readl(xhci->usb2_rhub.ports[i]->addr);
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci.c
+++ linux-qcom-6.8.0/drivers/usb/host/xhci.c
@@ -8,6 +8,7 @@
  * Some code borrowed from the Linux EHCI driver.
  */
 
+#include <linux/jiffies.h>
 #include <linux/pci.h>
 #include <linux/iommu.h>
 #include <linux/iopoll.h>
@@ -538,6 +539,9 @@
 	 */
 
 	hcd->uses_new_polling = 1;
+	if (hcd->msi_enabled)
+		ir->ip_autoclear = true;
+
 	if (!usb_hcd_is_primary_hcd(hcd))
 		return xhci_run_finished(xhci);
 
@@ -1123,10 +1127,20 @@
 			xhci_dbg(xhci, "Start the secondary HCD\n");
 			retval = xhci_run(xhci->shared_hcd);
 		}
-
+		if (retval)
+			return retval;
+		/*
+		 * Resume roothubs unconditionally as PORTSC change bits are not
+		 * immediately visible after xHC reset
+		 */
 		hcd->state = HC_STATE_SUSPENDED;
-		if (xhci->shared_hcd)
+
+		if (xhci->shared_hcd) {
 			xhci->shared_hcd->state = HC_STATE_SUSPENDED;
+			usb_hcd_resume_root_hub(xhci->shared_hcd);
+		}
+		usb_hcd_resume_root_hub(hcd);
+
 		goto done;
 	}
 
@@ -1150,7 +1164,6 @@
 
 	xhci_dbc_resume(xhci);
 
- done:
 	if (retval == 0) {
 		/*
 		 * Resume roothubs only if there are pending events.
@@ -1176,6 +1189,7 @@
 			usb_hcd_resume_root_hub(hcd);
 		}
 	}
+done:
 	/*
 	 * If system is subject to the Quirk, Compliance Mode Timer needs to
 	 * be re-initialized Always after a system resume. Ports are subject
@@ -1217,6 +1231,8 @@
 
 	temp = kzalloc_node(buf_len, GFP_ATOMIC,
 			    dev_to_node(hcd->self.sysdev));
+	if (!temp)
+		return -ENOMEM;
 
 	if (usb_urb_dir_out(urb))
 		sg_pcopy_to_buffer(urb->sg, urb->num_sgs,
@@ -1754,15 +1770,27 @@
 		}
 	}
 
-	/* Queue a stop endpoint command, but only if this is
-	 * the first cancellation to be handled.
-	 */
-	if (!(ep->ep_state & EP_STOP_CMD_PENDING)) {
+	/* These completion handlers will sort out cancelled TDs for us */
+	if (ep->ep_state & (EP_STOP_CMD_PENDING | EP_HALTED | SET_DEQ_PENDING)) {
+		xhci_dbg(xhci, "Not queuing Stop Endpoint on slot %d ep %d in state 0x%x\n",
+				urb->dev->slot_id, ep_index, ep->ep_state);
+		goto done;
+	}
+
+	/* In this case no commands are pending but the endpoint is stopped */
+	if (ep->ep_state & EP_CLEARING_TT) {
+		/* and cancelled TDs can be given back right away */
+		xhci_dbg(xhci, "Invalidating TDs instantly on slot %d ep %d in state 0x%x\n",
+				urb->dev->slot_id, ep_index, ep->ep_state);
+		xhci_process_cancelled_tds(ep);
+	} else {
+		/* Otherwise, queue a new Stop Endpoint command */
 		command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
 		if (!command) {
 			ret = -ENOMEM;
 			goto done;
 		}
+		ep->stop_time = jiffies;
 		ep->ep_state |= EP_STOP_CMD_PENDING;
 		xhci_queue_stop_endpoint(xhci, command, urb->dev->slot_id,
 					 ep_index, 0);
@@ -2825,7 +2853,7 @@
 				xhci->num_active_eps);
 		return -ENOMEM;
 	}
-	if ((xhci->quirks & XHCI_SW_BW_CHECKING) &&
+	if ((xhci->quirks & XHCI_SW_BW_CHECKING) && !ctx_change &&
 	    xhci_reserve_bandwidth(xhci, virt_dev, command->in_ctx)) {
 		if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK))
 			xhci_free_host_resources(xhci, ctrl_ctx);
@@ -3680,6 +3708,8 @@
 				xhci->num_active_eps);
 }
 
+static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev);
+
 /*
  * This submits a Reset Device Command, which will set the device state to 0,
  * set the device address to 0, and disable all the endpoints except the default
@@ -3750,6 +3780,23 @@
 						SLOT_STATE_DISABLED)
 		return 0;
 
+	if (xhci->quirks & XHCI_ETRON_HOST) {
+		/*
+		 * Obtaining a new device slot to inform the xHCI host that
+		 * the USB device has been reset.
+		 */
+		ret = xhci_disable_slot(xhci, udev->slot_id);
+		xhci_free_virt_device(xhci, udev->slot_id);
+		if (!ret) {
+			ret = xhci_alloc_dev(hcd, udev);
+			if (ret == 1)
+				ret = 0;
+			else
+				ret = -EINVAL;
+		}
+		return ret;
+	}
+
 	trace_xhci_discover_or_reset_device(slot_ctx);
 
 	xhci_dbg(xhci, "Resetting device with slot ID %u\n", slot_id);
@@ -4188,8 +4235,10 @@
 		mutex_unlock(&xhci->mutex);
 		ret = xhci_disable_slot(xhci, udev->slot_id);
 		xhci_free_virt_device(xhci, udev->slot_id);
-		if (!ret)
-			xhci_alloc_dev(hcd, udev);
+		if (!ret) {
+			if (xhci_alloc_dev(hcd, udev) == 1)
+				xhci_setup_addressable_virt_dev(xhci, udev);
+		}
 		kfree(command->completion);
 		kfree(command);
 		return -EPROTO;
--- linux-qcom-6.8.0.orig/drivers/usb/host/xhci.h
+++ linux-qcom-6.8.0/drivers/usb/host/xhci.h
@@ -17,11 +17,15 @@
 #include <linux/kernel.h>
 #include <linux/usb/hcd.h>
 #include <linux/io-64-nonatomic-lo-hi.h>
+#include <linux/io-64-nonatomic-hi-lo.h>
 
 /* Code sharing between pci-quirks and xhci hcd */
 #include	"xhci-ext-caps.h"
 #include "pci-quirks.h"
 
+#include "xhci-port.h"
+#include "xhci-caps.h"
+
 /* max buffer size for trace and debug messages */
 #define XHCI_MSG_MAX		500
 
@@ -62,90 +66,6 @@
 	/* Reserved up to (CAPLENGTH - 0x1C) */
 };
 
-/* hc_capbase bitmasks */
-/* bits 7:0 - how long is the Capabilities register */
-#define HC_LENGTH(p)		XHCI_HC_LENGTH(p)
-/* bits 31:16	*/
-#define HC_VERSION(p)		(((p) >> 16) & 0xffff)
-
-/* HCSPARAMS1 - hcs_params1 - bitmasks */
-/* bits 0:7, Max Device Slots */
-#define HCS_MAX_SLOTS(p)	(((p) >> 0) & 0xff)
-#define HCS_SLOTS_MASK		0xff
-/* bits 8:18, Max Interrupters */
-#define HCS_MAX_INTRS(p)	(((p) >> 8) & 0x7ff)
-/* bits 24:31, Max Ports - max value is 0x7F = 127 ports */
-#define HCS_MAX_PORTS(p)	(((p) >> 24) & 0x7f)
-
-/* HCSPARAMS2 - hcs_params2 - bitmasks */
-/* bits 0:3, frames or uframes that SW needs to queue transactions
- * ahead of the HW to meet periodic deadlines */
-#define HCS_IST(p)		(((p) >> 0) & 0xf)
-/* bits 4:7, max number of Event Ring segments */
-#define HCS_ERST_MAX(p)		(((p) >> 4) & 0xf)
-/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */
-/* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
-/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */
-#define HCS_MAX_SCRATCHPAD(p)   ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f))
-
-/* HCSPARAMS3 - hcs_params3 - bitmasks */
-/* bits 0:7, Max U1 to U0 latency for the roothub ports */
-#define HCS_U1_LATENCY(p)	(((p) >> 0) & 0xff)
-/* bits 16:31, Max U2 to U0 latency for the roothub ports */
-#define HCS_U2_LATENCY(p)	(((p) >> 16) & 0xffff)
-
-/* HCCPARAMS - hcc_params - bitmasks */
-/* true: HC can use 64-bit address pointers */
-#define HCC_64BIT_ADDR(p)	((p) & (1 << 0))
-/* true: HC can do bandwidth negotiation */
-#define HCC_BANDWIDTH_NEG(p)	((p) & (1 << 1))
-/* true: HC uses 64-byte Device Context structures
- * FIXME 64-byte context structures aren't supported yet.
- */
-#define HCC_64BYTE_CONTEXT(p)	((p) & (1 << 2))
-/* true: HC has port power switches */
-#define HCC_PPC(p)		((p) & (1 << 3))
-/* true: HC has port indicators */
-#define HCS_INDICATOR(p)	((p) & (1 << 4))
-/* true: HC has Light HC Reset Capability */
-#define HCC_LIGHT_RESET(p)	((p) & (1 << 5))
-/* true: HC supports latency tolerance messaging */
-#define HCC_LTC(p)		((p) & (1 << 6))
-/* true: no secondary Stream ID Support */
-#define HCC_NSS(p)		((p) & (1 << 7))
-/* true: HC supports Stopped - Short Packet */
-#define HCC_SPC(p)		((p) & (1 << 9))
-/* true: HC has Contiguous Frame ID Capability */
-#define HCC_CFC(p)		((p) & (1 << 11))
-/* Max size for Primary Stream Arrays - 2^(n+1), where n is bits 12:15 */
-#define HCC_MAX_PSA(p)		(1 << ((((p) >> 12) & 0xf) + 1))
-/* Extended Capabilities pointer from PCI base - section 5.3.6 */
-#define HCC_EXT_CAPS(p)		XHCI_HCC_EXT_CAPS(p)
-
-#define CTX_SIZE(_hcc)		(HCC_64BYTE_CONTEXT(_hcc) ? 64 : 32)
-
-/* db_off bitmask - bits 0:1 reserved */
-#define	DBOFF_MASK	(~0x3)
-
-/* run_regs_off bitmask - bits 0:4 reserved */
-#define	RTSOFF_MASK	(~0x1f)
-
-/* HCCPARAMS2 - hcc_params2 - bitmasks */
-/* true: HC supports U3 entry Capability */
-#define	HCC2_U3C(p)		((p) & (1 << 0))
-/* true: HC supports Configure endpoint command Max exit latency too large */
-#define	HCC2_CMC(p)		((p) & (1 << 1))
-/* true: HC supports Force Save context Capability */
-#define	HCC2_FSC(p)		((p) & (1 << 2))
-/* true: HC supports Compliance Transition Capability */
-#define	HCC2_CTC(p)		((p) & (1 << 3))
-/* true: HC support Large ESIT payload Capability > 48k */
-#define	HCC2_LEC(p)		((p) & (1 << 4))
-/* true: HC support Configuration Information Capability */
-#define	HCC2_CIC(p)		((p) & (1 << 5))
-/* true: HC support Extended TBC Capability, Isoc burst count > 65535 */
-#define	HCC2_ETC(p)		((p) & (1 << 6))
-
 /* Number of registers per port */
 #define	NUM_PORT_REGS	4
 
@@ -291,181 +211,6 @@
 #define CONFIG_CIE		(1 << 9)
 /* bits 10:31 - reserved and should be preserved */
 
-/* PORTSC - Port Status and Control Register - port_status_base bitmasks */
-/* true: device connected */
-#define PORT_CONNECT	(1 << 0)
-/* true: port enabled */
-#define PORT_PE		(1 << 1)
-/* bit 2 reserved and zeroed */
-/* true: port has an over-current condition */
-#define PORT_OC		(1 << 3)
-/* true: port reset signaling asserted */
-#define PORT_RESET	(1 << 4)
-/* Port Link State - bits 5:8
- * A read gives the current link PM state of the port,
- * a write with Link State Write Strobe set sets the link state.
- */
-#define PORT_PLS_MASK	(0xf << 5)
-#define XDEV_U0		(0x0 << 5)
-#define XDEV_U1		(0x1 << 5)
-#define XDEV_U2		(0x2 << 5)
-#define XDEV_U3		(0x3 << 5)
-#define XDEV_DISABLED	(0x4 << 5)
-#define XDEV_RXDETECT	(0x5 << 5)
-#define XDEV_INACTIVE	(0x6 << 5)
-#define XDEV_POLLING	(0x7 << 5)
-#define XDEV_RECOVERY	(0x8 << 5)
-#define XDEV_HOT_RESET	(0x9 << 5)
-#define XDEV_COMP_MODE	(0xa << 5)
-#define XDEV_TEST_MODE	(0xb << 5)
-#define XDEV_RESUME	(0xf << 5)
-
-/* true: port has power (see HCC_PPC) */
-#define PORT_POWER	(1 << 9)
-/* bits 10:13 indicate device speed:
- * 0 - undefined speed - port hasn't be initialized by a reset yet
- * 1 - full speed
- * 2 - low speed
- * 3 - high speed
- * 4 - super speed
- * 5-15 reserved
- */
-#define DEV_SPEED_MASK		(0xf << 10)
-#define	XDEV_FS			(0x1 << 10)
-#define	XDEV_LS			(0x2 << 10)
-#define	XDEV_HS			(0x3 << 10)
-#define	XDEV_SS			(0x4 << 10)
-#define	XDEV_SSP		(0x5 << 10)
-#define DEV_UNDEFSPEED(p)	(((p) & DEV_SPEED_MASK) == (0x0<<10))
-#define DEV_FULLSPEED(p)	(((p) & DEV_SPEED_MASK) == XDEV_FS)
-#define DEV_LOWSPEED(p)		(((p) & DEV_SPEED_MASK) == XDEV_LS)
-#define DEV_HIGHSPEED(p)	(((p) & DEV_SPEED_MASK) == XDEV_HS)
-#define DEV_SUPERSPEED(p)	(((p) & DEV_SPEED_MASK) == XDEV_SS)
-#define DEV_SUPERSPEEDPLUS(p)	(((p) & DEV_SPEED_MASK) == XDEV_SSP)
-#define DEV_SUPERSPEED_ANY(p)	(((p) & DEV_SPEED_MASK) >= XDEV_SS)
-#define DEV_PORT_SPEED(p)	(((p) >> 10) & 0x0f)
-
-/* Bits 20:23 in the Slot Context are the speed for the device */
-#define	SLOT_SPEED_FS		(XDEV_FS << 10)
-#define	SLOT_SPEED_LS		(XDEV_LS << 10)
-#define	SLOT_SPEED_HS		(XDEV_HS << 10)
-#define	SLOT_SPEED_SS		(XDEV_SS << 10)
-#define	SLOT_SPEED_SSP		(XDEV_SSP << 10)
-/* Port Indicator Control */
-#define PORT_LED_OFF	(0 << 14)
-#define PORT_LED_AMBER	(1 << 14)
-#define PORT_LED_GREEN	(2 << 14)
-#define PORT_LED_MASK	(3 << 14)
-/* Port Link State Write Strobe - set this when changing link state */
-#define PORT_LINK_STROBE	(1 << 16)
-/* true: connect status change */
-#define PORT_CSC	(1 << 17)
-/* true: port enable change */
-#define PORT_PEC	(1 << 18)
-/* true: warm reset for a USB 3.0 device is done.  A "hot" reset puts the port
- * into an enabled state, and the device into the default state.  A "warm" reset
- * also resets the link, forcing the device through the link training sequence.
- * SW can also look at the Port Reset register to see when warm reset is done.
- */
-#define PORT_WRC	(1 << 19)
-/* true: over-current change */
-#define PORT_OCC	(1 << 20)
-/* true: reset change - 1 to 0 transition of PORT_RESET */
-#define PORT_RC		(1 << 21)
-/* port link status change - set on some port link state transitions:
- *  Transition				Reason
- *  ------------------------------------------------------------------------------
- *  - U3 to Resume			Wakeup signaling from a device
- *  - Resume to Recovery to U0		USB 3.0 device resume
- *  - Resume to U0			USB 2.0 device resume
- *  - U3 to Recovery to U0		Software resume of USB 3.0 device complete
- *  - U3 to U0				Software resume of USB 2.0 device complete
- *  - U2 to U0				L1 resume of USB 2.1 device complete
- *  - U0 to U0 (???)			L1 entry rejection by USB 2.1 device
- *  - U0 to disabled			L1 entry error with USB 2.1 device
- *  - Any state to inactive		Error on USB 3.0 port
- */
-#define PORT_PLC	(1 << 22)
-/* port configure error change - port failed to configure its link partner */
-#define PORT_CEC	(1 << 23)
-#define PORT_CHANGE_MASK	(PORT_CSC | PORT_PEC | PORT_WRC | PORT_OCC | \
-				 PORT_RC | PORT_PLC | PORT_CEC)
-
-
-/* Cold Attach Status - xHC can set this bit to report device attached during
- * Sx state. Warm port reset should be perfomed to clear this bit and move port
- * to connected state.
- */
-#define PORT_CAS	(1 << 24)
-/* wake on connect (enable) */
-#define PORT_WKCONN_E	(1 << 25)
-/* wake on disconnect (enable) */
-#define PORT_WKDISC_E	(1 << 26)
-/* wake on over-current (enable) */
-#define PORT_WKOC_E	(1 << 27)
-/* bits 28:29 reserved */
-/* true: device is non-removable - for USB 3.0 roothub emulation */
-#define PORT_DEV_REMOVE	(1 << 30)
-/* Initiate a warm port reset - complete when PORT_WRC is '1' */
-#define PORT_WR		(1 << 31)
-
-/* We mark duplicate entries with -1 */
-#define DUPLICATE_ENTRY ((u8)(-1))
-
-/* Port Power Management Status and Control - port_power_base bitmasks */
-/* Inactivity timer value for transitions into U1, in microseconds.
- * Timeout can be up to 127us.  0xFF means an infinite timeout.
- */
-#define PORT_U1_TIMEOUT(p)	((p) & 0xff)
-#define PORT_U1_TIMEOUT_MASK	0xff
-/* Inactivity timer value for transitions into U2 */
-#define PORT_U2_TIMEOUT(p)	(((p) & 0xff) << 8)
-#define PORT_U2_TIMEOUT_MASK	(0xff << 8)
-/* Bits 24:31 for port testing */
-
-/* USB2 Protocol PORTSPMSC */
-#define	PORT_L1S_MASK		7
-#define	PORT_L1S_SUCCESS	1
-#define	PORT_RWE		(1 << 3)
-#define	PORT_HIRD(p)		(((p) & 0xf) << 4)
-#define	PORT_HIRD_MASK		(0xf << 4)
-#define	PORT_L1DS_MASK		(0xff << 8)
-#define	PORT_L1DS(p)		(((p) & 0xff) << 8)
-#define	PORT_HLE		(1 << 16)
-#define PORT_TEST_MODE_SHIFT	28
-
-/* USB3 Protocol PORTLI  Port Link Information */
-#define PORT_RX_LANES(p)	(((p) >> 16) & 0xf)
-#define PORT_TX_LANES(p)	(((p) >> 20) & 0xf)
-
-/* USB2 Protocol PORTHLPMC */
-#define PORT_HIRDM(p)((p) & 3)
-#define PORT_L1_TIMEOUT(p)(((p) & 0xff) << 2)
-#define PORT_BESLD(p)(((p) & 0xf) << 10)
-
-/* use 512 microseconds as USB2 LPM L1 default timeout. */
-#define XHCI_L1_TIMEOUT		512
-
-/* Set default HIRD/BESL value to 4 (350/400us) for USB2 L1 LPM resume latency.
- * Safe to use with mixed HIRD and BESL systems (host and device) and is used
- * by other operating systems.
- *
- * XHCI 1.0 errata 8/14/12 Table 13 notes:
- * "Software should choose xHC BESL/BESLD field values that do not violate a
- * device's resume latency requirements,
- * e.g. not program values > '4' if BLC = '1' and a HIRD device is attached,
- * or not program values < '4' if BLC = '0' and a BESL device is attached.
- */
-#define XHCI_DEFAULT_BESL	4
-
-/*
- * USB3 specification define a 360ms tPollingLFPSTiemout for USB3 ports
- * to complete link training. usually link trainig completes much faster
- * so check status 10 times with 36ms sleep in places we need to wait for
- * polling to complete.
- */
-#define XHCI_PORT_POLLING_LFPS_TIME  36
-
 /**
  * struct xhci_intr_reg - Interrupt Register Set
  * @irq_pending:	IMAN - Interrupt Management Register.  Used to enable
@@ -945,6 +690,7 @@
 	/* Bandwidth checking storage */
 	struct xhci_bw_info	bw_info;
 	struct list_head	bw_endpoint_list;
+	unsigned long		stop_time;
 	/* Isoch Frame ID checking storage */
 	int			next_frame_id;
 	/* Use new Isoch TRB layout needed for extended TBC support */
@@ -1258,7 +1004,7 @@
 /* Set TR Dequeue Pointer command TRB fields, 6.4.3.9 */
 #define TRB_TO_STREAM_ID(p)		((((p) & (0xffff << 16)) >> 16))
 #define STREAM_ID_FOR_TRB(p)		((((p)) & 0xffff) << 16)
-#define SCT_FOR_TRB(p)			(((p) << 1) & 0x7)
+#define SCT_FOR_TRB(p)			(((p) & 0x7) << 1)
 
 /* Link TRB specific fields */
 #define TRB_TC			(1<<1)
@@ -1533,6 +1279,7 @@
 	TD_DIRTY = 0,
 	TD_HALTED,
 	TD_CLEARING_CACHE,
+	TD_CLEARING_CACHE_DEFERRED,
 	TD_CLEARED,
 };
 
@@ -1649,8 +1396,8 @@
 	struct	xhci_td	td[] __counted_by(num_tds);
 };
 
-/* Reasonable limit for number of Event Ring segments (spec allows 32k) */
-#define	ERST_MAX_SEGS	2
+/* Number of Event Ring segments to allocate, when amount is not specified. (spec allows 32k) */
+#define	ERST_DEFAULT_SEGS	2
 /* Poll every 60 seconds */
 #define	POLL_TIMEOUT	60
 /* Stop endpoint command timeout (secs) for URB cancellation watchdog timer */
@@ -1688,6 +1435,8 @@
 	struct xhci_erst	erst;
 	struct xhci_intr_reg __iomem *ir_set;
 	unsigned int		intr_num;
+	bool			ip_autoclear;
+	u32			isoc_bei_interval;
 	/* For interrupter registers save and restore over suspend/resume */
 	u32	s3_irq_pending;
 	u32	s3_irq_control;
@@ -1760,7 +1509,6 @@
 	u8		isoc_threshold;
 	/* imod_interval in ns (I * 250ns) */
 	u32		imod_interval;
-	u32		isoc_bei_interval;
 	int		event_ring_max;
 	/* 4KB min, 128MB max */
 	int		page_size;
@@ -1843,7 +1591,7 @@
 #define XHCI_RESET_ON_RESUME	BIT_ULL(7)
 #define	XHCI_SW_BW_CHECKING	BIT_ULL(8)
 #define XHCI_AMD_0x96_HOST	BIT_ULL(9)
-#define XHCI_TRUST_TX_LENGTH	BIT_ULL(10)
+#define XHCI_TRUST_TX_LENGTH	BIT_ULL(10) /* Deprecated */
 #define XHCI_LPM_SUPPORT	BIT_ULL(11)
 #define XHCI_INTEL_HOST		BIT_ULL(12)
 #define XHCI_SPURIOUS_REBOOT	BIT_ULL(13)
@@ -1882,6 +1630,9 @@
 #define XHCI_RESET_TO_DEFAULT	BIT_ULL(44)
 #define XHCI_ZHAOXIN_TRB_FETCH	BIT_ULL(45)
 #define XHCI_ZHAOXIN_HOST	BIT_ULL(46)
+#define XHCI_WRITE_64_HI_LO	BIT_ULL(47)
+#define XHCI_CDNS_SCTX_QUIRK	BIT_ULL(48)
+#define XHCI_ETRON_HOST	BIT_ULL(49)
 
 	unsigned int		num_active_eps;
 	unsigned int		limit_active_eps;
@@ -1983,8 +1734,6 @@
 	dev_err(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
 #define xhci_warn(xhci, fmt, args...) \
 	dev_warn(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
-#define xhci_warn_ratelimited(xhci, fmt, args...) \
-	dev_warn_ratelimited(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
 #define xhci_info(xhci, fmt, args...) \
 	dev_info(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
 
@@ -2087,7 +1836,7 @@
 void xhci_free_container_ctx(struct xhci_hcd *xhci,
 		struct xhci_container_ctx *ctx);
 struct xhci_interrupter *
-xhci_create_secondary_interrupter(struct usb_hcd *hcd, int num_seg);
+xhci_create_secondary_interrupter(struct usb_hcd *hcd, unsigned int segs);
 void xhci_remove_secondary_interrupter(struct usb_hcd
 				       *hcd, struct xhci_interrupter *ir);
 
@@ -2175,6 +1924,7 @@
 void xhci_cleanup_command_queue(struct xhci_hcd *xhci);
 void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring);
 unsigned int count_trbs(u64 addr, u64 len);
+void xhci_process_cancelled_tds(struct xhci_virt_ep *ep);
 
 /* xHCI roothub code */
 void xhci_set_link_state(struct xhci_hcd *xhci, struct xhci_port *port,
--- linux-qcom-6.8.0.orig/drivers/usb/misc/Kconfig
+++ linux-qcom-6.8.0/drivers/usb/misc/Kconfig
@@ -264,6 +264,15 @@
 	  Say Y here if you need EZUSB device support.
 	  (Cypress FX/FX2/FX2LP microcontrollers)
 
+config USB_HUB_USB5807
+	tristate "USB5807 Hub Controller Configuration Driver"
+	depends on I2C
+	help
+	  This option enables support for configuration via SMBus of the
+	  Microchip USB5807 USB 3.1 Hub Controller. Configuration parameters may
+	  be set in devicetree.
+	  Say Y or M here if you need to configure such a device via SMBus.
+
 config USB_HUB_USB251XB
 	tristate "USB251XB Hub Controller Configuration Driver"
 	depends on I2C
--- linux-qcom-6.8.0.orig/drivers/usb/misc/Makefile
+++ linux-qcom-6.8.0/drivers/usb/misc/Makefile
@@ -26,6 +26,7 @@
 obj-$(CONFIG_USB_SEVSEG)		+= usbsevseg.o
 obj-$(CONFIG_USB_YUREX)			+= yurex.o
 obj-$(CONFIG_USB_HUB_USB251XB)		+= usb251xb.o
+obj-$(CONFIG_USB_HUB_USB5807)		+= usb5807.o
 obj-$(CONFIG_USB_HSIC_USB3503)		+= usb3503.o
 obj-$(CONFIG_USB_HSIC_USB4604)		+= usb4604.o
 obj-$(CONFIG_USB_CHAOSKEY)		+= chaoskey.o
--- linux-qcom-6.8.0.orig/drivers/usb/misc/appledisplay.c
+++ linux-qcom-6.8.0/drivers/usb/misc/appledisplay.c
@@ -107,7 +107,12 @@
 	case ACD_BTN_BRIGHT_UP:
 	case ACD_BTN_BRIGHT_DOWN:
 		pdata->button_pressed = 1;
-		schedule_delayed_work(&pdata->work, 0);
+		/*
+		 * there is a window during which no device
+		 * is registered
+		 */
+		if (pdata->bd )
+			schedule_delayed_work(&pdata->work, 0);
 		break;
 	case ACD_BTN_NONE:
 	default:
@@ -202,6 +207,7 @@
 	const struct usb_device_id *id)
 {
 	struct backlight_properties props;
+	struct backlight_device *backlight;
 	struct appledisplay *pdata;
 	struct usb_device *udev = interface_to_usbdev(iface);
 	struct usb_endpoint_descriptor *endpoint;
@@ -272,13 +278,14 @@
 	memset(&props, 0, sizeof(struct backlight_properties));
 	props.type = BACKLIGHT_RAW;
 	props.max_brightness = 0xff;
-	pdata->bd = backlight_device_register(bl_name, NULL, pdata,
+	backlight = backlight_device_register(bl_name, NULL, pdata,
 					      &appledisplay_bl_data, &props);
-	if (IS_ERR(pdata->bd)) {
+	if (IS_ERR(backlight)) {
 		dev_err(&iface->dev, "Backlight registration failed\n");
-		retval = PTR_ERR(pdata->bd);
+		retval = PTR_ERR(backlight);
 		goto error;
 	}
+	pdata->bd = backlight;
 
 	/* Try to get brightness */
 	brightness = appledisplay_bl_get_brightness(pdata->bd);
--- linux-qcom-6.8.0.orig/drivers/usb/misc/chaoskey.c
+++ linux-qcom-6.8.0/drivers/usb/misc/chaoskey.c
@@ -27,6 +27,8 @@
 static int chaoskey_rng_read(struct hwrng *rng, void *data,
 			     size_t max, bool wait);
 
+static DEFINE_MUTEX(chaoskey_list_lock);
+
 #define usb_dbg(usb_if, format, arg...) \
 	dev_dbg(&(usb_if)->dev, format, ## arg)
 
@@ -233,6 +235,7 @@
 	usb_deregister_dev(interface, &chaoskey_class);
 
 	usb_set_intfdata(interface, NULL);
+	mutex_lock(&chaoskey_list_lock);
 	mutex_lock(&dev->lock);
 
 	dev->present = false;
@@ -244,6 +247,7 @@
 	} else
 		mutex_unlock(&dev->lock);
 
+	mutex_unlock(&chaoskey_list_lock);
 	usb_dbg(interface, "disconnect done");
 }
 
@@ -251,6 +255,7 @@
 {
 	struct chaoskey *dev;
 	struct usb_interface *interface;
+	int rv = 0;
 
 	/* get the interface from minor number and driver information */
 	interface = usb_find_interface(&chaoskey_driver, iminor(inode));
@@ -266,18 +271,23 @@
 	}
 
 	file->private_data = dev;
+	mutex_lock(&chaoskey_list_lock);
 	mutex_lock(&dev->lock);
-	++dev->open;
+	if (dev->present)
+		++dev->open;
+	else
+		rv = -ENODEV;
 	mutex_unlock(&dev->lock);
+	mutex_unlock(&chaoskey_list_lock);
 
-	usb_dbg(interface, "open success");
-	return 0;
+	return rv;
 }
 
 static int chaoskey_release(struct inode *inode, struct file *file)
 {
 	struct chaoskey *dev = file->private_data;
 	struct usb_interface *interface;
+	int rv = 0;
 
 	if (dev == NULL)
 		return -ENODEV;
@@ -286,14 +296,15 @@
 
 	usb_dbg(interface, "release");
 
+	mutex_lock(&chaoskey_list_lock);
 	mutex_lock(&dev->lock);
 
 	usb_dbg(interface, "open count at release is %d", dev->open);
 
 	if (dev->open <= 0) {
 		usb_dbg(interface, "invalid open count (%d)", dev->open);
-		mutex_unlock(&dev->lock);
-		return -ENODEV;
+		rv = -ENODEV;
+		goto bail;
 	}
 
 	--dev->open;
@@ -302,13 +313,15 @@
 		if (dev->open == 0) {
 			mutex_unlock(&dev->lock);
 			chaoskey_free(dev);
-		} else
-			mutex_unlock(&dev->lock);
-	} else
-		mutex_unlock(&dev->lock);
-
+			goto destruction;
+		}
+	}
+bail:
+	mutex_unlock(&dev->lock);
+destruction:
+	mutex_unlock(&chaoskey_list_lock);
 	usb_dbg(interface, "release success");
-	return 0;
+	return rv;
 }
 
 static void chaos_read_callback(struct urb *urb)
--- linux-qcom-6.8.0.orig/drivers/usb/misc/cypress_cy7c63.c
+++ linux-qcom-6.8.0/drivers/usb/misc/cypress_cy7c63.c
@@ -88,6 +88,9 @@
 				 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
 				 address, data, iobuf, CYPRESS_MAX_REQSIZE,
 				 USB_CTRL_GET_TIMEOUT);
+	/* we must not process garbage */
+	if (retval < 2)
+		goto err_buf;
 
 	/* store returned data (more READs to be added) */
 	switch (request) {
@@ -107,6 +110,7 @@
 			break;
 	}
 
+err_buf:
 	kfree(iobuf);
 error:
 	return retval;
--- linux-qcom-6.8.0.orig/drivers/usb/misc/iowarrior.c
+++ linux-qcom-6.8.0/drivers/usb/misc/iowarrior.c
@@ -277,28 +277,45 @@
 	struct iowarrior *dev;
 	int read_idx;
 	int offset;
+	int retval;
 
 	dev = file->private_data;
 
+	if (file->f_flags & O_NONBLOCK) {
+		retval = mutex_trylock(&dev->mutex);
+		if (!retval)
+			return -EAGAIN;
+	} else {
+		retval = mutex_lock_interruptible(&dev->mutex);
+		if (retval)
+			return -ERESTARTSYS;
+	}
+
 	/* verify that the device wasn't unplugged */
-	if (!dev || !dev->present)
-		return -ENODEV;
+	if (!dev->present) {
+		retval = -ENODEV;
+		goto exit;
+	}
 
 	dev_dbg(&dev->interface->dev, "minor %d, count = %zd\n",
 		dev->minor, count);
 
 	/* read count must be packet size (+ time stamp) */
 	if ((count != dev->report_size)
-	    && (count != (dev->report_size + 1)))
-		return -EINVAL;
+	    && (count != (dev->report_size + 1))) {
+		retval = -EINVAL;
+		goto exit;
+	}
 
 	/* repeat until no buffer overrun in callback handler occur */
 	do {
 		atomic_set(&dev->overflow_flag, 0);
 		if ((read_idx = read_index(dev)) == -1) {
 			/* queue empty */
-			if (file->f_flags & O_NONBLOCK)
-				return -EAGAIN;
+			if (file->f_flags & O_NONBLOCK) {
+				retval = -EAGAIN;
+				goto exit;
+			}
 			else {
 				//next line will return when there is either new data, or the device is unplugged
 				int r = wait_event_interruptible(dev->read_wait,
@@ -309,28 +326,37 @@
 								  -1));
 				if (r) {
 					//we were interrupted by a signal
-					return -ERESTART;
+					retval = -ERESTART;
+					goto exit;
 				}
 				if (!dev->present) {
 					//The device was unplugged
-					return -ENODEV;
+					retval = -ENODEV;
+					goto exit;
 				}
 				if (read_idx == -1) {
 					// Can this happen ???
-					return 0;
+					retval = 0;
+					goto exit;
 				}
 			}
 		}
 
 		offset = read_idx * (dev->report_size + 1);
 		if (copy_to_user(buffer, dev->read_queue + offset, count)) {
-			return -EFAULT;
+			retval = -EFAULT;
+			goto exit;
 		}
 	} while (atomic_read(&dev->overflow_flag));
 
 	read_idx = ++read_idx == MAX_INTERRUPT_BUFFER ? 0 : read_idx;
 	atomic_set(&dev->read_idx, read_idx);
+	mutex_unlock(&dev->mutex);
 	return count;
+
+exit:
+	mutex_unlock(&dev->mutex);
+	return retval;
 }
 
 /*
@@ -885,7 +911,6 @@
 static void iowarrior_disconnect(struct usb_interface *interface)
 {
 	struct iowarrior *dev = usb_get_intfdata(interface);
-	int minor = dev->minor;
 
 	usb_deregister_dev(interface, &iowarrior_class);
 
@@ -909,9 +934,6 @@
 		mutex_unlock(&dev->mutex);
 		iowarrior_delete(dev);
 	}
-
-	dev_info(&interface->dev, "I/O-Warror #%d now disconnected\n",
-		 minor - IOWARRIOR_MINOR_BASE);
 }
 
 /* usb specific object needed to register this driver with the usb subsystem */
--- linux-qcom-6.8.0.orig/drivers/usb/misc/onboard_usb_hub.c
+++ linux-qcom-6.8.0/drivers/usb/misc/onboard_usb_hub.c
@@ -78,7 +78,7 @@
 	err = regulator_bulk_enable(hub->pdata->num_supplies, hub->supplies);
 	if (err) {
 		dev_err(hub->dev, "failed to enable supplies: %pe\n", ERR_PTR(err));
-		return err;
+		goto disable_clk;
 	}
 
 	fsleep(hub->pdata->reset_us);
@@ -87,6 +87,10 @@
 	hub->is_powered_on = true;
 
 	return 0;
+
+disable_clk:
+	clk_disable_unprepare(hub->clk);
+	return err;
 }
 
 static int onboard_hub_power_off(struct onboard_hub *hub)
--- linux-qcom-6.8.0.orig/drivers/usb/misc/qcom_eud.c
+++ linux-qcom-6.8.0/drivers/usb/misc/qcom_eud.c
@@ -5,6 +5,7 @@
 
 #include <linux/bitops.h>
 #include <linux/err.h>
+#include <linux/firmware/qcom/qcom_scm.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/iopoll.h>
@@ -35,18 +36,31 @@
 	struct usb_role_switch		*role_sw;
 	void __iomem			*base;
 	void __iomem			*mode_mgr;
+	phys_addr_t			mode_mgr_phys;
 	unsigned int			int_status;
 	int				irq;
 	bool				enabled;
 	bool				usb_attached;
 };
 
+struct eud_cfg {
+	bool secure_eud_en;
+};
+
 static int enable_eud(struct eud_chip *priv)
 {
+	int ret;
+
 	writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN);
 	writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE,
 			priv->base + EUD_REG_INT1_EN_MASK);
-	writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
+	if (priv->mode_mgr_phys && !priv->mode_mgr) {
+		ret = qcom_scm_io_writel(priv->mode_mgr_phys + EUD_REG_EUD_EN2, 1);
+		if (ret)
+			return ret;
+	} else {
+		writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
+	}
 
 	return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE);
 }
@@ -54,7 +68,10 @@
 static void disable_eud(struct eud_chip *priv)
 {
 	writel(0, priv->base + EUD_REG_CSR_EUD_EN);
-	writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
+	if (priv->mode_mgr_phys && !priv->mode_mgr)
+		qcom_scm_io_writel(priv->mode_mgr_phys + EUD_REG_EUD_EN2, 0);
+	else
+		writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
 }
 
 static ssize_t enable_show(struct device *dev,
@@ -178,6 +195,8 @@
 static int eud_probe(struct platform_device *pdev)
 {
 	struct eud_chip *chip;
+	struct resource *res;
+	const struct eud_cfg *cfg;
 	int ret;
 
 	chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
@@ -200,9 +219,22 @@
 	if (IS_ERR(chip->base))
 		return PTR_ERR(chip->base);
 
-	chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
-	if (IS_ERR(chip->mode_mgr))
-		return PTR_ERR(chip->mode_mgr);
+	cfg = of_device_get_match_data(&pdev->dev);
+	if (!cfg)
+		return -EINVAL;
+
+	if (cfg->secure_eud_en) {
+		res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+		if (!res)
+			return -ENODEV;
+		chip->mode_mgr_phys = res->start;
+		chip->mode_mgr = NULL;
+	} else {
+		chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
+		if (IS_ERR(chip->mode_mgr))
+			return PTR_ERR(chip->mode_mgr);
+		chip->mode_mgr_phys = 0;
+	}
 
 	chip->irq = platform_get_irq(pdev, 0);
 	if (chip->irq < 0)
@@ -231,8 +263,17 @@
 	disable_irq_wake(chip->irq);
 }
 
+static const struct eud_cfg nonsecure_eud = {
+	.secure_eud_en = false,
+};
+
+static const struct eud_cfg secure_eud = {
+	.secure_eud_en = true,
+};
+
 static const struct of_device_id eud_dt_match[] = {
-	{ .compatible = "qcom,sc7280-eud" },
+	{ .compatible = "qcom,eud", .data = &nonsecure_eud },
+	{ .compatible = "qcom,secure-eud", .data = &secure_eud },
 	{ }
 };
 MODULE_DEVICE_TABLE(of, eud_dt_match);
--- linux-qcom-6.8.0.orig/drivers/usb/misc/usb-ljca.c
+++ linux-qcom-6.8.0/drivers/usb/misc/usb-ljca.c
@@ -169,6 +169,7 @@
 	{ "INTC1096" },
 	{ "INTC100B" },
 	{ "INTC10D1" },
+	{ "INTC10B5" },
 	{},
 };
 
@@ -331,14 +332,11 @@
 
 	ret = usb_bulk_msg(adap->usb_dev, adap->tx_pipe, header,
 			   msg_len, &transferred, LJCA_WRITE_TIMEOUT_MS);
-
-	usb_autopm_put_interface(adap->intf);
-
 	if (ret < 0)
-		goto out;
+		goto out_put;
 	if (transferred != msg_len) {
 		ret = -EIO;
-		goto out;
+		goto out_put;
 	}
 
 	if (ack) {
@@ -346,11 +344,14 @@
 						  timeout);
 		if (!ret) {
 			ret = -ETIMEDOUT;
-			goto out;
+			goto out_put;
 		}
 	}
 	ret = adap->actual_length;
 
+out_put:
+	usb_autopm_put_interface(adap->intf);
+
 out:
 	spin_lock_irqsave(&adap->lock, flags);
 	adap->ex_buf = NULL;
@@ -518,8 +519,10 @@
 	int ret;
 
 	client = kzalloc(sizeof *client, GFP_KERNEL);
-	if (!client)
+	if (!client) {
+		kfree(data);
 		return -ENOMEM;
+	}
 
 	client->type = type;
 	client->id = id;
@@ -535,8 +538,10 @@
 	auxdev->dev.release = ljca_auxdev_release;
 
 	ret = auxiliary_device_init(auxdev);
-	if (ret)
+	if (ret) {
+		kfree(data);
 		goto err_free;
+	}
 
 	ljca_auxdev_acpi_bind(adap, auxdev, adr, id);
 
@@ -590,12 +595,8 @@
 		valid_pin[i] = get_unaligned_le32(&desc->bank_desc[i].valid_pins);
 	bitmap_from_arr32(gpio_info->valid_pin_map, valid_pin, gpio_num);
 
-	ret = ljca_new_client_device(adap, LJCA_CLIENT_GPIO, 0, "ljca-gpio",
+	return ljca_new_client_device(adap, LJCA_CLIENT_GPIO, 0, "ljca-gpio",
 				     gpio_info, LJCA_GPIO_ACPI_ADR);
-	if (ret)
-		kfree(gpio_info);
-
-	return ret;
 }
 
 static int ljca_enumerate_i2c(struct ljca_adapter *adap)
@@ -629,10 +630,8 @@
 		ret = ljca_new_client_device(adap, LJCA_CLIENT_I2C, i,
 					     "ljca-i2c", i2c_info,
 					     LJCA_I2C1_ACPI_ADR + i);
-		if (ret) {
-			kfree(i2c_info);
+		if (ret)
 			return ret;
-		}
 	}
 
 	return 0;
@@ -669,10 +668,8 @@
 		ret = ljca_new_client_device(adap, LJCA_CLIENT_SPI, i,
 					     "ljca-spi", spi_info,
 					     LJCA_SPI1_ACPI_ADR + i);
-		if (ret) {
-			kfree(spi_info);
+		if (ret)
 			return ret;
-		}
 	}
 
 	return 0;
@@ -814,6 +811,14 @@
 	if (ret)
 		goto err_free;
 
+	/*
+	 * This works around problems with ov2740 initialization on some
+	 * Lenovo platforms. The autosuspend delay, has to be smaller than
+	 * the delay after setting the reset_gpio line in ov2740_resume().
+	 * Otherwise the sensor randomly fails to initialize.
+	 */
+	pm_runtime_set_autosuspend_delay(&usb_dev->dev, 10);
+
 	usb_enable_autosuspend(usb_dev);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/usb/misc/usb5807.c
+++ linux-qcom-6.8.0/drivers/usb/misc/usb5807.c
@@ -0,0 +1,175 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Driver for Microchip USB5807 USB 3.1 Hub
+ * Configuration via SMBus.
+ *
+ * Copyright (c) 2023 Topic Embedded Products
+ */
+
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/gpio/consumer.h>
+#include <linux/i2c.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of_device.h>
+
+#define USB5807_CMD_ATTACH 0xAA55
+#define USB5807_CMD_CONFIG 0x9937
+
+#define USB5807_REG_LANE_SWAP 0x30FA
+
+#define USB5807_NUM_PORTS 7
+
+
+static int usb5807_write(struct i2c_client *i2c, void *buf, u8 len)
+{
+	int ret;
+	struct i2c_msg msg = {
+		.addr	= i2c->addr,
+		.flags  = 0x0,
+		.len	= len,
+		.buf	= buf,
+	};
+
+	ret = i2c_transfer(i2c->adapter, &msg, 1);
+	return ret < 0 ? ret : 0;
+}
+
+/*
+ * Send a command sequence, which is an I2C write transaction, with the command
+ * word in big endian and a terminating "0" byte.
+ */
+static int usb5807_command(struct i2c_client *i2c, u16 cmd)
+{
+	u8 buf[3] = {cmd >> 8, cmd & 0xff, 0};
+
+	return usb5807_write(i2c, buf, sizeof(buf));
+}
+
+static int usb5807_prepare_reg_u8(struct i2c_client *i2c, u16 reg, u8 value)
+{
+	u8 buf[] = {
+		0x00,
+		0x00,		/* Memory offset */
+		1 + 4,		/* Transaction size */
+		0x00,		/* 0 = Register write operation */
+		1,		/* Size of register data */
+		(reg >> 8) & 0xff,
+		reg & 0xff,	/* Register offset */
+		value,		/* Register data */
+		0		/* Terminating zero */
+	};
+
+	return usb5807_write(i2c, buf, sizeof(buf));
+}
+
+/*
+ * Write an 8-bit register. First we must write the "set register" operation to
+ * the chip's internal memory at offset 0, then issue a command to execute said
+ * operation.
+ */
+static int usb5807_write_reg_u8(struct i2c_client *i2c, u16 reg, u8 value)
+{
+	int ret;
+
+	ret = usb5807_prepare_reg_u8(i2c, reg, value);
+	if (ret)
+		return ret;
+
+	return usb5807_command(i2c, USB5807_CMD_CONFIG);
+}
+
+/* Decode array of port numbers property into bit mask */
+static u8 usb5807_get_ports_field(struct device *dev, const char *prop_name)
+{
+	struct property *prop;
+	const __be32 *p;
+	u32 port;
+	u8 result = 0;
+
+	of_property_for_each_u32(dev->of_node, prop_name, prop, p, port) {
+		if (port < USB5807_NUM_PORTS)
+			result |= BIT(port);
+		else
+			dev_warn(dev, "%s: port %u doesn't exist\n", prop_name,
+				 port);
+	}
+	return result;
+}
+
+static int usb5807_i2c_probe(struct i2c_client *i2c)
+{
+	struct device_node *np = i2c->dev.of_node;
+	struct gpio_desc *reset_gpio;
+	int ret;
+	u8 val;
+
+	/* Reset the chip to bring it into configuration mode */
+	reset_gpio = devm_gpiod_get_optional(&i2c->dev, "reset",
+					     GPIOD_OUT_HIGH);
+	if (IS_ERR(reset_gpio)) {
+		dev_warn(&i2c->dev, "Failed to request reset GPIO\n");
+		reset_gpio = NULL;
+	}
+	/* Reset timing: Assert for >= 5 us */
+	usleep_range(5, 10);
+
+	/* Lock the bus for >= 1ms while the hub reads the I2C strapping */
+	i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+
+	if (reset_gpio)
+		gpiod_set_value_cansleep(reset_gpio, 0);
+
+	usleep_range(1000, 2000);
+
+	i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+
+	/* The hub device needs additional time to boot up */
+	msleep(20);
+
+	val = usb5807_get_ports_field(&i2c->dev, "swap-dx-lanes");
+	if (val) {
+		ret = usb5807_write_reg_u8(i2c, USB5807_REG_LANE_SWAP, val);
+		if (ret < 0)
+			dev_err(&i2c->dev, "Failed writing config: %d\n", ret);
+	}
+
+	/*
+	 * Send the "Attach" command which makes the device disappear from the
+	 * I2C bus and starts USB enumeration.
+	 */
+	ret = usb5807_command(i2c, USB5807_CMD_ATTACH);
+	if (ret) {
+		dev_err(&i2c->dev, "Failed sending ATTACH command: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static const struct of_device_id usb5807_of_match[] = {
+	{ .compatible = "microchip,usb5807" },
+	{ } /* sentinel */
+};
+MODULE_DEVICE_TABLE(of, usb5807_of_match);
+
+static const struct i2c_device_id usb5807_id[] = {
+	{ "usb5807", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(i2c, usb5807_id);
+
+static struct i2c_driver usb5807_i2c_driver = {
+	.driver = {
+		.name = "usb5807",
+		.of_match_table = of_match_ptr(usb5807_of_match),
+	},
+	.probe    = usb5807_i2c_probe,
+	.id_table = usb5807_id,
+};
+
+module_i2c_driver(usb5807_i2c_driver);
+
+MODULE_DESCRIPTION("USB5807 USB 3.1 Hub Controller Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/usb/misc/uss720.c
+++ linux-qcom-6.8.0/drivers/usb/misc/uss720.c
@@ -677,7 +677,7 @@
 	struct parport_uss720_private *priv;
 	struct parport *pp;
 	unsigned char reg;
-	int i;
+	int ret;
 
 	dev_dbg(&intf->dev, "probe: vendor id 0x%x, device id 0x%x\n",
 		le16_to_cpu(usbdev->descriptor.idVendor),
@@ -688,8 +688,8 @@
 		usb_put_dev(usbdev);
 		return -ENODEV;
 	}
-	i = usb_set_interface(usbdev, intf->altsetting->desc.bInterfaceNumber, 2);
-	dev_dbg(&intf->dev, "set interface result %d\n", i);
+	ret = usb_set_interface(usbdev, intf->altsetting->desc.bInterfaceNumber, 2);
+	dev_dbg(&intf->dev, "set interface result %d\n", ret);
 
 	interface = intf->cur_altsetting;
 
@@ -725,12 +725,18 @@
 	set_1284_register(pp, 7, 0x00, GFP_KERNEL);
 	set_1284_register(pp, 6, 0x30, GFP_KERNEL);  /* PS/2 mode */
 	set_1284_register(pp, 2, 0x0c, GFP_KERNEL);
-	/* debugging */
-	get_1284_register(pp, 0, &reg, GFP_KERNEL);
+
+	/* The Belkin F5U002 Rev 2 P80453-B USB parallel port adapter shares the
+	 * device ID 050d:0002 with some other device that works with this
+	 * driver, but it itself does not. Detect and handle the bad cable
+	 * here. */
+	ret = get_1284_register(pp, 0, &reg, GFP_KERNEL);
 	dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);
+	if (ret < 0)
+		return ret;
 
-	i = usb_find_last_int_in_endpoint(interface, &epd);
-	if (!i) {
+	ret = usb_find_last_int_in_endpoint(interface, &epd);
+	if (!ret) {
 		dev_dbg(&intf->dev, "epaddr %d interval %d\n",
 				epd->bEndpointAddress, epd->bInterval);
 	}
--- linux-qcom-6.8.0.orig/drivers/usb/misc/yurex.c
+++ linux-qcom-6.8.0/drivers/usb/misc/yurex.c
@@ -34,8 +34,6 @@
 #define YUREX_BUF_SIZE		8
 #define YUREX_WRITE_TIMEOUT	(HZ*2)
 
-#define MAX_S64_STRLEN 20 /* {-}922337203685477580{7,8} */
-
 /* table of devices that work with this driver */
 static struct usb_device_id yurex_table[] = {
 	{ USB_DEVICE(YUREX_VENDOR_ID, YUREX_PRODUCT_ID) },
@@ -403,7 +401,7 @@
 {
 	struct usb_yurex *dev;
 	int len = 0;
-	char in_buffer[MAX_S64_STRLEN];
+	char in_buffer[20];
 	unsigned long flags;
 
 	dev = file->private_data;
@@ -414,16 +412,14 @@
 		return -ENODEV;
 	}
 
-	if (WARN_ON_ONCE(dev->bbu > S64_MAX || dev->bbu < S64_MIN)) {
-		mutex_unlock(&dev->io_mutex);
-		return -EIO;
-	}
-
 	spin_lock_irqsave(&dev->lock, flags);
-	scnprintf(in_buffer, MAX_S64_STRLEN, "%lld\n", dev->bbu);
+	len = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
 	spin_unlock_irqrestore(&dev->lock, flags);
 	mutex_unlock(&dev->io_mutex);
 
+	if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
+		return -EIO;
+
 	return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
 }
 
@@ -445,7 +441,10 @@
 	if (count == 0)
 		goto error;
 
-	mutex_lock(&dev->io_mutex);
+	retval = mutex_lock_interruptible(&dev->io_mutex);
+	if (retval < 0)
+		return -EINTR;
+
 	if (dev->disconnected) {		/* already disconnected */
 		mutex_unlock(&dev->io_mutex);
 		retval = -ENODEV;
@@ -511,8 +510,11 @@
 			__func__, retval);
 		goto error;
 	}
-	if (set && timeout)
+	if (set && timeout) {
+		spin_lock_irq(&dev->lock);
 		dev->bbu = c2;
+		spin_unlock_irq(&dev->lock);
+	}
 	return timeout ? count : -EIO;
 
 error:
--- linux-qcom-6.8.0.orig/drivers/usb/musb/da8xx.c
+++ linux-qcom-6.8.0/drivers/usb/musb/da8xx.c
@@ -556,7 +556,7 @@
 	ret = of_platform_populate(pdev->dev.of_node, NULL,
 				   da8xx_auxdata_lookup, &pdev->dev);
 	if (ret)
-		return ret;
+		goto err_unregister_phy;
 
 	pinfo = da8xx_dev_info;
 	pinfo.parent = &pdev->dev;
@@ -571,9 +571,13 @@
 	ret = PTR_ERR_OR_ZERO(glue->musb);
 	if (ret) {
 		dev_err(&pdev->dev, "failed to register musb device: %d\n", ret);
-		usb_phy_generic_unregister(glue->usb_phy);
+		goto err_unregister_phy;
 	}
 
+	return 0;
+
+err_unregister_phy:
+	usb_phy_generic_unregister(glue->usb_phy);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/drivers/usb/musb/musb_gadget.c
+++ linux-qcom-6.8.0/drivers/usb/musb/musb_gadget.c
@@ -1170,12 +1170,19 @@
  */
 void musb_ep_restart(struct musb *musb, struct musb_request *req)
 {
+	u16 csr;
+	void __iomem *epio = req->ep->hw_ep->regs;
+
 	trace_musb_req_start(req);
 	musb_ep_select(musb->mregs, req->epnum);
-	if (req->tx)
+	if (req->tx) {
 		txstate(musb, req);
-	else
-		rxstate(musb, req);
+	} else {
+		csr = musb_readw(epio, MUSB_RXCSR);
+		csr |= MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_P_WZC_BITS;
+		musb_writew(epio, MUSB_RXCSR, csr);
+		musb_writew(epio, MUSB_RXCSR, csr);
+	}
 }
 
 static int musb_ep_restart_resume_work(struct musb *musb, void *data)
--- linux-qcom-6.8.0.orig/drivers/usb/musb/sunxi.c
+++ linux-qcom-6.8.0/drivers/usb/musb/sunxi.c
@@ -293,8 +293,6 @@
 	if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags))
 		sunxi_sram_release(musb->controller->parent);
 
-	devm_usb_put_phy(glue->dev, glue->xceiv);
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/drivers/usb/phy/phy.c
+++ linux-qcom-6.8.0/drivers/usb/phy/phy.c
@@ -628,7 +628,7 @@
 {
 	int r;
 
-	r = devres_destroy(dev, devm_usb_phy_release, devm_usb_phy_match, phy);
+	r = devres_release(dev, devm_usb_phy_release, devm_usb_phy_match, phy);
 	dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n");
 }
 EXPORT_SYMBOL_GPL(devm_usb_put_phy);
--- linux-qcom-6.8.0.orig/drivers/usb/serial/cp210x.c
+++ linux-qcom-6.8.0/drivers/usb/serial/cp210x.c
@@ -56,6 +56,8 @@
 	{ USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
 	{ USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
 	{ USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
+	{ USB_DEVICE(0x04BF, 0x1301) }, /* TDK Corporation NC0110013M - Network Controller */
+	{ USB_DEVICE(0x04BF, 0x1303) }, /* TDK Corporation MM0110113M - i3 Micro Module */
 	{ USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */
 	{ USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
 	{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
@@ -144,6 +146,7 @@
 	{ USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
 	{ USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */
 	{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+	{ USB_DEVICE(0x10C4, 0x863C) }, /* MGP Instruments PDS100 */
 	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
 	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
 	{ USB_DEVICE(0x10C4, 0x87ED) }, /* IMST USB-Stick for Smart Meter */
@@ -177,6 +180,7 @@
 	{ USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */
 	{ USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */
 	{ USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */
+	{ USB_DEVICE(0x11CA, 0x0212) }, /* Verifone USB to Printer (UART, CP2102) */
 	{ USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */
 	{ USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */
 	{ USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
@@ -219,6 +223,7 @@
 	{ USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
 	{ USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
 	{ USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+	{ USB_DEVICE(0x1B93, 0x1013) }, /* Phoenix Contact UPS Device */
 	{ USB_DEVICE(0x1BA4, 0x0002) },	/* Silicon Labs 358x factory default */
 	{ USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
 	{ USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */
--- linux-qcom-6.8.0.orig/drivers/usb/serial/ftdi_sio.c
+++ linux-qcom-6.8.0/drivers/usb/serial/ftdi_sio.c
@@ -1077,6 +1077,8 @@
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	/* GMC devices */
+	{ USB_DEVICE(GMC_VID, GMC_Z216C_PID) },
 	{ }					/* Terminating entry */
 };
 
--- linux-qcom-6.8.0.orig/drivers/usb/serial/ftdi_sio_ids.h
+++ linux-qcom-6.8.0/drivers/usb/serial/ftdi_sio_ids.h
@@ -1606,3 +1606,9 @@
 #define UBLOX_VID			0x1546
 #define UBLOX_C099F9P_ZED_PID		0x0502
 #define UBLOX_C099F9P_ODIN_PID		0x0503
+
+/*
+ * GMC devices
+ */
+#define GMC_VID				0x1cd7
+#define GMC_Z216C_PID			0x0217 /* GMC Z216C Adapter IR-USB */
--- linux-qcom-6.8.0.orig/drivers/usb/serial/io_edgeport.c
+++ linux-qcom-6.8.0/drivers/usb/serial/io_edgeport.c
@@ -770,11 +770,12 @@
 static void edge_bulk_out_cmd_callback(struct urb *urb)
 {
 	struct edgeport_port *edge_port = urb->context;
+	struct device *dev = &urb->dev->dev;
 	int status = urb->status;
 
 	atomic_dec(&CmdUrbs);
-	dev_dbg(&urb->dev->dev, "%s - FREE URB %p (outstanding %d)\n",
-		__func__, urb, atomic_read(&CmdUrbs));
+	dev_dbg(dev, "%s - FREE URB %p (outstanding %d)\n", __func__, urb,
+		atomic_read(&CmdUrbs));
 
 
 	/* clean up the transfer buffer */
@@ -784,8 +785,7 @@
 	usb_free_urb(urb);
 
 	if (status) {
-		dev_dbg(&urb->dev->dev,
-			"%s - nonzero write bulk status received: %d\n",
+		dev_dbg(dev, "%s - nonzero write bulk status received: %d\n",
 			__func__, status);
 		return;
 	}
--- linux-qcom-6.8.0.orig/drivers/usb/serial/mos7840.c
+++ linux-qcom-6.8.0/drivers/usb/serial/mos7840.c
@@ -1737,6 +1737,49 @@
 	kfree(mos7840_port);
 }
 
+static int mos7840_suspend(struct usb_serial *serial, pm_message_t message)
+{
+	struct moschip_port *mos7840_port;
+	struct usb_serial_port *port;
+	int i;
+
+	for (i = 0; i < serial->num_ports; ++i) {
+		port = serial->port[i];
+		if (!tty_port_initialized(&port->port))
+			continue;
+
+		mos7840_port = usb_get_serial_port_data(port);
+
+		usb_kill_urb(mos7840_port->read_urb);
+		mos7840_port->read_urb_busy = false;
+	}
+
+	return 0;
+}
+
+static int mos7840_resume(struct usb_serial *serial)
+{
+	struct moschip_port *mos7840_port;
+	struct usb_serial_port *port;
+	int res;
+	int i;
+
+	for (i = 0; i < serial->num_ports; ++i) {
+		port = serial->port[i];
+		if (!tty_port_initialized(&port->port))
+			continue;
+
+		mos7840_port = usb_get_serial_port_data(port);
+
+		mos7840_port->read_urb_busy = true;
+		res = usb_submit_urb(mos7840_port->read_urb, GFP_NOIO);
+		if (res)
+			mos7840_port->read_urb_busy = false;
+	}
+
+	return 0;
+}
+
 static struct usb_serial_driver moschip7840_4port_device = {
 	.driver = {
 		   .owner = THIS_MODULE,
@@ -1764,6 +1807,8 @@
 	.port_probe = mos7840_port_probe,
 	.port_remove = mos7840_port_remove,
 	.read_bulk_callback = mos7840_bulk_in_callback,
+	.suspend = mos7840_suspend,
+	.resume = mos7840_resume,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
--- linux-qcom-6.8.0.orig/drivers/usb/serial/option.c
+++ linux-qcom-6.8.0/drivers/usb/serial/option.c
@@ -251,10 +251,15 @@
 #define QUECTEL_VENDOR_ID			0x2c7c
 /* These Quectel products use Quectel's vendor ID */
 #define QUECTEL_PRODUCT_EC21			0x0121
+#define QUECTEL_PRODUCT_RG650V			0x0122
 #define QUECTEL_PRODUCT_EM061K_LTA		0x0123
 #define QUECTEL_PRODUCT_EM061K_LMS		0x0124
 #define QUECTEL_PRODUCT_EC25			0x0125
 #define QUECTEL_PRODUCT_EM060K_128		0x0128
+#define QUECTEL_PRODUCT_EM060K_129		0x0129
+#define QUECTEL_PRODUCT_EM060K_12a		0x012a
+#define QUECTEL_PRODUCT_EM060K_12b		0x012b
+#define QUECTEL_PRODUCT_EM060K_12c		0x012c
 #define QUECTEL_PRODUCT_EG91			0x0191
 #define QUECTEL_PRODUCT_EG95			0x0195
 #define QUECTEL_PRODUCT_BG96			0x0296
@@ -275,6 +280,7 @@
 #define QUECTEL_PRODUCT_EG912Y			0x6001
 #define QUECTEL_PRODUCT_EC200S_CN		0x6002
 #define QUECTEL_PRODUCT_EC200A			0x6005
+#define QUECTEL_PRODUCT_EG916Q			0x6007
 #define QUECTEL_PRODUCT_EM061K_LWW		0x6008
 #define QUECTEL_PRODUCT_EM061K_LCN		0x6009
 #define QUECTEL_PRODUCT_EC200T			0x6026
@@ -613,6 +619,15 @@
 /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */
 #define LUAT_PRODUCT_AIR720U			0x4e00
 
+/* MeiG Smart Technology products */
+#define MEIGSMART_VENDOR_ID			0x2dee
+/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */
+#define MEIGSMART_PRODUCT_SRM825L		0x4d22
+/* MeiG Smart SLM320 based on UNISOC UIS8910 */
+#define MEIGSMART_PRODUCT_SLM320		0x4d41
+/* MeiG Smart SLM770A based on ASR1803 */
+#define MEIGSMART_PRODUCT_SLM770A		0x4d57
+
 /* Device flags */
 
 /* Highest interface number which can be used with NCTRL() and RSVD() */
@@ -1213,6 +1228,18 @@
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) },
@@ -1247,7 +1274,10 @@
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG912Y, 0xff, 0, 0) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG916Q, 0xff, 0x00, 0x00) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0, 0) },
 
 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
@@ -1355,6 +1385,24 @@
 	  .driver_info = NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff),	/* Telit FE990 (ECM) */
 	  .driver_info = NCTRL(0) | RSVD(1) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff),	/* Telit FN20C04 (rmnet) */
+	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff),	/* Telit FN920C04 (MBIM) */
+	  .driver_info = NCTRL(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff),	/* Telit FN20C04 (rmnet) */
+	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff),	/* Telit FN920C04 (MBIM) */
+	  .driver_info = NCTRL(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff),	/* Telit FN20C04 (rmnet) */
+	  .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff),	/* Telit FN920C04 (MBIM) */
+	  .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff),	/* Telit FE910C04 (rmnet) */
+	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff),	/* Telit FE910C04 (rmnet) */
+	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff),	/* Telit FE910C04 (rmnet) */
+	  .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
@@ -1398,6 +1446,10 @@
 	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff),	/* Telit LN940 (MBIM) */
 	  .driver_info = NCTRL(0) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3000, 0xff),	/* Telit FN912 */
+	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3001, 0xff),	/* Telit FN912 */
+	  .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff),	/* Telit LE910-S1 (RNDIS) */
 	  .driver_info = NCTRL(2) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff),	/* Telit LE910-S1 (ECM) */
@@ -1406,6 +1458,8 @@
 	  .driver_info = NCTRL(2) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff),	/* Telit LE910R1 (ECM) */
 	  .driver_info = NCTRL(2) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x9000, 0xff),	/* Telit generic core-dump device */
+	  .driver_info = NCTRL(0) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, 0x9010),				/* Telit SBL FN980 flashing device */
 	  .driver_info = NCTRL(0) | ZLP },
 	{ USB_DEVICE(TELIT_VENDOR_ID, 0x9200),				/* Telit LE910S1 flashing device */
@@ -2047,6 +2101,10 @@
 	  .driver_info = RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff),
 	  .driver_info = RSVD(4) },
+	{ USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b05),	/* Longsung U8300 */
+	  .driver_info = RSVD(4) | RSVD(5) },
+	{ USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b3c),	/* Longsung U9300 */
+	  .driver_info = RSVD(0) | RSVD(4) },
 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
 	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
@@ -2193,6 +2251,12 @@
 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7106_2COM, 0x02, 0x02, 0x01) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7126, 0xff, 0x00, 0x00),
+	  .driver_info = NCTRL(2) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7127, 0xff, 0x00, 0x00),
+	  .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7129, 0xff, 0x00, 0x00),        /* MediaTek T7XX  */
+	  .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) },
 	{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
 	{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200),
 	  .driver_info = RSVD(1) | RSVD(4) },
@@ -2253,6 +2317,8 @@
 	  .driver_info = RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff),			/* Foxconn T99W373 MBIM */
 	  .driver_info = RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff),			/* Foxconn T99W651 RNDIS */
+	  .driver_info = RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 (IOT version) */
 	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x1782, 0x4d10) },						/* Fibocom L610 (AT mode) */
@@ -2267,21 +2333,87 @@
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) },	/* Fibocom FG150 Diag */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) },		/* Fibocom FG150 AT */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) },			/* Fibocom FM160 (MBIM mode) */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0xff, 0x30) },	/* Fibocom FG132 Diag */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0xff, 0x40) },	/* Fibocom FG132 AT */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0, 0) },		/* Fibocom FG132 NMEA */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0115, 0xff),			/* Fibocom FM135 (laptop MBIM) */
+	  .driver_info = RSVD(5) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) },			/* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff),			/* Fibocom FM101-GL (laptop MBIM) */
 	  .driver_info = RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a04, 0xff) },			/* Fibocom FM650-CN (ECM mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) },			/* Fibocom FM650-CN (NCM mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) },			/* Fibocom FM650-CN (RNDIS mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) },			/* Fibocom FM650-CN (MBIM mode) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
+	{ USB_DEVICE(0x33f8, 0x0104),						/* Rolling RW101-GL (laptop RMNET) */
+	  .driver_info = RSVD(4) | RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) },			/* Rolling RW101-GL (laptop MBIM) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) },			/* Rolling RW101-GL (laptop MBIM) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff),			/* Rolling RW101-GL (laptop MBIM) */
+	  .driver_info = RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff),			/* Rolling RW135-GL (laptop MBIM) */
+	  .driver_info = RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff),			/* Rolling RW350-GL (laptop MBIM) */
+	  .driver_info = RSVD(5) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for Global */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WRD for Global SKU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WRD for China SKU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for SA */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for EU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for NA */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for China EDU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for Golbal EDU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WRD for WWAN Ready */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for WWAN Ready */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WRD for WWAN Ready */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for WWAN Ready */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff),			/* TCL IK512 MBIM */
+	  .driver_info = NCTRL(1) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff),			/* TCL IK512 ECM */
+	  .driver_info = NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x2949, 0x8700, 0xff) },			/* Neoway N723-EA */
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
--- linux-qcom-6.8.0.orig/drivers/usb/serial/pl2303.c
+++ linux-qcom-6.8.0/drivers/usb/serial/pl2303.c
@@ -118,6 +118,7 @@
 	{ USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
 	{ USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) },
 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) },
+	{ USB_DEVICE(MACROSILICON_VENDOR_ID, MACROSILICON_MS3020_PRODUCT_ID) },
 	{ }					/* Terminating entry */
 };
 
--- linux-qcom-6.8.0.orig/drivers/usb/serial/pl2303.h
+++ linux-qcom-6.8.0/drivers/usb/serial/pl2303.h
@@ -171,3 +171,7 @@
 /* Allied Telesis VT-Kit3 */
 #define AT_VENDOR_ID		0x0caa
 #define AT_VTKIT3_PRODUCT_ID	0x3001
+
+/* Macrosilicon MS3020 */
+#define MACROSILICON_VENDOR_ID		0x345f
+#define MACROSILICON_MS3020_PRODUCT_ID	0x3020
--- linux-qcom-6.8.0.orig/drivers/usb/serial/qcserial.c
+++ linux-qcom-6.8.0/drivers/usb/serial/qcserial.c
@@ -166,6 +166,8 @@
 	{DEVICE_SWI(0x1199, 0x9090)},	/* Sierra Wireless EM7565 QDL */
 	{DEVICE_SWI(0x1199, 0x9091)},	/* Sierra Wireless EM7565 */
 	{DEVICE_SWI(0x1199, 0x90d2)},	/* Sierra Wireless EM9191 QDL */
+	{DEVICE_SWI(0x1199, 0x90e4)},	/* Sierra Wireless EM86xx QDL*/
+	{DEVICE_SWI(0x1199, 0x90e5)},	/* Sierra Wireless EM86xx */
 	{DEVICE_SWI(0x1199, 0xc080)},	/* Sierra Wireless EM7590 QDL */
 	{DEVICE_SWI(0x1199, 0xc081)},	/* Sierra Wireless EM7590 */
 	{DEVICE_SWI(0x413c, 0x81a2)},	/* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
--- linux-qcom-6.8.0.orig/drivers/usb/serial/quatech2.c
+++ linux-qcom-6.8.0/drivers/usb/serial/quatech2.c
@@ -503,7 +503,7 @@
 
 				newport = *(ch + 3);
 
-				if (newport > serial->num_ports) {
+				if (newport >= serial->num_ports) {
 					dev_err(&port->dev,
 						"%s - port change to invalid port: %i\n",
 						__func__, newport);
--- linux-qcom-6.8.0.orig/drivers/usb/serial/usb_debug.c
+++ linux-qcom-6.8.0/drivers/usb/serial/usb_debug.c
@@ -76,6 +76,11 @@
 	usb_serial_generic_process_read_urb(urb);
 }
 
+static void usb_debug_init_termios(struct tty_struct *tty)
+{
+	tty->termios.c_lflag &= ~(ECHO | ECHONL);
+}
+
 static struct usb_serial_driver debug_device = {
 	.driver = {
 		.owner =	THIS_MODULE,
@@ -85,6 +90,7 @@
 	.num_ports =		1,
 	.bulk_out_size =	USB_DEBUG_MAX_PACKET_SIZE,
 	.break_ctl =		usb_debug_break_ctl,
+	.init_termios =		usb_debug_init_termios,
 	.process_read_urb =	usb_debug_process_read_urb,
 };
 
@@ -96,6 +102,7 @@
 	.id_table =		dbc_id_table,
 	.num_ports =		1,
 	.break_ctl =		usb_debug_break_ctl,
+	.init_termios =		usb_debug_init_termios,
 	.process_read_urb =	usb_debug_process_read_urb,
 };
 
--- linux-qcom-6.8.0.orig/drivers/usb/storage/alauda.c
+++ linux-qcom-6.8.0/drivers/usb/storage/alauda.c
@@ -105,6 +105,8 @@
 	unsigned char sense_key;
 	unsigned long sense_asc;	/* additional sense code */
 	unsigned long sense_ascq;	/* additional sense code qualifier */
+
+	bool media_initialized;
 };
 
 #define short_pack(lsb,msb) ( ((u16)(lsb)) | ( ((u16)(msb))<<8 ) )
@@ -476,11 +478,12 @@
 	}
 
 	/* Check for media change */
-	if (status[0] & 0x08) {
+	if (status[0] & 0x08 || !info->media_initialized) {
 		usb_stor_dbg(us, "Media change detected\n");
 		alauda_free_maps(&MEDIA_INFO(us));
-		alauda_init_media(us);
-
+		rc = alauda_init_media(us);
+		if (rc == USB_STOR_TRANSPORT_GOOD)
+			info->media_initialized = true;
 		info->sense_key = UNIT_ATTENTION;
 		info->sense_asc = 0x28;
 		info->sense_ascq = 0x00;
--- linux-qcom-6.8.0.orig/drivers/usb/storage/uas.c
+++ linux-qcom-6.8.0/drivers/usb/storage/uas.c
@@ -422,6 +422,7 @@
 			uas_log_cmd_state(cmnd, "data cmplt err", status);
 		/* error: no data transfered */
 		scsi_set_resid(cmnd, sdb->length);
+		set_host_byte(cmnd, DID_ERROR);
 	} else {
 		scsi_set_resid(cmnd, sdb->length - urb->actual_length);
 	}
@@ -533,7 +534,7 @@
  * daft to me.
  */
 
-static struct urb *uas_submit_sense_urb(struct scsi_cmnd *cmnd, gfp_t gfp)
+static int uas_submit_sense_urb(struct scsi_cmnd *cmnd, gfp_t gfp)
 {
 	struct uas_dev_info *devinfo = cmnd->device->hostdata;
 	struct urb *urb;
@@ -541,30 +542,28 @@
 
 	urb = uas_alloc_sense_urb(devinfo, gfp, cmnd);
 	if (!urb)
-		return NULL;
+		return -ENOMEM;
 	usb_anchor_urb(urb, &devinfo->sense_urbs);
 	err = usb_submit_urb(urb, gfp);
 	if (err) {
 		usb_unanchor_urb(urb);
 		uas_log_cmd_state(cmnd, "sense submit err", err);
 		usb_free_urb(urb);
-		return NULL;
 	}
-	return urb;
+	return err;
 }
 
 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
 			   struct uas_dev_info *devinfo)
 {
 	struct uas_cmd_info *cmdinfo = scsi_cmd_priv(cmnd);
-	struct urb *urb;
 	int err;
 
 	lockdep_assert_held(&devinfo->lock);
 	if (cmdinfo->state & SUBMIT_STATUS_URB) {
-		urb = uas_submit_sense_urb(cmnd, GFP_ATOMIC);
-		if (!urb)
-			return SCSI_MLQUEUE_DEVICE_BUSY;
+		err = uas_submit_sense_urb(cmnd, GFP_ATOMIC);
+		if (err)
+			return err;
 		cmdinfo->state &= ~SUBMIT_STATUS_URB;
 	}
 
@@ -572,7 +571,7 @@
 		cmdinfo->data_in_urb = uas_alloc_data_urb(devinfo, GFP_ATOMIC,
 							cmnd, DMA_FROM_DEVICE);
 		if (!cmdinfo->data_in_urb)
-			return SCSI_MLQUEUE_DEVICE_BUSY;
+			return -ENOMEM;
 		cmdinfo->state &= ~ALLOC_DATA_IN_URB;
 	}
 
@@ -582,7 +581,7 @@
 		if (err) {
 			usb_unanchor_urb(cmdinfo->data_in_urb);
 			uas_log_cmd_state(cmnd, "data in submit err", err);
-			return SCSI_MLQUEUE_DEVICE_BUSY;
+			return err;
 		}
 		cmdinfo->state &= ~SUBMIT_DATA_IN_URB;
 		cmdinfo->state |= DATA_IN_URB_INFLIGHT;
@@ -592,7 +591,7 @@
 		cmdinfo->data_out_urb = uas_alloc_data_urb(devinfo, GFP_ATOMIC,
 							cmnd, DMA_TO_DEVICE);
 		if (!cmdinfo->data_out_urb)
-			return SCSI_MLQUEUE_DEVICE_BUSY;
+			return -ENOMEM;
 		cmdinfo->state &= ~ALLOC_DATA_OUT_URB;
 	}
 
@@ -602,7 +601,7 @@
 		if (err) {
 			usb_unanchor_urb(cmdinfo->data_out_urb);
 			uas_log_cmd_state(cmnd, "data out submit err", err);
-			return SCSI_MLQUEUE_DEVICE_BUSY;
+			return err;
 		}
 		cmdinfo->state &= ~SUBMIT_DATA_OUT_URB;
 		cmdinfo->state |= DATA_OUT_URB_INFLIGHT;
@@ -611,7 +610,7 @@
 	if (cmdinfo->state & ALLOC_CMD_URB) {
 		cmdinfo->cmd_urb = uas_alloc_cmd_urb(devinfo, GFP_ATOMIC, cmnd);
 		if (!cmdinfo->cmd_urb)
-			return SCSI_MLQUEUE_DEVICE_BUSY;
+			return -ENOMEM;
 		cmdinfo->state &= ~ALLOC_CMD_URB;
 	}
 
@@ -621,7 +620,7 @@
 		if (err) {
 			usb_unanchor_urb(cmdinfo->cmd_urb);
 			uas_log_cmd_state(cmnd, "cmd submit err", err);
-			return SCSI_MLQUEUE_DEVICE_BUSY;
+			return err;
 		}
 		cmdinfo->cmd_urb = NULL;
 		cmdinfo->state &= ~SUBMIT_CMD_URB;
@@ -698,7 +697,7 @@
 	 * of queueing, no matter how fatal the error
 	 */
 	if (err == -ENODEV) {
-		set_host_byte(cmnd, DID_ERROR);
+		set_host_byte(cmnd, DID_NO_CONNECT);
 		scsi_done(cmnd);
 		goto zombie;
 	}
--- linux-qcom-6.8.0.orig/drivers/usb/storage/unusual_devs.h
+++ linux-qcom-6.8.0/drivers/usb/storage/unusual_devs.h
@@ -255,6 +255,13 @@
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_MAX_SECTORS_64 ),
 
+/* Added by Lubomir Rintel <lkundrak@v3.sk>, a very fine chap */
+UNUSUAL_DEV(  0x0421, 0x06c2, 0x0000, 0x0406,
+		"Nokia",
+		"Nokia 208",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_MAX_SECTORS_64 ),
+
 #ifdef NO_SDDR09
 UNUSUAL_DEV(  0x0436, 0x0005, 0x0100, 0x0100,
 		"Microtech",
@@ -1359,6 +1366,13 @@
 		USB_SC_DEVICE, USB_PR_DEVICE, option_ms_init,
 		0),
 
+/* Reported by Timo Aaltonen <tjaalton@ubuntu.com> */
+UNUSUAL_DEV( 0x0af0, 0x7011, 0x0000, 0x9999,
+		"Option",
+		"Mass Storage",
+		USB_SC_DEVICE, USB_PR_DEVICE, option_ms_init,
+		0 ),
+
 /*
  * Reported by F. Aben <f.aben@option.com>
  * This device (wrongly) has a vendor-specific device descriptor.
@@ -2423,6 +2437,17 @@
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_NOT_LOCKABLE),
 
+/*
+ * Reported by Icenowy Zheng <uwu@icenowy.me>
+ * This is an interface for vendor-specific cryptic commands instead
+ * of real USB storage device.
+ */
+UNUSUAL_DEV(  0xe5b7, 0x0811, 0x0100, 0x0100,
+		"ZhuHai JieLi Technology",
+		"JieLi BR21",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_IGNORE_DEVICE),
+
 /* Reported by Andrew Simmons <andrew.simmons@gmail.com> */
 UNUSUAL_DEV(  0xed06, 0x4500, 0x0001, 0x0001,
 		"DataStor",
--- linux-qcom-6.8.0.orig/drivers/usb/typec/anx7411.c
+++ linux-qcom-6.8.0/drivers/usb/typec/anx7411.c
@@ -289,6 +289,8 @@
 	struct power_supply *psy;
 	struct power_supply_desc psy_desc;
 	struct device *dev;
+	struct fwnode_handle *switch_node;
+	struct fwnode_handle *mux_node;
 };
 
 static u8 snk_identity[] = {
@@ -1020,6 +1022,16 @@
 		}
 }
 
+static void anx7411_port_unregister(struct typec_params *typecp)
+{
+	fwnode_handle_put(typecp->caps.fwnode);
+	anx7411_port_unregister_altmodes(typecp->port_amode);
+	if (typecp->port)
+		typec_unregister_port(typecp->port);
+	if (typecp->role_sw)
+		usb_role_switch_put(typecp->role_sw);
+}
+
 static int anx7411_usb_mux_set(struct typec_mux_dev *mux,
 			       struct typec_mux_state *state)
 {
@@ -1088,6 +1100,7 @@
 	if (ctx->typec.typec_mux) {
 		typec_mux_unregister(ctx->typec.typec_mux);
 		ctx->typec.typec_mux = NULL;
+		fwnode_handle_put(ctx->mux_node);
 	}
 }
 
@@ -1096,6 +1109,7 @@
 	if (ctx->typec.typec_switch) {
 		typec_switch_unregister(ctx->typec.typec_switch);
 		ctx->typec.typec_switch = NULL;
+		fwnode_handle_put(ctx->switch_node);
 	}
 }
 
@@ -1103,28 +1117,29 @@
 				      struct device *dev)
 {
 	int ret;
-	struct device_node *node;
 
-	node = of_get_child_by_name(dev->of_node, "orientation_switch");
-	if (!node)
+	ctx->switch_node = device_get_named_child_node(dev, "orientation_switch");
+	if (!ctx->switch_node)
 		return 0;
 
-	ret = anx7411_register_switch(ctx, dev, &node->fwnode);
+	ret = anx7411_register_switch(ctx, dev, ctx->switch_node);
 	if (ret) {
 		dev_err(dev, "failed register switch");
+		fwnode_handle_put(ctx->switch_node);
 		return ret;
 	}
 
-	node = of_get_child_by_name(dev->of_node, "mode_switch");
-	if (!node) {
+	ctx->mux_node = device_get_named_child_node(dev, "mode_switch");
+	if (!ctx->mux_node) {
 		dev_err(dev, "no typec mux exist");
 		ret = -ENODEV;
 		goto unregister_switch;
 	}
 
-	ret = anx7411_register_mux(ctx, dev, &node->fwnode);
+	ret = anx7411_register_mux(ctx, dev, ctx->mux_node);
 	if (ret) {
 		dev_err(dev, "failed register mode switch");
+		fwnode_handle_put(ctx->mux_node);
 		ret = -ENODEV;
 		goto unregister_switch;
 	}
@@ -1153,34 +1168,34 @@
 	ret = fwnode_property_read_string(fwnode, "power-role", &buf);
 	if (ret) {
 		dev_err(dev, "power-role not found: %d\n", ret);
-		return ret;
+		goto put_fwnode;
 	}
 
 	ret = typec_find_port_power_role(buf);
 	if (ret < 0)
-		return ret;
+		goto put_fwnode;
 	cap->type = ret;
 
 	ret = fwnode_property_read_string(fwnode, "data-role", &buf);
 	if (ret) {
 		dev_err(dev, "data-role not found: %d\n", ret);
-		return ret;
+		goto put_fwnode;
 	}
 
 	ret = typec_find_port_data_role(buf);
 	if (ret < 0)
-		return ret;
+		goto put_fwnode;
 	cap->data = ret;
 
 	ret = fwnode_property_read_string(fwnode, "try-power-role", &buf);
 	if (ret) {
 		dev_err(dev, "try-power-role not found: %d\n", ret);
-		return ret;
+		goto put_fwnode;
 	}
 
 	ret = typec_find_power_role(buf);
 	if (ret < 0)
-		return ret;
+		goto put_fwnode;
 	cap->prefer_role = ret;
 
 	/* Get source pdos */
@@ -1192,7 +1207,7 @@
 						     typecp->src_pdo_nr);
 		if (ret < 0) {
 			dev_err(dev, "source cap validate failed: %d\n", ret);
-			return -EINVAL;
+			goto put_fwnode;
 		}
 
 		typecp->caps_flags |= HAS_SOURCE_CAP;
@@ -1206,7 +1221,7 @@
 						     typecp->sink_pdo_nr);
 		if (ret < 0) {
 			dev_err(dev, "sink cap validate failed: %d\n", ret);
-			return -EINVAL;
+			goto put_fwnode;
 		}
 
 		for (i = 0; i < typecp->sink_pdo_nr; i++) {
@@ -1250,13 +1265,21 @@
 		ret = PTR_ERR(ctx->typec.port);
 		ctx->typec.port = NULL;
 		dev_err(dev, "Failed to register type c port %d\n", ret);
-		return ret;
+		goto put_usb_role_switch;
 	}
 
 	typec_port_register_altmodes(ctx->typec.port, NULL, ctx,
 				     ctx->typec.port_amode,
 				     MAX_ALTMODE);
 	return 0;
+
+put_usb_role_switch:
+	if (ctx->typec.role_sw)
+		usb_role_switch_put(ctx->typec.role_sw);
+put_fwnode:
+	fwnode_handle_put(fwnode);
+
+	return ret;
 }
 
 static int anx7411_typec_check_connection(struct anx7411_data *ctx)
@@ -1527,8 +1550,7 @@
 	destroy_workqueue(plat->workqueue);
 
 free_typec_port:
-	typec_unregister_port(plat->typec.port);
-	anx7411_port_unregister_altmodes(plat->typec.port_amode);
+	anx7411_port_unregister(&plat->typec);
 
 free_typec_switch:
 	anx7411_unregister_switch(plat);
@@ -1552,17 +1574,11 @@
 
 	i2c_unregister_device(plat->spi_client);
 
-	if (plat->typec.role_sw)
-		usb_role_switch_put(plat->typec.role_sw);
-
 	anx7411_unregister_mux(plat);
 
 	anx7411_unregister_switch(plat);
 
-	if (plat->typec.port)
-		typec_unregister_port(plat->typec.port);
-
-	anx7411_port_unregister_altmodes(plat->typec.port_amode);
+	anx7411_port_unregister(&plat->typec);
 }
 
 static const struct i2c_device_id anx7411_id[] = {
--- linux-qcom-6.8.0.orig/drivers/usb/typec/class.c
+++ linux-qcom-6.8.0/drivers/usb/typec/class.c
@@ -503,6 +503,7 @@
 		typec_altmode_put_partner(alt);
 
 	altmode_id_remove(alt->adev.dev.parent, alt->id);
+	put_device(alt->adev.dev.parent);
 	kfree(alt);
 }
 
@@ -552,6 +553,8 @@
 	alt->adev.dev.type = &typec_altmode_dev_type;
 	dev_set_name(&alt->adev.dev, "%s.%u", dev_name(parent), id);
 
+	get_device(alt->adev.dev.parent);
+
 	/* Link partners and plugs with the ports */
 	if (!is_port)
 		typec_altmode_set_partner(alt);
@@ -1310,6 +1313,7 @@
 {
 	struct typec_port *port = to_typec_port(dev);
 	struct usb_power_delivery *pd;
+	int ret;
 
 	if (!port->ops || !port->ops->pd_set)
 		return -EOPNOTSUPP;
@@ -1318,7 +1322,11 @@
 	if (!pd)
 		return -EINVAL;
 
-	return port->ops->pd_set(port, pd);
+	ret = port->ops->pd_set(port, pd);
+	if (ret)
+		return ret;
+
+	return size;
 }
 
 static ssize_t select_usb_power_delivery_show(struct device *dev,
@@ -2229,7 +2237,7 @@
 	const struct typec_altmode_ops *ops, void *drvdata,
 	struct typec_altmode **altmodes, size_t n)
 {
-	struct fwnode_handle *altmodes_node, *child;
+	struct fwnode_handle *child;
 	struct typec_altmode_desc desc;
 	struct typec_altmode *alt;
 	size_t index = 0;
@@ -2237,7 +2245,9 @@
 	u32 vdo;
 	int ret;
 
-	altmodes_node = device_get_named_child_node(&port->dev, "altmodes");
+	struct fwnode_handle *altmodes_node  __free(fwnode_handle) =
+		device_get_named_child_node(&port->dev, "altmodes");
+
 	if (!altmodes_node)
 		return; /* No altmodes specified */
 
@@ -2277,6 +2287,7 @@
 		altmodes[index] = alt;
 		index++;
 	}
+	fwnode_handle_put(altmodes_node);
 }
 EXPORT_SYMBOL_GPL(typec_port_register_altmodes);
 
--- linux-qcom-6.8.0.orig/drivers/usb/typec/mux/nb7vpq904m.c
+++ linux-qcom-6.8.0/drivers/usb/typec/mux/nb7vpq904m.c
@@ -413,7 +413,7 @@
 
 	ret = nb7vpq904m_parse_data_lanes_mapping(nb7);
 	if (ret)
-		return ret;
+		goto err_switch_put;
 
 	ret = regulator_enable(nb7->vcc_supply);
 	if (ret)
@@ -456,6 +456,9 @@
 	gpiod_set_value(nb7->enable_gpio, 0);
 	regulator_disable(nb7->vcc_supply);
 
+err_switch_put:
+	typec_switch_put(nb7->typec_switch);
+
 	return ret;
 }
 
@@ -469,6 +472,8 @@
 	gpiod_set_value(nb7->enable_gpio, 0);
 
 	regulator_disable(nb7->vcc_supply);
+
+	typec_switch_put(nb7->typec_switch);
 }
 
 static const struct i2c_device_id nb7vpq904m_table[] = {
--- linux-qcom-6.8.0.orig/drivers/usb/typec/mux/ptn36502.c
+++ linux-qcom-6.8.0/drivers/usb/typec/mux/ptn36502.c
@@ -362,8 +362,10 @@
 				     "Failed to acquire orientation-switch\n");
 
 	ret = regulator_enable(ptn->vdd18_supply);
-	if (ret)
-		return dev_err_probe(dev, ret, "Failed to enable vdd18\n");
+	if (ret) {
+		ret = dev_err_probe(dev, ret, "Failed to enable vdd18\n");
+		goto err_switch_put;
+	}
 
 	ret = ptn36502_detect(ptn);
 	if (ret)
@@ -403,6 +405,9 @@
 err_disable_regulator:
 	regulator_disable(ptn->vdd18_supply);
 
+err_switch_put:
+	typec_switch_put(ptn->typec_switch);
+
 	return ret;
 }
 
@@ -414,6 +419,8 @@
 	typec_switch_unregister(ptn->sw);
 
 	regulator_disable(ptn->vdd18_supply);
+
+	typec_switch_put(ptn->typec_switch);
 }
 
 static const struct i2c_device_id ptn36502_table[] = {
--- linux-qcom-6.8.0.orig/drivers/usb/typec/tcpm/maxim_contaminant.c
+++ linux-qcom-6.8.0/drivers/usb/typec/tcpm/maxim_contaminant.c
@@ -137,7 +137,7 @@
 
 		mv = max_contaminant_read_adc_mv(chip, channel, sleep_msec, raw, true);
 		if (mv < 0)
-			return ret;
+			return mv;
 
 		/* OVP enable */
 		ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL2, CCOVPDIS, 0);
@@ -159,7 +159,7 @@
 
 	mv = max_contaminant_read_adc_mv(chip, channel, sleep_msec, raw, true);
 	if (mv < 0)
-		return ret;
+		return mv;
 	/* Disable current source */
 	ret = regmap_update_bits(regmap, TCPC_VENDOR_CC_CTRL2, SBURPCTRL, 0);
 	if (ret < 0)
--- linux-qcom-6.8.0.orig/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
+++ linux-qcom-6.8.0/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
@@ -217,8 +217,10 @@
 		return -EINVAL;
 
 	bridge_dev = drm_dp_hpd_bridge_register(tcpm->dev, to_of_node(tcpm->tcpc.fwnode));
-	if (IS_ERR(bridge_dev))
-		return PTR_ERR(bridge_dev);
+	if (IS_ERR(bridge_dev)) {
+		ret = PTR_ERR(bridge_dev);
+		goto fwnode_remove;
+	}
 
 	tcpm->tcpm_port = tcpm_register_port(tcpm->dev, &tcpm->tcpc);
 	if (IS_ERR(tcpm->tcpm_port)) {
@@ -239,7 +241,7 @@
 	return 0;
 
 fwnode_remove:
-	fwnode_remove_software_node(tcpm->tcpc.fwnode);
+	fwnode_handle_put(tcpm->tcpc.fwnode);
 
 	return ret;
 }
@@ -251,7 +253,7 @@
 	qcom_pmic_typec_pdphy_stop(tcpm->pmic_typec_pdphy);
 	qcom_pmic_typec_port_stop(tcpm->pmic_typec_port);
 	tcpm_unregister_port(tcpm->tcpm_port);
-	fwnode_remove_software_node(tcpm->tcpc.fwnode);
+	fwnode_handle_put(tcpm->tcpc.fwnode);
 }
 
 static struct pmic_typec_pdphy_resources pm8150b_pdphy_res = {
--- linux-qcom-6.8.0.orig/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c
+++ linux-qcom-6.8.0/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c
@@ -161,6 +161,10 @@
 
 	spin_lock_irqsave(&pmic_typec_pdphy->lock, flags);
 
+	hdr_len = sizeof(msg->header);
+	txbuf_len = pd_header_cnt_le(msg->header) * 4;
+	txsize_len = hdr_len + txbuf_len - 1;
+
 	ret = regmap_read(pmic_typec_pdphy->regmap,
 			  pmic_typec_pdphy->base + USB_PDPHY_RX_ACKNOWLEDGE_REG,
 			  &val);
@@ -178,10 +182,6 @@
 	if (ret)
 		goto done;
 
-	hdr_len = sizeof(msg->header);
-	txbuf_len = pd_header_cnt_le(msg->header) * 4;
-	txsize_len = hdr_len + txbuf_len - 1;
-
 	/* Write message header sizeof(u16) to USB_PDPHY_TX_BUFFER_HDR_REG */
 	ret = regmap_bulk_write(pmic_typec_pdphy->regmap,
 				pmic_typec_pdphy->base + USB_PDPHY_TX_BUFFER_HDR_REG,
--- linux-qcom-6.8.0.orig/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+++ linux-qcom-6.8.0/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
@@ -252,7 +252,6 @@
 			val = TYPEC_CC_RP_DEF;
 			break;
 		}
-		val = TYPEC_CC_RP_DEF;
 	}
 
 	if (misc & CC_ORIENTATION)
--- linux-qcom-6.8.0.orig/drivers/usb/typec/tcpm/tcpci.c
+++ linux-qcom-6.8.0/drivers/usb/typec/tcpm/tcpci.c
@@ -889,6 +889,7 @@
 #ifdef CONFIG_OF
 static const struct of_device_id tcpci_of_match[] = {
 	{ .compatible = "nxp,ptn5110", },
+	{ .compatible = "tcpci", },
 	{},
 };
 MODULE_DEVICE_TABLE(of, tcpci_of_match);
--- linux-qcom-6.8.0.orig/drivers/usb/typec/tcpm/tcpm.c
+++ linux-qcom-6.8.0/drivers/usb/typec/tcpm/tcpm.c
@@ -1501,7 +1501,8 @@
 	port->partner_ident.cert_stat = p[VDO_INDEX_CSTAT];
 	port->partner_ident.product = product;
 
-	typec_partner_set_identity(port->partner);
+	if (port->partner)
+		typec_partner_set_identity(port->partner);
 
 	tcpm_log(port, "Identity: %04x:%04x.%04x",
 		 PD_IDH_VID(vdo),
@@ -1589,6 +1590,9 @@
 	struct typec_altmode *altmode;
 	int i;
 
+	if (!port->partner)
+		return;
+
 	for (i = 0; i < modep->altmodes; i++) {
 		altmode = typec_partner_register_altmode(port->partner,
 						&modep->altmode_desc[i]);
@@ -2412,7 +2416,7 @@
 {
 	struct usb_power_delivery_desc desc = { port->negotiated_rev };
 	struct usb_power_delivery_capabilities_desc caps = { };
-	struct usb_power_delivery_capabilities *cap;
+	struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
 
 	if (!port->partner_pd)
 		port->partner_pd = usb_power_delivery_register(NULL, &desc);
@@ -2422,6 +2426,11 @@
 	memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
 	caps.role = TYPEC_SOURCE;
 
+	if (cap) {
+		usb_power_delivery_unregister_capabilities(cap);
+		port->partner_source_caps = NULL;
+	}
+
 	cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
 	if (IS_ERR(cap))
 		return PTR_ERR(cap);
@@ -3584,7 +3593,10 @@
 
 static void tcpm_typec_connect(struct tcpm_port *port)
 {
+	struct typec_partner *partner;
+
 	if (!port->connected) {
+		port->connected = true;
 		/* Make sure we don't report stale identity information */
 		memset(&port->partner_ident, 0, sizeof(port->partner_ident));
 		port->partner_desc.usb_pd = port->pd_capable;
@@ -3594,9 +3606,13 @@
 			port->partner_desc.accessory = TYPEC_ACCESSORY_AUDIO;
 		else
 			port->partner_desc.accessory = TYPEC_ACCESSORY_NONE;
-		port->partner = typec_register_partner(port->typec_port,
-						       &port->partner_desc);
-		port->connected = true;
+		partner = typec_register_partner(port->typec_port, &port->partner_desc);
+		if (IS_ERR(partner)) {
+			dev_err(port->dev, "Failed to register partner (%ld)\n", PTR_ERR(partner));
+			return;
+		}
+
+		port->partner = partner;
 		typec_partner_set_usb_power_delivery(port->partner, port->partner_pd);
 	}
 }
@@ -3666,9 +3682,11 @@
 static void tcpm_typec_disconnect(struct tcpm_port *port)
 {
 	if (port->connected) {
-		typec_partner_set_usb_power_delivery(port->partner, NULL);
-		typec_unregister_partner(port->partner);
-		port->partner = NULL;
+		if (port->partner) {
+			typec_partner_set_usb_power_delivery(port->partner, NULL);
+			typec_unregister_partner(port->partner);
+			port->partner = NULL;
+		}
 		port->connected = false;
 	}
 }
@@ -3884,6 +3902,9 @@
 
 static void tcpm_set_initial_svdm_version(struct tcpm_port *port)
 {
+	if (!port->partner)
+		return;
+
 	switch (port->negotiated_rev) {
 	case PD_REV30:
 		break;
@@ -5407,6 +5428,7 @@
 		port->tcpc->set_bist_data(port->tcpc, false);
 
 	switch (port->state) {
+	case TOGGLING:
 	case ERROR_RECOVERY:
 	case PORT_RESET:
 	case PORT_RESET_WAIT_OFF:
@@ -6111,14 +6133,14 @@
 	if (data->sink_desc.pdo[0]) {
 		for (i = 0; i < PDO_MAX_OBJECTS && data->sink_desc.pdo[i]; i++)
 			port->snk_pdo[i] = data->sink_desc.pdo[i];
-		port->nr_snk_pdo = i + 1;
+		port->nr_snk_pdo = i;
 		port->operating_snk_mw = data->operating_snk_mw;
 	}
 
 	if (data->source_desc.pdo[0]) {
 		for (i = 0; i < PDO_MAX_OBJECTS && data->source_desc.pdo[i]; i++)
-			port->snk_pdo[i] = data->source_desc.pdo[i];
-		port->nr_src_pdo = i + 1;
+			port->src_pdo[i] = data->source_desc.pdo[i];
+		port->nr_src_pdo = i;
 	}
 
 	switch (port->state) {
@@ -6166,7 +6188,9 @@
 
 	port->port_source_caps = data->source_cap;
 	port->port_sink_caps = data->sink_cap;
+	typec_port_set_usb_power_delivery(p, NULL);
 	port->selected_pd = pd;
+	typec_port_set_usb_power_delivery(p, port->selected_pd);
 unlock:
 	mutex_unlock(&port->lock);
 	return ret;
@@ -6199,9 +6223,7 @@
 	port->port_source_caps = NULL;
 	for (i = 0; i < port->pd_count; i++) {
 		usb_power_delivery_unregister_capabilities(port->pd_list[i]->sink_cap);
-		kfree(port->pd_list[i]->sink_cap);
 		usb_power_delivery_unregister_capabilities(port->pd_list[i]->source_cap);
-		kfree(port->pd_list[i]->source_cap);
 		devm_kfree(port->dev, port->pd_list[i]);
 		port->pd_list[i] = NULL;
 		usb_power_delivery_unregister(port->pds[i]);
--- linux-qcom-6.8.0.orig/drivers/usb/typec/tcpm/wcove.c
+++ linux-qcom-6.8.0/drivers/usb/typec/tcpm/wcove.c
@@ -621,10 +621,6 @@
 	if (irq < 0)
 		return irq;
 
-	irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq);
-	if (irq < 0)
-		return irq;
-
 	ret = guid_parse(WCOVE_DSM_UUID, &wcove->guid);
 	if (ret)
 		return ret;
--- linux-qcom-6.8.0.orig/drivers/usb/typec/tipd/core.c
+++ linux-qcom-6.8.0/drivers/usb/typec/tipd/core.c
@@ -28,6 +28,7 @@
 #define TPS_REG_MODE			0x03
 #define TPS_REG_CMD1			0x08
 #define TPS_REG_DATA1			0x09
+#define TPS_REG_VERSION			0x0F
 #define TPS_REG_INT_EVENT1		0x14
 #define TPS_REG_INT_EVENT2		0x15
 #define TPS_REG_INT_MASK1		0x16
@@ -604,11 +605,11 @@
 	if (!tps6598x_read_status(tps, &status))
 		goto err_clear_ints;
 
-	if ((event[0] | event[1]) & TPS_REG_INT_POWER_STATUS_UPDATE)
+	if (event[0] & TPS_REG_INT_POWER_STATUS_UPDATE)
 		if (!tps6598x_read_power_status(tps))
 			goto err_clear_ints;
 
-	if ((event[0] | event[1]) & TPS_REG_INT_DATA_STATUS_UPDATE)
+	if (event[0] & TPS_REG_INT_DATA_STATUS_UPDATE)
 		if (!tps6598x_read_data_status(tps))
 			goto err_clear_ints;
 
@@ -617,7 +618,7 @@
 	 * a plug event. Therefore, we need to check
 	 * for pr/dr status change to set TypeC dr/pr accordingly.
 	 */
-	if ((event[0] | event[1]) & TPS_REG_INT_PLUG_EVENT ||
+	if (event[0] & TPS_REG_INT_PLUG_EVENT ||
 	    tps6598x_has_role_changed(tps, status))
 		tps6598x_handle_plug_event(tps, status);
 
@@ -636,49 +637,67 @@
 
 static irqreturn_t tps6598x_interrupt(int irq, void *data)
 {
+	int intev_len = TPS_65981_2_6_INTEVENT_LEN;
 	struct tps6598x *tps = data;
-	u64 event1 = 0;
-	u64 event2 = 0;
+	u64 event1[2] = { };
+	u64 event2[2] = { };
+	u32 version;
 	u32 status;
 	int ret;
 
 	mutex_lock(&tps->lock);
 
-	ret = tps6598x_read64(tps, TPS_REG_INT_EVENT1, &event1);
-	ret |= tps6598x_read64(tps, TPS_REG_INT_EVENT2, &event2);
+	ret = tps6598x_read32(tps, TPS_REG_VERSION, &version);
+	if (ret)
+		dev_warn(tps->dev, "%s: failed to read version (%d)\n",
+			 __func__, ret);
+
+	if (TPS_VERSION_HW_VERSION(version) == TPS_VERSION_HW_65987_8_DH ||
+	    TPS_VERSION_HW_VERSION(version) == TPS_VERSION_HW_65987_8_DK)
+		intev_len = TPS_65987_8_INTEVENT_LEN;
+
+	ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT1, event1, intev_len);
+
+	ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT1, event1, intev_len);
 	if (ret) {
-		dev_err(tps->dev, "%s: failed to read events\n", __func__);
+		dev_err(tps->dev, "%s: failed to read event1\n", __func__);
 		goto err_unlock;
 	}
-	trace_tps6598x_irq(event1, event2);
+	ret = tps6598x_block_read(tps, TPS_REG_INT_EVENT2, event2, intev_len);
+	if (ret) {
+		dev_err(tps->dev, "%s: failed to read event2\n", __func__);
+		goto err_unlock;
+	}
+	trace_tps6598x_irq(event1[0], event2[0]);
 
-	if (!(event1 | event2))
+	if (!(event1[0] | event1[1] | event2[0] | event2[1]))
 		goto err_unlock;
 
 	if (!tps6598x_read_status(tps, &status))
 		goto err_clear_ints;
 
-	if ((event1 | event2) & TPS_REG_INT_POWER_STATUS_UPDATE)
+	if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
 		if (!tps6598x_read_power_status(tps))
 			goto err_clear_ints;
 
-	if ((event1 | event2) & TPS_REG_INT_DATA_STATUS_UPDATE)
+	if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE)
 		if (!tps6598x_read_data_status(tps))
 			goto err_clear_ints;
 
 	/* Handle plug insert or removal */
-	if ((event1 | event2) & TPS_REG_INT_PLUG_EVENT)
+	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT)
 		tps6598x_handle_plug_event(tps, status);
 
 err_clear_ints:
-	tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event1);
-	tps6598x_write64(tps, TPS_REG_INT_CLEAR2, event2);
+	tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len);
+	tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len);
 
 err_unlock:
 	mutex_unlock(&tps->lock);
 
-	if (event1 | event2)
+	if (event1[0] | event1[1] | event2[0] | event2[1])
 		return IRQ_HANDLED;
+
 	return IRQ_NONE;
 }
 
@@ -1458,8 +1477,9 @@
 
 	if (!client->irq)
 		cancel_delayed_work_sync(&tps->wq_poll);
+	else
+		devm_free_irq(tps->dev, client->irq, tps);
 
-	devm_free_irq(tps->dev, client->irq, tps);
 	tps6598x_disconnect(tps, 0);
 	typec_unregister_port(tps->port);
 	usb_role_switch_put(tps->role_sw);
--- linux-qcom-6.8.0.orig/drivers/usb/typec/tipd/tps6598x.h
+++ linux-qcom-6.8.0/drivers/usb/typec/tipd/tps6598x.h
@@ -253,4 +253,15 @@
 #define TPS_PTCC_DEV				2
 #define TPS_PTCC_APP				3
 
+/* Version Register */
+#define TPS_VERSION_HW_VERSION_MASK            GENMASK(31, 24)
+#define TPS_VERSION_HW_VERSION(x)              TPS_FIELD_GET(TPS_VERSION_HW_VERSION_MASK, (x))
+#define TPS_VERSION_HW_65981_2_6               0x00
+#define TPS_VERSION_HW_65987_8_DH              0xF7
+#define TPS_VERSION_HW_65987_8_DK              0xF9
+
+/* Int Event Register length */
+#define TPS_65981_2_6_INTEVENT_LEN             8
+#define TPS_65987_8_INTEVENT_LEN               11
+
 #endif /* __TPS6598X_H__ */
--- linux-qcom-6.8.0.orig/drivers/usb/typec/ucsi/Makefile
+++ linux-qcom-6.8.0/drivers/usb/typec/ucsi/Makefile
@@ -21,3 +21,4 @@
 obj-$(CONFIG_UCSI_CCG)			+= ucsi_ccg.o
 obj-$(CONFIG_UCSI_STM32G0)		+= ucsi_stm32g0.o
 obj-$(CONFIG_UCSI_PMIC_GLINK)		+= ucsi_glink.o
+CFLAGS_ucsi_glink.o			:= -I$(src)
--- linux-qcom-6.8.0.orig/drivers/usb/typec/ucsi/displayport.c
+++ linux-qcom-6.8.0/drivers/usb/typec/ucsi/displayport.c
@@ -275,8 +275,6 @@
 	struct ucsi_dp *dp = container_of(work, struct ucsi_dp, work);
 	int ret;
 
-	mutex_lock(&dp->con->lock);
-
 	ret = typec_altmode_vdm(dp->alt, dp->header,
 				dp->vdo_data, dp->vdo_size);
 	if (ret)
@@ -285,8 +283,6 @@
 	dp->vdo_data = NULL;
 	dp->vdo_size = 0;
 	dp->header = 0;
-
-	mutex_unlock(&dp->con->lock);
 }
 
 void ucsi_displayport_remove_partner(struct typec_altmode *alt)
--- linux-qcom-6.8.0.orig/drivers/usb/typec/ucsi/ucsi.c
+++ linux-qcom-6.8.0/drivers/usb/typec/ucsi/ucsi.c
@@ -36,22 +36,29 @@
  */
 #define UCSI_SWAP_TIMEOUT_MS	5000
 
-static int ucsi_acknowledge_command(struct ucsi *ucsi)
+static int ucsi_read_message_in(struct ucsi *ucsi, void *buf,
+					  size_t buf_size)
 {
-	u64 ctrl;
-
-	ctrl = UCSI_ACK_CC_CI;
-	ctrl |= UCSI_ACK_COMMAND_COMPLETE;
+	/*
+	 * Below UCSI 2.0, MESSAGE_IN was limited to 16 bytes. Truncate the
+	 * reads here.
+	 */
+	if (ucsi->version <= UCSI_VERSION_1_2)
+		buf_size = clamp(buf_size, 0, 16);
 
-	return ucsi->ops->sync_write(ucsi, UCSI_CONTROL, &ctrl, sizeof(ctrl));
+	return ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, buf, buf_size);
 }
 
-static int ucsi_acknowledge_connector_change(struct ucsi *ucsi)
+static int ucsi_acknowledge(struct ucsi *ucsi, bool conn_ack)
 {
 	u64 ctrl;
 
 	ctrl = UCSI_ACK_CC_CI;
-	ctrl |= UCSI_ACK_CONNECTOR_CHANGE;
+	ctrl |= UCSI_ACK_COMMAND_COMPLETE;
+	if (conn_ack) {
+		clear_bit(EVENT_PENDING, &ucsi->flags);
+		ctrl |= UCSI_ACK_CONNECTOR_CHANGE;
+	}
 
 	return ucsi->ops->sync_write(ucsi, UCSI_CONTROL, &ctrl, sizeof(ctrl));
 }
@@ -64,7 +71,7 @@
 	int ret;
 
 	/* Acknowledge the command that failed */
-	ret = ucsi_acknowledge_command(ucsi);
+	ret = ucsi_acknowledge(ucsi, false);
 	if (ret)
 		return ret;
 
@@ -72,11 +79,11 @@
 	if (ret < 0)
 		return ret;
 
-	ret = ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, &error, sizeof(error));
+	ret = ucsi_read_message_in(ucsi, &error, sizeof(error));
 	if (ret)
 		return ret;
 
-	ret = ucsi_acknowledge_command(ucsi);
+	ret = ucsi_acknowledge(ucsi, false);
 	if (ret)
 		return ret;
 
@@ -138,25 +145,34 @@
 	if (!(cci & UCSI_CCI_COMMAND_COMPLETE))
 		return -EIO;
 
-	if (cci & UCSI_CCI_NOT_SUPPORTED)
+	if (cci & UCSI_CCI_NOT_SUPPORTED) {
+		if (ucsi_acknowledge(ucsi, false) < 0)
+			dev_err(ucsi->dev,
+				"ACK of unsupported command failed\n");
 		return -EOPNOTSUPP;
+	}
 
 	if (cci & UCSI_CCI_ERROR) {
-		if (cmd == UCSI_GET_ERROR_STATUS)
+		if (cmd == UCSI_GET_ERROR_STATUS) {
+			ret = ucsi_acknowledge(ucsi, false);
+			if (ret)
+				return ret;
+
 			return -EIO;
+		}
 		return ucsi_read_error(ucsi);
 	}
 
 	if (cmd == UCSI_CANCEL && cci & UCSI_CCI_CANCEL_COMPLETE) {
-		ret = ucsi_acknowledge_command(ucsi);
+		ret = ucsi_acknowledge(ucsi, false);
 		return ret ? ret : -EBUSY;
 	}
 
 	return UCSI_CCI_LENGTH(cci);
 }
 
-int ucsi_send_command(struct ucsi *ucsi, u64 command,
-		      void *data, size_t size)
+static int ucsi_send_command_common(struct ucsi *ucsi, u64 command,
+				    void *data, size_t size, bool conn_ack)
 {
 	u8 length;
 	int ret;
@@ -170,12 +186,12 @@
 	length = ret;
 
 	if (data) {
-		ret = ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, data, size);
+		ret = ucsi_read_message_in(ucsi, data, size);
 		if (ret)
 			goto out;
 	}
 
-	ret = ucsi_acknowledge_command(ucsi);
+	ret = ucsi_acknowledge(ucsi, conn_ack);
 	if (ret)
 		goto out;
 
@@ -184,6 +200,12 @@
 	mutex_unlock(&ucsi->ppm_lock);
 	return ret;
 }
+
+int ucsi_send_command(struct ucsi *ucsi, u64 command,
+		      void *data, size_t size)
+{
+	return ucsi_send_command_common(ucsi, command, data, size, false);
+}
 EXPORT_SYMBOL_GPL(ucsi_send_command);
 
 /* -------------------------------------------------------------------------- */
@@ -578,7 +600,8 @@
 	u64 command;
 	int ret;
 
-	if (ucsi->quirks & UCSI_NO_PARTNER_PDOS)
+	if (is_partner &&
+	    ucsi->quirks & UCSI_NO_PARTNER_PDOS)
 		return 0;
 
 	command = UCSI_COMMAND(UCSI_GET_PDOS) | UCSI_CONNECTOR_NUMBER(con->num);
@@ -680,12 +703,6 @@
 			return PTR_ERR(cap);
 
 		con->partner_source_caps = cap;
-
-		ret = typec_partner_set_usb_power_delivery(con->partner, con->partner_pd);
-		if (ret) {
-			usb_power_delivery_unregister_capabilities(con->partner_source_caps);
-			return ret;
-		}
 	}
 
 	ret = ucsi_get_pdos(con, TYPEC_SINK, 1, caps.pdo);
@@ -700,15 +717,9 @@
 			return PTR_ERR(cap);
 
 		con->partner_sink_caps = cap;
-
-		ret = typec_partner_set_usb_power_delivery(con->partner, con->partner_pd);
-		if (ret) {
-			usb_power_delivery_unregister_capabilities(con->partner_sink_caps);
-			return ret;
-		}
 	}
 
-	return 0;
+	return typec_partner_set_usb_power_delivery(con->partner, con->partner_pd);
 }
 
 static void ucsi_unregister_partner_pdos(struct ucsi_connector *con)
@@ -884,7 +895,9 @@
 	mutex_lock(&con->lock);
 
 	command = UCSI_GET_CONNECTOR_STATUS | UCSI_CONNECTOR_NUMBER(con->num);
-	ret = ucsi_send_command(ucsi, command, &con->status, sizeof(con->status));
+
+	ret = ucsi_send_command_common(ucsi, command, &con->status,
+				       sizeof(con->status), true);
 	if (ret < 0) {
 		dev_err(ucsi->dev, "%s: GET_CONNECTOR_STATUS failed (%d)\n",
 			__func__, ret);
@@ -894,6 +907,9 @@
 
 	trace_ucsi_connector_change(con->num, &con->status);
 
+	if (ucsi->ops->connector_status)
+		ucsi->ops->connector_status(con);
+
 	role = !!(con->status.flags & UCSI_CONSTAT_PWR_DIR);
 
 	if (con->status.change & UCSI_CONSTAT_POWER_DIR_CHANGE) {
@@ -936,14 +952,6 @@
 	if (con->status.change & UCSI_CONSTAT_CAM_CHANGE)
 		ucsi_partner_task(con, ucsi_check_altmodes, 1, 0);
 
-	clear_bit(EVENT_PENDING, &con->ucsi->flags);
-
-	mutex_lock(&ucsi->ppm_lock);
-	ret = ucsi_acknowledge_connector_change(ucsi);
-	mutex_unlock(&ucsi->ppm_lock);
-	if (ret)
-		dev_err(ucsi->dev, "%s: ACK failed (%d)", __func__, ret);
-
 out_unlock:
 	mutex_unlock(&con->lock);
 }
@@ -958,7 +966,7 @@
 	struct ucsi_connector *con = &ucsi->connector[num - 1];
 
 	if (!(ucsi->ntfy & UCSI_ENABLE_NTFY_CONNECTOR_CHANGE)) {
-		dev_dbg(ucsi->dev, "Bogus connector change event\n");
+		dev_dbg(ucsi->dev, "Early connector change event\n");
 		return;
 	}
 
@@ -981,13 +989,47 @@
 
 static int ucsi_reset_ppm(struct ucsi *ucsi)
 {
-	u64 command = UCSI_PPM_RESET;
+	u64 command;
 	unsigned long tmo;
 	u32 cci;
 	int ret;
 
 	mutex_lock(&ucsi->ppm_lock);
 
+	ret = ucsi->ops->read(ucsi, UCSI_CCI, &cci, sizeof(cci));
+	if (ret < 0)
+		goto out;
+
+	/*
+	 * If UCSI_CCI_RESET_COMPLETE is already set we must clear
+	 * the flag before we start another reset. Send a
+	 * UCSI_SET_NOTIFICATION_ENABLE command to achieve this.
+	 * Ignore a timeout and try the reset anyway if this fails.
+	 */
+	if (cci & UCSI_CCI_RESET_COMPLETE) {
+		command = UCSI_SET_NOTIFICATION_ENABLE;
+		ret = ucsi->ops->async_write(ucsi, UCSI_CONTROL, &command,
+					     sizeof(command));
+		if (ret < 0)
+			goto out;
+
+		tmo = jiffies + msecs_to_jiffies(UCSI_TIMEOUT_MS);
+		do {
+			ret = ucsi->ops->read(ucsi, UCSI_CCI,
+					      &cci, sizeof(cci));
+			if (ret < 0)
+				goto out;
+			if (cci & UCSI_CCI_COMMAND_COMPLETE)
+				break;
+			if (time_is_before_jiffies(tmo))
+				break;
+			msleep(20);
+		} while (1);
+
+		WARN_ON(cci & UCSI_CCI_RESET_COMPLETE);
+	}
+
+	command = UCSI_PPM_RESET;
 	ret = ucsi->ops->async_write(ucsi, UCSI_CONTROL, &command,
 				     sizeof(command));
 	if (ret < 0)
@@ -1223,6 +1265,9 @@
 	cap->driver_data = con;
 	cap->ops = &ucsi_ops;
 
+	if (ucsi->ops->update_connector)
+		ucsi->ops->update_connector(con);
+
 	ret = ucsi_register_port_psy(con);
 	if (ret)
 		goto out;
@@ -1249,7 +1294,6 @@
 		}
 
 		con->port_source_caps = pd_cap;
-		typec_port_set_usb_power_delivery(con->port, con->pd);
 	}
 
 	memset(&pd_caps, 0, sizeof(pd_caps));
@@ -1266,9 +1310,10 @@
 		}
 
 		con->port_sink_caps = pd_cap;
-		typec_port_set_usb_power_delivery(con->port, con->pd);
 	}
 
+	typec_port_set_usb_power_delivery(con->port, con->pd);
+
 	/* Alternate modes */
 	ret = ucsi_register_altmodes(con, UCSI_RECIPIENT_CON);
 	if (ret) {
@@ -1287,6 +1332,9 @@
 	}
 	ret = 0; /* ucsi_send_command() returns length on success */
 
+	if (ucsi->ops->connector_status)
+		ucsi->ops->connector_status(con);
+
 	switch (UCSI_CONSTAT_PARTNER_TYPE(con->status.flags)) {
 	case UCSI_CONSTAT_PARTNER_TYPE_UFP:
 	case UCSI_CONSTAT_PARTNER_TYPE_CABLE_AND_UFP:
@@ -1355,6 +1403,7 @@
 {
 	struct ucsi_connector *con, *connector;
 	u64 command, ntfy;
+	u32 cci;
 	int ret;
 	int i;
 
@@ -1407,6 +1456,15 @@
 
 	ucsi->connector = connector;
 	ucsi->ntfy = ntfy;
+
+	mutex_lock(&ucsi->ppm_lock);
+	ret = ucsi->ops->read(ucsi, UCSI_CCI, &cci, sizeof(cci));
+	mutex_unlock(&ucsi->ppm_lock);
+	if (ret)
+		return ret;
+	if (UCSI_CCI_CONNECTOR(cci))
+		ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci));
+
 	return 0;
 
 err_unregister:
@@ -1558,6 +1616,15 @@
 	if (!ucsi->version)
 		return -ENODEV;
 
+	/*
+	 * Version format is JJ.M.N (JJ = Major version, M = Minor version,
+	 * N = sub-minor version).
+	 */
+	dev_dbg(ucsi->dev, "Registered UCSI interface with version %x.%x.%x",
+		UCSI_BCD_GET_MAJOR(ucsi->version),
+		UCSI_BCD_GET_MINOR(ucsi->version),
+		UCSI_BCD_GET_SUBMINOR(ucsi->version));
+
 	queue_delayed_work(system_long_wq, &ucsi->work, 0);
 
 	ucsi_debugfs_register(ucsi);
--- linux-qcom-6.8.0.orig/drivers/usb/typec/ucsi/ucsi.h
+++ linux-qcom-6.8.0/drivers/usb/typec/ucsi/ucsi.h
@@ -15,6 +15,7 @@
 
 struct ucsi;
 struct ucsi_altmode;
+struct ucsi_connector;
 struct dentry;
 
 /* UCSI offsets (Bytes) */
@@ -23,6 +24,17 @@
 #define UCSI_CONTROL			8
 #define UCSI_MESSAGE_IN			16
 #define UCSI_MESSAGE_OUT		32
+#define UCSIv2_MESSAGE_OUT		272
+
+/* UCSI versions */
+#define UCSI_VERSION_1_2	0x0120
+#define UCSI_VERSION_2_0	0x0200
+#define UCSI_VERSION_2_1	0x0210
+#define UCSI_VERSION_3_0	0x0300
+
+#define UCSI_BCD_GET_MAJOR(_v_)		(((_v_) >> 8) & 0xFF)
+#define UCSI_BCD_GET_MINOR(_v_)		(((_v_) >> 4) & 0x0F)
+#define UCSI_BCD_GET_SUBMINOR(_v_)	((_v_) & 0x0F)
 
 /* Command Status and Connector Change Indication (CCI) bits */
 #define UCSI_CCI_CONNECTOR(_c_)		(((_c_) & GENMASK(7, 1)) >> 1)
@@ -41,6 +53,8 @@
  * @sync_write: Blocking write operation
  * @async_write: Non-blocking write operation
  * @update_altmodes: Squashes duplicate DP altmodes
+ * @update_connector: Update connector capabilities before registering
+ * @connector_status: Updates connector status, called holding connector lock
  *
  * Read and write routines for UCSI interface. @sync_write must wait for the
  * Command Completion Event from the PPM before returning, and @async_write must
@@ -55,6 +69,8 @@
 			   const void *val, size_t val_len);
 	bool (*update_altmodes)(struct ucsi *ucsi, struct ucsi_altmode *orig,
 				struct ucsi_altmode *updated);
+	void (*update_connector)(struct ucsi_connector *con);
+	void (*connector_status)(struct ucsi_connector *con);
 };
 
 struct ucsi *ucsi_create(struct device *dev, const struct ucsi_operations *ops);
@@ -221,12 +237,12 @@
 #define UCSI_CABLE_PROP_FLAG_VBUS_IN_CABLE	BIT(0)
 #define UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE	BIT(1)
 #define UCSI_CABLE_PROP_FLAG_DIRECTIONALITY	BIT(2)
-#define UCSI_CABLE_PROP_FLAG_PLUG_TYPE(_f_)	((_f_) & GENMASK(3, 0))
+#define UCSI_CABLE_PROP_FLAG_PLUG_TYPE(_f_)	(((_f_) & GENMASK(4, 3)) >> 3)
 #define   UCSI_CABLE_PROPERTY_PLUG_TYPE_A	0
 #define   UCSI_CABLE_PROPERTY_PLUG_TYPE_B	1
 #define   UCSI_CABLE_PROPERTY_PLUG_TYPE_C	2
 #define   UCSI_CABLE_PROPERTY_PLUG_OTHER	3
-#define UCSI_CABLE_PROP_MODE_SUPPORT		BIT(5)
+#define UCSI_CABLE_PROP_FLAG_MODE_SUPPORT	BIT(5)
 	u8 latency;
 } __packed;
 
@@ -396,7 +412,7 @@
 			  bool override, int offset,
 			  struct typec_altmode_desc *desc)
 {
-	return NULL;
+	return typec_port_register_altmode(con->port, desc);
 }
 
 static inline void
--- linux-qcom-6.8.0.orig/drivers/usb/typec/ucsi/ucsi_acpi.c
+++ linux-qcom-6.8.0/drivers/usb/typec/ucsi/ucsi_acpi.c
@@ -23,10 +23,11 @@
 	void *base;
 	struct completion complete;
 	unsigned long flags;
+#define UCSI_ACPI_SUPPRESS_EVENT	0
+#define UCSI_ACPI_COMMAND_PENDING	1
+#define UCSI_ACPI_ACK_PENDING		2
 	guid_t guid;
 	u64 cmd;
-	bool dell_quirk_probed;
-	bool dell_quirk_active;
 };
 
 static int ucsi_acpi_dsm(struct ucsi_acpi *ua, int func)
@@ -79,9 +80,9 @@
 	int ret;
 
 	if (ack)
-		set_bit(ACK_PENDING, &ua->flags);
+		set_bit(UCSI_ACPI_ACK_PENDING, &ua->flags);
 	else
-		set_bit(COMMAND_PENDING, &ua->flags);
+		set_bit(UCSI_ACPI_COMMAND_PENDING, &ua->flags);
 
 	ret = ucsi_acpi_async_write(ucsi, offset, val, val_len);
 	if (ret)
@@ -92,9 +93,9 @@
 
 out_clear_bit:
 	if (ack)
-		clear_bit(ACK_PENDING, &ua->flags);
+		clear_bit(UCSI_ACPI_ACK_PENDING, &ua->flags);
 	else
-		clear_bit(COMMAND_PENDING, &ua->flags);
+		clear_bit(UCSI_ACPI_COMMAND_PENDING, &ua->flags);
 
 	return ret;
 }
@@ -129,51 +130,40 @@
 };
 
 /*
- * Some Dell laptops expect that an ACK command with the
- * UCSI_ACK_CONNECTOR_CHANGE bit set is followed by a (separate)
- * ACK command that only has the UCSI_ACK_COMMAND_COMPLETE bit set.
- * If this is not done events are not delivered to OSPM and
- * subsequent commands will timeout.
+ * Some Dell laptops don't like ACK commands with the
+ * UCSI_ACK_CONNECTOR_CHANGE but not the UCSI_ACK_COMMAND_COMPLETE
+ * bit set. To work around this send a dummy command and bundle the
+ * UCSI_ACK_CONNECTOR_CHANGE with the UCSI_ACK_COMMAND_COMPLETE
+ * for the dummy command.
  */
 static int
 ucsi_dell_sync_write(struct ucsi *ucsi, unsigned int offset,
 		     const void *val, size_t val_len)
 {
 	struct ucsi_acpi *ua = ucsi_get_drvdata(ucsi);
-	u64 cmd = *(u64 *)val, ack = 0;
+	u64 cmd = *(u64 *)val;
+	u64 dummycmd = UCSI_GET_CAPABILITY;
 	int ret;
 
-	if (UCSI_COMMAND(cmd) == UCSI_ACK_CC_CI &&
-	    cmd & UCSI_ACK_CONNECTOR_CHANGE)
-		ack = UCSI_ACK_CC_CI | UCSI_ACK_COMMAND_COMPLETE;
+	if (cmd == (UCSI_ACK_CC_CI | UCSI_ACK_CONNECTOR_CHANGE)) {
+		cmd |= UCSI_ACK_COMMAND_COMPLETE;
 
-	ret = ucsi_acpi_sync_write(ucsi, offset, val, val_len);
-	if (ret != 0)
-		return ret;
-	if (ack == 0)
-		return ret;
-
-	if (!ua->dell_quirk_probed) {
-		ua->dell_quirk_probed = true;
+		/*
+		 * The UCSI core thinks it is sending a connector change ack
+		 * and will accept new connector change events. We don't want
+		 * this to happen for the dummy command as its response will
+		 * still report the very event that the core is trying to clear.
+		 */
+		set_bit(UCSI_ACPI_SUPPRESS_EVENT, &ua->flags);
+		ret = ucsi_acpi_sync_write(ucsi, UCSI_CONTROL, &dummycmd,
+					   sizeof(dummycmd));
+		clear_bit(UCSI_ACPI_SUPPRESS_EVENT, &ua->flags);
 
-		cmd = UCSI_GET_CAPABILITY;
-		ret = ucsi_acpi_sync_write(ucsi, UCSI_CONTROL, &cmd,
-					   sizeof(cmd));
-		if (ret == 0)
-			return ucsi_acpi_sync_write(ucsi, UCSI_CONTROL,
-						    &ack, sizeof(ack));
-		if (ret != -ETIMEDOUT)
+		if (ret < 0)
 			return ret;
-
-		ua->dell_quirk_active = true;
-		dev_err(ua->dev, "Firmware bug: Additional ACK required after ACKing a connector change.\n");
-		dev_err(ua->dev, "Firmware bug: Enabling workaround\n");
 	}
 
-	if (!ua->dell_quirk_active)
-		return ret;
-
-	return ucsi_acpi_sync_write(ucsi, UCSI_CONTROL, &ack, sizeof(ack));
+	return ucsi_acpi_sync_write(ucsi, UCSI_CONTROL, &cmd, sizeof(cmd));
 }
 
 static const struct ucsi_operations ucsi_dell_ops = {
@@ -209,13 +199,14 @@
 	if (ret)
 		return;
 
-	if (UCSI_CCI_CONNECTOR(cci))
+	if (UCSI_CCI_CONNECTOR(cci) &&
+	    !test_bit(UCSI_ACPI_SUPPRESS_EVENT, &ua->flags))
 		ucsi_connector_change(ua->ucsi, UCSI_CCI_CONNECTOR(cci));
 
 	if (cci & UCSI_CCI_ACK_COMPLETE && test_bit(ACK_PENDING, &ua->flags))
 		complete(&ua->complete);
 	if (cci & UCSI_CCI_COMMAND_COMPLETE &&
-	    test_bit(COMMAND_PENDING, &ua->flags))
+	    test_bit(UCSI_ACPI_COMMAND_PENDING, &ua->flags))
 		complete(&ua->complete);
 }
 
--- linux-qcom-6.8.0.orig/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ linux-qcom-6.8.0/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -441,6 +441,8 @@
 
 	port = uc->orig;
 	new_cam = UCSI_SET_NEW_CAM_GET_AM(*cmd);
+	if (new_cam >= ARRAY_SIZE(uc->updated))
+		return;
 	new_port = &uc->updated[new_cam];
 	cam = new_port->linked_idx;
 	enter_new_mode = UCSI_SET_NEW_CAM_ENTER(*cmd);
@@ -583,6 +585,10 @@
 		    uc->has_multiple_dp) {
 			con_index = (uc->last_cmd_sent >> 16) &
 				    UCSI_CMD_CONNECTOR_MASK;
+			if (con_index == 0) {
+				ret = -EINVAL;
+				goto err_clear_bit;
+			}
 			con = &uc->ucsi->connector[con_index - 1];
 			ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val);
 		}
--- linux-qcom-6.8.0.orig/drivers/usb/typec/ucsi/ucsi_glink.c
+++ linux-qcom-6.8.0/drivers/usb/typec/ucsi/ucsi_glink.c
@@ -2,6 +2,7 @@
 /*
  * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
  * Copyright (c) 2023, Linaro Ltd
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/auxiliary_bus.h>
 #include <linux/module.h>
@@ -14,6 +15,9 @@
 #include <linux/soc/qcom/pmic_glink.h>
 #include "ucsi.h"
 
+#define CREATE_TRACE_POINTS
+#include "ucsi_glink_trace.h"
+
 #define PMIC_GLINK_MAX_PORTS	2
 
 #define UCSI_BUF_SIZE                   48
@@ -73,10 +77,55 @@
 
 	struct work_struct notify_work;
 	struct work_struct register_work;
+	spinlock_t state_lock;
+	bool ucsi_registered;
+	bool pd_running;
 
 	u8 read_buf[UCSI_BUF_SIZE];
 };
 
+static char *offset_to_name(unsigned int offset)
+{
+	char *type;
+
+	switch (offset) {
+	case UCSI_VERSION:
+		type = "VER:";
+		break;
+	case UCSI_CCI:
+		type = "CCI:";
+		break;
+	case UCSI_CONTROL:
+		type = "CONTROL:";
+		break;
+	case UCSI_MESSAGE_IN:
+		type = "MSG_IN:";
+		break;
+	case UCSI_MESSAGE_OUT:
+		type = "MSG_OUT:";
+		break;
+	default:
+		type = "UNKNOWN:";
+		break;
+	}
+
+	return type;
+}
+
+static void ucsi_log(const char *prefix, unsigned int offset, u8 *buf,
+				size_t len)
+{
+	char str[256] = { 0 };
+	u32 i, pos = 0;
+
+	for (i = 0; i < len && pos < sizeof(str) - 1; i++)
+		pos += scnprintf(str + pos, sizeof(str) - pos, "%02x ", buf[i]);
+
+	str[pos] = '\0';
+
+	trace_ucsi_glink(prefix, offset_to_name(offset), str);
+}
+
 static int pmic_glink_ucsi_read(struct ucsi *__ucsi, unsigned int offset,
 				void *val, size_t val_len)
 {
@@ -107,6 +156,8 @@
 	}
 
 	memcpy(val, &ucsi->read_buf[offset], val_len);
+	ucsi_log("read:", offset, (u8 *)val, val_len);
+
 	ret = 0;
 
 out_unlock:
@@ -151,6 +202,7 @@
 	int ret;
 
 	mutex_lock(&ucsi->lock);
+	ucsi_log("async_write:", offset, (u8 *)val, val_len);
 	ret = pmic_glink_ucsi_locked_write(ucsi, offset, val, val_len);
 	mutex_unlock(&ucsi->lock);
 
@@ -170,13 +222,16 @@
 	ucsi->sync_val = 0;
 	reinit_completion(&ucsi->sync_ack);
 	ucsi->sync_pending = true;
+
+	ucsi_log("sync_write:", offset, (u8 *)val, val_len);
 	ret = pmic_glink_ucsi_locked_write(ucsi, offset, val, val_len);
 	mutex_unlock(&ucsi->lock);
 
 	left = wait_for_completion_timeout(&ucsi->sync_ack, 5 * HZ);
 	if (!left) {
 		dev_err(ucsi->dev, "timeout waiting for UCSI sync write response\n");
-		ret = -ETIMEDOUT;
+		/* return 0 here and let core UCSI code handle the CCI_BUSY */
+		ret = 0;
 	} else if (ucsi->sync_val) {
 		dev_err(ucsi->dev, "sync write returned: %d\n", ucsi->sync_val);
 	}
@@ -186,10 +241,45 @@
 	return ret;
 }
 
+static void pmic_glink_ucsi_update_connector(struct ucsi_connector *con)
+{
+	struct pmic_glink_ucsi *ucsi = ucsi_get_drvdata(con->ucsi);
+
+	if (con->num > PMIC_GLINK_MAX_PORTS ||
+	    !ucsi->port_orientation[con->num - 1])
+		return;
+
+	con->typec_cap.orientation_aware = true;
+}
+
+static void pmic_glink_ucsi_connector_status(struct ucsi_connector *con)
+{
+	struct pmic_glink_ucsi *ucsi = ucsi_get_drvdata(con->ucsi);
+	int orientation;
+
+	if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) {
+		typec_set_orientation(con->port, TYPEC_ORIENTATION_NONE);
+		return;
+	}
+
+	if (con->num > PMIC_GLINK_MAX_PORTS ||
+	    !ucsi->port_orientation[con->num - 1])
+		return;
+
+	orientation = gpiod_get_value(ucsi->port_orientation[con->num - 1]);
+	if (orientation >= 0) {
+		typec_switch_set(ucsi->port_switch[con->num - 1],
+				 orientation ? TYPEC_ORIENTATION_REVERSE
+				 : TYPEC_ORIENTATION_NORMAL);
+	}
+}
+
 static const struct ucsi_operations pmic_glink_ucsi_ops = {
 	.read = pmic_glink_ucsi_read,
 	.sync_write = pmic_glink_ucsi_sync_write,
-	.async_write = pmic_glink_ucsi_async_write
+	.async_write = pmic_glink_ucsi_async_write,
+	.update_connector = pmic_glink_ucsi_update_connector,
+	.connector_status = pmic_glink_ucsi_connector_status,
 };
 
 static void pmic_glink_ucsi_read_ack(struct pmic_glink_ucsi *ucsi, const void *data, int len)
@@ -199,6 +289,7 @@
 	if (resp->ret_code)
 		return;
 
+	pr_debug("UCSI Read ACK\n");
 	memcpy(ucsi->read_buf, resp->buf, UCSI_BUF_SIZE);
 	complete(&ucsi->read_ack);
 }
@@ -210,6 +301,7 @@
 	if (resp->ret_code)
 		return;
 
+	pr_debug("UCSI write ack\n");
 	ucsi->sync_val = resp->ret_code;
 	complete(&ucsi->write_ack);
 }
@@ -227,26 +319,12 @@
 		return;
 	}
 
+	ucsi_log("notify:", UCSI_CCI, (u8 *)&cci, sizeof(cci));
 	con_num = UCSI_CCI_CONNECTOR(cci);
-	if (con_num) {
-		if (con_num <= PMIC_GLINK_MAX_PORTS &&
-		    ucsi->port_orientation[con_num - 1]) {
-			int orientation = gpiod_get_value(ucsi->port_orientation[con_num - 1]);
-
-			if (orientation >= 0) {
-				typec_switch_set(ucsi->port_switch[con_num - 1],
-						 orientation ? TYPEC_ORIENTATION_REVERSE
-							     : TYPEC_ORIENTATION_NORMAL);
-			}
-		}
-
+	if (con_num)
 		ucsi_connector_change(ucsi->ucsi, con_num);
-	}
 
-	if (ucsi->sync_pending && cci & UCSI_CCI_BUSY) {
-		ucsi->sync_val = -EBUSY;
-		complete(&ucsi->sync_ack);
-	} else if (ucsi->sync_pending &&
+	if (ucsi->sync_pending &&
 		   (cci & (UCSI_CCI_ACK_COMPLETE | UCSI_CCI_COMMAND_COMPLETE))) {
 		complete(&ucsi->sync_ack);
 	}
@@ -255,8 +333,20 @@
 static void pmic_glink_ucsi_register(struct work_struct *work)
 {
 	struct pmic_glink_ucsi *ucsi = container_of(work, struct pmic_glink_ucsi, register_work);
+	unsigned long flags;
+	bool pd_running;
 
-	ucsi_register(ucsi->ucsi);
+	spin_lock_irqsave(&ucsi->state_lock, flags);
+	pd_running = ucsi->pd_running;
+	spin_unlock_irqrestore(&ucsi->state_lock, flags);
+
+	if (!ucsi->ucsi_registered && pd_running) {
+		ucsi_register(ucsi->ucsi);
+		ucsi->ucsi_registered = true;
+	} else if (ucsi->ucsi_registered && !pd_running) {
+		ucsi_unregister(ucsi->ucsi);
+		ucsi->ucsi_registered = false;
+	}
 }
 
 static void pmic_glink_ucsi_callback(const void *data, size_t len, void *priv)
@@ -280,11 +370,12 @@
 static void pmic_glink_ucsi_pdr_notify(void *priv, int state)
 {
 	struct pmic_glink_ucsi *ucsi = priv;
+	unsigned long flags;
 
-	if (state == SERVREG_SERVICE_STATE_UP)
-		schedule_work(&ucsi->register_work);
-	else if (state == SERVREG_SERVICE_STATE_DOWN)
-		ucsi_unregister(ucsi->ucsi);
+	spin_lock_irqsave(&ucsi->state_lock, flags);
+	ucsi->pd_running = (state == SERVREG_SERVICE_STATE_UP);
+	spin_unlock_irqrestore(&ucsi->state_lock, flags);
+	schedule_work(&ucsi->register_work);
 }
 
 static void pmic_glink_ucsi_destroy(void *data)
@@ -297,11 +388,14 @@
 	mutex_unlock(&ucsi->lock);
 }
 
+static unsigned long quirk_sc8180x = UCSI_NO_PARTNER_PDOS;
+
 static const struct of_device_id pmic_glink_ucsi_of_quirks[] = {
-	{ .compatible = "qcom,sc8180x-pmic-glink", .data = (void *)UCSI_NO_PARTNER_PDOS, },
-	{ .compatible = "qcom,sc8280xp-pmic-glink", .data = (void *)UCSI_NO_PARTNER_PDOS, },
-	{ .compatible = "qcom,sm8350-pmic-glink", .data = (void *)UCSI_NO_PARTNER_PDOS, },
-	{ .compatible = "qcom,sm8550-pmic-glink", .data = (void *)UCSI_NO_PARTNER_PDOS, },
+	{ .compatible = "qcom,qcm6490-pmic-glink", .data = &quirk_sc8180x, },
+	{ .compatible = "qcom,sc8180x-pmic-glink", .data = &quirk_sc8180x, },
+	{ .compatible = "qcom,sc8280xp-pmic-glink", .data = &quirk_sc8180x, },
+	{ .compatible = "qcom,sm8350-pmic-glink", .data = &quirk_sc8180x, },
+	{ .compatible = "qcom,sm8550-pmic-glink", .data = &quirk_sc8180x, },
 	{}
 };
 
@@ -326,6 +420,7 @@
 	init_completion(&ucsi->read_ack);
 	init_completion(&ucsi->write_ack);
 	init_completion(&ucsi->sync_ack);
+	spin_lock_init(&ucsi->state_lock);
 	mutex_init(&ucsi->lock);
 
 	ucsi->ucsi = ucsi_create(dev, &pmic_glink_ucsi_ops);
@@ -339,7 +434,7 @@
 
 	match = of_match_device(pmic_glink_ucsi_of_quirks, dev->parent);
 	if (match)
-		ucsi->ucsi->quirks = (unsigned long)match->data;
+		ucsi->ucsi->quirks = *(unsigned long *)match->data;
 
 	ucsi_set_drvdata(ucsi->ucsi, ucsi);
 
@@ -350,6 +445,7 @@
 		ret = fwnode_property_read_u32(fwnode, "reg", &port);
 		if (ret < 0) {
 			dev_err(dev, "missing reg property of %pOFn\n", fwnode);
+			fwnode_handle_put(fwnode);
 			return ret;
 		}
 
@@ -364,9 +460,11 @@
 		if (!desc)
 			continue;
 
-		if (IS_ERR(desc))
+		if (IS_ERR(desc)) {
+			fwnode_handle_put(fwnode);
 			return dev_err_probe(dev, PTR_ERR(desc),
 					     "unable to acquire orientation gpio\n");
+		}
 		ucsi->port_orientation[port] = desc;
 
 		ucsi->port_switch[port] = fwnode_typec_switch_get(fwnode);
@@ -375,12 +473,16 @@
 					"failed to acquire orientation-switch\n");
 	}
 
-	ucsi->client = devm_pmic_glink_register_client(dev,
-						       PMIC_GLINK_OWNER_USBC,
-						       pmic_glink_ucsi_callback,
-						       pmic_glink_ucsi_pdr_notify,
-						       ucsi);
-	return PTR_ERR_OR_ZERO(ucsi->client);
+	ucsi->client = devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_USBC,
+						    pmic_glink_ucsi_callback,
+						    pmic_glink_ucsi_pdr_notify,
+						    ucsi);
+	if (IS_ERR(ucsi->client))
+		return PTR_ERR(ucsi->client);
+
+	pmic_glink_client_register(ucsi->client);
+
+	return 0;
 }
 
 static void pmic_glink_ucsi_remove(struct auxiliary_device *adev)
--- linux-qcom-6.8.0.orig/drivers/usb/typec/ucsi/ucsi_glink_trace.h
+++ linux-qcom-6.8.0/drivers/usb/typec/ucsi/ucsi_glink_trace.h
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM ucsi_glink
+
+#if !defined(_TRACE_UCSI_GLINK_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_UCSI_GLINK_H
+
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(ucsi_glink,
+	TP_PROTO(char *prefix, char *msg_type, char *msg),
+	TP_ARGS(prefix, msg_type, msg),
+	TP_STRUCT__entry(
+		__string(prefix, prefix)
+		__string(msg_type, msg_type)
+		__string(msg, msg)
+	),
+	TP_fast_assign(
+		__assign_str(prefix, prefix);
+		__assign_str(msg_type, msg_type);
+		__assign_str(msg, msg);
+	),
+	TP_printk("%s %s %s", __get_str(prefix), __get_str(msg_type), __get_str(msg))
+);
+
+#endif /* _TRACE_UCSI_GLINK_H */
+
+/* This part must be outside protection */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH ../../drivers/usb/typec/ucsi
+
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE ucsi_glink_trace
+
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/drivers/usb/typec/ucsi/ucsi_stm32g0.c
+++ linux-qcom-6.8.0/drivers/usb/typec/ucsi/ucsi_stm32g0.c
@@ -64,6 +64,7 @@
 	struct completion complete;
 	struct device *dev;
 	unsigned long flags;
+#define ACK_PENDING	2
 	const char *fw_name;
 	struct ucsi *ucsi;
 	bool suspended;
@@ -395,9 +396,13 @@
 				   size_t len)
 {
 	struct ucsi_stm32g0 *g0 = ucsi_get_drvdata(ucsi);
+	bool ack = UCSI_COMMAND(*(u64 *)val) == UCSI_ACK_CC_CI;
 	int ret;
 
-	set_bit(COMMAND_PENDING, &g0->flags);
+	if (ack)
+		set_bit(ACK_PENDING, &g0->flags);
+	else
+		set_bit(COMMAND_PENDING, &g0->flags);
 
 	ret = ucsi_stm32g0_async_write(ucsi, offset, val, len);
 	if (ret)
@@ -405,9 +410,14 @@
 
 	if (!wait_for_completion_timeout(&g0->complete, msecs_to_jiffies(5000)))
 		ret = -ETIMEDOUT;
+	else
+		return 0;
 
 out_clear_bit:
-	clear_bit(COMMAND_PENDING, &g0->flags);
+	if (ack)
+		clear_bit(ACK_PENDING, &g0->flags);
+	else
+		clear_bit(COMMAND_PENDING, &g0->flags);
 
 	return ret;
 }
@@ -428,8 +438,9 @@
 	if (UCSI_CCI_CONNECTOR(cci))
 		ucsi_connector_change(g0->ucsi, UCSI_CCI_CONNECTOR(cci));
 
-	if (test_bit(COMMAND_PENDING, &g0->flags) &&
-	    cci & (UCSI_CCI_ACK_COMPLETE | UCSI_CCI_COMMAND_COMPLETE))
+	if (cci & UCSI_CCI_ACK_COMPLETE && test_and_clear_bit(ACK_PENDING, &g0->flags))
+		complete(&g0->complete);
+	if (cci & UCSI_CCI_COMMAND_COMPLETE && test_and_clear_bit(COMMAND_PENDING, &g0->flags))
 		complete(&g0->complete);
 
 	return IRQ_HANDLED;
--- linux-qcom-6.8.0.orig/drivers/usb/usbip/stub_rx.c
+++ linux-qcom-6.8.0/drivers/usb/usbip/stub_rx.c
@@ -144,53 +144,62 @@
 	if (err && err != -ENODEV)
 		dev_err(&sdev->udev->dev, "can't set config #%d, error %d\n",
 			config, err);
-	return 0;
+	return err;
 }
 
 static int tweak_reset_device_cmd(struct urb *urb)
 {
 	struct stub_priv *priv = (struct stub_priv *) urb->context;
 	struct stub_device *sdev = priv->sdev;
+	int err;
 
 	dev_info(&urb->dev->dev, "usb_queue_reset_device\n");
 
-	if (usb_lock_device_for_reset(sdev->udev, NULL) < 0) {
+	err = usb_lock_device_for_reset(sdev->udev, NULL);
+	if (err < 0) {
 		dev_err(&urb->dev->dev, "could not obtain lock to reset device\n");
-		return 0;
+		return err;
 	}
-	usb_reset_device(sdev->udev);
+	err = usb_reset_device(sdev->udev);
 	usb_unlock_device(sdev->udev);
 
-	return 0;
+	return err;
 }
 
 /*
  * clear_halt, set_interface, and set_configuration require special tricks.
+ * Returns 1 if request was tweaked, 0 otherwise.
  */
-static void tweak_special_requests(struct urb *urb)
+static int tweak_special_requests(struct urb *urb)
 {
+	int err;
+
 	if (!urb || !urb->setup_packet)
-		return;
+		return 0;
 
 	if (usb_pipetype(urb->pipe) != PIPE_CONTROL)
-		return;
+		return 0;
 
 	if (is_clear_halt_cmd(urb))
 		/* tweak clear_halt */
-		 tweak_clear_halt_cmd(urb);
+		err = tweak_clear_halt_cmd(urb);
 
 	else if (is_set_interface_cmd(urb))
 		/* tweak set_interface */
-		tweak_set_interface_cmd(urb);
+		err = tweak_set_interface_cmd(urb);
 
 	else if (is_set_configuration_cmd(urb))
 		/* tweak set_configuration */
-		tweak_set_configuration_cmd(urb);
+		err = tweak_set_configuration_cmd(urb);
 
 	else if (is_reset_device_cmd(urb))
-		tweak_reset_device_cmd(urb);
-	else
+		err = tweak_reset_device_cmd(urb);
+	else {
 		usbip_dbg_stub_rx("no need to tweak\n");
+		return 0;
+	}
+
+	return !err;
 }
 
 /*
@@ -468,6 +477,7 @@
 	int support_sg = 1;
 	int np = 0;
 	int ret, i;
+	int is_tweaked;
 
 	if (pipe == -1)
 		return;
@@ -580,8 +590,11 @@
 		priv->urbs[i]->pipe = pipe;
 		priv->urbs[i]->complete = stub_complete;
 
-		/* no need to submit an intercepted request, but harmless? */
-		tweak_special_requests(priv->urbs[i]);
+		/*
+		 * all URBs belong to a single PDU, so a global is_tweaked flag is
+		 * enough
+		 */
+		is_tweaked = tweak_special_requests(priv->urbs[i]);
 
 		masking_bogus_flags(priv->urbs[i]);
 	}
@@ -594,22 +607,32 @@
 
 	/* urb is now ready to submit */
 	for (i = 0; i < priv->num_urbs; i++) {
-		ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
+		if (!is_tweaked) {
+			ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
 
-		if (ret == 0)
-			usbip_dbg_stub_rx("submit urb ok, seqnum %u\n",
-					pdu->base.seqnum);
-		else {
-			dev_err(&udev->dev, "submit_urb error, %d\n", ret);
-			usbip_dump_header(pdu);
-			usbip_dump_urb(priv->urbs[i]);
+			if (ret == 0)
+				usbip_dbg_stub_rx("submit urb ok, seqnum %u\n",
+						pdu->base.seqnum);
+			else {
+				dev_err(&udev->dev, "submit_urb error, %d\n", ret);
+				usbip_dump_header(pdu);
+				usbip_dump_urb(priv->urbs[i]);
 
+				/*
+				 * Pessimistic.
+				 * This connection will be discarded.
+				 */
+				usbip_event_add(ud, SDEV_EVENT_ERROR_SUBMIT);
+				break;
+			}
+		} else {
 			/*
-			 * Pessimistic.
-			 * This connection will be discarded.
+			 * An identical URB was already submitted in
+			 * tweak_special_requests(). Skip submitting this URB to not
+			 * duplicate the request.
 			 */
-			usbip_event_add(ud, SDEV_EVENT_ERROR_SUBMIT);
-			break;
+			priv->urbs[i]->status = 0;
+			stub_complete(priv->urbs[i]);
 		}
 	}
 
--- linux-qcom-6.8.0.orig/drivers/usb/usbip/vhci_hcd.c
+++ linux-qcom-6.8.0/drivers/usb/usbip/vhci_hcd.c
@@ -745,6 +745,7 @@
 	 *
 	 */
 	if (usb_pipedevice(urb->pipe) == 0) {
+		struct usb_device *old;
 		__u8 type = usb_pipetype(urb->pipe);
 		struct usb_ctrlrequest *ctrlreq =
 			(struct usb_ctrlrequest *) urb->setup_packet;
@@ -755,14 +756,15 @@
 			goto no_need_xmit;
 		}
 
+		old = vdev->udev;
 		switch (ctrlreq->bRequest) {
 		case USB_REQ_SET_ADDRESS:
 			/* set_address may come when a device is reset */
 			dev_info(dev, "SetAddress Request (%d) to port %d\n",
 				 ctrlreq->wValue, vdev->rhport);
 
-			usb_put_dev(vdev->udev);
 			vdev->udev = usb_get_dev(urb->dev);
+			usb_put_dev(old);
 
 			spin_lock(&vdev->ud.lock);
 			vdev->ud.status = VDEV_ST_USED;
@@ -781,8 +783,8 @@
 				usbip_dbg_vhci_hc(
 					"Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
 
-			usb_put_dev(vdev->udev);
 			vdev->udev = usb_get_dev(urb->dev);
+			usb_put_dev(old);
 			goto out;
 
 		default:
@@ -1067,6 +1069,7 @@
 static void vhci_device_reset(struct usbip_device *ud)
 {
 	struct vhci_device *vdev = container_of(ud, struct vhci_device, ud);
+	struct usb_device *old = vdev->udev;
 	unsigned long flags;
 
 	spin_lock_irqsave(&ud->lock, flags);
@@ -1074,8 +1077,8 @@
 	vdev->speed  = 0;
 	vdev->devid  = 0;
 
-	usb_put_dev(vdev->udev);
 	vdev->udev = NULL;
+	usb_put_dev(old);
 
 	if (ud->tcp_socket) {
 		sockfd_put(ud->tcp_socket);
--- linux-qcom-6.8.0.orig/drivers/vdpa/ifcvf/ifcvf_base.c
+++ linux-qcom-6.8.0/drivers/vdpa/ifcvf/ifcvf_base.c
@@ -109,7 +109,7 @@
 	u32 i;
 
 	ret = pci_read_config_byte(pdev, PCI_CAPABILITY_LIST, &pos);
-	if (ret < 0) {
+	if (ret) {
 		IFCVF_ERR(pdev, "Failed to read PCI capability list\n");
 		return -EIO;
 	}
--- linux-qcom-6.8.0.orig/drivers/vdpa/mlx5/core/mr.c
+++ linux-qcom-6.8.0/drivers/vdpa/mlx5/core/mr.c
@@ -227,21 +227,19 @@
 	unsigned long lgcd = 0;
 	int log_entity_size;
 	unsigned long size;
-	u64 start = 0;
 	int err;
 	struct page *pg;
 	unsigned int nsg;
 	int sglen;
-	u64 pa;
+	u64 pa, offset;
 	u64 paend;
 	struct scatterlist *sg;
 	struct device *dma = mvdev->vdev.dma_dev;
 
 	for (map = vhost_iotlb_itree_first(iotlb, mr->start, mr->end - 1);
-	     map; map = vhost_iotlb_itree_next(map, start, mr->end - 1)) {
+	     map; map = vhost_iotlb_itree_next(map, mr->start, mr->end - 1)) {
 		size = maplen(map, mr);
 		lgcd = gcd(lgcd, size);
-		start += size;
 	}
 	log_entity_size = ilog2(lgcd);
 
@@ -255,8 +253,10 @@
 	sg = mr->sg_head.sgl;
 	for (map = vhost_iotlb_itree_first(iotlb, mr->start, mr->end - 1);
 	     map; map = vhost_iotlb_itree_next(map, mr->start, mr->end - 1)) {
-		paend = map->addr + maplen(map, mr);
-		for (pa = map->addr; pa < paend; pa += sglen) {
+		offset = mr->start > map->start ? mr->start - map->start : 0;
+		pa = map->addr + offset;
+		paend = map->addr + offset + maplen(map, mr);
+		for (; pa < paend; pa += sglen) {
 			pg = pfn_to_page(__phys_to_pfn(pa));
 			if (!sg) {
 				mlx5_vdpa_warn(mvdev, "sg null. start 0x%llx, end 0x%llx\n",
@@ -581,6 +581,9 @@
 
 void mlx5_vdpa_destroy_mr_resources(struct mlx5_vdpa_dev *mvdev)
 {
+	if (!mvdev->res.valid)
+		return;
+
 	for (int i = 0; i < MLX5_VDPA_NUM_AS; i++)
 		mlx5_vdpa_update_mr(mvdev, NULL, i);
 
--- linux-qcom-6.8.0.orig/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ linux-qcom-6.8.0/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -151,8 +151,6 @@
 
 static bool mlx5_vdpa_debug;
 
-#define MLX5_CVQ_MAX_ENT 16
-
 #define MLX5_LOG_VIO_FLAG(_feature)                                                                \
 	do {                                                                                       \
 		if (features & BIT_ULL(_feature))                                                  \
@@ -2276,9 +2274,16 @@
 	struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev);
 	struct mlx5_vdpa_virtqueue *mvq;
 
-	if (!is_index_valid(mvdev, idx) || is_ctrl_vq_idx(mvdev, idx))
+	if (!is_index_valid(mvdev, idx))
 		return;
 
+        if (is_ctrl_vq_idx(mvdev, idx)) {
+                struct mlx5_control_vq *cvq = &mvdev->cvq;
+
+                cvq->vring.vring.num = num;
+                return;
+        }
+
 	mvq = &ndev->vqs[idx];
 	mvq->num_ent = num;
 }
@@ -2963,7 +2968,7 @@
 		u16 idx = cvq->vring.last_avail_idx;
 
 		err = vringh_init_iotlb(&cvq->vring, mvdev->actual_features,
-					MLX5_CVQ_MAX_ENT, false,
+					cvq->vring.vring.num, false,
 					(struct vring_desc *)(uintptr_t)cvq->desc_addr,
 					(struct vring_avail *)(uintptr_t)cvq->driver_addr,
 					(struct vring_used *)(uintptr_t)cvq->device_addr);
--- linux-qcom-6.8.0.orig/drivers/vdpa/solidrun/snet_main.c
+++ linux-qcom-6.8.0/drivers/vdpa/solidrun/snet_main.c
@@ -555,7 +555,7 @@
 
 static int psnet_open_pf_bar(struct pci_dev *pdev, struct psnet *psnet)
 {
-	char name[50];
+	char *name;
 	int ret, i, mask = 0;
 	/* We don't know which BAR will be used to communicate..
 	 * We will map every bar with len > 0.
@@ -573,7 +573,10 @@
 		return -ENODEV;
 	}
 
-	snprintf(name, sizeof(name), "psnet[%s]-bars", pci_name(pdev));
+	name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "psnet[%s]-bars", pci_name(pdev));
+	if (!name)
+		return -ENOMEM;
+
 	ret = pcim_iomap_regions(pdev, mask, name);
 	if (ret) {
 		SNET_ERR(pdev, "Failed to request and map PCI BARs\n");
@@ -590,10 +593,13 @@
 
 static int snet_open_vf_bar(struct pci_dev *pdev, struct snet *snet)
 {
-	char name[50];
+	char *name;
 	int ret;
 
-	snprintf(name, sizeof(name), "snet[%s]-bar", pci_name(pdev));
+	name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "snet[%s]-bars", pci_name(pdev));
+	if (!name)
+		return -ENOMEM;
+
 	/* Request and map BAR */
 	ret = pcim_iomap_regions(pdev, BIT(snet->psnet->cfg.vf_bar), name);
 	if (ret) {
--- linux-qcom-6.8.0.orig/drivers/vdpa/vdpa_sim/vdpa_sim.c
+++ linux-qcom-6.8.0/drivers/vdpa/vdpa_sim/vdpa_sim.c
@@ -160,7 +160,7 @@
 		}
 	}
 
-	vdpasim->running = true;
+	vdpasim->running = false;
 	spin_unlock(&vdpasim->iommu_lock);
 
 	vdpasim->features = 0;
@@ -483,6 +483,7 @@
 
 	mutex_lock(&vdpasim->mutex);
 	vdpasim->status = status;
+	vdpasim->running = (status & VIRTIO_CONFIG_S_DRIVER_OK) != 0;
 	mutex_unlock(&vdpasim->mutex);
 }
 
--- linux-qcom-6.8.0.orig/drivers/vdpa/vdpa_user/vduse_dev.c
+++ linux-qcom-6.8.0/drivers/vdpa/vdpa_user/vduse_dev.c
@@ -8,6 +8,7 @@
  *
  */
 
+#include "linux/virtio_net.h"
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/cdev.h>
@@ -28,6 +29,7 @@
 #include <uapi/linux/virtio_config.h>
 #include <uapi/linux/virtio_ids.h>
 #include <uapi/linux/virtio_blk.h>
+#include <uapi/linux/virtio_ring.h>
 #include <linux/mod_devicetable.h>
 
 #include "iova_domain.h"
@@ -1671,13 +1673,17 @@
 	return false;
 }
 
-static bool features_is_valid(u64 features)
+static bool features_is_valid(struct vduse_dev_config *config)
 {
-	if (!(features & (1ULL << VIRTIO_F_ACCESS_PLATFORM)))
+	if (!(config->features & BIT_ULL(VIRTIO_F_ACCESS_PLATFORM)))
 		return false;
 
 	/* Now we only support read-only configuration space */
-	if (features & (1ULL << VIRTIO_BLK_F_CONFIG_WCE))
+	if ((config->device_id == VIRTIO_ID_BLOCK) &&
+			(config->features & BIT_ULL(VIRTIO_BLK_F_CONFIG_WCE)))
+		return false;
+	else if ((config->device_id == VIRTIO_ID_NET) &&
+			(config->features & BIT_ULL(VIRTIO_NET_F_CTRL_VQ)))
 		return false;
 
 	return true;
@@ -1704,7 +1710,7 @@
 	if (!device_is_allowed(config->device_id))
 		return false;
 
-	if (!features_is_valid(config->features))
+	if (!features_is_valid(config))
 		return false;
 
 	return true;
--- linux-qcom-6.8.0.orig/drivers/vdpa/virtio_pci/vp_vdpa.c
+++ linux-qcom-6.8.0/drivers/vdpa/virtio_pci/vp_vdpa.c
@@ -591,7 +591,11 @@
 		goto mdev_err;
 	}
 
-	mdev_id = kzalloc(sizeof(struct virtio_device_id), GFP_KERNEL);
+	/*
+	 * id_table should be a null terminated array, so allocate one additional
+	 * entry here, see vdpa_mgmtdev_get_classes().
+	 */
+	mdev_id = kcalloc(2, sizeof(struct virtio_device_id), GFP_KERNEL);
 	if (!mdev_id) {
 		err = -ENOMEM;
 		goto mdev_id_err;
@@ -611,8 +615,8 @@
 		goto probe_err;
 	}
 
-	mdev_id->device = mdev->id.device;
-	mdev_id->vendor = mdev->id.vendor;
+	mdev_id[0].device = mdev->id.device;
+	mdev_id[0].vendor = mdev->id.vendor;
 	mgtdev->id_table = mdev_id;
 	mgtdev->max_supported_vqs = vp_modern_get_num_queues(mdev);
 	mgtdev->supported_features = vp_modern_get_features(mdev);
--- linux-qcom-6.8.0.orig/drivers/vfio/device_cdev.c
+++ linux-qcom-6.8.0/drivers/vfio/device_cdev.c
@@ -39,6 +39,13 @@
 
 	filep->private_data = df;
 
+	/*
+	 * Use the pseudo fs inode on the device to link all mmaps
+	 * to the same address space, allowing us to unmap all vmas
+	 * associated to this device using unmap_mapping_range().
+	 */
+	filep->f_mapping = device->inode->i_mapping;
+
 	return 0;
 
 err_put_registration:
--- linux-qcom-6.8.0.orig/drivers/vfio/fsl-mc/vfio_fsl_mc_intr.c
+++ linux-qcom-6.8.0/drivers/vfio/fsl-mc/vfio_fsl_mc_intr.c
@@ -141,13 +141,14 @@
 	irq = &vdev->mc_irqs[index];
 
 	if (flags & VFIO_IRQ_SET_DATA_NONE) {
-		vfio_fsl_mc_irq_handler(hwirq, irq);
+		if (irq->trigger)
+			eventfd_signal(irq->trigger);
 
 	} else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
 		u8 trigger = *(u8 *)data;
 
-		if (trigger)
-			vfio_fsl_mc_irq_handler(hwirq, irq);
+		if (trigger && irq->trigger)
+			eventfd_signal(irq->trigger);
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/vfio/group.c
+++ linux-qcom-6.8.0/drivers/vfio/group.c
@@ -286,6 +286,13 @@
 	 */
 	filep->f_mode |= (FMODE_PREAD | FMODE_PWRITE);
 
+	/*
+	 * Use the pseudo fs inode on the device to link all mmaps
+	 * to the same address space, allowing us to unmap all vmas
+	 * associated to this device using unmap_mapping_range().
+	 */
+	filep->f_mapping = device->inode->i_mapping;
+
 	if (device->group->type == VFIO_NO_IOMMU)
 		dev_warn(device->dev, "vfio-noiommu device opened by user "
 			 "(%s:%d)\n", current->comm, task_pid_nr(current));
--- linux-qcom-6.8.0.orig/drivers/vfio/pci/mlx5/cmd.c
+++ linux-qcom-6.8.0/drivers/vfio/pci/mlx5/cmd.c
@@ -1417,7 +1417,8 @@
 	struct mlx5_vhca_qp *host_qp;
 	struct mlx5_vhca_qp *fw_qp;
 	struct mlx5_core_dev *mdev;
-	u32 max_msg_size = PAGE_SIZE;
+	u32 log_max_msg_size;
+	u32 max_msg_size;
 	u64 rq_size = SZ_2M;
 	u32 max_recv_wr;
 	int err;
@@ -1434,6 +1435,12 @@
 	}
 
 	mdev = mvdev->mdev;
+	log_max_msg_size = MLX5_CAP_ADV_VIRTUALIZATION(mdev, pg_track_log_max_msg_size);
+	max_msg_size = (1ULL << log_max_msg_size);
+	/* The RQ must hold at least 4 WQEs/messages for successful QP creation */
+	if (rq_size < 4 * max_msg_size)
+		rq_size = 4 * max_msg_size;
+
 	memset(tracker, 0, sizeof(*tracker));
 	tracker->uar = mlx5_get_uars_page(mdev);
 	if (IS_ERR(tracker->uar)) {
@@ -1523,25 +1530,41 @@
 {
 	u32 entry_size = MLX5_ST_SZ_BYTES(page_track_report_entry);
 	u32 nent = size / entry_size;
+	u32 nent_in_page;
+	u32 nent_to_set;
 	struct page *page;
+	u32 page_offset;
+	u32 page_index;
+	u32 buf_offset;
+	void *kaddr;
 	u64 addr;
 	u64 *buf;
 	int i;
 
-	if (WARN_ON(index >= qp->recv_buf.npages ||
+	buf_offset = index * qp->max_msg_size;
+	if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
 		    (nent > qp->max_msg_size / entry_size)))
 		return;
 
-	page = qp->recv_buf.page_list[index];
-	buf = kmap_local_page(page);
-	for (i = 0; i < nent; i++) {
-		addr = MLX5_GET(page_track_report_entry, buf + i,
-				dirty_address_low);
-		addr |= (u64)MLX5_GET(page_track_report_entry, buf + i,
-				      dirty_address_high) << 32;
-		iova_bitmap_set(dirty, addr, qp->tracked_page_size);
-	}
-	kunmap_local(buf);
+	do {
+		page_index = buf_offset / PAGE_SIZE;
+		page_offset = buf_offset % PAGE_SIZE;
+		nent_in_page = (PAGE_SIZE - page_offset) / entry_size;
+		page = qp->recv_buf.page_list[page_index];
+		kaddr = kmap_local_page(page);
+		buf = kaddr + page_offset;
+		nent_to_set = min(nent, nent_in_page);
+		for (i = 0; i < nent_to_set; i++) {
+			addr = MLX5_GET(page_track_report_entry, buf + i,
+					dirty_address_low);
+			addr |= (u64)MLX5_GET(page_track_report_entry, buf + i,
+					      dirty_address_high) << 32;
+			iova_bitmap_set(dirty, addr, qp->tracked_page_size);
+		}
+		kunmap_local(kaddr);
+		buf_offset += (nent_to_set * entry_size);
+		nent -= nent_to_set;
+	} while (nent);
 }
 
 static void
--- linux-qcom-6.8.0.orig/drivers/vfio/pci/mlx5/main.c
+++ linux-qcom-6.8.0/drivers/vfio/pci/mlx5/main.c
@@ -73,6 +73,7 @@
 	unsigned long filled;
 	unsigned int to_fill;
 	int ret;
+	int i;
 
 	to_fill = min_t(unsigned int, npages, PAGE_SIZE / sizeof(*page_list));
 	page_list = kvzalloc(to_fill * sizeof(*page_list), GFP_KERNEL_ACCOUNT);
@@ -93,7 +94,7 @@
 			GFP_KERNEL_ACCOUNT);
 
 		if (ret)
-			goto err;
+			goto err_append;
 		buf->allocated_length += filled * PAGE_SIZE;
 		/* clean input for another bulk allocation */
 		memset(page_list, 0, filled * sizeof(*page_list));
@@ -104,6 +105,9 @@
 	kvfree(page_list);
 	return 0;
 
+err_append:
+	for (i = filled - 1; i >= 0; i--)
+		__free_page(page_list[i]);
 err:
 	kvfree(page_list);
 	return ret;
@@ -685,14 +689,11 @@
 					O_RDONLY);
 	if (IS_ERR(migf->filp)) {
 		ret = PTR_ERR(migf->filp);
-		goto end;
+		kfree(migf);
+		return ERR_PTR(ret);
 	}
 
 	migf->mvdev = mvdev;
-	ret = mlx5vf_cmd_alloc_pd(migf);
-	if (ret)
-		goto out_free;
-
 	stream_open(migf->filp->f_inode, migf->filp);
 	mutex_init(&migf->lock);
 	init_waitqueue_head(&migf->poll_wait);
@@ -708,6 +709,11 @@
 	INIT_LIST_HEAD(&migf->buf_list);
 	INIT_LIST_HEAD(&migf->avail_list);
 	spin_lock_init(&migf->list_lock);
+
+	ret = mlx5vf_cmd_alloc_pd(migf);
+	if (ret)
+		goto out;
+
 	ret = mlx5vf_cmd_query_vhca_migration_state(mvdev, &length, &full_size, 0);
 	if (ret)
 		goto out_pd;
@@ -737,10 +743,8 @@
 	mlx5vf_free_data_buffer(buf);
 out_pd:
 	mlx5fv_cmd_clean_migf_resources(migf);
-out_free:
+out:
 	fput(migf->filp);
-end:
-	kfree(migf);
 	return ERR_PTR(ret);
 }
 
@@ -1099,13 +1103,19 @@
 					O_WRONLY);
 	if (IS_ERR(migf->filp)) {
 		ret = PTR_ERR(migf->filp);
-		goto end;
+		kfree(migf);
+		return ERR_PTR(ret);
 	}
 
+	stream_open(migf->filp->f_inode, migf->filp);
+	mutex_init(&migf->lock);
+	INIT_LIST_HEAD(&migf->buf_list);
+	INIT_LIST_HEAD(&migf->avail_list);
+	spin_lock_init(&migf->list_lock);
 	migf->mvdev = mvdev;
 	ret = mlx5vf_cmd_alloc_pd(migf);
 	if (ret)
-		goto out_free;
+		goto out;
 
 	buf = mlx5vf_alloc_data_buffer(migf, 0, DMA_TO_DEVICE);
 	if (IS_ERR(buf)) {
@@ -1129,20 +1139,13 @@
 		migf->load_state = MLX5_VF_LOAD_STATE_READ_IMAGE_NO_HEADER;
 	}
 
-	stream_open(migf->filp->f_inode, migf->filp);
-	mutex_init(&migf->lock);
-	INIT_LIST_HEAD(&migf->buf_list);
-	INIT_LIST_HEAD(&migf->avail_list);
-	spin_lock_init(&migf->list_lock);
 	return migf;
 out_buf:
 	mlx5vf_free_data_buffer(migf->buf[0]);
 out_pd:
 	mlx5vf_cmd_dealloc_pd(migf);
-out_free:
+out:
 	fput(migf->filp);
-end:
-	kfree(migf);
 	return ERR_PTR(ret);
 }
 
--- linux-qcom-6.8.0.orig/drivers/vfio/pci/pds/lm.c
+++ linux-qcom-6.8.0/drivers/vfio/pci/pds/lm.c
@@ -92,8 +92,10 @@
 {
 	mutex_lock(&lm_file->lock);
 
+	lm_file->disabled = true;
 	lm_file->size = 0;
 	lm_file->alloc_size = 0;
+	lm_file->filep->f_pos = 0;
 
 	/* Free scatter list of file pages */
 	sg_free_table(&lm_file->sg_table);
@@ -183,6 +185,12 @@
 	pos = &filp->f_pos;
 
 	mutex_lock(&lm_file->lock);
+
+	if (lm_file->disabled) {
+		done = -ENODEV;
+		goto out_unlock;
+	}
+
 	if (*pos > lm_file->size) {
 		done = -EINVAL;
 		goto out_unlock;
@@ -283,6 +291,11 @@
 
 	mutex_lock(&lm_file->lock);
 
+	if (lm_file->disabled) {
+		done = -ENODEV;
+		goto out_unlock;
+	}
+
 	while (len) {
 		size_t page_offset;
 		struct page *page;
--- linux-qcom-6.8.0.orig/drivers/vfio/pci/pds/lm.h
+++ linux-qcom-6.8.0/drivers/vfio/pci/pds/lm.h
@@ -27,6 +27,7 @@
 	struct scatterlist *last_offset_sg;	/* Iterator */
 	unsigned int sg_last_entry;
 	unsigned long last_offset;
+	bool disabled;
 };
 
 struct pds_vfio_pci_device;
--- linux-qcom-6.8.0.orig/drivers/vfio/pci/pds/vfio_dev.c
+++ linux-qcom-6.8.0/drivers/vfio/pci/pds/vfio_dev.c
@@ -32,9 +32,9 @@
 	mutex_lock(&pds_vfio->reset_mutex);
 	if (pds_vfio->deferred_reset) {
 		pds_vfio->deferred_reset = false;
+		pds_vfio_put_restore_file(pds_vfio);
+		pds_vfio_put_save_file(pds_vfio);
 		if (pds_vfio->state == VFIO_DEVICE_STATE_ERROR) {
-			pds_vfio_put_restore_file(pds_vfio);
-			pds_vfio_put_save_file(pds_vfio);
 			pds_vfio_dirty_disable(pds_vfio, false);
 		}
 		pds_vfio->state = pds_vfio->deferred_reset_state;
--- linux-qcom-6.8.0.orig/drivers/vfio/pci/vfio_pci.c
+++ linux-qcom-6.8.0/drivers/vfio/pci/vfio_pci.c
@@ -71,6 +71,8 @@
 		case PCI_DEVICE_ID_INTEL_QAT_C62X_VF:
 		case PCI_DEVICE_ID_INTEL_QAT_DH895XCC:
 		case PCI_DEVICE_ID_INTEL_QAT_DH895XCC_VF:
+		case PCI_DEVICE_ID_INTEL_DSA_SPR0:
+		case PCI_DEVICE_ID_INTEL_IAX_SPR0:
 			return true;
 		default:
 			return false;
--- linux-qcom-6.8.0.orig/drivers/vfio/pci/vfio_pci_config.c
+++ linux-qcom-6.8.0/drivers/vfio/pci/vfio_pci_config.c
@@ -313,6 +313,10 @@
 	return count;
 }
 
+static struct perm_bits direct_ro_perms = {
+	.readfn = vfio_direct_config_read,
+};
+
 /* Default capability regions to read-only, no-virtualization */
 static struct perm_bits cap_perms[PCI_CAP_ID_MAX + 1] = {
 	[0 ... PCI_CAP_ID_MAX] = { .readfn = vfio_direct_config_read }
@@ -1897,9 +1901,17 @@
 		cap_start = *ppos;
 	} else {
 		if (*ppos >= PCI_CFG_SPACE_SIZE) {
-			WARN_ON(cap_id > PCI_EXT_CAP_ID_MAX);
+			/*
+			 * We can get a cap_id that exceeds PCI_EXT_CAP_ID_MAX
+			 * if we're hiding an unknown capability at the start
+			 * of the extended capability list.  Use default, ro
+			 * access, which will virtualize the id and next values.
+			 */
+			if (cap_id > PCI_EXT_CAP_ID_MAX)
+				perm = &direct_ro_perms;
+			else
+				perm = &ecap_perms[cap_id];
 
-			perm = &ecap_perms[cap_id];
 			cap_start = vfio_find_cap_start(vdev, *ppos);
 		} else {
 			WARN_ON(cap_id > PCI_CAP_ID_MAX);
--- linux-qcom-6.8.0.orig/drivers/vfio/pci/vfio_pci_core.c
+++ linux-qcom-6.8.0/drivers/vfio/pci/vfio_pci_core.c
@@ -778,25 +778,26 @@
 }
 
 struct vfio_pci_fill_info {
-	struct vfio_pci_dependent_device __user *devices;
-	struct vfio_pci_dependent_device __user *devices_end;
 	struct vfio_device *vdev;
+	struct vfio_pci_dependent_device *devices;
+	int nr_devices;
 	u32 count;
 	u32 flags;
 };
 
 static int vfio_pci_fill_devs(struct pci_dev *pdev, void *data)
 {
-	struct vfio_pci_dependent_device info = {
-		.segment = pci_domain_nr(pdev->bus),
-		.bus = pdev->bus->number,
-		.devfn = pdev->devfn,
-	};
+	struct vfio_pci_dependent_device *info;
 	struct vfio_pci_fill_info *fill = data;
 
-	fill->count++;
-	if (fill->devices >= fill->devices_end)
-		return 0;
+	/* The topology changed since we counted devices */
+	if (fill->count >= fill->nr_devices)
+		return -EAGAIN;
+
+	info = &fill->devices[fill->count++];
+	info->segment = pci_domain_nr(pdev->bus);
+	info->bus = pdev->bus->number;
+	info->devfn = pdev->devfn;
 
 	if (fill->flags & VFIO_PCI_HOT_RESET_FLAG_DEV_ID) {
 		struct iommufd_ctx *iommufd = vfio_iommufd_device_ictx(fill->vdev);
@@ -809,19 +810,19 @@
 		 */
 		vdev = vfio_find_device_in_devset(dev_set, &pdev->dev);
 		if (!vdev) {
-			info.devid = VFIO_PCI_DEVID_NOT_OWNED;
+			info->devid = VFIO_PCI_DEVID_NOT_OWNED;
 		} else {
 			int id = vfio_iommufd_get_dev_id(vdev, iommufd);
 
 			if (id > 0)
-				info.devid = id;
+				info->devid = id;
 			else if (id == -ENOENT)
-				info.devid = VFIO_PCI_DEVID_OWNED;
+				info->devid = VFIO_PCI_DEVID_OWNED;
 			else
-				info.devid = VFIO_PCI_DEVID_NOT_OWNED;
+				info->devid = VFIO_PCI_DEVID_NOT_OWNED;
 		}
 		/* If devid is VFIO_PCI_DEVID_NOT_OWNED, clear owned flag. */
-		if (info.devid == VFIO_PCI_DEVID_NOT_OWNED)
+		if (info->devid == VFIO_PCI_DEVID_NOT_OWNED)
 			fill->flags &= ~VFIO_PCI_HOT_RESET_FLAG_DEV_ID_OWNED;
 	} else {
 		struct iommu_group *iommu_group;
@@ -830,13 +831,10 @@
 		if (!iommu_group)
 			return -EPERM; /* Cannot reset non-isolated devices */
 
-		info.group_id = iommu_group_id(iommu_group);
+		info->group_id = iommu_group_id(iommu_group);
 		iommu_group_put(iommu_group);
 	}
 
-	if (copy_to_user(fill->devices, &info, sizeof(info)))
-		return -EFAULT;
-	fill->devices++;
 	return 0;
 }
 
@@ -1258,10 +1256,11 @@
 {
 	unsigned long minsz =
 		offsetofend(struct vfio_pci_hot_reset_info, count);
+	struct vfio_pci_dependent_device *devices = NULL;
 	struct vfio_pci_hot_reset_info hdr;
 	struct vfio_pci_fill_info fill = {};
 	bool slot = false;
-	int ret = 0;
+	int ret, count = 0;
 
 	if (copy_from_user(&hdr, arg, minsz))
 		return -EFAULT;
@@ -1277,9 +1276,23 @@
 	else if (pci_probe_reset_bus(vdev->pdev->bus))
 		return -ENODEV;
 
-	fill.devices = arg->devices;
-	fill.devices_end = arg->devices +
-			   (hdr.argsz - sizeof(hdr)) / sizeof(arg->devices[0]);
+	ret = vfio_pci_for_each_slot_or_bus(vdev->pdev, vfio_pci_count_devs,
+					    &count, slot);
+	if (ret)
+		return ret;
+
+	if (count > (hdr.argsz - sizeof(hdr)) / sizeof(*devices)) {
+		hdr.count = count;
+		ret = -ENOSPC;
+		goto header;
+	}
+
+	devices = kcalloc(count, sizeof(*devices), GFP_KERNEL);
+	if (!devices)
+		return -ENOMEM;
+
+	fill.devices = devices;
+	fill.nr_devices = count;
 	fill.vdev = &vdev->vdev;
 
 	if (vfio_device_cdev_opened(&vdev->vdev))
@@ -1291,16 +1304,23 @@
 					    &fill, slot);
 	mutex_unlock(&vdev->vdev.dev_set->lock);
 	if (ret)
-		return ret;
+		goto out;
+
+	if (copy_to_user(arg->devices, devices,
+			 sizeof(*devices) * fill.count)) {
+		ret = -EFAULT;
+		goto out;
+	}
 
 	hdr.count = fill.count;
 	hdr.flags = fill.flags;
-	if (copy_to_user(arg, &hdr, minsz))
-		return -EFAULT;
 
-	if (fill.count > fill.devices - arg->devices)
-		return -ENOSPC;
-	return 0;
+header:
+	if (copy_to_user(arg, &hdr, minsz))
+		ret = -EFAULT;
+out:
+	kfree(devices);
+	return ret;
 }
 
 static int
--- linux-qcom-6.8.0.orig/drivers/vfio/pci/vfio_pci_intrs.c
+++ linux-qcom-6.8.0/drivers/vfio/pci/vfio_pci_intrs.c
@@ -90,22 +90,28 @@
 
 	if (likely(is_intx(vdev) && !vdev->virq_disabled)) {
 		struct vfio_pci_irq_ctx *ctx;
+		struct eventfd_ctx *trigger;
 
 		ctx = vfio_irq_ctx_get(vdev, 0);
 		if (WARN_ON_ONCE(!ctx))
 			return;
-		eventfd_signal(ctx->trigger);
+
+		trigger = READ_ONCE(ctx->trigger);
+		if (likely(trigger))
+			eventfd_signal(trigger);
 	}
 }
 
 /* Returns true if the INTx vfio_pci_irq_ctx.masked value is changed. */
-bool vfio_pci_intx_mask(struct vfio_pci_core_device *vdev)
+static bool __vfio_pci_intx_mask(struct vfio_pci_core_device *vdev)
 {
 	struct pci_dev *pdev = vdev->pdev;
 	struct vfio_pci_irq_ctx *ctx;
 	unsigned long flags;
 	bool masked_changed = false;
 
+	lockdep_assert_held(&vdev->igate);
+
 	spin_lock_irqsave(&vdev->irqlock, flags);
 
 	/*
@@ -143,6 +149,17 @@
 	return masked_changed;
 }
 
+bool vfio_pci_intx_mask(struct vfio_pci_core_device *vdev)
+{
+	bool mask_changed;
+
+	mutex_lock(&vdev->igate);
+	mask_changed = __vfio_pci_intx_mask(vdev);
+	mutex_unlock(&vdev->igate);
+
+	return mask_changed;
+}
+
 /*
  * If this is triggered by an eventfd, we can't call eventfd_signal
  * or else we'll deadlock on the eventfd wait queue.  Return >0 when
@@ -194,12 +211,21 @@
 	return ret;
 }
 
-void vfio_pci_intx_unmask(struct vfio_pci_core_device *vdev)
+static void __vfio_pci_intx_unmask(struct vfio_pci_core_device *vdev)
 {
+	lockdep_assert_held(&vdev->igate);
+
 	if (vfio_pci_intx_unmask_handler(vdev, NULL) > 0)
 		vfio_send_intx_eventfd(vdev, NULL);
 }
 
+void vfio_pci_intx_unmask(struct vfio_pci_core_device *vdev)
+{
+	mutex_lock(&vdev->igate);
+	__vfio_pci_intx_unmask(vdev);
+	mutex_unlock(&vdev->igate);
+}
+
 static irqreturn_t vfio_intx_handler(int irq, void *dev_id)
 {
 	struct vfio_pci_core_device *vdev = dev_id;
@@ -231,97 +257,102 @@
 	return ret;
 }
 
-static int vfio_intx_enable(struct vfio_pci_core_device *vdev)
+static int vfio_intx_enable(struct vfio_pci_core_device *vdev,
+			    struct eventfd_ctx *trigger)
 {
+	struct pci_dev *pdev = vdev->pdev;
 	struct vfio_pci_irq_ctx *ctx;
+	unsigned long irqflags;
+	char *name;
+	int ret;
 
 	if (!is_irq_none(vdev))
 		return -EINVAL;
 
-	if (!vdev->pdev->irq)
+	if (!pdev->irq)
 		return -ENODEV;
 
+	name = kasprintf(GFP_KERNEL_ACCOUNT, "vfio-intx(%s)", pci_name(pdev));
+	if (!name)
+		return -ENOMEM;
+
 	ctx = vfio_irq_ctx_alloc(vdev, 0);
-	if (!ctx)
+	if (!ctx) {
+		kfree(name);
 		return -ENOMEM;
+	}
+
+	ctx->name = name;
+	ctx->trigger = trigger;
 
 	/*
-	 * If the virtual interrupt is masked, restore it.  Devices
-	 * supporting DisINTx can be masked at the hardware level
-	 * here, non-PCI-2.3 devices will have to wait until the
-	 * interrupt is enabled.
+	 * Fill the initial masked state based on virq_disabled.  After
+	 * enable, changing the DisINTx bit in vconfig directly changes INTx
+	 * masking.  igate prevents races during setup, once running masked
+	 * is protected via irqlock.
+	 *
+	 * Devices supporting DisINTx also reflect the current mask state in
+	 * the physical DisINTx bit, which is not affected during IRQ setup.
+	 *
+	 * Devices without DisINTx support require an exclusive interrupt.
+	 * IRQ masking is performed at the IRQ chip.  Again, igate protects
+	 * against races during setup and IRQ handlers and irqfds are not
+	 * yet active, therefore masked is stable and can be used to
+	 * conditionally auto-enable the IRQ.
+	 *
+	 * irq_type must be stable while the IRQ handler is registered,
+	 * therefore it must be set before request_irq().
 	 */
 	ctx->masked = vdev->virq_disabled;
-	if (vdev->pci_2_3)
-		pci_intx(vdev->pdev, !ctx->masked);
+	if (vdev->pci_2_3) {
+		pci_intx(pdev, !ctx->masked);
+		irqflags = IRQF_SHARED;
+	} else {
+		irqflags = ctx->masked ? IRQF_NO_AUTOEN : 0;
+	}
 
 	vdev->irq_type = VFIO_PCI_INTX_IRQ_INDEX;
 
+	ret = request_irq(pdev->irq, vfio_intx_handler,
+			  irqflags, ctx->name, vdev);
+	if (ret) {
+		vdev->irq_type = VFIO_PCI_NUM_IRQS;
+		kfree(name);
+		vfio_irq_ctx_free(vdev, ctx, 0);
+		return ret;
+	}
+
 	return 0;
 }
 
-static int vfio_intx_set_signal(struct vfio_pci_core_device *vdev, int fd)
+static int vfio_intx_set_signal(struct vfio_pci_core_device *vdev,
+				struct eventfd_ctx *trigger)
 {
 	struct pci_dev *pdev = vdev->pdev;
-	unsigned long irqflags = IRQF_SHARED;
 	struct vfio_pci_irq_ctx *ctx;
-	struct eventfd_ctx *trigger;
-	unsigned long flags;
-	int ret;
+	struct eventfd_ctx *old;
 
 	ctx = vfio_irq_ctx_get(vdev, 0);
 	if (WARN_ON_ONCE(!ctx))
 		return -EINVAL;
 
-	if (ctx->trigger) {
-		free_irq(pdev->irq, vdev);
-		kfree(ctx->name);
-		eventfd_ctx_put(ctx->trigger);
-		ctx->trigger = NULL;
-	}
-
-	if (fd < 0) /* Disable only */
-		return 0;
+	old = ctx->trigger;
 
-	ctx->name = kasprintf(GFP_KERNEL_ACCOUNT, "vfio-intx(%s)",
-			      pci_name(pdev));
-	if (!ctx->name)
-		return -ENOMEM;
+	WRITE_ONCE(ctx->trigger, trigger);
 
-	trigger = eventfd_ctx_fdget(fd);
-	if (IS_ERR(trigger)) {
-		kfree(ctx->name);
-		return PTR_ERR(trigger);
+	/* Releasing an old ctx requires synchronizing in-flight users */
+	if (old) {
+		synchronize_irq(pdev->irq);
+		vfio_virqfd_flush_thread(&ctx->unmask);
+		eventfd_ctx_put(old);
 	}
 
-	ctx->trigger = trigger;
-
-	if (!vdev->pci_2_3)
-		irqflags = 0;
-
-	ret = request_irq(pdev->irq, vfio_intx_handler,
-			  irqflags, ctx->name, vdev);
-	if (ret) {
-		ctx->trigger = NULL;
-		kfree(ctx->name);
-		eventfd_ctx_put(trigger);
-		return ret;
-	}
-
-	/*
-	 * INTx disable will stick across the new irq setup,
-	 * disable_irq won't.
-	 */
-	spin_lock_irqsave(&vdev->irqlock, flags);
-	if (!vdev->pci_2_3 && ctx->masked)
-		disable_irq_nosync(pdev->irq);
-	spin_unlock_irqrestore(&vdev->irqlock, flags);
-
 	return 0;
 }
 
 static void vfio_intx_disable(struct vfio_pci_core_device *vdev)
 {
+	struct pci_dev *pdev = vdev->pdev;
 	struct vfio_pci_irq_ctx *ctx;
 
 	ctx = vfio_irq_ctx_get(vdev, 0);
@@ -329,10 +360,13 @@
 	if (ctx) {
 		vfio_virqfd_disable(&ctx->unmask);
 		vfio_virqfd_disable(&ctx->mask);
+		free_irq(pdev->irq, vdev);
+		if (ctx->trigger)
+			eventfd_ctx_put(ctx->trigger);
+		kfree(ctx->name);
+		vfio_irq_ctx_free(vdev, ctx, 0);
 	}
-	vfio_intx_set_signal(vdev, -1);
 	vdev->irq_type = VFIO_PCI_NUM_IRQS;
-	vfio_irq_ctx_free(vdev, ctx, 0);
 }
 
 /*
@@ -560,11 +594,11 @@
 		return -EINVAL;
 
 	if (flags & VFIO_IRQ_SET_DATA_NONE) {
-		vfio_pci_intx_unmask(vdev);
+		__vfio_pci_intx_unmask(vdev);
 	} else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
 		uint8_t unmask = *(uint8_t *)data;
 		if (unmask)
-			vfio_pci_intx_unmask(vdev);
+			__vfio_pci_intx_unmask(vdev);
 	} else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
 		struct vfio_pci_irq_ctx *ctx = vfio_irq_ctx_get(vdev, 0);
 		int32_t fd = *(int32_t *)data;
@@ -591,11 +625,11 @@
 		return -EINVAL;
 
 	if (flags & VFIO_IRQ_SET_DATA_NONE) {
-		vfio_pci_intx_mask(vdev);
+		__vfio_pci_intx_mask(vdev);
 	} else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
 		uint8_t mask = *(uint8_t *)data;
 		if (mask)
-			vfio_pci_intx_mask(vdev);
+			__vfio_pci_intx_mask(vdev);
 	} else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
 		return -ENOTTY; /* XXX implement me */
 	}
@@ -616,19 +650,23 @@
 		return -EINVAL;
 
 	if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
+		struct eventfd_ctx *trigger = NULL;
 		int32_t fd = *(int32_t *)data;
 		int ret;
 
+		if (fd >= 0) {
+			trigger = eventfd_ctx_fdget(fd);
+			if (IS_ERR(trigger))
+				return PTR_ERR(trigger);
+		}
+
 		if (is_intx(vdev))
-			return vfio_intx_set_signal(vdev, fd);
+			ret = vfio_intx_set_signal(vdev, trigger);
+		else
+			ret = vfio_intx_enable(vdev, trigger);
 
-		ret = vfio_intx_enable(vdev);
-		if (ret)
-			return ret;
-
-		ret = vfio_intx_set_signal(vdev, fd);
-		if (ret)
-			vfio_intx_disable(vdev);
+		if (ret && trigger)
+			eventfd_ctx_put(trigger);
 
 		return ret;
 	}
--- linux-qcom-6.8.0.orig/drivers/vfio/platform/vfio_platform_irq.c
+++ linux-qcom-6.8.0/drivers/vfio/platform/vfio_platform_irq.c
@@ -136,6 +136,16 @@
 	return 0;
 }
 
+/*
+ * The trigger eventfd is guaranteed valid in the interrupt path
+ * and protected by the igate mutex when triggered via ioctl.
+ */
+static void vfio_send_eventfd(struct vfio_platform_irq *irq_ctx)
+{
+	if (likely(irq_ctx->trigger))
+		eventfd_signal(irq_ctx->trigger);
+}
+
 static irqreturn_t vfio_automasked_irq_handler(int irq, void *dev_id)
 {
 	struct vfio_platform_irq *irq_ctx = dev_id;
@@ -155,7 +165,7 @@
 	spin_unlock_irqrestore(&irq_ctx->lock, flags);
 
 	if (ret == IRQ_HANDLED)
-		eventfd_signal(irq_ctx->trigger);
+		vfio_send_eventfd(irq_ctx);
 
 	return ret;
 }
@@ -164,52 +174,40 @@
 {
 	struct vfio_platform_irq *irq_ctx = dev_id;
 
-	eventfd_signal(irq_ctx->trigger);
+	vfio_send_eventfd(irq_ctx);
 
 	return IRQ_HANDLED;
 }
 
 static int vfio_set_trigger(struct vfio_platform_device *vdev, int index,
-			    int fd, irq_handler_t handler)
+			    int fd)
 {
 	struct vfio_platform_irq *irq = &vdev->irqs[index];
 	struct eventfd_ctx *trigger;
-	int ret;
 
 	if (irq->trigger) {
-		irq_clear_status_flags(irq->hwirq, IRQ_NOAUTOEN);
-		free_irq(irq->hwirq, irq);
-		kfree(irq->name);
+		disable_irq(irq->hwirq);
 		eventfd_ctx_put(irq->trigger);
 		irq->trigger = NULL;
 	}
 
 	if (fd < 0) /* Disable only */
 		return 0;
-	irq->name = kasprintf(GFP_KERNEL_ACCOUNT, "vfio-irq[%d](%s)",
-			      irq->hwirq, vdev->name);
-	if (!irq->name)
-		return -ENOMEM;
 
 	trigger = eventfd_ctx_fdget(fd);
-	if (IS_ERR(trigger)) {
-		kfree(irq->name);
+	if (IS_ERR(trigger))
 		return PTR_ERR(trigger);
-	}
 
 	irq->trigger = trigger;
 
-	irq_set_status_flags(irq->hwirq, IRQ_NOAUTOEN);
-	ret = request_irq(irq->hwirq, handler, 0, irq->name, irq);
-	if (ret) {
-		kfree(irq->name);
-		eventfd_ctx_put(trigger);
-		irq->trigger = NULL;
-		return ret;
-	}
-
-	if (!irq->masked)
-		enable_irq(irq->hwirq);
+	/*
+	 * irq->masked effectively provides nested disables within the overall
+	 * enable relative to trigger.  Specifically request_irq() is called
+	 * with NO_AUTOEN, therefore the IRQ is initially disabled.  The user
+	 * may only further disable the IRQ with a MASK operations because
+	 * irq->masked is initially false.
+	 */
+	enable_irq(irq->hwirq);
 
 	return 0;
 }
@@ -228,7 +226,7 @@
 		handler = vfio_irq_handler;
 
 	if (!count && (flags & VFIO_IRQ_SET_DATA_NONE))
-		return vfio_set_trigger(vdev, index, -1, handler);
+		return vfio_set_trigger(vdev, index, -1);
 
 	if (start != 0 || count != 1)
 		return -EINVAL;
@@ -236,7 +234,7 @@
 	if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
 		int32_t fd = *(int32_t *)data;
 
-		return vfio_set_trigger(vdev, index, fd, handler);
+		return vfio_set_trigger(vdev, index, fd);
 	}
 
 	if (flags & VFIO_IRQ_SET_DATA_NONE) {
@@ -260,6 +258,14 @@
 		    unsigned start, unsigned count, uint32_t flags,
 		    void *data) = NULL;
 
+	/*
+	 * For compatibility, errors from request_irq() are local to the
+	 * SET_IRQS path and reflected in the name pointer.  This allows,
+	 * for example, polling mode fallback for an exclusive IRQ failure.
+	 */
+	if (IS_ERR(vdev->irqs[index].name))
+		return PTR_ERR(vdev->irqs[index].name);
+
 	switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
 	case VFIO_IRQ_SET_ACTION_MASK:
 		func = vfio_platform_set_irq_mask;
@@ -280,7 +286,7 @@
 
 int vfio_platform_irq_init(struct vfio_platform_device *vdev)
 {
-	int cnt = 0, i;
+	int cnt = 0, i, ret = 0;
 
 	while (vdev->get_irq(vdev, cnt) >= 0)
 		cnt++;
@@ -292,37 +298,70 @@
 
 	for (i = 0; i < cnt; i++) {
 		int hwirq = vdev->get_irq(vdev, i);
+		irq_handler_t handler = vfio_irq_handler;
 
-		if (hwirq < 0)
+		if (hwirq < 0) {
+			ret = -EINVAL;
 			goto err;
+		}
 
 		spin_lock_init(&vdev->irqs[i].lock);
 
 		vdev->irqs[i].flags = VFIO_IRQ_INFO_EVENTFD;
 
-		if (irq_get_trigger_type(hwirq) & IRQ_TYPE_LEVEL_MASK)
+		if (irq_get_trigger_type(hwirq) & IRQ_TYPE_LEVEL_MASK) {
 			vdev->irqs[i].flags |= VFIO_IRQ_INFO_MASKABLE
 						| VFIO_IRQ_INFO_AUTOMASKED;
+			handler = vfio_automasked_irq_handler;
+		}
 
 		vdev->irqs[i].count = 1;
 		vdev->irqs[i].hwirq = hwirq;
 		vdev->irqs[i].masked = false;
+		vdev->irqs[i].name = kasprintf(GFP_KERNEL_ACCOUNT,
+					       "vfio-irq[%d](%s)", hwirq,
+					       vdev->name);
+		if (!vdev->irqs[i].name) {
+			ret = -ENOMEM;
+			goto err;
+		}
+
+		ret = request_irq(hwirq, handler, IRQF_NO_AUTOEN,
+				  vdev->irqs[i].name, &vdev->irqs[i]);
+		if (ret) {
+			kfree(vdev->irqs[i].name);
+			vdev->irqs[i].name = ERR_PTR(ret);
+		}
 	}
 
 	vdev->num_irqs = cnt;
 
 	return 0;
 err:
+	for (--i; i >= 0; i--) {
+		if (!IS_ERR(vdev->irqs[i].name)) {
+			free_irq(vdev->irqs[i].hwirq, &vdev->irqs[i]);
+			kfree(vdev->irqs[i].name);
+		}
+	}
 	kfree(vdev->irqs);
-	return -EINVAL;
+	return ret;
 }
 
 void vfio_platform_irq_cleanup(struct vfio_platform_device *vdev)
 {
 	int i;
 
-	for (i = 0; i < vdev->num_irqs; i++)
-		vfio_set_trigger(vdev, i, -1, NULL);
+	for (i = 0; i < vdev->num_irqs; i++) {
+		vfio_virqfd_disable(&vdev->irqs[i].mask);
+		vfio_virqfd_disable(&vdev->irqs[i].unmask);
+		if (!IS_ERR(vdev->irqs[i].name)) {
+			free_irq(vdev->irqs[i].hwirq, &vdev->irqs[i]);
+			if (vdev->irqs[i].trigger)
+				eventfd_ctx_put(vdev->irqs[i].trigger);
+			kfree(vdev->irqs[i].name);
+		}
+	}
 
 	vdev->num_irqs = 0;
 	kfree(vdev->irqs);
--- linux-qcom-6.8.0.orig/drivers/vfio/vfio_iommu_spapr_tce.c
+++ linux-qcom-6.8.0/drivers/vfio/vfio_iommu_spapr_tce.c
@@ -364,7 +364,6 @@
 		if (!tbl)
 			continue;
 
-		tce_iommu_clear(container, tbl, tbl->it_offset, tbl->it_size);
 		tce_iommu_free_table(container, tbl);
 	}
 
@@ -720,6 +719,8 @@
 
 	BUG_ON(!tbl->it_size);
 
+	tce_iommu_clear(container, tbl, tbl->it_offset, tbl->it_size);
+
 	/* Detach groups from IOMMUs */
 	list_for_each_entry(tcegrp, &container->group_list, next) {
 		table_group = iommu_group_get_iommudata(tcegrp->grp);
@@ -738,7 +739,6 @@
 	}
 
 	/* Free table */
-	tce_iommu_clear(container, tbl, tbl->it_offset, tbl->it_size);
 	tce_iommu_free_table(container, tbl);
 	container->tables[num] = NULL;
 
@@ -1197,9 +1197,14 @@
 		return;
 	}
 
-	for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i)
-		if (container->tables[i])
+	for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) {
+		if (container->tables[i]) {
+			tce_iommu_clear(container, container->tables[i],
+					container->tables[i]->it_offset,
+					container->tables[i]->it_size);
 			table_group->ops->unset_window(table_group, i);
+		}
+	}
 }
 
 static long tce_iommu_take_ownership(struct tce_container *container,
--- linux-qcom-6.8.0.orig/drivers/vfio/vfio_main.c
+++ linux-qcom-6.8.0/drivers/vfio/vfio_main.c
@@ -22,8 +22,10 @@
 #include <linux/list.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
+#include <linux/mount.h>
 #include <linux/mutex.h>
 #include <linux/pci.h>
+#include <linux/pseudo_fs.h>
 #include <linux/rwsem.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -43,9 +45,13 @@
 #define DRIVER_AUTHOR	"Alex Williamson <alex.williamson@redhat.com>"
 #define DRIVER_DESC	"VFIO - User Level meta-driver"
 
+#define VFIO_MAGIC 0x5646494f /* "VFIO" */
+
 static struct vfio {
 	struct class			*device_class;
 	struct ida			device_ida;
+	struct vfsmount			*vfs_mount;
+	int				fs_count;
 } vfio;
 
 #ifdef CONFIG_VFIO_NOIOMMU
@@ -186,6 +192,8 @@
 	if (device->ops->release)
 		device->ops->release(device);
 
+	iput(device->inode);
+	simple_release_fs(&vfio.vfs_mount, &vfio.fs_count);
 	kvfree(device);
 }
 
@@ -228,6 +236,34 @@
 }
 EXPORT_SYMBOL_GPL(_vfio_alloc_device);
 
+static int vfio_fs_init_fs_context(struct fs_context *fc)
+{
+	return init_pseudo(fc, VFIO_MAGIC) ? 0 : -ENOMEM;
+}
+
+static struct file_system_type vfio_fs_type = {
+	.name = "vfio",
+	.owner = THIS_MODULE,
+	.init_fs_context = vfio_fs_init_fs_context,
+	.kill_sb = kill_anon_super,
+};
+
+static struct inode *vfio_fs_inode_new(void)
+{
+	struct inode *inode;
+	int ret;
+
+	ret = simple_pin_fs(&vfio_fs_type, &vfio.vfs_mount, &vfio.fs_count);
+	if (ret)
+		return ERR_PTR(ret);
+
+	inode = alloc_anon_inode(vfio.vfs_mount->mnt_sb);
+	if (IS_ERR(inode))
+		simple_release_fs(&vfio.vfs_mount, &vfio.fs_count);
+
+	return inode;
+}
+
 /*
  * Initialize a vfio_device so it can be registered to vfio core.
  */
@@ -246,6 +282,11 @@
 	init_completion(&device->comp);
 	device->dev = dev;
 	device->ops = ops;
+	device->inode = vfio_fs_inode_new();
+	if (IS_ERR(device->inode)) {
+		ret = PTR_ERR(device->inode);
+		goto out_inode;
+	}
 
 	if (ops->init) {
 		ret = ops->init(device);
@@ -260,6 +301,9 @@
 	return 0;
 
 out_uninit:
+	iput(device->inode);
+	simple_release_fs(&vfio.vfs_mount, &vfio.fs_count);
+out_inode:
 	vfio_release_device_set(device);
 	ida_free(&vfio.device_ida, device->index);
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/vfio/virqfd.c
+++ linux-qcom-6.8.0/drivers/vfio/virqfd.c
@@ -101,6 +101,13 @@
 		virqfd->thread(virqfd->opaque, virqfd->data);
 }
 
+static void virqfd_flush_inject(struct work_struct *work)
+{
+	struct virqfd *virqfd = container_of(work, struct virqfd, flush_inject);
+
+	flush_work(&virqfd->inject);
+}
+
 int vfio_virqfd_enable(void *opaque,
 		       int (*handler)(void *, void *),
 		       void (*thread)(void *, void *),
@@ -124,6 +131,7 @@
 
 	INIT_WORK(&virqfd->shutdown, virqfd_shutdown);
 	INIT_WORK(&virqfd->inject, virqfd_inject);
+	INIT_WORK(&virqfd->flush_inject, virqfd_flush_inject);
 
 	irqfd = fdget(fd);
 	if (!irqfd.file) {
@@ -213,3 +221,16 @@
 	flush_workqueue(vfio_irqfd_cleanup_wq);
 }
 EXPORT_SYMBOL_GPL(vfio_virqfd_disable);
+
+void vfio_virqfd_flush_thread(struct virqfd **pvirqfd)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&virqfd_lock, flags);
+	if (*pvirqfd && (*pvirqfd)->thread)
+		queue_work(vfio_irqfd_cleanup_wq, &(*pvirqfd)->flush_inject);
+	spin_unlock_irqrestore(&virqfd_lock, flags);
+
+	flush_workqueue(vfio_irqfd_cleanup_wq);
+}
+EXPORT_SYMBOL_GPL(vfio_virqfd_flush_thread);
--- linux-qcom-6.8.0.orig/drivers/vhost/scsi.c
+++ linux-qcom-6.8.0/drivers/vhost/scsi.c
@@ -497,10 +497,8 @@
 		vq_err(vq, "Faulted on vhost_scsi_send_event\n");
 }
 
-static void vhost_scsi_evt_work(struct vhost_work *work)
+static void vhost_scsi_complete_events(struct vhost_scsi *vs, bool drop)
 {
-	struct vhost_scsi *vs = container_of(work, struct vhost_scsi,
-					vs_event_work);
 	struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
 	struct vhost_scsi_evt *evt, *t;
 	struct llist_node *llnode;
@@ -508,12 +506,20 @@
 	mutex_lock(&vq->mutex);
 	llnode = llist_del_all(&vs->vs_event_list);
 	llist_for_each_entry_safe(evt, t, llnode, list) {
-		vhost_scsi_do_evt_work(vs, evt);
+		if (!drop)
+			vhost_scsi_do_evt_work(vs, evt);
 		vhost_scsi_free_evt(vs, evt);
 	}
 	mutex_unlock(&vq->mutex);
 }
 
+static void vhost_scsi_evt_work(struct vhost_work *work)
+{
+	struct vhost_scsi *vs = container_of(work, struct vhost_scsi,
+					     vs_event_work);
+	vhost_scsi_complete_events(vs, false);
+}
+
 static int vhost_scsi_copy_sgl_to_iov(struct vhost_scsi_cmd *cmd)
 {
 	struct iov_iter *iter = &cmd->saved_iter;
@@ -1012,20 +1018,23 @@
 		/* virtio-scsi spec requires byte 0 of the lun to be 1 */
 		vq_err(vq, "Illegal virtio-scsi lun: %u\n", *vc->lunp);
 	} else {
-		struct vhost_scsi_tpg **vs_tpg, *tpg;
+		struct vhost_scsi_tpg **vs_tpg, *tpg = NULL;
 
-		vs_tpg = vhost_vq_get_backend(vq);	/* validated at handler entry */
-
-		tpg = READ_ONCE(vs_tpg[*vc->target]);
-		if (unlikely(!tpg)) {
-			vq_err(vq, "Target 0x%x does not exist\n", *vc->target);
-		} else {
-			if (tpgp)
-				*tpgp = tpg;
-			ret = 0;
+		if (vc->target) {
+			/* validated at handler entry */
+			vs_tpg = vhost_vq_get_backend(vq);
+			tpg = READ_ONCE(vs_tpg[*vc->target]);
+			if (unlikely(!tpg)) {
+				vq_err(vq, "Target 0x%x does not exist\n", *vc->target);
+				goto out;
+			}
 		}
-	}
 
+		if (tpgp)
+			*tpgp = tpg;
+		ret = 0;
+	}
+out:
 	return ret;
 }
 
@@ -1509,7 +1518,8 @@
 	}
 
 	llist_add(&evt->list, &vs->vs_event_list);
-	vhost_vq_work_queue(vq, &vs->vs_event_work);
+	if (!vhost_vq_work_queue(vq, &vs->vs_event_work))
+		vhost_scsi_complete_events(vs, true);
 }
 
 static void vhost_scsi_evt_handle_kick(struct vhost_work *work)
--- linux-qcom-6.8.0.orig/drivers/vhost/vdpa.c
+++ linux-qcom-6.8.0/drivers/vhost/vdpa.c
@@ -209,11 +209,9 @@
 	if (irq < 0)
 		return;
 
-	irq_bypass_unregister_producer(&vq->call_ctx.producer);
 	if (!vq->call_ctx.ctx)
 		return;
 
-	vq->call_ctx.producer.token = vq->call_ctx.ctx;
 	vq->call_ctx.producer.irq = irq;
 	ret = irq_bypass_register_producer(&vq->call_ctx.producer);
 	if (unlikely(ret))
@@ -695,6 +693,14 @@
 			vq->last_avail_idx = vq_state.split.avail_index;
 		}
 		break;
+	case VHOST_SET_VRING_CALL:
+		if (vq->call_ctx.ctx) {
+			if (ops->get_status(vdpa) &
+			    VIRTIO_CONFIG_S_DRIVER_OK)
+				vhost_vdpa_unsetup_vq_irq(v, idx);
+			vq->call_ctx.producer.token = NULL;
+		}
+		break;
 	}
 
 	r = vhost_vring_ioctl(&v->vdev, cmd, argp);
@@ -733,13 +739,16 @@
 			cb.callback = vhost_vdpa_virtqueue_cb;
 			cb.private = vq;
 			cb.trigger = vq->call_ctx.ctx;
+			vq->call_ctx.producer.token = vq->call_ctx.ctx;
+			if (ops->get_status(vdpa) &
+			    VIRTIO_CONFIG_S_DRIVER_OK)
+				vhost_vdpa_setup_vq_irq(v, idx);
 		} else {
 			cb.callback = NULL;
 			cb.private = NULL;
 			cb.trigger = NULL;
 		}
 		ops->set_vq_cb(vdpa, idx, &cb);
-		vhost_vdpa_setup_vq_irq(v, idx);
 		break;
 
 	case VHOST_SET_VRING_NUM:
@@ -1407,6 +1416,7 @@
 	for (i = 0; i < nvqs; i++) {
 		vqs[i] = &v->vqs[i];
 		vqs[i]->handle_kick = handle_vq_kick;
+		vqs[i]->call_ctx.ctx = NULL;
 	}
 	vhost_dev_init(dev, vqs, nvqs, 0, 0, 0, false,
 		       vhost_vdpa_process_iotlb_msg);
@@ -1469,13 +1479,7 @@
 
 	notify = ops->get_vq_notification(vdpa, index);
 
-	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-	if (remap_pfn_range(vma, vmf->address & PAGE_MASK,
-			    PFN_DOWN(notify.addr), PAGE_SIZE,
-			    vma->vm_page_prot))
-		return VM_FAULT_SIGBUS;
-
-	return VM_FAULT_NOPAGE;
+	return vmf_insert_pfn(vma, vmf->address & PAGE_MASK, PFN_DOWN(notify.addr));
 }
 
 static const struct vm_operations_struct vhost_vdpa_vm_ops = {
--- linux-qcom-6.8.0.orig/drivers/vhost/vhost.c
+++ linux-qcom-6.8.0/drivers/vhost/vhost.c
@@ -276,21 +276,36 @@
 EXPORT_SYMBOL_GPL(vhost_vq_flush);
 
 /**
- * vhost_worker_flush - flush a worker
+ * __vhost_worker_flush - flush a worker
  * @worker: worker to flush
  *
- * This does not use RCU to protect the worker, so the device or worker
- * mutex must be held.
+ * The worker's flush_mutex must be held.
  */
-static void vhost_worker_flush(struct vhost_worker *worker)
+static void __vhost_worker_flush(struct vhost_worker *worker)
 {
 	struct vhost_flush_struct flush;
 
+	if (!worker->attachment_cnt || worker->killed)
+		return;
+
 	init_completion(&flush.wait_event);
 	vhost_work_init(&flush.work, vhost_flush_work);
 
 	vhost_worker_queue(worker, &flush.work);
+	/*
+	 * Drop mutex in case our worker is killed and it needs to take the
+	 * mutex to force cleanup.
+	 */
+	mutex_unlock(&worker->mutex);
 	wait_for_completion(&flush.wait_event);
+	mutex_lock(&worker->mutex);
+}
+
+static void vhost_worker_flush(struct vhost_worker *worker)
+{
+	mutex_lock(&worker->mutex);
+	__vhost_worker_flush(worker);
+	mutex_unlock(&worker->mutex);
 }
 
 void vhost_dev_flush(struct vhost_dev *dev)
@@ -298,15 +313,8 @@
 	struct vhost_worker *worker;
 	unsigned long i;
 
-	xa_for_each(&dev->worker_xa, i, worker) {
-		mutex_lock(&worker->mutex);
-		if (!worker->attachment_cnt) {
-			mutex_unlock(&worker->mutex);
-			continue;
-		}
+	xa_for_each(&dev->worker_xa, i, worker)
 		vhost_worker_flush(worker);
-		mutex_unlock(&worker->mutex);
-	}
 }
 EXPORT_SYMBOL_GPL(vhost_dev_flush);
 
@@ -392,7 +400,7 @@
 	__vhost_vq_meta_reset(vq);
 }
 
-static bool vhost_worker(void *data)
+static bool vhost_run_work_list(void *data)
 {
 	struct vhost_worker *worker = data;
 	struct vhost_work *work, *work_next;
@@ -417,6 +425,40 @@
 	return !!node;
 }
 
+static void vhost_worker_killed(void *data)
+{
+	struct vhost_worker *worker = data;
+	struct vhost_dev *dev = worker->dev;
+	struct vhost_virtqueue *vq;
+	int i, attach_cnt = 0;
+
+	mutex_lock(&worker->mutex);
+	worker->killed = true;
+
+	for (i = 0; i < dev->nvqs; i++) {
+		vq = dev->vqs[i];
+
+		mutex_lock(&vq->mutex);
+		if (worker ==
+		    rcu_dereference_check(vq->worker,
+					  lockdep_is_held(&vq->mutex))) {
+			rcu_assign_pointer(vq->worker, NULL);
+			attach_cnt++;
+		}
+		mutex_unlock(&vq->mutex);
+	}
+
+	worker->attachment_cnt -= attach_cnt;
+	if (attach_cnt)
+		synchronize_rcu();
+	/*
+	 * Finish vhost_worker_flush calls and any other works that snuck in
+	 * before the synchronize_rcu.
+	 */
+	vhost_run_work_list(worker);
+	mutex_unlock(&worker->mutex);
+}
+
 static void vhost_vq_free_iovecs(struct vhost_virtqueue *vq)
 {
 	kfree(vq->indirect);
@@ -631,10 +673,12 @@
 	if (!worker)
 		return NULL;
 
+	worker->dev = dev;
 	snprintf(name, sizeof(name), "vhost-%d", current->pid);
 
-	vtsk = vhost_task_create(vhost_worker, worker, name);
-	if (!vtsk)
+	vtsk = vhost_task_create(vhost_run_work_list, vhost_worker_killed,
+				 worker, name);
+	if (IS_ERR(vtsk))
 		goto free_worker;
 
 	mutex_init(&worker->mutex);
@@ -664,22 +708,37 @@
 {
 	struct vhost_worker *old_worker;
 
-	old_worker = rcu_dereference_check(vq->worker,
-					   lockdep_is_held(&vq->dev->mutex));
-
 	mutex_lock(&worker->mutex);
-	worker->attachment_cnt++;
-	mutex_unlock(&worker->mutex);
+	if (worker->killed) {
+		mutex_unlock(&worker->mutex);
+		return;
+	}
+
+	mutex_lock(&vq->mutex);
+
+	old_worker = rcu_dereference_check(vq->worker,
+					   lockdep_is_held(&vq->mutex));
 	rcu_assign_pointer(vq->worker, worker);
+	worker->attachment_cnt++;
 
-	if (!old_worker)
+	if (!old_worker) {
+		mutex_unlock(&vq->mutex);
+		mutex_unlock(&worker->mutex);
 		return;
+	}
+	mutex_unlock(&vq->mutex);
+	mutex_unlock(&worker->mutex);
+
 	/*
 	 * Take the worker mutex to make sure we see the work queued from
 	 * device wide flushes which doesn't use RCU for execution.
 	 */
 	mutex_lock(&old_worker->mutex);
-	old_worker->attachment_cnt--;
+	if (old_worker->killed) {
+		mutex_unlock(&old_worker->mutex);
+		return;
+	}
+
 	/*
 	 * We don't want to call synchronize_rcu for every vq during setup
 	 * because it will slow down VM startup. If we haven't done
@@ -690,6 +749,8 @@
 	mutex_lock(&vq->mutex);
 	if (!vhost_vq_get_backend(vq) && !vq->kick) {
 		mutex_unlock(&vq->mutex);
+
+		old_worker->attachment_cnt--;
 		mutex_unlock(&old_worker->mutex);
 		/*
 		 * vsock can queue anytime after VHOST_VSOCK_SET_GUEST_CID.
@@ -705,7 +766,8 @@
 	/* Make sure new vq queue/flush/poll calls see the new worker */
 	synchronize_rcu();
 	/* Make sure whatever was queued gets run */
-	vhost_worker_flush(old_worker);
+	__vhost_worker_flush(old_worker);
+	old_worker->attachment_cnt--;
 	mutex_unlock(&old_worker->mutex);
 }
 
@@ -754,10 +816,16 @@
 		return -ENODEV;
 
 	mutex_lock(&worker->mutex);
-	if (worker->attachment_cnt) {
+	if (worker->attachment_cnt || worker->killed) {
 		mutex_unlock(&worker->mutex);
 		return -EBUSY;
 	}
+	/*
+	 * A flush might have raced and snuck in before attachment_cnt was set
+	 * to zero. Make sure flushes are flushed from the queue before
+	 * freeing.
+	 */
+	__vhost_worker_flush(worker);
 	mutex_unlock(&worker->mutex);
 
 	vhost_worker_destroy(dev, worker);
@@ -2799,9 +2867,19 @@
 	r = vhost_get_avail_idx(vq, &avail_idx);
 	if (unlikely(r))
 		return false;
+
 	vq->avail_idx = vhost16_to_cpu(vq, avail_idx);
+	if (vq->avail_idx != vq->last_avail_idx) {
+		/* Since we have updated avail_idx, the following
+		 * call to vhost_get_vq_desc() will read available
+		 * ring entries. Make sure that read happens after
+		 * the avail_idx read.
+		 */
+		smp_rmb();
+		return false;
+	}
 
-	return vq->avail_idx == vq->last_avail_idx;
+	return true;
 }
 EXPORT_SYMBOL_GPL(vhost_vq_avail_empty);
 
@@ -2838,9 +2916,19 @@
 		       &vq->avail->idx, r);
 		return false;
 	}
+
 	vq->avail_idx = vhost16_to_cpu(vq, avail_idx);
+	if (vq->avail_idx != vq->last_avail_idx) {
+		/* Since we have updated avail_idx, the following
+		 * call to vhost_get_vq_desc() will read available
+		 * ring entries. Make sure that read happens after
+		 * the avail_idx read.
+		 */
+		smp_rmb();
+		return true;
+	}
 
-	return vq->avail_idx != vq->last_avail_idx;
+	return false;
 }
 EXPORT_SYMBOL_GPL(vhost_enable_notify);
 
--- linux-qcom-6.8.0.orig/drivers/vhost/vhost.h
+++ linux-qcom-6.8.0/drivers/vhost/vhost.h
@@ -28,12 +28,14 @@
 
 struct vhost_worker {
 	struct vhost_task	*vtsk;
+	struct vhost_dev	*dev;
 	/* Used to serialize device wide flushing with worker swapping. */
 	struct mutex		mutex;
 	struct llist_head	work_list;
 	u64			kcov_handle;
 	u32			id;
 	int			attachment_cnt;
+	bool			killed;
 };
 
 /* Poll a file (eventfd or socket) */
--- linux-qcom-6.8.0.orig/drivers/vhost/vsock.c
+++ linux-qcom-6.8.0/drivers/vhost/vsock.c
@@ -667,6 +667,7 @@
 	}
 
 	vsock->guest_cid = 0; /* no CID assigned yet */
+	vsock->seqpacket_allow = false;
 
 	atomic_set(&vsock->queued_replies, 0);
 
@@ -810,8 +811,7 @@
 			goto err;
 	}
 
-	if (features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET))
-		vsock->seqpacket_allow = true;
+	vsock->seqpacket_allow = features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET);
 
 	for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) {
 		vq = &vsock->vqs[i];
--- linux-qcom-6.8.0.orig/drivers/video/Kconfig
+++ linux-qcom-6.8.0/drivers/video/Kconfig
@@ -11,6 +11,10 @@
 	  Support tracking and hand-over of aperture ownership. Required
 	  by graphics drivers for firmware-provided framebuffers.
 
+config SCREEN_INFO
+	bool
+	default n
+
 config STI_CORE
 	bool
 	depends on PARISC
--- linux-qcom-6.8.0.orig/drivers/video/Makefile
+++ linux-qcom-6.8.0/drivers/video/Makefile
@@ -1,12 +1,16 @@
 # SPDX-License-Identifier: GPL-2.0
 
 obj-$(CONFIG_APERTURE_HELPERS)    += aperture.o
+obj-$(CONFIG_SCREEN_INFO)         += screen_info.o
 obj-$(CONFIG_STI_CORE)            += sticore.o
 obj-$(CONFIG_VGASTATE)            += vgastate.o
 obj-$(CONFIG_VIDEO_CMDLINE)       += cmdline.o
 obj-$(CONFIG_VIDEO_NOMODESET)     += nomodeset.o
 obj-$(CONFIG_HDMI)                += hdmi.o
 
+screen_info-y			  := screen_info_generic.o
+screen_info-$(CONFIG_PCI)         += screen_info_pci.o
+
 obj-$(CONFIG_VT)		  += console/
 obj-$(CONFIG_FB_STI)		  += console/
 obj-$(CONFIG_LOGO)		  += logo/
--- linux-qcom-6.8.0.orig/drivers/video/aperture.c
+++ linux-qcom-6.8.0/drivers/video/aperture.c
@@ -293,7 +293,7 @@
 	 * ask for this, so let's assume that a real driver for the display
 	 * was already probed and prevent sysfb to register devices later.
 	 */
-	sysfb_disable();
+	sysfb_disable(NULL);
 
 	aperture_detach_devices(base, size);
 
@@ -346,15 +346,10 @@
  */
 int aperture_remove_conflicting_pci_devices(struct pci_dev *pdev, const char *name)
 {
-	bool primary = false;
 	resource_size_t base, size;
 	int bar, ret = 0;
 
-	if (pdev == vga_default_device())
-		primary = true;
-
-	if (primary)
-		sysfb_disable();
+	sysfb_disable(&pdev->dev);
 
 	for (bar = 0; bar < PCI_STD_NUM_BARS; ++bar) {
 		if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM))
@@ -370,7 +365,7 @@
 	 * that consumes the VGA framebuffer I/O range. Remove this
 	 * device as well.
 	 */
-	if (primary)
+	if (pdev == vga_default_device())
 		ret = __aperture_remove_legacy_vga_devices(pdev);
 
 	return ret;
--- linux-qcom-6.8.0.orig/drivers/video/backlight/da9052_bl.c
+++ linux-qcom-6.8.0/drivers/video/backlight/da9052_bl.c
@@ -117,6 +117,7 @@
 	wleds->led_reg = platform_get_device_id(pdev)->driver_data;
 	wleds->state = DA9052_WLEDS_OFF;
 
+	memset(&props, 0, sizeof(struct backlight_properties));
 	props.type = BACKLIGHT_RAW;
 	props.max_brightness = DA9052_MAX_BRIGHTNESS;
 
--- linux-qcom-6.8.0.orig/drivers/video/backlight/hx8357.c
+++ linux-qcom-6.8.0/drivers/video/backlight/hx8357.c
@@ -609,11 +609,13 @@
 	lcd->im_pins = devm_gpiod_get_array_optional(dev, "im", GPIOD_OUT_LOW);
 	if (IS_ERR(lcd->im_pins))
 		return dev_err_probe(dev, PTR_ERR(lcd->im_pins), "failed to request im GPIOs\n");
-	if (lcd->im_pins->ndescs < HX8357_NUM_IM_PINS)
-		return dev_err_probe(dev, -EINVAL, "not enough im GPIOs\n");
+	if (lcd->im_pins) {
+		if (lcd->im_pins->ndescs < HX8357_NUM_IM_PINS)
+			return dev_err_probe(dev, -EINVAL, "not enough im GPIOs\n");
 
-	for (i = 0; i < HX8357_NUM_IM_PINS; i++)
-		gpiod_set_consumer_name(lcd->im_pins->desc[i], "im_pins");
+		for (i = 0; i < HX8357_NUM_IM_PINS; i++)
+			gpiod_set_consumer_name(lcd->im_pins->desc[i], "im_pins");
+	}
 
 	lcdev = devm_lcd_device_register(&spi->dev, "mxsfb", &spi->dev, lcd,
 					&hx8357_ops);
--- linux-qcom-6.8.0.orig/drivers/video/backlight/ktz8866.c
+++ linux-qcom-6.8.0/drivers/video/backlight/ktz8866.c
@@ -97,20 +97,20 @@
 {
 	unsigned int val = 0;
 
-	if (of_property_read_u32(ktz->client->dev.of_node, "current-num-sinks", &val))
+	if (!of_property_read_u32(ktz->client->dev.of_node, "current-num-sinks", &val))
 		ktz8866_write(ktz, BL_EN, BIT(val) - 1);
 	else
 		/* Enable all 6 current sinks if the number of current sinks isn't specified. */
 		ktz8866_write(ktz, BL_EN, BIT(6) - 1);
 
-	if (of_property_read_u32(ktz->client->dev.of_node, "kinetic,current-ramp-delay-ms", &val)) {
+	if (!of_property_read_u32(ktz->client->dev.of_node, "kinetic,current-ramp-delay-ms", &val)) {
 		if (val <= 128)
 			ktz8866_write(ktz, BL_CFG2, BIT(7) | (ilog2(val) << 3) | PWM_HYST);
 		else
 			ktz8866_write(ktz, BL_CFG2, BIT(7) | ((5 + val / 64) << 3) | PWM_HYST);
 	}
 
-	if (of_property_read_u32(ktz->client->dev.of_node, "kinetic,led-enable-ramp-delay-ms", &val)) {
+	if (!of_property_read_u32(ktz->client->dev.of_node, "kinetic,led-enable-ramp-delay-ms", &val)) {
 		if (val == 0)
 			ktz8866_write(ktz, BL_DIMMING, 0);
 		else {
--- linux-qcom-6.8.0.orig/drivers/video/backlight/lm3630a_bl.c
+++ linux-qcom-6.8.0/drivers/video/backlight/lm3630a_bl.c
@@ -233,7 +233,7 @@
 		if (rval < 0)
 			goto out_i2c_err;
 		brightness |= rval;
-		goto out;
+		return brightness;
 	}
 
 	/* disable sleep */
@@ -244,11 +244,8 @@
 	rval = lm3630a_read(pchip, REG_BRT_A);
 	if (rval < 0)
 		goto out_i2c_err;
-	brightness = rval;
+	return rval;
 
-out:
-	bl->props.brightness = brightness;
-	return bl->props.brightness;
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access register\n");
 	return 0;
@@ -310,7 +307,7 @@
 		if (rval < 0)
 			goto out_i2c_err;
 		brightness |= rval;
-		goto out;
+		return brightness;
 	}
 
 	/* disable sleep */
@@ -321,11 +318,8 @@
 	rval = lm3630a_read(pchip, REG_BRT_B);
 	if (rval < 0)
 		goto out_i2c_err;
-	brightness = rval;
+	return rval;
 
-out:
-	bl->props.brightness = brightness;
-	return bl->props.brightness;
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access register\n");
 	return 0;
@@ -343,6 +337,7 @@
 	struct backlight_properties props;
 	const char *label;
 
+	memset(&props, 0, sizeof(struct backlight_properties));
 	props.type = BACKLIGHT_RAW;
 	if (pdata->leda_ctrl != LM3630A_LEDA_DISABLE) {
 		props.brightness = pdata->leda_init_brt;
--- linux-qcom-6.8.0.orig/drivers/video/backlight/lm3639_bl.c
+++ linux-qcom-6.8.0/drivers/video/backlight/lm3639_bl.c
@@ -338,6 +338,7 @@
 	}
 
 	/* backlight */
+	memset(&props, 0, sizeof(struct backlight_properties));
 	props.type = BACKLIGHT_RAW;
 	props.brightness = pdata->init_brt_led;
 	props.max_brightness = pdata->max_brt_led;
--- linux-qcom-6.8.0.orig/drivers/video/backlight/lp8788_bl.c
+++ linux-qcom-6.8.0/drivers/video/backlight/lp8788_bl.c
@@ -191,6 +191,7 @@
 	int init_brt;
 	char *name;
 
+	memset(&props, 0, sizeof(struct backlight_properties));
 	props.type = BACKLIGHT_PLATFORM;
 	props.max_brightness = MAX_BRIGHTNESS;
 
--- linux-qcom-6.8.0.orig/drivers/video/backlight/qcom-wled.c
+++ linux-qcom-6.8.0/drivers/video/backlight/qcom-wled.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2015, Sony Mobile Communications, AB.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/delay.h>
@@ -1734,6 +1735,7 @@
 	{ .compatible = "qcom,pmi8998-wled", .data = (void *)4 },
 	{ .compatible = "qcom,pm660l-wled", .data = (void *)4 },
 	{ .compatible = "qcom,pm6150l-wled", .data = (void *)5 },
+	{ .compatible = "qcom,pm7325b-wled", .data = (void *)5 },
 	{ .compatible = "qcom,pm8150l-wled", .data = (void *)5 },
 	{}
 };
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/Kconfig
+++ linux-qcom-6.8.0/drivers/video/fbdev/Kconfig
@@ -501,6 +501,7 @@
 	select FB_CFB_COPYAREA
 	select FB_CFB_FILLRECT
 	select FB_CFB_IMAGEBLIT
+	select FB_IOMEM_FOPS
 
 config FB_BW2
 	bool "BWtwo support"
@@ -521,6 +522,7 @@
 	depends on (FB = y) && (SPARC && FB_SBUS)
 	select FB_CFB_COPYAREA
 	select FB_CFB_IMAGEBLIT
+	select FB_IOMEM_FOPS
 	help
 	  This is the frame buffer device driver for the CGsix (GX, TurboGX)
 	  frame buffer.
@@ -530,6 +532,7 @@
 	depends on FB_SBUS && SPARC64
 	select FB_CFB_COPYAREA
 	select FB_CFB_IMAGEBLIT
+	select FB_IOMEM_FOPS
 	help
 	  This is the frame buffer device driver for the Creator, Creator3D,
 	  and Elite3D graphics boards.
@@ -1402,6 +1405,7 @@
 config FB_WM8505
 	bool "Wondermedia WM8xxx-series frame buffer support"
 	depends on (FB = y) && HAS_IOMEM && (ARCH_VT8500 || COMPILE_TEST)
+	select FB_IOMEM_FOPS
 	select FB_SYS_FILLRECT if (!FB_WMT_GE_ROPS)
 	select FB_SYS_COPYAREA if (!FB_WMT_GE_ROPS)
 	select FB_SYS_IMAGEBLIT
@@ -1677,8 +1681,8 @@
 	select FB_IOMEM_HELPERS
 
 config FB_SH7760
-	bool "SH7760/SH7763/SH7720/SH7721 LCDC support"
-	depends on FB=y && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
+	tristate "SH7760/SH7763/SH7720/SH7721 LCDC support"
+	depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
 		|| CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721)
 	select FB_IOMEM_HELPERS
 	help
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/core/Kconfig
+++ linux-qcom-6.8.0/drivers/video/fbdev/core/Kconfig
@@ -144,6 +144,12 @@
 	select FB_SYS_IMAGEBLIT
 	select FB_SYSMEM_FOPS
 
+config FB_DMAMEM_HELPERS_DEFERRED
+	bool
+	depends on FB_CORE
+	select FB_DEFERRED_IO
+	select FB_DMAMEM_HELPERS
+
 config FB_IOMEM_FOPS
 	tristate
 	depends on FB_CORE
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/core/fb_defio.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/core/fb_defio.c
@@ -196,7 +196,7 @@
  */
 static vm_fault_t fb_deferred_io_page_mkwrite(struct fb_info *info, struct vm_fault *vmf)
 {
-	unsigned long offset = vmf->address - vmf->vma->vm_start;
+	unsigned long offset = vmf->pgoff << PAGE_SHIFT;
 	struct page *page = vmf->page;
 
 	file_update_time(vmf->vma->vm_file);
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/core/fbcon.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/core/fbcon.c
@@ -848,6 +848,8 @@
 			return err;
 
 		fbcon_add_cursor_work(info);
+	} else if (vc) {
+		set_blitting_type(vc, info);
 	}
 
 	con2fb_map[unit] = newidx;
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/core/fbmon.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/core/fbmon.c
@@ -1311,7 +1311,7 @@
 int fb_videomode_from_videomode(const struct videomode *vm,
 				struct fb_videomode *fbmode)
 {
-	unsigned int htotal, vtotal;
+	unsigned int htotal, vtotal, total;
 
 	fbmode->xres = vm->hactive;
 	fbmode->left_margin = vm->hback_porch;
@@ -1344,8 +1344,9 @@
 	vtotal = vm->vactive + vm->vfront_porch + vm->vback_porch +
 		 vm->vsync_len;
 	/* prevent division by zero */
-	if (htotal && vtotal) {
-		fbmode->refresh = vm->pixelclock / (htotal * vtotal);
+	total = htotal * vtotal;
+	if (total) {
+		fbmode->refresh = vm->pixelclock / total;
 	/* a mode must have htotal and vtotal != 0 or it is invalid */
 	} else {
 		fbmode->refresh = 0;
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/efifb.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/efifb.c
@@ -571,15 +571,10 @@
 		break;
 	}
 
-	err = sysfs_create_groups(&dev->dev.kobj, efifb_groups);
-	if (err) {
-		pr_err("efifb: cannot add sysfs attrs\n");
-		goto err_unmap;
-	}
 	err = fb_alloc_cmap(&info->cmap, 256, 0);
 	if (err < 0) {
 		pr_err("efifb: cannot allocate colormap\n");
-		goto err_groups;
+		goto err_unmap;
 	}
 
 	if (efifb_pci_dev)
@@ -603,8 +598,6 @@
 		pm_runtime_put(&efifb_pci_dev->dev);
 
 	fb_dealloc_cmap(&info->cmap);
-err_groups:
-	sysfs_remove_groups(&dev->dev.kobj, efifb_groups);
 err_unmap:
 	if (mem_flags & (EFI_MEMORY_UC | EFI_MEMORY_WC))
 		iounmap(info->screen_base);
@@ -624,12 +617,12 @@
 
 	/* efifb_destroy takes care of info cleanup */
 	unregister_framebuffer(info);
-	sysfs_remove_groups(&pdev->dev.kobj, efifb_groups);
 }
 
 static struct platform_driver efifb_driver = {
 	.driver = {
 		.name = "efi-framebuffer",
+		.dev_groups = efifb_groups,
 	},
 	.probe = efifb_probe,
 	.remove_new = efifb_remove,
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/hpfb.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/hpfb.c
@@ -345,6 +345,7 @@
 	if (hpfb_init_one(paddr, vaddr)) {
 		if (d->scode >= DIOII_SCBASE)
 			iounmap((void *)vaddr);
+		release_mem_region(d->resource.start, resource_size(&d->resource));
 		return -ENOMEM;
 	}
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/pxafb.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/pxafb.c
@@ -2403,6 +2403,7 @@
 	info = &fbi->fb;
 
 	pxafb_overlay_exit(fbi);
+	cancel_work_sync(&fbi->task);
 	unregister_framebuffer(info);
 
 	pxafb_disable_controller(fbi);
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/savage/savagefb_driver.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/savage/savagefb_driver.c
@@ -2276,7 +2276,10 @@
 	if (info->var.xres_virtual > 0x1000)
 		info->var.xres_virtual = 0x1000;
 #endif
-	savagefb_check_var(&info->var, info);
+	err = savagefb_check_var(&info->var, info);
+	if (err)
+		goto failed;
+
 	savagefb_set_fix(info);
 
 	/*
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/sh7760fb.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/sh7760fb.c
@@ -409,12 +409,11 @@
 		vram = PAGE_SIZE;
 
 	fbmem = dma_alloc_coherent(info->device, vram, &par->fbdma, GFP_KERNEL);
-
 	if (!fbmem)
 		return -ENOMEM;
 
 	if ((par->fbdma & SH7760FB_DMA_MASK) != SH7760FB_DMA_MASK) {
-		sh7760fb_free_mem(info);
+		dma_free_coherent(info->device, vram, fbmem, par->fbdma);
 		dev_err(info->device, "kernel gave me memory at 0x%08lx, which is"
 			"unusable for the LCDC\n", (unsigned long)par->fbdma);
 		return -ENOMEM;
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/sh_mobile_lcdcfb.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/sh_mobile_lcdcfb.c
@@ -1575,7 +1575,7 @@
 	 */
 	info->fix = sh_mobile_lcdc_overlay_fix;
 	snprintf(info->fix.id, sizeof(info->fix.id),
-		 "SH Mobile LCDC Overlay %u", ovl->index);
+		 "SHMobile ovl %u", ovl->index);
 	info->fix.smem_start = ovl->dma_handle;
 	info->fix.smem_len = ovl->fb_size;
 	info->fix.line_length = ovl->pitch;
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/simplefb.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/simplefb.c
@@ -470,7 +470,7 @@
 		if (err == -ENOENT)
 			return 0;
 
-		dev_info(dev, "failed to parse power-domains: %d\n", err);
+		dev_err(dev, "failed to parse power-domains: %d\n", err);
 		return err;
 	}
 
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/sis/init301.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/sis/init301.c
@@ -172,7 +172,7 @@
 };
 
 /* 301C / 302ELV extended Part2 TV registers (4 tap scaler) */
-
+#ifdef CONFIG_FB_SIS_315
 static const unsigned char SiS_Part2CLVX_1[] = {
     0x00,0x00,
     0x00,0x20,0x00,0x00,0x7F,0x20,0x02,0x7F,0x7D,0x20,0x04,0x7F,0x7D,0x1F,0x06,0x7E,
@@ -245,7 +245,6 @@
     0xFF,0xFF,
 };
 
-#ifdef CONFIG_FB_SIS_315
 /* 661 et al LCD data structure (2.03.00) */
 static const unsigned char SiS_LCDStruct661[] = {
     /* 1024x768 */
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/sis/sis_main.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/sis/sis_main.c
@@ -183,7 +183,7 @@
 {
 	unsigned int j = 0, xres = 0, yres = 0, depth = 0, rate = 0;
 	int i = 0;
-	char strbuf[16], strbuf1[20];
+	char strbuf[24], strbuf1[20];
 	char *nameptr = name;
 
 	/* We don't know the hardware specs yet and there is no ivideo */
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/vesafb.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/vesafb.c
@@ -243,6 +243,7 @@
 
 static int vesafb_probe(struct platform_device *dev)
 {
+	struct screen_info *si = &screen_info;
 	struct fb_info *info;
 	struct vesafb_par *par;
 	int i, err;
@@ -255,17 +256,17 @@
 	fb_get_options("vesafb", &option);
 	vesafb_setup(option);
 
-	if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
+	if (si->orig_video_isVGA != VIDEO_TYPE_VLFB)
 		return -ENODEV;
 
-	vga_compat = (screen_info.capabilities & 2) ? 0 : 1;
-	vesafb_fix.smem_start = screen_info.lfb_base;
-	vesafb_defined.bits_per_pixel = screen_info.lfb_depth;
+	vga_compat = !__screen_info_vbe_mode_nonvga(si);
+	vesafb_fix.smem_start = si->lfb_base;
+	vesafb_defined.bits_per_pixel = si->lfb_depth;
 	if (15 == vesafb_defined.bits_per_pixel)
 		vesafb_defined.bits_per_pixel = 16;
-	vesafb_defined.xres = screen_info.lfb_width;
-	vesafb_defined.yres = screen_info.lfb_height;
-	vesafb_fix.line_length = screen_info.lfb_linelength;
+	vesafb_defined.xres = si->lfb_width;
+	vesafb_defined.yres = si->lfb_height;
+	vesafb_fix.line_length = si->lfb_linelength;
 	vesafb_fix.visual   = (vesafb_defined.bits_per_pixel == 8) ?
 		FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_TRUECOLOR;
 
@@ -277,7 +278,7 @@
 	/*   size_total -- all video memory we have. Used for mtrr
 	 *                 entries, resource allocation and bounds
 	 *                 checking. */
-	size_total = screen_info.lfb_size * 65536;
+	size_total = si->lfb_size * 65536;
 	if (vram_total)
 		size_total = vram_total * 1024 * 1024;
 	if (size_total < size_vmode)
@@ -297,7 +298,7 @@
 	vesafb_fix.smem_len = size_remap;
 
 #ifndef __i386__
-	screen_info.vesapm_seg = 0;
+	si->vesapm_seg = 0;
 #endif
 
 	if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
@@ -317,23 +318,26 @@
 	par = info->par;
 	info->pseudo_palette = par->pseudo_palette;
 
-	par->base = screen_info.lfb_base;
+	par->base = si->lfb_base;
 	par->size = size_total;
 
 	printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
-	       vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
+	       vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel,
+	       vesafb_fix.line_length, si->pages);
 
-	if (screen_info.vesapm_seg) {
+	if (si->vesapm_seg) {
 		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
-		       screen_info.vesapm_seg,screen_info.vesapm_off);
+		       si->vesapm_seg, si->vesapm_off);
 	}
 
-	if (screen_info.vesapm_seg < 0xc000)
+	if (si->vesapm_seg < 0xc000)
 		ypan = pmi_setpal = 0; /* not available or some DOS TSR ... */
 
 	if (ypan || pmi_setpal) {
+		unsigned long pmi_phys;
 		unsigned short *pmi_base;
-		pmi_base  = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
+		pmi_phys  = ((unsigned long)si->vesapm_seg << 4) + si->vesapm_off;
+		pmi_base  = (unsigned short *)phys_to_virt(pmi_phys);
 		pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
 		pmi_pal   = (void*)((char*)pmi_base + pmi_base[2]);
 		printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
@@ -377,14 +381,14 @@
 	vesafb_defined.left_margin  = (vesafb_defined.xres / 8) & 0xf8;
 	vesafb_defined.hsync_len    = (vesafb_defined.xres / 8) & 0xf8;
 
-	vesafb_defined.red.offset    = screen_info.red_pos;
-	vesafb_defined.red.length    = screen_info.red_size;
-	vesafb_defined.green.offset  = screen_info.green_pos;
-	vesafb_defined.green.length  = screen_info.green_size;
-	vesafb_defined.blue.offset   = screen_info.blue_pos;
-	vesafb_defined.blue.length   = screen_info.blue_size;
-	vesafb_defined.transp.offset = screen_info.rsvd_pos;
-	vesafb_defined.transp.length = screen_info.rsvd_size;
+	vesafb_defined.red.offset    = si->red_pos;
+	vesafb_defined.red.length    = si->red_size;
+	vesafb_defined.green.offset  = si->green_pos;
+	vesafb_defined.green.length  = si->green_size;
+	vesafb_defined.blue.offset   = si->blue_pos;
+	vesafb_defined.blue.length   = si->blue_size;
+	vesafb_defined.transp.offset = si->rsvd_pos;
+	vesafb_defined.transp.length = si->rsvd_size;
 
 	if (vesafb_defined.bits_per_pixel <= 8) {
 		depth = vesafb_defined.green.length;
@@ -399,14 +403,14 @@
 	       (vesafb_defined.bits_per_pixel > 8) ?
 	       "Truecolor" : (vga_compat || pmi_setpal) ?
 	       "Pseudocolor" : "Static Pseudocolor",
-	       screen_info.rsvd_size,
-	       screen_info.red_size,
-	       screen_info.green_size,
-	       screen_info.blue_size,
-	       screen_info.rsvd_pos,
-	       screen_info.red_pos,
-	       screen_info.green_pos,
-	       screen_info.blue_pos);
+	       si->rsvd_size,
+	       si->red_size,
+	       si->green_size,
+	       si->blue_size,
+	       si->rsvd_pos,
+	       si->red_pos,
+	       si->green_pos,
+	       si->blue_pos);
 
 	vesafb_fix.ypanstep  = ypan     ? 1 : 0;
 	vesafb_fix.ywrapstep = (ypan>1) ? 1 : 0;
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/via/accel.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/via/accel.c
@@ -115,7 +115,7 @@
 
 	if (op != VIA_BITBLT_FILL) {
 		tmp = src_mem ? 0 : src_addr;
-		if (dst_addr & 0xE0000007) {
+		if (tmp & 0xE0000007) {
 			printk(KERN_WARNING "hw_bitblt_1: Unsupported source "
 				"address %X\n", tmp);
 			return -EINVAL;
@@ -260,7 +260,7 @@
 		writel(tmp, engine + 0x18);
 
 		tmp = src_mem ? 0 : src_addr;
-		if (dst_addr & 0xE0000007) {
+		if (tmp & 0xE0000007) {
 			printk(KERN_WARNING "hw_bitblt_2: Unsupported source "
 				"address %X\n", tmp);
 			return -EINVAL;
--- linux-qcom-6.8.0.orig/drivers/video/fbdev/xen-fbfront.c
+++ linux-qcom-6.8.0/drivers/video/fbdev/xen-fbfront.c
@@ -407,6 +407,7 @@
 	/* complete the abuse: */
 	fb_info->pseudo_palette = fb_info->par;
 	fb_info->par = info;
+	fb_info->device = &dev->dev;
 
 	fb_info->screen_buffer = info->fb;
 
--- linux-qcom-6.8.0.orig/drivers/video/logo/pnmtologo.c
+++ linux-qcom-6.8.0/drivers/video/logo/pnmtologo.c
@@ -235,8 +235,6 @@
 	fputs("/*\n", out);
 	fputs(" *  DO NOT EDIT THIS FILE!\n", out);
 	fputs(" *\n", out);
-	fprintf(out, " *  It was automatically generated from %s\n", filename);
-	fputs(" *\n", out);
 	fprintf(out, " *  Linux logo %s\n", logoname);
 	fputs(" */\n\n", out);
 	fputs("#include <linux/linux_logo.h>\n\n", out);
--- linux-qcom-6.8.0.orig/drivers/video/screen_info_generic.c
+++ linux-qcom-6.8.0/drivers/video/screen_info_generic.c
@@ -0,0 +1,146 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/export.h>
+#include <linux/ioport.h>
+#include <linux/screen_info.h>
+#include <linux/string.h>
+
+static void resource_init_named(struct resource *r,
+				resource_size_t start, resource_size_t size,
+				const char *name, unsigned int flags)
+{
+	memset(r, 0, sizeof(*r));
+
+	r->start = start;
+	r->end = start + size - 1;
+	r->name = name;
+	r->flags = flags;
+}
+
+static void resource_init_io_named(struct resource *r,
+				   resource_size_t start, resource_size_t size,
+				   const char *name)
+{
+	resource_init_named(r, start, size, name, IORESOURCE_IO);
+}
+
+static void resource_init_mem_named(struct resource *r,
+				   resource_size_t start, resource_size_t size,
+				   const char *name)
+{
+	resource_init_named(r, start, size, name, IORESOURCE_MEM);
+}
+
+static inline bool __screen_info_has_ega_gfx(unsigned int mode)
+{
+	switch (mode) {
+	case 0x0d:	/* 320x200-4 */
+	case 0x0e:	/* 640x200-4 */
+	case 0x0f:	/* 640x350-1 */
+	case 0x10:	/* 640x350-4 */
+		return true;
+	default:
+		return false;
+	}
+}
+
+static inline bool __screen_info_has_vga_gfx(unsigned int mode)
+{
+	switch (mode) {
+	case 0x10:	/* 640x480-1 */
+	case 0x12:	/* 640x480-4 */
+	case 0x13:	/* 320-200-8 */
+	case 0x6a:	/* 800x600-4 (VESA) */
+		return true;
+	default:
+		return __screen_info_has_ega_gfx(mode);
+	}
+}
+
+/**
+ * screen_info_resources() - Get resources from screen_info structure
+ * @si: the screen_info
+ * @r: pointer to an array of resource structures
+ * @num: number of elements in @r:
+ *
+ * Returns:
+ * The number of resources stored in @r on success, or a negative errno code otherwise.
+ *
+ * A call to screen_info_resources() returns the resources consumed by the
+ * screen_info's device or framebuffer. The result is stored in the caller-supplied
+ * array @r with up to @num elements. The function returns the number of
+ * initialized elements.
+ */
+ssize_t screen_info_resources(const struct screen_info *si, struct resource *r, size_t num)
+{
+	struct resource *pos = r;
+	unsigned int type = screen_info_video_type(si);
+	u64 base, size;
+
+	switch (type) {
+	case VIDEO_TYPE_MDA:
+		if (num > 0)
+			resource_init_io_named(pos++, 0x3b0, 12, "mda");
+		if (num > 1)
+			resource_init_io_named(pos++, 0x3bf, 0x01, "mda");
+		if (num > 2)
+			resource_init_mem_named(pos++, 0xb0000, 0x2000, "mda");
+		break;
+	case VIDEO_TYPE_CGA:
+		if (num > 0)
+			resource_init_io_named(pos++, 0x3d4, 0x02, "cga");
+		if (num > 1)
+			resource_init_mem_named(pos++, 0xb8000, 0x2000, "cga");
+		break;
+	case VIDEO_TYPE_EGAM:
+		if (num > 0)
+			resource_init_io_named(pos++, 0x3bf, 0x10, "ega");
+		if (num > 1)
+			resource_init_mem_named(pos++, 0xb0000, 0x8000, "ega");
+		break;
+	case VIDEO_TYPE_EGAC:
+		if (num > 0)
+			resource_init_io_named(pos++, 0x3c0, 0x20, "ega");
+		if (num > 1) {
+			if (__screen_info_has_ega_gfx(si->orig_video_mode))
+				resource_init_mem_named(pos++, 0xa0000, 0x10000, "ega");
+			else
+				resource_init_mem_named(pos++, 0xb8000, 0x8000, "ega");
+		}
+		break;
+	case VIDEO_TYPE_VGAC:
+		if (num > 0)
+			resource_init_io_named(pos++, 0x3c0, 0x20, "vga+");
+		if (num > 1) {
+			if (__screen_info_has_vga_gfx(si->orig_video_mode))
+				resource_init_mem_named(pos++, 0xa0000, 0x10000, "vga+");
+			else
+				resource_init_mem_named(pos++, 0xb8000, 0x8000, "vga+");
+		}
+		break;
+	case VIDEO_TYPE_VLFB:
+	case VIDEO_TYPE_EFI:
+		base = __screen_info_lfb_base(si);
+		if (!base)
+			break;
+		size = __screen_info_lfb_size(si, type);
+		if (!size)
+			break;
+		if (num > 0)
+			resource_init_mem_named(pos++, base, size, "lfb");
+		break;
+	case VIDEO_TYPE_PICA_S3:
+	case VIDEO_TYPE_MIPS_G364:
+	case VIDEO_TYPE_SGI:
+	case VIDEO_TYPE_TGAC:
+	case VIDEO_TYPE_SUN:
+	case VIDEO_TYPE_SUNPCI:
+	case VIDEO_TYPE_PMAC:
+	default:
+		/* not supported */
+		return -EINVAL;
+	}
+
+	return pos - r;
+}
+EXPORT_SYMBOL(screen_info_resources);
--- linux-qcom-6.8.0.orig/drivers/video/screen_info_pci.c
+++ linux-qcom-6.8.0/drivers/video/screen_info_pci.c
@@ -0,0 +1,136 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/pci.h>
+#include <linux/printk.h>
+#include <linux/screen_info.h>
+#include <linux/string.h>
+
+static struct pci_dev *screen_info_lfb_pdev;
+static size_t screen_info_lfb_bar;
+static resource_size_t screen_info_lfb_offset;
+static struct resource screen_info_lfb_res = DEFINE_RES_MEM(0, 0);
+
+static bool __screen_info_relocation_is_valid(const struct screen_info *si, struct resource *pr)
+{
+	u64 size = __screen_info_lfb_size(si, screen_info_video_type(si));
+
+	if (screen_info_lfb_offset > resource_size(pr))
+		return false;
+	if (size > resource_size(pr))
+		return false;
+	if (resource_size(pr) - size < screen_info_lfb_offset)
+		return false;
+
+	return true;
+}
+
+void screen_info_apply_fixups(void)
+{
+	struct screen_info *si = &screen_info;
+
+	if (screen_info_lfb_pdev) {
+		struct resource *pr = &screen_info_lfb_pdev->resource[screen_info_lfb_bar];
+
+		if (pr->start != screen_info_lfb_res.start) {
+			if (__screen_info_relocation_is_valid(si, pr)) {
+				/*
+				 * Only update base if we have an actual
+				 * relocation to a valid I/O range.
+				 */
+				__screen_info_set_lfb_base(si, pr->start + screen_info_lfb_offset);
+				pr_info("Relocating firmware framebuffer to offset %pa[d] within %pr\n",
+					&screen_info_lfb_offset, pr);
+			} else {
+				pr_warn("Invalid relocating, disabling firmware framebuffer\n");
+			}
+		}
+	}
+}
+
+static void screen_info_fixup_lfb(struct pci_dev *pdev)
+{
+	unsigned int type;
+	struct resource res[SCREEN_INFO_MAX_RESOURCES];
+	size_t i, numres;
+	int ret;
+	const struct screen_info *si = &screen_info;
+
+	if (screen_info_lfb_pdev)
+		return; // already found
+
+	type = screen_info_video_type(si);
+	if (type != VIDEO_TYPE_EFI)
+		return; // only applies to EFI
+
+	ret = screen_info_resources(si, res, ARRAY_SIZE(res));
+	if (ret < 0)
+		return;
+	numres = ret;
+
+	for (i = 0; i < numres; ++i) {
+		struct resource *r = &res[i];
+		const struct resource *pr;
+
+		if (!(r->flags & IORESOURCE_MEM))
+			continue;
+		pr = pci_find_resource(pdev, r);
+		if (!pr)
+			continue;
+
+		/*
+		 * We've found a PCI device with the framebuffer
+		 * resource. Store away the parameters to track
+		 * relocation of the framebuffer aperture.
+		 */
+		screen_info_lfb_pdev = pdev;
+		screen_info_lfb_bar = pr - pdev->resource;
+		screen_info_lfb_offset = r->start - pr->start;
+		memcpy(&screen_info_lfb_res, r, sizeof(screen_info_lfb_res));
+	}
+}
+DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID, PCI_BASE_CLASS_DISPLAY, 16,
+			       screen_info_fixup_lfb);
+
+static struct pci_dev *__screen_info_pci_dev(struct resource *res)
+{
+	struct pci_dev *pdev = NULL;
+	const struct resource *r = NULL;
+
+	if (!(res->flags & IORESOURCE_MEM))
+		return NULL;
+
+	while (!r && (pdev = pci_get_base_class(PCI_BASE_CLASS_DISPLAY, pdev))) {
+		r = pci_find_resource(pdev, res);
+	}
+
+	return pdev;
+}
+
+/**
+ * screen_info_pci_dev() - Return PCI parent device that contains screen_info's framebuffer
+ * @si: the screen_info
+ *
+ * Returns:
+ * The screen_info's parent device or NULL on success, or a pointer-encoded
+ * errno value otherwise. The value NULL is not an error. It signals that no
+ * PCI device has been found.
+ */
+struct pci_dev *screen_info_pci_dev(const struct screen_info *si)
+{
+	struct resource res[SCREEN_INFO_MAX_RESOURCES];
+	ssize_t i, numres;
+
+	numres = screen_info_resources(si, res, ARRAY_SIZE(res));
+	if (numres < 0)
+		return ERR_PTR(numres);
+
+	for (i = 0; i < numres; ++i) {
+		struct pci_dev *pdev = __screen_info_pci_dev(&res[i]);
+
+		if (pdev)
+			return pdev;
+	}
+
+	return NULL;
+}
+EXPORT_SYMBOL(screen_info_pci_dev);
--- linux-qcom-6.8.0.orig/drivers/virt/Kconfig
+++ linux-qcom-6.8.0/drivers/virt/Kconfig
@@ -50,4 +50,6 @@
 
 source "drivers/virt/coco/Kconfig"
 
+source "drivers/virt/gunyah/Kconfig"
+
 endif
--- linux-qcom-6.8.0.orig/drivers/virt/Makefile
+++ linux-qcom-6.8.0/drivers/virt/Makefile
@@ -10,3 +10,4 @@
 obj-$(CONFIG_NITRO_ENCLAVES)	+= nitro_enclaves/
 obj-$(CONFIG_ACRN_HSM)		+= acrn/
 obj-y				+= coco/
+obj-y				+= gunyah/
--- linux-qcom-6.8.0.orig/drivers/virt/acrn/mm.c
+++ linux-qcom-6.8.0/drivers/virt/acrn/mm.c
@@ -155,43 +155,83 @@
 int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap)
 {
 	struct vm_memory_region_batch *regions_info;
-	int nr_pages, i = 0, order, nr_regions = 0;
+	int nr_pages, i, order, nr_regions = 0;
 	struct vm_memory_mapping *region_mapping;
 	struct vm_memory_region_op *vm_region;
 	struct page **pages = NULL, *page;
 	void *remap_vaddr;
 	int ret, pinned;
 	u64 user_vm_pa;
-	unsigned long pfn;
 	struct vm_area_struct *vma;
 
 	if (!vm || !memmap)
 		return -EINVAL;
 
+	/* Get the page number of the map region */
+	nr_pages = memmap->len >> PAGE_SHIFT;
+	if (!nr_pages)
+		return -EINVAL;
+
 	mmap_read_lock(current->mm);
 	vma = vma_lookup(current->mm, memmap->vma_base);
 	if (vma && ((vma->vm_flags & VM_PFNMAP) != 0)) {
+		unsigned long start_pfn, cur_pfn;
+		spinlock_t *ptl;
+		bool writable;
+		pte_t *ptep;
+
 		if ((memmap->vma_base + memmap->len) > vma->vm_end) {
 			mmap_read_unlock(current->mm);
 			return -EINVAL;
 		}
 
-		ret = follow_pfn(vma, memmap->vma_base, &pfn);
+		for (i = 0; i < nr_pages; i++) {
+			ret = follow_pte(vma->vm_mm,
+					 memmap->vma_base + i * PAGE_SIZE,
+					 &ptep, &ptl);
+			if (ret)
+				break;
+
+			cur_pfn = pte_pfn(ptep_get(ptep));
+			if (i == 0)
+				start_pfn = cur_pfn;
+			writable = !!pte_write(ptep_get(ptep));
+			pte_unmap_unlock(ptep, ptl);
+
+			/* Disallow write access if the PTE is not writable. */
+			if (!writable &&
+			    (memmap->attr & ACRN_MEM_ACCESS_WRITE)) {
+				ret = -EFAULT;
+				break;
+			}
+
+			/* Disallow refcounted pages. */
+			if (pfn_valid(cur_pfn) &&
+			    !PageReserved(pfn_to_page(cur_pfn))) {
+				ret = -EFAULT;
+				break;
+			}
+
+			/* Disallow non-contiguous ranges. */
+			if (cur_pfn != start_pfn + i) {
+				ret = -EINVAL;
+				break;
+			}
+		}
 		mmap_read_unlock(current->mm);
-		if (ret < 0) {
+
+		if (ret) {
 			dev_dbg(acrn_dev.this_device,
 				"Failed to lookup PFN at VMA:%pK.\n", (void *)memmap->vma_base);
 			return ret;
 		}
 
 		return acrn_mm_region_add(vm, memmap->user_vm_pa,
-			 PFN_PHYS(pfn), memmap->len,
+			 PFN_PHYS(start_pfn), memmap->len,
 			 ACRN_MEM_TYPE_WB, memmap->attr);
 	}
 	mmap_read_unlock(current->mm);
 
-	/* Get the page number of the map region */
-	nr_pages = memmap->len >> PAGE_SHIFT;
 	pages = vzalloc(array_size(nr_pages, sizeof(*pages)));
 	if (!pages)
 		return -ENOMEM;
@@ -235,12 +275,11 @@
 	mutex_unlock(&vm->regions_mapping_lock);
 
 	/* Calculate count of vm_memory_region_op */
-	while (i < nr_pages) {
+	for (i = 0; i < nr_pages; i += 1 << order) {
 		page = pages[i];
 		VM_BUG_ON_PAGE(PageTail(page), page);
 		order = compound_order(page);
 		nr_regions++;
-		i += 1 << order;
 	}
 
 	/* Prepare the vm_memory_region_batch */
@@ -257,8 +296,7 @@
 	regions_info->vmid = vm->vmid;
 	regions_info->regions_gpa = virt_to_phys(vm_region);
 	user_vm_pa = memmap->user_vm_pa;
-	i = 0;
-	while (i < nr_pages) {
+	for (i = 0; i < nr_pages; i += 1 << order) {
 		u32 region_size;
 
 		page = pages[i];
@@ -274,7 +312,6 @@
 
 		vm_region++;
 		user_vm_pa += region_size;
-		i += 1 << order;
 	}
 
 	/* Inform the ACRN Hypervisor to set up EPT mappings */
--- linux-qcom-6.8.0.orig/drivers/virt/coco/sev-guest/sev-guest.c
+++ linux-qcom-6.8.0/drivers/virt/coco/sev-guest/sev-guest.c
@@ -1009,8 +1009,13 @@
  * This driver is meant to be a common SEV guest interface driver and to
  * support any SEV guest API. As such, even though it has been introduced
  * with the SEV-SNP support, it is named "sev-guest".
+ *
+ * sev_guest_remove() lives in .exit.text. For drivers registered via
+ * module_platform_driver_probe() this is ok because they cannot get unbound
+ * at runtime. So mark the driver struct with __refdata to prevent modpost
+ * triggering a section mismatch warning.
  */
-static struct platform_driver sev_guest_driver = {
+static struct platform_driver sev_guest_driver __refdata = {
 	.remove_new	= __exit_p(sev_guest_remove),
 	.driver		= {
 		.name = "sev-guest",
--- linux-qcom-6.8.0.orig/drivers/virt/coco/tdx-guest/tdx-guest.c
+++ linux-qcom-6.8.0/drivers/virt/coco/tdx-guest/tdx-guest.c
@@ -124,10 +124,8 @@
 	if (!addr)
 		return NULL;
 
-	if (set_memory_decrypted((unsigned long)addr, count)) {
-		free_pages_exact(addr, len);
+	if (set_memory_decrypted((unsigned long)addr, count))
 		return NULL;
-	}
 
 	return addr;
 }
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/Kconfig
+++ linux-qcom-6.8.0/drivers/virt/gunyah/Kconfig
@@ -0,0 +1,81 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+config GUNYAH
+	tristate "Gunyah Virtualization drivers"
+	depends on ARM64
+	depends on MAILBOX
+	select GUNYAH_PLATFORM_HOOKS
+	imply GUNYAH_QCOM_PLATFORM if ARCH_QCOM
+	help
+	  The Gunyah drivers are the helper interfaces that run in a guest VM
+	  such as basic inter-VM IPC and signaling mechanisms, and higher level
+	  services such as memory/device sharing, IRQ sharing, and so on.
+
+	  Say Y/M here to enable the drivers needed to interact in a Gunyah
+	  virtual environment.
+
+config GUNYAH_PLATFORM_HOOKS
+	tristate
+
+config GUNYAH_QCOM_PLATFORM
+	tristate "Support for Gunyah on Qualcomm platforms"
+	depends on GUNYAH
+	select GUNYAH_PLATFORM_HOOKS
+	select QCOM_SCM
+	help
+	  Enable support for interacting with Gunyah on Qualcomm
+	  platforms. Interaction with Qualcomm firmware requires
+	  extra platform-specific support.
+
+	  Say Y/M here to use Gunyah on Qualcomm platforms.
+
+config GUNYAH_VCPU
+	tristate "Runnable Gunyah vCPUs"
+	depends on GUNYAH
+	help
+	  Enable kernel support for host-scheduled vCPUs running under Gunyah.
+	  When selecting this option, userspace virtual machine managers (VMM)
+	  can schedule the guest VM's vCPUs instead of using Gunyah's scheduler.
+	  VMMs can also handle stage 2 faults of the vCPUs.
+
+	  Say Y/M here if unsure and you want to support Gunyah VMMs.
+
+config GUNYAH_IRQFD
+	tristate "Gunyah irqfd interface"
+	depends on GUNYAH
+	help
+	  Enable kernel support for creating irqfds which can raise an interrupt
+	  on Gunyah virtual machine.
+
+	  Say Y/M here if unsure and you want to support Gunyah VMMs.
+
+config GUNYAH_IOEVENTFD
+	tristate "Gunyah ioeventfd interface"
+	depends on GUNYAH
+	help
+	  Enable kernel support for creating ioeventfds which can alert userspace
+	  when a Gunyah virtual machine accesses a memory address.
+
+	  Say Y/M here if unsure and you want to support Gunyah VMMs.
+
+menuconfig GUNYAH_DRIVERS
+	bool "Gunyah Virtualization drivers"
+	depends on ARM64
+	help
+	  The Gunyah drivers are the helper interfaces that runs on the
+	  virtual machines that provides support such as memory/device
+	  sharing, IRQ sharing, IPC/signalling mechanisms, and so on.
+	  Say Y here to enable the drivers needed to work on Gunyah
+	  virtualization environment.
+	  If you say N, all options in this submenu will be skipped and disabled.
+
+if GUNYAH_DRIVERS
+config GH_VIRT_WATCHDOG
+	tristate "Gunyah Virtual Watchdog Driver"
+	depends on QCOM_WDT_CORE
+	help
+	  This enables the Qualcomm Technologies, Inc. watchdog module for
+	  the Gunyah hypervisor. It provides an interface to perform watchdog
+	  actions such as setting the bark/bite time and also petting the
+	  watchdog in the hypervisor.
+endif
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/Makefile
+++ linux-qcom-6.8.0/drivers/virt/gunyah/Makefile
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0
+
+obj-$(CONFIG_GUNYAH_PLATFORM_HOOKS) += gunyah_platform_hooks.o
+obj-$(CONFIG_GUNYAH_QCOM_PLATFORM) += gunyah_qcom.o
+
+gunyah-y += rsc_mgr.o rsc_mgr_rpc.o vm_mgr.o vm_mgr_mm.o
+obj-$(CONFIG_GUNYAH) += gunyah.o
+
+obj-$(CONFIG_GUNYAH_VCPU) += gunyah_vcpu.o
+obj-$(CONFIG_GUNYAH_IRQFD) += gunyah_irqfd.o
+obj-$(CONFIG_GUNYAH_IOEVENTFD) += gunyah_ioeventfd.o
+obj-$(CONFIG_GH_VIRT_WATCHDOG) += gh_virt_wdt.o
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/gh_virt_wdt.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/gh_virt_wdt.c
@@ -0,0 +1,306 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+#include <linux/arm-smccc.h>
+#include <linux/gunyah.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <soc/qcom/wdt_core.h>
+
+#define VIRT_WDT_CONTROL \
+		ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32,\
+				ARM_SMCCC_OWNER_VENDOR_HYP, 0x0005)
+#define VIRT_WDT_STATUS	\
+		ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32,\
+				ARM_SMCCC_OWNER_VENDOR_HYP, 0x0006)
+#define VIRT_WDT_PET \
+		ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32,\
+				ARM_SMCCC_OWNER_VENDOR_HYP, 0x0007)
+#define VIRT_WDT_SET_TIME \
+		ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32,\
+				ARM_SMCCC_OWNER_VENDOR_HYP, 0x0008)
+#define VIRT_WDT_NO_CHANGE 0xFFFF
+
+/**
+ *  gh_wdt_call() - Sends ARM SMCCC 1.1 Calls to the hypervisor
+ *
+ *  @smc_id: The smc id needed to interact with the watchdog in the hypervisor
+ *  @arg1:   A u32 value to be sent to the hypervisor
+ *  @arg2:   A u16 value to be sent to the hypervisor
+ *  @arg3:   A u16 value to be sent to the hypervisor
+ *
+ *  The hypervisor takes input via  ARM SMCCC Calls. The position of
+ *  these values matter. u16 values are needed to set both the bark
+ *  and bite time. In all other cases only the u32 (arg1) value is required.
+ *
+ *  return: 0 on success, negative errno on failure.
+ */
+static struct arm_smccc_res gh_wdt_call(u32 smc_id, u32 arg1,
+					u16 arg2, u16 arg3)
+{
+	struct arm_smccc_res res;
+
+	if (smc_id == VIRT_WDT_SET_TIME)
+		/* virtual watchdog expecting u16 values for bark and bite */
+		arm_smccc_1_1_smc(smc_id, arg2, arg3,  &res);
+	else
+		arm_smccc_1_1_smc(smc_id, arg1, &res);
+
+	return res;
+}
+
+/**
+ *  gh_set_wdt_bark() - Sets the bark time for the virtual watchdog
+ *
+ *  @time:    A u32 value to be converted to milliseconds (u16)
+ *  @wdog_dd: The qcom watchdog data structure
+ *
+ *  The hypervisor requires both the bark and the bite time in the same
+ *  call. To update one and not the other, the value VIRT_WDT_NO_CHANGE
+ *  is used.
+ *
+ *  return: 0 on success, negative errno on failure.
+ */
+static int gh_set_wdt_bark(u32 time, struct msm_watchdog_data *wdog_dd)
+{
+	struct arm_smccc_res res;
+	int hret, ret;
+	u16 bark_time;
+
+	bark_time = (u16) time;
+	res = gh_wdt_call(VIRT_WDT_SET_TIME, 0, bark_time, VIRT_WDT_NO_CHANGE);
+	hret = res.a0;
+	ret = gh_error_remap(hret);
+	if (hret) {
+		dev_err(wdog_dd->dev, "failed to set bark time for vDOG, hret = %d ret = %d\n",
+			hret, ret);
+	}
+
+	return ret;
+}
+
+/**
+ *  gh_set_wdt_bite() - Sets the bite time for the virtual watchdog
+ *
+ *  @time:    A u32 value to be converted to milliseconds (u16)
+ *  @wdog_dd: The qcom watchdog data structure
+ *
+ *  The hypervisor requires both the bark and the bite time in the same
+ *  call. To update one and not the other, the value VIRT_WDT_NO_CHANGE
+ *  is used.
+ *
+ *  return: 0 on success, negative errno on failure.
+ */
+static int gh_set_wdt_bite(u32 time, struct msm_watchdog_data *wdog_dd)
+{
+	struct arm_smccc_res res;
+	int hret, ret;
+	u16 bite_time;
+
+	bite_time = (u16) time;
+	res = gh_wdt_call(VIRT_WDT_SET_TIME, 0, VIRT_WDT_NO_CHANGE, bite_time);
+	hret = res.a0;
+	ret = gh_error_remap(hret);
+	if (hret) {
+		dev_err(wdog_dd->dev, "failed to set bite time for vWDOG, hret = %d ret = %d\n",
+			hret, ret);
+	}
+
+	return ret;
+}
+
+/**
+ *  gh_reset_wdt() - Resets the virtual watchdog timer
+ *
+ *  @wdog_dd: The qcom watchdog data structure
+ *
+ *  VIRT_WDT_PET is used to reset the virtual watchdog.
+ *
+ *  return: 0 on success, negative errno on failure.
+ */
+static int gh_reset_wdt(struct msm_watchdog_data *wdog_dd)
+{
+	struct arm_smccc_res res;
+	int hret, ret;
+
+	res = gh_wdt_call(VIRT_WDT_PET, 0, 0, 0);
+	hret = res.a0;
+	ret = gh_error_remap(hret);
+	if (hret) {
+		dev_err(wdog_dd->dev, "failed to reset vWDOG, hret = %d ret = %d\n",
+			hret, ret);
+	}
+
+	return ret;
+}
+
+/**
+ *  gh_enable_wdt() - Enables the virtual watchdog
+ *
+ *  @wdog_dd: The qcom watchdog data structure
+ *  @state:   state value to send to watchdog
+ *
+ *  VIRT_WDT_CONTROL is used to enable the virtual watchdog.
+ *  Bit 0 is used to enable the watchdog. When this Bit is set to
+ *  1 the watchdog is enabled. NOTE: Bit 1 must always be set to
+ *  1 as this bit is reserved in the hypervisor and Bit 1 is
+ *  expected to be 1. If this Bit is not set, the hypervisor will
+ *  return an error. So to enable the watchdog you must use the value 3.
+ *  An error from the hypervisor is expected if you try to enable the
+ *  watchdog when its already enabled.
+ *
+ *  return: 0 on success, negative errno on failure.
+ */
+static int gh_enable_wdt(u32 state, struct msm_watchdog_data *wdog_dd)
+{
+	struct arm_smccc_res res;
+	int hret, ret;
+
+	if (wdog_dd->enabled) {
+		dev_err(wdog_dd->dev, "vWDT already enabled\n");
+		return 0;
+	}
+	res = gh_wdt_call(VIRT_WDT_CONTROL, 3, 0, 0);
+	hret = res.a0;
+	ret = gh_error_remap(hret);
+	if (hret) {
+		dev_err(wdog_dd->dev, "failed enabling vWDOG, hret = %d ret = %d\n",
+			hret, ret);
+	}
+
+	return ret;
+}
+
+/**
+ *  gh_disable_wdt() - Disables the virtual watchdog
+ *
+ *  @wdog_dd: The qcom watchdog data structure
+ *
+ *  VIRT_WDT_CONTROL is used to disable the virtual watchdog.
+ *  Bit 0 is used to disable the watchdog. When this Bit is set to
+ *  0 the watchdog is disabled. NOTE: Bit 1 must always be set to
+ *  1 as this bit is reserved in the hypervisor and Bit 1 is
+ *  expected to be 1. If this Bit is not set, the hypervisor will
+ *  return an error. So to disable the watchdog you must use the value 2.
+ *  An error from the hypervisor is expected if you try to disable the
+ *  watchdog when its already disabled.
+ *
+ *  return: 0 on success, negative errno on failure.
+ */
+static int gh_disable_wdt(struct msm_watchdog_data *wdog_dd)
+{
+	struct arm_smccc_res res;
+	int hret, ret;
+
+	if (!wdog_dd->enabled) {
+		dev_err(wdog_dd->dev, "vWDT already disabled\n");
+		return 0;
+	}
+	res = gh_wdt_call(VIRT_WDT_CONTROL, 2, 0, 0);
+	hret = res.a0;
+	ret = gh_error_remap(hret);
+	if (hret) {
+		dev_err(wdog_dd->dev, "failed disabling VDOG, hret = %d ret = %d\n",
+			hret, ret);
+	}
+
+	return ret;
+}
+
+/**
+ *  gh_get_wdt_status() - Displays the status of the virtual watchdog
+ *
+ *  @wdog_dd: The qcom watchdog data structure
+ *
+ *  VIRT_WDT_STATUS is used to display status of the virtual  watchdog.
+ *
+ *  return: 0 on success, negative errno on failure.
+ */
+static int gh_show_wdt_status(struct msm_watchdog_data *wdog_dd)
+{
+	struct arm_smccc_res res;
+	int hret, ret;
+
+	res = gh_wdt_call(VIRT_WDT_STATUS, 0, 0, 0);
+	hret = res.a0;
+	ret = gh_error_remap(hret);
+	if (hret) {
+		dev_err(wdog_dd->dev, "failed to get vWDOG status, hret = %d ret = %d\n",
+			hret, ret);
+	} else {
+		dev_err(wdog_dd->dev,
+			"vWdog-CTL: %d, vWdog-time since last pet: %d, vWdog-expired status: %d\n",
+			res.a1 & 1, res.a2, (res.a1 >> 31) & 1);
+	}
+
+	return ret;
+}
+
+static struct qcom_wdt_ops gh_wdt_ops = {
+	.set_bark_time  = gh_set_wdt_bark,
+	.set_bite_time  = gh_set_wdt_bite,
+	.reset_wdt      = gh_reset_wdt,
+	.enable_wdt     = gh_enable_wdt,
+	.disable_wdt    = gh_disable_wdt,
+	.show_wdt_status = gh_show_wdt_status
+};
+
+static int gh_wdt_probe(struct platform_device *pdev)
+{
+	struct msm_watchdog_data *wdog_dd;
+
+	wdog_dd = devm_kzalloc(&pdev->dev, sizeof(*wdog_dd), GFP_KERNEL);
+	if (!wdog_dd)
+		return -ENOMEM;
+	wdog_dd->ops = &gh_wdt_ops;
+
+	return qcom_wdt_register(pdev, wdog_dd, "gh-watchdog");
+}
+
+static const struct dev_pm_ops gh_wdt_dev_pm_ops = {
+#ifdef CONFIG_PM_SLEEP
+	.suspend_late = qcom_wdt_pet_suspend,
+	.resume_early = qcom_wdt_pet_resume,
+#endif
+	.freeze_late = qcom_wdt_pet_suspend,
+	.restore_early = qcom_wdt_pet_resume,
+};
+
+static const struct of_device_id gh_wdt_match_table[] = {
+	{ .compatible = "qcom,gh-watchdog" },
+	{}
+};
+
+static struct platform_driver gh_wdt_driver = {
+	.probe = gh_wdt_probe,
+	.remove = qcom_wdt_remove,
+	.driver = {
+		.name = "gh-watchdog",
+		.pm = &gh_wdt_dev_pm_ops,
+		.of_match_table = gh_wdt_match_table,
+	},
+};
+
+static int __init init_watchdog(void)
+{
+	return platform_driver_register(&gh_wdt_driver);
+}
+
+#if IS_MODULE(CONFIG_GH_VIRT_WATCHDOG)
+module_init(init_watchdog);
+#else
+pure_initcall(init_watchdog);
+#endif
+
+static __exit void exit_watchdog(void)
+{
+	platform_driver_unregister(&gh_wdt_driver);
+}
+module_exit(exit_watchdog);
+MODULE_DESCRIPTION("QCOM Gunyah Watchdog Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/gunyah_ioeventfd.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/gunyah_ioeventfd.c
@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/eventfd.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/gunyah.h>
+#include <linux/gunyah_vm_mgr.h>
+#include <linux/module.h>
+#include <linux/printk.h>
+
+#include <uapi/linux/gunyah.h>
+
+struct gh_ioeventfd {
+	struct gh_vm_function_instance *f;
+	struct gh_vm_io_handler io_handler;
+
+	struct eventfd_ctx *ctx;
+};
+
+static int gh_write_ioeventfd(struct gh_vm_io_handler *io_dev, u64 addr, u32 len, u64 data)
+{
+	struct gh_ioeventfd *iofd = container_of(io_dev, struct gh_ioeventfd, io_handler);
+
+	eventfd_signal(iofd->ctx);
+	return 0;
+}
+
+static struct gh_vm_io_handler_ops io_ops = {
+	.write = gh_write_ioeventfd,
+};
+
+static long gh_ioeventfd_bind(struct gh_vm_function_instance *f)
+{
+	const struct gh_fn_ioeventfd_arg *args = f->argp;
+	struct gh_ioeventfd *iofd;
+	struct eventfd_ctx *ctx;
+	int ret;
+
+	if (f->arg_size != sizeof(*args))
+		return -EINVAL;
+
+	/* All other flag bits are reserved for future use */
+	if (args->flags & ~GH_IOEVENTFD_FLAGS_DATAMATCH)
+		return -EINVAL;
+
+	/* must be natural-word sized, or 0 to ignore length */
+	switch (args->len) {
+	case 0:
+	case 1:
+	case 2:
+	case 4:
+	case 8:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* check for range overflow */
+	if (overflows_type(args->addr + args->len, u64))
+		return -EINVAL;
+
+	/* ioeventfd with no length can't be combined with DATAMATCH */
+	if (!args->len && (args->flags & GH_IOEVENTFD_FLAGS_DATAMATCH))
+		return -EINVAL;
+
+	ctx = eventfd_ctx_fdget(args->fd);
+	if (IS_ERR(ctx))
+		return PTR_ERR(ctx);
+
+	iofd = kzalloc(sizeof(*iofd), GFP_KERNEL);
+	if (!iofd) {
+		ret = -ENOMEM;
+		goto err_eventfd;
+	}
+
+	f->data = iofd;
+	iofd->f = f;
+
+	iofd->ctx = ctx;
+
+	if (args->flags & GH_IOEVENTFD_FLAGS_DATAMATCH) {
+		iofd->io_handler.datamatch = true;
+		iofd->io_handler.len = args->len;
+		iofd->io_handler.data = args->datamatch;
+	}
+	iofd->io_handler.addr = args->addr;
+	iofd->io_handler.ops = &io_ops;
+
+	ret = gh_vm_add_io_handler(f->ghvm, &iofd->io_handler);
+	if (ret)
+		goto err_io_dev_add;
+
+	return 0;
+
+err_io_dev_add:
+	kfree(iofd);
+err_eventfd:
+	eventfd_ctx_put(ctx);
+	return ret;
+}
+
+static void gh_ioevent_unbind(struct gh_vm_function_instance *f)
+{
+	struct gh_ioeventfd *iofd = f->data;
+
+	eventfd_ctx_put(iofd->ctx);
+	gh_vm_remove_io_handler(iofd->f->ghvm, &iofd->io_handler);
+	kfree(iofd);
+}
+
+static bool gh_ioevent_compare(const struct gh_vm_function_instance *f,
+				const void *arg, size_t size)
+{
+	const struct gh_fn_ioeventfd_arg *instance = f->argp,
+					 *other = arg;
+
+	if (sizeof(*other) != size)
+		return false;
+
+	return instance->addr == other->addr;
+}
+
+DECLARE_GH_VM_FUNCTION_INIT(ioeventfd, GH_FN_IOEVENTFD, 3,
+				gh_ioeventfd_bind, gh_ioevent_unbind,
+				gh_ioevent_compare);
+MODULE_DESCRIPTION("Gunyah ioeventfd VM Function");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/gunyah_irqfd.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/gunyah_irqfd.c
@@ -0,0 +1,180 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/eventfd.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/gunyah.h>
+#include <linux/gunyah_vm_mgr.h>
+#include <linux/module.h>
+#include <linux/poll.h>
+#include <linux/printk.h>
+
+#include <uapi/linux/gunyah.h>
+
+struct gh_irqfd {
+	struct gh_resource *ghrsc;
+	struct gh_vm_resource_ticket ticket;
+	struct gh_vm_function_instance *f;
+
+	bool level;
+
+	struct eventfd_ctx *ctx;
+	wait_queue_entry_t wait;
+	poll_table pt;
+};
+
+static int irqfd_wakeup(wait_queue_entry_t *wait, unsigned int mode, int sync, void *key)
+{
+	struct gh_irqfd *irqfd = container_of(wait, struct gh_irqfd, wait);
+	__poll_t flags = key_to_poll(key);
+	int ret = 0;
+
+	if (flags & EPOLLIN) {
+		if (irqfd->ghrsc) {
+			ret = gh_hypercall_bell_send(irqfd->ghrsc->capid, 1, NULL);
+			if (ret)
+				pr_err_ratelimited("Failed to inject interrupt %d: %d\n",
+						irqfd->ticket.label, ret);
+		} else
+			pr_err_ratelimited("Premature injection of interrupt\n");
+	}
+
+	return 0;
+}
+
+static void irqfd_ptable_queue_proc(struct file *file, wait_queue_head_t *wqh, poll_table *pt)
+{
+	struct gh_irqfd *irq_ctx = container_of(pt, struct gh_irqfd, pt);
+
+	add_wait_queue(wqh, &irq_ctx->wait);
+}
+
+static bool gh_irqfd_populate(struct gh_vm_resource_ticket *ticket, struct gh_resource *ghrsc)
+{
+	struct gh_irqfd *irqfd = container_of(ticket, struct gh_irqfd, ticket);
+	int ret;
+
+	if (irqfd->ghrsc) {
+		pr_warn("irqfd%d already got a Gunyah resource. Check if multiple resources with same label were configured.\n",
+			irqfd->ticket.label);
+		return false;
+	}
+
+	irqfd->ghrsc = ghrsc;
+	if (irqfd->level) {
+		/* Configure the bell to trigger when bit 0 is asserted (see
+		 * irq_wakeup) and for bell to automatically clear bit 0 once
+		 * received by the VM (ack_mask).  need to make sure bit 0 is cleared right away,
+		 * otherwise the line will never be deasserted. Emulating edge
+		 * trigger interrupt does not need to set either mask
+		 * because irq is listed only once per gh_hypercall_bell_send
+		 */
+		ret = gh_hypercall_bell_set_mask(irqfd->ghrsc->capid, 1, 1);
+		if (ret)
+			pr_warn("irq %d couldn't be set as level triggered. Might cause IRQ storm if asserted\n",
+				irqfd->ticket.label);
+	}
+
+	return true;
+}
+
+static void gh_irqfd_unpopulate(struct gh_vm_resource_ticket *ticket, struct gh_resource *ghrsc)
+{
+	struct gh_irqfd *irqfd = container_of(ticket, struct gh_irqfd, ticket);
+	u64 cnt;
+
+	eventfd_ctx_remove_wait_queue(irqfd->ctx, &irqfd->wait, &cnt);
+}
+
+static long gh_irqfd_bind(struct gh_vm_function_instance *f)
+{
+	struct gh_fn_irqfd_arg *args = f->argp;
+	struct gh_irqfd *irqfd;
+	__poll_t events;
+	struct fd fd;
+	long r;
+
+	if (f->arg_size != sizeof(*args))
+		return -EINVAL;
+
+	/* All other flag bits are reserved for future use */
+	if (args->flags & ~GH_IRQFD_FLAGS_LEVEL)
+		return -EINVAL;
+
+	irqfd = kzalloc(sizeof(*irqfd), GFP_KERNEL);
+	if (!irqfd)
+		return -ENOMEM;
+
+	irqfd->f = f;
+	f->data = irqfd;
+
+	fd = fdget(args->fd);
+	if (!fd.file) {
+		kfree(irqfd);
+		return -EBADF;
+	}
+
+	irqfd->ctx = eventfd_ctx_fileget(fd.file);
+	if (IS_ERR(irqfd->ctx)) {
+		r = PTR_ERR(irqfd->ctx);
+		goto err_fdput;
+	}
+
+	if (args->flags & GH_IRQFD_FLAGS_LEVEL)
+		irqfd->level = true;
+
+	init_waitqueue_func_entry(&irqfd->wait, irqfd_wakeup);
+	init_poll_funcptr(&irqfd->pt, irqfd_ptable_queue_proc);
+
+	irqfd->ticket.resource_type = GH_RESOURCE_TYPE_BELL_TX;
+	irqfd->ticket.label = args->label;
+	irqfd->ticket.owner = THIS_MODULE;
+	irqfd->ticket.populate = gh_irqfd_populate;
+	irqfd->ticket.unpopulate = gh_irqfd_unpopulate;
+
+	r = gh_vm_add_resource_ticket(f->ghvm, &irqfd->ticket);
+	if (r)
+		goto err_ctx;
+
+	events = vfs_poll(fd.file, &irqfd->pt);
+	if (events & EPOLLIN)
+		pr_warn("Premature injection of interrupt\n");
+	fdput(fd);
+
+	return 0;
+err_ctx:
+	eventfd_ctx_put(irqfd->ctx);
+err_fdput:
+	fdput(fd);
+	kfree(irqfd);
+	return r;
+}
+
+static void gh_irqfd_unbind(struct gh_vm_function_instance *f)
+{
+	struct gh_irqfd *irqfd = f->data;
+
+	gh_vm_remove_resource_ticket(irqfd->f->ghvm, &irqfd->ticket);
+	eventfd_ctx_put(irqfd->ctx);
+	kfree(irqfd);
+}
+
+static bool gh_irqfd_compare(const struct gh_vm_function_instance *f,
+				const void *arg, size_t size)
+{
+	const struct gh_fn_irqfd_arg *instance = f->argp,
+					 *other = arg;
+
+	if (sizeof(*other) != size)
+		return false;
+
+	return instance->label == other->label;
+}
+
+DECLARE_GH_VM_FUNCTION_INIT(irqfd, GH_FN_IRQFD, 2, gh_irqfd_bind, gh_irqfd_unbind,
+				gh_irqfd_compare);
+MODULE_DESCRIPTION("Gunyah irqfd VM Function");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/gunyah_platform_hooks.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/gunyah_platform_hooks.c
@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/rwsem.h>
+#include <linux/gunyah_rsc_mgr.h>
+
+#include "rsc_mgr.h"
+
+static const struct gh_rm_platform_ops *rm_platform_ops;
+static DECLARE_RWSEM(rm_platform_ops_lock);
+
+int gh_rm_platform_pre_mem_share(struct gh_rm *rm, struct gh_rm_mem_parcel *mem_parcel)
+{
+	int ret = 0;
+
+	down_read(&rm_platform_ops_lock);
+	if (rm_platform_ops && rm_platform_ops->pre_mem_share)
+		ret = rm_platform_ops->pre_mem_share(rm, mem_parcel);
+	up_read(&rm_platform_ops_lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(gh_rm_platform_pre_mem_share);
+
+int gh_rm_platform_post_mem_reclaim(struct gh_rm *rm, struct gh_rm_mem_parcel *mem_parcel)
+{
+	int ret = 0;
+
+	down_read(&rm_platform_ops_lock);
+	if (rm_platform_ops && rm_platform_ops->post_mem_reclaim)
+		ret = rm_platform_ops->post_mem_reclaim(rm, mem_parcel);
+	up_read(&rm_platform_ops_lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(gh_rm_platform_post_mem_reclaim);
+
+int gh_rm_register_platform_ops(const struct gh_rm_platform_ops *platform_ops)
+{
+	int ret = 0;
+
+	down_write(&rm_platform_ops_lock);
+	if (!rm_platform_ops)
+		rm_platform_ops = platform_ops;
+	else
+		ret = -EEXIST;
+	up_write(&rm_platform_ops_lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(gh_rm_register_platform_ops);
+
+void gh_rm_unregister_platform_ops(const struct gh_rm_platform_ops *platform_ops)
+{
+	down_write(&rm_platform_ops_lock);
+	if (rm_platform_ops == platform_ops)
+		rm_platform_ops = NULL;
+	up_write(&rm_platform_ops_lock);
+}
+EXPORT_SYMBOL_GPL(gh_rm_unregister_platform_ops);
+
+static void _devm_gh_rm_unregister_platform_ops(void *data)
+{
+	gh_rm_unregister_platform_ops((const struct gh_rm_platform_ops *)data);
+}
+
+int devm_gh_rm_register_platform_ops(struct device *dev, const struct gh_rm_platform_ops *ops)
+{
+	int ret;
+
+	ret = gh_rm_register_platform_ops(ops);
+	if (ret)
+		return ret;
+
+	return devm_add_action(dev, _devm_gh_rm_unregister_platform_ops, (void *)ops);
+}
+EXPORT_SYMBOL_GPL(devm_gh_rm_register_platform_ops);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Gunyah Platform Hooks");
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/gunyah_qcom.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/gunyah_qcom.c
@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/arm-smccc.h>
+#include <linux/gunyah_rsc_mgr.h>
+#include <linux/module.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/types.h>
+#include <linux/uuid.h>
+
+#define QCOM_SCM_RM_MANAGED_VMID	0x3A
+#define QCOM_SCM_MAX_MANAGED_VMID	0x3F
+
+static int qcom_scm_gh_rm_pre_mem_share(struct gh_rm *rm, struct gh_rm_mem_parcel *mem_parcel)
+{
+	struct qcom_scm_vmperm *new_perms;
+	u64 src, src_cpy;
+	int ret = 0, i, n;
+	u16 vmid;
+
+	new_perms = kcalloc(mem_parcel->n_acl_entries, sizeof(*new_perms), GFP_KERNEL);
+	if (!new_perms)
+		return -ENOMEM;
+
+	for (n = 0; n < mem_parcel->n_acl_entries; n++) {
+		vmid = le16_to_cpu(mem_parcel->acl_entries[n].vmid);
+		if (vmid <= QCOM_SCM_MAX_MANAGED_VMID)
+			new_perms[n].vmid = vmid;
+		else
+			new_perms[n].vmid = QCOM_SCM_RM_MANAGED_VMID;
+		if (mem_parcel->acl_entries[n].perms & GH_RM_ACL_X)
+			new_perms[n].perm |= QCOM_SCM_PERM_EXEC;
+		if (mem_parcel->acl_entries[n].perms & GH_RM_ACL_W)
+			new_perms[n].perm |= QCOM_SCM_PERM_WRITE;
+		if (mem_parcel->acl_entries[n].perms & GH_RM_ACL_R)
+			new_perms[n].perm |= QCOM_SCM_PERM_READ;
+	}
+
+	src = BIT_ULL(QCOM_SCM_VMID_HLOS);
+
+	for (i = 0; i < mem_parcel->n_mem_entries; i++) {
+		src_cpy = src;
+		ret = qcom_scm_assign_mem(le64_to_cpu(mem_parcel->mem_entries[i].phys_addr),
+						le64_to_cpu(mem_parcel->mem_entries[i].size),
+						&src_cpy, new_perms, mem_parcel->n_acl_entries);
+		if (ret)
+			break;
+	}
+
+	if (!ret)
+		goto out;
+
+	src = 0;
+	for (n = 0; n < mem_parcel->n_acl_entries; n++) {
+		vmid = le16_to_cpu(mem_parcel->acl_entries[n].vmid);
+		if (vmid <= QCOM_SCM_MAX_MANAGED_VMID)
+			src |= BIT_ULL(vmid);
+		else
+			src |= BIT_ULL(QCOM_SCM_RM_MANAGED_VMID);
+	}
+
+	new_perms[0].vmid = QCOM_SCM_VMID_HLOS;
+
+	for (i--; i >= 0; i--) {
+		src_cpy = src;
+		WARN_ON_ONCE(qcom_scm_assign_mem(
+				le64_to_cpu(mem_parcel->mem_entries[i].phys_addr),
+				le64_to_cpu(mem_parcel->mem_entries[i].size),
+				&src_cpy, new_perms, 1));
+	}
+
+out:
+	kfree(new_perms);
+	return ret;
+}
+
+static int qcom_scm_gh_rm_post_mem_reclaim(struct gh_rm *rm, struct gh_rm_mem_parcel *mem_parcel)
+{
+	struct qcom_scm_vmperm new_perms;
+	u64 src = 0, src_cpy;
+	int ret = 0, i, n;
+	u16 vmid;
+
+	new_perms.vmid = QCOM_SCM_VMID_HLOS;
+	new_perms.perm = QCOM_SCM_PERM_EXEC | QCOM_SCM_PERM_WRITE | QCOM_SCM_PERM_READ;
+
+	for (n = 0; n < mem_parcel->n_acl_entries; n++) {
+		vmid = le16_to_cpu(mem_parcel->acl_entries[n].vmid);
+		if (vmid <= QCOM_SCM_MAX_MANAGED_VMID)
+			src |= (1ull << vmid);
+		else
+			src |= (1ull << QCOM_SCM_RM_MANAGED_VMID);
+	}
+
+	for (i = 0; i < mem_parcel->n_mem_entries; i++) {
+		src_cpy = src;
+		ret = qcom_scm_assign_mem(le64_to_cpu(mem_parcel->mem_entries[i].phys_addr),
+						le64_to_cpu(mem_parcel->mem_entries[i].size),
+						&src_cpy, &new_perms, 1);
+		WARN_ON_ONCE(ret);
+	}
+
+	return ret;
+}
+
+static struct gh_rm_platform_ops qcom_scm_gh_rm_platform_ops = {
+	.pre_mem_share = qcom_scm_gh_rm_pre_mem_share,
+	.post_mem_reclaim = qcom_scm_gh_rm_post_mem_reclaim,
+};
+
+/* {19bd54bd-0b37-571b-946f-609b54539de6} */
+static const uuid_t QCOM_EXT_UUID =
+	UUID_INIT(0x19bd54bd, 0x0b37, 0x571b, 0x94, 0x6f, 0x60, 0x9b, 0x54, 0x53, 0x9d, 0xe6);
+
+#define GH_QCOM_EXT_CALL_UUID_ID	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, \
+							   ARM_SMCCC_OWNER_VENDOR_HYP, 0x3f01)
+
+static bool gh_has_qcom_extensions(void)
+{
+	struct arm_smccc_res res;
+	uuid_t uuid;
+	u32 *up;
+
+	arm_smccc_1_1_smc(GH_QCOM_EXT_CALL_UUID_ID, &res);
+
+	up = (u32 *)&uuid.b[0];
+	up[0] = lower_32_bits(res.a0);
+	up[1] = lower_32_bits(res.a1);
+	up[2] = lower_32_bits(res.a2);
+	up[3] = lower_32_bits(res.a3);
+
+	return uuid_equal(&uuid, &QCOM_EXT_UUID);
+}
+
+static int __init qcom_gh_platform_hooks_register(void)
+{
+	struct property *prop;
+
+	prop = of_find_property(of_root, "qcom,msm-id", NULL);
+	if (!prop)
+		return -ENODEV;
+
+	if (!gh_has_qcom_extensions())
+		return -ENODEV;
+
+	return gh_rm_register_platform_ops(&qcom_scm_gh_rm_platform_ops);
+}
+
+static void __exit qcom_gh_platform_hooks_unregister(void)
+{
+	gh_rm_unregister_platform_ops(&qcom_scm_gh_rm_platform_ops);
+}
+
+module_init(qcom_gh_platform_hooks_register);
+module_exit(qcom_gh_platform_hooks_unregister);
+MODULE_DESCRIPTION("Qualcomm Technologies, Inc. Platform Hooks for Gunyah");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/gunyah_vcpu.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/gunyah_vcpu.c
@@ -0,0 +1,494 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/anon_inodes.h>
+#include <linux/file.h>
+#include <linux/gunyah.h>
+#include <linux/gunyah_vm_mgr.h>
+#include <linux/interrupt.h>
+#include <linux/kref.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+
+#include "vm_mgr.h"
+
+#include <uapi/linux/gunyah.h>
+
+#define MAX_VCPU_NAME		20 /* gh-vcpu:u32_max+NUL */
+
+struct gh_vcpu {
+	struct gh_vm_function_instance *f;
+	struct gh_resource *rsc;
+	struct mutex run_lock;
+	/* Track why vcpu_run left last time around. */
+	enum {
+		GH_VCPU_UNKNOWN = 0,
+		GH_VCPU_READY,
+		GH_VCPU_MMIO_READ,
+		GH_VCPU_SYSTEM_DOWN,
+	} state;
+	u8 mmio_read_len;
+	struct gh_vcpu_run *vcpu_run;
+	struct completion ready;
+	struct gh_vm *ghvm;
+
+	struct notifier_block nb;
+	struct gh_vm_resource_ticket ticket;
+	struct kref kref;
+};
+
+static void vcpu_release(struct kref *kref)
+{
+	struct gh_vcpu *vcpu = container_of(kref, struct gh_vcpu, kref);
+
+	free_page((unsigned long)vcpu->vcpu_run);
+	kfree(vcpu);
+}
+
+/*
+ * When hypervisor allows us to schedule vCPU again, it gives us an interrupt
+ */
+static irqreturn_t gh_vcpu_irq_handler(int irq, void *data)
+{
+	struct gh_vcpu *vcpu = data;
+
+	complete(&vcpu->ready);
+	return IRQ_HANDLED;
+}
+
+static bool gh_handle_mmio(struct gh_vcpu *vcpu,
+				struct gh_hypercall_vcpu_run_resp *vcpu_run_resp)
+{
+	int ret = 0;
+	u64 addr = vcpu_run_resp->state_data[0],
+	    len  = vcpu_run_resp->state_data[1],
+	    data = vcpu_run_resp->state_data[2];
+
+	if (WARN_ON(len > sizeof(u64)))
+		len = sizeof(u64);
+
+	if (vcpu_run_resp->state == GH_VCPU_ADDRSPACE_VMMIO_READ) {
+		vcpu->vcpu_run->mmio.is_write = 0;
+		/* Record that we need to give vCPU user's supplied value next gh_vcpu_run() */
+		vcpu->state = GH_VCPU_MMIO_READ;
+		vcpu->mmio_read_len = len;
+	} else { /* GH_VCPU_ADDRSPACE_VMMIO_WRITE */
+		/* Try internal handlers first */
+		ret = gh_vm_mmio_write(vcpu->f->ghvm, addr, len, data);
+		if (!ret)
+			return true;
+
+		/* Give userspace the info */
+		vcpu->vcpu_run->mmio.is_write = 1;
+		memcpy(vcpu->vcpu_run->mmio.data, &data, len);
+	}
+
+	vcpu->vcpu_run->mmio.phys_addr = addr;
+	vcpu->vcpu_run->mmio.len = len;
+	vcpu->vcpu_run->exit_reason = GH_VCPU_EXIT_MMIO;
+
+	return false;
+}
+
+static int gh_vcpu_rm_notification(struct notifier_block *nb, unsigned long action, void *data)
+{
+	struct gh_vcpu *vcpu = container_of(nb, struct gh_vcpu, nb);
+	struct gh_rm_vm_exited_payload *exit_payload = data;
+
+	if (action == GH_RM_NOTIFICATION_VM_EXITED &&
+		le16_to_cpu(exit_payload->vmid) == vcpu->ghvm->vmid)
+		complete(&vcpu->ready);
+
+	return NOTIFY_OK;
+}
+
+static inline enum gh_vm_status remap_vm_status(enum gh_rm_vm_status rm_status)
+{
+	switch (rm_status) {
+	case GH_RM_VM_STATUS_INIT_FAILED:
+		return GH_VM_STATUS_LOAD_FAILED;
+	case GH_RM_VM_STATUS_EXITED:
+		return GH_VM_STATUS_EXITED;
+	default:
+		return GH_VM_STATUS_CRASHED;
+	}
+}
+
+/**
+ * gh_vcpu_check_system() - Check whether VM as a whole is running
+ * @vcpu: Pointer to gh_vcpu
+ *
+ * Returns true if the VM is alive.
+ * Returns false if the vCPU is the VM is not alive (can only be that VM is shutting down).
+ */
+static bool gh_vcpu_check_system(struct gh_vcpu *vcpu)
+	__must_hold(&vcpu->run_lock)
+{
+	bool ret = true;
+
+	down_read(&vcpu->ghvm->status_lock);
+	if (likely(vcpu->ghvm->vm_status == GH_RM_VM_STATUS_RUNNING))
+		goto out;
+
+	vcpu->vcpu_run->status.status = remap_vm_status(vcpu->ghvm->vm_status);
+	vcpu->vcpu_run->status.exit_info = vcpu->ghvm->exit_info;
+	vcpu->vcpu_run->exit_reason = GH_VCPU_EXIT_STATUS;
+	vcpu->state = GH_VCPU_SYSTEM_DOWN;
+	ret = false;
+out:
+	up_read(&vcpu->ghvm->status_lock);
+	return ret;
+}
+
+/*
+ * We must have interrupts enabled when making the hypercall to switch to
+ * guest vcpu, else guest vcpu runs until end of hypervisor scheduling time
+ * slice and also increases interrupt latency. Native vtime accounting
+ * requires that interrupts are disabled, so we can't do accounting.
+ */
+#if IS_ENABLED(CONFIG_TICK_CPU_ACCOUNTING)
+static inline void gh_guest_accounting_enter(void)
+{
+	vtime_account_guest_enter();
+}
+
+static inline void gh_guest_accounting_exit(void)
+{
+	vtime_account_guest_exit();
+}
+#else /* !CONFIG_TICK_CPU_ACCOUNTING */
+static inline void gh_guest_accounting_enter(void) { }
+static inline void gh_guest_accounting_exit(void) { }
+#endif /* CONFIG_TICK_CPU_ACCOUNTING */
+
+/**
+ * gh_vcpu_run() - Request Gunyah to begin scheduling this vCPU.
+ * @vcpu: The client descriptor that was obtained via gh_vcpu_alloc()
+ */
+static int gh_vcpu_run(struct gh_vcpu *vcpu)
+{
+	struct gh_hypercall_vcpu_run_resp vcpu_run_resp;
+	u64 state_data[3] = { 0 };
+	enum gh_error gh_error;
+	int ret = 0;
+
+	if (!vcpu->f)
+		return -ENODEV;
+
+	if (mutex_lock_interruptible(&vcpu->run_lock))
+		return -ERESTARTSYS;
+
+	if (!vcpu->rsc) {
+		ret = -ENODEV;
+		goto out;
+	}
+
+	switch (vcpu->state) {
+	case GH_VCPU_UNKNOWN:
+		if (vcpu->ghvm->vm_status != GH_RM_VM_STATUS_RUNNING) {
+			/* Check if VM is up. If VM is starting, will block until VM is fully up
+			 * since that thread does down_write.
+			 */
+			if (!gh_vcpu_check_system(vcpu))
+				goto out;
+		}
+		vcpu->state = GH_VCPU_READY;
+		break;
+	case GH_VCPU_MMIO_READ:
+		if (unlikely(vcpu->mmio_read_len > sizeof(state_data[0])))
+			vcpu->mmio_read_len = sizeof(state_data[0]);
+		memcpy(&state_data[0], vcpu->vcpu_run->mmio.data, vcpu->mmio_read_len);
+		vcpu->state = GH_VCPU_READY;
+		break;
+	case GH_VCPU_SYSTEM_DOWN:
+		goto out;
+	default:
+		break;
+	}
+
+	while (!ret && !signal_pending(current)) {
+		if (vcpu->vcpu_run->immediate_exit) {
+			ret = -EINTR;
+			goto out;
+		}
+
+		gh_guest_accounting_enter();
+		gh_error = gh_hypercall_vcpu_run(vcpu->rsc->capid, state_data, &vcpu_run_resp);
+		gh_guest_accounting_exit();
+		if (gh_error == GH_ERROR_OK) {
+			memset(state_data, 0, sizeof(state_data));
+			switch (vcpu_run_resp.state) {
+			case GH_VCPU_STATE_READY:
+				if (need_resched())
+					schedule();
+				break;
+			case GH_VCPU_STATE_POWERED_OFF:
+				/* vcpu might be off because the VM is shut down.
+				 * If so, it won't ever run again: exit back to user
+				 */
+				if (!gh_vcpu_check_system(vcpu))
+					goto out;
+				/* Otherwise, another vcpu will turn it on (e.g. by PSCI)
+				 * and hyp sends an interrupt to wake Linux up.
+				 */
+				fallthrough;
+			case GH_VCPU_STATE_EXPECTS_WAKEUP:
+				ret = wait_for_completion_interruptible(&vcpu->ready);
+				/* reinitialize completion before next hypercall. If we reinitialize
+				 * after the hypercall, interrupt may have already come before
+				 * re-initializing the completion and then end up waiting for
+				 * event that already happened.
+				 */
+				reinit_completion(&vcpu->ready);
+				/* Check system status again. Completion might've
+				 * come from gh_vcpu_rm_notification
+				 */
+				if (!ret && !gh_vcpu_check_system(vcpu))
+					goto out;
+				break;
+			case GH_VCPU_STATE_BLOCKED:
+				schedule();
+				break;
+			case GH_VCPU_ADDRSPACE_VMMIO_READ:
+			case GH_VCPU_ADDRSPACE_VMMIO_WRITE:
+				if (!gh_handle_mmio(vcpu, &vcpu_run_resp))
+					goto out;
+				break;
+			default:
+				pr_warn_ratelimited("Unknown vCPU state: %llx\n",
+							vcpu_run_resp.sized_state);
+				schedule();
+				break;
+			}
+		} else if (gh_error == GH_ERROR_RETRY) {
+			schedule();
+		} else {
+			ret = gh_error_remap(gh_error);
+		}
+	}
+
+out:
+	mutex_unlock(&vcpu->run_lock);
+
+	if (signal_pending(current))
+		return -ERESTARTSYS;
+
+	return ret;
+}
+
+static long gh_vcpu_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+{
+	struct gh_vcpu *vcpu = filp->private_data;
+	long ret = -EINVAL;
+
+	switch (cmd) {
+	case GH_VCPU_RUN:
+		ret = gh_vcpu_run(vcpu);
+		break;
+	case GH_VCPU_MMAP_SIZE:
+		ret = PAGE_SIZE;
+		break;
+	default:
+		break;
+	}
+	return ret;
+}
+
+static int gh_vcpu_release(struct inode *inode, struct file *filp)
+{
+	struct gh_vcpu *vcpu = filp->private_data;
+
+	gh_vm_put(vcpu->ghvm);
+	kref_put(&vcpu->kref, vcpu_release);
+	return 0;
+}
+
+static vm_fault_t gh_vcpu_fault(struct vm_fault *vmf)
+{
+	struct gh_vcpu *vcpu = vmf->vma->vm_file->private_data;
+	struct page *page = NULL;
+
+	if (vmf->pgoff == 0)
+		page = virt_to_page(vcpu->vcpu_run);
+
+	get_page(page);
+	vmf->page = page;
+	return 0;
+}
+
+static const struct vm_operations_struct gh_vcpu_ops = {
+	.fault = gh_vcpu_fault,
+};
+
+static int gh_vcpu_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	vma->vm_ops = &gh_vcpu_ops;
+	return 0;
+}
+
+static const struct file_operations gh_vcpu_fops = {
+	.owner = THIS_MODULE,
+	.unlocked_ioctl = gh_vcpu_ioctl,
+	.release = gh_vcpu_release,
+	.llseek = noop_llseek,
+	.mmap = gh_vcpu_mmap,
+};
+
+static bool gh_vcpu_populate(struct gh_vm_resource_ticket *ticket, struct gh_resource *ghrsc)
+{
+	struct gh_vcpu *vcpu = container_of(ticket, struct gh_vcpu, ticket);
+	int ret;
+
+	mutex_lock(&vcpu->run_lock);
+	if (vcpu->rsc) {
+		pr_warn("vcpu%d already got a Gunyah resource. Check if multiple resources with same label were configured.\n",
+			vcpu->ticket.label);
+		ret = -EEXIST;
+		goto out;
+	}
+
+	vcpu->rsc = ghrsc;
+	init_completion(&vcpu->ready);
+
+	ret = request_irq(vcpu->rsc->irq, gh_vcpu_irq_handler, IRQF_TRIGGER_RISING, "gh_vcpu",
+			vcpu);
+	if (ret)
+		pr_warn("Failed to request vcpu irq %d: %d\n", vcpu->rsc->irq, ret);
+
+	enable_irq_wake(vcpu->rsc->irq);
+
+out:
+	mutex_unlock(&vcpu->run_lock);
+	return !ret;
+}
+
+static void gh_vcpu_unpopulate(struct gh_vm_resource_ticket *ticket,
+				   struct gh_resource *ghrsc)
+{
+	struct gh_vcpu *vcpu = container_of(ticket, struct gh_vcpu, ticket);
+
+	vcpu->vcpu_run->immediate_exit = true;
+	complete_all(&vcpu->ready);
+	mutex_lock(&vcpu->run_lock);
+	free_irq(vcpu->rsc->irq, vcpu);
+	vcpu->rsc = NULL;
+	mutex_unlock(&vcpu->run_lock);
+}
+
+static long gh_vcpu_bind(struct gh_vm_function_instance *f)
+{
+	struct gh_fn_vcpu_arg *arg = f->argp;
+	struct gh_vcpu *vcpu;
+	char name[MAX_VCPU_NAME];
+	struct file *file;
+	struct page *page;
+	int fd;
+	long r;
+
+	if (f->arg_size != sizeof(*arg))
+		return -EINVAL;
+
+	vcpu = kzalloc(sizeof(*vcpu), GFP_KERNEL);
+	if (!vcpu)
+		return -ENOMEM;
+
+	vcpu->f = f;
+	f->data = vcpu;
+	mutex_init(&vcpu->run_lock);
+	kref_init(&vcpu->kref);
+
+	page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+	if (!page) {
+		r = -ENOMEM;
+		goto err_destroy_vcpu;
+	}
+	vcpu->vcpu_run = page_address(page);
+
+	vcpu->ticket.resource_type = GH_RESOURCE_TYPE_VCPU;
+	vcpu->ticket.label = arg->id;
+	vcpu->ticket.owner = THIS_MODULE;
+	vcpu->ticket.populate = gh_vcpu_populate;
+	vcpu->ticket.unpopulate = gh_vcpu_unpopulate;
+
+	r = gh_vm_add_resource_ticket(f->ghvm, &vcpu->ticket);
+	if (r)
+		goto err_destroy_page;
+
+	if (!gh_vm_get(f->ghvm)) {
+		r = -ENODEV;
+		goto err_remove_resource_ticket;
+	}
+	vcpu->ghvm = f->ghvm;
+
+	vcpu->nb.notifier_call = gh_vcpu_rm_notification;
+	/* Ensure we run after the vm_mgr handles the notification and does
+	 * any necessary state changes. We wake up to check the new state.
+	 */
+	vcpu->nb.priority = -1;
+	r = gh_rm_notifier_register(f->rm, &vcpu->nb);
+	if (r)
+		goto err_put_gh_vm;
+
+	kref_get(&vcpu->kref);
+
+	fd = get_unused_fd_flags(O_CLOEXEC);
+	if (fd < 0) {
+		r = fd;
+		goto err_notifier;
+	}
+
+	snprintf(name, sizeof(name), "gh-vcpu:%u", vcpu->ticket.label);
+	file = anon_inode_getfile(name, &gh_vcpu_fops, vcpu, O_RDWR);
+	if (IS_ERR(file)) {
+		r = PTR_ERR(file);
+		goto err_put_fd;
+	}
+
+	fd_install(fd, file);
+
+	return fd;
+err_put_fd:
+	put_unused_fd(fd);
+err_notifier:
+	gh_rm_notifier_unregister(f->rm, &vcpu->nb);
+err_put_gh_vm:
+	gh_vm_put(vcpu->ghvm);
+err_remove_resource_ticket:
+	gh_vm_remove_resource_ticket(f->ghvm, &vcpu->ticket);
+err_destroy_page:
+	free_page((unsigned long)vcpu->vcpu_run);
+err_destroy_vcpu:
+	kfree(vcpu);
+	return r;
+}
+
+static void gh_vcpu_unbind(struct gh_vm_function_instance *f)
+{
+	struct gh_vcpu *vcpu = f->data;
+
+	gh_rm_notifier_unregister(f->rm, &vcpu->nb);
+	gh_vm_remove_resource_ticket(vcpu->f->ghvm, &vcpu->ticket);
+	vcpu->f = NULL;
+
+	kref_put(&vcpu->kref, vcpu_release);
+}
+
+static bool gh_vcpu_compare(const struct gh_vm_function_instance *f,
+				const void *arg, size_t size)
+{
+	const struct gh_fn_vcpu_arg *instance = f->argp,
+					 *other = arg;
+
+	if (sizeof(*other) != size)
+		return false;
+
+	return instance->id == other->id;
+}
+
+DECLARE_GH_VM_FUNCTION_INIT(vcpu, GH_FN_VCPU, 1, gh_vcpu_bind, gh_vcpu_unbind, gh_vcpu_compare);
+MODULE_DESCRIPTION("Gunyah vCPU Function");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/rsc_mgr.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/rsc_mgr.c
@@ -0,0 +1,909 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include <linux/sched.h>
+#include <linux/gunyah.h>
+#include <linux/module.h>
+#include <linux/of_irq.h>
+#include <linux/notifier.h>
+#include <linux/workqueue.h>
+#include <linux/completion.h>
+#include <linux/gunyah_rsc_mgr.h>
+#include <linux/platform_device.h>
+#include <linux/miscdevice.h>
+
+#include <asm/gunyah.h>
+
+#include "rsc_mgr.h"
+#include "vm_mgr.h"
+
+#define RM_RPC_API_VERSION_MASK		GENMASK(3, 0)
+#define RM_RPC_HEADER_WORDS_MASK	GENMASK(7, 4)
+#define RM_RPC_API_VERSION		FIELD_PREP(RM_RPC_API_VERSION_MASK, 1)
+#define RM_RPC_HEADER_WORDS		FIELD_PREP(RM_RPC_HEADER_WORDS_MASK, \
+						(sizeof(struct gh_rm_rpc_hdr) / sizeof(u32)))
+#define RM_RPC_API			(RM_RPC_API_VERSION | RM_RPC_HEADER_WORDS)
+
+#define RM_RPC_TYPE_CONTINUATION	0x0
+#define RM_RPC_TYPE_REQUEST		0x1
+#define RM_RPC_TYPE_REPLY		0x2
+#define RM_RPC_TYPE_NOTIF		0x3
+#define RM_RPC_TYPE_MASK		GENMASK(1, 0)
+
+#define GH_RM_MAX_NUM_FRAGMENTS		62
+#define RM_RPC_FRAGMENTS_MASK		GENMASK(7, 2)
+
+struct gh_rm_rpc_hdr {
+	u8 api;
+	u8 type;
+	__le16 seq;
+	__le32 msg_id;
+} __packed;
+
+struct gh_rm_rpc_reply_hdr {
+	struct gh_rm_rpc_hdr hdr;
+	__le32 err_code; /* GH_RM_ERROR_* */
+} __packed;
+
+#define GH_RM_MAX_MSG_SIZE	(GH_MSGQ_MAX_MSG_SIZE - sizeof(struct gh_rm_rpc_hdr))
+
+/* RM Error codes */
+enum gh_rm_error {
+	GH_RM_ERROR_OK			= 0x0,
+	GH_RM_ERROR_UNIMPLEMENTED	= 0xFFFFFFFF,
+	GH_RM_ERROR_NOMEM		= 0x1,
+	GH_RM_ERROR_NORESOURCE		= 0x2,
+	GH_RM_ERROR_DENIED		= 0x3,
+	GH_RM_ERROR_INVALID		= 0x4,
+	GH_RM_ERROR_BUSY		= 0x5,
+	GH_RM_ERROR_ARGUMENT_INVALID	= 0x6,
+	GH_RM_ERROR_HANDLE_INVALID	= 0x7,
+	GH_RM_ERROR_VALIDATE_FAILED	= 0x8,
+	GH_RM_ERROR_MAP_FAILED		= 0x9,
+	GH_RM_ERROR_MEM_INVALID		= 0xA,
+	GH_RM_ERROR_MEM_INUSE		= 0xB,
+	GH_RM_ERROR_MEM_RELEASED	= 0xC,
+	GH_RM_ERROR_VMID_INVALID	= 0xD,
+	GH_RM_ERROR_LOOKUP_FAILED	= 0xE,
+	GH_RM_ERROR_IRQ_INVALID		= 0xF,
+	GH_RM_ERROR_IRQ_INUSE		= 0x10,
+	GH_RM_ERROR_IRQ_RELEASED	= 0x11,
+};
+
+/**
+ * struct gh_rm_connection - Represents a complete message from resource manager
+ * @payload: Combined payload of all the fragments (msg headers stripped off).
+ * @size: Size of the payload received so far.
+ * @msg_id: Message ID from the header.
+ * @type: RM_RPC_TYPE_REPLY or RM_RPC_TYPE_NOTIF.
+ * @num_fragments: total number of fragments expected to be received.
+ * @fragments_received: fragments received so far.
+ * @reply: Fields used for request/reply sequences
+ * @notification: Fields used for notifiations
+ */
+struct gh_rm_connection {
+	void *payload;
+	size_t size;
+	__le32 msg_id;
+	u8 type;
+
+	u8 num_fragments;
+	u8 fragments_received;
+
+	union {
+		/**
+		 * @ret: Linux return code, there was an error processing connection
+		 * @seq: Sequence ID for the main message.
+		 * @rm_error: For request/reply sequences with standard replies
+		 * @seq_done: Signals caller that the RM reply has been received
+		 */
+		struct {
+			int ret;
+			u16 seq;
+			enum gh_rm_error rm_error;
+			struct completion seq_done;
+		} reply;
+
+		/**
+		 * @rm: Pointer to the RM that launched the connection
+		 * @work: Triggered when all fragments of a notification received
+		 */
+		struct {
+			struct gh_rm *rm;
+			struct work_struct work;
+		} notification;
+	};
+};
+
+/**
+ * struct gh_rm - private data for communicating w/Gunyah resource manager
+ * @dev: pointer to RM platform device
+ * @tx_ghrsc: message queue resource to TX to RM
+ * @rx_ghrsc: message queue resource to RX from RM
+ * @msgq: mailbox instance of TX/RX resources above
+ * @msgq_client: mailbox client of above msgq
+ * @active_rx_connection: ongoing gh_rm_connection for which we're receiving fragments
+ * @last_tx_ret: return value of last mailbox tx
+ * @call_xarray: xarray to allocate & lookup sequence IDs for Request/Response flows
+ * @next_seq: next ID to allocate (for xa_alloc_cyclic)
+ * @cache: cache for allocating Tx messages
+ * @send_lock: synchronization to allow only one request to be sent at a time
+ * @nh: notifier chain for clients interested in RM notification messages
+ * @miscdev: /dev/gunyah
+ * @irq_domain: Domain to translate Gunyah hwirqs to Linux irqs
+ */
+struct gh_rm {
+	struct device *dev;
+	struct gh_resource tx_ghrsc;
+	struct gh_resource rx_ghrsc;
+	struct gh_msgq msgq;
+	struct mbox_client msgq_client;
+	struct gh_rm_connection *active_rx_connection;
+	int last_tx_ret;
+
+	struct xarray call_xarray;
+	u32 next_seq;
+
+	struct kmem_cache *cache;
+	struct mutex send_lock;
+	struct blocking_notifier_head nh;
+
+	struct miscdevice miscdev;
+	struct irq_domain *irq_domain;
+};
+
+/**
+ * gh_rm_error_remap() - Remap Gunyah resource manager errors into a Linux error code
+ * @rm_error: "Standard" return value from Gunyah resource manager
+ */
+static inline int gh_rm_error_remap(enum gh_rm_error rm_error)
+{
+	switch (rm_error) {
+	case GH_RM_ERROR_OK:
+		return 0;
+	case GH_RM_ERROR_UNIMPLEMENTED:
+		return -EOPNOTSUPP;
+	case GH_RM_ERROR_NOMEM:
+		return -ENOMEM;
+	case GH_RM_ERROR_NORESOURCE:
+		return -ENODEV;
+	case GH_RM_ERROR_DENIED:
+		return -EPERM;
+	case GH_RM_ERROR_BUSY:
+		return -EBUSY;
+	case GH_RM_ERROR_INVALID:
+	case GH_RM_ERROR_ARGUMENT_INVALID:
+	case GH_RM_ERROR_HANDLE_INVALID:
+	case GH_RM_ERROR_VALIDATE_FAILED:
+	case GH_RM_ERROR_MAP_FAILED:
+	case GH_RM_ERROR_MEM_INVALID:
+	case GH_RM_ERROR_MEM_INUSE:
+	case GH_RM_ERROR_MEM_RELEASED:
+	case GH_RM_ERROR_VMID_INVALID:
+	case GH_RM_ERROR_LOOKUP_FAILED:
+	case GH_RM_ERROR_IRQ_INVALID:
+	case GH_RM_ERROR_IRQ_INUSE:
+	case GH_RM_ERROR_IRQ_RELEASED:
+		return -EINVAL;
+	default:
+		return -EBADMSG;
+	}
+}
+
+struct gh_irq_chip_data {
+	u32 gh_virq;
+};
+
+static struct irq_chip gh_rm_irq_chip = {
+	.name			= "Gunyah",
+	.irq_enable		= irq_chip_enable_parent,
+	.irq_disable		= irq_chip_disable_parent,
+	.irq_ack		= irq_chip_ack_parent,
+	.irq_mask		= irq_chip_mask_parent,
+	.irq_mask_ack		= irq_chip_mask_ack_parent,
+	.irq_unmask		= irq_chip_unmask_parent,
+	.irq_eoi		= irq_chip_eoi_parent,
+	.irq_set_affinity	= irq_chip_set_affinity_parent,
+	.irq_set_type		= irq_chip_set_type_parent,
+	.irq_set_wake		= irq_chip_set_wake_parent,
+	.irq_set_vcpu_affinity	= irq_chip_set_vcpu_affinity_parent,
+	.irq_retrigger		= irq_chip_retrigger_hierarchy,
+	.irq_get_irqchip_state	= irq_chip_get_parent_state,
+	.irq_set_irqchip_state	= irq_chip_set_parent_state,
+	.flags			= IRQCHIP_SET_TYPE_MASKED |
+				  IRQCHIP_SKIP_SET_WAKE |
+				  IRQCHIP_MASK_ON_SUSPEND,
+};
+
+static int gh_rm_irq_domain_alloc(struct irq_domain *d, unsigned int virq, unsigned int nr_irqs,
+				 void *arg)
+{
+	struct gh_irq_chip_data *chip_data, *spec = arg;
+	struct irq_fwspec parent_fwspec = {};
+	struct gh_rm *rm = d->host_data;
+	u32 gh_virq = spec->gh_virq;
+	int ret;
+
+	if (nr_irqs != 1)
+		return -EINVAL;
+
+	chip_data = kzalloc(sizeof(*chip_data), GFP_KERNEL);
+	if (!chip_data)
+		return -ENOMEM;
+
+	chip_data->gh_virq = gh_virq;
+
+	ret = irq_domain_set_hwirq_and_chip(d, virq, chip_data->gh_virq, &gh_rm_irq_chip,
+						chip_data);
+	if (ret)
+		goto err_free_irq_data;
+
+	parent_fwspec.fwnode = d->parent->fwnode;
+	ret = arch_gh_fill_irq_fwspec_params(chip_data->gh_virq, &parent_fwspec);
+	if (ret) {
+		dev_err(rm->dev, "virq translation failed %u: %d\n", chip_data->gh_virq, ret);
+		goto err_free_irq_data;
+	}
+
+	ret = irq_domain_alloc_irqs_parent(d, virq, nr_irqs, &parent_fwspec);
+	if (ret)
+		goto err_free_irq_data;
+
+	return ret;
+err_free_irq_data:
+	kfree(chip_data);
+	return ret;
+}
+
+static void gh_rm_irq_domain_free_single(struct irq_domain *d, unsigned int virq)
+{
+	struct irq_data *irq_data;
+
+	irq_data = irq_domain_get_irq_data(d, virq);
+	if (!irq_data)
+		return;
+
+	kfree(irq_data->chip_data);
+	irq_data->chip_data = NULL;
+}
+
+static void gh_rm_irq_domain_free(struct irq_domain *d, unsigned int virq, unsigned int nr_irqs)
+{
+	unsigned int i;
+
+	for (i = 0; i < nr_irqs; i++)
+		gh_rm_irq_domain_free_single(d, virq);
+}
+
+static const struct irq_domain_ops gh_rm_irq_domain_ops = {
+	.alloc		= gh_rm_irq_domain_alloc,
+	.free		= gh_rm_irq_domain_free,
+};
+
+struct gh_resource *gh_rm_alloc_resource(struct gh_rm *rm, struct gh_rm_hyp_resource *hyp_resource)
+{
+	struct gh_resource *ghrsc;
+	int ret;
+
+	ghrsc = kzalloc(sizeof(*ghrsc), GFP_KERNEL);
+	if (!ghrsc)
+		return NULL;
+
+	ghrsc->type = hyp_resource->type;
+	ghrsc->capid = le64_to_cpu(hyp_resource->cap_id);
+	ghrsc->irq = IRQ_NOTCONNECTED;
+	ghrsc->rm_label = le32_to_cpu(hyp_resource->resource_label);
+	if (hyp_resource->virq) {
+		struct gh_irq_chip_data irq_data = {
+			.gh_virq = le32_to_cpu(hyp_resource->virq),
+		};
+
+		ret = irq_domain_alloc_irqs(rm->irq_domain, 1, NUMA_NO_NODE, &irq_data);
+		if (ret < 0) {
+			dev_err(rm->dev,
+				"Failed to allocate interrupt for resource %d label: %d: %d\n",
+				ghrsc->type, ghrsc->rm_label, ret);
+			kfree(ghrsc);
+			return NULL;
+		} else {
+			ghrsc->irq = ret;
+		}
+	}
+
+	return ghrsc;
+}
+
+void gh_rm_free_resource(struct gh_resource *ghrsc)
+{
+	irq_dispose_mapping(ghrsc->irq);
+	kfree(ghrsc);
+}
+
+static int gh_rm_init_connection_payload(struct gh_rm_connection *connection, void *msg,
+					size_t hdr_size, size_t msg_size)
+{
+	size_t max_buf_size, payload_size;
+	struct gh_rm_rpc_hdr *hdr = msg;
+
+	if (msg_size < hdr_size)
+		return -EINVAL;
+
+	payload_size = msg_size - hdr_size;
+
+	connection->num_fragments = FIELD_GET(RM_RPC_FRAGMENTS_MASK, hdr->type);
+	connection->fragments_received = 0;
+
+	/* There's not going to be any payload, no need to allocate buffer. */
+	if (!payload_size && !connection->num_fragments)
+		return 0;
+
+	if (connection->num_fragments > GH_RM_MAX_NUM_FRAGMENTS)
+		return -EINVAL;
+
+	max_buf_size = payload_size + (connection->num_fragments * GH_RM_MAX_MSG_SIZE);
+
+	connection->payload = kzalloc(max_buf_size, GFP_KERNEL);
+	if (!connection->payload)
+		return -ENOMEM;
+
+	memcpy(connection->payload, msg + hdr_size, payload_size);
+	connection->size = payload_size;
+	return 0;
+}
+
+static void gh_rm_abort_connection(struct gh_rm *rm)
+{
+	switch (rm->active_rx_connection->type) {
+	case RM_RPC_TYPE_REPLY:
+		rm->active_rx_connection->reply.ret = -EIO;
+		complete(&rm->active_rx_connection->reply.seq_done);
+		break;
+	case RM_RPC_TYPE_NOTIF:
+		fallthrough;
+	default:
+		kfree(rm->active_rx_connection->payload);
+		kfree(rm->active_rx_connection);
+	}
+
+	rm->active_rx_connection = NULL;
+}
+
+static void gh_rm_notif_work(struct work_struct *work)
+{
+	struct gh_rm_connection *connection = container_of(work, struct gh_rm_connection,
+								notification.work);
+	struct gh_rm *rm = connection->notification.rm;
+
+	blocking_notifier_call_chain(&rm->nh, le32_to_cpu(connection->msg_id), connection->payload);
+
+	put_device(rm->dev);
+	kfree(connection->payload);
+	kfree(connection);
+}
+
+static void gh_rm_process_notif(struct gh_rm *rm, void *msg, size_t msg_size)
+{
+	struct gh_rm_connection *connection;
+	struct gh_rm_rpc_hdr *hdr = msg;
+	int ret;
+
+	if (rm->active_rx_connection)
+		gh_rm_abort_connection(rm);
+
+	connection = kzalloc(sizeof(*connection), GFP_KERNEL);
+	if (!connection)
+		return;
+
+	connection->type = RM_RPC_TYPE_NOTIF;
+	connection->msg_id = hdr->msg_id;
+
+	get_device(rm->dev);
+	connection->notification.rm = rm;
+	INIT_WORK(&connection->notification.work, gh_rm_notif_work);
+
+	ret = gh_rm_init_connection_payload(connection, msg, sizeof(*hdr), msg_size);
+	if (ret) {
+		dev_err(rm->dev, "Failed to initialize connection for notification: %d\n", ret);
+		put_device(rm->dev);
+		kfree(connection);
+		return;
+	}
+
+	rm->active_rx_connection = connection;
+}
+
+static void gh_rm_process_reply(struct gh_rm *rm, void *msg, size_t msg_size)
+{
+	struct gh_rm_rpc_reply_hdr *reply_hdr = msg;
+	struct gh_rm_connection *connection;
+	u16 seq_id;
+
+	seq_id = le16_to_cpu(reply_hdr->hdr.seq);
+	connection = xa_load(&rm->call_xarray, seq_id);
+
+	if (!connection || connection->msg_id != reply_hdr->hdr.msg_id)
+		return;
+
+	if (rm->active_rx_connection)
+		gh_rm_abort_connection(rm);
+
+	if (gh_rm_init_connection_payload(connection, msg, sizeof(*reply_hdr), msg_size)) {
+		dev_err(rm->dev, "Failed to alloc connection buffer for sequence %d\n", seq_id);
+		/* Send connection complete and error the client. */
+		connection->reply.ret = -ENOMEM;
+		complete(&connection->reply.seq_done);
+		return;
+	}
+
+	connection->reply.rm_error = le32_to_cpu(reply_hdr->err_code);
+	rm->active_rx_connection = connection;
+}
+
+static void gh_rm_process_cont(struct gh_rm *rm, struct gh_rm_connection *connection,
+				void *msg, size_t msg_size)
+{
+	struct gh_rm_rpc_hdr *hdr = msg;
+	size_t payload_size = msg_size - sizeof(*hdr);
+
+	if (!rm->active_rx_connection)
+		return;
+
+	/*
+	 * hdr->fragments and hdr->msg_id preserves the value from first reply
+	 * or notif message. To detect mishandling, check it's still intact.
+	 */
+	if (connection->msg_id != hdr->msg_id ||
+		connection->num_fragments != FIELD_GET(RM_RPC_FRAGMENTS_MASK, hdr->type)) {
+		gh_rm_abort_connection(rm);
+		return;
+	}
+
+	memcpy(connection->payload + connection->size, msg + sizeof(*hdr), payload_size);
+	connection->size += payload_size;
+	connection->fragments_received++;
+}
+
+static void gh_rm_try_complete_connection(struct gh_rm *rm)
+{
+	struct gh_rm_connection *connection = rm->active_rx_connection;
+
+	if (!connection || connection->fragments_received != connection->num_fragments)
+		return;
+
+	switch (connection->type) {
+	case RM_RPC_TYPE_REPLY:
+		complete(&connection->reply.seq_done);
+		break;
+	case RM_RPC_TYPE_NOTIF:
+		schedule_work(&connection->notification.work);
+		break;
+	default:
+		dev_err_ratelimited(rm->dev, "Invalid message type (%u) received\n",
+					connection->type);
+		gh_rm_abort_connection(rm);
+		break;
+	}
+
+	rm->active_rx_connection = NULL;
+}
+
+static void gh_rm_msgq_rx_data(struct mbox_client *cl, void *mssg)
+{
+	struct gh_rm *rm = container_of(cl, struct gh_rm, msgq_client);
+	struct gh_msgq_rx_data *rx_data = mssg;
+	size_t msg_size = rx_data->length;
+	void *msg = rx_data->data;
+	struct gh_rm_rpc_hdr *hdr;
+
+	if (msg_size < sizeof(*hdr) || msg_size > GH_MSGQ_MAX_MSG_SIZE)
+		return;
+
+	hdr = msg;
+	if (hdr->api != RM_RPC_API) {
+		dev_err(rm->dev, "Unknown RM RPC API version: %x\n", hdr->api);
+		return;
+	}
+
+	switch (FIELD_GET(RM_RPC_TYPE_MASK, hdr->type)) {
+	case RM_RPC_TYPE_NOTIF:
+		gh_rm_process_notif(rm, msg, msg_size);
+		break;
+	case RM_RPC_TYPE_REPLY:
+		gh_rm_process_reply(rm, msg, msg_size);
+		break;
+	case RM_RPC_TYPE_CONTINUATION:
+		gh_rm_process_cont(rm, rm->active_rx_connection, msg, msg_size);
+		break;
+	default:
+		dev_err(rm->dev, "Invalid message type (%lu) received\n",
+			FIELD_GET(RM_RPC_TYPE_MASK, hdr->type));
+		return;
+	}
+
+	gh_rm_try_complete_connection(rm);
+}
+
+static void gh_rm_msgq_tx_done(struct mbox_client *cl, void *mssg, int r)
+{
+	struct gh_rm *rm = container_of(cl, struct gh_rm, msgq_client);
+
+	kmem_cache_free(rm->cache, mssg);
+	rm->last_tx_ret = r;
+}
+
+static int gh_rm_send_request(struct gh_rm *rm, u32 message_id,
+			      const void *req_buf, size_t req_buf_size,
+			      struct gh_rm_connection *connection)
+{
+	size_t buf_size_remaining = req_buf_size;
+	const void *req_buf_curr = req_buf;
+	struct gh_msgq_tx_data *msg;
+	struct gh_rm_rpc_hdr *hdr, hdr_template;
+	u32 cont_fragments = 0;
+	size_t payload_size;
+	void *payload;
+	int ret;
+
+	if (req_buf_size > GH_RM_MAX_NUM_FRAGMENTS * GH_RM_MAX_MSG_SIZE) {
+		dev_warn(rm->dev, "Limit (%lu bytes) exceeded for the maximum message size: %lu\n",
+			GH_RM_MAX_NUM_FRAGMENTS * GH_RM_MAX_MSG_SIZE, req_buf_size);
+		dump_stack();
+		return -E2BIG;
+	}
+
+	if (req_buf_size)
+		cont_fragments = (req_buf_size - 1) / GH_RM_MAX_MSG_SIZE;
+
+	hdr_template.api = RM_RPC_API;
+	hdr_template.type = FIELD_PREP(RM_RPC_TYPE_MASK, RM_RPC_TYPE_REQUEST) |
+				FIELD_PREP(RM_RPC_FRAGMENTS_MASK, cont_fragments);
+	hdr_template.seq = cpu_to_le16(connection->reply.seq);
+	hdr_template.msg_id = cpu_to_le32(message_id);
+
+	ret = mutex_lock_interruptible(&rm->send_lock);
+	if (ret)
+		return ret;
+
+	do {
+		msg = kmem_cache_zalloc(rm->cache, GFP_KERNEL);
+		if (!msg) {
+			ret = -ENOMEM;
+			goto out;
+		}
+
+		/* Fill header */
+		hdr = (struct gh_rm_rpc_hdr *)&msg->data[0];
+		*hdr = hdr_template;
+
+		/* Copy payload */
+		payload = &msg->data[0] + sizeof(*hdr);
+		payload_size = min(buf_size_remaining, GH_RM_MAX_MSG_SIZE);
+		memcpy(payload, req_buf_curr, payload_size);
+		req_buf_curr += payload_size;
+		buf_size_remaining -= payload_size;
+
+		/* Force the last fragment to immediately alert the receiver */
+		msg->push = !buf_size_remaining;
+		msg->length = sizeof(*hdr) + payload_size;
+
+		ret = mbox_send_message(gh_msgq_chan(&rm->msgq), msg);
+		if (ret < 0) {
+			kmem_cache_free(rm->cache, msg);
+			break;
+		}
+
+		if (rm->last_tx_ret) {
+			ret = rm->last_tx_ret;
+			break;
+		}
+
+		hdr_template.type = FIELD_PREP(RM_RPC_TYPE_MASK, RM_RPC_TYPE_CONTINUATION) |
+					FIELD_PREP(RM_RPC_FRAGMENTS_MASK, cont_fragments);
+	} while (buf_size_remaining);
+
+out:
+	mutex_unlock(&rm->send_lock);
+	return ret < 0 ? ret : 0;
+}
+
+/**
+ * gh_rm_call: Achieve request-response type communication with RPC
+ * @rm: Pointer to Gunyah resource manager internal data
+ * @message_id: The RM RPC message-id
+ * @req_buf: Request buffer that contains the payload
+ * @req_buf_size: Total size of the payload
+ * @resp_buf: Pointer to a response buffer
+ * @resp_buf_size: Size of the response buffer
+ *
+ * Make a request to the Resource Manager and wait for reply back. For a successful
+ * response, the function returns the payload. The size of the payload is set in
+ * resp_buf_size. The resp_buf must be freed by the caller when 0 is returned
+ * and resp_buf_size != 0.
+ *
+ * req_buf should be not NULL for req_buf_size >0. If req_buf_size == 0,
+ * req_buf *can* be NULL and no additional payload is sent.
+ *
+ * Context: Process context. Will sleep waiting for reply.
+ * Return: 0 on success. <0 if error.
+ */
+int gh_rm_call(struct gh_rm *rm, u32 message_id, const void *req_buf, size_t req_buf_size,
+		void **resp_buf, size_t *resp_buf_size)
+{
+	struct gh_rm_connection *connection;
+	u32 seq_id;
+	int ret;
+
+	/* message_id 0 is reserved. req_buf_size implies req_buf is not NULL */
+	if (!rm || !message_id || (!req_buf && req_buf_size))
+		return -EINVAL;
+
+
+	connection = kzalloc(sizeof(*connection), GFP_KERNEL);
+	if (!connection)
+		return -ENOMEM;
+
+	connection->type = RM_RPC_TYPE_REPLY;
+	connection->msg_id = cpu_to_le32(message_id);
+
+	init_completion(&connection->reply.seq_done);
+
+	/* Allocate a new seq number for this connection */
+	ret = xa_alloc_cyclic(&rm->call_xarray, &seq_id, connection, xa_limit_16b, &rm->next_seq,
+				GFP_KERNEL);
+	if (ret < 0)
+		goto free;
+	connection->reply.seq = lower_16_bits(seq_id);
+
+	/* Send the request to the Resource Manager */
+	ret = gh_rm_send_request(rm, message_id, req_buf, req_buf_size, connection);
+	if (ret < 0)
+		goto out;
+
+	/* Wait for response. Uninterruptible because rollback based on what RM did to VM
+	 * requires us to know how RM handled the call.
+	 */
+	wait_for_completion(&connection->reply.seq_done);
+
+	/* Check for internal (kernel) error waiting for the response */
+	if (connection->reply.ret) {
+		ret = connection->reply.ret;
+		if (ret != -ENOMEM)
+			kfree(connection->payload);
+		goto out;
+	}
+
+	/* Got a response, did resource manager give us an error? */
+	if (connection->reply.rm_error != GH_RM_ERROR_OK) {
+		dev_warn(rm->dev, "RM rejected message %08x. Error: %d\n", message_id,
+			connection->reply.rm_error);
+		ret = gh_rm_error_remap(connection->reply.rm_error);
+		kfree(connection->payload);
+		goto out;
+	}
+
+	/* Everything looks good, return the payload */
+	if (resp_buf_size)
+		*resp_buf_size = connection->size;
+	if (connection->size && resp_buf)
+		*resp_buf = connection->payload;
+	else {
+		/* kfree in case RM sent us multiple fragments but never any data in
+		 * those fragments. We would've allocated memory for it, but connection->size == 0
+		 */
+		kfree(connection->payload);
+	}
+
+out:
+	xa_erase(&rm->call_xarray, connection->reply.seq);
+free:
+	kfree(connection);
+	return ret;
+}
+
+
+int gh_rm_notifier_register(struct gh_rm *rm, struct notifier_block *nb)
+{
+	return blocking_notifier_chain_register(&rm->nh, nb);
+}
+EXPORT_SYMBOL_GPL(gh_rm_notifier_register);
+
+int gh_rm_notifier_unregister(struct gh_rm *rm, struct notifier_block *nb)
+{
+	return blocking_notifier_chain_unregister(&rm->nh, nb);
+}
+EXPORT_SYMBOL_GPL(gh_rm_notifier_unregister);
+
+struct device *gh_rm_get(struct gh_rm *rm)
+{
+	return get_device(rm->miscdev.this_device);
+}
+EXPORT_SYMBOL_GPL(gh_rm_get);
+
+void gh_rm_put(struct gh_rm *rm)
+{
+	put_device(rm->miscdev.this_device);
+}
+EXPORT_SYMBOL_GPL(gh_rm_put);
+
+static long gh_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+{
+	struct miscdevice *miscdev = filp->private_data;
+	struct gh_rm *rm = container_of(miscdev, struct gh_rm, miscdev);
+
+	return gh_dev_vm_mgr_ioctl(rm, cmd, arg);
+}
+
+static const struct file_operations gh_dev_fops = {
+	.owner		= THIS_MODULE,
+	.unlocked_ioctl	= gh_dev_ioctl,
+	.compat_ioctl	= compat_ptr_ioctl,
+	.llseek		= noop_llseek,
+};
+
+static int gh_msgq_platform_probe_direction(struct platform_device *pdev, bool tx,
+					    struct gh_resource *ghrsc)
+{
+	struct device_node *node = pdev->dev.of_node;
+	int ret;
+	int idx = tx ? 0 : 1;
+
+	ghrsc->type = tx ? GH_RESOURCE_TYPE_MSGQ_TX : GH_RESOURCE_TYPE_MSGQ_RX;
+
+	ghrsc->irq = platform_get_irq(pdev, idx);
+	if (ghrsc->irq < 0) {
+		dev_err(&pdev->dev, "Failed to get irq%d: %d\n", idx, ghrsc->irq);
+		return ghrsc->irq;
+	}
+
+	ret = of_property_read_u64_index(node, "reg", idx, &ghrsc->capid);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to get capid%d: %d\n", idx, ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int gh_identify(void)
+{
+	struct gh_hypercall_hyp_identify_resp gh_api;
+
+	if (!arch_is_gh_guest())
+		return -ENODEV;
+
+	gh_hypercall_hyp_identify(&gh_api);
+
+	pr_info("Running under Gunyah hypervisor %llx/v%u\n",
+		FIELD_GET(GH_API_INFO_VARIANT_MASK, gh_api.api_info),
+		gh_api_version(&gh_api));
+
+	/* We might move this out to individual drivers if there's ever an API version bump */
+	if (gh_api_version(&gh_api) != GH_API_V1) {
+		pr_info("Unsupported Gunyah version: %u\n", gh_api_version(&gh_api));
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static int gh_rm_drv_probe(struct platform_device *pdev)
+{
+	struct irq_domain *parent_irq_domain;
+	struct device_node *parent_irq_node;
+	struct gh_msgq_tx_data *msg;
+	struct gh_rm *rm;
+	int ret;
+
+	ret = gh_identify();
+	if (ret)
+		return ret;
+
+	rm = devm_kzalloc(&pdev->dev, sizeof(*rm), GFP_KERNEL);
+	if (!rm)
+		return -ENOMEM;
+
+	platform_set_drvdata(pdev, rm);
+	rm->dev = &pdev->dev;
+
+	mutex_init(&rm->send_lock);
+	BLOCKING_INIT_NOTIFIER_HEAD(&rm->nh);
+	xa_init_flags(&rm->call_xarray, XA_FLAGS_ALLOC);
+	rm->cache = kmem_cache_create("gh_rm", struct_size(msg, data, GH_MSGQ_MAX_MSG_SIZE), 0,
+		SLAB_HWCACHE_ALIGN, NULL);
+	if (!rm->cache)
+		return -ENOMEM;
+
+	ret = gh_msgq_platform_probe_direction(pdev, true, &rm->tx_ghrsc);
+	if (ret)
+		goto err_cache;
+
+	ret = gh_msgq_platform_probe_direction(pdev, false, &rm->rx_ghrsc);
+	if (ret)
+		goto err_cache;
+
+	rm->msgq_client.dev = &pdev->dev;
+	rm->msgq_client.tx_block = true;
+	rm->msgq_client.rx_callback = gh_rm_msgq_rx_data;
+	rm->msgq_client.tx_done = gh_rm_msgq_tx_done;
+
+	ret = gh_msgq_init(&pdev->dev, &rm->msgq, &rm->msgq_client, &rm->tx_ghrsc, &rm->rx_ghrsc);
+	if (ret)
+		goto err_cache;
+
+	parent_irq_node = of_irq_find_parent(pdev->dev.of_node);
+	if (!parent_irq_node) {
+		dev_err(&pdev->dev, "Failed to find interrupt parent of resource manager\n");
+		ret = -ENODEV;
+		goto err_msgq;
+	}
+
+	parent_irq_domain = irq_find_host(parent_irq_node);
+	if (!parent_irq_domain) {
+		dev_err(&pdev->dev, "Failed to find interrupt parent domain of resource manager\n");
+		ret = -ENODEV;
+		goto err_msgq;
+	}
+
+	rm->irq_domain = irq_domain_add_hierarchy(parent_irq_domain, 0, 0, pdev->dev.of_node,
+							&gh_rm_irq_domain_ops, NULL);
+	if (!rm->irq_domain) {
+		dev_err(&pdev->dev, "Failed to add irq domain\n");
+		ret = -ENODEV;
+		goto err_msgq;
+	}
+	rm->irq_domain->host_data = rm;
+
+	rm->miscdev.parent = &pdev->dev;
+	rm->miscdev.name = "gunyah";
+	rm->miscdev.minor = MISC_DYNAMIC_MINOR;
+	rm->miscdev.fops = &gh_dev_fops;
+
+	ret = misc_register(&rm->miscdev);
+	if (ret)
+		goto err_irq_domain;
+
+	return 0;
+err_irq_domain:
+	irq_domain_remove(rm->irq_domain);
+err_msgq:
+	gh_msgq_remove(&rm->msgq);
+err_cache:
+	kmem_cache_destroy(rm->cache);
+	return ret;
+}
+
+static int gh_rm_drv_remove(struct platform_device *pdev)
+{
+	struct gh_rm *rm = platform_get_drvdata(pdev);
+
+	misc_deregister(&rm->miscdev);
+	irq_domain_remove(rm->irq_domain);
+	gh_msgq_remove(&rm->msgq);
+	kmem_cache_destroy(rm->cache);
+
+	return 0;
+}
+
+static const struct of_device_id gh_rm_of_match[] = {
+	{ .compatible = "gunyah-resource-manager" },
+	{}
+};
+MODULE_DEVICE_TABLE(of, gh_rm_of_match);
+
+static struct platform_driver gh_rm_driver = {
+	.probe = gh_rm_drv_probe,
+	.remove = gh_rm_drv_remove,
+	.driver = {
+		.name = "gh_rsc_mgr",
+		.of_match_table = gh_rm_of_match,
+	},
+};
+module_platform_driver(gh_rm_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Gunyah Resource Manager Driver");
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/rsc_mgr.h
+++ linux-qcom-6.8.0/drivers/virt/gunyah/rsc_mgr.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __GH_RSC_MGR_PRIV_H
+#define __GH_RSC_MGR_PRIV_H
+
+#include <linux/gunyah.h>
+#include <linux/gunyah_rsc_mgr.h>
+#include <linux/types.h>
+
+struct gh_rm;
+int gh_rm_call(struct gh_rm *rsc_mgr, u32 message_id, const void *req_buf, size_t req_buf_size,
+		void **resp_buf, size_t *resp_buf_size);
+
+int gh_rm_platform_pre_mem_share(struct gh_rm *rm, struct gh_rm_mem_parcel *mem_parcel);
+int gh_rm_platform_post_mem_reclaim(struct gh_rm *rm, struct gh_rm_mem_parcel *mem_parcel);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/rsc_mgr_rpc.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/rsc_mgr_rpc.c
@@ -0,0 +1,500 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/gunyah_rsc_mgr.h>
+#include "rsc_mgr.h"
+
+/* Message IDs: Memory Management */
+#define GH_RM_RPC_MEM_LEND			0x51000012
+#define GH_RM_RPC_MEM_SHARE			0x51000013
+#define GH_RM_RPC_MEM_RECLAIM			0x51000015
+#define GH_RM_RPC_MEM_APPEND			0x51000018
+
+/* Message IDs: VM Management */
+#define GH_RM_RPC_VM_ALLOC_VMID			0x56000001
+#define GH_RM_RPC_VM_DEALLOC_VMID		0x56000002
+#define GH_RM_RPC_VM_START			0x56000004
+#define GH_RM_RPC_VM_STOP			0x56000005
+#define GH_RM_RPC_VM_RESET			0x56000006
+#define GH_RM_RPC_VM_CONFIG_IMAGE		0x56000009
+#define GH_RM_RPC_VM_INIT			0x5600000B
+#define GH_RM_RPC_VM_GET_HYP_RESOURCES		0x56000020
+#define GH_RM_RPC_VM_GET_VMID			0x56000024
+
+struct gh_rm_vm_common_vmid_req {
+	__le16 vmid;
+	__le16 _padding;
+} __packed;
+
+/* Call: MEM_LEND, MEM_SHARE */
+#define GH_MEM_SHARE_REQ_FLAGS_APPEND		BIT(1)
+
+struct gh_rm_mem_share_req_header {
+	u8 mem_type;
+	u8 _padding0;
+	u8 flags;
+	u8 _padding1;
+	__le32 label;
+} __packed;
+
+struct gh_rm_mem_share_req_acl_section {
+	__le32 n_entries;
+	struct gh_rm_mem_acl_entry entries[];
+};
+
+struct gh_rm_mem_share_req_mem_section {
+	__le16 n_entries;
+	__le16 _padding;
+	struct gh_rm_mem_entry entries[];
+};
+
+/* Call: MEM_RELEASE */
+struct gh_rm_mem_release_req {
+	__le32 mem_handle;
+	u8 flags; /* currently not used */
+	u8 _padding0;
+	__le16 _padding1;
+} __packed;
+
+/* Call: MEM_APPEND */
+#define GH_MEM_APPEND_REQ_FLAGS_END		BIT(0)
+
+struct gh_rm_mem_append_req_header {
+	__le32 mem_handle;
+	u8 flags;
+	u8 _padding0;
+	__le16 _padding1;
+} __packed;
+
+/* Call: VM_ALLOC */
+struct gh_rm_vm_alloc_vmid_resp {
+	__le16 vmid;
+	__le16 _padding;
+} __packed;
+
+/* Call: VM_STOP */
+#define GH_RM_VM_STOP_FLAG_FORCE_STOP		BIT(0)
+
+#define GH_RM_VM_STOP_REASON_FORCE_STOP		3
+
+struct gh_rm_vm_stop_req {
+	__le16 vmid;
+	u8 flags;
+	u8 _padding;
+	__le32 stop_reason;
+} __packed;
+
+/* Call: VM_CONFIG_IMAGE */
+struct gh_rm_vm_config_image_req {
+	__le16 vmid;
+	__le16 auth_mech;
+	__le32 mem_handle;
+	__le64 image_offset;
+	__le64 image_size;
+	__le64 dtb_offset;
+	__le64 dtb_size;
+} __packed;
+
+#define GH_RM_MAX_MEM_ENTRIES	512
+
+/*
+ * Several RM calls take only a VMID as a parameter and give only standard
+ * response back. Deduplicate boilerplate code by using this common call.
+ */
+static int gh_rm_common_vmid_call(struct gh_rm *rm, u32 message_id, u16 vmid)
+{
+	struct gh_rm_vm_common_vmid_req req_payload = {
+		.vmid = cpu_to_le16(vmid),
+	};
+
+	return gh_rm_call(rm, message_id, &req_payload, sizeof(req_payload), NULL, NULL);
+}
+
+static int _gh_rm_mem_append(struct gh_rm *rm, u32 mem_handle, bool end_append,
+			struct gh_rm_mem_entry *mem_entries, size_t n_mem_entries)
+{
+	struct gh_rm_mem_share_req_mem_section *mem_section;
+	struct gh_rm_mem_append_req_header *req_header;
+	size_t msg_size = 0;
+	void *msg;
+	int ret;
+
+	msg_size += sizeof(struct gh_rm_mem_append_req_header);
+	msg_size += struct_size(mem_section, entries, n_mem_entries);
+
+	msg = kzalloc(msg_size, GFP_KERNEL);
+	if (!msg)
+		return -ENOMEM;
+
+	req_header = msg;
+	mem_section = (void *)(req_header + 1);
+
+	req_header->mem_handle = cpu_to_le32(mem_handle);
+	if (end_append)
+		req_header->flags |= GH_MEM_APPEND_REQ_FLAGS_END;
+
+	mem_section->n_entries = cpu_to_le16(n_mem_entries);
+	memcpy(mem_section->entries, mem_entries, sizeof(*mem_entries) * n_mem_entries);
+
+	ret = gh_rm_call(rm, GH_RM_RPC_MEM_APPEND, msg, msg_size, NULL, NULL);
+	kfree(msg);
+
+	return ret;
+}
+
+static int gh_rm_mem_append(struct gh_rm *rm, u32 mem_handle,
+			struct gh_rm_mem_entry *mem_entries, size_t n_mem_entries)
+{
+	bool end_append;
+	int ret = 0;
+	size_t n;
+
+	while (n_mem_entries) {
+		if (n_mem_entries > GH_RM_MAX_MEM_ENTRIES) {
+			end_append = false;
+			n = GH_RM_MAX_MEM_ENTRIES;
+		} else {
+			end_append = true;
+			n = n_mem_entries;
+		}
+
+		ret = _gh_rm_mem_append(rm, mem_handle, end_append, mem_entries, n);
+		if (ret)
+			break;
+
+		mem_entries += n;
+		n_mem_entries -= n;
+	}
+
+	return ret;
+}
+
+static int gh_rm_mem_lend_common(struct gh_rm *rm, u32 message_id, struct gh_rm_mem_parcel *p)
+{
+	size_t msg_size = 0, initial_mem_entries = p->n_mem_entries, resp_size;
+	size_t acl_section_size, mem_section_size;
+	struct gh_rm_mem_share_req_acl_section *acl_section;
+	struct gh_rm_mem_share_req_mem_section *mem_section;
+	struct gh_rm_mem_share_req_header *req_header;
+	u32 *attr_section;
+	__le32 *resp;
+	void *msg;
+	int ret;
+
+	if (!p->acl_entries || !p->n_acl_entries || !p->mem_entries || !p->n_mem_entries ||
+	    p->n_acl_entries > U8_MAX || p->mem_handle != GH_MEM_HANDLE_INVAL)
+		return -EINVAL;
+
+	if (initial_mem_entries > GH_RM_MAX_MEM_ENTRIES)
+		initial_mem_entries = GH_RM_MAX_MEM_ENTRIES;
+
+	acl_section_size = struct_size(acl_section, entries, p->n_acl_entries);
+	mem_section_size = struct_size(mem_section, entries, initial_mem_entries);
+	/* The format of the message goes:
+	 * request header
+	 * ACL entries (which VMs get what kind of access to this memory parcel)
+	 * Memory entries (list of memory regions to share)
+	 * Memory attributes (currently unused, we'll hard-code the size to 0)
+	 */
+	msg_size += sizeof(struct gh_rm_mem_share_req_header);
+	msg_size += acl_section_size;
+	msg_size += mem_section_size;
+	msg_size += sizeof(u32); /* for memory attributes, currently unused */
+
+	msg = kzalloc(msg_size, GFP_KERNEL);
+	if (!msg)
+		return -ENOMEM;
+
+	ret = gh_rm_platform_pre_mem_share(rm, p);
+	if (ret) {
+		kfree(msg);
+		return ret;
+	}
+
+	req_header = msg;
+	acl_section = (void *)req_header + sizeof(*req_header);
+	mem_section = (void *)acl_section + acl_section_size;
+	attr_section = (void *)mem_section + mem_section_size;
+
+	req_header->mem_type = p->mem_type;
+	if (initial_mem_entries != p->n_mem_entries)
+		req_header->flags |= GH_MEM_SHARE_REQ_FLAGS_APPEND;
+	req_header->label = cpu_to_le32(p->label);
+
+	acl_section->n_entries = cpu_to_le32(p->n_acl_entries);
+	memcpy(acl_section->entries, p->acl_entries,
+		flex_array_size(acl_section, entries, p->n_acl_entries));
+
+	mem_section->n_entries = cpu_to_le16(initial_mem_entries);
+	memcpy(mem_section->entries, p->mem_entries,
+		flex_array_size(mem_section, entries, initial_mem_entries));
+
+	/* Set n_entries for memory attribute section to 0 */
+	*attr_section = 0;
+
+	ret = gh_rm_call(rm, message_id, msg, msg_size, (void **)&resp, &resp_size);
+	kfree(msg);
+
+	if (ret) {
+		gh_rm_platform_post_mem_reclaim(rm, p);
+		return ret;
+	}
+
+	p->mem_handle = le32_to_cpu(*resp);
+	kfree(resp);
+
+	if (initial_mem_entries != p->n_mem_entries) {
+		ret = gh_rm_mem_append(rm, p->mem_handle,
+					&p->mem_entries[initial_mem_entries],
+					p->n_mem_entries - initial_mem_entries);
+		if (ret) {
+			gh_rm_mem_reclaim(rm, p);
+			p->mem_handle = GH_MEM_HANDLE_INVAL;
+		}
+	}
+
+	return ret;
+}
+
+/**
+ * gh_rm_mem_lend() - Lend memory to other virtual machines.
+ * @rm: Handle to a Gunyah resource manager
+ * @parcel: Information about the memory to be lent.
+ *
+ * Lending removes Linux's access to the memory while the memory parcel is lent.
+ */
+int gh_rm_mem_lend(struct gh_rm *rm, struct gh_rm_mem_parcel *parcel)
+{
+	return gh_rm_mem_lend_common(rm, GH_RM_RPC_MEM_LEND, parcel);
+}
+
+
+/**
+ * gh_rm_mem_share() - Share memory with other virtual machines.
+ * @rm: Handle to a Gunyah resource manager
+ * @parcel: Information about the memory to be shared.
+ *
+ * Sharing keeps Linux's access to the memory while the memory parcel is shared.
+ */
+int gh_rm_mem_share(struct gh_rm *rm, struct gh_rm_mem_parcel *parcel)
+{
+	return gh_rm_mem_lend_common(rm, GH_RM_RPC_MEM_SHARE, parcel);
+}
+
+/**
+ * gh_rm_mem_reclaim() - Reclaim a memory parcel
+ * @rm: Handle to a Gunyah resource manager
+ * @parcel: Information about the memory to be reclaimed.
+ *
+ * RM maps the associated memory back into the stage-2 page tables of the owner VM.
+ */
+int gh_rm_mem_reclaim(struct gh_rm *rm, struct gh_rm_mem_parcel *parcel)
+{
+	struct gh_rm_mem_release_req req = {
+		.mem_handle = cpu_to_le32(parcel->mem_handle),
+	};
+	int ret;
+
+	ret = gh_rm_call(rm, GH_RM_RPC_MEM_RECLAIM, &req, sizeof(req), NULL, NULL);
+	/* Only call the platform mem reclaim hooks if we reclaimed the memory */
+	if (ret)
+		return ret;
+
+	return gh_rm_platform_post_mem_reclaim(rm, parcel);
+}
+
+/**
+ * gh_rm_alloc_vmid() - Allocate a new VM in Gunyah. Returns the VM identifier.
+ * @rm: Handle to a Gunyah resource manager
+ * @vmid: Use 0 to dynamically allocate a VM. A reserved VMID can be supplied
+ *        to request allocation of a platform-defined VM.
+ *
+ * Returns - the allocated VMID or negative value on error
+ */
+int gh_rm_alloc_vmid(struct gh_rm *rm, u16 vmid)
+{
+	struct gh_rm_vm_common_vmid_req req_payload = {
+		.vmid = cpu_to_le16(vmid),
+	};
+	struct gh_rm_vm_alloc_vmid_resp *resp_payload;
+	size_t resp_size;
+	void *resp;
+	int ret;
+
+	ret = gh_rm_call(rm, GH_RM_RPC_VM_ALLOC_VMID, &req_payload, sizeof(req_payload), &resp,
+			&resp_size);
+	if (ret)
+		return ret;
+
+	if (!vmid) {
+		resp_payload = resp;
+		ret = le16_to_cpu(resp_payload->vmid);
+		kfree(resp);
+	}
+
+	return ret;
+}
+
+/**
+ * gh_rm_dealloc_vmid() - Dispose of a VMID
+ * @rm: Handle to a Gunyah resource manager
+ * @vmid: VM identifier allocated with gh_rm_alloc_vmid
+ */
+int gh_rm_dealloc_vmid(struct gh_rm *rm, u16 vmid)
+{
+	return gh_rm_common_vmid_call(rm, GH_RM_RPC_VM_DEALLOC_VMID, vmid);
+}
+
+/**
+ * gh_rm_vm_reset() - Reset a VM's resources
+ * @rm: Handle to a Gunyah resource manager
+ * @vmid: VM identifier allocated with gh_rm_alloc_vmid
+ *
+ * As part of tearing down the VM, request RM to clean up all the VM resources
+ * associated with the VM. Only after this, Linux can clean up all the
+ * references it maintains to resources.
+ */
+int gh_rm_vm_reset(struct gh_rm *rm, u16 vmid)
+{
+	return gh_rm_common_vmid_call(rm, GH_RM_RPC_VM_RESET, vmid);
+}
+
+/**
+ * gh_rm_vm_start() - Move a VM into "ready to run" state
+ * @rm: Handle to a Gunyah resource manager
+ * @vmid: VM identifier allocated with gh_rm_alloc_vmid
+ *
+ * On VMs which use proxy scheduling, vcpu_run is needed to actually run the VM.
+ * On VMs which use Gunyah's scheduling, the vCPUs start executing in accordance with Gunyah
+ * scheduling policies.
+ */
+int gh_rm_vm_start(struct gh_rm *rm, u16 vmid)
+{
+	return gh_rm_common_vmid_call(rm, GH_RM_RPC_VM_START, vmid);
+}
+
+/**
+ * gh_rm_vm_stop() - Send a request to Resource Manager VM to forcibly stop a VM.
+ * @rm: Handle to a Gunyah resource manager
+ * @vmid: VM identifier allocated with gh_rm_alloc_vmid
+ */
+int gh_rm_vm_stop(struct gh_rm *rm, u16 vmid)
+{
+	struct gh_rm_vm_stop_req req_payload = {
+		.vmid = cpu_to_le16(vmid),
+		.flags = GH_RM_VM_STOP_FLAG_FORCE_STOP,
+		.stop_reason = cpu_to_le32(GH_RM_VM_STOP_REASON_FORCE_STOP),
+	};
+
+	return gh_rm_call(rm, GH_RM_RPC_VM_STOP, &req_payload, sizeof(req_payload), NULL, NULL);
+}
+
+/**
+ * gh_rm_vm_configure() - Prepare a VM to start and provide the common
+ *			  configuration needed by RM to configure a VM
+ * @rm: Handle to a Gunyah resource manager
+ * @vmid: VM identifier allocated with gh_rm_alloc_vmid
+ * @auth_mechanism: Authentication mechanism used by resource manager to verify
+ *                  the virtual machine
+ * @mem_handle: Handle to a previously shared memparcel that contains all parts
+ *              of the VM image subject to authentication.
+ * @image_offset: Start address of VM image, relative to the start of memparcel
+ * @image_size: Size of the VM image
+ * @dtb_offset: Start address of the devicetree binary with VM configuration,
+ *              relative to start of memparcel.
+ * @dtb_size: Maximum size of devicetree binary.
+ */
+int gh_rm_vm_configure(struct gh_rm *rm, u16 vmid, enum gh_rm_vm_auth_mechanism auth_mechanism,
+		u32 mem_handle, u64 image_offset, u64 image_size, u64 dtb_offset, u64 dtb_size)
+{
+	struct gh_rm_vm_config_image_req req_payload = {
+		.vmid = cpu_to_le16(vmid),
+		.auth_mech = cpu_to_le16(auth_mechanism),
+		.mem_handle = cpu_to_le32(mem_handle),
+		.image_offset = cpu_to_le64(image_offset),
+		.image_size = cpu_to_le64(image_size),
+		.dtb_offset = cpu_to_le64(dtb_offset),
+		.dtb_size = cpu_to_le64(dtb_size),
+	};
+
+	return gh_rm_call(rm, GH_RM_RPC_VM_CONFIG_IMAGE, &req_payload, sizeof(req_payload),
+			  NULL, NULL);
+}
+
+/**
+ * gh_rm_vm_init() - Move the VM to initialized state.
+ * @rm: Handle to a Gunyah resource manager
+ * @vmid: VM identifier
+ *
+ * RM will allocate needed resources for the VM.
+ */
+int gh_rm_vm_init(struct gh_rm *rm, u16 vmid)
+{
+	return gh_rm_common_vmid_call(rm, GH_RM_RPC_VM_INIT, vmid);
+}
+
+/**
+ * gh_rm_get_hyp_resources() - Retrieve hypervisor resources (capabilities) associated with a VM
+ * @rm: Handle to a Gunyah resource manager
+ * @vmid: VMID of the other VM to get the resources of
+ * @resources: Set by gh_rm_get_hyp_resources and contains the returned hypervisor resources.
+ *             Caller must free the resources pointer if successful.
+ */
+int gh_rm_get_hyp_resources(struct gh_rm *rm, u16 vmid,
+				struct gh_rm_hyp_resources **resources)
+{
+	struct gh_rm_vm_common_vmid_req req_payload = {
+		.vmid = cpu_to_le16(vmid),
+	};
+	struct gh_rm_hyp_resources *resp;
+	size_t resp_size;
+	int ret;
+
+	ret = gh_rm_call(rm, GH_RM_RPC_VM_GET_HYP_RESOURCES,
+			 &req_payload, sizeof(req_payload),
+			 (void **)&resp, &resp_size);
+	if (ret)
+		return ret;
+
+	if (!resp_size)
+		return -EBADMSG;
+
+	if (resp_size < struct_size(resp, entries, 0) ||
+		resp_size != struct_size(resp, entries, le32_to_cpu(resp->n_entries))) {
+		kfree(resp);
+		return -EBADMSG;
+	}
+
+	*resources = resp;
+	return 0;
+}
+
+/**
+ * gh_rm_get_vmid() - Retrieve VMID of this virtual machine
+ * @rm: Handle to a Gunyah resource manager
+ * @vmid: Filled with the VMID of this VM
+ */
+int gh_rm_get_vmid(struct gh_rm *rm, u16 *vmid)
+{
+	static u16 cached_vmid = GH_VMID_INVAL;
+	size_t resp_size;
+	__le32 *resp;
+	int ret;
+
+	if (cached_vmid != GH_VMID_INVAL) {
+		*vmid = cached_vmid;
+		return 0;
+	}
+
+	ret = gh_rm_call(rm, GH_RM_RPC_VM_GET_VMID, NULL, 0, (void **)&resp, &resp_size);
+	if (ret)
+		return ret;
+
+	*vmid = cached_vmid = lower_16_bits(le32_to_cpu(*resp));
+	kfree(resp);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(gh_rm_get_vmid);
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/vm_mgr.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/vm_mgr.c
@@ -0,0 +1,803 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "gh_vm_mgr: " fmt
+
+#include <linux/anon_inodes.h>
+#include <linux/compat.h>
+#include <linux/file.h>
+#include <linux/gunyah_rsc_mgr.h>
+#include <linux/gunyah_vm_mgr.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/xarray.h>
+
+#include <uapi/linux/gunyah.h>
+
+#include "vm_mgr.h"
+
+static void gh_vm_free(struct work_struct *work);
+
+static DEFINE_XARRAY(gh_vm_functions);
+
+static void gh_vm_put_function(struct gh_vm_function *fn)
+{
+	module_put(fn->mod);
+}
+
+static struct gh_vm_function *gh_vm_get_function(u32 type)
+{
+	struct gh_vm_function *fn;
+
+	fn = xa_load(&gh_vm_functions, type);
+	if (!fn) {
+		request_module("ghfunc:%d", type);
+
+		fn = xa_load(&gh_vm_functions, type);
+	}
+
+	if (!fn || !try_module_get(fn->mod))
+		fn = ERR_PTR(-ENOENT);
+
+	return fn;
+}
+
+static void gh_vm_remove_function_instance(struct gh_vm_function_instance *inst)
+	__must_hold(&inst->ghvm->fn_lock)
+{
+	inst->fn->unbind(inst);
+	list_del(&inst->vm_list);
+	gh_vm_put_function(inst->fn);
+	kfree(inst->argp);
+	kfree(inst);
+}
+
+static void gh_vm_remove_functions(struct gh_vm *ghvm)
+{
+	struct gh_vm_function_instance *inst, *iiter;
+
+	mutex_lock(&ghvm->fn_lock);
+	list_for_each_entry_safe(inst, iiter, &ghvm->functions, vm_list) {
+		gh_vm_remove_function_instance(inst);
+	}
+	mutex_unlock(&ghvm->fn_lock);
+}
+
+static long gh_vm_add_function_instance(struct gh_vm *ghvm, struct gh_fn_desc *f)
+{
+	struct gh_vm_function_instance *inst;
+	void __user *argp;
+	long r = 0;
+
+	if (f->arg_size > GH_FN_MAX_ARG_SIZE) {
+		dev_err_ratelimited(ghvm->parent, "%s: arg_size > %d\n",
+					__func__, GH_FN_MAX_ARG_SIZE);
+		return -EINVAL;
+	}
+
+	inst = kzalloc(sizeof(*inst), GFP_KERNEL);
+	if (!inst)
+		return -ENOMEM;
+
+	inst->arg_size = f->arg_size;
+	if (inst->arg_size) {
+		inst->argp = kzalloc(inst->arg_size, GFP_KERNEL);
+		if (!inst->argp) {
+			r = -ENOMEM;
+			goto free;
+		}
+
+		argp = u64_to_user_ptr(f->arg);
+		if (copy_from_user(inst->argp, argp, f->arg_size)) {
+			r = -EFAULT;
+			goto free_arg;
+		}
+	}
+
+	inst->fn = gh_vm_get_function(f->type);
+	if (IS_ERR(inst->fn)) {
+		r = PTR_ERR(inst->fn);
+		goto free_arg;
+	}
+
+	inst->ghvm = ghvm;
+	inst->rm = ghvm->rm;
+
+	mutex_lock(&ghvm->fn_lock);
+	r = inst->fn->bind(inst);
+	if (r < 0) {
+		mutex_unlock(&ghvm->fn_lock);
+		gh_vm_put_function(inst->fn);
+		goto free_arg;
+	}
+
+	list_add(&inst->vm_list, &ghvm->functions);
+	mutex_unlock(&ghvm->fn_lock);
+
+	return r;
+free_arg:
+	kfree(inst->argp);
+free:
+	kfree(inst);
+	return r;
+}
+
+static long gh_vm_rm_function_instance(struct gh_vm *ghvm, struct gh_fn_desc *f)
+{
+	struct gh_vm_function_instance *inst, *iter;
+	void __user *user_argp;
+	void *argp;
+	long r = 0;
+
+	r = mutex_lock_interruptible(&ghvm->fn_lock);
+	if (r)
+		return r;
+
+	if (f->arg_size) {
+		argp = kzalloc(f->arg_size, GFP_KERNEL);
+		if (!argp) {
+			r = -ENOMEM;
+			goto out;
+		}
+
+		user_argp = u64_to_user_ptr(f->arg);
+		if (copy_from_user(argp, user_argp, f->arg_size)) {
+			r = -EFAULT;
+			kfree(argp);
+			goto out;
+		}
+
+		r = -ENOENT;
+		list_for_each_entry_safe(inst, iter, &ghvm->functions, vm_list) {
+			if (inst->fn->type == f->type &&
+				inst->fn->compare(inst, argp, f->arg_size)) {
+				gh_vm_remove_function_instance(inst);
+				r = 0;
+			}
+		}
+
+		kfree(argp);
+	}
+
+out:
+	mutex_unlock(&ghvm->fn_lock);
+	return r;
+}
+
+int gh_vm_function_register(struct gh_vm_function *fn)
+{
+	if (!fn->bind || !fn->unbind)
+		return -EINVAL;
+
+	return xa_err(xa_store(&gh_vm_functions, fn->type, fn, GFP_KERNEL));
+}
+EXPORT_SYMBOL_GPL(gh_vm_function_register);
+
+void gh_vm_function_unregister(struct gh_vm_function *fn)
+{
+	/* Expecting unregister to only come when unloading a module */
+	WARN_ON(fn->mod && module_refcount(fn->mod));
+	xa_erase(&gh_vm_functions, fn->type);
+}
+EXPORT_SYMBOL_GPL(gh_vm_function_unregister);
+
+int gh_vm_add_resource_ticket(struct gh_vm *ghvm, struct gh_vm_resource_ticket *ticket)
+{
+	struct gh_vm_resource_ticket *iter;
+	struct gh_resource *ghrsc, *rsc_iter;
+	int ret = 0;
+
+	mutex_lock(&ghvm->resources_lock);
+	list_for_each_entry(iter, &ghvm->resource_tickets, vm_list) {
+		if (iter->resource_type == ticket->resource_type && iter->label == ticket->label) {
+			ret = -EEXIST;
+			goto out;
+		}
+	}
+
+	if (!try_module_get(ticket->owner)) {
+		ret = -ENODEV;
+		goto out;
+	}
+
+	list_add(&ticket->vm_list, &ghvm->resource_tickets);
+	INIT_LIST_HEAD(&ticket->resources);
+
+	list_for_each_entry_safe(ghrsc, rsc_iter, &ghvm->resources, list) {
+		if (ghrsc->type == ticket->resource_type && ghrsc->rm_label == ticket->label) {
+			if (ticket->populate(ticket, ghrsc))
+				list_move(&ghrsc->list, &ticket->resources);
+		}
+	}
+out:
+	mutex_unlock(&ghvm->resources_lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(gh_vm_add_resource_ticket);
+
+void gh_vm_remove_resource_ticket(struct gh_vm *ghvm, struct gh_vm_resource_ticket *ticket)
+{
+	struct gh_resource *ghrsc, *iter;
+
+	mutex_lock(&ghvm->resources_lock);
+	list_for_each_entry_safe(ghrsc, iter, &ticket->resources, list) {
+		ticket->unpopulate(ticket, ghrsc);
+		list_move(&ghrsc->list, &ghvm->resources);
+	}
+
+	module_put(ticket->owner);
+	list_del(&ticket->vm_list);
+	mutex_unlock(&ghvm->resources_lock);
+}
+EXPORT_SYMBOL_GPL(gh_vm_remove_resource_ticket);
+
+static void gh_vm_add_resource(struct gh_vm *ghvm, struct gh_resource *ghrsc)
+{
+	struct gh_vm_resource_ticket *ticket;
+
+	mutex_lock(&ghvm->resources_lock);
+	list_for_each_entry(ticket, &ghvm->resource_tickets, vm_list) {
+		if (ghrsc->type == ticket->resource_type && ghrsc->rm_label == ticket->label) {
+			if (ticket->populate(ticket, ghrsc))
+				list_add(&ghrsc->list, &ticket->resources);
+			else
+				list_add(&ghrsc->list, &ghvm->resources);
+			/* unconditonal -- we prevent multiple identical
+			 * resource tickets so there will not be some other
+			 * ticket elsewhere in the list if populate() failed.
+			 */
+			goto found;
+		}
+	}
+	list_add(&ghrsc->list, &ghvm->resources);
+found:
+	mutex_unlock(&ghvm->resources_lock);
+}
+
+static void gh_vm_clean_resources(struct gh_vm *ghvm)
+{
+	struct gh_vm_resource_ticket *ticket, *titer;
+	struct gh_resource *ghrsc, *riter;
+
+	mutex_lock(&ghvm->resources_lock);
+	if (!list_empty(&ghvm->resource_tickets)) {
+		dev_warn(ghvm->parent, "Dangling resource tickets:\n");
+		list_for_each_entry_safe(ticket, titer, &ghvm->resource_tickets, vm_list) {
+			dev_warn(ghvm->parent, "  %pS\n", ticket->populate);
+			gh_vm_remove_resource_ticket(ghvm, ticket);
+		}
+	}
+
+	list_for_each_entry_safe(ghrsc, riter, &ghvm->resources, list) {
+		gh_rm_free_resource(ghrsc);
+	}
+	mutex_unlock(&ghvm->resources_lock);
+}
+
+static int _gh_vm_io_handler_compare(const struct rb_node *node, const struct rb_node *parent)
+{
+	struct gh_vm_io_handler *n = container_of(node, struct gh_vm_io_handler, node);
+	struct gh_vm_io_handler *p = container_of(parent, struct gh_vm_io_handler, node);
+
+	if (n->addr < p->addr)
+		return -1;
+	if (n->addr > p->addr)
+		return 1;
+	if ((n->len && !p->len) || (!n->len && p->len))
+		return 0;
+	if (n->len < p->len)
+		return -1;
+	if (n->len > p->len)
+		return 1;
+	/* one of the io handlers doesn't have datamatch and the other does.
+	 * For purposes of comparison, that makes them identical since the
+	 * one that doesn't have datamatch will cover the same handler that
+	 * does.
+	 */
+	if (n->datamatch != p->datamatch)
+		return 0;
+	if (n->data < p->data)
+		return -1;
+	if (n->data > p->data)
+		return 1;
+	return 0;
+}
+
+static int gh_vm_io_handler_compare(struct rb_node *node, const struct rb_node *parent)
+{
+	return _gh_vm_io_handler_compare(node, parent);
+}
+
+static int gh_vm_io_handler_find(const void *key, const struct rb_node *node)
+{
+	const struct gh_vm_io_handler *k = key;
+
+	return _gh_vm_io_handler_compare(&k->node, node);
+}
+
+static struct gh_vm_io_handler *gh_vm_mgr_find_io_hdlr(struct gh_vm *ghvm, u64 addr,
+								u64 len, u64 data)
+{
+	struct gh_vm_io_handler key = {
+		.addr = addr,
+		.len = len,
+		.datamatch = true,
+		.data = data,
+	};
+	struct rb_node *node;
+
+	node = rb_find(&key, &ghvm->mmio_handler_root, gh_vm_io_handler_find);
+	if (!node)
+		return NULL;
+
+	return container_of(node, struct gh_vm_io_handler, node);
+}
+
+int gh_vm_mmio_write(struct gh_vm *ghvm, u64 addr, u32 len, u64 data)
+{
+	struct gh_vm_io_handler *io_hdlr = NULL;
+	int ret;
+
+	down_read(&ghvm->mmio_handler_lock);
+	io_hdlr = gh_vm_mgr_find_io_hdlr(ghvm, addr, len, data);
+	if (!io_hdlr || !io_hdlr->ops || !io_hdlr->ops->write) {
+		ret = -ENODEV;
+		goto out;
+	}
+
+	ret = io_hdlr->ops->write(io_hdlr, addr, len, data);
+
+out:
+	up_read(&ghvm->mmio_handler_lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(gh_vm_mmio_write);
+
+int gh_vm_add_io_handler(struct gh_vm *ghvm, struct gh_vm_io_handler *io_hdlr)
+{
+	struct rb_node *found;
+
+	if (io_hdlr->datamatch && (!io_hdlr->len || io_hdlr->len > sizeof(io_hdlr->data)))
+		return -EINVAL;
+
+	down_write(&ghvm->mmio_handler_lock);
+	found = rb_find_add(&io_hdlr->node, &ghvm->mmio_handler_root, gh_vm_io_handler_compare);
+	up_write(&ghvm->mmio_handler_lock);
+
+	return found ? -EEXIST : 0;
+}
+EXPORT_SYMBOL_GPL(gh_vm_add_io_handler);
+
+void gh_vm_remove_io_handler(struct gh_vm *ghvm, struct gh_vm_io_handler *io_hdlr)
+{
+	down_write(&ghvm->mmio_handler_lock);
+	rb_erase(&io_hdlr->node, &ghvm->mmio_handler_root);
+	up_write(&ghvm->mmio_handler_lock);
+}
+EXPORT_SYMBOL_GPL(gh_vm_remove_io_handler);
+
+static int gh_vm_rm_notification_status(struct gh_vm *ghvm, void *data)
+{
+	struct gh_rm_vm_status_payload *payload = data;
+
+	if (le16_to_cpu(payload->vmid) != ghvm->vmid)
+		return NOTIFY_OK;
+
+	/* All other state transitions are synchronous to a corresponding RM call */
+	if (payload->vm_status == GH_RM_VM_STATUS_RESET) {
+		down_write(&ghvm->status_lock);
+		ghvm->vm_status = payload->vm_status;
+		up_write(&ghvm->status_lock);
+		wake_up(&ghvm->vm_status_wait);
+	}
+
+	return NOTIFY_DONE;
+}
+
+static int gh_vm_rm_notification_exited(struct gh_vm *ghvm, void *data)
+{
+	struct gh_rm_vm_exited_payload *payload = data;
+
+	if (le16_to_cpu(payload->vmid) != ghvm->vmid)
+		return NOTIFY_OK;
+
+	down_write(&ghvm->status_lock);
+	ghvm->vm_status = GH_RM_VM_STATUS_EXITED;
+	ghvm->exit_info.type = le16_to_cpu(payload->exit_type);
+	ghvm->exit_info.reason_size = le32_to_cpu(payload->exit_reason_size);
+	memcpy(&ghvm->exit_info.reason, payload->exit_reason,
+		min(GH_VM_MAX_EXIT_REASON_SIZE, ghvm->exit_info.reason_size));
+	up_write(&ghvm->status_lock);
+	wake_up(&ghvm->vm_status_wait);
+
+	return NOTIFY_DONE;
+}
+
+static int gh_vm_rm_notification(struct notifier_block *nb, unsigned long action, void *data)
+{
+	struct gh_vm *ghvm = container_of(nb, struct gh_vm, nb);
+
+	switch (action) {
+	case GH_RM_NOTIFICATION_VM_STATUS:
+		return gh_vm_rm_notification_status(ghvm, data);
+	case GH_RM_NOTIFICATION_VM_EXITED:
+		return gh_vm_rm_notification_exited(ghvm, data);
+	default:
+		return NOTIFY_OK;
+	}
+}
+
+static void gh_vm_stop(struct gh_vm *ghvm)
+{
+	int ret;
+
+	down_write(&ghvm->status_lock);
+	if (ghvm->vm_status == GH_RM_VM_STATUS_RUNNING) {
+		ret = gh_rm_vm_stop(ghvm->rm, ghvm->vmid);
+		if (ret)
+			dev_warn(ghvm->parent, "Failed to stop VM: %d\n", ret);
+	}
+	up_write(&ghvm->status_lock);
+
+	wait_event(ghvm->vm_status_wait, ghvm->vm_status == GH_RM_VM_STATUS_EXITED);
+}
+
+static __must_check struct gh_vm *gh_vm_alloc(struct gh_rm *rm)
+{
+	struct gh_vm *ghvm;
+
+	ghvm = kzalloc(sizeof(*ghvm), GFP_KERNEL);
+	if (!ghvm)
+		return ERR_PTR(-ENOMEM);
+
+	ghvm->parent = gh_rm_get(rm);
+	ghvm->vmid = GH_VMID_INVAL;
+	ghvm->rm = rm;
+
+	mmgrab(current->mm);
+	ghvm->mm = current->mm;
+	mutex_init(&ghvm->mm_lock);
+	INIT_LIST_HEAD(&ghvm->memory_mappings);
+	init_rwsem(&ghvm->status_lock);
+	init_waitqueue_head(&ghvm->vm_status_wait);
+	INIT_WORK(&ghvm->free_work, gh_vm_free);
+	kref_init(&ghvm->kref);
+	mutex_init(&ghvm->resources_lock);
+	INIT_LIST_HEAD(&ghvm->resources);
+	INIT_LIST_HEAD(&ghvm->resource_tickets);
+	init_rwsem(&ghvm->mmio_handler_lock);
+	ghvm->mmio_handler_root = RB_ROOT;
+	INIT_LIST_HEAD(&ghvm->functions);
+	ghvm->vm_status = GH_RM_VM_STATUS_NO_STATE;
+
+	return ghvm;
+}
+
+static int gh_vm_start(struct gh_vm *ghvm)
+{
+	struct gh_vm_mem *mapping;
+	struct gh_rm_hyp_resources *resources;
+	struct gh_resource *ghrsc;
+	u64 dtb_offset;
+	u32 mem_handle;
+	int ret, i, n;
+
+	down_write(&ghvm->status_lock);
+	if (ghvm->vm_status != GH_RM_VM_STATUS_NO_STATE) {
+		up_write(&ghvm->status_lock);
+		return 0;
+	}
+
+	ghvm->nb.notifier_call = gh_vm_rm_notification;
+	ret = gh_rm_notifier_register(ghvm->rm, &ghvm->nb);
+	if (ret)
+		goto err;
+
+	ret = gh_rm_alloc_vmid(ghvm->rm, 0);
+	if (ret < 0) {
+		gh_rm_notifier_unregister(ghvm->rm, &ghvm->nb);
+		goto err;
+	}
+	ghvm->vmid = ret;
+	ghvm->vm_status = GH_RM_VM_STATUS_LOAD;
+
+	mutex_lock(&ghvm->mm_lock);
+	list_for_each_entry(mapping, &ghvm->memory_mappings, list) {
+		mapping->parcel.acl_entries[0].vmid = cpu_to_le16(ghvm->vmid);
+		switch (mapping->share_type) {
+		case VM_MEM_LEND:
+			ret = gh_rm_mem_lend(ghvm->rm, &mapping->parcel);
+			break;
+		case VM_MEM_SHARE:
+			ret = gh_rm_mem_share(ghvm->rm, &mapping->parcel);
+			break;
+		}
+		if (ret) {
+			dev_warn(ghvm->parent, "Failed to %s parcel %d: %d\n",
+				mapping->share_type == VM_MEM_LEND ? "lend" : "share",
+				mapping->parcel.label,
+				ret);
+			goto err;
+		}
+	}
+	mutex_unlock(&ghvm->mm_lock);
+
+	mapping = gh_vm_mem_find_by_addr(ghvm, ghvm->dtb_config.guest_phys_addr,
+					ghvm->dtb_config.size);
+	if (!mapping) {
+		dev_warn(ghvm->parent, "Failed to find the memory_handle for DTB\n");
+		ret = -EINVAL;
+		goto err;
+	}
+
+	mem_handle = mapping->parcel.mem_handle;
+	dtb_offset = ghvm->dtb_config.guest_phys_addr - mapping->guest_phys_addr;
+
+	ret = gh_rm_vm_configure(ghvm->rm, ghvm->vmid, ghvm->auth, mem_handle,
+				0, 0, dtb_offset, ghvm->dtb_config.size);
+	if (ret) {
+		dev_warn(ghvm->parent, "Failed to configure VM: %d\n", ret);
+		goto err;
+	}
+
+	ret = gh_rm_vm_init(ghvm->rm, ghvm->vmid);
+	if (ret) {
+		ghvm->vm_status = GH_RM_VM_STATUS_INIT_FAILED;
+		dev_warn(ghvm->parent, "Failed to initialize VM: %d\n", ret);
+		goto err;
+	}
+	ghvm->vm_status = GH_RM_VM_STATUS_READY;
+
+	ret = gh_rm_get_hyp_resources(ghvm->rm, ghvm->vmid, &resources);
+	if (ret) {
+		dev_warn(ghvm->parent, "Failed to get hypervisor resources for VM: %d\n", ret);
+		goto err;
+	}
+
+	for (i = 0, n = le32_to_cpu(resources->n_entries); i < n; i++) {
+		ghrsc = gh_rm_alloc_resource(ghvm->rm, &resources->entries[i]);
+		if (!ghrsc) {
+			ret = -ENOMEM;
+			goto err;
+		}
+
+		gh_vm_add_resource(ghvm, ghrsc);
+	}
+
+	ret = gh_rm_vm_start(ghvm->rm, ghvm->vmid);
+	if (ret) {
+		dev_warn(ghvm->parent, "Failed to start VM: %d\n", ret);
+		goto err;
+	}
+
+	ghvm->vm_status = GH_RM_VM_STATUS_RUNNING;
+	up_write(&ghvm->status_lock);
+	return ret;
+err:
+	/* gh_vm_free will handle releasing resources and reclaiming memory */
+	up_write(&ghvm->status_lock);
+	return ret;
+}
+
+static int gh_vm_ensure_started(struct gh_vm *ghvm)
+{
+	int ret;
+
+	ret = down_read_interruptible(&ghvm->status_lock);
+	if (ret)
+		return ret;
+
+	/* Unlikely because VM is typically started */
+	if (unlikely(ghvm->vm_status == GH_RM_VM_STATUS_NO_STATE)) {
+		up_read(&ghvm->status_lock);
+		ret = gh_vm_start(ghvm);
+		if (ret)
+			return ret;
+		/** gh_vm_start() is guaranteed to bring status out of
+		 * GH_RM_VM_STATUS_LOAD, thus infinitely recursive call is not
+		 * possible
+		 */
+		return gh_vm_ensure_started(ghvm);
+	}
+
+	/* Unlikely because VM is typically running */
+	if (unlikely(ghvm->vm_status != GH_RM_VM_STATUS_RUNNING))
+		ret = -ENODEV;
+
+	up_read(&ghvm->status_lock);
+	return ret;
+}
+
+static long gh_vm_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+{
+	struct gh_vm *ghvm = filp->private_data;
+	void __user *argp = (void __user *)arg;
+	long r;
+	bool lend = false;
+
+	switch (cmd) {
+	case GH_VM_ANDROID_LEND_USER_MEM:
+		lend = true;
+		fallthrough;
+	case GH_VM_SET_USER_MEM_REGION: {
+		struct gh_userspace_memory_region region;
+
+		/* only allow owner task to add memory */
+		if (ghvm->mm != current->mm)
+			return -EPERM;
+
+		if (copy_from_user(&region, argp, sizeof(region)))
+			return -EFAULT;
+
+		/* All other flag bits are reserved for future use */
+		if (region.flags & ~(GH_MEM_ALLOW_READ | GH_MEM_ALLOW_WRITE | GH_MEM_ALLOW_EXEC))
+			return -EINVAL;
+
+		r = gh_vm_mem_alloc(ghvm, &region, lend);
+		break;
+	}
+	case GH_VM_SET_DTB_CONFIG: {
+		struct gh_vm_dtb_config dtb_config;
+
+		if (copy_from_user(&dtb_config, argp, sizeof(dtb_config)))
+			return -EFAULT;
+
+		if (overflows_type(dtb_config.guest_phys_addr + dtb_config.size, u64))
+			return -EOVERFLOW;
+
+		ghvm->dtb_config = dtb_config;
+
+		r = 0;
+		break;
+	}
+	case GH_VM_START: {
+		r = gh_vm_ensure_started(ghvm);
+		break;
+	}
+	case GH_VM_ADD_FUNCTION: {
+		struct gh_fn_desc f;
+
+		if (copy_from_user(&f, argp, sizeof(f)))
+			return -EFAULT;
+
+		r = gh_vm_add_function_instance(ghvm, &f);
+		break;
+	}
+	case GH_VM_REMOVE_FUNCTION: {
+		struct gh_fn_desc f;
+
+		if (copy_from_user(&f, argp, sizeof(f)))
+			return -EFAULT;
+
+		r = gh_vm_rm_function_instance(ghvm, &f);
+		break;
+	}
+	default:
+		r = -ENOTTY;
+		break;
+	}
+
+	return r;
+}
+
+static void gh_vm_free(struct work_struct *work)
+{
+	struct gh_vm *ghvm = container_of(work, struct gh_vm, free_work);
+	int ret;
+
+	if (ghvm->vm_status == GH_RM_VM_STATUS_RUNNING)
+		gh_vm_stop(ghvm);
+
+	gh_vm_remove_functions(ghvm);
+	gh_vm_clean_resources(ghvm);
+
+	if (ghvm->vm_status != GH_RM_VM_STATUS_NO_STATE &&
+	    ghvm->vm_status != GH_RM_VM_STATUS_LOAD &&
+	    ghvm->vm_status != GH_RM_VM_STATUS_RESET) {
+		ret = gh_rm_vm_reset(ghvm->rm, ghvm->vmid);
+		if (ret)
+			dev_err(ghvm->parent, "Failed to reset the vm: %d\n", ret);
+		wait_event(ghvm->vm_status_wait, ghvm->vm_status == GH_RM_VM_STATUS_RESET);
+	}
+
+	gh_vm_mem_reclaim(ghvm);
+
+	if (ghvm->vm_status > GH_RM_VM_STATUS_NO_STATE) {
+		gh_rm_notifier_unregister(ghvm->rm, &ghvm->nb);
+
+		ret = gh_rm_dealloc_vmid(ghvm->rm, ghvm->vmid);
+		if (ret)
+			dev_warn(ghvm->parent, "Failed to deallocate vmid: %d\n", ret);
+	}
+
+	gh_rm_put(ghvm->rm);
+	mmdrop(ghvm->mm);
+	kfree(ghvm);
+}
+
+int __must_check gh_vm_get(struct gh_vm *ghvm)
+{
+	return kref_get_unless_zero(&ghvm->kref);
+}
+EXPORT_SYMBOL_GPL(gh_vm_get);
+
+static void _gh_vm_put(struct kref *kref)
+{
+	struct gh_vm *ghvm = container_of(kref, struct gh_vm, kref);
+
+	/* VM will be reset and make RM calls which can interruptible sleep.
+	 * Defer to a work so this thread can receive signal.
+	 */
+	schedule_work(&ghvm->free_work);
+}
+
+void gh_vm_put(struct gh_vm *ghvm)
+{
+	kref_put(&ghvm->kref, _gh_vm_put);
+}
+EXPORT_SYMBOL_GPL(gh_vm_put);
+
+static int gh_vm_release(struct inode *inode, struct file *filp)
+{
+	struct gh_vm *ghvm = filp->private_data;
+
+	gh_vm_put(ghvm);
+	return 0;
+}
+
+static const struct file_operations gh_vm_fops = {
+	.owner = THIS_MODULE,
+	.unlocked_ioctl = gh_vm_ioctl,
+	.compat_ioctl	= compat_ptr_ioctl,
+	.release = gh_vm_release,
+	.llseek = noop_llseek,
+};
+
+static long gh_dev_ioctl_create_vm(struct gh_rm *rm, unsigned long arg)
+{
+	struct gh_vm *ghvm;
+	struct file *file;
+	int fd, err;
+
+	/* arg reserved for future use. */
+	if (arg)
+		return -EINVAL;
+
+	ghvm = gh_vm_alloc(rm);
+	if (IS_ERR(ghvm))
+		return PTR_ERR(ghvm);
+
+	fd = get_unused_fd_flags(O_CLOEXEC);
+	if (fd < 0) {
+		err = fd;
+		goto err_destroy_vm;
+	}
+
+	file = anon_inode_getfile("gunyah-vm", &gh_vm_fops, ghvm, O_RDWR);
+	if (IS_ERR(file)) {
+		err = PTR_ERR(file);
+		goto err_put_fd;
+	}
+
+	fd_install(fd, file);
+
+	return fd;
+
+err_put_fd:
+	put_unused_fd(fd);
+err_destroy_vm:
+	gh_vm_put(ghvm);
+	return err;
+}
+
+long gh_dev_vm_mgr_ioctl(struct gh_rm *rm, unsigned int cmd, unsigned long arg)
+{
+	switch (cmd) {
+	case GH_CREATE_VM:
+		return gh_dev_ioctl_create_vm(rm, arg);
+	default:
+		return -ENOTTY;
+	}
+}
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/vm_mgr.h
+++ linux-qcom-6.8.0/drivers/virt/gunyah/vm_mgr.h
@@ -0,0 +1,70 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _GH_VM_MGR_H
+#define _GH_VM_MGR_H
+
+#include <linux/gunyah_rsc_mgr.h>
+#include <linux/gunyah_vm_mgr.h>
+#include <linux/list.h>
+#include <linux/kref.h>
+#include <linux/miscdevice.h>
+#include <linux/mutex.h>
+#include <linux/rwsem.h>
+#include <linux/wait.h>
+
+#include <uapi/linux/gunyah.h>
+
+long gh_dev_vm_mgr_ioctl(struct gh_rm *rm, unsigned int cmd, unsigned long arg);
+
+enum gh_vm_mem_share_type {
+	VM_MEM_SHARE,
+	VM_MEM_LEND,
+};
+
+struct gh_vm_mem {
+	struct list_head list;
+	enum gh_vm_mem_share_type share_type;
+	struct gh_rm_mem_parcel parcel;
+
+	__u64 guest_phys_addr;
+	struct page **pages;
+	unsigned long npages;
+};
+
+struct gh_vm {
+	u16 vmid;
+	struct gh_rm *rm;
+	struct device *parent;
+	enum gh_rm_vm_auth_mechanism auth;
+	struct gh_vm_dtb_config dtb_config;
+
+	struct notifier_block nb;
+	enum gh_rm_vm_status vm_status;
+	wait_queue_head_t vm_status_wait;
+	struct rw_semaphore status_lock;
+	struct gh_vm_exit_info exit_info;
+
+	struct work_struct free_work;
+	struct kref kref;
+	struct mm_struct *mm; /* userspace tied to this vm */
+	struct mutex mm_lock;
+	struct list_head memory_mappings;
+	struct mutex fn_lock;
+	struct list_head functions;
+	struct mutex resources_lock;
+	struct list_head resources;
+	struct list_head resource_tickets;
+	struct rb_root mmio_handler_root;
+	struct rw_semaphore mmio_handler_lock;
+};
+
+int gh_vm_mem_alloc(struct gh_vm *ghvm, struct gh_userspace_memory_region *region, bool lend);
+void gh_vm_mem_reclaim(struct gh_vm *ghvm);
+struct gh_vm_mem *gh_vm_mem_find_by_addr(struct gh_vm *ghvm, u64 guest_phys_addr, u32 size);
+
+int gh_vm_mmio_write(struct gh_vm *ghvm, u64 addr, u32 len, u64 data);
+
+#endif
--- linux-qcom-6.8.0.orig/drivers/virt/gunyah/vm_mgr_mm.c
+++ linux-qcom-6.8.0/drivers/virt/gunyah/vm_mgr_mm.c
@@ -0,0 +1,259 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) "gh_vm_mgr: " fmt
+
+#include <linux/gunyah_rsc_mgr.h>
+#include <linux/mm.h>
+
+#include <uapi/linux/gunyah.h>
+
+#include "vm_mgr.h"
+
+static bool pages_are_mergeable(struct page *a, struct page *b)
+{
+	return page_to_pfn(a) + 1 == page_to_pfn(b);
+}
+
+static bool gh_vm_mem_overlap(struct gh_vm_mem *a, u64 addr, u64 size)
+{
+	u64 a_end = a->guest_phys_addr + (a->npages << PAGE_SHIFT);
+	u64 end = addr + size;
+
+	return a->guest_phys_addr < end && addr < a_end;
+}
+
+static struct gh_vm_mem *__gh_vm_mem_find_by_label(struct gh_vm *ghvm, u32 label)
+	__must_hold(&ghvm->mm_lock)
+{
+	struct gh_vm_mem *mapping;
+
+	list_for_each_entry(mapping, &ghvm->memory_mappings, list)
+		if (mapping->parcel.label == label)
+			return mapping;
+
+	return NULL;
+}
+
+static void gh_vm_mem_reclaim_mapping(struct gh_vm *ghvm, struct gh_vm_mem *mapping)
+	__must_hold(&ghvm->mm_lock)
+{
+	int ret = 0;
+
+	if (mapping->parcel.mem_handle != GH_MEM_HANDLE_INVAL) {
+		ret = gh_rm_mem_reclaim(ghvm->rm, &mapping->parcel);
+		if (ret)
+			pr_warn("Failed to reclaim memory parcel for label %d: %d\n",
+				mapping->parcel.label, ret);
+	}
+
+	if (!ret) {
+		unpin_user_pages(mapping->pages, mapping->npages);
+		account_locked_vm(ghvm->mm, mapping->npages, false);
+	}
+
+	kvfree(mapping->pages);
+	kfree(mapping->parcel.acl_entries);
+	kvfree(mapping->parcel.mem_entries);
+
+	list_del(&mapping->list);
+}
+
+void gh_vm_mem_reclaim(struct gh_vm *ghvm)
+{
+	struct gh_vm_mem *mapping, *tmp;
+
+	mutex_lock(&ghvm->mm_lock);
+
+	list_for_each_entry_safe(mapping, tmp, &ghvm->memory_mappings, list) {
+		gh_vm_mem_reclaim_mapping(ghvm, mapping);
+		kfree(mapping);
+	}
+
+	mutex_unlock(&ghvm->mm_lock);
+}
+
+struct gh_vm_mem *gh_vm_mem_find_by_addr(struct gh_vm *ghvm, u64 guest_phys_addr, u32 size)
+{
+	struct gh_vm_mem *mapping;
+
+	if (overflows_type(guest_phys_addr + size, u64))
+		return NULL;
+
+	mutex_lock(&ghvm->mm_lock);
+
+	list_for_each_entry(mapping, &ghvm->memory_mappings, list) {
+		if (gh_vm_mem_overlap(mapping, guest_phys_addr, size))
+			goto unlock;
+	}
+
+	mapping = NULL;
+unlock:
+	mutex_unlock(&ghvm->mm_lock);
+	return mapping;
+}
+
+int gh_vm_mem_alloc(struct gh_vm *ghvm, struct gh_userspace_memory_region *region, bool lend)
+{
+	struct gh_vm_mem *mapping, *tmp_mapping;
+	struct page *curr_page, *prev_page;
+	struct gh_rm_mem_parcel *parcel;
+	int i, j, pinned, ret = 0;
+	unsigned int gup_flags;
+	size_t entry_size;
+	u16 vmid;
+
+	if (!region->memory_size || !PAGE_ALIGNED(region->memory_size) ||
+		!PAGE_ALIGNED(region->userspace_addr) ||
+		!PAGE_ALIGNED(region->guest_phys_addr))
+		return -EINVAL;
+
+	if (overflows_type(region->guest_phys_addr + region->memory_size, u64))
+		return -EOVERFLOW;
+
+	ret = mutex_lock_interruptible(&ghvm->mm_lock);
+	if (ret)
+		return ret;
+
+	mapping = __gh_vm_mem_find_by_label(ghvm, region->label);
+	if (mapping) {
+		ret = -EEXIST;
+		goto unlock;
+	}
+
+	list_for_each_entry(tmp_mapping, &ghvm->memory_mappings, list) {
+		if (gh_vm_mem_overlap(tmp_mapping, region->guest_phys_addr,
+					region->memory_size)) {
+			ret = -EEXIST;
+			goto unlock;
+		}
+	}
+
+	mapping = kzalloc(sizeof(*mapping), GFP_KERNEL_ACCOUNT);
+	if (!mapping) {
+		ret = -ENOMEM;
+		goto unlock;
+	}
+
+	mapping->guest_phys_addr = region->guest_phys_addr;
+	mapping->npages = region->memory_size >> PAGE_SHIFT;
+	parcel = &mapping->parcel;
+	parcel->label = region->label;
+	parcel->mem_handle = GH_MEM_HANDLE_INVAL; /* to be filled later by mem_share/mem_lend */
+	parcel->mem_type = GH_RM_MEM_TYPE_NORMAL;
+
+	ret = account_locked_vm(ghvm->mm, mapping->npages, true);
+	if (ret)
+		goto free_mapping;
+
+	mapping->pages = kvcalloc(mapping->npages, sizeof(*mapping->pages), GFP_KERNEL_ACCOUNT);
+	if (!mapping->pages) {
+		ret = -ENOMEM;
+		mapping->npages = 0; /* update npages for reclaim */
+		goto unlock_pages;
+	}
+
+	gup_flags = FOLL_LONGTERM;
+	if (region->flags & GH_MEM_ALLOW_WRITE)
+		gup_flags |= FOLL_WRITE;
+
+	pinned = pin_user_pages_fast(region->userspace_addr, mapping->npages,
+					gup_flags, mapping->pages);
+	if (pinned < 0) {
+		ret = pinned;
+		goto free_pages;
+	} else if (pinned != mapping->npages) {
+		ret = -EFAULT;
+		mapping->npages = pinned; /* update npages for reclaim */
+		goto unpin_pages;
+	}
+
+	if (lend) {
+		parcel->n_acl_entries = 1;
+		mapping->share_type = VM_MEM_LEND;
+	} else {
+		parcel->n_acl_entries = 2;
+		mapping->share_type = VM_MEM_SHARE;
+	}
+	parcel->acl_entries = kcalloc(parcel->n_acl_entries, sizeof(*parcel->acl_entries),
+					GFP_KERNEL);
+	if (!parcel->acl_entries) {
+		ret = -ENOMEM;
+		goto unpin_pages;
+	}
+
+	/* acl_entries[0].vmid will be this VM's vmid. We'll fill it when the
+	 * VM is starting and we know the VM's vmid.
+	 */
+	if (region->flags & GH_MEM_ALLOW_READ)
+		parcel->acl_entries[0].perms |= GH_RM_ACL_R;
+	if (region->flags & GH_MEM_ALLOW_WRITE)
+		parcel->acl_entries[0].perms |= GH_RM_ACL_W;
+	if (region->flags & GH_MEM_ALLOW_EXEC)
+		parcel->acl_entries[0].perms |= GH_RM_ACL_X;
+
+	if (!lend) {
+		ret = gh_rm_get_vmid(ghvm->rm, &vmid);
+		if (ret)
+			goto free_acl;
+
+		parcel->acl_entries[1].vmid = cpu_to_le16(vmid);
+		/* Host assumed to have all these permissions. Gunyah will not
+		 * grant new permissions if host actually had less than RWX
+		 */
+		parcel->acl_entries[1].perms = GH_RM_ACL_R | GH_RM_ACL_W | GH_RM_ACL_X;
+	}
+
+	parcel->n_mem_entries = 1;
+	for (i = 1; i < mapping->npages; i++) {
+		if (!pages_are_mergeable(mapping->pages[i - 1], mapping->pages[i]))
+			parcel->n_mem_entries++;
+	}
+
+	parcel->mem_entries = kvcalloc(parcel->n_mem_entries,
+					sizeof(parcel->mem_entries[0]),
+					GFP_KERNEL_ACCOUNT);
+	if (!parcel->mem_entries) {
+		ret = -ENOMEM;
+		goto free_acl;
+	}
+
+	/* reduce number of entries by combining contiguous pages into single memory entry */
+	prev_page = mapping->pages[0];
+	parcel->mem_entries[0].phys_addr = cpu_to_le64(page_to_phys(prev_page));
+	entry_size = PAGE_SIZE;
+	for (i = 1, j = 0; i < mapping->npages; i++) {
+		curr_page = mapping->pages[i];
+		if (pages_are_mergeable(prev_page, curr_page)) {
+			entry_size += PAGE_SIZE;
+		} else {
+			parcel->mem_entries[j].size = cpu_to_le64(entry_size);
+			j++;
+			parcel->mem_entries[j].phys_addr =
+				cpu_to_le64(page_to_phys(curr_page));
+			entry_size = PAGE_SIZE;
+		}
+
+		prev_page = curr_page;
+	}
+	parcel->mem_entries[j].size = cpu_to_le64(entry_size);
+
+	list_add(&mapping->list, &ghvm->memory_mappings);
+	mutex_unlock(&ghvm->mm_lock);
+	return 0;
+free_acl:
+	kfree(parcel->acl_entries);
+unpin_pages:
+	unpin_user_pages(mapping->pages, pinned);
+free_pages:
+	kvfree(mapping->pages);
+unlock_pages:
+	account_locked_vm(ghvm->mm, mapping->npages, false);
+free_mapping:
+	kvfree(mapping);
+unlock:
+	mutex_unlock(&ghvm->mm_lock);
+	return ret;
+}
--- linux-qcom-6.8.0.orig/drivers/virt/vmgenid.c
+++ linux-qcom-6.8.0/drivers/virt/vmgenid.c
@@ -68,7 +68,6 @@
 static void vmgenid_notify(struct acpi_device *device, u32 event)
 {
 	struct vmgenid_state *state = acpi_driver_data(device);
-	char *envp[] = { "NEW_VMGENID=1", NULL };
 	u8 old_id[VMGENID_SIZE];
 
 	memcpy(old_id, state->this_id, sizeof(old_id));
@@ -76,7 +75,6 @@
 	if (!memcmp(old_id, state->this_id, sizeof(old_id)))
 		return;
 	add_vmfork_randomness(state->this_id, sizeof(state->this_id));
-	kobject_uevent_env(&device->dev.kobj, KOBJ_CHANGE, envp);
 }
 
 static const struct acpi_device_id vmgenid_ids[] = {
--- linux-qcom-6.8.0.orig/drivers/virtio/virtio.c
+++ linux-qcom-6.8.0/drivers/virtio/virtio.c
@@ -127,10 +127,12 @@
 {
 	struct virtio_driver *drv = drv_to_virtio(dev->dev.driver);
 
-	if (!dev->config_enabled)
+	if (!dev->config_core_enabled || dev->config_driver_disabled)
 		dev->config_change_pending = true;
-	else if (drv && drv->config_changed)
+	else if (drv && drv->config_changed) {
 		drv->config_changed(dev);
+		dev->config_change_pending = false;
+	}
 }
 
 void virtio_config_changed(struct virtio_device *dev)
@@ -143,20 +145,51 @@
 }
 EXPORT_SYMBOL_GPL(virtio_config_changed);
 
-static void virtio_config_disable(struct virtio_device *dev)
+/**
+ * virtio_config_driver_disable - disable config change reporting by drivers
+ * @dev: the device to reset
+ *
+ * This is only allowed to be called by a driver and disabling can't
+ * be nested.
+ */
+void virtio_config_driver_disable(struct virtio_device *dev)
 {
 	spin_lock_irq(&dev->config_lock);
-	dev->config_enabled = false;
+	dev->config_driver_disabled = true;
 	spin_unlock_irq(&dev->config_lock);
 }
+EXPORT_SYMBOL_GPL(virtio_config_driver_disable);
 
-static void virtio_config_enable(struct virtio_device *dev)
+/**
+ * virtio_config_driver_enable - enable config change reporting by drivers
+ * @dev: the device to reset
+ *
+ * This is only allowed to be called by a driver and enabling can't
+ * be nested.
+ */
+void virtio_config_driver_enable(struct virtio_device *dev)
 {
 	spin_lock_irq(&dev->config_lock);
-	dev->config_enabled = true;
+	dev->config_driver_disabled = false;
+	if (dev->config_change_pending)
+		__virtio_config_changed(dev);
+	spin_unlock_irq(&dev->config_lock);
+}
+EXPORT_SYMBOL_GPL(virtio_config_driver_enable);
+
+static void virtio_config_core_disable(struct virtio_device *dev)
+{
+	spin_lock_irq(&dev->config_lock);
+	dev->config_core_enabled = false;
+	spin_unlock_irq(&dev->config_lock);
+}
+
+static void virtio_config_core_enable(struct virtio_device *dev)
+{
+	spin_lock_irq(&dev->config_lock);
+	dev->config_core_enabled = true;
 	if (dev->config_change_pending)
 		__virtio_config_changed(dev);
-	dev->config_change_pending = false;
 	spin_unlock_irq(&dev->config_lock);
 }
 
@@ -319,7 +352,7 @@
 	if (drv->scan)
 		drv->scan(dev);
 
-	virtio_config_enable(dev);
+	virtio_config_core_enable(dev);
 
 	return 0;
 
@@ -337,7 +370,7 @@
 	struct virtio_device *dev = dev_to_virtio(_d);
 	struct virtio_driver *drv = drv_to_virtio(dev->dev.driver);
 
-	virtio_config_disable(dev);
+	virtio_config_core_disable(dev);
 
 	drv->remove(dev);
 
@@ -450,7 +483,7 @@
 		goto out_ida_remove;
 
 	spin_lock_init(&dev->config_lock);
-	dev->config_enabled = false;
+	dev->config_core_enabled = false;
 	dev->config_change_pending = false;
 
 	INIT_LIST_HEAD(&dev->vqs);
@@ -504,14 +537,16 @@
 	struct virtio_driver *drv = drv_to_virtio(dev->dev.driver);
 	int ret;
 
-	virtio_config_disable(dev);
+	virtio_config_core_disable(dev);
 
 	dev->failed = dev->config->get_status(dev) & VIRTIO_CONFIG_S_FAILED;
 
 	if (drv && drv->freeze) {
 		ret = drv->freeze(dev);
-		if (ret)
+		if (ret) {
+			virtio_config_core_enable(dev);
 			return ret;
+		}
 	}
 
 	if (dev->config->destroy_avq)
@@ -568,7 +603,7 @@
 	if (!(dev->config->get_status(dev) & VIRTIO_CONFIG_S_DRIVER_OK))
 		virtio_device_ready(dev);
 
-	virtio_config_enable(dev);
+	virtio_config_core_enable(dev);
 
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/virtio/virtio_balloon.c
+++ linux-qcom-6.8.0/drivers/virtio/virtio_balloon.c
@@ -450,7 +450,7 @@
 	vb->adjustment_signal_pending = true;
 	if (!vb->adjustment_in_progress) {
 		vb->adjustment_in_progress = true;
-		pm_stay_awake(vb->vdev->dev.parent);
+		pm_stay_awake(&vb->vdev->dev);
 	}
 	spin_unlock_irqrestore(&vb->adjustment_lock, flags);
 
@@ -462,7 +462,7 @@
 	spin_lock_irq(&vb->adjustment_lock);
 	if (!vb->adjustment_signal_pending && vb->adjustment_in_progress) {
 		vb->adjustment_in_progress = false;
-		pm_relax(vb->vdev->dev.parent);
+		pm_relax(&vb->vdev->dev);
 	}
 	spin_unlock_irq(&vb->adjustment_lock);
 }
@@ -1029,6 +1029,15 @@
 
 	spin_lock_init(&vb->adjustment_lock);
 
+	/*
+	 * The virtio balloon itself can't wake up the device, but it is
+	 * responsible for processing wakeup events passed up from the transport
+	 * layer. Wakeup sources don't support nesting/chaining calls, so we use
+	 * our own wakeup source to ensure wakeup events are properly handled
+	 * without trampling on the transport layer's wakeup source.
+	 */
+	device_set_wakeup_capable(&vb->vdev->dev, true);
+
 	virtio_device_ready(vdev);
 
 	if (towards_target(vb))
--- linux-qcom-6.8.0.orig/drivers/virtio/virtio_pci_common.c
+++ linux-qcom-6.8.0/drivers/virtio/virtio_pci_common.c
@@ -236,7 +236,7 @@
 	int i;
 
 	list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
-		if (vp_dev->is_avq(vdev, vq->index))
+		if (vp_dev->is_avq && vp_dev->is_avq(vdev, vq->index))
 			continue;
 
 		if (vp_dev->per_vq_vectors) {
@@ -348,8 +348,10 @@
 				  vring_interrupt, 0,
 				  vp_dev->msix_names[msix_vec],
 				  vqs[i]);
-		if (err)
+		if (err) {
+			vp_del_vq(vqs[i]);
 			goto error_find;
+		}
 	}
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/virtio/virtio_ring.c
+++ linux-qcom-6.8.0/drivers/virtio/virtio_ring.c
@@ -1340,7 +1340,7 @@
 				sizeof(struct vring_packed_desc));
 	vq->packed.vring.desc[head].id = cpu_to_le16(id);
 
-	if (vq->do_unmap) {
+	if (vq->use_dma_api) {
 		vq->packed.desc_extra[id].addr = addr;
 		vq->packed.desc_extra[id].len = total_sg *
 				sizeof(struct vring_packed_desc);
@@ -1481,7 +1481,7 @@
 			desc[i].len = cpu_to_le32(sg->length);
 			desc[i].id = cpu_to_le16(id);
 
-			if (unlikely(vq->do_unmap)) {
+			if (unlikely(vq->use_dma_api)) {
 				vq->packed.desc_extra[curr].addr = addr;
 				vq->packed.desc_extra[curr].len = sg->length;
 				vq->packed.desc_extra[curr].flags =
@@ -1615,7 +1615,7 @@
 	vq->free_head = id;
 	vq->vq.num_free += state->num;
 
-	if (unlikely(vq->do_unmap)) {
+	if (unlikely(vq->use_dma_api)) {
 		curr = id;
 		for (i = 0; i < state->num; i++) {
 			vring_unmap_extra_packed(vq,
@@ -3126,8 +3126,10 @@
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
 
-	if (!vq->use_dma_api)
+	if (!vq->use_dma_api) {
+		kmsan_handle_dma(virt_to_page(ptr), offset_in_page(ptr), size, dir);
 		return (dma_addr_t)virt_to_phys(ptr);
+	}
 
 	return dma_map_single_attrs(vring_dma_dev(vq), ptr, size, dir, attrs);
 }
--- linux-qcom-6.8.0.orig/drivers/watchdog/apple_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/apple_wdt.c
@@ -130,7 +130,7 @@
 	 * can take up to ~20-25ms until the SoC is actually reset. Just wait
 	 * 50ms here to be safe.
 	 */
-	(void)readl_relaxed(wdt->regs + APPLE_WDT_WD1_CUR_TIME);
+	(void)readl(wdt->regs + APPLE_WDT_WD1_CUR_TIME);
 	mdelay(50);
 
 	return 0;
--- linux-qcom-6.8.0.orig/drivers/watchdog/bd9576_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/bd9576_wdt.c
@@ -29,7 +29,6 @@
 	struct gpio_desc	*gpiod_en;
 	struct device		*dev;
 	struct regmap		*regmap;
-	bool			always_running;
 	struct watchdog_device	wdd;
 };
 
@@ -62,10 +61,7 @@
 {
 	struct bd9576_wdt_priv *priv = watchdog_get_drvdata(wdd);
 
-	if (!priv->always_running)
-		bd9576_wdt_disable(priv);
-	else
-		set_bit(WDOG_HW_RUNNING, &wdd->status);
+	bd9576_wdt_disable(priv);
 
 	return 0;
 }
@@ -264,9 +260,6 @@
 	if (ret)
 		return ret;
 
-	priv->always_running = device_property_read_bool(dev->parent,
-							 "always-running");
-
 	watchdog_set_drvdata(&priv->wdd, priv);
 
 	priv->wdd.info			= &bd957x_wdt_ident;
@@ -281,9 +274,6 @@
 
 	watchdog_stop_on_reboot(&priv->wdd);
 
-	if (priv->always_running)
-		bd9576_wdt_start(&priv->wdd);
-
 	return devm_watchdog_register_device(dev, &priv->wdd);
 }
 
--- linux-qcom-6.8.0.orig/drivers/watchdog/cpu5wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/cpu5wdt.c
@@ -252,7 +252,7 @@
 	if (cpu5wdt_device.queue) {
 		cpu5wdt_device.queue = 0;
 		wait_for_completion(&cpu5wdt_device.stop);
-		del_timer(&cpu5wdt_device.timer);
+		timer_shutdown_sync(&cpu5wdt_device.timer);
 	}
 
 	misc_deregister(&cpu5wdt_misc);
--- linux-qcom-6.8.0.orig/drivers/watchdog/iTCO_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/iTCO_wdt.c
@@ -82,6 +82,13 @@
 #define TCO2_CNT(p)	(TCOBASE(p) + 0x0a) /* TCO2 Control Register	*/
 #define TCOv2_TMR(p)	(TCOBASE(p) + 0x12) /* TCOv2 Timer Initial Value*/
 
+/*
+ * NMI_NOW is bit 8 of TCO1_CNT register
+ * Read/Write
+ * This bit is implemented as RW but has no effect on HW.
+ */
+#define NMI_NOW		BIT(8)
+
 /* internal variables */
 struct iTCO_wdt_private {
 	struct watchdog_device wddev;
@@ -219,13 +226,23 @@
 	struct iTCO_wdt_private *p = priv;
 	u16 val, newval;
 
-	val = inw(TCO1_CNT(p));
+	/*
+	 * writing back 1b1 to NMI_NOW of TCO1_CNT register
+	 * causes NMI_NOW bit inversion what consequently does
+	 * not allow to perform the register's value comparison
+	 * properly.
+	 *
+	 * NMI_NOW bit masking for TCO1_CNT register values
+	 * helps to avoid possible NMI_NOW bit inversions on
+	 * following write operation.
+	 */
+	val = inw(TCO1_CNT(p)) & ~NMI_NOW;
 	if (set)
 		val |= BIT(0);
 	else
 		val &= ~BIT(0);
 	outw(val, TCO1_CNT(p));
-	newval = inw(TCO1_CNT(p));
+	newval = inw(TCO1_CNT(p)) & ~NMI_NOW;
 
 	/* make sure the update is successful */
 	return val != newval ? -EIO : 0;
--- linux-qcom-6.8.0.orig/drivers/watchdog/imx7ulp_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/imx7ulp_wdt.c
@@ -290,6 +290,11 @@
 	if (wdt->ext_reset)
 		val |= WDOG_CS_INT_EN;
 
+	if (readl(wdt->base + WDOG_CS) & WDOG_CS_EN) {
+		set_bit(WDOG_HW_RUNNING, &wdt->wdd.status);
+		val |= WDOG_CS_EN;
+	}
+
 	do {
 		ret = _imx7ulp_wdt_init(wdt, timeout, val);
 		toval = readl(wdt->base + WDOG_TOVAL);
--- linux-qcom-6.8.0.orig/drivers/watchdog/imx_sc_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/imx_sc_wdt.c
@@ -216,29 +216,6 @@
 	return devm_watchdog_register_device(dev, wdog);
 }
 
-static int __maybe_unused imx_sc_wdt_suspend(struct device *dev)
-{
-	struct imx_sc_wdt_device *imx_sc_wdd = dev_get_drvdata(dev);
-
-	if (watchdog_active(&imx_sc_wdd->wdd))
-		imx_sc_wdt_stop(&imx_sc_wdd->wdd);
-
-	return 0;
-}
-
-static int __maybe_unused imx_sc_wdt_resume(struct device *dev)
-{
-	struct imx_sc_wdt_device *imx_sc_wdd = dev_get_drvdata(dev);
-
-	if (watchdog_active(&imx_sc_wdd->wdd))
-		imx_sc_wdt_start(&imx_sc_wdd->wdd);
-
-	return 0;
-}
-
-static SIMPLE_DEV_PM_OPS(imx_sc_wdt_pm_ops,
-			 imx_sc_wdt_suspend, imx_sc_wdt_resume);
-
 static const struct of_device_id imx_sc_wdt_dt_ids[] = {
 	{ .compatible = "fsl,imx-sc-wdt", },
 	{ /* sentinel */ }
@@ -250,7 +227,6 @@
 	.driver		= {
 		.name	= "imx-sc-wdt",
 		.of_match_table = imx_sc_wdt_dt_ids,
-		.pm	= &imx_sc_wdt_pm_ops,
 	},
 };
 module_platform_driver(imx_sc_wdt_driver);
--- linux-qcom-6.8.0.orig/drivers/watchdog/it87_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/it87_wdt.c
@@ -20,6 +20,8 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/bits.h>
+#include <linux/dmi.h>
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
@@ -40,6 +42,7 @@
 #define VAL		0x2f
 
 /* Logical device Numbers LDN */
+#define EC		0x04
 #define GPIO		0x07
 
 /* Configuration Registers and Functions */
@@ -73,6 +76,12 @@
 #define IT8784_ID	0x8784
 #define IT8786_ID	0x8786
 
+/* Environment Controller Configuration Registers LDN=0x04 */
+#define SCR1		0xfa
+
+/* Environment Controller Bits SCR1 */
+#define WDT_PWRGD	0x20
+
 /* GPIO Configuration Registers LDN=0x07 */
 #define WDTCTRL		0x71
 #define WDTCFG		0x72
@@ -236,6 +245,21 @@
 	return ret;
 }
 
+enum {
+	IT87_WDT_OUTPUT_THROUGH_PWRGD	= BIT(0),
+};
+
+static const struct dmi_system_id it87_quirks[] = {
+	{
+		/* Qotom Q30900P (IT8786) */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "QCML04"),
+		},
+		.driver_data = (void *)IT87_WDT_OUTPUT_THROUGH_PWRGD,
+	},
+	{}
+};
+
 static const struct watchdog_info ident = {
 	.options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING,
 	.firmware_version = 1,
@@ -257,8 +281,10 @@
 
 static int __init it87_wdt_init(void)
 {
+	const struct dmi_system_id *dmi_id;
 	u8  chip_rev;
 	u8 ctrl;
+	int quirks = 0;
 	int rc;
 
 	rc = superio_enter();
@@ -269,6 +295,10 @@
 	chip_rev  = superio_inb(CHIPREV) & 0x0f;
 	superio_exit();
 
+	dmi_id = dmi_first_match(it87_quirks);
+	if (dmi_id)
+		quirks = (long)dmi_id->driver_data;
+
 	switch (chip_type) {
 	case IT8702_ID:
 		max_units = 255;
@@ -329,6 +359,15 @@
 		superio_outb(0x00, WDTCTRL);
 	}
 
+	if (quirks & IT87_WDT_OUTPUT_THROUGH_PWRGD) {
+		superio_select(EC);
+		ctrl = superio_inb(SCR1);
+		if (!(ctrl & WDT_PWRGD)) {
+			ctrl |= WDT_PWRGD;
+			superio_outb(ctrl, SCR1);
+		}
+	}
+
 	superio_exit();
 
 	if (timeout < 1 || timeout > max_units * 60) {
--- linux-qcom-6.8.0.orig/drivers/watchdog/mtk_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/mtk_wdt.c
@@ -10,6 +10,7 @@
  */
 
 #include <dt-bindings/reset/mt2712-resets.h>
+#include <dt-bindings/reset/mediatek,mt6735-wdt.h>
 #include <dt-bindings/reset/mediatek,mt6795-resets.h>
 #include <dt-bindings/reset/mt7986-resets.h>
 #include <dt-bindings/reset/mt8183-resets.h>
@@ -87,6 +88,10 @@
 	.toprgu_sw_rst_num = MT2712_TOPRGU_SW_RST_NUM,
 };
 
+static const struct mtk_wdt_data mt6735_data = {
+	.toprgu_sw_rst_num = MT6735_TOPRGU_RST_NUM,
+};
+
 static const struct mtk_wdt_data mt6795_data = {
 	.toprgu_sw_rst_num = MT6795_TOPRGU_SW_RST_NUM,
 };
@@ -225,9 +230,15 @@
 {
 	struct mtk_wdt_dev *mtk_wdt = watchdog_get_drvdata(wdt_dev);
 	void __iomem *wdt_base;
+	u32 reg;
 
 	wdt_base = mtk_wdt->wdt_base;
 
+	/* Enable reset in order to issue a system reset instead of an IRQ */
+	reg = readl(wdt_base + WDT_MODE);
+	reg &= ~WDT_MODE_IRQ_EN;
+	writel(reg | WDT_MODE_KEY, wdt_base + WDT_MODE);
+
 	while (1) {
 		writel(WDT_SWRST_KEY, wdt_base + WDT_SWRST);
 		mdelay(5);
@@ -483,6 +494,7 @@
 static const struct of_device_id mtk_wdt_dt_ids[] = {
 	{ .compatible = "mediatek,mt2712-wdt", .data = &mt2712_data },
 	{ .compatible = "mediatek,mt6589-wdt" },
+	{ .compatible = "mediatek,mt6735-wdt", .data = &mt6735_data },
 	{ .compatible = "mediatek,mt6795-wdt", .data = &mt6795_data },
 	{ .compatible = "mediatek,mt7986-wdt", .data = &mt7986_data },
 	{ .compatible = "mediatek,mt7988-wdt", .data = &mt7988_data },
--- linux-qcom-6.8.0.orig/drivers/watchdog/rti_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/rti_wdt.c
@@ -59,7 +59,9 @@
 #define PON_REASON_EOF_NUM	0xCCCCBBBB
 #define RESERVED_MEM_MIN_SIZE	12
 
-static int heartbeat = DEFAULT_HEARTBEAT;
+#define MAX_HW_ERROR		250
+
+static int heartbeat;
 
 /*
  * struct to hold data for each WDT device
@@ -97,7 +99,7 @@
 	 * to be 50% or less than that; we obviouly want to configure the open
 	 * window as large as possible so we select the 50% option.
 	 */
-	wdd->min_hw_heartbeat_ms = 500 * wdd->timeout;
+	wdd->min_hw_heartbeat_ms = 520 * wdd->timeout + MAX_HW_ERROR;
 
 	/* Generate NMI when wdt expires */
 	writel_relaxed(RTIWWDRX_NMI, wdt->base + RTIWWDRXCTRL);
@@ -131,31 +133,33 @@
 	 * be petted during the open window; not too early or not too late.
 	 * The HW configuration options only allow for the open window size
 	 * to be 50% or less than that.
+	 * To avoid any glitches, we accommodate 2% + max hardware error
+	 * safety margin.
 	 */
 	switch (wsize) {
 	case RTIWWDSIZE_50P:
-		/* 50% open window => 50% min heartbeat */
-		wdd->min_hw_heartbeat_ms = 500 * heartbeat;
+		/* 50% open window => 52% min heartbeat */
+		wdd->min_hw_heartbeat_ms = 520 * heartbeat + MAX_HW_ERROR;
 		break;
 
 	case RTIWWDSIZE_25P:
-		/* 25% open window => 75% min heartbeat */
-		wdd->min_hw_heartbeat_ms = 750 * heartbeat;
+		/* 25% open window => 77% min heartbeat */
+		wdd->min_hw_heartbeat_ms = 770 * heartbeat + MAX_HW_ERROR;
 		break;
 
 	case RTIWWDSIZE_12P5:
-		/* 12.5% open window => 87.5% min heartbeat */
-		wdd->min_hw_heartbeat_ms = 875 * heartbeat;
+		/* 12.5% open window => 89.5% min heartbeat */
+		wdd->min_hw_heartbeat_ms = 895 * heartbeat + MAX_HW_ERROR;
 		break;
 
 	case RTIWWDSIZE_6P25:
-		/* 6.5% open window => 93.5% min heartbeat */
-		wdd->min_hw_heartbeat_ms = 935 * heartbeat;
+		/* 6.5% open window => 95.5% min heartbeat */
+		wdd->min_hw_heartbeat_ms = 955 * heartbeat + MAX_HW_ERROR;
 		break;
 
 	case RTIWWDSIZE_3P125:
-		/* 3.125% open window => 96.9% min heartbeat */
-		wdd->min_hw_heartbeat_ms = 969 * heartbeat;
+		/* 3.125% open window => 98.9% min heartbeat */
+		wdd->min_hw_heartbeat_ms = 989 * heartbeat + MAX_HW_ERROR;
 		break;
 
 	default:
@@ -233,14 +237,6 @@
 		return -EINVAL;
 	}
 
-	/*
-	 * If watchdog is running at 32k clock, it is not accurate.
-	 * Adjust frequency down in this case so that we don't pet
-	 * the watchdog too often.
-	 */
-	if (wdt->freq < 32768)
-		wdt->freq = wdt->freq * 9 / 10;
-
 	pm_runtime_enable(dev);
 	ret = pm_runtime_resume_and_get(dev);
 	if (ret < 0) {
@@ -256,6 +252,7 @@
 	wdd->min_timeout = 1;
 	wdd->max_hw_heartbeat_ms = (WDT_PRELOAD_MAX << WDT_PRELOAD_SHIFT) /
 		wdt->freq * 1000;
+	wdd->timeout = DEFAULT_HEARTBEAT;
 	wdd->parent = dev;
 
 	watchdog_set_drvdata(wdd, wdt);
--- linux-qcom-6.8.0.orig/drivers/watchdog/rzg2l_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/rzg2l_wdt.c
@@ -8,11 +8,11 @@
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/io.h>
-#include <linux/iopoll.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
+#include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
 #include <linux/reset.h>
 #include <linux/units.h>
@@ -54,35 +54,11 @@
 	struct reset_control *rstc;
 	unsigned long osc_clk_rate;
 	unsigned long delay;
-	unsigned long minimum_assertion_period;
 	struct clk *pclk;
 	struct clk *osc_clk;
 	enum rz_wdt_type devtype;
 };
 
-static int rzg2l_wdt_reset(struct rzg2l_wdt_priv *priv)
-{
-	int err, status;
-
-	if (priv->devtype == WDT_RZV2M) {
-		/* WDT needs TYPE-B reset control */
-		err = reset_control_assert(priv->rstc);
-		if (err)
-			return err;
-		ndelay(priv->minimum_assertion_period);
-		err = reset_control_deassert(priv->rstc);
-		if (err)
-			return err;
-		err = read_poll_timeout(reset_control_status, status,
-					status != 1, 0, 1000, false,
-					priv->rstc);
-	} else {
-		err = reset_control_reset(priv->rstc);
-	}
-
-	return err;
-}
-
 static void rzg2l_wdt_wait_delay(struct rzg2l_wdt_priv *priv)
 {
 	/* delay timer when change the setting register */
@@ -123,8 +99,17 @@
 static int rzg2l_wdt_start(struct watchdog_device *wdev)
 {
 	struct rzg2l_wdt_priv *priv = watchdog_get_drvdata(wdev);
+	int ret;
+
+	ret = pm_runtime_resume_and_get(wdev->parent);
+	if (ret)
+		return ret;
 
-	pm_runtime_get_sync(wdev->parent);
+	ret = reset_control_deassert(priv->rstc);
+	if (ret) {
+		pm_runtime_put(wdev->parent);
+		return ret;
+	}
 
 	/* Initialize time out */
 	rzg2l_wdt_init_timeout(wdev);
@@ -141,15 +126,23 @@
 static int rzg2l_wdt_stop(struct watchdog_device *wdev)
 {
 	struct rzg2l_wdt_priv *priv = watchdog_get_drvdata(wdev);
+	int ret;
 
-	rzg2l_wdt_reset(priv);
-	pm_runtime_put(wdev->parent);
+	ret = reset_control_assert(priv->rstc);
+	if (ret)
+		return ret;
+
+	ret = pm_runtime_put(wdev->parent);
+	if (ret < 0)
+		return ret;
 
 	return 0;
 }
 
 static int rzg2l_wdt_set_timeout(struct watchdog_device *wdev, unsigned int timeout)
 {
+	int ret = 0;
+
 	wdev->timeout = timeout;
 
 	/*
@@ -158,22 +151,44 @@
 	 * to reset the module) so that it is updated with new timeout values.
 	 */
 	if (watchdog_active(wdev)) {
-		rzg2l_wdt_stop(wdev);
-		rzg2l_wdt_start(wdev);
+		ret = rzg2l_wdt_stop(wdev);
+		if (ret)
+			return ret;
+
+		ret = rzg2l_wdt_start(wdev);
 	}
 
-	return 0;
+	return ret;
 }
 
 static int rzg2l_wdt_restart(struct watchdog_device *wdev,
 			     unsigned long action, void *data)
 {
 	struct rzg2l_wdt_priv *priv = watchdog_get_drvdata(wdev);
+	int ret;
 
-	clk_prepare_enable(priv->pclk);
-	clk_prepare_enable(priv->osc_clk);
+	/*
+	 * In case of RZ/G3S the watchdog device may be part of an IRQ safe power
+	 * domain that is currently powered off. In this case we need to power
+	 * it on before accessing registers. Along with this the clocks will be
+	 * enabled. We don't undo the pm_runtime_resume_and_get() as the device
+	 * need to be on for the reboot to happen.
+	 *
+	 * For the rest of SoCs not registering a watchdog IRQ safe power
+	 * domain it is safe to call pm_runtime_resume_and_get() as the
+	 * irq_safe_dev_in_sleep_domain() call in genpd_runtime_resume()
+	 * returns non zero value and the genpd_lock() is avoided, thus, there
+	 * will be no invalid wait context reported by lockdep.
+	 */
+	ret = pm_runtime_resume_and_get(wdev->parent);
+	if (ret)
+		return ret;
 
 	if (priv->devtype == WDT_RZG2L) {
+		ret = reset_control_deassert(priv->rstc);
+		if (ret)
+			return ret;
+
 		/* Generate Reset (WDTRSTB) Signal on parity error */
 		rzg2l_wdt_write(priv, 0, PECR);
 
@@ -181,7 +196,9 @@
 		rzg2l_wdt_write(priv, PEEN_FORCE, PEEN);
 	} else {
 		/* RZ/V2M doesn't have parity error registers */
-		rzg2l_wdt_reset(priv);
+		ret = reset_control_reset(priv->rstc);
+		if (ret)
+			return ret;
 
 		wdev->timeout = 0;
 
@@ -224,13 +241,11 @@
 	.restart = rzg2l_wdt_restart,
 };
 
-static void rzg2l_wdt_reset_assert_pm_disable(void *data)
+static void rzg2l_wdt_pm_disable(void *data)
 {
 	struct watchdog_device *wdev = data;
-	struct rzg2l_wdt_priv *priv = watchdog_get_drvdata(wdev);
 
 	pm_runtime_disable(wdev->parent);
-	reset_control_assert(priv->rstc);
 }
 
 static int rzg2l_wdt_probe(struct platform_device *pdev)
@@ -273,19 +288,9 @@
 		return dev_err_probe(&pdev->dev, PTR_ERR(priv->rstc),
 				     "failed to get cpg reset");
 
-	ret = reset_control_deassert(priv->rstc);
-	if (ret)
-		return dev_err_probe(dev, ret, "failed to deassert");
-
 	priv->devtype = (uintptr_t)of_device_get_match_data(dev);
 
-	if (priv->devtype == WDT_RZV2M) {
-		priv->minimum_assertion_period = RZV2M_A_NSEC +
-			3 * F2CYCLE_NSEC(pclk_rate) + 5 *
-			max(F2CYCLE_NSEC(priv->osc_clk_rate),
-			    F2CYCLE_NSEC(pclk_rate));
-	}
-
+	pm_runtime_irq_safe(&pdev->dev);
 	pm_runtime_enable(&pdev->dev);
 
 	priv->wdev.info = &rzg2l_wdt_ident;
@@ -297,9 +302,7 @@
 	priv->wdev.timeout = WDT_DEFAULT_TIMEOUT;
 
 	watchdog_set_drvdata(&priv->wdev, priv);
-	ret = devm_add_action_or_reset(&pdev->dev,
-				       rzg2l_wdt_reset_assert_pm_disable,
-				       &priv->wdev);
+	ret = devm_add_action_or_reset(&pdev->dev, rzg2l_wdt_pm_disable, &priv->wdev);
 	if (ret < 0)
 		return ret;
 
--- linux-qcom-6.8.0.orig/drivers/watchdog/sa1100_wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/sa1100_wdt.c
@@ -191,9 +191,8 @@
 	if (!res)
 		return -ENXIO;
 	reg_base = devm_ioremap(&pdev->dev, res->start, resource_size(res));
-	ret = PTR_ERR_OR_ZERO(reg_base);
-	if (ret)
-		return ret;
+	if (!reg_base)
+		return -ENOMEM;
 
 	clk = clk_get(NULL, "OSTIMER0");
 	if (IS_ERR(clk)) {
--- linux-qcom-6.8.0.orig/drivers/watchdog/starfive-wdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/starfive-wdt.c
@@ -494,8 +494,13 @@
 	if (ret)
 		goto err_exit;
 
-	if (!early_enable)
-		pm_runtime_put_sync(&pdev->dev);
+	if (!early_enable) {
+		if (pm_runtime_enabled(&pdev->dev)) {
+			ret = pm_runtime_put_sync(&pdev->dev);
+			if (ret)
+				goto err_exit;
+		}
+	}
 
 	return 0;
 
--- linux-qcom-6.8.0.orig/drivers/watchdog/stm32_iwdg.c
+++ linux-qcom-6.8.0/drivers/watchdog/stm32_iwdg.c
@@ -20,6 +20,8 @@
 #include <linux/platform_device.h>
 #include <linux/watchdog.h>
 
+#define DEFAULT_TIMEOUT 10
+
 /* IWDG registers */
 #define IWDG_KR		0x00 /* Key register */
 #define IWDG_PR		0x04 /* Prescaler Register */
@@ -248,6 +250,7 @@
 	wdd->parent = dev;
 	wdd->info = &stm32_iwdg_info;
 	wdd->ops = &stm32_iwdg_ops;
+	wdd->timeout = DEFAULT_TIMEOUT;
 	wdd->min_timeout = DIV_ROUND_UP((RLR_MIN + 1) * PR_MIN, wdt->rate);
 	wdd->max_hw_heartbeat_ms = ((RLR_MAX + 1) * wdt->data->max_prescaler *
 				    1000) / wdt->rate;
--- linux-qcom-6.8.0.orig/drivers/watchdog/xilinx_wwdt.c
+++ linux-qcom-6.8.0/drivers/watchdog/xilinx_wwdt.c
@@ -2,7 +2,7 @@
 /*
  * Window watchdog device driver for Xilinx Versal WWDT
  *
- * Copyright (C) 2022 - 2023, Advanced Micro Devices, Inc.
+ * Copyright (C) 2022 - 2024, Advanced Micro Devices, Inc.
  */
 
 #include <linux/clk.h>
@@ -36,6 +36,12 @@
 
 #define XWWDT_CLOSE_WINDOW_PERCENT	50
 
+/* Maximum count value of each 32 bit window */
+#define XWWDT_MAX_COUNT_WINDOW		GENMASK(31, 0)
+
+/* Maximum count value of closed and open window combined */
+#define XWWDT_MAX_COUNT_WINDOW_COMBINED	GENMASK_ULL(32, 1)
+
 static int wwdt_timeout;
 static int closed_window_percent;
 
@@ -54,6 +60,8 @@
  * @xilinx_wwdt_wdd: watchdog device structure
  * @freq: source clock frequency of WWDT
  * @close_percent: Closed window percent
+ * @closed_timeout: Closed window timeout in ticks
+ * @open_timeout: Open window timeout in ticks
  */
 struct xwwdt_device {
 	void __iomem *base;
@@ -61,27 +69,22 @@
 	struct watchdog_device xilinx_wwdt_wdd;
 	unsigned long freq;
 	u32 close_percent;
+	u64 closed_timeout;
+	u64 open_timeout;
 };
 
 static int xilinx_wwdt_start(struct watchdog_device *wdd)
 {
 	struct xwwdt_device *xdev = watchdog_get_drvdata(wdd);
 	struct watchdog_device *xilinx_wwdt_wdd = &xdev->xilinx_wwdt_wdd;
-	u64 time_out, closed_timeout, open_timeout;
 	u32 control_status_reg;
 
-	/* Calculate timeout count */
-	time_out = xdev->freq * wdd->timeout;
-	closed_timeout = div_u64(time_out * xdev->close_percent, 100);
-	open_timeout = time_out - closed_timeout;
-	wdd->min_hw_heartbeat_ms = xdev->close_percent * 10 * wdd->timeout;
-
 	spin_lock(&xdev->spinlock);
 
 	iowrite32(XWWDT_MWR_MASK, xdev->base + XWWDT_MWR_OFFSET);
 	iowrite32(~(u32)XWWDT_ESR_WEN_MASK, xdev->base + XWWDT_ESR_OFFSET);
-	iowrite32((u32)closed_timeout, xdev->base + XWWDT_FWR_OFFSET);
-	iowrite32((u32)open_timeout, xdev->base + XWWDT_SWR_OFFSET);
+	iowrite32((u32)xdev->closed_timeout, xdev->base + XWWDT_FWR_OFFSET);
+	iowrite32((u32)xdev->open_timeout, xdev->base + XWWDT_SWR_OFFSET);
 
 	/* Enable the window watchdog timer */
 	control_status_reg = ioread32(xdev->base + XWWDT_ESR_OFFSET);
@@ -133,7 +136,12 @@
 	struct watchdog_device *xilinx_wwdt_wdd;
 	struct device *dev = &pdev->dev;
 	struct xwwdt_device *xdev;
+	u64 max_per_window_ms;
+	u64 min_per_window_ms;
+	u64 timeout_count;
 	struct clk *clk;
+	u32 timeout_ms;
+	u64 ms_count;
 	int ret;
 
 	xdev = devm_kzalloc(dev, sizeof(*xdev), GFP_KERNEL);
@@ -154,12 +162,13 @@
 		return PTR_ERR(clk);
 
 	xdev->freq = clk_get_rate(clk);
-	if (!xdev->freq)
+	if (xdev->freq < 1000000)
 		return -EINVAL;
 
 	xilinx_wwdt_wdd->min_timeout = XWWDT_MIN_TIMEOUT;
 	xilinx_wwdt_wdd->timeout = XWWDT_DEFAULT_TIMEOUT;
-	xilinx_wwdt_wdd->max_hw_heartbeat_ms = 1000 * xilinx_wwdt_wdd->timeout;
+	xilinx_wwdt_wdd->max_hw_heartbeat_ms =
+		div64_u64(XWWDT_MAX_COUNT_WINDOW_COMBINED, xdev->freq) * 1000;
 
 	if (closed_window_percent == 0 || closed_window_percent >= 100)
 		xdev->close_percent = XWWDT_CLOSE_WINDOW_PERCENT;
@@ -167,6 +176,48 @@
 		xdev->close_percent = closed_window_percent;
 
 	watchdog_init_timeout(xilinx_wwdt_wdd, wwdt_timeout, &pdev->dev);
+
+	/* Calculate ticks for 1 milli-second */
+	ms_count = div_u64(xdev->freq, 1000);
+	timeout_ms = xilinx_wwdt_wdd->timeout * 1000;
+	timeout_count = timeout_ms * ms_count;
+
+	if (timeout_ms > xilinx_wwdt_wdd->max_hw_heartbeat_ms) {
+		/*
+		 * To avoid ping restrictions until the minimum hardware heartbeat,
+		 * we will solely rely on the open window and
+		 * adjust the minimum hardware heartbeat to 0.
+		 */
+		xdev->closed_timeout = 0;
+		xdev->open_timeout = XWWDT_MAX_COUNT_WINDOW;
+		xilinx_wwdt_wdd->min_hw_heartbeat_ms = 0;
+		xilinx_wwdt_wdd->max_hw_heartbeat_ms = xilinx_wwdt_wdd->max_hw_heartbeat_ms / 2;
+	} else {
+		xdev->closed_timeout  = div64_u64(timeout_count * xdev->close_percent, 100);
+		xilinx_wwdt_wdd->min_hw_heartbeat_ms =
+			div64_u64(timeout_ms * xdev->close_percent, 100);
+
+		if (timeout_ms > xilinx_wwdt_wdd->max_hw_heartbeat_ms / 2) {
+			max_per_window_ms = xilinx_wwdt_wdd->max_hw_heartbeat_ms / 2;
+			min_per_window_ms = timeout_ms - max_per_window_ms;
+
+			if (xilinx_wwdt_wdd->min_hw_heartbeat_ms > max_per_window_ms) {
+				dev_info(xilinx_wwdt_wdd->parent,
+					 "Closed window cannot be set to %d%%. Using maximum supported value.\n",
+					xdev->close_percent);
+				xdev->closed_timeout = max_per_window_ms * ms_count;
+				xilinx_wwdt_wdd->min_hw_heartbeat_ms = max_per_window_ms;
+			} else if (xilinx_wwdt_wdd->min_hw_heartbeat_ms < min_per_window_ms) {
+				dev_info(xilinx_wwdt_wdd->parent,
+					 "Closed window cannot be set to %d%%. Using minimum supported value.\n",
+					xdev->close_percent);
+				xdev->closed_timeout = min_per_window_ms * ms_count;
+				xilinx_wwdt_wdd->min_hw_heartbeat_ms = min_per_window_ms;
+			}
+		}
+		xdev->open_timeout = timeout_count - xdev->closed_timeout;
+	}
+
 	spin_lock_init(&xdev->spinlock);
 	watchdog_set_drvdata(xilinx_wwdt_wdd, xdev);
 	watchdog_set_nowayout(xilinx_wwdt_wdd, 1);
--- linux-qcom-6.8.0.orig/drivers/xen/balloon.c
+++ linux-qcom-6.8.0/drivers/xen/balloon.c
@@ -672,7 +672,6 @@
 
 static void __init balloon_add_regions(void)
 {
-#if defined(CONFIG_XEN_PV)
 	unsigned long start_pfn, pages;
 	unsigned long pfn, extra_pfn_end;
 	unsigned int i;
@@ -696,7 +695,6 @@
 
 		balloon_stats.total_pages += extra_pfn_end - start_pfn;
 	}
-#endif
 }
 
 static int __init balloon_init(void)
--- linux-qcom-6.8.0.orig/drivers/xen/events/events_base.c
+++ linux-qcom-6.8.0/drivers/xen/events/events_base.c
@@ -1190,7 +1190,7 @@
 EXPORT_SYMBOL_GPL(xen_pirq_from_irq);
 
 static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip,
-				   struct xenbus_device *dev)
+				   struct xenbus_device *dev, bool shared)
 {
 	int ret = -ENOMEM;
 	struct irq_info *info;
@@ -1224,7 +1224,8 @@
 		 */
 		bind_evtchn_to_cpu(info, 0, false);
 	} else if (!WARN_ON(info->type != IRQT_EVTCHN)) {
-		info->refcnt++;
+		if (shared && !WARN_ON(info->refcnt < 0))
+			info->refcnt++;
 	}
 
 	ret = info->irq;
@@ -1237,13 +1238,13 @@
 
 int bind_evtchn_to_irq(evtchn_port_t evtchn)
 {
-	return bind_evtchn_to_irq_chip(evtchn, &xen_dynamic_chip, NULL);
+	return bind_evtchn_to_irq_chip(evtchn, &xen_dynamic_chip, NULL, false);
 }
 EXPORT_SYMBOL_GPL(bind_evtchn_to_irq);
 
 int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn)
 {
-	return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip, NULL);
+	return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip, NULL, false);
 }
 EXPORT_SYMBOL_GPL(bind_evtchn_to_irq_lateeoi);
 
@@ -1295,7 +1296,8 @@
 
 static int bind_interdomain_evtchn_to_irq_chip(struct xenbus_device *dev,
 					       evtchn_port_t remote_port,
-					       struct irq_chip *chip)
+					       struct irq_chip *chip,
+					       bool shared)
 {
 	struct evtchn_bind_interdomain bind_interdomain;
 	int err;
@@ -1307,14 +1309,14 @@
 					  &bind_interdomain);
 
 	return err ? : bind_evtchn_to_irq_chip(bind_interdomain.local_port,
-					       chip, dev);
+					       chip, dev, shared);
 }
 
 int bind_interdomain_evtchn_to_irq_lateeoi(struct xenbus_device *dev,
 					   evtchn_port_t remote_port)
 {
 	return bind_interdomain_evtchn_to_irq_chip(dev, remote_port,
-						   &xen_lateeoi_chip);
+						   &xen_lateeoi_chip, false);
 }
 EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi);
 
@@ -1430,7 +1432,8 @@
 {
 	int irq, retval;
 
-	irq = bind_evtchn_to_irq_chip(evtchn, chip, NULL);
+	irq = bind_evtchn_to_irq_chip(evtchn, chip, NULL,
+				      irqflags & IRQF_SHARED);
 	if (irq < 0)
 		return irq;
 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
@@ -1471,7 +1474,8 @@
 {
 	int irq, retval;
 
-	irq = bind_interdomain_evtchn_to_irq_chip(dev, remote_port, chip);
+	irq = bind_interdomain_evtchn_to_irq_chip(dev, remote_port, chip,
+						  irqflags & IRQF_SHARED);
 	if (irq < 0)
 		return irq;
 
--- linux-qcom-6.8.0.orig/drivers/xen/evtchn.c
+++ linux-qcom-6.8.0/drivers/xen/evtchn.c
@@ -85,6 +85,7 @@
 	struct per_user_data *user;
 	evtchn_port_t port;
 	bool enabled;
+	bool unbinding;
 };
 
 static void evtchn_free_ring(evtchn_port_t *ring)
@@ -164,6 +165,10 @@
 	struct per_user_data *u = evtchn->user;
 	unsigned int prod, cons;
 
+	/* Handler might be called when tearing down the IRQ. */
+	if (evtchn->unbinding)
+		return IRQ_HANDLED;
+
 	WARN(!evtchn->enabled,
 	     "Interrupt for port %u, but apparently not enabled; per-user %p\n",
 	     evtchn->port, u);
@@ -421,6 +426,7 @@
 
 	BUG_ON(irq < 0);
 
+	evtchn->unbinding = true;
 	unbind_from_irqhandler(irq, evtchn);
 
 	del_evtchn(u, evtchn);
--- linux-qcom-6.8.0.orig/drivers/xen/privcmd.c
+++ linux-qcom-6.8.0/drivers/xen/privcmd.c
@@ -17,6 +17,7 @@
 #include <linux/poll.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
+#include <linux/srcu.h>
 #include <linux/string.h>
 #include <linux/workqueue.h>
 #include <linux/errno.h>
@@ -845,7 +846,8 @@
 #ifdef CONFIG_XEN_PRIVCMD_EVENTFD
 /* Irqfd support */
 static struct workqueue_struct *irqfd_cleanup_wq;
-static DEFINE_MUTEX(irqfds_lock);
+static DEFINE_SPINLOCK(irqfds_lock);
+DEFINE_STATIC_SRCU(irqfds_srcu);
 static LIST_HEAD(irqfds_list);
 
 struct privcmd_kernel_irqfd {
@@ -873,6 +875,9 @@
 		container_of(work, struct privcmd_kernel_irqfd, shutdown);
 	u64 cnt;
 
+	/* Make sure irqfd has been initialized in assign path */
+	synchronize_srcu(&irqfds_srcu);
+
 	eventfd_ctx_remove_wait_queue(kirqfd->eventfd, &kirqfd->wait, &cnt);
 	eventfd_ctx_put(kirqfd->eventfd);
 	kfree(kirqfd);
@@ -909,9 +914,11 @@
 		irqfd_inject(kirqfd);
 
 	if (flags & EPOLLHUP) {
-		mutex_lock(&irqfds_lock);
+		unsigned long flags;
+
+		spin_lock_irqsave(&irqfds_lock, flags);
 		irqfd_deactivate(kirqfd);
-		mutex_unlock(&irqfds_lock);
+		spin_unlock_irqrestore(&irqfds_lock, flags);
 	}
 
 	return 0;
@@ -929,10 +936,11 @@
 static int privcmd_irqfd_assign(struct privcmd_irqfd *irqfd)
 {
 	struct privcmd_kernel_irqfd *kirqfd, *tmp;
+	unsigned long flags;
 	__poll_t events;
 	struct fd f;
 	void *dm_op;
-	int ret;
+	int ret, idx;
 
 	kirqfd = kzalloc(sizeof(*kirqfd) + irqfd->size, GFP_KERNEL);
 	if (!kirqfd)
@@ -968,18 +976,19 @@
 	init_waitqueue_func_entry(&kirqfd->wait, irqfd_wakeup);
 	init_poll_funcptr(&kirqfd->pt, irqfd_poll_func);
 
-	mutex_lock(&irqfds_lock);
+	spin_lock_irqsave(&irqfds_lock, flags);
 
 	list_for_each_entry(tmp, &irqfds_list, list) {
 		if (kirqfd->eventfd == tmp->eventfd) {
 			ret = -EBUSY;
-			mutex_unlock(&irqfds_lock);
+			spin_unlock_irqrestore(&irqfds_lock, flags);
 			goto error_eventfd;
 		}
 	}
 
+	idx = srcu_read_lock(&irqfds_srcu);
 	list_add_tail(&kirqfd->list, &irqfds_list);
-	mutex_unlock(&irqfds_lock);
+	spin_unlock_irqrestore(&irqfds_lock, flags);
 
 	/*
 	 * Check if there was an event already pending on the eventfd before we
@@ -989,6 +998,8 @@
 	if (events & EPOLLIN)
 		irqfd_inject(kirqfd);
 
+	srcu_read_unlock(&irqfds_srcu, idx);
+
 	/*
 	 * Do not drop the file until the kirqfd is fully initialized, otherwise
 	 * we might race against the EPOLLHUP.
@@ -1011,12 +1022,13 @@
 {
 	struct privcmd_kernel_irqfd *kirqfd;
 	struct eventfd_ctx *eventfd;
+	unsigned long flags;
 
 	eventfd = eventfd_ctx_fdget(irqfd->fd);
 	if (IS_ERR(eventfd))
 		return PTR_ERR(eventfd);
 
-	mutex_lock(&irqfds_lock);
+	spin_lock_irqsave(&irqfds_lock, flags);
 
 	list_for_each_entry(kirqfd, &irqfds_list, list) {
 		if (kirqfd->eventfd == eventfd) {
@@ -1025,7 +1037,7 @@
 		}
 	}
 
-	mutex_unlock(&irqfds_lock);
+	spin_unlock_irqrestore(&irqfds_lock, flags);
 
 	eventfd_ctx_put(eventfd);
 
@@ -1073,13 +1085,14 @@
 static void privcmd_irqfd_exit(void)
 {
 	struct privcmd_kernel_irqfd *kirqfd, *tmp;
+	unsigned long flags;
 
-	mutex_lock(&irqfds_lock);
+	spin_lock_irqsave(&irqfds_lock, flags);
 
 	list_for_each_entry_safe(kirqfd, tmp, &irqfds_list, list)
 		irqfd_deactivate(kirqfd);
 
-	mutex_unlock(&irqfds_lock);
+	spin_unlock_irqrestore(&irqfds_lock, flags);
 
 	destroy_workqueue(irqfd_cleanup_wq);
 }
--- linux-qcom-6.8.0.orig/drivers/xen/swiotlb-xen.c
+++ linux-qcom-6.8.0/drivers/xen/swiotlb-xen.c
@@ -78,9 +78,15 @@
 {
 	unsigned long next_bfn, xen_pfn = XEN_PFN_DOWN(p);
 	unsigned int i, nr_pages = XEN_PFN_UP(xen_offset_in_page(p) + size);
+	phys_addr_t algn = 1ULL << (get_order(size) + PAGE_SHIFT);
 
 	next_bfn = pfn_to_bfn(xen_pfn);
 
+	/* If buffer is physically aligned, ensure DMA alignment. */
+	if (IS_ALIGNED(p, algn) &&
+	    !IS_ALIGNED((phys_addr_t)next_bfn << XEN_PAGE_SHIFT, algn))
+		return 1;
+
 	for (i = 1; i < nr_pages; i++)
 		if (pfn_to_bfn(++xen_pfn) != ++next_bfn)
 			return 1;
@@ -140,7 +146,7 @@
 	void *ret;
 
 	/* Align the allocation to the Xen page size */
-	size = 1UL << (order + XEN_PAGE_SHIFT);
+	size = ALIGN(size, XEN_PAGE_SIZE);
 
 	ret = (void *)__get_free_pages(flags, get_order(size));
 	if (!ret)
@@ -172,7 +178,7 @@
 	int order = get_order(size);
 
 	/* Convert the size to actually allocated. */
-	size = 1UL << (order + XEN_PAGE_SHIFT);
+	size = ALIGN(size, XEN_PAGE_SIZE);
 
 	if (WARN_ON_ONCE(dma_handle + size - 1 > dev->coherent_dma_mask) ||
 	    WARN_ON_ONCE(range_straddles_page_boundary(phys, size)))
--- linux-qcom-6.8.0.orig/drivers/xen/xenbus/xenbus_probe.c
+++ linux-qcom-6.8.0/drivers/xen/xenbus/xenbus_probe.c
@@ -65,13 +65,17 @@
 #include "xenbus.h"
 
 
-static int xs_init_irq;
+static int xs_init_irq = -1;
 int xen_store_evtchn;
 EXPORT_SYMBOL_GPL(xen_store_evtchn);
 
 struct xenstore_domain_interface *xen_store_interface;
 EXPORT_SYMBOL_GPL(xen_store_interface);
 
+#define XS_INTERFACE_READY \
+	((xen_store_interface != NULL) && \
+	 (xen_store_interface->connection == XENSTORE_CONNECTED))
+
 enum xenstore_init xen_store_domain_type;
 EXPORT_SYMBOL_GPL(xen_store_domain_type);
 
@@ -309,7 +313,7 @@
 	if (err) {
 		dev_warn(&dev->dev, "watch_otherend on %s failed.\n",
 		       dev->nodename);
-		return err;
+		goto fail_remove;
 	}
 
 	dev->spurious_threshold = 1;
@@ -318,6 +322,12 @@
 			 dev->nodename);
 
 	return 0;
+fail_remove:
+	if (drv->remove) {
+		down(&dev->reclaim_sem);
+		drv->remove(dev);
+		up(&dev->reclaim_sem);
+	}
 fail_put:
 	module_put(drv->driver.owner);
 fail:
@@ -751,19 +761,19 @@
 {
 	xenstored_ready = 1;
 
-	if (!xen_store_interface) {
+	if (!xen_store_interface)
 		xen_store_interface = memremap(xen_store_gfn << XEN_PAGE_SHIFT,
 					       XEN_PAGE_SIZE, MEMREMAP_WB);
-		/*
-		 * Now it is safe to free the IRQ used for xenstore late
-		 * initialization. No need to unbind: it is about to be
-		 * bound again from xb_init_comms. Note that calling
-		 * unbind_from_irqhandler now would result in xen_evtchn_close()
-		 * being called and the event channel not being enabled again
-		 * afterwards, resulting in missed event notifications.
-		 */
+	/*
+	 * Now it is safe to free the IRQ used for xenstore late
+	 * initialization. No need to unbind: it is about to be
+	 * bound again from xb_init_comms. Note that calling
+	 * unbind_from_irqhandler now would result in xen_evtchn_close()
+	 * being called and the event channel not being enabled again
+	 * afterwards, resulting in missed event notifications.
+	 */
+	if (xs_init_irq >= 0)
 		free_irq(xs_init_irq, &xb_waitq);
-	}
 
 	/*
 	 * In the HVM case, xenbus_init() deferred its call to
@@ -822,7 +832,7 @@
 	if (xen_store_domain_type == XS_PV ||
 	    (xen_store_domain_type == XS_HVM &&
 	     !xs_hvm_defer_init_for_callback() &&
-	     xen_store_interface != NULL))
+	     XS_INTERFACE_READY))
 		xenbus_probe();
 
 	/*
@@ -831,7 +841,7 @@
 	 * started, then probe.  It will be triggered when communication
 	 * starts happening, by waiting on xb_waitq.
 	 */
-	if (xen_store_domain_type == XS_LOCAL || xen_store_interface == NULL) {
+	if (xen_store_domain_type == XS_LOCAL || !XS_INTERFACE_READY) {
 		struct task_struct *probe_task;
 
 		probe_task = kthread_run(xenbus_probe_thread, NULL,
@@ -1014,6 +1024,12 @@
 			xen_store_interface =
 				memremap(xen_store_gfn << XEN_PAGE_SHIFT,
 					 XEN_PAGE_SIZE, MEMREMAP_WB);
+			if (!xen_store_interface) {
+				pr_err("%s: cannot map HVM_PARAM_STORE_PFN=%llx\n",
+				       __func__, v);
+				err = -EINVAL;
+				goto out_error;
+			}
 			if (xen_store_interface->connection != XENSTORE_CONNECTED)
 				wait = true;
 		}
--- linux-qcom-6.8.0.orig/dropped.txt
+++ linux-qcom-6.8.0/dropped.txt
@@ -0,0 +1,11 @@
+Driver-related patches (dropped at every major release if they are not yet upstream):
+ - UBUNTU: SAUCE: Revert "fbdev: Make registered_fb[] private to fbmem.c" (required by nvidia, plan was to drop in newer kernels)
+
+Ubuntu-specific features not supported anymore:
+ - UBUNTU: SAUCE: shiftfs: deprecated
+ - UBUNTU: SAUCE: ubuntu fan: deprecated
+
+Retpoline annotations reverted after enforcing objtool warnings as fatal (LP: #2046440):
+ - UBUNTU: SAUCE: apm -- annotate indirect calls within firmware_restrict_branch_speculation_{start,end}
+ - UBUNTU: SAUCE: early/late -- annotate indirect calls in early/late initialisation code
+ - UBUNTU: SAUCE: vga_set_mode -- avoid jump tables
--- linux-qcom-6.8.0.orig/fs/9p/fid.c
+++ linux-qcom-6.8.0/fs/9p/fid.c
@@ -131,10 +131,9 @@
 			}
 		}
 		spin_unlock(&dentry->d_lock);
-	} else {
-		if (dentry->d_inode)
-			ret = v9fs_fid_find_inode(dentry->d_inode, false, uid, any);
 	}
+	if (!ret && dentry->d_inode)
+		ret = v9fs_fid_find_inode(dentry->d_inode, false, uid, any);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/fs/9p/fid.h
+++ linux-qcom-6.8.0/fs/9p/fid.h
@@ -49,9 +49,6 @@
 static inline void v9fs_fid_add_modes(struct p9_fid *fid, unsigned int s_flags,
 	unsigned int s_cache, unsigned int f_flags)
 {
-	if (fid->qid.type != P9_QTFILE)
-		return;
-
 	if ((!s_cache) ||
 	   ((fid->qid.version == 0) && !(s_flags & V9FS_IGNORE_QV)) ||
 	   (s_flags & V9FS_DIRECT_IO) || (f_flags & O_DIRECT)) {
--- linux-qcom-6.8.0.orig/fs/9p/vfs_dentry.c
+++ linux-qcom-6.8.0/fs/9p/vfs_dentry.c
@@ -48,12 +48,17 @@
 static void v9fs_dentry_release(struct dentry *dentry)
 {
 	struct hlist_node *p, *n;
+	struct hlist_head head;
 
 	p9_debug(P9_DEBUG_VFS, " dentry: %pd (%p)\n",
 		 dentry, dentry);
-	hlist_for_each_safe(p, n, (struct hlist_head *)&dentry->d_fsdata)
+
+	spin_lock(&dentry->d_lock);
+	hlist_move_list((struct hlist_head *)&dentry->d_fsdata, &head);
+	spin_unlock(&dentry->d_lock);
+
+	hlist_for_each_safe(p, n, &head)
 		p9_fid_put(hlist_entry(p, struct p9_fid, dlist));
-	dentry->d_fsdata = NULL;
 }
 
 static int v9fs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
--- linux-qcom-6.8.0.orig/fs/9p/vfs_file.c
+++ linux-qcom-6.8.0/fs/9p/vfs_file.c
@@ -520,6 +520,7 @@
 	.splice_read = v9fs_file_splice_read,
 	.splice_write = iter_file_splice_write,
 	.fsync = v9fs_file_fsync,
+	.setlease = simple_nosetlease,
 };
 
 const struct file_operations v9fs_file_operations_dotl = {
@@ -534,4 +535,5 @@
 	.splice_read = v9fs_file_splice_read,
 	.splice_write = iter_file_splice_write,
 	.fsync = v9fs_file_fsync_dotl,
+	.setlease = simple_nosetlease,
 };
--- linux-qcom-6.8.0.orig/fs/9p/vfs_inode.c
+++ linux-qcom-6.8.0/fs/9p/vfs_inode.c
@@ -83,7 +83,7 @@
 	int res;
 	int mode = stat->mode;
 
-	res = mode & S_IALLUGO;
+	res = mode & 0777; /* S_IRWXUGO */
 	if (v9fs_proto_dotu(v9ses)) {
 		if ((mode & P9_DMSETUID) == P9_DMSETUID)
 			res |= S_ISUID;
@@ -178,6 +178,9 @@
 		break;
 	}
 
+	if (uflags & O_TRUNC)
+		ret |= P9_OTRUNC;
+
 	if (extended) {
 		if (uflags & O_EXCL)
 			ret |= P9_OEXCL;
@@ -371,17 +374,21 @@
 	struct v9fs_inode __maybe_unused *v9inode = V9FS_I(inode);
 	__le32 __maybe_unused version;
 
-	truncate_inode_pages_final(&inode->i_data);
+	if (!is_bad_inode(inode)) {
+		truncate_inode_pages_final(&inode->i_data);
 
-	version = cpu_to_le32(v9inode->qid.version);
-	netfs_clear_inode_writeback(inode, &version);
+		version = cpu_to_le32(v9inode->qid.version);
+		netfs_clear_inode_writeback(inode, &version);
 
-	clear_inode(inode);
-	filemap_fdatawrite(&inode->i_data);
+		clear_inode(inode);
+		filemap_fdatawrite(&inode->i_data);
 
 #ifdef CONFIG_9P_FSCACHE
-	fscache_relinquish_cookie(v9fs_inode_cookie(v9inode), false);
+		if (v9fs_inode_cookie(v9inode))
+			fscache_relinquish_cookie(v9fs_inode_cookie(v9inode), false);
 #endif
+	} else
+		clear_inode(inode);
 }
 
 static int v9fs_test_inode(struct inode *inode, void *data)
@@ -1145,8 +1152,6 @@
 	struct v9fs_session_info *v9ses = sb->s_fs_info;
 	struct v9fs_inode *v9inode = V9FS_I(inode);
 
-	set_nlink(inode, 1);
-
 	inode_set_atime(inode, stat->atime, 0);
 	inode_set_mtime(inode, stat->mtime, 0);
 	inode_set_ctime(inode, stat->mtime, 0);
--- linux-qcom-6.8.0.orig/fs/9p/vfs_super.c
+++ linux-qcom-6.8.0/fs/9p/vfs_super.c
@@ -310,6 +310,7 @@
 	.alloc_inode = v9fs_alloc_inode,
 	.free_inode = v9fs_free_inode,
 	.statfs = simple_statfs,
+	.drop_inode = v9fs_drop_inode,
 	.evict_inode = v9fs_evict_inode,
 	.show_options = v9fs_show_options,
 	.umount_begin = v9fs_umount_begin,
--- linux-qcom-6.8.0.orig/fs/Kconfig
+++ linux-qcom-6.8.0/fs/Kconfig
@@ -289,6 +289,10 @@
 	depends on ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
 	depends on SPARSEMEM_VMEMMAP
 
+config HUGETLB_PMD_PAGE_TABLE_SHARING
+	def_bool HUGETLB_PAGE
+	depends on ARCH_WANT_HUGE_PMD_SHARE && SPLIT_PMD_PTLOCKS
+
 config ARCH_HAS_GIGANTIC_PAGE
 	bool
 
--- linux-qcom-6.8.0.orig/fs/afs/addr_prefs.c
+++ linux-qcom-6.8.0/fs/afs/addr_prefs.c
@@ -413,8 +413,10 @@
 
 	do {
 		argc = afs_split_string(&buf, argv, ARRAY_SIZE(argv));
-		if (argc < 0)
-			return argc;
+		if (argc < 0) {
+			ret = argc;
+			goto done;
+		}
 		if (argc < 2)
 			goto inval;
 
--- linux-qcom-6.8.0.orig/fs/afs/afs.h
+++ linux-qcom-6.8.0/fs/afs/afs.h
@@ -10,7 +10,7 @@
 
 #include <linux/in.h>
 
-#define AFS_MAXCELLNAME		256  	/* Maximum length of a cell name */
+#define AFS_MAXCELLNAME		253  	/* Maximum length of a cell name (DNS limited) */
 #define AFS_MAXVOLNAME		64  	/* Maximum length of a volume name */
 #define AFS_MAXNSERVERS		8   	/* Maximum servers in a basic volume record */
 #define AFS_NMAXNSERVERS	13  	/* Maximum servers in a N/U-class volume record */
--- linux-qcom-6.8.0.orig/fs/afs/afs_vl.h
+++ linux-qcom-6.8.0/fs/afs/afs_vl.h
@@ -13,6 +13,7 @@
 #define AFS_VL_PORT		7003	/* volume location service port */
 #define VL_SERVICE		52	/* RxRPC service ID for the Volume Location service */
 #define YFS_VL_SERVICE		2503	/* Service ID for AuriStor upgraded VL service */
+#define YFS_VL_MAXCELLNAME	256  	/* Maximum length of a cell name in YFS protocol */
 
 enum AFSVL_Operations {
 	VLGETENTRYBYID		= 503,	/* AFS Get VLDB entry by ID */
--- linux-qcom-6.8.0.orig/fs/afs/dir.c
+++ linux-qcom-6.8.0/fs/afs/dir.c
@@ -12,6 +12,7 @@
 #include <linux/swap.h>
 #include <linux/ctype.h>
 #include <linux/sched.h>
+#include <linux/iversion.h>
 #include <linux/task_io_accounting_ops.h>
 #include "internal.h"
 #include "afs_fs.h"
@@ -474,16 +475,6 @@
 			continue;
 		}
 
-		/* Don't expose silly rename entries to userspace. */
-		if (nlen > 6 &&
-		    dire->u.name[0] == '.' &&
-		    ctx->actor != afs_lookup_filldir &&
-		    ctx->actor != afs_lookup_one_filldir &&
-		    memcmp(dire->u.name, ".__afs", 6) == 0) {
-			ctx->pos = blkoff + next * sizeof(union afs_xdr_dirent);
-			continue;
-		}
-
 		/* found the next entry */
 		if (!dir_emit(ctx, dire->u.name, nlen,
 			      ntohl(dire->u.vnode),
@@ -1833,6 +1824,8 @@
 
 static void afs_rename_success(struct afs_operation *op)
 {
+	struct afs_vnode *vnode = AFS_FS_I(d_inode(op->dentry));
+
 	_enter("op=%08x", op->debug_id);
 
 	op->ctime = op->file[0].scb.status.mtime_client;
@@ -1842,6 +1835,22 @@
 		op->ctime = op->file[1].scb.status.mtime_client;
 		afs_vnode_commit_status(op, &op->file[1]);
 	}
+
+	/* If we're moving a subdir between dirs, we need to update
+	 * its DV counter too as the ".." will be altered.
+	 */
+	if (S_ISDIR(vnode->netfs.inode.i_mode) &&
+	    op->file[0].vnode != op->file[1].vnode) {
+		u64 new_dv;
+
+		write_seqlock(&vnode->cb_lock);
+
+		new_dv = vnode->status.data_version + 1;
+		vnode->status.data_version = new_dv;
+		inode_set_iversion_raw(&vnode->netfs.inode, new_dv);
+
+		write_sequnlock(&vnode->cb_lock);
+	}
 }
 
 static void afs_rename_edit_dir(struct afs_operation *op)
@@ -1883,6 +1892,12 @@
 				 &vnode->fid, afs_edit_dir_for_rename_2);
 	}
 
+	if (S_ISDIR(vnode->netfs.inode.i_mode) &&
+	    new_dvnode != orig_dvnode &&
+	    test_bit(AFS_VNODE_DIR_VALID, &vnode->flags))
+		afs_edit_dir_update_dotdot(vnode, new_dvnode,
+					   afs_edit_dir_for_rename_sub);
+
 	new_inode = d_inode(new_dentry);
 	if (new_inode) {
 		spin_lock(&new_inode->i_lock);
--- linux-qcom-6.8.0.orig/fs/afs/dir_edit.c
+++ linux-qcom-6.8.0/fs/afs/dir_edit.c
@@ -127,10 +127,10 @@
 /*
  * Scan a directory block looking for a dirent of the right name.
  */
-static int afs_dir_scan_block(union afs_xdr_dir_block *block, struct qstr *name,
+static int afs_dir_scan_block(const union afs_xdr_dir_block *block, const struct qstr *name,
 			      unsigned int blocknum)
 {
-	union afs_xdr_dirent *de;
+	const union afs_xdr_dirent *de;
 	u64 bitmap;
 	int d, len, n;
 
@@ -492,3 +492,90 @@
 	clear_bit(AFS_VNODE_DIR_VALID, &vnode->flags);
 	goto out_unmap;
 }
+
+/*
+ * Edit a subdirectory that has been moved between directories to update the
+ * ".." entry.
+ */
+void afs_edit_dir_update_dotdot(struct afs_vnode *vnode, struct afs_vnode *new_dvnode,
+				enum afs_edit_dir_reason why)
+{
+	union afs_xdr_dir_block *block;
+	union afs_xdr_dirent *de;
+	struct folio *folio;
+	unsigned int nr_blocks, b;
+	pgoff_t index;
+	loff_t i_size;
+	int slot;
+
+	_enter("");
+
+	i_size = i_size_read(&vnode->netfs.inode);
+	if (i_size < AFS_DIR_BLOCK_SIZE) {
+		clear_bit(AFS_VNODE_DIR_VALID, &vnode->flags);
+		return;
+	}
+	nr_blocks = i_size / AFS_DIR_BLOCK_SIZE;
+
+	/* Find a block that has sufficient slots available.  Each folio
+	 * contains two or more directory blocks.
+	 */
+	for (b = 0; b < nr_blocks; b++) {
+		index = b / AFS_DIR_BLOCKS_PER_PAGE;
+		folio = afs_dir_get_folio(vnode, index);
+		if (!folio)
+			goto error;
+
+		block = kmap_local_folio(folio, b * AFS_DIR_BLOCK_SIZE - folio_pos(folio));
+
+		/* Abandon the edit if we got a callback break. */
+		if (!test_bit(AFS_VNODE_DIR_VALID, &vnode->flags))
+			goto invalidated;
+
+		slot = afs_dir_scan_block(block, &dotdot_name, b);
+		if (slot >= 0)
+			goto found_dirent;
+
+		kunmap_local(block);
+		folio_unlock(folio);
+		folio_put(folio);
+	}
+
+	/* Didn't find the dirent to clobber.  Download the directory again. */
+	trace_afs_edit_dir(vnode, why, afs_edit_dir_update_nodd,
+			   0, 0, 0, 0, "..");
+	clear_bit(AFS_VNODE_DIR_VALID, &vnode->flags);
+	goto out;
+
+found_dirent:
+	de = &block->dirents[slot];
+	de->u.vnode  = htonl(new_dvnode->fid.vnode);
+	de->u.unique = htonl(new_dvnode->fid.unique);
+
+	trace_afs_edit_dir(vnode, why, afs_edit_dir_update_dd, b, slot,
+			   ntohl(de->u.vnode), ntohl(de->u.unique), "..");
+
+	kunmap_local(block);
+	folio_unlock(folio);
+	folio_put(folio);
+	inode_set_iversion_raw(&vnode->netfs.inode, vnode->status.data_version);
+
+out:
+	_leave("");
+	return;
+
+invalidated:
+	kunmap_local(block);
+	folio_unlock(folio);
+	folio_put(folio);
+	trace_afs_edit_dir(vnode, why, afs_edit_dir_update_inval,
+			   0, 0, 0, 0, "..");
+	clear_bit(AFS_VNODE_DIR_VALID, &vnode->flags);
+	goto out;
+
+error:
+	trace_afs_edit_dir(vnode, why, afs_edit_dir_update_error,
+			   0, 0, 0, 0, "..");
+	clear_bit(AFS_VNODE_DIR_VALID, &vnode->flags);
+	goto out;
+}
--- linux-qcom-6.8.0.orig/fs/afs/fs_operation.c
+++ linux-qcom-6.8.0/fs/afs/fs_operation.c
@@ -201,7 +201,7 @@
 		}
 	}
 
-	if (op->call_responded)
+	if (op->call_responded && op->server)
 		set_bit(AFS_SERVER_FL_RESPONDING, &op->server->flags);
 
 	if (!afs_op_error(op)) {
--- linux-qcom-6.8.0.orig/fs/afs/inode.c
+++ linux-qcom-6.8.0/fs/afs/inode.c
@@ -694,13 +694,18 @@
 {
 	struct afs_vnode_param *vp = &op->file[0];
 	struct afs_vnode *vnode = vp->vnode;
+	struct inode *inode = &vnode->netfs.inode;
 
 	if (op->setattr.attr->ia_valid & ATTR_SIZE) {
 		loff_t size = op->setattr.attr->ia_size;
-		loff_t i_size = op->setattr.old_i_size;
+		loff_t old = op->setattr.old_i_size;
 
-		if (size != i_size) {
-			truncate_setsize(&vnode->netfs.inode, size);
+		/* Note: inode->i_size was updated by afs_apply_status() inside
+		 * the I/O and callback locks.
+		 */
+
+		if (size != old) {
+			truncate_pagecache(inode, size);
 			netfs_resize_file(&vnode->netfs, size, true);
 			fscache_resize_cookie(afs_vnode_cache(vnode), size);
 		}
--- linux-qcom-6.8.0.orig/fs/afs/internal.h
+++ linux-qcom-6.8.0/fs/afs/internal.h
@@ -130,6 +130,7 @@
 	wait_queue_head_t	waitq;		/* processes awaiting completion */
 	struct work_struct	async_work;	/* async I/O processor */
 	struct work_struct	work;		/* actual work processor */
+	struct work_struct	free_work;	/* Deferred free processor */
 	struct rxrpc_call	*rxcall;	/* RxRPC call handle */
 	struct rxrpc_peer	*peer;		/* Remote endpoint */
 	struct key		*key;		/* security for this call */
@@ -1073,6 +1074,8 @@
 extern void afs_edit_dir_add(struct afs_vnode *, struct qstr *, struct afs_fid *,
 			     enum afs_edit_dir_reason);
 extern void afs_edit_dir_remove(struct afs_vnode *, struct qstr *, enum afs_edit_dir_reason);
+void afs_edit_dir_update_dotdot(struct afs_vnode *vnode, struct afs_vnode *new_dvnode,
+				enum afs_edit_dir_reason why);
 
 /*
  * dir_silly.c
@@ -1332,6 +1335,7 @@
 extern void __net_exit afs_close_socket(struct afs_net *);
 extern void afs_charge_preallocation(struct work_struct *);
 extern void afs_put_call(struct afs_call *);
+void afs_deferred_put_call(struct afs_call *call);
 void afs_make_call(struct afs_call *call, gfp_t gfp);
 void afs_wait_for_call_to_complete(struct afs_call *call);
 extern struct afs_call *afs_alloc_flat_call(struct afs_net *,
--- linux-qcom-6.8.0.orig/fs/afs/mntpt.c
+++ linux-qcom-6.8.0/fs/afs/mntpt.c
@@ -140,6 +140,11 @@
 		put_page(page);
 		if (ret < 0)
 			return ret;
+
+		/* Don't cross a backup volume mountpoint from a backup volume */
+		if (src_as->volume && src_as->volume->type == AFSVL_BACKVOL &&
+		    ctx->type == AFSVL_BACKVOL)
+			return -ENODEV;
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/fs/afs/rotate.c
+++ linux-qcom-6.8.0/fs/afs/rotate.c
@@ -602,6 +602,8 @@
 		goto wait_for_more_probe_results;
 
 	alist = op->estate->addresses;
+	best_prio = -1;
+	addr_index = 0;
 	for (i = 0; i < alist->nr_addrs; i++) {
 		if (alist->addrs[i].prio > best_prio) {
 			addr_index = i;
@@ -609,9 +611,7 @@
 		}
 	}
 
-	addr_index = READ_ONCE(alist->preferred);
-	if (!test_bit(addr_index, &set))
-		addr_index = __ffs(set);
+	alist->preferred = addr_index;
 
 	op->addr_index = addr_index;
 	set_bit(addr_index, &op->addr_tried);
@@ -656,12 +656,6 @@
 next_server:
 	trace_afs_rotate(op, afs_rotate_trace_next_server, 0);
 	_debug("next");
-	ASSERT(op->estate);
-	alist = op->estate->addresses;
-	if (op->call_responded &&
-	    op->addr_index != READ_ONCE(alist->preferred) &&
-	    test_bit(alist->preferred, &op->addr_tried))
-		WRITE_ONCE(alist->preferred, op->addr_index);
 	op->estate = NULL;
 	goto pick_server;
 
@@ -690,14 +684,7 @@
 failed:
 	trace_afs_rotate(op, afs_rotate_trace_failed, 0);
 	op->flags |= AFS_OPERATION_STOP;
-	if (op->estate) {
-		alist = op->estate->addresses;
-		if (op->call_responded &&
-		    op->addr_index != READ_ONCE(alist->preferred) &&
-		    test_bit(alist->preferred, &op->addr_tried))
-			WRITE_ONCE(alist->preferred, op->addr_index);
-		op->estate = NULL;
-	}
+	op->estate = NULL;
 	_leave(" = f [failed %d]", afs_op_error(op));
 	return false;
 }
--- linux-qcom-6.8.0.orig/fs/afs/rxrpc.c
+++ linux-qcom-6.8.0/fs/afs/rxrpc.c
@@ -18,6 +18,7 @@
 
 struct workqueue_struct *afs_async_calls;
 
+static void afs_deferred_free_worker(struct work_struct *work);
 static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long);
 static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long);
 static void afs_process_async_call(struct work_struct *);
@@ -149,6 +150,7 @@
 	call->debug_id = atomic_inc_return(&rxrpc_debug_id);
 	refcount_set(&call->ref, 1);
 	INIT_WORK(&call->async_work, afs_process_async_call);
+	INIT_WORK(&call->free_work, afs_deferred_free_worker);
 	init_waitqueue_head(&call->waitq);
 	spin_lock_init(&call->state_lock);
 	call->iter = &call->def_iter;
@@ -159,6 +161,36 @@
 	return call;
 }
 
+static void afs_free_call(struct afs_call *call)
+{
+	struct afs_net *net = call->net;
+	int o;
+
+	ASSERT(!work_pending(&call->async_work));
+
+	rxrpc_kernel_put_peer(call->peer);
+
+	if (call->rxcall) {
+		rxrpc_kernel_shutdown_call(net->socket, call->rxcall);
+		rxrpc_kernel_put_call(net->socket, call->rxcall);
+		call->rxcall = NULL;
+	}
+	if (call->type->destructor)
+		call->type->destructor(call);
+
+	afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call);
+	kfree(call->request);
+
+	o = atomic_read(&net->nr_outstanding_calls);
+	trace_afs_call(call->debug_id, afs_call_trace_free, 0, o,
+		       __builtin_return_address(0));
+	kfree(call);
+
+	o = atomic_dec_return(&net->nr_outstanding_calls);
+	if (o == 0)
+		wake_up_var(&net->nr_outstanding_calls);
+}
+
 /*
  * Dispose of a reference on a call.
  */
@@ -173,32 +205,34 @@
 	o = atomic_read(&net->nr_outstanding_calls);
 	trace_afs_call(debug_id, afs_call_trace_put, r - 1, o,
 		       __builtin_return_address(0));
+	if (zero)
+		afs_free_call(call);
+}
 
-	if (zero) {
-		ASSERT(!work_pending(&call->async_work));
-		ASSERT(call->type->name != NULL);
-
-		rxrpc_kernel_put_peer(call->peer);
-
-		if (call->rxcall) {
-			rxrpc_kernel_shutdown_call(net->socket, call->rxcall);
-			rxrpc_kernel_put_call(net->socket, call->rxcall);
-			call->rxcall = NULL;
-		}
-		if (call->type->destructor)
-			call->type->destructor(call);
+static void afs_deferred_free_worker(struct work_struct *work)
+{
+	struct afs_call *call = container_of(work, struct afs_call, free_work);
 
-		afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call);
-		kfree(call->request);
+	afs_free_call(call);
+}
 
-		trace_afs_call(call->debug_id, afs_call_trace_free, 0, o,
-			       __builtin_return_address(0));
-		kfree(call);
+/*
+ * Dispose of a reference on a call, deferring the cleanup to a workqueue
+ * to avoid lock recursion.
+ */
+void afs_deferred_put_call(struct afs_call *call)
+{
+	struct afs_net *net = call->net;
+	unsigned int debug_id = call->debug_id;
+	bool zero;
+	int r, o;
 
-		o = atomic_dec_return(&net->nr_outstanding_calls);
-		if (o == 0)
-			wake_up_var(&net->nr_outstanding_calls);
-	}
+	zero = __refcount_dec_and_test(&call->ref, &r);
+	o = atomic_read(&net->nr_outstanding_calls);
+	trace_afs_call(debug_id, afs_call_trace_put, r - 1, o,
+		       __builtin_return_address(0));
+	if (zero)
+		schedule_work(&call->free_work);
 }
 
 static struct afs_call *afs_get_call(struct afs_call *call,
@@ -640,7 +674,8 @@
 }
 
 /*
- * wake up an asynchronous call
+ * Wake up an asynchronous call.  The caller is holding the call notify
+ * spinlock around this, so we can't call afs_put_call().
  */
 static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
 				   unsigned long call_user_ID)
@@ -657,7 +692,7 @@
 			       __builtin_return_address(0));
 
 		if (!queue_work(afs_async_calls, &call->async_work))
-			afs_put_call(call);
+			afs_deferred_put_call(call);
 	}
 }
 
--- linux-qcom-6.8.0.orig/fs/afs/validation.c
+++ linux-qcom-6.8.0/fs/afs/validation.c
@@ -122,6 +122,9 @@
 	const struct afs_volume *volume = vnode->volume;
 	time64_t deadline = ktime_get_real_seconds() + 10;
 
+	if (test_bit(AFS_VNODE_DELETED, &vnode->flags))
+		return true;
+
 	if (atomic_read(&volume->cb_v_check) != atomic_read(&volume->cb_v_break) ||
 	    atomic64_read(&vnode->cb_expires_at)  <= deadline ||
 	    volume->cb_expires_at <= deadline ||
@@ -389,12 +392,17 @@
 	       key_serial(key));
 
 	if (afs_check_validity(vnode))
-		return 0;
+		return test_bit(AFS_VNODE_DELETED, &vnode->flags) ? -ESTALE : 0;
 
 	ret = down_write_killable(&vnode->validate_lock);
 	if (ret < 0)
 		goto error;
 
+	if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
+		ret = -ESTALE;
+		goto error_unlock;
+	}
+
 	/* Validate a volume after the v_break has changed or the volume
 	 * callback expired.  We only want to do this once per volume per
 	 * v_break change.  The actual work will be done when parsing the
@@ -448,12 +456,6 @@
 	vnode->cb_ro_snapshot = cb_ro_snapshot;
 	vnode->cb_scrub = cb_scrub;
 
-	if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
-		_debug("file already deleted");
-		ret = -ESTALE;
-		goto error_unlock;
-	}
-
 	/* if the vnode's data version number changed then its contents are
 	 * different */
 	zap |= test_and_clear_bit(AFS_VNODE_ZAP_DATA, &vnode->flags);
--- linux-qcom-6.8.0.orig/fs/afs/vl_alias.c
+++ linux-qcom-6.8.0/fs/afs/vl_alias.c
@@ -253,6 +253,7 @@
 static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key)
 {
 	struct afs_cell *master;
+	size_t name_len;
 	char *cell_name;
 
 	cell_name = afs_vl_get_cell_name(cell, key);
@@ -264,8 +265,11 @@
 		return 0;
 	}
 
-	master = afs_lookup_cell(cell->net, cell_name, strlen(cell_name),
-				 NULL, false);
+	name_len = strlen(cell_name);
+	if (!name_len || name_len > AFS_MAXCELLNAME)
+		master = ERR_PTR(-EOPNOTSUPP);
+	else
+		master = afs_lookup_cell(cell->net, cell_name, name_len, NULL, false);
 	kfree(cell_name);
 	if (IS_ERR(master))
 		return PTR_ERR(master);
--- linux-qcom-6.8.0.orig/fs/afs/vlclient.c
+++ linux-qcom-6.8.0/fs/afs/vlclient.c
@@ -697,7 +697,7 @@
 			return ret;
 
 		namesz = ntohl(call->tmp);
-		if (namesz > AFS_MAXCELLNAME)
+		if (namesz > YFS_VL_MAXCELLNAME)
 			return afs_protocol_error(call, afs_eproto_cellname_len);
 		paddedsz = (namesz + 3) & ~3;
 		call->count = namesz;
--- linux-qcom-6.8.0.orig/fs/aio.c
+++ linux-qcom-6.8.0/fs/aio.c
@@ -1202,8 +1202,8 @@
 		spin_lock_irqsave(&ctx->wait.lock, flags);
 		list_for_each_entry_safe(curr, next, &ctx->wait.head, w.entry)
 			if (avail >= curr->min_nr) {
-				list_del_init_careful(&curr->w.entry);
 				wake_up_process(curr->w.private);
+				list_del_init_careful(&curr->w.entry);
 			}
 		spin_unlock_irqrestore(&ctx->wait.lock, flags);
 	}
--- linux-qcom-6.8.0.orig/fs/autofs/inode.c
+++ linux-qcom-6.8.0/fs/autofs/inode.c
@@ -172,8 +172,7 @@
 	ret = autofs_check_pipe(pipe);
 	if (ret < 0) {
 		errorf(fc, "Invalid/unusable pipe");
-		if (param->type != fs_value_is_file)
-			fput(pipe);
+		fput(pipe);
 		return -EBADF;
 	}
 
--- linux-qcom-6.8.0.orig/fs/backing-file.c
+++ linux-qcom-6.8.0/fs/backing-file.c
@@ -280,13 +280,16 @@
 	if (WARN_ON_ONCE(!(out->f_mode & FMODE_BACKING)))
 		return -EIO;
 
+	if (!out->f_op->splice_write)
+		return -EINVAL;
+
 	ret = file_remove_privs(ctx->user_file);
 	if (ret)
 		return ret;
 
 	old_cred = override_creds(ctx->cred);
 	file_start_write(out);
-	ret = iter_file_splice_write(pipe, out, ppos, len, flags);
+	ret = out->f_op->splice_write(pipe, out, ppos, len, flags);
 	file_end_write(out);
 	revert_creds(old_cred);
 
--- linux-qcom-6.8.0.orig/fs/bcachefs/bcachefs.h
+++ linux-qcom-6.8.0/fs/bcachefs/bcachefs.h
@@ -451,6 +451,7 @@
 };
 
 #include "alloc_types.h"
+#include "btree_gc_types.h"
 #include "btree_types.h"
 #include "btree_write_buffer_types.h"
 #include "buckets_types.h"
@@ -480,48 +481,6 @@
 
 struct btree;
 
-enum gc_phase {
-	GC_PHASE_NOT_RUNNING,
-	GC_PHASE_START,
-	GC_PHASE_SB,
-
-	GC_PHASE_BTREE_stripes,
-	GC_PHASE_BTREE_extents,
-	GC_PHASE_BTREE_inodes,
-	GC_PHASE_BTREE_dirents,
-	GC_PHASE_BTREE_xattrs,
-	GC_PHASE_BTREE_alloc,
-	GC_PHASE_BTREE_quotas,
-	GC_PHASE_BTREE_reflink,
-	GC_PHASE_BTREE_subvolumes,
-	GC_PHASE_BTREE_snapshots,
-	GC_PHASE_BTREE_lru,
-	GC_PHASE_BTREE_freespace,
-	GC_PHASE_BTREE_need_discard,
-	GC_PHASE_BTREE_backpointers,
-	GC_PHASE_BTREE_bucket_gens,
-	GC_PHASE_BTREE_snapshot_trees,
-	GC_PHASE_BTREE_deleted_inodes,
-	GC_PHASE_BTREE_logged_ops,
-	GC_PHASE_BTREE_rebalance_work,
-
-	GC_PHASE_PENDING_DELETE,
-};
-
-struct gc_pos {
-	enum gc_phase		phase;
-	struct bpos		pos;
-	unsigned		level;
-};
-
-struct reflink_gc {
-	u64		offset;
-	u32		size;
-	u32		refcount;
-};
-
-typedef GENRADIX(struct reflink_gc) reflink_gc_table;
-
 struct io_count {
 	u64			sectors[2][BCH_DATA_NR];
 };
--- linux-qcom-6.8.0.orig/fs/bcachefs/btree_gc.c
+++ linux-qcom-6.8.0/fs/bcachefs/btree_gc.c
@@ -1077,8 +1077,7 @@
 
 static inline int btree_id_gc_phase_cmp(enum btree_id l, enum btree_id r)
 {
-	return  (int) btree_id_to_gc_phase(l) -
-		(int) btree_id_to_gc_phase(r);
+	return cmp_int(gc_btree_order(l), gc_btree_order(r));
 }
 
 static int bch2_gc_btrees(struct bch_fs *c, bool initial, bool metadata_only)
@@ -1123,7 +1122,7 @@
 			min_t(u64, bucket_to_sector(ca, b + 1), end) - start;
 
 		bch2_mark_metadata_bucket(c, ca, b, type, sectors,
-					  gc_phase(GC_PHASE_SB), flags);
+					  gc_phase(GC_PHASE_sb), flags);
 		b++;
 		start += sectors;
 	} while (start < end);
@@ -1152,14 +1151,14 @@
 		b = ca->journal.buckets[i];
 		bch2_mark_metadata_bucket(c, ca, b, BCH_DATA_journal,
 					  ca->mi.bucket_size,
-					  gc_phase(GC_PHASE_SB), flags);
+					  gc_phase(GC_PHASE_sb), flags);
 	}
 }
 
 static void bch2_mark_superblocks(struct bch_fs *c)
 {
 	mutex_lock(&c->sb_lock);
-	gc_pos_set(c, gc_phase(GC_PHASE_SB));
+	gc_pos_set(c, gc_phase(GC_PHASE_sb));
 
 	for_each_online_member(c, ca)
 		bch2_mark_dev_superblock(c, ca, BTREE_TRIGGER_GC);
@@ -1773,7 +1772,7 @@
 	if (ret)
 		goto out;
 again:
-	gc_pos_set(c, gc_phase(GC_PHASE_START));
+	gc_pos_set(c, gc_phase(GC_PHASE_start));
 
 	bch2_mark_superblocks(c);
 
@@ -1800,7 +1799,7 @@
 		 */
 		bch_info(c, "Second GC pass needed, restarting:");
 		clear_bit(BCH_FS_need_another_gc, &c->flags);
-		__gc_pos_set(c, gc_phase(GC_PHASE_NOT_RUNNING));
+		__gc_pos_set(c, gc_phase(GC_PHASE_not_running));
 
 		bch2_gc_stripes_reset(c, metadata_only);
 		bch2_gc_alloc_reset(c, metadata_only);
@@ -1827,7 +1826,7 @@
 
 	percpu_down_write(&c->mark_lock);
 	/* Indicates that gc is no longer in progress: */
-	__gc_pos_set(c, gc_phase(GC_PHASE_NOT_RUNNING));
+	__gc_pos_set(c, gc_phase(GC_PHASE_not_running));
 
 	bch2_gc_free(c);
 	percpu_up_write(&c->mark_lock);
--- linux-qcom-6.8.0.orig/fs/bcachefs/btree_gc.h
+++ linux-qcom-6.8.0/fs/bcachefs/btree_gc.h
@@ -3,6 +3,7 @@
 #define _BCACHEFS_BTREE_GC_H
 
 #include "bkey.h"
+#include "btree_gc_types.h"
 #include "btree_types.h"
 
 int bch2_check_topology(struct bch_fs *);
@@ -35,38 +36,17 @@
 /* Position of (the start of) a gc phase: */
 static inline struct gc_pos gc_phase(enum gc_phase phase)
 {
-	return (struct gc_pos) {
-		.phase	= phase,
-		.pos	= POS_MIN,
-		.level	= 0,
-	};
-}
-
-static inline int gc_pos_cmp(struct gc_pos l, struct gc_pos r)
-{
-	return  cmp_int(l.phase, r.phase) ?:
-		bpos_cmp(l.pos, r.pos) ?:
-		cmp_int(l.level, r.level);
-}
-
-static inline enum gc_phase btree_id_to_gc_phase(enum btree_id id)
-{
-	switch (id) {
-#define x(name, v, ...) case BTREE_ID_##name: return GC_PHASE_BTREE_##name;
-	BCH_BTREE_IDS()
-#undef x
-	default:
-		BUG();
-	}
+	return (struct gc_pos) { .phase	= phase, };
 }
 
-static inline struct gc_pos gc_pos_btree(enum btree_id id,
+static inline struct gc_pos gc_pos_btree(enum btree_id btree,
 					 struct bpos pos, unsigned level)
 {
 	return (struct gc_pos) {
-		.phase	= btree_id_to_gc_phase(id),
-		.pos	= pos,
+		.phase	= GC_PHASE_btree,
+		.btree	= btree,
 		.level	= level,
+		.pos	= pos,
 	};
 }
 
@@ -91,6 +71,22 @@
 	return gc_pos_btree(id, SPOS_MAX, BTREE_MAX_DEPTH);
 }
 
+static inline int gc_btree_order(enum btree_id btree)
+{
+	if (btree == BTREE_ID_stripes)
+		return -1;
+	return btree;
+}
+
+static inline int gc_pos_cmp(struct gc_pos l, struct gc_pos r)
+{
+	return   cmp_int(l.phase, r.phase) ?:
+		 cmp_int(gc_btree_order(l.btree),
+			 gc_btree_order(r.btree)) ?:
+		-cmp_int(l.level, r.level) ?:
+		 bpos_cmp(l.pos, r.pos);
+}
+
 static inline bool gc_visited(struct bch_fs *c, struct gc_pos pos)
 {
 	unsigned seq;
--- linux-qcom-6.8.0.orig/fs/bcachefs/btree_gc_types.h
+++ linux-qcom-6.8.0/fs/bcachefs/btree_gc_types.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _BCACHEFS_BTREE_GC_TYPES_H
+#define _BCACHEFS_BTREE_GC_TYPES_H
+
+#include <linux/generic-radix-tree.h>
+
+enum gc_phase {
+	GC_PHASE_not_running,
+	GC_PHASE_start,
+	GC_PHASE_sb,
+	GC_PHASE_btree,
+};
+
+struct gc_pos {
+	enum gc_phase		phase:8;
+	enum btree_id		btree:8;
+	u16			level;
+	struct bpos		pos;
+};
+
+struct reflink_gc {
+	u64		offset;
+	u32		size;
+	u32		refcount;
+};
+
+typedef GENRADIX(struct reflink_gc) reflink_gc_table;
+
+#endif /* _BCACHEFS_BTREE_GC_TYPES_H */
--- linux-qcom-6.8.0.orig/fs/bcachefs/ec.c
+++ linux-qcom-6.8.0/fs/bcachefs/ec.c
@@ -878,7 +878,7 @@
 	if (!genradix_ptr_alloc(&c->stripes, idx, gfp))
 		return -BCH_ERR_ENOMEM_ec_stripe_mem_alloc;
 
-	if (c->gc_pos.phase != GC_PHASE_NOT_RUNNING &&
+	if (c->gc_pos.phase != GC_PHASE_not_running &&
 	    !genradix_ptr_alloc(&c->gc_stripes, idx, gfp))
 		return -BCH_ERR_ENOMEM_ec_stripe_mem_alloc;
 
--- linux-qcom-6.8.0.orig/fs/bcachefs/extents.c
+++ linux-qcom-6.8.0/fs/bcachefs/extents.c
@@ -903,8 +903,29 @@
 			bkey_for_each_ptr_decode(k2.k, ptrs2, p2, entry2)
 				if (p1.ptr.dev		== p2.ptr.dev &&
 				    p1.ptr.gen		== p2.ptr.gen &&
+
+				    /*
+				     * This checks that the two pointers point
+				     * to the same region on disk - adjusting
+				     * for the difference in where the extents
+				     * start, since one may have been trimmed:
+				     */
 				    (s64) p1.ptr.offset + p1.crc.offset - bkey_start_offset(k1.k) ==
-				    (s64) p2.ptr.offset + p2.crc.offset - bkey_start_offset(k2.k))
+				    (s64) p2.ptr.offset + p2.crc.offset - bkey_start_offset(k2.k) &&
+
+				    /*
+				     * This additionally checks that the
+				     * extents overlap on disk, since the
+				     * previous check may trigger spuriously
+				     * when one extent is immediately partially
+				     * overwritten with another extent (so that
+				     * on disk they are adjacent) and
+				     * compression is in use:
+				     */
+				    ((p1.ptr.offset >= p2.ptr.offset &&
+				      p1.ptr.offset  < p2.ptr.offset + p2.crc.compressed_size) ||
+				     (p2.ptr.offset >= p1.ptr.offset &&
+				      p2.ptr.offset  < p1.ptr.offset + p1.crc.compressed_size)))
 					return true;
 
 		return false;
--- linux-qcom-6.8.0.orig/fs/bcachefs/fs.c
+++ linux-qcom-6.8.0/fs/bcachefs/fs.c
@@ -176,6 +176,14 @@
 	return jhash_3words(inum.subvol, inum.inum >> 32, inum.inum, JHASH_INITVAL);
 }
 
+struct bch_inode_info *__bch2_inode_hash_find(struct bch_fs *c, subvol_inum inum)
+{
+	return to_bch_ei(ilookup5_nowait(c->vfs_sb,
+					 bch2_inode_hash(inum),
+					 bch2_iget5_test,
+					 &inum));
+}
+
 struct inode *bch2_vfs_inode_get(struct bch_fs *c, subvol_inum inum)
 {
 	struct bch_inode_unpacked inode_u;
--- linux-qcom-6.8.0.orig/fs/bcachefs/fs.h
+++ linux-qcom-6.8.0/fs/bcachefs/fs.h
@@ -56,6 +56,8 @@
 	};
 }
 
+struct bch_inode_info *__bch2_inode_hash_find(struct bch_fs *, subvol_inum);
+
 /*
  * Set if we've gotten a btree error for this inode, and thus the vfs inode and
  * btree inode may be inconsistent:
@@ -194,6 +196,11 @@
 
 #define bch2_inode_update_after_write(_trans, _inode, _inode_u, _fields)	({ do {} while (0); })
 
+static inline struct bch_inode_info *__bch2_inode_hash_find(struct bch_fs *c, subvol_inum inum)
+{
+	return NULL;
+}
+
 static inline void bch2_evict_subvolume_inodes(struct bch_fs *c,
 					       snapshot_id_list *s) {}
 static inline void bch2_vfs_exit(void) {}
--- linux-qcom-6.8.0.orig/fs/bcachefs/fsck.c
+++ linux-qcom-6.8.0/fs/bcachefs/fsck.c
@@ -8,6 +8,7 @@
 #include "darray.h"
 #include "dirent.h"
 #include "error.h"
+#include "fs.h"
 #include "fs-common.h"
 #include "fsck.h"
 #include "inode.h"
@@ -807,6 +808,22 @@
 	return k.k->type == KEY_TYPE_set;
 }
 
+static bool bch2_inode_open(struct bch_fs *c, struct bpos p)
+{
+	subvol_inum inum = {
+		.subvol = snapshot_t(c, p.snapshot)->subvol,
+		.inum	= p.offset,
+	};
+
+	/* snapshot tree corruption, can't safely delete */
+	if (!inum.subvol) {
+		bch_err_ratelimited(c, "%s(): snapshot %u has no subvol", __func__, p.snapshot);
+		return true;
+	}
+
+	return __bch2_inode_hash_find(c, inum) != NULL;
+}
+
 static int check_inode(struct btree_trans *trans,
 		       struct btree_iter *iter,
 		       struct bkey_s_c k,
@@ -883,6 +900,7 @@
 	}
 
 	if (u.bi_flags & BCH_INODE_unlinked &&
+	    !bch2_inode_open(c, k.k->p) &&
 	    (!c->sb.clean ||
 	     fsck_err(c, inode_unlinked_but_clean,
 		      "filesystem marked clean, but inode %llu unlinked",
--- linux-qcom-6.8.0.orig/fs/bcachefs/mean_and_variance_test.c
+++ linux-qcom-6.8.0/fs/bcachefs/mean_and_variance_test.c
@@ -130,20 +130,8 @@
 			d, mean, stddev, weighted_mean, weighted_stddev);
 }
 
-static void mean_and_variance_test_2(struct kunit *test)
-{
-	s64 d[]			= { 100, 10, 10, 10, 10, 10, 10 };
-	s64 mean[]		= {  10, 10, 10, 10, 10, 10, 10 };
-	s64 stddev[]		= {   9,  9,  9,  9,  9,  9,  9 };
-	s64 weighted_mean[]	= {  32, 27, 22, 19, 17, 15, 14 };
-	s64 weighted_stddev[]	= {  38, 35, 31, 27, 24, 21, 18 };
-
-	do_mean_and_variance_test(test, 10, 6, ARRAY_SIZE(d), 2,
-			d, mean, stddev, weighted_mean, weighted_stddev);
-}
-
 /* Test behaviour where we switch from one steady state to another: */
-static void mean_and_variance_test_3(struct kunit *test)
+static void mean_and_variance_test_2(struct kunit *test)
 {
 	s64 d[]			= { 100, 100, 100, 100, 100 };
 	s64 mean[]		= {  22,  32,  40,  46,  50 };
@@ -155,18 +143,6 @@
 			d, mean, stddev, weighted_mean, weighted_stddev);
 }
 
-static void mean_and_variance_test_4(struct kunit *test)
-{
-	s64 d[]			= { 100, 100, 100, 100, 100 };
-	s64 mean[]		= {  10,  11,  12,  13,  14 };
-	s64 stddev[]		= {   9,  13,  15,  17,  19 };
-	s64 weighted_mean[]	= {  32,  49,  61,  71,  78 };
-	s64 weighted_stddev[]	= {  38,  44,  44,  41,  38 };
-
-	do_mean_and_variance_test(test, 10, 6, ARRAY_SIZE(d), 2,
-			d, mean, stddev, weighted_mean, weighted_stddev);
-}
-
 static void mean_and_variance_fast_divpow2(struct kunit *test)
 {
 	s64 i;
@@ -224,8 +200,6 @@
 	KUNIT_CASE(mean_and_variance_weighted_advanced_test),
 	KUNIT_CASE(mean_and_variance_test_1),
 	KUNIT_CASE(mean_and_variance_test_2),
-	KUNIT_CASE(mean_and_variance_test_3),
-	KUNIT_CASE(mean_and_variance_test_4),
 	{}
 };
 
--- linux-qcom-6.8.0.orig/fs/bcachefs/sb-downgrade.c
+++ linux-qcom-6.8.0/fs/bcachefs/sb-downgrade.c
@@ -125,7 +125,8 @@
 #define for_each_downgrade_entry(_d, _i)						\
 	for (const struct bch_sb_field_downgrade_entry *_i = (_d)->entries;		\
 	     (void *) _i	< vstruct_end(&(_d)->field) &&				\
-	     (void *) &_i->errors[0] < vstruct_end(&(_d)->field);			\
+	     (void *) &_i->errors[0] <= vstruct_end(&(_d)->field) &&			\
+	     (void *) downgrade_entry_next_c(_i) <= vstruct_end(&(_d)->field);		\
 	     _i = downgrade_entry_next_c(_i))
 
 static int bch2_sb_downgrade_validate(struct bch_sb *sb, struct bch_sb_field *f,
@@ -133,7 +134,17 @@
 {
 	struct bch_sb_field_downgrade *e = field_to_type(f, downgrade);
 
-	for_each_downgrade_entry(e, i) {
+	for (const struct bch_sb_field_downgrade_entry *i = e->entries;
+	     (void *) i	< vstruct_end(&e->field);
+	     i = downgrade_entry_next_c(i)) {
+		/*
+		 * Careful: sb_field_downgrade_entry is only 2 byte aligned, but
+		 * section sizes are 8 byte aligned - an empty entry spanning
+		 * the end of the section is allowed (and ignored):
+		 */
+		if ((void *) &i->errors[0] > vstruct_end(&e->field))
+			break;
+
 		if (BCH_VERSION_MAJOR(le16_to_cpu(i->version)) !=
 		    BCH_VERSION_MAJOR(le16_to_cpu(sb->version))) {
 			prt_printf(err, "downgrade entry with mismatched major version (%u != %u)",
@@ -205,7 +216,7 @@
 
 		dst = (void *) &darray_top(table);
 		dst->version = cpu_to_le16(src->version);
-		dst->recovery_passes[0]	= cpu_to_le64(src->recovery_passes);
+		dst->recovery_passes[0]	= cpu_to_le64(bch2_recovery_passes_to_stable(src->recovery_passes));
 		dst->recovery_passes[1]	= 0;
 		dst->nr_errors		= cpu_to_le16(src->nr_errors);
 		for (unsigned i = 0; i < src->nr_errors; i++)
--- linux-qcom-6.8.0.orig/fs/bcachefs/super-io.c
+++ linux-qcom-6.8.0/fs/bcachefs/super-io.c
@@ -1093,18 +1093,12 @@
 	 * c->sb will be checked before we write the superblock, so update it as
 	 * well:
 	 */
-	if (BCH_SB_VERSION_UPGRADE_COMPLETE(c->disk_sb.sb) > bcachefs_metadata_version_current) {
+	if (BCH_SB_VERSION_UPGRADE_COMPLETE(c->disk_sb.sb) > bcachefs_metadata_version_current)
 		SET_BCH_SB_VERSION_UPGRADE_COMPLETE(c->disk_sb.sb, bcachefs_metadata_version_current);
-		c->sb.version_upgrade_complete = bcachefs_metadata_version_current;
-	}
-	if (c->sb.version > bcachefs_metadata_version_current) {
+	if (c->sb.version > bcachefs_metadata_version_current)
 		c->disk_sb.sb->version = cpu_to_le16(bcachefs_metadata_version_current);
-		c->sb.version = bcachefs_metadata_version_current;
-	}
-	if (c->sb.version_min > bcachefs_metadata_version_current) {
+	if (c->sb.version_min > bcachefs_metadata_version_current)
 		c->disk_sb.sb->version_min = cpu_to_le16(bcachefs_metadata_version_current);
-		c->sb.version_min = bcachefs_metadata_version_current;
-	}
 	c->disk_sb.sb->compat[0] &= cpu_to_le64((1ULL << BCH_COMPAT_NR) - 1);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/fs/binfmt_elf.c
+++ linux-qcom-6.8.0/fs/binfmt_elf.c
@@ -1003,7 +1003,8 @@
 	if (elf_read_implies_exec(*elf_ex, executable_stack))
 		current->personality |= READ_IMPLIES_EXEC;
 
-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
+	const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space);
+	if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space)
 		current->flags |= PF_RANDOMIZE;
 
 	setup_new_exec(bprm);
@@ -1251,7 +1252,7 @@
 	mm->end_data = end_data;
 	mm->start_stack = bprm->p;
 
-	if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
+	if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) {
 		/*
 		 * For architectures with ELF randomization, when executing
 		 * a loader directly (i.e. no interpreter listed in ELF
--- linux-qcom-6.8.0.orig/fs/binfmt_elf_fdpic.c
+++ linux-qcom-6.8.0/fs/binfmt_elf_fdpic.c
@@ -320,7 +320,7 @@
 	else
 		executable_stack = EXSTACK_DEFAULT;
 
-	if (stack_size == 0) {
+	if (stack_size == 0 && interp_params.flags & ELF_FDPIC_FLAG_PRESENT) {
 		stack_size = interp_params.stack_size;
 		if (interp_params.flags & ELF_FDPIC_FLAG_EXEC_STACK)
 			executable_stack = EXSTACK_ENABLE_X;
--- linux-qcom-6.8.0.orig/fs/binfmt_flat.c
+++ linux-qcom-6.8.0/fs/binfmt_flat.c
@@ -72,8 +72,10 @@
 
 #ifdef CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET
 #define DATA_START_OFFSET_WORDS		(0)
+#define MAX_SHARED_LIBS_UPDATE		(0)
 #else
 #define DATA_START_OFFSET_WORDS		(MAX_SHARED_LIBS)
+#define MAX_SHARED_LIBS_UPDATE		(MAX_SHARED_LIBS)
 #endif
 
 struct lib_info {
@@ -880,7 +882,7 @@
 		return res;
 
 	/* Update data segment pointers for all libraries */
-	for (i = 0; i < MAX_SHARED_LIBS; i++) {
+	for (i = 0; i < MAX_SHARED_LIBS_UPDATE; i++) {
 		if (!libinfo.lib_list[i].loaded)
 			continue;
 		for (j = 0; j < MAX_SHARED_LIBS; j++) {
--- linux-qcom-6.8.0.orig/fs/btrfs/accessors.c
+++ linux-qcom-6.8.0/fs/btrfs/accessors.c
@@ -63,8 +63,8 @@
 	const unsigned long idx = get_eb_folio_index(token->eb, member_offset); \
 	const unsigned long oil = get_eb_offset_in_folio(token->eb,	\
 							 member_offset);\
-	const int unit_size = folio_size(token->eb->folios[0]);		\
-	const int unit_shift = folio_shift(token->eb->folios[0]);	\
+	const int unit_size = token->eb->folio_size;			\
+	const int unit_shift = token->eb->folio_shift;			\
 	const int size = sizeof(u##bits);				\
 	u8 lebytes[sizeof(u##bits)];					\
 	const int part = unit_size - oil;				\
@@ -94,7 +94,7 @@
 	const unsigned long idx = get_eb_folio_index(eb, member_offset);\
 	const unsigned long oil = get_eb_offset_in_folio(eb,		\
 							 member_offset);\
-	const int unit_size = folio_size(eb->folios[0]);		\
+	const int unit_size = eb->folio_size;				\
 	char *kaddr = folio_address(eb->folios[idx]);			\
 	const int size = sizeof(u##bits);				\
 	const int part = unit_size - oil;				\
@@ -117,8 +117,8 @@
 	const unsigned long idx = get_eb_folio_index(token->eb, member_offset); \
 	const unsigned long oil = get_eb_offset_in_folio(token->eb,	\
 							 member_offset);\
-	const int unit_size = folio_size(token->eb->folios[0]);		\
-	const int unit_shift = folio_shift(token->eb->folios[0]);	\
+	const int unit_size = token->eb->folio_size;			\
+	const int unit_shift = token->eb->folio_shift;			\
 	const int size = sizeof(u##bits);				\
 	u8 lebytes[sizeof(u##bits)];					\
 	const int part = unit_size - oil;				\
@@ -151,7 +151,7 @@
 	const unsigned long idx = get_eb_folio_index(eb, member_offset);\
 	const unsigned long oil = get_eb_offset_in_folio(eb,		\
 							 member_offset);\
-	const int unit_size = folio_size(eb->folios[0]);		\
+	const int unit_size = eb->folio_size;				\
 	char *kaddr = folio_address(eb->folios[idx]);			\
 	const int size = sizeof(u##bits);				\
 	const int part = unit_size - oil;				\
--- linux-qcom-6.8.0.orig/fs/btrfs/backref.c
+++ linux-qcom-6.8.0/fs/btrfs/backref.c
@@ -2773,20 +2773,14 @@
 	size_t alloc_bytes;
 
 	alloc_bytes = max_t(size_t, total_bytes, sizeof(*data));
-	data = kvmalloc(alloc_bytes, GFP_KERNEL);
+	data = kvzalloc(alloc_bytes, GFP_KERNEL);
 	if (!data)
 		return ERR_PTR(-ENOMEM);
 
-	if (total_bytes >= sizeof(*data)) {
+	if (total_bytes >= sizeof(*data))
 		data->bytes_left = total_bytes - sizeof(*data);
-		data->bytes_missing = 0;
-	} else {
+	else
 		data->bytes_missing = sizeof(*data) - total_bytes;
-		data->bytes_left = 0;
-	}
-
-	data->elem_cnt = 0;
-	data->elem_missed = 0;
 
 	return data;
 }
@@ -3107,10 +3101,14 @@
 		btrfs_backref_cleanup_node(cache, node);
 	}
 
-	cache->last_trans = 0;
-
-	for (i = 0; i < BTRFS_MAX_LEVEL; i++)
-		ASSERT(list_empty(&cache->pending[i]));
+	for (i = 0; i < BTRFS_MAX_LEVEL; i++) {
+		while (!list_empty(&cache->pending[i])) {
+			node = list_first_entry(&cache->pending[i],
+						struct btrfs_backref_node,
+						list);
+			btrfs_backref_cleanup_node(cache, node);
+		}
+	}
 	ASSERT(list_empty(&cache->pending_edge));
 	ASSERT(list_empty(&cache->useless_node));
 	ASSERT(list_empty(&cache->changed));
--- linux-qcom-6.8.0.orig/fs/btrfs/bio.c
+++ linux-qcom-6.8.0/fs/btrfs/bio.c
@@ -50,6 +50,7 @@
 	bbio->end_io = end_io;
 	bbio->private = private;
 	atomic_set(&bbio->pending_ios, 1);
+	WRITE_ONCE(bbio->status, BLK_STS_OK);
 }
 
 /*
@@ -124,43 +125,26 @@
 void btrfs_bio_end_io(struct btrfs_bio *bbio, blk_status_t status)
 {
 	bbio->bio.bi_status = status;
-	__btrfs_bio_end_io(bbio);
-}
-
-static void btrfs_orig_write_end_io(struct bio *bio);
-
-static void btrfs_bbio_propagate_error(struct btrfs_bio *bbio,
-				       struct btrfs_bio *orig_bbio)
-{
-	/*
-	 * For writes we tolerate nr_mirrors - 1 write failures, so we can't
-	 * just blindly propagate a write failure here.  Instead increment the
-	 * error count in the original I/O context so that it is guaranteed to
-	 * be larger than the error tolerance.
-	 */
-	if (bbio->bio.bi_end_io == &btrfs_orig_write_end_io) {
-		struct btrfs_io_stripe *orig_stripe = orig_bbio->bio.bi_private;
-		struct btrfs_io_context *orig_bioc = orig_stripe->bioc;
-
-		atomic_add(orig_bioc->max_errors, &orig_bioc->error);
-	} else {
-		orig_bbio->bio.bi_status = bbio->bio.bi_status;
-	}
-}
-
-static void btrfs_orig_bbio_end_io(struct btrfs_bio *bbio)
-{
 	if (bbio->bio.bi_pool == &btrfs_clone_bioset) {
 		struct btrfs_bio *orig_bbio = bbio->private;
 
-		if (bbio->bio.bi_status)
-			btrfs_bbio_propagate_error(bbio, orig_bbio);
 		btrfs_cleanup_bio(bbio);
 		bbio = orig_bbio;
 	}
 
-	if (atomic_dec_and_test(&bbio->pending_ios))
+	/*
+	 * At this point, bbio always points to the original btrfs_bio. Save
+	 * the first error in it.
+	 */
+	if (status != BLK_STS_OK)
+		cmpxchg(&bbio->status, BLK_STS_OK, status);
+
+	if (atomic_dec_and_test(&bbio->pending_ios)) {
+		/* Load split bio's error which might be set above. */
+		if (status == BLK_STS_OK)
+			bbio->bio.bi_status = READ_ONCE(bbio->status);
 		__btrfs_bio_end_io(bbio);
+	}
 }
 
 static int next_repair_mirror(struct btrfs_failed_bio *fbio, int cur_mirror)
@@ -180,7 +164,7 @@
 static void btrfs_repair_done(struct btrfs_failed_bio *fbio)
 {
 	if (atomic_dec_and_test(&fbio->repair_count)) {
-		btrfs_orig_bbio_end_io(fbio->bbio);
+		btrfs_bio_end_io(fbio->bbio, fbio->bbio->bio.bi_status);
 		mempool_free(fbio, &btrfs_failed_bio_pool);
 	}
 }
@@ -327,7 +311,7 @@
 	if (fbio)
 		btrfs_repair_done(fbio);
 	else
-		btrfs_orig_bbio_end_io(bbio);
+		btrfs_bio_end_io(bbio, bbio->bio.bi_status);
 }
 
 static void btrfs_log_dev_io_error(struct bio *bio, struct btrfs_device *dev)
@@ -361,7 +345,7 @@
 	if (is_data_bbio(bbio))
 		btrfs_check_read_bio(bbio, bbio->bio.bi_private);
 	else
-		btrfs_orig_bbio_end_io(bbio);
+		btrfs_bio_end_io(bbio, bbio->bio.bi_status);
 }
 
 static void btrfs_simple_end_io(struct bio *bio)
@@ -381,7 +365,7 @@
 	} else {
 		if (bio_op(bio) == REQ_OP_ZONE_APPEND && !bio->bi_status)
 			btrfs_record_physical_zoned(bbio);
-		btrfs_orig_bbio_end_io(bbio);
+		btrfs_bio_end_io(bbio, bbio->bio.bi_status);
 	}
 }
 
@@ -395,7 +379,7 @@
 	if (bio_op(bio) == REQ_OP_READ && is_data_bbio(bbio))
 		btrfs_check_read_bio(bbio, NULL);
 	else
-		btrfs_orig_bbio_end_io(bbio);
+		btrfs_bio_end_io(bbio, bbio->bio.bi_status);
 
 	btrfs_put_bioc(bioc);
 }
@@ -425,7 +409,7 @@
 	if (bio_op(bio) == REQ_OP_ZONE_APPEND && !bio->bi_status)
 		stripe->physical = bio->bi_iter.bi_sector << SECTOR_SHIFT;
 
-	btrfs_orig_bbio_end_io(bbio);
+	btrfs_bio_end_io(bbio, bbio->bio.bi_status);
 	btrfs_put_bioc(bioc);
 }
 
@@ -596,7 +580,7 @@
 
 	/* If an error occurred we just want to clean up the bio and move on. */
 	if (bio->bi_status) {
-		btrfs_orig_bbio_end_io(async->bbio);
+		btrfs_bio_end_io(async->bbio, async->bbio->bio.bi_status);
 		return;
 	}
 
@@ -659,7 +643,6 @@
 {
 	struct btrfs_inode *inode = bbio->inode;
 	struct btrfs_fs_info *fs_info = bbio->fs_info;
-	struct btrfs_bio *orig_bbio = bbio;
 	struct bio *bio = &bbio->bio;
 	u64 logical = bio->bi_iter.bi_sector << SECTOR_SHIFT;
 	u64 length = bio->bi_iter.bi_size;
@@ -697,7 +680,7 @@
 		bbio->saved_iter = bio->bi_iter;
 		ret = btrfs_lookup_bio_sums(bbio);
 		if (ret)
-			goto fail_put_bio;
+			goto fail;
 	}
 
 	if (btrfs_op(bio) == BTRFS_MAP_WRITE) {
@@ -731,11 +714,13 @@
 
 			ret = btrfs_bio_csum(bbio);
 			if (ret)
-				goto fail_put_bio;
-		} else if (use_append) {
+				goto fail;
+		} else if (use_append ||
+			   (btrfs_is_zoned(fs_info) && inode &&
+			    inode->flags & BTRFS_INODE_NODATASUM)) {
 			ret = btrfs_alloc_dummy_sum(bbio);
 			if (ret)
-				goto fail_put_bio;
+				goto fail;
 		}
 	}
 
@@ -743,12 +728,21 @@
 done:
 	return map_length == length;
 
-fail_put_bio:
-	if (map_length < length)
-		btrfs_cleanup_bio(bbio);
 fail:
 	btrfs_bio_counter_dec(fs_info);
-	btrfs_bio_end_io(orig_bbio, ret);
+	/*
+	 * We have split the original bbio, now we have to end both the current
+	 * @bbio and remaining one, as the remaining one will never be submitted.
+	 */
+	if (map_length < length) {
+		struct btrfs_bio *remaining = bbio->private;
+
+		ASSERT(bbio->bio.bi_pool == &btrfs_clone_bioset);
+		ASSERT(remaining);
+
+		btrfs_bio_end_io(remaining, ret);
+	}
+	btrfs_bio_end_io(bbio, ret);
 	/* Do not submit another chunk */
 	return true;
 }
--- linux-qcom-6.8.0.orig/fs/btrfs/bio.h
+++ linux-qcom-6.8.0/fs/btrfs/bio.h
@@ -77,6 +77,9 @@
 	/* File system that this I/O operates on. */
 	struct btrfs_fs_info *fs_info;
 
+	/* Save the first error status of split bio. */
+	blk_status_t status;
+
 	/*
 	 * This member must come last, bio_alloc_bioset will allocate enough
 	 * bytes for entire btrfs_bio but relies on bio being last.
--- linux-qcom-6.8.0.orig/fs/btrfs/block-group.c
+++ linux-qcom-6.8.0/fs/btrfs/block-group.c
@@ -1214,8 +1214,8 @@
 	block_group->space_info->total_bytes -= block_group->length;
 	block_group->space_info->bytes_readonly -=
 		(block_group->length - block_group->zone_unusable);
-	block_group->space_info->bytes_zone_unusable -=
-		block_group->zone_unusable;
+	btrfs_space_info_update_bytes_zone_unusable(fs_info, block_group->space_info,
+						    -block_group->zone_unusable);
 	block_group->space_info->disk_total -= block_group->length * factor;
 
 	spin_unlock(&block_group->space_info->lock);
@@ -1387,7 +1387,8 @@
 		if (btrfs_is_zoned(cache->fs_info)) {
 			/* Migrate zone_unusable bytes to readonly */
 			sinfo->bytes_readonly += cache->zone_unusable;
-			sinfo->bytes_zone_unusable -= cache->zone_unusable;
+			btrfs_space_info_update_bytes_zone_unusable(cache->fs_info, sinfo,
+								    -cache->zone_unusable);
 			cache->zone_unusable = 0;
 		}
 		cache->ro++;
@@ -1550,7 +1551,8 @@
 		 * needing to allocate extents from the block group.
 		 */
 		used = btrfs_space_info_used(space_info, true);
-		if (space_info->total_bytes - block_group->length < used) {
+		if (space_info->total_bytes - block_group->length < used &&
+		    block_group->zone_unusable < block_group->length) {
 			/*
 			 * Add a reference for the list, compensate for the ref
 			 * drop under the "next" label for the
@@ -1775,6 +1777,7 @@
 		container_of(work, struct btrfs_fs_info, reclaim_bgs_work);
 	struct btrfs_block_group *bg;
 	struct btrfs_space_info *space_info;
+	LIST_HEAD(retry_list);
 
 	if (!test_bit(BTRFS_FS_OPEN, &fs_info->flags))
 		return;
@@ -1911,8 +1914,20 @@
 		}
 
 next:
-		if (ret)
-			btrfs_mark_bg_to_reclaim(bg);
+		if (ret) {
+			/* Refcount held by the reclaim_bgs list after splice. */
+			spin_lock(&fs_info->unused_bgs_lock);
+			/*
+			 * This block group might be added to the unused list
+			 * during the above process. Move it back to the
+			 * reclaim list otherwise.
+			 */
+			if (list_empty(&bg->bg_list)) {
+				btrfs_get_block_group(bg);
+				list_add_tail(&bg->bg_list, &retry_list);
+			}
+			spin_unlock(&fs_info->unused_bgs_lock);
+		}
 		btrfs_put_block_group(bg);
 
 		mutex_unlock(&fs_info->reclaim_bgs_lock);
@@ -1932,6 +1947,9 @@
 	spin_unlock(&fs_info->unused_bgs_lock);
 	mutex_unlock(&fs_info->reclaim_bgs_lock);
 end:
+	spin_lock(&fs_info->unused_bgs_lock);
+	list_splice_tail(&retry_list, &fs_info->reclaim_bgs);
+	spin_unlock(&fs_info->unused_bgs_lock);
 	btrfs_exclop_finish(fs_info);
 	sb_end_write(fs_info->sb);
 }
@@ -3008,9 +3026,11 @@
 		if (btrfs_is_zoned(cache->fs_info)) {
 			/* Migrate zone_unusable bytes back */
 			cache->zone_unusable =
-				(cache->alloc_offset - cache->used) +
+				(cache->alloc_offset - cache->used - cache->pinned -
+				 cache->reserved) +
 				(cache->length - cache->zone_capacity);
-			sinfo->bytes_zone_unusable += cache->zone_unusable;
+			btrfs_space_info_update_bytes_zone_unusable(cache->fs_info, sinfo,
+								    cache->zone_unusable);
 			sinfo->bytes_readonly -= cache->zone_unusable;
 		}
 		num_bytes = cache->length - cache->reserved -
@@ -3763,6 +3783,8 @@
 	spin_lock(&cache->lock);
 	if (cache->ro)
 		space_info->bytes_readonly += num_bytes;
+	else if (btrfs_is_zoned(cache->fs_info))
+		space_info->bytes_zone_unusable += num_bytes;
 	cache->reserved -= num_bytes;
 	space_info->bytes_reserved -= num_bytes;
 	space_info->max_extent_size = 0;
--- linux-qcom-6.8.0.orig/fs/btrfs/btrfs_inode.h
+++ linux-qcom-6.8.0/fs/btrfs/btrfs_inode.h
@@ -71,6 +71,16 @@
 	BTRFS_INODE_FREE_SPACE_INODE,
 	/* Set when there are no capabilities in XATTs for the inode. */
 	BTRFS_INODE_NO_CAP_XATTR,
+	/*
+	 * Set if an error happened when doing a COW write before submitting a
+	 * bio or during writeback. Used for both buffered writes and direct IO
+	 * writes. This is to signal a fast fsync that it has to wait for
+	 * ordered extents to complete and therefore not log extent maps that
+	 * point to unwritten extents (when an ordered extent completes and it
+	 * has the BTRFS_ORDERED_IOERR flag set, it drops extent maps in its
+	 * range).
+	 */
+	BTRFS_INODE_COW_WRITE_ERROR,
 };
 
 /* in memory btrfs inode */
@@ -98,6 +108,7 @@
 	 * logged_trans), to access/update delalloc_bytes, new_delalloc_bytes,
 	 * defrag_bytes, disk_i_size, outstanding_extents, csum_bytes and to
 	 * update the VFS' inode number of bytes used.
+	 * Also protects setting struct file::private_data.
 	 */
 	spinlock_t lock;
 
@@ -416,6 +427,14 @@
 	return true;
 }
 
+static inline void btrfs_assert_inode_locked(struct btrfs_inode *inode)
+{
+	/* Immediately trigger a crash if the inode is not locked. */
+	ASSERT(inode_is_locked(&inode->vfs_inode));
+	/* Trigger a splat in dmesg if this task is not holding the lock. */
+	lockdep_assert_held(&inode->vfs_inode.i_rwsem);
+}
+
 /* Array of bytes with variable length, hexadecimal format 0x1234 */
 #define CSUM_FMT				"0x%*phN"
 #define CSUM_FMT_VALUE(size, bytes)		size, bytes
@@ -515,8 +534,7 @@
 int btrfs_encoded_io_compression_from_extent(struct btrfs_fs_info *fs_info,
 					     int compress_type);
 int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
-					  u64 file_offset, u64 disk_bytenr,
-					  u64 disk_io_size,
+					  u64 disk_bytenr, u64 disk_io_size,
 					  struct page **pages);
 ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
 			   struct btrfs_ioctl_encoded_io_args *encoded);
--- linux-qcom-6.8.0.orig/fs/btrfs/compression.c
+++ linux-qcom-6.8.0/fs/btrfs/compression.c
@@ -284,7 +284,7 @@
 static noinline void end_compressed_writeback(const struct compressed_bio *cb)
 {
 	struct inode *inode = &cb->bbio.inode->vfs_inode;
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	unsigned long index = cb->start >> PAGE_SHIFT;
 	unsigned long end_index = (cb->start + cb->len - 1) >> PAGE_SHIFT;
 	struct folio_batch fbatch;
@@ -415,7 +415,7 @@
 				     struct compressed_bio *cb,
 				     int *memstall, unsigned long *pflags)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	unsigned long end_index;
 	struct bio *orig_bio = &cb->orig_bbio->bio;
 	u64 cur = cb->orig_bbio->file_offset + orig_bio->bi_iter.bi_size;
@@ -441,7 +441,7 @@
 	 * This makes readahead less effective, so here disable readahead for
 	 * subpage for now, until full compressed write is supported.
 	 */
-	if (btrfs_sb(inode->i_sb)->sectorsize < PAGE_SIZE)
+	if (fs_info->sectorsize < PAGE_SIZE)
 		return 0;
 
 	end_index = (i_size_read(inode) - 1) >> PAGE_SHIFT;
@@ -515,6 +515,7 @@
 			put_page(page);
 			break;
 		}
+		add_size = min(em->start + em->len, page_end + 1) - cur;
 		free_extent_map(em);
 
 		if (page->index == end_index) {
@@ -527,7 +528,6 @@
 			}
 		}
 
-		add_size = min(em->start + em->len, page_end + 1) - cur;
 		ret = bio_add_page(orig_bio, page, add_size, offset_in_page(cur));
 		if (ret != add_size) {
 			unlock_extent(tree, cur, page_end, NULL);
@@ -1039,7 +1039,7 @@
 int btrfs_decompress(int type, const u8 *data_in, struct page *dest_page,
 		     unsigned long dest_pgoff, size_t srclen, size_t destlen)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(dest_page->mapping->host->i_sb);
+	struct btrfs_fs_info *fs_info = page_to_fs_info(dest_page);
 	struct list_head *workspace;
 	const u32 sectorsize = fs_info->sectorsize;
 	int ret;
--- linux-qcom-6.8.0.orig/fs/btrfs/ctree.c
+++ linux-qcom-6.8.0/fs/btrfs/ctree.c
@@ -321,7 +321,7 @@
 	WARN_ON(test_bit(BTRFS_ROOT_SHAREABLE, &root->state) &&
 		trans->transid != fs_info->running_transaction->transid);
 	WARN_ON(test_bit(BTRFS_ROOT_SHAREABLE, &root->state) &&
-		trans->transid != root->last_trans);
+		trans->transid != btrfs_get_root_last_trans(root));
 
 	level = btrfs_header_level(buf);
 	if (level == 0)
@@ -462,8 +462,16 @@
 	}
 
 	owner = btrfs_header_owner(buf);
-	BUG_ON(owner == BTRFS_TREE_RELOC_OBJECTID &&
-	       !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF));
+	if (unlikely(owner == BTRFS_TREE_RELOC_OBJECTID &&
+		     !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF))) {
+		btrfs_crit(fs_info,
+"found tree block at bytenr %llu level %d root %llu refs %llu flags %llx without full backref flag set",
+			   buf->start, btrfs_header_level(buf),
+			   btrfs_root_id(root), refs, flags);
+		ret = -EUCLEAN;
+		btrfs_abort_transaction(trans, ret);
+		return ret;
+	}
 
 	if (refs > 1) {
 		if ((owner == root->root_key.objectid ||
@@ -554,7 +562,7 @@
 	WARN_ON(test_bit(BTRFS_ROOT_SHAREABLE, &root->state) &&
 		trans->transid != fs_info->running_transaction->transid);
 	WARN_ON(test_bit(BTRFS_ROOT_SHAREABLE, &root->state) &&
-		trans->transid != root->last_trans);
+		trans->transid != btrfs_get_root_last_trans(root));
 
 	level = btrfs_header_level(buf);
 
@@ -623,10 +631,16 @@
 		atomic_inc(&cow->refs);
 		rcu_assign_pointer(root->node, cow);
 
-		btrfs_free_tree_block(trans, btrfs_root_id(root), buf,
-				      parent_start, last_ref);
+		ret = btrfs_free_tree_block(trans, btrfs_root_id(root), buf,
+					    parent_start, last_ref);
 		free_extent_buffer(buf);
 		add_root_to_dirty_list(root);
+		if (ret < 0) {
+			btrfs_tree_unlock(cow);
+			free_extent_buffer(cow);
+			btrfs_abort_transaction(trans, ret);
+			return ret;
+		}
 	} else {
 		WARN_ON(trans->transid != btrfs_header_generation(parent));
 		ret = btrfs_tree_mod_log_insert_key(parent, parent_slot,
@@ -651,9 +665,17 @@
 				return ret;
 			}
 		}
-		btrfs_free_tree_block(trans, btrfs_root_id(root), buf,
-				      parent_start, last_ref);
+		ret = btrfs_free_tree_block(trans, btrfs_root_id(root), buf,
+					    parent_start, last_ref);
+		if (ret < 0) {
+			btrfs_tree_unlock(cow);
+			free_extent_buffer(cow);
+			btrfs_abort_transaction(trans, ret);
+			return ret;
+		}
 	}
+
+	trace_btrfs_cow_block(root, buf, cow);
 	if (unlock_orig)
 		btrfs_tree_unlock(buf);
 	free_extent_buffer_stale(buf);
@@ -705,7 +727,6 @@
 {
 	struct btrfs_fs_info *fs_info = root->fs_info;
 	u64 search_start;
-	int ret;
 
 	if (unlikely(test_bit(BTRFS_ROOT_DELETING, &root->state))) {
 		btrfs_abort_transaction(trans, -EUCLEAN);
@@ -746,12 +767,8 @@
 	 * Also We don't care about the error, as it's handled internally.
 	 */
 	btrfs_qgroup_trace_subtree_after_cow(trans, root, buf);
-	ret = btrfs_force_cow_block(trans, root, buf, parent, parent_slot,
-				    cow_ret, search_start, 0, nest);
-
-	trace_btrfs_cow_block(root, buf, *cow_ret);
-
-	return ret;
+	return btrfs_force_cow_block(trans, root, buf, parent, parent_slot,
+				     cow_ret, search_start, 0, nest);
 }
 ALLOW_ERROR_INJECTION(btrfs_cow_block, ERRNO);
 
@@ -820,7 +837,7 @@
 	}
 
 	while (low < high) {
-		const int unit_size = folio_size(eb->folios[0]);
+		const int unit_size = eb->folio_size;
 		unsigned long oil;
 		unsigned long offset;
 		struct btrfs_disk_key *tmp;
@@ -986,9 +1003,13 @@
 		free_extent_buffer(mid);
 
 		root_sub_used_bytes(root);
-		btrfs_free_tree_block(trans, btrfs_root_id(root), mid, 0, 1);
+		ret = btrfs_free_tree_block(trans, btrfs_root_id(root), mid, 0, 1);
 		/* once for the root ptr */
 		free_extent_buffer_stale(mid);
+		if (ret < 0) {
+			btrfs_abort_transaction(trans, ret);
+			goto out;
+		}
 		return 0;
 	}
 	if (btrfs_header_nritems(mid) >
@@ -1056,10 +1077,14 @@
 				goto out;
 			}
 			root_sub_used_bytes(root);
-			btrfs_free_tree_block(trans, btrfs_root_id(root), right,
-					      0, 1);
+			ret = btrfs_free_tree_block(trans, btrfs_root_id(root),
+						    right, 0, 1);
 			free_extent_buffer_stale(right);
 			right = NULL;
+			if (ret < 0) {
+				btrfs_abort_transaction(trans, ret);
+				goto out;
+			}
 		} else {
 			struct btrfs_disk_key right_key;
 			btrfs_node_key(right, &right_key, 0);
@@ -1114,9 +1139,13 @@
 			goto out;
 		}
 		root_sub_used_bytes(root);
-		btrfs_free_tree_block(trans, btrfs_root_id(root), mid, 0, 1);
+		ret = btrfs_free_tree_block(trans, btrfs_root_id(root), mid, 0, 1);
 		free_extent_buffer_stale(mid);
 		mid = NULL;
+		if (ret < 0) {
+			btrfs_abort_transaction(trans, ret);
+			goto out;
+		}
 	} else {
 		/* update the parent key to reflect our changes */
 		struct btrfs_disk_key mid_key;
@@ -1998,7 +2027,7 @@
 		      const struct btrfs_key *key, struct btrfs_path *p,
 		      int ins_len, int cow)
 {
-	struct btrfs_fs_info *fs_info = root->fs_info;
+	struct btrfs_fs_info *fs_info;
 	struct extent_buffer *b;
 	int slot;
 	int ret;
@@ -2011,6 +2040,10 @@
 	int min_write_lock_level;
 	int prev_cmp;
 
+	if (!root)
+		return -EINVAL;
+
+	fs_info = root->fs_info;
 	might_sleep();
 
 	lowest_level = p->lowest_level;
@@ -2886,7 +2919,11 @@
 	old = root->node;
 	ret = btrfs_tree_mod_log_insert_root(root->node, c, false);
 	if (ret < 0) {
-		btrfs_free_tree_block(trans, btrfs_root_id(root), c, 0, 1);
+		int ret2;
+
+		ret2 = btrfs_free_tree_block(trans, btrfs_root_id(root), c, 0, 1);
+		if (ret2 < 0)
+			btrfs_abort_transaction(trans, ret2);
 		btrfs_tree_unlock(c);
 		free_extent_buffer(c);
 		return ret;
@@ -4451,9 +4488,12 @@
 	root_sub_used_bytes(root);
 
 	atomic_inc(&leaf->refs);
-	btrfs_free_tree_block(trans, btrfs_root_id(root), leaf, 0, 1);
+	ret = btrfs_free_tree_block(trans, btrfs_root_id(root), leaf, 0, 1);
 	free_extent_buffer_stale(leaf);
-	return 0;
+	if (ret < 0)
+		btrfs_abort_transaction(trans, ret);
+
+	return ret;
 }
 /*
  * delete the item at the leaf level in path.  If that empties
--- linux-qcom-6.8.0.orig/fs/btrfs/ctree.h
+++ linux-qcom-6.8.0/fs/btrfs/ctree.h
@@ -355,6 +355,16 @@
 	WRITE_ONCE(root->last_log_commit, commit_id);
 }
 
+static inline u64 btrfs_get_root_last_trans(const struct btrfs_root *root)
+{
+	return READ_ONCE(root->last_trans);
+}
+
+static inline void btrfs_set_root_last_trans(struct btrfs_root *root, u64 transid)
+{
+	WRITE_ONCE(root->last_trans, transid);
+}
+
 /*
  * Structure that conveys information about an extent that is going to replace
  * all the extents in a file range.
@@ -448,6 +458,8 @@
 	void *filldir_buf;
 	u64 last_index;
 	struct extent_state *llseek_cached_state;
+	/* Task that allocated this structure. */
+	struct task_struct *owner_task;
 };
 
 static inline u32 BTRFS_LEAF_DATA_SIZE(const struct btrfs_fs_info *info)
--- linux-qcom-6.8.0.orig/fs/btrfs/defrag.c
+++ linux-qcom-6.8.0/fs/btrfs/defrag.c
@@ -140,7 +140,7 @@
 	if (trans)
 		transid = trans->transid;
 	else
-		transid = inode->root->last_trans;
+		transid = btrfs_get_root_last_trans(root);
 
 	defrag = kmem_cache_zalloc(btrfs_inode_defrag_cachep, GFP_NOFS);
 	if (!defrag)
@@ -521,7 +521,7 @@
 	 * keep_locks set and lowest_level is 1, regardless of the value of
 	 * path->slots[1].
 	 */
-	BUG_ON(path->locks[1] == 0);
+	ASSERT(path->locks[1] != 0);
 	ret = btrfs_realloc_node(trans, root,
 				 path->nodes[1], 0,
 				 &last_ret,
@@ -771,12 +771,12 @@
 	 * We can get a merged extent, in that case, we need to re-search
 	 * tree to get the original em for defrag.
 	 *
-	 * If @newer_than is 0 or em::generation < newer_than, we can trust
-	 * this em, as either we don't care about the generation, or the
-	 * merged extent map will be rejected anyway.
+	 * This is because even if we have adjacent extents that are contiguous
+	 * and compatible (same type and flags), we still want to defrag them
+	 * so that we use less metadata (extent items in the extent tree and
+	 * file extent items in the inode's subvolume tree).
 	 */
-	if (em && (em->flags & EXTENT_FLAG_MERGED) &&
-	    newer_than && em->generation >= newer_than) {
+	if (em && (em->flags & EXTENT_FLAG_MERGED)) {
 		free_extent_map(em);
 		em = NULL;
 	}
@@ -810,7 +810,7 @@
 static bool defrag_check_next_extent(struct inode *inode, struct extent_map *em,
 				     u32 extent_thresh, u64 newer_than, bool locked)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct extent_map *next;
 	bool ret = false;
 
@@ -1366,7 +1366,7 @@
 		      struct btrfs_ioctl_defrag_range_args *range,
 		      u64 newer_than, unsigned long max_to_defrag)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	unsigned long sectors_defragged = 0;
 	u64 isize = i_size_read(inode);
 	u64 cur;
--- linux-qcom-6.8.0.orig/fs/btrfs/delayed-inode.c
+++ linux-qcom-6.8.0/fs/btrfs/delayed-inode.c
@@ -430,8 +430,6 @@
 
 	delayed_root = delayed_node->root->fs_info->delayed_root;
 
-	BUG_ON(!delayed_root);
-
 	if (delayed_item->type == BTRFS_DELAYED_INSERTION_ITEM)
 		root = &delayed_node->ins_root;
 	else
@@ -980,7 +978,7 @@
 
 	if (delayed_node &&
 	    test_bit(BTRFS_DELAYED_NODE_INODE_DIRTY, &delayed_node->flags)) {
-		BUG_ON(!delayed_node->root);
+		ASSERT(delayed_node->root);
 		clear_bit(BTRFS_DELAYED_NODE_INODE_DIRTY, &delayed_node->flags);
 		delayed_node->count--;
 
@@ -1128,6 +1126,9 @@
 	if (ret)
 		return ret;
 
+	ret = btrfs_record_root_in_trans(trans, node->root);
+	if (ret)
+		return ret;
 	ret = btrfs_update_delayed_inode(trans, node->root, path, node);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/fs/btrfs/delayed-ref.c
+++ linux-qcom-6.8.0/fs/btrfs/delayed-ref.c
@@ -716,7 +716,7 @@
 					      &href->ref_add_list);
 			else if (ref->action == BTRFS_DROP_DELAYED_REF) {
 				ASSERT(!list_empty(&exist->add_list));
-				list_del(&exist->add_list);
+				list_del_init(&exist->add_list);
 			} else {
 				ASSERT(0);
 			}
@@ -1232,6 +1232,74 @@
 	return find_ref_head(delayed_refs, bytenr, false);
 }
 
+static int find_comp(struct btrfs_delayed_ref_node *entry, u64 root, u64 parent)
+{
+	int type = parent ? BTRFS_SHARED_BLOCK_REF_KEY : BTRFS_TREE_BLOCK_REF_KEY;
+	struct btrfs_delayed_tree_ref *ref = btrfs_delayed_node_to_tree_ref(entry);
+
+	if (type < entry->type)
+		return -1;
+	if (type > entry->type)
+		return 1;
+
+	if (type == BTRFS_TREE_BLOCK_REF_KEY) {
+		if (root < ref->root)
+			return -1;
+		if (root > ref->root)
+			return 1;
+	} else {
+		if (parent < ref->parent)
+			return -1;
+		if (parent > ref->parent)
+			return 1;
+	}
+	return 0;
+}
+
+/*
+ * Check to see if a given root/parent reference is attached to the head.  This
+ * only checks for BTRFS_ADD_DELAYED_REF references that match, as that
+ * indicates the reference exists for the given root or parent.  This is for
+ * tree blocks only.
+ *
+ * @head: the head of the bytenr we're searching.
+ * @root: the root objectid of the reference if it is a normal reference.
+ * @parent: the parent if this is a shared backref.
+ */
+bool btrfs_find_delayed_tree_ref(struct btrfs_delayed_ref_head *head,
+				 u64 root, u64 parent)
+{
+	struct rb_node *node;
+	bool found = false;
+
+	lockdep_assert_held(&head->mutex);
+
+	spin_lock(&head->lock);
+	node = head->ref_tree.rb_root.rb_node;
+	while (node) {
+		struct btrfs_delayed_ref_node *entry;
+		int ret;
+
+		entry = rb_entry(node, struct btrfs_delayed_ref_node, ref_node);
+		ret = find_comp(entry, root, parent);
+		if (ret < 0) {
+			node = node->rb_left;
+		} else if (ret > 0) {
+			node = node->rb_right;
+		} else {
+			/*
+			 * We only want to count ADD actions, as drops mean the
+			 * ref doesn't exist.
+			 */
+			if (entry->action == BTRFS_ADD_DELAYED_REF)
+				found = true;
+			break;
+		}
+	}
+	spin_unlock(&head->lock);
+	return found;
+}
+
 void __cold btrfs_delayed_ref_exit(void)
 {
 	kmem_cache_destroy(btrfs_delayed_ref_head_cachep);
--- linux-qcom-6.8.0.orig/fs/btrfs/delayed-ref.h
+++ linux-qcom-6.8.0/fs/btrfs/delayed-ref.h
@@ -445,6 +445,8 @@
 void btrfs_migrate_to_delayed_refs_rsv(struct btrfs_fs_info *fs_info,
 				       u64 num_bytes);
 bool btrfs_check_space_for_delayed_refs(struct btrfs_fs_info *fs_info);
+bool btrfs_find_delayed_tree_ref(struct btrfs_delayed_ref_head *head,
+				 u64 root, u64 parent);
 
 /*
  * helper functions to cast a node into its container
--- linux-qcom-6.8.0.orig/fs/btrfs/dev-replace.c
+++ linux-qcom-6.8.0/fs/btrfs/dev-replace.c
@@ -643,6 +643,7 @@
 		return ret;
 
 	down_write(&dev_replace->rwsem);
+	dev_replace->replace_task = current;
 	switch (dev_replace->replace_state) {
 	case BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED:
 	case BTRFS_IOCTL_DEV_REPLACE_STATE_FINISHED:
@@ -973,6 +974,7 @@
 	list_add(&tgt_device->dev_alloc_list, &fs_devices->alloc_list);
 	fs_devices->rw_devices++;
 
+	dev_replace->replace_task = NULL;
 	up_write(&dev_replace->rwsem);
 	btrfs_rm_dev_replace_blocked(fs_info);
 
--- linux-qcom-6.8.0.orig/fs/btrfs/dir-item.c
+++ linux-qcom-6.8.0/fs/btrfs/dir-item.c
@@ -347,8 +347,8 @@
 			return di;
 	}
 	/* Adjust return code if the key was not found in the next leaf. */
-	if (ret > 0)
-		ret = 0;
+	if (ret >= 0)
+		ret = -ENOENT;
 
 	return ERR_PTR(ret);
 }
--- linux-qcom-6.8.0.orig/fs/btrfs/disk-io.c
+++ linux-qcom-6.8.0/fs/btrfs/disk-io.c
@@ -193,7 +193,7 @@
 		struct folio *folio = eb->folios[i];
 		u64 start = max_t(u64, eb->start, folio_pos(folio));
 		u64 end = min_t(u64, eb->start + eb->len,
-				folio_pos(folio) + folio_size(folio));
+				folio_pos(folio) + eb->folio_size);
 		u32 len = end - start;
 
 		ret = btrfs_repair_io_failure(fs_info, 0, start, len,
@@ -498,15 +498,15 @@
 static int btree_writepages(struct address_space *mapping,
 			    struct writeback_control *wbc)
 {
-	struct btrfs_fs_info *fs_info;
 	int ret;
 
 	if (wbc->sync_mode == WB_SYNC_NONE) {
+		struct btrfs_fs_info *fs_info;
 
 		if (wbc->for_kupdate)
 			return 0;
 
-		fs_info = BTRFS_I(mapping->host)->root->fs_info;
+		fs_info = inode_to_fs_info(mapping->host);
 		/* this is a bit racy, but that's ok */
 		ret = __percpu_counter_compare(&fs_info->dirty_metadata_bytes,
 					     BTRFS_DIRTY_METADATA_THRESH,
@@ -529,11 +529,12 @@
 				 size_t length)
 {
 	struct extent_io_tree *tree;
-	tree = &BTRFS_I(folio->mapping->host)->io_tree;
+
+	tree = &folio_to_inode(folio)->io_tree;
 	extent_invalidate_folio(tree, folio, offset);
 	btree_release_folio(folio, GFP_NOFS);
 	if (folio_get_private(folio)) {
-		btrfs_warn(BTRFS_I(folio->mapping->host)->root->fs_info,
+		btrfs_warn(folio_to_fs_info(folio),
 			   "folio private not zero on folio %llu",
 			   (unsigned long long)folio_pos(folio));
 		folio_detach_private(folio);
@@ -544,7 +545,7 @@
 static bool btree_dirty_folio(struct address_space *mapping,
 		struct folio *folio)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(mapping->host->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(mapping->host);
 	struct btrfs_subpage_info *spi = fs_info->subpage_info;
 	struct btrfs_subpage *subpage;
 	struct extent_buffer *eb;
@@ -658,7 +659,7 @@
 	root->state = 0;
 	RB_CLEAR_NODE(&root->rb_node);
 
-	root->last_trans = 0;
+	btrfs_set_root_last_trans(root, 0);
 	root->free_objectid = 0;
 	root->nr_delalloc_inodes = 0;
 	root->nr_ordered_extents = 0;
@@ -1011,7 +1012,7 @@
 		return ret;
 	}
 
-	log_root->last_trans = trans->transid;
+	btrfs_set_root_last_trans(log_root, trans->transid);
 	log_root->root_key.offset = root->root_key.objectid;
 
 	inode_item = &log_root->root_item.inode;
@@ -1966,7 +1967,7 @@
 	fs_info->qgroup_seq = 1;
 	fs_info->qgroup_ulist = NULL;
 	fs_info->qgroup_rescan_running = false;
-	fs_info->qgroup_drop_subtree_thres = BTRFS_MAX_LEVEL;
+	fs_info->qgroup_drop_subtree_thres = BTRFS_QGROUP_DROP_SUBTREE_THRES_DEFAULT;
 	mutex_init(&fs_info->qgroup_rescan_lock);
 }
 
@@ -2839,6 +2840,7 @@
 	int ret;
 
 	fs_info->sb = sb;
+	/* Temporary fixed values for block size until we read the superblock. */
 	sb->s_blocksize = BTRFS_BDEV_BLOCKSIZE;
 	sb->s_blocksize_bits = blksize_bits(BTRFS_BDEV_BLOCKSIZE);
 
@@ -3191,8 +3193,7 @@
 	return 0;
 }
 
-int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_devices,
-		      char *options)
+int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_devices)
 {
 	u32 sectorsize;
 	u32 nodesize;
@@ -3356,6 +3357,7 @@
 	sb->s_bdi->ra_pages *= btrfs_super_num_devices(disk_super);
 	sb->s_bdi->ra_pages = max(sb->s_bdi->ra_pages, SZ_4M / PAGE_SIZE);
 
+	/* Update the values for the current filesystem. */
 	sb->s_blocksize = sectorsize;
 	sb->s_blocksize_bits = blksize_bits(sectorsize);
 	memcpy(&sb->s_uuid, fs_info->fs_devices->fsid, BTRFS_FSID_SIZE);
@@ -4273,6 +4275,26 @@
 	btrfs_cleanup_defrag_inodes(fs_info);
 
 	/*
+	 * Wait for any fixup workers to complete.
+	 * If we don't wait for them here and they are still running by the time
+	 * we call kthread_stop() against the cleaner kthread further below, we
+	 * get an use-after-free on the cleaner because the fixup worker adds an
+	 * inode to the list of delayed iputs and then attempts to wakeup the
+	 * cleaner kthread, which was already stopped and destroyed. We parked
+	 * already the cleaner, but below we run all pending delayed iputs.
+	 */
+	btrfs_flush_workqueue(fs_info->fixup_workers);
+	/*
+	 * Similar case here, we have to wait for delalloc workers before we
+	 * proceed below and stop the cleaner kthread, otherwise we trigger a
+	 * use-after-tree on the cleaner kthread task_struct when a delalloc
+	 * worker running submit_compressed_extents() adds a delayed iput, which
+	 * does a wake up on the cleaner kthread, which was already freed below
+	 * when we call kthread_stop().
+	 */
+	btrfs_flush_workqueue(fs_info->delalloc_workers);
+
+	/*
 	 * After we parked the cleaner kthread, ordered extents may have
 	 * completed and created new delayed iputs. If one of the async reclaim
 	 * tasks is running and in the RUN_DELAYED_IPUTS flush state, then we
@@ -4541,18 +4563,10 @@
 				       struct btrfs_fs_info *fs_info)
 {
 	struct rb_node *node;
-	struct btrfs_delayed_ref_root *delayed_refs;
+	struct btrfs_delayed_ref_root *delayed_refs = &trans->delayed_refs;
 	struct btrfs_delayed_ref_node *ref;
 
-	delayed_refs = &trans->delayed_refs;
-
 	spin_lock(&delayed_refs->lock);
-	if (atomic_read(&delayed_refs->num_entries) == 0) {
-		spin_unlock(&delayed_refs->lock);
-		btrfs_debug(fs_info, "delayed_refs has NO entry");
-		return;
-	}
-
 	while ((node = rb_first_cached(&delayed_refs->href_root)) != NULL) {
 		struct btrfs_delayed_ref_head *head;
 		struct rb_node *n;
--- linux-qcom-6.8.0.orig/fs/btrfs/disk-io.h
+++ linux-qcom-6.8.0/fs/btrfs/disk-io.h
@@ -40,9 +40,7 @@
 int btrfs_start_pre_rw_mount(struct btrfs_fs_info *fs_info);
 int btrfs_check_super_csum(struct btrfs_fs_info *fs_info,
 			   const struct btrfs_super_block *disk_sb);
-int __cold open_ctree(struct super_block *sb,
-	       struct btrfs_fs_devices *fs_devices,
-	       char *options);
+int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_devices);
 void __cold close_ctree(struct btrfs_fs_info *fs_info);
 int btrfs_validate_super(struct btrfs_fs_info *fs_info,
 			 struct btrfs_super_block *sb, int mirror_num);
--- linux-qcom-6.8.0.orig/fs/btrfs/export.c
+++ linux-qcom-6.8.0/fs/btrfs/export.c
@@ -174,8 +174,15 @@
 	ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
 	if (ret < 0)
 		goto fail;
+	if (ret == 0) {
+		/*
+		 * Key with offset of -1 found, there would have to exist an
+		 * inode with such number or a root with such id.
+		 */
+		ret = -EUCLEAN;
+		goto fail;
+	}
 
-	BUG_ON(ret == 0); /* Key with offset of -1 found */
 	if (path->slots[0] == 0) {
 		ret = -ENOENT;
 		goto fail;
@@ -215,7 +222,7 @@
 {
 	struct inode *inode = d_inode(child);
 	struct inode *dir = d_inode(parent);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_path *path;
 	struct btrfs_root *root = BTRFS_I(dir)->root;
 	struct btrfs_inode_ref *iref;
--- linux-qcom-6.8.0.orig/fs/btrfs/extent-tree.c
+++ linux-qcom-6.8.0/fs/btrfs/extent-tree.c
@@ -109,10 +109,7 @@
 	struct btrfs_delayed_ref_head *head;
 	struct btrfs_delayed_ref_root *delayed_refs;
 	struct btrfs_path *path;
-	struct btrfs_extent_item *ei;
-	struct extent_buffer *leaf;
 	struct btrfs_key key;
-	u32 item_size;
 	u64 num_refs;
 	u64 extent_flags;
 	u64 owner = 0;
@@ -162,16 +159,11 @@
 	}
 
 	if (ret == 0) {
-		leaf = path->nodes[0];
-		item_size = btrfs_item_size(leaf, path->slots[0]);
-		if (item_size >= sizeof(*ei)) {
-			ei = btrfs_item_ptr(leaf, path->slots[0],
-					    struct btrfs_extent_item);
-			num_refs = btrfs_extent_refs(leaf, ei);
-			extent_flags = btrfs_extent_flags(leaf, ei);
-			owner = btrfs_get_extent_owner_root(fs_info, leaf,
-							    path->slots[0]);
-		} else {
+		struct extent_buffer *leaf = path->nodes[0];
+		struct btrfs_extent_item *ei;
+		const u32 item_size = btrfs_item_size(leaf, path->slots[0]);
+
+		if (unlikely(item_size < sizeof(*ei))) {
 			ret = -EUCLEAN;
 			btrfs_err(fs_info,
 			"unexpected extent item size, has %u expect >= %zu",
@@ -184,7 +176,18 @@
 			goto out_free;
 		}
 
-		BUG_ON(num_refs == 0);
+		ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
+		num_refs = btrfs_extent_refs(leaf, ei);
+		if (unlikely(num_refs == 0)) {
+			ret = -EUCLEAN;
+			btrfs_err(fs_info,
+		"unexpected zero reference count for extent item (%llu %u %llu)",
+				  key.objectid, key.type, key.offset);
+			btrfs_abort_transaction(trans, ret);
+			goto out_free;
+		}
+		extent_flags = btrfs_extent_flags(leaf, ei);
+		owner = btrfs_get_extent_owner_root(fs_info, leaf, path->slots[0]);
 	} else {
 		num_refs = 0;
 		extent_flags = 0;
@@ -214,10 +217,19 @@
 			goto search_again;
 		}
 		spin_lock(&head->lock);
-		if (head->extent_op && head->extent_op->update_flags)
+		if (head->extent_op && head->extent_op->update_flags) {
 			extent_flags |= head->extent_op->flags_to_set;
-		else
-			BUG_ON(num_refs == 0);
+		} else if (unlikely(num_refs == 0)) {
+			spin_unlock(&head->lock);
+			mutex_unlock(&head->mutex);
+			spin_unlock(&delayed_refs->lock);
+			ret = -EUCLEAN;
+			btrfs_err(fs_info,
+			  "unexpected zero reference count for extent %llu (%s)",
+				  bytenr, metadata ? "metadata" : "data");
+			btrfs_abort_transaction(trans, ret);
+			goto out_free;
+		}
 
 		num_refs += head->ref_mod;
 		spin_unlock(&head->lock);
@@ -1318,13 +1330,29 @@
 		bytes_left = end - start;
 	}
 
-	if (bytes_left) {
+	while (bytes_left) {
+		u64 bytes_to_discard = min(BTRFS_MAX_DISCARD_CHUNK_SIZE, bytes_left);
+
 		ret = blkdev_issue_discard(bdev, start >> SECTOR_SHIFT,
-					   bytes_left >> SECTOR_SHIFT,
+					   bytes_to_discard >> SECTOR_SHIFT,
 					   GFP_NOFS);
-		if (!ret)
-			*discarded_bytes += bytes_left;
+
+		if (ret) {
+			if (ret != -EOPNOTSUPP)
+				break;
+			continue;
+		}
+
+		start += bytes_to_discard;
+		bytes_left -= bytes_to_discard;
+		*discarded_bytes += bytes_to_discard;
+
+		if (btrfs_trim_interrupted()) {
+			ret = -ERESTARTSYS;
+			break;
+		}
 	}
+
 	return ret;
 }
 
@@ -2473,7 +2501,7 @@
 			goto out;
 
 		ret = check_delayed_ref(root, path, objectid, offset, bytenr);
-	} while (ret == -EAGAIN);
+	} while (ret == -EAGAIN && !path->nowait);
 
 out:
 	btrfs_release_path(path);
@@ -2830,7 +2858,8 @@
 			readonly = true;
 		} else if (btrfs_is_zoned(fs_info)) {
 			/* Need reset before reusing in a zoned block group */
-			space_info->bytes_zone_unusable += len;
+			btrfs_space_info_update_bytes_zone_unusable(fs_info, space_info,
+								    len);
 			readonly = true;
 		}
 		spin_unlock(&cache->lock);
@@ -3441,10 +3470,10 @@
 	return 0;
 }
 
-void btrfs_free_tree_block(struct btrfs_trans_handle *trans,
-			   u64 root_id,
-			   struct extent_buffer *buf,
-			   u64 parent, int last_ref)
+int btrfs_free_tree_block(struct btrfs_trans_handle *trans,
+			  u64 root_id,
+			  struct extent_buffer *buf,
+			  u64 parent, int last_ref)
 {
 	struct btrfs_fs_info *fs_info = trans->fs_info;
 	struct btrfs_ref generic_ref = { 0 };
@@ -3459,11 +3488,12 @@
 	if (root_id != BTRFS_TREE_LOG_OBJECTID) {
 		btrfs_ref_tree_mod(fs_info, &generic_ref);
 		ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, NULL);
-		BUG_ON(ret); /* -ENOMEM */
+		if (ret < 0)
+			return ret;
 	}
 
 	if (!last_ref)
-		return;
+		return 0;
 
 	if (btrfs_header_generation(buf) != trans->transid)
 		goto out;
@@ -3520,6 +3550,7 @@
 	 * matter anymore.
 	 */
 	clear_bit(EXTENT_BUFFER_CORRUPT, &buf->bflags);
+	return 0;
 }
 
 /* Can return -ENOMEM */
@@ -5287,7 +5318,15 @@
 		/* We don't care about errors in readahead. */
 		if (ret < 0)
 			continue;
-		BUG_ON(refs == 0);
+
+		/*
+		 * This could be racey, it's conceivable that we raced and end
+		 * up with a bogus refs count, if that's the case just skip, if
+		 * we are actually corrupt we will notice when we look up
+		 * everything again with our locks.
+		 */
+		if (refs == 0)
+			continue;
 
 		if (wc->stage == DROP_REFERENCE) {
 			if (refs == 1)
@@ -5346,16 +5385,19 @@
 	if (lookup_info &&
 	    ((wc->stage == DROP_REFERENCE && wc->refs[level] != 1) ||
 	     (wc->stage == UPDATE_BACKREF && !(wc->flags[level] & flag)))) {
-		BUG_ON(!path->locks[level]);
+		ASSERT(path->locks[level]);
 		ret = btrfs_lookup_extent_info(trans, fs_info,
 					       eb->start, level, 1,
 					       &wc->refs[level],
 					       &wc->flags[level],
 					       NULL);
-		BUG_ON(ret == -ENOMEM);
 		if (ret)
 			return ret;
-		BUG_ON(wc->refs[level] == 0);
+		if (unlikely(wc->refs[level] == 0)) {
+			btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0",
+				  eb->start);
+			return -EUCLEAN;
+		}
 	}
 
 	if (wc->stage == DROP_REFERENCE) {
@@ -5371,7 +5413,7 @@
 
 	/* wc->stage == UPDATE_BACKREF */
 	if (!(wc->flags[level] & flag)) {
-		BUG_ON(!path->locks[level]);
+		ASSERT(path->locks[level]);
 		ret = btrfs_inc_ref(trans, root, eb, 1);
 		BUG_ON(ret); /* -ENOMEM */
 		ret = btrfs_dec_ref(trans, root, eb, 0);
@@ -5400,23 +5442,62 @@
 			    struct btrfs_root *root, u64 bytenr, u64 parent,
 			    int level)
 {
+	struct btrfs_delayed_ref_root *delayed_refs;
+	struct btrfs_delayed_ref_head *head;
 	struct btrfs_path *path;
 	struct btrfs_extent_inline_ref *iref;
 	int ret;
+	bool exists = false;
 
 	path = btrfs_alloc_path();
 	if (!path)
 		return -ENOMEM;
-
+again:
 	ret = lookup_extent_backref(trans, path, &iref, bytenr,
 				    root->fs_info->nodesize, parent,
 				    root->root_key.objectid, level, 0);
+	if (ret != -ENOENT) {
+		/*
+		 * If we get 0 then we found our reference, return 1, else
+		 * return the error if it's not -ENOENT;
+		 */
+		btrfs_free_path(path);
+		return (ret < 0 ) ? ret : 1;
+	}
+
+	/*
+	 * We could have a delayed ref with this reference, so look it up while
+	 * we're holding the path open to make sure we don't race with the
+	 * delayed ref running.
+	 */
+	delayed_refs = &trans->transaction->delayed_refs;
+	spin_lock(&delayed_refs->lock);
+	head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
+	if (!head)
+		goto out;
+	if (!mutex_trylock(&head->mutex)) {
+		/*
+		 * We're contended, means that the delayed ref is running, get a
+		 * reference and wait for the ref head to be complete and then
+		 * try again.
+		 */
+		refcount_inc(&head->refs);
+		spin_unlock(&delayed_refs->lock);
+
+		btrfs_release_path(path);
+
+		mutex_lock(&head->mutex);
+		mutex_unlock(&head->mutex);
+		btrfs_put_delayed_ref_head(head);
+		goto again;
+	}
+
+	exists = btrfs_find_delayed_tree_ref(head, root->root_key.objectid, parent);
+	mutex_unlock(&head->mutex);
+out:
+	spin_unlock(&delayed_refs->lock);
 	btrfs_free_path(path);
-	if (ret == -ENOENT)
-		return 0;
-	if (ret < 0)
-		return ret;
-	return 1;
+	return exists ? 1 : 0;
 }
 
 /*
@@ -5491,8 +5572,9 @@
 		goto out_unlock;
 
 	if (unlikely(wc->refs[level - 1] == 0)) {
-		btrfs_err(fs_info, "Missing references.");
-		ret = -EIO;
+		btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0",
+			  bytenr);
+		ret = -EUCLEAN;
 		goto out_unlock;
 	}
 	*lookup_info = 0;
@@ -5655,7 +5737,7 @@
 				 struct walk_control *wc)
 {
 	struct btrfs_fs_info *fs_info = root->fs_info;
-	int ret;
+	int ret = 0;
 	int level = wc->level;
 	struct extent_buffer *eb = path->nodes[level];
 	u64 parent = 0;
@@ -5693,7 +5775,12 @@
 				path->locks[level] = 0;
 				return ret;
 			}
-			BUG_ON(wc->refs[level] == 0);
+			if (unlikely(wc->refs[level] == 0)) {
+				btrfs_tree_unlock_rw(eb, path->locks[level]);
+				btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0",
+					  eb->start);
+				return -EUCLEAN;
+			}
 			if (wc->refs[level] == 1) {
 				btrfs_tree_unlock_rw(eb, path->locks[level]);
 				path->locks[level] = 0;
@@ -5711,7 +5798,10 @@
 				ret = btrfs_dec_ref(trans, root, eb, 1);
 			else
 				ret = btrfs_dec_ref(trans, root, eb, 0);
-			BUG_ON(ret); /* -ENOMEM */
+			if (ret) {
+				btrfs_abort_transaction(trans, ret);
+				return ret;
+			}
 			if (is_fstree(root->root_key.objectid)) {
 				ret = btrfs_qgroup_trace_leaf_items(trans, eb);
 				if (ret) {
@@ -5742,12 +5832,14 @@
 			goto owner_mismatch;
 	}
 
-	btrfs_free_tree_block(trans, btrfs_root_id(root), eb, parent,
-			      wc->refs[level] == 1);
+	ret = btrfs_free_tree_block(trans, btrfs_root_id(root), eb, parent,
+				    wc->refs[level] == 1);
+	if (ret < 0)
+		btrfs_abort_transaction(trans, ret);
 out:
 	wc->refs[level] = 0;
 	wc->flags[level] = 0;
-	return 0;
+	return ret;
 
 owner_mismatch:
 	btrfs_err_rl(fs_info, "unexpected tree owner, have %llu expect %llu",
@@ -6271,7 +6363,7 @@
 		start += len;
 		*trimmed += bytes;
 
-		if (fatal_signal_pending(current)) {
+		if (btrfs_trim_interrupted()) {
 			ret = -ERESTARTSYS;
 			break;
 		}
@@ -6363,13 +6455,13 @@
 			continue;
 
 		ret = btrfs_trim_free_extents(device, &group_trimmed);
+
+		trimmed += group_trimmed;
 		if (ret) {
 			dev_failed++;
 			dev_ret = ret;
 			break;
 		}
-
-		trimmed += group_trimmed;
 	}
 	mutex_unlock(&fs_devices->device_list_mutex);
 
--- linux-qcom-6.8.0.orig/fs/btrfs/extent-tree.h
+++ linux-qcom-6.8.0/fs/btrfs/extent-tree.h
@@ -117,10 +117,10 @@
 					     u64 empty_size,
 					     u64 reloc_src_root,
 					     enum btrfs_lock_nesting nest);
-void btrfs_free_tree_block(struct btrfs_trans_handle *trans,
-			   u64 root_id,
-			   struct extent_buffer *buf,
-			   u64 parent, int last_ref);
+int btrfs_free_tree_block(struct btrfs_trans_handle *trans,
+			  u64 root_id,
+			  struct extent_buffer *buf,
+			  u64 parent, int last_ref);
 int btrfs_alloc_reserved_file_extent(struct btrfs_trans_handle *trans,
 				     struct btrfs_root *root, u64 owner,
 				     u64 offset, u64 ram_bytes,
--- linux-qcom-6.8.0.orig/fs/btrfs/extent_io.c
+++ linux-qcom-6.8.0/fs/btrfs/extent_io.c
@@ -78,7 +78,7 @@
 		eb = list_first_entry(&fs_info->allocated_ebs,
 				      struct extent_buffer, leak_list);
 		pr_err(
-	"BTRFS: buffer leak start %llu len %lu refs %d bflags %lu owner %llu\n",
+	"BTRFS: buffer leak start %llu len %u refs %d bflags %lu owner %llu\n",
 		       eb->start, eb->len, atomic_read(&eb->refs), eb->bflags,
 		       btrfs_header_owner(eb));
 		list_del(&eb->leak_list);
@@ -207,7 +207,7 @@
 				   struct page *locked_page, u64 start, u64 end,
 				   unsigned long page_ops)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(mapping->host->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(mapping->host);
 	pgoff_t start_index = start >> PAGE_SHIFT;
 	pgoff_t end_index = end >> PAGE_SHIFT;
 	pgoff_t index = start_index;
@@ -251,7 +251,7 @@
 					u64 start,
 					u64 end)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct address_space *mapping = inode->i_mapping;
 	pgoff_t start_index = start >> PAGE_SHIFT;
 	pgoff_t end_index = end >> PAGE_SHIFT;
@@ -323,7 +323,7 @@
 				    struct page *locked_page, u64 *start,
 				    u64 *end)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct extent_io_tree *tree = &BTRFS_I(inode)->io_tree;
 	const u64 orig_start = *start;
 	const u64 orig_end = *end;
@@ -433,7 +433,7 @@
 
 static void end_page_read(struct page *page, bool uptodate, u64 start, u32 len)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(page->mapping->host->i_sb);
+	struct btrfs_fs_info *fs_info = page_to_fs_info(page);
 	struct folio *folio = page_folio(page);
 
 	ASSERT(page_offset(page) <= start &&
@@ -692,31 +692,21 @@
 int btrfs_alloc_page_array(unsigned int nr_pages, struct page **page_array,
 			   gfp_t extra_gfp)
 {
+	const gfp_t gfp = GFP_NOFS | extra_gfp;
 	unsigned int allocated;
 
 	for (allocated = 0; allocated < nr_pages;) {
 		unsigned int last = allocated;
 
-		allocated = alloc_pages_bulk_array(GFP_NOFS | extra_gfp,
-						   nr_pages, page_array);
-
-		if (allocated == nr_pages)
-			return 0;
-
-		/*
-		 * During this iteration, no page could be allocated, even
-		 * though alloc_pages_bulk_array() falls back to alloc_page()
-		 * if  it could not bulk-allocate. So we must be out of memory.
-		 */
-		if (allocated == last) {
+		allocated = alloc_pages_bulk_array(gfp, nr_pages, page_array);
+		if (unlikely(allocated == last)) {
+			/* No progress, fail and do cleanup. */
 			for (int i = 0; i < allocated; i++) {
 				__free_page(page_array[i]);
 				page_array[i] = NULL;
 			}
 			return -ENOMEM;
 		}
-
-		memalloc_retry_wait(GFP_NOFS);
 	}
 	return 0;
 }
@@ -738,6 +728,8 @@
 
 	for (int i = 0; i < num_pages; i++)
 		eb->folios[i] = page_folio(page_array[i]);
+	eb->folio_size = PAGE_SIZE;
+	eb->folio_shift = PAGE_SHIFT;
 	return 0;
 }
 
@@ -827,7 +819,7 @@
 			       u64 disk_bytenr, struct page *page,
 			       size_t size, unsigned long pg_offset)
 {
-	struct btrfs_inode *inode = BTRFS_I(page->mapping->host);
+	struct btrfs_inode *inode = page_to_inode(page);
 
 	ASSERT(pg_offset + size <= PAGE_SIZE);
 	ASSERT(bio_ctrl->end_io_func);
@@ -936,17 +928,21 @@
 
 int set_page_extent_mapped(struct page *page)
 {
-	struct folio *folio = page_folio(page);
+	return set_folio_extent_mapped(page_folio(page));
+}
+
+int set_folio_extent_mapped(struct folio *folio)
+{
 	struct btrfs_fs_info *fs_info;
 
-	ASSERT(page->mapping);
+	ASSERT(folio->mapping);
 
 	if (folio_test_private(folio))
 		return 0;
 
-	fs_info = btrfs_sb(page->mapping->host->i_sb);
+	fs_info = folio_to_fs_info(folio);
 
-	if (btrfs_is_subpage(fs_info, page->mapping))
+	if (btrfs_is_subpage(fs_info, folio->mapping))
 		return btrfs_attach_subpage(fs_info, folio, BTRFS_SUBPAGE_DATA);
 
 	folio_attach_private(folio, (void *)EXTENT_FOLIO_PRIVATE);
@@ -963,7 +959,7 @@
 	if (!folio_test_private(folio))
 		return;
 
-	fs_info = btrfs_sb(page->mapping->host->i_sb);
+	fs_info = page_to_fs_info(page);
 	if (btrfs_is_subpage(fs_info, page->mapping))
 		return btrfs_detach_subpage(fs_info, folio);
 
@@ -1007,7 +1003,7 @@
 		      struct btrfs_bio_ctrl *bio_ctrl, u64 *prev_em_start)
 {
 	struct inode *inode = page->mapping->host;
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	u64 start = page_offset(page);
 	const u64 end = start + PAGE_SIZE - 1;
 	u64 cur = start;
@@ -1018,7 +1014,7 @@
 	int ret = 0;
 	size_t pg_offset = 0;
 	size_t iosize;
-	size_t blocksize = inode->i_sb->s_blocksize;
+	size_t blocksize = fs_info->sectorsize;
 	struct extent_io_tree *tree = &BTRFS_I(inode)->io_tree;
 
 	ret = set_page_extent_mapped(page);
@@ -1157,7 +1153,7 @@
 int btrfs_read_folio(struct file *file, struct folio *folio)
 {
 	struct page *page = &folio->page;
-	struct btrfs_inode *inode = BTRFS_I(page->mapping->host);
+	struct btrfs_inode *inode = page_to_inode(page);
 	u64 start = page_offset(page);
 	u64 end = start + PAGE_SIZE - 1;
 	struct btrfs_bio_ctrl bio_ctrl = { .opf = REQ_OP_READ };
@@ -1180,7 +1176,7 @@
 					struct btrfs_bio_ctrl *bio_ctrl,
 					u64 *prev_em_start)
 {
-	struct btrfs_inode *inode = BTRFS_I(pages[0]->mapping->host);
+	struct btrfs_inode *inode = page_to_inode(pages[0]);
 	int index;
 
 	btrfs_lock_and_flush_ordered_range(inode, start, end, NULL);
@@ -1399,6 +1395,13 @@
 		free_extent_map(em);
 		em = NULL;
 
+		/*
+		 * Although the PageDirty bit might be cleared before entering
+		 * this function, subpage dirty bit is not cleared.
+		 * So clear subpage dirty bit here so next time we won't submit
+		 * page for range already written to disk.
+		 */
+		btrfs_folio_clear_dirty(fs_info, page_folio(page), cur, iosize);
 		btrfs_set_range_writeback(inode, cur, cur + iosize - 1);
 		if (!PageWriteback(page)) {
 			btrfs_err(inode->root->fs_info,
@@ -1406,13 +1409,6 @@
 			       page->index, cur, end);
 		}
 
-		/*
-		 * Although the PageDirty bit is cleared before entering this
-		 * function, subpage dirty bit is not cleared.
-		 * So clear subpage dirty bit here so next time we won't submit
-		 * page for range already written to disk.
-		 */
-		btrfs_folio_clear_dirty(fs_info, page_folio(page), cur, iosize);
 
 		submit_extent_page(bio_ctrl, disk_bytenr, page, iosize,
 				   cur - page_offset(page));
@@ -1739,10 +1735,10 @@
 			folio_lock(folio);
 			folio_clear_dirty_for_io(folio);
 			folio_start_writeback(folio);
-			ret = bio_add_folio(&bbio->bio, folio, folio_size(folio), 0);
+			ret = bio_add_folio(&bbio->bio, folio, eb->folio_size, 0);
 			ASSERT(ret);
 			wbc_account_cgroup_owner(wbc, folio_page(folio, 0),
-						 folio_size(folio));
+						 eb->folio_size);
 			wbc->nr_to_write -= folio_nr_pages(folio);
 			folio_unlock(folio);
 		}
@@ -1766,7 +1762,7 @@
  */
 static int submit_eb_subpage(struct page *page, struct writeback_control *wbc)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(page->mapping->host->i_sb);
+	struct btrfs_fs_info *fs_info = page_to_fs_info(page);
 	struct folio *folio = page_folio(page);
 	int submitted = 0;
 	u64 page_start = page_offset(page);
@@ -1857,7 +1853,7 @@
 	if (!folio_test_private(folio))
 		return 0;
 
-	if (btrfs_sb(page->mapping->host->i_sb)->nodesize < PAGE_SIZE)
+	if (page_to_fs_info(page)->nodesize < PAGE_SIZE)
 		return submit_eb_subpage(page, wbc);
 
 	spin_lock(&mapping->i_private_lock);
@@ -1915,7 +1911,7 @@
 				   struct writeback_control *wbc)
 {
 	struct btrfs_eb_write_context ctx = { .wbc = wbc };
-	struct btrfs_fs_info *fs_info = BTRFS_I(mapping->host)->root->fs_info;
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(mapping->host);
 	int ret = 0;
 	int done = 0;
 	int nr_to_write_done = 0;
@@ -2203,7 +2199,7 @@
 	bool found_error = false;
 	int ret = 0;
 	struct address_space *mapping = inode->i_mapping;
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	const u32 sectorsize = fs_info->sectorsize;
 	loff_t i_size = i_size_read(inode);
 	u64 cur = start;
@@ -2225,10 +2221,8 @@
 
 		page = find_get_page(mapping, cur >> PAGE_SHIFT);
 		ASSERT(PageLocked(page));
-		if (pages_dirty && page != locked_page) {
+		if (pages_dirty && page != locked_page)
 			ASSERT(PageDirty(page));
-			clear_page_dirty_for_io(page);
-		}
 
 		ret = __extent_writepage_io(BTRFS_I(inode), page, &bio_ctrl,
 					    i_size, &nr);
@@ -2309,7 +2303,7 @@
 	struct extent_state *cached_state = NULL;
 	u64 start = folio_pos(folio);
 	u64 end = start + folio_size(folio) - 1;
-	size_t blocksize = folio->mapping->host->i_sb->s_blocksize;
+	size_t blocksize = folio_to_fs_info(folio)->sectorsize;
 
 	/* This function is only called for the btree inode */
 	ASSERT(tree->owner == IO_TREE_BTREE_INODE_IO);
@@ -2378,7 +2372,7 @@
 	struct extent_map *em;
 	u64 start = page_offset(page);
 	u64 end = start + PAGE_SIZE - 1;
-	struct btrfs_inode *btrfs_inode = BTRFS_I(page->mapping->host);
+	struct btrfs_inode *btrfs_inode = page_to_inode(page);
 	struct extent_io_tree *tree = &btrfs_inode->io_tree;
 	struct extent_map_tree *map = &btrfs_inode->extent_tree;
 
@@ -2453,12 +2447,65 @@
 	return try_release_extent_state(tree, page, mask);
 }
 
+struct btrfs_fiemap_entry {
+	u64 offset;
+	u64 phys;
+	u64 len;
+	u32 flags;
+};
+
 /*
- * To cache previous fiemap extent
+ * Indicate the caller of emit_fiemap_extent() that it needs to unlock the file
+ * range from the inode's io tree, unlock the subvolume tree search path, flush
+ * the fiemap cache and relock the file range and research the subvolume tree.
+ * The value here is something negative that can't be confused with a valid
+ * errno value and different from 1 because that's also a return value from
+ * fiemap_fill_next_extent() and also it's often used to mean some btree search
+ * did not find a key, so make it some distinct negative value.
+ */
+#define BTRFS_FIEMAP_FLUSH_CACHE (-(MAX_ERRNO + 1))
+
+/*
+ * Used to:
+ *
+ * - Cache the next entry to be emitted to the fiemap buffer, so that we can
+ *   merge extents that are contiguous and can be grouped as a single one;
  *
- * Will be used for merging fiemap extent
+ * - Store extents ready to be written to the fiemap buffer in an intermediary
+ *   buffer. This intermediary buffer is to ensure that in case the fiemap
+ *   buffer is memory mapped to the fiemap target file, we don't deadlock
+ *   during btrfs_page_mkwrite(). This is because during fiemap we are locking
+ *   an extent range in order to prevent races with delalloc flushing and
+ *   ordered extent completion, which is needed in order to reliably detect
+ *   delalloc in holes and prealloc extents. And this can lead to a deadlock
+ *   if the fiemap buffer is memory mapped to the file we are running fiemap
+ *   against (a silly, useless in practice scenario, but possible) because
+ *   btrfs_page_mkwrite() will try to lock the same extent range.
  */
 struct fiemap_cache {
+	/* An array of ready fiemap entries. */
+	struct btrfs_fiemap_entry *entries;
+	/* Number of entries in the entries array. */
+	int entries_size;
+	/* Index of the next entry in the entries array to write to. */
+	int entries_pos;
+	/*
+	 * Once the entries array is full, this indicates what's the offset for
+	 * the next file extent item we must search for in the inode's subvolume
+	 * tree after unlocking the extent range in the inode's io tree and
+	 * releasing the search path.
+	 */
+	u64 next_search_offset;
+	/*
+	 * This matches struct fiemap_extent_info::fi_mapped_extents, we use it
+	 * to count ourselves emitted extents and stop instead of relying on
+	 * fiemap_fill_next_extent() because we buffer ready fiemap entries at
+	 * the @entries array, and we want to stop as soon as we hit the max
+	 * amount of extents to map, not just to save time but also to make the
+	 * logic at extent_fiemap() simpler.
+	 */
+	unsigned int extents_mapped;
+	/* Fields for the cached extent (unsubmitted, not ready, extent). */
 	u64 offset;
 	u64 phys;
 	u64 len;
@@ -2466,6 +2513,28 @@
 	bool cached;
 };
 
+static int flush_fiemap_cache(struct fiemap_extent_info *fieinfo,
+			      struct fiemap_cache *cache)
+{
+	for (int i = 0; i < cache->entries_pos; i++) {
+		struct btrfs_fiemap_entry *entry = &cache->entries[i];
+		int ret;
+
+		ret = fiemap_fill_next_extent(fieinfo, entry->offset,
+					      entry->phys, entry->len,
+					      entry->flags);
+		/*
+		 * Ignore 1 (reached max entries) because we keep track of that
+		 * ourselves in emit_fiemap_extent().
+		 */
+		if (ret < 0)
+			return ret;
+	}
+	cache->entries_pos = 0;
+
+	return 0;
+}
+
 /*
  * Helper to submit fiemap extent.
  *
@@ -2480,8 +2549,8 @@
 				struct fiemap_cache *cache,
 				u64 offset, u64 phys, u64 len, u32 flags)
 {
+	struct btrfs_fiemap_entry *entry;
 	u64 cache_end;
-	int ret = 0;
 
 	/* Set at the end of extent_fiemap(). */
 	ASSERT((flags & FIEMAP_EXTENT_LAST) == 0);
@@ -2494,7 +2563,9 @@
 	 * find an extent that starts at an offset behind the end offset of the
 	 * previous extent we processed. This happens if fiemap is called
 	 * without FIEMAP_FLAG_SYNC and there are ordered extents completing
-	 * while we call btrfs_next_leaf() (through fiemap_next_leaf_item()).
+	 * after we had to unlock the file range, release the search path, emit
+	 * the fiemap extents stored in the buffer (cache->entries array) and
+	 * the lock the remainder of the range and re-search the btree.
 	 *
 	 * For example we are in leaf X processing its last item, which is the
 	 * file extent item for file range [512K, 1M[, and after
@@ -2607,11 +2678,35 @@
 
 emit:
 	/* Not mergeable, need to submit cached one */
-	ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
-				      cache->len, cache->flags);
-	cache->cached = false;
-	if (ret)
-		return ret;
+
+	if (cache->entries_pos == cache->entries_size) {
+		/*
+		 * We will need to research for the end offset of the last
+		 * stored extent and not from the current offset, because after
+		 * unlocking the range and releasing the path, if there's a hole
+		 * between that end offset and this current offset, a new extent
+		 * may have been inserted due to a new write, so we don't want
+		 * to miss it.
+		 */
+		entry = &cache->entries[cache->entries_size - 1];
+		cache->next_search_offset = entry->offset + entry->len;
+		cache->cached = false;
+
+		return BTRFS_FIEMAP_FLUSH_CACHE;
+	}
+
+	entry = &cache->entries[cache->entries_pos];
+	entry->offset = cache->offset;
+	entry->phys = cache->phys;
+	entry->len = cache->len;
+	entry->flags = cache->flags;
+	cache->entries_pos++;
+	cache->extents_mapped++;
+
+	if (cache->extents_mapped == fieinfo->fi_extents_max) {
+		cache->cached = false;
+		return 1;
+	}
 assign:
 	cache->cached = true;
 	cache->offset = offset;
@@ -2737,8 +2832,8 @@
 	 * neighbour leaf).
 	 * We also need the private clone because holding a read lock on an
 	 * extent buffer of the subvolume's b+tree will make lockdep unhappy
-	 * when we call fiemap_fill_next_extent(), because that may cause a page
-	 * fault when filling the user space buffer with fiemap data.
+	 * when we check if extents are shared, as backref walking may need to
+	 * lock the same leaf we are processing.
 	 */
 	clone = btrfs_clone_extent_buffer(path->nodes[0]);
 	if (!clone)
@@ -2778,34 +2873,16 @@
 	 * it beyond i_size.
 	 */
 	while (cur_offset < end && cur_offset < i_size) {
-		struct extent_state *cached_state = NULL;
 		u64 delalloc_start;
 		u64 delalloc_end;
 		u64 prealloc_start;
-		u64 lockstart;
-		u64 lockend;
 		u64 prealloc_len = 0;
 		bool delalloc;
 
-		lockstart = round_down(cur_offset, inode->root->fs_info->sectorsize);
-		lockend = round_up(end, inode->root->fs_info->sectorsize);
-
-		/*
-		 * We are only locking for the delalloc range because that's the
-		 * only thing that can change here.  With fiemap we have a lock
-		 * on the inode, so no buffered or direct writes can happen.
-		 *
-		 * However mmaps and normal page writeback will cause this to
-		 * change arbitrarily.  We have to lock the extent lock here to
-		 * make sure that nobody messes with the tree while we're doing
-		 * btrfs_find_delalloc_in_range.
-		 */
-		lock_extent(&inode->io_tree, lockstart, lockend, &cached_state);
 		delalloc = btrfs_find_delalloc_in_range(inode, cur_offset, end,
 							delalloc_cached_state,
 							&delalloc_start,
 							&delalloc_end);
-		unlock_extent(&inode->io_tree, lockstart, lockend, &cached_state);
 		if (!delalloc)
 			break;
 
@@ -2973,6 +3050,7 @@
 		  u64 start, u64 len)
 {
 	const u64 ino = btrfs_ino(inode);
+	struct extent_state *cached_state = NULL;
 	struct extent_state *delalloc_cached_state = NULL;
 	struct btrfs_path *path;
 	struct fiemap_cache cache = { 0 };
@@ -2985,26 +3063,33 @@
 	bool stopped = false;
 	int ret;
 
+	cache.entries_size = PAGE_SIZE / sizeof(struct btrfs_fiemap_entry);
+	cache.entries = kmalloc_array(cache.entries_size,
+				      sizeof(struct btrfs_fiemap_entry),
+				      GFP_KERNEL);
 	backref_ctx = btrfs_alloc_backref_share_check_ctx();
 	path = btrfs_alloc_path();
-	if (!backref_ctx || !path) {
+	if (!cache.entries || !backref_ctx || !path) {
 		ret = -ENOMEM;
 		goto out;
 	}
 
+restart:
 	range_start = round_down(start, sectorsize);
 	range_end = round_up(start + len, sectorsize);
 	prev_extent_end = range_start;
 
+	lock_extent(&inode->io_tree, range_start, range_end, &cached_state);
+
 	ret = fiemap_find_last_extent_offset(inode, path, &last_extent_end);
 	if (ret < 0)
-		goto out;
+		goto out_unlock;
 	btrfs_release_path(path);
 
 	path->reada = READA_FORWARD;
 	ret = fiemap_search_slot(inode, path, range_start);
 	if (ret < 0) {
-		goto out;
+		goto out_unlock;
 	} else if (ret > 0) {
 		/*
 		 * No file extent item found, but we may have delalloc between
@@ -3051,7 +3136,7 @@
 						  backref_ctx, 0, 0, 0,
 						  prev_extent_end, hole_end);
 			if (ret < 0) {
-				goto out;
+				goto out_unlock;
 			} else if (ret > 0) {
 				/* fiemap_fill_next_extent() told us to stop. */
 				stopped = true;
@@ -3107,7 +3192,7 @@
 								  extent_gen,
 								  backref_ctx);
 				if (ret < 0)
-					goto out;
+					goto out_unlock;
 				else if (ret > 0)
 					flags |= FIEMAP_EXTENT_SHARED;
 			}
@@ -3118,9 +3203,9 @@
 		}
 
 		if (ret < 0) {
-			goto out;
+			goto out_unlock;
 		} else if (ret > 0) {
-			/* fiemap_fill_next_extent() told us to stop. */
+			/* emit_fiemap_extent() told us to stop. */
 			stopped = true;
 			break;
 		}
@@ -3129,12 +3214,12 @@
 next_item:
 		if (fatal_signal_pending(current)) {
 			ret = -EINTR;
-			goto out;
+			goto out_unlock;
 		}
 
 		ret = fiemap_next_leaf_item(inode, path);
 		if (ret < 0) {
-			goto out;
+			goto out_unlock;
 		} else if (ret > 0) {
 			/* No more file extent items for this inode. */
 			break;
@@ -3143,22 +3228,12 @@
 	}
 
 check_eof_delalloc:
-	/*
-	 * Release (and free) the path before emitting any final entries to
-	 * fiemap_fill_next_extent() to keep lockdep happy. This is because
-	 * once we find no more file extent items exist, we may have a
-	 * non-cloned leaf, and fiemap_fill_next_extent() can trigger page
-	 * faults when copying data to the user space buffer.
-	 */
-	btrfs_free_path(path);
-	path = NULL;
-
 	if (!stopped && prev_extent_end < range_end) {
 		ret = fiemap_process_hole(inode, fieinfo, &cache,
 					  &delalloc_cached_state, backref_ctx,
 					  0, 0, 0, prev_extent_end, range_end - 1);
 		if (ret < 0)
-			goto out;
+			goto out_unlock;
 		prev_extent_end = range_end;
 	}
 
@@ -3166,28 +3241,16 @@
 		const u64 i_size = i_size_read(&inode->vfs_inode);
 
 		if (prev_extent_end < i_size) {
-			struct extent_state *cached_state = NULL;
 			u64 delalloc_start;
 			u64 delalloc_end;
-			u64 lockstart;
-			u64 lockend;
 			bool delalloc;
 
-			lockstart = round_down(prev_extent_end, sectorsize);
-			lockend = round_up(i_size, sectorsize);
-
-			/*
-			 * See the comment in fiemap_process_hole as to why
-			 * we're doing the locking here.
-			 */
-			lock_extent(&inode->io_tree, lockstart, lockend, &cached_state);
 			delalloc = btrfs_find_delalloc_in_range(inode,
 								prev_extent_end,
 								i_size - 1,
 								&delalloc_cached_state,
 								&delalloc_start,
 								&delalloc_end);
-			unlock_extent(&inode->io_tree, lockstart, lockend, &cached_state);
 			if (!delalloc)
 				cache.flags |= FIEMAP_EXTENT_LAST;
 		} else {
@@ -3195,9 +3258,39 @@
 		}
 	}
 
+out_unlock:
+	unlock_extent(&inode->io_tree, range_start, range_end, &cached_state);
+
+	if (ret == BTRFS_FIEMAP_FLUSH_CACHE) {
+		btrfs_release_path(path);
+		ret = flush_fiemap_cache(fieinfo, &cache);
+		if (ret)
+			goto out;
+		len -= cache.next_search_offset - start;
+		start = cache.next_search_offset;
+		goto restart;
+	} else if (ret < 0) {
+		goto out;
+	}
+
+	/*
+	 * Must free the path before emitting to the fiemap buffer because we
+	 * may have a non-cloned leaf and if the fiemap buffer is memory mapped
+	 * to a file, a write into it (through btrfs_page_mkwrite()) may trigger
+	 * waiting for an ordered extent that in order to complete needs to
+	 * modify that leaf, therefore leading to a deadlock.
+	 */
+	btrfs_free_path(path);
+	path = NULL;
+
+	ret = flush_fiemap_cache(fieinfo, &cache);
+	if (ret)
+		goto out;
+
 	ret = emit_last_fiemap_cache(fieinfo, &cache);
 out:
 	free_extent_state(delalloc_cached_state);
+	kfree(cache.entries);
 	btrfs_free_backref_share_ctx(backref_ctx);
 	btrfs_free_path(path);
 	return ret;
@@ -3415,7 +3508,7 @@
 	for (int i = 0; i < num_folios; i++) {
 		if (eb->folios[i]) {
 			detach_extent_buffer_folio(eb, eb->folios[i]);
-			__folio_put(eb->folios[i]);
+			folio_put(eb->folios[i]);
 		}
 	}
 	__free_extent_buffer(eb);
@@ -3551,6 +3644,8 @@
 	struct folio *folio = page_folio(page);
 	struct extent_buffer *exists;
 
+	lockdep_assert_held(&page->mapping->i_private_lock);
+
 	/*
 	 * For subpage case, we completely rely on radix tree to ensure we
 	 * don't try to insert two ebs for the same bytenr.  So here we always
@@ -3618,13 +3713,14 @@
  * The caller needs to free the existing folios and retry using the same order.
  */
 static int attach_eb_folio_to_filemap(struct extent_buffer *eb, int i,
+				      struct btrfs_subpage *prealloc,
 				      struct extent_buffer **found_eb_ret)
 {
 
 	struct btrfs_fs_info *fs_info = eb->fs_info;
 	struct address_space *mapping = fs_info->btree_inode->i_mapping;
 	const unsigned long index = eb->start >> PAGE_SHIFT;
-	struct folio *existing_folio;
+	struct folio *existing_folio = NULL;
 	int ret;
 
 	ASSERT(found_eb_ret);
@@ -3636,30 +3732,31 @@
 	ret = filemap_add_folio(mapping, eb->folios[i], index + i,
 				GFP_NOFS | __GFP_NOFAIL);
 	if (!ret)
-		return 0;
+		goto finish;
 
 	existing_folio = filemap_lock_folio(mapping, index + i);
 	/* The page cache only exists for a very short time, just retry. */
-	if (IS_ERR(existing_folio))
+	if (IS_ERR(existing_folio)) {
+		existing_folio = NULL;
 		goto retry;
+	}
 
 	/* For now, we should only have single-page folios for btree inode. */
 	ASSERT(folio_nr_pages(existing_folio) == 1);
 
-	if (folio_size(existing_folio) != folio_size(eb->folios[0])) {
+	if (folio_size(existing_folio) != eb->folio_size) {
 		folio_unlock(existing_folio);
 		folio_put(existing_folio);
 		return -EAGAIN;
 	}
 
-	if (fs_info->nodesize < PAGE_SIZE) {
-		/*
-		 * We're going to reuse the existing page, can drop our page
-		 * and subpage structure now.
-		 */
+finish:
+	spin_lock(&mapping->i_private_lock);
+	if (existing_folio && fs_info->nodesize < PAGE_SIZE) {
+		/* We're going to reuse the existing page, can drop our folio now. */
 		__free_page(folio_page(eb->folios[i], 0));
 		eb->folios[i] = existing_folio;
-	} else {
+	} else if (existing_folio) {
 		struct extent_buffer *existing_eb;
 
 		existing_eb = grab_extent_buffer(fs_info,
@@ -3667,6 +3764,7 @@
 		if (existing_eb) {
 			/* The extent buffer still exists, we can use it directly. */
 			*found_eb_ret = existing_eb;
+			spin_unlock(&mapping->i_private_lock);
 			folio_unlock(existing_folio);
 			folio_put(existing_folio);
 			return 1;
@@ -3675,6 +3773,22 @@
 		__free_page(folio_page(eb->folios[i], 0));
 		eb->folios[i] = existing_folio;
 	}
+	eb->folio_size = folio_size(eb->folios[i]);
+	eb->folio_shift = folio_shift(eb->folios[i]);
+	/* Should not fail, as we have preallocated the memory. */
+	ret = attach_extent_buffer_folio(eb, eb->folios[i], prealloc);
+	ASSERT(!ret);
+	/*
+	 * To inform we have an extra eb under allocation, so that
+	 * detach_extent_buffer_page() won't release the folio private when the
+	 * eb hasn't been inserted into radix tree yet.
+	 *
+	 * The ref will be decreased when the eb releases the page, in
+	 * detach_extent_buffer_page().  Thus needs no special handling in the
+	 * error path.
+	 */
+	btrfs_folio_inc_eb_refs(fs_info, eb->folios[i]);
+	spin_unlock(&mapping->i_private_lock);
 	return 0;
 }
 
@@ -3686,7 +3800,6 @@
 	int attached = 0;
 	struct extent_buffer *eb;
 	struct extent_buffer *existing_eb = NULL;
-	struct address_space *mapping = fs_info->btree_inode->i_mapping;
 	struct btrfs_subpage *prealloc = NULL;
 	u64 lockdep_owner = owner_root;
 	bool page_contig = true;
@@ -3752,7 +3865,7 @@
 	for (int i = 0; i < num_folios; i++) {
 		struct folio *folio;
 
-		ret = attach_eb_folio_to_filemap(eb, i, &existing_eb);
+		ret = attach_eb_folio_to_filemap(eb, i, prealloc, &existing_eb);
 		if (ret > 0) {
 			ASSERT(existing_eb);
 			goto out;
@@ -3789,22 +3902,6 @@
 		 * and free the allocated page.
 		 */
 		folio = eb->folios[i];
-		spin_lock(&mapping->i_private_lock);
-		/* Should not fail, as we have preallocated the memory */
-		ret = attach_extent_buffer_folio(eb, folio, prealloc);
-		ASSERT(!ret);
-		/*
-		 * To inform we have extra eb under allocation, so that
-		 * detach_extent_buffer_page() won't release the folio private
-		 * when the eb hasn't yet been inserted into radix tree.
-		 *
-		 * The ref will be decreased when the eb released the page, in
-		 * detach_extent_buffer_page().
-		 * Thus needs no special handling in error path.
-		 */
-		btrfs_folio_inc_eb_refs(fs_info, folio);
-		spin_unlock(&mapping->i_private_lock);
-
 		WARN_ON(btrfs_folio_test_dirty(fs_info, folio, eb->start, eb->len));
 
 		/*
@@ -4037,7 +4134,7 @@
 	 * The actual zeroout of the buffer will happen later in
 	 * btree_csum_one_bio.
 	 */
-	if (btrfs_is_zoned(fs_info)) {
+	if (btrfs_is_zoned(fs_info) && test_bit(EXTENT_BUFFER_DIRTY, &eb->bflags)) {
 		set_bit(EXTENT_BUFFER_ZONED_ZEROOUT, &eb->bflags);
 		return;
 	}
@@ -4216,6 +4313,19 @@
 	if (test_and_set_bit(EXTENT_BUFFER_READING, &eb->bflags))
 		goto done;
 
+	/*
+	 * Between the initial test_bit(EXTENT_BUFFER_UPTODATE) and the above
+	 * test_and_set_bit(EXTENT_BUFFER_READING), someone else could have
+	 * started and finished reading the same eb.  In this case, UPTODATE
+	 * will now be set, and we shouldn't read it in again.
+	 */
+	if (unlikely(test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags))) {
+		clear_bit(EXTENT_BUFFER_READING, &eb->bflags);
+		smp_mb__after_atomic();
+		wake_up_bit(&eb->bflags, EXTENT_BUFFER_READING);
+		return 0;
+	}
+
 	clear_bit(EXTENT_BUFFER_READ_ERR, &eb->bflags);
 	eb->read_mirror = 0;
 	check_buffer_tree_ref(eb);
@@ -4238,7 +4348,7 @@
 		for (int i = 0; i < num_folios; i++) {
 			struct folio *folio = eb->folios[i];
 
-			ret = bio_add_folio(&bbio->bio, folio, folio_size(folio), 0);
+			ret = bio_add_folio(&bbio->bio, folio, eb->folio_size, 0);
 			ASSERT(ret);
 		}
 	}
@@ -4258,7 +4368,7 @@
 			    unsigned long len)
 {
 	btrfs_warn(eb->fs_info,
-		"access to eb bytenr %llu len %lu out of range start %lu len %lu",
+		"access to eb bytenr %llu len %u out of range start %lu len %lu",
 		eb->start, eb->len, start, len);
 	WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
 
@@ -4287,7 +4397,7 @@
 void read_extent_buffer(const struct extent_buffer *eb, void *dstv,
 			unsigned long start, unsigned long len)
 {
-	const int unit_size = folio_size(eb->folios[0]);
+	const int unit_size = eb->folio_size;
 	size_t cur;
 	size_t offset;
 	char *dst = (char *)dstv;
@@ -4327,7 +4437,7 @@
 				       void __user *dstv,
 				       unsigned long start, unsigned long len)
 {
-	const int unit_size = folio_size(eb->folios[0]);
+	const int unit_size = eb->folio_size;
 	size_t cur;
 	size_t offset;
 	char __user *dst = (char __user *)dstv;
@@ -4367,7 +4477,7 @@
 int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv,
 			 unsigned long start, unsigned long len)
 {
-	const int unit_size = folio_size(eb->folios[0]);
+	const int unit_size = eb->folio_size;
 	size_t cur;
 	size_t offset;
 	char *kaddr;
@@ -4438,7 +4548,7 @@
 				  const void *srcv, unsigned long start,
 				  unsigned long len, bool use_memmove)
 {
-	const int unit_size = folio_size(eb->folios[0]);
+	const int unit_size = eb->folio_size;
 	size_t cur;
 	size_t offset;
 	char *kaddr;
@@ -4487,7 +4597,7 @@
 static void memset_extent_buffer(const struct extent_buffer *eb, int c,
 				 unsigned long start, unsigned long len)
 {
-	const int unit_size = folio_size(eb->folios[0]);
+	const int unit_size = eb->folio_size;
 	unsigned long cur = start;
 
 	if (eb->addr) {
@@ -4518,7 +4628,7 @@
 void copy_extent_buffer_full(const struct extent_buffer *dst,
 			     const struct extent_buffer *src)
 {
-	const int unit_size = folio_size(src->folios[0]);
+	const int unit_size = src->folio_size;
 	unsigned long cur = 0;
 
 	ASSERT(dst->len == src->len);
@@ -4540,7 +4650,7 @@
 			unsigned long dst_offset, unsigned long src_offset,
 			unsigned long len)
 {
-	const int unit_size = folio_size(dst->folios[0]);
+	const int unit_size = dst->folio_size;
 	u64 dst_len = dst->len;
 	size_t cur;
 	size_t offset;
@@ -4596,10 +4706,10 @@
 	 * the bitmap item in the extent buffer + the offset of the byte in the
 	 * bitmap item.
 	 */
-	offset = start + offset_in_folio(eb->folios[0], eb->start) + byte_offset;
+	offset = start + offset_in_eb_folio(eb, eb->start) + byte_offset;
 
-	*folio_index = offset >> folio_shift(eb->folios[0]);
-	*folio_offset = offset_in_folio(eb->folios[0], offset);
+	*folio_index = offset >> eb->folio_shift;
+	*folio_offset = offset_in_eb_folio(eb, offset);
 }
 
 /*
@@ -4713,7 +4823,7 @@
 			  unsigned long dst_offset, unsigned long src_offset,
 			  unsigned long len)
 {
-	const int unit_size = folio_size(dst->folios[0]);
+	const int unit_size = dst->folio_size;
 	unsigned long cur_off = 0;
 
 	if (check_eb_range(dst, dst_offset, len) ||
@@ -4837,7 +4947,7 @@
 
 static int try_release_subpage_extent_buffer(struct page *page)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(page->mapping->host->i_sb);
+	struct btrfs_fs_info *fs_info = page_to_fs_info(page);
 	u64 cur = page_offset(page);
 	const u64 end = page_offset(page) + PAGE_SIZE;
 	int ret;
@@ -4910,7 +5020,7 @@
 	struct folio *folio = page_folio(page);
 	struct extent_buffer *eb;
 
-	if (btrfs_sb(page->mapping->host->i_sb)->nodesize < PAGE_SIZE)
+	if (page_to_fs_info(page)->nodesize < PAGE_SIZE)
 		return try_release_subpage_extent_buffer(page);
 
 	/*
--- linux-qcom-6.8.0.orig/fs/btrfs/extent_io.h
+++ linux-qcom-6.8.0/fs/btrfs/extent_io.h
@@ -8,6 +8,7 @@
 #include <linux/fiemap.h>
 #include <linux/btrfs_tree.h>
 #include "compression.h"
+#include "messages.h"
 #include "ulist.h"
 #include "misc.h"
 
@@ -75,7 +76,8 @@
 #define INLINE_EXTENT_BUFFER_PAGES     (BTRFS_MAX_METADATA_BLOCKSIZE / PAGE_SIZE)
 struct extent_buffer {
 	u64 start;
-	unsigned long len;
+	u32 len;
+	u32 folio_size;
 	unsigned long bflags;
 	struct btrfs_fs_info *fs_info;
 
@@ -90,6 +92,7 @@
 	int read_mirror;
 	/* >= 0 if eb belongs to a log tree, -1 otherwise */
 	s8 log_index;
+	u8 folio_shift;
 	struct rcu_head rcu_head;
 
 	struct rw_semaphore lock;
@@ -113,6 +116,13 @@
 	struct btrfs_block_group *zoned_bg;
 };
 
+static inline unsigned long offset_in_eb_folio(const struct extent_buffer *eb,
+					       u64 start)
+{
+	ASSERT(eb->folio_size);
+	return start & (eb->folio_size - 1);
+}
+
 /*
  * Get the correct offset inside the page of extent buffer.
  *
@@ -151,13 +161,13 @@
 	 *	   the folio_shift would be large enough to always make us
 	 *	   return 0 as index.
 	 *    1.2) Several page sized folios
-	 *         The folio_shift() would be PAGE_SHIFT, giving us the correct
+	 *         The folio_shift would be PAGE_SHIFT, giving us the correct
 	 *         index.
 	 *
 	 * 2) sectorsize < PAGE_SIZE and nodesize < PAGE_SIZE case
 	 *    The folio would only be page sized, and always give us 0 as index.
 	 */
-	return offset >> folio_shift(eb->folios[0]);
+	return offset >> eb->folio_shift;
 }
 
 /*
@@ -221,6 +231,7 @@
 void extent_readahead(struct readahead_control *rac);
 int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
 		  u64 start, u64 len);
+int set_folio_extent_mapped(struct folio *folio);
 int set_page_extent_mapped(struct page *page);
 void clear_page_extent_mapped(struct page *page);
 
--- linux-qcom-6.8.0.orig/fs/btrfs/extent_map.c
+++ linux-qcom-6.8.0/fs/btrfs/extent_map.c
@@ -215,7 +215,12 @@
 	if (extent_map_end(prev) != next->start)
 		return false;
 
-	if (prev->flags != next->flags)
+	/*
+	 * The merged flag is not an on-disk flag, it just indicates we had the
+	 * extent maps of 2 (or more) adjacent extents merged, so factor it out.
+	 */
+	if ((prev->flags & ~EXTENT_FLAG_MERGED) !=
+	    (next->flags & ~EXTENT_FLAG_MERGED))
 		return false;
 
 	if (next->block_start < EXTENT_MAP_LAST_BYTE - 1)
@@ -291,6 +296,10 @@
  * Called after an extent has been written to disk properly.  Set the generation
  * to the generation that actually added the file item to the inode so we know
  * we need to sync this extent when we call fsync().
+ *
+ * Returns: 0	     on success
+ * 	    -ENOENT  when the extent is not found in the tree
+ * 	    -EUCLEAN if the found extent does not match the expected start
  */
 int unpin_extent_cache(struct btrfs_inode *inode, u64 start, u64 len, u64 gen)
 {
@@ -307,15 +316,19 @@
 		btrfs_warn(fs_info,
 "no extent map found for inode %llu (root %lld) when unpinning extent range [%llu, %llu), generation %llu",
 			   btrfs_ino(inode), btrfs_root_id(inode->root),
-			   start, len, gen);
+			   start, start + len, gen);
+		ret = -ENOENT;
 		goto out;
 	}
 
-	if (WARN_ON(em->start != start))
+	if (WARN_ON(em->start != start)) {
 		btrfs_warn(fs_info,
 "found extent map for inode %llu (root %lld) with unexpected start offset %llu when unpinning extent range [%llu, %llu), generation %llu",
 			   btrfs_ino(inode), btrfs_root_id(inode->root),
-			   em->start, start, len, gen);
+			   em->start, start, start + len, gen);
+		ret = -EUCLEAN;
+		goto out;
+	}
 
 	em->generation = gen;
 	em->flags &= ~EXTENT_FLAG_PINNED;
@@ -334,9 +347,9 @@
 		em->mod_len = em->len;
 	}
 
-	free_extent_map(em);
 out:
 	write_unlock(&tree->lock);
+	free_extent_map(em);
 	return ret;
 
 }
@@ -810,7 +823,7 @@
 					split->block_len = em->block_len;
 					split->orig_start = em->orig_start;
 				} else {
-					const u64 diff = start + len - em->start;
+					const u64 diff = end - em->start;
 
 					split->block_len = split->len;
 					split->block_start += diff;
--- linux-qcom-6.8.0.orig/fs/btrfs/file.c
+++ linux-qcom-6.8.0/fs/btrfs/file.c
@@ -1137,7 +1137,7 @@
 {
 	struct file *file = iocb->ki_filp;
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	loff_t pos = iocb->ki_pos;
 	int ret;
 	loff_t oldsize;
@@ -1185,7 +1185,7 @@
 	struct file *file = iocb->ki_filp;
 	loff_t pos;
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct page **pages = NULL;
 	struct extent_changeset *data_reserved = NULL;
 	u64 release_bytes = 0;
@@ -1461,7 +1461,7 @@
 {
 	struct file *file = iocb->ki_filp;
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	loff_t pos;
 	ssize_t written = 0;
 	ssize_t written_buffered;
@@ -1542,21 +1542,27 @@
 	 * So here we disable page faults in the iov_iter and then retry if we
 	 * got -EFAULT, faulting in the pages before the retry.
 	 */
+again:
 	from->nofault = true;
 	dio = btrfs_dio_write(iocb, from, written);
 	from->nofault = false;
 
-	/*
-	 * iomap_dio_complete() will call btrfs_sync_file() if we have a dsync
-	 * iocb, and that needs to lock the inode. So unlock it before calling
-	 * iomap_dio_complete() to avoid a deadlock.
-	 */
-	btrfs_inode_unlock(BTRFS_I(inode), ilock_flags);
-
-	if (IS_ERR_OR_NULL(dio))
+	if (IS_ERR_OR_NULL(dio)) {
 		err = PTR_ERR_OR_ZERO(dio);
-	else
+	} else {
+		/*
+		 * If we have a synchoronous write, we must make sure the fsync
+		 * triggered by the iomap_dio_complete() call below doesn't
+		 * deadlock on the inode lock - we are already holding it and we
+		 * can't call it after unlocking because we may need to complete
+		 * partial writes due to the input buffer (or parts of it) not
+		 * being already faulted in.
+		 */
+		ASSERT(current->journal_info == NULL);
+		current->journal_info = BTRFS_TRANS_DIO_WRITE_STUB;
 		err = iomap_dio_complete(dio);
+		current->journal_info = NULL;
+	}
 
 	/* No increment (+=) because iomap returns a cumulative value. */
 	if (err > 0)
@@ -1583,10 +1589,12 @@
 		} else {
 			fault_in_iov_iter_readable(from, left);
 			prev_left = left;
-			goto relock;
+			goto again;
 		}
 	}
 
+	btrfs_inode_unlock(BTRFS_I(inode), ilock_flags);
+
 	/*
 	 * If 'err' is -ENOTBLK or we have not written all data, then it means
 	 * we must fallback to buffered IO.
@@ -1787,13 +1795,20 @@
 {
 	struct dentry *dentry = file_dentry(file);
 	struct inode *inode = d_inode(dentry);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_trans_handle *trans;
 	struct btrfs_log_ctx ctx;
 	int ret = 0, err;
 	u64 len;
 	bool full_sync;
+	bool skip_ilock = false;
+
+	if (current->journal_info == BTRFS_TRANS_DIO_WRITE_STUB) {
+		skip_ilock = true;
+		current->journal_info = NULL;
+		btrfs_assert_inode_locked(BTRFS_I(inode));
+	}
 
 	trace_btrfs_sync_file(file, datasync);
 
@@ -1821,7 +1836,10 @@
 	if (ret)
 		goto out;
 
-	btrfs_inode_lock(BTRFS_I(inode), BTRFS_ILOCK_MMAP);
+	if (skip_ilock)
+		down_write(&BTRFS_I(inode)->i_mmap_lock);
+	else
+		btrfs_inode_lock(BTRFS_I(inode), BTRFS_ILOCK_MMAP);
 
 	atomic_inc(&root->log_batch);
 
@@ -1845,7 +1863,10 @@
 	 */
 	ret = start_ordered_ops(inode, start, end);
 	if (ret) {
-		btrfs_inode_unlock(BTRFS_I(inode), BTRFS_ILOCK_MMAP);
+		if (skip_ilock)
+			up_write(&BTRFS_I(inode)->i_mmap_lock);
+		else
+			btrfs_inode_unlock(BTRFS_I(inode), BTRFS_ILOCK_MMAP);
 		goto out;
 	}
 
@@ -1877,6 +1898,7 @@
 	 */
 	if (full_sync || btrfs_is_zoned(fs_info)) {
 		ret = btrfs_wait_ordered_range(inode, start, len);
+		clear_bit(BTRFS_INODE_COW_WRITE_ERROR, &BTRFS_I(inode)->runtime_flags);
 	} else {
 		/*
 		 * Get our ordered extents as soon as possible to avoid doing
@@ -1886,6 +1908,21 @@
 		btrfs_get_ordered_extents_for_logging(BTRFS_I(inode),
 						      &ctx.ordered_extents);
 		ret = filemap_fdatawait_range(inode->i_mapping, start, end);
+		if (ret)
+			goto out_release_extents;
+
+		/*
+		 * Check and clear the BTRFS_INODE_COW_WRITE_ERROR now after
+		 * starting and waiting for writeback, because for buffered IO
+		 * it may have been set during the end IO callback
+		 * (end_bbio_data_write() -> btrfs_finish_ordered_extent()) in
+		 * case an error happened and we need to wait for ordered
+		 * extents to complete so that any extent maps that point to
+		 * unwritten locations are dropped and we don't log them.
+		 */
+		if (test_and_clear_bit(BTRFS_INODE_COW_WRITE_ERROR,
+				       &BTRFS_I(inode)->runtime_flags))
+			ret = btrfs_wait_ordered_range(inode, start, len);
 	}
 
 	if (ret)
@@ -1947,7 +1984,10 @@
 	 * file again, but that will end up using the synchronization
 	 * inside btrfs_sync_log to keep things safe.
 	 */
-	btrfs_inode_unlock(BTRFS_I(inode), BTRFS_ILOCK_MMAP);
+	if (skip_ilock)
+		up_write(&BTRFS_I(inode)->i_mmap_lock);
+	else
+		btrfs_inode_unlock(BTRFS_I(inode), BTRFS_ILOCK_MMAP);
 
 	if (ret == BTRFS_NO_LOG_SYNC) {
 		ret = btrfs_end_transaction(trans);
@@ -2015,7 +2055,10 @@
 
 out_release_extents:
 	btrfs_release_log_ctx_extents(&ctx);
-	btrfs_inode_unlock(BTRFS_I(inode), BTRFS_ILOCK_MMAP);
+	if (skip_ilock)
+		up_write(&BTRFS_I(inode)->i_mmap_lock);
+	else
+		btrfs_inode_unlock(BTRFS_I(inode), BTRFS_ILOCK_MMAP);
 	goto out;
 }
 
@@ -2593,7 +2636,7 @@
 static int btrfs_punch_hole(struct file *file, loff_t offset, loff_t len)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct extent_state *cached_state = NULL;
 	struct btrfs_path *path;
@@ -3049,7 +3092,7 @@
 	int ret;
 
 	/* Do not allow fallocate in ZONED mode */
-	if (btrfs_is_zoned(btrfs_sb(inode->i_sb)))
+	if (btrfs_is_zoned(inode_to_fs_info(inode)))
 		return -EOPNOTSUPP;
 
 	alloc_start = round_down(offset, blocksize);
@@ -3460,7 +3503,7 @@
 static loff_t find_desired_extent(struct file *file, loff_t offset, int whence)
 {
 	struct btrfs_inode *inode = BTRFS_I(file->f_mapping->host);
-	struct btrfs_file_private *private = file->private_data;
+	struct btrfs_file_private *private;
 	struct btrfs_fs_info *fs_info = inode->root->fs_info;
 	struct extent_state *cached_state = NULL;
 	struct extent_state **delalloc_cached_state;
@@ -3488,7 +3531,19 @@
 	    inode_get_bytes(&inode->vfs_inode) == i_size)
 		return i_size;
 
-	if (!private) {
+	spin_lock(&inode->lock);
+	private = file->private_data;
+	spin_unlock(&inode->lock);
+
+	if (private && private->owner_task != current) {
+		/*
+		 * Not allocated by us, don't use it as its cached state is used
+		 * by the task that allocated it and we don't want neither to
+		 * mess with it nor get incorrect results because it reflects an
+		 * invalid state for the current task.
+		 */
+		private = NULL;
+	} else if (!private) {
 		private = kzalloc(sizeof(*private), GFP_KERNEL);
 		/*
 		 * No worries if memory allocation failed.
@@ -3496,7 +3551,23 @@
 		 * lseek SEEK_HOLE/DATA calls to a file when there's delalloc,
 		 * so everything will still be correct.
 		 */
-		file->private_data = private;
+		if (private) {
+			bool free = false;
+
+			private->owner_task = current;
+
+			spin_lock(&inode->lock);
+			if (file->private_data)
+				free = true;
+			else
+				file->private_data = private;
+			spin_unlock(&inode->lock);
+
+			if (free) {
+				kfree(private);
+				private = NULL;
+			}
+		}
 	}
 
 	if (private)
@@ -3754,7 +3825,7 @@
 	if (fsverity_active(inode))
 		return 0;
 
-	if (check_direct_read(btrfs_sb(inode->i_sb), to, iocb->ki_pos))
+	if (check_direct_read(inode_to_fs_info(inode), to, iocb->ki_pos))
 		return 0;
 
 	btrfs_inode_lock(BTRFS_I(inode), BTRFS_ILOCK_SHARED);
--- linux-qcom-6.8.0.orig/fs/btrfs/free-space-cache.c
+++ linux-qcom-6.8.0/fs/btrfs/free-space-cache.c
@@ -399,7 +399,7 @@
 		return -ENOMEM;
 
 	io_ctl->num_pages = num_pages;
-	io_ctl->fs_info = btrfs_sb(inode->i_sb);
+	io_ctl->fs_info = inode_to_fs_info(inode);
 	io_ctl->inode = inode;
 
 	return 0;
@@ -860,6 +860,7 @@
 				spin_unlock(&ctl->tree_lock);
 				btrfs_err(fs_info,
 					"Duplicate entries in free space cache, dumping");
+				kmem_cache_free(btrfs_free_space_bitmap_cachep, e->bitmap);
 				kmem_cache_free(btrfs_free_space_cachep, e);
 				goto free_cache;
 			}
@@ -1913,9 +1914,9 @@
 		ctl->free_space -= bytes;
 }
 
-static void bitmap_set_bits(struct btrfs_free_space_ctl *ctl,
-			    struct btrfs_free_space *info, u64 offset,
-			    u64 bytes)
+static void btrfs_bitmap_set_bits(struct btrfs_free_space_ctl *ctl,
+				  struct btrfs_free_space *info, u64 offset,
+				  u64 bytes)
 {
 	unsigned long start, count, end;
 	int extent_delta = 1;
@@ -2251,7 +2252,7 @@
 
 	bytes_to_set = min(end - offset, bytes);
 
-	bitmap_set_bits(ctl, info, offset, bytes_to_set);
+	btrfs_bitmap_set_bits(ctl, info, offset, bytes_to_set);
 
 	return bytes_to_set;
 
@@ -2699,15 +2700,16 @@
 	u64 offset = bytenr - block_group->start;
 	u64 to_free, to_unusable;
 	int bg_reclaim_threshold = 0;
-	bool initial = (size == block_group->length);
+	bool initial;
 	u64 reclaimable_unusable;
 
-	WARN_ON(!initial && offset + size > block_group->zone_capacity);
+	spin_lock(&block_group->lock);
 
+	initial = ((size == block_group->length) && (block_group->alloc_offset == 0));
+	WARN_ON(!initial && offset + size > block_group->zone_capacity);
 	if (!initial)
 		bg_reclaim_threshold = READ_ONCE(sinfo->bg_reclaim_threshold);
 
-	spin_lock(&ctl->tree_lock);
 	if (!used)
 		to_free = size;
 	else if (initial)
@@ -2720,18 +2722,19 @@
 		to_free = offset + size - block_group->alloc_offset;
 	to_unusable = size - to_free;
 
+	spin_lock(&ctl->tree_lock);
 	ctl->free_space += to_free;
+	spin_unlock(&ctl->tree_lock);
 	/*
 	 * If the block group is read-only, we should account freed space into
 	 * bytes_readonly.
 	 */
-	if (!block_group->ro)
+	if (!block_group->ro) {
 		block_group->zone_unusable += to_unusable;
-	spin_unlock(&ctl->tree_lock);
+		WARN_ON(block_group->zone_unusable > block_group->length);
+	}
 	if (!used) {
-		spin_lock(&block_group->lock);
 		block_group->alloc_offset -= size;
-		spin_unlock(&block_group->lock);
 	}
 
 	reclaimable_unusable = block_group->zone_unusable -
@@ -2745,6 +2748,8 @@
 		btrfs_mark_bg_to_reclaim(block_group);
 	}
 
+	spin_unlock(&block_group->lock);
+
 	return 0;
 }
 
@@ -3807,7 +3812,7 @@
 		if (async && *total_trimmed)
 			break;
 
-		if (fatal_signal_pending(current)) {
+		if (btrfs_trim_interrupted()) {
 			ret = -ERESTARTSYS;
 			break;
 		}
@@ -3998,7 +4003,7 @@
 		}
 		block_group->discard_cursor = start;
 
-		if (fatal_signal_pending(current)) {
+		if (btrfs_trim_interrupted()) {
 			if (start != offset)
 				reset_trimming_bitmap(ctl, offset);
 			ret = -ERESTARTSYS;
--- linux-qcom-6.8.0.orig/fs/btrfs/free-space-cache.h
+++ linux-qcom-6.8.0/fs/btrfs/free-space-cache.h
@@ -6,6 +6,8 @@
 #ifndef BTRFS_FREE_SPACE_CACHE_H
 #define BTRFS_FREE_SPACE_CACHE_H
 
+#include <linux/freezer.h>
+
 /*
  * This is the trim state of an extent or bitmap.
  *
@@ -43,6 +45,11 @@
 	return (info->trim_state == BTRFS_TRIM_STATE_TRIMMING);
 }
 
+static inline bool btrfs_trim_interrupted(void)
+{
+	return fatal_signal_pending(current) || freezing(current);
+}
+
 /*
  * Deltas are an effective way to populate global statistics.  Give macro names
  * to make it clear what we're doing.  An example is discard_extents in
--- linux-qcom-6.8.0.orig/fs/btrfs/free-space-tree.c
+++ linux-qcom-6.8.0/fs/btrfs/free-space-tree.c
@@ -1289,10 +1289,14 @@
 	btrfs_tree_lock(free_space_root->node);
 	btrfs_clear_buffer_dirty(trans, free_space_root->node);
 	btrfs_tree_unlock(free_space_root->node);
-	btrfs_free_tree_block(trans, btrfs_root_id(free_space_root),
-			      free_space_root->node, 0, 1);
-
+	ret = btrfs_free_tree_block(trans, btrfs_root_id(free_space_root),
+				    free_space_root->node, 0, 1);
 	btrfs_put_root(free_space_root);
+	if (ret < 0) {
+		btrfs_abort_transaction(trans, ret);
+		btrfs_end_transaction(trans);
+		return ret;
+	}
 
 	return btrfs_commit_transaction(trans);
 
--- linux-qcom-6.8.0.orig/fs/btrfs/fs.h
+++ linux-qcom-6.8.0/fs/btrfs/fs.h
@@ -278,6 +278,8 @@
 
 	struct percpu_counter bio_counter;
 	wait_queue_head_t replace_wait;
+
+	struct task_struct *replace_task;
 };
 
 /*
@@ -829,6 +831,17 @@
 #endif
 };
 
+#define page_to_inode(_page)	(BTRFS_I(_Generic((_page),			\
+					  struct page *: (_page))->mapping->host))
+#define folio_to_inode(_folio)	(BTRFS_I(_Generic((_folio),			\
+					  struct folio *: (_folio))->mapping->host))
+
+#define page_to_fs_info(_page)	 (page_to_inode(_page)->root->fs_info)
+#define folio_to_fs_info(_folio) (folio_to_inode(_folio)->root->fs_info)
+
+#define inode_to_fs_info(_inode) (BTRFS_I(_Generic((_inode),			\
+					   struct inode *: (_inode)))->root->fs_info)
+
 static inline u64 btrfs_get_fs_generation(const struct btrfs_fs_info *fs_info)
 {
 	return READ_ONCE(fs_info->generation);
--- linux-qcom-6.8.0.orig/fs/btrfs/inode.c
+++ linux-qcom-6.8.0/fs/btrfs/inode.c
@@ -740,7 +740,8 @@
 	struct async_extent *async_extent;
 
 	async_extent = kmalloc(sizeof(*async_extent), GFP_NOFS);
-	BUG_ON(!async_extent); /* -ENOMEM */
+	if (!async_extent)
+		return -ENOMEM;
 	async_extent->start = start;
 	async_extent->ram_size = ram_size;
 	async_extent->compressed_size = compressed_size;
@@ -1027,8 +1028,9 @@
 	 * The async work queues will take care of doing actual allocation on
 	 * disk for these compressed pages, and will submit the bios.
 	 */
-	add_async_extent(async_chunk, start, total_in, total_compressed, pages,
-			 nr_pages, compress_type);
+	ret = add_async_extent(async_chunk, start, total_in, total_compressed, pages,
+			       nr_pages, compress_type);
+	BUG_ON(ret);
 	if (start + total_in < end) {
 		start += total_in;
 		cond_resched();
@@ -1040,8 +1042,9 @@
 	if (!btrfs_test_opt(fs_info, FORCE_COMPRESS) && !inode->prop_compress)
 		inode->flags |= BTRFS_INODE_NOCOMPRESS;
 cleanup_and_bail_uncompressed:
-	add_async_extent(async_chunk, start, end - start + 1, 0, NULL, 0,
-			 BTRFS_COMPRESS_NONE);
+	ret = add_async_extent(async_chunk, start, end - start + 1, 0, NULL, 0,
+			       BTRFS_COMPRESS_NONE);
+	BUG_ON(ret);
 free_pages:
 	if (pages) {
 		for (i = 0; i < nr_pages; i++) {
@@ -1144,13 +1147,13 @@
 				   0, *alloc_hint, &ins, 1, 1);
 	if (ret) {
 		/*
-		 * Here we used to try again by going back to non-compressed
-		 * path for ENOSPC.  But we can't reserve space even for
-		 * compressed size, how could it work for uncompressed size
-		 * which requires larger size?  So here we directly go error
-		 * path.
+		 * We can't reserve contiguous space for the compressed size.
+		 * Unlikely, but it's possible that we could have enough
+		 * non-contiguous space for the uncompressed size instead.  So
+		 * fall back to uncompressed.
 		 */
-		goto out_free;
+		submit_uncompressed_range(inode, async_extent, locked_page);
+		goto done;
 	}
 
 	/* Here we're doing allocation and writeback of the compressed pages */
@@ -1202,7 +1205,6 @@
 out_free_reserve:
 	btrfs_dec_block_group_reservations(fs_info, ins.objectid);
 	btrfs_free_reserved_extent(fs_info, ins.objectid, ins.offset, 1);
-out_free:
 	mapping_set_error(inode->vfs_inode.i_mapping, -EIO);
 	extent_clear_unlock_delalloc(inode, start, end,
 				     NULL, EXTENT_LOCKED | EXTENT_DELALLOC |
@@ -1554,6 +1556,7 @@
 					     locked_page,
 					     clear_bits,
 					     page_ops);
+		btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size, NULL);
 		start += cur_alloc_size;
 	}
 
@@ -1567,6 +1570,7 @@
 		clear_bits |= EXTENT_CLEAR_DATA_RESV;
 		extent_clear_unlock_delalloc(inode, start, end, locked_page,
 					     clear_bits, page_ops);
+		btrfs_qgroup_free_data(inode, NULL, start, end - start + 1, NULL);
 	}
 	return ret;
 }
@@ -2233,13 +2237,15 @@
 	 */
 	if (cow_start != (u64)-1)
 		cur_offset = cow_start;
-	if (cur_offset < end)
+	if (cur_offset < end) {
 		extent_clear_unlock_delalloc(inode, cur_offset, end,
 					     locked_page, EXTENT_LOCKED |
 					     EXTENT_DELALLOC | EXTENT_DEFRAG |
 					     EXTENT_DO_ACCOUNTING, PAGE_UNLOCK |
 					     PAGE_START_WRITEBACK |
 					     PAGE_END_WRITEBACK);
+		btrfs_qgroup_free_data(inode, NULL, cur_offset, end - cur_offset + 1, NULL);
+	}
 	btrfs_free_path(path);
 	return ret;
 }
@@ -2523,7 +2529,7 @@
 		 */
 		if (bits & EXTENT_CLEAR_META_RESV &&
 		    root != fs_info->tree_root)
-			btrfs_delalloc_release_metadata(inode, len, false);
+			btrfs_delalloc_release_metadata(inode, len, true);
 
 		/* For sanity tests. */
 		if (btrfs_is_testing(fs_info))
@@ -2829,7 +2835,7 @@
 int btrfs_writepage_cow_fixup(struct page *page)
 {
 	struct inode *inode = page->mapping->host;
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_writepage_fixup *fixup;
 
 	/* This page has ordered extent covering it already */
@@ -3127,8 +3133,13 @@
 						ordered_extent->disk_num_bytes);
 		}
 	}
-	unpin_extent_cache(inode, ordered_extent->file_offset,
-			   ordered_extent->num_bytes, trans->transid);
+	if (ret < 0) {
+		btrfs_abort_transaction(trans, ret);
+		goto out;
+	}
+
+	ret = unpin_extent_cache(inode, ordered_extent->file_offset,
+				 ordered_extent->num_bytes, trans->transid);
 	if (ret < 0) {
 		btrfs_abort_transaction(trans, ret);
 		goto out;
@@ -3254,7 +3265,7 @@
 
 int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered)
 {
-	if (btrfs_is_zoned(btrfs_sb(ordered->inode->i_sb)) &&
+	if (btrfs_is_zoned(inode_to_fs_info(ordered->inode)) &&
 	    !test_bit(BTRFS_ORDERED_IOERR, &ordered->flags) &&
 	    list_empty(&ordered->bioc_list))
 		btrfs_finish_ordered_zoned(ordered);
@@ -3739,7 +3750,7 @@
 static int btrfs_read_locked_inode(struct inode *inode,
 				   struct btrfs_path *in_path)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_path *path = in_path;
 	struct extent_buffer *leaf;
 	struct btrfs_inode_item *inode_item;
@@ -4158,6 +4169,7 @@
 
 	btrfs_i_size_write(dir, dir->vfs_inode.i_size - name->len * 2);
 	inode_inc_iversion(&inode->vfs_inode);
+	inode_set_ctime_current(&inode->vfs_inode);
 	inode_inc_iversion(&dir->vfs_inode);
  	inode_set_mtime_to_ts(&dir->vfs_inode, inode_set_ctime_current(&dir->vfs_inode));
 	ret = btrfs_update_inode(trans, dir);
@@ -4301,11 +4313,8 @@
 	 */
 	if (btrfs_ino(inode) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID) {
 		di = btrfs_search_dir_index_item(root, path, dir_ino, &fname.disk_name);
-		if (IS_ERR_OR_NULL(di)) {
-			if (!di)
-				ret = -ENOENT;
-			else
-				ret = PTR_ERR(di);
+		if (IS_ERR(di)) {
+			ret = PTR_ERR(di);
 			btrfs_abort_transaction(trans, ret);
 			goto out;
 		}
@@ -4383,7 +4392,14 @@
 	ret = btrfs_search_slot(NULL, fs_info->tree_root, &key, path, 0, 0);
 	if (ret < 0)
 		goto out;
-	BUG_ON(ret == 0);
+	if (ret == 0) {
+		/*
+		 * Key with offset -1 found, there would have to exist a root
+		 * with such id, but this is out of valid range.
+		 */
+		ret = -EUCLEAN;
+		goto out;
+	}
 
 	ret = 0;
 	if (path->slots[0] > 0) {
@@ -4464,13 +4480,14 @@
 
 int btrfs_delete_subvolume(struct btrfs_inode *dir, struct dentry *dentry)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(dentry->d_sb);
 	struct btrfs_root *root = dir->root;
+	struct btrfs_fs_info *fs_info = root->fs_info;
 	struct inode *inode = d_inode(dentry);
 	struct btrfs_root *dest = BTRFS_I(inode)->root;
 	struct btrfs_trans_handle *trans;
 	struct btrfs_block_rsv block_rsv;
 	u64 root_flags;
+	u64 qgroup_reserved = 0;
 	int ret;
 
 	down_write(&fs_info->subvol_sem);
@@ -4515,12 +4532,20 @@
 	ret = btrfs_subvolume_reserve_metadata(root, &block_rsv, 5, true);
 	if (ret)
 		goto out_undead;
+	qgroup_reserved = block_rsv.qgroup_rsv_reserved;
 
 	trans = btrfs_start_transaction(root, 0);
 	if (IS_ERR(trans)) {
 		ret = PTR_ERR(trans);
 		goto out_release;
 	}
+	ret = btrfs_record_root_in_trans(trans, root);
+	if (ret) {
+		btrfs_abort_transaction(trans, ret);
+		goto out_end_trans;
+	}
+	btrfs_qgroup_convert_reserved_meta(root, qgroup_reserved);
+	qgroup_reserved = 0;
 	trans->block_rsv = &block_rsv;
 	trans->bytes_reserved = block_rsv.size;
 
@@ -4579,7 +4604,9 @@
 	ret = btrfs_end_transaction(trans);
 	inode->i_flags |= S_DEAD;
 out_release:
-	btrfs_subvolume_release_metadata(root, &block_rsv);
+	btrfs_block_rsv_release(fs_info, &block_rsv, (u64)-1, NULL);
+	if (qgroup_reserved)
+		btrfs_qgroup_free_meta_prealloc(root, qgroup_reserved);
 out_undead:
 	if (ret) {
 		spin_lock(&dest->root_item_lock);
@@ -5019,7 +5046,7 @@
 		btrfs_drew_write_unlock(&root->snapshot_lock);
 		btrfs_end_transaction(trans);
 	} else {
-		struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+		struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 
 		if (btrfs_is_zoned(fs_info)) {
 			ret = btrfs_wait_ordered_range(inode,
@@ -5222,7 +5249,7 @@
 
 void btrfs_evict_inode(struct inode *inode)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info;
 	struct btrfs_trans_handle *trans;
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_block_rsv *rsv = NULL;
@@ -5236,6 +5263,7 @@
 		return;
 	}
 
+	fs_info = inode_to_fs_info(inode);
 	evict_inode_truncate_pages(inode);
 
 	if (inode->i_nlink &&
@@ -5661,11 +5689,11 @@
 
 struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dir);
 	struct inode *inode;
 	struct btrfs_root *root = BTRFS_I(dir)->root;
 	struct btrfs_root *sub_root = root;
-	struct btrfs_key location;
+	struct btrfs_key location = { 0 };
 	u8 di_type = 0;
 	int ret = 0;
 
@@ -6200,7 +6228,7 @@
 	struct inode *dir = args->dir;
 	struct inode *inode = args->inode;
 	const struct fscrypt_str *name = args->orphan ? NULL : &args->fname.disk_name;
-	struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dir);
 	struct btrfs_root *root;
 	struct btrfs_inode_item *inode_item;
 	struct btrfs_key *location;
@@ -6522,7 +6550,7 @@
 static int btrfs_create_common(struct inode *dir, struct dentry *dentry,
 			       struct inode *inode)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dir);
 	struct btrfs_root *root = BTRFS_I(dir)->root;
 	struct btrfs_new_inode_args new_inode_args = {
 		.dir = dir,
@@ -6592,7 +6620,7 @@
 	struct btrfs_trans_handle *trans = NULL;
 	struct btrfs_root *root = BTRFS_I(dir)->root;
 	struct inode *inode = d_inode(old_dentry);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct fscrypt_name fname;
 	u64 index;
 	int err;
@@ -7078,7 +7106,7 @@
 			      u64 *orig_start, u64 *orig_block_len,
 			      u64 *ram_bytes, bool nowait, bool strict)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct can_nocow_file_extent_args nocow_args = { 0 };
 	struct btrfs_path *path;
 	int ret;
@@ -7317,7 +7345,7 @@
 					 unsigned int iomap_flags)
 {
 	const bool nowait = (iomap_flags & IOMAP_NOWAIT);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct extent_map *em = *map;
 	int type;
 	u64 block_start, orig_start, orig_block_len, ram_bytes;
@@ -7457,7 +7485,7 @@
 		struct iomap *srcmap)
 {
 	struct iomap_iter *iter = container_of(iomap, struct iomap_iter, iomap);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct extent_map *em;
 	struct extent_state *cached_state = NULL;
 	struct btrfs_dio_data *dio_data = iter->private;
@@ -7903,7 +7931,7 @@
  */
 static void wait_subpage_spinlock(struct page *page)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(page->mapping->host->i_sb);
+	struct btrfs_fs_info *fs_info = page_to_fs_info(page);
 	struct folio *folio = page_folio(page);
 	struct btrfs_subpage *subpage;
 
@@ -7970,7 +7998,7 @@
 static void btrfs_invalidate_folio(struct folio *folio, size_t offset,
 				 size_t length)
 {
-	struct btrfs_inode *inode = BTRFS_I(folio->mapping->host);
+	struct btrfs_inode *inode = folio_to_inode(folio);
 	struct btrfs_fs_info *fs_info = inode->root->fs_info;
 	struct extent_io_tree *tree = &inode->io_tree;
 	struct extent_state *cached_state = NULL;
@@ -8154,7 +8182,7 @@
 	struct page *page = vmf->page;
 	struct folio *folio = page_folio(page);
 	struct inode *inode = file_inode(vmf->vma->vm_file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
 	struct btrfs_ordered_extent *ordered;
 	struct extent_state *cached_state = NULL;
@@ -8723,7 +8751,7 @@
 	u64 delalloc_bytes;
 	u64 inode_bytes;
 	struct inode *inode = d_inode(path->dentry);
-	u32 blocksize = inode->i_sb->s_blocksize;
+	u32 blocksize = btrfs_sb(inode->i_sb)->sectorsize;
 	u32 bi_flags = BTRFS_I(inode)->flags;
 	u32 bi_ro_flags = BTRFS_I(inode)->ro_flags;
 
@@ -8763,7 +8791,7 @@
 			      struct inode *new_dir,
 			      struct dentry *new_dentry)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(old_dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(old_dir);
 	struct btrfs_trans_handle *trans;
 	unsigned int trans_num_items;
 	struct btrfs_root *root = BTRFS_I(old_dir)->root;
@@ -9015,7 +9043,7 @@
 			struct inode *new_dir, struct dentry *new_dentry,
 			unsigned int flags)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(old_dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(old_dir);
 	struct btrfs_new_inode_args whiteout_args = {
 		.dir = old_dir,
 		.dentry = old_dentry,
@@ -9457,7 +9485,7 @@
 static int btrfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
 			 struct dentry *dentry, const char *symname)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dir);
 	struct btrfs_trans_handle *trans;
 	struct btrfs_root *root = BTRFS_I(dir)->root;
 	struct btrfs_path *path;
@@ -9638,7 +9666,7 @@
 				       loff_t actual_len, u64 *alloc_hint,
 				       struct btrfs_trans_handle *trans)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct extent_map *em;
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_key ins;
@@ -9790,7 +9818,7 @@
 static int btrfs_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
 			 struct file *file, umode_t mode)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dir);
 	struct btrfs_trans_handle *trans;
 	struct btrfs_root *root = BTRFS_I(dir)->root;
 	struct inode *inode;
@@ -10002,14 +10030,14 @@
 		 */
 		WRITE_ONCE(priv->status, bbio->bio.bi_status);
 	}
-	if (!atomic_dec_return(&priv->pending))
+	if (atomic_dec_and_test(&priv->pending))
 		wake_up(&priv->wait);
 	bio_put(&bbio->bio);
 }
 
 int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
-					  u64 file_offset, u64 disk_bytenr,
-					  u64 disk_io_size, struct page **pages)
+					  u64 disk_bytenr, u64 disk_io_size,
+					  struct page **pages)
 {
 	struct btrfs_fs_info *fs_info = inode->root->fs_info;
 	struct btrfs_encoded_read_private priv = {
@@ -10079,7 +10107,7 @@
 		goto out;
 		}
 
-	ret = btrfs_encoded_read_regular_fill_pages(inode, start, disk_bytenr,
+	ret = btrfs_encoded_read_regular_fill_pages(inode, disk_bytenr,
 						    disk_io_size, pages);
 	if (ret)
 		goto out;
@@ -10649,15 +10677,25 @@
 	struct btrfs_fs_info *fs_info = root->fs_info;
 	struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
 	struct extent_state *cached_state = NULL;
-	struct extent_map *em = NULL;
 	struct btrfs_chunk_map *map = NULL;
 	struct btrfs_device *device = NULL;
 	struct btrfs_swap_info bsi = {
 		.lowest_ppage = (sector_t)-1ULL,
 	};
+	struct btrfs_backref_share_check_ctx *backref_ctx = NULL;
+	struct btrfs_path *path = NULL;
 	int ret = 0;
 	u64 isize;
-	u64 start;
+	u64 prev_extent_end = 0;
+
+	/*
+	 * Acquire the inode's mmap lock to prevent races with memory mapped
+	 * writes, as they could happen after we flush delalloc below and before
+	 * we lock the extent range further below. The inode was already locked
+	 * up in the call chain.
+	 */
+	btrfs_assert_inode_locked(BTRFS_I(inode));
+	down_write(&BTRFS_I(inode)->i_mmap_lock);
 
 	/*
 	 * If the swap file was just created, make sure delalloc is done. If the
@@ -10666,22 +10704,32 @@
 	 */
 	ret = btrfs_wait_ordered_range(inode, 0, (u64)-1);
 	if (ret)
-		return ret;
+		goto out_unlock_mmap;
 
 	/*
 	 * The inode is locked, so these flags won't change after we check them.
 	 */
 	if (BTRFS_I(inode)->flags & BTRFS_INODE_COMPRESS) {
 		btrfs_warn(fs_info, "swapfile must not be compressed");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_unlock_mmap;
 	}
 	if (!(BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW)) {
 		btrfs_warn(fs_info, "swapfile must not be copy-on-write");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_unlock_mmap;
 	}
 	if (!(BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM)) {
 		btrfs_warn(fs_info, "swapfile must not be checksummed");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_unlock_mmap;
+	}
+
+	path = btrfs_alloc_path();
+	backref_ctx = btrfs_alloc_backref_share_check_ctx();
+	if (!path || !backref_ctx) {
+		ret = -ENOMEM;
+		goto out_unlock_mmap;
 	}
 
 	/*
@@ -10696,7 +10744,8 @@
 	if (!btrfs_exclop_start(fs_info, BTRFS_EXCLOP_SWAP_ACTIVATE)) {
 		btrfs_warn(fs_info,
 	   "cannot activate swapfile while exclusive operation is running");
-		return -EBUSY;
+		ret = -EBUSY;
+		goto out_unlock_mmap;
 	}
 
 	/*
@@ -10710,7 +10759,8 @@
 		btrfs_exclop_finish(fs_info);
 		btrfs_warn(fs_info,
 	   "cannot activate swapfile because snapshot creation is in progress");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_unlock_mmap;
 	}
 	/*
 	 * Snapshots can create extents which require COW even if NODATACOW is
@@ -10726,11 +10776,13 @@
 	if (btrfs_root_dead(root)) {
 		spin_unlock(&root->root_item_lock);
 
+		btrfs_drew_write_unlock(&root->snapshot_lock);
 		btrfs_exclop_finish(fs_info);
 		btrfs_warn(fs_info,
 		"cannot activate swapfile because subvolume %llu is being deleted",
 			root->root_key.objectid);
-		return -EPERM;
+		ret = -EPERM;
+		goto out_unlock_mmap;
 	}
 	atomic_inc(&root->nr_swapfiles);
 	spin_unlock(&root->root_item_lock);
@@ -10738,24 +10790,39 @@
 	isize = ALIGN_DOWN(inode->i_size, fs_info->sectorsize);
 
 	lock_extent(io_tree, 0, isize - 1, &cached_state);
-	start = 0;
-	while (start < isize) {
-		u64 logical_block_start, physical_block_start;
+	while (prev_extent_end < isize) {
+		struct btrfs_key key;
+		struct extent_buffer *leaf;
+		struct btrfs_file_extent_item *ei;
 		struct btrfs_block_group *bg;
-		u64 len = isize - start;
+		u64 logical_block_start;
+		u64 physical_block_start;
+		u64 extent_gen;
+		u64 disk_bytenr;
+		u64 len;
+
+		key.objectid = btrfs_ino(BTRFS_I(inode));
+		key.type = BTRFS_EXTENT_DATA_KEY;
+		key.offset = prev_extent_end;
 
-		em = btrfs_get_extent(BTRFS_I(inode), NULL, 0, start, len);
-		if (IS_ERR(em)) {
-			ret = PTR_ERR(em);
+		ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+		if (ret < 0)
 			goto out;
-		}
 
-		if (em->block_start == EXTENT_MAP_HOLE) {
+		/*
+		 * If key not found it means we have an implicit hole (NO_HOLES
+		 * is enabled).
+		 */
+		if (ret > 0) {
 			btrfs_warn(fs_info, "swapfile must not have holes");
 			ret = -EINVAL;
 			goto out;
 		}
-		if (em->block_start == EXTENT_MAP_INLINE) {
+
+		leaf = path->nodes[0];
+		ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_file_extent_item);
+
+		if (btrfs_file_extent_type(leaf, ei) == BTRFS_FILE_EXTENT_INLINE) {
 			/*
 			 * It's unlikely we'll ever actually find ourselves
 			 * here, as a file small enough to fit inline won't be
@@ -10767,23 +10834,45 @@
 			ret = -EINVAL;
 			goto out;
 		}
-		if (extent_map_is_compressed(em)) {
+
+		if (btrfs_file_extent_compression(leaf, ei) != BTRFS_COMPRESS_NONE) {
 			btrfs_warn(fs_info, "swapfile must not be compressed");
 			ret = -EINVAL;
 			goto out;
 		}
 
-		logical_block_start = em->block_start + (start - em->start);
-		len = min(len, em->len - (start - em->start));
-		free_extent_map(em);
-		em = NULL;
+		disk_bytenr = btrfs_file_extent_disk_bytenr(leaf, ei);
+		if (disk_bytenr == 0) {
+			btrfs_warn(fs_info, "swapfile must not have holes");
+			ret = -EINVAL;
+			goto out;
+		}
 
-		ret = can_nocow_extent(inode, start, &len, NULL, NULL, NULL, false, true);
+		logical_block_start = disk_bytenr + btrfs_file_extent_offset(leaf, ei);
+		extent_gen = btrfs_file_extent_generation(leaf, ei);
+		prev_extent_end = btrfs_file_extent_end(path);
+
+		if (prev_extent_end > isize)
+			len = isize - key.offset;
+		else
+			len = btrfs_file_extent_num_bytes(leaf, ei);
+
+		backref_ctx->curr_leaf_bytenr = leaf->start;
+
+		/*
+		 * Don't need the path anymore, release to avoid deadlocks when
+		 * calling btrfs_is_data_extent_shared() because when joining a
+		 * transaction it can block waiting for the current one's commit
+		 * which in turn may be trying to lock the same leaf to flush
+		 * delayed items for example.
+		 */
+		btrfs_release_path(path);
+
+		ret = btrfs_is_data_extent_shared(BTRFS_I(inode), disk_bytenr,
+						  extent_gen, backref_ctx);
 		if (ret < 0) {
 			goto out;
-		} else if (ret) {
-			ret = 0;
-		} else {
+		} else if (ret > 0) {
 			btrfs_warn(fs_info,
 				   "swapfile must not be copy-on-write");
 			ret = -EINVAL;
@@ -10818,7 +10907,6 @@
 
 		physical_block_start = (map->stripes[0].physical +
 					(logical_block_start - map->start));
-		len = min(len, map->chunk_len - (logical_block_start - map->start));
 		btrfs_free_chunk_map(map);
 		map = NULL;
 
@@ -10859,20 +10947,21 @@
 				if (ret)
 					goto out;
 			}
-			bsi.start = start;
+			bsi.start = key.offset;
 			bsi.block_start = physical_block_start;
 			bsi.block_len = len;
 		}
 
-		start += len;
+		if (fatal_signal_pending(current)) {
+			ret = -EINTR;
+			goto out;
+		}
 	}
 
 	if (bsi.block_len)
 		ret = btrfs_add_swap_extent(sis, &bsi);
 
 out:
-	if (!IS_ERR_OR_NULL(em))
-		free_extent_map(em);
 	if (!IS_ERR_OR_NULL(map))
 		btrfs_free_chunk_map(map);
 
@@ -10885,6 +10974,10 @@
 
 	btrfs_exclop_finish(fs_info);
 
+out_unlock_mmap:
+	up_write(&BTRFS_I(inode)->i_mmap_lock);
+	btrfs_free_backref_share_ctx(backref_ctx);
+	btrfs_free_path(path);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/fs/btrfs/ioctl.c
+++ linux-qcom-6.8.0/fs/btrfs/ioctl.c
@@ -247,7 +247,7 @@
 		       struct dentry *dentry, struct fileattr *fa)
 {
 	struct inode *inode = d_inode(dentry);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_inode *binode = BTRFS_I(inode);
 	struct btrfs_root *root = binode->root;
 	struct btrfs_trans_handle *trans;
@@ -528,18 +528,16 @@
 	 * block group is in the logical address space, which can be any
 	 * sectorsize aligned bytenr in  the range [0, U64_MAX].
 	 */
-	if (range.len < fs_info->sb->s_blocksize)
+	if (range.len < fs_info->sectorsize)
 		return -EINVAL;
 
 	range.minlen = max(range.minlen, minlen);
 	ret = btrfs_trim_fs(fs_info, &range);
-	if (ret < 0)
-		return ret;
 
 	if (copy_to_user(arg, &range, sizeof(range)))
 		return -EFAULT;
 
-	return 0;
+	return ret;
 }
 
 int __pure btrfs_is_empty_uuid(u8 *uuid)
@@ -584,7 +582,7 @@
 				  struct inode *dir, struct dentry *dentry,
 				  struct btrfs_qgroup_inherit *inherit)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dir);
 	struct btrfs_trans_handle *trans;
 	struct btrfs_key key;
 	struct btrfs_root_item *root_item;
@@ -603,6 +601,7 @@
 	int ret;
 	dev_t anon_dev;
 	u64 objectid;
+	u64 qgroup_reserved = 0;
 
 	root_item = kzalloc(sizeof(*root_item), GFP_KERNEL);
 	if (!root_item)
@@ -640,13 +639,18 @@
 					       trans_num_items, false);
 	if (ret)
 		goto out_new_inode_args;
+	qgroup_reserved = block_rsv.qgroup_rsv_reserved;
 
 	trans = btrfs_start_transaction(root, 0);
 	if (IS_ERR(trans)) {
 		ret = PTR_ERR(trans);
-		btrfs_subvolume_release_metadata(root, &block_rsv);
-		goto out_new_inode_args;
+		goto out_release_rsv;
 	}
+	ret = btrfs_record_root_in_trans(trans, BTRFS_I(dir)->root);
+	if (ret)
+		goto out;
+	btrfs_qgroup_convert_reserved_meta(root, qgroup_reserved);
+	qgroup_reserved = 0;
 	trans->block_rsv = &block_rsv;
 	trans->bytes_reserved = block_rsv.size;
 	/* Tree log can't currently deal with an inode which is a new root. */
@@ -703,6 +707,8 @@
 	ret = btrfs_insert_root(trans, fs_info->tree_root, &key,
 				root_item);
 	if (ret) {
+		int ret2;
+
 		/*
 		 * Since we don't abort the transaction in this case, free the
 		 * tree block so that we don't leak space and leave the
@@ -713,7 +719,9 @@
 		btrfs_tree_lock(leaf);
 		btrfs_clear_buffer_dirty(trans, leaf);
 		btrfs_tree_unlock(leaf);
-		btrfs_free_tree_block(trans, objectid, leaf, 0, 1);
+		ret2 = btrfs_free_tree_block(trans, objectid, leaf, 0, 1);
+		if (ret2 < 0)
+			btrfs_abort_transaction(trans, ret2);
 		free_extent_buffer(leaf);
 		goto out;
 	}
@@ -757,9 +765,11 @@
 out:
 	trans->block_rsv = NULL;
 	trans->bytes_reserved = 0;
-	btrfs_subvolume_release_metadata(root, &block_rsv);
-
 	btrfs_end_transaction(trans);
+out_release_rsv:
+	btrfs_block_rsv_release(fs_info, &block_rsv, (u64)-1, NULL);
+	if (qgroup_reserved)
+		btrfs_qgroup_free_meta_prealloc(root, qgroup_reserved);
 out_new_inode_args:
 	btrfs_new_inode_args_destroy(&new_inode_args);
 out_inode:
@@ -776,11 +786,13 @@
 			   struct dentry *dentry, bool readonly,
 			   struct btrfs_qgroup_inherit *inherit)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dir);
 	struct inode *inode;
 	struct btrfs_pending_snapshot *pending_snapshot;
 	unsigned int trans_num_items;
 	struct btrfs_trans_handle *trans;
+	struct btrfs_block_rsv *block_rsv;
+	u64 qgroup_reserved = 0;
 	int ret;
 
 	/* We do not support snapshotting right now. */
@@ -817,19 +829,19 @@
 		goto free_pending;
 	}
 
-	btrfs_init_block_rsv(&pending_snapshot->block_rsv,
-			     BTRFS_BLOCK_RSV_TEMP);
+	block_rsv = &pending_snapshot->block_rsv;
+	btrfs_init_block_rsv(block_rsv, BTRFS_BLOCK_RSV_TEMP);
 	/*
 	 * 1 to add dir item
 	 * 1 to add dir index
 	 * 1 to update parent inode item
 	 */
 	trans_num_items = create_subvol_num_items(inherit) + 3;
-	ret = btrfs_subvolume_reserve_metadata(BTRFS_I(dir)->root,
-					       &pending_snapshot->block_rsv,
+	ret = btrfs_subvolume_reserve_metadata(BTRFS_I(dir)->root, block_rsv,
 					       trans_num_items, false);
 	if (ret)
 		goto free_pending;
+	qgroup_reserved = block_rsv->qgroup_rsv_reserved;
 
 	pending_snapshot->dentry = dentry;
 	pending_snapshot->root = root;
@@ -842,6 +854,13 @@
 		ret = PTR_ERR(trans);
 		goto fail;
 	}
+	ret = btrfs_record_root_in_trans(trans, BTRFS_I(dir)->root);
+	if (ret) {
+		btrfs_end_transaction(trans);
+		goto fail;
+	}
+	btrfs_qgroup_convert_reserved_meta(root, qgroup_reserved);
+	qgroup_reserved = 0;
 
 	trans->pending_snapshot = pending_snapshot;
 
@@ -871,7 +890,9 @@
 	if (ret && pending_snapshot->snap)
 		pending_snapshot->snap->anon_dev = 0;
 	btrfs_put_root(pending_snapshot->snap);
-	btrfs_subvolume_release_metadata(root, &pending_snapshot->block_rsv);
+	btrfs_block_rsv_release(fs_info, block_rsv, (u64)-1, NULL);
+	if (qgroup_reserved)
+		btrfs_qgroup_free_meta_prealloc(root, qgroup_reserved);
 free_pending:
 	if (pending_snapshot->anon_dev)
 		free_anon_bdev(pending_snapshot->anon_dev);
@@ -962,7 +983,7 @@
 				   struct btrfs_qgroup_inherit *inherit)
 {
 	struct inode *dir = d_inode(parent->dentry);
-	struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dir);
 	struct dentry *dentry;
 	struct fscrypt_str name_str = FSTR_INIT((char *)name, namelen);
 	int error;
@@ -1097,7 +1118,7 @@
 {
 	BTRFS_DEV_LOOKUP_ARGS(args);
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	u64 new_size;
 	u64 old_size;
 	u64 devid = 1;
@@ -1362,7 +1383,7 @@
 	if (vol_args->flags & BTRFS_SUBVOL_RDONLY)
 		readonly = true;
 	if (vol_args->flags & BTRFS_SUBVOL_QGROUP_INHERIT) {
-		u64 nums;
+		struct btrfs_fs_info *fs_info = inode_to_fs_info(file_inode(file));
 
 		if (vol_args->size < sizeof(*inherit) ||
 		    vol_args->size > PAGE_SIZE) {
@@ -1375,19 +1396,9 @@
 			goto free_args;
 		}
 
-		if (inherit->num_qgroups > PAGE_SIZE ||
-		    inherit->num_ref_copies > PAGE_SIZE ||
-		    inherit->num_excl_copies > PAGE_SIZE) {
-			ret = -EINVAL;
-			goto free_inherit;
-		}
-
-		nums = inherit->num_qgroups + 2 * inherit->num_ref_copies +
-		       2 * inherit->num_excl_copies;
-		if (vol_args->size != struct_size(inherit, qgroups, nums)) {
-			ret = -EINVAL;
+		ret = btrfs_qgroup_check_inherit(fs_info, inherit, vol_args->size);
+		if (ret < 0)
 			goto free_inherit;
-		}
 	}
 
 	ret = __btrfs_ioctl_snap_create(file, file_mnt_idmap(file),
@@ -1405,7 +1416,7 @@
 static noinline int btrfs_ioctl_subvol_getflags(struct inode *inode,
 						void __user *arg)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	int ret = 0;
 	u64 flags = 0;
@@ -1428,7 +1439,7 @@
 					      void __user *arg)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_trans_handle *trans;
 	u64 root_flags;
@@ -1675,7 +1686,7 @@
 				 u64 *buf_size,
 				 char __user *ubuf)
 {
-	struct btrfs_fs_info *info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *info = inode_to_fs_info(inode);
 	struct btrfs_root *root;
 	struct btrfs_key key;
 	struct btrfs_path *path;
@@ -2346,9 +2357,9 @@
 					     bool destroy_v2)
 {
 	struct dentry *parent = file->f_path.dentry;
-	struct btrfs_fs_info *fs_info = btrfs_sb(parent->d_sb);
 	struct dentry *dentry;
 	struct inode *dir = d_inode(parent);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dir);
 	struct inode *inode;
 	struct btrfs_root *root = BTRFS_I(dir)->root;
 	struct btrfs_root *dest = NULL;
@@ -2696,7 +2707,7 @@
 {
 	BTRFS_DEV_LOOKUP_ARGS(args);
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_ioctl_vol_args_v2 *vol_args;
 	struct bdev_handle *bdev_handle = NULL;
 	int ret;
@@ -2761,7 +2772,7 @@
 {
 	BTRFS_DEV_LOOKUP_ARGS(args);
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_ioctl_vol_args *vol_args;
 	struct bdev_handle *bdev_handle = NULL;
 	int ret;
@@ -2904,7 +2915,7 @@
 static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_root *new_root;
 	struct btrfs_dir_item *di;
@@ -3178,7 +3189,7 @@
 
 static long btrfs_ioctl_scrub(struct file *file, void __user *arg)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(file_inode(file)->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(file_inode(file));
 	struct btrfs_ioctl_scrub_args *sa;
 	int ret;
 
@@ -3696,7 +3707,7 @@
 static long btrfs_ioctl_quota_ctl(struct file *file, void __user *arg)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_ioctl_quota_ctl_args *sa;
 	int ret;
 
@@ -3713,15 +3724,43 @@
 		goto drop_write;
 	}
 
-	down_write(&fs_info->subvol_sem);
-
 	switch (sa->cmd) {
 	case BTRFS_QUOTA_CTL_ENABLE:
 	case BTRFS_QUOTA_CTL_ENABLE_SIMPLE_QUOTA:
+		down_write(&fs_info->subvol_sem);
 		ret = btrfs_quota_enable(fs_info, sa);
+		up_write(&fs_info->subvol_sem);
 		break;
 	case BTRFS_QUOTA_CTL_DISABLE:
+		/*
+		 * Lock the cleaner mutex to prevent races with concurrent
+		 * relocation, because relocation may be building backrefs for
+		 * blocks of the quota root while we are deleting the root. This
+		 * is like dropping fs roots of deleted snapshots/subvolumes, we
+		 * need the same protection.
+		 *
+		 * This also prevents races between concurrent tasks trying to
+		 * disable quotas, because we will unlock and relock
+		 * qgroup_ioctl_lock across BTRFS_FS_QUOTA_ENABLED changes.
+		 *
+		 * We take this here because we have the dependency of
+		 *
+		 * inode_lock -> subvol_sem
+		 *
+		 * because of rename.  With relocation we can prealloc extents,
+		 * so that makes the dependency chain
+		 *
+		 * cleaner_mutex -> inode_lock -> subvol_sem
+		 *
+		 * so we must take the cleaner_mutex here before we take the
+		 * subvol_sem.  The deadlock can't actually happen, but this
+		 * quiets lockdep.
+		 */
+		mutex_lock(&fs_info->cleaner_mutex);
+		down_write(&fs_info->subvol_sem);
 		ret = btrfs_quota_disable(fs_info);
+		up_write(&fs_info->subvol_sem);
+		mutex_unlock(&fs_info->cleaner_mutex);
 		break;
 	default:
 		ret = -EINVAL;
@@ -3729,7 +3768,6 @@
 	}
 
 	kfree(sa);
-	up_write(&fs_info->subvol_sem);
 drop_write:
 	mnt_drop_write_file(file);
 	return ret;
@@ -3738,7 +3776,7 @@
 static long btrfs_ioctl_qgroup_assign(struct file *file, void __user *arg)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_ioctl_qgroup_assign_args *sa;
 	struct btrfs_trans_handle *trans;
@@ -3894,7 +3932,7 @@
 static long btrfs_ioctl_quota_rescan(struct file *file, void __user *arg)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_ioctl_quota_rescan_args *qsa;
 	int ret;
 
@@ -3958,7 +3996,7 @@
 					    struct btrfs_ioctl_received_subvol_args *sa)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_root_item *root_item = &root->root_item;
 	struct btrfs_trans_handle *trans;
@@ -4146,7 +4184,7 @@
 static int btrfs_ioctl_set_fslabel(struct file *file, void __user *arg)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_super_block *super_block = fs_info->super_copy;
 	struct btrfs_trans_handle *trans;
@@ -4289,7 +4327,7 @@
 static int btrfs_ioctl_set_features(struct file *file, void __user *arg)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_super_block *super_block = fs_info->super_copy;
 	struct btrfs_ioctl_feature_flags flags[2];
@@ -4580,7 +4618,7 @@
 		cmd, unsigned long arg)
 {
 	struct inode *inode = file_inode(file);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	void __user *argp = (void __user *)arg;
 
--- linux-qcom-6.8.0.orig/fs/btrfs/lzo.c
+++ linux-qcom-6.8.0/fs/btrfs/lzo.c
@@ -214,7 +214,7 @@
 		unsigned long *total_in, unsigned long *total_out)
 {
 	struct workspace *workspace = list_entry(ws, struct workspace, list);
-	const u32 sectorsize = btrfs_sb(mapping->host->i_sb)->sectorsize;
+	const u32 sectorsize = inode_to_fs_info(mapping->host)->sectorsize;
 	struct page *page_in = NULL;
 	char *sizes_ptr;
 	const unsigned long max_nr_page = *out_pages;
@@ -429,7 +429,7 @@
 		size_t destlen)
 {
 	struct workspace *workspace = list_entry(ws, struct workspace, list);
-	struct btrfs_fs_info *fs_info = btrfs_sb(dest_page->mapping->host->i_sb);
+	struct btrfs_fs_info *fs_info = page_to_fs_info(dest_page);
 	const u32 sectorsize = fs_info->sectorsize;
 	size_t in_len;
 	size_t out_len;
--- linux-qcom-6.8.0.orig/fs/btrfs/ordered-data.c
+++ linux-qcom-6.8.0/fs/btrfs/ordered-data.c
@@ -383,6 +383,37 @@
 	ret = can_finish_ordered_extent(ordered, page, file_offset, len, uptodate);
 	spin_unlock_irqrestore(&inode->ordered_tree_lock, flags);
 
+	/*
+	 * If this is a COW write it means we created new extent maps for the
+	 * range and they point to unwritten locations if we got an error either
+	 * before submitting a bio or during IO.
+	 *
+	 * We have marked the ordered extent with BTRFS_ORDERED_IOERR, and we
+	 * are queuing its completion below. During completion, at
+	 * btrfs_finish_one_ordered(), we will drop the extent maps for the
+	 * unwritten extents.
+	 *
+	 * However because completion runs in a work queue we can end up having
+	 * a fast fsync running before that. In the case of direct IO, once we
+	 * unlock the inode the fsync might start, and we queue the completion
+	 * before unlocking the inode. In the case of buffered IO when writeback
+	 * finishes (end_bbio_data_write()) we queue the completion, so if the
+	 * writeback was triggered by a fast fsync, the fsync might start
+	 * logging before ordered extent completion runs in the work queue.
+	 *
+	 * The fast fsync will log file extent items based on the extent maps it
+	 * finds, so if by the time it collects extent maps the ordered extent
+	 * completion didn't happen yet, it will log file extent items that
+	 * point to unwritten extents, resulting in a corruption if a crash
+	 * happens and the log tree is replayed. Note that a fast fsync does not
+	 * wait for completion of ordered extents in order to reduce latency.
+	 *
+	 * Set a flag in the inode so that the next fast fsync will wait for
+	 * ordered extents to complete before starting to log.
+	 */
+	if (!uptodate && !test_bit(BTRFS_ORDERED_NOCOW, &ordered->flags))
+		set_bit(BTRFS_INODE_COW_WRITE_ERROR, &inode->runtime_flags);
+
 	if (ret)
 		btrfs_queue_ordered_fn(ordered);
 	return ret;
@@ -944,7 +975,7 @@
 {
 	struct rb_node *n;
 
-	ASSERT(inode_is_locked(&inode->vfs_inode));
+	btrfs_assert_inode_locked(inode);
 
 	spin_lock_irq(&inode->ordered_tree_lock);
 	for (n = rb_first(&inode->ordered_tree); n; n = rb_next(n)) {
@@ -1189,6 +1220,7 @@
 	ordered->disk_bytenr += len;
 	ordered->num_bytes -= len;
 	ordered->disk_num_bytes -= len;
+	ordered->ram_bytes -= len;
 
 	if (test_bit(BTRFS_ORDERED_IO_DONE, &ordered->flags)) {
 		ASSERT(ordered->bytes_left == 0);
--- linux-qcom-6.8.0.orig/fs/btrfs/print-tree.c
+++ linux-qcom-6.8.0/fs/btrfs/print-tree.c
@@ -14,7 +14,7 @@
 
 struct root_name_map {
 	u64 id;
-	char name[16];
+	const char *name;
 };
 
 static const struct root_name_map root_map[] = {
--- linux-qcom-6.8.0.orig/fs/btrfs/props.c
+++ linux-qcom-6.8.0/fs/btrfs/props.c
@@ -302,7 +302,7 @@
 static int prop_compression_apply(struct inode *inode, const char *value,
 				  size_t len)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	int type;
 
 	/* Reset to defaults */
--- linux-qcom-6.8.0.orig/fs/btrfs/qgroup.c
+++ linux-qcom-6.8.0/fs/btrfs/qgroup.c
@@ -468,6 +468,7 @@
 		}
 		if (!qgroup) {
 			struct btrfs_qgroup *prealloc;
+			struct btrfs_root *tree_root = fs_info->tree_root;
 
 			prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL);
 			if (!prealloc) {
@@ -475,6 +476,25 @@
 				goto out;
 			}
 			qgroup = add_qgroup_rb(fs_info, prealloc, found_key.offset);
+			/*
+			 * If a qgroup exists for a subvolume ID, it is possible
+			 * that subvolume has been deleted, in which case
+			 * re-using that ID would lead to incorrect accounting.
+			 *
+			 * Ensure that we skip any such subvol ids.
+			 *
+			 * We don't need to lock because this is only called
+			 * during mount before we start doing things like creating
+			 * subvolumes.
+			 */
+			if (is_fstree(qgroup->qgroupid) &&
+			    qgroup->qgroupid > tree_root->free_objectid)
+				/*
+				 * Don't need to check against BTRFS_LAST_FREE_OBJECTID,
+				 * as it will get checked on the next call to
+				 * btrfs_get_free_objectid.
+				 */
+				tree_root->free_objectid = qgroup->qgroupid + 1;
 		}
 		ret = btrfs_sysfs_add_one_qgroup(fs_info, qgroup);
 		if (ret < 0)
@@ -1112,6 +1132,7 @@
 	fs_info->qgroup_flags = BTRFS_QGROUP_STATUS_FLAG_ON;
 	if (simple) {
 		fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE;
+		btrfs_set_fs_incompat(fs_info, SIMPLE_QUOTA);
 		btrfs_set_qgroup_status_enable_gen(leaf, ptr, trans->transid);
 	} else {
 		fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT;
@@ -1245,8 +1266,6 @@
 	spin_lock(&fs_info->qgroup_lock);
 	fs_info->quota_root = quota_root;
 	set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
-	if (simple)
-		btrfs_set_fs_incompat(fs_info, SIMPLE_QUOTA);
 	spin_unlock(&fs_info->qgroup_lock);
 
 	/* Skip rescan for simple qgroups. */
@@ -1331,7 +1350,7 @@
 
 int btrfs_quota_disable(struct btrfs_fs_info *fs_info)
 {
-	struct btrfs_root *quota_root;
+	struct btrfs_root *quota_root = NULL;
 	struct btrfs_trans_handle *trans = NULL;
 	int ret = 0;
 
@@ -1342,16 +1361,10 @@
 	lockdep_assert_held_write(&fs_info->subvol_sem);
 
 	/*
-	 * Lock the cleaner mutex to prevent races with concurrent relocation,
-	 * because relocation may be building backrefs for blocks of the quota
-	 * root while we are deleting the root. This is like dropping fs roots
-	 * of deleted snapshots/subvolumes, we need the same protection.
-	 *
-	 * This also prevents races between concurrent tasks trying to disable
-	 * quotas, because we will unlock and relock qgroup_ioctl_lock across
-	 * BTRFS_FS_QUOTA_ENABLED changes.
+	 * Relocation will mess with backrefs, so make sure we have the
+	 * cleaner_mutex held to protect us from relocate.
 	 */
-	mutex_lock(&fs_info->cleaner_mutex);
+	lockdep_assert_held(&fs_info->cleaner_mutex);
 
 	mutex_lock(&fs_info->qgroup_ioctl_lock);
 	if (!fs_info->quota_root)
@@ -1373,9 +1386,13 @@
 	clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
 	btrfs_qgroup_wait_for_completion(fs_info, false);
 
+	/*
+	 * We have nothing held here and no trans handle, just return the error
+	 * if there is one.
+	 */
 	ret = flush_reservations(fs_info);
 	if (ret)
-		goto out_unlock_cleaner;
+		return ret;
 
 	/*
 	 * 1 For the root item
@@ -1404,7 +1421,7 @@
 	fs_info->quota_root = NULL;
 	fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_ON;
 	fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE;
-	fs_info->qgroup_drop_subtree_thres = BTRFS_MAX_LEVEL;
+	fs_info->qgroup_drop_subtree_thres = BTRFS_QGROUP_DROP_SUBTREE_THRES_DEFAULT;
 	spin_unlock(&fs_info->qgroup_lock);
 
 	btrfs_free_qgroup_config(fs_info);
@@ -1428,20 +1445,19 @@
 	btrfs_tree_lock(quota_root->node);
 	btrfs_clear_buffer_dirty(trans, quota_root->node);
 	btrfs_tree_unlock(quota_root->node);
-	btrfs_free_tree_block(trans, btrfs_root_id(quota_root),
-			      quota_root->node, 0, 1);
+	ret = btrfs_free_tree_block(trans, btrfs_root_id(quota_root),
+				    quota_root->node, 0, 1);
 
-	btrfs_put_root(quota_root);
+	if (ret < 0)
+		btrfs_abort_transaction(trans, ret);
 
 out:
+	btrfs_put_root(quota_root);
 	mutex_unlock(&fs_info->qgroup_ioctl_lock);
 	if (ret && trans)
 		btrfs_end_transaction(trans);
 	else if (trans)
 		ret = btrfs_commit_transaction(trans);
-out_unlock_cleaner:
-	mutex_unlock(&fs_info->cleaner_mutex);
-
 	return ret;
 }
 
@@ -1736,13 +1752,55 @@
 	return ret;
 }
 
-static bool qgroup_has_usage(struct btrfs_qgroup *qgroup)
+/*
+ * Return 0 if we can not delete the qgroup (not empty or has children etc).
+ * Return >0 if we can delete the qgroup.
+ * Return <0 for other errors during tree search.
+ */
+static int can_delete_qgroup(struct btrfs_fs_info *fs_info, struct btrfs_qgroup *qgroup)
 {
-	return (qgroup->rfer > 0 || qgroup->rfer_cmpr > 0 ||
-		qgroup->excl > 0 || qgroup->excl_cmpr > 0 ||
-		qgroup->rsv.values[BTRFS_QGROUP_RSV_DATA] > 0 ||
-		qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PREALLOC] > 0 ||
-		qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PERTRANS] > 0);
+	struct btrfs_key key;
+	struct btrfs_path *path;
+	int ret;
+
+	/*
+	 * Squota would never be inconsistent, but there can still be case
+	 * where a dropped subvolume still has qgroup numbers, and squota
+	 * relies on such qgroup for future accounting.
+	 *
+	 * So for squota, do not allow dropping any non-zero qgroup.
+	 */
+	if (btrfs_qgroup_mode(fs_info) == BTRFS_QGROUP_MODE_SIMPLE &&
+	    (qgroup->rfer || qgroup->excl || qgroup->excl_cmpr || qgroup->rfer_cmpr))
+		return 0;
+
+	/* For higher level qgroup, we can only delete it if it has no child. */
+	if (btrfs_qgroup_level(qgroup->qgroupid)) {
+		if (!list_empty(&qgroup->members))
+			return 0;
+		return 1;
+	}
+
+	/*
+	 * For level-0 qgroups, we can only delete it if it has no subvolume
+	 * for it.
+	 * This means even a subvolume is unlinked but not yet fully dropped,
+	 * we can not delete the qgroup.
+	 */
+	key.objectid = qgroup->qgroupid;
+	key.type = BTRFS_ROOT_ITEM_KEY;
+	key.offset = -1ULL;
+	path = btrfs_alloc_path();
+	if (!path)
+		return -ENOMEM;
+
+	ret = btrfs_find_root(fs_info->tree_root, &key, path, NULL, NULL);
+	btrfs_free_path(path);
+	/*
+	 * The @ret from btrfs_find_root() exactly matches our definition for
+	 * the return value, thus can be returned directly.
+	 */
+	return ret;
 }
 
 int btrfs_remove_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid)
@@ -1764,7 +1822,10 @@
 		goto out;
 	}
 
-	if (is_fstree(qgroupid) && qgroup_has_usage(qgroup)) {
+	ret = can_delete_qgroup(fs_info, qgroup);
+	if (ret < 0)
+		goto out;
+	if (ret == 0) {
 		ret = -EBUSY;
 		goto out;
 	}
@@ -1789,6 +1850,45 @@
 	}
 
 	spin_lock(&fs_info->qgroup_lock);
+	/*
+	 * Warn on reserved space. The subvolume should has no child nor
+	 * corresponding subvolume.
+	 * Thus its reserved space should all be zero, no matter if qgroup
+	 * is consistent or the mode.
+	 */
+	if (qgroup->rsv.values[BTRFS_QGROUP_RSV_DATA] ||
+	    qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PREALLOC] ||
+	    qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PERTRANS]) {
+		WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
+		btrfs_warn_rl(fs_info,
+"to be deleted qgroup %u/%llu has non-zero numbers, data %llu meta prealloc %llu meta pertrans %llu",
+			      btrfs_qgroup_level(qgroup->qgroupid),
+			      btrfs_qgroup_subvolid(qgroup->qgroupid),
+			      qgroup->rsv.values[BTRFS_QGROUP_RSV_DATA],
+			      qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PREALLOC],
+			      qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PERTRANS]);
+
+	}
+	/*
+	 * The same for rfer/excl numbers, but that's only if our qgroup is
+	 * consistent and if it's in regular qgroup mode.
+	 * For simple mode it's not as accurate thus we can hit non-zero values
+	 * very frequently.
+	 */
+	if (btrfs_qgroup_mode(fs_info) == BTRFS_QGROUP_MODE_FULL &&
+	    !(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT)) {
+		if (qgroup->rfer || qgroup->excl ||
+		    qgroup->rfer_cmpr || qgroup->excl_cmpr) {
+			WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
+			btrfs_warn_rl(fs_info,
+"to be deleted qgroup %u/%llu has non-zero numbers, rfer %llu rfer_cmpr %llu excl %llu excl_cmpr %llu",
+				      btrfs_qgroup_level(qgroup->qgroupid),
+				      btrfs_qgroup_subvolid(qgroup->qgroupid),
+				      qgroup->rfer, qgroup->rfer_cmpr,
+				      qgroup->excl, qgroup->excl_cmpr);
+			qgroup_mark_inconsistent(fs_info);
+		}
+	}
 	del_qgroup_rb(fs_info, qgroupid);
 	spin_unlock(&fs_info->qgroup_lock);
 
@@ -2861,8 +2961,6 @@
 	if (nr_old_roots == 0 && nr_new_roots == 0)
 		goto out_free;
 
-	BUG_ON(!fs_info->quota_root);
-
 	trace_btrfs_qgroup_account_extent(fs_info, trans->transid, bytenr,
 					num_bytes, nr_old_roots, nr_new_roots);
 
@@ -2959,11 +3057,6 @@
 				ctx.roots = NULL;
 			}
 
-			/* Free the reserved data space */
-			btrfs_qgroup_free_refroot(fs_info,
-					record->data_rsv_refroot,
-					record->data_rsv,
-					BTRFS_QGROUP_RSV_DATA);
 			/*
 			 * Use BTRFS_SEQ_LAST as time_seq to do special search,
 			 * which doesn't lock tree or delayed_refs and search
@@ -2987,6 +3080,11 @@
 			record->old_roots = NULL;
 			new_roots = NULL;
 		}
+		/* Free the reserved data space */
+		btrfs_qgroup_free_refroot(fs_info,
+				record->data_rsv_refroot,
+				record->data_rsv,
+				BTRFS_QGROUP_RSV_DATA);
 cleanup:
 		ulist_free(record->old_roots);
 		ulist_free(new_roots);
@@ -3048,6 +3146,65 @@
 	return ret;
 }
 
+int btrfs_qgroup_check_inherit(struct btrfs_fs_info *fs_info,
+			       struct btrfs_qgroup_inherit *inherit,
+			       size_t size)
+{
+	if (inherit->flags & ~BTRFS_QGROUP_INHERIT_FLAGS_SUPP)
+		return -EOPNOTSUPP;
+	if (size < sizeof(*inherit) || size > PAGE_SIZE)
+		return -EINVAL;
+
+	/*
+	 * In the past we allowed btrfs_qgroup_inherit to specify to copy
+	 * rfer/excl numbers directly from other qgroups.  This behavior has
+	 * been disabled in userspace for a very long time, but here we should
+	 * also disable it in kernel, as this behavior is known to mark qgroup
+	 * inconsistent, and a rescan would wipe out the changes anyway.
+	 *
+	 * Reject any btrfs_qgroup_inherit with num_ref_copies or num_excl_copies.
+	 */
+	if (inherit->num_ref_copies > 0 || inherit->num_excl_copies > 0)
+		return -EINVAL;
+
+	if (inherit->num_qgroups > PAGE_SIZE)
+		return -EINVAL;
+
+	if (size != struct_size(inherit, qgroups, inherit->num_qgroups))
+		return -EINVAL;
+
+	/*
+	 * Skip the inherit source qgroups check if qgroup is not enabled.
+	 * Qgroup can still be later enabled causing problems, but in that case
+	 * btrfs_qgroup_inherit() would just ignore those invalid ones.
+	 */
+	if (!btrfs_qgroup_enabled(fs_info))
+		return 0;
+
+	/*
+	 * Now check all the remaining qgroups, they should all:
+	 *
+	 * - Exist
+	 * - Be higher level qgroups.
+	 */
+	for (int i = 0; i < inherit->num_qgroups; i++) {
+		struct btrfs_qgroup *qgroup;
+		u64 qgroupid = inherit->qgroups[i];
+
+		if (btrfs_qgroup_level(qgroupid) == 0)
+			return -EINVAL;
+
+		spin_lock(&fs_info->qgroup_lock);
+		qgroup = find_qgroup_rb(fs_info, qgroupid);
+		if (!qgroup) {
+			spin_unlock(&fs_info->qgroup_lock);
+			return -ENOENT;
+		}
+		spin_unlock(&fs_info->qgroup_lock);
+	}
+	return 0;
+}
+
 static int qgroup_auto_inherit(struct btrfs_fs_info *fs_info,
 			       u64 inode_rootid,
 			       struct btrfs_qgroup_inherit **inherit)
@@ -3083,7 +3240,7 @@
 	qgids = res->qgroups;
 
 	list_for_each_entry(qg_list, &inode_qg->groups, next_group)
-		qgids[i] = qg_list->group->qgroupid;
+		qgids[i++] = qg_list->group->qgroupid;
 
 	*inherit = res;
 	return 0;
@@ -3715,14 +3872,14 @@
 		/* we're resuming qgroup rescan at mount time */
 		if (!(fs_info->qgroup_flags &
 		      BTRFS_QGROUP_STATUS_FLAG_RESCAN)) {
-			btrfs_warn(fs_info,
+			btrfs_debug(fs_info,
 			"qgroup rescan init failed, qgroup rescan is not queued");
 			ret = -EINVAL;
 		} else if (!(fs_info->qgroup_flags &
 			     BTRFS_QGROUP_STATUS_FLAG_ON)) {
-			btrfs_warn(fs_info,
+			btrfs_debug(fs_info,
 			"qgroup rescan init failed, qgroup is not enabled");
-			ret = -EINVAL;
+			ret = -ENOTCONN;
 		}
 
 		if (ret)
@@ -3733,14 +3890,12 @@
 
 	if (init_flags) {
 		if (fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN) {
-			btrfs_warn(fs_info,
-				   "qgroup rescan is already in progress");
 			ret = -EINPROGRESS;
 		} else if (!(fs_info->qgroup_flags &
 			     BTRFS_QGROUP_STATUS_FLAG_ON)) {
-			btrfs_warn(fs_info,
+			btrfs_debug(fs_info,
 			"qgroup rescan init failed, qgroup is not enabled");
-			ret = -EINVAL;
+			ret = -ENOTCONN;
 		} else if (btrfs_qgroup_mode(fs_info) == BTRFS_QGROUP_MODE_DISABLED) {
 			/* Quota disable is in progress */
 			ret = -EBUSY;
@@ -3969,6 +4124,8 @@
 		return 0;
 	}
 
+	btrfs_run_delayed_iputs(root->fs_info);
+	btrfs_wait_on_delayed_iputs(root->fs_info);
 	ret = btrfs_start_delalloc_snapshot(root, true);
 	if (ret < 0)
 		goto out;
@@ -4136,10 +4293,9 @@
 	int ret;
 
 	if (btrfs_qgroup_mode(inode->root->fs_info) == BTRFS_QGROUP_MODE_DISABLED) {
-		extent_changeset_init(&changeset);
 		return clear_record_extent_bits(&inode->io_tree, start,
 						start + len - 1,
-						EXTENT_QGROUP_RESERVED, &changeset);
+						EXTENT_QGROUP_RESERVED, NULL);
 	}
 
 	/* In release case, we shouldn't have @reserved */
@@ -4381,6 +4537,8 @@
 				      BTRFS_QGROUP_RSV_META_PREALLOC);
 	trace_qgroup_meta_convert(root, num_bytes);
 	qgroup_convert_meta(fs_info, root->root_key.objectid, num_bytes);
+	if (!sb_rdonly(fs_info->sb))
+		add_root_meta_rsv(root, num_bytes, BTRFS_QGROUP_RSV_META_PERTRANS);
 }
 
 /*
--- linux-qcom-6.8.0.orig/fs/btrfs/qgroup.h
+++ linux-qcom-6.8.0/fs/btrfs/qgroup.h
@@ -111,6 +111,8 @@
 #define BTRFS_QGROUP_RUNTIME_FLAG_CANCEL_RESCAN		(1ULL << 63)
 #define BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING		(1ULL << 62)
 
+#define BTRFS_QGROUP_DROP_SUBTREE_THRES_DEFAULT		(3)
+
 /*
  * Record a dirty extent, and info qgroup to update quota on it
  * TODO: Use kmem cache to alloc it.
@@ -341,6 +343,9 @@
 				struct ulist *new_roots);
 int btrfs_qgroup_account_extents(struct btrfs_trans_handle *trans);
 int btrfs_run_qgroups(struct btrfs_trans_handle *trans);
+int btrfs_qgroup_check_inherit(struct btrfs_fs_info *fs_info,
+			       struct btrfs_qgroup_inherit *inherit,
+			       size_t size);
 int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
 			 u64 objectid, u64 inode_rootid,
 			 struct btrfs_qgroup_inherit *inherit);
--- linux-qcom-6.8.0.orig/fs/btrfs/ref-verify.c
+++ linux-qcom-6.8.0/fs/btrfs/ref-verify.c
@@ -441,7 +441,8 @@
 	u32 item_size = btrfs_item_size(leaf, slot);
 	unsigned long end, ptr;
 	u64 offset, flags, count;
-	int type, ret;
+	int type;
+	int ret = 0;
 
 	ei = btrfs_item_ptr(leaf, slot, struct btrfs_extent_item);
 	flags = btrfs_extent_flags(leaf, ei);
@@ -486,7 +487,11 @@
 						  key->objectid, key->offset);
 			break;
 		case BTRFS_EXTENT_OWNER_REF_KEY:
-			WARN_ON(!btrfs_fs_incompat(fs_info, SIMPLE_QUOTA));
+			if (!btrfs_fs_incompat(fs_info, SIMPLE_QUOTA)) {
+				btrfs_err(fs_info,
+			  "found extent owner ref without simple quotas enabled");
+				ret = -EINVAL;
+			}
 			break;
 		default:
 			btrfs_err(fs_info, "invalid key type in iref");
@@ -852,6 +857,7 @@
 "dropping a ref for a root that doesn't have a ref on the block");
 			dump_block_entry(fs_info, be);
 			dump_ref_action(fs_info, ra);
+			rb_erase(&ref->node, &be->refs);
 			kfree(ref);
 			kfree(ra);
 			goto out_unlock;
--- linux-qcom-6.8.0.orig/fs/btrfs/reflink.c
+++ linux-qcom-6.8.0/fs/btrfs/reflink.c
@@ -174,7 +174,7 @@
 				    char *inline_data,
 				    struct btrfs_trans_handle **trans_out)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(dst->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(dst);
 	struct btrfs_root *root = BTRFS_I(dst)->root;
 	const u64 aligned_end = ALIGN(new_key->offset + datal,
 				      fs_info->sectorsize);
@@ -337,7 +337,7 @@
 		       const u64 off, const u64 olen, const u64 olen_aligned,
 		       const u64 destoff, int no_time_update)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	struct btrfs_path *path = NULL;
 	struct extent_buffer *leaf;
 	struct btrfs_trans_handle *trans;
@@ -663,7 +663,7 @@
 				   struct inode *dst, u64 dst_loff)
 {
 	struct btrfs_fs_info *fs_info = BTRFS_I(src)->root->fs_info;
-	const u64 bs = fs_info->sb->s_blocksize;
+	const u64 bs = fs_info->sectorsize;
 	int ret;
 
 	/*
@@ -726,11 +726,11 @@
 {
 	struct inode *inode = file_inode(file);
 	struct inode *src = file_inode(file_src);
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	int ret;
 	int wb_ret;
 	u64 len = olen;
-	u64 bs = fs_info->sb->s_blocksize;
+	u64 bs = fs_info->sectorsize;
 
 	/*
 	 * VFS's generic_remap_file_range_prep() protects us from cloning the
@@ -796,7 +796,7 @@
 {
 	struct inode *inode_in = file_inode(file_in);
 	struct inode *inode_out = file_inode(file_out);
-	u64 bs = BTRFS_I(inode_out)->root->fs_info->sb->s_blocksize;
+	u64 bs = BTRFS_I(inode_out)->root->fs_info->sectorsize;
 	u64 wb_len;
 	int ret;
 
--- linux-qcom-6.8.0.orig/fs/btrfs/relocation.c
+++ linux-qcom-6.8.0/fs/btrfs/relocation.c
@@ -231,70 +231,6 @@
 	return NULL;
 }
 
-static void update_backref_node(struct btrfs_backref_cache *cache,
-				struct btrfs_backref_node *node, u64 bytenr)
-{
-	struct rb_node *rb_node;
-	rb_erase(&node->rb_node, &cache->rb_root);
-	node->bytenr = bytenr;
-	rb_node = rb_simple_insert(&cache->rb_root, node->bytenr, &node->rb_node);
-	if (rb_node)
-		btrfs_backref_panic(cache->fs_info, bytenr, -EEXIST);
-}
-
-/*
- * update backref cache after a transaction commit
- */
-static int update_backref_cache(struct btrfs_trans_handle *trans,
-				struct btrfs_backref_cache *cache)
-{
-	struct btrfs_backref_node *node;
-	int level = 0;
-
-	if (cache->last_trans == 0) {
-		cache->last_trans = trans->transid;
-		return 0;
-	}
-
-	if (cache->last_trans == trans->transid)
-		return 0;
-
-	/*
-	 * detached nodes are used to avoid unnecessary backref
-	 * lookup. transaction commit changes the extent tree.
-	 * so the detached nodes are no longer useful.
-	 */
-	while (!list_empty(&cache->detached)) {
-		node = list_entry(cache->detached.next,
-				  struct btrfs_backref_node, list);
-		btrfs_backref_cleanup_node(cache, node);
-	}
-
-	while (!list_empty(&cache->changed)) {
-		node = list_entry(cache->changed.next,
-				  struct btrfs_backref_node, list);
-		list_del_init(&node->list);
-		BUG_ON(node->pending);
-		update_backref_node(cache, node, node->new_bytenr);
-	}
-
-	/*
-	 * some nodes can be left in the pending list if there were
-	 * errors during processing the pending nodes.
-	 */
-	for (level = 0; level < BTRFS_MAX_LEVEL; level++) {
-		list_for_each_entry(node, &cache->pending[level], list) {
-			BUG_ON(!node->pending);
-			if (node->bytenr == node->new_bytenr)
-				continue;
-			update_backref_node(cache, node, node->new_bytenr);
-		}
-	}
-
-	cache->last_trans = 0;
-	return 1;
-}
-
 static bool reloc_root_is_dead(const struct btrfs_root *root)
 {
 	/*
@@ -553,9 +489,6 @@
 	struct btrfs_backref_edge *new_edge;
 	struct rb_node *rb_node;
 
-	if (cache->last_trans > 0)
-		update_backref_cache(trans, cache);
-
 	rb_node = rb_simple_search(&cache->rb_root, src->commit_root->start);
 	if (rb_node) {
 		node = rb_entry(rb_node, struct btrfs_backref_node, rb_node);
@@ -820,7 +753,7 @@
 		goto abort;
 	}
 	set_bit(BTRFS_ROOT_SHAREABLE, &reloc_root->state);
-	reloc_root->last_trans = trans->transid;
+	btrfs_set_root_last_trans(reloc_root, trans->transid);
 	return reloc_root;
 fail:
 	kfree(root_item);
@@ -867,7 +800,7 @@
 	 */
 	if (root->reloc_root) {
 		reloc_root = root->reloc_root;
-		reloc_root->last_trans = trans->transid;
+		btrfs_set_root_last_trans(reloc_root, trans->transid);
 		return 0;
 	}
 
@@ -926,7 +859,7 @@
 	btrfs_grab_root(reloc_root);
 
 	/* root->reloc_root will stay until current relocation finished */
-	if (fs_info->reloc_ctl->merge_reloc_tree &&
+	if (fs_info->reloc_ctl && fs_info->reloc_ctl->merge_reloc_tree &&
 	    btrfs_root_refs(root_item) == 0) {
 		set_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state);
 		/*
@@ -1774,7 +1707,7 @@
 		 * btrfs_update_reloc_root() and update our root item
 		 * appropriately.
 		 */
-		reloc_root->last_trans = trans->transid;
+		btrfs_set_root_last_trans(reloc_root, trans->transid);
 		trans->block_rsv = rc->block_rsv;
 
 		replaced = 0;
@@ -2117,7 +2050,7 @@
 	struct btrfs_root *root;
 	int ret;
 
-	if (reloc_root->last_trans == trans->transid)
+	if (btrfs_get_root_last_trans(reloc_root) == trans->transid)
 		return 0;
 
 	root = btrfs_get_fs_root(fs_info, reloc_root->root_key.offset, false);
@@ -2987,7 +2920,7 @@
 			     const struct file_extent_cluster *cluster,
 			     int *cluster_nr, unsigned long page_index)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+	struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);
 	u64 offset = BTRFS_I(inode)->index_cnt;
 	const unsigned long last_index = (cluster->end - offset) >> PAGE_SHIFT;
 	gfp_t mask = btrfs_alloc_write_mask(inode->i_mapping);
@@ -2998,6 +2931,7 @@
 	int ret;
 
 	ASSERT(page_index <= last_index);
+again:
 	page = find_lock_page(inode->i_mapping, page_index);
 	if (!page) {
 		page_cache_sync_readahead(inode->i_mapping, ra, NULL,
@@ -3019,6 +2953,11 @@
 			ret = -EIO;
 			goto release_page;
 		}
+		if (page->mapping != inode->i_mapping) {
+			unlock_page(page);
+			put_page(page);
+			goto again;
+		}
 	}
 
 	/*
@@ -3714,11 +3653,9 @@
 			break;
 		}
 restart:
-		if (update_backref_cache(trans, &rc->backref_cache)) {
-			btrfs_end_transaction(trans);
-			trans = NULL;
-			continue;
-		}
+		if (rc->backref_cache.last_trans != trans->transid)
+			btrfs_backref_release_cache(&rc->backref_cache);
+		rc->backref_cache.last_trans = trans->transid;
 
 		ret = find_next_extent(rc, path, &key);
 		if (ret < 0)
--- linux-qcom-6.8.0.orig/fs/btrfs/root-tree.c
+++ linux-qcom-6.8.0/fs/btrfs/root-tree.c
@@ -539,13 +539,3 @@
 	}
 	return ret;
 }
-
-void btrfs_subvolume_release_metadata(struct btrfs_root *root,
-				      struct btrfs_block_rsv *rsv)
-{
-	struct btrfs_fs_info *fs_info = root->fs_info;
-	u64 qgroup_to_release;
-
-	btrfs_block_rsv_release(fs_info, rsv, (u64)-1, &qgroup_to_release);
-	btrfs_qgroup_convert_reserved_meta(root, qgroup_to_release);
-}
--- linux-qcom-6.8.0.orig/fs/btrfs/root-tree.h
+++ linux-qcom-6.8.0/fs/btrfs/root-tree.h
@@ -8,8 +8,6 @@
 int btrfs_subvolume_reserve_metadata(struct btrfs_root *root,
 				     struct btrfs_block_rsv *rsv,
 				     int nitems, bool use_global_rsv);
-void btrfs_subvolume_release_metadata(struct btrfs_root *root,
-				      struct btrfs_block_rsv *rsv);
 int btrfs_add_root_ref(struct btrfs_trans_handle *trans, u64 root_id,
 		       u64 ref_id, u64 dirid, u64 sequence,
 		       const struct fscrypt_str *name);
--- linux-qcom-6.8.0.orig/fs/btrfs/scrub.c
+++ linux-qcom-6.8.0/fs/btrfs/scrub.c
@@ -1012,6 +1012,7 @@
 	struct btrfs_fs_info *fs_info = sctx->fs_info;
 	int num_copies = btrfs_num_copies(fs_info, stripe->bg->start,
 					  stripe->bg->length);
+	unsigned long repaired;
 	int mirror;
 	int i;
 
@@ -1078,16 +1079,15 @@
 	 * Submit the repaired sectors.  For zoned case, we cannot do repair
 	 * in-place, but queue the bg to be relocated.
 	 */
-	if (btrfs_is_zoned(fs_info)) {
-		if (!bitmap_empty(&stripe->error_bitmap, stripe->nr_sectors))
+	bitmap_andnot(&repaired, &stripe->init_error_bitmap, &stripe->error_bitmap,
+		      stripe->nr_sectors);
+	if (!sctx->readonly && !bitmap_empty(&repaired, stripe->nr_sectors)) {
+		if (btrfs_is_zoned(fs_info)) {
 			btrfs_repair_one_zone(fs_info, sctx->stripes[0].bg->start);
-	} else if (!sctx->readonly) {
-		unsigned long repaired;
-
-		bitmap_andnot(&repaired, &stripe->init_error_bitmap,
-			      &stripe->error_bitmap, stripe->nr_sectors);
-		scrub_write_sectors(sctx, stripe, repaired, false);
-		wait_scrub_stripe_io(stripe);
+		} else {
+			scrub_write_sectors(sctx, stripe, repaired, false);
+			wait_scrub_stripe_io(stripe);
+		}
 	}
 
 	scrub_stripe_report_errors(sctx, stripe);
@@ -1534,6 +1534,10 @@
 	u64 extent_gen;
 	int ret;
 
+	if (unlikely(!extent_root)) {
+		btrfs_err(fs_info, "no valid extent root for scrub");
+		return -EUCLEAN;
+	}
 	memset(stripe->sectors, 0, sizeof(struct scrub_sector_verification) *
 				   stripe->nr_sectors);
 	scrub_stripe_reset_bitmaps(stripe);
@@ -1641,14 +1645,20 @@
 	}
 }
 
+static u32 stripe_length(const struct scrub_stripe *stripe)
+{
+	ASSERT(stripe->bg);
+
+	return min(BTRFS_STRIPE_LEN,
+		   stripe->bg->start + stripe->bg->length - stripe->logical);
+}
+
 static void scrub_submit_extent_sector_read(struct scrub_ctx *sctx,
 					    struct scrub_stripe *stripe)
 {
 	struct btrfs_fs_info *fs_info = stripe->bg->fs_info;
 	struct btrfs_bio *bbio = NULL;
-	unsigned int nr_sectors = min(BTRFS_STRIPE_LEN, stripe->bg->start +
-				      stripe->bg->length - stripe->logical) >>
-				  fs_info->sectorsize_bits;
+	unsigned int nr_sectors = stripe_length(stripe) >> fs_info->sectorsize_bits;
 	u64 stripe_len = BTRFS_STRIPE_LEN;
 	int mirror = stripe->mirror_num;
 	int i;
@@ -1681,20 +1691,24 @@
 					    (i << fs_info->sectorsize_bits);
 			int err;
 
-			bbio = btrfs_bio_alloc(stripe->nr_sectors, REQ_OP_READ,
-					       fs_info, scrub_read_endio, stripe);
-			bbio->bio.bi_iter.bi_sector = logical >> SECTOR_SHIFT;
-
 			io_stripe.is_scrub = true;
+			stripe_len = (nr_sectors - i) << fs_info->sectorsize_bits;
+			/*
+			 * For RST cases, we need to manually split the bbio to
+			 * follow the RST boundary.
+			 */
 			err = btrfs_map_block(fs_info, BTRFS_MAP_READ, logical,
-					      &stripe_len, &bioc, &io_stripe,
-					      &mirror);
+					      &stripe_len, &bioc, &io_stripe, &mirror);
 			btrfs_put_bioc(bioc);
-			if (err) {
-				btrfs_bio_end_io(bbio,
-						 errno_to_blk_status(err));
-				return;
+			if (err < 0) {
+				set_bit(i, &stripe->io_error_bitmap);
+				set_bit(i, &stripe->error_bitmap);
+				continue;
 			}
+
+			bbio = btrfs_bio_alloc(stripe->nr_sectors, REQ_OP_READ,
+					       fs_info, scrub_read_endio, stripe);
+			bbio->bio.bi_iter.bi_sector = logical >> SECTOR_SHIFT;
 		}
 
 		__bio_add_page(&bbio->bio, page, fs_info->sectorsize, pgoff);
@@ -1718,9 +1732,7 @@
 {
 	struct btrfs_fs_info *fs_info = sctx->fs_info;
 	struct btrfs_bio *bbio;
-	unsigned int nr_sectors = min(BTRFS_STRIPE_LEN, stripe->bg->start +
-				      stripe->bg->length - stripe->logical) >>
-				  fs_info->sectorsize_bits;
+	unsigned int nr_sectors = stripe_length(stripe) >> fs_info->sectorsize_bits;
 	int mirror = stripe->mirror_num;
 
 	ASSERT(stripe->bg);
@@ -1860,6 +1872,9 @@
 		stripe = &sctx->stripes[i];
 
 		wait_scrub_stripe_io(stripe);
+		spin_lock(&sctx->stat_lock);
+		sctx->stat.last_physical = stripe->physical + stripe_length(stripe);
+		spin_unlock(&sctx->stat_lock);
 		scrub_reset_stripe(stripe);
 	}
 out:
@@ -2093,7 +2108,7 @@
 	struct btrfs_fs_info *fs_info = sctx->fs_info;
 	const u64 logical_end = logical_start + logical_length;
 	u64 cur_logical = logical_start;
-	int ret;
+	int ret = 0;
 
 	/* The range must be inside the bg */
 	ASSERT(logical_start >= bg->start && logical_end <= bg->start + bg->length);
@@ -2128,7 +2143,9 @@
 					 cur_physical, &found_logical);
 		if (ret > 0) {
 			/* No more extent, just update the accounting */
+			spin_lock(&sctx->stat_lock);
 			sctx->stat.last_physical = physical + logical_length;
+			spin_unlock(&sctx->stat_lock);
 			ret = 0;
 			break;
 		}
@@ -2325,6 +2342,10 @@
 			stripe_logical += chunk_logical;
 			ret = scrub_raid56_parity_stripe(sctx, scrub_dev, bg,
 							 map, stripe_logical);
+			spin_lock(&sctx->stat_lock);
+			sctx->stat.last_physical = min(physical + BTRFS_STRIPE_LEN,
+						       physical_end);
+			spin_unlock(&sctx->stat_lock);
 			if (ret)
 				goto out;
 			goto next;
@@ -2805,7 +2826,17 @@
 		gen = btrfs_get_last_trans_committed(fs_info);
 
 	for (i = 0; i < BTRFS_SUPER_MIRROR_MAX; i++) {
-		bytenr = btrfs_sb_offset(i);
+		ret = btrfs_sb_log_location(scrub_dev, i, 0, &bytenr);
+		if (ret == -ENOENT)
+			break;
+
+		if (ret) {
+			spin_lock(&sctx->stat_lock);
+			sctx->stat.super_errors++;
+			spin_unlock(&sctx->stat_lock);
+			continue;
+		}
+
 		if (bytenr + BTRFS_SUPER_INFO_SIZE >
 		    scrub_dev->commit_total_bytes)
 			break;
--- linux-qcom-6.8.0.orig/fs/btrfs/send.c
+++ linux-qcom-6.8.0/fs/btrfs/send.c
@@ -777,7 +777,12 @@
 	if (WARN_ON(!sctx->send_buf))
 		return -EINVAL;
 
-	BUG_ON(sctx->send_size);
+	if (unlikely(sctx->send_size != 0)) {
+		btrfs_err(sctx->send_root->fs_info,
+			  "send: command header buffer not empty cmd %d offset %llu",
+			  cmd, sctx->send_off);
+		return -EINVAL;
+	}
 
 	sctx->send_size += sizeof(*hdr);
 	hdr = (struct btrfs_cmd_header *)sctx->send_buf;
@@ -1070,7 +1075,15 @@
 					ret = PTR_ERR(start);
 					goto out;
 				}
-				BUG_ON(start < p->buf);
+				if (unlikely(start < p->buf)) {
+					btrfs_err(root->fs_info,
+			"send: path ref buffer underflow for key (%llu %u %llu)",
+						  found_key->objectid,
+						  found_key->type,
+						  found_key->offset);
+					ret = -EINVAL;
+					goto out;
+				}
 			}
 			p->start = start;
 		} else {
@@ -4182,7 +4195,13 @@
 	 * This should never happen as the root dir always has the same ref
 	 * which is always '..'
 	 */
-	BUG_ON(sctx->cur_ino <= BTRFS_FIRST_FREE_OBJECTID);
+	if (unlikely(sctx->cur_ino <= BTRFS_FIRST_FREE_OBJECTID)) {
+		btrfs_err(fs_info,
+			  "send: unexpected inode %llu in process_recorded_refs()",
+			  sctx->cur_ino);
+		ret = -EINVAL;
+		goto out;
+	}
 
 	valid_path = fs_path_alloc();
 	if (!valid_path) {
@@ -5659,7 +5678,7 @@
 	 * Note that send_buf is a mapping of send_buf_pages, so this is really
 	 * reading into send_buf.
 	 */
-	ret = btrfs_encoded_read_regular_fill_pages(BTRFS_I(inode), offset,
+	ret = btrfs_encoded_read_regular_fill_pages(BTRFS_I(inode),
 						    disk_bytenr, disk_num_bytes,
 						    sctx->send_buf_pages +
 						    (data_offset >> PAGE_SHIFT));
@@ -6140,26 +6159,73 @@
 	int ret = 0;
 	u64 offset = key->offset;
 	u64 end;
-	u64 bs = sctx->send_root->fs_info->sb->s_blocksize;
+	u64 bs = sctx->send_root->fs_info->sectorsize;
+	struct btrfs_file_extent_item *ei;
+	u64 disk_byte;
+	u64 data_offset;
+	u64 num_bytes;
+	struct btrfs_inode_info info = { 0 };
 
 	end = min_t(u64, btrfs_file_extent_end(path), sctx->cur_inode_size);
 	if (offset >= end)
 		return 0;
 
-	if (clone_root && IS_ALIGNED(end, bs)) {
-		struct btrfs_file_extent_item *ei;
-		u64 disk_byte;
-		u64 data_offset;
+	num_bytes = end - offset;
 
-		ei = btrfs_item_ptr(path->nodes[0], path->slots[0],
-				    struct btrfs_file_extent_item);
-		disk_byte = btrfs_file_extent_disk_bytenr(path->nodes[0], ei);
-		data_offset = btrfs_file_extent_offset(path->nodes[0], ei);
-		ret = clone_range(sctx, path, clone_root, disk_byte,
-				  data_offset, offset, end - offset);
-	} else {
-		ret = send_extent_data(sctx, path, offset, end - offset);
+	if (!clone_root)
+		goto write_data;
+
+	if (IS_ALIGNED(end, bs))
+		goto clone_data;
+
+	/*
+	 * If the extent end is not aligned, we can clone if the extent ends at
+	 * the i_size of the inode and the clone range ends at the i_size of the
+	 * source inode, otherwise the clone operation fails with -EINVAL.
+	 */
+	if (end != sctx->cur_inode_size)
+		goto write_data;
+
+	ret = get_inode_info(clone_root->root, clone_root->ino, &info);
+	if (ret < 0)
+		return ret;
+
+	if (clone_root->offset + num_bytes == info.size) {
+		/*
+		 * The final size of our file matches the end offset, but it may
+		 * be that its current size is larger, so we have to truncate it
+		 * to any value between the start offset of the range and the
+		 * final i_size, otherwise the clone operation is invalid
+		 * because it's unaligned and it ends before the current EOF.
+		 * We do this truncate to the final i_size when we finish
+		 * processing the inode, but it's too late by then. And here we
+		 * truncate to the start offset of the range because it's always
+		 * sector size aligned while if it were the final i_size it
+		 * would result in dirtying part of a page, filling part of a
+		 * page with zeroes and then having the clone operation at the
+		 * receiver trigger IO and wait for it due to the dirty page.
+		 */
+		if (sctx->parent_root != NULL) {
+			ret = send_truncate(sctx, sctx->cur_ino,
+					    sctx->cur_inode_gen, offset);
+			if (ret < 0)
+				return ret;
+		}
+		goto clone_data;
 	}
+
+write_data:
+	ret = send_extent_data(sctx, path, offset, num_bytes);
+	sctx->cur_inode_next_write_offset = end;
+	return ret;
+
+clone_data:
+	ei = btrfs_item_ptr(path->nodes[0], path->slots[0],
+			    struct btrfs_file_extent_item);
+	disk_byte = btrfs_file_extent_disk_bytenr(path->nodes[0], ei);
+	data_offset = btrfs_file_extent_offset(path->nodes[0], ei);
+	ret = clone_range(sctx, path, clone_root, disk_byte, data_offset, offset,
+			  num_bytes);
 	sctx->cur_inode_next_write_offset = end;
 	return ret;
 }
@@ -7429,8 +7495,8 @@
 	u64 reada_done = 0;
 
 	lockdep_assert_held_read(&parent->fs_info->commit_root_sem);
+	ASSERT(*level != 0);
 
-	BUG_ON(*level == 0);
 	eb = btrfs_read_node_slot(parent, slot);
 	if (IS_ERR(eb))
 		return PTR_ERR(eb);
--- linux-qcom-6.8.0.orig/fs/btrfs/space-info.c
+++ linux-qcom-6.8.0/fs/btrfs/space-info.c
@@ -312,7 +312,7 @@
 	found->bytes_used += block_group->used;
 	found->disk_used += block_group->used * factor;
 	found->bytes_readonly += block_group->bytes_super;
-	found->bytes_zone_unusable += block_group->zone_unusable;
+	btrfs_space_info_update_bytes_zone_unusable(info, found, block_group->zone_unusable);
 	if (block_group->length > 0)
 		found->full = 0;
 	btrfs_try_granting_tickets(info, found);
@@ -374,11 +374,18 @@
 	 * "optimal" chunk size based on the fs size.  However when we actually
 	 * allocate the chunk we will strip this down further, making it no more
 	 * than 10% of the disk or 1G, whichever is smaller.
+	 *
+	 * On the zoned mode, we need to use zone_size (=
+	 * data_sinfo->chunk_size) as it is.
 	 */
 	data_sinfo = btrfs_find_space_info(fs_info, BTRFS_BLOCK_GROUP_DATA);
-	data_chunk_size = min(data_sinfo->chunk_size,
-			      mult_perc(fs_info->fs_devices->total_rw_bytes, 10));
-	data_chunk_size = min_t(u64, data_chunk_size, SZ_1G);
+	if (!btrfs_is_zoned(fs_info)) {
+		data_chunk_size = min(data_sinfo->chunk_size,
+				      mult_perc(fs_info->fs_devices->total_rw_bytes, 10));
+		data_chunk_size = min_t(u64, data_chunk_size, SZ_1G);
+	} else {
+		data_chunk_size = data_sinfo->chunk_size;
+	}
 
 	/*
 	 * Since data allocations immediately use block groups as part of the
@@ -406,6 +413,17 @@
 		avail >>= 3;
 	else
 		avail >>= 1;
+
+	/*
+	 * On the zoned mode, we always allocate one zone as one chunk.
+	 * Returning non-zone size alingned bytes here will result in
+	 * less pressure for the async metadata reclaim process, and it
+	 * will over-commit too much leading to ENOSPC. Align down to the
+	 * zone size to avoid that.
+	 */
+	if (btrfs_is_zoned(fs_info))
+		avail = ALIGN_DOWN(avail, fs_info->zone_size);
+
 	return avail;
 }
 
@@ -556,8 +574,7 @@
 
 		spin_lock(&cache->lock);
 		avail = cache->length - cache->used - cache->pinned -
-			cache->reserved - cache->delalloc_bytes -
-			cache->bytes_super - cache->zone_unusable;
+			cache->reserved - cache->bytes_super - cache->zone_unusable;
 		btrfs_info(fs_info,
 "block group %llu has %llu bytes, %llu used %llu pinned %llu reserved %llu delalloc %llu super %llu zone_unusable (%llu bytes available) %s",
 			   cache->start, cache->length, cache->used, cache->pinned,
--- linux-qcom-6.8.0.orig/fs/btrfs/space-info.h
+++ linux-qcom-6.8.0/fs/btrfs/space-info.h
@@ -198,6 +198,7 @@
 
 DECLARE_SPACE_INFO_UPDATE(bytes_may_use, "space_info");
 DECLARE_SPACE_INFO_UPDATE(bytes_pinned, "pinned");
+DECLARE_SPACE_INFO_UPDATE(bytes_zone_unusable, "zone_unusable");
 
 int btrfs_init_space_info(struct btrfs_fs_info *fs_info);
 void btrfs_add_bg_to_space_info(struct btrfs_fs_info *info,
--- linux-qcom-6.8.0.orig/fs/btrfs/subpage.c
+++ linux-qcom-6.8.0/fs/btrfs/subpage.c
@@ -725,8 +725,14 @@
 }
 
 #define GET_SUBPAGE_BITMAP(subpage, subpage_info, name, dst)		\
-	bitmap_cut(dst, subpage->bitmaps, 0,				\
-		   subpage_info->name##_offset, subpage_info->bitmap_nr_bits)
+{									\
+	const int bitmap_nr_bits = subpage_info->bitmap_nr_bits;	\
+									\
+	ASSERT(bitmap_nr_bits < BITS_PER_LONG);				\
+	*dst = bitmap_read(subpage->bitmaps,				\
+			   subpage_info->name##_offset,			\
+			   bitmap_nr_bits);				\
+}
 
 void __cold btrfs_subpage_dump_bitmap(const struct btrfs_fs_info *fs_info,
 				      struct folio *folio, u64 start, u32 len)
--- linux-qcom-6.8.0.orig/fs/btrfs/super.c
+++ linux-qcom-6.8.0/fs/btrfs/super.c
@@ -121,6 +121,7 @@
 	Opt_thread_pool,
 	Opt_treelog,
 	Opt_user_subvol_rm_allowed,
+	Opt_norecovery,
 
 	/* Rescue options */
 	Opt_rescue,
@@ -247,6 +248,8 @@
 	__fsparam(NULL, "nologreplay", Opt_nologreplay, fs_param_deprecated, NULL),
 	/* Deprecated, with alias rescue=usebackuproot */
 	__fsparam(NULL, "usebackuproot", Opt_usebackuproot, fs_param_deprecated, NULL),
+	/* For compatibility only, alias for "rescue=nologreplay". */
+	fsparam_flag("norecovery", Opt_norecovery),
 
 	/* Debugging options. */
 	fsparam_flag_no("enospc_debug", Opt_enospc_debug),
@@ -334,6 +337,15 @@
 		fallthrough;
 	case Opt_compress:
 	case Opt_compress_type:
+		/*
+		 * Provide the same semantics as older kernels that don't use fs
+		 * context, specifying the "compress" option clears
+		 * "force-compress" without the need to pass
+		 * "compress-force=[no|none]" before specifying "compress".
+		 */
+		if (opt != Opt_compress_force && opt != Opt_compress_force_type)
+			btrfs_clear_opt(ctx->mount_opt, FORCE_COMPRESS);
+
 		if (opt == Opt_compress || opt == Opt_compress_force) {
 			ctx->compress_type = BTRFS_COMPRESS_ZLIB;
 			ctx->compress_level = BTRFS_ZLIB_DEFAULT_LEVEL;
@@ -440,6 +452,11 @@
 		"'nologreplay' is deprecated, use 'rescue=nologreplay' instead");
 		btrfs_set_opt(ctx->mount_opt, NOLOGREPLAY);
 		break;
+	case Opt_norecovery:
+		btrfs_info(NULL,
+"'norecovery' is for compatibility only, recommended to use 'rescue=nologreplay'");
+		btrfs_set_opt(ctx->mount_opt, NOLOGREPLAY);
+		break;
 	case Opt_flushoncommit:
 		if (result.negated)
 			btrfs_clear_opt(ctx->mount_opt, FLUSHONCOMMIT);
@@ -912,8 +929,7 @@
 }
 
 static int btrfs_fill_super(struct super_block *sb,
-			    struct btrfs_fs_devices *fs_devices,
-			    void *data)
+			    struct btrfs_fs_devices *fs_devices)
 {
 	struct inode *inode;
 	struct btrfs_fs_info *fs_info = btrfs_sb(sb);
@@ -937,7 +953,7 @@
 		return err;
 	}
 
-	err = open_ctree(sb, fs_devices, (char *)data);
+	err = open_ctree(sb, fs_devices);
 	if (err) {
 		btrfs_err(fs_info, "open_ctree failed");
 		return err;
@@ -1468,8 +1484,7 @@
 	sync_filesystem(sb);
 	set_bit(BTRFS_FS_STATE_REMOUNTING, &fs_info->fs_state);
 
-	if (!mount_reconfigure &&
-	    !btrfs_check_options(fs_info, &ctx->mount_opt, fc->sb_flags))
+	if (!btrfs_check_options(fs_info, &ctx->mount_opt, fc->sb_flags))
 		return -EINVAL;
 
 	ret = btrfs_check_features(fs_info, !(fc->sb_flags & SB_RDONLY));
@@ -1767,7 +1782,7 @@
 		buf->f_bavail = 0;
 
 	buf->f_type = BTRFS_SUPER_MAGIC;
-	buf->f_bsize = dentry->d_sb->s_blocksize;
+	buf->f_bsize = fs_info->sectorsize;
 	buf->f_namelen = BTRFS_NAME_LEN;
 
 	/* We treat it as constant endianness (it doesn't matter _which_)
@@ -1851,18 +1866,21 @@
 
 	if (sb->s_root) {
 		btrfs_close_devices(fs_devices);
-		if ((fc->sb_flags ^ sb->s_flags) & SB_RDONLY)
-			ret = -EBUSY;
+		/*
+		 * At this stage we may have RO flag mismatch between
+		 * fc->sb_flags and sb->s_flags.  Caller should detect such
+		 * mismatch and reconfigure with sb->s_umount rwsem held if
+		 * needed.
+		 */
 	} else {
 		snprintf(sb->s_id, sizeof(sb->s_id), "%pg", bdev);
 		shrinker_debugfs_rename(sb->s_shrink, "sb-btrfs:%s", sb->s_id);
 		btrfs_sb(sb)->bdev_holder = &btrfs_fs_type;
-		ret = btrfs_fill_super(sb, fs_devices, NULL);
-	}
-
-	if (ret) {
-		deactivate_locked_super(sb);
-		return ret;
+		ret = btrfs_fill_super(sb, fs_devices);
+		if (ret) {
+			deactivate_locked_super(sb);
+			return ret;
+		}
 	}
 
 	btrfs_clear_oneshot_options(fs_info);
@@ -1943,59 +1961,23 @@
  *     fsconfig(FSCONFIG_SET_FLAG, "ro"). This option is seen by the filesystem
  *     in fc->sb_flags.
  *
- * This disambiguation has rather positive consequences.  Mounting a subvolume
- * ro will not also turn the superblock ro. Only the mount for the subvolume
- * will become ro.
- *
- * So, if the superblock creation request comes from the new mount API the
- * caller must have explicitly done:
- *
- *      fsconfig(FSCONFIG_SET_FLAG, "ro")
- *      fsmount/mount_setattr(MOUNT_ATTR_RDONLY)
- *
- * IOW, at some point the caller must have explicitly turned the whole
- * superblock ro and we shouldn't just undo it like we did for the old mount
- * API. In any case, it lets us avoid the hack in the new mount API.
- *
- * Consequently, the remounting hack must only be used for requests originating
- * from the old mount API and should be marked for full deprecation so it can be
- * turned off in a couple of years.
- *
- * The new mount API has no reason to support this hack.
+ * But, currently the util-linux mount command already utilizes the new mount
+ * API and is still setting fsconfig(FSCONFIG_SET_FLAG, "ro") no matter if it's
+ * btrfs or not, setting the whole super block RO.  To make per-subvolume mounting
+ * work with different options work we need to keep backward compatibility.
  */
-static struct vfsmount *btrfs_reconfigure_for_mount(struct fs_context *fc)
+static int btrfs_reconfigure_for_mount(struct fs_context *fc, struct vfsmount *mnt)
 {
-	struct vfsmount *mnt;
-	int ret;
-	const bool ro2rw = !(fc->sb_flags & SB_RDONLY);
-
-	/*
-	 * We got an EBUSY because our SB_RDONLY flag didn't match the existing
-	 * super block, so invert our setting here and retry the mount so we
-	 * can get our vfsmount.
-	 */
-	if (ro2rw)
-		fc->sb_flags |= SB_RDONLY;
-	else
-		fc->sb_flags &= ~SB_RDONLY;
-
-	mnt = fc_mount(fc);
-	if (IS_ERR(mnt))
-		return mnt;
+	int ret = 0;
 
-	if (!fc->oldapi || !ro2rw)
-		return mnt;
+	if (fc->sb_flags & SB_RDONLY)
+		return ret;
 
-	/* We need to convert to rw, call reconfigure. */
-	fc->sb_flags &= ~SB_RDONLY;
 	down_write(&mnt->mnt_sb->s_umount);
-	ret = btrfs_reconfigure(fc);
+	if (!(fc->sb_flags & SB_RDONLY) && (mnt->mnt_sb->s_flags & SB_RDONLY))
+		ret = btrfs_reconfigure(fc);
 	up_write(&mnt->mnt_sb->s_umount);
-	if (ret) {
-		mntput(mnt);
-		return ERR_PTR(ret);
-	}
-	return mnt;
+	return ret;
 }
 
 static int btrfs_get_tree_subvol(struct fs_context *fc)
@@ -2005,6 +1987,7 @@
 	struct fs_context *dup_fc;
 	struct dentry *dentry;
 	struct vfsmount *mnt;
+	int ret = 0;
 
 	/*
 	 * Setup a dummy root and fs_info for test/set super.  This is because
@@ -2047,11 +2030,16 @@
 	fc->security = NULL;
 
 	mnt = fc_mount(dup_fc);
-	if (PTR_ERR_OR_ZERO(mnt) == -EBUSY)
-		mnt = btrfs_reconfigure_for_mount(dup_fc);
-	put_fs_context(dup_fc);
-	if (IS_ERR(mnt))
+	if (IS_ERR(mnt)) {
+		put_fs_context(dup_fc);
 		return PTR_ERR(mnt);
+	}
+	ret = btrfs_reconfigure_for_mount(dup_fc, mnt);
+	put_fs_context(dup_fc);
+	if (ret) {
+		mntput(mnt);
+		return ret;
+	}
 
 	/*
 	 * This free's ->subvol_name, because if it isn't set we have to
--- linux-qcom-6.8.0.orig/fs/btrfs/sysfs.c
+++ linux-qcom-6.8.0/fs/btrfs/sysfs.c
@@ -1035,7 +1035,7 @@
 {
 	struct btrfs_fs_info *fs_info = to_fs_info(kobj);
 
-	return sysfs_emit(buf, "%u\n", fs_info->super_copy->nodesize);
+	return sysfs_emit(buf, "%u\n", fs_info->nodesize);
 }
 
 BTRFS_ATTR(, nodesize, btrfs_nodesize_show);
@@ -1045,7 +1045,7 @@
 {
 	struct btrfs_fs_info *fs_info = to_fs_info(kobj);
 
-	return sysfs_emit(buf, "%u\n", fs_info->super_copy->sectorsize);
+	return sysfs_emit(buf, "%u\n", fs_info->sectorsize);
 }
 
 BTRFS_ATTR(, sectorsize, btrfs_sectorsize_show);
@@ -1097,7 +1097,7 @@
 {
 	struct btrfs_fs_info *fs_info = to_fs_info(kobj);
 
-	return sysfs_emit(buf, "%u\n", fs_info->super_copy->sectorsize);
+	return sysfs_emit(buf, "%u\n", fs_info->sectorsize);
 }
 
 BTRFS_ATTR(, clone_alignment, btrfs_clone_alignment_show);
--- linux-qcom-6.8.0.orig/fs/btrfs/tests/extent-io-tests.c
+++ linux-qcom-6.8.0/fs/btrfs/tests/extent-io-tests.c
@@ -11,6 +11,7 @@
 #include "btrfs-tests.h"
 #include "../ctree.h"
 #include "../extent_io.h"
+#include "../disk-io.h"
 #include "../btrfs_inode.h"
 
 #define PROCESS_UNLOCK		(1 << 0)
@@ -105,9 +106,11 @@
 	}
 }
 
-static int test_find_delalloc(u32 sectorsize)
+static int test_find_delalloc(u32 sectorsize, u32 nodesize)
 {
-	struct inode *inode;
+	struct btrfs_fs_info *fs_info;
+	struct btrfs_root *root = NULL;
+	struct inode *inode = NULL;
 	struct extent_io_tree *tmp;
 	struct page *page;
 	struct page *locked_page = NULL;
@@ -121,12 +124,27 @@
 
 	test_msg("running find delalloc tests");
 
+	fs_info = btrfs_alloc_dummy_fs_info(nodesize, sectorsize);
+	if (!fs_info) {
+		test_std_err(TEST_ALLOC_FS_INFO);
+		return -ENOMEM;
+	}
+
+	root = btrfs_alloc_dummy_root(fs_info);
+	if (IS_ERR(root)) {
+		test_std_err(TEST_ALLOC_ROOT);
+		ret = PTR_ERR(root);
+		goto out;
+	}
+
 	inode = btrfs_new_test_inode();
 	if (!inode) {
 		test_std_err(TEST_ALLOC_INODE);
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto out;
 	}
 	tmp = &BTRFS_I(inode)->io_tree;
+	BTRFS_I(inode)->root = root;
 
 	/*
 	 * Passing NULL as we don't have fs_info but tracepoints are not used
@@ -316,6 +334,8 @@
 	process_page_range(inode, 0, total_dirty - 1,
 			   PROCESS_UNLOCK | PROCESS_RELEASE);
 	iput(inode);
+	btrfs_free_dummy_root(root);
+	btrfs_free_dummy_fs_info(fs_info);
 	return ret;
 }
 
@@ -794,7 +814,7 @@
 
 	test_msg("running extent I/O tests");
 
-	ret = test_find_delalloc(sectorsize);
+	ret = test_find_delalloc(sectorsize, nodesize);
 	if (ret)
 		goto out;
 
--- linux-qcom-6.8.0.orig/fs/btrfs/tests/extent-map-tests.c
+++ linux-qcom-6.8.0/fs/btrfs/tests/extent-map-tests.c
@@ -847,6 +847,11 @@
 		goto out;
 	}
 
+	if (em->block_start != SZ_32K + SZ_4K) {
+		test_err("em->block_start is %llu, expected 36K", em->block_start);
+		goto out;
+	}
+
 	free_extent_map(em);
 
 	read_lock(&em_tree->lock);
--- linux-qcom-6.8.0.orig/fs/btrfs/transaction.c
+++ linux-qcom-6.8.0/fs/btrfs/transaction.c
@@ -407,7 +407,7 @@
 	int ret = 0;
 
 	if ((test_bit(BTRFS_ROOT_SHAREABLE, &root->state) &&
-	    root->last_trans < trans->transid) || force) {
+	    btrfs_get_root_last_trans(root) < trans->transid) || force) {
 		WARN_ON(!force && root->commit_root != root->node);
 
 		/*
@@ -423,7 +423,7 @@
 		smp_wmb();
 
 		spin_lock(&fs_info->fs_roots_radix_lock);
-		if (root->last_trans == trans->transid && !force) {
+		if (btrfs_get_root_last_trans(root) == trans->transid && !force) {
 			spin_unlock(&fs_info->fs_roots_radix_lock);
 			return 0;
 		}
@@ -431,7 +431,7 @@
 				   (unsigned long)root->root_key.objectid,
 				   BTRFS_ROOT_TRANS_TAG);
 		spin_unlock(&fs_info->fs_roots_radix_lock);
-		root->last_trans = trans->transid;
+		btrfs_set_root_last_trans(root, trans->transid);
 
 		/* this is pretty tricky.  We don't want to
 		 * take the relocation lock in btrfs_record_root_in_trans
@@ -493,7 +493,7 @@
 	 * and barriers
 	 */
 	smp_rmb();
-	if (root->last_trans == trans->transid &&
+	if (btrfs_get_root_last_trans(root) == trans->transid &&
 	    !test_bit(BTRFS_ROOT_IN_TRANS_SETUP, &root->state))
 		return 0;
 
@@ -747,14 +747,6 @@
 		h->reloc_reserved = reloc_reserved;
 	}
 
-	/*
-	 * Now that we have found a transaction to be a part of, convert the
-	 * qgroup reservation from prealloc to pertrans. A different transaction
-	 * can't race in and free our pertrans out from under us.
-	 */
-	if (qgroup_reserved)
-		btrfs_qgroup_convert_reserved_meta(root, qgroup_reserved);
-
 got_it:
 	if (!current->journal_info)
 		current->journal_info = h;
@@ -788,8 +780,15 @@
 		 * not just freed.
 		 */
 		btrfs_end_transaction(h);
-		return ERR_PTR(ret);
+		goto reserve_fail;
 	}
+	/*
+	 * Now that we have found a transaction to be a part of, convert the
+	 * qgroup reservation from prealloc to pertrans. A different transaction
+	 * can't race in and free our pertrans out from under us.
+	 */
+	if (qgroup_reserved)
+		btrfs_qgroup_convert_reserved_meta(root, qgroup_reserved);
 
 	return h;
 
@@ -1497,6 +1496,7 @@
 			radix_tree_tag_clear(&fs_info->fs_roots_radix,
 					(unsigned long)root->root_key.objectid,
 					BTRFS_ROOT_TRANS_TAG);
+			btrfs_qgroup_free_meta_all_pertrans(root);
 			spin_unlock(&fs_info->fs_roots_radix_lock);
 
 			btrfs_free_log(trans, root);
@@ -1521,7 +1521,6 @@
 			if (ret2)
 				return ret2;
 			spin_lock(&fs_info->fs_roots_radix_lock);
-			btrfs_qgroup_free_meta_all_pertrans(root);
 		}
 	}
 	spin_unlock(&fs_info->fs_roots_radix_lock);
--- linux-qcom-6.8.0.orig/fs/btrfs/transaction.h
+++ linux-qcom-6.8.0/fs/btrfs/transaction.h
@@ -12,6 +12,12 @@
 #include "ctree.h"
 #include "misc.h"
 
+/*
+ * Signal that a direct IO write is in progress, to avoid deadlock for sync
+ * direct IO writes when fsync is called during the direct IO write path.
+ */
+#define BTRFS_TRANS_DIO_WRITE_STUB	((void *) 1)
+
 /* Radix-tree tag for roots that are part of the trasaction. */
 #define BTRFS_ROOT_TRANS_TAG			0
 
--- linux-qcom-6.8.0.orig/fs/btrfs/tree-checker.c
+++ linux-qcom-6.8.0/fs/btrfs/tree-checker.c
@@ -550,9 +550,10 @@
 
 		/* dir type check */
 		dir_type = btrfs_dir_ftype(leaf, di);
-		if (unlikely(dir_type >= BTRFS_FT_MAX)) {
+		if (unlikely(dir_type <= BTRFS_FT_UNKNOWN ||
+			     dir_type >= BTRFS_FT_MAX)) {
 			dir_item_err(leaf, slot,
-			"invalid dir item type, have %u expect [0, %u)",
+			"invalid dir item type, have %u expect (0, %u)",
 				dir_type, BTRFS_FT_MAX);
 			return -EUCLEAN;
 		}
@@ -1267,6 +1268,19 @@
 	va_end(args);
 }
 
+static bool is_valid_dref_root(u64 rootid)
+{
+	/*
+	 * The following tree root objectids are allowed to have a data backref:
+	 * - subvolume trees
+	 * - data reloc tree
+	 * - tree root
+	 *   For v1 space cache
+	 */
+	return is_fstree(rootid) || rootid == BTRFS_DATA_RELOC_TREE_OBJECTID ||
+	       rootid == BTRFS_ROOT_TREE_OBJECTID;
+}
+
 static int check_extent_item(struct extent_buffer *leaf,
 			     struct btrfs_key *key, int slot,
 			     struct btrfs_key *prev_key)
@@ -1419,6 +1433,8 @@
 		struct btrfs_extent_data_ref *dref;
 		struct btrfs_shared_data_ref *sref;
 		u64 seq;
+		u64 dref_root;
+		u64 dref_objectid;
 		u64 dref_offset;
 		u64 inline_offset;
 		u8 inline_type;
@@ -1462,11 +1478,26 @@
 		 */
 		case BTRFS_EXTENT_DATA_REF_KEY:
 			dref = (struct btrfs_extent_data_ref *)(&iref->offset);
+			dref_root = btrfs_extent_data_ref_root(leaf, dref);
+			dref_objectid = btrfs_extent_data_ref_objectid(leaf, dref);
 			dref_offset = btrfs_extent_data_ref_offset(leaf, dref);
 			seq = hash_extent_data_ref(
 					btrfs_extent_data_ref_root(leaf, dref),
 					btrfs_extent_data_ref_objectid(leaf, dref),
 					btrfs_extent_data_ref_offset(leaf, dref));
+			if (unlikely(!is_valid_dref_root(dref_root))) {
+				extent_err(leaf, slot,
+					   "invalid data ref root value %llu",
+					   dref_root);
+				return -EUCLEAN;
+			}
+			if (unlikely(dref_objectid < BTRFS_FIRST_FREE_OBJECTID ||
+				     dref_objectid > BTRFS_LAST_FREE_OBJECTID)) {
+				extent_err(leaf, slot,
+					   "invalid data ref objectid value %llu",
+					   dref_objectid);
+				return -EUCLEAN;
+			}
 			if (unlikely(!IS_ALIGNED(dref_offset,
 						 fs_info->sectorsize))) {
 				extent_err(leaf, slot,
@@ -1474,6 +1505,11 @@
 					   dref_offset, fs_info->sectorsize);
 				return -EUCLEAN;
 			}
+			if (unlikely(btrfs_extent_data_ref_count(leaf, dref) == 0)) {
+				extent_err(leaf, slot,
+			"invalid data ref count, should have non-zero value");
+				return -EUCLEAN;
+			}
 			inline_refs += btrfs_extent_data_ref_count(leaf, dref);
 			break;
 		/* Contains parent bytenr and ref count */
@@ -1486,6 +1522,11 @@
 					   inline_offset, fs_info->sectorsize);
 				return -EUCLEAN;
 			}
+			if (unlikely(btrfs_shared_data_ref_count(leaf, sref) == 0)) {
+				extent_err(leaf, slot,
+			"invalid shared data ref count, should have non-zero value");
+				return -EUCLEAN;
+			}
 			inline_refs += btrfs_shared_data_ref_count(leaf, sref);
 			break;
 		case BTRFS_EXTENT_OWNER_REF_KEY:
@@ -1558,8 +1599,18 @@
 {
 	u32 expect_item_size = 0;
 
-	if (key->type == BTRFS_SHARED_DATA_REF_KEY)
+	if (key->type == BTRFS_SHARED_DATA_REF_KEY) {
+		struct btrfs_shared_data_ref *sref;
+
+		sref = btrfs_item_ptr(leaf, slot, struct btrfs_shared_data_ref);
+		if (unlikely(btrfs_shared_data_ref_count(leaf, sref) == 0)) {
+			extent_err(leaf, slot,
+		"invalid shared data backref count, should have non-zero value");
+			return -EUCLEAN;
+		}
+
 		expect_item_size = sizeof(struct btrfs_shared_data_ref);
+	}
 
 	if (unlikely(btrfs_item_size(leaf, slot) != expect_item_size)) {
 		generic_err(leaf, slot,
@@ -1605,6 +1656,8 @@
 		return -EUCLEAN;
 	}
 	for (; ptr < end; ptr += sizeof(*dref)) {
+		u64 root;
+		u64 objectid;
 		u64 offset;
 
 		/*
@@ -1612,13 +1665,33 @@
 		 * overflow from the leaf due to hash collisions.
 		 */
 		dref = (struct btrfs_extent_data_ref *)ptr;
+		root = btrfs_extent_data_ref_root(leaf, dref);
+		objectid = btrfs_extent_data_ref_objectid(leaf, dref);
 		offset = btrfs_extent_data_ref_offset(leaf, dref);
+		if (unlikely(!is_valid_dref_root(root))) {
+			extent_err(leaf, slot,
+				   "invalid extent data backref root value %llu",
+				   root);
+			return -EUCLEAN;
+		}
+		if (unlikely(objectid < BTRFS_FIRST_FREE_OBJECTID ||
+			     objectid > BTRFS_LAST_FREE_OBJECTID)) {
+			extent_err(leaf, slot,
+				   "invalid extent data backref objectid value %llu",
+				   root);
+			return -EUCLEAN;
+		}
 		if (unlikely(!IS_ALIGNED(offset, leaf->fs_info->sectorsize))) {
 			extent_err(leaf, slot,
 	"invalid extent data backref offset, have %llu expect aligned to %u",
 				   offset, leaf->fs_info->sectorsize);
 			return -EUCLEAN;
 		}
+		if (unlikely(btrfs_extent_data_ref_count(leaf, dref) == 0)) {
+			extent_err(leaf, slot,
+	"invalid extent data backref count, should have non-zero value");
+			return -EUCLEAN;
+		}
 	}
 	return 0;
 }
@@ -1713,6 +1786,72 @@
 	return 0;
 }
 
+static int check_dev_extent_item(const struct extent_buffer *leaf,
+				 const struct btrfs_key *key,
+				 int slot,
+				 struct btrfs_key *prev_key)
+{
+	struct btrfs_dev_extent *de;
+	const u32 sectorsize = leaf->fs_info->sectorsize;
+
+	de = btrfs_item_ptr(leaf, slot, struct btrfs_dev_extent);
+	/* Basic fixed member checks. */
+	if (unlikely(btrfs_dev_extent_chunk_tree(leaf, de) !=
+		     BTRFS_CHUNK_TREE_OBJECTID)) {
+		generic_err(leaf, slot,
+			    "invalid dev extent chunk tree id, has %llu expect %llu",
+			    btrfs_dev_extent_chunk_tree(leaf, de),
+			    BTRFS_CHUNK_TREE_OBJECTID);
+		return -EUCLEAN;
+	}
+	if (unlikely(btrfs_dev_extent_chunk_objectid(leaf, de) !=
+		     BTRFS_FIRST_CHUNK_TREE_OBJECTID)) {
+		generic_err(leaf, slot,
+			    "invalid dev extent chunk objectid, has %llu expect %llu",
+			    btrfs_dev_extent_chunk_objectid(leaf, de),
+			    BTRFS_FIRST_CHUNK_TREE_OBJECTID);
+		return -EUCLEAN;
+	}
+	/* Alignment check. */
+	if (unlikely(!IS_ALIGNED(key->offset, sectorsize))) {
+		generic_err(leaf, slot,
+			    "invalid dev extent key.offset, has %llu not aligned to %u",
+			    key->offset, sectorsize);
+		return -EUCLEAN;
+	}
+	if (unlikely(!IS_ALIGNED(btrfs_dev_extent_chunk_offset(leaf, de),
+				 sectorsize))) {
+		generic_err(leaf, slot,
+			    "invalid dev extent chunk offset, has %llu not aligned to %u",
+			    btrfs_dev_extent_chunk_objectid(leaf, de),
+			    sectorsize);
+		return -EUCLEAN;
+	}
+	if (unlikely(!IS_ALIGNED(btrfs_dev_extent_length(leaf, de),
+				 sectorsize))) {
+		generic_err(leaf, slot,
+			    "invalid dev extent length, has %llu not aligned to %u",
+			    btrfs_dev_extent_length(leaf, de), sectorsize);
+		return -EUCLEAN;
+	}
+	/* Overlap check with previous dev extent. */
+	if (slot && prev_key->objectid == key->objectid &&
+	    prev_key->type == key->type) {
+		struct btrfs_dev_extent *prev_de;
+		u64 prev_len;
+
+		prev_de = btrfs_item_ptr(leaf, slot - 1, struct btrfs_dev_extent);
+		prev_len = btrfs_dev_extent_length(leaf, prev_de);
+		if (unlikely(prev_key->offset + prev_len > key->offset)) {
+			generic_err(leaf, slot,
+		"dev extent overlap, prev offset %llu len %llu current offset %llu",
+				    prev_key->objectid, prev_len, key->offset);
+			return -EUCLEAN;
+		}
+	}
+	return 0;
+}
+
 /*
  * Common point to switch the item-specific validation.
  */
@@ -1749,6 +1888,9 @@
 	case BTRFS_DEV_ITEM_KEY:
 		ret = check_dev_item(leaf, key, slot);
 		break;
+	case BTRFS_DEV_EXTENT_KEY:
+		ret = check_dev_extent_item(leaf, key, slot, prev_key);
+		break;
 	case BTRFS_INODE_ITEM_KEY:
 		ret = check_inode_item(leaf, key, slot);
 		break;
@@ -1793,6 +1935,11 @@
 		return BTRFS_TREE_BLOCK_INVALID_LEVEL;
 	}
 
+	if (unlikely(!btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_WRITTEN))) {
+		generic_err(leaf, 0, "invalid flag for leaf, WRITTEN not set");
+		return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET;
+	}
+
 	/*
 	 * Extent buffers from a relocation tree have a owner field that
 	 * corresponds to the subvolume tree they are based on. So just from an
@@ -1854,6 +2001,7 @@
 	for (slot = 0; slot < nritems; slot++) {
 		u32 item_end_expected;
 		u64 item_data_end;
+		enum btrfs_tree_block_status ret;
 
 		btrfs_item_key_to_cpu(leaf, &key, slot);
 
@@ -1909,21 +2057,10 @@
 			return BTRFS_TREE_BLOCK_INVALID_OFFSETS;
 		}
 
-		/*
-		 * We only want to do this if WRITTEN is set, otherwise the leaf
-		 * may be in some intermediate state and won't appear valid.
-		 */
-		if (btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_WRITTEN)) {
-			enum btrfs_tree_block_status ret;
-
-			/*
-			 * Check if the item size and content meet other
-			 * criteria
-			 */
-			ret = check_leaf_item(leaf, &key, slot, &prev_key);
-			if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
-				return ret;
-		}
+		/* Check if the item size and content meet other criteria. */
+		ret = check_leaf_item(leaf, &key, slot, &prev_key);
+		if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
+			return ret;
 
 		prev_key.objectid = key.objectid;
 		prev_key.type = key.type;
@@ -1953,6 +2090,11 @@
 	int level = btrfs_header_level(node);
 	u64 bytenr;
 
+	if (unlikely(!btrfs_header_flag(node, BTRFS_HEADER_FLAG_WRITTEN))) {
+		generic_err(node, 0, "invalid flag for node, WRITTEN not set");
+		return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET;
+	}
+
 	if (unlikely(level <= 0 || level >= BTRFS_MAX_LEVEL)) {
 		generic_err(node, 0,
 			"invalid level for node, have %d expect [1, %d]",
--- linux-qcom-6.8.0.orig/fs/btrfs/tree-checker.h
+++ linux-qcom-6.8.0/fs/btrfs/tree-checker.h
@@ -51,6 +51,7 @@
 	BTRFS_TREE_BLOCK_INVALID_BLOCKPTR,
 	BTRFS_TREE_BLOCK_INVALID_ITEM,
 	BTRFS_TREE_BLOCK_INVALID_OWNER,
+	BTRFS_TREE_BLOCK_WRITTEN_NOT_SET,
 };
 
 /*
--- linux-qcom-6.8.0.orig/fs/btrfs/tree-log.c
+++ linux-qcom-6.8.0/fs/btrfs/tree-log.c
@@ -140,6 +140,25 @@
  * and once to do all the other items.
  */
 
+static struct inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *root)
+{
+	unsigned int nofs_flag;
+	struct inode *inode;
+
+	/*
+	 * We're holding a transaction handle whether we are logging or
+	 * replaying a log tree, so we must make sure NOFS semantics apply
+	 * because btrfs_alloc_inode() may be triggered and it uses GFP_KERNEL
+	 * to allocate an inode, which can recurse back into the filesystem and
+	 * attempt a transaction commit, resulting in a deadlock.
+	 */
+	nofs_flag = memalloc_nofs_save();
+	inode = btrfs_iget(root->fs_info->sb, objectid, root);
+	memalloc_nofs_restore(nofs_flag);
+
+	return inode;
+}
+
 /*
  * start a sub transaction and setup the log tree
  * this increments the log tree writer count to make the people
@@ -602,7 +621,7 @@
 {
 	struct inode *inode;
 
-	inode = btrfs_iget(root->fs_info->sb, objectid, root);
+	inode = btrfs_iget_logging(objectid, root);
 	if (IS_ERR(inode))
 		inode = NULL;
 	return inode;
@@ -1355,7 +1374,7 @@
 	struct inode *inode = NULL;
 	unsigned long ref_ptr;
 	unsigned long ref_end;
-	struct fscrypt_str name;
+	struct fscrypt_str name = { 0 };
 	int ret;
 	int log_ref_ver = 0;
 	u64 parent_objectid;
@@ -1825,7 +1844,7 @@
 				    struct btrfs_dir_item *di,
 				    struct btrfs_key *key)
 {
-	struct fscrypt_str name;
+	struct fscrypt_str name = { 0 };
 	struct btrfs_dir_item *dir_dst_di;
 	struct btrfs_dir_item *index_dst_di;
 	bool dir_dst_matches = false;
@@ -2105,7 +2124,7 @@
 	struct extent_buffer *eb;
 	int slot;
 	struct btrfs_dir_item *di;
-	struct fscrypt_str name;
+	struct fscrypt_str name = { 0 };
 	struct inode *inode = NULL;
 	struct btrfs_key location;
 
@@ -4794,18 +4813,23 @@
 			path->slots[0]++;
 			continue;
 		}
-		if (!dropped_extents) {
-			/*
-			 * Avoid logging extent items logged in past fsync calls
-			 * and leading to duplicate keys in the log tree.
-			 */
+		/*
+		 * Avoid overlapping items in the log tree. The first time we
+		 * get here, get rid of everything from a past fsync. After
+		 * that, if the current extent starts before the end of the last
+		 * extent we copied, truncate the last one. This can happen if
+		 * an ordered extent completion modifies the subvolume tree
+		 * while btrfs_next_leaf() has the tree unlocked.
+		 */
+		if (!dropped_extents || key.offset < truncate_offset) {
 			ret = truncate_inode_items(trans, root->log_root, inode,
-						   truncate_offset,
+						   min(key.offset, truncate_offset),
 						   BTRFS_EXTENT_DATA_KEY);
 			if (ret)
 				goto out;
 			dropped_extents = true;
 		}
+		truncate_offset = btrfs_file_extent_end(path);
 		if (ins_nr == 0)
 			start_slot = slot;
 		ins_nr++;
@@ -5366,7 +5390,6 @@
 				struct btrfs_log_ctx *ctx)
 {
 	struct btrfs_root *root = start_inode->root;
-	struct btrfs_fs_info *fs_info = root->fs_info;
 	struct btrfs_path *path;
 	LIST_HEAD(dir_list);
 	struct btrfs_dir_list *dir_elem;
@@ -5427,7 +5450,7 @@
 				continue;
 
 			btrfs_release_path(path);
-			di_inode = btrfs_iget(fs_info->sb, di_key.objectid, root);
+			di_inode = btrfs_iget_logging(di_key.objectid, root);
 			if (IS_ERR(di_inode)) {
 				ret = PTR_ERR(di_inode);
 				goto out;
@@ -5487,7 +5510,7 @@
 		btrfs_add_delayed_iput(curr_inode);
 		curr_inode = NULL;
 
-		vfs_inode = btrfs_iget(fs_info->sb, ino, root);
+		vfs_inode = btrfs_iget_logging(ino, root);
 		if (IS_ERR(vfs_inode)) {
 			ret = PTR_ERR(vfs_inode);
 			break;
@@ -5582,7 +5605,7 @@
 	if (ctx->num_conflict_inodes >= MAX_CONFLICT_INODES)
 		return BTRFS_LOG_FORCE_COMMIT;
 
-	inode = btrfs_iget(root->fs_info->sb, ino, root);
+	inode = btrfs_iget_logging(ino, root);
 	/*
 	 * If the other inode that had a conflicting dir entry was deleted in
 	 * the current transaction then we either:
@@ -5683,7 +5706,6 @@
 				  struct btrfs_root *root,
 				  struct btrfs_log_ctx *ctx)
 {
-	struct btrfs_fs_info *fs_info = root->fs_info;
 	int ret = 0;
 
 	/*
@@ -5714,7 +5736,7 @@
 		list_del(&curr->list);
 		kfree(curr);
 
-		inode = btrfs_iget(fs_info->sb, ino, root);
+		inode = btrfs_iget_logging(ino, root);
 		/*
 		 * If the other inode that had a conflicting dir entry was
 		 * deleted in the current transaction, we need to log its parent
@@ -5725,7 +5747,7 @@
 			if (ret != -ENOENT)
 				break;
 
-			inode = btrfs_iget(fs_info->sb, parent, root);
+			inode = btrfs_iget_logging(parent, root);
 			if (IS_ERR(inode)) {
 				ret = PTR_ERR(inode);
 				break;
@@ -6247,7 +6269,6 @@
 				    struct btrfs_log_ctx *ctx)
 {
 	const bool orig_log_new_dentries = ctx->log_new_dentries;
-	struct btrfs_fs_info *fs_info = trans->fs_info;
 	struct btrfs_delayed_item *item;
 	int ret = 0;
 
@@ -6273,7 +6294,7 @@
 		if (key.type == BTRFS_ROOT_ITEM_KEY)
 			continue;
 
-		di_inode = btrfs_iget(fs_info->sb, key.objectid, inode->root);
+		di_inode = btrfs_iget_logging(key.objectid, inode->root);
 		if (IS_ERR(di_inode)) {
 			ret = PTR_ERR(di_inode);
 			break;
@@ -6657,7 +6678,6 @@
 				 struct btrfs_inode *inode,
 				 struct btrfs_log_ctx *ctx)
 {
-	struct btrfs_fs_info *fs_info = trans->fs_info;
 	int ret;
 	struct btrfs_path *path;
 	struct btrfs_key key;
@@ -6722,8 +6742,7 @@
 				cur_offset = item_size;
 			}
 
-			dir_inode = btrfs_iget(fs_info->sb, inode_key.objectid,
-					       root);
+			dir_inode = btrfs_iget_logging(inode_key.objectid, root);
 			/*
 			 * If the parent inode was deleted, return an error to
 			 * fallback to a transaction commit. This is to prevent
@@ -6785,7 +6804,6 @@
 	btrfs_item_key_to_cpu(path->nodes[0], &found_key, path->slots[0]);
 
 	while (true) {
-		struct btrfs_fs_info *fs_info = root->fs_info;
 		struct extent_buffer *leaf;
 		int slot;
 		struct btrfs_key search_key;
@@ -6800,7 +6818,7 @@
 		search_key.objectid = found_key.offset;
 		search_key.type = BTRFS_INODE_ITEM_KEY;
 		search_key.offset = 0;
-		inode = btrfs_iget(fs_info->sb, ino, root);
+		inode = btrfs_iget_logging(ino, root);
 		if (IS_ERR(inode))
 			return PTR_ERR(inode);
 
--- linux-qcom-6.8.0.orig/fs/btrfs/tree-log.h
+++ linux-qcom-6.8.0/fs/btrfs/tree-log.h
@@ -60,7 +60,7 @@
 	struct btrfs_ordered_extent *ordered;
 	struct btrfs_ordered_extent *tmp;
 
-	ASSERT(inode_is_locked(ctx->inode));
+	btrfs_assert_inode_locked(BTRFS_I(ctx->inode));
 
 	list_for_each_entry_safe(ordered, tmp, &ctx->ordered_extents, log_list) {
 		list_del_init(&ordered->log_list);
--- linux-qcom-6.8.0.orig/fs/btrfs/verity.c
+++ linux-qcom-6.8.0/fs/btrfs/verity.c
@@ -461,7 +461,7 @@
 	struct btrfs_root *root = inode->root;
 	int ret;
 
-	ASSERT(inode_is_locked(&inode->vfs_inode));
+	btrfs_assert_inode_locked(inode);
 	truncate_inode_pages(inode->vfs_inode.i_mapping, inode->vfs_inode.i_size);
 	clear_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
 	ret = btrfs_drop_verity_items(inode);
@@ -586,7 +586,7 @@
 	struct btrfs_trans_handle *trans;
 	int ret;
 
-	ASSERT(inode_is_locked(file_inode(filp)));
+	btrfs_assert_inode_locked(inode);
 
 	if (test_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags))
 		return -EBUSY;
@@ -634,7 +634,7 @@
 	int ret = 0;
 	int rollback_ret;
 
-	ASSERT(inode_is_locked(file_inode(filp)));
+	btrfs_assert_inode_locked(inode);
 
 	if (desc == NULL)
 		goto rollback;
--- linux-qcom-6.8.0.orig/fs/btrfs/volumes.c
+++ linux-qcom-6.8.0/fs/btrfs/volumes.c
@@ -694,6 +694,16 @@
 	device->bdev = bdev_handle->bdev;
 	clear_bit(BTRFS_DEV_STATE_IN_FS_METADATA, &device->dev_state);
 
+	if (device->devt != device->bdev->bd_dev) {
+		btrfs_warn(NULL,
+			   "device %s maj:min changed from %d:%d to %d:%d",
+			   device->name->str, MAJOR(device->devt),
+			   MINOR(device->devt), MAJOR(device->bdev->bd_dev),
+			   MINOR(device->bdev->bd_dev));
+
+		device->devt = device->bdev->bd_dev;
+	}
+
 	fs_devices->open_devices++;
 	if (test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state) &&
 	    device->devid != BTRFS_DEV_REPLACE_DEVID) {
@@ -719,6 +729,42 @@
 	return has_metadata_uuid ? sb->metadata_uuid : sb->fsid;
 }
 
+static bool is_same_device(struct btrfs_device *device, const char *new_path)
+{
+	struct path old = { .mnt = NULL, .dentry = NULL };
+	struct path new = { .mnt = NULL, .dentry = NULL };
+	char *old_path = NULL;
+	bool is_same = false;
+	int ret;
+
+	if (!device->name)
+		goto out;
+
+	old_path = kzalloc(PATH_MAX, GFP_NOFS);
+	if (!old_path)
+		goto out;
+
+	rcu_read_lock();
+	ret = strscpy(old_path, rcu_str_deref(device->name), PATH_MAX);
+	rcu_read_unlock();
+	if (ret < 0)
+		goto out;
+
+	ret = kern_path(old_path, LOOKUP_FOLLOW, &old);
+	if (ret)
+		goto out;
+	ret = kern_path(new_path, LOOKUP_FOLLOW, &new);
+	if (ret)
+		goto out;
+	if (path_equal(&old, &new))
+		is_same = true;
+out:
+	kfree(old_path);
+	path_put(&old);
+	path_put(&new);
+	return is_same;
+}
+
 /*
  * Add new device to list of registered devices
  *
@@ -835,7 +881,7 @@
 				disk_super->fsid, devid, found_transid, path,
 				current->comm, task_pid_nr(current));
 
-	} else if (!device->name || strcmp(device->name->str, path)) {
+	} else if (!device->name || !is_same_device(device, path)) {
 		/*
 		 * When FS is already mounted.
 		 * 1. If you are here and if the device->name is NULL that
@@ -1172,23 +1218,30 @@
 	struct btrfs_device *device;
 	struct btrfs_device *latest_dev = NULL;
 	struct btrfs_device *tmp_device;
+	int ret = 0;
 
 	list_for_each_entry_safe(device, tmp_device, &fs_devices->devices,
 				 dev_list) {
-		int ret;
+		int ret2;
 
-		ret = btrfs_open_one_device(fs_devices, device, flags, holder);
-		if (ret == 0 &&
+		ret2 = btrfs_open_one_device(fs_devices, device, flags, holder);
+		if (ret2 == 0 &&
 		    (!latest_dev || device->generation > latest_dev->generation)) {
 			latest_dev = device;
-		} else if (ret == -ENODATA) {
+		} else if (ret2 == -ENODATA) {
 			fs_devices->num_devices--;
 			list_del(&device->dev_list);
 			btrfs_free_device(device);
 		}
+		if (ret == 0 && ret2 != 0)
+			ret = ret2;
 	}
-	if (fs_devices->open_devices == 0)
+
+	if (fs_devices->open_devices == 0) {
+		if (ret)
+			return ret;
 		return -EINVAL;
+	}
 
 	fs_devices->opened = 1;
 	fs_devices->latest_dev = latest_dev;
@@ -1301,6 +1354,47 @@
 	return ret;
 }
 
+static bool btrfs_skip_registration(struct btrfs_super_block *disk_super,
+				    const char *path, dev_t devt,
+				    bool mount_arg_dev)
+{
+	struct btrfs_fs_devices *fs_devices;
+
+	/*
+	 * Do not skip device registration for mounted devices with matching
+	 * maj:min but different paths. Booting without initrd relies on
+	 * /dev/root initially, later replaced with the actual root device.
+	 * A successful scan ensures grub2-probe selects the correct device.
+	 */
+	list_for_each_entry(fs_devices, &fs_uuids, fs_list) {
+		struct btrfs_device *device;
+
+		mutex_lock(&fs_devices->device_list_mutex);
+
+		if (!fs_devices->opened) {
+			mutex_unlock(&fs_devices->device_list_mutex);
+			continue;
+		}
+
+		list_for_each_entry(device, &fs_devices->devices, dev_list) {
+			if (device->bdev && (device->bdev->bd_dev == devt) &&
+			    strcmp(device->name->str, path) != 0) {
+				mutex_unlock(&fs_devices->device_list_mutex);
+
+				/* Do not skip registration. */
+				return false;
+			}
+		}
+		mutex_unlock(&fs_devices->device_list_mutex);
+	}
+
+	if (!mount_arg_dev && btrfs_super_num_devices(disk_super) == 1 &&
+	    !(btrfs_super_flags(disk_super) & BTRFS_SUPER_FLAG_SEEDING))
+		return true;
+
+	return false;
+}
+
 /*
  * Look for a btrfs signature on a device. This may be called out of the mount path
  * and we are not allowed to call set_blocksize during the scan. The superblock
@@ -1357,18 +1451,14 @@
 		goto error_bdev_put;
 	}
 
-	if (!mount_arg_dev && btrfs_super_num_devices(disk_super) == 1 &&
-	    !(btrfs_super_flags(disk_super) & BTRFS_SUPER_FLAG_SEEDING)) {
-		dev_t devt;
+	if (btrfs_skip_registration(disk_super, path, bdev_handle->bdev->bd_dev,
+				    mount_arg_dev)) {
+		pr_debug("BTRFS: skip registering single non-seed device %s (%d:%d)\n",
+			  path, MAJOR(bdev_handle->bdev->bd_dev),
+			  MINOR(bdev_handle->bdev->bd_dev));
 
-		ret = lookup_bdev(path, &devt);
-		if (ret)
-			btrfs_warn(NULL, "lookup bdev failed for path %s: %d",
-				   path, ret);
-		else
-			btrfs_free_stale_devices(devt, NULL);
+		btrfs_free_stale_devices(bdev_handle->bdev->bd_dev, NULL);
 
-		pr_debug("BTRFS: skip registering single non-seed device %s\n", path);
 		device = NULL;
 		goto free_disk_super;
 	}
@@ -1403,7 +1493,7 @@
 
 		if (in_range(physical_start, *start, len) ||
 		    in_range(*start, physical_start,
-			     physical_end - physical_start)) {
+			     physical_end + 1 - physical_start)) {
 			*start = physical_end + 1;
 			return true;
 		}
@@ -2664,8 +2754,6 @@
 	set_blocksize(device->bdev, BTRFS_BDEV_BLOCKSIZE);
 
 	if (seeding_dev) {
-		btrfs_clear_sb_rdonly(sb);
-
 		/* GFP_KERNEL allocation must not be under device_list_mutex */
 		seed_devices = btrfs_init_sprout(fs_info);
 		if (IS_ERR(seed_devices)) {
@@ -2808,8 +2896,6 @@
 	mutex_unlock(&fs_info->chunk_mutex);
 	mutex_unlock(&fs_info->fs_devices->device_list_mutex);
 error_trans:
-	if (seeding_dev)
-		btrfs_set_sb_rdonly(sb);
 	if (trans)
 		btrfs_end_transaction(trans);
 error_free_zone:
@@ -3393,7 +3479,18 @@
 			mutex_unlock(&fs_info->reclaim_bgs_lock);
 			goto error;
 		}
-		BUG_ON(ret == 0); /* Corruption */
+		if (ret == 0) {
+			/*
+			 * On the first search we would find chunk tree with
+			 * offset -1, which is not possible. On subsequent
+			 * loops this would find an existing item on an invalid
+			 * offset (one less than the previous one, wrong
+			 * alignment and size).
+			 */
+			ret = -EUCLEAN;
+			mutex_unlock(&fs_info->reclaim_bgs_lock);
+			goto error;
+		}
 
 		ret = btrfs_previous_item(chunk_root, path, key.objectid,
 					  key.type);
@@ -6563,13 +6660,15 @@
 	max_len = btrfs_max_io_len(map, map_offset, &io_geom);
 	*length = min_t(u64, map->chunk_len - map_offset, max_len);
 
-	down_read(&dev_replace->rwsem);
+	if (dev_replace->replace_task != current)
+		down_read(&dev_replace->rwsem);
+
 	dev_replace_is_ongoing = btrfs_dev_replace_is_ongoing(dev_replace);
 	/*
 	 * Hold the semaphore for read during the whole operation, write is
 	 * requested at commit time but must wait.
 	 */
-	if (!dev_replace_is_ongoing)
+	if (!dev_replace_is_ongoing && dev_replace->replace_task != current)
 		up_read(&dev_replace->rwsem);
 
 	switch (map->type & BTRFS_BLOCK_GROUP_PROFILE_MASK) {
@@ -6710,7 +6809,7 @@
 	bioc->mirror_num = io_geom.mirror_num;
 
 out:
-	if (dev_replace_is_ongoing) {
+	if (dev_replace_is_ongoing && dev_replace->replace_task != current) {
 		lockdep_assert_held(&dev_replace->rwsem);
 		/* Unlock and let waiting writers proceed */
 		up_read(&dev_replace->rwsem);
--- linux-qcom-6.8.0.orig/fs/btrfs/volumes.h
+++ linux-qcom-6.8.0/fs/btrfs/volumes.h
@@ -15,6 +15,12 @@
 
 #define BTRFS_MAX_DATA_CHUNK_SIZE	(10ULL * SZ_1G)
 
+/*
+ * Arbitratry maximum size of one discard request to limit potentially long time
+ * spent in blkdev_issue_discard().
+ */
+#define BTRFS_MAX_DISCARD_CHUNK_SIZE	(SZ_1G)
+
 extern struct mutex uuid_mutex;
 
 #define BTRFS_STRIPE_LEN		SZ_64K
--- linux-qcom-6.8.0.orig/fs/btrfs/xattr.c
+++ linux-qcom-6.8.0/fs/btrfs/xattr.c
@@ -120,7 +120,7 @@
 	 * locks the inode's i_mutex before calling setxattr or removexattr.
 	 */
 	if (flags & XATTR_REPLACE) {
-		ASSERT(inode_is_locked(inode));
+		btrfs_assert_inode_locked(BTRFS_I(inode));
 		di = btrfs_lookup_xattr(NULL, root, path,
 				btrfs_ino(BTRFS_I(inode)), name, name_len, 0);
 		if (!di)
--- linux-qcom-6.8.0.orig/fs/btrfs/zoned.c
+++ linux-qcom-6.8.0/fs/btrfs/zoned.c
@@ -1279,7 +1279,7 @@
 				struct btrfs_chunk_map *map)
 {
 	struct btrfs_dev_replace *dev_replace = &fs_info->dev_replace;
-	struct btrfs_device *device = map->stripes[zone_idx].dev;
+	struct btrfs_device *device;
 	int dev_replace_is_ongoing = 0;
 	unsigned int nofs_flag;
 	struct blk_zone zone;
@@ -1287,7 +1287,11 @@
 
 	info->physical = map->stripes[zone_idx].physical;
 
+	down_read(&dev_replace->rwsem);
+	device = map->stripes[zone_idx].dev;
+
 	if (!device->bdev) {
+		up_read(&dev_replace->rwsem);
 		info->alloc_offset = WP_MISSING_DEV;
 		return 0;
 	}
@@ -1297,6 +1301,7 @@
 		__set_bit(zone_idx, active);
 
 	if (!btrfs_dev_is_sequential(device, info->physical)) {
+		up_read(&dev_replace->rwsem);
 		info->alloc_offset = WP_CONVENTIONAL;
 		return 0;
 	}
@@ -1304,11 +1309,9 @@
 	/* This zone will be used for allocation, so mark this zone non-empty. */
 	btrfs_dev_clear_zone_empty(device, info->physical);
 
-	down_read(&dev_replace->rwsem);
 	dev_replace_is_ongoing = btrfs_dev_replace_is_ongoing(dev_replace);
 	if (dev_replace_is_ongoing && dev_replace->tgtdev != NULL)
 		btrfs_dev_clear_zone_empty(dev_replace->tgtdev, info->physical);
-	up_read(&dev_replace->rwsem);
 
 	/*
 	 * The group is mapped to a sequential zone. Get the zone write pointer
@@ -1319,6 +1322,7 @@
 	ret = btrfs_get_dev_zone(device, info->physical, &zone);
 	memalloc_nofs_restore(nofs_flag);
 	if (ret) {
+		up_read(&dev_replace->rwsem);
 		if (ret != -EIO && ret != -EOPNOTSUPP)
 			return ret;
 		info->alloc_offset = WP_MISSING_DEV;
@@ -1330,6 +1334,7 @@
 		"zoned: unexpected conventional zone %llu on device %s (devid %llu)",
 			zone.start << SECTOR_SHIFT, rcu_str_deref(device->name),
 			device->devid);
+		up_read(&dev_replace->rwsem);
 		return -EIO;
 	}
 
@@ -1338,7 +1343,7 @@
 	switch (zone.cond) {
 	case BLK_ZONE_COND_OFFLINE:
 	case BLK_ZONE_COND_READONLY:
-		btrfs_err(fs_info,
+		btrfs_err_in_rcu(fs_info,
 		"zoned: offline/readonly zone %llu on device %s (devid %llu)",
 			  (info->physical >> device->zone_info->zone_size_shift),
 			  rcu_str_deref(device->name), device->devid);
@@ -1357,6 +1362,8 @@
 		break;
 	}
 
+	up_read(&dev_replace->rwsem);
+
 	return 0;
 }
 
@@ -1390,6 +1397,8 @@
 		return -EINVAL;
 	}
 
+	bg->zone_capacity = min_not_zero(zone_info[0].capacity, zone_info[1].capacity);
+
 	if (zone_info[0].alloc_offset == WP_MISSING_DEV) {
 		btrfs_err(bg->fs_info,
 			  "zoned: cannot recover write pointer for zone %llu",
@@ -1416,7 +1425,6 @@
 	}
 
 	bg->alloc_offset = zone_info[0].alloc_offset;
-	bg->zone_capacity = min(zone_info[0].capacity, zone_info[1].capacity);
 	return 0;
 }
 
@@ -1434,6 +1442,9 @@
 		return -EINVAL;
 	}
 
+	/* In case a device is missing we have a cap of 0, so don't use it. */
+	bg->zone_capacity = min_not_zero(zone_info[0].capacity, zone_info[1].capacity);
+
 	for (i = 0; i < map->num_stripes; i++) {
 		if (zone_info[i].alloc_offset == WP_MISSING_DEV ||
 		    zone_info[i].alloc_offset == WP_CONVENTIONAL)
@@ -1455,9 +1466,6 @@
 			if (test_bit(0, active))
 				set_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &bg->runtime_flags);
 		}
-		/* In case a device is missing we have a cap of 0, so don't use it. */
-		bg->zone_capacity = min_not_zero(zone_info[0].capacity,
-						 zone_info[1].capacity);
 	}
 
 	if (zone_info[0].alloc_offset != WP_MISSING_DEV)
@@ -1547,6 +1555,7 @@
 	unsigned long *active = NULL;
 	u64 last_alloc = 0;
 	u32 num_sequential = 0, num_conventional = 0;
+	u64 profile;
 
 	if (!btrfs_is_zoned(fs_info))
 		return 0;
@@ -1563,11 +1572,7 @@
 	if (!map)
 		return -EINVAL;
 
-	cache->physical_map = btrfs_clone_chunk_map(map, GFP_NOFS);
-	if (!cache->physical_map) {
-		ret = -ENOMEM;
-		goto out;
-	}
+	cache->physical_map = map;
 
 	zone_info = kcalloc(map->num_stripes, sizeof(*zone_info), GFP_NOFS);
 	if (!zone_info) {
@@ -1611,7 +1616,8 @@
 		}
 	}
 
-	switch (map->type & BTRFS_BLOCK_GROUP_PROFILE_MASK) {
+	profile = map->type & BTRFS_BLOCK_GROUP_PROFILE_MASK;
+	switch (profile) {
 	case 0: /* single */
 		ret = btrfs_load_block_group_single(cache, &zone_info[0], active);
 		break;
@@ -1638,6 +1644,23 @@
 		goto out;
 	}
 
+	if (ret == -EIO && profile != 0 && profile != BTRFS_BLOCK_GROUP_RAID0 &&
+	    profile != BTRFS_BLOCK_GROUP_RAID10) {
+		/*
+		 * Detected broken write pointer.  Make this block group
+		 * unallocatable by setting the allocation pointer at the end of
+		 * allocatable region. Relocating this block group will fix the
+		 * mismatch.
+		 *
+		 * Currently, we cannot handle RAID0 or RAID10 case like this
+		 * because we don't have a proper zone_capacity value. But,
+		 * reading from this block group won't work anyway by a missing
+		 * stripe.
+		 */
+		cache->alloc_offset = cache->zone_capacity;
+		ret = 0;
+	}
+
 out:
 	/* Reject non SINGLE data profiles without RST */
 	if ((map->type & BTRFS_BLOCK_GROUP_DATA) &&
@@ -1679,7 +1702,6 @@
 	}
 	bitmap_free(active);
 	kfree(zone_info);
-	btrfs_free_chunk_map(map);
 
 	return ret;
 }
@@ -2164,6 +2186,7 @@
 	struct btrfs_chunk_map *map;
 	const bool is_metadata = (block_group->flags &
 			(BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_SYSTEM));
+	struct btrfs_dev_replace *dev_replace = &fs_info->dev_replace;
 	int ret = 0;
 	int i;
 
@@ -2239,6 +2262,7 @@
 	btrfs_clear_data_reloc_bg(block_group);
 	spin_unlock(&block_group->lock);
 
+	down_read(&dev_replace->rwsem);
 	map = block_group->physical_map;
 	for (i = 0; i < map->num_stripes; i++) {
 		struct btrfs_device *device = map->stripes[i].dev;
@@ -2253,13 +2277,16 @@
 				       zinfo->zone_size >> SECTOR_SHIFT,
 				       GFP_NOFS);
 
-		if (ret)
+		if (ret) {
+			up_read(&dev_replace->rwsem);
 			return ret;
+		}
 
 		if (!(block_group->flags & BTRFS_BLOCK_GROUP_DATA))
 			zinfo->reserved_active_zones++;
 		btrfs_dev_clear_active_zone(device, physical);
 	}
+	up_read(&dev_replace->rwsem);
 
 	if (!fully_written)
 		btrfs_dec_block_group_ro(block_group);
--- linux-qcom-6.8.0.orig/fs/buffer.c
+++ linux-qcom-6.8.0/fs/buffer.c
@@ -2162,6 +2162,8 @@
 	struct buffer_head *bh, *head;
 
 	bh = head = folio_buffers(folio);
+	if (!bh)
+		return;
 	blocksize = bh->b_size;
 
 	block_start = 0;
--- linux-qcom-6.8.0.orig/fs/cachefiles/cache.c
+++ linux-qcom-6.8.0/fs/cachefiles/cache.c
@@ -8,6 +8,7 @@
 #include <linux/slab.h>
 #include <linux/statfs.h>
 #include <linux/namei.h>
+#include <trace/events/fscache.h>
 #include "internal.h"
 
 /*
@@ -312,19 +313,59 @@
 }
 
 /*
- * Withdraw volumes.
+ * Withdraw fscache volumes.
+ */
+static void cachefiles_withdraw_fscache_volumes(struct cachefiles_cache *cache)
+{
+	struct list_head *cur;
+	struct cachefiles_volume *volume;
+	struct fscache_volume *vcookie;
+
+	_enter("");
+retry:
+	spin_lock(&cache->object_list_lock);
+	list_for_each(cur, &cache->volumes) {
+		volume = list_entry(cur, struct cachefiles_volume, cache_link);
+
+		if (atomic_read(&volume->vcookie->n_accesses) == 0)
+			continue;
+
+		vcookie = fscache_try_get_volume(volume->vcookie,
+						 fscache_volume_get_withdraw);
+		if (vcookie) {
+			spin_unlock(&cache->object_list_lock);
+			fscache_withdraw_volume(vcookie);
+			fscache_put_volume(vcookie, fscache_volume_put_withdraw);
+			goto retry;
+		}
+	}
+	spin_unlock(&cache->object_list_lock);
+
+	_leave("");
+}
+
+/*
+ * Withdraw cachefiles volumes.
  */
 static void cachefiles_withdraw_volumes(struct cachefiles_cache *cache)
 {
 	_enter("");
 
 	for (;;) {
+		struct fscache_volume *vcookie = NULL;
 		struct cachefiles_volume *volume = NULL;
 
 		spin_lock(&cache->object_list_lock);
 		if (!list_empty(&cache->volumes)) {
 			volume = list_first_entry(&cache->volumes,
 						  struct cachefiles_volume, cache_link);
+			vcookie = fscache_try_get_volume(volume->vcookie,
+							 fscache_volume_get_withdraw);
+			if (!vcookie) {
+				spin_unlock(&cache->object_list_lock);
+				cpu_relax();
+				continue;
+			}
 			list_del_init(&volume->cache_link);
 		}
 		spin_unlock(&cache->object_list_lock);
@@ -332,6 +373,7 @@
 			break;
 
 		cachefiles_withdraw_volume(volume);
+		fscache_put_volume(vcookie, fscache_volume_put_withdraw);
 	}
 
 	_leave("");
@@ -371,6 +413,7 @@
 	pr_info("File cache on %s unregistering\n", fscache->name);
 
 	fscache_withdraw_cache(fscache);
+	cachefiles_withdraw_fscache_volumes(cache);
 
 	/* we now have to destroy all the active objects pertaining to this
 	 * cache - which we do by passing them off to thread pool to be
--- linux-qcom-6.8.0.orig/fs/cachefiles/daemon.c
+++ linux-qcom-6.8.0/fs/cachefiles/daemon.c
@@ -15,6 +15,7 @@
 #include <linux/namei.h>
 #include <linux/poll.h>
 #include <linux/mount.h>
+#include <linux/security.h>
 #include <linux/statfs.h>
 #include <linux/ctype.h>
 #include <linux/string.h>
@@ -133,7 +134,7 @@
 	return 0;
 }
 
-static void cachefiles_flush_reqs(struct cachefiles_cache *cache)
+void cachefiles_flush_reqs(struct cachefiles_cache *cache)
 {
 	struct xarray *xa = &cache->reqs;
 	struct cachefiles_req *req;
@@ -159,6 +160,7 @@
 	xa_for_each(xa, index, req) {
 		req->error = -EIO;
 		complete(&req->done);
+		__xa_erase(xa, index);
 	}
 	xa_unlock(xa);
 
@@ -365,14 +367,14 @@
 
 	if (cachefiles_in_ondemand_mode(cache)) {
 		if (!xa_empty(&cache->reqs)) {
-			rcu_read_lock();
+			xas_lock(&xas);
 			xas_for_each_marked(&xas, req, ULONG_MAX, CACHEFILES_REQ_NEW) {
 				if (!cachefiles_ondemand_is_reopening_read(req)) {
 					mask |= EPOLLIN;
 					break;
 				}
 			}
-			rcu_read_unlock();
+			xas_unlock(&xas);
 		}
 	} else {
 		if (test_bit(CACHEFILES_STATE_CHANGED, &cache->flags))
@@ -575,7 +577,7 @@
  */
 static int cachefiles_daemon_secctx(struct cachefiles_cache *cache, char *args)
 {
-	char *secctx;
+	int err;
 
 	_enter(",%s", args);
 
@@ -584,16 +586,16 @@
 		return -EINVAL;
 	}
 
-	if (cache->secctx) {
+	if (cache->have_secid) {
 		pr_err("Second security context specified\n");
 		return -EINVAL;
 	}
 
-	secctx = kstrdup(args, GFP_KERNEL);
-	if (!secctx)
-		return -ENOMEM;
+	err = security_secctx_to_secid(args, strlen(args), &cache->secid);
+	if (err)
+		return err;
 
-	cache->secctx = secctx;
+	cache->have_secid = true;
 	return 0;
 }
 
@@ -819,7 +821,6 @@
 	put_cred(cache->cache_cred);
 
 	kfree(cache->rootdirname);
-	kfree(cache->secctx);
 	kfree(cache->tag);
 
 	_leave("");
--- linux-qcom-6.8.0.orig/fs/cachefiles/interface.c
+++ linux-qcom-6.8.0/fs/cachefiles/interface.c
@@ -327,6 +327,8 @@
 static void cachefiles_clean_up_object(struct cachefiles_object *object,
 				       struct cachefiles_cache *cache)
 {
+	struct file *file;
+
 	if (test_bit(FSCACHE_COOKIE_RETIRED, &object->cookie->flags)) {
 		if (!test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags)) {
 			cachefiles_see_object(object, cachefiles_obj_see_clean_delete);
@@ -342,10 +344,14 @@
 	}
 
 	cachefiles_unmark_inode_in_use(object, object->file);
-	if (object->file) {
-		fput(object->file);
-		object->file = NULL;
-	}
+
+	spin_lock(&object->lock);
+	file = object->file;
+	object->file = NULL;
+	spin_unlock(&object->lock);
+
+	if (file)
+		fput(file);
 }
 
 /*
--- linux-qcom-6.8.0.orig/fs/cachefiles/internal.h
+++ linux-qcom-6.8.0/fs/cachefiles/internal.h
@@ -48,6 +48,7 @@
 	CACHEFILES_ONDEMAND_OBJSTATE_CLOSE, /* Anonymous fd closed by daemon or initial state */
 	CACHEFILES_ONDEMAND_OBJSTATE_OPEN, /* Anonymous fd associated with object is available */
 	CACHEFILES_ONDEMAND_OBJSTATE_REOPENING, /* Object that was closed and is being reopened. */
+	CACHEFILES_ONDEMAND_OBJSTATE_DROPPING, /* Object is being dropped. */
 };
 
 struct cachefiles_ondemand_info {
@@ -55,6 +56,7 @@
 	int				ondemand_id;
 	enum cachefiles_object_state	state;
 	struct cachefiles_object	*object;
+	spinlock_t			lock;
 };
 
 /*
@@ -120,13 +122,15 @@
 #define CACHEFILES_STATE_CHANGED	3	/* T if state changed (poll trigger) */
 #define CACHEFILES_ONDEMAND_MODE	4	/* T if in on-demand read mode */
 	char				*rootdirname;	/* name of cache root directory */
-	char				*secctx;	/* LSM security context */
 	char				*tag;		/* cache binding tag */
 	refcount_t			unbind_pincount;/* refcount to do daemon unbind */
 	struct xarray			reqs;		/* xarray of pending on-demand requests */
 	unsigned long			req_id_next;
 	struct xarray			ondemand_ids;	/* xarray for ondemand_id allocation */
 	u32				ondemand_id_next;
+	u32				msg_id_next;
+	u32				secid;		/* LSM security id */
+	bool				have_secid;	/* whether "secid" was set */
 };
 
 static inline bool cachefiles_in_ondemand_mode(struct cachefiles_cache *cache)
@@ -138,6 +142,7 @@
 struct cachefiles_req {
 	struct cachefiles_object *object;
 	struct completion done;
+	refcount_t ref;
 	int error;
 	struct cachefiles_msg msg;
 };
@@ -186,6 +191,7 @@
  * daemon.c
  */
 extern const struct file_operations cachefiles_daemon_fops;
+extern void cachefiles_flush_reqs(struct cachefiles_cache *cache);
 extern void cachefiles_get_unbind_pincount(struct cachefiles_cache *cache);
 extern void cachefiles_put_unbind_pincount(struct cachefiles_cache *cache);
 
@@ -332,6 +338,7 @@
 CACHEFILES_OBJECT_STATE_FUNCS(open, OPEN);
 CACHEFILES_OBJECT_STATE_FUNCS(close, CLOSE);
 CACHEFILES_OBJECT_STATE_FUNCS(reopening, REOPENING);
+CACHEFILES_OBJECT_STATE_FUNCS(dropping, DROPPING);
 
 static inline bool cachefiles_ondemand_is_reopening_read(struct cachefiles_req *req)
 {
@@ -424,6 +431,8 @@
 	pr_err("I/O Error: " FMT"\n", ##__VA_ARGS__);	\
 	fscache_io_error((___cache)->cache);		\
 	set_bit(CACHEFILES_DEAD, &(___cache)->flags);	\
+	if (cachefiles_in_ondemand_mode(___cache))	\
+		cachefiles_flush_reqs(___cache);	\
 } while (0)
 
 #define cachefiles_io_error_obj(object, FMT, ...)			\
--- linux-qcom-6.8.0.orig/fs/cachefiles/namei.c
+++ linux-qcom-6.8.0/fs/cachefiles/namei.c
@@ -596,14 +596,12 @@
 	 * write and readdir but not lookup or open).
 	 */
 	touch_atime(&file->f_path);
-	dput(dentry);
 	return true;
 
 check_failed:
 	fscache_cookie_lookup_negative(object->cookie);
 	cachefiles_unmark_inode_in_use(object, file);
 	fput(file);
-	dput(dentry);
 	if (ret == -ESTALE)
 		return cachefiles_create_file(object);
 	return false;
@@ -612,7 +610,6 @@
 	fput(file);
 error:
 	cachefiles_do_unmark_inode_in_use(object, d_inode(dentry));
-	dput(dentry);
 	return false;
 }
 
@@ -655,7 +652,9 @@
 		goto new_file;
 	}
 
-	if (!cachefiles_open_file(object, dentry))
+	ret = cachefiles_open_file(object, dentry);
+	dput(dentry);
+	if (!ret)
 		return false;
 
 	_leave(" = t [%lu]", file_inode(object->file)->i_ino);
--- linux-qcom-6.8.0.orig/fs/cachefiles/ondemand.c
+++ linux-qcom-6.8.0/fs/cachefiles/ondemand.c
@@ -4,19 +4,40 @@
 #include <linux/uio.h>
 #include "internal.h"
 
+struct ondemand_anon_file {
+	struct file *file;
+	int fd;
+};
+
+static inline void cachefiles_req_put(struct cachefiles_req *req)
+{
+	if (refcount_dec_and_test(&req->ref))
+		kfree(req);
+}
+
 static int cachefiles_ondemand_fd_release(struct inode *inode,
 					  struct file *file)
 {
 	struct cachefiles_object *object = file->private_data;
-	struct cachefiles_cache *cache = object->volume->cache;
-	struct cachefiles_ondemand_info *info = object->ondemand;
-	int object_id = info->ondemand_id;
+	struct cachefiles_cache *cache;
+	struct cachefiles_ondemand_info *info;
+	int object_id;
 	struct cachefiles_req *req;
-	XA_STATE(xas, &cache->reqs, 0);
+	XA_STATE(xas, NULL, 0);
+
+	if (!object)
+		return 0;
+
+	info = object->ondemand;
+	cache = object->volume->cache;
+	xas.xa = &cache->reqs;
 
 	xa_lock(&cache->reqs);
+	spin_lock(&info->lock);
+	object_id = info->ondemand_id;
 	info->ondemand_id = CACHEFILES_ONDEMAND_ID_CLOSED;
 	cachefiles_ondemand_set_object_close(object);
+	spin_unlock(&info->lock);
 
 	/* Only flush CACHEFILES_REQ_NEW marked req to avoid race with daemon_read */
 	xas_for_each_marked(&xas, req, ULONG_MAX, CACHEFILES_REQ_NEW) {
@@ -40,26 +61,36 @@
 {
 	struct cachefiles_object *object = kiocb->ki_filp->private_data;
 	struct cachefiles_cache *cache = object->volume->cache;
-	struct file *file = object->file;
-	size_t len = iter->count;
+	struct file *file;
+	size_t len = iter->count, aligned_len = len;
 	loff_t pos = kiocb->ki_pos;
 	const struct cred *saved_cred;
 	int ret;
 
-	if (!file)
+	spin_lock(&object->lock);
+	file = object->file;
+	if (!file) {
+		spin_unlock(&object->lock);
 		return -ENOBUFS;
+	}
+	get_file(file);
+	spin_unlock(&object->lock);
 
 	cachefiles_begin_secure(cache, &saved_cred);
-	ret = __cachefiles_prepare_write(object, file, &pos, &len, len, true);
+	ret = __cachefiles_prepare_write(object, file, &pos, &aligned_len, len, true);
 	cachefiles_end_secure(cache, saved_cred);
 	if (ret < 0)
-		return ret;
+		goto out;
 
 	trace_cachefiles_ondemand_fd_write(object, file_inode(file), pos, len);
 	ret = __cachefiles_write(object, file, pos, iter, NULL, NULL);
-	if (!ret)
+	if (!ret) {
 		ret = len;
+		kiocb->ki_pos += ret;
+	}
 
+out:
+	fput(file);
 	return ret;
 }
 
@@ -67,21 +98,31 @@
 					    int whence)
 {
 	struct cachefiles_object *object = filp->private_data;
-	struct file *file = object->file;
+	struct file *file;
+	loff_t ret;
 
-	if (!file)
+	spin_lock(&object->lock);
+	file = object->file;
+	if (!file) {
+		spin_unlock(&object->lock);
 		return -ENOBUFS;
+	}
+	get_file(file);
+	spin_unlock(&object->lock);
 
-	return vfs_llseek(file, pos, whence);
+	ret = vfs_llseek(file, pos, whence);
+	fput(file);
+
+	return ret;
 }
 
 static long cachefiles_ondemand_fd_ioctl(struct file *filp, unsigned int ioctl,
-					 unsigned long arg)
+					 unsigned long id)
 {
 	struct cachefiles_object *object = filp->private_data;
 	struct cachefiles_cache *cache = object->volume->cache;
 	struct cachefiles_req *req;
-	unsigned long id;
+	XA_STATE(xas, &cache->reqs, id);
 
 	if (ioctl != CACHEFILES_IOC_READ_COMPLETE)
 		return -EINVAL;
@@ -89,10 +130,15 @@
 	if (!test_bit(CACHEFILES_ONDEMAND_MODE, &cache->flags))
 		return -EOPNOTSUPP;
 
-	id = arg;
-	req = xa_erase(&cache->reqs, id);
-	if (!req)
+	xa_lock(&cache->reqs);
+	req = xas_load(&xas);
+	if (!req || req->msg.opcode != CACHEFILES_OP_READ ||
+	    req->object != object) {
+		xa_unlock(&cache->reqs);
 		return -EINVAL;
+	}
+	xas_store(&xas, NULL);
+	xa_unlock(&cache->reqs);
 
 	trace_cachefiles_ondemand_cread(object, id);
 	complete(&req->done);
@@ -116,10 +162,12 @@
 {
 	struct cachefiles_req *req;
 	struct fscache_cookie *cookie;
+	struct cachefiles_ondemand_info *info;
 	char *pid, *psize;
 	unsigned long id;
 	long size;
 	int ret;
+	XA_STATE(xas, &cache->reqs, 0);
 
 	if (!test_bit(CACHEFILES_ONDEMAND_MODE, &cache->flags))
 		return -EOPNOTSUPP;
@@ -143,10 +191,18 @@
 	if (ret)
 		return ret;
 
-	req = xa_erase(&cache->reqs, id);
-	if (!req)
+	xa_lock(&cache->reqs);
+	xas.xa_index = id;
+	req = xas_load(&xas);
+	if (!req || req->msg.opcode != CACHEFILES_OP_OPEN ||
+	    !req->object->ondemand->ondemand_id) {
+		xa_unlock(&cache->reqs);
 		return -EINVAL;
+	}
+	xas_store(&xas, NULL);
+	xa_unlock(&cache->reqs);
 
+	info = req->object->ondemand;
 	/* fail OPEN request if copen format is invalid */
 	ret = kstrtol(psize, 0, &size);
 	if (ret) {
@@ -166,6 +222,32 @@
 		goto out;
 	}
 
+	spin_lock(&info->lock);
+	/*
+	 * The anonymous fd was closed before copen ? Fail the request.
+	 *
+	 *             t1             |             t2
+	 * ---------------------------------------------------------
+	 *                             cachefiles_ondemand_copen
+	 *                             req = xa_erase(&cache->reqs, id)
+	 * // Anon fd is maliciously closed.
+	 * cachefiles_ondemand_fd_release
+	 * xa_lock(&cache->reqs)
+	 * cachefiles_ondemand_set_object_close(object)
+	 * xa_unlock(&cache->reqs)
+	 *                             cachefiles_ondemand_set_object_open
+	 *                             // No one will ever close it again.
+	 * cachefiles_ondemand_daemon_read
+	 * cachefiles_ondemand_select_req
+	 *
+	 * Get a read req but its fd is already closed. The daemon can't
+	 * issue a cread ioctl with an closed fd, then hung.
+	 */
+	if (info->ondemand_id == CACHEFILES_ONDEMAND_ID_CLOSED) {
+		spin_unlock(&info->lock);
+		req->error = -EBADFD;
+		goto out;
+	}
 	cookie = req->object->cookie;
 	cookie->object_size = size;
 	if (size)
@@ -175,9 +257,15 @@
 	trace_cachefiles_ondemand_copen(req->object, id, size);
 
 	cachefiles_ondemand_set_object_open(req->object);
+	spin_unlock(&info->lock);
 	wake_up_all(&cache->daemon_pollwq);
 
 out:
+	spin_lock(&info->lock);
+	/* Need to set object close to avoid reopen status continuing */
+	if (info->ondemand_id == CACHEFILES_ONDEMAND_ID_CLOSED)
+		cachefiles_ondemand_set_object_close(req->object);
+	spin_unlock(&info->lock);
 	complete(&req->done);
 	return ret;
 }
@@ -205,14 +293,14 @@
 	return 0;
 }
 
-static int cachefiles_ondemand_get_fd(struct cachefiles_req *req)
+static int cachefiles_ondemand_get_fd(struct cachefiles_req *req,
+				      struct ondemand_anon_file *anon_file)
 {
 	struct cachefiles_object *object;
 	struct cachefiles_cache *cache;
 	struct cachefiles_open *load;
-	struct file *file;
 	u32 object_id;
-	int ret, fd;
+	int ret;
 
 	object = cachefiles_grab_object(req->object,
 			cachefiles_obj_get_ondemand_fd);
@@ -224,35 +312,53 @@
 	if (ret < 0)
 		goto err;
 
-	fd = get_unused_fd_flags(O_WRONLY);
-	if (fd < 0) {
-		ret = fd;
+	anon_file->fd = get_unused_fd_flags(O_WRONLY);
+	if (anon_file->fd < 0) {
+		ret = anon_file->fd;
 		goto err_free_id;
 	}
 
-	file = anon_inode_getfile("[cachefiles]", &cachefiles_ondemand_fd_fops,
-				  object, O_WRONLY);
-	if (IS_ERR(file)) {
-		ret = PTR_ERR(file);
+	anon_file->file = anon_inode_getfile("[cachefiles]",
+				&cachefiles_ondemand_fd_fops, object, O_WRONLY);
+	if (IS_ERR(anon_file->file)) {
+		ret = PTR_ERR(anon_file->file);
 		goto err_put_fd;
 	}
 
-	file->f_mode |= FMODE_PWRITE | FMODE_LSEEK;
-	fd_install(fd, file);
+	spin_lock(&object->ondemand->lock);
+	if (object->ondemand->ondemand_id > 0) {
+		spin_unlock(&object->ondemand->lock);
+		/* Pair with check in cachefiles_ondemand_fd_release(). */
+		anon_file->file->private_data = NULL;
+		ret = -EEXIST;
+		goto err_put_file;
+	}
+
+	anon_file->file->f_mode |= FMODE_PWRITE | FMODE_LSEEK;
 
 	load = (void *)req->msg.data;
-	load->fd = fd;
+	load->fd = anon_file->fd;
 	object->ondemand->ondemand_id = object_id;
+	spin_unlock(&object->ondemand->lock);
 
 	cachefiles_get_unbind_pincount(cache);
 	trace_cachefiles_ondemand_open(object, &req->msg, load);
 	return 0;
 
+err_put_file:
+	fput(anon_file->file);
+	anon_file->file = NULL;
 err_put_fd:
-	put_unused_fd(fd);
+	put_unused_fd(anon_file->fd);
+	anon_file->fd = ret;
 err_free_id:
 	xa_erase(&cache->ondemand_ids, object_id);
 err:
+	spin_lock(&object->ondemand->lock);
+	/* Avoid marking an opened object as closed. */
+	if (object->ondemand->ondemand_id <= 0)
+		cachefiles_ondemand_set_object_close(object);
+	spin_unlock(&object->ondemand->lock);
 	cachefiles_put_object(object, cachefiles_obj_put_ondemand_fd);
 	return ret;
 }
@@ -294,14 +400,28 @@
 	return NULL;
 }
 
+static inline bool cachefiles_ondemand_finish_req(struct cachefiles_req *req,
+						  struct xa_state *xas, int err)
+{
+	if (unlikely(!xas || !req))
+		return false;
+
+	if (xa_cmpxchg(xas->xa, xas->xa_index, req, NULL, 0) != req)
+		return false;
+
+	req->error = err;
+	complete(&req->done);
+	return true;
+}
+
 ssize_t cachefiles_ondemand_daemon_read(struct cachefiles_cache *cache,
 					char __user *_buffer, size_t buflen)
 {
 	struct cachefiles_req *req;
 	struct cachefiles_msg *msg;
-	unsigned long id = 0;
 	size_t n;
 	int ret = 0;
+	struct ondemand_anon_file anon_file;
 	XA_STATE(xas, &cache->reqs, cache->req_id_next);
 
 	xa_lock(&cache->reqs);
@@ -330,42 +450,37 @@
 
 	xas_clear_mark(&xas, CACHEFILES_REQ_NEW);
 	cache->req_id_next = xas.xa_index + 1;
+	refcount_inc(&req->ref);
+	cachefiles_grab_object(req->object, cachefiles_obj_get_read_req);
 	xa_unlock(&cache->reqs);
 
-	id = xas.xa_index;
-
 	if (msg->opcode == CACHEFILES_OP_OPEN) {
-		ret = cachefiles_ondemand_get_fd(req);
-		if (ret) {
-			cachefiles_ondemand_set_object_close(req->object);
-			goto error;
-		}
+		ret = cachefiles_ondemand_get_fd(req, &anon_file);
+		if (ret)
+			goto out;
 	}
 
-	msg->msg_id = id;
+	msg->msg_id = xas.xa_index;
 	msg->object_id = req->object->ondemand->ondemand_id;
 
-	if (copy_to_user(_buffer, msg, n) != 0) {
+	if (copy_to_user(_buffer, msg, n) != 0)
 		ret = -EFAULT;
-		goto err_put_fd;
-	}
 
-	/* CLOSE request has no reply */
-	if (msg->opcode == CACHEFILES_OP_CLOSE) {
-		xa_erase(&cache->reqs, id);
-		complete(&req->done);
+	if (msg->opcode == CACHEFILES_OP_OPEN) {
+		if (ret < 0) {
+			fput(anon_file.file);
+			put_unused_fd(anon_file.fd);
+			goto out;
+		}
+		fd_install(anon_file.fd, anon_file.file);
 	}
-
-	return n;
-
-err_put_fd:
-	if (msg->opcode == CACHEFILES_OP_OPEN)
-		close_fd(((struct cachefiles_open *)msg->data)->fd);
-error:
-	xa_erase(&cache->reqs, id);
-	req->error = ret;
-	complete(&req->done);
-	return ret;
+out:
+	cachefiles_put_object(req->object, cachefiles_obj_put_read_req);
+	/* Remove error request and CLOSE request has no reply */
+	if (ret || msg->opcode == CACHEFILES_OP_CLOSE)
+		cachefiles_ondemand_finish_req(req, &xas, ret);
+	cachefiles_req_put(req);
+	return ret ? ret : n;
 }
 
 typedef int (*init_req_fn)(struct cachefiles_req *req, void *private);
@@ -395,6 +510,7 @@
 		goto out;
 	}
 
+	refcount_set(&req->ref, 1);
 	req->object = object;
 	init_completion(&req->done);
 	req->msg.opcode = opcode;
@@ -422,7 +538,8 @@
 		 */
 		xas_lock(&xas);
 
-		if (test_bit(CACHEFILES_DEAD, &cache->flags)) {
+		if (test_bit(CACHEFILES_DEAD, &cache->flags) ||
+		    cachefiles_ondemand_object_is_dropping(object)) {
 			xas_unlock(&xas);
 			ret = -EIO;
 			goto out;
@@ -432,20 +549,32 @@
 		smp_mb();
 
 		if (opcode == CACHEFILES_OP_CLOSE &&
-			!cachefiles_ondemand_object_is_open(object)) {
+		    !cachefiles_ondemand_object_is_open(object)) {
 			WARN_ON_ONCE(object->ondemand->ondemand_id == 0);
 			xas_unlock(&xas);
 			ret = -EIO;
 			goto out;
 		}
 
-		xas.xa_index = 0;
+		/*
+		 * Cyclically find a free xas to avoid msg_id reuse that would
+		 * cause the daemon to successfully copen a stale msg_id.
+		 */
+		xas.xa_index = cache->msg_id_next;
 		xas_find_marked(&xas, UINT_MAX, XA_FREE_MARK);
+		if (xas.xa_node == XAS_RESTART) {
+			xas.xa_index = 0;
+			xas_find_marked(&xas, cache->msg_id_next - 1, XA_FREE_MARK);
+		}
 		if (xas.xa_node == XAS_RESTART)
 			xas_set_err(&xas, -EBUSY);
+
 		xas_store(&xas, req);
-		xas_clear_mark(&xas, XA_FREE_MARK);
-		xas_set_mark(&xas, CACHEFILES_REQ_NEW);
+		if (xas_valid(&xas)) {
+			cache->msg_id_next = xas.xa_index + 1;
+			xas_clear_mark(&xas, XA_FREE_MARK);
+			xas_set_mark(&xas, CACHEFILES_REQ_NEW);
+		}
 		xas_unlock(&xas);
 	} while (xas_nomem(&xas, GFP_KERNEL));
 
@@ -454,16 +583,27 @@
 		goto out;
 
 	wake_up_all(&cache->daemon_pollwq);
-	wait_for_completion(&req->done);
-	ret = req->error;
-	kfree(req);
+wait:
+	ret = wait_for_completion_killable(&req->done);
+	if (!ret) {
+		ret = req->error;
+	} else {
+		ret = -EINTR;
+		if (!cachefiles_ondemand_finish_req(req, &xas, ret)) {
+			/* Someone will complete it soon. */
+			cpu_relax();
+			goto wait;
+		}
+	}
+	cachefiles_req_put(req);
 	return ret;
 out:
 	/* Reset the object to close state in error handling path.
 	 * If error occurs after creating the anonymous fd,
 	 * cachefiles_ondemand_fd_release() will set object to close.
 	 */
-	if (opcode == CACHEFILES_OP_OPEN)
+	if (opcode == CACHEFILES_OP_OPEN &&
+	    !cachefiles_ondemand_object_is_dropping(object))
 		cachefiles_ondemand_set_object_close(object);
 	kfree(req);
 	return ret;
@@ -562,8 +702,34 @@
 
 void cachefiles_ondemand_clean_object(struct cachefiles_object *object)
 {
+	unsigned long index;
+	struct cachefiles_req *req;
+	struct cachefiles_cache *cache;
+
+	if (!object->ondemand)
+		return;
+
 	cachefiles_ondemand_send_req(object, CACHEFILES_OP_CLOSE, 0,
 			cachefiles_ondemand_init_close_req, NULL);
+
+	if (!object->ondemand->ondemand_id)
+		return;
+
+	/* Cancel all requests for the object that is being dropped. */
+	cache = object->volume->cache;
+	xa_lock(&cache->reqs);
+	cachefiles_ondemand_set_object_dropping(object);
+	xa_for_each(&cache->reqs, index, req) {
+		if (req->object == object) {
+			req->error = -EIO;
+			complete(&req->done);
+			__xa_erase(&cache->reqs, index);
+		}
+	}
+	xa_unlock(&cache->reqs);
+
+	/* Wait for ondemand_object_worker() to finish to avoid UAF. */
+	cancel_work_sync(&object->ondemand->ondemand_work);
 }
 
 int cachefiles_ondemand_init_obj_info(struct cachefiles_object *object,
@@ -578,6 +744,7 @@
 		return -ENOMEM;
 
 	object->ondemand->object = object;
+	spin_lock_init(&object->ondemand->lock);
 	INIT_WORK(&object->ondemand->ondemand_work, ondemand_object_worker);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/fs/cachefiles/security.c
+++ linux-qcom-6.8.0/fs/cachefiles/security.c
@@ -18,7 +18,7 @@
 	struct cred *new;
 	int ret;
 
-	_enter("{%s}", cache->secctx);
+	_enter("{%u}", cache->have_secid ? cache->secid : 0);
 
 	new = prepare_kernel_cred(current);
 	if (!new) {
@@ -26,8 +26,8 @@
 		goto error;
 	}
 
-	if (cache->secctx) {
-		ret = set_security_override_from_ctx(new, cache->secctx);
+	if (cache->have_secid) {
+		ret = set_security_override(new, cache->secid);
 		if (ret < 0) {
 			put_cred(new);
 			pr_err("Security denies permission to nominate security context: error %d\n",
--- linux-qcom-6.8.0.orig/fs/cachefiles/volume.c
+++ linux-qcom-6.8.0/fs/cachefiles/volume.c
@@ -133,7 +133,6 @@
 
 void cachefiles_withdraw_volume(struct cachefiles_volume *volume)
 {
-	fscache_withdraw_volume(volume->vcookie);
 	cachefiles_set_volume_xattr(volume);
 	__cachefiles_free_volume(volume);
 }
--- linux-qcom-6.8.0.orig/fs/cachefiles/xattr.c
+++ linux-qcom-6.8.0/fs/cachefiles/xattr.c
@@ -64,9 +64,15 @@
 		memcpy(buf->data, fscache_get_aux(object->cookie), len);
 
 	ret = cachefiles_inject_write_error();
-	if (ret == 0)
-		ret = vfs_setxattr(&nop_mnt_idmap, dentry, cachefiles_xattr_cache,
-				   buf, sizeof(struct cachefiles_xattr) + len, 0);
+	if (ret == 0) {
+		ret = mnt_want_write_file(file);
+		if (ret == 0) {
+			ret = vfs_setxattr(&nop_mnt_idmap, dentry,
+					   cachefiles_xattr_cache, buf,
+					   sizeof(struct cachefiles_xattr) + len, 0);
+			mnt_drop_write_file(file);
+		}
+	}
 	if (ret < 0) {
 		trace_cachefiles_vfs_error(object, file_inode(file), ret,
 					   cachefiles_trace_setxattr_error);
@@ -110,9 +116,11 @@
 	if (xlen == 0)
 		xlen = vfs_getxattr(&nop_mnt_idmap, dentry, cachefiles_xattr_cache, buf, tlen);
 	if (xlen != tlen) {
-		if (xlen < 0)
+		if (xlen < 0) {
+			ret = xlen;
 			trace_cachefiles_vfs_error(object, file_inode(file), xlen,
 						   cachefiles_trace_getxattr_error);
+		}
 		if (xlen == -EIO)
 			cachefiles_io_error_obj(
 				object,
@@ -149,8 +157,14 @@
 	int ret;
 
 	ret = cachefiles_inject_remove_error();
-	if (ret == 0)
-		ret = vfs_removexattr(&nop_mnt_idmap, dentry, cachefiles_xattr_cache);
+	if (ret == 0) {
+		ret = mnt_want_write(cache->mnt);
+		if (ret == 0) {
+			ret = vfs_removexattr(&nop_mnt_idmap, dentry,
+					      cachefiles_xattr_cache);
+			mnt_drop_write(cache->mnt);
+		}
+	}
 	if (ret < 0) {
 		trace_cachefiles_vfs_error(object, d_inode(dentry), ret,
 					   cachefiles_trace_remxattr_error);
@@ -206,9 +220,15 @@
 	memcpy(buf->data, p, volume->vcookie->coherency_len);
 
 	ret = cachefiles_inject_write_error();
-	if (ret == 0)
-		ret = vfs_setxattr(&nop_mnt_idmap, dentry, cachefiles_xattr_cache,
-				   buf, len, 0);
+	if (ret == 0) {
+		ret = mnt_want_write(volume->cache->mnt);
+		if (ret == 0) {
+			ret = vfs_setxattr(&nop_mnt_idmap, dentry,
+					   cachefiles_xattr_cache,
+					   buf, len, 0);
+			mnt_drop_write(volume->cache->mnt);
+		}
+	}
 	if (ret < 0) {
 		trace_cachefiles_vfs_error(NULL, d_inode(dentry), ret,
 					   cachefiles_trace_setxattr_error);
@@ -252,6 +272,7 @@
 		xlen = vfs_getxattr(&nop_mnt_idmap, dentry, cachefiles_xattr_cache, buf, len);
 	if (xlen != len) {
 		if (xlen < 0) {
+			ret = xlen;
 			trace_cachefiles_vfs_error(NULL, d_inode(dentry), xlen,
 						   cachefiles_trace_getxattr_error);
 			if (xlen == -EIO)
--- linux-qcom-6.8.0.orig/fs/ceph/addr.c
+++ linux-qcom-6.8.0/fs/ceph/addr.c
@@ -95,7 +95,6 @@
 
 	/* dirty the head */
 	spin_lock(&ci->i_ceph_lock);
-	BUG_ON(ci->i_wr_ref == 0); // caller should hold Fw reference
 	if (__ceph_have_pending_cap_snap(ci)) {
 		struct ceph_cap_snap *capsnap =
 				list_last_entry(&ci->i_cap_snaps,
@@ -469,8 +468,11 @@
 	rreq->netfs_priv = priv;
 
 out:
-	if (ret < 0)
+	if (ret < 0) {
+		if (got)
+			ceph_put_cap_refs(ceph_inode(inode), got);
 		kfree(priv);
+	}
 
 	return ret;
 }
@@ -795,8 +797,10 @@
 	ihold(inode);
 
 	if (wbc->sync_mode == WB_SYNC_NONE &&
-	    ceph_inode_to_fs_client(inode)->write_congested)
+	    ceph_inode_to_fs_client(inode)->write_congested) {
+		redirty_page_for_writepage(wbc, page);
 		return AOP_WRITEPAGE_ACTIVATE;
+	}
 
 	wait_on_page_fscache(page);
 
--- linux-qcom-6.8.0.orig/fs/ceph/caps.c
+++ linux-qcom-6.8.0/fs/ceph/caps.c
@@ -2016,6 +2016,8 @@
  *  CHECK_CAPS_AUTHONLY - we should only check the auth cap
  *  CHECK_CAPS_FLUSH - we should flush any dirty caps immediately, without
  *    further delay.
+ *  CHECK_CAPS_FLUSH_FORCE - we should flush any caps immediately, without
+ *    further delay.
  */
 void ceph_check_caps(struct ceph_inode_info *ci, int flags)
 {
@@ -2097,7 +2099,7 @@
 	}
 
 	doutc(cl, "%p %llx.%llx file_want %s used %s dirty %s "
-	      "flushing %s issued %s revoking %s retain %s %s%s%s\n",
+	      "flushing %s issued %s revoking %s retain %s %s%s%s%s\n",
 	     inode, ceph_vinop(inode), ceph_cap_string(file_wanted),
 	     ceph_cap_string(used), ceph_cap_string(ci->i_dirty_caps),
 	     ceph_cap_string(ci->i_flushing_caps),
@@ -2105,7 +2107,8 @@
 	     ceph_cap_string(retain),
 	     (flags & CHECK_CAPS_AUTHONLY) ? " AUTHONLY" : "",
 	     (flags & CHECK_CAPS_FLUSH) ? " FLUSH" : "",
-	     (flags & CHECK_CAPS_NOINVAL) ? " NOINVAL" : "");
+	     (flags & CHECK_CAPS_NOINVAL) ? " NOINVAL" : "",
+	     (flags & CHECK_CAPS_FLUSH_FORCE) ? " FLUSH_FORCE" : "");
 
 	/*
 	 * If we no longer need to hold onto old our caps, and we may
@@ -2180,6 +2183,11 @@
 				queue_writeback = true;
 		}
 
+		if (flags & CHECK_CAPS_FLUSH_FORCE) {
+			doutc(cl, "force to flush caps\n");
+			goto ack;
+		}
+
 		if (cap == ci->i_auth_cap &&
 		    (cap->issued & CEPH_CAP_FILE_WR)) {
 			/* request larger max_size from MDS? */
@@ -3504,6 +3512,8 @@
 	bool queue_invalidate = false;
 	bool deleted_inode = false;
 	bool fill_inline = false;
+	bool revoke_wait = false;
+	int flags = 0;
 
 	/*
 	 * If there is at least one crypto block then we'll trust
@@ -3699,16 +3709,18 @@
 		      ceph_cap_string(cap->issued), ceph_cap_string(newcaps),
 		      ceph_cap_string(revoking));
 		if (S_ISREG(inode->i_mode) &&
-		    (revoking & used & CEPH_CAP_FILE_BUFFER))
+		    (revoking & used & CEPH_CAP_FILE_BUFFER)) {
 			writeback = true;  /* initiate writeback; will delay ack */
-		else if (queue_invalidate &&
+			revoke_wait = true;
+		} else if (queue_invalidate &&
 			 revoking == CEPH_CAP_FILE_CACHE &&
-			 (newcaps & CEPH_CAP_FILE_LAZYIO) == 0)
-			; /* do nothing yet, invalidation will be queued */
-		else if (cap == ci->i_auth_cap)
+			 (newcaps & CEPH_CAP_FILE_LAZYIO) == 0) {
+			revoke_wait = true; /* do nothing yet, invalidation will be queued */
+		} else if (cap == ci->i_auth_cap) {
 			check_caps = 1; /* check auth cap only */
-		else
+		} else {
 			check_caps = 2; /* check all caps */
+		}
 		/* If there is new caps, try to wake up the waiters */
 		if (~cap->issued & newcaps)
 			wake = true;
@@ -3735,8 +3747,9 @@
 	BUG_ON(cap->issued & ~cap->implemented);
 
 	/* don't let check_caps skip sending a response to MDS for revoke msgs */
-	if (le32_to_cpu(grant->op) == CEPH_CAP_OP_REVOKE) {
+	if (!revoke_wait && le32_to_cpu(grant->op) == CEPH_CAP_OP_REVOKE) {
 		cap->mds_wanted = 0;
+		flags |= CHECK_CAPS_FLUSH_FORCE;
 		if (cap == ci->i_auth_cap)
 			check_caps = 1; /* check auth cap only */
 		else
@@ -3792,9 +3805,9 @@
 
 	mutex_unlock(&session->s_mutex);
 	if (check_caps == 1)
-		ceph_check_caps(ci, CHECK_CAPS_AUTHONLY | CHECK_CAPS_NOINVAL);
+		ceph_check_caps(ci, flags | CHECK_CAPS_AUTHONLY | CHECK_CAPS_NOINVAL);
 	else if (check_caps == 2)
-		ceph_check_caps(ci, CHECK_CAPS_NOINVAL);
+		ceph_check_caps(ci, flags | CHECK_CAPS_NOINVAL);
 }
 
 /*
@@ -4775,13 +4788,13 @@
 
 			doutc(mdsc->fsc->client, "%p %llx.%llx\n", inode,
 			      ceph_vinop(inode));
-			spin_lock(&mdsc->cap_unlink_delay_lock);
+			spin_lock(&mdsc->cap_delay_lock);
 			ci->i_ceph_flags |= CEPH_I_FLUSH;
 			if (!list_empty(&ci->i_cap_delay_list))
 				list_del_init(&ci->i_cap_delay_list);
 			list_add_tail(&ci->i_cap_delay_list,
 				      &mdsc->cap_unlink_delay_list);
-			spin_unlock(&mdsc->cap_unlink_delay_lock);
+			spin_unlock(&mdsc->cap_delay_lock);
 
 			/*
 			 * Fire the work immediately, because the MDS maybe
--- linux-qcom-6.8.0.orig/fs/ceph/file.c
+++ linux-qcom-6.8.0/fs/ceph/file.c
@@ -1004,7 +1004,7 @@
 	if (ceph_inode_is_shutdown(inode))
 		return -EIO;
 
-	if (!len)
+	if (!len || !i_size)
 		return 0;
 	/*
 	 * flush any page cache pages in this range.  this
@@ -1024,7 +1024,7 @@
 		int num_pages;
 		size_t page_off;
 		bool more;
-		int idx;
+		int idx = 0;
 		size_t left;
 		struct ceph_osd_req_op *op;
 		u64 read_off = off;
@@ -1054,6 +1054,16 @@
 			len = read_off + read_len - off;
 		more = len < iov_iter_count(to);
 
+		op = &req->r_ops[0];
+		if (sparse) {
+			extent_cnt = __ceph_sparse_read_ext_count(inode, read_len);
+			ret = ceph_alloc_sparse_ext_map(op, extent_cnt);
+			if (ret) {
+				ceph_osdc_put_request(req);
+				break;
+			}
+		}
+
 		num_pages = calc_pages_for(read_off, read_len);
 		page_off = offset_in_page(off);
 		pages = ceph_alloc_page_vector(num_pages, GFP_KERNEL);
@@ -1065,17 +1075,7 @@
 
 		osd_req_op_extent_osd_data_pages(req, 0, pages, read_len,
 						 offset_in_page(read_off),
-						 false, false);
-
-		op = &req->r_ops[0];
-		if (sparse) {
-			extent_cnt = __ceph_sparse_read_ext_count(inode, read_len);
-			ret = ceph_alloc_sparse_ext_map(op, extent_cnt);
-			if (ret) {
-				ceph_osdc_put_request(req);
-				break;
-			}
-		}
+						 false, true);
 
 		ceph_osdc_start_request(osdc, req);
 		ret = ceph_osdc_wait_request(osdc, req);
@@ -1098,7 +1098,14 @@
 		else if (ret == -ENOENT)
 			ret = 0;
 
-		if (ret > 0 && IS_ENCRYPTED(inode)) {
+		if (ret < 0) {
+			ceph_osdc_put_request(req);
+			if (ret == -EBLOCKLISTED)
+				fsc->blocklisted = true;
+			break;
+		}
+
+		if (IS_ENCRYPTED(inode)) {
 			int fret;
 
 			fret = ceph_fscrypt_decrypt_extents(inode, pages,
@@ -1124,10 +1131,8 @@
 			ret = min_t(ssize_t, fret, len);
 		}
 
-		ceph_osdc_put_request(req);
-
 		/* Short read but not EOF? Zero out the remainder. */
-		if (ret >= 0 && ret < len && (off + ret < i_size)) {
+		if (ret < len && (off + ret < i_size)) {
 			int zlen = min(len - ret, i_size - off - ret);
 			int zoff = page_off + ret;
 
@@ -1137,8 +1142,11 @@
 			ret += zlen;
 		}
 
-		idx = 0;
-		left = ret > 0 ? ret : 0;
+		if (off + ret > i_size)
+			left = (i_size > off) ? i_size - off : 0;
+		else
+			left = ret;
+
 		while (left > 0) {
 			size_t plen, copied;
 
@@ -1154,28 +1162,21 @@
 				break;
 			}
 		}
-		ceph_release_page_vector(pages, num_pages);
 
-		if (ret < 0) {
-			if (ret == -EBLOCKLISTED)
-				fsc->blocklisted = true;
-			break;
-		}
+		ceph_osdc_put_request(req);
 
 		if (off >= i_size || !more)
 			break;
 	}
 
 	if (ret > 0) {
-		if (off > *ki_pos) {
-			if (off >= i_size) {
-				*retry_op = CHECK_EOF;
-				ret = i_size - *ki_pos;
-				*ki_pos = i_size;
-			} else {
-				ret = off - *ki_pos;
-				*ki_pos = off;
-			}
+		if (off >= i_size) {
+			*retry_op = CHECK_EOF;
+			ret = i_size - *ki_pos;
+			*ki_pos = i_size;
+		} else {
+			ret = off - *ki_pos;
+			*ki_pos = off;
 		}
 
 		if (last_objver)
@@ -1488,6 +1489,16 @@
 			break;
 		}
 
+		op = &req->r_ops[0];
+		if (!write && sparse) {
+			extent_cnt = __ceph_sparse_read_ext_count(inode, size);
+			ret = ceph_alloc_sparse_ext_map(op, extent_cnt);
+			if (ret) {
+				ceph_osdc_put_request(req);
+				break;
+			}
+		}
+
 		len = iter_get_bvecs_alloc(iter, size, &bvecs, &num_pages);
 		if (len < 0) {
 			ceph_osdc_put_request(req);
@@ -1497,6 +1508,8 @@
 		if (len != size)
 			osd_req_op_extent_update(req, 0, len);
 
+		osd_req_op_extent_osd_data_bvecs(req, 0, bvecs, num_pages, len);
+
 		/*
 		 * To simplify error handling, allow AIO when IO within i_size
 		 * or IO can be satisfied by single OSD request.
@@ -1528,17 +1541,6 @@
 			req->r_mtime = mtime;
 		}
 
-		osd_req_op_extent_osd_data_bvecs(req, 0, bvecs, num_pages, len);
-		op = &req->r_ops[0];
-		if (sparse) {
-			extent_cnt = __ceph_sparse_read_ext_count(inode, size);
-			ret = ceph_alloc_sparse_ext_map(op, extent_cnt);
-			if (ret) {
-				ceph_osdc_put_request(req);
-				break;
-			}
-		}
-
 		if (aio_req) {
 			aio_req->total_len += len;
 			aio_req->num_reqs++;
--- linux-qcom-6.8.0.orig/fs/ceph/mds_client.c
+++ linux-qcom-6.8.0/fs/ceph/mds_client.c
@@ -2504,7 +2504,7 @@
 	struct ceph_client *cl = mdsc->fsc->client;
 
 	doutc(cl, "begin\n");
-	spin_lock(&mdsc->cap_unlink_delay_lock);
+	spin_lock(&mdsc->cap_delay_lock);
 	while (!list_empty(&mdsc->cap_unlink_delay_list)) {
 		struct ceph_inode_info *ci;
 		struct inode *inode;
@@ -2516,15 +2516,15 @@
 
 		inode = igrab(&ci->netfs.inode);
 		if (inode) {
-			spin_unlock(&mdsc->cap_unlink_delay_lock);
+			spin_unlock(&mdsc->cap_delay_lock);
 			doutc(cl, "on %p %llx.%llx\n", inode,
 			      ceph_vinop(inode));
 			ceph_check_caps(ci, CHECK_CAPS_FLUSH);
 			iput(inode);
-			spin_lock(&mdsc->cap_unlink_delay_lock);
+			spin_lock(&mdsc->cap_delay_lock);
 		}
 	}
-	spin_unlock(&mdsc->cap_unlink_delay_lock);
+	spin_unlock(&mdsc->cap_delay_lock);
 	doutc(cl, "done\n");
 }
 
@@ -2808,12 +2808,11 @@
 
 	if (pos < 0) {
 		/*
-		 * A rename didn't occur, but somehow we didn't end up where
-		 * we thought we would. Throw a warning and try again.
+		 * The path is longer than PATH_MAX and this function
+		 * cannot ever succeed.  Creating paths that long is
+		 * possible with Ceph, but Linux cannot use them.
 		 */
-		pr_warn_client(cl, "did not end path lookup where expected (pos = %d)\n",
-			       pos);
-		goto retry;
+		return ERR_PTR(-ENAMETOOLONG);
 	}
 
 	*pbase = base;
@@ -5404,7 +5403,6 @@
 	INIT_LIST_HEAD(&mdsc->cap_wait_list);
 	spin_lock_init(&mdsc->cap_delay_lock);
 	INIT_LIST_HEAD(&mdsc->cap_unlink_delay_list);
-	spin_lock_init(&mdsc->cap_unlink_delay_lock);
 	INIT_LIST_HEAD(&mdsc->snap_flush_list);
 	spin_lock_init(&mdsc->snap_flush_lock);
 	mdsc->last_cap_flush_tid = 1;
--- linux-qcom-6.8.0.orig/fs/ceph/mds_client.h
+++ linux-qcom-6.8.0/fs/ceph/mds_client.h
@@ -461,9 +461,8 @@
 	struct delayed_work    delayed_work;  /* delayed work */
 	unsigned long    last_renew_caps;  /* last time we renewed our caps */
 	struct list_head cap_delay_list;   /* caps with delayed release */
-	spinlock_t       cap_delay_lock;   /* protects cap_delay_list */
 	struct list_head cap_unlink_delay_list;  /* caps with delayed release for unlink */
-	spinlock_t       cap_unlink_delay_lock;  /* protects cap_unlink_delay_list */
+	spinlock_t       cap_delay_lock;   /* protects cap_delay_list and cap_unlink_delay_list */
 	struct list_head snap_flush_list;  /* cap_snaps ready to flush */
 	spinlock_t       snap_flush_lock;
 
--- linux-qcom-6.8.0.orig/fs/ceph/mdsmap.c
+++ linux-qcom-6.8.0/fs/ceph/mdsmap.c
@@ -13,6 +13,7 @@
 #include "mdsmap.h"
 #include "mds_client.h"
 #include "super.h"
+#include "mdsmap.h"
 
 #define CEPH_MDS_IS_READY(i, ignore_laggy) \
 	(m->m_info[i].state > 0 && ignore_laggy ? true : !m->m_info[i].laggy)
--- linux-qcom-6.8.0.orig/fs/ceph/super.c
+++ linux-qcom-6.8.0/fs/ceph/super.c
@@ -284,7 +284,9 @@
 	size_t len;
 	struct ceph_fsid fsid;
 	struct ceph_parse_opts_ctx *pctx = fc->fs_private;
+	struct ceph_options *opts = pctx->copts;
 	struct ceph_mount_options *fsopt = pctx->opts;
+	const char *name_start = dev_name;
 	char *fsid_start, *fs_name_start;
 
 	if (*dev_name_end != '=') {
@@ -295,8 +297,14 @@
 	fsid_start = strchr(dev_name, '@');
 	if (!fsid_start)
 		return invalfc(fc, "missing cluster fsid");
-	++fsid_start; /* start of cluster fsid */
+	len = fsid_start - name_start;
+	kfree(opts->name);
+	opts->name = kstrndup(name_start, len, GFP_KERNEL);
+	if (!opts->name)
+		return -ENOMEM;
+	dout("using %s entity name", opts->name);
 
+	++fsid_start; /* start of cluster fsid */
 	fs_name_start = strchr(fsid_start, '.');
 	if (!fs_name_start)
 		return invalfc(fc, "missing file system name");
@@ -422,6 +430,8 @@
 
 	switch (token) {
 	case Opt_snapdirname:
+		if (strlen(param->string) > NAME_MAX)
+			return invalfc(fc, "snapdirname too long");
 		kfree(fsopt->snapdir_name);
 		fsopt->snapdir_name = param->string;
 		param->string = NULL;
@@ -961,7 +971,8 @@
 	if (!ceph_mds_request_cachep)
 		goto bad_mds_req;
 
-	ceph_wb_pagevec_pool = mempool_create_kmalloc_pool(10, CEPH_MAX_WRITE_SIZE >> PAGE_SHIFT);
+	ceph_wb_pagevec_pool = mempool_create_kmalloc_pool(10,
+	    (CEPH_MAX_WRITE_SIZE >> PAGE_SHIFT) * sizeof(struct page *));
 	if (!ceph_wb_pagevec_pool)
 		goto bad_pagevec_pool;
 
--- linux-qcom-6.8.0.orig/fs/ceph/super.h
+++ linux-qcom-6.8.0/fs/ceph/super.h
@@ -200,9 +200,10 @@
 	struct list_head caps_item;
 };
 
-#define CHECK_CAPS_AUTHONLY   1  /* only check auth cap */
-#define CHECK_CAPS_FLUSH      2  /* flush any dirty caps */
-#define CHECK_CAPS_NOINVAL    4  /* don't invalidate pagecache */
+#define CHECK_CAPS_AUTHONLY     1  /* only check auth cap */
+#define CHECK_CAPS_FLUSH        2  /* flush any dirty caps */
+#define CHECK_CAPS_NOINVAL      4  /* don't invalidate pagecache */
+#define CHECK_CAPS_FLUSH_FORCE  8  /* force flush any caps */
 
 struct ceph_cap_flush {
 	u64 tid;
@@ -1134,8 +1135,7 @@
 	void *acl;
 #endif
 #ifdef CONFIG_CEPH_FS_SECURITY_LABEL
-	void *sec_ctx;
-	u32 sec_ctxlen;
+	struct lsmcontext lsmctx;
 #endif
 #ifdef CONFIG_FS_ENCRYPTION
 	struct ceph_fscrypt_auth *fscrypt_auth;
--- linux-qcom-6.8.0.orig/fs/ceph/xattr.c
+++ linux-qcom-6.8.0/fs/ceph/xattr.c
@@ -1383,8 +1383,7 @@
 	int err;
 
 	err = security_dentry_init_security(dentry, mode, &dentry->d_name,
-					    &name, &as_ctx->sec_ctx,
-					    &as_ctx->sec_ctxlen);
+					    &name, &as_ctx->lsmctx);
 	if (err < 0) {
 		WARN_ON_ONCE(err != -EOPNOTSUPP);
 		err = 0; /* do nothing */
@@ -1409,7 +1408,7 @@
 	 */
 	name_len = strlen(name);
 	err = ceph_pagelist_reserve(pagelist,
-				    4 * 2 + name_len + as_ctx->sec_ctxlen);
+				    4 * 2 + name_len + as_ctx->lsmctx.len);
 	if (err)
 		goto out;
 
@@ -1429,11 +1428,9 @@
 		as_ctx->pagelist = pagelist;
 	}
 
-	ceph_pagelist_encode_32(pagelist, name_len);
-	ceph_pagelist_append(pagelist, name, name_len);
-
-	ceph_pagelist_encode_32(pagelist, as_ctx->sec_ctxlen);
-	ceph_pagelist_append(pagelist, as_ctx->sec_ctx, as_ctx->sec_ctxlen);
+	ceph_pagelist_encode_32(pagelist, as_ctx->lsmctx.len);
+	ceph_pagelist_append(pagelist, as_ctx->lsmctx.context,
+			     as_ctx->lsmctx.len);
 
 	err = 0;
 out:
@@ -1451,7 +1448,7 @@
 	posix_acl_release(as_ctx->default_acl);
 #endif
 #ifdef CONFIG_CEPH_FS_SECURITY_LABEL
-	security_release_secctx(as_ctx->sec_ctx, as_ctx->sec_ctxlen);
+	security_release_secctx(&as_ctx->lsmctx);
 #endif
 #ifdef CONFIG_FS_ENCRYPTION
 	kfree(as_ctx->fscrypt_auth);
--- linux-qcom-6.8.0.orig/fs/crypto/fname.c
+++ linux-qcom-6.8.0/fs/crypto/fname.c
@@ -74,13 +74,7 @@
 
 static inline bool fscrypt_is_dot_dotdot(const struct qstr *str)
 {
-	if (str->len == 1 && str->name[0] == '.')
-		return true;
-
-	if (str->len == 2 && str->name[0] == '.' && str->name[1] == '.')
-		return true;
-
-	return false;
+	return is_dot_dotdot(str->name, str->len);
 }
 
 /**
--- linux-qcom-6.8.0.orig/fs/crypto/fscrypt_private.h
+++ linux-qcom-6.8.0/fs/crypto/fscrypt_private.h
@@ -27,6 +27,27 @@
  */
 #define FSCRYPT_MIN_KEY_SIZE	16
 
+/* Maximum size of a standard fscrypt master key */
+#define FSCRYPT_MAX_STANDARD_KEY_SIZE	64
+
+/* Maximum size of a hardware-wrapped fscrypt master key */
+#define FSCRYPT_MAX_HW_WRAPPED_KEY_SIZE	BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE
+
+/*
+ * Maximum size of an fscrypt master key across both key types.
+ * This should just use max(), but max() doesn't work in a struct definition.
+ */
+#define FSCRYPT_MAX_ANY_KEY_SIZE \
+	(FSCRYPT_MAX_HW_WRAPPED_KEY_SIZE > FSCRYPT_MAX_STANDARD_KEY_SIZE ? \
+	 FSCRYPT_MAX_HW_WRAPPED_KEY_SIZE : FSCRYPT_MAX_STANDARD_KEY_SIZE)
+
+/*
+ * FSCRYPT_MAX_KEY_SIZE is defined in the UAPI header, but the addition of
+ * hardware-wrapped keys has made it misleading as it's only for standard keys.
+ * Don't use it in kernel code; use one of the above constants instead.
+ */
+#undef FSCRYPT_MAX_KEY_SIZE
+
 #define FSCRYPT_CONTEXT_V1	1
 #define FSCRYPT_CONTEXT_V2	2
 
@@ -358,13 +379,16 @@
  * outputs are unique and cryptographically isolated, i.e. knowledge of one
  * output doesn't reveal another.
  */
-#define HKDF_CONTEXT_KEY_IDENTIFIER	1 /* info=<empty>		*/
+#define HKDF_CONTEXT_KEY_IDENTIFIER_FOR_STANDARD_KEY \
+					1 /* info=<empty>		*/
 #define HKDF_CONTEXT_PER_FILE_ENC_KEY	2 /* info=file_nonce		*/
 #define HKDF_CONTEXT_DIRECT_KEY		3 /* info=mode_num		*/
 #define HKDF_CONTEXT_IV_INO_LBLK_64_KEY	4 /* info=mode_num||fs_uuid	*/
 #define HKDF_CONTEXT_DIRHASH_KEY	5 /* info=file_nonce		*/
 #define HKDF_CONTEXT_IV_INO_LBLK_32_KEY	6 /* info=mode_num||fs_uuid	*/
 #define HKDF_CONTEXT_INODE_HASH_KEY	7 /* info=<empty>		*/
+#define HKDF_CONTEXT_KEY_IDENTIFIER_FOR_HW_WRAPPED_KEY \
+					8 /* info=<empty>		*/
 
 int fscrypt_hkdf_expand(const struct fscrypt_hkdf *hkdf, u8 context,
 			const u8 *info, unsigned int infolen,
@@ -383,12 +407,17 @@
 }
 
 int fscrypt_prepare_inline_crypt_key(struct fscrypt_prepared_key *prep_key,
-				     const u8 *raw_key,
+				     const u8 *raw_key, size_t raw_key_size,
+				     bool is_hw_wrapped,
 				     const struct fscrypt_inode_info *ci);
 
 void fscrypt_destroy_inline_crypt_key(struct super_block *sb,
 				      struct fscrypt_prepared_key *prep_key);
 
+int fscrypt_derive_sw_secret(struct super_block *sb,
+			     const u8 *wrapped_key, size_t wrapped_key_size,
+			     u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE]);
+
 /*
  * Check whether the crypto transform or blk-crypto key has been allocated in
  * @prep_key, depending on which encryption implementation the file will use.
@@ -425,7 +454,8 @@
 
 static inline int
 fscrypt_prepare_inline_crypt_key(struct fscrypt_prepared_key *prep_key,
-				 const u8 *raw_key,
+				 const u8 *raw_key, size_t raw_key_size,
+				 bool is_hw_wrapped,
 				 const struct fscrypt_inode_info *ci)
 {
 	WARN_ON_ONCE(1);
@@ -438,6 +468,15 @@
 {
 }
 
+static inline int
+fscrypt_derive_sw_secret(struct super_block *sb,
+			 const u8 *wrapped_key, size_t wrapped_key_size,
+			 u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE])
+{
+	fscrypt_warn(NULL, "kernel doesn't support hardware-wrapped keys");
+	return -EOPNOTSUPP;
+}
+
 static inline bool
 fscrypt_is_key_prepared(struct fscrypt_prepared_key *prep_key,
 			const struct fscrypt_inode_info *ci)
@@ -454,20 +493,38 @@
 struct fscrypt_master_key_secret {
 
 	/*
-	 * For v2 policy keys: HKDF context keyed by this master key.
-	 * For v1 policy keys: not set (hkdf.hmac_tfm == NULL).
+	 * The KDF with which subkeys of this key can be derived.
+	 *
+	 * For v1 policy keys, this isn't applicable and won't be set.
+	 * Otherwise, this KDF will be keyed by this master key if
+	 * ->is_hw_wrapped=false, or by the "software secret" that hardware
+	 * derived from this master key if ->is_hw_wrapped=true.
 	 */
 	struct fscrypt_hkdf	hkdf;
 
 	/*
+	 * True if this key is a hardware-wrapped key; false if this key is a
+	 * standard key (i.e. a "software key").  For v1 policy keys this will
+	 * always be false, as v1 policy support is a legacy feature which
+	 * doesn't support newer functionality such as hardware-wrapped keys.
+	 */
+	bool			is_hw_wrapped;
+
+	/*
 	 * Size of the raw key in bytes.  This remains set even if ->raw was
 	 * zeroized due to no longer being needed.  I.e. we still remember the
 	 * size of the key even if we don't need to remember the key itself.
 	 */
 	u32			size;
 
-	/* For v1 policy keys: the raw key.  Wiped for v2 policy keys. */
-	u8			raw[FSCRYPT_MAX_KEY_SIZE];
+	/*
+	 * The raw key which userspace provided, when still needed.  This can be
+	 * either a standard key or a hardware-wrapped key, as indicated by
+	 * ->is_hw_wrapped.  In the case of a standard, v2 policy key, there is
+	 * no need to remember the raw key separately from ->hkdf so this field
+	 * will be zeroized as soon as ->hkdf is initialized.
+	 */
+	u8			raw[FSCRYPT_MAX_ANY_KEY_SIZE];
 
 } __randomize_layout;
 
--- linux-qcom-6.8.0.orig/fs/crypto/hkdf.c
+++ linux-qcom-6.8.0/fs/crypto/hkdf.c
@@ -4,7 +4,9 @@
  * Function"), aka RFC 5869.  See also the original paper (Krawczyk 2010):
  * "Cryptographic Extraction and Key Derivation: The HKDF Scheme".
  *
- * This is used to derive keys from the fscrypt master keys.
+ * This is used to derive keys from the fscrypt master keys (or from the
+ * "software secrets" which hardware derives from the fscrypt master keys, in
+ * the case that the fscrypt master keys are hardware-wrapped keys).
  *
  * Copyright 2019 Google LLC
  */
--- linux-qcom-6.8.0.orig/fs/crypto/inline_crypt.c
+++ linux-qcom-6.8.0/fs/crypto/inline_crypt.c
@@ -93,6 +93,7 @@
 {
 	const struct inode *inode = ci->ci_inode;
 	struct super_block *sb = inode->i_sb;
+	unsigned int policy_flags = fscrypt_policy_flags(&ci->ci_policy);
 	struct blk_crypto_config crypto_cfg;
 	struct block_device **devs;
 	unsigned int num_devs;
@@ -118,8 +119,7 @@
 	 * doesn't work with IV_INO_LBLK_32. For now, simply exclude
 	 * IV_INO_LBLK_32 with blocksize != PAGE_SIZE from inline encryption.
 	 */
-	if ((fscrypt_policy_flags(&ci->ci_policy) &
-	     FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) &&
+	if ((policy_flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) &&
 	    sb->s_blocksize != PAGE_SIZE)
 		return 0;
 
@@ -130,6 +130,9 @@
 	crypto_cfg.crypto_mode = ci->ci_mode->blk_crypto_mode;
 	crypto_cfg.data_unit_size = 1U << ci->ci_data_unit_bits;
 	crypto_cfg.dun_bytes = fscrypt_get_dun_bytes(ci);
+	crypto_cfg.key_type =
+		(policy_flags & FSCRYPT_POLICY_FLAG_HW_WRAPPED_KEY) ?
+		BLK_CRYPTO_KEY_TYPE_HW_WRAPPED : BLK_CRYPTO_KEY_TYPE_STANDARD;
 
 	devs = fscrypt_get_devices(sb, &num_devs);
 	if (IS_ERR(devs))
@@ -150,12 +153,15 @@
 }
 
 int fscrypt_prepare_inline_crypt_key(struct fscrypt_prepared_key *prep_key,
-				     const u8 *raw_key,
+				     const u8 *raw_key, size_t raw_key_size,
+				     bool is_hw_wrapped,
 				     const struct fscrypt_inode_info *ci)
 {
 	const struct inode *inode = ci->ci_inode;
 	struct super_block *sb = inode->i_sb;
 	enum blk_crypto_mode_num crypto_mode = ci->ci_mode->blk_crypto_mode;
+	enum blk_crypto_key_type key_type = is_hw_wrapped ?
+		BLK_CRYPTO_KEY_TYPE_HW_WRAPPED : BLK_CRYPTO_KEY_TYPE_STANDARD;
 	struct blk_crypto_key *blk_key;
 	struct block_device **devs;
 	unsigned int num_devs;
@@ -166,8 +172,8 @@
 	if (!blk_key)
 		return -ENOMEM;
 
-	err = blk_crypto_init_key(blk_key, raw_key, crypto_mode,
-				  fscrypt_get_dun_bytes(ci),
+	err = blk_crypto_init_key(blk_key, raw_key, raw_key_size, key_type,
+				  crypto_mode, fscrypt_get_dun_bytes(ci),
 				  1U << ci->ci_data_unit_bits);
 	if (err) {
 		fscrypt_err(inode, "error %d initializing blk-crypto key", err);
@@ -226,6 +232,56 @@
 	kfree_sensitive(blk_key);
 }
 
+/*
+ * Ask the inline encryption hardware to derive the software secret from a
+ * hardware-wrapped key.  Returns -EOPNOTSUPP if hardware-wrapped keys aren't
+ * supported on this filesystem or hardware.
+ */
+int fscrypt_derive_sw_secret(struct super_block *sb,
+			     const u8 *wrapped_key, size_t wrapped_key_size,
+			     u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE])
+{
+	struct block_device **devs;
+	unsigned int num_devs;
+	unsigned int i;
+	int err;
+
+	/* The filesystem must be mounted with -o inlinecrypt. */
+	if (!(sb->s_flags & SB_INLINECRYPT)) {
+		fscrypt_warn(NULL,
+			     "%s: filesystem not mounted with inlinecrypt\n",
+			     sb->s_id);
+		return -EOPNOTSUPP;
+	}
+
+	/*
+	 * Hardware-wrapped keys might be specific to a particular storage
+	 * device, so for now we don't allow them to be used if the filesystem
+	 * uses block devices with different crypto profiles.  This way, there
+	 * is no ambiguity about which ->derive_sw_secret method to call.
+	 */
+	devs = fscrypt_get_devices(sb, &num_devs);
+	if (IS_ERR(devs))
+		return PTR_ERR(devs);
+	for (i = 1; i < num_devs; i++) {
+		if (!blk_crypto_hw_wrapped_keys_compatible(devs[0], devs[i])) {
+			fscrypt_warn(NULL,
+				     "%s: unsupported multi-device configuration for hardware-wrapped keys",
+				     sb->s_id);
+			kfree(devs);
+			return -EOPNOTSUPP;
+		}
+	}
+	err = blk_crypto_derive_sw_secret(devs[0], wrapped_key,
+					  wrapped_key_size, sw_secret);
+	if (err == -EOPNOTSUPP)
+		fscrypt_warn(NULL,
+			     "%s: block device doesn't support hardware-wrapped keys\n",
+			     sb->s_id);
+	kfree(devs);
+	return err;
+}
+
 bool __fscrypt_inode_uses_inline_crypto(const struct inode *inode)
 {
 	return inode->i_crypt_info->ci_inlinecrypt;
--- linux-qcom-6.8.0.orig/fs/crypto/keyring.c
+++ linux-qcom-6.8.0/fs/crypto/keyring.c
@@ -144,11 +144,11 @@
 					struct key_preparsed_payload *prep)
 {
 	/*
-	 * We just charge FSCRYPT_MAX_KEY_SIZE bytes to the user's key quota for
-	 * each key, regardless of the exact key size.  The amount of memory
-	 * actually used is greater than the size of the raw key anyway.
+	 * We just charge FSCRYPT_MAX_STANDARD_KEY_SIZE bytes to the user's key
+	 * quota for each key, regardless of the exact key size.  The amount of
+	 * memory actually used is greater than the size of the raw key anyway.
 	 */
-	return key_payload_reserve(key, FSCRYPT_MAX_KEY_SIZE);
+	return key_payload_reserve(key, FSCRYPT_MAX_STANDARD_KEY_SIZE);
 }
 
 static void fscrypt_user_key_describe(const struct key *key, struct seq_file *m)
@@ -553,20 +553,45 @@
 	int err;
 
 	if (key_spec->type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) {
-		err = fscrypt_init_hkdf(&secret->hkdf, secret->raw,
-					secret->size);
-		if (err)
-			return err;
+		u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE];
+		u8 *kdf_key = secret->raw;
+		unsigned int kdf_key_size = secret->size;
+		u8 keyid_kdf_ctx = HKDF_CONTEXT_KEY_IDENTIFIER_FOR_STANDARD_KEY;
 
 		/*
-		 * Now that the HKDF context is initialized, the raw key is no
-		 * longer needed.
+		 * For standard keys, the fscrypt master key is used directly as
+		 * the fscrypt KDF key.  For hardware-wrapped keys, we have to
+		 * pass the master key to the hardware to derive the KDF key,
+		 * which is then only used to derive non-file-contents subkeys.
+		 */
+		if (secret->is_hw_wrapped) {
+			err = fscrypt_derive_sw_secret(sb, secret->raw,
+						       secret->size, sw_secret);
+			if (err)
+				return err;
+			kdf_key = sw_secret;
+			kdf_key_size = sizeof(sw_secret);
+			/*
+			 * To avoid weird behavior if someone manages to
+			 * determine sw_secret and add it as a standard key,
+			 * ensure that hardware-wrapped keys and standard keys
+			 * will have different key identifiers by deriving their
+			 * key identifiers using different KDF contexts.
+			 */
+			keyid_kdf_ctx =
+				HKDF_CONTEXT_KEY_IDENTIFIER_FOR_HW_WRAPPED_KEY;
+		}
+		err = fscrypt_init_hkdf(&secret->hkdf, kdf_key, kdf_key_size);
+		/*
+		 * Now that the KDF context is initialized, the raw KDF key is
+		 * no longer needed.
 		 */
-		memzero_explicit(secret->raw, secret->size);
+		memzero_explicit(kdf_key, kdf_key_size);
+		if (err)
+			return err;
 
 		/* Calculate the key identifier */
-		err = fscrypt_hkdf_expand(&secret->hkdf,
-					  HKDF_CONTEXT_KEY_IDENTIFIER, NULL, 0,
+		err = fscrypt_hkdf_expand(&secret->hkdf, keyid_kdf_ctx, NULL, 0,
 					  key_spec->u.identifier,
 					  FSCRYPT_KEY_IDENTIFIER_SIZE);
 		if (err)
@@ -575,19 +600,36 @@
 	return do_add_master_key(sb, secret, key_spec);
 }
 
+/*
+ * Validate the size of an fscrypt master key being added.  Note that this is
+ * just an initial check, as we don't know which ciphers will be used yet.
+ * There is a stricter size check later when the key is actually used by a file.
+ */
+static inline bool fscrypt_valid_key_size(size_t size, u32 add_key_flags)
+{
+	u32 max_size = (add_key_flags & FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED) ?
+		       FSCRYPT_MAX_HW_WRAPPED_KEY_SIZE :
+		       FSCRYPT_MAX_STANDARD_KEY_SIZE;
+
+	return size >= FSCRYPT_MIN_KEY_SIZE && size <= max_size;
+}
+
 static int fscrypt_provisioning_key_preparse(struct key_preparsed_payload *prep)
 {
 	const struct fscrypt_provisioning_key_payload *payload = prep->data;
 
-	if (prep->datalen < sizeof(*payload) + FSCRYPT_MIN_KEY_SIZE ||
-	    prep->datalen > sizeof(*payload) + FSCRYPT_MAX_KEY_SIZE)
+	if (prep->datalen < sizeof(*payload))
+		return -EINVAL;
+
+	if (!fscrypt_valid_key_size(prep->datalen - sizeof(*payload),
+				    payload->flags))
 		return -EINVAL;
 
 	if (payload->type != FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR &&
 	    payload->type != FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER)
 		return -EINVAL;
 
-	if (payload->__reserved)
+	if (payload->flags & ~FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED)
 		return -EINVAL;
 
 	prep->payload.data[0] = kmemdup(payload, prep->datalen, GFP_KERNEL);
@@ -634,18 +676,18 @@
  * Retrieve the raw key from the Linux keyring key specified by 'key_id', and
  * store it into 'secret'.
  *
- * The key must be of type "fscrypt-provisioning" and must have the field
- * fscrypt_provisioning_key_payload::type set to 'type', indicating that it's
- * only usable with fscrypt with the particular KDF version identified by
- * 'type'.  We don't use the "logon" key type because there's no way to
- * completely restrict the use of such keys; they can be used by any kernel API
- * that accepts "logon" keys and doesn't require a specific service prefix.
+ * The key must be of type "fscrypt-provisioning" and must have the 'type' and
+ * 'flags' field of the payload set to the given values, indicating that the key
+ * is intended for use for the specified purpose.  We don't use the "logon" key
+ * type because there's no way to completely restrict the use of such keys; they
+ * can be used by any kernel API that accepts "logon" keys and doesn't require a
+ * specific service prefix.
  *
  * The ability to specify the key via Linux keyring key is intended for cases
  * where userspace needs to re-add keys after the filesystem is unmounted and
  * re-mounted.  Most users should just provide the raw key directly instead.
  */
-static int get_keyring_key(u32 key_id, u32 type,
+static int get_keyring_key(u32 key_id, u32 type, u32 flags,
 			   struct fscrypt_master_key_secret *secret)
 {
 	key_ref_t ref;
@@ -662,8 +704,12 @@
 		goto bad_key;
 	payload = key->payload.data[0];
 
-	/* Don't allow fscrypt v1 keys to be used as v2 keys and vice versa. */
-	if (payload->type != type)
+	/*
+	 * Don't allow fscrypt v1 keys to be used as v2 keys and vice versa.
+	 * Similarly, don't allow hardware-wrapped keys to be used as
+	 * non-hardware-wrapped keys and vice versa.
+	 */
+	if (payload->type != type || payload->flags != flags)
 		goto bad_key;
 
 	secret->size = key->datalen - sizeof(*payload);
@@ -729,15 +775,24 @@
 		return -EACCES;
 
 	memset(&secret, 0, sizeof(secret));
+
+	if (arg.flags) {
+		if (arg.flags & ~FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED)
+			return -EINVAL;
+		if (arg.key_spec.type != FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER)
+			return -EINVAL;
+		secret.is_hw_wrapped = true;
+	}
+
 	if (arg.key_id) {
 		if (arg.raw_size != 0)
 			return -EINVAL;
-		err = get_keyring_key(arg.key_id, arg.key_spec.type, &secret);
+		err = get_keyring_key(arg.key_id, arg.key_spec.type, arg.flags,
+				      &secret);
 		if (err)
 			goto out_wipe_secret;
 	} else {
-		if (arg.raw_size < FSCRYPT_MIN_KEY_SIZE ||
-		    arg.raw_size > FSCRYPT_MAX_KEY_SIZE)
+		if (!fscrypt_valid_key_size(arg.raw_size, arg.flags))
 			return -EINVAL;
 		secret.size = arg.raw_size;
 		err = -EFAULT;
@@ -765,13 +820,13 @@
 static void
 fscrypt_get_test_dummy_secret(struct fscrypt_master_key_secret *secret)
 {
-	static u8 test_key[FSCRYPT_MAX_KEY_SIZE];
+	static u8 test_key[FSCRYPT_MAX_STANDARD_KEY_SIZE];
 
-	get_random_once(test_key, FSCRYPT_MAX_KEY_SIZE);
+	get_random_once(test_key, sizeof(test_key));
 
 	memset(secret, 0, sizeof(*secret));
-	secret->size = FSCRYPT_MAX_KEY_SIZE;
-	memcpy(secret->raw, test_key, FSCRYPT_MAX_KEY_SIZE);
+	secret->size = sizeof(test_key);
+	memcpy(secret->raw, test_key, sizeof(test_key));
 }
 
 int fscrypt_get_test_dummy_key_identifier(
@@ -785,7 +840,8 @@
 	err = fscrypt_init_hkdf(&secret.hkdf, secret.raw, secret.size);
 	if (err)
 		goto out;
-	err = fscrypt_hkdf_expand(&secret.hkdf, HKDF_CONTEXT_KEY_IDENTIFIER,
+	err = fscrypt_hkdf_expand(&secret.hkdf,
+				  HKDF_CONTEXT_KEY_IDENTIFIER_FOR_STANDARD_KEY,
 				  NULL, 0, key_identifier,
 				  FSCRYPT_KEY_IDENTIFIER_SIZE);
 out:
--- linux-qcom-6.8.0.orig/fs/crypto/keysetup.c
+++ linux-qcom-6.8.0/fs/crypto/keysetup.c
@@ -153,7 +153,9 @@
 	struct crypto_skcipher *tfm;
 
 	if (fscrypt_using_inline_encryption(ci))
-		return fscrypt_prepare_inline_crypt_key(prep_key, raw_key, ci);
+		return fscrypt_prepare_inline_crypt_key(prep_key, raw_key,
+							ci->ci_mode->keysize,
+							false, ci);
 
 	tfm = fscrypt_allocate_skcipher(ci->ci_mode, raw_key, ci->ci_inode);
 	if (IS_ERR(tfm))
@@ -195,14 +197,29 @@
 	struct fscrypt_mode *mode = ci->ci_mode;
 	const u8 mode_num = mode - fscrypt_modes;
 	struct fscrypt_prepared_key *prep_key;
-	u8 mode_key[FSCRYPT_MAX_KEY_SIZE];
+	u8 mode_key[FSCRYPT_MAX_STANDARD_KEY_SIZE];
 	u8 hkdf_info[sizeof(mode_num) + sizeof(sb->s_uuid)];
 	unsigned int hkdf_infolen = 0;
+	bool use_hw_wrapped_key = false;
 	int err;
 
 	if (WARN_ON_ONCE(mode_num > FSCRYPT_MODE_MAX))
 		return -EINVAL;
 
+	if (mk->mk_secret.is_hw_wrapped && S_ISREG(inode->i_mode)) {
+		/* Using a hardware-wrapped key for file contents encryption */
+		if (!fscrypt_using_inline_encryption(ci)) {
+			if (sb->s_flags & SB_INLINECRYPT)
+				fscrypt_warn(ci->ci_inode,
+					     "Hardware-wrapped key required, but no suitable inline encryption capabilities are available");
+			else
+				fscrypt_warn(ci->ci_inode,
+					     "Hardware-wrapped keys require inline encryption (-o inlinecrypt)");
+			return -EINVAL;
+		}
+		use_hw_wrapped_key = true;
+	}
+
 	prep_key = &keys[mode_num];
 	if (fscrypt_is_key_prepared(prep_key, ci)) {
 		ci->ci_enc_key = *prep_key;
@@ -214,6 +231,16 @@
 	if (fscrypt_is_key_prepared(prep_key, ci))
 		goto done_unlock;
 
+	if (use_hw_wrapped_key) {
+		err = fscrypt_prepare_inline_crypt_key(prep_key,
+						       mk->mk_secret.raw,
+						       mk->mk_secret.size, true,
+						       ci);
+		if (err)
+			goto out_unlock;
+		goto done_unlock;
+	}
+
 	BUILD_BUG_ON(sizeof(mode_num) != 1);
 	BUILD_BUG_ON(sizeof(sb->s_uuid) != 16);
 	BUILD_BUG_ON(sizeof(hkdf_info) != 17);
@@ -336,6 +363,19 @@
 {
 	int err;
 
+	if (mk->mk_secret.is_hw_wrapped &&
+	    !(ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_HW_WRAPPED_KEY)) {
+		fscrypt_warn(ci->ci_inode,
+			     "Given key is hardware-wrapped, but file isn't protected by a hardware-wrapped key");
+		return -EINVAL;
+	}
+	if ((ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_HW_WRAPPED_KEY) &&
+	    !mk->mk_secret.is_hw_wrapped) {
+		fscrypt_warn(ci->ci_inode,
+			     "File is protected by a hardware-wrapped key, but given key isn't hardware-wrapped");
+		return -EINVAL;
+	}
+
 	if (ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) {
 		/*
 		 * DIRECT_KEY: instead of deriving per-file encryption keys, the
@@ -362,7 +402,7 @@
 		   FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) {
 		err = fscrypt_setup_iv_ino_lblk_32_key(ci, mk);
 	} else {
-		u8 derived_key[FSCRYPT_MAX_KEY_SIZE];
+		u8 derived_key[FSCRYPT_MAX_STANDARD_KEY_SIZE];
 
 		err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf,
 					  HKDF_CONTEXT_PER_FILE_ENC_KEY,
@@ -499,6 +539,14 @@
 
 	switch (ci->ci_policy.version) {
 	case FSCRYPT_POLICY_V1:
+		if (WARN_ON(mk->mk_secret.is_hw_wrapped)) {
+			/*
+			 * This should never happen, as adding a v1 policy key
+			 * that is hardware-wrapped isn't allowed.
+			 */
+			err = -EINVAL;
+			goto out_release_key;
+		}
 		err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw);
 		break;
 	case FSCRYPT_POLICY_V2:
--- linux-qcom-6.8.0.orig/fs/crypto/keysetup_v1.c
+++ linux-qcom-6.8.0/fs/crypto/keysetup_v1.c
@@ -118,7 +118,8 @@
 	payload = (const struct fscrypt_key *)ukp->data;
 
 	if (ukp->datalen != sizeof(struct fscrypt_key) ||
-	    payload->size < 1 || payload->size > FSCRYPT_MAX_KEY_SIZE) {
+	    payload->size < 1 ||
+	    payload->size > FSCRYPT_MAX_STANDARD_KEY_SIZE) {
 		fscrypt_warn(NULL,
 			     "key with description '%s' has invalid payload",
 			     key->description);
@@ -149,7 +150,7 @@
 	const struct fscrypt_mode	*dk_mode;
 	struct fscrypt_prepared_key	dk_key;
 	u8				dk_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE];
-	u8				dk_raw[FSCRYPT_MAX_KEY_SIZE];
+	u8				dk_raw[FSCRYPT_MAX_STANDARD_KEY_SIZE];
 };
 
 static void free_direct_key(struct fscrypt_direct_key *dk)
--- linux-qcom-6.8.0.orig/fs/crypto/policy.c
+++ linux-qcom-6.8.0/fs/crypto/policy.c
@@ -229,7 +229,8 @@
 	if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |
 			      FSCRYPT_POLICY_FLAG_DIRECT_KEY |
 			      FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 |
-			      FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)) {
+			      FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32 |
+			      FSCRYPT_POLICY_FLAG_HW_WRAPPED_KEY)) {
 		fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)",
 			     policy->flags);
 		return false;
@@ -269,6 +270,14 @@
 		}
 	}
 
+	if ((policy->flags & FSCRYPT_POLICY_FLAG_HW_WRAPPED_KEY) &&
+	    !(policy->flags & (FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 |
+			       FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32))) {
+		fscrypt_warn(inode,
+			     "HW_WRAPPED_KEY flag can only be used with IV_INO_LBLK_64 or IV_INO_LBLK_32");
+		return false;
+	}
+
 	if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) &&
 	    !supported_direct_key_modes(inode, policy->contents_encryption_mode,
 					policy->filenames_encryption_mode))
--- linux-qcom-6.8.0.orig/fs/dax.c
+++ linux-qcom-6.8.0/fs/dax.c
@@ -1262,35 +1262,46 @@
 {
 	struct iomap *iomap = &iter->iomap;
 	const struct iomap *srcmap = iomap_iter_srcmap(iter);
-	loff_t pos = iter->pos;
-	loff_t length = iomap_length(iter);
+	loff_t copy_pos = iter->pos;
+	u64 copy_len = iomap_length(iter);
+	u32 mod;
 	int id = 0;
 	s64 ret = 0;
 	void *daddr = NULL, *saddr = NULL;
 
-	/* don't bother with blocks that are not shared to start with */
-	if (!(iomap->flags & IOMAP_F_SHARED))
-		return length;
+	if (!iomap_want_unshare_iter(iter))
+		return iomap_length(iter);
+
+	/*
+	 * Extend the file range to be aligned to fsblock/pagesize, because
+	 * we need to copy entire blocks, not just the byte range specified.
+	 * Invalidate the mapping because we're about to CoW.
+	 */
+	mod = offset_in_page(copy_pos);
+	if (mod) {
+		copy_len += mod;
+		copy_pos -= mod;
+	}
+
+	mod = offset_in_page(copy_pos + copy_len);
+	if (mod)
+		copy_len += PAGE_SIZE - mod;
+
+	invalidate_inode_pages2_range(iter->inode->i_mapping,
+				      copy_pos >> PAGE_SHIFT,
+				      (copy_pos + copy_len - 1) >> PAGE_SHIFT);
 
 	id = dax_read_lock();
-	ret = dax_iomap_direct_access(iomap, pos, length, &daddr, NULL);
+	ret = dax_iomap_direct_access(iomap, copy_pos, copy_len, &daddr, NULL);
 	if (ret < 0)
 		goto out_unlock;
 
-	/* zero the distance if srcmap is HOLE or UNWRITTEN */
-	if (srcmap->flags & IOMAP_F_SHARED || srcmap->type == IOMAP_UNWRITTEN) {
-		memset(daddr, 0, length);
-		dax_flush(iomap->dax_dev, daddr, length);
-		ret = length;
-		goto out_unlock;
-	}
-
-	ret = dax_iomap_direct_access(srcmap, pos, length, &saddr, NULL);
+	ret = dax_iomap_direct_access(srcmap, copy_pos, copy_len, &saddr, NULL);
 	if (ret < 0)
 		goto out_unlock;
 
-	if (copy_mc_to_kernel(daddr, saddr, length) == 0)
-		ret = length;
+	if (copy_mc_to_kernel(daddr, saddr, copy_len) == 0)
+		ret = iomap_length(iter);
 	else
 		ret = -EIO;
 
@@ -1305,11 +1316,15 @@
 	struct iomap_iter iter = {
 		.inode		= inode,
 		.pos		= pos,
-		.len		= len,
 		.flags		= IOMAP_WRITE | IOMAP_UNSHARE | IOMAP_DAX,
 	};
+	loff_t size = i_size_read(inode);
 	int ret;
 
+	if (pos < 0 || pos >= size)
+		return 0;
+
+	iter.len = min(len, size - pos);
 	while ((ret = iomap_iter(&iter, ops)) > 0)
 		iter.processed = dax_unshare_iter(&iter);
 	return ret;
--- linux-qcom-6.8.0.orig/fs/dcache.c
+++ linux-qcom-6.8.0/fs/dcache.c
@@ -355,7 +355,11 @@
 	flags &= ~DCACHE_ENTRY_TYPE;
 	WRITE_ONCE(dentry->d_flags, flags);
 	dentry->d_inode = NULL;
-	if (dentry->d_flags & DCACHE_LRU_LIST)
+	/*
+	 * The negative counter only tracks dentries on the LRU. Don't inc if
+	 * d_lru is on another list.
+	 */
+	if ((flags & (DCACHE_LRU_LIST|DCACHE_SHRINK_LIST)) == DCACHE_LRU_LIST)
 		this_cpu_inc(nr_dentry_negative);
 }
 
@@ -1844,9 +1848,11 @@
 
 	spin_lock(&dentry->d_lock);
 	/*
-	 * Decrement negative dentry count if it was in the LRU list.
+	 * The negative counter only tracks dentries on the LRU. Don't dec if
+	 * d_lru is on another list.
 	 */
-	if (dentry->d_flags & DCACHE_LRU_LIST)
+	if ((dentry->d_flags &
+	     (DCACHE_LRU_LIST|DCACHE_SHRINK_LIST)) == DCACHE_LRU_LIST)
 		this_cpu_dec(nr_dentry_negative);
 	hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
 	raw_write_seqcount_begin(&dentry->d_seq);
@@ -3029,28 +3035,25 @@
   
 bool is_subdir(struct dentry *new_dentry, struct dentry *old_dentry)
 {
-	bool result;
+	bool subdir;
 	unsigned seq;
 
 	if (new_dentry == old_dentry)
 		return true;
 
-	do {
-		/* for restarting inner loop in case of seq retry */
-		seq = read_seqbegin(&rename_lock);
-		/*
-		 * Need rcu_readlock to protect against the d_parent trashing
-		 * due to d_move
-		 */
-		rcu_read_lock();
-		if (d_ancestor(old_dentry, new_dentry))
-			result = true;
-		else
-			result = false;
-		rcu_read_unlock();
-	} while (read_seqretry(&rename_lock, seq));
-
-	return result;
+	/* Access d_parent under rcu as d_move() may change it. */
+	rcu_read_lock();
+	seq = read_seqbegin(&rename_lock);
+	subdir = d_ancestor(old_dentry, new_dentry);
+	 /* Try lockless once... */
+	if (read_seqretry(&rename_lock, seq)) {
+		/* ...else acquire lock for progress even on deep chains. */
+		read_seqlock_excl(&rename_lock);
+		subdir = d_ancestor(old_dentry, new_dentry);
+		read_sequnlock_excl(&rename_lock);
+	}
+	rcu_read_unlock();
+	return subdir;
 }
 EXPORT_SYMBOL(is_subdir);
 
--- linux-qcom-6.8.0.orig/fs/debugfs/inode.c
+++ linux-qcom-6.8.0/fs/debugfs/inode.c
@@ -751,13 +751,28 @@
 	if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)
 		return;
 
-	/* if we hit zero, just wait for all to finish */
-	if (!refcount_dec_and_test(&fsd->active_users)) {
-		wait_for_completion(&fsd->active_users_drained);
+	/* if this was the last reference, we're done */
+	if (refcount_dec_and_test(&fsd->active_users))
 		return;
-	}
 
-	/* if we didn't hit zero, try to cancel any we can */
+	/*
+	 * If there's still a reference, the code that obtained it can
+	 * be in different states:
+	 *  - The common case of not using cancellations, or already
+	 *    after debugfs_leave_cancellation(), where we just need
+	 *    to wait for debugfs_file_put() which signals the completion;
+	 *  - inside a cancellation section, i.e. between
+	 *    debugfs_enter_cancellation() and debugfs_leave_cancellation(),
+	 *    in which case we need to trigger the ->cancel() function,
+	 *    and then wait for debugfs_file_put() just like in the
+	 *    previous case;
+	 *  - before debugfs_enter_cancellation() (but obviously after
+	 *    debugfs_file_get()), in which case we may not see the
+	 *    cancellation in the list on the first round of the loop,
+	 *    but debugfs_enter_cancellation() signals the completion
+	 *    after adding it, so this code gets woken up to call the
+	 *    ->cancel() function.
+	 */
 	while (refcount_read(&fsd->active_users)) {
 		struct debugfs_cancellation *c;
 
--- linux-qcom-6.8.0.orig/fs/dlm/ast.c
+++ linux-qcom-6.8.0/fs/dlm/ast.c
@@ -12,6 +12,7 @@
 #include <trace/events/dlm.h>
 
 #include "dlm_internal.h"
+#include "lvb_table.h"
 #include "memory.h"
 #include "lock.h"
 #include "user.h"
@@ -42,6 +43,7 @@
 	struct dlm_ls *ls = lkb->lkb_resource->res_ls;
 	int rv = DLM_ENQUEUE_CALLBACK_SUCCESS;
 	struct dlm_callback *cb;
+	int copy_lvb = 0;
 	int prev_mode;
 
 	if (flags & DLM_CB_BAST) {
@@ -73,6 +75,17 @@
 				goto out;
 			}
 		}
+	} else if (flags & DLM_CB_CAST) {
+		if (test_bit(DLM_DFL_USER_BIT, &lkb->lkb_dflags)) {
+			if (lkb->lkb_last_cast)
+				prev_mode = lkb->lkb_last_cb->mode;
+			else
+				prev_mode = -1;
+
+			if (!status && lkb->lkb_lksb->sb_lvbptr &&
+			    dlm_lvb_operations[prev_mode + 1][mode + 1])
+				copy_lvb = 1;
+		}
 	}
 
 	cb = dlm_allocate_cb();
@@ -85,6 +98,7 @@
 	cb->mode = mode;
 	cb->sb_status = status;
 	cb->sb_flags = (sbflags & 0x000000FF);
+	cb->copy_lvb = copy_lvb;
 	kref_init(&cb->ref);
 	if (!test_and_set_bit(DLM_IFL_CB_PENDING_BIT, &lkb->lkb_iflags))
 		rv = DLM_ENQUEUE_CALLBACK_NEED_SCHED;
--- linux-qcom-6.8.0.orig/fs/dlm/dlm_internal.h
+++ linux-qcom-6.8.0/fs/dlm/dlm_internal.h
@@ -222,6 +222,7 @@
 	int			sb_status;	/* copy to lksb status */
 	uint8_t			sb_flags;	/* copy to lksb flags */
 	int8_t			mode; /* rq mode of bast, gr mode of cast */
+	int			copy_lvb;
 
 	struct list_head	list;
 	struct kref		ref;
--- linux-qcom-6.8.0.orig/fs/dlm/lock.c
+++ linux-qcom-6.8.0/fs/dlm/lock.c
@@ -2698,16 +2698,14 @@
 	case -EINVAL:
 		/* annoy the user because dlm usage is wrong */
 		WARN_ON(1);
-		log_error(ls, "%s %d %x %x %x %d %d %s", __func__,
+		log_error(ls, "%s %d %x %x %x %d %d", __func__,
 			  rv, lkb->lkb_id, dlm_iflags_val(lkb), args->flags,
-			  lkb->lkb_status, lkb->lkb_wait_type,
-			  lkb->lkb_resource->res_name);
+			  lkb->lkb_status, lkb->lkb_wait_type);
 		break;
 	default:
-		log_debug(ls, "%s %d %x %x %x %d %d %s", __func__,
+		log_debug(ls, "%s %d %x %x %x %d %d", __func__,
 			  rv, lkb->lkb_id, dlm_iflags_val(lkb), args->flags,
-			  lkb->lkb_status, lkb->lkb_wait_type,
-			  lkb->lkb_resource->res_name);
+			  lkb->lkb_status, lkb->lkb_wait_type);
 		break;
 	}
 
--- linux-qcom-6.8.0.orig/fs/dlm/user.c
+++ linux-qcom-6.8.0/fs/dlm/user.c
@@ -21,7 +21,6 @@
 #include "dlm_internal.h"
 #include "lockspace.h"
 #include "lock.h"
-#include "lvb_table.h"
 #include "user.h"
 #include "ast.h"
 #include "config.h"
@@ -806,8 +805,7 @@
 	struct dlm_lkb *lkb;
 	DECLARE_WAITQUEUE(wait, current);
 	struct dlm_callback *cb;
-	int rv, copy_lvb = 0;
-	int old_mode, new_mode;
+	int rv, ret;
 
 	if (count == sizeof(struct dlm_device_version)) {
 		rv = copy_version_to_user(buf, count);
@@ -864,9 +862,6 @@
 
 	lkb = list_first_entry(&proc->asts, struct dlm_lkb, lkb_cb_list);
 
-	/* rem_lkb_callback sets a new lkb_last_cast */
-	old_mode = lkb->lkb_last_cast->mode;
-
 	rv = dlm_dequeue_lkb_callback(lkb, &cb);
 	switch (rv) {
 	case DLM_DEQUEUE_CALLBACK_EMPTY:
@@ -895,20 +890,14 @@
 	if (cb->flags & DLM_CB_BAST) {
 		trace_dlm_bast(lkb->lkb_resource->res_ls, lkb, cb->mode);
 	} else if (cb->flags & DLM_CB_CAST) {
-		new_mode = cb->mode;
-
-		if (!cb->sb_status && lkb->lkb_lksb->sb_lvbptr &&
-		    dlm_lvb_operations[old_mode + 1][new_mode + 1])
-			copy_lvb = 1;
-
 		lkb->lkb_lksb->sb_status = cb->sb_status;
 		lkb->lkb_lksb->sb_flags = cb->sb_flags;
 		trace_dlm_ast(lkb->lkb_resource->res_ls, lkb);
 	}
 
-	rv = copy_result_to_user(lkb->lkb_ua,
-				 test_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags),
-				 cb->flags, cb->mode, copy_lvb, buf, count);
+	ret = copy_result_to_user(lkb->lkb_ua,
+				  test_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags),
+				  cb->flags, cb->mode, cb->copy_lvb, buf, count);
 
 	kref_put(&cb->ref, dlm_release_callback);
 
@@ -916,7 +905,7 @@
 	if (rv == DLM_DEQUEUE_CALLBACK_LAST)
 		dlm_put_lkb(lkb);
 
-	return rv;
+	return ret;
 }
 
 static __poll_t device_poll(struct file *file, poll_table *wait)
--- linux-qcom-6.8.0.orig/fs/ecryptfs/crypto.c
+++ linux-qcom-6.8.0/fs/ecryptfs/crypto.c
@@ -1949,16 +1949,6 @@
 	return rc;
 }
 
-static bool is_dot_dotdot(const char *name, size_t name_size)
-{
-	if (name_size == 1 && name[0] == '.')
-		return true;
-	else if (name_size == 2 && name[0] == '.' && name[1] == '.')
-		return true;
-
-	return false;
-}
-
 /**
  * ecryptfs_decode_and_decrypt_filename - converts the encoded cipher text name to decoded plaintext
  * @plaintext_name: The plaintext name
--- linux-qcom-6.8.0.orig/fs/ecryptfs/keystore.c
+++ linux-qcom-6.8.0/fs/ecryptfs/keystore.c
@@ -300,9 +300,11 @@
 	 *         | Key Identifier Size      | 1 or 2 bytes |
 	 *         | Key Identifier           | arbitrary    |
 	 *         | File Encryption Key Size | 1 or 2 bytes |
+	 *         | Cipher Code              | 1 byte       |
 	 *         | File Encryption Key      | arbitrary    |
+	 *         | Checksum                 | 2 bytes      |
 	 */
-	data_len = (5 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size);
+	data_len = (8 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size);
 	*packet = kmalloc(data_len, GFP_KERNEL);
 	message = *packet;
 	if (!message) {
--- linux-qcom-6.8.0.orig/fs/efivarfs/inode.c
+++ linux-qcom-6.8.0/fs/efivarfs/inode.c
@@ -51,7 +51,7 @@
  *
  *	VariableName-12345678-1234-1234-1234-1234567891bc
  */
-bool efivarfs_valid_name(const char *str, int len)
+static bool efivarfs_valid_name(const char *str, int len)
 {
 	const char *s = str + len - EFI_VARIABLE_GUID_LEN;
 
--- linux-qcom-6.8.0.orig/fs/efivarfs/internal.h
+++ linux-qcom-6.8.0/fs/efivarfs/internal.h
@@ -63,7 +63,6 @@
 
 extern const struct file_operations efivarfs_file_operations;
 extern const struct inode_operations efivarfs_dir_inode_operations;
-extern bool efivarfs_valid_name(const char *str, int len);
 extern struct inode *efivarfs_get_inode(struct super_block *sb,
 			const struct inode *dir, int mode, dev_t dev,
 			bool is_removable);
--- linux-qcom-6.8.0.orig/fs/efivarfs/super.c
+++ linux-qcom-6.8.0/fs/efivarfs/super.c
@@ -144,9 +144,6 @@
 	const unsigned char *s = qstr->name;
 	unsigned int len = qstr->len;
 
-	if (!efivarfs_valid_name(s, len))
-		return -EINVAL;
-
 	while (len-- > EFI_VARIABLE_GUID_LEN)
 		hash = partial_name_hash(*s++, hash);
 
--- linux-qcom-6.8.0.orig/fs/erofs/decompressor_deflate.c
+++ linux-qcom-6.8.0/fs/erofs/decompressor_deflate.c
@@ -46,39 +46,15 @@
 	/* by default, use # of possible CPUs instead */
 	if (!z_erofs_deflate_nstrms)
 		z_erofs_deflate_nstrms = num_possible_cpus();
-
-	for (; z_erofs_deflate_avail_strms < z_erofs_deflate_nstrms;
-	     ++z_erofs_deflate_avail_strms) {
-		struct z_erofs_deflate *strm;
-
-		strm = kzalloc(sizeof(*strm), GFP_KERNEL);
-		if (!strm)
-			goto out_failed;
-
-		/* XXX: in-kernel zlib cannot shrink windowbits currently */
-		strm->z.workspace = vmalloc(zlib_inflate_workspacesize());
-		if (!strm->z.workspace) {
-			kfree(strm);
-			goto out_failed;
-		}
-
-		spin_lock(&z_erofs_deflate_lock);
-		strm->next = z_erofs_deflate_head;
-		z_erofs_deflate_head = strm;
-		spin_unlock(&z_erofs_deflate_lock);
-	}
 	return 0;
-
-out_failed:
-	erofs_err(NULL, "failed to allocate zlib workspace");
-	z_erofs_deflate_exit();
-	return -ENOMEM;
 }
 
 int z_erofs_load_deflate_config(struct super_block *sb,
 			struct erofs_super_block *dsb, void *data, int size)
 {
 	struct z_erofs_deflate_cfgs *dfl = data;
+	static DEFINE_MUTEX(deflate_resize_mutex);
+	static bool inited;
 
 	if (!dfl || size < sizeof(struct z_erofs_deflate_cfgs)) {
 		erofs_err(sb, "invalid deflate cfgs, size=%u", size);
@@ -89,9 +65,36 @@
 		erofs_err(sb, "unsupported windowbits %u", dfl->windowbits);
 		return -EOPNOTSUPP;
 	}
-
+	mutex_lock(&deflate_resize_mutex);
+	if (!inited) {
+		for (; z_erofs_deflate_avail_strms < z_erofs_deflate_nstrms;
+		     ++z_erofs_deflate_avail_strms) {
+			struct z_erofs_deflate *strm;
+
+			strm = kzalloc(sizeof(*strm), GFP_KERNEL);
+			if (!strm)
+				goto failed;
+			/* XXX: in-kernel zlib cannot customize windowbits */
+			strm->z.workspace = vmalloc(zlib_inflate_workspacesize());
+			if (!strm->z.workspace) {
+				kfree(strm);
+				goto failed;
+			}
+
+			spin_lock(&z_erofs_deflate_lock);
+			strm->next = z_erofs_deflate_head;
+			z_erofs_deflate_head = strm;
+			spin_unlock(&z_erofs_deflate_lock);
+		}
+		inited = true;
+	}
+	mutex_unlock(&deflate_resize_mutex);
 	erofs_info(sb, "EXPERIMENTAL DEFLATE feature in use. Use at your own risk!");
 	return 0;
+failed:
+	mutex_unlock(&deflate_resize_mutex);
+	z_erofs_deflate_exit();
+	return -ENOMEM;
 }
 
 int z_erofs_deflate_decompress(struct z_erofs_decompress_req *rq,
--- linux-qcom-6.8.0.orig/fs/erofs/fscache.c
+++ linux-qcom-6.8.0/fs/erofs/fscache.c
@@ -3,6 +3,7 @@
  * Copyright (C) 2022, Alibaba Cloud
  * Copyright (C) 2022, Bytedance Inc. All rights reserved.
  */
+#include <linux/pseudo_fs.h>
 #include <linux/fscache.h>
 #include "internal.h"
 
@@ -12,6 +13,18 @@
 static LIST_HEAD(erofs_domain_cookies_list);
 static struct vfsmount *erofs_pseudo_mnt;
 
+static int erofs_anon_init_fs_context(struct fs_context *fc)
+{
+	return init_pseudo(fc, EROFS_SUPER_MAGIC) ? 0 : -ENOMEM;
+}
+
+static struct file_system_type erofs_anon_fs_type = {
+	.owner		= THIS_MODULE,
+	.name           = "pseudo_erofs",
+	.init_fs_context = erofs_anon_init_fs_context,
+	.kill_sb        = kill_anon_super,
+};
+
 struct erofs_fscache_request {
 	struct erofs_fscache_request *primary;
 	struct netfs_cache_resources cache_resources;
@@ -381,7 +394,7 @@
 		goto out;
 
 	if (!erofs_pseudo_mnt) {
-		struct vfsmount *mnt = kern_mount(&erofs_fs_type);
+		struct vfsmount *mnt = kern_mount(&erofs_anon_fs_type);
 		if (IS_ERR(mnt)) {
 			err = PTR_ERR(mnt);
 			goto out;
--- linux-qcom-6.8.0.orig/fs/erofs/inode.c
+++ linux-qcom-6.8.0/fs/erofs/inode.c
@@ -178,12 +178,14 @@
 			      unsigned int m_pofs)
 {
 	struct erofs_inode *vi = EROFS_I(inode);
-	unsigned int bsz = i_blocksize(inode);
+	loff_t off;
 	char *lnk;
 
-	/* if it cannot be handled with fast symlink scheme */
-	if (vi->datalayout != EROFS_INODE_FLAT_INLINE ||
-	    inode->i_size >= bsz || inode->i_size < 0) {
+	m_pofs += vi->xattr_isize;
+	/* check if it cannot be handled with fast symlink scheme */
+	if (vi->datalayout != EROFS_INODE_FLAT_INLINE || inode->i_size < 0 ||
+	    check_add_overflow(m_pofs, inode->i_size, &off) ||
+	    off > i_blocksize(inode)) {
 		inode->i_op = &erofs_symlink_iops;
 		return 0;
 	}
@@ -192,16 +194,6 @@
 	if (!lnk)
 		return -ENOMEM;
 
-	m_pofs += vi->xattr_isize;
-	/* inline symlink data shouldn't cross block boundary */
-	if (m_pofs + inode->i_size > bsz) {
-		kfree(lnk);
-		erofs_err(inode->i_sb,
-			  "inline data cross block boundary @ nid %llu",
-			  vi->nid);
-		DBG_BUGON(1);
-		return -EFSCORRUPTED;
-	}
 	memcpy(lnk, kaddr + m_pofs, inode->i_size);
 	lnk[inode->i_size] = '\0';
 
--- linux-qcom-6.8.0.orig/fs/erofs/internal.h
+++ linux-qcom-6.8.0/fs/erofs/internal.h
@@ -84,13 +84,6 @@
 	bool flatdev;
 };
 
-struct erofs_fs_context {
-	struct erofs_mount_opts opt;
-	struct erofs_dev_context *devs;
-	char *fsid;
-	char *domain_id;
-};
-
 /* all filesystem-wide lz4 configurations */
 struct erofs_sb_lz4_info {
 	/* # of pages needed for EROFS lz4 rolling decompression */
@@ -385,7 +378,6 @@
 	unsigned int m_deviceid;
 };
 
-extern struct file_system_type erofs_fs_type;
 extern const struct super_operations erofs_sops;
 
 extern const struct address_space_operations erofs_raw_access_aops;
--- linux-qcom-6.8.0.orig/fs/erofs/super.c
+++ linux-qcom-6.8.0/fs/erofs/super.c
@@ -370,18 +370,18 @@
 	return ret;
 }
 
-static void erofs_default_options(struct erofs_fs_context *ctx)
+static void erofs_default_options(struct erofs_sb_info *sbi)
 {
 #ifdef CONFIG_EROFS_FS_ZIP
-	ctx->opt.cache_strategy = EROFS_ZIP_CACHE_READAROUND;
-	ctx->opt.max_sync_decompress_pages = 3;
-	ctx->opt.sync_decompress = EROFS_SYNC_DECOMPRESS_AUTO;
+	sbi->opt.cache_strategy = EROFS_ZIP_CACHE_READAROUND;
+	sbi->opt.max_sync_decompress_pages = 3;
+	sbi->opt.sync_decompress = EROFS_SYNC_DECOMPRESS_AUTO;
 #endif
 #ifdef CONFIG_EROFS_FS_XATTR
-	set_opt(&ctx->opt, XATTR_USER);
+	set_opt(&sbi->opt, XATTR_USER);
 #endif
 #ifdef CONFIG_EROFS_FS_POSIX_ACL
-	set_opt(&ctx->opt, POSIX_ACL);
+	set_opt(&sbi->opt, POSIX_ACL);
 #endif
 }
 
@@ -426,17 +426,17 @@
 static bool erofs_fc_set_dax_mode(struct fs_context *fc, unsigned int mode)
 {
 #ifdef CONFIG_FS_DAX
-	struct erofs_fs_context *ctx = fc->fs_private;
+	struct erofs_sb_info *sbi = fc->s_fs_info;
 
 	switch (mode) {
 	case EROFS_MOUNT_DAX_ALWAYS:
 		warnfc(fc, "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
-		set_opt(&ctx->opt, DAX_ALWAYS);
-		clear_opt(&ctx->opt, DAX_NEVER);
+		set_opt(&sbi->opt, DAX_ALWAYS);
+		clear_opt(&sbi->opt, DAX_NEVER);
 		return true;
 	case EROFS_MOUNT_DAX_NEVER:
-		set_opt(&ctx->opt, DAX_NEVER);
-		clear_opt(&ctx->opt, DAX_ALWAYS);
+		set_opt(&sbi->opt, DAX_NEVER);
+		clear_opt(&sbi->opt, DAX_ALWAYS);
 		return true;
 	default:
 		DBG_BUGON(1);
@@ -451,7 +451,7 @@
 static int erofs_fc_parse_param(struct fs_context *fc,
 				struct fs_parameter *param)
 {
-	struct erofs_fs_context *ctx = fc->fs_private;
+	struct erofs_sb_info *sbi = fc->s_fs_info;
 	struct fs_parse_result result;
 	struct erofs_device_info *dif;
 	int opt, ret;
@@ -464,9 +464,9 @@
 	case Opt_user_xattr:
 #ifdef CONFIG_EROFS_FS_XATTR
 		if (result.boolean)
-			set_opt(&ctx->opt, XATTR_USER);
+			set_opt(&sbi->opt, XATTR_USER);
 		else
-			clear_opt(&ctx->opt, XATTR_USER);
+			clear_opt(&sbi->opt, XATTR_USER);
 #else
 		errorfc(fc, "{,no}user_xattr options not supported");
 #endif
@@ -474,16 +474,16 @@
 	case Opt_acl:
 #ifdef CONFIG_EROFS_FS_POSIX_ACL
 		if (result.boolean)
-			set_opt(&ctx->opt, POSIX_ACL);
+			set_opt(&sbi->opt, POSIX_ACL);
 		else
-			clear_opt(&ctx->opt, POSIX_ACL);
+			clear_opt(&sbi->opt, POSIX_ACL);
 #else
 		errorfc(fc, "{,no}acl options not supported");
 #endif
 		break;
 	case Opt_cache_strategy:
 #ifdef CONFIG_EROFS_FS_ZIP
-		ctx->opt.cache_strategy = result.uint_32;
+		sbi->opt.cache_strategy = result.uint_32;
 #else
 		errorfc(fc, "compression not supported, cache_strategy ignored");
 #endif
@@ -505,27 +505,27 @@
 			kfree(dif);
 			return -ENOMEM;
 		}
-		down_write(&ctx->devs->rwsem);
-		ret = idr_alloc(&ctx->devs->tree, dif, 0, 0, GFP_KERNEL);
-		up_write(&ctx->devs->rwsem);
+		down_write(&sbi->devs->rwsem);
+		ret = idr_alloc(&sbi->devs->tree, dif, 0, 0, GFP_KERNEL);
+		up_write(&sbi->devs->rwsem);
 		if (ret < 0) {
 			kfree(dif->path);
 			kfree(dif);
 			return ret;
 		}
-		++ctx->devs->extra_devices;
+		++sbi->devs->extra_devices;
 		break;
 #ifdef CONFIG_EROFS_FS_ONDEMAND
 	case Opt_fsid:
-		kfree(ctx->fsid);
-		ctx->fsid = kstrdup(param->string, GFP_KERNEL);
-		if (!ctx->fsid)
+		kfree(sbi->fsid);
+		sbi->fsid = kstrdup(param->string, GFP_KERNEL);
+		if (!sbi->fsid)
 			return -ENOMEM;
 		break;
 	case Opt_domain_id:
-		kfree(ctx->domain_id);
-		ctx->domain_id = kstrdup(param->string, GFP_KERNEL);
-		if (!ctx->domain_id)
+		kfree(sbi->domain_id);
+		sbi->domain_id = kstrdup(param->string, GFP_KERNEL);
+		if (!sbi->domain_id)
 			return -ENOMEM;
 		break;
 #else
@@ -579,18 +579,10 @@
 	.get_parent = erofs_get_parent,
 };
 
-static int erofs_fc_fill_pseudo_super(struct super_block *sb, struct fs_context *fc)
-{
-	static const struct tree_descr empty_descr = {""};
-
-	return simple_fill_super(sb, EROFS_SUPER_MAGIC, &empty_descr);
-}
-
 static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
 {
 	struct inode *inode;
-	struct erofs_sb_info *sbi;
-	struct erofs_fs_context *ctx = fc->fs_private;
+	struct erofs_sb_info *sbi = EROFS_SB(sb);
 	int err;
 
 	sb->s_magic = EROFS_SUPER_MAGIC;
@@ -598,19 +590,6 @@
 	sb->s_maxbytes = MAX_LFS_FILESIZE;
 	sb->s_op = &erofs_sops;
 
-	sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
-	if (!sbi)
-		return -ENOMEM;
-
-	sb->s_fs_info = sbi;
-	sbi->opt = ctx->opt;
-	sbi->devs = ctx->devs;
-	ctx->devs = NULL;
-	sbi->fsid = ctx->fsid;
-	ctx->fsid = NULL;
-	sbi->domain_id = ctx->domain_id;
-	ctx->domain_id = NULL;
-
 	sbi->blkszbits = PAGE_SHIFT;
 	if (erofs_is_fscache_mode(sb)) {
 		sb->s_blocksize = PAGE_SIZE;
@@ -712,16 +691,11 @@
 	return 0;
 }
 
-static int erofs_fc_anon_get_tree(struct fs_context *fc)
-{
-	return get_tree_nodev(fc, erofs_fc_fill_pseudo_super);
-}
-
 static int erofs_fc_get_tree(struct fs_context *fc)
 {
-	struct erofs_fs_context *ctx = fc->fs_private;
+	struct erofs_sb_info *sbi = fc->s_fs_info;
 
-	if (IS_ENABLED(CONFIG_EROFS_FS_ONDEMAND) && ctx->fsid)
+	if (IS_ENABLED(CONFIG_EROFS_FS_ONDEMAND) && sbi->fsid)
 		return get_tree_nodev(fc, erofs_fc_fill_super);
 
 	return get_tree_bdev(fc, erofs_fc_fill_super);
@@ -731,19 +705,19 @@
 {
 	struct super_block *sb = fc->root->d_sb;
 	struct erofs_sb_info *sbi = EROFS_SB(sb);
-	struct erofs_fs_context *ctx = fc->fs_private;
+	struct erofs_sb_info *new_sbi = fc->s_fs_info;
 
 	DBG_BUGON(!sb_rdonly(sb));
 
-	if (ctx->fsid || ctx->domain_id)
+	if (new_sbi->fsid || new_sbi->domain_id)
 		erofs_info(sb, "ignoring reconfiguration for fsid|domain_id.");
 
-	if (test_opt(&ctx->opt, POSIX_ACL))
+	if (test_opt(&new_sbi->opt, POSIX_ACL))
 		fc->sb_flags |= SB_POSIXACL;
 	else
 		fc->sb_flags &= ~SB_POSIXACL;
 
-	sbi->opt = ctx->opt;
+	sbi->opt = new_sbi->opt;
 
 	fc->sb_flags |= SB_RDONLY;
 	return 0;
@@ -774,12 +748,15 @@
 
 static void erofs_fc_free(struct fs_context *fc)
 {
-	struct erofs_fs_context *ctx = fc->fs_private;
+	struct erofs_sb_info *sbi = fc->s_fs_info;
 
-	erofs_free_dev_context(ctx->devs);
-	kfree(ctx->fsid);
-	kfree(ctx->domain_id);
-	kfree(ctx);
+	if (!sbi)
+		return;
+
+	erofs_free_dev_context(sbi->devs);
+	kfree(sbi->fsid);
+	kfree(sbi->domain_id);
+	kfree(sbi);
 }
 
 static const struct fs_context_operations erofs_context_ops = {
@@ -789,56 +766,37 @@
 	.free		= erofs_fc_free,
 };
 
-static const struct fs_context_operations erofs_anon_context_ops = {
-	.get_tree       = erofs_fc_anon_get_tree,
-};
-
 static int erofs_init_fs_context(struct fs_context *fc)
 {
-	struct erofs_fs_context *ctx;
-
-	/* pseudo mount for anon inodes */
-	if (fc->sb_flags & SB_KERNMOUNT) {
-		fc->ops = &erofs_anon_context_ops;
-		return 0;
-	}
+	struct erofs_sb_info *sbi;
 
-	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
-	if (!ctx)
+	sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
+	if (!sbi)
 		return -ENOMEM;
-	ctx->devs = kzalloc(sizeof(struct erofs_dev_context), GFP_KERNEL);
-	if (!ctx->devs) {
-		kfree(ctx);
+
+	sbi->devs = kzalloc(sizeof(struct erofs_dev_context), GFP_KERNEL);
+	if (!sbi->devs) {
+		kfree(sbi);
 		return -ENOMEM;
 	}
-	fc->fs_private = ctx;
+	fc->s_fs_info = sbi;
 
-	idr_init(&ctx->devs->tree);
-	init_rwsem(&ctx->devs->rwsem);
-	erofs_default_options(ctx);
+	idr_init(&sbi->devs->tree);
+	init_rwsem(&sbi->devs->rwsem);
+	erofs_default_options(sbi);
 	fc->ops = &erofs_context_ops;
 	return 0;
 }
 
 static void erofs_kill_sb(struct super_block *sb)
 {
-	struct erofs_sb_info *sbi;
-
-	/* pseudo mount for anon inodes */
-	if (sb->s_flags & SB_KERNMOUNT) {
-		kill_anon_super(sb);
-		return;
-	}
+	struct erofs_sb_info *sbi = EROFS_SB(sb);
 
-	if (erofs_is_fscache_mode(sb))
+	if (IS_ENABLED(CONFIG_EROFS_FS_ONDEMAND) && sbi->fsid)
 		kill_anon_super(sb);
 	else
 		kill_block_super(sb);
 
-	sbi = EROFS_SB(sb);
-	if (!sbi)
-		return;
-
 	erofs_free_dev_context(sbi->devs);
 	fs_put_dax(sbi->dax_dev, NULL);
 	erofs_fscache_unregister_fs(sb);
@@ -868,7 +826,7 @@
 	erofs_fscache_unregister_fs(sb);
 }
 
-struct file_system_type erofs_fs_type = {
+static struct file_system_type erofs_fs_type = {
 	.owner          = THIS_MODULE,
 	.name           = "erofs",
 	.init_fs_context = erofs_init_fs_context,
--- linux-qcom-6.8.0.orig/fs/erofs/zdata.c
+++ linux-qcom-6.8.0/fs/erofs/zdata.c
@@ -1472,11 +1472,7 @@
 	}
 
 	lock_page(page);
-	/* only true if page reclaim goes wrong, should never happen */
-	DBG_BUGON(justfound && PagePrivate(page));
-
-	/* the cached page is still in managed cache */
-	if (page->mapping == mc) {
+	if (likely(page->mapping == mc)) {
 		/*
 		 * The cached page is still available but without a valid
 		 * `->private` pcluster hint.  Let's reconnect them.
@@ -1487,23 +1483,23 @@
 			attach_page_private(page, pcl);
 			put_page(page);
 		}
-
-		/* no need to submit if it is already up-to-date */
-		if (PageUptodate(page)) {
-			unlock_page(page);
-			bvec->bv_page = NULL;
+		if (likely(page->private == (unsigned long)pcl))  {
+			/* don't submit cache I/Os again if already uptodate */
+			if (PageUptodate(page)) {
+				unlock_page(page);
+				bvec->bv_page = NULL;
+			}
+			return;
 		}
-		return;
+		/*
+		 * Already linked with another pcluster, which only appears in
+		 * crafted images by fuzzers for now.  But handle this anyway.
+		 */
+		tocache = false;	/* use temporary short-lived pages */
+	} else {
+		DBG_BUGON(1); /* referenced managed folios can't be truncated */
+		tocache = true;
 	}
-
-	/*
-	 * It has been truncated, so it's unsafe to reuse this one. Let's
-	 * allocate a new page for compressed data.
-	 */
-	DBG_BUGON(page->mapping);
-	DBG_BUGON(!justfound);
-
-	tocache = true;
 	unlock_page(page);
 	put_page(page);
 out_allocpage:
@@ -1659,13 +1655,10 @@
 		cur = mdev.m_pa;
 		end = cur + pcl->pclustersize;
 		do {
-			z_erofs_fill_bio_vec(&bvec, f, pcl, i++, mc);
-			if (!bvec.bv_page)
-				continue;
-
+			bvec.bv_page = NULL;
 			if (bio && (cur != last_pa ||
 				    last_bdev != mdev.m_bdev)) {
-submit_bio_retry:
+drain_io:
 				submit_bio(bio);
 				if (memstall) {
 					psi_memstall_leave(&pflags);
@@ -1674,6 +1667,15 @@
 				bio = NULL;
 			}
 
+			if (!bvec.bv_page) {
+				z_erofs_fill_bio_vec(&bvec, f, pcl, i++, mc);
+				if (!bvec.bv_page)
+					continue;
+				if (cur + bvec.bv_len > end)
+					bvec.bv_len = end - cur;
+				DBG_BUGON(bvec.bv_len < sb->s_blocksize);
+			}
+
 			if (unlikely(PageWorkingset(bvec.bv_page)) &&
 			    !memstall) {
 				psi_memstall_enter(&pflags);
@@ -1692,12 +1694,9 @@
 				last_bdev = mdev.m_bdev;
 			}
 
-			if (cur + bvec.bv_len > end)
-				bvec.bv_len = end - cur;
-			DBG_BUGON(bvec.bv_len < sb->s_blocksize);
 			if (!bio_add_page(bio, bvec.bv_page, bvec.bv_len,
 					  bvec.bv_offset))
-				goto submit_bio_retry;
+				goto drain_io;
 
 			last_pa = cur + bvec.bv_len;
 			bypass = false;
@@ -1709,11 +1708,10 @@
 			move_to_bypass_jobqueue(pcl, qtail, owned_head);
 	} while (owned_head != Z_EROFS_PCLUSTER_TAIL);
 
-	if (bio) {
+	if (bio)
 		submit_bio(bio);
-		if (memstall)
-			psi_memstall_leave(&pflags);
-	}
+	if (memstall)
+		psi_memstall_leave(&pflags);
 
 	/*
 	 * although background is preferred, no one is pending for submission.
--- linux-qcom-6.8.0.orig/fs/erofs/zmap.c
+++ linux-qcom-6.8.0/fs/erofs/zmap.c
@@ -234,7 +234,7 @@
 	unsigned int amortizedshift;
 	erofs_off_t pos;
 
-	if (lcn >= totalidx)
+	if (lcn >= totalidx || vi->z_logical_clusterbits > 14)
 		return -EINVAL;
 
 	m->lcn = lcn;
@@ -409,7 +409,7 @@
 	u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits;
 	int err;
 
-	do {
+	while (1) {
 		/* handle the last EOF pcluster (no next HEAD lcluster) */
 		if ((lcn << lclusterbits) >= inode->i_size) {
 			map->m_llen = inode->i_size - map->m_la;
@@ -421,14 +421,16 @@
 			return err;
 
 		if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) {
-			DBG_BUGON(!m->delta[1] &&
-				  m->clusterofs != 1 << lclusterbits);
+			/* work around invalid d1 generated by pre-1.0 mkfs */
+			if (unlikely(!m->delta[1])) {
+				m->delta[1] = 1;
+				DBG_BUGON(1);
+			}
 		} else if (m->type == Z_EROFS_LCLUSTER_TYPE_PLAIN ||
 			   m->type == Z_EROFS_LCLUSTER_TYPE_HEAD1 ||
 			   m->type == Z_EROFS_LCLUSTER_TYPE_HEAD2) {
-			/* go on until the next HEAD lcluster */
 			if (lcn != headlcn)
-				break;
+				break;	/* ends at the next HEAD lcluster */
 			m->delta[1] = 1;
 		} else {
 			erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu",
@@ -437,8 +439,7 @@
 			return -EOPNOTSUPP;
 		}
 		lcn += m->delta[1];
-	} while (m->delta[1]);
-
+	}
 	map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la;
 	return 0;
 }
@@ -723,6 +724,8 @@
 
 	err = z_erofs_do_map_blocks(inode, map, flags);
 out:
+	if (err)
+		map->m_llen = 0;
 	trace_z_erofs_map_blocks_iter_exit(inode, map, flags, err);
 	return err;
 }
--- linux-qcom-6.8.0.orig/fs/eventpoll.c
+++ linux-qcom-6.8.0/fs/eventpoll.c
@@ -740,7 +740,8 @@
 	to_free = NULL;
 	head = file->f_ep;
 	if (head->first == &epi->fllink && !epi->fllink.next) {
-		file->f_ep = NULL;
+		/* See eventpoll_release() for details. */
+		WRITE_ONCE(file->f_ep, NULL);
 		if (!is_file_epoll(file)) {
 			struct epitems_head *v;
 			v = container_of(head, struct epitems_head, epitems);
@@ -876,6 +877,34 @@
 }
 
 /*
+ * The ffd.file pointer may be in the process of being torn down due to
+ * being closed, but we may not have finished eventpoll_release() yet.
+ *
+ * Normally, even with the atomic_long_inc_not_zero, the file may have
+ * been free'd and then gotten re-allocated to something else (since
+ * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU).
+ *
+ * But for epoll, users hold the ep->mtx mutex, and as such any file in
+ * the process of being free'd will block in eventpoll_release_file()
+ * and thus the underlying file allocation will not be free'd, and the
+ * file re-use cannot happen.
+ *
+ * For the same reason we can avoid a rcu_read_lock() around the
+ * operation - 'ffd.file' cannot go away even if the refcount has
+ * reached zero (but we must still not call out to ->poll() functions
+ * etc).
+ */
+static struct file *epi_fget(const struct epitem *epi)
+{
+	struct file *file;
+
+	file = epi->ffd.file;
+	if (!atomic_long_inc_not_zero(&file->f_count))
+		file = NULL;
+	return file;
+}
+
+/*
  * Differs from ep_eventpoll_poll() in that internal callers already have
  * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested()
  * is correctly annotated.
@@ -883,14 +912,22 @@
 static __poll_t ep_item_poll(const struct epitem *epi, poll_table *pt,
 				 int depth)
 {
-	struct file *file = epi->ffd.file;
+	struct file *file = epi_fget(epi);
 	__poll_t res;
 
+	/*
+	 * We could return EPOLLERR | EPOLLHUP or something, but let's
+	 * treat this more as "file doesn't exist, poll didn't happen".
+	 */
+	if (!file)
+		return 0;
+
 	pt->_key = epi->event.events;
 	if (!is_file_epoll(file))
 		res = vfs_poll(file, pt);
 	else
 		res = __ep_eventpoll_poll(file, pt, depth);
+	fput(file);
 	return res & epi->event.events;
 }
 
@@ -1230,7 +1267,10 @@
 				break;
 			}
 		}
-		wake_up(&ep->wq);
+		if (sync)
+			wake_up_sync(&ep->wq);
+		else
+			wake_up(&ep->wq);
 	}
 	if (waitqueue_active(&ep->poll_wait))
 		pwake++;
@@ -1461,7 +1501,8 @@
 			spin_unlock(&file->f_lock);
 			goto allocate;
 		}
-		file->f_ep = head;
+		/* See eventpoll_release() for details. */
+		WRITE_ONCE(file->f_ep, head);
 		to_free = NULL;
 	}
 	hlist_add_head_rcu(&epi->fllink, file->f_ep);
--- linux-qcom-6.8.0.orig/fs/exec.c
+++ linux-qcom-6.8.0/fs/exec.c
@@ -67,6 +67,7 @@
 #include <linux/time_namespace.h>
 #include <linux/user_events.h>
 #include <linux/rseq.h>
+#include <linux/ksm.h>
 
 #include <linux/uaccess.h>
 #include <asm/mmu_context.h>
@@ -144,13 +145,11 @@
 		goto out;
 
 	/*
-	 * may_open() has already checked for this, so it should be
-	 * impossible to trip now. But we need to be extra cautious
-	 * and check again at the very end too.
+	 * Check do_open_execat() for an explanation.
 	 */
 	error = -EACCES;
-	if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) ||
-			 path_noexec(&file->f_path)))
+	if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) ||
+	    path_noexec(&file->f_path))
 		goto exit;
 
 	error = -ENOEXEC;
@@ -268,6 +267,14 @@
 	}
 
 	/*
+	 * Need to be called with mmap write lock
+	 * held, to avoid race with ksmd.
+	 */
+	err = ksm_execve(mm);
+	if (err)
+		goto err_ksm;
+
+	/*
 	 * Place the stack at the largest stack address the architecture
 	 * supports. Later, we'll move this to an appropriate place. We don't
 	 * use STACK_TOP because that can depend on attributes which aren't
@@ -288,6 +295,8 @@
 	bprm->p = vma->vm_end - sizeof(void *);
 	return 0;
 err:
+	ksm_exit(mm);
+err_ksm:
 	mmap_write_unlock(mm);
 err_free:
 	bprm->vma = NULL;
@@ -771,7 +780,8 @@
 	stack_base = calc_max_stack_size(stack_base);
 
 	/* Add space for stack randomization. */
-	stack_base += (STACK_RND_MASK << PAGE_SHIFT);
+	if (current->flags & PF_RANDOMIZE)
+		stack_base += (STACK_RND_MASK << PAGE_SHIFT);
 
 	/* Make sure we didn't let the argument array grow too large. */
 	if (vma->vm_end - vma->vm_start > stack_base)
@@ -895,6 +905,7 @@
 			goto out;
 	}
 
+	bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;
 	*sp_location = sp;
 
 out:
@@ -928,23 +939,22 @@
 
 	file = do_filp_open(fd, name, &open_exec_flags);
 	if (IS_ERR(file))
-		goto out;
+		return file;
 
 	/*
-	 * may_open() has already checked for this, so it should be
-	 * impossible to trip now. But we need to be extra cautious
-	 * and check again at the very end too.
+	 * In the past the regular type check was here. It moved to may_open() in
+	 * 633fb6ac3980 ("exec: move S_ISREG() check earlier"). Since then it is
+	 * an invariant that all non-regular files error out before we get here.
 	 */
 	err = -EACCES;
-	if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) ||
-			 path_noexec(&file->f_path)))
+	if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) ||
+	    path_noexec(&file->f_path))
 		goto exit;
 
 	err = deny_write_access(file);
 	if (err)
 		goto exit;
 
-out:
 	return file;
 
 exit:
@@ -1649,6 +1659,7 @@
 	unsigned int mode;
 	vfsuid_t vfsuid;
 	vfsgid_t vfsgid;
+	int err;
 
 	if (!mnt_may_suid(file->f_path.mnt))
 		return;
@@ -1665,12 +1676,17 @@
 	/* Be careful if suid/sgid is set */
 	inode_lock(inode);
 
-	/* reload atomically mode/uid/gid now that lock held */
+	/* Atomically reload and check mode/uid/gid now that lock held. */
 	mode = inode->i_mode;
 	vfsuid = i_uid_into_vfsuid(idmap, inode);
 	vfsgid = i_gid_into_vfsgid(idmap, inode);
+	err = inode_permission(idmap, inode, MAY_EXEC);
 	inode_unlock(inode);
 
+	/* Did the exec bit vanish out from under us? Give up. */
+	if (err)
+		return;
+
 	/* We ignore suid/sgid if there are no mappings for them in the ns */
 	if (!vfsuid_has_mapping(bprm->cred->user_ns, vfsuid) ||
 	    !vfsgid_has_mapping(bprm->cred->user_ns, vfsgid))
--- linux-qcom-6.8.0.orig/fs/exfat/balloc.c
+++ linux-qcom-6.8.0/fs/exfat/balloc.c
@@ -91,11 +91,8 @@
 				return -EIO;
 
 			type = exfat_get_entry_type(ep);
-			if (type == TYPE_UNUSED)
-				break;
-			if (type != TYPE_BITMAP)
-				continue;
-			if (ep->dentry.bitmap.flags == 0x0) {
+			if (type == TYPE_BITMAP &&
+			    ep->dentry.bitmap.flags == 0x0) {
 				int err;
 
 				err = exfat_allocate_bitmap(sb, ep);
@@ -103,6 +100,9 @@
 				return err;
 			}
 			brelse(bh);
+
+			if (type == TYPE_UNUSED)
+				return -EINVAL;
 		}
 
 		if (exfat_get_next_cluster(sb, &clu.dir))
--- linux-qcom-6.8.0.orig/fs/exfat/dir.c
+++ linux-qcom-6.8.0/fs/exfat/dir.c
@@ -125,7 +125,7 @@
 			type = exfat_get_entry_type(ep);
 			if (type == TYPE_UNUSED) {
 				brelse(bh);
-				break;
+				goto out;
 			}
 
 			if (type != TYPE_FILE && type != TYPE_DIR) {
@@ -189,6 +189,7 @@
 		}
 	}
 
+out:
 	dir_entry->namebuf.lfn[0] = '\0';
 	*cpos = EXFAT_DEN_TO_B(dentry);
 	return 0;
@@ -890,7 +891,7 @@
 
 	num_bh = EXFAT_B_TO_BLK_ROUND_UP(off + num_entries * DENTRY_SIZE, sb);
 	if (num_bh > ARRAY_SIZE(es->__bh)) {
-		es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_KERNEL);
+		es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_NOFS);
 		if (!es->bh) {
 			brelse(bh);
 			return -ENOMEM;
--- linux-qcom-6.8.0.orig/fs/exfat/fatent.c
+++ linux-qcom-6.8.0/fs/exfat/fatent.c
@@ -216,6 +216,16 @@
 
 			if (err)
 				goto dec_used_clus;
+
+			if (num_clusters >= sbi->num_clusters - EXFAT_FIRST_CLUSTER) {
+				/*
+				 * The cluster chain includes a loop, scan the
+				 * bitmap to get the number of used clusters.
+				 */
+				exfat_count_used_clusters(sb, &sbi->used_clusters);
+
+				return 0;
+			}
 		} while (clu != EXFAT_EOF_CLUSTER);
 	}
 
--- linux-qcom-6.8.0.orig/fs/exfat/file.c
+++ linux-qcom-6.8.0/fs/exfat/file.c
@@ -51,7 +51,7 @@
 	clu.flags = ei->flags;
 
 	ret = exfat_alloc_cluster(inode, new_num_clusters - num_clusters,
-			&clu, IS_DIRSYNC(inode));
+			&clu, inode_needs_sync(inode));
 	if (ret)
 		return ret;
 
@@ -77,12 +77,11 @@
 	ei->i_size_aligned = round_up(size, sb->s_blocksize);
 	ei->i_size_ondisk = ei->i_size_aligned;
 	inode->i_blocks = round_up(size, sbi->cluster_size) >> 9;
+	mark_inode_dirty(inode);
 
-	if (IS_DIRSYNC(inode))
+	if (IS_SYNC(inode))
 		return write_inode_now(inode, 1);
 
-	mark_inode_dirty(inode);
-
 	return 0;
 
 free_clu:
@@ -575,6 +574,16 @@
 	if (ret < 0)
 		goto unlock;
 
+	if (iocb->ki_flags & IOCB_DIRECT) {
+		unsigned long align = pos | iov_iter_alignment(iter);
+
+		if (!IS_ALIGNED(align, i_blocksize(inode)) &&
+		    !IS_ALIGNED(align, bdev_logical_block_size(inode->i_sb->s_bdev))) {
+			ret = -EINVAL;
+			goto unlock;
+		}
+	}
+
 	if (pos > valid_size) {
 		ret = exfat_file_zeroed_range(file, valid_size, pos);
 		if (ret < 0 && ret != -ENOSPC) {
--- linux-qcom-6.8.0.orig/fs/exfat/namei.c
+++ linux-qcom-6.8.0/fs/exfat/namei.c
@@ -377,6 +377,7 @@
 		if (ei->start_clu == EXFAT_EOF_CLUSTER) {
 			ei->start_clu = clu.dir;
 			p_dir->dir = clu.dir;
+			hint_femp.eidx = 0;
 		}
 
 		/* append to the FAT chain */
@@ -665,14 +666,26 @@
 	info->size = le64_to_cpu(ep2->dentry.stream.valid_size);
 	info->valid_size = le64_to_cpu(ep2->dentry.stream.valid_size);
 	info->size = le64_to_cpu(ep2->dentry.stream.size);
+
+	info->start_clu = le32_to_cpu(ep2->dentry.stream.start_clu);
+	if (!is_valid_cluster(sbi, info->start_clu) && info->size) {
+		exfat_warn(sb, "start_clu is invalid cluster(0x%x)",
+				info->start_clu);
+		info->size = 0;
+		info->valid_size = 0;
+	}
+
+	if (info->valid_size > info->size) {
+		exfat_warn(sb, "valid_size(%lld) is greater than size(%lld)",
+				info->valid_size, info->size);
+		info->valid_size = info->size;
+	}
+
 	if (info->size == 0) {
 		info->flags = ALLOC_NO_FAT_CHAIN;
 		info->start_clu = EXFAT_EOF_CLUSTER;
-	} else {
+	} else
 		info->flags = ep2->dentry.stream.flags;
-		info->start_clu =
-			le32_to_cpu(ep2->dentry.stream.start_clu);
-	}
 
 	exfat_get_entry_time(sbi, &info->crtime,
 			     ep->dentry.file.create_tz,
--- linux-qcom-6.8.0.orig/fs/exfat/nls.c
+++ linux-qcom-6.8.0/fs/exfat/nls.c
@@ -779,8 +779,11 @@
 				le32_to_cpu(ep->dentry.upcase.checksum));
 
 			brelse(bh);
-			if (ret && ret != -EIO)
+			if (ret && ret != -EIO) {
+				/* free memory from exfat_load_upcase_table call */
+				exfat_free_upcase_table(sbi);
 				goto load_default;
+			}
 
 			/* load successfully */
 			return ret;
--- linux-qcom-6.8.0.orig/fs/ext2/balloc.c
+++ linux-qcom-6.8.0/fs/ext2/balloc.c
@@ -77,26 +77,33 @@
 	ext2_grpblk_t next_zero_bit;
 	ext2_fsblk_t bitmap_blk;
 	ext2_fsblk_t group_first_block;
+	ext2_grpblk_t max_bit;
 
 	group_first_block = ext2_group_first_block_no(sb, block_group);
+	max_bit = ext2_group_last_block_no(sb, block_group) - group_first_block;
 
 	/* check whether block bitmap block number is set */
 	bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
 	offset = bitmap_blk - group_first_block;
-	if (!ext2_test_bit(offset, bh->b_data))
+	if (offset < 0 || offset > max_bit ||
+	    !ext2_test_bit(offset, bh->b_data))
 		/* bad block bitmap */
 		goto err_out;
 
 	/* check whether the inode bitmap block number is set */
 	bitmap_blk = le32_to_cpu(desc->bg_inode_bitmap);
 	offset = bitmap_blk - group_first_block;
-	if (!ext2_test_bit(offset, bh->b_data))
+	if (offset < 0 || offset > max_bit ||
+	    !ext2_test_bit(offset, bh->b_data))
 		/* bad block bitmap */
 		goto err_out;
 
 	/* check whether the inode table block number is set */
 	bitmap_blk = le32_to_cpu(desc->bg_inode_table);
 	offset = bitmap_blk - group_first_block;
+	if (offset < 0 || offset > max_bit ||
+	    offset + EXT2_SB(sb)->s_itb_per_group - 1 > max_bit)
+		goto err_out;
 	next_zero_bit = ext2_find_next_zero_bit(bh->b_data,
 				offset + EXT2_SB(sb)->s_itb_per_group,
 				offset);
--- linux-qcom-6.8.0.orig/fs/ext2/ext2.h
+++ linux-qcom-6.8.0/fs/ext2/ext2.h
@@ -674,7 +674,7 @@
 	struct inode	vfs_inode;
 	struct list_head i_orphan;	/* unlinked but open inodes */
 #ifdef CONFIG_QUOTA
-	struct dquot *i_dquot[MAXQUOTAS];
+	struct dquot __rcu *i_dquot[MAXQUOTAS];
 #endif
 };
 
--- linux-qcom-6.8.0.orig/fs/ext2/super.c
+++ linux-qcom-6.8.0/fs/ext2/super.c
@@ -320,7 +320,7 @@
 static ssize_t ext2_quota_write(struct super_block *sb, int type, const char *data, size_t len, loff_t off);
 static int ext2_quota_on(struct super_block *sb, int type, int format_id,
 			 const struct path *path);
-static struct dquot **ext2_get_dquots(struct inode *inode)
+static struct dquot __rcu **ext2_get_dquots(struct inode *inode)
 {
 	return EXT2_I(inode)->i_dquot;
 }
--- linux-qcom-6.8.0.orig/fs/ext4/balloc.c
+++ linux-qcom-6.8.0/fs/ext4/balloc.c
@@ -550,7 +550,8 @@
 	trace_ext4_read_block_bitmap_load(sb, block_group, ignore_locked);
 	ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO |
 			    (ignore_locked ? REQ_RAHEAD : 0),
-			    ext4_end_bitmap_read);
+			    ext4_end_bitmap_read,
+			    ext4_simulate_fail(sb, EXT4_SIM_BBITMAP_EIO));
 	return bh;
 verify:
 	err = ext4_validate_block_bitmap(sb, desc, block_group, bh);
@@ -577,7 +578,6 @@
 	if (!desc)
 		return -EFSCORRUPTED;
 	wait_on_buffer(bh);
-	ext4_simulate_fail_bh(sb, bh, EXT4_SIM_BBITMAP_EIO);
 	if (!buffer_uptodate(bh)) {
 		ext4_error_err(sb, EIO, "Cannot read block bitmap - "
 			       "block_group = %u, block_bitmap = %llu",
--- linux-qcom-6.8.0.orig/fs/ext4/dir.c
+++ linux-qcom-6.8.0/fs/ext4/dir.c
@@ -279,12 +279,20 @@
 					struct fscrypt_str de_name =
 							FSTR_INIT(de->name,
 								de->name_len);
+					u32 hash;
+					u32 minor_hash;
+
+					if (IS_CASEFOLDED(inode)) {
+						hash = EXT4_DIRENT_HASH(de);
+						minor_hash = EXT4_DIRENT_MINOR_HASH(de);
+					} else {
+						hash = 0;
+						minor_hash = 0;
+					}
 
 					/* Directory is encrypted */
 					err = fscrypt_fname_disk_to_usr(inode,
-						EXT4_DIRENT_HASH(de),
-						EXT4_DIRENT_MINOR_HASH(de),
-						&de_name, &fstr);
+						hash, minor_hash, &de_name, &fstr);
 					de_name = fstr;
 					fstr.len = save_len;
 					if (err)
--- linux-qcom-6.8.0.orig/fs/ext4/ext4.h
+++ linux-qcom-6.8.0/fs/ext4/ext4.h
@@ -1158,7 +1158,7 @@
 	tid_t i_datasync_tid;
 
 #ifdef CONFIG_QUOTA
-	struct dquot *i_dquot[MAXQUOTAS];
+	struct dquot __rcu *i_dquot[MAXQUOTAS];
 #endif
 
 	/* Precomputed uuid+inum+igen checksum for seeding inode checksums */
@@ -1862,14 +1862,6 @@
 	return false;
 }
 
-static inline void ext4_simulate_fail_bh(struct super_block *sb,
-					 struct buffer_head *bh,
-					 unsigned long code)
-{
-	if (!IS_ERR(bh) && ext4_simulate_fail(sb, code))
-		clear_buffer_uptodate(bh);
-}
-
 /*
  * Error number codes for s_{first,last}_error_errno
  *
@@ -2459,6 +2451,7 @@
 #define DX_HASH_HALF_MD4_UNSIGNED	4
 #define DX_HASH_TEA_UNSIGNED		5
 #define DX_HASH_SIPHASH			6
+#define DX_HASH_LAST 			DX_HASH_SIPHASH
 
 static inline u32 ext4_chksum(struct ext4_sb_info *sbi, u32 crc,
 			      const void *address, unsigned int length)
@@ -3085,9 +3078,9 @@
 extern struct buffer_head *ext4_sb_bread_unmovable(struct super_block *sb,
 						   sector_t block);
 extern void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags,
-				bh_end_io_t *end_io);
+				bh_end_io_t *end_io, bool simu_fail);
 extern int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags,
-			bh_end_io_t *end_io);
+			bh_end_io_t *end_io, bool simu_fail);
 extern int ext4_read_bh_lock(struct buffer_head *bh, blk_opf_t op_flags, bool wait);
 extern void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block);
 extern int ext4_seq_options_show(struct seq_file *seq, void *offset);
--- linux-qcom-6.8.0.orig/fs/ext4/extents.c
+++ linux-qcom-6.8.0/fs/ext4/extents.c
@@ -564,7 +564,7 @@
 
 	if (!bh_uptodate_or_lock(bh)) {
 		trace_ext4_ext_load_extent(inode, pblk, _RET_IP_);
-		err = ext4_read_bh(bh, 0, NULL);
+		err = ext4_read_bh(bh, 0, NULL, false);
 		if (err < 0)
 			goto errout;
 	}
@@ -957,6 +957,8 @@
 
 	ext4_ext_show_path(inode, path);
 
+	if (orig_path)
+		*orig_path = path;
 	return path;
 
 err:
@@ -1877,6 +1879,7 @@
 	path[0].p_hdr->eh_max = cpu_to_le16(max_root);
 
 	brelse(path[1].p_bh);
+	path[1].p_bh = NULL;
 	ext4_free_blocks(handle, inode, NULL, blk, 1,
 			 EXT4_FREE_BLOCKS_METADATA | EXT4_FREE_BLOCKS_FORGET);
 }
@@ -2103,6 +2106,7 @@
 				       ppath, newext);
 	if (err)
 		goto cleanup;
+	path = *ppath;
 	depth = ext_depth(inode);
 	eh = path[depth].p_hdr;
 
@@ -3230,6 +3234,24 @@
 	if (err != -ENOSPC && err != -EDQUOT && err != -ENOMEM)
 		goto out;
 
+	/*
+	 * Update path is required because previous ext4_ext_insert_extent()
+	 * may have freed or reallocated the path. Using EXT4_EX_NOFAIL
+	 * guarantees that ext4_find_extent() will not return -ENOMEM,
+	 * otherwise -ENOMEM will cause a retry in do_writepages(), and a
+	 * WARN_ON may be triggered in ext4_da_update_reserve_space() due to
+	 * an incorrect ee_len causing the i_reserved_data_blocks exception.
+	 */
+	path = ext4_find_extent(inode, ee_block, ppath,
+				flags | EXT4_EX_NOFAIL);
+	if (IS_ERR(path)) {
+		EXT4_ERROR_INODE(inode, "Failed split extent on %u, err %ld",
+				 split, PTR_ERR(path));
+		return PTR_ERR(path);
+	}
+	depth = ext_depth(inode);
+	ex = path[depth].p_ext;
+
 	if (EXT4_EXT_MAY_ZEROOUT & split_flag) {
 		if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) {
 			if (split_flag & EXT4_EXT_DATA_VALID1) {
@@ -3282,12 +3304,12 @@
 	ext4_ext_dirty(handle, inode, path + path->p_depth);
 	return err;
 out:
-	ext4_ext_show_leaf(inode, path);
+	ext4_ext_show_leaf(inode, *ppath);
 	return err;
 }
 
 /*
- * ext4_split_extents() splits an extent and mark extent which is covered
+ * ext4_split_extent() splits an extent and mark extent which is covered
  * by @map as split_flags indicates
  *
  * It may result in splitting the extent into multiple extents (up to three)
@@ -3363,7 +3385,7 @@
 			goto out;
 	}
 
-	ext4_ext_show_leaf(inode, path);
+	ext4_ext_show_leaf(inode, *ppath);
 out:
 	return err ? err : allocated;
 }
@@ -3402,9 +3424,10 @@
 	struct ext4_extent *ex, *abut_ex;
 	ext4_lblk_t ee_block, eof_block;
 	unsigned int ee_len, depth, map_len = map->m_len;
-	int allocated = 0, max_zeroout = 0;
 	int err = 0;
 	int split_flag = EXT4_EXT_DATA_VALID2;
+	int allocated = 0;
+	unsigned int max_zeroout = 0;
 
 	ext_debug(inode, "logical block %llu, max_blocks %u\n",
 		  (unsigned long long)map->m_lblk, map_len);
@@ -3827,14 +3850,13 @@
 			struct ext4_ext_path **ppath, int flags,
 			unsigned int allocated, ext4_fsblk_t newblock)
 {
-	struct ext4_ext_path __maybe_unused *path = *ppath;
 	int ret = 0;
 	int err = 0;
 
 	ext_debug(inode, "logical block %llu, max_blocks %u, flags 0x%x, allocated %u\n",
 		  (unsigned long long)map->m_lblk, map->m_len, flags,
 		  allocated);
-	ext4_ext_show_leaf(inode, path);
+	ext4_ext_show_leaf(inode, *ppath);
 
 	/*
 	 * When writing into unwritten space, we should not fail to
@@ -3931,7 +3953,7 @@
 	if (allocated > map->m_len)
 		allocated = map->m_len;
 	map->m_len = allocated;
-	ext4_ext_show_leaf(inode, path);
+	ext4_ext_show_leaf(inode, *ppath);
 out2:
 	return err ? err : allocated;
 }
@@ -4456,7 +4478,7 @@
 	int depth = 0;
 	struct ext4_map_blocks map;
 	unsigned int credits;
-	loff_t epos;
+	loff_t epos, old_size = i_size_read(inode);
 
 	BUG_ON(!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS));
 	map.m_lblk = offset;
@@ -4515,6 +4537,11 @@
 			if (ext4_update_inode_size(inode, epos) & 0x1)
 				inode_set_mtime_to_ts(inode,
 						      inode_get_ctime(inode));
+			if (epos > old_size) {
+				pagecache_isize_extended(inode, old_size, epos);
+				ext4_zero_partial_blocks(handle, inode,
+						     old_size, epos - old_size);
+			}
 		}
 		ret2 = ext4_mark_inode_dirty(handle, inode);
 		ext4_update_inode_fsync_trans(handle, inode, 1);
@@ -5534,6 +5561,7 @@
 	path = ext4_find_extent(inode, offset_lblk, NULL, 0);
 	if (IS_ERR(path)) {
 		up_write(&EXT4_I(inode)->i_data_sem);
+		ret = PTR_ERR(path);
 		goto out_stop;
 	}
 
@@ -5879,7 +5907,7 @@
 int ext4_ext_replay_update_ex(struct inode *inode, ext4_lblk_t start,
 			      int len, int unwritten, ext4_fsblk_t pblk)
 {
-	struct ext4_ext_path *path = NULL, *ppath;
+	struct ext4_ext_path *path;
 	struct ext4_extent *ex;
 	int ret;
 
@@ -5895,30 +5923,29 @@
 	if (le32_to_cpu(ex->ee_block) != start ||
 		ext4_ext_get_actual_len(ex) != len) {
 		/* We need to split this extent to match our extent first */
-		ppath = path;
 		down_write(&EXT4_I(inode)->i_data_sem);
-		ret = ext4_force_split_extent_at(NULL, inode, &ppath, start, 1);
+		ret = ext4_force_split_extent_at(NULL, inode, &path, start, 1);
 		up_write(&EXT4_I(inode)->i_data_sem);
 		if (ret)
 			goto out;
-		kfree(path);
-		path = ext4_find_extent(inode, start, NULL, 0);
+
+		path = ext4_find_extent(inode, start, &path, 0);
 		if (IS_ERR(path))
-			return -1;
-		ppath = path;
+			return PTR_ERR(path);
 		ex = path[path->p_depth].p_ext;
 		WARN_ON(le32_to_cpu(ex->ee_block) != start);
+
 		if (ext4_ext_get_actual_len(ex) != len) {
 			down_write(&EXT4_I(inode)->i_data_sem);
-			ret = ext4_force_split_extent_at(NULL, inode, &ppath,
+			ret = ext4_force_split_extent_at(NULL, inode, &path,
 							 start + len, 1);
 			up_write(&EXT4_I(inode)->i_data_sem);
 			if (ret)
 				goto out;
-			kfree(path);
-			path = ext4_find_extent(inode, start, NULL, 0);
+
+			path = ext4_find_extent(inode, start, &path, 0);
 			if (IS_ERR(path))
-				return -EINVAL;
+				return PTR_ERR(path);
 			ex = path[path->p_depth].p_ext;
 		}
 	}
--- linux-qcom-6.8.0.orig/fs/ext4/extents_status.c
+++ linux-qcom-6.8.0/fs/ext4/extents_status.c
@@ -310,6 +310,8 @@
 			       ext4_lblk_t lblk, ext4_lblk_t end,
 			       struct extent_status *es)
 {
+	es->es_lblk = es->es_len = es->es_pblk = 0;
+
 	if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
 		return;
 
--- linux-qcom-6.8.0.orig/fs/ext4/fast_commit.c
+++ linux-qcom-6.8.0/fs/ext4/fast_commit.c
@@ -339,22 +339,29 @@
 {
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	tid_t tid;
+	bool has_transaction = true;
+	bool is_ineligible;
 
 	if (ext4_fc_disabled(sb))
 		return;
 
-	ext4_set_mount_flag(sb, EXT4_MF_FC_INELIGIBLE);
 	if (handle && !IS_ERR(handle))
 		tid = handle->h_transaction->t_tid;
 	else {
 		read_lock(&sbi->s_journal->j_state_lock);
-		tid = sbi->s_journal->j_running_transaction ?
-				sbi->s_journal->j_running_transaction->t_tid : 0;
+		if (sbi->s_journal->j_running_transaction)
+			tid = sbi->s_journal->j_running_transaction->t_tid;
+		else
+			has_transaction = false;
 		read_unlock(&sbi->s_journal->j_state_lock);
 	}
 	spin_lock(&sbi->s_fc_lock);
-	if (sbi->s_fc_ineligible_tid < tid)
+	is_ineligible = ext4_test_mount_flag(sb, EXT4_MF_FC_INELIGIBLE);
+	if (has_transaction &&
+	    (!is_ineligible ||
+	     (is_ineligible && tid_gt(tid, sbi->s_fc_ineligible_tid))))
 		sbi->s_fc_ineligible_tid = tid;
+	ext4_set_mount_flag(sb, EXT4_MF_FC_INELIGIBLE);
 	spin_unlock(&sbi->s_fc_lock);
 	WARN_ON(reason >= EXT4_FC_REASON_MAX);
 	sbi->s_fc_stats.fc_ineligible_reason_count[reason]++;
@@ -372,7 +379,7 @@
  */
 static int ext4_fc_track_template(
 	handle_t *handle, struct inode *inode,
-	int (*__fc_track_fn)(struct inode *, void *, bool),
+	int (*__fc_track_fn)(handle_t *handle, struct inode *, void *, bool),
 	void *args, int enqueue)
 {
 	bool update = false;
@@ -389,7 +396,7 @@
 		ext4_fc_reset_inode(inode);
 		ei->i_sync_tid = tid;
 	}
-	ret = __fc_track_fn(inode, args, update);
+	ret = __fc_track_fn(handle, inode, args, update);
 	mutex_unlock(&ei->i_fc_lock);
 
 	if (!enqueue)
@@ -413,7 +420,8 @@
 };
 
 /* __track_fn for directory entry updates. Called with ei->i_fc_lock. */
-static int __track_dentry_update(struct inode *inode, void *arg, bool update)
+static int __track_dentry_update(handle_t *handle, struct inode *inode,
+				 void *arg, bool update)
 {
 	struct ext4_fc_dentry_update *node;
 	struct ext4_inode_info *ei = EXT4_I(inode);
@@ -428,14 +436,14 @@
 
 	if (IS_ENCRYPTED(dir)) {
 		ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_ENCRYPTED_FILENAME,
-					NULL);
+					handle);
 		mutex_lock(&ei->i_fc_lock);
 		return -EOPNOTSUPP;
 	}
 
 	node = kmem_cache_alloc(ext4_fc_dentry_cachep, GFP_NOFS);
 	if (!node) {
-		ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_NOMEM, NULL);
+		ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_NOMEM, handle);
 		mutex_lock(&ei->i_fc_lock);
 		return -ENOMEM;
 	}
@@ -447,7 +455,7 @@
 		node->fcd_name.name = kmalloc(dentry->d_name.len, GFP_NOFS);
 		if (!node->fcd_name.name) {
 			kmem_cache_free(ext4_fc_dentry_cachep, node);
-			ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_NOMEM, NULL);
+			ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_NOMEM, handle);
 			mutex_lock(&ei->i_fc_lock);
 			return -ENOMEM;
 		}
@@ -569,7 +577,8 @@
 }
 
 /* __track_fn for inode tracking */
-static int __track_inode(struct inode *inode, void *arg, bool update)
+static int __track_inode(handle_t *handle, struct inode *inode, void *arg,
+			 bool update)
 {
 	if (update)
 		return -EEXIST;
@@ -607,7 +616,8 @@
 };
 
 /* __track_fn for tracking data updates */
-static int __track_range(struct inode *inode, void *arg, bool update)
+static int __track_range(handle_t *handle, struct inode *inode, void *arg,
+			 bool update)
 {
 	struct ext4_inode_info *ei = EXT4_I(inode);
 	ext4_lblk_t oldstart;
@@ -649,6 +659,12 @@
 	if (ext4_test_mount_flag(inode->i_sb, EXT4_MF_FC_INELIGIBLE))
 		return;
 
+	if (ext4_has_inline_data(inode)) {
+		ext4_fc_mark_ineligible(inode->i_sb, EXT4_FC_REASON_XATTR,
+					handle);
+		return;
+	}
+
 	args.start = start;
 	args.end = end;
 
@@ -1207,7 +1223,7 @@
 	if (ret == -EALREADY) {
 		/* There was an ongoing commit, check if we need to restart */
 		if (atomic_read(&sbi->s_fc_subtid) <= subtid &&
-			commit_tid > journal->j_commit_sequence)
+		    tid_gt(commit_tid, journal->j_commit_sequence))
 			goto restart_fc;
 		ext4_fc_update_stats(sb, EXT4_FC_STATUS_SKIPPED, 0, 0,
 				commit_tid);
@@ -1282,8 +1298,21 @@
 		list_del_init(&iter->i_fc_list);
 		ext4_clear_inode_state(&iter->vfs_inode,
 				       EXT4_STATE_FC_COMMITTING);
-		if (iter->i_sync_tid <= tid)
+		if (tid_geq(tid, iter->i_sync_tid)) {
 			ext4_fc_reset_inode(&iter->vfs_inode);
+		} else if (full) {
+			/*
+			 * We are called after a full commit, inode has been
+			 * modified while the commit was running. Re-enqueue
+			 * the inode into STAGING, which will then be splice
+			 * back into MAIN. This cannot happen during
+			 * fastcommit because the journal is locked all the
+			 * time in that case (and tid doesn't increase so
+			 * tid check above isn't reliable).
+			 */
+			list_add_tail(&EXT4_I(&iter->vfs_inode)->i_fc_list,
+				      &sbi->s_fc_q[FC_Q_STAGING]);
+		}
 		/* Make sure EXT4_STATE_FC_COMMITTING bit is clear */
 		smp_mb();
 #if (BITS_PER_LONG < 64)
@@ -1313,7 +1342,7 @@
 	list_splice_init(&sbi->s_fc_q[FC_Q_STAGING],
 				&sbi->s_fc_q[FC_Q_MAIN]);
 
-	if (tid >= sbi->s_fc_ineligible_tid) {
+	if (tid_geq(tid, sbi->s_fc_ineligible_tid)) {
 		sbi->s_fc_ineligible_tid = 0;
 		ext4_clear_mount_flag(sb, EXT4_MF_FC_INELIGIBLE);
 	}
--- linux-qcom-6.8.0.orig/fs/ext4/file.c
+++ linux-qcom-6.8.0/fs/ext4/file.c
@@ -334,10 +334,10 @@
  * Clean up the inode after DIO or DAX extending write has completed and the
  * inode size has been updated using ext4_handle_inode_extension().
  */
-static void ext4_inode_extension_cleanup(struct inode *inode, ssize_t count)
+static void ext4_inode_extension_cleanup(struct inode *inode, bool need_trunc)
 {
 	lockdep_assert_held_write(&inode->i_rwsem);
-	if (count < 0) {
+	if (need_trunc) {
 		ext4_truncate_failed_write(inode);
 		/*
 		 * If the truncate operation failed early, then the inode may
@@ -586,7 +586,7 @@
 		 * writeback of delalloc blocks.
 		 */
 		WARN_ON_ONCE(ret == -EIOCBQUEUED);
-		ext4_inode_extension_cleanup(inode, ret);
+		ext4_inode_extension_cleanup(inode, ret < 0);
 	}
 
 out:
@@ -670,7 +670,7 @@
 
 	if (extend) {
 		ret = ext4_handle_inode_extension(inode, offset, ret);
-		ext4_inode_extension_cleanup(inode, ret);
+		ext4_inode_extension_cleanup(inode, ret < (ssize_t)count);
 	}
 out:
 	inode_unlock(inode);
--- linux-qcom-6.8.0.orig/fs/ext4/fsmap.c
+++ linux-qcom-6.8.0/fs/ext4/fsmap.c
@@ -185,6 +185,56 @@
 	return fmr->fmr_physical + fmr->fmr_length;
 }
 
+static int ext4_getfsmap_meta_helper(struct super_block *sb,
+				     ext4_group_t agno, ext4_grpblk_t start,
+				     ext4_grpblk_t len, void *priv)
+{
+	struct ext4_getfsmap_info *info = priv;
+	struct ext4_fsmap *p;
+	struct ext4_fsmap *tmp;
+	struct ext4_sb_info *sbi = EXT4_SB(sb);
+	ext4_fsblk_t fsb, fs_start, fs_end;
+	int error;
+
+	fs_start = fsb = (EXT4_C2B(sbi, start) +
+			  ext4_group_first_block_no(sb, agno));
+	fs_end = fs_start + EXT4_C2B(sbi, len);
+
+	/* Return relevant extents from the meta_list */
+	list_for_each_entry_safe(p, tmp, &info->gfi_meta_list, fmr_list) {
+		if (p->fmr_physical < info->gfi_next_fsblk) {
+			list_del(&p->fmr_list);
+			kfree(p);
+			continue;
+		}
+		if (p->fmr_physical <= fs_start ||
+		    p->fmr_physical + p->fmr_length <= fs_end) {
+			/* Emit the retained free extent record if present */
+			if (info->gfi_lastfree.fmr_owner) {
+				error = ext4_getfsmap_helper(sb, info,
+							&info->gfi_lastfree);
+				if (error)
+					return error;
+				info->gfi_lastfree.fmr_owner = 0;
+			}
+			error = ext4_getfsmap_helper(sb, info, p);
+			if (error)
+				return error;
+			fsb = p->fmr_physical + p->fmr_length;
+			if (info->gfi_next_fsblk < fsb)
+				info->gfi_next_fsblk = fsb;
+			list_del(&p->fmr_list);
+			kfree(p);
+			continue;
+		}
+	}
+	if (info->gfi_next_fsblk < fsb)
+		info->gfi_next_fsblk = fsb;
+
+	return 0;
+}
+
+
 /* Transform a blockgroup's free record into a fsmap */
 static int ext4_getfsmap_datadev_helper(struct super_block *sb,
 					ext4_group_t agno, ext4_grpblk_t start,
@@ -539,6 +589,7 @@
 		error = ext4_mballoc_query_range(sb, info->gfi_agno,
 				EXT4_B2C(sbi, info->gfi_low.fmr_physical),
 				EXT4_B2C(sbi, info->gfi_high.fmr_physical),
+				ext4_getfsmap_meta_helper,
 				ext4_getfsmap_datadev_helper, info);
 		if (error)
 			goto err;
@@ -560,7 +611,8 @@
 
 	/* Report any gaps at the end of the bg */
 	info->gfi_last = true;
-	error = ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster, 0, info);
+	error = ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster + 1,
+					     0, info);
 	if (error)
 		goto err;
 
--- linux-qcom-6.8.0.orig/fs/ext4/ialloc.c
+++ linux-qcom-6.8.0/fs/ext4/ialloc.c
@@ -194,8 +194,9 @@
 	 * submit the buffer_head for reading
 	 */
 	trace_ext4_load_inode_bitmap(sb, block_group);
-	ext4_read_bh(bh, REQ_META | REQ_PRIO, ext4_end_bitmap_read);
-	ext4_simulate_fail_bh(sb, bh, EXT4_SIM_IBITMAP_EIO);
+	ext4_read_bh(bh, REQ_META | REQ_PRIO,
+		     ext4_end_bitmap_read,
+		     ext4_simulate_fail(sb, EXT4_SIM_IBITMAP_EIO));
 	if (!buffer_uptodate(bh)) {
 		put_bh(bh);
 		ext4_error_err(sb, EIO, "Cannot read inode bitmap - "
@@ -514,6 +515,8 @@
 	if (min_inodes < 1)
 		min_inodes = 1;
 	min_clusters = avefreec - EXT4_CLUSTERS_PER_GROUP(sb)*flex_size / 4;
+	if (min_clusters < 0)
+		min_clusters = 0;
 
 	/*
 	 * Start looking in the flex group where we last allocated an
@@ -755,10 +758,10 @@
 	struct ext4_group_desc *gdp;
 	ext4_group_t group;
 	int bit;
-	int err = -EFSCORRUPTED;
+	int err;
 
 	if (ino < EXT4_FIRST_INO(sb) || ino > max_ino)
-		goto out;
+		return -EFSCORRUPTED;
 
 	group = (ino - 1) / EXT4_INODES_PER_GROUP(sb);
 	bit = (ino - 1) % EXT4_INODES_PER_GROUP(sb);
@@ -860,6 +863,7 @@
 	err = ext4_handle_dirty_metadata(NULL, NULL, group_desc_bh);
 	sync_dirty_buffer(group_desc_bh);
 out:
+	brelse(inode_bitmap_bh);
 	return err;
 }
 
@@ -1053,12 +1057,13 @@
 		brelse(inode_bitmap_bh);
 		inode_bitmap_bh = ext4_read_inode_bitmap(sb, group);
 		/* Skip groups with suspicious inode tables */
-		if (((!(sbi->s_mount_state & EXT4_FC_REPLAY))
-		     && EXT4_MB_GRP_IBITMAP_CORRUPT(grp)) ||
-		    IS_ERR(inode_bitmap_bh)) {
+		if (IS_ERR(inode_bitmap_bh)) {
 			inode_bitmap_bh = NULL;
 			goto next_group;
 		}
+		if (!(sbi->s_mount_state & EXT4_FC_REPLAY) &&
+		    EXT4_MB_GRP_IBITMAP_CORRUPT(grp))
+			goto next_group;
 
 repeat_in_this_group:
 		ret2 = find_inode_bit(sb, group, inode_bitmap_bh, &ino);
--- linux-qcom-6.8.0.orig/fs/ext4/indirect.c
+++ linux-qcom-6.8.0/fs/ext4/indirect.c
@@ -170,7 +170,7 @@
 		}
 
 		if (!bh_uptodate_or_lock(bh)) {
-			if (ext4_read_bh(bh, 0, NULL) < 0) {
+			if (ext4_read_bh(bh, 0, NULL, false) < 0) {
 				put_bh(bh);
 				goto failure;
 			}
--- linux-qcom-6.8.0.orig/fs/ext4/inline.c
+++ linux-qcom-6.8.0/fs/ext4/inline.c
@@ -1410,7 +1410,11 @@
 			hinfo->hash = EXT4_DIRENT_HASH(de);
 			hinfo->minor_hash = EXT4_DIRENT_MINOR_HASH(de);
 		} else {
-			ext4fs_dirhash(dir, de->name, de->name_len, hinfo);
+			err = ext4fs_dirhash(dir, de->name, de->name_len, hinfo);
+			if (err) {
+				ret = err;
+				goto out;
+			}
 		}
 		if ((hinfo->hash < start_hash) ||
 		    ((hinfo->hash == start_hash) &&
@@ -1660,24 +1664,36 @@
 					struct ext4_dir_entry_2 **res_dir,
 					int *has_inline_data)
 {
+	struct ext4_xattr_ibody_find is = {
+		.s = { .not_found = -ENODATA, },
+	};
+	struct ext4_xattr_info i = {
+		.name_index = EXT4_XATTR_INDEX_SYSTEM,
+		.name = EXT4_XATTR_SYSTEM_DATA,
+	};
 	int ret;
-	struct ext4_iloc iloc;
 	void *inline_start;
 	int inline_size;
 
-	if (ext4_get_inode_loc(dir, &iloc))
-		return NULL;
+	ret = ext4_get_inode_loc(dir, &is.iloc);
+	if (ret)
+		return ERR_PTR(ret);
 
 	down_read(&EXT4_I(dir)->xattr_sem);
+
+	ret = ext4_xattr_ibody_find(dir, &i, &is);
+	if (ret)
+		goto out;
+
 	if (!ext4_has_inline_data(dir)) {
 		*has_inline_data = 0;
 		goto out;
 	}
 
-	inline_start = (void *)ext4_raw_inode(&iloc)->i_block +
+	inline_start = (void *)ext4_raw_inode(&is.iloc)->i_block +
 						EXT4_INLINE_DOTDOT_SIZE;
 	inline_size = EXT4_MIN_INLINE_DATA_SIZE - EXT4_INLINE_DOTDOT_SIZE;
-	ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
+	ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size,
 			      dir, fname, 0, res_dir);
 	if (ret == 1)
 		goto out_find;
@@ -1687,20 +1703,23 @@
 	if (ext4_get_inline_size(dir) == EXT4_MIN_INLINE_DATA_SIZE)
 		goto out;
 
-	inline_start = ext4_get_inline_xattr_pos(dir, &iloc);
+	inline_start = ext4_get_inline_xattr_pos(dir, &is.iloc);
 	inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
 
-	ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
+	ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size,
 			      dir, fname, 0, res_dir);
 	if (ret == 1)
 		goto out_find;
 
 out:
-	brelse(iloc.bh);
-	iloc.bh = NULL;
+	brelse(is.iloc.bh);
+	if (ret < 0)
+		is.iloc.bh = ERR_PTR(ret);
+	else
+		is.iloc.bh = NULL;
 out_find:
 	up_read(&EXT4_I(dir)->xattr_sem);
-	return iloc.bh;
+	return is.iloc.bh;
 }
 
 int ext4_delete_inline_entry(handle_t *handle,
--- linux-qcom-6.8.0.orig/fs/ext4/inode.c
+++ linux-qcom-6.8.0/fs/ext4/inode.c
@@ -453,6 +453,35 @@
 }
 #endif /* ES_AGGRESSIVE_TEST */
 
+static int ext4_map_query_blocks(handle_t *handle, struct inode *inode,
+				 struct ext4_map_blocks *map)
+{
+	unsigned int status;
+	int retval;
+
+	if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
+		retval = ext4_ext_map_blocks(handle, inode, map, 0);
+	else
+		retval = ext4_ind_map_blocks(handle, inode, map, 0);
+
+	if (retval <= 0)
+		return retval;
+
+	if (unlikely(retval != map->m_len)) {
+		ext4_warning(inode->i_sb,
+			     "ES len assertion failed for inode "
+			     "%lu: retval %d != map->m_len %d",
+			     inode->i_ino, retval, map->m_len);
+		WARN_ON(1);
+	}
+
+	status = map->m_flags & EXT4_MAP_UNWRITTEN ?
+			EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
+	ext4_es_insert_extent(inode, map->m_lblk, map->m_len,
+			      map->m_pblk, status);
+	return retval;
+}
+
 /*
  * The ext4_map_blocks() function tries to look up the requested blocks,
  * and returns if the blocks are already mapped.
@@ -1299,8 +1328,10 @@
 	folio_unlock(folio);
 	folio_put(folio);
 
-	if (old_size < pos && !verity)
+	if (old_size < pos && !verity) {
 		pagecache_isize_extended(inode, old_size, pos);
+		ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size);
+	}
 	/*
 	 * Don't mark the inode dirty under folio lock. First, it unnecessarily
 	 * makes the holding time of folio lock longer. Second, it forces lock
@@ -1416,8 +1447,10 @@
 	folio_unlock(folio);
 	folio_put(folio);
 
-	if (old_size < pos && !verity)
+	if (old_size < pos && !verity) {
 		pagecache_isize_extended(inode, old_size, pos);
+		ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size);
+	}
 
 	if (size_changed) {
 		ret2 = ext4_mark_inode_dirty(handle, inode);
@@ -1708,6 +1741,7 @@
 		if (ext4_es_is_hole(&es))
 			goto add_delayed;
 
+found:
 		/*
 		 * Delayed extent could be allocated by fallocate.
 		 * So we need to check it.
@@ -1744,36 +1778,34 @@
 	down_read(&EXT4_I(inode)->i_data_sem);
 	if (ext4_has_inline_data(inode))
 		retval = 0;
-	else if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
-		retval = ext4_ext_map_blocks(NULL, inode, map, 0);
 	else
-		retval = ext4_ind_map_blocks(NULL, inode, map, 0);
-	if (retval < 0) {
-		up_read(&EXT4_I(inode)->i_data_sem);
+		retval = ext4_map_query_blocks(NULL, inode, map);
+	up_read(&EXT4_I(inode)->i_data_sem);
+	if (retval)
 		return retval;
-	}
-	if (retval > 0) {
-		unsigned int status;
 
-		if (unlikely(retval != map->m_len)) {
-			ext4_warning(inode->i_sb,
-				     "ES len assertion failed for inode "
-				     "%lu: retval %d != map->m_len %d",
-				     inode->i_ino, retval, map->m_len);
-			WARN_ON(1);
+add_delayed:
+	down_write(&EXT4_I(inode)->i_data_sem);
+	/*
+	 * Page fault path (ext4_page_mkwrite does not take i_rwsem)
+	 * and fallocate path (no folio lock) can race. Make sure we
+	 * lookup the extent status tree here again while i_data_sem
+	 * is held in write mode, before inserting a new da entry in
+	 * the extent status tree.
+	 */
+	if (ext4_es_lookup_extent(inode, iblock, NULL, &es)) {
+		if (!ext4_es_is_hole(&es)) {
+			up_write(&EXT4_I(inode)->i_data_sem);
+			goto found;
+		}
+	} else if (!ext4_has_inline_data(inode)) {
+		retval = ext4_map_query_blocks(NULL, inode, map);
+		if (retval) {
+			up_write(&EXT4_I(inode)->i_data_sem);
+			return retval;
 		}
-
-		status = map->m_flags & EXT4_MAP_UNWRITTEN ?
-				EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
-		ext4_es_insert_extent(inode, map->m_lblk, map->m_len,
-				      map->m_pblk, status);
-		up_read(&EXT4_I(inode)->i_data_sem);
-		return retval;
 	}
-	up_read(&EXT4_I(inode)->i_data_sem);
 
-add_delayed:
-	down_write(&EXT4_I(inode)->i_data_sem);
 	retval = ext4_insert_delayed_block(inode, map->m_lblk);
 	up_write(&EXT4_I(inode)->i_data_sem);
 	if (retval)
@@ -2334,7 +2366,7 @@
 
 	if (folio_pos(folio) + len > size &&
 	    !ext4_verity_in_progress(inode))
-		len = size - folio_pos(folio);
+		len = size & (len - 1);
 
 	return ext4_journal_folio_buffers(handle, folio, len);
 }
@@ -2887,9 +2919,6 @@
 	if (IS_ERR(folio))
 		return PTR_ERR(folio);
 
-	/* In case writeback began while the folio was unlocked */
-	folio_wait_stable(folio);
-
 #ifdef CONFIG_FS_ENCRYPTION
 	ret = ext4_block_write_begin(folio, pos, len, ext4_da_get_block_prep);
 #else
@@ -2946,8 +2975,14 @@
 	struct inode *inode = mapping->host;
 	loff_t old_size = inode->i_size;
 	bool disksize_changed = false;
-	loff_t new_i_size;
+	loff_t new_i_size, zero_len = 0;
+	handle_t *handle;
 
+	if (unlikely(!folio_buffers(folio))) {
+		folio_unlock(folio);
+		folio_put(folio);
+		return -EIO;
+	}
 	/*
 	 * block_write_end() will mark the inode as dirty with I_DIRTY_PAGES
 	 * flag, which all that's needed to trigger page writeback.
@@ -2985,18 +3020,21 @@
 	folio_unlock(folio);
 	folio_put(folio);
 
-	if (old_size < pos)
+	if (pos > old_size) {
 		pagecache_isize_extended(inode, old_size, pos);
+		zero_len = pos - old_size;
+	}
 
-	if (disksize_changed) {
-		handle_t *handle;
+	if (!disksize_changed && !zero_len)
+		return copied;
 
-		handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
-		if (IS_ERR(handle))
-			return PTR_ERR(handle);
-		ext4_mark_inode_dirty(handle, inode);
-		ext4_journal_stop(handle);
-	}
+	handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
+	if (IS_ERR(handle))
+		return PTR_ERR(handle);
+	if (zero_len)
+		ext4_zero_partial_blocks(handle, inode, old_size, zero_len);
+	ext4_mark_inode_dirty(handle, inode);
+	ext4_journal_stop(handle);
 
 	return copied;
 }
@@ -4458,10 +4496,10 @@
 	 * Read the block from disk.
 	 */
 	trace_ext4_load_inode(sb, ino);
-	ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO, NULL);
+	ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO, NULL,
+			    ext4_simulate_fail(sb, EXT4_SIM_INODE_EIO));
 	blk_finish_plug(&plug);
 	wait_on_buffer(bh);
-	ext4_simulate_fail_bh(sb, bh, EXT4_SIM_INODE_EIO);
 	if (!buffer_uptodate(bh)) {
 		if (ret_block)
 			*ret_block = block;
@@ -5207,8 +5245,9 @@
 {
 	unsigned offset;
 	journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
-	tid_t commit_tid = 0;
+	tid_t commit_tid;
 	int ret;
+	bool has_transaction;
 
 	offset = inode->i_size & (PAGE_SIZE - 1);
 	/*
@@ -5233,12 +5272,14 @@
 		folio_put(folio);
 		if (ret != -EBUSY)
 			return;
-		commit_tid = 0;
+		has_transaction = false;
 		read_lock(&journal->j_state_lock);
-		if (journal->j_committing_transaction)
+		if (journal->j_committing_transaction) {
 			commit_tid = journal->j_committing_transaction->t_tid;
+			has_transaction = true;
+		}
 		read_unlock(&journal->j_state_lock);
-		if (commit_tid)
+		if (has_transaction)
 			jbd2_log_wait_commit(journal, commit_tid);
 	}
 }
@@ -5384,6 +5425,14 @@
 		}
 
 		if (attr->ia_size != inode->i_size) {
+			/* attach jbd2 jinode for EOF folio tail zeroing */
+			if (attr->ia_size & (inode->i_sb->s_blocksize - 1) ||
+			    oldsize & (inode->i_sb->s_blocksize - 1)) {
+				error = ext4_inode_attach_jinode(inode);
+				if (error)
+					goto err_out;
+			}
+
 			handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
 			if (IS_ERR(handle)) {
 				error = PTR_ERR(handle);
@@ -5394,12 +5443,17 @@
 				orphan = 1;
 			}
 			/*
-			 * Update c/mtime on truncate up, ext4_truncate() will
-			 * update c/mtime in shrink case below
+			 * Update c/mtime and tail zero the EOF folio on
+			 * truncate up. ext4_truncate() handles the shrink case
+			 * below.
 			 */
-			if (!shrink)
+			if (!shrink) {
 				inode_set_mtime_to_ts(inode,
 						      inode_set_ctime_current(inode));
+				if (oldsize & (inode->i_sb->s_blocksize - 1))
+					ext4_block_truncate_page(handle,
+							inode->i_mapping, oldsize);
+			}
 
 			if (shrink)
 				ext4_fc_track_range(handle, inode,
--- linux-qcom-6.8.0.orig/fs/ext4/mballoc.c
+++ linux-qcom-6.8.0/fs/ext4/mballoc.c
@@ -831,6 +831,8 @@
 		return 0;
 	if (order == MB_NUM_ORDERS(sb))
 		order--;
+	if (WARN_ON_ONCE(order > MB_NUM_ORDERS(sb)))
+		order = MB_NUM_ORDERS(sb) - 1;
 	return order;
 }
 
@@ -1008,6 +1010,8 @@
 	 * goal length.
 	 */
 	order = fls(ac->ac_g_ex.fe_len) - 1;
+	if (WARN_ON_ONCE(order - 1 > MB_NUM_ORDERS(ac->ac_sb)))
+		order = MB_NUM_ORDERS(ac->ac_sb);
 	min_order = order - sbi->s_mb_best_avail_max_trim_order;
 	if (min_order < 0)
 		min_order = 0;
@@ -3059,7 +3063,10 @@
 	for (i = 0; i <= 13; i++)
 		seq_printf(seq, " %-5u", i <= blocksize_bits + 1 ?
 				sg.info.bb_counters[i] : 0);
-	seq_puts(seq, " ]\n");
+	seq_puts(seq, " ]");
+	if (EXT4_MB_GRP_BBITMAP_CORRUPT(&sg.info))
+		seq_puts(seq, " Block bitmap corrupted!");
+	seq_puts(seq, "\n");
 
 	return 0;
 }
@@ -3877,11 +3884,8 @@
 	/*
 	 * Clear the trimmed flag for the group so that the next
 	 * ext4_trim_fs can trim it.
-	 * If the volume is mounted with -o discard, online discard
-	 * is supported and the free blocks will be trimmed online.
 	 */
-	if (!test_opt(sb, DISCARD))
-		EXT4_MB_GRP_CLEAR_TRIMMED(db);
+	EXT4_MB_GRP_CLEAR_TRIMMED(db);
 
 	if (!db->bb_free_root.rb_node) {
 		/* No more items in the per group rb tree
@@ -5169,10 +5173,16 @@
 			.fe_len = ac->ac_orig_goal_len,
 		};
 		loff_t orig_goal_end = extent_logical_end(sbi, &ex);
+		loff_t o_ex_end = extent_logical_end(sbi, &ac->ac_o_ex);
 
-		/* we can't allocate as much as normalizer wants.
-		 * so, found space must get proper lstart
-		 * to cover original request */
+		/*
+		 * We can't allocate as much as normalizer wants, so we try
+		 * to get proper lstart to cover the original request, except
+		 * when the goal doesn't cover the original request as below:
+		 *
+		 * orig_ex:2045/2055(10), isize:8417280 -> normalized:0/2048
+		 * best_ex:0/200(200) -> adjusted: 1848/2048(200)
+		 */
 		BUG_ON(ac->ac_g_ex.fe_logical > ac->ac_o_ex.fe_logical);
 		BUG_ON(ac->ac_g_ex.fe_len < ac->ac_o_ex.fe_len);
 
@@ -5184,7 +5194,7 @@
 		 * 1. Check if best ex can be kept at end of goal (before
 		 *    cr_best_avail trimmed it) and still cover original start
 		 * 2. Else, check if best ex can be kept at start of goal and
-		 *    still cover original start
+		 *    still cover original end
 		 * 3. Else, keep the best ex at start of original request.
 		 */
 		ex.fe_len = ac->ac_b_ex.fe_len;
@@ -5194,7 +5204,7 @@
 			goto adjust_bex;
 
 		ex.fe_logical = ac->ac_g_ex.fe_logical;
-		if (ac->ac_o_ex.fe_logical < extent_logical_end(sbi, &ex))
+		if (o_ex_end <= extent_logical_end(sbi, &ex))
 			goto adjust_bex;
 
 		ex.fe_logical = ac->ac_o_ex.fe_logical;
@@ -5202,7 +5212,6 @@
 		ac->ac_b_ex.fe_logical = ex.fe_logical;
 
 		BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical);
-		BUG_ON(ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len);
 		BUG_ON(extent_logical_end(sbi, &ex) > orig_goal_end);
 	}
 
@@ -6111,6 +6120,7 @@
 	ext4_mb_mark_bb(sb, block, 1, true);
 	ar->len = 1;
 
+	*errp = 0;
 	return block;
 }
 
@@ -6493,8 +6503,9 @@
 					 " group:%u block:%d count:%lu failed"
 					 " with %d", block_group, bit, count,
 					 err);
-		} else
-			EXT4_MB_GRP_CLEAR_TRIMMED(e4b.bd_info);
+		}
+
+		EXT4_MB_GRP_CLEAR_TRIMMED(e4b.bd_info);
 
 		ext4_lock_group(sb, block_group);
 		mb_free_blocks(inode, &e4b, bit, count_clusters);
@@ -6978,13 +6989,14 @@
 ext4_mballoc_query_range(
 	struct super_block		*sb,
 	ext4_group_t			group,
-	ext4_grpblk_t			start,
+	ext4_grpblk_t			first,
 	ext4_grpblk_t			end,
+	ext4_mballoc_query_range_fn	meta_formatter,
 	ext4_mballoc_query_range_fn	formatter,
 	void				*priv)
 {
 	void				*bitmap;
-	ext4_grpblk_t			next;
+	ext4_grpblk_t			start, next;
 	struct ext4_buddy		e4b;
 	int				error;
 
@@ -6995,10 +7007,19 @@
 
 	ext4_lock_group(sb, group);
 
-	start = max(e4b.bd_info->bb_first_free, start);
+	start = max(e4b.bd_info->bb_first_free, first);
 	if (end >= EXT4_CLUSTERS_PER_GROUP(sb))
 		end = EXT4_CLUSTERS_PER_GROUP(sb) - 1;
-
+	if (meta_formatter && start != first) {
+		if (start > end)
+			start = end;
+		ext4_unlock_group(sb, group);
+		error = meta_formatter(sb, group, first, start - first,
+				       priv);
+		if (error)
+			goto out_unload;
+		ext4_lock_group(sb, group);
+	}
 	while (start <= end) {
 		start = mb_find_next_zero_bit(bitmap, end + 1, start);
 		if (start > end)
--- linux-qcom-6.8.0.orig/fs/ext4/mballoc.h
+++ linux-qcom-6.8.0/fs/ext4/mballoc.h
@@ -193,8 +193,8 @@
 	ext4_grpblk_t	ac_orig_goal_len;
 
 	__u32 ac_flags;		/* allocation hints */
+	__u32 ac_groups_linear_remaining;
 	__u16 ac_groups_scanned;
-	__u16 ac_groups_linear_remaining;
 	__u16 ac_found;
 	__u16 ac_cX_found[EXT4_MB_NUM_CRS];
 	__u16 ac_tail;
@@ -259,6 +259,7 @@
 	ext4_group_t			agno,
 	ext4_grpblk_t			start,
 	ext4_grpblk_t			end,
+	ext4_mballoc_query_range_fn	meta_formatter,
 	ext4_mballoc_query_range_fn	formatter,
 	void				*priv);
 
--- linux-qcom-6.8.0.orig/fs/ext4/migrate.c
+++ linux-qcom-6.8.0/fs/ext4/migrate.c
@@ -663,8 +663,8 @@
 	if (unlikely(ret2 && !ret))
 		ret = ret2;
 errout:
-	ext4_journal_stop(handle);
 	up_write(&EXT4_I(inode)->i_data_sem);
+	ext4_journal_stop(handle);
 out_unlock:
 	ext4_writepages_up_write(inode->i_sb, alloc_ctx);
 	return ret;
--- linux-qcom-6.8.0.orig/fs/ext4/mmp.c
+++ linux-qcom-6.8.0/fs/ext4/mmp.c
@@ -94,7 +94,7 @@
 	}
 
 	lock_buffer(*bh);
-	ret = ext4_read_bh(*bh, REQ_META | REQ_PRIO, NULL);
+	ret = ext4_read_bh(*bh, REQ_META | REQ_PRIO, NULL, false);
 	if (ret)
 		goto warn_exit;
 
--- linux-qcom-6.8.0.orig/fs/ext4/move_extent.c
+++ linux-qcom-6.8.0/fs/ext4/move_extent.c
@@ -36,7 +36,6 @@
 		*ppath = NULL;
 		return -ENODATA;
 	}
-	*ppath = path;
 	return 0;
 }
 
@@ -166,15 +165,16 @@
 	return 0;
 }
 
-/* Force page buffers uptodate w/o dropping page's lock */
-static int
-mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)
+/* Force folio buffers uptodate w/o dropping folio's lock */
+static int mext_page_mkuptodate(struct folio *folio, size_t from, size_t to)
 {
 	struct inode *inode = folio->mapping->host;
 	sector_t block;
-	struct buffer_head *bh, *head, *arr[MAX_BUF_PER_PAGE];
+	struct buffer_head *bh, *head;
 	unsigned int blocksize, block_start, block_end;
-	int i, err,  nr = 0, partial = 0;
+	int nr = 0;
+	bool partial = false;
+
 	BUG_ON(!folio_test_locked(folio));
 	BUG_ON(folio_test_writeback(folio));
 
@@ -192,38 +192,44 @@
 		block_end = block_start + blocksize;
 		if (block_end <= from || block_start >= to) {
 			if (!buffer_uptodate(bh))
-				partial = 1;
+				partial = true;
 			continue;
 		}
 		if (buffer_uptodate(bh))
 			continue;
 		if (!buffer_mapped(bh)) {
-			err = ext4_get_block(inode, block, bh, 0);
-			if (err) {
-				folio_set_error(folio);
+			int err = ext4_get_block(inode, block, bh, 0);
+			if (err)
 				return err;
-			}
 			if (!buffer_mapped(bh)) {
 				folio_zero_range(folio, block_start, blocksize);
 				set_buffer_uptodate(bh);
 				continue;
 			}
 		}
-		BUG_ON(nr >= MAX_BUF_PER_PAGE);
-		arr[nr++] = bh;
+		lock_buffer(bh);
+		if (buffer_uptodate(bh)) {
+			unlock_buffer(bh);
+			continue;
+		}
+		ext4_read_bh_nowait(bh, 0, NULL, false);
+		nr++;
 	}
 	/* No io required */
 	if (!nr)
 		goto out;
 
-	for (i = 0; i < nr; i++) {
-		bh = arr[i];
-		if (!bh_uptodate_or_lock(bh)) {
-			err = ext4_read_bh(bh, 0, NULL);
-			if (err)
-				return err;
-		}
-	}
+	bh = head;
+	do {
+		if (bh_offset(bh) + blocksize <= from)
+			continue;
+		if (bh_offset(bh) > to)
+			break;
+		wait_on_buffer(bh);
+		if (buffer_uptodate(bh))
+			continue;
+		return -EIO;
+	} while ((bh = bh->b_this_page) != head);
 out:
 	if (!partial)
 		folio_mark_uptodate(folio);
--- linux-qcom-6.8.0.orig/fs/ext4/namei.c
+++ linux-qcom-6.8.0/fs/ext4/namei.c
@@ -151,10 +151,11 @@
 
 		return bh;
 	}
-	if (!bh && (type == INDEX || type == DIRENT_HTREE)) {
+	/* The first directory block must not be a hole. */
+	if (!bh && (type == INDEX || type == DIRENT_HTREE || block == 0)) {
 		ext4_error_inode(inode, func, line, block,
-				 "Directory hole found for htree %s block",
-				 (type == INDEX) ? "index" : "leaf");
+				 "Directory hole found for htree %s block %u",
+				 (type == INDEX) ? "index" : "leaf", block);
 		return ERR_PTR(-EFSCORRUPTED);
 	}
 	if (!bh)
@@ -1525,7 +1526,7 @@
 }
 
 /*
- * Returns 0 if not found, -1 on failure, and 1 on success
+ * Returns 0 if not found, -EFSCORRUPTED on failure, and 1 on success
  */
 int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,
 		    struct inode *dir, struct ext4_filename *fname,
@@ -1546,7 +1547,7 @@
 			 * a full check */
 			if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf,
 						 buf_size, offset))
-				return -1;
+				return -EFSCORRUPTED;
 			*res_dir = de;
 			return 1;
 		}
@@ -1554,7 +1555,7 @@
 		de_len = ext4_rec_len_from_disk(de->rec_len,
 						dir->i_sb->s_blocksize);
 		if (de_len <= 0)
-			return -1;
+			return -EFSCORRUPTED;
 		offset += de_len;
 		de = (struct ext4_dir_entry_2 *) ((char *) de + de_len);
 	}
@@ -1706,8 +1707,10 @@
 			goto cleanup_and_exit;
 		} else {
 			brelse(bh);
-			if (i < 0)
+			if (i < 0) {
+				ret = ERR_PTR(i);
 				goto cleanup_and_exit;
+			}
 		}
 	next:
 		if (++block >= nblocks)
@@ -1802,7 +1805,7 @@
 		if (retval == 1)
 			goto success;
 		brelse(bh);
-		if (retval == -1) {
+		if (retval < 0) {
 			bh = ERR_PTR(ERR_BAD_DX_DIR);
 			goto errout;
 		}
@@ -2044,7 +2047,7 @@
 		split = count/2;
 
 	hash2 = map[split].hash;
-	continued = hash2 == map[split - 1].hash;
+	continued = split > 0 ? hash2 == map[split - 1].hash : 0;
 	dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n",
 			(unsigned long)dx_get_block(frame->at),
 					hash2, split, count-split));
@@ -2218,6 +2221,52 @@
 	return err ? err : err2;
 }
 
+static bool ext4_check_dx_root(struct inode *dir, struct dx_root *root)
+{
+	struct fake_dirent *fde;
+	const char *error_msg;
+	unsigned int rlen;
+	unsigned int blocksize = dir->i_sb->s_blocksize;
+	char *blockend = (char *)root + dir->i_sb->s_blocksize;
+
+	fde = &root->dot;
+	if (unlikely(fde->name_len != 1)) {
+		error_msg = "invalid name_len for '.'";
+		goto corrupted;
+	}
+	if (unlikely(strncmp(root->dot_name, ".", fde->name_len))) {
+		error_msg = "invalid name for '.'";
+		goto corrupted;
+	}
+	rlen = ext4_rec_len_from_disk(fde->rec_len, blocksize);
+	if (unlikely((char *)fde + rlen >= blockend)) {
+		error_msg = "invalid rec_len for '.'";
+		goto corrupted;
+	}
+
+	fde = &root->dotdot;
+	if (unlikely(fde->name_len != 2)) {
+		error_msg = "invalid name_len for '..'";
+		goto corrupted;
+	}
+	if (unlikely(strncmp(root->dotdot_name, "..", fde->name_len))) {
+		error_msg = "invalid name for '..'";
+		goto corrupted;
+	}
+	rlen = ext4_rec_len_from_disk(fde->rec_len, blocksize);
+	if (unlikely((char *)fde + rlen >= blockend)) {
+		error_msg = "invalid rec_len for '..'";
+		goto corrupted;
+	}
+
+	return true;
+
+corrupted:
+	EXT4_ERROR_INODE(dir, "Corrupt dir, %s, running e2fsck is recommended",
+			 error_msg);
+	return false;
+}
+
 /*
  * This converts a one block unindexed directory to a 3 block indexed
  * directory, and adds the dentry to the indexed directory.
@@ -2252,17 +2301,17 @@
 		brelse(bh);
 		return retval;
 	}
+
 	root = (struct dx_root *) bh->b_data;
+	if (!ext4_check_dx_root(dir, root)) {
+		brelse(bh);
+		return -EFSCORRUPTED;
+	}
 
 	/* The 0th block becomes the root, move the dirents out */
 	fde = &root->dotdot;
 	de = (struct ext4_dir_entry_2 *)((char *)fde +
 		ext4_rec_len_from_disk(fde->rec_len, blocksize));
-	if ((char *) de >= (((char *) root) + blocksize)) {
-		EXT4_ERROR_INODE(dir, "invalid rec_len for '..'");
-		brelse(bh);
-		return -EFSCORRUPTED;
-	}
 	len = ((char *) root) + (blocksize - csum_size) - (char *) de;
 
 	/* Allocate new block for the 0th block's dirents */
@@ -2898,7 +2947,7 @@
 	inode = ext4_new_inode_start_handle(idmap, dir, mode,
 					    NULL, 0, NULL,
 					    EXT4_HT_DIR,
-			EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) +
+			EXT4_MAXQUOTAS_TRANS_BLOCKS(dir->i_sb) +
 			  4 + EXT4_XATTR_TRANS_BLOCKS);
 	handle = ext4_journal_current_handle();
 	err = PTR_ERR(inode);
@@ -3084,10 +3133,7 @@
 		EXT4_ERROR_INODE(inode, "invalid size");
 		return false;
 	}
-	/* The first directory block must not be a hole,
-	 * so treat it as DIRENT_HTREE
-	 */
-	bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE);
+	bh = ext4_read_dirblock(inode, 0, EITHER);
 	if (IS_ERR(bh))
 		return false;
 
@@ -3532,10 +3578,7 @@
 		struct ext4_dir_entry_2 *de;
 		unsigned int offset;
 
-		/* The first directory block must not be a hole, so
-		 * treat it as DIRENT_HTREE
-		 */
-		bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE);
+		bh = ext4_read_dirblock(inode, 0, EITHER);
 		if (IS_ERR(bh)) {
 			*retval = PTR_ERR(bh);
 			return NULL;
--- linux-qcom-6.8.0.orig/fs/ext4/page-io.c
+++ linux-qcom-6.8.0/fs/ext4/page-io.c
@@ -117,7 +117,6 @@
 
 		if (bio->bi_status) {
 			int err = blk_status_to_errno(bio->bi_status);
-			folio_set_error(folio);
 			mapping_set_error(folio->mapping, err);
 		}
 		bh = head = folio_buffers(folio);
@@ -441,8 +440,6 @@
 	BUG_ON(!folio_test_locked(folio));
 	BUG_ON(folio_test_writeback(folio));
 
-	folio_clear_error(folio);
-
 	/*
 	 * Comments copied from block_write_full_folio:
 	 *
--- linux-qcom-6.8.0.orig/fs/ext4/readpage.c
+++ linux-qcom-6.8.0/fs/ext4/readpage.c
@@ -289,7 +289,6 @@
 
 				if (ext4_map_blocks(NULL, inode, &map, 0) < 0) {
 				set_error_page:
-					folio_set_error(folio);
 					folio_zero_segment(folio, 0,
 							  folio_size(folio));
 					folio_unlock(folio);
--- linux-qcom-6.8.0.orig/fs/ext4/resize.c
+++ linux-qcom-6.8.0/fs/ext4/resize.c
@@ -230,8 +230,8 @@
 #define MAX_RESIZE_BG				16384
 
 /*
- * alloc_flex_gd() allocates a ext4_new_flex_group_data with size of
- * @flexbg_size.
+ * alloc_flex_gd() allocates an ext4_new_flex_group_data that satisfies the
+ * resizing from @o_group to @n_group, its size is typically @flexbg_size.
  *
  * Returns NULL on failure otherwise address of the allocated structure.
  */
@@ -239,25 +239,27 @@
 				ext4_group_t o_group, ext4_group_t n_group)
 {
 	ext4_group_t last_group;
+	unsigned int max_resize_bg;
 	struct ext4_new_flex_group_data *flex_gd;
 
 	flex_gd = kmalloc(sizeof(*flex_gd), GFP_NOFS);
 	if (flex_gd == NULL)
 		goto out3;
 
-	if (unlikely(flexbg_size > MAX_RESIZE_BG))
-		flex_gd->resize_bg = MAX_RESIZE_BG;
-	else
-		flex_gd->resize_bg = flexbg_size;
+	max_resize_bg = umin(flexbg_size, MAX_RESIZE_BG);
+	flex_gd->resize_bg = max_resize_bg;
 
 	/* Avoid allocating large 'groups' array if not needed */
 	last_group = o_group | (flex_gd->resize_bg - 1);
 	if (n_group <= last_group)
-		flex_gd->resize_bg = 1 << fls(n_group - o_group + 1);
+		flex_gd->resize_bg = 1 << fls(n_group - o_group);
 	else if (n_group - last_group < flex_gd->resize_bg)
-		flex_gd->resize_bg = 1 << max(fls(last_group - o_group + 1),
+		flex_gd->resize_bg = 1 << max(fls(last_group - o_group),
 					      fls(n_group - last_group));
 
+	if (WARN_ON_ONCE(flex_gd->resize_bg > max_resize_bg))
+		flex_gd->resize_bg = max_resize_bg;
+
 	flex_gd->groups = kmalloc_array(flex_gd->resize_bg,
 					sizeof(struct ext4_new_group_data),
 					GFP_NOFS);
@@ -1298,7 +1300,7 @@
 	if (unlikely(!bh))
 		return NULL;
 	if (!bh_uptodate_or_lock(bh)) {
-		if (ext4_read_bh(bh, 0, NULL) < 0) {
+		if (ext4_read_bh(bh, 0, NULL, false) < 0) {
 			brelse(bh);
 			return NULL;
 		}
@@ -1602,7 +1604,8 @@
 		int gdb_num = group / EXT4_DESC_PER_BLOCK(sb);
 		int gdb_num_end = ((group + flex_gd->count - 1) /
 				   EXT4_DESC_PER_BLOCK(sb));
-		int meta_bg = ext4_has_feature_meta_bg(sb);
+		int meta_bg = ext4_has_feature_meta_bg(sb) &&
+			      gdb_num >= le32_to_cpu(es->s_first_meta_bg);
 		sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr -
 					 ext4_group_first_block_no(sb, 0);
 
--- linux-qcom-6.8.0.orig/fs/ext4/super.c
+++ linux-qcom-6.8.0/fs/ext4/super.c
@@ -161,8 +161,14 @@
 
 
 static inline void __ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags,
-				  bh_end_io_t *end_io)
+				  bh_end_io_t *end_io, bool simu_fail)
 {
+	if (simu_fail) {
+		clear_buffer_uptodate(bh);
+		unlock_buffer(bh);
+		return;
+	}
+
 	/*
 	 * buffer's verified bit is no longer valid after reading from
 	 * disk again due to write out error, clear it to make sure we
@@ -176,7 +182,7 @@
 }
 
 void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags,
-			 bh_end_io_t *end_io)
+			 bh_end_io_t *end_io, bool simu_fail)
 {
 	BUG_ON(!buffer_locked(bh));
 
@@ -184,10 +190,11 @@
 		unlock_buffer(bh);
 		return;
 	}
-	__ext4_read_bh(bh, op_flags, end_io);
+	__ext4_read_bh(bh, op_flags, end_io, simu_fail);
 }
 
-int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, bh_end_io_t *end_io)
+int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags,
+		 bh_end_io_t *end_io, bool simu_fail)
 {
 	BUG_ON(!buffer_locked(bh));
 
@@ -196,7 +203,7 @@
 		return 0;
 	}
 
-	__ext4_read_bh(bh, op_flags, end_io);
+	__ext4_read_bh(bh, op_flags, end_io, simu_fail);
 
 	wait_on_buffer(bh);
 	if (buffer_uptodate(bh))
@@ -208,10 +215,10 @@
 {
 	lock_buffer(bh);
 	if (!wait) {
-		ext4_read_bh_nowait(bh, op_flags, NULL);
+		ext4_read_bh_nowait(bh, op_flags, NULL, false);
 		return 0;
 	}
-	return ext4_read_bh(bh, op_flags, NULL);
+	return ext4_read_bh(bh, op_flags, NULL, false);
 }
 
 /*
@@ -266,7 +273,7 @@
 
 	if (likely(bh)) {
 		if (trylock_buffer(bh))
-			ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL);
+			ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL, false);
 		brelse(bh);
 	}
 }
@@ -346,9 +353,9 @@
 __u32 ext4_free_inodes_count(struct super_block *sb,
 			      struct ext4_group_desc *bg)
 {
-	return le16_to_cpu(bg->bg_free_inodes_count_lo) |
+	return le16_to_cpu(READ_ONCE(bg->bg_free_inodes_count_lo)) |
 		(EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT ?
-		 (__u32)le16_to_cpu(bg->bg_free_inodes_count_hi) << 16 : 0);
+		 (__u32)le16_to_cpu(READ_ONCE(bg->bg_free_inodes_count_hi)) << 16 : 0);
 }
 
 __u32 ext4_used_dirs_count(struct super_block *sb,
@@ -402,9 +409,9 @@
 void ext4_free_inodes_set(struct super_block *sb,
 			  struct ext4_group_desc *bg, __u32 count)
 {
-	bg->bg_free_inodes_count_lo = cpu_to_le16((__u16)count);
+	WRITE_ONCE(bg->bg_free_inodes_count_lo, cpu_to_le16((__u16)count));
 	if (EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT)
-		bg->bg_free_inodes_count_hi = cpu_to_le16(count >> 16);
+		WRITE_ONCE(bg->bg_free_inodes_count_hi, cpu_to_le16(count >> 16));
 }
 
 void ext4_used_dirs_set(struct super_block *sb,
@@ -751,11 +758,12 @@
 
 	ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only");
 	/*
-	 * Make sure updated value of ->s_mount_flags will be visible before
-	 * ->s_flags update
+	 * EXT4_FLAGS_SHUTDOWN was set which stops all filesystem
+	 * modifications. We don't set SB_RDONLY because that requires
+	 * sb->s_umount semaphore and setting it without proper remount
+	 * procedure is confusing code such as freeze_super() leading to
+	 * deadlocks and other problems.
 	 */
-	smp_wmb();
-	sb->s_flags |= SB_RDONLY;
 }
 
 static void update_super_work(struct work_struct *work)
@@ -1600,7 +1608,7 @@
 static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
 			     unsigned int flags);
 
-static struct dquot **ext4_get_dquots(struct inode *inode)
+static struct dquot __rcu **ext4_get_dquots(struct inode *inode)
 {
 	return EXT4_I(inode)->i_dquot;
 }
@@ -5126,16 +5134,27 @@
 	return ret;
 }
 
-static void ext4_hash_info_init(struct super_block *sb)
+static int ext4_hash_info_init(struct super_block *sb)
 {
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	struct ext4_super_block *es = sbi->s_es;
 	unsigned int i;
 
+	sbi->s_def_hash_version = es->s_def_hash_version;
+
+	if (sbi->s_def_hash_version > DX_HASH_LAST) {
+		ext4_msg(sb, KERN_ERR,
+			 "Invalid default hash set in the superblock");
+		return -EINVAL;
+	} else if (sbi->s_def_hash_version == DX_HASH_SIPHASH) {
+		ext4_msg(sb, KERN_ERR,
+			 "SIPHASH is not a valid default hash value");
+		return -EINVAL;
+	}
+
 	for (i = 0; i < 4; i++)
 		sbi->s_hash_seed[i] = le32_to_cpu(es->s_hash_seed[i]);
 
-	sbi->s_def_hash_version = es->s_def_hash_version;
 	if (ext4_has_feature_dir_index(sb)) {
 		i = le32_to_cpu(es->s_flags);
 		if (i & EXT2_FLAGS_UNSIGNED_HASH)
@@ -5153,6 +5172,7 @@
 #endif
 		}
 	}
+	return 0;
 }
 
 static int ext4_block_group_meta_init(struct super_block *sb, int silent)
@@ -5204,6 +5224,18 @@
 	return 0;
 }
 
+/*
+ * It's hard to get stripe aligned blocks if stripe is not aligned with
+ * cluster, just disable stripe and alert user to simplify code and avoid
+ * stripe aligned allocation which will rarely succeed.
+ */
+static bool ext4_is_stripe_incompatible(struct super_block *sb, unsigned long stripe)
+{
+	struct ext4_sb_info *sbi = EXT4_SB(sb);
+	return (stripe > 0 && sbi->s_cluster_ratio > 1 &&
+		stripe % sbi->s_cluster_ratio != 0);
+}
+
 static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
 {
 	struct ext4_super_block *es = NULL;
@@ -5288,7 +5320,9 @@
 	if (err)
 		goto failed_mount;
 
-	ext4_hash_info_init(sb);
+	err = ext4_hash_info_init(sb);
+	if (err)
+		goto failed_mount;
 
 	err = ext4_handle_clustersize(sb);
 	if (err)
@@ -5311,13 +5345,7 @@
 		goto failed_mount3;
 
 	sbi->s_stripe = ext4_get_stripe_size(sbi);
-	/*
-	 * It's hard to get stripe aligned blocks if stripe is not aligned with
-	 * cluster, just disable stripe and alert user to simpfy code and avoid
-	 * stripe aligned allocation which will rarely successes.
-	 */
-	if (sbi->s_stripe > 0 && sbi->s_cluster_ratio > 1 &&
-	    sbi->s_stripe % sbi->s_cluster_ratio != 0) {
+	if (ext4_is_stripe_incompatible(sb, sbi->s_stripe)) {
 		ext4_msg(sb, KERN_WARNING,
 			 "stripe (%lu) is not aligned with cluster size (%u), "
 			 "stripe is disabled",
@@ -5351,6 +5379,8 @@
 	INIT_LIST_HEAD(&sbi->s_orphan); /* unlinked but open files */
 	mutex_init(&sbi->s_orphan_lock);
 
+	spin_lock_init(&sbi->s_bdev_wb_lock);
+
 	ext4_fast_commit_init(sb);
 
 	sb->s_root = NULL;
@@ -5555,19 +5585,15 @@
 	if (err)
 		goto failed_mount6;
 
-	err = ext4_register_sysfs(sb);
-	if (err)
-		goto failed_mount7;
-
 	err = ext4_init_orphan_info(sb);
 	if (err)
-		goto failed_mount8;
+		goto failed_mount7;
 #ifdef CONFIG_QUOTA
 	/* Enable quota usage during mount. */
 	if (ext4_has_feature_quota(sb) && !sb_rdonly(sb)) {
 		err = ext4_enable_quotas(sb);
 		if (err)
-			goto failed_mount9;
+			goto failed_mount8;
 	}
 #endif  /* CONFIG_QUOTA */
 
@@ -5575,7 +5601,6 @@
 	 * Save the original bdev mapping's wb_err value which could be
 	 * used to detect the metadata async write error.
 	 */
-	spin_lock_init(&sbi->s_bdev_wb_lock);
 	errseq_check_and_advance(&sb->s_bdev->bd_inode->i_mapping->wb_err,
 				 &sbi->s_bdev_wb_err);
 	EXT4_SB(sb)->s_mount_state |= EXT4_ORPHAN_FS;
@@ -5593,7 +5618,7 @@
 		ext4_msg(sb, KERN_INFO, "recovery complete");
 		err = ext4_mark_recovery_complete(sb, es);
 		if (err)
-			goto failed_mount10;
+			goto failed_mount9;
 	}
 
 	if (test_opt(sb, DISCARD) && !bdev_max_discard_sectors(sb->s_bdev))
@@ -5610,15 +5635,17 @@
 	atomic_set(&sbi->s_warning_count, 0);
 	atomic_set(&sbi->s_msg_count, 0);
 
+	/* Register sysfs after all initializations are complete. */
+	err = ext4_register_sysfs(sb);
+	if (err)
+		goto failed_mount9;
+
 	return 0;
 
-failed_mount10:
+failed_mount9:
 	ext4_quotas_off(sb, EXT4_MAXQUOTAS);
-failed_mount9: __maybe_unused
+failed_mount8: __maybe_unused
 	ext4_release_orphan_info(sb);
-failed_mount8:
-	ext4_unregister_sysfs(sb);
-	kobject_put(&sbi->s_kobj);
 failed_mount7:
 	ext4_unregister_li_request(sb);
 failed_mount6:
@@ -5653,8 +5680,8 @@
 failed_mount3:
 	/* flush s_sb_upd_work before sbi destroy */
 	flush_work(&sbi->s_sb_upd_work);
-	del_timer_sync(&sbi->s_err_report);
 	ext4_stop_mmpd(sbi);
+	del_timer_sync(&sbi->s_err_report);
 	ext4_group_desc_free(sbi);
 failed_mount:
 	if (sbi->s_chksum_driver)
@@ -6483,6 +6510,15 @@
 
 	}
 
+	if ((ctx->spec & EXT4_SPEC_s_stripe) &&
+	    ext4_is_stripe_incompatible(sb, ctx->s_stripe)) {
+		ext4_msg(sb, KERN_WARNING,
+			 "stripe (%lu) is not aligned with cluster size (%u), "
+			 "stripe is disabled",
+			 ctx->s_stripe, sbi->s_cluster_ratio);
+		ctx->s_stripe = 0;
+	}
+
 	/*
 	 * Changing the DIOREAD_NOLOCK or DELALLOC mount options may cause
 	 * two calls to ext4_should_dioread_nolock() to return inconsistent
@@ -6529,9 +6565,6 @@
 		goto restore_opts;
 	}
 
-	if (test_opt2(sb, ABORT))
-		ext4_abort(sb, ESHUTDOWN, "Abort forced by user");
-
 	sb->s_flags = (sb->s_flags & ~SB_POSIXACL) |
 		(test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0);
 
@@ -6700,6 +6733,14 @@
 	if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
 		ext4_stop_mmpd(sbi);
 
+	/*
+	 * Handle aborting the filesystem as the last thing during remount to
+	 * avoid obsure errors during remount when some option changes fail to
+	 * apply due to shutdown filesystem.
+	 */
+	if (test_opt2(sb, ABORT))
+		ext4_abort(sb, ESHUTDOWN, "Abort forced by user");
+
 	return 0;
 
 restore_opts:
@@ -6864,6 +6905,10 @@
 	if (IS_ERR(handle))
 		return PTR_ERR(handle);
 	ret = dquot_commit(dquot);
+	if (ret < 0)
+		ext4_error_err(dquot->dq_sb, -ret,
+			       "Failed to commit dquot type %d",
+			       dquot->dq_id.type);
 	err = ext4_journal_stop(handle);
 	if (!ret)
 		ret = err;
@@ -6880,6 +6925,10 @@
 	if (IS_ERR(handle))
 		return PTR_ERR(handle);
 	ret = dquot_acquire(dquot);
+	if (ret < 0)
+		ext4_error_err(dquot->dq_sb, -ret,
+			      "Failed to acquire dquot type %d",
+			      dquot->dq_id.type);
 	err = ext4_journal_stop(handle);
 	if (!ret)
 		ret = err;
@@ -6899,6 +6948,10 @@
 		return PTR_ERR(handle);
 	}
 	ret = dquot_release(dquot);
+	if (ret < 0)
+		ext4_error_err(dquot->dq_sb, -ret,
+			       "Failed to release dquot type %d",
+			       dquot->dq_id.type);
 	err = ext4_journal_stop(handle);
 	if (!ret)
 		ret = err;
--- linux-qcom-6.8.0.orig/fs/ext4/sysfs.c
+++ linux-qcom-6.8.0/fs/ext4/sysfs.c
@@ -29,6 +29,7 @@
 	attr_trigger_test_error,
 	attr_first_error_time,
 	attr_last_error_time,
+	attr_clusters_in_group,
 	attr_feature,
 	attr_pointer_ui,
 	attr_pointer_ul,
@@ -104,7 +105,7 @@
 	int ret;
 
 	ret = kstrtoull(skip_spaces(buf), 0, &val);
-	if (ret || val >= clusters)
+	if (ret || val >= clusters || (s64)val < 0)
 		return -EINVAL;
 
 	atomic64_set(&sbi->s_resv_clusters, val);
@@ -207,13 +208,14 @@
 
 EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_readahead,
 		 ext4_sb_info, s_inode_readahead_blks);
+EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group,
+		 ext4_sb_info, s_mb_group_prealloc);
 EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal);
 EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats);
 EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan);
 EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan);
 EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs);
 EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request);
-EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc);
 EXT4_RW_ATTR_SBI_UI(mb_max_linear_groups, s_mb_max_linear_groups);
 EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb);
 EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error);
@@ -392,6 +394,7 @@
 				(unsigned long long)
 			percpu_counter_sum(&sbi->s_sra_exceeded_retry_limit));
 	case attr_inode_readahead:
+	case attr_clusters_in_group:
 	case attr_pointer_ui:
 		if (!ptr)
 			return 0;
@@ -451,7 +454,8 @@
 						s_kobj);
 	struct ext4_attr *a = container_of(attr, struct ext4_attr, attr);
 	void *ptr = calc_ptr(a, sbi);
-	unsigned long t;
+	unsigned int t;
+	unsigned long lt;
 	int ret;
 
 	switch (a->attr_id) {
@@ -460,7 +464,7 @@
 	case attr_pointer_ui:
 		if (!ptr)
 			return 0;
-		ret = kstrtoul(skip_spaces(buf), 0, &t);
+		ret = kstrtouint(skip_spaces(buf), 0, &t);
 		if (ret)
 			return ret;
 		if (a->attr_ptr == ptr_ext4_super_block_offset)
@@ -468,13 +472,23 @@
 		else
 			*((unsigned int *) ptr) = t;
 		return len;
+	case attr_clusters_in_group:
+		if (!ptr)
+			return 0;
+		ret = kstrtouint(skip_spaces(buf), 0, &t);
+		if (ret)
+			return ret;
+		if (t > sbi->s_clusters_per_group)
+			return -EINVAL;
+		*((unsigned int *) ptr) = t;
+		return len;
 	case attr_pointer_ul:
 		if (!ptr)
 			return 0;
-		ret = kstrtoul(skip_spaces(buf), 0, &t);
+		ret = kstrtoul(skip_spaces(buf), 0, &lt);
 		if (ret)
 			return ret;
-		*((unsigned long *) ptr) = t;
+		*((unsigned long *) ptr) = lt;
 		return len;
 	case attr_inode_readahead:
 		return inode_readahead_blks_store(sbi, buf, len);
--- linux-qcom-6.8.0.orig/fs/ext4/xattr.c
+++ linux-qcom-6.8.0/fs/ext4/xattr.c
@@ -458,7 +458,7 @@
 		ext4_set_inode_state(inode, EXT4_STATE_LUSTRE_EA_INODE);
 		ext4_xattr_inode_set_ref(inode, 1);
 	} else {
-		inode_lock(inode);
+		inode_lock_nested(inode, I_MUTEX_XATTR);
 		inode->i_flags |= S_NOQUOTA;
 		inode_unlock(inode);
 	}
@@ -1039,7 +1039,7 @@
 	s64 ref_count;
 	int ret;
 
-	inode_lock(ea_inode);
+	inode_lock_nested(ea_inode, I_MUTEX_XATTR);
 
 	ret = ext4_reserve_inode_write(handle, ea_inode, &iloc);
 	if (ret)
@@ -1433,6 +1433,12 @@
 			goto out;
 
 		memcpy(bh->b_data, buf, csize);
+		/*
+		 * Zero out block tail to avoid writing uninitialized memory
+		 * to disk.
+		 */
+		if (csize < blocksize)
+			memset(bh->b_data + csize, 0, blocksize - csize);
 		set_buffer_uptodate(bh);
 		ext4_handle_dirty_metadata(handle, ea_inode, bh);
 
@@ -1565,46 +1571,49 @@
 /*
  * Add value of the EA in an inode.
  */
-static int ext4_xattr_inode_lookup_create(handle_t *handle, struct inode *inode,
-					  const void *value, size_t value_len,
-					  struct inode **ret_inode)
+static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,
+		struct inode *inode, const void *value, size_t value_len)
 {
 	struct inode *ea_inode;
 	u32 hash;
 	int err;
 
+	/* Account inode & space to quota even if sharing... */
+	err = ext4_xattr_inode_alloc_quota(inode, value_len);
+	if (err)
+		return ERR_PTR(err);
+
 	hash = ext4_xattr_inode_hash(EXT4_SB(inode->i_sb), value, value_len);
 	ea_inode = ext4_xattr_inode_cache_find(inode, value, value_len, hash);
 	if (ea_inode) {
 		err = ext4_xattr_inode_inc_ref(handle, ea_inode);
-		if (err) {
-			iput(ea_inode);
-			return err;
-		}
-
-		*ret_inode = ea_inode;
-		return 0;
+		if (err)
+			goto out_err;
+		return ea_inode;
 	}
 
 	/* Create an inode for the EA value */
 	ea_inode = ext4_xattr_inode_create(handle, inode, hash);
-	if (IS_ERR(ea_inode))
-		return PTR_ERR(ea_inode);
+	if (IS_ERR(ea_inode)) {
+		ext4_xattr_inode_free_quota(inode, NULL, value_len);
+		return ea_inode;
+	}
 
 	err = ext4_xattr_inode_write(handle, ea_inode, value, value_len);
 	if (err) {
 		if (ext4_xattr_inode_dec_ref(handle, ea_inode))
 			ext4_warning_inode(ea_inode, "cleanup dec ref error %d", err);
-		iput(ea_inode);
-		return err;
+		goto out_err;
 	}
 
 	if (EA_INODE_CACHE(inode))
 		mb_cache_entry_create(EA_INODE_CACHE(inode), GFP_NOFS, hash,
 				      ea_inode->i_ino, true /* reusable */);
-
-	*ret_inode = ea_inode;
-	return 0;
+	return ea_inode;
+out_err:
+	iput(ea_inode);
+	ext4_xattr_inode_free_quota(inode, NULL, value_len);
+	return ERR_PTR(err);
 }
 
 /*
@@ -1616,6 +1625,7 @@
 static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
 				struct ext4_xattr_search *s,
 				handle_t *handle, struct inode *inode,
+				struct inode *new_ea_inode,
 				bool is_block)
 {
 	struct ext4_xattr_entry *last, *next;
@@ -1623,7 +1633,6 @@
 	size_t min_offs = s->end - s->base, name_len = strlen(i->name);
 	int in_inode = i->in_inode;
 	struct inode *old_ea_inode = NULL;
-	struct inode *new_ea_inode = NULL;
 	size_t old_size, new_size;
 	int ret;
 
@@ -1708,43 +1717,11 @@
 			old_ea_inode = NULL;
 			goto out;
 		}
-	}
-	if (i->value && in_inode) {
-		WARN_ON_ONCE(!i->value_len);
-
-		ret = ext4_xattr_inode_alloc_quota(inode, i->value_len);
-		if (ret)
-			goto out;
-
-		ret = ext4_xattr_inode_lookup_create(handle, inode, i->value,
-						     i->value_len,
-						     &new_ea_inode);
-		if (ret) {
-			new_ea_inode = NULL;
-			ext4_xattr_inode_free_quota(inode, NULL, i->value_len);
-			goto out;
-		}
-	}
 
-	if (old_ea_inode) {
 		/* We are ready to release ref count on the old_ea_inode. */
 		ret = ext4_xattr_inode_dec_ref(handle, old_ea_inode);
-		if (ret) {
-			/* Release newly required ref count on new_ea_inode. */
-			if (new_ea_inode) {
-				int err;
-
-				err = ext4_xattr_inode_dec_ref(handle,
-							       new_ea_inode);
-				if (err)
-					ext4_warning_inode(new_ea_inode,
-						  "dec ref new_ea_inode err=%d",
-						  err);
-				ext4_xattr_inode_free_quota(inode, new_ea_inode,
-							    i->value_len);
-			}
+		if (ret)
 			goto out;
-		}
 
 		ext4_xattr_inode_free_quota(inode, old_ea_inode,
 					    le32_to_cpu(here->e_value_size));
@@ -1868,7 +1845,6 @@
 	ret = 0;
 out:
 	iput(old_ea_inode);
-	iput(new_ea_inode);
 	return ret;
 }
 
@@ -1931,9 +1907,21 @@
 	size_t old_ea_inode_quota = 0;
 	unsigned int ea_ino;
 
-
 #define header(x) ((struct ext4_xattr_header *)(x))
 
+	/* If we need EA inode, prepare it before locking the buffer */
+	if (i->value && i->in_inode) {
+		WARN_ON_ONCE(!i->value_len);
+
+		ea_inode = ext4_xattr_inode_lookup_create(handle, inode,
+					i->value, i->value_len);
+		if (IS_ERR(ea_inode)) {
+			error = PTR_ERR(ea_inode);
+			ea_inode = NULL;
+			goto cleanup;
+		}
+	}
+
 	if (s->base) {
 		int offset = (char *)s->here - bs->bh->b_data;
 
@@ -1942,6 +1930,7 @@
 						      EXT4_JTR_NONE);
 		if (error)
 			goto cleanup;
+
 		lock_buffer(bs->bh);
 
 		if (header(s->base)->h_refcount == cpu_to_le32(1)) {
@@ -1968,7 +1957,7 @@
 			}
 			ea_bdebug(bs->bh, "modifying in-place");
 			error = ext4_xattr_set_entry(i, s, handle, inode,
-						     true /* is_block */);
+					     ea_inode, true /* is_block */);
 			ext4_xattr_block_csum_set(inode, bs->bh);
 			unlock_buffer(bs->bh);
 			if (error == -EFSCORRUPTED)
@@ -2036,29 +2025,13 @@
 		s->end = s->base + sb->s_blocksize;
 	}
 
-	error = ext4_xattr_set_entry(i, s, handle, inode, true /* is_block */);
+	error = ext4_xattr_set_entry(i, s, handle, inode, ea_inode,
+				     true /* is_block */);
 	if (error == -EFSCORRUPTED)
 		goto bad_block;
 	if (error)
 		goto cleanup;
 
-	if (i->value && s->here->e_value_inum) {
-		/*
-		 * A ref count on ea_inode has been taken as part of the call to
-		 * ext4_xattr_set_entry() above. We would like to drop this
-		 * extra ref but we have to wait until the xattr block is
-		 * initialized and has its own ref count on the ea_inode.
-		 */
-		ea_ino = le32_to_cpu(s->here->e_value_inum);
-		error = ext4_xattr_inode_iget(inode, ea_ino,
-					      le32_to_cpu(s->here->e_hash),
-					      &ea_inode);
-		if (error) {
-			ea_inode = NULL;
-			goto cleanup;
-		}
-	}
-
 inserted:
 	if (!IS_LAST_ENTRY(s->first)) {
 		new_bh = ext4_xattr_block_cache_find(inode, header(s->base),
@@ -2211,17 +2184,16 @@
 
 cleanup:
 	if (ea_inode) {
-		int error2;
-
-		error2 = ext4_xattr_inode_dec_ref(handle, ea_inode);
-		if (error2)
-			ext4_warning_inode(ea_inode, "dec ref error=%d",
-					   error2);
+		if (error) {
+			int error2;
 
-		/* If there was an error, revert the quota charge. */
-		if (error)
+			error2 = ext4_xattr_inode_dec_ref(handle, ea_inode);
+			if (error2)
+				ext4_warning_inode(ea_inode, "dec ref error=%d",
+						   error2);
 			ext4_xattr_inode_free_quota(inode, ea_inode,
 						    i_size_read(ea_inode));
+		}
 		iput(ea_inode);
 	}
 	if (ce)
@@ -2279,14 +2251,38 @@
 {
 	struct ext4_xattr_ibody_header *header;
 	struct ext4_xattr_search *s = &is->s;
+	struct inode *ea_inode = NULL;
 	int error;
 
 	if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
 		return -ENOSPC;
 
-	error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */);
-	if (error)
+	/* If we need EA inode, prepare it before locking the buffer */
+	if (i->value && i->in_inode) {
+		WARN_ON_ONCE(!i->value_len);
+
+		ea_inode = ext4_xattr_inode_lookup_create(handle, inode,
+					i->value, i->value_len);
+		if (IS_ERR(ea_inode))
+			return PTR_ERR(ea_inode);
+	}
+	error = ext4_xattr_set_entry(i, s, handle, inode, ea_inode,
+				     false /* is_block */);
+	if (error) {
+		if (ea_inode) {
+			int error2;
+
+			error2 = ext4_xattr_inode_dec_ref(handle, ea_inode);
+			if (error2)
+				ext4_warning_inode(ea_inode, "dec ref error=%d",
+						   error2);
+
+			ext4_xattr_inode_free_quota(inode, ea_inode,
+						    i_size_read(ea_inode));
+			iput(ea_inode);
+		}
 		return error;
+	}
 	header = IHDR(inode, ext4_raw_inode(&is->iloc));
 	if (!IS_LAST_ENTRY(s->first)) {
 		header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
@@ -2295,6 +2291,7 @@
 		header->h_magic = cpu_to_le32(0);
 		ext4_clear_inode_state(inode, EXT4_STATE_XATTR);
 	}
+	iput(ea_inode);
 	return 0;
 }
 
@@ -2557,6 +2554,8 @@
 
 		error = ext4_xattr_set_handle(handle, inode, name_index, name,
 					      value, value_len, flags);
+		ext4_fc_mark_ineligible(inode->i_sb, EXT4_FC_REASON_XATTR,
+					handle);
 		error2 = ext4_journal_stop(handle);
 		if (error == -ENOSPC &&
 		    ext4_should_retry_alloc(sb, &retries))
@@ -2564,7 +2563,6 @@
 		if (error == 0)
 			error = error2;
 	}
-	ext4_fc_mark_ineligible(inode->i_sb, EXT4_FC_REASON_XATTR, NULL);
 
 	return error;
 }
@@ -3126,8 +3124,10 @@
 
 		bh = ext4_sb_bread(inode->i_sb, ce->e_value, REQ_PRIO);
 		if (IS_ERR(bh)) {
-			if (PTR_ERR(bh) == -ENOMEM)
+			if (PTR_ERR(bh) == -ENOMEM) {
+				mb_cache_entry_put(ea_block_cache, ce);
 				return NULL;
+			}
 			bh = NULL;
 			EXT4_ERROR_INODE(inode, "block %lu read error",
 					 (unsigned long)ce->e_value);
--- linux-qcom-6.8.0.orig/fs/f2fs/checkpoint.c
+++ linux-qcom-6.8.0/fs/f2fs/checkpoint.c
@@ -32,7 +32,7 @@
 	f2fs_build_fault_attr(sbi, 0, 0);
 	if (!end_io)
 		f2fs_flush_merged_writes(sbi);
-	f2fs_handle_critical_error(sbi, reason, end_io);
+	f2fs_handle_critical_error(sbi, reason);
 }
 
 /*
@@ -889,7 +889,7 @@
 
 	cp_blocks = le32_to_cpu(cp_block->cp_pack_total_block_count);
 
-	if (cp_blocks > sbi->blocks_per_seg || cp_blocks <= F2FS_CP_PACKS) {
+	if (cp_blocks > BLKS_PER_SEG(sbi) || cp_blocks <= F2FS_CP_PACKS) {
 		f2fs_warn(sbi, "invalid cp_pack_total_block_count:%u",
 			  le32_to_cpu(cp_block->cp_pack_total_block_count));
 		goto invalid_cp;
@@ -1170,6 +1170,11 @@
 	ckpt->valid_node_count = cpu_to_le32(valid_node_count(sbi));
 	ckpt->valid_inode_count = cpu_to_le32(valid_inode_count(sbi));
 	ckpt->next_free_nid = cpu_to_le32(last_nid);
+
+	/* update user_block_counts */
+	sbi->last_valid_block_count = sbi->total_valid_block_count;
+	percpu_counter_set(&sbi->alloc_valid_block_count, 0);
+	percpu_counter_set(&sbi->rf_node_block_count, 0);
 }
 
 static bool __need_flush_quota(struct f2fs_sb_info *sbi)
@@ -1324,7 +1329,7 @@
 
 	if (cpc->reason & CP_UMOUNT) {
 		if (le32_to_cpu(ckpt->cp_pack_total_block_count) +
-			NM_I(sbi)->nat_bits_blocks > sbi->blocks_per_seg) {
+			NM_I(sbi)->nat_bits_blocks > BLKS_PER_SEG(sbi)) {
 			clear_ckpt_flags(sbi, CP_NAT_BITS_FLAG);
 			f2fs_notice(sbi, "Disable nat_bits due to no space");
 		} else if (!is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG) &&
@@ -1527,10 +1532,10 @@
 		cp_ver |= ((__u64)crc32 << 32);
 		*(__le64 *)nm_i->nat_bits = cpu_to_le64(cp_ver);
 
-		blk = start_blk + sbi->blocks_per_seg - nm_i->nat_bits_blocks;
+		blk = start_blk + BLKS_PER_SEG(sbi) - nm_i->nat_bits_blocks;
 		for (i = 0; i < nm_i->nat_bits_blocks; i++)
 			f2fs_update_meta_page(sbi, nm_i->nat_bits +
-					(i << F2FS_BLKSIZE_BITS), blk + i);
+					F2FS_BLK_TO_BYTES(i), blk + i);
 	}
 
 	/* write out checkpoint buffer at block 0 */
@@ -1559,11 +1564,6 @@
 		start_blk += NR_CURSEG_NODE_TYPE;
 	}
 
-	/* update user_block_counts */
-	sbi->last_valid_block_count = sbi->total_valid_block_count;
-	percpu_counter_set(&sbi->alloc_valid_block_count, 0);
-	percpu_counter_set(&sbi->rf_node_block_count, 0);
-
 	/* Here, we have one bio having CP pack except cp pack 2 page */
 	f2fs_sync_meta_pages(sbi, META, LONG_MAX, FS_CP_META_IO);
 	/* Wait for all dirty meta pages to be submitted for IO */
@@ -1587,8 +1587,9 @@
 	 */
 	if (f2fs_sb_has_encrypt(sbi) || f2fs_sb_has_verity(sbi) ||
 		f2fs_sb_has_compression(sbi))
-		invalidate_mapping_pages(META_MAPPING(sbi),
-				MAIN_BLKADDR(sbi), MAX_BLKADDR(sbi) - 1);
+		f2fs_bug_on(sbi,
+			invalidate_inode_pages2_range(META_MAPPING(sbi),
+				MAIN_BLKADDR(sbi), MAX_BLKADDR(sbi) - 1));
 
 	f2fs_release_ino_entry(sbi, false);
 
@@ -1730,9 +1731,9 @@
 		im->ino_num = 0;
 	}
 
-	sbi->max_orphans = (sbi->blocks_per_seg - F2FS_CP_PACKS -
+	sbi->max_orphans = (BLKS_PER_SEG(sbi) - F2FS_CP_PACKS -
 			NR_CURSEG_PERSIST_TYPE - __cp_payload(sbi)) *
-				F2FS_ORPHANS_PER_BLOCK;
+			F2FS_ORPHANS_PER_BLOCK;
 }
 
 int __init f2fs_create_checkpoint_caches(void)
--- linux-qcom-6.8.0.orig/fs/f2fs/compress.c
+++ linux-qcom-6.8.0/fs/f2fs/compress.c
@@ -198,8 +198,8 @@
 	ret = lzo1x_1_compress(cc->rbuf, cc->rlen, cc->cbuf->cdata,
 					&cc->clen, cc->private);
 	if (ret != LZO_E_OK) {
-		printk_ratelimited("%sF2FS-fs (%s): lzo compress failed, ret:%d\n",
-				KERN_ERR, F2FS_I_SB(cc->inode)->sb->s_id, ret);
+		f2fs_err_ratelimited(F2FS_I_SB(cc->inode),
+				"lzo compress failed, ret:%d", ret);
 		return -EIO;
 	}
 	return 0;
@@ -212,17 +212,15 @@
 	ret = lzo1x_decompress_safe(dic->cbuf->cdata, dic->clen,
 						dic->rbuf, &dic->rlen);
 	if (ret != LZO_E_OK) {
-		printk_ratelimited("%sF2FS-fs (%s): lzo decompress failed, ret:%d\n",
-				KERN_ERR, F2FS_I_SB(dic->inode)->sb->s_id, ret);
+		f2fs_err_ratelimited(F2FS_I_SB(dic->inode),
+				"lzo decompress failed, ret:%d", ret);
 		return -EIO;
 	}
 
 	if (dic->rlen != PAGE_SIZE << dic->log_cluster_size) {
-		printk_ratelimited("%sF2FS-fs (%s): lzo invalid rlen:%zu, "
-					"expected:%lu\n", KERN_ERR,
-					F2FS_I_SB(dic->inode)->sb->s_id,
-					dic->rlen,
-					PAGE_SIZE << dic->log_cluster_size);
+		f2fs_err_ratelimited(F2FS_I_SB(dic->inode),
+				"lzo invalid rlen:%zu, expected:%lu",
+				dic->rlen, PAGE_SIZE << dic->log_cluster_size);
 		return -EIO;
 	}
 	return 0;
@@ -294,16 +292,15 @@
 	ret = LZ4_decompress_safe(dic->cbuf->cdata, dic->rbuf,
 						dic->clen, dic->rlen);
 	if (ret < 0) {
-		printk_ratelimited("%sF2FS-fs (%s): lz4 decompress failed, ret:%d\n",
-				KERN_ERR, F2FS_I_SB(dic->inode)->sb->s_id, ret);
+		f2fs_err_ratelimited(F2FS_I_SB(dic->inode),
+				"lz4 decompress failed, ret:%d", ret);
 		return -EIO;
 	}
 
 	if (ret != PAGE_SIZE << dic->log_cluster_size) {
-		printk_ratelimited("%sF2FS-fs (%s): lz4 invalid ret:%d, "
-					"expected:%lu\n", KERN_ERR,
-					F2FS_I_SB(dic->inode)->sb->s_id, ret,
-					PAGE_SIZE << dic->log_cluster_size);
+		f2fs_err_ratelimited(F2FS_I_SB(dic->inode),
+				"lz4 invalid ret:%d, expected:%lu",
+				ret, PAGE_SIZE << dic->log_cluster_size);
 		return -EIO;
 	}
 	return 0;
@@ -350,9 +347,8 @@
 
 	stream = zstd_init_cstream(&params, 0, workspace, workspace_size);
 	if (!stream) {
-		printk_ratelimited("%sF2FS-fs (%s): %s zstd_init_cstream failed\n",
-				KERN_ERR, F2FS_I_SB(cc->inode)->sb->s_id,
-				__func__);
+		f2fs_err_ratelimited(F2FS_I_SB(cc->inode),
+				"%s zstd_init_cstream failed", __func__);
 		kvfree(workspace);
 		return -EIO;
 	}
@@ -390,16 +386,16 @@
 
 	ret = zstd_compress_stream(stream, &outbuf, &inbuf);
 	if (zstd_is_error(ret)) {
-		printk_ratelimited("%sF2FS-fs (%s): %s zstd_compress_stream failed, ret: %d\n",
-				KERN_ERR, F2FS_I_SB(cc->inode)->sb->s_id,
+		f2fs_err_ratelimited(F2FS_I_SB(cc->inode),
+				"%s zstd_compress_stream failed, ret: %d",
 				__func__, zstd_get_error_code(ret));
 		return -EIO;
 	}
 
 	ret = zstd_end_stream(stream, &outbuf);
 	if (zstd_is_error(ret)) {
-		printk_ratelimited("%sF2FS-fs (%s): %s zstd_end_stream returned %d\n",
-				KERN_ERR, F2FS_I_SB(cc->inode)->sb->s_id,
+		f2fs_err_ratelimited(F2FS_I_SB(cc->inode),
+				"%s zstd_end_stream returned %d",
 				__func__, zstd_get_error_code(ret));
 		return -EIO;
 	}
@@ -432,9 +428,8 @@
 
 	stream = zstd_init_dstream(max_window_size, workspace, workspace_size);
 	if (!stream) {
-		printk_ratelimited("%sF2FS-fs (%s): %s zstd_init_dstream failed\n",
-				KERN_ERR, F2FS_I_SB(dic->inode)->sb->s_id,
-				__func__);
+		f2fs_err_ratelimited(F2FS_I_SB(dic->inode),
+				"%s zstd_init_dstream failed", __func__);
 		kvfree(workspace);
 		return -EIO;
 	}
@@ -469,16 +464,15 @@
 
 	ret = zstd_decompress_stream(stream, &outbuf, &inbuf);
 	if (zstd_is_error(ret)) {
-		printk_ratelimited("%sF2FS-fs (%s): %s zstd_decompress_stream failed, ret: %d\n",
-				KERN_ERR, F2FS_I_SB(dic->inode)->sb->s_id,
+		f2fs_err_ratelimited(F2FS_I_SB(dic->inode),
+				"%s zstd_decompress_stream failed, ret: %d",
 				__func__, zstd_get_error_code(ret));
 		return -EIO;
 	}
 
 	if (dic->rlen != outbuf.pos) {
-		printk_ratelimited("%sF2FS-fs (%s): %s ZSTD invalid rlen:%zu, "
-				"expected:%lu\n", KERN_ERR,
-				F2FS_I_SB(dic->inode)->sb->s_id,
+		f2fs_err_ratelimited(F2FS_I_SB(dic->inode),
+				"%s ZSTD invalid rlen:%zu, expected:%lu",
 				__func__, dic->rlen,
 				PAGE_SIZE << dic->log_cluster_size);
 		return -EIO;
@@ -512,8 +506,8 @@
 	ret = lzorle1x_1_compress(cc->rbuf, cc->rlen, cc->cbuf->cdata,
 					&cc->clen, cc->private);
 	if (ret != LZO_E_OK) {
-		printk_ratelimited("%sF2FS-fs (%s): lzo-rle compress failed, ret:%d\n",
-				KERN_ERR, F2FS_I_SB(cc->inode)->sb->s_id, ret);
+		f2fs_err_ratelimited(F2FS_I_SB(cc->inode),
+				"lzo-rle compress failed, ret:%d", ret);
 		return -EIO;
 	}
 	return 0;
@@ -780,9 +774,9 @@
 		if (provided != calculated) {
 			if (!is_inode_flag_set(dic->inode, FI_COMPRESS_CORRUPT)) {
 				set_inode_flag(dic->inode, FI_COMPRESS_CORRUPT);
-				printk_ratelimited(
-					"%sF2FS-fs (%s): checksum invalid, nid = %lu, %x vs %x",
-					KERN_INFO, sbi->sb->s_id, dic->inode->i_ino,
+				f2fs_info_ratelimited(sbi,
+					"checksum invalid, nid = %lu, %x vs %x",
+					dic->inode->i_ino,
 					provided, calculated);
 			}
 			set_sbi_flag(sbi, SBI_NEED_FSCK);
@@ -951,7 +945,7 @@
 	unsigned int cluster_size = F2FS_I(inode)->i_cluster_size;
 	int count, i;
 
-	for (i = 1, count = 1; i < cluster_size; i++) {
+	for (i = 0, count = 0; i < cluster_size; i++) {
 		block_t blkaddr = data_blkaddr(dn->inode, dn->node_page,
 							dn->ofs_in_node + i);
 
@@ -962,8 +956,8 @@
 	return count;
 }
 
-static int __f2fs_cluster_blocks(struct inode *inode,
-				unsigned int cluster_idx, bool compr_blks)
+static int __f2fs_cluster_blocks(struct inode *inode, unsigned int cluster_idx,
+				enum cluster_check_type type)
 {
 	struct dnode_of_data dn;
 	unsigned int start_idx = cluster_idx <<
@@ -984,10 +978,12 @@
 	}
 
 	if (dn.data_blkaddr == COMPRESS_ADDR) {
-		if (compr_blks)
-			ret = __f2fs_get_cluster_blocks(inode, &dn);
-		else
+		if (type == CLUSTER_COMPR_BLKS)
+			ret = 1 + __f2fs_get_cluster_blocks(inode, &dn);
+		else if (type == CLUSTER_IS_COMPR)
 			ret = 1;
+	} else if (type == CLUSTER_RAW_BLKS) {
+		ret = __f2fs_get_cluster_blocks(inode, &dn);
 	}
 fail:
 	f2fs_put_dnode(&dn);
@@ -997,7 +993,16 @@
 /* return # of compressed blocks in compressed cluster */
 static int f2fs_compressed_blocks(struct compress_ctx *cc)
 {
-	return __f2fs_cluster_blocks(cc->inode, cc->cluster_idx, true);
+	return __f2fs_cluster_blocks(cc->inode, cc->cluster_idx,
+		CLUSTER_COMPR_BLKS);
+}
+
+/* return # of raw blocks in non-compressed cluster */
+static int f2fs_decompressed_blocks(struct inode *inode,
+				unsigned int cluster_idx)
+{
+	return __f2fs_cluster_blocks(inode, cluster_idx,
+		CLUSTER_RAW_BLKS);
 }
 
 /* return whether cluster is compressed one or not */
@@ -1005,7 +1010,16 @@
 {
 	return __f2fs_cluster_blocks(inode,
 		index >> F2FS_I(inode)->i_log_cluster_size,
-		false);
+		CLUSTER_IS_COMPR);
+}
+
+/* return whether cluster contains non raw blocks or not */
+bool f2fs_is_sparse_cluster(struct inode *inode, pgoff_t index)
+{
+	unsigned int cluster_idx = index >> F2FS_I(inode)->i_log_cluster_size;
+
+	return f2fs_decompressed_blocks(inode, cluster_idx) !=
+		F2FS_I(inode)->i_cluster_size;
 }
 
 static bool cluster_may_compress(struct compress_ctx *cc)
@@ -1418,6 +1432,8 @@
 	struct f2fs_sb_info *sbi = bio->bi_private;
 	struct compress_io_ctx *cic =
 			(struct compress_io_ctx *)page_private(page);
+	enum count_type type = WB_DATA_TYPE(page,
+				f2fs_is_compressed_page(page));
 	int i;
 
 	if (unlikely(bio->bi_status))
@@ -1425,7 +1441,7 @@
 
 	f2fs_compress_free_page(page);
 
-	dec_page_count(sbi, F2FS_WB_DATA);
+	dec_page_count(sbi, type);
 
 	if (atomic_dec_return(&cic->pending_pages))
 		return;
@@ -1441,12 +1457,14 @@
 }
 
 static int f2fs_write_raw_pages(struct compress_ctx *cc,
-					int *submitted,
+					int *submitted_p,
 					struct writeback_control *wbc,
 					enum iostat_type io_type)
 {
 	struct address_space *mapping = cc->inode->i_mapping;
-	int _submitted, compr_blocks, ret, i;
+	struct f2fs_sb_info *sbi = F2FS_M_SB(mapping);
+	int submitted, compr_blocks, i;
+	int ret = 0;
 
 	compr_blocks = f2fs_compressed_blocks(cc);
 
@@ -1461,6 +1479,10 @@
 	if (compr_blocks < 0)
 		return compr_blocks;
 
+	/* overwrite compressed cluster w/ normal cluster */
+	if (compr_blocks > 0)
+		f2fs_lock_op(sbi);
+
 	for (i = 0; i < cc->cluster_size; i++) {
 		if (!cc->rpages[i])
 			continue;
@@ -1485,7 +1507,7 @@
 		if (!clear_page_dirty_for_io(cc->rpages[i]))
 			goto continue_unlock;
 
-		ret = f2fs_write_single_data_page(cc->rpages[i], &_submitted,
+		ret = f2fs_write_single_data_page(cc->rpages[i], &submitted,
 						NULL, NULL, wbc, io_type,
 						compr_blocks, false);
 		if (ret) {
@@ -1493,26 +1515,29 @@
 				unlock_page(cc->rpages[i]);
 				ret = 0;
 			} else if (ret == -EAGAIN) {
+				ret = 0;
 				/*
 				 * for quota file, just redirty left pages to
 				 * avoid deadlock caused by cluster update race
 				 * from foreground operation.
 				 */
 				if (IS_NOQUOTA(cc->inode))
-					return 0;
-				ret = 0;
+					goto out;
 				f2fs_io_schedule_timeout(DEFAULT_IO_TIMEOUT);
 				goto retry_write;
 			}
-			return ret;
+			goto out;
 		}
 
-		*submitted += _submitted;
+		*submitted_p += submitted;
 	}
 
-	f2fs_balance_fs(F2FS_M_SB(mapping), true);
+out:
+	if (compr_blocks > 0)
+		f2fs_unlock_op(sbi);
 
-	return 0;
+	f2fs_balance_fs(sbi, true);
+	return ret;
 }
 
 int f2fs_write_multi_pages(struct compress_ctx *cc,
@@ -1806,16 +1831,18 @@
  * check whether cluster blocks are contiguous, and add extent cache entry
  * only if cluster blocks are logically and physically contiguous.
  */
-unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn)
+unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn,
+						unsigned int ofs_in_node)
 {
-	bool compressed = f2fs_data_blkaddr(dn) == COMPRESS_ADDR;
+	bool compressed = data_blkaddr(dn->inode, dn->node_page,
+					ofs_in_node) == COMPRESS_ADDR;
 	int i = compressed ? 1 : 0;
 	block_t first_blkaddr = data_blkaddr(dn->inode, dn->node_page,
-						dn->ofs_in_node + i);
+							ofs_in_node + i);
 
 	for (i += 1; i < F2FS_I(dn->inode)->i_cluster_size; i++) {
 		block_t blkaddr = data_blkaddr(dn->inode, dn->node_page,
-						dn->ofs_in_node + i);
+							ofs_in_node + i);
 
 		if (!__is_valid_data_blkaddr(blkaddr))
 			break;
--- linux-qcom-6.8.0.orig/fs/f2fs/data.c
+++ linux-qcom-6.8.0/fs/f2fs/data.c
@@ -48,7 +48,7 @@
 	bioset_exit(&f2fs_bioset);
 }
 
-static bool __is_cp_guaranteed(struct page *page)
+bool f2fs_is_cp_guaranteed(struct page *page)
 {
 	struct address_space *mapping = page->mapping;
 	struct inode *inode;
@@ -65,8 +65,6 @@
 			S_ISDIR(inode->i_mode))
 		return true;
 
-	if (f2fs_is_compressed_page(page))
-		return false;
 	if ((S_ISREG(inode->i_mode) && IS_NOQUOTA(inode)) ||
 			page_private_gcing(page))
 		return true;
@@ -338,18 +336,7 @@
 
 	bio_for_each_segment_all(bvec, bio, iter_all) {
 		struct page *page = bvec->bv_page;
-		enum count_type type = WB_DATA_TYPE(page);
-
-		if (page_private_dummy(page)) {
-			clear_page_private_dummy(page);
-			unlock_page(page);
-			mempool_free(page, sbi->write_io_dummy);
-
-			if (unlikely(bio->bi_status))
-				f2fs_stop_checkpoint(sbi, true,
-						STOP_CP_REASON_WRITE_FAIL);
-			continue;
-		}
+		enum count_type type = WB_DATA_TYPE(page, false);
 
 		fscrypt_finalize_bounce_page(&page);
 
@@ -524,50 +511,13 @@
 	submit_bio(bio);
 }
 
-static void f2fs_align_write_bio(struct f2fs_sb_info *sbi, struct bio *bio)
-{
-	unsigned int start =
-		(bio->bi_iter.bi_size >> F2FS_BLKSIZE_BITS) % F2FS_IO_SIZE(sbi);
-
-	if (start == 0)
-		return;
-
-	/* fill dummy pages */
-	for (; start < F2FS_IO_SIZE(sbi); start++) {
-		struct page *page =
-			mempool_alloc(sbi->write_io_dummy,
-				      GFP_NOIO | __GFP_NOFAIL);
-		f2fs_bug_on(sbi, !page);
-
-		lock_page(page);
-
-		zero_user_segment(page, 0, PAGE_SIZE);
-		set_page_private_dummy(page);
-
-		if (bio_add_page(bio, page, PAGE_SIZE, 0) < PAGE_SIZE)
-			f2fs_bug_on(sbi, 1);
-	}
-}
-
 static void f2fs_submit_write_bio(struct f2fs_sb_info *sbi, struct bio *bio,
 				  enum page_type type)
 {
 	WARN_ON_ONCE(is_read_io(bio_op(bio)));
 
-	if (type == DATA || type == NODE) {
-		if (f2fs_lfs_mode(sbi) && current->plug)
-			blk_finish_plug(current->plug);
-
-		if (F2FS_IO_ALIGNED(sbi)) {
-			f2fs_align_write_bio(sbi, bio);
-			/*
-			 * In the NODE case, we lose next block address chain.
-			 * So, we need to do checkpoint in f2fs_sync_file.
-			 */
-			if (type == NODE)
-				set_sbi_flag(sbi, SBI_NEED_CP);
-		}
-	}
+	if (f2fs_lfs_mode(sbi) && current->plug && PAGE_TYPE_ON_MAIN(type))
+		blk_finish_plug(current->plug);
 
 	trace_f2fs_submit_write_bio(sbi->sb, type, bio);
 	iostat_update_submit_ctx(bio, type);
@@ -762,7 +712,7 @@
 		wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
 
 	inc_page_count(fio->sbi, is_read_io(fio->op) ?
-			__read_io_type(page) : WB_DATA_TYPE(fio->page));
+			__read_io_type(page) : WB_DATA_TYPE(fio->page, false));
 
 	if (is_read_io(bio_op(bio)))
 		f2fs_submit_read_bio(fio->sbi, bio, fio->type);
@@ -796,16 +746,6 @@
 					block_t last_blkaddr,
 					block_t cur_blkaddr)
 {
-	if (F2FS_IO_ALIGNED(sbi) && (fio->type == DATA || fio->type == NODE)) {
-		unsigned int filled_blocks =
-				F2FS_BYTES_TO_BLK(bio->bi_iter.bi_size);
-		unsigned int io_size = F2FS_IO_SIZE(sbi);
-		unsigned int left_vecs = bio->bi_max_vecs - bio->bi_vcnt;
-
-		/* IOs in bio is aligned and left space of vectors is not enough */
-		if (!(filled_blocks % io_size) && left_vecs < io_size)
-			return false;
-	}
 	if (!page_is_mergeable(sbi, bio, last_blkaddr, cur_blkaddr))
 		return false;
 	return io_type_is_mergeable(io, fio);
@@ -973,7 +913,7 @@
 	if (fio->io_wbc)
 		wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
 
-	inc_page_count(fio->sbi, WB_DATA_TYPE(page));
+	inc_page_count(fio->sbi, WB_DATA_TYPE(page, false));
 
 	*fio->last_block = fio->new_blkaddr;
 	*fio->bio = bio;
@@ -984,6 +924,7 @@
 #ifdef CONFIG_BLK_DEV_ZONED
 static bool is_end_zone_blkaddr(struct f2fs_sb_info *sbi, block_t blkaddr)
 {
+	struct block_device *bdev = sbi->sb->s_bdev;
 	int devi = 0;
 
 	if (f2fs_is_multi_device(sbi)) {
@@ -994,8 +935,9 @@
 			return false;
 		}
 		blkaddr -= FDEV(devi).start_blk;
+		bdev = FDEV(devi).bdev;
 	}
-	return bdev_is_zoned(FDEV(devi).bdev) &&
+	return bdev_is_zoned(bdev) &&
 		f2fs_blkz_is_seq(sbi, devi, blkaddr) &&
 		(blkaddr % sbi->blocks_per_blkz == sbi->blocks_per_blkz - 1);
 }
@@ -1007,11 +949,12 @@
 	enum page_type btype = PAGE_TYPE_OF_BIO(fio->type);
 	struct f2fs_bio_info *io = sbi->write_io[btype] + fio->temp;
 	struct page *bio_page;
+	enum count_type type;
 
 	f2fs_bug_on(sbi, is_read_io(fio->op));
 
 	f2fs_down_write(&io->io_rwsem);
-
+next:
 #ifdef CONFIG_BLK_DEV_ZONED
 	if (f2fs_sb_has_blkzoned(sbi) && btype < META && io->zone_pending_bio) {
 		wait_for_completion_io(&io->zone_wait);
@@ -1021,7 +964,6 @@
 	}
 #endif
 
-next:
 	if (fio->in_list) {
 		spin_lock(&io->io_lock);
 		if (list_empty(&io->io_list)) {
@@ -1046,7 +988,8 @@
 	/* set submitted = true as a return value */
 	fio->submitted = 1;
 
-	inc_page_count(sbi, WB_DATA_TYPE(bio_page));
+	type = WB_DATA_TYPE(bio_page, fio->compressed_page);
+	inc_page_count(sbi, type);
 
 	if (io->bio &&
 	    (!io_is_mergeable(sbi, io->bio, io, fio, io->last_block_in_bio,
@@ -1056,13 +999,6 @@
 		__submit_merged_bio(io);
 alloc_new:
 	if (io->bio == NULL) {
-		if (F2FS_IO_ALIGNED(sbi) &&
-				(fio->type == DATA || fio->type == NODE) &&
-				fio->new_blkaddr & F2FS_IO_SIZE_MASK(sbi)) {
-			dec_page_count(sbi, WB_DATA_TYPE(bio_page));
-			fio->retry = 1;
-			goto skip;
-		}
 		io->bio = __bio_alloc(fio, BIO_MAX_VECS);
 		f2fs_set_bio_crypt_ctx(io->bio, fio->page->mapping->host,
 				       bio_page->index, fio, GFP_NOIO);
@@ -1080,10 +1016,6 @@
 	io->last_block_in_bio = fio->new_blkaddr;
 
 	trace_f2fs_submit_page_write(fio->page, fio);
-skip:
-	if (fio->in_list)
-		goto next;
-out:
 #ifdef CONFIG_BLK_DEV_ZONED
 	if (f2fs_sb_has_blkzoned(sbi) && btype < META &&
 			is_end_zone_blkaddr(sbi, fio->new_blkaddr)) {
@@ -1096,6 +1028,9 @@
 		__submit_merged_bio(io);
 	}
 #endif
+	if (fio->in_list)
+		goto next;
+out:
 	if (is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN) ||
 				!f2fs_is_checkpoint_ready(sbi))
 		__submit_merged_bio(io);
@@ -1218,7 +1153,8 @@
 
 	if (unlikely(is_inode_flag_set(dn->inode, FI_NO_ALLOC)))
 		return -EPERM;
-	if (unlikely((err = inc_valid_block_count(sbi, dn->inode, &count))))
+	err = inc_valid_block_count(sbi, dn->inode, &count, true);
+	if (unlikely(err))
 		return err;
 
 	trace_f2fs_reserve_new_blocks(dn->inode, dn->nid,
@@ -1475,7 +1411,7 @@
 
 	dn->data_blkaddr = f2fs_data_blkaddr(dn);
 	if (dn->data_blkaddr == NULL_ADDR) {
-		err = inc_valid_block_count(sbi, dn->inode, &count);
+		err = inc_valid_block_count(sbi, dn->inode, &count, true);
 		if (unlikely(err))
 			return err;
 	}
@@ -1856,16 +1792,6 @@
 	return true;
 }
 
-static inline u64 bytes_to_blks(struct inode *inode, u64 bytes)
-{
-	return (bytes >> inode->i_blkbits);
-}
-
-static inline u64 blks_to_bytes(struct inode *inode, u64 blks)
-{
-	return (blks << inode->i_blkbits);
-}
-
 static int f2fs_xattr_fiemap(struct inode *inode,
 				struct fiemap_extent_info *fieinfo)
 {
@@ -1891,7 +1817,7 @@
 			return err;
 		}
 
-		phys = blks_to_bytes(inode, ni.blk_addr);
+		phys = F2FS_BLK_TO_BYTES(ni.blk_addr);
 		offset = offsetof(struct f2fs_inode, i_addr) +
 					sizeof(__le32) * (DEF_ADDRS_PER_INODE -
 					get_inline_xattr_addrs(inode));
@@ -1923,7 +1849,7 @@
 			return err;
 		}
 
-		phys = blks_to_bytes(inode, ni.blk_addr);
+		phys = F2FS_BLK_TO_BYTES(ni.blk_addr);
 		len = inode->i_sb->s_blocksize;
 
 		f2fs_put_page(page, 1);
@@ -1939,30 +1865,11 @@
 	return (err < 0 ? err : 0);
 }
 
-static loff_t max_inode_blocks(struct inode *inode)
-{
-	loff_t result = ADDRS_PER_INODE(inode);
-	loff_t leaf_count = ADDRS_PER_BLOCK(inode);
-
-	/* two direct node blocks */
-	result += (leaf_count * 2);
-
-	/* two indirect node blocks */
-	leaf_count *= NIDS_PER_BLOCK;
-	result += (leaf_count * 2);
-
-	/* one double indirect node block */
-	leaf_count *= NIDS_PER_BLOCK;
-	result += leaf_count;
-
-	return result;
-}
-
 int f2fs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 		u64 start, u64 len)
 {
 	struct f2fs_map_blocks map;
-	sector_t start_blk, last_blk;
+	sector_t start_blk, last_blk, blk_len, max_len;
 	pgoff_t next_pgofs;
 	u64 logical = 0, phys = 0, size = 0;
 	u32 flags = 0;
@@ -2004,16 +1911,15 @@
 			goto out;
 	}
 
-	if (bytes_to_blks(inode, len) == 0)
-		len = blks_to_bytes(inode, 1);
-
-	start_blk = bytes_to_blks(inode, start);
-	last_blk = bytes_to_blks(inode, start + len - 1);
+	start_blk = F2FS_BYTES_TO_BLK(start);
+	last_blk = F2FS_BYTES_TO_BLK(start + len - 1);
+	blk_len = last_blk - start_blk + 1;
+	max_len = F2FS_BYTES_TO_BLK(maxbytes) - start_blk;
 
 next:
 	memset(&map, 0, sizeof(map));
 	map.m_lblk = start_blk;
-	map.m_len = bytes_to_blks(inode, len);
+	map.m_len = blk_len;
 	map.m_next_pgofs = &next_pgofs;
 	map.m_seg_type = NO_CHECK_TYPE;
 
@@ -2030,13 +1936,23 @@
 	if (!compr_cluster && !(map.m_flags & F2FS_MAP_FLAGS)) {
 		start_blk = next_pgofs;
 
-		if (blks_to_bytes(inode, start_blk) < blks_to_bytes(inode,
-						max_inode_blocks(inode)))
+		if (F2FS_BLK_TO_BYTES(start_blk) < maxbytes)
 			goto prep_next;
 
 		flags |= FIEMAP_EXTENT_LAST;
 	}
 
+	/*
+	 * current extent may cross boundary of inquiry, increase len to
+	 * requery.
+	 */
+	if (!compr_cluster && (map.m_flags & F2FS_MAP_MAPPED) &&
+				map.m_lblk + map.m_len - 1 == last_blk &&
+				blk_len != max_len) {
+		blk_len = max_len;
+		goto next;
+	}
+
 	compr_appended = false;
 	/* In a case of compressed cluster, append this to the last extent */
 	if (compr_cluster && ((map.m_flags & F2FS_MAP_DELALLOC) ||
@@ -2068,14 +1984,14 @@
 	} else if (compr_appended) {
 		unsigned int appended_blks = cluster_size -
 						count_in_cluster + 1;
-		size += blks_to_bytes(inode, appended_blks);
+		size += F2FS_BLK_TO_BYTES(appended_blks);
 		start_blk += appended_blks;
 		compr_cluster = false;
 	} else {
-		logical = blks_to_bytes(inode, start_blk);
+		logical = F2FS_BLK_TO_BYTES(start_blk);
 		phys = __is_valid_data_blkaddr(map.m_pblk) ?
-			blks_to_bytes(inode, map.m_pblk) : 0;
-		size = blks_to_bytes(inode, map.m_len);
+			F2FS_BLK_TO_BYTES(map.m_pblk) : 0;
+		size = F2FS_BLK_TO_BYTES(map.m_len);
 		flags = 0;
 
 		if (compr_cluster) {
@@ -2083,13 +1999,13 @@
 			count_in_cluster += map.m_len;
 			if (count_in_cluster == cluster_size) {
 				compr_cluster = false;
-				size += blks_to_bytes(inode, 1);
+				size += F2FS_BLKSIZE;
 			}
 		} else if (map.m_flags & F2FS_MAP_DELALLOC) {
 			flags = FIEMAP_EXTENT_UNWRITTEN;
 		}
 
-		start_blk += bytes_to_blks(inode, size);
+		start_blk += F2FS_BYTES_TO_BLK(size);
 	}
 
 prep_next:
@@ -2122,7 +2038,7 @@
 					bool is_readahead)
 {
 	struct bio *bio = *bio_ret;
-	const unsigned blocksize = blks_to_bytes(inode, 1);
+	const unsigned int blocksize = F2FS_BLKSIZE;
 	sector_t block_in_file;
 	sector_t last_block;
 	sector_t last_block_in_file;
@@ -2131,8 +2047,8 @@
 
 	block_in_file = (sector_t)page_index(page);
 	last_block = block_in_file + nr_pages;
-	last_block_in_file = bytes_to_blks(inode,
-			f2fs_readpage_limit(inode) + blocksize - 1);
+	last_block_in_file = F2FS_BYTES_TO_BLK(f2fs_readpage_limit(inode) +
+							blocksize - 1);
 	if (last_block > last_block_in_file)
 		last_block = last_block_in_file;
 
@@ -2234,7 +2150,7 @@
 	struct bio *bio = *bio_ret;
 	unsigned int start_idx = cc->cluster_idx << cc->log_cluster_size;
 	sector_t last_block_in_file;
-	const unsigned blocksize = blks_to_bytes(inode, 1);
+	const unsigned int blocksize = F2FS_BLKSIZE;
 	struct decompress_io_ctx *dic = NULL;
 	struct extent_info ei = {};
 	bool from_dnode = true;
@@ -2243,8 +2159,8 @@
 
 	f2fs_bug_on(sbi, f2fs_cluster_is_empty(cc));
 
-	last_block_in_file = bytes_to_blks(inode,
-			f2fs_readpage_limit(inode) + blocksize - 1);
+	last_block_in_file = F2FS_BYTES_TO_BLK(f2fs_readpage_limit(inode) +
+							blocksize - 1);
 
 	/* get rid of pages beyond EOF */
 	for (i = 0; i < cc->cluster_size; i++) {
@@ -2650,7 +2566,7 @@
 		return true;
 	if (IS_NOQUOTA(inode))
 		return true;
-	if (f2fs_is_atomic_file(inode))
+	if (f2fs_used_in_atomic_write(inode))
 		return true;
 	/* rewrite low ratio compress data w/ OPU mode to avoid fragmentation */
 	if (f2fs_compressed_file(inode) &&
@@ -2668,8 +2584,6 @@
 	if (fio) {
 		if (page_private_gcing(fio->page))
 			return true;
-		if (page_private_dummy(fio->page))
-			return true;
 		if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED) &&
 			f2fs_is_checkpointed_data(sbi, fio->old_blkaddr)))
 			return true;
@@ -2694,10 +2608,13 @@
 	struct dnode_of_data dn;
 	struct node_info ni;
 	bool ipu_force = false;
+	bool atomic_commit;
 	int err = 0;
 
 	/* Use COW inode to make dnode_of_data for atomic write */
-	if (f2fs_is_atomic_file(inode))
+	atomic_commit = f2fs_is_atomic_file(inode) &&
+				page_private_atomic(fio->page);
+	if (atomic_commit)
 		set_new_dnode(&dn, F2FS_I(inode)->cow_inode, NULL, NULL, 0);
 	else
 		set_new_dnode(&dn, inode, NULL, NULL, 0);
@@ -2743,7 +2660,7 @@
 	}
 
 	/* wait for GCed page writeback via META_MAPPING */
-	if (fio->post_read)
+	if (fio->meta_gc)
 		f2fs_wait_on_block_writeback(inode, fio->old_blkaddr);
 
 	/*
@@ -2801,6 +2718,8 @@
 	f2fs_outplace_write_data(&dn, fio);
 	trace_f2fs_do_write_data_page(page, OPU);
 	set_inode_flag(inode, FI_APPEND_WRITE);
+	if (atomic_commit)
+		clear_page_private_atomic(page);
 out_writepage:
 	f2fs_put_dnode(&dn);
 out:
@@ -2838,8 +2757,8 @@
 		.encrypted_page = NULL,
 		.submitted = 0,
 		.compr_blocks = compr_blocks,
-		.need_lock = LOCK_RETRY,
-		.post_read = f2fs_post_read_required(inode) ? 1 : 0,
+		.need_lock = compr_blocks ? LOCK_DONE : LOCK_RETRY,
+		.meta_gc = f2fs_meta_inode_gc_required(inode) ? 1 : 0,
 		.io_type = io_type,
 		.io_wbc = wbc,
 		.bio = bio,
@@ -2919,6 +2838,7 @@
 	if (err == -EAGAIN) {
 		err = f2fs_do_write_data_page(&fio);
 		if (err == -EAGAIN) {
+			f2fs_bug_on(sbi, compr_blocks);
 			fio.need_lock = LOCK_REQ;
 			err = f2fs_do_write_data_page(&fio);
 		}
@@ -3770,6 +3690,9 @@
 
 	set_page_dirty(page);
 
+	if (f2fs_is_atomic_file(inode))
+		set_page_private_atomic(page);
+
 	if (pos + copied > i_size_read(inode) &&
 	    !f2fs_verity_in_progress(inode)) {
 		f2fs_i_size_write(inode, pos + copied);
@@ -3906,25 +3829,34 @@
 	unsigned int blkofs;
 	unsigned int blk_per_sec = BLKS_PER_SEC(sbi);
 	unsigned int secidx = start_blk / blk_per_sec;
-	unsigned int end_sec = secidx + blkcnt / blk_per_sec;
+	unsigned int end_sec;
 	int ret = 0;
 
+	if (!blkcnt)
+		return 0;
+	end_sec = secidx + (blkcnt - 1) / blk_per_sec;
+
 	f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
 	filemap_invalidate_lock(inode->i_mapping);
 
 	set_inode_flag(inode, FI_ALIGNED_WRITE);
 	set_inode_flag(inode, FI_OPU_WRITE);
 
-	for (; secidx < end_sec; secidx++) {
+	for (; secidx <= end_sec; secidx++) {
+		unsigned int blkofs_end = secidx == end_sec ?
+			(blkcnt - 1) % blk_per_sec : blk_per_sec - 1;
+
 		f2fs_down_write(&sbi->pin_sem);
 
-		f2fs_lock_op(sbi);
-		f2fs_allocate_new_section(sbi, CURSEG_COLD_DATA_PINNED, false);
-		f2fs_unlock_op(sbi);
+		ret = f2fs_allocate_pinning_section(sbi);
+		if (ret) {
+			f2fs_up_write(&sbi->pin_sem);
+			break;
+		}
 
 		set_inode_flag(inode, FI_SKIP_WRITES);
 
-		for (blkofs = 0; blkofs < blk_per_sec; blkofs++) {
+		for (blkofs = 0; blkofs <= blkofs_end; blkofs++) {
 			struct page *page;
 			unsigned int blkidx = secidx * blk_per_sec + blkofs;
 
@@ -3966,15 +3898,14 @@
 	struct address_space *mapping = swap_file->f_mapping;
 	struct inode *inode = mapping->host;
 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
-	sector_t cur_lblock;
-	sector_t last_lblock;
-	sector_t pblock;
-	sector_t lowest_pblock = -1;
-	sector_t highest_pblock = 0;
+	block_t cur_lblock;
+	block_t last_lblock;
+	block_t pblock;
+	block_t lowest_pblock = -1;
+	block_t highest_pblock = 0;
 	int nr_extents = 0;
-	unsigned long nr_pblocks;
+	unsigned int nr_pblocks;
 	unsigned int blks_per_sec = BLKS_PER_SEC(sbi);
-	unsigned int sec_blks_mask = BLKS_PER_SEC(sbi) - 1;
 	unsigned int not_aligned = 0;
 	int ret = 0;
 
@@ -3983,7 +3914,7 @@
 	 * to be very smart.
 	 */
 	cur_lblock = 0;
-	last_lblock = bytes_to_blks(inode, i_size_read(inode));
+	last_lblock = F2FS_BYTES_TO_BLK(i_size_read(inode));
 
 	while (cur_lblock < last_lblock && cur_lblock < sis->max) {
 		struct f2fs_map_blocks map;
@@ -4012,28 +3943,35 @@
 		pblock = map.m_pblk;
 		nr_pblocks = map.m_len;
 
-		if ((pblock - SM_I(sbi)->main_blkaddr) & sec_blks_mask ||
-				nr_pblocks & sec_blks_mask) {
+		if ((pblock - SM_I(sbi)->main_blkaddr) % blks_per_sec ||
+				nr_pblocks % blks_per_sec ||
+				!f2fs_valid_pinned_area(sbi, pblock)) {
+			bool last_extent = false;
+
 			not_aligned++;
 
 			nr_pblocks = roundup(nr_pblocks, blks_per_sec);
 			if (cur_lblock + nr_pblocks > sis->max)
 				nr_pblocks -= blks_per_sec;
 
+			/* this extent is last one */
 			if (!nr_pblocks) {
-				/* this extent is last one */
-				nr_pblocks = map.m_len;
-				f2fs_warn(sbi, "Swapfile: last extent is not aligned to section");
-				goto next;
+				nr_pblocks = last_lblock - cur_lblock;
+				last_extent = true;
 			}
 
 			ret = f2fs_migrate_blocks(inode, cur_lblock,
 							nr_pblocks);
-			if (ret)
+			if (ret) {
+				if (ret == -ENOENT)
+					ret = -EINVAL;
 				goto out;
-			goto retry;
+			}
+
+			if (!last_extent)
+				goto retry;
 		}
-next:
+
 		if (cur_lblock + nr_pblocks >= sis->max)
 			nr_pblocks = sis->max - cur_lblock;
 
@@ -4071,17 +4009,17 @@
 				sector_t *span)
 {
 	struct inode *inode = file_inode(file);
+	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 	int ret;
 
 	if (!S_ISREG(inode->i_mode))
 		return -EINVAL;
 
-	if (f2fs_readonly(F2FS_I_SB(inode)->sb))
+	if (f2fs_readonly(sbi->sb))
 		return -EROFS;
 
-	if (f2fs_lfs_mode(F2FS_I_SB(inode))) {
-		f2fs_err(F2FS_I_SB(inode),
-			"Swapfile not supported in LFS mode");
+	if (f2fs_lfs_mode(sbi) && !f2fs_sb_has_blkzoned(sbi)) {
+		f2fs_err(sbi, "Swapfile not supported in LFS mode");
 		return -EINVAL;
 	}
 
@@ -4094,13 +4032,17 @@
 
 	f2fs_precache_extents(inode);
 
+	ret = filemap_fdatawrite(inode->i_mapping);
+	if (ret < 0)
+		return ret;
+
 	ret = check_swap_activate(sis, file, span);
 	if (ret < 0)
 		return ret;
 
 	stat_inc_swapfile_inode(inode);
 	set_inode_flag(inode, FI_PIN_FILE);
-	f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
+	f2fs_update_time(sbi, REQ_TIME);
 	return ret;
 }
 
@@ -4215,8 +4157,8 @@
 	pgoff_t next_pgofs = 0;
 	int err;
 
-	map.m_lblk = bytes_to_blks(inode, offset);
-	map.m_len = bytes_to_blks(inode, offset + length - 1) - map.m_lblk + 1;
+	map.m_lblk = F2FS_BYTES_TO_BLK(offset);
+	map.m_len = F2FS_BYTES_TO_BLK(offset + length - 1) - map.m_lblk + 1;
 	map.m_next_pgofs = &next_pgofs;
 	map.m_seg_type = f2fs_rw_hint_to_seg_type(inode->i_write_hint);
 	if (flags & IOMAP_WRITE)
@@ -4226,7 +4168,7 @@
 	if (err)
 		return err;
 
-	iomap->offset = blks_to_bytes(inode, map.m_lblk);
+	iomap->offset = F2FS_BLK_TO_BYTES(map.m_lblk);
 
 	/*
 	 * When inline encryption is enabled, sometimes I/O to an encrypted file
@@ -4244,16 +4186,16 @@
 	if (WARN_ON_ONCE(map.m_pblk == COMPRESS_ADDR))
 		return -EINVAL;
 
-	if (map.m_pblk != NULL_ADDR) {
-		iomap->length = blks_to_bytes(inode, map.m_len);
+	if (map.m_flags & F2FS_MAP_MAPPED) {
+		iomap->length = F2FS_BLK_TO_BYTES(map.m_len);
 		iomap->type = IOMAP_MAPPED;
 		iomap->flags |= IOMAP_F_MERGED;
 		iomap->bdev = map.m_bdev;
-		iomap->addr = blks_to_bytes(inode, map.m_pblk);
+		iomap->addr = F2FS_BLK_TO_BYTES(map.m_pblk);
 	} else {
 		if (flags & IOMAP_WRITE)
 			return -ENOTBLK;
-		iomap->length = blks_to_bytes(inode, next_pgofs) -
+		iomap->length = F2FS_BLK_TO_BYTES(next_pgofs) -
 				iomap->offset;
 		iomap->type = IOMAP_HOLE;
 		iomap->addr = IOMAP_NULL_ADDR;
--- linux-qcom-6.8.0.orig/fs/f2fs/debug.c
+++ linux-qcom-6.8.0/fs/f2fs/debug.c
@@ -41,7 +41,7 @@
 	total_vblocks = 0;
 	blks_per_sec = CAP_BLKS_PER_SEC(sbi);
 	hblks_per_sec = blks_per_sec / 2;
-	for (segno = 0; segno < MAIN_SEGS(sbi); segno += sbi->segs_per_sec) {
+	for (segno = 0; segno < MAIN_SEGS(sbi); segno += SEGS_PER_SEC(sbi)) {
 		vblocks = get_valid_blocks(sbi, segno, true);
 		dist = abs(vblocks - hblks_per_sec);
 		bimodal += dist * dist;
@@ -135,7 +135,7 @@
 	si->cur_ckpt_time = sbi->cprc_info.cur_time;
 	si->peak_ckpt_time = sbi->cprc_info.peak_time;
 	spin_unlock(&sbi->cprc_info.stat_lock);
-	si->total_count = (int)sbi->user_block_count / sbi->blocks_per_seg;
+	si->total_count = (int)sbi->user_block_count / BLKS_PER_SEG(sbi);
 	si->rsvd_segs = reserved_segments(sbi);
 	si->overp_segs = overprovision_segments(sbi);
 	si->valid_count = valid_user_blocks(sbi);
@@ -208,7 +208,7 @@
 		if (!blks)
 			continue;
 
-		if (blks == sbi->blocks_per_seg)
+		if (blks == BLKS_PER_SEG(sbi))
 			si->full_seg[type]++;
 		else
 			si->dirty_seg[type]++;
@@ -276,7 +276,7 @@
 	/* build nm */
 	si->base_mem += sizeof(struct f2fs_nm_info);
 	si->base_mem += __bitmap_size(sbi, NAT_BITMAP);
-	si->base_mem += (NM_I(sbi)->nat_bits_blocks << F2FS_BLKSIZE_BITS);
+	si->base_mem += F2FS_BLK_TO_BYTES(NM_I(sbi)->nat_bits_blocks);
 	si->base_mem += NM_I(sbi)->nat_blocks *
 				f2fs_bitmap_size(NAT_ENTRY_PER_BLOCK);
 	si->base_mem += NM_I(sbi)->nat_blocks / 8;
--- linux-qcom-6.8.0.orig/fs/f2fs/dir.c
+++ linux-qcom-6.8.0/fs/f2fs/dir.c
@@ -157,7 +157,8 @@
 	unsigned long bidx = 0;
 
 	for (i = 0; i < level; i++)
-		bidx += dir_buckets(i, dir_level) * bucket_blocks(i);
+		bidx += mul_u32_u32(dir_buckets(i, dir_level),
+				    bucket_blocks(i));
 	bidx += idx * bucket_blocks(level);
 	return bidx;
 }
@@ -830,13 +831,14 @@
 	return err;
 }
 
-int f2fs_do_tmpfile(struct inode *inode, struct inode *dir)
+int f2fs_do_tmpfile(struct inode *inode, struct inode *dir,
+					struct f2fs_filename *fname)
 {
 	struct page *page;
 	int err = 0;
 
 	f2fs_down_write(&F2FS_I(inode)->i_sem);
-	page = f2fs_init_inode_metadata(inode, dir, NULL, NULL);
+	page = f2fs_init_inode_metadata(inode, dir, fname, NULL);
 	if (IS_ERR(page)) {
 		err = PTR_ERR(page);
 		goto fail;
@@ -995,9 +997,8 @@
 		de = &d->dentry[bit_pos];
 		if (de->name_len == 0) {
 			if (found_valid_dirent || !bit_pos) {
-				printk_ratelimited(
-					"%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix.",
-					KERN_WARNING, sbi->sb->s_id,
+				f2fs_warn_ratelimited(sbi,
+					"invalid namelen(0), ino:%u, run fsck to fix.",
 					le32_to_cpu(de->ino));
 				set_sbi_flag(sbi, SBI_NEED_FSCK);
 			}
--- linux-qcom-6.8.0.orig/fs/f2fs/extent_cache.c
+++ linux-qcom-6.8.0/fs/f2fs/extent_cache.c
@@ -19,34 +19,24 @@
 #include "node.h"
 #include <trace/events/f2fs.h>
 
-bool sanity_check_extent_cache(struct inode *inode)
+bool sanity_check_extent_cache(struct inode *inode, struct page *ipage)
 {
 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
-	struct f2fs_inode_info *fi = F2FS_I(inode);
-	struct extent_tree *et = fi->extent_tree[EX_READ];
-	struct extent_info *ei;
+	struct f2fs_extent *i_ext = &F2FS_INODE(ipage)->i_ext;
+	struct extent_info ei;
 
-	if (!et)
-		return true;
+	get_read_extent_info(&ei, i_ext);
 
-	ei = &et->largest;
-	if (!ei->len)
+	if (!ei.len)
 		return true;
 
-	/* Let's drop, if checkpoint got corrupted. */
-	if (is_set_ckpt_flags(sbi, CP_ERROR_FLAG)) {
-		ei->len = 0;
-		et->largest_updated = true;
-		return true;
-	}
-
-	if (!f2fs_is_valid_blkaddr(sbi, ei->blk, DATA_GENERIC_ENHANCE) ||
-	    !f2fs_is_valid_blkaddr(sbi, ei->blk + ei->len - 1,
+	if (!f2fs_is_valid_blkaddr(sbi, ei.blk, DATA_GENERIC_ENHANCE) ||
+	    !f2fs_is_valid_blkaddr(sbi, ei.blk + ei.len - 1,
 					DATA_GENERIC_ENHANCE)) {
 		set_sbi_flag(sbi, SBI_NEED_FSCK);
 		f2fs_warn(sbi, "%s: inode (ino=%lx) extent info [%u, %u, %u] is incorrect, run fsck to fix",
 			  __func__, inode->i_ino,
-			  ei->blk, ei->fofs, ei->len);
+			  ei.blk, ei.fofs, ei.len);
 		return false;
 	}
 	return true;
@@ -357,27 +347,28 @@
 }
 
 static unsigned int __free_extent_tree(struct f2fs_sb_info *sbi,
-					struct extent_tree *et)
+				struct extent_tree *et, unsigned int nr_shrink)
 {
 	struct rb_node *node, *next;
 	struct extent_node *en;
-	unsigned int count = atomic_read(&et->node_cnt);
+	unsigned int count;
 
 	node = rb_first_cached(&et->root);
-	while (node) {
+
+	for (count = 0; node && count < nr_shrink; count++) {
 		next = rb_next(node);
 		en = rb_entry(node, struct extent_node, rb_node);
 		__release_extent_node(sbi, et, en);
 		node = next;
 	}
 
-	return count - atomic_read(&et->node_cnt);
+	return count;
 }
 
 static void __drop_largest_extent(struct extent_tree *et,
 					pgoff_t fofs, unsigned int len)
 {
-	if (fofs < et->largest.fofs + et->largest.len &&
+	if (fofs < (pgoff_t)et->largest.fofs + et->largest.len &&
 			fofs + len > et->largest.fofs) {
 		et->largest.len = 0;
 		et->largest_updated = true;
@@ -395,24 +386,22 @@
 
 	if (!__may_extent_tree(inode, EX_READ)) {
 		/* drop largest read extent */
-		if (i_ext && i_ext->len) {
+		if (i_ext->len) {
 			f2fs_wait_on_page_writeback(ipage, NODE, true, true);
 			i_ext->len = 0;
 			set_page_dirty(ipage);
 		}
-		goto out;
+		set_inode_flag(inode, FI_NO_EXTENT);
+		return;
 	}
 
 	et = __grab_extent_tree(inode, EX_READ);
 
-	if (!i_ext || !i_ext->len)
-		goto out;
-
 	get_read_extent_info(&ei, i_ext);
 
 	write_lock(&et->lock);
-	if (atomic_read(&et->node_cnt))
-		goto unlock_out;
+	if (atomic_read(&et->node_cnt) || !ei.len)
+		goto skip;
 
 	en = __attach_extent_node(sbi, et, &ei, NULL,
 				&et->root.rb_root.rb_node, true);
@@ -424,11 +413,13 @@
 		list_add_tail(&en->list, &eti->extent_list);
 		spin_unlock(&eti->extent_lock);
 	}
-unlock_out:
+skip:
+	/* Let's drop, if checkpoint got corrupted. */
+	if (f2fs_cp_error(sbi)) {
+		et->largest.len = 0;
+		et->largest_updated = true;
+	}
 	write_unlock(&et->lock);
-out:
-	if (!F2FS_I(inode)->extent_tree[EX_READ])
-		set_inode_flag(inode, FI_NO_EXTENT);
 }
 
 void f2fs_init_age_extent_tree(struct inode *inode)
@@ -467,7 +458,7 @@
 
 	if (type == EX_READ &&
 			et->largest.fofs <= pgofs &&
-			et->largest.fofs + et->largest.len > pgofs) {
+			(pgoff_t)et->largest.fofs + et->largest.len > pgofs) {
 		*ei = et->largest;
 		ret = true;
 		stat_inc_largest_node_hit(sbi);
@@ -590,6 +581,30 @@
 	return en;
 }
 
+static unsigned int __destroy_extent_node(struct inode *inode,
+					enum extent_type type)
+{
+	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+	struct extent_tree *et = F2FS_I(inode)->extent_tree[type];
+	unsigned int nr_shrink = type == EX_READ ?
+				READ_EXTENT_CACHE_SHRINK_NUMBER :
+				AGE_EXTENT_CACHE_SHRINK_NUMBER;
+	unsigned int node_cnt = 0;
+
+	if (!et || !atomic_read(&et->node_cnt))
+		return 0;
+
+	while (atomic_read(&et->node_cnt)) {
+		write_lock(&et->lock);
+		node_cnt += __free_extent_tree(sbi, et, nr_shrink);
+		write_unlock(&et->lock);
+	}
+
+	f2fs_bug_on(sbi, atomic_read(&et->node_cnt));
+
+	return node_cnt;
+}
+
 static void __update_extent_tree_range(struct inode *inode,
 			struct extent_info *tei, enum extent_type type)
 {
@@ -728,9 +743,6 @@
 		}
 	}
 
-	if (is_inode_flag_set(inode, FI_NO_EXTENT))
-		__free_extent_tree(sbi, et);
-
 	if (et->largest_updated) {
 		et->largest_updated = false;
 		updated = true;
@@ -748,6 +760,9 @@
 out_read_extent_cache:
 	write_unlock(&et->lock);
 
+	if (is_inode_flag_set(inode, FI_NO_EXTENT))
+		__destroy_extent_node(inode, EX_READ);
+
 	if (updated)
 		f2fs_mark_inode_dirty_sync(inode, true);
 }
@@ -912,10 +927,14 @@
 	list_for_each_entry_safe(et, next, &eti->zombie_list, list) {
 		if (atomic_read(&et->node_cnt)) {
 			write_lock(&et->lock);
-			node_cnt += __free_extent_tree(sbi, et);
+			node_cnt += __free_extent_tree(sbi, et,
+					nr_shrink - node_cnt - tree_cnt);
 			write_unlock(&et->lock);
 		}
-		f2fs_bug_on(sbi, atomic_read(&et->node_cnt));
+
+		if (atomic_read(&et->node_cnt))
+			goto unlock_out;
+
 		list_del_init(&et->list);
 		radix_tree_delete(&eti->extent_tree_root, et->ino);
 		kmem_cache_free(extent_tree_slab, et);
@@ -1054,23 +1073,6 @@
 	return __shrink_extent_tree(sbi, nr_shrink, EX_BLOCK_AGE);
 }
 
-static unsigned int __destroy_extent_node(struct inode *inode,
-					enum extent_type type)
-{
-	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
-	struct extent_tree *et = F2FS_I(inode)->extent_tree[type];
-	unsigned int node_cnt = 0;
-
-	if (!et || !atomic_read(&et->node_cnt))
-		return 0;
-
-	write_lock(&et->lock);
-	node_cnt = __free_extent_tree(sbi, et);
-	write_unlock(&et->lock);
-
-	return node_cnt;
-}
-
 void f2fs_destroy_extent_node(struct inode *inode)
 {
 	__destroy_extent_node(inode, EX_READ);
@@ -1079,7 +1081,6 @@
 
 static void __drop_extent_tree(struct inode *inode, enum extent_type type)
 {
-	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 	struct extent_tree *et = F2FS_I(inode)->extent_tree[type];
 	bool updated = false;
 
@@ -1087,7 +1088,6 @@
 		return;
 
 	write_lock(&et->lock);
-	__free_extent_tree(sbi, et);
 	if (type == EX_READ) {
 		set_inode_flag(inode, FI_NO_EXTENT);
 		if (et->largest.len) {
@@ -1096,6 +1096,9 @@
 		}
 	}
 	write_unlock(&et->lock);
+
+	__destroy_extent_node(inode, type);
+
 	if (updated)
 		f2fs_mark_inode_dirty_sync(inode, true);
 }
--- linux-qcom-6.8.0.orig/fs/f2fs/f2fs.h
+++ linux-qcom-6.8.0/fs/f2fs/f2fs.h
@@ -69,12 +69,17 @@
 
 struct f2fs_fault_info {
 	atomic_t inject_ops;
-	unsigned int inject_rate;
+	int inject_rate;
 	unsigned int inject_type;
 };
 
 extern const char *f2fs_fault_name[FAULT_MAX];
 #define IS_FAULT_SET(fi, type) ((fi)->inject_type & BIT(type))
+
+/* maximum retry count for injected failure */
+#define DEFAULT_FAILURE_RETRY_COUNT		8
+#else
+#define DEFAULT_FAILURE_RETRY_COUNT		1
 #endif
 
 /*
@@ -126,6 +131,12 @@
 
 #define COMPRESS_EXT_NUM		16
 
+enum blkzone_allocation_policy {
+	BLKZONE_ALLOC_PRIOR_SEQ,	/* Prioritize writing to sequential zones */
+	BLKZONE_ALLOC_ONLY_SEQ,		/* Only allow writing to sequential zones */
+	BLKZONE_ALLOC_PRIOR_CONV,	/* Prioritize writing to conventional zones */
+};
+
 /*
  * An implementation of an rwsem that is explicitly unfair to readers. This
  * prevents priority inversion when a low-priority reader acquires the read lock
@@ -142,7 +153,6 @@
 
 struct f2fs_mount_info {
 	unsigned int opt;
-	int write_io_size_bits;		/* Write IO size bits */
 	block_t root_reserved_blocks;	/* root reserved blocks */
 	kuid_t s_resuid;		/* reserved blocks for uid */
 	kgid_t s_resgid;		/* reserved blocks for gid */
@@ -278,6 +288,7 @@
 	APPEND_INO,		/* for append ino list */
 	UPDATE_INO,		/* for update ino list */
 	TRANS_DIR_INO,		/* for transactions dir ino list */
+	XATTR_DIR_INO,		/* for xattr updated dir ino list */
 	FLUSH_INO,		/* for multiple device flushing */
 	MAX_INO_ENTRY,		/* max. list */
 };
@@ -782,7 +793,6 @@
 	FI_NEED_IPU,		/* used for ipu per file */
 	FI_ATOMIC_FILE,		/* indicate atomic file */
 	FI_DATA_EXIST,		/* indicate data exists */
-	FI_INLINE_DOTS,		/* indicate inline dot dentries */
 	FI_SKIP_WRITES,		/* should skip data page writeback */
 	FI_OPU_WRITE,		/* used for opu per file */
 	FI_DIRTY_FILE,		/* indicate regular/symlink has dirty pages */
@@ -800,7 +810,9 @@
 	FI_ALIGNED_WRITE,	/* enable aligned write */
 	FI_COW_FILE,		/* indicate COW file */
 	FI_ATOMIC_COMMITTED,	/* indicate atomic commit completed except disk sync */
+	FI_ATOMIC_DIRTIED,	/* indicate atomic file is dirtied */
 	FI_ATOMIC_REPLACE,	/* indicate atomic replace */
+	FI_OPENED_FILE,		/* indicate file has been opened */
 	FI_MAX,			/* max flag, never be used */
 };
 
@@ -829,7 +841,7 @@
 	spinlock_t i_size_lock;		/* protect last_disk_size */
 
 #ifdef CONFIG_QUOTA
-	struct dquot *i_dquot[MAXQUOTAS];
+	struct dquot __rcu *i_dquot[MAXQUOTAS];
 
 	/* quota space reservation, managed internally by quota code */
 	qsize_t i_reserved_quota;
@@ -839,7 +851,11 @@
 	struct task_struct *atomic_write_task;	/* store atomic write task */
 	struct extent_tree *extent_tree[NR_EXTENT_CACHES];
 					/* cached extent_tree entry */
-	struct inode *cow_inode;	/* copy-on-write inode for atomic write */
+	union {
+		struct inode *cow_inode;	/* copy-on-write inode for atomic write */
+		struct inode *atomic_inode;
+					/* point to atomic_inode, available only for cow_inode */
+	};
 
 	/* avoid racing between foreground op and gc */
 	struct f2fs_rwsem i_gc_rwsem[2];
@@ -1080,7 +1096,8 @@
  * f2fs monitors the number of several block types such as on-writeback,
  * dirty dentry blocks, dirty node blocks, and dirty meta blocks.
  */
-#define WB_DATA_TYPE(p)	(__is_cp_guaranteed(p) ? F2FS_WB_CP_DATA : F2FS_WB_DATA)
+#define WB_DATA_TYPE(p, f)			\
+	(f || f2fs_is_cp_guaranteed(p) ? F2FS_WB_CP_DATA : F2FS_WB_DATA)
 enum count_type {
 	F2FS_DIRTY_DENTS,
 	F2FS_DIRTY_DATA,
@@ -1110,6 +1127,7 @@
  * ...			Only can be used with META.
  */
 #define PAGE_TYPE_OF_BIO(type)	((type) > META ? META : (type))
+#define PAGE_TYPE_ON_MAIN(type)	((type) == DATA || (type) == NODE)
 enum page_type {
 	DATA = 0,
 	NODE = 1,	/* should not change this */
@@ -1145,6 +1163,7 @@
 	CP_FASTBOOT_MODE,
 	CP_SPEC_LOG_NUM,
 	CP_RECOVER_DIR,
+	CP_XATTR_DIR,
 };
 
 enum iostat_type {
@@ -1204,9 +1223,8 @@
 	unsigned int submitted:1;	/* indicate IO submission */
 	unsigned int in_list:1;		/* indicate fio is in io_list */
 	unsigned int is_por:1;		/* indicate IO is from recovery or not */
-	unsigned int retry:1;		/* need to reallocate block address */
 	unsigned int encrypted:1;	/* indicate file is encrypted */
-	unsigned int post_read:1;	/* require post read */
+	unsigned int meta_gc:1;		/* require meta inode GC */
 	enum iostat_type io_type;	/* io type */
 	struct writeback_control *io_wbc; /* writeback control */
 	struct bio **bio;		/* bio for ipu */
@@ -1284,6 +1302,7 @@
 	bool no_bg_gc;			/* check the space and stop bg_gc */
 	bool should_migrate_blocks;	/* should migrate blocks */
 	bool err_gc_skipped;		/* return EAGAIN if GC skipped */
+	bool one_time;			/* require one time GC in one migration unit */
 	unsigned int nr_free_secs;	/* # of free sections to do GC */
 };
 
@@ -1406,10 +1425,10 @@
  * Layout A: lowest bit should be 1
  * | bit0 = 1 | bit1 | bit2 | ... | bit MAX | private data .... |
  * bit 0	PAGE_PRIVATE_NOT_POINTER
- * bit 1	PAGE_PRIVATE_DUMMY_WRITE
- * bit 2	PAGE_PRIVATE_ONGOING_MIGRATION
- * bit 3	PAGE_PRIVATE_INLINE_INODE
- * bit 4	PAGE_PRIVATE_REF_RESOURCE
+ * bit 1	PAGE_PRIVATE_ONGOING_MIGRATION
+ * bit 2	PAGE_PRIVATE_INLINE_INODE
+ * bit 3	PAGE_PRIVATE_REF_RESOURCE
+ * bit 4	PAGE_PRIVATE_ATOMIC_WRITE
  * bit 5-	f2fs private data
  *
  * Layout B: lowest bit should be 0
@@ -1417,10 +1436,10 @@
  */
 enum {
 	PAGE_PRIVATE_NOT_POINTER,		/* private contains non-pointer data */
-	PAGE_PRIVATE_DUMMY_WRITE,		/* data page for padding aligned IO */
 	PAGE_PRIVATE_ONGOING_MIGRATION,		/* data page which is on-going migrating */
 	PAGE_PRIVATE_INLINE_INODE,		/* inode page contains inline data */
 	PAGE_PRIVATE_REF_RESOURCE,		/* dirty page has referenced resources */
+	PAGE_PRIVATE_ATOMIC_WRITE,		/* data page from atomic write path */
 	PAGE_PRIVATE_MAX
 };
 
@@ -1551,6 +1570,9 @@
 
 #ifdef CONFIG_BLK_DEV_ZONED
 	unsigned int blocks_per_blkz;		/* F2FS blocks per zone */
+	unsigned int max_open_zones;		/* max open zone resources of the zoned device */
+	/* For adjust the priority writing position of data in zone UFS */
+	unsigned int blkzone_alloc_policy;
 #endif
 
 	/* for node-related operations */
@@ -1564,7 +1586,6 @@
 	struct f2fs_bio_info *write_io[NR_PAGE_TYPE];	/* for write bios */
 	/* keep migration IO order for LFS mode */
 	struct f2fs_rwsem io_order_lock;
-	mempool_t *write_io_dummy;		/* Dummy pages */
 	pgoff_t page_eio_ofs[NR_PAGE_TYPE];	/* EIO page offset */
 	int page_eio_cnt[NR_PAGE_TYPE];		/* EIO count */
 
@@ -1678,6 +1699,8 @@
 	unsigned int max_victim_search;
 	/* migration granularity of garbage collection, unit: segment */
 	unsigned int migration_granularity;
+	/* migration window granularity of garbage collection, unit: segment */
+	unsigned int migration_window_granularity;
 
 	/*
 	 * for stat information.
@@ -1810,6 +1833,35 @@
 #endif
 };
 
+/* Definitions to access f2fs_sb_info */
+#define BLKS_PER_SEG(sbi)					\
+	((sbi)->blocks_per_seg)
+#define BLKS_PER_SEC(sbi)					\
+	((sbi)->segs_per_sec << (sbi)->log_blocks_per_seg)
+#define SEGS_PER_SEC(sbi)					\
+	((sbi)->segs_per_sec)
+
+__printf(3, 4)
+void f2fs_printk(struct f2fs_sb_info *sbi, bool limit_rate, const char *fmt, ...);
+
+#define f2fs_err(sbi, fmt, ...)						\
+	f2fs_printk(sbi, false, KERN_ERR fmt, ##__VA_ARGS__)
+#define f2fs_warn(sbi, fmt, ...)					\
+	f2fs_printk(sbi, false, KERN_WARNING fmt, ##__VA_ARGS__)
+#define f2fs_notice(sbi, fmt, ...)					\
+	f2fs_printk(sbi, false, KERN_NOTICE fmt, ##__VA_ARGS__)
+#define f2fs_info(sbi, fmt, ...)					\
+	f2fs_printk(sbi, false, KERN_INFO fmt, ##__VA_ARGS__)
+#define f2fs_debug(sbi, fmt, ...)					\
+	f2fs_printk(sbi, false, KERN_DEBUG fmt, ##__VA_ARGS__)
+
+#define f2fs_err_ratelimited(sbi, fmt, ...)				\
+	f2fs_printk(sbi, true, KERN_ERR fmt, ##__VA_ARGS__)
+#define f2fs_warn_ratelimited(sbi, fmt, ...)				\
+	f2fs_printk(sbi, true, KERN_WARNING fmt, ##__VA_ARGS__)
+#define f2fs_info_ratelimited(sbi, fmt, ...)				\
+	f2fs_printk(sbi, true, KERN_INFO fmt, ##__VA_ARGS__)
+
 #ifdef CONFIG_F2FS_FAULT_INJECTION
 #define time_to_inject(sbi, type) __time_to_inject(sbi, type, __func__,	\
 									__builtin_return_address(0))
@@ -1827,9 +1879,8 @@
 	atomic_inc(&ffi->inject_ops);
 	if (atomic_read(&ffi->inject_ops) >= ffi->inject_rate) {
 		atomic_set(&ffi->inject_ops, 0);
-		printk_ratelimited("%sF2FS-fs (%s) : inject %s in %s of %pS\n",
-			KERN_INFO, sbi->sb->s_id, f2fs_fault_name[type],
-			func, parent_func);
+		f2fs_info_ratelimited(sbi, "inject %s in %s of %pS",
+				f2fs_fault_name[type], func, parent_func);
 		return true;
 	}
 	return false;
@@ -2249,11 +2300,32 @@
 	return false;
 }
 
+static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
+						struct inode *inode, bool cap)
+{
+	block_t avail_user_block_count;
+
+	avail_user_block_count = sbi->user_block_count -
+					sbi->current_reserved_blocks;
+
+	if (!__allow_reserved_blocks(sbi, inode, cap))
+		avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
+
+	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
+		if (avail_user_block_count > sbi->unusable_block_count)
+			avail_user_block_count -= sbi->unusable_block_count;
+		else
+			avail_user_block_count = 0;
+	}
+
+	return avail_user_block_count;
+}
+
 static inline void f2fs_i_blocks_write(struct inode *, block_t, bool, bool);
 static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
-				 struct inode *inode, blkcnt_t *count)
+				 struct inode *inode, blkcnt_t *count, bool partial)
 {
-	blkcnt_t diff = 0, release = 0;
+	long long diff = 0, release = 0;
 	block_t avail_user_block_count;
 	int ret;
 
@@ -2273,35 +2345,27 @@
 	percpu_counter_add(&sbi->alloc_valid_block_count, (*count));
 
 	spin_lock(&sbi->stat_lock);
-	sbi->total_valid_block_count += (block_t)(*count);
-	avail_user_block_count = sbi->user_block_count -
-					sbi->current_reserved_blocks;
 
-	if (!__allow_reserved_blocks(sbi, inode, true))
-		avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
-
-	if (F2FS_IO_ALIGNED(sbi))
-		avail_user_block_count -= sbi->blocks_per_seg *
-				SM_I(sbi)->additional_reserved_segments;
-
-	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
-		if (avail_user_block_count > sbi->unusable_block_count)
-			avail_user_block_count -= sbi->unusable_block_count;
-		else
-			avail_user_block_count = 0;
-	}
-	if (unlikely(sbi->total_valid_block_count > avail_user_block_count)) {
-		diff = sbi->total_valid_block_count - avail_user_block_count;
+	avail_user_block_count = get_available_block_count(sbi, inode, true);
+	diff = (long long)sbi->total_valid_block_count + *count -
+						avail_user_block_count;
+	if (unlikely(diff > 0)) {
+		if (!partial) {
+			spin_unlock(&sbi->stat_lock);
+			release = *count;
+			goto enospc;
+		}
 		if (diff > *count)
 			diff = *count;
 		*count -= diff;
 		release = diff;
-		sbi->total_valid_block_count -= diff;
 		if (!*count) {
 			spin_unlock(&sbi->stat_lock);
 			goto enospc;
 		}
 	}
+	sbi->total_valid_block_count += (block_t)(*count);
+
 	spin_unlock(&sbi->stat_lock);
 
 	if (unlikely(release)) {
@@ -2318,20 +2382,6 @@
 	return -ENOSPC;
 }
 
-__printf(2, 3)
-void f2fs_printk(struct f2fs_sb_info *sbi, const char *fmt, ...);
-
-#define f2fs_err(sbi, fmt, ...)						\
-	f2fs_printk(sbi, KERN_ERR fmt, ##__VA_ARGS__)
-#define f2fs_warn(sbi, fmt, ...)					\
-	f2fs_printk(sbi, KERN_WARNING fmt, ##__VA_ARGS__)
-#define f2fs_notice(sbi, fmt, ...)					\
-	f2fs_printk(sbi, KERN_NOTICE fmt, ##__VA_ARGS__)
-#define f2fs_info(sbi, fmt, ...)					\
-	f2fs_printk(sbi, KERN_INFO fmt, ##__VA_ARGS__)
-#define f2fs_debug(sbi, fmt, ...)					\
-	f2fs_printk(sbi, KERN_DEBUG fmt, ##__VA_ARGS__)
-
 #define PAGE_PRIVATE_GET_FUNC(name, flagname) \
 static inline bool page_private_##name(struct page *page) \
 { \
@@ -2360,17 +2410,17 @@
 PAGE_PRIVATE_GET_FUNC(nonpointer, NOT_POINTER);
 PAGE_PRIVATE_GET_FUNC(inline, INLINE_INODE);
 PAGE_PRIVATE_GET_FUNC(gcing, ONGOING_MIGRATION);
-PAGE_PRIVATE_GET_FUNC(dummy, DUMMY_WRITE);
+PAGE_PRIVATE_GET_FUNC(atomic, ATOMIC_WRITE);
 
 PAGE_PRIVATE_SET_FUNC(reference, REF_RESOURCE);
 PAGE_PRIVATE_SET_FUNC(inline, INLINE_INODE);
 PAGE_PRIVATE_SET_FUNC(gcing, ONGOING_MIGRATION);
-PAGE_PRIVATE_SET_FUNC(dummy, DUMMY_WRITE);
+PAGE_PRIVATE_SET_FUNC(atomic, ATOMIC_WRITE);
 
 PAGE_PRIVATE_CLEAR_FUNC(reference, REF_RESOURCE);
 PAGE_PRIVATE_CLEAR_FUNC(inline, INLINE_INODE);
 PAGE_PRIVATE_CLEAR_FUNC(gcing, ONGOING_MIGRATION);
-PAGE_PRIVATE_CLEAR_FUNC(dummy, DUMMY_WRITE);
+PAGE_PRIVATE_CLEAR_FUNC(atomic, ATOMIC_WRITE);
 
 static inline unsigned long get_page_private_data(struct page *page)
 {
@@ -2402,6 +2452,7 @@
 	clear_page_private_reference(page);
 	clear_page_private_gcing(page);
 	clear_page_private_inline(page);
+	clear_page_private_atomic(page);
 
 	f2fs_bug_on(F2FS_P_SB(page), page_private(page));
 }
@@ -2504,11 +2555,8 @@
 
 static inline int get_blocktype_secs(struct f2fs_sb_info *sbi, int block_type)
 {
-	unsigned int pages_per_sec = sbi->segs_per_sec * sbi->blocks_per_seg;
-	unsigned int segs = (get_pages(sbi, block_type) + pages_per_sec - 1) >>
-						sbi->log_blocks_per_seg;
-
-	return segs / sbi->segs_per_sec;
+	return div_u64(get_pages(sbi, block_type) + BLKS_PER_SEC(sbi) - 1,
+							BLKS_PER_SEC(sbi));
 }
 
 static inline block_t valid_user_blocks(struct f2fs_sb_info *sbi)
@@ -2572,7 +2620,7 @@
 	block_t start_addr = le32_to_cpu(F2FS_RAW_SUPER(sbi)->cp_blkaddr);
 
 	if (sbi->cur_cp_pack == 2)
-		start_addr += sbi->blocks_per_seg;
+		start_addr += BLKS_PER_SEG(sbi);
 	return start_addr;
 }
 
@@ -2581,7 +2629,7 @@
 	block_t start_addr = le32_to_cpu(F2FS_RAW_SUPER(sbi)->cp_blkaddr);
 
 	if (sbi->cur_cp_pack == 1)
-		start_addr += sbi->blocks_per_seg;
+		start_addr += BLKS_PER_SEG(sbi);
 	return start_addr;
 }
 
@@ -2600,7 +2648,8 @@
 					struct inode *inode, bool is_inode)
 {
 	block_t	valid_block_count;
-	unsigned int valid_node_count, user_block_count;
+	unsigned int valid_node_count;
+	unsigned int avail_user_block_count;
 	int err;
 
 	if (is_inode) {
@@ -2620,21 +2669,10 @@
 
 	spin_lock(&sbi->stat_lock);
 
-	valid_block_count = sbi->total_valid_block_count +
-					sbi->current_reserved_blocks + 1;
-
-	if (!__allow_reserved_blocks(sbi, inode, false))
-		valid_block_count += F2FS_OPTION(sbi).root_reserved_blocks;
-
-	if (F2FS_IO_ALIGNED(sbi))
-		valid_block_count += sbi->blocks_per_seg *
-				SM_I(sbi)->additional_reserved_segments;
-
-	user_block_count = sbi->user_block_count;
-	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED)))
-		user_block_count -= sbi->unusable_block_count;
+	valid_block_count = sbi->total_valid_block_count + 1;
+	avail_user_block_count = get_available_block_count(sbi, inode, false);
 
-	if (unlikely(valid_block_count > user_block_count)) {
+	if (unlikely(valid_block_count > avail_user_block_count)) {
 		spin_unlock(&sbi->stat_lock);
 		goto enospc;
 	}
@@ -2834,13 +2872,26 @@
 	return false;
 }
 
+static inline bool is_inflight_read_io(struct f2fs_sb_info *sbi)
+{
+	return get_pages(sbi, F2FS_RD_DATA) || get_pages(sbi, F2FS_DIO_READ);
+}
+
 static inline bool is_idle(struct f2fs_sb_info *sbi, int type)
 {
+	bool zoned_gc = (type == GC_TIME &&
+			F2FS_HAS_FEATURE(sbi, F2FS_FEATURE_BLKZONED));
+
 	if (sbi->gc_mode == GC_URGENT_HIGH)
 		return true;
 
-	if (is_inflight_io(sbi, type))
-		return false;
+	if (zoned_gc) {
+		if (is_inflight_read_io(sbi))
+			return false;
+	} else {
+		if (is_inflight_io(sbi, type))
+			return false;
+	}
 
 	if (sbi->gc_mode == GC_URGENT_MID)
 		return true;
@@ -2849,6 +2900,9 @@
 			(type == DISCARD_TIME || type == GC_TIME))
 		return true;
 
+	if (zoned_gc)
+		return true;
+
 	return f2fs_time_over(sbi, type);
 }
 
@@ -3018,7 +3072,6 @@
 			return;
 		fallthrough;
 	case FI_DATA_EXIST:
-	case FI_INLINE_DOTS:
 	case FI_PIN_FILE:
 	case FI_COMPRESS_RELEASED:
 		f2fs_mark_inode_dirty_sync(inode, true);
@@ -3142,8 +3195,6 @@
 		set_bit(FI_INLINE_DENTRY, fi->flags);
 	if (ri->i_inline & F2FS_DATA_EXIST)
 		set_bit(FI_DATA_EXIST, fi->flags);
-	if (ri->i_inline & F2FS_INLINE_DOTS)
-		set_bit(FI_INLINE_DOTS, fi->flags);
 	if (ri->i_inline & F2FS_EXTRA_ATTR)
 		set_bit(FI_EXTRA_ATTR, fi->flags);
 	if (ri->i_inline & F2FS_PIN_FILE)
@@ -3164,8 +3215,6 @@
 		ri->i_inline |= F2FS_INLINE_DENTRY;
 	if (is_inode_flag_set(inode, FI_DATA_EXIST))
 		ri->i_inline |= F2FS_DATA_EXIST;
-	if (is_inode_flag_set(inode, FI_INLINE_DOTS))
-		ri->i_inline |= F2FS_INLINE_DOTS;
 	if (is_inode_flag_set(inode, FI_EXTRA_ATTR))
 		ri->i_inline |= F2FS_EXTRA_ATTR;
 	if (is_inode_flag_set(inode, FI_PIN_FILE))
@@ -3252,11 +3301,6 @@
 	return is_inode_flag_set(inode, FI_DATA_EXIST);
 }
 
-static inline int f2fs_has_inline_dots(struct inode *inode)
-{
-	return is_inode_flag_set(inode, FI_INLINE_DOTS);
-}
-
 static inline int f2fs_is_mmap_file(struct inode *inode)
 {
 	return is_inode_flag_set(inode, FI_MMAP_FILE);
@@ -3364,17 +3408,6 @@
 	return is_set_ckpt_flags(sbi, CP_ERROR_FLAG);
 }
 
-static inline bool is_dot_dotdot(const u8 *name, size_t len)
-{
-	if (len == 1 && name[0] == '.')
-		return true;
-
-	if (len == 2 && name[0] == '.' && name[1] == '.')
-		return true;
-
-	return false;
-}
-
 static inline void *f2fs_kmalloc(struct f2fs_sb_info *sbi,
 					size_t size, gfp_t flags)
 {
@@ -3455,7 +3488,7 @@
 		sizeof((f2fs_inode)->field))			\
 		<= (F2FS_OLD_ATTRIBUTE_SIZE + (extra_isize)))	\
 
-#define __is_large_section(sbi)		((sbi)->segs_per_sec > 1)
+#define __is_large_section(sbi)		(SEGS_PER_SEC(sbi) > 1)
 
 #define __is_meta_io(fio) (PAGE_TYPE_OF_BIO((fio)->type) == META)
 
@@ -3464,11 +3497,9 @@
 static inline void verify_blkaddr(struct f2fs_sb_info *sbi,
 					block_t blkaddr, int type)
 {
-	if (!f2fs_is_valid_blkaddr(sbi, blkaddr, type)) {
+	if (!f2fs_is_valid_blkaddr(sbi, blkaddr, type))
 		f2fs_err(sbi, "invalid blkaddr: %u, type: %d, run fsck to fix.",
 			 blkaddr, type);
-		f2fs_bug_on(sbi, 1);
-	}
 }
 
 static inline bool __is_valid_data_blkaddr(block_t blkaddr)
@@ -3492,6 +3523,8 @@
 		 struct iattr *attr);
 int f2fs_truncate_hole(struct inode *inode, pgoff_t pg_start, pgoff_t pg_end);
 void f2fs_truncate_data_blocks_range(struct dnode_of_data *dn, int count);
+int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
+						bool readonly, bool need_lock);
 int f2fs_precache_extents(struct inode *inode);
 int f2fs_fileattr_get(struct dentry *dentry, struct fileattr *fa);
 int f2fs_fileattr_set(struct mnt_idmap *idmap,
@@ -3570,7 +3603,8 @@
 			struct inode *inode, nid_t ino, umode_t mode);
 void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
 			struct inode *dir, struct inode *inode);
-int f2fs_do_tmpfile(struct inode *inode, struct inode *dir);
+int f2fs_do_tmpfile(struct inode *inode, struct inode *dir,
+					struct f2fs_filename *fname);
 bool f2fs_empty_dir(struct inode *dir);
 
 static inline int f2fs_add_link(struct dentry *dentry, struct inode *inode)
@@ -3592,8 +3626,7 @@
 loff_t max_file_blocks(struct inode *inode);
 void f2fs_quota_off_umount(struct super_block *sb);
 void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag);
-void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
-							bool irq_context);
+void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason);
 void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error);
 void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error);
 int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover);
@@ -3692,7 +3725,8 @@
 			unsigned int *newseg, bool new_sec, int dir);
 void f2fs_allocate_segment_for_resize(struct f2fs_sb_info *sbi, int type,
 					unsigned int start, unsigned int end);
-void f2fs_allocate_new_section(struct f2fs_sb_info *sbi, int type, bool force);
+int f2fs_allocate_new_section(struct f2fs_sb_info *sbi, int type, bool force);
+int f2fs_allocate_pinning_section(struct f2fs_sb_info *sbi);
 void f2fs_allocate_new_segments(struct f2fs_sb_info *sbi);
 int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range);
 bool f2fs_exist_trim_candidates(struct f2fs_sb_info *sbi,
@@ -3804,6 +3838,7 @@
  */
 int __init f2fs_init_bioset(void);
 void f2fs_destroy_bioset(void);
+bool f2fs_is_cp_guaranteed(struct page *page);
 int f2fs_init_bio_entry_cache(void);
 void f2fs_destroy_bio_entry_cache(void);
 void f2fs_submit_read_bio(struct f2fs_sb_info *sbi, struct bio *bio,
@@ -3867,6 +3902,9 @@
 block_t f2fs_start_bidx_of_node(unsigned int node_ofs, struct inode *inode);
 int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control);
 void f2fs_build_gc_manager(struct f2fs_sb_info *sbi);
+int f2fs_gc_range(struct f2fs_sb_info *sbi,
+		unsigned int start_seg, unsigned int end_seg,
+		bool dry_run, unsigned int dry_run_sections);
 int f2fs_resize_fs(struct file *filp, __u64 block_count);
 int __init f2fs_create_garbage_collection_cache(void);
 void f2fs_destroy_garbage_collection_cache(void);
@@ -4135,7 +4173,7 @@
  * inline.c
  */
 bool f2fs_may_inline_data(struct inode *inode);
-bool f2fs_sanity_check_inline_data(struct inode *inode);
+bool f2fs_sanity_check_inline_data(struct inode *inode, struct page *ipage);
 bool f2fs_may_inline_dentry(struct inode *inode);
 void f2fs_do_read_inline_data(struct page *page, struct page *ipage);
 void f2fs_truncate_inline_inode(struct inode *inode,
@@ -4176,7 +4214,7 @@
 /*
  * extent_cache.c
  */
-bool sanity_check_extent_cache(struct inode *inode);
+bool sanity_check_extent_cache(struct inode *inode, struct page *ipage);
 void f2fs_init_extent_tree(struct inode *inode);
 void f2fs_drop_extent_tree(struct inode *inode);
 void f2fs_destroy_extent_node(struct inode *inode);
@@ -4247,10 +4285,25 @@
 		f2fs_compressed_file(inode);
 }
 
+static inline bool f2fs_used_in_atomic_write(struct inode *inode)
+{
+	return f2fs_is_atomic_file(inode) || f2fs_is_cow_file(inode);
+}
+
+static inline bool f2fs_meta_inode_gc_required(struct inode *inode)
+{
+	return f2fs_post_read_required(inode) || f2fs_used_in_atomic_write(inode);
+}
+
 /*
  * compress.c
  */
 #ifdef CONFIG_F2FS_FS_COMPRESSION
+enum cluster_check_type {
+	CLUSTER_IS_COMPR,   /* check only if compressed cluster */
+	CLUSTER_COMPR_BLKS, /* return # of compressed blocks in a cluster */
+	CLUSTER_RAW_BLKS    /* return # of raw blocks in a cluster */
+};
 bool f2fs_is_compressed_page(struct page *page);
 struct page *f2fs_compress_control_page(struct page *page);
 int f2fs_prepare_compress_overwrite(struct inode *inode,
@@ -4277,6 +4330,7 @@
 						struct writeback_control *wbc,
 						enum iostat_type io_type);
 int f2fs_is_compressed_cluster(struct inode *inode, pgoff_t index);
+bool f2fs_is_sparse_cluster(struct inode *inode, pgoff_t index);
 void f2fs_update_read_extent_tree_range_compressed(struct inode *inode,
 				pgoff_t fofs, block_t blkaddr,
 				unsigned int llen, unsigned int c_len);
@@ -4287,7 +4341,8 @@
 void f2fs_decompress_end_io(struct decompress_io_ctx *dic, bool failed,
 				bool in_task);
 void f2fs_put_page_dic(struct page *page, bool in_task);
-unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn);
+unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn,
+						unsigned int ofs_in_node);
 int f2fs_init_compress_ctx(struct compress_ctx *cc);
 void f2fs_destroy_compress_ctx(struct compress_ctx *cc, bool reuse);
 void f2fs_init_compress_info(struct f2fs_sb_info *sbi);
@@ -4344,7 +4399,8 @@
 {
 	WARN_ON_ONCE(1);
 }
-static inline unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn) { return 0; }
+static inline unsigned int f2fs_cluster_blocks_are_contiguous(
+			struct dnode_of_data *dn, unsigned int ofs_in_node) { return 0; }
 static inline bool f2fs_sanity_check_cluster(struct dnode_of_data *dn) { return false; }
 static inline int f2fs_init_compress_inode(struct f2fs_sb_info *sbi) { return 0; }
 static inline void f2fs_destroy_compress_inode(struct f2fs_sb_info *sbi) { }
@@ -4361,6 +4417,12 @@
 static inline void f2fs_invalidate_compress_pages(struct f2fs_sb_info *sbi,
 							nid_t ino) { }
 #define inc_compr_inode_stat(inode)		do { } while (0)
+static inline int f2fs_is_compressed_cluster(
+				struct inode *inode,
+				pgoff_t index) { return 0; }
+static inline bool f2fs_is_sparse_cluster(
+				struct inode *inode,
+				pgoff_t index) { return true; }
 static inline void f2fs_update_read_extent_tree_range_compressed(
 				struct inode *inode,
 				pgoff_t fofs, block_t blkaddr,
@@ -4401,15 +4463,24 @@
 {
 	struct f2fs_inode_info *fi = F2FS_I(inode);
 
-	if (!f2fs_compressed_file(inode))
+	f2fs_down_write(&F2FS_I(inode)->i_sem);
+
+	if (!f2fs_compressed_file(inode)) {
+		f2fs_up_write(&F2FS_I(inode)->i_sem);
 		return true;
-	if (S_ISREG(inode->i_mode) && F2FS_HAS_BLOCKS(inode))
+	}
+	if (f2fs_is_mmap_file(inode) ||
+		(S_ISREG(inode->i_mode) && F2FS_HAS_BLOCKS(inode))) {
+		f2fs_up_write(&F2FS_I(inode)->i_sem);
 		return false;
+	}
 
 	fi->i_flags &= ~F2FS_COMPR_FL;
 	stat_dec_compr_inode(inode);
 	clear_inode_flag(inode, FI_COMPRESSED_FILE);
 	f2fs_mark_inode_dirty_sync(inode, true);
+
+	f2fs_up_write(&F2FS_I(inode)->i_sem);
 	return true;
 }
 
@@ -4512,6 +4583,17 @@
 	return F2FS_OPTION(sbi).fs_mode == FS_MODE_LFS;
 }
 
+static inline bool f2fs_valid_pinned_area(struct f2fs_sb_info *sbi,
+					  block_t blkaddr)
+{
+	if (f2fs_sb_has_blkzoned(sbi)) {
+		int devi = f2fs_target_device_index(sbi, blkaddr);
+
+		return !bdev_is_zoned(FDEV(devi).bdev);
+	}
+	return true;
+}
+
 static inline bool f2fs_low_mem_mode(struct f2fs_sb_info *sbi)
 {
 	return F2FS_OPTION(sbi).memory_mode == MEMORY_MODE_LOW;
@@ -4563,10 +4645,14 @@
 }
 
 #ifdef CONFIG_F2FS_FAULT_INJECTION
-extern void f2fs_build_fault_attr(struct f2fs_sb_info *sbi, unsigned int rate,
-							unsigned int type);
+extern int f2fs_build_fault_attr(struct f2fs_sb_info *sbi, unsigned long rate,
+							unsigned long type);
 #else
-#define f2fs_build_fault_attr(sbi, rate, type)		do { } while (0)
+static inline int f2fs_build_fault_attr(struct f2fs_sb_info *sbi,
+					unsigned long rate, unsigned long type)
+{
+	return 0;
+}
 #endif
 
 static inline bool is_journalled_quota(struct f2fs_sb_info *sbi)
@@ -4613,10 +4699,36 @@
 	return f2fs_sb_has_readonly(sbi) || f2fs_readonly(sbi->sb);
 }
 
+static inline void f2fs_truncate_meta_inode_pages(struct f2fs_sb_info *sbi,
+					block_t blkaddr, unsigned int cnt)
+{
+	bool need_submit = false;
+	int i = 0;
+
+	do {
+		struct page *page;
+
+		page = find_get_page(META_MAPPING(sbi), blkaddr + i);
+		if (page) {
+			if (PageWriteback(page))
+				need_submit = true;
+			f2fs_put_page(page, 0);
+		}
+	} while (++i < cnt && !need_submit);
+
+	if (need_submit)
+		f2fs_submit_merged_write_cond(sbi, sbi->meta_inode,
+							NULL, 0, DATA);
+
+	truncate_inode_pages_range(META_MAPPING(sbi),
+			F2FS_BLK_TO_BYTES((loff_t)blkaddr),
+			F2FS_BLK_END_BYTES((loff_t)(blkaddr + cnt - 1)));
+}
+
 static inline void f2fs_invalidate_internal_cache(struct f2fs_sb_info *sbi,
 								block_t blkaddr)
 {
-	invalidate_mapping_pages(META_MAPPING(sbi), blkaddr, blkaddr);
+	f2fs_truncate_meta_inode_pages(sbi, blkaddr, 1);
 	f2fs_invalidate_compress_page(sbi, blkaddr);
 }
 
--- linux-qcom-6.8.0.orig/fs/f2fs/file.c
+++ linux-qcom-6.8.0/fs/f2fs/file.c
@@ -39,6 +39,7 @@
 static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
 {
 	struct inode *inode = file_inode(vmf->vma->vm_file);
+	vm_flags_t flags = vmf->vma->vm_flags;
 	vm_fault_t ret;
 
 	ret = filemap_fault(vmf);
@@ -46,7 +47,7 @@
 		f2fs_update_iostat(F2FS_I_SB(inode), inode,
 					APP_MAPPED_READ_IO, F2FS_BLKSIZE);
 
-	trace_f2fs_filemap_fault(inode, vmf->pgoff, vmf->vma->vm_flags, ret);
+	trace_f2fs_filemap_fault(inode, vmf->pgoff, flags, ret);
 
 	return ret;
 }
@@ -218,6 +219,9 @@
 		f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino,
 							TRANS_DIR_INO))
 		cp_reason = CP_RECOVER_DIR;
+	else if (f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino,
+							XATTR_DIR_INO))
+		cp_reason = CP_XATTR_DIR;
 
 	return cp_reason;
 }
@@ -539,6 +543,42 @@
 	return 0;
 }
 
+static int finish_preallocate_blocks(struct inode *inode)
+{
+	int ret;
+
+	inode_lock(inode);
+	if (is_inode_flag_set(inode, FI_OPENED_FILE)) {
+		inode_unlock(inode);
+		return 0;
+	}
+
+	if (!file_should_truncate(inode)) {
+		set_inode_flag(inode, FI_OPENED_FILE);
+		inode_unlock(inode);
+		return 0;
+	}
+
+	f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+	filemap_invalidate_lock(inode->i_mapping);
+
+	truncate_setsize(inode, i_size_read(inode));
+	ret = f2fs_truncate(inode);
+
+	filemap_invalidate_unlock(inode->i_mapping);
+	f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+
+	if (!ret)
+		set_inode_flag(inode, FI_OPENED_FILE);
+
+	inode_unlock(inode);
+	if (ret)
+		return ret;
+
+	file_dont_truncate(inode);
+	return 0;
+}
+
 static int f2fs_file_open(struct inode *inode, struct file *filp)
 {
 	int err = fscrypt_file_open(inode, filp);
@@ -556,7 +596,11 @@
 	filp->f_mode |= FMODE_NOWAIT | FMODE_BUF_RASYNC;
 	filp->f_mode |= FMODE_CAN_ODIRECT;
 
-	return dquot_file_open(inode, filp);
+	err = dquot_file_open(inode, filp);
+	if (err)
+		return err;
+
+	return finish_preallocate_blocks(inode);
 }
 
 void f2fs_truncate_data_blocks_range(struct dnode_of_data *dn, int count)
@@ -808,6 +852,12 @@
 		return true;
 	if (f2fs_compressed_file(inode))
 		return true;
+	/*
+	 * only force direct read to use buffered IO, for direct write,
+	 * it expects inline data conversion before committing IO.
+	 */
+	if (f2fs_has_inline_data(inode) && rw == READ)
+		return true;
 
 	/* disallow direct IO if any of devices has unaligned blksize */
 	if (f2fs_is_multi_device(sbi) && !sbi->aligned_blksize)
@@ -818,8 +868,6 @@
 	 */
 	if (f2fs_sb_has_blkzoned(sbi) && (rw == WRITE))
 		return true;
-	if (f2fs_lfs_mode(sbi) && rw == WRITE && F2FS_IO_ALIGNED(sbi))
-		return true;
 	if (is_sbi_flag_set(sbi, SBI_CP_DISABLED))
 		return true;
 
@@ -936,9 +984,14 @@
 				  ATTR_GID | ATTR_TIMES_SET))))
 		return -EPERM;
 
-	if ((attr->ia_valid & ATTR_SIZE) &&
-		!f2fs_is_compress_backend_ready(inode))
-		return -EOPNOTSUPP;
+	if ((attr->ia_valid & ATTR_SIZE)) {
+		if (!f2fs_is_compress_backend_ready(inode))
+			return -EOPNOTSUPP;
+		if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED) &&
+			!IS_ALIGNED(attr->ia_size,
+			F2FS_BLK_TO_BYTES(F2FS_I(inode)->i_cluster_size)))
+			return -EINVAL;
+	}
 
 	err = setattr_prepare(idmap, dentry, attr);
 	if (err)
@@ -990,6 +1043,13 @@
 				return err;
 		}
 
+		/*
+		 * wait for inflight dio, blocks should be removed after
+		 * IO completion.
+		 */
+		if (attr->ia_size < old_size)
+			inode_dio_wait(inode);
+
 		f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
 		filemap_invalidate_lock(inode->i_mapping);
 
@@ -1310,6 +1370,9 @@
 				f2fs_put_page(psrc, 1);
 				return PTR_ERR(pdst);
 			}
+
+			f2fs_wait_on_page_writeback(pdst, DATA, true, true);
+
 			memcpy_page(pdst, 0, psrc, 0, PAGE_SIZE);
 			set_page_dirty(pdst);
 			set_page_private_gcing(pdst);
@@ -1731,9 +1794,11 @@
 
 		f2fs_down_write(&sbi->pin_sem);
 
-		f2fs_lock_op(sbi);
-		f2fs_allocate_new_section(sbi, CURSEG_COLD_DATA_PINNED, false);
-		f2fs_unlock_op(sbi);
+		err = f2fs_allocate_pinning_section(sbi);
+		if (err) {
+			f2fs_up_write(&sbi->pin_sem);
+			goto out_err;
+		}
 
 		map.m_seg_type = CURSEG_COLD_DATA_PINNED;
 		err = f2fs_map_blocks(inode, &map, F2FS_GET_BLOCK_PRE_DIO);
@@ -1799,15 +1864,6 @@
 		(mode & (FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_INSERT_RANGE)))
 		return -EOPNOTSUPP;
 
-	/*
-	 * Pinned file should not support partial truncation since the block
-	 * can be used by applications.
-	 */
-	if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode)) &&
-		(mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_COLLAPSE_RANGE |
-			FALLOC_FL_ZERO_RANGE | FALLOC_FL_INSERT_RANGE)))
-		return -EOPNOTSUPP;
-
 	if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE |
 			FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_ZERO_RANGE |
 			FALLOC_FL_INSERT_RANGE))
@@ -1815,10 +1871,27 @@
 
 	inode_lock(inode);
 
+	/*
+	 * Pinned file should not support partial truncation since the block
+	 * can be used by applications.
+	 */
+	if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode)) &&
+		(mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_COLLAPSE_RANGE |
+			FALLOC_FL_ZERO_RANGE | FALLOC_FL_INSERT_RANGE))) {
+		ret = -EOPNOTSUPP;
+		goto out;
+	}
+
 	ret = file_modified(file);
 	if (ret)
 		goto out;
 
+	/*
+	 * wait for inflight dio, blocks should be removed after IO
+	 * completion.
+	 */
+	inode_dio_wait(inode);
+
 	if (mode & FALLOC_FL_PUNCH_HOLE) {
 		if (offset >= inode->i_size)
 			goto out;
@@ -2047,10 +2120,12 @@
 	struct mnt_idmap *idmap = file_mnt_idmap(filp);
 	struct f2fs_inode_info *fi = F2FS_I(inode);
 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
-	struct inode *pinode;
 	loff_t isize;
 	int ret;
 
+	if (!(filp->f_mode & FMODE_WRITE))
+		return -EBADF;
+
 	if (!inode_owner_or_capable(idmap, inode))
 		return -EACCES;
 
@@ -2096,15 +2171,10 @@
 	/* Check if the inode already has a COW inode */
 	if (fi->cow_inode == NULL) {
 		/* Create a COW inode for atomic write */
-		pinode = f2fs_iget(inode->i_sb, fi->i_pino);
-		if (IS_ERR(pinode)) {
-			f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
-			ret = PTR_ERR(pinode);
-			goto out;
-		}
+		struct dentry *dentry = file_dentry(filp);
+		struct inode *dir = d_inode(dentry->d_parent);
 
-		ret = f2fs_get_tmpfile(idmap, pinode, &fi->cow_inode);
-		iput(pinode);
+		ret = f2fs_get_tmpfile(idmap, dir, &fi->cow_inode);
 		if (ret) {
 			f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
 			goto out;
@@ -2112,8 +2182,15 @@
 
 		set_inode_flag(fi->cow_inode, FI_COW_FILE);
 		clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);
+
+		/* Set the COW inode's atomic_inode to the atomic inode */
+		F2FS_I(fi->cow_inode)->atomic_inode = inode;
 	} else {
 		/* Reuse the already created COW inode */
+		f2fs_bug_on(sbi, get_dirty_pages(fi->cow_inode));
+
+		invalidate_mapping_pages(fi->cow_inode->i_mapping, 0, -1);
+
 		ret = f2fs_do_truncate_blocks(fi->cow_inode, 0, true);
 		if (ret) {
 			f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
@@ -2155,6 +2232,9 @@
 	struct mnt_idmap *idmap = file_mnt_idmap(filp);
 	int ret;
 
+	if (!(filp->f_mode & FMODE_WRITE))
+		return -EBADF;
+
 	if (!inode_owner_or_capable(idmap, inode))
 		return -EACCES;
 
@@ -2187,6 +2267,9 @@
 	struct mnt_idmap *idmap = file_mnt_idmap(filp);
 	int ret;
 
+	if (!(filp->f_mode & FMODE_WRITE))
+		return -EBADF;
+
 	if (!inode_owner_or_capable(idmap, inode))
 		return -EACCES;
 
@@ -2205,34 +2288,13 @@
 	return ret;
 }
 
-static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
+int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
+						bool readonly, bool need_lock)
 {
-	struct inode *inode = file_inode(filp);
-	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 	struct super_block *sb = sbi->sb;
-	__u32 in;
 	int ret = 0;
 
-	if (!capable(CAP_SYS_ADMIN))
-		return -EPERM;
-
-	if (get_user(in, (__u32 __user *)arg))
-		return -EFAULT;
-
-	if (in != F2FS_GOING_DOWN_FULLSYNC) {
-		ret = mnt_want_write_file(filp);
-		if (ret) {
-			if (ret == -EROFS) {
-				ret = 0;
-				f2fs_stop_checkpoint(sbi, false,
-						STOP_CP_REASON_SHUTDOWN);
-				trace_f2fs_shutdown(sbi, in, ret);
-			}
-			return ret;
-		}
-	}
-
-	switch (in) {
+	switch (flag) {
 	case F2FS_GOING_DOWN_FULLSYNC:
 		ret = bdev_freeze(sb->s_bdev);
 		if (ret)
@@ -2266,18 +2328,65 @@
 		goto out;
 	}
 
+	if (readonly)
+		goto out;
+
+	/*
+	 * grab sb->s_umount to avoid racing w/ remount() and other shutdown
+	 * paths.
+	 */
+	if (need_lock)
+		down_write(&sbi->sb->s_umount);
+
 	f2fs_stop_gc_thread(sbi);
 	f2fs_stop_discard_thread(sbi);
 
 	f2fs_drop_discard_cmd(sbi);
 	clear_opt(sbi, DISCARD);
 
+	if (need_lock)
+		up_write(&sbi->sb->s_umount);
+
 	f2fs_update_time(sbi, REQ_TIME);
 out:
-	if (in != F2FS_GOING_DOWN_FULLSYNC)
-		mnt_drop_write_file(filp);
 
-	trace_f2fs_shutdown(sbi, in, ret);
+	trace_f2fs_shutdown(sbi, flag, ret);
+
+	return ret;
+}
+
+static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
+{
+	struct inode *inode = file_inode(filp);
+	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+	__u32 in;
+	int ret;
+	bool need_drop = false, readonly = false;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
+	if (get_user(in, (__u32 __user *)arg))
+		return -EFAULT;
+
+	if (in != F2FS_GOING_DOWN_FULLSYNC) {
+		ret = mnt_want_write_file(filp);
+		if (ret) {
+			if (ret != -EROFS)
+				return ret;
+
+			/* fallback to nosync shutdown for readonly fs */
+			in = F2FS_GOING_DOWN_NOSYNC;
+			readonly = true;
+		} else {
+			need_drop = true;
+		}
+	}
+
+	ret = f2fs_do_shutdown(sbi, in, readonly, true);
+
+	if (need_drop)
+		mnt_drop_write_file(filp);
 
 	return ret;
 }
@@ -2578,7 +2687,6 @@
 					.m_may_create = false };
 	struct extent_info ei = {};
 	pgoff_t pg_start, pg_end, next_pgofs;
-	unsigned int blk_per_seg = sbi->blocks_per_seg;
 	unsigned int total = 0, sec_num;
 	block_t blk_end = 0;
 	bool fragmented = false;
@@ -2591,7 +2699,8 @@
 
 	inode_lock(inode);
 
-	if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
+	if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED) ||
+		f2fs_is_atomic_file(inode)) {
 		err = -EINVAL;
 		goto unlock_out;
 	}
@@ -2614,7 +2723,7 @@
 	 * block addresses are continuous.
 	 */
 	if (f2fs_lookup_read_extent_cache(inode, pg_start, &ei)) {
-		if (ei.fofs + ei.len >= pg_end)
+		if ((pgoff_t)ei.fofs + ei.len >= pg_end)
 			goto out;
 	}
 
@@ -2687,7 +2796,8 @@
 		set_inode_flag(inode, FI_SKIP_WRITES);
 
 		idx = map.m_lblk;
-		while (idx < map.m_lblk + map.m_len && cnt < blk_per_seg) {
+		while (idx < map.m_lblk + map.m_len &&
+						cnt < BLKS_PER_SEG(sbi)) {
 			struct page *page;
 
 			page = f2fs_get_lock_data_page(inode, idx, true);
@@ -2696,6 +2806,8 @@
 				goto clear_out;
 			}
 
+			f2fs_wait_on_page_writeback(page, DATA, true, true);
+
 			set_page_dirty(page);
 			set_page_private_gcing(page);
 			f2fs_put_page(page, 1);
@@ -2707,7 +2819,7 @@
 
 		map.m_lblk = idx;
 check:
-		if (map.m_lblk < pg_end && cnt < blk_per_seg)
+		if (map.m_lblk < pg_end && cnt < BLKS_PER_SEG(sbi))
 			goto do_map;
 
 		clear_inode_flag(inode, FI_SKIP_WRITES);
@@ -2813,11 +2925,17 @@
 			goto out;
 	}
 
-	if (f2fs_compressed_file(src) || f2fs_compressed_file(dst)) {
+	if (f2fs_compressed_file(src) || f2fs_compressed_file(dst) ||
+		f2fs_is_pinned_file(src) || f2fs_is_pinned_file(dst)) {
 		ret = -EOPNOTSUPP;
 		goto out_unlock;
 	}
 
+	if (f2fs_is_atomic_file(src) || f2fs_is_atomic_file(dst)) {
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
 	ret = -EINVAL;
 	if (pos_in + len > src->i_size || pos_in + len < pos_in)
 		goto out_unlock;
@@ -2869,9 +2987,9 @@
 	}
 
 	f2fs_lock_op(sbi);
-	ret = __exchange_data_block(src, dst, pos_in >> F2FS_BLKSIZE_BITS,
-				pos_out >> F2FS_BLKSIZE_BITS,
-				len >> F2FS_BLKSIZE_BITS, false);
+	ret = __exchange_data_block(src, dst, F2FS_BYTES_TO_BLK(pos_in),
+				F2FS_BYTES_TO_BLK(pos_out),
+				F2FS_BYTES_TO_BLK(len), false);
 
 	if (!ret) {
 		if (dst_max_i_size)
@@ -2976,8 +3094,8 @@
 
 	if (!f2fs_is_multi_device(sbi) || sbi->s_ndevs - 1 <= range.dev_num ||
 			__is_large_section(sbi)) {
-		f2fs_warn(sbi, "Can't flush %u in %d for segs_per_sec %u != 1",
-			  range.dev_num, sbi->s_ndevs, sbi->segs_per_sec);
+		f2fs_warn(sbi, "Can't flush %u in %d for SEGS_PER_SEC %u != 1",
+			  range.dev_num, sbi->s_ndevs, SEGS_PER_SEC(sbi));
 		return -EINVAL;
 	}
 
@@ -3183,6 +3301,7 @@
 static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg)
 {
 	struct inode *inode = file_inode(filp);
+	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 	__u32 pin;
 	int ret = 0;
 
@@ -3192,7 +3311,7 @@
 	if (!S_ISREG(inode->i_mode))
 		return -EINVAL;
 
-	if (f2fs_readonly(F2FS_I_SB(inode)->sb))
+	if (f2fs_readonly(sbi->sb))
 		return -EROFS;
 
 	ret = mnt_want_write_file(filp);
@@ -3201,13 +3320,27 @@
 
 	inode_lock(inode);
 
+	if (f2fs_is_atomic_file(inode)) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	if (!pin) {
 		clear_inode_flag(inode, FI_PIN_FILE);
 		f2fs_i_gc_failures_write(inode, 0);
 		goto done;
+	} else if (f2fs_is_pinned_file(inode)) {
+		goto done;
+	}
+
+	if (f2fs_sb_has_blkzoned(sbi) && F2FS_HAS_BLOCKS(inode)) {
+		ret = -EFBIG;
+		goto out;
 	}
 
-	if (f2fs_should_update_outplace(inode, NULL)) {
+	/* Let's allow file pinning on zoned device. */
+	if (!f2fs_sb_has_blkzoned(sbi) &&
+	    f2fs_should_update_outplace(inode, NULL)) {
 		ret = -EINVAL;
 		goto out;
 	}
@@ -3229,7 +3362,7 @@
 	set_inode_flag(inode, FI_PIN_FILE);
 	ret = F2FS_I(inode)->i_gc_failures[GC_FAILURE_PIN];
 done:
-	f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
+	f2fs_update_time(sbi, REQ_TIME);
 out:
 	inode_unlock(inode);
 	mnt_drop_write_file(filp);
@@ -3490,9 +3623,6 @@
 	if (!f2fs_sb_has_compression(sbi))
 		return -EOPNOTSUPP;
 
-	if (!f2fs_compressed_file(inode))
-		return -EINVAL;
-
 	if (f2fs_readonly(sbi->sb))
 		return -EROFS;
 
@@ -3511,7 +3641,8 @@
 		goto out;
 	}
 
-	if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
+	if (!f2fs_compressed_file(inode) ||
+		is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
 		ret = -EINVAL;
 		goto out;
 	}
@@ -3538,9 +3669,12 @@
 		struct dnode_of_data dn;
 		pgoff_t end_offset, count;
 
+		f2fs_lock_op(sbi);
+
 		set_new_dnode(&dn, inode, NULL, NULL, 0);
 		ret = f2fs_get_dnode_of_data(&dn, page_idx, LOOKUP_NODE);
 		if (ret) {
+			f2fs_unlock_op(sbi);
 			if (ret == -ENOENT) {
 				page_idx = f2fs_get_next_page_offset(&dn,
 								page_idx);
@@ -3558,6 +3692,8 @@
 
 		f2fs_put_dnode(&dn);
 
+		f2fs_unlock_op(sbi);
+
 		if (ret < 0)
 			break;
 
@@ -3588,10 +3724,10 @@
 	return ret;
 }
 
-static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count,
+		unsigned int *reserved_blocks)
 {
 	struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
-	unsigned int reserved_blocks = 0;
 	int cluster_size = F2FS_I(dn->inode)->i_cluster_size;
 	block_t blkaddr;
 	int i;
@@ -3611,43 +3747,63 @@
 
 	while (count) {
 		int compr_blocks = 0;
-		blkcnt_t reserved;
+		blkcnt_t reserved = 0;
+		blkcnt_t to_reserved;
 		int ret;
 
-		for (i = 0; i < cluster_size; i++, dn->ofs_in_node++) {
-			blkaddr = f2fs_data_blkaddr(dn);
+		for (i = 0; i < cluster_size; i++) {
+			blkaddr = data_blkaddr(dn->inode, dn->node_page,
+						dn->ofs_in_node + i);
 
 			if (i == 0) {
-				if (blkaddr == COMPRESS_ADDR)
-					continue;
-				dn->ofs_in_node += cluster_size;
-				goto next;
+				if (blkaddr != COMPRESS_ADDR) {
+					dn->ofs_in_node += cluster_size;
+					goto next;
+				}
+				continue;
 			}
 
+			/*
+			 * compressed cluster was not released due to it
+			 * fails in release_compress_blocks(), so NEW_ADDR
+			 * is a possible case.
+			 */
+			if (blkaddr == NEW_ADDR) {
+				reserved++;
+				continue;
+			}
 			if (__is_valid_data_blkaddr(blkaddr)) {
 				compr_blocks++;
 				continue;
 			}
+		}
 
-			f2fs_set_data_blkaddr(dn, NEW_ADDR);
+		to_reserved = cluster_size - compr_blocks - reserved;
+
+		/* for the case all blocks in cluster were reserved */
+		if (reserved && to_reserved == 1) {
+			dn->ofs_in_node += cluster_size;
+			goto next;
 		}
 
-		reserved = cluster_size - compr_blocks;
-		ret = inc_valid_block_count(sbi, dn->inode, &reserved);
-		if (ret)
+		ret = inc_valid_block_count(sbi, dn->inode,
+						&to_reserved, false);
+		if (unlikely(ret))
 			return ret;
 
-		if (reserved != cluster_size - compr_blocks)
-			return -ENOSPC;
+		for (i = 0; i < cluster_size; i++, dn->ofs_in_node++) {
+			if (f2fs_data_blkaddr(dn) == NULL_ADDR)
+				f2fs_set_data_blkaddr(dn, NEW_ADDR);
+		}
 
 		f2fs_i_compr_blocks_update(dn->inode, compr_blocks, true);
 
-		reserved_blocks += reserved;
+		*reserved_blocks += to_reserved;
 next:
 		count -= cluster_size;
 	}
 
-	return reserved_blocks;
+	return 0;
 }
 
 static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
@@ -3661,9 +3817,6 @@
 	if (!f2fs_sb_has_compression(sbi))
 		return -EOPNOTSUPP;
 
-	if (!f2fs_compressed_file(inode))
-		return -EINVAL;
-
 	if (f2fs_readonly(sbi->sb))
 		return -EROFS;
 
@@ -3671,18 +3824,19 @@
 	if (ret)
 		return ret;
 
-	if (atomic_read(&F2FS_I(inode)->i_compr_blocks))
-		goto out;
-
 	f2fs_balance_fs(sbi, true);
 
 	inode_lock(inode);
 
-	if (!is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
+	if (!f2fs_compressed_file(inode) ||
+		!is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
 		ret = -EINVAL;
 		goto unlock_inode;
 	}
 
+	if (atomic_read(&F2FS_I(inode)->i_compr_blocks))
+		goto unlock_inode;
+
 	f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
 	filemap_invalidate_lock(inode->i_mapping);
 
@@ -3692,9 +3846,12 @@
 		struct dnode_of_data dn;
 		pgoff_t end_offset, count;
 
+		f2fs_lock_op(sbi);
+
 		set_new_dnode(&dn, inode, NULL, NULL, 0);
 		ret = f2fs_get_dnode_of_data(&dn, page_idx, LOOKUP_NODE);
 		if (ret) {
+			f2fs_unlock_op(sbi);
 			if (ret == -ENOENT) {
 				page_idx = f2fs_get_next_page_offset(&dn,
 								page_idx);
@@ -3708,31 +3865,31 @@
 		count = min(end_offset - dn.ofs_in_node, last_idx - page_idx);
 		count = round_up(count, F2FS_I(inode)->i_cluster_size);
 
-		ret = reserve_compress_blocks(&dn, count);
+		ret = reserve_compress_blocks(&dn, count, &reserved_blocks);
 
 		f2fs_put_dnode(&dn);
 
+		f2fs_unlock_op(sbi);
+
 		if (ret < 0)
 			break;
 
 		page_idx += count;
-		reserved_blocks += ret;
 	}
 
 	filemap_invalidate_unlock(inode->i_mapping);
 	f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
 
-	if (ret >= 0) {
+	if (!ret) {
 		clear_inode_flag(inode, FI_COMPRESS_RELEASED);
 		inode_set_ctime_current(inode);
 		f2fs_mark_inode_dirty_sync(inode, true);
 	}
 unlock_inode:
 	inode_unlock(inode);
-out:
 	mnt_drop_write_file(filp);
 
-	if (ret >= 0) {
+	if (!ret) {
 		ret = put_user(reserved_blocks, (u64 __user *)arg);
 	} else if (reserved_blocks &&
 			atomic_read(&F2FS_I(inode)->i_compr_blocks)) {
@@ -3981,16 +4138,20 @@
 				sizeof(option)))
 		return -EFAULT;
 
-	if (!f2fs_compressed_file(inode) ||
-			option.log_cluster_size < MIN_COMPRESS_LOG_SIZE ||
-			option.log_cluster_size > MAX_COMPRESS_LOG_SIZE ||
-			option.algorithm >= COMPRESS_MAX)
+	if (option.log_cluster_size < MIN_COMPRESS_LOG_SIZE ||
+		option.log_cluster_size > MAX_COMPRESS_LOG_SIZE ||
+		option.algorithm >= COMPRESS_MAX)
 		return -EINVAL;
 
 	file_start_write(filp);
 	inode_lock(inode);
 
 	f2fs_down_write(&F2FS_I(inode)->i_sem);
+	if (!f2fs_compressed_file(inode)) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	if (f2fs_is_mmap_file(inode) || get_dirty_pages(inode)) {
 		ret = -EBUSY;
 		goto out;
@@ -4051,6 +4212,8 @@
 		/* It will never fail, when page has pinned above */
 		f2fs_bug_on(F2FS_I_SB(inode), !page);
 
+		f2fs_wait_on_page_writeback(page, DATA, true, true);
+
 		set_page_dirty(page);
 		set_page_private_gcing(page);
 		f2fs_put_page(page, 1);
@@ -4065,10 +4228,8 @@
 	struct inode *inode = file_inode(filp);
 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 	struct f2fs_inode_info *fi = F2FS_I(inode);
-	pgoff_t page_idx = 0, last_idx;
-	unsigned int blk_per_seg = sbi->blocks_per_seg;
-	int cluster_size = fi->i_cluster_size;
-	int count, ret;
+	pgoff_t page_idx = 0, last_idx, cluster_idx;
+	int ret;
 
 	if (!f2fs_sb_has_compression(sbi) ||
 			F2FS_OPTION(sbi).compress_mode != COMPR_MODE_USER)
@@ -4077,9 +4238,6 @@
 	if (!(filp->f_mode & FMODE_WRITE))
 		return -EBADF;
 
-	if (!f2fs_compressed_file(inode))
-		return -EINVAL;
-
 	f2fs_balance_fs(sbi, true);
 
 	file_start_write(filp);
@@ -4090,7 +4248,8 @@
 		goto out;
 	}
 
-	if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
+	if (!f2fs_compressed_file(inode) ||
+		is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
 		ret = -EINVAL;
 		goto out;
 	}
@@ -4103,22 +4262,24 @@
 		goto out;
 
 	last_idx = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+	last_idx >>= fi->i_log_cluster_size;
+
+	for (cluster_idx = 0; cluster_idx < last_idx; cluster_idx++) {
+		page_idx = cluster_idx << fi->i_log_cluster_size;
 
-	count = last_idx - page_idx;
-	while (count && count >= cluster_size) {
-		ret = redirty_blocks(inode, page_idx, cluster_size);
+		if (!f2fs_is_compressed_cluster(inode, page_idx))
+			continue;
+
+		ret = redirty_blocks(inode, page_idx, fi->i_cluster_size);
 		if (ret < 0)
 			break;
 
-		if (get_dirty_pages(inode) >= blk_per_seg) {
+		if (get_dirty_pages(inode) >= BLKS_PER_SEG(sbi)) {
 			ret = filemap_fdatawrite(inode->i_mapping);
 			if (ret < 0)
 				break;
 		}
 
-		count -= cluster_size;
-		page_idx += cluster_size;
-
 		cond_resched();
 		if (fatal_signal_pending(current)) {
 			ret = -EINTR;
@@ -4144,10 +4305,9 @@
 {
 	struct inode *inode = file_inode(filp);
 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
-	pgoff_t page_idx = 0, last_idx;
-	unsigned int blk_per_seg = sbi->blocks_per_seg;
-	int cluster_size = F2FS_I(inode)->i_cluster_size;
-	int count, ret;
+	struct f2fs_inode_info *fi = F2FS_I(inode);
+	pgoff_t page_idx = 0, last_idx, cluster_idx;
+	int ret;
 
 	if (!f2fs_sb_has_compression(sbi) ||
 			F2FS_OPTION(sbi).compress_mode != COMPR_MODE_USER)
@@ -4156,9 +4316,6 @@
 	if (!(filp->f_mode & FMODE_WRITE))
 		return -EBADF;
 
-	if (!f2fs_compressed_file(inode))
-		return -EINVAL;
-
 	f2fs_balance_fs(sbi, true);
 
 	file_start_write(filp);
@@ -4169,7 +4326,8 @@
 		goto out;
 	}
 
-	if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
+	if (!f2fs_compressed_file(inode) ||
+		is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) {
 		ret = -EINVAL;
 		goto out;
 	}
@@ -4181,22 +4339,24 @@
 	set_inode_flag(inode, FI_ENABLE_COMPRESS);
 
 	last_idx = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+	last_idx >>= fi->i_log_cluster_size;
+
+	for (cluster_idx = 0; cluster_idx < last_idx; cluster_idx++) {
+		page_idx = cluster_idx << fi->i_log_cluster_size;
+
+		if (f2fs_is_sparse_cluster(inode, page_idx))
+			continue;
 
-	count = last_idx - page_idx;
-	while (count && count >= cluster_size) {
-		ret = redirty_blocks(inode, page_idx, cluster_size);
+		ret = redirty_blocks(inode, page_idx, fi->i_cluster_size);
 		if (ret < 0)
 			break;
 
-		if (get_dirty_pages(inode) >= blk_per_seg) {
+		if (get_dirty_pages(inode) >= BLKS_PER_SEG(sbi)) {
 			ret = filemap_fdatawrite(inode->i_mapping);
 			if (ret < 0)
 				break;
 		}
 
-		count -= cluster_size;
-		page_idx += cluster_size;
-
 		cond_resched();
 		if (fatal_signal_pending(current)) {
 			ret = -EINTR;
@@ -4455,6 +4615,10 @@
 		f2fs_trace_rw_file_path(iocb->ki_filp, iocb->ki_pos,
 					iov_iter_count(to), READ);
 
+	/* In LFS mode, if there is inflight dio, wait for its completion */
+	if (f2fs_lfs_mode(F2FS_I_SB(inode)))
+		inode_dio_wait(inode);
+
 	if (f2fs_should_use_dio(inode, iocb, to)) {
 		ret = f2fs_dio_read_iter(iocb, to);
 	} else {
--- linux-qcom-6.8.0.orig/fs/f2fs/gc.c
+++ linux-qcom-6.8.0/fs/f2fs/gc.c
@@ -81,6 +81,8 @@
 			continue;
 		}
 
+		gc_control.one_time = false;
+
 		/*
 		 * [GC triggering condition]
 		 * 0. GC is not conducted currently.
@@ -116,15 +118,29 @@
 			goto next;
 		}
 
-		if (has_enough_invalid_blocks(sbi))
+		if (f2fs_sb_has_blkzoned(sbi)) {
+			if (has_enough_free_blocks(sbi, LIMIT_NO_ZONED_GC)) {
+				wait_ms = gc_th->no_gc_sleep_time;
+				f2fs_up_write(&sbi->gc_lock);
+				goto next;
+			}
+			if (wait_ms == gc_th->no_gc_sleep_time)
+				wait_ms = gc_th->max_sleep_time;
+		}
+
+		if (need_to_boost_gc(sbi)) {
 			decrease_sleep_time(gc_th, &wait_ms);
-		else
+			if (f2fs_sb_has_blkzoned(sbi))
+				gc_control.one_time = true;
+		} else {
 			increase_sleep_time(gc_th, &wait_ms);
+		}
 do_gc:
 		stat_inc_gc_call_count(sbi, foreground ?
 					FOREGROUND : BACKGROUND);
 
-		sync_mode = F2FS_OPTION(sbi).bggc_mode == BGGC_MODE_SYNC;
+		sync_mode = (F2FS_OPTION(sbi).bggc_mode == BGGC_MODE_SYNC) ||
+				gc_control.one_time;
 
 		/* foreground GC was been triggered via f2fs_balance_fs() */
 		if (foreground)
@@ -179,9 +195,16 @@
 		return -ENOMEM;
 
 	gc_th->urgent_sleep_time = DEF_GC_THREAD_URGENT_SLEEP_TIME;
-	gc_th->min_sleep_time = DEF_GC_THREAD_MIN_SLEEP_TIME;
-	gc_th->max_sleep_time = DEF_GC_THREAD_MAX_SLEEP_TIME;
-	gc_th->no_gc_sleep_time = DEF_GC_THREAD_NOGC_SLEEP_TIME;
+
+	if (f2fs_sb_has_blkzoned(sbi)) {
+		gc_th->min_sleep_time = DEF_GC_THREAD_MIN_SLEEP_TIME_ZONED;
+		gc_th->max_sleep_time = DEF_GC_THREAD_MAX_SLEEP_TIME_ZONED;
+		gc_th->no_gc_sleep_time = DEF_GC_THREAD_NOGC_SLEEP_TIME_ZONED;
+	} else {
+		gc_th->min_sleep_time = DEF_GC_THREAD_MIN_SLEEP_TIME;
+		gc_th->max_sleep_time = DEF_GC_THREAD_MAX_SLEEP_TIME;
+		gc_th->no_gc_sleep_time = DEF_GC_THREAD_NOGC_SLEEP_TIME;
+	}
 
 	gc_th->gc_wake = false;
 
@@ -228,6 +251,8 @@
 
 	switch (sbi->gc_mode) {
 	case GC_IDLE_CB:
+	case GC_URGENT_LOW:
+	case GC_URGENT_MID:
 		gc_mode = GC_CB;
 		break;
 	case GC_IDLE_GREEDY:
@@ -259,7 +284,7 @@
 		p->ofs_unit = 1;
 	} else {
 		p->gc_mode = select_gc_type(sbi, gc_type);
-		p->ofs_unit = sbi->segs_per_sec;
+		p->ofs_unit = SEGS_PER_SEC(sbi);
 		if (__is_large_section(sbi)) {
 			p->dirty_bitmap = dirty_i->dirty_secmap;
 			p->max_search = count_bits(p->dirty_bitmap,
@@ -280,11 +305,11 @@
 			p->max_search > sbi->max_victim_search)
 		p->max_search = sbi->max_victim_search;
 
-	/* let's select beginning hot/small space first in no_heap mode*/
+	/* let's select beginning hot/small space first. */
 	if (f2fs_need_rand_seg(sbi))
-		p->offset = get_random_u32_below(MAIN_SECS(sbi) * sbi->segs_per_sec);
-	else if (test_opt(sbi, NOHEAP) &&
-		(type == CURSEG_HOT_DATA || IS_NODESEG(type)))
+		p->offset = get_random_u32_below(MAIN_SECS(sbi) *
+						SEGS_PER_SEC(sbi));
+	else if (type == CURSEG_HOT_DATA || IS_NODESEG(type))
 		p->offset = 0;
 	else
 		p->offset = SIT_I(sbi)->last_victim[p->gc_mode];
@@ -295,13 +320,13 @@
 {
 	/* SSR allocates in a segment unit */
 	if (p->alloc_mode == SSR)
-		return sbi->blocks_per_seg;
+		return BLKS_PER_SEG(sbi);
 	else if (p->alloc_mode == AT_SSR)
 		return UINT_MAX;
 
 	/* LFS */
 	if (p->gc_mode == GC_GREEDY)
-		return 2 * sbi->blocks_per_seg * p->ofs_unit;
+		return 2 * BLKS_PER_SEG(sbi) * p->ofs_unit;
 	else if (p->gc_mode == GC_CB)
 		return UINT_MAX;
 	else if (p->gc_mode == GC_AT)
@@ -496,9 +521,9 @@
 			return;
 	}
 
-	for (i = 0; i < sbi->segs_per_sec; i++)
+	for (i = 0; i < SEGS_PER_SEC(sbi); i++)
 		mtime += get_seg_entry(sbi, start + i)->mtime;
-	mtime = div_u64(mtime, sbi->segs_per_sec);
+	mtime = div_u64(mtime, SEGS_PER_SEC(sbi));
 
 	/* Handle if the system time has changed by the user */
 	if (mtime < sit_i->min_mtime)
@@ -599,7 +624,6 @@
 	unsigned long long age;
 	unsigned long long max_mtime = sit_i->dirty_max_mtime;
 	unsigned long long min_mtime = sit_i->dirty_min_mtime;
-	unsigned int seg_blocks = sbi->blocks_per_seg;
 	unsigned int vblocks;
 	unsigned int dirty_threshold = max(am->max_candidate_count,
 					am->candidate_ratio *
@@ -629,7 +653,7 @@
 	f2fs_bug_on(sbi, !vblocks);
 
 	/* rare case */
-	if (vblocks == seg_blocks)
+	if (vblocks == BLKS_PER_SEG(sbi))
 		goto skip_node;
 
 	iter++;
@@ -755,7 +779,7 @@
 	int ret = 0;
 
 	mutex_lock(&dirty_i->seglist_lock);
-	last_segment = MAIN_SECS(sbi) * sbi->segs_per_sec;
+	last_segment = MAIN_SECS(sbi) * SEGS_PER_SEC(sbi);
 
 	p.alloc_mode = alloc_mode;
 	p.age = age;
@@ -896,7 +920,7 @@
 			else
 				sm->last_victim[p.gc_mode] = segno + p.ofs_unit;
 			sm->last_victim[p.gc_mode] %=
-				(MAIN_SECS(sbi) * sbi->segs_per_sec);
+				(MAIN_SECS(sbi) * SEGS_PER_SEC(sbi));
 			break;
 		}
 	}
@@ -1172,7 +1196,8 @@
 static int ra_data_block(struct inode *inode, pgoff_t index)
 {
 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
-	struct address_space *mapping = inode->i_mapping;
+	struct address_space *mapping = f2fs_is_cow_file(inode) ?
+				F2FS_I(inode)->atomic_inode->i_mapping : inode->i_mapping;
 	struct dnode_of_data dn;
 	struct page *page;
 	struct f2fs_io_info fio = {
@@ -1184,7 +1209,6 @@
 		.op_flags = 0,
 		.encrypted_page = NULL,
 		.in_list = 0,
-		.retry = 0,
 	};
 	int err;
 
@@ -1264,6 +1288,8 @@
 static int move_data_block(struct inode *inode, block_t bidx,
 				int gc_type, unsigned int segno, int off)
 {
+	struct address_space *mapping = f2fs_is_cow_file(inode) ?
+				F2FS_I(inode)->atomic_inode->i_mapping : inode->i_mapping;
 	struct f2fs_io_info fio = {
 		.sbi = F2FS_I_SB(inode),
 		.ino = inode->i_ino,
@@ -1273,7 +1299,6 @@
 		.op_flags = 0,
 		.encrypted_page = NULL,
 		.in_list = 0,
-		.retry = 0,
 	};
 	struct dnode_of_data dn;
 	struct f2fs_summary sum;
@@ -1287,7 +1312,7 @@
 				CURSEG_ALL_DATA_ATGC : CURSEG_COLD_DATA;
 
 	/* do not read out */
-	page = f2fs_grab_cache_page(inode->i_mapping, bidx, false);
+	page = f2fs_grab_cache_page(mapping, bidx, false);
 	if (!page)
 		return -ENOMEM;
 
@@ -1393,18 +1418,12 @@
 	fio.op_flags = REQ_SYNC;
 	fio.new_blkaddr = newaddr;
 	f2fs_submit_page_write(&fio);
-	if (fio.retry) {
-		err = -EAGAIN;
-		if (PageWriteback(fio.encrypted_page))
-			end_page_writeback(fio.encrypted_page);
-		goto put_page_out;
-	}
 
 	f2fs_update_iostat(fio.sbi, NULL, FS_GC_DATA_IO, F2FS_BLKSIZE);
 
 	f2fs_update_data_blkaddr(&dn, newaddr);
 	set_inode_flag(inode, FI_APPEND_WRITE);
-put_page_out:
+
 	f2fs_put_page(fio.encrypted_page, 1);
 recover_block:
 	if (err)
@@ -1560,10 +1579,25 @@
 			int err;
 
 			inode = f2fs_iget(sb, dni.ino);
-			if (IS_ERR(inode) || is_bad_inode(inode) ||
-					special_file(inode->i_mode))
+			if (IS_ERR(inode))
 				continue;
 
+			if (is_bad_inode(inode) ||
+					special_file(inode->i_mode)) {
+				iput(inode);
+				continue;
+			}
+
+			if (f2fs_has_inline_data(inode)) {
+				iput(inode);
+				set_sbi_flag(sbi, SBI_NEED_FSCK);
+				f2fs_err_ratelimited(sbi,
+					"inode %lx has both inline_data flag and "
+					"data block, nid=%u, ofs_in_node=%u",
+					inode->i_ino, dni.nid, ofs_in_node);
+				continue;
+			}
+
 			err = f2fs_gc_pinned_control(inode, gc_type, segno);
 			if (err == -EAGAIN) {
 				iput(inode);
@@ -1580,7 +1614,7 @@
 			start_bidx = f2fs_start_bidx_of_node(nofs, inode) +
 								ofs_in_node;
 
-			if (f2fs_post_read_required(inode)) {
+			if (f2fs_meta_inode_gc_required(inode)) {
 				int err = ra_data_block(inode, start_bidx);
 
 				f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
@@ -1631,7 +1665,7 @@
 
 			start_bidx = f2fs_start_bidx_of_node(nofs, inode)
 								+ ofs_in_node;
-			if (f2fs_post_read_required(inode))
+			if (f2fs_meta_inode_gc_required(inode))
 				err = move_data_block(inode, start_bidx,
 							gc_type, segno, off);
 			else
@@ -1639,7 +1673,7 @@
 								segno, off);
 
 			if (!err && (gc_type == FG_GC ||
-					f2fs_post_read_required(inode)))
+					f2fs_meta_inode_gc_required(inode)))
 				submitted++;
 
 			if (locked) {
@@ -1672,31 +1706,49 @@
 static int do_garbage_collect(struct f2fs_sb_info *sbi,
 				unsigned int start_segno,
 				struct gc_inode_list *gc_list, int gc_type,
-				bool force_migrate)
+				bool force_migrate, bool one_time)
 {
 	struct page *sum_page;
 	struct f2fs_summary_block *sum;
 	struct blk_plug plug;
 	unsigned int segno = start_segno;
-	unsigned int end_segno = start_segno + sbi->segs_per_sec;
+	unsigned int end_segno = start_segno + SEGS_PER_SEC(sbi);
+	unsigned int sec_end_segno;
 	int seg_freed = 0, migrated = 0;
 	unsigned char type = IS_DATASEG(get_seg_entry(sbi, segno)->type) ?
 						SUM_TYPE_DATA : SUM_TYPE_NODE;
 	unsigned char data_type = (type == SUM_TYPE_DATA) ? DATA : NODE;
 	int submitted = 0;
 
-	if (__is_large_section(sbi))
-		end_segno = rounddown(end_segno, sbi->segs_per_sec);
+	if (__is_large_section(sbi)) {
+		sec_end_segno = rounddown(end_segno, SEGS_PER_SEC(sbi));
 
-	/*
-	 * zone-capacity can be less than zone-size in zoned devices,
-	 * resulting in less than expected usable segments in the zone,
-	 * calculate the end segno in the zone which can be garbage collected
-	 */
-	if (f2fs_sb_has_blkzoned(sbi))
-		end_segno -= sbi->segs_per_sec -
+		/*
+		 * zone-capacity can be less than zone-size in zoned devices,
+		 * resulting in less than expected usable segments in the zone,
+		 * calculate the end segno in the zone which can be garbage
+		 * collected
+		 */
+		if (f2fs_sb_has_blkzoned(sbi))
+			sec_end_segno -= SEGS_PER_SEC(sbi) -
 					f2fs_usable_segs_in_sec(sbi, segno);
 
+		if (gc_type == BG_GC || one_time) {
+			unsigned int window_granularity =
+				sbi->migration_window_granularity;
+
+			if (f2fs_sb_has_blkzoned(sbi) &&
+					!has_enough_free_blocks(sbi,
+					LIMIT_BOOST_ZONED_GC))
+				window_granularity *= BOOST_GC_MULTIPLE;
+
+			end_segno = start_segno + window_granularity;
+		}
+
+		if (end_segno > sec_end_segno)
+			end_segno = sec_end_segno;
+	}
+
 	sanity_check_seg_type(sbi, get_seg_entry(sbi, segno)->type);
 
 	/* readahead multi ssa blocks those have contiguous address */
@@ -1775,7 +1827,8 @@
 
 		if (__is_large_section(sbi))
 			sbi->next_victim_seg[gc_type] =
-				(segno + 1 < end_segno) ? segno + 1 : NULL_SEGNO;
+				(segno + 1 < sec_end_segno) ?
+					segno + 1 : NULL_SEGNO;
 skip:
 		f2fs_put_page(sum_page, 0);
 	}
@@ -1864,7 +1917,8 @@
 	}
 
 	seg_freed = do_garbage_collect(sbi, segno, &gc_list, gc_type,
-				gc_control->should_migrate_blocks);
+				gc_control->should_migrate_blocks,
+				gc_control->one_time);
 	if (seg_freed < 0)
 		goto stop;
 
@@ -1875,6 +1929,9 @@
 		total_sec_freed++;
 	}
 
+	if (gc_control->one_time)
+		goto stop;
+
 	if (gc_type == FG_GC) {
 		sbi->cur_victim_sec = NULL_SEGNO;
 
@@ -1983,10 +2040,39 @@
 	init_atgc_management(sbi);
 }
 
+int f2fs_gc_range(struct f2fs_sb_info *sbi,
+		unsigned int start_seg, unsigned int end_seg,
+		bool dry_run, unsigned int dry_run_sections)
+{
+	unsigned int segno;
+	unsigned int gc_secs = dry_run_sections;
+
+	for (segno = start_seg; segno <= end_seg; segno += SEGS_PER_SEC(sbi)) {
+		struct gc_inode_list gc_list = {
+			.ilist = LIST_HEAD_INIT(gc_list.ilist),
+			.iroot = RADIX_TREE_INIT(gc_list.iroot, GFP_NOFS),
+		};
+
+		do_garbage_collect(sbi, segno, &gc_list, FG_GC, true, false);
+		put_gc_inode(&gc_list);
+
+		if (!dry_run && get_valid_blocks(sbi, segno, true))
+			return -EAGAIN;
+		if (dry_run && dry_run_sections &&
+		    !get_valid_blocks(sbi, segno, true) && --gc_secs == 0)
+			break;
+
+		if (fatal_signal_pending(current))
+			return -ERESTARTSYS;
+	}
+
+	return 0;
+}
+
 static int free_segment_range(struct f2fs_sb_info *sbi,
-				unsigned int secs, bool gc_only)
+				unsigned int secs, bool dry_run)
 {
-	unsigned int segno, next_inuse, start, end;
+	unsigned int next_inuse, start, end;
 	struct cp_control cpc = { CP_RESIZE, 0, 0, 0 };
 	int gc_mode, gc_type;
 	int err = 0;
@@ -1994,7 +2080,7 @@
 
 	/* Force block allocation for GC */
 	MAIN_SECS(sbi) -= secs;
-	start = MAIN_SECS(sbi) * sbi->segs_per_sec;
+	start = MAIN_SECS(sbi) * SEGS_PER_SEC(sbi);
 	end = MAIN_SEGS(sbi) - 1;
 
 	mutex_lock(&DIRTY_I(sbi)->seglist_lock);
@@ -2012,25 +2098,8 @@
 		f2fs_allocate_segment_for_resize(sbi, type, start, end);
 
 	/* do GC to move out valid blocks in the range */
-	for (segno = start; segno <= end; segno += sbi->segs_per_sec) {
-		struct gc_inode_list gc_list = {
-			.ilist = LIST_HEAD_INIT(gc_list.ilist),
-			.iroot = RADIX_TREE_INIT(gc_list.iroot, GFP_NOFS),
-		};
-
-		do_garbage_collect(sbi, segno, &gc_list, FG_GC, true);
-		put_gc_inode(&gc_list);
-
-		if (!gc_only && get_valid_blocks(sbi, segno, true)) {
-			err = -EAGAIN;
-			goto out;
-		}
-		if (fatal_signal_pending(current)) {
-			err = -ERESTARTSYS;
-			goto out;
-		}
-	}
-	if (gc_only)
+	err = f2fs_gc_range(sbi, start, end, dry_run, 0);
+	if (err || dry_run)
 		goto out;
 
 	stat_inc_cp_call_count(sbi, TOTAL_CALL);
@@ -2056,7 +2125,7 @@
 	int segment_count;
 	int segment_count_main;
 	long long block_count;
-	int segs = secs * sbi->segs_per_sec;
+	int segs = secs * SEGS_PER_SEC(sbi);
 
 	f2fs_down_write(&sbi->sb_lock);
 
@@ -2069,7 +2138,7 @@
 	raw_sb->segment_count = cpu_to_le32(segment_count + segs);
 	raw_sb->segment_count_main = cpu_to_le32(segment_count_main + segs);
 	raw_sb->block_count = cpu_to_le64(block_count +
-					(long long)segs * sbi->blocks_per_seg);
+			(long long)(segs << sbi->log_blocks_per_seg));
 	if (f2fs_is_multi_device(sbi)) {
 		int last_dev = sbi->s_ndevs - 1;
 		int dev_segs =
@@ -2084,8 +2153,8 @@
 
 static void update_fs_metadata(struct f2fs_sb_info *sbi, int secs)
 {
-	int segs = secs * sbi->segs_per_sec;
-	long long blks = (long long)segs * sbi->blocks_per_seg;
+	int segs = secs * SEGS_PER_SEC(sbi);
+	long long blks = (long long)segs << sbi->log_blocks_per_seg;
 	long long user_block_count =
 				le64_to_cpu(F2FS_CKPT(sbi)->user_block_count);
 
@@ -2127,7 +2196,7 @@
 		int last_dev = sbi->s_ndevs - 1;
 		__u64 last_segs = FDEV(last_dev).total_segments;
 
-		if (block_count + last_segs * sbi->blocks_per_seg <=
+		if (block_count + (last_segs << sbi->log_blocks_per_seg) <=
 								old_block_count)
 			return -EINVAL;
 	}
--- linux-qcom-6.8.0.orig/fs/f2fs/gc.h
+++ linux-qcom-6.8.0/fs/f2fs/gc.h
@@ -15,6 +15,11 @@
 #define DEF_GC_THREAD_MAX_SLEEP_TIME	60000
 #define DEF_GC_THREAD_NOGC_SLEEP_TIME	300000	/* wait 5 min */
 
+/* GC sleep parameters for zoned deivces */
+#define DEF_GC_THREAD_MIN_SLEEP_TIME_ZONED	10
+#define DEF_GC_THREAD_MAX_SLEEP_TIME_ZONED	20
+#define DEF_GC_THREAD_NOGC_SLEEP_TIME_ZONED	60000
+
 /* choose candidates from sections which has age of more than 7 days */
 #define DEF_GC_THREAD_AGE_THRESHOLD		(60 * 60 * 24 * 7)
 #define DEF_GC_THREAD_CANDIDATE_RATIO		20	/* select 20% oldest sections as candidates */
@@ -25,6 +30,11 @@
 #define LIMIT_INVALID_BLOCK	40 /* percentage over total user space */
 #define LIMIT_FREE_BLOCK	40 /* percentage over invalid + free space */
 
+#define LIMIT_NO_ZONED_GC	60 /* percentage over total user space of no gc for zoned devices */
+#define LIMIT_BOOST_ZONED_GC	25 /* percentage over total user space of boosted gc for zoned devices */
+#define DEF_MIGRATION_WINDOW_GRANULARITY_ZONED	3
+#define BOOST_GC_MULTIPLE	5
+
 #define DEF_GC_FAILED_PINNED_FILES	2048
 
 /* Search max. number of dirty segments to select a victim segment */
@@ -151,6 +161,12 @@
 		*wait -= min_time;
 }
 
+static inline bool has_enough_free_blocks(struct f2fs_sb_info *sbi,
+						unsigned int limit_perc)
+{
+	return free_sections(sbi) > ((sbi->total_sections * limit_perc) / 100);
+}
+
 static inline bool has_enough_invalid_blocks(struct f2fs_sb_info *sbi)
 {
 	block_t user_block_count = sbi->user_block_count;
@@ -166,3 +182,10 @@
 		free_user_blocks(sbi) <
 			limit_free_user_blocks(invalid_user_blocks));
 }
+
+static inline bool need_to_boost_gc(struct f2fs_sb_info *sbi)
+{
+	if (f2fs_sb_has_blkzoned(sbi))
+		return !has_enough_free_blocks(sbi, LIMIT_BOOST_ZONED_GC);
+	return has_enough_invalid_blocks(sbi);
+}
--- linux-qcom-6.8.0.orig/fs/f2fs/inline.c
+++ linux-qcom-6.8.0/fs/f2fs/inline.c
@@ -16,7 +16,7 @@
 
 static bool support_inline_data(struct inode *inode)
 {
-	if (f2fs_is_atomic_file(inode))
+	if (f2fs_used_in_atomic_write(inode))
 		return false;
 	if (!S_ISREG(inode->i_mode) && !S_ISLNK(inode->i_mode))
 		return false;
@@ -33,11 +33,29 @@
 	return !f2fs_post_read_required(inode);
 }
 
-bool f2fs_sanity_check_inline_data(struct inode *inode)
+static bool inode_has_blocks(struct inode *inode, struct page *ipage)
+{
+	struct f2fs_inode *ri = F2FS_INODE(ipage);
+	int i;
+
+	if (F2FS_HAS_BLOCKS(inode))
+		return true;
+
+	for (i = 0; i < DEF_NIDS_PER_INODE; i++) {
+		if (ri->i_nid[i])
+			return true;
+	}
+	return false;
+}
+
+bool f2fs_sanity_check_inline_data(struct inode *inode, struct page *ipage)
 {
 	if (!f2fs_has_inline_data(inode))
 		return false;
 
+	if (inode_has_blocks(inode, ipage))
+		return false;
+
 	if (!support_inline_data(inode))
 		return true;
 
@@ -203,8 +221,10 @@
 	struct page *ipage, *page;
 	int err = 0;
 
-	if (!f2fs_has_inline_data(inode) ||
-			f2fs_hw_is_readonly(sbi) || f2fs_readonly(sbi->sb))
+	if (f2fs_hw_is_readonly(sbi) || f2fs_readonly(sbi->sb))
+		return -EROFS;
+
+	if (!f2fs_has_inline_data(inode))
 		return 0;
 
 	err = f2fs_dquot_initialize(inode);
--- linux-qcom-6.8.0.orig/fs/f2fs/inode.c
+++ linux-qcom-6.8.0/fs/f2fs/inode.c
@@ -29,9 +29,17 @@
 	if (is_inode_flag_set(inode, FI_NEW_INODE))
 		return;
 
+	if (f2fs_readonly(F2FS_I_SB(inode)->sb))
+		return;
+
 	if (f2fs_inode_dirtied(inode, sync))
 		return;
 
+	if (f2fs_is_atomic_file(inode)) {
+		set_inode_flag(inode, FI_ATOMIC_DIRTIED);
+		return;
+	}
+
 	mark_inode_dirty_sync(inode);
 }
 
@@ -343,7 +351,7 @@
 		}
 	}
 
-	if (f2fs_sanity_check_inline_data(inode)) {
+	if (f2fs_sanity_check_inline_data(inode, node_page)) {
 		f2fs_warn(sbi, "%s: inode (ino=%lx, mode=%u) should not have inline_data, run fsck to fix",
 			  __func__, inode->i_ino, inode->i_mode);
 		return false;
@@ -361,6 +369,12 @@
 		return false;
 	}
 
+	if (fi->i_xattr_nid && f2fs_check_nid_range(sbi, fi->i_xattr_nid)) {
+		f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_xattr_nid: %u, run fsck to fix.",
+			  __func__, inode->i_ino, fi->i_xattr_nid);
+		return false;
+	}
+
 	return true;
 }
 
@@ -502,16 +516,16 @@
 
 	init_idisk_time(inode);
 
-	/* Need all the flag bits */
-	f2fs_init_read_extent_tree(inode, node_page);
-	f2fs_init_age_extent_tree(inode);
-
-	if (!sanity_check_extent_cache(inode)) {
+	if (!sanity_check_extent_cache(inode, node_page)) {
 		f2fs_put_page(node_page, 1);
 		f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE);
 		return -EFSCORRUPTED;
 	}
 
+	/* Need all the flag bits */
+	f2fs_init_read_extent_tree(inode, node_page);
+	f2fs_init_age_extent_tree(inode);
+
 	f2fs_put_page(node_page, 1);
 
 	stat_inc_inline_xattr(inode);
@@ -604,14 +618,6 @@
 	}
 	f2fs_set_inode_flags(inode);
 
-	if (file_should_truncate(inode) &&
-			!is_sbi_flag_set(sbi, SBI_POR_DOING)) {
-		ret = f2fs_truncate(inode);
-		if (ret)
-			goto bad_inode;
-		file_dont_truncate(inode);
-	}
-
 	unlock_new_inode(inode);
 	trace_f2fs_iget(inode);
 	return inode;
@@ -782,8 +788,10 @@
 		!is_inode_flag_set(inode, FI_DIRTY_INODE))
 		return 0;
 
-	if (!f2fs_is_checkpoint_ready(sbi))
+	if (!f2fs_is_checkpoint_ready(sbi)) {
+		f2fs_mark_inode_dirty_sync(inode, true);
 		return -ENOSPC;
+	}
 
 	/*
 	 * We need to balance fs here to prevent from producing dirty node pages
@@ -807,8 +815,9 @@
 
 	f2fs_abort_atomic_write(inode, true);
 
-	if (fi->cow_inode) {
+	if (fi->cow_inode && f2fs_is_cow_file(fi->cow_inode)) {
 		clear_inode_flag(fi->cow_inode, FI_COW_FILE);
+		F2FS_I(fi->cow_inode)->atomic_inode = NULL;
 		iput(fi->cow_inode);
 		fi->cow_inode = NULL;
 	}
--- linux-qcom-6.8.0.orig/fs/f2fs/namei.c
+++ linux-qcom-6.8.0/fs/f2fs/namei.c
@@ -455,62 +455,6 @@
 	return d_obtain_alias(f2fs_iget(child->d_sb, ino));
 }
 
-static int __recover_dot_dentries(struct inode *dir, nid_t pino)
-{
-	struct f2fs_sb_info *sbi = F2FS_I_SB(dir);
-	struct qstr dot = QSTR_INIT(".", 1);
-	struct f2fs_dir_entry *de;
-	struct page *page;
-	int err = 0;
-
-	if (f2fs_readonly(sbi->sb)) {
-		f2fs_info(sbi, "skip recovering inline_dots inode (ino:%lu, pino:%u) in readonly mountpoint",
-			  dir->i_ino, pino);
-		return 0;
-	}
-
-	if (!S_ISDIR(dir->i_mode)) {
-		f2fs_err(sbi, "inconsistent inode status, skip recovering inline_dots inode (ino:%lu, i_mode:%u, pino:%u)",
-			  dir->i_ino, dir->i_mode, pino);
-		set_sbi_flag(sbi, SBI_NEED_FSCK);
-		return -ENOTDIR;
-	}
-
-	err = f2fs_dquot_initialize(dir);
-	if (err)
-		return err;
-
-	f2fs_balance_fs(sbi, true);
-
-	f2fs_lock_op(sbi);
-
-	de = f2fs_find_entry(dir, &dot, &page);
-	if (de) {
-		f2fs_put_page(page, 0);
-	} else if (IS_ERR(page)) {
-		err = PTR_ERR(page);
-		goto out;
-	} else {
-		err = f2fs_do_add_link(dir, &dot, NULL, dir->i_ino, S_IFDIR);
-		if (err)
-			goto out;
-	}
-
-	de = f2fs_find_entry(dir, &dotdot_name, &page);
-	if (de)
-		f2fs_put_page(page, 0);
-	else if (IS_ERR(page))
-		err = PTR_ERR(page);
-	else
-		err = f2fs_do_add_link(dir, &dotdot_name, NULL, pino, S_IFDIR);
-out:
-	if (!err)
-		clear_inode_flag(dir, FI_INLINE_DOTS);
-
-	f2fs_unlock_op(sbi);
-	return err;
-}
-
 static struct dentry *f2fs_lookup(struct inode *dir, struct dentry *dentry,
 		unsigned int flags)
 {
@@ -520,7 +464,6 @@
 	struct dentry *new;
 	nid_t ino = -1;
 	int err = 0;
-	unsigned int root_ino = F2FS_ROOT_INO(F2FS_I_SB(dir));
 	struct f2fs_filename fname;
 
 	trace_f2fs_lookup_start(dir, dentry, flags);
@@ -557,17 +500,6 @@
 		goto out;
 	}
 
-	if ((dir->i_ino == root_ino) && f2fs_has_inline_dots(dir)) {
-		err = __recover_dot_dentries(dir, root_ino);
-		if (err)
-			goto out_iput;
-	}
-
-	if (f2fs_has_inline_dots(inode)) {
-		err = __recover_dot_dentries(inode, dir->i_ino);
-		if (err)
-			goto out_iput;
-	}
 	if (IS_ENCRYPTED(dir) &&
 	    (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) &&
 	    !fscrypt_has_permitted_context(dir, inode)) {
@@ -852,7 +784,7 @@
 
 static int __f2fs_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
 			  struct file *file, umode_t mode, bool is_whiteout,
-			  struct inode **new_inode)
+			  struct inode **new_inode, struct f2fs_filename *fname)
 {
 	struct f2fs_sb_info *sbi = F2FS_I_SB(dir);
 	struct inode *inode;
@@ -880,7 +812,7 @@
 	if (err)
 		goto out;
 
-	err = f2fs_do_tmpfile(inode, dir);
+	err = f2fs_do_tmpfile(inode, dir, fname);
 	if (err)
 		goto release_out;
 
@@ -931,22 +863,24 @@
 	if (!f2fs_is_checkpoint_ready(sbi))
 		return -ENOSPC;
 
-	err = __f2fs_tmpfile(idmap, dir, file, mode, false, NULL);
+	err = __f2fs_tmpfile(idmap, dir, file, mode, false, NULL, NULL);
 
 	return finish_open_simple(file, err);
 }
 
 static int f2fs_create_whiteout(struct mnt_idmap *idmap,
-				struct inode *dir, struct inode **whiteout)
+				struct inode *dir, struct inode **whiteout,
+				struct f2fs_filename *fname)
 {
-	return __f2fs_tmpfile(idmap, dir, NULL,
-				S_IFCHR | WHITEOUT_MODE, true, whiteout);
+	return __f2fs_tmpfile(idmap, dir, NULL, S_IFCHR | WHITEOUT_MODE,
+						true, whiteout, fname);
 }
 
 int f2fs_get_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
 		     struct inode **new_inode)
 {
-	return __f2fs_tmpfile(idmap, dir, NULL, S_IFREG, false, new_inode);
+	return __f2fs_tmpfile(idmap, dir, NULL, S_IFREG,
+				false, new_inode, NULL);
 }
 
 static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
@@ -990,7 +924,14 @@
 	}
 
 	if (flags & RENAME_WHITEOUT) {
-		err = f2fs_create_whiteout(idmap, old_dir, &whiteout);
+		struct f2fs_filename fname;
+
+		err = f2fs_setup_filename(old_dir, &old_dentry->d_name,
+							0, &fname);
+		if (err)
+			return err;
+
+		err = f2fs_create_whiteout(idmap, old_dir, &whiteout, &fname);
 		if (err)
 			return err;
 	}
--- linux-qcom-6.8.0.orig/fs/f2fs/node.c
+++ linux-qcom-6.8.0/fs/f2fs/node.c
@@ -852,21 +852,29 @@
 
 	if (is_inode_flag_set(dn->inode, FI_COMPRESSED_FILE) &&
 					f2fs_sb_has_readonly(sbi)) {
-		unsigned int c_len = f2fs_cluster_blocks_are_contiguous(dn);
+		unsigned int cluster_size = F2FS_I(dn->inode)->i_cluster_size;
+		unsigned int ofs_in_node = dn->ofs_in_node;
+		pgoff_t fofs = index;
+		unsigned int c_len;
 		block_t blkaddr;
 
+		/* should align fofs and ofs_in_node to cluster_size */
+		if (fofs % cluster_size) {
+			fofs = round_down(fofs, cluster_size);
+			ofs_in_node = round_down(ofs_in_node, cluster_size);
+		}
+
+		c_len = f2fs_cluster_blocks_are_contiguous(dn, ofs_in_node);
 		if (!c_len)
 			goto out;
 
-		blkaddr = f2fs_data_blkaddr(dn);
+		blkaddr = data_blkaddr(dn->inode, dn->node_page, ofs_in_node);
 		if (blkaddr == COMPRESS_ADDR)
 			blkaddr = data_blkaddr(dn->inode, dn->node_page,
-						dn->ofs_in_node + 1);
+						ofs_in_node + 1);
 
 		f2fs_update_read_extent_tree_range_compressed(dn->inode,
-					index, blkaddr,
-					F2FS_I(dn->inode)->i_cluster_size,
-					c_len);
+					fofs, blkaddr, cluster_size, c_len);
 	}
 out:
 	return 0;
@@ -897,6 +905,16 @@
 	if (err)
 		return err;
 
+	if (ni.blk_addr != NEW_ADDR &&
+		!f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC_ENHANCE)) {
+		f2fs_err_ratelimited(sbi,
+			"nat entry is corrupted, run fsck to fix it, ino:%u, "
+			"nid:%u, blkaddr:%u", ni.ino, ni.nid, ni.blk_addr);
+		set_sbi_flag(sbi, SBI_NEED_FSCK);
+		f2fs_handle_error(sbi, ERROR_INCONSISTENT_NAT);
+		return -EFSCORRUPTED;
+	}
+
 	/* Deallocate node address */
 	f2fs_invalidate_blocks(sbi, ni.blk_addr);
 	dec_valid_node_count(sbi, dn->inode, dn->nid == dn->inode->i_ino);
@@ -1179,7 +1197,17 @@
 		default:
 			BUG();
 		}
-		if (err < 0 && err != -ENOENT)
+		if (err == -ENOENT) {
+			set_sbi_flag(F2FS_P_SB(page), SBI_NEED_FSCK);
+			f2fs_handle_error(sbi, ERROR_INVALID_BLKADDR);
+			f2fs_err_ratelimited(sbi,
+				"truncate node fail, ino:%lu, nid:%u, "
+				"offset[0]:%d, offset[1]:%d, nofs:%d",
+				inode->i_ino, dn.nid, offset[0],
+				offset[1], nofs);
+			err = 0;
+		}
+		if (err < 0)
 			goto fail;
 		if (offset[1] == 0 &&
 				ri->i_nid[offset[0] - NODE_DIR1_BLOCK]) {
@@ -1311,8 +1339,14 @@
 	}
 	if (unlikely(new_ni.blk_addr != NULL_ADDR)) {
 		err = -EFSCORRUPTED;
+		dec_valid_node_count(sbi, dn->inode, !ofs);
 		set_sbi_flag(sbi, SBI_NEED_FSCK);
-		f2fs_handle_error(sbi, ERROR_INVALID_BLKADDR);
+		f2fs_warn_ratelimited(sbi,
+			"f2fs_new_node_page: inconsistent nat entry, "
+			"ino:%u, nid:%u, blkaddr:%u, ver:%u, flag:%u",
+			new_ni.ino, new_ni.nid, new_ni.blk_addr,
+			new_ni.version, new_ni.flag);
+		f2fs_handle_error(sbi, ERROR_INCONSISTENT_NAT);
 		goto fail;
 	}
 #endif
@@ -1337,7 +1371,6 @@
 	if (ofs == 0)
 		inc_valid_inode_count(sbi);
 	return page;
-
 fail:
 	clear_node_page_dirty(page);
 	f2fs_put_page(page, 1);
@@ -2841,7 +2874,7 @@
 	int i, idx, last_offset, nrpages;
 
 	/* scan the node segment */
-	last_offset = sbi->blocks_per_seg;
+	last_offset = BLKS_PER_SEG(sbi);
 	addr = START_BLOCK(sbi, segno);
 	sum_entry = &sum->entries[0];
 
@@ -3148,7 +3181,7 @@
 
 	nm_i->nat_bits_blocks = F2FS_BLK_ALIGN((nat_bits_bytes << 1) + 8);
 	nm_i->nat_bits = f2fs_kvzalloc(sbi,
-			nm_i->nat_bits_blocks << F2FS_BLKSIZE_BITS, GFP_KERNEL);
+			F2FS_BLK_TO_BYTES(nm_i->nat_bits_blocks), GFP_KERNEL);
 	if (!nm_i->nat_bits)
 		return -ENOMEM;
 
@@ -3158,7 +3191,7 @@
 	if (!is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG))
 		return 0;
 
-	nat_bits_addr = __start_cp_addr(sbi) + sbi->blocks_per_seg -
+	nat_bits_addr = __start_cp_addr(sbi) + BLKS_PER_SEG(sbi) -
 						nm_i->nat_bits_blocks;
 	for (i = 0; i < nm_i->nat_bits_blocks; i++) {
 		struct page *page;
@@ -3167,7 +3200,7 @@
 		if (IS_ERR(page))
 			return PTR_ERR(page);
 
-		memcpy(nm_i->nat_bits + (i << F2FS_BLKSIZE_BITS),
+		memcpy(nm_i->nat_bits + F2FS_BLK_TO_BYTES(i),
 					page_address(page), F2FS_BLKSIZE);
 		f2fs_put_page(page, 1);
 	}
--- linux-qcom-6.8.0.orig/fs/f2fs/node.h
+++ linux-qcom-6.8.0/fs/f2fs/node.h
@@ -208,10 +208,10 @@
 
 	block_addr = (pgoff_t)(nm_i->nat_blkaddr +
 		(block_off << 1) -
-		(block_off & (sbi->blocks_per_seg - 1)));
+		(block_off & (BLKS_PER_SEG(sbi) - 1)));
 
 	if (f2fs_test_bit(block_off, nm_i->nat_bitmap))
-		block_addr += sbi->blocks_per_seg;
+		block_addr += BLKS_PER_SEG(sbi);
 
 	return block_addr;
 }
--- linux-qcom-6.8.0.orig/fs/f2fs/recovery.c
+++ linux-qcom-6.8.0/fs/f2fs/recovery.c
@@ -354,7 +354,7 @@
 	if (blkaddr + 1 == next_blkaddr)
 		ra_blocks = min_t(unsigned int, RECOVERY_MAX_RA_BLOCKS,
 							ra_blocks * 2);
-	else if (next_blkaddr % sbi->blocks_per_seg)
+	else if (next_blkaddr % BLKS_PER_SEG(sbi))
 		ra_blocks = max_t(unsigned int, RECOVERY_MIN_RA_BLOCKS,
 							ra_blocks / 2);
 	return ra_blocks;
@@ -611,6 +611,19 @@
 	return 0;
 }
 
+static int f2fs_reserve_new_block_retry(struct dnode_of_data *dn)
+{
+	int i, err = 0;
+
+	for (i = DEFAULT_FAILURE_RETRY_COUNT; i > 0; i--) {
+		err = f2fs_reserve_new_block(dn);
+		if (!err)
+			break;
+	}
+
+	return err;
+}
+
 static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
 					struct page *page)
 {
@@ -712,14 +725,8 @@
 		 */
 		if (dest == NEW_ADDR) {
 			f2fs_truncate_data_blocks_range(&dn, 1);
-			do {
-				err = f2fs_reserve_new_block(&dn);
-				if (err == -ENOSPC) {
-					f2fs_bug_on(sbi, 1);
-					break;
-				}
-			} while (err &&
-				IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION));
+
+			err = f2fs_reserve_new_block_retry(&dn);
 			if (err)
 				goto err;
 			continue;
@@ -727,16 +734,8 @@
 
 		/* dest is valid block, try to recover from src to dest */
 		if (f2fs_is_valid_blkaddr(sbi, dest, META_POR)) {
-
 			if (src == NULL_ADDR) {
-				do {
-					err = f2fs_reserve_new_block(&dn);
-					if (err == -ENOSPC) {
-						f2fs_bug_on(sbi, 1);
-						break;
-					}
-				} while (err &&
-					IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION));
+				err = f2fs_reserve_new_block_retry(&dn);
 				if (err)
 					goto err;
 			}
--- linux-qcom-6.8.0.orig/fs/f2fs/segment.c
+++ linux-qcom-6.8.0/fs/f2fs/segment.c
@@ -192,16 +192,22 @@
 	if (!f2fs_is_atomic_file(inode))
 		return;
 
+	if (clean)
+		truncate_inode_pages_final(inode->i_mapping);
+
 	release_atomic_write_cnt(inode);
 	clear_inode_flag(inode, FI_ATOMIC_COMMITTED);
 	clear_inode_flag(inode, FI_ATOMIC_REPLACE);
 	clear_inode_flag(inode, FI_ATOMIC_FILE);
+	if (is_inode_flag_set(inode, FI_ATOMIC_DIRTIED)) {
+		clear_inode_flag(inode, FI_ATOMIC_DIRTIED);
+		f2fs_mark_inode_dirty_sync(inode, true);
+	}
 	stat_dec_atomic_inode(inode);
 
 	F2FS_I(inode)->atomic_write_task = NULL;
 
 	if (clean) {
-		truncate_inode_pages_final(inode->i_mapping);
 		f2fs_i_size_write(inode, fi->original_i_size);
 		fi->original_i_size = 0;
 	}
@@ -248,7 +254,7 @@
 	} else {
 		blkcnt_t count = 1;
 
-		err = inc_valid_block_count(sbi, inode, &count);
+		err = inc_valid_block_count(sbi, inode, &count, true);
 		if (err) {
 			f2fs_put_dnode(&dn);
 			return err;
@@ -366,6 +372,10 @@
 	} else {
 		sbi->committed_atomic_block += fi->atomic_write_cnt;
 		set_inode_flag(inode, FI_ATOMIC_COMMITTED);
+		if (is_inode_flag_set(inode, FI_ATOMIC_DIRTIED)) {
+			clear_inode_flag(inode, FI_ATOMIC_DIRTIED);
+			f2fs_mark_inode_dirty_sync(inode, true);
+		}
 	}
 
 	__complete_revoke_list(inode, &revoke_list, ret ? true : false);
@@ -448,8 +458,8 @@
 	unsigned int nodes = get_pages(sbi, F2FS_DIRTY_NODES);
 	unsigned int meta = get_pages(sbi, F2FS_DIRTY_META);
 	unsigned int imeta = get_pages(sbi, F2FS_DIRTY_IMETA);
-	unsigned int threshold = sbi->blocks_per_seg * factor *
-					DEFAULT_DIRTY_THRESHOLD;
+	unsigned int threshold = (factor * DEFAULT_DIRTY_THRESHOLD) <<
+				sbi->log_blocks_per_seg;
 	unsigned int global_threshold = threshold * 3 / 2;
 
 	if (dents >= threshold || qdata >= threshold ||
@@ -1101,9 +1111,8 @@
 		dc->error = 0;
 
 	if (dc->error)
-		printk_ratelimited(
-			"%sF2FS-fs (%s): Issue discard(%u, %u, %u) failed, ret: %d",
-			KERN_INFO, sbi->sb->s_id,
+		f2fs_info_ratelimited(sbi,
+			"Issue discard(%u, %u, %u) failed, ret: %d",
 			dc->di.lstart, dc->di.start, dc->di.len, dc->error);
 	__detach_discard_cmd(dcc, dc);
 }
@@ -1132,8 +1141,7 @@
 	struct seg_entry *sentry;
 	unsigned int segno;
 	block_t blk = start;
-	unsigned long offset, size, max_blocks = sbi->blocks_per_seg;
-	unsigned long *map;
+	unsigned long offset, size, *map;
 
 	while (blk < end) {
 		segno = GET_SEGNO(sbi, blk);
@@ -1143,7 +1151,7 @@
 		if (end < START_BLOCK(sbi, segno + 1))
 			size = GET_BLKOFF_FROM_SEG0(sbi, end);
 		else
-			size = max_blocks;
+			size = BLKS_PER_SEG(sbi);
 		map = (unsigned long *)(sentry->cur_valid_map);
 		offset = __find_rev_next_bit(map, size, offset);
 		f2fs_bug_on(sbi, offset != size);
@@ -1274,9 +1282,25 @@
 						wait_list, issued);
 			return 0;
 		}
+
+		/*
+		 * Issue discard for conventional zones only if the device
+		 * supports discard.
+		 */
+		if (!bdev_max_discard_sectors(bdev))
+			return -EOPNOTSUPP;
 	}
 #endif
 
+	/*
+	 * stop issuing discard for any of below cases:
+	 * 1. device is conventional zone, but it doesn't support discard.
+	 * 2. device is regulare device, after snapshot it doesn't support
+	 * discard.
+	 */
+	if (!bdev_max_discard_sectors(bdev))
+		return -EOPNOTSUPP;
+
 	trace_f2fs_issue_discard(bdev, dc->di.start, dc->di.len);
 
 	lstart = dc->di.lstart;
@@ -2042,7 +2066,6 @@
 							bool check_only)
 {
 	int entries = SIT_VBLOCK_MAP_SIZE / sizeof(unsigned long);
-	int max_blocks = sbi->blocks_per_seg;
 	struct seg_entry *se = get_seg_entry(sbi, cpc->trim_start);
 	unsigned long *cur_map = (unsigned long *)se->cur_valid_map;
 	unsigned long *ckpt_map = (unsigned long *)se->ckpt_valid_map;
@@ -2054,8 +2077,9 @@
 	struct list_head *head = &SM_I(sbi)->dcc_info->entry_list;
 	int i;
 
-	if (se->valid_blocks == max_blocks || !f2fs_hw_support_discard(sbi) ||
-			!f2fs_block_unit_discard(sbi))
+	if (se->valid_blocks == BLKS_PER_SEG(sbi) ||
+	    !f2fs_hw_support_discard(sbi) ||
+	    !f2fs_block_unit_discard(sbi))
 		return false;
 
 	if (!force) {
@@ -2072,13 +2096,14 @@
 
 	while (force || SM_I(sbi)->dcc_info->nr_discards <=
 				SM_I(sbi)->dcc_info->max_discards) {
-		start = __find_rev_next_bit(dmap, max_blocks, end + 1);
-		if (start >= max_blocks)
+		start = __find_rev_next_bit(dmap, BLKS_PER_SEG(sbi), end + 1);
+		if (start >= BLKS_PER_SEG(sbi))
 			break;
 
-		end = __find_rev_next_zero_bit(dmap, max_blocks, start + 1);
-		if (force && start && end != max_blocks
-					&& (end - start) < cpc->trim_minlen)
+		end = __find_rev_next_zero_bit(dmap,
+						BLKS_PER_SEG(sbi), start + 1);
+		if (force && start && end != BLKS_PER_SEG(sbi) &&
+		    (end - start) < cpc->trim_minlen)
 			continue;
 
 		if (check_only)
@@ -2160,8 +2185,8 @@
 								start + 1);
 
 		if (section_alignment) {
-			start = rounddown(start, sbi->segs_per_sec);
-			end = roundup(end, sbi->segs_per_sec);
+			start = rounddown(start, SEGS_PER_SEC(sbi));
+			end = roundup(end, SEGS_PER_SEC(sbi));
 		}
 
 		for (i = start; i < end; i++) {
@@ -2189,9 +2214,9 @@
 		if (!IS_CURSEC(sbi, secno) &&
 			!get_valid_blocks(sbi, start, true))
 			f2fs_issue_discard(sbi, START_BLOCK(sbi, start_segno),
-				sbi->segs_per_sec << sbi->log_blocks_per_seg);
+						BLKS_PER_SEC(sbi));
 
-		start = start_segno + sbi->segs_per_sec;
+		start = start_segno + SEGS_PER_SEC(sbi);
 		if (start < end)
 			goto next;
 		else
@@ -2210,7 +2235,7 @@
 find_next:
 		if (is_valid) {
 			next_pos = find_next_zero_bit_le(entry->discard_map,
-					sbi->blocks_per_seg, cur_pos);
+						BLKS_PER_SEG(sbi), cur_pos);
 			len = next_pos - cur_pos;
 
 			if (f2fs_sb_has_blkzoned(sbi) ||
@@ -2222,13 +2247,13 @@
 			total_len += len;
 		} else {
 			next_pos = find_next_bit_le(entry->discard_map,
-					sbi->blocks_per_seg, cur_pos);
+						BLKS_PER_SEG(sbi), cur_pos);
 		}
 skip:
 		cur_pos = next_pos;
 		is_valid = !is_valid;
 
-		if (cur_pos < sbi->blocks_per_seg)
+		if (cur_pos < BLKS_PER_SEG(sbi))
 			goto find_next;
 
 		release_discard_addr(entry);
@@ -2277,7 +2302,7 @@
 	dcc->max_ordered_discard = DEFAULT_MAX_ORDERED_DISCARD_GRANULARITY;
 	dcc->discard_io_aware = DPOLICY_IO_AWARE_ENABLE;
 	if (F2FS_OPTION(sbi).discard_unit == DISCARD_UNIT_SEGMENT)
-		dcc->discard_granularity = sbi->blocks_per_seg;
+		dcc->discard_granularity = BLKS_PER_SEG(sbi);
 	else if (F2FS_OPTION(sbi).discard_unit == DISCARD_UNIT_SECTION)
 		dcc->discard_granularity = BLKS_PER_SEC(sbi);
 
@@ -2399,6 +2424,8 @@
 #endif
 
 	segno = GET_SEGNO(sbi, blkaddr);
+	if (segno == NULL_SEGNO)
+		return;
 
 	se = get_seg_entry(sbi, segno);
 	new_vblocks = se->valid_blocks + del;
@@ -2540,7 +2567,7 @@
 	struct curseg_info *curseg = CURSEG_I(sbi, type);
 
 	if (sbi->ckpt->alloc_type[type] == SSR)
-		return sbi->blocks_per_seg;
+		return BLKS_PER_SEG(sbi);
 	return curseg->next_blkoff;
 }
 
@@ -2628,7 +2655,7 @@
 	unsigned int segno = curseg->segno + 1;
 	struct free_segmap_info *free_i = FREE_I(sbi);
 
-	if (segno < MAIN_SEGS(sbi) && segno % sbi->segs_per_sec)
+	if (segno < MAIN_SEGS(sbi) && segno % SEGS_PER_SEC(sbi))
 		return !test_bit(segno, free_i->free_segmap);
 	return 0;
 }
@@ -2638,53 +2665,68 @@
  * This function should be returned with success, otherwise BUG
  */
 static void get_new_segment(struct f2fs_sb_info *sbi,
-			unsigned int *newseg, bool new_sec, int dir)
+			unsigned int *newseg, bool new_sec, bool pinning)
 {
 	struct free_segmap_info *free_i = FREE_I(sbi);
 	unsigned int segno, secno, zoneno;
 	unsigned int total_zones = MAIN_SECS(sbi) / sbi->secs_per_zone;
 	unsigned int hint = GET_SEC_FROM_SEG(sbi, *newseg);
 	unsigned int old_zoneno = GET_ZONE_FROM_SEG(sbi, *newseg);
-	unsigned int left_start = hint;
 	bool init = true;
-	int go_left = 0;
 	int i;
+	int ret = 0;
 
 	spin_lock(&free_i->segmap_lock);
 
-	if (!new_sec && ((*newseg + 1) % sbi->segs_per_sec)) {
+	if (!new_sec && ((*newseg + 1) % SEGS_PER_SEC(sbi))) {
 		segno = find_next_zero_bit(free_i->free_segmap,
 			GET_SEG_FROM_SEC(sbi, hint + 1), *newseg + 1);
 		if (segno < GET_SEG_FROM_SEC(sbi, hint + 1))
 			goto got_it;
 	}
+
+#ifdef CONFIG_BLK_DEV_ZONED
+	/*
+	 * If we format f2fs on zoned storage, let's try to get pinned sections
+	 * from beginning of the storage, which should be a conventional one.
+	 */
+	if (f2fs_sb_has_blkzoned(sbi)) {
+		/* Prioritize writing to conventional zones */
+		if (sbi->blkzone_alloc_policy == BLKZONE_ALLOC_PRIOR_CONV || pinning)
+			segno = 0;
+		else
+			segno = max(first_zoned_segno(sbi), *newseg);
+		hint = GET_SEC_FROM_SEG(sbi, segno);
+	}
+#endif
+
 find_other_zone:
 	secno = find_next_zero_bit(free_i->free_secmap, MAIN_SECS(sbi), hint);
-	if (secno >= MAIN_SECS(sbi)) {
-		if (dir == ALLOC_RIGHT) {
+
+#ifdef CONFIG_BLK_DEV_ZONED
+	if (secno >= MAIN_SECS(sbi) && f2fs_sb_has_blkzoned(sbi)) {
+		/* Write only to sequential zones */
+		if (sbi->blkzone_alloc_policy == BLKZONE_ALLOC_ONLY_SEQ) {
+			hint = GET_SEC_FROM_SEG(sbi, first_zoned_segno(sbi));
+			secno = find_next_zero_bit(free_i->free_secmap, MAIN_SECS(sbi), hint);
+		} else
 			secno = find_first_zero_bit(free_i->free_secmap,
-							MAIN_SECS(sbi));
-			f2fs_bug_on(sbi, secno >= MAIN_SECS(sbi));
-		} else {
-			go_left = 1;
-			left_start = hint - 1;
+								MAIN_SECS(sbi));
+		if (secno >= MAIN_SECS(sbi)) {
+			ret = -ENOSPC;
+			goto out_unlock;
 		}
 	}
-	if (go_left == 0)
-		goto skip_left;
+#endif
 
-	while (test_bit(left_start, free_i->free_secmap)) {
-		if (left_start > 0) {
-			left_start--;
-			continue;
-		}
-		left_start = find_first_zero_bit(free_i->free_secmap,
+	if (secno >= MAIN_SECS(sbi)) {
+		secno = find_first_zero_bit(free_i->free_secmap,
 							MAIN_SECS(sbi));
-		f2fs_bug_on(sbi, left_start >= MAIN_SECS(sbi));
-		break;
+		if (secno >= MAIN_SECS(sbi)) {
+			ret = -ENOSPC;
+			goto out_unlock;
+		}
 	}
-	secno = left_start;
-skip_left:
 	segno = GET_SEG_FROM_SEC(sbi, secno);
 	zoneno = GET_ZONE_FROM_SEC(sbi, secno);
 
@@ -2695,21 +2737,13 @@
 		goto got_it;
 	if (zoneno == old_zoneno)
 		goto got_it;
-	if (dir == ALLOC_LEFT) {
-		if (!go_left && zoneno + 1 >= total_zones)
-			goto got_it;
-		if (go_left && zoneno == 0)
-			goto got_it;
-	}
 	for (i = 0; i < NR_CURSEG_TYPE; i++)
 		if (CURSEG_I(sbi, i)->zone == zoneno)
 			break;
 
 	if (i < NR_CURSEG_TYPE) {
 		/* zone is in user, try another */
-		if (go_left)
-			hint = zoneno * sbi->secs_per_zone - 1;
-		else if (zoneno + 1 >= total_zones)
+		if (zoneno + 1 >= total_zones)
 			hint = 0;
 		else
 			hint = (zoneno + 1) * sbi->secs_per_zone;
@@ -2721,7 +2755,13 @@
 	f2fs_bug_on(sbi, test_bit(segno, free_i->free_segmap));
 	__set_inuse(sbi, segno);
 	*newseg = segno;
+out_unlock:
 	spin_unlock(&free_i->segmap_lock);
+
+	if (ret) {
+		f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_NO_SEGMENT);
+		f2fs_bug_on(sbi, 1);
+	}
 }
 
 static void reset_curseg(struct f2fs_sb_info *sbi, int type, int modified)
@@ -2755,9 +2795,8 @@
 
 	sanity_check_seg_type(sbi, seg_type);
 	if (f2fs_need_rand_seg(sbi))
-		return get_random_u32_below(MAIN_SECS(sbi) * sbi->segs_per_sec);
+		return get_random_u32_below(MAIN_SECS(sbi) * SEGS_PER_SEC(sbi));
 
-	/* if segs_per_sec is large than 1, we need to keep original policy. */
 	if (__is_large_section(sbi))
 		return curseg->segno;
 
@@ -2768,8 +2807,7 @@
 	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED)))
 		return 0;
 
-	if (test_opt(sbi, NOHEAP) &&
-		(seg_type == CURSEG_HOT_DATA || IS_NODESEG(seg_type)))
+	if (seg_type == CURSEG_HOT_DATA || IS_NODESEG(seg_type))
 		return 0;
 
 	if (SIT_I(sbi)->last_victim[ALLOC_NEXT])
@@ -2786,30 +2824,30 @@
  * Allocate a current working segment.
  * This function always allocates a free segment in LFS manner.
  */
-static void new_curseg(struct f2fs_sb_info *sbi, int type, bool new_sec)
+static int new_curseg(struct f2fs_sb_info *sbi, int type, bool new_sec)
 {
 	struct curseg_info *curseg = CURSEG_I(sbi, type);
-	unsigned short seg_type = curseg->seg_type;
 	unsigned int segno = curseg->segno;
-	int dir = ALLOC_LEFT;
+	bool pinning = type == CURSEG_COLD_DATA_PINNED;
 
 	if (curseg->inited)
-		write_sum_page(sbi, curseg->sum_blk,
-				GET_SUM_BLOCK(sbi, segno));
-	if (seg_type == CURSEG_WARM_DATA || seg_type == CURSEG_COLD_DATA)
-		dir = ALLOC_RIGHT;
-
-	if (test_opt(sbi, NOHEAP))
-		dir = ALLOC_RIGHT;
+		write_sum_page(sbi, curseg->sum_blk, GET_SUM_BLOCK(sbi, segno));
 
 	segno = __get_next_segno(sbi, type);
-	get_new_segment(sbi, &segno, new_sec, dir);
+	get_new_segment(sbi, &segno, new_sec, pinning);
+	if (new_sec && pinning &&
+	    !f2fs_valid_pinned_area(sbi, START_BLOCK(sbi, segno))) {
+		__set_free(sbi, segno);
+		return -EAGAIN;
+	}
+
 	curseg->next_segno = segno;
 	reset_curseg(sbi, type, 1);
 	curseg->alloc_type = LFS;
 	if (F2FS_OPTION(sbi).fs_mode == FS_MODE_FRAGMENT_BLK)
 		curseg->fragment_remained_chunk =
 				get_random_u32_inclusive(1, sbi->max_fragment_chunk);
+	return 0;
 }
 
 static int __next_free_blkoff(struct f2fs_sb_info *sbi,
@@ -2825,7 +2863,7 @@
 	for (i = 0; i < entries; i++)
 		target_map[i] = ckpt_map[i] | cur_map[i];
 
-	return __find_rev_next_zero_bit(target_map, sbi->blocks_per_seg, start);
+	return __find_rev_next_zero_bit(target_map, BLKS_PER_SEG(sbi), start);
 }
 
 static int f2fs_find_next_ssr_block(struct f2fs_sb_info *sbi,
@@ -2836,7 +2874,7 @@
 
 bool f2fs_segment_has_free_slot(struct f2fs_sb_info *sbi, int segno)
 {
-	return __next_free_blkoff(sbi, segno, 0) < sbi->blocks_per_seg;
+	return __next_free_blkoff(sbi, segno, 0) < BLKS_PER_SEG(sbi);
 }
 
 /*
@@ -2851,7 +2889,8 @@
 	struct f2fs_summary_block *sum_node;
 	struct page *sum_page;
 
-	write_sum_page(sbi, curseg->sum_blk, GET_SUM_BLOCK(sbi, curseg->segno));
+	if (curseg->inited)
+		write_sum_page(sbi, curseg->sum_blk, GET_SUM_BLOCK(sbi, curseg->segno));
 
 	__set_test_and_inuse(sbi, new_segno);
 
@@ -3082,7 +3121,7 @@
 	f2fs_up_read(&SM_I(sbi)->curseg_lock);
 }
 
-static void __allocate_new_segment(struct f2fs_sb_info *sbi, int type,
+static int __allocate_new_segment(struct f2fs_sb_info *sbi, int type,
 						bool new_sec, bool force)
 {
 	struct curseg_info *curseg = CURSEG_I(sbi, type);
@@ -3092,21 +3131,49 @@
 	    !curseg->next_blkoff &&
 	    !get_valid_blocks(sbi, curseg->segno, new_sec) &&
 	    !get_ckpt_valid_blocks(sbi, curseg->segno, new_sec))
-		return;
+		return 0;
 
 	old_segno = curseg->segno;
-	new_curseg(sbi, type, true);
+	if (new_curseg(sbi, type, true))
+		return -EAGAIN;
 	stat_inc_seg_type(sbi, curseg);
 	locate_dirty_segment(sbi, old_segno);
+	return 0;
 }
 
-void f2fs_allocate_new_section(struct f2fs_sb_info *sbi, int type, bool force)
+int f2fs_allocate_new_section(struct f2fs_sb_info *sbi, int type, bool force)
 {
+	int ret;
+
 	f2fs_down_read(&SM_I(sbi)->curseg_lock);
 	down_write(&SIT_I(sbi)->sentry_lock);
-	__allocate_new_segment(sbi, type, true, force);
+	ret = __allocate_new_segment(sbi, type, true, force);
 	up_write(&SIT_I(sbi)->sentry_lock);
 	f2fs_up_read(&SM_I(sbi)->curseg_lock);
+
+	return ret;
+}
+
+int f2fs_allocate_pinning_section(struct f2fs_sb_info *sbi)
+{
+	int err;
+	bool gc_required = true;
+
+retry:
+	f2fs_lock_op(sbi);
+	err = f2fs_allocate_new_section(sbi, CURSEG_COLD_DATA_PINNED, false);
+	f2fs_unlock_op(sbi);
+
+	if (f2fs_sb_has_blkzoned(sbi) && err && gc_required) {
+		f2fs_down_write(&sbi->gc_lock);
+		f2fs_gc_range(sbi, 0, GET_SEGNO(sbi, FDEV(0).end_blk), true, 1);
+		f2fs_up_write(&sbi->gc_lock);
+
+		gc_required = false;
+		goto retry;
+	}
+
+	return err;
 }
 
 void f2fs_allocate_new_segments(struct f2fs_sb_info *sbi)
@@ -3236,8 +3303,8 @@
 	end_segno = (end >= MAX_BLKADDR(sbi)) ? MAIN_SEGS(sbi) - 1 :
 						GET_SEGNO(sbi, end);
 	if (need_align) {
-		start_segno = rounddown(start_segno, sbi->segs_per_sec);
-		end_segno = roundup(end_segno + 1, sbi->segs_per_sec) - 1;
+		start_segno = rounddown(start_segno, SEGS_PER_SEC(sbi));
+		end_segno = roundup(end_segno + 1, SEGS_PER_SEC(sbi)) - 1;
 	}
 
 	cpc.reason = CP_DISCARD;
@@ -3345,7 +3412,9 @@
 		if (page_private_gcing(fio->page)) {
 			if (fio->sbi->am.atgc_enabled &&
 				(fio->io_type == FS_DATA_IO) &&
-				(fio->sbi->gc_mode != GC_URGENT_HIGH))
+				(fio->sbi->gc_mode != GC_URGENT_HIGH) &&
+				__is_valid_data_blkaddr(fio->old_blkaddr) &&
+				!is_inode_flag_set(inode, FI_OPU_WRITE))
 				return CURSEG_ALL_DATA_ATGC;
 			else
 				return CURSEG_COLD_DATA;
@@ -3435,7 +3504,7 @@
 	}
 	*new_blkaddr = NEXT_FREE_BLKADDR(sbi, curseg);
 
-	f2fs_bug_on(sbi, curseg->next_blkoff >= sbi->blocks_per_seg);
+	f2fs_bug_on(sbi, curseg->next_blkoff >= BLKS_PER_SEG(sbi));
 
 	f2fs_wait_discard_bio(sbi, *new_blkaddr);
 
@@ -3464,14 +3533,20 @@
 	 * since SSR needs latest valid block information.
 	 */
 	update_sit_entry(sbi, *new_blkaddr, 1);
-	if (GET_SEGNO(sbi, old_blkaddr) != NULL_SEGNO)
-		update_sit_entry(sbi, old_blkaddr, -1);
+	update_sit_entry(sbi, old_blkaddr, -1);
 
 	/*
 	 * If the current segment is full, flush it out and replace it with a
 	 * new segment.
 	 */
 	if (segment_full) {
+		if (type == CURSEG_COLD_DATA_PINNED &&
+		    !((curseg->segno + 1) % sbi->segs_per_sec)) {
+			write_sum_page(sbi, curseg->sum_blk,
+					GET_SUM_BLOCK(sbi, curseg->segno));
+			goto skip_new_segment;
+		}
+
 		if (from_gc) {
 			get_atssr_segment(sbi, type, se->type,
 						AT_SSR, se->mtime);
@@ -3483,6 +3558,8 @@
 			stat_inc_seg_type(sbi, curseg);
 		}
 	}
+
+skip_new_segment:
 	/*
 	 * segment dirty status should be updated after segment allocation,
 	 * so we just need to update status only one time after previous
@@ -3491,12 +3568,12 @@
 	locate_dirty_segment(sbi, GET_SEGNO(sbi, old_blkaddr));
 	locate_dirty_segment(sbi, GET_SEGNO(sbi, *new_blkaddr));
 
-	if (IS_DATASEG(type))
+	if (IS_DATASEG(curseg->seg_type))
 		atomic64_inc(&sbi->allocated_data_blocks);
 
 	up_write(&sit_i->sentry_lock);
 
-	if (page && IS_NODESEG(type)) {
+	if (page && IS_NODESEG(curseg->seg_type)) {
 		fill_node_footer_blkaddr(page, NEXT_FREE_BLKADDR(sbi, curseg));
 
 		f2fs_inode_chksum_set(sbi, page);
@@ -3505,9 +3582,6 @@
 	if (fio) {
 		struct f2fs_bio_info *io;
 
-		if (F2FS_IO_ALIGNED(sbi))
-			fio->retry = 0;
-
 		INIT_LIST_HEAD(&fio->list);
 		fio->in_list = 1;
 		io = sbi->write_io[fio->type] + fio->temp;
@@ -3555,7 +3629,7 @@
 
 	if (keep_order)
 		f2fs_down_read(&fio->sbi->io_order_lock);
-reallocate:
+
 	f2fs_allocate_data_block(fio->sbi, fio->page, fio->old_blkaddr,
 			&fio->new_blkaddr, sum, type, fio);
 	if (GET_SEGNO(fio->sbi, fio->old_blkaddr) != NULL_SEGNO)
@@ -3563,10 +3637,6 @@
 
 	/* writeout dirty page into bdev */
 	f2fs_submit_page_write(fio);
-	if (fio->retry) {
-		fio->old_blkaddr = fio->new_blkaddr;
-		goto reallocate;
-	}
 
 	f2fs_update_device_state(fio->sbi, fio->ino, fio->new_blkaddr, 1);
 
@@ -3652,9 +3722,8 @@
 		goto drop_bio;
 	}
 
-	if (fio->post_read)
-		invalidate_mapping_pages(META_MAPPING(sbi),
-				fio->new_blkaddr, fio->new_blkaddr);
+	if (fio->meta_gc)
+		f2fs_truncate_meta_inode_pages(sbi, fio->new_blkaddr, 1);
 
 	stat_inc_inplace_blocks(fio->sbi);
 
@@ -3730,8 +3799,8 @@
 		}
 	}
 
-	f2fs_bug_on(sbi, !IS_DATASEG(type));
 	curseg = CURSEG_I(sbi, type);
+	f2fs_bug_on(sbi, !IS_DATASEG(curseg->seg_type));
 
 	mutex_lock(&curseg->curseg_mutex);
 	down_write(&sit_i->sentry_lock);
@@ -3819,7 +3888,7 @@
 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 	struct page *cpage;
 
-	if (!f2fs_post_read_required(inode))
+	if (!f2fs_meta_inode_gc_required(inode))
 		return;
 
 	if (!__is_valid_data_blkaddr(blkaddr))
@@ -3838,13 +3907,13 @@
 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 	block_t i;
 
-	if (!f2fs_post_read_required(inode))
+	if (!f2fs_meta_inode_gc_required(inode))
 		return;
 
 	for (i = 0; i < len; i++)
 		f2fs_wait_on_block_writeback(inode, blkaddr + i);
 
-	invalidate_mapping_pages(META_MAPPING(sbi), blkaddr, blkaddr + len - 1);
+	f2fs_truncate_meta_inode_pages(sbi, blkaddr, len);
 }
 
 static int read_compacted_summaries(struct f2fs_sb_info *sbi)
@@ -3886,7 +3955,7 @@
 		seg_i->next_blkoff = blk_off;
 
 		if (seg_i->alloc_type == SSR)
-			blk_off = sbi->blocks_per_seg;
+			blk_off = BLKS_PER_SEG(sbi);
 
 		for (j = 0; j < blk_off; j++) {
 			struct f2fs_summary *s;
@@ -3954,7 +4023,7 @@
 			struct f2fs_summary *ns = &sum->entries[0];
 			int i;
 
-			for (i = 0; i < sbi->blocks_per_seg; i++, ns++) {
+			for (i = 0; i < BLKS_PER_SEG(sbi); i++, ns++) {
 				ns->version = 0;
 				ns->ofs_in_node = 0;
 			}
@@ -4587,21 +4656,20 @@
 
 			sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks;
 
-			if (f2fs_block_unit_discard(sbi)) {
-				/* build discard map only one time */
-				if (is_set_ckpt_flags(sbi, CP_TRIMMED_FLAG)) {
-					memset(se->discard_map, 0xff,
+			if (!f2fs_block_unit_discard(sbi))
+				goto init_discard_map_done;
+
+			/* build discard map only one time */
+			if (is_set_ckpt_flags(sbi, CP_TRIMMED_FLAG)) {
+				memset(se->discard_map, 0xff,
 						SIT_VBLOCK_MAP_SIZE);
-				} else {
-					memcpy(se->discard_map,
-						se->cur_valid_map,
+				goto init_discard_map_done;
+			}
+			memcpy(se->discard_map, se->cur_valid_map,
 						SIT_VBLOCK_MAP_SIZE);
-					sbi->discard_blks +=
-						sbi->blocks_per_seg -
+			sbi->discard_blks += BLKS_PER_SEG(sbi) -
 						se->valid_blocks;
-				}
-			}
-
+init_discard_map_done:
 			if (__is_large_section(sbi))
 				get_sec_entry(sbi, start)->valid_blocks +=
 							se->valid_blocks;
@@ -4741,7 +4809,7 @@
 		return;
 
 	mutex_lock(&dirty_i->seglist_lock);
-	for (segno = 0; segno < MAIN_SEGS(sbi); segno += sbi->segs_per_sec) {
+	for (segno = 0; segno < MAIN_SEGS(sbi); segno += SEGS_PER_SEC(sbi)) {
 		valid_blocks = get_valid_blocks(sbi, segno, true);
 		secno = GET_SEC_FROM_SEG(sbi, segno);
 
@@ -4840,7 +4908,7 @@
 		if (curseg->alloc_type == SSR)
 			continue;
 
-		for (blkofs += 1; blkofs < sbi->blocks_per_seg; blkofs++) {
+		for (blkofs += 1; blkofs < BLKS_PER_SEG(sbi); blkofs++) {
 			if (!f2fs_test_bit(blkofs, se->cur_valid_map))
 				continue;
 out:
@@ -5119,7 +5187,7 @@
 	unsigned int secno;
 
 	if (!sbi->unusable_blocks_per_sec)
-		return sbi->blocks_per_seg;
+		return BLKS_PER_SEG(sbi);
 
 	secno = GET_SEC_FROM_SEG(sbi, segno);
 	seg_start = START_BLOCK(sbi, segno);
@@ -5134,10 +5202,10 @@
 	 */
 	if (seg_start >= sec_cap_blkaddr)
 		return 0;
-	if (seg_start + sbi->blocks_per_seg > sec_cap_blkaddr)
+	if (seg_start + BLKS_PER_SEG(sbi) > sec_cap_blkaddr)
 		return sec_cap_blkaddr - seg_start;
 
-	return sbi->blocks_per_seg;
+	return BLKS_PER_SEG(sbi);
 }
 #else
 int f2fs_fix_curseg_write_pointer(struct f2fs_sb_info *sbi)
@@ -5163,7 +5231,7 @@
 	if (f2fs_sb_has_blkzoned(sbi))
 		return f2fs_usable_zone_blks_in_seg(sbi, segno);
 
-	return sbi->blocks_per_seg;
+	return BLKS_PER_SEG(sbi);
 }
 
 unsigned int f2fs_usable_segs_in_sec(struct f2fs_sb_info *sbi,
@@ -5172,7 +5240,7 @@
 	if (f2fs_sb_has_blkzoned(sbi))
 		return CAP_SEGS_PER_SEC(sbi);
 
-	return sbi->segs_per_sec;
+	return SEGS_PER_SEC(sbi);
 }
 
 /*
@@ -5187,14 +5255,14 @@
 
 	sit_i->min_mtime = ULLONG_MAX;
 
-	for (segno = 0; segno < MAIN_SEGS(sbi); segno += sbi->segs_per_sec) {
+	for (segno = 0; segno < MAIN_SEGS(sbi); segno += SEGS_PER_SEC(sbi)) {
 		unsigned int i;
 		unsigned long long mtime = 0;
 
-		for (i = 0; i < sbi->segs_per_sec; i++)
+		for (i = 0; i < SEGS_PER_SEC(sbi); i++)
 			mtime += get_seg_entry(sbi, segno + i)->mtime;
 
-		mtime = div_u64(mtime, sbi->segs_per_sec);
+		mtime = div_u64(mtime, SEGS_PER_SEC(sbi));
 
 		if (sit_i->min_mtime > mtime)
 			sit_i->min_mtime = mtime;
@@ -5233,7 +5301,7 @@
 		sm_info->ipu_policy = BIT(F2FS_IPU_FSYNC);
 	sm_info->min_ipu_util = DEF_MIN_IPU_UTIL;
 	sm_info->min_fsync_blocks = DEF_MIN_FSYNC_BLOCKS;
-	sm_info->min_seq_blocks = sbi->blocks_per_seg;
+	sm_info->min_seq_blocks = BLKS_PER_SEG(sbi);
 	sm_info->min_hot_blocks = DEF_MIN_HOT_BLOCKS;
 	sm_info->min_ssr_sections = reserved_sections(sbi);
 
--- linux-qcom-6.8.0.orig/fs/f2fs/segment.h
+++ linux-qcom-6.8.0/fs/f2fs/segment.h
@@ -48,21 +48,21 @@
 
 #define IS_CURSEC(sbi, secno)						\
 	(((secno) == CURSEG_I(sbi, CURSEG_HOT_DATA)->segno /		\
-	  (sbi)->segs_per_sec) ||	\
+	  SEGS_PER_SEC(sbi)) ||	\
 	 ((secno) == CURSEG_I(sbi, CURSEG_WARM_DATA)->segno /		\
-	  (sbi)->segs_per_sec) ||	\
+	  SEGS_PER_SEC(sbi)) ||	\
 	 ((secno) == CURSEG_I(sbi, CURSEG_COLD_DATA)->segno /		\
-	  (sbi)->segs_per_sec) ||	\
+	  SEGS_PER_SEC(sbi)) ||	\
 	 ((secno) == CURSEG_I(sbi, CURSEG_HOT_NODE)->segno /		\
-	  (sbi)->segs_per_sec) ||	\
+	  SEGS_PER_SEC(sbi)) ||	\
 	 ((secno) == CURSEG_I(sbi, CURSEG_WARM_NODE)->segno /		\
-	  (sbi)->segs_per_sec) ||	\
+	  SEGS_PER_SEC(sbi)) ||	\
 	 ((secno) == CURSEG_I(sbi, CURSEG_COLD_NODE)->segno /		\
-	  (sbi)->segs_per_sec) ||	\
+	  SEGS_PER_SEC(sbi)) ||	\
 	 ((secno) == CURSEG_I(sbi, CURSEG_COLD_DATA_PINNED)->segno /	\
-	  (sbi)->segs_per_sec) ||	\
+	  SEGS_PER_SEC(sbi)) ||	\
 	 ((secno) == CURSEG_I(sbi, CURSEG_ALL_DATA_ATGC)->segno /	\
-	  (sbi)->segs_per_sec))
+	  SEGS_PER_SEC(sbi)))
 
 #define MAIN_BLKADDR(sbi)						\
 	(SM_I(sbi) ? SM_I(sbi)->main_blkaddr : 				\
@@ -93,24 +93,22 @@
 #define GET_SEGNO_FROM_SEG0(sbi, blk_addr)				\
 	(GET_SEGOFF_FROM_SEG0(sbi, blk_addr) >> (sbi)->log_blocks_per_seg)
 #define GET_BLKOFF_FROM_SEG0(sbi, blk_addr)				\
-	(GET_SEGOFF_FROM_SEG0(sbi, blk_addr) & ((sbi)->blocks_per_seg - 1))
+	(GET_SEGOFF_FROM_SEG0(sbi, blk_addr) & (BLKS_PER_SEG(sbi) - 1))
 
 #define GET_SEGNO(sbi, blk_addr)					\
 	((!__is_valid_data_blkaddr(blk_addr)) ?			\
 	NULL_SEGNO : GET_L2R_SEGNO(FREE_I(sbi),			\
 		GET_SEGNO_FROM_SEG0(sbi, blk_addr)))
-#define BLKS_PER_SEC(sbi)					\
-	((sbi)->segs_per_sec * (sbi)->blocks_per_seg)
 #define CAP_BLKS_PER_SEC(sbi)					\
-	((sbi)->segs_per_sec * (sbi)->blocks_per_seg -		\
+	(SEGS_PER_SEC(sbi) * BLKS_PER_SEG(sbi) -		\
 	 (sbi)->unusable_blocks_per_sec)
 #define CAP_SEGS_PER_SEC(sbi)					\
-	((sbi)->segs_per_sec - ((sbi)->unusable_blocks_per_sec >>\
+	(SEGS_PER_SEC(sbi) - ((sbi)->unusable_blocks_per_sec >>	\
 	(sbi)->log_blocks_per_seg))
 #define GET_SEC_FROM_SEG(sbi, segno)				\
-	(((segno) == -1) ? -1 : (segno) / (sbi)->segs_per_sec)
+	(((segno) == -1) ? -1 : (segno) / SEGS_PER_SEC(sbi))
 #define GET_SEG_FROM_SEC(sbi, secno)				\
-	((secno) * (sbi)->segs_per_sec)
+	((secno) * SEGS_PER_SEC(sbi))
 #define GET_ZONE_FROM_SEC(sbi, secno)				\
 	(((secno) == -1) ? -1 : (secno) / (sbi)->secs_per_zone)
 #define GET_ZONE_FROM_SEG(sbi, segno)				\
@@ -139,16 +137,6 @@
 	((sectors) >> F2FS_LOG_SECTORS_PER_BLOCK)
 
 /*
- * indicate a block allocation direction: RIGHT and LEFT.
- * RIGHT means allocating new sections towards the end of volume.
- * LEFT means the opposite direction.
- */
-enum {
-	ALLOC_RIGHT = 0,
-	ALLOC_LEFT
-};
-
-/*
  * In the victim_sel_policy->alloc_mode, there are three block allocation modes.
  * LFS writes data sequentially with cleaning operations.
  * SSR (Slack Space Recycle) reuses obsolete space without cleaning operations.
@@ -360,11 +348,12 @@
 				unsigned int segno, bool use_section)
 {
 	if (use_section && __is_large_section(sbi)) {
-		unsigned int start_segno = START_SEGNO(segno);
+		unsigned int secno = GET_SEC_FROM_SEG(sbi, segno);
+		unsigned int start_segno = GET_SEG_FROM_SEC(sbi, secno);
 		unsigned int blocks = 0;
 		int i;
 
-		for (i = 0; i < sbi->segs_per_sec; i++, start_segno++) {
+		for (i = 0; i < SEGS_PER_SEC(sbi); i++, start_segno++) {
 			struct seg_entry *se = get_seg_entry(sbi, start_segno);
 
 			blocks += se->ckpt_valid_blocks;
@@ -449,7 +438,7 @@
 	free_i->free_segments++;
 
 	next = find_next_bit(free_i->free_segmap,
-			start_segno + sbi->segs_per_sec, start_segno);
+			start_segno + SEGS_PER_SEC(sbi), start_segno);
 	if (next >= start_segno + usable_segs) {
 		clear_bit(secno, free_i->free_secmap);
 		free_i->free_sections++;
@@ -485,7 +474,7 @@
 		if (!inmem && IS_CURSEC(sbi, secno))
 			goto skip_free;
 		next = find_next_bit(free_i->free_segmap,
-				start_segno + sbi->segs_per_sec, start_segno);
+				start_segno + SEGS_PER_SEC(sbi), start_segno);
 		if (next >= start_segno + usable_segs) {
 			if (test_and_clear_bit(secno, free_i->free_secmap))
 				free_i->free_sections++;
@@ -570,34 +559,37 @@
 }
 
 static inline bool has_curseg_enough_space(struct f2fs_sb_info *sbi,
-			unsigned int node_blocks, unsigned int dent_blocks)
+			unsigned int node_blocks, unsigned int data_blocks,
+			unsigned int dent_blocks)
 {
 
-	unsigned int segno, left_blocks;
+	unsigned int segno, left_blocks, blocks;
 	int i;
 
-	/* check current node segment */
-	for (i = CURSEG_HOT_NODE; i <= CURSEG_COLD_NODE; i++) {
+	/* check current data/node sections in the worst case. */
+	for (i = CURSEG_HOT_DATA; i < NR_PERSISTENT_LOG; i++) {
 		segno = CURSEG_I(sbi, i)->segno;
-		left_blocks = f2fs_usable_blks_in_seg(sbi, segno) -
-				get_seg_entry(sbi, segno)->ckpt_valid_blocks;
+		left_blocks = CAP_BLKS_PER_SEC(sbi) -
+				get_ckpt_valid_blocks(sbi, segno, true);
 
-		if (node_blocks > left_blocks)
+		blocks = i <= CURSEG_COLD_DATA ? data_blocks : node_blocks;
+		if (blocks > left_blocks)
 			return false;
 	}
 
-	/* check current data segment */
+	/* check current data section for dentry blocks. */
 	segno = CURSEG_I(sbi, CURSEG_HOT_DATA)->segno;
-	left_blocks = f2fs_usable_blks_in_seg(sbi, segno) -
-			get_seg_entry(sbi, segno)->ckpt_valid_blocks;
+	left_blocks = CAP_BLKS_PER_SEC(sbi) -
+			get_ckpt_valid_blocks(sbi, segno, true);
 	if (dent_blocks > left_blocks)
 		return false;
 	return true;
 }
 
 /*
- * calculate needed sections for dirty node/dentry
- * and call has_curseg_enough_space
+ * calculate needed sections for dirty node/dentry and call
+ * has_curseg_enough_space, please note that, it needs to account
+ * dirty data as well in lfs mode when checkpoint is disabled.
  */
 static inline void __get_secs_required(struct f2fs_sb_info *sbi,
 		unsigned int *lower_p, unsigned int *upper_p, bool *curseg_p)
@@ -606,19 +598,30 @@
 					get_pages(sbi, F2FS_DIRTY_DENTS) +
 					get_pages(sbi, F2FS_DIRTY_IMETA);
 	unsigned int total_dent_blocks = get_pages(sbi, F2FS_DIRTY_DENTS);
+	unsigned int total_data_blocks = 0;
 	unsigned int node_secs = total_node_blocks / CAP_BLKS_PER_SEC(sbi);
 	unsigned int dent_secs = total_dent_blocks / CAP_BLKS_PER_SEC(sbi);
+	unsigned int data_secs = 0;
 	unsigned int node_blocks = total_node_blocks % CAP_BLKS_PER_SEC(sbi);
 	unsigned int dent_blocks = total_dent_blocks % CAP_BLKS_PER_SEC(sbi);
+	unsigned int data_blocks = 0;
+
+	if (f2fs_lfs_mode(sbi) &&
+		unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
+		total_data_blocks = get_pages(sbi, F2FS_DIRTY_DATA);
+		data_secs = total_data_blocks / CAP_BLKS_PER_SEC(sbi);
+		data_blocks = total_data_blocks % CAP_BLKS_PER_SEC(sbi);
+	}
 
 	if (lower_p)
-		*lower_p = node_secs + dent_secs;
+		*lower_p = node_secs + dent_secs + data_secs;
 	if (upper_p)
 		*upper_p = node_secs + dent_secs +
-			(node_blocks ? 1 : 0) + (dent_blocks ? 1 : 0);
+			(node_blocks ? 1 : 0) + (dent_blocks ? 1 : 0) +
+			(data_blocks ? 1 : 0);
 	if (curseg_p)
 		*curseg_p = has_curseg_enough_space(sbi,
-				node_blocks, dent_blocks);
+				node_blocks, data_blocks, dent_blocks);
 }
 
 static inline bool has_not_enough_free_secs(struct f2fs_sb_info *sbi,
@@ -638,7 +641,7 @@
 
 	if (free_secs > upper_secs)
 		return false;
-	else if (free_secs <= lower_secs)
+	if (free_secs <= lower_secs)
 		return true;
 	return !curseg_space;
 }
@@ -793,10 +796,10 @@
 		return -EFSCORRUPTED;
 	}
 
-	if (usable_blks_per_seg < sbi->blocks_per_seg)
+	if (usable_blks_per_seg < BLKS_PER_SEG(sbi))
 		f2fs_bug_on(sbi, find_next_bit_le(&raw_sit->valid_map,
-				sbi->blocks_per_seg,
-				usable_blks_per_seg) != sbi->blocks_per_seg);
+				BLKS_PER_SEG(sbi),
+				usable_blks_per_seg) != BLKS_PER_SEG(sbi));
 
 	/* check segment usage, and check boundary of a given segment number */
 	if (unlikely(GET_SIT_VBLOCKS(raw_sit) > usable_blks_per_seg
@@ -915,9 +918,9 @@
 		return 0;
 
 	if (type == DATA)
-		return sbi->blocks_per_seg;
+		return BLKS_PER_SEG(sbi);
 	else if (type == NODE)
-		return 8 * sbi->blocks_per_seg;
+		return 8 * BLKS_PER_SEG(sbi);
 	else if (type == META)
 		return 8 * BIO_MAX_VECS;
 	else
@@ -969,3 +972,13 @@
 	dcc->discard_wake = true;
 	wake_up_interruptible_all(&dcc->discard_wait_queue);
 }
+
+static inline unsigned int first_zoned_segno(struct f2fs_sb_info *sbi)
+{
+	int devi;
+
+	for (devi = 0; devi < sbi->s_ndevs; devi++)
+		if (bdev_is_zoned(FDEV(devi).bdev))
+			return GET_SEGNO(sbi, FDEV(devi).start_blk);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/fs/f2fs/super.c
+++ linux-qcom-6.8.0/fs/f2fs/super.c
@@ -64,21 +64,31 @@
 	[FAULT_BLKADDR]		= "invalid blkaddr",
 };
 
-void f2fs_build_fault_attr(struct f2fs_sb_info *sbi, unsigned int rate,
-							unsigned int type)
+int f2fs_build_fault_attr(struct f2fs_sb_info *sbi, unsigned long rate,
+							unsigned long type)
 {
 	struct f2fs_fault_info *ffi = &F2FS_OPTION(sbi).fault_info;
 
 	if (rate) {
+		if (rate > INT_MAX)
+			return -EINVAL;
 		atomic_set(&ffi->inject_ops, 0);
-		ffi->inject_rate = rate;
+		ffi->inject_rate = (int)rate;
 	}
 
-	if (type)
-		ffi->inject_type = type;
+	if (type) {
+		if (type >= BIT(FAULT_MAX))
+			return -EINVAL;
+		ffi->inject_type = (unsigned int)type;
+	}
 
 	if (!rate && !type)
 		memset(ffi, 0, sizeof(struct f2fs_fault_info));
+	else
+		f2fs_info(sbi,
+			"build fault injection attr: rate: %lu, type: 0x%lx",
+								rate, type);
+	return 0;
 }
 #endif
 
@@ -137,7 +147,6 @@
 	Opt_resgid,
 	Opt_resuid,
 	Opt_mode,
-	Opt_io_size_bits,
 	Opt_fault_injection,
 	Opt_fault_type,
 	Opt_lazytime,
@@ -216,7 +225,6 @@
 	{Opt_resgid, "resgid=%u"},
 	{Opt_resuid, "resuid=%u"},
 	{Opt_mode, "mode=%s"},
-	{Opt_io_size_bits, "io_bits=%u"},
 	{Opt_fault_injection, "fault_injection=%u"},
 	{Opt_fault_type, "fault_type=%u"},
 	{Opt_lazytime, "lazytime"},
@@ -263,7 +271,8 @@
 	{Opt_err, NULL},
 };
 
-void f2fs_printk(struct f2fs_sb_info *sbi, const char *fmt, ...)
+void f2fs_printk(struct f2fs_sb_info *sbi, bool limit_rate,
+						const char *fmt, ...)
 {
 	struct va_format vaf;
 	va_list args;
@@ -274,8 +283,12 @@
 	level = printk_get_level(fmt);
 	vaf.fmt = printk_skip_level(fmt);
 	vaf.va = &args;
-	printk("%c%cF2FS-fs (%s): %pV\n",
-	       KERN_SOH_ASCII, level, sbi->sb->s_id, &vaf);
+	if (limit_rate)
+		printk_ratelimited("%c%cF2FS-fs (%s): %pV\n",
+			KERN_SOH_ASCII, level, sbi->sb->s_id, &vaf);
+	else
+		printk("%c%cF2FS-fs (%s): %pV\n",
+			KERN_SOH_ASCII, level, sbi->sb->s_id, &vaf);
 
 	va_end(args);
 }
@@ -343,46 +356,6 @@
 					   F2FS_OPTION(sbi).s_resgid));
 }
 
-static inline int adjust_reserved_segment(struct f2fs_sb_info *sbi)
-{
-	unsigned int sec_blks = sbi->blocks_per_seg * sbi->segs_per_sec;
-	unsigned int avg_vblocks;
-	unsigned int wanted_reserved_segments;
-	block_t avail_user_block_count;
-
-	if (!F2FS_IO_ALIGNED(sbi))
-		return 0;
-
-	/* average valid block count in section in worst case */
-	avg_vblocks = sec_blks / F2FS_IO_SIZE(sbi);
-
-	/*
-	 * we need enough free space when migrating one section in worst case
-	 */
-	wanted_reserved_segments = (F2FS_IO_SIZE(sbi) / avg_vblocks) *
-						reserved_segments(sbi);
-	wanted_reserved_segments -= reserved_segments(sbi);
-
-	avail_user_block_count = sbi->user_block_count -
-				sbi->current_reserved_blocks -
-				F2FS_OPTION(sbi).root_reserved_blocks;
-
-	if (wanted_reserved_segments * sbi->blocks_per_seg >
-					avail_user_block_count) {
-		f2fs_err(sbi, "IO align feature can't grab additional reserved segment: %u, available segments: %u",
-			wanted_reserved_segments,
-			avail_user_block_count >> sbi->log_blocks_per_seg);
-		return -ENOSPC;
-	}
-
-	SM_I(sbi)->additional_reserved_segments = wanted_reserved_segments;
-
-	f2fs_info(sbi, "IO align feature needs additional reserved segment: %u",
-			 wanted_reserved_segments);
-
-	return 0;
-}
-
 static inline void adjust_unusable_cap_perc(struct f2fs_sb_info *sbi)
 {
 	if (!F2FS_OPTION(sbi).unusable_cap_perc)
@@ -663,7 +636,7 @@
 #ifdef CONFIG_F2FS_FS_ZSTD
 static int f2fs_set_zstd_level(struct f2fs_sb_info *sbi, const char *str)
 {
-	unsigned int level;
+	int level;
 	int len = 4;
 
 	if (strlen(str) == len) {
@@ -677,9 +650,15 @@
 		f2fs_info(sbi, "wrong format, e.g. <alg_name>:<compr_level>");
 		return -EINVAL;
 	}
-	if (kstrtouint(str + 1, 10, &level))
+	if (kstrtoint(str + 1, 10, &level))
 		return -EINVAL;
 
+	/* f2fs does not support negative compress level now */
+	if (level < 0) {
+		f2fs_info(sbi, "do not support negative compress level: %d", level);
+		return -ERANGE;
+	}
+
 	if (!f2fs_is_compress_level_valid(COMPRESS_ZSTD, level)) {
 		f2fs_info(sbi, "invalid zstd compress level: %d", level);
 		return -EINVAL;
@@ -730,6 +709,11 @@
 			if (!strcmp(name, "on")) {
 				F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_ON;
 			} else if (!strcmp(name, "off")) {
+				if (f2fs_sb_has_blkzoned(sbi)) {
+					f2fs_warn(sbi, "zoned devices need bggc");
+					kfree(name);
+					return -EINVAL;
+				}
 				F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_OFF;
 			} else if (!strcmp(name, "sync")) {
 				F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_SYNC;
@@ -763,10 +747,8 @@
 			clear_opt(sbi, DISCARD);
 			break;
 		case Opt_noheap:
-			set_opt(sbi, NOHEAP);
-			break;
 		case Opt_heap:
-			clear_opt(sbi, NOHEAP);
+			f2fs_warn(sbi, "heap/no_heap options were deprecated");
 			break;
 #ifdef CONFIG_F2FS_FS_XATTR
 		case Opt_user_xattr:
@@ -913,28 +895,21 @@
 			}
 			kfree(name);
 			break;
-		case Opt_io_size_bits:
-			if (args->from && match_int(args, &arg))
-				return -EINVAL;
-			if (arg <= 0 || arg > __ilog2_u32(BIO_MAX_VECS)) {
-				f2fs_warn(sbi, "Not support %ld, larger than %d",
-					BIT(arg), BIO_MAX_VECS);
-				return -EINVAL;
-			}
-			F2FS_OPTION(sbi).write_io_size_bits = arg;
-			break;
 #ifdef CONFIG_F2FS_FAULT_INJECTION
 		case Opt_fault_injection:
 			if (args->from && match_int(args, &arg))
 				return -EINVAL;
-			f2fs_build_fault_attr(sbi, arg, F2FS_ALL_FAULT_TYPE);
+			if (f2fs_build_fault_attr(sbi, arg,
+					F2FS_ALL_FAULT_TYPE))
+				return -EINVAL;
 			set_opt(sbi, FAULT_INJECTION);
 			break;
 
 		case Opt_fault_type:
 			if (args->from && match_int(args, &arg))
 				return -EINVAL;
-			f2fs_build_fault_attr(sbi, 0, arg);
+			if (f2fs_build_fault_attr(sbi, 0, arg))
+				return -EINVAL;
 			set_opt(sbi, FAULT_INJECTION);
 			break;
 #else
@@ -1392,12 +1367,6 @@
 	}
 #endif
 
-	if (F2FS_IO_SIZE_BITS(sbi) && !f2fs_lfs_mode(sbi)) {
-		f2fs_err(sbi, "Should set mode=lfs with %luKB-sized IO",
-			 F2FS_IO_SIZE_KB(sbi));
-		return -EINVAL;
-	}
-
 	if (test_opt(sbi, INLINE_XATTR_SIZE)) {
 		int min_size, max_size;
 
@@ -1718,7 +1687,6 @@
 
 	f2fs_destroy_page_array_cache(sbi);
 	f2fs_destroy_xattr_caches(sbi);
-	mempool_destroy(sbi->write_io_dummy);
 #ifdef CONFIG_QUOTA
 	for (i = 0; i < MAXQUOTAS; i++)
 		kfree(F2FS_OPTION(sbi).s_qf_names[i]);
@@ -1779,6 +1747,18 @@
 
 static int f2fs_unfreeze(struct super_block *sb)
 {
+	struct f2fs_sb_info *sbi = F2FS_SB(sb);
+
+	/*
+	 * It will update discard_max_bytes of mounted lvm device to zero
+	 * after creating snapshot on this lvm device, let's drop all
+	 * remained discards.
+	 * We don't need to disable real-time discard because discard_max_bytes
+	 * will recover after removal of snapshot.
+	 */
+	if (test_opt(sbi, DISCARD) && !f2fs_hw_support_discard(sbi))
+		f2fs_issue_discard_timeout(sbi);
+
 	clear_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING);
 	return 0;
 }
@@ -2009,10 +1989,6 @@
 	} else {
 		seq_puts(seq, ",nodiscard");
 	}
-	if (test_opt(sbi, NOHEAP))
-		seq_puts(seq, ",no_heap");
-	else
-		seq_puts(seq, ",heap");
 #ifdef CONFIG_F2FS_FS_XATTR
 	if (test_opt(sbi, XATTR_USER))
 		seq_puts(seq, ",user_xattr");
@@ -2078,9 +2054,6 @@
 					F2FS_OPTION(sbi).s_resuid),
 				from_kgid_munged(&init_user_ns,
 					F2FS_OPTION(sbi).s_resgid));
-	if (F2FS_IO_SIZE_BITS(sbi))
-		seq_printf(seq, ",io_bits=%u",
-				F2FS_OPTION(sbi).write_io_size_bits);
 #ifdef CONFIG_F2FS_FAULT_INJECTION
 	if (test_opt(sbi, FAULT_INJECTION)) {
 		seq_printf(seq, ",fault_injection=%u",
@@ -2187,12 +2160,9 @@
 	F2FS_OPTION(sbi).memory_mode = MEMORY_MODE_NORMAL;
 	F2FS_OPTION(sbi).errors = MOUNT_ERRORS_CONTINUE;
 
-	sbi->sb->s_flags &= ~SB_INLINECRYPT;
-
 	set_opt(sbi, INLINE_XATTR);
 	set_opt(sbi, INLINE_DATA);
 	set_opt(sbi, INLINE_DENTRY);
-	set_opt(sbi, NOHEAP);
 	set_opt(sbi, MERGE_CHECKPOINT);
 	F2FS_OPTION(sbi).unusable_cap = 0;
 	sbi->sb->s_flags |= SB_LAZYTIME;
@@ -2332,7 +2302,6 @@
 	bool no_read_extent_cache = !test_opt(sbi, READ_EXTENT_CACHE);
 	bool no_age_extent_cache = !test_opt(sbi, AGE_EXTENT_CACHE);
 	bool enable_checkpoint = !test_opt(sbi, DISABLE_CHECKPOINT);
-	bool no_io_align = !F2FS_IO_ALIGNED(sbi);
 	bool no_atgc = !test_opt(sbi, ATGC);
 	bool no_discard = !test_opt(sbi, DISCARD);
 	bool no_compress_cache = !test_opt(sbi, COMPRESS_CACHE);
@@ -2382,6 +2351,17 @@
 	if (err)
 		goto restore_opts;
 
+#ifdef CONFIG_BLK_DEV_ZONED
+	if (f2fs_sb_has_blkzoned(sbi) &&
+		sbi->max_open_zones < F2FS_OPTION(sbi).active_logs) {
+		f2fs_err(sbi,
+			"zoned: max open zones %u is too small, need at least %u open zones",
+				 sbi->max_open_zones, F2FS_OPTION(sbi).active_logs);
+		err = -EINVAL;
+		goto restore_opts;
+	}
+#endif
+
 	/* flush outstanding errors before changing fs state */
 	flush_work(&sbi->s_error_work);
 
@@ -2440,12 +2420,6 @@
 		goto restore_opts;
 	}
 
-	if (no_io_align == !!F2FS_IO_ALIGNED(sbi)) {
-		err = -EINVAL;
-		f2fs_warn(sbi, "switch io_bits option is not allowed");
-		goto restore_opts;
-	}
-
 	if (no_compress_cache == !!test_opt(sbi, COMPRESS_CACHE)) {
 		err = -EINVAL;
 		f2fs_warn(sbi, "switch compress_cache option is not allowed");
@@ -2609,6 +2583,11 @@
 	return err;
 }
 
+static void f2fs_shutdown(struct super_block *sb)
+{
+	f2fs_do_shutdown(F2FS_SB(sb), F2FS_GOING_DOWN_NOSYNC, false, false);
+}
+
 #ifdef CONFIG_QUOTA
 static bool f2fs_need_recovery(struct f2fs_sb_info *sbi)
 {
@@ -2768,7 +2747,7 @@
 	return dquot_initialize(inode);
 }
 
-static struct dquot **f2fs_get_dquots(struct inode *inode)
+static struct dquot __rcu **f2fs_get_dquots(struct inode *inode)
 {
 	return F2FS_I(inode)->i_dquot;
 }
@@ -3208,6 +3187,7 @@
 	.unfreeze_fs	= f2fs_unfreeze,
 	.statfs		= f2fs_statfs,
 	.remount_fs	= f2fs_remount,
+	.shutdown	= f2fs_shutdown,
 };
 
 #ifdef CONFIG_FS_ENCRYPTION
@@ -3362,7 +3342,7 @@
 	 * fit within U32_MAX + 1 data units.
 	 */
 
-	result = min(result, (((loff_t)U32_MAX + 1) * 4096) >> F2FS_BLKSIZE_BITS);
+	result = umin(result, F2FS_BYTES_TO_BLK(((loff_t)U32_MAX + 1) * 4096));
 
 	return result;
 }
@@ -3400,9 +3380,9 @@
 	u32 segment_count = le32_to_cpu(raw_super->segment_count);
 	u32 log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg);
 	u64 main_end_blkaddr = main_blkaddr +
-				(segment_count_main << log_blocks_per_seg);
+				((u64)segment_count_main << log_blocks_per_seg);
 	u64 seg_end_blkaddr = segment0_blkaddr +
-				(segment_count << log_blocks_per_seg);
+				((u64)segment_count << log_blocks_per_seg);
 
 	if (segment0_blkaddr != cp_blkaddr) {
 		f2fs_info(sbi, "Mismatch start address, segment0(%u) cp_blkaddr(%u)",
@@ -3706,7 +3686,7 @@
 	}
 
 	main_segs = le32_to_cpu(raw_super->segment_count_main);
-	blocks_per_seg = sbi->blocks_per_seg;
+	blocks_per_seg = BLKS_PER_SEG(sbi);
 
 	for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
 		if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs ||
@@ -3819,8 +3799,8 @@
 	sbi->secs_per_zone = le32_to_cpu(raw_super->secs_per_zone);
 	sbi->total_sections = le32_to_cpu(raw_super->section_count);
 	sbi->total_node_count =
-		(le32_to_cpu(raw_super->segment_count_nat) / 2)
-			* sbi->blocks_per_seg * NAT_ENTRY_PER_BLOCK;
+		((le32_to_cpu(raw_super->segment_count_nat) / 2) *
+		NAT_ENTRY_PER_BLOCK) << sbi->log_blocks_per_seg;
 	F2FS_ROOT_INO(sbi) = le32_to_cpu(raw_super->root_ino);
 	F2FS_NODE_INO(sbi) = le32_to_cpu(raw_super->node_ino);
 	F2FS_META_INO(sbi) = le32_to_cpu(raw_super->meta_ino);
@@ -3829,7 +3809,9 @@
 	sbi->next_victim_seg[BG_GC] = NULL_SEGNO;
 	sbi->next_victim_seg[FG_GC] = NULL_SEGNO;
 	sbi->max_victim_search = DEF_MAX_VICTIM_SEARCH;
-	sbi->migration_granularity = sbi->segs_per_sec;
+	sbi->migration_granularity = SEGS_PER_SEC(sbi);
+	sbi->migration_window_granularity = f2fs_sb_has_blkzoned(sbi) ?
+		DEF_MIGRATION_WINDOW_GRANULARITY_ZONED : SEGS_PER_SEC(sbi);
 	sbi->seq_file_ra_mul = MIN_RA_MUL;
 	sbi->max_fragment_chunk = DEF_FRAGMENT_SIZE;
 	sbi->max_fragment_hole = DEF_FRAGMENT_SIZE;
@@ -3924,17 +3906,25 @@
 	sector_t nr_sectors = bdev_nr_sectors(bdev);
 	struct f2fs_report_zones_args rep_zone_arg;
 	u64 zone_sectors;
+	unsigned int max_open_zones;
 	int ret;
 
 	if (!f2fs_sb_has_blkzoned(sbi))
 		return 0;
 
-	zone_sectors = bdev_zone_sectors(bdev);
-	if (!is_power_of_2(zone_sectors)) {
-		f2fs_err(sbi, "F2FS does not support non power of 2 zone sizes\n");
-		return -EINVAL;
+	if (bdev_is_zoned(FDEV(devi).bdev)) {
+		max_open_zones = bdev_max_open_zones(bdev);
+		if (max_open_zones && (max_open_zones < sbi->max_open_zones))
+			sbi->max_open_zones = max_open_zones;
+		if (sbi->max_open_zones < F2FS_OPTION(sbi).active_logs) {
+			f2fs_err(sbi,
+				"zoned: max open zones %u is too small, need at least %u open zones",
+				sbi->max_open_zones, F2FS_OPTION(sbi).active_logs);
+			return -EINVAL;
+		}
 	}
 
+	zone_sectors = bdev_zone_sectors(bdev);
 	if (sbi->blocks_per_blkz && sbi->blocks_per_blkz !=
 				SECTOR_TO_BLOCK(zone_sectors))
 		return -EINVAL;
@@ -4162,8 +4152,7 @@
 		|| system_state == SYSTEM_RESTART;
 }
 
-void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
-							bool irq_context)
+void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason)
 {
 	struct super_block *sb = sbi->sb;
 	bool shutdown = reason == STOP_CP_REASON_SHUTDOWN;
@@ -4175,10 +4164,12 @@
 	if (!f2fs_hw_is_readonly(sbi)) {
 		save_stop_reason(sbi, reason);
 
-		if (irq_context && !shutdown)
-			schedule_work(&sbi->s_error_work);
-		else
-			f2fs_record_stop_reason(sbi);
+		/*
+		 * always create an asynchronous task to record stop_reason
+		 * in order to avoid potential deadlock when running into
+		 * f2fs_record_stop_reason() synchronously.
+		 */
+		schedule_work(&sbi->s_error_work);
 	}
 
 	/*
@@ -4195,17 +4186,25 @@
 	if (shutdown)
 		set_sbi_flag(sbi, SBI_IS_SHUTDOWN);
 
-	/* continue filesystem operators if errors=continue */
-	if (continue_fs || f2fs_readonly(sb))
+	/*
+	 * Continue filesystem operators if errors=continue. Should not set
+	 * RO by shutdown, since RO bypasses thaw_super which can hang the
+	 * system.
+	 */
+	if (continue_fs || f2fs_readonly(sb) || shutdown) {
+		f2fs_warn(sbi, "Stopped filesystem due to reason: %d", reason);
 		return;
+	}
 
 	f2fs_warn(sbi, "Remounting filesystem read-only");
+
 	/*
-	 * Make sure updated value of ->s_mount_flags will be visible before
-	 * ->s_flags update
+	 * We have already set CP_ERROR_FLAG flag to stop all updates
+	 * to filesystem, so it doesn't need to set SB_RDONLY flag here
+	 * because the flag should be set covered w/ sb->s_umount semaphore
+	 * via remount procedure, otherwise, it will confuse code like
+	 * freeze_super() which will lead to deadlocks and other problems.
 	 */
-	smp_wmb();
-	sb->s_flags |= SB_RDONLY;
 }
 
 static void f2fs_record_error_work(struct work_struct *work)
@@ -4244,6 +4243,10 @@
 
 	logical_blksize = bdev_logical_block_size(sbi->sb->s_bdev);
 	sbi->aligned_blksize = true;
+#ifdef CONFIG_BLK_DEV_ZONED
+	sbi->max_open_zones = UINT_MAX;
+	sbi->blkzone_alloc_policy = BLKZONE_ALLOC_PRIOR_SEQ;
+#endif
 
 	for (i = 0; i < max_devices; i++) {
 		if (i == 0)
@@ -4305,8 +4308,6 @@
 			  FDEV(i).total_segments,
 			  FDEV(i).start_blk, FDEV(i).end_blk);
 	}
-	f2fs_info(sbi,
-		  "IO Block Size: %8ld KB", F2FS_IO_SIZE_KB(sbi));
 	return 0;
 }
 
@@ -4519,19 +4520,10 @@
 	if (err)
 		goto free_iostat;
 
-	if (F2FS_IO_ALIGNED(sbi)) {
-		sbi->write_io_dummy =
-			mempool_create_page_pool(2 * (F2FS_IO_SIZE(sbi) - 1), 0);
-		if (!sbi->write_io_dummy) {
-			err = -ENOMEM;
-			goto free_percpu;
-		}
-	}
-
 	/* init per sbi slab cache */
 	err = f2fs_init_xattr_caches(sbi);
 	if (err)
-		goto free_io_dummy;
+		goto free_percpu;
 	err = f2fs_init_page_array_cache(sbi);
 	if (err)
 		goto free_xattr_cache;
@@ -4619,10 +4611,6 @@
 		goto free_nm;
 	}
 
-	err = adjust_reserved_segment(sbi);
-	if (err)
-		goto free_nm;
-
 	/* For write statistics */
 	sbi->sectors_written_start = f2fs_get_sectors_written(sbi);
 
@@ -4853,8 +4841,6 @@
 	f2fs_destroy_page_array_cache(sbi);
 free_xattr_cache:
 	f2fs_destroy_xattr_caches(sbi);
-free_io_dummy:
-	mempool_destroy(sbi->write_io_dummy);
 free_percpu:
 	destroy_percpu_info(sbi);
 free_iostat:
@@ -5000,9 +4986,6 @@
 	err = f2fs_init_shrinker();
 	if (err)
 		goto free_sysfs;
-	err = register_filesystem(&f2fs_fs_type);
-	if (err)
-		goto free_shrinker;
 	f2fs_create_root_stats();
 	err = f2fs_init_post_read_processing();
 	if (err)
@@ -5025,7 +5008,12 @@
 	err = f2fs_create_casefold_cache();
 	if (err)
 		goto free_compress_cache;
+	err = register_filesystem(&f2fs_fs_type);
+	if (err)
+		goto free_casefold_cache;
 	return 0;
+free_casefold_cache:
+	f2fs_destroy_casefold_cache();
 free_compress_cache:
 	f2fs_destroy_compress_cache();
 free_compress_mempool:
@@ -5040,8 +5028,6 @@
 	f2fs_destroy_post_read_processing();
 free_root_stats:
 	f2fs_destroy_root_stats();
-	unregister_filesystem(&f2fs_fs_type);
-free_shrinker:
 	f2fs_exit_shrinker();
 free_sysfs:
 	f2fs_exit_sysfs();
@@ -5065,6 +5051,7 @@
 
 static void __exit exit_f2fs_fs(void)
 {
+	unregister_filesystem(&f2fs_fs_type);
 	f2fs_destroy_casefold_cache();
 	f2fs_destroy_compress_cache();
 	f2fs_destroy_compress_mempool();
@@ -5073,7 +5060,6 @@
 	f2fs_destroy_iostat_processing();
 	f2fs_destroy_post_read_processing();
 	f2fs_destroy_root_stats();
-	unregister_filesystem(&f2fs_fs_type);
 	f2fs_exit_shrinker();
 	f2fs_exit_sysfs();
 	f2fs_destroy_garbage_collection_cache();
--- linux-qcom-6.8.0.orig/fs/f2fs/sysfs.c
+++ linux-qcom-6.8.0/fs/f2fs/sysfs.c
@@ -484,17 +484,23 @@
 	if (ret < 0)
 		return ret;
 #ifdef CONFIG_F2FS_FAULT_INJECTION
-	if (a->struct_type == FAULT_INFO_TYPE && t >= BIT(FAULT_MAX))
-		return -EINVAL;
-	if (a->struct_type == FAULT_INFO_RATE && t >= UINT_MAX)
-		return -EINVAL;
+	if (a->struct_type == FAULT_INFO_TYPE) {
+		if (f2fs_build_fault_attr(sbi, 0, t))
+			return -EINVAL;
+		return count;
+	}
+	if (a->struct_type == FAULT_INFO_RATE) {
+		if (f2fs_build_fault_attr(sbi, t, 0))
+			return -EINVAL;
+		return count;
+	}
 #endif
 	if (a->struct_type == RESERVED_BLOCKS) {
 		spin_lock(&sbi->stat_lock);
 		if (t > (unsigned long)(sbi->user_block_count -
 				F2FS_OPTION(sbi).root_reserved_blocks -
-				sbi->blocks_per_seg *
-				SM_I(sbi)->additional_reserved_segments)) {
+				(SM_I(sbi)->additional_reserved_segments <<
+					sbi->log_blocks_per_seg))) {
 			spin_unlock(&sbi->stat_lock);
 			return -EINVAL;
 		}
@@ -551,7 +557,12 @@
 	}
 
 	if (!strcmp(a->attr.name, "migration_granularity")) {
-		if (t == 0 || t > sbi->segs_per_sec)
+		if (t == 0 || t > SEGS_PER_SEC(sbi))
+			return -EINVAL;
+	}
+
+	if (!strcmp(a->attr.name, "migration_window_granularity")) {
+		if (t == 0 || t > SEGS_PER_SEC(sbi))
 			return -EINVAL;
 	}
 
@@ -621,6 +632,15 @@
 	}
 #endif
 
+#ifdef CONFIG_BLK_DEV_ZONED
+	if (!strcmp(a->attr.name, "blkzone_alloc_policy")) {
+		if (t < BLKZONE_ALLOC_PRIOR_SEQ || t > BLKZONE_ALLOC_PRIOR_CONV)
+			return -EINVAL;
+		sbi->blkzone_alloc_policy = t;
+		return count;
+	}
+#endif
+
 #ifdef CONFIG_F2FS_FS_COMPRESSION
 	if (!strcmp(a->attr.name, "compr_written_block") ||
 		!strcmp(a->attr.name, "compr_saved_block")) {
@@ -988,6 +1008,7 @@
 F2FS_SBI_RW_ATTR(gc_reclaimed_segments, gc_reclaimed_segs);
 F2FS_SBI_GENERAL_RW_ATTR(max_victim_search);
 F2FS_SBI_GENERAL_RW_ATTR(migration_granularity);
+F2FS_SBI_GENERAL_RW_ATTR(migration_window_granularity);
 F2FS_SBI_GENERAL_RW_ATTR(dir_level);
 #ifdef CONFIG_F2FS_IOSTAT
 F2FS_SBI_GENERAL_RW_ATTR(iostat_enable);
@@ -1020,6 +1041,7 @@
 F2FS_SBI_GENERAL_RW_ATTR(last_age_weight);
 #ifdef CONFIG_BLK_DEV_ZONED
 F2FS_SBI_GENERAL_RO_ATTR(unusable_blocks_per_sec);
+F2FS_SBI_GENERAL_RW_ATTR(blkzone_alloc_policy);
 #endif
 
 /* STAT_INFO ATTR */
@@ -1127,6 +1149,7 @@
 	ATTR_LIST(min_ssr_sections),
 	ATTR_LIST(max_victim_search),
 	ATTR_LIST(migration_granularity),
+	ATTR_LIST(migration_window_granularity),
 	ATTR_LIST(dir_level),
 	ATTR_LIST(ram_thresh),
 	ATTR_LIST(ra_nid_pages),
@@ -1174,6 +1197,7 @@
 #endif
 #ifdef CONFIG_BLK_DEV_ZONED
 	ATTR_LIST(unusable_blocks_per_sec),
+	ATTR_LIST(blkzone_alloc_policy),
 #endif
 #ifdef CONFIG_F2FS_FS_COMPRESSION
 	ATTR_LIST(compr_written_block),
--- linux-qcom-6.8.0.orig/fs/f2fs/xattr.c
+++ linux-qcom-6.8.0/fs/f2fs/xattr.c
@@ -629,6 +629,7 @@
 			const char *name, const void *value, size_t size,
 			struct page *ipage, int flags)
 {
+	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 	struct f2fs_xattr_entry *here, *last;
 	void *base_addr, *last_base_addr;
 	int found, newsize;
@@ -772,9 +773,18 @@
 	if (index == F2FS_XATTR_INDEX_ENCRYPTION &&
 			!strcmp(name, F2FS_XATTR_NAME_ENCRYPTION_CONTEXT))
 		f2fs_set_encrypted_inode(inode);
-	if (S_ISDIR(inode->i_mode))
-		set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_CP);
 
+	if (!S_ISDIR(inode->i_mode))
+		goto same;
+	/*
+	 * In restrict mode, fsync() always try to trigger checkpoint for all
+	 * metadata consistency, in other mode, it triggers checkpoint when
+	 * parent's xattr metadata was updated.
+	 */
+	if (F2FS_OPTION(sbi).fsync_mode == FSYNC_MODE_STRICT)
+		set_sbi_flag(sbi, SBI_NEED_CP);
+	else
+		f2fs_add_ino_entry(sbi, inode->i_ino, XATTR_DIR_INO);
 same:
 	if (is_inode_flag_set(inode, FI_ACL_MODE)) {
 		inode->i_mode = F2FS_I(inode)->i_acl_mode;
--- linux-qcom-6.8.0.orig/fs/fat/namei_vfat.c
+++ linux-qcom-6.8.0/fs/fat/namei_vfat.c
@@ -1037,7 +1037,7 @@
 	if (corrupt < 0) {
 		fat_fs_error(new_dir->i_sb,
 			     "%s: Filesystem corrupted (i_pos %lld)",
-			     __func__, sinfo.i_pos);
+			     __func__, new_i_pos);
 	}
 	goto out;
 }
--- linux-qcom-6.8.0.orig/fs/fat/nfs.c
+++ linux-qcom-6.8.0/fs/fat/nfs.c
@@ -130,6 +130,12 @@
 		fid->parent_i_gen = parent->i_generation;
 		type = FILEID_FAT_WITH_PARENT;
 		*lenp = FAT_FID_SIZE_WITH_PARENT;
+	} else {
+		/*
+		 * We need to initialize this field because the fh is actually
+		 * 12 bytes long
+		 */
+		fid->parent_i_pos_hi = 0;
 	}
 
 	return type;
--- linux-qcom-6.8.0.orig/fs/fcntl.c
+++ linux-qcom-6.8.0/fs/fcntl.c
@@ -86,8 +86,8 @@
 	return error;
 }
 
-static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
-                     int force)
+void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
+		int force)
 {
 	write_lock_irq(&filp->f_owner.lock);
 	if (force || !filp->f_owner.pid) {
@@ -97,19 +97,13 @@
 
 		if (pid) {
 			const struct cred *cred = current_cred();
+			security_file_set_fowner(filp);
 			filp->f_owner.uid = cred->uid;
 			filp->f_owner.euid = cred->euid;
 		}
 	}
 	write_unlock_irq(&filp->f_owner.lock);
 }
-
-void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
-		int force)
-{
-	security_file_set_fowner(filp);
-	f_modown(filp, pid, type, force);
-}
 EXPORT_SYMBOL(__f_setown);
 
 int f_setown(struct file *filp, int who, int force)
@@ -145,7 +139,7 @@
 
 void f_delown(struct file *filp)
 {
-	f_modown(filp, NULL, PIDTYPE_TGID, 1);
+	__f_setown(filp, NULL, PIDTYPE_TGID, 1);
 }
 
 pid_t f_getown(struct file *filp)
@@ -268,7 +262,7 @@
 }
 #endif
 
-static bool rw_hint_valid(enum rw_hint hint)
+static bool rw_hint_valid(u64 hint)
 {
 	switch (hint) {
 	case RWH_WRITE_LIFE_NOT_SET:
@@ -288,19 +282,17 @@
 {
 	struct inode *inode = file_inode(file);
 	u64 __user *argp = (u64 __user *)arg;
-	enum rw_hint hint;
-	u64 h;
+	u64 hint;
 
 	switch (cmd) {
 	case F_GET_RW_HINT:
-		h = inode->i_write_hint;
-		if (copy_to_user(argp, &h, sizeof(*argp)))
+		hint = inode->i_write_hint;
+		if (copy_to_user(argp, &hint, sizeof(*argp)))
 			return -EFAULT;
 		return 0;
 	case F_SET_RW_HINT:
-		if (copy_from_user(&h, argp, sizeof(h)))
+		if (copy_from_user(&hint, argp, sizeof(hint)))
 			return -EFAULT;
-		hint = (enum rw_hint) h;
 		if (!rw_hint_valid(hint))
 			return -EINVAL;
 
--- linux-qcom-6.8.0.orig/fs/fhandle.c
+++ linux-qcom-6.8.0/fs/fhandle.c
@@ -36,7 +36,7 @@
 	if (f_handle.handle_bytes > MAX_HANDLE_SZ)
 		return -EINVAL;
 
-	handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
+	handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
 			 GFP_KERNEL);
 	if (!handle)
 		return -ENOMEM;
@@ -71,7 +71,7 @@
 	/* copy the mount id */
 	if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
 	    copy_to_user(ufh, handle,
-			 sizeof(struct file_handle) + handle_bytes))
+			 struct_size(handle, f_handle, handle_bytes)))
 		retval = -EFAULT;
 	kfree(handle);
 	return retval;
@@ -192,7 +192,7 @@
 		retval = -EINVAL;
 		goto out_err;
 	}
-	handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
+	handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
 			 GFP_KERNEL);
 	if (!handle) {
 		retval = -ENOMEM;
--- linux-qcom-6.8.0.orig/fs/file.c
+++ linux-qcom-6.8.0/fs/file.c
@@ -21,6 +21,7 @@
 #include <linux/rcupdate.h>
 #include <linux/close_range.h>
 #include <net/sock.h>
+#include <linux/init_task.h>
 
 #include "internal.h"
 
@@ -46,27 +47,23 @@
 #define BITBIT_NR(nr)	BITS_TO_LONGS(BITS_TO_LONGS(nr))
 #define BITBIT_SIZE(nr)	(BITBIT_NR(nr) * sizeof(long))
 
+#define fdt_words(fdt) ((fdt)->max_fds / BITS_PER_LONG) // words in ->open_fds
 /*
  * Copy 'count' fd bits from the old table to the new table and clear the extra
  * space if any.  This does not copy the file pointers.  Called with the files
  * spinlock held for write.
  */
-static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt,
-			    unsigned int count)
+static inline void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt,
+			    unsigned int copy_words)
 {
-	unsigned int cpy, set;
+	unsigned int nwords = fdt_words(nfdt);
 
-	cpy = count / BITS_PER_BYTE;
-	set = (nfdt->max_fds - count) / BITS_PER_BYTE;
-	memcpy(nfdt->open_fds, ofdt->open_fds, cpy);
-	memset((char *)nfdt->open_fds + cpy, 0, set);
-	memcpy(nfdt->close_on_exec, ofdt->close_on_exec, cpy);
-	memset((char *)nfdt->close_on_exec + cpy, 0, set);
-
-	cpy = BITBIT_SIZE(count);
-	set = BITBIT_SIZE(nfdt->max_fds) - cpy;
-	memcpy(nfdt->full_fds_bits, ofdt->full_fds_bits, cpy);
-	memset((char *)nfdt->full_fds_bits + cpy, 0, set);
+	bitmap_copy_and_extend(nfdt->open_fds, ofdt->open_fds,
+			copy_words * BITS_PER_LONG, nwords * BITS_PER_LONG);
+	bitmap_copy_and_extend(nfdt->close_on_exec, ofdt->close_on_exec,
+			copy_words * BITS_PER_LONG, nwords * BITS_PER_LONG);
+	bitmap_copy_and_extend(nfdt->full_fds_bits, ofdt->full_fds_bits,
+			copy_words, nwords);
 }
 
 /*
@@ -84,7 +81,7 @@
 	memcpy(nfdt->fd, ofdt->fd, cpy);
 	memset((char *)nfdt->fd + cpy, 0, set);
 
-	copy_fd_bitmaps(nfdt, ofdt, ofdt->max_fds);
+	copy_fd_bitmaps(nfdt, ofdt, fdt_words(ofdt));
 }
 
 /*
@@ -271,59 +268,45 @@
 	__clear_bit(fd / BITS_PER_LONG, fdt->full_fds_bits);
 }
 
-static unsigned int count_open_files(struct fdtable *fdt)
-{
-	unsigned int size = fdt->max_fds;
-	unsigned int i;
-
-	/* Find the last open fd */
-	for (i = size / BITS_PER_LONG; i > 0; ) {
-		if (fdt->open_fds[--i])
-			break;
-	}
-	i = (i + 1) * BITS_PER_LONG;
-	return i;
-}
-
 /*
  * Note that a sane fdtable size always has to be a multiple of
  * BITS_PER_LONG, since we have bitmaps that are sized by this.
  *
- * 'max_fds' will normally already be properly aligned, but it
- * turns out that in the close_range() -> __close_range() ->
- * unshare_fd() -> dup_fd() -> sane_fdtable_size() we can end
- * up having a 'max_fds' value that isn't already aligned.
- *
- * Rather than make close_range() have to worry about this,
- * just make that BITS_PER_LONG alignment be part of a sane
- * fdtable size. Becuase that's really what it is.
+ * punch_hole is optional - when close_range() is asked to unshare
+ * and close, we don't need to copy descriptors in that range, so
+ * a smaller cloned descriptor table might suffice if the last
+ * currently opened descriptor falls into that range.
  */
-static unsigned int sane_fdtable_size(struct fdtable *fdt, unsigned int max_fds)
+static unsigned int sane_fdtable_size(struct fdtable *fdt, struct fd_range *punch_hole)
 {
-	unsigned int count;
+	unsigned int last = find_last_bit(fdt->open_fds, fdt->max_fds);
 
-	count = count_open_files(fdt);
-	if (max_fds < NR_OPEN_DEFAULT)
-		max_fds = NR_OPEN_DEFAULT;
-	return ALIGN(min(count, max_fds), BITS_PER_LONG);
+	if (last == fdt->max_fds)
+		return NR_OPEN_DEFAULT;
+	if (punch_hole && punch_hole->to >= last && punch_hole->from <= last) {
+		last = find_last_bit(fdt->open_fds, punch_hole->from);
+		if (last == punch_hole->from)
+			return NR_OPEN_DEFAULT;
+	}
+	return ALIGN(last + 1, BITS_PER_LONG);
 }
 
 /*
- * Allocate a new files structure and copy contents from the
- * passed in files structure.
- * errorp will be valid only when the returned files_struct is NULL.
+ * Allocate a new descriptor table and copy contents from the passed in
+ * instance.  Returns a pointer to cloned table on success, ERR_PTR()
+ * on failure.  For 'punch_hole' see sane_fdtable_size().
  */
-struct files_struct *dup_fd(struct files_struct *oldf, unsigned int max_fds, int *errorp)
+struct files_struct *dup_fd(struct files_struct *oldf, struct fd_range *punch_hole)
 {
 	struct files_struct *newf;
 	struct file **old_fds, **new_fds;
 	unsigned int open_files, i;
 	struct fdtable *old_fdt, *new_fdt;
+	int error;
 
-	*errorp = -ENOMEM;
 	newf = kmem_cache_alloc(files_cachep, GFP_KERNEL);
 	if (!newf)
-		goto out;
+		return ERR_PTR(-ENOMEM);
 
 	atomic_set(&newf->count, 1);
 
@@ -340,7 +323,7 @@
 
 	spin_lock(&oldf->file_lock);
 	old_fdt = files_fdtable(oldf);
-	open_files = sane_fdtable_size(old_fdt, max_fds);
+	open_files = sane_fdtable_size(old_fdt, punch_hole);
 
 	/*
 	 * Check whether we need to allocate a larger fd array and fd set.
@@ -353,14 +336,14 @@
 
 		new_fdt = alloc_fdtable(open_files - 1);
 		if (!new_fdt) {
-			*errorp = -ENOMEM;
+			error = -ENOMEM;
 			goto out_release;
 		}
 
 		/* beyond sysctl_nr_open; nothing to do */
 		if (unlikely(new_fdt->max_fds < open_files)) {
 			__free_fdtable(new_fdt);
-			*errorp = -EMFILE;
+			error = -EMFILE;
 			goto out_release;
 		}
 
@@ -371,10 +354,10 @@
 		 */
 		spin_lock(&oldf->file_lock);
 		old_fdt = files_fdtable(oldf);
-		open_files = sane_fdtable_size(old_fdt, max_fds);
+		open_files = sane_fdtable_size(old_fdt, punch_hole);
 	}
 
-	copy_fd_bitmaps(new_fdt, old_fdt, open_files);
+	copy_fd_bitmaps(new_fdt, old_fdt, open_files / BITS_PER_LONG);
 
 	old_fds = old_fdt->fd;
 	new_fds = new_fdt->fd;
@@ -405,8 +388,7 @@
 
 out_release:
 	kmem_cache_free(files_cachep, newf);
-out:
-	return NULL;
+	return ERR_PTR(error);
 }
 
 static struct fdtable *close_files(struct files_struct * files)
@@ -481,12 +463,12 @@
 
 static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start)
 {
-	unsigned int maxfd = fdt->max_fds;
+	unsigned int maxfd = fdt->max_fds; /* always multiple of BITS_PER_LONG */
 	unsigned int maxbit = maxfd / BITS_PER_LONG;
 	unsigned int bitbit = start / BITS_PER_LONG;
 
 	bitbit = find_next_zero_bit(fdt->full_fds_bits, maxbit, bitbit) * BITS_PER_LONG;
-	if (bitbit > maxfd)
+	if (bitbit >= maxfd)
 		return maxfd;
 	if (bitbit > start)
 		start = bitbit;
@@ -747,37 +729,25 @@
 	if (fd > max_fd)
 		return -EINVAL;
 
-	if (flags & CLOSE_RANGE_UNSHARE) {
-		int ret;
-		unsigned int max_unshare_fds = NR_OPEN_MAX;
+	if ((flags & CLOSE_RANGE_UNSHARE) && atomic_read(&cur_fds->count) > 1) {
+		struct fd_range range = {fd, max_fd}, *punch_hole = &range;
 
 		/*
 		 * If the caller requested all fds to be made cloexec we always
 		 * copy all of the file descriptors since they still want to
 		 * use them.
 		 */
-		if (!(flags & CLOSE_RANGE_CLOEXEC)) {
-			/*
-			 * If the requested range is greater than the current
-			 * maximum, we're closing everything so only copy all
-			 * file descriptors beneath the lowest file descriptor.
-			 */
-			rcu_read_lock();
-			if (max_fd >= last_fd(files_fdtable(cur_fds)))
-				max_unshare_fds = fd;
-			rcu_read_unlock();
-		}
-
-		ret = unshare_fd(CLONE_FILES, max_unshare_fds, &fds);
-		if (ret)
-			return ret;
+		if (flags & CLOSE_RANGE_CLOEXEC)
+			punch_hole = NULL;
 
+		fds = dup_fd(cur_fds, punch_hole);
+		if (IS_ERR(fds))
+			return PTR_ERR(fds);
 		/*
 		 * We used to share our file descriptor table, and have now
 		 * created a private one, make sure we're using it below.
 		 */
-		if (fds)
-			swap(cur_fds, fds);
+		swap(cur_fds, fds);
 	}
 
 	if (flags & CLOSE_RANGE_CLOEXEC)
@@ -818,6 +788,7 @@
 
 	return file;
 }
+EXPORT_SYMBOL(file_close_fd);
 
 void do_close_on_exec(struct files_struct *files)
 {
@@ -1251,6 +1222,7 @@
 	 * tables and this condition does not arise without those.
 	 */
 	fdt = files_fdtable(files);
+	fd = array_index_nospec(fd, fdt->max_fds);
 	tofree = fdt->fd[fd];
 	if (!tofree && fd_is_open(fd, fdt))
 		goto Ebusy;
--- linux-qcom-6.8.0.orig/fs/fs-writeback.c
+++ linux-qcom-6.8.0/fs/fs-writeback.c
@@ -2044,6 +2044,7 @@
 	struct inode *inode;
 	long progress;
 	struct blk_plug plug;
+	bool queued = false;
 
 	blk_start_plug(&plug);
 	for (;;) {
@@ -2086,8 +2087,10 @@
 			dirtied_before = jiffies;
 
 		trace_writeback_start(wb, work);
-		if (list_empty(&wb->b_io))
+		if (list_empty(&wb->b_io)) {
 			queue_io(wb, work, dirtied_before);
+			queued = true;
+		}
 		if (work->sb)
 			progress = writeback_sb_inodes(work->sb, wb, work);
 		else
@@ -2102,7 +2105,7 @@
 		 * mean the overall work is done. So we keep looping as long
 		 * as made some progress on cleaning pages or inodes.
 		 */
-		if (progress) {
+		if (progress || !queued) {
 			spin_unlock(&wb->list_lock);
 			continue;
 		}
--- linux-qcom-6.8.0.orig/fs/fs_context.c
+++ linux-qcom-6.8.0/fs/fs_context.c
@@ -599,7 +599,7 @@
 			      param->key);
 	}
 
-	if (size + len + 2 > PAGE_SIZE)
+	if (len > PAGE_SIZE || size + len + 2 > PAGE_SIZE)
 		return invalf(fc, "VFS: Legacy: Cumulative options too large");
 	if (strchr(param->key, ',') ||
 	    (param->type == fs_value_is_string &&
--- linux-qcom-6.8.0.orig/fs/fs_parser.c
+++ linux-qcom-6.8.0/fs/fs_parser.c
@@ -308,6 +308,40 @@
 }
 EXPORT_SYMBOL(fs_param_is_fd);
 
+int fs_param_is_uid(struct p_log *log, const struct fs_parameter_spec *p,
+		    struct fs_parameter *param, struct fs_parse_result *result)
+{
+	kuid_t uid;
+
+	if (fs_param_is_u32(log, p, param, result) != 0)
+		return fs_param_bad_value(log, param);
+
+	uid = make_kuid(current_user_ns(), result->uint_32);
+	if (!uid_valid(uid))
+		return inval_plog(log, "Invalid uid '%s'", param->string);
+
+	result->uid = uid;
+	return 0;
+}
+EXPORT_SYMBOL(fs_param_is_uid);
+
+int fs_param_is_gid(struct p_log *log, const struct fs_parameter_spec *p,
+		    struct fs_parameter *param, struct fs_parse_result *result)
+{
+	kgid_t gid;
+
+	if (fs_param_is_u32(log, p, param, result) != 0)
+		return fs_param_bad_value(log, param);
+
+	gid = make_kgid(current_user_ns(), result->uint_32);
+	if (!gid_valid(gid))
+		return inval_plog(log, "Invalid gid '%s'", param->string);
+
+	result->gid = gid;
+	return 0;
+}
+EXPORT_SYMBOL(fs_param_is_gid);
+
 int fs_param_is_blockdev(struct p_log *log, const struct fs_parameter_spec *p,
 		  struct fs_parameter *param, struct fs_parse_result *result)
 {
--- linux-qcom-6.8.0.orig/fs/fuse/dev.c
+++ linux-qcom-6.8.0/fs/fuse/dev.c
@@ -773,7 +773,6 @@
 	    (folio->flags & PAGE_FLAGS_CHECK_AT_PREP &
 	     ~(1 << PG_locked |
 	       1 << PG_referenced |
-	       1 << PG_uptodate |
 	       1 << PG_lru |
 	       1 << PG_active |
 	       1 << PG_workingset |
@@ -818,9 +817,7 @@
 
 	newfolio = page_folio(buf->page);
 
-	if (!folio_test_uptodate(newfolio))
-		folio_mark_uptodate(newfolio);
-
+	folio_clear_uptodate(newfolio);
 	folio_clear_mappedtodisk(newfolio);
 
 	if (fuse_check_folio(newfolio) != 0)
@@ -1618,9 +1615,11 @@
 
 		this_num = min_t(unsigned, num, PAGE_SIZE - offset);
 		err = fuse_copy_page(cs, &page, offset, this_num, 0);
-		if (!err && offset == 0 &&
-		    (this_num == PAGE_SIZE || file_size == end))
+		if (!PageUptodate(page) && !err && offset == 0 &&
+		    (this_num == PAGE_SIZE || file_size == end)) {
+			zero_user_segment(page, this_num, PAGE_SIZE);
 			SetPageUptodate(page);
+		}
 		unlock_page(page);
 		put_page(page);
 
--- linux-qcom-6.8.0.orig/fs/fuse/dir.c
+++ linux-qcom-6.8.0/fs/fuse/dir.c
@@ -391,6 +391,10 @@
 	err = -EIO;
 	if (fuse_invalid_attr(&outarg->attr))
 		goto out_put_forget;
+	if (outarg->nodeid == FUSE_ROOT_ID && outarg->generation != 0) {
+		pr_warn_once("root generation should be zero\n");
+		outarg->generation = 0;
+	}
 
 	*inode = fuse_iget(sb, outarg->nodeid, outarg->generation,
 			   &outarg->attr, ATTR_TIMEOUT(outarg),
@@ -462,29 +466,29 @@
 {
 	struct fuse_secctx *fctx;
 	struct fuse_secctx_header *header;
-	void *ctx = NULL, *ptr;
-	u32 ctxlen, total_len = sizeof(*header);
+	struct lsmcontext lsmctx = { };
+	void *ptr;
+	u32 total_len = sizeof(*header);
 	int err, nr_ctx = 0;
-	const char *name;
+	const char *name = NULL;
 	size_t namelen;
 
 	err = security_dentry_init_security(entry, mode, &entry->d_name,
-					    &name, &ctx, &ctxlen);
-	if (err) {
-		if (err != -EOPNOTSUPP)
-			goto out_err;
-		/* No LSM is supporting this security hook. Ignore error */
-		ctxlen = 0;
-		ctx = NULL;
-	}
+					    &name, &lsmctx);
 
-	if (ctxlen) {
+	/* If no LSM is supporting this security hook ignore error */
+	if (err && err != -EOPNOTSUPP)
+		goto out_err;
+
+	if (lsmctx.len) {
 		nr_ctx = 1;
 		namelen = strlen(name) + 1;
 		err = -EIO;
-		if (WARN_ON(namelen > XATTR_NAME_MAX + 1 || ctxlen > S32_MAX))
+		if (WARN_ON(namelen > XATTR_NAME_MAX + 1 ||
+		    lsmctx.len > S32_MAX))
 			goto out_err;
-		total_len += FUSE_REC_ALIGN(sizeof(*fctx) + namelen + ctxlen);
+		total_len += FUSE_REC_ALIGN(sizeof(*fctx) + namelen +
+					    lsmctx.len);
 	}
 
 	err = -ENOMEM;
@@ -497,19 +501,20 @@
 	ptr += sizeof(*header);
 	if (nr_ctx) {
 		fctx = ptr;
-		fctx->size = ctxlen;
+		fctx->size = lsmctx.len;
 		ptr += sizeof(*fctx);
 
 		strcpy(ptr, name);
 		ptr += namelen;
 
-		memcpy(ptr, ctx, ctxlen);
+		memcpy(ptr, lsmctx.context, lsmctx.len);
 	}
 	ext->size = total_len;
 	ext->value = header;
 	err = 0;
 out_err:
-	kfree(ctx);
+	if (nr_ctx)
+		security_release_secctx(&lsmctx);
 	return err;
 }
 
@@ -664,7 +669,7 @@
 
 	err = get_create_ext(&args, dir, entry, mode);
 	if (err)
-		goto out_put_forget_req;
+		goto out_free_ff;
 
 	err = fuse_simple_request(fm, &args);
 	free_ext_value(&args);
@@ -1210,7 +1215,7 @@
 	if (((sx->mask & STATX_SIZE) && !fuse_valid_size(sx->size)) ||
 	    ((sx->mask & STATX_TYPE) && (!fuse_valid_type(sx->mode) ||
 					 inode_wrong_type(inode, sx->mode)))) {
-		make_bad_inode(inode);
+		fuse_make_bad(inode);
 		return -EIO;
 	}
 
@@ -1313,6 +1318,7 @@
 			err = fuse_do_statx(inode, file, stat);
 			if (err == -ENOSYS) {
 				fc->no_statx = 1;
+				err = 0;
 				goto retry;
 			}
 		} else {
--- linux-qcom-6.8.0.orig/fs/fuse/file.c
+++ linux-qcom-6.8.0/fs/fuse/file.c
@@ -626,7 +626,7 @@
 	args->out_args[0].size = count;
 }
 
-static void fuse_release_user_pages(struct fuse_args_pages *ap,
+static void fuse_release_user_pages(struct fuse_args_pages *ap, ssize_t nres,
 				    bool should_dirty)
 {
 	unsigned int i;
@@ -636,6 +636,9 @@
 			set_page_dirty_lock(ap->pages[i]);
 		put_page(ap->pages[i]);
 	}
+
+	if (nres > 0 && ap->args.invalidate_vmap)
+		invalidate_kernel_vmap_range(ap->args.vmap_base, nres);
 }
 
 static void fuse_io_release(struct kref *kref)
@@ -734,25 +737,29 @@
 	struct fuse_io_args *ia = container_of(args, typeof(*ia), ap.args);
 	struct fuse_io_priv *io = ia->io;
 	ssize_t pos = -1;
-
-	fuse_release_user_pages(&ia->ap, io->should_dirty);
+	size_t nres;
 
 	if (err) {
 		/* Nothing */
 	} else if (io->write) {
 		if (ia->write.out.size > ia->write.in.size) {
 			err = -EIO;
-		} else if (ia->write.in.size != ia->write.out.size) {
-			pos = ia->write.in.offset - io->offset +
-				ia->write.out.size;
+		} else {
+			nres = ia->write.out.size;
+			if (ia->write.in.size != ia->write.out.size)
+				pos = ia->write.in.offset - io->offset +
+				      ia->write.out.size;
 		}
 	} else {
 		u32 outsize = args->out_args[0].size;
 
+		nres = outsize;
 		if (ia->read.in.size != outsize)
 			pos = ia->read.in.offset - io->offset + outsize;
 	}
 
+	fuse_release_user_pages(&ia->ap, err ?: nres, io->should_dirty);
+
 	fuse_aio_complete(io, err, pos);
 	fuse_io_free(ia);
 }
@@ -1369,24 +1376,37 @@
 
 static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii,
 			       size_t *nbytesp, int write,
-			       unsigned int max_pages)
+			       unsigned int max_pages,
+			       bool use_pages_for_kvec_io)
 {
+	bool flush_or_invalidate = false;
 	size_t nbytes = 0;  /* # bytes already packed in req */
 	ssize_t ret = 0;
 
-	/* Special case for kernel I/O: can copy directly into the buffer */
+	/* Special case for kernel I/O: can copy directly into the buffer.
+	 * However if the implementation of fuse_conn requires pages instead of
+	 * pointer (e.g., virtio-fs), use iov_iter_extract_pages() instead.
+	 */
 	if (iov_iter_is_kvec(ii)) {
-		unsigned long user_addr = fuse_get_user_addr(ii);
-		size_t frag_size = fuse_get_frag_size(ii, *nbytesp);
+		void *user_addr = (void *)fuse_get_user_addr(ii);
 
-		if (write)
-			ap->args.in_args[1].value = (void *) user_addr;
-		else
-			ap->args.out_args[0].value = (void *) user_addr;
+		if (!use_pages_for_kvec_io) {
+			size_t frag_size = fuse_get_frag_size(ii, *nbytesp);
 
-		iov_iter_advance(ii, frag_size);
-		*nbytesp = frag_size;
-		return 0;
+			if (write)
+				ap->args.in_args[1].value = user_addr;
+			else
+				ap->args.out_args[0].value = user_addr;
+
+			iov_iter_advance(ii, frag_size);
+			*nbytesp = frag_size;
+			return 0;
+		}
+
+		if (is_vmalloc_addr(user_addr)) {
+			ap->args.vmap_base = user_addr;
+			flush_or_invalidate = true;
+		}
 	}
 
 	while (nbytes < *nbytesp && ap->num_pages < max_pages) {
@@ -1412,6 +1432,10 @@
 			(PAGE_SIZE - ret) & (PAGE_SIZE - 1);
 	}
 
+	if (write && flush_or_invalidate)
+		flush_kernel_vmap_range(ap->args.vmap_base, nbytes);
+
+	ap->args.invalidate_vmap = !write && flush_or_invalidate;
 	ap->args.user_pages = true;
 	if (write)
 		ap->args.in_pages = true;
@@ -1479,7 +1503,7 @@
 		size_t nbytes = min(count, nmax);
 
 		err = fuse_get_user_pages(&ia->ap, iter, &nbytes, write,
-					  max_pages);
+					  max_pages, fc->use_pages_for_kvec_io);
 		if (err && !nbytes)
 			break;
 
@@ -1493,7 +1517,7 @@
 		}
 
 		if (!io->async || nres < 0) {
-			fuse_release_user_pages(&ia->ap, io->should_dirty);
+			fuse_release_user_pages(&ia->ap, nres, io->should_dirty);
 			fuse_io_free(ia);
 		}
 		ia = NULL;
@@ -1736,10 +1760,16 @@
 	fuse_writepage_finish(fm, wpa);
 	spin_unlock(&fi->lock);
 
-	/* After fuse_writepage_finish() aux request list is private */
+	/* After rb_erase() aux request list is private */
 	for (aux = wpa->next; aux; aux = next) {
+		struct backing_dev_info *bdi = inode_to_bdi(aux->inode);
+
 		next = aux->next;
 		aux->next = NULL;
+
+		dec_wb_stat(&bdi->wb, WB_WRITEBACK);
+		dec_node_page_state(aux->ia.ap.pages[0], NR_WRITEBACK_TEMP);
+		wb_writeout_inc(&bdi->wb);
 		fuse_writepage_free(aux);
 	}
 
@@ -2468,7 +2498,8 @@
 		return fuse_dax_mmap(file, vma);
 
 	if (ff->open_flags & FOPEN_DIRECT_IO) {
-		/* Can't provide the coherency needed for MAP_SHARED
+		/*
+		 * Can't provide the coherency needed for MAP_SHARED
 		 * if FUSE_DIRECT_IO_ALLOW_MMAP isn't set.
 		 */
 		if ((vma->vm_flags & VM_MAYSHARE) && !fc->direct_io_allow_mmap)
@@ -2476,7 +2507,10 @@
 
 		invalidate_inode_pages2(file->f_mapping);
 
-		return generic_file_mmap(file, vma);
+		if (!(vma->vm_flags & VM_MAYSHARE)) {
+			/* MAP_PRIVATE */
+			return generic_file_mmap(file, vma);
+		}
 	}
 
 	if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE))
--- linux-qcom-6.8.0.orig/fs/fuse/fuse_i.h
+++ linux-qcom-6.8.0/fs/fuse/fuse_i.h
@@ -283,9 +283,12 @@
 	bool page_replace:1;
 	bool may_block:1;
 	bool is_ext:1;
+	bool invalidate_vmap:1;
 	struct fuse_in_arg in_args[3];
 	struct fuse_arg out_args[2];
 	void (*end)(struct fuse_mount *fm, struct fuse_args *args, int error);
+	/* Used for kvec iter backed by vmalloc address */
+	void *vmap_base;
 };
 
 struct fuse_args_pages {
@@ -818,6 +821,9 @@
 	/* Is statx not implemented by fs? */
 	unsigned int no_statx:1;
 
+	/* Use pages instead of pointer for kernel I/O */
+	unsigned int use_pages_for_kvec_io:1;
+
 	/** The number of requests waiting for completion */
 	atomic_t num_waiting;
 
@@ -940,7 +946,6 @@
 
 static inline void fuse_make_bad(struct inode *inode)
 {
-	remove_inode_hash(inode);
 	set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);
 }
 
--- linux-qcom-6.8.0.orig/fs/fuse/inode.c
+++ linux-qcom-6.8.0/fs/fuse/inode.c
@@ -469,8 +469,11 @@
 	} else if (fuse_stale_inode(inode, generation, attr)) {
 		/* nodeid was reused, any I/O on the old inode should fail */
 		fuse_make_bad(inode);
-		iput(inode);
-		goto retry;
+		if (inode != d_inode(sb->s_root)) {
+			remove_inode_hash(inode);
+			iput(inode);
+			goto retry;
+		}
 	}
 	fi = get_fuse_inode(inode);
 	spin_lock(&fi->lock);
@@ -745,6 +748,8 @@
 	struct fs_parse_result result;
 	struct fuse_fs_context *ctx = fsc->fs_private;
 	int opt;
+	kuid_t kuid;
+	kgid_t kgid;
 
 	if (fsc->purpose == FS_CONTEXT_FOR_RECONFIGURE) {
 		/*
@@ -789,16 +794,30 @@
 		break;
 
 	case OPT_USER_ID:
-		ctx->user_id = make_kuid(fsc->user_ns, result.uint_32);
-		if (!uid_valid(ctx->user_id))
+		kuid =  make_kuid(fsc->user_ns, result.uint_32);
+		if (!uid_valid(kuid))
+			return invalfc(fsc, "Invalid user_id");
+		/*
+		 * The requested uid must be representable in the
+		 * filesystem's idmapping.
+		 */
+		if (!kuid_has_mapping(fsc->user_ns, kuid))
 			return invalfc(fsc, "Invalid user_id");
+		ctx->user_id = kuid;
 		ctx->user_id_present = true;
 		break;
 
 	case OPT_GROUP_ID:
-		ctx->group_id = make_kgid(fsc->user_ns, result.uint_32);
-		if (!gid_valid(ctx->group_id))
+		kgid = make_kgid(fsc->user_ns, result.uint_32);;
+		if (!gid_valid(kgid))
+			return invalfc(fsc, "Invalid group_id");
+		/*
+		 * The requested gid must be representable in the
+		 * filesystem's idmapping.
+		 */
+		if (!kgid_has_mapping(fsc->user_ns, kgid))
 			return invalfc(fsc, "Invalid group_id");
+		ctx->group_id = kgid;
 		ctx->group_id_present = true;
 		break;
 
--- linux-qcom-6.8.0.orig/fs/fuse/virtio_fs.c
+++ linux-qcom-6.8.0/fs/fuse/virtio_fs.c
@@ -323,6 +323,16 @@
 		return -ENOMEM;
 	memcpy(fs->tag, tag_buf, len);
 	fs->tag[len] = '\0';
+
+	/* While the VIRTIO specification allows any character, newlines are
+	 * awkward on mount(8) command-lines and cause problems in the sysfs
+	 * "tag" attr and uevent TAG= properties. Forbid them.
+	 */
+	if (strchr(fs->tag, '\n')) {
+		dev_dbg(&vdev->dev, "refusing virtiofs tag with newline character\n");
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
@@ -1448,6 +1458,7 @@
 	fc->delete_stale = true;
 	fc->auto_submounts = true;
 	fc->sync_fs = true;
+	fc->use_pages_for_kvec_io = true;
 
 	/* Tell FUSE to split requests that exceed the virtqueue's size */
 	fc->max_pages_limit = min_t(unsigned int, fc->max_pages_limit,
--- linux-qcom-6.8.0.orig/fs/fuse/xattr.c
+++ linux-qcom-6.8.0/fs/fuse/xattr.c
@@ -81,7 +81,7 @@
 	}
 	ret = fuse_simple_request(fm, &args);
 	if (!ret && !size)
-		ret = min_t(ssize_t, outarg.size, XATTR_SIZE_MAX);
+		ret = min_t(size_t, outarg.size, XATTR_SIZE_MAX);
 	if (ret == -ENOSYS) {
 		fm->fc->no_getxattr = 1;
 		ret = -EOPNOTSUPP;
@@ -143,7 +143,7 @@
 	}
 	ret = fuse_simple_request(fm, &args);
 	if (!ret && !size)
-		ret = min_t(ssize_t, outarg.size, XATTR_LIST_MAX);
+		ret = min_t(size_t, outarg.size, XATTR_LIST_MAX);
 	if (ret > 0 && size)
 		ret = fuse_verify_xattr_list(list, ret);
 	if (ret == -ENOSYS) {
--- linux-qcom-6.8.0.orig/fs/gfs2/bmap.c
+++ linux-qcom-6.8.0/fs/gfs2/bmap.c
@@ -1718,7 +1718,8 @@
 	struct buffer_head *dibh, *bh;
 	struct gfs2_holder rd_gh;
 	unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift;
-	u64 lblock = (offset + (1 << bsize_shift) - 1) >> bsize_shift;
+	unsigned int bsize = 1 << bsize_shift;
+	u64 lblock = (offset + bsize - 1) >> bsize_shift;
 	__u16 start_list[GFS2_MAX_META_HEIGHT];
 	__u16 __end_list[GFS2_MAX_META_HEIGHT], *end_list = NULL;
 	unsigned int start_aligned, end_aligned;
@@ -1729,7 +1730,7 @@
 	u64 prev_bnr = 0;
 	__be64 *start, *end;
 
-	if (offset >= maxsize) {
+	if (offset + bsize - 1 >= maxsize) {
 		/*
 		 * The starting point lies beyond the allocated metadata;
 		 * there are no blocks to deallocate.
--- linux-qcom-6.8.0.orig/fs/gfs2/file.c
+++ linux-qcom-6.8.0/fs/gfs2/file.c
@@ -251,6 +251,7 @@
 		error = filemap_fdatawait(inode->i_mapping);
 		if (error)
 			goto out;
+		truncate_inode_pages(inode->i_mapping, 0);
 		if (new_flags & GFS2_DIF_JDATA)
 			gfs2_ordered_del_inode(ip);
 	}
--- linux-qcom-6.8.0.orig/fs/gfs2/glock.c
+++ linux-qcom-6.8.0/fs/gfs2/glock.c
@@ -166,19 +166,45 @@
 	return true;
 }
 
-void gfs2_glock_free(struct gfs2_glock *gl)
+static void __gfs2_glock_free(struct gfs2_glock *gl)
 {
-	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
-
-	gfs2_glock_assert_withdraw(gl, atomic_read(&gl->gl_revokes) == 0);
 	rhashtable_remove_fast(&gl_hash_table, &gl->gl_node, ht_parms);
 	smp_mb();
 	wake_up_glock(gl);
 	call_rcu(&gl->gl_rcu, gfs2_glock_dealloc);
+}
+
+void gfs2_glock_free(struct gfs2_glock *gl) {
+	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+
+	__gfs2_glock_free(gl);
 	if (atomic_dec_and_test(&sdp->sd_glock_disposal))
 		wake_up(&sdp->sd_kill_wait);
 }
 
+void gfs2_glock_free_later(struct gfs2_glock *gl) {
+	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+
+	spin_lock(&lru_lock);
+	list_add(&gl->gl_lru, &sdp->sd_dead_glocks);
+	spin_unlock(&lru_lock);
+	if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+		wake_up(&sdp->sd_kill_wait);
+}
+
+static void gfs2_free_dead_glocks(struct gfs2_sbd *sdp)
+{
+	struct list_head *list = &sdp->sd_dead_glocks;
+
+	while(!list_empty(list)) {
+		struct gfs2_glock *gl;
+
+		gl = list_first_entry(list, struct gfs2_glock, gl_lru);
+		list_del_init(&gl->gl_lru);
+		__gfs2_glock_free(gl);
+	}
+}
+
 /**
  * gfs2_glock_hold() - increment reference count on glock
  * @gl: The glock to hold
@@ -248,7 +274,7 @@
  * Enqueue the glock on the work queue.  Passes one glock reference on to the
  * work queue.
  */
-static void __gfs2_glock_queue_work(struct gfs2_glock *gl, unsigned long delay) {
+static void gfs2_glock_queue_work(struct gfs2_glock *gl, unsigned long delay) {
 	if (!queue_delayed_work(glock_workqueue, &gl->gl_work, delay)) {
 		/*
 		 * We are holding the lockref spinlock, and the work was still
@@ -261,12 +287,6 @@
 	}
 }
 
-static void gfs2_glock_queue_work(struct gfs2_glock *gl, unsigned long delay) {
-	spin_lock(&gl->gl_lockref.lock);
-	__gfs2_glock_queue_work(gl, delay);
-	spin_unlock(&gl->gl_lockref.lock);
-}
-
 static void __gfs2_glock_put(struct gfs2_glock *gl)
 {
 	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
@@ -285,14 +305,6 @@
 	sdp->sd_lockstruct.ls_ops->lm_put_lock(gl);
 }
 
-/*
- * Cause the glock to be put in work queue context.
- */
-void gfs2_glock_queue_put(struct gfs2_glock *gl)
-{
-	gfs2_glock_queue_work(gl, 0);
-}
-
 /**
  * gfs2_glock_put() - Decrement reference count on glock
  * @gl: The glock to put
@@ -307,6 +319,23 @@
 	__gfs2_glock_put(gl);
 }
 
+/*
+ * gfs2_glock_put_async - Decrement reference count without sleeping
+ * @gl: The glock to put
+ *
+ * Decrement the reference count on glock immediately unless it is the last
+ * reference.  Defer putting the last reference to work queue context.
+ */
+void gfs2_glock_put_async(struct gfs2_glock *gl)
+{
+	if (lockref_put_or_lock(&gl->gl_lockref))
+		return;
+
+	GLOCK_BUG_ON(gl, gl->gl_lockref.count != 1);
+	gfs2_glock_queue_work(gl, 0);
+	spin_unlock(&gl->gl_lockref.lock);
+}
+
 /**
  * may_grant - check if it's ok to grant a new lock
  * @gl: The glock
@@ -591,7 +620,6 @@
 	struct gfs2_holder *gh;
 	unsigned state = ret & LM_OUT_ST_MASK;
 
-	spin_lock(&gl->gl_lockref.lock);
 	trace_gfs2_glock_state_change(gl, state);
 	state_change(gl, state);
 	gh = find_first_waiter(gl);
@@ -639,7 +667,6 @@
 			       gl->gl_target, state);
 			GLOCK_BUG_ON(gl, 1);
 		}
-		spin_unlock(&gl->gl_lockref.lock);
 		return;
 	}
 
@@ -662,7 +689,6 @@
 	}
 out:
 	clear_bit(GLF_LOCK, &gl->gl_flags);
-	spin_unlock(&gl->gl_lockref.lock);
 }
 
 static bool is_system_glock(struct gfs2_glock *gl)
@@ -690,6 +716,7 @@
 {
 	const struct gfs2_glock_operations *glops = gl->gl_ops;
 	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+	struct lm_lockstruct *ls = &sdp->sd_lockstruct;
 	unsigned int lck_flags = (unsigned int)(gh ? gh->gh_flags : 0);
 	int ret;
 
@@ -718,6 +745,9 @@
 	    (gl->gl_state == LM_ST_EXCLUSIVE) ||
 	    (lck_flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB)))
 		clear_bit(GLF_BLOCKING, &gl->gl_flags);
+	if (!glops->go_inval && !glops->go_sync)
+		goto skip_inval;
+
 	spin_unlock(&gl->gl_lockref.lock);
 	if (glops->go_sync) {
 		ret = glops->go_sync(gl);
@@ -730,6 +760,7 @@
 				fs_err(sdp, "Error %d syncing glock \n", ret);
 				gfs2_dump_glock(NULL, gl, true);
 			}
+			spin_lock(&gl->gl_lockref.lock);
 			goto skip_inval;
 		}
 	}
@@ -750,9 +781,10 @@
 		glops->go_inval(gl, target == LM_ST_DEFERRED ? 0 : DIO_METADATA);
 		clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
 	}
+	spin_lock(&gl->gl_lockref.lock);
 
 skip_inval:
-	gfs2_glock_hold(gl);
+	gl->gl_lockref.count++;
 	/*
 	 * Check for an error encountered since we called go_sync and go_inval.
 	 * If so, we can't withdraw from the glock code because the withdraw
@@ -795,30 +827,36 @@
 			clear_bit(GLF_LOCK, &gl->gl_flags);
 			clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
 			gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
-			goto out;
+			return;
 		} else {
 			clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
 		}
 	}
 
-	if (sdp->sd_lockstruct.ls_ops->lm_lock)	{
-		/* lock_dlm */
-		ret = sdp->sd_lockstruct.ls_ops->lm_lock(gl, target, lck_flags);
+	if (ls->ls_ops->lm_lock) {
+		spin_unlock(&gl->gl_lockref.lock);
+		ret = ls->ls_ops->lm_lock(gl, target, lck_flags);
+		spin_lock(&gl->gl_lockref.lock);
+
 		if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED &&
 		    target == LM_ST_UNLOCKED &&
-		    test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags)) {
-			finish_xmote(gl, target);
-			gfs2_glock_queue_work(gl, 0);
+		    test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
+			/*
+			 * The lockspace has been released and the lock has
+			 * been unlocked implicitly.
+			 */
 		} else if (ret) {
 			fs_err(sdp, "lm_lock ret %d\n", ret);
-			GLOCK_BUG_ON(gl, !gfs2_withdrawing_or_withdrawn(sdp));
+			target = gl->gl_state | LM_OUT_ERROR;
+		} else {
+			/* The operation will be completed asynchronously. */
+			return;
 		}
-	} else { /* lock_nolock */
-		finish_xmote(gl, target);
-		gfs2_glock_queue_work(gl, 0);
 	}
-out:
-	spin_lock(&gl->gl_lockref.lock);
+
+	/* Complete the operation now. */
+	finish_xmote(gl, target);
+	gfs2_glock_queue_work(gl, 0);
 }
 
 /**
@@ -865,7 +903,7 @@
 	clear_bit(GLF_LOCK, &gl->gl_flags);
 	smp_mb__after_atomic();
 	gl->gl_lockref.count++;
-	__gfs2_glock_queue_work(gl, 0);
+	gfs2_glock_queue_work(gl, 0);
 	return;
 
 out_unlock:
@@ -1002,14 +1040,15 @@
 				  &gl->gl_delete, 0);
 }
 
-static bool gfs2_queue_verify_evict(struct gfs2_glock *gl)
+bool gfs2_queue_verify_delete(struct gfs2_glock *gl, bool later)
 {
 	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+	unsigned long delay;
 
-	if (test_and_set_bit(GLF_VERIFY_EVICT, &gl->gl_flags))
+	if (test_and_set_bit(GLF_VERIFY_DELETE, &gl->gl_flags))
 		return false;
-	return queue_delayed_work(sdp->sd_delete_wq,
-				  &gl->gl_delete, 5 * HZ);
+	delay = later ? 5 * HZ : 0;
+	return queue_delayed_work(sdp->sd_delete_wq, &gl->gl_delete, delay);
 }
 
 static void delete_work_func(struct work_struct *work)
@@ -1041,19 +1080,19 @@
 		if (gfs2_try_evict(gl)) {
 			if (test_bit(SDF_KILL, &sdp->sd_flags))
 				goto out;
-			if (gfs2_queue_verify_evict(gl))
+			if (gfs2_queue_verify_delete(gl, true))
 				return;
 		}
 		goto out;
 	}
 
-	if (test_and_clear_bit(GLF_VERIFY_EVICT, &gl->gl_flags)) {
+	if (test_and_clear_bit(GLF_VERIFY_DELETE, &gl->gl_flags)) {
 		inode = gfs2_lookup_by_inum(sdp, no_addr, gl->gl_no_formal_ino,
 					    GFS2_BLKST_UNLINKED);
 		if (IS_ERR(inode)) {
 			if (PTR_ERR(inode) == -EAGAIN &&
 			    !test_bit(SDF_KILL, &sdp->sd_flags) &&
-			    gfs2_queue_verify_evict(gl))
+			    gfs2_queue_verify_delete(gl, true))
 				return;
 		} else {
 			d_prune_aliases(inode);
@@ -1071,11 +1110,12 @@
 	struct gfs2_glock *gl = container_of(work, struct gfs2_glock, gl_work.work);
 	unsigned int drop_refs = 1;
 
-	if (test_and_clear_bit(GLF_REPLY_PENDING, &gl->gl_flags)) {
+	spin_lock(&gl->gl_lockref.lock);
+	if (test_bit(GLF_REPLY_PENDING, &gl->gl_flags)) {
+		clear_bit(GLF_REPLY_PENDING, &gl->gl_flags);
 		finish_xmote(gl, gl->gl_reply);
 		drop_refs++;
 	}
-	spin_lock(&gl->gl_lockref.lock);
 	if (test_bit(GLF_PENDING_DEMOTE, &gl->gl_flags) &&
 	    gl->gl_state != LM_ST_UNLOCKED &&
 	    gl->gl_demote_state != LM_ST_EXCLUSIVE) {
@@ -1096,12 +1136,12 @@
 		drop_refs--;
 		if (gl->gl_name.ln_type != LM_TYPE_INODE)
 			delay = 0;
-		__gfs2_glock_queue_work(gl, delay);
+		gfs2_glock_queue_work(gl, delay);
 	}
 
 	/*
 	 * Drop the remaining glock references manually here. (Mind that
-	 * __gfs2_glock_queue_work depends on the lockref spinlock begin held
+	 * gfs2_glock_queue_work depends on the lockref spinlock begin held
 	 * here as well.)
 	 */
 	gl->gl_lockref.count -= drop_refs;
@@ -1606,7 +1646,7 @@
 		     test_and_clear_bit(GLF_FROZEN, &gl->gl_flags))) {
 		set_bit(GLF_REPLY_PENDING, &gl->gl_flags);
 		gl->gl_lockref.count++;
-		__gfs2_glock_queue_work(gl, 0);
+		gfs2_glock_queue_work(gl, 0);
 	}
 	run_queue(gl, 1);
 	spin_unlock(&gl->gl_lockref.lock);
@@ -1672,7 +1712,7 @@
 		    !test_bit(GLF_DEMOTE, &gl->gl_flags) &&
 		    gl->gl_name.ln_type == LM_TYPE_INODE)
 			delay = gl->gl_hold_time;
-		__gfs2_glock_queue_work(gl, delay);
+		gfs2_glock_queue_work(gl, delay);
 	}
 }
 
@@ -1896,7 +1936,7 @@
 			delay = gl->gl_hold_time;
 	}
 	handle_callback(gl, state, delay, true);
-	__gfs2_glock_queue_work(gl, delay);
+	gfs2_glock_queue_work(gl, delay);
 	spin_unlock(&gl->gl_lockref.lock);
 }
 
@@ -1956,7 +1996,7 @@
 
 	gl->gl_lockref.count++;
 	set_bit(GLF_REPLY_PENDING, &gl->gl_flags);
-	__gfs2_glock_queue_work(gl, 0);
+	gfs2_glock_queue_work(gl, 0);
 	spin_unlock(&gl->gl_lockref.lock);
 }
 
@@ -2009,15 +2049,14 @@
 			atomic_inc(&lru_count);
 			continue;
 		}
-		if (test_and_set_bit(GLF_LOCK, &gl->gl_flags)) {
+		if (test_bit(GLF_LOCK, &gl->gl_flags)) {
 			spin_unlock(&gl->gl_lockref.lock);
 			goto add_back_to_lru;
 		}
 		gl->gl_lockref.count++;
 		if (demote_ok(gl))
 			handle_callback(gl, LM_ST_UNLOCKED, 0, false);
-		WARN_ON(!test_and_clear_bit(GLF_LOCK, &gl->gl_flags));
-		__gfs2_glock_queue_work(gl, 0);
+		gfs2_glock_queue_work(gl, 0);
 		spin_unlock(&gl->gl_lockref.lock);
 		cond_resched_lock(&lru_lock);
 	}
@@ -2113,7 +2152,7 @@
 void gfs2_cancel_delete_work(struct gfs2_glock *gl)
 {
 	clear_bit(GLF_TRY_TO_EVICT, &gl->gl_flags);
-	clear_bit(GLF_VERIFY_EVICT, &gl->gl_flags);
+	clear_bit(GLF_VERIFY_DELETE, &gl->gl_flags);
 	if (cancel_delayed_work(&gl->gl_delete))
 		gfs2_glock_put(gl);
 }
@@ -2148,8 +2187,11 @@
 		return;
 	if (!lockref_get_not_dead(&gl->gl_lockref))
 		return;
+
+	spin_lock(&gl->gl_lockref.lock);
 	set_bit(GLF_REPLY_PENDING, &gl->gl_flags);
 	gfs2_glock_queue_work(gl, 0);
+	spin_unlock(&gl->gl_lockref.lock);
 }
 
 /**
@@ -2167,7 +2209,7 @@
 		gl->gl_lockref.count++;
 		if (gl->gl_state != LM_ST_UNLOCKED)
 			handle_callback(gl, LM_ST_UNLOCKED, 0, false);
-		__gfs2_glock_queue_work(gl, 0);
+		gfs2_glock_queue_work(gl, 0);
 	}
 	spin_unlock(&gl->gl_lockref.lock);
 }
@@ -2225,6 +2267,8 @@
 	wait_event_timeout(sdp->sd_kill_wait,
 			   atomic_read(&sdp->sd_glock_disposal) == 0,
 			   HZ * 600);
+	gfs2_lm_unmount(sdp);
+	gfs2_free_dead_glocks(sdp);
 	glock_hash_walk(dump_glock_func, sdp);
 }
 
@@ -2345,7 +2389,7 @@
 		*p++ = 'N';
 	if (test_bit(GLF_TRY_TO_EVICT, gflags))
 		*p++ = 'e';
-	if (test_bit(GLF_VERIFY_EVICT, gflags))
+	if (test_bit(GLF_VERIFY_DELETE, gflags))
 		*p++ = 'E';
 	*p = 0;
 	return buf;
@@ -2529,8 +2573,7 @@
 	if (gl) {
 		if (n == 0)
 			return;
-		if (!lockref_put_not_zero(&gl->gl_lockref))
-			gfs2_glock_queue_put(gl);
+		gfs2_glock_put_async(gl);
 	}
 	for (;;) {
 		gl = rhashtable_walk_next(&gi->hti);
--- linux-qcom-6.8.0.orig/fs/gfs2/glock.h
+++ linux-qcom-6.8.0/fs/gfs2/glock.h
@@ -172,7 +172,7 @@
 		   int create, struct gfs2_glock **glp);
 struct gfs2_glock *gfs2_glock_hold(struct gfs2_glock *gl);
 void gfs2_glock_put(struct gfs2_glock *gl);
-void gfs2_glock_queue_put(struct gfs2_glock *gl);
+void gfs2_glock_put_async(struct gfs2_glock *gl);
 
 void __gfs2_holder_init(struct gfs2_glock *gl, unsigned int state,
 		        u16 flags, struct gfs2_holder *gh,
@@ -245,6 +245,7 @@
 void gfs2_glock_cb(struct gfs2_glock *gl, unsigned int state);
 void gfs2_glock_complete(struct gfs2_glock *gl, int ret);
 bool gfs2_queue_try_to_evict(struct gfs2_glock *gl);
+bool gfs2_queue_verify_delete(struct gfs2_glock *gl, bool later);
 void gfs2_cancel_delete_work(struct gfs2_glock *gl);
 void gfs2_flush_delete_work(struct gfs2_sbd *sdp);
 void gfs2_gl_hash_clear(struct gfs2_sbd *sdp);
@@ -252,6 +253,7 @@
 void gfs2_glock_thaw(struct gfs2_sbd *sdp);
 void gfs2_glock_add_to_lru(struct gfs2_glock *gl);
 void gfs2_glock_free(struct gfs2_glock *gl);
+void gfs2_glock_free_later(struct gfs2_glock *gl);
 
 int __init gfs2_glock_init(void);
 void gfs2_glock_exit(void);
--- linux-qcom-6.8.0.orig/fs/gfs2/glops.c
+++ linux-qcom-6.8.0/fs/gfs2/glops.c
@@ -82,6 +82,9 @@
 	GLOCK_BUG_ON(gl, !fsync && atomic_read(&gl->gl_ail_count));
 	spin_unlock(&sdp->sd_ail_lock);
 	gfs2_log_unlock(sdp);
+
+	if (gfs2_withdrawing(sdp))
+		gfs2_withdraw(sdp);
 }
 
 
--- linux-qcom-6.8.0.orig/fs/gfs2/incore.h
+++ linux-qcom-6.8.0/fs/gfs2/incore.h
@@ -331,7 +331,7 @@
 	GLF_BLOCKING			= 15,
 	GLF_FREEING			= 16, /* Wait for glock to be freed */
 	GLF_TRY_TO_EVICT		= 17, /* iopen glocks only */
-	GLF_VERIFY_EVICT		= 18, /* iopen glocks only */
+	GLF_VERIFY_DELETE		= 18, /* iopen glocks only */
 };
 
 struct gfs2_glock {
@@ -838,6 +838,7 @@
 	/* For quiescing the filesystem */
 	struct gfs2_holder sd_freeze_gh;
 	struct mutex sd_freeze_mutex;
+	struct list_head sd_dead_glocks;
 
 	char sd_fsname[GFS2_FSNAME_LEN + 3 * sizeof(int) + 2];
 	char sd_table_name[GFS2_FSNAME_LEN];
--- linux-qcom-6.8.0.orig/fs/gfs2/lock_dlm.c
+++ linux-qcom-6.8.0/fs/gfs2/lock_dlm.c
@@ -121,6 +121,11 @@
 	struct gfs2_glock *gl = arg;
 	unsigned ret = gl->gl_state;
 
+	/* If the glock is dead, we only react to a dlm_unlock() reply. */
+	if (__lockref_is_dead(&gl->gl_lockref) &&
+	    gl->gl_lksb.sb_status != -DLM_EUNLOCK)
+		return;
+
 	gfs2_update_reply_times(gl);
 	BUG_ON(gl->gl_lksb.sb_flags & DLM_SBF_DEMOTED);
 
@@ -171,6 +176,9 @@
 {
 	struct gfs2_glock *gl = arg;
 
+	if (__lockref_is_dead(&gl->gl_lockref))
+		return;
+
 	switch (mode) {
 	case DLM_LOCK_EX:
 		gfs2_glock_cb(gl, LM_ST_UNLOCKED);
@@ -291,8 +299,12 @@
 	struct lm_lockstruct *ls = &sdp->sd_lockstruct;
 	int error;
 
-	if (gl->gl_lksb.sb_lkid == 0)
-		goto out_free;
+	BUG_ON(!__lockref_is_dead(&gl->gl_lockref));
+
+	if (gl->gl_lksb.sb_lkid == 0) {
+		gfs2_glock_free(gl);
+		return;
+	}
 
 	clear_bit(GLF_BLOCKING, &gl->gl_flags);
 	gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
@@ -300,13 +312,17 @@
 	gfs2_update_request_times(gl);
 
 	/* don't want to call dlm if we've unmounted the lock protocol */
-	if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags))
-		goto out_free;
+	if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
+		gfs2_glock_free(gl);
+		return;
+	}
 	/* don't want to skip dlm_unlock writing the lvb when lock has one */
 
 	if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
-	    !gl->gl_lksb.sb_lvbptr)
-		goto out_free;
+	    !gl->gl_lksb.sb_lvbptr) {
+		gfs2_glock_free_later(gl);
+		return;
+	}
 
 again:
 	error = dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_VALBLK,
@@ -321,10 +337,6 @@
 		       gl->gl_name.ln_type,
 		       (unsigned long long)gl->gl_name.ln_number, error);
 	}
-	return;
-
-out_free:
-	gfs2_glock_free(gl);
 }
 
 static void gdlm_cancel(struct gfs2_glock *gl)
--- linux-qcom-6.8.0.orig/fs/gfs2/log.c
+++ linux-qcom-6.8.0/fs/gfs2/log.c
@@ -786,7 +786,7 @@
 {
 	if (atomic_dec_return(&gl->gl_revokes) == 0) {
 		clear_bit(GLF_LFLUSH, &gl->gl_flags);
-		gfs2_glock_queue_put(gl);
+		gfs2_glock_put_async(gl);
 	}
 }
 
@@ -1108,7 +1108,8 @@
 	lops_before_commit(sdp, tr);
 	if (gfs2_withdrawing_or_withdrawn(sdp))
 		goto out_withdraw;
-	gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE);
+	if (sdp->sd_jdesc)
+		gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE);
 	if (gfs2_withdrawing_or_withdrawn(sdp))
 		goto out_withdraw;
 
--- linux-qcom-6.8.0.orig/fs/gfs2/ops_fstype.c
+++ linux-qcom-6.8.0/fs/gfs2/ops_fstype.c
@@ -136,6 +136,7 @@
 	atomic_set(&sdp->sd_log_in_flight, 0);
 	init_waitqueue_head(&sdp->sd_log_flush_wait);
 	mutex_init(&sdp->sd_freeze_mutex);
+	INIT_LIST_HEAD(&sdp->sd_dead_glocks);
 
 	return sdp;
 
--- linux-qcom-6.8.0.orig/fs/gfs2/quota.c
+++ linux-qcom-6.8.0/fs/gfs2/quota.c
@@ -75,9 +75,6 @@
 #define GFS2_QD_HASH_SIZE       BIT(GFS2_QD_HASH_SHIFT)
 #define GFS2_QD_HASH_MASK       (GFS2_QD_HASH_SIZE - 1)
 
-#define QC_CHANGE 0
-#define QC_SYNC 1
-
 /* Lock order: qd_lock -> bucket lock -> qd->lockref.lock -> lru lock */
 /*                     -> sd_bitmap_lock                              */
 static DEFINE_SPINLOCK(qd_lock);
@@ -462,47 +459,29 @@
 	mutex_unlock(&sdp->sd_quota_mutex);
 }
 
-static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,
-			 u64 *sync_gen)
+static bool qd_grab_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,
+			 u64 sync_gen)
 {
 	if (test_bit(QDF_LOCKED, &qd->qd_flags) ||
 	    !test_bit(QDF_CHANGE, &qd->qd_flags) ||
-	    (sync_gen && (qd->qd_sync_gen >= *sync_gen)))
-		return 0;
-
-	/*
-	 * If qd_change is 0 it means a pending quota change was negated.
-	 * We should not sync it, but we still have a qd reference and slot
-	 * reference taken by gfs2_quota_change -> do_qc that need to be put.
-	 */
-	if (!qd->qd_change && test_and_clear_bit(QDF_CHANGE, &qd->qd_flags)) {
-		slot_put(qd);
-		qd_put(qd);
-		return 0;
-	}
+	    qd->qd_sync_gen >= sync_gen)
+		return false;
 
 	if (!lockref_get_not_dead(&qd->qd_lockref))
-		return 0;
+		return false;
 
 	list_move_tail(&qd->qd_list, &sdp->sd_quota_list);
 	set_bit(QDF_LOCKED, &qd->qd_flags);
 	qd->qd_change_sync = qd->qd_change;
 	slot_hold(qd);
-	return 1;
+	return true;
 }
 
-static int qd_bh_get_or_undo(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd)
+static void qd_ungrab_sync(struct gfs2_quota_data *qd)
 {
-	int error;
-
-	error = bh_get(qd);
-	if (!error)
-		return 0;
-
 	clear_bit(QDF_LOCKED, &qd->qd_flags);
 	slot_put(qd);
 	qd_put(qd);
-	return error;
 }
 
 static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)
@@ -518,7 +497,7 @@
 	spin_lock(&qd_lock);
 
 	list_for_each_entry(iter, &sdp->sd_quota_list, qd_list) {
-		if (qd_check_sync(sdp, iter, &sdp->sd_quota_sync_gen)) {
+		if (qd_grab_sync(sdp, iter, sdp->sd_quota_sync_gen)) {
 			qd = iter;
 			break;
 		}
@@ -527,12 +506,15 @@
 	spin_unlock(&qd_lock);
 
 	if (qd) {
-		error = qd_bh_get_or_undo(sdp, qd);
-		if (error)
+		error = bh_get(qd);
+		if (error) {
+			qd_ungrab_sync(qd);
 			return error;
-		*qdp = qd;
+		}
 	}
 
+	*qdp = qd;
+
 	return 0;
 }
 
@@ -710,7 +692,7 @@
 	return 0;
 }
 
-static void do_qc(struct gfs2_quota_data *qd, s64 change, int qc_type)
+static void do_qc(struct gfs2_quota_data *qd, s64 change)
 {
 	struct gfs2_sbd *sdp = qd->qd_sbd;
 	struct gfs2_inode *ip = GFS2_I(sdp->sd_qc_inode);
@@ -735,18 +717,16 @@
 	qd->qd_change = x;
 	spin_unlock(&qd_lock);
 
-	if (qc_type == QC_CHANGE) {
-		if (!test_and_set_bit(QDF_CHANGE, &qd->qd_flags)) {
-			qd_hold(qd);
-			slot_hold(qd);
-		}
-	} else {
+	if (!x) {
 		gfs2_assert_warn(sdp, test_bit(QDF_CHANGE, &qd->qd_flags));
 		clear_bit(QDF_CHANGE, &qd->qd_flags);
 		qc->qc_flags = 0;
 		qc->qc_id = 0;
 		slot_put(qd);
 		qd_put(qd);
+	} else if (!test_and_set_bit(QDF_CHANGE, &qd->qd_flags)) {
+		qd_hold(qd);
+		slot_hold(qd);
 	}
 
 	if (change < 0) /* Reset quiet flag if we freed some blocks */
@@ -992,7 +972,7 @@
 		if (error)
 			goto out_end_trans;
 
-		do_qc(qd, -qd->qd_change_sync, QC_SYNC);
+		do_qc(qd, -qd->qd_change_sync);
 		set_bit(QDF_REFRESH, &qd->qd_flags);
 	}
 
@@ -1166,7 +1146,6 @@
 	struct gfs2_quota_data *qda[2 * GFS2_MAXQUOTAS];
 	unsigned int count = 0;
 	u32 x;
-	int found;
 
 	if (!test_and_clear_bit(GIF_QD_LOCKED, &ip->i_flags))
 		return;
@@ -1174,6 +1153,7 @@
 	for (x = 0; x < ip->i_qadata->qa_qd_num; x++) {
 		struct gfs2_quota_data *qd;
 		bool sync;
+		int error;
 
 		qd = ip->i_qadata->qa_qd[x];
 		sync = need_sync(qd);
@@ -1183,14 +1163,20 @@
 			continue;
 
 		spin_lock(&qd_lock);
-		found = qd_check_sync(sdp, qd, NULL);
+		sync = qd_grab_sync(sdp, qd, U64_MAX);
 		spin_unlock(&qd_lock);
 
-		if (!found)
+		if (!sync)
+			continue;
+
+		gfs2_assert_warn(sdp, qd->qd_change_sync);
+		error = bh_get(qd);
+		if (error) {
+			qd_ungrab_sync(qd);
 			continue;
+		}
 
-		if (!qd_bh_get_or_undo(sdp, qd))
-			qda[count++] = qd;
+		qda[count++] = qd;
 	}
 
 	if (count) {
@@ -1312,7 +1298,7 @@
 
 		if (qid_eq(qd->qd_id, make_kqid_uid(uid)) ||
 		    qid_eq(qd->qd_id, make_kqid_gid(gid))) {
-			do_qc(qd, change, QC_CHANGE);
+			do_qc(qd, change);
 		}
 	}
 }
--- linux-qcom-6.8.0.orig/fs/gfs2/rgrp.c
+++ linux-qcom-6.8.0/fs/gfs2/rgrp.c
@@ -1879,7 +1879,7 @@
 		 */
 		ip = gl->gl_object;
 
-		if (ip || !gfs2_queue_try_to_evict(gl))
+		if (ip || !gfs2_queue_verify_delete(gl, false))
 			gfs2_glock_put(gl);
 		else
 			found++;
--- linux-qcom-6.8.0.orig/fs/gfs2/super.c
+++ linux-qcom-6.8.0/fs/gfs2/super.c
@@ -67,9 +67,13 @@
 	sdp->sd_journals = 0;
 	spin_unlock(&sdp->sd_jindex_spin);
 
+	down_write(&sdp->sd_log_flush_lock);
 	sdp->sd_jdesc = NULL;
+	up_write(&sdp->sd_log_flush_lock);
+
 	while (!list_empty(&list)) {
 		jd = list_first_entry(&list, struct gfs2_jdesc, jd_list);
+		BUG_ON(jd->jd_log_bio);
 		gfs2_free_journal_extents(jd);
 		list_del(&jd->jd_list);
 		iput(jd->jd_inode);
@@ -646,10 +650,7 @@
 	gfs2_gl_hash_clear(sdp);
 	truncate_inode_pages_final(&sdp->sd_aspace);
 	gfs2_delete_debugfs_file(sdp);
-	/*  Unmount the locking protocol  */
-	gfs2_lm_unmount(sdp);
 
-	/*  At this point, we're through participating in the lockspace  */
 	gfs2_sys_fs_del(sdp);
 	free_sbd(sdp);
 }
@@ -1044,8 +1045,8 @@
 		struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
 
 		gfs2_glock_hold(gl);
-		if (!gfs2_queue_try_to_evict(gl))
-			gfs2_glock_queue_put(gl);
+		if (!gfs2_queue_verify_delete(gl, true))
+			gfs2_glock_put_async(gl);
 		return 0;
 	}
 
@@ -1251,7 +1252,7 @@
 static void gfs2_glock_put_eventually(struct gfs2_glock *gl)
 {
 	if (current->flags & PF_MEMALLOC)
-		gfs2_glock_queue_put(gl);
+		gfs2_glock_put_async(gl);
 	else
 		gfs2_glock_put(gl);
 }
@@ -1538,11 +1539,13 @@
 	if (!ip)
 		return NULL;
 	ip->i_no_addr = 0;
+	ip->i_no_formal_ino = 0;
 	ip->i_flags = 0;
 	ip->i_gl = NULL;
 	gfs2_holder_mark_uninitialized(&ip->i_iopen_gh);
 	memset(&ip->i_res, 0, sizeof(ip->i_res));
 	RB_CLEAR_NODE(&ip->i_res.rs_node);
+	ip->i_diskflags = 0;
 	ip->i_rahead = 0;
 	return &ip->i_inode;
 }
--- linux-qcom-6.8.0.orig/fs/gfs2/util.c
+++ linux-qcom-6.8.0/fs/gfs2/util.c
@@ -99,12 +99,12 @@
  */
 int gfs2_freeze_lock_shared(struct gfs2_sbd *sdp)
 {
+	int flags = LM_FLAG_NOEXP | GL_EXACT;
 	int error;
 
-	error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED,
-				   LM_FLAG_NOEXP | GL_EXACT,
+	error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED, flags,
 				   &sdp->sd_freeze_gh);
-	if (error)
+	if (error && error != GLR_TRYFAILED)
 		fs_err(sdp, "can't lock the freeze glock: %d\n", error);
 	return error;
 }
@@ -255,7 +255,7 @@
 		gfs2_glock_nq(&sdp->sd_live_gh);
 	}
 
-	gfs2_glock_queue_put(live_gl); /* drop extra reference we acquired */
+	gfs2_glock_put(live_gl); /* drop extra reference we acquired */
 	clear_bit(SDF_WITHDRAW_RECOVERY, &sdp->sd_flags);
 
 	/*
@@ -350,7 +350,6 @@
 			fs_err(sdp, "telling LM to unmount\n");
 			lm->lm_unmount(sdp);
 		}
-		set_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags);
 		fs_err(sdp, "File system withdrawn\n");
 		dump_stack();
 		clear_bit(SDF_WITHDRAW_IN_PROG, &sdp->sd_flags);
--- linux-qcom-6.8.0.orig/fs/hfs/bnode.c
+++ linux-qcom-6.8.0/fs/hfs/bnode.c
@@ -55,7 +55,7 @@
 	return data;
 }
 
-void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
+int hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
 {
 	struct hfs_btree *tree;
 	int key_len;
@@ -67,7 +67,13 @@
 	else
 		key_len = tree->max_key_len + 1;
 
+	if (key_len > tree->max_key_len + 1) {
+		pr_err("key_len %d too large\n", key_len);
+		return -EINVAL;
+	}
+
 	hfs_bnode_read(node, key, off, key_len);
+	return 0;
 }
 
 void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)
--- linux-qcom-6.8.0.orig/fs/hfs/brec.c
+++ linux-qcom-6.8.0/fs/hfs/brec.c
@@ -70,6 +70,7 @@
 	int data_off, end_off;
 	int idx_rec_off, data_rec_off, end_rec_off;
 	__be32 cnid;
+	int res;
 
 	tree = fd->tree;
 	if (!fd->bnode) {
@@ -138,7 +139,10 @@
 	 * at the start of the node and it is not the new node
 	 */
 	if (!rec && new_node != node) {
-		hfs_bnode_read_key(node, fd->search_key, data_off + size);
+		res = hfs_bnode_read_key(node, fd->search_key, data_off + size);
+		if (res < 0)
+			return res;
+
 		hfs_brec_update_parent(fd);
 	}
 
@@ -156,7 +160,10 @@
 		entry_len = sizeof(cnid);
 
 		/* get index key */
-		hfs_bnode_read_key(new_node, fd->search_key, 14);
+		res = hfs_bnode_read_key(new_node, fd->search_key, 14);
+		if (res < 0)
+			return res;
+
 		__hfs_brec_find(fd->bnode, fd);
 
 		hfs_bnode_put(new_node);
@@ -356,6 +363,7 @@
 	int newkeylen, diff;
 	int rec, rec_off, end_rec_off;
 	int start_off, end_off;
+	int res;
 
 	tree = fd->tree;
 	node = fd->bnode;
@@ -431,7 +439,10 @@
 		}
 		fd->bnode = hfs_bnode_find(tree, new_node->parent);
 		/* create index key and entry */
-		hfs_bnode_read_key(new_node, fd->search_key, 14);
+		res = hfs_bnode_read_key(new_node, fd->search_key, 14);
+		if (res < 0)
+			return res;
+
 		cnid = cpu_to_be32(new_node->this);
 
 		__hfs_brec_find(fd->bnode, fd);
@@ -443,7 +454,9 @@
 			if (new_node == node)
 				goto out;
 			/* restore search_key */
-			hfs_bnode_read_key(node, fd->search_key, 14);
+			res = hfs_bnode_read_key(node, fd->search_key, 14);
+			if (res < 0)
+				return res;
 		}
 		new_node = NULL;
 	}
--- linux-qcom-6.8.0.orig/fs/hfs/btree.h
+++ linux-qcom-6.8.0/fs/hfs/btree.h
@@ -97,7 +97,7 @@
 extern void hfs_bnode_read(struct hfs_bnode *, void *, int, int);
 extern u16 hfs_bnode_read_u16(struct hfs_bnode *, int);
 extern u8 hfs_bnode_read_u8(struct hfs_bnode *, int);
-extern void hfs_bnode_read_key(struct hfs_bnode *, void *, int);
+extern int hfs_bnode_read_key(struct hfs_bnode *, void *, int);
 extern void hfs_bnode_write(struct hfs_bnode *, void *, int, int);
 extern void hfs_bnode_write_u16(struct hfs_bnode *, int, u16);
 extern void hfs_bnode_write_u8(struct hfs_bnode *, int, u8);
--- linux-qcom-6.8.0.orig/fs/hfs/inode.c
+++ linux-qcom-6.8.0/fs/hfs/inode.c
@@ -200,6 +200,7 @@
 	HFS_I(inode)->flags = 0;
 	HFS_I(inode)->rsrc_inode = NULL;
 	HFS_I(inode)->fs_blocks = 0;
+	HFS_I(inode)->tz_secondswest = sys_tz.tz_minuteswest * 60;
 	if (S_ISDIR(mode)) {
 		inode->i_size = 2;
 		HFS_SB(sb)->folder_count++;
@@ -275,6 +276,8 @@
 	for (count = 0, i = 0; i < 3; i++)
 		count += be16_to_cpu(ext[i].count);
 	HFS_I(inode)->first_blocks = count;
+	HFS_I(inode)->cached_start = 0;
+	HFS_I(inode)->cached_blocks = 0;
 
 	inode->i_size = HFS_I(inode)->phys_size = log_size;
 	HFS_I(inode)->fs_blocks = (log_size + sb->s_blocksize - 1) >> sb->s_blocksize_bits;
--- linux-qcom-6.8.0.orig/fs/hfs/super.c
+++ linux-qcom-6.8.0/fs/hfs/super.c
@@ -418,11 +418,13 @@
 		goto bail_no_root;
 	res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
 	if (!res) {
-		if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
+		if (fd.entrylength != sizeof(rec.dir)) {
 			res =  -EIO;
 			goto bail_hfs_find;
 		}
 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
+		if (rec.type != HFS_CDR_DIR)
+			res = -EIO;
 	}
 	if (res)
 		goto bail_hfs_find;
--- linux-qcom-6.8.0.orig/fs/hfsplus/bfind.c
+++ linux-qcom-6.8.0/fs/hfsplus/bfind.c
@@ -25,19 +25,8 @@
 	fd->key = ptr + tree->max_key_len + 2;
 	hfs_dbg(BNODE_REFS, "find_init: %d (%p)\n",
 		tree->cnid, __builtin_return_address(0));
-	switch (tree->cnid) {
-	case HFSPLUS_CAT_CNID:
-		mutex_lock_nested(&tree->tree_lock, CATALOG_BTREE_MUTEX);
-		break;
-	case HFSPLUS_EXT_CNID:
-		mutex_lock_nested(&tree->tree_lock, EXTENTS_BTREE_MUTEX);
-		break;
-	case HFSPLUS_ATTR_CNID:
-		mutex_lock_nested(&tree->tree_lock, ATTR_BTREE_MUTEX);
-		break;
-	default:
-		BUG();
-	}
+	mutex_lock_nested(&tree->tree_lock,
+			hfsplus_btree_lock_class(tree));
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/fs/hfsplus/bnode.c
+++ linux-qcom-6.8.0/fs/hfsplus/bnode.c
@@ -54,7 +54,7 @@
 	return data;
 }
 
-void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
+int hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
 {
 	struct hfs_btree *tree;
 	int key_len;
@@ -67,7 +67,13 @@
 	else
 		key_len = tree->max_key_len + 2;
 
+	if (key_len > tree->max_key_len + 2) {
+		pr_err("key_len %d too large\n", key_len);
+		return -EINVAL;
+	}
+
 	hfs_bnode_read(node, key, off, key_len);
+	return 0;
 }
 
 void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)
--- linux-qcom-6.8.0.orig/fs/hfsplus/brec.c
+++ linux-qcom-6.8.0/fs/hfsplus/brec.c
@@ -68,6 +68,7 @@
 	int data_off, end_off;
 	int idx_rec_off, data_rec_off, end_rec_off;
 	__be32 cnid;
+	int res;
 
 	tree = fd->tree;
 	if (!fd->bnode) {
@@ -138,7 +139,10 @@
 	 * at the start of the node and it is not the new node
 	 */
 	if (!rec && new_node != node) {
-		hfs_bnode_read_key(node, fd->search_key, data_off + size);
+		res = hfs_bnode_read_key(node, fd->search_key, data_off + size);
+		if (res < 0)
+			return res;
+
 		hfs_brec_update_parent(fd);
 	}
 
@@ -156,7 +160,10 @@
 		entry_len = sizeof(cnid);
 
 		/* get index key */
-		hfs_bnode_read_key(new_node, fd->search_key, 14);
+		res = hfs_bnode_read_key(new_node, fd->search_key, 14);
+		if (res < 0)
+			return res;
+
 		__hfs_brec_find(fd->bnode, fd, hfs_find_rec_by_key);
 
 		hfs_bnode_put(new_node);
@@ -360,6 +367,7 @@
 	int newkeylen, diff;
 	int rec, rec_off, end_rec_off;
 	int start_off, end_off;
+	int res;
 
 	tree = fd->tree;
 	node = fd->bnode;
@@ -435,7 +443,10 @@
 		}
 		fd->bnode = hfs_bnode_find(tree, new_node->parent);
 		/* create index key and entry */
-		hfs_bnode_read_key(new_node, fd->search_key, 14);
+		res = hfs_bnode_read_key(new_node, fd->search_key, 14);
+		if (res < 0)
+			return res;
+
 		cnid = cpu_to_be32(new_node->this);
 
 		__hfs_brec_find(fd->bnode, fd, hfs_find_rec_by_key);
@@ -447,7 +458,9 @@
 			if (new_node == node)
 				goto out;
 			/* restore search_key */
-			hfs_bnode_read_key(node, fd->search_key, 14);
+			res = hfs_bnode_read_key(node, fd->search_key, 14);
+			if (res < 0)
+				return res;
 		}
 		new_node = NULL;
 	}
--- linux-qcom-6.8.0.orig/fs/hfsplus/extents.c
+++ linux-qcom-6.8.0/fs/hfsplus/extents.c
@@ -430,7 +430,8 @@
 		hfsplus_free_extents(sb, ext_entry, total_blocks - start,
 				     total_blocks);
 		total_blocks = start;
-		mutex_lock(&fd.tree->tree_lock);
+		mutex_lock_nested(&fd.tree->tree_lock,
+			hfsplus_btree_lock_class(fd.tree));
 	} while (total_blocks > blocks);
 	hfs_find_exit(&fd);
 
@@ -592,7 +593,8 @@
 					     alloc_cnt, alloc_cnt - blk_cnt);
 			hfsplus_dump_extent(hip->first_extents);
 			hip->first_blocks = blk_cnt;
-			mutex_lock(&fd.tree->tree_lock);
+			mutex_lock_nested(&fd.tree->tree_lock,
+				hfsplus_btree_lock_class(fd.tree));
 			break;
 		}
 		res = __hfsplus_ext_cache_extent(&fd, inode, alloc_cnt);
@@ -606,7 +608,8 @@
 		hfsplus_free_extents(sb, hip->cached_extents,
 				     alloc_cnt - start, alloc_cnt - blk_cnt);
 		hfsplus_dump_extent(hip->cached_extents);
-		mutex_lock(&fd.tree->tree_lock);
+		mutex_lock_nested(&fd.tree->tree_lock,
+				hfsplus_btree_lock_class(fd.tree));
 		if (blk_cnt > start) {
 			hip->extent_state |= HFSPLUS_EXT_DIRTY;
 			break;
--- linux-qcom-6.8.0.orig/fs/hfsplus/hfsplus_fs.h
+++ linux-qcom-6.8.0/fs/hfsplus/hfsplus_fs.h
@@ -156,6 +156,7 @@
 
 	/* Runtime variables */
 	u32 blockoffset;
+	u32 min_io_size;
 	sector_t part_start;
 	sector_t sect_count;
 	int fs_shift;
@@ -307,7 +308,7 @@
  */
 static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
 {
-	return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev),
+	return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size,
 		     HFSPLUS_SECTOR_SIZE);
 }
 
@@ -396,7 +397,7 @@
 void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len);
 u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off);
 u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off);
-void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off);
+int hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off);
 void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len);
 void hfs_bnode_write_u16(struct hfs_bnode *node, int off, u16 data);
 void hfs_bnode_clear(struct hfs_bnode *node, int off, int len);
@@ -553,6 +554,27 @@
 	return cpu_to_be32(lower_32_bits(ut) + HFSPLUS_UTC_OFFSET);
 }
 
+static inline enum hfsplus_btree_mutex_classes
+hfsplus_btree_lock_class(struct hfs_btree *tree)
+{
+	enum hfsplus_btree_mutex_classes class;
+
+	switch (tree->cnid) {
+	case HFSPLUS_CAT_CNID:
+		class = CATALOG_BTREE_MUTEX;
+		break;
+	case HFSPLUS_EXT_CNID:
+		class = EXTENTS_BTREE_MUTEX;
+		break;
+	case HFSPLUS_ATTR_CNID:
+		class = ATTR_BTREE_MUTEX;
+		break;
+	default:
+		BUG();
+	}
+	return class;
+}
+
 /* compatibility */
 #define hfsp_mt2ut(t)		(struct timespec64){ .tv_sec = __hfsp_mt2ut(t) }
 #define hfsp_ut2mt(t)		__hfsp_ut2mt((t).tv_sec)
--- linux-qcom-6.8.0.orig/fs/hfsplus/wrapper.c
+++ linux-qcom-6.8.0/fs/hfsplus/wrapper.c
@@ -30,7 +30,7 @@
  * @sector: block to read or write, for blocks of HFSPLUS_SECTOR_SIZE bytes
  * @buf: buffer for I/O
  * @data: output pointer for location of requested data
- * @opf: request op flags
+ * @opf: I/O operation type and flags
  *
  * The unit of I/O is hfsplus_min_io_size(sb), which may be bigger than
  * HFSPLUS_SECTOR_SIZE, and @buf must be sized accordingly. On reads
@@ -172,6 +172,8 @@
 	if (!blocksize)
 		goto out;
 
+	sbi->min_io_size = blocksize;
+
 	if (hfsplus_get_last_session(sb, &part_start, &part_size))
 		goto out;
 
--- linux-qcom-6.8.0.orig/fs/hfsplus/xattr.c
+++ linux-qcom-6.8.0/fs/hfsplus/xattr.c
@@ -698,7 +698,7 @@
 		return err;
 	}
 
-	strbuf = kmalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN +
+	strbuf = kzalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN +
 			XATTR_MAC_OSX_PREFIX_LEN + 1, GFP_KERNEL);
 	if (!strbuf) {
 		res = -ENOMEM;
--- linux-qcom-6.8.0.orig/fs/hostfs/hostfs.h
+++ linux-qcom-6.8.0/fs/hostfs/hostfs.h
@@ -63,9 +63,10 @@
 	struct hostfs_timespec atime, mtime, ctime;
 	unsigned int blksize;
 	unsigned long long blocks;
-	unsigned int maj;
-	unsigned int min;
-	dev_t dev;
+	struct {
+		unsigned int maj;
+		unsigned int min;
+	} rdev, dev;
 };
 
 extern int stat_file(const char *path, struct hostfs_stat *p, int fd);
--- linux-qcom-6.8.0.orig/fs/hostfs/hostfs_kern.c
+++ linux-qcom-6.8.0/fs/hostfs/hostfs_kern.c
@@ -530,10 +530,11 @@
 static int hostfs_inode_set(struct inode *ino, void *data)
 {
 	struct hostfs_stat *st = data;
-	dev_t rdev;
+	dev_t dev, rdev;
 
 	/* Reencode maj and min with the kernel encoding.*/
-	rdev = MKDEV(st->maj, st->min);
+	rdev = MKDEV(st->rdev.maj, st->rdev.min);
+	dev = MKDEV(st->dev.maj, st->dev.min);
 
 	switch (st->mode & S_IFMT) {
 	case S_IFLNK:
@@ -559,7 +560,7 @@
 		return -EIO;
 	}
 
-	HOSTFS_I(ino)->dev = st->dev;
+	HOSTFS_I(ino)->dev = dev;
 	ino->i_ino = st->ino;
 	ino->i_mode = st->mode;
 	return hostfs_inode_update(ino, st);
@@ -568,8 +569,9 @@
 static int hostfs_inode_test(struct inode *inode, void *data)
 {
 	const struct hostfs_stat *st = data;
+	dev_t dev = MKDEV(st->dev.maj, st->dev.min);
 
-	return inode->i_ino == st->ino && HOSTFS_I(inode)->dev == st->dev;
+	return inode->i_ino == st->ino && HOSTFS_I(inode)->dev == dev;
 }
 
 static struct inode *hostfs_iget(struct super_block *sb, char *name)
--- linux-qcom-6.8.0.orig/fs/hostfs/hostfs_user.c
+++ linux-qcom-6.8.0/fs/hostfs/hostfs_user.c
@@ -34,9 +34,10 @@
 	p->mtime.tv_nsec = 0;
 	p->blksize = buf->st_blksize;
 	p->blocks = buf->st_blocks;
-	p->maj = os_major(buf->st_rdev);
-	p->min = os_minor(buf->st_rdev);
-	p->dev = buf->st_dev;
+	p->rdev.maj = os_major(buf->st_rdev);
+	p->rdev.min = os_minor(buf->st_rdev);
+	p->dev.maj = os_major(buf->st_dev);
+	p->dev.min = os_minor(buf->st_dev);
 }
 
 int stat_file(const char *path, struct hostfs_stat *p, int fd)
--- linux-qcom-6.8.0.orig/fs/inode.c
+++ linux-qcom-6.8.0/fs/inode.c
@@ -485,6 +485,39 @@
 		this_cpu_dec(nr_unused);
 }
 
+static void inode_pin_lru_isolating(struct inode *inode)
+{
+	lockdep_assert_held(&inode->i_lock);
+	WARN_ON(inode->i_state & (I_LRU_ISOLATING | I_FREEING | I_WILL_FREE));
+	inode->i_state |= I_LRU_ISOLATING;
+}
+
+static void inode_unpin_lru_isolating(struct inode *inode)
+{
+	spin_lock(&inode->i_lock);
+	WARN_ON(!(inode->i_state & I_LRU_ISOLATING));
+	inode->i_state &= ~I_LRU_ISOLATING;
+	smp_mb();
+	wake_up_bit(&inode->i_state, __I_LRU_ISOLATING);
+	spin_unlock(&inode->i_lock);
+}
+
+static void inode_wait_for_lru_isolating(struct inode *inode)
+{
+	spin_lock(&inode->i_lock);
+	if (inode->i_state & I_LRU_ISOLATING) {
+		DEFINE_WAIT_BIT(wq, &inode->i_state, __I_LRU_ISOLATING);
+		wait_queue_head_t *wqh;
+
+		wqh = bit_waitqueue(&inode->i_state, __I_LRU_ISOLATING);
+		spin_unlock(&inode->i_lock);
+		__wait_on_bit(wqh, &wq, bit_wait, TASK_UNINTERRUPTIBLE);
+		spin_lock(&inode->i_lock);
+		WARN_ON(inode->i_state & I_LRU_ISOLATING);
+	}
+	spin_unlock(&inode->i_lock);
+}
+
 /**
  * inode_sb_list_add - add inode to the superblock list of inodes
  * @inode: inode to add
@@ -559,6 +592,7 @@
 	struct hlist_node *dentry_first;
 	struct dentry *dentry_ptr;
 	struct dentry dentry;
+	char fname[64] = {};
 	unsigned long ino;
 
 	/*
@@ -594,11 +628,14 @@
 		return;
 	}
 
+	if (strncpy_from_kernel_nofault(fname, dentry.d_name.name, 63) < 0)
+		strscpy(fname, "<invalid>", sizeof(fname));
 	/*
-	 * if dentry is corrupted, the %pd handler may still crash,
-	 * but it's unlikely that we reach here with a corrupt mapping
+	 * Even if strncpy_from_kernel_nofault() succeeded,
+	 * the fname could be unreliable
 	 */
-	pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n", a_ops, ino, &dentry);
+	pr_warn("aops:%ps ino:%lx dentry name(?):\"%s\"\n",
+		a_ops, ino, fname);
 }
 
 void clear_inode(struct inode *inode)
@@ -653,6 +690,8 @@
 
 	inode_sb_list_del(inode);
 
+	inode_wait_for_lru_isolating(inode);
+
 	/*
 	 * Wait for flusher thread to be done with the inode so that filesystem
 	 * does not start destroying it while writeback is still running. Since
@@ -721,6 +760,10 @@
 			continue;
 
 		spin_lock(&inode->i_lock);
+		if (atomic_read(&inode->i_count)) {
+			spin_unlock(&inode->i_lock);
+			continue;
+		}
 		if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) {
 			spin_unlock(&inode->i_lock);
 			continue;
@@ -841,7 +884,7 @@
 	 * be under pressure before the cache inside the highmem zone.
 	 */
 	if (inode_has_buffers(inode) || !mapping_empty(&inode->i_data)) {
-		__iget(inode);
+		inode_pin_lru_isolating(inode);
 		spin_unlock(&inode->i_lock);
 		spin_unlock(lru_lock);
 		if (remove_inode_buffers(inode)) {
@@ -853,7 +896,7 @@
 				__count_vm_events(PGINODESTEAL, reap);
 			mm_account_reclaimed_pages(reap);
 		}
-		iput(inode);
+		inode_unpin_lru_isolating(inode);
 		spin_lock(lru_lock);
 		return LRU_RETRY;
 	}
--- linux-qcom-6.8.0.orig/fs/iomap/buffered-io.c
+++ linux-qcom-6.8.0/fs/iomap/buffered-io.c
@@ -203,6 +203,7 @@
 	unsigned block_size = (1 << block_bits);
 	size_t poff = offset_in_folio(folio, *pos);
 	size_t plen = min_t(loff_t, folio_size(folio) - poff, length);
+	size_t orig_plen = plen;
 	unsigned first = poff >> block_bits;
 	unsigned last = (poff + plen - 1) >> block_bits;
 
@@ -239,7 +240,7 @@
 	 * handle both halves separately so that we properly zero data in the
 	 * page cache for blocks that are entirely outside of i_size.
 	 */
-	if (orig_pos <= isize && orig_pos + length > isize) {
+	if (orig_pos <= isize && orig_pos + orig_plen > isize) {
 		unsigned end = offset_in_folio(folio, isize - 1) >> block_bits;
 
 		if (first <= end && last > end)
@@ -871,11 +872,11 @@
 static loff_t iomap_write_iter(struct iomap_iter *iter, struct iov_iter *i)
 {
 	loff_t length = iomap_length(iter);
-	size_t chunk = PAGE_SIZE << MAX_PAGECACHE_ORDER;
 	loff_t pos = iter->pos;
 	ssize_t written = 0;
 	long status = 0;
 	struct address_space *mapping = iter->inode->i_mapping;
+	size_t chunk = mapping_max_folio_size(mapping);
 	unsigned int bdp_flags = (iter->flags & IOMAP_NOWAIT) ? BDP_ASYNC : 0;
 
 	do {
@@ -1097,7 +1098,7 @@
 		}
 
 		/* move offset to start of next folio in range */
-		start_byte = folio_next_index(folio) << PAGE_SHIFT;
+		start_byte = folio_pos(folio) + folio_size(folio);
 		folio_unlock(folio);
 		folio_put(folio);
 	}
@@ -1179,7 +1180,15 @@
 			error = data_end;
 			goto out_unlock;
 		}
-		WARN_ON_ONCE(data_end <= start_byte);
+
+		/*
+		 * If we race with post-direct I/O invalidation of the page cache,
+		 * there might be no data left at start_byte.
+		 */
+		if (data_end == start_byte)
+			continue;
+
+		WARN_ON_ONCE(data_end < start_byte);
 		WARN_ON_ONCE(data_end > scan_end_byte);
 
 		error = iomap_write_delalloc_scan(inode, &punch_start_byte,
@@ -1267,16 +1276,11 @@
 static loff_t iomap_unshare_iter(struct iomap_iter *iter)
 {
 	struct iomap *iomap = &iter->iomap;
-	const struct iomap *srcmap = iomap_iter_srcmap(iter);
 	loff_t pos = iter->pos;
 	loff_t length = iomap_length(iter);
 	loff_t written = 0;
 
-	/* don't bother with blocks that are not shared to start with */
-	if (!(iomap->flags & IOMAP_F_SHARED))
-		return length;
-	/* don't bother with holes or unwritten extents */
-	if (srcmap->type == IOMAP_HOLE || srcmap->type == IOMAP_UNWRITTEN)
+	if (!iomap_want_unshare_iter(iter))
 		return length;
 
 	do {
@@ -1318,11 +1322,15 @@
 	struct iomap_iter iter = {
 		.inode		= inode,
 		.pos		= pos,
-		.len		= len,
 		.flags		= IOMAP_WRITE | IOMAP_UNSHARE,
 	};
+	loff_t size = i_size_read(inode);
 	int ret;
 
+	if (pos < 0 || pos >= size)
+		return 0;
+
+	iter.len = min(len, size - pos);
 	while ((ret = iomap_iter(&iter, ops)) > 0)
 		iter.processed = iomap_unshare_iter(&iter);
 	return ret;
@@ -1833,16 +1841,10 @@
 	if (unlikely(error)) {
 		/*
 		 * Let the filesystem know what portion of the current page
-		 * failed to map. If the page hasn't been added to ioend, it
-		 * won't be affected by I/O completion and we must unlock it
-		 * now.
+		 * failed to map.
 		 */
 		if (wpc->ops->discard_folio)
 			wpc->ops->discard_folio(folio, pos);
-		if (!count) {
-			folio_unlock(folio);
-			goto done;
-		}
 	}
 
 	/*
@@ -1851,6 +1853,16 @@
 	 * all the dirty bits in the folio here.
 	 */
 	iomap_clear_range_dirty(folio, 0, folio_size(folio));
+
+	/*
+	 * If the page hasn't been added to the ioend, it won't be affected by
+	 * I/O completion and we must unlock it now.
+	 */
+	if (error && !count) {
+		folio_unlock(folio);
+		goto done;
+	}
+
 	folio_start_writeback(folio);
 	folio_unlock(folio);
 
--- linux-qcom-6.8.0.orig/fs/isofs/inode.c
+++ linux-qcom-6.8.0/fs/isofs/inode.c
@@ -908,8 +908,22 @@
 	 * we then decide whether to use the Joliet descriptor.
 	 */
 	inode = isofs_iget(s, sbi->s_firstdatazone, 0);
-	if (IS_ERR(inode))
-		goto out_no_root;
+
+	/*
+	 * Fix for broken CDs with a corrupt root inode but a correct Joliet
+	 * root directory.
+	 */
+	if (IS_ERR(inode)) {
+		if (joliet_level && sbi->s_firstdatazone != first_data_zone) {
+			printk(KERN_NOTICE
+			       "ISOFS: root inode is unusable. "
+			       "Disabling Rock Ridge and switching to Joliet.");
+			sbi->s_rock = 0;
+			inode = NULL;
+		} else {
+			goto out_no_root;
+		}
+	}
 
 	/*
 	 * Fix for broken CDs with Rock Ridge and empty ISO root directory but
--- linux-qcom-6.8.0.orig/fs/jbd2/checkpoint.c
+++ linux-qcom-6.8.0/fs/jbd2/checkpoint.c
@@ -79,17 +79,23 @@
 		if (space_left < nblocks) {
 			int chkpt = journal->j_checkpoint_transactions != NULL;
 			tid_t tid = 0;
+			bool has_transaction = false;
 
-			if (journal->j_committing_transaction)
+			if (journal->j_committing_transaction) {
 				tid = journal->j_committing_transaction->t_tid;
+				has_transaction = true;
+			}
 			spin_unlock(&journal->j_list_lock);
 			write_unlock(&journal->j_state_lock);
 			if (chkpt) {
 				jbd2_log_do_checkpoint(journal);
-			} else if (jbd2_cleanup_journal_tail(journal) == 0) {
-				/* We were able to recover space; yay! */
+			} else if (jbd2_cleanup_journal_tail(journal) <= 0) {
+				/*
+				 * We were able to recover space or the
+				 * journal was aborted due to an error.
+				 */
 				;
-			} else if (tid) {
+			} else if (has_transaction) {
 				/*
 				 * jbd2_journal_commit_transaction() may want
 				 * to take the checkpoint_mutex if JBD2_FLUSHED
@@ -409,6 +415,7 @@
 	tid_t tid = 0;
 	unsigned long nr_freed = 0;
 	unsigned long freed;
+	bool first_set = false;
 
 again:
 	spin_lock(&journal->j_list_lock);
@@ -428,8 +435,10 @@
 	else
 		transaction = journal->j_checkpoint_transactions;
 
-	if (!first_tid)
+	if (!first_set) {
 		first_tid = transaction->t_tid;
+		first_set = true;
+	}
 	last_transaction = journal->j_checkpoint_transactions->t_cpprev;
 	next_transaction = transaction;
 	last_tid = last_transaction->t_tid;
@@ -459,7 +468,7 @@
 	spin_unlock(&journal->j_list_lock);
 	cond_resched();
 
-	if (*nr_to_scan && next_tid)
+	if (*nr_to_scan && journal->j_shrink_transaction)
 		goto again;
 out:
 	trace_jbd2_shrink_checkpoint_list(journal, first_tid, tid, last_tid,
--- linux-qcom-6.8.0.orig/fs/jbd2/commit.c
+++ linux-qcom-6.8.0/fs/jbd2/commit.c
@@ -767,7 +767,7 @@
 		if (first_block < journal->j_tail)
 			freed += journal->j_last - journal->j_first;
 		/* Update tail only if we free significant amount of space */
-		if (freed < jbd2_journal_get_max_txn_bufs(journal))
+		if (freed < journal->j_max_transaction_buffers)
 			update_tail = 0;
 	}
 	J_ASSERT(commit_transaction->t_state == T_COMMIT);
@@ -777,9 +777,9 @@
 	/*
 	 * If the journal is not located on the file system device,
 	 * then we must flush the file system device before we issue
-	 * the commit record
+	 * the commit record and update the journal tail sequence.
 	 */
-	if (commit_transaction->t_need_data_flush &&
+	if ((commit_transaction->t_need_data_flush || update_tail) &&
 	    (journal->j_fs_dev != journal->j_dev) &&
 	    (journal->j_flags & JBD2_BARRIER))
 		blkdev_issue_flush(journal->j_fs_dev);
--- linux-qcom-6.8.0.orig/fs/jbd2/journal.c
+++ linux-qcom-6.8.0/fs/jbd2/journal.c
@@ -399,6 +399,7 @@
 		tmp = jbd2_alloc(bh_in->b_size, GFP_NOFS);
 		if (!tmp) {
 			brelse(new_bh);
+			free_buffer_head(new_bh);
 			return -ENOMEM;
 		}
 		spin_lock(&jh_in->b_state_lock);
@@ -724,7 +725,7 @@
 		return -EINVAL;
 
 	write_lock(&journal->j_state_lock);
-	if (tid <= journal->j_commit_sequence) {
+	if (tid_geq(journal->j_commit_sequence, tid)) {
 		write_unlock(&journal->j_state_lock);
 		return -EALREADY;
 	}
@@ -754,9 +755,9 @@
  */
 static int __jbd2_fc_end_commit(journal_t *journal, tid_t tid, bool fallback)
 {
-	jbd2_journal_unlock_updates(journal);
 	if (journal->j_fc_cleanup_callback)
 		journal->j_fc_cleanup_callback(journal, 0, tid);
+	jbd2_journal_unlock_updates(journal);
 	write_lock(&journal->j_state_lock);
 	journal->j_flags &= ~JBD2_FAST_COMMIT_ONGOING;
 	if (fallback)
@@ -1451,6 +1452,48 @@
 	return space / record_size;
 }
 
+static int jbd2_journal_get_max_txn_bufs(journal_t *journal)
+{
+	return (journal->j_total_len - journal->j_fc_wbufsize) / 4;
+}
+
+/*
+ * Base amount of descriptor blocks we reserve for each transaction.
+ */
+static int jbd2_descriptor_blocks_per_trans(journal_t *journal)
+{
+	int tag_space = journal->j_blocksize - sizeof(journal_header_t);
+	int tags_per_block;
+
+	/* Subtract UUID */
+	tag_space -= 16;
+	if (jbd2_journal_has_csum_v2or3(journal))
+		tag_space -= sizeof(struct jbd2_journal_block_tail);
+	/* Commit code leaves a slack space of 16 bytes at the end of block */
+	tags_per_block = (tag_space - 16) / journal_tag_bytes(journal);
+	/*
+	 * Revoke descriptors are accounted separately so we need to reserve
+	 * space for commit block and normal transaction descriptor blocks.
+	 */
+	return 1 + DIV_ROUND_UP(jbd2_journal_get_max_txn_bufs(journal),
+				tags_per_block);
+}
+
+/*
+ * Initialize number of blocks each transaction reserves for its bookkeeping
+ * and maximum number of blocks a transaction can use. This needs to be called
+ * after the journal size and the fastcommit area size are initialized.
+ */
+static void jbd2_journal_init_transaction_limits(journal_t *journal)
+{
+	journal->j_revoke_records_per_block =
+				journal_revoke_records_per_block(journal);
+	journal->j_transaction_overhead_buffers =
+				jbd2_descriptor_blocks_per_trans(journal);
+	journal->j_max_transaction_buffers =
+				jbd2_journal_get_max_txn_bufs(journal);
+}
+
 /*
  * Load the on-disk journal superblock and read the key fields into the
  * journal_t.
@@ -1492,8 +1535,8 @@
 	if (jbd2_journal_has_csum_v2or3(journal))
 		journal->j_csum_seed = jbd2_chksum(journal, ~0, sb->s_uuid,
 						   sizeof(sb->s_uuid));
-	journal->j_revoke_records_per_block =
-				journal_revoke_records_per_block(journal);
+	/* After journal features are set, we can compute transaction limits */
+	jbd2_journal_init_transaction_limits(journal);
 
 	if (jbd2_has_feature_fast_commit(journal)) {
 		journal->j_fc_last = be32_to_cpu(sb->s_maxlen);
@@ -1743,8 +1786,6 @@
 	journal->j_commit_sequence = journal->j_transaction_sequence - 1;
 	journal->j_commit_request = journal->j_commit_sequence;
 
-	journal->j_max_transaction_buffers = jbd2_journal_get_max_txn_bufs(journal);
-
 	/*
 	 * Now that journal recovery is done, turn fast commits off here. This
 	 * way, if fast commit was enabled before the crash but if now FS has
@@ -2285,8 +2326,6 @@
 	journal->j_fc_first = journal->j_last + 1;
 	journal->j_fc_off = 0;
 	journal->j_free = journal->j_last - journal->j_first;
-	journal->j_max_transaction_buffers =
-		jbd2_journal_get_max_txn_bufs(journal);
 
 	return 0;
 }
@@ -2374,8 +2413,7 @@
 	sb->s_feature_ro_compat |= cpu_to_be32(ro);
 	sb->s_feature_incompat  |= cpu_to_be32(incompat);
 	unlock_buffer(journal->j_sb_buffer);
-	journal->j_revoke_records_per_block =
-				journal_revoke_records_per_block(journal);
+	jbd2_journal_init_transaction_limits(journal);
 
 	return 1;
 #undef COMPAT_FEATURE_ON
@@ -2406,8 +2444,7 @@
 	sb->s_feature_compat    &= ~cpu_to_be32(compat);
 	sb->s_feature_ro_compat &= ~cpu_to_be32(ro);
 	sb->s_feature_incompat  &= ~cpu_to_be32(incompat);
-	journal->j_revoke_records_per_block =
-				journal_revoke_records_per_block(journal);
+	jbd2_journal_init_transaction_limits(journal);
 }
 EXPORT_SYMBOL(jbd2_journal_clear_features);
 
--- linux-qcom-6.8.0.orig/fs/jbd2/recovery.c
+++ linux-qcom-6.8.0/fs/jbd2/recovery.c
@@ -443,6 +443,27 @@
 	return provided == cpu_to_be32(calculated);
 }
 
+static bool jbd2_commit_block_csum_verify_partial(journal_t *j, void *buf)
+{
+	struct commit_header *h;
+	__be32 provided;
+	__u32 calculated;
+	void *tmpbuf;
+
+	tmpbuf = kzalloc(j->j_blocksize, GFP_KERNEL);
+	if (!tmpbuf)
+		return false;
+
+	memcpy(tmpbuf, buf, sizeof(struct commit_header));
+	h = tmpbuf;
+	provided = h->h_chksum[0];
+	h->h_chksum[0] = 0;
+	calculated = jbd2_chksum(j, j->j_csum_seed, tmpbuf, j->j_blocksize);
+	kfree(tmpbuf);
+
+	return provided == cpu_to_be32(calculated);
+}
+
 static int jbd2_block_tag_csum_verify(journal_t *j, journal_block_tag_t *tag,
 				      journal_block_tag3_t *tag3,
 				      void *buf, __u32 sequence)
@@ -810,6 +831,13 @@
 			if (pass == PASS_SCAN &&
 			    !jbd2_commit_block_csum_verify(journal,
 							   bh->b_data)) {
+				if (jbd2_commit_block_csum_verify_partial(
+								  journal,
+								  bh->b_data)) {
+					pr_notice("JBD2: Find incomplete commit block in transaction %u block %lu\n",
+						  next_commit_ID, next_log_block);
+					goto chksum_ok;
+				}
 			chksum_error:
 				if (commit_time < last_trans_commit_time)
 					goto ignore_crc_mismatch;
@@ -824,6 +852,7 @@
 				}
 			}
 			if (pass == PASS_SCAN) {
+			chksum_ok:
 				last_trans_commit_time = commit_time;
 				head_block = next_log_block;
 			}
@@ -843,6 +872,7 @@
 					  next_log_block);
 				need_check_commit_time = true;
 			}
+
 			/* If we aren't in the REVOKE pass, then we can
 			 * just skip over this block. */
 			if (pass != PASS_REVOKE) {
--- linux-qcom-6.8.0.orig/fs/jbd2/revoke.c
+++ linux-qcom-6.8.0/fs/jbd2/revoke.c
@@ -654,7 +654,7 @@
 	set_buffer_jwrite(descriptor);
 	BUFFER_TRACE(descriptor, "write");
 	set_buffer_dirty(descriptor);
-	write_dirty_buffer(descriptor, REQ_SYNC);
+	write_dirty_buffer(descriptor, JBD2_JOURNAL_REQ_FLAGS);
 }
 #endif
 
--- linux-qcom-6.8.0.orig/fs/jbd2/transaction.c
+++ linux-qcom-6.8.0/fs/jbd2/transaction.c
@@ -63,28 +63,6 @@
 }
 
 /*
- * Base amount of descriptor blocks we reserve for each transaction.
- */
-static int jbd2_descriptor_blocks_per_trans(journal_t *journal)
-{
-	int tag_space = journal->j_blocksize - sizeof(journal_header_t);
-	int tags_per_block;
-
-	/* Subtract UUID */
-	tag_space -= 16;
-	if (jbd2_journal_has_csum_v2or3(journal))
-		tag_space -= sizeof(struct jbd2_journal_block_tail);
-	/* Commit code leaves a slack space of 16 bytes at the end of block */
-	tags_per_block = (tag_space - 16) / journal_tag_bytes(journal);
-	/*
-	 * Revoke descriptors are accounted separately so we need to reserve
-	 * space for commit block and normal transaction descriptor blocks.
-	 */
-	return 1 + DIV_ROUND_UP(journal->j_max_transaction_buffers,
-				tags_per_block);
-}
-
-/*
  * jbd2_get_transaction: obtain a new transaction_t object.
  *
  * Simply initialise a new transaction. Initialize it in
@@ -109,7 +87,7 @@
 	transaction->t_expires = jiffies + journal->j_commit_interval;
 	atomic_set(&transaction->t_updates, 0);
 	atomic_set(&transaction->t_outstanding_credits,
-		   jbd2_descriptor_blocks_per_trans(journal) +
+		   journal->j_transaction_overhead_buffers +
 		   atomic_read(&journal->j_reserved_credits));
 	atomic_set(&transaction->t_outstanding_revokes, 0);
 	atomic_set(&transaction->t_handle_count, 0);
@@ -213,6 +191,13 @@
 	wake_up(&journal->j_wait_reserved);
 }
 
+/* Maximum number of blocks for user transaction payload */
+static int jbd2_max_user_trans_buffers(journal_t *journal)
+{
+	return journal->j_max_transaction_buffers -
+				journal->j_transaction_overhead_buffers;
+}
+
 /*
  * Wait until we can add credits for handle to the running transaction.  Called
  * with j_state_lock held for reading. Returns 0 if handle joined the running
@@ -262,12 +247,12 @@
 		 * big to fit this handle? Wait until reserved credits are freed.
 		 */
 		if (atomic_read(&journal->j_reserved_credits) + total >
-		    journal->j_max_transaction_buffers) {
+		    jbd2_max_user_trans_buffers(journal)) {
 			read_unlock(&journal->j_state_lock);
 			jbd2_might_wait_for_commit(journal);
 			wait_event(journal->j_wait_reserved,
 				   atomic_read(&journal->j_reserved_credits) + total <=
-				   journal->j_max_transaction_buffers);
+				   jbd2_max_user_trans_buffers(journal));
 			__acquire(&journal->j_state_lock); /* fake out sparse */
 			return 1;
 		}
@@ -307,14 +292,14 @@
 
 	needed = atomic_add_return(rsv_blocks, &journal->j_reserved_credits);
 	/* We allow at most half of a transaction to be reserved */
-	if (needed > journal->j_max_transaction_buffers / 2) {
+	if (needed > jbd2_max_user_trans_buffers(journal) / 2) {
 		sub_reserved_credits(journal, rsv_blocks);
 		atomic_sub(total, &t->t_outstanding_credits);
 		read_unlock(&journal->j_state_lock);
 		jbd2_might_wait_for_commit(journal);
 		wait_event(journal->j_wait_reserved,
 			 atomic_read(&journal->j_reserved_credits) + rsv_blocks
-			 <= journal->j_max_transaction_buffers / 2);
+			 <= jbd2_max_user_trans_buffers(journal) / 2);
 		__acquire(&journal->j_state_lock); /* fake out sparse */
 		return 1;
 	}
@@ -344,12 +329,12 @@
 	 * size and limit the number of total credits to not exceed maximum
 	 * transaction size per operation.
 	 */
-	if ((rsv_blocks > journal->j_max_transaction_buffers / 2) ||
-	    (rsv_blocks + blocks > journal->j_max_transaction_buffers)) {
+	if (rsv_blocks > jbd2_max_user_trans_buffers(journal) / 2 ||
+	    rsv_blocks + blocks > jbd2_max_user_trans_buffers(journal)) {
 		printk(KERN_ERR "JBD2: %s wants too many credits "
 		       "credits:%d rsv_credits:%d max:%d\n",
 		       current->comm, blocks, rsv_blocks,
-		       journal->j_max_transaction_buffers);
+		       jbd2_max_user_trans_buffers(journal));
 		WARN_ON(1);
 		return -ENOSPC;
 	}
--- linux-qcom-6.8.0.orig/fs/jffs2/compr_rtime.c
+++ linux-qcom-6.8.0/fs/jffs2/compr_rtime.c
@@ -95,6 +95,9 @@
 
 		positions[value]=outpos;
 		if (repeat) {
+			if ((outpos + repeat) > destlen) {
+				return 1;
+			}
 			if (backoffs + repeat >= outpos) {
 				while(repeat) {
 					cpage_out[outpos++] = cpage_out[backoffs++];
--- linux-qcom-6.8.0.orig/fs/jffs2/erase.c
+++ linux-qcom-6.8.0/fs/jffs2/erase.c
@@ -338,10 +338,9 @@
 		} while(--retlen);
 		mtd_unpoint(c->mtd, jeb->offset, c->sector_size);
 		if (retlen) {
-			pr_warn("Newly-erased block contained word 0x%lx at offset 0x%08tx\n",
-				*wordebuf,
-				jeb->offset +
-				c->sector_size-retlen * sizeof(*wordebuf));
+			*bad_offset = jeb->offset + c->sector_size - retlen * sizeof(*wordebuf);
+			pr_warn("Newly-erased block contained word 0x%lx at offset 0x%08x\n",
+				*wordebuf, *bad_offset);
 			return -EIO;
 		}
 		return 0;
--- linux-qcom-6.8.0.orig/fs/jffs2/super.c
+++ linux-qcom-6.8.0/fs/jffs2/super.c
@@ -58,6 +58,7 @@
 	struct jffs2_inode_info *f = foo;
 
 	mutex_init(&f->sem);
+	f->target = NULL;
 	inode_init_once(&f->vfs_inode);
 }
 
--- linux-qcom-6.8.0.orig/fs/jffs2/xattr.c
+++ linux-qcom-6.8.0/fs/jffs2/xattr.c
@@ -1110,6 +1110,9 @@
 		return rc;
 
 	request = PAD(sizeof(struct jffs2_raw_xattr) + strlen(xname) + 1 + size);
+	if (request > c->sector_size - c->cleanmarker_size)
+		return -ERANGE;
+
 	rc = jffs2_reserve_space(c, request, &length,
 				 ALLOC_NORMAL, JFFS2_SUMMARY_XATTR_SIZE);
 	if (rc) {
--- linux-qcom-6.8.0.orig/fs/jfs/jfs_discard.c
+++ linux-qcom-6.8.0/fs/jfs/jfs_discard.c
@@ -65,7 +65,7 @@
 int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
 {
 	struct inode *ipbmap = JFS_SBI(ip->i_sb)->ipbmap;
-	struct bmap *bmp = JFS_SBI(ip->i_sb)->bmap;
+	struct bmap *bmp;
 	struct super_block *sb = ipbmap->i_sb;
 	int agno, agno_end;
 	u64 start, end, minlen;
@@ -83,10 +83,15 @@
 	if (minlen == 0)
 		minlen = 1;
 
+	down_read(&sb->s_umount);
+	bmp = JFS_SBI(ip->i_sb)->bmap;
+
 	if (minlen > bmp->db_agsize ||
 	    start >= bmp->db_mapsize ||
-	    range->len < sb->s_blocksize)
+	    range->len < sb->s_blocksize) {
+		up_read(&sb->s_umount);
 		return -EINVAL;
+	}
 
 	if (end >= bmp->db_mapsize)
 		end = bmp->db_mapsize - 1;
@@ -100,6 +105,8 @@
 		trimmed += dbDiscardAG(ip, agno, minlen);
 		agno++;
 	}
+
+	up_read(&sb->s_umount);
 	range->len = trimmed << sb->s_blocksize_bits;
 
 	return 0;
--- linux-qcom-6.8.0.orig/fs/jfs/jfs_dmap.c
+++ linux-qcom-6.8.0/fs/jfs/jfs_dmap.c
@@ -187,7 +187,7 @@
 	}
 
 	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
-	if (!bmp->db_numag) {
+	if (!bmp->db_numag || bmp->db_numag > MAXAG) {
 		err = -EINVAL;
 		goto err_release_metapage;
 	}
@@ -652,7 +652,7 @@
 	 * average free space.
 	 */
 	for (i = 0 ; i < bmp->db_numag; i++, agpref++) {
-		if (agpref == bmp->db_numag)
+		if (agpref >= bmp->db_numag)
 			agpref = 0;
 
 		if (atomic_read(&bmp->db_active[agpref]))
@@ -1626,6 +1626,8 @@
 		} else if (rc == -ENOSPC) {
 			/* search for next smaller log2 block */
 			l2nb = BLKSTOL2(nblocks) - 1;
+			if (unlikely(l2nb < 0))
+				break;
 			nblocks = 1LL << l2nb;
 		} else {
 			/* Trim any already allocated blocks */
@@ -1818,6 +1820,9 @@
 			return -EIO;
 		dp = (struct dmap *) mp->data;
 
+		if (dp->tree.budmin < 0)
+			return -EIO;
+
 		/* try to allocate the blocks.
 		 */
 		rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results);
@@ -2886,6 +2891,9 @@
 	/* bubble the new value up the tree as required.
 	 */
 	for (k = 0; k < le32_to_cpu(tp->dmt_height); k++) {
+		if (lp == 0)
+			break;
+
 		/* get the index of the first leaf of the 4 leaf
 		 * group containing the specified leaf (leafno).
 		 */
@@ -2942,9 +2950,10 @@
 static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
 {
 	int ti, n = 0, k, x = 0;
-	int max_size;
+	int max_size, max_idx;
 
 	max_size = is_ctl ? CTLTREESIZE : TREESIZE;
+	max_idx = is_ctl ? LPERCTL : LPERDMAP;
 
 	/* first check the root of the tree to see if there is
 	 * sufficient free space.
@@ -2976,6 +2985,8 @@
 		 */
 		assert(n < 4);
 	}
+	if (le32_to_cpu(tp->dmt_leafidx) >= max_idx)
+		return -ENOSPC;
 
 	/* set the return to the leftmost leaf describing sufficient
 	 * free space.
@@ -3020,7 +3031,7 @@
 
 	/* scan the word for nb free bits at nb alignments.
 	 */
-	for (bitno = 0; mask != 0; bitno += nb, mask >>= nb) {
+	for (bitno = 0; mask != 0; bitno += nb, mask = (mask >> nb)) {
 		if ((mask & word) == mask)
 			break;
 	}
--- linux-qcom-6.8.0.orig/fs/jfs/jfs_dtree.c
+++ linux-qcom-6.8.0/fs/jfs/jfs_dtree.c
@@ -834,6 +834,8 @@
 	 * the full page.
 	 */
 	DT_GETSEARCH(ip, btstack->top, bn, mp, p, index);
+	if (p->header.freelist == 0)
+		return -EINVAL;
 
 	/*
 	 *	insert entry for new key
@@ -2889,6 +2891,14 @@
 		stbl = DT_GETSTBL(p);
 
 		for (i = index; i < p->header.nextindex; i++) {
+			if (stbl[i] < 0 || stbl[i] > 127) {
+				jfs_err("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld",
+					i, stbl[i], (long)ip->i_ino, (long long)bn);
+				free_page(dirent_buf);
+				DT_PUTPAGE(mp);
+				return -EIO;
+			}
+
 			d = (struct ldtentry *) & p->slot[stbl[i]];
 
 			if (((long) jfs_dirent + d->namlen + 1) >
@@ -3084,6 +3094,13 @@
 
 		/* get the leftmost entry */
 		stbl = DT_GETSTBL(p);
+
+		if (stbl[0] < 0 || stbl[0] > 127) {
+			DT_PUTPAGE(mp);
+			jfs_error(ip->i_sb, "stbl[0] out of bound\n");
+			return -EIO;
+		}
+
 		xd = (pxd_t *) & p->slot[stbl[0]];
 
 		/* get the child page block address */
--- linux-qcom-6.8.0.orig/fs/jfs/jfs_imap.c
+++ linux-qcom-6.8.0/fs/jfs/jfs_imap.c
@@ -290,7 +290,7 @@
 int diRead(struct inode *ip)
 {
 	struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb);
-	int iagno, ino, extno, rc;
+	int iagno, ino, extno, rc, agno;
 	struct inode *ipimap;
 	struct dinode *dp;
 	struct iag *iagp;
@@ -339,8 +339,11 @@
 
 	/* get the ag for the iag */
 	agstart = le64_to_cpu(iagp->agstart);
+	agno = BLKTOAG(agstart, JFS_SBI(ip->i_sb));
 
 	release_metapage(mp);
+	if (agno >= MAXAG || agno < 0)
+		return -EIO;
 
 	rel_inode = (ino & (INOSPERPAGE - 1));
 	pageno = blkno >> sbi->l2nbperpage;
@@ -1357,7 +1360,7 @@
 	/* get the ag number of this iag */
 	agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
 	dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
-	if (agno < 0 || agno > dn_numag)
+	if (agno < 0 || agno > dn_numag || agno >= MAXAG)
 		return -EIO;
 
 	if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
--- linux-qcom-6.8.0.orig/fs/jfs/jfs_incore.h
+++ linux-qcom-6.8.0/fs/jfs/jfs_incore.h
@@ -92,7 +92,7 @@
 		} link;
 	} u;
 #ifdef CONFIG_QUOTA
-	struct dquot *i_dquot[MAXQUOTAS];
+	struct dquot __rcu *i_dquot[MAXQUOTAS];
 #endif
 	u32 dev;	/* will die when we get wide dev_t */
 	struct inode	vfs_inode;
--- linux-qcom-6.8.0.orig/fs/jfs/super.c
+++ linux-qcom-6.8.0/fs/jfs/super.c
@@ -824,7 +824,7 @@
 	return len - towrite;
 }
 
-static struct dquot **jfs_get_dquots(struct inode *inode)
+static struct dquot __rcu **jfs_get_dquots(struct inode *inode)
 {
 	return JFS_IP(inode)->i_dquot;
 }
--- linux-qcom-6.8.0.orig/fs/jfs/xattr.c
+++ linux-qcom-6.8.0/fs/jfs/xattr.c
@@ -434,6 +434,8 @@
 	int rc;
 	int quota_allocation = 0;
 
+	memset(&ea_buf->new_ea, 0, sizeof(ea_buf->new_ea));
+
 	/* When fsck.jfs clears a bad ea, it doesn't clear the size */
 	if (ji->ea.flag == 0)
 		ea_size = 0;
@@ -557,9 +559,11 @@
 
       size_check:
 	if (EALIST_SIZE(ea_buf->xattr) != ea_size) {
+		int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr));
+
 		printk(KERN_ERR "ea_get: invalid extended attribute\n");
 		print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1,
-				     ea_buf->xattr, ea_size, 1);
+				     ea_buf->xattr, size, 1);
 		ea_release(inode, ea_buf);
 		rc = -EIO;
 		goto clean_up;
@@ -795,7 +799,7 @@
 		       size_t buf_size)
 {
 	struct jfs_ea_list *ealist;
-	struct jfs_ea *ea;
+	struct jfs_ea *ea, *ealist_end;
 	struct ea_buffer ea_buf;
 	int xattr_size;
 	ssize_t size;
@@ -815,9 +819,16 @@
 		goto not_found;
 
 	ealist = (struct jfs_ea_list *) ea_buf.xattr;
+	ealist_end = END_EALIST(ealist);
 
 	/* Find the named attribute */
-	for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea))
+	for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) {
+		if (unlikely(ea + 1 > ealist_end) ||
+		    unlikely(NEXT_EA(ea) > ealist_end)) {
+			size = -EUCLEAN;
+			goto release;
+		}
+
 		if ((namelen == ea->namelen) &&
 		    memcmp(name, ea->name, namelen) == 0) {
 			/* Found it */
@@ -832,6 +843,7 @@
 			memcpy(data, value, size);
 			goto release;
 		}
+	}
       not_found:
 	size = -ENODATA;
       release:
@@ -859,7 +871,7 @@
 	ssize_t size = 0;
 	int xattr_size;
 	struct jfs_ea_list *ealist;
-	struct jfs_ea *ea;
+	struct jfs_ea *ea, *ealist_end;
 	struct ea_buffer ea_buf;
 
 	down_read(&JFS_IP(inode)->xattr_sem);
@@ -874,9 +886,16 @@
 		goto release;
 
 	ealist = (struct jfs_ea_list *) ea_buf.xattr;
+	ealist_end = END_EALIST(ealist);
 
 	/* compute required size of list */
-	for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) {
+	for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) {
+		if (unlikely(ea + 1 > ealist_end) ||
+		    unlikely(NEXT_EA(ea) > ealist_end)) {
+			size = -EUCLEAN;
+			goto release;
+		}
+
 		if (can_list(ea))
 			size += name_size(ea) + 1;
 	}
--- linux-qcom-6.8.0.orig/fs/kernfs/dir.c
+++ linux-qcom-6.8.0/fs/kernfs/dir.c
@@ -529,6 +529,20 @@
 }
 EXPORT_SYMBOL_GPL(kernfs_get);
 
+static void kernfs_free_rcu(struct rcu_head *rcu)
+{
+	struct kernfs_node *kn = container_of(rcu, struct kernfs_node, rcu);
+
+	kfree_const(kn->name);
+
+	if (kn->iattr) {
+		simple_xattrs_free(&kn->iattr->xattrs, NULL);
+		kmem_cache_free(kernfs_iattrs_cache, kn->iattr);
+	}
+
+	kmem_cache_free(kernfs_node_cache, kn);
+}
+
 /**
  * kernfs_put - put a reference count on a kernfs_node
  * @kn: the target kernfs_node
@@ -557,16 +571,11 @@
 	if (kernfs_type(kn) == KERNFS_LINK)
 		kernfs_put(kn->symlink.target_kn);
 
-	kfree_const(kn->name);
-
-	if (kn->iattr) {
-		simple_xattrs_free(&kn->iattr->xattrs, NULL);
-		kmem_cache_free(kernfs_iattrs_cache, kn->iattr);
-	}
 	spin_lock(&kernfs_idr_lock);
 	idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
 	spin_unlock(&kernfs_idr_lock);
-	kmem_cache_free(kernfs_node_cache, kn);
+
+	call_rcu(&kn->rcu, kernfs_free_rcu);
 
 	kn = parent;
 	if (kn) {
@@ -575,7 +584,7 @@
 	} else {
 		/* just released the root kn, free @root too */
 		idr_destroy(&root->ino_idr);
-		kfree(root);
+		kfree_rcu(root, rcu);
 	}
 }
 EXPORT_SYMBOL_GPL(kernfs_put);
@@ -715,7 +724,7 @@
 	ino_t ino = kernfs_id_ino(id);
 	u32 gen = kernfs_id_gen(id);
 
-	spin_lock(&kernfs_idr_lock);
+	rcu_read_lock();
 
 	kn = idr_find(&root->ino_idr, (u32)ino);
 	if (!kn)
@@ -739,10 +748,10 @@
 	if (unlikely(!__kernfs_active(kn) || !atomic_inc_not_zero(&kn->count)))
 		goto err_unlock;
 
-	spin_unlock(&kernfs_idr_lock);
+	rcu_read_unlock();
 	return kn;
 err_unlock:
-	spin_unlock(&kernfs_idr_lock);
+	rcu_read_unlock();
 	return NULL;
 }
 
--- linux-qcom-6.8.0.orig/fs/kernfs/file.c
+++ linux-qcom-6.8.0/fs/kernfs/file.c
@@ -483,9 +483,11 @@
 		goto out_put;
 
 	rc = 0;
-	of->mmapped = true;
-	of_on(of)->nr_mmapped++;
-	of->vm_ops = vma->vm_ops;
+	if (!of->mmapped) {
+		of->mmapped = true;
+		of_on(of)->nr_mmapped++;
+		of->vm_ops = vma->vm_ops;
+	}
 	vma->vm_ops = &kernfs_vm_ops;
 out_put:
 	kernfs_put_active(of->kn);
@@ -634,11 +636,18 @@
 	 * each file a separate locking class.  Let's differentiate on
 	 * whether the file has mmap or not for now.
 	 *
-	 * Both paths of the branch look the same.  They're supposed to
+	 * For similar reasons, writable and readonly files are given different
+	 * lockdep key, because the writable file /sys/power/resume may call vfs
+	 * lookup helpers for arbitrary paths and readonly files can be read by
+	 * overlayfs from vfs helpers when sysfs is a lower layer of overalyfs.
+	 *
+	 * All three cases look the same.  They're supposed to
 	 * look that way and give @of->mutex different static lockdep keys.
 	 */
 	if (has_mmap)
 		mutex_init(&of->mutex);
+	else if (file->f_mode & FMODE_WRITE)
+		mutex_init(&of->mutex);
 	else
 		mutex_init(&of->mutex);
 
--- linux-qcom-6.8.0.orig/fs/kernfs/kernfs-internal.h
+++ linux-qcom-6.8.0/fs/kernfs/kernfs-internal.h
@@ -49,6 +49,8 @@
 	struct rw_semaphore	kernfs_rwsem;
 	struct rw_semaphore	kernfs_iattr_rwsem;
 	struct rw_semaphore	kernfs_supers_rwsem;
+
+	struct rcu_head		rcu;
 };
 
 /* +1 to avoid triggering overflow warning when negating it */
--- linux-qcom-6.8.0.orig/fs/libfs.c
+++ linux-qcom-6.8.0/fs/libfs.c
@@ -240,17 +240,29 @@
 };
 EXPORT_SYMBOL(simple_dir_inode_operations);
 
-static void offset_set(struct dentry *dentry, u32 offset)
+/* simple_offset_add() never assigns these to a dentry */
+enum {
+	DIR_OFFSET_FIRST	= 2,		/* Find first real entry */
+	DIR_OFFSET_EOD		= S32_MAX,
+};
+
+/* simple_offset_add() allocation range */
+enum {
+	DIR_OFFSET_MIN		= DIR_OFFSET_FIRST + 1,
+	DIR_OFFSET_MAX		= DIR_OFFSET_EOD - 1,
+};
+
+static void offset_set(struct dentry *dentry, long offset)
 {
-	dentry->d_fsdata = (void *)((uintptr_t)(offset));
+	dentry->d_fsdata = (void *)offset;
 }
 
-static u32 dentry2offset(struct dentry *dentry)
+static long dentry2offset(struct dentry *dentry)
 {
-	return (u32)((uintptr_t)(dentry->d_fsdata));
+	return (long)dentry->d_fsdata;
 }
 
-static struct lock_class_key simple_offset_xa_lock;
+static struct lock_class_key simple_offset_lock_class;
 
 /**
  * simple_offset_init - initialize an offset_ctx
@@ -259,11 +271,9 @@
  */
 void simple_offset_init(struct offset_ctx *octx)
 {
-	xa_init_flags(&octx->xa, XA_FLAGS_ALLOC1);
-	lockdep_set_class(&octx->xa.xa_lock, &simple_offset_xa_lock);
-
-	/* 0 is '.', 1 is '..', so always start with offset 2 */
-	octx->next_offset = 2;
+	mt_init_flags(&octx->mt, MT_FLAGS_ALLOC_RANGE);
+	lockdep_set_class(&octx->mt.ma_lock, &simple_offset_lock_class);
+	octx->next_offset = DIR_OFFSET_MIN;
 }
 
 /**
@@ -271,27 +281,39 @@
  * @octx: directory offset ctx to be updated
  * @dentry: new dentry being added
  *
- * Returns zero on success. @so_ctx and the dentry offset are updated.
+ * Returns zero on success. @octx and the dentry's offset are updated.
  * Otherwise, a negative errno value is returned.
  */
 int simple_offset_add(struct offset_ctx *octx, struct dentry *dentry)
 {
-	static const struct xa_limit limit = XA_LIMIT(2, U32_MAX);
-	u32 offset;
+	unsigned long offset;
 	int ret;
 
 	if (dentry2offset(dentry) != 0)
 		return -EBUSY;
 
-	ret = xa_alloc_cyclic(&octx->xa, &offset, dentry, limit,
-			      &octx->next_offset, GFP_KERNEL);
-	if (ret < 0)
-		return ret;
+	ret = mtree_alloc_cyclic(&octx->mt, &offset, dentry, DIR_OFFSET_MIN,
+				 DIR_OFFSET_MAX, &octx->next_offset,
+				 GFP_KERNEL);
+	if (unlikely(ret < 0))
+		return ret == -EBUSY ? -ENOSPC : ret;
 
 	offset_set(dentry, offset);
 	return 0;
 }
 
+static int simple_offset_replace(struct offset_ctx *octx, struct dentry *dentry,
+				 long offset)
+{
+	int ret;
+
+	ret = mtree_store(&octx->mt, offset, dentry, GFP_KERNEL);
+	if (ret)
+		return ret;
+	offset_set(dentry, offset);
+	return 0;
+}
+
 /**
  * simple_offset_remove - Remove an entry to a directory's offset map
  * @octx: directory offset ctx to be updated
@@ -300,23 +322,56 @@
  */
 void simple_offset_remove(struct offset_ctx *octx, struct dentry *dentry)
 {
-	u32 offset;
+	long offset;
 
 	offset = dentry2offset(dentry);
 	if (offset == 0)
 		return;
 
-	xa_erase(&octx->xa, offset);
+	mtree_erase(&octx->mt, offset);
 	offset_set(dentry, 0);
 }
 
 /**
+ * simple_offset_rename - handle directory offsets for rename
+ * @old_dir: parent directory of source entry
+ * @old_dentry: dentry of source entry
+ * @new_dir: parent_directory of destination entry
+ * @new_dentry: dentry of destination
+ *
+ * Caller provides appropriate serialization.
+ *
+ * User space expects the directory offset value of the replaced
+ * (new) directory entry to be unchanged after a rename.
+ *
+ * Returns zero on success, a negative errno value on failure.
+ */
+int simple_offset_rename(struct inode *old_dir, struct dentry *old_dentry,
+			 struct inode *new_dir, struct dentry *new_dentry)
+{
+	struct offset_ctx *old_ctx = old_dir->i_op->get_offset_ctx(old_dir);
+	struct offset_ctx *new_ctx = new_dir->i_op->get_offset_ctx(new_dir);
+	long new_offset = dentry2offset(new_dentry);
+
+	simple_offset_remove(old_ctx, old_dentry);
+
+	if (new_offset) {
+		offset_set(new_dentry, 0);
+		return simple_offset_replace(new_ctx, old_dentry, new_offset);
+	}
+	return simple_offset_add(new_ctx, old_dentry);
+}
+
+/**
  * simple_offset_rename_exchange - exchange rename with directory offsets
  * @old_dir: parent of dentry being moved
  * @old_dentry: dentry being moved
  * @new_dir: destination parent
  * @new_dentry: destination dentry
  *
+ * This API preserves the directory offset values. Caller provides
+ * appropriate serialization.
+ *
  * Returns zero on success. Otherwise a negative errno is returned and the
  * rename is rolled back.
  */
@@ -327,18 +382,18 @@
 {
 	struct offset_ctx *old_ctx = old_dir->i_op->get_offset_ctx(old_dir);
 	struct offset_ctx *new_ctx = new_dir->i_op->get_offset_ctx(new_dir);
-	u32 old_index = dentry2offset(old_dentry);
-	u32 new_index = dentry2offset(new_dentry);
+	long old_index = dentry2offset(old_dentry);
+	long new_index = dentry2offset(new_dentry);
 	int ret;
 
 	simple_offset_remove(old_ctx, old_dentry);
 	simple_offset_remove(new_ctx, new_dentry);
 
-	ret = simple_offset_add(new_ctx, old_dentry);
+	ret = simple_offset_replace(new_ctx, old_dentry, new_index);
 	if (ret)
 		goto out_restore;
 
-	ret = simple_offset_add(old_ctx, new_dentry);
+	ret = simple_offset_replace(old_ctx, new_dentry, old_index);
 	if (ret) {
 		simple_offset_remove(new_ctx, old_dentry);
 		goto out_restore;
@@ -353,10 +408,8 @@
 	return 0;
 
 out_restore:
-	offset_set(old_dentry, old_index);
-	xa_store(&old_ctx->xa, old_index, old_dentry, GFP_KERNEL);
-	offset_set(new_dentry, new_index);
-	xa_store(&new_ctx->xa, new_index, new_dentry, GFP_KERNEL);
+	(void)simple_offset_replace(old_ctx, old_dentry, old_index);
+	(void)simple_offset_replace(new_ctx, new_dentry, new_index);
 	return ret;
 }
 
@@ -369,7 +422,7 @@
  */
 void simple_offset_destroy(struct offset_ctx *octx)
 {
-	xa_destroy(&octx->xa);
+	mtree_destroy(&octx->mt);
 }
 
 /**
@@ -397,57 +450,89 @@
 		return -EINVAL;
 	}
 
-	/* In this case, ->private_data is protected by f_pos_lock */
-	file->private_data = NULL;
-	return vfs_setpos(file, offset, U32_MAX);
+	return vfs_setpos(file, offset, LONG_MAX);
 }
 
-static struct dentry *offset_find_next(struct xa_state *xas)
+static struct dentry *find_positive_dentry(struct dentry *parent,
+					   struct dentry *dentry,
+					   bool next)
+{
+	struct dentry *found = NULL;
+
+	spin_lock(&parent->d_lock);
+	if (next)
+		dentry = d_next_sibling(dentry);
+	else if (!dentry)
+		dentry = d_first_child(parent);
+	hlist_for_each_entry_from(dentry, d_sib) {
+		if (!simple_positive(dentry))
+			continue;
+		spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+		if (simple_positive(dentry))
+			found = dget_dlock(dentry);
+		spin_unlock(&dentry->d_lock);
+		if (likely(found))
+			break;
+	}
+	spin_unlock(&parent->d_lock);
+	return found;
+}
+
+static noinline_for_stack struct dentry *
+offset_dir_lookup(struct dentry *parent, loff_t offset)
 {
+	struct inode *inode = d_inode(parent);
+	struct offset_ctx *octx = inode->i_op->get_offset_ctx(inode);
 	struct dentry *child, *found = NULL;
 
-	rcu_read_lock();
-	child = xas_next_entry(xas, U32_MAX);
-	if (!child)
-		goto out;
-	spin_lock(&child->d_lock);
-	if (simple_positive(child))
-		found = dget_dlock(child);
-	spin_unlock(&child->d_lock);
-out:
-	rcu_read_unlock();
+	MA_STATE(mas, &octx->mt, offset, offset);
+
+	if (offset == DIR_OFFSET_FIRST)
+		found = find_positive_dentry(parent, NULL, false);
+	else {
+		rcu_read_lock();
+		child = mas_find(&mas, DIR_OFFSET_MAX);
+		found = find_positive_dentry(parent, child, false);
+		rcu_read_unlock();
+	}
 	return found;
 }
 
 static bool offset_dir_emit(struct dir_context *ctx, struct dentry *dentry)
 {
-	u32 offset = dentry2offset(dentry);
 	struct inode *inode = d_inode(dentry);
 
-	return ctx->actor(ctx, dentry->d_name.name, dentry->d_name.len, offset,
-			  inode->i_ino, fs_umode_to_dtype(inode->i_mode));
+	return dir_emit(ctx, dentry->d_name.name, dentry->d_name.len,
+			inode->i_ino, fs_umode_to_dtype(inode->i_mode));
 }
 
-static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx)
+static void offset_iterate_dir(struct file *file, struct dir_context *ctx)
 {
-	struct offset_ctx *so_ctx = inode->i_op->get_offset_ctx(inode);
-	XA_STATE(xas, &so_ctx->xa, ctx->pos);
+	struct dentry *dir = file->f_path.dentry;
 	struct dentry *dentry;
 
+	dentry = offset_dir_lookup(dir, ctx->pos);
+	if (!dentry)
+		goto out_eod;
 	while (true) {
-		dentry = offset_find_next(&xas);
-		if (!dentry)
-			return ERR_PTR(-ENOENT);
+		struct dentry *next;
 
-		if (!offset_dir_emit(ctx, dentry)) {
-			dput(dentry);
+		ctx->pos = dentry2offset(dentry);
+		if (!offset_dir_emit(ctx, dentry))
 			break;
-		}
 
+		next = find_positive_dentry(dir, dentry, true);
 		dput(dentry);
-		ctx->pos = xas.xa_index + 1;
+
+		if (!next)
+			goto out_eod;
+		dentry = next;
 	}
-	return NULL;
+	dput(dentry);
+	return;
+
+out_eod:
+	ctx->pos = DIR_OFFSET_EOD;
 }
 
 /**
@@ -467,6 +552,8 @@
  *
  * On return, @ctx->pos contains an offset that will read the next entry
  * in this directory when offset_readdir() is called again with @ctx.
+ * Caller places this value in the d_off field of the last entry in the
+ * user's buffer.
  *
  * Return values:
  *   %0 - Complete
@@ -479,13 +566,8 @@
 
 	if (!dir_emit_dots(file, ctx))
 		return 0;
-
-	/* In this case, ->private_data is protected by f_pos_lock */
-	if (ctx->pos == 2)
-		file->private_data = NULL;
-	else if (file->private_data == ERR_PTR(-ENOENT))
-		return 0;
-	file->private_data = offset_iterate_dir(d_inode(dir), ctx);
+	if (ctx->pos != DIR_OFFSET_EOD)
+		offset_iterate_dir(file, ctx);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/fs/lockd/svc.c
+++ linux-qcom-6.8.0/fs/lockd/svc.c
@@ -710,8 +710,6 @@
 #endif
 };
 
-static struct svc_stat		nlmsvc_stats;
-
 #define NLM_NRVERS	ARRAY_SIZE(nlmsvc_version)
 static struct svc_program	nlmsvc_program = {
 	.pg_prog		= NLM_PROGRAM,		/* program number */
@@ -719,7 +717,6 @@
 	.pg_vers		= nlmsvc_version,	/* version table */
 	.pg_name		= "lockd",		/* service name */
 	.pg_class		= "nfsd",		/* share authentication with nfsd */
-	.pg_stats		= &nlmsvc_stats,	/* stats table */
 	.pg_authenticate	= &lockd_authenticate,	/* export authentication */
 	.pg_init_request	= svc_generic_init_request,
 	.pg_rpcbind_set		= svc_generic_rpcbind_set,
--- linux-qcom-6.8.0.orig/fs/locks.c
+++ linux-qcom-6.8.0/fs/locks.c
@@ -1313,9 +1313,9 @@
 		locks_wake_up_blocks(left);
 	}
  out:
+	trace_posix_lock_inode(inode, request, error);
 	spin_unlock(&ctx->flc_lock);
 	percpu_up_read(&file_rwsem);
-	trace_posix_lock_inode(inode, request, error);
 	/*
 	 * Free any unused locks.
 	 */
@@ -2382,8 +2382,9 @@
 	error = do_lock_file_wait(filp, cmd, file_lock);
 
 	/*
-	 * Attempt to detect a close/fcntl race and recover by releasing the
-	 * lock that was just acquired. There is no need to do that when we're
+	 * Detect close/fcntl races and recover by zapping all POSIX locks
+	 * associated with this file and our files_struct, just like on
+	 * filp_flush(). There is no need to do that when we're
 	 * unlocking though, or for OFD locks.
 	 */
 	if (!error && file_lock->fl_type != F_UNLCK &&
@@ -2398,9 +2399,7 @@
 		f = files_lookup_fd_locked(files, fd);
 		spin_unlock(&files->file_lock);
 		if (f != filp) {
-			file_lock->fl_type = F_UNLCK;
-			error = do_lock_file_wait(filp, cmd, file_lock);
-			WARN_ON_ONCE(error);
+			locks_remove_posix(filp, files);
 			error = -EBADF;
 		}
 	}
@@ -2505,8 +2504,9 @@
 	error = do_lock_file_wait(filp, cmd, file_lock);
 
 	/*
-	 * Attempt to detect a close/fcntl race and recover by releasing the
-	 * lock that was just acquired. There is no need to do that when we're
+	 * Detect close/fcntl races and recover by zapping all POSIX locks
+	 * associated with this file and our files_struct, just like on
+	 * filp_flush(). There is no need to do that when we're
 	 * unlocking though, or for OFD locks.
 	 */
 	if (!error && file_lock->fl_type != F_UNLCK &&
@@ -2521,9 +2521,7 @@
 		f = files_lookup_fd_locked(files, fd);
 		spin_unlock(&files->file_lock);
 		if (f != filp) {
-			file_lock->fl_type = F_UNLCK;
-			error = do_lock_file_wait(filp, cmd, file_lock);
-			WARN_ON_ONCE(error);
+			locks_remove_posix(filp, files);
 			error = -EBADF;
 		}
 	}
--- linux-qcom-6.8.0.orig/fs/minix/namei.c
+++ linux-qcom-6.8.0/fs/minix/namei.c
@@ -213,8 +213,7 @@
 		if (!new_de)
 			goto out_dir;
 		err = minix_set_link(new_de, new_page, old_inode);
-		kunmap(new_page);
-		put_page(new_page);
+		unmap_and_put_page(new_page, new_de);
 		if (err)
 			goto out_dir;
 		inode_set_ctime_current(new_inode);
--- linux-qcom-6.8.0.orig/fs/mount.h
+++ linux-qcom-6.8.0/fs/mount.h
@@ -36,6 +36,7 @@
 	struct dentry *mnt_mountpoint;
 	struct vfsmount mnt;
 	union {
+		struct rb_node mnt_node; /* node in the ns->mounts rbtree */
 		struct rcu_head mnt_rcu;
 		struct llist_node mnt_llist;
 	};
@@ -49,10 +50,7 @@
 	struct list_head mnt_child;	/* and going through their mnt_child */
 	struct list_head mnt_instance;	/* mount instance on sb->s_mounts */
 	const char *mnt_devname;	/* Name of device e.g. /dev/dsk/hda1 */
-	union {
-		struct rb_node mnt_node;	/* Under ns->mounts */
-		struct list_head mnt_list;
-	};
+	struct list_head mnt_list;
 	struct list_head mnt_expire;	/* link in fs-specific expiry list */
 	struct list_head mnt_share;	/* circular list of shared mounts */
 	struct list_head mnt_slave_list;/* list of slave mounts */
@@ -143,11 +141,16 @@
 	return ns->seq == 0;
 }
 
+static inline bool mnt_ns_attached(const struct mount *mnt)
+{
+	return !RB_EMPTY_NODE(&mnt->mnt_node);
+}
+
 static inline void move_from_ns(struct mount *mnt, struct list_head *dt_list)
 {
-	WARN_ON(!(mnt->mnt.mnt_flags & MNT_ONRB));
-	mnt->mnt.mnt_flags &= ~MNT_ONRB;
+	WARN_ON(!mnt_ns_attached(mnt));
 	rb_erase(&mnt->mnt_node, &mnt->mnt_ns->mounts);
+	RB_CLEAR_NODE(&mnt->mnt_node);
 	list_add_tail(&mnt->mnt_list, dt_list);
 }
 
--- linux-qcom-6.8.0.orig/fs/namei.c
+++ linux-qcom-6.8.0/fs/namei.c
@@ -1028,8 +1028,8 @@
 		path_put(&last->link);
 }
 
-static int sysctl_protected_symlinks __read_mostly;
-static int sysctl_protected_hardlinks __read_mostly;
+static int sysctl_protected_symlinks __read_mostly = 1;
+static int sysctl_protected_hardlinks __read_mostly = 1;
 static int sysctl_protected_fifos __read_mostly;
 static int sysctl_protected_regular __read_mostly;
 
@@ -2680,10 +2680,8 @@
 	if (!len)
 		return -EACCES;
 
-	if (unlikely(name[0] == '.')) {
-		if (len < 2 || (len == 2 && name[1] == '.'))
-			return -EACCES;
-	}
+	if (is_dot_dotdot(name, len))
+		return -EACCES;
 
 	while (len--) {
 		unsigned int c = *(const unsigned char *)name++;
--- linux-qcom-6.8.0.orig/fs/namespace.c
+++ linux-qcom-6.8.0/fs/namespace.c
@@ -238,6 +238,7 @@
 		INIT_HLIST_NODE(&mnt->mnt_mp_list);
 		INIT_LIST_HEAD(&mnt->mnt_umounting);
 		INIT_HLIST_HEAD(&mnt->mnt_stuck_children);
+		RB_CLEAR_NODE(&mnt->mnt_node);
 		mnt->mnt.mnt_idmap = &nop_mnt_idmap;
 	}
 	return mnt;
@@ -1018,7 +1019,7 @@
 	struct rb_node **link = &ns->mounts.rb_node;
 	struct rb_node *parent = NULL;
 
-	WARN_ON(mnt->mnt.mnt_flags & MNT_ONRB);
+	WARN_ON(mnt_ns_attached(mnt));
 	mnt->mnt_ns = ns;
 	while (*link) {
 		parent = *link;
@@ -1029,7 +1030,6 @@
 	}
 	rb_link_node(&mnt->mnt_node, parent, link);
 	rb_insert_color(&mnt->mnt_node, &ns->mounts);
-	mnt->mnt.mnt_flags |= MNT_ONRB;
 }
 
 /*
@@ -1199,7 +1199,7 @@
 	}
 
 	mnt->mnt.mnt_flags = old->mnt.mnt_flags;
-	mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL|MNT_ONRB);
+	mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL);
 
 	atomic_inc(&sb->s_active);
 	mnt->mnt.mnt_idmap = mnt_idmap_get(mnt_idmap(&old->mnt));
@@ -1633,7 +1633,7 @@
 	/* Gather the mounts to umount */
 	for (p = mnt; p; p = next_mnt(p, mnt)) {
 		p->mnt.mnt_flags |= MNT_UMOUNT;
-		if (p->mnt.mnt_flags & MNT_ONRB)
+		if (mnt_ns_attached(p))
 			move_from_ns(p, &tmp_list);
 		else
 			list_move(&p->mnt_list, &tmp_list);
@@ -1782,16 +1782,14 @@
 
 	event++;
 	if (flags & MNT_DETACH) {
-		if (mnt->mnt.mnt_flags & MNT_ONRB ||
-		    !list_empty(&mnt->mnt_list))
+		if (mnt_ns_attached(mnt) || !list_empty(&mnt->mnt_list))
 			umount_tree(mnt, UMOUNT_PROPAGATE);
 		retval = 0;
 	} else {
 		shrink_submounts(mnt);
 		retval = -EBUSY;
 		if (!propagate_mount_busy(mnt, 2)) {
-			if (mnt->mnt.mnt_flags & MNT_ONRB ||
-			    !list_empty(&mnt->mnt_list))
+			if (mnt_ns_attached(mnt) || !list_empty(&mnt->mnt_list))
 				umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
 			retval = 0;
 		}
@@ -2801,8 +2799,15 @@
 	if (!__mnt_is_readonly(mnt) &&
 	   (!(sb->s_iflags & SB_I_TS_EXPIRY_WARNED)) &&
 	   (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
-		char *buf = (char *)__get_free_page(GFP_KERNEL);
-		char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
+		char *buf, *mntpath;
+
+		buf = (char *)__get_free_page(GFP_KERNEL);
+		if (buf)
+			mntpath = d_path(mountpoint, buf, PAGE_SIZE);
+		else
+			mntpath = ERR_PTR(-ENOMEM);
+		if (IS_ERR(mntpath))
+			mntpath = "(unknown)";
 
 		pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n",
 			sb->s_type->name,
@@ -2810,8 +2815,9 @@
 			mntpath, &sb->s_time_max,
 			(unsigned long long)sb->s_time_max);
 
-		free_page((unsigned long)buf);
 		sb->s_iflags |= SB_I_TS_EXPIRY_WARNED;
+		if (buf)
+			free_page((unsigned long)buf);
 	}
 }
 
@@ -4906,6 +4912,7 @@
 static int do_statmount(struct kstatmount *s)
 {
 	struct mount *m = real_mount(s->mnt);
+	struct mnt_namespace *ns = m->mnt_ns;
 	int err;
 
 	/*
@@ -4913,7 +4920,7 @@
 	 * mounts to show users.
 	 */
 	if (!is_path_reachable(m, m->mnt.mnt_root, &s->root) &&
-	    !ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN))
+	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 
 	err = security_sb_statfs(s->mnt->mnt_root);
@@ -5047,32 +5054,50 @@
 	return node_to_mount(rb_next(&curr->mnt_node));
 }
 
-static ssize_t do_listmount(struct mount *first, struct path *orig,
-			    u64 mnt_parent_id, u64 __user *mnt_ids,
-			    size_t nr_mnt_ids, const struct path *root)
+static ssize_t do_listmount(u64 mnt_parent_id, u64 last_mnt_id, u64 *mnt_ids,
+			    size_t nr_mnt_ids)
 {
-	struct mount *r;
+	struct path root __free(path_put) = {};
+	struct mnt_namespace *ns = current->nsproxy->mnt_ns;
+	struct path orig;
+	struct mount *r, *first;
 	ssize_t ret;
 
+	rwsem_assert_held(&namespace_sem);
+
+	get_fs_root(current->fs, &root);
+	if (mnt_parent_id == LSMT_ROOT) {
+		orig = root;
+	} else {
+		orig.mnt = lookup_mnt_in_ns(mnt_parent_id, ns);
+		if (!orig.mnt)
+			return -ENOENT;
+		orig.dentry = orig.mnt->mnt_root;
+	}
+
 	/*
 	 * Don't trigger audit denials. We just want to determine what
 	 * mounts to show users.
 	 */
-	if (!is_path_reachable(real_mount(orig->mnt), orig->dentry, root) &&
-	    !ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN))
+	if (!is_path_reachable(real_mount(orig.mnt), orig.dentry, &root) &&
+	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 
-	ret = security_sb_statfs(orig->dentry);
+	ret = security_sb_statfs(orig.dentry);
 	if (ret)
 		return ret;
 
+	if (!last_mnt_id)
+		first = node_to_mount(rb_first(&ns->mounts));
+	else
+		first = mnt_find_id_at(ns, last_mnt_id + 1);
+
 	for (ret = 0, r = first; r && nr_mnt_ids; r = listmnt_next(r)) {
 		if (r->mnt_id_unique == mnt_parent_id)
 			continue;
-		if (!is_path_reachable(r, r->mnt.mnt_root, orig))
+		if (!is_path_reachable(r, r->mnt.mnt_root, &orig))
 			continue;
-		if (put_user(r->mnt_id_unique, mnt_ids))
-			return -EFAULT;
+		*mnt_ids = r->mnt_id_unique;
 		mnt_ids++;
 		nr_mnt_ids--;
 		ret++;
@@ -5080,22 +5105,24 @@
 	return ret;
 }
 
-SYSCALL_DEFINE4(listmount, const struct mnt_id_req __user *, req, u64 __user *,
-		mnt_ids, size_t, nr_mnt_ids, unsigned int, flags)
+SYSCALL_DEFINE4(listmount, const struct mnt_id_req __user *, req,
+		u64 __user *, mnt_ids, size_t, nr_mnt_ids, unsigned int, flags)
 {
-	struct mnt_namespace *ns = current->nsproxy->mnt_ns;
+	u64 *kmnt_ids __free(kvfree) = NULL;
+	const size_t maxcount = 1000000;
 	struct mnt_id_req kreq;
-	struct mount *first;
-	struct path root, orig;
-	u64 mnt_parent_id, last_mnt_id;
-	const size_t maxcount = (size_t)-1 >> 3;
 	ssize_t ret;
 
 	if (flags)
 		return -EINVAL;
 
+	/*
+	 * If the mount namespace really has more than 1 million mounts the
+	 * caller must iterate over the mount namespace (and reconsider their
+	 * system design...).
+	 */
 	if (unlikely(nr_mnt_ids > maxcount))
-		return -EFAULT;
+		return -EOVERFLOW;
 
 	if (!access_ok(mnt_ids, nr_mnt_ids * sizeof(*mnt_ids)))
 		return -EFAULT;
@@ -5103,33 +5130,23 @@
 	ret = copy_mnt_id_req(req, &kreq);
 	if (ret)
 		return ret;
-	mnt_parent_id = kreq.mnt_id;
-	last_mnt_id = kreq.param;
 
-	down_read(&namespace_sem);
-	get_fs_root(current->fs, &root);
-	if (mnt_parent_id == LSMT_ROOT) {
-		orig = root;
-	} else {
-		ret = -ENOENT;
-		orig.mnt = lookup_mnt_in_ns(mnt_parent_id, ns);
-		if (!orig.mnt)
-			goto err;
-		orig.dentry = orig.mnt->mnt_root;
-	}
-	if (!last_mnt_id)
-		first = node_to_mount(rb_first(&ns->mounts));
-	else
-		first = mnt_find_id_at(ns, last_mnt_id + 1);
+	kmnt_ids = kvmalloc_array(nr_mnt_ids, sizeof(*kmnt_ids),
+				  GFP_KERNEL_ACCOUNT);
+	if (!kmnt_ids)
+		return -ENOMEM;
+
+	scoped_guard(rwsem_read, &namespace_sem)
+		ret = do_listmount(kreq.mnt_id, kreq.param, kmnt_ids, nr_mnt_ids);
+	if (ret <= 0)
+		return ret;
+
+	if (copy_to_user(mnt_ids, kmnt_ids, ret * sizeof(*mnt_ids)))
+		return -EFAULT;
 
-	ret = do_listmount(first, &orig, mnt_parent_id, mnt_ids, nr_mnt_ids, &root);
-err:
-	path_put(&root);
-	up_read(&namespace_sem);
 	return ret;
 }
 
-
 static void __init init_mount_tree(void)
 {
 	struct vfsmount *mnt;
--- linux-qcom-6.8.0.orig/fs/netfs/buffered_write.c
+++ linux-qcom-6.8.0/fs/netfs/buffered_write.c
@@ -163,24 +163,23 @@
 	struct folio *folio;
 	enum netfs_how_to_modify howto;
 	enum netfs_folio_trace trace;
-	unsigned int bdp_flags = (iocb->ki_flags & IOCB_SYNC) ? 0: BDP_ASYNC;
-	ssize_t written = 0, ret;
+	unsigned int bdp_flags = (iocb->ki_flags & IOCB_NOWAIT) ? BDP_ASYNC : 0;
+	ssize_t written = 0, ret, ret2;
 	loff_t i_size, pos = iocb->ki_pos, from, to;
-	size_t max_chunk = PAGE_SIZE << MAX_PAGECACHE_ORDER;
+	size_t max_chunk = mapping_max_folio_size(mapping);
 	bool maybe_trouble = false;
 
 	if (unlikely(test_bit(NETFS_ICTX_WRITETHROUGH, &ctx->flags) ||
 		     iocb->ki_flags & (IOCB_DSYNC | IOCB_SYNC))
 	    ) {
-		if (pos < i_size_read(inode)) {
-			ret = filemap_write_and_wait_range(mapping, pos, pos + iter->count);
-			if (ret < 0) {
-				goto out;
-			}
-		}
-
 		wbc_attach_fdatawrite_inode(&wbc, mapping->host);
 
+		ret = filemap_write_and_wait_range(mapping, pos, pos + iter->count);
+		if (ret < 0) {
+			wbc_detach_inode(&wbc);
+			goto out;
+		}
+
 		wreq = netfs_begin_writethrough(iocb, iter->count);
 		if (IS_ERR(wreq)) {
 			wbc_detach_inode(&wbc);
@@ -395,10 +394,12 @@
 
 out:
 	if (unlikely(wreq)) {
-		ret = netfs_end_writethrough(wreq, iocb);
+		ret2 = netfs_end_writethrough(wreq, iocb);
 		wbc_detach_inode(&wbc);
-		if (ret == -EIOCBQUEUED)
-			return ret;
+		if (ret2 == -EIOCBQUEUED)
+			return ret2;
+		if (ret == 0)
+			ret = ret2;
 	}
 
 	iocb->ki_pos += written;
@@ -506,6 +507,7 @@
 {
 	struct folio *folio = page_folio(vmf->page);
 	struct file *file = vmf->vma->vm_file;
+	struct address_space *mapping = file->f_mapping;
 	struct inode *inode = file_inode(file);
 	vm_fault_t ret = VM_FAULT_RETRY;
 	int err;
@@ -519,6 +521,11 @@
 
 	if (folio_lock_killable(folio) < 0)
 		goto out;
+	if (folio->mapping != mapping) {
+		folio_unlock(folio);
+		ret = VM_FAULT_NOPAGE;
+		goto out;
+	}
 
 	/* Can we see a streaming write here? */
 	if (WARN_ON(!folio_test_uptodate(folio))) {
@@ -528,9 +535,9 @@
 
 	if (netfs_folio_group(folio) != netfs_group) {
 		folio_unlock(folio);
-		err = filemap_fdatawait_range(inode->i_mapping,
-					      folio_pos(folio),
-					      folio_pos(folio) + folio_size(folio));
+		err = filemap_fdatawrite_range(mapping,
+					       folio_pos(folio),
+					       folio_pos(folio) + folio_size(folio));
 		switch (err) {
 		case 0:
 			ret = VM_FAULT_RETRY;
@@ -804,7 +811,7 @@
 				break;
 			}
 
-			if (!folio_try_get_rcu(folio)) {
+			if (!folio_try_get(folio)) {
 				xas_reset(xas);
 				continue;
 			}
@@ -1021,7 +1028,7 @@
 		if (!folio)
 			break;
 
-		if (!folio_try_get_rcu(folio)) {
+		if (!folio_try_get(folio)) {
 			xas_reset(xas);
 			continue;
 		}
--- linux-qcom-6.8.0.orig/fs/netfs/direct_write.c
+++ linux-qcom-6.8.0/fs/netfs/direct_write.c
@@ -62,7 +62,7 @@
 		 * allocate a sufficiently large bvec array and may shorten the
 		 * request.
 		 */
-		if (async || user_backed_iter(iter)) {
+		if (user_backed_iter(iter)) {
 			n = netfs_extract_user_iter(iter, wreq->len, &wreq->iter, 0);
 			if (n < 0) {
 				ret = n;
@@ -73,6 +73,11 @@
 			wreq->direct_bv_unpin = iov_iter_extract_will_pin(iter);
 			wreq->len = iov_iter_count(&wreq->iter);
 		} else {
+			/* If this is a kernel-generated async DIO request,
+			 * assume that any resources the iterator points to
+			 * (eg. a bio_vec array) will persist till the end of
+			 * the op.
+			 */
 			wreq->iter = *iter;
 		}
 
@@ -132,12 +137,14 @@
 ssize_t netfs_unbuffered_write_iter(struct kiocb *iocb, struct iov_iter *from)
 {
 	struct file *file = iocb->ki_filp;
-	struct inode *inode = file->f_mapping->host;
+	struct address_space *mapping = file->f_mapping;
+	struct inode *inode = mapping->host;
 	struct netfs_inode *ictx = netfs_inode(inode);
-	unsigned long long end;
 	ssize_t ret;
+	loff_t pos = iocb->ki_pos;
+	unsigned long long end = pos + iov_iter_count(from) - 1;
 
-	_enter("%llx,%zx,%llx", iocb->ki_pos, iov_iter_count(from), i_size_read(inode));
+	_enter("%llx,%zx,%llx", pos, iov_iter_count(from), i_size_read(inode));
 
 	if (!iov_iter_count(from))
 		return 0;
@@ -157,7 +164,25 @@
 	ret = file_update_time(file);
 	if (ret < 0)
 		goto out;
-	ret = kiocb_invalidate_pages(iocb, iov_iter_count(from));
+	if (iocb->ki_flags & IOCB_NOWAIT) {
+		/* We could block if there are any pages in the range. */
+		ret = -EAGAIN;
+		if (filemap_range_has_page(mapping, pos, end))
+			if (filemap_invalidate_inode(inode, true, pos, end))
+				goto out;
+	} else {
+		ret = filemap_write_and_wait_range(mapping, pos, end);
+		if (ret < 0)
+			goto out;
+	}
+
+	/*
+	 * After a write we want buffered reads to be sure to go to disk to get
+	 * the new data.  We invalidate clean cached page from the region we're
+	 * about to write.  We do this *before* the write so that we can return
+	 * without clobbering -EIOCBQUEUED from ->direct_IO().
+	 */
+	ret = filemap_invalidate_inode(inode, true, pos, end);
 	if (ret < 0)
 		goto out;
 	end = iocb->ki_pos + iov_iter_count(from);
--- linux-qcom-6.8.0.orig/fs/netfs/fscache_cookie.c
+++ linux-qcom-6.8.0/fs/netfs/fscache_cookie.c
@@ -741,6 +741,10 @@
 			spin_lock(&cookie->lock);
 		}
 		if (test_bit(FSCACHE_COOKIE_DO_LRU_DISCARD, &cookie->flags)) {
+			if (atomic_read(&cookie->n_accesses) != 0)
+				/* still being accessed: postpone it */
+				break;
+
 			__fscache_set_cookie_state(cookie,
 						   FSCACHE_COOKIE_STATE_LRU_DISCARDING);
 			wake = true;
--- linux-qcom-6.8.0.orig/fs/netfs/fscache_main.c
+++ linux-qcom-6.8.0/fs/netfs/fscache_main.c
@@ -103,6 +103,7 @@
 
 	kmem_cache_destroy(fscache_cookie_jar);
 	fscache_proc_cleanup();
+	timer_shutdown_sync(&fscache_cookie_lru_timer);
 	destroy_workqueue(fscache_wq);
 	pr_notice("FS-Cache unloaded\n");
 }
--- linux-qcom-6.8.0.orig/fs/netfs/fscache_volume.c
+++ linux-qcom-6.8.0/fs/netfs/fscache_volume.c
@@ -27,6 +27,19 @@
 	return volume;
 }
 
+struct fscache_volume *fscache_try_get_volume(struct fscache_volume *volume,
+					      enum fscache_volume_trace where)
+{
+	int ref;
+
+	if (!__refcount_inc_not_zero(&volume->ref, &ref))
+		return NULL;
+
+	trace_fscache_volume(volume->debug_id, ref + 1, where);
+	return volume;
+}
+EXPORT_SYMBOL(fscache_try_get_volume);
+
 static void fscache_see_volume(struct fscache_volume *volume,
 			       enum fscache_volume_trace where)
 {
@@ -309,8 +322,7 @@
 	}
 	return;
 no_wait:
-	clear_bit_unlock(FSCACHE_VOLUME_CREATING, &volume->flags);
-	wake_up_bit(&volume->flags, FSCACHE_VOLUME_CREATING);
+	clear_and_wake_up_bit(FSCACHE_VOLUME_CREATING, &volume->flags);
 }
 
 /*
@@ -420,6 +432,7 @@
 			fscache_free_volume(volume);
 	}
 }
+EXPORT_SYMBOL(fscache_put_volume);
 
 /*
  * Relinquish a volume representation cookie.
--- linux-qcom-6.8.0.orig/fs/netfs/internal.h
+++ linux-qcom-6.8.0/fs/netfs/internal.h
@@ -326,8 +326,6 @@
 
 struct fscache_volume *fscache_get_volume(struct fscache_volume *volume,
 					  enum fscache_volume_trace where);
-void fscache_put_volume(struct fscache_volume *volume,
-			enum fscache_volume_trace where);
 bool fscache_begin_volume_access(struct fscache_volume *volume,
 				 struct fscache_cookie *cookie,
 				 enum fscache_access_trace why);
--- linux-qcom-6.8.0.orig/fs/netfs/io.c
+++ linux-qcom-6.8.0/fs/netfs/io.c
@@ -312,6 +312,7 @@
 			netfs_reset_subreq_iter(rreq, subreq);
 			netfs_read_from_server(rreq, subreq);
 		} else if (test_bit(NETFS_SREQ_SHORT_IO, &subreq->flags)) {
+			netfs_reset_subreq_iter(rreq, subreq);
 			netfs_rreq_short_read(rreq, subreq);
 		}
 	}
--- linux-qcom-6.8.0.orig/fs/netfs/locking.c
+++ linux-qcom-6.8.0/fs/netfs/locking.c
@@ -121,6 +121,7 @@
 		up_write(&inode->i_rwsem);
 		return -ERESTARTSYS;
 	}
+	downgrade_write(&inode->i_rwsem);
 	return 0;
 }
 EXPORT_SYMBOL(netfs_start_io_write);
@@ -135,7 +136,7 @@
 void netfs_end_io_write(struct inode *inode)
 	__releases(inode->i_rwsem)
 {
-	up_write(&inode->i_rwsem);
+	up_read(&inode->i_rwsem);
 }
 EXPORT_SYMBOL(netfs_end_io_write);
 
--- linux-qcom-6.8.0.orig/fs/netfs/main.c
+++ linux-qcom-6.8.0/fs/netfs/main.c
@@ -115,7 +115,7 @@
 	return 0;
 
 error_proc:
-	remove_proc_entry("fs/netfs", NULL);
+	remove_proc_subtree("fs/netfs", NULL);
 error:
 	return ret;
 }
@@ -124,6 +124,6 @@
 static void __exit netfs_exit(void)
 {
 	fscache_exit();
-	remove_proc_entry("fs/netfs", NULL);
+	remove_proc_subtree("fs/netfs", NULL);
 }
 module_exit(netfs_exit);
--- linux-qcom-6.8.0.orig/fs/netfs/misc.c
+++ linux-qcom-6.8.0/fs/netfs/misc.c
@@ -242,6 +242,9 @@
 	struct netfs_inode *ctx = netfs_inode(folio_inode(folio));
 	unsigned long long end;
 
+	if (folio_test_dirty(folio))
+		return false;
+
 	end = folio_pos(folio) + folio_size(folio);
 	if (end > ctx->zero_point)
 		ctx->zero_point = end;
--- linux-qcom-6.8.0.orig/fs/nfs/callback.c
+++ linux-qcom-6.8.0/fs/nfs/callback.c
@@ -356,15 +356,12 @@
 	[4] = &nfs4_callback_version4,
 };
 
-static struct svc_stat nfs4_callback_stats;
-
 static struct svc_program nfs4_callback_program = {
 	.pg_prog = NFS4_CALLBACK,			/* RPC service number */
 	.pg_nvers = ARRAY_SIZE(nfs4_callback_version),	/* Number of entries */
 	.pg_vers = nfs4_callback_version,		/* version table */
 	.pg_name = "NFSv4 callback",			/* service name */
 	.pg_class = "nfs",				/* authentication class */
-	.pg_stats = &nfs4_callback_stats,
 	.pg_authenticate = nfs_callback_authenticate,
 	.pg_init_request = svc_generic_init_request,
 	.pg_rpcbind_set	= svc_generic_rpcbind_set,
--- linux-qcom-6.8.0.orig/fs/nfs/callback_xdr.c
+++ linux-qcom-6.8.0/fs/nfs/callback_xdr.c
@@ -372,6 +372,8 @@
 
 	rc_list->rcl_nrefcalls = ntohl(*p++);
 	if (rc_list->rcl_nrefcalls) {
+		if (unlikely(rc_list->rcl_nrefcalls > xdr->buf->len))
+			goto out;
 		p = xdr_inline_decode(xdr,
 			     rc_list->rcl_nrefcalls * 2 * sizeof(uint32_t));
 		if (unlikely(p == NULL))
--- linux-qcom-6.8.0.orig/fs/nfs/client.c
+++ linux-qcom-6.8.0/fs/nfs/client.c
@@ -73,7 +73,6 @@
 	.number			= NFS_PROGRAM,
 	.nrvers			= ARRAY_SIZE(nfs_version),
 	.version		= nfs_version,
-	.stats			= &nfs_rpcstat,
 	.pipe_dir_name		= NFS_PIPE_DIRNAME,
 };
 
@@ -502,6 +501,7 @@
 			  const struct nfs_client_initdata *cl_init,
 			  rpc_authflavor_t flavor)
 {
+	struct nfs_net		*nn = net_generic(clp->cl_net, nfs_net_id);
 	struct rpc_clnt		*clnt = NULL;
 	struct rpc_create_args args = {
 		.net		= clp->cl_net,
@@ -513,6 +513,7 @@
 		.servername	= clp->cl_hostname,
 		.nodename	= cl_init->nodename,
 		.program	= &nfs_program,
+		.stats		= &nn->rpcstats,
 		.version	= clp->rpc_ops->version,
 		.authflavor	= flavor,
 		.cred		= cl_init->cred,
@@ -986,6 +987,7 @@
 	INIT_LIST_HEAD(&server->layouts);
 	INIT_LIST_HEAD(&server->state_owners_lru);
 	INIT_LIST_HEAD(&server->ss_copies);
+	INIT_LIST_HEAD(&server->ss_src_copies);
 
 	atomic_set(&server->active, 0);
 
@@ -1182,6 +1184,8 @@
 #endif
 	spin_lock_init(&nn->nfs_client_lock);
 	nn->boot_time = ktime_get_real();
+	memset(&nn->rpcstats, 0, sizeof(nn->rpcstats));
+	nn->rpcstats.program = &nfs_program;
 
 	nfs_netns_sysfs_setup(nn, net);
 }
--- linux-qcom-6.8.0.orig/fs/nfs/delegation.c
+++ linux-qcom-6.8.0/fs/nfs/delegation.c
@@ -628,6 +628,9 @@
 				prev = delegation;
 			continue;
 		}
+		inode = nfs_delegation_grab_inode(delegation);
+		if (inode == NULL)
+			continue;
 
 		if (prev) {
 			struct inode *tmp = nfs_delegation_grab_inode(prev);
@@ -638,12 +641,6 @@
 			}
 		}
 
-		inode = nfs_delegation_grab_inode(delegation);
-		if (inode == NULL) {
-			rcu_read_unlock();
-			iput(to_put);
-			goto restart;
-		}
 		delegation = nfs_start_delegation_return_locked(NFS_I(inode));
 		rcu_read_unlock();
 
@@ -985,6 +982,11 @@
 	}
 
 	nfs_mark_delegation_revoked(delegation);
+	clear_bit(NFS_DELEGATION_RETURNING, &delegation->flags);
+	spin_unlock(&delegation->lock);
+	if (nfs_detach_delegation(NFS_I(inode), delegation, NFS_SERVER(inode)))
+		nfs_put_delegation(delegation);
+	goto out_rcu_unlock;
 
 out_clear_returning:
 	clear_bit(NFS_DELEGATION_RETURNING, &delegation->flags);
@@ -1165,7 +1167,6 @@
 	struct inode *inode;
 restart:
 	rcu_read_lock();
-restart_locked:
 	list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
 		if (test_bit(NFS_DELEGATION_INODE_FREEING,
 					&delegation->flags) ||
@@ -1176,7 +1177,7 @@
 			continue;
 		inode = nfs_delegation_grab_inode(delegation);
 		if (inode == NULL)
-			goto restart_locked;
+			continue;
 		delegation = nfs_start_delegation_return_locked(NFS_I(inode));
 		rcu_read_unlock();
 		if (delegation != NULL) {
@@ -1299,7 +1300,6 @@
 
 restart:
 	rcu_read_lock();
-restart_locked:
 	list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
 		if (test_bit(NFS_DELEGATION_INODE_FREEING,
 					&delegation->flags) ||
@@ -1311,7 +1311,7 @@
 			continue;
 		inode = nfs_delegation_grab_inode(delegation);
 		if (inode == NULL)
-			goto restart_locked;
+			continue;
 		spin_lock(&delegation->lock);
 		cred = get_cred_rcu(delegation->cred);
 		nfs4_stateid_copy(&stateid, &delegation->stateid);
--- linux-qcom-6.8.0.orig/fs/nfs/dir.c
+++ linux-qcom-6.8.0/fs/nfs/dir.c
@@ -807,7 +807,7 @@
 	int ret;
 
 	if (entry->fattr->label)
-		entry->fattr->label->len = NFS4_MAXLABELLEN;
+		entry->fattr->label->lsmctx.len = NFS4_MAXLABELLEN;
 	ret = xdr_decode(desc, entry, stream);
 	if (ret || !desc->plus)
 		return ret;
@@ -1625,7 +1625,16 @@
 	switch (error) {
 	case 1:
 		break;
-	case 0:
+	case -ETIMEDOUT:
+		if (inode && (IS_ROOT(dentry) ||
+			      NFS_SERVER(inode)->flags & NFS_MOUNT_SOFTREVAL))
+			error = 1;
+		break;
+	case -ESTALE:
+	case -ENOENT:
+		error = 0;
+		fallthrough;
+	default:
 		/*
 		 * We can't d_drop the root of a disconnected tree:
 		 * its d_hash is on the s_anon list and d_drop() would hide
@@ -1680,18 +1689,8 @@
 
 	dir_verifier = nfs_save_change_attribute(dir);
 	ret = NFS_PROTO(dir)->lookup(dir, dentry, fhandle, fattr);
-	if (ret < 0) {
-		switch (ret) {
-		case -ESTALE:
-		case -ENOENT:
-			ret = 0;
-			break;
-		case -ETIMEDOUT:
-			if (NFS_SERVER(inode)->flags & NFS_MOUNT_SOFTREVAL)
-				ret = 1;
-		}
+	if (ret < 0)
 		goto out;
-	}
 
 	/* Request help from readdirplus */
 	nfs_lookup_advise_force_readdirplus(dir, flags);
@@ -1735,7 +1734,7 @@
 			 unsigned int flags)
 {
 	struct inode *inode;
-	int error;
+	int error = 0;
 
 	nfs_inc_stats(dir, NFSIOS_DENTRYREVALIDATE);
 	inode = d_inode(dentry);
@@ -1780,7 +1779,7 @@
 out_bad:
 	if (flags & LOOKUP_RCU)
 		return -ECHILD;
-	return nfs_lookup_revalidate_done(dir, dentry, inode, 0);
+	return nfs_lookup_revalidate_done(dir, dentry, inode, error);
 }
 
 static int
@@ -1802,9 +1801,10 @@
 		if (parent != READ_ONCE(dentry->d_parent))
 			return -ECHILD;
 	} else {
-		/* Wait for unlink to complete */
+		/* Wait for unlink to complete - see unblock_revalidate() */
 		wait_var_event(&dentry->d_fsdata,
-			       dentry->d_fsdata != NFS_FSDATA_BLOCKED);
+			       smp_load_acquire(&dentry->d_fsdata)
+			       != NFS_FSDATA_BLOCKED);
 		parent = dget_parent(dentry);
 		ret = reval(d_inode(parent), dentry, flags);
 		dput(parent);
@@ -1817,6 +1817,29 @@
 	return __nfs_lookup_revalidate(dentry, flags, nfs_do_lookup_revalidate);
 }
 
+static void block_revalidate(struct dentry *dentry)
+{
+	/* old devname - just in case */
+	kfree(dentry->d_fsdata);
+
+	/* Any new reference that could lead to an open
+	 * will take ->d_lock in lookup_open() -> d_lookup().
+	 * Holding this lock ensures we cannot race with
+	 * __nfs_lookup_revalidate() and removes and need
+	 * for further barriers.
+	 */
+	lockdep_assert_held(&dentry->d_lock);
+
+	dentry->d_fsdata = NFS_FSDATA_BLOCKED;
+}
+
+static void unblock_revalidate(struct dentry *dentry)
+{
+	/* store_release ensures wait_var_event() sees the update */
+	smp_store_release(&dentry->d_fsdata, NULL);
+	wake_up_var(&dentry->d_fsdata);
+}
+
 /*
  * A weaker form of d_revalidate for revalidating just the d_inode(dentry)
  * when we don't really care about the dentry name. This is called when a
@@ -2501,15 +2524,12 @@
 		spin_unlock(&dentry->d_lock);
 		goto out;
 	}
-	/* old devname */
-	kfree(dentry->d_fsdata);
-	dentry->d_fsdata = NFS_FSDATA_BLOCKED;
+	block_revalidate(dentry);
 
 	spin_unlock(&dentry->d_lock);
 	error = nfs_safe_remove(dentry);
 	nfs_dentry_remove_handle_error(dir, dentry, error);
-	dentry->d_fsdata = NULL;
-	wake_up_var(&dentry->d_fsdata);
+	unblock_revalidate(dentry);
 out:
 	trace_nfs_unlink_exit(dir, dentry, error);
 	return error;
@@ -2616,8 +2636,7 @@
 {
 	struct dentry *new_dentry = data->new_dentry;
 
-	new_dentry->d_fsdata = NULL;
-	wake_up_var(&new_dentry->d_fsdata);
+	unblock_revalidate(new_dentry);
 }
 
 /*
@@ -2679,11 +2698,6 @@
 		if (WARN_ON(new_dentry->d_flags & DCACHE_NFSFS_RENAMED) ||
 		    WARN_ON(new_dentry->d_fsdata == NFS_FSDATA_BLOCKED))
 			goto out;
-		if (new_dentry->d_fsdata) {
-			/* old devname */
-			kfree(new_dentry->d_fsdata);
-			new_dentry->d_fsdata = NULL;
-		}
 
 		spin_lock(&new_dentry->d_lock);
 		if (d_count(new_dentry) > 2) {
@@ -2705,7 +2719,7 @@
 			new_dentry = dentry;
 			new_inode = NULL;
 		} else {
-			new_dentry->d_fsdata = NFS_FSDATA_BLOCKED;
+			block_revalidate(new_dentry);
 			must_unblock = true;
 			spin_unlock(&new_dentry->d_lock);
 		}
@@ -2717,6 +2731,8 @@
 	task = nfs_async_rename(old_dir, new_dir, old_dentry, new_dentry,
 				must_unblock ? nfs_unblock_rename : NULL);
 	if (IS_ERR(task)) {
+		if (must_unblock)
+			unblock_revalidate(new_dentry);
 		error = PTR_ERR(task);
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/fs/nfs/direct.c
+++ linux-qcom-6.8.0/fs/nfs/direct.c
@@ -141,8 +141,6 @@
 {
 	ssize_t ret;
 
-	VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE);
-
 	if (iov_iter_rw(iter) == READ)
 		ret = nfs_file_direct_read(iocb, iter, true);
 	else
@@ -667,10 +665,17 @@
 	LIST_HEAD(mds_list);
 
 	nfs_init_cinfo_from_dreq(&cinfo, dreq);
+	nfs_commit_begin(cinfo.mds);
 	nfs_scan_commit(dreq->inode, &mds_list, &cinfo);
 	res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo);
-	if (res < 0) /* res == -ENOMEM */
-		nfs_direct_write_reschedule(dreq);
+	if (res < 0) { /* res == -ENOMEM */
+		spin_lock(&dreq->lock);
+		if (dreq->flags == 0)
+			dreq->flags = NFS_ODIRECT_RESCHED_WRITES;
+		spin_unlock(&dreq->lock);
+	}
+	if (nfs_commit_end(cinfo.mds))
+		nfs_direct_write_complete(dreq);
 }
 
 static void nfs_direct_write_clear_reqs(struct nfs_direct_req *dreq)
--- linux-qcom-6.8.0.orig/fs/nfs/file.c
+++ linux-qcom-6.8.0/fs/nfs/file.c
@@ -434,7 +434,7 @@
 	/* Cancel any unstarted writes on this page */
 	nfs_wb_folio_cancel(inode, folio);
 	folio_wait_fscache(folio);
-	trace_nfs_invalidate_folio(inode, folio);
+	trace_nfs_invalidate_folio(inode, folio_pos(folio) + offset, length);
 }
 
 /*
@@ -502,7 +502,8 @@
 
 	folio_wait_fscache(folio);
 	ret = nfs_wb_folio(inode, folio);
-	trace_nfs_launder_folio_done(inode, folio, ret);
+	trace_nfs_launder_folio_done(inode, folio_pos(folio),
+			folio_size(folio), ret);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/fs/nfs/filelayout/filelayout.c
+++ linux-qcom-6.8.0/fs/nfs/filelayout/filelayout.c
@@ -883,7 +883,7 @@
 						      NFS4_MAX_UINT64,
 						      IOMODE_READ,
 						      false,
-						      GFP_KERNEL);
+						      nfs_io_gfp_mask());
 		if (IS_ERR(pgio->pg_lseg)) {
 			pgio->pg_error = PTR_ERR(pgio->pg_lseg);
 			pgio->pg_lseg = NULL;
@@ -907,7 +907,7 @@
 						      NFS4_MAX_UINT64,
 						      IOMODE_RW,
 						      false,
-						      GFP_NOFS);
+						      nfs_io_gfp_mask());
 		if (IS_ERR(pgio->pg_lseg)) {
 			pgio->pg_error = PTR_ERR(pgio->pg_lseg);
 			pgio->pg_lseg = NULL;
--- linux-qcom-6.8.0.orig/fs/nfs/flexfilelayout/flexfilelayout.c
+++ linux-qcom-6.8.0/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -2016,7 +2016,7 @@
 	for (idx = 0; idx < flseg->mirror_array_cnt; idx++) {
 		mirror = flseg->mirror_array[idx];
 		mirror_ds = mirror->mirror_ds;
-		if (!mirror_ds)
+		if (IS_ERR_OR_NULL(mirror_ds))
 			continue;
 		ds = mirror->mirror_ds->ds;
 		if (!ds)
--- linux-qcom-6.8.0.orig/fs/nfs/fs_context.c
+++ linux-qcom-6.8.0/fs/nfs/fs_context.c
@@ -1111,9 +1111,12 @@
 		ctx->acdirmax	= data->acdirmax;
 		ctx->need_mount	= false;
 
-		memcpy(sap, &data->addr, sizeof(data->addr));
-		ctx->nfs_server.addrlen = sizeof(data->addr);
-		ctx->nfs_server.port = ntohs(data->addr.sin_port);
+		if (!is_remount_fc(fc)) {
+			memcpy(sap, &data->addr, sizeof(data->addr));
+			ctx->nfs_server.addrlen = sizeof(data->addr);
+			ctx->nfs_server.port = ntohs(data->addr.sin_port);
+		}
+
 		if (sap->ss_family != AF_INET ||
 		    !nfs_verify_server_address(sap))
 			goto out_no_address;
--- linux-qcom-6.8.0.orig/fs/nfs/fscache.c
+++ linux-qcom-6.8.0/fs/nfs/fscache.c
@@ -301,11 +301,11 @@
 	struct inode *inode = sreq->rreq->inode;
 	struct nfs_open_context *ctx = sreq->rreq->netfs_priv;
 	struct page *page;
+	unsigned long idx;
 	int err;
 	pgoff_t start = (sreq->start + sreq->transferred) >> PAGE_SHIFT;
 	pgoff_t last = ((sreq->start + sreq->len -
 			 sreq->transferred - 1) >> PAGE_SHIFT);
-	XA_STATE(xas, &sreq->rreq->mapping->i_pages, start);
 
 	nfs_pageio_init_read(&pgio, inode, false,
 			     &nfs_async_read_completion_ops);
@@ -316,19 +316,14 @@
 
 	pgio.pg_netfs = netfs; /* used in completion */
 
-	xas_lock(&xas);
-	xas_for_each(&xas, page, last) {
+	xa_for_each_range(&sreq->rreq->mapping->i_pages, idx, page, start, last) {
 		/* nfs_read_add_folio() may schedule() due to pNFS layout and other RPCs  */
-		xas_pause(&xas);
-		xas_unlock(&xas);
 		err = nfs_read_add_folio(&pgio, ctx, page_folio(page));
 		if (err < 0) {
 			netfs->error = err;
 			goto out;
 		}
-		xas_lock(&xas);
 	}
-	xas_unlock(&xas);
 out:
 	nfs_pageio_complete_read(&pgio);
 	nfs_netfs_put(netfs);
--- linux-qcom-6.8.0.orig/fs/nfs/inode.c
+++ linux-qcom-6.8.0/fs/nfs/inode.c
@@ -206,12 +206,15 @@
 		nfs_fscache_invalidate(inode, 0);
 	flags &= ~NFS_INO_REVAL_FORCED;
 
-	nfsi->cache_validity |= flags;
+	flags |= nfsi->cache_validity;
+	if (inode->i_mapping->nrpages == 0)
+		flags &= ~NFS_INO_INVALID_DATA;
 
-	if (inode->i_mapping->nrpages == 0) {
-		nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
-		nfs_ooo_clear(nfsi);
-	} else if (nfsi->cache_validity & NFS_INO_INVALID_DATA) {
+	/* pairs with nfs_clear_invalid_mapping()'s smp_load_acquire() */
+	smp_store_release(&nfsi->cache_validity, flags);
+
+	if (inode->i_mapping->nrpages == 0 ||
+	    nfsi->cache_validity & NFS_INO_INVALID_DATA) {
 		nfs_ooo_clear(nfsi);
 	}
 	trace_nfs_set_cache_invalid(inode, 0);
@@ -357,14 +360,15 @@
 		return;
 
 	if ((fattr->valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL) && inode->i_security) {
-		error = security_inode_notifysecctx(inode, fattr->label->label,
-				fattr->label->len);
+		error = security_inode_notifysecctx(inode,
+						fattr->label->lsmctx.context,
+						fattr->label->lsmctx.len);
 		if (error)
 			printk(KERN_ERR "%s() %s %d "
 					"security_inode_notifysecctx() %d\n",
 					__func__,
-					(char *)fattr->label->label,
-					fattr->label->len, error);
+					(char *)fattr->label->lsmctx.context,
+					fattr->label->lsmctx.len, error);
 		nfs_clear_label_invalid(inode);
 	}
 }
@@ -380,12 +384,14 @@
 	if (label == NULL)
 		return ERR_PTR(-ENOMEM);
 
-	label->label = kzalloc(NFS4_MAXLABELLEN, flags);
-	if (label->label == NULL) {
+	label->lsmctx.context = kzalloc(NFS4_MAXLABELLEN, flags);
+	if (label->lsmctx.context == NULL) {
 		kfree(label);
 		return ERR_PTR(-ENOMEM);
 	}
-	label->len = NFS4_MAXLABELLEN;
+	label->lsmctx.len = NFS4_MAXLABELLEN;
+	/* Use an invalid LSM ID as this should never be "released". */
+	label->lsmctx.id = LSM_ID_UNDEF;
 
 	return label;
 }
@@ -1340,6 +1346,13 @@
 					 TASK_KILLABLE|TASK_FREEZABLE_UNSAFE);
 		if (ret)
 			goto out;
+		smp_rmb(); /* pairs with smp_wmb() below */
+		if (test_bit(NFS_INO_INVALIDATING, bitlock))
+			continue;
+		/* pairs with nfs_set_cache_invalid()'s smp_store_release() */
+		if (!(smp_load_acquire(&nfsi->cache_validity) & NFS_INO_INVALID_DATA))
+			goto out;
+		/* Slow-path that double-checks with spinlock held */
 		spin_lock(&inode->i_lock);
 		if (test_bit(NFS_INO_INVALIDATING, bitlock)) {
 			spin_unlock(&inode->i_lock);
@@ -1565,6 +1578,7 @@
 	fattr->gencount = nfs_inc_attr_generation_counter();
 	fattr->owner_name = NULL;
 	fattr->group_name = NULL;
+	fattr->mdsthreshold = NULL;
 }
 EXPORT_SYMBOL_GPL(nfs_fattr_init);
 
@@ -2426,12 +2440,21 @@
 
 static int nfs_net_init(struct net *net)
 {
+	struct nfs_net *nn = net_generic(net, nfs_net_id);
+
 	nfs_clients_init(net);
+
+	if (!rpc_proc_register(net, &nn->rpcstats)) {
+		nfs_clients_exit(net);
+		return -ENOMEM;
+	}
+
 	return nfs_fs_proc_net_init(net);
 }
 
 static void nfs_net_exit(struct net *net)
 {
+	rpc_proc_unregister(net, "nfs");
 	nfs_fs_proc_net_exit(net);
 	nfs_clients_exit(net);
 }
@@ -2486,15 +2509,12 @@
 	if (err)
 		goto out1;
 
-	rpc_proc_register(&init_net, &nfs_rpcstat);
-
 	err = register_nfs_fs();
 	if (err)
 		goto out0;
 
 	return 0;
 out0:
-	rpc_proc_unregister(&init_net, "nfs");
 	nfs_destroy_directcache();
 out1:
 	nfs_destroy_writepagecache();
@@ -2524,7 +2544,6 @@
 	nfs_destroy_inodecache();
 	nfs_destroy_nfspagecache();
 	unregister_pernet_subsys(&nfs_net_ops);
-	rpc_proc_unregister(&init_net, "nfs");
 	unregister_nfs_fs();
 	nfs_fs_proc_exit();
 	nfsiod_stop();
--- linux-qcom-6.8.0.orig/fs/nfs/internal.h
+++ linux-qcom-6.8.0/fs/nfs/internal.h
@@ -11,7 +11,7 @@
 #include <linux/nfs_page.h>
 #include <linux/wait_bit.h>
 
-#define NFS_SB_MASK (SB_RDONLY|SB_NOSUID|SB_NODEV|SB_NOEXEC|SB_SYNCHRONOUS)
+#define NFS_SB_MASK (SB_NOSUID|SB_NODEV|SB_NOEXEC|SB_SYNCHRONOUS)
 
 extern const struct export_operations nfs_export_ops;
 
@@ -346,13 +346,15 @@
 	if (!dst || !src)
 		return NULL;
 
-	if (src->len > NFS4_MAXLABELLEN)
+	if (src->lsmctx.len > NFS4_MAXLABELLEN)
 		return NULL;
 
 	dst->lfs = src->lfs;
 	dst->pi = src->pi;
-	dst->len = src->len;
-	memcpy(dst->label, src->label, src->len);
+	/* Use an invalid LSM ID as lsmctx should never be "released" */
+	dst->lsmctx.id = LSM_ID_UNDEF;
+	dst->lsmctx.len = src->lsmctx.len;
+	memcpy(dst->lsmctx.context, src->lsmctx.context, src->lsmctx.len);
 
 	return dst;
 }
@@ -449,8 +451,6 @@
 int nfs_get_tree_common(struct fs_context *);
 void nfs_kill_super(struct super_block *);
 
-extern struct rpc_stat nfs_rpcstat;
-
 extern int __init register_nfs_fs(void);
 extern void __exit unregister_nfs_fs(void);
 extern bool nfs_sb_active(struct super_block *sb);
@@ -712,9 +712,9 @@
 	if ((bsize & (bsize - 1)) || nrbitsp) {
 		unsigned char	nrbits;
 
-		for (nrbits = 31; nrbits && !(bsize & (1 << nrbits)); nrbits--)
+		for (nrbits = 31; nrbits && !(bsize & (1UL << nrbits)); nrbits--)
 			;
-		bsize = 1 << nrbits;
+		bsize = 1UL << nrbits;
 		if (nrbitsp)
 			*nrbitsp = nrbits;
 	}
--- linux-qcom-6.8.0.orig/fs/nfs/netns.h
+++ linux-qcom-6.8.0/fs/nfs/netns.h
@@ -9,6 +9,7 @@
 #include <linux/nfs4.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
+#include <linux/sunrpc/stats.h>
 
 struct bl_dev_msg {
 	int32_t status;
@@ -34,6 +35,7 @@
 	struct nfs_netns_client *nfs_client;
 	spinlock_t nfs_client_lock;
 	ktime_t boot_time;
+	struct rpc_stat rpcstats;
 #ifdef CONFIG_PROC_FS
 	struct proc_dir_entry *proc_nfsfs;
 #endif
--- linux-qcom-6.8.0.orig/fs/nfs/nfs42.h
+++ linux-qcom-6.8.0/fs/nfs/nfs42.h
@@ -55,11 +55,14 @@
  * They would be 7 bytes long in the eventual buffer ("user.x\0"), and
  * 8 bytes long XDR-encoded.
  *
- * Include the trailing eof word as well.
+ * Include the trailing eof word as well and make the result a multiple
+ * of 4 bytes.
  */
 static inline u32 nfs42_listxattr_xdrsize(u32 buflen)
 {
-	return ((buflen / (XATTR_USER_PREFIX_LEN + 2)) * 8) + 4;
+	u32 size = 8 * buflen / (XATTR_USER_PREFIX_LEN + 2) + 4;
+
+	return (size + 3) & ~3;
 }
 #endif /* CONFIG_NFS_V4_2 */
 #endif /* __LINUX_FS_NFS_NFS4_2_H */
--- linux-qcom-6.8.0.orig/fs/nfs/nfs42proc.c
+++ linux-qcom-6.8.0/fs/nfs/nfs42proc.c
@@ -218,7 +218,7 @@
 
 	if (dst_server != src_server) {
 		spin_lock(&src_server->nfs_client->cl_lock);
-		list_add_tail(&copy->src_copies, &src_server->ss_copies);
+		list_add_tail(&copy->src_copies, &src_server->ss_src_copies);
 		spin_unlock(&src_server->nfs_client->cl_lock);
 	}
 
--- linux-qcom-6.8.0.orig/fs/nfs/nfs4client.c
+++ linux-qcom-6.8.0/fs/nfs/nfs4client.c
@@ -231,9 +231,8 @@
 		__set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags);
 	__set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
 	__set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags);
-
-	if (test_bit(NFS_CS_DS, &cl_init->init_flags))
-		__set_bit(NFS_CS_DS, &clp->cl_flags);
+	if (test_bit(NFS_CS_PNFS, &cl_init->init_flags))
+		__set_bit(NFS_CS_PNFS, &clp->cl_flags);
 	/*
 	 * Set up the connection to the server before we add add to the
 	 * global list.
@@ -1011,7 +1010,6 @@
 	if (mds_srv->flags & NFS_MOUNT_NORESVPORT)
 		__set_bit(NFS_CS_NORESVPORT, &cl_init.init_flags);
 
-	__set_bit(NFS_CS_DS, &cl_init.init_flags);
 	__set_bit(NFS_CS_PNFS, &cl_init.init_flags);
 	cl_init.max_connect = NFS_MAX_TRANSPORTS;
 	/*
--- linux-qcom-6.8.0.orig/fs/nfs/nfs4proc.c
+++ linux-qcom-6.8.0/fs/nfs/nfs4proc.c
@@ -124,12 +124,11 @@
 
 	label->lfs = 0;
 	label->pi = 0;
-	label->len = 0;
-	label->label = NULL;
+	label->lsmctx.len = 0;
+	label->lsmctx.context = NULL;
 
 	err = security_dentry_init_security(dentry, sattr->ia_mode,
-				&dentry->d_name, NULL,
-				(void **)&label->label, &label->len);
+				&dentry->d_name, NULL, &label->lsmctx);
 	if (err == 0)
 		return label;
 
@@ -139,7 +138,7 @@
 nfs4_label_release_security(struct nfs4_label *label)
 {
 	if (label)
-		security_release_secctx(label->label, label->len);
+		security_release_secctx(&label->lsmctx);
 }
 static inline u32 *nfs4_bitmask(struct nfs_server *server, struct nfs4_label *label)
 {
@@ -2553,12 +2552,14 @@
 	struct nfs4_opendata *data = calldata;
 	struct nfs4_state *state = NULL;
 
+	/* In case of error, no cleanup! */
+	if (data->rpc_status != 0 || !data->rpc_done) {
+		nfs_release_seqid(data->o_arg.seqid);
+		goto out_free;
+	}
 	/* If this request hasn't been cancelled, do nothing */
 	if (!data->cancelled)
 		goto out_free;
-	/* In case of error, no cleanup! */
-	if (data->rpc_status != 0 || !data->rpc_done)
-		goto out_free;
 	/* In case we need an open_confirm, no cleanup! */
 	if (data->o_res.rflags & NFS4_OPEN_RESULT_CONFIRM)
 		goto out_free;
@@ -4028,6 +4029,23 @@
 	}
 }
 
+static bool _is_same_nfs4_pathname(struct nfs4_pathname *path1,
+				   struct nfs4_pathname *path2)
+{
+	int i;
+
+	if (path1->ncomponents != path2->ncomponents)
+		return false;
+	for (i = 0; i < path1->ncomponents; i++) {
+		if (path1->components[i].len != path2->components[i].len)
+			return false;
+		if (memcmp(path1->components[i].data, path2->components[i].data,
+				path1->components[i].len))
+			return false;
+	}
+	return true;
+}
+
 static int _nfs4_discover_trunking(struct nfs_server *server,
 				   struct nfs_fh *fhandle)
 {
@@ -4061,9 +4079,13 @@
 	if (status)
 		goto out_free_3;
 
-	for (i = 0; i < locations->nlocations; i++)
+	for (i = 0; i < locations->nlocations; i++) {
+		if (!_is_same_nfs4_pathname(&locations->fs_path,
+					&locations->locations[i].rootpath))
+			continue;
 		test_fs_location_for_trunking(&locations->locations[i], clp,
 					      server);
+	}
 out_free_3:
 	kfree(locations->fattr);
 out_free_2:
@@ -5461,7 +5483,7 @@
 	struct rpc_message *msg = &task->tk_msg;
 
 	if (msg->rpc_proc == &nfs4_procedures[NFSPROC4_CLNT_READ_PLUS] &&
-	    server->caps & NFS_CAP_READ_PLUS && task->tk_status == -ENOTSUPP) {
+	    task->tk_status == -ENOTSUPP) {
 		server->caps &= ~NFS_CAP_READ_PLUS;
 		msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ];
 		rpc_restart_call_prepare(task);
@@ -6153,7 +6175,7 @@
 					size_t buflen)
 {
 	struct nfs_server *server = NFS_SERVER(inode);
-	struct nfs4_label label = {0, 0, buflen, buf};
+	struct nfs4_label label = {0, 0, {buf, buflen, -1} };
 
 	u32 bitmask[3] = { 0, 0, FATTR4_WORD2_SECURITY_LABEL };
 	struct nfs_fattr fattr = {
@@ -6181,7 +6203,7 @@
 		return ret;
 	if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
 		return -ENOENT;
-	return label.len;
+	return label.lsmctx.len;
 }
 
 static int nfs4_get_security_label(struct inode *inode, void *buf,
@@ -6258,7 +6280,8 @@
 static int
 nfs4_set_security_label(struct inode *inode, const void *buf, size_t buflen)
 {
-	struct nfs4_label ilabel = {0, 0, buflen, (char *)buf };
+	struct nfs4_label ilabel = {0, 0,
+				    {(char *)buf, buflen, -1}};
 	struct nfs_fattr *fattr;
 	int status;
 
@@ -6273,6 +6296,7 @@
 	if (status == 0)
 		nfs_setsecurity(inode, fattr);
 
+	nfs_free_fattr(fattr);
 	return status;
 }
 #endif	/* CONFIG_NFS_V4_SECURITY_LABEL */
@@ -8820,7 +8844,7 @@
 #ifdef CONFIG_NFS_V4_1_MIGRATION
 	calldata->args.flags |= EXCHGID4_FLAG_SUPP_MOVED_MIGR;
 #endif
-	if (test_bit(NFS_CS_DS, &clp->cl_flags))
+	if (test_bit(NFS_CS_PNFS, &clp->cl_flags))
 		calldata->args.flags |= EXCHGID4_FLAG_USE_PNFS_DS;
 	msg.rpc_argp = &calldata->args;
 	msg.rpc_resp = &calldata->res;
@@ -9851,13 +9875,16 @@
 		fallthrough;
 	default:
 		task->tk_status = 0;
+		lrp->res.lrs_present = 0;
 		fallthrough;
 	case 0:
 		break;
 	case -NFS4ERR_DELAY:
-		if (nfs4_async_handle_error(task, server, NULL, NULL) != -EAGAIN)
-			break;
-		goto out_restart;
+		if (nfs4_async_handle_error(task, server, NULL, NULL) ==
+		    -EAGAIN)
+			goto out_restart;
+		lrp->res.lrs_present = 0;
+		break;
 	}
 	return;
 out_restart:
@@ -10615,29 +10642,33 @@
 static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size)
 {
 	ssize_t error, error2, error3;
+	size_t left = size;
 
-	error = generic_listxattr(dentry, list, size);
+	error = generic_listxattr(dentry, list, left);
 	if (error < 0)
 		return error;
 	if (list) {
 		list += error;
-		size -= error;
+		left -= error;
 	}
 
-	error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, size);
+	error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, left);
 	if (error2 < 0)
 		return error2;
 
 	if (list) {
 		list += error2;
-		size -= error2;
+		left -= error2;
 	}
 
-	error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, size);
+	error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, left);
 	if (error3 < 0)
 		return error3;
 
-	return error + error2 + error3;
+	error += error2 + error3;
+	if (size && error > size)
+		return -ERANGE;
+	return error;
 }
 
 static void nfs4_enable_swap(struct inode *inode)
--- linux-qcom-6.8.0.orig/fs/nfs/nfs4state.c
+++ linux-qcom-6.8.0/fs/nfs/nfs4state.c
@@ -1597,7 +1597,7 @@
 			complete(&copy->completion);
 		}
 	}
-	list_for_each_entry(copy, &sp->so_server->ss_copies, src_copies) {
+	list_for_each_entry(copy, &sp->so_server->ss_src_copies, src_copies) {
 		if ((test_bit(NFS_CLNT_SRC_SSC_COPY_STATE, &state->flags) &&
 				!nfs4_stateid_match_other(&state->stateid,
 				&copy->parent_src_state->stateid)))
@@ -1957,6 +1957,7 @@
 				set_bit(ops->owner_flag_bit, &sp->so_flags);
 				nfs4_put_state_owner(sp);
 				status = nfs4_recovery_handle_error(clp, status);
+				nfs4_free_state_owners(&freeme);
 				return (status != 0) ? status : -EAGAIN;
 			}
 
@@ -2117,6 +2118,7 @@
 {
 	struct nfs_client *clp = server->nfs_client;
 	struct nfs4_fs_locations *locations = NULL;
+	struct nfs_fattr *fattr;
 	struct inode *inode;
 	struct page *page;
 	int status, result;
@@ -2126,19 +2128,16 @@
 			(unsigned long long)server->fsid.minor,
 			clp->cl_hostname);
 
-	result = 0;
 	page = alloc_page(GFP_KERNEL);
 	locations = kmalloc(sizeof(struct nfs4_fs_locations), GFP_KERNEL);
-	if (page == NULL || locations == NULL) {
-		dprintk("<-- %s: no memory\n", __func__);
-		goto out;
-	}
-	locations->fattr = nfs_alloc_fattr();
-	if (locations->fattr == NULL) {
+	fattr = nfs_alloc_fattr();
+	if (page == NULL || locations == NULL || fattr == NULL) {
 		dprintk("<-- %s: no memory\n", __func__);
+		result = 0;
 		goto out;
 	}
 
+	locations->fattr = fattr;
 	inode = d_inode(server->super->s_root);
 	result = nfs4_proc_get_locations(server, NFS_FH(inode), locations,
 					 page, cred);
--- linux-qcom-6.8.0.orig/fs/nfs/nfs4xdr.c
+++ linux-qcom-6.8.0/fs/nfs/nfs4xdr.c
@@ -1154,7 +1154,7 @@
 	}
 
 	if (label && (attrmask[2] & FATTR4_WORD2_SECURITY_LABEL)) {
-		len += 4 + 4 + 4 + (XDR_QUADLEN(label->len) << 2);
+		len += 4 + 4 + 4 + (XDR_QUADLEN(label->lsmctx.len) << 2);
 		bmval[2] |= FATTR4_WORD2_SECURITY_LABEL;
 	}
 
@@ -1186,8 +1186,9 @@
 	if (label && (bmval[2] & FATTR4_WORD2_SECURITY_LABEL)) {
 		*p++ = cpu_to_be32(label->lfs);
 		*p++ = cpu_to_be32(label->pi);
-		*p++ = cpu_to_be32(label->len);
-		p = xdr_encode_opaque_fixed(p, label->label, label->len);
+		*p++ = cpu_to_be32(label->lsmctx.len);
+		p = xdr_encode_opaque_fixed(p, label->lsmctx.context,
+					    label->lsmctx.len);
 	}
 	if (bmval[2] & FATTR4_WORD2_MODE_UMASK) {
 		*p++ = cpu_to_be32(iap->ia_mode & S_IALLUGO);
@@ -4245,11 +4246,11 @@
 			return -EIO;
 		bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
 		if (len < NFS4_MAXLABELLEN) {
-			if (label && label->len) {
-				if (label->len < len)
+			if (label && label->lsmctx.len) {
+				if (label->lsmctx.len < len)
 					return -ERANGE;
-				memcpy(label->label, p, len);
-				label->len = len;
+				memcpy(label->lsmctx.context, p, len);
+				label->lsmctx.len = len;
 				label->pi = pi;
 				label->lfs = lfs;
 				status = NFS_ATTR_FATTR_V4_SECURITY_LABEL;
@@ -4257,10 +4258,11 @@
 		} else
 			printk(KERN_WARNING "%s: label too long (%u)!\n",
 					__func__, len);
-		if (label && label->label)
+		if (label && label->lsmctx.context)
 			dprintk("%s: label=%.*s, len=%d, PI=%d, LFS=%d\n",
-				__func__, label->len, (char *)label->label,
-				label->len, label->pi, label->lfs);
+				__func__, label->lsmctx.len,
+				(char *)label->lsmctx.context,
+				label->lsmctx.len, label->pi, label->lfs);
 	}
 	return status;
 }
--- linux-qcom-6.8.0.orig/fs/nfs/nfsroot.c
+++ linux-qcom-6.8.0/fs/nfs/nfsroot.c
@@ -175,10 +175,10 @@
 	size_t len = strlen(dest);
 
 	if (len && dest[len - 1] != ',')
-		if (strlcat(dest, ",", destlen) > destlen)
+		if (strlcat(dest, ",", destlen) >= destlen)
 			return -1;
 
-	if (strlcat(dest, src, destlen) > destlen)
+	if (strlcat(dest, src, destlen) >= destlen)
 		return -1;
 	return 0;
 }
--- linux-qcom-6.8.0.orig/fs/nfs/nfstrace.h
+++ linux-qcom-6.8.0/fs/nfs/nfstrace.h
@@ -939,10 +939,11 @@
 DECLARE_EVENT_CLASS(nfs_folio_event,
 		TP_PROTO(
 			const struct inode *inode,
-			struct folio *folio
+			loff_t offset,
+			size_t count
 		),
 
-		TP_ARGS(inode, folio),
+		TP_ARGS(inode, offset, count),
 
 		TP_STRUCT__entry(
 			__field(dev_t, dev)
@@ -950,7 +951,7 @@
 			__field(u64, fileid)
 			__field(u64, version)
 			__field(loff_t, offset)
-			__field(u32, count)
+			__field(size_t, count)
 		),
 
 		TP_fast_assign(
@@ -960,13 +961,13 @@
 			__entry->fileid = nfsi->fileid;
 			__entry->fhandle = nfs_fhandle_hash(&nfsi->fh);
 			__entry->version = inode_peek_iversion_raw(inode);
-			__entry->offset = folio_file_pos(folio);
-			__entry->count = nfs_folio_length(folio);
+			__entry->offset = offset,
+			__entry->count = count;
 		),
 
 		TP_printk(
 			"fileid=%02x:%02x:%llu fhandle=0x%08x version=%llu "
-			"offset=%lld count=%u",
+			"offset=%lld count=%zu",
 			MAJOR(__entry->dev), MINOR(__entry->dev),
 			(unsigned long long)__entry->fileid,
 			__entry->fhandle, __entry->version,
@@ -978,18 +979,20 @@
 	DEFINE_EVENT(nfs_folio_event, name, \
 			TP_PROTO( \
 				const struct inode *inode, \
-				struct folio *folio \
+				loff_t offset, \
+				size_t count \
 			), \
-			TP_ARGS(inode, folio))
+			TP_ARGS(inode, offset, count))
 
 DECLARE_EVENT_CLASS(nfs_folio_event_done,
 		TP_PROTO(
 			const struct inode *inode,
-			struct folio *folio,
+			loff_t offset,
+			size_t count,
 			int ret
 		),
 
-		TP_ARGS(inode, folio, ret),
+		TP_ARGS(inode, offset, count, ret),
 
 		TP_STRUCT__entry(
 			__field(dev_t, dev)
@@ -998,7 +1001,7 @@
 			__field(u64, fileid)
 			__field(u64, version)
 			__field(loff_t, offset)
-			__field(u32, count)
+			__field(size_t, count)
 		),
 
 		TP_fast_assign(
@@ -1008,14 +1011,14 @@
 			__entry->fileid = nfsi->fileid;
 			__entry->fhandle = nfs_fhandle_hash(&nfsi->fh);
 			__entry->version = inode_peek_iversion_raw(inode);
-			__entry->offset = folio_file_pos(folio);
-			__entry->count = nfs_folio_length(folio);
+			__entry->offset = offset,
+			__entry->count = count,
 			__entry->ret = ret;
 		),
 
 		TP_printk(
 			"fileid=%02x:%02x:%llu fhandle=0x%08x version=%llu "
-			"offset=%lld count=%u ret=%d",
+			"offset=%lld count=%zu ret=%d",
 			MAJOR(__entry->dev), MINOR(__entry->dev),
 			(unsigned long long)__entry->fileid,
 			__entry->fhandle, __entry->version,
@@ -1027,10 +1030,11 @@
 	DEFINE_EVENT(nfs_folio_event_done, name, \
 			TP_PROTO( \
 				const struct inode *inode, \
-				struct folio *folio, \
+				loff_t offset, \
+				size_t count, \
 				int ret \
 			), \
-			TP_ARGS(inode, folio, ret))
+			TP_ARGS(inode, offset, count, ret))
 
 DEFINE_NFS_FOLIO_EVENT(nfs_aop_readpage);
 DEFINE_NFS_FOLIO_EVENT_DONE(nfs_aop_readpage_done);
--- linux-qcom-6.8.0.orig/fs/nfs/pagelist.c
+++ linux-qcom-6.8.0/fs/nfs/pagelist.c
@@ -1545,6 +1545,11 @@
 					continue;
 			} else if (index == prev->wb_index + 1)
 				continue;
+			/*
+			 * We will submit more requests after these. Indicate
+			 * this to the underlying layers.
+			 */
+			desc->pg_moreio = 1;
 			nfs_pageio_complete(desc);
 			break;
 		}
--- linux-qcom-6.8.0.orig/fs/nfs/pnfs.c
+++ linux-qcom-6.8.0/fs/nfs/pnfs.c
@@ -1172,10 +1172,9 @@
 	LIST_HEAD(freeme);
 
 	spin_lock(&inode->i_lock);
-	if (!pnfs_layout_is_valid(lo) ||
-	    !nfs4_stateid_match_other(&lo->plh_stateid, arg_stateid))
+	if (!nfs4_stateid_match_other(&lo->plh_stateid, arg_stateid))
 		goto out_unlock;
-	if (stateid) {
+	if (stateid && pnfs_layout_is_valid(lo)) {
 		u32 seq = be32_to_cpu(arg_stateid->seqid);
 
 		pnfs_mark_matching_lsegs_invalid(lo, &freeme, range, seq);
@@ -1197,7 +1196,7 @@
 		enum pnfs_iomode *iomode)
 {
 	/* Serialise LAYOUTGET/LAYOUTRETURN */
-	if (atomic_read(&lo->plh_outstanding) != 0)
+	if (atomic_read(&lo->plh_outstanding) != 0 && lo->plh_return_seq == 0)
 		return false;
 	if (test_and_set_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags))
 		return false;
@@ -1999,6 +1998,14 @@
 	}
 
 lookup_again:
+	if (!nfs4_valid_open_stateid(ctx->state)) {
+		trace_pnfs_update_layout(ino, pos, count,
+					 iomode, lo, lseg,
+					 PNFS_UPDATE_LAYOUT_INVALID_OPEN);
+		lseg = ERR_PTR(-EIO);
+		goto out;
+	}
+
 	lseg = ERR_PTR(nfs4_client_recover_expired_lease(clp));
 	if (IS_ERR(lseg))
 		goto out;
--- linux-qcom-6.8.0.orig/fs/nfs/pnfs_nfs.c
+++ linux-qcom-6.8.0/fs/nfs/pnfs_nfs.c
@@ -919,6 +919,8 @@
 	dprintk("--> %s DS %s\n", __func__, ds->ds_remotestr);
 
 	list_for_each_entry(da, &ds->ds_addrs, da_node) {
+		char servername[48];
+
 		dprintk("%s: DS %s: trying address %s\n",
 			__func__, ds->ds_remotestr, da->da_remotestr);
 
@@ -929,6 +931,7 @@
 				.dstaddr = (struct sockaddr *)&da->da_addr,
 				.addrlen = da->da_addrlen,
 				.servername = clp->cl_hostname,
+				.xprtsec = clp->cl_xprtsec,
 			};
 			struct nfs4_add_xprt_data xprtdata = {
 				.clp = clp,
@@ -938,10 +941,45 @@
 				.data = &xprtdata,
 			};
 
-			if (da->da_transport != clp->cl_proto)
+			if (da->da_transport != clp->cl_proto &&
+					clp->cl_proto != XPRT_TRANSPORT_TCP_TLS)
 				continue;
+			if (da->da_transport == XPRT_TRANSPORT_TCP &&
+				mds_srv->nfs_client->cl_proto ==
+					XPRT_TRANSPORT_TCP_TLS) {
+				struct sockaddr *addr =
+					(struct sockaddr *)&da->da_addr;
+				struct sockaddr_in *sin =
+					(struct sockaddr_in *)&da->da_addr;
+				struct sockaddr_in6 *sin6 =
+					(struct sockaddr_in6 *)&da->da_addr;
+
+				/* for NFS with TLS we need to supply a correct
+				 * servername of the trunked transport, not the
+				 * servername of the main transport stored in
+				 * clp->cl_hostname. And set the protocol to
+				 * indicate to use TLS
+				 */
+				servername[0] = '\0';
+				switch(addr->sa_family) {
+				case AF_INET:
+					snprintf(servername, sizeof(servername),
+						"%pI4", &sin->sin_addr.s_addr);
+					break;
+				case AF_INET6:
+					snprintf(servername, sizeof(servername),
+						"%pI6", &sin6->sin6_addr);
+					break;
+				default:
+					/* do not consider this address */
+					continue;
+				}
+				xprt_args.ident = XPRT_TRANSPORT_TCP_TLS;
+				xprt_args.servername = servername;
+			}
 			if (da->da_addr.ss_family != clp->cl_addr.ss_family)
 				continue;
+
 			/**
 			* Test this address for session trunking and
 			* add as an alias
@@ -953,6 +991,10 @@
 			if (xprtdata.cred)
 				put_cred(xprtdata.cred);
 		} else {
+			if (da->da_transport == XPRT_TRANSPORT_TCP &&
+				mds_srv->nfs_client->cl_proto ==
+					XPRT_TRANSPORT_TCP_TLS)
+				da->da_transport = XPRT_TRANSPORT_TCP_TLS;
 			clp = nfs4_set_ds_client(mds_srv,
 						&da->da_addr,
 						da->da_addrlen,
--- linux-qcom-6.8.0.orig/fs/nfs/read.c
+++ linux-qcom-6.8.0/fs/nfs/read.c
@@ -305,6 +305,8 @@
 	new = nfs_page_create_from_folio(ctx, folio, 0, aligned_len);
 	if (IS_ERR(new)) {
 		error = PTR_ERR(new);
+		if (nfs_netfs_folio_unlock(folio))
+			folio_unlock(folio);
 		goto out;
 	}
 
@@ -330,13 +332,15 @@
 int nfs_read_folio(struct file *file, struct folio *folio)
 {
 	struct inode *inode = file_inode(file);
+	loff_t pos = folio_pos(folio);
+	size_t len = folio_size(folio);
 	struct nfs_pageio_descriptor pgio;
 	struct nfs_open_context *ctx;
 	int ret;
 
-	trace_nfs_aop_readpage(inode, folio);
+	trace_nfs_aop_readpage(inode, pos, len);
 	nfs_inc_stats(inode, NFSIOS_VFSREADPAGE);
-	task_io_account_read(folio_size(folio));
+	task_io_account_read(len);
 
 	/*
 	 * Try to flush any pending writes to the file..
@@ -379,7 +383,7 @@
 out_put:
 	put_nfs_open_context(ctx);
 out:
-	trace_nfs_aop_readpage_done(inode, folio, ret);
+	trace_nfs_aop_readpage_done(inode, pos, len, ret);
 	return ret;
 out_unlock:
 	folio_unlock(folio);
--- linux-qcom-6.8.0.orig/fs/nfs/super.c
+++ linux-qcom-6.8.0/fs/nfs/super.c
@@ -47,6 +47,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/in6.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <net/ipv6.h>
 #include <linux/netdevice.h>
@@ -228,6 +229,7 @@
 		ret = fn(server, data);
 		if (ret)
 			goto out;
+		cond_resched();
 		rcu_read_lock();
 	}
 	rcu_read_unlock();
@@ -872,7 +874,15 @@
 	 * Now ask the mount server to map our export path
 	 * to a file handle.
 	 */
-	status = nfs_mount(&request, ctx->timeo, ctx->retrans);
+	if ((request.protocol == XPRT_TRANSPORT_UDP) ==
+	    !(ctx->flags & NFS_MOUNT_TCP))
+		/*
+		 * NFS protocol and mount protocol are both UDP or neither UDP
+		 * so timeouts are compatible.  Use NFS timeouts for MOUNT
+		 */
+		status = nfs_mount(&request, ctx->timeo, ctx->retrans);
+	else
+		status = nfs_mount(&request, NFS_UNSPEC_TIMEO, NFS_UNSPEC_RETRANS);
 	if (status != 0) {
 		dfprintk(MOUNT, "NFS: unable to mount server %s, error %d\n",
 				request.hostname, status);
--- linux-qcom-6.8.0.orig/fs/nfs/symlink.c
+++ linux-qcom-6.8.0/fs/nfs/symlink.c
@@ -41,7 +41,7 @@
 error:
 	folio_set_error(folio);
 	folio_unlock(folio);
-	return -EIO;
+	return error;
 }
 
 static const char *nfs_get_link(struct dentry *dentry,
--- linux-qcom-6.8.0.orig/fs/nfs/write.c
+++ linux-qcom-6.8.0/fs/nfs/write.c
@@ -1650,7 +1650,7 @@
 				       !atomic_read(&cinfo->rpcs_out));
 }
 
-static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo)
+void nfs_commit_begin(struct nfs_mds_commit_info *cinfo)
 {
 	atomic_inc(&cinfo->rpcs_out);
 }
@@ -2077,17 +2077,17 @@
  */
 int nfs_wb_folio(struct inode *inode, struct folio *folio)
 {
-	loff_t range_start = folio_file_pos(folio);
-	loff_t range_end = range_start + (loff_t)folio_size(folio) - 1;
+	loff_t range_start = folio_pos(folio);
+	size_t len = folio_size(folio);
 	struct writeback_control wbc = {
 		.sync_mode = WB_SYNC_ALL,
 		.nr_to_write = 0,
 		.range_start = range_start,
-		.range_end = range_end,
+		.range_end = range_start + len - 1,
 	};
 	int ret;
 
-	trace_nfs_writeback_folio(inode, folio);
+	trace_nfs_writeback_folio(inode, range_start, len);
 
 	for (;;) {
 		folio_wait_writeback(folio);
@@ -2105,7 +2105,7 @@
 			goto out_error;
 	}
 out_error:
-	trace_nfs_writeback_folio_done(inode, folio, ret);
+	trace_nfs_writeback_folio_done(inode, range_start, len, ret);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/fs/nfsd/Kconfig
+++ linux-qcom-6.8.0/fs/nfsd/Kconfig
@@ -162,7 +162,7 @@
 config NFSD_LEGACY_CLIENT_TRACKING
 	bool "Support legacy NFSv4 client tracking methods (DEPRECATED)"
 	depends on NFSD_V4
-	default n
+	default y
 	help
 	  The NFSv4 server needs to store a small amount of information on
 	  stable storage in order to handle state recovery after reboot. Most
--- linux-qcom-6.8.0.orig/fs/nfsd/cache.h
+++ linux-qcom-6.8.0/fs/nfsd/cache.h
@@ -80,8 +80,6 @@
 
 int	nfsd_drc_slab_create(void);
 void	nfsd_drc_slab_free(void);
-int	nfsd_net_reply_cache_init(struct nfsd_net *nn);
-void	nfsd_net_reply_cache_destroy(struct nfsd_net *nn);
 int	nfsd_reply_cache_init(struct nfsd_net *);
 void	nfsd_reply_cache_shutdown(struct nfsd_net *);
 int	nfsd_cache_lookup(struct svc_rqst *rqstp, unsigned int start,
--- linux-qcom-6.8.0.orig/fs/nfsd/export.c
+++ linux-qcom-6.8.0/fs/nfsd/export.c
@@ -1365,9 +1365,12 @@
 		return 0;
 	}
 
-	exp_get(exp);
+	if (!cache_get_rcu(&exp->h))
+		return 0;
+
 	if (cache_check(cd, &exp->h, NULL))
 		return 0;
+
 	exp_put(exp);
 	return svc_export_show(m, cd, cp);
 }
--- linux-qcom-6.8.0.orig/fs/nfsd/filecache.c
+++ linux-qcom-6.8.0/fs/nfsd/filecache.c
@@ -219,6 +219,7 @@
 		return NULL;
 
 	INIT_LIST_HEAD(&nf->nf_lru);
+	INIT_LIST_HEAD(&nf->nf_gc);
 	nf->nf_birthtime = ktime_get();
 	nf->nf_file = NULL;
 	nf->nf_cred = get_current_cred();
@@ -396,8 +397,8 @@
 	struct nfsd_file *nf;
 
 	while (!list_empty(dispose)) {
-		nf = list_first_entry(dispose, struct nfsd_file, nf_lru);
-		list_del_init(&nf->nf_lru);
+		nf = list_first_entry(dispose, struct nfsd_file, nf_gc);
+		list_del_init(&nf->nf_gc);
 		nfsd_file_free(nf);
 	}
 }
@@ -414,12 +415,12 @@
 {
 	while(!list_empty(dispose)) {
 		struct nfsd_file *nf = list_first_entry(dispose,
-						struct nfsd_file, nf_lru);
+						struct nfsd_file, nf_gc);
 		struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id);
 		struct nfsd_fcache_disposal *l = nn->fcache_disposal;
 
 		spin_lock(&l->lock);
-		list_move_tail(&nf->nf_lru, &l->freeme);
+		list_move_tail(&nf->nf_gc, &l->freeme);
 		spin_unlock(&l->lock);
 		queue_work(nfsd_filecache_wq, &l->work);
 	}
@@ -476,7 +477,8 @@
 
 	/* Refcount went to zero. Unhash it and queue it to the dispose list */
 	nfsd_file_unhash(nf);
-	list_lru_isolate_move(lru, &nf->nf_lru, head);
+	list_lru_isolate(lru, &nf->nf_lru);
+	list_add(&nf->nf_gc, head);
 	this_cpu_inc(nfsd_file_evictions);
 	trace_nfsd_file_gc_disposed(nf);
 	return LRU_REMOVED;
@@ -551,7 +553,7 @@
 
 	/* If refcount goes to 0, then put on the dispose list */
 	if (refcount_sub_and_test(decrement, &nf->nf_ref)) {
-		list_add(&nf->nf_lru, dispose);
+		list_add(&nf->nf_gc, dispose);
 		trace_nfsd_file_closing(nf);
 	}
 }
@@ -627,8 +629,8 @@
 
 	nfsd_file_queue_for_close(inode, &dispose);
 	while (!list_empty(&dispose)) {
-		nf = list_first_entry(&dispose, struct nfsd_file, nf_lru);
-		list_del_init(&nf->nf_lru);
+		nf = list_first_entry(&dispose, struct nfsd_file, nf_gc);
+		list_del_init(&nf->nf_gc);
 		nfsd_file_free(nf);
 	}
 	flush_delayed_fput();
@@ -714,7 +716,7 @@
 
 	ret = rhltable_init(&nfsd_file_rhltable, &nfsd_file_rhash_params);
 	if (ret)
-		return ret;
+		goto out;
 
 	ret = -ENOMEM;
 	nfsd_filecache_wq = alloc_workqueue("nfsd_filecache", WQ_UNBOUND, 0);
@@ -773,6 +775,8 @@
 
 	INIT_DELAYED_WORK(&nfsd_filecache_laundrette, nfsd_file_gc_worker);
 out:
+	if (ret)
+		clear_bit(NFSD_FILE_CACHE_UP, &nfsd_file_flags);
 	return ret;
 out_notifier:
 	lease_unregister_notifier(&nfsd_file_lease_notifier);
@@ -1043,8 +1047,6 @@
 	if (likely(ret == 0))
 		goto open_file;
 
-	if (ret == -EEXIST)
-		goto retry;
 	trace_nfsd_file_insert_err(rqstp, inode, may_flags, ret);
 	status = nfserr_jukebox;
 	goto construction_err;
@@ -1059,6 +1061,7 @@
 			status = nfserr_jukebox;
 			goto construction_err;
 		}
+		nfsd_file_put(nf);
 		open_retry = false;
 		fh_put(fhp);
 		goto retry;
--- linux-qcom-6.8.0.orig/fs/nfsd/filecache.h
+++ linux-qcom-6.8.0/fs/nfsd/filecache.h
@@ -44,6 +44,7 @@
 
 	struct nfsd_file_mark	*nf_mark;
 	struct list_head	nf_lru;
+	struct list_head	nf_gc;
 	struct rcu_head		nf_rcu;
 	ktime_t			nf_birthtime;
 };
--- linux-qcom-6.8.0.orig/fs/nfsd/netns.h
+++ linux-qcom-6.8.0/fs/nfsd/netns.h
@@ -11,8 +11,10 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <linux/filelock.h>
+#include <linux/nfs4.h>
 #include <linux/percpu_counter.h>
 #include <linux/siphash.h>
+#include <linux/sunrpc/stats.h>
 
 /* Hash tables for nfs4_clientid state */
 #define CLIENT_HASH_BITS                 4
@@ -26,10 +28,22 @@
 
 enum {
 	/* cache misses due only to checksum comparison failures */
-	NFSD_NET_PAYLOAD_MISSES,
+	NFSD_STATS_PAYLOAD_MISSES,
 	/* amount of memory (in bytes) currently consumed by the DRC */
-	NFSD_NET_DRC_MEM_USAGE,
-	NFSD_NET_COUNTERS_NUM
+	NFSD_STATS_DRC_MEM_USAGE,
+	NFSD_STATS_RC_HITS,		/* repcache hits */
+	NFSD_STATS_RC_MISSES,		/* repcache misses */
+	NFSD_STATS_RC_NOCACHE,		/* uncached reqs */
+	NFSD_STATS_FH_STALE,		/* FH stale error */
+	NFSD_STATS_IO_READ,		/* bytes returned to read requests */
+	NFSD_STATS_IO_WRITE,		/* bytes passed in write requests */
+#ifdef CONFIG_NFSD_V4
+	NFSD_STATS_FIRST_NFS4_OP,	/* count of individual nfsv4 operations */
+	NFSD_STATS_LAST_NFS4_OP = NFSD_STATS_FIRST_NFS4_OP + LAST_NFS4_OP,
+#define NFSD_STATS_NFS4_OP(op)	(NFSD_STATS_FIRST_NFS4_OP + (op))
+	NFSD_STATS_WDELEG_GETATTR,	/* count of getattr conflict with wdeleg */
+#endif
+	NFSD_STATS_COUNTERS_NUM
 };
 
 /*
@@ -134,6 +148,7 @@
 	u32		s2s_cp_cl_id;
 	struct idr	s2s_cp_stateids;
 	spinlock_t	s2s_cp_lock;
+	atomic_t	pending_async_copies;
 
 	/*
 	 * Version information
@@ -164,7 +179,10 @@
 	atomic_t                 num_drc_entries;
 
 	/* Per-netns stats counters */
-	struct percpu_counter    counter[NFSD_NET_COUNTERS_NUM];
+	struct percpu_counter    counter[NFSD_STATS_COUNTERS_NUM];
+
+	/* sunrpc svc stats */
+	struct svc_stat          nfsd_svcstats;
 
 	/* longest hash chain seen */
 	unsigned int             longest_chain;
--- linux-qcom-6.8.0.orig/fs/nfsd/nfs4callback.c
+++ linux-qcom-6.8.0/fs/nfsd/nfs4callback.c
@@ -85,7 +85,21 @@
 static void encode_bitmap4(struct xdr_stream *xdr, const __u32 *bitmap,
 			   size_t len)
 {
-	WARN_ON_ONCE(xdr_stream_encode_uint32_array(xdr, bitmap, len) < 0);
+	xdr_stream_encode_uint32_array(xdr, bitmap, len);
+}
+
+static int decode_cb_fattr4(struct xdr_stream *xdr, uint32_t *bitmap,
+				struct nfs4_cb_fattr *fattr)
+{
+	fattr->ncf_cb_change = 0;
+	fattr->ncf_cb_fsize = 0;
+	if (bitmap[0] & FATTR4_WORD0_CHANGE)
+		if (xdr_stream_decode_u64(xdr, &fattr->ncf_cb_change) < 0)
+			return -NFSERR_BAD_XDR;
+	if (bitmap[0] & FATTR4_WORD0_SIZE)
+		if (xdr_stream_decode_u64(xdr, &fattr->ncf_cb_fsize) < 0)
+			return -NFSERR_BAD_XDR;
+	return 0;
 }
 
 static void encode_nfs_cb_opnum4(struct xdr_stream *xdr, enum nfs_cb_opnum4 op)
@@ -273,17 +287,17 @@
 	u32 length;
 	__be32 *p;
 
-	p = xdr_inline_decode(xdr, 4 + 4);
+	p = xdr_inline_decode(xdr, XDR_UNIT);
 	if (unlikely(p == NULL))
 		goto out_overflow;
-	hdr->status = be32_to_cpup(p++);
+	hdr->status = be32_to_cpup(p);
 	/* Ignore the tag */
-	length = be32_to_cpup(p++);
-	p = xdr_inline_decode(xdr, length + 4);
-	if (unlikely(p == NULL))
+	if (xdr_stream_decode_u32(xdr, &length) < 0)
+		goto out_overflow;
+	if (xdr_inline_decode(xdr, length) == NULL)
+		goto out_overflow;
+	if (xdr_stream_decode_u32(xdr, &hdr->nops) < 0)
 		goto out_overflow;
-	p += XDR_QUADLEN(length);
-	hdr->nops = be32_to_cpup(p);
 	return 0;
 out_overflow:
 	return -EIO;
@@ -334,6 +348,30 @@
 }
 
 /*
+ * CB_GETATTR4args
+ *	struct CB_GETATTR4args {
+ *	   nfs_fh4 fh;
+ *	   bitmap4 attr_request;
+ *	};
+ *
+ * The size and change attributes are the only one
+ * guaranteed to be serviced by the client.
+ */
+static void
+encode_cb_getattr4args(struct xdr_stream *xdr, struct nfs4_cb_compound_hdr *hdr,
+			struct nfs4_cb_fattr *fattr)
+{
+	struct nfs4_delegation *dp =
+		container_of(fattr, struct nfs4_delegation, dl_cb_fattr);
+	struct knfsd_fh *fh = &dp->dl_stid.sc_file->fi_fhandle;
+
+	encode_nfs_cb_opnum4(xdr, OP_CB_GETATTR);
+	encode_nfs_fh4(xdr, fh);
+	encode_bitmap4(xdr, fattr->ncf_cb_bmap, ARRAY_SIZE(fattr->ncf_cb_bmap));
+	hdr->nops++;
+}
+
+/*
  * CB_SEQUENCE4args
  *
  *	struct CB_SEQUENCE4args {
@@ -469,6 +507,26 @@
 }
 
 /*
+ * 20.1.  Operation 3: CB_GETATTR - Get Attributes
+ */
+static void nfs4_xdr_enc_cb_getattr(struct rpc_rqst *req,
+		struct xdr_stream *xdr, const void *data)
+{
+	const struct nfsd4_callback *cb = data;
+	struct nfs4_cb_fattr *ncf =
+		container_of(cb, struct nfs4_cb_fattr, ncf_getattr);
+	struct nfs4_cb_compound_hdr hdr = {
+		.ident = cb->cb_clp->cl_cb_ident,
+		.minorversion = cb->cb_clp->cl_minorversion,
+	};
+
+	encode_cb_compound4args(xdr, &hdr);
+	encode_cb_sequence4args(xdr, cb, &hdr);
+	encode_cb_getattr4args(xdr, &hdr, ncf);
+	encode_cb_nops(&hdr);
+}
+
+/*
  * 20.2. Operation 4: CB_RECALL - Recall a Delegation
  */
 static void nfs4_xdr_enc_cb_recall(struct rpc_rqst *req, struct xdr_stream *xdr,
@@ -524,6 +582,42 @@
 }
 
 /*
+ * 20.1.  Operation 3: CB_GETATTR - Get Attributes
+ */
+static int nfs4_xdr_dec_cb_getattr(struct rpc_rqst *rqstp,
+				  struct xdr_stream *xdr,
+				  void *data)
+{
+	struct nfsd4_callback *cb = data;
+	struct nfs4_cb_compound_hdr hdr;
+	int status;
+	u32 bitmap[3] = {0};
+	u32 attrlen;
+	struct nfs4_cb_fattr *ncf =
+		container_of(cb, struct nfs4_cb_fattr, ncf_getattr);
+
+	status = decode_cb_compound4res(xdr, &hdr);
+	if (unlikely(status))
+		return status;
+
+	status = decode_cb_sequence4res(xdr, cb);
+	if (unlikely(status || cb->cb_seq_status))
+		return status;
+
+	status = decode_cb_op_status(xdr, OP_CB_GETATTR, &cb->cb_status);
+	if (status)
+		return status;
+	if (xdr_stream_decode_uint32_array(xdr, bitmap, 3) < 0)
+		return -NFSERR_BAD_XDR;
+	if (xdr_stream_decode_u32(xdr, &attrlen) < 0)
+		return -NFSERR_BAD_XDR;
+	if (attrlen > (sizeof(ncf->ncf_cb_change) + sizeof(ncf->ncf_cb_fsize)))
+		return -NFSERR_BAD_XDR;
+	status = decode_cb_fattr4(xdr, bitmap, ncf);
+	return status;
+}
+
+/*
  * 20.2. Operation 4: CB_RECALL - Recall a Delegation
  */
 static int nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp,
@@ -831,6 +925,7 @@
 	PROC(CB_NOTIFY_LOCK,	COMPOUND,	cb_notify_lock,	cb_notify_lock),
 	PROC(CB_OFFLOAD,	COMPOUND,	cb_offload,	cb_offload),
 	PROC(CB_RECALL_ANY,	COMPOUND,	cb_recall_any,	cb_recall_any),
+	PROC(CB_GETATTR,	COMPOUND,	cb_getattr,	cb_getattr),
 };
 
 static unsigned int nfs4_cb_counts[ARRAY_SIZE(nfs4_cb_procedures)];
@@ -962,7 +1057,7 @@
 		args.authflavor = clp->cl_cred.cr_flavor;
 		clp->cl_cb_ident = conn->cb_ident;
 	} else {
-		if (!conn->cb_xprt)
+		if (!conn->cb_xprt || !ses)
 			return -EINVAL;
 		clp->cl_cb_session = ses;
 		args.bc_xprt = conn->cb_xprt;
@@ -1178,6 +1273,7 @@
 		ret = false;
 		break;
 	case -NFS4ERR_DELAY:
+		cb->cb_seq_status = 1;
 		if (!rpc_restart_call(task))
 			goto out;
 
--- linux-qcom-6.8.0.orig/fs/nfsd/nfs4idmap.c
+++ linux-qcom-6.8.0/fs/nfsd/nfs4idmap.c
@@ -581,6 +581,7 @@
 		.id = id,
 		.type = type,
 	};
+	__be32 status = nfs_ok;
 	__be32 *p;
 	int ret;
 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
@@ -593,12 +594,16 @@
 		return nfserrno(ret);
 	ret = strlen(item->name);
 	WARN_ON_ONCE(ret > IDMAP_NAMESZ);
+
 	p = xdr_reserve_space(xdr, ret + 4);
-	if (!p)
-		return nfserr_resource;
-	p = xdr_encode_opaque(p, item->name, ret);
+	if (unlikely(!p)) {
+		status = nfserr_resource;
+		goto out_put;
+	}
+	xdr_encode_opaque(p, item->name, ret);
+out_put:
 	cache_put(&item->h, nn->idtoname_cache);
-	return 0;
+	return status;
 }
 
 static bool
--- linux-qcom-6.8.0.orig/fs/nfsd/nfs4proc.c
+++ linux-qcom-6.8.0/fs/nfsd/nfs4proc.c
@@ -751,15 +751,6 @@
 			   &access->ac_supported);
 }
 
-static void gen_boot_verifier(nfs4_verifier *verifier, struct net *net)
-{
-	__be32 *verf = (__be32 *)verifier->data;
-
-	BUILD_BUG_ON(2*sizeof(*verf) != sizeof(verifier->data));
-
-	nfsd_copy_write_verifier(verf, net_generic(net, nfsd_net_id));
-}
-
 static __be32
 nfsd4_commit(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 	     union nfsd4_op_u *u)
@@ -1285,6 +1276,7 @@
 {
 	if (!refcount_dec_and_test(&copy->refcount))
 		return;
+	atomic_dec(&copy->cp_nn->pending_async_copies);
 	kfree(copy->cp_src);
 	kfree(copy);
 }
@@ -1296,7 +1288,7 @@
 	nfs4_put_copy(copy);
 }
 
-static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp)
+static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp)
 {
 	struct nfsd4_copy *copy = NULL;
 
@@ -1305,6 +1297,9 @@
 		copy = list_first_entry(&clp->async_copies, struct nfsd4_copy,
 					copies);
 		refcount_inc(&copy->refcount);
+		copy->cp_clp = NULL;
+		if (!list_empty(&copy->copies))
+			list_del_init(&copy->copies);
 	}
 	spin_unlock(&clp->async_lock);
 	return copy;
@@ -1314,7 +1309,7 @@
 {
 	struct nfsd4_copy *copy;
 
-	while ((copy = nfsd4_get_copy(clp)) != NULL)
+	while ((copy = nfsd4_unhash_copy(clp)) != NULL)
 		nfsd4_stop_copy(copy);
 }
 #ifdef CONFIG_NFSD_V4_2_INTER_SSC
@@ -1627,7 +1622,6 @@
 		test_bit(NFSD4_COPY_F_COMMITTED, &copy->cp_flags) ?
 			NFS_FILE_SYNC : NFS_UNSTABLE;
 	nfsd4_copy_set_sync(copy, sync);
-	gen_boot_verifier(&copy->cp_res.wr_verifier, copy->cp_clp->net);
 }
 
 static ssize_t _nfsd_copy_file_range(struct nfsd4_copy *copy,
@@ -1800,9 +1794,14 @@
 nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 		union nfsd4_op_u *u)
 {
+	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
+	struct nfsd4_copy *async_copy = NULL;
 	struct nfsd4_copy *copy = &u->copy;
+	struct nfsd42_write_res *result;
 	__be32 status;
-	struct nfsd4_copy *async_copy = NULL;
+
+	result = &copy->cp_res;
+	nfsd_copy_write_verifier((__be32 *)&result->wr_verifier.data, nn);
 
 	copy->cp_clp = cstate->clp;
 	if (nfsd4_ssc_is_inter(copy)) {
@@ -1828,21 +1827,23 @@
 	memcpy(&copy->fh, &cstate->current_fh.fh_handle,
 		sizeof(struct knfsd_fh));
 	if (nfsd4_copy_is_async(copy)) {
-		struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
-
-		status = nfserrno(-ENOMEM);
 		async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL);
 		if (!async_copy)
 			goto out_err;
+		async_copy->cp_nn = nn;
 		INIT_LIST_HEAD(&async_copy->copies);
 		refcount_set(&async_copy->refcount, 1);
+		/* Arbitrary cap on number of pending async copy operations */
+		if (atomic_inc_return(&nn->pending_async_copies) >
+				(int)rqstp->rq_pool->sp_nrthreads)
+			goto out_err;
 		async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL);
 		if (!async_copy->cp_src)
 			goto out_err;
 		if (!nfs4_init_copy_state(nn, copy))
 			goto out_err;
-		memcpy(&copy->cp_res.cb_stateid, &copy->cp_stateid.cs_stid,
-			sizeof(copy->cp_res.cb_stateid));
+		memcpy(&result->cb_stateid, &copy->cp_stateid.cs_stid,
+			sizeof(result->cb_stateid));
 		dup_copy_fields(copy, async_copy);
 		async_copy->copy_task = kthread_create(nfsd4_do_async_copy,
 				async_copy, "%s", "copy thread");
@@ -1873,7 +1874,7 @@
 	}
 	if (async_copy)
 		cleanup_async_copy(async_copy);
-	status = nfserrno(-ENOMEM);
+	status = nfserr_jukebox;
 	goto out;
 }
 
@@ -2231,7 +2232,7 @@
 	const struct nfsd4_layout_ops *ops;
 	struct nfs4_layout_stateid *ls;
 	__be32 nfserr;
-	int accmode = NFSD_MAY_READ_IF_EXEC;
+	int accmode = NFSD_MAY_READ_IF_EXEC | NFSD_MAY_OWNER_OVERRIDE;
 
 	switch (lgp->lg_seg.iomode) {
 	case IOMODE_READ:
@@ -2321,7 +2322,8 @@
 	struct nfs4_layout_stateid *ls;
 	__be32 nfserr;
 
-	nfserr = fh_verify(rqstp, current_fh, 0, NFSD_MAY_WRITE);
+	nfserr = fh_verify(rqstp, current_fh, 0,
+			   NFSD_MAY_WRITE | NFSD_MAY_OWNER_OVERRIDE);
 	if (nfserr)
 		goto out;
 
@@ -2490,10 +2492,10 @@
 	return rpc_success;
 }
 
-static inline void nfsd4_increment_op_stats(u32 opnum)
+static inline void nfsd4_increment_op_stats(struct nfsd_net *nn, u32 opnum)
 {
 	if (opnum >= FIRST_NFS4_OP && opnum <= LAST_NFS4_OP)
-		percpu_counter_inc(&nfsdstats.counter[NFSD_STATS_NFS4_OP(opnum)]);
+		percpu_counter_inc(&nn->counter[NFSD_STATS_NFS4_OP(opnum)]);
 }
 
 static const struct nfsd4_operation nfsd4_ops[];
@@ -2768,7 +2770,7 @@
 					   status, nfsd4_op_name(op->opnum));
 
 		nfsd4_cstate_clear_replay(cstate);
-		nfsd4_increment_op_stats(op->opnum);
+		nfsd4_increment_op_stats(nn, op->opnum);
 	}
 
 	fh_put(current_fh);
--- linux-qcom-6.8.0.orig/fs/nfsd/nfs4recover.c
+++ linux-qcom-6.8.0/fs/nfsd/nfs4recover.c
@@ -659,7 +659,8 @@
 		return status;
 	status = -ENOTDIR;
 	if (d_is_dir(path.dentry)) {
-		strcpy(user_recovery_dirname, recdir);
+		strscpy(user_recovery_dirname, recdir,
+			sizeof(user_recovery_dirname));
 		status = 0;
 	}
 	path_put(&path);
@@ -809,6 +810,10 @@
 			ci = &cmsg->cm_u.cm_clntinfo;
 			if (get_user(namelen, &ci->cc_name.cn_len))
 				return -EFAULT;
+			if (!namelen) {
+				dprintk("%s: namelen should not be zero", __func__);
+				return -EINVAL;
+			}
 			name.data = memdup_user(&ci->cc_name.cn_id, namelen);
 			if (IS_ERR(name.data))
 				return PTR_ERR(name.data);
@@ -831,6 +836,10 @@
 			cnm = &cmsg->cm_u.cm_name;
 			if (get_user(namelen, &cnm->cn_len))
 				return -EFAULT;
+			if (!namelen) {
+				dprintk("%s: namelen should not be zero", __func__);
+				return -EINVAL;
+			}
 			name.data = memdup_user(&cnm->cn_id, namelen);
 			if (IS_ERR(name.data))
 				return PTR_ERR(name.data);
@@ -2086,8 +2095,8 @@
 	status = nn->client_tracking_ops->init(net);
 out:
 	if (status) {
-		printk(KERN_WARNING "NFSD: Unable to initialize client "
-				    "recovery tracking! (%d)\n", status);
+		pr_warn("NFSD: Unable to initialize client recovery tracking! (%d)\n", status);
+		pr_warn("NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING.\n");
 		nn->client_tracking_ops = NULL;
 	}
 	return status;
--- linux-qcom-6.8.0.orig/fs/nfsd/nfs4state.c
+++ linux-qcom-6.8.0/fs/nfsd/nfs4state.c
@@ -1087,7 +1087,8 @@
  * When a delegation is recalled, the filehandle is stored in the "new"
  * filter.
  * Every 30 seconds we swap the filters and clear the "new" one,
- * unless both are empty of course.
+ * unless both are empty of course.  This results in delegations for a
+ * given filehandle being blocked for between 30 and 60 seconds.
  *
  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
  * low 3 bytes as hash-table indices.
@@ -1116,9 +1117,9 @@
 		if (ktime_get_seconds() - bd->swap_time > 30) {
 			bd->entries -= bd->old_entries;
 			bd->old_entries = bd->entries;
+			bd->new = 1-bd->new;
 			memset(bd->set[bd->new], 0,
 			       sizeof(bd->set[0]));
-			bd->new = 1-bd->new;
 			bd->swap_time = ktime_get_seconds();
 		}
 		spin_unlock(&blocked_delegations_lock);
@@ -1626,6 +1627,14 @@
 	free_ol_stateid_reaplist(&reaplist);
 }
 
+static bool nfs4_openowner_unhashed(struct nfs4_openowner *oo)
+{
+	lockdep_assert_held(&oo->oo_owner.so_client->cl_lock);
+
+	return list_empty(&oo->oo_owner.so_strhash) &&
+		list_empty(&oo->oo_perclient);
+}
+
 static void unhash_openowner_locked(struct nfs4_openowner *oo)
 {
 	struct nfs4_client *clp = oo->oo_owner.so_client;
@@ -2888,12 +2897,9 @@
 nfsd4_cb_recall_any_release(struct nfsd4_callback *cb)
 {
 	struct nfs4_client *clp = cb->cb_clp;
-	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 
-	spin_lock(&nn->client_lock);
 	clear_bit(NFSD4_CLIENT_CB_RECALL_ANY, &clp->cl_flags);
-	put_client_renew_locked(clp);
-	spin_unlock(&nn->client_lock);
+	drop_client(clp);
 }
 
 static const struct nfsd4_callback_ops nfsd4_cb_recall_any_ops = {
@@ -4635,6 +4641,12 @@
 	spin_lock(&oo->oo_owner.so_client->cl_lock);
 	spin_lock(&fp->fi_lock);
 
+	if (nfs4_openowner_unhashed(oo)) {
+		mutex_unlock(&stp->st_mutex);
+		stp = NULL;
+		goto out_unlock;
+	}
+
 	retstp = nfsd4_find_existing_open(fp, open);
 	if (retstp)
 		goto out_unlock;
@@ -5754,6 +5766,11 @@
 
 	if (!stp) {
 		stp = init_open_stateid(fp, open);
+		if (!stp) {
+			status = nfserr_jukebox;
+			goto out;
+		}
+
 		if (!open->op_stp)
 			new_stp = true;
 	}
@@ -6274,7 +6291,7 @@
 		list_add(&clp->cl_ra_cblist, &cblist);
 
 		/* release in nfsd4_cb_recall_any_release */
-		atomic_inc(&clp->cl_rpc_users);
+		kref_get(&clp->cl_nfsdfs.cl_ref);
 		set_bit(NFSD4_CLIENT_CB_RECALL_ANY, &clp->cl_flags);
 		clp->cl_ra_time = ktime_get_boottime_seconds();
 	}
@@ -8165,6 +8182,7 @@
 	spin_lock_init(&nn->client_lock);
 	spin_lock_init(&nn->s2s_cp_lock);
 	idr_init(&nn->s2s_cp_stateids);
+	atomic_set(&nn->pending_async_copies, 0);
 
 	spin_lock_init(&nn->blocked_locks_lock);
 	INIT_LIST_HEAD(&nn->blocked_locks_lru);
@@ -8281,7 +8299,7 @@
 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 
 	shrinker_free(nn->nfsd_client_shrinker);
-	cancel_work(&nn->nfsd_shrinker_work);
+	cancel_work_sync(&nn->nfsd_shrinker_work);
 	cancel_delayed_work_sync(&nn->laundromat_work);
 	locks_end_grace(&nn->nfsd4_manager);
 
@@ -8450,6 +8468,7 @@
 nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode)
 {
 	__be32 status;
+	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
 	struct file_lock_context *ctx;
 	struct file_lock *fl;
 	struct nfs4_delegation *dp;
@@ -8479,7 +8498,7 @@
 			}
 break_lease:
 			spin_unlock(&ctx->flc_lock);
-			nfsd_stats_wdeleg_getattr_inc();
+			nfsd_stats_wdeleg_getattr_inc(nn);
 			status = nfserrno(nfsd_open_break_lease(inode, NFSD_MAY_READ));
 			if (status != nfserr_jukebox ||
 					!nfsd_wait_for_delegreturn(rqstp, inode))
--- linux-qcom-6.8.0.orig/fs/nfsd/nfs4xdr.c
+++ linux-qcom-6.8.0/fs/nfsd/nfs4xdr.c
@@ -1246,14 +1246,6 @@
 }
 
 static __be32
-nfsd4_decode_putpubfh(struct nfsd4_compoundargs *argp, union nfsd4_op_u *p)
-{
-	if (argp->minorversion == 0)
-		return nfs_ok;
-	return nfserr_notsupp;
-}
-
-static __be32
 nfsd4_decode_read(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
 {
 	struct nfsd4_read *read = &u->read;
@@ -2345,7 +2337,7 @@
 	[OP_OPEN_CONFIRM]	= nfsd4_decode_open_confirm,
 	[OP_OPEN_DOWNGRADE]	= nfsd4_decode_open_downgrade,
 	[OP_PUTFH]		= nfsd4_decode_putfh,
-	[OP_PUTPUBFH]		= nfsd4_decode_putpubfh,
+	[OP_PUTPUBFH]		= nfsd4_decode_noop,
 	[OP_PUTROOTFH]		= nfsd4_decode_noop,
 	[OP_READ]		= nfsd4_decode_read,
 	[OP_READDIR]		= nfsd4_decode_readdir,
@@ -2806,11 +2798,11 @@
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
 static inline __be32
 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
-			    void *context, int len)
+			    const struct lsmcontext *context)
 {
 	__be32 *p;
 
-	p = xdr_reserve_space(xdr, len + 4 + 4 + 4);
+	p = xdr_reserve_space(xdr, context->len + 4 + 4 + 4);
 	if (!p)
 		return nfserr_resource;
 
@@ -2820,13 +2812,13 @@
 	 */
 	*p++ = cpu_to_be32(0); /* lfs */
 	*p++ = cpu_to_be32(0); /* pi */
-	p = xdr_encode_opaque(p, context, len);
+	p = xdr_encode_opaque(p, context->context, context->len);
 	return 0;
 }
 #else
 static inline __be32
 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
-			    void *context, int len)
+			    struct lsmcontext *context)
 { return 0; }
 #endif
 
@@ -2909,8 +2901,7 @@
 	struct nfs4_acl		*acl;
 	u64			size;
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
-	void			*context;
-	int			contextlen;
+	struct lsmcontext	context;
 #endif
 	u32			rdattr_err;
 	bool			contextsupport;
@@ -3365,8 +3356,7 @@
 static __be32 nfsd4_encode_fattr4_sec_label(struct xdr_stream *xdr,
 					    const struct nfsd4_fattr_args *args)
 {
-	return nfsd4_encode_security_label(xdr, args->rqstp,
-					   args->context, args->contextlen);
+	return nfsd4_encode_security_label(xdr, args->rqstp, &args->context);
 }
 #endif
 
@@ -3490,11 +3480,13 @@
 		    struct dentry *dentry, const u32 *bmval,
 		    int ignore_crossmnt)
 {
+	DECLARE_BITMAP(attr_bitmap, ARRAY_SIZE(nfsd4_enc_fattr4_encode_ops));
 	struct nfsd4_fattr_args args;
 	struct svc_fh *tempfh = NULL;
 	int starting_len = xdr->buf->len;
 	__be32 *attrlen_p, status;
 	int attrlen_offset;
+	u32 attrmask[3];
 	int err;
 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
 	u32 minorversion = resp->cstate.minorversion;
@@ -3502,10 +3494,6 @@
 		.mnt	= exp->ex_path.mnt,
 		.dentry	= dentry,
 	};
-	union {
-		u32		attrmask[3];
-		unsigned long	mask[2];
-	} u;
 	unsigned long bit;
 
 	WARN_ON_ONCE(bmval[1] & NFSD_WRITEONLY_ATTRS_WORD1);
@@ -3515,24 +3503,27 @@
 	args.exp = exp;
 	args.dentry = dentry;
 	args.ignore_crossmnt = (ignore_crossmnt != 0);
+	args.acl = NULL;
+#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+	args.context.context = NULL;
+#endif
 
 	/*
 	 * Make a local copy of the attribute bitmap that can be modified.
 	 */
-	memset(&u, 0, sizeof(u));
-	u.attrmask[0] = bmval[0];
-	u.attrmask[1] = bmval[1];
-	u.attrmask[2] = bmval[2];
+	attrmask[0] = bmval[0];
+	attrmask[1] = bmval[1];
+	attrmask[2] = bmval[2];
 
 	args.rdattr_err = 0;
 	if (exp->ex_fslocs.migrated) {
-		status = fattr_handle_absent_fs(&u.attrmask[0], &u.attrmask[1],
-						&u.attrmask[2], &args.rdattr_err);
+		status = fattr_handle_absent_fs(&attrmask[0], &attrmask[1],
+						&attrmask[2], &args.rdattr_err);
 		if (status)
 			goto out;
 	}
 	args.size = 0;
-	if (u.attrmask[0] & (FATTR4_WORD0_CHANGE | FATTR4_WORD0_SIZE)) {
+	if (attrmask[0] & (FATTR4_WORD0_CHANGE | FATTR4_WORD0_SIZE)) {
 		status = nfsd4_deleg_getattr_conflict(rqstp, d_inode(dentry));
 		if (status)
 			goto out;
@@ -3547,16 +3538,16 @@
 
 	if (!(args.stat.result_mask & STATX_BTIME))
 		/* underlying FS does not offer btime so we can't share it */
-		u.attrmask[1] &= ~FATTR4_WORD1_TIME_CREATE;
-	if ((u.attrmask[0] & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE |
+		attrmask[1] &= ~FATTR4_WORD1_TIME_CREATE;
+	if ((attrmask[0] & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE |
 			FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) ||
-	    (u.attrmask[1] & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
+	    (attrmask[1] & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
 		       FATTR4_WORD1_SPACE_TOTAL))) {
 		err = vfs_statfs(&path, &args.statfs);
 		if (err)
 			goto out_nfserr;
 	}
-	if ((u.attrmask[0] & (FATTR4_WORD0_FILEHANDLE | FATTR4_WORD0_FSID)) &&
+	if ((attrmask[0] & (FATTR4_WORD0_FILEHANDLE | FATTR4_WORD0_FSID)) &&
 	    !fhp) {
 		tempfh = kmalloc(sizeof(struct svc_fh), GFP_KERNEL);
 		status = nfserr_jukebox;
@@ -3570,11 +3561,10 @@
 	} else
 		args.fhp = fhp;
 
-	args.acl = NULL;
-	if (u.attrmask[0] & FATTR4_WORD0_ACL) {
+	if (attrmask[0] & FATTR4_WORD0_ACL) {
 		err = nfsd4_get_nfs4_acl(rqstp, dentry, &args.acl);
 		if (err == -EOPNOTSUPP)
-			u.attrmask[0] &= ~FATTR4_WORD0_ACL;
+			attrmask[0] &= ~FATTR4_WORD0_ACL;
 		else if (err == -EINVAL) {
 			status = nfserr_attrnotsupp;
 			goto out;
@@ -3585,18 +3575,17 @@
 	args.contextsupport = false;
 
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
-	args.context = NULL;
-	if ((u.attrmask[2] & FATTR4_WORD2_SECURITY_LABEL) ||
-	     u.attrmask[0] & FATTR4_WORD0_SUPPORTED_ATTRS) {
+	if ((attrmask[2] & FATTR4_WORD2_SECURITY_LABEL) ||
+	     attrmask[0] & FATTR4_WORD0_SUPPORTED_ATTRS) {
 		if (exp->ex_flags & NFSEXP_SECURITY_LABEL)
 			err = security_inode_getsecctx(d_inode(dentry),
-						&args.context, &args.contextlen);
+						       &args.context);
 		else
 			err = -EOPNOTSUPP;
 		args.contextsupport = (err == 0);
-		if (u.attrmask[2] & FATTR4_WORD2_SECURITY_LABEL) {
+		if (attrmask[2] & FATTR4_WORD2_SECURITY_LABEL) {
 			if (err == -EOPNOTSUPP)
-				u.attrmask[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
+				attrmask[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
 			else if (err)
 				goto out_nfserr;
 		}
@@ -3604,8 +3593,8 @@
 #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
 
 	/* attrmask */
-	status = nfsd4_encode_bitmap4(xdr, u.attrmask[0],
-				      u.attrmask[1], u.attrmask[2]);
+	status = nfsd4_encode_bitmap4(xdr, attrmask[0], attrmask[1],
+				      attrmask[2]);
 	if (status)
 		goto out;
 
@@ -3614,7 +3603,9 @@
 	attrlen_p = xdr_reserve_space(xdr, XDR_UNIT);
 	if (!attrlen_p)
 		goto out_resource;
-	for_each_set_bit(bit, (const unsigned long *)&u.mask,
+	bitmap_from_arr32(attr_bitmap, attrmask,
+			  ARRAY_SIZE(nfsd4_enc_fattr4_encode_ops));
+	for_each_set_bit(bit, attr_bitmap,
 			 ARRAY_SIZE(nfsd4_enc_fattr4_encode_ops)) {
 		status = nfsd4_enc_fattr4_encode_ops[bit](xdr, &args);
 		if (status != nfs_ok)
@@ -3625,8 +3616,8 @@
 
 out:
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
-	if (args.context)
-		security_release_secctx(args.context, args.contextlen);
+	if (args.context.context)
+		security_release_secctx(&args.context);
 #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
 	kfree(args.acl);
 	if (tempfh) {
--- linux-qcom-6.8.0.orig/fs/nfsd/nfscache.c
+++ linux-qcom-6.8.0/fs/nfsd/nfscache.c
@@ -176,27 +176,6 @@
 	kmem_cache_destroy(drc_slab);
 }
 
-/**
- * nfsd_net_reply_cache_init - per net namespace reply cache set-up
- * @nn: nfsd_net being initialized
- *
- * Returns zero on succes; otherwise a negative errno is returned.
- */
-int nfsd_net_reply_cache_init(struct nfsd_net *nn)
-{
-	return nfsd_percpu_counters_init(nn->counter, NFSD_NET_COUNTERS_NUM);
-}
-
-/**
- * nfsd_net_reply_cache_destroy - per net namespace reply cache tear-down
- * @nn: nfsd_net being freed
- *
- */
-void nfsd_net_reply_cache_destroy(struct nfsd_net *nn)
-{
-	nfsd_percpu_counters_destroy(nn->counter, NFSD_NET_COUNTERS_NUM);
-}
-
 int nfsd_reply_cache_init(struct nfsd_net *nn)
 {
 	unsigned int hashsize;
@@ -501,7 +480,7 @@
 int nfsd_cache_lookup(struct svc_rqst *rqstp, unsigned int start,
 		      unsigned int len, struct nfsd_cacherep **cacherep)
 {
-	struct nfsd_net		*nn;
+	struct nfsd_net		*nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
 	struct nfsd_cacherep	*rp, *found;
 	__wsum			csum;
 	struct nfsd_drc_bucket	*b;
@@ -510,7 +489,7 @@
 	int rtn = RC_DOIT;
 
 	if (type == RC_NOCACHE) {
-		nfsd_stats_rc_nocache_inc();
+		nfsd_stats_rc_nocache_inc(nn);
 		goto out;
 	}
 
@@ -520,7 +499,6 @@
 	 * Since the common case is a cache miss followed by an insert,
 	 * preallocate an entry.
 	 */
-	nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
 	rp = nfsd_cacherep_alloc(rqstp, csum, nn);
 	if (!rp)
 		goto out;
@@ -537,7 +515,7 @@
 
 	nfsd_cacherep_dispose(&dispose);
 
-	nfsd_stats_rc_misses_inc();
+	nfsd_stats_rc_misses_inc(nn);
 	atomic_inc(&nn->num_drc_entries);
 	nfsd_stats_drc_mem_usage_add(nn, sizeof(*rp));
 	goto out;
@@ -545,7 +523,7 @@
 found_entry:
 	/* We found a matching entry which is either in progress or done. */
 	nfsd_reply_cache_free_locked(NULL, rp, nn);
-	nfsd_stats_rc_hits_inc();
+	nfsd_stats_rc_hits_inc(nn);
 	rtn = RC_DROPIT;
 	rp = found;
 
@@ -687,15 +665,15 @@
 		   atomic_read(&nn->num_drc_entries));
 	seq_printf(m, "hash buckets:          %u\n", 1 << nn->maskbits);
 	seq_printf(m, "mem usage:             %lld\n",
-		   percpu_counter_sum_positive(&nn->counter[NFSD_NET_DRC_MEM_USAGE]));
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_DRC_MEM_USAGE]));
 	seq_printf(m, "cache hits:            %lld\n",
-		   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_RC_HITS]));
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_RC_HITS]));
 	seq_printf(m, "cache misses:          %lld\n",
-		   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_RC_MISSES]));
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_RC_MISSES]));
 	seq_printf(m, "not cached:            %lld\n",
-		   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_RC_NOCACHE]));
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_RC_NOCACHE]));
 	seq_printf(m, "payload misses:        %lld\n",
-		   percpu_counter_sum_positive(&nn->counter[NFSD_NET_PAYLOAD_MISSES]));
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_PAYLOAD_MISSES]));
 	seq_printf(m, "longest chain len:     %u\n", nn->longest_chain);
 	seq_printf(m, "cachesize at longest:  %u\n", nn->longest_chain_cachesize);
 	return 0;
--- linux-qcom-6.8.0.orig/fs/nfsd/nfsctl.c
+++ linux-qcom-6.8.0/fs/nfsd/nfsctl.c
@@ -48,12 +48,10 @@
 	NFSD_MaxBlkSize,
 	NFSD_MaxConnections,
 	NFSD_Filecache,
-#ifdef CONFIG_NFSD_V4
 	NFSD_Leasetime,
 	NFSD_Gracetime,
 	NFSD_RecoveryDir,
 	NFSD_V4EndGrace,
-#endif
 	NFSD_MaxReserved
 };
 
@@ -1359,7 +1357,9 @@
 #ifdef CONFIG_NFSD_V4
 		[NFSD_Leasetime] = {"nfsv4leasetime", &transaction_ops, S_IWUSR|S_IRUSR},
 		[NFSD_Gracetime] = {"nfsv4gracetime", &transaction_ops, S_IWUSR|S_IRUSR},
+#ifdef CONFIG_NFSD_LEGACY_CLIENT_TRACKING
 		[NFSD_RecoveryDir] = {"nfsv4recoverydir", &transaction_ops, S_IWUSR|S_IRUSR},
+#endif
 		[NFSD_V4EndGrace] = {"v4_end_grace", &transaction_ops, S_IWUSR|S_IRUGO},
 #endif
 		/* last one */ {""}
@@ -1671,14 +1671,19 @@
 	retval = nfsd_idmap_init(net);
 	if (retval)
 		goto out_idmap_error;
-	retval = nfsd_net_reply_cache_init(nn);
+	retval = nfsd_stat_counters_init(nn);
 	if (retval)
 		goto out_repcache_error;
+	memset(&nn->nfsd_svcstats, 0, sizeof(nn->nfsd_svcstats));
+	nn->nfsd_svcstats.program = &nfsd_program;
 	nn->nfsd_versions = NULL;
 	nn->nfsd4_minorversions = NULL;
+	nn->nfsd_info.mutex = &nfsd_mutex;
+	nn->nfsd_serv = NULL;
 	nfsd4_init_leases_net(nn);
 	get_random_bytes(&nn->siphash_key, sizeof(nn->siphash_key));
 	seqlock_init(&nn->writeverf_lock);
+	nfsd_proc_stat_init(net);
 
 	return 0;
 
@@ -1699,7 +1704,8 @@
 {
 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 
-	nfsd_net_reply_cache_destroy(nn);
+	nfsd_proc_stat_shutdown(net);
+	nfsd_stat_counters_destroy(nn);
 	nfsd_idmap_shutdown(net);
 	nfsd_export_shutdown(net);
 	nfsd_netns_free_versions(nn);
@@ -1722,12 +1728,9 @@
 	retval = nfsd4_init_pnfs();
 	if (retval)
 		goto out_free_slabs;
-	retval = nfsd_stat_init();	/* Statistics */
-	if (retval)
-		goto out_free_pnfs;
 	retval = nfsd_drc_slab_create();
 	if (retval)
-		goto out_free_stat;
+		goto out_free_pnfs;
 	nfsd_lockd_init();	/* lockd->nfsd callbacks */
 	retval = create_proc_exports_entry();
 	if (retval)
@@ -1761,8 +1764,6 @@
 out_free_lockd:
 	nfsd_lockd_shutdown();
 	nfsd_drc_slab_free();
-out_free_stat:
-	nfsd_stat_shutdown();
 out_free_pnfs:
 	nfsd4_exit_pnfs();
 out_free_slabs:
@@ -1780,7 +1781,6 @@
 	nfsd_drc_slab_free();
 	remove_proc_entry("fs/nfs/exports", NULL);
 	remove_proc_entry("fs/nfs", NULL);
-	nfsd_stat_shutdown();
 	nfsd_lockd_shutdown();
 	nfsd4_free_slabs();
 	nfsd4_exit_pnfs();
--- linux-qcom-6.8.0.orig/fs/nfsd/nfsd.h
+++ linux-qcom-6.8.0/fs/nfsd/nfsd.h
@@ -86,6 +86,7 @@
 extern spinlock_t		nfsd_drc_lock;
 extern unsigned long		nfsd_drc_max_mem;
 extern unsigned long		nfsd_drc_mem_used;
+extern atomic_t			nfsd_th_cnt;		/* number of available threads */
 
 extern const struct seq_operations nfs_exports_op;
 
--- linux-qcom-6.8.0.orig/fs/nfsd/nfsfh.c
+++ linux-qcom-6.8.0/fs/nfsd/nfsfh.c
@@ -327,6 +327,7 @@
 __be32
 fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type, int access)
 {
+	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
 	struct svc_export *exp = NULL;
 	struct dentry	*dentry;
 	__be32		error;
@@ -395,7 +396,7 @@
 out:
 	trace_nfsd_fh_verify_err(rqstp, fhp, type, access, error);
 	if (error == nfserr_stale)
-		nfsd_stats_fh_stale_inc(exp);
+		nfsd_stats_fh_stale_inc(nn, exp);
 	return error;
 }
 
@@ -572,7 +573,7 @@
 		_fh_update(fhp, exp, dentry);
 	if (fhp->fh_handle.fh_fileid_type == FILEID_INVALID) {
 		fh_put(fhp);
-		return nfserr_opnotsupp;
+		return nfserr_stale;
 	}
 
 	return 0;
@@ -598,7 +599,7 @@
 
 	_fh_update(fhp, fhp->fh_export, dentry);
 	if (fhp->fh_handle.fh_fileid_type == FILEID_INVALID)
-		return nfserr_opnotsupp;
+		return nfserr_stale;
 	return 0;
 out_bad:
 	printk(KERN_ERR "fh_update: fh not verified!\n");
--- linux-qcom-6.8.0.orig/fs/nfsd/nfssvc.c
+++ linux-qcom-6.8.0/fs/nfsd/nfssvc.c
@@ -34,6 +34,7 @@
 
 #define NFSDDBG_FACILITY	NFSDDBG_SVC
 
+atomic_t			nfsd_th_cnt = ATOMIC_INIT(0);
 extern struct svc_program	nfsd_program;
 static int			nfsd(void *vrqstp);
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
@@ -80,7 +81,6 @@
 unsigned long	nfsd_drc_mem_used;
 
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
-static struct svc_stat	nfsd_acl_svcstats;
 static const struct svc_version *nfsd_acl_version[] = {
 # if defined(CONFIG_NFSD_V2_ACL)
 	[2] = &nfsd_acl_version2,
@@ -99,15 +99,11 @@
 	.pg_vers		= nfsd_acl_version,
 	.pg_name		= "nfsacl",
 	.pg_class		= "nfsd",
-	.pg_stats		= &nfsd_acl_svcstats,
 	.pg_authenticate	= &svc_set_client,
 	.pg_init_request	= nfsd_acl_init_request,
 	.pg_rpcbind_set		= nfsd_acl_rpcbind_set,
 };
 
-static struct svc_stat	nfsd_acl_svcstats = {
-	.program	= &nfsd_acl_program,
-};
 #endif /* defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) */
 
 static const struct svc_version *nfsd_version[] = {
@@ -132,7 +128,6 @@
 	.pg_vers		= nfsd_version,		/* version table */
 	.pg_name		= "nfsd",		/* program name */
 	.pg_class		= "nfsd",		/* authentication class */
-	.pg_stats		= &nfsd_svcstats,	/* version table */
 	.pg_authenticate	= &svc_set_client,	/* export authentication */
 	.pg_init_request	= nfsd_init_request,
 	.pg_rpcbind_set		= nfsd_rpcbind_set,
@@ -455,6 +450,9 @@
 {
 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 
+	if (!nn->nfsd_net_up)
+		return;
+	nfsd_export_flush(net);
 	nfs4_state_shutdown_net(net);
 	nfsd_reply_cache_shutdown(nn);
 	nfsd_file_cache_shutdown_net(net);
@@ -562,11 +560,8 @@
 	 * other initialization has been done except the rpcb information.
 	 */
 	svc_rpcb_cleanup(serv, net);
-	if (!nn->nfsd_net_up)
-		return;
 
 	nfsd_shutdown_net(net);
-	nfsd_export_flush(net);
 	svc_destroy(&serv);
 }
 
@@ -666,7 +661,8 @@
 	if (nfsd_max_blksize == 0)
 		nfsd_max_blksize = nfsd_get_default_max_blksize();
 	nfsd_reset_versions(nn);
-	serv = svc_create_pooled(&nfsd_program, nfsd_max_blksize, nfsd);
+	serv = svc_create_pooled(&nfsd_program, &nn->nfsd_svcstats,
+				 nfsd_max_blksize, nfsd);
 	if (serv == NULL)
 		return -ENOMEM;
 
@@ -677,7 +673,6 @@
 		return error;
 	}
 	spin_lock(&nfsd_notifier_lock);
-	nn->nfsd_info.mutex = &nfsd_mutex;
 	nn->nfsd_serv = serv;
 	spin_unlock(&nfsd_notifier_lock);
 
@@ -711,7 +706,7 @@
 
 	if (serv)
 		for (i = 0; i < serv->sv_nrpools && i < n; i++)
-			nthreads[i] = atomic_read(&serv->sv_pools[i].sp_nrthreads);
+			nthreads[i] = serv->sv_pools[i].sp_nrthreads;
 	return 0;
 }
 
@@ -929,7 +924,7 @@
 
 	current->fs->umask = 0;
 
-	atomic_inc(&nfsdstats.th_cnt);
+	atomic_inc(&nfsd_th_cnt);
 
 	set_freezable();
 
@@ -943,7 +938,7 @@
 		svc_recv(rqstp);
 	}
 
-	atomic_dec(&nfsdstats.th_cnt);
+	atomic_dec(&nfsd_th_cnt);
 
 out:
 	/* Release the thread */
--- linux-qcom-6.8.0.orig/fs/nfsd/state.h
+++ linux-qcom-6.8.0/fs/nfsd/state.h
@@ -117,6 +117,16 @@
 	time64_t		cpntf_time;	/* last time stateid used */
 };
 
+struct nfs4_cb_fattr {
+	struct nfsd4_callback ncf_getattr;
+	u32 ncf_cb_status;
+	u32 ncf_cb_bmap[1];
+
+	/* from CB_GETATTR reply */
+	u64 ncf_cb_change;
+	u64 ncf_cb_fsize;
+};
+
 /*
  * Represents a delegation stateid. The nfs4_client holds references to these
  * and they are put when it is being destroyed or when the delegation is
@@ -150,6 +160,9 @@
 	int			dl_retries;
 	struct nfsd4_callback	dl_recall;
 	bool			dl_recalled;
+
+	/* for CB_GETATTR */
+	struct nfs4_cb_fattr    dl_cb_fattr;
 };
 
 #define cb_to_delegation(cb) \
@@ -640,6 +653,7 @@
 	NFSPROC4_CLNT_CB_SEQUENCE,
 	NFSPROC4_CLNT_CB_NOTIFY_LOCK,
 	NFSPROC4_CLNT_CB_RECALL_ANY,
+	NFSPROC4_CLNT_CB_GETATTR,
 };
 
 /* Returns true iff a is later than b: */
--- linux-qcom-6.8.0.orig/fs/nfsd/stats.c
+++ linux-qcom-6.8.0/fs/nfsd/stats.c
@@ -27,25 +27,22 @@
 
 #include "nfsd.h"
 
-struct nfsd_stats	nfsdstats;
-struct svc_stat		nfsd_svcstats = {
-	.program	= &nfsd_program,
-};
-
 static int nfsd_show(struct seq_file *seq, void *v)
 {
+	struct net *net = pde_data(file_inode(seq->file));
+	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 	int i;
 
 	seq_printf(seq, "rc %lld %lld %lld\nfh %lld 0 0 0 0\nio %lld %lld\n",
-		   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_RC_HITS]),
-		   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_RC_MISSES]),
-		   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_RC_NOCACHE]),
-		   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_FH_STALE]),
-		   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_IO_READ]),
-		   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_IO_WRITE]));
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_RC_HITS]),
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_RC_MISSES]),
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_RC_NOCACHE]),
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_FH_STALE]),
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_IO_READ]),
+		   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_IO_WRITE]));
 
 	/* thread usage: */
-	seq_printf(seq, "th %u 0", atomic_read(&nfsdstats.th_cnt));
+	seq_printf(seq, "th %u 0", atomic_read(&nfsd_th_cnt));
 
 	/* deprecated thread usage histogram stats */
 	for (i = 0; i < 10; i++)
@@ -55,7 +52,7 @@
 	seq_puts(seq, "\nra 0 0 0 0 0 0 0 0 0 0 0 0\n");
 
 	/* show my rpc info */
-	svc_seq_show(seq, &nfsd_svcstats);
+	svc_seq_show(seq, &nn->nfsd_svcstats);
 
 #ifdef CONFIG_NFSD_V4
 	/* Show count for individual nfsv4 operations */
@@ -63,10 +60,10 @@
 	seq_printf(seq, "proc4ops %u", LAST_NFS4_OP + 1);
 	for (i = 0; i <= LAST_NFS4_OP; i++) {
 		seq_printf(seq, " %lld",
-			   percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_NFS4_OP(i)]));
+			   percpu_counter_sum_positive(&nn->counter[NFSD_STATS_NFS4_OP(i)]));
 	}
 	seq_printf(seq, "\nwdeleg_getattr %lld",
-		percpu_counter_sum_positive(&nfsdstats.counter[NFSD_STATS_WDELEG_GETATTR]));
+		percpu_counter_sum_positive(&nn->counter[NFSD_STATS_WDELEG_GETATTR]));
 
 	seq_putc(seq, '\n');
 #endif
@@ -108,31 +105,24 @@
 		percpu_counter_destroy(&counters[i]);
 }
 
-static int nfsd_stat_counters_init(void)
+int nfsd_stat_counters_init(struct nfsd_net *nn)
 {
-	return nfsd_percpu_counters_init(nfsdstats.counter, NFSD_STATS_COUNTERS_NUM);
+	return nfsd_percpu_counters_init(nn->counter, NFSD_STATS_COUNTERS_NUM);
 }
 
-static void nfsd_stat_counters_destroy(void)
+void nfsd_stat_counters_destroy(struct nfsd_net *nn)
 {
-	nfsd_percpu_counters_destroy(nfsdstats.counter, NFSD_STATS_COUNTERS_NUM);
+	nfsd_percpu_counters_destroy(nn->counter, NFSD_STATS_COUNTERS_NUM);
 }
 
-int nfsd_stat_init(void)
+void nfsd_proc_stat_init(struct net *net)
 {
-	int err;
-
-	err = nfsd_stat_counters_init();
-	if (err)
-		return err;
+	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 
-	svc_proc_register(&init_net, &nfsd_svcstats, &nfsd_proc_ops);
-
-	return 0;
+	svc_proc_register(net, &nn->nfsd_svcstats, &nfsd_proc_ops);
 }
 
-void nfsd_stat_shutdown(void)
+void nfsd_proc_stat_shutdown(struct net *net)
 {
-	nfsd_stat_counters_destroy();
-	svc_proc_unregister(&init_net, "nfsd");
+	svc_proc_unregister(net, "nfsd");
 }
--- linux-qcom-6.8.0.orig/fs/nfsd/stats.h
+++ linux-qcom-6.8.0/fs/nfsd/stats.h
@@ -10,94 +10,72 @@
 #include <uapi/linux/nfsd/stats.h>
 #include <linux/percpu_counter.h>
 
-
-enum {
-	NFSD_STATS_RC_HITS,		/* repcache hits */
-	NFSD_STATS_RC_MISSES,		/* repcache misses */
-	NFSD_STATS_RC_NOCACHE,		/* uncached reqs */
-	NFSD_STATS_FH_STALE,		/* FH stale error */
-	NFSD_STATS_IO_READ,		/* bytes returned to read requests */
-	NFSD_STATS_IO_WRITE,		/* bytes passed in write requests */
-#ifdef CONFIG_NFSD_V4
-	NFSD_STATS_FIRST_NFS4_OP,	/* count of individual nfsv4 operations */
-	NFSD_STATS_LAST_NFS4_OP = NFSD_STATS_FIRST_NFS4_OP + LAST_NFS4_OP,
-#define NFSD_STATS_NFS4_OP(op)	(NFSD_STATS_FIRST_NFS4_OP + (op))
-	NFSD_STATS_WDELEG_GETATTR,	/* count of getattr conflict with wdeleg */
-#endif
-	NFSD_STATS_COUNTERS_NUM
-};
-
-struct nfsd_stats {
-	struct percpu_counter	counter[NFSD_STATS_COUNTERS_NUM];
-
-	atomic_t	th_cnt;		/* number of available threads */
-};
-
-extern struct nfsd_stats	nfsdstats;
-
-extern struct svc_stat		nfsd_svcstats;
-
 int nfsd_percpu_counters_init(struct percpu_counter *counters, int num);
 void nfsd_percpu_counters_reset(struct percpu_counter *counters, int num);
 void nfsd_percpu_counters_destroy(struct percpu_counter *counters, int num);
-int nfsd_stat_init(void);
-void nfsd_stat_shutdown(void);
+int nfsd_stat_counters_init(struct nfsd_net *nn);
+void nfsd_stat_counters_destroy(struct nfsd_net *nn);
+void nfsd_proc_stat_init(struct net *net);
+void nfsd_proc_stat_shutdown(struct net *net);
 
-static inline void nfsd_stats_rc_hits_inc(void)
+static inline void nfsd_stats_rc_hits_inc(struct nfsd_net *nn)
 {
-	percpu_counter_inc(&nfsdstats.counter[NFSD_STATS_RC_HITS]);
+	percpu_counter_inc(&nn->counter[NFSD_STATS_RC_HITS]);
 }
 
-static inline void nfsd_stats_rc_misses_inc(void)
+static inline void nfsd_stats_rc_misses_inc(struct nfsd_net *nn)
 {
-	percpu_counter_inc(&nfsdstats.counter[NFSD_STATS_RC_MISSES]);
+	percpu_counter_inc(&nn->counter[NFSD_STATS_RC_MISSES]);
 }
 
-static inline void nfsd_stats_rc_nocache_inc(void)
+static inline void nfsd_stats_rc_nocache_inc(struct nfsd_net *nn)
 {
-	percpu_counter_inc(&nfsdstats.counter[NFSD_STATS_RC_NOCACHE]);
+	percpu_counter_inc(&nn->counter[NFSD_STATS_RC_NOCACHE]);
 }
 
-static inline void nfsd_stats_fh_stale_inc(struct svc_export *exp)
+static inline void nfsd_stats_fh_stale_inc(struct nfsd_net *nn,
+					   struct svc_export *exp)
 {
-	percpu_counter_inc(&nfsdstats.counter[NFSD_STATS_FH_STALE]);
+	percpu_counter_inc(&nn->counter[NFSD_STATS_FH_STALE]);
 	if (exp && exp->ex_stats)
 		percpu_counter_inc(&exp->ex_stats->counter[EXP_STATS_FH_STALE]);
 }
 
-static inline void nfsd_stats_io_read_add(struct svc_export *exp, s64 amount)
+static inline void nfsd_stats_io_read_add(struct nfsd_net *nn,
+					  struct svc_export *exp, s64 amount)
 {
-	percpu_counter_add(&nfsdstats.counter[NFSD_STATS_IO_READ], amount);
+	percpu_counter_add(&nn->counter[NFSD_STATS_IO_READ], amount);
 	if (exp && exp->ex_stats)
 		percpu_counter_add(&exp->ex_stats->counter[EXP_STATS_IO_READ], amount);
 }
 
-static inline void nfsd_stats_io_write_add(struct svc_export *exp, s64 amount)
+static inline void nfsd_stats_io_write_add(struct nfsd_net *nn,
+					   struct svc_export *exp, s64 amount)
 {
-	percpu_counter_add(&nfsdstats.counter[NFSD_STATS_IO_WRITE], amount);
+	percpu_counter_add(&nn->counter[NFSD_STATS_IO_WRITE], amount);
 	if (exp && exp->ex_stats)
 		percpu_counter_add(&exp->ex_stats->counter[EXP_STATS_IO_WRITE], amount);
 }
 
 static inline void nfsd_stats_payload_misses_inc(struct nfsd_net *nn)
 {
-	percpu_counter_inc(&nn->counter[NFSD_NET_PAYLOAD_MISSES]);
+	percpu_counter_inc(&nn->counter[NFSD_STATS_PAYLOAD_MISSES]);
 }
 
 static inline void nfsd_stats_drc_mem_usage_add(struct nfsd_net *nn, s64 amount)
 {
-	percpu_counter_add(&nn->counter[NFSD_NET_DRC_MEM_USAGE], amount);
+	percpu_counter_add(&nn->counter[NFSD_STATS_DRC_MEM_USAGE], amount);
 }
 
 static inline void nfsd_stats_drc_mem_usage_sub(struct nfsd_net *nn, s64 amount)
 {
-	percpu_counter_sub(&nn->counter[NFSD_NET_DRC_MEM_USAGE], amount);
+	percpu_counter_sub(&nn->counter[NFSD_STATS_DRC_MEM_USAGE], amount);
 }
 
 #ifdef CONFIG_NFSD_V4
-static inline void nfsd_stats_wdeleg_getattr_inc(void)
+static inline void nfsd_stats_wdeleg_getattr_inc(struct nfsd_net *nn)
 {
-	percpu_counter_inc(&nfsdstats.counter[NFSD_STATS_WDELEG_GETATTR]);
+	percpu_counter_inc(&nn->counter[NFSD_STATS_WDELEG_GETATTR]);
 }
 #endif
 #endif /* _NFSD_STATS_H */
--- linux-qcom-6.8.0.orig/fs/nfsd/trace.h
+++ linux-qcom-6.8.0/fs/nfsd/trace.h
@@ -843,7 +843,7 @@
 		__array(unsigned char, addr, sizeof(struct sockaddr_in6))
 		__field(unsigned long, flavor)
 		__array(unsigned char, verifier, NFS4_VERIFIER_SIZE)
-		__string_len(name, name, clp->cl_name.len)
+		__string_len(name, clp->cl_name.data, clp->cl_name.len)
 	),
 	TP_fast_assign(
 		__entry->cl_boot = clp->cl_clientid.cl_boot;
--- linux-qcom-6.8.0.orig/fs/nfsd/vfs.c
+++ linux-qcom-6.8.0/fs/nfsd/vfs.c
@@ -101,6 +101,7 @@
 		{ nfserr_io, -EUCLEAN },
 		{ nfserr_perm, -ENOKEY },
 		{ nfserr_no_grace, -ENOGRACE},
+		{ nfserr_io, -EBADMSG },
 	};
 	int	i;
 
@@ -1002,7 +1003,9 @@
 			       unsigned long *count, u32 *eof, ssize_t host_err)
 {
 	if (host_err >= 0) {
-		nfsd_stats_io_read_add(fhp->fh_export, host_err);
+		struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
+
+		nfsd_stats_io_read_add(nn, fhp->fh_export, host_err);
 		*eof = nfsd_eof_on_read(file, offset, host_err, *count);
 		*count = host_err;
 		fsnotify_access(file);
@@ -1185,7 +1188,7 @@
 		goto out_nfserr;
 	}
 	*cnt = host_err;
-	nfsd_stats_io_write_add(exp, *cnt);
+	nfsd_stats_io_write_add(nn, exp, *cnt);
 	fsnotify_modify(file);
 	host_err = filemap_check_wb_err(file->f_mapping, since);
 	if (host_err < 0)
@@ -1833,7 +1836,7 @@
 	trap = lock_rename(tdentry, fdentry);
 	if (IS_ERR(trap)) {
 		err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev;
-		goto out;
+		goto out_want_write;
 	}
 	err = fh_fill_pre_attrs(ffhp);
 	if (err != nfs_ok)
@@ -1903,6 +1906,7 @@
 	}
 out_unlock:
 	unlock_rename(tdentry, fdentry);
+out_want_write:
 	fh_drop_write(ffhp);
 
 	/*
--- linux-qcom-6.8.0.orig/fs/nfsd/xdr4.h
+++ linux-qcom-6.8.0/fs/nfsd/xdr4.h
@@ -693,6 +693,7 @@
 	struct nfsd4_ssc_umount_item *ss_nsui;
 	struct nfs_fh		c_fh;
 	nfs4_stateid		stateid;
+	struct nfsd_net		*cp_nn;
 };
 
 static inline void nfsd4_copy_set_sync(struct nfsd4_copy *copy, bool sync)
--- linux-qcom-6.8.0.orig/fs/nfsd/xdr4cb.h
+++ linux-qcom-6.8.0/fs/nfsd/xdr4cb.h
@@ -54,3 +54,21 @@
 #define NFS4_dec_cb_recall_any_sz	(cb_compound_dec_hdr_sz  +      \
 					cb_sequence_dec_sz +            \
 					op_dec_sz)
+
+/*
+ * 1: CB_GETATTR opcode (32-bit)
+ * N: file_handle
+ * 1: number of entry in attribute array (32-bit)
+ * 1: entry 0 in attribute array (32-bit)
+ */
+#define NFS4_enc_cb_getattr_sz		(cb_compound_enc_hdr_sz +       \
+					cb_sequence_enc_sz +            \
+					1 + enc_nfs4_fh_sz + 1 + 1)
+/*
+ * 4: fattr_bitmap_maxsz
+ * 1: attribute array len
+ * 2: change attr (64-bit)
+ * 2: size (64-bit)
+ */
+#define NFS4_dec_cb_getattr_sz		(cb_compound_dec_hdr_sz  +      \
+			cb_sequence_dec_sz + 4 + 1 + 2 + 2 + op_dec_sz)
--- linux-qcom-6.8.0.orig/fs/nilfs2/alloc.c
+++ linux-qcom-6.8.0/fs/nilfs2/alloc.c
@@ -377,11 +377,12 @@
  * @target: offset number of an entry in the group (start point)
  * @bsize: size in bits
  * @lock: spin lock protecting @bitmap
+ * @wrap: whether to wrap around
  */
 static int nilfs_palloc_find_available_slot(unsigned char *bitmap,
 					    unsigned long target,
 					    unsigned int bsize,
-					    spinlock_t *lock)
+					    spinlock_t *lock, bool wrap)
 {
 	int pos, end = bsize;
 
@@ -397,6 +398,8 @@
 
 		end = target;
 	}
+	if (!wrap)
+		return -ENOSPC;
 
 	/* wrap around */
 	for (pos = 0; pos < end; pos++) {
@@ -495,9 +498,10 @@
  * nilfs_palloc_prepare_alloc_entry - prepare to allocate a persistent object
  * @inode: inode of metadata file using this allocator
  * @req: nilfs_palloc_req structure exchanged for the allocation
+ * @wrap: whether to wrap around
  */
 int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
-				     struct nilfs_palloc_req *req)
+				     struct nilfs_palloc_req *req, bool wrap)
 {
 	struct buffer_head *desc_bh, *bitmap_bh;
 	struct nilfs_palloc_group_desc *desc;
@@ -516,7 +520,7 @@
 	entries_per_group = nilfs_palloc_entries_per_group(inode);
 
 	for (i = 0; i < ngroups; i += n) {
-		if (group >= ngroups) {
+		if (group >= ngroups && wrap) {
 			/* wrap around */
 			group = 0;
 			maxgroup = nilfs_palloc_group(inode, req->pr_entry_nr,
@@ -541,7 +545,13 @@
 				bitmap = bitmap_kaddr + bh_offset(bitmap_bh);
 				pos = nilfs_palloc_find_available_slot(
 					bitmap, group_offset,
-					entries_per_group, lock);
+					entries_per_group, lock, wrap);
+				/*
+				 * Since the search for a free slot in the
+				 * second and subsequent bitmap blocks always
+				 * starts from the beginning, the wrap flag
+				 * only has an effect on the first search.
+				 */
 				if (pos >= 0) {
 					/* found a free entry */
 					nilfs_palloc_group_desc_add_entries(
--- linux-qcom-6.8.0.orig/fs/nilfs2/alloc.h
+++ linux-qcom-6.8.0/fs/nilfs2/alloc.h
@@ -50,8 +50,8 @@
 	struct buffer_head *pr_entry_bh;
 };
 
-int nilfs_palloc_prepare_alloc_entry(struct inode *,
-				     struct nilfs_palloc_req *);
+int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
+				     struct nilfs_palloc_req *req, bool wrap);
 void nilfs_palloc_commit_alloc_entry(struct inode *,
 				     struct nilfs_palloc_req *);
 void nilfs_palloc_abort_alloc_entry(struct inode *, struct nilfs_palloc_req *);
--- linux-qcom-6.8.0.orig/fs/nilfs2/btnode.c
+++ linux-qcom-6.8.0/fs/nilfs2/btnode.c
@@ -35,6 +35,7 @@
 	ii->i_flags = 0;
 	memset(&ii->i_bmap_data, 0, sizeof(struct nilfs_bmap));
 	mapping_set_gfp_mask(btnc_inode->i_mapping, GFP_NOFS);
+	btnc_inode->i_mapping->a_ops = &nilfs_buffer_cache_aops;
 }
 
 void nilfs_btnode_cache_clear(struct address_space *btnc)
@@ -51,15 +52,23 @@
 
 	bh = nilfs_grab_buffer(inode, btnc, blocknr, BIT(BH_NILFS_Node));
 	if (unlikely(!bh))
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	if (unlikely(buffer_mapped(bh) || buffer_uptodate(bh) ||
 		     buffer_dirty(bh))) {
-		brelse(bh);
-		BUG();
+		/*
+		 * The block buffer at the specified new address was already
+		 * in use.  This can happen if it is a virtual block number
+		 * and has been reallocated due to corruption of the bitmap
+		 * used to manage its allocation state (if not, the buffer
+		 * clearing of an abandoned b-tree node is missing somewhere).
+		 */
+		nilfs_error(inode->i_sb,
+			    "state inconsistency probably due to duplicate use of b-tree node block address %llu (ino=%lu)",
+			    (unsigned long long)blocknr, inode->i_ino);
+		goto failed;
 	}
 	memset(bh->b_data, 0, i_blocksize(inode));
-	bh->b_bdev = inode->i_sb->s_bdev;
 	bh->b_blocknr = blocknr;
 	set_buffer_mapped(bh);
 	set_buffer_uptodate(bh);
@@ -67,6 +76,12 @@
 	folio_unlock(bh->b_folio);
 	folio_put(bh->b_folio);
 	return bh;
+
+failed:
+	folio_unlock(bh->b_folio);
+	folio_put(bh->b_folio);
+	brelse(bh);
+	return ERR_PTR(-EIO);
 }
 
 int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
@@ -118,7 +133,6 @@
 		goto found;
 	}
 	set_buffer_mapped(bh);
-	bh->b_bdev = inode->i_sb->s_bdev;
 	bh->b_blocknr = pblocknr; /* set block address for read */
 	bh->b_end_io = end_buffer_read_sync;
 	get_bh(bh);
@@ -217,8 +231,8 @@
 	}
 
 	nbh = nilfs_btnode_create_block(btnc, newkey);
-	if (!nbh)
-		return -ENOMEM;
+	if (IS_ERR(nbh))
+		return PTR_ERR(nbh);
 
 	BUG_ON(nbh == obh);
 	ctxt->newbh = nbh;
--- linux-qcom-6.8.0.orig/fs/nilfs2/btree.c
+++ linux-qcom-6.8.0/fs/nilfs2/btree.c
@@ -63,8 +63,8 @@
 	struct buffer_head *bh;
 
 	bh = nilfs_btnode_create_block(btnc, ptr);
-	if (!bh)
-		return -ENOMEM;
+	if (IS_ERR(bh))
+		return PTR_ERR(bh);
 
 	set_buffer_nilfs_volatile(bh);
 	*bhp = bh;
@@ -350,7 +350,7 @@
 	if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
 		     level >= NILFS_BTREE_LEVEL_MAX ||
 		     (flags & NILFS_BTREE_NODE_ROOT) ||
-		     nchildren < 0 ||
+		     nchildren <= 0 ||
 		     nchildren > NILFS_BTREE_NODE_NCHILDREN_MAX(size))) {
 		nilfs_crit(inode->i_sb,
 			   "bad btree node (ino=%lu, blocknr=%llu): level = %d, flags = 0x%x, nchildren = %d",
@@ -381,7 +381,8 @@
 	if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
 		     level >= NILFS_BTREE_LEVEL_MAX ||
 		     nchildren < 0 ||
-		     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+		     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX ||
+		     (nchildren == 0 && level > NILFS_BTREE_LEVEL_NODE_MIN))) {
 		nilfs_crit(inode->i_sb,
 			   "bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d",
 			   inode->i_ino, level, flags, nchildren);
@@ -724,7 +725,7 @@
 		dat = nilfs_bmap_get_dat(btree);
 		ret = nilfs_dat_translate(dat, ptr, &blocknr);
 		if (ret < 0)
-			goto out;
+			goto dat_error;
 		ptr = blocknr;
 	}
 	cnt = 1;
@@ -743,7 +744,7 @@
 			if (dat) {
 				ret = nilfs_dat_translate(dat, ptr2, &blocknr);
 				if (ret < 0)
-					goto out;
+					goto dat_error;
 				ptr2 = blocknr;
 			}
 			if (ptr2 != ptr + cnt || ++cnt == maxblocks)
@@ -781,6 +782,11 @@
  out:
 	nilfs_btree_free_path(path);
 	return ret;
+
+ dat_error:
+	if (ret == -ENOENT)
+		ret = -EINVAL;  /* Notify bmap layer of metadata corruption */
+	goto out;
 }
 
 static void nilfs_btree_promote_key(struct nilfs_bmap *btree,
@@ -1653,13 +1659,16 @@
 	int nchildren, ret;
 
 	root = nilfs_btree_get_root(btree);
+	nchildren = nilfs_btree_node_get_nchildren(root);
+	if (unlikely(nchildren == 0))
+		return 0;
+
 	switch (nilfs_btree_height(btree)) {
 	case 2:
 		bh = NULL;
 		node = root;
 		break;
 	case 3:
-		nchildren = nilfs_btree_node_get_nchildren(root);
 		if (nchildren > 1)
 			return 0;
 		ptr = nilfs_btree_node_get_ptr(root, nchildren - 1,
@@ -1668,12 +1677,12 @@
 		if (ret < 0)
 			return ret;
 		node = (struct nilfs_btree_node *)bh->b_data;
+		nchildren = nilfs_btree_node_get_nchildren(node);
 		break;
 	default:
 		return 0;
 	}
 
-	nchildren = nilfs_btree_node_get_nchildren(node);
 	maxkey = nilfs_btree_node_get_key(node, nchildren - 1);
 	nextmaxkey = (nchildren > 1) ?
 		nilfs_btree_node_get_key(node, nchildren - 2) : 0;
--- linux-qcom-6.8.0.orig/fs/nilfs2/dat.c
+++ linux-qcom-6.8.0/fs/nilfs2/dat.c
@@ -75,7 +75,7 @@
 {
 	int ret;
 
-	ret = nilfs_palloc_prepare_alloc_entry(dat, req);
+	ret = nilfs_palloc_prepare_alloc_entry(dat, req, true);
 	if (ret < 0)
 		return ret;
 
--- linux-qcom-6.8.0.orig/fs/nilfs2/dir.c
+++ linux-qcom-6.8.0/fs/nilfs2/dir.c
@@ -70,7 +70,7 @@
  */
 static unsigned int nilfs_last_byte(struct inode *inode, unsigned long page_nr)
 {
-	unsigned int last_byte = inode->i_size;
+	u64 last_byte = inode->i_size;
 
 	last_byte -= page_nr << PAGE_SHIFT;
 	if (last_byte > PAGE_SIZE)
@@ -135,6 +135,9 @@
 			goto Enamelen;
 		if (((offs + rec_len - 1) ^ offs) & ~(chunk_size-1))
 			goto Espan;
+		if (unlikely(p->inode &&
+			     NILFS_PRIVATE_INODE(le64_to_cpu(p->inode))))
+			goto Einumber;
 	}
 	if (offs != limit)
 		goto Eend;
@@ -160,6 +163,9 @@
 	goto bad_entry;
 Espan:
 	error = "directory entry across blocks";
+	goto bad_entry;
+Einumber:
+	error = "disallowed inode number";
 bad_entry:
 	nilfs_error(sb,
 		    "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%zd, name_len=%d",
@@ -240,7 +246,7 @@
 
 #define S_SHIFT 12
 static unsigned char
-nilfs_type_by_mode[S_IFMT >> S_SHIFT] = {
+nilfs_type_by_mode[(S_IFMT >> S_SHIFT) + 1] = {
 	[S_IFREG >> S_SHIFT]	= NILFS_FT_REG_FILE,
 	[S_IFDIR >> S_SHIFT]	= NILFS_FT_DIR,
 	[S_IFCHR >> S_SHIFT]	= NILFS_FT_CHRDEV,
@@ -318,7 +324,7 @@
  * The folio is mapped and unlocked.  When the caller is finished with
  * the entry, it should call folio_release_kmap().
  *
- * On failure, returns NULL and the caller should ignore foliop.
+ * On failure, returns an error pointer and the caller should ignore foliop.
  */
 struct nilfs_dir_entry *nilfs_find_entry(struct inode *dir,
 		const struct qstr *qstr, struct folio **foliop)
@@ -341,22 +347,24 @@
 	do {
 		char *kaddr = nilfs_get_folio(dir, n, foliop);
 
-		if (!IS_ERR(kaddr)) {
-			de = (struct nilfs_dir_entry *)kaddr;
-			kaddr += nilfs_last_byte(dir, n) - reclen;
-			while ((char *) de <= kaddr) {
-				if (de->rec_len == 0) {
-					nilfs_error(dir->i_sb,
-						"zero-length directory entry");
-					folio_release_kmap(*foliop, kaddr);
-					goto out;
-				}
-				if (nilfs_match(namelen, name, de))
-					goto found;
-				de = nilfs_next_entry(de);
+		if (IS_ERR(kaddr))
+			return ERR_CAST(kaddr);
+
+		de = (struct nilfs_dir_entry *)kaddr;
+		kaddr += nilfs_last_byte(dir, n) - reclen;
+		while ((char *)de <= kaddr) {
+			if (de->rec_len == 0) {
+				nilfs_error(dir->i_sb,
+					    "zero-length directory entry");
+				folio_release_kmap(*foliop, kaddr);
+				goto out;
 			}
-			folio_release_kmap(*foliop, kaddr);
+			if (nilfs_match(namelen, name, de))
+				goto found;
+			de = nilfs_next_entry(de);
 		}
+		folio_release_kmap(*foliop, kaddr);
+
 		if (++n >= npages)
 			n = 0;
 		/* next folio is past the blocks we've got */
@@ -369,7 +377,7 @@
 		}
 	} while (n != start);
 out:
-	return NULL;
+	return ERR_PTR(-ENOENT);
 
 found:
 	ei->i_dir_start_lookup = n;
@@ -378,25 +386,53 @@
 
 struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct folio **foliop)
 {
-	struct nilfs_dir_entry *de = nilfs_get_folio(dir, 0, foliop);
+	struct folio *folio;
+	struct nilfs_dir_entry *de, *next_de;
+	size_t limit;
+	char *msg;
 
+	de = nilfs_get_folio(dir, 0, &folio);
 	if (IS_ERR(de))
 		return NULL;
-	return nilfs_next_entry(de);
+
+	limit = nilfs_last_byte(dir, 0);  /* is a multiple of chunk size */
+	if (unlikely(!limit || le64_to_cpu(de->inode) != dir->i_ino ||
+		     !nilfs_match(1, ".", de))) {
+		msg = "missing '.'";
+		goto fail;
+	}
+
+	next_de = nilfs_next_entry(de);
+	/*
+	 * If "next_de" has not reached the end of the chunk, there is
+	 * at least one more record.  Check whether it matches "..".
+	 */
+	if (unlikely((char *)next_de == (char *)de + nilfs_chunk_size(dir) ||
+		     !nilfs_match(2, "..", next_de))) {
+		msg = "missing '..'";
+		goto fail;
+	}
+	*foliop = folio;
+	return next_de;
+
+fail:
+	nilfs_error(dir->i_sb, "directory #%lu %s", dir->i_ino, msg);
+	folio_release_kmap(folio, de);
+	return NULL;
 }
 
-ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr)
+int nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr, ino_t *ino)
 {
-	ino_t res = 0;
 	struct nilfs_dir_entry *de;
 	struct folio *folio;
 
 	de = nilfs_find_entry(dir, qstr, &folio);
-	if (de) {
-		res = le64_to_cpu(de->inode);
-		folio_release_kmap(folio, de);
-	}
-	return res;
+	if (IS_ERR(de))
+		return PTR_ERR(de);
+
+	*ino = le64_to_cpu(de->inode);
+	folio_release_kmap(folio, de);
+	return 0;
 }
 
 void nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de,
@@ -608,7 +644,7 @@
 
 		kaddr = nilfs_get_folio(inode, i, &folio);
 		if (IS_ERR(kaddr))
-			continue;
+			return 0;
 
 		de = (struct nilfs_dir_entry *)kaddr;
 		kaddr += nilfs_last_byte(inode, i) - NILFS_DIR_REC_LEN(1);
--- linux-qcom-6.8.0.orig/fs/nilfs2/direct.c
+++ linux-qcom-6.8.0/fs/nilfs2/direct.c
@@ -66,7 +66,7 @@
 		dat = nilfs_bmap_get_dat(direct);
 		ret = nilfs_dat_translate(dat, ptr, &blocknr);
 		if (ret < 0)
-			return ret;
+			goto dat_error;
 		ptr = blocknr;
 	}
 
@@ -79,7 +79,7 @@
 		if (dat) {
 			ret = nilfs_dat_translate(dat, ptr2, &blocknr);
 			if (ret < 0)
-				return ret;
+				goto dat_error;
 			ptr2 = blocknr;
 		}
 		if (ptr2 != ptr + cnt)
@@ -87,6 +87,11 @@
 	}
 	*ptrp = ptr;
 	return cnt;
+
+ dat_error:
+	if (ret == -ENOENT)
+		ret = -EINVAL;  /* Notify bmap layer of metadata corruption */
+	return ret;
 }
 
 static __u64
--- linux-qcom-6.8.0.orig/fs/nilfs2/gcinode.c
+++ linux-qcom-6.8.0/fs/nilfs2/gcinode.c
@@ -83,10 +83,8 @@
 		goto out;
 	}
 
-	if (!buffer_mapped(bh)) {
-		bh->b_bdev = inode->i_sb->s_bdev;
+	if (!buffer_mapped(bh))
 		set_buffer_mapped(bh);
-	}
 	bh->b_blocknr = pbn;
 	bh->b_end_io = end_buffer_read_sync;
 	get_bh(bh);
@@ -165,7 +163,7 @@
 
 	inode->i_mode = S_IFREG;
 	mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
-	inode->i_mapping->a_ops = &empty_aops;
+	inode->i_mapping->a_ops = &nilfs_buffer_cache_aops;
 
 	ii->i_flags = 0;
 	nilfs_bmap_init_gc(ii->i_bmap);
--- linux-qcom-6.8.0.orig/fs/nilfs2/ifile.c
+++ linux-qcom-6.8.0/fs/nilfs2/ifile.c
@@ -55,13 +55,10 @@
 	struct nilfs_palloc_req req;
 	int ret;
 
-	req.pr_entry_nr = 0;  /*
-			       * 0 says find free inode from beginning
-			       * of a group. dull code!!
-			       */
+	req.pr_entry_nr = NILFS_FIRST_INO(ifile->i_sb);
 	req.pr_entry_bh = NULL;
 
-	ret = nilfs_palloc_prepare_alloc_entry(ifile, &req);
+	ret = nilfs_palloc_prepare_alloc_entry(ifile, &req, false);
 	if (!ret) {
 		ret = nilfs_palloc_get_entry_block(ifile, req.pr_entry_nr, 1,
 						   &req.pr_entry_bh);
--- linux-qcom-6.8.0.orig/fs/nilfs2/inode.c
+++ linux-qcom-6.8.0/fs/nilfs2/inode.c
@@ -112,7 +112,7 @@
 					   "%s (ino=%lu): a race condition while inserting a data block at offset=%llu",
 					   __func__, inode->i_ino,
 					   (unsigned long long)blkoff);
-				err = 0;
+				err = -EAGAIN;
 			}
 			nilfs_transaction_abort(inode->i_sb);
 			goto out;
@@ -310,6 +310,10 @@
 	.is_partially_uptodate  = block_is_partially_uptodate,
 };
 
+const struct address_space_operations nilfs_buffer_cache_aops = {
+	.invalidate_folio	= block_invalidate_folio,
+};
+
 static int nilfs_insert_inode_locked(struct inode *inode,
 				     struct nilfs_root *root,
 				     unsigned long ino)
@@ -615,8 +619,14 @@
 	inode = nilfs_iget_locked(sb, root, ino);
 	if (unlikely(!inode))
 		return ERR_PTR(-ENOMEM);
-	if (!(inode->i_state & I_NEW))
+
+	if (!(inode->i_state & I_NEW)) {
+		if (!inode->i_nlink) {
+			iput(inode);
+			return ERR_PTR(-ESTALE);
+		}
 		return inode;
+	}
 
 	err = __nilfs_read_inode(sb, root, ino, inode);
 	if (unlikely(err)) {
@@ -749,6 +759,7 @@
 	NILFS_I(s_inode)->i_flags = 0;
 	memset(NILFS_I(s_inode)->i_bmap, 0, sizeof(struct nilfs_bmap));
 	mapping_set_gfp_mask(s_inode->i_mapping, GFP_NOFS);
+	s_inode->i_mapping->a_ops = &nilfs_buffer_cache_aops;
 
 	err = nilfs_attach_btree_node_cache(s_inode);
 	if (unlikely(err)) {
--- linux-qcom-6.8.0.orig/fs/nilfs2/ioctl.c
+++ linux-qcom-6.8.0/fs/nilfs2/ioctl.c
@@ -60,7 +60,7 @@
 	if (argv->v_nmembs == 0)
 		return 0;
 
-	if (argv->v_size > PAGE_SIZE)
+	if ((size_t)argv->v_size > PAGE_SIZE)
 		return -EINVAL;
 
 	/*
--- linux-qcom-6.8.0.orig/fs/nilfs2/mdt.c
+++ linux-qcom-6.8.0/fs/nilfs2/mdt.c
@@ -89,7 +89,6 @@
 	if (buffer_uptodate(bh))
 		goto failed_bh;
 
-	bh->b_bdev = sb->s_bdev;
 	err = nilfs_mdt_insert_new_block(inode, block, bh, init_block);
 	if (likely(!err)) {
 		get_bh(bh);
--- linux-qcom-6.8.0.orig/fs/nilfs2/namei.c
+++ linux-qcom-6.8.0/fs/nilfs2/namei.c
@@ -55,12 +55,25 @@
 {
 	struct inode *inode;
 	ino_t ino;
+	int res;
 
 	if (dentry->d_name.len > NILFS_NAME_LEN)
 		return ERR_PTR(-ENAMETOOLONG);
 
-	ino = nilfs_inode_by_name(dir, &dentry->d_name);
-	inode = ino ? nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino) : NULL;
+	res = nilfs_inode_by_name(dir, &dentry->d_name, &ino);
+	if (res) {
+		if (res != -ENOENT)
+			return ERR_PTR(res);
+		inode = NULL;
+	} else {
+		inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino);
+		if (inode == ERR_PTR(-ESTALE)) {
+			nilfs_error(dir->i_sb,
+					"deleted inode referenced: %lu", ino);
+			return ERR_PTR(-EIO);
+		}
+	}
+
 	return d_splice_alias(inode, dentry);
 }
 
@@ -149,6 +162,9 @@
 	/* slow symlink */
 	inode->i_op = &nilfs_symlink_inode_operations;
 	inode_nohighmem(inode);
+	mapping_set_gfp_mask(inode->i_mapping,
+			     mapping_gfp_constraint(inode->i_mapping,
+						    ~__GFP_FS));
 	inode->i_mapping->a_ops = &nilfs_aops;
 	err = page_symlink(inode, symname, l);
 	if (err)
@@ -263,10 +279,11 @@
 	struct folio *folio;
 	int err;
 
-	err = -ENOENT;
 	de = nilfs_find_entry(dir, &dentry->d_name, &folio);
-	if (!de)
+	if (IS_ERR(de)) {
+		err = PTR_ERR(de);
 		goto out;
+	}
 
 	inode = d_inode(dentry);
 	err = -EIO;
@@ -362,10 +379,11 @@
 	if (unlikely(err))
 		return err;
 
-	err = -ENOENT;
 	old_de = nilfs_find_entry(old_dir, &old_dentry->d_name, &old_folio);
-	if (!old_de)
+	if (IS_ERR(old_de)) {
+		err = PTR_ERR(old_de);
 		goto out;
+	}
 
 	if (S_ISDIR(old_inode->i_mode)) {
 		err = -EIO;
@@ -382,10 +400,12 @@
 		if (dir_de && !nilfs_empty_dir(new_inode))
 			goto out_dir;
 
-		err = -ENOENT;
-		new_de = nilfs_find_entry(new_dir, &new_dentry->d_name, &new_folio);
-		if (!new_de)
+		new_de = nilfs_find_entry(new_dir, &new_dentry->d_name,
+					  &new_folio);
+		if (IS_ERR(new_de)) {
+			err = PTR_ERR(new_de);
 			goto out_dir;
+		}
 		nilfs_set_link(new_dir, new_de, new_folio, old_inode);
 		folio_release_kmap(new_folio, new_de);
 		nilfs_mark_inode_dirty(new_dir);
@@ -440,12 +460,13 @@
  */
 static struct dentry *nilfs_get_parent(struct dentry *child)
 {
-	unsigned long ino;
+	ino_t ino;
+	int res;
 	struct nilfs_root *root;
 
-	ino = nilfs_inode_by_name(d_inode(child), &dotdot_name);
-	if (!ino)
-		return ERR_PTR(-ENOENT);
+	res = nilfs_inode_by_name(d_inode(child), &dotdot_name, &ino);
+	if (res)
+		return ERR_PTR(res);
 
 	root = NILFS_I(d_inode(child))->i_root;
 
--- linux-qcom-6.8.0.orig/fs/nilfs2/nilfs.h
+++ linux-qcom-6.8.0/fs/nilfs2/nilfs.h
@@ -116,9 +116,15 @@
 #define NILFS_FIRST_INO(sb) (((struct the_nilfs *)sb->s_fs_info)->ns_first_ino)
 
 #define NILFS_MDT_INODE(sb, ino) \
-	((ino) < NILFS_FIRST_INO(sb) && (NILFS_MDT_INO_BITS & BIT(ino)))
+	((ino) < NILFS_USER_INO && (NILFS_MDT_INO_BITS & BIT(ino)))
 #define NILFS_VALID_INODE(sb, ino) \
-	((ino) >= NILFS_FIRST_INO(sb) || (NILFS_SYS_INO_BITS & BIT(ino)))
+	((ino) >= NILFS_FIRST_INO(sb) ||				\
+	 ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino))))
+
+#define NILFS_PRIVATE_INODE(ino) ({					\
+	ino_t __ino = (ino);						\
+	((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO &&	\
+	 (__ino) != NILFS_SKETCH_INO); })
 
 /**
  * struct nilfs_transaction_info: context information for synchronization
@@ -227,7 +233,7 @@
 
 /* dir.c */
 int nilfs_add_link(struct dentry *, struct inode *);
-ino_t nilfs_inode_by_name(struct inode *, const struct qstr *);
+int nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr, ino_t *ino);
 int nilfs_make_empty(struct inode *, struct inode *);
 struct nilfs_dir_entry *nilfs_find_entry(struct inode *, const struct qstr *,
 		struct folio **);
@@ -373,6 +379,7 @@
 extern const struct inode_operations nilfs_file_inode_operations;
 extern const struct file_operations nilfs_file_operations;
 extern const struct address_space_operations nilfs_aops;
+extern const struct address_space_operations nilfs_buffer_cache_aops;
 extern const struct inode_operations nilfs_dir_inode_operations;
 extern const struct inode_operations nilfs_special_inode_operations;
 extern const struct inode_operations nilfs_symlink_inode_operations;
--- linux-qcom-6.8.0.orig/fs/nilfs2/page.c
+++ linux-qcom-6.8.0/fs/nilfs2/page.c
@@ -39,7 +39,6 @@
 	first_block = (unsigned long)index << (PAGE_SHIFT - blkbits);
 	bh = get_nth_bh(bh, block - first_block);
 
-	touch_buffer(bh);
 	wait_on_buffer(bh);
 	return bh;
 }
@@ -64,6 +63,7 @@
 		folio_put(folio);
 		return NULL;
 	}
+	bh->b_bdev = inode->i_sb->s_bdev;
 	return bh;
 }
 
@@ -77,7 +77,8 @@
 	const unsigned long clear_bits =
 		(BIT(BH_Uptodate) | BIT(BH_Dirty) | BIT(BH_Mapped) |
 		 BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) |
-		 BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected));
+		 BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) |
+		 BIT(BH_Delay));
 
 	lock_buffer(bh);
 	set_mask_bits(&bh->b_state, clear_bits, 0);
@@ -408,13 +409,15 @@
 
 	folio_clear_uptodate(folio);
 	folio_clear_mappedtodisk(folio);
+	folio_clear_checked(folio);
 
 	head = folio_buffers(folio);
 	if (head) {
 		const unsigned long clear_bits =
 			(BIT(BH_Uptodate) | BIT(BH_Dirty) | BIT(BH_Mapped) |
 			 BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) |
-			 BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected));
+			 BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) |
+			 BIT(BH_Delay));
 
 		bh = head;
 		do {
--- linux-qcom-6.8.0.orig/fs/nilfs2/recovery.c
+++ linux-qcom-6.8.0/fs/nilfs2/recovery.c
@@ -709,6 +709,33 @@
 }
 
 /**
+ * nilfs_abort_roll_forward - cleaning up after a failed rollforward recovery
+ * @nilfs: nilfs object
+ */
+static void nilfs_abort_roll_forward(struct the_nilfs *nilfs)
+{
+	struct nilfs_inode_info *ii, *n;
+	LIST_HEAD(head);
+
+	/* Abandon inodes that have read recovery data */
+	spin_lock(&nilfs->ns_inode_lock);
+	list_splice_init(&nilfs->ns_dirty_files, &head);
+	spin_unlock(&nilfs->ns_inode_lock);
+	if (list_empty(&head))
+		return;
+
+	set_nilfs_purging(nilfs);
+	list_for_each_entry_safe(ii, n, &head, i_dirty) {
+		spin_lock(&nilfs->ns_inode_lock);
+		list_del_init(&ii->i_dirty);
+		spin_unlock(&nilfs->ns_inode_lock);
+
+		iput(&ii->vfs_inode);
+	}
+	clear_nilfs_purging(nilfs);
+}
+
+/**
  * nilfs_salvage_orphan_logs - salvage logs written after the latest checkpoint
  * @nilfs: nilfs object
  * @sb: super block instance
@@ -766,15 +793,19 @@
 		if (unlikely(err)) {
 			nilfs_err(sb, "error %d writing segment for recovery",
 				  err);
-			goto failed;
+			goto put_root;
 		}
 
 		nilfs_finish_roll_forward(nilfs, ri);
 	}
 
- failed:
+put_root:
 	nilfs_put_root(root);
 	return err;
+
+failed:
+	nilfs_abort_roll_forward(nilfs);
+	goto put_root;
 }
 
 /**
--- linux-qcom-6.8.0.orig/fs/nilfs2/segment.c
+++ linux-qcom-6.8.0/fs/nilfs2/segment.c
@@ -136,7 +136,7 @@
 
 #define nilfs_cnt32_ge(a, b)   \
 	(typecheck(__u32, a) && typecheck(__u32, b) && \
-	 ((__s32)(a) - (__s32)(b) >= 0))
+	 ((__s32)((a) - (b)) >= 0))
 
 static int nilfs_prepare_segment_lock(struct super_block *sb,
 				      struct nilfs_transaction_info *ti)
@@ -1693,6 +1693,7 @@
 			if (bh->b_folio != bd_folio) {
 				if (bd_folio) {
 					folio_lock(bd_folio);
+					folio_wait_writeback(bd_folio);
 					folio_clear_dirty_for_io(bd_folio);
 					folio_start_writeback(bd_folio);
 					folio_unlock(bd_folio);
@@ -1706,6 +1707,7 @@
 			if (bh == segbuf->sb_super_root) {
 				if (bh->b_folio != bd_folio) {
 					folio_lock(bd_folio);
+					folio_wait_writeback(bd_folio);
 					folio_clear_dirty_for_io(bd_folio);
 					folio_start_writeback(bd_folio);
 					folio_unlock(bd_folio);
@@ -1722,6 +1724,7 @@
 	}
 	if (bd_folio) {
 		folio_lock(bd_folio);
+		folio_wait_writeback(bd_folio);
 		folio_clear_dirty_for_io(bd_folio);
 		folio_start_writeback(bd_folio);
 		folio_unlock(bd_folio);
@@ -1832,6 +1835,9 @@
 	nilfs_abort_logs(&logs, ret ? : err);
 
 	list_splice_tail_init(&sci->sc_segbufs, &logs);
+	if (list_empty(&logs))
+		return; /* if the first segment buffer preparation failed */
+
 	nilfs_cancel_segusage(&logs, nilfs->ns_sufile);
 	nilfs_free_incomplete_logs(&logs, nilfs);
 
@@ -2076,7 +2082,7 @@
 
 		err = nilfs_segctor_begin_construction(sci, nilfs);
 		if (unlikely(err))
-			goto out;
+			goto failed;
 
 		/* Update time stamp */
 		sci->sc_seg_ctime = ktime_get_real_seconds();
@@ -2139,10 +2145,9 @@
 	return err;
 
  failed_to_write:
-	if (sci->sc_stage.flags & NILFS_CF_IFILE_STARTED)
-		nilfs_redirty_inodes(&sci->sc_dirty_files);
-
  failed:
+	if (mode == SC_LSEG_SR && nilfs_sc_cstage_get(sci) >= NILFS_ST_IFILE)
+		nilfs_redirty_inodes(&sci->sc_dirty_files);
 	if (nilfs_doing_gc())
 		nilfs_redirty_inodes(&sci->sc_gc_inodes);
 	nilfs_segctor_abort_construction(sci, nilfs, err);
@@ -2161,8 +2166,10 @@
 {
 	spin_lock(&sci->sc_state_lock);
 	if (!(sci->sc_state & NILFS_SEGCTOR_COMMIT)) {
-		sci->sc_timer.expires = jiffies + sci->sc_interval;
-		add_timer(&sci->sc_timer);
+		if (sci->sc_task) {
+			sci->sc_timer.expires = jiffies + sci->sc_interval;
+			add_timer(&sci->sc_timer);
+		}
 		sci->sc_state |= NILFS_SEGCTOR_COMMIT;
 	}
 	spin_unlock(&sci->sc_state_lock);
@@ -2209,19 +2216,36 @@
 	struct nilfs_segctor_wait_request wait_req;
 	int err = 0;
 
-	spin_lock(&sci->sc_state_lock);
 	init_wait(&wait_req.wq);
 	wait_req.err = 0;
 	atomic_set(&wait_req.done, 0);
+	init_waitqueue_entry(&wait_req.wq, current);
+
+	/*
+	 * To prevent a race issue where completion notifications from the
+	 * log writer thread are missed, increment the request sequence count
+	 * "sc_seq_request" and insert a wait queue entry using the current
+	 * sequence number into the "sc_wait_request" queue at the same time
+	 * within the lock section of "sc_state_lock".
+	 */
+	spin_lock(&sci->sc_state_lock);
 	wait_req.seq = ++sci->sc_seq_request;
+	add_wait_queue(&sci->sc_wait_request, &wait_req.wq);
 	spin_unlock(&sci->sc_state_lock);
 
-	init_waitqueue_entry(&wait_req.wq, current);
-	add_wait_queue(&sci->sc_wait_request, &wait_req.wq);
-	set_current_state(TASK_INTERRUPTIBLE);
 	wake_up(&sci->sc_wait_daemon);
 
 	for (;;) {
+		set_current_state(TASK_INTERRUPTIBLE);
+
+		/*
+		 * Synchronize only while the log writer thread is alive.
+		 * Leave flushing out after the log writer thread exits to
+		 * the cleanup work in nilfs_segctor_destroy().
+		 */
+		if (!sci->sc_task)
+			break;
+
 		if (atomic_read(&wait_req.done)) {
 			err = wait_req.err;
 			break;
@@ -2237,7 +2261,7 @@
 	return err;
 }
 
-static void nilfs_segctor_wakeup(struct nilfs_sc_info *sci, int err)
+static void nilfs_segctor_wakeup(struct nilfs_sc_info *sci, int err, bool force)
 {
 	struct nilfs_segctor_wait_request *wrq, *n;
 	unsigned long flags;
@@ -2245,7 +2269,7 @@
 	spin_lock_irqsave(&sci->sc_wait_request.lock, flags);
 	list_for_each_entry_safe(wrq, n, &sci->sc_wait_request.head, wq.entry) {
 		if (!atomic_read(&wrq->done) &&
-		    nilfs_cnt32_ge(sci->sc_seq_done, wrq->seq)) {
+		    (force || nilfs_cnt32_ge(sci->sc_seq_done, wrq->seq))) {
 			wrq->err = err;
 			atomic_set(&wrq->done, 1);
 		}
@@ -2363,10 +2387,21 @@
  */
 static void nilfs_segctor_accept(struct nilfs_sc_info *sci)
 {
+	bool thread_is_alive;
+
 	spin_lock(&sci->sc_state_lock);
 	sci->sc_seq_accepted = sci->sc_seq_request;
+	thread_is_alive = (bool)sci->sc_task;
 	spin_unlock(&sci->sc_state_lock);
-	del_timer_sync(&sci->sc_timer);
+
+	/*
+	 * This function does not race with the log writer thread's
+	 * termination.  Therefore, deleting sc_timer, which should not be
+	 * done after the log writer thread exits, can be done safely outside
+	 * the area protected by sc_state_lock.
+	 */
+	if (thread_is_alive)
+		del_timer_sync(&sci->sc_timer);
 }
 
 /**
@@ -2383,7 +2418,7 @@
 	if (mode == SC_LSEG_SR) {
 		sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
 		sci->sc_seq_done = sci->sc_seq_accepted;
-		nilfs_segctor_wakeup(sci, err);
+		nilfs_segctor_wakeup(sci, err, false);
 		sci->sc_flush_request = 0;
 	} else {
 		if (mode == SC_FLUSH_FILE)
@@ -2392,7 +2427,7 @@
 			sci->sc_flush_request &= ~FLUSH_DAT_BIT;
 
 		/* re-enable timer if checkpoint creation was not done */
-		if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) &&
+		if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) && sci->sc_task &&
 		    time_before(jiffies, sci->sc_timer.expires))
 			add_timer(&sci->sc_timer);
 	}
@@ -2582,6 +2617,7 @@
 	int timeout = 0;
 
 	sci->sc_timer_task = current;
+	timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0);
 
 	/* start sync. */
 	sci->sc_task = current;
@@ -2649,6 +2685,7 @@
  end_thread:
 	/* end sync. */
 	sci->sc_task = NULL;
+	timer_shutdown_sync(&sci->sc_timer);
 	wake_up(&sci->sc_wait_task); /* for nilfs_segctor_kill_thread() */
 	spin_unlock(&sci->sc_state_lock);
 	return 0;
@@ -2712,7 +2749,6 @@
 	INIT_LIST_HEAD(&sci->sc_gc_inodes);
 	INIT_LIST_HEAD(&sci->sc_iput_queue);
 	INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func);
-	timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0);
 
 	sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT;
 	sci->sc_mjcp_freq = HZ * NILFS_SC_DEFAULT_SR_FREQ;
@@ -2766,6 +2802,13 @@
 		|| sci->sc_seq_request != sci->sc_seq_done);
 	spin_unlock(&sci->sc_state_lock);
 
+	/*
+	 * Forcibly wake up tasks waiting in nilfs_segctor_sync(), which can
+	 * be called from delayed iput() via nilfs_evict_inode() and can race
+	 * with the above log writer thread termination.
+	 */
+	nilfs_segctor_wakeup(sci, 0, true);
+
 	if (flush_work(&sci->sc_iput_work))
 		flag = true;
 
@@ -2791,7 +2834,6 @@
 
 	down_write(&nilfs->ns_segctor_sem);
 
-	timer_shutdown_sync(&sci->sc_timer);
 	kfree(sci);
 }
 
--- linux-qcom-6.8.0.orig/fs/nilfs2/sysfs.c
+++ linux-qcom-6.8.0/fs/nilfs2/sysfs.c
@@ -836,9 +836,15 @@
 				struct the_nilfs *nilfs,
 				char *buf)
 {
-	struct nilfs_super_block **sbp = nilfs->ns_sbp;
-	u32 major = le32_to_cpu(sbp[0]->s_rev_level);
-	u16 minor = le16_to_cpu(sbp[0]->s_minor_rev_level);
+	struct nilfs_super_block *raw_sb;
+	u32 major;
+	u16 minor;
+
+	down_read(&nilfs->ns_sem);
+	raw_sb = nilfs->ns_sbp[0];
+	major = le32_to_cpu(raw_sb->s_rev_level);
+	minor = le16_to_cpu(raw_sb->s_minor_rev_level);
+	up_read(&nilfs->ns_sem);
 
 	return sysfs_emit(buf, "%d.%d\n", major, minor);
 }
@@ -856,8 +862,13 @@
 				    struct the_nilfs *nilfs,
 				    char *buf)
 {
-	struct nilfs_super_block **sbp = nilfs->ns_sbp;
-	u64 dev_size = le64_to_cpu(sbp[0]->s_dev_size);
+	struct nilfs_super_block *raw_sb;
+	u64 dev_size;
+
+	down_read(&nilfs->ns_sem);
+	raw_sb = nilfs->ns_sbp[0];
+	dev_size = le64_to_cpu(raw_sb->s_dev_size);
+	up_read(&nilfs->ns_sem);
 
 	return sysfs_emit(buf, "%llu\n", dev_size);
 }
@@ -879,9 +890,15 @@
 			    struct the_nilfs *nilfs,
 			    char *buf)
 {
-	struct nilfs_super_block **sbp = nilfs->ns_sbp;
+	struct nilfs_super_block *raw_sb;
+	ssize_t len;
+
+	down_read(&nilfs->ns_sem);
+	raw_sb = nilfs->ns_sbp[0];
+	len = sysfs_emit(buf, "%pUb\n", raw_sb->s_uuid);
+	up_read(&nilfs->ns_sem);
 
-	return sysfs_emit(buf, "%pUb\n", sbp[0]->s_uuid);
+	return len;
 }
 
 static
@@ -889,10 +906,16 @@
 				    struct the_nilfs *nilfs,
 				    char *buf)
 {
-	struct nilfs_super_block **sbp = nilfs->ns_sbp;
+	struct nilfs_super_block *raw_sb;
+	ssize_t len;
+
+	down_read(&nilfs->ns_sem);
+	raw_sb = nilfs->ns_sbp[0];
+	len = scnprintf(buf, sizeof(raw_sb->s_volume_name), "%s\n",
+			raw_sb->s_volume_name);
+	up_read(&nilfs->ns_sem);
 
-	return scnprintf(buf, sizeof(sbp[0]->s_volume_name), "%s\n",
-			 sbp[0]->s_volume_name);
+	return len;
 }
 
 static const char dev_readme_str[] =
--- linux-qcom-6.8.0.orig/fs/nilfs2/the_nilfs.c
+++ linux-qcom-6.8.0/fs/nilfs2/the_nilfs.c
@@ -452,6 +452,12 @@
 	}
 
 	nilfs->ns_first_ino = le32_to_cpu(sbp->s_first_ino);
+	if (nilfs->ns_first_ino < NILFS_USER_INO) {
+		nilfs_err(nilfs->ns_sb,
+			  "too small lower limit for non-reserved inode numbers: %u",
+			  nilfs->ns_first_ino);
+		return -EINVAL;
+	}
 
 	nilfs->ns_blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment);
 	if (nilfs->ns_blocks_per_segment < NILFS_SEG_MIN_BLOCKS) {
--- linux-qcom-6.8.0.orig/fs/nilfs2/the_nilfs.h
+++ linux-qcom-6.8.0/fs/nilfs2/the_nilfs.h
@@ -182,7 +182,7 @@
 	unsigned long		ns_nrsvsegs;
 	unsigned long		ns_first_data_block;
 	int			ns_inode_size;
-	int			ns_first_ino;
+	unsigned int		ns_first_ino;
 	u32			ns_crc_seed;
 
 	/* /sys/fs/<nilfs>/<device> */
--- linux-qcom-6.8.0.orig/fs/notify/fanotify/fanotify_user.c
+++ linux-qcom-6.8.0/fs/notify/fanotify/fanotify_user.c
@@ -266,13 +266,6 @@
 			       group->fanotify_data.f_flags | __FMODE_NONOTIFY,
 			       current_cred());
 	if (IS_ERR(new_file)) {
-		/*
-		 * we still send an event even if we can't open the file.  this
-		 * can happen when say tasks are gone and we try to open their
-		 * /proc files or we try to open a WRONLY file like in sysfs
-		 * we just send the errno to userspace since there isn't much
-		 * else we can do.
-		 */
 		put_unused_fd(client_fd);
 		client_fd = PTR_ERR(new_file);
 	} else {
@@ -663,7 +656,7 @@
 	unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES);
 	unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD;
 	struct file *f = NULL, *pidfd_file = NULL;
-	int ret, pidfd = FAN_NOPIDFD, fd = FAN_NOFD;
+	int ret, pidfd = -ESRCH, fd = -EBADF;
 
 	pr_debug("%s: group=%p event=%p\n", __func__, group, event);
 
@@ -691,10 +684,39 @@
 	if (!FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) &&
 	    path && path->mnt && path->dentry) {
 		fd = create_fd(group, path, &f);
-		if (fd < 0)
-			return fd;
+		/*
+		 * Opening an fd from dentry can fail for several reasons.
+		 * For example, when tasks are gone and we try to open their
+		 * /proc files or we try to open a WRONLY file like in sysfs
+		 * or when trying to open a file that was deleted on the
+		 * remote network server.
+		 *
+		 * For a group with FAN_REPORT_FD_ERROR, we will send the
+		 * event with the error instead of the open fd, otherwise
+		 * Userspace may not get the error at all.
+		 * In any case, userspace will not know which file failed to
+		 * open, so add a debug print for further investigation.
+		 */
+		if (fd < 0) {
+			pr_debug("fanotify: create_fd(%pd2) failed err=%d\n",
+				 path->dentry, fd);
+			if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR)) {
+				/*
+				 * Historically, we've handled EOPENSTALE in a
+				 * special way and silently dropped such
+				 * events. Now we have to keep it to maintain
+				 * backward compatibility...
+				 */
+				if (fd == -EOPENSTALE)
+					fd = 0;
+				return fd;
+			}
+		}
 	}
-	metadata.fd = fd;
+	if (FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR))
+		metadata.fd = fd;
+	else
+		metadata.fd = fd >= 0 ? fd : FAN_NOFD;
 
 	if (pidfd_mode) {
 		/*
@@ -709,18 +731,16 @@
 		 * The PIDTYPE_TGID check for an event->pid is performed
 		 * preemptively in an attempt to catch out cases where the event
 		 * listener reads events after the event generating process has
-		 * already terminated. Report FAN_NOPIDFD to the event listener
-		 * in those cases, with all other pidfd creation errors being
-		 * reported as FAN_EPIDFD.
+		 * already terminated.  Depending on flag FAN_REPORT_FD_ERROR,
+		 * report either -ESRCH or FAN_NOPIDFD to the event listener in
+		 * those cases with all other pidfd creation errors reported as
+		 * the error code itself or as FAN_EPIDFD.
 		 */
-		if (metadata.pid == 0 ||
-		    !pid_has_task(event->pid, PIDTYPE_TGID)) {
-			pidfd = FAN_NOPIDFD;
-		} else {
+		if (metadata.pid && pid_has_task(event->pid, PIDTYPE_TGID))
 			pidfd = pidfd_prepare(event->pid, 0, &pidfd_file);
-			if (pidfd < 0)
-				pidfd = FAN_EPIDFD;
-		}
+
+		if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0)
+			pidfd = pidfd == -ESRCH ? FAN_NOPIDFD : FAN_EPIDFD;
 	}
 
 	ret = -EFAULT;
@@ -737,9 +757,6 @@
 	buf += FAN_EVENT_METADATA_LEN;
 	count -= FAN_EVENT_METADATA_LEN;
 
-	if (fanotify_is_perm_event(event->mask))
-		FANOTIFY_PERM(event)->fd = fd;
-
 	if (info_mode) {
 		ret = copy_info_records_to_user(event, info, info_mode, pidfd,
 						buf, count);
@@ -753,15 +770,18 @@
 	if (pidfd_file)
 		fd_install(pidfd, pidfd_file);
 
+	if (fanotify_is_perm_event(event->mask))
+		FANOTIFY_PERM(event)->fd = fd;
+
 	return metadata.event_len;
 
 out_close_fd:
-	if (fd != FAN_NOFD) {
+	if (f) {
 		put_unused_fd(fd);
 		fput(f);
 	}
 
-	if (pidfd >= 0) {
+	if (pidfd_file) {
 		put_unused_fd(pidfd);
 		fput(pidfd_file);
 	}
@@ -828,15 +848,6 @@
 		}
 
 		ret = copy_event_to_user(group, event, buf, count);
-		if (unlikely(ret == -EOPENSTALE)) {
-			/*
-			 * We cannot report events with stale fd so drop it.
-			 * Setting ret to 0 will continue the event loop and
-			 * do the right thing if there are no more events to
-			 * read (i.e. return bytes read, -EAGAIN or wait).
-			 */
-			ret = 0;
-		}
 
 		/*
 		 * Permission events get queued to wait for response.  Other
@@ -845,7 +856,7 @@
 		if (!fanotify_is_perm_event(event->mask)) {
 			fsnotify_destroy_event(group, &event->fse);
 		} else {
-			if (ret <= 0) {
+			if (ret <= 0 || FANOTIFY_PERM(event)->fd < 0) {
 				spin_lock(&group->notification_lock);
 				finish_permission_event(group,
 					FANOTIFY_PERM(event), FAN_DENY, NULL);
@@ -2011,7 +2022,7 @@
 				     FANOTIFY_DEFAULT_MAX_USER_MARKS);
 
 	BUILD_BUG_ON(FANOTIFY_INIT_FLAGS & FANOTIFY_INTERNAL_GROUP_FLAGS);
-	BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 12);
+	BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 13);
 	BUILD_BUG_ON(HWEIGHT32(FANOTIFY_MARK_FLAGS) != 11);
 
 	fanotify_mark_cache = KMEM_CACHE(fanotify_mark,
--- linux-qcom-6.8.0.orig/fs/notify/fdinfo.c
+++ linux-qcom-6.8.0/fs/notify/fdinfo.c
@@ -51,10 +51,8 @@
 	size = f.handle.handle_bytes >> 2;
 
 	ret = exportfs_encode_fid(inode, (struct fid *)f.handle.f_handle, &size);
-	if ((ret == FILEID_INVALID) || (ret < 0)) {
-		WARN_ONCE(1, "Can't encode file handler for inotify: %d\n", ret);
+	if ((ret == FILEID_INVALID) || (ret < 0))
 		return;
-	}
 
 	f.handle.handle_type = ret;
 	f.handle.handle_bytes = size * sizeof(u32);
--- linux-qcom-6.8.0.orig/fs/notify/fsnotify.c
+++ linux-qcom-6.8.0/fs/notify/fsnotify.c
@@ -103,17 +103,13 @@
  * parent cares.  Thus when an event happens on a child it can quickly tell
  * if there is a need to find a parent and send the event to the parent.
  */
-void __fsnotify_update_child_dentry_flags(struct inode *inode)
+void fsnotify_set_children_dentry_flags(struct inode *inode)
 {
 	struct dentry *alias;
-	int watched;
 
 	if (!S_ISDIR(inode->i_mode))
 		return;
 
-	/* determine if the children should tell inode about their events */
-	watched = fsnotify_inode_watches_children(inode);
-
 	spin_lock(&inode->i_lock);
 	/* run all of the dentries associated with this inode.  Since this is a
 	 * directory, there damn well better only be one item on this list */
@@ -129,10 +125,7 @@
 				continue;
 
 			spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED);
-			if (watched)
-				child->d_flags |= DCACHE_FSNOTIFY_PARENT_WATCHED;
-			else
-				child->d_flags &= ~DCACHE_FSNOTIFY_PARENT_WATCHED;
+			child->d_flags |= DCACHE_FSNOTIFY_PARENT_WATCHED;
 			spin_unlock(&child->d_lock);
 		}
 		spin_unlock(&alias->d_lock);
@@ -140,8 +133,26 @@
 	spin_unlock(&inode->i_lock);
 }
 
+/*
+ * Lazily clear false positive PARENT_WATCHED flag for child whose parent had
+ * stopped watching children.
+ */
+static void fsnotify_clear_child_dentry_flag(struct inode *pinode,
+					     struct dentry *dentry)
+{
+	spin_lock(&dentry->d_lock);
+	/*
+	 * d_lock is a sufficient barrier to prevent observing a non-watched
+	 * parent state from before the fsnotify_set_children_dentry_flags()
+	 * or fsnotify_update_flags() call that had set PARENT_WATCHED.
+	 */
+	if (!fsnotify_inode_watches_children(pinode))
+		dentry->d_flags &= ~DCACHE_FSNOTIFY_PARENT_WATCHED;
+	spin_unlock(&dentry->d_lock);
+}
+
 /* Are inode/sb/mount interested in parent and name info with this event? */
-static bool fsnotify_event_needs_parent(struct inode *inode, struct mount *mnt,
+static bool fsnotify_event_needs_parent(struct inode *inode, __u32 mnt_mask,
 					__u32 mask)
 {
 	__u32 marks_mask = 0;
@@ -158,15 +169,26 @@
 	BUILD_BUG_ON(FS_EVENTS_POSS_ON_CHILD & ~FS_EVENTS_POSS_TO_PARENT);
 
 	/* Did either inode/sb/mount subscribe for events with parent/name? */
-	marks_mask |= fsnotify_parent_needed_mask(inode->i_fsnotify_mask);
-	marks_mask |= fsnotify_parent_needed_mask(inode->i_sb->s_fsnotify_mask);
-	if (mnt)
-		marks_mask |= fsnotify_parent_needed_mask(mnt->mnt_fsnotify_mask);
+	marks_mask |= fsnotify_parent_needed_mask(
+				READ_ONCE(inode->i_fsnotify_mask));
+	marks_mask |= fsnotify_parent_needed_mask(
+				READ_ONCE(inode->i_sb->s_fsnotify_mask));
+	marks_mask |= fsnotify_parent_needed_mask(mnt_mask);
 
 	/* Did they subscribe for this event with parent/name info? */
 	return mask & marks_mask;
 }
 
+/* Are there any inode/mount/sb objects that are interested in this event? */
+static inline bool fsnotify_object_watched(struct inode *inode, __u32 mnt_mask,
+					   __u32 mask)
+{
+	__u32 marks_mask = READ_ONCE(inode->i_fsnotify_mask) | mnt_mask |
+			   READ_ONCE(inode->i_sb->s_fsnotify_mask);
+
+	return mask & marks_mask & ALL_FSNOTIFY_EVENTS;
+}
+
 /*
  * Notify this dentry's parent about a child's events with child name info
  * if parent is watching or if inode/sb/mount are interested in events with
@@ -179,7 +201,8 @@
 		      int data_type)
 {
 	const struct path *path = fsnotify_data_path(data, data_type);
-	struct mount *mnt = path ? real_mount(path->mnt) : NULL;
+	__u32 mnt_mask = path ?
+		READ_ONCE(real_mount(path->mnt)->mnt_fsnotify_mask) : 0;
 	struct inode *inode = d_inode(dentry);
 	struct dentry *parent;
 	bool parent_watched = dentry->d_flags & DCACHE_FSNOTIFY_PARENT_WATCHED;
@@ -190,16 +213,13 @@
 	struct qstr *file_name = NULL;
 	int ret = 0;
 
-	/*
-	 * Do inode/sb/mount care about parent and name info on non-dir?
-	 * Do they care about any event at all?
-	 */
-	if (!inode->i_fsnotify_marks && !inode->i_sb->s_fsnotify_marks &&
-	    (!mnt || !mnt->mnt_fsnotify_marks) && !parent_watched)
+	/* Optimize the likely case of nobody watching this path */
+	if (likely(!parent_watched &&
+		   !fsnotify_object_watched(inode, mnt_mask, mask)))
 		return 0;
 
 	parent = NULL;
-	parent_needed = fsnotify_event_needs_parent(inode, mnt, mask);
+	parent_needed = fsnotify_event_needs_parent(inode, mnt_mask, mask);
 	if (!parent_watched && !parent_needed)
 		goto notify;
 
@@ -208,7 +228,7 @@
 	p_inode = parent->d_inode;
 	p_mask = fsnotify_inode_watches_children(p_inode);
 	if (unlikely(parent_watched && !p_mask))
-		__fsnotify_update_child_dentry_flags(p_inode);
+		fsnotify_clear_child_dentry_flag(p_inode, dentry);
 
 	/*
 	 * Include parent/name in notification either if some notification
@@ -299,16 +319,19 @@
 	if (!inode_mark)
 		return 0;
 
-	if (mask & FS_EVENT_ON_CHILD) {
-		/*
-		 * Some events can be sent on both parent dir and child marks
-		 * (e.g. FS_ATTRIB).  If both parent dir and child are
-		 * watching, report the event once to parent dir with name (if
-		 * interested) and once to child without name (if interested).
-		 * The child watcher is expecting an event without a file name
-		 * and without the FS_EVENT_ON_CHILD flag.
-		 */
-		mask &= ~FS_EVENT_ON_CHILD;
+	/*
+	 * Some events can be sent on both parent dir and child marks (e.g.
+	 * FS_ATTRIB).  If both parent dir and child are watching, report the
+	 * event once to parent dir with name (if interested) and once to child
+	 * without name (if interested).
+	 *
+	 * In any case regardless whether the parent is watching or not, the
+	 * child watcher is expecting an event without the FS_EVENT_ON_CHILD
+	 * flag. The file name is expected if and only if this is a directory
+	 * event.
+	 */
+	mask &= ~FS_EVENT_ON_CHILD;
+	if (!(mask & ALL_FSNOTIFY_DIRENT_EVENTS)) {
 		dir = NULL;
 		name = NULL;
 	}
@@ -525,13 +548,13 @@
 	    (!inode2 || !inode2->i_fsnotify_marks))
 		return 0;
 
-	marks_mask = sb->s_fsnotify_mask;
+	marks_mask = READ_ONCE(sb->s_fsnotify_mask);
 	if (mnt)
-		marks_mask |= mnt->mnt_fsnotify_mask;
+		marks_mask |= READ_ONCE(mnt->mnt_fsnotify_mask);
 	if (inode)
-		marks_mask |= inode->i_fsnotify_mask;
+		marks_mask |= READ_ONCE(inode->i_fsnotify_mask);
 	if (inode2)
-		marks_mask |= inode2->i_fsnotify_mask;
+		marks_mask |= READ_ONCE(inode2->i_fsnotify_mask);
 
 
 	/*
--- linux-qcom-6.8.0.orig/fs/notify/fsnotify.h
+++ linux-qcom-6.8.0/fs/notify/fsnotify.h
@@ -74,7 +74,7 @@
  * update the dentry->d_flags of all of inode's children to indicate if inode cares
  * about events that happen to its children.
  */
-extern void __fsnotify_update_child_dentry_flags(struct inode *inode);
+extern void fsnotify_set_children_dentry_flags(struct inode *inode);
 
 extern struct kmem_cache *fsnotify_mark_connector_cachep;
 
--- linux-qcom-6.8.0.orig/fs/notify/inotify/inotify_user.c
+++ linux-qcom-6.8.0/fs/notify/inotify/inotify_user.c
@@ -569,7 +569,7 @@
 		/* more bits in old than in new? */
 		int dropped = (old_mask & ~new_mask);
 		/* more bits in this fsn_mark than the inode's mask? */
-		int do_inode = (new_mask & ~inode->i_fsnotify_mask);
+		int do_inode = (new_mask & ~READ_ONCE(inode->i_fsnotify_mask));
 
 		/* update the inode with this new fsn_mark */
 		if (dropped || do_inode)
--- linux-qcom-6.8.0.orig/fs/notify/mark.c
+++ linux-qcom-6.8.0/fs/notify/mark.c
@@ -113,7 +113,7 @@
 	if (WARN_ON(!fsnotify_valid_obj_type(conn->type)))
 		return 0;
 
-	return *fsnotify_conn_mask_p(conn);
+	return READ_ONCE(*fsnotify_conn_mask_p(conn));
 }
 
 static void fsnotify_get_inode_ref(struct inode *inode)
@@ -171,11 +171,33 @@
 		    !(mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF))
 			want_iref = true;
 	}
-	*fsnotify_conn_mask_p(conn) = new_mask;
+	/*
+	 * We use WRITE_ONCE() to prevent silly compiler optimizations from
+	 * confusing readers not holding conn->lock with partial updates.
+	 */
+	WRITE_ONCE(*fsnotify_conn_mask_p(conn), new_mask);
 
 	return fsnotify_update_iref(conn, want_iref);
 }
 
+static bool fsnotify_conn_watches_children(
+					struct fsnotify_mark_connector *conn)
+{
+	if (conn->type != FSNOTIFY_OBJ_TYPE_INODE)
+		return false;
+
+	return fsnotify_inode_watches_children(fsnotify_conn_inode(conn));
+}
+
+static void fsnotify_conn_set_children_dentry_flags(
+					struct fsnotify_mark_connector *conn)
+{
+	if (conn->type != FSNOTIFY_OBJ_TYPE_INODE)
+		return;
+
+	fsnotify_set_children_dentry_flags(fsnotify_conn_inode(conn));
+}
+
 /*
  * Calculate mask of events for a list of marks. The caller must make sure
  * connector and connector->obj cannot disappear under us.  Callers achieve
@@ -184,15 +206,23 @@
  */
 void fsnotify_recalc_mask(struct fsnotify_mark_connector *conn)
 {
+	bool update_children;
+
 	if (!conn)
 		return;
 
 	spin_lock(&conn->lock);
+	update_children = !fsnotify_conn_watches_children(conn);
 	__fsnotify_recalc_mask(conn);
+	update_children &= fsnotify_conn_watches_children(conn);
 	spin_unlock(&conn->lock);
-	if (conn->type == FSNOTIFY_OBJ_TYPE_INODE)
-		__fsnotify_update_child_dentry_flags(
-					fsnotify_conn_inode(conn));
+	/*
+	 * Set children's PARENT_WATCHED flags only if parent started watching.
+	 * When parent stops watching, we clear false positive PARENT_WATCHED
+	 * flags lazily in __fsnotify_parent().
+	 */
+	if (update_children)
+		fsnotify_conn_set_children_dentry_flags(conn);
 }
 
 /* Free all connectors queued for freeing once SRCU period ends */
--- linux-qcom-6.8.0.orig/fs/ntfs3/attrib.c
+++ linux-qcom-6.8.0/fs/ntfs3/attrib.c
@@ -231,7 +231,7 @@
 	struct ntfs_sb_info *sbi;
 	struct ATTRIB *attr_s;
 	struct MFT_REC *rec;
-	u32 used, asize, rsize, aoff, align;
+	u32 used, asize, rsize, aoff;
 	bool is_data;
 	CLST len, alen;
 	char *next;
@@ -252,10 +252,13 @@
 	rsize = le32_to_cpu(attr->res.data_size);
 	is_data = attr->type == ATTR_DATA && !attr->name_len;
 
-	align = sbi->cluster_size;
-	if (is_attr_compressed(attr))
-		align <<= COMPRESSION_UNIT;
-	len = (rsize + align - 1) >> sbi->cluster_bits;
+	/* len - how many clusters required to store 'rsize' bytes */
+	if (is_attr_compressed(attr)) {
+		u8 shift = sbi->cluster_bits + NTFS_LZNT_CUNIT;
+		len = ((rsize + (1u << shift) - 1) >> shift) << NTFS_LZNT_CUNIT;
+	} else {
+		len = bytes_to_cluster(sbi, rsize);
+	}
 
 	run_init(run);
 
@@ -670,7 +673,8 @@
 			goto undo_2;
 		}
 
-		if (!is_mft)
+		/* keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP. */
+		if (ni->mi.rno != MFT_REC_MFT)
 			run_truncate_head(run, evcn + 1);
 
 		svcn = le64_to_cpu(attr->nres.svcn);
@@ -972,6 +976,21 @@
 	if (err)
 		goto out;
 
+	/* Check for compressed frame. */
+	err = attr_is_frame_compressed(ni, attr_b, vcn >> NTFS_LZNT_CUNIT,
+				       &hint, run);
+	if (err)
+		goto out;
+
+	if (hint) {
+		/* if frame is compressed - don't touch it. */
+		*lcn = COMPRESSED_LCN;
+		/* length to the end of frame. */
+		*len = NTFS_LZNT_CLUSTERS - (vcn & (NTFS_LZNT_CLUSTERS - 1));
+		err = 0;
+		goto out;
+	}
+
 	if (!*len) {
 		if (run_lookup_entry(run, vcn, lcn, len, NULL)) {
 			if (*lcn != SPARSE_LCN || !new)
@@ -1011,16 +1030,16 @@
 
 		/* Check if 'vcn' and 'vcn0' in different attribute segments. */
 		if (vcn < svcn || evcn1 <= vcn) {
-			/* Load attribute for truncated vcn. */
-			attr = ni_find_attr(ni, attr_b, &le, ATTR_DATA, NULL, 0,
-					    &vcn, &mi);
-			if (!attr) {
+			struct ATTRIB *attr2;
+			/* Load runs for truncated vcn. */
+			attr2 = ni_find_attr(ni, attr_b, &le_b, ATTR_DATA, NULL,
+					     0, &vcn, &mi);
+			if (!attr2) {
 				err = -EINVAL;
 				goto out;
 			}
-			svcn = le64_to_cpu(attr->nres.svcn);
-			evcn1 = le64_to_cpu(attr->nres.evcn) + 1;
-			err = attr_load_runs(attr, ni, run, NULL);
+			evcn1 = le64_to_cpu(attr2->nres.evcn) + 1;
+			err = attr_load_runs(attr2, ni, run, NULL);
 			if (err)
 				goto out;
 		}
@@ -1513,15 +1532,18 @@
 
 /*
  * attr_is_frame_compressed - Used to detect compressed frame.
+ *
+ * attr - base (primary) attribute segment.
+ * run  - run to use, usually == &ni->file.run.
+ * Only base segments contains valid 'attr->nres.c_unit'
  */
 int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr,
-			     CLST frame, CLST *clst_data)
+			     CLST frame, CLST *clst_data, struct runs_tree *run)
 {
 	int err;
 	u32 clst_frame;
 	CLST clen, lcn, vcn, alen, slen, vcn_next;
 	size_t idx;
-	struct runs_tree *run;
 
 	*clst_data = 0;
 
@@ -1533,7 +1555,6 @@
 
 	clst_frame = 1u << attr->nres.c_unit;
 	vcn = frame * clst_frame;
-	run = &ni->file.run;
 
 	if (!run_lookup_entry(run, vcn, &lcn, &clen, &idx)) {
 		err = attr_load_runs_vcn(ni, attr->type, attr_name(attr),
@@ -1669,7 +1690,7 @@
 	if (err)
 		goto out;
 
-	err = attr_is_frame_compressed(ni, attr_b, frame, &clst_data);
+	err = attr_is_frame_compressed(ni, attr_b, frame, &clst_data, run);
 	if (err)
 		goto out;
 
@@ -1722,6 +1743,7 @@
 
 	attr_b->nres.total_size = cpu_to_le64(total_size);
 	inode_set_bytes(&ni->vfs_inode, total_size);
+	ni->ni_flags |= NI_FLAG_UPDATE_PARENT;
 
 	mi_b->dirty = true;
 	mark_inode_dirty(&ni->vfs_inode);
--- linux-qcom-6.8.0.orig/fs/ntfs3/bitmap.c
+++ linux-qcom-6.8.0/fs/ntfs3/bitmap.c
@@ -654,7 +654,7 @@
 	wnd->total_zeroes = nbits;
 	wnd->extent_max = MINUS_ONE_T;
 	wnd->zone_bit = wnd->zone_end = 0;
-	wnd->nwnd = bytes_to_block(sb, bitmap_size(nbits));
+	wnd->nwnd = bytes_to_block(sb, ntfs3_bitmap_size(nbits));
 	wnd->bits_last = nbits & (wbits - 1);
 	if (!wnd->bits_last)
 		wnd->bits_last = wbits;
@@ -1347,7 +1347,7 @@
 		return -EINVAL;
 
 	/* Align to 8 byte boundary. */
-	new_wnd = bytes_to_block(sb, bitmap_size(new_bits));
+	new_wnd = bytes_to_block(sb, ntfs3_bitmap_size(new_bits));
 	new_last = new_bits & (wbits - 1);
 	if (!new_last)
 		new_last = wbits;
@@ -1382,7 +1382,7 @@
 
 		err = ntfs_vbo_to_lbo(sbi, &wnd->run, vbo, &lbo, &bytes);
 		if (err)
-			break;
+			return err;
 
 		bh = ntfs_bread(sb, lbo >> sb->s_blocksize_bits);
 		if (!bh)
--- linux-qcom-6.8.0.orig/fs/ntfs3/dir.c
+++ linux-qcom-6.8.0/fs/ntfs3/dir.c
@@ -272,9 +272,12 @@
 	return err == -ENOENT ? NULL : err ? ERR_PTR(err) : inode;
 }
 
-static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni,
-			       const struct NTFS_DE *e, u8 *name,
-			       struct dir_context *ctx)
+/*
+ * returns false if 'ctx' if full
+ */
+static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi,
+				 struct ntfs_inode *ni, const struct NTFS_DE *e,
+				 u8 *name, struct dir_context *ctx)
 {
 	const struct ATTR_FILE_NAME *fname;
 	unsigned long ino;
@@ -284,29 +287,29 @@
 	fname = Add2Ptr(e, sizeof(struct NTFS_DE));
 
 	if (fname->type == FILE_NAME_DOS)
-		return 0;
+		return true;
 
 	if (!mi_is_ref(&ni->mi, &fname->home))
-		return 0;
+		return true;
 
 	ino = ino_get(&e->ref);
 
 	if (ino == MFT_REC_ROOT)
-		return 0;
+		return true;
 
 	/* Skip meta files. Unless option to show metafiles is set. */
 	if (!sbi->options->showmeta && ntfs_is_meta_file(sbi, ino))
-		return 0;
+		return true;
 
 	if (sbi->options->nohidden && (fname->dup.fa & FILE_ATTRIBUTE_HIDDEN))
-		return 0;
+		return true;
 
 	name_len = ntfs_utf16_to_nls(sbi, fname->name, fname->name_len, name,
 				     PATH_MAX);
 	if (name_len <= 0) {
 		ntfs_warn(sbi->sb, "failed to convert name for inode %lx.",
 			  ino);
-		return 0;
+		return true;
 	}
 
 	/*
@@ -326,7 +329,8 @@
 	 * It does additional locks/reads just to get the type of name.
 	 * Should we use additional mount option to enable branch below?
 	 */
-	if ((fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) &&
+	if (((fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) ||
+	     fname->dup.ea_size) &&
 	    ino != ni->mi.rno) {
 		struct inode *inode = ntfs_iget5(sbi->sb, &e->ref, NULL);
 		if (!IS_ERR_OR_NULL(inode)) {
@@ -335,17 +339,20 @@
 		}
 	}
 
-	return !dir_emit(ctx, (s8 *)name, name_len, ino, dt_type);
+	return dir_emit(ctx, (s8 *)name, name_len, ino, dt_type);
 }
 
 /*
  * ntfs_read_hdr - Helper function for ntfs_readdir().
+ *
+ * returns 0 if ok.
+ * returns -EINVAL if directory is corrupted.
+ * returns +1 if 'ctx' is full.
  */
 static int ntfs_read_hdr(struct ntfs_sb_info *sbi, struct ntfs_inode *ni,
 			 const struct INDEX_HDR *hdr, u64 vbo, u64 pos,
 			 u8 *name, struct dir_context *ctx)
 {
-	int err;
 	const struct NTFS_DE *e;
 	u32 e_size;
 	u32 end = le32_to_cpu(hdr->used);
@@ -353,12 +360,12 @@
 
 	for (;; off += e_size) {
 		if (off + sizeof(struct NTFS_DE) > end)
-			return -1;
+			return -EINVAL;
 
 		e = Add2Ptr(hdr, off);
 		e_size = le16_to_cpu(e->size);
 		if (e_size < sizeof(struct NTFS_DE) || off + e_size > end)
-			return -1;
+			return -EINVAL;
 
 		if (de_is_last(e))
 			return 0;
@@ -368,14 +375,15 @@
 			continue;
 
 		if (le16_to_cpu(e->key_size) < SIZEOF_ATTRIBUTE_FILENAME)
-			return -1;
+			return -EINVAL;
 
 		ctx->pos = vbo + off;
 
 		/* Submit the name to the filldir callback. */
-		err = ntfs_filldir(sbi, ni, e, name, ctx);
-		if (err)
-			return err;
+		if (!ntfs_dir_emit(sbi, ni, e, name, ctx)) {
+			/* ctx is full. */
+			return +1;
+		}
 	}
 }
 
@@ -474,7 +482,6 @@
 
 		vbo = (u64)bit << index_bits;
 		if (vbo >= i_size) {
-			ntfs_inode_err(dir, "Looks like your dir is corrupt");
 			err = -EINVAL;
 			goto out;
 		}
@@ -497,9 +504,16 @@
 	__putname(name);
 	put_indx_node(node);
 
-	if (err == -ENOENT) {
+	if (err == 1) {
+		/* 'ctx' is full. */
+		err = 0;
+	} else if (err == -ENOENT) {
 		err = 0;
 		ctx->pos = pos;
+	} else if (err < 0) {
+		if (err == -EINVAL)
+			ntfs_inode_err(dir, "directory corrupted");
+		ctx->pos = eod;
 	}
 
 	return err;
--- linux-qcom-6.8.0.orig/fs/ntfs3/file.c
+++ linux-qcom-6.8.0/fs/ntfs3/file.c
@@ -299,10 +299,7 @@
 		}
 
 		if (ni->i_valid < to) {
-			if (!inode_trylock(inode)) {
-				err = -EAGAIN;
-				goto out;
-			}
+			inode_lock(inode);
 			err = ntfs_extend_initialized_size(file, ni,
 							   ni->i_valid, to);
 			inode_unlock(inode);
@@ -345,6 +342,42 @@
 		err = 0;
 	}
 
+	if (file && is_sparsed(ni)) {
+		/*
+		 * This code optimizes large writes to sparse file.
+		 * TODO: merge this fragment with fallocate fragment.
+		 */
+		struct ntfs_sb_info *sbi = ni->mi.sbi;
+		CLST vcn = pos >> sbi->cluster_bits;
+		CLST cend = bytes_to_cluster(sbi, end);
+		CLST cend_v = bytes_to_cluster(sbi, ni->i_valid);
+		CLST lcn, clen;
+		bool new;
+
+		if (cend_v > cend)
+			cend_v = cend;
+
+		/*
+		 * Allocate and zero new clusters.
+		 * Zeroing these clusters may be too long.
+		 */
+		for (; vcn < cend_v; vcn += clen) {
+			err = attr_data_get_block(ni, vcn, cend_v - vcn, &lcn,
+						  &clen, &new, true);
+			if (err)
+				goto out;
+		}
+		/*
+		 * Allocate but not zero new clusters.
+		 */
+		for (; vcn < cend; vcn += clen) {
+			err = attr_data_get_block(ni, vcn, cend - vcn, &lcn,
+						  &clen, &new, false);
+			if (err)
+				goto out;
+		}
+	}
+
 	inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
 	mark_inode_dirty(inode);
 
@@ -421,7 +454,7 @@
 }
 
 /*
- * ntfs_fallocate
+ * ntfs_fallocate - file_operations::ntfs_fallocate
  *
  * Preallocate space for a file. This implements ntfs's fallocate file
  * operation, which gets called from sys_fallocate system call. User
@@ -556,6 +589,8 @@
 		ni_lock(ni);
 		err = attr_collapse_range(ni, vbo, len);
 		ni_unlock(ni);
+		if (err)
+			goto out;
 	} else if (mode & FALLOC_FL_INSERT_RANGE) {
 		/* Check new size. */
 		err = inode_newsize_ok(inode, new_size);
@@ -1174,7 +1209,14 @@
 	/* If we are last writer on the inode, drop the block reservation. */
 	if (sbi->options->prealloc &&
 	    ((file->f_mode & FMODE_WRITE) &&
-	     atomic_read(&inode->i_writecount) == 1)) {
+	     atomic_read(&inode->i_writecount) == 1)
+	   /*
+	    * The only file when inode->i_fop = &ntfs_file_operations and
+	    * init_rwsem(&ni->file.run_lock) is not called explicitly is MFT.
+	    *
+	    * Add additional check here.
+	    */
+	    && inode->i_ino != MFT_REC_MFT) {
 		ni_lock(ni);
 		down_write(&ni->file.run_lock);
 
--- linux-qcom-6.8.0.orig/fs/ntfs3/frecord.c
+++ linux-qcom-6.8.0/fs/ntfs3/frecord.c
@@ -102,7 +102,9 @@
 {
 	struct rb_node *node;
 
-	if (!ni->vfs_inode.i_nlink && ni->mi.mrec && is_rec_inuse(ni->mi.mrec))
+	if (!ni->vfs_inode.i_nlink && ni->mi.mrec &&
+	    is_rec_inuse(ni->mi.mrec) &&
+	    !(ni->mi.sbi->flags & NTFS_FLAGS_LOG_REPLAYING))
 		ni_delete_all(ni);
 
 	al_destroy(ni);
@@ -1501,7 +1503,7 @@
 
 	if (is_ext) {
 		if (flags & ATTR_FLAG_COMPRESSED)
-			attr->nres.c_unit = COMPRESSION_UNIT;
+			attr->nres.c_unit = NTFS_LZNT_CUNIT;
 		attr->nres.total_size = attr->nres.alloc_size;
 	}
 
@@ -1601,8 +1603,10 @@
 		asize = le32_to_cpu(attr->size);
 		roff = le16_to_cpu(attr->nres.run_off);
 
-		if (roff > asize)
+		if (roff > asize) {
+			_ntfs_bad_inode(&ni->vfs_inode);
 			return -EINVAL;
+		}
 
 		/* run==1 means unpack and deallocate. */
 		run_unpack_ex(RUN_DEALLOCATE, sbi, ni->mi.rno, svcn, evcn, svcn,
@@ -1908,8 +1912,7 @@
 	int err = 0;
 	struct ntfs_sb_info *sbi = ni->mi.sbi;
 	u8 cluster_bits = sbi->cluster_bits;
-	struct runs_tree *run;
-	struct rw_semaphore *run_lock;
+	struct runs_tree run;
 	struct ATTRIB *attr;
 	CLST vcn = vbo >> cluster_bits;
 	CLST lcn, clen;
@@ -1920,13 +1923,11 @@
 	u32 flags;
 	bool ok;
 
+	run_init(&run);
 	if (S_ISDIR(ni->vfs_inode.i_mode)) {
-		run = &ni->dir.alloc_run;
 		attr = ni_find_attr(ni, NULL, NULL, ATTR_ALLOC, I30_NAME,
 				    ARRAY_SIZE(I30_NAME), NULL, NULL);
-		run_lock = &ni->dir.run_lock;
 	} else {
-		run = &ni->file.run;
 		attr = ni_find_attr(ni, NULL, NULL, ATTR_DATA, NULL, 0, NULL,
 				    NULL);
 		if (!attr) {
@@ -1941,7 +1942,6 @@
 				"fiemap is not supported for compressed file (cp -r)");
 			goto out;
 		}
-		run_lock = &ni->file.run_lock;
 	}
 
 	if (!attr || !attr->non_res) {
@@ -1958,35 +1958,28 @@
 	if (end > alloc_size)
 		end = alloc_size;
 
-	down_read(run_lock);
 
 	while (vbo < end) {
 		if (idx == -1) {
-			ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx);
+			ok = run_lookup_entry(&run, vcn, &lcn, &clen, &idx);
 		} else {
 			CLST vcn_next = vcn;
 
-			ok = run_get_entry(run, ++idx, &vcn, &lcn, &clen) &&
+			ok = run_get_entry(&run, ++idx, &vcn, &lcn, &clen) &&
 			     vcn == vcn_next;
 			if (!ok)
 				vcn = vcn_next;
 		}
 
 		if (!ok) {
-			up_read(run_lock);
-			down_write(run_lock);
-
 			err = attr_load_runs_vcn(ni, attr->type,
 						 attr_name(attr),
-						 attr->name_len, run, vcn);
-
-			up_write(run_lock);
-			down_read(run_lock);
+						 attr->name_len, &run, vcn);
 
 			if (err)
 				break;
 
-			ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx);
+			ok = run_lookup_entry(&run, vcn, &lcn, &clen, &idx);
 
 			if (!ok) {
 				err = -EINVAL;
@@ -2011,8 +2004,9 @@
 		} else if (is_attr_compressed(attr)) {
 			CLST clst_data;
 
-			err = attr_is_frame_compressed(
-				ni, attr, vcn >> attr->nres.c_unit, &clst_data);
+			err = attr_is_frame_compressed(ni, attr,
+						       vcn >> attr->nres.c_unit,
+						       &clst_data, &run);
 			if (err)
 				break;
 			if (clst_data < NTFS_LZNT_CLUSTERS)
@@ -2043,6 +2037,7 @@
 
 			err = fiemap_fill_next_extent(fieinfo, vbo, lbo, dlen,
 						      flags);
+
 			if (err < 0)
 				break;
 			if (err == 1) {
@@ -2073,9 +2068,8 @@
 		vbo += bytes;
 	}
 
-	up_read(run_lock);
-
 out:
+	run_close(&run);
 	return err;
 }
 
@@ -2606,7 +2600,8 @@
 		down_write(&ni->file.run_lock);
 		run_truncate_around(run, le64_to_cpu(attr->nres.svcn));
 		frame = frame_vbo >> (cluster_bits + NTFS_LZNT_CUNIT);
-		err = attr_is_frame_compressed(ni, attr, frame, &clst_data);
+		err = attr_is_frame_compressed(ni, attr, frame, &clst_data,
+					       run);
 		up_write(&ni->file.run_lock);
 		if (err)
 			goto out1;
--- linux-qcom-6.8.0.orig/fs/ntfs3/fslog.c
+++ linux-qcom-6.8.0/fs/ntfs3/fslog.c
@@ -609,14 +609,29 @@
 	*head = cpu_to_le16(index);
 }
 
+/*
+ * Enumerate restart table.
+ *
+ * @t - table to enumerate.
+ * @c - current enumerated element.
+ *
+ * enumeration starts with @c == NULL
+ * returns next element or NULL
+ */
 static inline void *enum_rstbl(struct RESTART_TABLE *t, void *c)
 {
 	__le32 *e;
 	u32 bprt;
-	u16 rsize = t ? le16_to_cpu(t->size) : 0;
+	u16 rsize;
+
+	if (!t)
+		return NULL;
+
+	rsize = le16_to_cpu(t->size);
 
 	if (!c) {
-		if (!t || !t->total)
+		/* start enumeration. */
+		if (!t->total)
 			return NULL;
 		e = Add2Ptr(t, sizeof(struct RESTART_TABLE));
 	} else {
@@ -724,7 +739,8 @@
 
 	if (!rsize || rsize > bytes ||
 	    rsize + sizeof(struct RESTART_TABLE) > bytes || bytes < ts ||
-	    le16_to_cpu(rt->total) > ne || ff > ts || lf > ts ||
+	    le16_to_cpu(rt->total) > ne ||
+			ff > ts - sizeof(__le32) || lf > ts - sizeof(__le32) ||
 	    (ff && ff < sizeof(struct RESTART_TABLE)) ||
 	    (lf && lf < sizeof(struct RESTART_TABLE))) {
 		return false;
@@ -754,6 +770,9 @@
 			return false;
 
 		off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
+
+		if (off > ts - sizeof(__le32))
+			return false;
 	}
 
 	return true;
@@ -1184,7 +1203,8 @@
 static int log_read_rst(struct ntfs_log *log, bool first,
 			struct restart_info *info)
 {
-	u32 skip, vbo;
+	u32 skip;
+	u64 vbo;
 	struct RESTART_HDR *r_page = NULL;
 
 	/* Determine which restart area we are looking for. */
@@ -2991,7 +3011,7 @@
 	if (is_ext) {
 		attr->name_off = SIZEOF_NONRESIDENT_EX_LE;
 		if (is_attr_compressed(attr))
-			attr->nres.c_unit = COMPRESSION_UNIT;
+			attr->nres.c_unit = NTFS_LZNT_CUNIT;
 
 		attr->nres.run_off =
 			cpu_to_le16(SIZEOF_NONRESIDENT_EX + name_size);
@@ -3721,6 +3741,8 @@
 
 	u64 rec_lsn, checkpt_lsn = 0, rlsn = 0;
 	struct ATTR_NAME_ENTRY *attr_names = NULL;
+	u32 attr_names_bytes = 0;
+	u32 oatbl_bytes = 0;
 	struct RESTART_TABLE *dptbl = NULL;
 	struct RESTART_TABLE *trtbl = NULL;
 	const struct RESTART_TABLE *rt;
@@ -3735,6 +3757,7 @@
 	struct NTFS_RESTART *rst = NULL;
 	struct lcb *lcb = NULL;
 	struct OPEN_ATTR_ENRTY *oe;
+	struct ATTR_NAME_ENTRY *ane;
 	struct TRANSACTION_ENTRY *tr;
 	struct DIR_PAGE_ENTRY *dp;
 	u32 i, bytes_per_attr_entry;
@@ -3914,6 +3937,9 @@
 		goto out;
 	}
 
+	log->page_mask = log->page_size - 1;
+	log->page_bits = blksize_bits(log->page_size);
+
 	/* If the file size has shrunk then we won't mount it. */
 	if (log->l_size < le64_to_cpu(ra2->l_size)) {
 		err = -EINVAL;
@@ -4313,17 +4339,40 @@
 	lcb = NULL;
 
 check_attribute_names2:
-	if (rst->attr_names_len && oatbl) {
-		struct ATTR_NAME_ENTRY *ane = attr_names;
-		while (ane->off) {
+	if (attr_names && oatbl) {
+		off = 0;
+		for (;;) {
+			/* Check we can use attribute name entry 'ane'. */
+			static_assert(sizeof(*ane) == 4);
+			if (off + sizeof(*ane) > attr_names_bytes) {
+				/* just ignore the rest. */
+				break;
+			}
+
+			ane = Add2Ptr(attr_names, off);
+			t16 = le16_to_cpu(ane->off);
+			if (!t16) {
+				/* this is the only valid exit. */
+				break;
+			}
+
+			/* Check we can use open attribute entry 'oe'. */
+			if (t16 + sizeof(*oe) > oatbl_bytes) {
+				/* just ignore the rest. */
+				break;
+			}
+
 			/* TODO: Clear table on exit! */
-			oe = Add2Ptr(oatbl, le16_to_cpu(ane->off));
+			oe = Add2Ptr(oatbl, t16);
 			t16 = le16_to_cpu(ane->name_bytes);
+			off += t16 + sizeof(*ane);
+			if (off > attr_names_bytes) {
+				/* just ignore the rest. */
+				break;
+			}
 			oe->name_len = t16 / sizeof(short);
 			oe->ptr = ane->name;
 			oe->is_attr_name = 2;
-			ane = Add2Ptr(ane,
-				      sizeof(struct ATTR_NAME_ENTRY) + t16);
 		}
 	}
 
--- linux-qcom-6.8.0.orig/fs/ntfs3/fsntfs.c
+++ linux-qcom-6.8.0/fs/ntfs3/fsntfs.c
@@ -522,7 +522,7 @@
 	ni->mi.dirty = true;
 
 	/* Step 2: Resize $MFT::BITMAP. */
-	new_bitmap_bytes = bitmap_size(new_mft_total);
+	new_bitmap_bytes = ntfs3_bitmap_size(new_mft_total);
 
 	err = attr_set_size(ni, ATTR_BITMAP, NULL, 0, &sbi->mft.bitmap.run,
 			    new_bitmap_bytes, &new_bitmap_bytes, true, NULL);
--- linux-qcom-6.8.0.orig/fs/ntfs3/index.c
+++ linux-qcom-6.8.0/fs/ntfs3/index.c
@@ -978,7 +978,7 @@
 		hdr->used =
 			cpu_to_le32(eo + sizeof(struct NTFS_DE) + sizeof(u64));
 		de_set_vbn_le(e, *sub_vbn);
-		hdr->flags = 1;
+		hdr->flags = NTFS_INDEX_HDR_HAS_SUBNODES;
 	} else {
 		e->size = cpu_to_le16(sizeof(struct NTFS_DE));
 		hdr->used = cpu_to_le32(eo + sizeof(struct NTFS_DE));
@@ -1456,8 +1456,8 @@
 
 	alloc->nres.valid_size = alloc->nres.data_size = cpu_to_le64(data_size);
 
-	err = ni_insert_resident(ni, bitmap_size(1), ATTR_BITMAP, in->name,
-				 in->name_len, &bitmap, NULL, NULL);
+	err = ni_insert_resident(ni, ntfs3_bitmap_size(1), ATTR_BITMAP,
+				 in->name, in->name_len, &bitmap, NULL, NULL);
 	if (err)
 		goto out2;
 
@@ -1518,8 +1518,9 @@
 	if (bmp) {
 		/* Increase bitmap. */
 		err = attr_set_size(ni, ATTR_BITMAP, in->name, in->name_len,
-				    &indx->bitmap_run, bitmap_size(bit + 1),
-				    NULL, true, NULL);
+				    &indx->bitmap_run,
+				    ntfs3_bitmap_size(bit + 1), NULL, true,
+				    NULL);
 		if (err)
 			goto out1;
 	}
@@ -1533,6 +1534,11 @@
 		goto out1;
 	}
 
+	if (data_size <= le64_to_cpu(alloc->nres.data_size)) {
+		/* Reuse index. */
+		goto out;
+	}
+
 	/* Increase allocation. */
 	err = attr_set_size(ni, ATTR_ALLOC, in->name, in->name_len,
 			    &indx->alloc_run, data_size, &data_size, true,
@@ -1546,6 +1552,7 @@
 	if (in->name == I30_NAME)
 		i_size_write(&ni->vfs_inode, data_size);
 
+out:
 	*vbn = bit << indx->idx2vbn_bits;
 
 	return 0;
@@ -1676,7 +1683,7 @@
 	e->size = cpu_to_le16(sizeof(struct NTFS_DE) + sizeof(u64));
 	e->flags = NTFS_IE_HAS_SUBNODES | NTFS_IE_LAST;
 
-	hdr->flags = 1;
+	hdr->flags = NTFS_INDEX_HDR_HAS_SUBNODES;
 	hdr->used = hdr->total =
 		cpu_to_le32(new_root_size - offsetof(struct INDEX_ROOT, ihdr));
 
@@ -2092,7 +2099,7 @@
 	if (in->name == I30_NAME)
 		i_size_write(&ni->vfs_inode, new_data);
 
-	bpb = bitmap_size(bit);
+	bpb = ntfs3_bitmap_size(bit);
 	if (bpb * 8 == nbits)
 		return 0;
 
--- linux-qcom-6.8.0.orig/fs/ntfs3/inode.c
+++ linux-qcom-6.8.0/fs/ntfs3/inode.c
@@ -37,7 +37,7 @@
 	bool is_dir;
 	unsigned long ino = inode->i_ino;
 	u32 rp_fa = 0, asize, t32;
-	u16 roff, rsize, names = 0;
+	u16 roff, rsize, names = 0, links = 0;
 	const struct ATTR_FILE_NAME *fname = NULL;
 	const struct INDEX_ROOT *root;
 	struct REPARSE_DATA_BUFFER rp; // 0x18 bytes
@@ -200,11 +200,12 @@
 		    rsize < SIZEOF_ATTRIBUTE_FILENAME)
 			goto out;
 
+		names += 1;
 		fname = Add2Ptr(attr, roff);
 		if (fname->type == FILE_NAME_DOS)
 			goto next_attr;
 
-		names += 1;
+		links += 1;
 		if (name && name->len == fname->name_len &&
 		    !ntfs_cmp_names_cpu(name, (struct le_str *)&fname->name_len,
 					NULL, false))
@@ -429,7 +430,7 @@
 		ni->mi.dirty = true;
 	}
 
-	set_nlink(inode, names);
+	set_nlink(inode, links);
 
 	if (S_ISDIR(mode)) {
 		ni->std_fa |= FILE_ATTRIBUTE_DIRECTORY;
@@ -531,11 +532,15 @@
 	if (inode->i_state & I_NEW)
 		inode = ntfs_read_mft(inode, name, ref);
 	else if (ref->seq != ntfs_i(inode)->mi.mrec->seq) {
-		/* Inode overlaps? */
-		_ntfs_bad_inode(inode);
+		/*
+		 * Sequence number is not expected.
+		 * Looks like inode was reused but caller uses the old reference
+		 */
+		iput(inode);
+		inode = ERR_PTR(-ESTALE);
 	}
 
-	if (IS_ERR(inode) && name)
+	if (IS_ERR(inode))
 		ntfs_set_state(sb->s_fs_info, NTFS_DIRTY_ERROR);
 
 	return inode;
@@ -570,13 +575,18 @@
 	clear_buffer_uptodate(bh);
 
 	if (is_resident(ni)) {
-		ni_lock(ni);
-		err = attr_data_read_resident(ni, &folio->page);
-		ni_unlock(ni);
-
-		if (!err)
-			set_buffer_uptodate(bh);
+		bh->b_blocknr = RESIDENT_LCN;
 		bh->b_size = block_size;
+		if (!folio) {
+			err = 0;
+		} else {
+			ni_lock(ni);
+			err = attr_data_read_resident(ni, &folio->page);
+			ni_unlock(ni);
+
+			if (!err)
+				set_buffer_uptodate(bh);
+		}
 		return err;
 	}
 
@@ -594,7 +604,8 @@
 
 	bytes = ((u64)len << cluster_bits) - off;
 
-	if (lcn == SPARSE_LCN) {
+	if (lcn >= sbi->used.bitmap.nbits) {
+		/* This case includes resident/compressed/sparse. */
 		if (!create) {
 			if (bh->b_size > bytes)
 				bh->b_size = bytes;
@@ -1494,7 +1505,7 @@
 			attr->size = cpu_to_le32(SIZEOF_NONRESIDENT_EX + 8);
 			attr->name_off = SIZEOF_NONRESIDENT_EX_LE;
 			attr->flags = ATTR_FLAG_COMPRESSED;
-			attr->nres.c_unit = COMPRESSION_UNIT;
+			attr->nres.c_unit = NTFS_LZNT_CUNIT;
 			asize = SIZEOF_NONRESIDENT_EX + 8;
 		} else {
 			attr->size = cpu_to_le32(SIZEOF_NONRESIDENT + 8);
@@ -1648,7 +1659,9 @@
 	 * The packed size of extended attribute is stored in direntry too.
 	 * 'fname' here points to inside new_de.
 	 */
-	ntfs_save_wsl_perm(inode, &fname->dup.ea_size);
+	err = ntfs_save_wsl_perm(inode, &fname->dup.ea_size);
+	if (err)
+		goto out6;
 
 	/*
 	 * update ea_size in file_name attribute too.
@@ -1692,6 +1705,15 @@
 	goto out2;
 
 out6:
+	attr = ni_find_attr(ni, NULL, NULL, ATTR_EA, NULL, 0, NULL, NULL);
+	if (attr && attr->non_res) {
+		/* Delete ATTR_EA, if non-resident. */
+		struct runs_tree run;
+		run_init(&run);
+		attr_set_size(ni, ATTR_EA, NULL, 0, &run, 0, NULL, false, NULL);
+		run_close(&run);
+	}
+
 	if (rp_inserted)
 		ntfs_remove_reparse(sbi, IO_REPARSE_TAG_SYMLINK, &new_de->ref);
 
@@ -2115,5 +2137,6 @@
 const struct address_space_operations ntfs_aops_cmpr = {
 	.read_folio	= ntfs_read_folio,
 	.readahead	= ntfs_readahead,
+	.dirty_folio	= block_dirty_folio,
 };
 // clang-format on
--- linux-qcom-6.8.0.orig/fs/ntfs3/lznt.c
+++ linux-qcom-6.8.0/fs/ntfs3/lznt.c
@@ -236,6 +236,9 @@
 
 	/* Do decompression until pointers are inside range. */
 	while (up < unc_end && cmpr < cmpr_end) {
+		// return err if more than LZNT_CHUNK_SIZE bytes are written
+		if (up - unc > LZNT_CHUNK_SIZE)
+			return -EINVAL;
 		/* Correct index */
 		while (unc + s_max_off[index] < up)
 			index += 1;
--- linux-qcom-6.8.0.orig/fs/ntfs3/namei.c
+++ linux-qcom-6.8.0/fs/ntfs3/namei.c
@@ -81,7 +81,7 @@
 		if (err < 0)
 			inode = ERR_PTR(err);
 		else {
-			ni_lock(ni);
+			ni_lock_dir(ni);
 			inode = dir_search_u(dir, uni, NULL);
 			ni_unlock(ni);
 		}
@@ -501,7 +501,7 @@
 	/*
 	 * Try slow way with current upcase table
 	 */
-	uni = __getname();
+	uni = kmem_cache_alloc(names_cachep, GFP_NOWAIT);
 	if (!uni)
 		return -ENOMEM;
 
@@ -523,7 +523,7 @@
 	err = 0;
 
 out:
-	__putname(uni);
+	kmem_cache_free(names_cachep, uni);
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/fs/ntfs3/ntfs.h
+++ linux-qcom-6.8.0/fs/ntfs3/ntfs.h
@@ -59,7 +59,7 @@
 struct cpu_str {
 	u8 len;
 	u8 unused;
-	u16 name[10];
+	u16 name[];
 };
 
 struct le_str {
@@ -82,9 +82,6 @@
 #define RESIDENT_LCN   ((CLST)-2)
 #define COMPRESSED_LCN ((CLST)-3)
 
-#define COMPRESSION_UNIT     4
-#define COMPRESS_MAX_CLUSTER 0x1000
-
 enum RECORD_NUM {
 	MFT_REC_MFT		= 0,
 	MFT_REC_MIRR		= 1,
@@ -696,14 +693,15 @@
 	      offsetof(struct ATTR_FILE_NAME, name) + \
 	      NTFS_NAME_LEN * sizeof(short), 8)
 
+#define NTFS_INDEX_HDR_HAS_SUBNODES cpu_to_le32(1)
+
 struct INDEX_HDR {
 	__le32 de_off;	// 0x00: The offset from the start of this structure
 			// to the first NTFS_DE.
 	__le32 used;	// 0x04: The size of this structure plus all
 			// entries (quad-word aligned).
 	__le32 total;	// 0x08: The allocated size of for this structure plus all entries.
-	u8 flags;	// 0x0C: 0x00 = Small directory, 0x01 = Large directory.
-	u8 res[3];
+	__le32 flags;	// 0x0C: 0x00 = Small directory, 0x01 = Large directory.
 
 	//
 	// de_off + used <= total
@@ -751,7 +749,7 @@
 
 static inline bool hdr_has_subnode(const struct INDEX_HDR *hdr)
 {
-	return hdr->flags & 1;
+	return hdr->flags & NTFS_INDEX_HDR_HAS_SUBNODES;
 }
 
 struct INDEX_BUFFER {
@@ -771,7 +769,7 @@
 
 static inline bool ib_is_leaf(const struct INDEX_BUFFER *ib)
 {
-	return !(ib->ihdr.flags & 1);
+	return !(ib->ihdr.flags & NTFS_INDEX_HDR_HAS_SUBNODES);
 }
 
 /* Index root structure ( 0x90 ). */
--- linux-qcom-6.8.0.orig/fs/ntfs3/ntfs_fs.h
+++ linux-qcom-6.8.0/fs/ntfs3/ntfs_fs.h
@@ -334,7 +334,7 @@
 
 /* Nested class for ntfs_inode::ni_lock. */
 enum ntfs_inode_mutex_lock_class {
-	NTFS_INODE_MUTEX_DIRTY,
+	NTFS_INODE_MUTEX_DIRTY = 1,
 	NTFS_INODE_MUTEX_SECURITY,
 	NTFS_INODE_MUTEX_OBJID,
 	NTFS_INODE_MUTEX_REPARSE,
@@ -446,7 +446,8 @@
 			struct runs_tree *run, u64 frame, u64 frames,
 			u8 frame_bits, u32 *ondisk_size, u64 *vbo_data);
 int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr,
-			     CLST frame, CLST *clst_data);
+			     CLST frame, CLST *clst_data,
+			     struct runs_tree *run);
 int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size,
 			u64 new_valid);
 int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes);
@@ -966,9 +967,9 @@
 }
 
 /* NTFS uses quad aligned bitmaps. */
-static inline size_t bitmap_size(size_t bits)
+static inline size_t ntfs3_bitmap_size(size_t bits)
 {
-	return ALIGN((bits + 7) >> 3, 8);
+	return BITS_TO_U64(bits) * sizeof(u64);
 }
 
 #define _100ns2seconds 10000000
--- linux-qcom-6.8.0.orig/fs/ntfs3/record.c
+++ linux-qcom-6.8.0/fs/ntfs3/record.c
@@ -223,29 +223,21 @@
 		prev_type = 0;
 		attr = Add2Ptr(rec, off);
 	} else {
-		/* Check if input attr inside record. */
+		/*
+		 * We don't need to check previous attr here. There is
+		 * a bounds checking in the previous round.
+		 */
 		off = PtrOffset(rec, attr);
-		if (off >= used)
-			return NULL;
 
 		asize = le32_to_cpu(attr->size);
-		if (asize < SIZEOF_RESIDENT) {
-			/* Impossible 'cause we should not return such attribute. */
-			return NULL;
-		}
-
-		/* Overflow check. */
-		if (off + asize < off)
-			return NULL;
 
 		prev_type = le32_to_cpu(attr->type);
 		attr = Add2Ptr(attr, asize);
 		off += asize;
 	}
 
-	asize = le32_to_cpu(attr->size);
-
 	/* Can we use the first field (attr->type). */
+	/* NOTE: this code also checks attr->size availability. */
 	if (off + 8 > used) {
 		static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);
 		return NULL;
@@ -265,6 +257,8 @@
 	if (t32 < prev_type)
 		return NULL;
 
+	asize = le32_to_cpu(attr->size);
+
 	/* Check overflow and boundary. */
 	if (off + asize < off || off + asize > used)
 		return NULL;
@@ -293,6 +287,10 @@
 	if (attr->non_res != 1)
 		return NULL;
 
+	/* Can we use memory including attr->nres.valid_size? */
+	if (asize < SIZEOF_NONRESIDENT)
+		return NULL;
+
 	t16 = le16_to_cpu(attr->nres.run_off);
 	if (t16 > asize)
 		return NULL;
@@ -319,7 +317,8 @@
 
 	if (!attr->nres.svcn && is_attr_ext(attr)) {
 		/* First segment of sparse/compressed attribute */
-		if (asize + 8 < SIZEOF_NONRESIDENT_EX)
+		/* Can we use memory including attr->nres.total_size? */
+		if (asize < SIZEOF_NONRESIDENT_EX)
 			return NULL;
 
 		tot_size = le64_to_cpu(attr->nres.total_size);
@@ -329,10 +328,10 @@
 		if (tot_size > alloc_size)
 			return NULL;
 	} else {
-		if (asize + 8 < SIZEOF_NONRESIDENT)
+		if (attr->nres.c_unit)
 			return NULL;
 
-		if (attr->nres.c_unit)
+		if (alloc_size > mi->sbi->volume.size)
 			return NULL;
 	}
 
@@ -534,16 +533,9 @@
 	if (aoff + asize > used)
 		return false;
 
-	if (ni && is_attr_indexed(attr)) {
+	if (ni && is_attr_indexed(attr) && attr->type == ATTR_NAME) {
 		u16 links = le16_to_cpu(ni->mi.mrec->hard_links);
-		struct ATTR_FILE_NAME *fname =
-			attr->type != ATTR_NAME ?
-				NULL :
-				resident_data_ex(attr,
-						 SIZEOF_ATTRIBUTE_FILENAME);
-		if (fname && fname->type == FILE_NAME_DOS) {
-			/* Do not decrease links count deleting DOS name. */
-		} else if (!links) {
+		if (!links) {
 			/* minor error. Not critical. */
 		} else {
 			ni->mi.mrec->hard_links = cpu_to_le16(links - 1);
--- linux-qcom-6.8.0.orig/fs/ntfs3/run.c
+++ linux-qcom-6.8.0/fs/ntfs3/run.c
@@ -1053,8 +1053,8 @@
 {
 	int ret, err;
 	CLST next_vcn, lcn, len;
-	size_t index;
-	bool ok;
+	size_t index, done;
+	bool ok, zone;
 	struct wnd_bitmap *wnd;
 
 	ret = run_unpack(run, sbi, ino, svcn, evcn, vcn, run_buf, run_buf_size);
@@ -1085,8 +1085,9 @@
 			continue;
 
 		down_read_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS);
+		zone = max(wnd->zone_bit, lcn) < min(wnd->zone_end, lcn + len);
 		/* Check for free blocks. */
-		ok = wnd_is_used(wnd, lcn, len);
+		ok = !zone && wnd_is_used(wnd, lcn, len);
 		up_read(&wnd->rw_lock);
 		if (ok)
 			continue;
@@ -1094,14 +1095,33 @@
 		/* Looks like volume is corrupted. */
 		ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
 
-		if (down_write_trylock(&wnd->rw_lock)) {
-			/* Mark all zero bits as used in range [lcn, lcn+len). */
-			size_t done;
-			err = wnd_set_used_safe(wnd, lcn, len, &done);
-			up_write(&wnd->rw_lock);
-			if (err)
-				return err;
+		if (!down_write_trylock(&wnd->rw_lock))
+			continue;
+
+		if (zone) {
+			/*
+			 * Range [lcn, lcn + len) intersects with zone.
+			 * To avoid complex with zone just turn it off.
+			 */
+			wnd_zone_set(wnd, 0, 0);
+		}
+
+		/* Mark all zero bits as used in range [lcn, lcn+len). */
+		err = wnd_set_used_safe(wnd, lcn, len, &done);
+		if (zone) {
+			/* Restore zone. Lock mft run. */
+			struct rw_semaphore *lock;
+			lock = is_mounted(sbi) ? &sbi->mft.ni->file.run_lock :
+						 NULL;
+			if (lock)
+				down_read(lock);
+			ntfs_refresh_zone(sbi);
+			if (lock)
+				up_read(lock);
 		}
+		up_write(&wnd->rw_lock);
+		if (err)
+			return err;
 	}
 
 	return ret;
--- linux-qcom-6.8.0.orig/fs/ntfs3/super.c
+++ linux-qcom-6.8.0/fs/ntfs3/super.c
@@ -275,7 +275,7 @@
 	fsparam_flag_no("acl",			Opt_acl),
 	fsparam_string("iocharset",		Opt_iocharset),
 	fsparam_flag_no("prealloc",		Opt_prealloc),
-	fsparam_flag_no("nocase",		Opt_nocase),
+	fsparam_flag_no("case",		Opt_nocase),
 	{}
 };
 // clang-format on
@@ -462,7 +462,7 @@
 	struct super_block *sb = m->private;
 	struct ntfs_sb_info *sbi = sb->s_fs_info;
 
-	seq_printf(m, "ntfs%d.%d\n%u\n%zu\n\%zu\n%zu\n%s\n%s\n",
+	seq_printf(m, "ntfs%d.%d\n%u\n%zu\n%zu\n%zu\n%s\n%s\n",
 		   sbi->volume.major_ver, sbi->volume.minor_ver,
 		   sbi->cluster_size, sbi->used.bitmap.nbits,
 		   sbi->mft.bitmap.nbits,
@@ -1341,7 +1341,7 @@
 
 	/* Check bitmap boundary. */
 	tt = sbi->used.bitmap.nbits;
-	if (inode->i_size < bitmap_size(tt)) {
+	if (inode->i_size < ntfs3_bitmap_size(tt)) {
 		ntfs_err(sb, "$Bitmap is corrupted.");
 		err = -EINVAL;
 		goto put_inode_out;
@@ -1804,8 +1804,6 @@
 {
 	int err;
 
-	pr_info("ntfs3: Max link count %u\n", NTFS_LINK_MAX);
-
 	if (IS_ENABLED(CONFIG_NTFS3_FS_POSIX_ACL))
 		pr_info("ntfs3: Enabled Linux POSIX ACLs support\n");
 	if (IS_ENABLED(CONFIG_NTFS3_64BIT_CLUSTER))
--- linux-qcom-6.8.0.orig/fs/ntfs3/xattr.c
+++ linux-qcom-6.8.0/fs/ntfs3/xattr.c
@@ -219,8 +219,11 @@
 		if (!ea->name_len)
 			break;
 
-		if (ea->name_len > ea_size)
+		if (ea->name_len > ea_size) {
+			ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR);
+			err = -EINVAL; /* corrupted fs */
 			break;
+		}
 
 		if (buffer) {
 			/* Check if we can use field ea->name */
--- linux-qcom-6.8.0.orig/fs/ocfs2/aops.c
+++ linux-qcom-6.8.0/fs/ocfs2/aops.c
@@ -156,9 +156,8 @@
 	err = ocfs2_extent_map_get_blocks(inode, iblock, &p_blkno, &count,
 					  &ext_flags);
 	if (err) {
-		mlog(ML_ERROR, "Error %d from get_blocks(0x%p, %llu, 1, "
-		     "%llu, NULL)\n", err, inode, (unsigned long long)iblock,
-		     (unsigned long long)p_blkno);
+		mlog(ML_ERROR, "get_blocks() failed, inode: 0x%p, "
+		     "block: %llu\n", inode, (unsigned long long)iblock);
 		goto bail;
 	}
 
@@ -2368,6 +2367,11 @@
 	}
 
 	list_for_each_entry(ue, &dwc->dw_zero_list, ue_node) {
+		ret = ocfs2_assure_trans_credits(handle, credits);
+		if (ret < 0) {
+			mlog_errno(ret);
+			break;
+		}
 		ret = ocfs2_mark_extent_written(inode, &et, handle,
 						ue->ue_cpos, 1,
 						ue->ue_phys,
--- linux-qcom-6.8.0.orig/fs/ocfs2/aops.h
+++ linux-qcom-6.8.0/fs/ocfs2/aops.h
@@ -70,6 +70,8 @@
 	OCFS2_IOCB_NUM_LOCKS
 };
 
+#define ocfs2_iocb_init_rw_locked(iocb) \
+	(iocb->private = NULL)
 #define ocfs2_iocb_clear_rw_locked(iocb) \
 	clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private)
 #define ocfs2_iocb_rw_locked_level(iocb) \
--- linux-qcom-6.8.0.orig/fs/ocfs2/buffer_head_io.c
+++ linux-qcom-6.8.0/fs/ocfs2/buffer_head_io.c
@@ -235,7 +235,6 @@
 		if (bhs[i] == NULL) {
 			bhs[i] = sb_getblk(sb, block++);
 			if (bhs[i] == NULL) {
-				ocfs2_metadata_cache_io_unlock(ci);
 				status = -ENOMEM;
 				mlog_errno(status);
 				/* Don't forget to put previous bh! */
@@ -389,7 +388,8 @@
 		/* Always set the buffer in the cache, even if it was
 		 * a forced read, or read-ahead which hasn't yet
 		 * completed. */
-		ocfs2_set_buffer_uptodate(ci, bh);
+		if (bh)
+			ocfs2_set_buffer_uptodate(ci, bh);
 	}
 	ocfs2_metadata_cache_io_unlock(ci);
 
--- linux-qcom-6.8.0.orig/fs/ocfs2/dir.c
+++ linux-qcom-6.8.0/fs/ocfs2/dir.c
@@ -294,13 +294,16 @@
  * bh passed here can be an inode block or a dir data block, depending
  * on the inode inline data flag.
  */
-static int ocfs2_check_dir_entry(struct inode * dir,
-				 struct ocfs2_dir_entry * de,
-				 struct buffer_head * bh,
+static int ocfs2_check_dir_entry(struct inode *dir,
+				 struct ocfs2_dir_entry *de,
+				 struct buffer_head *bh,
+				 char *buf,
+				 unsigned int size,
 				 unsigned long offset)
 {
 	const char *error_msg = NULL;
 	const int rlen = le16_to_cpu(de->rec_len);
+	const unsigned long next_offset = ((char *) de - buf) + rlen;
 
 	if (unlikely(rlen < OCFS2_DIR_REC_LEN(1)))
 		error_msg = "rec_len is smaller than minimal";
@@ -308,9 +311,11 @@
 		error_msg = "rec_len % 4 != 0";
 	else if (unlikely(rlen < OCFS2_DIR_REC_LEN(de->name_len)))
 		error_msg = "rec_len is too small for name_len";
-	else if (unlikely(
-		 ((char *) de - bh->b_data) + rlen > dir->i_sb->s_blocksize))
-		error_msg = "directory entry across blocks";
+	else if (unlikely(next_offset > size))
+		error_msg = "directory entry overrun";
+	else if (unlikely(next_offset > size - OCFS2_DIR_REC_LEN(1)) &&
+		 next_offset != size)
+		error_msg = "directory entry too close to end";
 
 	if (unlikely(error_msg != NULL))
 		mlog(ML_ERROR, "bad entry in directory #%llu: %s - "
@@ -352,16 +357,17 @@
 	de_buf = first_de;
 	dlimit = de_buf + bytes;
 
-	while (de_buf < dlimit) {
+	while (de_buf < dlimit - OCFS2_DIR_MEMBER_LEN) {
 		/* this code is executed quadratically often */
 		/* do minimal checking `by hand' */
 
 		de = (struct ocfs2_dir_entry *) de_buf;
 
-		if (de_buf + namelen <= dlimit &&
+		if (de->name + namelen <= dlimit &&
 		    ocfs2_match(namelen, name, de)) {
 			/* found a match - just to be sure, do a full check */
-			if (!ocfs2_check_dir_entry(dir, de, bh, offset)) {
+			if (!ocfs2_check_dir_entry(dir, de, bh, first_de,
+						   bytes, offset)) {
 				ret = -1;
 				goto bail;
 			}
@@ -1138,7 +1144,7 @@
 	pde = NULL;
 	de = (struct ocfs2_dir_entry *) first_de;
 	while (i < bytes) {
-		if (!ocfs2_check_dir_entry(dir, de, bh, i)) {
+		if (!ocfs2_check_dir_entry(dir, de, bh, first_de, bytes, i)) {
 			status = -EIO;
 			mlog_errno(status);
 			goto bail;
@@ -1635,7 +1641,8 @@
 		/* These checks should've already been passed by the
 		 * prepare function, but I guess we can leave them
 		 * here anyway. */
-		if (!ocfs2_check_dir_entry(dir, de, insert_bh, offset)) {
+		if (!ocfs2_check_dir_entry(dir, de, insert_bh, data_start,
+					   size, offset)) {
 			retval = -ENOENT;
 			goto bail;
 		}
@@ -1774,7 +1781,8 @@
 		}
 
 		de = (struct ocfs2_dir_entry *) (data->id_data + ctx->pos);
-		if (!ocfs2_check_dir_entry(inode, de, di_bh, ctx->pos)) {
+		if (!ocfs2_check_dir_entry(inode, de, di_bh, (char *)data->id_data,
+					   i_size_read(inode), ctx->pos)) {
 			/* On error, skip the f_pos to the end. */
 			ctx->pos = i_size_read(inode);
 			break;
@@ -1867,7 +1875,8 @@
 		while (ctx->pos < i_size_read(inode)
 		       && offset < sb->s_blocksize) {
 			de = (struct ocfs2_dir_entry *) (bh->b_data + offset);
-			if (!ocfs2_check_dir_entry(inode, de, bh, offset)) {
+			if (!ocfs2_check_dir_entry(inode, de, bh, bh->b_data,
+						   sb->s_blocksize, offset)) {
 				/* On error, skip the f_pos to the
 				   next block. */
 				ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1;
@@ -3339,7 +3348,7 @@
 	struct super_block *sb = dir->i_sb;
 	struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
 	struct ocfs2_dir_entry *de, *last_de = NULL;
-	char *de_buf, *limit;
+	char *first_de, *de_buf, *limit;
 	unsigned long offset = 0;
 	unsigned int rec_len, new_rec_len, free_space;
 
@@ -3352,14 +3361,16 @@
 	else
 		free_space = dir->i_sb->s_blocksize - i_size_read(dir);
 
-	de_buf = di->id2.i_data.id_data;
+	first_de = di->id2.i_data.id_data;
+	de_buf = first_de;
 	limit = de_buf + i_size_read(dir);
 	rec_len = OCFS2_DIR_REC_LEN(namelen);
 
 	while (de_buf < limit) {
 		de = (struct ocfs2_dir_entry *)de_buf;
 
-		if (!ocfs2_check_dir_entry(dir, de, di_bh, offset)) {
+		if (!ocfs2_check_dir_entry(dir, de, di_bh, first_de,
+					   i_size_read(dir), offset)) {
 			ret = -ENOENT;
 			goto out;
 		}
@@ -3441,7 +3452,8 @@
 			/* move to next block */
 			de = (struct ocfs2_dir_entry *) bh->b_data;
 		}
-		if (!ocfs2_check_dir_entry(dir, de, bh, offset)) {
+		if (!ocfs2_check_dir_entry(dir, de, bh, bh->b_data, blocksize,
+					   offset)) {
 			status = -ENOENT;
 			goto bail;
 		}
--- linux-qcom-6.8.0.orig/fs/ocfs2/dlmglue.c
+++ linux-qcom-6.8.0/fs/ocfs2/dlmglue.c
@@ -3110,6 +3110,7 @@
 	struct ocfs2_lock_res *iter = v;
 	struct ocfs2_lock_res *dummy = &priv->p_iter_res;
 
+	(*pos)++;
 	spin_lock(&ocfs2_dlm_tracking_lock);
 	iter = ocfs2_dlm_next_res(iter, priv);
 	list_del_init(&dummy->l_debug_list);
--- linux-qcom-6.8.0.orig/fs/ocfs2/extent_map.c
+++ linux-qcom-6.8.0/fs/ocfs2/extent_map.c
@@ -973,7 +973,13 @@
 	}
 
 	while (done < nr) {
-		down_read(&OCFS2_I(inode)->ip_alloc_sem);
+		if (!down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) {
+			rc = -EAGAIN;
+			mlog(ML_ERROR,
+				 "Inode #%llu ip_alloc_sem is temporarily unavailable\n",
+				 (unsigned long long)OCFS2_I(inode)->ip_blkno);
+			break;
+		}
 		rc = ocfs2_extent_map_get_blocks(inode, v_block + done,
 						 &p_block, &p_count, NULL);
 		up_read(&OCFS2_I(inode)->ip_alloc_sem);
--- linux-qcom-6.8.0.orig/fs/ocfs2/file.c
+++ linux-qcom-6.8.0/fs/ocfs2/file.c
@@ -1128,9 +1128,12 @@
 	trace_ocfs2_setattr(inode, dentry,
 			    (unsigned long long)OCFS2_I(inode)->ip_blkno,
 			    dentry->d_name.len, dentry->d_name.name,
-			    attr->ia_valid, attr->ia_mode,
-			    from_kuid(&init_user_ns, attr->ia_uid),
-			    from_kgid(&init_user_ns, attr->ia_gid));
+			    attr->ia_valid,
+				attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0,
+				attr->ia_valid & ATTR_UID ?
+					from_kuid(&init_user_ns, attr->ia_uid) : 0,
+				attr->ia_valid & ATTR_GID ?
+					from_kgid(&init_user_ns, attr->ia_gid) : 0);
 
 	/* ensuring we don't even attempt to truncate a symlink */
 	if (S_ISLNK(inode->i_mode))
@@ -1783,6 +1786,14 @@
 		return 0;
 
 	if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+		int id_count = ocfs2_max_inline_data_with_xattr(inode->i_sb, di);
+
+		if (byte_start > id_count || byte_start + byte_len > id_count) {
+			ret = -EINVAL;
+			mlog_errno(ret);
+			goto out;
+		}
+
 		ret = ocfs2_truncate_inline(inode, di_bh, byte_start,
 					    byte_start + byte_len, 0);
 		if (ret) {
@@ -1936,6 +1947,8 @@
 
 	inode_lock(inode);
 
+	/* Wait all existing dio workers, newcomers will block on i_rwsem */
+	inode_dio_wait(inode);
 	/*
 	 * This prevents concurrent writes on other nodes
 	 */
@@ -2384,6 +2397,8 @@
 	} else
 		inode_lock(inode);
 
+	ocfs2_iocb_init_rw_locked(iocb);
+
 	/*
 	 * Concurrent O_DIRECT writes are allowed with
 	 * mount_option "coherency=buffered".
@@ -2530,6 +2545,8 @@
 	if (!direct_io && nowait)
 		return -EOPNOTSUPP;
 
+	ocfs2_iocb_init_rw_locked(iocb);
+
 	/*
 	 * buffered reads protect themselves in ->read_folio().  O_DIRECT reads
 	 * need locks to protect pending reads from racing with truncate.
--- linux-qcom-6.8.0.orig/fs/ocfs2/inode.h
+++ linux-qcom-6.8.0/fs/ocfs2/inode.h
@@ -65,7 +65,7 @@
 	tid_t i_sync_tid;
 	tid_t i_datasync_tid;
 
-	struct dquot *i_dquot[MAXQUOTAS];
+	struct dquot __rcu *i_dquot[MAXQUOTAS];
 };
 
 /*
--- linux-qcom-6.8.0.orig/fs/ocfs2/journal.c
+++ linux-qcom-6.8.0/fs/ocfs2/journal.c
@@ -446,6 +446,23 @@
 }
 
 /*
+ * Make sure handle has at least 'nblocks' credits available. If it does not
+ * have that many credits available, we will try to extend the handle to have
+ * enough credits. If that fails, we will restart transaction to have enough
+ * credits. Similar notes regarding data consistency and locking implications
+ * as for ocfs2_extend_trans() apply here.
+ */
+int ocfs2_assure_trans_credits(handle_t *handle, int nblocks)
+{
+	int old_nblks = jbd2_handle_buffer_credits(handle);
+
+	trace_ocfs2_assure_trans_credits(old_nblks);
+	if (old_nblks >= nblocks)
+		return 0;
+	return ocfs2_extend_trans(handle, nblocks - old_nblks);
+}
+
+/*
  * If we have fewer than thresh credits, extend by OCFS2_MAX_TRANS_DATA.
  * If that fails, restart the transaction & regain write access for the
  * buffer head which is used for metadata modifications.
@@ -479,12 +496,6 @@
 	return status;
 }
 
-
-struct ocfs2_triggers {
-	struct jbd2_buffer_trigger_type	ot_triggers;
-	int				ot_offset;
-};
-
 static inline struct ocfs2_triggers *to_ocfs2_trigger(struct jbd2_buffer_trigger_type *triggers)
 {
 	return container_of(triggers, struct ocfs2_triggers, ot_triggers);
@@ -548,85 +559,76 @@
 static void ocfs2_abort_trigger(struct jbd2_buffer_trigger_type *triggers,
 				struct buffer_head *bh)
 {
+	struct ocfs2_triggers *ot = to_ocfs2_trigger(triggers);
+
 	mlog(ML_ERROR,
 	     "ocfs2_abort_trigger called by JBD2.  bh = 0x%lx, "
 	     "bh->b_blocknr = %llu\n",
 	     (unsigned long)bh,
 	     (unsigned long long)bh->b_blocknr);
 
-	ocfs2_error(bh->b_assoc_map->host->i_sb,
+	ocfs2_error(ot->sb,
 		    "JBD2 has aborted our journal, ocfs2 cannot continue\n");
 }
 
-static struct ocfs2_triggers di_triggers = {
-	.ot_triggers = {
-		.t_frozen = ocfs2_frozen_trigger,
-		.t_abort = ocfs2_abort_trigger,
-	},
-	.ot_offset	= offsetof(struct ocfs2_dinode, i_check),
-};
-
-static struct ocfs2_triggers eb_triggers = {
-	.ot_triggers = {
-		.t_frozen = ocfs2_frozen_trigger,
-		.t_abort = ocfs2_abort_trigger,
-	},
-	.ot_offset	= offsetof(struct ocfs2_extent_block, h_check),
-};
-
-static struct ocfs2_triggers rb_triggers = {
-	.ot_triggers = {
-		.t_frozen = ocfs2_frozen_trigger,
-		.t_abort = ocfs2_abort_trigger,
-	},
-	.ot_offset	= offsetof(struct ocfs2_refcount_block, rf_check),
-};
-
-static struct ocfs2_triggers gd_triggers = {
-	.ot_triggers = {
-		.t_frozen = ocfs2_frozen_trigger,
-		.t_abort = ocfs2_abort_trigger,
-	},
-	.ot_offset	= offsetof(struct ocfs2_group_desc, bg_check),
-};
-
-static struct ocfs2_triggers db_triggers = {
-	.ot_triggers = {
-		.t_frozen = ocfs2_db_frozen_trigger,
-		.t_abort = ocfs2_abort_trigger,
-	},
-};
-
-static struct ocfs2_triggers xb_triggers = {
-	.ot_triggers = {
-		.t_frozen = ocfs2_frozen_trigger,
-		.t_abort = ocfs2_abort_trigger,
-	},
-	.ot_offset	= offsetof(struct ocfs2_xattr_block, xb_check),
-};
-
-static struct ocfs2_triggers dq_triggers = {
-	.ot_triggers = {
-		.t_frozen = ocfs2_dq_frozen_trigger,
-		.t_abort = ocfs2_abort_trigger,
-	},
-};
-
-static struct ocfs2_triggers dr_triggers = {
-	.ot_triggers = {
-		.t_frozen = ocfs2_frozen_trigger,
-		.t_abort = ocfs2_abort_trigger,
-	},
-	.ot_offset	= offsetof(struct ocfs2_dx_root_block, dr_check),
-};
-
-static struct ocfs2_triggers dl_triggers = {
-	.ot_triggers = {
-		.t_frozen = ocfs2_frozen_trigger,
-		.t_abort = ocfs2_abort_trigger,
-	},
-	.ot_offset	= offsetof(struct ocfs2_dx_leaf, dl_check),
-};
+static void ocfs2_setup_csum_triggers(struct super_block *sb,
+				      enum ocfs2_journal_trigger_type type,
+				      struct ocfs2_triggers *ot)
+{
+	BUG_ON(type >= OCFS2_JOURNAL_TRIGGER_COUNT);
+
+	switch (type) {
+	case OCFS2_JTR_DI:
+		ot->ot_triggers.t_frozen = ocfs2_frozen_trigger;
+		ot->ot_offset = offsetof(struct ocfs2_dinode, i_check);
+		break;
+	case OCFS2_JTR_EB:
+		ot->ot_triggers.t_frozen = ocfs2_frozen_trigger;
+		ot->ot_offset = offsetof(struct ocfs2_extent_block, h_check);
+		break;
+	case OCFS2_JTR_RB:
+		ot->ot_triggers.t_frozen = ocfs2_frozen_trigger;
+		ot->ot_offset = offsetof(struct ocfs2_refcount_block, rf_check);
+		break;
+	case OCFS2_JTR_GD:
+		ot->ot_triggers.t_frozen = ocfs2_frozen_trigger;
+		ot->ot_offset = offsetof(struct ocfs2_group_desc, bg_check);
+		break;
+	case OCFS2_JTR_DB:
+		ot->ot_triggers.t_frozen = ocfs2_db_frozen_trigger;
+		break;
+	case OCFS2_JTR_XB:
+		ot->ot_triggers.t_frozen = ocfs2_frozen_trigger;
+		ot->ot_offset = offsetof(struct ocfs2_xattr_block, xb_check);
+		break;
+	case OCFS2_JTR_DQ:
+		ot->ot_triggers.t_frozen = ocfs2_dq_frozen_trigger;
+		break;
+	case OCFS2_JTR_DR:
+		ot->ot_triggers.t_frozen = ocfs2_frozen_trigger;
+		ot->ot_offset = offsetof(struct ocfs2_dx_root_block, dr_check);
+		break;
+	case OCFS2_JTR_DL:
+		ot->ot_triggers.t_frozen = ocfs2_frozen_trigger;
+		ot->ot_offset = offsetof(struct ocfs2_dx_leaf, dl_check);
+		break;
+	case OCFS2_JTR_NONE:
+		/* To make compiler happy... */
+		return;
+	}
+
+	ot->ot_triggers.t_abort = ocfs2_abort_trigger;
+	ot->sb = sb;
+}
+
+void ocfs2_initialize_journal_triggers(struct super_block *sb,
+				       struct ocfs2_triggers triggers[])
+{
+	enum ocfs2_journal_trigger_type type;
+
+	for (type = OCFS2_JTR_DI; type < OCFS2_JOURNAL_TRIGGER_COUNT; type++)
+		ocfs2_setup_csum_triggers(sb, type, &triggers[type]);
+}
 
 static int __ocfs2_journal_access(handle_t *handle,
 				  struct ocfs2_caching_info *ci,
@@ -708,56 +710,91 @@
 int ocfs2_journal_access_di(handle_t *handle, struct ocfs2_caching_info *ci,
 			    struct buffer_head *bh, int type)
 {
-	return __ocfs2_journal_access(handle, ci, bh, &di_triggers, type);
+	struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci));
+
+	return __ocfs2_journal_access(handle, ci, bh,
+				      &osb->s_journal_triggers[OCFS2_JTR_DI],
+				      type);
 }
 
 int ocfs2_journal_access_eb(handle_t *handle, struct ocfs2_caching_info *ci,
 			    struct buffer_head *bh, int type)
 {
-	return __ocfs2_journal_access(handle, ci, bh, &eb_triggers, type);
+	struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci));
+
+	return __ocfs2_journal_access(handle, ci, bh,
+				      &osb->s_journal_triggers[OCFS2_JTR_EB],
+				      type);
 }
 
 int ocfs2_journal_access_rb(handle_t *handle, struct ocfs2_caching_info *ci,
 			    struct buffer_head *bh, int type)
 {
-	return __ocfs2_journal_access(handle, ci, bh, &rb_triggers,
+	struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci));
+
+	return __ocfs2_journal_access(handle, ci, bh,
+				      &osb->s_journal_triggers[OCFS2_JTR_RB],
 				      type);
 }
 
 int ocfs2_journal_access_gd(handle_t *handle, struct ocfs2_caching_info *ci,
 			    struct buffer_head *bh, int type)
 {
-	return __ocfs2_journal_access(handle, ci, bh, &gd_triggers, type);
+	struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci));
+
+	return __ocfs2_journal_access(handle, ci, bh,
+				     &osb->s_journal_triggers[OCFS2_JTR_GD],
+				     type);
 }
 
 int ocfs2_journal_access_db(handle_t *handle, struct ocfs2_caching_info *ci,
 			    struct buffer_head *bh, int type)
 {
-	return __ocfs2_journal_access(handle, ci, bh, &db_triggers, type);
+	struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci));
+
+	return __ocfs2_journal_access(handle, ci, bh,
+				     &osb->s_journal_triggers[OCFS2_JTR_DB],
+				     type);
 }
 
 int ocfs2_journal_access_xb(handle_t *handle, struct ocfs2_caching_info *ci,
 			    struct buffer_head *bh, int type)
 {
-	return __ocfs2_journal_access(handle, ci, bh, &xb_triggers, type);
+	struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci));
+
+	return __ocfs2_journal_access(handle, ci, bh,
+				     &osb->s_journal_triggers[OCFS2_JTR_XB],
+				     type);
 }
 
 int ocfs2_journal_access_dq(handle_t *handle, struct ocfs2_caching_info *ci,
 			    struct buffer_head *bh, int type)
 {
-	return __ocfs2_journal_access(handle, ci, bh, &dq_triggers, type);
+	struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci));
+
+	return __ocfs2_journal_access(handle, ci, bh,
+				     &osb->s_journal_triggers[OCFS2_JTR_DQ],
+				     type);
 }
 
 int ocfs2_journal_access_dr(handle_t *handle, struct ocfs2_caching_info *ci,
 			    struct buffer_head *bh, int type)
 {
-	return __ocfs2_journal_access(handle, ci, bh, &dr_triggers, type);
+	struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci));
+
+	return __ocfs2_journal_access(handle, ci, bh,
+				     &osb->s_journal_triggers[OCFS2_JTR_DR],
+				     type);
 }
 
 int ocfs2_journal_access_dl(handle_t *handle, struct ocfs2_caching_info *ci,
 			    struct buffer_head *bh, int type)
 {
-	return __ocfs2_journal_access(handle, ci, bh, &dl_triggers, type);
+	struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci));
+
+	return __ocfs2_journal_access(handle, ci, bh,
+				     &osb->s_journal_triggers[OCFS2_JTR_DL],
+				     type);
 }
 
 int ocfs2_journal_access(handle_t *handle, struct ocfs2_caching_info *ci,
@@ -778,13 +815,15 @@
 		if (!is_handle_aborted(handle)) {
 			journal_t *journal = handle->h_transaction->t_journal;
 
-			mlog(ML_ERROR, "jbd2_journal_dirty_metadata failed. "
-					"Aborting transaction and journal.\n");
+			mlog(ML_ERROR, "jbd2_journal_dirty_metadata failed: "
+			     "handle type %u started at line %u, credits %u/%u "
+			     "errcode %d. Aborting transaction and journal.\n",
+			     handle->h_type, handle->h_line_no,
+			     handle->h_requested_credits,
+			     jbd2_handle_buffer_credits(handle), status);
 			handle->h_err = status;
 			jbd2_journal_abort_handle(handle);
 			jbd2_journal_abort(journal, status);
-			ocfs2_abort(bh->b_assoc_map->host->i_sb,
-				    "Journal already aborted.\n");
 		}
 	}
 }
@@ -1016,7 +1055,7 @@
 	if (!igrab(inode))
 		BUG();
 
-	num_running_trans = atomic_read(&(osb->journal->j_num_trans));
+	num_running_trans = atomic_read(&(journal->j_num_trans));
 	trace_ocfs2_journal_shutdown(num_running_trans);
 
 	/* Do a commit_cache here. It will flush our journal, *and*
@@ -1035,9 +1074,10 @@
 		osb->commit_task = NULL;
 	}
 
-	BUG_ON(atomic_read(&(osb->journal->j_num_trans)) != 0);
+	BUG_ON(atomic_read(&(journal->j_num_trans)) != 0);
 
-	if (ocfs2_mount_local(osb)) {
+	if (ocfs2_mount_local(osb) &&
+	    (journal->j_journal->j_flags & JBD2_LOADED)) {
 		jbd2_journal_lock_updates(journal->j_journal);
 		status = jbd2_journal_flush(journal->j_journal, 0);
 		jbd2_journal_unlock_updates(journal->j_journal);
--- linux-qcom-6.8.0.orig/fs/ocfs2/journal.h
+++ linux-qcom-6.8.0/fs/ocfs2/journal.h
@@ -243,6 +243,8 @@
 int			     ocfs2_commit_trans(struct ocfs2_super *osb,
 						handle_t *handle);
 int			     ocfs2_extend_trans(handle_t *handle, int nblocks);
+int			     ocfs2_assure_trans_credits(handle_t *handle,
+						int nblocks);
 int			     ocfs2_allocate_extend_trans(handle_t *handle,
 						int thresh);
 
--- linux-qcom-6.8.0.orig/fs/ocfs2/localalloc.c
+++ linux-qcom-6.8.0/fs/ocfs2/localalloc.c
@@ -863,14 +863,8 @@
 
 	numfound = bitoff = startoff = 0;
 	left = le32_to_cpu(alloc->id1.bitmap1.i_total);
-	while ((bitoff = ocfs2_find_next_zero_bit(bitmap, left, startoff)) != -1) {
-		if (bitoff == left) {
-			/* mlog(0, "bitoff (%d) == left", bitoff); */
-			break;
-		}
-		/* mlog(0, "Found a zero: bitoff = %d, startoff = %d, "
-		   "numfound = %d\n", bitoff, startoff, numfound);*/
-
+	while ((bitoff = ocfs2_find_next_zero_bit(bitmap, left, startoff)) <
+	       left) {
 		/* Ok, we found a zero bit... is it contig. or do we
 		 * start over?*/
 		if (bitoff == startoff) {
@@ -976,8 +970,8 @@
 	start = count = 0;
 	left = le32_to_cpu(alloc->id1.bitmap1.i_total);
 
-	while ((bit_off = ocfs2_find_next_zero_bit(bitmap, left, start))
-	       != -1) {
+	while (1) {
+		bit_off = ocfs2_find_next_zero_bit(bitmap, left, start);
 		if ((bit_off < left) && (bit_off == start)) {
 			count++;
 			start++;
@@ -1002,6 +996,7 @@
 				goto bail;
 			}
 		}
+
 		if (bit_off >= left)
 			break;
 		count = 1;
--- linux-qcom-6.8.0.orig/fs/ocfs2/namei.c
+++ linux-qcom-6.8.0/fs/ocfs2/namei.c
@@ -200,8 +200,10 @@
 	mode = mode_strip_sgid(&nop_mnt_idmap, dir, mode);
 	inode_init_owner(&nop_mnt_idmap, inode, dir, mode);
 	status = dquot_initialize(inode);
-	if (status)
+	if (status) {
+		iput(inode);
 		return ERR_PTR(status);
+	}
 
 	return inode;
 }
@@ -566,7 +568,7 @@
 	fe->i_last_eb_blk = 0;
 	strcpy(fe->i_signature, OCFS2_INODE_SIGNATURE);
 	fe->i_flags |= cpu_to_le32(OCFS2_VALID_FL);
-	ktime_get_real_ts64(&ts);
+	ktime_get_coarse_real_ts64(&ts);
 	fe->i_atime = fe->i_ctime = fe->i_mtime =
 		cpu_to_le64(ts.tv_sec);
 	fe->i_mtime_nsec = fe->i_ctime_nsec = fe->i_atime_nsec =
@@ -797,6 +799,7 @@
 	ocfs2_set_links_count(fe, inode->i_nlink);
 	fe->i_ctime = cpu_to_le64(inode_get_ctime_sec(inode));
 	fe->i_ctime_nsec = cpu_to_le32(inode_get_ctime_nsec(inode));
+	ocfs2_update_inode_fsync_trans(handle, inode, 0);
 	ocfs2_journal_dirty(handle, fe_bh);
 
 	err = ocfs2_add_entry(handle, dentry, inode,
@@ -993,6 +996,7 @@
 		drop_nlink(inode);
 	drop_nlink(inode);
 	ocfs2_set_links_count(fe, inode->i_nlink);
+	ocfs2_update_inode_fsync_trans(handle, inode, 0);
 	ocfs2_journal_dirty(handle, fe_bh);
 
 	inode_set_mtime_to_ts(dir, inode_set_ctime_current(dir));
--- linux-qcom-6.8.0.orig/fs/ocfs2/ocfs2.h
+++ linux-qcom-6.8.0/fs/ocfs2/ocfs2.h
@@ -284,6 +284,30 @@
 #define OCFS2_OSB_ERROR_FS	0x0004
 #define OCFS2_DEFAULT_ATIME_QUANTUM	60
 
+struct ocfs2_triggers {
+	struct jbd2_buffer_trigger_type	ot_triggers;
+	int				ot_offset;
+	struct super_block		*sb;
+};
+
+enum ocfs2_journal_trigger_type {
+	OCFS2_JTR_DI,
+	OCFS2_JTR_EB,
+	OCFS2_JTR_RB,
+	OCFS2_JTR_GD,
+	OCFS2_JTR_DB,
+	OCFS2_JTR_XB,
+	OCFS2_JTR_DQ,
+	OCFS2_JTR_DR,
+	OCFS2_JTR_DL,
+	OCFS2_JTR_NONE  /* This must be the last entry */
+};
+
+#define OCFS2_JOURNAL_TRIGGER_COUNT OCFS2_JTR_NONE
+
+void ocfs2_initialize_journal_triggers(struct super_block *sb,
+				       struct ocfs2_triggers triggers[]);
+
 struct ocfs2_journal;
 struct ocfs2_slot_info;
 struct ocfs2_recovery_map;
@@ -351,6 +375,9 @@
 	struct ocfs2_journal *journal;
 	unsigned long osb_commit_interval;
 
+	/* Journal triggers for checksum */
+	struct ocfs2_triggers s_journal_triggers[OCFS2_JOURNAL_TRIGGER_COUNT];
+
 	struct delayed_work		la_enable_wq;
 
 	/*
--- linux-qcom-6.8.0.orig/fs/ocfs2/ocfs2_trace.h
+++ linux-qcom-6.8.0/fs/ocfs2/ocfs2_trace.h
@@ -2577,6 +2577,8 @@
 
 DEFINE_OCFS2_INT_INT_EVENT(ocfs2_extend_trans);
 
+DEFINE_OCFS2_INT_EVENT(ocfs2_assure_trans_credits);
+
 DEFINE_OCFS2_INT_EVENT(ocfs2_extend_trans_restart);
 
 DEFINE_OCFS2_INT_INT_EVENT(ocfs2_allocate_extend_trans);
--- linux-qcom-6.8.0.orig/fs/ocfs2/quota_global.c
+++ linux-qcom-6.8.0/fs/ocfs2/quota_global.c
@@ -881,7 +881,7 @@
 	int status = 0;
 
 	trace_ocfs2_get_next_id(from_kqid(&init_user_ns, *qid), type);
-	if (!sb_has_quota_loaded(sb, type)) {
+	if (!sb_has_quota_active(sb, type)) {
 		status = -ESRCH;
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/fs/ocfs2/quota_local.c
+++ linux-qcom-6.8.0/fs/ocfs2/quota_local.c
@@ -689,7 +689,7 @@
 	int status;
 	struct buffer_head *bh = NULL;
 	struct ocfs2_quota_recovery *rec;
-	int locked = 0;
+	int locked = 0, global_read = 0;
 
 	info->dqi_max_spc_limit = 0x7fffffffffffffffLL;
 	info->dqi_max_ino_limit = 0x7fffffffffffffffLL;
@@ -697,6 +697,7 @@
 	if (!oinfo) {
 		mlog(ML_ERROR, "failed to allocate memory for ocfs2 quota"
 			       " info.");
+		status = -ENOMEM;
 		goto out_err;
 	}
 	info->dqi_priv = oinfo;
@@ -709,6 +710,7 @@
 	status = ocfs2_global_read_info(sb, type);
 	if (status < 0)
 		goto out_err;
+	global_read = 1;
 
 	status = ocfs2_inode_lock(lqinode, &oinfo->dqi_lqi_bh, 1);
 	if (status < 0) {
@@ -779,10 +781,12 @@
 		if (locked)
 			ocfs2_inode_unlock(lqinode, 1);
 		ocfs2_release_local_quota_bitmaps(&oinfo->dqi_chunk);
+		if (global_read)
+			cancel_delayed_work_sync(&oinfo->dqi_sync_work);
 		kfree(oinfo);
 	}
 	brelse(bh);
-	return -1;
+	return status;
 }
 
 /* Write local info to quota file */
@@ -860,6 +864,7 @@
 	brelse(oinfo->dqi_libh);
 	brelse(oinfo->dqi_lqi_bh);
 	kfree(oinfo);
+	info->dqi_priv = NULL;
 	return status;
 }
 
--- linux-qcom-6.8.0.orig/fs/ocfs2/refcounttree.c
+++ linux-qcom-6.8.0/fs/ocfs2/refcounttree.c
@@ -25,6 +25,7 @@
 #include "namei.h"
 #include "ocfs2_trace.h"
 #include "file.h"
+#include "symlink.h"
 
 #include <linux/bio.h>
 #include <linux/blkdev.h>
@@ -4155,8 +4156,9 @@
 	int ret;
 	struct inode *inode = d_inode(old_dentry);
 	struct buffer_head *new_bh = NULL;
+	struct ocfs2_inode_info *oi = OCFS2_I(inode);
 
-	if (OCFS2_I(inode)->ip_flags & OCFS2_INODE_SYSTEM_FILE) {
+	if (oi->ip_flags & OCFS2_INODE_SYSTEM_FILE) {
 		ret = -EINVAL;
 		mlog_errno(ret);
 		goto out;
@@ -4182,6 +4184,26 @@
 		goto out_unlock;
 	}
 
+	if ((oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) &&
+	    (oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL)) {
+		/*
+		 * Adjust extent record count to reserve space for extended attribute.
+		 * Inline data count had been adjusted in ocfs2_duplicate_inline_data().
+		 */
+		struct ocfs2_inode_info *new_oi = OCFS2_I(new_inode);
+
+		if (!(new_oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) &&
+		    !(ocfs2_inode_is_fast_symlink(new_inode))) {
+			struct ocfs2_dinode *new_di = (struct ocfs2_dinode *)new_bh->b_data;
+			struct ocfs2_dinode *old_di = (struct ocfs2_dinode *)old_bh->b_data;
+			struct ocfs2_extent_list *el = &new_di->id2.i_list;
+			int inline_size = le16_to_cpu(old_di->i_xattr_inline_size);
+
+			le16_add_cpu(&el->l_count, -(inline_size /
+					sizeof(struct ocfs2_extent_rec)));
+		}
+	}
+
 	ret = ocfs2_create_reflink_node(inode, old_bh,
 					new_inode, new_bh, preserve);
 	if (ret) {
@@ -4189,7 +4211,7 @@
 		goto inode_unlock;
 	}
 
-	if (OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_XATTR_FL) {
+	if (oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) {
 		ret = ocfs2_reflink_xattrs(inode, old_bh,
 					   new_inode, new_bh,
 					   preserve);
--- linux-qcom-6.8.0.orig/fs/ocfs2/reservations.c
+++ linux-qcom-6.8.0/fs/ocfs2/reservations.c
@@ -414,7 +414,7 @@
 
 	start = search_start;
 	while ((offset = ocfs2_find_next_zero_bit(bitmap, resmap->m_bitmap_len,
-						 start)) != -1) {
+					start)) < resmap->m_bitmap_len) {
 		/* Search reached end of the region */
 		if (offset >= (search_start + search_len))
 			break;
--- linux-qcom-6.8.0.orig/fs/ocfs2/resize.c
+++ linux-qcom-6.8.0/fs/ocfs2/resize.c
@@ -566,6 +566,8 @@
 	ocfs2_commit_trans(osb, handle);
 
 out_free_group_bh:
+	if (ret < 0)
+		ocfs2_remove_from_cache(INODE_CACHE(inode), group_bh);
 	brelse(group_bh);
 
 out_unlock:
--- linux-qcom-6.8.0.orig/fs/ocfs2/suballoc.c
+++ linux-qcom-6.8.0/fs/ocfs2/suballoc.c
@@ -1290,10 +1290,8 @@
 	found = start = best_offset = best_size = 0;
 	bitmap = bg->bg_bitmap;
 
-	while((offset = ocfs2_find_next_zero_bit(bitmap, total_bits, start)) != -1) {
-		if (offset == total_bits)
-			break;
-
+	while ((offset = ocfs2_find_next_zero_bit(bitmap, total_bits, start)) <
+	       total_bits) {
 		if (!ocfs2_test_bg_bit_allocatable(bg_bh, offset)) {
 			/* We found a zero, but we can't use it as it
 			 * hasn't been put to disk yet! */
--- linux-qcom-6.8.0.orig/fs/ocfs2/super.c
+++ linux-qcom-6.8.0/fs/ocfs2/super.c
@@ -122,7 +122,7 @@
 static int ocfs2_enable_quotas(struct ocfs2_super *osb);
 static void ocfs2_disable_quotas(struct ocfs2_super *osb);
 
-static struct dquot **ocfs2_get_dquots(struct inode *inode)
+static struct dquot __rcu **ocfs2_get_dquots(struct inode *inode)
 {
 	return OCFS2_I(inode)->i_dquot;
 }
@@ -1075,9 +1075,11 @@
 	debugfs_create_file("fs_state", S_IFREG|S_IRUSR, osb->osb_debug_root,
 			    osb, &ocfs2_osb_debug_fops);
 
-	if (ocfs2_meta_ecc(osb))
+	if (ocfs2_meta_ecc(osb)) {
+		ocfs2_initialize_journal_triggers(sb, osb->s_journal_triggers);
 		ocfs2_blockcheck_stats_debugfs_install( &osb->osb_ecc_stats,
 							osb->osb_debug_root);
+	}
 
 	status = ocfs2_mount_volume(sb);
 	if (status < 0)
@@ -2320,6 +2322,7 @@
 			       struct ocfs2_blockcheck_stats *stats)
 {
 	int status = -EAGAIN;
+	u32 blksz_bits;
 
 	if (memcmp(di->i_signature, OCFS2_SUPER_BLOCK_SIGNATURE,
 		   strlen(OCFS2_SUPER_BLOCK_SIGNATURE)) == 0) {
@@ -2334,11 +2337,15 @@
 				goto out;
 		}
 		status = -EINVAL;
-		if ((1 << le32_to_cpu(di->id2.i_super.s_blocksize_bits)) != blksz) {
+		/* Acceptable block sizes are 512 bytes, 1K, 2K and 4K. */
+		blksz_bits = le32_to_cpu(di->id2.i_super.s_blocksize_bits);
+		if (blksz_bits < 9 || blksz_bits > 12) {
+			mlog(ML_ERROR, "found superblock with incorrect block "
+			     "size bits: found %u, should be 9, 10, 11, or 12\n",
+			     blksz_bits);
+		} else if ((1 << le32_to_cpu(blksz_bits)) != blksz) {
 			mlog(ML_ERROR, "found superblock with incorrect block "
-			     "size: found %u, should be %u\n",
-			     1 << le32_to_cpu(di->id2.i_super.s_blocksize_bits),
-			       blksz);
+			     "size: found %u, should be %u\n", 1 << blksz_bits, blksz);
 		} else if (le16_to_cpu(di->id2.i_super.s_major_rev_level) !=
 			   OCFS2_MAJOR_REV_LEVEL ||
 			   le16_to_cpu(di->id2.i_super.s_minor_rev_level) !=
--- linux-qcom-6.8.0.orig/fs/ocfs2/xattr.c
+++ linux-qcom-6.8.0/fs/ocfs2/xattr.c
@@ -1062,13 +1062,13 @@
 	return i_ret + b_ret;
 }
 
-static int ocfs2_xattr_find_entry(int name_index,
+static int ocfs2_xattr_find_entry(struct inode *inode, int name_index,
 				  const char *name,
 				  struct ocfs2_xattr_search *xs)
 {
 	struct ocfs2_xattr_entry *entry;
 	size_t name_len;
-	int i, cmp = 1;
+	int i, name_offset, cmp = 1;
 
 	if (name == NULL)
 		return -EINVAL;
@@ -1076,13 +1076,22 @@
 	name_len = strlen(name);
 	entry = xs->here;
 	for (i = 0; i < le16_to_cpu(xs->header->xh_count); i++) {
+		if ((void *)entry >= xs->end) {
+			ocfs2_error(inode->i_sb, "corrupted xattr entries");
+			return -EFSCORRUPTED;
+		}
 		cmp = name_index - ocfs2_xattr_get_type(entry);
 		if (!cmp)
 			cmp = name_len - entry->xe_name_len;
-		if (!cmp)
-			cmp = memcmp(name, (xs->base +
-				     le16_to_cpu(entry->xe_name_offset)),
-				     name_len);
+		if (!cmp) {
+			name_offset = le16_to_cpu(entry->xe_name_offset);
+			if ((xs->base + name_offset + name_len) > xs->end) {
+				ocfs2_error(inode->i_sb,
+					    "corrupted xattr entries");
+				return -EFSCORRUPTED;
+			}
+			cmp = memcmp(name, (xs->base + name_offset), name_len);
+		}
 		if (cmp == 0)
 			break;
 		entry += 1;
@@ -1166,7 +1175,7 @@
 	xs->base = (void *)xs->header;
 	xs->here = xs->header->xh_entries;
 
-	ret = ocfs2_xattr_find_entry(name_index, name, xs);
+	ret = ocfs2_xattr_find_entry(inode, name_index, name, xs);
 	if (ret)
 		return ret;
 	size = le64_to_cpu(xs->here->xe_value_size);
@@ -2027,8 +2036,7 @@
 				rc = 0;
 			ocfs2_xa_cleanup_value_truncate(loc, "removing",
 							orig_clusters);
-			if (rc)
-				goto out;
+			goto out;
 		}
 	}
 
@@ -2698,7 +2706,7 @@
 
 	/* Find the named attribute. */
 	if (oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL) {
-		ret = ocfs2_xattr_find_entry(name_index, name, xs);
+		ret = ocfs2_xattr_find_entry(inode, name_index, name, xs);
 		if (ret && ret != -ENODATA)
 			return ret;
 		xs->not_found = ret;
@@ -2833,7 +2841,7 @@
 		xs->end = (void *)(blk_bh->b_data) + blk_bh->b_size;
 		xs->here = xs->header->xh_entries;
 
-		ret = ocfs2_xattr_find_entry(name_index, name, xs);
+		ret = ocfs2_xattr_find_entry(inode, name_index, name, xs);
 	} else
 		ret = ocfs2_xattr_index_block_find(inode, blk_bh,
 						   name_index,
@@ -6511,16 +6519,7 @@
 	}
 
 	new_oi = OCFS2_I(args->new_inode);
-	/*
-	 * Adjust extent record count to reserve space for extended attribute.
-	 * Inline data count had been adjusted in ocfs2_duplicate_inline_data().
-	 */
-	if (!(new_oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) &&
-	    !(ocfs2_inode_is_fast_symlink(args->new_inode))) {
-		struct ocfs2_extent_list *el = &new_di->id2.i_list;
-		le16_add_cpu(&el->l_count, -(inline_size /
-					sizeof(struct ocfs2_extent_rec)));
-	}
+
 	spin_lock(&new_oi->ip_lock);
 	new_oi->ip_dyn_features |= OCFS2_HAS_XATTR_FL | OCFS2_INLINE_XATTR_FL;
 	new_di->i_dyn_features = cpu_to_le16(new_oi->ip_dyn_features);
--- linux-qcom-6.8.0.orig/fs/open.c
+++ linux-qcom-6.8.0/fs/open.c
@@ -200,13 +200,13 @@
 	return error;
 }
 
-SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length)
+SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length)
 {
 	return do_sys_ftruncate(fd, length, 1);
 }
 
 #ifdef CONFIG_COMPAT
-COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length)
+COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length)
 {
 	return do_sys_ftruncate(fd, length, 1);
 }
@@ -1446,6 +1446,8 @@
 
 	if (unlikely(usize < OPEN_HOW_SIZE_VER0))
 		return -EINVAL;
+	if (unlikely(usize > PAGE_SIZE))
+		return -E2BIG;
 
 	err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize);
 	if (err)
--- linux-qcom-6.8.0.orig/fs/openpromfs/inode.c
+++ linux-qcom-6.8.0/fs/openpromfs/inode.c
@@ -355,10 +355,10 @@
 	return inode;
 }
 
-static int openprom_remount(struct super_block *sb, int *flags, char *data)
+static int openpromfs_reconfigure(struct fs_context *fc)
 {
-	sync_filesystem(sb);
-	*flags |= SB_NOATIME;
+	sync_filesystem(fc->root->d_sb);
+	fc->sb_flags |= SB_NOATIME;
 	return 0;
 }
 
@@ -366,7 +366,6 @@
 	.alloc_inode	= openprom_alloc_inode,
 	.free_inode	= openprom_free_inode,
 	.statfs		= simple_statfs,
-	.remount_fs	= openprom_remount,
 };
 
 static int openprom_fill_super(struct super_block *s, struct fs_context *fc)
@@ -415,6 +414,7 @@
 
 static const struct fs_context_operations openpromfs_context_ops = {
 	.get_tree	= openpromfs_get_tree,
+	.reconfigure	= openpromfs_reconfigure,
 };
 
 static int openpromfs_init_fs_context(struct fs_context *fc)
--- linux-qcom-6.8.0.orig/fs/orangefs/super.c
+++ linux-qcom-6.8.0/fs/orangefs/super.c
@@ -201,7 +201,8 @@
 		     (long)new_op->downcall.resp.statfs.files_avail);
 
 	buf->f_type = sb->s_magic;
-	memcpy(&buf->f_fsid, &ORANGEFS_SB(sb)->fs_id, sizeof(buf->f_fsid));
+	buf->f_fsid.val[0] = ORANGEFS_SB(sb)->fs_id;
+	buf->f_fsid.val[1] = ORANGEFS_SB(sb)->id;
 	buf->f_bsize = new_op->downcall.resp.statfs.block_size;
 	buf->f_namelen = ORANGEFS_NAME_MAX;
 
@@ -527,7 +528,7 @@
 	sb->s_fs_info = kzalloc(sizeof(struct orangefs_sb_info_s), GFP_KERNEL);
 	if (!ORANGEFS_SB(sb)) {
 		d = ERR_PTR(-ENOMEM);
-		goto free_sb_and_op;
+		goto free_op;
 	}
 
 	ret = orangefs_fill_sb(sb,
--- linux-qcom-6.8.0.orig/fs/overlayfs/copy_up.c
+++ linux-qcom-6.8.0/fs/overlayfs/copy_up.c
@@ -234,17 +234,33 @@
 {
 	loff_t tmp;
 
-	if (WARN_ON_ONCE(pos != pos2))
+	if (pos != pos2)
 		return -EIO;
-	if (WARN_ON_ONCE(pos < 0 || len < 0 || totlen < 0))
+	if (pos < 0 || len < 0 || totlen < 0)
 		return -EIO;
-	if (WARN_ON_ONCE(check_add_overflow(pos, len, &tmp)))
+	if (check_add_overflow(pos, len, &tmp))
 		return -EIO;
 	return 0;
 }
 
+static int ovl_sync_file(struct path *path)
+{
+	struct file *new_file;
+	int err;
+
+	new_file = ovl_path_open(path, O_LARGEFILE | O_RDONLY);
+	if (IS_ERR(new_file))
+		return PTR_ERR(new_file);
+
+	err = vfs_fsync(new_file, 0);
+	fput(new_file);
+
+	return err;
+}
+
 static int ovl_copy_up_file(struct ovl_fs *ofs, struct dentry *dentry,
-			    struct file *new_file, loff_t len)
+			    struct file *new_file, loff_t len,
+			    bool datasync)
 {
 	struct path datapath;
 	struct file *old_file;
@@ -342,7 +358,8 @@
 
 		len -= bytes;
 	}
-	if (!error && ovl_should_sync(ofs))
+	/* call fsync once, either now or later along with metadata */
+	if (!error && ovl_should_sync(ofs) && datasync)
 		error = vfs_fsync(new_file, 0);
 out_fput:
 	fput(old_file);
@@ -399,13 +416,13 @@
 	return err;
 }
 
-struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real,
+struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode,
 				  bool is_upper)
 {
 	struct ovl_fh *fh;
 	int fh_type, dwords;
 	int buflen = MAX_HANDLE_SZ;
-	uuid_t *uuid = &real->d_sb->s_uuid;
+	uuid_t *uuid = &realinode->i_sb->s_uuid;
 	int err;
 
 	/* Make sure the real fid stays 32bit aligned */
@@ -422,13 +439,13 @@
 	 * the price or reconnecting the dentry.
 	 */
 	dwords = buflen >> 2;
-	fh_type = exportfs_encode_fh(real, (void *)fh->fb.fid, &dwords, 0);
+	fh_type = exportfs_encode_inode_fh(realinode, (void *)fh->fb.fid,
+					   &dwords, NULL, 0);
 	buflen = (dwords << 2);
 
 	err = -EIO;
-	if (WARN_ON(fh_type < 0) ||
-	    WARN_ON(buflen > MAX_HANDLE_SZ) ||
-	    WARN_ON(fh_type == FILEID_INVALID))
+	if (fh_type < 0 || fh_type == FILEID_INVALID ||
+	    WARN_ON(buflen > MAX_HANDLE_SZ))
 		goto out_err;
 
 	fh->fb.version = OVL_FH_VERSION;
@@ -464,7 +481,7 @@
 	if (!ovl_can_decode_fh(origin->d_sb))
 		return NULL;
 
-	return ovl_encode_real_fh(ofs, origin, false);
+	return ovl_encode_real_fh(ofs, d_inode(origin), false);
 }
 
 int ovl_set_origin_fh(struct ovl_fs *ofs, const struct ovl_fh *fh,
@@ -489,7 +506,7 @@
 	const struct ovl_fh *fh;
 	int err;
 
-	fh = ovl_encode_real_fh(ofs, upper, true);
+	fh = ovl_encode_real_fh(ofs, d_inode(upper), true);
 	if (IS_ERR(fh))
 		return PTR_ERR(fh);
 
@@ -574,6 +591,7 @@
 	bool indexed;
 	bool metacopy;
 	bool metacopy_digest;
+	bool metadata_fsync;
 };
 
 static int ovl_link_up(struct ovl_copy_up_ctx *c)
@@ -634,7 +652,8 @@
 	if (IS_ERR(new_file))
 		return PTR_ERR(new_file);
 
-	err = ovl_copy_up_file(ofs, c->dentry, new_file, c->stat.size);
+	err = ovl_copy_up_file(ofs, c->dentry, new_file, c->stat.size,
+			       !c->metadata_fsync);
 	fput(new_file);
 
 	return err;
@@ -701,6 +720,10 @@
 		err = ovl_set_attr(ofs, temp, &c->stat);
 	inode_unlock(temp->d_inode);
 
+	/* fsync metadata before moving it into upper dir */
+	if (!err && ovl_should_sync(ofs) && c->metadata_fsync)
+		err = ovl_sync_file(&upperpath);
+
 	return err;
 }
 
@@ -860,7 +883,8 @@
 
 	temp = tmpfile->f_path.dentry;
 	if (!c->metacopy && c->stat.size) {
-		err = ovl_copy_up_file(ofs, c->dentry, tmpfile, c->stat.size);
+		err = ovl_copy_up_file(ofs, c->dentry, tmpfile, c->stat.size,
+				       !c->metadata_fsync);
 		if (err)
 			goto out_fput;
 	}
@@ -1135,6 +1159,17 @@
 	    !kgid_has_mapping(current_user_ns(), ctx.stat.gid))
 		return -EOVERFLOW;
 
+	/*
+	 * With metacopy disabled, we fsync after final metadata copyup, for
+	 * both regular files and directories to get atomic copyup semantics
+	 * on filesystems that do not use strict metadata ordering (e.g. ubifs).
+	 *
+	 * With metacopy enabled we want to avoid fsync on all meta copyup
+	 * that will hurt performance of workloads such as chown -R, so we
+	 * only fsync on data copyup as legacy behavior.
+	 */
+	ctx.metadata_fsync = !OVL_FS(dentry->d_sb)->config.metacopy &&
+			     (S_ISREG(ctx.stat.mode) || S_ISDIR(ctx.stat.mode));
 	ctx.metacopy = ovl_need_meta_copy_up(dentry, ctx.stat.mode, flags);
 
 	if (parent) {
--- linux-qcom-6.8.0.orig/fs/overlayfs/dir.c
+++ linux-qcom-6.8.0/fs/overlayfs/dir.c
@@ -327,9 +327,6 @@
 	struct dentry *newdentry;
 	int err;
 
-	if (!attr->hardlink && !IS_POSIXACL(udir))
-		attr->mode &= ~current_umask();
-
 	inode_lock_nested(udir, I_MUTEX_PARENT);
 	newdentry = ovl_create_real(ofs, udir,
 				    ovl_lookup_upper(ofs, dentry->d_name.name,
--- linux-qcom-6.8.0.orig/fs/overlayfs/export.c
+++ linux-qcom-6.8.0/fs/overlayfs/export.c
@@ -176,31 +176,37 @@
  *
  * Return 0 for upper file handle, > 0 for lower file handle or < 0 on error.
  */
-static int ovl_check_encode_origin(struct dentry *dentry)
+static int ovl_check_encode_origin(struct inode *inode)
 {
-	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
+	struct ovl_fs *ofs = OVL_FS(inode->i_sb);
 	bool decodable = ofs->config.nfs_export;
+	struct dentry *dentry;
+	int err;
+
+	/* No upper layer? */
+	if (!ovl_upper_mnt(ofs))
+		return 1;
 
 	/* Lower file handle for non-upper non-decodable */
-	if (!ovl_dentry_upper(dentry) && !decodable)
+	if (!ovl_inode_upper(inode) && !decodable)
 		return 1;
 
 	/* Upper file handle for pure upper */
-	if (!ovl_dentry_lower(dentry))
+	if (!ovl_inode_lower(inode))
 		return 0;
 
 	/*
 	 * Root is never indexed, so if there's an upper layer, encode upper for
 	 * root.
 	 */
-	if (dentry == dentry->d_sb->s_root)
+	if (inode == d_inode(inode->i_sb->s_root))
 		return 0;
 
 	/*
 	 * Upper decodable file handle for non-indexed upper.
 	 */
-	if (ovl_dentry_upper(dentry) && decodable &&
-	    !ovl_test_flag(OVL_INDEX, d_inode(dentry)))
+	if (ovl_inode_upper(inode) && decodable &&
+	    !ovl_test_flag(OVL_INDEX, inode))
 		return 0;
 
 	/*
@@ -209,14 +215,23 @@
 	 * ovl_connect_layer() will try to make origin's layer "connected" by
 	 * copying up a "connectable" ancestor.
 	 */
-	if (d_is_dir(dentry) && ovl_upper_mnt(ofs) && decodable)
-		return ovl_connect_layer(dentry);
+	if (!decodable || !S_ISDIR(inode->i_mode))
+		return 1;
+
+	dentry = d_find_any_alias(inode);
+	if (!dentry)
+		return -ENOENT;
+
+	err = ovl_connect_layer(dentry);
+	dput(dentry);
+	if (err < 0)
+		return err;
 
 	/* Lower file handle for indexed and non-upper dir/non-dir */
 	return 1;
 }
 
-static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry,
+static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct inode *inode,
 			     u32 *fid, int buflen)
 {
 	struct ovl_fh *fh = NULL;
@@ -227,13 +242,13 @@
 	 * Check if we should encode a lower or upper file handle and maybe
 	 * copy up an ancestor to make lower file handle connectable.
 	 */
-	err = enc_lower = ovl_check_encode_origin(dentry);
+	err = enc_lower = ovl_check_encode_origin(inode);
 	if (enc_lower < 0)
 		goto fail;
 
 	/* Encode an upper or lower file handle */
-	fh = ovl_encode_real_fh(ofs, enc_lower ? ovl_dentry_lower(dentry) :
-				ovl_dentry_upper(dentry), !enc_lower);
+	fh = ovl_encode_real_fh(ofs, enc_lower ? ovl_inode_lower(inode) :
+				ovl_inode_upper(inode), !enc_lower);
 	if (IS_ERR(fh))
 		return PTR_ERR(fh);
 
@@ -247,8 +262,8 @@
 	return err;
 
 fail:
-	pr_warn_ratelimited("failed to encode file handle (%pd2, err=%i)\n",
-			    dentry, err);
+	pr_warn_ratelimited("failed to encode file handle (ino=%lu, err=%i)\n",
+			    inode->i_ino, err);
 	goto out;
 }
 
@@ -256,19 +271,13 @@
 			 struct inode *parent)
 {
 	struct ovl_fs *ofs = OVL_FS(inode->i_sb);
-	struct dentry *dentry;
 	int bytes, buflen = *max_len << 2;
 
 	/* TODO: encode connectable file handles */
 	if (parent)
 		return FILEID_INVALID;
 
-	dentry = d_find_any_alias(inode);
-	if (!dentry)
-		return FILEID_INVALID;
-
-	bytes = ovl_dentry_to_fid(ofs, dentry, fid, buflen);
-	dput(dentry);
+	bytes = ovl_dentry_to_fid(ofs, inode, fid, buflen);
 	if (bytes <= 0)
 		return FILEID_INVALID;
 
--- linux-qcom-6.8.0.orig/fs/overlayfs/inode.c
+++ linux-qcom-6.8.0/fs/overlayfs/inode.c
@@ -617,8 +617,13 @@
 	struct file *file;
 	unsigned int cmd;
 	int err;
+	unsigned int flags;
 
-	file = dentry_open(realpath, O_RDONLY, current_cred());
+	flags = O_RDONLY;
+	if (force_o_largefile())
+		flags |= O_LARGEFILE;
+
+	file = dentry_open(realpath, flags, current_cred());
 	if (IS_ERR(file))
 		return PTR_ERR(file);
 
--- linux-qcom-6.8.0.orig/fs/overlayfs/namei.c
+++ linux-qcom-6.8.0/fs/overlayfs/namei.c
@@ -542,7 +542,7 @@
 	struct ovl_fh *fh;
 	int err;
 
-	fh = ovl_encode_real_fh(ofs, real, is_upper);
+	fh = ovl_encode_real_fh(ofs, d_inode(real), is_upper);
 	err = PTR_ERR(fh);
 	if (IS_ERR(fh)) {
 		fh = NULL;
@@ -738,7 +738,7 @@
 	struct ovl_fh *fh;
 	int err;
 
-	fh = ovl_encode_real_fh(ofs, origin, false);
+	fh = ovl_encode_real_fh(ofs, d_inode(origin), false);
 	if (IS_ERR(fh))
 		return PTR_ERR(fh);
 
--- linux-qcom-6.8.0.orig/fs/overlayfs/overlayfs.h
+++ linux-qcom-6.8.0/fs/overlayfs/overlayfs.h
@@ -866,7 +866,7 @@
 int ovl_maybe_copy_up(struct dentry *dentry, int flags);
 int ovl_copy_xattr(struct super_block *sb, const struct path *path, struct dentry *new);
 int ovl_set_attr(struct ovl_fs *ofs, struct dentry *upper, struct kstat *stat);
-struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real,
+struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct inode *realinode,
 				  bool is_upper);
 struct ovl_fh *ovl_get_origin_fh(struct ovl_fs *ofs, struct dentry *origin);
 int ovl_set_origin_fh(struct ovl_fs *ofs, const struct ovl_fh *fh,
--- linux-qcom-6.8.0.orig/fs/overlayfs/params.c
+++ linux-qcom-6.8.0/fs/overlayfs/params.c
@@ -55,6 +55,7 @@
 	Opt_uuid,
 	Opt_nfs_export,
 	Opt_userxattr,
+	Opt_nouserxattr,
 	Opt_xino,
 	Opt_metacopy,
 	Opt_verity,
@@ -155,6 +156,7 @@
 	fsparam_enum("uuid",                Opt_uuid, ovl_parameter_uuid),
 	fsparam_enum("nfs_export",          Opt_nfs_export, ovl_parameter_bool),
 	fsparam_flag("userxattr",           Opt_userxattr),
+	fsparam_flag("nouserxattr",         Opt_nouserxattr),
 	fsparam_enum("xino",                Opt_xino, ovl_parameter_xino),
 	fsparam_enum("metacopy",            Opt_metacopy, ovl_parameter_bool),
 	fsparam_enum("verity",              Opt_verity, ovl_parameter_verity),
@@ -280,12 +282,20 @@
 {
 	struct ovl_fs_context *ctx = fc->fs_private;
 
-	if (ovl_dentry_weird(path->dentry))
-		return invalfc(fc, "filesystem on %s not supported", name);
-
 	if (!d_is_dir(path->dentry))
 		return invalfc(fc, "%s is not a directory", name);
 
+	/*
+	 * Root dentries of case-insensitive capable filesystems might
+	 * not have the dentry operations set, but still be incompatible
+	 * with overlayfs.  Check explicitly to prevent post-mount
+	 * failures.
+	 */
+	if (sb_has_encoding(path->mnt->mnt_sb))
+		return invalfc(fc, "case-insensitive capable filesystem on %s not supported", name);
+
+	if (ovl_dentry_weird(path->dentry))
+		return invalfc(fc, "filesystem on %s not supported", name);
 
 	/*
 	 * Check whether upper path is read-only here to report failures
@@ -349,6 +359,8 @@
 	case Opt_datadir_add:
 		ctx->nr_data++;
 		fallthrough;
+	case Opt_lowerdir:
+		fallthrough;
 	case Opt_lowerdir_add:
 		WARN_ON(ctx->nr >= ctx->capacity);
 		l = &ctx->lower[ctx->nr++];
@@ -361,10 +373,9 @@
 	}
 }
 
-static int ovl_parse_layer(struct fs_context *fc, struct fs_parameter *param,
-			   enum ovl_opt layer)
+static int ovl_parse_layer(struct fs_context *fc, const char *layer_name, enum ovl_opt layer)
 {
-	char *name = kstrdup(param->string, GFP_KERNEL);
+	char *name = kstrdup(layer_name, GFP_KERNEL);
 	bool upper = (layer == Opt_upperdir || layer == Opt_workdir);
 	struct path path;
 	int err;
@@ -372,7 +383,7 @@
 	if (!name)
 		return -ENOMEM;
 
-	if (upper)
+	if (upper || layer == Opt_lowerdir)
 		err = ovl_mount_dir(name, &path);
 	else
 		err = ovl_mount_dir_noesc(name, &path);
@@ -428,7 +439,6 @@
 {
 	int err;
 	struct ovl_fs_context *ctx = fc->fs_private;
-	struct ovl_fs_context_layer *l;
 	char *dup = NULL, *iter;
 	ssize_t nr_lower, nr;
 	bool data_layer = false;
@@ -445,7 +455,7 @@
 		return 0;
 
 	if (*name == ':') {
-		pr_err("cannot append lower layer");
+		pr_err("cannot append lower layer\n");
 		return -EINVAL;
 	}
 
@@ -468,35 +478,11 @@
 		goto out_err;
 	}
 
-	if (nr_lower > ctx->capacity) {
-		err = -ENOMEM;
-		l = krealloc_array(ctx->lower, nr_lower, sizeof(*ctx->lower),
-				   GFP_KERNEL_ACCOUNT);
-		if (!l)
-			goto out_err;
-
-		ctx->lower = l;
-		ctx->capacity = nr_lower;
-	}
-
 	iter = dup;
-	l = ctx->lower;
-	for (nr = 0; nr < nr_lower; nr++, l++) {
-		ctx->nr++;
-		memset(l, 0, sizeof(*l));
-
-		err = ovl_mount_dir(iter, &l->path);
+	for (nr = 0; nr < nr_lower; nr++) {
+		err = ovl_parse_layer(fc, iter, Opt_lowerdir);
 		if (err)
-			goto out_put;
-
-		err = ovl_mount_dir_check(fc, &l->path, Opt_lowerdir, iter, false);
-		if (err)
-			goto out_put;
-
-		err = -ENOMEM;
-		l->name = kstrdup(iter, GFP_KERNEL_ACCOUNT);
-		if (!l->name)
-			goto out_put;
+			goto out_err;
 
 		if (data_layer)
 			ctx->nr_data++;
@@ -513,8 +499,8 @@
 			 * there are no data layers.
 			 */
 			if (ctx->nr_data > 0) {
-				pr_err("regular lower layers cannot follow data lower layers");
-				goto out_put;
+				pr_err("regular lower layers cannot follow data lower layers\n");
+				goto out_err;
 			}
 
 			data_layer = false;
@@ -528,9 +514,6 @@
 	kfree(dup);
 	return 0;
 
-out_put:
-	ovl_reset_lowerdirs(ctx);
-
 out_err:
 	kfree(dup);
 
@@ -578,7 +561,7 @@
 	case Opt_datadir_add:
 	case Opt_upperdir:
 	case Opt_workdir:
-		err = ovl_parse_layer(fc, param, opt);
+		err = ovl_parse_layer(fc, param->string, opt);
 		break;
 	case Opt_default_permissions:
 		config->default_permissions = true;
@@ -619,6 +602,9 @@
 	case Opt_userxattr:
 		config->userxattr = true;
 		break;
+	case Opt_nouserxattr:
+		config->userxattr = false;
+		break;
 	default:
 		pr_err("unrecognized mount option \"%s\" or missing value\n",
 		       param->key);
@@ -725,6 +711,8 @@
 	ofs->config.nfs_export		= ovl_nfs_export_def;
 	ofs->config.xino		= ovl_xino_def();
 	ofs->config.metacopy		= ovl_metacopy_def;
+	if (fc->user_ns != &init_user_ns)
+		ofs->config.userxattr = true;
 
 	fc->s_fs_info		= ofs;
 	fc->fs_private		= ctx;
@@ -778,11 +766,6 @@
 {
 	struct ovl_opt_set set = ctx->set;
 
-	if (ctx->nr_data > 0 && !config->metacopy) {
-		pr_err("lower data-only dirs require metacopy support.\n");
-		return -EINVAL;
-	}
-
 	/* Workdir/index are useless in non-upper mount */
 	if (!config->upperdir) {
 		if (config->workdir) {
@@ -934,6 +917,39 @@
 		config->metacopy = false;
 	}
 
+	/*
+	 * Fail if we don't have trusted xattr capability and a feature was
+	 * explicitly requested that requires them.
+	 */
+	if (!config->userxattr && !capable(CAP_SYS_ADMIN)) {
+		if (set.redirect &&
+		    config->redirect_mode != OVL_REDIRECT_NOFOLLOW) {
+			pr_err("redirect_dir requires permission to access trusted xattrs\n");
+			return -EPERM;
+		}
+		if (config->metacopy && set.metacopy) {
+			pr_err("metacopy requires permission to access trusted xattrs\n");
+			return -EPERM;
+		}
+		if (config->verity_mode) {
+			pr_err("verity requires permission to access trusted xattrs\n");
+			return -EPERM;
+		}
+		if (ctx->nr_data > 0) {
+			pr_err("lower data-only dirs require permission to access trusted xattrs\n");
+			return -EPERM;
+		}
+		/*
+		 * Other xattr-dependent features should be disabled without
+		 * great disturbance to the user in ovl_make_workdir().
+		 */
+	}
+
+	if (ctx->nr_data > 0 && !config->metacopy) {
+		pr_err("lower data-only dirs require metacopy support.\n");
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
@@ -997,6 +1013,8 @@
 		seq_puts(m, ",volatile");
 	if (ofs->config.userxattr)
 		seq_puts(m, ",userxattr");
+	else
+		seq_puts(m, ",nouserxattr");
 	if (ofs->config.verity_mode != ovl_verity_mode_def())
 		seq_printf(m, ",verity=%s",
 			   ovl_verity_mode(&ofs->config));
--- linux-qcom-6.8.0.orig/fs/overlayfs/util.c
+++ linux-qcom-6.8.0/fs/overlayfs/util.c
@@ -197,6 +197,9 @@
 
 bool ovl_dentry_weird(struct dentry *dentry)
 {
+	if (!d_can_lookup(dentry) && !d_is_file(dentry) && !d_is_symlink(dentry))
+		return true;
+
 	return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT |
 				  DCACHE_MANAGE_TRANSIT |
 				  DCACHE_OP_HASH |
--- linux-qcom-6.8.0.orig/fs/proc/Makefile
+++ linux-qcom-6.8.0/fs/proc/Makefile
@@ -5,7 +5,7 @@
 
 obj-y   += proc.o
 
-CFLAGS_task_mmu.o	+= $(call cc-option,-Wno-override-init,)
+CFLAGS_task_mmu.o	+= -Wno-override-init
 proc-y			:= nommu.o task_nommu.o
 proc-$(CONFIG_MMU)	:= task_mmu.o
 
@@ -33,4 +33,4 @@
 proc-$(CONFIG_PROC_VMCORE)	+= vmcore.o
 proc-$(CONFIG_PRINTK)	+= kmsg.o
 proc-$(CONFIG_PROC_PAGE_MONITOR)	+= page.o
-proc-$(CONFIG_BOOT_CONFIG)	+= bootconfig.o
+proc-$(CONFIG_BOOT_CONFIG)	+= bootconfig.o version_signature.o
--- linux-qcom-6.8.0.orig/fs/proc/base.c
+++ linux-qcom-6.8.0/fs/proc/base.c
@@ -85,6 +85,7 @@
 #include <linux/elf.h>
 #include <linux/pid_namespace.h>
 #include <linux/user_namespace.h>
+#include <linux/fs_parser.h>
 #include <linux/fs_struct.h>
 #include <linux/slab.h>
 #include <linux/sched/autogroup.h>
@@ -117,6 +118,40 @@
 static u8 nlink_tid __ro_after_init;
 static u8 nlink_tgid __ro_after_init;
 
+enum proc_mem_force {
+	PROC_MEM_FORCE_ALWAYS,
+	PROC_MEM_FORCE_PTRACE,
+	PROC_MEM_FORCE_NEVER
+};
+
+static enum proc_mem_force proc_mem_force_override __ro_after_init =
+	IS_ENABLED(CONFIG_PROC_MEM_NO_FORCE) ? PROC_MEM_FORCE_NEVER :
+	IS_ENABLED(CONFIG_PROC_MEM_FORCE_PTRACE) ? PROC_MEM_FORCE_PTRACE :
+	PROC_MEM_FORCE_ALWAYS;
+
+static const struct constant_table proc_mem_force_table[] __initconst = {
+	{ "always", PROC_MEM_FORCE_ALWAYS },
+	{ "ptrace", PROC_MEM_FORCE_PTRACE },
+	{ "never", PROC_MEM_FORCE_NEVER },
+	{ }
+};
+
+static int __init early_proc_mem_force_override(char *buf)
+{
+	if (!buf)
+		return -EINVAL;
+
+	/*
+	 * lookup_constant() defaults to proc_mem_force_override to preseve
+	 * the initial Kconfig choice in case an invalid param gets passed.
+	 */
+	proc_mem_force_override = lookup_constant(proc_mem_force_table,
+						  buf, proc_mem_force_override);
+
+	return 0;
+}
+early_param("proc_mem.force_override", early_proc_mem_force_override);
+
 struct pid_entry {
 	const char *name;
 	unsigned int len;
@@ -835,6 +870,28 @@
 	return ret;
 }
 
+static bool proc_mem_foll_force(struct file *file, struct mm_struct *mm)
+{
+	struct task_struct *task;
+	bool ptrace_active = false;
+
+	switch (proc_mem_force_override) {
+	case PROC_MEM_FORCE_NEVER:
+		return false;
+	case PROC_MEM_FORCE_PTRACE:
+		task = get_proc_task(file_inode(file));
+		if (task) {
+			ptrace_active =	READ_ONCE(task->ptrace) &&
+					READ_ONCE(task->mm) == mm &&
+					READ_ONCE(task->parent) == current;
+			put_task_struct(task);
+		}
+		return ptrace_active;
+	default:
+		return true;
+	}
+}
+
 static ssize_t mem_rw(struct file *file, char __user *buf,
 			size_t count, loff_t *ppos, int write)
 {
@@ -855,7 +912,9 @@
 	if (!mmget_not_zero(mm))
 		goto free;
 
-	flags = FOLL_FORCE | (write ? FOLL_WRITE : 0);
+	flags = write ? FOLL_WRITE : 0;
+	if (proc_mem_foll_force(file, mm))
+		flags |= FOLL_FORCE;
 
 	while (count > 0) {
 		size_t this_len = min_t(size_t, count, PAGE_SIZE);
@@ -3214,7 +3273,7 @@
 	mm = get_task_mm(task);
 	if (mm) {
 		seq_printf(m, "ksm_rmap_items %lu\n", mm->ksm_rmap_items);
-		seq_printf(m, "ksm_zero_pages %lu\n", mm->ksm_zero_pages);
+		seq_printf(m, "ksm_zero_pages %ld\n", mm_ksm_zero_pages(mm));
 		seq_printf(m, "ksm_merging_pages %lu\n", mm->ksm_merging_pages);
 		seq_printf(m, "ksm_process_profit %ld\n", ksm_process_profit(mm));
 		mmput(mm);
--- linux-qcom-6.8.0.orig/fs/proc/bootconfig.c
+++ linux-qcom-6.8.0/fs/proc/bootconfig.c
@@ -62,12 +62,12 @@
 				break;
 			dst += ret;
 		}
-		if (ret >= 0 && boot_command_line[0]) {
-			ret = snprintf(dst, rest(dst, end), "# Parameters from bootloader:\n# %s\n",
-				       boot_command_line);
-			if (ret > 0)
-				dst += ret;
-		}
+	}
+	if (cmdline_has_extra_options() && ret >= 0 && boot_command_line[0]) {
+		ret = snprintf(dst, rest(dst, end), "# Parameters from bootloader:\n# %s\n",
+			       boot_command_line);
+		if (ret > 0)
+			dst += ret;
 	}
 out:
 	kfree(key);
--- linux-qcom-6.8.0.orig/fs/proc/fd.c
+++ linux-qcom-6.8.0/fs/proc/fd.c
@@ -74,7 +74,18 @@
 	return 0;
 }
 
-static int proc_fdinfo_access_allowed(struct inode *inode)
+static int seq_fdinfo_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, seq_show, inode);
+}
+
+/**
+ * Shared /proc/pid/fdinfo and /proc/pid/fdinfo/fd permission helper to ensure
+ * that the current task has PTRACE_MODE_READ in addition to the normal
+ * POSIX-like checks.
+ */
+static int proc_fdinfo_permission(struct mnt_idmap *idmap, struct inode *inode,
+				  int mask)
 {
 	bool allowed = false;
 	struct task_struct *task = get_proc_task(inode);
@@ -88,18 +99,13 @@
 	if (!allowed)
 		return -EACCES;
 
-	return 0;
+	return generic_permission(idmap, inode, mask);
 }
 
-static int seq_fdinfo_open(struct inode *inode, struct file *file)
-{
-	int ret = proc_fdinfo_access_allowed(inode);
-
-	if (ret)
-		return ret;
-
-	return single_open(file, seq_show, inode);
-}
+static const struct inode_operations proc_fdinfo_file_inode_operations = {
+	.permission	= proc_fdinfo_permission,
+	.setattr	= proc_setattr,
+};
 
 static const struct file_operations proc_fdinfo_file_operations = {
 	.open		= seq_fdinfo_open,
@@ -388,6 +394,8 @@
 	ei = PROC_I(inode);
 	ei->fd = data->fd;
 
+	inode->i_op = &proc_fdinfo_file_inode_operations;
+
 	inode->i_fop = &proc_fdinfo_file_operations;
 	tid_fd_update_inode(task, inode, 0);
 
@@ -407,23 +415,13 @@
 				  proc_fdinfo_instantiate);
 }
 
-static int proc_open_fdinfo(struct inode *inode, struct file *file)
-{
-	int ret = proc_fdinfo_access_allowed(inode);
-
-	if (ret)
-		return ret;
-
-	return 0;
-}
-
 const struct inode_operations proc_fdinfo_inode_operations = {
 	.lookup		= proc_lookupfdinfo,
+	.permission	= proc_fdinfo_permission,
 	.setattr	= proc_setattr,
 };
 
 const struct file_operations proc_fdinfo_operations = {
-	.open		= proc_open_fdinfo,
 	.read		= generic_read_dir,
 	.iterate_shared	= proc_readfdinfo,
 	.llseek		= generic_file_llseek,
--- linux-qcom-6.8.0.orig/fs/proc/kcore.c
+++ linux-qcom-6.8.0/fs/proc/kcore.c
@@ -50,6 +50,20 @@
 #define	kc_offset_to_vaddr(o) ((o) + PAGE_OFFSET)
 #endif
 
+#ifndef kc_xlate_dev_mem_ptr
+#define kc_xlate_dev_mem_ptr kc_xlate_dev_mem_ptr
+static inline void *kc_xlate_dev_mem_ptr(phys_addr_t phys)
+{
+	return __va(phys);
+}
+#endif
+#ifndef kc_unxlate_dev_mem_ptr
+#define kc_unxlate_dev_mem_ptr kc_unxlate_dev_mem_ptr
+static inline void kc_unxlate_dev_mem_ptr(phys_addr_t phys, void *virt)
+{
+}
+#endif
+
 static LIST_HEAD(kclist_head);
 static DECLARE_RWSEM(kclist_lock);
 static int kcore_need_update = 1;
@@ -471,19 +485,21 @@
 	while (buflen) {
 		struct page *page;
 		unsigned long pfn;
+		phys_addr_t phys;
+		void *__start;
 
 		/*
 		 * If this is the first iteration or the address is not within
 		 * the previous entry, search for a matching entry.
 		 */
 		if (!m || start < m->addr || start >= m->addr + m->size) {
-			struct kcore_list *iter;
+			struct kcore_list *pos;
 
 			m = NULL;
-			list_for_each_entry(iter, &kclist_head, list) {
-				if (start >= iter->addr &&
-				    start < iter->addr + iter->size) {
-					m = iter;
+			list_for_each_entry(pos, &kclist_head, list) {
+				if (start >= pos->addr &&
+				    start < pos->addr + pos->size) {
+					m = pos;
 					break;
 				}
 			}
@@ -537,7 +553,8 @@
 			}
 			break;
 		case KCORE_RAM:
-			pfn = __pa(start) >> PAGE_SHIFT;
+			phys = __pa(start);
+			pfn =  phys >> PAGE_SHIFT;
 			page = pfn_to_online_page(pfn);
 
 			/*
@@ -557,17 +574,33 @@
 			fallthrough;
 		case KCORE_VMEMMAP:
 		case KCORE_TEXT:
+			if (m->type == KCORE_RAM) {
+				__start = kc_xlate_dev_mem_ptr(phys);
+				if (!__start) {
+					ret = -ENOMEM;
+					if (iov_iter_zero(tsz, iter) != tsz)
+						ret = -EFAULT;
+					goto out;
+				}
+			} else {
+				__start = (void *)start;
+			}
+
 			/*
 			 * Sadly we must use a bounce buffer here to be able to
 			 * make use of copy_from_kernel_nofault(), as these
 			 * memory regions might not always be mapped on all
 			 * architectures.
 			 */
-			if (copy_from_kernel_nofault(buf, (void *)start, tsz)) {
+			ret = copy_from_kernel_nofault(buf, __start, tsz);
+			if (m->type == KCORE_RAM)
+				kc_unxlate_dev_mem_ptr(phys, __start);
+			if (ret) {
 				if (iov_iter_zero(tsz, iter) != tsz) {
 					ret = -EFAULT;
 					goto out;
 				}
+				ret = 0;
 			/*
 			 * We know the bounce buffer is safe to copy from, so
 			 * use _copy_to_iter() directly.
--- linux-qcom-6.8.0.orig/fs/proc/page.c
+++ linux-qcom-6.8.0/fs/proc/page.c
@@ -67,7 +67,7 @@
 		 */
 		ppage = pfn_to_online_page(pfn);
 
-		if (!ppage || PageSlab(ppage) || page_has_type(ppage))
+		if (!ppage)
 			pcount = 0;
 		else
 			pcount = page_mapcount(ppage);
@@ -124,11 +124,8 @@
 
 	/*
 	 * pseudo flags for the well known (anonymous) memory mapped pages
-	 *
-	 * Note that page->_mapcount is overloaded in SLAB, so the
-	 * simple test in page_mapped() is not enough.
 	 */
-	if (!PageSlab(page) && page_mapped(page))
+	if (page_mapped(page))
 		u |= 1 << KPF_MMAP;
 	if (PageAnon(page))
 		u |= 1 << KPF_ANON;
--- linux-qcom-6.8.0.orig/fs/proc/proc_sysctl.c
+++ linux-qcom-6.8.0/fs/proc/proc_sysctl.c
@@ -479,12 +479,10 @@
 			make_empty_dir_inode(inode);
 	}
 
+	inode->i_uid = GLOBAL_ROOT_UID;
+	inode->i_gid = GLOBAL_ROOT_GID;
 	if (root->set_ownership)
-		root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
-	else {
-		inode->i_uid = GLOBAL_ROOT_UID;
-		inode->i_gid = GLOBAL_ROOT_GID;
-	}
+		root->set_ownership(head, &inode->i_uid, &inode->i_gid);
 
 	return inode;
 }
--- linux-qcom-6.8.0.orig/fs/proc/softirqs.c
+++ linux-qcom-6.8.0/fs/proc/softirqs.c
@@ -20,7 +20,7 @@
 	for (i = 0; i < NR_SOFTIRQS; i++) {
 		seq_printf(p, "%12s:", softirq_to_name[i]);
 		for_each_possible_cpu(j)
-			seq_printf(p, " %10u", kstat_softirqs_cpu(i, j));
+			seq_put_decimal_ull_width(p, " ", kstat_softirqs_cpu(i, j), 10);
 		seq_putc(p, '\n');
 	}
 	return 0;
--- linux-qcom-6.8.0.orig/fs/proc/task_mmu.c
+++ linux-qcom-6.8.0/fs/proc/task_mmu.c
@@ -965,12 +965,17 @@
 				break;
 
 			/* Case 1 and 2 above */
-			if (vma->vm_start >= last_vma_end)
+			if (vma->vm_start >= last_vma_end) {
+				smap_gather_stats(vma, &mss, 0);
+				last_vma_end = vma->vm_end;
 				continue;
+			}
 
 			/* Case 4 above */
-			if (vma->vm_end > last_vma_end)
+			if (vma->vm_end > last_vma_end) {
 				smap_gather_stats(vma, &mss, last_vma_end);
+				last_vma_end = vma->vm_end;
+			}
 		}
 	} for_each_vma(vmi, vma);
 
@@ -1352,8 +1357,7 @@
 	return (pagemap_entry_t) { .pme = (frame & PM_PFRAME_MASK) | flags };
 }
 
-static int add_to_pagemap(unsigned long addr, pagemap_entry_t *pme,
-			  struct pagemapread *pm)
+static int add_to_pagemap(pagemap_entry_t *pme, struct pagemapread *pm)
 {
 	pm->buffer[pm->pos++] = *pme;
 	if (pm->pos >= pm->len)
@@ -1380,7 +1384,7 @@
 			hole_end = end;
 
 		for (; addr < hole_end; addr += PAGE_SIZE) {
-			err = add_to_pagemap(addr, &pme, pm);
+			err = add_to_pagemap(&pme, pm);
 			if (err)
 				goto out;
 		}
@@ -1392,7 +1396,7 @@
 		if (vma->vm_flags & VM_SOFTDIRTY)
 			pme = make_pme(0, PM_SOFT_DIRTY);
 		for (; addr < min(end, vma->vm_end); addr += PAGE_SIZE) {
-			err = add_to_pagemap(addr, &pme, pm);
+			err = add_to_pagemap(&pme, pm);
 			if (err)
 				goto out;
 		}
@@ -1406,7 +1410,6 @@
 {
 	u64 frame = 0, flags = 0;
 	struct page *page = NULL;
-	bool migration = false;
 
 	if (pte_present(pte)) {
 		if (pm->show_pfn)
@@ -1438,7 +1441,6 @@
 			    (offset << MAX_SWAPFILES_SHIFT);
 		}
 		flags |= PM_SWAP;
-		migration = is_migration_entry(entry);
 		if (is_pfn_swap_entry(entry))
 			page = pfn_swap_entry_to_page(entry);
 		if (pte_marker_entry_uffd_wp(entry))
@@ -1447,7 +1449,7 @@
 
 	if (page && !PageAnon(page))
 		flags |= PM_FILE;
-	if (page && !migration && page_mapcount(page) == 1)
+	if (page && (flags & PM_PRESENT) && page_mapcount(page) == 1)
 		flags |= PM_MMAP_EXCLUSIVE;
 	if (vma->vm_flags & VM_SOFTDIRTY)
 		flags |= PM_SOFT_DIRTY;
@@ -1464,10 +1466,10 @@
 	pte_t *pte, *orig_pte;
 	int err = 0;
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
-	bool migration = false;
 
 	ptl = pmd_trans_huge_lock(pmdp, vma);
 	if (ptl) {
+		unsigned int idx = (addr & ~PMD_MASK) >> PAGE_SHIFT;
 		u64 flags = 0, frame = 0;
 		pmd_t pmd = *pmdp;
 		struct page *page = NULL;
@@ -1484,8 +1486,7 @@
 			if (pmd_uffd_wp(pmd))
 				flags |= PM_UFFD_WP;
 			if (pm->show_pfn)
-				frame = pmd_pfn(pmd) +
-					((addr & ~PMD_MASK) >> PAGE_SHIFT);
+				frame = pmd_pfn(pmd) + idx;
 		}
 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
 		else if (is_swap_pmd(pmd)) {
@@ -1494,11 +1495,9 @@
 
 			if (pm->show_pfn) {
 				if (is_pfn_swap_entry(entry))
-					offset = swp_offset_pfn(entry);
+					offset = swp_offset_pfn(entry) + idx;
 				else
-					offset = swp_offset(entry);
-				offset = offset +
-					((addr & ~PMD_MASK) >> PAGE_SHIFT);
+					offset = swp_offset(entry) + idx;
 				frame = swp_type(entry) |
 					(offset << MAX_SWAPFILES_SHIFT);
 			}
@@ -1508,18 +1507,23 @@
 			if (pmd_swp_uffd_wp(pmd))
 				flags |= PM_UFFD_WP;
 			VM_BUG_ON(!is_pmd_migration_entry(pmd));
-			migration = is_migration_entry(entry);
 			page = pfn_swap_entry_to_page(entry);
 		}
 #endif
 
-		if (page && !migration && page_mapcount(page) == 1)
-			flags |= PM_MMAP_EXCLUSIVE;
+		if (page && !PageAnon(page))
+			flags |= PM_FILE;
 
-		for (; addr != end; addr += PAGE_SIZE) {
-			pagemap_entry_t pme = make_pme(frame, flags);
+		for (; addr != end; addr += PAGE_SIZE, idx++) {
+			u64 cur_flags = flags;
+			pagemap_entry_t pme;
+
+			if (page && (flags & PM_PRESENT) &&
+			    page_mapcount(page + idx) == 1)
+				cur_flags |= PM_MMAP_EXCLUSIVE;
 
-			err = add_to_pagemap(addr, &pme, pm);
+			pme = make_pme(frame, cur_flags);
+			err = add_to_pagemap(&pme, pm);
 			if (err)
 				break;
 			if (pm->show_pfn) {
@@ -1547,7 +1551,7 @@
 		pagemap_entry_t pme;
 
 		pme = pte_to_pagemap_entry(pm, vma, addr, ptep_get(pte));
-		err = add_to_pagemap(addr, &pme, pm);
+		err = add_to_pagemap(&pme, pm);
 		if (err)
 			break;
 	}
@@ -1597,7 +1601,7 @@
 	for (; addr != end; addr += PAGE_SIZE) {
 		pagemap_entry_t pme = make_pme(frame, flags);
 
-		err = add_to_pagemap(addr, &pme, pm);
+		err = add_to_pagemap(&pme, pm);
 		if (err)
 			return err;
 		if (pm->show_pfn && (flags & PM_PRESENT))
@@ -1818,15 +1822,13 @@
 }
 
 static void make_uffd_wp_pte(struct vm_area_struct *vma,
-			     unsigned long addr, pte_t *pte)
+			     unsigned long addr, pte_t *pte, pte_t ptent)
 {
-	pte_t ptent = ptep_get(pte);
-
 	if (pte_present(ptent)) {
 		pte_t old_pte;
 
 		old_pte = ptep_modify_prot_start(vma, addr, pte);
-		ptent = pte_mkuffd_wp(ptent);
+		ptent = pte_mkuffd_wp(old_pte);
 		ptep_modify_prot_commit(vma, addr, pte, old_pte, ptent);
 	} else if (is_swap_pte(ptent)) {
 		ptent = pte_swp_mkuffd_wp(ptent);
@@ -2176,9 +2178,12 @@
 	if ((p->arg.flags & PM_SCAN_WP_MATCHING) && !p->vec_out) {
 		/* Fast path for performing exclusive WP */
 		for (addr = start; addr != end; pte++, addr += PAGE_SIZE) {
-			if (pte_uffd_wp(ptep_get(pte)))
+			pte_t ptent = ptep_get(pte);
+
+			if ((pte_present(ptent) && pte_uffd_wp(ptent)) ||
+			    pte_swp_uffd_wp_any(ptent))
 				continue;
-			make_uffd_wp_pte(vma, addr, pte);
+			make_uffd_wp_pte(vma, addr, pte, ptent);
 			if (!flush_end)
 				start = addr;
 			flush_end = addr + PAGE_SIZE;
@@ -2191,8 +2196,10 @@
 	    p->arg.return_mask == PAGE_IS_WRITTEN) {
 		for (addr = start; addr < end; pte++, addr += PAGE_SIZE) {
 			unsigned long next = addr + PAGE_SIZE;
+			pte_t ptent = ptep_get(pte);
 
-			if (pte_uffd_wp(ptep_get(pte)))
+			if ((pte_present(ptent) && pte_uffd_wp(ptent)) ||
+			    pte_swp_uffd_wp_any(ptent))
 				continue;
 			ret = pagemap_scan_output(p->cur_vma_category | PAGE_IS_WRITTEN,
 						  p, addr, &next);
@@ -2200,7 +2207,7 @@
 				break;
 			if (~p->arg.flags & PM_SCAN_WP_MATCHING)
 				continue;
-			make_uffd_wp_pte(vma, addr, pte);
+			make_uffd_wp_pte(vma, addr, pte, ptent);
 			if (!flush_end)
 				start = addr;
 			flush_end = next;
@@ -2209,8 +2216,9 @@
 	}
 
 	for (addr = start; addr != end; pte++, addr += PAGE_SIZE) {
+		pte_t ptent = ptep_get(pte);
 		unsigned long categories = p->cur_vma_category |
-					   pagemap_page_category(p, vma, addr, ptep_get(pte));
+					   pagemap_page_category(p, vma, addr, ptent);
 		unsigned long next = addr + PAGE_SIZE;
 
 		if (!pagemap_scan_is_interesting_page(categories, p))
@@ -2225,7 +2233,7 @@
 		if (~categories & PAGE_IS_WRITTEN)
 			continue;
 
-		make_uffd_wp_pte(vma, addr, pte);
+		make_uffd_wp_pte(vma, addr, pte, ptent);
 		if (!flush_end)
 			start = addr;
 		flush_end = next;
@@ -2361,8 +2369,10 @@
 		return -EFAULT;
 	if (!arg->vec && arg->vec_len)
 		return -EINVAL;
+	if (UINT_MAX == SIZE_MAX && arg->vec_len > SIZE_MAX)
+		return -EINVAL;
 	if (arg->vec && !access_ok((void __user *)(long)arg->vec,
-			      arg->vec_len * sizeof(struct page_region)))
+				   size_mul(arg->vec_len, sizeof(struct page_region))))
 		return -EFAULT;
 
 	/* Fixup default values */
--- linux-qcom-6.8.0.orig/fs/proc/version_signature.c
+++ linux-qcom-6.8.0/fs/proc/version_signature.c
@@ -0,0 +1,32 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/utsname.h>
+
+static int version_signature_proc_show(struct seq_file *m, void *v)
+{
+	seq_printf(m, "%s\n", CONFIG_VERSION_SIGNATURE);
+	return 0;
+}
+
+static int version_signature_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, version_signature_proc_show, NULL);
+}
+
+static const struct proc_ops version_signature_proc_fops = {
+	.proc_open	= version_signature_proc_open,
+	.proc_read	= seq_read,
+	.proc_lseek	= seq_lseek,
+	.proc_release	= single_release,
+};
+
+static int __init proc_version_signature_init(void)
+{
+	proc_create("version_signature", 0, NULL, &version_signature_proc_fops);
+	return 0;
+}
+module_init(proc_version_signature_init);
--- linux-qcom-6.8.0.orig/fs/proc/vmcore.c
+++ linux-qcom-6.8.0/fs/proc/vmcore.c
@@ -383,6 +383,8 @@
 		/* leave now if filled buffer already */
 		if (!iov_iter_count(iter))
 			return acc;
+
+		cond_resched();
 	}
 
 	list_for_each_entry(m, &vmcore_list, list) {
@@ -402,6 +404,8 @@
 			if (!iov_iter_count(iter))
 				return acc;
 		}
+
+		cond_resched();
 	}
 
 	return acc;
@@ -455,10 +459,6 @@
 #endif
 }
 
-static const struct vm_operations_struct vmcore_mmap_ops = {
-	.fault = mmap_vmcore_fault,
-};
-
 /**
  * vmcore_alloc_buf - allocate buffer in vmalloc memory
  * @size: size of buffer
@@ -486,6 +486,11 @@
  * virtually contiguous user-space in ELF layout.
  */
 #ifdef CONFIG_MMU
+
+static const struct vm_operations_struct vmcore_mmap_ops = {
+	.fault = mmap_vmcore_fault,
+};
+
 /*
  * remap_oldmem_pfn_checked - do remap_oldmem_pfn_range replacing all pages
  * reported as not being ram with the zero page.
--- linux-qcom-6.8.0.orig/fs/pstore/inode.c
+++ linux-qcom-6.8.0/fs/pstore/inode.c
@@ -307,7 +307,6 @@
 {
 	struct pstore_private *pos, *tmp;
 	struct dentry *root;
-	int rc = 0;
 
 	root = psinfo_lock_root();
 	if (!root)
@@ -317,11 +316,8 @@
 		list_for_each_entry_safe(pos, tmp, &records_list, list) {
 			if (pos->record->psi == psi) {
 				list_del_init(&pos->list);
-				rc = simple_unlink(d_inode(root), pos->dentry);
-				if (WARN_ON(rc))
-					break;
-				d_drop(pos->dentry);
-				dput(pos->dentry);
+				d_invalidate(pos->dentry);
+				simple_unlink(d_inode(root), pos->dentry);
 				pos->dentry = NULL;
 			}
 		}
@@ -329,7 +325,7 @@
 
 	inode_unlock(d_inode(root));
 
-	return rc;
+	return 0;
 }
 
 /*
--- linux-qcom-6.8.0.orig/fs/pstore/zone.c
+++ linux-qcom-6.8.0/fs/pstore/zone.c
@@ -973,6 +973,8 @@
 		char *buf = kasprintf(GFP_KERNEL, "%s: Total %d times\n",
 				      kmsg_dump_reason_str(record->reason),
 				      record->count);
+		if (!buf)
+			return -ENOMEM;
 		hlen = strlen(buf);
 		record->buf = krealloc(buf, hlen + size, GFP_KERNEL);
 		if (!record->buf) {
--- linux-qcom-6.8.0.orig/fs/qnx6/inode.c
+++ linux-qcom-6.8.0/fs/qnx6/inode.c
@@ -178,8 +178,7 @@
  */
 static const char *qnx6_checkroot(struct super_block *s)
 {
-	static char match_root[2][3] = {".\0\0", "..\0"};
-	int i, error = 0;
+	int error = 0;
 	struct qnx6_dir_entry *dir_entry;
 	struct inode *root = d_inode(s->s_root);
 	struct address_space *mapping = root->i_mapping;
@@ -188,11 +187,9 @@
 		return "error reading root directory";
 	kmap(page);
 	dir_entry = page_address(page);
-	for (i = 0; i < 2; i++) {
-		/* maximum 3 bytes - due to match_root limitation */
-		if (strncmp(dir_entry[i].de_fname, match_root[i], 3))
-			error = 1;
-	}
+	if (memcmp(dir_entry[0].de_fname, ".", 2) ||
+	    memcmp(dir_entry[1].de_fname, "..", 3))
+		error = 1;
 	qnx6_put_page(page);
 	if (error)
 		return "error reading root directory.";
--- linux-qcom-6.8.0.orig/fs/quota/dquot.c
+++ linux-qcom-6.8.0/fs/quota/dquot.c
@@ -399,15 +399,17 @@
 EXPORT_SYMBOL(dquot_mark_dquot_dirty);
 
 /* Dirtify all the dquots - this can block when journalling */
-static inline int mark_all_dquot_dirty(struct dquot * const *dquot)
+static inline int mark_all_dquot_dirty(struct dquot __rcu * const *dquots)
 {
 	int ret, err, cnt;
+	struct dquot *dquot;
 
 	ret = err = 0;
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-		if (dquot[cnt])
+		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
+		if (dquot)
 			/* Even in case of error we have to continue */
-			ret = mark_dquot_dirty(dquot[cnt]);
+			ret = mark_dquot_dirty(dquot);
 		if (!err)
 			err = ret;
 	}
@@ -688,6 +690,8 @@
 
 	WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount));
 
+	flush_delayed_work(&quota_release_work);
+
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
 		if (type != -1 && cnt != type)
 			continue;
@@ -987,9 +991,8 @@
 	 * smp_mb__before_atomic() in dquot_acquire().
 	 */
 	smp_rmb();
-#ifdef CONFIG_QUOTA_DEBUG
-	BUG_ON(!dquot->dq_sb);	/* Has somebody invalidated entry under us? */
-#endif
+	/* Has somebody invalidated entry under us? */
+	WARN_ON_ONCE(hlist_unhashed(&dquot->dq_hash));
 out:
 	if (empty)
 		do_destroy_dquot(empty);
@@ -998,14 +1001,14 @@
 }
 EXPORT_SYMBOL(dqget);
 
-static inline struct dquot **i_dquot(struct inode *inode)
+static inline struct dquot __rcu **i_dquot(struct inode *inode)
 {
 	return inode->i_sb->s_op->get_dquots(inode);
 }
 
 static int dqinit_needed(struct inode *inode, int type)
 {
-	struct dquot * const *dquots;
+	struct dquot __rcu * const *dquots;
 	int cnt;
 
 	if (IS_NOQUOTA(inode))
@@ -1095,14 +1098,16 @@
 		 */
 		spin_lock(&dq_data_lock);
 		if (!IS_NOQUOTA(inode)) {
-			struct dquot **dquots = i_dquot(inode);
-			struct dquot *dquot = dquots[type];
+			struct dquot __rcu **dquots = i_dquot(inode);
+			struct dquot *dquot = srcu_dereference_check(
+				dquots[type], &dquot_srcu,
+				lockdep_is_held(&dq_data_lock));
 
 #ifdef CONFIG_QUOTA_DEBUG
 			if (unlikely(inode_get_rsv_space(inode) > 0))
 				reserved = 1;
 #endif
-			dquots[type] = NULL;
+			rcu_assign_pointer(dquots[type], NULL);
 			if (dquot)
 				dqput(dquot);
 		}
@@ -1455,7 +1460,8 @@
 static int __dquot_initialize(struct inode *inode, int type)
 {
 	int cnt, init_needed = 0;
-	struct dquot **dquots, *got[MAXQUOTAS] = {};
+	struct dquot __rcu **dquots;
+	struct dquot *got[MAXQUOTAS] = {};
 	struct super_block *sb = inode->i_sb;
 	qsize_t rsv;
 	int ret = 0;
@@ -1530,7 +1536,7 @@
 		if (!got[cnt])
 			continue;
 		if (!dquots[cnt]) {
-			dquots[cnt] = got[cnt];
+			rcu_assign_pointer(dquots[cnt], got[cnt]);
 			got[cnt] = NULL;
 			/*
 			 * Make quota reservation system happy if someone
@@ -1538,12 +1544,16 @@
 			 */
 			rsv = inode_get_rsv_space(inode);
 			if (unlikely(rsv)) {
+				struct dquot *dquot = srcu_dereference_check(
+					dquots[cnt], &dquot_srcu,
+					lockdep_is_held(&dq_data_lock));
+
 				spin_lock(&inode->i_lock);
 				/* Get reservation again under proper lock */
 				rsv = __inode_get_rsv_space(inode);
-				spin_lock(&dquots[cnt]->dq_dqb_lock);
-				dquots[cnt]->dq_dqb.dqb_rsvspace += rsv;
-				spin_unlock(&dquots[cnt]->dq_dqb_lock);
+				spin_lock(&dquot->dq_dqb_lock);
+				dquot->dq_dqb.dqb_rsvspace += rsv;
+				spin_unlock(&dquot->dq_dqb_lock);
 				spin_unlock(&inode->i_lock);
 			}
 		}
@@ -1565,7 +1575,7 @@
 
 bool dquot_initialize_needed(struct inode *inode)
 {
-	struct dquot **dquots;
+	struct dquot __rcu **dquots;
 	int i;
 
 	if (!inode_quota_active(inode))
@@ -1590,13 +1600,14 @@
 static void __dquot_drop(struct inode *inode)
 {
 	int cnt;
-	struct dquot **dquots = i_dquot(inode);
+	struct dquot __rcu **dquots = i_dquot(inode);
 	struct dquot *put[MAXQUOTAS];
 
 	spin_lock(&dq_data_lock);
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-		put[cnt] = dquots[cnt];
-		dquots[cnt] = NULL;
+		put[cnt] = srcu_dereference_check(dquots[cnt], &dquot_srcu,
+					lockdep_is_held(&dq_data_lock));
+		rcu_assign_pointer(dquots[cnt], NULL);
 	}
 	spin_unlock(&dq_data_lock);
 	dqput_all(put);
@@ -1604,7 +1615,7 @@
 
 void dquot_drop(struct inode *inode)
 {
-	struct dquot * const *dquots;
+	struct dquot __rcu * const *dquots;
 	int cnt;
 
 	if (IS_NOQUOTA(inode))
@@ -1677,7 +1688,8 @@
 	int cnt, ret = 0, index;
 	struct dquot_warn warn[MAXQUOTAS];
 	int reserve = flags & DQUOT_SPACE_RESERVE;
-	struct dquot **dquots;
+	struct dquot __rcu **dquots;
+	struct dquot *dquot;
 
 	if (!inode_quota_active(inode)) {
 		if (reserve) {
@@ -1697,27 +1709,26 @@
 	index = srcu_read_lock(&dquot_srcu);
 	spin_lock(&inode->i_lock);
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-		if (!dquots[cnt])
+		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
+		if (!dquot)
 			continue;
 		if (reserve) {
-			ret = dquot_add_space(dquots[cnt], 0, number, flags,
-					      &warn[cnt]);
+			ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]);
 		} else {
-			ret = dquot_add_space(dquots[cnt], number, 0, flags,
-					      &warn[cnt]);
+			ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]);
 		}
 		if (ret) {
 			/* Back out changes we already did */
 			for (cnt--; cnt >= 0; cnt--) {
-				if (!dquots[cnt])
+				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
+				if (!dquot)
 					continue;
-				spin_lock(&dquots[cnt]->dq_dqb_lock);
+				spin_lock(&dquot->dq_dqb_lock);
 				if (reserve)
-					dquot_free_reserved_space(dquots[cnt],
-								  number);
+					dquot_free_reserved_space(dquot, number);
 				else
-					dquot_decr_space(dquots[cnt], number);
-				spin_unlock(&dquots[cnt]->dq_dqb_lock);
+					dquot_decr_space(dquot, number);
+				spin_unlock(&dquot->dq_dqb_lock);
 			}
 			spin_unlock(&inode->i_lock);
 			goto out_flush_warn;
@@ -1747,7 +1758,8 @@
 {
 	int cnt, ret = 0, index;
 	struct dquot_warn warn[MAXQUOTAS];
-	struct dquot * const *dquots;
+	struct dquot __rcu * const *dquots;
+	struct dquot *dquot;
 
 	if (!inode_quota_active(inode))
 		return 0;
@@ -1758,17 +1770,19 @@
 	index = srcu_read_lock(&dquot_srcu);
 	spin_lock(&inode->i_lock);
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-		if (!dquots[cnt])
+		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
+		if (!dquot)
 			continue;
-		ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]);
+		ret = dquot_add_inodes(dquot, 1, &warn[cnt]);
 		if (ret) {
 			for (cnt--; cnt >= 0; cnt--) {
-				if (!dquots[cnt])
+				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
+				if (!dquot)
 					continue;
 				/* Back out changes we already did */
-				spin_lock(&dquots[cnt]->dq_dqb_lock);
-				dquot_decr_inodes(dquots[cnt], 1);
-				spin_unlock(&dquots[cnt]->dq_dqb_lock);
+				spin_lock(&dquot->dq_dqb_lock);
+				dquot_decr_inodes(dquot, 1);
+				spin_unlock(&dquot->dq_dqb_lock);
 			}
 			goto warn_put_all;
 		}
@@ -1789,7 +1803,8 @@
  */
 void dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
 {
-	struct dquot **dquots;
+	struct dquot __rcu **dquots;
+	struct dquot *dquot;
 	int cnt, index;
 
 	if (!inode_quota_active(inode)) {
@@ -1805,9 +1820,8 @@
 	spin_lock(&inode->i_lock);
 	/* Claim reserved quotas to allocated quotas */
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-		if (dquots[cnt]) {
-			struct dquot *dquot = dquots[cnt];
-
+		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
+		if (dquot) {
 			spin_lock(&dquot->dq_dqb_lock);
 			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number))
 				number = dquot->dq_dqb.dqb_rsvspace;
@@ -1831,7 +1845,8 @@
  */
 void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
 {
-	struct dquot **dquots;
+	struct dquot __rcu **dquots;
+	struct dquot *dquot;
 	int cnt, index;
 
 	if (!inode_quota_active(inode)) {
@@ -1847,9 +1862,8 @@
 	spin_lock(&inode->i_lock);
 	/* Claim reserved quotas to allocated quotas */
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-		if (dquots[cnt]) {
-			struct dquot *dquot = dquots[cnt];
-
+		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
+		if (dquot) {
 			spin_lock(&dquot->dq_dqb_lock);
 			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number))
 				number = dquot->dq_dqb.dqb_curspace;
@@ -1875,7 +1889,8 @@
 {
 	unsigned int cnt;
 	struct dquot_warn warn[MAXQUOTAS];
-	struct dquot **dquots;
+	struct dquot __rcu **dquots;
+	struct dquot *dquot;
 	int reserve = flags & DQUOT_SPACE_RESERVE, index;
 
 	if (!inode_quota_active(inode)) {
@@ -1896,17 +1911,18 @@
 		int wtype;
 
 		warn[cnt].w_type = QUOTA_NL_NOWARN;
-		if (!dquots[cnt])
+		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
+		if (!dquot)
 			continue;
-		spin_lock(&dquots[cnt]->dq_dqb_lock);
-		wtype = info_bdq_free(dquots[cnt], number);
+		spin_lock(&dquot->dq_dqb_lock);
+		wtype = info_bdq_free(dquot, number);
 		if (wtype != QUOTA_NL_NOWARN)
-			prepare_warning(&warn[cnt], dquots[cnt], wtype);
+			prepare_warning(&warn[cnt], dquot, wtype);
 		if (reserve)
-			dquot_free_reserved_space(dquots[cnt], number);
+			dquot_free_reserved_space(dquot, number);
 		else
-			dquot_decr_space(dquots[cnt], number);
-		spin_unlock(&dquots[cnt]->dq_dqb_lock);
+			dquot_decr_space(dquot, number);
+		spin_unlock(&dquot->dq_dqb_lock);
 	}
 	if (reserve)
 		*inode_reserved_space(inode) -= number;
@@ -1930,7 +1946,8 @@
 {
 	unsigned int cnt;
 	struct dquot_warn warn[MAXQUOTAS];
-	struct dquot * const *dquots;
+	struct dquot __rcu * const *dquots;
+	struct dquot *dquot;
 	int index;
 
 	if (!inode_quota_active(inode))
@@ -1941,16 +1958,16 @@
 	spin_lock(&inode->i_lock);
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
 		int wtype;
-
 		warn[cnt].w_type = QUOTA_NL_NOWARN;
-		if (!dquots[cnt])
+		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
+		if (!dquot)
 			continue;
-		spin_lock(&dquots[cnt]->dq_dqb_lock);
-		wtype = info_idq_free(dquots[cnt], 1);
+		spin_lock(&dquot->dq_dqb_lock);
+		wtype = info_idq_free(dquot, 1);
 		if (wtype != QUOTA_NL_NOWARN)
-			prepare_warning(&warn[cnt], dquots[cnt], wtype);
-		dquot_decr_inodes(dquots[cnt], 1);
-		spin_unlock(&dquots[cnt]->dq_dqb_lock);
+			prepare_warning(&warn[cnt], dquot, wtype);
+		dquot_decr_inodes(dquot, 1);
+		spin_unlock(&dquot->dq_dqb_lock);
 	}
 	spin_unlock(&inode->i_lock);
 	mark_all_dquot_dirty(dquots);
@@ -1976,8 +1993,9 @@
 	qsize_t cur_space;
 	qsize_t rsv_space = 0;
 	qsize_t inode_usage = 1;
+	struct dquot __rcu **dquots;
 	struct dquot *transfer_from[MAXQUOTAS] = {};
-	int cnt, ret = 0;
+	int cnt, index, ret = 0;
 	char is_valid[MAXQUOTAS] = {};
 	struct dquot_warn warn_to[MAXQUOTAS];
 	struct dquot_warn warn_from_inodes[MAXQUOTAS];
@@ -2008,6 +2026,7 @@
 	}
 	cur_space = __inode_get_bytes(inode);
 	rsv_space = __inode_get_rsv_space(inode);
+	dquots = i_dquot(inode);
 	/*
 	 * Build the transfer_from list, check limits, and update usage in
 	 * the target structures.
@@ -2022,7 +2041,8 @@
 		if (!sb_has_quota_active(inode->i_sb, cnt))
 			continue;
 		is_valid[cnt] = 1;
-		transfer_from[cnt] = i_dquot(inode)[cnt];
+		transfer_from[cnt] = srcu_dereference_check(dquots[cnt],
+				&dquot_srcu, lockdep_is_held(&dq_data_lock));
 		ret = dquot_add_inodes(transfer_to[cnt], inode_usage,
 				       &warn_to[cnt]);
 		if (ret)
@@ -2061,13 +2081,21 @@
 						  rsv_space);
 			spin_unlock(&transfer_from[cnt]->dq_dqb_lock);
 		}
-		i_dquot(inode)[cnt] = transfer_to[cnt];
+		rcu_assign_pointer(dquots[cnt], transfer_to[cnt]);
 	}
 	spin_unlock(&inode->i_lock);
 	spin_unlock(&dq_data_lock);
 
-	mark_all_dquot_dirty(transfer_from);
-	mark_all_dquot_dirty(transfer_to);
+	/*
+	 * These arrays are local and we hold dquot references so we don't need
+	 * the srcu protection but still take dquot_srcu to avoid warning in
+	 * mark_all_dquot_dirty().
+	 */
+	index = srcu_read_lock(&dquot_srcu);
+	mark_all_dquot_dirty((struct dquot __rcu **)transfer_from);
+	mark_all_dquot_dirty((struct dquot __rcu **)transfer_to);
+	srcu_read_unlock(&dquot_srcu, index);
+
 	flush_warnings(warn_to);
 	flush_warnings(warn_from_inodes);
 	flush_warnings(warn_from_space);
@@ -2381,7 +2409,7 @@
 int dquot_load_quota_sb(struct super_block *sb, int type, int format_id,
 	unsigned int flags)
 {
-	struct quota_format_type *fmt = find_quota_format(format_id);
+	struct quota_format_type *fmt;
 	struct quota_info *dqopt = sb_dqopt(sb);
 	int error;
 
@@ -2390,6 +2418,7 @@
 	/* Just unsuspend quotas? */
 	BUG_ON(flags & DQUOT_SUSPENDED);
 
+	fmt = find_quota_format(format_id);
 	if (!fmt)
 		return -ESRCH;
 	if (!sb->dq_op || !sb->s_qcop ||
--- linux-qcom-6.8.0.orig/fs/quota/quota_tree.c
+++ linux-qcom-6.8.0/fs/quota/quota_tree.c
@@ -21,6 +21,12 @@
 MODULE_DESCRIPTION("Quota trie support");
 MODULE_LICENSE("GPL");
 
+/*
+ * Maximum quota tree depth we support. Only to limit recursion when working
+ * with the tree.
+ */
+#define MAX_QTREE_DEPTH 6
+
 #define __QUOTA_QT_PARANOIA
 
 static int __get_index(struct qtree_mem_dqinfo *info, qid_t id, int depth)
@@ -327,27 +333,36 @@
 
 /* Insert reference to structure into the trie */
 static int do_insert_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot,
-			  uint *treeblk, int depth)
+			  uint *blks, int depth)
 {
 	char *buf = kmalloc(info->dqi_usable_bs, GFP_NOFS);
 	int ret = 0, newson = 0, newact = 0;
 	__le32 *ref;
 	uint newblk;
+	int i;
 
 	if (!buf)
 		return -ENOMEM;
-	if (!*treeblk) {
+	if (!blks[depth]) {
 		ret = get_free_dqblk(info);
 		if (ret < 0)
 			goto out_buf;
-		*treeblk = ret;
+		for (i = 0; i < depth; i++)
+			if (ret == blks[i]) {
+				quota_error(dquot->dq_sb,
+					"Free block already used in tree: block %u",
+					ret);
+				ret = -EIO;
+				goto out_buf;
+			}
+		blks[depth] = ret;
 		memset(buf, 0, info->dqi_usable_bs);
 		newact = 1;
 	} else {
-		ret = read_blk(info, *treeblk, buf);
+		ret = read_blk(info, blks[depth], buf);
 		if (ret < 0) {
 			quota_error(dquot->dq_sb, "Can't read tree quota "
-				    "block %u", *treeblk);
+				    "block %u", blks[depth]);
 			goto out_buf;
 		}
 	}
@@ -357,8 +372,20 @@
 			     info->dqi_blocks - 1);
 	if (ret)
 		goto out_buf;
-	if (!newblk)
+	if (!newblk) {
 		newson = 1;
+	} else {
+		for (i = 0; i <= depth; i++)
+			if (newblk == blks[i]) {
+				quota_error(dquot->dq_sb,
+					"Cycle in quota tree detected: block %u index %u",
+					blks[depth],
+					get_index(info, dquot->dq_id, depth));
+				ret = -EIO;
+				goto out_buf;
+			}
+	}
+	blks[depth + 1] = newblk;
 	if (depth == info->dqi_qtree_depth - 1) {
 #ifdef __QUOTA_QT_PARANOIA
 		if (newblk) {
@@ -370,16 +397,16 @@
 			goto out_buf;
 		}
 #endif
-		newblk = find_free_dqentry(info, dquot, &ret);
+		blks[depth + 1] = find_free_dqentry(info, dquot, &ret);
 	} else {
-		ret = do_insert_tree(info, dquot, &newblk, depth+1);
+		ret = do_insert_tree(info, dquot, blks, depth + 1);
 	}
 	if (newson && ret >= 0) {
 		ref[get_index(info, dquot->dq_id, depth)] =
-							cpu_to_le32(newblk);
-		ret = write_blk(info, *treeblk, buf);
+						cpu_to_le32(blks[depth + 1]);
+		ret = write_blk(info, blks[depth], buf);
 	} else if (newact && ret < 0) {
-		put_free_dqblk(info, buf, *treeblk);
+		put_free_dqblk(info, buf, blks[depth]);
 	}
 out_buf:
 	kfree(buf);
@@ -390,7 +417,7 @@
 static inline int dq_insert_tree(struct qtree_mem_dqinfo *info,
 				 struct dquot *dquot)
 {
-	int tmp = QT_TREEOFF;
+	uint blks[MAX_QTREE_DEPTH] = { QT_TREEOFF };
 
 #ifdef __QUOTA_QT_PARANOIA
 	if (info->dqi_blocks <= QT_TREEOFF) {
@@ -398,7 +425,11 @@
 		return -EIO;
 	}
 #endif
-	return do_insert_tree(info, dquot, &tmp, 0);
+	if (info->dqi_qtree_depth >= MAX_QTREE_DEPTH) {
+		quota_error(dquot->dq_sb, "Quota tree depth too big!");
+		return -EIO;
+	}
+	return do_insert_tree(info, dquot, blks, 0);
 }
 
 /*
@@ -511,19 +542,20 @@
 
 /* Remove reference to dquot from tree */
 static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot,
-		       uint *blk, int depth)
+		       uint *blks, int depth)
 {
 	char *buf = kmalloc(info->dqi_usable_bs, GFP_NOFS);
 	int ret = 0;
 	uint newblk;
 	__le32 *ref = (__le32 *)buf;
+	int i;
 
 	if (!buf)
 		return -ENOMEM;
-	ret = read_blk(info, *blk, buf);
+	ret = read_blk(info, blks[depth], buf);
 	if (ret < 0) {
 		quota_error(dquot->dq_sb, "Can't read quota data block %u",
-			    *blk);
+			    blks[depth]);
 		goto out_buf;
 	}
 	newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]);
@@ -532,29 +564,38 @@
 	if (ret)
 		goto out_buf;
 
+	for (i = 0; i <= depth; i++)
+		if (newblk == blks[i]) {
+			quota_error(dquot->dq_sb,
+				"Cycle in quota tree detected: block %u index %u",
+				blks[depth],
+				get_index(info, dquot->dq_id, depth));
+			ret = -EIO;
+			goto out_buf;
+		}
 	if (depth == info->dqi_qtree_depth - 1) {
 		ret = free_dqentry(info, dquot, newblk);
-		newblk = 0;
+		blks[depth + 1] = 0;
 	} else {
-		ret = remove_tree(info, dquot, &newblk, depth+1);
+		blks[depth + 1] = newblk;
+		ret = remove_tree(info, dquot, blks, depth + 1);
 	}
-	if (ret >= 0 && !newblk) {
-		int i;
+	if (ret >= 0 && !blks[depth + 1]) {
 		ref[get_index(info, dquot->dq_id, depth)] = cpu_to_le32(0);
 		/* Block got empty? */
 		for (i = 0; i < (info->dqi_usable_bs >> 2) && !ref[i]; i++)
 			;
 		/* Don't put the root block into the free block list */
 		if (i == (info->dqi_usable_bs >> 2)
-		    && *blk != QT_TREEOFF) {
-			put_free_dqblk(info, buf, *blk);
-			*blk = 0;
+		    && blks[depth] != QT_TREEOFF) {
+			put_free_dqblk(info, buf, blks[depth]);
+			blks[depth] = 0;
 		} else {
-			ret = write_blk(info, *blk, buf);
+			ret = write_blk(info, blks[depth], buf);
 			if (ret < 0)
 				quota_error(dquot->dq_sb,
 					    "Can't write quota tree block %u",
-					    *blk);
+					    blks[depth]);
 		}
 	}
 out_buf:
@@ -565,11 +606,15 @@
 /* Delete dquot from tree */
 int qtree_delete_dquot(struct qtree_mem_dqinfo *info, struct dquot *dquot)
 {
-	uint tmp = QT_TREEOFF;
+	uint blks[MAX_QTREE_DEPTH] = { QT_TREEOFF };
 
 	if (!dquot->dq_off)	/* Even not allocated? */
 		return 0;
-	return remove_tree(info, dquot, &tmp, 0);
+	if (info->dqi_qtree_depth >= MAX_QTREE_DEPTH) {
+		quota_error(dquot->dq_sb, "Quota tree depth too big!");
+		return -EIO;
+	}
+	return remove_tree(info, dquot, blks, 0);
 }
 EXPORT_SYMBOL(qtree_delete_dquot);
 
@@ -613,18 +658,20 @@
 
 /* Find entry for given id in the tree */
 static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info,
-				struct dquot *dquot, uint blk, int depth)
+				struct dquot *dquot, uint *blks, int depth)
 {
 	char *buf = kmalloc(info->dqi_usable_bs, GFP_NOFS);
 	loff_t ret = 0;
 	__le32 *ref = (__le32 *)buf;
+	uint blk;
+	int i;
 
 	if (!buf)
 		return -ENOMEM;
-	ret = read_blk(info, blk, buf);
+	ret = read_blk(info, blks[depth], buf);
 	if (ret < 0) {
 		quota_error(dquot->dq_sb, "Can't read quota tree block %u",
-			    blk);
+			    blks[depth]);
 		goto out_buf;
 	}
 	ret = 0;
@@ -636,8 +683,19 @@
 	if (ret)
 		goto out_buf;
 
+	/* Check for cycles in the tree */
+	for (i = 0; i <= depth; i++)
+		if (blk == blks[i]) {
+			quota_error(dquot->dq_sb,
+				"Cycle in quota tree detected: block %u index %u",
+				blks[depth],
+				get_index(info, dquot->dq_id, depth));
+			ret = -EIO;
+			goto out_buf;
+		}
+	blks[depth + 1] = blk;
 	if (depth < info->dqi_qtree_depth - 1)
-		ret = find_tree_dqentry(info, dquot, blk, depth+1);
+		ret = find_tree_dqentry(info, dquot, blks, depth + 1);
 	else
 		ret = find_block_dqentry(info, dquot, blk);
 out_buf:
@@ -649,7 +707,13 @@
 static inline loff_t find_dqentry(struct qtree_mem_dqinfo *info,
 				  struct dquot *dquot)
 {
-	return find_tree_dqentry(info, dquot, QT_TREEOFF, 0);
+	uint blks[MAX_QTREE_DEPTH] = { QT_TREEOFF };
+
+	if (info->dqi_qtree_depth >= MAX_QTREE_DEPTH) {
+		quota_error(dquot->dq_sb, "Quota tree depth too big!");
+		return -EIO;
+	}
+	return find_tree_dqentry(info, dquot, blks, 0);
 }
 
 int qtree_read_dquot(struct qtree_mem_dqinfo *info, struct dquot *dquot)
--- linux-qcom-6.8.0.orig/fs/quota/quota_v2.c
+++ linux-qcom-6.8.0/fs/quota/quota_v2.c
@@ -166,14 +166,17 @@
 		    i_size_read(sb_dqopt(sb)->files[type]));
 		goto out_free;
 	}
-	if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) {
-		quota_error(sb, "Free block number too big (%u >= %u).",
-			    qinfo->dqi_free_blk, qinfo->dqi_blocks);
+	if (qinfo->dqi_free_blk && (qinfo->dqi_free_blk <= QT_TREEOFF ||
+	    qinfo->dqi_free_blk >= qinfo->dqi_blocks)) {
+		quota_error(sb, "Free block number %u out of range (%u, %u).",
+			    qinfo->dqi_free_blk, QT_TREEOFF, qinfo->dqi_blocks);
 		goto out_free;
 	}
-	if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) {
-		quota_error(sb, "Block with free entry too big (%u >= %u).",
-			    qinfo->dqi_free_entry, qinfo->dqi_blocks);
+	if (qinfo->dqi_free_entry && (qinfo->dqi_free_entry <= QT_TREEOFF ||
+	    qinfo->dqi_free_entry >= qinfo->dqi_blocks)) {
+		quota_error(sb, "Block with free entry %u out of range (%u, %u).",
+			    qinfo->dqi_free_entry, QT_TREEOFF,
+			    qinfo->dqi_blocks);
 		goto out_free;
 	}
 	ret = 0;
--- linux-qcom-6.8.0.orig/fs/reiserfs/reiserfs.h
+++ linux-qcom-6.8.0/fs/reiserfs/reiserfs.h
@@ -97,7 +97,7 @@
 	struct rw_semaphore i_xattr_sem;
 #endif
 #ifdef CONFIG_QUOTA
-	struct dquot *i_dquot[MAXQUOTAS];
+	struct dquot __rcu *i_dquot[MAXQUOTAS];
 #endif
 
 	struct inode vfs_inode;
--- linux-qcom-6.8.0.orig/fs/reiserfs/super.c
+++ linux-qcom-6.8.0/fs/reiserfs/super.c
@@ -802,7 +802,7 @@
 static ssize_t reiserfs_quota_read(struct super_block *, int, char *, size_t,
 				   loff_t);
 
-static struct dquot **reiserfs_get_dquots(struct inode *inode)
+static struct dquot __rcu **reiserfs_get_dquots(struct inode *inode)
 {
 	return REISERFS_I(inode)->i_dquot;
 }
--- linux-qcom-6.8.0.orig/fs/select.c
+++ linux-qcom-6.8.0/fs/select.c
@@ -476,7 +476,7 @@
 		wait->_key |= POLLOUT_SET;
 }
 
-static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time)
+static noinline_for_stack int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time)
 {
 	ktime_t expire, *to = NULL;
 	struct poll_wqueues table;
@@ -780,7 +780,9 @@
 {
 	// the path is hot enough for overhead of copy_from_user() to matter
 	if (from) {
-		if (!user_read_access_begin(from, sizeof(*from)))
+		if (can_do_masked_user_access())
+			from = masked_user_access_begin(from);
+		else if (!user_read_access_begin(from, sizeof(*from)))
 			return -EFAULT;
 		unsafe_get_user(to->p, &from->p, Efault);
 		unsafe_get_user(to->size, &from->size, Efault);
--- linux-qcom-6.8.0.orig/fs/smb/client/Makefile
+++ linux-qcom-6.8.0/fs/smb/client/Makefile
@@ -12,7 +12,7 @@
 	  smb2ops.o smb2maperror.o smb2transport.o \
 	  smb2misc.o smb2pdu.o smb2inode.o smb2file.o cifsacl.o fs_context.o \
 	  dns_resolve.o cifs_spnego_negtokeninit.asn1.o asn1.o \
-	  namespace.o
+	  namespace.o reparse.o
 
 $(obj)/asn1.o: $(obj)/cifs_spnego_negtokeninit.asn1.h
 
--- linux-qcom-6.8.0.orig/fs/smb/client/cached_dir.c
+++ linux-qcom-6.8.0/fs/smb/client/cached_dir.c
@@ -17,6 +17,11 @@
 static void smb2_close_cached_fid(struct kref *ref);
 static void cfids_laundromat_worker(struct work_struct *work);
 
+struct cached_dir_dentry {
+	struct list_head entry;
+	struct dentry *dentry;
+};
+
 static struct cached_fid *find_or_create_cached_dir(struct cached_fids *cfids,
 						    const char *path,
 						    bool lookup_only,
@@ -59,6 +64,16 @@
 	list_add(&cfid->entry, &cfids->entries);
 	cfid->on_list = true;
 	kref_get(&cfid->refcount);
+	/*
+	 * Set @cfid->has_lease to true during construction so that the lease
+	 * reference can be put in cached_dir_lease_break() due to a potential
+	 * lease break right after the request is sent or while @cfid is still
+	 * being cached, or if a reconnection is triggered during construction.
+	 * Concurrent processes won't be to use it yet due to @cfid->time being
+	 * zero.
+	 */
+	cfid->has_lease = true;
+
 	spin_unlock(&cfids->cfid_list_lock);
 	return cfid;
 }
@@ -176,12 +191,12 @@
 		return -ENOENT;
 	}
 	/*
-	 * Return cached fid if it has a lease.  Otherwise, it is either a new
-	 * entry or laundromat worker removed it from @cfids->entries.  Caller
-	 * will put last reference if the latter.
+	 * Return cached fid if it is valid (has a lease and has a time).
+	 * Otherwise, it is either a new entry or laundromat worker removed it
+	 * from @cfids->entries.  Caller will put last reference if the latter.
 	 */
 	spin_lock(&cfids->cfid_list_lock);
-	if (cfid->has_lease) {
+	if (cfid->has_lease && cfid->time) {
 		spin_unlock(&cfids->cfid_list_lock);
 		*ret_cfid = cfid;
 		kfree(utf16_path);
@@ -212,6 +227,7 @@
 		}
 	}
 	cfid->dentry = dentry;
+	cfid->tcon = tcon;
 
 	/*
 	 * We do not hold the lock for the open because in case
@@ -239,7 +255,8 @@
 		.tcon = tcon,
 		.path = path,
 		.create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE),
-		.desired_access =  FILE_READ_DATA | FILE_READ_ATTRIBUTES,
+		.desired_access =  FILE_READ_DATA | FILE_READ_ATTRIBUTES |
+				   FILE_READ_EA,
 		.disposition = FILE_OPEN,
 		.fid = pfid,
 		.replay = !!(retries),
@@ -266,15 +283,6 @@
 
 	smb2_set_related(&rqst[1]);
 
-	/*
-	 * Set @cfid->has_lease to true before sending out compounded request so
-	 * its lease reference can be put in cached_dir_lease_break() due to a
-	 * potential lease break right after the request is sent or while @cfid
-	 * is still being cached.  Concurrent processes won't be to use it yet
-	 * due to @cfid->time being zero.
-	 */
-	cfid->has_lease = true;
-
 	if (retries) {
 		smb2_set_replay(server, &rqst[0]);
 		smb2_set_replay(server, &rqst[1]);
@@ -291,7 +299,6 @@
 		}
 		goto oshr_free;
 	}
-	cfid->tcon = tcon;
 	cfid->is_open = true;
 
 	spin_lock(&cfids->cfid_list_lock);
@@ -346,6 +353,7 @@
 	SMB2_query_info_free(&rqst[1]);
 	free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base);
 	free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base);
+out:
 	if (rc) {
 		spin_lock(&cfids->cfid_list_lock);
 		if (cfid->on_list) {
@@ -357,23 +365,14 @@
 			/*
 			 * We are guaranteed to have two references at this
 			 * point. One for the caller and one for a potential
-			 * lease. Release the Lease-ref so that the directory
-			 * will be closed when the caller closes the cached
-			 * handle.
+			 * lease. Release one here, and the second below.
 			 */
 			cfid->has_lease = false;
-			spin_unlock(&cfids->cfid_list_lock);
 			kref_put(&cfid->refcount, smb2_close_cached_fid);
-			goto out;
 		}
 		spin_unlock(&cfids->cfid_list_lock);
-	}
-out:
-	if (rc) {
-		if (cfid->is_open)
-			SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid,
-				   cfid->fid.volatile_fid);
-		free_cached_dir(cfid);
+
+		kref_put(&cfid->refcount, smb2_close_cached_fid);
 	} else {
 		*ret_cfid = cfid;
 		atomic_inc(&tcon->num_remote_opens);
@@ -400,7 +399,7 @@
 	spin_lock(&cfids->cfid_list_lock);
 	list_for_each_entry(cfid, &cfids->entries, entry) {
 		if (dentry && cfid->dentry == dentry) {
-			cifs_dbg(FYI, "found a cached root file handle by dentry\n");
+			cifs_dbg(FYI, "found a cached file handle by dentry\n");
 			kref_get(&cfid->refcount);
 			*ret_cfid = cfid;
 			spin_unlock(&cfids->cfid_list_lock);
@@ -416,6 +415,7 @@
 {
 	struct cached_fid *cfid = container_of(ref, struct cached_fid,
 					       refcount);
+	int rc;
 
 	spin_lock(&cfid->cfids->cfid_list_lock);
 	if (cfid->on_list) {
@@ -429,9 +429,10 @@
 	cfid->dentry = NULL;
 
 	if (cfid->is_open) {
-		SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid,
+		rc = SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid,
 			   cfid->fid.volatile_fid);
-		atomic_dec(&cfid->tcon->num_remote_opens);
+		if (rc) /* should we retry on -EBUSY or -EAGAIN? */
+			cifs_dbg(VFS, "close cached dir rc %d\n", rc);
 	}
 
 	free_cached_dir(cfid);
@@ -474,7 +475,10 @@
 	struct cifs_tcon *tcon;
 	struct tcon_link *tlink;
 	struct cached_fids *cfids;
+	struct cached_dir_dentry *tmp_list, *q;
+	LIST_HEAD(entry);
 
+	spin_lock(&cifs_sb->tlink_tree_lock);
 	for (node = rb_first(root); node; node = rb_next(node)) {
 		tlink = rb_entry(node, struct tcon_link, tl_rbnode);
 		tcon = tlink_tcon(tlink);
@@ -483,11 +487,30 @@
 		cfids = tcon->cfids;
 		if (cfids == NULL)
 			continue;
+		spin_lock(&cfids->cfid_list_lock);
 		list_for_each_entry(cfid, &cfids->entries, entry) {
-			dput(cfid->dentry);
+			tmp_list = kmalloc(sizeof(*tmp_list), GFP_ATOMIC);
+			if (tmp_list == NULL)
+				break;
+			spin_lock(&cfid->fid_lock);
+			tmp_list->dentry = cfid->dentry;
 			cfid->dentry = NULL;
+			spin_unlock(&cfid->fid_lock);
+
+			list_add_tail(&tmp_list->entry, &entry);
 		}
+		spin_unlock(&cfids->cfid_list_lock);
+	}
+	spin_unlock(&cifs_sb->tlink_tree_lock);
+
+	list_for_each_entry_safe(tmp_list, q, &entry, entry) {
+		list_del(&tmp_list->entry);
+		dput(tmp_list->dentry);
+		kfree(tmp_list);
 	}
+
+	/* Flush any pending work that will drop dentries */
+	flush_workqueue(cfid_put_wq);
 }
 
 /*
@@ -498,50 +521,71 @@
 {
 	struct cached_fids *cfids = tcon->cfids;
 	struct cached_fid *cfid, *q;
-	LIST_HEAD(entry);
 
 	if (cfids == NULL)
 		return;
 
+	/*
+	 * Mark all the cfids as closed, and move them to the cfids->dying list.
+	 * They'll be cleaned up later by cfids_invalidation_worker. Take
+	 * a reference to each cfid during this process.
+	 */
 	spin_lock(&cfids->cfid_list_lock);
 	list_for_each_entry_safe(cfid, q, &cfids->entries, entry) {
-		list_move(&cfid->entry, &entry);
+		list_move(&cfid->entry, &cfids->dying);
 		cfids->num_entries--;
 		cfid->is_open = false;
 		cfid->on_list = false;
-		/* To prevent race with smb2_cached_lease_break() */
-		kref_get(&cfid->refcount);
-	}
-	spin_unlock(&cfids->cfid_list_lock);
-
-	list_for_each_entry_safe(cfid, q, &entry, entry) {
-		list_del(&cfid->entry);
-		cancel_work_sync(&cfid->lease_break);
 		if (cfid->has_lease) {
 			/*
-			 * We lease was never cancelled from the server so we
-			 * need to drop the reference.
+			 * The lease was never cancelled from the server,
+			 * so steal that reference.
 			 */
-			spin_lock(&cfids->cfid_list_lock);
 			cfid->has_lease = false;
-			spin_unlock(&cfids->cfid_list_lock);
-			kref_put(&cfid->refcount, smb2_close_cached_fid);
-		}
-		/* Drop the extra reference opened above*/
-		kref_put(&cfid->refcount, smb2_close_cached_fid);
+		} else
+			kref_get(&cfid->refcount);
 	}
+	/*
+	 * Queue dropping of the dentries once locks have been dropped
+	 */
+	if (!list_empty(&cfids->dying))
+		queue_work(cfid_put_wq, &cfids->invalidation_work);
+	spin_unlock(&cfids->cfid_list_lock);
 }
 
 static void
-smb2_cached_lease_break(struct work_struct *work)
+cached_dir_offload_close(struct work_struct *work)
 {
 	struct cached_fid *cfid = container_of(work,
-				struct cached_fid, lease_break);
+				struct cached_fid, close_work);
+	struct cifs_tcon *tcon = cfid->tcon;
+
+	WARN_ON(cfid->on_list);
 
-	spin_lock(&cfid->cfids->cfid_list_lock);
-	cfid->has_lease = false;
-	spin_unlock(&cfid->cfids->cfid_list_lock);
 	kref_put(&cfid->refcount, smb2_close_cached_fid);
+	cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cached_close);
+}
+
+/*
+ * Release the cached directory's dentry, and then queue work to drop cached
+ * directory itself (closing on server if needed).
+ *
+ * Must be called with a reference to the cached_fid and a reference to the
+ * tcon.
+ */
+static void cached_dir_put_work(struct work_struct *work)
+{
+	struct cached_fid *cfid = container_of(work, struct cached_fid,
+					       put_work);
+	struct dentry *dentry;
+
+	spin_lock(&cfid->fid_lock);
+	dentry = cfid->dentry;
+	cfid->dentry = NULL;
+	spin_unlock(&cfid->fid_lock);
+
+	dput(dentry);
+	queue_work(serverclose_wq, &cfid->close_work);
 }
 
 int cached_dir_lease_break(struct cifs_tcon *tcon, __u8 lease_key[16])
@@ -558,6 +602,7 @@
 		    !memcmp(lease_key,
 			    cfid->fid.lease_key,
 			    SMB2_LEASE_KEY_SIZE)) {
+			cfid->has_lease = false;
 			cfid->time = 0;
 			/*
 			 * We found a lease remove it from the list
@@ -567,8 +612,10 @@
 			cfid->on_list = false;
 			cfids->num_entries--;
 
-			queue_work(cifsiod_wq,
-				   &cfid->lease_break);
+			++tcon->tc_count;
+			trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+					    netfs_trace_tcon_ref_get_cached_lease_break);
+			queue_work(cfid_put_wq, &cfid->put_work);
 			spin_unlock(&cfids->cfid_list_lock);
 			return true;
 		}
@@ -590,7 +637,8 @@
 		return NULL;
 	}
 
-	INIT_WORK(&cfid->lease_break, smb2_cached_lease_break);
+	INIT_WORK(&cfid->close_work, cached_dir_offload_close);
+	INIT_WORK(&cfid->put_work, cached_dir_put_work);
 	INIT_LIST_HEAD(&cfid->entry);
 	INIT_LIST_HEAD(&cfid->dirents.entries);
 	mutex_init(&cfid->dirents.de_mutex);
@@ -603,6 +651,9 @@
 {
 	struct cached_dirent *dirent, *q;
 
+	WARN_ON(work_pending(&cfid->close_work));
+	WARN_ON(work_pending(&cfid->put_work));
+
 	dput(cfid->dentry);
 	cfid->dentry = NULL;
 
@@ -620,10 +671,30 @@
 	kfree(cfid);
 }
 
+static void cfids_invalidation_worker(struct work_struct *work)
+{
+	struct cached_fids *cfids = container_of(work, struct cached_fids,
+						 invalidation_work);
+	struct cached_fid *cfid, *q;
+	LIST_HEAD(entry);
+
+	spin_lock(&cfids->cfid_list_lock);
+	/* move cfids->dying to the local list */
+	list_cut_before(&entry, &cfids->dying, &cfids->dying);
+	spin_unlock(&cfids->cfid_list_lock);
+
+	list_for_each_entry_safe(cfid, q, &entry, entry) {
+		list_del(&cfid->entry);
+		/* Drop the ref-count acquired in invalidate_all_cached_dirs */
+		kref_put(&cfid->refcount, smb2_close_cached_fid);
+	}
+}
+
 static void cfids_laundromat_worker(struct work_struct *work)
 {
 	struct cached_fids *cfids;
 	struct cached_fid *cfid, *q;
+	struct dentry *dentry;
 	LIST_HEAD(entry);
 
 	cfids = container_of(work, struct cached_fids, laundromat_work.work);
@@ -635,33 +706,42 @@
 			cfid->on_list = false;
 			list_move(&cfid->entry, &entry);
 			cfids->num_entries--;
-			/* To prevent race with smb2_cached_lease_break() */
-			kref_get(&cfid->refcount);
+			if (cfid->has_lease) {
+				/*
+				 * Our lease has not yet been cancelled from the
+				 * server. Steal that reference.
+				 */
+				cfid->has_lease = false;
+			} else
+				kref_get(&cfid->refcount);
 		}
 	}
 	spin_unlock(&cfids->cfid_list_lock);
 
 	list_for_each_entry_safe(cfid, q, &entry, entry) {
 		list_del(&cfid->entry);
-		/*
-		 * Cancel and wait for the work to finish in case we are racing
-		 * with it.
-		 */
-		cancel_work_sync(&cfid->lease_break);
-		if (cfid->has_lease) {
+
+		spin_lock(&cfid->fid_lock);
+		dentry = cfid->dentry;
+		cfid->dentry = NULL;
+		spin_unlock(&cfid->fid_lock);
+
+		dput(dentry);
+		if (cfid->is_open) {
+			spin_lock(&cifs_tcp_ses_lock);
+			++cfid->tcon->tc_count;
+			trace_smb3_tcon_ref(cfid->tcon->debug_id, cfid->tcon->tc_count,
+					    netfs_trace_tcon_ref_get_cached_laundromat);
+			spin_unlock(&cifs_tcp_ses_lock);
+			queue_work(serverclose_wq, &cfid->close_work);
+		} else
 			/*
-			 * Our lease has not yet been cancelled from the server
-			 * so we need to drop the reference.
+			 * Drop the ref-count from above, either the lease-ref (if there
+			 * was one) or the extra one acquired.
 			 */
-			spin_lock(&cfids->cfid_list_lock);
-			cfid->has_lease = false;
-			spin_unlock(&cfids->cfid_list_lock);
 			kref_put(&cfid->refcount, smb2_close_cached_fid);
-		}
-		/* Drop the extra reference opened above */
-		kref_put(&cfid->refcount, smb2_close_cached_fid);
 	}
-	queue_delayed_work(cifsiod_wq, &cfids->laundromat_work,
+	queue_delayed_work(cfid_put_wq, &cfids->laundromat_work,
 			   dir_cache_timeout * HZ);
 }
 
@@ -674,9 +754,11 @@
 		return NULL;
 	spin_lock_init(&cfids->cfid_list_lock);
 	INIT_LIST_HEAD(&cfids->entries);
+	INIT_LIST_HEAD(&cfids->dying);
 
+	INIT_WORK(&cfids->invalidation_work, cfids_invalidation_worker);
 	INIT_DELAYED_WORK(&cfids->laundromat_work, cfids_laundromat_worker);
-	queue_delayed_work(cifsiod_wq, &cfids->laundromat_work,
+	queue_delayed_work(cfid_put_wq, &cfids->laundromat_work,
 			   dir_cache_timeout * HZ);
 
 	return cfids;
@@ -695,12 +777,18 @@
 		return;
 
 	cancel_delayed_work_sync(&cfids->laundromat_work);
+	cancel_work_sync(&cfids->invalidation_work);
 
 	spin_lock(&cfids->cfid_list_lock);
 	list_for_each_entry_safe(cfid, q, &cfids->entries, entry) {
 		cfid->on_list = false;
 		cfid->is_open = false;
 		list_move(&cfid->entry, &entry);
+	}
+	list_for_each_entry_safe(cfid, q, &cfids->dying, entry) {
+		cfid->on_list = false;
+		cfid->is_open = false;
+		list_move(&cfid->entry, &entry);
 	}
 	spin_unlock(&cfids->cfid_list_lock);
 
--- linux-qcom-6.8.0.orig/fs/smb/client/cached_dir.h
+++ linux-qcom-6.8.0/fs/smb/client/cached_dir.h
@@ -44,7 +44,8 @@
 	spinlock_t fid_lock;
 	struct cifs_tcon *tcon;
 	struct dentry *dentry;
-	struct work_struct lease_break;
+	struct work_struct put_work;
+	struct work_struct close_work;
 	struct smb2_file_all_info file_all_info;
 	struct cached_dirents dirents;
 };
@@ -53,10 +54,13 @@
 struct cached_fids {
 	/* Must be held when:
 	 * - accessing the cfids->entries list
+	 * - accessing the cfids->dying list
 	 */
 	spinlock_t cfid_list_lock;
 	int num_entries;
 	struct list_head entries;
+	struct list_head dying;
+	struct work_struct invalidation_work;
 	struct delayed_work laundromat_work;
 };
 
--- linux-qcom-6.8.0.orig/fs/smb/client/cifs_debug.c
+++ linux-qcom-6.8.0/fs/smb/client/cifs_debug.c
@@ -250,6 +250,8 @@
 	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
 		list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
+			if (cifs_ses_exiting(ses))
+				continue;
 			list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 				spin_lock(&tcon->open_file_lock);
 				list_for_each_entry(cfile, &tcon->openFileList, tlist) {
@@ -488,6 +490,8 @@
 				ses->ses_count, ses->serverOS, ses->serverNOS,
 				ses->capabilities, ses->ses_status);
 			}
+			if (ses->expired_pwd)
+				seq_puts(m, "password no longer valid ");
 			spin_unlock(&ses->ses_lock);
 
 			seq_printf(m, "\n\tSecurity type: %s ",
@@ -654,6 +658,8 @@
 			}
 #endif /* CONFIG_CIFS_STATS2 */
 			list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
+				if (cifs_ses_exiting(ses))
+					continue;
 				list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 					atomic_set(&tcon->num_smbs_sent, 0);
 					spin_lock(&tcon->stat_lock);
@@ -733,6 +739,8 @@
 			}
 #endif /* STATS2 */
 		list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
+			if (cifs_ses_exiting(ses))
+				continue;
 			list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 				i++;
 				seq_printf(m, "\n%d) %s", i, tcon->tree_name);
@@ -1044,7 +1052,7 @@
 static void
 cifs_security_flags_handle_must_flags(unsigned int *flags)
 {
-	unsigned int signflags = *flags & CIFSSEC_MUST_SIGN;
+	unsigned int signflags = *flags & (CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL);
 
 	if ((*flags & CIFSSEC_MUST_KRB5) == CIFSSEC_MUST_KRB5)
 		*flags = CIFSSEC_MUST_KRB5;
--- linux-qcom-6.8.0.orig/fs/smb/client/cifs_spnego.c
+++ linux-qcom-6.8.0/fs/smb/client/cifs_spnego.c
@@ -82,6 +82,9 @@
 /* strlen of ";pid=0x" */
 #define PID_KEY_LEN		7
 
+/* strlen of ";upcall_target=" */
+#define UPCALL_TARGET_KEY_LEN	15
+
 /* get a key struct with a SPNEGO security blob, suitable for session setup */
 struct key *
 cifs_get_spnego_key(struct cifs_ses *sesInfo,
@@ -108,6 +111,11 @@
 	if (sesInfo->user_name)
 		desc_len += USER_KEY_LEN + strlen(sesInfo->user_name);
 
+	if (sesInfo->upcall_target == UPTARGET_MOUNT)
+		desc_len += UPCALL_TARGET_KEY_LEN + 5; // strlen("mount")
+	else
+		desc_len += UPCALL_TARGET_KEY_LEN + 3; // strlen("app")
+
 	spnego_key = ERR_PTR(-ENOMEM);
 	description = kzalloc(desc_len, GFP_KERNEL);
 	if (description == NULL)
@@ -156,6 +164,14 @@
 	dp = description + strlen(description);
 	sprintf(dp, ";pid=0x%x", current->pid);
 
+	if (sesInfo->upcall_target == UPTARGET_MOUNT) {
+		dp = description + strlen(description);
+		sprintf(dp, ";upcall_target=mount");
+	} else {
+		dp = description + strlen(description);
+		sprintf(dp, ";upcall_target=app");
+	}
+
 	cifs_dbg(FYI, "key description = %s\n", description);
 	saved_cred = override_creds(spnego_cred);
 	spnego_key = request_key(&cifs_spnego_key_type, description, "");
--- linux-qcom-6.8.0.orig/fs/smb/client/cifs_unicode.c
+++ linux-qcom-6.8.0/fs/smb/client/cifs_unicode.c
@@ -484,10 +484,21 @@
 			/**
 			 * Remap spaces and periods found at the end of every
 			 * component of the path. The special cases of '.' and
-			 * '..' do not need to be dealt with explicitly because
-			 * they are addressed in namei.c:link_path_walk().
+			 * '..' are need to be handled because of symlinks.
+			 * They are treated as non-end-of-string to avoid
+			 * remapping and breaking symlinks pointing to . or ..
 			 **/
-			if ((i == srclen - 1) || (source[i+1] == '\\'))
+			if ((i == 0 || source[i-1] == '\\') &&
+			    source[i] == '.' &&
+			    (i == srclen-1 || source[i+1] == '\\'))
+				end_of_string = false; /* "." case */
+			else if (i >= 1 &&
+				 (i == 1 || source[i-2] == '\\') &&
+				 source[i-1] == '.' &&
+				 source[i] == '.' &&
+				 (i == srclen-1 || source[i+1] == '\\'))
+				end_of_string = false; /* ".." case */
+			else if ((i == srclen - 1) || (source[i+1] == '\\'))
 				end_of_string = true;
 			else
 				end_of_string = false;
--- linux-qcom-6.8.0.orig/fs/smb/client/cifsacl.c
+++ linux-qcom-6.8.0/fs/smb/client/cifsacl.c
@@ -27,18 +27,18 @@
 #include "cifs_unicode.h"
 
 /* security id for everyone/world system group */
-static const struct cifs_sid sid_everyone = {
+static const struct smb_sid sid_everyone = {
 	1, 1, {0, 0, 0, 0, 0, 1}, {0} };
 /* security id for Authenticated Users system group */
-static const struct cifs_sid sid_authusers = {
+static const struct smb_sid sid_authusers = {
 	1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11)} };
 
 /* S-1-22-1 Unmapped Unix users */
-static const struct cifs_sid sid_unix_users = {1, 1, {0, 0, 0, 0, 0, 22},
+static const struct smb_sid sid_unix_users = {1, 1, {0, 0, 0, 0, 0, 22},
 		{cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
 
 /* S-1-22-2 Unmapped Unix groups */
-static const struct cifs_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22},
+static const struct smb_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22},
 		{cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
 
 /*
@@ -48,17 +48,17 @@
 /* S-1-5-88 MS NFS and Apple style UID/GID/mode */
 
 /* S-1-5-88-1 Unix uid */
-static const struct cifs_sid sid_unix_NFS_users = { 1, 2, {0, 0, 0, 0, 0, 5},
+static const struct smb_sid sid_unix_NFS_users = { 1, 2, {0, 0, 0, 0, 0, 5},
 	{cpu_to_le32(88),
 	 cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
 
 /* S-1-5-88-2 Unix gid */
-static const struct cifs_sid sid_unix_NFS_groups = { 1, 2, {0, 0, 0, 0, 0, 5},
+static const struct smb_sid sid_unix_NFS_groups = { 1, 2, {0, 0, 0, 0, 0, 5},
 	{cpu_to_le32(88),
 	 cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
 
 /* S-1-5-88-3 Unix mode */
-static const struct cifs_sid sid_unix_NFS_mode = { 1, 2, {0, 0, 0, 0, 0, 5},
+static const struct smb_sid sid_unix_NFS_mode = { 1, 2, {0, 0, 0, 0, 0, 5},
 	{cpu_to_le32(88),
 	 cpu_to_le32(3), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
 
@@ -106,7 +106,7 @@
 };
 
 static char *
-sid_to_key_str(struct cifs_sid *sidptr, unsigned int type)
+sid_to_key_str(struct smb_sid *sidptr, unsigned int type)
 {
 	int i, len;
 	unsigned int saval;
@@ -158,7 +158,7 @@
  * the same returns zero, if they do not match returns non-zero.
  */
 static int
-compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
+compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid)
 {
 	int i;
 	int num_subauth, num_sat, num_saw;
@@ -204,11 +204,11 @@
 }
 
 static bool
-is_well_known_sid(const struct cifs_sid *psid, uint32_t *puid, bool is_group)
+is_well_known_sid(const struct smb_sid *psid, uint32_t *puid, bool is_group)
 {
 	int i;
 	int num_subauth;
-	const struct cifs_sid *pwell_known_sid;
+	const struct smb_sid *pwell_known_sid;
 
 	if (!psid || (puid == NULL))
 		return false;
@@ -260,7 +260,7 @@
 }
 
 static __u16
-cifs_copy_sid(struct cifs_sid *dst, const struct cifs_sid *src)
+cifs_copy_sid(struct smb_sid *dst, const struct smb_sid *src)
 {
 	int i;
 	__u16 size = 1 + 1 + 6;
@@ -277,11 +277,11 @@
 }
 
 static int
-id_to_sid(unsigned int cid, uint sidtype, struct cifs_sid *ssid)
+id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid)
 {
 	int rc;
 	struct key *sidkey;
-	struct cifs_sid *ksid;
+	struct smb_sid *ksid;
 	unsigned int ksid_size;
 	char desc[3 + 10 + 1]; /* 3 byte prefix + 10 bytes for value + NULL */
 	const struct cred *saved_cred;
@@ -312,8 +312,8 @@
 	 * it could be.
 	 */
 	ksid = sidkey->datalen <= sizeof(sidkey->payload) ?
-		(struct cifs_sid *)&sidkey->payload :
-		(struct cifs_sid *)sidkey->payload.data[0];
+		(struct smb_sid *)&sidkey->payload :
+		(struct smb_sid *)sidkey->payload.data[0];
 
 	ksid_size = CIFS_SID_BASE_SIZE + (ksid->num_subauth * sizeof(__le32));
 	if (ksid_size > sidkey->datalen) {
@@ -336,7 +336,7 @@
 }
 
 int
-sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid,
+sid_to_id(struct cifs_sb_info *cifs_sb, struct smb_sid *psid,
 		struct cifs_fattr *fattr, uint sidtype)
 {
 	int rc = 0;
@@ -515,43 +515,43 @@
 }
 
 /* copy ntsd, owner sid, and group sid from a security descriptor to another */
-static __u32 copy_sec_desc(const struct cifs_ntsd *pntsd,
-				struct cifs_ntsd *pnntsd,
+static __u32 copy_sec_desc(const struct smb_ntsd *pntsd,
+				struct smb_ntsd *pnntsd,
 				__u32 sidsoffset,
-				struct cifs_sid *pownersid,
-				struct cifs_sid *pgrpsid)
+				struct smb_sid *pownersid,
+				struct smb_sid *pgrpsid)
 {
-	struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
-	struct cifs_sid *nowner_sid_ptr, *ngroup_sid_ptr;
+	struct smb_sid *owner_sid_ptr, *group_sid_ptr;
+	struct smb_sid *nowner_sid_ptr, *ngroup_sid_ptr;
 
 	/* copy security descriptor control portion */
 	pnntsd->revision = pntsd->revision;
 	pnntsd->type = pntsd->type;
-	pnntsd->dacloffset = cpu_to_le32(sizeof(struct cifs_ntsd));
+	pnntsd->dacloffset = cpu_to_le32(sizeof(struct smb_ntsd));
 	pnntsd->sacloffset = 0;
 	pnntsd->osidoffset = cpu_to_le32(sidsoffset);
-	pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct cifs_sid));
+	pnntsd->gsidoffset = cpu_to_le32(sidsoffset + sizeof(struct smb_sid));
 
 	/* copy owner sid */
 	if (pownersid)
 		owner_sid_ptr = pownersid;
 	else
-		owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
+		owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
 				le32_to_cpu(pntsd->osidoffset));
-	nowner_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset);
+	nowner_sid_ptr = (struct smb_sid *)((char *)pnntsd + sidsoffset);
 	cifs_copy_sid(nowner_sid_ptr, owner_sid_ptr);
 
 	/* copy group sid */
 	if (pgrpsid)
 		group_sid_ptr = pgrpsid;
 	else
-		group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
+		group_sid_ptr = (struct smb_sid *)((char *)pntsd +
 				le32_to_cpu(pntsd->gsidoffset));
-	ngroup_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset +
-					sizeof(struct cifs_sid));
+	ngroup_sid_ptr = (struct smb_sid *)((char *)pnntsd + sidsoffset +
+					sizeof(struct smb_sid));
 	cifs_copy_sid(ngroup_sid_ptr, group_sid_ptr);
 
-	return sidsoffset + (2 * sizeof(struct cifs_sid));
+	return sidsoffset + (2 * sizeof(struct smb_sid));
 }
 
 
@@ -666,7 +666,7 @@
 	return;
 }
 
-static __u16 cifs_copy_ace(struct cifs_ace *dst, struct cifs_ace *src, struct cifs_sid *psid)
+static __u16 cifs_copy_ace(struct smb_ace *dst, struct smb_ace *src, struct smb_sid *psid)
 {
 	__u16 size = 1 + 1 + 2 + 4;
 
@@ -685,8 +685,8 @@
 	return size;
 }
 
-static __u16 fill_ace_for_sid(struct cifs_ace *pntace,
-			const struct cifs_sid *psid, __u64 nmode,
+static __u16 fill_ace_for_sid(struct smb_ace *pntace,
+			const struct smb_sid *psid, __u64 nmode,
 			umode_t bits, __u8 access_type,
 			bool allow_delete_child)
 {
@@ -723,7 +723,7 @@
 
 
 #ifdef CONFIG_CIFS_DEBUG2
-static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
+static void dump_ace(struct smb_ace *pace, char *end_of_acl)
 {
 	int num_subauth;
 
@@ -758,15 +758,15 @@
 }
 #endif
 
-static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
-		       struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
+static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl,
+		       struct smb_sid *pownersid, struct smb_sid *pgrpsid,
 		       struct cifs_fattr *fattr, bool mode_from_special_sid)
 {
 	int i;
 	int num_aces = 0;
 	int acl_size;
 	char *acl_base;
-	struct cifs_ace **ppace;
+	struct smb_ace **ppace;
 
 	/* BB need to add parm so we can store the SID BB */
 
@@ -793,21 +793,21 @@
 	fattr->cf_mode &= ~(0777);
 
 	acl_base = (char *)pdacl;
-	acl_size = sizeof(struct cifs_acl);
+	acl_size = sizeof(struct smb_acl);
 
 	num_aces = le32_to_cpu(pdacl->num_aces);
 	if (num_aces > 0) {
 		umode_t denied_mode = 0;
 
-		if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *))
+		if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))
 			return;
-		ppace = kmalloc_array(num_aces, sizeof(struct cifs_ace *),
+		ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *),
 				      GFP_KERNEL);
 		if (!ppace)
 			return;
 
 		for (i = 0; i < num_aces; ++i) {
-			ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
+			ppace[i] = (struct smb_ace *) (acl_base + acl_size);
 #ifdef CONFIG_CIFS_DEBUG2
 			dump_ace(ppace[i], end_of_acl);
 #endif
@@ -849,7 +849,7 @@
 
 /*			memcpy((void *)(&(cifscred->aces[i])),
 				(void *)ppace[i],
-				sizeof(struct cifs_ace)); */
+				sizeof(struct smb_ace)); */
 
 			acl_base = (char *)ppace[i];
 			acl_size = le16_to_cpu(ppace[i]->size);
@@ -861,7 +861,7 @@
 	return;
 }
 
-unsigned int setup_authusers_ACE(struct cifs_ace *pntace)
+unsigned int setup_authusers_ACE(struct smb_ace *pntace)
 {
 	int i;
 	unsigned int ace_size = 20;
@@ -885,12 +885,17 @@
  * Fill in the special SID based on the mode. See
  * https://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx
  */
-unsigned int setup_special_mode_ACE(struct cifs_ace *pntace, __u64 nmode)
+unsigned int setup_special_mode_ACE(struct smb_ace *pntace,
+				    bool posix,
+				    __u64 nmode)
 {
 	int i;
 	unsigned int ace_size = 28;
 
-	pntace->type = ACCESS_DENIED_ACE_TYPE;
+	if (posix)
+		pntace->type = ACCESS_ALLOWED_ACE_TYPE;
+	else
+		pntace->type = ACCESS_DENIED_ACE_TYPE;
 	pntace->flags = 0x0;
 	pntace->access_req = 0;
 	pntace->sid.num_subauth = 3;
@@ -907,7 +912,7 @@
 	return ace_size;
 }
 
-unsigned int setup_special_user_owner_ACE(struct cifs_ace *pntace)
+unsigned int setup_special_user_owner_ACE(struct smb_ace *pntace)
 {
 	int i;
 	unsigned int ace_size = 28;
@@ -930,10 +935,11 @@
 }
 
 static void populate_new_aces(char *nacl_base,
-		struct cifs_sid *pownersid,
-		struct cifs_sid *pgrpsid,
+		struct smb_sid *pownersid,
+		struct smb_sid *pgrpsid,
 		__u64 *pnmode, u32 *pnum_aces, u16 *pnsize,
-		bool modefromsid)
+		bool modefromsid,
+		bool posix)
 {
 	__u64 nmode;
 	u32 num_aces = 0;
@@ -944,19 +950,21 @@
 	__u64 deny_user_mode = 0;
 	__u64 deny_group_mode = 0;
 	bool sticky_set = false;
-	struct cifs_ace *pnntace = NULL;
+	struct smb_ace *pnntace = NULL;
 
 	nmode = *pnmode;
 	num_aces = *pnum_aces;
 	nsize = *pnsize;
 
-	if (modefromsid) {
-		pnntace = (struct cifs_ace *) (nacl_base + nsize);
-		nsize += setup_special_mode_ACE(pnntace, nmode);
-		num_aces++;
-		pnntace = (struct cifs_ace *) (nacl_base + nsize);
-		nsize += setup_authusers_ACE(pnntace);
+	if (modefromsid || posix) {
+		pnntace = (struct smb_ace *) (nacl_base + nsize);
+		nsize += setup_special_mode_ACE(pnntace, posix, nmode);
 		num_aces++;
+		if (modefromsid) {
+			pnntace = (struct smb_ace *) (nacl_base + nsize);
+			nsize += setup_authusers_ACE(pnntace);
+			num_aces++;
+		}
 		goto set_size;
 	}
 
@@ -967,7 +975,7 @@
 	 * updated in the inode.
 	 */
 
-	if (!memcmp(pownersid, pgrpsid, sizeof(struct cifs_sid))) {
+	if (!memcmp(pownersid, pgrpsid, sizeof(struct smb_sid))) {
 		/*
 		 * Case when owner and group SIDs are the same.
 		 * Set the more restrictive of the two modes.
@@ -992,7 +1000,7 @@
 		sticky_set = true;
 
 	if (deny_user_mode) {
-		pnntace = (struct cifs_ace *) (nacl_base + nsize);
+		pnntace = (struct smb_ace *) (nacl_base + nsize);
 		nsize += fill_ace_for_sid(pnntace, pownersid, deny_user_mode,
 				0700, ACCESS_DENIED, false);
 		num_aces++;
@@ -1000,31 +1008,31 @@
 
 	/* Group DENY ACE does not conflict with owner ALLOW ACE. Keep in preferred order*/
 	if (deny_group_mode && !(deny_group_mode & (user_mode >> 3))) {
-		pnntace = (struct cifs_ace *) (nacl_base + nsize);
+		pnntace = (struct smb_ace *) (nacl_base + nsize);
 		nsize += fill_ace_for_sid(pnntace, pgrpsid, deny_group_mode,
 				0070, ACCESS_DENIED, false);
 		num_aces++;
 	}
 
-	pnntace = (struct cifs_ace *) (nacl_base + nsize);
+	pnntace = (struct smb_ace *) (nacl_base + nsize);
 	nsize += fill_ace_for_sid(pnntace, pownersid, user_mode,
 			0700, ACCESS_ALLOWED, true);
 	num_aces++;
 
 	/* Group DENY ACE conflicts with owner ALLOW ACE. So keep it after. */
 	if (deny_group_mode && (deny_group_mode & (user_mode >> 3))) {
-		pnntace = (struct cifs_ace *) (nacl_base + nsize);
+		pnntace = (struct smb_ace *) (nacl_base + nsize);
 		nsize += fill_ace_for_sid(pnntace, pgrpsid, deny_group_mode,
 				0070, ACCESS_DENIED, false);
 		num_aces++;
 	}
 
-	pnntace = (struct cifs_ace *) (nacl_base + nsize);
+	pnntace = (struct smb_ace *) (nacl_base + nsize);
 	nsize += fill_ace_for_sid(pnntace, pgrpsid, group_mode,
 			0070, ACCESS_ALLOWED, !sticky_set);
 	num_aces++;
 
-	pnntace = (struct cifs_ace *) (nacl_base + nsize);
+	pnntace = (struct smb_ace *) (nacl_base + nsize);
 	nsize += fill_ace_for_sid(pnntace, &sid_everyone, other_mode,
 			0007, ACCESS_ALLOWED, !sticky_set);
 	num_aces++;
@@ -1034,31 +1042,31 @@
 	*pnsize = nsize;
 }
 
-static __u16 replace_sids_and_copy_aces(struct cifs_acl *pdacl, struct cifs_acl *pndacl,
-		struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
-		struct cifs_sid *pnownersid, struct cifs_sid *pngrpsid)
+static __u16 replace_sids_and_copy_aces(struct smb_acl *pdacl, struct smb_acl *pndacl,
+		struct smb_sid *pownersid, struct smb_sid *pgrpsid,
+		struct smb_sid *pnownersid, struct smb_sid *pngrpsid)
 {
 	int i;
 	u16 size = 0;
-	struct cifs_ace *pntace = NULL;
+	struct smb_ace *pntace = NULL;
 	char *acl_base = NULL;
 	u32 src_num_aces = 0;
 	u16 nsize = 0;
-	struct cifs_ace *pnntace = NULL;
+	struct smb_ace *pnntace = NULL;
 	char *nacl_base = NULL;
 	u16 ace_size = 0;
 
 	acl_base = (char *)pdacl;
-	size = sizeof(struct cifs_acl);
+	size = sizeof(struct smb_acl);
 	src_num_aces = le32_to_cpu(pdacl->num_aces);
 
 	nacl_base = (char *)pndacl;
-	nsize = sizeof(struct cifs_acl);
+	nsize = sizeof(struct smb_acl);
 
 	/* Go through all the ACEs */
 	for (i = 0; i < src_num_aces; ++i) {
-		pntace = (struct cifs_ace *) (acl_base + size);
-		pnntace = (struct cifs_ace *) (nacl_base + nsize);
+		pntace = (struct smb_ace *) (acl_base + size);
+		pnntace = (struct smb_ace *) (nacl_base + nsize);
 
 		if (pnownersid && compare_sids(&pntace->sid, pownersid) == 0)
 			ace_size = cifs_copy_ace(pnntace, pntace, pnownersid);
@@ -1074,48 +1082,48 @@
 	return nsize;
 }
 
-static int set_chmod_dacl(struct cifs_acl *pdacl, struct cifs_acl *pndacl,
-		struct cifs_sid *pownersid,	struct cifs_sid *pgrpsid,
-		__u64 *pnmode, bool mode_from_sid)
+static int set_chmod_dacl(struct smb_acl *pdacl, struct smb_acl *pndacl,
+		struct smb_sid *pownersid,	struct smb_sid *pgrpsid,
+		__u64 *pnmode, bool mode_from_sid, bool posix)
 {
 	int i;
 	u16 size = 0;
-	struct cifs_ace *pntace = NULL;
+	struct smb_ace *pntace = NULL;
 	char *acl_base = NULL;
 	u32 src_num_aces = 0;
 	u16 nsize = 0;
-	struct cifs_ace *pnntace = NULL;
+	struct smb_ace *pnntace = NULL;
 	char *nacl_base = NULL;
 	u32 num_aces = 0;
 	bool new_aces_set = false;
 
 	/* Assuming that pndacl and pnmode are never NULL */
 	nacl_base = (char *)pndacl;
-	nsize = sizeof(struct cifs_acl);
+	nsize = sizeof(struct smb_acl);
 
 	/* If pdacl is NULL, we don't have a src. Simply populate new ACL. */
-	if (!pdacl) {
+	if (!pdacl || posix) {
 		populate_new_aces(nacl_base,
 				pownersid, pgrpsid,
 				pnmode, &num_aces, &nsize,
-				mode_from_sid);
+				mode_from_sid, posix);
 		goto finalize_dacl;
 	}
 
 	acl_base = (char *)pdacl;
-	size = sizeof(struct cifs_acl);
+	size = sizeof(struct smb_acl);
 	src_num_aces = le32_to_cpu(pdacl->num_aces);
 
 	/* Retain old ACEs which we can retain */
 	for (i = 0; i < src_num_aces; ++i) {
-		pntace = (struct cifs_ace *) (acl_base + size);
+		pntace = (struct smb_ace *) (acl_base + size);
 
 		if (!new_aces_set && (pntace->flags & INHERITED_ACE)) {
 			/* Place the new ACEs in between existing explicit and inherited */
 			populate_new_aces(nacl_base,
 					pownersid, pgrpsid,
 					pnmode, &num_aces, &nsize,
-					mode_from_sid);
+					mode_from_sid, posix);
 
 			new_aces_set = true;
 		}
@@ -1130,7 +1138,7 @@
 		}
 
 		/* update the pointer to the next ACE to populate*/
-		pnntace = (struct cifs_ace *) (nacl_base + nsize);
+		pnntace = (struct smb_ace *) (nacl_base + nsize);
 
 		nsize += cifs_copy_ace(pnntace, pntace, NULL);
 		num_aces++;
@@ -1144,7 +1152,7 @@
 		populate_new_aces(nacl_base,
 				pownersid, pgrpsid,
 				pnmode, &num_aces, &nsize,
-				mode_from_sid);
+				mode_from_sid, posix);
 
 		new_aces_set = true;
 	}
@@ -1156,7 +1164,7 @@
 	return 0;
 }
 
-static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
+static int parse_sid(struct smb_sid *psid, char *end_of_acl)
 {
 	/* BB need to add parm so we can store the SID BB */
 
@@ -1191,24 +1199,24 @@
 
 /* Convert CIFS ACL to POSIX form */
 static int parse_sec_desc(struct cifs_sb_info *cifs_sb,
-		struct cifs_ntsd *pntsd, int acl_len, struct cifs_fattr *fattr,
+		struct smb_ntsd *pntsd, int acl_len, struct cifs_fattr *fattr,
 		bool get_mode_from_special_sid)
 {
 	int rc = 0;
-	struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
-	struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
+	struct smb_sid *owner_sid_ptr, *group_sid_ptr;
+	struct smb_acl *dacl_ptr; /* no need for SACL ptr */
 	char *end_of_acl = ((char *)pntsd) + acl_len;
 	__u32 dacloffset;
 
 	if (pntsd == NULL)
 		return -EIO;
 
-	owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
+	owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
 				le32_to_cpu(pntsd->osidoffset));
-	group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
+	group_sid_ptr = (struct smb_sid *)((char *)pntsd +
 				le32_to_cpu(pntsd->gsidoffset));
 	dacloffset = le32_to_cpu(pntsd->dacloffset);
-	dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
+	dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
 	cifs_dbg(NOISY, "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n",
 		 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
 		 le32_to_cpu(pntsd->gsidoffset),
@@ -1249,38 +1257,38 @@
 }
 
 /* Convert permission bits from mode to equivalent CIFS ACL */
-static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
+static int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd,
 	__u32 secdesclen, __u32 *pnsecdesclen, __u64 *pnmode, kuid_t uid, kgid_t gid,
-	bool mode_from_sid, bool id_from_sid, int *aclflag)
+	bool mode_from_sid, bool id_from_sid, bool posix, int *aclflag)
 {
 	int rc = 0;
 	__u32 dacloffset;
 	__u32 ndacloffset;
 	__u32 sidsoffset;
-	struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
-	struct cifs_sid *nowner_sid_ptr = NULL, *ngroup_sid_ptr = NULL;
-	struct cifs_acl *dacl_ptr = NULL;  /* no need for SACL ptr */
-	struct cifs_acl *ndacl_ptr = NULL; /* no need for SACL ptr */
+	struct smb_sid *owner_sid_ptr, *group_sid_ptr;
+	struct smb_sid *nowner_sid_ptr = NULL, *ngroup_sid_ptr = NULL;
+	struct smb_acl *dacl_ptr = NULL;  /* no need for SACL ptr */
+	struct smb_acl *ndacl_ptr = NULL; /* no need for SACL ptr */
 	char *end_of_acl = ((char *)pntsd) + secdesclen;
 	u16 size = 0;
 
 	dacloffset = le32_to_cpu(pntsd->dacloffset);
 	if (dacloffset) {
-		dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
+		dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
 		if (end_of_acl < (char *)dacl_ptr + le16_to_cpu(dacl_ptr->size)) {
 			cifs_dbg(VFS, "Server returned illegal ACL size\n");
 			return -EINVAL;
 		}
 	}
 
-	owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
+	owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
 			le32_to_cpu(pntsd->osidoffset));
-	group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
+	group_sid_ptr = (struct smb_sid *)((char *)pntsd +
 			le32_to_cpu(pntsd->gsidoffset));
 
 	if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */
-		ndacloffset = sizeof(struct cifs_ntsd);
-		ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset);
+		ndacloffset = sizeof(struct smb_ntsd);
+		ndacl_ptr = (struct smb_acl *)((char *)pnntsd + ndacloffset);
 		ndacl_ptr->revision =
 			dacloffset ? dacl_ptr->revision : cpu_to_le16(ACL_REVISION);
 
@@ -1288,7 +1296,7 @@
 		ndacl_ptr->num_aces = cpu_to_le32(0);
 
 		rc = set_chmod_dacl(dacl_ptr, ndacl_ptr, owner_sid_ptr, group_sid_ptr,
-				    pnmode, mode_from_sid);
+				    pnmode, mode_from_sid, posix);
 
 		sidsoffset = ndacloffset + le16_to_cpu(ndacl_ptr->size);
 		/* copy the non-dacl portion of secdesc */
@@ -1297,15 +1305,15 @@
 
 		*aclflag |= CIFS_ACL_DACL;
 	} else {
-		ndacloffset = sizeof(struct cifs_ntsd);
-		ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset);
+		ndacloffset = sizeof(struct smb_ntsd);
+		ndacl_ptr = (struct smb_acl *)((char *)pnntsd + ndacloffset);
 		ndacl_ptr->revision =
 			dacloffset ? dacl_ptr->revision : cpu_to_le16(ACL_REVISION);
 		ndacl_ptr->num_aces = dacl_ptr ? dacl_ptr->num_aces : 0;
 
 		if (uid_valid(uid)) { /* chown */
 			uid_t id;
-			nowner_sid_ptr = kzalloc(sizeof(struct cifs_sid),
+			nowner_sid_ptr = kzalloc(sizeof(struct smb_sid),
 								GFP_KERNEL);
 			if (!nowner_sid_ptr) {
 				rc = -ENOMEM;
@@ -1334,7 +1342,7 @@
 		}
 		if (gid_valid(gid)) { /* chgrp */
 			gid_t id;
-			ngroup_sid_ptr = kzalloc(sizeof(struct cifs_sid),
+			ngroup_sid_ptr = kzalloc(sizeof(struct smb_sid),
 								GFP_KERNEL);
 			if (!ngroup_sid_ptr) {
 				rc = -ENOMEM;
@@ -1385,11 +1393,11 @@
 }
 
 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
-struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
+struct smb_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
 				      const struct cifs_fid *cifsfid, u32 *pacllen,
 				      u32 __maybe_unused unused)
 {
-	struct cifs_ntsd *pntsd = NULL;
+	struct smb_ntsd *pntsd = NULL;
 	unsigned int xid;
 	int rc;
 	struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
@@ -1410,10 +1418,10 @@
 	return pntsd;
 }
 
-static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
+static struct smb_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
 		const char *path, u32 *pacllen)
 {
-	struct cifs_ntsd *pntsd = NULL;
+	struct smb_ntsd *pntsd = NULL;
 	int oplock = 0;
 	unsigned int xid;
 	int rc;
@@ -1454,11 +1462,11 @@
 }
 
 /* Retrieve an ACL from the server */
-struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
+struct smb_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
 				      struct inode *inode, const char *path,
 			       u32 *pacllen, u32 info)
 {
-	struct cifs_ntsd *pntsd = NULL;
+	struct smb_ntsd *pntsd = NULL;
 	struct cifsFileInfo *open_file = NULL;
 
 	if (inode)
@@ -1472,7 +1480,7 @@
 }
 
  /* Set an ACL on the server */
-int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
+int set_cifs_acl(struct smb_ntsd *pnntsd, __u32 acllen,
 			struct inode *inode, const char *path, int aclflag)
 {
 	int oplock = 0;
@@ -1528,7 +1536,7 @@
 		  struct inode *inode, bool mode_from_special_sid,
 		  const char *path, const struct cifs_fid *pfid)
 {
-	struct cifs_ntsd *pntsd = NULL;
+	struct smb_ntsd *pntsd = NULL;
 	u32 acllen = 0;
 	int rc = 0;
 	struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
@@ -1580,13 +1588,14 @@
 	__u32 secdesclen = 0;
 	__u32 nsecdesclen = 0;
 	__u32 dacloffset = 0;
-	struct cifs_acl *dacl_ptr = NULL;
-	struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */
-	struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
+	struct smb_acl *dacl_ptr = NULL;
+	struct smb_ntsd *pntsd = NULL; /* acl obtained from server */
+	struct smb_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
 	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
 	struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
 	struct smb_version_operations *ops;
 	bool mode_from_sid, id_from_sid;
+	bool posix = tlink_tcon(tlink)->posix_extensions;
 	const u32 info = 0;
 
 	if (IS_ERR(tlink))
@@ -1622,21 +1631,22 @@
 		id_from_sid = false;
 
 	/* Potentially, five new ACEs can be added to the ACL for U,G,O mapping */
-	nsecdesclen = secdesclen;
 	if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */
-		if (mode_from_sid)
-			nsecdesclen += 2 * sizeof(struct cifs_ace);
+		if (posix)
+			nsecdesclen = 1 * sizeof(struct smb_ace);
+		else if (mode_from_sid)
+			nsecdesclen = secdesclen + (2 * sizeof(struct smb_ace));
 		else /* cifsacl */
-			nsecdesclen += 5 * sizeof(struct cifs_ace);
+			nsecdesclen = secdesclen + (5 * sizeof(struct smb_ace));
 	} else { /* chown */
 		/* When ownership changes, changes new owner sid length could be different */
-		nsecdesclen = sizeof(struct cifs_ntsd) + (sizeof(struct cifs_sid) * 2);
+		nsecdesclen = sizeof(struct smb_ntsd) + (sizeof(struct smb_sid) * 2);
 		dacloffset = le32_to_cpu(pntsd->dacloffset);
 		if (dacloffset) {
-			dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
+			dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
 			if (mode_from_sid)
 				nsecdesclen +=
-					le32_to_cpu(dacl_ptr->num_aces) * sizeof(struct cifs_ace);
+					le32_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace);
 			else /* cifsacl */
 				nsecdesclen += le16_to_cpu(dacl_ptr->size);
 		}
@@ -1657,7 +1667,7 @@
 	}
 
 	rc = build_sec_desc(pntsd, pnntsd, secdesclen, &nsecdesclen, pnmode, uid, gid,
-			    mode_from_sid, id_from_sid, &aclflag);
+			    mode_from_sid, id_from_sid, posix, &aclflag);
 
 	cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc);
 
--- linux-qcom-6.8.0.orig/fs/smb/client/cifsacl.h
+++ linux-qcom-6.8.0/fs/smb/client/cifsacl.h
@@ -33,9 +33,9 @@
  * Security Descriptor length containing DACL with 3 ACEs (one each for
  * owner, group and world).
  */
-#define DEFAULT_SEC_DESC_LEN (sizeof(struct cifs_ntsd) + \
-			      sizeof(struct cifs_acl) + \
-			      (sizeof(struct cifs_ace) * 4))
+#define DEFAULT_SEC_DESC_LEN (sizeof(struct smb_ntsd) + \
+			      sizeof(struct smb_acl) + \
+			      (sizeof(struct smb_ace) * 4))
 
 /*
  * Maximum size of a string representation of a SID:
@@ -55,7 +55,7 @@
 #define SID_STRING_BASE_SIZE (2 + 3 + 15 + 1)
 #define SID_STRING_SUBAUTH_SIZE (11) /* size of a single subauth string */
 
-struct cifs_ntsd {
+struct smb_ntsd {
 	__le16 revision; /* revision level */
 	__le16 type;
 	__le32 osidoffset;
@@ -64,17 +64,17 @@
 	__le32 dacloffset;
 } __attribute__((packed));
 
-struct cifs_sid {
+struct smb_sid {
 	__u8 revision; /* revision level */
 	__u8 num_subauth;
 	__u8 authority[NUM_AUTHS];
 	__le32 sub_auth[SID_MAX_SUB_AUTHORITIES]; /* sub_auth[num_subauth] */
 } __attribute__((packed));
 
-/* size of a struct cifs_sid, sans sub_auth array */
+/* size of a struct smb_sid, sans sub_auth array */
 #define CIFS_SID_BASE_SIZE (1 + 1 + NUM_AUTHS)
 
-struct cifs_acl {
+struct smb_acl {
 	__le16 revision; /* revision level */
 	__le16 size;
 	__le32 num_aces;
@@ -111,12 +111,12 @@
 #define SUCCESSFUL_ACCESS_ACE_FLAG 0x40
 #define FAILED_ACCESS_ACE_FLAG	0x80
 
-struct cifs_ace {
+struct smb_ace {
 	__u8 type; /* see above and MS-DTYP 2.4.4.1 */
 	__u8 flags;
 	__le16 size;
 	__le32 access_req;
-	struct cifs_sid sid; /* ie UUID of user or group who gets these perms */
+	struct smb_sid sid; /* ie UUID of user or group who gets these perms */
 } __attribute__((packed));
 
 /*
@@ -194,6 +194,6 @@
  * Minimum security descriptor can be one without any SACL and DACL and can
  * consist of revision, type, and two sids of minimum size for owner and group
  */
-#define MIN_SEC_DESC_LEN  (sizeof(struct cifs_ntsd) + (2 * MIN_SID_LEN))
+#define MIN_SEC_DESC_LEN  (sizeof(struct smb_ntsd) + (2 * MIN_SID_LEN))
 
 #endif /* _CIFSACL_H */
--- linux-qcom-6.8.0.orig/fs/smb/client/cifsencrypt.c
+++ linux-qcom-6.8.0/fs/smb/client/cifsencrypt.c
@@ -129,7 +129,7 @@
 			for (j = foffset / PAGE_SIZE; j < npages; j++) {
 				len = min_t(size_t, maxsize, PAGE_SIZE - offset);
 				p = kmap_local_page(folio_page(folio, j));
-				ret = crypto_shash_update(shash, p, len);
+				ret = crypto_shash_update(shash, p + offset, len);
 				kunmap_local(p);
 				if (ret < 0)
 					return ret;
--- linux-qcom-6.8.0.orig/fs/smb/client/cifsfs.c
+++ linux-qcom-6.8.0/fs/smb/client/cifsfs.c
@@ -134,7 +134,7 @@
 MODULE_PARM_DESC(enable_oplocks, "Enable or disable oplocks. Default: y/Y/1");
 
 module_param(enable_gcm_256, bool, 0644);
-MODULE_PARM_DESC(enable_gcm_256, "Enable requesting strongest (256 bit) GCM encryption. Default: n/N/0");
+MODULE_PARM_DESC(enable_gcm_256, "Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/0");
 
 module_param(require_gcm_256, bool, 0644);
 MODULE_PARM_DESC(require_gcm_256, "Require strongest (256 bit) GCM encryption. Default: n/N/0");
@@ -160,6 +160,8 @@
 struct workqueue_struct	*fileinfo_put_wq;
 struct workqueue_struct	*cifsoplockd_wq;
 struct workqueue_struct	*deferredclose_wq;
+struct workqueue_struct	*serverclose_wq;
+struct workqueue_struct	*cfid_put_wq;
 __u32 cifs_lock_secret;
 
 /*
@@ -316,8 +318,17 @@
 	struct TCP_Server_Info *server = tcon->ses->server;
 	unsigned int xid;
 	int rc = 0;
+	const char *full_path;
+	void *page;
 
 	xid = get_xid();
+	page = alloc_dentry_path();
+
+	full_path = build_path_from_dentry(dentry, page);
+	if (IS_ERR(full_path)) {
+		rc = PTR_ERR(full_path);
+		goto statfs_out;
+	}
 
 	if (le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength) > 0)
 		buf->f_namelen =
@@ -333,8 +344,10 @@
 	buf->f_ffree = 0;	/* unlimited */
 
 	if (server->ops->queryfs)
-		rc = server->ops->queryfs(xid, tcon, cifs_sb, buf);
+		rc = server->ops->queryfs(xid, tcon, full_path, cifs_sb, buf);
 
+statfs_out:
+	free_dentry_path(page);
 	free_xid(xid);
 	return rc;
 }
@@ -392,6 +405,7 @@
 	 * server, can not assume caching of file data or metadata.
 	 */
 	cifs_set_oplock_level(cifs_inode, 0);
+	cifs_inode->lease_granted = false;
 	cifs_inode->flags = 0;
 	spin_lock_init(&cifs_inode->writers_lock);
 	cifs_inode->writers = 0;
@@ -532,6 +546,30 @@
 	return 0;
 }
 
+static void
+cifs_show_upcall_target(struct seq_file *s, struct cifs_sb_info *cifs_sb)
+{
+	if (cifs_sb->ctx->upcall_target == UPTARGET_UNSPECIFIED) {
+		seq_puts(s, ",upcall_target=app");
+		return;
+	}
+
+	seq_puts(s, ",upcall_target=");
+
+	switch (cifs_sb->ctx->upcall_target) {
+	case UPTARGET_APP:
+		seq_puts(s, "app");
+		break;
+	case UPTARGET_MOUNT:
+		seq_puts(s, "mount");
+		break;
+	default:
+		/* shouldn't ever happen */
+		seq_puts(s, "unknown");
+		break;
+	}
+}
+
 /*
  * cifs_show_options() is for displaying mount options in /proc/mounts.
  * Not all settable options are displayed but most of the important
@@ -548,6 +586,7 @@
 	seq_show_option(s, "vers", tcon->ses->server->vals->version_string);
 	cifs_show_security(s, tcon->ses);
 	cifs_show_cache_flavor(s, cifs_sb);
+	cifs_show_upcall_target(s, cifs_sb);
 
 	if (tcon->no_lease)
 		seq_puts(s, ",nolease");
@@ -740,6 +779,8 @@
 
 	spin_lock(&cifs_tcp_ses_lock);
 	spin_lock(&tcon->tc_lock);
+	trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+			    netfs_trace_tcon_ref_see_umount);
 	if ((tcon->tc_count > 1) || (tcon->status == TID_EXITING)) {
 		/* we have other mounts to same share or we have
 		   already tried to umount this and woken up
@@ -1278,7 +1319,7 @@
 	struct cifsFileInfo *smb_file_src = src_file->private_data;
 	struct cifsFileInfo *smb_file_target = dst_file->private_data;
 	struct cifs_tcon *target_tcon, *src_tcon;
-	unsigned long long destend, fstart, fend, new_size;
+	unsigned long long destend, fstart, fend, old_size, new_size;
 	unsigned int xid;
 	int rc;
 
@@ -1343,6 +1384,9 @@
 	rc = cifs_flush_folio(target_inode, destend, &fstart, &fend, false);
 	if (rc)
 		goto unlock;
+	if (fend > target_cifsi->netfs.zero_point)
+		target_cifsi->netfs.zero_point = fend + 1;
+	old_size = target_cifsi->netfs.remote_i_size;
 
 	/* Discard all the folios that overlap the destination region. */
 	cifs_dbg(FYI, "about to discard pages %llx-%llx\n", fstart, fend);
@@ -1355,12 +1399,13 @@
 	if (target_tcon->ses->server->ops->duplicate_extents) {
 		rc = target_tcon->ses->server->ops->duplicate_extents(xid,
 			smb_file_src, smb_file_target, off, len, destoff);
-		if (rc == 0 && new_size > i_size_read(target_inode)) {
+		if (rc == 0 && new_size > old_size) {
 			truncate_setsize(target_inode, new_size);
-			netfs_resize_file(&target_cifsi->netfs, new_size, true);
 			fscache_resize_cookie(cifs_inode_cookie(target_inode),
 					      new_size);
 		}
+		if (rc == 0 && new_size > target_cifsi->netfs.zero_point)
+			target_cifsi->netfs.zero_point = new_size;
 	}
 
 	/* force revalidate of size and timestamps of target file now
@@ -1388,7 +1433,6 @@
 	struct cifsFileInfo *smb_file_target;
 	struct cifs_tcon *src_tcon;
 	struct cifs_tcon *target_tcon;
-	unsigned long long destend, fstart, fend;
 	ssize_t rc;
 
 	cifs_dbg(FYI, "copychunk range\n");
@@ -1406,7 +1450,7 @@
 	target_tcon = tlink_tcon(smb_file_target->tlink);
 
 	if (src_tcon->ses != target_tcon->ses) {
-		cifs_dbg(VFS, "source and target of copy not on same server\n");
+		cifs_dbg(FYI, "source and target of copy not on same server\n");
 		goto out;
 	}
 
@@ -1438,23 +1482,13 @@
 			goto unlock;
 	}
 
-	destend = destoff + len - 1;
-
-	/* Flush the folios at either end of the destination range to prevent
-	 * accidental loss of dirty data outside of the range.
+	/* Flush and invalidate all the folios in the destination region.  If
+	 * the copy was successful, then some of the flush is extra overhead,
+	 * but we need to allow for the copy failing in some way (eg. ENOSPC).
 	 */
-	fstart = destoff;
-	fend = destend;
-
-	rc = cifs_flush_folio(target_inode, destoff, &fstart, &fend, true);
+	rc = filemap_invalidate_inode(target_inode, true, destoff, destoff + len - 1);
 	if (rc)
 		goto unlock;
-	rc = cifs_flush_folio(target_inode, destend, &fstart, &fend, false);
-	if (rc)
-		goto unlock;
-
-	/* Discard all the folios that overlap the destination region. */
-	truncate_inode_pages_range(&target_inode->i_data, fstart, fend);
 
 	fscache_invalidate(cifs_inode_cookie(target_inode), NULL,
 			   i_size_read(target_inode), 0);
@@ -1893,9 +1927,23 @@
 		goto out_destroy_cifsoplockd_wq;
 	}
 
+	serverclose_wq = alloc_workqueue("serverclose",
+					   WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
+	if (!serverclose_wq) {
+		rc = -ENOMEM;
+		goto out_destroy_deferredclose_wq;
+	}
+
+	cfid_put_wq = alloc_workqueue("cfid_put_wq",
+				      WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
+	if (!cfid_put_wq) {
+		rc = -ENOMEM;
+		goto out_destroy_serverclose_wq;
+	}
+
 	rc = cifs_init_inodecache();
 	if (rc)
-		goto out_destroy_deferredclose_wq;
+		goto out_destroy_cfid_put_wq;
 
 	rc = init_mids();
 	if (rc)
@@ -1957,6 +2005,10 @@
 	destroy_mids();
 out_destroy_inodecache:
 	cifs_destroy_inodecache();
+out_destroy_cfid_put_wq:
+	destroy_workqueue(cfid_put_wq);
+out_destroy_serverclose_wq:
+	destroy_workqueue(serverclose_wq);
 out_destroy_deferredclose_wq:
 	destroy_workqueue(deferredclose_wq);
 out_destroy_cifsoplockd_wq:
@@ -1996,6 +2048,8 @@
 	destroy_workqueue(cifsoplockd_wq);
 	destroy_workqueue(decrypt_wq);
 	destroy_workqueue(fileinfo_put_wq);
+	destroy_workqueue(serverclose_wq);
+	destroy_workqueue(cfid_put_wq);
 	destroy_workqueue(cifsiod_wq);
 	cifs_proc_clean();
 }
--- linux-qcom-6.8.0.orig/fs/smb/client/cifsglob.h
+++ linux-qcom-6.8.0/fs/smb/client/cifsglob.h
@@ -153,6 +153,12 @@
 	Kerberos,		/* Kerberos via SPNEGO */
 };
 
+enum upcall_target_enum {
+	UPTARGET_UNSPECIFIED, /* not specified, defaults to app */
+	UPTARGET_MOUNT, /* upcall to the mount namespace */
+	UPTARGET_APP, /* upcall to the application namespace which did the mount */
+};
+
 struct session_key {
 	unsigned int len;
 	char *response;
@@ -184,10 +190,10 @@
 	int gid;
 	int mode;
 	int cecount;
-	struct cifs_sid osid;
-	struct cifs_sid gsid;
+	struct smb_sid osid;
+	struct smb_sid gsid;
 	struct cifs_ntace *ntaces;
-	struct cifs_ace *aces;
+	struct smb_ace *aces;
 };
 
 struct cifs_open_info_data {
@@ -209,27 +215,14 @@
 		};
 	} reparse;
 	char *symlink_target;
-	struct cifs_sid posix_owner;
-	struct cifs_sid posix_group;
+	struct smb_sid posix_owner;
+	struct smb_sid posix_group;
 	union {
 		struct smb2_file_all_info fi;
 		struct smb311_posix_qinfo posix_fi;
 	};
 };
 
-static inline bool cifs_open_data_reparse(struct cifs_open_info_data *data)
-{
-	struct smb2_file_all_info *fi = &data->fi;
-	u32 attrs = le32_to_cpu(fi->Attributes);
-	bool ret;
-
-	ret = data->reparse_point || (attrs & ATTR_REPARSE);
-	if (ret)
-		attrs |= ATTR_REPARSE;
-	fi->Attributes = cpu_to_le32(attrs);
-	return ret;
-}
-
 /*
  *****************************************************************
  * Except the CIFS PDUs themselves all the
@@ -346,6 +339,9 @@
 	/* informational QFS call */
 	void (*qfs_tcon)(const unsigned int, struct cifs_tcon *,
 			 struct cifs_sb_info *);
+	/* query for server interfaces */
+	int (*query_server_interfaces)(const unsigned int, struct cifs_tcon *,
+				       bool);
 	/* check if a path is accessible or not */
 	int (*is_path_accessible)(const unsigned int, struct cifs_tcon *,
 				  struct cifs_sb_info *, const char *);
@@ -429,10 +425,10 @@
 	/* set fid protocol-specific info */
 	void (*set_fid)(struct cifsFileInfo *, struct cifs_fid *, __u32);
 	/* close a file */
-	void (*close)(const unsigned int, struct cifs_tcon *,
+	int (*close)(const unsigned int, struct cifs_tcon *,
 		      struct cifs_fid *);
 	/* close a file, returning file attributes and timestamps */
-	void (*close_getattr)(const unsigned int xid, struct cifs_tcon *tcon,
+	int (*close_getattr)(const unsigned int xid, struct cifs_tcon *tcon,
 		      struct cifsFileInfo *pfile_info);
 	/* send a flush request to the server */
 	int (*flush)(const unsigned int, struct cifs_tcon *, struct cifs_fid *);
@@ -472,7 +468,7 @@
 			__u16 net_fid, struct cifsInodeInfo *cifs_inode);
 	/* query remote filesystem */
 	int (*queryfs)(const unsigned int, struct cifs_tcon *,
-		       struct cifs_sb_info *, struct kstatfs *);
+		       const char *, struct cifs_sb_info *, struct kstatfs *);
 	/* send mandatory brlock to the server */
 	int (*mand_lock)(const unsigned int, struct cifsFileInfo *, __u64,
 			 __u64, __u32, int, int, bool);
@@ -526,12 +522,12 @@
 	int (*set_EA)(const unsigned int, struct cifs_tcon *, const char *,
 			const char *, const void *, const __u16,
 			const struct nls_table *, struct cifs_sb_info *);
-	struct cifs_ntsd * (*get_acl)(struct cifs_sb_info *, struct inode *,
-			const char *, u32 *, u32);
-	struct cifs_ntsd * (*get_acl_by_fid)(struct cifs_sb_info *,
-			const struct cifs_fid *, u32 *, u32);
-	int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *,
-			int);
+	struct smb_ntsd * (*get_acl)(struct cifs_sb_info *cifssb, struct inode *ino,
+			const char *patch, u32 *plen, u32 info);
+	struct smb_ntsd * (*get_acl_by_fid)(struct cifs_sb_info *cifssmb,
+			const struct cifs_fid *pfid, u32 *plen, u32 info);
+	int (*set_acl)(struct smb_ntsd *pntsd, __u32 len, struct inode *ino, const char *path,
+			int flag);
 	/* writepages retry size */
 	unsigned int (*wp_retry_size)(struct inode *);
 	/* get mtu credits */
@@ -579,6 +575,7 @@
 	/* Check for STATUS_NETWORK_NAME_DELETED */
 	bool (*is_network_name_deleted)(char *buf, struct TCP_Server_Info *srv);
 	int (*parse_reparse_point)(struct cifs_sb_info *cifs_sb,
+				   const char *full_path,
 				   struct kvec *rsp_iov,
 				   struct cifs_open_info_data *data);
 	int (*create_reparse_symlink)(const unsigned int xid,
@@ -1060,12 +1057,15 @@
 				   and after mount option parsing we fill it */
 	char *domainName;
 	char *password;
+	char *password2; /* When key rotation used, new password may be set before it expires */
 	char workstation_name[CIFS_MAX_WORKSTATION_LEN];
 	struct session_key auth_key;
 	struct ntlmssp_auth *ntlmssp; /* ciphertext, flags, server challenge */
 	enum securityEnum sectype; /* what security flavor was specified? */
+	enum upcall_target_enum upcall_target; /* what upcall target was specified? */
 	bool sign;		/* is signing required? */
 	bool domainAuto:1;
+	bool expired_pwd;  /* track if access denied or expired pwd so can know if need to update */
 	unsigned int flags;
 	__u16 session_flags;
 	__u8 smb3signingkey[SMB3_SIGN_KEY_SIZE];
@@ -1171,6 +1171,7 @@
  */
 struct cifs_tcon {
 	struct list_head tcon_list;
+	int debug_id;		/* Debugging for tracing */
 	int tc_count;
 	struct list_head rlist; /* reconnect list */
 	spinlock_t tc_lock;  /* protect anything here that is not protected */
@@ -1257,13 +1258,14 @@
 	__u32 max_cached_dirs;
 #ifdef CONFIG_CIFS_FSCACHE
 	u64 resource_id;		/* server resource id */
+	bool fscache_acquired;		/* T if we've tried acquiring a cookie */
 	struct fscache_volume *fscache;	/* cookie for share */
+	struct mutex fscache_lock;	/* Prevent regetting a cookie */
 #endif
 	struct list_head pending_opens;	/* list of incomplete opens */
 	struct cached_fids *cfids;
 	/* BB add field for back pointer to sb struct(s)? */
 #ifdef CONFIG_CIFS_DFS_UPCALL
-	struct list_head dfs_ses_list;
 	struct delayed_work dfs_cache_work;
 #endif
 	struct delayed_work	query_interfaces; /* query interfaces workqueue job */
@@ -1420,6 +1422,7 @@
 	bool invalidHandle:1;	/* file closed via session abend */
 	bool swapfile:1;
 	bool oplock_break_cancelled:1;
+	bool offload:1; /* offload final part of _put to a wq */
 	unsigned int oplock_epoch; /* epoch from the lease break */
 	__u32 oplock_level; /* oplock/lease level from the lease break */
 	int count;
@@ -1428,6 +1431,7 @@
 	struct cifs_search_info srch_inf;
 	struct work_struct oplock_break; /* work for oplock breaks */
 	struct work_struct put; /* work for the final part of _put */
+	struct work_struct serverclose; /* work for serverclose */
 	struct delayed_work deferred;
 	bool deferred_close_scheduled; /* Flag to indicate close is scheduled */
 	char *symlink_target;
@@ -1784,7 +1788,6 @@
 	struct TCP_Server_Info *server;
 	struct cifs_ses *ses;
 	struct cifs_tcon *tcon;
-	struct list_head dfs_ses_list;
 };
 
 static inline void __free_dfs_info_param(struct dfs_info3_param *param)
@@ -1897,7 +1900,7 @@
 #define   CIFSSEC_MAY_SIGN	0x00001
 #define   CIFSSEC_MAY_NTLMV2	0x00004
 #define   CIFSSEC_MAY_KRB5	0x00008
-#define   CIFSSEC_MAY_SEAL	0x00040 /* not supported yet */
+#define   CIFSSEC_MAY_SEAL	0x00040
 #define   CIFSSEC_MAY_NTLMSSP	0x00080 /* raw ntlmssp with ntlmv2 */
 
 #define   CIFSSEC_MUST_SIGN	0x01001
@@ -1907,15 +1910,15 @@
 #define   CIFSSEC_MUST_NTLMV2	0x04004
 #define   CIFSSEC_MUST_KRB5	0x08008
 #ifdef CONFIG_CIFS_UPCALL
-#define   CIFSSEC_MASK          0x8F08F /* flags supported if no weak allowed */
+#define   CIFSSEC_MASK          0xCF0CF /* flags supported if no weak allowed */
 #else
-#define	  CIFSSEC_MASK          0x87087 /* flags supported if no weak allowed */
+#define	  CIFSSEC_MASK          0xC70C7 /* flags supported if no weak allowed */
 #endif /* UPCALL */
-#define   CIFSSEC_MUST_SEAL	0x40040 /* not supported yet */
+#define   CIFSSEC_MUST_SEAL	0x40040
 #define   CIFSSEC_MUST_NTLMSSP	0x80080 /* raw ntlmssp with ntlmv2 */
 
-#define   CIFSSEC_DEF (CIFSSEC_MAY_SIGN | CIFSSEC_MAY_NTLMV2 | CIFSSEC_MAY_NTLMSSP)
-#define   CIFSSEC_MAX (CIFSSEC_MUST_NTLMV2)
+#define   CIFSSEC_DEF (CIFSSEC_MAY_SIGN | CIFSSEC_MAY_NTLMV2 | CIFSSEC_MAY_NTLMSSP | CIFSSEC_MAY_SEAL)
+#define   CIFSSEC_MAX (CIFSSEC_MAY_SIGN | CIFSSEC_MUST_KRB5 | CIFSSEC_MAY_SEAL)
 #define   CIFSSEC_AUTH_MASK (CIFSSEC_MAY_NTLMV2 | CIFSSEC_MAY_KRB5 | CIFSSEC_MAY_NTLMSSP)
 /*
  *****************************************************************
@@ -1997,7 +2000,7 @@
  * cifsInodeInfo->lock_sem	cifsInodeInfo->llist		cifs_init_once
  *				->can_cache_brlcks
  * cifsInodeInfo->deferred_lock	cifsInodeInfo->deferred_closes	cifsInodeInfo_alloc
- * cached_fid->fid_mutex		cifs_tcon->crfid		tcon_info_alloc
+ * cached_fids->cfid_list_lock	cifs_tcon->cfids->entries	 init_cached_dirs
  * cifsFileInfo->fh_mutex		cifsFileInfo			cifs_new_fileinfo
  * cifsFileInfo->file_info_lock	cifsFileInfo->count		cifs_new_fileinfo
  *				->invalidHandle			initiate_cifs_search
@@ -2085,6 +2088,8 @@
 extern struct workqueue_struct *fileinfo_put_wq;
 extern struct workqueue_struct *cifsoplockd_wq;
 extern struct workqueue_struct *deferredclose_wq;
+extern struct workqueue_struct *serverclose_wq;
+extern struct workqueue_struct *cfid_put_wq;
 extern __u32 cifs_lock_secret;
 
 extern mempool_t *cifs_mid_poolp;
@@ -2290,4 +2295,14 @@
 	struct smb2_file_link_info link_info;
 };
 
+static inline bool cifs_ses_exiting(struct cifs_ses *ses)
+{
+	bool ret;
+
+	spin_lock(&ses->ses_lock);
+	ret = ses->ses_status == SES_EXITING;
+	spin_unlock(&ses->ses_lock);
+	return ret;
+}
+
 #endif	/* _CIFS_GLOB_H */
--- linux-qcom-6.8.0.orig/fs/smb/client/cifspdu.h
+++ linux-qcom-6.8.0/fs/smb/client/cifspdu.h
@@ -882,7 +882,7 @@
 	__u8 OplockLevel;
 	__u16 Fid;
 	__le32 CreateAction;
-	struct_group(common_attributes,
+	struct_group_attr(common_attributes, __packed,
 		__le64 CreationTime;
 		__le64 LastAccessTime;
 		__le64 LastWriteTime;
@@ -2266,7 +2266,7 @@
 /* QueryFileInfo/QueryPathinfo (also for SetPath/SetFile) data buffer formats */
 /******************************************************************************/
 typedef struct { /* data block encoding of response to level 263 QPathInfo */
-	struct_group(common_attributes,
+	struct_group_attr(common_attributes, __packed,
 		__le64 CreationTime;
 		__le64 LastAccessTime;
 		__le64 LastWriteTime;
--- linux-qcom-6.8.0.orig/fs/smb/client/cifsproto.h
+++ linux-qcom-6.8.0/fs/smb/client/cifsproto.h
@@ -144,7 +144,8 @@
 extern int checkSMB(char *buf, unsigned int len, struct TCP_Server_Info *srvr);
 extern bool is_valid_oplock_break(char *, struct TCP_Server_Info *);
 extern bool backup_cred(struct cifs_sb_info *);
-extern bool is_size_safe_to_change(struct cifsInodeInfo *, __u64 eof);
+extern bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 eof,
+				   bool from_readdir);
 extern void cifs_update_eof(struct cifsInodeInfo *cifsi, loff_t offset,
 			    unsigned int bytes_written);
 extern struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *, int);
@@ -201,17 +202,14 @@
 				     struct cifs_sb_info *cifs_sb);
 extern void cifs_dir_info_to_fattr(struct cifs_fattr *, FILE_DIRECTORY_INFO *,
 					struct cifs_sb_info *);
-extern int cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr);
+extern int cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr,
+			       bool from_readdir);
 extern struct inode *cifs_iget(struct super_block *sb,
 			       struct cifs_fattr *fattr);
 
 int cifs_get_inode_info(struct inode **inode, const char *full_path,
 			struct cifs_open_info_data *data, struct super_block *sb, int xid,
 			const struct cifs_fid *fid);
-bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,
-				 struct cifs_fattr *fattr,
-				 struct cifs_open_info_data *data);
-
 extern int smb311_posix_get_inode_info(struct inode **inode,
 				       const char *full_path,
 				       struct cifs_open_info_data *data,
@@ -225,7 +223,7 @@
 extern int cifs_rename_pending_delete(const char *full_path,
 				      struct dentry *dentry,
 				      const unsigned int xid);
-extern int sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid,
+extern int sid_to_id(struct cifs_sb_info *cifs_sb, struct smb_sid *psid,
 				struct cifs_fattr *fattr, uint sidtype);
 extern int cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb,
 			      struct cifs_fattr *fattr, struct inode *inode,
@@ -233,19 +231,21 @@
 			      const char *path, const struct cifs_fid *pfid);
 extern int id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode,
 					kuid_t uid, kgid_t gid);
-extern struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *, struct inode *,
-				      const char *, u32 *, u32);
-extern struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *,
-				const struct cifs_fid *, u32 *, u32);
+extern struct smb_ntsd *get_cifs_acl(struct cifs_sb_info *cifssmb, struct inode *ino,
+				      const char *path, u32 *plen, u32 info);
+extern struct smb_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifssb,
+				const struct cifs_fid *pfid, u32 *plen, u32 info);
 extern struct posix_acl *cifs_get_acl(struct mnt_idmap *idmap,
 				      struct dentry *dentry, int type);
 extern int cifs_set_acl(struct mnt_idmap *idmap,
 			struct dentry *dentry, struct posix_acl *acl, int type);
-extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *,
-				const char *, int);
-extern unsigned int setup_authusers_ACE(struct cifs_ace *pace);
-extern unsigned int setup_special_mode_ACE(struct cifs_ace *pace, __u64 nmode);
-extern unsigned int setup_special_user_owner_ACE(struct cifs_ace *pace);
+extern int set_cifs_acl(struct smb_ntsd *pntsd, __u32 len, struct inode *ino,
+				const char *path, int flag);
+extern unsigned int setup_authusers_ACE(struct smb_ace *pace);
+extern unsigned int setup_special_mode_ACE(struct smb_ace *pace,
+					   bool posix,
+					   __u64 nmode);
+extern unsigned int setup_special_user_owner_ACE(struct smb_ace *pace);
 
 extern void dequeue_mid(struct mid_q_entry *mid, bool malformed);
 extern int cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
@@ -301,7 +301,7 @@
 		     struct TCP_Server_Info *primary_server);
 extern void cifs_put_tcp_session(struct TCP_Server_Info *server,
 				 int from_reconnect);
-extern void cifs_put_tcon(struct cifs_tcon *tcon);
+extern void cifs_put_tcon(struct cifs_tcon *tcon, enum smb3_tcon_ref_trace trace);
 
 extern void cifs_release_automount_timer(void);
 
@@ -526,8 +526,9 @@
 
 extern struct cifs_ses *sesInfoAlloc(void);
 extern void sesInfoFree(struct cifs_ses *);
-extern struct cifs_tcon *tcon_info_alloc(bool dir_leases_enabled);
-extern void tconInfoFree(struct cifs_tcon *);
+extern struct cifs_tcon *tcon_info_alloc(bool dir_leases_enabled,
+					 enum smb3_tcon_ref_trace trace);
+extern void tconInfoFree(struct cifs_tcon *tcon, enum smb3_tcon_ref_trace trace);
 
 extern int cifs_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server,
 		   __u32 *pexpected_response_sequence_number);
@@ -563,9 +564,9 @@
 		const struct nls_table *nls_codepage,
 		struct cifs_sb_info *cifs_sb);
 extern int CIFSSMBGetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon,
-			__u16 fid, struct cifs_ntsd **acl_inf, __u32 *buflen);
+			__u16 fid, struct smb_ntsd **acl_inf, __u32 *buflen);
 extern int CIFSSMBSetCIFSACL(const unsigned int, struct cifs_tcon *, __u16,
-			struct cifs_ntsd *, __u32, int);
+			struct smb_ntsd *pntsd, __u32 len, int aclflag);
 extern int cifs_do_get_acl(const unsigned int xid, struct cifs_tcon *tcon,
 			   const unsigned char *searchName,
 			   struct posix_acl **acl, const int acl_type,
@@ -674,6 +675,7 @@
 char *extract_sharename(const char *unc);
 int parse_reparse_point(struct reparse_data_buffer *buf,
 			u32 plen, struct cifs_sb_info *cifs_sb,
+			const char *full_path,
 			bool unicode, struct cifs_open_info_data *data);
 int cifs_sfu_make_node(unsigned int xid, struct inode *inode,
 		       struct dentry *dentry, struct cifs_tcon *tcon,
@@ -717,35 +719,33 @@
 		return options;
 }
 
-struct super_block *cifs_get_tcon_super(struct cifs_tcon *tcon);
-void cifs_put_tcon_super(struct super_block *sb);
 int cifs_wait_for_server_reconnect(struct TCP_Server_Info *server, bool retry);
 
-/* Put references of @ses and @ses->dfs_root_ses */
+/* Put references of @ses and its children */
 static inline void cifs_put_smb_ses(struct cifs_ses *ses)
 {
-	struct cifs_ses *rses = ses->dfs_root_ses;
+	struct cifs_ses *next;
 
-	__cifs_put_smb_ses(ses);
-	if (rses)
-		__cifs_put_smb_ses(rses);
+	do {
+		next = ses->dfs_root_ses;
+		__cifs_put_smb_ses(ses);
+	} while ((ses = next));
 }
 
-/* Get an active reference of @ses and @ses->dfs_root_ses.
+/* Get an active reference of @ses and its children.
  *
  * NOTE: make sure to call this function when incrementing reference count of
  * @ses to ensure that any DFS root session attached to it (@ses->dfs_root_ses)
  * will also get its reference count incremented.
  *
- * cifs_put_smb_ses() will put both references, so call it when you're done.
+ * cifs_put_smb_ses() will put all references, so call it when you're done.
  */
 static inline void cifs_smb_ses_inc_refcount(struct cifs_ses *ses)
 {
 	lockdep_assert_held(&cifs_tcp_ses_lock);
 
-	ses->ses_count++;
-	if (ses->dfs_root_ses)
-		ses->dfs_root_ses->ses_count++;
+	for (; ses; ses = ses->dfs_root_ses)
+		ses->ses_count++;
 }
 
 static inline bool dfs_src_pathname_equal(const char *s1, const char *s2)
--- linux-qcom-6.8.0.orig/fs/smb/client/cifssmb.c
+++ linux-qcom-6.8.0/fs/smb/client/cifssmb.c
@@ -3385,7 +3385,7 @@
 /* Get Security Descriptor (by handle) from remote server for a file or dir */
 int
 CIFSSMBGetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, __u16 fid,
-		  struct cifs_ntsd **acl_inf, __u32 *pbuflen)
+		  struct smb_ntsd **acl_inf, __u32 *pbuflen)
 {
 	int rc = 0;
 	int buf_type = 0;
@@ -3455,7 +3455,7 @@
 
 		/* check if buffer is big enough for the acl
 		   header followed by the smallest SID */
-		if ((*pbuflen < sizeof(struct cifs_ntsd) + 8) ||
+		if ((*pbuflen < sizeof(struct smb_ntsd) + 8) ||
 		    (*pbuflen >= 64 * 1024)) {
 			cifs_dbg(VFS, "bad acl length %d\n", *pbuflen);
 			rc = -EINVAL;
@@ -3475,7 +3475,7 @@
 
 int
 CIFSSMBSetCIFSACL(const unsigned int xid, struct cifs_tcon *tcon, __u16 fid,
-			struct cifs_ntsd *pntsd, __u32 acllen, int aclflag)
+			struct smb_ntsd *pntsd, __u32 acllen, int aclflag)
 {
 	__u16 byte_count, param_count, data_count, param_offset, data_offset;
 	int rc = 0;
@@ -5364,7 +5364,7 @@
 	param_offset = offsetof(struct smb_com_transaction2_spi_req,
 				InformationLevel) - 4;
 	offset = param_offset + params;
-	data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
+	data_offset = (char *)pSMB + offsetof(typeof(*pSMB), hdr.Protocol) + offset;
 	pSMB->ParameterOffset = cpu_to_le16(param_offset);
 	pSMB->DataOffset = cpu_to_le16(offset);
 	pSMB->SetupCount = 1;
--- linux-qcom-6.8.0.orig/fs/smb/client/connect.c
+++ linux-qcom-6.8.0/fs/smb/client/connect.c
@@ -123,12 +123,16 @@
 	struct cifs_tcon *tcon = container_of(work,
 					struct cifs_tcon,
 					query_interfaces.work);
+	struct TCP_Server_Info *server = tcon->ses->server;
 
 	/*
 	 * query server network interfaces, in case they change
 	 */
+	if (!server->ops->query_server_interfaces)
+		return;
+
 	xid = get_xid();
-	rc = SMB3_request_interfaces(xid, tcon, false);
+	rc = server->ops->query_server_interfaces(xid, tcon, false);
 	free_xid(xid);
 
 	if (rc) {
@@ -174,6 +178,8 @@
 
 	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
+		if (cifs_ses_exiting(ses))
+			continue;
 		spin_lock(&ses->chan_lock);
 		for (i = 0; i < ses->chan_count; i++) {
 			if (!ses->chans[i].server)
@@ -231,7 +237,13 @@
 
 	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each_entry_safe(ses, nses, &pserver->smb_ses_list, smb_ses_list) {
-		/* check if iface is still active */
+		spin_lock(&ses->ses_lock);
+		if (ses->ses_status == SES_EXITING) {
+			spin_unlock(&ses->ses_lock);
+			continue;
+		}
+		spin_unlock(&ses->ses_lock);
+
 		spin_lock(&ses->chan_lock);
 		if (cifs_ses_get_chan_index(ses, server) ==
 		    CIFS_INVAL_CHAN_INDEX) {
@@ -648,6 +660,19 @@
 server_unresponsive(struct TCP_Server_Info *server)
 {
 	/*
+	 * If we're in the process of mounting a share or reconnecting a session
+	 * and the server abruptly shut down (e.g. socket wasn't closed, packet
+	 * had been ACK'ed but no SMB response), don't wait longer than 20s to
+	 * negotiate protocol.
+	 */
+	spin_lock(&server->srv_lock);
+	if (server->tcpStatus == CifsInNegotiate &&
+	    time_after(jiffies, server->lstrp + 20 * HZ)) {
+		spin_unlock(&server->srv_lock);
+		cifs_reconnect(server, false);
+		return true;
+	}
+	/*
 	 * We need to wait 3 echo intervals to make sure we handle such
 	 * situations right:
 	 * 1s  client sends a normal SMB request
@@ -658,7 +683,6 @@
 	 * 65s kernel_recvmsg times out, and we see that we haven't gotten
 	 *     a response in >60s.
 	 */
-	spin_lock(&server->srv_lock);
 	if ((server->tcpStatus == CifsGood ||
 	    server->tcpStatus == CifsNeedNegotiate) &&
 	    (!server->ops->can_echo || server->ops->can_echo(server)) &&
@@ -982,9 +1006,13 @@
 	msleep(125);
 	if (cifs_rdma_enabled(server))
 		smbd_destroy(server);
+
 	if (server->ssocket) {
 		sock_release(server->ssocket);
 		server->ssocket = NULL;
+
+		/* Release netns reference for the socket. */
+		put_net(cifs_net_ns(server));
 	}
 
 	if (!list_empty(&server->pending_mid_q)) {
@@ -1033,7 +1061,10 @@
 		 */
 	}
 
+	/* Release netns reference for this server. */
+	put_net(cifs_net_ns(server));
 	kfree(server->leaf_fullpath);
+	kfree(server->hostname);
 	kfree(server);
 
 	length = atomic_dec_return(&tcpSesAllocCount);
@@ -1628,8 +1659,6 @@
 	/* srv_count can never go negative */
 	WARN_ON(server->srv_count < 0);
 
-	put_net(cifs_net_ns(server));
-
 	list_del_init(&server->tcp_ses_list);
 	spin_unlock(&cifs_tcp_ses_lock);
 
@@ -1659,8 +1688,6 @@
 	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
-	kfree(server->hostname);
-	server->hostname = NULL;
 
 	task = xchg(&server->tsk, NULL);
 	if (task)
@@ -1706,6 +1733,8 @@
 
 	tcp_ses->ops = ctx->ops;
 	tcp_ses->vals = ctx->vals;
+
+	/* Grab netns reference for this server. */
 	cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
 
 	tcp_ses->conn_id = atomic_inc_return(&tcpSesNextId);
@@ -1837,6 +1866,7 @@
 out_err_crypto_release:
 	cifs_crypto_secmech_release(tcp_ses);
 
+	/* Release netns reference for this server. */
 	put_net(cifs_net_ns(tcp_ses));
 
 out_err:
@@ -1845,8 +1875,10 @@
 			cifs_put_tcp_session(tcp_ses->primary_server, false);
 		kfree(tcp_ses->hostname);
 		kfree(tcp_ses->leaf_fullpath);
-		if (tcp_ses->ssocket)
+		if (tcp_ses->ssocket) {
 			sock_release(tcp_ses->ssocket);
+			put_net(cifs_net_ns(tcp_ses));
+		}
 		kfree(tcp_ses);
 	}
 	return ERR_PTR(rc);
@@ -1859,6 +1891,9 @@
 	    ctx->sectype != ses->sectype)
 		return 0;
 
+	if (ctx->dfs_root_ses != ses->dfs_root_ses)
+		return 0;
+
 	/*
 	 * If an existing session is limited to less channels than
 	 * requested, it should not be reused
@@ -1885,11 +1920,35 @@
 			    CIFS_MAX_USERNAME_LEN))
 			return 0;
 		if ((ctx->username && strlen(ctx->username) != 0) &&
-		    ses->password != NULL &&
-		    strncmp(ses->password,
-			    ctx->password ? ctx->password : "",
-			    CIFS_MAX_PASSWORD_LEN))
-			return 0;
+		    ses->password != NULL) {
+
+			/* New mount can only share sessions with an existing mount if:
+			 * 1. Both password and password2 match, or
+			 * 2. password2 of the old mount matches password of the new mount
+			 *    and password of the old mount matches password2 of the new
+			 *	  mount
+			 */
+			if (ses->password2 != NULL && ctx->password2 != NULL) {
+				if (!((strncmp(ses->password, ctx->password ?
+					ctx->password : "", CIFS_MAX_PASSWORD_LEN) == 0 &&
+					strncmp(ses->password2, ctx->password2,
+					CIFS_MAX_PASSWORD_LEN) == 0) ||
+					(strncmp(ses->password, ctx->password2,
+					CIFS_MAX_PASSWORD_LEN) == 0 &&
+					strncmp(ses->password2, ctx->password ?
+					ctx->password : "", CIFS_MAX_PASSWORD_LEN) == 0)))
+					return 0;
+
+			} else if ((ses->password2 == NULL && ctx->password2 != NULL) ||
+				(ses->password2 != NULL && ctx->password2 == NULL)) {
+				return 0;
+
+			} else {
+				if (strncmp(ses->password, ctx->password ?
+					ctx->password : "", CIFS_MAX_PASSWORD_LEN))
+					return 0;
+			}
+		}
 	}
 
 	if (strcmp(ctx->local_nls->charset, ses->local_nls->charset))
@@ -1931,7 +1990,7 @@
 	}
 
 	/* no need to setup directory caching on IPC share, so pass in false */
-	tcon = tcon_info_alloc(false);
+	tcon = tcon_info_alloc(false, netfs_trace_tcon_ref_new_ipc);
 	if (tcon == NULL)
 		return -ENOMEM;
 
@@ -1948,7 +2007,7 @@
 
 	if (rc) {
 		cifs_server_dbg(VFS, "failed to connect to IPC (rc=%d)\n", rc);
-		tconInfoFree(tcon);
+		tconInfoFree(tcon, netfs_trace_tcon_ref_free_ipc_fail);
 		goto out;
 	}
 
@@ -1962,31 +2021,6 @@
 	return rc;
 }
 
-/**
- * cifs_free_ipc - helper to release the session IPC tcon
- * @ses: smb session to unmount the IPC from
- *
- * Needs to be called everytime a session is destroyed.
- *
- * On session close, the IPC is closed and the server must release all tcons of the session.
- * No need to send a tree disconnect here.
- *
- * Besides, it will make the server to not close durable and resilient files on session close, as
- * specified in MS-SMB2 3.3.5.6 Receiving an SMB2 LOGOFF Request.
- */
-static int
-cifs_free_ipc(struct cifs_ses *ses)
-{
-	struct cifs_tcon *tcon = ses->tcon_ipc;
-
-	if (tcon == NULL)
-		return 0;
-
-	tconInfoFree(tcon);
-	ses->tcon_ipc = NULL;
-	return 0;
-}
-
 static struct cifs_ses *
 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
 {
@@ -2018,48 +2052,52 @@
 void __cifs_put_smb_ses(struct cifs_ses *ses)
 {
 	struct TCP_Server_Info *server = ses->server;
+	struct cifs_tcon *tcon;
 	unsigned int xid;
 	size_t i;
+	bool do_logoff;
 	int rc;
 
+	spin_lock(&cifs_tcp_ses_lock);
 	spin_lock(&ses->ses_lock);
-	if (ses->ses_status == SES_EXITING) {
+	cifs_dbg(FYI, "%s: id=0x%llx ses_count=%d ses_status=%u ipc=%s\n",
+		 __func__, ses->Suid, ses->ses_count, ses->ses_status,
+		 ses->tcon_ipc ? ses->tcon_ipc->tree_name : "none");
+	if (ses->ses_status == SES_EXITING || --ses->ses_count > 0) {
 		spin_unlock(&ses->ses_lock);
+		spin_unlock(&cifs_tcp_ses_lock);
 		return;
 	}
-	spin_unlock(&ses->ses_lock);
+	/* ses_count can never go negative */
+	WARN_ON(ses->ses_count < 0);
 
-	cifs_dbg(FYI, "%s: ses_count=%d\n", __func__, ses->ses_count);
-	cifs_dbg(FYI,
-		 "%s: ses ipc: %s\n", __func__, ses->tcon_ipc ? ses->tcon_ipc->tree_name : "NONE");
+	spin_lock(&ses->chan_lock);
+	cifs_chan_clear_need_reconnect(ses, server);
+	spin_unlock(&ses->chan_lock);
 
-	spin_lock(&cifs_tcp_ses_lock);
-	if (--ses->ses_count > 0) {
-		spin_unlock(&cifs_tcp_ses_lock);
-		return;
-	}
-	spin_lock(&ses->ses_lock);
-	if (ses->ses_status == SES_GOOD)
-		ses->ses_status = SES_EXITING;
+	do_logoff = ses->ses_status == SES_GOOD && server->ops->logoff;
+	ses->ses_status = SES_EXITING;
+	tcon = ses->tcon_ipc;
+	ses->tcon_ipc = NULL;
 	spin_unlock(&ses->ses_lock);
 	spin_unlock(&cifs_tcp_ses_lock);
 
-	/* ses_count can never go negative */
-	WARN_ON(ses->ses_count < 0);
-
-	spin_lock(&ses->ses_lock);
-	if (ses->ses_status == SES_EXITING && server->ops->logoff) {
-		spin_unlock(&ses->ses_lock);
-		cifs_free_ipc(ses);
+	/*
+	 * On session close, the IPC is closed and the server must release all
+	 * tcons of the session.  No need to send a tree disconnect here.
+	 *
+	 * Besides, it will make the server to not close durable and resilient
+	 * files on session close, as specified in MS-SMB2 3.3.5.6 Receiving an
+	 * SMB2 LOGOFF Request.
+	 */
+	tconInfoFree(tcon, netfs_trace_tcon_ref_free_ipc);
+	if (do_logoff) {
 		xid = get_xid();
 		rc = server->ops->logoff(xid, ses);
 		if (rc)
 			cifs_server_dbg(VFS, "%s: Session Logoff failure rc=%d\n",
 				__func__, rc);
 		_free_xid(xid);
-	} else {
-		spin_unlock(&ses->ses_lock);
-		cifs_free_ipc(ses);
 	}
 
 	spin_lock(&cifs_tcp_ses_lock);
@@ -2192,6 +2230,7 @@
 	}
 
 	++delim;
+	/* BB consider adding support for password2 (Key Rotation) for multiuser in future */
 	ctx->password = kstrndup(delim, len, GFP_KERNEL);
 	if (!ctx->password) {
 		cifs_dbg(FYI, "Unable to allocate %zd bytes for password\n",
@@ -2215,6 +2254,7 @@
 			kfree(ctx->username);
 			ctx->username = NULL;
 			kfree_sensitive(ctx->password);
+			/* no need to free ctx->password2 since not allocated in this path */
 			ctx->password = NULL;
 			goto out_key_put;
 		}
@@ -2252,6 +2292,7 @@
 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
 {
 	int rc = 0;
+	int retries = 0;
 	unsigned int xid;
 	struct cifs_ses *ses;
 	struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
@@ -2270,6 +2311,8 @@
 			cifs_dbg(FYI, "Session needs reconnect\n");
 
 			mutex_lock(&ses->session_mutex);
+
+retry_old_session:
 			rc = cifs_negotiate_protocol(xid, ses, server);
 			if (rc) {
 				mutex_unlock(&ses->session_mutex);
@@ -2282,6 +2325,13 @@
 			rc = cifs_setup_session(xid, ses, server,
 						ctx->local_nls);
 			if (rc) {
+				if (((rc == -EACCES) || (rc == -EKEYEXPIRED) ||
+					(rc == -EKEYREVOKED)) && !retries && ses->password2) {
+					retries++;
+					cifs_dbg(FYI, "Session reconnect failed, retrying with alternate password\n");
+					swap(ses->password, ses->password2);
+					goto retry_old_session;
+				}
 				mutex_unlock(&ses->session_mutex);
 				/* problem -- put our reference */
 				cifs_put_smb_ses(ses);
@@ -2326,6 +2376,12 @@
 		if (!ses->password)
 			goto get_ses_fail;
 	}
+	/* ctx->password freed at unmount */
+	if (ctx->password2) {
+		ses->password2 = kstrdup(ctx->password2, GFP_KERNEL);
+		if (!ses->password2)
+			goto get_ses_fail;
+	}
 	if (ctx->domainname) {
 		ses->domainName = kstrdup(ctx->domainname, GFP_KERNEL);
 		if (!ses->domainName)
@@ -2341,6 +2397,26 @@
 
 	ses->sectype = ctx->sectype;
 	ses->sign = ctx->sign;
+
+	/*
+	 *Explicitly marking upcall_target mount option for easier handling
+	 * by cifs_spnego.c and eventually cifs.upcall.c
+	 */
+
+	switch (ctx->upcall_target) {
+	case UPTARGET_UNSPECIFIED: /* default to app */
+	case UPTARGET_APP:
+		ses->upcall_target = UPTARGET_APP;
+		break;
+	case UPTARGET_MOUNT:
+		ses->upcall_target = UPTARGET_MOUNT;
+		break;
+	default:
+		// should never happen
+		ses->upcall_target = UPTARGET_APP;
+		break;
+	}
+
 	ses->local_nls = load_nls(ctx->local_nls->charset);
 
 	/* add server as first channel */
@@ -2351,6 +2427,7 @@
 	ses->chans_need_reconnect = 1;
 	spin_unlock(&ses->chan_lock);
 
+retry_new_session:
 	mutex_lock(&ses->session_mutex);
 	rc = cifs_negotiate_protocol(xid, ses, server);
 	if (!rc)
@@ -2363,8 +2440,16 @@
 	       sizeof(ses->smb3signingkey));
 	spin_unlock(&ses->chan_lock);
 
-	if (rc)
-		goto get_ses_fail;
+	if (rc) {
+		if (((rc == -EACCES) || (rc == -EKEYEXPIRED) ||
+			(rc == -EKEYREVOKED)) && !retries && ses->password2) {
+			retries++;
+			cifs_dbg(FYI, "Session setup failed, retrying with alternate password\n");
+			swap(ses->password, ses->password2);
+			goto retry_new_session;
+		} else
+			goto get_ses_fail;
+	}
 
 	/*
 	 * success, put it on the list and add it as first channel
@@ -2372,9 +2457,9 @@
 	 * need to lock before changing something in the session.
 	 */
 	spin_lock(&cifs_tcp_ses_lock);
+	if (ctx->dfs_root_ses)
+		cifs_smb_ses_inc_refcount(ctx->dfs_root_ses);
 	ses->dfs_root_ses = ctx->dfs_root_ses;
-	if (ses->dfs_root_ses)
-		ses->dfs_root_ses->ses_count++;
 	list_add(&ses->smb_ses_list, &server->smb_ses_list);
 	spin_unlock(&cifs_tcp_ses_lock);
 
@@ -2433,6 +2518,8 @@
 			continue;
 		}
 		++tcon->tc_count;
+		trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+				    netfs_trace_tcon_ref_get_find);
 		spin_unlock(&tcon->tc_lock);
 		spin_unlock(&cifs_tcp_ses_lock);
 		return tcon;
@@ -2442,7 +2529,7 @@
 }
 
 void
-cifs_put_tcon(struct cifs_tcon *tcon)
+cifs_put_tcon(struct cifs_tcon *tcon, enum smb3_tcon_ref_trace trace)
 {
 	unsigned int xid;
 	struct cifs_ses *ses;
@@ -2458,6 +2545,7 @@
 	cifs_dbg(FYI, "%s: tc_count=%d\n", __func__, tcon->tc_count);
 	spin_lock(&cifs_tcp_ses_lock);
 	spin_lock(&tcon->tc_lock);
+	trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count - 1, trace);
 	if (--tcon->tc_count > 0) {
 		spin_unlock(&tcon->tc_lock);
 		spin_unlock(&cifs_tcp_ses_lock);
@@ -2494,7 +2582,7 @@
 	_free_xid(xid);
 
 	cifs_fscache_release_super_cookie(tcon);
-	tconInfoFree(tcon);
+	tconInfoFree(tcon, netfs_trace_tcon_ref_free);
 	cifs_put_smb_ses(ses);
 }
 
@@ -2545,10 +2633,10 @@
 
 	if (ses->server->dialect >= SMB20_PROT_ID &&
 	    (ses->server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING))
-		nohandlecache = ctx->nohandlecache;
+		nohandlecache = ctx->nohandlecache || !dir_cache_timeout;
 	else
 		nohandlecache = true;
-	tcon = tcon_info_alloc(!nohandlecache);
+	tcon = tcon_info_alloc(!nohandlecache, netfs_trace_tcon_ref_new);
 	if (tcon == NULL) {
 		rc = -ENOMEM;
 		goto out_fail;
@@ -2612,6 +2700,13 @@
 			cifs_dbg(VFS, "Server does not support mounting with posix SMB3.11 extensions\n");
 			rc = -EOPNOTSUPP;
 			goto out_fail;
+		} else if (ses->server->vals->protocol_id == SMB10_PROT_ID)
+			if (cap_unix(ses))
+				cifs_dbg(FYI, "Unix Extensions requested on SMB1 mount\n");
+			else {
+				cifs_dbg(VFS, "SMB1 Unix Extensions not supported by server\n");
+				rc = -EOPNOTSUPP;
+				goto out_fail;
 		} else {
 			cifs_dbg(VFS,
 				"Check vers= mount option. SMB3.11 disabled but required for POSIX extensions\n");
@@ -2738,7 +2833,7 @@
 	return tcon;
 
 out_fail:
-	tconInfoFree(tcon);
+	tconInfoFree(tcon, netfs_trace_tcon_ref_free_fail);
 	return ERR_PTR(rc);
 }
 
@@ -2755,7 +2850,7 @@
 	}
 
 	if (!IS_ERR(tlink_tcon(tlink)))
-		cifs_put_tcon(tlink_tcon(tlink));
+		cifs_put_tcon(tlink_tcon(tlink), netfs_trace_tcon_ref_put_tlink);
 	kfree(tlink);
 }
 
@@ -3054,13 +3149,22 @@
 	if (server->ssocket) {
 		socket = server->ssocket;
 	} else {
-		rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
-				   IPPROTO_TCP, &server->ssocket, 1);
+		struct net *net = cifs_net_ns(server);
+
+		rc = sock_create_kern(net, sfamily, SOCK_STREAM, IPPROTO_TCP, &server->ssocket);
 		if (rc < 0) {
 			cifs_server_dbg(VFS, "Error %d creating socket\n", rc);
 			return rc;
 		}
 
+		/*
+		 * Grab netns reference for the socket.
+		 *
+		 * It'll be released here, on error, or in clean_demultiplex_info() upon server
+		 * teardown.
+		 */
+		get_net(net);
+
 		/* BB other socket options to set KEEPALIVE, NODELAY? */
 		cifs_dbg(FYI, "Socket created\n");
 		socket = server->ssocket;
@@ -3073,8 +3177,10 @@
 	}
 
 	rc = bind_socket(server);
-	if (rc < 0)
+	if (rc < 0) {
+		put_net(cifs_net_ns(server));
 		return rc;
+	}
 
 	/*
 	 * Eventually check for other socket options to change from
@@ -3111,6 +3217,7 @@
 	if (rc < 0) {
 		cifs_dbg(FYI, "Error %d connecting to server\n", rc);
 		trace_smb3_connect_err(server->hostname, server->conn_id, &server->dstaddr, rc);
+		put_net(cifs_net_ns(server));
 		sock_release(socket);
 		server->ssocket = NULL;
 		return rc;
@@ -3119,6 +3226,9 @@
 	if (sport == htons(RFC1001_PORT))
 		rc = ip_rfc1001_connect(server);
 
+	if (rc < 0)
+		put_net(cifs_net_ns(server));
+
 	return rc;
 }
 
@@ -3318,11 +3428,14 @@
 	int rc = 0;
 
 	if (mnt_ctx->tcon)
-		cifs_put_tcon(mnt_ctx->tcon);
+		cifs_put_tcon(mnt_ctx->tcon, netfs_trace_tcon_ref_put_mnt_ctx);
 	else if (mnt_ctx->ses)
 		cifs_put_smb_ses(mnt_ctx->ses);
 	else if (mnt_ctx->server)
 		cifs_put_tcp_session(mnt_ctx->server, 0);
+	mnt_ctx->ses = NULL;
+	mnt_ctx->tcon = NULL;
+	mnt_ctx->server = NULL;
 	mnt_ctx->cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_POSIX_PATHS;
 	free_xid(mnt_ctx->xid);
 }
@@ -3601,8 +3714,6 @@
 	bool isdfs;
 	int rc;
 
-	INIT_LIST_HEAD(&mnt_ctx.dfs_ses_list);
-
 	rc = dfs_mount_share(&mnt_ctx, &isdfs);
 	if (rc)
 		goto error;
@@ -3633,7 +3744,6 @@
 	return rc;
 
 error:
-	dfs_put_root_smb_sessions(&mnt_ctx.dfs_ses_list);
 	cifs_mount_put_conns(&mnt_ctx);
 	return rc;
 }
@@ -3648,6 +3758,18 @@
 		goto error;
 
 	rc = cifs_mount_get_tcon(&mnt_ctx);
+	if (!rc) {
+		/*
+		 * Prevent superblock from being created with any missing
+		 * connections.
+		 */
+		if (WARN_ON(!mnt_ctx.server))
+			rc = -EHOSTDOWN;
+		else if (WARN_ON(!mnt_ctx.ses))
+			rc = -EACCES;
+		else if (WARN_ON(!mnt_ctx.tcon))
+			rc = -ENOENT;
+	}
 	if (rc)
 		goto error;
 
@@ -3670,6 +3792,7 @@
 }
 #endif
 
+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
 /*
  * Issue a TREE_CONNECT request.
  */
@@ -3791,11 +3914,25 @@
 		else
 			tcon->Flags = 0;
 		cifs_dbg(FYI, "Tcon flags: 0x%x\n", tcon->Flags);
-	}
 
+		/*
+		 * reset_cifs_unix_caps calls QFSInfo which requires
+		 * need_reconnect to be false, but we would not need to call
+		 * reset_caps if this were not a reconnect case so must check
+		 * need_reconnect flag here.  The caller will also clear
+		 * need_reconnect when tcon was successful but needed to be
+		 * cleared earlier in the case of unix extensions reconnect
+		 */
+		if (tcon->need_reconnect && tcon->unix_ext) {
+			cifs_dbg(FYI, "resetting caps for %s\n", tcon->tree_name);
+			tcon->need_reconnect = false;
+			reset_cifs_unix_caps(xid, tcon, NULL, NULL);
+		}
+	}
 	cifs_buf_release(smb_buffer);
 	return rc;
 }
+#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
 
 static void delayed_free(struct rcu_head *p)
 {
@@ -3985,13 +4122,14 @@
 }
 
 static struct cifs_tcon *
-cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
+__cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
 {
 	int rc;
 	struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
 	struct cifs_ses *ses;
 	struct cifs_tcon *tcon = NULL;
 	struct smb3_fs_context *ctx;
+	char *origin_fullpath = NULL;
 
 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 	if (ctx == NULL)
@@ -4015,6 +4153,7 @@
 	ctx->sign = master_tcon->ses->sign;
 	ctx->seal = master_tcon->seal;
 	ctx->witness = master_tcon->use_witness;
+	ctx->dfs_root_ses = master_tcon->ses->dfs_root_ses;
 
 	rc = cifs_set_vol_auth(ctx, master_tcon->ses);
 	if (rc) {
@@ -4034,12 +4173,39 @@
 		goto out;
 	}
 
+#ifdef CONFIG_CIFS_DFS_UPCALL
+	spin_lock(&master_tcon->tc_lock);
+	if (master_tcon->origin_fullpath) {
+		spin_unlock(&master_tcon->tc_lock);
+		origin_fullpath = dfs_get_path(cifs_sb, cifs_sb->ctx->source);
+		if (IS_ERR(origin_fullpath)) {
+			tcon = ERR_CAST(origin_fullpath);
+			origin_fullpath = NULL;
+			cifs_put_smb_ses(ses);
+			goto out;
+		}
+	} else {
+		spin_unlock(&master_tcon->tc_lock);
+	}
+#endif
+
 	tcon = cifs_get_tcon(ses, ctx);
 	if (IS_ERR(tcon)) {
 		cifs_put_smb_ses(ses);
 		goto out;
 	}
 
+#ifdef CONFIG_CIFS_DFS_UPCALL
+	if (origin_fullpath) {
+		spin_lock(&tcon->tc_lock);
+		tcon->origin_fullpath = origin_fullpath;
+		spin_unlock(&tcon->tc_lock);
+		origin_fullpath = NULL;
+		queue_delayed_work(dfscache_wq, &tcon->dfs_cache_work,
+				   dfs_cache_get_ttl() * HZ);
+	}
+#endif
+
 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
 	if (cap_unix(ses))
 		reset_cifs_unix_caps(0, tcon, NULL, ctx);
@@ -4048,11 +4214,23 @@
 out:
 	kfree(ctx->username);
 	kfree_sensitive(ctx->password);
+	kfree(origin_fullpath);
 	kfree(ctx);
 
 	return tcon;
 }
 
+static struct cifs_tcon *
+cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
+{
+	struct cifs_tcon *ret;
+
+	cifs_mount_lock();
+	ret = __cifs_construct_tcon(cifs_sb, fsuid);
+	cifs_mount_unlock();
+	return ret;
+}
+
 struct cifs_tcon *
 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
 {
--- linux-qcom-6.8.0.orig/fs/smb/client/dfs.c
+++ linux-qcom-6.8.0/fs/smb/client/dfs.c
@@ -66,33 +66,20 @@
 }
 
 /*
- * Track individual DFS referral servers used by new DFS mount.
- *
- * On success, their lifetime will be shared by final tcon (dfs_ses_list).
- * Otherwise, they will be put by dfs_put_root_smb_sessions() in cifs_mount().
+ * Get an active reference of @ses so that next call to cifs_put_tcon() won't
+ * release it as any new DFS referrals must go through its IPC tcon.
  */
-static int add_root_smb_session(struct cifs_mount_ctx *mnt_ctx)
+static void add_root_smb_session(struct cifs_mount_ctx *mnt_ctx)
 {
 	struct smb3_fs_context *ctx = mnt_ctx->fs_ctx;
-	struct dfs_root_ses *root_ses;
 	struct cifs_ses *ses = mnt_ctx->ses;
 
 	if (ses) {
-		root_ses = kmalloc(sizeof(*root_ses), GFP_KERNEL);
-		if (!root_ses)
-			return -ENOMEM;
-
-		INIT_LIST_HEAD(&root_ses->list);
-
 		spin_lock(&cifs_tcp_ses_lock);
 		cifs_smb_ses_inc_refcount(ses);
 		spin_unlock(&cifs_tcp_ses_lock);
-		root_ses->ses = ses;
-		list_add_tail(&root_ses->list, &mnt_ctx->dfs_ses_list);
 	}
-	/* Select new DFS referral server so that new referrals go through it */
 	ctx->dfs_root_ses = ses;
-	return 0;
 }
 
 static inline int parse_dfs_target(struct smb3_fs_context *ctx,
@@ -185,11 +172,8 @@
 					continue;
 			}
 
-			if (is_refsrv) {
-				rc = add_root_smb_session(mnt_ctx);
-				if (rc)
-					goto out;
-			}
+			if (is_refsrv)
+				add_root_smb_session(mnt_ctx);
 
 			rc = ref_walk_advance(rw);
 			if (!rc) {
@@ -232,6 +216,7 @@
 	struct smb3_fs_context *ctx = mnt_ctx->fs_ctx;
 	struct cifs_tcon *tcon;
 	char *origin_fullpath;
+	bool new_tcon = true;
 	int rc;
 
 	origin_fullpath = dfs_get_path(cifs_sb, ctx->source);
@@ -239,6 +224,18 @@
 		return PTR_ERR(origin_fullpath);
 
 	rc = dfs_referral_walk(mnt_ctx);
+	if (!rc) {
+		/*
+		 * Prevent superblock from being created with any missing
+		 * connections.
+		 */
+		if (WARN_ON(!mnt_ctx->server))
+			rc = -EHOSTDOWN;
+		else if (WARN_ON(!mnt_ctx->ses))
+			rc = -EACCES;
+		else if (WARN_ON(!mnt_ctx->tcon))
+			rc = -ENOENT;
+	}
 	if (rc)
 		goto out;
 
@@ -247,15 +244,14 @@
 	if (!tcon->origin_fullpath) {
 		tcon->origin_fullpath = origin_fullpath;
 		origin_fullpath = NULL;
+	} else {
+		new_tcon = false;
 	}
 	spin_unlock(&tcon->tc_lock);
 
-	if (list_empty(&tcon->dfs_ses_list)) {
-		list_replace_init(&mnt_ctx->dfs_ses_list, &tcon->dfs_ses_list);
+	if (new_tcon) {
 		queue_delayed_work(dfscache_wq, &tcon->dfs_cache_work,
 				   dfs_cache_get_ttl() * HZ);
-	} else {
-		dfs_put_root_smb_sessions(&mnt_ctx->dfs_ses_list);
 	}
 
 out:
@@ -298,7 +294,6 @@
 	if (rc)
 		return rc;
 
-	ctx->dfs_root_ses = mnt_ctx->ses;
 	/*
 	 * If called with 'nodfs' mount option, then skip DFS resolving.  Otherwise unconditionally
 	 * try to get an DFS referral (even cached) to determine whether it is an DFS mount.
@@ -324,49 +319,8 @@
 
 	*isdfs = true;
 	add_root_smb_session(mnt_ctx);
-	return __dfs_mount_share(mnt_ctx);
-}
-
-/* Update dfs referral path of superblock */
-static int update_server_fullpath(struct TCP_Server_Info *server, struct cifs_sb_info *cifs_sb,
-				  const char *target)
-{
-	int rc = 0;
-	size_t len = strlen(target);
-	char *refpath, *npath;
-
-	if (unlikely(len < 2 || *target != '\\'))
-		return -EINVAL;
-
-	if (target[1] == '\\') {
-		len += 1;
-		refpath = kmalloc(len, GFP_KERNEL);
-		if (!refpath)
-			return -ENOMEM;
-
-		scnprintf(refpath, len, "%s", target);
-	} else {
-		len += sizeof("\\");
-		refpath = kmalloc(len, GFP_KERNEL);
-		if (!refpath)
-			return -ENOMEM;
-
-		scnprintf(refpath, len, "\\%s", target);
-	}
-
-	npath = dfs_cache_canonical_path(refpath, cifs_sb->local_nls, cifs_remap(cifs_sb));
-	kfree(refpath);
-
-	if (IS_ERR(npath)) {
-		rc = PTR_ERR(npath);
-	} else {
-		mutex_lock(&server->refpath_lock);
-		spin_lock(&server->srv_lock);
-		kfree(server->leaf_fullpath);
-		server->leaf_fullpath = npath;
-		spin_unlock(&server->srv_lock);
-		mutex_unlock(&server->refpath_lock);
-	}
+	rc = __dfs_mount_share(mnt_ctx);
+	dfs_put_root_smb_sessions(mnt_ctx);
 	return rc;
 }
 
@@ -394,77 +348,22 @@
 	return rc;
 }
 
-static void __tree_connect_ipc(const unsigned int xid, char *tree,
-			       struct cifs_sb_info *cifs_sb,
-			       struct cifs_ses *ses)
-{
-	struct TCP_Server_Info *server = ses->server;
-	struct cifs_tcon *tcon = ses->tcon_ipc;
-	int rc;
-
-	spin_lock(&ses->ses_lock);
-	spin_lock(&ses->chan_lock);
-	if (cifs_chan_needs_reconnect(ses, server) ||
-	    ses->ses_status != SES_GOOD) {
-		spin_unlock(&ses->chan_lock);
-		spin_unlock(&ses->ses_lock);
-		cifs_server_dbg(FYI, "%s: skipping ipc reconnect due to disconnected ses\n",
-				__func__);
-		return;
-	}
-	spin_unlock(&ses->chan_lock);
-	spin_unlock(&ses->ses_lock);
-
-	cifs_server_lock(server);
-	scnprintf(tree, MAX_TREE_SIZE, "\\\\%s\\IPC$", server->hostname);
-	cifs_server_unlock(server);
-
-	rc = server->ops->tree_connect(xid, ses, tree, tcon,
-				       cifs_sb->local_nls);
-	cifs_server_dbg(FYI, "%s: tree_reconnect %s: %d\n", __func__, tree, rc);
-	spin_lock(&tcon->tc_lock);
-	if (rc) {
-		tcon->status = TID_NEED_TCON;
-	} else {
-		tcon->status = TID_GOOD;
-		tcon->need_reconnect = false;
-	}
-	spin_unlock(&tcon->tc_lock);
-}
-
-static void tree_connect_ipc(const unsigned int xid, char *tree,
-			     struct cifs_sb_info *cifs_sb,
-			     struct cifs_tcon *tcon)
-{
-	struct cifs_ses *ses = tcon->ses;
-
-	__tree_connect_ipc(xid, tree, cifs_sb, ses);
-	__tree_connect_ipc(xid, tree, cifs_sb, CIFS_DFS_ROOT_SES(ses));
-}
-
-static int __tree_connect_dfs_target(const unsigned int xid, struct cifs_tcon *tcon,
-				     struct cifs_sb_info *cifs_sb, char *tree, bool islink,
-				     struct dfs_cache_tgt_list *tl)
+static int tree_connect_dfs_target(const unsigned int xid,
+				   struct cifs_tcon *tcon,
+				   struct cifs_sb_info *cifs_sb,
+				   char *tree, bool islink,
+				   struct dfs_cache_tgt_list *tl)
 {
-	int rc;
+	const struct smb_version_operations *ops = tcon->ses->server->ops;
 	struct TCP_Server_Info *server = tcon->ses->server;
-	const struct smb_version_operations *ops = server->ops;
-	struct cifs_ses *root_ses = CIFS_DFS_ROOT_SES(tcon->ses);
-	char *share = NULL, *prefix = NULL;
 	struct dfs_cache_tgt_iterator *tit;
+	char *share = NULL, *prefix = NULL;
 	bool target_match;
-
-	tit = dfs_cache_get_tgt_iterator(tl);
-	if (!tit) {
-		rc = -ENOENT;
-		goto out;
-	}
+	int rc = -ENOENT;
 
 	/* Try to tree connect to all dfs targets */
-	for (; tit; tit = dfs_cache_get_next_tgt(tl, tit)) {
-		const char *target = dfs_cache_get_tgt_name(tit);
-		DFS_CACHE_TGT_LIST(ntl);
-
+	for (tit = dfs_cache_get_tgt_iterator(tl);
+	     tit; tit = dfs_cache_get_next_tgt(tl, tit)) {
 		kfree(share);
 		kfree(prefix);
 		share = prefix = NULL;
@@ -485,69 +384,16 @@
 		}
 
 		dfs_cache_noreq_update_tgthint(server->leaf_fullpath + 1, tit);
-		tree_connect_ipc(xid, tree, cifs_sb, tcon);
-
 		scnprintf(tree, MAX_TREE_SIZE, "\\%s", share);
-		if (!islink) {
-			rc = ops->tree_connect(xid, tcon->ses, tree, tcon, cifs_sb->local_nls);
-			break;
-		}
-
-		/*
-		 * If no dfs referrals were returned from link target, then just do a TREE_CONNECT
-		 * to it.  Otherwise, cache the dfs referral and then mark current tcp ses for
-		 * reconnect so either the demultiplex thread or the echo worker will reconnect to
-		 * newly resolved target.
-		 */
-		if (dfs_cache_find(xid, root_ses, cifs_sb->local_nls, cifs_remap(cifs_sb), target,
-				   NULL, &ntl)) {
-			rc = ops->tree_connect(xid, tcon->ses, tree, tcon, cifs_sb->local_nls);
-			if (rc)
-				continue;
-
+		rc = ops->tree_connect(xid, tcon->ses, tree,
+				       tcon, tcon->ses->local_nls);
+		if (islink && !rc && cifs_sb)
 			rc = cifs_update_super_prepath(cifs_sb, prefix);
-		} else {
-			/* Target is another dfs share */
-			rc = update_server_fullpath(server, cifs_sb, target);
-			dfs_cache_free_tgts(tl);
-
-			if (!rc) {
-				rc = -EREMOTE;
-				list_replace_init(&ntl.tl_list, &tl->tl_list);
-			} else
-				dfs_cache_free_tgts(&ntl);
-		}
 		break;
 	}
 
-out:
 	kfree(share);
 	kfree(prefix);
-
-	return rc;
-}
-
-static int tree_connect_dfs_target(const unsigned int xid, struct cifs_tcon *tcon,
-				   struct cifs_sb_info *cifs_sb, char *tree, bool islink,
-				   struct dfs_cache_tgt_list *tl)
-{
-	int rc;
-	int num_links = 0;
-	struct TCP_Server_Info *server = tcon->ses->server;
-	char *old_fullpath = server->leaf_fullpath;
-
-	do {
-		rc = __tree_connect_dfs_target(xid, tcon, cifs_sb, tree, islink, tl);
-		if (!rc || rc != -EREMOTE)
-			break;
-	} while (rc = -ELOOP, ++num_links < MAX_NESTED_LINKS);
-	/*
-	 * If we couldn't tree connect to any targets from last referral path, then
-	 * retry it from newly resolved dfs referral.
-	 */
-	if (rc && server->leaf_fullpath != old_fullpath)
-		cifs_signal_cifsd_for_reconnect(server, true);
-
 	dfs_cache_free_tgts(tl);
 	return rc;
 }
@@ -602,14 +448,11 @@
 	if (!IS_ERR(sb))
 		cifs_sb = CIFS_SB(sb);
 
-	/*
-	 * Tree connect to last share in @tcon->tree_name whether dfs super or
-	 * cached dfs referral was not found.
-	 */
-	if (!cifs_sb || !server->leaf_fullpath ||
+	/* Tree connect to last share in @tcon->tree_name if no DFS referral */
+	if (!server->leaf_fullpath ||
 	    dfs_cache_noreq_find(server->leaf_fullpath + 1, &ref, &tl)) {
-		rc = ops->tree_connect(xid, tcon->ses, tcon->tree_name, tcon,
-				       cifs_sb ? cifs_sb->local_nls : nlsc);
+		rc = ops->tree_connect(xid, tcon->ses, tcon->tree_name,
+				       tcon, tcon->ses->local_nls);
 		goto out;
 	}
 
--- linux-qcom-6.8.0.orig/fs/smb/client/dfs.h
+++ linux-qcom-6.8.0/fs/smb/client/dfs.h
@@ -7,7 +7,9 @@
 #define _CIFS_DFS_H
 
 #include "cifsglob.h"
+#include "cifsproto.h"
 #include "fs_context.h"
+#include "dfs_cache.h"
 #include "cifs_unicode.h"
 #include <linux/namei.h>
 
@@ -114,11 +116,6 @@
 				       ref_walk_tit(rw));
 }
 
-struct dfs_root_ses {
-	struct list_head list;
-	struct cifs_ses *ses;
-};
-
 int dfs_parse_target_referral(const char *full_path, const struct dfs_info3_param *ref,
 			      struct smb3_fs_context *ctx);
 int dfs_mount_share(struct cifs_mount_ctx *mnt_ctx, bool *isdfs);
@@ -133,20 +130,32 @@
 {
 	struct smb3_fs_context *ctx = mnt_ctx->fs_ctx;
 	struct cifs_sb_info *cifs_sb = mnt_ctx->cifs_sb;
+	struct cifs_ses *rses = ctx->dfs_root_ses ?: mnt_ctx->ses;
 
-	return dfs_cache_find(mnt_ctx->xid, ctx->dfs_root_ses, cifs_sb->local_nls,
+	return dfs_cache_find(mnt_ctx->xid, rses, cifs_sb->local_nls,
 			      cifs_remap(cifs_sb), path, ref, tl);
 }
 
-static inline void dfs_put_root_smb_sessions(struct list_head *head)
-{
-	struct dfs_root_ses *root, *tmp;
-
-	list_for_each_entry_safe(root, tmp, head, list) {
-		list_del_init(&root->list);
-		cifs_put_smb_ses(root->ses);
-		kfree(root);
+/*
+ * cifs_get_smb_ses() already guarantees an active reference of
+ * @ses->dfs_root_ses when a new session is created, so we need to put extra
+ * references of all DFS root sessions that were used across the mount process
+ * in dfs_mount_share().
+ */
+static inline void dfs_put_root_smb_sessions(struct cifs_mount_ctx *mnt_ctx)
+{
+	const struct smb3_fs_context *ctx = mnt_ctx->fs_ctx;
+	struct cifs_ses *ses = ctx->dfs_root_ses;
+	struct cifs_ses *cur;
+
+	if (!ses)
+		return;
+
+	for (cur = ses; cur; cur = cur->dfs_root_ses) {
+		if (cur->dfs_root_ses)
+			cifs_put_smb_ses(cur->dfs_root_ses);
 	}
+	cifs_put_smb_ses(ses);
 }
 
 #endif /* _CIFS_DFS_H */
--- linux-qcom-6.8.0.orig/fs/smb/client/dfs_cache.c
+++ linux-qcom-6.8.0/fs/smb/client/dfs_cache.c
@@ -1172,8 +1172,8 @@
 	return ret;
 }
 
-/* Refresh dfs referral of tcon and mark it for reconnect if needed */
-static int __refresh_tcon(const char *path, struct cifs_ses *ses, bool force_refresh)
+/* Refresh dfs referral of @ses and mark it for reconnect if needed */
+static void __refresh_ses_referral(struct cifs_ses *ses, bool force_refresh)
 {
 	struct TCP_Server_Info *server = ses->server;
 	DFS_CACHE_TGT_LIST(old_tl);
@@ -1181,10 +1181,21 @@
 	bool needs_refresh = false;
 	struct cache_entry *ce;
 	unsigned int xid;
+	char *path = NULL;
 	int rc = 0;
 
 	xid = get_xid();
 
+	mutex_lock(&server->refpath_lock);
+	if (server->leaf_fullpath) {
+		path = kstrdup(server->leaf_fullpath + 1, GFP_ATOMIC);
+		if (!path)
+			rc = -ENOMEM;
+	}
+	mutex_unlock(&server->refpath_lock);
+	if (!path)
+		goto out;
+
 	down_read(&htable_rw_lock);
 	ce = lookup_cache_entry(path);
 	needs_refresh = force_refresh || IS_ERR(ce) || cache_entry_expired(ce);
@@ -1218,19 +1229,17 @@
 	free_xid(xid);
 	dfs_cache_free_tgts(&old_tl);
 	dfs_cache_free_tgts(&new_tl);
-	return rc;
+	kfree(path);
 }
 
-static int refresh_tcon(struct cifs_tcon *tcon, bool force_refresh)
+static inline void refresh_ses_referral(struct cifs_ses *ses)
 {
-	struct TCP_Server_Info *server = tcon->ses->server;
-	struct cifs_ses *ses = tcon->ses;
+	__refresh_ses_referral(ses, false);
+}
 
-	mutex_lock(&server->refpath_lock);
-	if (server->leaf_fullpath)
-		__refresh_tcon(server->leaf_fullpath + 1, ses, force_refresh);
-	mutex_unlock(&server->refpath_lock);
-	return 0;
+static inline void force_refresh_ses_referral(struct cifs_ses *ses)
+{
+	__refresh_ses_referral(ses, true);
 }
 
 /**
@@ -1271,34 +1280,20 @@
 	 */
 	cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
 
-	return refresh_tcon(tcon, true);
+	force_refresh_ses_referral(tcon->ses);
+	return 0;
 }
 
 /* Refresh all DFS referrals related to DFS tcon */
 void dfs_cache_refresh(struct work_struct *work)
 {
-	struct TCP_Server_Info *server;
-	struct dfs_root_ses *rses;
 	struct cifs_tcon *tcon;
 	struct cifs_ses *ses;
 
 	tcon = container_of(work, struct cifs_tcon, dfs_cache_work.work);
-	ses = tcon->ses;
-	server = ses->server;
 
-	mutex_lock(&server->refpath_lock);
-	if (server->leaf_fullpath)
-		__refresh_tcon(server->leaf_fullpath + 1, ses, false);
-	mutex_unlock(&server->refpath_lock);
-
-	list_for_each_entry(rses, &tcon->dfs_ses_list, list) {
-		ses = rses->ses;
-		server = ses->server;
-		mutex_lock(&server->refpath_lock);
-		if (server->leaf_fullpath)
-			__refresh_tcon(server->leaf_fullpath + 1, ses, false);
-		mutex_unlock(&server->refpath_lock);
-	}
+	for (ses = tcon->ses; ses; ses = ses->dfs_root_ses)
+		refresh_ses_referral(ses);
 
 	queue_delayed_work(dfscache_wq, &tcon->dfs_cache_work,
 			   atomic_read(&dfs_cache_ttl) * HZ);
--- linux-qcom-6.8.0.orig/fs/smb/client/dir.c
+++ linux-qcom-6.8.0/fs/smb/client/dir.c
@@ -189,6 +189,7 @@
 	int disposition;
 	struct TCP_Server_Info *server = tcon->ses->server;
 	struct cifs_open_parms oparms;
+	int rdwr_for_fscache = 0;
 
 	*oplock = 0;
 	if (tcon->ses->server->oplocks)
@@ -200,6 +201,10 @@
 		return PTR_ERR(full_path);
 	}
 
+	/* If we're caching, we need to be able to fill in around partial writes. */
+	if (cifs_fscache_enabled(inode) && (oflags & O_ACCMODE) == O_WRONLY)
+		rdwr_for_fscache = 1;
+
 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
 	if (tcon->unix_ext && cap_unix(tcon->ses) && !tcon->broken_posix_open &&
 	    (CIFS_UNIX_POSIX_PATH_OPS_CAP &
@@ -276,6 +281,8 @@
 		desired_access |= GENERIC_READ; /* is this too little? */
 	if (OPEN_FMODE(oflags) & FMODE_WRITE)
 		desired_access |= GENERIC_WRITE;
+	if (rdwr_for_fscache == 1)
+		desired_access |= GENERIC_READ;
 
 	disposition = FILE_OVERWRITE_IF;
 	if ((oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
@@ -304,6 +311,7 @@
 	if (!tcon->unix_ext && (mode & S_IWUGO) == 0)
 		create_options |= CREATE_OPTION_READONLY;
 
+retry_open:
 	oparms = (struct cifs_open_parms) {
 		.tcon = tcon,
 		.cifs_sb = cifs_sb,
@@ -317,8 +325,15 @@
 	rc = server->ops->open(xid, &oparms, oplock, buf);
 	if (rc) {
 		cifs_dbg(FYI, "cifs_create returned 0x%x\n", rc);
+		if (rc == -EACCES && rdwr_for_fscache == 1) {
+			desired_access &= ~GENERIC_READ;
+			rdwr_for_fscache = 2;
+			goto retry_open;
+		}
 		goto out;
 	}
+	if (rdwr_for_fscache == 2)
+		cifs_invalidate_cache(inode, FSCACHE_INVAL_DIO_WRITE);
 
 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
 	/*
--- linux-qcom-6.8.0.orig/fs/smb/client/file.c
+++ linux-qcom-6.8.0/fs/smb/client/file.c
@@ -206,12 +206,12 @@
 	 */
 }
 
-static inline int cifs_convert_flags(unsigned int flags)
+static inline int cifs_convert_flags(unsigned int flags, int rdwr_for_fscache)
 {
 	if ((flags & O_ACCMODE) == O_RDONLY)
 		return GENERIC_READ;
 	else if ((flags & O_ACCMODE) == O_WRONLY)
-		return GENERIC_WRITE;
+		return rdwr_for_fscache == 1 ? (GENERIC_READ | GENERIC_WRITE) : GENERIC_WRITE;
 	else if ((flags & O_ACCMODE) == O_RDWR) {
 		/* GENERIC_ALL is too much permission to request
 		   can cause unnecessary access denied on create */
@@ -329,7 +329,7 @@
 		}
 	} else {
 		cifs_revalidate_mapping(*pinode);
-		rc = cifs_fattr_to_inode(*pinode, &fattr);
+		rc = cifs_fattr_to_inode(*pinode, &fattr, false);
 	}
 
 posix_open_ret:
@@ -348,11 +348,16 @@
 	int create_options = CREATE_NOT_DIR;
 	struct TCP_Server_Info *server = tcon->ses->server;
 	struct cifs_open_parms oparms;
+	int rdwr_for_fscache = 0;
 
 	if (!server->ops->open)
 		return -ENOSYS;
 
-	desired_access = cifs_convert_flags(f_flags);
+	/* If we're caching, we need to be able to fill in around partial writes. */
+	if (cifs_fscache_enabled(inode) && (f_flags & O_ACCMODE) == O_WRONLY)
+		rdwr_for_fscache = 1;
+
+	desired_access = cifs_convert_flags(f_flags, rdwr_for_fscache);
 
 /*********************************************************************
  *  open flag mapping table:
@@ -389,6 +394,7 @@
 	if (f_flags & O_DIRECT)
 		create_options |= CREATE_NO_BUFFER;
 
+retry_open:
 	oparms = (struct cifs_open_parms) {
 		.tcon = tcon,
 		.cifs_sb = cifs_sb,
@@ -400,8 +406,16 @@
 	};
 
 	rc = server->ops->open(xid, &oparms, oplock, buf);
-	if (rc)
+	if (rc) {
+		if (rc == -EACCES && rdwr_for_fscache == 1) {
+			desired_access = cifs_convert_flags(f_flags, 0);
+			rdwr_for_fscache = 2;
+			goto retry_open;
+		}
 		return rc;
+	}
+	if (rdwr_for_fscache == 2)
+		cifs_invalidate_cache(inode, FSCACHE_INVAL_DIO_WRITE);
 
 	/* TODO: Add support for calling posix query info but with passing in fid */
 	if (tcon->unix_ext)
@@ -445,6 +459,7 @@
 }
 
 static void cifsFileInfo_put_work(struct work_struct *work);
+void serverclose_work(struct work_struct *work);
 
 struct cifsFileInfo *cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
 				       struct tcon_link *tlink, __u32 oplock,
@@ -491,6 +506,7 @@
 	cfile->tlink = cifs_get_tlink(tlink);
 	INIT_WORK(&cfile->oplock_break, cifs_oplock_break);
 	INIT_WORK(&cfile->put, cifsFileInfo_put_work);
+	INIT_WORK(&cfile->serverclose, serverclose_work);
 	INIT_DELAYED_WORK(&cfile->deferred, smb2_deferred_work_close);
 	mutex_init(&cfile->fh_mutex);
 	spin_lock_init(&cfile->file_info_lock);
@@ -582,6 +598,40 @@
 	cifsFileInfo_put_final(cifs_file);
 }
 
+void serverclose_work(struct work_struct *work)
+{
+	struct cifsFileInfo *cifs_file = container_of(work,
+			struct cifsFileInfo, serverclose);
+
+	struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
+
+	struct TCP_Server_Info *server = tcon->ses->server;
+	int rc = 0;
+	int retries = 0;
+	int MAX_RETRIES = 4;
+
+	do {
+		if (server->ops->close_getattr)
+			rc = server->ops->close_getattr(0, tcon, cifs_file);
+		else if (server->ops->close)
+			rc = server->ops->close(0, tcon, &cifs_file->fid);
+
+		if (rc == -EBUSY || rc == -EAGAIN) {
+			retries++;
+			msleep(250);
+		}
+	} while ((rc == -EBUSY || rc == -EAGAIN) && (retries < MAX_RETRIES)
+	);
+
+	if (retries == MAX_RETRIES)
+		pr_warn("Serverclose failed %d times, giving up\n", MAX_RETRIES);
+
+	if (cifs_file->offload)
+		queue_work(fileinfo_put_wq, &cifs_file->put);
+	else
+		cifsFileInfo_put_final(cifs_file);
+}
+
 /**
  * cifsFileInfo_put - release a reference of file priv data
  *
@@ -622,10 +672,13 @@
 	struct cifs_fid fid = {};
 	struct cifs_pending_open open;
 	bool oplock_break_cancelled;
+	bool serverclose_offloaded = false;
 
 	spin_lock(&tcon->open_file_lock);
 	spin_lock(&cifsi->open_file_lock);
 	spin_lock(&cifs_file->file_info_lock);
+
+	cifs_file->offload = offload;
 	if (--cifs_file->count > 0) {
 		spin_unlock(&cifs_file->file_info_lock);
 		spin_unlock(&cifsi->open_file_lock);
@@ -667,13 +720,20 @@
 	if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
 		struct TCP_Server_Info *server = tcon->ses->server;
 		unsigned int xid;
+		int rc = 0;
 
 		xid = get_xid();
 		if (server->ops->close_getattr)
-			server->ops->close_getattr(xid, tcon, cifs_file);
+			rc = server->ops->close_getattr(xid, tcon, cifs_file);
 		else if (server->ops->close)
-			server->ops->close(xid, tcon, &cifs_file->fid);
+			rc = server->ops->close(xid, tcon, &cifs_file->fid);
 		_free_xid(xid);
+
+		if (rc == -EBUSY || rc == -EAGAIN) {
+			// Server close failed, hence offloading it as an async op
+			queue_work(serverclose_wq, &cifs_file->serverclose);
+			serverclose_offloaded = true;
+		}
 	}
 
 	if (oplock_break_cancelled)
@@ -681,10 +741,15 @@
 
 	cifs_del_pending_open(&open);
 
-	if (offload)
-		queue_work(fileinfo_put_wq, &cifs_file->put);
-	else
-		cifsFileInfo_put_final(cifs_file);
+	// if serverclose has been offloaded to wq (on failure), it will
+	// handle offloading put as well. If serverclose not offloaded,
+	// we need to handle offloading put here.
+	if (!serverclose_offloaded) {
+		if (offload)
+			queue_work(fileinfo_put_wq, &cifs_file->put);
+		else
+			cifsFileInfo_put_final(cifs_file);
+	}
 }
 
 int cifs_open(struct inode *inode, struct file *file)
@@ -834,11 +899,11 @@
 use_cache:
 	fscache_use_cookie(cifs_inode_cookie(file_inode(file)),
 			   file->f_mode & FMODE_WRITE);
-	if (file->f_flags & O_DIRECT &&
-	    (!((file->f_flags & O_ACCMODE) != O_RDONLY) ||
-	     file->f_flags & O_APPEND))
-		cifs_invalidate_cache(file_inode(file),
-				      FSCACHE_INVAL_DIO_WRITE);
+	if (!(file->f_flags & O_DIRECT))
+		goto out;
+	if ((file->f_flags & (O_ACCMODE | O_APPEND)) == O_RDONLY)
+		goto out;
+	cifs_invalidate_cache(file_inode(file), FSCACHE_INVAL_DIO_WRITE);
 
 out:
 	free_dentry_path(page);
@@ -903,6 +968,7 @@
 	int disposition = FILE_OPEN;
 	int create_options = CREATE_NOT_DIR;
 	struct cifs_open_parms oparms;
+	int rdwr_for_fscache = 0;
 
 	xid = get_xid();
 	mutex_lock(&cfile->fh_mutex);
@@ -966,7 +1032,11 @@
 	}
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
 
-	desired_access = cifs_convert_flags(cfile->f_flags);
+	/* If we're caching, we need to be able to fill in around partial writes. */
+	if (cifs_fscache_enabled(inode) && (cfile->f_flags & O_ACCMODE) == O_WRONLY)
+		rdwr_for_fscache = 1;
+
+	desired_access = cifs_convert_flags(cfile->f_flags, rdwr_for_fscache);
 
 	/* O_SYNC also has bit for O_DSYNC so following check picks up either */
 	if (cfile->f_flags & O_SYNC)
@@ -978,6 +1048,7 @@
 	if (server->ops->get_lease_key)
 		server->ops->get_lease_key(inode, &cfile->fid);
 
+retry_open:
 	oparms = (struct cifs_open_parms) {
 		.tcon = tcon,
 		.cifs_sb = cifs_sb,
@@ -1003,6 +1074,11 @@
 		/* indicate that we need to relock the file */
 		oparms.reconnect = true;
 	}
+	if (rc == -EACCES && rdwr_for_fscache == 1) {
+		desired_access = cifs_convert_flags(cfile->f_flags, 0);
+		rdwr_for_fscache = 2;
+		goto retry_open;
+	}
 
 	if (rc) {
 		mutex_unlock(&cfile->fh_mutex);
@@ -1011,6 +1087,9 @@
 		goto reopen_error_exit;
 	}
 
+	if (rdwr_for_fscache == 2)
+		cifs_invalidate_cache(inode, FSCACHE_INVAL_DIO_WRITE);
+
 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
 reopen_success:
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
@@ -2624,20 +2703,20 @@
  * dirty pages if possible, but don't sleep while doing so.
  */
 static void cifs_extend_writeback(struct address_space *mapping,
+				  struct xa_state *xas,
 				  long *_count,
 				  loff_t start,
 				  int max_pages,
-				  size_t max_len,
-				  unsigned int *_len)
+				  loff_t max_len,
+				  size_t *_len)
 {
 	struct folio_batch batch;
 	struct folio *folio;
-	unsigned int psize, nr_pages;
-	size_t len = *_len;
-	pgoff_t index = (start + len) / PAGE_SIZE;
+	unsigned int nr_pages;
+	pgoff_t index = (start + *_len) / PAGE_SIZE;
+	size_t len;
 	bool stop = true;
 	unsigned int i;
-	XA_STATE(xas, &mapping->i_pages, index);
 
 	folio_batch_init(&batch);
 
@@ -2648,54 +2727,64 @@
 		 */
 		rcu_read_lock();
 
-		xas_for_each(&xas, folio, ULONG_MAX) {
+		xas_for_each(xas, folio, ULONG_MAX) {
 			stop = true;
-			if (xas_retry(&xas, folio))
+			if (xas_retry(xas, folio))
 				continue;
 			if (xa_is_value(folio))
 				break;
-			if (folio->index != index)
+			if (folio->index != index) {
+				xas_reset(xas);
 				break;
-			if (!folio_try_get_rcu(folio)) {
-				xas_reset(&xas);
+			}
+
+			if (!folio_try_get(folio)) {
+				xas_reset(xas);
 				continue;
 			}
 			nr_pages = folio_nr_pages(folio);
-			if (nr_pages > max_pages)
+			if (nr_pages > max_pages) {
+				xas_reset(xas);
 				break;
+			}
 
 			/* Has the page moved or been split? */
-			if (unlikely(folio != xas_reload(&xas))) {
+			if (unlikely(folio != xas_reload(xas))) {
 				folio_put(folio);
+				xas_reset(xas);
 				break;
 			}
 
 			if (!folio_trylock(folio)) {
 				folio_put(folio);
+				xas_reset(xas);
 				break;
 			}
-			if (!folio_test_dirty(folio) || folio_test_writeback(folio)) {
+			if (!folio_test_dirty(folio) ||
+			    folio_test_writeback(folio)) {
 				folio_unlock(folio);
 				folio_put(folio);
+				xas_reset(xas);
 				break;
 			}
 
 			max_pages -= nr_pages;
-			psize = folio_size(folio);
-			len += psize;
+			len = folio_size(folio);
 			stop = false;
-			if (max_pages <= 0 || len >= max_len || *_count <= 0)
-				stop = true;
 
 			index += nr_pages;
+			*_count -= nr_pages;
+			*_len += len;
+			if (max_pages <= 0 || *_len >= max_len || *_count <= 0)
+				stop = true;
+
 			if (!folio_batch_add(&batch, folio))
 				break;
 			if (stop)
 				break;
 		}
 
-		if (!stop)
-			xas_pause(&xas);
+		xas_pause(xas);
 		rcu_read_unlock();
 
 		/* Now, if we obtained any pages, we can shift them to being
@@ -2712,16 +2801,12 @@
 			if (!folio_clear_dirty_for_io(folio))
 				WARN_ON(1);
 			folio_start_writeback(folio);
-
-			*_count -= folio_nr_pages(folio);
 			folio_unlock(folio);
 		}
 
 		folio_batch_release(&batch);
 		cond_resched();
 	} while (!stop);
-
-	*_len = len;
 }
 
 /*
@@ -2729,8 +2814,10 @@
  */
 static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping,
 						 struct writeback_control *wbc,
+						 struct xa_state *xas,
 						 struct folio *folio,
-						 loff_t start, loff_t end)
+						 unsigned long long start,
+						 unsigned long long end)
 {
 	struct inode *inode = mapping->host;
 	struct TCP_Server_Info *server;
@@ -2739,17 +2826,18 @@
 	struct cifs_credits credits_on_stack;
 	struct cifs_credits *credits = &credits_on_stack;
 	struct cifsFileInfo *cfile = NULL;
-	unsigned int xid, wsize, len;
-	loff_t i_size = i_size_read(inode);
-	size_t max_len;
+	unsigned long long i_size = i_size_read(inode), max_len;
+	unsigned int xid, wsize;
+	size_t len = folio_size(folio);
 	long count = wbc->nr_to_write;
 	int rc;
 
 	/* The folio should be locked, dirty and not undergoing writeback. */
+	if (!folio_clear_dirty_for_io(folio))
+		WARN_ON_ONCE(1);
 	folio_start_writeback(folio);
 
 	count -= folio_nr_pages(folio);
-	len = folio_size(folio);
 
 	xid = get_xid();
 	server = cifs_pick_channel(cifs_sb_master_tcon(cifs_sb)->ses);
@@ -2779,9 +2867,10 @@
 	wdata->server = server;
 	cfile = NULL;
 
-	/* Find all consecutive lockable dirty pages, stopping when we find a
-	 * page that is not immediately lockable, is not dirty or is missing,
-	 * or we reach the end of the range.
+	/* Find all consecutive lockable dirty pages that have contiguous
+	 * written regions, stopping when we find a page that is not
+	 * immediately lockable, is not dirty or is missing, or we reach the
+	 * end of the range.
 	 */
 	if (start < i_size) {
 		/* Trim the write to the EOF; the extra data is ignored.  Also
@@ -2801,19 +2890,18 @@
 			max_pages -= folio_nr_pages(folio);
 
 			if (max_pages > 0)
-				cifs_extend_writeback(mapping, &count, start,
+				cifs_extend_writeback(mapping, xas, &count, start,
 						      max_pages, max_len, &len);
 		}
-		len = min_t(loff_t, len, max_len);
 	}
-
-	wdata->bytes = len;
+	len = min_t(unsigned long long, len, i_size - start);
 
 	/* We now have a contiguous set of dirty pages, each with writeback
 	 * set; the first page is still locked at this point, but all the rest
 	 * have been unlocked.
 	 */
 	folio_unlock(folio);
+	wdata->bytes = len;
 
 	if (start < i_size) {
 		iov_iter_xarray(&wdata->iter, ITER_SOURCE, &mapping->i_pages,
@@ -2864,102 +2952,118 @@
 /*
  * write a region of pages back to the server
  */
-static int cifs_writepages_region(struct address_space *mapping,
-				  struct writeback_control *wbc,
-				  loff_t start, loff_t end, loff_t *_next)
+static ssize_t cifs_writepages_begin(struct address_space *mapping,
+				     struct writeback_control *wbc,
+				     struct xa_state *xas,
+				     unsigned long long *_start,
+				     unsigned long long end)
 {
-	struct folio_batch fbatch;
+	struct folio *folio;
+	unsigned long long start = *_start;
+	ssize_t ret;
 	int skips = 0;
 
-	folio_batch_init(&fbatch);
-	do {
-		int nr;
-		pgoff_t index = start / PAGE_SIZE;
+search_again:
+	/* Find the first dirty page. */
+	rcu_read_lock();
 
-		nr = filemap_get_folios_tag(mapping, &index, end / PAGE_SIZE,
-					    PAGECACHE_TAG_DIRTY, &fbatch);
-		if (!nr)
+	for (;;) {
+		folio = xas_find_marked(xas, end / PAGE_SIZE, PAGECACHE_TAG_DIRTY);
+		if (xas_retry(xas, folio) || xa_is_value(folio))
+			continue;
+		if (!folio)
 			break;
 
-		for (int i = 0; i < nr; i++) {
-			ssize_t ret;
-			struct folio *folio = fbatch.folios[i];
-
-redo_folio:
-			start = folio_pos(folio); /* May regress with THPs */
-
-			/* At this point we hold neither the i_pages lock nor the
-			 * page lock: the page may be truncated or invalidated
-			 * (changing page->mapping to NULL), or even swizzled
-			 * back from swapper_space to tmpfs file mapping
-			 */
-			if (wbc->sync_mode != WB_SYNC_NONE) {
-				ret = folio_lock_killable(folio);
-				if (ret < 0)
-					goto write_error;
-			} else {
-				if (!folio_trylock(folio))
-					goto skip_write;
-			}
-
-			if (folio->mapping != mapping ||
-			    !folio_test_dirty(folio)) {
-				start += folio_size(folio);
-				folio_unlock(folio);
-				continue;
-			}
+		if (!folio_try_get(folio)) {
+			xas_reset(xas);
+			continue;
+		}
 
-			if (folio_test_writeback(folio) ||
-			    folio_test_fscache(folio)) {
-				folio_unlock(folio);
-				if (wbc->sync_mode == WB_SYNC_NONE)
-					goto skip_write;
+		if (unlikely(folio != xas_reload(xas))) {
+			folio_put(folio);
+			xas_reset(xas);
+			continue;
+		}
 
-				folio_wait_writeback(folio);
-#ifdef CONFIG_CIFS_FSCACHE
-				folio_wait_fscache(folio);
-#endif
-				goto redo_folio;
-			}
+		xas_pause(xas);
+		break;
+	}
+	rcu_read_unlock();
+	if (!folio)
+		return 0;
 
-			if (!folio_clear_dirty_for_io(folio))
-				/* We hold the page lock - it should've been dirty. */
-				WARN_ON(1);
+	start = folio_pos(folio); /* May regress with THPs */
 
-			ret = cifs_write_back_from_locked_folio(mapping, wbc, folio, start, end);
-			if (ret < 0)
-				goto write_error;
+	/* At this point we hold neither the i_pages lock nor the page lock:
+	 * the page may be truncated or invalidated (changing page->mapping to
+	 * NULL), or even swizzled back from swapper_space to tmpfs file
+	 * mapping
+	 */
+lock_again:
+	if (wbc->sync_mode != WB_SYNC_NONE) {
+		ret = folio_lock_killable(folio);
+		if (ret < 0)
+			return ret;
+	} else {
+		if (!folio_trylock(folio))
+			goto search_again;
+	}
 
-			start += ret;
-			continue;
+	if (folio->mapping != mapping ||
+	    !folio_test_dirty(folio)) {
+		start += folio_size(folio);
+		folio_unlock(folio);
+		goto search_again;
+	}
 
-write_error:
-			folio_batch_release(&fbatch);
-			*_next = start;
-			return ret;
+	if (folio_test_writeback(folio) ||
+	    folio_test_fscache(folio)) {
+		folio_unlock(folio);
+		if (wbc->sync_mode != WB_SYNC_NONE) {
+			folio_wait_writeback(folio);
+#ifdef CONFIG_CIFS_FSCACHE
+			folio_wait_fscache(folio);
+#endif
+			goto lock_again;
+		}
 
-skip_write:
-			/*
-			 * Too many skipped writes, or need to reschedule?
-			 * Treat it as a write error without an error code.
-			 */
+		start += folio_size(folio);
+		if (wbc->sync_mode == WB_SYNC_NONE) {
 			if (skips >= 5 || need_resched()) {
 				ret = 0;
-				goto write_error;
+				goto out;
 			}
-
-			/* Otherwise, just skip that folio and go on to the next */
 			skips++;
-			start += folio_size(folio);
-			continue;
 		}
+		goto search_again;
+	}
 
-		folio_batch_release(&fbatch);		
-		cond_resched();
-	} while (wbc->nr_to_write > 0);
+	ret = cifs_write_back_from_locked_folio(mapping, wbc, xas, folio, start, end);
+out:
+	if (ret > 0)
+		*_start = start + ret;
+	return ret;
+}
 
-	*_next = start;
-	return 0;
+/*
+ * Write a region of pages back to the server
+ */
+static int cifs_writepages_region(struct address_space *mapping,
+				  struct writeback_control *wbc,
+				  unsigned long long *_start,
+				  unsigned long long end)
+{
+	ssize_t ret;
+
+	XA_STATE(xas, &mapping->i_pages, *_start / PAGE_SIZE);
+
+	do {
+		ret = cifs_writepages_begin(mapping, wbc, &xas, _start, end);
+		if (ret > 0 && wbc->nr_to_write > 0)
+			cond_resched();
+	} while (ret > 0 && wbc->nr_to_write > 0);
+
+	return ret > 0 ? 0 : ret;
 }
 
 /*
@@ -2968,7 +3072,7 @@
 static int cifs_writepages(struct address_space *mapping,
 			   struct writeback_control *wbc)
 {
-	loff_t start, next;
+	loff_t start, end;
 	int ret;
 
 	/* We have to be careful as we can end up racing with setattr()
@@ -2976,28 +3080,34 @@
 	 * to prevent it.
 	 */
 
-	if (wbc->range_cyclic) {
+	if (wbc->range_cyclic && mapping->writeback_index) {
 		start = mapping->writeback_index * PAGE_SIZE;
-		ret = cifs_writepages_region(mapping, wbc, start, LLONG_MAX, &next);
-		if (ret == 0) {
-			mapping->writeback_index = next / PAGE_SIZE;
-			if (start > 0 && wbc->nr_to_write > 0) {
-				ret = cifs_writepages_region(mapping, wbc, 0,
-							     start, &next);
-				if (ret == 0)
-					mapping->writeback_index =
-						next / PAGE_SIZE;
-			}
+		ret = cifs_writepages_region(mapping, wbc, &start, LLONG_MAX);
+		if (ret < 0)
+			goto out;
+
+		if (wbc->nr_to_write <= 0) {
+			mapping->writeback_index = start / PAGE_SIZE;
+			goto out;
 		}
+
+		start = 0;
+		end = mapping->writeback_index * PAGE_SIZE;
+		mapping->writeback_index = 0;
+		ret = cifs_writepages_region(mapping, wbc, &start, end);
+		if (ret == 0)
+			mapping->writeback_index = start / PAGE_SIZE;
 	} else if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX) {
-		ret = cifs_writepages_region(mapping, wbc, 0, LLONG_MAX, &next);
+		start = 0;
+		ret = cifs_writepages_region(mapping, wbc, &start, LLONG_MAX);
 		if (wbc->nr_to_write > 0 && ret == 0)
-			mapping->writeback_index = next / PAGE_SIZE;
+			mapping->writeback_index = start / PAGE_SIZE;
 	} else {
-		ret = cifs_writepages_region(mapping, wbc,
-					     wbc->range_start, wbc->range_end, &next);
+		start = wbc->range_start;
+		ret = cifs_writepages_region(mapping, wbc, &start, wbc->range_end);
 	}
 
+out:
 	return ret;
 }
 
@@ -3711,6 +3821,7 @@
 	struct inode *inode = file->f_mapping->host;
 	struct cifsInodeInfo *cinode = CIFS_I(inode);
 	struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;
+	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
 	ssize_t rc;
 
 	inode_lock(inode);
@@ -3724,12 +3835,16 @@
 	if (rc <= 0)
 		goto out;
 
-	if (!cifs_find_lock_conflict(cfile, iocb->ki_pos, iov_iter_count(from),
+	if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOPOSIXBRL) &&
+	    (cifs_find_lock_conflict(cfile, iocb->ki_pos, iov_iter_count(from),
 				     server->vals->exclusive_lock_type, 0,
-				     NULL, CIFS_WRITE_OP))
-		rc = __generic_file_write_iter(iocb, from);
-	else
+				     NULL, CIFS_WRITE_OP))) {
 		rc = -EACCES;
+		goto out;
+	}
+
+	rc = __generic_file_write_iter(iocb, from);
+
 out:
 	up_read(&cinode->lock_sem);
 	inode_unlock(inode);
@@ -4256,9 +4371,7 @@
 	if (!CIFS_CACHE_READ(cinode))
 		return cifs_user_readv(iocb, to);
 
-	if (cap_unix(tcon->ses) &&
-	    (CIFS_UNIX_FCNTL_CAP & le64_to_cpu(tcon->fsUnixInfo.Capability)) &&
-	    ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOPOSIXBRL) == 0))
+	if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOPOSIXBRL) == 0)
 		return generic_file_read_iter(iocb, to);
 
 	/*
@@ -4738,12 +4851,14 @@
    refreshing the inode only on increases in the file size
    but this is tricky to do without racing with writebehind
    page caching in the current Linux kernel design */
-bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file)
+bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file,
+			    bool from_readdir)
 {
 	if (!cifsInode)
 		return true;
 
-	if (is_inode_writable(cifsInode)) {
+	if (is_inode_writable(cifsInode) ||
+		((cifsInode->oplock & CIFS_CACHE_RW_FLG) != 0 && from_readdir)) {
 		/* This inode is open for write at least once */
 		struct cifs_sb_info *cifs_sb;
 
--- linux-qcom-6.8.0.orig/fs/smb/client/fs_context.c
+++ linux-qcom-6.8.0/fs/smb/client/fs_context.c
@@ -37,7 +37,7 @@
 #include "rfc1002pdu.h"
 #include "fs_context.h"
 
-static DEFINE_MUTEX(cifs_mount_mutex);
+DEFINE_MUTEX(cifs_mount_mutex);
 
 static const match_table_t cifs_smb_version_tokens = {
 	{ Smb_1, SMB1_VERSION_STRING },
@@ -67,6 +67,12 @@
 	{ Opt_sec_err, NULL }
 };
 
+static const match_table_t cifs_upcall_target = {
+	{ Opt_upcall_target_mount, "mount" },
+	{ Opt_upcall_target_application, "app" },
+	{ Opt_upcall_target_err, NULL }
+};
+
 const struct fs_parameter_spec smb3_fs_parameters[] = {
 	/* Mount options that take no arguments */
 	fsparam_flag_no("user_xattr", Opt_user_xattr),
@@ -162,6 +168,7 @@
 	fsparam_string("username", Opt_user),
 	fsparam_string("pass", Opt_pass),
 	fsparam_string("password", Opt_pass),
+	fsparam_string("password2", Opt_pass2),
 	fsparam_string("ip", Opt_ip),
 	fsparam_string("addr", Opt_ip),
 	fsparam_string("domain", Opt_domain),
@@ -174,6 +181,7 @@
 	fsparam_string("vers", Opt_vers),
 	fsparam_string("sec", Opt_sec),
 	fsparam_string("cache", Opt_cache),
+	fsparam_string("upcall_target", Opt_upcalltarget),
 
 	/* Arguments that should be ignored */
 	fsparam_flag("guest", Opt_ignore),
@@ -244,6 +252,29 @@
 	return 0;
 }
 
+static int
+cifs_parse_upcall_target(struct fs_context *fc, char *value, struct smb3_fs_context *ctx)
+{
+	substring_t args[MAX_OPT_ARGS];
+
+	ctx->upcall_target = UPTARGET_UNSPECIFIED;
+
+	switch (match_token(value, cifs_upcall_target, args)) {
+	case Opt_upcall_target_mount:
+		ctx->upcall_target = UPTARGET_MOUNT;
+		break;
+	case Opt_upcall_target_application:
+		ctx->upcall_target = UPTARGET_APP;
+		break;
+
+	default:
+		cifs_errorf(fc, "bad upcall target: %s\n", value);
+		return 1;
+	}
+
+	return 0;
+}
+
 static const match_table_t cifs_cacheflavor_tokens = {
 	{ Opt_cache_loose, "loose" },
 	{ Opt_cache_strict, "strict" },
@@ -315,6 +346,7 @@
 	new_ctx->nodename = NULL;
 	new_ctx->username = NULL;
 	new_ctx->password = NULL;
+	new_ctx->password2 = NULL;
 	new_ctx->server_hostname = NULL;
 	new_ctx->domainname = NULL;
 	new_ctx->UNC = NULL;
@@ -327,6 +359,7 @@
 	DUP_CTX_STR(prepath);
 	DUP_CTX_STR(username);
 	DUP_CTX_STR(password);
+	DUP_CTX_STR(password2);
 	DUP_CTX_STR(server_hostname);
 	DUP_CTX_STR(UNC);
 	DUP_CTX_STR(source);
@@ -715,6 +748,16 @@
 	/* set the port that we got earlier */
 	cifs_set_port((struct sockaddr *)&ctx->dstaddr, ctx->port);
 
+	if (ctx->uid_specified && !ctx->forceuid_specified) {
+		ctx->override_uid = 1;
+		pr_notice("enabling forceuid mount option implicitly because uid= option is specified\n");
+	}
+
+	if (ctx->gid_specified && !ctx->forcegid_specified) {
+		ctx->override_gid = 1;
+		pr_notice("enabling forcegid mount option implicitly because gid= option is specified\n");
+	}
+
 	if (ctx->override_uid && !ctx->uid_specified) {
 		ctx->override_uid = 0;
 		pr_notice("ignoring forceuid mount option specified with no uid= option\n");
@@ -753,9 +796,9 @@
 
 	if (err)
 		return err;
-	mutex_lock(&cifs_mount_mutex);
+	cifs_mount_lock();
 	ret = smb3_get_tree_common(fc);
-	mutex_unlock(&cifs_mount_mutex);
+	cifs_mount_unlock();
 	return ret;
 }
 
@@ -772,7 +815,7 @@
  */
 static int smb3_verify_reconfigure_ctx(struct fs_context *fc,
 				       struct smb3_fs_context *new_ctx,
-				       struct smb3_fs_context *old_ctx)
+				       struct smb3_fs_context *old_ctx, bool need_recon)
 {
 	if (new_ctx->posix_paths != old_ctx->posix_paths) {
 		cifs_errorf(fc, "can not change posixpaths during remount\n");
@@ -798,8 +841,15 @@
 	}
 	if (new_ctx->password &&
 	    (!old_ctx->password || strcmp(new_ctx->password, old_ctx->password))) {
-		cifs_errorf(fc, "can not change password during remount\n");
-		return -EINVAL;
+		if (need_recon == false) {
+			cifs_errorf(fc,
+				    "can not change password of active session during remount\n");
+			return -EINVAL;
+		} else if (old_ctx->sectype == Kerberos) {
+			cifs_errorf(fc,
+				    "can not change password for Kerberos via remount\n");
+			return -EINVAL;
+		}
 	}
 	if (new_ctx->domainname &&
 	    (!old_ctx->domainname || strcmp(new_ctx->domainname, old_ctx->domainname))) {
@@ -838,14 +888,44 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
+int smb3_sync_session_ctx_passwords(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses)
+{
+	if (ses->password &&
+	    cifs_sb->ctx->password &&
+	    strcmp(ses->password, cifs_sb->ctx->password)) {
+		kfree_sensitive(cifs_sb->ctx->password);
+		cifs_sb->ctx->password = kstrdup(ses->password, GFP_KERNEL);
+		if (!cifs_sb->ctx->password)
+			return -ENOMEM;
+	}
+	if (ses->password2 &&
+	    cifs_sb->ctx->password2 &&
+	    strcmp(ses->password2, cifs_sb->ctx->password2)) {
+		kfree_sensitive(cifs_sb->ctx->password2);
+		cifs_sb->ctx->password2 = kstrdup(ses->password2, GFP_KERNEL);
+		if (!cifs_sb->ctx->password2) {
+			kfree_sensitive(cifs_sb->ctx->password);
+			cifs_sb->ctx->password = NULL;
+			return -ENOMEM;
+		}
+	}
+	return 0;
+}
+
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
 	struct dentry *root = fc->root;
 	struct cifs_sb_info *cifs_sb = CIFS_SB(root->d_sb);
+	struct cifs_ses *ses = cifs_sb_master_tcon(cifs_sb)->ses;
+	char *new_password = NULL, *new_password2 = NULL;
+	bool need_recon = false;
 	int rc;
 
-	rc = smb3_verify_reconfigure_ctx(fc, ctx, cifs_sb->ctx);
+	if (ses->expired_pwd)
+		need_recon = true;
+
+	rc = smb3_verify_reconfigure_ctx(fc, ctx, cifs_sb->ctx, need_recon);
 	if (rc)
 		return rc;
 
@@ -858,7 +938,63 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
+
+	if (need_recon == false)
+		STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
+	else  {
+		if (ctx->password) {
+			new_password = kstrdup(ctx->password, GFP_KERNEL);
+			if (!new_password)
+				return -ENOMEM;
+		} else
+			STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
+	}
+
+	/*
+	 * if a new password2 has been specified, then reset it's value
+	 * inside the ses struct
+	 */
+	if (ctx->password2) {
+		new_password2 = kstrdup(ctx->password2, GFP_KERNEL);
+		if (!new_password2) {
+			kfree_sensitive(new_password);
+			return -ENOMEM;
+		}
+	} else
+		STEAL_STRING_SENSITIVE(cifs_sb, ctx, password2);
+
+	/*
+	 * we may update the passwords in the ses struct below. Make sure we do
+	 * not race with smb2_reconnect
+	 */
+	mutex_lock(&ses->session_mutex);
+
+	/*
+	 * smb2_reconnect may swap password and password2 in case session setup
+	 * failed. First get ctx passwords in sync with ses passwords. It should
+	 * be okay to do this even if this function were to return an error at a
+	 * later stage
+	 */
+	rc = smb3_sync_session_ctx_passwords(cifs_sb, ses);
+	if (rc) {
+		mutex_unlock(&ses->session_mutex);
+		return rc;
+	}
+
+	/*
+	 * now that allocations for passwords are done, commit them
+	 */
+	if (new_password) {
+		kfree_sensitive(ses->password);
+		ses->password = new_password;
+	}
+	if (new_password2) {
+		kfree_sensitive(ses->password2);
+		ses->password2 = new_password2;
+	}
+
+	mutex_unlock(&ses->session_mutex);
+
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -967,12 +1103,14 @@
 			ctx->override_uid = 0;
 		else
 			ctx->override_uid = 1;
+		ctx->forceuid_specified = true;
 		break;
 	case Opt_forcegid:
 		if (result.negated)
 			ctx->override_gid = 0;
 		else
 			ctx->override_gid = 1;
+		ctx->forcegid_specified = true;
 		break;
 	case Opt_perm:
 		if (result.negated)
@@ -1258,6 +1396,18 @@
 			goto cifs_parse_mount_err;
 		}
 		break;
+	case Opt_pass2:
+		kfree_sensitive(ctx->password2);
+		ctx->password2 = NULL;
+		if (strlen(param->string) == 0)
+			break;
+
+		ctx->password2 = kstrdup(param->string, GFP_KERNEL);
+		if (ctx->password2 == NULL) {
+			cifs_errorf(fc, "OOM when copying password2 string\n");
+			goto cifs_parse_mount_err;
+		}
+		break;
 	case Opt_ip:
 		if (strlen(param->string) == 0) {
 			ctx->got_ip = false;
@@ -1379,6 +1529,10 @@
 		if (cifs_parse_security_flavors(fc, param->string, ctx) != 0)
 			goto cifs_parse_mount_err;
 		break;
+	case Opt_upcalltarget:
+		if (cifs_parse_upcall_target(fc, param->string, ctx) != 0)
+			goto cifs_parse_mount_err;
+		break;
 	case Opt_cache:
 		if (cifs_parse_cache_flavor(fc, param->string, ctx) != 0)
 			goto cifs_parse_mount_err;
@@ -1552,11 +1706,18 @@
 	}
 	/* case Opt_ignore: - is ignored as expected ... */
 
+	if (ctx->multiuser && ctx->upcall_target == UPTARGET_MOUNT) {
+		cifs_errorf(fc, "multiuser mount option not supported with upcalltarget set as 'mount'\n");
+		goto cifs_parse_mount_err;
+	}
+
 	return 0;
 
  cifs_parse_mount_err:
 	kfree_sensitive(ctx->password);
 	ctx->password = NULL;
+	kfree_sensitive(ctx->password2);
+	ctx->password2 = NULL;
 	return -EINVAL;
 }
 
@@ -1661,6 +1822,8 @@
 	ctx->username = NULL;
 	kfree_sensitive(ctx->password);
 	ctx->password = NULL;
+	kfree_sensitive(ctx->password2);
+	ctx->password2 = NULL;
 	kfree(ctx->server_hostname);
 	ctx->server_hostname = NULL;
 	kfree(ctx->UNC);
--- linux-qcom-6.8.0.orig/fs/smb/client/fs_context.h
+++ linux-qcom-6.8.0/fs/smb/client/fs_context.h
@@ -54,6 +54,12 @@
 	Opt_sec_err
 };
 
+enum cifs_upcall_target_param {
+	Opt_upcall_target_mount,
+	Opt_upcall_target_application,
+	Opt_upcall_target_err
+};
+
 enum cifs_param {
 	/* Mount options that take no arguments */
 	Opt_user_xattr,
@@ -107,6 +113,8 @@
 	Opt_multichannel,
 	Opt_compress,
 	Opt_witness,
+	Opt_is_upcall_target_mount,
+	Opt_is_upcall_target_application,
 
 	/* Mount options which take numeric value */
 	Opt_backupuid,
@@ -138,6 +146,7 @@
 	Opt_source,
 	Opt_user,
 	Opt_pass,
+	Opt_pass2,
 	Opt_ip,
 	Opt_domain,
 	Opt_srcaddr,
@@ -148,6 +157,7 @@
 	Opt_vers,
 	Opt_sec,
 	Opt_cache,
+	Opt_upcalltarget,
 
 	/* Mount options to be ignored */
 	Opt_ignore,
@@ -156,6 +166,8 @@
 };
 
 struct smb3_fs_context {
+	bool forceuid_specified;
+	bool forcegid_specified;
 	bool uid_specified;
 	bool cruid_specified;
 	bool gid_specified;
@@ -169,6 +181,7 @@
 
 	char *username;
 	char *password;
+	char *password2;
 	char *domainname;
 	char *source;
 	char *server_hostname;
@@ -186,6 +199,7 @@
 	umode_t file_mode;
 	umode_t dir_mode;
 	enum securityEnum sectype; /* sectype requested via mnt opts */
+	enum upcall_target_enum upcall_target; /* where to upcall for mount */
 	bool sign; /* was signing requested via mnt opts? */
 	bool ignore_signature:1;
 	bool retry:1;
@@ -285,6 +299,7 @@
 }
 
 extern int smb3_fs_context_dup(struct smb3_fs_context *new_ctx, struct smb3_fs_context *ctx);
+extern int smb3_sync_session_ctx_passwords(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses);
 extern void smb3_update_mnt_flags(struct cifs_sb_info *cifs_sb);
 
 /*
@@ -295,4 +310,16 @@
 #define MAX_CACHED_FIDS 16
 extern char *cifs_sanitize_prepath(char *prepath, gfp_t gfp);
 
+extern struct mutex cifs_mount_mutex;
+
+static inline void cifs_mount_lock(void)
+{
+	mutex_lock(&cifs_mount_mutex);
+}
+
+static inline void cifs_mount_unlock(void)
+{
+	mutex_unlock(&cifs_mount_mutex);
+}
+
 #endif
--- linux-qcom-6.8.0.orig/fs/smb/client/fscache.c
+++ linux-qcom-6.8.0/fs/smb/client/fscache.c
@@ -12,6 +12,16 @@
 #include "cifs_fs_sb.h"
 #include "cifsproto.h"
 
+/*
+ * Key for fscache inode.  [!] Contents must match comparisons in cifs_find_inode().
+ */
+struct cifs_fscache_inode_key {
+
+	__le64  uniqueid;	/* server inode number */
+	__le64  createtime;	/* creation time on server */
+	u8	type;		/* S_IFMT file type */
+} __packed;
+
 static void cifs_fscache_fill_volume_coherency(
 	struct cifs_tcon *tcon,
 	struct cifs_fscache_volume_coherency_data *cd)
@@ -33,12 +43,23 @@
 	char *key;
 	int ret = -ENOMEM;
 
+	if (tcon->fscache_acquired)
+		return 0;
+
+	mutex_lock(&tcon->fscache_lock);
+	if (tcon->fscache_acquired) {
+		mutex_unlock(&tcon->fscache_lock);
+		return 0;
+	}
+	tcon->fscache_acquired = true;
+
 	tcon->fscache = NULL;
 	switch (sa->sa_family) {
 	case AF_INET:
 	case AF_INET6:
 		break;
 	default:
+		mutex_unlock(&tcon->fscache_lock);
 		cifs_dbg(VFS, "Unknown network family '%d'\n", sa->sa_family);
 		return -EINVAL;
 	}
@@ -47,6 +68,7 @@
 
 	sharename = extract_sharename(tcon->tree_name);
 	if (IS_ERR(sharename)) {
+		mutex_unlock(&tcon->fscache_lock);
 		cifs_dbg(FYI, "%s: couldn't extract sharename\n", __func__);
 		return PTR_ERR(sharename);
 	}
@@ -72,6 +94,11 @@
 		}
 		pr_err("Cache volume key already in use (%s)\n", key);
 		vcookie = NULL;
+		trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+				    netfs_trace_tcon_ref_see_fscache_collision);
+	} else {
+		trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+				    netfs_trace_tcon_ref_see_fscache_okay);
 	}
 
 	tcon->fscache = vcookie;
@@ -80,6 +107,7 @@
 	kfree(key);
 out:
 	kfree(sharename);
+	mutex_unlock(&tcon->fscache_lock);
 	return ret;
 }
 
@@ -92,20 +120,26 @@
 	cifs_fscache_fill_volume_coherency(tcon, &cd);
 	fscache_relinquish_volume(tcon->fscache, &cd, false);
 	tcon->fscache = NULL;
+	trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+			    netfs_trace_tcon_ref_see_fscache_relinq);
 }
 
 void cifs_fscache_get_inode_cookie(struct inode *inode)
 {
 	struct cifs_fscache_inode_coherency_data cd;
+	struct cifs_fscache_inode_key key;
 	struct cifsInodeInfo *cifsi = CIFS_I(inode);
 	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
 	struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
 
+	key.uniqueid	= cpu_to_le64(cifsi->uniqueid);
+	key.createtime	= cpu_to_le64(cifsi->createtime);
+	key.type	= (inode->i_mode & S_IFMT) >> 12;
 	cifs_fscache_fill_coherency(&cifsi->netfs.inode, &cd);
 
 	cifsi->netfs.cache =
 		fscache_acquire_cookie(tcon->fscache, 0,
-				       &cifsi->uniqueid, sizeof(cifsi->uniqueid),
+				       &key, sizeof(key),
 				       &cd, sizeof(cd),
 				       i_size_read(&cifsi->netfs.inode));
 	if (cifsi->netfs.cache)
--- linux-qcom-6.8.0.orig/fs/smb/client/fscache.h
+++ linux-qcom-6.8.0/fs/smb/client/fscache.h
@@ -109,6 +109,11 @@
 		__cifs_readahead_to_fscache(inode, pos, len);
 }
 
+static inline bool cifs_fscache_enabled(struct inode *inode)
+{
+	return fscache_cookie_enabled(cifs_inode_cookie(inode));
+}
+
 #else /* CONFIG_CIFS_FSCACHE */
 static inline
 void cifs_fscache_fill_coherency(struct inode *inode,
@@ -124,6 +129,7 @@
 static inline void cifs_fscache_unuse_inode_cookie(struct inode *inode, bool update) {}
 static inline struct fscache_cookie *cifs_inode_cookie(struct inode *inode) { return NULL; }
 static inline void cifs_invalidate_cache(struct inode *inode, unsigned int flags) {}
+static inline bool cifs_fscache_enabled(struct inode *inode) { return false; }
 
 static inline int cifs_fscache_query_occupancy(struct inode *inode,
 					       pgoff_t first, unsigned int nr_pages,
--- linux-qcom-6.8.0.orig/fs/smb/client/inode.c
+++ linux-qcom-6.8.0/fs/smb/client/inode.c
@@ -26,6 +26,7 @@
 #include "fs_context.h"
 #include "cifs_ioctl.h"
 #include "cached_dir.h"
+#include "reparse.h"
 
 static void cifs_set_ops(struct inode *inode)
 {
@@ -147,7 +148,8 @@
 
 /* populate an inode with info from a cifs_fattr struct */
 int
-cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
+cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr,
+		    bool from_readdir)
 {
 	struct cifsInodeInfo *cifs_i = CIFS_I(inode);
 	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
@@ -157,6 +159,8 @@
 		CIFS_I(inode)->time = 0; /* force reval */
 		return -ESTALE;
 	}
+	if (inode->i_state & I_NEW)
+		CIFS_I(inode)->netfs.zero_point = fattr->cf_eof;
 
 	cifs_revalidate_cache(inode, fattr);
 
@@ -199,7 +203,7 @@
 	 * Can't safely change the file size here if the client is writing to
 	 * it due to potential races.
 	 */
-	if (is_size_safe_to_change(cifs_i, fattr->cf_eof)) {
+	if (is_size_safe_to_change(cifs_i, fattr->cf_eof, from_readdir)) {
 		i_size_write(inode, fattr->cf_eof);
 
 		/*
@@ -368,7 +372,7 @@
 		CIFS_I(*inode)->time = 0; /* force reval */
 		return -ESTALE;
 	}
-	return cifs_fattr_to_inode(*inode, fattr);
+	return cifs_fattr_to_inode(*inode, fattr, false);
 }
 
 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
@@ -403,7 +407,7 @@
 	} else
 		goto cifs_gfiunix_out;
 
-	rc = cifs_fattr_to_inode(inode, &fattr);
+	rc = cifs_fattr_to_inode(inode, &fattr, false);
 
 cifs_gfiunix_out:
 	free_xid(xid);
@@ -727,84 +731,6 @@
 		fattr->cf_mode, fattr->cf_uniqueid, fattr->cf_nlink);
 }
 
-static inline dev_t nfs_mkdev(struct reparse_posix_data *buf)
-{
-	u64 v = le64_to_cpu(*(__le64 *)buf->DataBuffer);
-
-	return MKDEV(v >> 32, v & 0xffffffff);
-}
-
-bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,
-				 struct cifs_fattr *fattr,
-				 struct cifs_open_info_data *data)
-{
-	struct reparse_posix_data *buf = data->reparse.posix;
-	u32 tag = data->reparse.tag;
-
-	if (tag == IO_REPARSE_TAG_NFS && buf) {
-		switch (le64_to_cpu(buf->InodeType)) {
-		case NFS_SPECFILE_CHR:
-			fattr->cf_mode |= S_IFCHR;
-			fattr->cf_dtype = DT_CHR;
-			fattr->cf_rdev = nfs_mkdev(buf);
-			break;
-		case NFS_SPECFILE_BLK:
-			fattr->cf_mode |= S_IFBLK;
-			fattr->cf_dtype = DT_BLK;
-			fattr->cf_rdev = nfs_mkdev(buf);
-			break;
-		case NFS_SPECFILE_FIFO:
-			fattr->cf_mode |= S_IFIFO;
-			fattr->cf_dtype = DT_FIFO;
-			break;
-		case NFS_SPECFILE_SOCK:
-			fattr->cf_mode |= S_IFSOCK;
-			fattr->cf_dtype = DT_SOCK;
-			break;
-		case NFS_SPECFILE_LNK:
-			fattr->cf_mode |= S_IFLNK;
-			fattr->cf_dtype = DT_LNK;
-			break;
-		default:
-			WARN_ON_ONCE(1);
-			return false;
-		}
-		return true;
-	}
-
-	switch (tag) {
-	case IO_REPARSE_TAG_LX_SYMLINK:
-		fattr->cf_mode |= S_IFLNK;
-		fattr->cf_dtype = DT_LNK;
-		break;
-	case IO_REPARSE_TAG_LX_FIFO:
-		fattr->cf_mode |= S_IFIFO;
-		fattr->cf_dtype = DT_FIFO;
-		break;
-	case IO_REPARSE_TAG_AF_UNIX:
-		fattr->cf_mode |= S_IFSOCK;
-		fattr->cf_dtype = DT_SOCK;
-		break;
-	case IO_REPARSE_TAG_LX_CHR:
-		fattr->cf_mode |= S_IFCHR;
-		fattr->cf_dtype = DT_CHR;
-		break;
-	case IO_REPARSE_TAG_LX_BLK:
-		fattr->cf_mode |= S_IFBLK;
-		fattr->cf_dtype = DT_BLK;
-		break;
-	case 0: /* SMB1 symlink */
-	case IO_REPARSE_TAG_SYMLINK:
-	case IO_REPARSE_TAG_NFS:
-		fattr->cf_mode |= S_IFLNK;
-		fattr->cf_dtype = DT_LNK;
-		break;
-	default:
-		return false;
-	}
-	return true;
-}
-
 static void cifs_open_info_to_fattr(struct cifs_fattr *fattr,
 				    struct cifs_open_info_data *data,
 				    struct super_block *sb)
@@ -854,10 +780,6 @@
 		fattr->cf_mode = S_IFREG | cifs_sb->ctx->file_mode;
 		fattr->cf_dtype = DT_REG;
 
-		/* clear write bits if ATTR_READONLY is set */
-		if (fattr->cf_cifsattrs & ATTR_READONLY)
-			fattr->cf_mode &= ~(S_IWUGO);
-
 		/*
 		 * Don't accept zero nlink from non-unix servers unless
 		 * delete is pending.  Instead mark it as unknown.
@@ -870,6 +792,10 @@
 		}
 	}
 
+	/* clear write bits if ATTR_READONLY is set */
+	if (fattr->cf_cifsattrs & ATTR_READONLY)
+		fattr->cf_mode &= ~(S_IWUGO);
+
 out_reparse:
 	if (S_ISLNK(fattr->cf_mode)) {
 		if (likely(data->symlink_target))
@@ -934,7 +860,7 @@
 	fattr.cf_uniqueid = CIFS_I(inode)->uniqueid;
 	fattr.cf_flags |= CIFS_FATTR_NEED_REVAL;
 	/* if filetype is different, return error */
-	rc = cifs_fattr_to_inode(inode, &fattr);
+	rc = cifs_fattr_to_inode(inode, &fattr, false);
 cgfi_exit:
 	cifs_free_open_info(&data);
 	free_xid(xid);
@@ -1089,13 +1015,26 @@
 	}
 
 	rc = -EOPNOTSUPP;
-	switch ((data->reparse.tag = tag)) {
-	case 0: /* SMB1 symlink */
+	data->reparse.tag = tag;
+	if (!data->reparse.tag) {
 		if (server->ops->query_symlink) {
 			rc = server->ops->query_symlink(xid, tcon,
 							cifs_sb, full_path,
 							&data->symlink_target);
 		}
+		if (rc == -EOPNOTSUPP)
+			data->reparse.tag = IO_REPARSE_TAG_INTERNAL;
+	}
+
+	switch (data->reparse.tag) {
+	case 0: /* SMB1 symlink */
+		break;
+	case IO_REPARSE_TAG_INTERNAL:
+		rc = 0;
+		if (le32_to_cpu(data->fi.Attributes) & ATTR_DIRECTORY) {
+			cifs_create_junction_fattr(fattr, sb);
+			goto out;
+		}
 		break;
 	case IO_REPARSE_TAG_MOUNT_POINT:
 		cifs_create_junction_fattr(fattr, sb);
@@ -1107,6 +1046,7 @@
 			rc = 0;
 		} else if (iov && server->ops->parse_reparse_point) {
 			rc = server->ops->parse_reparse_point(cifs_sb,
+							      full_path,
 							      iov, data);
 		}
 		break;
@@ -1262,11 +1202,14 @@
 				 __func__, rc);
 			goto out;
 		}
-	}
-
-	/* fill in remaining high mode bits e.g. SUID, VTX */
-	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)
+	} else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)
+		/* fill in remaining high mode bits e.g. SUID, VTX */
 		cifs_sfu_mode(fattr, full_path, cifs_sb, xid);
+	else if (!(tcon->posix_extensions))
+		/* clear write bits if ATTR_READONLY is set */
+		if (fattr->cf_cifsattrs & ATTR_READONLY)
+			fattr->cf_mode &= ~(S_IWUGO);
+
 
 	/* check for Minshall+French symlinks */
 	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MF_SYMLINKS) {
@@ -1413,6 +1356,8 @@
 {
 	struct cifs_fattr *fattr = opaque;
 
+	/* [!] The compared values must be the same in struct cifs_fscache_inode_key. */
+
 	/* don't match inode with different uniqueid */
 	if (CIFS_I(inode)->uniqueid != fattr->cf_uniqueid)
 		return 0;
@@ -1491,7 +1436,7 @@
 		}
 
 		/* can't fail - see cifs_find_inode() */
-		cifs_fattr_to_inode(inode, fattr);
+		cifs_fattr_to_inode(inode, fattr, false);
 		if (sb->s_flags & SB_NOATIME)
 			inode->i_flags |= S_NOATIME | S_NOCMTIME;
 		if (inode->i_state & I_NEW) {
@@ -2448,13 +2393,10 @@
 		return true;
 
 	if (!open_cached_dir_by_dentry(tcon, dentry->d_parent, &cfid)) {
-		spin_lock(&cfid->fid_lock);
 		if (cfid->time && cifs_i->time > cfid->time) {
-			spin_unlock(&cfid->fid_lock);
 			close_cached_dir(cfid);
 			return false;
 		}
-		spin_unlock(&cfid->fid_lock);
 		close_cached_dir(cfid);
 	}
 	/*
@@ -3050,6 +2992,7 @@
 	int rc = -EACCES;
 	__u32 dosattr = 0;
 	__u64 mode = NO_CHANGE_64;
+	bool posix = cifs_sb_master_tcon(cifs_sb)->posix_extensions;
 
 	xid = get_xid();
 
@@ -3140,7 +3083,8 @@
 		mode = attrs->ia_mode;
 		rc = 0;
 		if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) ||
-		    (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID)) {
+		    (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) ||
+		    posix) {
 			rc = id_mode_to_cifs_acl(inode, full_path, &mode,
 						INVALID_UID, INVALID_GID);
 			if (rc) {
--- linux-qcom-6.8.0.orig/fs/smb/client/ioctl.c
+++ linux-qcom-6.8.0/fs/smb/client/ioctl.c
@@ -247,7 +247,9 @@
 		spin_lock(&cifs_tcp_ses_lock);
 		list_for_each_entry(server_it, &cifs_tcp_ses_list, tcp_ses_list) {
 			list_for_each_entry(ses_it, &server_it->smb_ses_list, smb_ses_list) {
-				if (ses_it->Suid == out.session_id) {
+				spin_lock(&ses_it->ses_lock);
+				if (ses_it->ses_status != SES_EXITING &&
+				    ses_it->Suid == out.session_id) {
 					ses = ses_it;
 					/*
 					 * since we are using the session outside the crit
@@ -255,9 +257,11 @@
 					 * so increment its refcount
 					 */
 					cifs_smb_ses_inc_refcount(ses);
+					spin_unlock(&ses_it->ses_lock);
 					found = true;
 					goto search_end;
 				}
+				spin_unlock(&ses_it->ses_lock);
 			}
 		}
 search_end:
--- linux-qcom-6.8.0.orig/fs/smb/client/misc.c
+++ linux-qcom-6.8.0/fs/smb/client/misc.c
@@ -101,6 +101,7 @@
 	kfree(buf_to_free->serverDomain);
 	kfree(buf_to_free->serverNOS);
 	kfree_sensitive(buf_to_free->password);
+	kfree_sensitive(buf_to_free->password2);
 	kfree(buf_to_free->user_name);
 	kfree(buf_to_free->domainName);
 	kfree_sensitive(buf_to_free->auth_key.response);
@@ -113,9 +114,10 @@
 }
 
 struct cifs_tcon *
-tcon_info_alloc(bool dir_leases_enabled)
+tcon_info_alloc(bool dir_leases_enabled, enum smb3_tcon_ref_trace trace)
 {
 	struct cifs_tcon *ret_buf;
+	static atomic_t tcon_debug_id;
 
 	ret_buf = kzalloc(sizeof(*ret_buf), GFP_KERNEL);
 	if (!ret_buf)
@@ -132,7 +134,8 @@
 
 	atomic_inc(&tconInfoAllocCount);
 	ret_buf->status = TID_NEW;
-	++ret_buf->tc_count;
+	ret_buf->debug_id = atomic_inc_return(&tcon_debug_id);
+	ret_buf->tc_count = 1;
 	spin_lock_init(&ret_buf->tc_lock);
 	INIT_LIST_HEAD(&ret_buf->openFileList);
 	INIT_LIST_HEAD(&ret_buf->tcon_list);
@@ -141,27 +144,26 @@
 	atomic_set(&ret_buf->num_local_opens, 0);
 	atomic_set(&ret_buf->num_remote_opens, 0);
 	ret_buf->stats_from_time = ktime_get_real_seconds();
-#ifdef CONFIG_CIFS_DFS_UPCALL
-	INIT_LIST_HEAD(&ret_buf->dfs_ses_list);
+#ifdef CONFIG_CIFS_FSCACHE
+	mutex_init(&ret_buf->fscache_lock);
 #endif
+	trace_smb3_tcon_ref(ret_buf->debug_id, ret_buf->tc_count, trace);
 
 	return ret_buf;
 }
 
 void
-tconInfoFree(struct cifs_tcon *tcon)
+tconInfoFree(struct cifs_tcon *tcon, enum smb3_tcon_ref_trace trace)
 {
 	if (tcon == NULL) {
 		cifs_dbg(FYI, "Null buffer passed to tconInfoFree\n");
 		return;
 	}
+	trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, trace);
 	free_cached_dirs(tcon->cfids);
 	atomic_dec(&tconInfoAllocCount);
 	kfree(tcon->nativeFileSystem);
 	kfree_sensitive(tcon->password);
-#ifdef CONFIG_CIFS_DFS_UPCALL
-	dfs_put_root_smb_sessions(&tcon->dfs_ses_list);
-#endif
 	kfree(tcon->origin_fullpath);
 	kfree(tcon);
 }
@@ -490,6 +492,8 @@
 	/* look up tcon based on tid & uid */
 	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
+		if (cifs_ses_exiting(ses))
+			continue;
 		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 			if (tcon->tid != buf->Tid)
 				continue;
@@ -1253,6 +1257,7 @@
 				   const char *full_path,
 				   bool *islink)
 {
+	struct TCP_Server_Info *server = tcon->ses->server;
 	struct cifs_ses *ses = tcon->ses;
 	size_t len;
 	char *path;
@@ -1269,12 +1274,12 @@
 	    !is_tcon_dfs(tcon))
 		return 0;
 
-	spin_lock(&tcon->tc_lock);
-	if (!tcon->origin_fullpath) {
-		spin_unlock(&tcon->tc_lock);
+	spin_lock(&server->srv_lock);
+	if (!server->leaf_fullpath) {
+		spin_unlock(&server->srv_lock);
 		return 0;
 	}
-	spin_unlock(&tcon->tc_lock);
+	spin_unlock(&server->srv_lock);
 
 	/*
 	 * Slow path - tcon is DFS and @full_path has prefix path, so attempt
--- linux-qcom-6.8.0.orig/fs/smb/client/namespace.c
+++ linux-qcom-6.8.0/fs/smb/client/namespace.c
@@ -196,11 +196,28 @@
 	struct smb3_fs_context tmp;
 	char *full_path;
 	struct vfsmount *mnt;
+	struct cifs_sb_info *mntpt_sb;
+	struct cifs_ses *ses;
 
 	if (IS_ROOT(mntpt))
 		return ERR_PTR(-ESTALE);
 
-	cur_ctx = CIFS_SB(mntpt->d_sb)->ctx;
+	mntpt_sb = CIFS_SB(mntpt->d_sb);
+	ses = cifs_sb_master_tcon(mntpt_sb)->ses;
+	cur_ctx = mntpt_sb->ctx;
+
+	/*
+	 * At this point, the root session should be in the mntpt sb. We should
+	 * bring the sb context passwords in sync with the root session's
+	 * passwords. This would help prevent unnecessary retries and password
+	 * swaps for automounts.
+	 */
+	mutex_lock(&ses->session_mutex);
+	rc = smb3_sync_session_ctx_passwords(mntpt_sb, ses);
+	mutex_unlock(&ses->session_mutex);
+
+	if (rc)
+		return ERR_PTR(rc);
 
 	fc = fs_context_for_submount(path->mnt->mnt_sb->s_type, mntpt);
 	if (IS_ERR(fc))
--- linux-qcom-6.8.0.orig/fs/smb/client/readdir.c
+++ linux-qcom-6.8.0/fs/smb/client/readdir.c
@@ -22,6 +22,7 @@
 #include "smb2proto.h"
 #include "fs_context.h"
 #include "cached_dir.h"
+#include "reparse.h"
 
 /*
  * To be safe - for UCS to UTF-8 with strings loaded with the rare long
@@ -56,23 +57,6 @@
 #endif /* DEBUG2 */
 
 /*
- * Match a reparse point inode if reparse tag and ctime haven't changed.
- *
- * Windows Server updates ctime of reparse points when their data have changed.
- * The server doesn't allow changing reparse tags from existing reparse points,
- * though it's worth checking.
- */
-static inline bool reparse_inode_match(struct inode *inode,
-				       struct cifs_fattr *fattr)
-{
-	struct timespec64 ctime = inode_get_ctime(inode);
-
-	return (CIFS_I(inode)->cifsAttrs & ATTR_REPARSE) &&
-		CIFS_I(inode)->reparse_tag == fattr->cf_cifstag &&
-		timespec64_equal(&ctime, &fattr->cf_ctime);
-}
-
-/*
  * Attempt to preload the dcache with the results from the FIND_FIRST/NEXT
  *
  * Find the dentry that matches "name". If there isn't one, create one. If it's
@@ -87,6 +71,8 @@
 	struct inode *inode;
 	struct super_block *sb = parent->d_sb;
 	struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
+	bool posix = cifs_sb_master_tcon(cifs_sb)->posix_extensions;
+	bool reparse_need_reval = false;
 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
 	int rc;
 
@@ -101,7 +87,21 @@
 		 * this spares us an invalidation.
 		 */
 retry:
-		if ((fattr->cf_cifsattrs & ATTR_REPARSE) ||
+		if (posix) {
+			switch (fattr->cf_mode & S_IFMT) {
+			case S_IFLNK:
+			case S_IFBLK:
+			case S_IFCHR:
+				reparse_need_reval = true;
+				break;
+			default:
+				break;
+			}
+		} else if (fattr->cf_cifsattrs & ATTR_REPARSE) {
+			reparse_need_reval = true;
+		}
+
+		if (reparse_need_reval ||
 		    (fattr->cf_flags & CIFS_FATTR_NEED_REVAL))
 			return;
 
@@ -148,7 +148,7 @@
 						rc = -ESTALE;
 					}
 				}
-				if (!rc && !cifs_fattr_to_inode(inode, fattr)) {
+				if (!rc && !cifs_fattr_to_inode(inode, fattr, true)) {
 					dput(dentry);
 					return;
 				}
--- linux-qcom-6.8.0.orig/fs/smb/client/reparse.c
+++ linux-qcom-6.8.0/fs/smb/client/reparse.c
@@ -0,0 +1,433 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024 Paulo Alcantara <pc@manguebit.com>
+ */
+
+#include <linux/fs.h>
+#include <linux/stat.h>
+#include <linux/slab.h>
+#include "cifsglob.h"
+#include "smb2proto.h"
+#include "cifsproto.h"
+#include "cifs_unicode.h"
+#include "cifs_debug.h"
+#include "reparse.h"
+
+int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode,
+				struct dentry *dentry, struct cifs_tcon *tcon,
+				const char *full_path, const char *symname)
+{
+	struct reparse_symlink_data_buffer *buf = NULL;
+	struct cifs_open_info_data data;
+	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+	struct inode *new;
+	struct kvec iov;
+	__le16 *path;
+	char *sym, sep = CIFS_DIR_SEP(cifs_sb);
+	u16 len, plen;
+	int rc = 0;
+
+	if (strlen(symname) > REPARSE_SYM_PATH_MAX)
+		return -ENAMETOOLONG;
+
+	sym = kstrdup(symname, GFP_KERNEL);
+	if (!sym)
+		return -ENOMEM;
+
+	data = (struct cifs_open_info_data) {
+		.reparse_point = true,
+		.reparse = { .tag = IO_REPARSE_TAG_SYMLINK, },
+		.symlink_target = sym,
+	};
+
+	convert_delimiter(sym, sep);
+	path = cifs_convert_path_to_utf16(sym, cifs_sb);
+	if (!path) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	plen = 2 * UniStrnlen((wchar_t *)path, REPARSE_SYM_PATH_MAX);
+	len = sizeof(*buf) + plen * 2;
+	buf = kzalloc(len, GFP_KERNEL);
+	if (!buf) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	buf->ReparseTag = cpu_to_le32(IO_REPARSE_TAG_SYMLINK);
+	buf->ReparseDataLength = cpu_to_le16(len - sizeof(struct reparse_data_buffer));
+	buf->SubstituteNameOffset = cpu_to_le16(plen);
+	buf->SubstituteNameLength = cpu_to_le16(plen);
+	memcpy(&buf->PathBuffer[plen], path, plen);
+	buf->PrintNameOffset = 0;
+	buf->PrintNameLength = cpu_to_le16(plen);
+	memcpy(buf->PathBuffer, path, plen);
+	buf->Flags = cpu_to_le32(*symname != '/' ? SYMLINK_FLAG_RELATIVE : 0);
+	if (*sym != sep)
+		buf->Flags = cpu_to_le32(SYMLINK_FLAG_RELATIVE);
+
+	convert_delimiter(sym, '/');
+	iov.iov_base = buf;
+	iov.iov_len = len;
+	new = smb2_get_reparse_inode(&data, inode->i_sb, xid,
+				     tcon, full_path, &iov);
+	if (!IS_ERR(new))
+		d_instantiate(dentry, new);
+	else
+		rc = PTR_ERR(new);
+out:
+	kfree(path);
+	cifs_free_open_info(&data);
+	kfree(buf);
+	return rc;
+}
+
+static int nfs_set_reparse_buf(struct reparse_posix_data *buf,
+			       mode_t mode, dev_t dev,
+			       struct kvec *iov)
+{
+	u64 type;
+	u16 len, dlen;
+
+	len = sizeof(*buf);
+
+	switch ((type = reparse_mode_nfs_type(mode))) {
+	case NFS_SPECFILE_BLK:
+	case NFS_SPECFILE_CHR:
+		dlen = sizeof(__le64);
+		break;
+	case NFS_SPECFILE_FIFO:
+	case NFS_SPECFILE_SOCK:
+		dlen = 0;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	buf->ReparseTag = cpu_to_le32(IO_REPARSE_TAG_NFS);
+	buf->Reserved = 0;
+	buf->InodeType = cpu_to_le64(type);
+	buf->ReparseDataLength = cpu_to_le16(len + dlen -
+					     sizeof(struct reparse_data_buffer));
+	*(__le64 *)buf->DataBuffer = cpu_to_le64(((u64)MINOR(dev) << 32) |
+						 MAJOR(dev));
+	iov->iov_base = buf;
+	iov->iov_len = len + dlen;
+	return 0;
+}
+
+int smb2_make_nfs_node(unsigned int xid, struct inode *inode,
+		       struct dentry *dentry, struct cifs_tcon *tcon,
+		       const char *full_path, umode_t mode, dev_t dev)
+{
+	struct cifs_open_info_data data;
+	struct reparse_posix_data *p;
+	struct inode *new;
+	struct kvec iov;
+	__u8 buf[sizeof(*p) + sizeof(__le64)];
+	int rc;
+
+	p = (struct reparse_posix_data *)buf;
+	rc = nfs_set_reparse_buf(p, mode, dev, &iov);
+	if (rc)
+		return rc;
+
+	data = (struct cifs_open_info_data) {
+		.reparse_point = true,
+		.reparse = { .tag = IO_REPARSE_TAG_NFS, .posix = p, },
+	};
+
+	new = smb2_get_reparse_inode(&data, inode->i_sb, xid,
+				     tcon, full_path, &iov);
+	if (!IS_ERR(new))
+		d_instantiate(dentry, new);
+	else
+		rc = PTR_ERR(new);
+	cifs_free_open_info(&data);
+	return rc;
+}
+
+/* See MS-FSCC 2.1.2.6 for the 'NFS' style reparse tags */
+static int parse_reparse_posix(struct reparse_posix_data *buf,
+			       struct cifs_sb_info *cifs_sb,
+			       struct cifs_open_info_data *data)
+{
+	unsigned int len;
+	u64 type;
+
+	len = le16_to_cpu(buf->ReparseDataLength);
+	if (len < sizeof(buf->InodeType)) {
+		cifs_dbg(VFS, "srv returned malformed nfs buffer\n");
+		return -EIO;
+	}
+
+	len -= sizeof(buf->InodeType);
+
+	switch ((type = le64_to_cpu(buf->InodeType))) {
+	case NFS_SPECFILE_LNK:
+		if (len == 0 || (len % 2)) {
+			cifs_dbg(VFS, "srv returned malformed nfs symlink buffer\n");
+			return -EIO;
+		}
+		/*
+		 * Check that buffer does not contain UTF-16 null codepoint
+		 * because Linux cannot process symlink with null byte.
+		 */
+		if (UniStrnlen((wchar_t *)buf->DataBuffer, len/2) != len/2) {
+			cifs_dbg(VFS, "srv returned null byte in nfs symlink target location\n");
+			return -EIO;
+		}
+		data->symlink_target = cifs_strndup_from_utf16(buf->DataBuffer,
+							       len, true,
+							       cifs_sb->local_nls);
+		if (!data->symlink_target)
+			return -ENOMEM;
+		cifs_dbg(FYI, "%s: target path: %s\n",
+			 __func__, data->symlink_target);
+		break;
+	case NFS_SPECFILE_CHR:
+	case NFS_SPECFILE_BLK:
+		/* DataBuffer for block and char devices contains two 32-bit numbers */
+		if (len != 8) {
+			cifs_dbg(VFS, "srv returned malformed nfs buffer for type: 0x%llx\n", type);
+			return -EIO;
+		}
+		break;
+	case NFS_SPECFILE_FIFO:
+	case NFS_SPECFILE_SOCK:
+		/* DataBuffer for fifos and sockets is empty */
+		if (len != 0) {
+			cifs_dbg(VFS, "srv returned malformed nfs buffer for type: 0x%llx\n", type);
+			return -EIO;
+		}
+		break;
+	default:
+		cifs_dbg(VFS, "%s: unhandled inode type: 0x%llx\n",
+			 __func__, type);
+		return -EOPNOTSUPP;
+	}
+	return 0;
+}
+
+int smb2_parse_native_symlink(char **target, const char *buf, unsigned int len,
+			      bool unicode, bool relative,
+			      const char *full_path,
+			      struct cifs_sb_info *cifs_sb)
+{
+	char sep = CIFS_DIR_SEP(cifs_sb);
+	char *linux_target = NULL;
+	char *smb_target = NULL;
+	int levels;
+	int rc;
+	int i;
+
+	smb_target = cifs_strndup_from_utf16(buf, len, unicode, cifs_sb->local_nls);
+	if (!smb_target) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	if (smb_target[0] == sep && relative) {
+		/*
+		 * This is a relative SMB symlink from the top of the share,
+		 * which is the top level directory of the Linux mount point.
+		 * Linux does not support such relative symlinks, so convert
+		 * it to the relative symlink from the current directory.
+		 * full_path is the SMB path to the symlink (from which is
+		 * extracted current directory) and smb_target is the SMB path
+		 * where symlink points, therefore full_path must always be on
+		 * the SMB share.
+		 */
+		int smb_target_len = strlen(smb_target)+1;
+		levels = 0;
+		for (i = 1; full_path[i]; i++) { /* i=1 to skip leading sep */
+			if (full_path[i] == sep)
+				levels++;
+		}
+		linux_target = kmalloc(levels*3 + smb_target_len, GFP_KERNEL);
+		if (!linux_target) {
+			rc = -ENOMEM;
+			goto out;
+		}
+		for (i = 0; i < levels; i++) {
+			linux_target[i*3 + 0] = '.';
+			linux_target[i*3 + 1] = '.';
+			linux_target[i*3 + 2] = sep;
+		}
+		memcpy(linux_target + levels*3, smb_target+1, smb_target_len); /* +1 to skip leading sep */
+	} else {
+		linux_target = smb_target;
+		smb_target = NULL;
+	}
+
+	if (sep == '\\')
+		convert_delimiter(linux_target, '/');
+
+	rc = 0;
+	*target = linux_target;
+
+	cifs_dbg(FYI, "%s: symlink target: %s\n", __func__, *target);
+
+out:
+	if (rc != 0)
+		kfree(linux_target);
+	kfree(smb_target);
+	return rc;
+}
+
+static int parse_reparse_symlink(struct reparse_symlink_data_buffer *sym,
+				 u32 plen, bool unicode,
+				 struct cifs_sb_info *cifs_sb,
+				 const char *full_path,
+				 struct cifs_open_info_data *data)
+{
+	unsigned int len;
+	unsigned int offs;
+
+	/* We handle Symbolic Link reparse tag here. See: MS-FSCC 2.1.2.4 */
+
+	offs = le16_to_cpu(sym->SubstituteNameOffset);
+	len = le16_to_cpu(sym->SubstituteNameLength);
+	if (offs + 20 > plen || offs + len + 20 > plen) {
+		cifs_dbg(VFS, "srv returned malformed symlink buffer\n");
+		return -EIO;
+	}
+
+	return smb2_parse_native_symlink(&data->symlink_target,
+					 sym->PathBuffer + offs,
+					 len,
+					 unicode,
+					 le32_to_cpu(sym->Flags) & SYMLINK_FLAG_RELATIVE,
+					 full_path,
+					 cifs_sb);
+}
+
+int parse_reparse_point(struct reparse_data_buffer *buf,
+			u32 plen, struct cifs_sb_info *cifs_sb,
+			const char *full_path,
+			bool unicode, struct cifs_open_info_data *data)
+{
+	struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+
+	data->reparse.buf = buf;
+
+	/* See MS-FSCC 2.1.2 */
+	switch (le32_to_cpu(buf->ReparseTag)) {
+	case IO_REPARSE_TAG_NFS:
+		return parse_reparse_posix((struct reparse_posix_data *)buf,
+					   cifs_sb, data);
+	case IO_REPARSE_TAG_SYMLINK:
+		return parse_reparse_symlink(
+			(struct reparse_symlink_data_buffer *)buf,
+			plen, unicode, cifs_sb, full_path, data);
+	case IO_REPARSE_TAG_LX_SYMLINK:
+	case IO_REPARSE_TAG_AF_UNIX:
+	case IO_REPARSE_TAG_LX_FIFO:
+	case IO_REPARSE_TAG_LX_CHR:
+	case IO_REPARSE_TAG_LX_BLK:
+		break;
+	default:
+		cifs_tcon_dbg(VFS | ONCE, "unhandled reparse tag: 0x%08x\n",
+			      le32_to_cpu(buf->ReparseTag));
+		break;
+	}
+	return 0;
+}
+
+int smb2_parse_reparse_point(struct cifs_sb_info *cifs_sb,
+			     const char *full_path,
+			     struct kvec *rsp_iov,
+			     struct cifs_open_info_data *data)
+{
+	struct reparse_data_buffer *buf;
+	struct smb2_ioctl_rsp *io = rsp_iov->iov_base;
+	u32 plen = le32_to_cpu(io->OutputCount);
+
+	buf = (struct reparse_data_buffer *)((u8 *)io +
+					     le32_to_cpu(io->OutputOffset));
+	return parse_reparse_point(buf, plen, cifs_sb, full_path, true, data);
+}
+
+bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,
+				 struct cifs_fattr *fattr,
+				 struct cifs_open_info_data *data)
+{
+	struct reparse_posix_data *buf = data->reparse.posix;
+	u32 tag = data->reparse.tag;
+
+	if (tag == IO_REPARSE_TAG_NFS && buf) {
+		if (le16_to_cpu(buf->ReparseDataLength) < sizeof(buf->InodeType))
+			return false;
+		switch (le64_to_cpu(buf->InodeType)) {
+		case NFS_SPECFILE_CHR:
+			if (le16_to_cpu(buf->ReparseDataLength) != sizeof(buf->InodeType) + 8)
+				return false;
+			fattr->cf_mode |= S_IFCHR;
+			fattr->cf_rdev = reparse_nfs_mkdev(buf);
+			break;
+		case NFS_SPECFILE_BLK:
+			if (le16_to_cpu(buf->ReparseDataLength) != sizeof(buf->InodeType) + 8)
+				return false;
+			fattr->cf_mode |= S_IFBLK;
+			fattr->cf_rdev = reparse_nfs_mkdev(buf);
+			break;
+		case NFS_SPECFILE_FIFO:
+			fattr->cf_mode |= S_IFIFO;
+			break;
+		case NFS_SPECFILE_SOCK:
+			fattr->cf_mode |= S_IFSOCK;
+			break;
+		case NFS_SPECFILE_LNK:
+			fattr->cf_mode |= S_IFLNK;
+			break;
+		default:
+			WARN_ON_ONCE(1);
+			return false;
+		}
+		goto out;
+	}
+
+	switch (tag) {
+	case IO_REPARSE_TAG_INTERNAL:
+		if (!(fattr->cf_cifsattrs & ATTR_DIRECTORY))
+			return false;
+		fallthrough;
+	case IO_REPARSE_TAG_DFS:
+	case IO_REPARSE_TAG_DFSR:
+	case IO_REPARSE_TAG_MOUNT_POINT:
+		/* See cifs_create_junction_fattr() */
+		fattr->cf_mode = S_IFDIR | 0711;
+		break;
+	case IO_REPARSE_TAG_LX_SYMLINK:
+		fattr->cf_mode |= S_IFLNK;
+		fattr->cf_dtype = DT_LNK;
+		break;
+	case IO_REPARSE_TAG_LX_FIFO:
+		fattr->cf_mode |= S_IFIFO;
+		fattr->cf_dtype = DT_FIFO;
+		break;
+	case IO_REPARSE_TAG_AF_UNIX:
+		fattr->cf_mode |= S_IFSOCK;
+		fattr->cf_dtype = DT_SOCK;
+		break;
+	case IO_REPARSE_TAG_LX_CHR:
+		fattr->cf_mode |= S_IFCHR;
+		fattr->cf_dtype = DT_CHR;
+		break;
+	case IO_REPARSE_TAG_LX_BLK:
+		fattr->cf_mode |= S_IFBLK;
+		fattr->cf_dtype = DT_BLK;
+		break;
+	case 0: /* SMB1 symlink */
+	case IO_REPARSE_TAG_SYMLINK:
+	case IO_REPARSE_TAG_NFS:
+		fattr->cf_mode |= S_IFLNK;
+		break;
+	default:
+		return false;
+	}
+out:
+	fattr->cf_dtype = S_DT(fattr->cf_mode);
+	return true;
+}
--- linux-qcom-6.8.0.orig/fs/smb/client/reparse.h
+++ linux-qcom-6.8.0/fs/smb/client/reparse.h
@@ -0,0 +1,92 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024 Paulo Alcantara <pc@manguebit.com>
+ */
+
+#ifndef _CIFS_REPARSE_H
+#define _CIFS_REPARSE_H
+
+#include <linux/fs.h>
+#include <linux/stat.h>
+#include "cifsglob.h"
+
+#define REPARSE_SYM_PATH_MAX 4060
+
+/*
+ * Used only by cifs.ko to ignore reparse points from files when client or
+ * server doesn't support FSCTL_GET_REPARSE_POINT.
+ */
+#define IO_REPARSE_TAG_INTERNAL ((__u32)~0U)
+
+static inline dev_t reparse_nfs_mkdev(struct reparse_posix_data *buf)
+{
+	u64 v = le64_to_cpu(*(__le64 *)buf->DataBuffer);
+
+	return MKDEV(v >> 32, v & 0xffffffff);
+}
+
+static inline u64 reparse_mode_nfs_type(mode_t mode)
+{
+	switch (mode & S_IFMT) {
+	case S_IFBLK: return NFS_SPECFILE_BLK;
+	case S_IFCHR: return NFS_SPECFILE_CHR;
+	case S_IFIFO: return NFS_SPECFILE_FIFO;
+	case S_IFSOCK: return NFS_SPECFILE_SOCK;
+	}
+	return 0;
+}
+
+/*
+ * Match a reparse point inode if reparse tag and ctime haven't changed.
+ *
+ * Windows Server updates ctime of reparse points when their data have changed.
+ * The server doesn't allow changing reparse tags from existing reparse points,
+ * though it's worth checking.
+ */
+static inline bool reparse_inode_match(struct inode *inode,
+				       struct cifs_fattr *fattr)
+{
+	struct cifsInodeInfo *cinode = CIFS_I(inode);
+	struct timespec64 ctime = inode_get_ctime(inode);
+
+	/*
+	 * Do not match reparse tags when client or server doesn't support
+	 * FSCTL_GET_REPARSE_POINT.  @fattr->cf_cifstag should contain correct
+	 * reparse tag from query dir response but the client won't be able to
+	 * read the reparse point data anyway.  This spares us a revalidation.
+	 */
+	if (cinode->reparse_tag != IO_REPARSE_TAG_INTERNAL &&
+	    cinode->reparse_tag != fattr->cf_cifstag)
+		return false;
+	return (cinode->cifsAttrs & ATTR_REPARSE) &&
+		timespec64_equal(&ctime, &fattr->cf_ctime);
+}
+
+static inline bool cifs_open_data_reparse(struct cifs_open_info_data *data)
+{
+	struct smb2_file_all_info *fi = &data->fi;
+	u32 attrs = le32_to_cpu(fi->Attributes);
+	bool ret;
+
+	ret = data->reparse_point || (attrs & ATTR_REPARSE);
+	if (ret)
+		attrs |= ATTR_REPARSE;
+	fi->Attributes = cpu_to_le32(attrs);
+	return ret;
+}
+
+bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,
+				 struct cifs_fattr *fattr,
+				 struct cifs_open_info_data *data);
+int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode,
+				struct dentry *dentry, struct cifs_tcon *tcon,
+				const char *full_path, const char *symname);
+int smb2_make_nfs_node(unsigned int xid, struct inode *inode,
+		       struct dentry *dentry, struct cifs_tcon *tcon,
+		       const char *full_path, umode_t mode, dev_t dev);
+int smb2_parse_reparse_point(struct cifs_sb_info *cifs_sb,
+			     const char *full_path,
+			     struct kvec *rsp_iov,
+			     struct cifs_open_info_data *data);
+
+#endif /* _CIFS_REPARSE_H */
--- linux-qcom-6.8.0.orig/fs/smb/client/sess.c
+++ linux-qcom-6.8.0/fs/smb/client/sess.c
@@ -230,7 +230,7 @@
 		spin_lock(&ses->iface_lock);
 		if (!ses->iface_count) {
 			spin_unlock(&ses->iface_lock);
-			cifs_dbg(VFS, "server %s does not advertise interfaces\n",
+			cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
 				      ses->server->hostname);
 			break;
 		}
@@ -396,7 +396,7 @@
 	spin_lock(&ses->iface_lock);
 	if (!ses->iface_count) {
 		spin_unlock(&ses->iface_lock);
-		cifs_dbg(VFS, "server %s does not advertise interfaces\n", ses->server->hostname);
+		cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
 		return;
 	}
 
--- linux-qcom-6.8.0.orig/fs/smb/client/smb1ops.c
+++ linux-qcom-6.8.0/fs/smb/client/smb1ops.c
@@ -753,11 +753,11 @@
 	cinode->can_cache_brlcks = CIFS_CACHE_WRITE(cinode);
 }
 
-static void
+static int
 cifs_close_file(const unsigned int xid, struct cifs_tcon *tcon,
 		struct cifs_fid *fid)
 {
-	CIFSSMBClose(xid, tcon, fid->netfid);
+	return CIFSSMBClose(xid, tcon, fid->netfid);
 }
 
 static int
@@ -909,7 +909,7 @@
 
 static int
 cifs_queryfs(const unsigned int xid, struct cifs_tcon *tcon,
-	     struct cifs_sb_info *cifs_sb, struct kstatfs *buf)
+	     const char *path, struct cifs_sb_info *cifs_sb, struct kstatfs *buf)
 {
 	int rc = -EOPNOTSUPP;
 
@@ -994,17 +994,17 @@
 }
 
 static int cifs_parse_reparse_point(struct cifs_sb_info *cifs_sb,
+				    const char *full_path,
 				    struct kvec *rsp_iov,
 				    struct cifs_open_info_data *data)
 {
 	struct reparse_data_buffer *buf;
 	TRANSACT_IOCTL_RSP *io = rsp_iov->iov_base;
-	bool unicode = !!(io->hdr.Flags2 & SMBFLG2_UNICODE);
 	u32 plen = le16_to_cpu(io->ByteCount);
 
 	buf = (struct reparse_data_buffer *)((__u8 *)&io->hdr.Protocol +
 					     le32_to_cpu(io->DataOffset));
-	return parse_reparse_point(buf, plen, cifs_sb, unicode, data);
+	return parse_reparse_point(buf, plen, cifs_sb, full_path, true, data);
 }
 
 static bool
--- linux-qcom-6.8.0.orig/fs/smb/client/smb2file.c
+++ linux-qcom-6.8.0/fs/smb/client/smb2file.c
@@ -63,12 +63,12 @@
 	return sym;
 }
 
-int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec *iov, char **path)
+int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec *iov,
+				const char *full_path, char **path)
 {
 	struct smb2_symlink_err_rsp *sym;
 	unsigned int sub_offs, sub_len;
 	unsigned int print_offs, print_len;
-	char *s;
 
 	if (!cifs_sb || !iov || !iov->iov_base || !iov->iov_len || !path)
 		return -EINVAL;
@@ -86,15 +86,13 @@
 	    iov->iov_len < SMB2_SYMLINK_STRUCT_SIZE + print_offs + print_len)
 		return -EINVAL;
 
-	s = cifs_strndup_from_utf16((char *)sym->PathBuffer + sub_offs, sub_len, true,
-				    cifs_sb->local_nls);
-	if (!s)
-		return -ENOMEM;
-	convert_delimiter(s, '/');
-	cifs_dbg(FYI, "%s: symlink target: %s\n", __func__, s);
-
-	*path = s;
-	return 0;
+	return smb2_parse_native_symlink(path,
+					 (char *)sym->PathBuffer + sub_offs,
+					 sub_len,
+					 true,
+					 le32_to_cpu(sym->Flags) & SYMLINK_FLAG_RELATIVE,
+					 full_path,
+					 cifs_sb);
 }
 
 int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32 *oplock, void *buf)
@@ -126,6 +124,7 @@
 			goto out;
 		if (hdr->Status == STATUS_STOPPED_ON_SYMLINK) {
 			rc = smb2_parse_symlink_response(oparms->cifs_sb, &err_iov,
+							 oparms->path,
 							 &data->symlink_target);
 			if (!rc) {
 				memset(smb2_data, 0, sizeof(*smb2_data));
--- linux-qcom-6.8.0.orig/fs/smb/client/smb2inode.c
+++ linux-qcom-6.8.0/fs/smb/client/smb2inode.c
@@ -228,7 +228,7 @@
 							  SMB2_O_INFO_FILE, 0,
 							  sizeof(struct smb311_posix_qinfo *) +
 							  (PATH_MAX * 2) +
-							  (sizeof(struct cifs_sid) * 2), 0, NULL);
+							  (sizeof(struct smb_sid) * 2), 0, NULL);
 			} else {
 				rc = SMB2_query_info_init(tcon, server,
 							  &rqst[num_rqst],
@@ -238,7 +238,7 @@
 							  SMB2_O_INFO_FILE, 0,
 							  sizeof(struct smb311_posix_qinfo *) +
 							  (PATH_MAX * 2) +
-							  (sizeof(struct cifs_sid) * 2), 0, NULL);
+							  (sizeof(struct smb_sid) * 2), 0, NULL);
 				if (!rc) {
 					smb2_set_next_command(tcon, &rqst[num_rqst]);
 					smb2_set_related(&rqst[num_rqst]);
@@ -659,6 +659,7 @@
 
 static int parse_create_response(struct cifs_open_info_data *data,
 				 struct cifs_sb_info *cifs_sb,
+				 const char *full_path,
 				 const struct kvec *iov)
 {
 	struct smb2_create_rsp *rsp = iov->iov_base;
@@ -672,6 +673,7 @@
 		break;
 	case STATUS_STOPPED_ON_SYMLINK:
 		rc = smb2_parse_symlink_response(cifs_sb, iov,
+						 full_path,
 						 &data->symlink_target);
 		if (rc)
 			return rc;
@@ -758,12 +760,14 @@
 
 	switch (rc) {
 	case 0:
+		rc = parse_create_response(data, cifs_sb, full_path, &out_iov[0]);
+		break;
 	case -EOPNOTSUPP:
 		/*
 		 * BB TODO: When support for special files added to Samba
 		 * re-verify this path.
 		 */
-		rc = parse_create_response(data, cifs_sb, &out_iov[0]);
+		rc = parse_create_response(data, cifs_sb, full_path, &out_iov[0]);
 		if (rc || !data->reparse_point)
 			goto out;
 
@@ -978,10 +982,13 @@
 	struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
 	struct cifsFileInfo *cfile;
 	struct inode *new = NULL;
+	int out_buftype[4] = {};
+	struct kvec out_iov[4] = {};
 	struct kvec in_iov[2];
 	int cmds[2];
 	int da, co, cd;
 	int rc;
+	int i;
 
 	da = SYNCHRONIZE | DELETE |
 		FILE_READ_ATTRIBUTES |
@@ -998,7 +1005,7 @@
 		cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
 		rc = smb2_compound_op(xid, tcon, cifs_sb, full_path,
 				      da, cd, co, ACL_NO_MODE, in_iov,
-				      cmds, 2, cfile, NULL, NULL);
+				      cmds, 2, cfile, out_iov, out_buftype);
 		if (!rc) {
 			rc = smb311_posix_get_inode_info(&new, full_path,
 							 data, sb, xid);
@@ -1008,12 +1015,29 @@
 		cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
 		rc = smb2_compound_op(xid, tcon, cifs_sb, full_path,
 				      da, cd, co, ACL_NO_MODE, in_iov,
-				      cmds, 2, cfile, NULL, NULL);
+				      cmds, 2, cfile, out_iov, out_buftype);
 		if (!rc) {
 			rc = cifs_get_inode_info(&new, full_path,
 						 data, sb, xid, NULL);
 		}
 	}
+
+
+	/*
+	 * If CREATE was successful but SMB2_OP_SET_REPARSE failed then
+	 * remove the intermediate object created by CREATE. Otherwise
+	 * empty object stay on the server when reparse call failed.
+	 */
+	if (rc &&
+	    out_iov[0].iov_base != NULL && out_buftype[0] != CIFS_NO_BUFFER &&
+	    ((struct smb2_hdr *)out_iov[0].iov_base)->Status == STATUS_SUCCESS &&
+	    (out_iov[1].iov_base == NULL || out_buftype[1] == CIFS_NO_BUFFER ||
+	     ((struct smb2_hdr *)out_iov[1].iov_base)->Status != STATUS_SUCCESS))
+		smb2_unlink(xid, tcon, full_path, cifs_sb);
+
+	for (i = 0; i < ARRAY_SIZE(out_buftype); i++)
+		free_rsp_buf(out_buftype[i], out_iov[i].iov_base);
+
 	return rc ? ERR_PTR(rc) : new;
 }
 
--- linux-qcom-6.8.0.orig/fs/smb/client/smb2misc.c
+++ linux-qcom-6.8.0/fs/smb/client/smb2misc.c
@@ -622,6 +622,8 @@
 	/* look up tcon based on tid & uid */
 	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
+		if (cifs_ses_exiting(ses))
+			continue;
 		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 			spin_lock(&tcon->open_file_lock);
 			cifs_stats_inc(
@@ -697,6 +699,8 @@
 	/* look up tcon based on tid & uid */
 	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
+		if (cifs_ses_exiting(ses))
+			continue;
 		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 
 			spin_lock(&tcon->open_file_lock);
@@ -763,7 +767,7 @@
 	if (rc)
 		cifs_tcon_dbg(VFS, "Close cancelled mid failed rc:%d\n", rc);
 
-	cifs_put_tcon(tcon);
+	cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_close_fid);
 	kfree(cancelled);
 }
 
@@ -807,6 +811,8 @@
 	if (tcon->tc_count <= 0) {
 		struct TCP_Server_Info *server = NULL;
 
+		trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+				    netfs_trace_tcon_ref_see_cancelled_close);
 		WARN_ONCE(tcon->tc_count < 0, "tcon refcount is negative");
 		spin_unlock(&cifs_tcp_ses_lock);
 
@@ -819,12 +825,14 @@
 		return 0;
 	}
 	tcon->tc_count++;
+	trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+			    netfs_trace_tcon_ref_get_cancelled_close);
 	spin_unlock(&cifs_tcp_ses_lock);
 
 	rc = __smb2_handle_cancelled_cmd(tcon, SMB2_CLOSE_HE, 0,
 					 persistent_fid, volatile_fid);
 	if (rc)
-		cifs_put_tcon(tcon);
+		cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_close);
 
 	return rc;
 }
@@ -852,7 +860,7 @@
 					 rsp->PersistentFileId,
 					 rsp->VolatileFileId);
 	if (rc)
-		cifs_put_tcon(tcon);
+		cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_mid);
 
 	return rc;
 }
--- linux-qcom-6.8.0.orig/fs/smb/client/smb2ops.c
+++ linux-qcom-6.8.0/fs/smb/client/smb2ops.c
@@ -28,6 +28,7 @@
 #include "fscache.h"
 #include "fs_context.h"
 #include "cached_dir.h"
+#include "reparse.h"
 
 /* Change credits for different ops and return the total number of credits */
 static int
@@ -1121,7 +1122,7 @@
 	struct cifs_fid fid;
 	unsigned int size[1];
 	void *data[1];
-	struct smb2_file_full_ea_info *ea = NULL;
+	struct smb2_file_full_ea_info *ea;
 	struct smb2_query_info_rsp *rsp;
 	int rc, used_len = 0;
 	int retries = 0, cur_sleep = 1;
@@ -1142,6 +1143,7 @@
 	if (!utf16_path)
 		return -ENOMEM;
 
+	ea = NULL;
 	resp_buftype[0] = resp_buftype[1] = resp_buftype[2] = CIFS_NO_BUFFER;
 	vars = kzalloc(sizeof(*vars), GFP_KERNEL);
 	if (!vars) {
@@ -1411,14 +1413,14 @@
 	memcpy(cfile->fid.create_guid, fid->create_guid, 16);
 }
 
-static void
+static int
 smb2_close_file(const unsigned int xid, struct cifs_tcon *tcon,
 		struct cifs_fid *fid)
 {
-	SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid);
+	return SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid);
 }
 
-static void
+static int
 smb2_close_getattr(const unsigned int xid, struct cifs_tcon *tcon,
 		   struct cifsFileInfo *cfile)
 {
@@ -1429,7 +1431,7 @@
 	rc = __SMB2_close(xid, tcon, cfile->fid.persistent_fid,
 		   cfile->fid.volatile_fid, &file_inf);
 	if (rc)
-		return;
+		return rc;
 
 	inode = d_inode(cfile->dentry);
 
@@ -1458,6 +1460,7 @@
 
 	/* End of file and Attributes should not have to be updated on close */
 	spin_unlock(&inode->i_lock);
+	return rc;
 }
 
 static int
@@ -2026,6 +2029,7 @@
 		 * size will be queried on next revalidate, but it is important
 		 * to make sure that file's cached size is updated immediately
 		 */
+		netfs_resize_file(netfs_inode(inode), dest_off + len, true);
 		cifs_setsize(inode, dest_off + len);
 	}
 	rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
@@ -2479,6 +2483,8 @@
 
 	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
+		if (cifs_ses_exiting(ses))
+			continue;
 		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 			if (tcon->tid == le32_to_cpu(shdr->Id.SyncId.TreeId)) {
 				spin_lock(&tcon->tc_lock);
@@ -2779,7 +2785,7 @@
 
 static int
 smb2_queryfs(const unsigned int xid, struct cifs_tcon *tcon,
-	     struct cifs_sb_info *cifs_sb, struct kstatfs *buf)
+	     const char *path, struct cifs_sb_info *cifs_sb, struct kstatfs *buf)
 {
 	struct smb2_query_info_rsp *rsp;
 	struct smb2_fs_full_size_info *info = NULL;
@@ -2788,7 +2794,7 @@
 	int rc;
 
 
-	rc = smb2_query_info_compound(xid, tcon, "",
+	rc = smb2_query_info_compound(xid, tcon, path,
 				      FILE_READ_ATTRIBUTES,
 				      FS_FULL_SIZE_INFORMATION,
 				      SMB2_O_INFO_FILESYSTEM,
@@ -2816,28 +2822,33 @@
 
 static int
 smb311_queryfs(const unsigned int xid, struct cifs_tcon *tcon,
-	       struct cifs_sb_info *cifs_sb, struct kstatfs *buf)
+	       const char *path, struct cifs_sb_info *cifs_sb, struct kstatfs *buf)
 {
 	int rc;
-	__le16 srch_path = 0; /* Null - open root of share */
+	__le16 *utf16_path = NULL;
 	u8 oplock = SMB2_OPLOCK_LEVEL_NONE;
 	struct cifs_open_parms oparms;
 	struct cifs_fid fid;
 
 	if (!tcon->posix_extensions)
-		return smb2_queryfs(xid, tcon, cifs_sb, buf);
+		return smb2_queryfs(xid, tcon, path, cifs_sb, buf);
 
 	oparms = (struct cifs_open_parms) {
 		.tcon = tcon,
-		.path = "",
+		.path = path,
 		.desired_access = FILE_READ_ATTRIBUTES,
 		.disposition = FILE_OPEN,
 		.create_options = cifs_create_options(cifs_sb, 0),
 		.fid = &fid,
 	};
 
-	rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL,
+	utf16_path = cifs_convert_path_to_utf16(path, cifs_sb);
+	if (utf16_path == NULL)
+		return -ENOMEM;
+
+	rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL,
 		       NULL, NULL);
+	kfree(utf16_path);
 	if (rc)
 		return rc;
 
@@ -2911,8 +2922,11 @@
 		tcon = list_first_entry_or_null(&ses->tcon_list,
 						struct cifs_tcon,
 						tcon_list);
-		if (tcon)
+		if (tcon) {
 			tcon->tc_count++;
+			trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+					    netfs_trace_tcon_ref_get_dfs_refer);
+		}
 		spin_unlock(&cifs_tcp_ses_lock);
 	}
 
@@ -2976,6 +2990,8 @@
 		/* ipc tcons are not refcounted */
 		spin_lock(&cifs_tcp_ses_lock);
 		tcon->tc_count--;
+		trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+				    netfs_trace_tcon_ref_dec_dfs_refer);
 		/* tc_count can never go negative */
 		WARN_ON(tcon->tc_count < 0);
 		spin_unlock(&cifs_tcp_ses_lock);
@@ -2986,114 +3002,11 @@
 	return rc;
 }
 
-/* See MS-FSCC 2.1.2.6 for the 'NFS' style reparse tags */
-static int parse_reparse_posix(struct reparse_posix_data *buf,
-			       struct cifs_sb_info *cifs_sb,
-			       struct cifs_open_info_data *data)
-{
-	unsigned int len;
-	u64 type;
-
-	switch ((type = le64_to_cpu(buf->InodeType))) {
-	case NFS_SPECFILE_LNK:
-		len = le16_to_cpu(buf->ReparseDataLength);
-		data->symlink_target = cifs_strndup_from_utf16(buf->DataBuffer,
-							       len, true,
-							       cifs_sb->local_nls);
-		if (!data->symlink_target)
-			return -ENOMEM;
-		convert_delimiter(data->symlink_target, '/');
-		cifs_dbg(FYI, "%s: target path: %s\n",
-			 __func__, data->symlink_target);
-		break;
-	case NFS_SPECFILE_CHR:
-	case NFS_SPECFILE_BLK:
-	case NFS_SPECFILE_FIFO:
-	case NFS_SPECFILE_SOCK:
-		break;
-	default:
-		cifs_dbg(VFS, "%s: unhandled inode type: 0x%llx\n",
-			 __func__, type);
-		return -EOPNOTSUPP;
-	}
-	return 0;
-}
-
-static int parse_reparse_symlink(struct reparse_symlink_data_buffer *sym,
-				 u32 plen, bool unicode,
-				 struct cifs_sb_info *cifs_sb,
-				 struct cifs_open_info_data *data)
-{
-	unsigned int len;
-	unsigned int offs;
-
-	/* We handle Symbolic Link reparse tag here. See: MS-FSCC 2.1.2.4 */
-
-	offs = le16_to_cpu(sym->SubstituteNameOffset);
-	len = le16_to_cpu(sym->SubstituteNameLength);
-	if (offs + 20 > plen || offs + len + 20 > plen) {
-		cifs_dbg(VFS, "srv returned malformed symlink buffer\n");
-		return -EIO;
-	}
-
-	data->symlink_target = cifs_strndup_from_utf16(sym->PathBuffer + offs,
-						       len, unicode,
-						       cifs_sb->local_nls);
-	if (!data->symlink_target)
-		return -ENOMEM;
-
-	convert_delimiter(data->symlink_target, '/');
-	cifs_dbg(FYI, "%s: target path: %s\n", __func__, data->symlink_target);
-
-	return 0;
-}
-
-int parse_reparse_point(struct reparse_data_buffer *buf,
-			u32 plen, struct cifs_sb_info *cifs_sb,
-			bool unicode, struct cifs_open_info_data *data)
-{
-	data->reparse.buf = buf;
-
-	/* See MS-FSCC 2.1.2 */
-	switch (le32_to_cpu(buf->ReparseTag)) {
-	case IO_REPARSE_TAG_NFS:
-		return parse_reparse_posix((struct reparse_posix_data *)buf,
-					   cifs_sb, data);
-	case IO_REPARSE_TAG_SYMLINK:
-		return parse_reparse_symlink(
-			(struct reparse_symlink_data_buffer *)buf,
-			plen, unicode, cifs_sb, data);
-	case IO_REPARSE_TAG_LX_SYMLINK:
-	case IO_REPARSE_TAG_AF_UNIX:
-	case IO_REPARSE_TAG_LX_FIFO:
-	case IO_REPARSE_TAG_LX_CHR:
-	case IO_REPARSE_TAG_LX_BLK:
-		return 0;
-	default:
-		cifs_dbg(VFS, "%s: unhandled reparse tag: 0x%08x\n",
-			 __func__, le32_to_cpu(buf->ReparseTag));
-		return -EOPNOTSUPP;
-	}
-}
-
-static int smb2_parse_reparse_point(struct cifs_sb_info *cifs_sb,
-				    struct kvec *rsp_iov,
-				    struct cifs_open_info_data *data)
-{
-	struct reparse_data_buffer *buf;
-	struct smb2_ioctl_rsp *io = rsp_iov->iov_base;
-	u32 plen = le32_to_cpu(io->OutputCount);
-
-	buf = (struct reparse_data_buffer *)((u8 *)io +
-					     le32_to_cpu(io->OutputOffset));
-	return parse_reparse_point(buf, plen, cifs_sb, true, data);
-}
-
-static struct cifs_ntsd *
+static struct smb_ntsd *
 get_smb2_acl_by_fid(struct cifs_sb_info *cifs_sb,
 		    const struct cifs_fid *cifsfid, u32 *pacllen, u32 info)
 {
-	struct cifs_ntsd *pntsd = NULL;
+	struct smb_ntsd *pntsd = NULL;
 	unsigned int xid;
 	int rc = -EOPNOTSUPP;
 	struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
@@ -3118,11 +3031,11 @@
 
 }
 
-static struct cifs_ntsd *
+static struct smb_ntsd *
 get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb,
 		     const char *path, u32 *pacllen, u32 info)
 {
-	struct cifs_ntsd *pntsd = NULL;
+	struct smb_ntsd *pntsd = NULL;
 	u8 oplock = SMB2_OPLOCK_LEVEL_NONE;
 	unsigned int xid;
 	int rc;
@@ -3185,7 +3098,7 @@
 }
 
 static int
-set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
+set_smb2_acl(struct smb_ntsd *pnntsd, __u32 acllen,
 		struct inode *inode, const char *path, int aclflag)
 {
 	u8 oplock = SMB2_OPLOCK_LEVEL_NONE;
@@ -3243,12 +3156,12 @@
 }
 
 /* Retrieve an ACL from the server */
-static struct cifs_ntsd *
+static struct smb_ntsd *
 get_smb2_acl(struct cifs_sb_info *cifs_sb,
 	     struct inode *inode, const char *path,
 	     u32 *pacllen, u32 info)
 {
-	struct cifs_ntsd *pntsd = NULL;
+	struct smb_ntsd *pntsd = NULL;
 	struct cifsFileInfo *open_file = NULL;
 
 	if (inode && !(info & SACL_SECINFO))
@@ -3280,13 +3193,15 @@
 }
 
 static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
-			    loff_t offset, loff_t len, bool keep_size)
+			    unsigned long long offset, unsigned long long len,
+			    bool keep_size)
 {
 	struct cifs_ses *ses = tcon->ses;
 	struct inode *inode = file_inode(file);
 	struct cifsInodeInfo *cifsi = CIFS_I(inode);
 	struct cifsFileInfo *cfile = file->private_data;
-	unsigned long long new_size;
+	struct netfs_inode *ictx = netfs_inode(inode);
+	unsigned long long i_size, new_size, remote_size;
 	long rc;
 	unsigned int xid;
 
@@ -3298,6 +3213,16 @@
 	inode_lock(inode);
 	filemap_invalidate_lock(inode->i_mapping);
 
+	i_size = i_size_read(inode);
+	remote_size = ictx->remote_i_size;
+	if (offset + len >= remote_size && offset < i_size) {
+		unsigned long long top = umin(offset + len, i_size);
+
+		rc = filemap_write_and_wait_range(inode->i_mapping, offset, top - 1);
+		if (rc < 0)
+			goto zero_range_exit;
+	}
+
 	/*
 	 * We zero the range through ioctl, so we need remove the page caches
 	 * first, otherwise the data may be inconsistent with the server.
@@ -3348,6 +3273,7 @@
 	struct inode *inode = file_inode(file);
 	struct cifsFileInfo *cfile = file->private_data;
 	struct file_zero_data_information fsctl_buf;
+	unsigned long long end = offset + len, i_size, remote_i_size;
 	long rc;
 	unsigned int xid;
 	__u8 set_sparse = 1;
@@ -3379,6 +3305,27 @@
 			(char *)&fsctl_buf,
 			sizeof(struct file_zero_data_information),
 			CIFSMaxBufSize, NULL, NULL);
+
+	if (rc)
+		goto unlock;
+
+	/* If there's dirty data in the buffer that would extend the EOF if it
+	 * were written, then we need to move the EOF marker over to the lower
+	 * of the high end of the hole and the proposed EOF.  The problem is
+	 * that we locally hole-punch the tail of the dirty data, the proposed
+	 * EOF update will end up in the wrong place.
+	 */
+	i_size = i_size_read(inode);
+	remote_i_size = netfs_inode(inode)->remote_i_size;
+	if (end > remote_i_size && i_size > remote_i_size) {
+		unsigned long long extend_to = umin(end, i_size);
+		rc = SMB2_set_eof(xid, tcon, cfile->fid.persistent_fid,
+				  cfile->fid.volatile_fid, cfile->pid, extend_to);
+		if (rc >= 0)
+			netfs_inode(inode)->remote_i_size = extend_to;
+	}
+
+unlock:
 	filemap_invalidate_unlock(inode->i_mapping);
 out:
 	inode_unlock(inode);
@@ -4078,7 +4025,7 @@
 	if (oplock == SMB2_OPLOCK_LEVEL_EXCLUSIVE)
 		return SMB2_LEASE_WRITE_CACHING_LE | SMB2_LEASE_READ_CACHING_LE;
 	else if (oplock == SMB2_OPLOCK_LEVEL_II)
-		return SMB2_LEASE_READ_CACHING_LE;
+		return SMB2_LEASE_READ_CACHING_LE | SMB2_LEASE_HANDLE_CACHING_LE;
 	else if (oplock == SMB2_OPLOCK_LEVEL_BATCH)
 		return SMB2_LEASE_HANDLE_CACHING_LE | SMB2_LEASE_READ_CACHING_LE |
 		       SMB2_LEASE_WRITE_CACHING_LE;
@@ -4313,7 +4260,7 @@
  */
 static int
 crypt_message(struct TCP_Server_Info *server, int num_rqst,
-	      struct smb_rqst *rqst, int enc)
+	      struct smb_rqst *rqst, int enc, struct crypto_aead *tfm)
 {
 	struct smb2_transform_hdr *tr_hdr =
 		(struct smb2_transform_hdr *)rqst[0].rq_iov[0].iov_base;
@@ -4324,8 +4271,6 @@
 	u8 key[SMB3_ENC_DEC_KEY_SIZE];
 	struct aead_request *req;
 	u8 *iv;
-	DECLARE_CRYPTO_WAIT(wait);
-	struct crypto_aead *tfm;
 	unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
 	void *creq;
 	size_t sensitive_size;
@@ -4337,14 +4282,6 @@
 		return rc;
 	}
 
-	rc = smb3_crypto_aead_allocate(server);
-	if (rc) {
-		cifs_server_dbg(VFS, "%s: crypto alloc failed\n", __func__);
-		return rc;
-	}
-
-	tfm = enc ? server->secmech.enc : server->secmech.dec;
-
 	if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) ||
 		(server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))
 		rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE);
@@ -4384,11 +4321,7 @@
 	aead_request_set_crypt(req, sg, sg, crypt_len, iv);
 	aead_request_set_ad(req, assoc_data_len);
 
-	aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-				  crypto_req_done, &wait);
-
-	rc = crypto_wait_req(enc ? crypto_aead_encrypt(req)
-				: crypto_aead_decrypt(req), &wait);
+	rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);
 
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
@@ -4495,7 +4428,7 @@
 	/* fill the 1st iov with a transform header */
 	fill_transform_hdr(tr_hdr, orig_len, old_rq, server->cipher_type);
 
-	rc = crypt_message(server, num_rqst, new_rq, 1);
+	rc = crypt_message(server, num_rqst, new_rq, 1, server->secmech.enc);
 	cifs_dbg(FYI, "Encrypt message returned %d\n", rc);
 	if (rc)
 		goto err_free;
@@ -4520,8 +4453,9 @@
 		 unsigned int buf_data_size, struct iov_iter *iter,
 		 bool is_offloaded)
 {
-	struct kvec iov[2];
+	struct crypto_aead *tfm;
 	struct smb_rqst rqst = {NULL};
+	struct kvec iov[2];
 	size_t iter_size = 0;
 	int rc;
 
@@ -4538,9 +4472,31 @@
 		iter_size = iov_iter_count(iter);
 	}
 
-	rc = crypt_message(server, 1, &rqst, 0);
+	if (is_offloaded) {
+		if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) ||
+		    (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))
+			tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
+		else
+			tfm = crypto_alloc_aead("ccm(aes)", 0, 0);
+		if (IS_ERR(tfm)) {
+			rc = PTR_ERR(tfm);
+			cifs_server_dbg(VFS, "%s: Failed alloc decrypt TFM, rc=%d\n", __func__, rc);
+
+			return rc;
+		}
+	} else {
+		if (unlikely(!server->secmech.dec))
+			return -EIO;
+
+		tfm = server->secmech.dec;
+	}
+
+	rc = crypt_message(server, 1, &rqst, 0, tfm);
 	cifs_dbg(FYI, "Decrypt message returned %d\n", rc);
 
+	if (is_offloaded)
+		crypto_free_aead(tfm);
+
 	if (rc)
 		return rc;
 
@@ -5128,152 +5084,6 @@
 	return rc;
 }
 
-static inline u64 mode_nfs_type(mode_t mode)
-{
-	switch (mode & S_IFMT) {
-	case S_IFBLK: return NFS_SPECFILE_BLK;
-	case S_IFCHR: return NFS_SPECFILE_CHR;
-	case S_IFIFO: return NFS_SPECFILE_FIFO;
-	case S_IFSOCK: return NFS_SPECFILE_SOCK;
-	}
-	return 0;
-}
-
-static int nfs_set_reparse_buf(struct reparse_posix_data *buf,
-			       mode_t mode, dev_t dev,
-			       struct kvec *iov)
-{
-	u64 type;
-	u16 len, dlen;
-
-	len = sizeof(*buf);
-
-	switch ((type = mode_nfs_type(mode))) {
-	case NFS_SPECFILE_BLK:
-	case NFS_SPECFILE_CHR:
-		dlen = sizeof(__le64);
-		break;
-	case NFS_SPECFILE_FIFO:
-	case NFS_SPECFILE_SOCK:
-		dlen = 0;
-		break;
-	default:
-		return -EOPNOTSUPP;
-	}
-
-	buf->ReparseTag = cpu_to_le32(IO_REPARSE_TAG_NFS);
-	buf->Reserved = 0;
-	buf->InodeType = cpu_to_le64(type);
-	buf->ReparseDataLength = cpu_to_le16(len + dlen -
-					     sizeof(struct reparse_data_buffer));
-	*(__le64 *)buf->DataBuffer = cpu_to_le64(((u64)MAJOR(dev) << 32) |
-						 MINOR(dev));
-	iov->iov_base = buf;
-	iov->iov_len = len + dlen;
-	return 0;
-}
-
-static int nfs_make_node(unsigned int xid, struct inode *inode,
-			 struct dentry *dentry, struct cifs_tcon *tcon,
-			 const char *full_path, umode_t mode, dev_t dev)
-{
-	struct cifs_open_info_data data;
-	struct reparse_posix_data *p;
-	struct inode *new;
-	struct kvec iov;
-	__u8 buf[sizeof(*p) + sizeof(__le64)];
-	int rc;
-
-	p = (struct reparse_posix_data *)buf;
-	rc = nfs_set_reparse_buf(p, mode, dev, &iov);
-	if (rc)
-		return rc;
-
-	data = (struct cifs_open_info_data) {
-		.reparse_point = true,
-		.reparse = { .tag = IO_REPARSE_TAG_NFS, .posix = p, },
-	};
-
-	new = smb2_get_reparse_inode(&data, inode->i_sb, xid,
-				     tcon, full_path, &iov);
-	if (!IS_ERR(new))
-		d_instantiate(dentry, new);
-	else
-		rc = PTR_ERR(new);
-	cifs_free_open_info(&data);
-	return rc;
-}
-
-static int smb2_create_reparse_symlink(const unsigned int xid,
-				       struct inode *inode,
-				       struct dentry *dentry,
-				       struct cifs_tcon *tcon,
-				       const char *full_path,
-				       const char *symname)
-{
-	struct reparse_symlink_data_buffer *buf = NULL;
-	struct cifs_open_info_data data;
-	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
-	struct inode *new;
-	struct kvec iov;
-	__le16 *path;
-	char *sym, sep = CIFS_DIR_SEP(cifs_sb);
-	u16 len, plen;
-	int rc = 0;
-
-	sym = kstrdup(symname, GFP_KERNEL);
-	if (!sym)
-		return -ENOMEM;
-
-	data = (struct cifs_open_info_data) {
-		.reparse_point = true,
-		.reparse = { .tag = IO_REPARSE_TAG_SYMLINK, },
-		.symlink_target = sym,
-	};
-
-	convert_delimiter(sym, sep);
-	path = cifs_convert_path_to_utf16(sym, cifs_sb);
-	if (!path) {
-		rc = -ENOMEM;
-		goto out;
-	}
-
-	plen = 2 * UniStrnlen((wchar_t *)path, PATH_MAX);
-	len = sizeof(*buf) + plen * 2;
-	buf = kzalloc(len, GFP_KERNEL);
-	if (!buf) {
-		rc = -ENOMEM;
-		goto out;
-	}
-
-	buf->ReparseTag = cpu_to_le32(IO_REPARSE_TAG_SYMLINK);
-	buf->ReparseDataLength = cpu_to_le16(len - sizeof(struct reparse_data_buffer));
-	buf->SubstituteNameOffset = cpu_to_le16(plen);
-	buf->SubstituteNameLength = cpu_to_le16(plen);
-	memcpy(&buf->PathBuffer[plen], path, plen);
-	buf->PrintNameOffset = 0;
-	buf->PrintNameLength = cpu_to_le16(plen);
-	memcpy(buf->PathBuffer, path, plen);
-	buf->Flags = cpu_to_le32(*symname != '/' ? SYMLINK_FLAG_RELATIVE : 0);
-	if (*sym != sep)
-		buf->Flags = cpu_to_le32(SYMLINK_FLAG_RELATIVE);
-
-	convert_delimiter(sym, '/');
-	iov.iov_base = buf;
-	iov.iov_len = len;
-	new = smb2_get_reparse_inode(&data, inode->i_sb, xid,
-				     tcon, full_path, &iov);
-	if (!IS_ERR(new))
-		d_instantiate(dentry, new);
-	else
-		rc = PTR_ERR(new);
-out:
-	kfree(path);
-	cifs_free_open_info(&data);
-	kfree(buf);
-	return rc;
-}
-
 static int smb2_make_node(unsigned int xid, struct inode *inode,
 			  struct dentry *dentry, struct cifs_tcon *tcon,
 			  const char *full_path, umode_t mode, dev_t dev)
@@ -5291,8 +5101,8 @@
 		rc = cifs_sfu_make_node(xid, inode, dentry, tcon,
 					full_path, mode, dev);
 	} else {
-		rc = nfs_make_node(xid, inode, dentry, tcon,
-				   full_path, mode, dev);
+		rc = smb2_make_nfs_node(xid, inode, dentry, tcon,
+					full_path, mode, dev);
 	}
 	return rc;
 }
@@ -5538,6 +5348,7 @@
 	.tree_connect = SMB2_tcon,
 	.tree_disconnect = SMB2_tdis,
 	.qfs_tcon = smb3_qfs_tcon,
+	.query_server_interfaces = SMB3_request_interfaces,
 	.is_path_accessible = smb2_is_path_accessible,
 	.can_echo = smb2_can_echo,
 	.echo = SMB2_echo,
@@ -5653,6 +5464,7 @@
 	.tree_connect = SMB2_tcon,
 	.tree_disconnect = SMB2_tdis,
 	.qfs_tcon = smb3_qfs_tcon,
+	.query_server_interfaces = SMB3_request_interfaces,
 	.is_path_accessible = smb2_is_path_accessible,
 	.can_echo = smb2_can_echo,
 	.echo = SMB2_echo,
--- linux-qcom-6.8.0.orig/fs/smb/client/smb2pdu.c
+++ linux-qcom-6.8.0/fs/smb/client/smb2pdu.c
@@ -80,6 +80,9 @@
 	if (tcon->seal &&
 	    (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
 		return 1;
+	if (((global_secflags & CIFSSEC_MUST_SEAL) == CIFSSEC_MUST_SEAL) &&
+	    (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
+		return 1;
 	return 0;
 }
 
@@ -367,6 +370,17 @@
 		}
 
 		rc = cifs_setup_session(0, ses, server, nls_codepage);
+		if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) {
+			/*
+			 * Try alternate password for next reconnect (key rotation
+			 * could be enabled on the server e.g.) if an alternate
+			 * password is available and the current password is expired,
+			 * but do not swap on non pwd related errors like host down
+			 */
+			if (ses->password2)
+				swap(ses->password2, ses->password);
+		}
+
 		if ((rc == -EACCES) && !tcon->retry) {
 			mutex_unlock(&ses->session_mutex);
 			rc = -EHOSTDOWN;
@@ -409,14 +423,15 @@
 	spin_unlock(&ses->ses_lock);
 
 	if (!rc &&
-	    (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
+	    (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL) &&
+	    server->ops->query_server_interfaces) {
 		mutex_unlock(&ses->session_mutex);
 
 		/*
 		 * query server network interfaces, in case they change
 		 */
 		xid = get_xid();
-		rc = SMB3_request_interfaces(xid, tcon, false);
+		rc = server->ops->query_server_interfaces(xid, tcon, false);
 		free_xid(xid);
 
 		if (rc == -EOPNOTSUPP && ses->chan_count > 1) {
@@ -1203,7 +1218,9 @@
 	 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context
 	 * Set the cipher type manually.
 	 */
-	if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
+	if ((server->dialect == SMB30_PROT_ID ||
+	     server->dialect == SMB302_PROT_ID) &&
+	    (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
 		server->cipher_type = SMB2_ENCRYPTION_AES128_CCM;
 
 	security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
@@ -1238,6 +1255,12 @@
 		else
 			cifs_server_dbg(VFS, "Missing expected negotiate contexts\n");
 	}
+
+	if (server->cipher_type && !rc) {
+		rc = smb3_crypto_aead_allocate(server);
+		if (rc)
+			cifs_server_dbg(VFS, "%s: crypto alloc failed, rc=%d\n", __func__, rc);
+	}
 neg_exit:
 	free_rsp_buf(resp_buftype, rsp);
 	return rc;
@@ -1536,6 +1559,11 @@
 			    &sess_data->buf0_type,
 			    CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov);
 	cifs_small_buf_release(sess_data->iov[0].iov_base);
+	if (rc == 0)
+		sess_data->ses->expired_pwd = false;
+	else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED))
+		sess_data->ses->expired_pwd = true;
+
 	memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
 
 	return rc;
@@ -2585,7 +2613,7 @@
 	unsigned int group_offset = 0;
 	struct smb3_acl acl = {};
 
-	*len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8);
+	*len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct smb_ace) * 4), 8);
 
 	if (set_owner) {
 		/* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */
@@ -2634,21 +2662,21 @@
 	ptr += sizeof(struct smb3_acl);
 
 	/* create one ACE to hold the mode embedded in reserved special SID */
-	acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode);
+	acelen = setup_special_mode_ACE((struct smb_ace *)ptr, false, (__u64)mode);
 	ptr += acelen;
 	acl_size = acelen + sizeof(struct smb3_acl);
 	ace_count = 1;
 
 	if (set_owner) {
 		/* we do not need to reallocate buffer to add the two more ACEs. plenty of space */
-		acelen = setup_special_user_owner_ACE((struct cifs_ace *)ptr);
+		acelen = setup_special_user_owner_ACE((struct smb_ace *)ptr);
 		ptr += acelen;
 		acl_size += acelen;
 		ace_count += 1;
 	}
 
 	/* and one more ACE to allow access for authenticated users */
-	acelen = setup_authusers_ACE((struct cifs_ace *)ptr);
+	acelen = setup_authusers_ACE((struct smb_ace *)ptr);
 	ptr += acelen;
 	acl_size += acelen;
 	ace_count += 1;
@@ -3252,6 +3280,15 @@
 		return rc;
 
 	if (indatalen) {
+		unsigned int len;
+
+		if (WARN_ON_ONCE(smb3_encryption_required(tcon) &&
+				 (check_add_overflow(total_len - 1,
+						     ALIGN(indatalen, 8), &len) ||
+				  len > MAX_CIFS_SMALL_BUFFER_SIZE))) {
+			cifs_small_buf_release(req);
+			return -EIO;
+		}
 		/*
 		 * indatalen is usually small at a couple of bytes max, so
 		 * just allocate through generic pool
@@ -3600,9 +3637,9 @@
 			memcpy(&pbuf->network_open_info,
 			       &rsp->network_open_info,
 			       sizeof(pbuf->network_open_info));
+		atomic_dec(&tcon->num_remote_opens);
 	}
 
-	atomic_dec(&tcon->num_remote_opens);
 close_exit:
 	SMB2_close_free(&rqst);
 	free_rsp_buf(resp_buftype, rsp);
@@ -3856,7 +3893,7 @@
 		u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen)
 {
 	size_t output_len = sizeof(struct smb311_posix_qinfo *) +
-			(sizeof(struct cifs_sid) * 2) + (PATH_MAX * 2);
+			(sizeof(struct smb_sid) * 2) + (PATH_MAX * 2);
 	*plen = 0;
 
 	return query_info(xid, tcon, persistent_fid, volatile_fid,
@@ -4099,6 +4136,8 @@
 		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 			if (tcon->need_reconnect || tcon->need_reopen_files) {
 				tcon->tc_count++;
+				trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+						    netfs_trace_tcon_ref_get_reconnect_server);
 				list_add_tail(&tcon->rlist, &tmp_list);
 				tcon_selected = true;
 			}
@@ -4137,14 +4176,14 @@
 		if (tcon->ipc)
 			cifs_put_smb_ses(tcon->ses);
 		else
-			cifs_put_tcon(tcon);
+			cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_reconnect_server);
 	}
 
 	if (!ses_exist)
 		goto done;
 
 	/* allocate a dummy tcon struct used for reconnect */
-	tcon = tcon_info_alloc(false);
+	tcon = tcon_info_alloc(false, netfs_trace_tcon_ref_new_reconnect_server);
 	if (!tcon) {
 		resched = true;
 		list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) {
@@ -4167,7 +4206,7 @@
 		list_del_init(&ses->rlist);
 		cifs_put_smb_ses(ses);
 	}
-	tconInfoFree(tcon);
+	tconInfoFree(tcon, netfs_trace_tcon_ref_free_reconnect_server);
 
 done:
 	cifs_dbg(FYI, "Reconnecting tcons and channels finished\n");
@@ -4387,7 +4426,7 @@
 	 * If we want to do a RDMA write, fill in and append
 	 * smbd_buffer_descriptor_v1 to the end of read request
 	 */
-	if (smb3_use_rdma_offload(io_parms)) {
+	if (rdata && smb3_use_rdma_offload(io_parms)) {
 		struct smbd_buffer_descriptor_v1 *v1;
 		bool need_invalidate = server->dialect == SMB30_PROT_ID;
 
@@ -5565,7 +5604,7 @@
 int
 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon,
 		u64 persistent_fid, u64 volatile_fid,
-		struct cifs_ntsd *pnntsd, int pacllen, int aclflag)
+		struct smb_ntsd *pnntsd, int pacllen, int aclflag)
 {
 	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
 			current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag,
--- linux-qcom-6.8.0.orig/fs/smb/client/smb2pdu.h
+++ linux-qcom-6.8.0/fs/smb/client/smb2pdu.h
@@ -319,7 +319,7 @@
 } __packed;
 
 struct smb2_file_network_open_info {
-	struct_group(network_open_info,
+	struct_group_attr(network_open_info, __packed,
 		__le64 CreationTime;
 		__le64 LastAccessTime;
 		__le64 LastWriteTime;
@@ -363,8 +363,8 @@
 	u32 nlink;
 	u32 reparse_tag;
 	u32 mode;
-	struct cifs_sid owner; /* var-sized on the wire */
-	struct cifs_sid group; /* var-sized on the wire */
+	struct smb_sid owner; /* var-sized on the wire */
+	struct smb_sid group; /* var-sized on the wire */
 } __packed;
 
 #define SMB2_QUERY_DIRECTORY_IOV_SIZE 2
@@ -407,8 +407,8 @@
 struct smb2_posix_info_parsed {
 	const struct smb2_posix_info *base;
 	size_t size;
-	struct cifs_sid owner;
-	struct cifs_sid group;
+	struct smb_sid owner;
+	struct smb_sid group;
 	int name_len;
 	const u8 *name;
 };
--- linux-qcom-6.8.0.orig/fs/smb/client/smb2proto.h
+++ linux-qcom-6.8.0/fs/smb/client/smb2proto.h
@@ -37,8 +37,6 @@
 					      struct smb_rqst *rqst);
 extern struct mid_q_entry *smb2_setup_async_request(
 			struct TCP_Server_Info *server, struct smb_rqst *rqst);
-extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server,
-					   __u64 ses_id);
 extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server,
 						__u64 ses_id, __u32  tid);
 extern int smb2_calc_signature(struct smb_rqst *rqst,
@@ -109,7 +107,14 @@
 			  struct cifs_sb_info *cifs_sb,
 			  const unsigned char *path, char *pbuf,
 			  unsigned int *pbytes_read);
-int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec *iov, char **path);
+int smb2_parse_native_symlink(char **target, const char *buf, unsigned int len,
+			      bool unicode, bool relative,
+			      const char *full_path,
+			      struct cifs_sb_info *cifs_sb);
+int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb,
+				const struct kvec *iov,
+				const char *full_path,
+				char **path);
 int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32 *oplock,
 		   void *buf);
 extern int smb2_unlock_range(struct cifsFileInfo *cfile,
@@ -236,7 +241,7 @@
 extern void SMB2_set_info_free(struct smb_rqst *rqst);
 extern int SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon,
 			u64 persistent_fid, u64 volatile_fid,
-			struct cifs_ntsd *pnntsd, int pacllen, int aclflag);
+			struct smb_ntsd *pnntsd, int pacllen, int aclflag);
 extern int SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
 		       u64 persistent_fid, u64 volatile_fid,
 		       struct smb2_file_full_ea_info *buf, int len);
@@ -308,5 +313,11 @@
 int posix_info_parse(const void *beg, const void *end,
 		     struct smb2_posix_info_parsed *out);
 int posix_info_sid_size(const void *beg, const void *end);
+int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode,
+				struct dentry *dentry, struct cifs_tcon *tcon,
+				const char *full_path, const char *symname);
+int smb2_make_nfs_node(unsigned int xid, struct inode *inode,
+		       struct dentry *dentry, struct cifs_tcon *tcon,
+		       const char *full_path, umode_t mode, dev_t dev);
 
 #endif			/* _SMB2PROTO_H */
--- linux-qcom-6.8.0.orig/fs/smb/client/smb2transport.c
+++ linux-qcom-6.8.0/fs/smb/client/smb2transport.c
@@ -74,7 +74,7 @@
 
 
 static
-int smb2_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key)
+int smb3_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key)
 {
 	struct cifs_chan *chan;
 	struct TCP_Server_Info *pserver;
@@ -168,16 +168,41 @@
 	return NULL;
 }
 
-struct cifs_ses *
-smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
+static int smb2_get_sign_key(struct TCP_Server_Info *server,
+			     __u64 ses_id, u8 *key)
 {
 	struct cifs_ses *ses;
+	int rc = -ENOENT;
+
+	if (SERVER_IS_CHAN(server))
+		server = server->primary_server;
 
 	spin_lock(&cifs_tcp_ses_lock);
-	ses = smb2_find_smb_ses_unlocked(server, ses_id);
-	spin_unlock(&cifs_tcp_ses_lock);
+	list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
+		if (ses->Suid != ses_id)
+			continue;
 
-	return ses;
+		rc = 0;
+		spin_lock(&ses->ses_lock);
+		switch (ses->ses_status) {
+		case SES_EXITING: /* SMB2_LOGOFF */
+		case SES_GOOD:
+			if (likely(ses->auth_key.response)) {
+				memcpy(key, ses->auth_key.response,
+				       SMB2_NTLMV2_SESSKEY_SIZE);
+			} else {
+				rc = -EIO;
+			}
+			break;
+		default:
+			rc = -EAGAIN;
+			break;
+		}
+		spin_unlock(&ses->ses_lock);
+		break;
+	}
+	spin_unlock(&cifs_tcp_ses_lock);
+	return rc;
 }
 
 static struct cifs_tcon *
@@ -189,6 +214,8 @@
 		if (tcon->tid != tid)
 			continue;
 		++tcon->tc_count;
+		trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
+				    netfs_trace_tcon_ref_get_find_sess_tcon);
 		return tcon;
 	}
 
@@ -214,8 +241,8 @@
 	}
 	tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid);
 	if (!tcon) {
-		cifs_put_smb_ses(ses);
 		spin_unlock(&cifs_tcp_ses_lock);
+		cifs_put_smb_ses(ses);
 		return NULL;
 	}
 	spin_unlock(&cifs_tcp_ses_lock);
@@ -234,14 +261,16 @@
 	unsigned char *sigptr = smb2_signature;
 	struct kvec *iov = rqst->rq_iov;
 	struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base;
-	struct cifs_ses *ses;
 	struct shash_desc *shash = NULL;
 	struct smb_rqst drqst;
+	__u64 sid = le64_to_cpu(shdr->SessionId);
+	u8 key[SMB2_NTLMV2_SESSKEY_SIZE];
 
-	ses = smb2_find_smb_ses(server, le64_to_cpu(shdr->SessionId));
-	if (unlikely(!ses)) {
-		cifs_server_dbg(VFS, "%s: Could not find session\n", __func__);
-		return -ENOENT;
+	rc = smb2_get_sign_key(server, sid, key);
+	if (unlikely(rc)) {
+		cifs_server_dbg(FYI, "%s: [sesid=0x%llx] couldn't find signing key: %d\n",
+				__func__, sid, rc);
+		return rc;
 	}
 
 	memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE);
@@ -258,8 +287,7 @@
 		shash = server->secmech.hmacsha256;
 	}
 
-	rc = crypto_shash_setkey(shash->tfm, ses->auth_key.response,
-			SMB2_NTLMV2_SESSKEY_SIZE);
+	rc = crypto_shash_setkey(shash->tfm, key, sizeof(key));
 	if (rc) {
 		cifs_server_dbg(VFS,
 				"%s: Could not update with response\n",
@@ -301,8 +329,6 @@
 out:
 	if (allocate_crypto)
 		cifs_free_hash(&shash);
-	if (ses)
-		cifs_put_smb_ses(ses);
 	return rc;
 }
 
@@ -568,7 +594,7 @@
 	struct smb_rqst drqst;
 	u8 key[SMB3_SIGN_KEY_SIZE];
 
-	rc = smb2_get_sign_key(le64_to_cpu(shdr->SessionId), server, key);
+	rc = smb3_get_sign_key(le64_to_cpu(shdr->SessionId), server, key);
 	if (unlikely(rc)) {
 		cifs_server_dbg(FYI, "%s: Could not get signing key\n", __func__);
 		return rc;
--- linux-qcom-6.8.0.orig/fs/smb/client/trace.h
+++ linux-qcom-6.8.0/fs/smb/client/trace.h
@@ -3,6 +3,9 @@
  *   Copyright (C) 2018, Microsoft Corporation.
  *
  *   Author(s): Steve French <stfrench@microsoft.com>
+ *
+ * Please use this 3-part article as a reference for writing new tracepoints:
+ * https://lwn.net/Articles/379903/
  */
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM cifs
@@ -15,9 +18,73 @@
 #include <linux/inet.h>
 
 /*
- * Please use this 3-part article as a reference for writing new tracepoints:
- * https://lwn.net/Articles/379903/
+ * Specify enums for tracing information.
+ */
+#define smb3_tcon_ref_traces					      \
+	EM(netfs_trace_tcon_ref_dec_dfs_refer,		"DEC DfsRef") \
+	EM(netfs_trace_tcon_ref_free,			"FRE       ") \
+	EM(netfs_trace_tcon_ref_free_fail,		"FRE Fail  ") \
+	EM(netfs_trace_tcon_ref_free_ipc,		"FRE Ipc   ") \
+	EM(netfs_trace_tcon_ref_free_ipc_fail,		"FRE Ipc-F ") \
+	EM(netfs_trace_tcon_ref_free_reconnect_server,	"FRE Reconn") \
+	EM(netfs_trace_tcon_ref_get_cached_laundromat,	"GET Ch-Lau") \
+	EM(netfs_trace_tcon_ref_get_cached_lease_break,	"GET Ch-Lea") \
+	EM(netfs_trace_tcon_ref_get_cancelled_close,	"GET Cn-Cls") \
+	EM(netfs_trace_tcon_ref_get_dfs_refer,		"GET DfsRef") \
+	EM(netfs_trace_tcon_ref_get_find,		"GET Find  ") \
+	EM(netfs_trace_tcon_ref_get_find_sess_tcon,	"GET FndSes") \
+	EM(netfs_trace_tcon_ref_get_reconnect_server,	"GET Reconn") \
+	EM(netfs_trace_tcon_ref_new,			"NEW       ") \
+	EM(netfs_trace_tcon_ref_new_ipc,		"NEW Ipc   ") \
+	EM(netfs_trace_tcon_ref_new_reconnect_server,	"NEW Reconn") \
+	EM(netfs_trace_tcon_ref_put_cached_close,	"PUT Ch-Cls") \
+	EM(netfs_trace_tcon_ref_put_cancelled_close,	"PUT Cn-Cls") \
+	EM(netfs_trace_tcon_ref_put_cancelled_close_fid, "PUT Cn-Fid") \
+	EM(netfs_trace_tcon_ref_put_cancelled_mid,	"PUT Cn-Mid") \
+	EM(netfs_trace_tcon_ref_put_mnt_ctx,		"PUT MntCtx") \
+	EM(netfs_trace_tcon_ref_put_reconnect_server,	"PUT Reconn") \
+	EM(netfs_trace_tcon_ref_put_tlink,		"PUT Tlink ") \
+	EM(netfs_trace_tcon_ref_see_cancelled_close,	"SEE Cn-Cls") \
+	EM(netfs_trace_tcon_ref_see_fscache_collision,	"SEE FV-CO!") \
+	EM(netfs_trace_tcon_ref_see_fscache_okay,	"SEE FV-Ok ") \
+	EM(netfs_trace_tcon_ref_see_fscache_relinq,	"SEE FV-Rlq") \
+	E_(netfs_trace_tcon_ref_see_umount,		"SEE Umount")
+
+#undef EM
+#undef E_
+
+/*
+ * Define those tracing enums.
  */
+#ifndef __SMB3_DECLARE_TRACE_ENUMS_ONCE_ONLY
+#define __SMB3_DECLARE_TRACE_ENUMS_ONCE_ONLY
+
+#define EM(a, b) a,
+#define E_(a, b) a
+
+enum smb3_tcon_ref_trace { smb3_tcon_ref_traces } __mode(byte);
+
+#undef EM
+#undef E_
+#endif
+
+/*
+ * Export enum symbols via userspace.
+ */
+#define EM(a, b) TRACE_DEFINE_ENUM(a);
+#define E_(a, b) TRACE_DEFINE_ENUM(a);
+
+smb3_tcon_ref_traces;
+
+#undef EM
+#undef E_
+
+/*
+ * Now redefine the EM() and E_() macros to map the enums to the strings that
+ * will be printed in the output.
+ */
+#define EM(a, b)	{ a, b },
+#define E_(a, b)	{ a, b }
 
 /* For logging errors in read or write */
 DECLARE_EVENT_CLASS(smb3_rw_err_class,
@@ -1089,6 +1156,30 @@
 DEFINE_SMB3_CREDIT_EVENT(overflow_credits);
 DEFINE_SMB3_CREDIT_EVENT(set_credits);
 
+
+TRACE_EVENT(smb3_tcon_ref,
+	    TP_PROTO(unsigned int tcon_debug_id, int ref,
+		     enum smb3_tcon_ref_trace trace),
+	    TP_ARGS(tcon_debug_id, ref, trace),
+	    TP_STRUCT__entry(
+		    __field(unsigned int,		tcon)
+		    __field(int,			ref)
+		    __field(enum smb3_tcon_ref_trace,	trace)
+			     ),
+	    TP_fast_assign(
+		    __entry->tcon	= tcon_debug_id;
+		    __entry->ref	= ref;
+		    __entry->trace	= trace;
+			   ),
+	    TP_printk("TC=%08x %s r=%u",
+		      __entry->tcon,
+		      __print_symbolic(__entry->trace, smb3_tcon_ref_traces),
+		      __entry->ref)
+	    );
+
+
+#undef EM
+#undef E_
 #endif /* _CIFS_TRACE_H */
 
 #undef TRACE_INCLUDE_PATH
--- linux-qcom-6.8.0.orig/fs/smb/client/transport.c
+++ linux-qcom-6.8.0/fs/smb/client/transport.c
@@ -909,12 +909,15 @@
 			list_del_init(&mid->qhead);
 			mid->mid_flags |= MID_DELETED;
 		}
+		spin_unlock(&server->mid_lock);
 		cifs_server_dbg(VFS, "%s: invalid mid state mid=%llu state=%d\n",
 			 __func__, mid->mid, mid->mid_state);
 		rc = -EIO;
+		goto sync_mid_done;
 	}
 	spin_unlock(&server->mid_lock);
 
+sync_mid_done:
 	release_mid(mid);
 	return rc;
 }
@@ -1057,9 +1060,11 @@
 		index = (uint)atomic_inc_return(&ses->chan_seq);
 		index %= ses->chan_count;
 	}
+
+	server = ses->chans[index].server;
 	spin_unlock(&ses->chan_lock);
 
-	return ses->chans[index].server;
+	return server;
 }
 
 int
--- linux-qcom-6.8.0.orig/fs/smb/client/xattr.c
+++ linux-qcom-6.8.0/fs/smb/client/xattr.c
@@ -162,7 +162,7 @@
 	case XATTR_CIFS_ACL:
 	case XATTR_CIFS_NTSD:
 	case XATTR_CIFS_NTSD_FULL: {
-		struct cifs_ntsd *pacl;
+		struct smb_ntsd *pacl;
 
 		if (!value)
 			goto out;
@@ -315,7 +315,7 @@
 		 * fetch owner and DACL otherwise
 		 */
 		u32 acllen, extra_info;
-		struct cifs_ntsd *pacl;
+		struct smb_ntsd *pacl;
 
 		if (pTcon->ses->server->ops->get_acl == NULL)
 			goto out; /* rc already EOPNOTSUPP */
--- linux-qcom-6.8.0.orig/fs/smb/common/smb2pdu.h
+++ linux-qcom-6.8.0/fs/smb/common/smb2pdu.h
@@ -702,7 +702,7 @@
 	__le16 StructureSize; /* 60 */
 	__le16 Flags;
 	__le32 Reserved;
-	struct_group(network_open_info,
+	struct_group_attr(network_open_info, __packed,
 		__le64 CreationTime;
 		__le64 LastAccessTime;
 		__le64 LastWriteTime;
@@ -908,6 +908,40 @@
 	__u8   Buffer[];
 } __packed;
 
+/* DeviceType Flags */
+#define FILE_DEVICE_CD_ROM              0x00000002
+#define FILE_DEVICE_CD_ROM_FILE_SYSTEM  0x00000003
+#define FILE_DEVICE_DFS                 0x00000006
+#define FILE_DEVICE_DISK                0x00000007
+#define FILE_DEVICE_DISK_FILE_SYSTEM    0x00000008
+#define FILE_DEVICE_FILE_SYSTEM         0x00000009
+#define FILE_DEVICE_NAMED_PIPE          0x00000011
+#define FILE_DEVICE_NETWORK             0x00000012
+#define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
+#define FILE_DEVICE_NULL                0x00000015
+#define FILE_DEVICE_PARALLEL_PORT       0x00000016
+#define FILE_DEVICE_PRINTER             0x00000018
+#define FILE_DEVICE_SERIAL_PORT         0x0000001b
+#define FILE_DEVICE_STREAMS             0x0000001e
+#define FILE_DEVICE_TAPE                0x0000001f
+#define FILE_DEVICE_TAPE_FILE_SYSTEM    0x00000020
+#define FILE_DEVICE_VIRTUAL_DISK        0x00000024
+#define FILE_DEVICE_NETWORK_REDIRECTOR  0x00000028
+
+/* Device Characteristics */
+#define FILE_REMOVABLE_MEDIA			0x00000001
+#define FILE_READ_ONLY_DEVICE			0x00000002
+#define FILE_FLOPPY_DISKETTE			0x00000004
+#define FILE_WRITE_ONCE_MEDIA			0x00000008
+#define FILE_REMOTE_DEVICE			0x00000010
+#define FILE_DEVICE_IS_MOUNTED			0x00000020
+#define FILE_VIRTUAL_VOLUME			0x00000040
+#define FILE_DEVICE_SECURE_OPEN			0x00000100
+#define FILE_CHARACTERISTIC_TS_DEVICE		0x00001000
+#define FILE_CHARACTERISTIC_WEBDAV_DEVICE	0x00002000
+#define FILE_PORTABLE_DEVICE			0x00004000
+#define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000
+
 /*
  * Maximum number of iovs we need for a set-info request.
  * The largest one is rename/hardlink
--- linux-qcom-6.8.0.orig/fs/smb/server/auth.c
+++ linux-qcom-6.8.0/fs/smb/server/auth.c
@@ -1012,6 +1012,8 @@
 
 	ses_enc_key = enc ? sess->smb3encryptionkey :
 		sess->smb3decryptionkey;
+	if (enc)
+		ksmbd_user_session_get(sess);
 	memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE);
 
 	return 0;
--- linux-qcom-6.8.0.orig/fs/smb/server/connection.c
+++ linux-qcom-6.8.0/fs/smb/server/connection.c
@@ -39,7 +39,8 @@
 	xa_destroy(&conn->sessions);
 	kvfree(conn->request_buf);
 	kfree(conn->preauth_info);
-	kfree(conn);
+	if (atomic_dec_and_test(&conn->refcnt))
+		kfree(conn);
 }
 
 /**
@@ -68,6 +69,7 @@
 		conn->um = NULL;
 	atomic_set(&conn->req_running, 0);
 	atomic_set(&conn->r_count, 0);
+	atomic_set(&conn->refcnt, 1);
 	conn->total_credits = 1;
 	conn->outstanding_credits = 0;
 
@@ -117,8 +119,8 @@
 	if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE)
 		requests_queue = &conn->requests;
 
+	atomic_inc(&conn->req_running);
 	if (requests_queue) {
-		atomic_inc(&conn->req_running);
 		spin_lock(&conn->request_lock);
 		list_add_tail(&work->request_entry, requests_queue);
 		spin_unlock(&conn->request_lock);
@@ -129,11 +131,14 @@
 {
 	struct ksmbd_conn *conn = work->conn;
 
+	atomic_dec(&conn->req_running);
+	if (waitqueue_active(&conn->req_running_q))
+		wake_up(&conn->req_running_q);
+
 	if (list_empty(&work->request_entry) &&
 	    list_empty(&work->async_request_entry))
 		return;
 
-	atomic_dec(&conn->req_running);
 	spin_lock(&conn->request_lock);
 	list_del_init(&work->request_entry);
 	spin_unlock(&conn->request_lock);
@@ -273,7 +278,7 @@
 {
 	struct ksmbd_conn *conn = (struct ksmbd_conn *)p;
 	struct ksmbd_transport *t = conn->transport;
-	unsigned int pdu_size, max_allowed_pdu_size;
+	unsigned int pdu_size, max_allowed_pdu_size, max_req;
 	char hdr_buf[4] = {0,};
 	int size;
 
@@ -283,6 +288,7 @@
 	if (t->ops->prepare && t->ops->prepare(t))
 		goto out;
 
+	max_req = server_conf.max_inflight_req;
 	conn->last_active = jiffies;
 	set_freezable();
 	while (ksmbd_conn_alive(conn)) {
@@ -292,6 +298,13 @@
 		kvfree(conn->request_buf);
 		conn->request_buf = NULL;
 
+recheck:
+		if (atomic_read(&conn->req_running) + 1 > max_req) {
+			wait_event_interruptible(conn->req_running_q,
+				atomic_read(&conn->req_running) < max_req);
+			goto recheck;
+		}
+
 		size = t->ops->read(t, hdr_buf, sizeof(hdr_buf), -1);
 		if (size != sizeof(hdr_buf))
 			break;
--- linux-qcom-6.8.0.orig/fs/smb/server/connection.h
+++ linux-qcom-6.8.0/fs/smb/server/connection.h
@@ -106,6 +106,7 @@
 	bool				signing_negotiated;
 	__le16				signing_algorithm;
 	bool				binding;
+	atomic_t			refcnt;
 };
 
 struct ksmbd_conn_ops {
--- linux-qcom-6.8.0.orig/fs/smb/server/ksmbd_netlink.h
+++ linux-qcom-6.8.0/fs/smb/server/ksmbd_netlink.h
@@ -166,7 +166,8 @@
 	__u16	force_uid;
 	__u16	force_gid;
 	__s8	share_name[KSMBD_REQ_MAX_SHARE_NAME];
-	__u32	reserved[112];		/* Reserved room */
+	__u32	reserved[111];		/* Reserved room */
+	__u32	payload_sz;
 	__u32	veto_list_sz;
 	__s8	____payload[];
 };
--- linux-qcom-6.8.0.orig/fs/smb/server/mgmt/share_config.c
+++ linux-qcom-6.8.0/fs/smb/server/mgmt/share_config.c
@@ -15,6 +15,7 @@
 #include "share_config.h"
 #include "user_config.h"
 #include "user_session.h"
+#include "../connection.h"
 #include "../transport_ipc.h"
 #include "../misc.h"
 
@@ -120,12 +121,13 @@
 	return 0;
 }
 
-static struct ksmbd_share_config *share_config_request(struct unicode_map *um,
+static struct ksmbd_share_config *share_config_request(struct ksmbd_work *work,
 						       const char *name)
 {
 	struct ksmbd_share_config_response *resp;
 	struct ksmbd_share_config *share = NULL;
 	struct ksmbd_share_config *lookup;
+	struct unicode_map *um = work->conn->um;
 	int ret;
 
 	resp = ksmbd_ipc_share_config_request(name);
@@ -158,10 +160,19 @@
 	share->name = kstrdup(name, GFP_KERNEL);
 
 	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) {
-		share->path = kstrdup(ksmbd_share_config_path(resp),
+		int path_len = PATH_MAX;
+
+		if (resp->payload_sz)
+			path_len = resp->payload_sz - resp->veto_list_sz;
+
+		share->path = kstrndup(ksmbd_share_config_path(resp), path_len,
 				      GFP_KERNEL);
-		if (share->path)
+		if (share->path) {
 			share->path_sz = strlen(share->path);
+			while (share->path_sz > 1 &&
+			       share->path[share->path_sz - 1] == '/')
+				share->path[--share->path_sz] = '\0';
+		}
 		share->create_mask = resp->create_mask;
 		share->directory_mask = resp->directory_mask;
 		share->force_create_mode = resp->force_create_mode;
@@ -172,7 +183,14 @@
 				      KSMBD_SHARE_CONFIG_VETO_LIST(resp),
 				      resp->veto_list_sz);
 		if (!ret && share->path) {
+			if (__ksmbd_override_fsids(work, share)) {
+				kill_share(share);
+				share = NULL;
+				goto out;
+			}
+
 			ret = kern_path(share->path, 0, &share->vfs_path);
+			ksmbd_revert_fsids(work);
 			if (ret) {
 				ksmbd_debug(SMB, "failed to access '%s'\n",
 					    share->path);
@@ -205,7 +223,7 @@
 	return share;
 }
 
-struct ksmbd_share_config *ksmbd_share_config_get(struct unicode_map *um,
+struct ksmbd_share_config *ksmbd_share_config_get(struct ksmbd_work *work,
 						  const char *name)
 {
 	struct ksmbd_share_config *share;
@@ -218,7 +236,7 @@
 
 	if (share)
 		return share;
-	return share_config_request(um, name);
+	return share_config_request(work, name);
 }
 
 bool ksmbd_share_veto_filename(struct ksmbd_share_config *share,
--- linux-qcom-6.8.0.orig/fs/smb/server/mgmt/share_config.h
+++ linux-qcom-6.8.0/fs/smb/server/mgmt/share_config.h
@@ -11,6 +11,8 @@
 #include <linux/path.h>
 #include <linux/unicode.h>
 
+struct ksmbd_work;
+
 struct ksmbd_share_config {
 	char			*name;
 	char			*path;
@@ -68,7 +70,7 @@
 	__ksmbd_share_config_put(share);
 }
 
-struct ksmbd_share_config *ksmbd_share_config_get(struct unicode_map *um,
+struct ksmbd_share_config *ksmbd_share_config_get(struct ksmbd_work *work,
 						  const char *name);
 bool ksmbd_share_veto_filename(struct ksmbd_share_config *share,
 			       const char *filename);
--- linux-qcom-6.8.0.orig/fs/smb/server/mgmt/tree_connect.c
+++ linux-qcom-6.8.0/fs/smb/server/mgmt/tree_connect.c
@@ -16,17 +16,18 @@
 #include "user_session.h"
 
 struct ksmbd_tree_conn_status
-ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess,
-			const char *share_name)
+ksmbd_tree_conn_connect(struct ksmbd_work *work, const char *share_name)
 {
 	struct ksmbd_tree_conn_status status = {-ENOENT, NULL};
 	struct ksmbd_tree_connect_response *resp = NULL;
 	struct ksmbd_share_config *sc;
 	struct ksmbd_tree_connect *tree_conn = NULL;
 	struct sockaddr *peer_addr;
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess = work->sess;
 	int ret;
 
-	sc = ksmbd_share_config_get(conn->um, share_name);
+	sc = ksmbd_share_config_get(work, share_name);
 	if (!sc)
 		return status;
 
@@ -61,7 +62,7 @@
 		struct ksmbd_share_config *new_sc;
 
 		ksmbd_share_config_del(sc);
-		new_sc = ksmbd_share_config_get(conn->um, share_name);
+		new_sc = ksmbd_share_config_get(work, share_name);
 		if (!new_sc) {
 			pr_err("Failed to update stale share config\n");
 			status.ret = -ESTALE;
--- linux-qcom-6.8.0.orig/fs/smb/server/mgmt/tree_connect.h
+++ linux-qcom-6.8.0/fs/smb/server/mgmt/tree_connect.h
@@ -13,6 +13,7 @@
 struct ksmbd_share_config;
 struct ksmbd_user;
 struct ksmbd_conn;
+struct ksmbd_work;
 
 enum {
 	TREE_NEW = 0,
@@ -50,8 +51,7 @@
 struct ksmbd_session;
 
 struct ksmbd_tree_conn_status
-ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess,
-			const char *share_name);
+ksmbd_tree_conn_connect(struct ksmbd_work *work, const char *share_name);
 void ksmbd_tree_connect_put(struct ksmbd_tree_connect *tcon);
 
 int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
--- linux-qcom-6.8.0.orig/fs/smb/server/mgmt/user_session.c
+++ linux-qcom-6.8.0/fs/smb/server/mgmt/user_session.c
@@ -90,7 +90,7 @@
 
 int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name)
 {
-	struct ksmbd_session_rpc *entry;
+	struct ksmbd_session_rpc *entry, *old;
 	struct ksmbd_rpc_command *resp;
 	int method;
 
@@ -106,16 +106,19 @@
 	entry->id = ksmbd_ipc_id_alloc();
 	if (entry->id < 0)
 		goto free_entry;
-	xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL);
+	old = xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL);
+	if (xa_is_err(old))
+		goto free_id;
 
 	resp = ksmbd_rpc_open(sess, entry->id);
 	if (!resp)
-		goto free_id;
+		goto erase_xa;
 
 	kvfree(resp);
 	return entry->id;
-free_id:
+erase_xa:
 	xa_erase(&sess->rpc_handle_list, entry->id);
+free_id:
 	ksmbd_rpc_id_free(entry->id);
 free_entry:
 	kfree(entry);
@@ -174,11 +177,13 @@
 	unsigned long id;
 	struct ksmbd_session *sess;
 
+	down_write(&sessions_table_lock);
 	down_write(&conn->session_lock);
 	xa_for_each(&conn->sessions, id, sess) {
-		if (sess->state != SMB2_SESSION_VALID ||
-		    time_after(jiffies,
-			       sess->last_active + SMB2_SESSION_TIMEOUT)) {
+		if (atomic_read(&sess->refcnt) == 0 &&
+		    (sess->state != SMB2_SESSION_VALID ||
+		     time_after(jiffies,
+			       sess->last_active + SMB2_SESSION_TIMEOUT))) {
 			xa_erase(&conn->sessions, sess->id);
 			hash_del(&sess->hlist);
 			ksmbd_session_destroy(sess);
@@ -186,6 +191,7 @@
 		}
 	}
 	up_write(&conn->session_lock);
+	up_write(&sessions_table_lock);
 }
 
 int ksmbd_session_register(struct ksmbd_conn *conn,
@@ -227,7 +233,6 @@
 			}
 		}
 	}
-	up_write(&sessions_table_lock);
 
 	down_write(&conn->session_lock);
 	xa_for_each(&conn->sessions, id, sess) {
@@ -247,6 +252,7 @@
 		}
 	}
 	up_write(&conn->session_lock);
+	up_write(&sessions_table_lock);
 }
 
 struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
@@ -256,8 +262,10 @@
 
 	down_read(&conn->session_lock);
 	sess = xa_load(&conn->sessions, id);
-	if (sess)
+	if (sess) {
 		sess->last_active = jiffies;
+		ksmbd_user_session_get(sess);
+	}
 	up_read(&conn->session_lock);
 	return sess;
 }
@@ -269,7 +277,7 @@
 	down_read(&sessions_table_lock);
 	sess = __session_lookup(id);
 	if (sess)
-		sess->last_active = jiffies;
+		ksmbd_user_session_get(sess);
 	up_read(&sessions_table_lock);
 
 	return sess;
@@ -288,6 +296,22 @@
 	return sess;
 }
 
+void ksmbd_user_session_get(struct ksmbd_session *sess)
+{
+	atomic_inc(&sess->refcnt);
+}
+
+void ksmbd_user_session_put(struct ksmbd_session *sess)
+{
+	if (!sess)
+		return;
+
+	if (atomic_read(&sess->refcnt) <= 0)
+		WARN_ON(1);
+	else
+		atomic_dec(&sess->refcnt);
+}
+
 struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn,
 						    u64 sess_id)
 {
@@ -356,6 +380,7 @@
 	xa_init(&sess->rpc_handle_list);
 	sess->sequence_number = 1;
 	rwlock_init(&sess->tree_conns_lock);
+	atomic_set(&sess->refcnt, 1);
 
 	ret = __init_smb2_session(sess);
 	if (ret)
--- linux-qcom-6.8.0.orig/fs/smb/server/mgmt/user_session.h
+++ linux-qcom-6.8.0/fs/smb/server/mgmt/user_session.h
@@ -61,6 +61,8 @@
 	struct ksmbd_file_table		file_table;
 	unsigned long			last_active;
 	rwlock_t			tree_conns_lock;
+
+	atomic_t			refcnt;
 };
 
 static inline int test_session_flag(struct ksmbd_session *sess, int bit)
@@ -101,4 +103,6 @@
 int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name);
 void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id);
 int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id);
+void ksmbd_user_session_get(struct ksmbd_session *sess);
+void ksmbd_user_session_put(struct ksmbd_session *sess);
 #endif /* __USER_SESSION_MANAGEMENT_H__ */
--- linux-qcom-6.8.0.orig/fs/smb/server/oplock.c
+++ linux-qcom-6.8.0/fs/smb/server/oplock.c
@@ -51,6 +51,7 @@
 	init_waitqueue_head(&opinfo->oplock_brk);
 	atomic_set(&opinfo->refcount, 1);
 	atomic_set(&opinfo->breaking_cnt, 0);
+	atomic_inc(&opinfo->conn->refcnt);
 
 	return opinfo;
 }
@@ -124,6 +125,8 @@
 {
 	if (opinfo->is_lease)
 		free_lease(opinfo);
+	if (opinfo->conn && atomic_dec_and_test(&opinfo->conn->refcnt))
+		kfree(opinfo->conn);
 	kfree(opinfo);
 }
 
@@ -162,9 +165,7 @@
 		if (!atomic_inc_not_zero(&opinfo->refcount))
 			opinfo = NULL;
 		else {
-			atomic_inc(&opinfo->conn->r_count);
 			if (ksmbd_conn_releasing(opinfo->conn)) {
-				atomic_dec(&opinfo->conn->r_count);
 				atomic_dec(&opinfo->refcount);
 				opinfo = NULL;
 			}
@@ -176,26 +177,11 @@
 	return opinfo;
 }
 
-static void opinfo_conn_put(struct oplock_info *opinfo)
+void opinfo_put(struct oplock_info *opinfo)
 {
-	struct ksmbd_conn *conn;
-
 	if (!opinfo)
 		return;
 
-	conn = opinfo->conn;
-	/*
-	 * Checking waitqueue to dropping pending requests on
-	 * disconnection. waitqueue_active is safe because it
-	 * uses atomic operation for condition.
-	 */
-	if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))
-		wake_up(&conn->r_count_q);
-	opinfo_put(opinfo);
-}
-
-void opinfo_put(struct oplock_info *opinfo)
-{
 	if (!atomic_dec_and_test(&opinfo->refcount))
 		return;
 
@@ -612,13 +598,28 @@
 
 		if (opinfo->op_state == OPLOCK_CLOSING)
 			return -ENOENT;
-		else if (!opinfo->is_lease && opinfo->level <= req_op_level)
-			return 1;
+		else if (opinfo->level <= req_op_level) {
+			if (opinfo->is_lease == false)
+				return 1;
+
+			if (opinfo->o_lease->state !=
+			    (SMB2_LEASE_HANDLE_CACHING_LE |
+			     SMB2_LEASE_READ_CACHING_LE))
+				return 1;
+		}
 	}
 
-	if (!opinfo->is_lease && opinfo->level <= req_op_level) {
-		wake_up_oplock_break(opinfo);
-		return 1;
+	if (opinfo->level <= req_op_level) {
+		if (opinfo->is_lease == false) {
+			wake_up_oplock_break(opinfo);
+			return 1;
+		}
+		if (opinfo->o_lease->state !=
+		    (SMB2_LEASE_HANDLE_CACHING_LE |
+		     SMB2_LEASE_READ_CACHING_LE)) {
+			wake_up_oplock_break(opinfo);
+			return 1;
+		}
 	}
 	return 0;
 }
@@ -886,7 +887,6 @@
 		struct lease *lease = brk_opinfo->o_lease;
 
 		atomic_inc(&brk_opinfo->breaking_cnt);
-
 		err = oplock_break_pending(brk_opinfo, req_op_level);
 		if (err)
 			return err < 0 ? err : 0;
@@ -1116,15 +1116,12 @@
 			if (!atomic_inc_not_zero(&opinfo->refcount))
 				continue;
 
-			atomic_inc(&opinfo->conn->r_count);
-			if (ksmbd_conn_releasing(opinfo->conn)) {
-				atomic_dec(&opinfo->conn->r_count);
+			if (ksmbd_conn_releasing(opinfo->conn))
 				continue;
-			}
 
 			read_unlock(&p_ci->m_lock);
 			oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE);
-			opinfo_conn_put(opinfo);
+			opinfo_put(opinfo);
 			read_lock(&p_ci->m_lock);
 		}
 	}
@@ -1158,14 +1155,11 @@
 			if (!atomic_inc_not_zero(&opinfo->refcount))
 				continue;
 
-			atomic_inc(&opinfo->conn->r_count);
-			if (ksmbd_conn_releasing(opinfo->conn)) {
-				atomic_dec(&opinfo->conn->r_count);
+			if (ksmbd_conn_releasing(opinfo->conn))
 				continue;
-			}
 			read_unlock(&p_ci->m_lock);
 			oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE);
-			opinfo_conn_put(opinfo);
+			opinfo_put(opinfo);
 			read_lock(&p_ci->m_lock);
 		}
 	}
@@ -1199,7 +1193,9 @@
 
 	/* Only v2 leases handle the directory */
 	if (S_ISDIR(file_inode(fp->filp)->i_mode)) {
-		if (!lctx || lctx->version != 2)
+		if (!lctx || lctx->version != 2 ||
+		    (lctx->flags != SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET_LE &&
+		     !lctx->epoch))
 			return 0;
 	}
 
@@ -1243,7 +1239,7 @@
 	prev_opinfo = opinfo_get_list(ci);
 	if (!prev_opinfo ||
 	    (prev_opinfo->level == SMB2_OPLOCK_LEVEL_NONE && lctx)) {
-		opinfo_conn_put(prev_opinfo);
+		opinfo_put(prev_opinfo);
 		goto set_lev;
 	}
 	prev_op_has_lease = prev_opinfo->is_lease;
@@ -1253,19 +1249,19 @@
 	if (share_ret < 0 &&
 	    prev_opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
 		err = share_ret;
-		opinfo_conn_put(prev_opinfo);
+		opinfo_put(prev_opinfo);
 		goto err_out;
 	}
 
 	if (prev_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH &&
 	    prev_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
-		opinfo_conn_put(prev_opinfo);
+		opinfo_put(prev_opinfo);
 		goto op_break_not_needed;
 	}
 
 	list_add(&work->interim_entry, &prev_opinfo->interim_list);
 	err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II);
-	opinfo_conn_put(prev_opinfo);
+	opinfo_put(prev_opinfo);
 	if (err == -ENOENT)
 		goto set_lev;
 	/* Check all oplock was freed by close */
@@ -1328,14 +1324,14 @@
 		return;
 	if (brk_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH &&
 	    brk_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
-		opinfo_conn_put(brk_opinfo);
+		opinfo_put(brk_opinfo);
 		return;
 	}
 
 	brk_opinfo->open_trunc = is_trunc;
 	list_add(&work->interim_entry, &brk_opinfo->interim_list);
 	oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II);
-	opinfo_conn_put(brk_opinfo);
+	opinfo_put(brk_opinfo);
 }
 
 /**
@@ -1364,11 +1360,8 @@
 		if (!atomic_inc_not_zero(&brk_op->refcount))
 			continue;
 
-		atomic_inc(&brk_op->conn->r_count);
-		if (ksmbd_conn_releasing(brk_op->conn)) {
-			atomic_dec(&brk_op->conn->r_count);
+		if (ksmbd_conn_releasing(brk_op->conn))
 			continue;
-		}
 
 		rcu_read_unlock();
 		if (brk_op->is_lease && (brk_op->o_lease->state &
@@ -1399,7 +1392,7 @@
 		brk_op->open_trunc = is_trunc;
 		oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE);
 next:
-		opinfo_conn_put(brk_op);
+		opinfo_put(brk_op);
 		rcu_read_lock();
 	}
 	rcu_read_unlock();
@@ -1461,8 +1454,9 @@
 		buf->lcontext.LeaseFlags = lease->flags;
 		buf->lcontext.Epoch = cpu_to_le16(lease->epoch);
 		buf->lcontext.LeaseState = lease->state;
-		memcpy(buf->lcontext.ParentLeaseKey, lease->parent_lease_key,
-		       SMB2_LEASE_KEY_SIZE);
+		if (lease->flags == SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET_LE)
+			memcpy(buf->lcontext.ParentLeaseKey, lease->parent_lease_key,
+			       SMB2_LEASE_KEY_SIZE);
 		buf->ccontext.DataOffset = cpu_to_le16(offsetof
 				(struct create_lease_v2, lcontext));
 		buf->ccontext.DataLength = cpu_to_le32(sizeof(struct lease_context_v2));
@@ -1527,8 +1521,9 @@
 		lreq->flags = lc->lcontext.LeaseFlags;
 		lreq->epoch = lc->lcontext.Epoch;
 		lreq->duration = lc->lcontext.LeaseDuration;
-		memcpy(lreq->parent_lease_key, lc->lcontext.ParentLeaseKey,
-				SMB2_LEASE_KEY_SIZE);
+		if (lreq->flags == SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET_LE)
+			memcpy(lreq->parent_lease_key, lc->lcontext.ParentLeaseKey,
+			       SMB2_LEASE_KEY_SIZE);
 		lreq->version = 2;
 	} else {
 		struct create_lease *lc = (struct create_lease *)cc;
--- linux-qcom-6.8.0.orig/fs/smb/server/server.c
+++ linux-qcom-6.8.0/fs/smb/server/server.c
@@ -167,20 +167,17 @@
 	int rc;
 	bool is_chained = false;
 
-	if (conn->ops->allocate_rsp_buf(work))
-		return;
-
 	if (conn->ops->is_transform_hdr &&
 	    conn->ops->is_transform_hdr(work->request_buf)) {
 		rc = conn->ops->decrypt_req(work);
-		if (rc < 0) {
-			conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
-			goto send;
-		}
-
+		if (rc < 0)
+			return;
 		work->encrypted = true;
 	}
 
+	if (conn->ops->allocate_rsp_buf(work))
+		return;
+
 	rc = conn->ops->init_rsp_hdr(work);
 	if (rc) {
 		/* either uid or tid is not correct */
@@ -250,6 +247,8 @@
 		if (rc < 0)
 			conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
 	}
+	if (work->sess)
+		ksmbd_user_session_put(work->sess);
 
 	ksmbd_conn_write(work);
 }
@@ -276,8 +275,12 @@
 	 * disconnection. waitqueue_active is safe because it
 	 * uses atomic operation for condition.
 	 */
+	atomic_inc(&conn->refcnt);
 	if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))
 		wake_up(&conn->r_count_q);
+
+	if (atomic_dec_and_test(&conn->refcnt))
+		kfree(conn);
 }
 
 /**
@@ -292,6 +295,10 @@
 	struct ksmbd_work *work;
 	int err;
 
+	err = ksmbd_init_smb_server(conn);
+	if (err)
+		return 0;
+
 	work = ksmbd_alloc_work_struct();
 	if (!work) {
 		pr_err("allocation for work failed\n");
@@ -302,12 +309,6 @@
 	work->request_buf = conn->request_buf;
 	conn->request_buf = NULL;
 
-	err = ksmbd_init_smb_server(work);
-	if (err) {
-		ksmbd_free_work_struct(work);
-		return 0;
-	}
-
 	ksmbd_conn_enqueue_request(work);
 	atomic_inc(&conn->r_count);
 	/* update activity on connection */
@@ -360,6 +361,7 @@
 	server_conf.auth_mechs |= KSMBD_AUTH_KRB5 |
 				KSMBD_AUTH_MSKRB5;
 #endif
+	server_conf.max_inflight_req = SMB2_MAX_CREDITS;
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/fs/smb/server/server.h
+++ linux-qcom-6.8.0/fs/smb/server/server.h
@@ -42,6 +42,7 @@
 	struct smb_sid		domain_sid;
 	unsigned int		auth_mechs;
 	unsigned int		max_connections;
+	unsigned int		max_inflight_req;
 
 	char			*conf[SERVER_CONF_WORK_GROUP + 1];
 };
--- linux-qcom-6.8.0.orig/fs/smb/server/smb2misc.c
+++ linux-qcom-6.8.0/fs/smb/server/smb2misc.c
@@ -101,13 +101,17 @@
 		*len = le16_to_cpu(((struct smb2_sess_setup_req *)hdr)->SecurityBufferLength);
 		break;
 	case SMB2_TREE_CONNECT:
-		*off = le16_to_cpu(((struct smb2_tree_connect_req *)hdr)->PathOffset);
+		*off = max_t(unsigned short int,
+			     le16_to_cpu(((struct smb2_tree_connect_req *)hdr)->PathOffset),
+			     offsetof(struct smb2_tree_connect_req, Buffer));
 		*len = le16_to_cpu(((struct smb2_tree_connect_req *)hdr)->PathLength);
 		break;
 	case SMB2_CREATE:
 	{
 		unsigned short int name_off =
-			le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
+			max_t(unsigned short int,
+			      le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset),
+			      offsetof(struct smb2_create_req, Buffer));
 		unsigned short int name_len =
 			le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
 
@@ -128,11 +132,15 @@
 		break;
 	}
 	case SMB2_QUERY_INFO:
-		*off = le16_to_cpu(((struct smb2_query_info_req *)hdr)->InputBufferOffset);
+		*off = max_t(unsigned int,
+			     le16_to_cpu(((struct smb2_query_info_req *)hdr)->InputBufferOffset),
+			     offsetof(struct smb2_query_info_req, Buffer));
 		*len = le32_to_cpu(((struct smb2_query_info_req *)hdr)->InputBufferLength);
 		break;
 	case SMB2_SET_INFO:
-		*off = le16_to_cpu(((struct smb2_set_info_req *)hdr)->BufferOffset);
+		*off = max_t(unsigned int,
+			     le16_to_cpu(((struct smb2_set_info_req *)hdr)->BufferOffset),
+			     offsetof(struct smb2_set_info_req, Buffer));
 		*len = le32_to_cpu(((struct smb2_set_info_req *)hdr)->BufferLength);
 		break;
 	case SMB2_READ:
@@ -142,7 +150,7 @@
 	case SMB2_WRITE:
 		if (((struct smb2_write_req *)hdr)->DataOffset ||
 		    ((struct smb2_write_req *)hdr)->Length) {
-			*off = max_t(unsigned int,
+			*off = max_t(unsigned short int,
 				     le16_to_cpu(((struct smb2_write_req *)hdr)->DataOffset),
 				     offsetof(struct smb2_write_req, Buffer));
 			*len = le32_to_cpu(((struct smb2_write_req *)hdr)->Length);
@@ -153,7 +161,9 @@
 		*len = le16_to_cpu(((struct smb2_write_req *)hdr)->WriteChannelInfoLength);
 		break;
 	case SMB2_QUERY_DIRECTORY:
-		*off = le16_to_cpu(((struct smb2_query_directory_req *)hdr)->FileNameOffset);
+		*off = max_t(unsigned short int,
+			     le16_to_cpu(((struct smb2_query_directory_req *)hdr)->FileNameOffset),
+			     offsetof(struct smb2_query_directory_req, Buffer));
 		*len = le16_to_cpu(((struct smb2_query_directory_req *)hdr)->FileNameLength);
 		break;
 	case SMB2_LOCK:
@@ -168,7 +178,9 @@
 		break;
 	}
 	case SMB2_IOCTL:
-		*off = le32_to_cpu(((struct smb2_ioctl_req *)hdr)->InputOffset);
+		*off = max_t(unsigned int,
+			     le32_to_cpu(((struct smb2_ioctl_req *)hdr)->InputOffset),
+			     offsetof(struct smb2_ioctl_req, Buffer));
 		*len = le32_to_cpu(((struct smb2_ioctl_req *)hdr)->InputCount);
 		break;
 	default:
--- linux-qcom-6.8.0.orig/fs/smb/server/smb2ops.c
+++ linux-qcom-6.8.0/fs/smb/server/smb2ops.c
@@ -228,6 +228,11 @@
 	    conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION)
 		conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
 
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION ||
+	    (!(server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF) &&
+	     conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION))
+		conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
+
 	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL)
 		conn->vals->capabilities |= SMB2_GLOBAL_CAP_MULTI_CHANNEL;
 }
@@ -275,11 +280,6 @@
 		conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING |
 			SMB2_GLOBAL_CAP_DIRECTORY_LEASING;
 
-	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION ||
-	    (!(server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF) &&
-	     conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION))
-		conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
-
 	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL)
 		conn->vals->capabilities |= SMB2_GLOBAL_CAP_MULTI_CHANNEL;
 
--- linux-qcom-6.8.0.orig/fs/smb/server/smb2pdu.c
+++ linux-qcom-6.8.0/fs/smb/server/smb2pdu.c
@@ -67,8 +67,10 @@
 		return false;
 
 	sess = ksmbd_session_lookup_all(conn, id);
-	if (sess)
+	if (sess) {
+		ksmbd_user_session_put(sess);
 		return true;
+	}
 	pr_err("Invalid user session id: %llu\n", id);
 	return false;
 }
@@ -535,6 +537,10 @@
 	if (cmd == SMB2_QUERY_INFO_HE) {
 		struct smb2_query_info_req *req;
 
+		if (get_rfc1002_len(work->request_buf) <
+		    offsetof(struct smb2_query_info_req, OutputBufferLength))
+			return -EINVAL;
+
 		req = smb2_get_msg(work->request_buf);
 		if ((req->InfoType == SMB2_O_INFO_FILE &&
 		     (req->FileInfoClass == FILE_FULL_EA_INFORMATION ||
@@ -650,6 +656,12 @@
 		return name;
 	}
 
+	if (*name == '\\') {
+		pr_err("not allow directory name included leading slash\n");
+		kfree(name);
+		return ERR_PTR(-EINVAL);
+	}
+
 	ksmbd_conv_path_to_unix(name);
 	ksmbd_strip_last_slash(name);
 	return name;
@@ -707,6 +719,9 @@
 	struct smb2_hdr *rsp_hdr;
 	struct ksmbd_work *in_work = ksmbd_alloc_work_struct();
 
+	if (!in_work)
+		return;
+
 	if (allocate_interim_rsp_buf(in_work)) {
 		pr_err("smb_allocate_rsp_buf failed!\n");
 		ksmbd_free_work_struct(in_work);
@@ -1701,6 +1716,8 @@
 		rc = ksmbd_session_register(conn, sess);
 		if (rc)
 			goto out_err;
+
+		conn->binding = false;
 	} else if (conn->dialect >= SMB30_PROT_ID &&
 		   (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) &&
 		   req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) {
@@ -1714,29 +1731,35 @@
 
 		if (conn->dialect != sess->dialect) {
 			rc = -EINVAL;
+			ksmbd_user_session_put(sess);
 			goto out_err;
 		}
 
 		if (!(req->hdr.Flags & SMB2_FLAGS_SIGNED)) {
 			rc = -EINVAL;
+			ksmbd_user_session_put(sess);
 			goto out_err;
 		}
 
 		if (strncmp(conn->ClientGUID, sess->ClientGUID,
 			    SMB2_CLIENT_GUID_SIZE)) {
 			rc = -ENOENT;
+			ksmbd_user_session_put(sess);
 			goto out_err;
 		}
 
 		if (sess->state == SMB2_SESSION_IN_PROGRESS) {
 			rc = -EACCES;
+			ksmbd_user_session_put(sess);
 			goto out_err;
 		}
 
 		if (sess->state == SMB2_SESSION_EXPIRED) {
 			rc = -EFAULT;
+			ksmbd_user_session_put(sess);
 			goto out_err;
 		}
+		ksmbd_user_session_put(sess);
 
 		if (ksmbd_conn_need_reconnect(conn)) {
 			rc = -EFAULT;
@@ -1744,7 +1767,8 @@
 			goto out_err;
 		}
 
-		if (ksmbd_session_lookup(conn, sess_id)) {
+		sess = ksmbd_session_lookup(conn, sess_id);
+		if (!sess) {
 			rc = -EACCES;
 			goto out_err;
 		}
@@ -1779,6 +1803,8 @@
 			sess = NULL;
 			goto out_err;
 		}
+
+		conn->binding = false;
 	}
 	work->sess = sess;
 
@@ -1951,7 +1977,7 @@
 
 	WORK_BUFFERS(work, req, rsp);
 
-	treename = smb_strndup_from_utf16(req->Buffer,
+	treename = smb_strndup_from_utf16((char *)req + le16_to_cpu(req->PathOffset),
 					  le16_to_cpu(req->PathLength), true,
 					  conn->local_nls);
 	if (IS_ERR(treename)) {
@@ -1969,7 +1995,7 @@
 	ksmbd_debug(SMB, "tree connect request for tree %s treename %s\n",
 		    name, treename);
 
-	status = ksmbd_tree_conn_connect(conn, sess, name);
+	status = ksmbd_tree_conn_connect(work, name);
 	if (status.ret == KSMBD_TREE_CONN_STATUS_OK)
 		rsp->hdr.Id.SyncId.TreeId = cpu_to_le32(status.tree_conn->id);
 	else
@@ -2060,15 +2086,22 @@
  * @access:		file access flags
  * @disposition:	file disposition flags
  * @may_flags:		set with MAY_ flags
+ * @is_dir:		is creating open flags for directory
  *
  * Return:      file open flags
  */
 static int smb2_create_open_flags(bool file_present, __le32 access,
 				  __le32 disposition,
-				  int *may_flags)
+				  int *may_flags,
+				  bool is_dir)
 {
 	int oflags = O_NONBLOCK | O_LARGEFILE;
 
+	if (is_dir) {
+		access &= ~FILE_WRITE_DESIRE_ACCESS_LE;
+		ksmbd_debug(SMB, "Discard write access to a directory\n");
+	}
+
 	if (access & FILE_READ_DESIRED_ACCESS_LE &&
 	    access & FILE_WRITE_DESIRE_ACCESS_LE) {
 		oflags |= O_RDWR;
@@ -2190,9 +2223,9 @@
 int smb2_session_logoff(struct ksmbd_work *work)
 {
 	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess = work->sess;
 	struct smb2_logoff_req *req;
 	struct smb2_logoff_rsp *rsp;
-	struct ksmbd_session *sess;
 	u64 sess_id;
 	int err;
 
@@ -2214,11 +2247,6 @@
 	ksmbd_close_session_fds(work);
 	ksmbd_conn_wait_idle(conn, sess_id);
 
-	/*
-	 * Re-lookup session to validate if session is deleted
-	 * while waiting request complete
-	 */
-	sess = ksmbd_session_lookup_all(conn, sess_id);
 	if (ksmbd_tree_conn_session_logoff(sess)) {
 		ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId);
 		rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED;
@@ -2227,7 +2255,9 @@
 	}
 
 	ksmbd_destroy_file_table(&sess->file_table);
+	down_write(&conn->session_lock);
 	sess->state = SMB2_SESSION_EXPIRED;
+	up_write(&conn->session_lock);
 
 	ksmbd_free_user(sess->user);
 	sess->user = NULL;
@@ -2376,7 +2406,8 @@
 			if (rc > 0) {
 				rc = ksmbd_vfs_remove_xattr(idmap,
 							    path,
-							    attr_name);
+							    attr_name,
+							    get_write);
 
 				if (rc < 0) {
 					ksmbd_debug(SMB,
@@ -2391,7 +2422,7 @@
 		} else {
 			rc = ksmbd_vfs_setxattr(idmap, path, attr_name, value,
 						le16_to_cpu(eabuf->EaValueLength),
-						0, true);
+						0, get_write);
 			if (rc < 0) {
 				ksmbd_debug(SMB,
 					    "ksmbd_vfs_setxattr is failed(%d)\n",
@@ -2483,7 +2514,7 @@
 		    !strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX,
 			     STREAM_PREFIX_LEN)) {
 			err = ksmbd_vfs_remove_xattr(idmap, path,
-						     name);
+						     name, true);
 			if (err)
 				ksmbd_debug(SMB, "remove xattr failed : %s\n",
 					    name);
@@ -2697,20 +2728,11 @@
 	}
 
 	if (req->NameLength) {
-		if ((req->CreateOptions & FILE_DIRECTORY_FILE_LE) &&
-		    *(char *)req->Buffer == '\\') {
-			pr_err("not allow directory name included leading slash\n");
-			rc = -EINVAL;
-			goto err_out2;
-		}
-
-		name = smb2_get_name(req->Buffer,
+		name = smb2_get_name((char *)req + le16_to_cpu(req->NameOffset),
 				     le16_to_cpu(req->NameLength),
 				     work->conn->local_nls);
 		if (IS_ERR(name)) {
 			rc = PTR_ERR(name);
-			if (rc != -ENOMEM)
-				rc = -ENOENT;
 			name = NULL;
 			goto err_out2;
 		}
@@ -2981,7 +3003,9 @@
 
 	open_flags = smb2_create_open_flags(file_present, daccess,
 					    req->CreateDisposition,
-					    &may_flags);
+					    &may_flags,
+		req->CreateOptions & FILE_DIRECTORY_FILE_LE ||
+		(file_present && S_ISDIR(d_inode(path.dentry)->i_mode)));
 
 	if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
 		if (open_flags & (O_CREAT | O_TRUNC)) {
@@ -3467,7 +3491,7 @@
 	kfree(name);
 	kfree(lc);
 
-	return 0;
+	return rc;
 }
 
 static int readdir_info_level_struct_sz(int info_level)
@@ -3733,6 +3757,26 @@
 		posix_info->DeviceId = cpu_to_le32(ksmbd_kstat->kstat->rdev);
 		posix_info->HardLinks = cpu_to_le32(ksmbd_kstat->kstat->nlink);
 		posix_info->Mode = cpu_to_le32(ksmbd_kstat->kstat->mode & 0777);
+		switch (ksmbd_kstat->kstat->mode & S_IFMT) {
+		case S_IFDIR:
+			posix_info->Mode |= cpu_to_le32(POSIX_TYPE_DIR << POSIX_FILETYPE_SHIFT);
+			break;
+		case S_IFLNK:
+			posix_info->Mode |= cpu_to_le32(POSIX_TYPE_SYMLINK << POSIX_FILETYPE_SHIFT);
+			break;
+		case S_IFCHR:
+			posix_info->Mode |= cpu_to_le32(POSIX_TYPE_CHARDEV << POSIX_FILETYPE_SHIFT);
+			break;
+		case S_IFBLK:
+			posix_info->Mode |= cpu_to_le32(POSIX_TYPE_BLKDEV << POSIX_FILETYPE_SHIFT);
+			break;
+		case S_IFIFO:
+			posix_info->Mode |= cpu_to_le32(POSIX_TYPE_FIFO << POSIX_FILETYPE_SHIFT);
+			break;
+		case S_IFSOCK:
+			posix_info->Mode |= cpu_to_le32(POSIX_TYPE_SOCKET << POSIX_FILETYPE_SHIFT);
+		}
+
 		posix_info->Inode = cpu_to_le64(ksmbd_kstat->kstat->ino);
 		posix_info->DosAttributes =
 			S_ISDIR(ksmbd_kstat->kstat->mode) ?
@@ -3828,11 +3872,16 @@
 		}
 
 		ksmbd_kstat.kstat = &kstat;
-		if (priv->info_level != FILE_NAMES_INFORMATION)
-			ksmbd_vfs_fill_dentry_attrs(priv->work,
-						    idmap,
-						    dent,
-						    &ksmbd_kstat);
+		if (priv->info_level != FILE_NAMES_INFORMATION) {
+			rc = ksmbd_vfs_fill_dentry_attrs(priv->work,
+							 idmap,
+							 dent,
+							 &ksmbd_kstat);
+			if (rc) {
+				dput(dent);
+				continue;
+			}
+		}
 
 		rc = smb2_populate_readdir_entry(priv->work->conn,
 						 priv->info_level,
@@ -3967,6 +4016,7 @@
 	/* dot and dotdot entries are already reserved */
 	if (!strcmp(".", name) || !strcmp("..", name))
 		return true;
+	d_info->num_scan++;
 	if (ksmbd_share_veto_filename(priv->work->tcon->share_conf, name))
 		return true;
 	if (!match_pattern(name, namlen, priv->search_pattern))
@@ -4075,7 +4125,7 @@
 	}
 
 	srch_flag = req->Flags;
-	srch_ptr = smb_strndup_from_utf16(req->Buffer,
+	srch_ptr = smb_strndup_from_utf16((char *)req + le16_to_cpu(req->FileNameOffset),
 					  le16_to_cpu(req->FileNameLength), 1,
 					  conn->local_nls);
 	if (IS_ERR(srch_ptr)) {
@@ -4127,9 +4177,18 @@
 	query_dir_private.info_level		= req->FileInformationClass;
 	dir_fp->readdir_data.private		= &query_dir_private;
 	set_ctx_actor(&dir_fp->readdir_data.ctx, __query_dir);
-
+again:
+	d_info.num_scan = 0;
 	rc = iterate_dir(dir_fp->filp, &dir_fp->readdir_data.ctx);
 	/*
+	 * num_entry can be 0 if the directory iteration stops before reaching
+	 * the end of the directory and no file is matched with the search
+	 * pattern.
+	 */
+	if (rc >= 0 && !d_info.num_entry && d_info.num_scan &&
+	    d_info.out_buf_len > 0)
+		goto again;
+	/*
 	 * req->OutputBufferLength is too small to contain even one entry.
 	 * In this case, it immediately returns OutputBufferLength 0 to client.
 	 */
@@ -4158,7 +4217,8 @@
 		rsp->OutputBufferLength = cpu_to_le32(0);
 		rsp->Buffer[0] = 0;
 		rc = ksmbd_iov_pin_rsp(work, (void *)rsp,
-				       sizeof(struct smb2_query_directory_rsp));
+				       offsetof(struct smb2_query_directory_rsp, Buffer)
+				       + 1);
 		if (rc)
 			goto err_out;
 	} else {
@@ -4335,7 +4395,8 @@
 		    sizeof(struct smb2_ea_info_req))
 			return -EINVAL;
 
-		ea_req = (struct smb2_ea_info_req *)req->Buffer;
+		ea_req = (struct smb2_ea_info_req *)((char *)req +
+						     le16_to_cpu(req->InputBufferOffset));
 	} else {
 		/* need to send all EAs, if no specific EA is requested*/
 		if (le32_to_cpu(req->Flags) & SL_RETURN_SINGLE_ENTRY)
@@ -4480,6 +4541,7 @@
 	struct smb2_file_basic_info *basic_info;
 	struct kstat stat;
 	u64 time;
+	int ret;
 
 	if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) {
 		pr_err("no right to read the attributes : 0x%x\n",
@@ -4487,9 +4549,12 @@
 		return -EACCES;
 	}
 
+	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+			  AT_STATX_SYNC_AS_STAT);
+	if (ret)
+		return ret;
+
 	basic_info = (struct smb2_file_basic_info *)rsp->Buffer;
-	generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS,
-			 file_inode(fp->filp), &stat);
 	basic_info->CreationTime = cpu_to_le64(fp->create_time);
 	time = ksmbd_UnixTimeToNT(stat.atime);
 	basic_info->LastAccessTime = cpu_to_le64(time);
@@ -4504,27 +4569,31 @@
 	return 0;
 }
 
-static void get_file_standard_info(struct smb2_query_info_rsp *rsp,
-				   struct ksmbd_file *fp, void *rsp_org)
+static int get_file_standard_info(struct smb2_query_info_rsp *rsp,
+				  struct ksmbd_file *fp, void *rsp_org)
 {
 	struct smb2_file_standard_info *sinfo;
 	unsigned int delete_pending;
-	struct inode *inode;
 	struct kstat stat;
+	int ret;
 
-	inode = file_inode(fp->filp);
-	generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, inode, &stat);
+	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+			  AT_STATX_SYNC_AS_STAT);
+	if (ret)
+		return ret;
 
 	sinfo = (struct smb2_file_standard_info *)rsp->Buffer;
 	delete_pending = ksmbd_inode_pending_delete(fp);
 
-	sinfo->AllocationSize = cpu_to_le64(inode->i_blocks << 9);
+	sinfo->AllocationSize = cpu_to_le64(stat.blocks << 9);
 	sinfo->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
 	sinfo->NumberOfLinks = cpu_to_le32(get_nlink(&stat) - delete_pending);
 	sinfo->DeletePending = delete_pending;
 	sinfo->Directory = S_ISDIR(stat.mode) ? 1 : 0;
 	rsp->OutputBufferLength =
 		cpu_to_le32(sizeof(struct smb2_file_standard_info));
+
+	return 0;
 }
 
 static void get_file_alignment_info(struct smb2_query_info_rsp *rsp,
@@ -4546,11 +4615,11 @@
 	struct ksmbd_conn *conn = work->conn;
 	struct smb2_file_all_info *file_info;
 	unsigned int delete_pending;
-	struct inode *inode;
 	struct kstat stat;
 	int conv_len;
 	char *filename;
 	u64 time;
+	int ret;
 
 	if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) {
 		ksmbd_debug(SMB, "no right to read the attributes : 0x%x\n",
@@ -4562,8 +4631,10 @@
 	if (IS_ERR(filename))
 		return PTR_ERR(filename);
 
-	inode = file_inode(fp->filp);
-	generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, inode, &stat);
+	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+			  AT_STATX_SYNC_AS_STAT);
+	if (ret)
+		return ret;
 
 	ksmbd_debug(SMB, "filename = %s\n", filename);
 	delete_pending = ksmbd_inode_pending_delete(fp);
@@ -4579,7 +4650,7 @@
 	file_info->Attributes = fp->f_ci->m_fattr;
 	file_info->Pad1 = 0;
 	file_info->AllocationSize =
-		cpu_to_le64(inode->i_blocks << 9);
+		cpu_to_le64(stat.blocks << 9);
 	file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
 	file_info->NumberOfLinks =
 			cpu_to_le32(get_nlink(&stat) - delete_pending);
@@ -4623,10 +4694,10 @@
 		cpu_to_le32(sizeof(struct smb2_file_alt_name_info) + conv_len);
 }
 
-static void get_file_stream_info(struct ksmbd_work *work,
-				 struct smb2_query_info_rsp *rsp,
-				 struct ksmbd_file *fp,
-				 void *rsp_org)
+static int get_file_stream_info(struct ksmbd_work *work,
+				struct smb2_query_info_rsp *rsp,
+				struct ksmbd_file *fp,
+				void *rsp_org)
 {
 	struct ksmbd_conn *conn = work->conn;
 	struct smb2_file_stream_info *file_info;
@@ -4637,9 +4708,13 @@
 	int nbytes = 0, streamlen, stream_name_len, next, idx = 0;
 	int buf_free_len;
 	struct smb2_query_info_req *req = ksmbd_req_buf_next(work);
+	int ret;
+
+	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+			  AT_STATX_SYNC_AS_STAT);
+	if (ret)
+		return ret;
 
-	generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS,
-			 file_inode(fp->filp), &stat);
 	file_info = (struct smb2_file_stream_info *)rsp->Buffer;
 
 	buf_free_len =
@@ -4720,29 +4795,37 @@
 	kvfree(xattr_list);
 
 	rsp->OutputBufferLength = cpu_to_le32(nbytes);
+
+	return 0;
 }
 
-static void get_file_internal_info(struct smb2_query_info_rsp *rsp,
-				   struct ksmbd_file *fp, void *rsp_org)
+static int get_file_internal_info(struct smb2_query_info_rsp *rsp,
+				  struct ksmbd_file *fp, void *rsp_org)
 {
 	struct smb2_file_internal_info *file_info;
 	struct kstat stat;
+	int ret;
+
+	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+			  AT_STATX_SYNC_AS_STAT);
+	if (ret)
+		return ret;
 
-	generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS,
-			 file_inode(fp->filp), &stat);
 	file_info = (struct smb2_file_internal_info *)rsp->Buffer;
 	file_info->IndexNumber = cpu_to_le64(stat.ino);
 	rsp->OutputBufferLength =
 		cpu_to_le32(sizeof(struct smb2_file_internal_info));
+
+	return 0;
 }
 
 static int get_file_network_open_info(struct smb2_query_info_rsp *rsp,
 				      struct ksmbd_file *fp, void *rsp_org)
 {
 	struct smb2_file_ntwrk_info *file_info;
-	struct inode *inode;
 	struct kstat stat;
 	u64 time;
+	int ret;
 
 	if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) {
 		pr_err("no right to read the attributes : 0x%x\n",
@@ -4750,10 +4833,12 @@
 		return -EACCES;
 	}
 
-	file_info = (struct smb2_file_ntwrk_info *)rsp->Buffer;
+	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+			  AT_STATX_SYNC_AS_STAT);
+	if (ret)
+		return ret;
 
-	inode = file_inode(fp->filp);
-	generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, inode, &stat);
+	file_info = (struct smb2_file_ntwrk_info *)rsp->Buffer;
 
 	file_info->CreationTime = cpu_to_le64(fp->create_time);
 	time = ksmbd_UnixTimeToNT(stat.atime);
@@ -4763,8 +4848,7 @@
 	time = ksmbd_UnixTimeToNT(stat.ctime);
 	file_info->ChangeTime = cpu_to_le64(time);
 	file_info->Attributes = fp->f_ci->m_fattr;
-	file_info->AllocationSize =
-		cpu_to_le64(inode->i_blocks << 9);
+	file_info->AllocationSize = cpu_to_le64(stat.blocks << 9);
 	file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
 	file_info->Reserved = cpu_to_le32(0);
 	rsp->OutputBufferLength =
@@ -4804,14 +4888,17 @@
 		cpu_to_le32(sizeof(struct smb2_file_mode_info));
 }
 
-static void get_file_compression_info(struct smb2_query_info_rsp *rsp,
-				      struct ksmbd_file *fp, void *rsp_org)
+static int get_file_compression_info(struct smb2_query_info_rsp *rsp,
+				     struct ksmbd_file *fp, void *rsp_org)
 {
 	struct smb2_file_comp_info *file_info;
 	struct kstat stat;
+	int ret;
 
-	generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS,
-			 file_inode(fp->filp), &stat);
+	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+			  AT_STATX_SYNC_AS_STAT);
+	if (ret)
+		return ret;
 
 	file_info = (struct smb2_file_comp_info *)rsp->Buffer;
 	file_info->CompressedFileSize = cpu_to_le64(stat.blocks << 9);
@@ -4823,6 +4910,8 @@
 
 	rsp->OutputBufferLength =
 		cpu_to_le32(sizeof(struct smb2_file_comp_info));
+
+	return 0;
 }
 
 static int get_file_attribute_tag_info(struct smb2_query_info_rsp *rsp,
@@ -4844,7 +4933,7 @@
 	return 0;
 }
 
-static void find_file_posix_info(struct smb2_query_info_rsp *rsp,
+static int find_file_posix_info(struct smb2_query_info_rsp *rsp,
 				struct ksmbd_file *fp, void *rsp_org)
 {
 	struct smb311_posix_qinfo *file_info;
@@ -4852,24 +4941,51 @@
 	struct mnt_idmap *idmap = file_mnt_idmap(fp->filp);
 	vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode);
 	vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode);
+	struct kstat stat;
 	u64 time;
 	int out_buf_len = sizeof(struct smb311_posix_qinfo) + 32;
+	int ret;
+
+	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+			  AT_STATX_SYNC_AS_STAT);
+	if (ret)
+		return ret;
 
 	file_info = (struct smb311_posix_qinfo *)rsp->Buffer;
 	file_info->CreationTime = cpu_to_le64(fp->create_time);
-	time = ksmbd_UnixTimeToNT(inode_get_atime(inode));
+	time = ksmbd_UnixTimeToNT(stat.atime);
 	file_info->LastAccessTime = cpu_to_le64(time);
-	time = ksmbd_UnixTimeToNT(inode_get_mtime(inode));
+	time = ksmbd_UnixTimeToNT(stat.mtime);
 	file_info->LastWriteTime = cpu_to_le64(time);
-	time = ksmbd_UnixTimeToNT(inode_get_ctime(inode));
+	time = ksmbd_UnixTimeToNT(stat.ctime);
 	file_info->ChangeTime = cpu_to_le64(time);
 	file_info->DosAttributes = fp->f_ci->m_fattr;
-	file_info->Inode = cpu_to_le64(inode->i_ino);
-	file_info->EndOfFile = cpu_to_le64(inode->i_size);
-	file_info->AllocationSize = cpu_to_le64(inode->i_blocks << 9);
-	file_info->HardLinks = cpu_to_le32(inode->i_nlink);
-	file_info->Mode = cpu_to_le32(inode->i_mode & 0777);
-	file_info->DeviceId = cpu_to_le32(inode->i_rdev);
+	file_info->Inode = cpu_to_le64(stat.ino);
+	file_info->EndOfFile = cpu_to_le64(stat.size);
+	file_info->AllocationSize = cpu_to_le64(stat.blocks << 9);
+	file_info->HardLinks = cpu_to_le32(stat.nlink);
+	file_info->Mode = cpu_to_le32(stat.mode & 0777);
+	switch (stat.mode & S_IFMT) {
+	case S_IFDIR:
+		file_info->Mode |= cpu_to_le32(POSIX_TYPE_DIR << POSIX_FILETYPE_SHIFT);
+		break;
+	case S_IFLNK:
+		file_info->Mode |= cpu_to_le32(POSIX_TYPE_SYMLINK << POSIX_FILETYPE_SHIFT);
+		break;
+	case S_IFCHR:
+		file_info->Mode |= cpu_to_le32(POSIX_TYPE_CHARDEV << POSIX_FILETYPE_SHIFT);
+		break;
+	case S_IFBLK:
+		file_info->Mode |= cpu_to_le32(POSIX_TYPE_BLKDEV << POSIX_FILETYPE_SHIFT);
+		break;
+	case S_IFIFO:
+		file_info->Mode |= cpu_to_le32(POSIX_TYPE_FIFO << POSIX_FILETYPE_SHIFT);
+		break;
+	case S_IFSOCK:
+		file_info->Mode |= cpu_to_le32(POSIX_TYPE_SOCKET << POSIX_FILETYPE_SHIFT);
+	}
+
+	file_info->DeviceId = cpu_to_le32(stat.rdev);
 
 	/*
 	 * Sids(32) contain two sids(Domain sid(16), UNIX group sid(16)).
@@ -4882,6 +4998,8 @@
 		  SIDUNIX_GROUP, (struct smb_sid *)&file_info->Sids[16]);
 
 	rsp->OutputBufferLength = cpu_to_le32(out_buf_len);
+
+	return 0;
 }
 
 static int smb2_get_info_file(struct ksmbd_work *work,
@@ -4930,7 +5048,7 @@
 		break;
 
 	case FILE_STANDARD_INFORMATION:
-		get_file_standard_info(rsp, fp, work->response_buf);
+		rc = get_file_standard_info(rsp, fp, work->response_buf);
 		break;
 
 	case FILE_ALIGNMENT_INFORMATION:
@@ -4946,11 +5064,11 @@
 		break;
 
 	case FILE_STREAM_INFORMATION:
-		get_file_stream_info(work, rsp, fp, work->response_buf);
+		rc = get_file_stream_info(work, rsp, fp, work->response_buf);
 		break;
 
 	case FILE_INTERNAL_INFORMATION:
-		get_file_internal_info(rsp, fp, work->response_buf);
+		rc = get_file_internal_info(rsp, fp, work->response_buf);
 		break;
 
 	case FILE_NETWORK_OPEN_INFORMATION:
@@ -4974,7 +5092,7 @@
 		break;
 
 	case FILE_COMPRESSION_INFORMATION:
-		get_file_compression_info(rsp, fp, work->response_buf);
+		rc = get_file_compression_info(rsp, fp, work->response_buf);
 		break;
 
 	case FILE_ATTRIBUTE_TAG_INFORMATION:
@@ -4985,7 +5103,7 @@
 			pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n");
 			rc = -EOPNOTSUPP;
 		} else {
-			find_file_posix_info(rsp, fp, work->response_buf);
+			rc = find_file_posix_info(rsp, fp, work->response_buf);
 		}
 		break;
 	default:
@@ -5037,8 +5155,13 @@
 
 		info = (struct filesystem_device_info *)rsp->Buffer;
 
-		info->DeviceType = cpu_to_le32(stfs.f_type);
-		info->DeviceCharacteristics = cpu_to_le32(0x00000020);
+		info->DeviceType = cpu_to_le32(FILE_DEVICE_DISK);
+		info->DeviceCharacteristics =
+			cpu_to_le32(FILE_DEVICE_IS_MOUNTED);
+		if (!test_tree_conn_flag(work->tcon,
+					 KSMBD_TREE_CONN_FLAG_WRITABLE))
+			info->DeviceCharacteristics |=
+				cpu_to_le32(FILE_READ_ONLY_DEVICE);
 		rsp->OutputBufferLength = cpu_to_le32(8);
 		break;
 	}
@@ -5305,6 +5428,11 @@
 
 	ksmbd_debug(SMB, "GOT query info request\n");
 
+	if (ksmbd_override_fsids(work)) {
+		rc = -ENOMEM;
+		goto err_out;
+	}
+
 	switch (req->InfoType) {
 	case SMB2_O_INFO_FILE:
 		ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n");
@@ -5323,6 +5451,7 @@
 			    req->InfoType);
 		rc = -EOPNOTSUPP;
 	}
+	ksmbd_revert_fsids(work);
 
 	if (!rc) {
 		rsp->StructureSize = cpu_to_le16(9);
@@ -5332,6 +5461,7 @@
 					le32_to_cpu(rsp->OutputBufferLength));
 	}
 
+err_out:
 	if (rc < 0) {
 		if (rc == -EACCES)
 			rsp->hdr.Status = STATUS_ACCESS_DENIED;
@@ -5398,7 +5528,6 @@
 	struct smb2_close_rsp *rsp;
 	struct ksmbd_conn *conn = work->conn;
 	struct ksmbd_file *fp;
-	struct inode *inode;
 	u64 time;
 	int err = 0;
 
@@ -5453,24 +5582,33 @@
 	rsp->Reserved = 0;
 
 	if (req->Flags == SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB) {
+		struct kstat stat;
+		int ret;
+
 		fp = ksmbd_lookup_fd_fast(work, volatile_id);
 		if (!fp) {
 			err = -ENOENT;
 			goto out;
 		}
 
-		inode = file_inode(fp->filp);
+		ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+				  AT_STATX_SYNC_AS_STAT);
+		if (ret) {
+			ksmbd_fd_put(work, fp);
+			goto out;
+		}
+
 		rsp->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB;
-		rsp->AllocationSize = S_ISDIR(inode->i_mode) ? 0 :
-			cpu_to_le64(inode->i_blocks << 9);
-		rsp->EndOfFile = cpu_to_le64(inode->i_size);
+		rsp->AllocationSize = S_ISDIR(stat.mode) ? 0 :
+			cpu_to_le64(stat.blocks << 9);
+		rsp->EndOfFile = cpu_to_le64(stat.size);
 		rsp->Attributes = fp->f_ci->m_fattr;
 		rsp->CreationTime = cpu_to_le64(fp->create_time);
-		time = ksmbd_UnixTimeToNT(inode_get_atime(inode));
+		time = ksmbd_UnixTimeToNT(stat.atime);
 		rsp->LastAccessTime = cpu_to_le64(time);
-		time = ksmbd_UnixTimeToNT(inode_get_mtime(inode));
+		time = ksmbd_UnixTimeToNT(stat.mtime);
 		rsp->LastWriteTime = cpu_to_le64(time);
-		time = ksmbd_UnixTimeToNT(inode_get_ctime(inode));
+		time = ksmbd_UnixTimeToNT(stat.ctime);
 		rsp->ChangeTime = cpu_to_le64(time);
 		ksmbd_fd_put(work, fp);
 	} else {
@@ -5581,8 +5719,9 @@
 	if (!file_info->ReplaceIfExists)
 		flags = RENAME_NOREPLACE;
 
-	smb_break_all_levII_oplock(work, fp, 0);
 	rc = ksmbd_vfs_rename(work, &fp->filp->f_path, new_name, flags);
+	if (!rc)
+		smb_break_all_levII_oplock(work, fp, 0);
 out:
 	kfree(new_name);
 	return rc;
@@ -5689,15 +5828,13 @@
 		attrs.ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET);
 	}
 
-	attrs.ia_valid |= ATTR_CTIME;
 	if (file_info->ChangeTime)
-		attrs.ia_ctime = ksmbd_NTtimeToUnix(file_info->ChangeTime);
-	else
-		attrs.ia_ctime = inode_get_ctime(inode);
+		inode_set_ctime_to_ts(inode,
+				ksmbd_NTtimeToUnix(file_info->ChangeTime));
 
 	if (file_info->LastWriteTime) {
 		attrs.ia_mtime = ksmbd_NTtimeToUnix(file_info->LastWriteTime);
-		attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET);
+		attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET | ATTR_CTIME);
 	}
 
 	if (file_info->Attributes) {
@@ -5739,8 +5876,6 @@
 			return -EACCES;
 
 		inode_lock(inode);
-		inode_set_ctime_to_ts(inode, attrs.ia_ctime);
-		attrs.ia_valid &= ~ATTR_CTIME;
 		rc = notify_change(idmap, dentry, &attrs, NULL);
 		inode_unlock(inode);
 	}
@@ -5759,15 +5894,21 @@
 
 	loff_t alloc_blks;
 	struct inode *inode;
+	struct kstat stat;
 	int rc;
 
 	if (!(fp->daccess & FILE_WRITE_DATA_LE))
 		return -EACCES;
 
+	rc = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
+			 AT_STATX_SYNC_AS_STAT);
+	if (rc)
+		return rc;
+
 	alloc_blks = (le64_to_cpu(file_alloc_info->AllocationSize) + 511) >> 9;
 	inode = file_inode(fp->filp);
 
-	if (alloc_blks > inode->i_blocks) {
+	if (alloc_blks > stat.blocks) {
 		smb_break_all_levII_oplock(work, fp, 1);
 		rc = vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0,
 				   alloc_blks * 512);
@@ -5775,7 +5916,7 @@
 			pr_err("vfs_fallocate is failed : %d\n", rc);
 			return rc;
 		}
-	} else if (alloc_blks < inode->i_blocks) {
+	} else if (alloc_blks < stat.blocks) {
 		loff_t size;
 
 		/*
@@ -5930,6 +6071,7 @@
 			      struct ksmbd_share_config *share)
 {
 	unsigned int buf_len = le32_to_cpu(req->BufferLength);
+	char *buffer = (char *)req + le16_to_cpu(req->BufferOffset);
 
 	switch (req->FileInfoClass) {
 	case FILE_BASIC_INFORMATION:
@@ -5937,7 +6079,7 @@
 		if (buf_len < sizeof(struct smb2_file_basic_info))
 			return -EINVAL;
 
-		return set_file_basic_info(fp, (struct smb2_file_basic_info *)req->Buffer, share);
+		return set_file_basic_info(fp, (struct smb2_file_basic_info *)buffer, share);
 	}
 	case FILE_ALLOCATION_INFORMATION:
 	{
@@ -5945,7 +6087,7 @@
 			return -EINVAL;
 
 		return set_file_allocation_info(work, fp,
-						(struct smb2_file_alloc_info *)req->Buffer);
+						(struct smb2_file_alloc_info *)buffer);
 	}
 	case FILE_END_OF_FILE_INFORMATION:
 	{
@@ -5953,7 +6095,7 @@
 			return -EINVAL;
 
 		return set_end_of_file_info(work, fp,
-					    (struct smb2_file_eof_info *)req->Buffer);
+					    (struct smb2_file_eof_info *)buffer);
 	}
 	case FILE_RENAME_INFORMATION:
 	{
@@ -5961,7 +6103,7 @@
 			return -EINVAL;
 
 		return set_rename_info(work, fp,
-				       (struct smb2_file_rename_info *)req->Buffer,
+				       (struct smb2_file_rename_info *)buffer,
 				       buf_len);
 	}
 	case FILE_LINK_INFORMATION:
@@ -5970,7 +6112,7 @@
 			return -EINVAL;
 
 		return smb2_create_link(work, work->tcon->share_conf,
-					(struct smb2_file_link_info *)req->Buffer,
+					(struct smb2_file_link_info *)buffer,
 					buf_len, fp->filp,
 					work->conn->local_nls);
 	}
@@ -5980,7 +6122,7 @@
 			return -EINVAL;
 
 		return set_file_disposition_info(fp,
-						 (struct smb2_file_disposition_info *)req->Buffer);
+						 (struct smb2_file_disposition_info *)buffer);
 	}
 	case FILE_FULL_EA_INFORMATION:
 	{
@@ -5993,7 +6135,7 @@
 		if (buf_len < sizeof(struct smb2_ea_info))
 			return -EINVAL;
 
-		return smb2_set_ea((struct smb2_ea_info *)req->Buffer,
+		return smb2_set_ea((struct smb2_ea_info *)buffer,
 				   buf_len, &fp->filp->f_path, true);
 	}
 	case FILE_POSITION_INFORMATION:
@@ -6001,14 +6143,14 @@
 		if (buf_len < sizeof(struct smb2_file_pos_info))
 			return -EINVAL;
 
-		return set_file_position_info(fp, (struct smb2_file_pos_info *)req->Buffer);
+		return set_file_position_info(fp, (struct smb2_file_pos_info *)buffer);
 	}
 	case FILE_MODE_INFORMATION:
 	{
 		if (buf_len < sizeof(struct smb2_file_mode_info))
 			return -EINVAL;
 
-		return set_file_mode_info(fp, (struct smb2_file_mode_info *)req->Buffer);
+		return set_file_mode_info(fp, (struct smb2_file_mode_info *)buffer);
 	}
 	}
 
@@ -6089,7 +6231,7 @@
 		}
 		rc = smb2_set_info_sec(fp,
 				       le32_to_cpu(req->AdditionalInformation),
-				       req->Buffer,
+				       (char *)req + le16_to_cpu(req->BufferOffset),
 				       le32_to_cpu(req->BufferLength));
 		ksmbd_revert_fsids(work);
 		break;
@@ -6327,6 +6469,10 @@
 	}
 
 	offset = le64_to_cpu(req->Offset);
+	if (offset < 0) {
+		err = -EINVAL;
+		goto out;
+	}
 	length = le32_to_cpu(req->Length);
 	mincount = le32_to_cpu(req->MinimumCount);
 
@@ -6540,6 +6686,8 @@
 	}
 
 	offset = le64_to_cpu(req->Offset);
+	if (offset < 0)
+		return -EINVAL;
 	length = le32_to_cpu(req->Length);
 
 	if (req->Channel == SMB2_CHANNEL_RDMA_V1 ||
@@ -7535,7 +7683,7 @@
 				 struct smb2_ioctl_rsp *rsp)
 {
 	struct ksmbd_rpc_command *rpc_resp;
-	char *data_buf = (char *)&req->Buffer[0];
+	char *data_buf = (char *)req + le32_to_cpu(req->InputOffset);
 	int nbytes = 0;
 
 	rpc_resp = ksmbd_rpc_ioctl(work->sess, id, data_buf,
@@ -7648,6 +7796,7 @@
 	u64 id = KSMBD_NO_FID;
 	struct ksmbd_conn *conn = work->conn;
 	int ret = 0;
+	char *buffer;
 
 	if (work->next_smb2_rcv_hdr_off) {
 		req = ksmbd_req_buf_next(work);
@@ -7670,6 +7819,8 @@
 		goto out;
 	}
 
+	buffer = (char *)req + le32_to_cpu(req->InputOffset);
+
 	cnt_code = le32_to_cpu(req->CtlCode);
 	ret = smb2_calc_max_out_buf_len(work, 48,
 					le32_to_cpu(req->MaxOutputResponse));
@@ -7727,7 +7878,7 @@
 		}
 
 		ret = fsctl_validate_negotiate_info(conn,
-			(struct validate_negotiate_info_req *)&req->Buffer[0],
+			(struct validate_negotiate_info_req *)buffer,
 			(struct validate_negotiate_info_rsp *)&rsp->Buffer[0],
 			in_buf_len);
 		if (ret < 0)
@@ -7780,7 +7931,7 @@
 		rsp->VolatileFileId = req->VolatileFileId;
 		rsp->PersistentFileId = req->PersistentFileId;
 		fsctl_copychunk(work,
-				(struct copychunk_ioctl_req *)&req->Buffer[0],
+				(struct copychunk_ioctl_req *)buffer,
 				le32_to_cpu(req->CtlCode),
 				le32_to_cpu(req->InputCount),
 				req->VolatileFileId,
@@ -7793,8 +7944,7 @@
 			goto out;
 		}
 
-		ret = fsctl_set_sparse(work, id,
-				       (struct file_sparse *)&req->Buffer[0]);
+		ret = fsctl_set_sparse(work, id, (struct file_sparse *)buffer);
 		if (ret < 0)
 			goto out;
 		break;
@@ -7817,7 +7967,7 @@
 		}
 
 		zero_data =
-			(struct file_zero_data_information *)&req->Buffer[0];
+			(struct file_zero_data_information *)buffer;
 
 		off = le64_to_cpu(zero_data->FileOffset);
 		bfz = le64_to_cpu(zero_data->BeyondFinalZero);
@@ -7848,7 +7998,7 @@
 		}
 
 		ret = fsctl_query_allocated_ranges(work, id,
-			(struct file_allocated_range_buffer *)&req->Buffer[0],
+			(struct file_allocated_range_buffer *)buffer,
 			(struct file_allocated_range_buffer *)&rsp->Buffer[0],
 			out_buf_len /
 			sizeof(struct file_allocated_range_buffer), &nbytes);
@@ -7892,7 +8042,7 @@
 			goto out;
 		}
 
-		dup_ext = (struct duplicate_extents_to_file *)&req->Buffer[0];
+		dup_ext = (struct duplicate_extents_to_file *)buffer;
 
 		fp_in = ksmbd_lookup_fd_slow(work, dup_ext->VolatileFileHandle,
 					     dup_ext->PersistentFileHandle);
@@ -8631,6 +8781,7 @@
 		       le64_to_cpu(tr_hdr->SessionId));
 		return -ECONNABORTED;
 	}
+	ksmbd_user_session_put(sess);
 
 	iov[0].iov_base = buf;
 	iov[0].iov_len = sizeof(struct smb2_transform_hdr) + 4;
--- linux-qcom-6.8.0.orig/fs/smb/server/smb2pdu.h
+++ linux-qcom-6.8.0/fs/smb/server/smb2pdu.h
@@ -485,4 +485,14 @@
 	return buf + 4;
 }
 
+#define POSIX_TYPE_FILE		0
+#define POSIX_TYPE_DIR		1
+#define POSIX_TYPE_SYMLINK	2
+#define POSIX_TYPE_CHARDEV	3
+#define POSIX_TYPE_BLKDEV	4
+#define POSIX_TYPE_FIFO		5
+#define POSIX_TYPE_SOCKET	6
+
+#define POSIX_FILETYPE_SHIFT	12
+
 #endif	/* _SMB2PDU_H */
--- linux-qcom-6.8.0.orig/fs/smb/server/smb_common.c
+++ linux-qcom-6.8.0/fs/smb/server/smb_common.c
@@ -18,8 +18,8 @@
 #include "mgmt/share_config.h"
 
 /*for shortname implementation */
-static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%";
-#define MANGLE_BASE (sizeof(basechars) / sizeof(char) - 1)
+static const char *basechars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%";
+#define MANGLE_BASE (strlen(basechars) - 1)
 #define MAGIC_CHAR '~'
 #define PERIOD '.'
 #define mangle(V) ((char)(basechars[(V) % MANGLE_BASE]))
@@ -388,6 +388,10 @@
 	.set_rsp_status = set_smb1_rsp_status,
 };
 
+static struct smb_version_values smb1_server_values = {
+	.max_credits = SMB2_MAX_CREDITS,
+};
+
 static int smb1_negotiate(struct ksmbd_work *work)
 {
 	return ksmbd_smb_negotiate_common(work, SMB_COM_NEGOTIATE);
@@ -399,18 +403,18 @@
 
 static int init_smb1_server(struct ksmbd_conn *conn)
 {
+	conn->vals = &smb1_server_values;
 	conn->ops = &smb1_server_ops;
 	conn->cmds = smb1_server_cmds;
 	conn->max_cmds = ARRAY_SIZE(smb1_server_cmds);
 	return 0;
 }
 
-int ksmbd_init_smb_server(struct ksmbd_work *work)
+int ksmbd_init_smb_server(struct ksmbd_conn *conn)
 {
-	struct ksmbd_conn *conn = work->conn;
 	__le32 proto;
 
-	proto = *(__le32 *)((struct smb_hdr *)work->request_buf)->Protocol;
+	proto = *(__le32 *)((struct smb_hdr *)conn->request_buf)->Protocol;
 	if (conn->need_neg == false) {
 		if (proto == SMB1_PROTO_NUMBER)
 			return -EINVAL;
@@ -457,10 +461,13 @@
 			}
 
 			ksmbd_kstat.kstat = &kstat;
-			ksmbd_vfs_fill_dentry_attrs(work,
-						    idmap,
-						    dentry,
-						    &ksmbd_kstat);
+			rc = ksmbd_vfs_fill_dentry_attrs(work,
+							 idmap,
+							 dentry,
+							 &ksmbd_kstat);
+			if (rc)
+				break;
+
 			rc = fn(conn, info_level, d_info, &ksmbd_kstat);
 			if (rc)
 				break;
@@ -729,10 +736,10 @@
 	return p && p[0] == '*';
 }
 
-int ksmbd_override_fsids(struct ksmbd_work *work)
+int __ksmbd_override_fsids(struct ksmbd_work *work,
+		struct ksmbd_share_config *share)
 {
 	struct ksmbd_session *sess = work->sess;
-	struct ksmbd_share_config *share = work->tcon->share_conf;
 	struct cred *cred;
 	struct group_info *gi;
 	unsigned int uid;
@@ -772,6 +779,11 @@
 	return 0;
 }
 
+int ksmbd_override_fsids(struct ksmbd_work *work)
+{
+	return __ksmbd_override_fsids(work, work->tcon->share_conf);
+}
+
 void ksmbd_revert_fsids(struct ksmbd_work *work)
 {
 	const struct cred *cred;
--- linux-qcom-6.8.0.orig/fs/smb/server/smb_common.h
+++ linux-qcom-6.8.0/fs/smb/server/smb_common.h
@@ -427,7 +427,7 @@
 
 int ksmbd_lookup_dialect_by_id(__le16 *cli_dialects, __le16 dialects_count);
 
-int ksmbd_init_smb_server(struct ksmbd_work *work);
+int ksmbd_init_smb_server(struct ksmbd_conn *conn);
 
 struct ksmbd_kstat;
 int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work,
@@ -447,6 +447,8 @@
 int ksmbd_smb_negotiate_common(struct ksmbd_work *work, unsigned int command);
 
 int ksmbd_smb_check_shared_mode(struct file *filp, struct ksmbd_file *curr_fp);
+int __ksmbd_override_fsids(struct ksmbd_work *work,
+			   struct ksmbd_share_config *share);
 int ksmbd_override_fsids(struct ksmbd_work *work);
 void ksmbd_revert_fsids(struct ksmbd_work *work);
 
--- linux-qcom-6.8.0.orig/fs/smb/server/transport_ipc.c
+++ linux-qcom-6.8.0/fs/smb/server/transport_ipc.c
@@ -65,6 +65,7 @@
 	struct hlist_node	ipc_table_hlist;
 
 	void			*response;
+	unsigned int		msg_sz;
 };
 
 static struct delayed_work ipc_timer_work;
@@ -275,6 +276,7 @@
 		}
 
 		memcpy(entry->response, payload, sz);
+		entry->msg_sz = sz;
 		wake_up_interruptible(&entry->wait);
 		ret = 0;
 		break;
@@ -303,8 +305,11 @@
 		init_smb2_max_write_size(req->smb2_max_write);
 	if (req->smb2_max_trans)
 		init_smb2_max_trans_size(req->smb2_max_trans);
-	if (req->smb2_max_credits)
+	if (req->smb2_max_credits) {
 		init_smb2_max_credits(req->smb2_max_credits);
+		server_conf.max_inflight_req =
+			req->smb2_max_credits;
+	}
 	if (req->smbd_max_io_size)
 		init_smbd_max_io_size(req->smbd_max_io_size);
 
@@ -453,6 +458,34 @@
 	return ret;
 }
 
+static int ipc_validate_msg(struct ipc_msg_table_entry *entry)
+{
+	unsigned int msg_sz = entry->msg_sz;
+
+	if (entry->type == KSMBD_EVENT_RPC_REQUEST) {
+		struct ksmbd_rpc_command *resp = entry->response;
+
+		msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz;
+	} else if (entry->type == KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST) {
+		struct ksmbd_spnego_authen_response *resp = entry->response;
+
+		msg_sz = sizeof(struct ksmbd_spnego_authen_response) +
+				resp->session_key_len + resp->spnego_blob_len;
+	} else if (entry->type == KSMBD_EVENT_SHARE_CONFIG_REQUEST) {
+		struct ksmbd_share_config_response *resp = entry->response;
+
+		if (resp->payload_sz) {
+			if (resp->payload_sz < resp->veto_list_sz)
+				return -EINVAL;
+
+			msg_sz = sizeof(struct ksmbd_share_config_response) +
+					resp->payload_sz;
+		}
+	}
+
+	return entry->msg_sz != msg_sz ? -EINVAL : 0;
+}
+
 static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle)
 {
 	struct ipc_msg_table_entry entry;
@@ -477,6 +510,13 @@
 	ret = wait_event_interruptible_timeout(entry.wait,
 					       entry.response != NULL,
 					       IPC_WAIT_TIMEOUT);
+	if (entry.response) {
+		ret = ipc_validate_msg(&entry);
+		if (ret) {
+			kvfree(entry.response);
+			entry.response = NULL;
+		}
+	}
 out:
 	down_write(&ipc_msg_table_lock);
 	hash_del(&entry.ipc_table_hlist);
--- linux-qcom-6.8.0.orig/fs/smb/server/transport_tcp.c
+++ linux-qcom-6.8.0/fs/smb/server/transport_tcp.c
@@ -448,6 +448,10 @@
 		sin6.sin6_family = PF_INET6;
 		sin6.sin6_addr = in6addr_any;
 		sin6.sin6_port = htons(server_conf.tcp_port);
+
+		lock_sock(ksmbd_socket->sk);
+		ksmbd_socket->sk->sk_ipv6only = false;
+		release_sock(ksmbd_socket->sk);
 	}
 
 	ksmbd_tcp_nodelay(ksmbd_socket);
@@ -620,8 +624,10 @@
 		for_each_netdev(&init_net, netdev) {
 			if (netif_is_bridge_port(netdev))
 				continue;
-			if (!alloc_iface(kstrdup(netdev->name, GFP_KERNEL)))
+			if (!alloc_iface(kstrdup(netdev->name, GFP_KERNEL))) {
+				rtnl_unlock();
 				return -ENOMEM;
+			}
 		}
 		rtnl_unlock();
 		bind_additional_ifaces = 1;
--- linux-qcom-6.8.0.orig/fs/smb/server/vfs.c
+++ linux-qcom-6.8.0/fs/smb/server/vfs.c
@@ -496,7 +496,7 @@
 	int err = 0;
 
 	if (work->conn->connection_type) {
-		if (!(fp->daccess & FILE_WRITE_DATA_LE)) {
+		if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE))) {
 			pr_err("no right to write(%pD)\n", fp->filp);
 			err = -EACCES;
 			goto out;
@@ -754,10 +754,15 @@
 		goto out4;
 	}
 
+	/*
+	 * explicitly handle file overwrite case, for compatibility with
+	 * filesystems that may not support rename flags (e.g: fuse)
+	 */
 	if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry)) {
 		err = -EEXIST;
 		goto out4;
 	}
+	flags &= ~(RENAME_NOREPLACE);
 
 	if (old_child == trap) {
 		err = -EINVAL;
@@ -1053,16 +1058,21 @@
 }
 
 int ksmbd_vfs_remove_xattr(struct mnt_idmap *idmap,
-			   const struct path *path, char *attr_name)
+			   const struct path *path, char *attr_name,
+			   bool get_write)
 {
 	int err;
 
-	err = mnt_want_write(path->mnt);
-	if (err)
-		return err;
+	if (get_write == true) {
+		err = mnt_want_write(path->mnt);
+		if (err)
+			return err;
+	}
 
 	err = vfs_removexattr(idmap, path->dentry, attr_name);
-	mnt_drop_write(path->mnt);
+
+	if (get_write == true)
+		mnt_drop_write(path->mnt);
 
 	return err;
 }
@@ -1105,9 +1115,10 @@
 	struct ksmbd_readdir_data *buf;
 
 	buf = container_of(ctx, struct ksmbd_readdir_data, ctx);
-	buf->dirent_count++;
+	if (!is_dot_dotdot(name, namlen))
+		buf->dirent_count++;
 
-	return buf->dirent_count <= 2;
+	return !buf->dirent_count;
 }
 
 /**
@@ -1127,7 +1138,7 @@
 	readdir_data.dirent_count = 0;
 
 	err = iterate_dir(fp->filp, &readdir_data.ctx);
-	if (readdir_data.dirent_count > 2)
+	if (readdir_data.dirent_count)
 		err = -ENOTEMPTY;
 	else
 		err = 0;
@@ -1156,7 +1167,7 @@
 	if (cmp < 0)
 		cmp = strncasecmp((char *)buf->private, name, namlen);
 	if (!cmp) {
-		memcpy((char *)buf->private, name, namlen);
+		memcpy((char *)buf->private, name, buf->used);
 		buf->dirent_count = 1;
 		return false;
 	}
@@ -1224,10 +1235,7 @@
 		char *filepath;
 		size_t path_len, remain_len;
 
-		filepath = kstrdup(name, GFP_KERNEL);
-		if (!filepath)
-			return -ENOMEM;
-
+		filepath = name;
 		path_len = strlen(filepath);
 		remain_len = path_len;
 
@@ -1256,6 +1264,8 @@
 					      filepath,
 					      flags,
 					      path);
+			if (!is_last)
+				next[0] = '/';
 			if (err)
 				goto out2;
 			else if (is_last)
@@ -1263,17 +1273,15 @@
 			path_put(parent_path);
 			*parent_path = *path;
 
-			next[0] = '/';
 			remain_len -= filename_len + 1;
 		}
 
 		err = -EINVAL;
 out2:
 		path_put(parent_path);
-out1:
-		kfree(filepath);
 	}
 
+out1:
 	if (!err) {
 		err = mnt_want_write(parent_path->mnt);
 		if (err) {
@@ -1375,7 +1383,7 @@
 		ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name));
 
 		if (!strncmp(name, XATTR_NAME_SD, XATTR_NAME_SD_LEN)) {
-			err = ksmbd_vfs_remove_xattr(idmap, path, name);
+			err = ksmbd_vfs_remove_xattr(idmap, path, name, true);
 			if (err)
 				ksmbd_debug(SMB, "remove xattr failed : %s\n", name);
 		}
@@ -1682,11 +1690,19 @@
 				struct dentry *dentry,
 				struct ksmbd_kstat *ksmbd_kstat)
 {
+	struct ksmbd_share_config *share_conf = work->tcon->share_conf;
 	u64 time;
 	int rc;
+	struct path path = {
+		.mnt = share_conf->vfs_path.mnt,
+		.dentry = dentry,
+	};
 
-	generic_fillattr(idmap, STATX_BASIC_STATS, d_inode(dentry),
-			 ksmbd_kstat->kstat);
+	rc = vfs_getattr(&path, ksmbd_kstat->kstat,
+			 STATX_BASIC_STATS | STATX_BTIME,
+			 AT_STATX_SYNC_AS_STAT);
+	if (rc)
+		return rc;
 
 	time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->ctime);
 	ksmbd_kstat->create_time = time;
--- linux-qcom-6.8.0.orig/fs/smb/server/vfs.h
+++ linux-qcom-6.8.0/fs/smb/server/vfs.h
@@ -43,6 +43,7 @@
 	char		*rptr;
 	int		name_len;
 	int		out_buf_len;
+	int		num_scan;
 	int		num_entry;
 	int		data_count;
 	int		last_entry_offset;
@@ -114,7 +115,8 @@
 int ksmbd_vfs_xattr_stream_name(char *stream_name, char **xattr_stream_name,
 				size_t *xattr_stream_name_size, int s_type);
 int ksmbd_vfs_remove_xattr(struct mnt_idmap *idmap,
-			   const struct path *path, char *attr_name);
+			   const struct path *path, char *attr_name,
+			   bool get_write);
 int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name,
 			       unsigned int flags, struct path *parent_path,
 			       struct path *path, bool caseless);
--- linux-qcom-6.8.0.orig/fs/smb/server/vfs_cache.c
+++ linux-qcom-6.8.0/fs/smb/server/vfs_cache.c
@@ -254,7 +254,8 @@
 		ci->m_flags &= ~S_DEL_ON_CLS_STREAM;
 		err = ksmbd_vfs_remove_xattr(file_mnt_idmap(filp),
 					     &filp->f_path,
-					     fp->stream.name);
+					     fp->stream.name,
+					     true);
 		if (err)
 			pr_err("remove xattr failed : %s\n",
 			       fp->stream.name);
--- linux-qcom-6.8.0.orig/fs/squashfs/inode.c
+++ linux-qcom-6.8.0/fs/squashfs/inode.c
@@ -48,6 +48,10 @@
 	gid_t i_gid;
 	int err;
 
+	inode->i_ino = le32_to_cpu(sqsh_ino->inode_number);
+	if (inode->i_ino == 0)
+		return -EINVAL;
+
 	err = squashfs_get_id(sb, le16_to_cpu(sqsh_ino->uid), &i_uid);
 	if (err)
 		return err;
@@ -58,7 +62,6 @@
 
 	i_uid_write(inode, i_uid);
 	i_gid_write(inode, i_gid);
-	inode->i_ino = le32_to_cpu(sqsh_ino->inode_number);
 	inode_set_mtime(inode, le32_to_cpu(sqsh_ino->mtime), 0);
 	inode_set_atime(inode, inode_get_mtime_sec(inode), 0);
 	inode_set_ctime(inode, inode_get_mtime_sec(inode), 0);
@@ -276,8 +279,13 @@
 		if (err < 0)
 			goto failed_read;
 
-		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		inode->i_size = le32_to_cpu(sqsh_ino->symlink_size);
+		if (inode->i_size > PAGE_SIZE) {
+			ERROR("Corrupted symlink\n");
+			return -EINVAL;
+		}
+
+		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		inode->i_op = &squashfs_symlink_inode_ops;
 		inode_nohighmem(inode);
 		inode->i_data.a_ops = &squashfs_symlink_aops;
--- linux-qcom-6.8.0.orig/fs/super.c
+++ linux-qcom-6.8.0/fs/super.c
@@ -735,6 +735,17 @@
 	struct user_namespace *user_ns = fc->global ? &init_user_ns : fc->user_ns;
 	int err;
 
+	/*
+	 * Never allow s_user_ns != &init_user_ns when FS_USERNS_MOUNT is
+	 * not set, as the filesystem is likely unprepared to handle it.
+	 * This can happen when fsconfig() is called from init_user_ns with
+	 * an fs_fd opened in another user namespace.
+	 */
+	if (user_ns != &init_user_ns && !(fc->fs_type->fs_flags & FS_USERNS_MOUNT)) {
+		errorfc(fc, "VFS: Mounting from non-initial user namespace is not allowed");
+		return ERR_PTR(-EPERM);
+	}
+
 retry:
 	spin_lock(&sb_lock);
 	if (test) {
@@ -1501,8 +1512,17 @@
 
 	lockdep_assert_held(&bdev->bd_fsfreeze_mutex);
 
+	/*
+	 * The block device may have been frozen before it was claimed by a
+	 * filesystem. Concurrently another process might try to mount that
+	 * frozen block device and has temporarily claimed the block device for
+	 * that purpose causing a concurrent fs_bdev_thaw() to end up here. The
+	 * mounter is already about to abort mounting because they still saw an
+	 * elevanted bdev->bd_fsfreeze_count so get_bdev_super() will return
+	 * NULL in that case.
+	 */
 	sb = get_bdev_super(bdev);
-	if (WARN_ON_ONCE(!sb))
+	if (!sb)
 		return -EINVAL;
 
 	if (sb->s_op->thaw_super)
--- linux-qcom-6.8.0.orig/fs/sysfs/file.c
+++ linux-qcom-6.8.0/fs/sysfs/file.c
@@ -463,6 +463,8 @@
 	kn = kernfs_find_and_get(kobj->sd, attr->name);
 	if (kn)
 		kernfs_break_active_protection(kn);
+	else
+		kobject_put(kobj);
 	return kn;
 }
 EXPORT_SYMBOL_GPL(sysfs_break_active_protection);
--- linux-qcom-6.8.0.orig/fs/sysv/itree.c
+++ linux-qcom-6.8.0/fs/sysv/itree.c
@@ -83,9 +83,6 @@
 	return (sysv_zone_t*)((char*)bh->b_data + bh->b_size);
 }
 
-/*
- * Requires read_lock(&pointers_lock) or write_lock(&pointers_lock)
- */
 static Indirect *get_branch(struct inode *inode,
 			    int depth,
 			    int offsets[],
@@ -105,15 +102,18 @@
 		bh = sb_bread(sb, block);
 		if (!bh)
 			goto failure;
+		read_lock(&pointers_lock);
 		if (!verify_chain(chain, p))
 			goto changed;
 		add_chain(++p, bh, (sysv_zone_t*)bh->b_data + *++offsets);
+		read_unlock(&pointers_lock);
 		if (!p->key)
 			goto no_block;
 	}
 	return NULL;
 
 changed:
+	read_unlock(&pointers_lock);
 	brelse(bh);
 	*err = -EAGAIN;
 	goto no_block;
@@ -219,9 +219,7 @@
 		goto out;
 
 reread:
-	read_lock(&pointers_lock);
 	partial = get_branch(inode, depth, offsets, chain, &err);
-	read_unlock(&pointers_lock);
 
 	/* Simplest case - block found, no allocation needed */
 	if (!partial) {
@@ -291,9 +289,9 @@
 	*top = 0;
 	for (k = depth; k > 1 && !offsets[k-1]; k--)
 		;
+	partial = get_branch(inode, k, offsets, chain, &err);
 
 	write_lock(&pointers_lock);
-	partial = get_branch(inode, k, offsets, chain, &err);
 	if (!partial)
 		partial = chain + k-1;
 	/*
--- linux-qcom-6.8.0.orig/fs/tracefs/event_inode.c
+++ linux-qcom-6.8.0/fs/tracefs/event_inode.c
@@ -35,11 +35,27 @@
 /* Choose something "unique" ;-) */
 #define EVENTFS_FILE_INODE_INO		0x12c4e37
 
+struct eventfs_root_inode {
+	struct eventfs_inode		ei;
+	struct inode			*parent_inode;
+	struct dentry			*events_dir;
+};
+
+static struct eventfs_root_inode *get_root_inode(struct eventfs_inode *ei)
+{
+	WARN_ON_ONCE(!ei->is_events);
+	return container_of(ei, struct eventfs_root_inode, ei);
+}
+
 /* Just try to make something consistent and unique */
 static int eventfs_dir_ino(struct eventfs_inode *ei)
 {
-	if (!ei->ino)
+	if (!ei->ino) {
 		ei->ino = get_next_ino();
+		/* Must not have the file inode number */
+		if (ei->ino == EVENTFS_FILE_INODE_INO)
+			ei->ino = get_next_ino();
+	}
 
 	return ei->ino;
 }
@@ -57,11 +73,25 @@
 	EVENTFS_SAVE_MODE	= BIT(16),
 	EVENTFS_SAVE_UID	= BIT(17),
 	EVENTFS_SAVE_GID	= BIT(18),
-	EVENTFS_TOPLEVEL	= BIT(19),
 };
 
 #define EVENTFS_MODE_MASK	(EVENTFS_SAVE_MODE - 1)
 
+static void free_ei_rcu(struct rcu_head *rcu)
+{
+	struct eventfs_inode *ei = container_of(rcu, struct eventfs_inode, rcu);
+	struct eventfs_root_inode *rei;
+
+	kfree(ei->entry_attrs);
+	kfree_const(ei->name);
+	if (ei->is_events) {
+		rei = get_root_inode(ei);
+		kfree(rei);
+	} else {
+		kfree(ei);
+	}
+}
+
 /*
  * eventfs_inode reference count management.
  *
@@ -73,12 +103,17 @@
 static void release_ei(struct kref *ref)
 {
 	struct eventfs_inode *ei = container_of(ref, struct eventfs_inode, kref);
+	const struct eventfs_entry *entry;
 
 	WARN_ON_ONCE(!ei->is_freed);
 
-	kfree(ei->entry_attrs);
-	kfree_const(ei->name);
-	kfree_rcu(ei, rcu);
+	for (int i = 0; i < ei->nr_entries; i++) {
+		entry = &ei->entries[i];
+		if (entry->release)
+			entry->release(entry->name, ei->data);
+	}
+
+	call_srcu(&eventfs_srcu, &ei->rcu, free_ei_rcu);
 }
 
 static inline void put_ei(struct eventfs_inode *ei)
@@ -95,6 +130,18 @@
 	}
 }
 
+/*
+ * Called when creation of an ei fails, do not call release() functions.
+ */
+static inline void cleanup_ei(struct eventfs_inode *ei)
+{
+	if (ei) {
+		/* Set nr_entries to 0 to prevent release() function being called */
+		ei->nr_entries = 0;
+		free_ei(ei);
+	}
+}
+
 static inline struct eventfs_inode *get_ei(struct eventfs_inode *ei)
 {
 	if (ei)
@@ -164,21 +211,7 @@
 	 * determined by the parent directory.
 	 */
 	if (dentry->d_inode->i_mode & S_IFDIR) {
-		/*
-		 * The events directory dentry is never freed, unless its
-		 * part of an instance that is deleted. It's attr is the
-		 * default for its child files and directories.
-		 * Do not update it. It's not used for its own mode or ownership.
-		 */
-		if (ei->is_events) {
-			/* But it still needs to know if it was modified */
-			if (iattr->ia_valid & ATTR_UID)
-				ei->attr.mode |= EVENTFS_SAVE_UID;
-			if (iattr->ia_valid & ATTR_GID)
-				ei->attr.mode |= EVENTFS_SAVE_GID;
-		} else {
-			update_attr(&ei->attr, iattr);
-		}
+		update_attr(&ei->attr, iattr);
 
 	} else {
 		name = dentry->d_name.name;
@@ -196,18 +229,25 @@
 	return ret;
 }
 
-static void update_top_events_attr(struct eventfs_inode *ei, struct super_block *sb)
+static void update_events_attr(struct eventfs_inode *ei, struct super_block *sb)
 {
-	struct inode *root;
+	struct eventfs_root_inode *rei;
+	struct inode *parent;
 
-	/* Only update if the "events" was on the top level */
-	if (!ei || !(ei->attr.mode & EVENTFS_TOPLEVEL))
-		return;
+	rei = get_root_inode(ei);
+
+	/* Use the parent inode permissions unless root set its permissions */
+	parent = rei->parent_inode;
+
+	if (rei->ei.attr.mode & EVENTFS_SAVE_UID)
+		ei->attr.uid = rei->ei.attr.uid;
+	else
+		ei->attr.uid = parent->i_uid;
 
-	/* Get the tracefs root inode. */
-	root = d_inode(sb->s_root);
-	ei->attr.uid = root->i_uid;
-	ei->attr.gid = root->i_gid;
+	if (rei->ei.attr.mode & EVENTFS_SAVE_GID)
+		ei->attr.gid = rei->ei.attr.gid;
+	else
+		ei->attr.gid = parent->i_gid;
 }
 
 static void set_top_events_ownership(struct inode *inode)
@@ -216,10 +256,10 @@
 	struct eventfs_inode *ei = ti->private;
 
 	/* The top events directory doesn't get automatically updated */
-	if (!ei || !ei->is_events || !(ei->attr.mode & EVENTFS_TOPLEVEL))
+	if (!ei || !ei->is_events)
 		return;
 
-	update_top_events_attr(ei, inode->i_sb);
+	update_events_attr(ei, inode->i_sb);
 
 	if (!(ei->attr.mode & EVENTFS_SAVE_UID))
 		inode->i_uid = ei->attr.uid;
@@ -248,7 +288,7 @@
 	return generic_permission(idmap, inode, mask);
 }
 
-static const struct inode_operations eventfs_root_dir_inode_operations = {
+static const struct inode_operations eventfs_dir_inode_operations = {
 	.lookup		= eventfs_root_lookup,
 	.setattr	= eventfs_set_attr,
 	.getattr	= eventfs_get_attr,
@@ -265,6 +305,62 @@
 	.llseek		= generic_file_llseek,
 };
 
+static void eventfs_set_attrs(struct eventfs_inode *ei, bool update_uid, kuid_t uid,
+			      bool update_gid, kgid_t gid, int level)
+{
+	struct eventfs_inode *ei_child;
+
+	/* Update events/<system>/<event> */
+	if (WARN_ON_ONCE(level > 3))
+		return;
+
+	if (update_uid) {
+		ei->attr.mode &= ~EVENTFS_SAVE_UID;
+		ei->attr.uid = uid;
+	}
+
+	if (update_gid) {
+		ei->attr.mode &= ~EVENTFS_SAVE_GID;
+		ei->attr.gid = gid;
+	}
+
+	list_for_each_entry(ei_child, &ei->children, list) {
+		eventfs_set_attrs(ei_child, update_uid, uid, update_gid, gid, level + 1);
+	}
+
+	if (!ei->entry_attrs)
+		return;
+
+	for (int i = 0; i < ei->nr_entries; i++) {
+		if (update_uid) {
+			ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_UID;
+			ei->entry_attrs[i].uid = uid;
+		}
+		if (update_gid) {
+			ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_GID;
+			ei->entry_attrs[i].gid = gid;
+		}
+	}
+
+}
+
+/*
+ * On a remount of tracefs, if UID or GID options are set, then
+ * the mount point inode permissions should be used.
+ * Reset the saved permission flags appropriately.
+ */
+void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid)
+{
+	struct eventfs_inode *ei = ti->private;
+
+	/* Only the events directory does the updates */
+	if (!ei || !ei->is_events || ei->is_freed)
+		return;
+
+	eventfs_set_attrs(ei, update_uid, ti->vfs_inode.i_uid,
+			  update_gid, ti->vfs_inode.i_gid, 0);
+}
+
 /* Return the evenfs_inode of the "events" directory */
 static struct eventfs_inode *eventfs_find_events(struct dentry *dentry)
 {
@@ -280,14 +376,13 @@
 		 * If the ei is being freed, the ownership of the children
 		 * doesn't matter.
 		 */
-		if (ei->is_freed) {
-			ei = NULL;
-			break;
-		}
+		if (ei->is_freed)
+			return NULL;
+
 		// Walk upwards until you find the events inode
 	} while (!ei->is_events);
 
-	update_top_events_attr(ei, dentry->d_sb);
+	update_events_attr(ei, dentry->d_sb);
 
 	return ei;
 }
@@ -391,7 +486,7 @@
 	update_inode_attr(dentry, inode, &ei->attr,
 			  S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO);
 
-	inode->i_op = &eventfs_root_dir_inode_operations;
+	inode->i_op = &eventfs_dir_inode_operations;
 	inode->i_fop = &eventfs_file_operations;
 
 	/* All directories will have the same inode number */
@@ -408,19 +503,43 @@
 	return NULL;
 }
 
+static inline struct eventfs_inode *init_ei(struct eventfs_inode *ei, const char *name)
+{
+	ei->name = kstrdup_const(name, GFP_KERNEL);
+	if (!ei->name)
+		return NULL;
+	kref_init(&ei->kref);
+	return ei;
+}
+
 static inline struct eventfs_inode *alloc_ei(const char *name)
 {
 	struct eventfs_inode *ei = kzalloc(sizeof(*ei), GFP_KERNEL);
+	struct eventfs_inode *result;
 
 	if (!ei)
 		return NULL;
 
-	ei->name = kstrdup_const(name, GFP_KERNEL);
-	if (!ei->name) {
+	result = init_ei(ei, name);
+	if (!result)
 		kfree(ei);
+
+	return result;
+}
+
+static inline struct eventfs_inode *alloc_root_ei(const char *name)
+{
+	struct eventfs_root_inode *rei = kzalloc(sizeof(*rei), GFP_KERNEL);
+	struct eventfs_inode *ei;
+
+	if (!rei)
 		return NULL;
-	}
-	kref_init(&ei->kref);
+
+	rei->ei.is_events = 1;
+	ei = init_ei(&rei->ei, name);
+	if (!ei)
+		kfree(rei);
+
 	return ei;
 }
 
@@ -686,8 +805,8 @@
 
 	/* Was the parent freed? */
 	if (list_empty(&ei->list)) {
-		free_ei(ei);
-		ei = NULL;
+		cleanup_ei(ei);
+		ei = ERR_PTR(-EBUSY);
 	}
 	return ei;
 }
@@ -709,6 +828,7 @@
 						int size, void *data)
 {
 	struct dentry *dentry = tracefs_start_creating(name, parent);
+	struct eventfs_root_inode *rei;
 	struct eventfs_inode *ei;
 	struct tracefs_inode *ti;
 	struct inode *inode;
@@ -721,7 +841,7 @@
 	if (IS_ERR(dentry))
 		return ERR_CAST(dentry);
 
-	ei = alloc_ei(name);
+	ei = alloc_root_ei(name);
 	if (!ei)
 		goto fail;
 
@@ -730,39 +850,38 @@
 		goto fail;
 
 	// Note: we have a ref to the dentry from tracefs_start_creating()
-	ei->events_dir = dentry;
+	rei = get_root_inode(ei);
+	rei->events_dir = dentry;
+	rei->parent_inode = d_inode(dentry->d_sb->s_root);
+
 	ei->entries = entries;
 	ei->nr_entries = size;
-	ei->is_events = 1;
 	ei->data = data;
 
 	/* Save the ownership of this directory */
 	uid = d_inode(dentry->d_parent)->i_uid;
 	gid = d_inode(dentry->d_parent)->i_gid;
 
-	/*
-	 * If the events directory is of the top instance, then parent
-	 * is NULL. Set the attr.mode to reflect this and its permissions will
-	 * default to the tracefs root dentry.
-	 */
-	if (!parent)
-		ei->attr.mode = EVENTFS_TOPLEVEL;
-
-	/* This is used as the default ownership of the files and directories */
 	ei->attr.uid = uid;
 	ei->attr.gid = gid;
 
+	/*
+	 * When the "events" directory is created, it takes on the
+	 * permissions of its parent. But can be reset on remount.
+	 */
+	ei->attr.mode |= EVENTFS_SAVE_UID | EVENTFS_SAVE_GID;
+
 	INIT_LIST_HEAD(&ei->children);
 	INIT_LIST_HEAD(&ei->list);
 
 	ti = get_tracefs(inode);
-	ti->flags |= TRACEFS_EVENT_INODE | TRACEFS_EVENT_TOP_INODE;
+	ti->flags |= TRACEFS_EVENT_INODE;
 	ti->private = ei;
 
 	inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
 	inode->i_uid = uid;
 	inode->i_gid = gid;
-	inode->i_op = &eventfs_root_dir_inode_operations;
+	inode->i_op = &eventfs_dir_inode_operations;
 	inode->i_fop = &eventfs_file_operations;
 
 	dentry->d_fsdata = get_ei(ei);
@@ -785,7 +904,7 @@
 	return ei;
 
  fail:
-	free_ei(ei);
+	cleanup_ei(ei);
 	tracefs_failed_creating(dentry);
 	return ERR_PTR(-ENOMEM);
 }
@@ -816,7 +935,7 @@
 	list_for_each_entry(ei_child, &ei->children, list)
 		eventfs_remove_rec(ei_child, level + 1);
 
-	list_del(&ei->list);
+	list_del_rcu(&ei->list);
 	free_ei(ei);
 }
 
@@ -844,13 +963,15 @@
  */
 void eventfs_remove_events_dir(struct eventfs_inode *ei)
 {
+	struct eventfs_root_inode *rei;
 	struct dentry *dentry;
 
-	dentry = ei->events_dir;
+	rei = get_root_inode(ei);
+	dentry = rei->events_dir;
 	if (!dentry)
 		return;
 
-	ei->events_dir = NULL;
+	rei->events_dir = NULL;
 	eventfs_remove_dir(ei);
 
 	/*
--- linux-qcom-6.8.0.orig/fs/tracefs/inode.c
+++ linux-qcom-6.8.0/fs/tracefs/inode.c
@@ -30,20 +30,44 @@
 static int tracefs_mount_count;
 static bool tracefs_registered;
 
+/*
+ * Keep track of all tracefs_inodes in order to update their
+ * flags if necessary on a remount.
+ */
+static DEFINE_SPINLOCK(tracefs_inode_lock);
+static LIST_HEAD(tracefs_inodes);
+
 static struct inode *tracefs_alloc_inode(struct super_block *sb)
 {
 	struct tracefs_inode *ti;
+	unsigned long flags;
 
-	ti = kmem_cache_alloc(tracefs_inode_cachep, GFP_KERNEL);
+	ti = alloc_inode_sb(sb, tracefs_inode_cachep, GFP_KERNEL);
 	if (!ti)
 		return NULL;
 
+	spin_lock_irqsave(&tracefs_inode_lock, flags);
+	list_add_rcu(&ti->list, &tracefs_inodes);
+	spin_unlock_irqrestore(&tracefs_inode_lock, flags);
+
 	return &ti->vfs_inode;
 }
 
 static void tracefs_free_inode(struct inode *inode)
 {
-	kmem_cache_free(tracefs_inode_cachep, get_tracefs(inode));
+	struct tracefs_inode *ti = get_tracefs(inode);
+
+	kmem_cache_free(tracefs_inode_cachep, ti);
+}
+
+static void tracefs_destroy_inode(struct inode *inode)
+{
+	struct tracefs_inode *ti = get_tracefs(inode);
+	unsigned long flags;
+
+	spin_lock_irqsave(&tracefs_inode_lock, flags);
+	list_del_rcu(&ti->list);
+	spin_unlock_irqrestore(&tracefs_inode_lock, flags);
 }
 
 static ssize_t default_read_file(struct file *file, char __user *buf,
@@ -153,16 +177,39 @@
 {
 	struct tracefs_inode *ti = get_tracefs(inode);
 	struct inode *root_inode = ti->private;
+	kuid_t uid;
+	kgid_t gid;
+
+	uid = root_inode->i_uid;
+	gid = root_inode->i_gid;
+
+	/*
+	 * If the root is not the mount point, then check the root's
+	 * permissions. If it was never set, then default to the
+	 * mount point.
+	 */
+	if (root_inode != d_inode(root_inode->i_sb->s_root)) {
+		struct tracefs_inode *rti;
+
+		rti = get_tracefs(root_inode);
+		root_inode = d_inode(root_inode->i_sb->s_root);
+
+		if (!(rti->flags & TRACEFS_UID_PERM_SET))
+			uid = root_inode->i_uid;
+
+		if (!(rti->flags & TRACEFS_GID_PERM_SET))
+			gid = root_inode->i_gid;
+	}
 
 	/*
 	 * If this inode has never been referenced, then update
 	 * the permissions to the superblock.
 	 */
 	if (!(ti->flags & TRACEFS_UID_PERM_SET))
-		inode->i_uid = root_inode->i_uid;
+		inode->i_uid = uid;
 
 	if (!(ti->flags & TRACEFS_GID_PERM_SET))
-		inode->i_gid = root_inode->i_gid;
+		inode->i_gid = gid;
 }
 
 static int tracefs_permission(struct mnt_idmap *idmap,
@@ -313,6 +360,8 @@
 	struct tracefs_fs_info *fsi = sb->s_fs_info;
 	struct inode *inode = d_inode(sb->s_root);
 	struct tracefs_mount_opts *opts = &fsi->mount_opts;
+	struct tracefs_inode *ti;
+	bool update_uid, update_gid;
 	umode_t tmp_mode;
 
 	/*
@@ -332,6 +381,25 @@
 	if (!remount || opts->opts & BIT(Opt_gid))
 		inode->i_gid = opts->gid;
 
+	if (remount && (opts->opts & BIT(Opt_uid) || opts->opts & BIT(Opt_gid))) {
+
+		update_uid = opts->opts & BIT(Opt_uid);
+		update_gid = opts->opts & BIT(Opt_gid);
+
+		rcu_read_lock();
+		list_for_each_entry_rcu(ti, &tracefs_inodes, list) {
+			if (update_uid)
+				ti->flags &= ~TRACEFS_UID_PERM_SET;
+
+			if (update_gid)
+				ti->flags &= ~TRACEFS_GID_PERM_SET;
+
+			if (ti->flags & TRACEFS_EVENT_INODE)
+				eventfs_remount(ti, update_uid, update_gid);
+		}
+		rcu_read_unlock();
+	}
+
 	return 0;
 }
 
@@ -368,10 +436,27 @@
 	return 0;
 }
 
+static int tracefs_drop_inode(struct inode *inode)
+{
+	struct tracefs_inode *ti = get_tracefs(inode);
+
+	/*
+	 * This inode is being freed and cannot be used for
+	 * eventfs. Clear the flag so that it doesn't call into
+	 * eventfs during the remount flag updates. The eventfs_inode
+	 * gets freed after an RCU cycle, so the content will still
+	 * be safe if the iteration is going on now.
+	 */
+	ti->flags &= ~TRACEFS_EVENT_INODE;
+
+	return 1;
+}
+
 static const struct super_operations tracefs_super_operations = {
 	.alloc_inode    = tracefs_alloc_inode,
 	.free_inode     = tracefs_free_inode,
-	.drop_inode     = generic_delete_inode,
+	.destroy_inode  = tracefs_destroy_inode,
+	.drop_inode     = tracefs_drop_inode,
 	.statfs		= simple_statfs,
 	.remount_fs	= tracefs_remount,
 	.show_options	= tracefs_show_options,
--- linux-qcom-6.8.0.orig/fs/tracefs/internal.h
+++ linux-qcom-6.8.0/fs/tracefs/internal.h
@@ -4,15 +4,15 @@
 
 enum {
 	TRACEFS_EVENT_INODE		= BIT(1),
-	TRACEFS_EVENT_TOP_INODE		= BIT(2),
-	TRACEFS_GID_PERM_SET		= BIT(3),
-	TRACEFS_UID_PERM_SET		= BIT(4),
-	TRACEFS_INSTANCE_INODE		= BIT(5),
+	TRACEFS_GID_PERM_SET		= BIT(2),
+	TRACEFS_UID_PERM_SET		= BIT(3),
+	TRACEFS_INSTANCE_INODE		= BIT(4),
 };
 
 struct tracefs_inode {
 	struct inode            vfs_inode;
 	/* The below gets initialized with memset_after(ti, 0, vfs_inode) */
+	struct list_head	list;
 	unsigned long           flags;
 	void                    *private;
 };
@@ -36,7 +36,6 @@
  * @children:	link list into the child eventfs_inode
  * @entries:	the array of entries representing the files in the directory
  * @name:	the name of the directory to create
- * @events_dir: the dentry of the events directory
  * @entry_attrs: Saved mode and ownership of the @d_children
  * @data:	The private data to pass to the callbacks
  * @attr:	Saved mode and ownership of eventfs_inode itself
@@ -54,7 +53,6 @@
 	struct list_head		children;
 	const struct eventfs_entry	*entries;
 	const char			*name;
-	struct dentry			*events_dir;
 	struct eventfs_attr		*entry_attrs;
 	void				*data;
 	struct eventfs_attr		attr;
@@ -75,6 +73,7 @@
 struct dentry *tracefs_failed_creating(struct dentry *dentry);
 struct inode *tracefs_get_inode(struct super_block *sb);
 
+void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid);
 void eventfs_d_release(struct dentry *dentry);
 
 #endif /* _TRACEFS_INTERNAL_H */
--- linux-qcom-6.8.0.orig/fs/ubifs/file.c
+++ linux-qcom-6.8.0/fs/ubifs/file.c
@@ -261,9 +261,6 @@
 				return err;
 			}
 		}
-
-		SetPageUptodate(page);
-		ClearPageError(page);
 	}
 
 	if (PagePrivate(page))
@@ -463,9 +460,6 @@
 				return err;
 			}
 		}
-
-		SetPageUptodate(page);
-		ClearPageError(page);
 	}
 
 	err = allocate_budget(c, page, ui, appending);
@@ -475,10 +469,8 @@
 		 * If we skipped reading the page because we were going to
 		 * write all of it, then it is not up to date.
 		 */
-		if (skipped_read) {
+		if (skipped_read)
 			ClearPageChecked(page);
-			ClearPageUptodate(page);
-		}
 		/*
 		 * Budgeting failed which means it would have to force
 		 * write-back but didn't, because we set the @fast flag in the
@@ -569,6 +561,9 @@
 		goto out;
 	}
 
+	if (len == PAGE_SIZE)
+		SetPageUptodate(page);
+
 	if (!PagePrivate(page)) {
 		attach_page_private(page, (void *)1);
 		atomic_long_inc(&c->dirty_pg_cnt);
--- linux-qcom-6.8.0.orig/fs/ubifs/super.c
+++ linux-qcom-6.8.0/fs/ubifs/super.c
@@ -773,10 +773,10 @@
 	 * necessary to report something for the 'statfs()' call.
 	 *
 	 * Subtract the LEB reserved for GC, the LEB which is reserved for
-	 * deletions, minimum LEBs for the index, and assume only one journal
-	 * head is available.
+	 * deletions, minimum LEBs for the index, the LEBs which are reserved
+	 * for each journal head.
 	 */
-	tmp64 = c->main_lebs - 1 - 1 - MIN_INDEX_LEBS - c->jhead_cnt + 1;
+	tmp64 = c->main_lebs - 1 - 1 - MIN_INDEX_LEBS - c->jhead_cnt;
 	tmp64 *= (long long)c->leb_size - c->leb_overhead;
 	tmp64 = ubifs_reported_space(c, tmp64);
 	c->block_cnt = tmp64 >> UBIFS_BLOCK_SHIFT;
--- linux-qcom-6.8.0.orig/fs/ubifs/tnc_commit.c
+++ linux-qcom-6.8.0/fs/ubifs/tnc_commit.c
@@ -657,6 +657,8 @@
 		znode->alt = 0;
 		cnext = find_next_dirty(znode);
 		if (!cnext) {
+			ubifs_assert(c, !znode->parent);
+			znode->cparent = NULL;
 			znode->cnext = c->cnext;
 			break;
 		}
--- linux-qcom-6.8.0.orig/fs/udf/balloc.c
+++ linux-qcom-6.8.0/fs/udf/balloc.c
@@ -18,6 +18,7 @@
 #include "udfdecl.h"
 
 #include <linux/bitops.h>
+#include <linux/overflow.h>
 
 #include "udf_i.h"
 #include "udf_sb.h"
@@ -64,8 +65,12 @@
 	}
 
 	for (i = 0; i < count; i++)
-		if (udf_test_bit(i + off, bh->b_data))
+		if (udf_test_bit(i + off, bh->b_data)) {
+			bitmap->s_block_bitmap[bitmap_nr] =
+							ERR_PTR(-EFSCORRUPTED);
+			brelse(bh);
 			return -EFSCORRUPTED;
+		}
 	return 0;
 }
 
@@ -81,8 +86,15 @@
 			  block_group, nr_groups);
 	}
 
-	if (bitmap->s_block_bitmap[block_group])
+	if (bitmap->s_block_bitmap[block_group]) {
+		/*
+		 * The bitmap failed verification in the past. No point in
+		 * trying again.
+		 */
+		if (IS_ERR(bitmap->s_block_bitmap[block_group]))
+			return PTR_ERR(bitmap->s_block_bitmap[block_group]);
 		return block_group;
+	}
 
 	retval = read_block_bitmap(sb, bitmap, block_group, block_group);
 	if (retval < 0)
@@ -129,7 +141,6 @@
 {
 	struct udf_sb_info *sbi = UDF_SB(sb);
 	struct buffer_head *bh = NULL;
-	struct udf_part_map *partmap;
 	unsigned long block;
 	unsigned long block_group;
 	unsigned long bit;
@@ -138,19 +149,9 @@
 	unsigned long overflow;
 
 	mutex_lock(&sbi->s_alloc_mutex);
-	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-	if (bloc->logicalBlockNum + count < count ||
-	    (bloc->logicalBlockNum + count) > partmap->s_partition_len) {
-		udf_debug("%u < %d || %u + %u > %u\n",
-			  bloc->logicalBlockNum, 0,
-			  bloc->logicalBlockNum, count,
-			  partmap->s_partition_len);
-		goto error_return;
-	}
-
+	/* We make sure this cannot overflow when mounting the filesystem */
 	block = bloc->logicalBlockNum + offset +
 		(sizeof(struct spaceBitmapDesc) << 3);
-
 	do {
 		overflow = 0;
 		block_group = block >> (sb->s_blocksize_bits + 3);
@@ -380,25 +381,15 @@
 				  uint32_t count)
 {
 	struct udf_sb_info *sbi = UDF_SB(sb);
-	struct udf_part_map *partmap;
 	uint32_t start, end;
 	uint32_t elen;
 	struct kernel_lb_addr eloc;
 	struct extent_position oepos, epos;
 	int8_t etype;
 	struct udf_inode_info *iinfo;
+	int ret = 0;
 
 	mutex_lock(&sbi->s_alloc_mutex);
-	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-	if (bloc->logicalBlockNum + count < count ||
-	    (bloc->logicalBlockNum + count) > partmap->s_partition_len) {
-		udf_debug("%u < %d || %u + %u > %u\n",
-			  bloc->logicalBlockNum, 0,
-			  bloc->logicalBlockNum, count,
-			  partmap->s_partition_len);
-		goto error_return;
-	}
-
 	iinfo = UDF_I(table);
 	udf_add_free_space(sb, sbi->s_partition, count);
 
@@ -410,8 +401,12 @@
 	epos.block = oepos.block = iinfo->i_location;
 	epos.bh = oepos.bh = NULL;
 
-	while (count &&
-	       (etype = udf_next_aext(table, &epos, &eloc, &elen, 1)) != -1) {
+	while (count) {
+		ret = udf_next_aext(table, &epos, &eloc, &elen, &etype, 1);
+		if (ret < 0)
+			goto error_return;
+		if (ret == 0)
+			break;
 		if (((eloc.logicalBlockNum +
 			(elen >> sb->s_blocksize_bits)) == start)) {
 			if ((0x3FFFFFFF - elen) <
@@ -486,11 +481,8 @@
 			adsize = sizeof(struct short_ad);
 		else if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_LONG)
 			adsize = sizeof(struct long_ad);
-		else {
-			brelse(oepos.bh);
-			brelse(epos.bh);
+		else
 			goto error_return;
-		}
 
 		if (epos.offset + (2 * adsize) > sb->s_blocksize) {
 			/* Steal a block from the extent being free'd */
@@ -506,10 +498,10 @@
 			__udf_add_aext(table, &epos, &eloc, elen, 1);
 	}
 
+error_return:
 	brelse(epos.bh);
 	brelse(oepos.bh);
 
-error_return:
 	mutex_unlock(&sbi->s_alloc_mutex);
 	return;
 }
@@ -525,6 +517,7 @@
 	struct extent_position epos;
 	int8_t etype = -1;
 	struct udf_inode_info *iinfo;
+	int ret = 0;
 
 	if (first_block >= sbi->s_partmaps[partition].s_partition_len)
 		return 0;
@@ -543,11 +536,14 @@
 	epos.bh = NULL;
 	eloc.logicalBlockNum = 0xFFFFFFFF;
 
-	while (first_block != eloc.logicalBlockNum &&
-	       (etype = udf_next_aext(table, &epos, &eloc, &elen, 1)) != -1) {
+	while (first_block != eloc.logicalBlockNum) {
+		ret = udf_next_aext(table, &epos, &eloc, &elen, &etype, 1);
+		if (ret < 0)
+			goto err_out;
+		if (ret == 0)
+			break;
 		udf_debug("eloc=%u, elen=%u, first_block=%u\n",
 			  eloc.logicalBlockNum, elen, first_block);
-		; /* empty loop body */
 	}
 
 	if (first_block == eloc.logicalBlockNum) {
@@ -566,6 +562,7 @@
 		alloc_count = 0;
 	}
 
+err_out:
 	brelse(epos.bh);
 
 	if (alloc_count)
@@ -587,6 +584,7 @@
 	struct extent_position epos, goal_epos;
 	int8_t etype;
 	struct udf_inode_info *iinfo = UDF_I(table);
+	int ret = 0;
 
 	*err = -ENOSPC;
 
@@ -610,8 +608,10 @@
 	epos.block = iinfo->i_location;
 	epos.bh = goal_epos.bh = NULL;
 
-	while (spread &&
-	       (etype = udf_next_aext(table, &epos, &eloc, &elen, 1)) != -1) {
+	while (spread) {
+		ret = udf_next_aext(table, &epos, &eloc, &elen, &etype, 1);
+		if (ret <= 0)
+			break;
 		if (goal >= eloc.logicalBlockNum) {
 			if (goal < eloc.logicalBlockNum +
 					(elen >> sb->s_blocksize_bits))
@@ -639,9 +639,11 @@
 
 	brelse(epos.bh);
 
-	if (spread == 0xFFFFFFFF) {
+	if (ret < 0 || spread == 0xFFFFFFFF) {
 		brelse(goal_epos.bh);
 		mutex_unlock(&sbi->s_alloc_mutex);
+		if (ret < 0)
+			*err = ret;
 		return 0;
 	}
 
@@ -673,6 +675,17 @@
 {
 	uint16_t partition = bloc->partitionReferenceNum;
 	struct udf_part_map *map = &UDF_SB(sb)->s_partmaps[partition];
+	uint32_t blk;
+
+	if (check_add_overflow(bloc->logicalBlockNum, offset, &blk) ||
+	    check_add_overflow(blk, count, &blk) ||
+	    bloc->logicalBlockNum + count > map->s_partition_len) {
+		udf_debug("Invalid request to free blocks: (%d, %u), off %u, "
+			  "len %u, partition len %u\n",
+			  partition, bloc->logicalBlockNum, offset, count,
+			  map->s_partition_len);
+		return;
+	}
 
 	if (map->s_partition_flags & UDF_PART_FLAG_UNALLOC_BITMAP) {
 		udf_bitmap_free_blocks(sb, map->s_uspace.s_bitmap,
--- linux-qcom-6.8.0.orig/fs/udf/directory.c
+++ linux-qcom-6.8.0/fs/udf/directory.c
@@ -166,13 +166,19 @@
  */
 static int udf_fiiter_advance_blk(struct udf_fileident_iter *iter)
 {
+	int8_t etype = -1;
+	int err = 0;
+
 	iter->loffset++;
 	if (iter->loffset < DIV_ROUND_UP(iter->elen, 1<<iter->dir->i_blkbits))
 		return 0;
 
 	iter->loffset = 0;
-	if (udf_next_aext(iter->dir, &iter->epos, &iter->eloc, &iter->elen, 1)
-			!= (EXT_RECORDED_ALLOCATED >> 30)) {
+	err = udf_next_aext(iter->dir, &iter->epos, &iter->eloc,
+			    &iter->elen, &etype, 1);
+	if (err < 0)
+		return err;
+	else if (err == 0 || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
 		if (iter->pos == iter->dir->i_size) {
 			iter->elen = 0;
 			return 0;
@@ -240,6 +246,7 @@
 {
 	struct udf_inode_info *iinfo = UDF_I(dir);
 	int err = 0;
+	int8_t etype;
 
 	iter->dir = dir;
 	iter->bh[0] = iter->bh[1] = NULL;
@@ -259,9 +266,9 @@
 		goto out;
 	}
 
-	if (inode_bmap(dir, iter->pos >> dir->i_blkbits, &iter->epos,
-		       &iter->eloc, &iter->elen, &iter->loffset) !=
-	    (EXT_RECORDED_ALLOCATED >> 30)) {
+	err = inode_bmap(dir, iter->pos >> dir->i_blkbits, &iter->epos,
+			 &iter->eloc, &iter->elen, &iter->loffset, &etype);
+	if (err <= 0 || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
 		if (pos == dir->i_size)
 			return 0;
 		udf_err(dir->i_sb,
@@ -457,6 +464,7 @@
 	sector_t block;
 	uint32_t old_elen = iter->elen;
 	int err;
+	int8_t etype;
 
 	if (WARN_ON_ONCE(iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB))
 		return -EINVAL;
@@ -471,8 +479,9 @@
 		udf_fiiter_update_elen(iter, old_elen);
 		return err;
 	}
-	if (inode_bmap(iter->dir, block, &iter->epos, &iter->eloc, &iter->elen,
-		       &iter->loffset) != (EXT_RECORDED_ALLOCATED >> 30)) {
+	err = inode_bmap(iter->dir, block, &iter->epos, &iter->eloc, &iter->elen,
+		   &iter->loffset, &etype);
+	if (err <= 0 || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
 		udf_err(iter->dir->i_sb,
 			"block %llu not allocated in directory (ino %lu)\n",
 			(unsigned long long)block, iter->dir->i_ino);
--- linux-qcom-6.8.0.orig/fs/udf/file.c
+++ linux-qcom-6.8.0/fs/udf/file.c
@@ -232,7 +232,9 @@
 
 	if ((attr->ia_valid & ATTR_SIZE) &&
 	    attr->ia_size != i_size_read(inode)) {
+		filemap_invalidate_lock(inode->i_mapping);
 		error = udf_setsize(inode, attr->ia_size);
+		filemap_invalidate_unlock(inode->i_mapping);
 		if (error)
 			return error;
 	}
--- linux-qcom-6.8.0.orig/fs/udf/inode.c
+++ linux-qcom-6.8.0/fs/udf/inode.c
@@ -341,7 +341,7 @@
  */
 int udf_expand_file_adinicb(struct inode *inode)
 {
-	struct page *page;
+	struct folio *folio;
 	struct udf_inode_info *iinfo = UDF_I(inode);
 	int err;
 
@@ -357,12 +357,13 @@
 		return 0;
 	}
 
-	page = find_or_create_page(inode->i_mapping, 0, GFP_NOFS);
-	if (!page)
-		return -ENOMEM;
+	folio = __filemap_get_folio(inode->i_mapping, 0,
+			FGP_LOCK | FGP_ACCESSED | FGP_CREAT, GFP_KERNEL);
+	if (IS_ERR(folio))
+		return PTR_ERR(folio);
 
-	if (!PageUptodate(page))
-		udf_adinicb_readpage(page);
+	if (!folio_test_uptodate(folio))
+		udf_adinicb_readpage(&folio->page);
 	down_write(&iinfo->i_data_sem);
 	memset(iinfo->i_data + iinfo->i_lenEAttr, 0x00,
 	       iinfo->i_lenAlloc);
@@ -371,22 +372,22 @@
 		iinfo->i_alloc_type = ICBTAG_FLAG_AD_SHORT;
 	else
 		iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
-	set_page_dirty(page);
-	unlock_page(page);
+	folio_mark_dirty(folio);
+	folio_unlock(folio);
 	up_write(&iinfo->i_data_sem);
 	err = filemap_fdatawrite(inode->i_mapping);
 	if (err) {
 		/* Restore everything back so that we don't lose data... */
-		lock_page(page);
+		folio_lock(folio);
 		down_write(&iinfo->i_data_sem);
-		memcpy_to_page(page, 0, iinfo->i_data + iinfo->i_lenEAttr,
-			       inode->i_size);
-		unlock_page(page);
+		memcpy_from_folio(iinfo->i_data + iinfo->i_lenEAttr,
+				folio, 0, inode->i_size);
+		folio_unlock(folio);
 		iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
 		iinfo->i_lenAlloc = inode->i_size;
 		up_write(&iinfo->i_data_sem);
 	}
-	put_page(page);
+	folio_put(folio);
 	mark_inode_dirty(inode);
 
 	return err;
@@ -407,7 +408,7 @@
 
 static int udf_map_block(struct inode *inode, struct udf_map_rq *map)
 {
-	int err;
+	int ret;
 	struct udf_inode_info *iinfo = UDF_I(inode);
 
 	if (WARN_ON_ONCE(iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB))
@@ -419,18 +420,24 @@
 		uint32_t elen;
 		sector_t offset;
 		struct extent_position epos = {};
+		int8_t etype;
 
 		down_read(&iinfo->i_data_sem);
-		if (inode_bmap(inode, map->lblk, &epos, &eloc, &elen, &offset)
-				== (EXT_RECORDED_ALLOCATED >> 30)) {
+		ret = inode_bmap(inode, map->lblk, &epos, &eloc, &elen, &offset,
+				 &etype);
+		if (ret < 0)
+			goto out_read;
+		if (ret > 0 && etype == (EXT_RECORDED_ALLOCATED >> 30)) {
 			map->pblk = udf_get_lb_pblock(inode->i_sb, &eloc,
 							offset);
 			map->oflags |= UDF_BLK_MAPPED;
+			ret = 0;
 		}
+out_read:
 		up_read(&iinfo->i_data_sem);
 		brelse(epos.bh);
 
-		return 0;
+		return ret;
 	}
 
 	down_write(&iinfo->i_data_sem);
@@ -441,9 +448,9 @@
 	if (((loff_t)map->lblk) << inode->i_blkbits >= iinfo->i_lenExtents)
 		udf_discard_prealloc(inode);
 	udf_clear_extent_cache(inode);
-	err = inode_getblk(inode, map);
+	ret = inode_getblk(inode, map);
 	up_write(&iinfo->i_data_sem);
-	return err;
+	return ret;
 }
 
 static int __udf_get_block(struct inode *inode, sector_t block,
@@ -546,6 +553,7 @@
 	} else {
 		struct kernel_lb_addr tmploc;
 		uint32_t tmplen;
+		int8_t tmptype;
 
 		udf_write_aext(inode, last_pos, &last_ext->extLocation,
 				last_ext->extLength, 1);
@@ -555,8 +563,12 @@
 		 * more extents, we may need to enter possible following
 		 * empty indirect extent.
 		 */
-		if (new_block_bytes)
-			udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
+		if (new_block_bytes) {
+			err = udf_next_aext(inode, last_pos, &tmploc, &tmplen,
+					    &tmptype, 0);
+			if (err < 0)
+				goto out_err;
+		}
 	}
 	iinfo->i_lenExtents += add;
 
@@ -660,8 +672,10 @@
 	 */
 	udf_discard_prealloc(inode);
 
-	etype = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset);
-	within_last_ext = (etype != -1);
+	err = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset, &etype);
+	if (err < 0)
+		goto out;
+	within_last_ext = (err == 1);
 	/* We don't expect extents past EOF... */
 	WARN_ON_ONCE(within_last_ext &&
 		     elen > ((loff_t)offset + 1) << inode->i_blkbits);
@@ -675,8 +689,10 @@
 		extent.extLength = EXT_NOT_RECORDED_NOT_ALLOCATED;
 	} else {
 		epos.offset -= adsize;
-		etype = udf_next_aext(inode, &epos, &extent.extLocation,
-				      &extent.extLength, 0);
+		err = udf_next_aext(inode, &epos, &extent.extLocation,
+				    &extent.extLength, &etype, 0);
+		if (err <= 0)
+			goto out;
 		extent.extLength |= etype << 30;
 	}
 
@@ -713,11 +729,11 @@
 	loff_t lbcount = 0, b_off = 0;
 	udf_pblk_t newblocknum;
 	sector_t offset = 0;
-	int8_t etype;
+	int8_t etype, tmpetype;
 	struct udf_inode_info *iinfo = UDF_I(inode);
 	udf_pblk_t goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
 	int lastblock = 0;
-	bool isBeyondEOF;
+	bool isBeyondEOF = false;
 	int ret = 0;
 
 	prev_epos.offset = udf_file_entry_alloc_offset(inode);
@@ -749,9 +765,13 @@
 		prev_epos.offset = cur_epos.offset;
 		cur_epos.offset = next_epos.offset;
 
-		etype = udf_next_aext(inode, &next_epos, &eloc, &elen, 1);
-		if (etype == -1)
+		ret = udf_next_aext(inode, &next_epos, &eloc, &elen, &etype, 1);
+		if (ret < 0) {
+			goto out_free;
+		} else if (ret == 0) {
+			isBeyondEOF = true;
 			break;
+		}
 
 		c = !c;
 
@@ -772,13 +792,17 @@
 	 * Move prev_epos and cur_epos into indirect extent if we are at
 	 * the pointer to it
 	 */
-	udf_next_aext(inode, &prev_epos, &tmpeloc, &tmpelen, 0);
-	udf_next_aext(inode, &cur_epos, &tmpeloc, &tmpelen, 0);
+	ret = udf_next_aext(inode, &prev_epos, &tmpeloc, &tmpelen, &tmpetype, 0);
+	if (ret < 0)
+		goto out_free;
+	ret = udf_next_aext(inode, &cur_epos, &tmpeloc, &tmpelen, &tmpetype, 0);
+	if (ret < 0)
+		goto out_free;
 
 	/* if the extent is allocated and recorded, return the block
 	   if the extent is not a multiple of the blocksize, round up */
 
-	if (etype == (EXT_RECORDED_ALLOCATED >> 30)) {
+	if (!isBeyondEOF && etype == (EXT_RECORDED_ALLOCATED >> 30)) {
 		if (elen & (inode->i_sb->s_blocksize - 1)) {
 			elen = EXT_RECORDED_ALLOCATED |
 				((elen + inode->i_sb->s_blocksize - 1) &
@@ -794,10 +818,9 @@
 	}
 
 	/* Are we beyond EOF and preallocated extent? */
-	if (etype == -1) {
+	if (isBeyondEOF) {
 		loff_t hole_len;
 
-		isBeyondEOF = true;
 		if (count) {
 			if (c)
 				laarr[0] = laarr[1];
@@ -833,7 +856,6 @@
 		endnum = c + 1;
 		lastblock = 1;
 	} else {
-		isBeyondEOF = false;
 		endnum = startnum = ((count > 2) ? 2 : count);
 
 		/* if the current extent is in position 0,
@@ -847,15 +869,17 @@
 
 		/* if the current block is located in an extent,
 		   read the next extent */
-		etype = udf_next_aext(inode, &next_epos, &eloc, &elen, 0);
-		if (etype != -1) {
+		ret = udf_next_aext(inode, &next_epos, &eloc, &elen, &etype, 0);
+		if (ret > 0) {
 			laarr[c + 1].extLength = (etype << 30) | elen;
 			laarr[c + 1].extLocation = eloc;
 			count++;
 			startnum++;
 			endnum++;
-		} else
+		} else if (ret == 0)
 			lastblock = 1;
+		else
+			goto out_free;
 	}
 
 	/* if the current extent is not recorded but allocated, get the
@@ -1173,6 +1197,7 @@
 	int start = 0, i;
 	struct kernel_lb_addr tmploc;
 	uint32_t tmplen;
+	int8_t tmpetype;
 	int err;
 
 	if (startnum > endnum) {
@@ -1190,14 +1215,19 @@
 			 */
 			if (err < 0)
 				return err;
-			udf_next_aext(inode, epos, &laarr[i].extLocation,
-				      &laarr[i].extLength, 1);
+			err = udf_next_aext(inode, epos, &laarr[i].extLocation,
+				      &laarr[i].extLength, &tmpetype, 1);
+			if (err < 0)
+				return err;
 			start++;
 		}
 	}
 
 	for (i = start; i < endnum; i++) {
-		udf_next_aext(inode, epos, &tmploc, &tmplen, 0);
+		err = udf_next_aext(inode, epos, &tmploc, &tmplen, &tmpetype, 0);
+		if (err < 0)
+			return err;
+
 		udf_write_aext(inode, epos, &laarr[i].extLocation,
 			       laarr[i].extLength, 1);
 	}
@@ -1251,7 +1281,6 @@
 	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
 		return -EPERM;
 
-	filemap_invalidate_lock(inode->i_mapping);
 	iinfo = UDF_I(inode);
 	if (newsize > inode->i_size) {
 		if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
@@ -1264,11 +1293,11 @@
 			}
 			err = udf_expand_file_adinicb(inode);
 			if (err)
-				goto out_unlock;
+				return err;
 		}
 		err = udf_extend_file(inode, newsize);
 		if (err)
-			goto out_unlock;
+			return err;
 set_size:
 		truncate_setsize(inode, newsize);
 	} else {
@@ -1286,14 +1315,14 @@
 		err = block_truncate_page(inode->i_mapping, newsize,
 					  udf_get_block);
 		if (err)
-			goto out_unlock;
+			return err;
 		truncate_setsize(inode, newsize);
 		down_write(&iinfo->i_data_sem);
 		udf_clear_extent_cache(inode);
 		err = udf_truncate_extents(inode);
 		up_write(&iinfo->i_data_sem);
 		if (err)
-			goto out_unlock;
+			return err;
 	}
 update_time:
 	inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
@@ -1301,8 +1330,6 @@
 		udf_sync_inode(inode);
 	else
 		mark_inode_dirty(inode);
-out_unlock:
-	filemap_invalidate_unlock(inode->i_mapping);
 	return err;
 }
 
@@ -1961,6 +1988,7 @@
 	struct extent_position nepos;
 	struct kernel_lb_addr neloc;
 	int ver, adsize;
+	int err = 0;
 
 	if (UDF_I(inode)->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
 		adsize = sizeof(struct short_ad);
@@ -2005,10 +2033,12 @@
 	if (epos->offset + adsize > sb->s_blocksize) {
 		struct kernel_lb_addr cp_loc;
 		uint32_t cp_len;
-		int cp_type;
+		int8_t cp_type;
 
 		epos->offset -= adsize;
-		cp_type = udf_current_aext(inode, epos, &cp_loc, &cp_len, 0);
+		err = udf_current_aext(inode, epos, &cp_loc, &cp_len, &cp_type, 0);
+		if (err <= 0)
+			goto err_out;
 		cp_len |= ((uint32_t)cp_type) << 30;
 
 		__udf_add_aext(inode, &nepos, &cp_loc, cp_len, 1);
@@ -2023,6 +2053,9 @@
 	*epos = nepos;
 
 	return 0;
+err_out:
+	brelse(bh);
+	return err;
 }
 
 /*
@@ -2168,21 +2201,30 @@
  */
 #define UDF_MAX_INDIR_EXTS 16
 
-int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
-		     struct kernel_lb_addr *eloc, uint32_t *elen, int inc)
+/*
+ * Returns 1 on success, -errno on error, 0 on hit EOF.
+ */
+int udf_next_aext(struct inode *inode, struct extent_position *epos,
+		  struct kernel_lb_addr *eloc, uint32_t *elen, int8_t *etype,
+		  int inc)
 {
-	int8_t etype;
 	unsigned int indirections = 0;
+	int ret = 0;
+	udf_pblk_t block;
 
-	while ((etype = udf_current_aext(inode, epos, eloc, elen, inc)) ==
-	       (EXT_NEXT_EXTENT_ALLOCDESCS >> 30)) {
-		udf_pblk_t block;
+	while (1) {
+		ret = udf_current_aext(inode, epos, eloc, elen,
+				       etype, inc);
+		if (ret <= 0)
+			return ret;
+		if (*etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
+			return ret;
 
 		if (++indirections > UDF_MAX_INDIR_EXTS) {
 			udf_err(inode->i_sb,
 				"too many indirect extents in inode %lu\n",
 				inode->i_ino);
-			return -1;
+			return -EFSCORRUPTED;
 		}
 
 		epos->block = *eloc;
@@ -2192,18 +2234,19 @@
 		epos->bh = sb_bread(inode->i_sb, block);
 		if (!epos->bh) {
 			udf_debug("reading block %u failed!\n", block);
-			return -1;
+			return -EIO;
 		}
 	}
-
-	return etype;
 }
 
-int8_t udf_current_aext(struct inode *inode, struct extent_position *epos,
-			struct kernel_lb_addr *eloc, uint32_t *elen, int inc)
+/*
+ * Returns 1 on success, -errno on error, 0 on hit EOF.
+ */
+int udf_current_aext(struct inode *inode, struct extent_position *epos,
+		     struct kernel_lb_addr *eloc, uint32_t *elen, int8_t *etype,
+		     int inc)
 {
 	int alen;
-	int8_t etype;
 	uint8_t *ptr;
 	struct short_ad *sad;
 	struct long_ad *lad;
@@ -2218,20 +2261,23 @@
 		alen = udf_file_entry_alloc_offset(inode) +
 							iinfo->i_lenAlloc;
 	} else {
+		struct allocExtDesc *header =
+			(struct allocExtDesc *)epos->bh->b_data;
+
 		if (!epos->offset)
 			epos->offset = sizeof(struct allocExtDesc);
 		ptr = epos->bh->b_data + epos->offset;
-		alen = sizeof(struct allocExtDesc) +
-			le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)->
-							lengthAllocDescs);
+		if (check_add_overflow(sizeof(struct allocExtDesc),
+				le32_to_cpu(header->lengthAllocDescs), &alen))
+			return -1;
 	}
 
 	switch (iinfo->i_alloc_type) {
 	case ICBTAG_FLAG_AD_SHORT:
 		sad = udf_get_fileshortad(ptr, alen, &epos->offset, inc);
 		if (!sad)
-			return -1;
-		etype = le32_to_cpu(sad->extLength) >> 30;
+			return 0;
+		*etype = le32_to_cpu(sad->extLength) >> 30;
 		eloc->logicalBlockNum = le32_to_cpu(sad->extPosition);
 		eloc->partitionReferenceNum =
 				iinfo->i_location.partitionReferenceNum;
@@ -2240,17 +2286,17 @@
 	case ICBTAG_FLAG_AD_LONG:
 		lad = udf_get_filelongad(ptr, alen, &epos->offset, inc);
 		if (!lad)
-			return -1;
-		etype = le32_to_cpu(lad->extLength) >> 30;
+			return 0;
+		*etype = le32_to_cpu(lad->extLength) >> 30;
 		*eloc = lelb_to_cpu(lad->extLocation);
 		*elen = le32_to_cpu(lad->extLength) & UDF_EXTENT_LENGTH_MASK;
 		break;
 	default:
 		udf_debug("alloc_type = %u unsupported\n", iinfo->i_alloc_type);
-		return -1;
+		return -EINVAL;
 	}
 
-	return etype;
+	return 1;
 }
 
 static int udf_insert_aext(struct inode *inode, struct extent_position epos,
@@ -2259,20 +2305,24 @@
 	struct kernel_lb_addr oeloc;
 	uint32_t oelen;
 	int8_t etype;
-	int err;
+	int ret;
 
 	if (epos.bh)
 		get_bh(epos.bh);
 
-	while ((etype = udf_next_aext(inode, &epos, &oeloc, &oelen, 0)) != -1) {
+	while (1) {
+		ret = udf_next_aext(inode, &epos, &oeloc, &oelen, &etype, 0);
+		if (ret <= 0)
+			break;
 		udf_write_aext(inode, &epos, &neloc, nelen, 1);
 		neloc = oeloc;
 		nelen = (etype << 30) | oelen;
 	}
-	err = udf_add_aext(inode, &epos, &neloc, nelen, 1);
+	if (ret == 0)
+		ret = udf_add_aext(inode, &epos, &neloc, nelen, 1);
 	brelse(epos.bh);
 
-	return err;
+	return ret;
 }
 
 int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
@@ -2284,6 +2334,7 @@
 	struct udf_inode_info *iinfo;
 	struct kernel_lb_addr eloc;
 	uint32_t elen;
+	int ret;
 
 	if (epos.bh) {
 		get_bh(epos.bh);
@@ -2299,10 +2350,18 @@
 		adsize = 0;
 
 	oepos = epos;
-	if (udf_next_aext(inode, &epos, &eloc, &elen, 1) == -1)
+	if (udf_next_aext(inode, &epos, &eloc, &elen, &etype, 1) <= 0)
 		return -1;
 
-	while ((etype = udf_next_aext(inode, &epos, &eloc, &elen, 1)) != -1) {
+	while (1) {
+		ret = udf_next_aext(inode, &epos, &eloc, &elen, &etype, 1);
+		if (ret < 0) {
+			brelse(epos.bh);
+			brelse(oepos.bh);
+			return -1;
+		}
+		if (ret == 0)
+			break;
 		udf_write_aext(inode, &oepos, &eloc, (etype << 30) | elen, 1);
 		if (oepos.bh != epos.bh) {
 			oepos.block = epos.block;
@@ -2359,14 +2418,17 @@
 	return (elen >> 30);
 }
 
-int8_t inode_bmap(struct inode *inode, sector_t block,
-		  struct extent_position *pos, struct kernel_lb_addr *eloc,
-		  uint32_t *elen, sector_t *offset)
+/*
+ * Returns 1 on success, -errno on error, 0 on hit EOF.
+ */
+int inode_bmap(struct inode *inode, sector_t block, struct extent_position *pos,
+	       struct kernel_lb_addr *eloc, uint32_t *elen, sector_t *offset,
+	       int8_t *etype)
 {
 	unsigned char blocksize_bits = inode->i_sb->s_blocksize_bits;
 	loff_t lbcount = 0, bcount = (loff_t) block << blocksize_bits;
-	int8_t etype;
 	struct udf_inode_info *iinfo;
+	int err = 0;
 
 	iinfo = UDF_I(inode);
 	if (!udf_read_extent_cache(inode, bcount, &lbcount, pos)) {
@@ -2376,11 +2438,13 @@
 	}
 	*elen = 0;
 	do {
-		etype = udf_next_aext(inode, pos, eloc, elen, 1);
-		if (etype == -1) {
-			*offset = (bcount - lbcount) >> blocksize_bits;
-			iinfo->i_lenExtents = lbcount;
-			return -1;
+		err = udf_next_aext(inode, pos, eloc, elen, etype, 1);
+		if (err <= 0) {
+			if (err == 0) {
+				*offset = (bcount - lbcount) >> blocksize_bits;
+				iinfo->i_lenExtents = lbcount;
+			}
+			return err;
 		}
 		lbcount += *elen;
 	} while (lbcount <= bcount);
@@ -2388,5 +2452,5 @@
 	udf_update_extent_cache(inode, lbcount - *elen, pos);
 	*offset = (bcount + *elen - lbcount) >> blocksize_bits;
 
-	return etype;
+	return 1;
 }
--- linux-qcom-6.8.0.orig/fs/udf/namei.c
+++ linux-qcom-6.8.0/fs/udf/namei.c
@@ -517,7 +517,11 @@
 			 inode->i_nlink);
 	clear_nlink(inode);
 	inode->i_size = 0;
-	inode_dec_link_count(dir);
+	if (dir->i_nlink >= 3)
+		inode_dec_link_count(dir);
+	else
+		udf_warn(inode->i_sb, "parent dir link count too low (%u)\n",
+			 dir->i_nlink);
 	udf_add_fid_counter(dir->i_sb, true, -1);
 	inode_set_mtime_to_ts(dir,
 			      inode_set_ctime_to_ts(dir, inode_set_ctime_current(inode)));
@@ -784,8 +788,18 @@
 			retval = -ENOTEMPTY;
 			if (!empty_dir(new_inode))
 				goto out_oiter;
+			retval = -EFSCORRUPTED;
+			if (new_inode->i_nlink != 2)
+				goto out_oiter;
 		}
+		retval = -EFSCORRUPTED;
+		if (old_dir->i_nlink < 3)
+			goto out_oiter;
 		is_dir = true;
+	} else if (new_inode) {
+		retval = -EFSCORRUPTED;
+		if (new_inode->i_nlink < 1)
+			goto out_oiter;
 	}
 	if (is_dir && old_dir != new_dir) {
 		retval = udf_fiiter_find_entry(old_inode, &dotdot_name,
@@ -873,8 +887,6 @@
 	if (has_diriter) {
 		diriter.fi.icb.extLocation =
 					cpu_to_lelb(UDF_I(new_dir)->i_location);
-		udf_update_tag((char *)&diriter.fi,
-			       udf_dir_entry_len(&diriter.fi));
 		udf_fiiter_write_fi(&diriter, NULL);
 		udf_fiiter_release(&diriter);
 	}
--- linux-qcom-6.8.0.orig/fs/udf/partition.c
+++ linux-qcom-6.8.0/fs/udf/partition.c
@@ -282,9 +282,11 @@
 	sector_t ext_offset;
 	struct extent_position epos = {};
 	uint32_t phyblock;
+	int8_t etype;
+	int err = 0;
 
-	if (inode_bmap(inode, block, &epos, &eloc, &elen, &ext_offset) !=
-						(EXT_RECORDED_ALLOCATED >> 30))
+	err = inode_bmap(inode, block, &epos, &eloc, &elen, &ext_offset, &etype);
+	if (err <= 0 || etype != (EXT_RECORDED_ALLOCATED >> 30))
 		phyblock = 0xFFFFFFFF;
 	else {
 		map = &UDF_SB(sb)->s_partmaps[partition];
--- linux-qcom-6.8.0.orig/fs/udf/super.c
+++ linux-qcom-6.8.0/fs/udf/super.c
@@ -269,7 +269,8 @@
 	int nr_groups = bitmap->s_nr_groups;
 
 	for (i = 0; i < nr_groups; i++)
-		brelse(bitmap->s_block_bitmap[i]);
+		if (!IS_ERR_OR_NULL(bitmap->s_block_bitmap[i]))
+			brelse(bitmap->s_block_bitmap[i]);
 
 	kvfree(bitmap);
 }
@@ -1079,12 +1080,19 @@
 	struct udf_part_map *map;
 	struct udf_sb_info *sbi = UDF_SB(sb);
 	struct partitionHeaderDesc *phd;
+	u32 sum;
 	int err;
 
 	map = &sbi->s_partmaps[p_index];
 
 	map->s_partition_len = le32_to_cpu(p->partitionLength); /* blocks */
 	map->s_partition_root = le32_to_cpu(p->partitionStartingLocation);
+	if (check_add_overflow(map->s_partition_root, map->s_partition_len,
+			       &sum)) {
+		udf_err(sb, "Partition %d has invalid location %u + %u\n",
+			p_index, map->s_partition_root, map->s_partition_len);
+		return -EFSCORRUPTED;
+	}
 
 	if (p->accessType == cpu_to_le32(PD_ACCESS_TYPE_READ_ONLY))
 		map->s_partition_flags |= UDF_PART_FLAG_READ_ONLY;
@@ -1140,6 +1148,14 @@
 		bitmap->s_extPosition = le32_to_cpu(
 				phd->unallocSpaceBitmap.extPosition);
 		map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_BITMAP;
+		/* Check whether math over bitmap won't overflow. */
+		if (check_add_overflow(map->s_partition_len,
+				       sizeof(struct spaceBitmapDesc) << 3,
+				       &sum)) {
+			udf_err(sb, "Partition %d is too long (%u)\n", p_index,
+				map->s_partition_len);
+			return -EFSCORRUPTED;
+		}
 		udf_debug("unallocSpaceBitmap (part %d) @ %u\n",
 			  p_index, bitmap->s_extPosition);
 	}
@@ -2438,13 +2454,14 @@
 	uint32_t elen;
 	struct kernel_lb_addr eloc;
 	struct extent_position epos;
+	int8_t etype;
 
 	mutex_lock(&UDF_SB(sb)->s_alloc_mutex);
 	epos.block = UDF_I(table)->i_location;
 	epos.offset = sizeof(struct unallocSpaceEntry);
 	epos.bh = NULL;
 
-	while (udf_next_aext(table, &epos, &eloc, &elen, 1) != -1)
+	while (udf_next_aext(table, &epos, &eloc, &elen, &etype, 1) > 0)
 		accum += (elen >> table->i_sb->s_blocksize_bits);
 
 	brelse(epos.bh);
--- linux-qcom-6.8.0.orig/fs/udf/truncate.c
+++ linux-qcom-6.8.0/fs/udf/truncate.c
@@ -69,6 +69,7 @@
 	int8_t etype = -1, netype;
 	int adsize;
 	struct udf_inode_info *iinfo = UDF_I(inode);
+	int ret;
 
 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ||
 	    inode->i_size == iinfo->i_lenExtents)
@@ -85,7 +86,10 @@
 		BUG();
 
 	/* Find the last extent in the file */
-	while ((netype = udf_next_aext(inode, &epos, &eloc, &elen, 1)) != -1) {
+	while (1) {
+		ret = udf_next_aext(inode, &epos, &eloc, &elen, &netype, 1);
+		if (ret <= 0)
+			break;
 		etype = netype;
 		lbcount += elen;
 		if (lbcount > inode->i_size) {
@@ -101,7 +105,8 @@
 			epos.offset -= adsize;
 			extent_trunc(inode, &epos, &eloc, etype, elen, nelen);
 			epos.offset += adsize;
-			if (udf_next_aext(inode, &epos, &eloc, &elen, 1) != -1)
+			if (udf_next_aext(inode, &epos, &eloc, &elen,
+					  &netype, 1) > 0)
 				udf_err(inode->i_sb,
 					"Extent after EOF in inode %u\n",
 					(unsigned)inode->i_ino);
@@ -110,7 +115,8 @@
 	}
 	/* This inode entry is in-memory only and thus we don't have to mark
 	 * the inode dirty */
-	iinfo->i_lenExtents = inode->i_size;
+	if (ret == 0)
+		iinfo->i_lenExtents = inode->i_size;
 	brelse(epos.bh);
 }
 
@@ -124,6 +130,8 @@
 	int8_t etype = -1;
 	struct udf_inode_info *iinfo = UDF_I(inode);
 	int bsize = i_blocksize(inode);
+	int8_t tmpetype = -1;
+	int ret;
 
 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ||
 	    ALIGN(inode->i_size, bsize) == ALIGN(iinfo->i_lenExtents, bsize))
@@ -132,15 +140,23 @@
 	epos.block = iinfo->i_location;
 
 	/* Find the last extent in the file */
-	while (udf_next_aext(inode, &epos, &eloc, &elen, 0) != -1) {
+	while (1) {
+		ret = udf_next_aext(inode, &epos, &eloc, &elen, &tmpetype, 0);
+		if (ret < 0)
+			goto out;
+		if (ret == 0)
+			break;
 		brelse(prev_epos.bh);
 		prev_epos = epos;
 		if (prev_epos.bh)
 			get_bh(prev_epos.bh);
 
-		etype = udf_next_aext(inode, &epos, &eloc, &elen, 1);
+		ret = udf_next_aext(inode, &epos, &eloc, &elen, &etype, 1);
+		if (ret < 0)
+			goto out;
 		lbcount += elen;
 	}
+
 	if (etype == (EXT_NOT_RECORDED_ALLOCATED >> 30)) {
 		lbcount -= elen;
 		udf_delete_aext(inode, prev_epos);
@@ -150,6 +166,7 @@
 	/* This inode entry is in-memory only and thus we don't have to mark
 	 * the inode dirty */
 	iinfo->i_lenExtents = lbcount;
+out:
 	brelse(epos.bh);
 	brelse(prev_epos.bh);
 }
@@ -188,6 +205,7 @@
 	loff_t byte_offset;
 	int adsize;
 	struct udf_inode_info *iinfo = UDF_I(inode);
+	int ret = 0;
 
 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
 		adsize = sizeof(struct short_ad);
@@ -196,10 +214,12 @@
 	else
 		BUG();
 
-	etype = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset);
+	ret = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset, &etype);
+	if (ret < 0)
+		return ret;
 	byte_offset = (offset << sb->s_blocksize_bits) +
 		(inode->i_size & (sb->s_blocksize - 1));
-	if (etype == -1) {
+	if (ret == 0) {
 		/* We should extend the file? */
 		WARN_ON(byte_offset);
 		return 0;
@@ -217,8 +237,8 @@
 	else
 		lenalloc -= sizeof(struct allocExtDesc);
 
-	while ((etype = udf_current_aext(inode, &epos, &eloc,
-					 &elen, 0)) != -1) {
+	while ((ret = udf_current_aext(inode, &epos, &eloc,
+				       &elen, &etype, 0)) > 0) {
 		if (etype == (EXT_NEXT_EXTENT_ALLOCDESCS >> 30)) {
 			udf_write_aext(inode, &epos, &neloc, nelen, 0);
 			if (indirect_ext_len) {
@@ -253,6 +273,11 @@
 		}
 	}
 
+	if (ret < 0) {
+		brelse(epos.bh);
+		return ret;
+	}
+
 	if (indirect_ext_len) {
 		BUG_ON(!epos.bh);
 		udf_free_blocks(sb, NULL, &epos.block, 0, indirect_ext_len);
--- linux-qcom-6.8.0.orig/fs/udf/udfdecl.h
+++ linux-qcom-6.8.0/fs/udf/udfdecl.h
@@ -157,8 +157,9 @@
 extern int udf_setsize(struct inode *, loff_t);
 extern void udf_evict_inode(struct inode *);
 extern int udf_write_inode(struct inode *, struct writeback_control *wbc);
-extern int8_t inode_bmap(struct inode *, sector_t, struct extent_position *,
-			 struct kernel_lb_addr *, uint32_t *, sector_t *);
+extern int inode_bmap(struct inode *inode, sector_t block,
+		      struct extent_position *pos, struct kernel_lb_addr *eloc,
+		      uint32_t *elen, sector_t *offset, int8_t *etype);
 int udf_get_block(struct inode *, sector_t, struct buffer_head *, int);
 extern int udf_setup_indirect_aext(struct inode *inode, udf_pblk_t block,
 				   struct extent_position *epos);
@@ -169,10 +170,12 @@
 extern void udf_write_aext(struct inode *, struct extent_position *,
 			   struct kernel_lb_addr *, uint32_t, int);
 extern int8_t udf_delete_aext(struct inode *, struct extent_position);
-extern int8_t udf_next_aext(struct inode *, struct extent_position *,
-			    struct kernel_lb_addr *, uint32_t *, int);
-extern int8_t udf_current_aext(struct inode *, struct extent_position *,
-			       struct kernel_lb_addr *, uint32_t *, int);
+extern int udf_next_aext(struct inode *inode, struct extent_position *epos,
+			 struct kernel_lb_addr *eloc, uint32_t *elen,
+			 int8_t *etype, int inc);
+extern int udf_current_aext(struct inode *inode, struct extent_position *epos,
+			    struct kernel_lb_addr *eloc, uint32_t *elen,
+			    int8_t *etype, int inc);
 extern void udf_update_extra_perms(struct inode *inode, umode_t mode);
 
 /* misc.c */
--- linux-qcom-6.8.0.orig/fs/udf/udftime.c
+++ linux-qcom-6.8.0/fs/udf/udftime.c
@@ -46,13 +46,18 @@
 	dest->tv_sec = mktime64(year, src.month, src.day, src.hour, src.minute,
 			src.second);
 	dest->tv_sec -= offset * 60;
-	dest->tv_nsec = 1000 * (src.centiseconds * 10000 +
-			src.hundredsOfMicroseconds * 100 + src.microseconds);
+
 	/*
 	 * Sanitize nanosecond field since reportedly some filesystems are
 	 * recorded with bogus sub-second values.
 	 */
-	dest->tv_nsec %= NSEC_PER_SEC;
+	if (src.centiseconds < 100 && src.hundredsOfMicroseconds < 100 &&
+	    src.microseconds < 100) {
+		dest->tv_nsec = 1000 * (src.centiseconds * 10000 +
+			src.hundredsOfMicroseconds * 100 + src.microseconds);
+	} else {
+		dest->tv_nsec = 0;
+	}
 }
 
 void
--- linux-qcom-6.8.0.orig/fs/ufs/super.c
+++ linux-qcom-6.8.0/fs/ufs/super.c
@@ -1240,11 +1240,7 @@
 	else
 		uspi->s_apbshift = uspi->s_bshift - 2;
 
-	uspi->s_2apbshift = uspi->s_apbshift * 2;
-	uspi->s_3apbshift = uspi->s_apbshift * 3;
 	uspi->s_apb = 1 << uspi->s_apbshift;
-	uspi->s_2apb = 1 << uspi->s_2apbshift;
-	uspi->s_3apb = 1 << uspi->s_3apbshift;
 	uspi->s_apbmask = uspi->s_apb - 1;
 	uspi->s_nspfshift = uspi->s_fshift - UFS_SECTOR_BITS;
 	uspi->s_nspb = uspi->s_nspf << uspi->s_fpbshift;
--- linux-qcom-6.8.0.orig/fs/ufs/ufs_fs.h
+++ linux-qcom-6.8.0/fs/ufs/ufs_fs.h
@@ -775,12 +775,8 @@
 
 	__u32	s_fpbmask;	/* fragments per block mask */
 	__u32	s_apb;		/* address per block */
-	__u32	s_2apb;		/* address per block^2 */
-	__u32	s_3apb;		/* address per block^3 */
 	__u32	s_apbmask;	/* address per block mask */
 	__u32	s_apbshift;	/* address per block shift */
-	__u32	s_2apbshift;	/* address per block shift * 2 */
-	__u32	s_3apbshift;	/* address per block shift * 3 */
 	__u32	s_nspfshift;	/* number of sector per fragment shift */
 	__u32	s_nspb;		/* number of sector per block */
 	__u32	s_inopf;	/* inodes per fragment */
--- linux-qcom-6.8.0.orig/fs/unicode/utf8-core.c
+++ linux-qcom-6.8.0/fs/unicode/utf8-core.c
@@ -198,7 +198,7 @@
 	return um;
 
 out_symbol_put:
-	symbol_put(um->tables);
+	symbol_put(utf8_data_table);
 out_free_um:
 	kfree(um);
 	return ERR_PTR(-EINVAL);
--- linux-qcom-6.8.0.orig/fs/userfaultfd.c
+++ linux-qcom-6.8.0/fs/userfaultfd.c
@@ -763,6 +763,34 @@
 	}
 }
 
+void dup_userfaultfd_fail(struct list_head *fcs)
+{
+	struct userfaultfd_fork_ctx *fctx, *n;
+
+	/*
+	 * An error has occurred on fork, we will tear memory down, but have
+	 * allocated memory for fctx's and raised reference counts for both the
+	 * original and child contexts (and on the mm for each as a result).
+	 *
+	 * These would ordinarily be taken care of by a user handling the event,
+	 * but we are no longer doing so, so manually clean up here.
+	 *
+	 * mm tear down will take care of cleaning up VMA contexts.
+	 */
+	list_for_each_entry_safe(fctx, n, fcs, list) {
+		struct userfaultfd_ctx *octx = fctx->orig;
+		struct userfaultfd_ctx *ctx = fctx->new;
+
+		atomic_dec(&octx->mmap_changing);
+		VM_BUG_ON(atomic_read(&octx->mmap_changing) < 0);
+		userfaultfd_ctx_put(octx);
+		userfaultfd_ctx_put(ctx);
+
+		list_del(&fctx->list);
+		kfree(fctx);
+	}
+}
+
 void mremap_userfaultfd_prep(struct vm_area_struct *vma,
 			     struct vm_userfaultfd_ctx *vm_ctx)
 {
@@ -925,6 +953,10 @@
 			prev = vma;
 			continue;
 		}
+		/* Reset ptes for the whole vma range if wr-protected */
+		if (userfaultfd_wp(vma))
+			uffd_wp_range(vma, vma->vm_start,
+				      vma->vm_end - vma->vm_start, false);
 		new_flags = vma->vm_flags & ~__VM_UFFD_FLAGS;
 		vma = vma_modify_flags_uffd(&vmi, prev, vma, vma->vm_start,
 					    vma->vm_end, new_flags,
@@ -2092,7 +2124,7 @@
 		goto out;
 	features = uffdio_api.features;
 	ret = -EINVAL;
-	if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES))
+	if (uffdio_api.api != UFFD_API)
 		goto err_out;
 	ret = -EPERM;
 	if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE))
@@ -2116,6 +2148,11 @@
 	uffdio_api.features &= ~UFFD_FEATURE_WP_UNPOPULATED;
 	uffdio_api.features &= ~UFFD_FEATURE_WP_ASYNC;
 #endif
+
+	ret = -EINVAL;
+	if (features & ~uffdio_api.features)
+		goto err_out;
+
 	uffdio_api.ioctls = UFFD_API_IOCTLS;
 	ret = -EFAULT;
 	if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
--- linux-qcom-6.8.0.orig/fs/vboxsf/file.c
+++ linux-qcom-6.8.0/fs/vboxsf/file.c
@@ -218,6 +218,7 @@
 	.release = vboxsf_file_release,
 	.fsync = noop_fsync,
 	.splice_read = filemap_splice_read,
+	.setlease = simple_nosetlease,
 };
 
 const struct inode_operations vboxsf_reg_iops = {
--- linux-qcom-6.8.0.orig/fs/vboxsf/super.c
+++ linux-qcom-6.8.0/fs/vboxsf/super.c
@@ -151,7 +151,7 @@
 		if (!sbi->nls) {
 			vbg_err("vboxsf: Count not load '%s' nls\n", nls_name);
 			err = -EINVAL;
-			goto fail_free;
+			goto fail_destroy_idr;
 		}
 	}
 
@@ -224,6 +224,7 @@
 		ida_simple_remove(&vboxsf_bdi_ida, sbi->bdi_id);
 	if (sbi->nls)
 		unload_nls(sbi->nls);
+fail_destroy_idr:
 	idr_destroy(&sbi->ino_idr);
 	kfree(sbi);
 	return err;
--- linux-qcom-6.8.0.orig/fs/verity/init.c
+++ linux-qcom-6.8.0/fs/verity/init.c
@@ -10,8 +10,6 @@
 #include <linux/ratelimit.h>
 
 #ifdef CONFIG_SYSCTL
-static struct ctl_table_header *fsverity_sysctl_header;
-
 static struct ctl_table fsverity_sysctl_table[] = {
 #ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
 	{
@@ -28,10 +26,7 @@
 
 static void __init fsverity_init_sysctl(void)
 {
-	fsverity_sysctl_header = register_sysctl("fs/verity",
-						 fsverity_sysctl_table);
-	if (!fsverity_sysctl_header)
-		panic("fsverity sysctl registration failed");
+	register_sysctl_init("fs/verity", fsverity_sysctl_table);
 }
 #else /* CONFIG_SYSCTL */
 static inline void fsverity_init_sysctl(void)
--- linux-qcom-6.8.0.orig/fs/xattr.c
+++ linux-qcom-6.8.0/fs/xattr.c
@@ -631,10 +631,9 @@
 			ctx->kvalue, ctx->size, ctx->flags);
 }
 
-static long
-setxattr(struct mnt_idmap *idmap, struct dentry *d,
-	const char __user *name, const void __user *value, size_t size,
-	int flags)
+static int path_setxattr(const char __user *pathname,
+			 const char __user *name, const void __user *value,
+			 size_t size, int flags, unsigned int lookup_flags)
 {
 	struct xattr_name kname;
 	struct xattr_ctx ctx = {
@@ -644,33 +643,20 @@
 		.kname    = &kname,
 		.flags    = flags,
 	};
+	struct path path;
 	int error;
 
 	error = setxattr_copy(name, &ctx);
 	if (error)
 		return error;
 
-	error = do_setxattr(idmap, d, &ctx);
-
-	kvfree(ctx.kvalue);
-	return error;
-}
-
-static int path_setxattr(const char __user *pathname,
-			 const char __user *name, const void __user *value,
-			 size_t size, int flags, unsigned int lookup_flags)
-{
-	struct path path;
-	int error;
-
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
-		return error;
+		goto out;
 	error = mnt_want_write(path.mnt);
 	if (!error) {
-		error = setxattr(mnt_idmap(path.mnt), path.dentry, name,
-				 value, size, flags);
+		error = do_setxattr(mnt_idmap(path.mnt), path.dentry, &ctx);
 		mnt_drop_write(path.mnt);
 	}
 	path_put(&path);
@@ -678,6 +664,9 @@
 		lookup_flags |= LOOKUP_REVAL;
 		goto retry;
 	}
+
+out:
+	kvfree(ctx.kvalue);
 	return error;
 }
 
@@ -698,20 +687,32 @@
 SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
 		const void __user *,value, size_t, size, int, flags)
 {
-	struct fd f = fdget(fd);
-	int error = -EBADF;
+	struct xattr_name kname;
+	struct xattr_ctx ctx = {
+		.cvalue   = value,
+		.kvalue   = NULL,
+		.size     = size,
+		.kname    = &kname,
+		.flags    = flags,
+	};
+	int error;
 
+	CLASS(fd, f)(fd);
 	if (!f.file)
-		return error;
+		return -EBADF;
+
 	audit_file(f.file);
+	error = setxattr_copy(name, &ctx);
+	if (error)
+		return error;
+
 	error = mnt_want_write_file(f.file);
 	if (!error) {
-		error = setxattr(file_mnt_idmap(f.file),
-				 f.file->f_path.dentry, name,
-				 value, size, flags);
+		error = do_setxattr(file_mnt_idmap(f.file),
+				    f.file->f_path.dentry, &ctx);
 		mnt_drop_write_file(f.file);
 	}
-	fdput(f);
+	kvfree(ctx.kvalue);
 	return error;
 }
 
@@ -900,9 +901,17 @@
  * Extended attribute REMOVE operations
  */
 static long
-removexattr(struct mnt_idmap *idmap, struct dentry *d,
-	    const char __user *name)
+removexattr(struct mnt_idmap *idmap, struct dentry *d, const char *name)
 {
+	if (is_posix_acl_xattr(name))
+		return vfs_remove_acl(idmap, d, name);
+	return vfs_removexattr(idmap, d, name);
+}
+
+static int path_removexattr(const char __user *pathname,
+			    const char __user *name, unsigned int lookup_flags)
+{
+	struct path path;
 	int error;
 	char kname[XATTR_NAME_MAX + 1];
 
@@ -911,25 +920,13 @@
 		error = -ERANGE;
 	if (error < 0)
 		return error;
-
-	if (is_posix_acl_xattr(kname))
-		return vfs_remove_acl(idmap, d, kname);
-
-	return vfs_removexattr(idmap, d, kname);
-}
-
-static int path_removexattr(const char __user *pathname,
-			    const char __user *name, unsigned int lookup_flags)
-{
-	struct path path;
-	int error;
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
 		return error;
 	error = mnt_want_write(path.mnt);
 	if (!error) {
-		error = removexattr(mnt_idmap(path.mnt), path.dentry, name);
+		error = removexattr(mnt_idmap(path.mnt), path.dentry, kname);
 		mnt_drop_write(path.mnt);
 	}
 	path_put(&path);
@@ -955,15 +952,23 @@
 SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
 {
 	struct fd f = fdget(fd);
+	char kname[XATTR_NAME_MAX + 1];
 	int error = -EBADF;
 
 	if (!f.file)
 		return error;
 	audit_file(f.file);
+
+	error = strncpy_from_user(kname, name, sizeof(kname));
+	if (error == 0 || error == sizeof(kname))
+		error = -ERANGE;
+	if (error < 0)
+		return error;
+
 	error = mnt_want_write_file(f.file);
 	if (!error) {
 		error = removexattr(file_mnt_idmap(f.file),
-				    f.file->f_path.dentry, name);
+				    f.file->f_path.dentry, kname);
 		mnt_drop_write_file(f.file);
 	}
 	fdput(f);
--- linux-qcom-6.8.0.orig/fs/xfs/Kconfig
+++ linux-qcom-6.8.0/fs/xfs/Kconfig
@@ -204,6 +204,18 @@
 
 	  Say N unless you are an XFS developer, or you play one on TV.
 
+config XFS_DEBUG_EXPENSIVE
+	bool "XFS expensive debugging checks"
+	depends on XFS_FS && XFS_DEBUG
+	help
+	  Say Y here to get an XFS build with expensive debugging checks
+	  enabled.  These checks may affect performance significantly.
+
+	  Note that the resulting code will be HUGER and SLOWER, and probably
+	  not useful unless you are debugging a particular problem.
+
+	  Say N unless you are an XFS developer, or you play one on TV.
+
 config XFS_ASSERT_FATAL
 	bool "XFS fatal asserts"
 	default y
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_ag.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_ag.c
@@ -979,14 +979,23 @@
 
 	if (error) {
 		/*
-		 * if extent allocation fails, need to roll the transaction to
+		 * If extent allocation fails, need to roll the transaction to
 		 * ensure that the AGFL fixup has been committed anyway.
+		 *
+		 * We need to hold the AGF across the roll to ensure nothing can
+		 * access the AG for allocation until the shrink is fully
+		 * cleaned up. And due to the resetting of the AG block
+		 * reservation space needing to lock the AGI, we also have to
+		 * hold that so we don't get AGI/AGF lock order inversions in
+		 * the error handling path.
 		 */
 		xfs_trans_bhold(*tpp, agfbp);
+		xfs_trans_bhold(*tpp, agibp);
 		err2 = xfs_trans_roll(tpp);
 		if (err2)
 			return err2;
 		xfs_trans_bjoin(*tpp, agfbp);
+		xfs_trans_bjoin(*tpp, agibp);
 		goto resv_init_out;
 	}
 
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_attr.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_attr.c
@@ -1510,12 +1510,23 @@
 	return error;
 }
 
+/* Enforce that there is at most one namespace bit per attr. */
+inline bool xfs_attr_check_namespace(unsigned int attr_flags)
+{
+	return hweight32(attr_flags & XFS_ATTR_NSP_ONDISK_MASK) < 2;
+}
+
 /* Returns true if the attribute entry name is valid. */
 bool
 xfs_attr_namecheck(
+	unsigned int	attr_flags,
 	const void	*name,
 	size_t		length)
 {
+	/* Only one namespace bit allowed. */
+	if (!xfs_attr_check_namespace(attr_flags))
+		return false;
+
 	/*
 	 * MAXNAMELEN includes the trailing null, but (name/length) leave it
 	 * out, so use >= for the length check.
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_attr.h
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_attr.h
@@ -547,7 +547,9 @@
 int xfs_attr_set(struct xfs_da_args *args);
 int xfs_attr_set_iter(struct xfs_attr_intent *attr);
 int xfs_attr_remove_iter(struct xfs_attr_intent *attr);
-bool xfs_attr_namecheck(const void *name, size_t length);
+bool xfs_attr_check_namespace(unsigned int attr_flags);
+bool xfs_attr_namecheck(unsigned int attr_flags, const void *name,
+		size_t length);
 int xfs_attr_calc_size(struct xfs_da_args *args, int *local);
 void xfs_init_attr_trans(struct xfs_da_args *args, struct xfs_trans_res *tres,
 			 unsigned int *total);
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_attr_leaf.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -914,6 +914,10 @@
 		nargs.hashval = xfs_da_hashname(sfe->nameval,
 						sfe->namelen);
 		nargs.attr_filter = sfe->flags & XFS_ATTR_NSP_ONDISK_MASK;
+		if (!xfs_attr_check_namespace(sfe->flags)) {
+			error = -EFSCORRUPTED;
+			goto out;
+		}
 		error = xfs_attr3_leaf_lookup_int(bp, &nargs); /* set a->index */
 		ASSERT(error == -ENOATTR);
 		error = xfs_attr3_leaf_add(bp, &nargs);
@@ -1027,7 +1031,7 @@
 		 * one namespace flag per xattr, so we can just count the
 		 * bits (i.e. hweight) here.
 		 */
-		if (hweight8(sfep->flags & XFS_ATTR_NSP_ONDISK_MASK) > 1)
+		if (!xfs_attr_check_namespace(sfep->flags))
 			return __this_address;
 
 		sfep = next_sfep;
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_attr_remote.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_attr_remote.c
@@ -619,7 +619,6 @@
 	if (error)
 		return error;
 
-	ASSERT(nmap == 1);
 	ASSERT((map->br_startblock != DELAYSTARTBLOCK) &&
 	       (map->br_startblock != HOLESTARTBLOCK));
 
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_bmap.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_bmap.c
@@ -1549,6 +1549,7 @@
 			if (error)
 				goto done;
 		}
+		ASSERT(da_new <= da_old);
 		break;
 
 	case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING | BMAP_LEFT_CONTIG:
@@ -1578,6 +1579,7 @@
 			if (error)
 				goto done;
 		}
+		ASSERT(da_new <= da_old);
 		break;
 
 	case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING | BMAP_RIGHT_CONTIG:
@@ -1611,6 +1613,7 @@
 			if (error)
 				goto done;
 		}
+		ASSERT(da_new <= da_old);
 		break;
 
 	case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING:
@@ -1643,6 +1646,7 @@
 				goto done;
 			}
 		}
+		ASSERT(da_new <= da_old);
 		break;
 
 	case BMAP_LEFT_FILLING | BMAP_LEFT_CONTIG:
@@ -1680,6 +1684,7 @@
 			if (error)
 				goto done;
 		}
+		ASSERT(da_new <= da_old);
 		break;
 
 	case BMAP_LEFT_FILLING:
@@ -1767,6 +1772,7 @@
 		xfs_iext_update_extent(bma->ip, state, &bma->icur, &PREV);
 		xfs_iext_next(ifp, &bma->icur);
 		xfs_iext_update_extent(bma->ip, state, &bma->icur, &RIGHT);
+		ASSERT(da_new <= da_old);
 		break;
 
 	case BMAP_RIGHT_FILLING:
@@ -1814,6 +1820,7 @@
 		PREV.br_blockcount = temp;
 		xfs_iext_insert(bma->ip, &bma->icur, &PREV, state);
 		xfs_iext_next(ifp, &bma->icur);
+		ASSERT(da_new <= da_old);
 		break;
 
 	case 0:
@@ -1934,11 +1941,9 @@
 	}
 
 	/* adjust for changes in reserved delayed indirect blocks */
-	if (da_new != da_old) {
-		ASSERT(state == 0 || da_new < da_old);
+	if (da_new != da_old)
 		error = xfs_mod_fdblocks(mp, (int64_t)(da_old - da_new),
-				false);
-	}
+				true);
 
 	xfs_bmap_check_leaf_extents(bma->cur, bma->ip, whichfork);
 done:
@@ -3984,20 +3989,32 @@
 	xfs_extlen_t		alen;
 	xfs_extlen_t		indlen;
 	int			error;
-	xfs_fileoff_t		aoff = off;
+	xfs_fileoff_t		aoff;
+	bool			use_cowextszhint =
+					whichfork == XFS_COW_FORK && !prealloc;
 
+retry:
 	/*
 	 * Cap the alloc length. Keep track of prealloc so we know whether to
 	 * tag the inode before we return.
 	 */
+	aoff = off;
 	alen = XFS_FILBLKS_MIN(len + prealloc, XFS_MAX_BMBT_EXTLEN);
 	if (!eof)
 		alen = XFS_FILBLKS_MIN(alen, got->br_startoff - aoff);
 	if (prealloc && alen >= len)
 		prealloc = alen - len;
 
-	/* Figure out the extent size, adjust alen */
-	if (whichfork == XFS_COW_FORK) {
+	/*
+	 * If we're targetting the COW fork but aren't creating a speculative
+	 * posteof preallocation, try to expand the reservation to align with
+	 * the COW extent size hint if there's sufficient free space.
+	 *
+	 * Unlike the data fork, the CoW cancellation functions will free all
+	 * the reservations at inactivation, so we don't require that every
+	 * delalloc reservation have a dirty pagecache.
+	 */
+	if (use_cowextszhint) {
 		struct xfs_bmbt_irec	prev;
 		xfs_extlen_t		extsz = xfs_get_cowextsz_hint(ip);
 
@@ -4016,7 +4033,7 @@
 	 */
 	error = xfs_quota_reserve_blkres(ip, alen);
 	if (error)
-		return error;
+		goto out;
 
 	/*
 	 * Split changing sb for alen and indlen since they could be coming
@@ -4061,6 +4078,17 @@
 out_unreserve_quota:
 	if (XFS_IS_QUOTA_ON(mp))
 		xfs_quota_unreserve_blkres(ip, alen);
+out:
+	if (error == -ENOSPC || error == -EDQUOT) {
+		trace_xfs_delalloc_enospc(ip, off, len);
+
+		if (prealloc || use_cowextszhint) {
+			/* retry without any preallocation */
+			use_cowextszhint = false;
+			prealloc = 0;
+			goto retry;
+		}
+	}
 	return error;
 }
 
@@ -4143,8 +4171,10 @@
 	} else {
 		error = xfs_bmap_alloc_userdata(bma);
 	}
-	if (error || bma->blkno == NULLFSBLOCK)
+	if (error)
 		return error;
+	if (bma->blkno == NULLFSBLOCK)
+		return -ENOSPC;
 
 	if (bma->flags & XFS_BMAPI_ZERO) {
 		error = xfs_zero_extent(bma->ip, bma->blkno, bma->length);
@@ -4324,6 +4354,15 @@
  * extent state if necessary.  Details behaviour is controlled by the flags
  * parameter.  Only allocates blocks from a single allocation group, to avoid
  * locking problems.
+ *
+ * Returns 0 on success and places the extent mappings in mval.  nmaps is used
+ * as an input/output parameter where the caller specifies the maximum number
+ * of mappings that may be returned and xfs_bmapi_write passes back the number
+ * of mappings (including existing mappings) it found.
+ *
+ * Returns a negative error code on failure, including -ENOSPC when it could not
+ * allocate any blocks and -ENOSR when it did allocate blocks to convert a
+ * delalloc range, but those blocks were before the passed in range.
  */
 int
 xfs_bmapi_write(
@@ -4451,10 +4490,16 @@
 			ASSERT(len > 0);
 			ASSERT(bma.length > 0);
 			error = xfs_bmapi_allocate(&bma);
-			if (error)
+			if (error) {
+				/*
+				 * If we already allocated space in a previous
+				 * iteration return what we go so far when
+				 * running out of space.
+				 */
+				if (error == -ENOSPC && bma.nallocs)
+					break;
 				goto error0;
-			if (bma.blkno == NULLFSBLOCK)
-				break;
+			}
 
 			/*
 			 * If this is a CoW allocation, record the data in
@@ -4492,7 +4537,6 @@
 		if (!xfs_iext_next_extent(ifp, &bma.icur, &bma.got))
 			eof = true;
 	}
-	*nmap = n;
 
 	error = xfs_bmap_btree_to_extents(tp, ip, bma.cur, &bma.logflags,
 			whichfork);
@@ -4503,7 +4547,22 @@
 	       ifp->if_nextents > XFS_IFORK_MAXEXT(ip, whichfork));
 	xfs_bmapi_finish(&bma, whichfork, 0);
 	xfs_bmap_validate_ret(orig_bno, orig_len, orig_flags, orig_mval,
-		orig_nmap, *nmap);
+		orig_nmap, n);
+
+	/*
+	 * When converting delayed allocations, xfs_bmapi_allocate ignores
+	 * the passed in bno and always converts from the start of the found
+	 * delalloc extent.
+	 *
+	 * To avoid a successful return with *nmap set to 0, return the magic
+	 * -ENOSR error code for this particular case so that the caller can
+	 * handle it.
+	 */
+	if (!n) {
+		ASSERT(bma.nallocs >= *nmap);
+		return -ENOSR;
+	}
+	*nmap = n;
 	return 0;
 error0:
 	xfs_bmapi_finish(&bma, whichfork, error);
@@ -4516,8 +4575,8 @@
  * invocations to allocate the target offset if a large enough physical extent
  * is not available.
  */
-int
-xfs_bmapi_convert_delalloc(
+static int
+xfs_bmapi_convert_one_delalloc(
 	struct xfs_inode	*ip,
 	int			whichfork,
 	xfs_off_t		offset,
@@ -4574,7 +4633,8 @@
 	if (!isnullstartblock(bma.got.br_startblock)) {
 		xfs_bmbt_to_iomap(ip, iomap, &bma.got, 0, flags,
 				xfs_iomap_inode_sequence(ip, flags));
-		*seq = READ_ONCE(ifp->if_seq);
+		if (seq)
+			*seq = READ_ONCE(ifp->if_seq);
 		goto out_trans_cancel;
 	}
 
@@ -4610,9 +4670,6 @@
 	if (error)
 		goto out_finish;
 
-	error = -ENOSPC;
-	if (WARN_ON_ONCE(bma.blkno == NULLFSBLOCK))
-		goto out_finish;
 	error = -EFSCORRUPTED;
 	if (WARN_ON_ONCE(!xfs_valid_startblock(ip, bma.got.br_startblock)))
 		goto out_finish;
@@ -4623,7 +4680,8 @@
 	ASSERT(!isnullstartblock(bma.got.br_startblock));
 	xfs_bmbt_to_iomap(ip, iomap, &bma.got, 0, flags,
 				xfs_iomap_inode_sequence(ip, flags));
-	*seq = READ_ONCE(ifp->if_seq);
+	if (seq)
+		*seq = READ_ONCE(ifp->if_seq);
 
 	if (whichfork == XFS_COW_FORK)
 		xfs_refcount_alloc_cow_extent(tp, bma.blkno, bma.length);
@@ -4646,6 +4704,36 @@
 	return error;
 }
 
+/*
+ * Pass in a dellalloc extent and convert it to real extents, return the real
+ * extent that maps offset_fsb in iomap.
+ */
+int
+xfs_bmapi_convert_delalloc(
+	struct xfs_inode	*ip,
+	int			whichfork,
+	loff_t			offset,
+	struct iomap		*iomap,
+	unsigned int		*seq)
+{
+	int			error;
+
+	/*
+	 * Attempt to allocate whatever delalloc extent currently backs offset
+	 * and put the result into iomap.  Allocate in a loop because it may
+	 * take several attempts to allocate real blocks for a contiguous
+	 * delalloc extent if free space is sufficiently fragmented.
+	 */
+	do {
+		error = xfs_bmapi_convert_one_delalloc(ip, whichfork, offset,
+					iomap, seq);
+		if (error)
+			return error;
+	} while (iomap->offset + iomap->length <= offset);
+
+	return 0;
+}
+
 int
 xfs_bmapi_remap(
 	struct xfs_trans	*tp,
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_btree.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_btree.c
@@ -3429,14 +3429,31 @@
 	xfs_btree_log_block(cur, bp, XFS_BB_NUMRECS);
 
 	/*
-	 * If we just inserted into a new tree block, we have to
-	 * recalculate nkey here because nkey is out of date.
+	 * Update btree keys to reflect the newly added record or keyptr.
+	 * There are three cases here to be aware of.  Normally, all we have to
+	 * do is walk towards the root, updating keys as necessary.
 	 *
-	 * Otherwise we're just updating an existing block (having shoved
-	 * some records into the new tree block), so use the regular key
-	 * update mechanism.
+	 * If the caller had us target a full block for the insertion, we dealt
+	 * with that by calling the _make_block_unfull function.  If the
+	 * "make unfull" function splits the block, it'll hand us back the key
+	 * and pointer of the new block.  We haven't yet added the new block to
+	 * the next level up, so if we decide to add the new record to the new
+	 * block (bp->b_bn != old_bn), we have to update the caller's pointer
+	 * so that the caller adds the new block with the correct key.
+	 *
+	 * However, there is a third possibility-- if the selected block is the
+	 * root block of an inode-rooted btree and cannot be expanded further,
+	 * the "make unfull" function moves the root block contents to a new
+	 * block and updates the root block to point to the new block.  In this
+	 * case, no block pointer is passed back because the block has already
+	 * been added to the btree.  In this case, we need to use the regular
+	 * key update function, just like the first case.  This is critical for
+	 * overlapping btrees, because the high key must be updated to reflect
+	 * the entire tree, not just the subtree accessible through the first
+	 * child of the root (which is now two levels down from the root).
 	 */
-	if (bp && xfs_buf_daddr(bp) != old_bn) {
+	if (!xfs_btree_ptr_is_null(cur, &nptr) &&
+	    bp && xfs_buf_daddr(bp) != old_bn) {
 		xfs_btree_get_keys(cur, block, lkey);
 	} else if (xfs_btree_needs_key_update(cur, optr)) {
 		error = xfs_btree_update_keys(cur, level);
@@ -4996,7 +5013,7 @@
 	int			level,
 	void			*data)
 {
-	xfs_extlen_t		*blocks = data;
+	xfs_filblks_t		*blocks = data;
 	(*blocks)++;
 
 	return 0;
@@ -5006,7 +5023,7 @@
 int
 xfs_btree_count_blocks(
 	struct xfs_btree_cur	*cur,
-	xfs_extlen_t		*blocks)
+	xfs_filblks_t		*blocks)
 {
 	*blocks = 0;
 	return xfs_btree_visit_blocks(cur, xfs_btree_count_blocks_helper,
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_btree.h
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_btree.h
@@ -554,7 +554,7 @@
 int xfs_btree_visit_blocks(struct xfs_btree_cur *cur,
 		xfs_btree_visit_blocks_fn fn, unsigned int flags, void *data);
 
-int xfs_btree_count_blocks(struct xfs_btree_cur *cur, xfs_extlen_t *blocks);
+int xfs_btree_count_blocks(struct xfs_btree_cur *cur, xfs_filblks_t *blocks);
 
 union xfs_btree_rec *xfs_btree_rec_addr(struct xfs_btree_cur *cur, int n,
 		struct xfs_btree_block *block);
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_da_btree.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_da_btree.c
@@ -2150,8 +2150,8 @@
 	struct xfs_inode	*dp = args->dp;
 	int			w = args->whichfork;
 	xfs_rfsblock_t		nblks = dp->i_nblocks;
-	struct xfs_bmbt_irec	map, *mapp;
-	int			nmap, error, got, i, mapi;
+	struct xfs_bmbt_irec	map, *mapp = &map;
+	int			nmap, error, got, i, mapi = 1;
 
 	/*
 	 * Find a spot in the file space to put the new block.
@@ -2167,14 +2167,7 @@
 	error = xfs_bmapi_write(tp, dp, *bno, count,
 			xfs_bmapi_aflag(w)|XFS_BMAPI_METADATA|XFS_BMAPI_CONTIG,
 			args->total, &map, &nmap);
-	if (error)
-		return error;
-
-	ASSERT(nmap <= 1);
-	if (nmap == 1) {
-		mapp = &map;
-		mapi = 1;
-	} else if (nmap == 0 && count > 1) {
+	if (error == -ENOSPC && count > 1) {
 		xfs_fileoff_t		b;
 		int			c;
 
@@ -2191,16 +2184,13 @@
 					args->total, &mapp[mapi], &nmap);
 			if (error)
 				goto out_free_map;
-			if (nmap < 1)
-				break;
 			mapi += nmap;
 			b = mapp[mapi - 1].br_startoff +
 			    mapp[mapi - 1].br_blockcount;
 		}
-	} else {
-		mapi = 0;
-		mapp = NULL;
 	}
+	if (error)
+		goto out_free_map;
 
 	/*
 	 * Count the blocks we got, make sure it matches the total.
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_da_format.h
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_da_format.h
@@ -708,8 +708,13 @@
 #define XFS_ATTR_ROOT		(1u << XFS_ATTR_ROOT_BIT)
 #define XFS_ATTR_SECURE		(1u << XFS_ATTR_SECURE_BIT)
 #define XFS_ATTR_INCOMPLETE	(1u << XFS_ATTR_INCOMPLETE_BIT)
+
 #define XFS_ATTR_NSP_ONDISK_MASK	(XFS_ATTR_ROOT | XFS_ATTR_SECURE)
 
+#define XFS_ATTR_ONDISK_MASK	(XFS_ATTR_NSP_ONDISK_MASK | \
+				 XFS_ATTR_LOCAL | \
+				 XFS_ATTR_INCOMPLETE)
+
 /*
  * Alignment for namelist and valuelist entries (since they are mixed
  * there can be only one alignment value)
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_dir2_data.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_dir2_data.c
@@ -177,6 +177,14 @@
 	while (offset < end) {
 		struct xfs_dir2_data_unused	*dup = bp->b_addr + offset;
 		struct xfs_dir2_data_entry	*dep = bp->b_addr + offset;
+		unsigned int	reclen;
+
+		/*
+		 * Are the remaining bytes large enough to hold an
+		 * unused entry?
+		 */
+		if (offset > end - xfs_dir2_data_unusedsize(1))
+			return __this_address;
 
 		/*
 		 * If it's unused, look for the space in the bestfree table.
@@ -186,9 +194,13 @@
 		if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
 			xfs_failaddr_t	fa;
 
+			reclen = xfs_dir2_data_unusedsize(
+					be16_to_cpu(dup->length));
 			if (lastfree != 0)
 				return __this_address;
-			if (offset + be16_to_cpu(dup->length) > end)
+			if (be16_to_cpu(dup->length) != reclen)
+				return __this_address;
+			if (offset + reclen > end)
 				return __this_address;
 			if (be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)) !=
 			    offset)
@@ -206,10 +218,18 @@
 				    be16_to_cpu(bf[2].length))
 					return __this_address;
 			}
-			offset += be16_to_cpu(dup->length);
+			offset += reclen;
 			lastfree = 1;
 			continue;
 		}
+
+		/*
+		 * This is not an unused entry. Are the remaining bytes
+		 * large enough for a dirent with a single-byte name?
+		 */
+		if (offset > end - xfs_dir2_data_entsize(mp, 1))
+			return __this_address;
+
 		/*
 		 * It's a real entry.  Validate the fields.
 		 * If this is a block directory then make sure it's
@@ -218,9 +238,10 @@
 		 */
 		if (dep->namelen == 0)
 			return __this_address;
-		if (!xfs_verify_dir_ino(mp, be64_to_cpu(dep->inumber)))
+		reclen = xfs_dir2_data_entsize(mp, dep->namelen);
+		if (offset + reclen > end)
 			return __this_address;
-		if (offset + xfs_dir2_data_entsize(mp, dep->namelen) > end)
+		if (!xfs_verify_dir_ino(mp, be64_to_cpu(dep->inumber)))
 			return __this_address;
 		if (be16_to_cpu(*xfs_dir2_data_entry_tag_p(mp, dep)) != offset)
 			return __this_address;
@@ -244,7 +265,7 @@
 			if (i >= be32_to_cpu(btp->count))
 				return __this_address;
 		}
-		offset += xfs_dir2_data_entsize(mp, dep->namelen);
+		offset += reclen;
 	}
 	/*
 	 * Need to have seen all the entries and all the bestfree slots.
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_dir2_priv.h
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_dir2_priv.h
@@ -189,6 +189,13 @@
 		       struct dir_context *ctx, size_t bufsize);
 
 static inline unsigned int
+xfs_dir2_data_unusedsize(
+	unsigned int	len)
+{
+	return round_up(len, XFS_DIR2_DATA_ALIGN);
+}
+
+static inline unsigned int
 xfs_dir2_data_entsize(
 	struct xfs_mount	*mp,
 	unsigned int		namelen)
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_ialloc.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_ialloc.c
@@ -801,7 +801,8 @@
 		 * the end of the AG.
 		 */
 		args.min_agbno = args.mp->m_sb.sb_inoalignmt;
-		args.max_agbno = round_down(args.mp->m_sb.sb_agblocks,
+		args.max_agbno = round_down(xfs_ag_block_count(args.mp,
+							pag->pag_agno),
 					    args.mp->m_sb.sb_inoalignmt) -
 				 igeo->ialloc_blks;
 
@@ -2196,9 +2197,9 @@
 		return -EINVAL;
 	}
 	agbno = XFS_AGINO_TO_AGBNO(mp, agino);
-	if (agbno >= mp->m_sb.sb_agblocks)  {
-		xfs_warn(mp, "%s: agbno >= mp->m_sb.sb_agblocks (%d >= %d).",
-			__func__, agbno, mp->m_sb.sb_agblocks);
+	if (agbno >= xfs_ag_block_count(mp, pag->pag_agno)) {
+		xfs_warn(mp, "%s: agbno >= xfs_ag_block_count (%d >= %d).",
+			__func__, agbno, xfs_ag_block_count(mp, pag->pag_agno));
 		ASSERT(0);
 		return -EINVAL;
 	}
@@ -2321,7 +2322,7 @@
 	 */
 	agino = XFS_INO_TO_AGINO(mp, ino);
 	agbno = XFS_AGINO_TO_AGBNO(mp, agino);
-	if (agbno >= mp->m_sb.sb_agblocks ||
+	if (agbno >= xfs_ag_block_count(mp, pag->pag_agno) ||
 	    ino != XFS_AGINO_TO_INO(mp, pag->pag_agno, agino)) {
 		error = -EINVAL;
 #ifdef DEBUG
@@ -2331,11 +2332,12 @@
 		 */
 		if (flags & XFS_IGET_UNTRUSTED)
 			return error;
-		if (agbno >= mp->m_sb.sb_agblocks) {
+		if (agbno >= xfs_ag_block_count(mp, pag->pag_agno)) {
 			xfs_alert(mp,
 		"%s: agbno (0x%llx) >= mp->m_sb.sb_agblocks (0x%lx)",
 				__func__, (unsigned long long)agbno,
-				(unsigned long)mp->m_sb.sb_agblocks);
+				(unsigned long)xfs_ag_block_count(mp,
+							pag->pag_agno));
 		}
 		if (ino != XFS_AGINO_TO_INO(mp, pag->pag_agno, agino)) {
 			xfs_alert(mp,
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_ialloc_btree.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_ialloc_btree.c
@@ -754,15 +754,17 @@
 {
 	struct xfs_buf		*agbp = NULL;
 	struct xfs_btree_cur	*cur = NULL;
+	xfs_filblks_t		blocks;
 	int			error;
 
 	error = xfs_inobt_cur(pag, tp, btnum, &cur, &agbp);
 	if (error)
 		return error;
 
-	error = xfs_btree_count_blocks(cur, tree_blocks);
+	error = xfs_btree_count_blocks(cur, &blocks);
 	xfs_btree_del_cursor(cur, error);
 	xfs_trans_brelse(tp, agbp);
+	*tree_blocks = blocks;
 
 	return error;
 }
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_inode_buf.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_inode_buf.c
@@ -368,17 +368,40 @@
 	/*
 	 * For fork types that can contain local data, check that the fork
 	 * format matches the size of local data contained within the fork.
-	 *
-	 * For all types, check that when the size says the should be in extent
-	 * or btree format, the inode isn't claiming it is in local format.
 	 */
 	if (whichfork == XFS_DATA_FORK) {
-		if (S_ISDIR(mode) || S_ISLNK(mode)) {
+		/*
+		 * A directory small enough to fit in the inode must be stored
+		 * in local format.  The directory sf <-> extents conversion
+		 * code updates the directory size accordingly.  Directories
+		 * being truncated have zero size and are not subject to this
+		 * check.
+		 */
+		if (S_ISDIR(mode)) {
+			if (dip->di_size &&
+			    be64_to_cpu(dip->di_size) <= fork_size &&
+			    fork_format != XFS_DINODE_FMT_LOCAL)
+				return __this_address;
+		}
+
+		/*
+		 * A symlink with a target small enough to fit in the inode can
+		 * be stored in extents format if xattrs were added (thus
+		 * converting the data fork from shortform to remote format)
+		 * and then removed.
+		 */
+		if (S_ISLNK(mode)) {
 			if (be64_to_cpu(dip->di_size) <= fork_size &&
+			    fork_format != XFS_DINODE_FMT_EXTENTS &&
 			    fork_format != XFS_DINODE_FMT_LOCAL)
 				return __this_address;
 		}
 
+		/*
+		 * For all types, check that when the size says the fork should
+		 * be in extent or btree format, the inode isn't claiming to be
+		 * in local format.
+		 */
 		if (be64_to_cpu(dip->di_size) > fork_size &&
 		    fork_format == XFS_DINODE_FMT_LOCAL)
 			return __this_address;
@@ -494,9 +517,19 @@
 	if (mode && xfs_mode_to_ftype(mode) == XFS_DIR3_FT_UNKNOWN)
 		return __this_address;
 
-	/* No zero-length symlinks/dirs. */
-	if ((S_ISLNK(mode) || S_ISDIR(mode)) && di_size == 0)
-		return __this_address;
+	/*
+	 * No zero-length symlinks/dirs unless they're unlinked and hence being
+	 * inactivated.
+	 */
+	if ((S_ISLNK(mode) || S_ISDIR(mode)) && di_size == 0) {
+		if (dip->di_version > 1) {
+			if (dip->di_nlink)
+				return __this_address;
+		} else {
+			if (dip->di_onlink)
+				return __this_address;
+		}
+	}
 
 	fa = xfs_dinode_verify_nrext64(mp, dip);
 	if (fa)
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_quota_defs.h
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_quota_defs.h
@@ -56,7 +56,7 @@
  * And, of course, we also need to take into account the dquot log format item
  * used to describe each dquot.
  */
-#define XFS_DQUOT_LOGRES(mp)	\
+#define XFS_DQUOT_LOGRES	\
 	((sizeof(struct xfs_dq_logformat) + sizeof(struct xfs_disk_dquot)) * 6)
 
 #define XFS_IS_QUOTA_ON(mp)		((mp)->m_qflags & XFS_ALL_QUOTA_ACCT)
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_sb.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_sb.c
@@ -260,13 +260,6 @@
 	 * the kernel cannot support since we checked for unsupported bits in
 	 * the read verifier, which means that memory is corrupt.
 	 */
-	if (xfs_sb_has_compat_feature(sbp, XFS_SB_FEAT_COMPAT_UNKNOWN)) {
-		xfs_warn(mp,
-"Corruption detected in superblock compatible features (0x%x)!",
-			(sbp->sb_features_compat & XFS_SB_FEAT_COMPAT_UNKNOWN));
-		return -EFSCORRUPTED;
-	}
-
 	if (!xfs_is_readonly(mp) &&
 	    xfs_sb_has_ro_compat_feature(sbp, XFS_SB_FEAT_RO_COMPAT_UNKNOWN)) {
 		xfs_alert(mp,
@@ -361,6 +354,21 @@
 					 sbp->sb_inoalignmt, align);
 				return -EINVAL;
 			}
+
+			if (sbp->sb_spino_align &&
+			    (sbp->sb_spino_align > sbp->sb_inoalignmt ||
+			     (sbp->sb_inoalignmt % sbp->sb_spino_align) != 0)) {
+				xfs_warn(mp,
+"Sparse inode alignment (%u) is invalid, must be integer factor of (%u).",
+					sbp->sb_spino_align,
+					sbp->sb_inoalignmt);
+				return -EINVAL;
+			}
+		} else if (sbp->sb_spino_align) {
+			xfs_warn(mp,
+				"Sparse inode alignment (%u) should be zero.",
+				sbp->sb_spino_align);
+			return -EINVAL;
 		}
 	} else if (sbp->sb_qflags & (XFS_PQUOTA_ENFD | XFS_GQUOTA_ENFD |
 				XFS_PQUOTA_CHKD | XFS_GQUOTA_CHKD)) {
@@ -530,7 +538,8 @@
 	}
 
 	if (!xfs_validate_stripe_geometry(mp, XFS_FSB_TO_B(mp, sbp->sb_unit),
-			XFS_FSB_TO_B(mp, sbp->sb_width), 0, false))
+			XFS_FSB_TO_B(mp, sbp->sb_width), 0,
+			xfs_buf_daddr(bp) == XFS_SB_DADDR, false))
 		return -EFSCORRUPTED;
 
 	/*
@@ -1032,11 +1041,12 @@
 	 * and hence we don't need have to update it here.
 	 */
 	if (xfs_has_lazysbcount(mp)) {
-		mp->m_sb.sb_icount = percpu_counter_sum(&mp->m_icount);
+		mp->m_sb.sb_icount = percpu_counter_sum_positive(&mp->m_icount);
 		mp->m_sb.sb_ifree = min_t(uint64_t,
-				percpu_counter_sum(&mp->m_ifree),
+				percpu_counter_sum_positive(&mp->m_ifree),
 				mp->m_sb.sb_icount);
-		mp->m_sb.sb_fdblocks = percpu_counter_sum(&mp->m_fdblocks);
+		mp->m_sb.sb_fdblocks =
+				percpu_counter_sum_positive(&mp->m_fdblocks);
 	}
 
 	xfs_sb_to_disk(bp->b_addr, &mp->m_sb);
@@ -1321,8 +1331,10 @@
 }
 
 /*
- * sunit, swidth, sectorsize(optional with 0) should be all in bytes,
- * so users won't be confused by values in error messages.
+ * sunit, swidth, sectorsize(optional with 0) should be all in bytes, so users
+ * won't be confused by values in error messages.  This function returns false
+ * if the stripe geometry is invalid and the caller is unable to repair the
+ * stripe configuration later in the mount process.
  */
 bool
 xfs_validate_stripe_geometry(
@@ -1330,20 +1342,21 @@
 	__s64			sunit,
 	__s64			swidth,
 	int			sectorsize,
+	bool			may_repair,
 	bool			silent)
 {
 	if (swidth > INT_MAX) {
 		if (!silent)
 			xfs_notice(mp,
 "stripe width (%lld) is too large", swidth);
-		return false;
+		goto check_override;
 	}
 
 	if (sunit > swidth) {
 		if (!silent)
 			xfs_notice(mp,
 "stripe unit (%lld) is larger than the stripe width (%lld)", sunit, swidth);
-		return false;
+		goto check_override;
 	}
 
 	if (sectorsize && (int)sunit % sectorsize) {
@@ -1351,21 +1364,21 @@
 			xfs_notice(mp,
 "stripe unit (%lld) must be a multiple of the sector size (%d)",
 				   sunit, sectorsize);
-		return false;
+		goto check_override;
 	}
 
 	if (sunit && !swidth) {
 		if (!silent)
 			xfs_notice(mp,
 "invalid stripe unit (%lld) and stripe width of 0", sunit);
-		return false;
+		goto check_override;
 	}
 
 	if (!sunit && swidth) {
 		if (!silent)
 			xfs_notice(mp,
 "invalid stripe width (%lld) and stripe unit of 0", swidth);
-		return false;
+		goto check_override;
 	}
 
 	if (sunit && (int)swidth % (int)sunit) {
@@ -1373,9 +1386,27 @@
 			xfs_notice(mp,
 "stripe width (%lld) must be a multiple of the stripe unit (%lld)",
 				   swidth, sunit);
-		return false;
+		goto check_override;
 	}
 	return true;
+
+check_override:
+	if (!may_repair)
+		return false;
+	/*
+	 * During mount, mp->m_dalign will not be set unless the sunit mount
+	 * option was set. If it was set, ignore the bad stripe alignment values
+	 * and allow the validation and overwrite later in the mount process to
+	 * attempt to overwrite the bad stripe alignment values with the values
+	 * supplied by mount options.
+	 */
+	if (!mp->m_dalign)
+		return false;
+	if (!silent)
+		xfs_notice(mp,
+"Will try to correct with specified mount options sunit (%d) and swidth (%d)",
+			BBTOB(mp->m_dalign), BBTOB(mp->m_swidth));
+	return true;
 }
 
 /*
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_sb.h
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_sb.h
@@ -35,8 +35,9 @@
 				struct xfs_trans *tp, xfs_agnumber_t agno,
 				struct xfs_buf **bpp);
 
-extern bool	xfs_validate_stripe_geometry(struct xfs_mount *mp,
-		__s64 sunit, __s64 swidth, int sectorsize, bool silent);
+bool	xfs_validate_stripe_geometry(struct xfs_mount *mp,
+		__s64 sunit, __s64 swidth, int sectorsize, bool may_repair,
+		bool silent);
 
 uint8_t xfs_compute_rextslog(xfs_rtbxlen_t rtextents);
 
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_symlink_remote.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_symlink_remote.c
@@ -89,8 +89,10 @@
 	struct xfs_mount	*mp = bp->b_mount;
 	struct xfs_dsymlink_hdr	*dsl = bp->b_addr;
 
+	/* no verification of non-crc buffers */
 	if (!xfs_has_crc(mp))
-		return __this_address;
+		return NULL;
+
 	if (!xfs_verify_magic(bp, dsl->sl_magic))
 		return __this_address;
 	if (!uuid_equal(&dsl->sl_uuid, &mp->m_sb.sb_meta_uuid))
--- linux-qcom-6.8.0.orig/fs/xfs/libxfs/xfs_trans_resv.c
+++ linux-qcom-6.8.0/fs/xfs/libxfs/xfs_trans_resv.c
@@ -336,11 +336,11 @@
 					blksz);
 		t1 += adj;
 		t3 += adj;
-		return XFS_DQUOT_LOGRES(mp) + max3(t1, t2, t3);
+		return XFS_DQUOT_LOGRES + max3(t1, t2, t3);
 	}
 
 	t4 = xfs_calc_refcountbt_reservation(mp, 1);
-	return XFS_DQUOT_LOGRES(mp) + max(t4, max3(t1, t2, t3));
+	return XFS_DQUOT_LOGRES + max(t4, max3(t1, t2, t3));
 }
 
 unsigned int
@@ -408,11 +408,11 @@
 					xfs_refcountbt_block_count(mp, 4),
 					blksz);
 
-		return XFS_DQUOT_LOGRES(mp) + max3(t1, t2, t3);
+		return XFS_DQUOT_LOGRES + max3(t1, t2, t3);
 	}
 
 	t4 = xfs_calc_refcountbt_reservation(mp, 2);
-	return XFS_DQUOT_LOGRES(mp) + max(t4, max3(t1, t2, t3));
+	return XFS_DQUOT_LOGRES + max(t4, max3(t1, t2, t3));
 }
 
 unsigned int
@@ -438,7 +438,7 @@
 xfs_calc_rename_reservation(
 	struct xfs_mount	*mp)
 {
-	return XFS_DQUOT_LOGRES(mp) +
+	return XFS_DQUOT_LOGRES +
 		max((xfs_calc_inode_res(mp, 5) +
 		     xfs_calc_buf_res(2 * XFS_DIROP_LOG_COUNT(mp),
 				      XFS_FSB_TO_B(mp, 1))),
@@ -477,7 +477,7 @@
 xfs_calc_link_reservation(
 	struct xfs_mount	*mp)
 {
-	return XFS_DQUOT_LOGRES(mp) +
+	return XFS_DQUOT_LOGRES +
 		xfs_calc_iunlink_remove_reservation(mp) +
 		max((xfs_calc_inode_res(mp, 2) +
 		     xfs_calc_buf_res(XFS_DIROP_LOG_COUNT(mp),
@@ -515,7 +515,7 @@
 xfs_calc_remove_reservation(
 	struct xfs_mount	*mp)
 {
-	return XFS_DQUOT_LOGRES(mp) +
+	return XFS_DQUOT_LOGRES +
 		xfs_calc_iunlink_add_reservation(mp) +
 		max((xfs_calc_inode_res(mp, 2) +
 		     xfs_calc_buf_res(XFS_DIROP_LOG_COUNT(mp),
@@ -574,7 +574,7 @@
 STATIC uint
 xfs_calc_icreate_reservation(xfs_mount_t *mp)
 {
-	return XFS_DQUOT_LOGRES(mp) +
+	return XFS_DQUOT_LOGRES +
 		max(xfs_calc_icreate_resv_alloc(mp),
 		    xfs_calc_create_resv_modify(mp));
 }
@@ -583,7 +583,7 @@
 xfs_calc_create_tmpfile_reservation(
 	struct xfs_mount        *mp)
 {
-	uint	res = XFS_DQUOT_LOGRES(mp);
+	uint	res = XFS_DQUOT_LOGRES;
 
 	res += xfs_calc_icreate_resv_alloc(mp);
 	return res + xfs_calc_iunlink_add_reservation(mp);
@@ -632,7 +632,7 @@
 xfs_calc_ifree_reservation(
 	struct xfs_mount	*mp)
 {
-	return XFS_DQUOT_LOGRES(mp) +
+	return XFS_DQUOT_LOGRES +
 		xfs_calc_inode_res(mp, 1) +
 		xfs_calc_buf_res(3, mp->m_sb.sb_sectsize) +
 		xfs_calc_iunlink_remove_reservation(mp) +
@@ -649,7 +649,7 @@
 xfs_calc_ichange_reservation(
 	struct xfs_mount	*mp)
 {
-	return XFS_DQUOT_LOGRES(mp) +
+	return XFS_DQUOT_LOGRES +
 		xfs_calc_inode_res(mp, 1) +
 		xfs_calc_buf_res(1, mp->m_sb.sb_sectsize);
 
@@ -758,7 +758,7 @@
 xfs_calc_addafork_reservation(
 	struct xfs_mount	*mp)
 {
-	return XFS_DQUOT_LOGRES(mp) +
+	return XFS_DQUOT_LOGRES +
 		xfs_calc_inode_res(mp, 1) +
 		xfs_calc_buf_res(2, mp->m_sb.sb_sectsize) +
 		xfs_calc_buf_res(1, mp->m_dir_geo->blksize) +
@@ -806,7 +806,7 @@
 xfs_calc_attrsetm_reservation(
 	struct xfs_mount	*mp)
 {
-	return XFS_DQUOT_LOGRES(mp) +
+	return XFS_DQUOT_LOGRES +
 		xfs_calc_inode_res(mp, 1) +
 		xfs_calc_buf_res(1, mp->m_sb.sb_sectsize) +
 		xfs_calc_buf_res(XFS_DA_NODE_MAXDEPTH, XFS_FSB_TO_B(mp, 1));
@@ -846,7 +846,7 @@
 xfs_calc_attrrm_reservation(
 	struct xfs_mount	*mp)
 {
-	return XFS_DQUOT_LOGRES(mp) +
+	return XFS_DQUOT_LOGRES +
 		max((xfs_calc_inode_res(mp, 1) +
 		     xfs_calc_buf_res(XFS_DA_NODE_MAXDEPTH,
 				      XFS_FSB_TO_B(mp, 1)) +
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/agheader.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/agheader.c
@@ -59,6 +59,30 @@
 }
 
 /*
+ * Calculate the ondisk superblock size in bytes given the feature set of the
+ * mounted filesystem (aka the primary sb).  This is subtlely different from
+ * the logic in xfs_repair, which computes the size of a secondary sb given the
+ * featureset listed in the secondary sb.
+ */
+STATIC size_t
+xchk_superblock_ondisk_size(
+	struct xfs_mount	*mp)
+{
+	if (xfs_has_metauuid(mp))
+		return offsetofend(struct xfs_dsb, sb_meta_uuid);
+	if (xfs_has_crc(mp))
+		return offsetofend(struct xfs_dsb, sb_lsn);
+	if (xfs_sb_version_hasmorebits(&mp->m_sb))
+		return offsetofend(struct xfs_dsb, sb_bad_features2);
+	if (xfs_has_logv2(mp))
+		return offsetofend(struct xfs_dsb, sb_logsunit);
+	if (xfs_has_sector(mp))
+		return offsetofend(struct xfs_dsb, sb_logsectsize);
+	/* only support dirv2 or more recent */
+	return offsetofend(struct xfs_dsb, sb_dirblklog);
+}
+
+/*
  * Scrub the filesystem superblock.
  *
  * Note: We do /not/ attempt to check AG 0's superblock.  Mount is
@@ -74,6 +98,7 @@
 	struct xfs_buf		*bp;
 	struct xfs_dsb		*sb;
 	struct xfs_perag	*pag;
+	size_t			sblen;
 	xfs_agnumber_t		agno;
 	uint32_t		v2_ok;
 	__be32			features_mask;
@@ -350,8 +375,8 @@
 	}
 
 	/* Everything else must be zero. */
-	if (memchr_inv(sb + 1, 0,
-			BBTOB(bp->b_length) - sizeof(struct xfs_dsb)))
+	sblen = xchk_superblock_ondisk_size(mp);
+	if (memchr_inv((char *)sb + sblen, 0, BBTOB(bp->b_length) - sblen))
 		xchk_block_set_corrupt(sc, bp);
 
 	xchk_superblock_xref(sc, bp);
@@ -434,7 +459,7 @@
 {
 	struct xfs_agf		*agf = sc->sa.agf_bp->b_addr;
 	struct xfs_mount	*mp = sc->mp;
-	xfs_agblock_t		blocks;
+	xfs_filblks_t		blocks;
 	xfs_agblock_t		btreeblks;
 	int			error;
 
@@ -483,7 +508,7 @@
 	struct xfs_scrub	*sc)
 {
 	struct xfs_agf		*agf = sc->sa.agf_bp->b_addr;
-	xfs_agblock_t		blocks;
+	xfs_filblks_t		blocks;
 	int			error;
 
 	if (!sc->sa.refc_cur)
@@ -816,7 +841,7 @@
 	struct xfs_scrub	*sc)
 {
 	struct xfs_agi		*agi = sc->sa.agi_bp->b_addr;
-	xfs_agblock_t		blocks;
+	xfs_filblks_t		blocks;
 	int			error = 0;
 
 	if (!xfs_has_inobtcounts(sc->mp))
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/agheader_repair.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/agheader_repair.c
@@ -258,7 +258,7 @@
 	struct xfs_agf		*agf = agf_bp->b_addr;
 	struct xfs_mount	*mp = sc->mp;
 	xfs_agblock_t		btreeblks;
-	xfs_agblock_t		blocks;
+	xfs_filblks_t		blocks;
 	int			error;
 
 	/* Update the AGF counters from the bnobt. */
@@ -705,7 +705,7 @@
 	 * step.
 	 */
 	xagb_bitmap_init(&af.used_extents);
-	af.agfl_bno = xfs_buf_to_agfl_bno(agfl_bp),
+	af.agfl_bno = xfs_buf_to_agfl_bno(agfl_bp);
 	xagb_bitmap_walk(agfl_extents, xrep_agfl_fill, &af);
 	error = xagb_bitmap_disunion(agfl_extents, &af.used_extents);
 	if (error)
@@ -913,7 +913,7 @@
 	if (error)
 		goto err;
 	if (xfs_has_inobtcounts(mp)) {
-		xfs_agblock_t	blocks;
+		xfs_filblks_t	blocks;
 
 		error = xfs_btree_count_blocks(cur, &blocks);
 		if (error)
@@ -926,7 +926,7 @@
 	agi->agi_freecount = cpu_to_be32(freecount);
 
 	if (xfs_has_finobt(mp) && xfs_has_inobtcounts(mp)) {
-		xfs_agblock_t	blocks;
+		xfs_filblks_t	blocks;
 
 		cur = xfs_inobt_init_cursor(sc->sa.pag, sc->tp, agi_bp,
 				XFS_BTNUM_FINO);
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/attr.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/attr.c
@@ -182,33 +182,24 @@
 		return;
 	}
 
+	if (flags & ~XFS_ATTR_ONDISK_MASK) {
+		xchk_fblock_set_corrupt(sx->sc, XFS_ATTR_FORK, args.blkno);
+		goto fail_xref;
+	}
+
 	if (flags & XFS_ATTR_INCOMPLETE) {
 		/* Incomplete attr key, just mark the inode for preening. */
 		xchk_ino_set_preen(sx->sc, context->dp->i_ino);
 		return;
 	}
 
-	/* Only one namespace bit allowed. */
-	if (hweight32(flags & XFS_ATTR_NSP_ONDISK_MASK) > 1) {
-		xchk_fblock_set_corrupt(sx->sc, XFS_ATTR_FORK, args.blkno);
-		goto fail_xref;
-	}
-
 	/* Does this name make sense? */
-	if (!xfs_attr_namecheck(name, namelen)) {
+	if (!xfs_attr_namecheck(flags, name, namelen)) {
 		xchk_fblock_set_corrupt(sx->sc, XFS_ATTR_FORK, args.blkno);
 		goto fail_xref;
 	}
 
 	/*
-	 * Local xattr values are stored in the attr leaf block, so we don't
-	 * need to retrieve the value from a remote block to detect corruption
-	 * problems.
-	 */
-	if (flags & XFS_ATTR_LOCAL)
-		goto fail_xref;
-
-	/*
 	 * Try to allocate enough memory to extrat the attr value.  If that
 	 * doesn't work, we overload the seen_enough variable to convey
 	 * the error message back to the main scrub function.
@@ -223,6 +214,11 @@
 
 	args.value = ab->value;
 
+	/*
+	 * Get the attr value to ensure that lookup can find this attribute
+	 * through the dabtree indexing and that remote value retrieval also
+	 * works correctly.
+	 */
 	error = xfs_attr_get_ilocked(&args);
 	/* ENODATA means the hash lookup failed and the attr is bad */
 	if (error == -ENODATA)
@@ -463,7 +459,6 @@
 	xfs_dahash_t			hash;
 	int				nameidx;
 	int				hdrsize;
-	unsigned int			badflags;
 	int				error;
 
 	ASSERT(blk->magic == XFS_ATTR_LEAF_MAGIC);
@@ -493,10 +488,15 @@
 
 	/* Retrieve the entry and check it. */
 	hash = be32_to_cpu(ent->hashval);
-	badflags = ~(XFS_ATTR_LOCAL | XFS_ATTR_ROOT | XFS_ATTR_SECURE |
-			XFS_ATTR_INCOMPLETE);
-	if ((ent->flags & badflags) != 0)
+	if (ent->flags & ~XFS_ATTR_ONDISK_MASK) {
+		xchk_da_set_corrupt(ds, level);
+		return 0;
+	}
+	if (!xfs_attr_check_namespace(ent->flags)) {
 		xchk_da_set_corrupt(ds, level);
+		return 0;
+	}
+
 	if (ent->flags & XFS_ATTR_LOCAL) {
 		lentry = (struct xfs_attr_leaf_name_local *)
 				(((char *)bp->b_addr) + nameidx);
@@ -555,6 +555,15 @@
 			xchk_fblock_set_corrupt(sc, XFS_ATTR_FORK, 0);
 			break;
 		}
+
+		/*
+		 * Shortform entries do not set LOCAL or INCOMPLETE, so the
+		 * only valid flag bits here are for namespaces.
+		 */
+		if (sfe->flags & ~XFS_ATTR_NSP_ONDISK_MASK) {
+			xchk_fblock_set_corrupt(sc, XFS_ATTR_FORK, 0);
+			break;
+		}
 
 		if (!xchk_xattr_set_map(sc, ab->usedmap,
 				(char *)sfe - (char *)sf,
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/bmap.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/bmap.c
@@ -938,7 +938,13 @@
 		}
 		break;
 	case XFS_ATTR_FORK:
-		if (!xfs_has_attr(mp) && !xfs_has_attr2(mp))
+		/*
+		 * "attr" means that an attr fork was created at some point in
+		 * the life of this filesystem.  "attr2" means that inodes have
+		 * variable-sized data/attr fork areas.  Hence we only check
+		 * attr here.
+		 */
+		if (!xfs_has_attr(mp))
 			xchk_ino_set_corrupt(sc, sc->ip->i_ino);
 		break;
 	default:
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/btree.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/btree.c
@@ -385,7 +385,12 @@
 	agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
 	agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
 
-	init_sa = bs->cur->bc_flags & XFS_BTREE_LONG_PTRS;
+	/*
+	 * If the btree being examined is not itself a per-AG btree, initialize
+	 * sc->sa so that we can check for the presence of an ownership record
+	 * in the rmap btree for the AG containing the block.
+	 */
+	init_sa = bs->cur->bc_flags & XFS_BTREE_ROOT_IN_INODE;
 	if (init_sa) {
 		error = xchk_ag_init_existing(bs->sc, agno, &bs->sc->sa);
 		if (!xchk_btree_xref_process_error(bs->sc, bs->cur,
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/common.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/common.c
@@ -737,7 +737,7 @@
 {
 	ASSERT(sc->tp != NULL);
 
-	return xfs_iget(sc->mp, sc->tp, inum, XFS_IGET_UNTRUSTED, 0, ipp);
+	return xfs_iget(sc->mp, sc->tp, inum, XCHK_IGET_FLAGS, 0, ipp);
 }
 
 /*
@@ -788,8 +788,8 @@
 	if (error)
 		return error;
 
-	error = xfs_iget(mp, tp, inum,
-			XFS_IGET_NORETRY | XFS_IGET_UNTRUSTED, 0, ipp);
+	error = xfs_iget(mp, tp, inum, XFS_IGET_NORETRY | XCHK_IGET_FLAGS, 0,
+			ipp);
 	if (error == -EAGAIN) {
 		/*
 		 * The inode may be in core but temporarily unavailable and may
@@ -1000,9 +1000,7 @@
 	struct xfs_scrub	*sc,
 	struct xfs_inode	*ip)
 {
-	if (current->journal_info != NULL) {
-		ASSERT(current->journal_info == sc->tp);
-
+	if (sc->tp) {
 		/*
 		 * If we are in a transaction, we /cannot/ drop the inode
 		 * ourselves, because the VFS will trigger writeback, which
@@ -1018,12 +1016,6 @@
 		spin_lock(&VFS_I(ip)->i_lock);
 		VFS_I(ip)->i_state &= ~I_DONTCACHE;
 		spin_unlock(&VFS_I(ip)->i_lock);
-	} else if (atomic_read(&VFS_I(ip)->i_count) == 1) {
-		/*
-		 * If this is the last reference to the inode and the caller
-		 * permits it, set DONTCACHE to avoid thrashing.
-		 */
-		d_mark_dontcache(VFS_I(ip));
 	}
 
 	xfs_irele(ip);
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/fscounters.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/fscounters.c
@@ -264,7 +264,7 @@
 	struct xchk_fscounters	*fsc,
 	xfs_agnumber_t		agno)
 {
-	xfs_extlen_t		blocks;
+	xfs_filblks_t		blocks;
 	int			error;
 
 	error = xchk_ag_init_existing(sc, agno, &sc->sa);
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/ialloc.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/ialloc.c
@@ -653,8 +653,8 @@
 	int			which)
 {
 	xfs_filblks_t		blocks;
-	xfs_extlen_t		inobt_blocks = 0;
-	xfs_extlen_t		finobt_blocks = 0;
+	xfs_filblks_t		inobt_blocks = 0;
+	xfs_filblks_t		finobt_blocks = 0;
 	int			error;
 
 	if (!sc->sa.ino_cur || !sc->sa.rmap_cur ||
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/refcount.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/refcount.c
@@ -478,7 +478,7 @@
 	struct xfs_scrub	*sc,
 	xfs_filblks_t		cow_blocks)
 {
-	xfs_extlen_t		refcbt_blocks = 0;
+	xfs_filblks_t		refcbt_blocks = 0;
 	xfs_filblks_t		blocks;
 	int			error;
 
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/repair.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/repair.c
@@ -1089,9 +1089,11 @@
 		return error;
 
 	/* Make sure the attr fork looks ok before we delete it. */
-	error = xrep_metadata_inode_subtype(sc, XFS_SCRUB_TYPE_BMBTA);
-	if (error)
-		return error;
+	if (xfs_inode_hasattr(sc->ip)) {
+		error = xrep_metadata_inode_subtype(sc, XFS_SCRUB_TYPE_BMBTA);
+		if (error)
+			return error;
+	}
 
 	/* Clear the reflink flag since metadata never shares. */
 	if (xfs_is_reflink_inode(sc->ip)) {
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/scrub.h
+++ linux-qcom-6.8.0/fs/xfs/scrub/scrub.h
@@ -17,6 +17,13 @@
 #define XCHK_GFP_FLAGS	((__force gfp_t)(GFP_KERNEL | __GFP_NOWARN | \
 					 __GFP_RETRY_MAYFAIL))
 
+/*
+ * For opening files by handle for fsck operations, we don't trust the inumber
+ * or the allocation state; therefore, perform an untrusted lookup.  We don't
+ * want these inodes to pollute the cache, so mark them for immediate removal.
+ */
+#define XCHK_IGET_FLAGS	(XFS_IGET_UNTRUSTED | XFS_IGET_DONTCACHE)
+
 /* Type info and names for the scrub types. */
 enum xchk_type {
 	ST_NONE = 1,	/* disabled */
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/stats.c
+++ linux-qcom-6.8.0/fs/xfs/scrub/stats.c
@@ -329,9 +329,9 @@
 	if (!cs->cs_debugfs)
 		return;
 
-	debugfs_create_file("stats", 0644, cs->cs_debugfs, cs,
+	debugfs_create_file("stats", 0444, cs->cs_debugfs, cs,
 			&scrub_stats_fops);
-	debugfs_create_file("clear_stats", 0400, cs->cs_debugfs, cs,
+	debugfs_create_file("clear_stats", 0200, cs->cs_debugfs, cs,
 			&clear_scrub_stats_fops);
 }
 
--- linux-qcom-6.8.0.orig/fs/xfs/scrub/trace.h
+++ linux-qcom-6.8.0/fs/xfs/scrub/trace.h
@@ -476,7 +476,7 @@
 	TP_fast_assign(
 		xfs_fsblock_t fsbno = xchk_btree_cur_fsbno(cur, level);
 		__entry->dev = sc->mp->m_super->s_dev;
-		__entry->ino = sc->ip->i_ino;
+		__entry->ino = cur->bc_ino.ip->i_ino;
 		__entry->whichfork = cur->bc_ino.whichfork;
 		__entry->type = sc->sm->sm_type;
 		__entry->btnum = cur->bc_btnum;
@@ -834,18 +834,16 @@
 	TP_STRUCT__entry(
 		__field(dev_t, dev)
 		__field(unsigned long, ino)
-		__array(char, pathname, 256)
+		__array(char, pathname, MAXNAMELEN)
 	),
 	TP_fast_assign(
-		char		pathname[257];
 		char		*path;
 
 		__entry->ino = file_inode(xf->file)->i_ino;
-		memset(pathname, 0, sizeof(pathname));
-		path = file_path(xf->file, pathname, sizeof(pathname) - 1);
+		path = file_path(xf->file, __entry->pathname, MAXNAMELEN);
 		if (IS_ERR(path))
-			path = "(unknown)";
-		strncpy(__entry->pathname, path, sizeof(__entry->pathname));
+			strncpy(__entry->pathname, "(unknown)",
+					sizeof(__entry->pathname));
 	),
 	TP_printk("xfino 0x%lx path '%s'",
 		  __entry->ino,
--- linux-qcom-6.8.0.orig/fs/xfs/xfs.h
+++ linux-qcom-6.8.0/fs/xfs/xfs.h
@@ -10,6 +10,10 @@
 #define DEBUG 1
 #endif
 
+#ifdef CONFIG_XFS_DEBUG_EXPENSIVE
+#define DEBUG_EXPENSIVE 1
+#endif
+
 #ifdef CONFIG_XFS_ASSERT_FATAL
 #define XFS_ASSERT_FATAL 1
 #endif
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_aops.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_aops.c
@@ -233,45 +233,6 @@
 	return true;
 }
 
-/*
- * Pass in a dellalloc extent and convert it to real extents, return the real
- * extent that maps offset_fsb in wpc->iomap.
- *
- * The current page is held locked so nothing could have removed the block
- * backing offset_fsb, although it could have moved from the COW to the data
- * fork by another thread.
- */
-static int
-xfs_convert_blocks(
-	struct iomap_writepage_ctx *wpc,
-	struct xfs_inode	*ip,
-	int			whichfork,
-	loff_t			offset)
-{
-	int			error;
-	unsigned		*seq;
-
-	if (whichfork == XFS_COW_FORK)
-		seq = &XFS_WPC(wpc)->cow_seq;
-	else
-		seq = &XFS_WPC(wpc)->data_seq;
-
-	/*
-	 * Attempt to allocate whatever delalloc extent currently backs offset
-	 * and put the result into wpc->iomap.  Allocate in a loop because it
-	 * may take several attempts to allocate real blocks for a contiguous
-	 * delalloc extent if free space is sufficiently fragmented.
-	 */
-	do {
-		error = xfs_bmapi_convert_delalloc(ip, whichfork, offset,
-				&wpc->iomap, seq);
-		if (error)
-			return error;
-	} while (wpc->iomap.offset + wpc->iomap.length <= offset);
-
-	return 0;
-}
-
 static int
 xfs_map_blocks(
 	struct iomap_writepage_ctx *wpc,
@@ -289,6 +250,7 @@
 	struct xfs_iext_cursor	icur;
 	int			retries = 0;
 	int			error = 0;
+	unsigned int		*seq;
 
 	if (xfs_is_shutdown(mp))
 		return -EIO;
@@ -386,7 +348,19 @@
 	trace_xfs_map_blocks_found(ip, offset, count, whichfork, &imap);
 	return 0;
 allocate_blocks:
-	error = xfs_convert_blocks(wpc, ip, whichfork, offset);
+	/*
+	 * Convert a dellalloc extent to a real one. The current page is held
+	 * locked so nothing could have removed the block backing offset_fsb,
+	 * although it could have moved from the COW to the data fork by another
+	 * thread.
+	 */
+	if (whichfork == XFS_COW_FORK)
+		seq = &XFS_WPC(wpc)->cow_seq;
+	else
+		seq = &XFS_WPC(wpc)->data_seq;
+
+	error = xfs_bmapi_convert_delalloc(ip, whichfork, offset,
+				&wpc->iomap, seq);
 	if (error) {
 		/*
 		 * If we failed to find the extent in the COW fork we might have
@@ -502,13 +476,6 @@
 {
 	struct xfs_writepage_ctx wpc = { };
 
-	/*
-	 * Writing back data in a transaction context can result in recursive
-	 * transactions. This is bad, so issue a warning and get out of here.
-	 */
-	if (WARN_ON_ONCE(current->journal_info))
-		return 0;
-
 	xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED);
 	return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops);
 }
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_attr_item.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_attr_item.c
@@ -466,6 +466,9 @@
 	unsigned int			op = attrp->alfi_op_flags &
 					     XFS_ATTRI_OP_FLAGS_TYPE_MASK;
 
+	if (!xfs_sb_version_haslogxattrs(&mp->m_sb))
+		return false;
+
 	if (attrp->__pad != 0)
 		return false;
 
@@ -475,6 +478,10 @@
 	if (attrp->alfi_attr_filter & ~XFS_ATTRI_FILTER_MASK)
 		return false;
 
+	if (!xfs_attr_check_namespace(attrp->alfi_attr_filter &
+				      XFS_ATTR_NSP_ONDISK_MASK))
+		return false;
+
 	/* alfi_op_flags should be either a set or remove */
 	switch (op) {
 	case XFS_ATTRI_OP_FLAGS_SET:
@@ -538,8 +545,6 @@
 	args->op_flags = XFS_DA_OP_RECOVERY | XFS_DA_OP_OKNOENT |
 			 XFS_DA_OP_LOGGED;
 
-	ASSERT(xfs_sb_version_haslogxattrs(&mp->m_sb));
-
 	switch (attr->xattri_op_flags) {
 	case XFS_ATTRI_OP_FLAGS_SET:
 	case XFS_ATTRI_OP_FLAGS_REPLACE:
@@ -588,7 +593,8 @@
 	 */
 	attrp = &attrip->attri_format;
 	if (!xfs_attri_validate(mp, attrp) ||
-	    !xfs_attr_namecheck(nv->name.i_addr, nv->name.i_len))
+	    !xfs_attr_namecheck(attrp->alfi_attr_filter, nv->name.i_addr,
+				nv->name.i_len))
 		return -EFSCORRUPTED;
 
 	attr = xfs_attri_recover_work(mp, dfp, attrp, &ip, nv);
@@ -702,48 +708,112 @@
 	const void			*attr_value = NULL;
 	const void			*attr_name;
 	size_t				len;
-
-	attri_formatp = item->ri_buf[0].i_addr;
-	attr_name = item->ri_buf[1].i_addr;
+	unsigned int			op, i = 0;
 
 	/* Validate xfs_attri_log_format before the large memory allocation */
 	len = sizeof(struct xfs_attri_log_format);
-	if (item->ri_buf[0].i_len != len) {
+	if (item->ri_buf[i].i_len != len) {
 		XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
 				item->ri_buf[0].i_addr, item->ri_buf[0].i_len);
 		return -EFSCORRUPTED;
 	}
 
+	attri_formatp = item->ri_buf[i].i_addr;
 	if (!xfs_attri_validate(mp, attri_formatp)) {
 		XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
-				item->ri_buf[0].i_addr, item->ri_buf[0].i_len);
+				attri_formatp, len);
+		return -EFSCORRUPTED;
+	}
+
+	/* Check the number of log iovecs makes sense for the op code. */
+	op = attri_formatp->alfi_op_flags & XFS_ATTRI_OP_FLAGS_TYPE_MASK;
+	switch (op) {
+	case XFS_ATTRI_OP_FLAGS_SET:
+	case XFS_ATTRI_OP_FLAGS_REPLACE:
+		/* Log item, attr name, attr value */
+		if (item->ri_total != 3) {
+			XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+					     attri_formatp, len);
+			return -EFSCORRUPTED;
+		}
+		break;
+	case XFS_ATTRI_OP_FLAGS_REMOVE:
+		/* Log item, attr name */
+		if (item->ri_total != 2) {
+			XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+					     attri_formatp, len);
+			return -EFSCORRUPTED;
+		}
+		break;
+	default:
+		XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+				     attri_formatp, len);
 		return -EFSCORRUPTED;
 	}
+	i++;
 
 	/* Validate the attr name */
-	if (item->ri_buf[1].i_len !=
+	if (item->ri_buf[i].i_len !=
 			xlog_calc_iovec_len(attri_formatp->alfi_name_len)) {
 		XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
-				item->ri_buf[0].i_addr, item->ri_buf[0].i_len);
+				attri_formatp, len);
 		return -EFSCORRUPTED;
 	}
 
-	if (!xfs_attr_namecheck(attr_name, attri_formatp->alfi_name_len)) {
+	attr_name = item->ri_buf[i].i_addr;
+	if (!xfs_attr_namecheck(attri_formatp->alfi_attr_filter, attr_name,
+				attri_formatp->alfi_name_len)) {
 		XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
-				item->ri_buf[1].i_addr, item->ri_buf[1].i_len);
+				attri_formatp, len);
 		return -EFSCORRUPTED;
 	}
+	i++;
 
 	/* Validate the attr value, if present */
 	if (attri_formatp->alfi_value_len != 0) {
-		if (item->ri_buf[2].i_len != xlog_calc_iovec_len(attri_formatp->alfi_value_len)) {
+		if (item->ri_buf[i].i_len != xlog_calc_iovec_len(attri_formatp->alfi_value_len)) {
 			XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
 					item->ri_buf[0].i_addr,
 					item->ri_buf[0].i_len);
 			return -EFSCORRUPTED;
 		}
 
-		attr_value = item->ri_buf[2].i_addr;
+		attr_value = item->ri_buf[i].i_addr;
+		i++;
+	}
+
+	/*
+	 * Make sure we got the correct number of buffers for the operation
+	 * that we just loaded.
+	 */
+	if (i != item->ri_total) {
+		XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+				attri_formatp, len);
+		return -EFSCORRUPTED;
+	}
+
+	switch (op) {
+	case XFS_ATTRI_OP_FLAGS_REMOVE:
+		/* Regular remove operations operate only on names. */
+		if (attr_value != NULL || attri_formatp->alfi_value_len != 0) {
+			XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+					     attri_formatp, len);
+			return -EFSCORRUPTED;
+		}
+		fallthrough;
+	case XFS_ATTRI_OP_FLAGS_SET:
+	case XFS_ATTRI_OP_FLAGS_REPLACE:
+		/*
+		 * Regular xattr set/remove/replace operations require a name
+		 * and do not take a newname.  Values are optional for set and
+		 * replace.
+		 */
+		if (attr_name == NULL || attri_formatp->alfi_name_len == 0) {
+			XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+					     attri_formatp, len);
+			return -EFSCORRUPTED;
+		}
+		break;
 	}
 
 	/*
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_attr_list.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_attr_list.c
@@ -81,7 +81,8 @@
 	     (dp->i_af.if_bytes + sf->count * 16) < context->bufsize)) {
 		for (i = 0, sfe = xfs_attr_sf_firstentry(sf); i < sf->count; i++) {
 			if (XFS_IS_CORRUPT(context->dp->i_mount,
-					   !xfs_attr_namecheck(sfe->nameval,
+					   !xfs_attr_namecheck(sfe->flags,
+							       sfe->nameval,
 							       sfe->namelen)))
 				return -EFSCORRUPTED;
 			context->put_listent(context,
@@ -119,7 +120,8 @@
 	for (i = 0, sfe = xfs_attr_sf_firstentry(sf); i < sf->count; i++) {
 		if (unlikely(
 		    ((char *)sfe < (char *)sf) ||
-		    ((char *)sfe >= ((char *)sf + dp->i_af.if_bytes)))) {
+		    ((char *)sfe >= ((char *)sf + dp->i_af.if_bytes)) ||
+		    !xfs_attr_check_namespace(sfe->flags))) {
 			XFS_CORRUPTION_ERROR("xfs_attr_shortform_list",
 					     XFS_ERRLEVEL_LOW,
 					     context->dp->i_mount, sfe,
@@ -173,7 +175,7 @@
 			cursor->offset = 0;
 		}
 		if (XFS_IS_CORRUPT(context->dp->i_mount,
-				   !xfs_attr_namecheck(sbp->name,
+				   !xfs_attr_namecheck(sbp->flags, sbp->name,
 						       sbp->namelen))) {
 			error = -EFSCORRUPTED;
 			goto out;
@@ -464,7 +466,8 @@
 		}
 
 		if (XFS_IS_CORRUPT(context->dp->i_mount,
-				   !xfs_attr_namecheck(name, namelen)))
+				   !xfs_attr_namecheck(entry->flags, name,
+						       namelen)))
 			return -EFSCORRUPTED;
 		context->put_listent(context, entry->flags,
 					      name, namelen, valuelen);
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_bmap_util.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_bmap_util.c
@@ -111,7 +111,7 @@
 	struct xfs_mount	*mp = ip->i_mount;
 	struct xfs_ifork	*ifp = xfs_ifork_ptr(ip, whichfork);
 	struct xfs_btree_cur	*cur;
-	xfs_extlen_t		btblocks = 0;
+	xfs_filblks_t		btblocks = 0;
 	int			error;
 
 	*nextents = 0;
@@ -489,13 +489,11 @@
 
 /*
  * Test whether it is appropriate to check an inode for and free post EOF
- * blocks. The 'force' parameter determines whether we should also consider
- * regular files that are marked preallocated or append-only.
+ * blocks.
  */
 bool
 xfs_can_free_eofblocks(
-	struct xfs_inode	*ip,
-	bool			force)
+	struct xfs_inode	*ip)
 {
 	struct xfs_bmbt_irec	imap;
 	struct xfs_mount	*mp = ip->i_mount;
@@ -529,11 +527,11 @@
 		return false;
 
 	/*
-	 * Do not free real preallocated or append-only files unless the file
-	 * has delalloc blocks and we are forced to remove them.
+	 * Only free real extents for inodes with persistent preallocations or
+	 * the append-only flag.
 	 */
 	if (ip->i_diflags & (XFS_DIFLAG_PREALLOC | XFS_DIFLAG_APPEND))
-		if (!force || ip->i_delayed_blks == 0)
+		if (ip->i_delayed_blks == 0)
 			return false;
 
 	/*
@@ -587,6 +585,22 @@
 	/* Wait on dio to ensure i_size has settled. */
 	inode_dio_wait(VFS_I(ip));
 
+	/*
+	 * For preallocated files only free delayed allocations.
+	 *
+	 * Note that this means we also leave speculative preallocations in
+	 * place for preallocated files.
+	 */
+	if (ip->i_diflags & (XFS_DIFLAG_PREALLOC | XFS_DIFLAG_APPEND)) {
+		if (ip->i_delayed_blks) {
+			xfs_bmap_punch_delalloc_range(ip,
+				round_up(XFS_ISIZE(ip), mp->m_sb.sb_blocksize),
+				LLONG_MAX);
+		}
+		xfs_inode_clear_eofblocks_tag(ip);
+		return 0;
+	}
+
 	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, 0, 0, 0, &tp);
 	if (error) {
 		ASSERT(xfs_is_shutdown(mp));
@@ -721,33 +735,32 @@
 		if (error)
 			goto error;
 
-		error = xfs_bmapi_write(tp, ip, startoffset_fsb,
-				allocatesize_fsb, XFS_BMAPI_PREALLOC, 0, imapp,
-				&nimaps);
-		if (error)
-			goto error;
-
-		ip->i_diflags |= XFS_DIFLAG_PREALLOC;
-		xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-
-		error = xfs_trans_commit(tp);
-		xfs_iunlock(ip, XFS_ILOCK_EXCL);
-		if (error)
-			break;
-
 		/*
 		 * If the allocator cannot find a single free extent large
 		 * enough to cover the start block of the requested range,
-		 * xfs_bmapi_write will return 0 but leave *nimaps set to 0.
+		 * xfs_bmapi_write will return -ENOSR.
 		 *
 		 * In that case we simply need to keep looping with the same
 		 * startoffset_fsb so that one of the following allocations
 		 * will eventually reach the requested range.
 		 */
-		if (nimaps) {
+		error = xfs_bmapi_write(tp, ip, startoffset_fsb,
+				allocatesize_fsb, XFS_BMAPI_PREALLOC, 0, imapp,
+				&nimaps);
+		if (error) {
+			if (error != -ENOSR)
+				goto error;
+			error = 0;
+		} else {
 			startoffset_fsb += imapp->br_blockcount;
 			allocatesize_fsb -= imapp->br_blockcount;
 		}
+
+		ip->i_diflags |= XFS_DIFLAG_PREALLOC;
+		xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+
+		error = xfs_trans_commit(tp);
+		xfs_iunlock(ip, XFS_ILOCK_EXCL);
 	}
 
 	return error;
@@ -803,14 +816,18 @@
 	xfs_off_t		offset,
 	xfs_off_t		len)
 {
-	struct xfs_mount	*mp = ip->i_mount;
 	struct inode		*inode = VFS_I(ip);
 	xfs_off_t		rounding, start, end;
 	int			error;
 
-	rounding = max_t(xfs_off_t, mp->m_sb.sb_blocksize, PAGE_SIZE);
-	start = round_down(offset, rounding);
-	end = round_up(offset + len, rounding) - 1;
+	/*
+	 * Make sure we extend the flush out to extent alignment
+	 * boundaries so any extent range overlapping the start/end
+	 * of the modification we are about to do is clean and idle.
+	 */
+	rounding = max_t(xfs_off_t, xfs_inode_alloc_unitsize(ip), PAGE_SIZE);
+	start = rounddown_64(offset, rounding);
+	end = roundup_64(offset + len, rounding) - 1;
 
 	error = filemap_write_and_wait_range(inode->i_mapping, start, end);
 	if (error)
@@ -893,14 +910,14 @@
 	struct xfs_inode	*ip,
 	loff_t			offset)
 {
-	struct xfs_mount	*mp = ip->i_mount;
+	unsigned int		rounding;
 	int			error;
 
 	/*
 	 * Trim eofblocks to avoid shifting uninitialized post-eof preallocation
 	 * into the accessible region of the file.
 	 */
-	if (xfs_can_free_eofblocks(ip, true)) {
+	if (xfs_can_free_eofblocks(ip)) {
 		error = xfs_free_eofblocks(ip);
 		if (error)
 			return error;
@@ -911,11 +928,13 @@
 	 * with the full range of the operation. If we don't, a COW writeback
 	 * completion could race with an insert, front merge with the start
 	 * extent (after split) during the shift and corrupt the file. Start
-	 * with the block just prior to the start to stabilize the boundary.
+	 * with the allocation unit just prior to the start to stabilize the
+	 * boundary.
 	 */
-	offset = round_down(offset, mp->m_sb.sb_blocksize);
+	rounding = xfs_inode_alloc_unitsize(ip);
+	offset = rounddown_64(offset, rounding);
 	if (offset)
-		offset -= mp->m_sb.sb_blocksize;
+		offset -= rounding;
 
 	/*
 	 * Writeback and invalidate cache for the remainder of the file as we're
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_bmap_util.h
+++ linux-qcom-6.8.0/fs/xfs/xfs_bmap_util.h
@@ -63,7 +63,7 @@
 				xfs_off_t len);
 
 /* EOF block manipulation functions */
-bool	xfs_can_free_eofblocks(struct xfs_inode *ip, bool force);
+bool	xfs_can_free_eofblocks(struct xfs_inode *ip);
 int	xfs_free_eofblocks(struct xfs_inode *ip);
 
 int	xfs_swap_extents(struct xfs_inode *ip, struct xfs_inode *tip,
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_buf_item.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_buf_item.c
@@ -22,6 +22,7 @@
 #include "xfs_trace.h"
 #include "xfs_log.h"
 #include "xfs_log_priv.h"
+#include "xfs_error.h"
 
 
 struct kmem_cache	*xfs_buf_item_cache;
@@ -781,8 +782,39 @@
 	return lsn;
 }
 
+#ifdef DEBUG_EXPENSIVE
+static int
+xfs_buf_item_precommit(
+	struct xfs_trans	*tp,
+	struct xfs_log_item	*lip)
+{
+	struct xfs_buf_log_item	*bip = BUF_ITEM(lip);
+	struct xfs_buf		*bp = bip->bli_buf;
+	struct xfs_mount	*mp = bp->b_mount;
+	xfs_failaddr_t		fa;
+
+	if (!bp->b_ops || !bp->b_ops->verify_struct)
+		return 0;
+	if (bip->bli_flags & XFS_BLI_STALE)
+		return 0;
+
+	fa = bp->b_ops->verify_struct(bp);
+	if (fa) {
+		xfs_buf_verifier_error(bp, -EFSCORRUPTED, bp->b_ops->name,
+				bp->b_addr, BBTOB(bp->b_length), fa);
+		xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
+		ASSERT(fa == NULL);
+	}
+
+	return 0;
+}
+#else
+# define xfs_buf_item_precommit	NULL
+#endif
+
 static const struct xfs_item_ops xfs_buf_item_ops = {
 	.iop_size	= xfs_buf_item_size,
+	.iop_precommit	= xfs_buf_item_precommit,
 	.iop_format	= xfs_buf_item_format,
 	.iop_pin	= xfs_buf_item_pin,
 	.iop_unpin	= xfs_buf_item_unpin,
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_dquot.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_dquot.c
@@ -333,7 +333,6 @@
 		goto err_cancel;
 
 	ASSERT(map.br_blockcount == XFS_DQUOT_CLUSTER_SIZE_FSB);
-	ASSERT(nmaps == 1);
 	ASSERT((map.br_startblock != DELAYSTARTBLOCK) &&
 	       (map.br_startblock != HOLESTARTBLOCK));
 
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_dquot_item.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_dquot_item.c
@@ -17,6 +17,7 @@
 #include "xfs_trans_priv.h"
 #include "xfs_qm.h"
 #include "xfs_log.h"
+#include "xfs_error.h"
 
 static inline struct xfs_dq_logitem *DQUOT_ITEM(struct xfs_log_item *lip)
 {
@@ -193,8 +194,38 @@
 	return xfs_qm_dquot_logitem_release(lip);
 }
 
+#ifdef DEBUG_EXPENSIVE
+static int
+xfs_qm_dquot_logitem_precommit(
+	struct xfs_trans	*tp,
+	struct xfs_log_item	*lip)
+{
+	struct xfs_dquot	*dqp = DQUOT_ITEM(lip)->qli_dquot;
+	struct xfs_mount	*mp = dqp->q_mount;
+	struct xfs_disk_dquot	ddq = { };
+	xfs_failaddr_t		fa;
+
+	xfs_dquot_to_disk(&ddq, dqp);
+	fa = xfs_dquot_verify(mp, &ddq, dqp->q_id);
+	if (fa) {
+		XFS_CORRUPTION_ERROR("Bad dquot during logging",
+				XFS_ERRLEVEL_LOW, mp, &ddq, sizeof(ddq));
+		xfs_alert(mp,
+ "Metadata corruption detected at %pS, dquot 0x%x",
+				fa, dqp->q_id);
+		xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
+		ASSERT(fa == NULL);
+	}
+
+	return 0;
+}
+#else
+# define xfs_qm_dquot_logitem_precommit	NULL
+#endif
+
 static const struct xfs_item_ops xfs_dquot_item_ops = {
 	.iop_size	= xfs_qm_dquot_logitem_size,
+	.iop_precommit	= xfs_qm_dquot_logitem_precommit,
 	.iop_format	= xfs_qm_dquot_logitem_format,
 	.iop_pin	= xfs_qm_dquot_logitem_pin,
 	.iop_unpin	= xfs_qm_dquot_logitem_unpin,
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_file.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_file.c
@@ -24,6 +24,7 @@
 #include "xfs_pnfs.h"
 #include "xfs_iomap.h"
 #include "xfs_reflink.h"
+#include "xfs_file.h"
 
 #include <linux/dax.h>
 #include <linux/falloc.h>
@@ -38,33 +39,25 @@
  * Decide if the given file range is aligned to the size of the fundamental
  * allocation unit for the file.
  */
-static bool
+bool
 xfs_is_falloc_aligned(
 	struct xfs_inode	*ip,
 	loff_t			pos,
 	long long int		len)
 {
-	struct xfs_mount	*mp = ip->i_mount;
-	uint64_t		mask;
+	unsigned int		alloc_unit = xfs_inode_alloc_unitsize(ip);
 
-	if (XFS_IS_REALTIME_INODE(ip)) {
-		if (!is_power_of_2(mp->m_sb.sb_rextsize)) {
-			u64	rextbytes;
-			u32	mod;
-
-			rextbytes = XFS_FSB_TO_B(mp, mp->m_sb.sb_rextsize);
-			div_u64_rem(pos, rextbytes, &mod);
-			if (mod)
-				return false;
-			div_u64_rem(len, rextbytes, &mod);
-			return mod == 0;
-		}
-		mask = XFS_FSB_TO_B(mp, mp->m_sb.sb_rextsize) - 1;
-	} else {
-		mask = mp->m_sb.sb_blocksize - 1;
+	if (!is_power_of_2(alloc_unit)) {
+		u32	mod;
+
+		div_u64_rem(pos, alloc_unit, &mod);
+		if (mod)
+			return false;
+		div_u64_rem(len, alloc_unit, &mod);
+		return mod == 0;
 	}
 
-	return !((pos | len) & mask);
+	return !((pos | len) & (alloc_unit - 1));
 }
 
 /*
@@ -1220,6 +1213,14 @@
 	xfs_iunlock2_remapping(src, dest);
 	if (ret)
 		trace_xfs_reflink_remap_range_error(dest, ret, _RET_IP_);
+	/*
+	 * If the caller did not set CAN_SHORTEN, then it is not prepared to
+	 * handle partial results -- either the whole remap succeeds, or we
+	 * must say why it did not.  In this case, any error should be returned
+	 * to the caller.
+	 */
+	if (ret && remapped < len && !(remap_flags & REMAP_FILE_CAN_SHORTEN))
+		return ret;
 	return remapped > 0 ? remapped : ret;
 }
 
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_file.h
+++ linux-qcom-6.8.0/fs/xfs/xfs_file.h
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2000-2005 Silicon Graphics, Inc.
+ * All Rights Reserved.
+ */
+#ifndef __XFS_FILE_H__
+#define __XFS_FILE_H__
+
+extern const struct file_operations xfs_file_operations;
+extern const struct file_operations xfs_dir_file_operations;
+
+bool xfs_is_falloc_aligned(struct xfs_inode *ip, loff_t pos,
+		long long int len);
+
+#endif /* __XFS_FILE_H__ */
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_filestream.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_filestream.c
@@ -64,7 +64,7 @@
 	struct xfs_perag	*pag;
 	struct xfs_perag	*max_pag = NULL;
 	xfs_extlen_t		minlen = *longest;
-	xfs_extlen_t		free = 0, minfree, maxfree = 0;
+	xfs_extlen_t		minfree, maxfree = 0;
 	xfs_agnumber_t		agno;
 	bool			first_pass = true;
 	int			err;
@@ -107,7 +107,6 @@
 			     !(flags & XFS_PICK_USERDATA) ||
 			     (flags & XFS_PICK_LOWSPACE))) {
 				/* Break out, retaining the reference on the AG. */
-				free = pag->pagf_freeblks;
 				break;
 			}
 		}
@@ -150,23 +149,25 @@
 		 * grab.
 		 */
 		if (!max_pag) {
-			for_each_perag_wrap(args->mp, 0, start_agno, args->pag)
+			for_each_perag_wrap(args->mp, 0, start_agno, pag) {
+				max_pag = pag;
 				break;
-			atomic_inc(&args->pag->pagf_fstrms);
-			*longest = 0;
-		} else {
-			pag = max_pag;
-			free = maxfree;
-			atomic_inc(&pag->pagf_fstrms);
+			}
+
+			/* Bail if there are no AGs at all to select from. */
+			if (!max_pag)
+				return -ENOSPC;
 		}
+
+		pag = max_pag;
+		atomic_inc(&pag->pagf_fstrms);
 	} else if (max_pag) {
 		xfs_perag_rele(max_pag);
 	}
 
-	trace_xfs_filestream_pick(pag, pino, free);
+	trace_xfs_filestream_pick(pag, pino);
 	args->pag = pag;
 	return 0;
-
 }
 
 static struct xfs_inode *
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_fsmap.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_fsmap.c
@@ -71,7 +71,7 @@
 	switch (src->fmr_owner) {
 	case 0:			/* "lowest owner id possible" */
 	case -1ULL:		/* "highest owner id possible" */
-		dest->rm_owner = 0;
+		dest->rm_owner = src->fmr_owner;
 		break;
 	case XFS_FMR_OWN_FREE:
 		dest->rm_owner = XFS_RMAP_OWN_NULL;
@@ -252,7 +252,7 @@
 	const struct xfs_rmap_irec	*rec,
 	xfs_daddr_t			rec_daddr)
 {
-	if (info->low_daddr != -1ULL)
+	if (info->low_daddr != XFS_BUF_DADDR_NULL)
 		return rec_daddr < info->low_daddr;
 	if (info->low.rm_blockcount)
 		return xfs_rmap_compare(rec, &info->low) < 0;
@@ -983,7 +983,7 @@
 		info.dev = handlers[i].dev;
 		info.last = false;
 		info.pag = NULL;
-		info.low_daddr = -1ULL;
+		info.low_daddr = XFS_BUF_DADDR_NULL;
 		info.low.rm_blockcount = 0;
 		error = handlers[i].fn(tp, dkeys, &info);
 		if (error)
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_icache.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_icache.c
@@ -1149,7 +1149,7 @@
 	}
 	*lockflags |= XFS_IOLOCK_EXCL;
 
-	if (xfs_can_free_eofblocks(ip, false))
+	if (xfs_can_free_eofblocks(ip))
 		return xfs_free_eofblocks(ip);
 
 	/* inode could be preallocated or append-only */
@@ -2031,8 +2031,10 @@
  *  - Memory shrinkers queued the inactivation worker and it hasn't finished.
  *  - The queue depth exceeds the maximum allowable percpu backlog.
  *
- * Note: If the current thread is running a transaction, we don't ever want to
- * wait for other transactions because that could introduce a deadlock.
+ * Note: If we are in a NOFS context here (e.g. current thread is running a
+ * transaction) the we don't want to block here as inodegc progress may require
+ * filesystem resources we hold to make progress and that could result in a
+ * deadlock. Hence we skip out of here if we are in a scoped NOFS context.
  */
 static inline bool
 xfs_inodegc_want_flush_work(
@@ -2040,7 +2042,7 @@
 	unsigned int		items,
 	unsigned int		shrinker_hits)
 {
-	if (current->journal_info)
+	if (current->flags & PF_MEMALLOC_NOFS)
 		return false;
 
 	if (shrinker_hits > 0)
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_inode.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_inode.c
@@ -981,10 +981,12 @@
 	prid = xfs_get_initial_prid(dp);
 
 	/*
-	 * Make sure that we have allocated dquot(s) on disk.
+	 * Make sure that we have allocated dquot(s) on disk.  The uid/gid
+	 * computation code must match what the VFS uses to assign i_[ug]id.
+	 * INHERIT adjusts the gid computation for setgid/grpid systems.
 	 */
-	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(idmap, &init_user_ns),
-			mapped_fsgid(idmap, &init_user_ns), prid,
+	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(idmap, i_user_ns(VFS_I(dp))),
+			mapped_fsgid(idmap, i_user_ns(VFS_I(dp))), prid,
 			XFS_QMOPT_QUOTALL | XFS_QMOPT_INHERIT,
 			&udqp, &gdqp, &pdqp);
 	if (error)
@@ -1130,10 +1132,12 @@
 	prid = xfs_get_initial_prid(dp);
 
 	/*
-	 * Make sure that we have allocated dquot(s) on disk.
+	 * Make sure that we have allocated dquot(s) on disk.  The uid/gid
+	 * computation code must match what the VFS uses to assign i_[ug]id.
+	 * INHERIT adjusts the gid computation for setgid/grpid systems.
 	 */
-	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(idmap, &init_user_ns),
-			mapped_fsgid(idmap, &init_user_ns), prid,
+	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(idmap, i_user_ns(VFS_I(dp))),
+			mapped_fsgid(idmap, i_user_ns(VFS_I(dp))), prid,
 			XFS_QMOPT_QUOTALL | XFS_QMOPT_INHERIT,
 			&udqp, &gdqp, &pdqp);
 	if (error)
@@ -1240,8 +1244,19 @@
 	 */
 	if (unlikely((tdp->i_diflags & XFS_DIFLAG_PROJINHERIT) &&
 		     tdp->i_projid != sip->i_projid)) {
-		error = -EXDEV;
-		goto error_return;
+		/*
+		 * Project quota setup skips special files which can
+		 * leave inodes in a PROJINHERIT directory without a
+		 * project ID set. We need to allow links to be made
+		 * to these "project-less" inodes because userspace
+		 * expects them to succeed after project ID setup,
+		 * but everything else should be rejected.
+		 */
+		if (!special_file(VFS_I(sip)->i_mode) ||
+		    sip->i_projid != 0) {
+			error = -EXDEV;
+			goto error_return;
+		}
 	}
 
 	if (!resblks) {
@@ -1449,7 +1464,7 @@
 	if (!xfs_ilock_nowait(ip, XFS_IOLOCK_EXCL))
 		return 0;
 
-	if (xfs_can_free_eofblocks(ip, false)) {
+	if (xfs_can_free_eofblocks(ip)) {
 		/*
 		 * Check if the inode is being opened, written and closed
 		 * frequently and we have delayed allocation blocks outstanding
@@ -1665,15 +1680,13 @@
 
 	/*
 	 * This file isn't being freed, so check if there are post-eof blocks
-	 * to free.  @force is true because we are evicting an inode from the
-	 * cache.  Post-eof blocks must be freed, lest we end up with broken
-	 * free space accounting.
+	 * to free.
 	 *
 	 * Note: don't bother with iolock here since lockdep complains about
 	 * acquiring it in reclaim context. We have the only reference to the
 	 * inode at this point anyways.
 	 */
-	return xfs_can_free_eofblocks(ip, true);
+	return xfs_can_free_eofblocks(ip);
 }
 
 /*
@@ -1721,15 +1734,11 @@
 
 	if (VFS_I(ip)->i_nlink != 0) {
 		/*
-		 * force is true because we are evicting an inode from the
-		 * cache. Post-eof blocks must be freed, lest we end up with
-		 * broken free space accounting.
-		 *
 		 * Note: don't bother with iolock here since lockdep complains
 		 * about acquiring it in reclaim context. We have the only
 		 * reference to the inode at this point anyways.
 		 */
-		if (xfs_can_free_eofblocks(ip, true))
+		if (xfs_can_free_eofblocks(ip))
 			error = xfs_free_eofblocks(ip);
 
 		goto out;
@@ -2309,11 +2318,26 @@
 		 * This buffer may not have been correctly initialised as we
 		 * didn't read it from disk. That's not important because we are
 		 * only using to mark the buffer as stale in the log, and to
-		 * attach stale cached inodes on it. That means it will never be
-		 * dispatched for IO. If it is, we want to know about it, and we
-		 * want it to fail. We can acheive this by adding a write
-		 * verifier to the buffer.
+		 * attach stale cached inodes on it.
+		 *
+		 * For the inode that triggered the cluster freeing, this
+		 * attachment may occur in xfs_inode_item_precommit() after we
+		 * have marked this buffer stale.  If this buffer was not in
+		 * memory before xfs_ifree_cluster() started, it will not be
+		 * marked XBF_DONE and this will cause problems later in
+		 * xfs_inode_item_precommit() when we trip over a (stale, !done)
+		 * buffer to attached to the transaction.
+		 *
+		 * Hence we have to mark the buffer as XFS_DONE here. This is
+		 * safe because we are also marking the buffer as XBF_STALE and
+		 * XFS_BLI_STALE. That means it will never be dispatched for
+		 * IO and it won't be unlocked until the cluster freeing has
+		 * been committed to the journal and the buffer unpinned. If it
+		 * is written, we want to know about it, and we want it to
+		 * fail. We can acheive this by adding a write verifier to the
+		 * buffer.
 		 */
+		bp->b_flags |= XBF_DONE;
 		bp->b_ops = &xfs_inode_buf_ops;
 
 		/*
@@ -3777,3 +3801,16 @@
 		return false;
 	}
 }
+
+/* Returns the size of fundamental allocation unit for a file, in bytes. */
+unsigned int
+xfs_inode_alloc_unitsize(
+	struct xfs_inode	*ip)
+{
+	unsigned int		blocks = 1;
+
+	if (XFS_IS_REALTIME_INODE(ip))
+		blocks = ip->i_mount->m_sb.sb_rextsize;
+
+	return XFS_FSB_TO_B(ip->i_mount, blocks);
+}
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_inode.h
+++ linux-qcom-6.8.0/fs/xfs/xfs_inode.h
@@ -624,4 +624,6 @@
 
 bool xfs_ifork_zapped(const struct xfs_inode *ip, int whichfork);
 
+unsigned int xfs_inode_alloc_unitsize(struct xfs_inode *ip);
+
 #endif	/* __XFS_INODE_H__ */
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_inode_item.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_inode_item.c
@@ -37,6 +37,36 @@
 	return INODE_ITEM(lip)->ili_inode->i_ino;
 }
 
+#ifdef DEBUG_EXPENSIVE
+static void
+xfs_inode_item_precommit_check(
+	struct xfs_inode	*ip)
+{
+	struct xfs_mount	*mp = ip->i_mount;
+	struct xfs_dinode	*dip;
+	xfs_failaddr_t		fa;
+
+	dip = kzalloc(mp->m_sb.sb_inodesize, GFP_KERNEL | GFP_NOFS);
+	if (!dip) {
+		ASSERT(dip != NULL);
+		return;
+	}
+
+	xfs_inode_to_disk(ip, dip, 0);
+	xfs_dinode_calc_crc(mp, dip);
+	fa = xfs_dinode_verify(mp, ip->i_ino, dip);
+	if (fa) {
+		xfs_inode_verifier_error(ip, -EFSCORRUPTED, __func__, dip,
+				sizeof(*dip), fa);
+		xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
+		ASSERT(fa == NULL);
+	}
+	kfree(dip);
+}
+#else
+# define xfs_inode_item_precommit_check(ip)	((void)0)
+#endif
+
 /*
  * Prior to finally logging the inode, we have to ensure that all the
  * per-modification inode state changes are applied. This includes VFS inode
@@ -169,6 +199,8 @@
 	iip->ili_fields |= (flags | iip->ili_last_fields);
 	spin_unlock(&iip->ili_lock);
 
+	xfs_inode_item_precommit_check(ip);
+
 	/*
 	 * We are done with the log item transaction dirty state, so clear it so
 	 * that it doesn't pollute future transactions.
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_ioctl.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_ioctl.c
@@ -39,6 +39,7 @@
 #include "xfs_ioctl.h"
 #include "xfs_xattr.h"
 #include "xfs_rtbitmap.h"
+#include "xfs_file.h"
 
 #include <linux/mount.h>
 #include <linux/namei.h>
@@ -1128,6 +1129,17 @@
 		/* Can't change realtime flag if any extents are allocated. */
 		if (ip->i_df.if_nextents || ip->i_delayed_blks)
 			return -EINVAL;
+
+		/*
+		 * If S_DAX is enabled on this file, we can only switch the
+		 * device if both support fsdax.  We can't update S_DAX because
+		 * there might be other threads walking down the access paths.
+		 */
+		if (IS_DAX(VFS_I(ip)) &&
+		    (mp->m_ddev_targp->bt_daxdev == NULL ||
+		     (mp->m_rtdev_targp &&
+		      mp->m_rtdev_targp->bt_daxdev == NULL)))
+			return -EINVAL;
 	}
 
 	if (rtflag) {
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_iomap.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_iomap.c
@@ -317,14 +317,6 @@
 	if (error)
 		goto out_unlock;
 
-	/*
-	 * Copy any maps to caller's array and return any error.
-	 */
-	if (nimaps == 0) {
-		error = -ENOSPC;
-		goto out_unlock;
-	}
-
 	if (unlikely(!xfs_valid_startblock(ip, imap->br_startblock)))
 		error = xfs_alert_fsblock_zero(ip, imap);
 
@@ -1014,6 +1006,24 @@
 	}
 
 	/*
+	 * For zeroing, trim a delalloc extent that extends beyond the EOF
+	 * block.  If it starts beyond the EOF block, convert it to an
+	 * unwritten extent.
+	 */
+	if ((flags & IOMAP_ZERO) && imap.br_startoff <= offset_fsb &&
+	    isnullstartblock(imap.br_startblock)) {
+		xfs_fileoff_t eof_fsb = XFS_B_TO_FSB(mp, XFS_ISIZE(ip));
+
+		if (offset_fsb >= eof_fsb)
+			goto convert_delay;
+		if (end_fsb > eof_fsb) {
+			end_fsb = eof_fsb;
+			xfs_trim_extent(&imap, offset_fsb,
+					end_fsb - offset_fsb);
+		}
+	}
+
+	/*
 	 * Search the COW fork extent list even if we did not find a data fork
 	 * extent.  This serves two purposes: first this implements the
 	 * speculative preallocation using cowextsize, so that we also unshare
@@ -1117,47 +1127,48 @@
 		}
 	}
 
-retry:
-	error = xfs_bmapi_reserve_delalloc(ip, allocfork, offset_fsb,
-			end_fsb - offset_fsb, prealloc_blocks,
-			allocfork == XFS_DATA_FORK ? &imap : &cmap,
-			allocfork == XFS_DATA_FORK ? &icur : &ccur,
-			allocfork == XFS_DATA_FORK ? eof : cow_eof);
-	switch (error) {
-	case 0:
-		break;
-	case -ENOSPC:
-	case -EDQUOT:
-		/* retry without any preallocation */
-		trace_xfs_delalloc_enospc(ip, offset, count);
-		if (prealloc_blocks) {
-			prealloc_blocks = 0;
-			goto retry;
-		}
-		fallthrough;
-	default:
-		goto out_unlock;
-	}
-
 	if (allocfork == XFS_COW_FORK) {
+		error = xfs_bmapi_reserve_delalloc(ip, allocfork, offset_fsb,
+				end_fsb - offset_fsb, prealloc_blocks, &cmap,
+				&ccur, cow_eof);
+		if (error)
+			goto out_unlock;
+
 		trace_xfs_iomap_alloc(ip, offset, count, allocfork, &cmap);
 		goto found_cow;
 	}
 
+	error = xfs_bmapi_reserve_delalloc(ip, allocfork, offset_fsb,
+			end_fsb - offset_fsb, prealloc_blocks, &imap, &icur,
+			eof);
+	if (error)
+		goto out_unlock;
+
 	/*
 	 * Flag newly allocated delalloc blocks with IOMAP_F_NEW so we punch
 	 * them out if the write happens to fail.
 	 */
 	seq = xfs_iomap_inode_sequence(ip, IOMAP_F_NEW);
-	xfs_iunlock(ip, XFS_ILOCK_EXCL);
+	xfs_iunlock(ip, lockmode);
 	trace_xfs_iomap_alloc(ip, offset, count, allocfork, &imap);
 	return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, IOMAP_F_NEW, seq);
 
 found_imap:
 	seq = xfs_iomap_inode_sequence(ip, 0);
-	xfs_iunlock(ip, XFS_ILOCK_EXCL);
+	xfs_iunlock(ip, lockmode);
 	return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, 0, seq);
 
+convert_delay:
+	xfs_iunlock(ip, lockmode);
+	truncate_pagecache(inode, offset);
+	error = xfs_bmapi_convert_delalloc(ip, XFS_DATA_FORK, offset,
+					   iomap, NULL);
+	if (error)
+		return error;
+
+	trace_xfs_iomap_alloc(ip, offset, count, XFS_DATA_FORK, &imap);
+	return 0;
+
 found_cow:
 	seq = xfs_iomap_inode_sequence(ip, 0);
 	if (imap.br_startoff <= offset_fsb) {
@@ -1165,17 +1176,17 @@
 		if (error)
 			goto out_unlock;
 		seq = xfs_iomap_inode_sequence(ip, IOMAP_F_SHARED);
-		xfs_iunlock(ip, XFS_ILOCK_EXCL);
+		xfs_iunlock(ip, lockmode);
 		return xfs_bmbt_to_iomap(ip, iomap, &cmap, flags,
 					 IOMAP_F_SHARED, seq);
 	}
 
 	xfs_trim_extent(&cmap, offset_fsb, imap.br_startoff - offset_fsb);
-	xfs_iunlock(ip, XFS_ILOCK_EXCL);
+	xfs_iunlock(ip, lockmode);
 	return xfs_bmbt_to_iomap(ip, iomap, &cmap, flags, 0, seq);
 
 out_unlock:
-	xfs_iunlock(ip, XFS_ILOCK_EXCL);
+	xfs_iunlock(ip, lockmode);
 	return error;
 }
 
@@ -1323,7 +1334,7 @@
 	if (cow_fsb != NULLFILEOFF && cow_fsb <= offset_fsb) {
 		if (data_fsb < cow_fsb + cmap.br_blockcount)
 			end_fsb = min(end_fsb, data_fsb);
-		xfs_trim_extent(&cmap, offset_fsb, end_fsb);
+		xfs_trim_extent(&cmap, offset_fsb, end_fsb - offset_fsb);
 		seq = xfs_iomap_inode_sequence(ip, IOMAP_F_SHARED);
 		error = xfs_bmbt_to_iomap(ip, iomap, &cmap, flags,
 				IOMAP_F_SHARED, seq);
@@ -1348,7 +1359,7 @@
 	imap.br_state = XFS_EXT_NORM;
 done:
 	seq = xfs_iomap_inode_sequence(ip, 0);
-	xfs_trim_extent(&imap, offset_fsb, end_fsb);
+	xfs_trim_extent(&imap, offset_fsb, end_fsb - offset_fsb);
 	error = xfs_bmbt_to_iomap(ip, iomap, &imap, flags, 0, seq);
 out_unlock:
 	xfs_iunlock(ip, lockmode);
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_iops.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_iops.c
@@ -25,6 +25,7 @@
 #include "xfs_error.h"
 #include "xfs_ioctl.h"
 #include "xfs_xattr.h"
+#include "xfs_file.h"
 
 #include <linux/posix_acl.h>
 #include <linux/security.h>
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_iops.h
+++ linux-qcom-6.8.0/fs/xfs/xfs_iops.h
@@ -8,9 +8,6 @@
 
 struct xfs_inode;
 
-extern const struct file_operations xfs_file_operations;
-extern const struct file_operations xfs_dir_file_operations;
-
 extern ssize_t xfs_vn_listxattr(struct dentry *, char *data, size_t size);
 
 int xfs_vn_setattr_size(struct mnt_idmap *idmap,
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_log_recover.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_log_recover.c
@@ -2456,7 +2456,10 @@
 
 		ohead = (struct xlog_op_header *)dp;
 		dp += sizeof(*ohead);
-		ASSERT(dp <= end);
+		if (dp > end) {
+			xfs_warn(log->l_mp, "%s: op header overrun", __func__);
+			return -EFSCORRUPTED;
+		}
 
 		/* errors will abort recovery */
 		error = xlog_recover_process_ophdr(log, rhash, rhead, ohead,
@@ -2966,7 +2969,7 @@
 	int			error = 0, h_size, h_len;
 	int			error2 = 0;
 	int			bblks, split_bblks;
-	int			hblks, split_hblks, wrapped_hblks;
+	int			hblks = 1, split_hblks, wrapped_hblks;
 	int			i;
 	struct hlist_head	rhash[XLOG_RHASH_SIZE];
 	LIST_HEAD		(buffer_list);
@@ -3022,14 +3025,22 @@
 		if (error)
 			goto bread_err1;
 
-		hblks = xlog_logrec_hblks(log, rhead);
-		if (hblks != 1) {
-			kmem_free(hbp);
-			hbp = xlog_alloc_buffer(log, hblks);
+		/*
+		 * This open codes xlog_logrec_hblks so that we can reuse the
+		 * fixed up h_size value calculated above.  Without that we'd
+		 * still allocate the buffer based on the incorrect on-disk
+		 * size.
+		 */
+		if (h_size > XLOG_HEADER_CYCLE_SIZE &&
+		    (rhead->h_version & cpu_to_be32(XLOG_VERSION_2))) {
+			hblks = DIV_ROUND_UP(h_size, XLOG_HEADER_CYCLE_SIZE);
+			if (hblks > 1) {
+				kmem_free(hbp);
+				hbp = xlog_alloc_buffer(log, hblks);
+			}
 		}
 	} else {
 		ASSERT(log->l_sectBBsize == 1);
-		hblks = 1;
 		hbp = xlog_alloc_buffer(log, 1);
 		h_size = XLOG_BIG_RECORD_BSIZE;
 	}
@@ -3204,11 +3215,28 @@
 	kmem_free(hbp);
 
 	/*
-	 * Submit buffers that have been added from the last record processed,
-	 * regardless of error status.
+	 * Submit buffers that have been dirtied by the last record recovered.
 	 */
-	if (!list_empty(&buffer_list))
+	if (!list_empty(&buffer_list)) {
+		if (error) {
+			/*
+			 * If there has been an item recovery error then we
+			 * cannot allow partial checkpoint writeback to
+			 * occur.  We might have multiple checkpoints with the
+			 * same start LSN in this buffer list, and partial
+			 * writeback of a checkpoint in this situation can
+			 * prevent future recovery of all the changes in the
+			 * checkpoints at this start LSN.
+			 *
+			 * Note: Shutting down the filesystem will result in the
+			 * delwri submission marking all the buffers stale,
+			 * completing them and cleaning up _XBF_LOGRECOVERY
+			 * state without doing any IO.
+			 */
+			xlog_force_shutdown(log, SHUTDOWN_LOG_IO_ERROR);
+		}
 		error2 = xfs_buf_delwri_submit(&buffer_list);
+	}
 
 	if (error && first_bad)
 		*first_bad = rhead_blk;
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_reflink.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_reflink.c
@@ -429,13 +429,6 @@
 	if (error)
 		return error;
 
-	/*
-	 * Allocation succeeded but the requested range was not even partially
-	 * satisfied?  Bail out!
-	 */
-	if (nimaps == 0)
-		return -ENOSPC;
-
 convert:
 	return xfs_reflink_convert_unwritten(ip, imap, cmap, convert_now);
 
@@ -498,13 +491,6 @@
 		error = xfs_trans_commit(tp);
 		if (error)
 			return error;
-
-		/*
-		 * Allocation succeeded but the requested range was not even
-		 * partially satisfied?  Bail out!
-		 */
-		if (nimaps == 0)
-			return -ENOSPC;
 	} while (cmap->br_startoff + cmap->br_blockcount <= imap->br_startoff);
 
 	return xfs_reflink_convert_unwritten(ip, imap, cmap, convert_now);
@@ -730,12 +716,6 @@
 	int			nmaps;
 	int			error;
 
-	/* No COW extents?  That's easy! */
-	if (ifp->if_bytes == 0) {
-		*offset_fsb = end_fsb;
-		return 0;
-	}
-
 	resblks = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK);
 	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, resblks, 0,
 			XFS_TRANS_RESERVE, &tp);
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_rtalloc.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_rtalloc.c
@@ -707,8 +707,6 @@
 		nmap = 1;
 		error = xfs_bmapi_write(tp, ip, oblocks, nblocks - oblocks,
 					XFS_BMAPI_METADATA, 0, &map, &nmap);
-		if (!error && nmap < 1)
-			error = -ENOSPC;
 		if (error)
 			goto out_trans_cancel;
 		/*
@@ -787,6 +785,39 @@
 }
 
 /*
+ * If we changed the rt extent size (meaning there was no rt volume previously)
+ * and the root directory had EXTSZINHERIT and RTINHERIT set, it's possible
+ * that the extent size hint on the root directory is no longer congruent with
+ * the new rt extent size.  Log the rootdir inode to fix this.
+ */
+static int
+xfs_growfs_rt_fixup_extsize(
+	struct xfs_mount	*mp)
+{
+	struct xfs_inode	*ip = mp->m_rootip;
+	struct xfs_trans	*tp;
+	int			error = 0;
+
+	xfs_ilock(ip, XFS_IOLOCK_EXCL);
+	if (!(ip->i_diflags & XFS_DIFLAG_RTINHERIT) ||
+	    !(ip->i_diflags & XFS_DIFLAG_EXTSZINHERIT))
+		goto out_iolock;
+
+	error = xfs_trans_alloc_inode(ip, &M_RES(mp)->tr_ichange, 0, 0, false,
+			&tp);
+	if (error)
+		goto out_iolock;
+
+	xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+	error = xfs_trans_commit(tp);
+	xfs_iunlock(ip, XFS_ILOCK_EXCL);
+
+out_iolock:
+	xfs_iunlock(ip, XFS_IOLOCK_EXCL);
+	return error;
+}
+
+/*
  * Visible (exported) functions.
  */
 
@@ -814,6 +845,7 @@
 	xfs_extlen_t	rsumblocks;	/* current number of rt summary blks */
 	xfs_sb_t	*sbp;		/* old superblock */
 	uint8_t		*rsum_cache;	/* old summary cache */
+	xfs_agblock_t	old_rextsize = mp->m_sb.sb_rextsize;
 
 	sbp = &mp->m_sb;
 
@@ -823,34 +855,39 @@
 	/* Needs to have been mounted with an rt device. */
 	if (!XFS_IS_REALTIME_MOUNT(mp))
 		return -EINVAL;
+
+	if (!mutex_trylock(&mp->m_growlock))
+		return -EWOULDBLOCK;
 	/*
 	 * Mount should fail if the rt bitmap/summary files don't load, but
 	 * we'll check anyway.
 	 */
+	error = -EINVAL;
 	if (!mp->m_rbmip || !mp->m_rsumip)
-		return -EINVAL;
+		goto out_unlock;
 
 	/* Shrink not supported. */
 	if (in->newblocks <= sbp->sb_rblocks)
-		return -EINVAL;
+		goto out_unlock;
 
 	/* Can only change rt extent size when adding rt volume. */
 	if (sbp->sb_rblocks > 0 && in->extsize != sbp->sb_rextsize)
-		return -EINVAL;
+		goto out_unlock;
 
 	/* Range check the extent size. */
 	if (XFS_FSB_TO_B(mp, in->extsize) > XFS_MAX_RTEXTSIZE ||
 	    XFS_FSB_TO_B(mp, in->extsize) < XFS_MIN_RTEXTSIZE)
-		return -EINVAL;
+		goto out_unlock;
 
 	/* Unsupported realtime features. */
+	error = -EOPNOTSUPP;
 	if (xfs_has_rmapbt(mp) || xfs_has_reflink(mp) || xfs_has_quota(mp))
-		return -EOPNOTSUPP;
+		goto out_unlock;
 
 	nrblocks = in->newblocks;
 	error = xfs_sb_validate_fsb_count(sbp, nrblocks);
 	if (error)
-		return error;
+		goto out_unlock;
 	/*
 	 * Read in the last block of the device, make sure it exists.
 	 */
@@ -858,7 +895,7 @@
 				XFS_FSB_TO_BB(mp, nrblocks - 1),
 				XFS_FSB_TO_BB(mp, 1), 0, &bp, NULL);
 	if (error)
-		return error;
+		goto out_unlock;
 	xfs_buf_relse(bp);
 
 	/*
@@ -866,8 +903,10 @@
 	 */
 	nrextents = nrblocks;
 	do_div(nrextents, in->extsize);
-	if (!xfs_validate_rtextents(nrextents))
-		return -EINVAL;
+	if (!xfs_validate_rtextents(nrextents)) {
+		error = -EINVAL;
+		goto out_unlock;
+	}
 	nrbmblocks = xfs_rtbitmap_blockcount(mp, nrextents);
 	nrextslog = xfs_compute_rextslog(nrextents);
 	nrsumlevels = nrextslog + 1;
@@ -878,8 +917,11 @@
 	 * the log.  This prevents us from getting a log overflow,
 	 * since we'll log basically the whole summary file at once.
 	 */
-	if (nrsumblocks > (mp->m_sb.sb_logblocks >> 1))
-		return -EINVAL;
+	if (nrsumblocks > (mp->m_sb.sb_logblocks >> 1)) {
+		error = -EINVAL;
+		goto out_unlock;
+	}
+
 	/*
 	 * Get the old block counts for bitmap and summary inodes.
 	 * These can't change since other growfs callers are locked out.
@@ -891,10 +933,10 @@
 	 */
 	error = xfs_growfs_rt_alloc(mp, rbmblocks, nrbmblocks, mp->m_rbmip);
 	if (error)
-		return error;
+		goto out_unlock;
 	error = xfs_growfs_rt_alloc(mp, rsumblocks, nrsumblocks, mp->m_rsumip);
 	if (error)
-		return error;
+		goto out_unlock;
 
 	rsum_cache = mp->m_rsum_cache;
 	if (nrbmblocks != sbp->sb_rbmblocks)
@@ -1043,6 +1085,12 @@
 	if (error)
 		goto out_free;
 
+	if (old_rextsize != in->extsize) {
+		error = xfs_growfs_rt_fixup_extsize(mp);
+		if (error)
+			goto out_free;
+	}
+
 	/* Update secondary superblocks now the physical grow has completed */
 	error = xfs_update_secondary_sbs(mp);
 
@@ -1066,6 +1114,8 @@
 		}
 	}
 
+out_unlock:
+	mutex_unlock(&mp->m_growlock);
 	return error;
 }
 
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_symlink.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_symlink.c
@@ -194,10 +194,12 @@
 	prid = xfs_get_initial_prid(dp);
 
 	/*
-	 * Make sure that we have allocated dquot(s) on disk.
+	 * Make sure that we have allocated dquot(s) on disk.  The uid/gid
+	 * computation code must match what the VFS uses to assign i_[ug]id.
+	 * INHERIT adjusts the gid computation for setgid/grpid systems.
 	 */
-	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(idmap, &init_user_ns),
-			mapped_fsgid(idmap, &init_user_ns), prid,
+	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(idmap, i_user_ns(VFS_I(dp))),
+			mapped_fsgid(idmap, i_user_ns(VFS_I(dp))), prid,
 			XFS_QMOPT_QUOTALL | XFS_QMOPT_INHERIT,
 			&udqp, &gdqp, &pdqp);
 	if (error)
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_trace.h
+++ linux-qcom-6.8.0/fs/xfs/xfs_trace.h
@@ -675,8 +675,8 @@
 DEFINE_FILESTREAM_EVENT(xfs_filestream_scan);
 
 TRACE_EVENT(xfs_filestream_pick,
-	TP_PROTO(struct xfs_perag *pag, xfs_ino_t ino, xfs_extlen_t free),
-	TP_ARGS(pag, ino, free),
+	TP_PROTO(struct xfs_perag *pag, xfs_ino_t ino),
+	TP_ARGS(pag, ino),
 	TP_STRUCT__entry(
 		__field(dev_t, dev)
 		__field(xfs_ino_t, ino)
@@ -687,14 +687,9 @@
 	TP_fast_assign(
 		__entry->dev = pag->pag_mount->m_super->s_dev;
 		__entry->ino = ino;
-		if (pag) {
-			__entry->agno = pag->pag_agno;
-			__entry->streams = atomic_read(&pag->pagf_fstrms);
-		} else {
-			__entry->agno = NULLAGNUMBER;
-			__entry->streams = 0;
-		}
-		__entry->free = free;
+		__entry->agno = pag->pag_agno;
+		__entry->streams = atomic_read(&pag->pagf_fstrms);
+		__entry->free = pag->pagf_freeblks;
 	),
 	TP_printk("dev %d:%d ino 0x%llx agno 0x%x streams %d free %d",
 		  MAJOR(__entry->dev), MINOR(__entry->dev),
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_trans.c
+++ linux-qcom-6.8.0/fs/xfs/xfs_trans.c
@@ -960,13 +960,6 @@
 
 	trace_xfs_trans_commit(tp, _RET_IP_);
 
-	error = xfs_trans_run_precommits(tp);
-	if (error) {
-		if (tp->t_flags & XFS_TRANS_PERM_LOG_RES)
-			xfs_defer_cancel(tp);
-		goto out_unreserve;
-	}
-
 	/*
 	 * Finish deferred items on final commit. Only permanent transactions
 	 * should ever have deferred ops.
@@ -977,13 +970,12 @@
 		error = xfs_defer_finish_noroll(&tp);
 		if (error)
 			goto out_unreserve;
-
-		/* Run precommits from final tx in defer chain. */
-		error = xfs_trans_run_precommits(tp);
-		if (error)
-			goto out_unreserve;
 	}
 
+	error = xfs_trans_run_precommits(tp);
+	if (error)
+		goto out_unreserve;
+
 	/*
 	 * If there is nothing to be logged by the transaction,
 	 * then unlock all of the items associated with the
--- linux-qcom-6.8.0.orig/fs/xfs/xfs_trans.h
+++ linux-qcom-6.8.0/fs/xfs/xfs_trans.h
@@ -267,19 +267,14 @@
 xfs_trans_set_context(
 	struct xfs_trans	*tp)
 {
-	ASSERT(current->journal_info == NULL);
 	tp->t_pflags = memalloc_nofs_save();
-	current->journal_info = tp;
 }
 
 static inline void
 xfs_trans_clear_context(
 	struct xfs_trans	*tp)
 {
-	if (current->journal_info == tp) {
-		memalloc_nofs_restore(tp->t_pflags);
-		current->journal_info = NULL;
-	}
+	memalloc_nofs_restore(tp->t_pflags);
 }
 
 static inline void
@@ -287,10 +282,8 @@
 	struct xfs_trans	*old_tp,
 	struct xfs_trans	*new_tp)
 {
-	ASSERT(current->journal_info == old_tp);
 	new_tp->t_pflags = old_tp->t_pflags;
 	old_tp->t_pflags = 0;
-	current->journal_info = new_tp;
 }
 
 #endif	/* __XFS_TRANS_H__ */
--- linux-qcom-6.8.0.orig/include/acpi/acoutput.h
+++ linux-qcom-6.8.0/include/acpi/acoutput.h
@@ -193,6 +193,7 @@
  */
 #ifndef ACPI_NO_ERROR_MESSAGES
 #define AE_INFO                         _acpi_module_name, __LINE__
+#define ACPI_ONCE(_fn, _plist)                  { static char _done; if (!_done) { _done = 1; _fn _plist; } }
 
 /*
  * Error reporting. Callers module and line number are inserted by AE_INFO,
@@ -201,8 +202,10 @@
  */
 #define ACPI_INFO(plist)                acpi_info plist
 #define ACPI_WARNING(plist)             acpi_warning plist
+#define ACPI_WARNING_ONCE(plist)        ACPI_ONCE(acpi_warning, plist)
 #define ACPI_EXCEPTION(plist)           acpi_exception plist
 #define ACPI_ERROR(plist)               acpi_error plist
+#define ACPI_ERROR_ONCE(plist)          ACPI_ONCE(acpi_error, plist)
 #define ACPI_BIOS_WARNING(plist)        acpi_bios_warning plist
 #define ACPI_BIOS_EXCEPTION(plist)      acpi_bios_exception plist
 #define ACPI_BIOS_ERROR(plist)          acpi_bios_error plist
@@ -214,8 +217,10 @@
 
 #define ACPI_INFO(plist)
 #define ACPI_WARNING(plist)
+#define ACPI_WARNING_ONCE(plist)
 #define ACPI_EXCEPTION(plist)
 #define ACPI_ERROR(plist)
+#define ACPI_ERROR_ONCE(plist)
 #define ACPI_BIOS_WARNING(plist)
 #define ACPI_BIOS_EXCEPTION(plist)
 #define ACPI_BIOS_ERROR(plist)
--- linux-qcom-6.8.0.orig/include/acpi/acpi_bus.h
+++ linux-qcom-6.8.0/include/acpi/acpi_bus.h
@@ -749,6 +749,7 @@
 bool acpi_quirk_skip_acpi_ac_and_battery(void);
 int acpi_install_cmos_rtc_space_handler(acpi_handle handle);
 void acpi_remove_cmos_rtc_space_handler(acpi_handle handle);
+int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip);
 #else
 static inline bool acpi_device_override_status(struct acpi_device *adev,
 					       unsigned long long *status)
@@ -766,23 +767,22 @@
 static inline void acpi_remove_cmos_rtc_space_handler(acpi_handle handle)
 {
 }
+static inline int
+acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip)
+{
+	*skip = false;
+	return 0;
+}
 #endif
 
 #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS)
 bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev);
-int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip);
 bool acpi_quirk_skip_gpio_event_handlers(void);
 #else
 static inline bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev)
 {
 	return false;
 }
-static inline int
-acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip)
-{
-	*skip = false;
-	return 0;
-}
 static inline bool acpi_quirk_skip_gpio_event_handlers(void)
 {
 	return false;
@@ -911,17 +911,19 @@
  * acpi_dev_hid_uid_match - Match device by supplied HID and UID
  * @adev: ACPI device to match.
  * @hid2: Hardware ID of the device.
- * @uid2: Unique ID of the device, pass 0 or NULL to not check _UID.
+ * @uid2: Unique ID of the device, pass NULL to not check _UID.
  *
  * Matches HID and UID in @adev with given @hid2 and @uid2. Absence of @uid2
  * will be treated as a match. If user wants to validate @uid2, it should be
  * done before calling this function.
  *
- * Returns: %true if matches or @uid2 is 0 or NULL, %false otherwise.
+ * Returns: %true if matches or @uid2 is NULL, %false otherwise.
  */
 #define acpi_dev_hid_uid_match(adev, hid2, uid2)			\
 	(acpi_dev_hid_match(adev, hid2) &&				\
-		(!(uid2) || acpi_dev_uid_match(adev, uid2)))
+		/* Distinguish integer 0 from NULL @uid2 */		\
+		(_Generic(uid2,	ACPI_STR_TYPES(!(uid2)), default: 0) ||	\
+		acpi_dev_uid_match(adev, uid2)))
 
 void acpi_dev_clear_dependencies(struct acpi_device *supplier);
 bool acpi_dev_ready_for_enumeration(const struct acpi_device *device);
@@ -976,11 +978,16 @@
 {
 	acpi_dev_put(adev);
 }
+
+int acpi_wait_for_acpi_ipmi(void);
+
 #else	/* CONFIG_ACPI */
 
 static inline int register_acpi_bus_type(void *bus) { return 0; }
 static inline int unregister_acpi_bus_type(void *bus) { return 0; }
 
+static inline int acpi_wait_for_acpi_ipmi(void) { return 0; }
+
 #endif				/* CONFIG_ACPI */
 
 #endif /*__ACPI_BUS_H__*/
--- linux-qcom-6.8.0.orig/include/acpi/acpixf.h
+++ linux-qcom-6.8.0/include/acpi/acpixf.h
@@ -660,6 +660,7 @@
 			     void *context))
 ACPI_EXTERNAL_RETURN_STATUS(acpi_status
 			    acpi_execute_reg_methods(acpi_handle device,
+						     u32 nax_depth,
 						     acpi_adr_space_type
 						     space_id))
 ACPI_EXTERNAL_RETURN_STATUS(acpi_status
--- linux-qcom-6.8.0.orig/include/acpi/cppc_acpi.h
+++ linux-qcom-6.8.0/include/acpi/cppc_acpi.h
@@ -64,6 +64,8 @@
 	int cpu_id;
 	int write_cmd_status;
 	int write_cmd_id;
+	/* Lock used for RMW operations in cpc_write() */
+	raw_spinlock_t rmw_lock;
 	struct cpc_register_resource cpc_regs[MAX_CPC_REG_ENT];
 	struct acpi_psd_package domain_info;
 	struct kobject kobj;
@@ -139,6 +141,7 @@
 #ifdef CONFIG_ACPI_CPPC_LIB
 extern int cppc_get_desired_perf(int cpunum, u64 *desired_perf);
 extern int cppc_get_nominal_perf(int cpunum, u64 *nominal_perf);
+extern int cppc_get_highest_perf(int cpunum, u64 *highest_perf);
 extern int cppc_get_perf_ctrs(int cpu, struct cppc_perf_fb_ctrs *perf_fb_ctrs);
 extern int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls);
 extern int cppc_set_enable(int cpu, bool enable);
@@ -167,6 +170,10 @@
 {
 	return -ENOTSUPP;
 }
+static inline int cppc_get_highest_perf(int cpunum, u64 *highest_perf)
+{
+	return -ENOTSUPP;
+}
 static inline int cppc_get_perf_ctrs(int cpu, struct cppc_perf_fb_ctrs *perf_fb_ctrs)
 {
 	return -ENOTSUPP;
--- linux-qcom-6.8.0.orig/include/acpi/pcc.h
+++ linux-qcom-6.8.0/include/acpi/pcc.h
@@ -12,6 +12,7 @@
 struct pcc_mbox_chan {
 	struct mbox_chan *mchan;
 	u64 shmem_base_addr;
+	void __iomem *shmem;
 	u64 shmem_size;
 	u32 latency;
 	u32 max_access_rate;
@@ -31,11 +32,13 @@
 #define PCC_CMD_COMPLETION_NOTIFY	BIT(0)
 
 #define MAX_PCC_SUBSPACES	256
+#define PCC_ACK_FLAG_MASK	0x1
 
 #ifdef CONFIG_PCC
 extern struct pcc_mbox_chan *
 pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id);
 extern void pcc_mbox_free_channel(struct pcc_mbox_chan *chan);
+extern int pcc_mbox_ioremap(struct mbox_chan *chan);
 #else
 static inline struct pcc_mbox_chan *
 pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id)
@@ -43,6 +46,10 @@
 	return ERR_PTR(-ENODEV);
 }
 static inline void pcc_mbox_free_channel(struct pcc_mbox_chan *chan) { }
+static inline int pcc_mbox_ioremap(struct mbox_chan *chan)
+{
+	return 0;
+};
 #endif
 
 #endif /* _PCC_H */
--- linux-qcom-6.8.0.orig/include/asm-generic/barrier.h
+++ linux-qcom-6.8.0/include/asm-generic/barrier.h
@@ -296,5 +296,13 @@
 #define io_stop_wc() do { } while (0)
 #endif
 
+/*
+ * Architectures that guarantee an implicit smp_mb() in switch_mm()
+ * can override smp_mb__after_switch_mm.
+ */
+#ifndef smp_mb__after_switch_mm
+# define smp_mb__after_switch_mm()	smp_mb()
+#endif
+
 #endif /* !__ASSEMBLY__ */
 #endif /* __ASM_GENERIC_BARRIER_H */
--- linux-qcom-6.8.0.orig/include/asm-generic/hyperv-tlfs.h
+++ linux-qcom-6.8.0/include/asm-generic/hyperv-tlfs.h
@@ -135,7 +135,7 @@
  *
  */
 
-#define HV_LINUX_VENDOR_ID              0x8100
+#define HV_LINUX_VENDOR_ID              0x80 /* Canonical */
 
 /*
  * Crash notification flags.
--- linux-qcom-6.8.0.orig/include/asm-generic/mshyperv.h
+++ linux-qcom-6.8.0/include/asm-generic/mshyperv.h
@@ -115,6 +115,14 @@
 	return status;
 }
 
+#ifndef PKG_ABI
+/*
+ * Preserve the ability to 'make deb-pkg' since PKG_ABI is provided
+ * by the Ubuntu build rules.
+ */
+#define PKG_ABI 0
+#endif
+
 /* Generate the guest OS identifier as described in the Hyper-V TLFS */
 static inline u64 hv_generate_guest_id(u64 kernel_version)
 {
@@ -122,6 +130,7 @@
 
 	guest_id = (((u64)HV_LINUX_VENDOR_ID) << 48);
 	guest_id |= (kernel_version << 16);
+	guest_id |= PKG_ABI;
 
 	return guest_id;
 }
--- linux-qcom-6.8.0.orig/include/asm-generic/vmlinux.lds.h
+++ linux-qcom-6.8.0/include/asm-generic/vmlinux.lds.h
@@ -101,7 +101,7 @@
 #define DATA_MAIN .data .data.[0-9a-zA-Z_]* .data..L* .data..compoundliteral* .data.$__unnamed_* .data.$L*
 #define SDATA_MAIN .sdata .sdata.[0-9a-zA-Z_]*
 #define RODATA_MAIN .rodata .rodata.[0-9a-zA-Z_]* .rodata..L*
-#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]* .bss..compoundliteral*
+#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]* .bss..L* .bss..compoundliteral*
 #define SBSS_MAIN .sbss .sbss.[0-9a-zA-Z_]*
 #else
 #define TEXT_MAIN .text
@@ -139,14 +139,6 @@
  * often happens at runtime)
  */
 
-#if defined(CONFIG_MEMORY_HOTPLUG)
-#define MEM_KEEP(sec)    *(.mem##sec)
-#define MEM_DISCARD(sec)
-#else
-#define MEM_KEEP(sec)
-#define MEM_DISCARD(sec) *(.mem##sec)
-#endif
-
 #ifndef CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE
 #define KEEP_PATCHABLE		KEEP(*(__patchable_function_entries))
 #define PATCHABLE_DISCARDS
@@ -355,10 +347,9 @@
 	*(.data..decrypted)						\
 	*(.ref.data)							\
 	*(.data..shared_aligned) /* percpu related */			\
-	MEM_KEEP(init.data*)						\
-	*(.data.unlikely)						\
+	*(.data..unlikely)						\
 	__start_once = .;						\
-	*(.data.once)							\
+	*(.data..once)							\
 	__end_once = .;							\
 	STRUCT_ALIGN();							\
 	*(__tracepoints)						\
@@ -520,7 +511,6 @@
 	/* __*init sections */						\
 	__init_rodata : AT(ADDR(__init_rodata) - LOAD_OFFSET) {		\
 		*(.ref.rodata)						\
-		MEM_KEEP(init.rodata)					\
 	}								\
 									\
 	/* Built-in module parameters. */				\
@@ -571,8 +561,7 @@
 		*(.text.unknown .text.unknown.*)			\
 		NOINSTR_TEXT						\
 		*(.ref.text)						\
-		*(.text.asan.* .text.tsan.*)				\
-	MEM_KEEP(init.text*)						\
+		*(.text.asan.* .text.tsan.*)
 
 
 /* sched.text is aling to function alignment to secure we have same
@@ -679,7 +668,6 @@
 #define INIT_DATA							\
 	KEEP(*(SORT(___kentry+*)))					\
 	*(.init.data .init.data.*)					\
-	MEM_DISCARD(init.data*)						\
 	KERNEL_CTORS()							\
 	MCOUNT_REC()							\
 	*(.init.rodata .init.rodata.*)					\
@@ -687,7 +675,6 @@
 	TRACE_SYSCALLS()						\
 	KPROBE_BLACKLIST()						\
 	ERROR_INJECT_WHITELIST()					\
-	MEM_DISCARD(init.rodata)					\
 	CLK_OF_TABLES()							\
 	RESERVEDMEM_OF_TABLES()						\
 	TIMER_OF_TABLES()						\
@@ -705,8 +692,7 @@
 
 #define INIT_TEXT							\
 	*(.init.text .init.text.*)					\
-	*(.text.startup)						\
-	MEM_DISCARD(init.text*)
+	*(.text.startup)
 
 #define EXIT_DATA							\
 	*(.exit.data .exit.data.*)					\
--- linux-qcom-6.8.0.orig/include/clocksource/hyperv_timer.h
+++ linux-qcom-6.8.0/include/clocksource/hyperv_timer.h
@@ -38,6 +38,8 @@
 extern unsigned long hv_get_tsc_pfn(void);
 extern struct ms_hyperv_tsc_page *hv_get_tsc_page(void);
 
+extern void hv_adj_sched_clock_offset(u64 offset);
+
 static __always_inline bool
 hv_read_tsc_page_tsc(const struct ms_hyperv_tsc_page *tsc_pg,
 		     u64 *cur_tsc, u64 *time)
--- linux-qcom-6.8.0.orig/include/clocksource/timer-xilinx.h
+++ linux-qcom-6.8.0/include/clocksource/timer-xilinx.h
@@ -41,7 +41,7 @@
 struct xilinx_timer_priv {
 	struct regmap *map;
 	struct clk *clk;
-	u32 max;
+	u64 max;
 };
 
 /**
--- linux-qcom-6.8.0.orig/include/crypto/internal/ecc.h
+++ linux-qcom-6.8.0/include/crypto/internal/ecc.h
@@ -57,6 +57,16 @@
 }
 
 /**
+ * ecc_digits_from_bytes() - Create ndigits-sized digits array from byte array
+ * @in:       Input byte array
+ * @nbytes    Size of input byte array
+ * @out       Output digits array
+ * @ndigits:  Number of digits to create from byte array
+ */
+void ecc_digits_from_bytes(const u8 *in, unsigned int nbytes,
+			   u64 *out, unsigned int ndigits);
+
+/**
  * ecc_is_key_valid() - Validate a given ECDH private key
  *
  * @curve_id:		id representing the curve to use
--- linux-qcom-6.8.0.orig/include/crypto/internal/simd.h
+++ linux-qcom-6.8.0/include/crypto/internal/simd.h
@@ -14,11 +14,10 @@
 struct simd_skcipher_alg;
 struct skcipher_alg;
 
-struct simd_skcipher_alg *simd_skcipher_create_compat(const char *algname,
+struct simd_skcipher_alg *simd_skcipher_create_compat(struct skcipher_alg *ialg,
+						      const char *algname,
 						      const char *drvname,
 						      const char *basename);
-struct simd_skcipher_alg *simd_skcipher_create(const char *algname,
-					       const char *basename);
 void simd_skcipher_free(struct simd_skcipher_alg *alg);
 
 int simd_register_skciphers_compat(struct skcipher_alg *algs, int count,
@@ -32,13 +31,6 @@
 struct simd_aead_alg;
 struct aead_alg;
 
-struct simd_aead_alg *simd_aead_create_compat(const char *algname,
-					      const char *drvname,
-					      const char *basename);
-struct simd_aead_alg *simd_aead_create(const char *algname,
-				       const char *basename);
-void simd_aead_free(struct simd_aead_alg *alg);
-
 int simd_register_aeads_compat(struct aead_alg *algs, int count,
 			       struct simd_aead_alg **simd_algs);
 
--- linux-qcom-6.8.0.orig/include/drm/bridge/aux-bridge.h
+++ linux-qcom-6.8.0/include/drm/bridge/aux-bridge.h
@@ -33,7 +33,7 @@
 	return NULL;
 }
 
-static inline int devm_drm_dp_hpd_bridge_add(struct auxiliary_device *adev)
+static inline int devm_drm_dp_hpd_bridge_add(struct device *dev, struct auxiliary_device *adev)
 {
 	return 0;
 }
--- linux-qcom-6.8.0.orig/include/drm/display/drm_dp_helper.h
+++ linux-qcom-6.8.0/include/drm/display/drm_dp_helper.h
@@ -101,6 +101,8 @@
 void drm_dp_vsc_sdp_log(const char *level, struct device *dev,
 			const struct drm_dp_vsc_sdp *vsc);
 
+bool drm_dp_vsc_sdp_supported(struct drm_dp_aux *aux, const u8 dpcd[DP_RECEIVER_CAP_SIZE]);
+
 int drm_dp_psr_setup_time(const u8 psr_cap[EDP_PSR_RECEIVER_CAP_SIZE]);
 
 static inline int
@@ -463,9 +465,15 @@
 	 * @is_remote: Is this AUX CH actually using sideband messaging.
 	 */
 	bool is_remote;
+
+	/**
+	 * @powered_down: If true then the remote endpoint is powered down.
+	 */
+	bool powered_down;
 };
 
 int drm_dp_dpcd_probe(struct drm_dp_aux *aux, unsigned int offset);
+void drm_dp_dpcd_set_powered(struct drm_dp_aux *aux, bool powered);
 ssize_t drm_dp_dpcd_read(struct drm_dp_aux *aux, unsigned int offset,
 			 void *buffer, size_t size);
 ssize_t drm_dp_dpcd_write(struct drm_dp_aux *aux, unsigned int offset,
@@ -813,4 +821,6 @@
 		       int bpp_x16, unsigned long flags);
 int drm_dp_bw_channel_coding_efficiency(bool is_uhbr);
 
+ssize_t drm_dp_vsc_sdp_pack(const struct drm_dp_vsc_sdp *vsc, struct dp_sdp *sdp);
+
 #endif /* _DRM_DP_HELPER_H_ */
--- linux-qcom-6.8.0.orig/include/drm/display/drm_dp_mst_helper.h
+++ linux-qcom-6.8.0/include/drm/display/drm_dp_mst_helper.h
@@ -701,6 +701,13 @@
 	bool payload_id_table_cleared : 1;
 
 	/**
+	 * @reset_rx_state: The down request's reply and up request message
+	 * receiver state must be reset, after the topology manager got
+	 * removed. Protected by @lock.
+	 */
+	bool reset_rx_state : 1;
+
+	/**
 	 * @payload_count: The number of currently active payloads in hardware. This value is only
 	 * intended to be used internally by MST helpers for payload tracking, and is only safe to
 	 * read/write from the atomic commit (not check) context.
@@ -851,7 +858,6 @@
 			     struct drm_dp_mst_topology_state *mst_state,
 			     struct drm_dp_mst_atomic_payload *payload);
 int drm_dp_add_payload_part2(struct drm_dp_mst_topology_mgr *mgr,
-			     struct drm_atomic_state *state,
 			     struct drm_dp_mst_atomic_payload *payload);
 void drm_dp_remove_payload_part1(struct drm_dp_mst_topology_mgr *mgr,
 				 struct drm_dp_mst_topology_state *mst_state,
--- linux-qcom-6.8.0.orig/include/drm/drm_accel.h
+++ linux-qcom-6.8.0/include/drm/drm_accel.h
@@ -51,11 +51,10 @@
 
 #if IS_ENABLED(CONFIG_DRM_ACCEL)
 
+extern struct xarray accel_minors_xa;
+
 void accel_core_exit(void);
 int accel_core_init(void);
-void accel_minor_remove(int index);
-int accel_minor_alloc(void);
-void accel_minor_replace(struct drm_minor *minor, int index);
 void accel_set_device_instance_params(struct device *kdev, int index);
 int accel_open(struct inode *inode, struct file *filp);
 void accel_debugfs_init(struct drm_device *dev);
@@ -73,19 +72,6 @@
 	return 0;
 }
 
-static inline void accel_minor_remove(int index)
-{
-}
-
-static inline int accel_minor_alloc(void)
-{
-	return -EOPNOTSUPP;
-}
-
-static inline void accel_minor_replace(struct drm_minor *minor, int index)
-{
-}
-
 static inline void accel_set_device_instance_params(struct device *kdev, int index)
 {
 }
--- linux-qcom-6.8.0.orig/include/drm/drm_bridge.h
+++ linux-qcom-6.8.0/include/drm/drm_bridge.h
@@ -558,6 +558,37 @@
 			 struct drm_connector *connector);
 
 	/**
+	 * @edid_read:
+	 *
+	 * Read the EDID data of the connected display.
+	 *
+	 * The @edid_read callback is the preferred way of reporting mode
+	 * information for a display connected to the bridge output. Bridges
+	 * that support reading EDID shall implement this callback and leave
+	 * the @get_modes callback unimplemented.
+	 *
+	 * The caller of this operation shall first verify the output
+	 * connection status and refrain from reading EDID from a disconnected
+	 * output.
+	 *
+	 * This callback is optional. Bridges that implement it shall set the
+	 * DRM_BRIDGE_OP_EDID flag in their &drm_bridge->ops.
+	 *
+	 * The connector parameter shall be used for the sole purpose of EDID
+	 * retrieval, and shall not be stored internally by bridge drivers for
+	 * future usage.
+	 *
+	 * RETURNS:
+	 *
+	 * An edid structure newly allocated with drm_edid_alloc() or returned
+	 * from drm_edid_read() family of functions on success, or NULL
+	 * otherwise. The caller is responsible for freeing the returned edid
+	 * structure with drm_edid_free().
+	 */
+	const struct drm_edid *(*edid_read)(struct drm_bridge *bridge,
+					    struct drm_connector *connector);
+
+	/**
 	 * @get_edid:
 	 *
 	 * Read and parse the EDID data of the connected display.
@@ -746,6 +777,11 @@
 	 */
 	bool interlace_allowed;
 	/**
+	 * @ycbcr_420_allowed: Indicate that the bridge can handle YCbCr 420
+	 * output.
+	 */
+	bool ycbcr_420_allowed;
+	/**
 	 * @pre_enable_prev_first: The bridge requires that the prev
 	 * bridge @pre_enable function is called before its @pre_enable,
 	 * and conversely for post_disable. This is most frequently a
@@ -888,6 +924,8 @@
 enum drm_connector_status drm_bridge_detect(struct drm_bridge *bridge);
 int drm_bridge_get_modes(struct drm_bridge *bridge,
 			 struct drm_connector *connector);
+const struct drm_edid *drm_bridge_edid_read(struct drm_bridge *bridge,
+					    struct drm_connector *connector);
 struct edid *drm_bridge_get_edid(struct drm_bridge *bridge,
 				 struct drm_connector *connector);
 void drm_bridge_hpd_enable(struct drm_bridge *bridge,
--- linux-qcom-6.8.0.orig/include/drm/drm_displayid.h
+++ linux-qcom-6.8.0/include/drm/drm_displayid.h
@@ -30,7 +30,6 @@
 #define VESA_IEEE_OUI				0x3a0292
 
 /* DisplayID Structure versions */
-#define DISPLAY_ID_STRUCTURE_VER_12		0x12
 #define DISPLAY_ID_STRUCTURE_VER_20		0x20
 
 /* DisplayID Structure v1r2 Data Blocks */
--- linux-qcom-6.8.0.orig/include/drm/drm_file.h
+++ linux-qcom-6.8.0/include/drm/drm_file.h
@@ -45,6 +45,8 @@
 struct device;
 struct file;
 
+extern struct xarray drm_minors_xa;
+
 /*
  * FIXME: Not sure we want to have drm_minor here in the end, but to avoid
  * header include loops we need it here for now.
@@ -434,6 +436,9 @@
 
 void drm_file_update_pid(struct drm_file *);
 
+struct drm_minor *drm_minor_acquire(struct xarray *minors_xa, unsigned int minor_id);
+void drm_minor_release(struct drm_minor *minor);
+
 int drm_open(struct inode *inode, struct file *filp);
 int drm_open_helper(struct file *filp, struct drm_minor *minor);
 ssize_t drm_read(struct file *filp, char __user *buffer,
--- linux-qcom-6.8.0.orig/include/drm/drm_fixed.h
+++ linux-qcom-6.8.0/include/drm/drm_fixed.h
@@ -71,7 +71,6 @@
 }
 
 #define DRM_FIXED_POINT		32
-#define DRM_FIXED_POINT_HALF	16
 #define DRM_FIXED_ONE		(1ULL << DRM_FIXED_POINT)
 #define DRM_FIXED_DECIMAL_MASK	(DRM_FIXED_ONE - 1)
 #define DRM_FIXED_DIGITS_MASK	(~DRM_FIXED_DECIMAL_MASK)
@@ -90,12 +89,12 @@
 
 static inline int drm_fixp2int_round(s64 a)
 {
-	return drm_fixp2int(a + (1 << (DRM_FIXED_POINT_HALF - 1)));
+	return drm_fixp2int(a + DRM_FIXED_ONE / 2);
 }
 
 static inline int drm_fixp2int_ceil(s64 a)
 {
-	if (a > 0)
+	if (a >= 0)
 		return drm_fixp2int(a + DRM_FIXED_ALMOST_ONE);
 	else
 		return drm_fixp2int(a - DRM_FIXED_ALMOST_ONE);
--- linux-qcom-6.8.0.orig/include/drm/drm_gem.h
+++ linux-qcom-6.8.0/include/drm/drm_gem.h
@@ -553,6 +553,19 @@
 
 int drm_gem_evict(struct drm_gem_object *obj);
 
+/**
+ * drm_gem_object_is_shared_for_memory_stats - helper for shared memory stats
+ *
+ * This helper should only be used for fdinfo shared memory stats to determine
+ * if a GEM object is shared.
+ *
+ * @obj: obj in question
+ */
+static inline bool drm_gem_object_is_shared_for_memory_stats(struct drm_gem_object *obj)
+{
+	return (obj->handle_count > 1) || obj->dma_buf;
+}
+
 #ifdef CONFIG_LOCKDEP
 /**
  * drm_gem_gpuva_set_lock() - Set the lock protecting accesses to the gpuva list.
--- linux-qcom-6.8.0.orig/include/drm/drm_kunit_helpers.h
+++ linux-qcom-6.8.0/include/drm/drm_kunit_helpers.h
@@ -3,6 +3,8 @@
 #ifndef DRM_KUNIT_HELPERS_H_
 #define DRM_KUNIT_HELPERS_H_
 
+#include <drm/drm_drv.h>
+
 #include <linux/device.h>
 
 #include <kunit/test.h>
--- linux-qcom-6.8.0.orig/include/drm/drm_mipi_dsi.h
+++ linux-qcom-6.8.0/include/drm/drm_mipi_dsi.h
@@ -241,9 +241,9 @@
 int mipi_dsi_turn_on_peripheral(struct mipi_dsi_device *dsi);
 int mipi_dsi_set_maximum_return_packet_size(struct mipi_dsi_device *dsi,
 					    u16 value);
-ssize_t mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable);
-ssize_t mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi,
-				       const struct drm_dsc_picture_parameter_set *pps);
+int mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable);
+int mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi,
+				   const struct drm_dsc_picture_parameter_set *pps);
 
 ssize_t mipi_dsi_generic_write(struct mipi_dsi_device *dsi, const void *payload,
 			       size_t size);
@@ -305,17 +305,17 @@
  * @dsi: DSI peripheral device
  * @seq: buffer containing the payload
  */
-#define mipi_dsi_generic_write_seq(dsi, seq...)                                \
-	do {                                                                   \
-		static const u8 d[] = { seq };                                 \
-		struct device *dev = &dsi->dev;                                \
-		int ret;                                                       \
-		ret = mipi_dsi_generic_write(dsi, d, ARRAY_SIZE(d));           \
-		if (ret < 0) {                                                 \
-			dev_err_ratelimited(dev, "transmit data failed: %d\n", \
-					    ret);                              \
-			return ret;                                            \
-		}                                                              \
+#define mipi_dsi_generic_write_seq(dsi, seq...)                                 \
+	do {                                                                    \
+		static const u8 d[] = { seq };                                  \
+		struct device *dev = &dsi->dev;                                 \
+		ssize_t ret;                                                    \
+		ret = mipi_dsi_generic_write(dsi, d, ARRAY_SIZE(d));            \
+		if (ret < 0) {                                                  \
+			dev_err_ratelimited(dev, "transmit data failed: %zd\n", \
+					    ret);                               \
+			return ret;                                             \
+		}                                                               \
 	} while (0)
 
 /**
@@ -324,18 +324,18 @@
  * @cmd: Command
  * @seq: buffer containing data to be transmitted
  */
-#define mipi_dsi_dcs_write_seq(dsi, cmd, seq...)                           \
-	do {                                                               \
-		static const u8 d[] = { cmd, seq };                        \
-		struct device *dev = &dsi->dev;                            \
-		int ret;                                                   \
-		ret = mipi_dsi_dcs_write_buffer(dsi, d, ARRAY_SIZE(d));    \
-		if (ret < 0) {                                             \
-			dev_err_ratelimited(                               \
-				dev, "sending command %#02x failed: %d\n", \
-				cmd, ret);                                 \
-			return ret;                                        \
-		}                                                          \
+#define mipi_dsi_dcs_write_seq(dsi, cmd, seq...)                            \
+	do {                                                                \
+		static const u8 d[] = { cmd, seq };                         \
+		struct device *dev = &dsi->dev;                             \
+		ssize_t ret;                                                \
+		ret = mipi_dsi_dcs_write_buffer(dsi, d, ARRAY_SIZE(d));     \
+		if (ret < 0) {                                              \
+			dev_err_ratelimited(                                \
+				dev, "sending command %#02x failed: %zd\n", \
+				cmd, ret);                                  \
+			return ret;                                         \
+		}                                                           \
 	} while (0)
 
 /**
--- linux-qcom-6.8.0.orig/include/drm/drm_modeset_helper_vtables.h
+++ linux-qcom-6.8.0/include/drm/drm_modeset_helper_vtables.h
@@ -898,7 +898,8 @@
 	 *
 	 * RETURNS:
 	 *
-	 * The number of modes added by calling drm_mode_probed_add().
+	 * The number of modes added by calling drm_mode_probed_add(). Return 0
+	 * on failures (no modes) instead of negative error codes.
 	 */
 	int (*get_modes)(struct drm_connector *connector);
 
--- linux-qcom-6.8.0.orig/include/drm/drm_print.h
+++ linux-qcom-6.8.0/include/drm/drm_print.h
@@ -122,7 +122,8 @@
 
 /**
  * struct drm_print_iterator - local struct used with drm_printer_coredump
- * @data: Pointer to the devcoredump output buffer
+ * @data: Pointer to the devcoredump output buffer, can be NULL if using
+ * drm_printer_coredump to determine size of devcoredump
  * @start: The offset within the buffer to start writing
  * @remain: The number of bytes to write for this iteration
  */
@@ -167,6 +168,57 @@
  *			coredump_read, ...)
  *	}
  *
+ * The above example has a time complexity of O(N^2), where N is the size of the
+ * devcoredump. This is acceptable for small devcoredumps but scales poorly for
+ * larger ones.
+ *
+ * Another use case for drm_coredump_printer is to capture the devcoredump into
+ * a saved buffer before the dev_coredump() callback. This involves two passes:
+ * one to determine the size of the devcoredump and another to print it to a
+ * buffer. Then, in dev_coredump(), copy from the saved buffer into the
+ * devcoredump read buffer.
+ *
+ * For example::
+ *
+ *	char *devcoredump_saved_buffer;
+ *
+ *	ssize_t __coredump_print(char *buffer, ssize_t count, ...)
+ *	{
+ *		struct drm_print_iterator iter;
+ *		struct drm_printer p;
+ *
+ *		iter.data = buffer;
+ *		iter.start = 0;
+ *		iter.remain = count;
+ *
+ *		p = drm_coredump_printer(&iter);
+ *
+ *		drm_printf(p, "foo=%d\n", foo);
+ *		...
+ *		return count - iter.remain;
+ *	}
+ *
+ *	void coredump_print(...)
+ *	{
+ *		ssize_t count;
+ *
+ *		count = __coredump_print(NULL, INT_MAX, ...);
+ *		devcoredump_saved_buffer = kvmalloc(count, GFP_KERNEL);
+ *		__coredump_print(devcoredump_saved_buffer, count, ...);
+ *	}
+ *
+ *	void coredump_read(char *buffer, loff_t offset, size_t count,
+ *			   void *data, size_t datalen)
+ *	{
+ *		...
+ *		memcpy(buffer, devcoredump_saved_buffer + offset, count);
+ *		...
+ *	}
+ *
+ * The above example has a time complexity of O(N*2), where N is the size of the
+ * devcoredump. This scales better than the previous example for larger
+ * devcoredumps.
+ *
  * RETURNS:
  * The &drm_printer object
  */
--- linux-qcom-6.8.0.orig/include/drm/gpu_scheduler.h
+++ linux-qcom-6.8.0/include/drm/gpu_scheduler.h
@@ -574,7 +574,7 @@
 
 void drm_sched_tdr_queue_imm(struct drm_gpu_scheduler *sched);
 void drm_sched_job_cleanup(struct drm_sched_job *job);
-void drm_sched_wakeup(struct drm_gpu_scheduler *sched, struct drm_sched_entity *entity);
+void drm_sched_wakeup(struct drm_gpu_scheduler *sched);
 bool drm_sched_wqueue_ready(struct drm_gpu_scheduler *sched);
 void drm_sched_wqueue_stop(struct drm_gpu_scheduler *sched);
 void drm_sched_wqueue_start(struct drm_gpu_scheduler *sched);
--- linux-qcom-6.8.0.orig/include/drm/i915_pciids.h
+++ linux-qcom-6.8.0/include/drm/i915_pciids.h
@@ -709,7 +709,9 @@
 	INTEL_VGA_DEVICE(0x5692, info), \
 	INTEL_VGA_DEVICE(0x56A0, info), \
 	INTEL_VGA_DEVICE(0x56A1, info), \
-	INTEL_VGA_DEVICE(0x56A2, info)
+	INTEL_VGA_DEVICE(0x56A2, info), \
+	INTEL_VGA_DEVICE(0x56BE, info), \
+	INTEL_VGA_DEVICE(0x56BF, info)
 
 #define INTEL_DG2_G11_IDS(info) \
 	INTEL_VGA_DEVICE(0x5693, info), \
--- linux-qcom-6.8.0.orig/include/drm/ttm/ttm_tt.h
+++ linux-qcom-6.8.0/include/drm/ttm/ttm_tt.h
@@ -79,6 +79,12 @@
 	 *   page_flags = TTM_TT_FLAG_EXTERNAL |
 	 *		  TTM_TT_FLAG_EXTERNAL_MAPPABLE;
 	 *
+	 * TTM_TT_FLAG_DECRYPTED: The mapped ttm pages should be marked as
+	 * not encrypted. The framework will try to match what the dma layer
+	 * is doing, but note that it is a little fragile because ttm page
+	 * fault handling abuses the DMA api a bit and dma_map_attrs can't be
+	 * used to assure pgprot always matches.
+	 *
 	 * TTM_TT_FLAG_PRIV_POPULATED: TTM internal only. DO NOT USE. This is
 	 * set by TTM after ttm_tt_populate() has successfully returned, and is
 	 * then unset when TTM calls ttm_tt_unpopulate().
@@ -87,8 +93,9 @@
 #define TTM_TT_FLAG_ZERO_ALLOC		BIT(1)
 #define TTM_TT_FLAG_EXTERNAL		BIT(2)
 #define TTM_TT_FLAG_EXTERNAL_MAPPABLE	BIT(3)
+#define TTM_TT_FLAG_DECRYPTED		BIT(4)
 
-#define TTM_TT_FLAG_PRIV_POPULATED	BIT(4)
+#define TTM_TT_FLAG_PRIV_POPULATED	BIT(5)
 	uint32_t page_flags;
 	/** @num_pages: Number of pages in the page array. */
 	uint32_t num_pages;
--- linux-qcom-6.8.0.orig/include/dt-bindings/arm/qcom,ids.h
+++ linux-qcom-6.8.0/include/dt-bindings/arm/qcom,ids.h
@@ -238,6 +238,7 @@
 #define QCOM_ID_SC7280			487
 #define QCOM_ID_SC7180P			495
 #define QCOM_ID_QCM6490			497
+#define QCOM_ID_QCS6490			498
 #define QCOM_ID_IPQ5000			503
 #define QCOM_ID_IPQ0509			504
 #define QCOM_ID_IPQ0518			505
@@ -252,11 +253,13 @@
 #define QCOM_ID_IPQ9510			521
 #define QCOM_ID_QRB4210			523
 #define QCOM_ID_QRB2210			524
+#define QCOM_ID_SA8255P			532
 #define QCOM_ID_SA8775P			534
 #define QCOM_ID_QRU1000			539
 #define QCOM_ID_QDU1000			545
 #define QCOM_ID_SM8650			557
 #define QCOM_ID_SM4450			568
+#define QCOM_ID_SM8650P			577
 #define QCOM_ID_QDU1010			587
 #define QCOM_ID_QRU1032			588
 #define QCOM_ID_QRU1052			589
@@ -265,7 +268,19 @@
 #define QCOM_ID_IPQ5322			593
 #define QCOM_ID_IPQ5312			594
 #define QCOM_ID_IPQ5302			595
+#define QCOM_ID_QCS8550			603
+#define QCOM_ID_QCM8550			604
+#define QCOM_ID_SA7255P			606
 #define QCOM_ID_IPQ5300			624
+#define QCOM_ID_SA8797P			648
+#define QCOM_ID_IPQ5321			650
+#define QCOM_ID_QCS9100			667
+#define QCOM_ID_QCS8300			674
+#define QCOM_ID_QCS8275			675
+#define QCOM_ID_QCS9075			676
+#define QCOM_ID_QCS615			680
+#define QCOM_ID_QAM8397P		689
+#define QCOM_ID_QAM8797P		690
 
 /*
  * The board type and revision information, used by Qualcomm bootloaders and
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/exynos7885.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/exynos7885.h
@@ -136,12 +136,12 @@
 #define CLK_MOUT_FSYS_MMC_CARD_USER	2
 #define CLK_MOUT_FSYS_MMC_EMBD_USER	3
 #define CLK_MOUT_FSYS_MMC_SDIO_USER	4
-#define CLK_MOUT_FSYS_USB30DRD_USER	4
 #define CLK_GOUT_MMC_CARD_ACLK		5
 #define CLK_GOUT_MMC_CARD_SDCLKIN	6
 #define CLK_GOUT_MMC_EMBD_ACLK		7
 #define CLK_GOUT_MMC_EMBD_SDCLKIN	8
 #define CLK_GOUT_MMC_SDIO_ACLK		9
 #define CLK_GOUT_MMC_SDIO_SDCLKIN	10
+#define CLK_MOUT_FSYS_USB30DRD_USER	11
 
 #endif /* _DT_BINDINGS_CLOCK_EXYNOS_7885_H */
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,gcc-sc8180x.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,gcc-sc8180x.h
@@ -246,6 +246,9 @@
 #define GCC_PCIE_3_CLKREF_CLK					236
 #define GCC_USB3_PRIM_CLKREF_CLK				237
 #define GCC_USB3_SEC_CLKREF_CLK					238
+#define GCC_UFS_MEM_CLKREF_EN					239
+#define GCC_UFS_CARD_CLKREF_EN					240
+#define GPLL9							241
 
 #define GCC_EMAC_BCR						0
 #define GCC_GPU_BCR						1
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,qcs615-camcc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,qcs615-camcc.h
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_CLK_QCOM_CAM_CC_QCS615_H
+#define _DT_BINDINGS_CLK_QCOM_CAM_CC_QCS615_H
+
+/* CAM_CC clocks */
+#define CAM_CC_BPS_AHB_CLK					0
+#define CAM_CC_BPS_AREG_CLK					1
+#define CAM_CC_BPS_AXI_CLK					2
+#define CAM_CC_BPS_CLK						3
+#define CAM_CC_BPS_CLK_SRC					4
+#define CAM_CC_CAMNOC_ATB_CLK					5
+#define CAM_CC_CAMNOC_AXI_CLK					6
+#define CAM_CC_CCI_CLK						7
+#define CAM_CC_CCI_CLK_SRC					8
+#define CAM_CC_CORE_AHB_CLK					9
+#define CAM_CC_CPAS_AHB_CLK					10
+#define CAM_CC_CPHY_RX_CLK_SRC					11
+#define CAM_CC_CSI0PHYTIMER_CLK					12
+#define CAM_CC_CSI0PHYTIMER_CLK_SRC				13
+#define CAM_CC_CSI1PHYTIMER_CLK					14
+#define CAM_CC_CSI1PHYTIMER_CLK_SRC				15
+#define CAM_CC_CSI2PHYTIMER_CLK					16
+#define CAM_CC_CSI2PHYTIMER_CLK_SRC				17
+#define CAM_CC_CSIPHY0_CLK					18
+#define CAM_CC_CSIPHY1_CLK					19
+#define CAM_CC_CSIPHY2_CLK					20
+#define CAM_CC_FAST_AHB_CLK_SRC					21
+#define CAM_CC_ICP_ATB_CLK					22
+#define CAM_CC_ICP_CLK						23
+#define CAM_CC_ICP_CLK_SRC					24
+#define CAM_CC_ICP_CTI_CLK					25
+#define CAM_CC_ICP_TS_CLK					26
+#define CAM_CC_IFE_0_AXI_CLK					27
+#define CAM_CC_IFE_0_CLK					28
+#define CAM_CC_IFE_0_CLK_SRC					29
+#define CAM_CC_IFE_0_CPHY_RX_CLK				30
+#define CAM_CC_IFE_0_CSID_CLK					31
+#define CAM_CC_IFE_0_CSID_CLK_SRC				32
+#define CAM_CC_IFE_0_DSP_CLK					33
+#define CAM_CC_IFE_1_AXI_CLK					34
+#define CAM_CC_IFE_1_CLK					35
+#define CAM_CC_IFE_1_CLK_SRC					36
+#define CAM_CC_IFE_1_CPHY_RX_CLK				37
+#define CAM_CC_IFE_1_CSID_CLK					38
+#define CAM_CC_IFE_1_CSID_CLK_SRC				39
+#define CAM_CC_IFE_1_DSP_CLK					40
+#define CAM_CC_IFE_LITE_CLK					41
+#define CAM_CC_IFE_LITE_CLK_SRC					42
+#define CAM_CC_IFE_LITE_CPHY_RX_CLK				43
+#define CAM_CC_IFE_LITE_CSID_CLK				44
+#define CAM_CC_IFE_LITE_CSID_CLK_SRC				45
+#define CAM_CC_IPE_0_AHB_CLK					46
+#define CAM_CC_IPE_0_AREG_CLK					47
+#define CAM_CC_IPE_0_AXI_CLK					48
+#define CAM_CC_IPE_0_CLK					49
+#define CAM_CC_IPE_0_CLK_SRC					50
+#define CAM_CC_JPEG_CLK						51
+#define CAM_CC_JPEG_CLK_SRC					52
+#define CAM_CC_LRME_CLK						53
+#define CAM_CC_LRME_CLK_SRC					54
+#define CAM_CC_MCLK0_CLK					55
+#define CAM_CC_MCLK0_CLK_SRC					56
+#define CAM_CC_MCLK1_CLK					57
+#define CAM_CC_MCLK1_CLK_SRC					58
+#define CAM_CC_MCLK2_CLK					59
+#define CAM_CC_MCLK2_CLK_SRC					60
+#define CAM_CC_MCLK3_CLK					61
+#define CAM_CC_MCLK3_CLK_SRC					62
+#define CAM_CC_PLL0						63
+#define CAM_CC_PLL1						64
+#define CAM_CC_PLL2						65
+#define CAM_CC_PLL2_OUT_AUX2					66
+#define CAM_CC_PLL3						67
+#define CAM_CC_SLOW_AHB_CLK_SRC					68
+#define CAM_CC_SOC_AHB_CLK					69
+#define CAM_CC_SYS_TMR_CLK					70
+
+/* CAM_CC power domains */
+#define BPS_GDSC						0
+#define IFE_0_GDSC						1
+#define IFE_1_GDSC						2
+#define IPE_0_GDSC						3
+#define TITAN_TOP_GDSC						4
+
+/* CAM_CC resets */
+#define CAM_CC_BPS_BCR						0
+#define CAM_CC_CAMNOC_BCR					1
+#define CAM_CC_CCI_BCR						2
+#define CAM_CC_CPAS_BCR						3
+#define CAM_CC_CSI0PHY_BCR					4
+#define CAM_CC_CSI1PHY_BCR					5
+#define CAM_CC_CSI2PHY_BCR					6
+#define CAM_CC_ICP_BCR						7
+#define CAM_CC_IFE_0_BCR					8
+#define CAM_CC_IFE_1_BCR					9
+#define CAM_CC_IFE_LITE_BCR					10
+#define CAM_CC_IPE_0_BCR					11
+#define CAM_CC_JPEG_BCR						12
+#define CAM_CC_LRME_BCR						13
+#define CAM_CC_MCLK0_BCR					14
+#define CAM_CC_MCLK1_BCR					15
+#define CAM_CC_MCLK2_BCR					16
+#define CAM_CC_MCLK3_BCR					17
+#define CAM_CC_TITAN_TOP_BCR					18
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,qcs615-dispcc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,qcs615-dispcc.h
@@ -0,0 +1,52 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_CLK_QCOM_DISP_CC_QCS615_H
+#define _DT_BINDINGS_CLK_QCOM_DISP_CC_QCS615_H
+
+/* DISP_CC clocks */
+#define DISP_CC_MDSS_AHB_CLK					0
+#define DISP_CC_MDSS_AHB_CLK_SRC				1
+#define DISP_CC_MDSS_BYTE0_CLK					2
+#define DISP_CC_MDSS_BYTE0_CLK_SRC				3
+#define DISP_CC_MDSS_BYTE0_DIV_CLK_SRC				4
+#define DISP_CC_MDSS_BYTE0_INTF_CLK				5
+#define DISP_CC_MDSS_DP_AUX_CLK					6
+#define DISP_CC_MDSS_DP_AUX_CLK_SRC				7
+#define DISP_CC_MDSS_DP_CRYPTO_CLK				8
+#define DISP_CC_MDSS_DP_CRYPTO_CLK_SRC				9
+#define DISP_CC_MDSS_DP_LINK_CLK				10
+#define DISP_CC_MDSS_DP_LINK_CLK_SRC				11
+#define DISP_CC_MDSS_DP_LINK_DIV_CLK_SRC			12
+#define DISP_CC_MDSS_DP_LINK_INTF_CLK				13
+#define DISP_CC_MDSS_DP_PIXEL1_CLK				14
+#define DISP_CC_MDSS_DP_PIXEL1_CLK_SRC				15
+#define DISP_CC_MDSS_DP_PIXEL_CLK				16
+#define DISP_CC_MDSS_DP_PIXEL_CLK_SRC				17
+#define DISP_CC_MDSS_ESC0_CLK					18
+#define DISP_CC_MDSS_ESC0_CLK_SRC				19
+#define DISP_CC_MDSS_MDP_CLK					20
+#define DISP_CC_MDSS_MDP_CLK_SRC				21
+#define DISP_CC_MDSS_MDP_LUT_CLK				22
+#define DISP_CC_MDSS_NON_GDSC_AHB_CLK				23
+#define DISP_CC_MDSS_PCLK0_CLK					24
+#define DISP_CC_MDSS_PCLK0_CLK_SRC				25
+#define DISP_CC_MDSS_ROT_CLK					26
+#define DISP_CC_MDSS_ROT_CLK_SRC				27
+#define DISP_CC_MDSS_RSCC_AHB_CLK				28
+#define DISP_CC_MDSS_RSCC_VSYNC_CLK				29
+#define DISP_CC_MDSS_VSYNC_CLK					30
+#define DISP_CC_MDSS_VSYNC_CLK_SRC				31
+#define DISP_CC_PLL0						32
+#define DISP_CC_XO_CLK						33
+
+/* DISP_CC power domains */
+#define MDSS_CORE_GDSC						0
+
+/* DISP_CC resets */
+#define DISP_CC_MDSS_CORE_BCR					0
+#define DISP_CC_MDSS_RSCC_BCR					1
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,qcs615-gcc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,qcs615-gcc.h
@@ -0,0 +1,211 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_CLK_QCOM_GCC_QCS615_H
+#define _DT_BINDINGS_CLK_QCOM_GCC_QCS615_H
+
+/* GCC clocks */
+#define GPLL0_OUT_AUX2_DIV					0
+#define GPLL3_OUT_AUX2_DIV					1
+#define GPLL0							2
+#define GPLL3							3
+#define GPLL4							4
+#define GPLL6							5
+#define GPLL6_OUT_MAIN						6
+#define GPLL7							7
+#define GPLL8							8
+#define GPLL8_OUT_MAIN						9
+#define GCC_AGGRE_UFS_PHY_AXI_CLK				10
+#define GCC_AGGRE_USB2_SEC_AXI_CLK				11
+#define GCC_AGGRE_USB3_PRIM_AXI_CLK				12
+#define GCC_AHB2PHY_EAST_CLK					13
+#define GCC_AHB2PHY_WEST_CLK					14
+#define GCC_BOOT_ROM_AHB_CLK					15
+#define GCC_CAMERA_AHB_CLK					16
+#define GCC_CAMERA_HF_AXI_CLK					17
+#define GCC_CAMERA_XO_CLK					18
+#define GCC_CE1_AHB_CLK						19
+#define GCC_CE1_AXI_CLK						20
+#define GCC_CE1_CLK						21
+#define GCC_CFG_NOC_USB2_SEC_AXI_CLK				22
+#define GCC_CFG_NOC_USB3_PRIM_AXI_CLK				23
+#define GCC_CPUSS_AHB_CLK					24
+#define GCC_CPUSS_AHB_CLK_SRC					25
+#define GCC_CPUSS_GNOC_CLK					26
+#define GCC_DDRSS_GPU_AXI_CLK					27
+#define GCC_DISP_AHB_CLK					28
+#define GCC_DISP_GPLL0_DIV_CLK_SRC				29
+#define GCC_DISP_HF_AXI_CLK					30
+#define GCC_DISP_XO_CLK						31
+#define GCC_EMAC_AXI_CLK					32
+#define GCC_EMAC_PTP_CLK					33
+#define GCC_EMAC_PTP_CLK_SRC					34
+#define GCC_EMAC_RGMII_CLK					35
+#define GCC_EMAC_RGMII_CLK_SRC					36
+#define GCC_EMAC_SLV_AHB_CLK					37
+#define GCC_GP1_CLK						38
+#define GCC_GP1_CLK_SRC						39
+#define GCC_GP2_CLK						40
+#define GCC_GP2_CLK_SRC						41
+#define GCC_GP3_CLK						42
+#define GCC_GP3_CLK_SRC						43
+#define GCC_GPU_CFG_AHB_CLK					44
+#define GCC_GPU_GPLL0_CLK_SRC					45
+#define GCC_GPU_GPLL0_DIV_CLK_SRC				46
+#define GCC_GPU_IREF_CLK					47
+#define GCC_GPU_MEMNOC_GFX_CLK					48
+#define GCC_GPU_SNOC_DVM_GFX_CLK				49
+#define GCC_PCIE0_PHY_REFGEN_CLK				50
+#define GCC_PCIE_0_AUX_CLK					51
+#define GCC_PCIE_0_AUX_CLK_SRC					52
+#define GCC_PCIE_0_CFG_AHB_CLK					53
+#define GCC_PCIE_0_CLKREF_CLK					54
+#define GCC_PCIE_0_MSTR_AXI_CLK					55
+#define GCC_PCIE_0_PIPE_CLK					56
+#define GCC_PCIE_0_SLV_AXI_CLK					57
+#define GCC_PCIE_0_SLV_Q2A_AXI_CLK				58
+#define GCC_PCIE_PHY_AUX_CLK					59
+#define GCC_PCIE_PHY_REFGEN_CLK_SRC				60
+#define GCC_PDM2_CLK						61
+#define GCC_PDM2_CLK_SRC					62
+#define GCC_PDM_AHB_CLK						63
+#define GCC_PDM_XO4_CLK						64
+#define GCC_PRNG_AHB_CLK					65
+#define GCC_QMIP_CAMERA_NRT_AHB_CLK				66
+#define GCC_QMIP_DISP_AHB_CLK					67
+#define GCC_QMIP_PCIE_AHB_CLK					68
+#define GCC_QMIP_VIDEO_VCODEC_AHB_CLK				69
+#define GCC_QSPI_CNOC_PERIPH_AHB_CLK				70
+#define GCC_QSPI_CORE_CLK					71
+#define GCC_QSPI_CORE_CLK_SRC					72
+#define GCC_QUPV3_WRAP0_CORE_2X_CLK				73
+#define GCC_QUPV3_WRAP0_CORE_CLK				74
+#define GCC_QUPV3_WRAP0_S0_CLK					75
+#define GCC_QUPV3_WRAP0_S0_CLK_SRC				76
+#define GCC_QUPV3_WRAP0_S1_CLK					77
+#define GCC_QUPV3_WRAP0_S1_CLK_SRC				78
+#define GCC_QUPV3_WRAP0_S2_CLK					79
+#define GCC_QUPV3_WRAP0_S2_CLK_SRC				80
+#define GCC_QUPV3_WRAP0_S3_CLK					81
+#define GCC_QUPV3_WRAP0_S3_CLK_SRC				82
+#define GCC_QUPV3_WRAP0_S4_CLK					83
+#define GCC_QUPV3_WRAP0_S4_CLK_SRC				84
+#define GCC_QUPV3_WRAP0_S5_CLK					85
+#define GCC_QUPV3_WRAP0_S5_CLK_SRC				86
+#define GCC_QUPV3_WRAP1_CORE_2X_CLK				87
+#define GCC_QUPV3_WRAP1_CORE_CLK				88
+#define GCC_QUPV3_WRAP1_S0_CLK					89
+#define GCC_QUPV3_WRAP1_S0_CLK_SRC				90
+#define GCC_QUPV3_WRAP1_S1_CLK					91
+#define GCC_QUPV3_WRAP1_S1_CLK_SRC				92
+#define GCC_QUPV3_WRAP1_S2_CLK					93
+#define GCC_QUPV3_WRAP1_S2_CLK_SRC				94
+#define GCC_QUPV3_WRAP1_S3_CLK					95
+#define GCC_QUPV3_WRAP1_S3_CLK_SRC				96
+#define GCC_QUPV3_WRAP1_S4_CLK					97
+#define GCC_QUPV3_WRAP1_S4_CLK_SRC				98
+#define GCC_QUPV3_WRAP1_S5_CLK					99
+#define GCC_QUPV3_WRAP1_S5_CLK_SRC				100
+#define GCC_QUPV3_WRAP_0_M_AHB_CLK				101
+#define GCC_QUPV3_WRAP_0_S_AHB_CLK				102
+#define GCC_QUPV3_WRAP_1_M_AHB_CLK				103
+#define GCC_QUPV3_WRAP_1_S_AHB_CLK				104
+#define GCC_RX1_USB2_CLKREF_CLK					105
+#define GCC_RX3_USB2_CLKREF_CLK					106
+#define GCC_SDCC1_AHB_CLK					107
+#define GCC_SDCC1_APPS_CLK					108
+#define GCC_SDCC1_APPS_CLK_SRC					109
+#define GCC_SDCC1_ICE_CORE_CLK					110
+#define GCC_SDCC1_ICE_CORE_CLK_SRC				111
+#define GCC_SDCC2_AHB_CLK					112
+#define GCC_SDCC2_APPS_CLK					113
+#define GCC_SDCC2_APPS_CLK_SRC					114
+#define GCC_SDR_CORE_CLK					115
+#define GCC_SDR_CSR_HCLK					116
+#define GCC_SDR_PRI_MI2S_CLK					117
+#define GCC_SDR_SEC_MI2S_CLK					118
+#define GCC_SDR_WR0_MEM_CLK					119
+#define GCC_SDR_WR1_MEM_CLK					120
+#define GCC_SDR_WR2_MEM_CLK					121
+#define GCC_SYS_NOC_CPUSS_AHB_CLK				122
+#define GCC_UFS_CARD_CLKREF_CLK					123
+#define GCC_UFS_MEM_CLKREF_CLK					124
+#define GCC_UFS_PHY_AHB_CLK					125
+#define GCC_UFS_PHY_AXI_CLK					126
+#define GCC_UFS_PHY_AXI_CLK_SRC					127
+#define GCC_UFS_PHY_ICE_CORE_CLK				128
+#define GCC_UFS_PHY_ICE_CORE_CLK_SRC				129
+#define GCC_UFS_PHY_PHY_AUX_CLK					130
+#define GCC_UFS_PHY_PHY_AUX_CLK_SRC				131
+#define GCC_UFS_PHY_RX_SYMBOL_0_CLK				132
+#define GCC_UFS_PHY_TX_SYMBOL_0_CLK				133
+#define GCC_UFS_PHY_UNIPRO_CORE_CLK				134
+#define GCC_UFS_PHY_UNIPRO_CORE_CLK_SRC				135
+#define GCC_USB20_SEC_MASTER_CLK				136
+#define GCC_USB20_SEC_MASTER_CLK_SRC				137
+#define GCC_USB20_SEC_MOCK_UTMI_CLK				138
+#define GCC_USB20_SEC_MOCK_UTMI_CLK_SRC				139
+#define GCC_USB20_SEC_SLEEP_CLK					140
+#define GCC_USB2_PRIM_CLKREF_CLK				141
+#define GCC_USB2_SEC_CLKREF_CLK					142
+#define GCC_USB2_SEC_PHY_AUX_CLK				143
+#define GCC_USB2_SEC_PHY_AUX_CLK_SRC				144
+#define GCC_USB2_SEC_PHY_COM_AUX_CLK				145
+#define GCC_USB2_SEC_PHY_PIPE_CLK				146
+#define GCC_USB30_PRIM_MASTER_CLK				147
+#define GCC_USB30_PRIM_MASTER_CLK_SRC				148
+#define GCC_USB30_PRIM_MOCK_UTMI_CLK				149
+#define GCC_USB30_PRIM_MOCK_UTMI_CLK_SRC			150
+#define GCC_USB30_PRIM_SLEEP_CLK				151
+#define GCC_USB3_PRIM_CLKREF_CLK				152
+#define GCC_USB3_PRIM_PHY_AUX_CLK				153
+#define GCC_USB3_PRIM_PHY_AUX_CLK_SRC				154
+#define GCC_USB3_PRIM_PHY_COM_AUX_CLK				155
+#define GCC_USB3_PRIM_PHY_PIPE_CLK				156
+#define GCC_USB3_SEC_CLKREF_CLK					157
+#define GCC_VIDEO_AHB_CLK					158
+#define GCC_VIDEO_AXI0_CLK					159
+#define GCC_VIDEO_XO_CLK					160
+#define GCC_VSENSOR_CLK_SRC					161
+#define GCC_AGGRE_UFS_PHY_AXI_HW_CTL_CLK			162
+#define GCC_UFS_PHY_AXI_HW_CTL_CLK				163
+#define GCC_UFS_PHY_ICE_CORE_HW_CTL_CLK				164
+#define GCC_UFS_PHY_PHY_AUX_HW_CTL_CLK				165
+#define GCC_UFS_PHY_UNIPRO_CORE_HW_CTL_CLK			166
+
+/* GCC Resets */
+#define GCC_EMAC_BCR                                            0
+#define GCC_QUSB2PHY_PRIM_BCR                                   1
+#define GCC_QUSB2PHY_SEC_BCR                                    2
+#define GCC_USB30_PRIM_BCR                                      3
+#define GCC_USB2_PHY_SEC_BCR                                    4
+#define GCC_USB3_DP_PHY_SEC_BCR                                 5
+#define GCC_USB3PHY_PHY_SEC_BCR                                 6
+#define GCC_PCIE_0_BCR                                          7
+#define GCC_PCIE_0_PHY_BCR                                      8
+#define GCC_PCIE_PHY_BCR                                        9
+#define GCC_PCIE_PHY_COM_BCR                                    10
+#define GCC_UFS_PHY_BCR                                         11
+#define GCC_USB20_SEC_BCR                                       12
+#define GCC_USB3_PHY_PRIM_SP0_BCR                               13
+#define GCC_USB3PHY_PHY_PRIM_SP0_BCR                            14
+#define GCC_SDCC1_BCR                                           15
+#define GCC_SDCC2_BCR                                           16
+
+/* GCC power domains */
+#define EMAC_GDSC						0
+#define PCIE_0_GDSC						1
+#define UFS_PHY_GDSC						2
+#define USB20_SEC_GDSC						3
+#define USB30_PRIM_GDSC						4
+#define HLOS1_VOTE_AGGRE_NOC_MMU_AUDIO_TBU_GDSC			5
+#define HLOS1_VOTE_AGGRE_NOC_MMU_TBU1_GDSC			6
+#define HLOS1_VOTE_AGGRE_NOC_MMU_TBU2_GDSC			7
+#define HLOS1_VOTE_AGGRE_NOC_MMU_PCIE_TBU_GDSC			8
+#define HLOS1_VOTE_MMNOC_MMU_TBU_HF0_GDSC			9
+#define HLOS1_VOTE_MMNOC_MMU_TBU_SF_GDSC			10
+#define HLOS1_VOTE_MMNOC_MMU_TBU_HF1_GDSC			11
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,qcs615-gpucc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,qcs615-gpucc.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_CLK_QCOM_GPU_CC_QCS615_H
+#define _DT_BINDINGS_CLK_QCOM_GPU_CC_QCS615_H
+
+/* GPU_CC clocks */
+#define CRC_DIV_PLL0						0
+#define CRC_DIV_PLL1						1
+#define GPU_CC_PLL0						2
+#define GPU_CC_PLL1						3
+#define GPU_CC_CRC_AHB_CLK					4
+#define GPU_CC_CX_GFX3D_CLK					5
+#define GPU_CC_CX_GFX3D_SLV_CLK					6
+#define GPU_CC_CX_GMU_CLK					7
+#define GPU_CC_CX_SNOC_DVM_CLK					8
+#define GPU_CC_CXO_AON_CLK					9
+#define GPU_CC_CXO_CLK						10
+#define GPU_CC_GMU_CLK_SRC					11
+#define GPU_CC_GX_GFX3D_CLK					12
+#define GPU_CC_GX_GFX3D_CLK_SRC					13
+#define GPU_CC_GX_GMU_CLK					14
+#define GPU_CC_HLOS1_VOTE_GPU_SMMU_CLK				15
+#define GPU_CC_SLEEP_CLK					16
+
+/* GPU_CC power domains */
+#define CX_GDSC							0
+#define GX_GDSC							1
+
+/* GPU_CC resets */
+#define GPU_CC_CX_BCR						0
+#define GPU_CC_GFX3D_AON_BCR					1
+#define GPU_CC_GMU_BCR						2
+#define GPU_CC_GX_BCR						3
+#define GPU_CC_XO_BCR						4
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,qcs615-videocc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,qcs615-videocc.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_CLK_QCOM_VIDEO_CC_QCS615_H
+#define _DT_BINDINGS_CLK_QCOM_VIDEO_CC_QCS615_H
+
+/* VIDEO_CC clocks */
+#define VIDEO_CC_SLEEP_CLK					0
+#define VIDEO_CC_SLEEP_CLK_SRC					1
+#define VIDEO_CC_VCODEC0_AXI_CLK				2
+#define VIDEO_CC_VCODEC0_CORE_CLK				3
+#define VIDEO_CC_VENUS_AHB_CLK					4
+#define VIDEO_CC_VENUS_CLK_SRC					5
+#define VIDEO_CC_VENUS_CTL_AXI_CLK				6
+#define VIDEO_CC_VENUS_CTL_CORE_CLK				7
+#define VIDEO_CC_XO_CLK						8
+#define VIDEO_PLL0						9
+
+/* VIDEO_CC power domains */
+#define VCODEC0_GDSC						0
+#define VENUS_GDSC						1
+
+/* VIDEO_CC resets */
+#define VIDEO_CC_INTERFACE_BCR					0
+#define VIDEO_CC_VCODEC0_BCR					1
+#define VIDEO_CC_VENUS_BCR					2
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,qcs8300-gcc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,qcs8300-gcc.h
@@ -0,0 +1,234 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_CLK_QCOM_GCC_QCS8300_H
+#define _DT_BINDINGS_CLK_QCOM_GCC_QCS8300_H
+
+/* GCC clocks */
+#define GCC_GPLL0						0
+#define GCC_GPLL0_OUT_EVEN					1
+#define GCC_GPLL1						2
+#define GCC_GPLL4						3
+#define GCC_GPLL7						4
+#define GCC_GPLL9						5
+#define GCC_AGGRE_NOC_QUPV3_AXI_CLK				6
+#define GCC_AGGRE_UFS_PHY_AXI_CLK				7
+#define GCC_AGGRE_USB2_PRIM_AXI_CLK				8
+#define GCC_AGGRE_USB3_PRIM_AXI_CLK				9
+#define GCC_AHB2PHY0_CLK					10
+#define GCC_AHB2PHY2_CLK					11
+#define GCC_AHB2PHY3_CLK					12
+#define GCC_BOOT_ROM_AHB_CLK					13
+#define GCC_CAMERA_AHB_CLK					14
+#define GCC_CAMERA_HF_AXI_CLK					15
+#define GCC_CAMERA_SF_AXI_CLK					16
+#define GCC_CAMERA_THROTTLE_XO_CLK				17
+#define GCC_CAMERA_XO_CLK					18
+#define GCC_CFG_NOC_USB2_PRIM_AXI_CLK				19
+#define GCC_CFG_NOC_USB3_PRIM_AXI_CLK				20
+#define GCC_DDRSS_GPU_AXI_CLK					21
+#define GCC_DISP_AHB_CLK					22
+#define GCC_DISP_HF_AXI_CLK					23
+#define GCC_DISP_XO_CLK						24
+#define GCC_EDP_REF_CLKREF_EN					25
+#define GCC_EMAC0_AXI_CLK					26
+#define GCC_EMAC0_PHY_AUX_CLK					27
+#define GCC_EMAC0_PHY_AUX_CLK_SRC				28
+#define GCC_EMAC0_PTP_CLK					29
+#define GCC_EMAC0_PTP_CLK_SRC					30
+#define GCC_EMAC0_RGMII_CLK					31
+#define GCC_EMAC0_RGMII_CLK_SRC					32
+#define GCC_EMAC0_SLV_AHB_CLK					33
+#define GCC_GP1_CLK						34
+#define GCC_GP1_CLK_SRC						35
+#define GCC_GP2_CLK						36
+#define GCC_GP2_CLK_SRC						37
+#define GCC_GP3_CLK						38
+#define GCC_GP3_CLK_SRC						39
+#define GCC_GP4_CLK						40
+#define GCC_GP4_CLK_SRC						41
+#define GCC_GP5_CLK						42
+#define GCC_GP5_CLK_SRC						43
+#define GCC_GPU_CFG_AHB_CLK					44
+#define GCC_GPU_GPLL0_CLK_SRC					45
+#define GCC_GPU_GPLL0_DIV_CLK_SRC				46
+#define GCC_GPU_MEMNOC_GFX_CENTER_PIPELINE_CLK			47
+#define GCC_GPU_MEMNOC_GFX_CLK					48
+#define GCC_GPU_SNOC_DVM_GFX_CLK				49
+#define GCC_GPU_TCU_THROTTLE_AHB_CLK				50
+#define GCC_GPU_TCU_THROTTLE_CLK				51
+#define GCC_PCIE_0_AUX_CLK					52
+#define GCC_PCIE_0_AUX_CLK_SRC					53
+#define GCC_PCIE_0_CFG_AHB_CLK					54
+#define GCC_PCIE_0_MSTR_AXI_CLK					55
+#define GCC_PCIE_0_PHY_AUX_CLK					56
+#define GCC_PCIE_0_PHY_AUX_CLK_SRC				57
+#define GCC_PCIE_0_PHY_RCHNG_CLK				58
+#define GCC_PCIE_0_PHY_RCHNG_CLK_SRC				59
+#define GCC_PCIE_0_PIPE_CLK					60
+#define GCC_PCIE_0_PIPE_CLK_SRC					61
+#define GCC_PCIE_0_PIPE_DIV_CLK_SRC				62
+#define GCC_PCIE_0_PIPEDIV2_CLK					63
+#define GCC_PCIE_0_SLV_AXI_CLK					64
+#define GCC_PCIE_0_SLV_Q2A_AXI_CLK				65
+#define GCC_PCIE_1_AUX_CLK					66
+#define GCC_PCIE_1_AUX_CLK_SRC					67
+#define GCC_PCIE_1_CFG_AHB_CLK					68
+#define GCC_PCIE_1_MSTR_AXI_CLK					69
+#define GCC_PCIE_1_PHY_AUX_CLK					70
+#define GCC_PCIE_1_PHY_AUX_CLK_SRC				71
+#define GCC_PCIE_1_PHY_RCHNG_CLK				72
+#define GCC_PCIE_1_PHY_RCHNG_CLK_SRC				73
+#define GCC_PCIE_1_PIPE_CLK					74
+#define GCC_PCIE_1_PIPE_CLK_SRC					75
+#define GCC_PCIE_1_PIPE_DIV_CLK_SRC				76
+#define GCC_PCIE_1_PIPEDIV2_CLK					77
+#define GCC_PCIE_1_SLV_AXI_CLK					78
+#define GCC_PCIE_1_SLV_Q2A_AXI_CLK				79
+#define GCC_PCIE_CLKREF_EN					80
+#define GCC_PCIE_THROTTLE_CFG_CLK				81
+#define GCC_PDM2_CLK						82
+#define GCC_PDM2_CLK_SRC					83
+#define GCC_PDM_AHB_CLK						84
+#define GCC_PDM_XO4_CLK						85
+#define GCC_QMIP_CAMERA_NRT_AHB_CLK				86
+#define GCC_QMIP_CAMERA_RT_AHB_CLK				87
+#define GCC_QMIP_DISP_AHB_CLK					88
+#define GCC_QMIP_DISP_ROT_AHB_CLK				89
+#define GCC_QMIP_VIDEO_CVP_AHB_CLK				90
+#define GCC_QMIP_VIDEO_VCODEC_AHB_CLK				91
+#define GCC_QMIP_VIDEO_VCPU_AHB_CLK				92
+#define GCC_QUPV3_WRAP0_CORE_2X_CLK				93
+#define GCC_QUPV3_WRAP0_CORE_CLK				94
+#define GCC_QUPV3_WRAP0_S0_CLK					95
+#define GCC_QUPV3_WRAP0_S0_CLK_SRC				96
+#define GCC_QUPV3_WRAP0_S1_CLK					97
+#define GCC_QUPV3_WRAP0_S1_CLK_SRC				98
+#define GCC_QUPV3_WRAP0_S2_CLK					99
+#define GCC_QUPV3_WRAP0_S2_CLK_SRC				100
+#define GCC_QUPV3_WRAP0_S3_CLK					101
+#define GCC_QUPV3_WRAP0_S3_CLK_SRC				102
+#define GCC_QUPV3_WRAP0_S4_CLK					103
+#define GCC_QUPV3_WRAP0_S4_CLK_SRC				104
+#define GCC_QUPV3_WRAP0_S5_CLK					105
+#define GCC_QUPV3_WRAP0_S5_CLK_SRC				106
+#define GCC_QUPV3_WRAP0_S6_CLK					107
+#define GCC_QUPV3_WRAP0_S6_CLK_SRC				108
+#define GCC_QUPV3_WRAP0_S7_CLK					109
+#define GCC_QUPV3_WRAP0_S7_CLK_SRC				110
+#define GCC_QUPV3_WRAP1_CORE_2X_CLK				111
+#define GCC_QUPV3_WRAP1_CORE_CLK				112
+#define GCC_QUPV3_WRAP1_S0_CLK					113
+#define GCC_QUPV3_WRAP1_S0_CLK_SRC				114
+#define GCC_QUPV3_WRAP1_S1_CLK					115
+#define GCC_QUPV3_WRAP1_S1_CLK_SRC				116
+#define GCC_QUPV3_WRAP1_S2_CLK					117
+#define GCC_QUPV3_WRAP1_S2_CLK_SRC				118
+#define GCC_QUPV3_WRAP1_S3_CLK					119
+#define GCC_QUPV3_WRAP1_S3_CLK_SRC				120
+#define GCC_QUPV3_WRAP1_S4_CLK					121
+#define GCC_QUPV3_WRAP1_S4_CLK_SRC				122
+#define GCC_QUPV3_WRAP1_S5_CLK					123
+#define GCC_QUPV3_WRAP1_S5_CLK_SRC				124
+#define GCC_QUPV3_WRAP1_S6_CLK					125
+#define GCC_QUPV3_WRAP1_S6_CLK_SRC				126
+#define GCC_QUPV3_WRAP1_S7_CLK					127
+#define GCC_QUPV3_WRAP1_S7_CLK_SRC				128
+#define GCC_QUPV3_WRAP3_CORE_2X_CLK				129
+#define GCC_QUPV3_WRAP3_CORE_CLK				130
+#define GCC_QUPV3_WRAP3_QSPI_CLK				131
+#define GCC_QUPV3_WRAP3_S0_CLK					132
+#define GCC_QUPV3_WRAP3_S0_CLK_SRC				133
+#define GCC_QUPV3_WRAP3_S0_DIV_CLK_SRC				134
+#define GCC_QUPV3_WRAP_0_M_AHB_CLK				135
+#define GCC_QUPV3_WRAP_0_S_AHB_CLK				136
+#define GCC_QUPV3_WRAP_1_M_AHB_CLK				137
+#define GCC_QUPV3_WRAP_1_S_AHB_CLK				138
+#define GCC_QUPV3_WRAP_3_M_AHB_CLK				139
+#define GCC_QUPV3_WRAP_3_S_AHB_CLK				140
+#define GCC_SDCC1_AHB_CLK					141
+#define GCC_SDCC1_APPS_CLK					142
+#define GCC_SDCC1_APPS_CLK_SRC					143
+#define GCC_SDCC1_ICE_CORE_CLK					144
+#define GCC_SDCC1_ICE_CORE_CLK_SRC				145
+#define GCC_SGMI_CLKREF_EN					146
+#define GCC_UFS_PHY_AHB_CLK					147
+#define GCC_UFS_PHY_AXI_CLK					148
+#define GCC_UFS_PHY_AXI_CLK_SRC					149
+#define GCC_UFS_PHY_ICE_CORE_CLK				150
+#define GCC_UFS_PHY_ICE_CORE_CLK_SRC				151
+#define GCC_UFS_PHY_PHY_AUX_CLK					152
+#define GCC_UFS_PHY_PHY_AUX_CLK_SRC				153
+#define GCC_UFS_PHY_RX_SYMBOL_0_CLK				154
+#define GCC_UFS_PHY_RX_SYMBOL_0_CLK_SRC				155
+#define GCC_UFS_PHY_RX_SYMBOL_1_CLK				156
+#define GCC_UFS_PHY_RX_SYMBOL_1_CLK_SRC				157
+#define GCC_UFS_PHY_TX_SYMBOL_0_CLK				158
+#define GCC_UFS_PHY_TX_SYMBOL_0_CLK_SRC				159
+#define GCC_UFS_PHY_UNIPRO_CORE_CLK				160
+#define GCC_UFS_PHY_UNIPRO_CORE_CLK_SRC				161
+#define GCC_USB20_MASTER_CLK					162
+#define GCC_USB20_MASTER_CLK_SRC				163
+#define GCC_USB20_MOCK_UTMI_CLK					164
+#define GCC_USB20_MOCK_UTMI_CLK_SRC				165
+#define GCC_USB20_MOCK_UTMI_POSTDIV_CLK_SRC			166
+#define GCC_USB20_SLEEP_CLK					167
+#define GCC_USB30_PRIM_MASTER_CLK				168
+#define GCC_USB30_PRIM_MASTER_CLK_SRC				169
+#define GCC_USB30_PRIM_MOCK_UTMI_CLK				170
+#define GCC_USB30_PRIM_MOCK_UTMI_CLK_SRC			171
+#define GCC_USB30_PRIM_MOCK_UTMI_POSTDIV_CLK_SRC		172
+#define GCC_USB30_PRIM_SLEEP_CLK				173
+#define GCC_USB3_PRIM_PHY_AUX_CLK				174
+#define GCC_USB3_PRIM_PHY_AUX_CLK_SRC				175
+#define GCC_USB3_PRIM_PHY_COM_AUX_CLK				176
+#define GCC_USB3_PRIM_PHY_PIPE_CLK				177
+#define GCC_USB3_PRIM_PHY_PIPE_CLK_SRC				178
+#define GCC_USB_CLKREF_EN					179
+#define GCC_VIDEO_AHB_CLK					180
+#define GCC_VIDEO_AXI0_CLK					181
+#define GCC_VIDEO_AXI1_CLK					182
+#define GCC_VIDEO_XO_CLK					183
+
+/* GCC power domains */
+#define GCC_EMAC0_GDSC						0
+#define GCC_PCIE_0_GDSC						1
+#define GCC_PCIE_1_GDSC						2
+#define GCC_UFS_PHY_GDSC					3
+#define GCC_USB20_PRIM_GDSC					4
+#define GCC_USB30_PRIM_GDSC					5
+
+/* GCC resets */
+#define GCC_EMAC0_BCR						0
+#define GCC_PCIE_0_BCR						1
+#define GCC_PCIE_0_LINK_DOWN_BCR				2
+#define GCC_PCIE_0_NOCSR_COM_PHY_BCR				3
+#define GCC_PCIE_0_PHY_BCR					4
+#define GCC_PCIE_0_PHY_NOCSR_COM_PHY_BCR			5
+#define GCC_PCIE_1_BCR						6
+#define GCC_PCIE_1_LINK_DOWN_BCR				7
+#define GCC_PCIE_1_NOCSR_COM_PHY_BCR				8
+#define GCC_PCIE_1_PHY_BCR					9
+#define GCC_PCIE_1_PHY_NOCSR_COM_PHY_BCR			10
+#define GCC_SDCC1_BCR						11
+#define GCC_UFS_PHY_BCR						12
+#define GCC_USB20_PRIM_BCR					13
+#define GCC_USB2_PHY_PRIM_BCR					14
+#define GCC_USB2_PHY_SEC_BCR					15
+#define GCC_USB30_PRIM_BCR					16
+#define GCC_USB3_DP_PHY_PRIM_BCR				17
+#define GCC_USB3_PHY_PRIM_BCR					18
+#define GCC_USB3_PHY_TERT_BCR					19
+#define GCC_USB3_UNIPHY_MP0_BCR					20
+#define GCC_USB3_UNIPHY_MP1_BCR					21
+#define GCC_USB3PHY_PHY_PRIM_BCR				22
+#define GCC_USB3UNIPHY_PHY_MP0_BCR				23
+#define GCC_USB3UNIPHY_PHY_MP1_BCR				24
+#define GCC_USB_PHY_CFG_AHB2PHY_BCR				25
+#define GCC_VIDEO_BCR						26
+#define GCC_VIDEO_AXI0_CLK_ARES					27
+#define GCC_VIDEO_AXI1_CLK_ARES					28
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,sa8775p-camcc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,sa8775p-camcc.h
@@ -0,0 +1,109 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_CLK_QCOM_SA8775P_CAM_CC_H
+#define _DT_BINDINGS_CLK_QCOM_SA8775P_CAM_CC_H
+
+/* CAM_CC clocks */
+#define CAM_CC_CAMNOC_AXI_CLK					0
+#define CAM_CC_CAMNOC_AXI_CLK_SRC				1
+#define CAM_CC_CAMNOC_DCD_XO_CLK				2
+#define CAM_CC_CAMNOC_XO_CLK					3
+#define CAM_CC_CCI_0_CLK					4
+#define CAM_CC_CCI_0_CLK_SRC					5
+#define CAM_CC_CCI_1_CLK					6
+#define CAM_CC_CCI_1_CLK_SRC					7
+#define CAM_CC_CCI_2_CLK					8
+#define CAM_CC_CCI_2_CLK_SRC					9
+#define CAM_CC_CCI_3_CLK					10
+#define CAM_CC_CCI_3_CLK_SRC					11
+#define CAM_CC_CORE_AHB_CLK					12
+#define CAM_CC_CPAS_AHB_CLK					13
+#define CAM_CC_CPAS_FAST_AHB_CLK				14
+#define CAM_CC_CPAS_IFE_0_CLK					15
+#define CAM_CC_CPAS_IFE_1_CLK					16
+#define CAM_CC_CPAS_IFE_LITE_CLK				17
+#define CAM_CC_CPAS_IPE_CLK					18
+#define CAM_CC_CPAS_SFE_LITE_0_CLK				19
+#define CAM_CC_CPAS_SFE_LITE_1_CLK				20
+#define CAM_CC_CPHY_RX_CLK_SRC					21
+#define CAM_CC_CSI0PHYTIMER_CLK					22
+#define CAM_CC_CSI0PHYTIMER_CLK_SRC				23
+#define CAM_CC_CSI1PHYTIMER_CLK					24
+#define CAM_CC_CSI1PHYTIMER_CLK_SRC				25
+#define CAM_CC_CSI2PHYTIMER_CLK					26
+#define CAM_CC_CSI2PHYTIMER_CLK_SRC				27
+#define CAM_CC_CSI3PHYTIMER_CLK					28
+#define CAM_CC_CSI3PHYTIMER_CLK_SRC				29
+#define CAM_CC_CSID_CLK						30
+#define CAM_CC_CSID_CLK_SRC					31
+#define CAM_CC_CSID_CSIPHY_RX_CLK				32
+#define CAM_CC_CSIPHY0_CLK					33
+#define CAM_CC_CSIPHY1_CLK					34
+#define CAM_CC_CSIPHY2_CLK					35
+#define CAM_CC_CSIPHY3_CLK					36
+#define CAM_CC_FAST_AHB_CLK_SRC					37
+#define CAM_CC_GDSC_CLK						38
+#define CAM_CC_ICP_AHB_CLK					39
+#define CAM_CC_ICP_CLK						40
+#define CAM_CC_ICP_CLK_SRC					41
+#define CAM_CC_IFE_0_CLK					42
+#define CAM_CC_IFE_0_CLK_SRC					43
+#define CAM_CC_IFE_0_FAST_AHB_CLK				44
+#define CAM_CC_IFE_1_CLK					45
+#define CAM_CC_IFE_1_CLK_SRC					46
+#define CAM_CC_IFE_1_FAST_AHB_CLK				47
+#define CAM_CC_IFE_LITE_AHB_CLK					48
+#define CAM_CC_IFE_LITE_CLK					49
+#define CAM_CC_IFE_LITE_CLK_SRC					50
+#define CAM_CC_IFE_LITE_CPHY_RX_CLK				51
+#define CAM_CC_IFE_LITE_CSID_CLK				52
+#define CAM_CC_IFE_LITE_CSID_CLK_SRC				53
+#define CAM_CC_IPE_AHB_CLK					54
+#define CAM_CC_IPE_CLK						55
+#define CAM_CC_IPE_CLK_SRC					56
+#define CAM_CC_IPE_FAST_AHB_CLK					57
+#define CAM_CC_MCLK0_CLK					58
+#define CAM_CC_MCLK0_CLK_SRC					59
+#define CAM_CC_MCLK1_CLK					60
+#define CAM_CC_MCLK1_CLK_SRC					61
+#define CAM_CC_MCLK2_CLK					62
+#define CAM_CC_MCLK2_CLK_SRC					63
+#define CAM_CC_MCLK3_CLK					64
+#define CAM_CC_MCLK3_CLK_SRC					65
+#define CAM_CC_PLL0						66
+#define CAM_CC_PLL0_OUT_EVEN					67
+#define CAM_CC_PLL0_OUT_ODD					68
+#define CAM_CC_PLL2						69
+#define CAM_CC_PLL3						70
+#define CAM_CC_PLL3_OUT_EVEN					71
+#define CAM_CC_PLL4						72
+#define CAM_CC_PLL4_OUT_EVEN					73
+#define CAM_CC_PLL5						74
+#define CAM_CC_PLL5_OUT_EVEN					75
+#define CAM_CC_SFE_LITE_0_CLK					76
+#define CAM_CC_SFE_LITE_0_FAST_AHB_CLK				77
+#define CAM_CC_SFE_LITE_1_CLK					78
+#define CAM_CC_SFE_LITE_1_FAST_AHB_CLK				79
+#define CAM_CC_SLEEP_CLK					80
+#define CAM_CC_SLEEP_CLK_SRC					81
+#define CAM_CC_SLOW_AHB_CLK_SRC					82
+#define CAM_CC_SM_OBS_CLK					83
+#define CAM_CC_XO_CLK_SRC					84
+#define CAM_CC_QDSS_DEBUG_XO_CLK				85
+#define CAM_CC_TITAN_TOP_ACCU_SHIFT_CLK				86
+
+/* CAM_CC power domains */
+#define CAM_CC_TITAN_TOP_GDSC					0
+
+/* CAM_CC resets */
+#define CAM_CC_ICP_BCR						0
+#define CAM_CC_IFE_0_BCR					1
+#define CAM_CC_IFE_1_BCR					2
+#define CAM_CC_IPE_0_BCR					3
+#define CAM_CC_SFE_LITE_0_BCR					4
+#define CAM_CC_SFE_LITE_1_BCR					5
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,sa8775p-dispcc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,sa8775p-dispcc.h
@@ -0,0 +1,87 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_CLK_QCOM_SA8775P_DISP_CC_H
+#define _DT_BINDINGS_CLK_QCOM_SA8775P_DISP_CC_H
+
+/* DISP_CC_0/1 clocks */
+#define MDSS_DISP_CC_MDSS_AHB1_CLK				0
+#define MDSS_DISP_CC_MDSS_AHB_CLK				1
+#define MDSS_DISP_CC_MDSS_AHB_CLK_SRC				2
+#define MDSS_DISP_CC_MDSS_BYTE0_CLK				3
+#define MDSS_DISP_CC_MDSS_BYTE0_CLK_SRC				4
+#define MDSS_DISP_CC_MDSS_BYTE0_DIV_CLK_SRC			5
+#define MDSS_DISP_CC_MDSS_BYTE0_INTF_CLK			6
+#define MDSS_DISP_CC_MDSS_BYTE1_CLK				7
+#define MDSS_DISP_CC_MDSS_BYTE1_CLK_SRC				8
+#define MDSS_DISP_CC_MDSS_BYTE1_DIV_CLK_SRC			9
+#define MDSS_DISP_CC_MDSS_BYTE1_INTF_CLK			10
+#define MDSS_DISP_CC_MDSS_DPTX0_AUX_CLK				11
+#define MDSS_DISP_CC_MDSS_DPTX0_AUX_CLK_SRC			12
+#define MDSS_DISP_CC_MDSS_DPTX0_CRYPTO_CLK			13
+#define MDSS_DISP_CC_MDSS_DPTX0_CRYPTO_CLK_SRC			14
+#define MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK			15
+#define MDSS_DISP_CC_MDSS_DPTX0_LINK_CLK_SRC			16
+#define MDSS_DISP_CC_MDSS_DPTX0_LINK_DIV_CLK_SRC		17
+#define MDSS_DISP_CC_MDSS_DPTX0_LINK_INTF_CLK			18
+#define MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK			19
+#define MDSS_DISP_CC_MDSS_DPTX0_PIXEL0_CLK_SRC			20
+#define MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK			21
+#define MDSS_DISP_CC_MDSS_DPTX0_PIXEL1_CLK_SRC			22
+#define MDSS_DISP_CC_MDSS_DPTX0_PIXEL2_CLK			23
+#define MDSS_DISP_CC_MDSS_DPTX0_PIXEL2_CLK_SRC			24
+#define MDSS_DISP_CC_MDSS_DPTX0_PIXEL3_CLK			25
+#define MDSS_DISP_CC_MDSS_DPTX0_PIXEL3_CLK_SRC			26
+#define MDSS_DISP_CC_MDSS_DPTX0_USB_ROUTER_LINK_INTF_CLK	27
+#define MDSS_DISP_CC_MDSS_DPTX1_AUX_CLK				28
+#define MDSS_DISP_CC_MDSS_DPTX1_AUX_CLK_SRC			29
+#define MDSS_DISP_CC_MDSS_DPTX1_CRYPTO_CLK			30
+#define MDSS_DISP_CC_MDSS_DPTX1_CRYPTO_CLK_SRC			31
+#define MDSS_DISP_CC_MDSS_DPTX1_LINK_CLK			32
+#define MDSS_DISP_CC_MDSS_DPTX1_LINK_CLK_SRC			33
+#define MDSS_DISP_CC_MDSS_DPTX1_LINK_DIV_CLK_SRC		34
+#define MDSS_DISP_CC_MDSS_DPTX1_LINK_INTF_CLK			35
+#define MDSS_DISP_CC_MDSS_DPTX1_PIXEL0_CLK			36
+#define MDSS_DISP_CC_MDSS_DPTX1_PIXEL0_CLK_SRC			37
+#define MDSS_DISP_CC_MDSS_DPTX1_PIXEL1_CLK			38
+#define MDSS_DISP_CC_MDSS_DPTX1_PIXEL1_CLK_SRC			39
+#define MDSS_DISP_CC_MDSS_DPTX1_USB_ROUTER_LINK_INTF_CLK	40
+#define MDSS_DISP_CC_MDSS_ESC0_CLK				41
+#define MDSS_DISP_CC_MDSS_ESC0_CLK_SRC				42
+#define MDSS_DISP_CC_MDSS_ESC1_CLK				43
+#define MDSS_DISP_CC_MDSS_ESC1_CLK_SRC				44
+#define MDSS_DISP_CC_MDSS_MDP1_CLK				45
+#define MDSS_DISP_CC_MDSS_MDP_CLK				46
+#define MDSS_DISP_CC_MDSS_MDP_CLK_SRC				47
+#define MDSS_DISP_CC_MDSS_MDP_LUT1_CLK				48
+#define MDSS_DISP_CC_MDSS_MDP_LUT_CLK				49
+#define MDSS_DISP_CC_MDSS_NON_GDSC_AHB_CLK			50
+#define MDSS_DISP_CC_MDSS_PCLK0_CLK				51
+#define MDSS_DISP_CC_MDSS_PCLK0_CLK_SRC				52
+#define MDSS_DISP_CC_MDSS_PCLK1_CLK				53
+#define MDSS_DISP_CC_MDSS_PCLK1_CLK_SRC				54
+#define MDSS_DISP_CC_MDSS_PLL_LOCK_MONITOR_CLK			55
+#define MDSS_DISP_CC_MDSS_RSCC_AHB_CLK				56
+#define MDSS_DISP_CC_MDSS_RSCC_VSYNC_CLK			57
+#define MDSS_DISP_CC_MDSS_VSYNC1_CLK				58
+#define MDSS_DISP_CC_MDSS_VSYNC_CLK				59
+#define MDSS_DISP_CC_MDSS_VSYNC_CLK_SRC				60
+#define MDSS_DISP_CC_PLL0					61
+#define MDSS_DISP_CC_PLL1					62
+#define MDSS_DISP_CC_SLEEP_CLK					63
+#define MDSS_DISP_CC_SLEEP_CLK_SRC				64
+#define MDSS_DISP_CC_SM_OBS_CLK					65
+#define MDSS_DISP_CC_XO_CLK					66
+#define MDSS_DISP_CC_XO_CLK_SRC					67
+
+/* DISP_CC_0/1 power domains */
+#define MDSS_DISP_CC_MDSS_CORE_GDSC				0
+#define MDSS_DISP_CC_MDSS_CORE_INT2_GDSC			1
+
+/* DISP_CC_0/1 resets */
+#define MDSS_DISP_CC_MDSS_CORE_BCR				0
+#define MDSS_DISP_CC_MDSS_RSCC_BCR				1
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,sa8775p-gpucc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,sa8775p-gpucc.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
 /*
- * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  * Copyright (c) 2023, Linaro Limited
  */
 
@@ -31,6 +31,8 @@
 #define GPU_CC_MEMNOC_GFX_CLK			20
 #define GPU_CC_SLEEP_CLK			21
 #define GPU_CC_XO_CLK_SRC			22
+#define GPU_CC_CX_ACCU_SHIFT_CLK		23
+#define GPU_CC_GX_ACCU_SHIFT_CLK		24
 
 /* GPU_CC resets */
 #define GPUCC_GPU_CC_ACD_BCR			0
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/qcom,sa8775p-videocc.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/qcom,sa8775p-videocc.h
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_CLK_QCOM_SA8775P_VIDEO_CC_H
+#define _DT_BINDINGS_CLK_QCOM_SA8775P_VIDEO_CC_H
+
+/* VIDEO_CC clocks */
+#define VIDEO_CC_AHB_CLK					0
+#define VIDEO_CC_AHB_CLK_SRC					1
+#define VIDEO_CC_MVS0_CLK					2
+#define VIDEO_CC_MVS0_CLK_SRC					3
+#define VIDEO_CC_MVS0_DIV_CLK_SRC				4
+#define VIDEO_CC_MVS0C_CLK					5
+#define VIDEO_CC_MVS0C_DIV2_DIV_CLK_SRC				6
+#define VIDEO_CC_MVS1_CLK					7
+#define VIDEO_CC_MVS1_CLK_SRC					8
+#define VIDEO_CC_MVS1_DIV_CLK_SRC				9
+#define VIDEO_CC_MVS1C_CLK					10
+#define VIDEO_CC_MVS1C_DIV2_DIV_CLK_SRC				11
+#define VIDEO_CC_PLL_LOCK_MONITOR_CLK				12
+#define VIDEO_CC_SLEEP_CLK					13
+#define VIDEO_CC_SLEEP_CLK_SRC					14
+#define VIDEO_CC_SM_DIV_CLK_SRC					15
+#define VIDEO_CC_SM_OBS_CLK					16
+#define VIDEO_CC_XO_CLK						17
+#define VIDEO_CC_XO_CLK_SRC					18
+#define VIDEO_PLL0						19
+#define VIDEO_PLL1						20
+
+/* VIDEO_CC power domains */
+#define VIDEO_CC_MVS0C_GDSC					0
+#define VIDEO_CC_MVS0_GDSC					1
+#define VIDEO_CC_MVS1C_GDSC					2
+#define VIDEO_CC_MVS1_GDSC					3
+
+/* VIDEO_CC resets */
+#define VIDEO_CC_INTERFACE_BCR					0
+#define VIDEO_CC_MVS0_BCR					1
+#define VIDEO_CC_MVS0C_CLK_ARES					2
+#define VIDEO_CC_MVS0C_BCR					3
+#define VIDEO_CC_MVS1_BCR					4
+#define VIDEO_CC_MVS1C_CLK_ARES					5
+#define VIDEO_CC_MVS1C_BCR					6
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/clock/r8a779g0-cpg-mssr.h
+++ linux-qcom-6.8.0/include/dt-bindings/clock/r8a779g0-cpg-mssr.h
@@ -86,5 +86,6 @@
 #define R8A779G0_CLK_CPEX		74
 #define R8A779G0_CLK_CBFUSA		75
 #define R8A779G0_CLK_R			76
+#define R8A779G0_CLK_CP			77
 
 #endif /* __DT_BINDINGS_CLOCK_R8A779G0_CPG_MSSR_H__ */
--- linux-qcom-6.8.0.orig/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pm8550.h
+++ linux-qcom-6.8.0/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pm8550.h
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_QCOM_SPMI_VADC_PM8550_H
+#define _DT_BINDINGS_QCOM_SPMI_VADC_PM8550_H
+
+#ifndef PM8550_SID
+#define PM8550_SID		1
+#endif
+
+/* ADC channels for PM8550_ADC for PMIC5 Gen3 */
+#define PM8550_ADC5_GEN3_OFFSET_REF			(PM8550_SID << 8 | 0x00)
+#define PM8550_ADC5_GEN3_1P25VREF			(PM8550_SID << 8 | 0x01)
+#define PM8550_ADC5_GEN3_VREF_VADC			(PM8550_SID << 8 | 0x02)
+#define PM8550_ADC5_GEN3_DIE_TEMP			(PM8550_SID << 8 | 0x03)
+
+#define PM8550_ADC5_GEN3_AMUX_THM1			(PM8550_SID << 8 | 0x04)
+#define PM8550_ADC5_GEN3_AMUX_THM2			(PM8550_SID << 8 | 0x05)
+#define PM8550_ADC5_GEN3_AMUX_THM3			(PM8550_SID << 8 | 0x06)
+#define PM8550_ADC5_GEN3_AMUX_THM4			(PM8550_SID << 8 | 0x07)
+#define PM8550_ADC5_GEN3_AMUX_THM5			(PM8550_SID << 8 | 0x08)
+#define PM8550_ADC5_GEN3_AMUX_THM6_GPIO2		(PM8550_SID << 8 | 0x09)
+#define PM8550_ADC5_GEN3_AMUX1_GPIO3			(PM8550_SID << 8 | 0x0a)
+#define PM8550_ADC5_GEN3_AMUX2_GPIO4			(PM8550_SID << 8 | 0x0b)
+#define PM8550_ADC5_GEN3_AMUX3_GPIO7			(PM8550_SID << 8 | 0x0c)
+#define PM8550_ADC5_GEN3_AMUX4_GPIO12			(PM8550_SID << 8 | 0x0d)
+
+/* 100k pull-up */
+#define PM8550_ADC5_GEN3_AMUX_THM1_100K_PU		(PM8550_SID << 8 | 0x44)
+#define PM8550_ADC5_GEN3_AMUX_THM2_100K_PU		(PM8550_SID << 8 | 0x45)
+#define PM8550_ADC5_GEN3_AMUX_THM3_100K_PU		(PM8550_SID << 8 | 0x46)
+#define PM8550_ADC5_GEN3_AMUX_THM4_100K_PU		(PM8550_SID << 8 | 0x47)
+#define PM8550_ADC5_GEN3_AMUX_THM5_100K_PU		(PM8550_SID << 8 | 0x48)
+#define PM8550_ADC5_GEN3_AMUX_THM6_GPIO2_100K_PU	(PM8550_SID << 8 | 0x49)
+#define PM8550_ADC5_GEN3_AMUX1_GPIO3_100K_PU		(PM8550_SID << 8 | 0x4a)
+#define PM8550_ADC5_GEN3_AMUX2_GPIO4_100K_PU		(PM8550_SID << 8 | 0x4b)
+#define PM8550_ADC5_GEN3_AMUX3_GPIO7_100K_PU		(PM8550_SID << 8 | 0x4c)
+#define PM8550_ADC5_GEN3_AMUX4_GPIO12_100K_PU		(PM8550_SID << 8 | 0x4d)
+
+/* 1/3 Divider */
+#define PM8550_ADC5_GEN3_AMUX3_GPIO7_DIV3		(PM8550_SID << 8 | 0x8c)
+#define PM8550_ADC5_GEN3_AMUX4_GPIO12_DIV3		(PM8550_SID << 8 | 0x8d)
+
+#define PM8550_ADC5_GEN3_VPH_PWR			(PM8550_SID << 8 | 0x8e)
+
+#endif /* _DT_BINDINGS_QCOM_SPMI_VADC_PM8550_H */
--- linux-qcom-6.8.0.orig/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pm8550b.h
+++ linux-qcom-6.8.0/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pm8550b.h
@@ -0,0 +1,97 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_QCOM_SPMI_VADC_PM8550B_H
+#define _DT_BINDINGS_QCOM_SPMI_VADC_PM8550B_H
+
+#ifndef PM8550B_SID
+#define PM8550B_SID		7
+#endif
+
+/* ADC channels for PM8550B_ADC for PMIC5 Gen3 */
+#define PM8550B_ADC5_GEN3_OFFSET_REF			(PM8550B_SID << 8 | 0x00)
+#define PM8550B_ADC5_GEN3_1P25VREF			(PM8550B_SID << 8 | 0x01)
+#define PM8550B_ADC5_GEN3_VREF_VADC			(PM8550B_SID << 8 | 0x02)
+#define PM8550B_ADC5_GEN3_DIE_TEMP			(PM8550B_SID << 8 | 0x03)
+
+#define PM8550B_ADC5_GEN3_AMUX_THM1_BATT_THERM		(PM8550B_SID << 8 | 0x04)
+#define PM8550B_ADC5_GEN3_AMUX_THM2_BATT_ID		(PM8550B_SID << 8 | 0x05)
+#define PM8550B_ADC5_GEN3_AMUX_THM3_SMB_TEMP_V		(PM8550B_SID << 8 | 0x06)
+#define PM8550B_ADC5_GEN3_AMUX_THM4_USB_THERM		(PM8550B_SID << 8 | 0x07)
+#define PM8550B_ADC5_GEN3_AMUX_THM5_OPTION		(PM8550B_SID << 8 | 0x08)
+#define PM8550B_ADC5_GEN3_AMUX_THM6_GPIO10		(PM8550B_SID << 8 | 0x09)
+#define PM8550B_ADC5_GEN3_AMUX1_GPIO1			(PM8550B_SID << 8 | 0x0a)
+#define PM8550B_ADC5_GEN3_AMUX2_GPIO5			(PM8550B_SID << 8 | 0x0b)
+#define PM8550B_ADC5_GEN3_AMUX3_GPIO6			(PM8550B_SID << 8 | 0x0c)
+#define PM8550B_ADC5_GEN3_AMUX4_GPIO12			(PM8550B_SID << 8 | 0x0d)
+
+#define PM8550B_ADC5_GEN3_CHG_TEMP			(PM8550B_SID << 8 | 0x10)
+#define PM8550B_ADC5_GEN3_USB_SNS_V_16			(PM8550B_SID << 8 | 0x11)
+#define PM8550B_ADC5_GEN3_VIN_DIV16_MUX			(PM8550B_SID << 8 | 0x12)
+#define PM8550B_ADC5_GEN3_USBC_MUX			(PM8550B_SID << 8 | 0x13)
+#define PM8550B_ADC5_GEN3_VREF_BAT_THERM		(PM8550B_SID << 8 | 0x15)
+#define PM8550B_ADC5_GEN3_IIN_FB			(PM8550B_SID << 8 | 0x17)
+#define PM8550B_ADC5_GEN3_TEMP_ALARM_LITE		(PM8550B_SID << 8 | 0x18)
+#define PM8550B_ADC5_GEN3_SMB_IIN			(PM8550B_SID << 8 | 0x19)
+#define PM8550B_ADC5_GEN3_VREF_BAT2_THERM		(PM8550B_SID << 8 | 0x1a)
+#define PM8550B_ADC5_GEN3_SMB_ICHG			(PM8550B_SID << 8 | 0x1b)
+#define PM8550B_ADC5_GEN3_SMB_TEMP_I			(PM8550B_SID << 8 | 0x1e)
+#define PM8550B_ADC5_GEN3_CHG_TEMP_I			(PM8550B_SID << 8 | 0x1f)
+#define PM8550B_ADC5_GEN3_ICHG_FB			(PM8550B_SID << 8 | 0xa1)
+
+/* 30k pull-up */
+#define PM8550B_ADC5_GEN3_AMUX_THM1_BATT_THERM_30K_PU	(PM8550B_SID << 8 | 0x24)
+#define PM8550B_ADC5_GEN3_AMUX_THM2_BATT_ID_30K_PU	(PM8550B_SID << 8 | 0x25)
+#define PM8550B_ADC5_GEN3_AMUX_THM3_SMB_TEMP_V_30K_PU	(PM8550B_SID << 8 | 0x26)
+#define PM8550B_ADC5_GEN3_AMUX_THM4_USB_THERM_30K_PU	(PM8550B_SID << 8 | 0x27)
+#define PM8550B_ADC5_GEN3_AMUX_THM5_OPTION_30K_PU	(PM8550B_SID << 8 | 0x28)
+#define PM8550B_ADC5_GEN3_AMUX_THM6_GPIO10_30K_PU	(PM8550B_SID << 8 | 0x29)
+#define PM8550B_ADC5_GEN3_AMUX1_GPIO1_30K_PU		(PM8550B_SID << 8 | 0x2a)
+#define PM8550B_ADC5_GEN3_AMUX2_GPIO5_30K_PU		(PM8550B_SID << 8 | 0x2b)
+#define PM8550B_ADC5_GEN3_AMUX3_GPIO6_30K_PU		(PM8550B_SID << 8 | 0x2c)
+#define PM8550B_ADC5_GEN3_AMUX4_GPIO12_30K_PU		(PM8550B_SID << 8 | 0x2d)
+
+#define PM8550B_ADC5_GEN3_USBC_MUX_30K_PU		(PM8550B_SID << 8 | 0x33)
+
+/* 100k pull-up */
+#define PM8550B_ADC5_GEN3_AMUX_THM1_BATT_THERM_100K_PU	(PM8550B_SID << 8 | 0x44)
+#define PM8550B_ADC5_GEN3_AMUX_THM2_BATT_ID_100K_PU	(PM8550B_SID << 8 | 0x45)
+#define PM8550B_ADC5_GEN3_AMUX_THM3_SMB_TEMP_V_100K_PU	(PM8550B_SID << 8 | 0x46)
+#define PM8550B_ADC5_GEN3_AMUX_THM4_USB_THERM_100K_PU	(PM8550B_SID << 8 | 0x47)
+#define PM8550B_ADC5_GEN3_AMUX_THM5_OPTION_100K_PU	(PM8550B_SID << 8 | 0x48)
+#define PM8550B_ADC5_GEN3_AMUX_THM6_GPIO10_100K_PU	(PM8550B_SID << 8 | 0x49)
+#define PM8550B_ADC5_GEN3_AMUX1_GPIO1_100K_PU		(PM8550B_SID << 8 | 0x4a)
+#define PM8550B_ADC5_GEN3_AMUX2_GPIO5_100K_PU		(PM8550B_SID << 8 | 0x4b)
+#define PM8550B_ADC5_GEN3_AMUX3_GPIO6_100K_PU		(PM8550B_SID << 8 | 0x4c)
+#define PM8550B_ADC5_GEN3_AMUX4_GPIO12_100K_PU		(PM8550B_SID << 8 | 0x4d)
+
+#define PM8550B_ADC5_GEN3_USBC_MUX_100K_PU		(PM8550B_SID << 8 | 0x53)
+
+/* 400k pull-up */
+#define PM8550B_ADC5_GEN3_AMUX_THM1_BATT_THERM_400K_PU	(PM8550B_SID << 8 | 0x64)
+#define PM8550B_ADC5_GEN3_AMUX_THM2_BATT_ID_400K_PU	(PM8550B_SID << 8 | 0x65)
+#define PM8550B_ADC5_GEN3_AMUX_THM3_SMB_TEMP_V_400K_PU	(PM8550B_SID << 8 | 0x66)
+#define PM8550B_ADC5_GEN3_AMUX_THM4_USB_THERM_400K_PU	(PM8550B_SID << 8 | 0x67)
+#define PM8550B_ADC5_GEN3_AMUX_THM5_OPTION_400K_PU	(PM8550B_SID << 8 | 0x68)
+#define PM8550B_ADC5_GEN3_AMUX_THM6_GPIO10_400K_PU	(PM8550B_SID << 8 | 0x69)
+#define PM8550B_ADC5_GEN3_AMUX1_GPIO1_400K_PU		(PM8550B_SID << 8 | 0x6a)
+#define PM8550B_ADC5_GEN3_AMUX2_GPIO5_400K_PU		(PM8550B_SID << 8 | 0x6b)
+#define PM8550B_ADC5_GEN3_AMUX3_GPIO6_400K_PU		(PM8550B_SID << 8 | 0x6c)
+#define PM8550B_ADC5_GEN3_AMUX4_GPIO12_400K_PU		(PM8550B_SID << 8 | 0x6d)
+
+#define PM8550B_ADC5_GEN3_USBC_MUX_400K_PU		(PM8550B_SID << 8 | 0x73)
+
+/* 1/3 Divider */
+#define PM8550B_ADC5_GEN3_AMUX1_GPIO1_DIV3		(PM8550B_SID << 8 | 0x8a)
+#define PM8550B_ADC5_GEN3_AMUX2_GPIO5_DIV3		(PM8550B_SID << 8 | 0x8b)
+#define PM8550B_ADC5_GEN3_AMUX3_GPIO6_DIV3		(PM8550B_SID << 8 | 0x8c)
+
+#define PM8550B_ADC5_GEN3_VPH_PWR			(PM8550B_SID << 8 | 0x8e)
+#define PM8550B_ADC5_GEN3_VBAT_SNS_QBG			(PM8550B_SID << 8 | 0x8f)
+#define PM8550B_ADC5_GEN3_VBAT_SNS_CHGR			(PM8550B_SID << 8 | 0x94)
+#define PM8550B_ADC5_GEN3_VBAT_2S_MID_QBG		(PM8550B_SID << 8 | 0x96)
+#define PM8550B_ADC5_GEN3_VBAT_2S_MID_CHGR		(PM8550B_SID << 8 | 0x9d)
+
+#endif /* _DT_BINDINGS_QCOM_SPMI_VADC_PM8550B_H */
--- linux-qcom-6.8.0.orig/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pm8550vx.h
+++ linux-qcom-6.8.0/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pm8550vx.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_QCOM_SPMI_VADC_PM8550VX_H
+#define _DT_BINDINGS_QCOM_SPMI_VADC_PM8550VX_H
+
+/* ADC channels for PM8550VX_ADC for PMIC5 Gen3 */
+#define PM8550VX_ADC5_GEN3_OFFSET_REF(sid)		((sid) << 8 | 0x00)
+#define PM8550VX_ADC5_GEN3_1P25VREF(sid)		((sid) << 8 | 0x01)
+#define PM8550VX_ADC5_GEN3_VREF_VADC(sid)		((sid) << 8 | 0x02)
+#define PM8550VX_ADC5_GEN3_DIE_TEMP(sid)		((sid) << 8 | 0x03)
+
+#endif /* _DT_BINDINGS_QCOM_SPMI_VADC_PM8550VX_H */
--- linux-qcom-6.8.0.orig/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pm8775.h
+++ linux-qcom-6.8.0/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pm8775.h
@@ -0,0 +1,146 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_QCOM_SPMI_VADC_PM8775_H
+#define _DT_BINDINGS_QCOM_SPMI_VADC_PM8775_H
+
+#ifndef PM8775_1_SID
+#define PM8775_1_SID		0
+#endif
+#ifndef PM8775_2_SID
+#define PM8775_2_SID		2
+#endif
+#ifndef PM8775_3_SID
+#define PM8775_3_SID		4
+#endif
+#ifndef PM8775_4_SID
+#define PM8775_4_SID		6
+#endif
+
+/* ADC channels for PM8775_1_ADC for PMIC5 Gen3 */
+#define PM8775_1_ADC5_GEN3_OFFSET_REF			(PM8775_1_SID << 8 | 0x0)
+#define PM8775_1_ADC5_GEN3_1P25VREF			(PM8775_1_SID << 8 | 0x01)
+#define PM8775_1_ADC5_GEN3_VREF_VADC			(PM8775_1_SID << 8 | 0x02)
+#define PM8775_1_ADC5_GEN3_DIE_TEMP			(PM8775_1_SID << 8 | 0x03)
+
+#define PM8775_1_ADC5_GEN3_AMUX1_THM			(PM8775_1_SID << 8 | 0x04)
+#define PM8775_1_ADC5_GEN3_AMUX2_THM			(PM8775_1_SID << 8 | 0x05)
+#define PM8775_1_ADC5_GEN3_AMUX3_THM			(PM8775_1_SID << 8 | 0x06)
+#define PM8775_1_ADC5_GEN3_AMUX4_THM			(PM8775_1_SID << 8 | 0x07)
+#define PM8775_1_ADC5_GEN3_AMUX5_THM			(PM8775_1_SID << 8 | 0x08)
+#define PM8775_1_ADC5_GEN3_AMUX6_THM			(PM8775_1_SID << 8 | 0x09)
+#define PM8775_1_ADC5_GEN3_AMUX1_GPIO9			(PM8775_1_SID << 8 | 0x0a)
+#define PM8775_1_ADC5_GEN3_AMUX2_GPIO10			(PM8775_1_SID << 8 | 0x0b)
+#define PM8775_1_ADC5_GEN3_AMUX3_GPIO11			(PM8775_1_SID << 8 | 0x0c)
+#define PM8775_1_ADC5_GEN3_AMUX4_GPIO12			(PM8775_1_SID << 8 | 0x0d)
+
+/* 100k pull-up2 */
+#define PM8775_1_ADC5_GEN3_AMUX1_THM_100K_PU		(PM8775_1_SID << 8 | 0x44)
+#define PM8775_1_ADC5_GEN3_AMUX2_THM_100K_PU		(PM8775_1_SID << 8 | 0x45)
+#define PM8775_1_ADC5_GEN3_AMUX3_THM_100K_PU		(PM8775_1_SID << 8 | 0x46)
+#define PM8775_1_ADC5_GEN3_AMUX4_THM_100K_PU		(PM8775_1_SID << 8 | 0x47)
+#define PM8775_1_ADC5_GEN3_AMUX5_THM_100K_PU		(PM8775_1_SID << 8 | 0x48)
+#define PM8775_1_ADC5_GEN3_AMUX6_THM_100K_PU		(PM8775_1_SID << 8 | 0x49)
+#define PM8775_1_ADC5_GEN3_AMUX1_GPIO9_100K_PU		(PM8775_1_SID << 8 | 0x4a)
+#define PM8775_1_ADC5_GEN3_AMUX2_GPIO10_100K_PU		(PM8775_1_SID << 8 | 0x4b)
+#define PM8775_1_ADC5_GEN3_AMUX3_GPIO11_100K_PU		(PM8775_1_SID << 8 | 0x4c)
+#define PM8775_1_ADC5_GEN3_AMUX4_GPIO12_100K_PU		(PM8775_1_SID << 8 | 0x4d)
+
+#define PM8775_1_ADC5_GEN3_VPH_PWR			(PM8775_1_SID << 8 | 0x8e)
+
+/* ADC channels for PM8775_2_ADC for PMIC5 Gen3 */
+#define PM8775_2_ADC5_GEN3_OFFSET_REF			(PM8775_2_SID << 8 | 0x0)
+#define PM8775_2_ADC5_GEN3_1P25VREF			(PM8775_2_SID << 8 | 0x01)
+#define PM8775_2_ADC5_GEN3_VREF_VADC			(PM8775_2_SID << 8 | 0x02)
+#define PM8775_2_ADC5_GEN3_DIE_TEMP			(PM8775_2_SID << 8 | 0x03)
+
+#define PM8775_2_ADC5_GEN3_AMUX1_THM			(PM8775_2_SID << 8 | 0x04)
+#define PM8775_2_ADC5_GEN3_AMUX2_THM			(PM8775_2_SID << 8 | 0x05)
+#define PM8775_2_ADC5_GEN3_AMUX3_THM			(PM8775_2_SID << 8 | 0x06)
+#define PM8775_2_ADC5_GEN3_AMUX4_THM			(PM8775_2_SID << 8 | 0x07)
+#define PM8775_2_ADC5_GEN3_AMUX5_THM			(PM8775_2_SID << 8 | 0x08)
+#define PM8775_2_ADC5_GEN3_AMUX6_THM			(PM8775_2_SID << 8 | 0x09)
+#define PM8775_2_ADC5_GEN3_AMUX1_GPIO9			(PM8775_2_SID << 8 | 0x0a)
+#define PM8775_2_ADC5_GEN3_AMUX2_GPIO10			(PM8775_2_SID << 8 | 0x0b)
+#define PM8775_2_ADC5_GEN3_AMUX3_GPIO11			(PM8775_2_SID << 8 | 0x0c)
+#define PM8775_2_ADC5_GEN3_AMUX4_GPIO12			(PM8775_2_SID << 8 | 0x0d)
+
+/* 100k pull-up2 */
+#define PM8775_2_ADC5_GEN3_AMUX1_THM_100K_PU		(PM8775_2_SID << 8 | 0x44)
+#define PM8775_2_ADC5_GEN3_AMUX2_THM_100K_PU		(PM8775_2_SID << 8 | 0x45)
+#define PM8775_2_ADC5_GEN3_AMUX3_THM_100K_PU		(PM8775_2_SID << 8 | 0x46)
+#define PM8775_2_ADC5_GEN3_AMUX4_THM_100K_PU		(PM8775_2_SID << 8 | 0x47)
+#define PM8775_2_ADC5_GEN3_AMUX5_THM_100K_PU		(PM8775_2_SID << 8 | 0x48)
+#define PM8775_2_ADC5_GEN3_AMUX6_THM_100K_PU		(PM8775_2_SID << 8 | 0x49)
+#define PM8775_2_ADC5_GEN3_AMUX1_GPIO9_100K_PU		(PM8775_2_SID << 8 | 0x4a)
+#define PM8775_2_ADC5_GEN3_AMUX2_GPIO10_100K_PU		(PM8775_2_SID << 8 | 0x4b)
+#define PM8775_2_ADC5_GEN3_AMUX3_GPIO11_100K_PU		(PM8775_2_SID << 8 | 0x4c)
+#define PM8775_2_ADC5_GEN3_AMUX4_GPIO12_100K_PU		(PM8775_2_SID << 8 | 0x4d)
+
+#define PM8775_2_ADC5_GEN3_VPH_PWR			(PM8775_2_SID << 8 | 0x8e)
+
+/* ADC channels for PM8775_3_ADC for PMIC5 Gen3 */
+#define PM8775_3_ADC5_GEN3_OFFSET_REF			(PM8775_3_SID << 8 | 0x0)
+#define PM8775_3_ADC5_GEN3_1P25VREF			(PM8775_3_SID << 8 | 0x01)
+#define PM8775_3_ADC5_GEN3_VREF_VADC			(PM8775_3_SID << 8 | 0x02)
+#define PM8775_3_ADC5_GEN3_DIE_TEMP			(PM8775_3_SID << 8 | 0x03)
+
+#define PM8775_3_ADC5_GEN3_AMUX1_THM			(PM8775_3_SID << 8 | 0x04)
+#define PM8775_3_ADC5_GEN3_AMUX2_THM			(PM8775_3_SID << 8 | 0x05)
+#define PM8775_3_ADC5_GEN3_AMUX3_THM			(PM8775_3_SID << 8 | 0x06)
+#define PM8775_3_ADC5_GEN3_AMUX4_THM			(PM8775_3_SID << 8 | 0x07)
+#define PM8775_3_ADC5_GEN3_AMUX5_THM			(PM8775_3_SID << 8 | 0x08)
+#define PM8775_3_ADC5_GEN3_AMUX6_THM			(PM8775_3_SID << 8 | 0x09)
+#define PM8775_3_ADC5_GEN3_AMUX1_GPIO9			(PM8775_3_SID << 8 | 0x0a)
+#define PM8775_3_ADC5_GEN3_AMUX2_GPIO10			(PM8775_3_SID << 8 | 0x0b)
+#define PM8775_3_ADC5_GEN3_AMUX3_GPIO11			(PM8775_3_SID << 8 | 0x0c)
+#define PM8775_3_ADC5_GEN3_AMUX4_GPIO12			(PM8775_3_SID << 8 | 0x0d)
+
+/* 100k pull-up2 */
+#define PM8775_3_ADC5_GEN3_AMUX1_THM_100K_PU		(PM8775_3_SID << 8 | 0x44)
+#define PM8775_3_ADC5_GEN3_AMUX2_THM_100K_PU		(PM8775_3_SID << 8 | 0x45)
+#define PM8775_3_ADC5_GEN3_AMUX3_THM_100K_PU		(PM8775_3_SID << 8 | 0x46)
+#define PM8775_3_ADC5_GEN3_AMUX4_THM_100K_PU		(PM8775_3_SID << 8 | 0x47)
+#define PM8775_3_ADC5_GEN3_AMUX5_THM_100K_PU		(PM8775_3_SID << 8 | 0x48)
+#define PM8775_3_ADC5_GEN3_AMUX6_THM_100K_PU		(PM8775_3_SID << 8 | 0x49)
+#define PM8775_3_ADC5_GEN3_AMUX1_GPIO9_100K_PU		(PM8775_3_SID << 8 | 0x4a)
+#define PM8775_3_ADC5_GEN3_AMUX2_GPIO10_100K_PU		(PM8775_3_SID << 8 | 0x4b)
+#define PM8775_3_ADC5_GEN3_AMUX3_GPIO11_100K_PU		(PM8775_3_SID << 8 | 0x4c)
+#define PM8775_3_ADC5_GEN3_AMUX4_GPIO12_100K_PU		(PM8775_3_SID << 8 | 0x4d)
+
+#define PM8775_3_ADC5_GEN3_VPH_PWR			(PM8775_3_SID << 8 | 0x8e)
+
+/* ADC channels for PM8775_4_ADC for PMIC5 Gen3 */
+#define PM8775_4_ADC5_GEN3_OFFSET_REF			(PM8775_4_SID << 8 | 0x0)
+#define PM8775_4_ADC5_GEN3_1P25VREF			(PM8775_4_SID << 8 | 0x01)
+#define PM8775_4_ADC5_GEN3_VREF_VADC			(PM8775_4_SID << 8 | 0x02)
+#define PM8775_4_ADC5_GEN3_DIE_TEMP			(PM8775_4_SID << 8 | 0x03)
+
+#define PM8775_4_ADC5_GEN3_AMUX1_THM			(PM8775_4_SID << 8 | 0x04)
+#define PM8775_4_ADC5_GEN3_AMUX2_THM			(PM8775_4_SID << 8 | 0x05)
+#define PM8775_4_ADC5_GEN3_AMUX3_THM			(PM8775_4_SID << 8 | 0x06)
+#define PM8775_4_ADC5_GEN3_AMUX4_THM			(PM8775_4_SID << 8 | 0x07)
+#define PM8775_4_ADC5_GEN3_AMUX5_THM			(PM8775_4_SID << 8 | 0x08)
+#define PM8775_4_ADC5_GEN3_AMUX6_THM			(PM8775_4_SID << 8 | 0x09)
+#define PM8775_4_ADC5_GEN3_AMUX1_GPIO9			(PM8775_4_SID << 8 | 0x0a)
+#define PM8775_4_ADC5_GEN3_AMUX2_GPIO10			(PM8775_4_SID << 8 | 0x0b)
+#define PM8775_4_ADC5_GEN3_AMUX3_GPIO11			(PM8775_4_SID << 8 | 0x0c)
+#define PM8775_4_ADC5_GEN3_AMUX4_GPIO12			(PM8775_4_SID << 8 | 0x0d)
+
+/* 100k pull-up2 */
+#define PM8775_4_ADC5_GEN3_AMUX1_THM_100K_PU		(PM8775_4_SID << 8 | 0x44)
+#define PM8775_4_ADC5_GEN3_AMUX2_THM_100K_PU		(PM8775_4_SID << 8 | 0x45)
+#define PM8775_4_ADC5_GEN3_AMUX3_THM_100K_PU		(PM8775_4_SID << 8 | 0x46)
+#define PM8775_4_ADC5_GEN3_AMUX4_THM_100K_PU		(PM8775_4_SID << 8 | 0x47)
+#define PM8775_4_ADC5_GEN3_AMUX5_THM_100K_PU		(PM8775_4_SID << 8 | 0x48)
+#define PM8775_4_ADC5_GEN3_AMUX6_THM_100K_PU		(PM8775_4_SID << 8 | 0x49)
+#define PM8775_4_ADC5_GEN3_AMUX1_GPIO9_100K_PU		(PM8775_4_SID << 8 | 0x4a)
+#define PM8775_4_ADC5_GEN3_AMUX2_GPIO10_100K_PU		(PM8775_4_SID << 8 | 0x4b)
+#define PM8775_4_ADC5_GEN3_AMUX3_GPIO11_100K_PU		(PM8775_4_SID << 8 | 0x4c)
+#define PM8775_4_ADC5_GEN3_AMUX4_GPIO12_100K_PU		(PM8775_4_SID << 8 | 0x4d)
+
+#define PM8775_4_ADC5_GEN3_VPH_PWR			(PM8775_4_SID << 8 | 0x8e)
+
+#endif /* _DT_BINDINGS_QCOM_SPMI_VADC_PM8775_H */
--- linux-qcom-6.8.0.orig/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pmk8550.h
+++ linux-qcom-6.8.0/include/dt-bindings/iio/qcom,spmi-adc5-gen3-pmk8550.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DT_BINDINGS_QCOM_SPMI_VADC_PMK8550_H
+#define _DT_BINDINGS_QCOM_SPMI_VADC_PMK8550_H
+
+#ifndef PMK8550_SID
+#define PMK8550_SID		0
+#endif
+
+/* ADC channels for PMK8550_ADC for PMIC5 Gen3 */
+#define PMK8550_ADC5_GEN3_OFFSET_REF			(PMK8550_SID << 8 | 0x00)
+#define PMK8550_ADC5_GEN3_1P25VREF			(PMK8550_SID << 8 | 0x01)
+#define PMK8550_ADC5_GEN3_VREF_VADC			(PMK8550_SID << 8 | 0x02)
+#define PMK8550_ADC5_GEN3_DIE_TEMP			(PMK8550_SID << 8 | 0x03)
+
+#define PMK8550_ADC5_GEN3_AMUX_THM1_XO_THERM		(PMK8550_SID << 8 | 0x04)
+#define PMK8550_ADC5_GEN3_AMUX_THM2_GPIO1		(PMK8550_SID << 8 | 0x05)
+#define PMK8550_ADC5_GEN3_AMUX_THM3_GPIO2		(PMK8550_SID << 8 | 0x06)
+#define PMK8550_ADC5_GEN3_AMUX_THM4_GPIO3		(PMK8550_SID << 8 | 0x07)
+#define PMK8550_ADC5_GEN3_AMUX_THM5_GPIO4		(PMK8550_SID << 8 | 0x08)
+#define PMK8550_ADC5_GEN3_AMUX_THM6_GPIO5		(PMK8550_SID << 8 | 0x09)
+#define PMK8550_ADC5_GEN3_AMUX1_GPIO6			(PMK8550_SID << 8 | 0x0a)
+
+/* 30k pull-up */
+#define PMK8550_ADC5_GEN3_AMUX_THM1_XO_THERM_30K_PU	(PMK8550_SID << 8 | 0x24)
+#define PMK8550_ADC5_GEN3_AMUX_THM2_GPIO1_30K_PU	(PMK8550_SID << 8 | 0x25)
+#define PMK8550_ADC5_GEN3_AMUX_THM3_GPIO2_30K_PU	(PMK8550_SID << 8 | 0x26)
+#define PMK8550_ADC5_GEN3_AMUX_THM4_GPIO3_30K_PU	(PMK8550_SID << 8 | 0x27)
+#define PMK8550_ADC5_GEN3_AMUX_THM5_GPIO4_30K_PU	(PMK8550_SID << 8 | 0x28)
+#define PMK8550_ADC5_GEN3_AMUX_THM6_GPIO5_30K_PU	(PMK8550_SID << 8 | 0x29)
+#define PMK8550_ADC5_GEN3_AMUX1_GPIO6_30K_PU		(PMK8550_SID << 8 | 0x2a)
+
+/* 100k pull-up */
+#define PMK8550_ADC5_GEN3_AMUX_THM1_XO_THERM_100K_PU	(PMK8550_SID << 8 | 0x44)
+#define PMK8550_ADC5_GEN3_AMUX_THM2_GPIO1_100K_PU	(PMK8550_SID << 8 | 0x45)
+#define PMK8550_ADC5_GEN3_AMUX_THM3_GPIO2_100K_PU	(PMK8550_SID << 8 | 0x46)
+#define PMK8550_ADC5_GEN3_AMUX_THM4_GPIO3_100K_PU	(PMK8550_SID << 8 | 0x47)
+#define PMK8550_ADC5_GEN3_AMUX_THM5_GPIO4_100K_PU	(PMK8550_SID << 8 | 0x48)
+#define PMK8550_ADC5_GEN3_AMUX_THM6_GPIO5_100K_PU	(PMK8550_SID << 8 | 0x49)
+#define PMK8550_ADC5_GEN3_AMUX1_GPIO6_100K_PU		(PMK8550_SID << 8 | 0x4a)
+
+/* 400k pull-up */
+#define PMK8550_ADC5_GEN3_AMUX_THM1_XO_THERM_400K_PU	(PMK8550_SID << 8 | 0x64)
+#define PMK8550_ADC5_GEN3_AMUX_THM2_GPIO1_400K_PU	(PMK8550_SID << 8 | 0x65)
+#define PMK8550_ADC5_GEN3_AMUX_THM3_GPIO2_400K_PU	(PMK8550_SID << 8 | 0x66)
+#define PMK8550_ADC5_GEN3_AMUX_THM4_GPIO3_400K_PU	(PMK8550_SID << 8 | 0x67)
+#define PMK8550_ADC5_GEN3_AMUX_THM5_GPIO4_400K_PU	(PMK8550_SID << 8 | 0x68)
+#define PMK8550_ADC5_GEN3_AMUX_THM6_GPIO5_400K_PU	(PMK8550_SID << 8 | 0x69)
+#define PMK8550_ADC5_GEN3_AMUX1_GPIO6_400K_PU		(PMK8550_SID << 8 | 0x6a)
+
+#endif /* _DT_BINDINGS_QCOM_SPMI_VADC_PMK8550_H */
--- linux-qcom-6.8.0.orig/include/dt-bindings/iio/qcom,spmi-vadc.h
+++ linux-qcom-6.8.0/include/dt-bindings/iio/qcom,spmi-vadc.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (c) 2012-2014,2018,2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef _DT_BINDINGS_QCOM_SPMI_VADC_H
@@ -300,4 +301,82 @@
 #define ADC7_SBUx				0x94
 #define ADC7_VBAT_2S_MID			0x96
 
+/* ADC channels for PMIC5 Gen3 */
+
+#define ADC5_GEN3_OFFSET_REF			0x00
+#define ADC5_GEN3_1P25VREF			0x01
+#define ADC5_GEN3_VREF_VADC			0x02
+#define ADC5_GEN3_DIE_TEMP			0x03
+
+#define ADC5_GEN3_AMUX1_THM			0x04
+#define ADC5_GEN3_AMUX2_THM			0x05
+#define ADC5_GEN3_AMUX3_THM			0x06
+#define ADC5_GEN3_AMUX4_THM			0x07
+#define ADC5_GEN3_AMUX5_THM			0x08
+#define ADC5_GEN3_AMUX6_THM			0x09
+#define ADC5_GEN3_AMUX1_GPIO			0x0a
+#define ADC5_GEN3_AMUX2_GPIO			0x0b
+#define ADC5_GEN3_AMUX3_GPIO			0x0c
+#define ADC5_GEN3_AMUX4_GPIO			0x0d
+
+#define ADC5_GEN3_CHG_TEMP			0x10
+#define ADC5_GEN3_USB_SNS_V_16			0x11
+#define ADC5_GEN3_VIN_DIV16_MUX			0x12
+#define ADC5_GEN3_VREF_BAT_THERM		0x15
+#define ADC5_GEN3_IIN_FB			0x17
+#define ADC5_GEN3_TEMP_ALARM_LITE		0x18
+#define ADC5_GEN3_IIN_SMB			0x19
+#define ADC5_GEN3_ICHG_SMB			0x1b
+#define ADC5_GEN3_ICHG_FB			0xa1
+
+/* 30k pull-up1 */
+#define ADC5_GEN3_AMUX1_THM_30K_PU		0x24
+#define ADC5_GEN3_AMUX2_THM_30K_PU		0x25
+#define ADC5_GEN3_AMUX3_THM_30K_PU		0x26
+#define ADC5_GEN3_AMUX4_THM_30K_PU		0x27
+#define ADC5_GEN3_AMUX5_THM_30K_PU		0x28
+#define ADC5_GEN3_AMUX6_THM_30K_PU		0x29
+#define ADC5_GEN3_AMUX1_GPIO_30K_PU		0x2a
+#define ADC5_GEN3_AMUX2_GPIO_30K_PU		0x2b
+#define ADC5_GEN3_AMUX3_GPIO_30K_PU		0x2c
+#define ADC5_GEN3_AMUX4_GPIO_30K_PU		0x2d
+
+/* 100k pull-up2 */
+#define ADC5_GEN3_AMUX1_THM_100K_PU		0x44
+#define ADC5_GEN3_AMUX2_THM_100K_PU		0x45
+#define ADC5_GEN3_AMUX3_THM_100K_PU		0x46
+#define ADC5_GEN3_AMUX4_THM_100K_PU		0x47
+#define ADC5_GEN3_AMUX5_THM_100K_PU		0x48
+#define ADC5_GEN3_AMUX6_THM_100K_PU		0x49
+#define ADC5_GEN3_AMUX1_GPIO_100K_PU		0x4a
+#define ADC5_GEN3_AMUX2_GPIO_100K_PU		0x4b
+#define ADC5_GEN3_AMUX3_GPIO_100K_PU		0x4c
+#define ADC5_GEN3_AMUX4_GPIO_100K_PU		0x4d
+
+/* 400k pull-up3 */
+#define ADC5_GEN3_AMUX1_THM_400K_PU		0x64
+#define ADC5_GEN3_AMUX2_THM_400K_PU		0x65
+#define ADC5_GEN3_AMUX3_THM_400K_PU		0x66
+#define ADC5_GEN3_AMUX4_THM_400K_PU		0x67
+#define ADC5_GEN3_AMUX5_THM_400K_PU		0x68
+#define ADC5_GEN3_AMUX6_THM_400K_PU		0x69
+#define ADC5_GEN3_AMUX1_GPIO_400K_PU		0x6a
+#define ADC5_GEN3_AMUX2_GPIO_400K_PU		0x6b
+#define ADC5_GEN3_AMUX3_GPIO_400K_PU		0x6c
+#define ADC5_GEN3_AMUX4_GPIO_400K_PU		0x6d
+
+/* 1/3 Divider */
+#define ADC5_GEN3_AMUX1_GPIO_DIV3		0x8a
+#define ADC5_GEN3_AMUX2_GPIO_DIV3		0x8b
+#define ADC5_GEN3_AMUX3_GPIO_DIV3		0x8c
+
+#define ADC5_GEN3_VPH_PWR			0x8e
+#define ADC5_GEN3_VBAT_SNS_QBG			0x8f
+
+#define ADC5_GEN3_VBAT_SNS_CHGR			0x94
+#define ADC5_GEN3_VBAT_2S_MID_QBG		0x96
+#define ADC5_GEN3_VBAT_2S_MID_CHGR		0x9d
+
+#define ADC5_OFFSET_EXT2			0xf8
+
 #endif /* _DT_BINDINGS_QCOM_SPMI_VADC_H */
--- linux-qcom-6.8.0.orig/include/dt-bindings/interconnect/qcom,icc.h
+++ linux-qcom-6.8.0/include/dt-bindings/interconnect/qcom,icc.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef __DT_BINDINGS_INTERCONNECT_QCOM_ICC_H
@@ -23,4 +24,10 @@
 #define QCOM_ICC_TAG_ALWAYS		(QCOM_ICC_TAG_AMC | QCOM_ICC_TAG_WAKE |\
 					 QCOM_ICC_TAG_SLEEP)
 
+/*
+ * PERF_MODE indicates that each node in the requested path should use
+ * performance-optimized settings if supported by the node.
+ */
+#define QCOM_ICC_TAG_PERF_MODE		(1 << 3)
+
 #endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/interconnect/qcom,qcs615-rpmh.h
+++ linux-qcom-6.8.0/include/dt-bindings/interconnect/qcom,qcs615-rpmh.h
@@ -0,0 +1,136 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __DT_BINDINGS_INTERCONNECT_QCOM_QCS615_H
+#define __DT_BINDINGS_INTERCONNECT_QCOM_QCS615_H
+
+#define MASTER_A1NOC_CFG		1
+#define MASTER_QDSS_BAM			2
+#define MASTER_QSPI			3
+#define MASTER_QUP_0			4
+#define MASTER_BLSP_1			5
+#define MASTER_CNOC_A2NOC		6
+#define MASTER_CRYPTO			7
+#define MASTER_IPA			8
+#define MASTER_EMAC_EVB			9
+#define MASTER_PCIE			10
+#define MASTER_QDSS_ETR			11
+#define MASTER_SDCC_1			12
+#define MASTER_SDCC_2			13
+#define MASTER_UFS_MEM			14
+#define MASTER_USB2			15
+#define MASTER_USB3_0			16
+#define SLAVE_A1NOC_SNOC		17
+#define SLAVE_LPASS_SNOC		18
+#define SLAVE_ANOC_PCIE_SNOC		19
+#define SLAVE_SERVICE_A2NOC		20
+
+#define MASTER_CAMNOC_HF0_UNCOMP	1
+#define MASTER_CAMNOC_HF1_UNCOMP	2
+#define MASTER_CAMNOC_SF_UNCOMP		3
+#define SLAVE_CAMNOC_UNCOMP		4
+
+#define MASTER_SPDM			1
+#define MASTER_SNOC_CNOC		2
+#define MASTER_QDSS_DAP			3
+#define SLAVE_A1NOC_CFG			4
+#define SLAVE_AHB2PHY_EAST		5
+#define SLAVE_AHB2PHY_WEST		6
+#define SLAVE_AOP			7
+#define SLAVE_AOSS			8
+#define SLAVE_CAMERA_CFG		9
+#define SLAVE_CLK_CTL			10
+#define SLAVE_RBCPR_CX_CFG		11
+#define SLAVE_RBCPR_MX_CFG		12
+#define SLAVE_CRYPTO_0_CFG		13
+#define SLAVE_CNOC_DDRSS		14
+#define SLAVE_DISPLAY_CFG		15
+#define SLAVE_EMAC_AVB_CFG		16
+#define SLAVE_GLM			17
+#define SLAVE_GFX3D_CFG			18
+#define SLAVE_IMEM_CFG			19
+#define SLAVE_IPA_CFG			20
+#define SLAVE_CNOC_MNOC_CFG		21
+#define SLAVE_PCIE_CFG			22
+#define SLAVE_PIMEM_CFG			23
+#define SLAVE_PRNG			24
+#define SLAVE_QDSS_CFG			25
+#define SLAVE_QSPI			26
+#define SLAVE_QUP_0			27
+#define SLAVE_QUP_1			28
+#define SLAVE_SDCC_1			29
+#define SLAVE_SDCC_2			30
+#define SLAVE_SNOC_CFG			31
+#define SLAVE_SPDM_WRAPPER		32
+#define SLAVE_TCSR			33
+#define SLAVE_TLMM_EAST			34
+#define SLAVE_TLMM_SOUTH		35
+#define SLAVE_TLMM_WEST			36
+#define SLAVE_UFS_MEM_CFG		37
+#define SLAVE_USB2			38
+#define SLAVE_USB3			39
+#define SLAVE_VENUS_CFG			40
+#define SLAVE_VSENSE_CTRL_CFG		41
+#define SLAVE_CNOC_A2NOC		42
+#define SLAVE_SERVICE_CNOC		43
+
+#define MASTER_CNOC_DC_NOC		1
+#define SLAVE_DC_NOC_GEMNOC		2
+#define SLAVE_LLCC_CFG			3
+
+#define MASTER_APPSS_PROC		1
+#define MASTER_GPU_TCU			2
+#define MASTER_SYS_TCU			3
+#define MASTER_GEM_NOC_CFG		4
+#define MASTER_GFX3D			5
+#define MASTER_MNOC_HF_MEM_NOC		6
+#define MASTER_MNOC_SF_MEM_NOC		7
+#define MASTER_SNOC_GC_MEM_NOC		8
+#define MASTER_SNOC_SF_MEM_NOC		9
+#define SLAVE_MSS_PROC_MS_MPU_CFG	10
+#define SLAVE_GEM_NOC_SNOC		11
+#define SLAVE_LLCC			12
+#define SLAVE_MEM_NOC_PCIE_SNOC		13
+#define SLAVE_SERVICE_GEM_NOC		14
+
+#define MASTER_IPA_CORE			1
+#define SLAVE_IPA_CORE			2
+
+#define MASTER_LLCC			1
+#define SLAVE_EBI1			2
+
+#define MASTER_CNOC_MNOC_CFG		1
+#define MASTER_CAMNOC_HF0		2
+#define MASTER_CAMNOC_HF1		3
+#define MASTER_CAMNOC_SF		4
+#define MASTER_MDP0			5
+#define MASTER_ROTATOR			6
+#define MASTER_VIDEO_P0			7
+#define MASTER_VIDEO_PROC		8
+#define SLAVE_MNOC_SF_MEM_NOC		9
+#define SLAVE_MNOC_HF_MEM_NOC		10
+#define SLAVE_SERVICE_MNOC		11
+
+#define MASTER_SNOC_CFG			1
+#define MASTER_A1NOC_SNOC		2
+#define MASTER_GEM_NOC_SNOC		3
+#define MASTER_GEM_NOC_PCIE_SNOC	4
+#define MASTER_LPASS_ANOC		5
+#define MASTER_ANOC_PCIE_SNOC		6
+#define MASTER_PIMEM			7
+#define MASTER_GIC			8
+#define SLAVE_APPSS			9
+#define SLAVE_SNOC_CNOC			10
+#define SLAVE_SNOC_GEM_NOC_SF		11
+#define SLAVE_SNOC_MEM_NOC_GC		12
+#define SLAVE_IMEM			13
+#define SLAVE_PIMEM			14
+#define SLAVE_SERVICE_SNOC		15
+#define SLAVE_PCIE_0			16
+#define SLAVE_QDSS_STM			17
+#define SLAVE_TCU			18
+
+#endif
+
--- linux-qcom-6.8.0.orig/include/dt-bindings/interconnect/qcom,qcs8300-rpmh.h
+++ linux-qcom-6.8.0/include/dt-bindings/interconnect/qcom,qcs8300-rpmh.h
@@ -0,0 +1,189 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __DT_BINDINGS_INTERCONNECT_QCOM_QCS8300_H
+#define __DT_BINDINGS_INTERCONNECT_QCOM_QCS8300_H
+
+#define MASTER_QUP_3				0
+#define MASTER_EMAC				1
+#define MASTER_SDC				2
+#define MASTER_UFS_MEM				3
+#define MASTER_USB2				4
+#define MASTER_USB3_0				5
+#define SLAVE_A1NOC_SNOC			6
+
+#define MASTER_QDSS_BAM				0
+#define MASTER_QUP_0				1
+#define MASTER_QUP_1				2
+#define MASTER_CNOC_A2NOC			3
+#define MASTER_CRYPTO_CORE0			4
+#define MASTER_CRYPTO_CORE1			5
+#define MASTER_IPA				6
+#define MASTER_QDSS_ETR_0			7
+#define MASTER_QDSS_ETR_1			8
+#define SLAVE_A2NOC_SNOC			9
+
+#define MASTER_QUP_CORE_0			0
+#define MASTER_QUP_CORE_1			1
+#define MASTER_QUP_CORE_3			2
+#define SLAVE_QUP_CORE_0			3
+#define SLAVE_QUP_CORE_1			4
+#define SLAVE_QUP_CORE_3			5
+
+#define MASTER_GEM_NOC_CNOC			0
+#define MASTER_GEM_NOC_PCIE_SNOC		1
+#define SLAVE_AHB2PHY_2				2
+#define SLAVE_AHB2PHY_3				3
+#define SLAVE_ANOC_THROTTLE_CFG			4
+#define SLAVE_AOSS				5
+#define SLAVE_APPSS				6
+#define SLAVE_BOOT_ROM				7
+#define SLAVE_CAMERA_CFG			8
+#define SLAVE_CAMERA_NRT_THROTTLE_CFG		9
+#define SLAVE_CAMERA_RT_THROTTLE_CFG		10
+#define SLAVE_CLK_CTL				11
+#define SLAVE_CDSP_CFG				12
+#define SLAVE_RBCPR_CX_CFG			13
+#define SLAVE_RBCPR_MMCX_CFG			14
+#define SLAVE_RBCPR_MX_CFG			15
+#define SLAVE_CPR_NSPCX				16
+#define SLAVE_CPR_NSPHMX			17
+#define SLAVE_CRYPTO_0_CFG			18
+#define SLAVE_CX_RDPM				19
+#define SLAVE_DISPLAY_CFG			20
+#define SLAVE_DISPLAY_RT_THROTTLE_CFG		21
+#define SLAVE_EMAC_CFG				22
+#define SLAVE_GP_DSP0_CFG			23
+#define SLAVE_GPDSP0_THROTTLE_CFG		24
+#define SLAVE_GPU_TCU_THROTTLE_CFG		25
+#define SLAVE_GFX3D_CFG				26
+#define SLAVE_HWKM				27
+#define SLAVE_IMEM_CFG				28
+#define SLAVE_IPA_CFG				29
+#define SLAVE_IPC_ROUTER_CFG			30
+#define SLAVE_LPASS				31
+#define SLAVE_LPASS_THROTTLE_CFG		32
+#define SLAVE_MX_RDPM				33
+#define SLAVE_MXC_RDPM				34
+#define SLAVE_PCIE_0_CFG			35
+#define SLAVE_PCIE_1_CFG			36
+#define SLAVE_PCIE_TCU_THROTTLE_CFG		37
+#define SLAVE_PCIE_THROTTLE_CFG			38
+#define SLAVE_PDM				39
+#define SLAVE_PIMEM_CFG				40
+#define SLAVE_PKA_WRAPPER_CFG			41
+#define SLAVE_QDSS_CFG				42
+#define SLAVE_QM_CFG				43
+#define SLAVE_QM_MPU_CFG			44
+#define SLAVE_QUP_0				45
+#define SLAVE_QUP_1				46
+#define SLAVE_QUP_3				47
+#define SLAVE_SAIL_THROTTLE_CFG			48
+#define SLAVE_SDC1				49
+#define SLAVE_SECURITY				50
+#define SLAVE_SNOC_THROTTLE_CFG			51
+#define SLAVE_TCSR				52
+#define SLAVE_TLMM				53
+#define SLAVE_TSC_CFG				54
+#define SLAVE_UFS_MEM_CFG			55
+#define SLAVE_USB2				56
+#define SLAVE_USB3_0				57
+#define SLAVE_VENUS_CFG				58
+#define SLAVE_VENUS_CVP_THROTTLE_CFG		59
+#define SLAVE_VENUS_V_CPU_THROTTLE_CFG		60
+#define SLAVE_VENUS_VCODEC_THROTTLE_CFG		61
+#define SLAVE_DDRSS_CFG				62
+#define SLAVE_GPDSP_NOC_CFG			63
+#define SLAVE_CNOC_MNOC_HF_CFG			64
+#define SLAVE_CNOC_MNOC_SF_CFG			65
+#define SLAVE_PCIE_ANOC_CFG			66
+#define SLAVE_SNOC_CFG				67
+#define SLAVE_BOOT_IMEM				68
+#define SLAVE_IMEM				69
+#define SLAVE_PIMEM				70
+#define SLAVE_PCIE_0				71
+#define SLAVE_PCIE_1				72
+#define SLAVE_QDSS_STM				73
+#define SLAVE_TCU				74
+
+#define MASTER_CNOC_DC_NOC			0
+#define SLAVE_LLCC_CFG				1
+#define SLAVE_GEM_NOC_CFG			2
+
+#define MASTER_GPU_TCU				0
+#define MASTER_PCIE_TCU				1
+#define MASTER_SYS_TCU				2
+#define MASTER_APPSS_PROC			3
+#define MASTER_COMPUTE_NOC			4
+#define MASTER_GEM_NOC_CFG			5
+#define MASTER_GPDSP_SAIL			6
+#define MASTER_GFX3D				7
+#define MASTER_MNOC_HF_MEM_NOC			8
+#define MASTER_MNOC_SF_MEM_NOC			9
+#define MASTER_ANOC_PCIE_GEM_NOC		10
+#define MASTER_SNOC_GC_MEM_NOC			11
+#define MASTER_SNOC_SF_MEM_NOC			12
+#define SLAVE_GEM_NOC_CNOC			13
+#define SLAVE_LLCC				14
+#define SLAVE_GEM_NOC_PCIE_CNOC			15
+#define SLAVE_SERVICE_GEM_NOC_1			16
+#define SLAVE_SERVICE_GEM_NOC_2			17
+#define SLAVE_SERVICE_GEM_NOC			18
+#define SLAVE_SERVICE_GEM_NOC2			19
+
+#define MASTER_SAILSS_MD0			0
+#define MASTER_DSP0				1
+#define SLAVE_GP_DSP_SAIL_NOC			2
+
+#define MASTER_CNOC_LPASS_AG_NOC		0
+#define MASTER_LPASS_PROC			1
+#define SLAVE_LPASS_CORE_CFG			2
+#define SLAVE_LPASS_LPI_CFG			3
+#define SLAVE_LPASS_MPU_CFG			4
+#define SLAVE_LPASS_TOP_CFG			5
+#define SLAVE_LPASS_SNOC			6
+#define SLAVE_SERVICES_LPASS_AML_NOC		7
+#define SLAVE_SERVICE_LPASS_AG_NOC		8
+
+#define MASTER_LLCC				0
+#define SLAVE_EBI1				1
+
+#define MASTER_CAMNOC_HF			0
+#define MASTER_CAMNOC_ICP			1
+#define MASTER_CAMNOC_SF			2
+#define MASTER_MDP0				3
+#define MASTER_MDP1				4
+#define MASTER_CNOC_MNOC_HF_CFG			5
+#define MASTER_CNOC_MNOC_SF_CFG			6
+#define MASTER_VIDEO_P0				7
+#define MASTER_VIDEO_PROC			8
+#define MASTER_VIDEO_V_PROC			9
+#define SLAVE_MNOC_HF_MEM_NOC			10
+#define SLAVE_MNOC_SF_MEM_NOC			11
+#define SLAVE_SERVICE_MNOC_HF			12
+#define SLAVE_SERVICE_MNOC_SF			13
+
+#define MASTER_CDSP_NOC_CFG			0
+#define MASTER_CDSP_PROC			1
+#define SLAVE_HCP_A				2
+#define SLAVE_CDSP_MEM_NOC			3
+#define SLAVE_SERVICE_NSP_NOC			4
+
+#define MASTER_PCIE_0				0
+#define MASTER_PCIE_1				1
+#define SLAVE_ANOC_PCIE_GEM_NOC			2
+
+#define MASTER_GIC_AHB				0
+#define MASTER_A1NOC_SNOC			1
+#define MASTER_A2NOC_SNOC			2
+#define MASTER_LPASS_ANOC			3
+#define MASTER_SNOC_CFG				4
+#define MASTER_PIMEM				5
+#define MASTER_GIC				6
+#define SLAVE_SNOC_GEM_NOC_GC			7
+#define SLAVE_SNOC_GEM_NOC_SF			8
+#define SLAVE_SERVICE_SNOC			9
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/interrupt-controller/arm-gic.h
+++ linux-qcom-6.8.0/include/dt-bindings/interrupt-controller/arm-gic.h
@@ -12,6 +12,7 @@
 
 #define GIC_SPI 0
 #define GIC_PPI 1
+#define GIC_ESPI 2
 
 /*
  * Interrupt specifier cell 2.
--- linux-qcom-6.8.0.orig/include/dt-bindings/mailbox/qcom-ipcc.h
+++ linux-qcom-6.8.0/include/dt-bindings/mailbox/qcom-ipcc.h
@@ -33,5 +33,7 @@
 #define IPCC_CLIENT_NSP1		18
 #define IPCC_CLIENT_TME			23
 #define IPCC_CLIENT_WPSS		24
+#define IPCC_CLIENT_GPDSP0		31
+#define IPCC_CLIENT_GPDSP1		32
 
 #endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/msm-camera.h
+++ linux-qcom-6.8.0/include/dt-bindings/msm-camera.h
@@ -0,0 +1,167 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __MSM_CAMERA_H
+#define __MSM_CAMERA_H
+
+/* CPAS path data types */
+#define CAM_CPAS_PATH_DATA_IFE_START_OFFSET 0
+#define CAM_CPAS_PATH_DATA_IFE_LINEAR (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_IFE_VID (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_IFE_DISP (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_IFE_STATS (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_IFE_RDI0 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_IFE_RDI1 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_IFE_RDI2 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_IFE_RDI3 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 7)
+#define CAM_CPAS_PATH_DATA_IFE_PDAF (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 8)
+#define CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW \
+	(CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 9)
+#define CAM_CPAS_PATH_DATA_IFE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_IPE_START_OFFSET 32
+#define CAM_CPAS_PATH_DATA_IPE_RD_IN (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_IPE_RD_REF (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_IPE_WR_VID (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_IPE_WR_DISP (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_IPE_WR_REF (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_IPE_WR_APP (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_IPE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_OPE_START_OFFSET 64
+#define CAM_CPAS_PATH_DATA_OPE_RD_IN (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_OPE_RD_REF (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_OPE_WR_VID (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_OPE_WR_DISP (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_OPE_WR_REF (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_OPE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_SFE_START_OFFSET 96
+#define CAM_CPAS_PATH_DATA_SFE_NRDI    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_SFE_RDI0    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_SFE_RDI1    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_SFE_RDI2    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_SFE_RDI3    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_SFE_RDI4    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_SFE_STATS   (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_SFE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_CRE_START_OFFSET    (CAM_CPAS_PATH_DATA_SFE_MAX_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_CRE_RD_IN           (CAM_CPAS_PATH_DATA_CRE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_CRE_WR_OUT          (CAM_CPAS_PATH_DATA_CRE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_CRE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_CRE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_OFE_START_OFFSET (CAM_CPAS_PATH_DATA_CRE_MAX_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_OFE_RD_EXT       (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_OFE_RD_INT_PDI   (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_OFE_RD_INT_HDR   (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_OFE_WR_VID       (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_OFE_WR_DISP      (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_OFE_WR_IR        (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_OFE_WR_HDR_LTM   (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_OFE_WR_DC4       (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 7)
+#define CAM_CPAS_PATH_DATA_OFE_WR_AI        (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 8)
+#define CAM_CPAS_PATH_DATA_OFE_WR_PDI       (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 9)
+#define CAM_CPAS_PATH_DATA_OFE_WR_IDEALRAW  (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 10)
+#define CAM_CPAS_PATH_DATA_OFE_WR_STATS     (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 11)
+#define CAM_CPAS_PATH_DATA_OFE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_CONSO_OFFSET 256
+#define CAM_CPAS_PATH_DATA_ALL (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 0)
+
+/* IFE consolidated paths */
+#define CAM_CPAS_PATH_DATA_IFE_LINEAR_PDAF (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_IFE_UBWC_STATS (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_IFE_PIXEL_ALL (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW \
+	(CAM_CPAS_PATH_DATA_CONSO_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_IFE_RDI_ALL (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_IFE_UBWC (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_IFE_LINEAR_STATS (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 7)
+#define CAM_CPAS_PATH_DATA_IFE_UBWC_LINEAR (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 8)
+#define CAM_CPAS_PATH_DATA_IFE_PDAF_LINEAR (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 9)
+
+/* IPE Consolidated paths */
+#define CAM_CPAS_PATH_DATA_IPE_WR_VID_DISP (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 1)
+
+/* CPAS transaction types */
+#define CAM_CPAS_TRANSACTION_READ 0
+#define CAM_CPAS_TRANSACTION_WRITE 1
+
+/* CPAS traffic merge types */
+#define CAM_CPAS_TRAFFIC_MERGE_SUM 0
+#define CAM_CPAS_TRAFFIC_MERGE_SUM_INTERLEAVE 1
+
+/* Feature bit type */
+#define CAM_CPAS_FEATURE_TYPE_DISABLE 0
+#define CAM_CPAS_FEATURE_TYPE_ENABLE 1
+#define CAM_CPAS_FEATURE_TYPE_VALUE 2
+
+/* Feature support bit positions in feature fuse register*/
+#define CAM_CPAS_QCFA_BINNING_ENABLE 0
+#define CAM_CPAS_SECURE_CAMERA_ENABLE 1
+#define CAM_CPAS_MF_HDR_ENABLE 2
+#define CAM_CPAS_MP_LIMIT_FUSE 3
+#define CAM_CPAS_ISP_FUSE      4
+#define CAM_CPAS_ISP_PIX_FUSE  5
+#define CAM_CPAS_ISP_LITE_FUSE 6
+#define CAM_CPAS_CSIPHY_FUSE   7
+#define CAM_CPAS_IPE_VID_OUT_8BPP_LIMIT_ENABLE 8
+#define CAM_CPAS_SFE_FUSE 9
+#define CAM_CPAS_SHDR_FUSE     7
+#define CAM_CPAS_CSIPHY_FUSE   8
+#define CAM_CPAS_RT_OT_FUSE    9
+#define CAM_CPAS_FUSE_FEATURE_MAX 10
+#define CAM_CPAS_CUSTOM_FUSE 10
+#define CAM_CPAS_CAM_FUSE 11
+#define CAM_CPAS_SHDR_FUSE 12
+#define CAM_CPAS_FUSE_FEATURE_MAX 13
+
+/* Flash type*/
+#define CAM_FLASH_TYPE_PMIC 0
+#define CAM_FLASH_TYPE_I2C  1
+#define CAM_FLASH_TYPE_GPIO 2
+
+/* CCI master */
+#define CCI_MASTER_0 0
+#define CCI_MASTER_1 1
+#define CCI_MASTER_MAX 2
+
+/* AON Camera IDs*/
+#define AON_CAM1             0
+#define AON_CAM2             1
+#define MAX_AON_CAM          2
+#define NOT_AON_CAM          255
+
+/* Camera DRV enable masks */
+#define CAM_DDR_DRV    0x1
+#define CAM_CLK_DRV    0x2
+
+/* Port index for BW voting */
+#define CAM_CPAS_PORT_HLOS_DRV    0
+#define CAM_CPAS_PORT_DRV_0       1
+#define CAM_CPAS_PORT_DRV_1       2
+#define CAM_CPAS_PORT_DRV_2       3
+#define CAM_CPAS_PORT_DRV_DYN     32
+
+/* Domain ID types */
+#define CAM_CPAS_NON_SECURE_DOMAIN  0
+#define CAM_CPAS_SECURE_DOMAIN      1
+
+/* Debug bypass driver */
+#define CAM_BYPASS_RGLTR      0x1
+#define CAM_BYPASS_RGLTR_MODE 0x2
+#define CAM_BYPASS_CLKS       0x4
+#define CAM_BYPASS_CESTA      0x8
+#define CAM_BYPASS_ICC        0x10
+
+#endif
--- linux-qcom-6.8.0.orig/include/dt-bindings/power/qcom-rpmpd.h
+++ linux-qcom-6.8.0/include/dt-bindings/power/qcom-rpmpd.h
@@ -4,6 +4,25 @@
 #ifndef _DT_BINDINGS_POWER_QCOM_RPMPD_H
 #define _DT_BINDINGS_POWER_QCOM_RPMPD_H
 
+/* QCS8300 Power Domain Indexes */
+#define QCS8300_CX	0
+#define QCS8300_CX_AO	1
+#define QCS8300_DDR	2
+#define QCS8300_EBI	3
+#define QCS8300_GFX	4
+#define QCS8300_LCX	5
+#define QCS8300_LMX	6
+#define QCS8300_MMCX	7
+#define QCS8300_MMCX_AO	8
+#define QCS8300_MSS	9
+#define QCS8300_MX	10
+#define QCS8300_MX_AO	11
+#define QCS8300_MXC	12
+#define QCS8300_MXC_AO	13
+#define QCS8300_NSP0	14
+#define QCS8300_NSP1	15
+#define QCS8300_XO	16
+
 /* SA8775P Power Domain Indexes */
 #define SA8775P_CX	0
 #define SA8775P_CX_AO	1
--- linux-qcom-6.8.0.orig/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
+++ linux-qcom-6.8.0/include/dt-bindings/sound/qcom,q6dsp-lpass-ports.h
@@ -139,6 +139,26 @@
 #define DISPLAY_PORT_RX_5	133
 #define DISPLAY_PORT_RX_6	134
 #define DISPLAY_PORT_RX_7	135
+#define PRIMARY_SDR_MI2S_RX     136
+#define PRIMARY_SDR_MI2S_TX     137
+#define SECONDARY_SDR_MI2S_RX   138
+#define SECONDARY_SDR_MI2S_TX   139
+#define TERTIARY_SDR_MI2S_RX    140
+#define TERTIARY_SDR_MI2S_TX    141
+#define QUATERNARY_SDR_MI2S_RX  142
+#define QUATERNARY_SDR_MI2S_TX  143
+#define QUINARY_SDR_MI2S_RX     144
+#define QUINARY_SDR_MI2S_TX     145
+#define PRIMARY_SDR_TDM_RX_0    146
+#define PRIMARY_SDR_TDM_TX_0    147
+#define SECONDARY_SDR_TDM_RX_0  148
+#define SECONDARY_SDR_TDM_TX_0  149
+#define TERTIARY_SDR_TDM_RX_0   150
+#define TERTIARY_SDR_TDM_TX_0   151
+#define QUATERNARY_SDR_TDM_RX_0 152
+#define QUATERNARY_SDR_TDM_TX_0 153
+#define QUINARY_SDR_TDM_RX_0    154
+#define QUINARY_SDR_TDM_TX_0    155
 
 #define LPASS_CLK_ID_PRI_MI2S_IBIT	1
 #define LPASS_CLK_ID_PRI_MI2S_EBIT	2
--- linux-qcom-6.8.0.orig/include/kunit/skbuff.h
+++ linux-qcom-6.8.0/include/kunit/skbuff.h
@@ -29,7 +29,7 @@
 static inline struct sk_buff *kunit_zalloc_skb(struct kunit *test, int len,
 					       gfp_t gfp)
 {
-	struct sk_buff *res = alloc_skb(len, GFP_KERNEL);
+	struct sk_buff *res = alloc_skb(len, gfp);
 
 	if (!res || skb_pad(res, len))
 		return NULL;
--- linux-qcom-6.8.0.orig/include/kvm/arm_pmu.h
+++ linux-qcom-6.8.0/include/kvm/arm_pmu.h
@@ -86,7 +86,7 @@
  */
 #define kvm_pmu_update_vcpu_events(vcpu)				\
 	do {								\
-		if (!has_vhe() && kvm_vcpu_has_pmu(vcpu))		\
+		if (!has_vhe() && kvm_arm_support_pmu_v3())		\
 			vcpu->arch.pmu.events = *kvm_get_pmu_events();	\
 	} while (0)
 
--- linux-qcom-6.8.0.orig/include/linux/acpi.h
+++ linux-qcom-6.8.0/include/linux/acpi.h
@@ -573,9 +573,13 @@
 #define OSC_SB_CPCV2_SUPPORT			0x00000040
 #define OSC_SB_PCLPI_SUPPORT			0x00000080
 #define OSC_SB_OSLPI_SUPPORT			0x00000100
+#define OSC_SB_FAST_THERMAL_SAMPLING_SUPPORT	0x00000200
+#define OSC_SB_OVER_16_PSTATES_SUPPORT		0x00000400
+#define OSC_SB_GED_SUPPORT			0x00000800
 #define OSC_SB_CPC_DIVERSE_HIGH_SUPPORT		0x00001000
-#define OSC_SB_GENERIC_INITIATOR_SUPPORT	0x00002000
+#define OSC_SB_IRQ_RESOURCE_SOURCE_SUPPORT	0x00002000
 #define OSC_SB_CPC_FLEXIBLE_ADR_SPACE		0x00004000
+#define OSC_SB_GENERIC_INITIATOR_SUPPORT	0x00020000
 #define OSC_SB_NATIVE_USB4_SUPPORT		0x00040000
 #define OSC_SB_PRM_SUPPORT			0x00200000
 #define OSC_SB_FFH_OPR_SUPPORT			0x00400000
@@ -1170,6 +1174,7 @@
 #endif
 
 #ifdef CONFIG_ACPI
+char *acpi_handle_path(acpi_handle handle);
 __printf(3, 4)
 void acpi_handle_printk(const char *level, acpi_handle handle,
 			const char *fmt, ...);
--- linux-qcom-6.8.0.orig/include/linux/arm-smccc.h
+++ linux-qcom-6.8.0/include/linux/arm-smccc.h
@@ -227,8 +227,6 @@
 
 void __init arm_smccc_version_init(u32 version, enum arm_smccc_conduit conduit);
 
-extern u64 smccc_has_sve_hint;
-
 /**
  * arm_smccc_get_soc_id_version()
  *
@@ -327,15 +325,6 @@
 };
 
 /**
- * __arm_smccc_sve_check() - Set the SVE hint bit when doing SMC calls
- *
- * Sets the SMCCC hint bit to indicate if there is live state in the SVE
- * registers, this modifies x0 in place and should never be called from C
- * code.
- */
-asmlinkage unsigned long __arm_smccc_sve_check(unsigned long x0);
-
-/**
  * __arm_smccc_smc() - make SMC calls
  * @a0-a7: arguments passed in registers 0 to 7
  * @res: result values from registers 0 to 3
@@ -402,20 +391,6 @@
 
 #endif
 
-/* nVHE hypervisor doesn't have a current thread so needs separate checks */
-#if defined(CONFIG_ARM64_SVE) && !defined(__KVM_NVHE_HYPERVISOR__)
-
-#define SMCCC_SVE_CHECK ALTERNATIVE("nop \n",  "bl __arm_smccc_sve_check \n", \
-				    ARM64_SVE)
-#define smccc_sve_clobbers "x16", "x30", "cc",
-
-#else
-
-#define SMCCC_SVE_CHECK
-#define smccc_sve_clobbers
-
-#endif
-
 #define __constraint_read_2	"r" (arg0)
 #define __constraint_read_3	__constraint_read_2, "r" (arg1)
 #define __constraint_read_4	__constraint_read_3, "r" (arg2)
@@ -486,12 +461,11 @@
 		register unsigned long r3 asm("r3"); 			\
 		CONCATENATE(__declare_arg_,				\
 			    COUNT_ARGS(__VA_ARGS__))(__VA_ARGS__);	\
-		asm volatile(SMCCC_SVE_CHECK				\
-			     inst "\n" :				\
+		asm volatile(inst "\n" :				\
 			     "=r" (r0), "=r" (r1), "=r" (r2), "=r" (r3)	\
 			     : CONCATENATE(__constraint_read_,		\
 					   COUNT_ARGS(__VA_ARGS__))	\
-			     : smccc_sve_clobbers "memory");		\
+			     : "memory");				\
 		if (___res)						\
 			*___res = (typeof(*___res)){r0, r1, r2, r3};	\
 	} while (0)
@@ -540,7 +514,7 @@
 		asm ("" :						\
 		     : CONCATENATE(__constraint_read_,			\
 				   COUNT_ARGS(__VA_ARGS__))		\
-		     : smccc_sve_clobbers "memory");			\
+		     : "memory");					\
 		if (___res)						\
 			___res->a0 = SMCCC_RET_NOT_SUPPORTED;		\
 	} while (0)
--- linux-qcom-6.8.0.orig/include/linux/atomic/atomic-arch-fallback.h
+++ linux-qcom-6.8.0/include/linux/atomic/atomic-arch-fallback.h
@@ -2234,7 +2234,7 @@
 
 /**
  * raw_atomic_sub_and_test() - atomic subtract and test if zero with full ordering
- * @i: int value to add
+ * @i: int value to subtract
  * @v: pointer to atomic_t
  *
  * Atomically updates @v to (@v - @i) with full ordering.
@@ -4346,7 +4346,7 @@
 
 /**
  * raw_atomic64_sub_and_test() - atomic subtract and test if zero with full ordering
- * @i: s64 value to add
+ * @i: s64 value to subtract
  * @v: pointer to atomic64_t
  *
  * Atomically updates @v to (@v - @i) with full ordering.
@@ -4662,4 +4662,4 @@
 }
 
 #endif /* _LINUX_ATOMIC_FALLBACK_H */
-// eec048affea735b8464f58e6d96992101f8f85f1
+// 192d6476c0a1486196d1a01386828be566343816
--- linux-qcom-6.8.0.orig/include/linux/atomic/atomic-instrumented.h
+++ linux-qcom-6.8.0/include/linux/atomic/atomic-instrumented.h
@@ -1341,7 +1341,7 @@
 
 /**
  * atomic_sub_and_test() - atomic subtract and test if zero with full ordering
- * @i: int value to add
+ * @i: int value to subtract
  * @v: pointer to atomic_t
  *
  * Atomically updates @v to (@v - @i) with full ordering.
@@ -2905,7 +2905,7 @@
 
 /**
  * atomic64_sub_and_test() - atomic subtract and test if zero with full ordering
- * @i: s64 value to add
+ * @i: s64 value to subtract
  * @v: pointer to atomic64_t
  *
  * Atomically updates @v to (@v - @i) with full ordering.
@@ -4469,7 +4469,7 @@
 
 /**
  * atomic_long_sub_and_test() - atomic subtract and test if zero with full ordering
- * @i: long value to add
+ * @i: long value to subtract
  * @v: pointer to atomic_long_t
  *
  * Atomically updates @v to (@v - @i) with full ordering.
@@ -5008,4 +5008,4 @@
 
 
 #endif /* _LINUX_ATOMIC_INSTRUMENTED_H */
-// 2cc4bc990fef44d3836ec108f11b610f3f438184
+// 1b2571b4e17a6671a7631db8158e0fa5afb6e51d
--- linux-qcom-6.8.0.orig/include/linux/atomic/atomic-long.h
+++ linux-qcom-6.8.0/include/linux/atomic/atomic-long.h
@@ -1527,7 +1527,7 @@
 
 /**
  * raw_atomic_long_sub_and_test() - atomic subtract and test if zero with full ordering
- * @i: long value to add
+ * @i: long value to subtract
  * @v: pointer to atomic_long_t
  *
  * Atomically updates @v to (@v - @i) with full ordering.
@@ -1795,4 +1795,4 @@
 }
 
 #endif /* _LINUX_ATOMIC_LONG_H */
-// 4ef23f98c73cff96d239896175fd26b10b88899e
+// f8204cfa718c04a01e3c7a15257ac85bbef54c23
--- linux-qcom-6.8.0.orig/include/linux/audit.h
+++ linux-qcom-6.8.0/include/linux/audit.h
@@ -37,6 +37,7 @@
 struct audit_tree;
 struct sk_buff;
 struct kern_ipc_perm;
+struct lsmblob;
 
 struct audit_krule {
 	u32			pflags;
@@ -185,6 +186,10 @@
 						  const char *operation);
 extern void		    audit_log_lost(const char *message);
 
+extern void audit_log_object_context(struct audit_buffer *ab,
+				     struct lsmblob *blob);
+extern int audit_log_subject_context(struct audit_buffer *ab,
+				     struct lsmblob *blob);
 extern int audit_log_task_context(struct audit_buffer *ab);
 extern void audit_log_task_info(struct audit_buffer *ab);
 
@@ -245,6 +250,14 @@
 { }
 static inline void audit_log_path_denied(int type, const char *operation)
 { }
+static inline  void audit_log_object_context(struct audit_buffer *ab,
+					     struct lsmblob *blob)
+{ }
+static inline int audit_log_subject_context(struct audit_buffer *ab,
+					    struct lsmblob *blob)
+{
+	return 0;
+}
 static inline int audit_log_task_context(struct audit_buffer *ab)
 {
 	return 0;
--- linux-qcom-6.8.0.orig/include/linux/bitmap.h
+++ linux-qcom-6.8.0/include/linux/bitmap.h
@@ -6,6 +6,7 @@
 
 #include <linux/align.h>
 #include <linux/bitops.h>
+#include <linux/cleanup.h>
 #include <linux/errno.h>
 #include <linux/find.h>
 #include <linux/limits.h>
@@ -79,6 +80,10 @@
  *  bitmap_to_arr64(buf, src, nbits)            Copy nbits from buf to u64[] dst
  *  bitmap_get_value8(map, start)               Get 8bit value from map at start
  *  bitmap_set_value8(map, value, start)        Set 8bit value to map at start
+ *  bitmap_read(map, start, nbits)              Read an nbits-sized value from
+ *                                              map at start
+ *  bitmap_write(map, value, start, nbits)      Write an nbits-sized value to
+ *                                              map at start
  *
  * Note, bitmap_zero() and bitmap_fill() operate over the region of
  * unsigned longs, that is, bits behind bitmap till the unsigned long
@@ -127,6 +132,8 @@
 unsigned long *bitmap_zalloc_node(unsigned int nbits, gfp_t flags, int node);
 void bitmap_free(const unsigned long *bitmap);
 
+DEFINE_FREE(bitmap, unsigned long *, if (_T) bitmap_free(_T))
+
 /* Managed variants of the above. */
 unsigned long *devm_bitmap_alloc(struct device *dev,
 				 unsigned int nbits, gfp_t flags);
@@ -214,9 +221,11 @@
 #define BITMAP_FIRST_WORD_MASK(start) (~0UL << ((start) & (BITS_PER_LONG - 1)))
 #define BITMAP_LAST_WORD_MASK(nbits) (~0UL >> (-(nbits) & (BITS_PER_LONG - 1)))
 
+#define bitmap_size(nbits)	(ALIGN(nbits, BITS_PER_LONG) / BITS_PER_BYTE)
+
 static inline void bitmap_zero(unsigned long *dst, unsigned int nbits)
 {
-	unsigned int len = BITS_TO_LONGS(nbits) * sizeof(unsigned long);
+	unsigned int len = bitmap_size(nbits);
 
 	if (small_const_nbits(nbits))
 		*dst = 0;
@@ -226,7 +235,7 @@
 
 static inline void bitmap_fill(unsigned long *dst, unsigned int nbits)
 {
-	unsigned int len = BITS_TO_LONGS(nbits) * sizeof(unsigned long);
+	unsigned int len = bitmap_size(nbits);
 
 	if (small_const_nbits(nbits))
 		*dst = ~0UL;
@@ -237,7 +246,7 @@
 static inline void bitmap_copy(unsigned long *dst, const unsigned long *src,
 			unsigned int nbits)
 {
-	unsigned int len = BITS_TO_LONGS(nbits) * sizeof(unsigned long);
+	unsigned int len = bitmap_size(nbits);
 
 	if (small_const_nbits(nbits))
 		*dst = *src;
@@ -256,6 +265,18 @@
 		dst[nbits / BITS_PER_LONG] &= BITMAP_LAST_WORD_MASK(nbits);
 }
 
+static inline void bitmap_copy_and_extend(unsigned long *to,
+					  const unsigned long *from,
+					  unsigned int count, unsigned int size)
+{
+	unsigned int copy = BITS_TO_LONGS(count);
+
+	memcpy(to, from, copy * sizeof(long));
+	if (count % BITS_PER_LONG)
+		to[copy - 1] &= BITMAP_LAST_WORD_MASK(count);
+	memset(to + copy, 0, bitmap_size(size) - copy * sizeof(long));
+}
+
 /*
  * On 32-bit systems bitmaps are represented as u32 arrays internally. On LE64
  * machines the order of hi and lo parts of numbers match the bitmap structure.
@@ -636,6 +657,79 @@
 	map[index] |= value << offset;
 }
 
+/**
+ * bitmap_read - read a value of n-bits from the memory region
+ * @map: address to the bitmap memory region
+ * @start: bit offset of the n-bit value
+ * @nbits: size of value in bits, nonzero, up to BITS_PER_LONG
+ *
+ * Returns: value of @nbits bits located at the @start bit offset within the
+ * @map memory region. For @nbits = 0 and @nbits > BITS_PER_LONG the return
+ * value is undefined.
+ */
+static inline unsigned long bitmap_read(const unsigned long *map,
+					unsigned long start,
+					unsigned long nbits)
+{
+	size_t index = BIT_WORD(start);
+	unsigned long offset = start % BITS_PER_LONG;
+	unsigned long space = BITS_PER_LONG - offset;
+	unsigned long value_low, value_high;
+
+	if (unlikely(!nbits || nbits > BITS_PER_LONG))
+		return 0;
+
+	if (space >= nbits)
+		return (map[index] >> offset) & BITMAP_LAST_WORD_MASK(nbits);
+
+	value_low = map[index] & BITMAP_FIRST_WORD_MASK(start);
+	value_high = map[index + 1] & BITMAP_LAST_WORD_MASK(start + nbits);
+	return (value_low >> offset) | (value_high << space);
+}
+
+/**
+ * bitmap_write - write n-bit value within a memory region
+ * @map: address to the bitmap memory region
+ * @value: value to write, clamped to nbits
+ * @start: bit offset of the n-bit value
+ * @nbits: size of value in bits, nonzero, up to BITS_PER_LONG.
+ *
+ * bitmap_write() behaves as-if implemented as @nbits calls of __assign_bit(),
+ * i.e. bits beyond @nbits are ignored:
+ *
+ *   for (bit = 0; bit < nbits; bit++)
+ *           __assign_bit(start + bit, bitmap, val & BIT(bit));
+ *
+ * For @nbits == 0 and @nbits > BITS_PER_LONG no writes are performed.
+ */
+static inline void bitmap_write(unsigned long *map, unsigned long value,
+				unsigned long start, unsigned long nbits)
+{
+	size_t index;
+	unsigned long offset;
+	unsigned long space;
+	unsigned long mask;
+	bool fit;
+
+	if (unlikely(!nbits || nbits > BITS_PER_LONG))
+		return;
+
+	mask = BITMAP_LAST_WORD_MASK(nbits);
+	value &= mask;
+	offset = start % BITS_PER_LONG;
+	space = BITS_PER_LONG - offset;
+	fit = space >= nbits;
+	index = BIT_WORD(start);
+
+	map[index] &= (fit ? (~(mask << offset)) : ~BITMAP_FIRST_WORD_MASK(start));
+	map[index] |= value << offset;
+	if (fit)
+		return;
+
+	map[index + 1] &= BITMAP_FIRST_WORD_MASK(start + nbits);
+	map[index + 1] |= (value >> space);
+}
+
 #endif /* __ASSEMBLY__ */
 
 #endif /* __LINUX_BITMAP_H */
--- linux-qcom-6.8.0.orig/include/linux/bitops.h
+++ linux-qcom-6.8.0/include/linux/bitops.h
@@ -80,6 +80,7 @@
 __check_bitop_pr(__test_and_clear_bit);
 __check_bitop_pr(__test_and_change_bit);
 __check_bitop_pr(test_bit);
+__check_bitop_pr(test_bit_acquire);
 
 #undef __check_bitop_pr
 
--- linux-qcom-6.8.0.orig/include/linux/blk-crypto-profile.h
+++ linux-qcom-6.8.0/include/linux/blk-crypto-profile.h
@@ -57,6 +57,62 @@
 	int (*keyslot_evict)(struct blk_crypto_profile *profile,
 			     const struct blk_crypto_key *key,
 			     unsigned int slot);
+
+	/**
+	 * @derive_sw_secret: Derive the software secret from a hardware-wrapped
+	 *		      key in ephemerally-wrapped form.
+	 *
+	 * This only needs to be implemented if BLK_CRYPTO_KEY_TYPE_HW_WRAPPED
+	 * is supported.
+	 *
+	 * Must return 0 on success, -EBADMSG if the key is invalid, or another
+	 * -errno code on other errors.
+	 */
+	int (*derive_sw_secret)(struct blk_crypto_profile *profile,
+				const u8 *eph_key, size_t eph_key_size,
+				u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE]);
+
+	/**
+	 * @import_key: Create a hardware-wrapped key by importing a raw key.
+	 *
+	 * This only needs to be implemented if BLK_CRYPTO_KEY_TYPE_HW_WRAPPED
+	 * is supported.
+	 *
+	 * On success, must write the new key in long-term wrapped form to
+	 * @lt_key and return its size in bytes.  On failure, must return a
+	 * -errno value.
+	 */
+	int (*import_key)(struct blk_crypto_profile *profile,
+			  const u8 *raw_key, size_t raw_key_size,
+			  u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+
+	/**
+	 * @generate_key: Generate a hardware-wrapped key.
+	 *
+	 * This only needs to be implemented if BLK_CRYPTO_KEY_TYPE_HW_WRAPPED
+	 * is supported.
+	 *
+	 * On success, must write the new key in long-term wrapped form to
+	 * @lt_key and return its size in bytes.  On failure, must return a
+	 * -errno value.
+	 */
+	int (*generate_key)(struct blk_crypto_profile *profile,
+			    u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+
+	/**
+	 * @prepare_key: Prepare a hardware-wrapped key to be used.
+	 *
+	 * Prepare a hardware-wrapped key to be used by converting it from
+	 * long-term wrapped form to ephemerally-wrapped form.  This only needs
+	 * to be implemented if BLK_CRYPTO_KEY_TYPE_HW_WRAPPED is supported.
+	 *
+	 * On success, must write the key in ephemerally-wrapped form to
+	 * @eph_key and return its size in bytes.  On failure, must return a
+	 * -errno value.
+	 */
+	int (*prepare_key)(struct blk_crypto_profile *profile,
+			   const u8 *lt_key, size_t lt_key_size,
+			   u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
 };
 
 /**
@@ -85,6 +141,12 @@
 	unsigned int max_dun_bytes_supported;
 
 	/**
+	 * @key_types_supported: A bitmask of the supported key types:
+	 * BLK_CRYPTO_KEY_TYPE_STANDARD and/or BLK_CRYPTO_KEY_TYPE_HW_WRAPPED.
+	 */
+	unsigned int key_types_supported;
+
+	/**
 	 * @modes_supported: Array of bitmasks that specifies whether each
 	 * combination of crypto mode and data unit size is supported.
 	 * Specifically, the i'th bit of modes_supported[crypto_mode] is set if
@@ -143,6 +205,17 @@
 
 void blk_crypto_profile_destroy(struct blk_crypto_profile *profile);
 
+int blk_crypto_import_key(struct blk_crypto_profile *profile,
+			  const u8 *raw_key, size_t raw_key_size,
+			  u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+
+int blk_crypto_generate_key(struct blk_crypto_profile *profile,
+			    u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+
+int blk_crypto_prepare_key(struct blk_crypto_profile *profile,
+			   const u8 *lt_key, size_t lt_key_size,
+			   u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+
 void blk_crypto_intersect_capabilities(struct blk_crypto_profile *parent,
 				       const struct blk_crypto_profile *child);
 
--- linux-qcom-6.8.0.orig/include/linux/blk-crypto.h
+++ linux-qcom-6.8.0/include/linux/blk-crypto.h
@@ -7,6 +7,7 @@
 #define __LINUX_BLK_CRYPTO_H
 
 #include <linux/types.h>
+#include <uapi/linux/blk-crypto.h>
 
 enum blk_crypto_mode_num {
 	BLK_ENCRYPTION_MODE_INVALID,
@@ -17,7 +18,58 @@
 	BLK_ENCRYPTION_MODE_MAX,
 };
 
-#define BLK_CRYPTO_MAX_KEY_SIZE		64
+/*
+ * Supported types of keys.  Must be bitflags due to their use in
+ * blk_crypto_profile::key_types_supported.
+ */
+enum blk_crypto_key_type {
+	/*
+	 * Standard keys (i.e. "software keys").  These keys are simply kept in
+	 * raw, plaintext form in kernel memory.
+	 */
+	BLK_CRYPTO_KEY_TYPE_STANDARD = 1 << 0,
+
+	/*
+	 * Hardware-wrapped keys.  These keys are only present in kernel memory
+	 * in ephemerally-wrapped form, and they can only be unwrapped by
+	 * dedicated hardware.  For details, see the "Hardware-wrapped keys"
+	 * section of Documentation/block/inline-encryption.rst.
+	 */
+	BLK_CRYPTO_KEY_TYPE_HW_WRAPPED = 1 << 1,
+};
+
+/*
+ * Currently the maximum standard key size is 64 bytes, as that is the key size
+ * of BLK_ENCRYPTION_MODE_AES_256_XTS which takes the longest key.
+ *
+ * The maximum hardware-wrapped key size depends on the hardware's key wrapping
+ * algorithm, which is a hardware implementation detail, so it isn't precisely
+ * specified.  But currently 128 bytes is plenty in practice.  Implementations
+ * are recommended to wrap a 32-byte key for the hardware KDF with AES-256-GCM,
+ * which should result in a size closer to 64 bytes than 128.
+ *
+ * Both of these values can trivially be increased if ever needed.
+ */
+#define BLK_CRYPTO_MAX_STANDARD_KEY_SIZE	64
+#define BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE	128
+
+/* This should use max(), but max() doesn't work in a struct definition. */
+#define BLK_CRYPTO_MAX_ANY_KEY_SIZE \
+	(BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE > \
+	 BLK_CRYPTO_MAX_STANDARD_KEY_SIZE ? \
+	 BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE : BLK_CRYPTO_MAX_STANDARD_KEY_SIZE)
+
+/*
+ * Size of the "software secret" which can be derived from a hardware-wrapped
+ * key.  This is currently always 32 bytes.  Note, the choice of 32 bytes
+ * assumes that the software secret is only used directly for algorithms that
+ * don't require more than a 256-bit key to get the desired security strength.
+ * If it were to be used e.g. directly as an AES-256-XTS key, then this would
+ * need to be increased (which is possible if hardware supports it, but care
+ * would need to be taken to avoid breaking users who need exactly 32 bytes).
+ */
+#define BLK_CRYPTO_SW_SECRET_SIZE	32
+
 /**
  * struct blk_crypto_config - an inline encryption key's crypto configuration
  * @crypto_mode: encryption algorithm this key is for
@@ -26,20 +78,23 @@
  *	ciphertext.  This is always a power of 2.  It might be e.g. the
  *	filesystem block size or the disk sector size.
  * @dun_bytes: the maximum number of bytes of DUN used when using this key
+ * @key_type: the type of this key -- either standard or hardware-wrapped
  */
 struct blk_crypto_config {
 	enum blk_crypto_mode_num crypto_mode;
 	unsigned int data_unit_size;
 	unsigned int dun_bytes;
+	enum blk_crypto_key_type key_type;
 };
 
 /**
  * struct blk_crypto_key - an inline encryption key
- * @crypto_cfg: the crypto configuration (like crypto_mode, key size) for this
- *		key
+ * @crypto_cfg: the crypto mode, data unit size, key type, and other
+ *		characteristics of this key and how it will be used
  * @data_unit_size_bits: log2 of data_unit_size
- * @size: size of this key in bytes (determined by @crypto_cfg.crypto_mode)
- * @raw: the raw bytes of this key.  Only the first @size bytes are used.
+ * @size: size of this key in bytes.  The size of a standard key is fixed for a
+ *	  given crypto mode, but the size of a hardware-wrapped key can vary.
+ * @raw: the bytes of this key.  Only the first @size bytes are significant.
  *
  * A blk_crypto_key is immutable once created, and many bios can reference it at
  * the same time.  It must not be freed until all bios using it have completed
@@ -49,7 +104,7 @@
 	struct blk_crypto_config crypto_cfg;
 	unsigned int data_unit_size_bits;
 	unsigned int size;
-	u8 raw[BLK_CRYPTO_MAX_KEY_SIZE];
+	u8 raw[BLK_CRYPTO_MAX_ANY_KEY_SIZE];
 };
 
 #define BLK_CRYPTO_MAX_IV_SIZE		32
@@ -87,7 +142,9 @@
 				 unsigned int bytes,
 				 const u64 next_dun[BLK_CRYPTO_DUN_ARRAY_SIZE]);
 
-int blk_crypto_init_key(struct blk_crypto_key *blk_key, const u8 *raw_key,
+int blk_crypto_init_key(struct blk_crypto_key *blk_key,
+			const u8 *raw_key, size_t raw_key_size,
+			enum blk_crypto_key_type key_type,
 			enum blk_crypto_mode_num crypto_mode,
 			unsigned int dun_bytes,
 			unsigned int data_unit_size);
@@ -103,6 +160,13 @@
 bool blk_crypto_config_supported(struct block_device *bdev,
 				 const struct blk_crypto_config *cfg);
 
+int blk_crypto_derive_sw_secret(struct block_device *bdev,
+				const u8 *eph_key, size_t eph_key_size,
+				u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE]);
+
+bool blk_crypto_hw_wrapped_keys_compatible(struct block_device *bdev1,
+					   struct block_device *bdev2);
+
 #else /* CONFIG_BLK_INLINE_ENCRYPTION */
 
 static inline bool bio_has_crypt_ctx(struct bio *bio)
--- linux-qcom-6.8.0.orig/include/linux/blk-integrity.h
+++ linux-qcom-6.8.0/include/linux/blk-integrity.h
@@ -105,14 +105,13 @@
 }
 
 /*
- * Return the first bvec that contains integrity data.  Only drivers that are
- * limited to a single integrity segment should use this helper.
+ * Return the current bvec that contains the integrity data. bip_iter may be
+ * advanced to iterate over the integrity data.
  */
-static inline struct bio_vec *rq_integrity_vec(struct request *rq)
+static inline struct bio_vec rq_integrity_vec(struct request *rq)
 {
-	if (WARN_ON_ONCE(queue_max_integrity_segments(rq->q) > 1))
-		return NULL;
-	return rq->bio->bi_integrity->bip_vec;
+	return mp_bvec_iter_bvec(rq->bio->bi_integrity->bip_vec,
+				 rq->bio->bi_integrity->bip_iter);
 }
 #else /* CONFIG_BLK_DEV_INTEGRITY */
 static inline int blk_rq_count_integrity_sg(struct request_queue *q,
@@ -176,9 +175,10 @@
 	return 0;
 }
 
-static inline struct bio_vec *rq_integrity_vec(struct request *rq)
+static inline struct bio_vec rq_integrity_vec(struct request *rq)
 {
-	return NULL;
+	/* the optimizer will remove all calls to this function */
+	return (struct bio_vec){ };
 }
 #endif /* CONFIG_BLK_DEV_INTEGRITY */
 #endif /* _LINUX_BLK_INTEGRITY_H */
--- linux-qcom-6.8.0.orig/include/linux/blk-mq.h
+++ linux-qcom-6.8.0/include/linux/blk-mq.h
@@ -895,6 +895,8 @@
 void blk_mq_freeze_queue_wait(struct request_queue *q);
 int blk_mq_freeze_queue_wait_timeout(struct request_queue *q,
 				     unsigned long timeout);
+void blk_mq_unfreeze_queue_non_owner(struct request_queue *q);
+void blk_freeze_queue_start_non_owner(struct request_queue *q);
 
 void blk_mq_map_queues(struct blk_mq_queue_map *qmap);
 void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues);
--- linux-qcom-6.8.0.orig/include/linux/blkdev.h
+++ linux-qcom-6.8.0/include/linux/blkdev.h
@@ -24,6 +24,7 @@
 #include <linux/sbitmap.h>
 #include <linux/uuid.h>
 #include <linux/xarray.h>
+#include <linux/lockdep.h>
 
 struct module;
 struct request_queue;
@@ -126,6 +127,8 @@
 #define BLK_OPEN_WRITE_IOCTL	((__force blk_mode_t)(1 << 4))
 /* open is exclusive wrt all other BLK_OPEN_WRITE opens to the device */
 #define BLK_OPEN_RESTRICT_WRITES	((__force blk_mode_t)(1 << 5))
+/* return partition scanning errors */
+#define BLK_OPEN_STRICT_SCAN	((__force blk_mode_t)(1 << 6))
 
 struct gendisk {
 	/*
@@ -231,6 +234,19 @@
 	return atomic_read(&disk->part0->bd_openers);
 }
 
+/**
+ * disk_has_partscan - return %true if partition scanning is enabled on a disk
+ * @disk: disk to check
+ *
+ * Returns %true if partitions scanning is enabled for @disk, or %false if
+ * partition scanning is disabled either permanently or temporarily.
+ */
+static inline bool disk_has_partscan(struct gendisk *disk)
+{
+	return !(disk->flags & (GENHD_FL_NO_PART | GENHD_FL_HIDDEN)) &&
+		!test_bit(GD_SUPPRESS_PART_SCAN, &disk->state);
+}
+
 /*
  * The gendisk is refcounted by the part0 block_device, and the bd_device
  * therein is also used for device model presentation in sysfs.
@@ -386,6 +402,11 @@
 	struct xarray		hctx_table;
 
 	struct percpu_ref	q_usage_counter;
+	struct lock_class_key	io_lock_cls_key;
+	struct lockdep_map	io_lockdep_map;
+
+	struct lock_class_key	q_lock_cls_key;
+	struct lockdep_map	q_lockdep_map;
 
 	struct request		*last_merge;
 
@@ -488,6 +509,10 @@
 	struct throtl_data *td;
 #endif
 	struct rcu_head		rcu_head;
+#ifdef CONFIG_LOCKDEP
+	struct task_struct	*mq_freeze_owner;
+	int			mq_freeze_owner_depth;
+#endif
 	wait_queue_head_t	mq_freeze_wq;
 	/*
 	 * Protect concurrent access to q_usage_counter by
@@ -1155,7 +1180,7 @@
 	return q->limits.io_min;
 }
 
-static inline int bdev_io_min(struct block_device *bdev)
+static inline unsigned int bdev_io_min(struct block_device *bdev)
 {
 	return queue_io_min(bdev_get_queue(bdev));
 }
--- linux-qcom-6.8.0.orig/include/linux/bootconfig.h
+++ linux-qcom-6.8.0/include/linux/bootconfig.h
@@ -10,6 +10,7 @@
 #ifdef __KERNEL__
 #include <linux/kernel.h>
 #include <linux/types.h>
+bool __init cmdline_has_extra_options(void);
 #else /* !__KERNEL__ */
 /*
  * NOTE: This is only for tools/bootconfig, because tools/bootconfig will
@@ -287,7 +288,12 @@
 int __init xbc_get_info(int *node_size, size_t *data_size);
 
 /* XBC cleanup data structures */
-void __init xbc_exit(void);
+void __init _xbc_exit(bool early);
+
+static inline void xbc_exit(void)
+{
+	_xbc_exit(false);
+}
 
 /* XBC embedded bootconfig data in kernel */
 #ifdef CONFIG_BOOT_CONFIG_EMBED
--- linux-qcom-6.8.0.orig/include/linux/bpf-cgroup.h
+++ linux-qcom-6.8.0/include/linux/bpf-cgroup.h
@@ -389,14 +389,6 @@
 	__ret;								       \
 })
 
-#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen)			       \
-({									       \
-	int __ret = 0;							       \
-	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT))			       \
-		copy_from_sockptr(&__ret, optlen, sizeof(int));		       \
-	__ret;								       \
-})
-
 #define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, optlen,   \
 				       max_optlen, retval)		       \
 ({									       \
@@ -517,7 +509,6 @@
 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
 #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; })
 #define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; })
-#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) ({ 0; })
 #define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, \
 				       optlen, max_optlen, retval) ({ retval; })
 #define BPF_CGROUP_RUN_PROG_GETSOCKOPT_KERN(sock, level, optname, optval, \
--- linux-qcom-6.8.0.orig/include/linux/bpf.h
+++ linux-qcom-6.8.0/include/linux/bpf.h
@@ -290,6 +290,7 @@
 	 * same prog type, JITed flag and xdp_has_frags flag.
 	 */
 	struct {
+		const struct btf_type *attach_func_proto;
 		spinlock_t lock;
 		enum bpf_prog_type type;
 		bool jited;
@@ -622,6 +623,7 @@
 	 */
 	PTR_UNTRUSTED		= BIT(6 + BPF_BASE_TYPE_BITS),
 
+	/* MEM can be uninitialized. */
 	MEM_UNINIT		= BIT(7 + BPF_BASE_TYPE_BITS),
 
 	/* DYNPTR points to memory local to the bpf program. */
@@ -682,6 +684,18 @@
 	/* DYNPTR points to xdp_buff */
 	DYNPTR_TYPE_XDP		= BIT(16 + BPF_BASE_TYPE_BITS),
 
+	/* Memory must be aligned on some architectures, used in combination with
+	 * MEM_FIXED_SIZE.
+	 */
+	MEM_ALIGNED		= BIT(17 + BPF_BASE_TYPE_BITS),
+
+	/* MEM is being written to, often combined with MEM_UNINIT. Non-presence
+	 * of MEM_WRITE means that MEM is only being read. MEM_WRITE without the
+	 * MEM_UNINIT means that memory needs to be initialized since it is also
+	 * read.
+	 */
+	MEM_WRITE		= BIT(18 + BPF_BASE_TYPE_BITS),
+
 	__BPF_TYPE_FLAG_MAX,
 	__BPF_TYPE_LAST_FLAG	= __BPF_TYPE_FLAG_MAX - 1,
 };
@@ -718,8 +732,6 @@
 	ARG_ANYTHING,		/* any (initialized) argument is ok */
 	ARG_PTR_TO_SPIN_LOCK,	/* pointer to bpf_spin_lock */
 	ARG_PTR_TO_SOCK_COMMON,	/* pointer to sock_common */
-	ARG_PTR_TO_INT,		/* pointer to int */
-	ARG_PTR_TO_LONG,	/* pointer to long */
 	ARG_PTR_TO_SOCKET,	/* pointer to bpf_sock (fullsock) */
 	ARG_PTR_TO_BTF_ID,	/* pointer to in-kernel struct */
 	ARG_PTR_TO_RINGBUF_MEM,	/* pointer to dynamically reserved ringbuf memory */
@@ -741,10 +753,10 @@
 	ARG_PTR_TO_SOCKET_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_SOCKET,
 	ARG_PTR_TO_STACK_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_STACK,
 	ARG_PTR_TO_BTF_ID_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_BTF_ID,
-	/* pointer to memory does not need to be initialized, helper function must fill
-	 * all bytes or clear them in error case.
+	/* Pointer to memory does not need to be initialized, since helper function
+	 * fills all bytes or clears them in error case.
 	 */
-	ARG_PTR_TO_UNINIT_MEM		= MEM_UNINIT | ARG_PTR_TO_MEM,
+	ARG_PTR_TO_UNINIT_MEM		= MEM_UNINIT | MEM_WRITE | ARG_PTR_TO_MEM,
 	/* Pointer to valid memory of size known at compile time. */
 	ARG_PTR_TO_FIXED_SIZE_MEM	= MEM_FIXED_SIZE | ARG_PTR_TO_MEM,
 
@@ -905,6 +917,7 @@
  */
 struct bpf_insn_access_aux {
 	enum bpf_reg_type reg_type;
+	bool is_ldsx;
 	union {
 		int ctx_field_size;
 		struct {
@@ -913,6 +926,7 @@
 		};
 	};
 	struct bpf_verifier_log *log; /* for verbose logs */
+	bool is_retval; /* is accessing function return value ? */
 };
 
 static inline void
@@ -1265,8 +1279,12 @@
 void *__bpf_dynptr_data_rw(const struct bpf_dynptr_kern *ptr, u32 len);
 
 #ifdef CONFIG_BPF_JIT
-int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);
-int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);
+int bpf_trampoline_link_prog(struct bpf_tramp_link *link,
+			     struct bpf_trampoline *tr,
+			     struct bpf_prog *tgt_prog);
+int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
+			       struct bpf_trampoline *tr,
+			       struct bpf_prog *tgt_prog);
 struct bpf_trampoline *bpf_trampoline_get(u64 key,
 					  struct bpf_attach_target_info *tgt_info);
 void bpf_trampoline_put(struct bpf_trampoline *tr);
@@ -1347,12 +1365,14 @@
 bool bpf_prog_has_trampoline(const struct bpf_prog *prog);
 #else
 static inline int bpf_trampoline_link_prog(struct bpf_tramp_link *link,
-					   struct bpf_trampoline *tr)
+					   struct bpf_trampoline *tr,
+					   struct bpf_prog *tgt_prog)
 {
 	return -ENOTSUPP;
 }
 static inline int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
-					     struct bpf_trampoline *tr)
+					     struct bpf_trampoline *tr,
+					     struct bpf_prog *tgt_prog)
 {
 	return -ENOTSUPP;
 }
@@ -1456,6 +1476,9 @@
 	bool xdp_has_frags;
 	bool exception_cb;
 	bool exception_boundary;
+	bool is_extended; /* true if extended by freplace program */
+	u64 prog_array_member_cnt; /* counts how many times as member of prog_array */
+	struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cnt */
 	/* BTF_KIND_FUNC_PROTO for valid attach_btf_id */
 	const struct btf_type *attach_func_proto;
 	/* function name for valid attach_btf_id */
@@ -1568,12 +1591,26 @@
 	enum bpf_link_type type;
 	const struct bpf_link_ops *ops;
 	struct bpf_prog *prog;
-	struct work_struct work;
+	/* rcu is used before freeing, work can be used to schedule that
+	 * RCU-based freeing before that, so they never overlap
+	 */
+	union {
+		struct rcu_head rcu;
+		struct work_struct work;
+	};
 };
 
 struct bpf_link_ops {
 	void (*release)(struct bpf_link *link);
+	/* deallocate link resources callback, called without RCU grace period
+	 * waiting
+	 */
 	void (*dealloc)(struct bpf_link *link);
+	/* deallocate link resources callback, called after RCU grace period;
+	 * if underlying BPF program is sleepable we go through tasks trace
+	 * RCU GP and then "classic" RCU GP
+	 */
+	void (*dealloc_deferred)(struct bpf_link *link);
 	int (*detach)(struct bpf_link *link);
 	int (*update_prog)(struct bpf_link *link, struct bpf_prog *new_prog,
 			   struct bpf_prog *old_prog);
@@ -2006,26 +2043,25 @@
  * rcu-protected dynamically sized maps.
  */
 static __always_inline u32
-bpf_prog_run_array_uprobe(const struct bpf_prog_array __rcu *array_rcu,
+bpf_prog_run_array_uprobe(const struct bpf_prog_array *array,
 			  const void *ctx, bpf_prog_run_fn run_prog)
 {
 	const struct bpf_prog_array_item *item;
 	const struct bpf_prog *prog;
-	const struct bpf_prog_array *array;
 	struct bpf_run_ctx *old_run_ctx;
 	struct bpf_trace_run_ctx run_ctx;
 	u32 ret = 1;
 
 	might_fault();
+	RCU_LOCKDEP_WARN(!rcu_read_lock_trace_held(), "no rcu lock held");
+
+	if (unlikely(!array))
+		return ret;
 
-	rcu_read_lock_trace();
 	migrate_disable();
 
 	run_ctx.is_uprobe = true;
 
-	array = rcu_dereference_check(array_rcu, rcu_read_lock_trace_held());
-	if (unlikely(!array))
-		goto out;
 	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
 	item = &array->items[0];
 	while ((prog = READ_ONCE(item->prog))) {
@@ -2040,9 +2076,7 @@
 			rcu_read_unlock();
 	}
 	bpf_reset_run_ctx(old_run_ctx);
-out:
 	migrate_enable();
-	rcu_read_unlock_trace();
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/include/linux/bpf_lsm.h
+++ linux-qcom-6.8.0/include/linux/bpf_lsm.h
@@ -9,6 +9,7 @@
 
 #include <linux/sched.h>
 #include <linux/bpf.h>
+#include <linux/bpf_verifier.h>
 #include <linux/lsm_hooks.h>
 
 #ifdef CONFIG_BPF_LSM
@@ -45,6 +46,8 @@
 
 void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func);
 
+int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
+			     struct bpf_retval_range *range);
 #else /* !CONFIG_BPF_LSM */
 
 static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id)
@@ -78,6 +81,11 @@
 {
 }
 
+static inline int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
+					   struct bpf_retval_range *range)
+{
+	return -EOPNOTSUPP;
+}
 #endif /* CONFIG_BPF_LSM */
 
 #endif /* _LINUX_BPF_LSM_H */
--- linux-qcom-6.8.0.orig/include/linux/bpf_mem_alloc.h
+++ linux-qcom-6.8.0/include/linux/bpf_mem_alloc.h
@@ -33,6 +33,9 @@
 int bpf_mem_alloc_percpu_unit_init(struct bpf_mem_alloc *ma, int size);
 void bpf_mem_alloc_destroy(struct bpf_mem_alloc *ma);
 
+/* Check the allocation size for kmalloc equivalent allocator */
+int bpf_mem_alloc_check_size(bool percpu, size_t size);
+
 /* kmalloc/kfree equivalent: */
 void *bpf_mem_alloc(struct bpf_mem_alloc *ma, size_t size);
 void bpf_mem_free(struct bpf_mem_alloc *ma, void *ptr);
--- linux-qcom-6.8.0.orig/include/linux/bpf_verifier.h
+++ linux-qcom-6.8.0/include/linux/bpf_verifier.h
@@ -732,6 +732,8 @@
 	/* Same as scratched_regs but for stack slots */
 	u64 scratched_stack_slots;
 	u64 prev_log_pos, prev_insn_print_pos;
+	/* buffer used to temporary hold constants as scalar registers */
+	struct bpf_reg_state fake_reg[2];
 	/* buffer used to generate temporary string representations,
 	 * e.g., in reg_type_str() to generate reg_type string
 	 */
@@ -830,8 +832,8 @@
 /* only use after check_attach_btf_id() */
 static inline enum bpf_prog_type resolve_prog_type(const struct bpf_prog *prog)
 {
-	return prog->type == BPF_PROG_TYPE_EXT ?
-		prog->aux->dst_prog->type : prog->type;
+	return (prog->type == BPF_PROG_TYPE_EXT && prog->aux->saved_dst_prog_type) ?
+		prog->aux->saved_dst_prog_type : prog->type;
 }
 
 static inline bool bpf_prog_check_recur(const struct bpf_prog *prog)
--- linux-qcom-6.8.0.orig/include/linux/call_once.h
+++ linux-qcom-6.8.0/include/linux/call_once.h
@@ -0,0 +1,66 @@
+#ifndef _LINUX_CALL_ONCE_H
+#define _LINUX_CALL_ONCE_H
+
+#include <linux/types.h>
+#include <linux/mutex.h>
+
+#define ONCE_NOT_STARTED 0
+#define ONCE_RUNNING     1
+#define ONCE_COMPLETED   2
+
+struct once {
+        atomic_t state;
+        struct mutex lock;
+};
+
+static inline void __once_init(struct once *once, const char *name,
+			       struct lock_class_key *key)
+{
+        atomic_set(&once->state, ONCE_NOT_STARTED);
+        __mutex_init(&once->lock, name, key);
+}
+
+#define once_init(once)							\
+do {									\
+	static struct lock_class_key __key;				\
+	__once_init((once), #once, &__key);				\
+} while (0)
+
+/*
+ * call_once - Ensure a function has been called exactly once
+ *
+ * @once: Tracking struct
+ * @cb: Function to be called
+ *
+ * If @once has never completed successfully before, call @cb and, if
+ * it returns a zero or positive value, mark @once as completed.  Return
+ * the value returned by @cb
+ *
+ * If @once has completed succesfully before, return 0.
+ *
+ * The call to @cb is implicitly surrounded by a mutex, though for
+ * efficiency the * function avoids taking it after the first call.
+ */
+static inline int call_once(struct once *once, int (*cb)(struct once *))
+{
+	int r, state;
+
+	/* Pairs with atomic_set_release() below.  */
+	if (atomic_read_acquire(&once->state) == ONCE_COMPLETED)
+		return 0;
+
+	guard(mutex)(&once->lock);
+	state = atomic_read(&once->state);
+	if (unlikely(state != ONCE_NOT_STARTED))
+		return WARN_ON_ONCE(state != ONCE_COMPLETED) ? -EINVAL : 0;
+
+	atomic_set(&once->state, ONCE_RUNNING);
+	r = cb(once);
+	if (r < 0)
+		atomic_set(&once->state, ONCE_NOT_STARTED);
+	else
+		atomic_set_release(&once->state, ONCE_COMPLETED);
+	return r;
+}
+
+#endif /* _LINUX_CALL_ONCE_H */
--- linux-qcom-6.8.0.orig/include/linux/cdrom.h
+++ linux-qcom-6.8.0/include/linux/cdrom.h
@@ -77,7 +77,7 @@
 				      unsigned int clearing, int slot);
 	int (*tray_move) (struct cdrom_device_info *, int);
 	int (*lock_door) (struct cdrom_device_info *, int);
-	int (*select_speed) (struct cdrom_device_info *, int);
+	int (*select_speed) (struct cdrom_device_info *, unsigned long);
 	int (*get_last_session) (struct cdrom_device_info *,
 				 struct cdrom_multisession *);
 	int (*get_mcn) (struct cdrom_device_info *,
--- linux-qcom-6.8.0.orig/include/linux/cleanup.h
+++ linux-qcom-6.8.0/include/linux/cleanup.h
@@ -146,14 +146,20 @@
  *      similar to scoped_guard(), except it does fail when the lock
  *      acquire fails.
  *
+ *      Only for conditional locks.
  */
 
+#define __DEFINE_CLASS_IS_CONDITIONAL(_name, _is_cond)	\
+static __maybe_unused const bool class_##_name##_is_conditional = _is_cond
+
 #define DEFINE_GUARD(_name, _type, _lock, _unlock) \
+	__DEFINE_CLASS_IS_CONDITIONAL(_name, false); \
 	DEFINE_CLASS(_name, _type, if (_T) { _unlock; }, ({ _lock; _T; }), _type _T); \
 	static inline void * class_##_name##_lock_ptr(class_##_name##_t *_T) \
-	{ return *_T; }
+	{ return (void *)(__force unsigned long)*_T; }
 
 #define DEFINE_GUARD_COND(_name, _ext, _condlock) \
+	__DEFINE_CLASS_IS_CONDITIONAL(_name##_ext, true); \
 	EXTEND_CLASS(_name, _ext, \
 		     ({ void *_t = _T; if (_T && !(_condlock)) _t = NULL; _t; }), \
 		     class_##_name##_t _T) \
@@ -164,17 +170,40 @@
 	CLASS(_name, __UNIQUE_ID(guard))
 
 #define __guard_ptr(_name) class_##_name##_lock_ptr
+#define __is_cond_ptr(_name) class_##_name##_is_conditional
 
-#define scoped_guard(_name, args...)					\
-	for (CLASS(_name, scope)(args),					\
-	     *done = NULL; __guard_ptr(_name)(&scope) && !done; done = (void *)1)
-
-#define scoped_cond_guard(_name, _fail, args...) \
-	for (CLASS(_name, scope)(args), \
-	     *done = NULL; !done; done = (void *)1) \
-		if (!__guard_ptr(_name)(&scope)) _fail; \
-		else
+/*
+ * Helper macro for scoped_guard().
+ *
+ * Note that the "!__is_cond_ptr(_name)" part of the condition ensures that
+ * compiler would be sure that for the unconditional locks the body of the
+ * loop (caller-provided code glued to the else clause) could not be skipped.
+ * It is needed because the other part - "__guard_ptr(_name)(&scope)" - is too
+ * hard to deduce (even if could be proven true for unconditional locks).
+ */
+#define __scoped_guard(_name, _label, args...)				\
+	for (CLASS(_name, scope)(args);					\
+	     __guard_ptr(_name)(&scope) || !__is_cond_ptr(_name);	\
+	     ({ goto _label; }))					\
+		if (0) {						\
+_label:									\
+			break;						\
+		} else
+
+#define scoped_guard(_name, args...)	\
+	__scoped_guard(_name, __UNIQUE_ID(label), args)
+
+#define __scoped_cond_guard(_name, _fail, _label, args...)		\
+	for (CLASS(_name, scope)(args); true; ({ goto _label; }))	\
+		if (!__guard_ptr(_name)(&scope)) {			\
+			BUILD_BUG_ON(!__is_cond_ptr(_name));		\
+			_fail;						\
+_label:									\
+			break;						\
+		} else
 
+#define scoped_cond_guard(_name, _fail, args...)	\
+	__scoped_cond_guard(_name, _fail, __UNIQUE_ID(label), args)
 /*
  * Additional helper macros for generating lock guards with types, either for
  * locks that don't have a native type (eg. RCU, preempt) or those that need a
@@ -208,7 +237,7 @@
 									\
 static inline void *class_##_name##_lock_ptr(class_##_name##_t *_T)	\
 {									\
-	return _T->lock;						\
+	return (void *)(__force unsigned long)_T->lock;			\
 }
 
 
@@ -230,14 +259,17 @@
 }
 
 #define DEFINE_LOCK_GUARD_1(_name, _type, _lock, _unlock, ...)		\
+__DEFINE_CLASS_IS_CONDITIONAL(_name, false);				\
 __DEFINE_UNLOCK_GUARD(_name, _type, _unlock, __VA_ARGS__)		\
 __DEFINE_LOCK_GUARD_1(_name, _type, _lock)
 
 #define DEFINE_LOCK_GUARD_0(_name, _lock, _unlock, ...)			\
+__DEFINE_CLASS_IS_CONDITIONAL(_name, false);				\
 __DEFINE_UNLOCK_GUARD(_name, void, _unlock, __VA_ARGS__)		\
 __DEFINE_LOCK_GUARD_0(_name, _lock)
 
 #define DEFINE_LOCK_GUARD_1_COND(_name, _ext, _condlock)		\
+	__DEFINE_CLASS_IS_CONDITIONAL(_name##_ext, true);		\
 	EXTEND_CLASS(_name, _ext,					\
 		     ({ class_##_name##_t _t = { .lock = l }, *_T = &_t;\
 		        if (_T->lock && !(_condlock)) _T->lock = NULL;	\
--- linux-qcom-6.8.0.orig/include/linux/clk.h
+++ linux-qcom-6.8.0/include/linux/clk.h
@@ -202,6 +202,18 @@
 int clk_rate_exclusive_get(struct clk *clk);
 
 /**
+ * devm_clk_rate_exclusive_get - devm variant of clk_rate_exclusive_get
+ * @dev: device the exclusivity is bound to
+ * @clk: clock source
+ *
+ * Calls clk_rate_exclusive_get() on @clk and registers a devm cleanup handler
+ * on @dev to call clk_rate_exclusive_put().
+ *
+ * Must not be called from within atomic context.
+ */
+int devm_clk_rate_exclusive_get(struct device *dev, struct clk *clk);
+
+/**
  * clk_rate_exclusive_put - release exclusivity over the rate control of a
  *                          producer
  * @clk: clock source
@@ -273,6 +285,11 @@
 {
 	return 0;
 }
+
+static inline int devm_clk_rate_exclusive_get(struct device *dev, struct clk *clk)
+{
+	return 0;
+}
 
 static inline void clk_rate_exclusive_put(struct clk *clk) {}
 
--- linux-qcom-6.8.0.orig/include/linux/clocksource.h
+++ linux-qcom-6.8.0/include/linux/clocksource.h
@@ -291,7 +291,19 @@
 #define TIMER_ACPI_DECLARE(name, table_id, fn)		\
 	ACPI_DECLARE_PROBE_ENTRY(timer, name, table_id, 0, NULL, 0, fn)
 
-extern ulong max_cswd_read_retries;
+static inline unsigned int clocksource_get_max_watchdog_retry(void)
+{
+	/*
+	 * When system is in the boot phase or under heavy workload, there
+	 * can be random big latencies during the clocksource/watchdog
+	 * read, so allow retries to filter the noise latency. As the
+	 * latency's frequency and maximum value goes up with the number of
+	 * CPUs, scale the number of retries with the number of online
+	 * CPUs.
+	 */
+	return (ilog2(num_online_cpus()) / 2) + 1;
+}
+
 void clocksource_verify_percpu(struct clocksource *cs);
 
 #endif /* _LINUX_CLOCKSOURCE_H */
--- linux-qcom-6.8.0.orig/include/linux/compat.h
+++ linux-qcom-6.8.0/include/linux/compat.h
@@ -608,7 +608,7 @@
 asmlinkage long compat_sys_fstatfs64(unsigned int fd, compat_size_t sz,
 				     struct compat_statfs64 __user *buf);
 asmlinkage long compat_sys_truncate(const char __user *, compat_off_t);
-asmlinkage long compat_sys_ftruncate(unsigned int, compat_ulong_t);
+asmlinkage long compat_sys_ftruncate(unsigned int, compat_off_t);
 /* No generic prototype for truncate64, ftruncate64, fallocate */
 asmlinkage long compat_sys_openat(int dfd, const char __user *filename,
 				  int flags, umode_t mode);
--- linux-qcom-6.8.0.orig/include/linux/compiler-gcc.h
+++ linux-qcom-6.8.0/include/linux/compiler-gcc.h
@@ -100,7 +100,11 @@
 #define __noscs __attribute__((__no_sanitize__("shadow-call-stack")))
 #endif
 
+#ifdef __SANITIZE_HWADDRESS__
+#define __no_sanitize_address __attribute__((__no_sanitize__("hwaddress")))
+#else
 #define __no_sanitize_address __attribute__((__no_sanitize_address__))
+#endif
 
 #if defined(__SANITIZE_THREAD__)
 #define __no_sanitize_thread __attribute__((__no_sanitize_thread__))
--- linux-qcom-6.8.0.orig/include/linux/compiler.h
+++ linux-qcom-6.8.0/include/linux/compiler.h
@@ -125,7 +125,7 @@
 #define annotate_unreachable() __annotate_unreachable(__COUNTER__)
 
 /* Annotate a C jump table to allow objtool to follow the code flow */
-#define __annotate_jump_table __section(".rodata..c_jump_table")
+#define __annotate_jump_table __section(".rodata..c_jump_table,\"a\",@progbits #")
 
 #else /* !CONFIG_OBJTOOL */
 #define annotate_unreachable()
@@ -201,28 +201,43 @@
 
 #endif /* __KERNEL__ */
 
+/**
+ * offset_to_ptr - convert a relative memory offset to an absolute pointer
+ * @off:	the address of the 32-bit offset value
+ */
+static inline void *offset_to_ptr(const int *off)
+{
+	return (void *)((unsigned long)off + *off);
+}
+
+#endif /* __ASSEMBLY__ */
+
+#ifdef CONFIG_64BIT
+#define ARCH_SEL(a,b) a
+#else
+#define ARCH_SEL(a,b) b
+#endif
+
 /*
  * Force the compiler to emit 'sym' as a symbol, so that we can reference
  * it from inline assembler. Necessary in case 'sym' could be inlined
  * otherwise, or eliminated entirely due to lack of references that are
  * visible to the compiler.
  */
-#define ___ADDRESSABLE(sym, __attrs) \
-	static void * __used __attrs \
+#define ___ADDRESSABLE(sym, __attrs)						\
+	static void * __used __attrs						\
 		__UNIQUE_ID(__PASTE(__addressable_,sym)) = (void *)&sym;
+
 #define __ADDRESSABLE(sym) \
 	___ADDRESSABLE(sym, __section(".discard.addressable"))
 
-/**
- * offset_to_ptr - convert a relative memory offset to an absolute pointer
- * @off:	the address of the 32-bit offset value
- */
-static inline void *offset_to_ptr(const int *off)
-{
-	return (void *)((unsigned long)off + *off);
-}
+#define __ADDRESSABLE_ASM(sym)						\
+	.pushsection .discard.addressable,"aw";				\
+	.align ARCH_SEL(8,4);						\
+	ARCH_SEL(.quad, .long) __stringify(sym);			\
+	.popsection;
 
-#endif /* __ASSEMBLY__ */
+#define __ADDRESSABLE_ASM_STR(sym) __stringify(__ADDRESSABLE_ASM(sym))
 
 /* &a[0] degrades to a pointer: a different type from an array */
 #define __must_be_array(a)	BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
--- linux-qcom-6.8.0.orig/include/linux/compiler_attributes.h
+++ linux-qcom-6.8.0/include/linux/compiler_attributes.h
@@ -95,19 +95,6 @@
 #endif
 
 /*
- * Optional: only supported since gcc >= 14
- * Optional: only supported since clang >= 18
- *
- *   gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
- * clang: https://reviews.llvm.org/D148381
- */
-#if __has_attribute(__counted_by__)
-# define __counted_by(member)		__attribute__((__counted_by__(member)))
-#else
-# define __counted_by(member)
-#endif
-
-/*
  * Optional: not supported by gcc
  * Optional: only supported since clang >= 14.0
  *
@@ -334,6 +321,18 @@
 #define __section(section)              __attribute__((__section__(section)))
 
 /*
+ * Optional: only supported since gcc >= 12
+ *
+ *   gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-uninitialized-variable-attribute
+ * clang: https://clang.llvm.org/docs/AttributeReference.html#uninitialized
+ */
+#if __has_attribute(__uninitialized__)
+# define __uninitialized		__attribute__((__uninitialized__))
+#else
+# define __uninitialized
+#endif
+
+/*
  *   gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-unused-function-attribute
  *   gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html#index-unused-type-attribute
  *   gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-unused-variable-attribute
--- linux-qcom-6.8.0.orig/include/linux/compiler_types.h
+++ linux-qcom-6.8.0/include/linux/compiler_types.h
@@ -278,10 +278,51 @@
 # define __no_kcsan
 #endif
 
+#ifdef __SANITIZE_MEMORY__
+/*
+ * Similarly to KASAN and KCSAN, KMSAN loses function attributes of inlined
+ * functions, therefore disabling KMSAN checks also requires disabling inlining.
+ *
+ * __no_sanitize_or_inline effectively prevents KMSAN from reporting errors
+ * within the function and marks all its outputs as initialized.
+ */
+# define __no_sanitize_or_inline __no_kmsan_checks notrace __maybe_unused
+#endif
+
 #ifndef __no_sanitize_or_inline
 #define __no_sanitize_or_inline __always_inline
 #endif
 
+/*
+ * Apply __counted_by() when the Endianness matches to increase test coverage.
+ */
+#ifdef __LITTLE_ENDIAN
+#define __counted_by_le(member)	__counted_by(member)
+#define __counted_by_be(member)
+#else
+#define __counted_by_le(member)
+#define __counted_by_be(member)	__counted_by(member)
+#endif
+
+/*
+ * Optional: only supported since gcc >= 15
+ * Optional: only supported since clang >= 18
+ *
+ *   gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
+ * clang: https://github.com/llvm/llvm-project/pull/76348
+ *
+ * __bdos on clang < 19.1.2 can erroneously return 0:
+ * https://github.com/llvm/llvm-project/pull/110497
+ *
+ * __bdos on clang < 19.1.3 can be off by 4:
+ * https://github.com/llvm/llvm-project/pull/112636
+ */
+#ifdef CONFIG_CC_HAS_COUNTED_BY
+# define __counted_by(member)		__attribute__((__counted_by__(member)))
+#else
+# define __counted_by(member)
+#endif
+
 /* Section for code which can't be instrumented at all */
 #define __noinstr_section(section)					\
 	noinline notrace __attribute((__section__(section)))		\
--- linux-qcom-6.8.0.orig/include/linux/coresight.h
+++ linux-qcom-6.8.0/include/linux/coresight.h
@@ -65,6 +65,7 @@
 	CORESIGHT_DEV_SUBTYPE_SOURCE_BUS,
 	CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE,
 	CORESIGHT_DEV_SUBTYPE_SOURCE_TPDM,
+	CORESIGHT_DEV_SUBTYPE_SOURCE_REMOTE_PROC,
 	CORESIGHT_DEV_SUBTYPE_SOURCE_OTHERS,
 };
 
@@ -582,7 +583,7 @@
 
 extern void coresight_disclaim_device(struct coresight_device *csdev);
 extern void coresight_disclaim_device_unlocked(struct coresight_device *csdev);
-extern char *coresight_alloc_device_name(struct coresight_dev_list *devs,
+extern const char *coresight_alloc_device_name(struct coresight_dev_list *devs,
 					 struct device *dev);
 
 extern bool coresight_loses_context_with_cpu(struct device *dev);
@@ -676,6 +677,8 @@
 #endif		/* IS_ENABLED(CONFIG_CORESIGHT) */
 
 extern int coresight_get_cpu(struct device *dev);
+extern int coresight_get_source_traceid(struct device *dev, u32 *id);
+extern const char *coresight_get_device_name(struct device *dev);
 
 struct coresight_platform_data *coresight_get_platform_data(struct device *dev);
 struct coresight_connection *
--- linux-qcom-6.8.0.orig/include/linux/counter.h
+++ linux-qcom-6.8.0/include/linux/counter.h
@@ -359,7 +359,6 @@
  * @num_counts:		number of Counts specified in @counts
  * @ext:		optional array of Counter device extensions
  * @num_ext:		number of Counter device extensions specified in @ext
- * @priv:		optional private data supplied by driver
  * @dev:		internal device structure
  * @chrdev:		internal character device structure
  * @events_list:	list of current watching Counter events
--- linux-qcom-6.8.0.orig/include/linux/cpu.h
+++ linux-qcom-6.8.0/include/linux/cpu.h
@@ -75,6 +75,8 @@
 					     struct device_attribute *attr, char *buf);
 extern ssize_t cpu_show_gds(struct device *dev,
 			    struct device_attribute *attr, char *buf);
+extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev,
+					       struct device_attribute *attr, char *buf);
 
 extern __printf(4, 5)
 struct device *cpu_device_create(struct device *parent, void *drvdata,
@@ -217,7 +219,18 @@
 static inline void cpuhp_report_idle_dead(void) { }
 #endif /* #ifdef CONFIG_HOTPLUG_CPU */
 
+#ifdef CONFIG_CPU_MITIGATIONS
 extern bool cpu_mitigations_off(void);
 extern bool cpu_mitigations_auto_nosmt(void);
+#else
+static inline bool cpu_mitigations_off(void)
+{
+	return true;
+}
+static inline bool cpu_mitigations_auto_nosmt(void)
+{
+	return false;
+}
+#endif
 
 #endif /* _LINUX_CPU_H_ */
--- linux-qcom-6.8.0.orig/include/linux/cpufreq.h
+++ linux-qcom-6.8.0/include/linux/cpufreq.h
@@ -1021,6 +1021,18 @@
 						   efficiencies);
 }
 
+static inline bool cpufreq_is_in_limits(struct cpufreq_policy *policy, int idx)
+{
+	unsigned int freq;
+
+	if (idx < 0)
+		return false;
+
+	freq = policy->freq_table[idx].frequency;
+
+	return freq == clamp_val(freq, policy->min, policy->max);
+}
+
 static inline int cpufreq_frequency_table_target(struct cpufreq_policy *policy,
 						 unsigned int target_freq,
 						 unsigned int relation)
@@ -1054,7 +1066,8 @@
 		return 0;
 	}
 
-	if (idx < 0 && efficiencies) {
+	/* Limit frequency index to honor policy->min/max */
+	if (!cpufreq_is_in_limits(policy, idx) && efficiencies) {
 		efficiencies = false;
 		goto retry;
 	}
@@ -1111,10 +1124,9 @@
 				    const char *cell_name,
 				    struct of_phandle_args *args)
 {
-	struct device_node *cpu_np;
 	int ret;
 
-	cpu_np = of_cpu_device_node_get(cpu);
+	struct device_node *cpu_np __free(device_node) = of_cpu_device_node_get(cpu);
 	if (!cpu_np)
 		return -ENODEV;
 
@@ -1122,9 +1134,6 @@
 					 args);
 	if (ret < 0)
 		return ret;
-
-	of_node_put(cpu_np);
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/include/linux/cpuhotplug.h
+++ linux-qcom-6.8.0/include/linux/cpuhotplug.h
@@ -146,6 +146,7 @@
 	CPUHP_AP_IRQ_MIPS_GIC_STARTING,
 	CPUHP_AP_IRQ_LOONGARCH_STARTING,
 	CPUHP_AP_IRQ_SIFIVE_PLIC_STARTING,
+	CPUHP_AP_IRQ_RISCV_SBI_IPI_STARTING,
 	CPUHP_AP_ARM_MVEBU_COHERENCY,
 	CPUHP_AP_PERF_X86_AMD_UNCORE_STARTING,
 	CPUHP_AP_PERF_X86_STARTING,
--- linux-qcom-6.8.0.orig/include/linux/cpumask.h
+++ linux-qcom-6.8.0/include/linux/cpumask.h
@@ -839,7 +839,7 @@
  */
 static inline unsigned int cpumask_size(void)
 {
-	return BITS_TO_LONGS(large_cpumask_bits) * sizeof(long);
+	return bitmap_size(large_cpumask_bits);
 }
 
 /*
--- linux-qcom-6.8.0.orig/include/linux/cpuset.h
+++ linux-qcom-6.8.0/include/linux/cpuset.h
@@ -70,7 +70,6 @@
 extern void cpuset_init_smp(void);
 extern void cpuset_force_rebuild(void);
 extern void cpuset_update_active_cpus(void);
-extern void cpuset_wait_for_hotplug(void);
 extern void inc_dl_tasks_cs(struct task_struct *task);
 extern void dec_dl_tasks_cs(struct task_struct *task);
 extern void cpuset_lock(void);
@@ -190,8 +189,6 @@
 	partition_sched_domains(1, NULL, NULL);
 }
 
-static inline void cpuset_wait_for_hotplug(void) { }
-
 static inline void inc_dl_tasks_cs(struct task_struct *task) { }
 static inline void dec_dl_tasks_cs(struct task_struct *task) { }
 static inline void cpuset_lock(void) { }
--- linux-qcom-6.8.0.orig/include/linux/dev_printk.h
+++ linux-qcom-6.8.0/include/linux/dev_printk.h
@@ -130,6 +130,16 @@
 	})
 
 /*
+ * Dummy dev_printk for disabled debugging statements to use whilst maintaining
+ * gcc's format checking.
+ */
+#define dev_no_printk(level, dev, fmt, ...)				\
+	({								\
+		if (0)							\
+			_dev_printk(level, dev, fmt, ##__VA_ARGS__);	\
+	})
+
+/*
  * #defines for all the dev_<level> macros to prefix with whatever
  * possible use of #define dev_fmt(fmt) ...
  */
@@ -158,10 +168,7 @@
 	dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__)
 #else
 #define dev_dbg(dev, fmt, ...)						\
-({									\
-	if (0)								\
-		dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__); \
-})
+	dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__)
 #endif
 
 #ifdef CONFIG_PRINTK
@@ -247,20 +254,14 @@
 } while (0)
 #else
 #define dev_dbg_ratelimited(dev, fmt, ...)				\
-do {									\
-	if (0)								\
-		dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__); \
-} while (0)
+	dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__)
 #endif
 
 #ifdef VERBOSE_DEBUG
 #define dev_vdbg	dev_dbg
 #else
 #define dev_vdbg(dev, fmt, ...)						\
-({									\
-	if (0)								\
-		dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__); \
-})
+	dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__)
 #endif
 
 /*
--- linux-qcom-6.8.0.orig/include/linux/device.h
+++ linux-qcom-6.8.0/include/linux/device.h
@@ -1061,6 +1061,9 @@
 			  int (*fn)(struct device *dev, void *data));
 int device_for_each_child_reverse(struct device *dev, void *data,
 				  int (*fn)(struct device *dev, void *data));
+int device_for_each_child_reverse_from(struct device *parent,
+				       struct device *from, const void *data,
+				       int (*fn)(struct device *, const void *));
 struct device *device_find_child(struct device *dev, void *data,
 				 int (*match)(struct device *dev, void *data));
 struct device *device_find_child_by_name(struct device *parent,
@@ -1247,6 +1250,7 @@
 void device_link_remove(void *consumer, struct device *supplier);
 void device_links_supplier_sync_state_pause(void);
 void device_links_supplier_sync_state_resume(void);
+void device_link_wait_removal(void);
 
 /* Create alias, so I can be autoloaded. */
 #define MODULE_ALIAS_CHARDEV(major,minor) \
--- linux-qcom-6.8.0.orig/include/linux/dm-io.h
+++ linux-qcom-6.8.0/include/linux/dm-io.h
@@ -80,7 +80,8 @@
  * error occurred doing io to the corresponding region.
  */
 int dm_io(struct dm_io_request *io_req, unsigned int num_regions,
-	  struct dm_io_region *region, unsigned int long *sync_error_bits);
+	  struct dm_io_region *region, unsigned int long *sync_error_bits,
+	  unsigned short ioprio);
 
 #endif	/* __KERNEL__ */
 #endif	/* _LINUX_DM_IO_H */
--- linux-qcom-6.8.0.orig/include/linux/dma-buf.h
+++ linux-qcom-6.8.0/include/linux/dma-buf.h
@@ -9,6 +9,8 @@
  * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and
  * Daniel Vetter <daniel@ffwll.ch> for their support in creation and
  * refining of this idea.
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #ifndef __DMA_BUF_H__
 #define __DMA_BUF_H__
@@ -230,6 +232,40 @@
 	int (*begin_cpu_access)(struct dma_buf *, enum dma_data_direction);
 
 	/**
+	 * @begin_cpu_access_partial:
+	 *
+	 * This is called from dma_buf_begin_cpu_access_partial() and allows the
+	 * exporter to ensure that the memory specified in the range is
+	 * available for cpu access - the exporter might need to allocate or
+	 * swap-in and pin the backing storage.
+	 * The exporter also needs to ensure that cpu access is
+	 * coherent for the access direction. The direction can be used by the
+	 * exporter to optimize the cache flushing, i.e. access with a different
+	 * direction (read instead of write) might return stale or even bogus
+	 * data (e.g. when the exporter needs to copy the data to temporary
+	 * storage).
+	 *
+	 * This callback is optional.
+	 *
+	 * FIXME: This is both called through the DMA_BUF_IOCTL_SYNC command
+	 * from userspace (where storage shouldn't be pinned to avoid handing
+	 * de-factor mlock rights to userspace) and for the kernel-internal
+	 * users of the various kmap interfaces, where the backing storage must
+	 * be pinned to guarantee that the atomic kmap calls can succeed. Since
+	 * there's no in-kernel users of the kmap interfaces yet this isn't a
+	 * real problem.
+	 *
+	 * Returns:
+	 *
+	 * 0 on success or a negative error code on failure. This can for
+	 * example fail when the backing storage can't be allocated. Can also
+	 * return -ERESTARTSYS or -EINTR when the call has been interrupted and
+	 * needs to be restarted.
+	 */
+	int (*begin_cpu_access_partial)(struct dma_buf *dmabuf,
+			enum dma_data_direction,
+			unsigned int offset, unsigned int len);
+	/**
 	 * @end_cpu_access:
 	 *
 	 * This is called from dma_buf_end_cpu_access() when the importer is
@@ -247,6 +283,27 @@
 	int (*end_cpu_access)(struct dma_buf *, enum dma_data_direction);
 
 	/**
+	 * @end_cpu_access_partial:
+	 *
+	 * This is called from dma_buf_end_cpu_access_partial() when the
+	 * importer is done accessing the CPU. The exporter can use to limit
+	 * cache flushing to only the range specefied and to unpin any
+	 * resources pinned in @begin_cpu_access_umapped.
+	 * The result of any dma_buf kmap calls after end_cpu_access_partial is
+	 * undefined.
+	 *
+	 * This callback is optional.
+	 *
+	 * Returns:
+	 *
+	 * 0 on success or a negative error code on failure. Can return
+	 *-ERESTARTSYS or -EINTR when the call has been interrupted and needs
+	 * to be restarted.
+	 */
+	int (*end_cpu_access_partial)(struct dma_buf *dmabuf,
+			enum dma_data_direction,
+			unsigned int offset, unsigned int len);
+	/**
 	 * @mmap:
 	 *
 	 * This callback is used by the dma_buf_mmap() function
@@ -498,6 +555,8 @@
  * @importer_ops: importer operations for this attachment, if provided
  * dma_buf_map/unmap_attachment() must be called with the dma_resv lock held.
  * @importer_priv: importer specific attachment data.
+ * @dma_map_attrs: DMA attributes to be used when the exporter maps the buffer
+ * through dma_buf_map_attachment.
  *
  * This structure holds the attachment information between the dma_buf buffer
  * and its user device(s). The list contains one attachment struct per device
@@ -518,6 +577,7 @@
 	const struct dma_buf_attach_ops *importer_ops;
 	void *importer_priv;
 	void *priv;
+	unsigned long dma_map_attrs;
 };
 
 /**
@@ -619,8 +679,14 @@
 void dma_buf_move_notify(struct dma_buf *dma_buf);
 int dma_buf_begin_cpu_access(struct dma_buf *dma_buf,
 			     enum dma_data_direction dir);
+int dma_buf_begin_cpu_access_partial(struct dma_buf *dma_buf,
+		enum dma_data_direction dir,
+		unsigned int offset, unsigned int len);
 int dma_buf_end_cpu_access(struct dma_buf *dma_buf,
 			   enum dma_data_direction dir);
+int dma_buf_end_cpu_access_partial(struct dma_buf *dma_buf,
+		enum dma_data_direction dir,
+		unsigned int offset, unsigned int len);
 struct sg_table *
 dma_buf_map_attachment_unlocked(struct dma_buf_attachment *attach,
 				enum dma_data_direction direction);
--- linux-qcom-6.8.0.orig/include/linux/dma-heap.h
+++ linux-qcom-6.8.0/include/linux/dma-heap.h
@@ -4,6 +4,8 @@
  *
  * Copyright (C) 2011 Google, Inc.
  * Copyright (C) 2019 Linaro Ltd.
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef _DMA_HEAPS_H
@@ -12,6 +14,7 @@
 #include <linux/cdev.h>
 #include <linux/types.h>
 
+struct cma;
 struct dma_heap;
 
 /**
@@ -23,8 +26,8 @@
 struct dma_heap_ops {
 	struct dma_buf *(*allocate)(struct dma_heap *heap,
 				    unsigned long len,
-				    unsigned long fd_flags,
-				    unsigned long heap_flags);
+				    u32 fd_flags,
+				    u64 heap_flags);
 };
 
 /**
@@ -51,6 +54,15 @@
 void *dma_heap_get_drvdata(struct dma_heap *heap);
 
 /**
+ * dma_heap_get_dev() - get device struct for the heap
+ * @heap: DMA-Heap to retrieve device struct from
+ *
+ * Returns:
+ * The device struct for the heap.
+ */
+struct device *dma_heap_get_dev(struct dma_heap *heap);
+
+/**
  * dma_heap_get_name() - get heap name
  * @heap: DMA-Heap to retrieve private data for
  *
@@ -65,4 +77,44 @@
  */
 struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info);
 
+/**
+ * dma_heap_find - get the heap registered with the specified name
+ * @name: Name of the DMA-Heap to find
+ *
+ * Returns:
+ * The DMA-Heap with the provided name.
+ *
+ * NOTE: DMA-Heaps returned from this function MUST be released using
+ * dma_heap_put() when the user is done to enable the heap to be unloaded.
+ */
+struct dma_heap *dma_heap_find(const char *name);
+
+/**
+ * dma_heap_put - drops a reference to a dmabuf heap, potentially freeing it
+ * @heap: the heap whose reference count to decrement
+ */
+void dma_heap_put(struct dma_heap *heap);
+
+/**
+ * dma_heap_buffer_alloc - Allocate dma-buf from a dma_heap
+ * @heap:	DMA-Heap to allocate from
+ * @len:	size to allocate in bytes
+ * @fd_flags:	flags to set on returned dma-buf fd
+ * @heap_flags: flags to pass to the dma heap
+ *
+ * This is for internal dma-buf allocations only. Free returned buffers with dma_buf_put().
+ */
+struct dma_buf *dma_heap_buffer_alloc(struct dma_heap *heap, size_t len,
+				      unsigned int fd_flags,
+				      unsigned int heap_flags);
+
+#ifdef CONFIG_DMABUF_HEAPS_CMA
+int cma_heap_add(struct cma *cma, void *data);
+#else
+static inline int cma_heap_add(struct cma *cma, void *data)
+{
+	return -EINVAL;
+}
+#endif /* CONFIG_DMABUF_HEAPS_CMA */
+
 #endif /* _DMA_HEAPS_H */
--- linux-qcom-6.8.0.orig/include/linux/dma/qcom-gpi-dma.h
+++ linux-qcom-6.8.0/include/linux/dma/qcom-gpi-dma.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (c) 2020, Linaro Limited
+ * Copyright (c) 2023-24 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef QCOM_GPI_DMA_H
@@ -15,6 +16,11 @@
 	SPI_DUPLEX,
 };
 
+#define QCOM_GPI_BLOCK_EVENT_IRQ	BIT(0)
+#define QCOM_GPI_IMMEDIATE_DMA		BIT(1)
+
+#define QCOM_GPI_IMMEDIATE_DMA_LEN	8
+
 /**
  * struct gpi_spi_config - spi config for peripheral
  *
@@ -30,6 +36,7 @@
  * @cs: chip select toggle
  * @set_config: set peripheral config
  * @rx_len: receive length for buffer
+ * @flags: flags for immediate dma and block event interrupt support
  */
 struct gpi_spi_config {
 	u8 set_config;
@@ -44,6 +51,7 @@
 	u32 clk_src;
 	enum spi_transfer_cmd cmd;
 	u32 rx_len;
+	u8 flags;
 };
 
 enum i2c_op {
@@ -65,6 +73,8 @@
  * @rx_len: receive length for buffer
  * @op: i2c cmd
  * @muli-msg: is part of multi i2c r-w msgs
+ * @status: gpi event status
+ * @gi2c: pointer to qcom i2c structure
  */
 struct gpi_i2c_config {
 	u8 set_config;
@@ -78,6 +88,11 @@
 	u32 rx_len;
 	enum i2c_op op;
 	bool multi_msg;
+	bool shared_se;
+	bool first_msg;
+	bool last_msg;
+	u32 status;
+	struct geni_i2c_dev *gi2c;
 };
 
 #endif /* QCOM_GPI_DMA_H */
--- linux-qcom-6.8.0.orig/include/linux/dma/qcom_bam_dma.h
+++ linux-qcom-6.8.0/include/linux/dma/qcom_bam_dma.h
@@ -8,6 +8,9 @@
 
 #include <asm/byteorder.h>
 
+#define DMA_PREP_LOCK	BIT(0)
+#define DMA_PREP_UNLOCK	BIT(1)
+
 /*
  * This data type corresponds to the native Command Element
  * supported by BAM DMA Engine.
--- linux-qcom-6.8.0.orig/include/linux/dpll.h
+++ linux-qcom-6.8.0/include/linux/dpll.h
@@ -15,6 +15,7 @@
 
 struct dpll_device;
 struct dpll_pin;
+struct dpll_pin_esync;
 
 struct dpll_device_ops {
 	int (*mode_get)(const struct dpll_device *dpll, void *dpll_priv,
@@ -82,6 +83,13 @@
 	int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv,
 		       const struct dpll_device *dpll, void *dpll_priv,
 		       s64 *ffo, struct netlink_ext_ack *extack);
+	int (*esync_set)(const struct dpll_pin *pin, void *pin_priv,
+			 const struct dpll_device *dpll, void *dpll_priv,
+			 u64 freq, struct netlink_ext_ack *extack);
+	int (*esync_get)(const struct dpll_pin *pin, void *pin_priv,
+			 const struct dpll_device *dpll, void *dpll_priv,
+			 struct dpll_pin_esync *esync,
+			 struct netlink_ext_ack *extack);
 };
 
 struct dpll_pin_frequency {
@@ -110,6 +118,13 @@
 	s32 max;
 };
 
+struct dpll_pin_esync {
+	u64 freq;
+	const struct dpll_pin_frequency *range;
+	u8 range_num;
+	u8 pulse;
+};
+
 struct dpll_pin_properties {
 	const char *board_label;
 	const char *panel_label;
--- linux-qcom-6.8.0.orig/include/linux/dsa/ocelot.h
+++ linux-qcom-6.8.0/include/linux/dsa/ocelot.h
@@ -5,6 +5,8 @@
 #ifndef _NET_DSA_TAG_OCELOT_H
 #define _NET_DSA_TAG_OCELOT_H
 
+#include <linux/if_bridge.h>
+#include <linux/if_vlan.h>
 #include <linux/kthread.h>
 #include <linux/packing.h>
 #include <linux/skbuff.h>
@@ -13,6 +15,7 @@
 struct ocelot_skb_cb {
 	struct sk_buff *clone;
 	unsigned int ptp_class; /* valid only for clones */
+	unsigned long ptp_tx_time; /* valid only for clones */
 	u32 tstamp_lo;
 	u8 ptp_cmd;
 	u8 ts_id;
@@ -273,4 +276,49 @@
 	return rew_op;
 }
 
+/**
+ * ocelot_xmit_get_vlan_info: Determine VLAN_TCI and TAG_TYPE for injected frame
+ * @skb: Pointer to socket buffer
+ * @br: Pointer to bridge device that the port is under, if any
+ * @vlan_tci:
+ * @tag_type:
+ *
+ * If the port is under a VLAN-aware bridge, remove the VLAN header from the
+ * payload and move it into the DSA tag, which will make the switch classify
+ * the packet to the bridge VLAN. Otherwise, leave the classified VLAN at zero,
+ * which is the pvid of standalone ports (OCELOT_STANDALONE_PVID), although not
+ * of VLAN-unaware bridge ports (that would be ocelot_vlan_unaware_pvid()).
+ * Anyway, VID 0 is fine because it is stripped on egress for these port modes,
+ * and source address learning is not performed for packets injected from the
+ * CPU anyway, so it doesn't matter that the VID is "wrong".
+ */
+static inline void ocelot_xmit_get_vlan_info(struct sk_buff *skb,
+					     struct net_device *br,
+					     u64 *vlan_tci, u64 *tag_type)
+{
+	struct vlan_ethhdr *hdr;
+	u16 proto, tci;
+
+	if (!br || !br_vlan_enabled(br)) {
+		*vlan_tci = 0;
+		*tag_type = IFH_TAG_TYPE_C;
+		return;
+	}
+
+	hdr = (struct vlan_ethhdr *)skb_mac_header(skb);
+	br_vlan_get_proto(br, &proto);
+
+	if (ntohs(hdr->h_vlan_proto) == proto) {
+		vlan_remove_tag(skb, &tci);
+		*vlan_tci = tci;
+	} else {
+		rcu_read_lock();
+		br_vlan_get_pvid_rcu(br, &tci);
+		rcu_read_unlock();
+		*vlan_tci = tci;
+	}
+
+	*tag_type = (proto != ETH_P_8021Q) ? IFH_TAG_TYPE_S : IFH_TAG_TYPE_C;
+}
+
 #endif
--- linux-qcom-6.8.0.orig/include/linux/dynamic_queue_limits.h
+++ linux-qcom-6.8.0/include/linux/dynamic_queue_limits.h
@@ -74,7 +74,8 @@
  */
 static inline void dql_queued(struct dql *dql, unsigned int count)
 {
-	BUG_ON(count > DQL_MAX_OBJECT);
+	if (WARN_ON_ONCE(count > DQL_MAX_OBJECT))
+		return;
 
 	dql->last_obj_cnt = count;
 
--- linux-qcom-6.8.0.orig/include/linux/eeprom_93cx6.h
+++ linux-qcom-6.8.0/include/linux/eeprom_93cx6.h
@@ -11,6 +11,8 @@
 	Supported chipsets: 93c46, 93c56 and 93c66.
  */
 
+#include <linux/bits.h>
+
 /*
  * EEPROM operation defines.
  */
@@ -34,6 +36,7 @@
  * @register_write(struct eeprom_93cx6 *eeprom): handler to
  * write to the eeprom register by using all reg_* fields.
  * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines
+ * @quirks: eeprom or controller quirks
  * @drive_data: Set if we're driving the data line.
  * @reg_data_in: register field to indicate data input
  * @reg_data_out: register field to indicate data output
@@ -50,6 +53,9 @@
 	void (*register_write)(struct eeprom_93cx6 *eeprom);
 
 	int width;
+	unsigned int quirks;
+/* Some EEPROMs require an extra clock cycle before reading */
+#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE	BIT(0)
 
 	char drive_data;
 	char reg_data_in;
@@ -71,3 +77,8 @@
 
 extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom,
 			       u8 addr, u16 data);
+
+static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom)
+{
+	return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE;
+}
--- linux-qcom-6.8.0.orig/include/linux/efi.h
+++ linux-qcom-6.8.0/include/linux/efi.h
@@ -45,6 +45,8 @@
 #define EFI_ABORTED		(21 | (1UL << (BITS_PER_LONG-1)))
 #define EFI_SECURITY_VIOLATION	(26 | (1UL << (BITS_PER_LONG-1)))
 
+#define EFI_IS_ERROR(x)		((x) & (1UL << (BITS_PER_LONG-1)))
+
 typedef unsigned long efi_status_t;
 typedef u8 efi_bool_t;
 typedef u16 efi_char16_t;		/* UNICODE character */
@@ -386,6 +388,7 @@
 #define EFI_CONSOLE_OUT_DEVICE_GUID		EFI_GUID(0xd3b36f2c, 0xd551, 0x11d4,  0x9a, 0x46, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d)
 #define APPLE_PROPERTIES_PROTOCOL_GUID		EFI_GUID(0x91bd12fe, 0xf6c3, 0x44fb,  0xa5, 0xb7, 0x51, 0x22, 0xab, 0x30, 0x3a, 0xe0)
 #define EFI_TCG2_PROTOCOL_GUID			EFI_GUID(0x607f766c, 0x7455, 0x42be,  0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f)
+#define EFI_TCG2_FINAL_EVENTS_TABLE_GUID	EFI_GUID(0x1e2ed096, 0x30e2, 0x4254,  0xbd, 0x89, 0x86, 0x3b, 0xbe, 0xf8, 0x23, 0x25)
 #define EFI_LOAD_FILE_PROTOCOL_GUID		EFI_GUID(0x56ec3091, 0x954c, 0x11d2,  0x8e, 0x3f, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
 #define EFI_LOAD_FILE2_PROTOCOL_GUID		EFI_GUID(0x4006c0c1, 0xfcb3, 0x403e,  0x99, 0x6d, 0x4a, 0x6c, 0x87, 0x24, 0xe0, 0x6d)
 #define EFI_RT_PROPERTIES_TABLE_GUID		EFI_GUID(0xeb66918a, 0x7eef, 0x402a,  0x84, 0x2e, 0x93, 0x1d, 0x21, 0xc3, 0x8a, 0xe9)
@@ -400,6 +403,8 @@
 #define EFI_CERT_X509_GUID			EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72)
 #define EFI_CERT_X509_SHA256_GUID		EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed)
 #define EFI_CC_BLOB_GUID			EFI_GUID(0x067b1f5f, 0xcf26, 0x44c5, 0x85, 0x54, 0x93, 0xd7, 0x77, 0x91, 0x2d, 0x42)
+#define EFI_CC_MEASUREMENT_PROTOCOL_GUID	EFI_GUID(0x96751a3d, 0x72f4, 0x41a6, 0xa7, 0x94, 0xed, 0x5d, 0x0e, 0x67, 0xae, 0x6b)
+#define EFI_CC_FINAL_EVENTS_TABLE_GUID		EFI_GUID(0xdd4a4648, 0x2de7, 0x4665, 0x96, 0x4d, 0x21, 0xd9, 0xef, 0x5f, 0xb4, 0x46)
 
 /*
  * This GUID is used to pass to the kernel proper the struct screen_info
@@ -411,7 +416,6 @@
 #define LINUX_EFI_LOADER_ENTRY_GUID		EFI_GUID(0x4a67b082, 0x0a4c, 0x41cf,  0xb6, 0xc7, 0x44, 0x0b, 0x29, 0xbb, 0x8c, 0x4f)
 #define LINUX_EFI_RANDOM_SEED_TABLE_GUID	EFI_GUID(0x1ce1e5bc, 0x7ceb, 0x42f2,  0x81, 0xe5, 0x8a, 0xad, 0xf1, 0x80, 0xf5, 0x7b)
 #define LINUX_EFI_TPM_EVENT_LOG_GUID		EFI_GUID(0xb7799cb0, 0xeca2, 0x4943,  0x96, 0x67, 0x1f, 0xae, 0x07, 0xb7, 0x47, 0xfa)
-#define LINUX_EFI_TPM_FINAL_LOG_GUID		EFI_GUID(0x1e2ed096, 0x30e2, 0x4254,  0xbd, 0x89, 0x86, 0x3b, 0xbe, 0xf8, 0x23, 0x25)
 #define LINUX_EFI_MEMRESERVE_TABLE_GUID		EFI_GUID(0x888eb0c6, 0x8ede, 0x4ff5,  0xa8, 0xf0, 0x9a, 0xee, 0x5c, 0xb9, 0x77, 0xc2)
 #define LINUX_EFI_INITRD_MEDIA_GUID		EFI_GUID(0x5568e427, 0x68fc, 0x4f3d,  0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68)
 #define LINUX_EFI_MOK_VARIABLE_TABLE_GUID	EFI_GUID(0xc451ed2b, 0x9694, 0x45d3,  0xba, 0xba, 0xed, 0x9f, 0x89, 0x88, 0xa3, 0x89)
@@ -865,6 +869,23 @@
 #define EFI_MEM_ATTR		10	/* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
 #define EFI_MEM_NO_SOFT_RESERVE	11	/* Is the kernel configured to ignore soft reservations? */
 #define EFI_PRESERVE_BS_REGIONS	12	/* Are EFI boot-services memory segments available? */
+#define EFI_SECURE_BOOT		13	/* Are we in Secure Boot mode? */
+
+enum efi_secureboot_mode {
+	efi_secureboot_mode_unset,
+	efi_secureboot_mode_unknown,
+	efi_secureboot_mode_disabled,
+	efi_secureboot_mode_enabled,
+};
+
+#ifdef CONFIG_EFI_PARAMS_FROM_FDT
+u32 __init efi_get__secure_boot(void);
+#else
+static inline u32 efi_get__secure_boot(void)
+{
+	return efi_secureboot_mode_unset;
+};
+#endif
 
 #ifdef CONFIG_EFI
 /*
@@ -876,6 +897,8 @@
 }
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
 
+extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode);
+
 bool __pure __efi_soft_reserve_enabled(void);
 
 static inline bool __pure efi_soft_reserve_enabled(void)
@@ -897,6 +920,8 @@
 static inline void
 efi_reboot(enum reboot_mode reboot_mode, const char *__unused) {}
 
+static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {}
+
 static inline bool efi_soft_reserve_enabled(void)
 {
 	return false;
@@ -911,6 +936,7 @@
 #endif
 
 extern int efi_status_to_err(efi_status_t status);
+extern const char *efi_status_to_str(efi_status_t status);
 
 /*
  * Variable Attributes
@@ -1127,13 +1153,6 @@
 extern void efi_call_virt_check_flags(unsigned long flags, const void *caller);
 extern unsigned long efi_call_virt_save_flags(void);
 
-enum efi_secureboot_mode {
-	efi_secureboot_mode_unset,
-	efi_secureboot_mode_unknown,
-	efi_secureboot_mode_disabled,
-	efi_secureboot_mode_enabled,
-};
-
 static inline
 enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var)
 {
--- linux-qcom-6.8.0.orig/include/linux/etherdevice.h
+++ linux-qcom-6.8.0/include/linux/etherdevice.h
@@ -608,6 +608,39 @@
 }
 
 /**
+ * eth_skb_pkt_type - Assign packet type if destination address does not match
+ * @skb: Assigned a packet type if address does not match @dev address
+ * @dev: Network device used to compare packet address against
+ *
+ * If the destination MAC address of the packet does not match the network
+ * device address, assign an appropriate packet type.
+ */
+static inline void eth_skb_pkt_type(struct sk_buff *skb,
+				    const struct net_device *dev)
+{
+	const struct ethhdr *eth = eth_hdr(skb);
+
+	if (unlikely(!ether_addr_equal_64bits(eth->h_dest, dev->dev_addr))) {
+		if (unlikely(is_multicast_ether_addr_64bits(eth->h_dest))) {
+			if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
+				skb->pkt_type = PACKET_BROADCAST;
+			else
+				skb->pkt_type = PACKET_MULTICAST;
+		} else {
+			skb->pkt_type = PACKET_OTHERHOST;
+		}
+	}
+}
+
+static inline struct ethhdr *eth_skb_pull_mac(struct sk_buff *skb)
+{
+	struct ethhdr *eth = (struct ethhdr *)skb->data;
+
+	skb_pull_inline(skb, ETH_HLEN);
+	return eth;
+}
+
+/**
  * eth_skb_pad - Pad buffer to mininum number of octets for Ethernet frame
  * @skb: Buffer to pad
  *
--- linux-qcom-6.8.0.orig/include/linux/eventpoll.h
+++ linux-qcom-6.8.0/include/linux/eventpoll.h
@@ -42,7 +42,7 @@
 	 * because the file in on the way to be removed and nobody ( but
 	 * eventpoll ) has still a reference to this file.
 	 */
-	if (likely(!file->f_ep))
+	if (likely(!READ_ONCE(file->f_ep)))
 		return;
 
 	/*
--- linux-qcom-6.8.0.orig/include/linux/f2fs_fs.h
+++ linux-qcom-6.8.0/include/linux/f2fs_fs.h
@@ -19,14 +19,16 @@
 #define F2FS_BLKSIZE_BITS		PAGE_SHIFT /* bits for F2FS_BLKSIZE */
 #define F2FS_MAX_EXTENSION		64	/* # of extension entries */
 #define F2FS_EXTENSION_LEN		8	/* max size of extension */
-#define F2FS_BLK_ALIGN(x)	(((x) + F2FS_BLKSIZE - 1) >> F2FS_BLKSIZE_BITS)
 
 #define NULL_ADDR		((block_t)0)	/* used as block_t addresses */
 #define NEW_ADDR		((block_t)-1)	/* used as block_t addresses */
 #define COMPRESS_ADDR		((block_t)-2)	/* used as compressed data flag */
 
-#define F2FS_BYTES_TO_BLK(bytes)	((bytes) >> F2FS_BLKSIZE_BITS)
-#define F2FS_BLK_TO_BYTES(blk)		((blk) << F2FS_BLKSIZE_BITS)
+#define F2FS_BLKSIZE_MASK		(F2FS_BLKSIZE - 1)
+#define F2FS_BYTES_TO_BLK(bytes)	((unsigned long long)(bytes) >> F2FS_BLKSIZE_BITS)
+#define F2FS_BLK_TO_BYTES(blk)		((unsigned long long)(blk) << F2FS_BLKSIZE_BITS)
+#define F2FS_BLK_END_BYTES(blk)		(F2FS_BLK_TO_BYTES(blk + 1) - 1)
+#define F2FS_BLK_ALIGN(x)		(F2FS_BYTES_TO_BLK((x) + F2FS_BLKSIZE - 1))
 
 /* 0, 1(node nid), 2(meta nid) are reserved node id */
 #define F2FS_RESERVED_NODE_NUM		3
@@ -40,12 +42,6 @@
 
 #define F2FS_ENC_UTF8_12_1	1
 
-#define F2FS_IO_SIZE(sbi)	BIT(F2FS_OPTION(sbi).write_io_size_bits) /* Blocks */
-#define F2FS_IO_SIZE_KB(sbi)	BIT(F2FS_OPTION(sbi).write_io_size_bits + 2) /* KB */
-#define F2FS_IO_SIZE_BITS(sbi)	(F2FS_OPTION(sbi).write_io_size_bits) /* power of 2 */
-#define F2FS_IO_SIZE_MASK(sbi)	(F2FS_IO_SIZE(sbi) - 1)
-#define F2FS_IO_ALIGNED(sbi)	(F2FS_IO_SIZE(sbi) > 1)
-
 /* This flag is used by node and meta inodes, and by recovery */
 #define GFP_F2FS_ZERO		(GFP_NOFS | __GFP_ZERO)
 
@@ -81,6 +77,7 @@
 	STOP_CP_REASON_CORRUPTED_SUMMARY,
 	STOP_CP_REASON_UPDATE_INODE,
 	STOP_CP_REASON_FLUSH_FAIL,
+	STOP_CP_REASON_NO_SEGMENT,
 	STOP_CP_REASON_MAX,
 };
 
@@ -283,7 +280,7 @@
 #define F2FS_INLINE_DATA	0x02	/* file inline data flag */
 #define F2FS_INLINE_DENTRY	0x04	/* file inline dentry flag */
 #define F2FS_DATA_EXIST		0x08	/* file inline data exist flag */
-#define F2FS_INLINE_DOTS	0x10	/* file having implicit dot dentries */
+#define F2FS_INLINE_DOTS	0x10	/* file having implicit dot dentries (obsolete) */
 #define F2FS_EXTRA_ATTR		0x20	/* file having extra attribute */
 #define F2FS_PIN_FILE		0x40	/* file should not be gced */
 #define F2FS_COMPRESS_RELEASED	0x80	/* file released compressed blocks */
--- linux-qcom-6.8.0.orig/include/linux/fanotify.h
+++ linux-qcom-6.8.0/include/linux/fanotify.h
@@ -36,6 +36,7 @@
 #define FANOTIFY_ADMIN_INIT_FLAGS	(FANOTIFY_PERM_CLASSES | \
 					 FAN_REPORT_TID | \
 					 FAN_REPORT_PIDFD | \
+					 FAN_REPORT_FD_ERROR | \
 					 FAN_UNLIMITED_QUEUE | \
 					 FAN_UNLIMITED_MARKS)
 
--- linux-qcom-6.8.0.orig/include/linux/fb.h
+++ linux-qcom-6.8.0/include/linux/fb.h
@@ -686,6 +686,10 @@
 	__FB_GEN_DEFAULT_DEFERRED_OPS_RDWR(__prefix, __damage_range, sys) \
 	__FB_GEN_DEFAULT_DEFERRED_OPS_DRAW(__prefix, __damage_area, sys)
 
+#define FB_GEN_DEFAULT_DEFERRED_DMAMEM_OPS(__prefix, __damage_range, __damage_area) \
+	__FB_GEN_DEFAULT_DEFERRED_OPS_RDWR(__prefix, __damage_range, sys) \
+	__FB_GEN_DEFAULT_DEFERRED_OPS_DRAW(__prefix, __damage_area, sys)
+
 /*
  * Initializes struct fb_ops for deferred I/O.
  */
--- linux-qcom-6.8.0.orig/include/linux/fdtable.h
+++ linux-qcom-6.8.0/include/linux/fdtable.h
@@ -22,7 +22,6 @@
  * as this is the granularity returned by copy_fdset().
  */
 #define NR_OPEN_DEFAULT BITS_PER_LONG
-#define NR_OPEN_MAX ~0U
 
 struct fdtable {
 	unsigned int max_fds;
@@ -111,7 +110,10 @@
 
 void put_files_struct(struct files_struct *fs);
 int unshare_files(void);
-struct files_struct *dup_fd(struct files_struct *, unsigned, int *) __latent_entropy;
+struct fd_range {
+	unsigned int from, to;
+};
+struct files_struct *dup_fd(struct files_struct *, struct fd_range *) __latent_entropy;
 void do_close_on_exec(struct files_struct *);
 int iterate_fd(struct files_struct *, unsigned,
 		int (*)(const void *, struct file *, unsigned),
@@ -120,8 +122,6 @@
 extern int close_fd(unsigned int fd);
 extern int __close_range(unsigned int fd, unsigned int max_fd, unsigned int flags);
 extern struct file *file_close_fd(unsigned int fd);
-extern int unshare_fd(unsigned long unshare_flags, unsigned int max_fds,
-		      struct files_struct **new_fdp);
 
 extern struct kmem_cache *files_cachep;
 
--- linux-qcom-6.8.0.orig/include/linux/filter.h
+++ linux-qcom-6.8.0/include/linux/filter.h
@@ -547,24 +547,27 @@
 	__BPF_MAP(n, __BPF_DECL_ARGS, __BPF_N, u64, __ur_1, u64, __ur_2,       \
 		  u64, __ur_3, u64, __ur_4, u64, __ur_5)
 
-#define BPF_CALL_x(x, name, ...)					       \
+#define BPF_CALL_x(x, attr, name, ...)					       \
 	static __always_inline						       \
 	u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__));   \
 	typedef u64 (*btf_##name)(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)); \
-	u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__));	       \
-	u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__))	       \
+	attr u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__));    \
+	attr u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__))     \
 	{								       \
 		return ((btf_##name)____##name)(__BPF_MAP(x,__BPF_CAST,__BPF_N,__VA_ARGS__));\
 	}								       \
 	static __always_inline						       \
 	u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__))
 
-#define BPF_CALL_0(name, ...)	BPF_CALL_x(0, name, __VA_ARGS__)
-#define BPF_CALL_1(name, ...)	BPF_CALL_x(1, name, __VA_ARGS__)
-#define BPF_CALL_2(name, ...)	BPF_CALL_x(2, name, __VA_ARGS__)
-#define BPF_CALL_3(name, ...)	BPF_CALL_x(3, name, __VA_ARGS__)
-#define BPF_CALL_4(name, ...)	BPF_CALL_x(4, name, __VA_ARGS__)
-#define BPF_CALL_5(name, ...)	BPF_CALL_x(5, name, __VA_ARGS__)
+#define __NOATTR
+#define BPF_CALL_0(name, ...)	BPF_CALL_x(0, __NOATTR, name, __VA_ARGS__)
+#define BPF_CALL_1(name, ...)	BPF_CALL_x(1, __NOATTR, name, __VA_ARGS__)
+#define BPF_CALL_2(name, ...)	BPF_CALL_x(2, __NOATTR, name, __VA_ARGS__)
+#define BPF_CALL_3(name, ...)	BPF_CALL_x(3, __NOATTR, name, __VA_ARGS__)
+#define BPF_CALL_4(name, ...)	BPF_CALL_x(4, __NOATTR, name, __VA_ARGS__)
+#define BPF_CALL_5(name, ...)	BPF_CALL_x(5, __NOATTR, name, __VA_ARGS__)
+
+#define NOTRACE_BPF_CALL_1(name, ...)	BPF_CALL_x(1, notrace, name, __VA_ARGS__)
 
 #define bpf_ctx_range(TYPE, MEMBER)						\
 	offsetof(TYPE, MEMBER) ... offsetofend(TYPE, MEMBER) - 1
@@ -881,20 +884,22 @@
 
 #define bpf_classic_proglen(fprog) (fprog->len * sizeof(fprog->filter[0]))
 
-static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
+static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp)
 {
 #ifndef CONFIG_BPF_JIT_ALWAYS_ON
 	if (!fp->jited) {
 		set_vm_flush_reset_perms(fp);
-		set_memory_ro((unsigned long)fp, fp->pages);
+		return set_memory_ro((unsigned long)fp, fp->pages);
 	}
 #endif
+	return 0;
 }
 
-static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
+static inline int __must_check
+bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
 {
 	set_vm_flush_reset_perms(hdr);
-	set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT);
+	return set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT);
 }
 
 int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap);
@@ -956,7 +961,7 @@
 bool bpf_jit_supports_far_kfunc_call(void);
 bool bpf_jit_supports_exceptions(void);
 void arch_bpf_stack_walk(bool (*consume_fn)(void *cookie, u64 ip, u64 sp, u64 bp), void *cookie);
-bool bpf_helper_changes_pkt_data(void *func);
+bool bpf_helper_changes_pkt_data(enum bpf_func_id func_id);
 
 static inline bool bpf_dump_raw_ok(const struct cred *cred)
 {
@@ -1160,18 +1165,18 @@
 	return false;
 }
 
-const char *__bpf_address_lookup(unsigned long addr, unsigned long *size,
+int __bpf_address_lookup(unsigned long addr, unsigned long *size,
 				 unsigned long *off, char *sym);
 bool is_bpf_text_address(unsigned long addr);
 int bpf_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
 		    char *sym);
 struct bpf_prog *bpf_prog_ksym_find(unsigned long addr);
 
-static inline const char *
+static inline int
 bpf_address_lookup(unsigned long addr, unsigned long *size,
 		   unsigned long *off, char **modname, char *sym)
 {
-	const char *ret = __bpf_address_lookup(addr, size, off, sym);
+	int ret = __bpf_address_lookup(addr, size, off, sym);
 
 	if (ret && modname)
 		*modname = NULL;
@@ -1215,11 +1220,11 @@
 	return false;
 }
 
-static inline const char *
+static inline int
 __bpf_address_lookup(unsigned long addr, unsigned long *size,
 		     unsigned long *off, char *sym)
 {
-	return NULL;
+	return 0;
 }
 
 static inline bool is_bpf_text_address(unsigned long addr)
@@ -1238,11 +1243,11 @@
 	return NULL;
 }
 
-static inline const char *
+static inline int
 bpf_address_lookup(unsigned long addr, unsigned long *size,
 		   unsigned long *off, char **modname, char *sym)
 {
-	return NULL;
+	return 0;
 }
 
 static inline void bpf_prog_kallsyms_add(struct bpf_prog *fp)
--- linux-qcom-6.8.0.orig/include/linux/firmware/qcom/qcom_qseecom.h
+++ linux-qcom-6.8.0/include/linux/firmware/qcom/qcom_qseecom.h
@@ -10,6 +10,7 @@
 #define __QCOM_QSEECOM_H
 
 #include <linux/auxiliary_bus.h>
+#include <linux/dma-mapping.h>
 #include <linux/types.h>
 
 #include <linux/firmware/qcom/qcom_scm.h>
@@ -25,11 +26,56 @@
 };
 
 /**
+ * qseecom_scm_dev() - Get the SCM device associated with the QSEECOM client.
+ * @client: The QSEECOM client device.
+ *
+ * Returns the SCM device under which the provided QSEECOM client device
+ * operates. This function is intended to be used for DMA allocations.
+ */
+static inline struct device *qseecom_scm_dev(struct qseecom_client *client)
+{
+	return client->aux_dev.dev.parent->parent;
+}
+
+/**
+ * qseecom_dma_alloc() - Allocate DMA memory for a QSEECOM client.
+ * @client:     The QSEECOM client to allocate the memory for.
+ * @size:       The number of bytes to allocate.
+ * @dma_handle: Pointer to where the DMA address should be stored.
+ * @gfp:        Allocation flags.
+ *
+ * Wrapper function for dma_alloc_coherent(), allocating DMA memory usable for
+ * TZ/QSEECOM communication. Refer to dma_alloc_coherent() for details.
+ */
+static inline void *qseecom_dma_alloc(struct qseecom_client *client, size_t size,
+				      dma_addr_t *dma_handle, gfp_t gfp)
+{
+	return dma_alloc_coherent(qseecom_scm_dev(client), size, dma_handle, gfp);
+}
+
+/**
+ * dma_free_coherent() - Free QSEECOM DMA memory.
+ * @client:     The QSEECOM client for which the memory has been allocated.
+ * @size:       The number of bytes allocated.
+ * @cpu_addr:   Virtual memory address to free.
+ * @dma_handle: DMA memory address to free.
+ *
+ * Wrapper function for dma_free_coherent(), freeing memory previously
+ * allocated with qseecom_dma_alloc(). Refer to dma_free_coherent() for
+ * details.
+ */
+static inline void qseecom_dma_free(struct qseecom_client *client, size_t size,
+				    void *cpu_addr, dma_addr_t dma_handle)
+{
+	return dma_free_coherent(qseecom_scm_dev(client), size, cpu_addr, dma_handle);
+}
+
+/**
  * qcom_qseecom_app_send() - Send to and receive data from a given QSEE app.
  * @client:   The QSEECOM client associated with the target app.
- * @req:      Request buffer sent to the app (must be DMA-mappable).
+ * @req:      DMA address of the request buffer sent to the app.
  * @req_size: Size of the request buffer.
- * @rsp:      Response buffer, written to by the app (must be DMA-mappable).
+ * @rsp:      DMA address of the response buffer, written to by the app.
  * @rsp_size: Size of the response buffer.
  *
  * Sends a request to the QSEE app associated with the given client and read
@@ -43,8 +89,9 @@
  *
  * Return: Zero on success, nonzero on failure.
  */
-static inline int qcom_qseecom_app_send(struct qseecom_client *client, void *req, size_t req_size,
-					void *rsp, size_t rsp_size)
+static inline int qcom_qseecom_app_send(struct qseecom_client *client,
+					dma_addr_t req, size_t req_size,
+					dma_addr_t rsp, size_t rsp_size)
 {
 	return qcom_scm_qseecom_app_send(client->app_id, req, req_size, rsp, rsp_size);
 }
--- linux-qcom-6.8.0.orig/include/linux/firmware/qcom/qcom_scm.h
+++ linux-qcom-6.8.0/include/linux/firmware/qcom/qcom_scm.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /* Copyright (c) 2010-2015, 2018-2019 The Linux Foundation. All rights reserved.
  * Copyright (C) 2015 Linaro Ltd.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #ifndef __QCOM_SCM_H
 #define __QCOM_SCM_H
@@ -10,6 +11,9 @@
 #include <linux/cpumask.h>
 
 #include <dt-bindings/firmware/qcom,scm.h>
+#ifdef CONFIG_QCOM_SCM_ADDON
+#include "qcom_scm_addon.h"
+#endif
 
 #define QCOM_SCM_VERSION(major, minor)	(((major) << 16) | ((minor) & 0xFF))
 #define QCOM_SCM_CPU_PWR_DOWN_L2_ON	0x0
@@ -53,6 +57,19 @@
 	QCOM_SCM_ICE_CIPHER_AES_256_CBC = 4,
 };
 
+struct qcom_scm_current_perm_info {
+	__le32 vmid;
+	__le32 perm;
+	__le64 ctx;
+	__le32 ctx_size;
+	__le32 unused;
+};
+
+struct qcom_scm_mem_map_info {
+	__le64 mem_addr;
+	__le64 mem_size;
+};
+
 #define QCOM_SCM_PERM_READ       0x4
 #define QCOM_SCM_PERM_WRITE      0x2
 #define QCOM_SCM_PERM_EXEC       0x1
@@ -61,6 +78,29 @@
 
 bool qcom_scm_is_available(void);
 
+static inline void qcom_scm_populate_vmperm_info(
+		struct qcom_scm_current_perm_info *destvm, int vmid, int perm)
+{
+	if (!destvm)
+		return;
+
+	destvm->vmid = cpu_to_le32(vmid);
+	destvm->perm = cpu_to_le32(perm);
+	destvm->ctx = 0;
+	destvm->ctx_size = 0;
+}
+
+static inline void qcom_scm_populate_mem_map_info(
+		struct qcom_scm_mem_map_info *mem_to_map,
+		phys_addr_t mem_addr, size_t mem_size)
+{
+	if (!mem_to_map)
+		return;
+
+	mem_to_map->mem_addr = cpu_to_le64(mem_addr);
+	mem_to_map->mem_size = cpu_to_le64(mem_size);
+}
+
 int qcom_scm_set_cold_boot_addr(void *entry);
 int qcom_scm_set_warm_boot_addr(void *entry);
 void qcom_scm_cpu_power_down(u32 flags);
@@ -70,6 +110,7 @@
 	void *ptr;
 	dma_addr_t phys;
 	ssize_t size;
+	bool shm_bridge_needed;
 };
 
 int qcom_scm_pas_init_image(u32 peripheral, const void *metadata, size_t size,
@@ -85,6 +126,8 @@
 
 bool qcom_scm_restore_sec_cfg_available(void);
 int qcom_scm_restore_sec_cfg(u32 device_id, u32 spare);
+int qcom_scm_set_gpu_smmu_aperture(unsigned int context_bank);
+bool qcom_scm_set_gpu_smmu_aperture_is_available(void);
 int qcom_scm_iommu_secure_ptbl_size(u32 spare, size_t *size);
 int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare);
 int qcom_scm_iommu_set_cp_pool_size(u32 spare, u32 size);
@@ -93,6 +136,11 @@
 int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz, u64 *src,
 			const struct qcom_scm_vmperm *newvm,
 			unsigned int dest_cnt);
+extern int
+qcom_scm_assign_mem_regions(struct qcom_scm_mem_map_info *mem_regions,
+		size_t mem_regions_sz, u32 *srcvms, size_t src_sz,
+		struct qcom_scm_current_perm_info *newvms,
+		size_t newvms_sz);
 
 bool qcom_scm_ocmem_lock_available(void);
 int qcom_scm_ocmem_lock(enum qcom_scm_ocmem_client id, u32 offset, u32 size,
@@ -103,7 +151,14 @@
 int qcom_scm_ice_invalidate_key(u32 index);
 int qcom_scm_ice_set_key(u32 index, const u8 *key, u32 key_size,
 			 enum qcom_scm_ice_cipher cipher, u32 data_unit_size);
+int qcom_scm_derive_sw_secret(const u8 *wkey, size_t wkey_size,
+			      u8 *sw_secret, size_t sw_secret_size);
 
+int qcom_scm_generate_ice_key(u8 *lt_key, size_t lt_key_size);
+int qcom_scm_prepare_ice_key(const u8 *lt_key, size_t lt_key_size,
+			     u8 *eph_key, size_t eph_size);
+int qcom_scm_import_ice_key(const u8 *imp_key, size_t imp_size,
+			    u8 *lt_key, size_t lt_key_size);
 bool qcom_scm_hdcp_available(void);
 int qcom_scm_hdcp_req(struct qcom_scm_hdcp_req *req, u32 req_cnt, u32 *resp);
 
@@ -115,11 +170,40 @@
 int qcom_scm_lmh_profile_change(u32 profile_id);
 bool qcom_scm_lmh_dcvsh_available(void);
 
+/*
+ * Request TZ to program set of access controlled registers necessary
+ * irrespective of any features
+ */
+#define QCOM_SCM_GPU_ALWAYS_EN_REQ BIT(0)
+/*
+ * Request TZ to program BCL id to access controlled register when BCL is
+ * enabled
+ */
+#define QCOM_SCM_GPU_BCL_EN_REQ BIT(1)
+/*
+ * Request TZ to program set of access controlled register for CLX feature
+ * when enabled
+ */
+#define QCOM_SCM_GPU_CLX_EN_REQ BIT(2)
+/*
+ * Request TZ to program tsense ids to access controlled registers for reading
+ * gpu temperature sensors
+ */
+#define QCOM_SCM_GPU_TSENSE_EN_REQ BIT(3)
+
+int qcom_scm_gpu_init_regs(u32 gpu_req);
+
+int qcom_scm_shm_bridge_enable(void);
+int qcom_scm_shm_bridge_create(struct device *dev, u64 pfn_and_ns_perm_flags,
+			       u64 ipfn_and_s_perm_flags, u64 size_and_flags,
+			       u64 ns_vmids, u64 *handle);
+int qcom_scm_shm_bridge_delete(struct device *dev, u64 handle);
+
 #ifdef CONFIG_QCOM_QSEECOM
 
 int qcom_scm_qseecom_app_get_id(const char *app_name, u32 *app_id);
-int qcom_scm_qseecom_app_send(u32 app_id, void *req, size_t req_size, void *rsp,
-			      size_t rsp_size);
+int qcom_scm_qseecom_app_send(u32 app_id, dma_addr_t req, size_t req_size,
+			      dma_addr_t rsp, size_t rsp_size);
 
 #else /* CONFIG_QCOM_QSEECOM */
 
@@ -128,9 +212,9 @@
 	return -EINVAL;
 }
 
-static inline int qcom_scm_qseecom_app_send(u32 app_id, void *req,
-					    size_t req_size, void *rsp,
-					    size_t rsp_size)
+static inline int qcom_scm_qseecom_app_send(u32 app_id,
+					    dma_addr_t req, size_t req_size,
+					    dma_addr_t rsp, size_t rsp_size)
 {
 	return -EINVAL;
 }
--- linux-qcom-6.8.0.orig/include/linux/firmware/qcom/qcom_scm_addon.h
+++ linux-qcom-6.8.0/include/linux/firmware/qcom/qcom_scm_addon.h
@@ -0,0 +1,221 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __QCOM_SCM_ADDON_H
+#define __QCOM_SCM_ADDON_H
+
+#include <asm-generic/errno-base.h>
+
+#ifdef CONFIG_QCOM_SCM_ADDON
+
+#define QCOM_SCM_CAMERA_MAX_QOS_CNT	2
+
+struct qcom_scm_camera_qos {
+	u32 offset;
+	u32 val;
+};
+
+extern int qcom_scm_camera_update_camnoc_qos(uint32_t use_case_id,
+		uint32_t qos_cnt, struct qcom_scm_camera_qos *scm_buf);
+extern bool qcom_scm_dcvs_ca_available(void);
+extern bool qcom_scm_dcvs_core_available(void);
+extern int qcom_scm_dcvs_reset(void);
+extern int qcom_scm_dcvs_init_v2(phys_addr_t addr, size_t size,
+			int *version);
+extern int qcom_scm_dcvs_update(int level, s64 total_time,
+			s64 busy_time);
+extern int qcom_scm_dcvs_update_v2(int level, s64 total_time,
+			s64 busy_time);
+extern int qcom_scm_dcvs_update_ca_v2(int level, s64 total_time,
+			s64 busy_time, int context_count);
+extern int qcom_scm_dcvs_init_ca_v2(phys_addr_t addr, size_t size);
+extern int qcom_scm_io_reset(void);
+extern int qcom_scm_get_tz_log_feat_id(u64 *version);
+extern int qcom_scm_get_tz_feat_id_version(u64 feat_id, u64 *version);
+extern int qcom_scm_register_qsee_log_buf(phys_addr_t buf, size_t len);
+extern int qcom_scm_query_encrypted_log_feature(u64 *enabled);
+extern int qcom_scm_request_encrypted_log(phys_addr_t buf,
+			size_t len, uint32_t log_id, bool is_full_tz_logs_supported,
+			bool is_full_tz_logs_enabled);
+extern bool qcom_scm_kgsl_set_smmu_aperture_available(void);
+extern int qcom_scm_kgsl_set_smmu_aperture(unsigned int num_context_bank);
+extern int qcom_scm_kgsl_init_regs(u32 gpu_req);
+extern int qcom_scm_invoke_smc(phys_addr_t in_buf, size_t in_buf_size,
+			phys_addr_t out_buf, size_t out_buf_size, int32_t *result,
+			u64 *response_type, unsigned int *data);
+extern int qcom_scm_invoke_smc_legacy(phys_addr_t in_buf, size_t in_buf_size,
+			phys_addr_t out_buf, size_t out_buf_size, int32_t *result,
+			u64 *response_type, unsigned int *data);
+extern int qcom_scm_invoke_callback_response(phys_addr_t out_buf,
+			size_t out_buf_size, int32_t *result, u64 *response_type,
+			unsigned int *data);
+extern int qcom_scm_sec_wdog_deactivate(void);
+extern int qcom_scm_sec_wdog_trigger(void);
+extern int qcom_scm_enable_shm_bridge(void);
+extern int qcom_scm_delete_shm_bridge(u64 handle);
+extern int qcom_scm_create_shm_bridge(u64 pfn_and_ns_perm_flags,
+			u64 ipfn_and_s_perm_flags, u64 size_and_flags, u64 ns_vmids,
+			u64 *handle);
+extern int qcom_scm_spin_cpu(void);
+extern int qcom_scm_ddrbw_profiler(phys_addr_t in_buf, size_t in_buf_size,
+				   phys_addr_t out_buf, size_t out_buf_size);
+extern int qcom_scm_she_op(u64 _arg1, u64 _arg2, u64 _arg3, u64 _arg4, u64 *res1);
+#else
+static inline bool qcom_scm_dcvs_ca_available(void)
+{
+	return false;
+}
+
+static inline bool qcom_scm_dcvs_core_available(void)
+{
+	return false;
+}
+
+static inline int qcom_scm_dcvs_reset(void)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_dcvs_init_v2(phys_addr_t addr, size_t size,
+			int *version)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_dcvs_update(int level, s64 total_time,
+			s64 busy_time)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_dcvs_update_v2(int level, s64 total_time,
+			s64 busy_time)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_dcvs_update_ca_v2(int level, s64 total_time,
+			s64 busy_time, int context_count)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_dcvs_init_ca_v2(phys_addr_t addr, size_t size)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_io_reset(void)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_get_tz_log_feat_id(u64 *version)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_get_tz_feat_id_version(u64 feat_id, u64 *version)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_register_qsee_log_buf(phys_addr_t buf, size_t len)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_query_encrypted_log_feature(u64 *enabled)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_request_encrypted_log(phys_addr_t buf,
+			size_t len, uint32_t log_id, bool is_full_tz_logs_supported,
+			bool is_full_tz_logs_enabled)
+{
+	return -EPERM;
+}
+
+static inline bool qcom_scm_kgsl_set_smmu_aperture_available(void)
+{
+	return false;
+}
+
+static inline int qcom_scm_kgsl_set_smmu_aperture(unsigned int num_context_bank)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_kgsl_init_regs(u32 gpu_req)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_invoke_smc(phys_addr_t in_buf, size_t in_buf_size,
+			phys_addr_t out_buf, size_t out_buf_size, int32_t *result,
+			u64 *response_type, unsigned int *data)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_invoke_smc_legacy(phys_addr_t in_buf, size_t in_buf_size,
+			phys_addr_t out_buf, size_t out_buf_size, int32_t *result,
+			u64 *response_type, unsigned int *data)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_invoke_callback_response(phys_addr_t out_buf,
+			size_t out_buf_size, int32_t *result, u64 *response_type,
+			unsigned int *data)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_sec_wdog_deactivate(void)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_sec_wdog_trigger(void)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_enable_shm_bridge(void)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_delete_shm_bridge(u64 handle)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_create_shm_bridge(u64 pfn_and_ns_perm_flags,
+			u64 ipfn_and_s_perm_flags, u64 size_and_flags, u64 ns_vmids,
+			u64 *handle)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_spin_cpu(void)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_ddrbw_profiler(phys_addr_t in_buf, size_t in_buf_size,
+				   phys_addr_t out_buf, size_t out_buf_size)
+{
+	return -EPERM;
+}
+
+static inline int qcom_scm_she_op(u64 _arg1, u64 _arg2, u64 _arg3, u64 _arg4, u64 *res1)
+{
+	return -EPERM;
+}
+#endif
+#endif
--- linux-qcom-6.8.0.orig/include/linux/firmware/qcom/qcom_tzmem.h
+++ linux-qcom-6.8.0/include/linux/firmware/qcom/qcom_tzmem.h
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2023-2024 Linaro Ltd.
+ */
+
+#ifndef __QCOM_TZMEM_H
+#define __QCOM_TZMEM_H
+
+#include <linux/cleanup.h>
+#include <linux/gfp.h>
+#include <linux/types.h>
+
+struct device;
+struct qcom_tzmem_pool;
+
+/**
+ * enum qcom_tzmem_policy - Policy for pool growth.
+ */
+enum qcom_tzmem_policy {
+	/**< Static pool, never grow above initial size. */
+	QCOM_TZMEM_POLICY_STATIC = 1,
+	/**< When out of memory, add increment * current size of memory. */
+	QCOM_TZMEM_POLICY_MULTIPLIER,
+	/**< When out of memory add as much as is needed until max_size. */
+	QCOM_TZMEM_POLICY_ON_DEMAND,
+};
+
+/**
+ * struct qcom_tzmem_pool_config - TZ memory pool configuration.
+ * @initial_size: Number of bytes to allocate for the pool during its creation.
+ * @policy: Pool size growth policy.
+ * @increment: Used with policies that allow pool growth.
+ * @max_size: Size above which the pool will never grow.
+ */
+struct qcom_tzmem_pool_config {
+	size_t initial_size;
+	enum qcom_tzmem_policy policy;
+	size_t increment;
+	size_t max_size;
+};
+
+struct qcom_tzmem_area {
+	struct list_head list;
+	void *vaddr;
+	dma_addr_t paddr;
+	size_t size;
+	void *priv;
+};
+
+struct qcom_tzmem_pool *
+qcom_tzmem_pool_new(const struct qcom_tzmem_pool_config *config);
+void qcom_tzmem_pool_free(struct qcom_tzmem_pool *pool);
+struct qcom_tzmem_pool *
+devm_qcom_tzmem_pool_new(struct device *dev,
+			 const struct qcom_tzmem_pool_config *config);
+
+void *qcom_tzmem_alloc(struct qcom_tzmem_pool *pool, size_t size, gfp_t gfp);
+void qcom_tzmem_free(void *ptr);
+
+#if IS_ENABLED(CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE)
+int qcom_tzmem_init_area(struct qcom_tzmem_area *area);
+void qcom_tzmem_cleanup_area(struct qcom_tzmem_area *area);
+#else
+static int qcom_tzmem_init_area(struct qcom_tzmem_area *area)
+{
+	return 0;
+}
+
+static void qcom_tzmem_cleanup_area(struct qcom_tzmem_area *area)
+{
+
+}
+#endif
+DEFINE_FREE(qcom_tzmem, void *, if (_T) qcom_tzmem_free(_T))
+
+phys_addr_t qcom_tzmem_to_phys(void *ptr);
+
+int32_t qcom_tzmem_deregister(uint64_t handle);
+int32_t qcom_tzmem_register(
+		phys_addr_t paddr,
+		size_t size,
+		uint32_t *ns_vmid_list,
+		uint32_t *ns_vm_perm_list,
+		uint32_t ns_vmid_num,
+		uint32_t tz_perm,
+		uint64_t *handle);
+
+#endif /* __QCOM_TZMEM */
--- linux-qcom-6.8.0.orig/include/linux/fortify-string.h
+++ linux-qcom-6.8.0/include/linux/fortify-string.h
@@ -31,17 +31,30 @@
 	__ret;							\
 })
 
-#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
+#if defined(__SANITIZE_ADDRESS__)
+
+#if !defined(CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX) && !defined(CONFIG_GENERIC_ENTRY)
+extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset);
+extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove);
+extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy);
+#elif defined(CONFIG_KASAN_GENERIC)
+extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(__asan_memset);
+extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(__asan_memmove);
+extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(__asan_memcpy);
+#else /* CONFIG_KASAN_SW_TAGS */
+extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(__hwasan_memset);
+extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(__hwasan_memmove);
+extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(__hwasan_memcpy);
+#endif
+
 extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr);
 extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp);
-extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy);
-extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove);
-extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset);
 extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat);
 extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy);
 extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen);
 extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat);
 extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy);
+
 #else
 
 #if defined(__SANITIZE_MEMORY__)
@@ -66,6 +79,7 @@
 #define __underlying_strlen	__builtin_strlen
 #define __underlying_strncat	__builtin_strncat
 #define __underlying_strncpy	__builtin_strncpy
+
 #endif
 
 /**
--- linux-qcom-6.8.0.orig/include/linux/fpga/fpga-bridge.h
+++ linux-qcom-6.8.0/include/linux/fpga/fpga-bridge.h
@@ -45,6 +45,7 @@
  * @dev: FPGA bridge device
  * @mutex: enforces exclusive reference to bridge
  * @br_ops: pointer to struct of FPGA bridge ops
+ * @br_ops_owner: module containing the br_ops
  * @info: fpga image specific information
  * @node: FPGA bridge list node
  * @priv: low level driver private date
@@ -54,6 +55,7 @@
 	struct device dev;
 	struct mutex mutex; /* for exclusive reference to bridge */
 	const struct fpga_bridge_ops *br_ops;
+	struct module *br_ops_owner;
 	struct fpga_image_info *info;
 	struct list_head node;
 	void *priv;
@@ -79,10 +81,12 @@
 			       struct fpga_image_info *info,
 			       struct list_head *bridge_list);
 
+#define fpga_bridge_register(parent, name, br_ops, priv) \
+	__fpga_bridge_register(parent, name, br_ops, priv, THIS_MODULE)
 struct fpga_bridge *
-fpga_bridge_register(struct device *parent, const char *name,
-		     const struct fpga_bridge_ops *br_ops,
-		     void *priv);
+__fpga_bridge_register(struct device *parent, const char *name,
+		       const struct fpga_bridge_ops *br_ops, void *priv,
+		       struct module *owner);
 void fpga_bridge_unregister(struct fpga_bridge *br);
 
 #endif /* _LINUX_FPGA_BRIDGE_H */
--- linux-qcom-6.8.0.orig/include/linux/fpga/fpga-mgr.h
+++ linux-qcom-6.8.0/include/linux/fpga/fpga-mgr.h
@@ -201,6 +201,7 @@
  * @state: state of fpga manager
  * @compat_id: FPGA manager id for compatibility check.
  * @mops: pointer to struct of fpga manager ops
+ * @mops_owner: module containing the mops
  * @priv: low level driver private date
  */
 struct fpga_manager {
@@ -210,6 +211,7 @@
 	enum fpga_mgr_states state;
 	struct fpga_compat_id *compat_id;
 	const struct fpga_manager_ops *mops;
+	struct module *mops_owner;
 	void *priv;
 };
 
@@ -230,18 +232,30 @@
 
 void fpga_mgr_put(struct fpga_manager *mgr);
 
+#define fpga_mgr_register_full(parent, info) \
+	__fpga_mgr_register_full(parent, info, THIS_MODULE)
 struct fpga_manager *
-fpga_mgr_register_full(struct device *parent, const struct fpga_manager_info *info);
+__fpga_mgr_register_full(struct device *parent, const struct fpga_manager_info *info,
+			 struct module *owner);
 
+#define fpga_mgr_register(parent, name, mops, priv) \
+	__fpga_mgr_register(parent, name, mops, priv, THIS_MODULE)
 struct fpga_manager *
-fpga_mgr_register(struct device *parent, const char *name,
-		  const struct fpga_manager_ops *mops, void *priv);
+__fpga_mgr_register(struct device *parent, const char *name,
+		    const struct fpga_manager_ops *mops, void *priv, struct module *owner);
+
 void fpga_mgr_unregister(struct fpga_manager *mgr);
 
+#define devm_fpga_mgr_register_full(parent, info) \
+	__devm_fpga_mgr_register_full(parent, info, THIS_MODULE)
 struct fpga_manager *
-devm_fpga_mgr_register_full(struct device *parent, const struct fpga_manager_info *info);
+__devm_fpga_mgr_register_full(struct device *parent, const struct fpga_manager_info *info,
+			      struct module *owner);
+#define devm_fpga_mgr_register(parent, name, mops, priv) \
+	__devm_fpga_mgr_register(parent, name, mops, priv, THIS_MODULE)
 struct fpga_manager *
-devm_fpga_mgr_register(struct device *parent, const char *name,
-		       const struct fpga_manager_ops *mops, void *priv);
+__devm_fpga_mgr_register(struct device *parent, const char *name,
+			 const struct fpga_manager_ops *mops, void *priv,
+			 struct module *owner);
 
 #endif /*_LINUX_FPGA_MGR_H */
--- linux-qcom-6.8.0.orig/include/linux/fpga/fpga-region.h
+++ linux-qcom-6.8.0/include/linux/fpga/fpga-region.h
@@ -36,6 +36,7 @@
  * @mgr: FPGA manager
  * @info: FPGA image info
  * @compat_id: FPGA region id for compatibility check.
+ * @ops_owner: module containing the get_bridges function
  * @priv: private data
  * @get_bridges: optional function to get bridges to a list
  */
@@ -46,6 +47,7 @@
 	struct fpga_manager *mgr;
 	struct fpga_image_info *info;
 	struct fpga_compat_id *compat_id;
+	struct module *ops_owner;
 	void *priv;
 	int (*get_bridges)(struct fpga_region *region);
 };
@@ -58,12 +60,17 @@
 
 int fpga_region_program_fpga(struct fpga_region *region);
 
+#define fpga_region_register_full(parent, info) \
+	__fpga_region_register_full(parent, info, THIS_MODULE)
 struct fpga_region *
-fpga_region_register_full(struct device *parent, const struct fpga_region_info *info);
+__fpga_region_register_full(struct device *parent, const struct fpga_region_info *info,
+			    struct module *owner);
 
+#define fpga_region_register(parent, mgr, get_bridges) \
+	__fpga_region_register(parent, mgr, get_bridges, THIS_MODULE)
 struct fpga_region *
-fpga_region_register(struct device *parent, struct fpga_manager *mgr,
-		     int (*get_bridges)(struct fpga_region *));
+__fpga_region_register(struct device *parent, struct fpga_manager *mgr,
+		       int (*get_bridges)(struct fpga_region *), struct module *owner);
 void fpga_region_unregister(struct fpga_region *region);
 
 #endif /* _FPGA_REGION_H */
--- linux-qcom-6.8.0.orig/include/linux/framer/framer.h
+++ linux-qcom-6.8.0/include/linux/framer/framer.h
@@ -181,12 +181,12 @@
 	return -ENOSYS;
 }
 
-struct framer *framer_get(struct device *dev, const char *con_id)
+static inline struct framer *framer_get(struct device *dev, const char *con_id)
 {
 	return ERR_PTR(-ENOSYS);
 }
 
-void framer_put(struct device *dev, struct framer *framer)
+static inline void framer_put(struct device *dev, struct framer *framer)
 {
 }
 
--- linux-qcom-6.8.0.orig/include/linux/fs.h
+++ linux-qcom-6.8.0/include/linux/fs.h
@@ -43,6 +43,7 @@
 #include <linux/cred.h>
 #include <linux/mnt_idmapping.h>
 #include <linux/slab.h>
+#include <linux/maple_tree.h>
 
 #include <asm/byteorder.h>
 #include <uapi/linux/fs.h>
@@ -642,6 +643,7 @@
 	umode_t			i_mode;
 	unsigned short		i_opflags;
 	kuid_t			i_uid;
+	struct list_head	i_lru;		/* inode LRU list */
 	kgid_t			i_gid;
 	unsigned int		i_flags;
 
@@ -703,7 +705,6 @@
 	u16			i_wb_frn_avg_time;
 	u16			i_wb_frn_history;
 #endif
-	struct list_head	i_lru;		/* inode LRU list */
 	struct list_head	i_sb_list;
 	struct list_head	i_wb_list;	/* backing dev writeback list */
 	union {
@@ -1038,7 +1039,7 @@
 	__u32 handle_bytes;
 	int handle_type;
 	/* file identifier */
-	unsigned char f_handle[];
+	unsigned char f_handle[] __counted_by(handle_bytes);
 };
 
 static inline struct file *get_file(struct file *f)
@@ -2158,7 +2159,7 @@
 #ifdef CONFIG_QUOTA
 	ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
 	ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
-	struct dquot **(*get_dquots)(struct inode *);
+	struct dquot __rcu **(*get_dquots)(struct inode *);
 #endif
 	long (*nr_cached_objects)(struct super_block *,
 				  struct shrink_control *);
@@ -2348,6 +2349,9 @@
  *
  * I_PINNING_FSCACHE_WB	Inode is pinning an fscache object for writeback.
  *
+ * I_LRU_ISOLATING	Inode is pinned being isolated from LRU without holding
+ *			i_count.
+ *
  * Q: What is the difference between I_WILL_FREE and I_FREEING?
  */
 #define I_DIRTY_SYNC		(1 << 0)
@@ -2371,6 +2375,8 @@
 #define I_DONTCACHE		(1 << 16)
 #define I_SYNC_QUEUED		(1 << 17)
 #define I_PINNING_NETFS_WB	(1 << 18)
+#define __I_LRU_ISOLATING	19
+#define I_LRU_ISOLATING		(1 << __I_LRU_ISOLATING)
 
 #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
 #define I_DIRTY (I_DIRTY_INODE | I_DIRTY_PAGES)
@@ -2927,6 +2933,17 @@
 
 extern char *file_path(struct file *, char *, int);
 
+/**
+ * is_dot_dotdot - returns true only if @name is "." or ".."
+ * @name: file name to check
+ * @len: length of file name, in bytes
+ */
+static inline bool is_dot_dotdot(const char *name, size_t len)
+{
+	return len && unlikely(name[0] == '.') &&
+		(len == 1 || (len == 2 && name[1] == '.'));
+}
+
 #include <linux/err.h>
 
 /* needed for stackable file system support */
@@ -3259,13 +3276,15 @@
 		const void __user *from, size_t count);
 
 struct offset_ctx {
-	struct xarray		xa;
-	u32			next_offset;
+	struct maple_tree	mt;
+	unsigned long		next_offset;
 };
 
 void simple_offset_init(struct offset_ctx *octx);
 int simple_offset_add(struct offset_ctx *octx, struct dentry *dentry);
 void simple_offset_remove(struct offset_ctx *octx, struct dentry *dentry);
+int simple_offset_rename(struct inode *old_dir, struct dentry *old_dentry,
+			 struct inode *new_dir, struct dentry *new_dentry);
 int simple_offset_rename_exchange(struct inode *old_dir,
 				  struct dentry *old_dentry,
 				  struct inode *new_dir,
@@ -3281,6 +3300,15 @@
 
 extern void generic_set_encrypted_ci_d_ops(struct dentry *dentry);
 
+static inline bool sb_has_encoding(const struct super_block *sb)
+{
+#if IS_ENABLED(CONFIG_UNICODE)
+	return !!sb->s_encoding;
+#else
+	return false;
+#endif
+}
+
 int may_setattr(struct mnt_idmap *idmap, struct inode *inode,
 		unsigned int ia_valid);
 int setattr_prepare(struct mnt_idmap *, struct dentry *, struct iattr *);
--- linux-qcom-6.8.0.orig/include/linux/fs_parser.h
+++ linux-qcom-6.8.0/include/linux/fs_parser.h
@@ -28,7 +28,7 @@
  */
 fs_param_type fs_param_is_bool, fs_param_is_u32, fs_param_is_s32, fs_param_is_u64,
 	fs_param_is_enum, fs_param_is_string, fs_param_is_blob, fs_param_is_blockdev,
-	fs_param_is_path, fs_param_is_fd;
+	fs_param_is_path, fs_param_is_fd, fs_param_is_uid, fs_param_is_gid;
 
 /*
  * Specification of the type of value a parameter wants.
@@ -57,6 +57,8 @@
 		int		int_32;		/* For spec_s32/spec_enum */
 		unsigned int	uint_32;	/* For spec_u32{,_octal,_hex}/spec_enum */
 		u64		uint_64;	/* For spec_u64 */
+		kuid_t		uid;
+		kgid_t		gid;
 	};
 };
 
@@ -131,5 +133,7 @@
 #define fsparam_bdev(NAME, OPT)	__fsparam(fs_param_is_blockdev, NAME, OPT, 0, NULL)
 #define fsparam_path(NAME, OPT)	__fsparam(fs_param_is_path, NAME, OPT, 0, NULL)
 #define fsparam_fd(NAME, OPT)	__fsparam(fs_param_is_fd, NAME, OPT, 0, NULL)
+#define fsparam_uid(NAME, OPT) __fsparam(fs_param_is_uid, NAME, OPT, 0, NULL)
+#define fsparam_gid(NAME, OPT) __fsparam(fs_param_is_gid, NAME, OPT, 0, NULL)
 
 #endif /* _LINUX_FS_PARSER_H */
--- linux-qcom-6.8.0.orig/include/linux/fscache-cache.h
+++ linux-qcom-6.8.0/include/linux/fscache-cache.h
@@ -19,6 +19,7 @@
 enum fscache_cache_trace;
 enum fscache_cookie_trace;
 enum fscache_access_trace;
+enum fscache_volume_trace;
 
 enum fscache_cache_state {
 	FSCACHE_CACHE_IS_NOT_PRESENT,	/* No cache is present for this name */
@@ -97,6 +98,11 @@
 
 extern void fscache_io_error(struct fscache_cache *cache);
 
+extern struct fscache_volume *
+fscache_try_get_volume(struct fscache_volume *volume,
+		       enum fscache_volume_trace where);
+extern void fscache_put_volume(struct fscache_volume *volume,
+			       enum fscache_volume_trace where);
 extern void fscache_end_volume_access(struct fscache_volume *volume,
 				      struct fscache_cookie *cookie,
 				      enum fscache_access_trace why);
--- linux-qcom-6.8.0.orig/include/linux/fsl/enetc_mdio.h
+++ linux-qcom-6.8.0/include/linux/fsl/enetc_mdio.h
@@ -59,7 +59,8 @@
 static inline int enetc_mdio_write_c45(struct mii_bus *bus, int phy_id,
 				       int devad, int regnum, u16 value)
 { return -EINVAL; }
-struct enetc_hw *enetc_hw_alloc(struct device *dev, void __iomem *port_regs)
+static inline struct enetc_hw *enetc_hw_alloc(struct device *dev,
+					      void __iomem *port_regs)
 { return ERR_PTR(-EINVAL); }
 
 #endif
--- linux-qcom-6.8.0.orig/include/linux/fsnotify.h
+++ linux-qcom-6.8.0/include/linux/fsnotify.h
@@ -93,7 +93,13 @@
 {
 	const struct path *path;
 
-	if (file->f_mode & FMODE_NONOTIFY)
+	/*
+	 * FMODE_NONOTIFY are fds generated by fanotify itself which should not
+	 * generate new events. We also don't want to generate events for
+	 * FMODE_PATH fds (involves open & close events) as they are just
+	 * handle creation / destruction events and not "real" file events.
+	 */
+	if (file->f_mode & (FMODE_NONOTIFY | FMODE_PATH))
 		return 0;
 
 	path = &file->f_path;
--- linux-qcom-6.8.0.orig/include/linux/fsnotify_backend.h
+++ linux-qcom-6.8.0/include/linux/fsnotify_backend.h
@@ -563,12 +563,14 @@
 
 static inline int fsnotify_inode_watches_children(struct inode *inode)
 {
+	__u32 parent_mask = READ_ONCE(inode->i_fsnotify_mask);
+
 	/* FS_EVENT_ON_CHILD is set if the inode may care */
-	if (!(inode->i_fsnotify_mask & FS_EVENT_ON_CHILD))
+	if (!(parent_mask & FS_EVENT_ON_CHILD))
 		return 0;
 	/* this inode might care about child events, does it care about the
 	 * specific set of events that can happen on a child? */
-	return inode->i_fsnotify_mask & FS_EVENTS_POSS_ON_CHILD;
+	return parent_mask & FS_EVENTS_POSS_ON_CHILD;
 }
 
 /*
@@ -582,7 +584,7 @@
 	/*
 	 * Serialisation of setting PARENT_WATCHED on the dentries is provided
 	 * by d_lock. If inotify_inode_watched changes after we have taken
-	 * d_lock, the following __fsnotify_update_child_dentry_flags call will
+	 * d_lock, the following fsnotify_set_children_dentry_flags call will
 	 * find our entry, so it will spin until we complete here, and update
 	 * us with the new state.
 	 */
--- linux-qcom-6.8.0.orig/include/linux/ftrace.h
+++ linux-qcom-6.8.0/include/linux/ftrace.h
@@ -87,15 +87,15 @@
 
 #if defined(CONFIG_FUNCTION_TRACER) && defined(CONFIG_MODULES) && \
 	defined(CONFIG_DYNAMIC_FTRACE)
-const char *
+int
 ftrace_mod_address_lookup(unsigned long addr, unsigned long *size,
 		   unsigned long *off, char **modname, char *sym);
 #else
-static inline const char *
+static inline int
 ftrace_mod_address_lookup(unsigned long addr, unsigned long *size,
 		   unsigned long *off, char **modname, char *sym)
 {
-	return NULL;
+	return 0;
 }
 #endif
 
--- linux-qcom-6.8.0.orig/include/linux/fwnode.h
+++ linux-qcom-6.8.0/include/linux/fwnode.h
@@ -53,8 +53,10 @@
  * fwnode link flags
  *
  * CYCLE:	The fwnode link is part of a cycle. Don't defer probe.
+ * IGNORE:	Completely ignore this link, even during cycle detection.
  */
 #define FWLINK_FLAG_CYCLE			BIT(0)
+#define FWLINK_FLAG_IGNORE			BIT(1)
 
 struct fwnode_link {
 	struct fwnode_handle *supplier;
--- linux-qcom-6.8.0.orig/include/linux/gfp_types.h
+++ linux-qcom-6.8.0/include/linux/gfp_types.h
@@ -2,6 +2,8 @@
 #ifndef __LINUX_GFP_TYPES_H
 #define __LINUX_GFP_TYPES_H
 
+#include <linux/bits.h>
+
 /* The typedef is in types.h but we want the documentation here */
 #if 0
 /**
--- linux-qcom-6.8.0.orig/include/linux/gpio/property.h
+++ linux-qcom-6.8.0/include/linux/gpio/property.h
@@ -2,7 +2,6 @@
 #ifndef __LINUX_GPIO_PROPERTY_H
 #define __LINUX_GPIO_PROPERTY_H
 
-#include <dt-bindings/gpio/gpio.h> /* for GPIO_* flags */
 #include <linux/property.h>
 
 #define PROPERTY_ENTRY_GPIO(_name_, _chip_node_, _idx_, _flags_) \
--- linux-qcom-6.8.0.orig/include/linux/gunyah.h
+++ linux-qcom-6.8.0/include/linux/gunyah.h
@@ -0,0 +1,207 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _LINUX_GUNYAH_H
+#define _LINUX_GUNYAH_H
+
+#include <linux/bitfield.h>
+#include <linux/errno.h>
+#include <linux/interrupt.h>
+#include <linux/limits.h>
+#include <linux/mailbox_controller.h>
+#include <linux/mailbox_client.h>
+#include <linux/types.h>
+
+/* Matches resource manager's resource types for VM_GET_HYP_RESOURCES RPC */
+enum gh_resource_type {
+	GH_RESOURCE_TYPE_BELL_TX	= 0,
+	GH_RESOURCE_TYPE_BELL_RX	= 1,
+	GH_RESOURCE_TYPE_MSGQ_TX	= 2,
+	GH_RESOURCE_TYPE_MSGQ_RX	= 3,
+	GH_RESOURCE_TYPE_VCPU		= 4,
+};
+
+struct gh_resource {
+	enum gh_resource_type type;
+	u64 capid;
+	unsigned int irq;
+
+	struct list_head list;
+	u32 rm_label;
+};
+
+/**
+ * Gunyah Message Queues
+ */
+
+#define GH_MSGQ_MAX_MSG_SIZE		240
+
+struct gh_msgq_tx_data {
+	size_t length;
+	bool push;
+	char data[];
+};
+
+struct gh_msgq_rx_data {
+	size_t length;
+	char data[GH_MSGQ_MAX_MSG_SIZE];
+};
+
+struct gh_msgq {
+	struct gh_resource *tx_ghrsc;
+	struct gh_resource *rx_ghrsc;
+
+	/* msgq private */
+	int last_ret; /* Linux error, not GH_STATUS_* */
+	struct mbox_chan mbox_chan;
+	struct mbox_controller mbox;
+	struct tasklet_struct txdone_tasklet;
+};
+
+
+int gh_msgq_init(struct device *parent, struct gh_msgq *msgq, struct mbox_client *cl,
+		     struct gh_resource *tx_ghrsc, struct gh_resource *rx_ghrsc);
+void gh_msgq_remove(struct gh_msgq *msgq);
+
+static inline struct mbox_chan *gh_msgq_chan(struct gh_msgq *msgq)
+{
+	return &msgq->mbox.chans[0];
+}
+
+/******************************************************************************/
+/* Common arch-independent definitions for Gunyah hypercalls                  */
+
+#define GH_CAPID_INVAL	U64_MAX
+#define GH_VMID_ROOT_VM	0xff
+
+enum gh_error {
+	GH_ERROR_OK			= 0,
+	GH_ERROR_UNIMPLEMENTED		= -1,
+	GH_ERROR_RETRY			= -2,
+
+	GH_ERROR_ARG_INVAL		= 1,
+	GH_ERROR_ARG_SIZE		= 2,
+	GH_ERROR_ARG_ALIGN		= 3,
+
+	GH_ERROR_NOMEM			= 10,
+
+	GH_ERROR_ADDR_OVFL		= 20,
+	GH_ERROR_ADDR_UNFL		= 21,
+	GH_ERROR_ADDR_INVAL		= 22,
+
+	GH_ERROR_DENIED			= 30,
+	GH_ERROR_BUSY			= 31,
+	GH_ERROR_IDLE			= 32,
+
+	GH_ERROR_IRQ_BOUND		= 40,
+	GH_ERROR_IRQ_UNBOUND		= 41,
+
+	GH_ERROR_CSPACE_CAP_NULL	= 50,
+	GH_ERROR_CSPACE_CAP_REVOKED	= 51,
+	GH_ERROR_CSPACE_WRONG_OBJ_TYPE	= 52,
+	GH_ERROR_CSPACE_INSUF_RIGHTS	= 53,
+	GH_ERROR_CSPACE_FULL		= 54,
+
+	GH_ERROR_MSGQUEUE_EMPTY		= 60,
+	GH_ERROR_MSGQUEUE_FULL		= 61,
+};
+
+/**
+ * gh_error_remap() - Remap Gunyah hypervisor errors into a Linux error code
+ * @gh_error: Gunyah hypercall return value
+ */
+static inline int gh_error_remap(enum gh_error gh_error)
+{
+	switch (gh_error) {
+	case GH_ERROR_OK:
+		return 0;
+	case GH_ERROR_NOMEM:
+		return -ENOMEM;
+	case GH_ERROR_DENIED:
+	case GH_ERROR_CSPACE_CAP_NULL:
+	case GH_ERROR_CSPACE_CAP_REVOKED:
+	case GH_ERROR_CSPACE_WRONG_OBJ_TYPE:
+	case GH_ERROR_CSPACE_INSUF_RIGHTS:
+	case GH_ERROR_CSPACE_FULL:
+		return -EACCES;
+	case GH_ERROR_BUSY:
+	case GH_ERROR_IDLE:
+		return -EBUSY;
+	case GH_ERROR_IRQ_BOUND:
+	case GH_ERROR_IRQ_UNBOUND:
+	case GH_ERROR_MSGQUEUE_FULL:
+	case GH_ERROR_MSGQUEUE_EMPTY:
+		return -EIO;
+	case GH_ERROR_UNIMPLEMENTED:
+	case GH_ERROR_RETRY:
+		return -EOPNOTSUPP;
+	default:
+		return -EINVAL;
+	}
+}
+
+enum gh_api_feature {
+	GH_FEATURE_DOORBELL 	= 1,
+	GH_FEATURE_MSGQUEUE 	= 2,
+	GH_FEATURE_VCPU 	= 5,
+	GH_FEATURE_MEMEXTENT 	= 6,
+};
+
+bool arch_is_gh_guest(void);
+
+#define GH_API_V1			1
+
+/* Other bits reserved for future use and will be zero */
+#define GH_API_INFO_API_VERSION_MASK	GENMASK_ULL(13, 0)
+#define GH_API_INFO_BIG_ENDIAN		BIT_ULL(14)
+#define GH_API_INFO_IS_64BIT		BIT_ULL(15)
+#define GH_API_INFO_VARIANT_MASK	GENMASK_ULL(63, 56)
+
+struct gh_hypercall_hyp_identify_resp {
+	u64 api_info;
+	u64 flags[3];
+};
+
+static inline u16 gh_api_version(const struct gh_hypercall_hyp_identify_resp *gh_api)
+{
+	return FIELD_GET(GH_API_INFO_API_VERSION_MASK, gh_api->api_info);
+}
+
+void gh_hypercall_hyp_identify(struct gh_hypercall_hyp_identify_resp *hyp_identity);
+
+enum gh_error gh_hypercall_bell_send(u64 capid, u64 new_flags, u64 *old_flags);
+enum gh_error gh_hypercall_bell_set_mask(u64 capid, u64 enable_mask, u64 ack_mask);
+
+#define GH_HYPERCALL_MSGQ_TX_FLAGS_PUSH		BIT(0)
+
+enum gh_error gh_hypercall_msgq_send(u64 capid, size_t size, void *buff, u64 tx_flags, bool *ready);
+enum gh_error gh_hypercall_msgq_recv(u64 capid, void *buff, size_t size, size_t *recv_size,
+					bool *ready);
+
+struct gh_hypercall_vcpu_run_resp {
+	union {
+		enum {
+			/* VCPU is ready to run */
+			GH_VCPU_STATE_READY		= 0,
+			/* VCPU is sleeping until an interrupt arrives */
+			GH_VCPU_STATE_EXPECTS_WAKEUP	= 1,
+			/* VCPU is powered off */
+			GH_VCPU_STATE_POWERED_OFF	= 2,
+			/* VCPU is blocked in EL2 for unspecified reason */
+			GH_VCPU_STATE_BLOCKED		= 3,
+			/* VCPU has returned for MMIO READ */
+			GH_VCPU_ADDRSPACE_VMMIO_READ	= 4,
+			/* VCPU has returned for MMIO WRITE */
+			GH_VCPU_ADDRSPACE_VMMIO_WRITE	= 5,
+		} state;
+		u64 sized_state;
+	};
+	u64 state_data[3];
+};
+
+enum gh_error gh_hypercall_vcpu_run(u64 capid, u64 *resume_data,
+					struct gh_hypercall_vcpu_run_resp *resp);
+
+#endif
--- linux-qcom-6.8.0.orig/include/linux/gunyah/gh_common.h
+++ linux-qcom-6.8.0/include/linux/gunyah/gh_common.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+#ifndef __GH_COMMON_H
+#define __GH_COMMON_H
+
+#include <linux/types.h>
+
+/* Common Gunyah types */
+typedef u16 gh_vmid_t;
+typedef u32 gh_rm_msgid_t;
+typedef u32 gh_virq_handle_t;
+typedef u32 gh_label_t;
+typedef u32 gh_memparcel_handle_t;
+typedef u64 gh_capid_t;
+typedef u64 gh_dbl_flags_t;
+
+struct gh_vminfo {
+	u8 *guid;
+	char *uri;
+	char *name;
+	char *sign_auth;
+};
+
+/* Common Gunyah macros */
+#define GH_CAPID_INVAL	U64_MAX
+#define GH_VMID_INVAL	U16_MAX
+
+enum gh_vm_names {
+	/*
+	 * GH_SELF_VM is an alias for VMID 0. Useful for RM APIs which allow
+	 * operations on current VM such as console
+	 */
+	GH_SELF_VM,
+	GH_PRIMARY_VM,
+	GH_TRUSTED_VM,
+	GH_CPUSYS_VM,
+	GH_OEM_VM,
+	GH_VM_MAX
+};
+
+#endif
--- linux-qcom-6.8.0.orig/include/linux/gunyah/gh_rm_drv.h
+++ linux-qcom-6.8.0/include/linux/gunyah/gh_rm_drv.h
@@ -0,0 +1,775 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+#ifndef __GH_RM_DRV_H
+#define __GH_RM_DRV_H
+
+#include <linux/types.h>
+#include <linux/notifier.h>
+#include <linux/fwnode.h>
+#include <linux/gunyah_rsc_mgr.h>
+#include <linux/range.h>
+
+#include "gh_common.h"
+
+/* Notification type Message IDs */
+/* Memory APIs */
+#define GH_RM_NOTIF_MEM_SHARED		0x51100011
+#define GH_RM_NOTIF_MEM_RELEASED	0x51100012
+#define GH_RM_NOTIF_MEM_ACCEPTED	0x51100013
+
+#define GH_RM_MEM_TYPE_NORMAL	0
+#define GH_RM_MEM_TYPE_IO	1
+
+#define GH_RM_TRANS_TYPE_DONATE	0
+#define GH_RM_TRANS_TYPE_LEND	1
+#define GH_RM_TRANS_TYPE_SHARE	2
+
+#define GH_RM_ACL_X		BIT(0)
+#define GH_RM_ACL_W		BIT(1)
+#define GH_RM_ACL_R		BIT(2)
+
+#define GH_RM_MEM_RELEASE_CLEAR BIT(0)
+#define GH_RM_MEM_RECLAIM_CLEAR BIT(0)
+
+#define GH_RM_MEM_ACCEPT_VALIDATE_SANITIZED	BIT(0)
+#define GH_RM_MEM_ACCEPT_VALIDATE_ACL_ATTRS	BIT(1)
+#define GH_RM_MEM_ACCEPT_VALIDATE_LABEL		BIT(2)
+#define GH_RM_MEM_ACCEPT_MAP_IPA_CONTIGUOUS	BIT(4)
+#define GH_RM_MEM_ACCEPT_DONE			BIT(7)
+
+#define GH_RM_MEM_SHARE_SANITIZE		BIT(0)
+#define GH_RM_MEM_SHARE_APPEND			BIT(1)
+#define GH_RM_MEM_LEND_SANITIZE			BIT(0)
+#define GH_RM_MEM_LEND_APPEND			BIT(1)
+#define GH_RM_MEM_DONATE_SANITIZE		BIT(0)
+#define GH_RM_MEM_DONATE_APPEND			BIT(1)
+
+#define GH_RM_MEM_APPEND_END			BIT(0)
+
+#define GH_RM_MEM_NOTIFY_RECIPIENT_SHARED	BIT(0)
+#define GH_RM_MEM_NOTIFY_RECIPIENT	GH_RM_MEM_NOTIFY_RECIPIENT_SHARED
+#define GH_RM_MEM_NOTIFY_OWNER_RELEASED		BIT(1)
+#define GH_RM_MEM_NOTIFY_OWNER		GH_RM_MEM_NOTIFY_OWNER_RELEASED
+#define GH_RM_MEM_NOTIFY_OWNER_ACCEPTED		BIT(2)
+
+/* Support may vary across hardware platforms */
+#define GH_RM_IPA_RESERVE_ECC			BIT(0)
+#define GH_RM_IPA_RESERVE_MEMTAG		BIT(1)
+#define GH_RM_IPA_RESERVE_NORMAL		BIT(2)
+#define GH_RM_IPA_RESERVE_IO			BIT(3)
+/* BIT(4) and BIT(5) reserved */
+/* The calling VM's default memory type */
+#define GH_RM_IPA_RESERVE_DEFAULT		BIT(6)
+#define GH_RM_IPA_RESERVE_VALID_FLAGS		(GENMASK(3, 0) | BIT(6))
+
+#define GH_RM_IPA_RESERVE_PLATFORM_ENCRYPTED		BIT(0)
+#define GH_RM_IPA_RESERVE_PLATFORM_AUTHENTICATED	BIT(1)
+#define GH_RM_IPA_RESERVE_PLATFORM_ANTI_ROLLBACK	BIT(2)
+#define GH_RM_IPA_RESERVE_PLATFORM_VALID_FLAGS		GENMASK(2, 0)
+
+#define MAX_EXIT_REASON_SIZE			4
+
+struct gh_rm_mem_shared_acl_entry;
+struct gh_rm_mem_shared_sgl_entry;
+struct gh_rm_mem_shared_attr_entry;
+
+struct gh_rm_notif_mem_shared_payload {
+	u32 mem_handle;
+	u8 mem_type;
+	u8 trans_type;
+	u8 flags;
+	u8 reserved1;
+	u16 owner_vmid;
+	u16 reserved2;
+	u32 label;
+	gh_label_t mem_info_tag;
+	/* TODO: How to arrange multiple variable length struct arrays? */
+} __packed;
+
+struct gh_rm_mem_shared_acl_entry {
+	u16 acl_vmid;
+	u8 acl_rights;
+	u8 reserved;
+} __packed;
+
+struct gh_rm_mem_shared_sgl_entry {
+	u32 sgl_size_low;
+	u32 sgl_size_high;
+} __packed;
+
+struct gh_rm_mem_shared_attr_entry {
+	u16 attributes;
+	u16 attributes_vmid;
+} __packed;
+
+struct gh_rm_notif_mem_released_payload {
+	u32 mem_handle;
+	u16 participant_vmid;
+	u16 reserved;
+	gh_label_t mem_info_tag;
+} __packed;
+
+struct gh_rm_notif_mem_accepted_payload {
+	u32 mem_handle;
+	u16 participant_vmid;
+	u16 reserved;
+	gh_label_t mem_info_tag;
+} __packed;
+
+struct gh_acl_entry {
+	u16 vmid;
+	u8 perms;
+	u8 reserved;
+} __packed;
+
+struct gh_sgl_entry {
+	u64 ipa_base;
+	u64 size;
+} __packed;
+
+struct gh_mem_attr_entry {
+	u16 attr;
+	u16 vmid;
+} __packed;
+
+struct gh_acl_desc {
+	u32 n_acl_entries;
+	struct gh_acl_entry acl_entries[];
+} __packed;
+
+struct gh_sgl_desc {
+	u16 n_sgl_entries;
+	u16 reserved;
+	struct gh_sgl_entry sgl_entries[];
+} __packed;
+
+struct gh_mem_attr_desc {
+	u16 n_mem_attr_entries;
+	u16 reserved;
+	struct gh_mem_attr_entry attr_entries[];
+} __packed;
+
+struct gh_notify_vmid_entry {
+	u16 vmid;
+	u16 reserved;
+} __packed;
+
+struct gh_notify_vmid_desc {
+	u16 n_vmid_entries;
+	u16 reserved;
+	struct gh_notify_vmid_entry vmid_entries[];
+} __packed;
+
+/* VM APIs */
+#define GH_RM_NOTIF_VM_EXITED		0x56100001
+#define GH_RM_NOTIF_VM_SHUTDOWN		0x56100002
+#define GH_RM_NOTIF_VM_STATUS		0x56100008
+#define GH_RM_NOTIF_VM_IRQ_LENT		0x56100011
+#define GH_RM_NOTIF_VM_IRQ_RELEASED	0x56100012
+#define GH_RM_NOTIF_VM_IRQ_ACCEPTED	0x56100013
+
+/* AUTH mechanisms */
+#define GH_VM_UNAUTH			0
+#define GH_VM_AUTH_PIL_ELF		1
+#define GH_VM_AUTH_ANDROID_PVM		2
+
+/* AUTH_PARAM_TYPE mechanisms */
+#define GH_VM_AUTH_PARAM_PAS_ID		0 /* Used to pass peripheral auth id */
+
+#define GH_RM_VM_STATUS_NO_STATE	0
+#define GH_RM_VM_STATUS_INIT		1
+#define GH_RM_VM_STATUS_READY		2
+#define GH_RM_VM_STATUS_RUNNING		3
+#define GH_RM_VM_STATUS_PAUSED		4
+#define GH_RM_VM_STATUS_LOAD		5
+#define GH_RM_VM_STATUS_AUTH		6
+/* 7 is reserved */
+#define GH_RM_VM_STATUS_INIT_FAILED	8
+#define GH_RM_VM_STATUS_EXITED		9
+#define GH_RM_VM_STATUS_RESETTING	10
+#define GH_RM_VM_STATUS_RESET		11
+
+#define GH_RM_OS_STATUS_NONE		0
+#define GH_RM_OS_STATUS_EARLY_BOOT	1
+#define GH_RM_OS_STATUS_BOOT		2
+#define GH_RM_OS_STATUS_INIT		3
+#define GH_RM_OS_STATUS_RUN		4
+
+#define GH_RM_APP_STATUS_TUI_SERVICE_BOOT	1
+
+#define GH_RM_VM_STOP_FLAG_FORCE_STOP				0x01
+
+#define GH_RM_VM_EXIT_TYPE_VM_EXIT				0
+#define GH_RM_VM_EXIT_TYPE_SYSTEM_OFF		1
+#define GH_RM_VM_EXIT_TYPE_SYSTEM_RESET		2
+#define GH_RM_VM_EXIT_TYPE_SYSTEM_RESET2	3
+#define GH_RM_VM_EXIT_TYPE_WDT_BITE				4
+#define GH_RM_VM_EXIT_TYPE_HYP_ERROR			5
+#define GH_RM_VM_EXIT_TYPE_ASYNC_EXT_ABORT		6
+#define GH_RM_VM_EXIT_TYPE_VM_STOP_FORCED		7
+
+/* GH_RM_VM_EXIT_TYPE_VM_EXIT */
+struct gh_vm_exit_reason_vm_exit {
+	u16 exit_flags;
+	/* GH_VM_EXIT_EXIT_FLAG_* are bit representations */
+#define GH_VM_EXIT_EXIT_FLAG_TYPE	0x1
+#define GH_VM_EXIT_POWEROFF	0 /* Value at bit:0 */
+#define GH_VM_EXIT_RESTART	1 /* Value at bit:0 */
+#define GH_VM_EXIT_EXIT_FLAG_SYSTEM	0x2
+#define GH_VM_EXIT_EXIT_FLAG_WARM	0x4
+#define GH_VM_EXIT_EXIT_FLAG_DUMP	0x8
+
+	u8 exit_code;
+	/* Exit codes */
+#define GH_VM_EXIT_CODE_NORMAL	0
+#define GH_VM_EXIT_SOFTWARE_ERR	1
+#define GH_VM_EXIT_BUS_ERR		2
+#define GH_VM_EXIT_DEVICE_ERR	3
+
+	u8 reserved;
+} __packed;
+
+/* Reasons for VM_STOP */
+#define GH_VM_STOP_SHUTDOWN					0
+#define GH_VM_STOP_RESTART					1
+#define GH_VM_STOP_CRASH					2
+#define GH_VM_STOP_FORCE_STOP					3
+#define GH_VM_STOP_MAX						4
+struct gh_rm_notif_vm_exited_payload {
+	gh_vmid_t vmid;
+	u16 exit_type;
+	u32 exit_reason_size;
+	u32 exit_reason[];
+} __packed;
+
+struct gh_rm_notif_vm_shutdown_payload {
+	u32 stop_reason;
+} __packed;
+
+struct gh_rm_notif_vm_status_payload {
+	gh_vmid_t vmid;
+	u16 reserved;
+	u8 vm_status;
+	u8 os_status;
+	u16 app_status;
+} __packed;
+
+struct gh_rm_notif_vm_irq_lent_payload {
+	gh_vmid_t owner_vmid;
+	u16 reserved;
+	gh_virq_handle_t virq_handle;
+	gh_label_t virq_label;
+} __packed;
+
+struct gh_rm_notif_vm_irq_released_payload {
+	gh_virq_handle_t virq_handle;
+} __packed;
+
+struct gh_rm_notif_vm_irq_accepted_payload {
+	gh_virq_handle_t virq_handle;
+} __packed;
+
+struct gh_vm_auth_param_entry {
+	u32 auth_param_type;
+	u32 auth_param;
+} __packed;
+
+/* Arch specific APIs */
+#if IS_ENABLED(CONFIG_GH_ARM64_DRV)
+/* IRQ APIs */
+int gh_get_irq(u32 virq, u32 type, struct fwnode_handle *handle);
+int gh_put_irq(int irq);
+int gh_get_virq(int base_virq, int virq);
+int gh_put_virq(int irq);
+int gh_arch_validate_vm_exited_notif(size_t payload_size,
+	struct gh_rm_notif_vm_exited_payload *payload);
+#else
+static inline int gh_get_irq(u32 virq, u32 type,
+					struct fwnode_handle *handle)
+{
+	return -EINVAL;
+}
+static inline int gh_put_irq(int irq)
+{
+	return -EINVAL;
+}
+static inline int gh_get_virq(int base_virq, int virq)
+{
+	return -EINVAL;
+}
+static inline int gh_put_virq(int irq)
+{
+	return -EINVAL;
+}
+static inline int gh_arch_validate_vm_exited_notif(size_t payload_size,
+	struct gh_rm_notif_vm_exited_payload *payload)
+{
+	return -EINVAL;
+}
+#endif
+/* VM Services */
+#define GH_RM_NOTIF_VM_CONSOLE_CHARS	0X56100080
+
+struct gh_rm_notif_vm_console_chars {
+	gh_vmid_t vmid;
+	u16 num_bytes;
+	u8 bytes[];
+} __packed;
+
+struct gh_vm_status {
+	u8 vm_status;
+	u8 os_status;
+	u16 app_status;
+} __packed;
+
+struct notifier_block;
+
+typedef int (*gh_virtio_mmio_cb_t)(gh_vmid_t peer, const char *vm_name,
+	gh_label_t label, gh_capid_t cap_id, int linux_irq, u64 base, u64 size);
+typedef int (*gh_wdog_manage_cb_t)(gh_vmid_t vmid, gh_capid_t cap_id, bool populate);
+typedef int (*gh_vcpu_affinity_set_cb_t)(gh_vmid_t vmid, gh_label_t label,
+						gh_capid_t cap_id, int linux_irq);
+typedef int (*gh_vcpu_affinity_reset_cb_t)(gh_vmid_t vmid, gh_label_t label,
+						gh_capid_t cap_id, int *linux_irq);
+typedef int (*gh_vpm_grp_set_cb_t)(gh_vmid_t vmid, gh_capid_t cap_id, int linux_irq);
+typedef int (*gh_vpm_grp_reset_cb_t)(gh_vmid_t vmid, int *linux_irq);
+typedef void (*gh_all_res_populated_cb_t)(gh_vmid_t vmid, bool res_populated);
+
+#if IS_ENABLED(CONFIG_GH_RM_DRV)
+/* RM client registration APIs */
+int gh_rm_register_notifier(struct notifier_block *nb);
+int gh_rm_unregister_notifier(struct notifier_block *nb);
+
+/* Client APIs for IRQ management */
+int gh_rm_virq_to_irq(u32 virq, u32 type);
+int gh_rm_irq_to_virq(int irq, u32 *virq);
+
+int gh_rm_vm_irq_lend(gh_vmid_t vmid,
+		      int virq,
+		      int label,
+		      gh_virq_handle_t *virq_handle);
+int gh_rm_vm_irq_lend_notify(gh_vmid_t vmid, gh_virq_handle_t virq_handle);
+int gh_rm_vm_irq_accept(gh_virq_handle_t virq_handle, int virq);
+int gh_rm_vm_irq_accept_notify(gh_vmid_t vmid, gh_virq_handle_t virq_handle);
+int gh_rm_vm_irq_release(gh_virq_handle_t virq_handle);
+int gh_rm_vm_irq_release_notify(gh_vmid_t vmid, gh_virq_handle_t virq_handle);
+
+
+int gh_rm_vm_irq_reclaim(gh_virq_handle_t virq_handle);
+
+int gh_rm_set_virtio_mmio_cb(gh_virtio_mmio_cb_t fnptr);
+void gh_rm_unset_virtio_mmio_cb(void);
+int gh_rm_set_wdog_manage_cb(gh_wdog_manage_cb_t fnptr);
+int gh_rm_set_vcpu_affinity_cb(gh_vcpu_affinity_set_cb_t fnptr);
+int gh_rm_reset_vcpu_affinity_cb(gh_vcpu_affinity_reset_cb_t fnptr);
+int gh_rm_set_vpm_grp_cb(gh_vpm_grp_set_cb_t fnptr);
+int gh_rm_reset_vpm_grp_cb(gh_vpm_grp_reset_cb_t fnptr);
+int gh_rm_all_res_populated_cb(gh_all_res_populated_cb_t fnptr);
+
+/* Client APIs for VM management */
+int gh_rm_vm_alloc_vmid(enum gh_vm_names vm_name, int *vmid);
+int gh_rm_vm_dealloc_vmid(gh_vmid_t vmid);
+int gh_rm_vm_config_image(gh_vmid_t vmid, u16 auth_mech, u32 mem_handle,
+	u64 image_offset, u64 image_size, u64 dtb_offset, u64 dtb_size);
+int gh_rm_vm_auth_image(gh_vmid_t vmid, ssize_t n_entries,
+				struct gh_vm_auth_param_entry *entry);
+int ghd_rm_vm_init(gh_vmid_t vmid);
+int ghd_rm_get_vmid(enum gh_vm_names vm_name, gh_vmid_t *vmid);
+int gh_rm_get_vm_id_info(gh_vmid_t vmid);
+int gh_rm_get_vm_name(gh_vmid_t vmid, enum gh_vm_names *vm_name);
+int gh_rm_get_vminfo(enum gh_vm_names vm_name, struct gh_vminfo *vminfo);
+int ghd_rm_vm_start(int vmid);
+enum gh_vm_names gh_get_image_name(const char *str);
+enum gh_vm_names gh_get_vm_name(const char *str);
+int gh_rm_get_this_vmid(gh_vmid_t *vmid);
+int ghd_rm_vm_stop(gh_vmid_t vmid, u32 stop_reason, u8 flags);
+int ghd_rm_vm_reset(gh_vmid_t vmid);
+
+/* Client APIs for VM query */
+int gh_rm_populate_hyp_res(gh_vmid_t vmid, const char *vm_name);
+int gh_rm_unpopulate_hyp_res(gh_vmid_t vmid, const char *vm_name);
+
+/* Client APIs for VM Services */
+struct gh_vm_status *gh_rm_vm_get_status(gh_vmid_t vmid);
+int gh_rm_vm_set_status(struct gh_vm_status gh_vm_status);
+int gh_rm_vm_set_vm_status(u8 vm_status);
+int gh_rm_vm_set_os_status(u8 os_status);
+int gh_rm_vm_set_app_status(u16 app_status);
+int gh_rm_console_open(gh_vmid_t vmid);
+int gh_rm_console_close(gh_vmid_t vmid);
+int gh_rm_console_write(gh_vmid_t vmid, const char *buf, size_t size);
+int gh_rm_console_flush(gh_vmid_t vmid);
+int gh_rm_mem_qcom_lookup_sgl(u8 mem_type, gh_label_t label,
+			      struct gh_acl_desc *acl_desc,
+			      struct gh_sgl_desc *sgl_desc,
+			      struct gh_mem_attr_desc *mem_attr_desc,
+			      gh_memparcel_handle_t *handle);
+int gh_rm_mem_release(gh_memparcel_handle_t handle, u8 flags);
+int ghd_rm_mem_reclaim(gh_memparcel_handle_t handle, u8 flags);
+struct gh_sgl_desc *gh_rm_mem_accept(gh_memparcel_handle_t handle, u8 mem_type,
+				     u8 trans_type, u8 flags, gh_label_t label,
+				     struct gh_acl_desc *acl_desc,
+				     struct gh_sgl_desc *sgl_desc,
+				     struct gh_mem_attr_desc *mem_attr_desc,
+				     u16 map_vmid);
+int ghd_rm_mem_share(u8 mem_type, u8 flags, gh_label_t label,
+		    struct gh_acl_desc *acl_desc, struct gh_sgl_desc *sgl_desc,
+		    struct gh_mem_attr_desc *mem_attr_desc,
+		    gh_memparcel_handle_t *handle);
+int ghd_rm_mem_lend(u8 mem_type, u8 flags, gh_label_t label,
+		   struct gh_acl_desc *acl_desc, struct gh_sgl_desc *sgl_desc,
+		   struct gh_mem_attr_desc *mem_attr_desc,
+		   gh_memparcel_handle_t *handle);
+int gh_rm_mem_donate(u8 mem_type, u8 flags, gh_label_t label,
+		   struct gh_acl_desc *acl_desc, struct gh_sgl_desc *sgl_desc,
+		   struct gh_mem_attr_desc *mem_attr_desc,
+		   gh_memparcel_handle_t *handle);
+int gh_rm_mem_notify(gh_memparcel_handle_t handle, u8 flags,
+		     gh_label_t mem_info_tag,
+		     struct gh_notify_vmid_desc *vmid_desc);
+int gh_rm_ipa_reserve(u64 size, u64 align, struct range limits, u32 generic_constraints,
+		      u32 platform_constraints, u64 *ipa);
+
+/* API to set time base */
+int gh_rm_vm_set_time_base(gh_vmid_t vmid);
+
+/* API for minidump support */
+int gh_rm_minidump_get_info(void);
+int gh_rm_minidump_register_range(phys_addr_t base_ipa, size_t region_size,
+				  const char *name, size_t name_size);
+int gh_rm_minidump_deregister_slot(uint16_t slot_num);
+int gh_rm_minidump_get_slot_from_name(uint16_t starting_slot, const char *name,
+				      size_t name_size);
+
+#else
+/* RM client register notifications APIs */
+static inline int gh_rm_register_notifier(struct notifier_block *nb)
+{
+	return -ENODEV;
+}
+
+static inline int gh_rm_unregister_notifier(struct notifier_block *nb)
+{
+	return -ENODEV;
+}
+
+/* Client APIs for IRQ management */
+static inline int gh_rm_virq_to_irq(u32 virq)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_irq_lend(gh_vmid_t vmid,
+				    int virq,
+				    int label,
+				    gh_virq_handle_t *virq_handle)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_irq_to_virq(int irq, u32 *virq)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_irq_lend_notify(gh_vmid_t vmid,
+					   gh_virq_handle_t virq_handle)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_irq_accept(gh_virq_handle_t virq_handle, int virq)
+{
+	return -EINVAL;
+
+}
+
+static inline int gh_rm_vm_irq_accept_notify(gh_vmid_t vmid,
+					     gh_virq_handle_t virq_handle)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_irq_release(gh_virq_handle_t virq_handle)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_irq_release_notify(gh_vmid_t vmid,
+					      gh_virq_handle_t virq_handle)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_irq_reclaim(gh_virq_handle_t virq_handle)
+{
+	return -EINVAL;
+}
+
+/* Client APIs for VM management */
+static inline int gh_rm_vm_alloc_vmid(enum gh_vm_names vm_name, int *vmid)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_dealloc_vmid(gh_vmid_t vmid)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_config_image(gh_vmid_t vmid, u16 auth_mech,
+		u32 mem_handle, u64 image_offset, u64 image_size,
+		u64 dtb_offset, u64 dtb_size)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_auth_image(gh_vmid_t vmid, ssize_t n_entries,
+				struct gh_vm_auth_param_entry *entry)
+{
+	return -EINVAL;
+}
+
+static inline int ghd_rm_vm_init(gh_vmid_t vmid)
+{
+	return -EINVAL;
+}
+
+static inline int ghd_rm_get_vmid(enum gh_vm_names vm_name, gh_vmid_t *vmid)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_get_vm_name(gh_vmid_t vmid, enum gh_vm_names *vm_name)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_get_this_vmid(gh_vmid_t *vmid)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_get_vminfo(enum gh_vm_names vm_name, struct gh_vminfo *vminfo)
+{
+	return -EINVAL;
+}
+
+static inline int ghd_rm_vm_start(int vmid)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_get_vm_id_info(gh_vmid_t vmid)
+{
+	return -EINVAL;
+}
+
+static inline int ghd_rm_vm_stop(gh_vmid_t vmid, u32 stop_reason, u8 flags)
+{
+	return -EINVAL;
+}
+
+static inline int ghd_rm_vm_reset(gh_vmid_t vmid)
+{
+	return -EINVAL;
+}
+
+/* Client APIs for VM query */
+static inline int gh_rm_populate_hyp_res(gh_vmid_t vmid, const char *vm_name)
+{
+	return -EINVAL;
+}
+
+/* Client APIs for VM Services */
+static inline struct gh_vm_status *gh_rm_vm_get_status(gh_vmid_t vmid)
+{
+	return ERR_PTR(-EINVAL);
+}
+
+static inline int gh_rm_vm_set_status(struct gh_vm_status gh_vm_status)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_set_vm_status(u8 vm_status)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_set_os_status(u8 os_status)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_vm_set_app_status(u16 app_status)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_console_open(gh_vmid_t vmid)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_console_close(gh_vmid_t vmid)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_console_write(gh_vmid_t vmid, const char *buf,
+					size_t size)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_console_flush(gh_vmid_t vmid)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_mem_qcom_lookup_sgl(u8 mem_type, gh_label_t label,
+			      struct gh_acl_desc *acl_desc,
+			      struct gh_sgl_desc *sgl_desc,
+			      struct gh_mem_attr_desc *mem_attr_desc,
+			      gh_memparcel_handle_t *handle)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_mem_release(gh_memparcel_handle_t handle, u8 flags)
+{
+	return -EINVAL;
+}
+
+static inline int ghd_rm_mem_reclaim(gh_memparcel_handle_t handle, u8 flags)
+{
+	return -EINVAL;
+}
+
+static inline struct gh_sgl_desc *gh_rm_mem_accept(gh_memparcel_handle_t handle,
+				     u8 mem_type,
+				     u8 trans_type, u8 flags, gh_label_t label,
+				     struct gh_acl_desc *acl_desc,
+				     struct gh_sgl_desc *sgl_desc,
+				     struct gh_mem_attr_desc *mem_attr_desc,
+				     u16 map_vmid)
+{
+	return ERR_PTR(-EINVAL);
+}
+
+static inline int ghd_rm_mem_share(u8 mem_type, u8 flags, gh_label_t label,
+		    struct gh_acl_desc *acl_desc, struct gh_sgl_desc *sgl_desc,
+		    struct gh_mem_attr_desc *mem_attr_desc,
+		    gh_memparcel_handle_t *handle)
+{
+	return -EINVAL;
+}
+
+static inline int ghd_rm_mem_lend(u8 mem_type, u8 flags, gh_label_t label,
+		   struct gh_acl_desc *acl_desc, struct gh_sgl_desc *sgl_desc,
+		   struct gh_mem_attr_desc *mem_attr_desc,
+		   gh_memparcel_handle_t *handle)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_mem_donate(u8 mem_type, u8 flags, gh_label_t label,
+		   struct gh_acl_desc *acl_desc, struct gh_sgl_desc *sgl_desc,
+		   struct gh_mem_attr_desc *mem_attr_desc,
+		   gh_memparcel_handle_t *handle)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_mem_notify(gh_memparcel_handle_t handle, u8 flags,
+				   gh_label_t mem_info_tag,
+				   struct gh_notify_vmid_desc *vmid_desc)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_set_virtio_mmio_cb(gh_virtio_mmio_cb_t fnptr)
+{
+	return -EINVAL;
+}
+
+static inline void gh_rm_unset_virtio_mmio_cb(void)
+{
+
+}
+
+static inline int gh_rm_set_wdog_manage_cb(gh_wdog_manage_cb_t fnptr)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_set_vcpu_affinity_cb(gh_vcpu_affinity_set_cb_t fnptr)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_reset_vcpu_affinity_cb(gh_vcpu_affinity_reset_cb_t fnptr)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_set_vpm_grp_cb(gh_vpm_grp_set_cb_t fnptr)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_reset_vpm_grp_cb(gh_vpm_grp_reset_cb_t fnptr)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_all_res_populated_cb(gh_all_res_populated_cb_t fnptr)
+{
+	return -EINVAL;
+}
+
+/* API to set time base */
+static inline int gh_rm_vm_set_time_base(gh_vmid_t vmid)
+{
+	return -EINVAL;
+}
+
+/* API for minidump support */
+static inline int gh_rm_minidump_get_info(void)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_minidump_register_range(phys_addr_t base_ipa,
+					 size_t region_size, const char *name,
+					 size_t name_size)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_minidump_deregister_slot(uint16_t slot_num)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_minidump_get_slot_from_name(uint16_t starting_slot,
+						    const char *name,
+						    size_t name_size)
+{
+	return -EINVAL;
+}
+
+static inline int gh_rm_ipa_reserve(u64 size, u64 align, struct range limits,
+				    u32 generic_constraints, u32 platform_constraints,
+				    u64 *ipa)
+{
+	return -EINVAL;
+}
+#endif
+#endif
--- linux-qcom-6.8.0.orig/include/linux/gunyah_rsc_mgr.h
+++ linux-qcom-6.8.0/include/linux/gunyah_rsc_mgr.h
@@ -0,0 +1,162 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _GUNYAH_RSC_MGR_H
+#define _GUNYAH_RSC_MGR_H
+
+#include <linux/list.h>
+#include <linux/notifier.h>
+#include <linux/gunyah.h>
+
+#define GH_VMID_INVAL		U16_MAX
+#define GH_MEM_HANDLE_INVAL	U32_MAX
+
+struct gh_rm;
+int gh_rm_notifier_register(struct gh_rm *rm, struct notifier_block *nb);
+int gh_rm_notifier_unregister(struct gh_rm *rm, struct notifier_block *nb);
+struct device *gh_rm_get(struct gh_rm *rm);
+void gh_rm_put(struct gh_rm *rm);
+
+struct gh_rm_vm_exited_payload {
+	__le16 vmid;
+	__le16 exit_type;
+	__le32 exit_reason_size;
+	u8 exit_reason[];
+} __packed;
+
+#define GH_RM_NOTIFICATION_VM_EXITED		 0x56100001
+
+enum gh_rm_vm_status {
+	GH_RM_VM_STATUS_NO_STATE	= 0,
+	GH_RM_VM_STATUS_INIT		= 1,
+	GH_RM_VM_STATUS_READY		= 2,
+	GH_RM_VM_STATUS_RUNNING		= 3,
+	GH_RM_VM_STATUS_PAUSED		= 4,
+	GH_RM_VM_STATUS_LOAD		= 5,
+	GH_RM_VM_STATUS_AUTH		= 6,
+	GH_RM_VM_STATUS_INIT_FAILED	= 8,
+	GH_RM_VM_STATUS_EXITED		= 9,
+	GH_RM_VM_STATUS_RESETTING	= 10,
+	GH_RM_VM_STATUS_RESET		= 11,
+};
+
+struct gh_rm_vm_status_payload {
+	__le16 vmid;
+	u16 reserved;
+	u8 vm_status;
+	u8 os_status;
+	__le16 app_status;
+} __packed;
+
+#define GH_RM_NOTIFICATION_VM_STATUS		 0x56100008
+
+#define GH_RM_ACL_X		BIT(0)
+#define GH_RM_ACL_W		BIT(1)
+#define GH_RM_ACL_R		BIT(2)
+
+struct gh_rm_mem_acl_entry {
+	__le16 vmid;
+	u8 perms;
+	u8 reserved;
+} __packed;
+
+struct gh_rm_mem_entry {
+	__le64 phys_addr;
+	__le64 size;
+} __packed;
+
+enum gh_rm_mem_type {
+	GH_RM_MEM_TYPE_NORMAL	= 0,
+	GH_RM_MEM_TYPE_IO	= 1,
+};
+
+/*
+ * struct gh_rm_mem_parcel - Info about memory to be lent/shared/donated/reclaimed
+ * @mem_type: The type of memory: normal (DDR) or IO
+ * @label: An client-specified identifier which can be used by the other VMs to identify the purpose
+ *         of the memory parcel.
+ * @n_acl_entries: Count of the number of entries in the @acl_entries array.
+ * @acl_entries: An array of access control entries. Each entry specifies a VM and what access
+ *               is allowed for the memory parcel.
+ * @n_mem_entries: Count of the number of entries in the @mem_entries array.
+ * @mem_entries: An array of regions to be associated with the memory parcel. Addresses should be
+ *               (intermediate) physical addresses from Linux's perspective.
+ * @mem_handle: On success, filled with memory handle that RM allocates for this memory parcel
+ */
+struct gh_rm_mem_parcel {
+	enum gh_rm_mem_type mem_type;
+	u32 label;
+	size_t n_acl_entries;
+	struct gh_rm_mem_acl_entry *acl_entries;
+	size_t n_mem_entries;
+	struct gh_rm_mem_entry *mem_entries;
+	u32 mem_handle;
+};
+
+/* RPC Calls */
+int gh_rm_mem_lend(struct gh_rm *rm, struct gh_rm_mem_parcel *parcel);
+int gh_rm_mem_share(struct gh_rm *rm, struct gh_rm_mem_parcel *parcel);
+int gh_rm_mem_reclaim(struct gh_rm *rm, struct gh_rm_mem_parcel *parcel);
+
+int gh_rm_alloc_vmid(struct gh_rm *rm, u16 vmid);
+int gh_rm_dealloc_vmid(struct gh_rm *rm, u16 vmid);
+int gh_rm_vm_reset(struct gh_rm *rm, u16 vmid);
+int gh_rm_vm_start(struct gh_rm *rm, u16 vmid);
+int gh_rm_vm_stop(struct gh_rm *rm, u16 vmid);
+
+enum gh_rm_vm_auth_mechanism {
+	GH_RM_VM_AUTH_NONE		= 0,
+	GH_RM_VM_AUTH_QCOM_PIL_ELF	= 1,
+	GH_RM_VM_AUTH_QCOM_ANDROID_PVM	= 2,
+};
+
+int gh_rm_vm_configure(struct gh_rm *rm, u16 vmid, enum gh_rm_vm_auth_mechanism auth_mechanism,
+			u32 mem_handle, u64 image_offset, u64 image_size,
+			u64 dtb_offset, u64 dtb_size);
+int gh_rm_vm_init(struct gh_rm *rm, u16 vmid);
+
+struct gh_rm_hyp_resource {
+	u8 type;
+	u8 reserved;
+	__le16 partner_vmid;
+	__le32 resource_handle;
+	__le32 resource_label;
+	__le64 cap_id;
+	__le32 virq_handle;
+	__le32 virq;
+	__le64 base;
+	__le64 size;
+} __packed;
+
+struct gh_rm_hyp_resources {
+	__le32 n_entries;
+	struct gh_rm_hyp_resource entries[];
+} __packed;
+
+int gh_rm_get_hyp_resources(struct gh_rm *rm, u16 vmid,
+				struct gh_rm_hyp_resources **resources);
+int gh_rm_get_vmid(struct gh_rm *rm, u16 *vmid);
+
+struct gh_resource *gh_rm_alloc_resource(struct gh_rm *rm, struct gh_rm_hyp_resource *hyp_resource);
+void gh_rm_free_resource(struct gh_resource *ghrsc);
+
+struct gh_rm_platform_ops {
+	int (*pre_mem_share)(struct gh_rm *rm, struct gh_rm_mem_parcel *mem_parcel);
+	int (*post_mem_reclaim)(struct gh_rm *rm, struct gh_rm_mem_parcel *mem_parcel);
+};
+
+#if IS_ENABLED(CONFIG_GUNYAH_PLATFORM_HOOKS)
+int gh_rm_register_platform_ops(const struct gh_rm_platform_ops *platform_ops);
+void gh_rm_unregister_platform_ops(const struct gh_rm_platform_ops *platform_ops);
+int devm_gh_rm_register_platform_ops(struct device *dev, const struct gh_rm_platform_ops *ops);
+#else
+static inline int gh_rm_register_platform_ops(const struct gh_rm_platform_ops *platform_ops)
+	{ return 0; }
+static inline void gh_rm_unregister_platform_ops(const struct gh_rm_platform_ops *platform_ops) { }
+static inline int devm_gh_rm_register_platform_ops(struct device *dev,
+	const struct gh_rm_platform_ops *ops) { return 0; }
+#endif
+
+#endif
--- linux-qcom-6.8.0.orig/include/linux/gunyah_vm_mgr.h
+++ linux-qcom-6.8.0/include/linux/gunyah_vm_mgr.h
@@ -0,0 +1,153 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _GUNYAH_VM_MGR_H
+#define _GUNYAH_VM_MGR_H
+
+#include <linux/compiler_types.h>
+#include <linux/gunyah.h>
+#include <linux/gunyah_rsc_mgr.h>
+#include <linux/list.h>
+#include <linux/mod_devicetable.h>
+#include <linux/notifier.h>
+
+#include <uapi/linux/gunyah.h>
+
+struct gh_vm;
+
+int __must_check gh_vm_get(struct gh_vm *ghvm);
+void gh_vm_put(struct gh_vm *ghvm);
+
+struct gh_vm_function_instance;
+/**
+ * struct gh_vm_function - Represents a function type
+ * @type: value from &enum gh_fn_type
+ * @name: friendly name for debug purposes
+ * @mod: owner of the function type
+ * @bind: Called when a new function of this type has been allocated.
+ * @unbind: Called when the function instance is being destroyed.
+ * @compare: Compare function instance @f's argument to the provided arg.
+ *           Return true if they are equivalent. Used on GH_VM_REMOVE_FUNCTION.
+ */
+struct gh_vm_function {
+	u32 type;
+	const char *name;
+	struct module *mod;
+	long (*bind)(struct gh_vm_function_instance *f);
+	void (*unbind)(struct gh_vm_function_instance *f);
+	bool (*compare)(const struct gh_vm_function_instance *f, const void *arg, size_t size);
+};
+
+/**
+ * struct gh_vm_function_instance - Represents one function instance
+ * @arg_size: size of user argument
+ * @argp: pointer to user argument
+ * @ghvm: Pointer to VM instance
+ * @rm: Pointer to resource manager for the VM instance
+ * @fn: The ops for the function
+ * @data: Private data for function
+ * @vm_list: for gh_vm's functions list
+ * @fn_list: for gh_vm_function's instances list
+ */
+struct gh_vm_function_instance {
+	size_t arg_size;
+	void *argp;
+	struct gh_vm *ghvm;
+	struct gh_rm *rm;
+	struct gh_vm_function *fn;
+	void *data;
+	struct list_head vm_list;
+};
+
+int gh_vm_function_register(struct gh_vm_function *f);
+void gh_vm_function_unregister(struct gh_vm_function *f);
+
+/* Since the function identifiers were setup in a uapi header as an
+ * enum and we do no want to change that, the user must supply the expanded
+ * constant as well and the compiler checks they are the same.
+ * See also MODULE_ALIAS_RDMA_NETLINK.
+ */
+#define MODULE_ALIAS_GH_VM_FUNCTION(_type, _idx)			\
+	static inline void __maybe_unused __chk##_idx(void)		\
+	{								\
+		BUILD_BUG_ON(_type != _idx);				\
+	}								\
+	MODULE_ALIAS("ghfunc:" __stringify(_idx))
+
+#define DECLARE_GH_VM_FUNCTION(_name, _type, _bind, _unbind, _compare)	\
+	static struct gh_vm_function _name = {				\
+		.type = _type,						\
+		.name = __stringify(_name),				\
+		.mod = THIS_MODULE,					\
+		.bind = _bind,						\
+		.unbind = _unbind,					\
+		.compare = _compare,					\
+	}
+
+#define module_gh_vm_function(__gf)					\
+	module_driver(__gf, gh_vm_function_register, gh_vm_function_unregister)
+
+#define DECLARE_GH_VM_FUNCTION_INIT(_name, _type, _idx, _bind, _unbind, _compare)	\
+	DECLARE_GH_VM_FUNCTION(_name, _type, _bind, _unbind, _compare);			\
+	module_gh_vm_function(_name);							\
+	MODULE_ALIAS_GH_VM_FUNCTION(_type, _idx)
+
+/**
+ * struct gh_vm_resource_ticket - Represents a ticket to reserve exclusive access to VM resource(s)
+ * @vm_list: for @gh_vm->resource_tickets
+ * @resources: List of resource(s) associated with this ticket(members are from @gh_resource->list)
+ * @resource_type: Type of resource this ticket reserves
+ * @label: Label of the resource from resource manager this ticket reserves.
+ * @owner: owner of the ticket
+ * @populate: callback provided by the ticket owner and called when a resource is found that
+ *            matches @resource_type and @label. Note that this callback could be called
+ *            multiple times if userspace created mutliple resources with the same type/label.
+ *            This callback may also have significant delay after gh_vm_add_resource_ticket()
+ *            since gh_vm_add_resource_ticket() could be called before the VM starts.
+ * @unpopulate: callback provided by the ticket owner and called when the ticket owner should
+ *              no longer use the resource provided in the argument. When unpopulate() returns,
+ *              the ticket owner should not be able to use the resource any more as the resource
+ *              might being freed.
+ */
+struct gh_vm_resource_ticket {
+	struct list_head vm_list;
+	struct list_head resources;
+	enum gh_resource_type resource_type;
+	u32 label;
+
+	struct module *owner;
+	bool (*populate)(struct gh_vm_resource_ticket *ticket, struct gh_resource *ghrsc);
+	void (*unpopulate)(struct gh_vm_resource_ticket *ticket, struct gh_resource *ghrsc);
+};
+
+int gh_vm_add_resource_ticket(struct gh_vm *ghvm, struct gh_vm_resource_ticket *ticket);
+void gh_vm_remove_resource_ticket(struct gh_vm *ghvm, struct gh_vm_resource_ticket *ticket);
+
+/*
+ * gh_vm_io_handler contains the info about an io device and its associated
+ * addr and the ops associated with the io device.
+ */
+struct gh_vm_io_handler {
+	struct rb_node node;
+	u64 addr;
+
+	bool datamatch;
+	u8 len;
+	u64 data;
+	struct gh_vm_io_handler_ops *ops;
+};
+
+/*
+ * gh_vm_io_handler_ops contains function pointers associated with an iodevice.
+ */
+struct gh_vm_io_handler_ops {
+	int (*read)(struct gh_vm_io_handler *io_dev, u64 addr, u32 len, u64 data);
+	int (*write)(struct gh_vm_io_handler *io_dev, u64 addr, u32 len, u64 data);
+};
+
+int gh_vm_add_io_handler(struct gh_vm *ghvm, struct gh_vm_io_handler *io_dev);
+void gh_vm_remove_io_handler(struct gh_vm *ghvm, struct gh_vm_io_handler *io_dev);
+
+#endif
--- linux-qcom-6.8.0.orig/include/linux/hid.h
+++ linux-qcom-6.8.0/include/linux/hid.h
@@ -359,6 +359,7 @@
  * | @HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP:
  * | @HID_QUIRK_HAVE_SPECIAL_DRIVER:
  * | @HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE:
+ * | @HID_QUIRK_IGNORE_SPECIAL_DRIVER
  * | @HID_QUIRK_FULLSPEED_INTERVAL:
  * | @HID_QUIRK_NO_INIT_REPORTS:
  * | @HID_QUIRK_NO_IGNORE:
@@ -384,6 +385,7 @@
 #define HID_QUIRK_HAVE_SPECIAL_DRIVER		BIT(19)
 #define HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE	BIT(20)
 #define HID_QUIRK_NOINVERT			BIT(21)
+#define HID_QUIRK_IGNORE_SPECIAL_DRIVER		BIT(22)
 #define HID_QUIRK_FULLSPEED_INTERVAL		BIT(28)
 #define HID_QUIRK_NO_INIT_REPORTS		BIT(29)
 #define HID_QUIRK_NO_IGNORE			BIT(30)
--- linux-qcom-6.8.0.orig/include/linux/hisi_acc_qm.h
+++ linux-qcom-6.8.0/include/linux/hisi_acc_qm.h
@@ -221,6 +221,12 @@
 
 struct hisi_qm;
 
+enum acc_err_result {
+	ACC_ERR_NONE,
+	ACC_ERR_NEED_RESET,
+	ACC_ERR_RECOVERED,
+};
+
 struct hisi_qm_err_info {
 	char *acpi_rst;
 	u32 msi_wr_port;
@@ -249,9 +255,9 @@
 	void (*close_axi_master_ooo)(struct hisi_qm *qm);
 	void (*open_sva_prefetch)(struct hisi_qm *qm);
 	void (*close_sva_prefetch)(struct hisi_qm *qm);
-	void (*log_dev_hw_err)(struct hisi_qm *qm, u32 err_sts);
 	void (*show_last_dfx_regs)(struct hisi_qm *qm);
 	void (*err_info_init)(struct hisi_qm *qm);
+	enum acc_err_result (*get_err_result)(struct hisi_qm *qm);
 };
 
 struct hisi_qm_cap_info {
--- linux-qcom-6.8.0.orig/include/linux/hrtimer.h
+++ linux-qcom-6.8.0/include/linux/hrtimer.h
@@ -492,6 +492,7 @@
 extern void sysrq_timer_list_show(void);
 
 int hrtimers_prepare_cpu(unsigned int cpu);
+int hrtimers_cpu_starting(unsigned int cpu);
 #ifdef CONFIG_HOTPLUG_CPU
 int hrtimers_cpu_dying(unsigned int cpu);
 #else
--- linux-qcom-6.8.0.orig/include/linux/huge_mm.h
+++ linux-qcom-6.8.0/include/linux/huge_mm.h
@@ -75,14 +75,20 @@
 #define THP_ORDERS_ALL_ANON	((BIT(PMD_ORDER + 1) - 1) & ~(BIT(0) | BIT(1)))
 
 /*
- * Mask of all large folio orders supported for file THP.
+ * Mask of all large folio orders supported for file THP. Folios in a DAX
+ * file is never split and the MAX_PAGECACHE_ORDER limit does not apply to
+ * it.
  */
-#define THP_ORDERS_ALL_FILE	(BIT(PMD_ORDER) | BIT(PUD_ORDER))
+#define THP_ORDERS_ALL_FILE_DAX		\
+	(BIT(PMD_ORDER) | BIT(PUD_ORDER))
+#define THP_ORDERS_ALL_FILE_DEFAULT	\
+	((BIT(MAX_PAGECACHE_ORDER + 1) - 1) & ~BIT(0))
 
 /*
  * Mask of all large folio orders supported for THP.
  */
-#define THP_ORDERS_ALL		(THP_ORDERS_ALL_ANON | THP_ORDERS_ALL_FILE)
+#define THP_ORDERS_ALL	\
+	(THP_ORDERS_ALL_ANON | THP_ORDERS_ALL_FILE_DAX | THP_ORDERS_ALL_FILE_DEFAULT)
 
 #define thp_vma_allowable_order(vma, vm_flags, smaps, in_pf, enforce_sysfs, order) \
 	(!!thp_vma_allowable_orders(vma, vm_flags, smaps, in_pf, enforce_sysfs, BIT(order)))
@@ -114,18 +120,6 @@
 			(1<<TRANSPARENT_HUGEPAGE_FLAG);
 }
 
-static inline bool hugepage_flags_enabled(void)
-{
-	/*
-	 * We cover both the anon and the file-backed case here; we must return
-	 * true if globally enabled, even when all anon sizes are set to never.
-	 * So we don't need to look at huge_anon_orders_inherit.
-	 */
-	return hugepage_global_enabled() ||
-	       huge_anon_orders_always ||
-	       huge_anon_orders_madvise;
-}
-
 static inline int highest_order(unsigned long orders)
 {
 	return fls_long(orders) - 1;
@@ -260,6 +254,24 @@
 	(transparent_hugepage_flags &					\
 	 (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG))
 
+static inline bool vma_thp_disabled(struct vm_area_struct *vma,
+		unsigned long vm_flags)
+{
+	/*
+	 * Explicitly disabled through madvise or prctl, or some
+	 * architectures may disable THP for some mappings, for
+	 * example, s390 kvm.
+	 */
+	return (vm_flags & VM_NOHUGEPAGE) ||
+	       test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags);
+}
+
+static inline bool thp_disabled_by_hw(void)
+{
+	/* If the hardware/firmware marked hugepage support disabled. */
+	return transparent_hugepage_flags & (1 << TRANSPARENT_HUGEPAGE_UNSUPPORTED);
+}
+
 unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr,
 		unsigned long len, unsigned long pgoff, unsigned long flags);
 
--- linux-qcom-6.8.0.orig/include/linux/hugetlb.h
+++ linux-qcom-6.8.0/include/linux/hugetlb.h
@@ -713,6 +713,7 @@
 /* Defines one hugetlb page size */
 struct hstate {
 	struct mutex resize_lock;
+	struct lock_class_key resize_key;
 	int next_nid_to_alloc;
 	int next_nid_to_free;
 	unsigned int order;
@@ -1241,7 +1242,7 @@
 }
 #endif
 
-#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING
 static inline bool hugetlb_pmd_shared(pte_t *pte)
 {
 	return page_count(virt_to_page(pte)) > 1;
@@ -1277,8 +1278,7 @@
 static inline pte_t *
 hugetlb_walk(struct vm_area_struct *vma, unsigned long addr, unsigned long sz)
 {
-#if defined(CONFIG_HUGETLB_PAGE) && \
-	defined(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) && defined(CONFIG_LOCKDEP)
+#if defined(CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING) && defined(CONFIG_LOCKDEP)
 	struct hugetlb_vma_lock *vma_lock = vma->vm_private_data;
 
 	/*
--- linux-qcom-6.8.0.orig/include/linux/hwspinlock.h
+++ linux-qcom-6.8.0/include/linux/hwspinlock.h
@@ -68,6 +68,7 @@
 int __hwspin_trylock(struct hwspinlock *, int, unsigned long *);
 void __hwspin_unlock(struct hwspinlock *, int, unsigned long *);
 int of_hwspin_lock_get_id_byname(struct device_node *np, const char *name);
+int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id);
 int devm_hwspin_lock_free(struct device *dev, struct hwspinlock *hwlock);
 struct hwspinlock *devm_hwspin_lock_request(struct device *dev);
 struct hwspinlock *devm_hwspin_lock_request_specific(struct device *dev,
@@ -127,6 +128,11 @@
 {
 }
 
+static inline int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id)
+{
+	return 0;
+}
+
 static inline int of_hwspin_lock_get_id(struct device_node *np, int index)
 {
 	return 0;
--- linux-qcom-6.8.0.orig/include/linux/hyperv.h
+++ linux-qcom-6.8.0/include/linux/hyperv.h
@@ -832,6 +832,7 @@
 	u32 gpadl_handle;
 	u32 size;
 	void *buffer;
+	bool decrypted;
 };
 
 struct vmbus_channel {
@@ -1560,6 +1561,7 @@
 	void *channel;
 	void (*util_cb)(void *);
 	int (*util_init)(struct hv_util_service *);
+	int (*util_init_transport)(void);
 	void (*util_deinit)(void);
 	int (*util_pre_suspend)(void);
 	int (*util_pre_resume)(void);
--- linux-qcom-6.8.0.orig/include/linux/i2c.h
+++ linux-qcom-6.8.0/include/linux/i2c.h
@@ -748,6 +748,9 @@
 	struct regulator *bus_regulator;
 
 	struct dentry *debugfs;
+
+	/* 7bit address space */
+	DECLARE_BITMAP(addrs_in_instantiation, 1 << 7);
 };
 #define to_i2c_adapter(d) container_of(d, struct i2c_adapter, dev)
 
@@ -1034,7 +1037,7 @@
 struct acpi_resource;
 struct acpi_resource_i2c_serialbus;
 
-#if IS_ENABLED(CONFIG_ACPI)
+#if IS_REACHABLE(CONFIG_ACPI) && IS_REACHABLE(CONFIG_I2C)
 bool i2c_acpi_get_i2c_resource(struct acpi_resource *ares,
 			       struct acpi_resource_i2c_serialbus **i2c);
 int i2c_acpi_client_count(struct acpi_device *adev);
--- linux-qcom-6.8.0.orig/include/linux/i3c/master.h
+++ linux-qcom-6.8.0/include/linux/i3c/master.h
@@ -277,13 +277,28 @@
 };
 
 /**
+ * enum i3c_open_drain_speed - I3C open-drain speed
+ * @I3C_OPEN_DRAIN_SLOW_SPEED: Slow open-drain speed for sending the first
+ *				broadcast address. The first broadcast address at this speed
+ *				will be visible to all devices on the I3C bus. I3C devices
+ *				working in I2C mode will turn off their spike filter when
+ *				switching into I3C mode.
+ * @I3C_OPEN_DRAIN_NORMAL_SPEED: Normal open-drain speed in I3C bus mode.
+ */
+enum i3c_open_drain_speed {
+	I3C_OPEN_DRAIN_SLOW_SPEED,
+	I3C_OPEN_DRAIN_NORMAL_SPEED,
+};
+
+/**
  * enum i3c_addr_slot_status - I3C address slot status
  * @I3C_ADDR_SLOT_FREE: address is free
  * @I3C_ADDR_SLOT_RSVD: address is reserved
  * @I3C_ADDR_SLOT_I2C_DEV: address is assigned to an I2C device
  * @I3C_ADDR_SLOT_I3C_DEV: address is assigned to an I3C device
  * @I3C_ADDR_SLOT_STATUS_MASK: address slot mask
- *
+ * @I3C_ADDR_SLOT_EXT_DESIRED: the bitmask represents addresses that are preferred by some devices,
+ *			       such as the "assigned-address" property in a device tree source.
  * On an I3C bus, addresses are assigned dynamically, and we need to know which
  * addresses are free to use and which ones are already assigned.
  *
@@ -296,8 +311,12 @@
 	I3C_ADDR_SLOT_I2C_DEV,
 	I3C_ADDR_SLOT_I3C_DEV,
 	I3C_ADDR_SLOT_STATUS_MASK = 3,
+	I3C_ADDR_SLOT_EXT_STATUS_MASK = 7,
+	I3C_ADDR_SLOT_EXT_DESIRED = BIT(2),
 };
 
+#define I3C_ADDR_SLOT_STATUS_BITS 4
+
 /**
  * struct i3c_bus - I3C bus object
  * @cur_master: I3C master currently driving the bus. Since I3C is multi-master
@@ -339,7 +358,7 @@
 struct i3c_bus {
 	struct i3c_dev_desc *cur_master;
 	int id;
-	unsigned long addrslots[((I2C_MAX_ADDR + 1) * 2) / BITS_PER_LONG];
+	unsigned long addrslots[((I2C_MAX_ADDR + 1) * I3C_ADDR_SLOT_STATUS_BITS) / BITS_PER_LONG];
 	enum i3c_bus_mode mode;
 	struct {
 		unsigned long i3c;
@@ -435,6 +454,7 @@
  *		      NULL.
  * @enable_hotjoin: enable hot join event detect.
  * @disable_hotjoin: disable hot join event detect.
+ * @set_speed: adjust I3C open drain mode timing.
  */
 struct i3c_master_controller_ops {
 	int (*bus_init)(struct i3c_master_controller *master);
@@ -463,6 +483,7 @@
 				 struct i3c_ibi_slot *slot);
 	int (*enable_hotjoin)(struct i3c_master_controller *master);
 	int (*disable_hotjoin)(struct i3c_master_controller *master);
+	int (*set_speed)(struct i3c_master_controller *master, enum i3c_open_drain_speed speed);
 };
 
 /**
--- linux-qcom-6.8.0.orig/include/linux/ieee80211.h
+++ linux-qcom-6.8.0/include/linux/ieee80211.h
@@ -5009,7 +5009,7 @@
 	bool check_common_len = false;
 	u16 control;
 
-	if (len < fixed)
+	if (!data || len < fixed)
 		return false;
 
 	control = le16_to_cpu(mle->control);
@@ -5145,7 +5145,7 @@
 		info_len += 1;
 
 	return prof->sta_info_len >= info_len &&
-	       fixed + prof->sta_info_len <= len;
+	       fixed + prof->sta_info_len - 1 <= len;
 }
 
 /**
--- linux-qcom-6.8.0.orig/include/linux/if_vlan.h
+++ linux-qcom-6.8.0/include/linux/if_vlan.h
@@ -585,13 +585,16 @@
  * vlan_get_protocol - get protocol EtherType.
  * @skb: skbuff to query
  * @type: first vlan protocol
+ * @mac_offset: MAC offset
  * @depth: buffer to store length of eth and vlan tags in bytes
  *
  * Returns the EtherType of the packet, regardless of whether it is
  * vlan encapsulated (normal or hardware accelerated) or not.
  */
-static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type,
-					 int *depth)
+static inline __be16 __vlan_get_protocol_offset(const struct sk_buff *skb,
+						__be16 type,
+						int mac_offset,
+						int *depth)
 {
 	unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH;
 
@@ -610,7 +613,8 @@
 		do {
 			struct vlan_hdr vhdr, *vh;
 
-			vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr);
+			vh = skb_header_pointer(skb, mac_offset + vlan_depth,
+						sizeof(vhdr), &vhdr);
 			if (unlikely(!vh || !--parse_depth))
 				return 0;
 
@@ -625,6 +629,12 @@
 	return type;
 }
 
+static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type,
+					 int *depth)
+{
+	return __vlan_get_protocol_offset(skb, type, 0, depth);
+}
+
 /**
  * vlan_get_protocol - get protocol EtherType.
  * @skb: skbuff to query
--- linux-qcom-6.8.0.orig/include/linux/iio/backend.h
+++ linux-qcom-6.8.0/include/linux/iio/backend.h
@@ -0,0 +1,72 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef _IIO_BACKEND_H_
+#define _IIO_BACKEND_H_
+
+#include <linux/types.h>
+
+struct fwnode_handle;
+struct iio_backend;
+struct device;
+struct iio_dev;
+
+enum iio_backend_data_type {
+	IIO_BACKEND_TWOS_COMPLEMENT,
+	IIO_BACKEND_OFFSET_BINARY,
+	IIO_BACKEND_DATA_TYPE_MAX
+};
+
+/**
+ * struct iio_backend_data_fmt - Backend data format
+ * @type:		Data type.
+ * @sign_extend:	Bool to tell if the data is sign extended.
+ * @enable:		Enable/Disable the data format module. If disabled,
+ *			not formatting will happen.
+ */
+struct iio_backend_data_fmt {
+	enum iio_backend_data_type type;
+	bool sign_extend;
+	bool enable;
+};
+
+/**
+ * struct iio_backend_ops - operations structure for an iio_backend
+ * @enable:		Enable backend.
+ * @disable:		Disable backend.
+ * @chan_enable:	Enable one channel.
+ * @chan_disable:	Disable one channel.
+ * @data_format_set:	Configure the data format for a specific channel.
+ * @request_buffer:	Request an IIO buffer.
+ * @free_buffer:	Free an IIO buffer.
+ **/
+struct iio_backend_ops {
+	int (*enable)(struct iio_backend *back);
+	void (*disable)(struct iio_backend *back);
+	int (*chan_enable)(struct iio_backend *back, unsigned int chan);
+	int (*chan_disable)(struct iio_backend *back, unsigned int chan);
+	int (*data_format_set)(struct iio_backend *back, unsigned int chan,
+			       const struct iio_backend_data_fmt *data);
+	struct iio_buffer *(*request_buffer)(struct iio_backend *back,
+					     struct iio_dev *indio_dev);
+	void (*free_buffer)(struct iio_backend *back,
+			    struct iio_buffer *buffer);
+};
+
+int iio_backend_chan_enable(struct iio_backend *back, unsigned int chan);
+int iio_backend_chan_disable(struct iio_backend *back, unsigned int chan);
+int devm_iio_backend_enable(struct device *dev, struct iio_backend *back);
+int iio_backend_data_format_set(struct iio_backend *back, unsigned int chan,
+				const struct iio_backend_data_fmt *data);
+int devm_iio_backend_request_buffer(struct device *dev,
+				    struct iio_backend *back,
+				    struct iio_dev *indio_dev);
+
+void *iio_backend_get_priv(const struct iio_backend *conv);
+struct iio_backend *devm_iio_backend_get(struct device *dev, const char *name);
+struct iio_backend *
+__devm_iio_backend_get_from_fwnode_lookup(struct device *dev,
+					  struct fwnode_handle *fwnode);
+
+int devm_iio_backend_register(struct device *dev,
+			      const struct iio_backend_ops *ops, void *priv);
+
+#endif
--- linux-qcom-6.8.0.orig/include/linux/iio/buffer-dmaengine.h
+++ linux-qcom-6.8.0/include/linux/iio/buffer-dmaengine.h
@@ -10,6 +10,9 @@
 struct iio_dev;
 struct device;
 
+struct iio_buffer *iio_dmaengine_buffer_alloc(struct device *dev,
+					      const char *channel);
+void iio_dmaengine_buffer_free(struct iio_buffer *buffer);
 int devm_iio_dmaengine_buffer_setup(struct device *dev,
 				    struct iio_dev *indio_dev,
 				    const char *channel);
--- linux-qcom-6.8.0.orig/include/linux/init.h
+++ linux-qcom-6.8.0/include/linux/init.h
@@ -84,11 +84,15 @@
 
 #define __exit          __section(".exit.text") __exitused __cold notrace
 
-/* Used for MEMORY_HOTPLUG */
-#define __meminit        __section(".meminit.text") __cold notrace \
-						  __latent_entropy
-#define __meminitdata    __section(".meminit.data")
-#define __meminitconst   __section(".meminit.rodata")
+#ifdef CONFIG_MEMORY_HOTPLUG
+#define __meminit
+#define __meminitdata
+#define __meminitconst
+#else
+#define __meminit	__init
+#define __meminitdata	__initdata
+#define __meminitconst	__initconst
+#endif
 
 /* For assembly routines */
 #define __HEAD		.section	".head.text","ax"
--- linux-qcom-6.8.0.orig/include/linux/intel_rapl.h
+++ linux-qcom-6.8.0/include/linux/intel_rapl.h
@@ -178,6 +178,12 @@
 	struct rapl_if_priv *priv;
 };
 
+struct rapl_package *rapl_find_package_domain_cpuslocked(int id, struct rapl_if_priv *priv,
+						       bool id_is_cpu);
+struct rapl_package *rapl_add_package_cpuslocked(int id, struct rapl_if_priv *priv,
+						 bool id_is_cpu);
+void rapl_remove_package_cpuslocked(struct rapl_package *rp);
+
 struct rapl_package *rapl_find_package_domain(int id, struct rapl_if_priv *priv, bool id_is_cpu);
 struct rapl_package *rapl_add_package(int id, struct rapl_if_priv *priv, bool id_is_cpu);
 void rapl_remove_package(struct rapl_package *rp);
--- linux-qcom-6.8.0.orig/include/linux/intel_tcc.h
+++ linux-qcom-6.8.0/include/linux/intel_tcc.h
@@ -13,6 +13,7 @@
 int intel_tcc_get_tjmax(int cpu);
 int intel_tcc_get_offset(int cpu);
 int intel_tcc_set_offset(int cpu, int offset);
-int intel_tcc_get_temp(int cpu, bool pkg);
+int intel_tcc_get_temp(int cpu, int *temp, bool pkg);
+u32 intel_tcc_get_offset_mask(void);
 
 #endif /* __INTEL_TCC_H__ */
--- linux-qcom-6.8.0.orig/include/linux/interrupt.h
+++ linux-qcom-6.8.0/include/linux/interrupt.h
@@ -67,6 +67,8 @@
  *                later.
  * IRQF_NO_DEBUG - Exclude from runnaway detection for IPI and similar handlers,
  *		   depends on IRQF_PERCPU.
+ * IRQF_COND_ONESHOT - Agree to do IRQF_ONESHOT if already set for a shared
+ *                 interrupt.
  */
 #define IRQF_SHARED		0x00000080
 #define IRQF_PROBE_SHARED	0x00000100
@@ -82,6 +84,7 @@
 #define IRQF_COND_SUSPEND	0x00040000
 #define IRQF_NO_AUTOEN		0x00080000
 #define IRQF_NO_DEBUG		0x00100000
+#define IRQF_COND_ONESHOT	0x00200000
 
 #define IRQF_TIMER		(__IRQF_TIMER | IRQF_NO_SUSPEND | IRQF_NO_THREAD)
 
@@ -165,7 +168,7 @@
 request_irq(unsigned int irq, irq_handler_t handler, unsigned long flags,
 	    const char *name, void *dev)
 {
-	return request_threaded_irq(irq, handler, NULL, flags, name, dev);
+	return request_threaded_irq(irq, handler, NULL, flags | IRQF_COND_ONESHOT, name, dev);
 }
 
 extern int __must_check
--- linux-qcom-6.8.0.orig/include/linux/io_uring.h
+++ linux-qcom-6.8.0/include/linux/io_uring.h
@@ -16,10 +16,8 @@
 
 static inline void io_uring_files_cancel(void)
 {
-	if (current->io_uring) {
-		io_uring_unreg_ringfd();
+	if (current->io_uring)
 		__io_uring_cancel(false);
-	}
 }
 static inline void io_uring_task_cancel(void)
 {
--- linux-qcom-6.8.0.orig/include/linux/io_uring/cmd.h
+++ linux-qcom-6.8.0/include/linux/io_uring/cmd.h
@@ -26,12 +26,25 @@
 #if defined(CONFIG_IO_URING)
 int io_uring_cmd_import_fixed(u64 ubuf, unsigned long len, int rw,
 			      struct iov_iter *iter, void *ioucmd);
-void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, ssize_t res2,
+
+/*
+ * Completes the request, i.e. posts an io_uring CQE and deallocates @ioucmd
+ * and the corresponding io_uring request.
+ *
+ * Note: the caller should never hard code @issue_flags and is only allowed
+ * to pass the mask provided by the core io_uring code.
+ */
+void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, u64 res2,
 			unsigned issue_flags);
+
 void __io_uring_cmd_do_in_task(struct io_uring_cmd *ioucmd,
 			    void (*task_work_cb)(struct io_uring_cmd *, unsigned),
 			    unsigned flags);
 
+/*
+ * Note: the caller should never hard code @issue_flags and only use the
+ * mask provided by the core io_uring code.
+ */
 void io_uring_cmd_mark_cancelable(struct io_uring_cmd *cmd,
 		unsigned int issue_flags);
 
@@ -42,7 +55,7 @@
 	return -EOPNOTSUPP;
 }
 static inline void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret,
-		ssize_t ret2, unsigned issue_flags)
+		u64 ret2, unsigned issue_flags)
 {
 }
 static inline void __io_uring_cmd_do_in_task(struct io_uring_cmd *ioucmd,
--- linux-qcom-6.8.0.orig/include/linux/io_uring_types.h
+++ linux-qcom-6.8.0/include/linux/io_uring_types.h
@@ -281,7 +281,6 @@
 
 		struct io_submit_state	submit_state;
 
-		struct io_buffer_list	*io_bl;
 		struct xarray		io_bl_xa;
 
 		struct io_hash_table	cancel_table_locked;
--- linux-qcom-6.8.0.orig/include/linux/iomap.h
+++ linux-qcom-6.8.0/include/linux/iomap.h
@@ -256,6 +256,25 @@
 	return &i->iomap;
 }
 
+/*
+ * Check if the range needs to be unshared for a FALLOC_FL_UNSHARE_RANGE
+ * operation.
+ *
+ * Don't bother with blocks that are not shared to start with; or mappings that
+ * cannot be shared, such as inline data, delalloc reservations, holes or
+ * unwritten extents.
+ *
+ * Note that we use srcmap directly instead of iomap_iter_srcmap as unsharing
+ * requires providing a separate source map, and the presence of one is a good
+ * indicator that unsharing is needed, unlike IOMAP_F_SHARED which can be set
+ * for any data that goes into the COW fork for XFS.
+ */
+static inline bool iomap_want_unshare_iter(const struct iomap_iter *iter)
+{
+	return (iter->iomap.flags & IOMAP_F_SHARED) &&
+		iter->srcmap.type == IOMAP_MAPPED;
+}
+
 ssize_t iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *from,
 		const struct iomap_ops *ops);
 int iomap_file_buffered_write_punch_delalloc(struct inode *inode,
--- linux-qcom-6.8.0.orig/include/linux/iommu.h
+++ linux-qcom-6.8.0/include/linux/iommu.h
@@ -487,6 +487,7 @@
 	struct module *owner;
 	struct iommu_domain *identity_domain;
 	struct iommu_domain *blocked_domain;
+	struct iommu_domain *release_domain;
 	struct iommu_domain *default_domain;
 };
 
@@ -1460,7 +1461,7 @@
 static inline struct iommu_sva *
 iommu_sva_bind_device(struct device *dev, struct mm_struct *mm)
 {
-	return NULL;
+	return ERR_PTR(-ENODEV);
 }
 
 static inline void iommu_sva_unbind_device(struct iommu_sva *handle)
--- linux-qcom-6.8.0.orig/include/linux/ipc_namespace.h
+++ linux-qcom-6.8.0/include/linux/ipc_namespace.h
@@ -128,6 +128,9 @@
 static inline int mq_init_ns(struct ipc_namespace *ns) { return 0; }
 #endif
 
+extern struct ipc_namespace *get_ipc_ns_exported(struct ipc_namespace *ns);
+extern struct ipc_namespace *show_init_ipc_ns(void);
+
 #if defined(CONFIG_IPC_NS)
 extern struct ipc_namespace *copy_ipcs(unsigned long flags,
 	struct user_namespace *user_ns, struct ipc_namespace *ns);
--- linux-qcom-6.8.0.orig/include/linux/irqchip/arm-gic-v4.h
+++ linux-qcom-6.8.0/include/linux/irqchip/arm-gic-v4.h
@@ -58,10 +58,12 @@
 				bool	enabled;
 				bool	group;
 			}			sgi_config[16];
-			atomic_t vmapp_count;
 		};
 	};
 
+	/* Track the VPE being mapped */
+	atomic_t vmapp_count;
+
 	/*
 	 * Ensures mutual exclusion between affinity setting of the
 	 * vPE and vLPI operations using vpe->col_idx.
--- linux-qcom-6.8.0.orig/include/linux/irqflags.h
+++ linux-qcom-6.8.0/include/linux/irqflags.h
@@ -114,7 +114,7 @@
 # define lockdep_softirq_enter()		do { } while (0)
 # define lockdep_softirq_exit()			do { } while (0)
 # define lockdep_hrtimer_enter(__hrtimer)	false
-# define lockdep_hrtimer_exit(__context)	do { } while (0)
+# define lockdep_hrtimer_exit(__context)	do { (void)(__context); } while (0)
 # define lockdep_posixtimer_enter()		do { } while (0)
 # define lockdep_posixtimer_exit()		do { } while (0)
 # define lockdep_irq_work_enter(__work)		do { } while (0)
--- linux-qcom-6.8.0.orig/include/linux/jbd2.h
+++ linux-qcom-6.8.0/include/linux/jbd2.h
@@ -1086,6 +1086,13 @@
 	int			j_revoke_records_per_block;
 
 	/**
+	 * @j_transaction_overhead_buffers:
+	 *
+	 * Number of blocks each transaction needs for its own bookkeeping
+	 */
+	int			j_transaction_overhead_buffers;
+
+	/**
 	 * @j_commit_interval:
 	 *
 	 * What is the maximum transaction lifetime before we begin a commit?
@@ -1662,11 +1669,6 @@
 int jbd2_fc_wait_bufs(journal_t *journal, int num_blks);
 int jbd2_fc_release_bufs(journal_t *journal);
 
-static inline int jbd2_journal_get_max_txn_bufs(journal_t *journal)
-{
-	return (journal->j_total_len - journal->j_fc_wbufsize) / 4;
-}
-
 /*
  * is_journal_abort
  *
--- linux-qcom-6.8.0.orig/include/linux/jiffies.h
+++ linux-qcom-6.8.0/include/linux/jiffies.h
@@ -499,7 +499,7 @@
  * - all other values are converted to jiffies by either multiplying
  *   the input value by a factor or dividing it with a factor and
  *   handling any 32-bit overflows.
- *   for the details see __msecs_to_jiffies()
+ *   for the details see _msecs_to_jiffies()
  *
  * msecs_to_jiffies() checks for the passed in value being a constant
  * via __builtin_constant_p() allowing gcc to eliminate most of the
--- linux-qcom-6.8.0.orig/include/linux/kcov.h
+++ linux-qcom-6.8.0/include/linux/kcov.h
@@ -21,6 +21,8 @@
 	KCOV_MODE_TRACE_PC = 2,
 	/* Collecting comparison operands mode. */
 	KCOV_MODE_TRACE_CMP = 3,
+	/* The process owns a KCOV remote reference. */
+	KCOV_MODE_REMOTE = 4,
 };
 
 #define KCOV_IN_CTXSW	(1 << 30)
@@ -55,21 +57,47 @@
 
 /*
  * The softirq flavor of kcov_remote_*() functions is introduced as a temporary
- * work around for kcov's lack of nested remote coverage sections support in
- * task context. Adding support for nested sections is tracked in:
- * https://bugzilla.kernel.org/show_bug.cgi?id=210337
+ * workaround for KCOV's lack of nested remote coverage sections support.
+ *
+ * Adding support is tracked in https://bugzilla.kernel.org/show_bug.cgi?id=210337.
+ *
+ * kcov_remote_start_usb_softirq():
+ *
+ * 1. Only collects coverage when called in the softirq context. This allows
+ *    avoiding nested remote coverage collection sections in the task context.
+ *    For example, USB/IP calls usb_hcd_giveback_urb() in the task context
+ *    within an existing remote coverage collection section. Thus, KCOV should
+ *    not attempt to start collecting coverage within the coverage collection
+ *    section in __usb_hcd_giveback_urb() in this case.
+ *
+ * 2. Disables interrupts for the duration of the coverage collection section.
+ *    This allows avoiding nested remote coverage collection sections in the
+ *    softirq context (a softirq might occur during the execution of a work in
+ *    the BH workqueue, which runs with in_serving_softirq() > 0).
+ *    For example, usb_giveback_urb_bh() runs in the BH workqueue with
+ *    interrupts enabled, so __usb_hcd_giveback_urb() might be interrupted in
+ *    the middle of its remote coverage collection section, and the interrupt
+ *    handler might invoke __usb_hcd_giveback_urb() again.
  */
 
-static inline void kcov_remote_start_usb_softirq(u64 id)
+static inline unsigned long kcov_remote_start_usb_softirq(u64 id)
 {
-	if (in_serving_softirq())
+	unsigned long flags = 0;
+
+	if (in_serving_softirq()) {
+		local_irq_save(flags);
 		kcov_remote_start_usb(id);
+	}
+
+	return flags;
 }
 
-static inline void kcov_remote_stop_softirq(void)
+static inline void kcov_remote_stop_softirq(unsigned long flags)
 {
-	if (in_serving_softirq())
+	if (in_serving_softirq()) {
 		kcov_remote_stop();
+		local_irq_restore(flags);
+	}
 }
 
 #ifdef CONFIG_64BIT
@@ -103,8 +131,11 @@
 }
 static inline void kcov_remote_start_common(u64 id) {}
 static inline void kcov_remote_start_usb(u64 id) {}
-static inline void kcov_remote_start_usb_softirq(u64 id) {}
-static inline void kcov_remote_stop_softirq(void) {}
+static inline unsigned long kcov_remote_start_usb_softirq(u64 id)
+{
+	return 0;
+}
+static inline void kcov_remote_stop_softirq(unsigned long flags) {}
 
 #endif /* CONFIG_KCOV */
 #endif /* _LINUX_KCOV_H */
--- linux-qcom-6.8.0.orig/include/linux/kernfs.h
+++ linux-qcom-6.8.0/include/linux/kernfs.h
@@ -223,6 +223,8 @@
 	unsigned short		flags;
 	umode_t			mode;
 	struct kernfs_iattrs	*iattr;
+
+	struct rcu_head		rcu;
 };
 
 /*
--- linux-qcom-6.8.0.orig/include/linux/kexec.h
+++ linux-qcom-6.8.0/include/linux/kexec.h
@@ -502,10 +502,8 @@
 
 extern bool kexec_file_dbg_print;
 
-#define kexec_dprintk(fmt, ...)					\
-	printk("%s" fmt,					\
-	       kexec_file_dbg_print ? KERN_INFO : KERN_DEBUG,	\
-	       ##__VA_ARGS__)
+#define kexec_dprintk(fmt, arg...) \
+        do { if (kexec_file_dbg_print) pr_info(fmt, ##arg); } while (0)
 
 #else /* !CONFIG_KEXEC_CORE */
 struct pt_regs;
--- linux-qcom-6.8.0.orig/include/linux/kprobes.h
+++ linux-qcom-6.8.0/include/linux/kprobes.h
@@ -378,11 +378,15 @@
 extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
 				  struct ftrace_ops *ops, struct ftrace_regs *fregs);
 extern int arch_prepare_kprobe_ftrace(struct kprobe *p);
+/* Set when ftrace has been killed: kprobes on ftrace must be disabled for safety */
+extern bool kprobe_ftrace_disabled __read_mostly;
+extern void kprobe_ftrace_kill(void);
 #else
 static inline int arch_prepare_kprobe_ftrace(struct kprobe *p)
 {
 	return -EINVAL;
 }
+static inline void kprobe_ftrace_kill(void) {}
 #endif /* CONFIG_KPROBES_ON_FTRACE */
 
 /* Get the kprobe at this addr (if any) - called with preemption disabled */
@@ -495,6 +499,9 @@
 static inline void kprobe_free_init_mem(void)
 {
 }
+static inline void kprobe_ftrace_kill(void)
+{
+}
 static inline int disable_kprobe(struct kprobe *kp)
 {
 	return -EOPNOTSUPP;
--- linux-qcom-6.8.0.orig/include/linux/ksm.h
+++ linux-qcom-6.8.0/include/linux/ksm.h
@@ -33,28 +33,38 @@
  */
 #define is_ksm_zero_pte(pte)	(is_zero_pfn(pte_pfn(pte)) && pte_dirty(pte))
 
-extern unsigned long ksm_zero_pages;
+extern atomic_long_t ksm_zero_pages;
+
+static inline void ksm_map_zero_page(struct mm_struct *mm)
+{
+	atomic_long_inc(&ksm_zero_pages);
+	atomic_long_inc(&mm->ksm_zero_pages);
+}
 
 static inline void ksm_might_unmap_zero_page(struct mm_struct *mm, pte_t pte)
 {
 	if (is_ksm_zero_pte(pte)) {
-		ksm_zero_pages--;
-		mm->ksm_zero_pages--;
+		atomic_long_dec(&ksm_zero_pages);
+		atomic_long_dec(&mm->ksm_zero_pages);
 	}
 }
 
-static inline int ksm_fork(struct mm_struct *mm, struct mm_struct *oldmm)
+static inline long mm_ksm_zero_pages(struct mm_struct *mm)
 {
-	int ret;
+	return atomic_long_read(&mm->ksm_zero_pages);
+}
 
-	if (test_bit(MMF_VM_MERGEABLE, &oldmm->flags)) {
-		ret = __ksm_enter(mm);
-		if (ret)
-			return ret;
-	}
+static inline void ksm_fork(struct mm_struct *mm, struct mm_struct *oldmm)
+{
+	/* Adding mm to ksm is best effort on fork. */
+	if (test_bit(MMF_VM_MERGEABLE, &oldmm->flags))
+		__ksm_enter(mm);
+}
 
-	if (test_bit(MMF_VM_MERGE_ANY, &oldmm->flags))
-		set_bit(MMF_VM_MERGE_ANY, &mm->flags);
+static inline int ksm_execve(struct mm_struct *mm)
+{
+	if (test_bit(MMF_VM_MERGE_ANY, &mm->flags))
+		return __ksm_enter(mm);
 
 	return 0;
 }
@@ -102,7 +112,11 @@
 	return 0;
 }
 
-static inline int ksm_fork(struct mm_struct *mm, struct mm_struct *oldmm)
+static inline void ksm_fork(struct mm_struct *mm, struct mm_struct *oldmm)
+{
+}
+
+static inline int ksm_execve(struct mm_struct *mm)
 {
 	return 0;
 }
--- linux-qcom-6.8.0.orig/include/linux/kvm_host.h
+++ linux-qcom-6.8.0/include/linux/kvm_host.h
@@ -2323,12 +2323,6 @@
 }
 #endif /* CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE */
 
-typedef int (*kvm_vm_thread_fn_t)(struct kvm *kvm, uintptr_t data);
-
-int kvm_vm_create_worker_thread(struct kvm *kvm, kvm_vm_thread_fn_t thread_fn,
-				uintptr_t data, const char *name,
-				struct task_struct **thread_ptr);
-
 #ifdef CONFIG_KVM_XFER_TO_GUEST_WORK
 static inline void kvm_handle_signal_exit(struct kvm_vcpu *vcpu)
 {
--- linux-qcom-6.8.0.orig/include/linux/leds.h
+++ linux-qcom-6.8.0/include/linux/leds.h
@@ -244,7 +244,7 @@
 	struct kernfs_node	*brightness_hw_changed_kn;
 #endif
 
-	/* Ensures consistent access to the LED Flash Class device */
+	/* Ensures consistent access to the LED class device */
 	struct mutex		led_access;
 };
 
@@ -474,6 +474,9 @@
 	int		(*activate)(struct led_classdev *led_cdev);
 	void		(*deactivate)(struct led_classdev *led_cdev);
 
+	/* Brightness set by led_trigger_event */
+	enum led_brightness brightness;
+
 	/* LED-private triggers have this set */
 	struct led_hw_trigger_type *trigger_type;
 
@@ -527,6 +530,12 @@
 	return led_cdev->trigger_data;
 }
 
+static inline enum led_brightness
+led_trigger_get_brightness(const struct led_trigger *trigger)
+{
+	return trigger ? trigger->brightness : LED_OFF;
+}
+
 #define module_led_trigger(__led_trigger) \
 	module_driver(__led_trigger, led_trigger_register, \
 		      led_trigger_unregister)
@@ -563,6 +572,12 @@
 	return NULL;
 }
 
+static inline enum led_brightness
+led_trigger_get_brightness(const struct led_trigger *trigger)
+{
+	return LED_OFF;
+}
+
 #endif /* CONFIG_LEDS_TRIGGERS */
 
 /* Trigger specific enum */
--- linux-qcom-6.8.0.orig/include/linux/libata.h
+++ linux-qcom-6.8.0/include/linux/libata.h
@@ -107,6 +107,7 @@
 
 	ATA_DFLAG_NCQ_PRIO_ENABLED = (1 << 20), /* Priority cmds sent to dev */
 	ATA_DFLAG_CDL_ENABLED	= (1 << 21), /* cmd duration limits is enabled */
+	ATA_DFLAG_RESUMING	= (1 << 22),  /* Device is resuming */
 	ATA_DFLAG_DETACH	= (1 << 24),
 	ATA_DFLAG_DETACHED	= (1 << 25),
 	ATA_DFLAG_DA		= (1 << 26), /* device supports Device Attention */
@@ -1241,6 +1242,7 @@
 extern struct ata_port *ata_sas_port_alloc(struct ata_host *,
 					   struct ata_port_info *, struct Scsi_Host *);
 extern void ata_port_probe(struct ata_port *ap);
+extern void ata_port_free(struct ata_port *ap);
 extern int ata_sas_tport_add(struct device *parent, struct ata_port *ap);
 extern void ata_sas_tport_delete(struct ata_port *ap);
 extern int ata_sas_slave_configure(struct scsi_device *, struct ata_port *);
--- linux-qcom-6.8.0.orig/include/linux/lockdep.h
+++ linux-qcom-6.8.0/include/linux/lockdep.h
@@ -173,7 +173,7 @@
 			      (lock)->dep_map.lock_type)
 
 #define lockdep_set_subclass(lock, sub)					\
-	lockdep_init_map_type(&(lock)->dep_map, #lock, (lock)->dep_map.key, sub,\
+	lockdep_init_map_type(&(lock)->dep_map, (lock)->dep_map.name, (lock)->dep_map.key, sub,\
 			      (lock)->dep_map.wait_type_inner,		\
 			      (lock)->dep_map.wait_type_outer,		\
 			      (lock)->dep_map.lock_type)
--- linux-qcom-6.8.0.orig/include/linux/lsm/apparmor.h
+++ linux-qcom-6.8.0/include/linux/lsm/apparmor.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Linux Security Module interface to other subsystems.
+ * AppArmor presents a single u32 value which is known as a secid.
+ */
+#ifndef __LINUX_LSM_APPARMOR_H
+#define __LINUX_LSM_APPARMOR_H
+
+struct aa_label;
+
+struct lsmblob_apparmor {
+#ifdef CONFIG_SECURITY_APPARMOR
+	struct aa_label *label;
+#endif
+};
+
+#endif /* ! __LINUX_LSM_APPARMOR_H */
--- linux-qcom-6.8.0.orig/include/linux/lsm/bpf.h
+++ linux-qcom-6.8.0/include/linux/lsm/bpf.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Linux Security Module interface to other subsystems.
+ * BPF may present a single u32 value.
+ */
+#ifndef __LINUX_LSM_BPF_H
+#define __LINUX_LSM_BPF_H
+#include <linux/types.h>
+
+struct lsmblob_bpf {
+#ifdef CONFIG_BPF_LSM
+	u32 secid;
+#endif
+};
+
+#endif /* ! __LINUX_LSM_BPF_H */
--- linux-qcom-6.8.0.orig/include/linux/lsm/selinux.h
+++ linux-qcom-6.8.0/include/linux/lsm/selinux.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Linux Security Module interface to other subsystems.
+ * SELinux presents a single u32 value which is known as a secid.
+ */
+#ifndef __LINUX_LSM_SELINUX_H
+#define __LINUX_LSM_SELINUX_H
+#include <linux/types.h>
+
+struct lsmblob_selinux {
+#ifdef CONFIG_SECURITY_SELINUX
+	u32 secid;
+#endif
+};
+
+#endif /* ! __LINUX_LSM_SELINUX_H */
--- linux-qcom-6.8.0.orig/include/linux/lsm/smack.h
+++ linux-qcom-6.8.0/include/linux/lsm/smack.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Linux Security Module interface to other subsystems.
+ * Smack presents a pointer into the global Smack label list.
+ */
+#ifndef __LINUX_LSM_SMACK_H
+#define __LINUX_LSM_SMACK_H
+
+struct smack_known;
+
+struct lsmblob_smack {
+#ifdef CONFIG_SECURITY_SMACK
+	struct smack_known *skp;
+#endif
+};
+
+#endif /* ! __LINUX_LSM_SMACK_H */
--- linux-qcom-6.8.0.orig/include/linux/lsm_hook_defs.h
+++ linux-qcom-6.8.0/include/linux/lsm_hook_defs.h
@@ -83,7 +83,7 @@
 	 const struct path *to_path)
 LSM_HOOK(int, -EOPNOTSUPP, dentry_init_security, struct dentry *dentry,
 	 int mode, const struct qstr *name, const char **xattr_name,
-	 void **ctx, u32 *ctxlen)
+	 struct lsmcontext *cp)
 LSM_HOOK(int, 0, dentry_create_files_as, struct dentry *dentry, int mode,
 	 struct qstr *name, const struct cred *old, struct cred *new)
 
@@ -161,7 +161,8 @@
 	 const char *name, const void *value, size_t size, int flags)
 LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer,
 	 size_t buffer_size)
-LSM_HOOK(void, LSM_RET_VOID, inode_getsecid, struct inode *inode, u32 *secid)
+LSM_HOOK(void, LSM_RET_VOID, inode_getlsmblob, struct inode *inode,
+	 struct lsmblob *blob)
 LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new)
 LSM_HOOK(int, -EOPNOTSUPP, inode_copy_up_xattr, const char *name)
 LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir,
@@ -197,6 +198,8 @@
 LSM_HOOK(void, LSM_RET_VOID, cred_transfer, struct cred *new,
 	 const struct cred *old)
 LSM_HOOK(void, LSM_RET_VOID, cred_getsecid, const struct cred *c, u32 *secid)
+LSM_HOOK(void, LSM_RET_VOID, cred_getlsmblob, const struct cred *c,
+	 struct lsmblob *blob)
 LSM_HOOK(int, 0, kernel_act_as, struct cred *new, u32 secid)
 LSM_HOOK(int, 0, kernel_create_files_as, struct cred *new, struct inode *inode)
 LSM_HOOK(int, 0, kernel_module_request, char *kmod_name)
@@ -215,9 +218,9 @@
 LSM_HOOK(int, 0, task_setpgid, struct task_struct *p, pid_t pgid)
 LSM_HOOK(int, 0, task_getpgid, struct task_struct *p)
 LSM_HOOK(int, 0, task_getsid, struct task_struct *p)
-LSM_HOOK(void, LSM_RET_VOID, current_getsecid_subj, u32 *secid)
-LSM_HOOK(void, LSM_RET_VOID, task_getsecid_obj,
-	 struct task_struct *p, u32 *secid)
+LSM_HOOK(void, LSM_RET_VOID, current_getlsmblob_subj, struct lsmblob *blob)
+LSM_HOOK(void, LSM_RET_VOID, task_getlsmblob_obj,
+	 struct task_struct *p, struct lsmblob *blob)
 LSM_HOOK(int, 0, task_setnice, struct task_struct *p, int nice)
 LSM_HOOK(int, 0, task_setioprio, struct task_struct *p, int ioprio)
 LSM_HOOK(int, 0, task_getioprio, struct task_struct *p)
@@ -236,8 +239,8 @@
 	 struct inode *inode)
 LSM_HOOK(int, 0, userns_create, const struct cred *cred)
 LSM_HOOK(int, 0, ipc_permission, struct kern_ipc_perm *ipcp, short flag)
-LSM_HOOK(void, LSM_RET_VOID, ipc_getsecid, struct kern_ipc_perm *ipcp,
-	 u32 *secid)
+LSM_HOOK(void, LSM_RET_VOID, ipc_getlsmblob, struct kern_ipc_perm *ipcp,
+	 struct lsmblob *blob)
 LSM_HOOK(int, 0, msg_msg_alloc_security, struct msg_msg *msg)
 LSM_HOOK(void, LSM_RET_VOID, msg_msg_free_security, struct msg_msg *msg)
 LSM_HOOK(int, 0, msg_queue_alloc_security, struct kern_ipc_perm *perm)
@@ -265,22 +268,23 @@
 LSM_HOOK(void, LSM_RET_VOID, d_instantiate, struct dentry *dentry,
 	 struct inode *inode)
 LSM_HOOK(int, -EOPNOTSUPP, getselfattr, unsigned int attr,
-	 struct lsm_ctx __user *ctx, size_t *size, u32 flags)
+	 struct lsm_ctx __user *ctx, u32 *size, u32 flags)
 LSM_HOOK(int, -EOPNOTSUPP, setselfattr, unsigned int attr,
-	 struct lsm_ctx *ctx, size_t size, u32 flags)
+	 struct lsm_ctx *ctx, u32 size, u32 flags)
 LSM_HOOK(int, -EINVAL, getprocattr, struct task_struct *p, const char *name,
 	 char **value)
 LSM_HOOK(int, -EINVAL, setprocattr, const char *name, void *value, size_t size)
 LSM_HOOK(int, 0, ismaclabel, const char *name)
-LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, char **secdata,
-	 u32 *seclen)
+LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, struct lsmcontext *cp)
+LSM_HOOK(int, -EOPNOTSUPP, lsmblob_to_secctx, struct lsmblob *blob,
+	 struct lsmcontext *cp)
 LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *secid)
-LSM_HOOK(void, LSM_RET_VOID, release_secctx, char *secdata, u32 seclen)
+LSM_HOOK(void, LSM_RET_VOID, release_secctx, struct lsmcontext *cp)
 LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode)
 LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 ctxlen)
 LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen)
-LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode, void **ctx,
-	 u32 *ctxlen)
+LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode,
+	 struct lsmcontext *cp)
 
 #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
 LSM_HOOK(int, 0, post_notification, const struct cred *w_cred,
@@ -394,10 +398,11 @@
 
 #ifdef CONFIG_AUDIT
 LSM_HOOK(int, 0, audit_rule_init, u32 field, u32 op, char *rulestr,
-	 void **lsmrule)
+	 void **lsmrule, int lsmid, gfp_t gfp)
 LSM_HOOK(int, 0, audit_rule_known, struct audit_krule *krule)
-LSM_HOOK(int, 0, audit_rule_match, u32 secid, u32 field, u32 op, void *lsmrule)
-LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule)
+LSM_HOOK(int, 0, audit_rule_match, struct lsmblob *blob, u32 field, u32 op,
+	 void *lsmrule, int lsmid)
+LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule, int lsmid)
 #endif /* CONFIG_AUDIT */
 
 #ifdef CONFIG_BPF_SYSCALL
@@ -411,6 +416,8 @@
 #endif /* CONFIG_BPF_SYSCALL */
 
 LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)
+LSM_HOOK(int, 0, lock_kernel_down, const char *where, enum lockdown_reason level)
+
 
 #ifdef CONFIG_PERF_EVENTS
 LSM_HOOK(int, 0, perf_event_open, struct perf_event_attr *attr, int type)
--- linux-qcom-6.8.0.orig/include/linux/lsm_hooks.h
+++ linux-qcom-6.8.0/include/linux/lsm_hooks.h
@@ -47,12 +47,14 @@
  * struct lsm_id - Identify a Linux Security Module.
  * @lsm: name of the LSM, must be approved by the LSM maintainers
  * @id: LSM ID number from uapi/linux/lsm.h
+ * @lsmblob: indicates the LSM has an entry in struct lsmblob
  *
  * Contains the information that identifies the LSM.
  */
 struct lsm_id {
 	const char	*name;
 	u64		id;
+	bool		lsmblob;
 };
 
 /*
@@ -73,11 +75,16 @@
 	int	lbs_cred;
 	int	lbs_file;
 	int	lbs_inode;
+	int	lbs_sock;
 	int	lbs_superblock;
 	int	lbs_ipc;
+	int	lbs_key;
 	int	lbs_msg_msg;
 	int	lbs_task;
 	int	lbs_xattr_count; /* number of xattr slots in new_xattrs array */
+	int	lbs_mnt_opts;
+	bool	lbs_secmark;	/* expressed desire for secmark use */
+	bool	lbs_netlabel;	/* expressed desire for netlabel use */
 };
 
 /**
@@ -151,5 +158,6 @@
 		__aligned(sizeof(unsigned long))
 
 extern int lsm_inode_alloc(struct inode *inode);
+extern void *lsm_mnt_opts_alloc(gfp_t priority);
 
 #endif /* ! __LINUX_LSM_HOOKS_H */
--- linux-qcom-6.8.0.orig/include/linux/maple_tree.h
+++ linux-qcom-6.8.0/include/linux/maple_tree.h
@@ -171,6 +171,7 @@
 #define MT_FLAGS_LOCK_IRQ	0x100
 #define MT_FLAGS_LOCK_BH	0x200
 #define MT_FLAGS_LOCK_EXTERN	0x300
+#define MT_FLAGS_ALLOC_WRAPPED	0x0800
 
 #define MAPLE_HEIGHT_MAX	31
 
@@ -319,6 +320,9 @@
 int mtree_alloc_range(struct maple_tree *mt, unsigned long *startp,
 		void *entry, unsigned long size, unsigned long min,
 		unsigned long max, gfp_t gfp);
+int mtree_alloc_cyclic(struct maple_tree *mt, unsigned long *startp,
+		void *entry, unsigned long range_lo, unsigned long range_hi,
+		unsigned long *next, gfp_t gfp);
 int mtree_alloc_rrange(struct maple_tree *mt, unsigned long *startp,
 		void *entry, unsigned long size, unsigned long min,
 		unsigned long max, gfp_t gfp);
@@ -499,6 +503,9 @@
 void *mas_find_rev(struct ma_state *mas, unsigned long min);
 void *mas_find_range_rev(struct ma_state *mas, unsigned long max);
 int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp);
+int mas_alloc_cyclic(struct ma_state *mas, unsigned long *startp,
+		void *entry, unsigned long range_lo, unsigned long range_hi,
+		unsigned long *next, gfp_t gfp);
 
 bool mas_nomem(struct ma_state *mas, gfp_t gfp);
 void mas_pause(struct ma_state *mas);
--- linux-qcom-6.8.0.orig/include/linux/mem-buf-exporter.h
+++ linux-qcom-6.8.0/include/linux/mem-buf-exporter.h
@@ -0,0 +1,120 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ *  Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ *  Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MEM_BUF_EXPORTER_H
+#define _MEM_BUF_EXPORTER_H
+
+#include <linux/dma-buf.h>
+#include <linux/gunyah/gh_rm_drv.h>
+#include <soc/qcom/secure_buffer.h>
+
+int mem_buf_dma_buf_attach(struct dma_buf *dmabuf,
+		      struct dma_buf_attachment *attachment);
+
+/* Private data for managing a dmabuf's Virtual Machine permissions. */
+struct mem_buf_vmperm;
+
+/*
+ * @lookup: Returns the mem_buf_vmperm data structure contained somewhere
+ * in the exporter's private_data, or a negative number on error.
+ * @attach: The exporter's normal dma_buf_attach callback
+ * @dma_ops: The exporter's standard dma_buf callbacks, except for
+ * attach which must be NULL.
+ */
+struct mem_buf_dma_buf_ops {
+	struct mem_buf_vmperm *(*lookup)(struct dma_buf *dmabuf);
+	int (*attach)(struct dma_buf *dmabuf, struct dma_buf_attachment *a);
+	struct dma_buf_ops dma_ops;
+};
+
+struct dma_buf *
+mem_buf_dma_buf_export(struct dma_buf_export_info *exp_info,
+			struct mem_buf_dma_buf_ops *ops);
+
+
+#define MEM_BUF_WRAPPER_FLAG_STATIC_VM BIT(0)
+#define MEM_BUF_WRAPPER_FLAG_LENDSHARE BIT(1)
+#define MEM_BUF_WRAPPER_FLAG_ACCEPT BIT(2)
+#define MEM_BUF_WRAPPER_FLAG_ERR BIT(3)
+
+/*
+ * A dmabuf owned by the current VM with RWX permissions.
+ * All variants should be free'd via mem_buf_vmperm_free().
+ *
+ * @dmabuf: value returned from dma_buf_export()
+ * @sgt: Reference to the exporter's internal memory descriptor.
+ * Will not be freed by mem_buf_vmperm_free().
+ */
+struct mem_buf_vmperm *mem_buf_vmperm_alloc(struct sg_table *sgt);
+
+/*
+ * A dmabuf which permantently belongs to the given VMs & permissions.
+ */
+struct mem_buf_vmperm *mem_buf_vmperm_alloc_staticvm(struct sg_table *sgt, int *vmids, int *perms,
+		u32 nr_acl_entries);
+
+/*
+ * A dmabuf in the "MEMACCEPT" state.
+ */
+struct mem_buf_vmperm *mem_buf_vmperm_alloc_accept(struct sg_table *sgt,
+	gh_memparcel_handle_t memparcel_hdl, int *vmids, int *perms,
+	unsigned int nr_acl_entries);
+
+/*
+ * Performs the expected close step based on whether the dmabuf
+ * is of the "STATICVM" "MEMACCEPT" or "DEFAULT" type.
+ * Exporters should call this from dma_buf_release. If this function
+ * Returns an error, exporters should consider the underlying memory
+ * to have undefined permissions.
+ */
+int mem_buf_vmperm_release(struct mem_buf_vmperm *vmperm);
+
+/*
+ * Pins ths permissions of the dmabuf.
+ * The exporter should call this from dma_buf_mmap, vm_ops->open(), and
+ * dma_buf_map_attachment. It must not be called from
+ * dma_buf_begin_cpu_access as userspace may call this function unsafely
+ * via DMA_BUF_IOCTL_SYNC.
+ */
+void mem_buf_vmperm_pin(struct mem_buf_vmperm *vmperm);
+
+/*
+ * Unpins ths permissions of the dmabuf.
+ * The exporter should call this from vm_ops->close(), and
+ * dma_buf_unmap_attachment. It must not be called from
+ * dma_buf_end_cpu_access as userspace may call this function unsafely
+ * via DMA_BUF_IOCTL_SYNC.
+ */
+void mem_buf_vmperm_unpin(struct mem_buf_vmperm *vmperm);
+
+/*
+ * Check whether the current permissions of the dmabuf allow CMO.
+ * Requires RW.
+ *
+ * The exporter should call this during dma_buf_map/unmap_attachment,
+ * and dma_buf_begin/end_cpu_access.
+ */
+bool mem_buf_vmperm_can_cmo(struct mem_buf_vmperm *vmperm);
+
+/*
+ * Check whether the current permissions of the dmabuf allow mmap.
+ * Requires at minimum the permissions specified in vma.
+ *
+ * The exporter should call mem_buf_vmperm_pin() from mmap.
+ * The exporter should implement the open() and close() operations of
+ * vma->vm_ops, and call mem_buf_vmperm_pin()/unpin() respectively.
+ */
+bool mem_buf_vmperm_can_mmap(struct mem_buf_vmperm *vmperm, struct vm_area_struct *vma);
+
+/*
+ * Check whether the current permissions of the dmabuf allow vmap.
+ * Requires RW.
+ *
+ * The exporter should call this during dma_buf_vmap,
+ */
+bool mem_buf_vmperm_can_vmap(struct mem_buf_vmperm *vmperm);
+
+#endif /*_MEM_BUF_EXPORTER_H */
--- linux-qcom-6.8.0.orig/include/linux/mem-buf.h
+++ linux-qcom-6.8.0/include/linux/mem-buf.h
@@ -0,0 +1,139 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ *  Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ *  Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MEM_BUF_H
+#define _MEM_BUF_H
+
+#include <linux/err.h>
+#include <linux/errno.h>
+#include <linux/gunyah/gh_rm_drv.h>
+#include <linux/types.h>
+#include <linux/dma-buf.h>
+#include <uapi/linux/mem-buf.h>
+
+/* For in-kernel use only, not allowed for userspace ioctl */
+#define MEM_BUF_BUDDY_MEM_TYPE (MEM_BUF_ION_MEM_TYPE + 2)
+
+/* Used to obtain the underlying vmperm struct of a DMA-BUF */
+struct mem_buf_vmperm *to_mem_buf_vmperm(struct dma_buf *dmabuf);
+
+/* Returns true if the local VM has exclusive access and is the owner */
+bool mem_buf_dma_buf_exclusive_owner(struct dma_buf *dmabuf);
+
+/*
+ * Returns the Virtual Machine vmids & permissions of the dmabuf. Can't be
+ * modified.
+ */
+int mem_buf_dma_buf_get_vmperm(struct dma_buf *dmabuf, const int **vmids,
+		const int **perms, int *nr_acl_entries);
+/*
+ * Returns a copy of the Virtual Machine vmids & permissions of the dmabuf.
+ * The caller must kfree() when finished.
+ */
+int mem_buf_dma_buf_copy_vmperm(struct dma_buf *dmabuf, int **vmids, int **perms,
+		int *nr_acl_entries);
+
+/*
+ * Returns 0 if @dmabuf has a valid memparcel handle and stores it in
+ * memparcel_hdl
+ */
+int mem_buf_dma_buf_get_memparcel_hdl(struct dma_buf *dmabuf,
+				      gh_memparcel_handle_t *memparcel_hdl);
+
+typedef int (*mem_buf_dma_buf_destructor)(void *dtor_data);
+int mem_buf_dma_buf_set_destructor(struct dma_buf *dmabuf,
+				   mem_buf_dma_buf_destructor dtor,
+				   void *dtor_data);
+
+/**
+ * struct mem_buf_allocation_data - Data structure that contains information
+ * about a memory buffer allocation request.
+ * @size: The size (in bytes) of the memory to be requested from a remote VM
+ * @nr_acl_entries: The number of ACL entries in @acl_list
+ * @acl_list: A list of VMID and permission pairs that describe what VMIDs will
+ * have access to the memory, and with what permissions
+ * @trans_type: One of GH_RM_TRANS_TYPE_DONATE/LEND/SHARE
+ * @sgl_desc: Optional. Requests a specific set of IPA addresses.
+ * @src_mem_type: The type of memory that the remote VM should allocate
+ * (e.g. ION memory)
+ * @src_data: A pointer to memory type specific data that the remote VM may need
+ * when performing an allocation (e.g. ION memory allocations require a heap ID)
+ * @dst_mem_type: The type of memory that the native VM wants (e.g. ION memory)
+ * @dst_data: A pointer to memory type specific data that the native VM may
+ * need when adding the memory from the remote VM (e.g. ION memory requires a
+ * heap ID to add the memory to).
+ */
+struct mem_buf_allocation_data {
+	size_t size;
+	unsigned int nr_acl_entries;
+	int *vmids;
+	int *perms;
+	u32 trans_type;
+	struct gh_sgl_desc *sgl_desc;
+	enum mem_buf_mem_type src_mem_type;
+	void *src_data;
+	enum mem_buf_mem_type dst_mem_type;
+	void *dst_data;
+};
+
+struct mem_buf_lend_kernel_arg {
+	unsigned int nr_acl_entries;
+	int *vmids;
+	int *perms;
+	gh_memparcel_handle_t memparcel_hdl;
+	u32 flags;
+	u64 label;
+};
+
+int mem_buf_lend(struct dma_buf *dmabuf,
+		struct mem_buf_lend_kernel_arg *arg);
+
+/*
+ * mem_buf_share
+ * Grant the local VM, as well as one or more remote VMs access
+ * to the dmabuf. The permissions of the local VM default to RWX
+ * unless otherwise specified.
+ */
+int mem_buf_share(struct dma_buf *dmabuf,
+		struct mem_buf_lend_kernel_arg *arg);
+
+
+struct mem_buf_retrieve_kernel_arg {
+	int sender_vmid;
+	unsigned int nr_acl_entries;
+	int *vmids;
+	int *perms;
+	gh_memparcel_handle_t memparcel_hdl;
+	int fd_flags;
+};
+struct dma_buf *mem_buf_retrieve(struct mem_buf_retrieve_kernel_arg *arg);
+int mem_buf_reclaim(struct dma_buf *dmabuf);
+
+#if IS_ENABLED(CONFIG_QCOM_MEM_BUF)
+
+void *mem_buf_alloc(struct mem_buf_allocation_data *alloc_data);
+void mem_buf_free(void *membuf);
+struct gh_sgl_desc *mem_buf_get_sgl(void *membuf);
+int mem_buf_current_vmid(void);
+#else
+
+static inline void *mem_buf_alloc(struct mem_buf_allocation_data *alloc_data)
+{
+	return ERR_PTR(-ENODEV);
+}
+
+static inline void mem_buf_free(void *membuf) {}
+
+static inline struct gh_sgl_desc *mem_buf_get_sgl(void *membuf)
+{
+	return ERR_PTR(-EINVAL);
+}
+static inline int mem_buf_current_vmid(void)
+{
+	return -EINVAL;
+}
+#endif /* CONFIG_QCOM_MEM_BUF */
+#endif /* _MEM_BUF_H */
--- linux-qcom-6.8.0.orig/include/linux/memfd.h
+++ linux-qcom-6.8.0/include/linux/memfd.h
@@ -6,11 +6,25 @@
 
 #ifdef CONFIG_MEMFD_CREATE
 extern long memfd_fcntl(struct file *file, unsigned int cmd, unsigned int arg);
+unsigned int *memfd_file_seals_ptr(struct file *file);
 #else
 static inline long memfd_fcntl(struct file *f, unsigned int c, unsigned int a)
 {
 	return -EINVAL;
 }
+
+static inline unsigned int *memfd_file_seals_ptr(struct file *file)
+{
+	return NULL;
+}
 #endif
 
+/* Retrieve memfd seals associated with the file, if any. */
+static inline unsigned int memfd_file_seals(struct file *file)
+{
+	unsigned int *sealsp = memfd_file_seals_ptr(file);
+
+	return sealsp ? *sealsp : 0;
+}
+
 #endif /* __LINUX_MEMFD_H */
--- linux-qcom-6.8.0.orig/include/linux/memory.h
+++ linux-qcom-6.8.0/include/linux/memory.h
@@ -96,8 +96,17 @@
 #define	MEM_GOING_ONLINE	(1<<3)
 #define	MEM_CANCEL_ONLINE	(1<<4)
 #define	MEM_CANCEL_OFFLINE	(1<<5)
+#define	MEM_PREPARE_ONLINE	(1<<6)
+#define	MEM_FINISH_OFFLINE	(1<<7)
 
 struct memory_notify {
+	/*
+	 * The altmap_start_pfn and altmap_nr_pages fields are designated for
+	 * specifying the altmap range and are exclusively intended for use in
+	 * MEM_PREPARE_ONLINE/MEM_FINISH_OFFLINE notifiers.
+	 */
+	unsigned long altmap_start_pfn;
+	unsigned long altmap_nr_pages;
 	unsigned long start_pfn;
 	unsigned long nr_pages;
 	int status_change_nid_normal;
--- linux-qcom-6.8.0.orig/include/linux/memory_hotplug.h
+++ linux-qcom-6.8.0/include/linux/memory_hotplug.h
@@ -106,6 +106,22 @@
  * implies the node id (nid).
  */
 #define MHP_NID_IS_MGID		((__force mhp_t)BIT(2))
+/*
+ * The hotplugged memory is completely inaccessible while the memory is
+ * offline. The memory provider will handle MEM_PREPARE_ONLINE /
+ * MEM_FINISH_OFFLINE notifications and make the memory accessible.
+ *
+ * This flag is only relevant when used along with MHP_MEMMAP_ON_MEMORY,
+ * because the altmap cannot be written (e.g., poisoned) when adding
+ * memory -- before it is set online.
+ *
+ * This allows for adding memory with an altmap that is not currently
+ * made available by a hypervisor. When onlining that memory, the
+ * hypervisor can be instructed to make that memory available, and
+ * the onlining phase will not require any memory allocations, which is
+ * helpful in low-memory situations.
+ */
+#define MHP_OFFLINE_INACCESSIBLE	((__force mhp_t)BIT(3))
 
 /*
  * Extended parameters for memory hotplug:
@@ -154,7 +170,7 @@
 				      long nr_pages);
 /* VM interface that may be used by firmware interface */
 extern int mhp_init_memmap_on_memory(unsigned long pfn, unsigned long nr_pages,
-				     struct zone *zone);
+				     struct zone *zone, bool mhp_off_inaccessible);
 extern void mhp_deinit_memmap_on_memory(unsigned long pfn, unsigned long nr_pages);
 extern int online_pages(unsigned long pfn, unsigned long nr_pages,
 			struct zone *zone, struct memory_group *group);
--- linux-qcom-6.8.0.orig/include/linux/mempolicy.h
+++ linux-qcom-6.8.0/include/linux/mempolicy.h
@@ -167,7 +167,8 @@
 /* Check if a vma is migratable */
 extern bool vma_migratable(struct vm_area_struct *vma);
 
-int mpol_misplaced(struct folio *, struct vm_area_struct *, unsigned long);
+int mpol_misplaced(struct folio *folio, struct vm_fault *vmf,
+					unsigned long addr);
 extern void mpol_put_task_policy(struct task_struct *);
 
 static inline bool mpol_is_preferred_many(struct mempolicy *pol)
@@ -282,7 +283,7 @@
 #endif
 
 static inline int mpol_misplaced(struct folio *folio,
-				 struct vm_area_struct *vma,
+				 struct vm_fault *vmf,
 				 unsigned long address)
 {
 	return -1; /* no node preference */
--- linux-qcom-6.8.0.orig/include/linux/memremap.h
+++ linux-qcom-6.8.0/include/linux/memremap.h
@@ -25,6 +25,7 @@
 	unsigned long free;
 	unsigned long align;
 	unsigned long alloc;
+	bool inaccessible;
 };
 
 /*
--- linux-qcom-6.8.0.orig/include/linux/migrate.h
+++ linux-qcom-6.8.0/include/linux/migrate.h
@@ -142,9 +142,16 @@
 }
 
 #ifdef CONFIG_NUMA_BALANCING
+int migrate_misplaced_folio_prepare(struct folio *folio,
+		struct vm_area_struct *vma, int node);
 int migrate_misplaced_folio(struct folio *folio, struct vm_area_struct *vma,
 			   int node);
 #else
+static inline int migrate_misplaced_folio_prepare(struct folio *folio,
+		struct vm_area_struct *vma, int node)
+{
+	return -EAGAIN; /* can't migrate now */
+}
 static inline int migrate_misplaced_folio(struct folio *folio,
 					 struct vm_area_struct *vma, int node)
 {
--- linux-qcom-6.8.0.orig/include/linux/mlx5/device.h
+++ linux-qcom-6.8.0/include/linux/mlx5/device.h
@@ -294,6 +294,7 @@
 #define MLX5_UMR_FLEX_ALIGNMENT 0x40
 #define MLX5_UMR_MTT_NUM_ENTRIES_ALIGNMENT (MLX5_UMR_FLEX_ALIGNMENT / sizeof(struct mlx5_mtt))
 #define MLX5_UMR_KLM_NUM_ENTRIES_ALIGNMENT (MLX5_UMR_FLEX_ALIGNMENT / sizeof(struct mlx5_klm))
+#define MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT (MLX5_UMR_FLEX_ALIGNMENT / sizeof(struct mlx5_ksm))
 
 #define MLX5_USER_INDEX_LEN (MLX5_FLD_SZ_BYTES(qpc, user_index) * 8)
 
--- linux-qcom-6.8.0.orig/include/linux/mlx5/driver.h
+++ linux-qcom-6.8.0/include/linux/mlx5/driver.h
@@ -553,6 +553,7 @@
 	 * creation/deletion on drivers rescan. Unset during device attach.
 	 */
 	MLX5_PRIV_FLAGS_DETACH = 1 << 2,
+	MLX5_PRIV_FLAGS_SWITCH_LEGACY = 1 << 3,
 };
 
 struct mlx5_adev {
@@ -861,6 +862,7 @@
 	void		       *context;
 	int			idx;
 	struct completion	handling;
+	struct completion	slotted;
 	struct completion	done;
 	struct mlx5_cmd        *cmd;
 	struct work_struct	work;
@@ -1219,6 +1221,12 @@
 	return dev->coredev_type == MLX5_COREDEV_VF;
 }
 
+static inline bool mlx5_core_same_coredev_type(const struct mlx5_core_dev *dev1,
+					       const struct mlx5_core_dev *dev2)
+{
+	return dev1->coredev_type == dev2->coredev_type;
+}
+
 static inline bool mlx5_core_is_ecpf(const struct mlx5_core_dev *dev)
 {
 	return dev->caps.embedded_cpu;
--- linux-qcom-6.8.0.orig/include/linux/mlx5/mlx5_ifc.h
+++ linux-qcom-6.8.0/include/linux/mlx5/mlx5_ifc.h
@@ -1011,7 +1011,8 @@
 
 	u8         max_tsar_bw_share[0x20];
 
-	u8         reserved_at_100[0x20];
+	u8         nic_element_type[0x10];
+	u8         nic_tsar_type[0x10];
 
 	u8         reserved_at_120[0x3];
 	u8         log_meter_aso_granularity[0x5];
@@ -3883,10 +3884,11 @@
 };
 
 enum {
-	ELEMENT_TYPE_CAP_MASK_TASR		= 1 << 0,
+	ELEMENT_TYPE_CAP_MASK_TSAR		= 1 << 0,
 	ELEMENT_TYPE_CAP_MASK_VPORT		= 1 << 1,
 	ELEMENT_TYPE_CAP_MASK_VPORT_TC		= 1 << 2,
 	ELEMENT_TYPE_CAP_MASK_PARA_VPORT_TC	= 1 << 3,
+	ELEMENT_TYPE_CAP_MASK_QUEUE_GROUP	= 1 << 4,
 };
 
 struct mlx5_ifc_scheduling_context_bits {
@@ -4594,6 +4596,12 @@
 	TSAR_ELEMENT_TSAR_TYPE_ETS = 0x2,
 };
 
+enum {
+	TSAR_TYPE_CAP_MASK_DWRR		= 1 << 0,
+	TSAR_TYPE_CAP_MASK_ROUND_ROBIN	= 1 << 1,
+	TSAR_TYPE_CAP_MASK_ETS		= 1 << 2,
+};
+
 struct mlx5_ifc_tsar_element_bits {
 	u8         reserved_at_0[0x8];
 	u8         tsar_type[0x8];
@@ -10265,9 +10273,9 @@
 	u8         mfrl[0x1];
 	u8         regs_39_to_32[0x8];
 
-	u8         regs_31_to_10[0x16];
+	u8         regs_31_to_11[0x15];
 	u8         mtmp[0x1];
-	u8         regs_8_to_0[0x9];
+	u8         regs_9_to_0[0xa];
 };
 
 struct mlx5_ifc_mcam_access_reg_bits1 {
--- linux-qcom-6.8.0.orig/include/linux/mlx5/qp.h
+++ linux-qcom-6.8.0/include/linux/mlx5/qp.h
@@ -576,9 +576,12 @@
 
 static inline int mlx5_get_qp_default_ts(struct mlx5_core_dev *dev)
 {
-	return !MLX5_CAP_ROCE(dev, qp_ts_format) ?
-		       MLX5_TIMESTAMP_FORMAT_FREE_RUNNING :
-		       MLX5_TIMESTAMP_FORMAT_DEFAULT;
+	u8 supported_ts_cap = mlx5_get_roce_state(dev) ?
+			      MLX5_CAP_ROCE(dev, qp_ts_format) :
+			      MLX5_CAP_GEN(dev, sq_ts_format);
+
+	return supported_ts_cap ? MLX5_TIMESTAMP_FORMAT_DEFAULT :
+	       MLX5_TIMESTAMP_FORMAT_FREE_RUNNING;
 }
 
 #endif /* MLX5_QP_H */
--- linux-qcom-6.8.0.orig/include/linux/mm.h
+++ linux-qcom-6.8.0/include/linux/mm.h
@@ -95,6 +95,10 @@
 extern int mmap_rnd_compat_bits __read_mostly;
 #endif
 
+#ifndef PHYSMEM_END
+# define PHYSMEM_END	((1ULL << MAX_PHYSMEM_BITS) - 1)
+#endif
+
 #include <asm/page.h>
 #include <asm/processor.h>
 
@@ -1204,14 +1208,16 @@
  * a large folio, it includes the number of times this page is mapped
  * as part of that folio.
  *
- * The result is undefined for pages which cannot be mapped into userspace.
- * For example SLAB or special types of pages. See function page_has_type().
- * They use this field in struct page differently.
+ * Will report 0 for pages which cannot be mapped into userspace, eg
+ * slab, page tables and similar.
  */
 static inline int page_mapcount(struct page *page)
 {
 	int mapcount = atomic_read(&page->_mapcount) + 1;
 
+	/* Handle page_has_type() pages */
+	if (mapcount < 0)
+		mapcount = 0;
 	if (unlikely(PageCompound(page)))
 		mapcount += folio_entire_mapcount(page_folio(page));
 
@@ -2142,21 +2148,49 @@
 }
 
 /**
- * folio_estimated_sharers - Estimate the number of sharers of a folio.
+ * folio_likely_mapped_shared - Estimate if the folio is mapped into the page
+ *				tables of more than one MM
  * @folio: The folio.
  *
- * folio_estimated_sharers() aims to serve as a function to efficiently
- * estimate the number of processes sharing a folio. This is done by
- * looking at the precise mapcount of the first subpage in the folio, and
- * assuming the other subpages are the same. This may not be true for large
- * folios. If you want exact mapcounts for exact calculations, look at
- * page_mapcount() or folio_total_mapcount().
+ * This function checks if the folio is currently mapped into more than one
+ * MM ("mapped shared"), or if the folio is only mapped into a single MM
+ * ("mapped exclusively").
+ *
+ * As precise information is not easily available for all folios, this function
+ * estimates the number of MMs ("sharers") that are currently mapping a folio
+ * using the number of times the first page of the folio is currently mapped
+ * into page tables.
+ *
+ * For small anonymous folios (except KSM folios) and anonymous hugetlb folios,
+ * the return value will be exactly correct, because they can only be mapped
+ * at most once into an MM, and they cannot be partially mapped.
+ *
+ * For other folios, the result can be fuzzy:
+ *    #. For partially-mappable large folios (THP), the return value can wrongly
+ *       indicate "mapped exclusively" (false negative) when the folio is
+ *       only partially mapped into at least one MM.
+ *    #. For pagecache folios (including hugetlb), the return value can wrongly
+ *       indicate "mapped shared" (false positive) when two VMAs in the same MM
+ *       cover the same file range.
+ *    #. For (small) KSM folios, the return value can wrongly indicate "mapped
+ *       shared" (false negative), when the folio is mapped multiple times into
+ *       the same MM.
+ *
+ * Further, this function only considers current page table mappings that
+ * are tracked using the folio mapcount(s).
+ *
+ * This function does not consider:
+ *    #. If the folio might get mapped in the (near) future (e.g., swapcache,
+ *       pagecache, temporary unmapping for migration).
+ *    #. If the folio is mapped differently (VM_PFNMAP).
+ *    #. If hugetlb page table sharing applies. Callers might want to check
+ *       hugetlb_pmd_shared().
  *
- * Return: The estimated number of processes sharing a folio.
+ * Return: Whether the folio is estimated to be mapped into more than one MM.
  */
-static inline int folio_estimated_sharers(struct folio *folio)
+static inline bool folio_likely_mapped_shared(struct folio *folio)
 {
-	return page_mapcount(folio_page(folio, 0));
+	return page_mapcount(folio_page(folio, 0)) > 1;
 }
 
 #ifndef HAVE_ARCH_MAKE_PAGE_ACCESSIBLE
@@ -3044,6 +3078,7 @@
 	if (!pmd_ptlock_init(ptdesc))
 		return false;
 	__folio_set_pgtable(folio);
+	ptdesc_pmd_pts_init(ptdesc);
 	lruvec_stat_add_folio(folio, NR_PAGETABLE);
 	return true;
 }
@@ -4111,6 +4146,37 @@
 static inline void mem_dump_obj(void *object) {}
 #endif
 
+static inline bool is_write_sealed(int seals)
+{
+	return seals & (F_SEAL_WRITE | F_SEAL_FUTURE_WRITE);
+}
+
+/**
+ * is_readonly_sealed - Checks whether write-sealed but mapped read-only,
+ *                      in which case writes should be disallowing moving
+ *                      forwards.
+ * @seals: the seals to check
+ * @vm_flags: the VMA flags to check
+ *
+ * Returns whether readonly sealed, in which case writess should be disallowed
+ * going forward.
+ */
+static inline bool is_readonly_sealed(int seals, vm_flags_t vm_flags)
+{
+	/*
+	 * Since an F_SEAL_[FUTURE_]WRITE sealed memfd can be mapped as
+	 * MAP_SHARED and read-only, take care to not allow mprotect to
+	 * revert protections on such mappings. Do this only for shared
+	 * mappings. For private mappings, don't need to mask
+	 * VM_MAYWRITE as we still want them to be COW-writable.
+	 */
+	if (is_write_sealed(seals) &&
+	    ((vm_flags & (VM_SHARED | VM_WRITE)) == VM_SHARED))
+		return true;
+
+	return false;
+}
+
 /**
  * seal_check_write - Check for F_SEAL_WRITE or F_SEAL_FUTURE_WRITE flags and
  *                    handle them.
@@ -4122,24 +4188,15 @@
  */
 static inline int seal_check_write(int seals, struct vm_area_struct *vma)
 {
-	if (seals & (F_SEAL_WRITE | F_SEAL_FUTURE_WRITE)) {
-		/*
-		 * New PROT_WRITE and MAP_SHARED mmaps are not allowed when
-		 * write seals are active.
-		 */
-		if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_WRITE))
-			return -EPERM;
-
-		/*
-		 * Since an F_SEAL_[FUTURE_]WRITE sealed memfd can be mapped as
-		 * MAP_SHARED and read-only, take care to not allow mprotect to
-		 * revert protections on such mappings. Do this only for shared
-		 * mappings. For private mappings, don't need to mask
-		 * VM_MAYWRITE as we still want them to be COW-writable.
-		 */
-		if (vma->vm_flags & VM_SHARED)
-			vm_flags_clear(vma, VM_MAYWRITE);
-	}
+	if (!is_write_sealed(seals))
+		return 0;
+
+	/*
+	 * New PROT_WRITE and MAP_SHARED mmaps are not allowed when
+	 * write seals are active.
+	 */
+	if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_WRITE))
+		return -EPERM;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/include/linux/mm_types.h
+++ linux-qcom-6.8.0/include/linux/mm_types.h
@@ -402,6 +402,7 @@
  * @__page_mapping:   Aliases with page->mapping. Unused for page tables.
  * @pt_mm:            Used for x86 pgds.
  * @pt_frag_refcount: For fragmented page table tracking. Powerpc only.
+ * @pt_share_count:   Used for HugeTLB PMD page table share count.
  * @_pt_pad_2:        Padding to ensure proper alignment.
  * @ptl:              Lock for the page table.
  * @__page_type:      Same as page->page_type. Unused for page tables.
@@ -427,6 +428,9 @@
 	union {
 		struct mm_struct *pt_mm;
 		atomic_t pt_frag_refcount;
+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING
+		atomic_t pt_share_count;
+#endif
 	};
 
 	union {
@@ -471,6 +475,32 @@
 	const struct page *:		(const struct ptdesc *)(p),	\
 	struct page *:			(struct ptdesc *)(p)))
 
+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING
+static inline void ptdesc_pmd_pts_init(struct ptdesc *ptdesc)
+{
+	atomic_set(&ptdesc->pt_share_count, 0);
+}
+
+static inline void ptdesc_pmd_pts_inc(struct ptdesc *ptdesc)
+{
+	atomic_inc(&ptdesc->pt_share_count);
+}
+
+static inline void ptdesc_pmd_pts_dec(struct ptdesc *ptdesc)
+{
+	atomic_dec(&ptdesc->pt_share_count);
+}
+
+static inline int ptdesc_pmd_pts_count(struct ptdesc *ptdesc)
+{
+	return atomic_read(&ptdesc->pt_share_count);
+}
+#else
+static inline void ptdesc_pmd_pts_init(struct ptdesc *ptdesc)
+{
+}
+#endif
+
 /*
  * Used for sizing the vmemmap region on some architectures
  */
@@ -960,7 +990,7 @@
 		 * Represent how many empty pages are merged with kernel zero
 		 * pages when enabling KSM use_zero_pages.
 		 */
-		unsigned long ksm_zero_pages;
+		atomic_long_t ksm_zero_pages;
 #endif /* CONFIG_KSM */
 #ifdef CONFIG_LRU_GEN_WALKS_MMU
 		struct {
--- linux-qcom-6.8.0.orig/include/linux/mman.h
+++ linux-qcom-6.8.0/include/linux/mman.h
@@ -2,6 +2,7 @@
 #ifndef _LINUX_MMAN_H
 #define _LINUX_MMAN_H
 
+#include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/percpu_counter.h>
 
@@ -94,7 +95,7 @@
 #endif
 
 #ifndef arch_calc_vm_flag_bits
-#define arch_calc_vm_flag_bits(flags) 0
+#define arch_calc_vm_flag_bits(file, flags) 0
 #endif
 
 #ifndef arch_validate_prot
@@ -151,17 +152,25 @@
  * Combine the mmap "flags" argument into "vm_flags" used internally.
  */
 static inline unsigned long
-calc_vm_flag_bits(unsigned long flags)
+calc_vm_flag_bits(struct file *file, unsigned long flags)
 {
 	return _calc_vm_trans(flags, MAP_GROWSDOWN,  VM_GROWSDOWN ) |
 	       _calc_vm_trans(flags, MAP_LOCKED,     VM_LOCKED    ) |
 	       _calc_vm_trans(flags, MAP_SYNC,	     VM_SYNC      ) |
 	       _calc_vm_trans(flags, MAP_STACK,	     VM_NOHUGEPAGE) |
-	       arch_calc_vm_flag_bits(flags);
+	       arch_calc_vm_flag_bits(file, flags);
 }
 
 unsigned long vm_commit_limit(void);
 
+#ifndef arch_memory_deny_write_exec_supported
+static inline bool arch_memory_deny_write_exec_supported(void)
+{
+	return true;
+}
+#define arch_memory_deny_write_exec_supported arch_memory_deny_write_exec_supported
+#endif
+
 /*
  * Denies creating a writable executable mapping or gaining executable permissions.
  *
@@ -180,16 +189,31 @@
  *
  *	d)	mmap(PROT_READ | PROT_EXEC)
  *		mmap(PROT_READ | PROT_EXEC | PROT_BTI)
+ *
+ * This is only applicable if the user has set the Memory-Deny-Write-Execute
+ * (MDWE) protection mask for the current process.
+ *
+ * @old specifies the VMA flags the VMA originally possessed, and @new the ones
+ * we propose to set.
+ *
+ * Return: false if proposed change is OK, true if not ok and should be denied.
  */
-static inline bool map_deny_write_exec(struct vm_area_struct *vma,  unsigned long vm_flags)
+static inline bool map_deny_write_exec(unsigned long old, unsigned long new)
 {
+	/* If MDWE is disabled, we have nothing to deny. */
 	if (!test_bit(MMF_HAS_MDWE, &current->mm->flags))
 		return false;
 
-	if ((vm_flags & VM_EXEC) && (vm_flags & VM_WRITE))
+	/* If the new VMA is not executable, we have nothing to deny. */
+	if (!(new & VM_EXEC))
+		return false;
+
+	/* Under MDWE we do not accept newly writably executable VMAs... */
+	if (new & VM_WRITE)
 		return true;
 
-	if (!(vma->vm_flags & VM_EXEC) && (vm_flags & VM_EXEC))
+	/* ...nor previously non-executable VMAs becoming executable. */
+	if (!(old & VM_EXEC))
 		return true;
 
 	return false;
--- linux-qcom-6.8.0.orig/include/linux/mmc/card.h
+++ linux-qcom-6.8.0/include/linux/mmc/card.h
@@ -35,7 +35,7 @@
 	unsigned int		wp_grp_size;
 	unsigned int		read_blkbits;
 	unsigned int		write_blkbits;
-	unsigned int		capacity;
+	sector_t		capacity;
 	unsigned int		read_partial:1,
 				read_misalign:1,
 				write_partial:1,
@@ -294,6 +294,7 @@
 #define MMC_QUIRK_BROKEN_SD_DISCARD	(1<<14)	/* Disable broken SD discard support */
 #define MMC_QUIRK_BROKEN_SD_CACHE	(1<<15)	/* Disable broken SD cache support */
 #define MMC_QUIRK_BROKEN_CACHE_FLUSH	(1<<16)	/* Don't flush cache until the write has occurred */
+#define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY	(1<<17) /* Disable broken SD poweroff notify support */
 
 	bool			written_flag;	/* Indicates eMMC has been written since power on */
 	bool			reenable_cmdq;	/* Re-enable Command Queue */
--- linux-qcom-6.8.0.orig/include/linux/mmc/sd.h
+++ linux-qcom-6.8.0/include/linux/mmc/sd.h
@@ -36,6 +36,7 @@
 /* OCR bit definitions */
 #define SD_OCR_S18R		(1 << 24)    /* 1.8V switching request */
 #define SD_ROCR_S18A		SD_OCR_S18R  /* 1.8V switching accepted by card */
+#define SD_OCR_2T		(1 << 27)    /* HO2T/CO2T - SDUC support */
 #define SD_OCR_XPC		(1 << 28)    /* SDXC power control */
 #define SD_OCR_CCS		(1 << 30)    /* Card Capacity Status */
 
--- linux-qcom-6.8.0.orig/include/linux/mmc/slot-gpio.h
+++ linux-qcom-6.8.0/include/linux/mmc/slot-gpio.h
@@ -21,6 +21,7 @@
 			 unsigned int debounce);
 int mmc_gpiod_request_ro(struct mmc_host *host, const char *con_id,
 			 unsigned int idx, unsigned int debounce);
+int mmc_gpiod_set_cd_config(struct mmc_host *host, unsigned long config);
 void mmc_gpio_set_cd_isr(struct mmc_host *host,
 			 irqreturn_t (*isr)(int irq, void *dev_id));
 int mmc_gpio_set_cd_wake(struct mmc_host *host, bool on);
--- linux-qcom-6.8.0.orig/include/linux/mmdebug.h
+++ linux-qcom-6.8.0/include/linux/mmdebug.h
@@ -46,7 +46,7 @@
 		}							\
 	} while (0)
 #define VM_WARN_ON_ONCE_PAGE(cond, page)	({			\
-	static bool __section(".data.once") __warned;			\
+	static bool __section(".data..once") __warned;			\
 	int __ret_warn_once = !!(cond);					\
 									\
 	if (unlikely(__ret_warn_once && !__warned)) {			\
@@ -66,7 +66,7 @@
 	unlikely(__ret_warn);						\
 })
 #define VM_WARN_ON_ONCE_FOLIO(cond, folio)	({			\
-	static bool __section(".data.once") __warned;			\
+	static bool __section(".data..once") __warned;			\
 	int __ret_warn_once = !!(cond);					\
 									\
 	if (unlikely(__ret_warn_once && !__warned)) {			\
@@ -77,7 +77,7 @@
 	unlikely(__ret_warn_once);					\
 })
 #define VM_WARN_ON_ONCE_MM(cond, mm)		({			\
-	static bool __section(".data.once") __warned;			\
+	static bool __section(".data..once") __warned;			\
 	int __ret_warn_once = !!(cond);					\
 									\
 	if (unlikely(__ret_warn_once && !__warned)) {			\
--- linux-qcom-6.8.0.orig/include/linux/mmzone.h
+++ linux-qcom-6.8.0/include/linux/mmzone.h
@@ -452,9 +452,7 @@
 
 enum {
 	MM_LEAF_TOTAL,		/* total leaf entries */
-	MM_LEAF_OLD,		/* old leaf entries */
 	MM_LEAF_YOUNG,		/* young leaf entries */
-	MM_NONLEAF_TOTAL,	/* total non-leaf entries */
 	MM_NONLEAF_FOUND,	/* non-leaf entries found in Bloom filters */
 	MM_NONLEAF_ADDED,	/* non-leaf entries added to Bloom filters */
 	NR_MM_STATS
@@ -551,7 +549,7 @@
 
 void lru_gen_init_pgdat(struct pglist_data *pgdat);
 void lru_gen_init_lruvec(struct lruvec *lruvec);
-void lru_gen_look_around(struct page_vma_mapped_walk *pvmw);
+bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw);
 
 void lru_gen_init_memcg(struct mem_cgroup *memcg);
 void lru_gen_exit_memcg(struct mem_cgroup *memcg);
@@ -570,8 +568,9 @@
 {
 }
 
-static inline void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
+static inline bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
 {
+	return false;
 }
 
 static inline void lru_gen_init_memcg(struct mem_cgroup *memcg)
@@ -648,13 +647,12 @@
 };
 
 /*
- * One per migratetype for each PAGE_ALLOC_COSTLY_ORDER. One additional list
- * for THP which will usually be GFP_MOVABLE. Even if it is another type,
- * it should not contribute to serious fragmentation causing THP allocation
- * failures.
+ * One per migratetype for each PAGE_ALLOC_COSTLY_ORDER. Two additional lists
+ * are added for THP. One PCP list is used by GPF_MOVABLE, and the other PCP list
+ * is used by GFP_UNMOVABLE and GFP_RECLAIMABLE.
  */
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
-#define NR_PCP_THP 1
+#define NR_PCP_THP 2
 #else
 #define NR_PCP_THP 0
 #endif
@@ -1974,8 +1972,9 @@
 static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn)
 {
 	int idx = subsection_map_index(pfn);
+	struct mem_section_usage *usage = READ_ONCE(ms->usage);
 
-	return test_bit(idx, READ_ONCE(ms->usage)->subsection_map);
+	return usage ? test_bit(idx, usage->subsection_map) : 0;
 }
 #else
 static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn)
--- linux-qcom-6.8.0.orig/include/linux/mod_devicetable.h
+++ linux-qcom-6.8.0/include/linux/mod_devicetable.h
@@ -690,6 +690,8 @@
 	__u16 model;
 	__u16 steppings;
 	__u16 feature;	/* bit index */
+	/* Solely for kernel-internal use: DO NOT EXPORT to userspace! */
+	__u16 flags;
 	kernel_ulong_t driver_data;
 };
 
--- linux-qcom-6.8.0.orig/include/linux/module.h
+++ linux-qcom-6.8.0/include/linux/module.h
@@ -35,9 +35,11 @@
 #define MODULE_NAME_LEN MAX_PARAM_PREFIX_LEN
 
 struct modversion_info {
-	unsigned long crc;
-	char name[MODULE_NAME_LEN];
-};
+	/* Offset of the next modversion entry in relation to this one. */
+	u32 next;
+	u32 crc;
+	char name[]; /* Flexible array member */
+} __packed;
 
 struct module;
 struct exception_table_entry;
@@ -922,11 +924,11 @@
  * least KSYM_NAME_LEN long: a pointer to namebuf is returned if
  * found, otherwise NULL.
  */
-const char *module_address_lookup(unsigned long addr,
-				  unsigned long *symbolsize,
-				  unsigned long *offset,
-				  char **modname, const unsigned char **modbuildid,
-				  char *namebuf);
+int module_address_lookup(unsigned long addr,
+			  unsigned long *symbolsize,
+			  unsigned long *offset,
+			  char **modname, const unsigned char **modbuildid,
+			  char *namebuf);
 int lookup_module_symbol_name(unsigned long addr, char *symname);
 int lookup_module_symbol_attrs(unsigned long addr,
 			       unsigned long *size,
@@ -955,14 +957,14 @@
 }
 
 /* For kallsyms to ask for address resolution.  NULL means not found. */
-static inline const char *module_address_lookup(unsigned long addr,
+static inline int module_address_lookup(unsigned long addr,
 						unsigned long *symbolsize,
 						unsigned long *offset,
 						char **modname,
 						const unsigned char **modbuildid,
 						char *namebuf)
 {
-	return NULL;
+	return 0;
 }
 
 static inline int lookup_module_symbol_name(unsigned long addr, char *symname)
--- linux-qcom-6.8.0.orig/include/linux/moduleloader.h
+++ linux-qcom-6.8.0/include/linux/moduleloader.h
@@ -115,6 +115,14 @@
 		    const Elf_Shdr *sechdrs,
 		    struct module *mod);
 
+#ifdef CONFIG_MODULES
+void flush_module_init_free_work(void);
+#else
+static inline void flush_module_init_free_work(void)
+{
+}
+#endif
+
 /* Any cleanup needed when module leaves. */
 void module_arch_cleanup(struct module *mod);
 
--- linux-qcom-6.8.0.orig/include/linux/mount.h
+++ linux-qcom-6.8.0/include/linux/mount.h
@@ -50,7 +50,7 @@
 #define MNT_ATIME_MASK (MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME )
 
 #define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \
-			    MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED | MNT_ONRB)
+			    MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED)
 
 #define MNT_INTERNAL	0x4000
 
@@ -64,7 +64,6 @@
 #define MNT_SYNC_UMOUNT		0x2000000
 #define MNT_MARKED		0x4000000
 #define MNT_UMOUNT		0x8000000
-#define MNT_ONRB		0x10000000
 
 struct vfsmount {
 	struct dentry *mnt_root;	/* root of the mounted tree */
--- linux-qcom-6.8.0.orig/include/linux/msm_dma_iommu_mapping.h
+++ linux-qcom-6.8.0/include/linux/msm_dma_iommu_mapping.h
@@ -0,0 +1,145 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015-2016, 2018, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _LINUX_MSM_DMA_IOMMU_MAPPING_H
+#define _LINUX_MSM_DMA_IOMMU_MAPPING_H
+
+#include <linux/device.h>
+#include <linux/dma-buf.h>
+#include <linux/scatterlist.h>
+#include <linux/dma-mapping.h>
+#include <linux/qcom-dma-mapping.h>
+
+#if IS_ENABLED(CONFIG_QCOM_LAZY_MAPPING)
+/*
+ * This function is not taking a reference to the dma_buf here. It is expected
+ * that clients hold reference to the dma_buf until they are done with mapping
+ * and unmapping.
+ */
+int msm_dma_map_sg_attrs(struct device *dev, struct scatterlist *sg, int nents,
+		   enum dma_data_direction dir, struct dma_buf *dma_buf,
+		   unsigned long attrs);
+
+/*
+ * This function takes an extra reference to the dma_buf.
+ * What this means is that calling msm_dma_unmap_sg will not result in buffer's
+ * iommu mapping being removed, which means that subsequent calls to lazy map
+ * will simply re-use the existing iommu mapping.
+ * The iommu unmapping of the buffer will occur when the ION buffer is
+ * destroyed.
+ * Using lazy mapping can provide a performance benefit because subsequent
+ * mappings are faster.
+ *
+ * The limitation of using this API are that all subsequent iommu mappings
+ * must be the same as the original mapping, ie they must map the same part of
+ * the buffer with the same dma data direction. Also there can't be multiple
+ * mappings of different parts of the buffer.
+ */
+static inline int msm_dma_map_sg_lazy(struct device *dev,
+			       struct scatterlist *sg, int nents,
+			       enum dma_data_direction dir,
+			       struct dma_buf *dma_buf)
+{
+	return msm_dma_map_sg_attrs(dev, sg, nents, dir, dma_buf, 0);
+}
+
+static inline int msm_dma_map_sg(struct device *dev, struct scatterlist *sg,
+				  int nents, enum dma_data_direction dir,
+				  struct dma_buf *dma_buf)
+{
+	unsigned long attrs;
+
+	attrs = DMA_ATTR_NO_DELAYED_UNMAP;
+	return msm_dma_map_sg_attrs(dev, sg, nents, dir, dma_buf, attrs);
+}
+
+void msm_dma_unmap_sg_attrs(struct device *dev, struct scatterlist *sgl,
+			    int nents, enum dma_data_direction dir,
+			    struct dma_buf *dma_buf, unsigned long attrs);
+
+static inline int msm_dma_map_sgtable(struct device *dev, struct sg_table *sgt,
+				      enum dma_data_direction dir,
+				      struct dma_buf *dma_buf, unsigned long attrs)
+{
+	int nents;
+
+	nents = msm_dma_map_sg_attrs(dev, sgt->sgl, sgt->orig_nents, dir, dma_buf, attrs);
+	if (nents <= 0)
+		return -EINVAL;
+
+	sgt->nents = nents;
+	return 0;
+}
+
+static inline void msm_dma_unmap_sgtable(struct device *dev, struct sg_table *sgt,
+					 enum dma_data_direction dir,
+					 struct dma_buf *dma_buf, unsigned long attrs)
+{
+	msm_dma_unmap_sg_attrs(dev, sgt->sgl, sgt->nents, dir, dma_buf, attrs);
+}
+
+int msm_dma_unmap_all_for_dev(struct device *dev);
+
+/*
+ * Below is private function only to be called by framework (ION) and not by
+ * clients.
+ */
+void msm_dma_buf_freed(void *buffer);
+
+#else /*CONFIG_QCOM_LAZY_MAPPING*/
+
+static inline int msm_dma_map_sg_attrs(struct device *dev,
+			struct scatterlist *sg, int nents,
+			enum dma_data_direction dir, struct dma_buf *dma_buf,
+			unsigned long attrs)
+{
+	return -EINVAL;
+}
+
+static inline void
+msm_dma_unmap_sg_attrs(struct device *dev, struct scatterlist *sgl,
+		       int nents, enum dma_data_direction dir,
+		       struct dma_buf *dma_buf, unsigned long attrs)
+{
+}
+
+static inline int msm_dma_map_sg_lazy(struct device *dev,
+			       struct scatterlist *sg, int nents,
+			       enum dma_data_direction dir,
+			       struct dma_buf *dma_buf)
+{
+	return -EINVAL;
+}
+
+static inline int msm_dma_map_sg(struct device *dev, struct scatterlist *sg,
+				  int nents, enum dma_data_direction dir,
+				  struct dma_buf *dma_buf)
+{
+	return -EINVAL;
+}
+
+static inline int msm_dma_map_sgtable(struct device *dev, struct sg_table *sgt,
+				      enum dma_data_direction dir,
+				      struct dma_buf *dma_buf, unsigned long attrs)
+{
+	return -EINVAL;
+}
+
+static inline void msm_dma_unmap_sgtable(struct device *dev, struct sg_table *sgt,
+					 enum dma_data_direction dir,
+					 struct dma_buf *dma_buf, unsigned long attrs)
+{
+}
+
+static inline int msm_dma_unmap_all_for_dev(struct device *dev)
+{
+	return 0;
+}
+
+static inline void msm_dma_buf_freed(void *buffer) {}
+#endif /*CONFIG_QCOM_LAZY_MAPPING*/
+
+#endif
--- linux-qcom-6.8.0.orig/include/linux/mtd/spinand.h
+++ linux-qcom-6.8.0/include/linux/mtd/spinand.h
@@ -169,7 +169,7 @@
 struct spinand_op;
 struct spinand_device;
 
-#define SPINAND_MAX_ID_LEN	4
+#define SPINAND_MAX_ID_LEN	5
 /*
  * For erase, write and read operation, we got the following timings :
  * tBERS (erase) 1ms to 4ms
--- linux-qcom-6.8.0.orig/include/linux/mutex.h
+++ linux-qcom-6.8.0/include/linux/mutex.h
@@ -22,6 +22,8 @@
 #include <linux/cleanup.h>
 #include <linux/mutex_types.h>
 
+struct device;
+
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 # define __DEP_MAP_MUTEX_INITIALIZER(lockname)			\
 		, .dep_map = {					\
@@ -121,6 +123,31 @@
 } while (0)
 #endif /* CONFIG_PREEMPT_RT */
 
+#ifdef CONFIG_DEBUG_MUTEXES
+
+int __devm_mutex_init(struct device *dev, struct mutex *lock);
+
+#else
+
+static inline int __devm_mutex_init(struct device *dev, struct mutex *lock)
+{
+	/*
+	 * When CONFIG_DEBUG_MUTEXES is off mutex_destroy() is just a nop so
+	 * no really need to register it in the devm subsystem.
+	 */
+	return 0;
+}
+
+#endif
+
+#define devm_mutex_init(dev, mutex)			\
+({							\
+	typeof(mutex) mutex_ = (mutex);			\
+							\
+	mutex_init(mutex_);				\
+	__devm_mutex_init(dev, mutex_);			\
+})
+
 /*
  * See kernel/locking/mutex.c for detailed documentation of these APIs.
  * Also see Documentation/locking/mutex-design.rst.
--- linux-qcom-6.8.0.orig/include/linux/net.h
+++ linux-qcom-6.8.0/include/linux/net.h
@@ -323,6 +323,25 @@
 	return !PageSlab(page) && page_count(page) >= 1;
 }
 
+/*
+ * Check sendpage_ok on contiguous pages.
+ */
+static inline bool sendpages_ok(struct page *page, size_t len, size_t offset)
+{
+	struct page *p = page + (offset >> PAGE_SHIFT);
+	size_t count = 0;
+
+	while (count < len) {
+		if (!sendpage_ok(p))
+			return false;
+
+		p++;
+		count += PAGE_SIZE;
+	}
+
+	return true;
+}
+
 int kernel_sendmsg(struct socket *sock, struct msghdr *msg, struct kvec *vec,
 		   size_t num, size_t len);
 int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,
--- linux-qcom-6.8.0.orig/include/linux/netdev_features.h
+++ linux-qcom-6.8.0/include/linux/netdev_features.h
@@ -261,4 +261,11 @@
 				 NETIF_F_GSO_UDP_TUNNEL |		\
 				 NETIF_F_GSO_UDP_TUNNEL_CSUM)
 
+static inline netdev_features_t netdev_base_features(netdev_features_t features)
+{
+	features &= ~NETIF_F_ONE_FOR_ALL;
+	features |= NETIF_F_ALL_FOR_ALL;
+	return features;
+}
+
 #endif	/* _LINUX_NETDEV_FEATURES_H */
--- linux-qcom-6.8.0.orig/include/linux/netdevice.h
+++ linux-qcom-6.8.0/include/linux/netdevice.h
@@ -360,7 +360,7 @@
 
 	unsigned long		state;
 	int			weight;
-	int			defer_hard_irqs_count;
+	u32			defer_hard_irqs_count;
 	unsigned long		gro_bitmask;
 	int			(*poll)(struct napi_struct *, int);
 #ifdef CONFIG_NETPOLL
@@ -2144,6 +2144,7 @@
 		struct pcpu_sw_netstats __percpu	*tstats;
 		struct pcpu_dstats __percpu		*dstats;
 	};
+	unsigned long		state;
 	unsigned int		flags;
 	unsigned short		hard_header_len;
 	netdev_features_t	features;
@@ -2158,7 +2159,7 @@
 	unsigned int		real_num_rx_queues;
 	struct netdev_rx_queue	*_rx;
 	unsigned long		gro_flush_timeout;
-	int			napi_defer_hard_irqs;
+	u32			napi_defer_hard_irqs;
 	unsigned int		gro_max_size;
 	unsigned int		gro_ipv4_max_size;
 	rx_handler_func_t __rcu	*rx_handler;
@@ -2189,7 +2190,6 @@
 	 *	part of the usual set specified in Space.c.
 	 */
 
-	unsigned long		state;
 
 	struct list_head	dev_list;
 	struct list_head	napi_list;
@@ -3428,6 +3428,12 @@
 
 static __always_inline void netif_tx_stop_queue(struct netdev_queue *dev_queue)
 {
+	/* Paired with READ_ONCE() from dev_watchdog() */
+	WRITE_ONCE(dev_queue->trans_start, jiffies);
+
+	/* This barrier is paired with smp_mb() from dev_watchdog() */
+	smp_mb__before_atomic();
+
 	/* Must be an atomic op see netif_txq_try_stop() */
 	set_bit(__QUEUE_STATE_DRV_XOFF, &dev_queue->state);
 }
@@ -3554,6 +3560,12 @@
 	if (likely(dql_avail(&dev_queue->dql) >= 0))
 		return;
 
+	/* Paired with READ_ONCE() from dev_watchdog() */
+	WRITE_ONCE(dev_queue->trans_start, jiffies);
+
+	/* This barrier is paired with smp_mb() from dev_watchdog() */
+	smp_mb__before_atomic();
+
 	set_bit(__QUEUE_STATE_STACK_XOFF, &dev_queue->state);
 
 	/*
@@ -5104,6 +5116,24 @@
 void netif_inherit_tso_max(struct net_device *to,
 			   const struct net_device *from);
 
+static inline unsigned int
+netif_get_gro_max_size(const struct net_device *dev, const struct sk_buff *skb)
+{
+	/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */
+	return skb->protocol == htons(ETH_P_IPV6) ?
+	       READ_ONCE(dev->gro_max_size) :
+	       READ_ONCE(dev->gro_ipv4_max_size);
+}
+
+static inline unsigned int
+netif_get_gso_max_size(const struct net_device *dev, const struct sk_buff *skb)
+{
+	/* pairs with WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */
+	return skb->protocol == htons(ETH_P_IPV6) ?
+	       READ_ONCE(dev->gso_max_size) :
+	       READ_ONCE(dev->gso_ipv4_max_size);
+}
+
 static inline bool netif_is_macsec(const struct net_device *dev)
 {
 	return dev->priv_flags & IFF_MACSEC;
--- linux-qcom-6.8.0.orig/include/linux/netlink.h
+++ linux-qcom-6.8.0/include/linux/netlink.h
@@ -291,6 +291,7 @@
 	u16			answer_flags;
 	u32			min_dump_alloc;
 	unsigned int		prev_seq, seq;
+	int			flags;
 	bool			strict_check;
 	union {
 		u8		ctx[48];
@@ -323,6 +324,7 @@
 	void *data;
 	struct module *module;
 	u32 min_dump_alloc;
+	int flags;
 };
 
 int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
--- linux-qcom-6.8.0.orig/include/linux/netpoll.h
+++ linux-qcom-6.8.0/include/linux/netpoll.h
@@ -71,7 +71,7 @@
 {
 	struct net_device *dev = napi->dev;
 
-	if (dev && dev->npinfo) {
+	if (dev && rcu_access_pointer(dev->npinfo)) {
 		int owner = smp_processor_id();
 
 		while (cmpxchg(&napi->poll_owner, -1, owner) != -1)
--- linux-qcom-6.8.0.orig/include/linux/nfs4.h
+++ linux-qcom-6.8.0/include/linux/nfs4.h
@@ -15,6 +15,7 @@
 
 #include <linux/list.h>
 #include <linux/uidgid.h>
+#include <linux/security.h>
 #include <uapi/linux/nfs4.h>
 #include <linux/sunrpc/msg_prot.h>
 
@@ -44,10 +45,9 @@
 #define NFS4_MAXLABELLEN	2048
 
 struct nfs4_label {
-	uint32_t	lfs;
-	uint32_t	pi;
-	u32		len;
-	char	*label;
+	uint32_t		lfs;
+	uint32_t		pi;
+	struct lsmcontext	lsmctx;
 };
 
 typedef struct { char data[NFS4_VERIFIER_SIZE]; } nfs4_verifier;
--- linux-qcom-6.8.0.orig/include/linux/nfs_fs.h
+++ linux-qcom-6.8.0/include/linux/nfs_fs.h
@@ -457,7 +457,7 @@
 {
 #ifdef CONFIG_NFS_V4_SECURITY_LABEL
 	if (label) {
-		kfree(label->label);
+		kfree(label->lsmctx.context);
 		kfree(label);
 	}
 #endif
@@ -611,6 +611,7 @@
 extern int  nfs_commit_inode(struct inode *, int);
 extern struct nfs_commit_data *nfs_commitdata_alloc(void);
 extern void nfs_commit_free(struct nfs_commit_data *data);
+void nfs_commit_begin(struct nfs_mds_commit_info *cinfo);
 bool nfs_commit_end(struct nfs_mds_commit_info *cinfo);
 
 static inline bool nfs_have_writebacks(const struct inode *inode)
--- linux-qcom-6.8.0.orig/include/linux/nfs_fs_sb.h
+++ linux-qcom-6.8.0/include/linux/nfs_fs_sb.h
@@ -239,6 +239,7 @@
 	struct list_head	layouts;
 	struct list_head	delegations;
 	struct list_head	ss_copies;
+	struct list_head	ss_src_copies;
 
 	unsigned long		delegation_gen;
 	unsigned long		mig_gen;
--- linux-qcom-6.8.0.orig/include/linux/node.h
+++ linux-qcom-6.8.0/include/linux/node.h
@@ -34,6 +34,18 @@
 	unsigned int write_latency;
 };
 
+/*
+ * ACCESS_COORDINATE_LOCAL correlates to ACCESS CLASS 0
+ *	- access_coordinate between target node and nearest initiator node
+ * ACCESS_COORDINATE_CPU correlates to ACCESS CLASS 1
+ *	- access_coordinate between target node and nearest CPU node
+ */
+enum access_coordinate_class {
+	ACCESS_COORDINATE_LOCAL,
+	ACCESS_COORDINATE_CPU,
+	ACCESS_COORDINATE_MAX
+};
+
 enum cache_indexing {
 	NODE_CACHE_DIRECT_MAP,
 	NODE_CACHE_INDEXED,
@@ -66,7 +78,7 @@
 #ifdef CONFIG_HMEM_REPORTING
 void node_add_cache(unsigned int nid, struct node_cache_attrs *cache_attrs);
 void node_set_perf_attrs(unsigned int nid, struct access_coordinate *coord,
-			 unsigned access);
+			 enum access_coordinate_class access);
 #else
 static inline void node_add_cache(unsigned int nid,
 				  struct node_cache_attrs *cache_attrs)
@@ -75,7 +87,7 @@
 
 static inline void node_set_perf_attrs(unsigned int nid,
 				       struct access_coordinate *coord,
-				       unsigned access)
+				       enum access_coordinate_class access)
 {
 }
 #endif
@@ -137,7 +149,7 @@
 
 extern int register_memory_node_under_compute_node(unsigned int mem_nid,
 						   unsigned int cpu_nid,
-						   unsigned access);
+						   enum access_coordinate_class access);
 #else
 static inline void node_dev_init(void)
 {
--- linux-qcom-6.8.0.orig/include/linux/numa.h
+++ linux-qcom-6.8.0/include/linux/numa.h
@@ -15,6 +15,11 @@
 #define	NUMA_NO_NODE	(-1)
 #define	NUMA_NO_MEMBLK	(-1)
 
+static inline bool numa_valid_node(int nid)
+{
+	return nid >= 0 && nid < MAX_NUMNODES;
+}
+
 /* optionally keep NUMA memory info available post init */
 #ifdef CONFIG_NUMA_KEEP_MEMINFO
 #define __initdata_or_meminfo
@@ -36,12 +41,7 @@
 int phys_to_target_node(u64 start);
 #endif
 
-#ifndef numa_fill_memblks
-static inline int __init numa_fill_memblks(u64 start, u64 end)
-{
-	return NUMA_NO_MEMBLK;
-}
-#endif
+int numa_fill_memblks(u64 start, u64 end);
 
 #else /* !CONFIG_NUMA */
 static inline int numa_nearest_node(int node, unsigned int state)
--- linux-qcom-6.8.0.orig/include/linux/nvme-keyring.h
+++ linux-qcom-6.8.0/include/linux/nvme-keyring.h
@@ -12,7 +12,7 @@
 		const char *hostnqn, const char *subnqn);
 
 key_serial_t nvme_keyring_id(void);
-
+struct key *nvme_tls_key_lookup(key_serial_t key_id);
 #else
 
 static inline key_serial_t nvme_tls_psk_default(struct key *keyring,
@@ -24,5 +24,9 @@
 {
 	return 0;
 }
+static inline struct key *nvme_tls_key_lookup(key_serial_t key_id)
+{
+	return ERR_PTR(-ENOTSUPP);
+}
 #endif /* !CONFIG_NVME_KEYRING */
 #endif /* _NVME_KEYRING_H */
--- linux-qcom-6.8.0.orig/include/linux/nvme.h
+++ linux-qcom-6.8.0/include/linux/nvme.h
@@ -87,10 +87,11 @@
 enum {
 	NVMF_RDMA_QPTYPE_CONNECTED	= 1, /* Reliable Connected */
 	NVMF_RDMA_QPTYPE_DATAGRAM	= 2, /* Reliable Datagram */
+	NVMF_RDMA_QPTYPE_INVALID	= 0xff,
 };
 
-/* RDMA QP Service Type codes for Discovery Log Page entry TSAS
- * RDMA_QPTYPE field
+/* RDMA Provider Type codes for Discovery Log Page entry TSAS
+ * RDMA_PRTYPE field
  */
 enum {
 	NVMF_RDMA_PRTYPE_NOT_SPECIFIED	= 1, /* No Provider Specified */
@@ -112,6 +113,7 @@
 	NVMF_TCP_SECTYPE_NONE = 0, /* No Security */
 	NVMF_TCP_SECTYPE_TLS12 = 1, /* TLSv1.2, NVMe-oF 1.1 and NVMe-TCP 3.6.1.1 */
 	NVMF_TCP_SECTYPE_TLS13 = 2, /* TLSv1.3, NVMe-oF 1.1 and NVMe-TCP 3.6.1.1 */
+	NVMF_TCP_SECTYPE_INVALID = 0xff,
 };
 
 #define NVME_AQ_DEPTH		32
@@ -1848,6 +1850,7 @@
 	/*
 	 * Generic Command Status:
 	 */
+	NVME_SCT_GENERIC		= 0x0,
 	NVME_SC_SUCCESS			= 0x0,
 	NVME_SC_INVALID_OPCODE		= 0x1,
 	NVME_SC_INVALID_FIELD		= 0x2,
@@ -1895,6 +1898,7 @@
 	/*
 	 * Command Specific Status:
 	 */
+	NVME_SCT_COMMAND_SPECIFIC	= 0x100,
 	NVME_SC_CQ_INVALID		= 0x100,
 	NVME_SC_QID_INVALID		= 0x101,
 	NVME_SC_QUEUE_SIZE		= 0x102,
@@ -1968,6 +1972,7 @@
 	/*
 	 * Media and Data Integrity Errors:
 	 */
+	NVME_SCT_MEDIA_ERROR		= 0x200,
 	NVME_SC_WRITE_FAULT		= 0x280,
 	NVME_SC_READ_ERROR		= 0x281,
 	NVME_SC_GUARD_CHECK		= 0x282,
@@ -1980,6 +1985,7 @@
 	/*
 	 * Path-related Errors:
 	 */
+	NVME_SCT_PATH			= 0x300,
 	NVME_SC_INTERNAL_PATH_ERROR	= 0x300,
 	NVME_SC_ANA_PERSISTENT_LOSS	= 0x301,
 	NVME_SC_ANA_INACCESSIBLE	= 0x302,
@@ -1988,11 +1994,17 @@
 	NVME_SC_HOST_PATH_ERROR		= 0x370,
 	NVME_SC_HOST_ABORTED_CMD	= 0x371,
 
-	NVME_SC_CRD			= 0x1800,
-	NVME_SC_MORE			= 0x2000,
-	NVME_SC_DNR			= 0x4000,
+	NVME_SC_MASK			= 0x00ff, /* Status Code */
+	NVME_SCT_MASK			= 0x0700, /* Status Code Type */
+	NVME_SCT_SC_MASK		= NVME_SCT_MASK | NVME_SC_MASK,
+
+	NVME_STATUS_CRD			= 0x1800, /* Command Retry Delayed */
+	NVME_STATUS_MORE		= 0x2000,
+	NVME_STATUS_DNR			= 0x4000, /* Do Not Retry */
 };
 
+#define NVME_SCT(status) ((status) >> 8 & 7)
+
 struct nvme_completion {
 	/*
 	 * Used by Admin and Fabrics commands to return data:
--- linux-qcom-6.8.0.orig/include/linux/objagg.h
+++ linux-qcom-6.8.0/include/linux/objagg.h
@@ -8,7 +8,6 @@
 	size_t obj_size;
 	bool (*delta_check)(void *priv, const void *parent_obj,
 			    const void *obj);
-	int (*hints_obj_cmp)(const void *obj1, const void *obj2);
 	void * (*delta_create)(void *priv, void *parent_obj, void *obj);
 	void (*delta_destroy)(void *priv, void *delta_priv);
 	void * (*root_create)(void *priv, void *obj, unsigned int root_id);
--- linux-qcom-6.8.0.orig/include/linux/of.h
+++ linux-qcom-6.8.0/include/linux/of.h
@@ -13,6 +13,7 @@
  */
 #include <linux/types.h>
 #include <linux/bitops.h>
+#include <linux/cleanup.h>
 #include <linux/errno.h>
 #include <linux/kobject.h>
 #include <linux/mod_devicetable.h>
@@ -134,6 +135,7 @@
 }
 static inline void of_node_put(struct device_node *node) { }
 #endif /* !CONFIG_OF_DYNAMIC */
+DEFINE_FREE(device_node, struct device_node *, if (_T) of_node_put(_T))
 
 /* Pointer for first entry in chain of all nodes. */
 extern struct device_node *of_root;
@@ -1428,10 +1430,23 @@
 #define for_each_child_of_node(parent, child) \
 	for (child = of_get_next_child(parent, NULL); child != NULL; \
 	     child = of_get_next_child(parent, child))
+
+#define for_each_child_of_node_scoped(parent, child) \
+	for (struct device_node *child __free(device_node) =		\
+	     of_get_next_child(parent, NULL);				\
+	     child != NULL;						\
+	     child = of_get_next_child(parent, child))
+
 #define for_each_available_child_of_node(parent, child) \
 	for (child = of_get_next_available_child(parent, NULL); child != NULL; \
 	     child = of_get_next_available_child(parent, child))
 
+#define for_each_available_child_of_node_scoped(parent, child) \
+	for (struct device_node *child __free(device_node) =		\
+	     of_get_next_available_child(parent, NULL);			\
+	     child != NULL;						\
+	     child = of_get_next_available_child(parent, child))
+
 #define for_each_of_cpu_node(cpu) \
 	for (cpu = of_get_next_cpu_node(NULL); cpu != NULL; \
 	     cpu = of_get_next_cpu_node(cpu))
--- linux-qcom-6.8.0.orig/include/linux/of_fdt.h
+++ linux-qcom-6.8.0/include/linux/of_fdt.h
@@ -31,6 +31,7 @@
 extern int __initdata dt_root_addr_cells;
 extern int __initdata dt_root_size_cells;
 extern void *initial_boot_params;
+extern phys_addr_t initial_boot_params_pa;
 
 extern char __dtb_start[];
 extern char __dtb_end[];
@@ -70,8 +71,8 @@
 /* Early flat tree scan hooks */
 extern int early_init_dt_scan_root(void);
 
-extern bool early_init_dt_scan(void *params);
-extern bool early_init_dt_verify(void *params);
+extern bool early_init_dt_scan(void *dt_virt, phys_addr_t dt_phys);
+extern bool early_init_dt_verify(void *dt_virt, phys_addr_t dt_phys);
 extern void early_init_dt_scan_nodes(void);
 
 extern const char *of_flat_dt_get_machine_name(void);
--- linux-qcom-6.8.0.orig/include/linux/oid_registry.h
+++ linux-qcom-6.8.0/include/linux/oid_registry.h
@@ -17,10 +17,12 @@
  *	  build_OID_registry.pl to generate the data for look_up_OID().
  */
 enum OID {
+	OID_id_dsa_with_sha1,		/* 1.2.840.10030.4.3 */
 	OID_id_dsa,			/* 1.2.840.10040.4.1 */
 	OID_id_ecPublicKey,		/* 1.2.840.10045.2.1 */
 	OID_id_prime192v1,		/* 1.2.840.10045.3.1.1 */
 	OID_id_prime256v1,		/* 1.2.840.10045.3.1.7 */
+	OID_id_ecdsa_with_sha1,		/* 1.2.840.10045.4.1 */
 	OID_id_ecdsa_with_sha224,	/* 1.2.840.10045.4.3.1 */
 	OID_id_ecdsa_with_sha256,	/* 1.2.840.10045.4.3.2 */
 	OID_id_ecdsa_with_sha384,	/* 1.2.840.10045.4.3.3 */
@@ -28,6 +30,7 @@
 
 	/* PKCS#1 {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1)} */
 	OID_rsaEncryption,		/* 1.2.840.113549.1.1.1 */
+	OID_sha1WithRSAEncryption,	/* 1.2.840.113549.1.1.5 */
 	OID_sha256WithRSAEncryption,	/* 1.2.840.113549.1.1.11 */
 	OID_sha384WithRSAEncryption,	/* 1.2.840.113549.1.1.12 */
 	OID_sha512WithRSAEncryption,	/* 1.2.840.113549.1.1.13 */
@@ -64,6 +67,7 @@
 	OID_PKU2U,			/* 1.3.5.1.5.2.7 */
 	OID_Scram,			/* 1.3.6.1.5.5.14 */
 	OID_certAuthInfoAccess,		/* 1.3.6.1.5.5.7.1.1 */
+	OID_sha1,			/* 1.3.14.3.2.26 */
 	OID_id_ansip384r1,		/* 1.3.132.0.34 */
 	OID_sha256,			/* 2.16.840.1.101.3.4.2.1 */
 	OID_sha384,			/* 2.16.840.1.101.3.4.2.2 */
--- linux-qcom-6.8.0.orig/include/linux/once.h
+++ linux-qcom-6.8.0/include/linux/once.h
@@ -46,7 +46,7 @@
 #define DO_ONCE(func, ...)						     \
 	({								     \
 		bool ___ret = false;					     \
-		static bool __section(".data.once") ___done = false;	     \
+		static bool __section(".data..once") ___done = false;	     \
 		static DEFINE_STATIC_KEY_TRUE(___once_key);		     \
 		if (static_branch_unlikely(&___once_key)) {		     \
 			unsigned long ___flags;				     \
@@ -64,7 +64,7 @@
 #define DO_ONCE_SLEEPABLE(func, ...)						\
 	({									\
 		bool ___ret = false;						\
-		static bool __section(".data.once") ___done = false;		\
+		static bool __section(".data..once") ___done = false;		\
 		static DEFINE_STATIC_KEY_TRUE(___once_key);			\
 		if (static_branch_unlikely(&___once_key)) {			\
 			___ret = __do_once_sleepable_start(&___done);		\
--- linux-qcom-6.8.0.orig/include/linux/once_lite.h
+++ linux-qcom-6.8.0/include/linux/once_lite.h
@@ -12,7 +12,7 @@
 
 #define __ONCE_LITE_IF(condition)					\
 	({								\
-		static bool __section(".data.once") __already_done;	\
+		static bool __section(".data..once") __already_done;	\
 		bool __ret_cond = !!(condition);			\
 		bool __ret_once = false;				\
 									\
--- linux-qcom-6.8.0.orig/include/linux/overflow.h
+++ linux-qcom-6.8.0/include/linux/overflow.h
@@ -31,8 +31,10 @@
  * credit to Christian Biere.
  */
 #define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type)))
-#define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
-#define type_min(T) ((T)((T)-type_max(T)-(T)1))
+#define __type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
+#define type_max(t)	__type_max(typeof(t))
+#define __type_min(T) ((T)((T)-type_max(T)-(T)1))
+#define type_min(t)	__type_min(typeof(t))
 
 /*
  * Avoids triggering -Wtype-limits compilation warning,
@@ -130,10 +132,10 @@
 
 #define __overflows_type_constexpr(x, T) (			\
 	is_unsigned_type(typeof(x)) ?				\
-		(x) > type_max(typeof(T)) :			\
+		(x) > type_max(T) :				\
 	is_unsigned_type(typeof(T)) ?				\
-		(x) < 0 || (x) > type_max(typeof(T)) :		\
-	(x) < type_min(typeof(T)) || (x) > type_max(typeof(T)))
+		(x) < 0 || (x) > type_max(T) :			\
+	(x) < type_min(T) || (x) > type_max(T))
 
 #define __overflows_type(x, T)		({	\
 	typeof(T) v = 0;			\
@@ -319,7 +321,7 @@
  * @count: Number of elements in the array; must be compile-time const.
  * @initializer: initializer expression (could be empty for no init).
  */
-#define _DEFINE_FLEX(type, name, member, count, initializer)			\
+#define _DEFINE_FLEX(type, name, member, count, initializer...)			\
 	_Static_assert(__builtin_constant_p(count),				\
 		       "onstack flex array members require compile-time const count"); \
 	union {									\
@@ -329,8 +331,8 @@
 	type *name = (type *)&name##_u
 
 /**
- * DEFINE_FLEX() - Define an on-stack instance of structure with a trailing
- * flexible array member.
+ * DEFINE_RAW_FLEX() - Define an on-stack instance of structure with a trailing
+ * flexible array member, when it does not have a __counted_by annotation.
  *
  * @type: structure type name, including "struct" keyword.
  * @name: Name for a variable to define.
@@ -341,7 +343,24 @@
  * flexible array member.
  * Use __struct_size(@name) to get compile-time size of it afterwards.
  */
-#define DEFINE_FLEX(type, name, member, count)			\
+#define DEFINE_RAW_FLEX(type, name, member, count)	\
 	_DEFINE_FLEX(type, name, member, count, = {})
 
+/**
+ * DEFINE_FLEX() - Define an on-stack instance of structure with a trailing
+ * flexible array member.
+ *
+ * @TYPE: structure type name, including "struct" keyword.
+ * @NAME: Name for a variable to define.
+ * @MEMBER: Name of the array member.
+ * @COUNTER: Name of the __counted_by member.
+ * @COUNT: Number of elements in the array; must be compile-time const.
+ *
+ * Define a zeroed, on-stack, instance of @TYPE structure with a trailing
+ * flexible array member.
+ * Use __struct_size(@NAME) to get compile-time size of it afterwards.
+ */
+#define DEFINE_FLEX(TYPE, NAME, MEMBER, COUNTER, COUNT)	\
+	_DEFINE_FLEX(TYPE, NAME, MEMBER, COUNT, = { .obj.COUNTER = COUNT, })
+
 #endif /* __LINUX_OVERFLOW_H */
--- linux-qcom-6.8.0.orig/include/linux/page-flags.h
+++ linux-qcom-6.8.0/include/linux/page-flags.h
@@ -190,7 +190,6 @@
 
 	/* At least one page in this folio has the hwpoison flag set */
 	PG_has_hwpoisoned = PG_error,
-	PG_hugetlb = PG_active,
 	PG_large_rmappable = PG_workingset, /* anon or file-backed */
 };
 
@@ -242,7 +241,7 @@
 	return page_fixed_fake_head(page) != page;
 }
 
-static inline unsigned long _compound_head(const struct page *page)
+static __always_inline unsigned long _compound_head(const struct page *page)
 {
 	unsigned long head = READ_ONCE(page->compound_head);
 
@@ -432,30 +431,51 @@
 	TESTSETFLAG(uname, lname, policy)				\
 	TESTCLEARFLAG(uname, lname, policy)
 
+#define FOLIO_TEST_FLAG_FALSE(name)					\
+static inline bool folio_test_##name(const struct folio *folio)		\
+{ return false; }
+#define FOLIO_SET_FLAG_NOOP(name)					\
+static inline void folio_set_##name(struct folio *folio) { }
+#define FOLIO_CLEAR_FLAG_NOOP(name)					\
+static inline void folio_clear_##name(struct folio *folio) { }
+#define __FOLIO_SET_FLAG_NOOP(name)					\
+static inline void __folio_set_##name(struct folio *folio) { }
+#define __FOLIO_CLEAR_FLAG_NOOP(name)					\
+static inline void __folio_clear_##name(struct folio *folio) { }
+#define FOLIO_TEST_SET_FLAG_FALSE(name)					\
+static inline bool folio_test_set_##name(struct folio *folio)		\
+{ return false; }
+#define FOLIO_TEST_CLEAR_FLAG_FALSE(name)				\
+static inline bool folio_test_clear_##name(struct folio *folio)		\
+{ return false; }
+
+#define FOLIO_FLAG_FALSE(name)						\
+FOLIO_TEST_FLAG_FALSE(name)						\
+FOLIO_SET_FLAG_NOOP(name)						\
+FOLIO_CLEAR_FLAG_NOOP(name)
+
 #define TESTPAGEFLAG_FALSE(uname, lname)				\
-static inline bool folio_test_##lname(const struct folio *folio) { return false; } \
+FOLIO_TEST_FLAG_FALSE(lname)						\
 static inline int Page##uname(const struct page *page) { return 0; }
 
 #define SETPAGEFLAG_NOOP(uname, lname)					\
-static inline void folio_set_##lname(struct folio *folio) { }		\
+FOLIO_SET_FLAG_NOOP(lname)						\
 static inline void SetPage##uname(struct page *page) {  }
 
 #define CLEARPAGEFLAG_NOOP(uname, lname)				\
-static inline void folio_clear_##lname(struct folio *folio) { }		\
+FOLIO_CLEAR_FLAG_NOOP(lname)						\
 static inline void ClearPage##uname(struct page *page) {  }
 
 #define __CLEARPAGEFLAG_NOOP(uname, lname)				\
-static inline void __folio_clear_##lname(struct folio *folio) { }	\
+__FOLIO_CLEAR_FLAG_NOOP(lname)						\
 static inline void __ClearPage##uname(struct page *page) {  }
 
 #define TESTSETFLAG_FALSE(uname, lname)					\
-static inline bool folio_test_set_##lname(struct folio *folio)		\
-{ return 0; }								\
+FOLIO_TEST_SET_FLAG_FALSE(lname)					\
 static inline int TestSetPage##uname(struct page *page) { return 0; }
 
 #define TESTCLEARFLAG_FALSE(uname, lname)				\
-static inline bool folio_test_clear_##lname(struct folio *folio)	\
-{ return 0; }								\
+FOLIO_TEST_CLEAR_FLAG_FALSE(lname)					\
 static inline int TestClearPage##uname(struct page *page) { return 0; }
 
 #define PAGEFLAG_FALSE(uname, lname) TESTPAGEFLAG_FALSE(uname, lname)	\
@@ -829,29 +849,6 @@
 
 #define PG_head_mask ((1UL << PG_head))
 
-#ifdef CONFIG_HUGETLB_PAGE
-int PageHuge(struct page *page);
-SETPAGEFLAG(HugeTLB, hugetlb, PF_SECOND)
-CLEARPAGEFLAG(HugeTLB, hugetlb, PF_SECOND)
-
-/**
- * folio_test_hugetlb - Determine if the folio belongs to hugetlbfs
- * @folio: The folio to test.
- *
- * Context: Any context.  Caller should have a reference on the folio to
- * prevent it from being turned into a tail page.
- * Return: True for hugetlbfs folios, false for anon folios or folios
- * belonging to other filesystems.
- */
-static inline bool folio_test_hugetlb(struct folio *folio)
-{
-	return folio_test_large(folio) &&
-		test_bit(PG_hugetlb, folio_flags(folio, 1));
-}
-#else
-TESTPAGEFLAG_FALSE(Huge, hugetlb)
-#endif
-
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 /*
  * PageHuge() only returns true for hugetlbfs pages, but not for
@@ -908,33 +905,22 @@
 #endif
 
 /*
- * Check if a page is currently marked HWPoisoned. Note that this check is
- * best effort only and inherently racy: there is no way to synchronize with
- * failing hardware.
- */
-static inline bool is_page_hwpoison(struct page *page)
-{
-	if (PageHWPoison(page))
-		return true;
-	return PageHuge(page) && PageHWPoison(compound_head(page));
-}
-
-/*
  * For pages that are never mapped to userspace (and aren't PageSlab),
  * page_type may be used.  Because it is initialised to -1, we invert the
  * sense of the bit, so __SetPageFoo *clears* the bit used for PageFoo, and
  * __ClearPageFoo *sets* the bit used for PageFoo.  We reserve a few high and
- * low bits so that an underflow or overflow of page_mapcount() won't be
+ * low bits so that an underflow or overflow of _mapcount won't be
  * mistaken for a page type value.
  */
 
 #define PAGE_TYPE_BASE	0xf0000000
-/* Reserve		0x0000007f to catch underflows of page_mapcount */
+/* Reserve		0x0000007f to catch underflows of _mapcount */
 #define PAGE_MAPCOUNT_RESERVE	-128
 #define PG_buddy	0x00000080
 #define PG_offline	0x00000100
 #define PG_table	0x00000200
 #define PG_guard	0x00000400
+#define PG_hugetlb	0x00000800
 
 #define PageType(page, flag)						\
 	((page->page_type & (PAGE_TYPE_BASE | flag)) == PAGE_TYPE_BASE)
@@ -951,35 +937,38 @@
 	return page_type_has_type(page->page_type);
 }
 
+#define FOLIO_TYPE_OPS(lname, fname)					\
+static __always_inline bool folio_test_##fname(const struct folio *folio)\
+{									\
+	return folio_test_type(folio, PG_##lname);			\
+}									\
+static __always_inline void __folio_set_##fname(struct folio *folio)	\
+{									\
+	VM_BUG_ON_FOLIO(!folio_test_type(folio, 0), folio);		\
+	folio->page.page_type &= ~PG_##lname;				\
+}									\
+static __always_inline void __folio_clear_##fname(struct folio *folio)	\
+{									\
+	VM_BUG_ON_FOLIO(!folio_test_##fname(folio), folio);		\
+	folio->page.page_type |= PG_##lname;				\
+}
+
 #define PAGE_TYPE_OPS(uname, lname, fname)				\
+FOLIO_TYPE_OPS(lname, fname)						\
 static __always_inline int Page##uname(const struct page *page)		\
 {									\
 	return PageType(page, PG_##lname);				\
 }									\
-static __always_inline int folio_test_##fname(const struct folio *folio)\
-{									\
-	return folio_test_type(folio, PG_##lname);			\
-}									\
 static __always_inline void __SetPage##uname(struct page *page)		\
 {									\
 	VM_BUG_ON_PAGE(!PageType(page, 0), page);			\
 	page->page_type &= ~PG_##lname;					\
 }									\
-static __always_inline void __folio_set_##fname(struct folio *folio)	\
-{									\
-	VM_BUG_ON_FOLIO(!folio_test_type(folio, 0), folio);		\
-	folio->page.page_type &= ~PG_##lname;				\
-}									\
 static __always_inline void __ClearPage##uname(struct page *page)	\
 {									\
 	VM_BUG_ON_PAGE(!Page##uname(page), page);			\
 	page->page_type |= PG_##lname;					\
-}									\
-static __always_inline void __folio_clear_##fname(struct folio *folio)	\
-{									\
-	VM_BUG_ON_FOLIO(!folio_test_##fname(folio), folio);		\
-	folio->page.page_type |= PG_##lname;				\
-}									\
+}
 
 /*
  * PageBuddy() indicates that the page is free and in the buddy system
@@ -1026,6 +1015,37 @@
  */
 PAGE_TYPE_OPS(Guard, guard, guard)
 
+#ifdef CONFIG_HUGETLB_PAGE
+FOLIO_TYPE_OPS(hugetlb, hugetlb)
+#else
+FOLIO_TEST_FLAG_FALSE(hugetlb)
+#endif
+
+/**
+ * PageHuge - Determine if the page belongs to hugetlbfs
+ * @page: The page to test.
+ *
+ * Context: Any context.
+ * Return: True for hugetlbfs pages, false for anon pages or pages
+ * belonging to other filesystems.
+ */
+static inline bool PageHuge(const struct page *page)
+{
+	return folio_test_hugetlb(page_folio(page));
+}
+
+/*
+ * Check if a page is currently marked HWPoisoned. Note that this check is
+ * best effort only and inherently racy: there is no way to synchronize with
+ * failing hardware.
+ */
+static inline bool is_page_hwpoison(struct page *page)
+{
+	if (PageHWPoison(page))
+		return true;
+	return PageHuge(page) && PageHWPoison(compound_head(page));
+}
+
 extern bool is_free_buddy_page(struct page *page);
 
 PAGEFLAG(Isolated, isolated, PF_ANY);
@@ -1092,7 +1112,7 @@
  */
 #define PAGE_FLAGS_SECOND						\
 	(0xffUL /* order */		| 1UL << PG_has_hwpoisoned |	\
-	 1UL << PG_hugetlb		| 1UL << PG_large_rmappable)
+	 1UL << PG_large_rmappable)
 
 #define PAGE_FLAGS_PRIVATE				\
 	(1UL << PG_private | 1UL << PG_private_2)
--- linux-qcom-6.8.0.orig/include/linux/page_ref.h
+++ linux-qcom-6.8.0/include/linux/page_ref.h
@@ -263,54 +263,9 @@
 	return folio_ref_add_unless(folio, 1, 0);
 }
 
-static inline bool folio_ref_try_add_rcu(struct folio *folio, int count)
+static inline bool folio_ref_try_add(struct folio *folio, int count)
 {
-#ifdef CONFIG_TINY_RCU
-	/*
-	 * The caller guarantees the folio will not be freed from interrupt
-	 * context, so (on !SMP) we only need preemption to be disabled
-	 * and TINY_RCU does that for us.
-	 */
-# ifdef CONFIG_PREEMPT_COUNT
-	VM_BUG_ON(!in_atomic() && !irqs_disabled());
-# endif
-	VM_BUG_ON_FOLIO(folio_ref_count(folio) == 0, folio);
-	folio_ref_add(folio, count);
-#else
-	if (unlikely(!folio_ref_add_unless(folio, count, 0))) {
-		/* Either the folio has been freed, or will be freed. */
-		return false;
-	}
-#endif
-	return true;
-}
-
-/**
- * folio_try_get_rcu - Attempt to increase the refcount on a folio.
- * @folio: The folio.
- *
- * This is a version of folio_try_get() optimised for non-SMP kernels.
- * If you are still holding the rcu_read_lock() after looking up the
- * page and know that the page cannot have its refcount decreased to
- * zero in interrupt context, you can use this instead of folio_try_get().
- *
- * Example users include get_user_pages_fast() (as pages are not unmapped
- * from interrupt context) and the page cache lookups (as pages are not
- * truncated from interrupt context).  We also know that pages are not
- * frozen in interrupt context for the purposes of splitting or migration.
- *
- * You can also use this function if you're holding a lock that prevents
- * pages being frozen & removed; eg the i_pages lock for the page cache
- * or the mmap_lock or page table lock for page tables.  In this case,
- * it will always succeed, and you could have used a plain folio_get(),
- * but it's sometimes more convenient to have a common function called
- * from both locked and RCU-protected contexts.
- *
- * Return: True if the reference count was successfully incremented.
- */
-static inline bool folio_try_get_rcu(struct folio *folio)
-{
-	return folio_ref_try_add_rcu(folio, 1);
+	return folio_ref_add_unless(folio, count, 0);
 }
 
 static inline int page_ref_freeze(struct page *page, int count)
--- linux-qcom-6.8.0.orig/include/linux/pagemap.h
+++ linux-qcom-6.8.0/include/linux/pagemap.h
@@ -40,6 +40,8 @@
 int filemap_fdatawait_range(struct address_space *, loff_t lstart, loff_t lend);
 int filemap_fdatawait_range_keep_errors(struct address_space *mapping,
 		loff_t start_byte, loff_t end_byte);
+int filemap_invalidate_inode(struct inode *inode, bool flush,
+			     loff_t start, loff_t end);
 
 static inline int filemap_fdatawait(struct address_space *mapping)
 {
@@ -344,6 +346,26 @@
 	m->gfp_mask = mask;
 }
 
+/*
+ * There are some parts of the kernel which assume that PMD entries
+ * are exactly HPAGE_PMD_ORDER.  Those should be fixed, but until then,
+ * limit the maximum allocation order to PMD size.  I'm not aware of any
+ * assumptions about maximum order if THP are disabled, but 8 seems like
+ * a good order (that's 1MB if you're using 4kB pages)
+ */
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+#define PREFERRED_MAX_PAGECACHE_ORDER	HPAGE_PMD_ORDER
+#else
+#define PREFERRED_MAX_PAGECACHE_ORDER	8
+#endif
+
+/*
+ * xas_split_alloc() does not support arbitrary orders. This implies no
+ * 512MB THP on ARM64 with 64KB base page size.
+ */
+#define MAX_XAS_ORDER		(XA_CHUNK_SHIFT * 2 - 1)
+#define MAX_PAGECACHE_ORDER	min(MAX_XAS_ORDER, PREFERRED_MAX_PAGECACHE_ORDER)
+
 /**
  * mapping_set_large_folios() - Indicate the file supports large folios.
  * @mapping: The file.
@@ -370,6 +392,14 @@
 		test_bit(AS_LARGE_FOLIO_SUPPORT, &mapping->flags);
 }
 
+/* Return the maximum folio size for this pagecache mapping, in bytes. */
+static inline size_t mapping_max_folio_size(struct address_space *mapping)
+{
+	if (mapping_large_folio_support(mapping))
+		return PAGE_SIZE << MAX_PAGECACHE_ORDER;
+	return PAGE_SIZE;
+}
+
 static inline int filemap_nr_thps(struct address_space *mapping)
 {
 #ifdef CONFIG_READ_ONLY_THP_FOR_FS
@@ -528,19 +558,6 @@
 	return folio_detach_private(page_folio(page));
 }
 
-/*
- * There are some parts of the kernel which assume that PMD entries
- * are exactly HPAGE_PMD_ORDER.  Those should be fixed, but until then,
- * limit the maximum allocation order to PMD size.  I'm not aware of any
- * assumptions about maximum order if THP are disabled, but 8 seems like
- * a good order (that's 1MB if you're using 4kB pages)
- */
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-#define MAX_PAGECACHE_ORDER	HPAGE_PMD_ORDER
-#else
-#define MAX_PAGECACHE_ORDER	8
-#endif
-
 #ifdef CONFIG_NUMA
 struct folio *filemap_alloc_folio(gfp_t gfp, unsigned int order);
 #else
--- linux-qcom-6.8.0.orig/include/linux/path.h
+++ linux-qcom-6.8.0/include/linux/path.h
@@ -24,4 +24,13 @@
 	*path = (struct path) { };
 }
 
+/*
+ * Cleanup macro for use with __free(path_put). Avoids dereference and
+ * copying @path unlike DEFINE_FREE(). path_put() will handle the empty
+ * path correctly just ensure @path is initialized:
+ *
+ * struct path path __free(path_put) = {};
+ */
+#define __free_path_put path_put
+
 #endif  /* _LINUX_PATH_H */
--- linux-qcom-6.8.0.orig/include/linux/pci-epc.h
+++ linux-qcom-6.8.0/include/linux/pci-epc.h
@@ -128,6 +128,7 @@
  * @group: configfs group representing the PCI EPC device
  * @lock: mutex to protect pci_epc ops
  * @function_num_map: bitmap to manage physical function number
+ * @domain_nr: PCI domain number of the endpoint controller
  */
 struct pci_epc {
 	struct device			dev;
@@ -143,6 +144,7 @@
 	/* mutex to protect against concurrent access of EP controller */
 	struct mutex			lock;
 	unsigned long			function_num_map;
+	int				domain_nr;
 };
 
 /**
--- linux-qcom-6.8.0.orig/include/linux/pci-pwrctl.h
+++ linux-qcom-6.8.0/include/linux/pci-pwrctl.h
@@ -0,0 +1,51 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2024 Linaro Ltd.
+ */
+
+#ifndef __PCI_PWRCTL_H__
+#define __PCI_PWRCTL_H__
+
+#include <linux/notifier.h>
+
+struct device;
+struct device_link;
+
+/*
+ * This is a simple framework for solving the issue of PCI devices that require
+ * certain resources (regulators, GPIOs, clocks) to be enabled before the
+ * device can actually be detected on the PCI bus.
+ *
+ * The idea is to reuse the platform bus to populate OF nodes describing the
+ * PCI device and its resources, let these platform devices probe and enable
+ * relevant resources and then trigger a rescan of the PCI bus allowing for the
+ * same device (with a second associated struct device) to be registered with
+ * the PCI subsystem.
+ *
+ * To preserve a correct hierarchy for PCI power management and device reset,
+ * we create a device link between the power control platform device (parent)
+ * and the supplied PCI device (child).
+ */
+
+/**
+ * struct pci_pwrctl - PCI device power control context.
+ * @dev: Address of the power controlling device.
+ *
+ * An object of this type must be allocated by the PCI power control device and
+ * passed to the pwrctl subsystem to trigger a bus rescan and setup a device
+ * link with the device once it's up.
+ */
+struct pci_pwrctl {
+	struct device *dev;
+
+	/* Private: don't use. */
+	struct notifier_block nb;
+	struct device_link *link;
+};
+
+int pci_pwrctl_device_set_ready(struct pci_pwrctl *pwrctl);
+void pci_pwrctl_device_unset_ready(struct pci_pwrctl *pwrctl);
+int devm_pci_pwrctl_device_set_ready(struct device *dev,
+				     struct pci_pwrctl *pwrctl);
+
+#endif /* __PCI_PWRCTL_H__ */
--- linux-qcom-6.8.0.orig/include/linux/pci.h
+++ linux-qcom-6.8.0/include/linux/pci.h
@@ -245,6 +245,8 @@
 	PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 11),
 	/* Device does honor MSI masking despite saying otherwise */
 	PCI_DEV_FLAGS_HAS_MSI_MASKING = (__force pci_dev_flags_t) (1 << 12),
+	/* Enable ASPM regardless of how LnkCtl is programmed */
+	PCI_DEV_FLAGS_ENABLE_ASPM = (__force pci_dev_flags_t) (1 << 13),
 };
 
 enum pci_irq_reroute_variant {
@@ -371,6 +373,7 @@
 	unsigned int	pme_support:5;	/* Bitmask of states from which PME#
 					   can be generated */
 	unsigned int	pme_poll:1;	/* Poll device's PME status bit */
+	unsigned int	config_crs_sv:1; /* Config CRS software visibility */
 	unsigned int	d1_support:1;	/* Low power state D1 is supported */
 	unsigned int	d2_support:1;	/* Low power state D2 is supported */
 	unsigned int	no_d1d2:1;	/* D1 and D2 are forbidden */
@@ -390,9 +393,9 @@
 	unsigned int	d3hot_delay;	/* D3hot->D0 transition time in ms */
 	unsigned int	d3cold_delay;	/* D3cold->D0 transition time in ms */
 
+	u16		l1ss;		/* L1SS Capability pointer */
 #ifdef CONFIG_PCIEASPM
 	struct pcie_link_state	*link_state;	/* ASPM link state */
-	u16		l1ss;		/* L1SS Capability pointer */
 	unsigned int	ltr_path:1;	/* Latency Tolerance Reporting
 					   supported from root to here */
 #endif
@@ -465,6 +468,7 @@
 	unsigned int	no_command_memory:1;	/* No PCI_COMMAND_MEMORY */
 	unsigned int	rom_bar_overlap:1;	/* ROM BAR disable broken */
 	unsigned int	rom_attr_enabled:1;	/* Display of ROM attribute enabled? */
+	unsigned int	aspm_os_control:1;	/* Display of ROM attribute enabled? */
 	pci_dev_flags_t dev_flags;
 	atomic_t	enable_cnt;	/* pci_enable_device has been called */
 
@@ -1658,8 +1662,6 @@
 	u16	entry;	/* Driver uses to specify entry, OS writes */
 };
 
-struct msi_domain_template;
-
 #ifdef CONFIG_PCI_MSI
 int pci_msi_vec_count(struct pci_dev *dev);
 void pci_disable_msi(struct pci_dev *dev);
@@ -1692,11 +1694,6 @@
 void pci_free_irq_vectors(struct pci_dev *dev);
 int pci_irq_vector(struct pci_dev *dev, unsigned int nr);
 const struct cpumask *pci_irq_get_affinity(struct pci_dev *pdev, int vec);
-bool pci_create_ims_domain(struct pci_dev *pdev, const struct msi_domain_template *template,
-			   unsigned int hwsize, void *data);
-struct msi_map pci_ims_alloc_irq(struct pci_dev *pdev, union msi_instance_cookie *icookie,
-				 const struct irq_affinity_desc *affdesc);
-void pci_ims_free_irq(struct pci_dev *pdev, struct msi_map map);
 
 #else
 static inline int pci_msi_vec_count(struct pci_dev *dev) { return -ENOSYS; }
@@ -1760,25 +1757,6 @@
 {
 	return cpu_possible_mask;
 }
-
-static inline bool pci_create_ims_domain(struct pci_dev *pdev,
-					 const struct msi_domain_template *template,
-					 unsigned int hwsize, void *data)
-{ return false; }
-
-static inline struct msi_map pci_ims_alloc_irq(struct pci_dev *pdev,
-					       union msi_instance_cookie *icookie,
-					       const struct irq_affinity_desc *affdesc)
-{
-	struct msi_map map = { .index = -ENOSYS, };
-
-	return map;
-}
-
-static inline void pci_ims_free_irq(struct pci_dev *pdev, struct msi_map map)
-{
-}
-
 #endif
 
 /**
@@ -1841,6 +1819,7 @@
 void pcie_no_aspm(void);
 bool pcie_aspm_support_enabled(void);
 bool pcie_aspm_enabled(struct pci_dev *pdev);
+bool pcie_aspm_capable(struct pci_dev *pdev);
 #else
 static inline int pci_disable_link_state(struct pci_dev *pdev, int state)
 { return 0; }
@@ -1853,6 +1832,7 @@
 static inline void pcie_no_aspm(void) { }
 static inline bool pcie_aspm_support_enabled(void) { return false; }
 static inline bool pcie_aspm_enabled(struct pci_dev *pdev) { return false; }
+static inline bool pcie_aspm_capable(struct pci_dev *pdev) { return false; }
 #endif
 
 #ifdef CONFIG_PCIEAER
@@ -1914,7 +1894,7 @@
 { return 0; }
 #endif
 int pci_bus_find_domain_nr(struct pci_bus *bus, struct device *parent);
-void pci_bus_release_domain_nr(struct pci_bus *bus, struct device *parent);
+void pci_bus_release_domain_nr(struct device *parent, int domain_nr);
 #endif
 
 /* Some architectures require additional setup to direct VGA traffic */
@@ -2517,6 +2497,16 @@
 	return NULL;
 }
 
+static inline bool pci_dev_is_disconnected(const struct pci_dev *dev)
+{
+	/*
+	 * error_state is set in pci_dev_set_io_state() using xchg/cmpxchg()
+	 * and read w/o common lock. READ_ONCE() ensures compiler cannot cache
+	 * the value (e.g. inside the loop in pci_dev_wait()).
+	 */
+	return READ_ONCE(dev->error_state) == pci_channel_io_perm_failure;
+}
+
 void pci_request_acs(void);
 bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags);
 bool pci_acs_path_enabled(struct pci_dev *start,
@@ -2621,6 +2611,12 @@
 static inline bool pci_pr3_present(struct pci_dev *pdev) { return false; }
 #endif
 
+#if defined(CONFIG_X86) && defined(CONFIG_ACPI)
+bool arch_pci_dev_is_removable(struct pci_dev *pdev);
+#else
+static inline bool arch_pci_dev_is_removable(struct pci_dev *pdev) { return false; }
+#endif
+
 #ifdef CONFIG_EEH
 static inline struct eeh_dev *pci_dev_to_eeh_dev(struct pci_dev *pdev)
 {
@@ -2685,6 +2681,14 @@
 void pci_uevent_ers(struct pci_dev *pdev, enum  pci_ers_result err_type);
 #endif
 
+struct msi_domain_template;
+
+bool pci_create_ims_domain(struct pci_dev *pdev, const struct msi_domain_template *template,
+			   unsigned int hwsize, void *data);
+struct msi_map pci_ims_alloc_irq(struct pci_dev *pdev, union msi_instance_cookie *icookie,
+				 const struct irq_affinity_desc *affdesc);
+void pci_ims_free_irq(struct pci_dev *pdev, struct msi_map map);
+
 #include <linux/dma-mapping.h>
 
 #define pci_printk(level, pdev, fmt, arg...) \
--- linux-qcom-6.8.0.orig/include/linux/pci_ids.h
+++ linux-qcom-6.8.0/include/linux/pci_ids.h
@@ -580,6 +580,8 @@
 #define PCI_DEVICE_ID_AMD_19H_M78H_DF_F3 0x12fb
 #define PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3 0x12c3
 #define PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3 0x16fb
+#define PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3 0x124b
+#define PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3 0x12bb
 #define PCI_DEVICE_ID_AMD_MI200_DF_F3	0x14d3
 #define PCI_DEVICE_ID_AMD_MI300_DF_F3	0x152b
 #define PCI_DEVICE_ID_AMD_VANGOGH_USB	0x163a
@@ -2125,6 +2127,8 @@
 
 #define PCI_VENDOR_ID_CHELSIO		0x1425
 
+#define PCI_VENDOR_ID_EDIMAX		0x1432
+
 #define PCI_VENDOR_ID_ADLINK		0x144a
 
 #define PCI_VENDOR_ID_SAMSUNG		0x144d
@@ -2654,6 +2658,8 @@
 #define PCI_DEVICE_ID_DCI_PCCOM8	0x0002
 #define PCI_DEVICE_ID_DCI_PCCOM2	0x0004
 
+#define PCI_VENDOR_ID_GLENFLY		0x6766
+
 #define PCI_VENDOR_ID_INTEL		0x8086
 #define PCI_DEVICE_ID_INTEL_EESSC	0x0008
 #define PCI_DEVICE_ID_INTEL_HDA_CML_LP	0x02c8
@@ -2686,8 +2692,10 @@
 #define PCI_DEVICE_ID_INTEL_I960	0x0960
 #define PCI_DEVICE_ID_INTEL_I960RM	0x0962
 #define PCI_DEVICE_ID_INTEL_HDA_HSW_0	0x0a0c
+#define PCI_DEVICE_ID_INTEL_DSA_SPR0	0x0b25
 #define PCI_DEVICE_ID_INTEL_HDA_HSW_2	0x0c0c
 #define PCI_DEVICE_ID_INTEL_CENTERTON_ILB	0x0c60
+#define PCI_DEVICE_ID_INTEL_IAX_SPR0	0x0cfe
 #define PCI_DEVICE_ID_INTEL_HDA_HSW_3	0x0d0c
 #define PCI_DEVICE_ID_INTEL_HDA_BYT	0x0f04
 #define PCI_DEVICE_ID_INTEL_SST_BYT	0x0f28
--- linux-qcom-6.8.0.orig/include/linux/pcs-xpcs-qcom.h
+++ linux-qcom-6.8.0/include/linux/pcs-xpcs-qcom.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Synopsys DesignWare XPCS platform device driver
+ *
+ * Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __LINUX_PCS_XPCS_QCOM_H
+#define __LINUX_PCS_XPCS_QCOM_H
+
+#include <linux/phy.h>
+#include <linux/phylink.h>
+
+/* AN mode */
+#define DW_AN_C37_USXGMII		1
+#define DW_10GBASER			5
+
+struct xpcs_id;
+
+struct dw_xpcs_qcom {
+	const struct xpcs_id *id;
+	struct phylink_pcs pcs;
+	void __iomem *addr;
+	int pcs_intr;
+	bool intr_en;
+	int phy_interface;
+};
+
+struct phylink_pcs *qcom_xpcs_create(struct device_node *np,
+				      phy_interface_t interface);
+void qcom_xpcs_link_up(struct phylink_pcs *pcs, unsigned int mode,
+		  phy_interface_t interface, int speed, int duplex);
+#endif /* __LINUX_PCS_XPCS_QCOM_H */
--- linux-qcom-6.8.0.orig/include/linux/perf_event.h
+++ linux-qcom-6.8.0/include/linux/perf_event.h
@@ -786,6 +786,7 @@
 	struct irq_work			pending_irq;
 	struct callback_head		pending_task;
 	unsigned int			pending_work;
+	struct rcuwait			pending_work_wait;
 
 	atomic_t			event_limit;
 
@@ -1612,20 +1613,20 @@
 #define PERF_SECURITY_CPU		1
 #define PERF_SECURITY_KERNEL		2
 #define PERF_SECURITY_TRACEPOINT	3
+#define PERF_SECURITY_MAX		4
 
-static inline int perf_is_paranoid(void)
+static inline bool perf_paranoid_any(void)
 {
-	return sysctl_perf_event_paranoid > -1;
+	return sysctl_perf_event_paranoid >= PERF_SECURITY_MAX;
 }
 
-static inline int perf_allow_kernel(struct perf_event_attr *attr)
+static inline int perf_is_paranoid(void)
 {
-	if (sysctl_perf_event_paranoid > 1 && !perfmon_capable())
-		return -EACCES;
-
-	return security_perf_event_open(attr, PERF_SECURITY_KERNEL);
+	return sysctl_perf_event_paranoid > -1;
 }
 
+int perf_allow_kernel(struct perf_event_attr *attr);
+
 static inline int perf_allow_cpu(struct perf_event_attr *attr)
 {
 	if (sysctl_perf_event_paranoid > 0 && !perfmon_capable())
--- linux-qcom-6.8.0.orig/include/linux/phy.h
+++ linux-qcom-6.8.0/include/linux/phy.h
@@ -852,6 +852,15 @@
 	bool pst;
 };
 
+/* Modes for PHY LED configuration */
+enum phy_led_modes {
+	PHY_LED_ACTIVE_LOW = 0,
+	PHY_LED_INACTIVE_HIGH_IMPEDANCE = 1,
+
+	/* keep it last */
+	__PHY_LED_MODES_NUM,
+};
+
 /**
  * struct phy_led: An LED driven by the PHY
  *
@@ -1102,7 +1111,7 @@
 				  u8 index, enum led_brightness value);
 
 	/**
-	 * @led_blink_set: Set a PHY LED brightness.  Index indicates
+	 * @led_blink_set: Set a PHY LED blinking.  Index indicates
 	 * which of the PHYs led should be configured to blink. Delays
 	 * are in milliseconds and if both are zero then a sensible
 	 * default should be chosen.  The call should adjust the
@@ -1145,6 +1154,19 @@
 	int (*led_hw_control_get)(struct phy_device *dev, u8 index,
 				  unsigned long *rules);
 
+	/**
+	 * @led_polarity_set: Set the LED polarity modes
+	 * @dev: PHY device which has the LED
+	 * @index: Which LED of the PHY device
+	 * @modes: bitmap of LED polarity modes
+	 *
+	 * Configure LED with all the required polarity modes in @modes
+	 * to make it correctly turn ON or OFF.
+	 *
+	 * Returns 0, or an error code.
+	 */
+	int (*led_polarity_set)(struct phy_device *dev, int index,
+				unsigned long modes);
 };
 #define to_phy_driver(d) container_of(to_mdio_common_driver(d),		\
 				      struct phy_driver, mdiodrv)
--- linux-qcom-6.8.0.orig/include/linux/phy/phy-dp.h
+++ linux-qcom-6.8.0/include/linux/phy/phy-dp.h
@@ -8,6 +8,9 @@
 
 #include <linux/types.h>
 
+#define PHY_SUBMODE_DP	0
+#define PHY_SUBMODE_EDP	1
+
 /**
  * struct phy_configure_opts_dp - DisplayPort PHY configuration set
  *
--- linux-qcom-6.8.0.orig/include/linux/phy/tegra/xusb.h
+++ linux-qcom-6.8.0/include/linux/phy/tegra/xusb.h
@@ -26,6 +26,7 @@
 int tegra_phy_xusb_utmi_port_reset(struct phy *phy);
 int tegra_xusb_padctl_get_usb3_companion(struct tegra_xusb_padctl *padctl,
 					 unsigned int port);
+int tegra_xusb_padctl_get_port_number(struct phy *phy);
 int tegra_xusb_padctl_enable_phy_sleepwalk(struct tegra_xusb_padctl *padctl, struct phy *phy,
 					   enum usb_device_speed speed);
 int tegra_xusb_padctl_disable_phy_sleepwalk(struct tegra_xusb_padctl *padctl, struct phy *phy);
--- linux-qcom-6.8.0.orig/include/linux/phylink.h
+++ linux-qcom-6.8.0/include/linux/phylink.h
@@ -161,6 +161,7 @@
 
 /**
  * struct phylink_mac_ops - MAC operations structure.
+ * @validate: Validate and update the link configuration.
  * @mac_get_caps: Get MAC capabilities for interface mode.
  * @mac_select_pcs: Select a PCS for the interface mode.
  * @mac_prepare: prepare for a major reconfiguration of the interface.
@@ -172,6 +173,9 @@
  * The individual methods are described more fully below.
  */
 struct phylink_mac_ops {
+	void (*validate)(struct phylink_config *config,
+			 unsigned long *supported,
+			 struct phylink_link_state *state);
 	unsigned long (*mac_get_caps)(struct phylink_config *config,
 				      phy_interface_t interface);
 	struct phylink_pcs *(*mac_select_pcs)(struct phylink_config *config,
@@ -192,6 +196,40 @@
 
 #if 0 /* For kernel-doc purposes only. */
 /**
+ * validate - Validate and update the link configuration
+ * @config: a pointer to a &struct phylink_config.
+ * @supported: ethtool bitmask for supported link modes.
+ * @state: a pointer to a &struct phylink_link_state.
+ *
+ * Clear bits in the @supported and @state->advertising masks that
+ * are not supportable by the MAC.
+ *
+ * Note that the PHY may be able to transform from one connection
+ * technology to another, so, eg, don't clear 1000BaseX just
+ * because the MAC is unable to BaseX mode. This is more about
+ * clearing unsupported speeds and duplex settings. The port modes
+ * should not be cleared; phylink_set_port_modes() will help with this.
+ *
+ * When @config->supported_interfaces has been set, phylink will iterate
+ * over the supported interfaces to determine the full capability of the
+ * MAC. The validation function must not print errors if @state->interface
+ * is set to an unexpected value.
+ *
+ * When @config->supported_interfaces is empty, phylink will call this
+ * function with @state->interface set to %PHY_INTERFACE_MODE_NA, and
+ * expects the MAC driver to return all supported link modes.
+ *
+ * If the @state->interface mode is not supported, then the @supported
+ * mask must be cleared.
+ *
+ * This member is optional; if not set, the generic validator will be
+ * used making use of @config->mac_capabilities and
+ * @config->supported_interfaces to determine which link modes are
+ * supported.
+ */
+void validate(struct phylink_config *config, unsigned long *supported,
+	      struct phylink_link_state *state);
+/**
  * mac_get_caps: Get MAC capabilities for interface mode.
  * @config: a pointer to a &struct phylink_config.
  * @interface: PHY interface mode.
--- linux-qcom-6.8.0.orig/include/linux/platform_data/x86/asus-wmi.h
+++ linux-qcom-6.8.0/include/linux/platform_data/x86/asus-wmi.h
@@ -64,6 +64,7 @@
 #define ASUS_WMI_DEVID_SCREENPAD_LIGHT	0x00050032
 #define ASUS_WMI_DEVID_FAN_BOOST_MODE	0x00110018
 #define ASUS_WMI_DEVID_THROTTLE_THERMAL_POLICY 0x00120075
+#define ASUS_WMI_DEVID_THROTTLE_THERMAL_POLICY_VIVO 0x00110019
 
 /* Misc */
 #define ASUS_WMI_DEVID_PANEL_OD		0x00050019
--- linux-qcom-6.8.0.orig/include/linux/pm_domain.h
+++ linux-qcom-6.8.0/include/linux/pm_domain.h
@@ -20,6 +20,33 @@
 #include <linux/time64.h>
 
 /*
+ * Flags to control the behaviour when attaching a device to its PM domains.
+ *
+ * PD_FLAG_NO_DEV_LINK:		As the default behaviour creates a device-link
+ *				for every PM domain that gets attached, this
+ *				flag can be used to skip that.
+ *
+ * PD_FLAG_DEV_LINK_ON:		Add the DL_FLAG_RPM_ACTIVE to power-on the
+ *				supplier and its PM domain when creating the
+ *				device-links.
+ *
+ */
+#define PD_FLAG_NO_DEV_LINK		BIT(0)
+#define PD_FLAG_DEV_LINK_ON		BIT(1)
+
+struct dev_pm_domain_attach_data {
+	const char * const *pd_names;
+	const u32 num_pd_names;
+	const u32 pd_flags;
+};
+
+struct dev_pm_domain_list {
+	struct device **pd_devs;
+	struct device_link **pd_links;
+	u32 num_pds;
+};
+
+/*
  * Flags to control the behaviour of a genpd.
  *
  * These flags may be set in the struct generic_pm_domain's flags field by a
@@ -65,6 +92,10 @@
  * GENPD_FLAG_OPP_TABLE_FW:	The genpd provider supports performance states,
  *				but its corresponding OPP tables are not
  *				described in DT, but are given directly by FW.
+ *
+ * GENPD_FLAG_DEV_NAME_FW:	Instructs genpd to generate an unique device name
+ *				using ida. It is used by genpd providers which
+ *				get their genpd-names directly from FW.
  */
 #define GENPD_FLAG_PM_CLK	 (1U << 0)
 #define GENPD_FLAG_IRQ_SAFE	 (1U << 1)
@@ -74,6 +105,7 @@
 #define GENPD_FLAG_RPM_ALWAYS_ON (1U << 5)
 #define GENPD_FLAG_MIN_RESIDENCY (1U << 6)
 #define GENPD_FLAG_OPP_TABLE_FW	 (1U << 7)
+#define GENPD_FLAG_DEV_NAME_FW	 (1U << 8)
 
 enum gpd_status {
 	GENPD_STATE_ON = 0,	/* PM domain is on */
@@ -136,6 +168,7 @@
 	atomic_t sd_count;	/* Number of subdomains with power "on" */
 	enum gpd_status status;	/* Current state of the domain */
 	unsigned int device_count;	/* Number of devices */
+	unsigned int device_id;		/* unique device id */
 	unsigned int suspended_count;	/* System suspend device counter */
 	unsigned int prepared_count;	/* Suspend counter of prepared devices */
 	unsigned int performance_state;	/* Aggregated max performance state */
@@ -233,6 +266,7 @@
 int pm_genpd_init(struct generic_pm_domain *genpd,
 		  struct dev_power_governor *gov, bool is_off);
 int pm_genpd_remove(struct generic_pm_domain *genpd);
+struct device *dev_to_genpd_dev(struct device *dev);
 int dev_pm_genpd_set_performance_state(struct device *dev, unsigned int state);
 int dev_pm_genpd_add_notifier(struct device *dev, struct notifier_block *nb);
 int dev_pm_genpd_remove_notifier(struct device *dev);
@@ -280,6 +314,11 @@
 	return -EOPNOTSUPP;
 }
 
+static inline struct device *dev_to_genpd_dev(struct device *dev)
+{
+	return ERR_PTR(-EOPNOTSUPP);
+}
+
 static inline int dev_pm_genpd_set_performance_state(struct device *dev,
 						     unsigned int state)
 {
@@ -420,7 +459,11 @@
 					  unsigned int index);
 struct device *dev_pm_domain_attach_by_name(struct device *dev,
 					    const char *name);
+int dev_pm_domain_attach_list(struct device *dev,
+			      const struct dev_pm_domain_attach_data *data,
+			      struct dev_pm_domain_list **list);
 void dev_pm_domain_detach(struct device *dev, bool power_off);
+void dev_pm_domain_detach_list(struct dev_pm_domain_list *list);
 int dev_pm_domain_start(struct device *dev);
 void dev_pm_domain_set(struct device *dev, struct dev_pm_domain *pd);
 int dev_pm_domain_set_performance_state(struct device *dev, unsigned int state);
@@ -439,7 +482,14 @@
 {
 	return NULL;
 }
+static inline int dev_pm_domain_attach_list(struct device *dev,
+				const struct dev_pm_domain_attach_data *data,
+				struct dev_pm_domain_list **list)
+{
+	return 0;
+}
 static inline void dev_pm_domain_detach(struct device *dev, bool power_off) {}
+static inline void dev_pm_domain_detach_list(struct dev_pm_domain_list *list) {}
 static inline int dev_pm_domain_start(struct device *dev)
 {
 	return 0;
--- linux-qcom-6.8.0.orig/include/linux/pm_opp.h
+++ linux-qcom-6.8.0/include/linux/pm_opp.h
@@ -193,6 +193,7 @@
 void dev_pm_opp_remove_table(struct device *dev);
 void dev_pm_opp_cpumask_remove_table(const struct cpumask *cpumask);
 int dev_pm_opp_sync_regulators(struct device *dev);
+int dev_pm_opp_set_level(struct device *dev, unsigned int level);
 #else
 static inline struct opp_table *dev_pm_opp_get_opp_table(struct device *dev)
 {
@@ -441,6 +442,11 @@
 {
 	return -EOPNOTSUPP;
 }
+
+static inline int dev_pm_opp_set_level(struct device *dev, unsigned int level)
+{
+	return -EOPNOTSUPP;
+}
 
 #endif		/* CONFIG_PM_OPP */
 
--- linux-qcom-6.8.0.orig/include/linux/pm_runtime.h
+++ linux-qcom-6.8.0/include/linux/pm_runtime.h
@@ -72,7 +72,8 @@
 extern int __pm_runtime_idle(struct device *dev, int rpmflags);
 extern int __pm_runtime_suspend(struct device *dev, int rpmflags);
 extern int __pm_runtime_resume(struct device *dev, int rpmflags);
-extern int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count);
+extern int pm_runtime_get_if_active(struct device *dev);
+extern int pm_runtime_get_if_in_use(struct device *dev);
 extern int pm_schedule_suspend(struct device *dev, unsigned int delay);
 extern int __pm_runtime_set_status(struct device *dev, unsigned int status);
 extern int pm_runtime_barrier(struct device *dev);
@@ -95,18 +96,6 @@
 extern int devm_pm_runtime_enable(struct device *dev);
 
 /**
- * pm_runtime_get_if_in_use - Conditionally bump up runtime PM usage counter.
- * @dev: Target device.
- *
- * Increment the runtime PM usage counter of @dev if its runtime PM status is
- * %RPM_ACTIVE and its runtime PM usage counter is greater than 0.
- */
-static inline int pm_runtime_get_if_in_use(struct device *dev)
-{
-	return pm_runtime_get_if_active(dev, false);
-}
-
-/**
  * pm_suspend_ignore_children - Set runtime PM behavior regarding children.
  * @dev: Target device.
  * @enable: Whether or not to ignore possible dependencies on children.
@@ -275,8 +264,7 @@
 {
 	return -EINVAL;
 }
-static inline int pm_runtime_get_if_active(struct device *dev,
-					   bool ign_usage_count)
+static inline int pm_runtime_get_if_active(struct device *dev)
 {
 	return -EINVAL;
 }
--- linux-qcom-6.8.0.orig/include/linux/pnp.h
+++ linux-qcom-6.8.0/include/linux/pnp.h
@@ -435,8 +435,6 @@
 #define protocol_for_each_dev(protocol, dev)	\
 	list_for_each_entry(dev, &(protocol)->devices, protocol_list)
 
-extern const struct bus_type pnp_bus_type;
-
 #if defined(CONFIG_PNP)
 
 /* device management */
--- linux-qcom-6.8.0.orig/include/linux/poll.h
+++ linux-qcom-6.8.0/include/linux/poll.h
@@ -14,11 +14,7 @@
 
 /* ~832 bytes of stack space used max in sys_select/sys_poll before allocating
    additional memory. */
-#ifdef __clang__
-#define MAX_STACK_ALLOC 768
-#else
 #define MAX_STACK_ALLOC 832
-#endif
 #define FRONTEND_STACK_ALLOC	256
 #define SELECT_STACK_ALLOC	FRONTEND_STACK_ALLOC
 #define POLL_STACK_ALLOC	FRONTEND_STACK_ALLOC
@@ -45,8 +41,16 @@
 
 static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address, poll_table *p)
 {
-	if (p && p->_qproc && wait_address)
+	if (p && p->_qproc && wait_address) {
 		p->_qproc(filp, wait_address, p);
+		/*
+		 * This memory barrier is paired in the wq_has_sleeper().
+		 * See the comment above prepare_to_wait(), we need to
+		 * ensure that subsequent tests in this thread can't be
+		 * reordered with __add_wait_queue() in _qproc() paths.
+		 */
+		smp_mb();
+	}
 }
 
 /*
--- linux-qcom-6.8.0.orig/include/linux/preempt.h
+++ linux-qcom-6.8.0/include/linux/preempt.h
@@ -481,4 +481,45 @@
 DEFINE_LOCK_GUARD_0(preempt_notrace, preempt_disable_notrace(), preempt_enable_notrace())
 DEFINE_LOCK_GUARD_0(migrate, migrate_disable(), migrate_enable())
 
+#ifdef CONFIG_PREEMPT_DYNAMIC
+
+extern bool preempt_model_none(void);
+extern bool preempt_model_voluntary(void);
+extern bool preempt_model_full(void);
+
+#else
+
+static inline bool preempt_model_none(void)
+{
+	return IS_ENABLED(CONFIG_PREEMPT_NONE);
+}
+static inline bool preempt_model_voluntary(void)
+{
+	return IS_ENABLED(CONFIG_PREEMPT_VOLUNTARY);
+}
+static inline bool preempt_model_full(void)
+{
+	return IS_ENABLED(CONFIG_PREEMPT);
+}
+
+#endif
+
+static inline bool preempt_model_rt(void)
+{
+	return IS_ENABLED(CONFIG_PREEMPT_RT);
+}
+
+/*
+ * Does the preemption model allow non-cooperative preemption?
+ *
+ * For !CONFIG_PREEMPT_DYNAMIC kernels this is an exact match with
+ * CONFIG_PREEMPTION; for CONFIG_PREEMPT_DYNAMIC this doesn't work as the
+ * kernel is *built* with CONFIG_PREEMPTION=y but may run with e.g. the
+ * PREEMPT_NONE model.
+ */
+static inline bool preempt_model_preemptible(void)
+{
+	return preempt_model_full() || preempt_model_rt();
+}
+
 #endif /* __LINUX_PREEMPT_H */
--- linux-qcom-6.8.0.orig/include/linux/printk.h
+++ linux-qcom-6.8.0/include/linux/printk.h
@@ -126,7 +126,7 @@
 #define no_printk(fmt, ...)				\
 ({							\
 	if (0)						\
-		printk(fmt, ##__VA_ARGS__);		\
+		_printk(fmt, ##__VA_ARGS__);		\
 	0;						\
 })
 
@@ -273,6 +273,8 @@
 }
 #endif
 
+bool this_cpu_in_panic(void);
+
 #ifdef CONFIG_SMP
 extern int __printk_cpu_sync_try_get(void);
 extern void __printk_cpu_sync_wait(void);
--- linux-qcom-6.8.0.orig/include/linux/profile.h
+++ linux-qcom-6.8.0/include/linux/profile.h
@@ -11,7 +11,6 @@
 
 #define CPU_PROFILING	1
 #define SCHED_PROFILING	2
-#define SLEEP_PROFILING	3
 #define KVM_PROFILING	4
 
 struct proc_dir_entry;
--- linux-qcom-6.8.0.orig/include/linux/property.h
+++ linux-qcom-6.8.0/include/linux/property.h
@@ -12,6 +12,7 @@
 
 #include <linux/args.h>
 #include <linux/bits.h>
+#include <linux/cleanup.h>
 #include <linux/fwnode.h>
 #include <linux/stddef.h>
 #include <linux/types.h>
@@ -181,6 +182,11 @@
 	for (child = device_get_next_child_node(dev, NULL); child;	\
 	     child = device_get_next_child_node(dev, child))
 
+#define device_for_each_child_node_scoped(dev, child)			\
+	for (struct fwnode_handle *child __free(fwnode_handle) =	\
+		device_get_next_child_node(dev, NULL);			\
+	     child; child = device_get_next_child_node(dev, child))
+
 struct fwnode_handle *fwnode_get_named_child_node(const struct fwnode_handle *fwnode,
 						  const char *childname);
 struct fwnode_handle *device_get_named_child_node(const struct device *dev,
@@ -189,6 +195,8 @@
 struct fwnode_handle *fwnode_handle_get(struct fwnode_handle *fwnode);
 void fwnode_handle_put(struct fwnode_handle *fwnode);
 
+DEFINE_FREE(fwnode_handle, struct fwnode_handle *, fwnode_handle_put(_T))
+
 int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index);
 int fwnode_irq_get_byname(const struct fwnode_handle *fwnode, const char *name);
 
--- linux-qcom-6.8.0.orig/include/linux/pruss_driver.h
+++ linux-qcom-6.8.0/include/linux/pruss_driver.h
@@ -144,32 +144,32 @@
 static inline int pruss_cfg_get_gpmux(struct pruss *pruss,
 				      enum pruss_pru_id pru_id, u8 *mux)
 {
-	return ERR_PTR(-EOPNOTSUPP);
+	return -EOPNOTSUPP;
 }
 
 static inline int pruss_cfg_set_gpmux(struct pruss *pruss,
 				      enum pruss_pru_id pru_id, u8 mux)
 {
-	return ERR_PTR(-EOPNOTSUPP);
+	return -EOPNOTSUPP;
 }
 
 static inline int pruss_cfg_gpimode(struct pruss *pruss,
 				    enum pruss_pru_id pru_id,
 				    enum pruss_gpi_mode mode)
 {
-	return ERR_PTR(-EOPNOTSUPP);
+	return -EOPNOTSUPP;
 }
 
 static inline int pruss_cfg_miirt_enable(struct pruss *pruss, bool enable)
 {
-	return ERR_PTR(-EOPNOTSUPP);
+	return -EOPNOTSUPP;
 }
 
 static inline int pruss_cfg_xfr_enable(struct pruss *pruss,
 				       enum pru_type pru_type,
-				       bool enable);
+				       bool enable)
 {
-	return ERR_PTR(-EOPNOTSUPP);
+	return -EOPNOTSUPP;
 }
 
 #endif /* CONFIG_TI_PRUSS */
--- linux-qcom-6.8.0.orig/include/linux/pse-pd/pse.h
+++ linux-qcom-6.8.0/include/linux/pse-pd/pse.h
@@ -114,14 +114,14 @@
 					 struct netlink_ext_ack *extack,
 					 struct pse_control_status *status)
 {
-	return -ENOTSUPP;
+	return -EOPNOTSUPP;
 }
 
 static inline int pse_ethtool_set_config(struct pse_control *psec,
 					 struct netlink_ext_ack *extack,
 					 const struct pse_control_config *config)
 {
-	return -ENOTSUPP;
+	return -EOPNOTSUPP;
 }
 
 #endif
--- linux-qcom-6.8.0.orig/include/linux/pwm.h
+++ linux-qcom-6.8.0/include/linux/pwm.h
@@ -271,7 +271,6 @@
  * @id: unique number of this PWM chip
  * @npwm: number of PWMs controlled by this chip
  * @of_xlate: request a PWM device given a device tree PWM specifier
- * @of_pwm_n_cells: number of cells expected in the device tree PWM specifier
  * @atomic: can the driver's ->apply() be called in atomic context
  * @pwms: array of PWM devices allocated by the framework
  */
@@ -284,13 +283,17 @@
 
 	struct pwm_device * (*of_xlate)(struct pwm_chip *chip,
 					const struct of_phandle_args *args);
-	unsigned int of_pwm_n_cells;
 	bool atomic;
 
 	/* only used internally by the PWM framework */
 	struct pwm_device *pwms;
 };
 
+static inline struct device *pwmchip_parent(const struct pwm_chip *chip)
+{
+	return chip->dev;
+}
+
 #if IS_ENABLED(CONFIG_PWM)
 /* PWM user APIs */
 int pwm_apply_might_sleep(struct pwm_device *pwm, const struct pwm_state *state);
--- linux-qcom-6.8.0.orig/include/linux/pwrseq/consumer.h
+++ linux-qcom-6.8.0/include/linux/pwrseq/consumer.h
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2024 Linaro Ltd.
+ */
+
+#ifndef __POWER_SEQUENCING_CONSUMER_H__
+#define __POWER_SEQUENCING_CONSUMER_H__
+
+#include <linux/err.h>
+
+struct device;
+struct pwrseq_desc;
+
+#if IS_ENABLED(CONFIG_POWER_SEQUENCING)
+
+struct pwrseq_desc * __must_check
+pwrseq_get(struct device *dev, const char *target);
+void pwrseq_put(struct pwrseq_desc *desc);
+
+struct pwrseq_desc * __must_check
+devm_pwrseq_get(struct device *dev, const char *target);
+
+int pwrseq_power_on(struct pwrseq_desc *desc);
+int pwrseq_power_off(struct pwrseq_desc *desc);
+
+#else /* CONFIG_POWER_SEQUENCING */
+
+static inline struct pwrseq_desc * __must_check
+pwrseq_get(struct device *dev, const char *target)
+{
+	return ERR_PTR(-ENOSYS);
+}
+
+static inline void pwrseq_put(struct pwrseq_desc *desc)
+{
+}
+
+static inline struct pwrseq_desc * __must_check
+devm_pwrseq_get(struct device *dev, const char *target)
+{
+	return ERR_PTR(-ENOSYS);
+}
+
+static inline int pwrseq_power_on(struct pwrseq_desc *desc)
+{
+	return -ENOSYS;
+}
+
+static inline int pwrseq_power_off(struct pwrseq_desc *desc)
+{
+	return -ENOSYS;
+}
+
+#endif /* CONFIG_POWER_SEQUENCING */
+
+#endif /* __POWER_SEQUENCING_CONSUMER_H__ */
--- linux-qcom-6.8.0.orig/include/linux/pwrseq/provider.h
+++ linux-qcom-6.8.0/include/linux/pwrseq/provider.h
@@ -0,0 +1,75 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2024 Linaro Ltd.
+ */
+
+#ifndef __POWER_SEQUENCING_PROVIDER_H__
+#define __POWER_SEQUENCING_PROVIDER_H__
+
+struct device;
+struct module;
+struct pwrseq_device;
+
+typedef int (*pwrseq_power_state_func)(struct pwrseq_device *);
+typedef int (*pwrseq_match_func)(struct pwrseq_device *, struct device *);
+
+/**
+ * struct pwrseq_unit_data - Configuration of a single power sequencing
+ *                           unit.
+ * @name: Name of the unit.
+ * @deps: Units that must be enabled before this one and disabled after it
+ *        in the order they come in this array. Must be NULL-terminated.
+ * @enable: Callback running the part of the power-on sequence provided by
+ *          this unit.
+ * @disable: Callback running the part of the power-off sequence provided
+ *           by this unit.
+ */
+struct pwrseq_unit_data {
+	const char *name;
+	const struct pwrseq_unit_data **deps;
+	pwrseq_power_state_func enable;
+	pwrseq_power_state_func disable;
+};
+
+/**
+ * struct pwrseq_target_data - Configuration of a power sequencing target.
+ * @name: Name of the target.
+ * @unit: Final unit that this target must reach in order to be considered
+ *        enabled.
+ * @post_enable: Callback run after the target unit has been enabled, *after*
+ *               the state lock has been released. It's useful for implementing
+ *               boot-up delays without blocking other users from powering up
+ *               using the same power sequencer.
+ */
+struct pwrseq_target_data {
+	const char *name;
+	const struct pwrseq_unit_data *unit;
+	pwrseq_power_state_func post_enable;
+};
+
+/**
+ * struct pwrseq_config - Configuration used for registering a new provider.
+ * @parent: Parent device for the sequencer. Must be set.
+ * @owner: Module providing this device.
+ * @drvdata: Private driver data.
+ * @match: Provider callback used to match the consumer device to the sequencer.
+ * @targets: Array of targets for this power sequencer. Must be NULL-terminated.
+ */
+struct pwrseq_config {
+	struct device *parent;
+	struct module *owner;
+	void *drvdata;
+	pwrseq_match_func match;
+	const struct pwrseq_target_data **targets;
+};
+
+struct pwrseq_device *
+pwrseq_device_register(const struct pwrseq_config *config);
+void pwrseq_device_unregister(struct pwrseq_device *pwrseq);
+struct pwrseq_device *
+devm_pwrseq_device_register(struct device *dev,
+			    const struct pwrseq_config *config);
+
+void *pwrseq_device_get_drvdata(struct pwrseq_device *pwrseq);
+
+#endif /* __POWER_SEQUENCING_PROVIDER_H__ */
--- linux-qcom-6.8.0.orig/include/linux/qcom-dma-mapping.h
+++ linux-qcom-6.8.0/include/linux/qcom-dma-mapping.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ & Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/*
+ * DMA_ATTR_NO_DELAYED_UNMAP: Used by msm specific lazy mapping to indicate
+ * that the mapping can be freed on unmap, rather than when the ion_buffer
+ * is freed.
+ */
+#define DMA_ATTR_NO_DELAYED_UNMAP	(1UL << 13)
+/*
+ * When passed to a DMA map call the DMA_ATTR_FORCE_COHERENT DMA
+ * attribute can be used to force a buffer to be mapped as IO coherent.
+ */
+#define DMA_ATTR_FORCE_COHERENT			(1UL << 15)
+/*
+ * When passed to a DMA map call the DMA_ATTR_FORCE_NON_COHERENT DMA
+ * attribute can be used to force a buffer to not be mapped as IO
+ * coherent.
+ */
+#define DMA_ATTR_FORCE_NON_COHERENT		(1UL << 16)
+/*
+ * DMA_ATTR_DELAYED_UNMAP: Used by ION, it will ensure that mappings are not
+ * removed on unmap but instead are removed when the ion_buffer is freed.
+ */
+#define DMA_ATTR_DELAYED_UNMAP		(1UL << 17)
+/*
+ * DMA_ATTR_QTI_SMMU_PROXY_MAP : Map this buffer in the TVM SMMU if supported
+ * on the target.
+ */
+#define DMA_ATTR_QTI_SMMU_PROXY_MAP	(1UL << 18)
+
+#ifndef DMA_ATTR_SYS_CACHE
+/* Attributes are not supported, so render them ineffective. */
+#define DMA_ATTR_SYS_CACHE		(0UL)
+#define DMA_ATTR_SYS_CACHE_NWA		(0UL)
+#endif
--- linux-qcom-6.8.0.orig/include/linux/qcom_dma_heap.h
+++ linux-qcom-6.8.0/include/linux/qcom_dma_heap.h
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _QCOM_DMA_HEAP_H
+#define _QCOM_DMA_HEAP_H
+
+#include <linux/bits.h>
+#include <linux/bitfield.h>
+#include <linux/dma-buf.h>
+
+#include <linux/qcom_dma_heap_dt_constants.h>
+#include <linux/err.h>
+
+/* Heap flags */
+#define QCOM_DMA_HEAP_FLAG_CACHED	BIT(1)
+
+#define QCOM_DMA_HEAP_FLAG_CP_TRUSTED_VM		BIT(15)
+#define QCOM_DMA_HEAP_FLAG_CP_TZ		BIT(16)
+#define QCOM_DMA_HEAP_FLAG_CP_TOUCH		BIT(17)
+#define QCOM_DMA_HEAP_FLAG_CP_BITSTREAM		BIT(18)
+#define QCOM_DMA_HEAP_FLAG_CP_PIXEL		BIT(19)
+#define QCOM_DMA_HEAP_FLAG_CP_NON_PIXEL		BIT(20)
+#define QCOM_DMA_HEAP_FLAG_CP_CAMERA		BIT(21)
+#define QCOM_DMA_HEAP_FLAG_CP_HLOS		BIT(22)
+#define QCOM_DMA_HEAP_FLAG_CP_SPSS_SP		BIT(23)
+#define QCOM_DMA_HEAP_FLAG_CP_SPSS_SP_SHARED	BIT(24)
+#define QCOM_DMA_HEAP_FLAG_CP_SEC_DISPLAY	BIT(25)
+#define QCOM_DMA_HEAP_FLAG_CP_APP		BIT(26)
+#define QCOM_DMA_HEAP_FLAG_CP_CAMERA_PREVIEW	BIT(27)
+#define QCOM_DMA_HEAP_FLAG_CP_MSS_MSA		BIT(28)
+#define QCOM_DMA_HEAP_FLAG_CP_CDSP		BIT(29)
+#define QCOM_DMA_HEAP_FLAG_CP_SPSS_HLOS_SHARED	BIT(30)
+
+#define QCOM_DMA_HEAP_FLAGS_CP_MASK	GENMASK(30, 15)
+
+#define QCOM_DMA_HEAP_FLAG_SECURE	BIT(31)
+
+bool qcom_is_dma_buf_file(struct file *file);
+
+struct dma_buf_heap_prefetch_region {
+	u64 size;
+	struct dma_heap *heap;
+};
+
+int qcom_secure_system_heap_prefetch(struct dma_buf_heap_prefetch_region *regions,
+				     size_t nr_regions);
+
+int qcom_secure_system_heap_drain(struct dma_buf_heap_prefetch_region *regions,
+				  size_t nr_regions);
+
+/**
+ * dma_buf_heap_hyp_assign - wrapper function for hyp-assigning a dma_buf
+ * @buf:		dma_buf to hyp-assign away from HLOS
+ * @dest_vmids:		array of QCOM_DMA_HEAP_FLAG VMIDs (as defined above)
+ * @dest_perms:		array of PERM_READ/PERM_WRITE/PERM_EXEC permission bits (as
+ *			defined in include/soc/qcom/secure_buffer.h), such that
+ *			dest_perms[i] specifies the permissions for VMID dest_vmids[i]
+ * @dest_nelems:	number of elements in dest_vmids and dest_perms
+ *
+ * Return: Temporarily return -EINVAL whilst the functon isn't present. Otherwise, return
+ * 0 on success, or a negative value returned by hyp_assign_table() on failure.
+ */
+static inline int dma_buf_heap_hyp_assign(struct dma_buf *buf, int *dest_vmids, int *dest_perms,
+				   int dest_nelems)
+{
+	return -EINVAL;
+}
+
+/**
+ * dma_buf_heap_hyp_unassign - wrapper function that hyp-assigns a dma_buf back to HLOS
+ * @buf:	dma_buf to hyp-assign back to HLOS
+ *
+ * This function takes a dma_buf, and re-assigns it to HLOS with RWX permissions (at the
+ * S2 level). The end-points to which the buffer was assigned to are tracked by the flags
+ * kept in the msm_heap_helper_buffer->flags field (the helper_buffer is accesed through
+ * dma_buf->priv), so the corresponding VMIDs don't need to be supplied as arguments.
+ *
+ * Return: Temporarily return -EINVAL whilst the functon isn't present. Otherwise, return
+ * 0 on success, or a negative value returned by hyp_assign_table() on failure.
+ */
+static inline int dma_buf_heap_hyp_unassign(struct dma_buf *buf)
+{
+	return -EINVAL;
+}
+
+#endif /* _QCOM_DMA_HEAP_H */
--- linux-qcom-6.8.0.orig/include/linux/qcom_dma_heap_dt_constants.h
+++ linux-qcom-6.8.0/include/linux/qcom_dma_heap_dt_constants.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _QCOM_DMA_HEAP_DT_CONSTATS_H
+#define _QCOM_DMA_HEAP_DT_CONSTATS_H
+
+#define HEAP_TYPE_SECURE_CARVEOUT 0
+#define HEAP_TYPE_CARVEOUT 1
+#define HEAP_TYPE_CMA 2
+#define HEAP_TYPE_TUI_CARVEOUT 3
+
+#endif /* _QCOM_DMA_HEAP_DT_CONSTATS_H */
--- linux-qcom-6.8.0.orig/include/linux/qtee_shmbridge.h
+++ linux-qcom-6.8.0/include/linux/qtee_shmbridge.h
@@ -0,0 +1,155 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __QTEE_SHMBRIDGE_H__
+#define __QTEE_SHMBRIDGE_H__
+
+/**
+ * struct qtee_shm - info of shared memory allocated from the default bridge
+ * @ paddr: physical address of the shm allocated from the default bridge
+ * @ vaddr: virtual address of the shm
+ * @ size: size of the shm
+ */
+struct qtee_shm {
+	phys_addr_t paddr;
+	void *vaddr;
+	size_t size;
+};
+
+#ifdef CONFIG_QTEE_SHM_BRIDGE
+/**
+ * Register paddr & size as a bridge, get bridge handle
+ *
+ * @ [IN] paddr: physical addr of the buffer to be turned into bridge
+ * @ [IN] size: size of the bridge
+ * @ [IN] ns_vmid_list: non-secure vmids array
+ * @ [IN] ns_vm_perm_list: NS VM permission array
+ * @ [IN] ns_vmid_num: number of NS VMIDs (at most 4)
+ * @ [IN] tz_perm: TZ permission
+ * @ [OUT] *handle: output shmbridge handle
+ *
+ * return success or error
+ */
+int32_t qtee_shmbridge_register(
+		phys_addr_t paddr,
+		size_t size,
+		uint32_t *ns_vmid_list,
+		uint32_t *ns_vm_perm_list,
+		uint32_t ns_vmid_num,
+		uint32_t tz_perm,
+		uint64_t *handle);
+
+
+/**
+ * Check whether shmbridge mechanism is enabled in HYP or not
+ *
+ * return true when enabled, false when not enabled
+ */
+bool qtee_shmbridge_is_enabled(void);
+
+/**
+ * Check whether a bridge starting from paddr exists
+ *
+ * @ [IN] paddr: physical addr of the buffer
+ *
+ * return 0 or -EEXIST
+ */
+int32_t qtee_shmbridge_query(phys_addr_t paddr);
+
+/**
+ * Deregister bridge
+ *
+ * @ [IN] handle: shmbridge handle
+ *
+ * return success or error
+ */
+int32_t qtee_shmbridge_deregister(uint64_t handle);
+
+/**
+ * Sub-allocate from default kernel bridge created by shmb driver
+ *
+ * @ [IN] size: size of the buffer to be sub-allocated from the bridge
+ * @ [OUT] *shm: output qtee_shm structure with buffer paddr, vaddr and size;
+ * returns ERR_PTR or NULL otherwise return success or error
+ *
+ * Note: This will allocate a cached buffer, so after a client allocates a
+ * bridge buffer, it need to first flush cache with
+ * "qtee_shmbridge_flush_shm_buf" before invoke scm_call to TZ, and then
+ * invalidate cache with "qtee_shmbridge_inv_shm_buf" after scm_call return.
+ */
+int32_t qtee_shmbridge_allocate_shm(size_t size, struct qtee_shm *shm);
+
+/*
+ * Free buffer that is sub-allocated from default kernel bridge
+ *
+ * @ [IN] shm: qtee_shm structure to be freed
+ *
+ */
+void qtee_shmbridge_free_shm(struct qtee_shm *shm);
+
+/*
+ * cache clean operation for buffer sub-allocated from default bridge
+ *
+ * @ [IN] shm: qtee_shm, its cache to be cleaned
+ *
+ */
+void qtee_shmbridge_flush_shm_buf(struct qtee_shm *shm);
+
+/*
+ * cache invalidation operation for buffer sub-allocated from default bridge
+ *
+ * @ [IN] shm: qtee_shm, its cache to be invalidated
+ *
+ */
+void qtee_shmbridge_inv_shm_buf(struct qtee_shm *shm);
+
+#else
+static int32_t qtee_shmbridge_register(
+		phys_addr_t paddr,
+		size_t size,
+		uint32_t *ns_vmid_list,
+		uint32_t *ns_vm_perm_list,
+		uint32_t ns_vmid_num,
+		uint32_t tz_perm,
+		uint64_t *handle)
+{
+	return -EINVAL;
+}
+
+static bool qtee_shmbridge_is_enabled(void)
+{
+	return false;
+}
+
+static int32_t qtee_shmbridge_allocate_shm(size_t size, struct qtee_shm *shm)
+{
+	return -EINVAL;
+}
+
+static void qtee_shmbridge_free_shm(struct qtee_shm *shm)
+{
+}
+
+static void qtee_shmbridge_flush_shm_buf(struct qtee_shm *shm)
+{
+}
+
+static void qtee_shmbridge_inv_shm_buf(struct qtee_shm *shm)
+{
+}
+
+static int32_t qtee_shmbridge_query(phys_addr_t paddr)
+{
+	return -EINVAL;
+}
+
+static int32_t qtee_shmbridge_deregister(uint64_t handle)
+{
+	return -EINVAL;
+}
+
+#endif
+
+#endif /*__QTEE_SHMBRIDGE_H__*/
--- linux-qcom-6.8.0.orig/include/linux/qti-smmu-proxy-callbacks.h
+++ linux-qcom-6.8.0/include/linux/qti-smmu-proxy-callbacks.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __SMMU_PROXY_CALLBACKS_H_
+#define __SMMU_PROXY_CALLBACKS_H_
+
+typedef int (*smmu_proxy_map_sgtable)(struct device *client_dev, struct sg_table *table,
+				      struct dma_buf *dmabuf);
+
+typedef void (*smmu_proxy_unmap_sgtable)(struct device *client_dev, struct sg_table *table,
+					 struct dma_buf *dmabuf);
+
+struct smmu_proxy_callbacks {
+	smmu_proxy_map_sgtable map_sgtable;
+	smmu_proxy_unmap_sgtable unmap_sgtable;
+};
+
+int qti_smmu_proxy_register_callbacks(smmu_proxy_map_sgtable map_sgtable_fn_ptr,
+				      smmu_proxy_unmap_sgtable unmap_sgtable_fn_ptr);
+
+#endif /* __SMMU_PROXY_CALLBACKS_H_ */
--- linux-qcom-6.8.0.orig/include/linux/randomize_kstack.h
+++ linux-qcom-6.8.0/include/linux/randomize_kstack.h
@@ -80,7 +80,7 @@
 	if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT,	\
 				&randomize_kstack_offset)) {		\
 		u32 offset = raw_cpu_read(kstack_offset);		\
-		offset ^= (rand);					\
+		offset = ror32(offset, 5) ^ (rand);			\
 		raw_cpu_write(kstack_offset, offset);			\
 	}								\
 } while (0)
--- linux-qcom-6.8.0.orig/include/linux/rcupdate.h
+++ linux-qcom-6.8.0/include/linux/rcupdate.h
@@ -184,9 +184,9 @@
 	do {									\
 		int ___rttq_nesting = READ_ONCE((t)->trc_reader_nesting);	\
 										\
-		if (likely(!READ_ONCE((t)->trc_reader_special.b.need_qs)) &&	\
+		if (unlikely(READ_ONCE((t)->trc_reader_special.b.need_qs) == TRC_NEED_QS) &&	\
 		    likely(!___rttq_nesting)) {					\
-			rcu_trc_cmpxchg_need_qs((t), 0,	TRC_NEED_QS_CHECKED);	\
+			rcu_trc_cmpxchg_need_qs((t), TRC_NEED_QS, TRC_NEED_QS_CHECKED);	\
 		} else if (___rttq_nesting && ___rttq_nesting != INT_MIN &&	\
 			   !READ_ONCE((t)->trc_reader_special.b.blocked)) {	\
 			rcu_tasks_trace_qs_blkd(t);				\
@@ -247,6 +247,37 @@
 	cond_resched(); \
 } while (0)
 
+/**
+ * rcu_softirq_qs_periodic - Report RCU and RCU-Tasks quiescent states
+ * @old_ts: jiffies at start of processing.
+ *
+ * This helper is for long-running softirq handlers, such as NAPI threads in
+ * networking. The caller should initialize the variable passed in as @old_ts
+ * at the beginning of the softirq handler. When invoked frequently, this macro
+ * will invoke rcu_softirq_qs() every 100 milliseconds thereafter, which will
+ * provide both RCU and RCU-Tasks quiescent states. Note that this macro
+ * modifies its old_ts argument.
+ *
+ * Because regions of code that have disabled softirq act as RCU read-side
+ * critical sections, this macro should be invoked with softirq (and
+ * preemption) enabled.
+ *
+ * The macro is not needed when CONFIG_PREEMPT_RT is defined. RT kernels would
+ * have more chance to invoke schedule() calls and provide necessary quiescent
+ * states. As a contrast, calling cond_resched() only won't achieve the same
+ * effect because cond_resched() does not provide RCU-Tasks quiescent states.
+ */
+#define rcu_softirq_qs_periodic(old_ts) \
+do { \
+	if (!IS_ENABLED(CONFIG_PREEMPT_RT) && \
+	    time_after(jiffies, (old_ts) + HZ / 10)) { \
+		preempt_disable(); \
+		rcu_softirq_qs(); \
+		preempt_enable(); \
+		(old_ts) = jiffies; \
+	} \
+} while (0)
+
 /*
  * Infrastructure to implement the synchronize_() primitives in
  * TREE_RCU and rcu_barrier_() primitives in TINY_RCU.
@@ -362,7 +393,7 @@
  */
 #define RCU_LOCKDEP_WARN(c, s)						\
 	do {								\
-		static bool __section(".data.unlikely") __warned;	\
+		static bool __section(".data..unlikely") __warned;	\
 		if (debug_lockdep_rcu_enabled() && (c) &&		\
 		    debug_lockdep_rcu_enabled() && !__warned) {		\
 			__warned = true;				\
--- linux-qcom-6.8.0.orig/include/linux/rcutiny.h
+++ linux-qcom-6.8.0/include/linux/rcutiny.h
@@ -111,6 +111,11 @@
 	kvfree(ptr);
 }
 
+static inline void kvfree_rcu_barrier(void)
+{
+	rcu_barrier();
+}
+
 #ifdef CONFIG_KASAN_GENERIC
 void kvfree_call_rcu(struct rcu_head *head, void *ptr);
 #else
--- linux-qcom-6.8.0.orig/include/linux/rcutree.h
+++ linux-qcom-6.8.0/include/linux/rcutree.h
@@ -35,6 +35,7 @@
 
 void synchronize_rcu_expedited(void);
 void kvfree_call_rcu(struct rcu_head *head, void *ptr);
+void kvfree_rcu_barrier(void);
 
 void rcu_barrier(void);
 void rcu_momentary_dyntick_idle(void);
--- linux-qcom-6.8.0.orig/include/linux/regmap.h
+++ linux-qcom-6.8.0/include/linux/regmap.h
@@ -1225,6 +1225,7 @@
 int regmap_raw_write_async(struct regmap *map, unsigned int reg,
 			   const void *val, size_t val_len);
 int regmap_read(struct regmap *map, unsigned int reg, unsigned int *val);
+int regmap_read_bypassed(struct regmap *map, unsigned int reg, unsigned int *val);
 int regmap_raw_read(struct regmap *map, unsigned int reg,
 		    void *val, size_t val_len);
 int regmap_noinc_read(struct regmap *map, unsigned int reg,
@@ -1732,6 +1733,13 @@
 {
 	WARN_ONCE(1, "regmap API is disabled");
 	return -EINVAL;
+}
+
+static inline int regmap_read_bypassed(struct regmap *map, unsigned int reg,
+				       unsigned int *val)
+{
+	WARN_ONCE(1, "regmap API is disabled");
+	return -EINVAL;
 }
 
 static inline int regmap_raw_read(struct regmap *map, unsigned int reg,
--- linux-qcom-6.8.0.orig/include/linux/regulator/consumer.h
+++ linux-qcom-6.8.0/include/linux/regulator/consumer.h
@@ -320,13 +320,13 @@
 
 static inline int devm_regulator_get_enable(struct device *dev, const char *id)
 {
-	return -ENODEV;
+	return 0;
 }
 
 static inline int devm_regulator_get_enable_optional(struct device *dev,
 						     const char *id)
 {
-	return -ENODEV;
+	return 0;
 }
 
 static inline struct regulator *__must_check
@@ -443,6 +443,14 @@
 {
 	return 0;
 }
+
+static inline int devm_regulator_bulk_get_const(
+	struct device *dev, int num_consumers,
+	const struct regulator_bulk_data *in_consumers,
+	struct regulator_bulk_data **out_consumers)
+{
+	return 0;
+}
 
 static inline int regulator_bulk_enable(int num_consumers,
 					struct regulator_bulk_data *consumers)
--- linux-qcom-6.8.0.orig/include/linux/regulator/debug-regulator.h
+++ linux-qcom-6.8.0/include/linux/regulator/debug-regulator.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _LINUX_REGULATOR_DEBUG_CONTROL_H_
+#define _LINUX_REGULATOR_DEBUG_CONTROL_H_
+
+struct device;
+struct regulator_dev;
+
+#if IS_ENABLED(CONFIG_REGULATOR_DEBUG_CONTROL)
+
+int regulator_debug_register(struct device *dev, struct regulator_dev *rdev);
+void regulator_debug_unregister(struct regulator_dev *rdev);
+int devm_regulator_debug_register(struct device *dev,
+				  struct regulator_dev *rdev);
+void devm_regulator_debug_unregister(struct regulator_dev *rdev);
+
+#else
+
+static inline int regulator_debug_register(struct device *dev,
+					   struct regulator_dev *rdev)
+{ return 0; }
+static inline void regulator_debug_unregister(struct regulator_dev *rdev)
+{ }
+static inline int devm_regulator_debug_register(struct device *dev,
+						struct regulator_dev *rdev)
+{ return 0; }
+static inline void devm_regulator_debug_unregister(struct regulator_dev *rdev)
+{ }
+
+#endif
+#endif
--- linux-qcom-6.8.0.orig/include/linux/regulator/driver.h
+++ linux-qcom-6.8.0/include/linux/regulator/driver.h
@@ -299,6 +299,8 @@
  * @vsel_range_reg: Register for range selector when using pickable ranges
  *		    and ``regulator_map_*_voltage_*_pickable`` functions.
  * @vsel_range_mask: Mask for register bitfield used for range selector
+ * @range_applied_by_vsel: A flag to indicate that changes to vsel_range_reg
+ *			   are only effective after vsel_reg is written
  * @vsel_reg: Register for selector when using ``regulator_map_*_voltage_*``
  * @vsel_mask: Mask for register bitfield used for selector
  * @vsel_step: Specify the resolution of selector stepping when setting
@@ -389,6 +391,7 @@
 
 	unsigned int vsel_range_reg;
 	unsigned int vsel_range_mask;
+	bool range_applied_by_vsel;
 	unsigned int vsel_reg;
 	unsigned int vsel_mask;
 	unsigned int vsel_step;
--- linux-qcom-6.8.0.orig/include/linux/regulator/proxy-consumer.h
+++ linux-qcom-6.8.0/include/linux/regulator/proxy-consumer.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _LINUX_REGULATOR_PROXY_CONSUMER_H_
+#define _LINUX_REGULATOR_PROXY_CONSUMER_H_
+
+#include <linux/device.h>
+#include <linux/of.h>
+
+#if IS_ENABLED(CONFIG_REGULATOR_PROXY_CONSUMER)
+
+int regulator_proxy_consumer_register(struct device *dev,
+				      struct device_node *node);
+void regulator_proxy_consumer_unregister(struct device *dev);
+int devm_regulator_proxy_consumer_register(struct device *dev,
+				      struct device_node *node);
+void devm_regulator_proxy_consumer_unregister(struct device *dev);
+void regulator_proxy_consumer_sync_state(struct device *dev);
+
+#else
+
+static inline int regulator_proxy_consumer_register(struct device *dev,
+						    struct device_node *node)
+{ return 0; }
+static inline void regulator_proxy_consumer_unregister(struct device *dev)
+{ }
+static inline int devm_regulator_proxy_consumer_register(struct device *dev,
+						    struct device_node *node)
+{ return 0; }
+static inline void devm_regulator_proxy_consumer_unregister(struct device *dev)
+{ }
+void regulator_proxy_consumer_sync_state(struct device *dev)
+{ }
+
+#endif
+#endif
--- linux-qcom-6.8.0.orig/include/linux/ring_buffer.h
+++ linux-qcom-6.8.0/include/linux/ring_buffer.h
@@ -98,7 +98,9 @@
 	__ring_buffer_alloc((size), (flags), &__key);	\
 })
 
-int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full);
+typedef bool (*ring_buffer_cond_fn)(void *data);
+int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full,
+		     ring_buffer_cond_fn cond, void *data);
 __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu,
 			  struct file *filp, poll_table *poll_table, int full);
 void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu);
--- linux-qcom-6.8.0.orig/include/linux/rwbase_rt.h
+++ linux-qcom-6.8.0/include/linux/rwbase_rt.h
@@ -26,12 +26,17 @@
 	} while (0)
 
 
-static __always_inline bool rw_base_is_locked(struct rwbase_rt *rwb)
+static __always_inline bool rw_base_is_locked(const struct rwbase_rt *rwb)
 {
 	return atomic_read(&rwb->readers) != READER_BIAS;
 }
 
-static __always_inline bool rw_base_is_contended(struct rwbase_rt *rwb)
+static inline void rw_base_assert_held_write(const struct rwbase_rt *rwb)
+{
+	WARN_ON(atomic_read(&rwb->readers) != WRITER_BIAS);
+}
+
+static __always_inline bool rw_base_is_contended(const struct rwbase_rt *rwb)
 {
 	return atomic_read(&rwb->readers) > 0;
 }
--- linux-qcom-6.8.0.orig/include/linux/rwsem.h
+++ linux-qcom-6.8.0/include/linux/rwsem.h
@@ -66,14 +66,24 @@
 #endif
 };
 
-/* In all implementations count != 0 means locked */
+#define RWSEM_UNLOCKED_VALUE		0UL
+#define RWSEM_WRITER_LOCKED		(1UL << 0)
+#define __RWSEM_COUNT_INIT(name)	.count = ATOMIC_LONG_INIT(RWSEM_UNLOCKED_VALUE)
+
 static inline int rwsem_is_locked(struct rw_semaphore *sem)
 {
-	return atomic_long_read(&sem->count) != 0;
+	return atomic_long_read(&sem->count) != RWSEM_UNLOCKED_VALUE;
 }
 
-#define RWSEM_UNLOCKED_VALUE		0L
-#define __RWSEM_COUNT_INIT(name)	.count = ATOMIC_LONG_INIT(RWSEM_UNLOCKED_VALUE)
+static inline void rwsem_assert_held_nolockdep(const struct rw_semaphore *sem)
+{
+	WARN_ON(atomic_long_read(&sem->count) == RWSEM_UNLOCKED_VALUE);
+}
+
+static inline void rwsem_assert_held_write_nolockdep(const struct rw_semaphore *sem)
+{
+	WARN_ON(!(atomic_long_read(&sem->count) & RWSEM_WRITER_LOCKED));
+}
 
 /* Common initializer macros and functions */
 
@@ -152,11 +162,21 @@
 	__init_rwsem((sem), #sem, &__key);			\
 } while (0)
 
-static __always_inline int rwsem_is_locked(struct rw_semaphore *sem)
+static __always_inline int rwsem_is_locked(const struct rw_semaphore *sem)
 {
 	return rw_base_is_locked(&sem->rwbase);
 }
 
+static inline void rwsem_assert_held_nolockdep(const struct rw_semaphore *sem)
+{
+	WARN_ON(!rwsem_is_locked(sem));
+}
+
+static inline void rwsem_assert_held_write_nolockdep(const struct rw_semaphore *sem)
+{
+	rw_base_assert_held_write(sem);
+}
+
 static __always_inline int rwsem_is_contended(struct rw_semaphore *sem)
 {
 	return rw_base_is_contended(&sem->rwbase);
@@ -169,6 +189,22 @@
  * the RT specific variant.
  */
 
+static inline void rwsem_assert_held(const struct rw_semaphore *sem)
+{
+	if (IS_ENABLED(CONFIG_LOCKDEP))
+		lockdep_assert_held(sem);
+	else
+		rwsem_assert_held_nolockdep(sem);
+}
+
+static inline void rwsem_assert_held_write(const struct rw_semaphore *sem)
+{
+	if (IS_ENABLED(CONFIG_LOCKDEP))
+		lockdep_assert_held_write(sem);
+	else
+		rwsem_assert_held_write_nolockdep(sem);
+}
+
 /*
  * lock for reading
  */
--- linux-qcom-6.8.0.orig/include/linux/sbitmap.h
+++ linux-qcom-6.8.0/include/linux/sbitmap.h
@@ -36,6 +36,11 @@
 	 * @cleared: word holding cleared bits
 	 */
 	unsigned long cleared ____cacheline_aligned_in_smp;
+
+	/**
+	 * @swap_lock: serializes simultaneous updates of ->word and ->cleared
+	 */
+	raw_spinlock_t swap_lock;
 } ____cacheline_aligned_in_smp;
 
 /**
--- linux-qcom-6.8.0.orig/include/linux/scatterlist.h
+++ linux-qcom-6.8.0/include/linux/scatterlist.h
@@ -313,7 +313,7 @@
 }
 
 /**
- * sg_unmark_bus_address - Unmark the scatterlist entry as a bus address
+ * sg_dma_unmark_bus_address - Unmark the scatterlist entry as a bus address
  * @sg:		 SG entry
  *
  * Description:
--- linux-qcom-6.8.0.orig/include/linux/sched.h
+++ linux-qcom-6.8.0/include/linux/sched.h
@@ -637,6 +637,8 @@
 	 *
 	 * @dl_overrun tells if the task asked to be informed about runtime
 	 * overruns.
+	 *
+	 * @dl_server tells if this is a server entity.
 	 */
 	unsigned int			dl_throttled      : 1;
 	unsigned int			dl_yielded        : 1;
@@ -858,6 +860,8 @@
 	u8				rcu_tasks_idx;
 	int				rcu_tasks_idle_cpu;
 	struct list_head		rcu_tasks_holdout_list;
+	int				rcu_tasks_exit_cpu;
+	struct list_head		rcu_tasks_exit_list;
 #endif /* #ifdef CONFIG_TASKS_RCU */
 
 #ifdef CONFIG_TASKS_TRACE_RCU
@@ -1581,8 +1585,9 @@
 	 * We're lying here, but rather than expose a completely new task state
 	 * to userspace, we can make this appear as if the task has gone through
 	 * a regular rt_mutex_lock() call.
+	 * Report frozen tasks as uninterruptible.
 	 */
-	if (tsk_state & TASK_RTLOCK_WAIT)
+	if ((tsk_state & TASK_RTLOCK_WAIT) || (tsk_state & TASK_FROZEN))
 		state = TASK_UNINTERRUPTIBLE;
 
 	return fls(state);
@@ -2056,47 +2061,6 @@
 	__cond_resched_rwlock_write(lock);					\
 })
 
-#ifdef CONFIG_PREEMPT_DYNAMIC
-
-extern bool preempt_model_none(void);
-extern bool preempt_model_voluntary(void);
-extern bool preempt_model_full(void);
-
-#else
-
-static inline bool preempt_model_none(void)
-{
-	return IS_ENABLED(CONFIG_PREEMPT_NONE);
-}
-static inline bool preempt_model_voluntary(void)
-{
-	return IS_ENABLED(CONFIG_PREEMPT_VOLUNTARY);
-}
-static inline bool preempt_model_full(void)
-{
-	return IS_ENABLED(CONFIG_PREEMPT);
-}
-
-#endif
-
-static inline bool preempt_model_rt(void)
-{
-	return IS_ENABLED(CONFIG_PREEMPT_RT);
-}
-
-/*
- * Does the preemption model allow non-cooperative preemption?
- *
- * For !CONFIG_PREEMPT_DYNAMIC kernels this is an exact match with
- * CONFIG_PREEMPTION; for CONFIG_PREEMPT_DYNAMIC this doesn't work as the
- * kernel is *built* with CONFIG_PREEMPTION=y but may run with e.g. the
- * PREEMPT_NONE model.
- */
-static inline bool preempt_model_preemptible(void)
-{
-	return preempt_model_full() || preempt_model_rt();
-}
-
 static __always_inline bool need_resched(void)
 {
 	return unlikely(tif_need_resched());
--- linux-qcom-6.8.0.orig/include/linux/sched/task_stack.h
+++ linux-qcom-6.8.0/include/linux/sched/task_stack.h
@@ -9,6 +9,7 @@
 #include <linux/sched.h>
 #include <linux/magic.h>
 #include <linux/refcount.h>
+#include <linux/kasan.h>
 
 #ifdef CONFIG_THREAD_INFO_IN_TASK
 
@@ -89,6 +90,7 @@
 {
 	void *stack = task_stack_page(current);
 
+	obj = kasan_reset_tag(obj);
 	return (obj >= stack) && (obj < (stack + THREAD_SIZE));
 }
 
--- linux-qcom-6.8.0.orig/include/linux/sched/vhost_task.h
+++ linux-qcom-6.8.0/include/linux/sched/vhost_task.h
@@ -4,7 +4,8 @@
 
 struct vhost_task;
 
-struct vhost_task *vhost_task_create(bool (*fn)(void *), void *arg,
+struct vhost_task *vhost_task_create(bool (*fn)(void *),
+				     void (*handle_kill)(void *), void *arg,
 				     const char *name);
 void vhost_task_start(struct vhost_task *vtsk);
 void vhost_task_stop(struct vhost_task *vtsk);
--- linux-qcom-6.8.0.orig/include/linux/screen_info.h
+++ linux-qcom-6.8.0/include/linux/screen_info.h
@@ -4,6 +4,142 @@
 
 #include <uapi/linux/screen_info.h>
 
+#include <linux/bits.h>
+
+/**
+ * SCREEN_INFO_MAX_RESOURCES - maximum number of resources per screen_info
+ */
+#define SCREEN_INFO_MAX_RESOURCES	3
+
+struct pci_dev;
+struct resource;
+
+static inline bool __screen_info_has_lfb(unsigned int type)
+{
+	return (type == VIDEO_TYPE_VLFB) || (type == VIDEO_TYPE_EFI);
+}
+
+static inline u64 __screen_info_lfb_base(const struct screen_info *si)
+{
+	u64 lfb_base = si->lfb_base;
+
+	if (si->capabilities & VIDEO_CAPABILITY_64BIT_BASE)
+		lfb_base |= (u64)si->ext_lfb_base << 32;
+
+	return lfb_base;
+}
+
+static inline void __screen_info_set_lfb_base(struct screen_info *si, u64 lfb_base)
+{
+	si->lfb_base = lfb_base & GENMASK_ULL(31, 0);
+	si->ext_lfb_base = (lfb_base & GENMASK_ULL(63, 32)) >> 32;
+
+	if (si->ext_lfb_base)
+		si->capabilities |= VIDEO_CAPABILITY_64BIT_BASE;
+	else
+		si->capabilities &= ~VIDEO_CAPABILITY_64BIT_BASE;
+}
+
+static inline u64 __screen_info_lfb_size(const struct screen_info *si, unsigned int type)
+{
+	u64 lfb_size = si->lfb_size;
+
+	if (type == VIDEO_TYPE_VLFB)
+		lfb_size <<= 16;
+	return lfb_size;
+}
+
+static inline unsigned int __screen_info_video_type(unsigned int type)
+{
+	switch (type) {
+	case VIDEO_TYPE_MDA:
+	case VIDEO_TYPE_CGA:
+	case VIDEO_TYPE_EGAM:
+	case VIDEO_TYPE_EGAC:
+	case VIDEO_TYPE_VGAC:
+	case VIDEO_TYPE_VLFB:
+	case VIDEO_TYPE_PICA_S3:
+	case VIDEO_TYPE_MIPS_G364:
+	case VIDEO_TYPE_SGI:
+	case VIDEO_TYPE_TGAC:
+	case VIDEO_TYPE_SUN:
+	case VIDEO_TYPE_SUNPCI:
+	case VIDEO_TYPE_PMAC:
+	case VIDEO_TYPE_EFI:
+		return type;
+	default:
+		return 0;
+	}
+}
+
+/**
+ * screen_info_video_type() - Decodes the video type from struct screen_info
+ * @si: an instance of struct screen_info
+ *
+ * Returns:
+ * A VIDEO_TYPE_ constant representing si's type of video display, or 0 otherwise.
+ */
+static inline unsigned int screen_info_video_type(const struct screen_info *si)
+{
+	unsigned int type;
+
+	// check if display output is on
+	if (!si->orig_video_isVGA)
+		return 0;
+
+	// check for a known VIDEO_TYPE_ constant
+	type = __screen_info_video_type(si->orig_video_isVGA);
+	if (type)
+		return si->orig_video_isVGA;
+
+	// check if text mode has been initialized
+	if (!si->orig_video_lines || !si->orig_video_cols)
+		return 0;
+
+	// 80x25 text, mono
+	if (si->orig_video_mode == 0x07) {
+		if ((si->orig_video_ega_bx & 0xff) != 0x10)
+			return VIDEO_TYPE_EGAM;
+		else
+			return VIDEO_TYPE_MDA;
+	}
+
+	// EGA/VGA, 16 colors
+	if ((si->orig_video_ega_bx & 0xff) != 0x10) {
+		if (si->orig_video_isVGA)
+			return VIDEO_TYPE_VGAC;
+		else
+			return VIDEO_TYPE_EGAC;
+	}
+
+	// the rest...
+	return VIDEO_TYPE_CGA;
+}
+
+ssize_t screen_info_resources(const struct screen_info *si, struct resource *r, size_t num);
+
+#if defined(CONFIG_PCI)
+void screen_info_apply_fixups(void);
+struct pci_dev *screen_info_pci_dev(const struct screen_info *si);
+#else
+static inline void screen_info_apply_fixups(void)
+{ }
+static inline struct pci_dev *screen_info_pci_dev(const struct screen_info *si)
+{
+	return NULL;
+}
+#endif
+
 extern struct screen_info screen_info;
 
+static inline bool __screen_info_vbe_mode_nonvga(const struct screen_info *si)
+{
+	/*
+	 * VESA modes typically run on VGA hardware. Set bit 5 signals that this
+	 * is not the case. Drivers can then not make use of VGA resources. See
+	 * Sec 4.4 of the VBE 2.0 spec.
+	 */
+	return si->vesa_attributes & BIT(5);
+}
+
 #endif /* _SCREEN_INFO_H */
--- linux-qcom-6.8.0.orig/include/linux/seccomp.h
+++ linux-qcom-6.8.0/include/linux/seccomp.h
@@ -50,10 +50,10 @@
 
 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
 static inline int secure_computing(void) { return 0; }
-static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
 #else
 static inline void secure_computing_strict(int this_syscall) { return; }
 #endif
+static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
 
 static inline long prctl_get_seccomp(void)
 {
--- linux-qcom-6.8.0.orig/include/linux/secretmem.h
+++ linux-qcom-6.8.0/include/linux/secretmem.h
@@ -13,10 +13,10 @@
 	/*
 	 * Using folio_mapping() is quite slow because of the actual call
 	 * instruction.
-	 * We know that secretmem pages are not compound and LRU so we can
+	 * We know that secretmem pages are not compound, so we can
 	 * save a couple of cycles here.
 	 */
-	if (folio_test_large(folio) || !folio_test_lru(folio))
+	if (folio_test_large(folio))
 		return false;
 
 	mapping = (struct address_space *)
--- linux-qcom-6.8.0.orig/include/linux/security.h
+++ linux-qcom-6.8.0/include/linux/security.h
@@ -33,6 +33,10 @@
 #include <linux/mm.h>
 #include <linux/sockptr.h>
 #include <uapi/linux/lsm.h>
+#include <linux/lsm/selinux.h>
+#include <linux/lsm/smack.h>
+#include <linux/lsm/apparmor.h>
+#include <linux/lsm/bpf.h>
 
 struct linux_binprm;
 struct cred;
@@ -139,8 +143,31 @@
 	LOCKDOWN_CONFIDENTIALITY_MAX,
 };
 
+/*
+ * A "security context" is the text representation of
+ * the information used by LSMs.
+ * This structure contains the string, its length, and which LSM
+ * it is useful for.
+ */
+struct lsmcontext {
+	char	*context;	/* Provided by the module */
+	u32	len;
+	int	id;		/* Identifies the module */
+};
+
+/*
+ * Data exported by the security modules
+ */
+struct lsmblob {
+	struct lsmblob_selinux selinux;
+	struct lsmblob_smack smack;
+	struct lsmblob_apparmor apparmor;
+	struct lsmblob_bpf bpf;
+};
+
 extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1];
 extern u32 lsm_active_cnt;
+extern u32 lsm_blob_cnt;
 extern const struct lsm_id *lsm_idlist[];
 
 /* These functions are in security/commoncap.c */
@@ -256,6 +283,30 @@
 	return kernel_load_data_str[id];
 }
 
+/**
+ * lsmblob_is_set - report if there is a value in the lsmblob
+ * @blob: Pointer to the exported LSM data
+ *
+ * Returns true if there is a value set, false otherwise
+ */
+static inline bool lsmblob_is_set(struct lsmblob *blob)
+{
+	const struct lsmblob empty = {};
+
+	return !!memcmp(blob, &empty, sizeof(*blob));
+}
+
+/**
+ * lsmblob_init - initialize a lsmblob structure
+ * @blob: Pointer to the data to initialize
+ *
+ * Set all secid for all modules to the specified value.
+ */
+static inline void lsmblob_init(struct lsmblob *blob)
+{
+	memset(blob, 0, sizeof(*blob));
+}
+
 #ifdef CONFIG_SECURITY
 
 int call_blocking_lsm_notifier(enum lsm_event event, void *data);
@@ -266,6 +317,8 @@
 extern int security_init(void);
 extern int early_security_init(void);
 extern u64 lsm_name_to_attr(const char *name);
+extern u64 lsm_name_to_id(const char *name);
+extern const char *lsm_id_to_name(u64 id);
 
 /* Security operations */
 int security_binder_set_context_mgr(const struct cred *mgr);
@@ -327,8 +380,8 @@
 int security_move_mount(const struct path *from_path, const struct path *to_path);
 int security_dentry_init_security(struct dentry *dentry, int mode,
 				  const struct qstr *name,
-				  const char **xattr_name, void **ctx,
-				  u32 *ctxlen);
+				  const char **xattr_name,
+				  struct lsmcontext *lsmcxt);
 int security_dentry_create_files_as(struct dentry *dentry, int mode,
 					struct qstr *name,
 					const struct cred *old,
@@ -385,7 +438,7 @@
 			       void **buffer, bool alloc);
 int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
 int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
-void security_inode_getsecid(struct inode *inode, u32 *secid);
+void security_inode_getlsmblob(struct inode *inode, struct lsmblob *blob);
 int security_inode_copy_up(struct dentry *src, struct cred **new);
 int security_inode_copy_up_xattr(const char *name);
 int security_kernfs_init_security(struct kernfs_node *kn_dir,
@@ -416,6 +469,7 @@
 int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
 void security_transfer_creds(struct cred *new, const struct cred *old);
 void security_cred_getsecid(const struct cred *c, u32 *secid);
+void security_cred_getlsmblob(const struct cred *c, struct lsmblob *blob);
 int security_kernel_act_as(struct cred *new, u32 secid);
 int security_kernel_create_files_as(struct cred *new, struct inode *inode);
 int security_kernel_module_request(char *kmod_name);
@@ -435,8 +489,8 @@
 int security_task_setpgid(struct task_struct *p, pid_t pgid);
 int security_task_getpgid(struct task_struct *p);
 int security_task_getsid(struct task_struct *p);
-void security_current_getsecid_subj(u32 *secid);
-void security_task_getsecid_obj(struct task_struct *p, u32 *secid);
+void security_current_getlsmblob_subj(struct lsmblob *blob);
+void security_task_getlsmblob_obj(struct task_struct *p, struct lsmblob *blob);
 int security_task_setnice(struct task_struct *p, int nice);
 int security_task_setioprio(struct task_struct *p, int ioprio);
 int security_task_getioprio(struct task_struct *p);
@@ -454,7 +508,7 @@
 void security_task_to_inode(struct task_struct *p, struct inode *inode);
 int security_create_user_ns(const struct cred *cred);
 int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
-void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid);
+void security_ipc_getlsmblob(struct kern_ipc_perm *ipcp, struct lsmblob *blob);
 int security_msg_msg_alloc(struct msg_msg *msg);
 void security_msg_msg_free(struct msg_msg *msg);
 int security_msg_queue_alloc(struct kern_ipc_perm *msq);
@@ -478,23 +532,26 @@
 			unsigned nsops, int alter);
 void security_d_instantiate(struct dentry *dentry, struct inode *inode);
 int security_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
-			 size_t __user *size, u32 flags);
+			 u32 __user *size, u32 flags);
 int security_setselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
-			 size_t size, u32 flags);
+			 u32 size, u32 flags);
 int security_getprocattr(struct task_struct *p, int lsmid, const char *name,
 			 char **value);
 int security_setprocattr(int lsmid, const char *name, void *value, size_t size);
 int security_netlink_send(struct sock *sk, struct sk_buff *skb);
 int security_ismaclabel(const char *name);
-int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
+int security_secid_to_secctx(u32 secid, struct lsmcontext *cp);
+int security_lsmblob_to_secctx(struct lsmblob *blob, struct lsmcontext *cp,
+			       int lsmid);
 int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
-void security_release_secctx(char *secdata, u32 seclen);
+void security_release_secctx(struct lsmcontext *cp);
 void security_inode_invalidate_secctx(struct inode *inode);
 int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
-int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
+int security_inode_getsecctx(struct inode *inode, struct lsmcontext *cp);
 int security_locked_down(enum lockdown_reason what);
-int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, size_t *uctx_len,
+int security_lock_kernel_down(const char *where, enum lockdown_reason level);
+int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
 		      void *val, size_t val_len, u64 id, u64 flags);
 #else /* CONFIG_SECURITY */
 
@@ -518,6 +575,16 @@
 	return LSM_ATTR_UNDEF;
 }
 
+static inline u64 lsm_name_to_id(const char *name)
+{
+	return LSM_ID_UNDEF;
+}
+
+static inline const char *lsm_id_to_name(u64 id)
+{
+	return NULL;
+}
+
 static inline void security_free_mnt_opts(void **mnt_opts)
 {
 }
@@ -768,8 +835,7 @@
 						 int mode,
 						 const struct qstr *name,
 						 const char **xattr_name,
-						 void **ctx,
-						 u32 *ctxlen)
+						 struct lsmcontext *lsmcxt)
 {
 	return -EOPNOTSUPP;
 }
@@ -964,9 +1030,10 @@
 	return 0;
 }
 
-static inline void security_inode_getsecid(struct inode *inode, u32 *secid)
+static inline void security_inode_getlsmblob(struct inode *inode,
+					     struct lsmblob *blob)
 {
-	*secid = 0;
+	lsmblob_init(blob);
 }
 
 static inline int security_inode_copy_up(struct dentry *src, struct cred **new)
@@ -1101,6 +1168,12 @@
 	*secid = 0;
 }
 
+static inline void security_cred_getlsmblob(const struct cred *c,
+					    struct lsmblob *blob)
+{
+	lsmblob_init(blob);
+}
+
 static inline int security_kernel_act_as(struct cred *cred, u32 secid)
 {
 	return 0;
@@ -1178,14 +1251,15 @@
 	return 0;
 }
 
-static inline void security_current_getsecid_subj(u32 *secid)
+static inline void security_current_getlsmblob_subj(struct lsmblob *blob)
 {
-	*secid = 0;
+	lsmblob_init(blob);
 }
 
-static inline void security_task_getsecid_obj(struct task_struct *p, u32 *secid)
+static inline void security_task_getlsmblob_obj(struct task_struct *p,
+						struct lsmblob *blob)
 {
-	*secid = 0;
+	lsmblob_init(blob);
 }
 
 static inline int security_task_setnice(struct task_struct *p, int nice)
@@ -1261,9 +1335,10 @@
 	return 0;
 }
 
-static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
+static inline void security_ipc_getlsmblob(struct kern_ipc_perm *ipcp,
+					   struct lsmblob *blob)
 {
-	*secid = 0;
+	lsmblob_init(blob);
 }
 
 static inline int security_msg_msg_alloc(struct msg_msg *msg)
@@ -1397,7 +1472,13 @@
 	return 0;
 }
 
-static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+static inline int security_secid_to_secctx(u32 secid, struct lsmcontext *cp)
+{
+	return -EOPNOTSUPP;
+}
+
+static inline int security_lsmblob_to_secctx(struct lsmblob *blob,
+					     struct lsmcontext *cp, int lsmid)
 {
 	return -EOPNOTSUPP;
 }
@@ -1409,7 +1490,7 @@
 	return -EOPNOTSUPP;
 }
 
-static inline void security_release_secctx(char *secdata, u32 seclen)
+static inline void security_release_secctx(struct lsmcontext *cp)
 {
 }
 
@@ -1425,7 +1506,8 @@
 {
 	return -EOPNOTSUPP;
 }
-static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
+static inline int security_inode_getsecctx(struct inode *inode,
+					   struct lsmcontext *cp)
 {
 	return -EOPNOTSUPP;
 }
@@ -1433,8 +1515,12 @@
 {
 	return 0;
 }
+static inline int security_lock_kernel_down(const char *where, enum lockdown_reason level)
+{
+	return 0;
+}
 static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx,
-				    size_t *uctx_len, void *val, size_t val_len,
+				    u32 *uctx_len, void *val, size_t val_len,
 				    u64 id, u64 flags)
 {
 	return -EOPNOTSUPP;
@@ -1988,15 +2074,17 @@
 
 #ifdef CONFIG_AUDIT
 #ifdef CONFIG_SECURITY
-int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);
+int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule,
+			     gfp_t gfp);
 int security_audit_rule_known(struct audit_krule *krule);
-int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule);
+int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
+			      void *lsmrule);
 void security_audit_rule_free(void *lsmrule);
 
 #else
 
 static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
-					   void **lsmrule)
+					   void **lsmrule, gfp_t gfp)
 {
 	return 0;
 }
@@ -2006,8 +2094,8 @@
 	return 0;
 }
 
-static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
-					    void *lsmrule)
+static inline int security_audit_rule_match(struct lsmblob *blob, u32 field,
+					    u32 op, void *lsmrule)
 {
 	return 0;
 }
@@ -2018,6 +2106,32 @@
 #endif /* CONFIG_SECURITY */
 #endif /* CONFIG_AUDIT */
 
+#if defined(CONFIG_IMA_LSM_RULES) && defined(CONFIG_SECURITY)
+int ima_filter_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule,
+			 int lsmid, gfp_t gfp);
+int ima_filter_rule_match(struct lsmblob *blob, u32 field, u32 op,
+			  void *lsmrule, int lsmid);
+void ima_filter_rule_free(void *lsmrule, int lsmid);
+
+#else
+
+static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr,
+				       void **lsmrule, int lsmid, gfp_t gfp)
+{
+	return 0;
+}
+
+static inline int ima_filter_rule_match(struct lsmblob *blob, u32 field, u32 op,
+					void *lsmrule, int lsmid)
+{
+	return 0;
+}
+
+static inline void ima_filter_rule_free(void *lsmrule, int lsmid)
+{ }
+
+#endif /* defined(CONFIG_IMA_LSM_RULES) && defined(CONFIG_SECURITY) */
+
 #ifdef CONFIG_SECURITYFS
 
 extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
--- linux-qcom-6.8.0.orig/include/linux/seqlock.h
+++ linux-qcom-6.8.0/include/linux/seqlock.h
@@ -637,6 +637,23 @@
 }
 
 /**
+ * read_seqcount_latch() - pick even/odd latch data copy
+ * @s: Pointer to seqcount_latch_t
+ *
+ * See write_seqcount_latch() for details and a full reader/writer usage
+ * example.
+ *
+ * Return: sequence counter raw value. Use the lowest bit as an index for
+ * picking which data copy to read. The full counter must then be checked
+ * with read_seqcount_latch_retry().
+ */
+static __always_inline unsigned read_seqcount_latch(const seqcount_latch_t *s)
+{
+	kcsan_atomic_next(KCSAN_SEQLOCK_REGION_MAX);
+	return raw_read_seqcount_latch(s);
+}
+
+/**
  * raw_read_seqcount_latch_retry() - end a seqcount_latch_t read section
  * @s:		Pointer to seqcount_latch_t
  * @start:	count, from raw_read_seqcount_latch()
@@ -651,8 +668,33 @@
 }
 
 /**
+ * read_seqcount_latch_retry() - end a seqcount_latch_t read section
+ * @s:		Pointer to seqcount_latch_t
+ * @start:	count, from read_seqcount_latch()
+ *
+ * Return: true if a read section retry is required, else false
+ */
+static __always_inline int
+read_seqcount_latch_retry(const seqcount_latch_t *s, unsigned start)
+{
+	kcsan_atomic_next(0);
+	return raw_read_seqcount_latch_retry(s, start);
+}
+
+/**
  * raw_write_seqcount_latch() - redirect latch readers to even/odd copy
  * @s: Pointer to seqcount_latch_t
+ */
+static __always_inline void raw_write_seqcount_latch(seqcount_latch_t *s)
+{
+	smp_wmb();	/* prior stores before incrementing "sequence" */
+	s->seqcount.sequence++;
+	smp_wmb();      /* increment "sequence" before following stores */
+}
+
+/**
+ * write_seqcount_latch_begin() - redirect latch readers to odd copy
+ * @s: Pointer to seqcount_latch_t
  *
  * The latch technique is a multiversion concurrency control method that allows
  * queries during non-atomic modifications. If you can guarantee queries never
@@ -680,17 +722,11 @@
  *
  *	void latch_modify(struct latch_struct *latch, ...)
  *	{
- *		smp_wmb();	// Ensure that the last data[1] update is visible
- *		latch->seq.sequence++;
- *		smp_wmb();	// Ensure that the seqcount update is visible
- *
+ *		write_seqcount_latch_begin(&latch->seq);
  *		modify(latch->data[0], ...);
- *
- *		smp_wmb();	// Ensure that the data[0] update is visible
- *		latch->seq.sequence++;
- *		smp_wmb();	// Ensure that the seqcount update is visible
- *
+ *		write_seqcount_latch(&latch->seq);
  *		modify(latch->data[1], ...);
+ *		write_seqcount_latch_end(&latch->seq);
  *	}
  *
  * The query will have a form like::
@@ -701,13 +737,13 @@
  *		unsigned seq, idx;
  *
  *		do {
- *			seq = raw_read_seqcount_latch(&latch->seq);
+ *			seq = read_seqcount_latch(&latch->seq);
  *
  *			idx = seq & 0x01;
  *			entry = data_query(latch->data[idx], ...);
  *
  *		// This includes needed smp_rmb()
- *		} while (raw_read_seqcount_latch_retry(&latch->seq, seq));
+ *		} while (read_seqcount_latch_retry(&latch->seq, seq));
  *
  *		return entry;
  *	}
@@ -731,11 +767,31 @@
  *	When data is a dynamic data structure; one should use regular RCU
  *	patterns to manage the lifetimes of the objects within.
  */
-static inline void raw_write_seqcount_latch(seqcount_latch_t *s)
+static __always_inline void write_seqcount_latch_begin(seqcount_latch_t *s)
 {
-	smp_wmb();	/* prior stores before incrementing "sequence" */
-	s->seqcount.sequence++;
-	smp_wmb();      /* increment "sequence" before following stores */
+	kcsan_nestable_atomic_begin();
+	raw_write_seqcount_latch(s);
+}
+
+/**
+ * write_seqcount_latch() - redirect latch readers to even copy
+ * @s: Pointer to seqcount_latch_t
+ */
+static __always_inline void write_seqcount_latch(seqcount_latch_t *s)
+{
+	raw_write_seqcount_latch(s);
+}
+
+/**
+ * write_seqcount_latch_end() - end a seqcount_latch_t write section
+ * @s:		Pointer to seqcount_latch_t
+ *
+ * Marks the end of a seqcount_latch_t writer section, after all copies of the
+ * latch-protected data have been updated.
+ */
+static __always_inline void write_seqcount_latch_end(seqcount_latch_t *s)
+{
+	kcsan_nestable_atomic_end();
 }
 
 #define __SEQLOCK_UNLOCKED(lockname)					\
@@ -769,11 +825,7 @@
  */
 static inline unsigned read_seqbegin(const seqlock_t *sl)
 {
-	unsigned ret = read_seqcount_begin(&sl->seqcount);
-
-	kcsan_atomic_next(0);  /* non-raw usage, assume closing read_seqretry() */
-	kcsan_flat_atomic_begin();
-	return ret;
+	return read_seqcount_begin(&sl->seqcount);
 }
 
 /**
@@ -789,12 +841,6 @@
  */
 static inline unsigned read_seqretry(const seqlock_t *sl, unsigned start)
 {
-	/*
-	 * Assume not nested: read_seqretry() may be called multiple times when
-	 * completing read critical section.
-	 */
-	kcsan_flat_atomic_end();
-
 	return read_seqcount_retry(&sl->seqcount, start);
 }
 
--- linux-qcom-6.8.0.orig/include/linux/serial_core.h
+++ linux-qcom-6.8.0/include/linux/serial_core.h
@@ -470,6 +470,7 @@
 	unsigned char		iotype;			/* io access style */
 	unsigned char		quirks;			/* internal quirks */
 
+#define UPIO_UNKNOWN		((unsigned char)~0U)	/* UCHAR_MAX */
 #define UPIO_PORT		(SERIAL_IO_PORT)	/* 8b I/O port access */
 #define UPIO_HUB6		(SERIAL_IO_HUB6)	/* Hub6 ISA card */
 #define UPIO_MEM		(SERIAL_IO_MEM)		/* driver-specific */
@@ -826,6 +827,24 @@
 })
 
 /**
+ * uart_port_tx_limited_flags -- transmit helper for uart_port with count limiting with flags
+ * @port: uart port
+ * @ch: variable to store a character to be written to the HW
+ * @flags: %UART_TX_NOSTOP or similar
+ * @count: a limit of characters to send
+ * @tx_ready: can HW accept more data function
+ * @put_char: function to write a character
+ * @tx_done: function to call after the loop is done
+ *
+ * See uart_port_tx_limited() for more details.
+ */
+#define uart_port_tx_limited_flags(port, ch, flags, count, tx_ready, put_char, tx_done) ({ \
+	unsigned int __count = (count);							   \
+	__uart_port_tx(port, ch, flags, tx_ready, put_char, tx_done, __count,		   \
+			__count--);							   \
+})
+
+/**
  * uart_port_tx -- transmit helper for uart_port
  * @port: uart port
  * @ch: variable to store a character to be written to the HW
@@ -959,6 +978,8 @@
 void uart_unregister_driver(struct uart_driver *uart);
 int uart_add_one_port(struct uart_driver *reg, struct uart_port *port);
 void uart_remove_one_port(struct uart_driver *reg, struct uart_port *port);
+int uart_read_port_properties(struct uart_port *port);
+int uart_read_and_validate_port_properties(struct uart_port *port);
 bool uart_match_port(const struct uart_port *port1,
 		const struct uart_port *port2);
 
--- linux-qcom-6.8.0.orig/include/linux/shmem_fs.h
+++ linux-qcom-6.8.0/include/linux/shmem_fs.h
@@ -37,7 +37,7 @@
 	unsigned int		fsflags;	/* for FS_IOC_[SG]ETFLAGS */
 	atomic_t		stop_eviction;	/* hold when working on inode */
 #ifdef CONFIG_TMPFS_QUOTA
-	struct dquot		*i_dquot[MAXQUOTAS];
+	struct dquot __rcu	*i_dquot[MAXQUOTAS];
 #endif
 	struct inode		vfs_inode;
 };
@@ -114,8 +114,17 @@
 extern void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end);
 int shmem_unuse(unsigned int type);
 
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
 extern bool shmem_is_huge(struct inode *inode, pgoff_t index, bool shmem_huge_force,
 			  struct mm_struct *mm, unsigned long vm_flags);
+#else
+static __always_inline bool shmem_is_huge(struct inode *inode, pgoff_t index, bool shmem_huge_force,
+					  struct mm_struct *mm, unsigned long vm_flags)
+{
+	return false;
+}
+#endif
+
 #ifdef CONFIG_SHMEM
 extern unsigned long shmem_swap_usage(struct vm_area_struct *vma);
 #else
--- linux-qcom-6.8.0.orig/include/linux/skbuff.h
+++ linux-qcom-6.8.0/include/linux/skbuff.h
@@ -697,6 +697,13 @@
 typedef unsigned char *sk_buff_data_t;
 #endif
 
+enum skb_tstamp_type {
+	SKB_CLOCK_REALTIME,
+	SKB_CLOCK_MONOTONIC,
+	SKB_CLOCK_TAI,
+	__SKB_CLOCK_MAX = SKB_CLOCK_TAI,
+};
+
 /**
  * DOC: Basic sk_buff geometry
  *
@@ -748,8 +755,6 @@
  *	@list: queue head
  *	@ll_node: anchor in an llist (eg socket defer_list)
  *	@sk: Socket we are owned by
- *	@ip_defrag_offset: (aka @sk) alternate use of @sk, used in
- *		fragmentation management
  *	@dev: Device we arrived on/are leaving by
  *	@dev_scratch: (aka @dev) alternate use of @dev when @dev would be %NULL
  *	@cb: Control buffer. Free for use by every layer. Put private vars here
@@ -816,10 +821,8 @@
  *	@dst_pending_confirm: need to confirm neighbour
  *	@decrypted: Decrypted SKB
  *	@slow_gro: state present at GRO time, slower prepare step required
- *	@mono_delivery_time: When set, skb->tstamp has the
- *		delivery_time in mono clock base (i.e. EDT).  Otherwise, the
- *		skb->tstamp has the (rcv) timestamp at ingress and
- *		delivery_time at egress.
+ *	@tstamp_type: When set, skb->tstamp has the
+ *		delivery_time clock base of skb->tstamp.
  *	@napi_id: id of the NAPI struct this skb came from
  *	@sender_cpu: (aka @napi_id) source CPU in XPS
  *	@alloc_cpu: CPU which did the skb allocation.
@@ -870,10 +873,7 @@
 		struct llist_node	ll_node;
 	};
 
-	union {
-		struct sock		*sk;
-		int			ip_defrag_offset;
-	};
+	struct sock		*sk;
 
 	union {
 		ktime_t		tstamp;
@@ -950,7 +950,7 @@
 	/* private: */
 	__u8			__mono_tc_offset[0];
 	/* public: */
-	__u8			mono_delivery_time:1;	/* See SKB_MONO_DELIVERY_TIME_MASK */
+	__u8			tstamp_type:2;	/* See skb_tstamp_type */
 #ifdef CONFIG_NET_XGRESS
 	__u8			tc_at_ingress:1;	/* See TC_AT_INGRESS_MASK */
 	__u8			tc_skip_classify:1;
@@ -1080,15 +1080,16 @@
 #endif
 #define PKT_TYPE_OFFSET		offsetof(struct sk_buff, __pkt_type_offset)
 
-/* if you move tc_at_ingress or mono_delivery_time
+/* if you move tc_at_ingress or tstamp_type
  * around, you also must adapt these constants.
  */
 #ifdef __BIG_ENDIAN_BITFIELD
-#define SKB_MONO_DELIVERY_TIME_MASK	(1 << 7)
-#define TC_AT_INGRESS_MASK		(1 << 6)
+#define SKB_TSTAMP_TYPE_MASK		(3 << 6)
+#define SKB_TSTAMP_TYPE_RSHIFT		(6)
+#define TC_AT_INGRESS_MASK		(1 << 5)
 #else
-#define SKB_MONO_DELIVERY_TIME_MASK	(1 << 0)
-#define TC_AT_INGRESS_MASK		(1 << 1)
+#define SKB_TSTAMP_TYPE_MASK		(3)
+#define TC_AT_INGRESS_MASK		(1 << 2)
 #endif
 #define SKB_BF_MONO_TC_OFFSET		offsetof(struct sk_buff, __mono_tc_offset)
 
@@ -1174,15 +1175,6 @@
 	return (skb->_skb_refdst & SKB_DST_NOREF) && skb_dst(skb);
 }
 
-/**
- * skb_rtable - Returns the skb &rtable
- * @skb: buffer
- */
-static inline struct rtable *skb_rtable(const struct sk_buff *skb)
-{
-	return (struct rtable *)skb_dst(skb);
-}
-
 /* For mangling skb->pkt_type from user space side from applications
  * such as nft, tc, etc, we only allow a conservative subset of
  * possible pkt_types to be set.
@@ -2642,6 +2634,8 @@
 void *skb_push(struct sk_buff *skb, unsigned int len);
 static inline void *__skb_push(struct sk_buff *skb, unsigned int len)
 {
+	DEBUG_NET_WARN_ON_ONCE(len > INT_MAX);
+
 	skb->data -= len;
 	skb->len  += len;
 	return skb->data;
@@ -2650,6 +2644,8 @@
 void *skb_pull(struct sk_buff *skb, unsigned int len);
 static inline void *__skb_pull(struct sk_buff *skb, unsigned int len)
 {
+	DEBUG_NET_WARN_ON_ONCE(len > INT_MAX);
+
 	skb->len -= len;
 	if (unlikely(skb->len < skb->data_len)) {
 #if defined(CONFIG_DEBUG_NET)
@@ -2674,6 +2670,8 @@
 static inline enum skb_drop_reason
 pskb_may_pull_reason(struct sk_buff *skb, unsigned int len)
 {
+	DEBUG_NET_WARN_ON_ONCE(len > INT_MAX);
+
 	if (likely(len <= skb_headlen(skb)))
 		return SKB_NOT_DROPPED_YET;
 
@@ -2846,6 +2844,11 @@
 	skb->inner_network_header += offset;
 }
 
+static inline bool skb_inner_network_header_was_set(const struct sk_buff *skb)
+{
+	return skb->inner_network_header > 0;
+}
+
 static inline unsigned char *skb_inner_mac_header(const struct sk_buff *skb)
 {
 	return skb->head + skb->inner_mac_header;
@@ -2966,6 +2969,21 @@
 	}
 }
 
+/* Move the full mac header up to current network_header.
+ * Leaves skb->data pointing at offset skb->mac_len into the mac_header.
+ * Must be provided the complete mac header length.
+ */
+static inline void skb_mac_header_rebuild_full(struct sk_buff *skb, u32 full_mac_len)
+{
+	if (skb_mac_header_was_set(skb)) {
+		const unsigned char *old_mac = skb_mac_header(skb);
+
+		skb_set_mac_header(skb, -full_mac_len);
+		memmove(skb_mac_header(skb), old_mac, full_mac_len);
+		__skb_push(skb, full_mac_len - skb->mac_len);
+	}
+}
+
 static inline int skb_checksum_start_offset(const struct sk_buff *skb)
 {
 	return skb->csum_start - skb_headroom(skb);
@@ -3449,6 +3467,16 @@
 bool napi_pp_put_page(struct page *page, bool napi_safe);
 
 static inline void
+skb_page_unref(const struct sk_buff *skb, struct page *page, bool napi_safe)
+{
+#ifdef CONFIG_PAGE_POOL
+	if (skb->pp_recycle && napi_pp_put_page(page, napi_safe))
+		return;
+#endif
+	put_page(page);
+}
+
+static inline void
 napi_frag_unref(skb_frag_t *frag, bool recycle, bool napi_safe)
 {
 	struct page *page = skb_frag_page(frag);
@@ -4172,7 +4200,7 @@
 static inline void __net_timestamp(struct sk_buff *skb)
 {
 	skb->tstamp = ktime_get_real();
-	skb->mono_delivery_time = 0;
+	skb->tstamp_type = SKB_CLOCK_REALTIME;
 }
 
 static inline ktime_t net_timedelta(ktime_t t)
@@ -4181,10 +4209,36 @@
 }
 
 static inline void skb_set_delivery_time(struct sk_buff *skb, ktime_t kt,
-					 bool mono)
+					 u8 tstamp_type)
 {
 	skb->tstamp = kt;
-	skb->mono_delivery_time = kt && mono;
+
+	if (kt)
+		skb->tstamp_type = tstamp_type;
+	else
+		skb->tstamp_type = SKB_CLOCK_REALTIME;
+}
+
+static inline void skb_set_delivery_type_by_clockid(struct sk_buff *skb,
+						    ktime_t kt, clockid_t clockid)
+{
+	u8 tstamp_type = SKB_CLOCK_REALTIME;
+
+	switch (clockid) {
+	case CLOCK_REALTIME:
+		break;
+	case CLOCK_MONOTONIC:
+		tstamp_type = SKB_CLOCK_MONOTONIC;
+		break;
+	case CLOCK_TAI:
+		tstamp_type = SKB_CLOCK_TAI;
+		break;
+	default:
+		WARN_ON_ONCE(1);
+		kt = 0;
+	}
+
+	skb_set_delivery_time(skb, kt, tstamp_type);
 }
 
 DECLARE_STATIC_KEY_FALSE(netstamp_needed_key);
@@ -4194,8 +4248,8 @@
  */
 static inline void skb_clear_delivery_time(struct sk_buff *skb)
 {
-	if (skb->mono_delivery_time) {
-		skb->mono_delivery_time = 0;
+	if (skb->tstamp_type) {
+		skb->tstamp_type = SKB_CLOCK_REALTIME;
 		if (static_branch_unlikely(&netstamp_needed_key))
 			skb->tstamp = ktime_get_real();
 		else
@@ -4205,7 +4259,7 @@
 
 static inline void skb_clear_tstamp(struct sk_buff *skb)
 {
-	if (skb->mono_delivery_time)
+	if (skb->tstamp_type)
 		return;
 
 	skb->tstamp = 0;
@@ -4213,7 +4267,7 @@
 
 static inline ktime_t skb_tstamp(const struct sk_buff *skb)
 {
-	if (skb->mono_delivery_time)
+	if (skb->tstamp_type)
 		return 0;
 
 	return skb->tstamp;
@@ -4221,7 +4275,7 @@
 
 static inline ktime_t skb_tstamp_cond(const struct sk_buff *skb, bool cond)
 {
-	if (!skb->mono_delivery_time && skb->tstamp)
+	if (skb->tstamp_type != SKB_CLOCK_MONOTONIC && skb->tstamp)
 		return skb->tstamp;
 
 	if (static_branch_unlikely(&netstamp_needed_key) || cond)
--- linux-qcom-6.8.0.orig/include/linux/skmsg.h
+++ linux-qcom-6.8.0/include/linux/skmsg.h
@@ -313,17 +313,22 @@
 	kfree_skb(skb);
 }
 
-static inline void sk_psock_queue_msg(struct sk_psock *psock,
+static inline bool sk_psock_queue_msg(struct sk_psock *psock,
 				      struct sk_msg *msg)
 {
+	bool ret;
+
 	spin_lock_bh(&psock->ingress_lock);
-	if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
+	if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
 		list_add_tail(&msg->list, &psock->ingress_msg);
-	else {
+		ret = true;
+	} else {
 		sk_msg_free(psock->sk, msg);
 		kfree(msg);
+		ret = false;
 	}
 	spin_unlock_bh(&psock->ingress_lock);
+	return ret;
 }
 
 static inline struct sk_msg *sk_psock_dequeue_msg(struct sk_psock *psock)
@@ -461,10 +466,12 @@
 
 static inline void sk_psock_data_ready(struct sock *sk, struct sk_psock *psock)
 {
+	read_lock_bh(&sk->sk_callback_lock);
 	if (psock->saved_data_ready)
 		psock->saved_data_ready(sk);
 	else
 		sk->sk_data_ready(sk);
+	read_unlock_bh(&sk->sk_callback_lock);
 }
 
 static inline void psock_set_prog(struct bpf_prog **pprog,
--- linux-qcom-6.8.0.orig/include/linux/slab.h
+++ linux-qcom-6.8.0/include/linux/slab.h
@@ -228,7 +228,7 @@
 void kfree_sensitive(const void *objp);
 size_t __ksize(const void *objp);
 
-DEFINE_FREE(kfree, void *, if (_T) kfree(_T))
+DEFINE_FREE(kfree, void *, if (!IS_ERR_OR_NULL(_T)) kfree(_T))
 
 /**
  * ksize - Report actual allocation size of associated object
@@ -754,7 +754,7 @@
 extern void *kvrealloc(const void *p, size_t oldsize, size_t newsize, gfp_t flags)
 		      __realloc_size(3);
 extern void kvfree(const void *addr);
-DEFINE_FREE(kvfree, void *, if (_T) kvfree(_T))
+DEFINE_FREE(kvfree, void *, if (!IS_ERR_OR_NULL(_T)) kvfree(_T))
 
 extern void kvfree_sensitive(const void *addr, size_t len);
 
--- linux-qcom-6.8.0.orig/include/linux/smp.h
+++ linux-qcom-6.8.0/include/linux/smp.h
@@ -218,6 +218,8 @@
 static inline void kick_all_cpus_sync(void) {  }
 static inline void wake_up_all_idle_cpus(void) {  }
 
+#define setup_max_cpus 0
+
 #ifdef CONFIG_UP_LATE_INIT
 extern void __init up_late_init(void);
 static inline void smp_init(void) { up_late_init(); }
--- linux-qcom-6.8.0.orig/include/linux/soc/andes/irq.h
+++ linux-qcom-6.8.0/include/linux/soc/andes/irq.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2023 Andes Technology Corporation
+ */
+#ifndef __ANDES_IRQ_H
+#define __ANDES_IRQ_H
+
+/* Andes PMU irq number */
+#define ANDES_RV_IRQ_PMOVI		18
+#define ANDES_RV_IRQ_LAST		ANDES_RV_IRQ_PMOVI
+#define ANDES_SLI_CAUSE_BASE		256
+
+/* Andes PMU related registers */
+#define ANDES_CSR_SLIE			0x9c4
+#define ANDES_CSR_SLIP			0x9c5
+#define ANDES_CSR_SCOUNTEROF		0x9d4
+
+#endif /* __ANDES_IRQ_H */
--- linux-qcom-6.8.0.orig/include/linux/soc/qcom/geni-se.h
+++ linux-qcom-6.8.0/include/linux/soc/qcom/geni-se.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef _LINUX_QCOM_GENI_SE
@@ -52,6 +53,7 @@
 	unsigned int avg_bw;
 };
 
+
 /**
  * struct geni_se - GENI Serial Engine
  * @base:		Base Address of the Serial Engine's register block
@@ -72,6 +74,19 @@
 	struct geni_icc_path icc_paths[3];
 };
 
+/**
+ * struct qup_se_rsc - Structure containing se details protocol and xfer mode
+ *
+ * @mode: transfer mode se fifo, dma or gsi.
+ * @protocol: Protocol spi or i2c or serial.
+ * @se: Pointer to the concerned serial engine.
+ */
+struct qup_se_rsc {
+	enum geni_se_xfer_mode mode;
+	enum geni_se_protocol_type protocol;
+	struct geni_se *se;
+};
+
 /* Common SE registers */
 #define GENI_FORCE_DEFAULT_REG		0x20
 #define GENI_OUTPUT_CTRL		0x24
@@ -88,11 +103,15 @@
 #define SE_GENI_M_IRQ_STATUS		0x610
 #define SE_GENI_M_IRQ_EN		0x614
 #define SE_GENI_M_IRQ_CLEAR		0x618
+#define SE_GENI_M_IRQ_EN_SET		0x61c
+#define SE_GENI_M_IRQ_EN_CLEAR		0x620
 #define SE_GENI_S_CMD0			0x630
 #define SE_GENI_S_CMD_CTRL_REG		0x634
 #define SE_GENI_S_IRQ_STATUS		0x640
 #define SE_GENI_S_IRQ_EN		0x644
 #define SE_GENI_S_IRQ_CLEAR		0x648
+#define SE_GENI_S_IRQ_EN_SET		0x64c
+#define SE_GENI_S_IRQ_EN_CLEAR		0x650
 #define SE_GENI_TX_FIFOn		0x700
 #define SE_GENI_RX_FIFOn		0x780
 #define SE_GENI_TX_FIFO_STATUS		0x800
@@ -101,6 +120,8 @@
 #define SE_GENI_RX_WATERMARK_REG	0x810
 #define SE_GENI_RX_RFR_WATERMARK_REG	0x814
 #define SE_GENI_IOS			0x908
+#define SE_GENI_M_GP_LENGTH		0x910
+#define SE_GENI_S_GP_LENGTH		0x914
 #define SE_DMA_TX_IRQ_STAT		0xc40
 #define SE_DMA_TX_IRQ_CLR		0xc44
 #define SE_DMA_TX_FSM_RST		0xc58
@@ -233,6 +254,9 @@
 #define IO2_DATA_IN			BIT(1)
 #define RX_DATA_IN			BIT(0)
 
+/* SE_GENI_M_GP_LENGTH and SE_GENI_S_GP_LENGTH fields */
+#define GP_LENGTH			GENMASK(31, 0)
+
 /* SE_DMA_TX_IRQ_STAT Register fields */
 #define TX_DMA_DONE			BIT(0)
 #define TX_EOT				BIT(1)
@@ -521,5 +545,10 @@
 int geni_icc_enable(struct geni_se *se);
 
 int geni_icc_disable(struct geni_se *se);
+
+void geni_se_clks_off(struct geni_se *se);
+
+int geni_load_se_firmware(struct geni_se *se,
+			  enum geni_se_protocol_type protocol);
 #endif
 #endif
--- linux-qcom-6.8.0.orig/include/linux/soc/qcom/llcc-qcom.h
+++ linux-qcom-6.8.0/include/linux/soc/qcom/llcc-qcom.h
@@ -54,7 +54,19 @@
 #define LLCC_CAMEXP4	 52
 #define LLCC_DISP_WB	 53
 #define LLCC_DISP_1	 54
+#define LLCC_VIEYE	 57
+#define LLCC_VIDPTH	 58
+#define LLCC_GPUMV	 59
+#define LLCC_EVA_LEFT	 60
+#define LLCC_EVA_RIGHT	 61
+#define LLCC_EVAGAIN	 62
+#define LLCC_VIPTH	 63
 #define LLCC_VIDVSP	 64
+#define LLCC_DISP_LEFT	 65
+#define LLCC_DISP_RIGHT	 66
+#define LLCC_EVCS_LEFT	 67
+#define LLCC_EVCS_RIGHT	 68
+#define LLCC_SPAD	 69
 
 /**
  * struct llcc_slice_desc - Cache slice descriptor
@@ -124,6 +136,7 @@
  * @num_banks: Number of llcc banks
  * @bitmap: Bit map to track the active slice ids
  * @ecc_irq: interrupt for llcc cache error detection and reporting
+ * @ecc_irq_configured: 'True' if firmware has already configured the irq propagation
  * @version: Indicates the LLCC version
  */
 struct llcc_drv_data {
@@ -137,6 +150,7 @@
 	u32 num_banks;
 	unsigned long *bitmap;
 	int ecc_irq;
+	bool ecc_irq_configured;
 	u32 version;
 };
 
--- linux-qcom-6.8.0.orig/include/linux/soc/qcom/panel_event_notifier.h
+++ linux-qcom-6.8.0/include/linux/soc/qcom/panel_event_notifier.h
@@ -0,0 +1,82 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ */
+
+#ifndef __PANEL_EVENT_NOTIFIER_H
+#define __PANEL_EVENT_NOTIFIER_H
+
+#include <linux/err.h>
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <drm/drm_panel.h>
+
+enum panel_event_notifier_tag {
+	PANEL_EVENT_NOTIFICATION_NONE,
+	PANEL_EVENT_NOTIFICATION_PRIMARY,
+	PANEL_EVENT_NOTIFICATION_SECONDARY,
+	PANEL_EVENT_NOTIFICATION_MAX
+};
+
+enum panel_event_notifier_client {
+	PANEL_EVENT_NOTIFIER_CLIENT_PRIMARY_TOUCH,
+	PANEL_EVENT_NOTIFIER_CLIENT_SECONDARY_TOUCH,
+	PANEL_EVENT_NOTIFIER_CLIENT_ECM,
+	PANEL_EVENT_NOTIFIER_CLIENT_MAX
+};
+
+enum panel_event_notification_type {
+	DRM_PANEL_EVENT_NONE,
+	DRM_PANEL_EVENT_BLANK,
+	DRM_PANEL_EVENT_UNBLANK,
+	DRM_PANEL_EVENT_BLANK_LP,
+	DRM_PANEL_EVENT_FPS_CHANGE,
+	DRM_PANEL_EVENT_MAX
+};
+
+struct panel_event_notification_data {
+	u32 old_fps;
+	u32 new_fps;
+	bool early_trigger;
+};
+
+struct panel_event_notification {
+	enum panel_event_notification_type notif_type;
+	struct panel_event_notification_data notif_data;
+	struct drm_panel *panel;
+};
+
+typedef void (*panel_event_notifier_handler)(enum panel_event_notifier_tag tag,
+				struct panel_event_notification *notification,
+					void *pvt_data);
+
+#if IS_ENABLED(CONFIG_QCOM_PANEL_EVENT_NOTIFIER)
+void *panel_event_notifier_register(enum panel_event_notifier_tag tag,
+		enum panel_event_notifier_client client_handle,
+		struct drm_panel *panel,
+		panel_event_notifier_handler notif_handler, void *pvt_data);
+void panel_event_notifier_unregister(void *cookie);
+void panel_event_notification_trigger(enum panel_event_notifier_tag tag,
+		 struct panel_event_notification *notification);
+
+#else
+static inline void *panel_event_notifier_register(enum panel_event_notifier_tag tag,
+		enum panel_event_notifier_client client_handle,
+		struct drm_panel *panel,
+		panel_event_notifier_handler notif_handler, void *pvt_data)
+{
+	return ERR_PTR(-EOPNOTSUPP);
+}
+
+static inline void panel_event_notifier_unregister(void *cookie)
+{
+}
+static inline void panel_event_notification_trigger(
+		enum panel_event_notifier_tag tag,
+		struct panel_event_notification *notification)
+{
+}
+#endif
+#endif
--- linux-qcom-6.8.0.orig/include/linux/soc/qcom/pmic_glink.h
+++ linux-qcom-6.8.0/include/linux/soc/qcom/pmic_glink.h
@@ -23,10 +23,11 @@
 
 int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len);
 
-struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev,
-							  unsigned int id,
-							  void (*cb)(const void *, size_t, void *),
-							  void (*pdr)(void *, int),
-							  void *priv);
+struct pmic_glink_client *devm_pmic_glink_client_alloc(struct device *dev,
+						       unsigned int id,
+						       void (*cb)(const void *, size_t, void *),
+						       void (*pdr)(void *, int),
+						       void *priv);
+void pmic_glink_client_register(struct pmic_glink_client *client);
 
 #endif
--- linux-qcom-6.8.0.orig/include/linux/soc/qcom/pmic_glink_altmode.h
+++ linux-qcom-6.8.0/include/linux/soc/qcom/pmic_glink_altmode.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __SOC_QCOM_PMIC_GLINK_ALTMODE_H__
+#define __SOC_QCOM_PMIC_GLINK_ALTMODE_H__
+
+#include <linux/usb/typec_dp.h>
+
+int pmic_glink_altmode_register_client(void (*cb)(void *priv, struct typec_displayport_data data,
+					int orientation),
+					void *priv);
+
+#endif
--- linux-qcom-6.8.0.orig/include/linux/soc/qcom/smem.h
+++ linux-qcom-6.8.0/include/linux/soc/qcom/smem.h
@@ -14,4 +14,6 @@
 
 int qcom_smem_get_soc_id(u32 *id);
 
+int qcom_smem_bust_hwspin_lock_by_host(unsigned int host);
+
 #endif
--- linux-qcom-6.8.0.orig/include/linux/soc/qcom/usb_qdss.h
+++ linux-qcom-6.8.0/include/linux/soc/qcom/usb_qdss.h
@@ -0,0 +1,106 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __LINUX_USB_QDSS_H
+#define __LINUX_USB_QDSS_H
+
+#include <linux/err.h>
+#include <linux/kernel.h>
+#include <linux/scatterlist.h>
+
+/**
+ *  struct qdss_request - QDSS request structure for usb 7 coresight usage.
+ *  @buf: Buffer point to store the data.
+ *  @length: Request length
+ *  @actual: Actual length of the data buffer.
+ *  @status: Current status of the buffer.
+ *  @context: Pointer to save the context of the request.
+ *  @sg:Pointer to the scatterlist.
+ *  @num_sgs: Number of scatter gather lists required.
+ */
+struct qdss_request {
+	char *buf;
+	int length;
+	int actual;
+	int status;
+	void *context;
+	struct scatterlist *sg;
+	unsigned int num_sgs;
+};
+
+/** enum qdss_state - QDSS state enum */
+enum qdss_state {
+	USB_QDSS_CONNECT,
+	USB_QDSS_DISCONNECT,
+	USB_QDSS_DATA_WRITE_DONE,
+};
+
+/* References of usb_qdss_ch used in functions below */
+struct usb_qdss_ch;
+
+#if IS_ENABLED(CONFIG_USB_F_QDSS)
+
+/**
+ * usb_qdss_open - Used to open a valid usb channel to perform the r/w operations.
+ * @name: Name of the channel
+ * @priv: variable to save the reference of qdss instance.
+ * @notify: usb_notifer used to notify the coresight driver.
+ */
+struct usb_qdss_ch *usb_qdss_open(const char *name, void *priv,
+	void (*notify)(void *priv, unsigned int event,
+		struct qdss_request *d_req, struct usb_qdss_ch *ch));
+/**
+ * usb_qdss_close - Used to close the current active usb channel.
+ *	 As part of the execution, function will dequeue any pending
+ *	 requests & calls free_req.
+ * @ch: Valid usb channel to send data.
+ */
+void usb_qdss_close(struct usb_qdss_ch *ch);
+/**
+ * usb_qdss_alloc_req - Accepts the usb channel and number of write buffers
+ *	which is used to call the usb_ep_alloc_request. Further the completion
+ *	handler qdss_write_complete is assigned which would be called on
+ *	completion callback.
+ * @ch: Valid usb channel to send data.
+ */
+int usb_qdss_alloc_req(struct usb_qdss_ch *ch, int n_write);
+/**
+ * usb_qdss_alloc_req - As the name suggestions, this functions frees the usb
+ *	requests from the active pool.
+ * @ch: Valid usb channel to send data.
+ * @n_write:Number of write buffers.
+ */
+void usb_qdss_free_req(struct usb_qdss_ch *ch);
+/**
+ * usb_qdss_write - This function is responsible for performing ep_queue
+ *	operation to usb gadget driver.
+ * @ch: Valid usb channel to send data.
+ * @d_req: qdss request which need to be queued.
+ */
+int usb_qdss_write(struct usb_qdss_ch *ch, struct qdss_request *d_req);
+#else
+static inline struct usb_qdss_ch *usb_qdss_open(const char *name, void *priv,
+		void (*n)(void *, unsigned int event,
+		struct qdss_request *d, struct usb_qdss_ch *c))
+{
+	return ERR_PTR(-ENODEV);
+}
+
+static inline int usb_qdss_write(struct usb_qdss_ch *c, struct qdss_request *d)
+{
+	return -ENODEV;
+}
+
+static inline int usb_qdss_alloc_req(struct usb_qdss_ch *c, int n_wr)
+{
+	return -ENODEV;
+}
+
+static inline void usb_qdss_close(struct usb_qdss_ch *ch) { }
+
+static inline void usb_qdss_free_req(struct usb_qdss_ch *ch) { }
+#endif /* CONFIG_USB_F_QDSS */
+
+#endif /* __LINUX_USB_QDSS_H */
--- linux-qcom-6.8.0.orig/include/linux/sock_diag.h
+++ linux-qcom-6.8.0/include/linux/sock_diag.h
@@ -13,6 +13,7 @@
 struct sock;
 
 struct sock_diag_handler {
+	struct module *owner;
 	__u8 family;
 	int (*dump)(struct sk_buff *skb, struct nlmsghdr *nlh);
 	int (*get_info)(struct sk_buff *skb, struct sock *sk);
@@ -22,8 +23,13 @@
 int sock_diag_register(const struct sock_diag_handler *h);
 void sock_diag_unregister(const struct sock_diag_handler *h);
 
-void sock_diag_register_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));
-void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));
+struct sock_diag_inet_compat {
+	struct module *owner;
+	int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh);
+};
+
+void sock_diag_register_inet_compat(const struct sock_diag_inet_compat *ptr);
+void sock_diag_unregister_inet_compat(const struct sock_diag_inet_compat *ptr);
 
 u64 __sock_gen_cookie(struct sock *sk);
 
--- linux-qcom-6.8.0.orig/include/linux/sockptr.h
+++ linux-qcom-6.8.0/include/linux/sockptr.h
@@ -50,11 +50,38 @@
 	return 0;
 }
 
+/* Deprecated.
+ * This is unsafe, unless caller checked user provided optlen.
+ * Prefer copy_safe_from_sockptr() instead.
+ */
 static inline int copy_from_sockptr(void *dst, sockptr_t src, size_t size)
 {
 	return copy_from_sockptr_offset(dst, src, 0, size);
 }
 
+/**
+ * copy_safe_from_sockptr: copy a struct from sockptr
+ * @dst:   Destination address, in kernel space. This buffer must be @ksize
+ *         bytes long.
+ * @ksize: Size of @dst struct.
+ * @optval: Source address. (in user or kernel space)
+ * @optlen: Size of @optval data.
+ *
+ * Returns:
+ *  * -EINVAL: @optlen < @ksize
+ *  * -EFAULT: access to userspace failed.
+ *  * 0 : @ksize bytes were copied
+ */
+static inline int copy_safe_from_sockptr(void *dst, size_t ksize,
+					 sockptr_t optval, unsigned int optlen)
+{
+	if (optlen < ksize)
+		return -EINVAL;
+	if (copy_from_sockptr(dst, optval, ksize))
+		return -EFAULT;
+	return 0;
+}
+
 static inline int copy_struct_from_sockptr(void *dst, size_t ksize,
 		sockptr_t src, size_t usize)
 {
--- linux-qcom-6.8.0.orig/include/linux/soundwire/sdw.h
+++ linux-qcom-6.8.0/include/linux/soundwire/sdw.h
@@ -1059,6 +1059,7 @@
 
 int sdw_compare_devid(struct sdw_slave *slave, struct sdw_slave_id id);
 void sdw_extract_slave_id(struct sdw_bus *bus, u64 addr, struct sdw_slave_id *id);
+void sdw_native_notify(bool native_rate_status);
 
 #if IS_ENABLED(CONFIG_SOUNDWIRE)
 
--- linux-qcom-6.8.0.orig/include/linux/spi/spi.h
+++ linux-qcom-6.8.0/include/linux/spi/spi.h
@@ -1085,12 +1085,13 @@
 	unsigned	dummy_data:1;
 	unsigned	cs_off:1;
 	unsigned	cs_change:1;
-	unsigned	tx_nbits:3;
-	unsigned	rx_nbits:3;
+	unsigned	tx_nbits:4;
+	unsigned	rx_nbits:4;
 	unsigned	timestamped:1;
 #define	SPI_NBITS_SINGLE	0x01 /* 1-bit transfer */
 #define	SPI_NBITS_DUAL		0x02 /* 2-bit transfer */
 #define	SPI_NBITS_QUAD		0x04 /* 4-bit transfer */
+#define	SPI_NBITS_OCTAL	0x08 /* 8-bit transfer */
 	u8		bits_per_word;
 	struct spi_delay	delay;
 	struct spi_delay	cs_change_delay;
--- linux-qcom-6.8.0.orig/include/linux/spinlock.h
+++ linux-qcom-6.8.0/include/linux/spinlock.h
@@ -462,11 +462,10 @@
  */
 static inline int spin_needbreak(spinlock_t *lock)
 {
-#ifdef CONFIG_PREEMPTION
+	if (!preempt_model_preemptible())
+		return 0;
+
 	return spin_is_contended(lock);
-#else
-	return 0;
-#endif
 }
 
 /*
@@ -479,11 +478,10 @@
  */
 static inline int rwlock_needbreak(rwlock_t *lock)
 {
-#ifdef CONFIG_PREEMPTION
+	if (!preempt_model_preemptible())
+		return 0;
+
 	return rwlock_is_contended(lock);
-#else
-	return 0;
-#endif
 }
 
 /*
--- linux-qcom-6.8.0.orig/include/linux/stackdepot.h
+++ linux-qcom-6.8.0/include/linux/stackdepot.h
@@ -30,6 +30,52 @@
  */
 #define STACK_DEPOT_EXTRA_BITS 5
 
+#define DEPOT_HANDLE_BITS (sizeof(depot_stack_handle_t) * 8)
+
+#define DEPOT_POOL_ORDER 2 /* Pool size order, 4 pages */
+#define DEPOT_POOL_SIZE (1LL << (PAGE_SHIFT + DEPOT_POOL_ORDER))
+#define DEPOT_STACK_ALIGN 4
+#define DEPOT_OFFSET_BITS (DEPOT_POOL_ORDER + PAGE_SHIFT - DEPOT_STACK_ALIGN)
+#define DEPOT_POOL_INDEX_BITS (DEPOT_HANDLE_BITS - DEPOT_OFFSET_BITS - \
+			       STACK_DEPOT_EXTRA_BITS)
+
+#ifdef CONFIG_STACKDEPOT
+/* Compact structure that stores a reference to a stack. */
+union handle_parts {
+	depot_stack_handle_t handle;
+	struct {
+		u32 pool_index_plus_1	: DEPOT_POOL_INDEX_BITS;
+		u32 offset		: DEPOT_OFFSET_BITS;
+		u32 extra		: STACK_DEPOT_EXTRA_BITS;
+	};
+};
+
+struct stack_record {
+	struct list_head hash_list;	/* Links in the hash table */
+	u32 hash;			/* Hash in hash table */
+	u32 size;			/* Number of stored frames */
+	union handle_parts handle;	/* Constant after initialization */
+	refcount_t count;
+	union {
+		unsigned long entries[CONFIG_STACKDEPOT_MAX_FRAMES];	/* Frames */
+		struct {
+			/*
+			 * An important invariant of the implementation is to
+			 * only place a stack record onto the freelist iff its
+			 * refcount is zero. Because stack records with a zero
+			 * refcount are never considered as valid, it is safe to
+			 * union @entries and freelist management state below.
+			 * Conversely, as soon as an entry is off the freelist
+			 * and its refcount becomes non-zero, the below must not
+			 * be accessed until being placed back on the freelist.
+			 */
+			struct list_head free_list;	/* Links in the freelist */
+			unsigned long rcu_state;	/* RCU cookie */
+		};
+	};
+};
+#endif
+
 typedef u32 depot_flags_t;
 
 /*
@@ -101,7 +147,7 @@
  * If the provided stack trace comes from the interrupt context, only the part
  * up to the interrupt entry is saved.
  *
- * Context: Any context, but setting STACK_DEPOT_FLAG_CAN_ALLOC is required if
+ * Context: Any context, but unsetting STACK_DEPOT_FLAG_CAN_ALLOC is required if
  *          alloc_pages() cannot be used from the current context. Currently
  *          this is the case for contexts where neither %GFP_ATOMIC nor
  *          %GFP_NOWAIT can be used (NMI, raw_spin_lock).
@@ -110,7 +156,7 @@
  */
 depot_stack_handle_t stack_depot_save_flags(unsigned long *entries,
 					    unsigned int nr_entries,
-					    gfp_t gfp_flags,
+					    gfp_t alloc_flags,
 					    depot_flags_t depot_flags);
 
 /**
@@ -129,7 +175,7 @@
  * Return: Handle of the stack trace stored in depot, 0 on failure
  */
 depot_stack_handle_t stack_depot_save(unsigned long *entries,
-				      unsigned int nr_entries, gfp_t gfp_flags);
+				      unsigned int nr_entries, gfp_t alloc_flags);
 
 /**
  * stack_depot_fetch - Fetch a stack trace from stack depot
--- linux-qcom-6.8.0.orig/include/linux/static_call.h
+++ linux-qcom-6.8.0/include/linux/static_call.h
@@ -160,6 +160,8 @@
 
 #ifdef CONFIG_HAVE_STATIC_CALL_INLINE
 
+extern int static_call_initialized;
+
 extern int __init static_call_init(void);
 
 extern void static_call_force_reinit(void);
@@ -225,6 +227,8 @@
 
 #elif defined(CONFIG_HAVE_STATIC_CALL)
 
+#define static_call_initialized 0
+
 static inline int static_call_init(void) { return 0; }
 
 #define DEFINE_STATIC_CALL(name, _func)					\
@@ -281,6 +285,8 @@
 
 #else /* Generic implementation */
 
+#define static_call_initialized 0
+
 static inline int static_call_init(void) { return 0; }
 
 static inline long __static_call_return0(void)
--- linux-qcom-6.8.0.orig/include/linux/stmmac.h
+++ linux-qcom-6.8.0/include/linux/stmmac.h
@@ -15,9 +15,9 @@
 #include <linux/platform_device.h>
 #include <linux/phy.h>
 
-#define MTL_MAX_RX_QUEUES	8
-#define MTL_MAX_TX_QUEUES	8
-#define STMMAC_CH_MAX		8
+#define MTL_MAX_RX_QUEUES	12
+#define MTL_MAX_TX_QUEUES	12
+#define STMMAC_CH_MAX		12
 
 #define STMMAC_RX_COE_NONE	0
 #define STMMAC_RX_COE_TYPE1	1
@@ -96,10 +96,20 @@
 	bool pblx8;
 	int fixed_burst;
 	int mixed_burst;
+	int owrq;
+	int orrq;
+	u32 tdps;
+	u32 rdps;
+	u32 txdcsz;
+	u32 rxdcsz;
 	bool aal;
 	bool eame;
 	bool multi_msi_en;
 	bool dche;
+	bool tx_pdma_custom_map;
+	bool rx_pdma_custom_map;
+	u8 tx_pdma_map[MTL_MAX_TX_QUEUES];
+	u8 rx_pdma_map[MTL_MAX_RX_QUEUES];
 };
 
 #define AXI_BLEN	7
@@ -117,7 +127,6 @@
 
 #define EST_GCL		1024
 struct stmmac_est {
-	struct mutex lock;
 	int enable;
 	u32 btr_reserve[2];
 	u32 btr_offset[2];
@@ -127,6 +136,7 @@
 	u32 gcl_unaligned[EST_GCL];
 	u32 gcl[EST_GCL];
 	u32 gcl_size;
+	u32 max_sdu[MTL_MAX_TX_QUEUES];
 };
 
 struct stmmac_rxq_cfg {
@@ -208,6 +218,18 @@
 	u32 mtl_low_cred_offset;
 };
 
+/* Addresses that may be customized by a platform */
+struct dwxgmac_addrs {
+	u32 dma_even_chan_base;
+	u32 dma_odd_chan_base;
+	u32 dma_chan_offset;
+	u32 mtl_chan_base;
+	u32 mtl_chan_offset;
+	u32 timestamp_base;
+	u32 pps_base;
+	u32 pps_offset;
+};
+
 #define STMMAC_FLAG_HAS_INTEGRATED_PCS		BIT(0)
 #define STMMAC_FLAG_SPH_DISABLE			BIT(1)
 #define STMMAC_FLAG_USE_PHY_WOL			BIT(2)
@@ -223,6 +245,8 @@
 #define STMMAC_FLAG_HWTSTAMP_CORRECT_LATENCY	BIT(12)
 
 struct plat_stmmacenet_data {
+	u32 snps_id;
+	u32 dev_id;
 	int bus_id;
 	int phy_addr;
 	/* MAC ----- optional PCS ----- SerDes ----- optional PHY ----- Media
@@ -267,6 +291,8 @@
 	u32 host_dma_width;
 	u32 rx_queues_to_use;
 	u32 tx_queues_to_use;
+	bool has_hdma;
+	bool insert_ts_pktid;
 	u8 rx_sched_algorithm;
 	u8 tx_sched_algorithm;
 	struct stmmac_rxq_cfg rx_queues_cfg[MTL_MAX_RX_QUEUES];
@@ -281,6 +307,7 @@
 	void (*exit)(struct platform_device *pdev, void *priv);
 	struct mac_device_info *(*setup)(void *priv);
 	int (*clks_config)(void *priv, bool enabled);
+	struct phylink_pcs *qcom_pcs;
 	int (*crosststamp)(ktime_t *device, struct system_counterval_t *system,
 			   void *ctx);
 	void (*dump_debug_regs)(void *priv);
@@ -312,6 +339,7 @@
 	int msi_rx_base_vec;
 	int msi_tx_base_vec;
 	const struct dwmac4_addrs *dwmac4_addrs;
+	const struct dwxgmac_addrs *dwxgmac_addrs;
 	unsigned int flags;
 };
 #endif
--- linux-qcom-6.8.0.orig/include/linux/sunrpc/clnt.h
+++ linux-qcom-6.8.0/include/linux/sunrpc/clnt.h
@@ -139,6 +139,7 @@
 	const char		*servername;
 	const char		*nodename;
 	const struct rpc_program *program;
+	struct rpc_stat		*stats;
 	u32			prognumber;	/* overrides program->number */
 	u32			version;
 	rpc_authflavor_t	authflavor;
--- linux-qcom-6.8.0.orig/include/linux/sunrpc/sched.h
+++ linux-qcom-6.8.0/include/linux/sunrpc/sched.h
@@ -197,7 +197,7 @@
 	unsigned char		maxpriority;		/* maximum priority (0 if queue is not a priority queue) */
 	unsigned char		priority;		/* current priority */
 	unsigned char		nr;			/* # tasks remaining for cookie */
-	unsigned short		qlen;			/* total # tasks waiting in queue */
+	unsigned int		qlen;			/* total # tasks waiting in queue */
 	struct rpc_timer	timer_list;
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) || IS_ENABLED(CONFIG_TRACEPOINTS)
 	const char *		name;
--- linux-qcom-6.8.0.orig/include/linux/sunrpc/svc.h
+++ linux-qcom-6.8.0/include/linux/sunrpc/svc.h
@@ -33,9 +33,9 @@
  * node traffic on multi-node NUMA NFS servers.
  */
 struct svc_pool {
-	unsigned int		sp_id;	    	/* pool id; also node id on NUMA */
+	unsigned int		sp_id;		/* pool id; also node id on NUMA */
 	struct lwq		sp_xprts;	/* pending transports */
-	atomic_t		sp_nrthreads;	/* # of threads in pool */
+	unsigned int		sp_nrthreads;	/* # of threads in pool */
 	struct list_head	sp_all_threads;	/* all server threads */
 	struct llist_head	sp_idle_threads; /* idle server threads */
 
@@ -339,7 +339,6 @@
 	const struct svc_version **pg_vers;	/* version array */
 	char *			pg_name;	/* service name */
 	char *			pg_class;	/* class name: services sharing authentication */
-	struct svc_stat *	pg_stats;	/* rpc statistics */
 	enum svc_auth_status	(*pg_authenticate)(struct svc_rqst *rqstp);
 	__be32			(*pg_init_request)(struct svc_rqst *,
 						   const struct svc_program *,
@@ -411,7 +410,9 @@
 void		   svc_rqst_release_pages(struct svc_rqst *rqstp);
 void		   svc_rqst_free(struct svc_rqst *);
 void		   svc_exit_thread(struct svc_rqst *);
-struct svc_serv *  svc_create_pooled(struct svc_program *, unsigned int,
+struct svc_serv *  svc_create_pooled(struct svc_program *prog,
+				     struct svc_stat *stats,
+				     unsigned int bufsize,
 				     int (*threadfn)(void *data));
 int		   svc_set_num_threads(struct svc_serv *, struct svc_pool *, int);
 int		   svc_pool_stats_open(struct svc_info *si, struct file *file);
--- linux-qcom-6.8.0.orig/include/linux/swap.h
+++ linux-qcom-6.8.0/include/linux/swap.h
@@ -344,7 +344,8 @@
 }
 
 /* linux/mm/workingset.c */
-bool workingset_test_recent(void *shadow, bool file, bool *workingset);
+bool workingset_test_recent(void *shadow, bool file, bool *workingset,
+				bool flush);
 void workingset_age_nonresident(struct lruvec *lruvec, unsigned long nr_pages);
 void *workingset_eviction(struct folio *folio, struct mem_cgroup *target_memcg);
 void workingset_refault(struct folio *folio, void *shadow);
--- linux-qcom-6.8.0.orig/include/linux/swapops.h
+++ linux-qcom-6.8.0/include/linux/swapops.h
@@ -390,6 +390,35 @@
 }
 #endif	/* CONFIG_MIGRATION */
 
+#ifdef CONFIG_MEMORY_FAILURE
+
+/*
+ * Support for hardware poisoned pages
+ */
+static inline swp_entry_t make_hwpoison_entry(struct page *page)
+{
+	BUG_ON(!PageLocked(page));
+	return swp_entry(SWP_HWPOISON, page_to_pfn(page));
+}
+
+static inline int is_hwpoison_entry(swp_entry_t entry)
+{
+	return swp_type(entry) == SWP_HWPOISON;
+}
+
+#else
+
+static inline swp_entry_t make_hwpoison_entry(struct page *page)
+{
+	return swp_entry(0, 0);
+}
+
+static inline int is_hwpoison_entry(swp_entry_t swp)
+{
+	return 0;
+}
+#endif
+
 typedef unsigned long pte_marker;
 
 #define  PTE_MARKER_UFFD_WP			BIT(0)
@@ -470,8 +499,9 @@
 
 /*
  * A pfn swap entry is a special type of swap entry that always has a pfn stored
- * in the swap offset. They are used to represent unaddressable device memory
- * and to restrict access to a page undergoing migration.
+ * in the swap offset. They can either be used to represent unaddressable device
+ * memory, to restrict access to a page undergoing migration or to represent a
+ * pfn which has been hwpoisoned and unmapped.
  */
 static inline bool is_pfn_swap_entry(swp_entry_t entry)
 {
@@ -479,7 +509,7 @@
 	BUILD_BUG_ON(SWP_TYPE_SHIFT < SWP_PFN_BITS);
 
 	return is_migration_entry(entry) || is_device_private_entry(entry) ||
-	       is_device_exclusive_entry(entry);
+	       is_device_exclusive_entry(entry) || is_hwpoison_entry(entry);
 }
 
 struct page_vma_mapped_walk;
@@ -548,35 +578,6 @@
 }
 #endif  /* CONFIG_ARCH_ENABLE_THP_MIGRATION */
 
-#ifdef CONFIG_MEMORY_FAILURE
-
-/*
- * Support for hardware poisoned pages
- */
-static inline swp_entry_t make_hwpoison_entry(struct page *page)
-{
-	BUG_ON(!PageLocked(page));
-	return swp_entry(SWP_HWPOISON, page_to_pfn(page));
-}
-
-static inline int is_hwpoison_entry(swp_entry_t entry)
-{
-	return swp_type(entry) == SWP_HWPOISON;
-}
-
-#else
-
-static inline swp_entry_t make_hwpoison_entry(struct page *page)
-{
-	return swp_entry(0, 0);
-}
-
-static inline int is_hwpoison_entry(swp_entry_t swp)
-{
-	return 0;
-}
-#endif
-
 static inline int non_swap_entry(swp_entry_t entry)
 {
 	return swp_type(entry) >= MAX_SWAPFILES;
--- linux-qcom-6.8.0.orig/include/linux/syscalls.h
+++ linux-qcom-6.8.0/include/linux/syscalls.h
@@ -418,7 +418,7 @@
 			      u64 __user *mnt_ids, size_t nr_mnt_ids,
 			      unsigned int flags);
 asmlinkage long sys_truncate(const char __user *path, long length);
-asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length);
+asmlinkage long sys_ftruncate(unsigned int fd, off_t length);
 #if BITS_PER_LONG == 32
 asmlinkage long sys_truncate64(const char __user *path, loff_t length);
 asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length);
@@ -858,9 +858,15 @@
 				const struct rlimit64 __user *new_rlim,
 				struct rlimit64 __user *old_rlim);
 asmlinkage long sys_fanotify_init(unsigned int flags, unsigned int event_f_flags);
+#if defined(CONFIG_ARCH_SPLIT_ARG64)
+asmlinkage long sys_fanotify_mark(int fanotify_fd, unsigned int flags,
+                                unsigned int mask_1, unsigned int mask_2,
+				int dfd, const char  __user * pathname);
+#else
 asmlinkage long sys_fanotify_mark(int fanotify_fd, unsigned int flags,
 				  u64 mask, int fd,
 				  const char  __user *pathname);
+#endif
 asmlinkage long sys_name_to_handle_at(int dfd, const char __user *name,
 				      struct file_handle __user *handle,
 				      int __user *mnt_id, int flag);
@@ -960,10 +966,10 @@
 		struct cachestat __user *cstat, unsigned int flags);
 asmlinkage long sys_map_shadow_stack(unsigned long addr, unsigned long size, unsigned int flags);
 asmlinkage long sys_lsm_get_self_attr(unsigned int attr, struct lsm_ctx *ctx,
-				      size_t *size, __u32 flags);
+				      u32 *size, u32 flags);
 asmlinkage long sys_lsm_set_self_attr(unsigned int attr, struct lsm_ctx *ctx,
-				      size_t size, __u32 flags);
-asmlinkage long sys_lsm_list_modules(u64 *ids, size_t *size, u32 flags);
+				      u32 size, u32 flags);
+asmlinkage long sys_lsm_list_modules(u64 *ids, u32 *size, u32 flags);
 
 /*
  * Architecture-specific system calls
--- linux-qcom-6.8.0.orig/include/linux/sysctl.h
+++ linux-qcom-6.8.0/include/linux/sysctl.h
@@ -205,7 +205,6 @@
 	struct ctl_table_set default_set;
 	struct ctl_table_set *(*lookup)(struct ctl_table_root *root);
 	void (*set_ownership)(struct ctl_table_header *head,
-			      struct ctl_table *table,
 			      kuid_t *uid, kgid_t *gid);
 	int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);
 };
--- linux-qcom-6.8.0.orig/include/linux/sysfb.h
+++ linux-qcom-6.8.0/include/linux/sysfb.h
@@ -58,11 +58,11 @@
 
 #ifdef CONFIG_SYSFB
 
-void sysfb_disable(void);
+void sysfb_disable(struct device *dev);
 
 #else /* CONFIG_SYSFB */
 
-static inline void sysfb_disable(void)
+static inline void sysfb_disable(struct device *dev)
 {
 }
 
@@ -91,7 +91,8 @@
 bool sysfb_parse_mode(const struct screen_info *si,
 		      struct simplefb_platform_data *mode);
 struct platform_device *sysfb_create_simplefb(const struct screen_info *si,
-					      const struct simplefb_platform_data *mode);
+					      const struct simplefb_platform_data *mode,
+					      struct device *parent);
 
 #else /* CONFIG_SYSFB_SIMPLE */
 
@@ -102,7 +103,8 @@
 }
 
 static inline struct platform_device *sysfb_create_simplefb(const struct screen_info *si,
-							    const struct simplefb_platform_data *mode)
+							    const struct simplefb_platform_data *mode,
+							    struct device *parent)
 {
 	return ERR_PTR(-EINVAL);
 }
--- linux-qcom-6.8.0.orig/include/linux/task_work.h
+++ linux-qcom-6.8.0/include/linux/task_work.h
@@ -14,10 +14,14 @@
 }
 
 enum task_work_notify_mode {
-	TWA_NONE,
+	TWA_NONE = 0,
 	TWA_RESUME,
 	TWA_SIGNAL,
 	TWA_SIGNAL_NO_IPI,
+	TWA_NMI_CURRENT,
+
+	TWA_FLAGS = 0xff00,
+	TWAF_NO_ALLOC = 0x0100,
 };
 
 static inline bool task_work_pending(struct task_struct *task)
@@ -30,7 +34,8 @@
 
 struct callback_head *task_work_cancel_match(struct task_struct *task,
 	bool (*match)(struct callback_head *, void *data), void *data);
-struct callback_head *task_work_cancel(struct task_struct *, task_work_func_t);
+struct callback_head *task_work_cancel_func(struct task_struct *, task_work_func_t);
+bool task_work_cancel(struct task_struct *task, struct callback_head *cb);
 void task_work_run(void);
 
 static inline void exit_task_work(struct task_struct *task)
--- linux-qcom-6.8.0.orig/include/linux/thermal.h
+++ linux-qcom-6.8.0/include/linux/thermal.h
@@ -119,12 +119,19 @@
 #endif
 };
 
+#define	TZ_STATE_FLAG_SUSPENDED	BIT(0)
+#define	TZ_STATE_FLAG_RESUMING	BIT(1)
+#define	TZ_STATE_FLAG_INIT	BIT(2)
+
+#define TZ_STATE_READY         0
+
 /**
  * struct thermal_zone_device - structure for a thermal zone
  * @id:		unique id number for each thermal zone
  * @type:	the thermal zone device type
  * @device:	&struct device for this thermal zone
  * @removal:	removal completion
+ * @resume:	resume completion
  * @trip_temp_attrs:	attributes for trip points for sysfs: trip temperature
  * @trip_type_attrs:	attributes for trip points for sysfs: trip type
  * @trip_hyst_attrs:	attributes for trip points for sysfs: trip hysteresis
@@ -159,13 +166,14 @@
  * @node:	node in thermal_tz_list (in thermal_core.c)
  * @poll_queue:	delayed work for polling
  * @notify_event: Last notification event
- * @suspended: thermal zone suspend indicator
+ * @state:	current state of the thermal zone
  */
 struct thermal_zone_device {
 	int id;
 	char type[THERMAL_NAME_LENGTH];
 	struct device device;
 	struct completion removal;
+	struct completion resume;
 	struct attribute_group trips_attribute_group;
 	struct thermal_attr *trip_temp_attrs;
 	struct thermal_attr *trip_type_attrs;
@@ -196,7 +204,7 @@
 #ifdef CONFIG_THERMAL_DEBUGFS
 	struct thermal_debugfs *debugfs;
 #endif
-	bool suspended;
+	u8 state;
 };
 
 /**
@@ -300,6 +308,8 @@
 			    struct thermal_trip *trip);
 int thermal_zone_get_trip(struct thermal_zone_device *tz, int trip_id,
 			  struct thermal_trip *trip);
+int thermal_zone_set_trip(struct thermal_zone_device *tz, int trip_id,
+			  const struct thermal_trip *trip);
 int for_each_thermal_trip(struct thermal_zone_device *tz,
 			  int (*cb)(struct thermal_trip *, void *),
 			  void *data);
--- linux-qcom-6.8.0.orig/include/linux/tick.h
+++ linux-qcom-6.8.0/include/linux/tick.h
@@ -242,12 +242,19 @@
 	if (tick_nohz_full_enabled())
 		tick_nohz_dep_set_task(tsk, bit);
 }
+
 static inline void tick_dep_clear_task(struct task_struct *tsk,
 				       enum tick_dep_bits bit)
 {
 	if (tick_nohz_full_enabled())
 		tick_nohz_dep_clear_task(tsk, bit);
 }
+
+static inline void tick_dep_init_task(struct task_struct *tsk)
+{
+	atomic_set(&tsk->tick_dep_mask, 0);
+}
+
 static inline void tick_dep_set_signal(struct task_struct *tsk,
 				       enum tick_dep_bits bit)
 {
@@ -281,6 +288,7 @@
 				     enum tick_dep_bits bit) { }
 static inline void tick_dep_clear_task(struct task_struct *tsk,
 				       enum tick_dep_bits bit) { }
+static inline void tick_dep_init_task(struct task_struct *tsk) { }
 static inline void tick_dep_set_signal(struct task_struct *tsk,
 				       enum tick_dep_bits bit) { }
 static inline void tick_dep_clear_signal(struct signal_struct *signal,
--- linux-qcom-6.8.0.orig/include/linux/trace_events.h
+++ linux-qcom-6.8.0/include/linux/trace_events.h
@@ -103,13 +103,16 @@
 	unsigned int		temp_size;
 	char			*fmt;	/* modified format holder */
 	unsigned int		fmt_size;
-	long			wait_index;
+	atomic_t		wait_index;
 
 	/* trace_seq for __print_flags() and __print_symbolic() etc. */
 	struct trace_seq	tmp_seq;
 
 	cpumask_var_t		started;
 
+	/* Set when the file is closed to prevent new waiters */
+	bool			closed;
+
 	/* it's true when current open file is snapshot */
 	bool			snapshot;
 
@@ -279,7 +282,8 @@
 			const char *name;
 			const int  size;
 			const int  align;
-			const int  is_signed;
+			const unsigned int is_signed:1;
+			unsigned int needs_test:1;
 			const int  filter_type;
 			const int  len;
 		};
@@ -331,6 +335,7 @@
 	TRACE_EVENT_FL_EPROBE_BIT,
 	TRACE_EVENT_FL_FPROBE_BIT,
 	TRACE_EVENT_FL_CUSTOM_BIT,
+	TRACE_EVENT_FL_TEST_STR_BIT,
 };
 
 /*
@@ -348,6 +353,7 @@
  *  CUSTOM        - Event is a custom event (to be attached to an exsiting tracepoint)
  *                   This is set when the custom event has not been attached
  *                   to a tracepoint yet, then it is cleared when it is.
+ *  TEST_STR      - The event has a "%s" that points to a string outside the event
  */
 enum {
 	TRACE_EVENT_FL_FILTERED		= (1 << TRACE_EVENT_FL_FILTERED_BIT),
@@ -361,6 +367,7 @@
 	TRACE_EVENT_FL_EPROBE		= (1 << TRACE_EVENT_FL_EPROBE_BIT),
 	TRACE_EVENT_FL_FPROBE		= (1 << TRACE_EVENT_FL_FPROBE_BIT),
 	TRACE_EVENT_FL_CUSTOM		= (1 << TRACE_EVENT_FL_CUSTOM_BIT),
+	TRACE_EVENT_FL_TEST_STR		= (1 << TRACE_EVENT_FL_TEST_STR_BIT),
 };
 
 #define TRACE_EVENT_FL_UKPROBE (TRACE_EVENT_FL_KPROBE | TRACE_EVENT_FL_UPROBE)
@@ -369,7 +376,7 @@
 	struct list_head	list;
 	struct trace_event_class *class;
 	union {
-		char			*name;
+		const char		*name;
 		/* Set TRACE_EVENT_FL_TRACEPOINT flag when using "tp" */
 		struct tracepoint	*tp;
 	};
@@ -870,7 +877,6 @@
 struct perf_event;
 
 DECLARE_PER_CPU(struct pt_regs, perf_trace_regs);
-DECLARE_PER_CPU(int, bpf_kprobe_override);
 
 extern int  perf_trace_init(struct perf_event *event);
 extern void perf_trace_destroy(struct perf_event *event);
--- linux-qcom-6.8.0.orig/include/linux/tracefs.h
+++ linux-qcom-6.8.0/include/linux/tracefs.h
@@ -62,6 +62,8 @@
 typedef int (*eventfs_callback)(const char *name, umode_t *mode, void **data,
 				const struct file_operations **fops);
 
+typedef void (*eventfs_release)(const char *name, void *data);
+
 /**
  * struct eventfs_entry - dynamically created eventfs file call back handler
  * @name:	Then name of the dynamic file in an eventfs directory
@@ -72,6 +74,7 @@
 struct eventfs_entry {
 	const char			*name;
 	eventfs_callback		callback;
+	eventfs_release			release;
 };
 
 struct eventfs_inode;
--- linux-qcom-6.8.0.orig/include/linux/tty_driver.h
+++ linux-qcom-6.8.0/include/linux/tty_driver.h
@@ -154,6 +154,13 @@
  *
  *	Optional. Called under the @tty->termios_rwsem. May sleep.
  *
+ * @ldisc_ok: ``int ()(struct tty_struct *tty, int ldisc)``
+ *
+ *	This routine allows the @tty driver to decide if it can deal
+ *	with a particular @ldisc.
+ *
+ *	Optional. Called under the @tty->ldisc_sem and @tty->termios_rwsem.
+ *
  * @set_ldisc: ``void ()(struct tty_struct *tty)``
  *
  *	This routine allows the @tty driver to be notified when the device's
@@ -372,6 +379,7 @@
 	void (*hangup)(struct tty_struct *tty);
 	int (*break_ctl)(struct tty_struct *tty, int state);
 	void (*flush_buffer)(struct tty_struct *tty);
+	int (*ldisc_ok)(struct tty_struct *tty, int ldisc);
 	void (*set_ldisc)(struct tty_struct *tty);
 	void (*wait_until_sent)(struct tty_struct *tty, int timeout);
 	void (*send_xchar)(struct tty_struct *tty, u8 ch);
--- linux-qcom-6.8.0.orig/include/linux/u64_stats_sync.h
+++ linux-qcom-6.8.0/include/linux/u64_stats_sync.h
@@ -135,10 +135,11 @@
 	p->v++;
 }
 
-static inline void u64_stats_init(struct u64_stats_sync *syncp)
-{
-	seqcount_init(&syncp->seq);
-}
+#define u64_stats_init(syncp)				\
+	do {						\
+		struct u64_stats_sync *__s = (syncp);	\
+		seqcount_init(&__s->seq);		\
+	} while (0)
 
 static inline void __u64_stats_update_begin(struct u64_stats_sync *syncp)
 {
--- linux-qcom-6.8.0.orig/include/linux/uaccess.h
+++ linux-qcom-6.8.0/include/linux/uaccess.h
@@ -32,6 +32,13 @@
 })
 #endif
 
+#ifdef masked_user_access_begin
+ #define can_do_masked_user_access() 1
+#else
+ #define can_do_masked_user_access() 0
+ #define masked_user_access_begin(src) NULL
+#endif
+
 /*
  * Architectures should provide two primitives (raw_copy_{to,from}_user())
  * and get rid of their private instances of copy_{to,from}_user() and
--- linux-qcom-6.8.0.orig/include/linux/ubsan.h
+++ linux-qcom-6.8.0/include/linux/ubsan.h
@@ -4,6 +4,11 @@
 
 #ifdef CONFIG_UBSAN_TRAP
 const char *report_ubsan_failure(struct pt_regs *regs, u32 check_type);
+#else
+static inline const char *report_ubsan_failure(struct pt_regs *regs, u32 check_type)
+{
+	return NULL;
+}
 #endif
 
 #endif
--- linux-qcom-6.8.0.orig/include/linux/udp.h
+++ linux-qcom-6.8.0/include/linux/udp.h
@@ -105,7 +105,7 @@
 #define udp_assign_bit(nr, sk, val)		\
 	assign_bit(UDP_FLAGS_##nr, &udp_sk(sk)->udp_flags, val)
 
-#define UDP_MAX_SEGMENTS	(1 << 6UL)
+#define UDP_MAX_SEGMENTS	(1 << 7UL)
 
 #define udp_sk(ptr) container_of_const(ptr, struct udp_sock, inet.sk)
 
@@ -140,6 +140,24 @@
 	}
 }
 
+DECLARE_STATIC_KEY_FALSE(udp_encap_needed_key);
+#if IS_ENABLED(CONFIG_IPV6)
+DECLARE_STATIC_KEY_FALSE(udpv6_encap_needed_key);
+#endif
+
+static inline bool udp_encap_needed(void)
+{
+	if (static_branch_unlikely(&udp_encap_needed_key))
+		return true;
+
+#if IS_ENABLED(CONFIG_IPV6)
+	if (static_branch_unlikely(&udpv6_encap_needed_key))
+		return true;
+#endif
+
+	return false;
+}
+
 static inline bool udp_unexpected_gso(struct sock *sk, struct sk_buff *skb)
 {
 	if (!skb_is_gso(skb))
@@ -153,6 +171,16 @@
 	    !udp_test_bit(ACCEPT_FRAGLIST, sk))
 		return true;
 
+	/* GSO packets lacking the SKB_GSO_UDP_TUNNEL/_CSUM bits might still
+	 * land in a tunnel as the socket check in udp_gro_receive cannot be
+	 * foolproof.
+	 */
+	if (udp_encap_needed() &&
+	    READ_ONCE(udp_sk(sk)->encap_rcv) &&
+	    !(skb_shinfo(skb)->gso_type &
+	      (SKB_GSO_UDP_TUNNEL | SKB_GSO_UDP_TUNNEL_CSUM)))
+		return true;
+
 	return false;
 }
 
--- linux-qcom-6.8.0.orig/include/linux/uprobes.h
+++ linux-qcom-6.8.0/include/linux/uprobes.h
@@ -76,6 +76,8 @@
 	struct uprobe			*active_uprobe;
 	unsigned long			xol_vaddr;
 
+	struct arch_uprobe              *auprobe;
+
 	struct return_instance		*return_instances;
 	unsigned int			depth;
 };
--- linux-qcom-6.8.0.orig/include/linux/usb/chipidea.h
+++ linux-qcom-6.8.0/include/linux/usb/chipidea.h
@@ -65,6 +65,7 @@
 #define CI_HDRC_PHY_VBUS_CONTROL	BIT(16)
 #define CI_HDRC_HAS_PORTSC_PEC_MISSED	BIT(17)
 #define CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS	BIT(18)
+#define	CI_HDRC_HAS_SHORT_PKT_LIMIT	BIT(19)
 	enum usb_dr_mode	dr_mode;
 #define CI_HDRC_CONTROLLER_RESET_EVENT		0
 #define CI_HDRC_CONTROLLER_STOPPED_EVENT	1
--- linux-qcom-6.8.0.orig/include/linux/usb/pd_vdo.h
+++ linux-qcom-6.8.0/include/linux/usb/pd_vdo.h
@@ -7,6 +7,7 @@
 #define __LINUX_USB_PD_VDO_H
 
 #include "pd.h"
+#include <linux/bitfield.h>
 
 /*
  * VDO : Vendor Defined Message Object
@@ -182,7 +183,7 @@
  * <5:3>   :: Alternate modes
  * <2:0>   :: USB highest speed
  */
-#define PD_VDO_UFP_DEVCAP(vdo)	(((vdo) & GENMASK(27, 24)) >> 24)
+#define PD_VDO_UFP_DEVCAP(vdo)	FIELD_GET(GENMASK(27, 24), vdo)
 
 /* UFP VDO Version */
 #define UFP_VDO_VER1_2		2
@@ -241,7 +242,7 @@
  * <21:5>  :: Reserved
  * <4:0>   :: Port number
  */
-#define PD_VDO_DFP_HOSTCAP(vdo)	(((vdo) & GENMASK(26, 24)) >> 24)
+#define PD_VDO_DFP_HOSTCAP(vdo)	FIELD_GET(GENMASK(26, 24), vdo)
 
 #define DFP_VDO_VER1_1		1
 #define HOST_USB2_CAPABLE	BIT(0)
--- linux-qcom-6.8.0.orig/include/linux/usb/typec_dp.h
+++ linux-qcom-6.8.0/include/linux/usb/typec_dp.h
@@ -3,6 +3,7 @@
 #define __USB_TYPEC_DP_H
 
 #include <linux/usb/typec_altmode.h>
+#include <linux/bitfield.h>
 
 #define USB_TYPEC_DP_SID	0xff01
 /* USB IF has not assigned a Standard ID (SID) for VirtualLink,
@@ -67,21 +68,21 @@
 #define   DP_CAP_UFP_D			1
 #define   DP_CAP_DFP_D			2
 #define   DP_CAP_DFP_D_AND_UFP_D	3
-#define DP_CAP_DP_SIGNALLING(_cap_)	(((_cap_) & GENMASK(5, 2)) >> 2)
+#define DP_CAP_DP_SIGNALLING(_cap_)	FIELD_GET(GENMASK(5, 2), _cap_)
 #define   DP_CAP_SIGNALLING_HBR3	1
 #define   DP_CAP_SIGNALLING_UHBR10	2
 #define   DP_CAP_SIGNALLING_UHBR20	3
 #define DP_CAP_RECEPTACLE		BIT(6)
 #define DP_CAP_USB			BIT(7)
-#define DP_CAP_DFP_D_PIN_ASSIGN(_cap_)	(((_cap_) & GENMASK(15, 8)) >> 8)
-#define DP_CAP_UFP_D_PIN_ASSIGN(_cap_)	(((_cap_) & GENMASK(23, 16)) >> 16)
+#define DP_CAP_DFP_D_PIN_ASSIGN(_cap_)	FIELD_GET(GENMASK(15, 8), _cap_)
+#define DP_CAP_UFP_D_PIN_ASSIGN(_cap_)	FIELD_GET(GENMASK(23, 16), _cap_)
 /* Get pin assignment taking plug & receptacle into consideration */
 #define DP_CAP_PIN_ASSIGN_UFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \
 			DP_CAP_UFP_D_PIN_ASSIGN(_cap_) : DP_CAP_DFP_D_PIN_ASSIGN(_cap_))
 #define DP_CAP_PIN_ASSIGN_DFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \
 			DP_CAP_DFP_D_PIN_ASSIGN(_cap_) : DP_CAP_UFP_D_PIN_ASSIGN(_cap_))
 #define DP_CAP_UHBR_13_5_SUPPORT	BIT(26)
-#define DP_CAP_CABLE_TYPE(_cap_)	(((_cap_) & GENMASK(29, 28)) >> 28)
+#define DP_CAP_CABLE_TYPE(_cap_)	FIELD_GET(GENMASK(29, 28), _cap_)
 #define   DP_CAP_CABLE_TYPE_PASSIVE	0
 #define   DP_CAP_CABLE_TYPE_RE_TIMER	1
 #define   DP_CAP_CABLE_TYPE_RE_DRIVER	2
@@ -116,7 +117,7 @@
 
 /* Helper for setting/getting the pin assignment value to the configuration */
 #define DP_CONF_SET_PIN_ASSIGN(_a_)	((_a_) << 8)
-#define DP_CONF_GET_PIN_ASSIGN(_conf_)	(((_conf_) & GENMASK(15, 8)) >> 8)
+#define DP_CONF_GET_PIN_ASSIGN(_conf_)	FIELD_GET(GENMASK(15, 8), _conf_)
 #define DP_CONF_UHBR13_5_SUPPORT	BIT(26)
 #define DP_CONF_CABLE_TYPE_MASK		GENMASK(29, 28)
 #define DP_CONF_CABLE_TYPE_SHIFT	28
--- linux-qcom-6.8.0.orig/include/linux/usb/usbnet.h
+++ linux-qcom-6.8.0/include/linux/usb/usbnet.h
@@ -76,8 +76,23 @@
 #		define EVENT_LINK_CHANGE	11
 #		define EVENT_SET_RX_MODE	12
 #		define EVENT_NO_IP_ALIGN	13
+/* This one is special, as it indicates that the device is going away
+ * there are cyclic dependencies between tasklet, timer and bh
+ * that must be broken
+ */
+#		define EVENT_UNPLUG		31
 };
 
+static inline bool usbnet_going_away(struct usbnet *ubn)
+{
+	return test_bit(EVENT_UNPLUG, &ubn->flags);
+}
+
+static inline void usbnet_mark_going_away(struct usbnet *ubn)
+{
+	set_bit(EVENT_UNPLUG, &ubn->flags);
+}
+
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
 {
 	return to_usb_driver(intf->dev.driver);
--- linux-qcom-6.8.0.orig/include/linux/user_namespace.h
+++ linux-qcom-6.8.0/include/linux/user_namespace.h
@@ -139,7 +139,8 @@
 
 long inc_rlimit_ucounts(struct ucounts *ucounts, enum rlimit_type type, long v);
 bool dec_rlimit_ucounts(struct ucounts *ucounts, enum rlimit_type type, long v);
-long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type);
+long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type,
+			    bool override_rlimit);
 void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum rlimit_type type);
 bool is_rlimit_overlimit(struct ucounts *ucounts, enum rlimit_type type, unsigned long max);
 
@@ -187,6 +188,8 @@
 		       const struct user_namespace *child);
 extern bool current_in_userns(const struct user_namespace *target_ns);
 struct ns_common *ns_get_owner(struct ns_common *ns);
+
+extern int unprivileged_userns_clone;
 #else
 
 static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
--- linux-qcom-6.8.0.orig/include/linux/userfaultfd_k.h
+++ linux-qcom-6.8.0/include/linux/userfaultfd_k.h
@@ -205,6 +205,7 @@
 
 extern int dup_userfaultfd(struct vm_area_struct *, struct list_head *);
 extern void dup_userfaultfd_complete(struct list_head *);
+void dup_userfaultfd_fail(struct list_head *);
 
 extern void mremap_userfaultfd_prep(struct vm_area_struct *,
 				    struct vm_userfaultfd_ctx *);
@@ -288,6 +289,10 @@
 {
 }
 
+static inline void dup_userfaultfd_fail(struct list_head *l)
+{
+}
+
 static inline void mremap_userfaultfd_prep(struct vm_area_struct *vma,
 					   struct vm_userfaultfd_ctx *ctx)
 {
--- linux-qcom-6.8.0.orig/include/linux/util_macros.h
+++ linux-qcom-6.8.0/include/linux/util_macros.h
@@ -4,19 +4,6 @@
 
 #include <linux/math.h>
 
-#define __find_closest(x, a, as, op)					\
-({									\
-	typeof(as) __fc_i, __fc_as = (as) - 1;				\
-	typeof(x) __fc_x = (x);						\
-	typeof(*a) const *__fc_a = (a);					\
-	for (__fc_i = 0; __fc_i < __fc_as; __fc_i++) {			\
-		if (__fc_x op DIV_ROUND_CLOSEST(__fc_a[__fc_i] +	\
-						__fc_a[__fc_i + 1], 2))	\
-			break;						\
-	}								\
-	(__fc_i);							\
-})
-
 /**
  * find_closest - locate the closest element in a sorted array
  * @x: The reference value.
@@ -25,8 +12,27 @@
  * @as: Size of 'a'.
  *
  * Returns the index of the element closest to 'x'.
+ * Note: If using an array of negative numbers (or mixed positive numbers),
+ *       then be sure that 'x' is of a signed-type to get good results.
  */
-#define find_closest(x, a, as) __find_closest(x, a, as, <=)
+#define find_closest(x, a, as)						\
+({									\
+	typeof(as) __fc_i, __fc_as = (as) - 1;				\
+	long __fc_mid_x, __fc_x = (x);					\
+	long __fc_left, __fc_right;					\
+	typeof(*a) const *__fc_a = (a);					\
+	for (__fc_i = 0; __fc_i < __fc_as; __fc_i++) {			\
+		__fc_mid_x = (__fc_a[__fc_i] + __fc_a[__fc_i + 1]) / 2;	\
+		if (__fc_x <= __fc_mid_x) {				\
+			__fc_left = __fc_x - __fc_a[__fc_i];		\
+			__fc_right = __fc_a[__fc_i + 1] - __fc_x;	\
+			if (__fc_right < __fc_left)			\
+				__fc_i++;				\
+			break;						\
+		}							\
+	}								\
+	(__fc_i);							\
+})
 
 /**
  * find_closest_descending - locate the closest element in a sorted array
@@ -36,9 +42,27 @@
  * @as: Size of 'a'.
  *
  * Similar to find_closest() but 'a' is expected to be sorted in descending
- * order.
+ * order. The iteration is done in reverse order, so that the comparison
+ * of '__fc_right' & '__fc_left' also works for unsigned numbers.
  */
-#define find_closest_descending(x, a, as) __find_closest(x, a, as, >=)
+#define find_closest_descending(x, a, as)				\
+({									\
+	typeof(as) __fc_i, __fc_as = (as) - 1;				\
+	long __fc_mid_x, __fc_x = (x);					\
+	long __fc_left, __fc_right;					\
+	typeof(*a) const *__fc_a = (a);					\
+	for (__fc_i = __fc_as; __fc_i >= 1; __fc_i--) {			\
+		__fc_mid_x = (__fc_a[__fc_i] + __fc_a[__fc_i - 1]) / 2;	\
+		if (__fc_x <= __fc_mid_x) {				\
+			__fc_left = __fc_x - __fc_a[__fc_i];		\
+			__fc_right = __fc_a[__fc_i - 1] - __fc_x;	\
+			if (__fc_right < __fc_left)			\
+				__fc_i--;				\
+			break;						\
+		}							\
+	}								\
+	(__fc_i);							\
+})
 
 /**
  * is_insidevar - check if the @ptr points inside the @var memory range.
--- linux-qcom-6.8.0.orig/include/linux/vfio.h
+++ linux-qcom-6.8.0/include/linux/vfio.h
@@ -64,6 +64,7 @@
 	struct completion comp;
 	struct iommufd_access *iommufd_access;
 	void (*put_kvm)(struct kvm *kvm);
+	struct inode *inode;
 #if IS_ENABLED(CONFIG_IOMMUFD)
 	struct iommufd_device *iommufd_device;
 	u8 iommufd_attached:1;
@@ -356,6 +357,7 @@
 	wait_queue_entry_t		wait;
 	poll_table		pt;
 	struct work_struct	shutdown;
+	struct work_struct	flush_inject;
 	struct virqfd		**pvirqfd;
 };
 
@@ -363,5 +365,6 @@
 		       void (*thread)(void *, void *), void *data,
 		       struct virqfd **pvirqfd, int fd);
 void vfio_virqfd_disable(struct virqfd **pvirqfd);
+void vfio_virqfd_flush_thread(struct virqfd **pvirqfd);
 
 #endif /* VFIO_H */
--- linux-qcom-6.8.0.orig/include/linux/virtio.h
+++ linux-qcom-6.8.0/include/linux/virtio.h
@@ -115,7 +115,9 @@
  * struct virtio_device - representation of a device using virtio
  * @index: unique position on the virtio bus
  * @failed: saved value for VIRTIO_CONFIG_S_FAILED bit (for restore)
- * @config_enabled: configuration change reporting enabled
+ * @config_core_enabled: configuration change reporting enabled by core
+ * @config_driver_disabled: configuration change reporting disabled by
+ *                          a driver
  * @config_change_pending: configuration change reported while disabled
  * @config_lock: protects configuration change reporting
  * @vqs_list_lock: protects @vqs.
@@ -130,7 +132,8 @@
 struct virtio_device {
 	int index;
 	bool failed;
-	bool config_enabled;
+	bool config_core_enabled;
+	bool config_driver_disabled;
 	bool config_change_pending;
 	spinlock_t config_lock;
 	spinlock_t vqs_list_lock;
@@ -157,6 +160,10 @@
 void __virtqueue_unbreak(struct virtqueue *_vq);
 
 void virtio_config_changed(struct virtio_device *dev);
+
+void virtio_config_driver_disable(struct virtio_device *dev);
+void virtio_config_driver_enable(struct virtio_device *dev);
+
 #ifdef CONFIG_PM_SLEEP
 int virtio_device_freeze(struct virtio_device *dev);
 int virtio_device_restore(struct virtio_device *dev);
--- linux-qcom-6.8.0.orig/include/linux/virtio_net.h
+++ linux-qcom-6.8.0/include/linux/virtio_net.h
@@ -103,8 +103,10 @@
 
 		if (!skb_partial_csum_set(skb, start, off))
 			return -EINVAL;
+		if (skb_transport_offset(skb) < nh_min_len)
+			return -EINVAL;
 
-		nh_min_len = max_t(u32, nh_min_len, skb_transport_offset(skb));
+		nh_min_len = skb_transport_offset(skb);
 		p_off = nh_min_len + thlen;
 		if (!pskb_may_pull(skb, p_off))
 			return -EINVAL;
@@ -171,6 +173,12 @@
 			if (gso_type != SKB_GSO_UDP_L4)
 				return -EINVAL;
 			break;
+		case SKB_GSO_TCPV4:
+		case SKB_GSO_TCPV6:
+			if (skb->ip_summed == CHECKSUM_PARTIAL &&
+			    skb->csum_offset != offsetof(struct tcphdr, check))
+				return -EINVAL;
+			break;
 		}
 
 		/* Kernel has a special handling for GSO_BY_FRAGS. */
--- linux-qcom-6.8.0.orig/include/linux/vmstat.h
+++ linux-qcom-6.8.0/include/linux/vmstat.h
@@ -519,7 +519,7 @@
 
 static inline const char *lru_list_name(enum lru_list lru)
 {
-	return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
+	return node_stat_name(NR_LRU_BASE + (enum node_stat_item)lru) + 3; // skip "nr_"
 }
 
 static inline const char *writeback_stat_name(enum writeback_stat_item item)
--- linux-qcom-6.8.0.orig/include/linux/wait.h
+++ linux-qcom-6.8.0/include/linux/wait.h
@@ -221,6 +221,7 @@
 #define wake_up_all(x)			__wake_up(x, TASK_NORMAL, 0, NULL)
 #define wake_up_locked(x)		__wake_up_locked((x), TASK_NORMAL, 1)
 #define wake_up_all_locked(x)		__wake_up_locked((x), TASK_NORMAL, 0)
+#define wake_up_sync(x)			__wake_up_sync(x, TASK_NORMAL)
 
 #define wake_up_interruptible(x)	__wake_up(x, TASK_INTERRUPTIBLE, 1, NULL)
 #define wake_up_interruptible_nr(x, nr)	__wake_up(x, TASK_INTERRUPTIBLE, nr, NULL)
--- linux-qcom-6.8.0.orig/include/linux/workqueue.h
+++ linux-qcom-6.8.0/include/linux/workqueue.h
@@ -79,7 +79,7 @@
 	WORK_BUSY_RUNNING	= 1 << 1,
 
 	/* maximum string length for set_worker_desc() */
-	WORKER_DESC_LEN		= 24,
+	WORKER_DESC_LEN		= 32,
 };
 
 /* Convenience constants - of type 'unsigned long', not 'enum'! */
@@ -471,6 +471,9 @@
 #define create_singlethread_workqueue(name)				\
 	alloc_ordered_workqueue("%s", __WQ_LEGACY | WQ_MEM_RECLAIM, name)
 
+#define from_work(var, callback_work, work_fieldname)	\
+	container_of(callback_work, typeof(*var), work_fieldname)
+
 extern void destroy_workqueue(struct workqueue_struct *wq);
 
 struct workqueue_attrs *alloc_workqueue_attrs(void);
--- linux-qcom-6.8.0.orig/include/linux/wwan.h
+++ linux-qcom-6.8.0/include/linux/wwan.h
@@ -16,6 +16,7 @@
  * @WWAN_PORT_QCDM: Qcom Modem diagnostic interface
  * @WWAN_PORT_FIREHOSE: XML based command protocol
  * @WWAN_PORT_XMMRPC: Control protocol for Intel XMM modems
+ * @WWAN_PORT_FASTBOOT: Fastboot protocol control
  *
  * @WWAN_PORT_MAX: Highest supported port types
  * @WWAN_PORT_UNKNOWN: Special value to indicate an unknown port type
@@ -28,6 +29,7 @@
 	WWAN_PORT_QCDM,
 	WWAN_PORT_FIREHOSE,
 	WWAN_PORT_XMMRPC,
+	WWAN_PORT_FASTBOOT,
 
 	/* Add new port types above this line */
 
--- linux-qcom-6.8.0.orig/include/linux/xarray.h
+++ linux-qcom-6.8.0/include/linux/xarray.h
@@ -1548,6 +1548,7 @@
 
 #ifdef CONFIG_XARRAY_MULTI
 int xa_get_order(struct xarray *, unsigned long index);
+int xas_get_order(struct xa_state *xas);
 void xas_split(struct xa_state *, void *entry, unsigned int order);
 void xas_split_alloc(struct xa_state *, void *entry, unsigned int order, gfp_t);
 #else
@@ -1555,6 +1556,11 @@
 {
 	return 0;
 }
+
+static inline int xas_get_order(struct xa_state *xas)
+{
+	return 0;
+}
 
 static inline void xas_split(struct xa_state *xas, void *entry,
 		unsigned int order)
--- linux-qcom-6.8.0.orig/include/linux/zswap.h
+++ linux-qcom-6.8.0/include/linux/zswap.h
@@ -35,7 +35,7 @@
 void zswap_memcg_offline_cleanup(struct mem_cgroup *memcg);
 void zswap_lruvec_state_init(struct lruvec *lruvec);
 void zswap_folio_swapin(struct folio *folio);
-bool is_zswap_enabled(void);
+bool zswap_is_enabled(void);
 #else
 
 struct zswap_lruvec_state {};
@@ -57,7 +57,7 @@
 static inline void zswap_lruvec_state_init(struct lruvec *lruvec) {}
 static inline void zswap_folio_swapin(struct folio *folio) {}
 
-static inline bool is_zswap_enabled(void)
+static inline bool zswap_is_enabled(void)
 {
 	return false;
 }
--- linux-qcom-6.8.0.orig/include/media/cec.h
+++ linux-qcom-6.8.0/include/media/cec.h
@@ -260,6 +260,7 @@
 	u16 phys_addr;
 	bool needs_hpd;
 	bool is_enabled;
+	bool is_claiming_log_addrs;
 	bool is_configuring;
 	bool must_reconfigure;
 	bool is_configured;
--- linux-qcom-6.8.0.orig/include/media/media-entity.h
+++ linux-qcom-6.8.0/include/media/media-entity.h
@@ -225,6 +225,7 @@
  * @graph_obj:	Embedded structure containing the media object common data
  * @entity:	Entity this pad belongs to
  * @index:	Pad index in the entity pads array, numbered from 0 to n
+ * @num_links:	Number of links connected to this pad
  * @sig_type:	Type of the signal inside a media pad
  * @flags:	Pad flags, as defined in
  *		:ref:`include/uapi/linux/media.h <media_header>`
@@ -236,6 +237,7 @@
 	struct media_gobj graph_obj;	/* must be first field in struct */
 	struct media_entity *entity;
 	u16 index;
+	u16 num_links;
 	enum media_pad_signal_type sig_type;
 	unsigned long flags;
 
--- linux-qcom-6.8.0.orig/include/media/v4l2-dv-timings.h
+++ linux-qcom-6.8.0/include/media/v4l2-dv-timings.h
@@ -146,15 +146,18 @@
  * @polarities: the horizontal and vertical polarities (same as struct
  *		v4l2_bt_timings polarities).
  * @interlaced: if this flag is true, it indicates interlaced format
+ * @cap: the v4l2_dv_timings_cap capabilities.
  * @fmt: the resulting timings.
  *
  * This function will attempt to detect if the given values correspond to a
  * valid CVT format. If so, then it will return true, and fmt will be filled
  * in with the found CVT timings.
  */
-bool v4l2_detect_cvt(unsigned frame_height, unsigned hfreq, unsigned vsync,
-		unsigned active_width, u32 polarities, bool interlaced,
-		struct v4l2_dv_timings *fmt);
+bool v4l2_detect_cvt(unsigned int frame_height, unsigned int hfreq,
+		     unsigned int vsync, unsigned int active_width,
+		     u32 polarities, bool interlaced,
+		     const struct v4l2_dv_timings_cap *cap,
+		     struct v4l2_dv_timings *fmt);
 
 /**
  * v4l2_detect_gtf - detect if the given timings follow the GTF standard
@@ -170,15 +173,18 @@
  *		image height, so it has to be passed explicitly. Usually
  *		the native screen aspect ratio is used for this. If it
  *		is not filled in correctly, then 16:9 will be assumed.
+ * @cap: the v4l2_dv_timings_cap capabilities.
  * @fmt: the resulting timings.
  *
  * This function will attempt to detect if the given values correspond to a
  * valid GTF format. If so, then it will return true, and fmt will be filled
  * in with the found GTF timings.
  */
-bool v4l2_detect_gtf(unsigned frame_height, unsigned hfreq, unsigned vsync,
-		u32 polarities, bool interlaced, struct v4l2_fract aspect,
-		struct v4l2_dv_timings *fmt);
+bool v4l2_detect_gtf(unsigned int frame_height, unsigned int hfreq,
+		     unsigned int vsync, u32 polarities, bool interlaced,
+		     struct v4l2_fract aspect,
+		     const struct v4l2_dv_timings_cap *cap,
+		     struct v4l2_dv_timings *fmt);
 
 /**
  * v4l2_calc_aspect_ratio - calculate the aspect ratio based on bytes
--- linux-qcom-6.8.0.orig/include/media/videobuf2-core.h
+++ linux-qcom-6.8.0/include/media/videobuf2-core.h
@@ -72,6 +72,10 @@
  *		 argument to other ops in this structure.
  * @put_userptr: inform the allocator that a USERPTR buffer will no longer
  *		 be used.
+ * @prepare:	called every time the buffer is passed from userspace to the
+ *		driver, useful for cache synchronisation, optional.
+ * @finish:	called every time the buffer is passed back from the driver
+ *		to the userspace, also optional.
  * @attach_dmabuf: attach a shared &struct dma_buf for a hardware operation;
  *		   used for DMABUF memory types; dev is the alloc device
  *		   dbuf is the shared dma_buf; returns ERR_PTR() on failure;
@@ -86,10 +90,6 @@
  *		dmabuf.
  * @unmap_dmabuf: releases access control to the dmabuf - allocator is notified
  *		  that this driver is done using the dmabuf for now.
- * @prepare:	called every time the buffer is passed from userspace to the
- *		driver, useful for cache synchronisation, optional.
- * @finish:	called every time the buffer is passed back from the driver
- *		to the userspace, also optional.
  * @vaddr:	return a kernel virtual address to a given memory buffer
  *		associated with the passed private structure or NULL if no
  *		such mapping exists.
@@ -484,7 +484,6 @@
  *		caller. For example, for V4L2, it should match
  *		the types defined on &enum v4l2_buf_type.
  * @io_modes:	supported io methods (see &enum vb2_io_modes).
- * @alloc_devs:	&struct device memory type/allocator-specific per-plane device
  * @dev:	device to use for the default allocation context if the driver
  *		doesn't fill in the @alloc_devs array.
  * @dma_attrs:	DMA attributes to use for the DMA.
@@ -553,6 +552,7 @@
  *		VIDIOC_REQBUFS will ensure at least @min_queued_buffers
  *		buffers will be allocated. Note that VIDIOC_CREATE_BUFS will not
  *		modify the requested buffer count.
+ * @alloc_devs:	&struct device memory type/allocator-specific per-plane device
  */
 /*
  * Private elements (won't appear at the uAPI book):
@@ -577,6 +577,9 @@
  * @waiting_for_buffers: used in poll() to check if vb2 is still waiting for
  *		buffers. Only set for capture queues if qbuf has not yet been
  *		called since poll() needs to return %EPOLLERR in that situation.
+ * @waiting_in_dqbuf: set by the core for the duration of a blocking DQBUF, when
+ *		it has to wait for a buffer to become available with vb2_queue->lock
+ *		released. Used to prevent destroying the queue by other threads.
  * @is_multiplanar: set if buffer type is multiplanar
  * @is_output:	set if buffer type is output
  * @copy_timestamp: set if vb2-core should set timestamps
--- linux-qcom-6.8.0.orig/include/net/addrconf.h
+++ linux-qcom-6.8.0/include/net/addrconf.h
@@ -437,6 +437,10 @@
 	refcount_inc(&ifp->refcnt);
 }
 
+static inline bool in6_ifa_hold_safe(struct inet6_ifaddr *ifp)
+{
+	return refcount_inc_not_zero(&ifp->refcnt);
+}
 
 /*
  *	compute link-local solicited-node multicast address
--- linux-qcom-6.8.0.orig/include/net/af_unix.h
+++ linux-qcom-6.8.0/include/net/af_unix.h
@@ -55,7 +55,7 @@
 	struct mutex		iolock, bindlock;
 	struct sock		*peer;
 	struct list_head	link;
-	atomic_long_t		inflight;
+	unsigned long		inflight;
 	spinlock_t		lock;
 	unsigned long		gc_flags;
 #define UNIX_GC_CANDIDATE	0
@@ -77,6 +77,9 @@
 	U_LOCK_NORMAL,
 	U_LOCK_SECOND,	/* for double locking, see unix_state_double_lock(). */
 	U_LOCK_DIAG, /* used while dumping icons, see sk_diag_dump_icons(). */
+	U_LOCK_GC_LISTENER, /* used for listening socket while determining gc
+			     * candidates to close a small race window.
+			     */
 };
 
 static inline void unix_state_lock_nested(struct sock *sk,
--- linux-qcom-6.8.0.orig/include/net/af_vsock.h
+++ linux-qcom-6.8.0/include/net/af_vsock.h
@@ -230,8 +230,12 @@
 int vsock_add_tap(struct vsock_tap *vt);
 int vsock_remove_tap(struct vsock_tap *vt);
 void vsock_deliver_tap(struct sk_buff *build_skb(void *opaque), void *opaque);
+int __vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+				int flags);
 int vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 			      int flags);
+int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
+			  size_t len, int flags);
 int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
 			size_t len, int flags);
 
--- linux-qcom-6.8.0.orig/include/net/ax25.h
+++ linux-qcom-6.8.0/include/net/ax25.h
@@ -216,7 +216,7 @@
 struct ctl_table;
 
 typedef struct ax25_dev {
-	struct ax25_dev		*next;
+	struct list_head	list;
 
 	struct net_device	*dev;
 	netdevice_tracker	dev_tracker;
@@ -330,7 +330,6 @@
 void ax25_digi_invert(const ax25_digi *, ax25_digi *);
 
 /* ax25_dev.c */
-extern ax25_dev *ax25_dev_list;
 extern spinlock_t ax25_dev_lock;
 
 #if IS_ENABLED(CONFIG_AX25)
--- linux-qcom-6.8.0.orig/include/net/bluetooth/bluetooth.h
+++ linux-qcom-6.8.0/include/net/bluetooth/bluetooth.h
@@ -123,6 +123,7 @@
 
 #define BT_VOICE_TRANSPARENT			0x0003
 #define BT_VOICE_CVSD_16BIT			0x0060
+#define BT_VOICE_TRANSPARENT_16BIT		0x0063
 
 #define BT_SNDMTU		12
 #define BT_RCVMTU		13
@@ -164,6 +165,8 @@
 #define BT_ISO_QOS_BIG_UNSET	0xff
 #define BT_ISO_QOS_BIS_UNSET	0xff
 
+#define BT_ISO_SYNC_TIMEOUT	0x07d0 /* 20 secs */
+
 struct bt_iso_io_qos {
 	__u32 interval;
 	__u16 latency;
@@ -283,7 +286,7 @@
 	bt_err_ratelimited("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__)
 
 /* Connection and socket states */
-enum {
+enum bt_sock_state {
 	BT_CONNECTED = 1, /* Equal to TCP_ESTABLISHED to make net code happy */
 	BT_OPEN,
 	BT_BOUND,
@@ -401,6 +404,7 @@
 void bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
+bool bt_sock_linked(struct bt_sock_list *l, struct sock *s);
 struct sock *bt_sock_alloc(struct net *net, struct socket *sock,
 			   struct proto *prot, int proto, gfp_t prio, int kern);
 int  bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
--- linux-qcom-6.8.0.orig/include/net/bluetooth/hci.h
+++ linux-qcom-6.8.0/include/net/bluetooth/hci.h
@@ -1,7 +1,7 @@
 /*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
-   Copyright 2023 NXP
+   Copyright 2023-2024 NXP
 
    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
 
@@ -29,13 +29,11 @@
 #define HCI_MAX_ACL_SIZE	1024
 #define HCI_MAX_SCO_SIZE	255
 #define HCI_MAX_ISO_SIZE	251
+#define HCI_MAX_ISO_BIS		31
 #define HCI_MAX_EVENT_SIZE	260
 #define HCI_MAX_FRAME_SIZE	(HCI_MAX_ACL_SIZE + 4)
 
 #define HCI_LINK_KEY_SIZE	16
-#define HCI_AMP_LINK_KEY_SIZE	(2 * HCI_LINK_KEY_SIZE)
-
-#define HCI_MAX_AMP_ASSOC_SIZE	672
 
 #define HCI_MAX_CPB_DATA_SIZE	252
 
@@ -71,26 +69,6 @@
 #define HCI_SMD		9
 #define HCI_VIRTIO	10
 
-/* HCI controller types */
-#define HCI_PRIMARY	0x00
-#define HCI_AMP		0x01
-
-/* First BR/EDR Controller shall have ID = 0 */
-#define AMP_ID_BREDR	0x00
-
-/* AMP controller types */
-#define AMP_TYPE_BREDR	0x00
-#define AMP_TYPE_80211	0x01
-
-/* AMP controller status */
-#define AMP_STATUS_POWERED_DOWN			0x00
-#define AMP_STATUS_BLUETOOTH_ONLY		0x01
-#define AMP_STATUS_NO_CAPACITY			0x02
-#define AMP_STATUS_LOW_CAPACITY			0x03
-#define AMP_STATUS_MEDIUM_CAPACITY		0x04
-#define AMP_STATUS_HIGH_CAPACITY		0x05
-#define AMP_STATUS_FULL_CAPACITY		0x06
-
 /* HCI device quirks */
 enum {
 	/* When this quirk is set, the HCI Reset command is send when
@@ -176,6 +154,15 @@
 	 */
 	HCI_QUIRK_USE_BDADDR_PROPERTY,
 
+	/* When this quirk is set, the Bluetooth Device Address provided by
+	 * the 'local-bd-address' fwnode property is incorrectly specified in
+	 * big-endian order.
+	 *
+	 * This quirk can be set before hci_register_dev is called or
+	 * during the hdev->setup vendor callback.
+	 */
+	HCI_QUIRK_BDADDR_PROPERTY_BROKEN,
+
 	/* When this quirk is set, the duplicate filtering during
 	 * scanning is based on Bluetooth devices addresses. To allow
 	 * RSSI based updates, restart scanning if needed.
@@ -220,14 +207,17 @@
 	 */
 	HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 
-	/* When this quirk is set, the controller has validated that
-	 * LE states reported through the HCI_LE_READ_SUPPORTED_STATES are
-	 * valid.  This mechanism is necessary as many controllers have
-	 * been seen has having trouble initiating a connectable
-	 * advertisement despite the state combination being reported as
-	 * supported.
+	/* When this quirk is set, the LE states reported through the
+	 * HCI_LE_READ_SUPPORTED_STATES are invalid/broken.
+	 *
+	 * This mechanism is necessary as many controllers have been seen has
+	 * having trouble initiating a connectable advertisement despite the
+	 * state combination being reported as supported.
+	 *
+	 * This quirk can be set before hci_register_dev is called or
+	 * during the hdev->setup vendor callback.
 	 */
-	HCI_QUIRK_VALID_LE_STATES,
+	HCI_QUIRK_BROKEN_LE_STATES,
 
 	/* When this quirk is set, then erroneous data reporting
 	 * is ignored. This is mainly due to the fact that the HCI
@@ -311,6 +301,20 @@
 	 */
 	HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT,
 
+	/*
+	 * When this quirk is set, the HCI_OP_LE_EXT_CREATE_CONN command is
+	 * disabled. This is required for the Actions Semiconductor ATS2851
+	 * based controllers, which erroneously claims to support it.
+	 */
+	HCI_QUIRK_BROKEN_EXT_CREATE_CONN,
+
+	/*
+	 * When this quirk is set, the command WRITE_AUTH_PAYLOAD_TIMEOUT is
+	 * skipped. This is required for the Actions Semiconductor ATS2851
+	 * based controllers, due to a race condition in pairing process.
+	 */
+	HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT,
+
 	/* When this quirk is set, MSFT extension monitor tracking by
 	 * address filter is supported. Since tracking quantity of each
 	 * pattern is limited, this feature supports tracking multiple
@@ -330,6 +334,25 @@
 	 * during the hdev->setup vendor callback.
 	 */
 	HCI_QUIRK_BROKEN_LE_CODED,
+
+	/*
+	 * When this quirk is set, the HCI_OP_READ_ENC_KEY_SIZE command is
+	 * skipped during an HCI_EV_ENCRYPT_CHANGE event. This is required
+	 * for Actions Semiconductor ATS2851 based controllers, which erroneously
+	 * claim to support it.
+	 */
+	HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE,
+
+	/*
+	 * When this quirk is set, the reserved bits of Primary/Secondary_PHY
+	 * inside the LE Extended Advertising Report events are discarded.
+	 * This is required for some Apple/Broadcom controllers which
+	 * abuse these reserved bits for unrelated flags.
+	 *
+	 * This quirk can be set before hci_register_dev is called or
+	 * during the hdev->setup vendor callback.
+	 */
+	HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY,
 };
 
 /* HCI device flags */
@@ -393,7 +416,6 @@
 	HCI_LIMITED_PRIVACY,
 	HCI_RPA_EXPIRED,
 	HCI_RPA_RESOLVING,
-	HCI_HS_ENABLED,
 	HCI_LE_ENABLED,
 	HCI_ADVERTISING,
 	HCI_ADVERTISING_CONNECTABLE,
@@ -437,7 +459,7 @@
 #define HCI_NCMD_TIMEOUT	msecs_to_jiffies(4000)	/* 4 seconds */
 #define HCI_ACL_TX_TIMEOUT	msecs_to_jiffies(45000)	/* 45 seconds */
 #define HCI_AUTO_OFF_TIMEOUT	msecs_to_jiffies(2000)	/* 2 seconds */
-#define HCI_POWER_OFF_TIMEOUT	msecs_to_jiffies(5000)	/* 5 seconds */
+#define HCI_ACL_CONN_TIMEOUT	msecs_to_jiffies(20000)	/* 20 seconds */
 #define HCI_LE_CONN_TIMEOUT	msecs_to_jiffies(20000)	/* 20 seconds */
 #define HCI_LE_AUTOCONN_TIMEOUT	msecs_to_jiffies(4000)	/* 4 seconds */
 
@@ -511,7 +533,6 @@
 #define ESCO_LINK	0x02
 /* Low Energy links do not have defined link type. Use invented one */
 #define LE_LINK		0x80
-#define AMP_LINK	0x81
 #define ISO_LINK	0x82
 #define INVALID_LINK	0xff
 
@@ -653,6 +674,7 @@
 #define HCI_ERROR_PIN_OR_KEY_MISSING	0x06
 #define HCI_ERROR_MEMORY_EXCEEDED	0x07
 #define HCI_ERROR_CONNECTION_TIMEOUT	0x08
+#define HCI_ERROR_COMMAND_DISALLOWED	0x0c
 #define HCI_ERROR_REJ_LIMITED_RESOURCES	0x0d
 #define HCI_ERROR_REJ_BAD_ADDR		0x0f
 #define HCI_ERROR_INVALID_PARAMETERS	0x12
@@ -661,6 +683,7 @@
 #define HCI_ERROR_REMOTE_POWER_OFF	0x15
 #define HCI_ERROR_LOCAL_HOST_TERM	0x16
 #define HCI_ERROR_PAIRING_NOT_ALLOWED	0x18
+#define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE	0x1e
 #define HCI_ERROR_INVALID_LL_PARAMS	0x1e
 #define HCI_ERROR_UNSPECIFIED		0x1f
 #define HCI_ERROR_ADVERTISING_TIMEOUT	0x3c
@@ -675,6 +698,7 @@
 #define HCI_RSSI_INVALID	127
 
 #define HCI_SYNC_HANDLE_INVALID	0xffff
+#define HCI_SID_INVALID		0xff
 
 #define HCI_ROLE_MASTER		0x00
 #define HCI_ROLE_SLAVE		0x01
@@ -925,56 +949,6 @@
 	__u8     reason;
 } __packed;
 
-#define HCI_OP_CREATE_PHY_LINK		0x0435
-struct hci_cp_create_phy_link {
-	__u8     phy_handle;
-	__u8     key_len;
-	__u8     key_type;
-	__u8     key[HCI_AMP_LINK_KEY_SIZE];
-} __packed;
-
-#define HCI_OP_ACCEPT_PHY_LINK		0x0436
-struct hci_cp_accept_phy_link {
-	__u8     phy_handle;
-	__u8     key_len;
-	__u8     key_type;
-	__u8     key[HCI_AMP_LINK_KEY_SIZE];
-} __packed;
-
-#define HCI_OP_DISCONN_PHY_LINK		0x0437
-struct hci_cp_disconn_phy_link {
-	__u8     phy_handle;
-	__u8     reason;
-} __packed;
-
-struct ext_flow_spec {
-	__u8       id;
-	__u8       stype;
-	__le16     msdu;
-	__le32     sdu_itime;
-	__le32     acc_lat;
-	__le32     flush_to;
-} __packed;
-
-#define HCI_OP_CREATE_LOGICAL_LINK	0x0438
-#define HCI_OP_ACCEPT_LOGICAL_LINK	0x0439
-struct hci_cp_create_accept_logical_link {
-	__u8                  phy_handle;
-	struct ext_flow_spec  tx_flow_spec;
-	struct ext_flow_spec  rx_flow_spec;
-} __packed;
-
-#define HCI_OP_DISCONN_LOGICAL_LINK	0x043a
-struct hci_cp_disconn_logical_link {
-	__le16   log_handle;
-} __packed;
-
-#define HCI_OP_LOGICAL_LINK_CANCEL	0x043b
-struct hci_cp_logical_link_cancel {
-	__u8     phy_handle;
-	__u8     flow_spec_id;
-} __packed;
-
 #define HCI_OP_ENHANCED_SETUP_SYNC_CONN		0x043d
 struct hci_coding_format {
 	__u8	id;
@@ -1596,46 +1570,6 @@
 	__u8     key_size;
 } __packed;
 
-#define HCI_OP_READ_LOCAL_AMP_INFO	0x1409
-struct hci_rp_read_local_amp_info {
-	__u8     status;
-	__u8     amp_status;
-	__le32   total_bw;
-	__le32   max_bw;
-	__le32   min_latency;
-	__le32   max_pdu;
-	__u8     amp_type;
-	__le16   pal_cap;
-	__le16   max_assoc_size;
-	__le32   max_flush_to;
-	__le32   be_flush_to;
-} __packed;
-
-#define HCI_OP_READ_LOCAL_AMP_ASSOC	0x140a
-struct hci_cp_read_local_amp_assoc {
-	__u8     phy_handle;
-	__le16   len_so_far;
-	__le16   max_len;
-} __packed;
-struct hci_rp_read_local_amp_assoc {
-	__u8     status;
-	__u8     phy_handle;
-	__le16   rem_len;
-	__u8     frag[];
-} __packed;
-
-#define HCI_OP_WRITE_REMOTE_AMP_ASSOC	0x140b
-struct hci_cp_write_remote_amp_assoc {
-	__u8     phy_handle;
-	__le16   len_so_far;
-	__le16   rem_len;
-	__u8     frag[];
-} __packed;
-struct hci_rp_write_remote_amp_assoc {
-	__u8     status;
-	__u8     phy_handle;
-} __packed;
-
 #define HCI_OP_GET_MWS_TRANSPORT_CONFIG	0x140c
 
 #define HCI_OP_ENABLE_DUT_MODE		0x1803
@@ -1647,6 +1581,15 @@
 	__u8     mask[8];
 } __packed;
 
+/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E
+ * 7.8.2 LE Read Buffer Size command
+ * MAX_LE_MTU is 0xffff.
+ * 0 is also valid. It means that no dedicated LE Buffer exists.
+ * It should use the HCI_Read_Buffer_Size command and mtu is shared
+ * between BR/EDR and LE.
+ */
+#define HCI_MIN_LE_MTU 0x001b
+
 #define HCI_OP_LE_READ_BUFFER_SIZE	0x2002
 struct hci_rp_le_read_buffer_size {
 	__u8     status;
@@ -2007,7 +1950,7 @@
 	__u8  operation;
 	__u8  frag_pref;
 	__u8  length;
-	__u8  data[];
+	__u8  data[] __counted_by(length);
 } __packed;
 
 #define HCI_OP_LE_SET_EXT_SCAN_RSP_DATA		0x2038
@@ -2016,7 +1959,7 @@
 	__u8  operation;
 	__u8  frag_pref;
 	__u8  length;
-	__u8  data[];
+	__u8  data[] __counted_by(length);
 } __packed;
 
 #define HCI_OP_LE_SET_EXT_ADV_ENABLE		0x2039
@@ -2035,13 +1978,14 @@
 } __packed;
 
 #define HCI_MAX_PER_AD_LENGTH	252
+#define HCI_MAX_PER_AD_TOT_LEN	1650
 
 #define HCI_OP_LE_SET_PER_ADV_DATA		0x203f
 struct hci_cp_le_set_per_adv_data {
 	__u8  handle;
 	__u8  operation;
 	__u8  length;
-	__u8  data[];
+	__u8  data[] __counted_by(length);
 } __packed;
 
 #define HCI_OP_LE_SET_PER_ADV_ENABLE		0x2040
@@ -2142,7 +2086,7 @@
 
 struct hci_cp_le_create_cis {
 	__u8    num_cis;
-	struct hci_cis cis[];
+	struct hci_cis cis[] __counted_by(num_cis);
 } __packed;
 
 #define HCI_OP_LE_REMOVE_CIG			0x2065
@@ -2196,7 +2140,7 @@
 	__u8    mse;
 	__le16  timeout;
 	__u8    num_bis;
-	__u8    bis[];
+	__u8    bis[] __counted_by(num_bis);
 } __packed;
 
 #define HCI_OP_LE_BIG_TERM_SYNC			0x206c
@@ -2795,6 +2739,10 @@
 	__u8     data[];
 } __packed;
 
+#define LE_PA_DATA_COMPLETE	0x00
+#define LE_PA_DATA_MORE_TO_COME	0x01
+#define LE_PA_DATA_TRUNCATED	0x02
+
 #define HCI_EV_LE_EXT_ADV_SET_TERM	0x12
 struct hci_evt_le_ext_adv_set_term {
 	__u8	status;
--- linux-qcom-6.8.0.orig/include/net/bluetooth/hci_core.h
+++ linux-qcom-6.8.0/include/net/bluetooth/hci_core.h
@@ -1,7 +1,7 @@
 /*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
-   Copyright 2023 NXP
+   Copyright 2023-2024 NXP
 
    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
 
@@ -91,8 +91,6 @@
 	s8			rssi;
 	u16			uuid_count;
 	u8			(*uuids)[16];
-	unsigned long		scan_start;
-	unsigned long		scan_duration;
 	unsigned long		name_resolve_timeout;
 };
 
@@ -126,7 +124,6 @@
 struct hci_conn_hash {
 	struct list_head list;
 	unsigned int     acl_num;
-	unsigned int     amp_num;
 	unsigned int     sco_num;
 	unsigned int     iso_num;
 	unsigned int     le_num;
@@ -189,7 +186,6 @@
 struct smp_csrk {
 	bdaddr_t bdaddr;
 	u8 bdaddr_type;
-	u8 link_type;
 	u8 type;
 	u8 val[16];
 };
@@ -199,7 +195,6 @@
 	struct rcu_head rcu;
 	bdaddr_t bdaddr;
 	u8 bdaddr_type;
-	u8 link_type;
 	u8 authenticated;
 	u8 type;
 	u8 enc_size;
@@ -214,7 +209,6 @@
 	bdaddr_t rpa;
 	bdaddr_t bdaddr;
 	u8 addr_type;
-	u8 link_type;
 	u8 val[16];
 };
 
@@ -222,8 +216,6 @@
 	struct list_head list;
 	struct rcu_head rcu;
 	bdaddr_t bdaddr;
-	u8 bdaddr_type;
-	u8 link_type;
 	u8 type;
 	u8 val[HCI_LINK_KEY_SIZE];
 	u8 pin_len;
@@ -247,6 +239,7 @@
 	bool	periodic;
 	__u8	mesh;
 	__u8	instance;
+	__u8	handle;
 	__u32	flags;
 	__u16	timeout;
 	__u16	remaining_time;
@@ -341,14 +334,6 @@
 /* Default authenticated payload timeout 30s */
 #define DEFAULT_AUTH_PAYLOAD_TIMEOUT   0x0bb8
 
-struct amp_assoc {
-	__u16	len;
-	__u16	offset;
-	__u16	rem_len;
-	__u16	len_so_far;
-	__u8	data[HCI_MAX_AMP_ASSOC_SIZE];
-};
-
 #define HCI_MAX_PAGES	3
 
 struct hci_dev {
@@ -361,7 +346,6 @@
 	unsigned long	flags;
 	__u16		id;
 	__u8		bus;
-	__u8		dev_type;
 	bdaddr_t	bdaddr;
 	bdaddr_t	setup_addr;
 	bdaddr_t	public_addr;
@@ -467,21 +451,6 @@
 	__u16		sniff_min_interval;
 	__u16		sniff_max_interval;
 
-	__u8		amp_status;
-	__u32		amp_total_bw;
-	__u32		amp_max_bw;
-	__u32		amp_min_latency;
-	__u32		amp_max_pdu;
-	__u8		amp_type;
-	__u16		amp_pal_cap;
-	__u16		amp_assoc_size;
-	__u32		amp_max_flush_to;
-	__u32		amp_be_flush_to;
-
-	struct amp_assoc	loc_assoc;
-
-	__u8		flow_ctl_mode;
-
 	unsigned int	auto_accept_delay;
 
 	unsigned long	quirks;
@@ -501,11 +470,6 @@
 	unsigned int	le_pkts;
 	unsigned int	iso_pkts;
 
-	__u16		block_len;
-	__u16		block_mtu;
-	__u16		num_blocks;
-	__u16		block_cnt;
-
 	unsigned long	acl_last_tx;
 	unsigned long	sco_last_tx;
 	unsigned long	le_last_tx;
@@ -552,6 +516,7 @@
 	__u32			req_status;
 	__u32			req_result;
 	struct sk_buff		*req_skb;
+	struct sk_buff		*req_rsp;
 
 	void			*smp_data;
 	void			*smp_bredr_data;
@@ -704,7 +669,9 @@
 	__u8		adv_instance;
 	__u16		handle;
 	__u16		sync_handle;
+	__u8		sid;
 	__u16		state;
+	__u16		mtu;
 	__u8		mode;
 	__u8		type;
 	__u8		role;
@@ -734,14 +701,20 @@
 	__u16		le_supv_timeout;
 	__u8		le_adv_data[HCI_MAX_EXT_AD_LENGTH];
 	__u8		le_adv_data_len;
-	__u8		le_per_adv_data[HCI_MAX_PER_AD_LENGTH];
-	__u8		le_per_adv_data_len;
+	__u8		le_per_adv_data[HCI_MAX_PER_AD_TOT_LEN];
+	__u16		le_per_adv_data_len;
+	__u16		le_per_adv_data_offset;
+	__u8		le_adv_phy;
+	__u8		le_adv_sec_phy;
 	__u8		le_tx_phy;
 	__u8		le_rx_phy;
 	__s8		rssi;
 	__s8		tx_power;
 	__s8		max_tx_power;
 	struct bt_iso_qos iso_qos;
+	__u8		num_bis;
+	__u8		bis[HCI_MAX_ISO_BIS];
+
 	unsigned long	flags;
 
 	enum conn_reasons conn_reason;
@@ -773,7 +746,6 @@
 	void		*l2cap_data;
 	void		*sco_data;
 	void		*iso_data;
-	struct amp_mgr	*amp_mgr;
 
 	struct list_head link_list;
 	struct hci_conn	*parent;
@@ -800,7 +772,6 @@
 	struct sk_buff_head data_q;
 	unsigned int	sent;
 	__u8		state;
-	bool		amp;
 };
 
 struct hci_conn_params {
@@ -854,7 +825,7 @@
 	} while (0)
 
 #define hci_dev_le_state_simultaneous(hdev) \
-	(test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) && \
+	(!test_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks) && \
 	 (hdev->le_states[4] & 0x08) &&	/* Central */ \
 	 (hdev->le_states[4] & 0x40) &&	/* Peripheral */ \
 	 (hdev->le_states[3] & 0x10))	/* Simultaneous */
@@ -916,8 +887,6 @@
 	hdev->discovery.uuid_count = 0;
 	kfree(hdev->discovery.uuids);
 	hdev->discovery.uuids = NULL;
-	hdev->discovery.scan_start = 0;
-	hdev->discovery.scan_duration = 0;
 }
 
 bool hci_discovery_active(struct hci_dev *hdev);
@@ -981,8 +950,10 @@
 	HCI_CONN_PER_ADV,
 	HCI_CONN_BIG_CREATED,
 	HCI_CONN_CREATE_CIS,
+	HCI_CONN_CREATE_BIG_SYNC,
 	HCI_CONN_BIG_SYNC,
 	HCI_CONN_BIG_SYNC_FAILED,
+	HCI_CONN_CREATE_PA_SYNC,
 	HCI_CONN_PA_SYNC,
 	HCI_CONN_PA_SYNC_FAILED,
 };
@@ -1009,9 +980,6 @@
 	case ACL_LINK:
 		h->acl_num++;
 		break;
-	case AMP_LINK:
-		h->amp_num++;
-		break;
 	case LE_LINK:
 		h->le_num++;
 		if (c->role == HCI_ROLE_SLAVE)
@@ -1038,9 +1006,6 @@
 	case ACL_LINK:
 		h->acl_num--;
 		break;
-	case AMP_LINK:
-		h->amp_num--;
-		break;
 	case LE_LINK:
 		h->le_num--;
 		if (c->role == HCI_ROLE_SLAVE)
@@ -1062,8 +1027,6 @@
 	switch (type) {
 	case ACL_LINK:
 		return h->acl_num;
-	case AMP_LINK:
-		return h->amp_num;
 	case LE_LINK:
 		return h->le_num;
 	case SCO_LINK:
@@ -1080,7 +1043,25 @@
 {
 	struct hci_conn_hash *c = &hdev->conn_hash;
 
-	return c->acl_num + c->amp_num + c->sco_num + c->le_num + c->iso_num;
+	return c->acl_num + c->sco_num + c->le_num + c->iso_num;
+}
+
+static inline bool hci_conn_valid(struct hci_dev *hdev, struct hci_conn *conn)
+{
+	struct hci_conn_hash *h = &hdev->conn_hash;
+	struct hci_conn  *c;
+
+	rcu_read_lock();
+
+	list_for_each_entry_rcu(c, &h->list, list) {
+		if (c == conn) {
+			rcu_read_unlock();
+			return true;
+		}
+	}
+	rcu_read_unlock();
+
+	return false;
 }
 
 static inline __u8 hci_conn_lookup_type(struct hci_dev *hdev, __u16 handle)
@@ -1125,6 +1106,30 @@
 	return NULL;
 }
 
+static inline struct hci_conn *hci_conn_hash_lookup_sid(struct hci_dev *hdev,
+							__u8 sid,
+							bdaddr_t *dst,
+							__u8 dst_type)
+{
+	struct hci_conn_hash *h = &hdev->conn_hash;
+	struct hci_conn  *c;
+
+	rcu_read_lock();
+
+	list_for_each_entry_rcu(c, &h->list, list) {
+		if (c->type != ISO_LINK  || bacmp(&c->dst, dst) ||
+		    c->dst_type != dst_type || c->sid != sid)
+			continue;
+
+		rcu_read_unlock();
+		return c;
+	}
+
+	rcu_read_unlock();
+
+	return NULL;
+}
+
 static inline struct hci_conn *
 hci_conn_hash_lookup_per_adv_bis(struct hci_dev *hdev,
 				 bdaddr_t *ba,
@@ -1296,6 +1301,30 @@
 }
 
 static inline struct hci_conn *
+hci_conn_hash_lookup_big_sync_pend(struct hci_dev *hdev,
+				   __u8 handle, __u8 num_bis)
+{
+	struct hci_conn_hash *h = &hdev->conn_hash;
+	struct hci_conn  *c;
+
+	rcu_read_lock();
+
+	list_for_each_entry_rcu(c, &h->list, list) {
+		if (c->type != ISO_LINK)
+			continue;
+
+		if (handle == c->iso_qos.bcast.big && num_bis == c->num_bis) {
+			rcu_read_unlock();
+			return c;
+		}
+	}
+
+	rcu_read_unlock();
+
+	return NULL;
+}
+
+static inline struct hci_conn *
 hci_conn_hash_lookup_big_state(struct hci_dev *hdev, __u8 handle,  __u16 state)
 {
 	struct hci_conn_hash *h = &hdev->conn_hash;
@@ -1351,8 +1380,14 @@
 	rcu_read_lock();
 
 	list_for_each_entry_rcu(c, &h->list, list) {
-		if (c->type != ISO_LINK ||
-			!test_bit(HCI_CONN_PA_SYNC, &c->flags))
+		if (c->type != ISO_LINK)
+			continue;
+
+		/* Ignore the listen hcon, we are looking
+		 * for the child hcon that was created as
+		 * a result of the PA sync established event.
+		 */
+		if (c->state == BT_LISTEN)
 			continue;
 
 		if (c->sync_handle == sync_handle) {
@@ -1472,6 +1507,8 @@
 void hci_sco_setup(struct hci_conn *conn, __u8 status);
 bool hci_iso_setup_path(struct hci_conn *conn);
 int hci_le_create_cis_pending(struct hci_dev *hdev);
+int hci_pa_create_sync_pending(struct hci_dev *hdev);
+int hci_le_big_create_sync_pending(struct hci_dev *hdev);
 int hci_conn_check_create_cis(struct hci_conn *conn);
 
 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
@@ -1480,7 +1517,6 @@
 				    bdaddr_t *dst, u8 role);
 void hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
-void hci_conn_check_pending(struct hci_dev *hdev);
 
 struct hci_chan *hci_chan_create(struct hci_conn *conn);
 void hci_chan_del(struct hci_chan *chan);
@@ -1493,12 +1529,14 @@
 				     enum conn_reasons conn_reason);
 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 				u8 dst_type, bool dst_resolved, u8 sec_level,
-				u16 conn_timeout, u8 role);
+				u16 conn_timeout, u8 role, u8 phy, u8 sec_phy);
+void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status);
 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 				 u8 sec_level, u8 auth_type,
-				 enum conn_reasons conn_reason);
+				 enum conn_reasons conn_reason, u16 timeout);
 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
-				 __u16 setting, struct bt_codec *codec);
+				 __u16 setting, struct bt_codec *codec,
+				 u16 timeout);
 struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
 			      __u8 dst_type, struct bt_iso_qos *qos);
 struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst,
@@ -1509,8 +1547,8 @@
 struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
 				 __u8 dst_type, struct bt_iso_qos *qos,
 				 __u8 data_len, __u8 *data);
-int hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst, __u8 dst_type,
-		       __u8 sid, struct bt_iso_qos *qos);
+struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
+		       __u8 dst_type, __u8 sid, struct bt_iso_qos *qos);
 int hci_le_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
 			   struct bt_iso_qos *qos,
 			   __u16 sync_handle, __u8 num_bis, __u8 bis[]);
@@ -1587,10 +1625,6 @@
 			}
 			break;
 
-		case AMP_LINK:
-			timeo = conn->disc_timeout;
-			break;
-
 		default:
 			timeo = 0;
 			break;
@@ -1884,6 +1918,10 @@
 #define privacy_mode_capable(dev) (use_ll_privacy(dev) && \
 				   (hdev->commands[39] & 0x04))
 
+#define read_key_size_capable(dev) \
+	((dev)->commands[20] & 0x10 && \
+	 !test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks))
+
 /* Use enhanced synchronous connection if command is supported and its quirk
  * has not been set.
  */
@@ -1897,8 +1935,8 @@
 			   !test_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &(dev)->quirks))
 
 /* Use ext create connection if command is supported */
-#define use_ext_conn(dev) ((dev)->commands[37] & 0x80)
-
+#define use_ext_conn(dev) (((dev)->commands[37] & 0x80) && \
+	!test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, &(dev)->quirks))
 /* Extended advertising support */
 #define ext_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_EXT_ADV))
 
@@ -1911,8 +1949,10 @@
  * C24: Mandatory if the LE Controller supports Connection State and either
  * LE Feature (LL Privacy) or LE Feature (Extended Advertising) is supported
  */
-#define use_enhanced_conn_complete(dev) (ll_privacy_capable(dev) || \
-					 ext_adv_capable(dev))
+#define use_enhanced_conn_complete(dev) ((ll_privacy_capable(dev) || \
+					 ext_adv_capable(dev)) && \
+					 !test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, \
+						 &(dev)->quirks))
 
 /* Periodic advertising support */
 #define per_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_PERIODIC_ADV))
@@ -2129,18 +2169,46 @@
 {
 	u16 max_latency;
 
-	if (min > max || min < 6 || max > 3200)
+	if (min > max) {
+		BT_WARN("min %d > max %d", min, max);
 		return -EINVAL;
+	}
 
-	if (to_multiplier < 10 || to_multiplier > 3200)
+	if (min < 6) {
+		BT_WARN("min %d < 6", min);
 		return -EINVAL;
+	}
 
-	if (max >= to_multiplier * 8)
+	if (max > 3200) {
+		BT_WARN("max %d > 3200", max);
 		return -EINVAL;
+	}
+
+	if (to_multiplier < 10) {
+		BT_WARN("to_multiplier %d < 10", to_multiplier);
+		return -EINVAL;
+	}
+
+	if (to_multiplier > 3200) {
+		BT_WARN("to_multiplier %d > 3200", to_multiplier);
+		return -EINVAL;
+	}
+
+	if (max >= to_multiplier * 8) {
+		BT_WARN("max %d >= to_multiplier %d * 8", max, to_multiplier);
+		return -EINVAL;
+	}
 
 	max_latency = (to_multiplier * 4 / max) - 1;
-	if (latency > 499 || latency > max_latency)
+	if (latency > 499) {
+		BT_WARN("latency %d > 499", latency);
 		return -EINVAL;
+	}
+
+	if (latency > max_latency) {
+		BT_WARN("latency %d > max_latency %d", latency, max_latency);
+		return -EINVAL;
+	}
 
 	return 0;
 }
@@ -2241,8 +2309,8 @@
 			      bool mgmt_connected);
 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
 			    u8 link_type, u8 addr_type, u8 status);
-void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-			 u8 addr_type, u8 status);
+void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn,
+			 u8 status);
 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure);
 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 				  u8 status);
--- linux-qcom-6.8.0.orig/include/net/bluetooth/hci_sync.h
+++ linux-qcom-6.8.0/include/net/bluetooth/hci_sync.h
@@ -38,16 +38,34 @@
 int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
 			     const void *param, u8 event, u32 timeout,
 			     struct sock *sk);
+int hci_cmd_sync_status(struct hci_dev *hdev, u16 opcode, u32 plen,
+			const void *param, u32 timeout);
 
 void hci_cmd_sync_init(struct hci_dev *hdev);
 void hci_cmd_sync_clear(struct hci_dev *hdev);
 void hci_cmd_sync_cancel(struct hci_dev *hdev, int err);
-void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err);
+void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err);
 
 int hci_cmd_sync_submit(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
 			void *data, hci_cmd_sync_work_destroy_t destroy);
 int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
 		       void *data, hci_cmd_sync_work_destroy_t destroy);
+int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+			    void *data, hci_cmd_sync_work_destroy_t destroy);
+int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+		     void *data, hci_cmd_sync_work_destroy_t destroy);
+int hci_cmd_sync_run_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+			  void *data, hci_cmd_sync_work_destroy_t destroy);
+struct hci_cmd_sync_work_entry *
+hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+			  void *data, hci_cmd_sync_work_destroy_t destroy);
+void hci_cmd_sync_cancel_entry(struct hci_dev *hdev,
+			       struct hci_cmd_sync_work_entry *entry);
+bool hci_cmd_sync_dequeue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+			  void *data, hci_cmd_sync_work_destroy_t destroy);
+bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev,
+			      hci_cmd_sync_work_func_t func, void *data,
+			      hci_cmd_sync_work_destroy_t destroy);
 
 int hci_update_eir_sync(struct hci_dev *hdev);
 int hci_update_class_sync(struct hci_dev *hdev);
@@ -127,8 +145,6 @@
 
 int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason);
 
-int hci_le_create_conn_sync(struct hci_dev *hdev, struct hci_conn *conn);
-
 int hci_le_create_cis_sync(struct hci_dev *hdev);
 
 int hci_le_remove_cig_sync(struct hci_dev *hdev, u8 handle);
@@ -138,3 +154,9 @@
 int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle);
 
 int hci_le_pa_terminate_sync(struct hci_dev *hdev, u16 handle);
+
+int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn);
+
+int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn);
+
+int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn);
--- linux-qcom-6.8.0.orig/include/net/bluetooth/l2cap.h
+++ linux-qcom-6.8.0/include/net/bluetooth/l2cap.h
@@ -59,8 +59,6 @@
 #define L2CAP_WAIT_ACK_POLL_PERIOD	msecs_to_jiffies(200)
 #define L2CAP_WAIT_ACK_TIMEOUT		msecs_to_jiffies(10000)
 
-#define L2CAP_A2MP_DEFAULT_MTU		670
-
 /* L2CAP socket address */
 struct sockaddr_l2 {
 	sa_family_t	l2_family;
@@ -109,12 +107,6 @@
 #define L2CAP_ECHO_RSP		0x09
 #define L2CAP_INFO_REQ		0x0a
 #define L2CAP_INFO_RSP		0x0b
-#define L2CAP_CREATE_CHAN_REQ	0x0c
-#define L2CAP_CREATE_CHAN_RSP	0x0d
-#define L2CAP_MOVE_CHAN_REQ	0x0e
-#define L2CAP_MOVE_CHAN_RSP	0x0f
-#define L2CAP_MOVE_CHAN_CFM	0x10
-#define L2CAP_MOVE_CHAN_CFM_RSP	0x11
 #define L2CAP_CONN_PARAM_UPDATE_REQ	0x12
 #define L2CAP_CONN_PARAM_UPDATE_RSP	0x13
 #define L2CAP_LE_CONN_REQ	0x14
@@ -144,7 +136,6 @@
 /* L2CAP fixed channels */
 #define L2CAP_FC_SIG_BREDR	0x02
 #define L2CAP_FC_CONNLESS	0x04
-#define L2CAP_FC_A2MP		0x08
 #define L2CAP_FC_ATT		0x10
 #define L2CAP_FC_SIG_LE		0x20
 #define L2CAP_FC_SMP_LE		0x40
@@ -267,7 +258,6 @@
 /* channel identifier */
 #define L2CAP_CID_SIGNALING	0x0001
 #define L2CAP_CID_CONN_LESS	0x0002
-#define L2CAP_CID_A2MP		0x0003
 #define L2CAP_CID_ATT		0x0004
 #define L2CAP_CID_LE_SIGNALING	0x0005
 #define L2CAP_CID_SMP		0x0006
@@ -282,7 +272,6 @@
 #define L2CAP_CR_BAD_PSM	0x0002
 #define L2CAP_CR_SEC_BLOCK	0x0003
 #define L2CAP_CR_NO_MEM		0x0004
-#define L2CAP_CR_BAD_AMP	0x0005
 #define L2CAP_CR_INVALID_SCID	0x0006
 #define L2CAP_CR_SCID_IN_USE	0x0007
 
@@ -404,29 +393,6 @@
 	__u8        data[];
 } __packed;
 
-struct l2cap_create_chan_req {
-	__le16      psm;
-	__le16      scid;
-	__u8        amp_id;
-} __packed;
-
-struct l2cap_create_chan_rsp {
-	__le16      dcid;
-	__le16      scid;
-	__le16      result;
-	__le16      status;
-} __packed;
-
-struct l2cap_move_chan_req {
-	__le16      icid;
-	__u8        dest_amp_id;
-} __packed;
-
-struct l2cap_move_chan_rsp {
-	__le16      icid;
-	__le16      result;
-} __packed;
-
 #define L2CAP_MR_SUCCESS	0x0000
 #define L2CAP_MR_PEND		0x0001
 #define L2CAP_MR_BAD_ID		0x0002
@@ -539,8 +505,6 @@
 
 struct l2cap_chan {
 	struct l2cap_conn	*conn;
-	struct hci_conn		*hs_hcon;
-	struct hci_chan		*hs_hchan;
 	struct kref	kref;
 	atomic_t	nesting;
 
@@ -584,6 +548,9 @@
 	__u16		tx_credits;
 	__u16		rx_credits;
 
+	/* estimated available receive buffer space or -1 if unknown */
+	ssize_t		rx_avail;
+
 	__u8		tx_state;
 	__u8		rx_state;
 
@@ -591,12 +558,6 @@
 	unsigned long	conn_state;
 	unsigned long	flags;
 
-	__u8		remote_amp_id;
-	__u8		local_amp_id;
-	__u8		move_id;
-	__u8		move_state;
-	__u8		move_role;
-
 	__u16		next_tx_seq;
 	__u16		expected_ack_seq;
 	__u16		expected_tx_seq;
@@ -724,10 +685,15 @@
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
 
+struct l2cap_rx_busy {
+	struct list_head	list;
+	struct sk_buff		*skb;
+};
+
 struct l2cap_pinfo {
 	struct bt_sock		bt;
 	struct l2cap_chan	*chan;
-	struct sk_buff		*rx_busy_skb;
+	struct list_head	rx_busy;
 };
 
 enum {
@@ -981,10 +947,11 @@
 struct l2cap_chan *l2cap_chan_create(void);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
-		       bdaddr_t *dst, u8 dst_type);
+		       bdaddr_t *dst, u8 dst_type, u16 timeout);
 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
+void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail);
 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator);
 void l2cap_chan_set_defaults(struct l2cap_chan *chan);
 int l2cap_ertm_init(struct l2cap_chan *chan);
--- linux-qcom-6.8.0.orig/include/net/bond_options.h
+++ linux-qcom-6.8.0/include/net/bond_options.h
@@ -160,5 +160,7 @@
 #if IS_ENABLED(CONFIG_IPV6)
 void bond_option_ns_ip6_targets_clear(struct bonding *bond);
 #endif
+void bond_slave_ns_maddrs_add(struct bonding *bond, struct slave *slave);
+void bond_slave_ns_maddrs_del(struct bonding *bond, struct slave *slave);
 
 #endif /* _NET_BOND_OPTIONS_H */
--- linux-qcom-6.8.0.orig/include/net/bonding.h
+++ linux-qcom-6.8.0/include/net/bonding.h
@@ -258,7 +258,7 @@
 #ifdef CONFIG_XFRM_OFFLOAD
 	struct list_head ipsec_list;
 	/* protecting ipsec_list */
-	spinlock_t ipsec_lock;
+	struct mutex ipsec_lock;
 #endif /* CONFIG_XFRM_OFFLOAD */
 	struct bpf_prog *xdp_prog;
 };
--- linux-qcom-6.8.0.orig/include/net/busy_poll.h
+++ linux-qcom-6.8.0/include/net/busy_poll.h
@@ -64,7 +64,7 @@
 static inline unsigned long busy_loop_current_time(void)
 {
 #ifdef CONFIG_NET_RX_BUSY_POLL
-	return (unsigned long)(local_clock() >> 10);
+	return (unsigned long)(ktime_get_ns() >> 10);
 #else
 	return 0;
 #endif
--- linux-qcom-6.8.0.orig/include/net/cfg80211.h
+++ linux-qcom-6.8.0/include/net/cfg80211.h
@@ -4972,6 +4972,7 @@
  *	set this flag to update channels on beacon hints.
  * @WIPHY_FLAG_SUPPORTS_NSTR_NONPRIMARY: support connection to non-primary link
  *	of an NSTR mobile AP MLD.
+ * @WIPHY_FLAG_DISABLE_WEXT: disable wireless extensions for this device
  */
 enum wiphy_flags {
 	WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK		= BIT(0),
@@ -4983,6 +4984,7 @@
 	WIPHY_FLAG_4ADDR_STATION		= BIT(6),
 	WIPHY_FLAG_CONTROL_PORT_PROTOCOL	= BIT(7),
 	WIPHY_FLAG_IBSS_RSN			= BIT(8),
+	WIPHY_FLAG_DISABLE_WEXT			= BIT(9),
 	WIPHY_FLAG_MESH_AUTH			= BIT(10),
 	WIPHY_FLAG_SUPPORTS_EXT_KCK_32          = BIT(11),
 	WIPHY_FLAG_SUPPORTS_NSTR_NONPRIMARY	= BIT(12),
@@ -6048,6 +6050,50 @@
 			      struct wiphy_delayed_work *dwork);
 
 /**
+ * wiphy_delayed_work_pending - Find out whether a wiphy delayable
+ * work item is currently pending.
+ *
+ * @wiphy: the wiphy, for debug purposes
+ * @dwork: the delayed work in question
+ *
+ * Return: true if timer is pending, false otherwise
+ *
+ * How wiphy_delayed_work_queue() works is by setting a timer which
+ * when it expires calls wiphy_work_queue() to queue the wiphy work.
+ * Because wiphy_delayed_work_queue() uses mod_timer(), if it is
+ * called twice and the second call happens before the first call
+ * deadline, the work will rescheduled for the second deadline and
+ * won't run before that.
+ *
+ * wiphy_delayed_work_pending() can be used to detect if calling
+ * wiphy_work_delayed_work_queue() would start a new work schedule
+ * or delayed a previous one. As seen below it cannot be used to
+ * detect precisely if the work has finished to execute nor if it
+ * is currently executing.
+ *
+ *      CPU0                                CPU1
+ * wiphy_delayed_work_queue(wk)
+ *  mod_timer(wk->timer)
+ *                                     wiphy_delayed_work_pending(wk) -> true
+ *
+ * [...]
+ * expire_timers(wk->timer)
+ *  detach_timer(wk->timer)
+ *                                     wiphy_delayed_work_pending(wk) -> false
+ *  wk->timer->function()                          |
+ *   wiphy_work_queue(wk)                          | delayed work pending
+ *    list_add_tail()                              | returns false but
+ *    queue_work(cfg80211_wiphy_work)              | wk->func() has not
+ *                                                 | been run yet
+ * [...]                                           |
+ *  cfg80211_wiphy_work()                          |
+ *   wk->func()                                    V
+ *
+ */
+bool wiphy_delayed_work_pending(struct wiphy *wiphy,
+				struct wiphy_delayed_work *dwork);
+
+/**
  * struct wireless_dev - wireless device state
  *
  * For netdevs, this structure must be allocated by the driver
--- linux-qcom-6.8.0.orig/include/net/cfg802154.h
+++ linux-qcom-6.8.0/include/net/cfg802154.h
@@ -401,6 +401,7 @@
 
 struct ieee802154_llsec_key_entry {
 	struct list_head list;
+	struct rcu_head rcu;
 
 	struct ieee802154_llsec_key_id id;
 	struct ieee802154_llsec_key *key;
--- linux-qcom-6.8.0.orig/include/net/dst_ops.h
+++ linux-qcom-6.8.0/include/net/dst_ops.h
@@ -24,7 +24,7 @@
 	void			(*destroy)(struct dst_entry *);
 	void			(*ifdown)(struct dst_entry *,
 					  struct net_device *dev);
-	struct dst_entry *	(*negative_advice)(struct dst_entry *);
+	void			(*negative_advice)(struct sock *sk, struct dst_entry *);
 	void			(*link_failure)(struct sk_buff *);
 	void			(*update_pmtu)(struct dst_entry *dst, struct sock *sk,
 					       struct sk_buff *skb, u32 mtu,
--- linux-qcom-6.8.0.orig/include/net/genetlink.h
+++ linux-qcom-6.8.0/include/net/genetlink.h
@@ -519,13 +519,12 @@
  * @skb: netlink message as socket buffer
  * @portid: own netlink portid to avoid sending to yourself
  * @group: offset of multicast group in groups array
- * @flags: allocation flags
  *
  * This function must hold the RTNL or rcu_read_lock().
  */
 int genlmsg_multicast_allns(const struct genl_family *family,
 			    struct sk_buff *skb, u32 portid,
-			    unsigned int group, gfp_t flags);
+			    unsigned int group);
 
 /**
  * genlmsg_unicast - unicast a netlink message
--- linux-qcom-6.8.0.orig/include/net/gro.h
+++ linux-qcom-6.8.0/include/net/gro.h
@@ -86,6 +86,15 @@
 
 	/* used to support CHECKSUM_COMPLETE for tunneling protocols */
 	__wsum	csum;
+
+	/* L3 offsets */
+	union {
+		struct {
+			u16 network_offset;
+			u16 inner_network_offset;
+		};
+		u16 network_offsets[2];
+	};
 };
 
 #define NAPI_GRO_CB(skb) ((struct napi_gro_cb *)(skb)->cb)
--- linux-qcom-6.8.0.orig/include/net/ieee80211_radiotap.h
+++ linux-qcom-6.8.0/include/net/ieee80211_radiotap.h
@@ -24,25 +24,27 @@
  * struct ieee80211_radiotap_header - base radiotap header
  */
 struct ieee80211_radiotap_header {
-	/**
-	 * @it_version: radiotap version, always 0
-	 */
-	uint8_t it_version;
+	__struct_group(ieee80211_radiotap_header_fixed, hdr, __packed,
+		/**
+		 * @it_version: radiotap version, always 0
+		 */
+		uint8_t it_version;
 
-	/**
-	 * @it_pad: padding (or alignment)
-	 */
-	uint8_t it_pad;
+		/**
+		 * @it_pad: padding (or alignment)
+		 */
+		uint8_t it_pad;
 
-	/**
-	 * @it_len: overall radiotap header length
-	 */
-	__le16 it_len;
+		/**
+		 * @it_len: overall radiotap header length
+		 */
+		__le16 it_len;
 
-	/**
-	 * @it_present: (first) present word
-	 */
-	__le32 it_present;
+		/**
+		 * @it_present: (first) present word
+		 */
+		__le32 it_present;
+	);
 
 	/**
 	 * @it_optional: all remaining presence bitmaps
@@ -50,6 +52,9 @@
 	__le32 it_optional[];
 } __packed;
 
+static_assert(offsetof(struct ieee80211_radiotap_header, it_optional) == sizeof(struct ieee80211_radiotap_header_fixed),
+	      "struct member likely outside of __struct_group()");
+
 /* version is always 0 */
 #define PKTHDR_RADIOTAP_VERSION	0
 
--- linux-qcom-6.8.0.orig/include/net/inet_connection_sock.h
+++ linux-qcom-6.8.0/include/net/inet_connection_sock.h
@@ -175,6 +175,7 @@
 			       void (*delack_handler)(struct timer_list *),
 			       void (*keepalive_handler)(struct timer_list *));
 void inet_csk_clear_xmit_timers(struct sock *sk);
+void inet_csk_clear_xmit_timers_sync(struct sock *sk);
 
 static inline void inet_csk_schedule_ack(struct sock *sk)
 {
@@ -265,7 +266,7 @@
 struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
 				      struct request_sock *req,
 				      struct sock *child);
-void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
+bool inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
 				   unsigned long timeout);
 struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child,
 					 struct request_sock *req,
@@ -283,7 +284,7 @@
 
 static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)
 {
-	return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog;
+	return inet_csk_reqsk_queue_len(sk) > READ_ONCE(sk->sk_max_ack_backlog);
 }
 
 bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req);
--- linux-qcom-6.8.0.orig/include/net/inet_frag.h
+++ linux-qcom-6.8.0/include/net/inet_frag.h
@@ -76,7 +76,7 @@
  * @stamp: timestamp of the last received fragment
  * @len: total length of the original datagram
  * @meat: length of received fragments so far
- * @mono_delivery_time: stamp has a mono delivery time (EDT)
+ * @tstamp_type: stamp has a mono delivery time (EDT)
  * @flags: fragment queue flags
  * @max_size: maximum received fragment size
  * @fqdir: pointer to struct fqdir
@@ -97,7 +97,7 @@
 	ktime_t			stamp;
 	int			len;
 	int			meat;
-	u8			mono_delivery_time;
+	u8			tstamp_type;
 	__u8			flags;
 	u16			max_size;
 	struct fqdir		*fqdir;
--- linux-qcom-6.8.0.orig/include/net/inet_timewait_sock.h
+++ linux-qcom-6.8.0/include/net/inet_timewait_sock.h
@@ -93,8 +93,10 @@
 					   struct inet_timewait_death_row *dr,
 					   const int state);
 
-void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
-			 struct inet_hashinfo *hashinfo);
+void inet_twsk_hashdance_schedule(struct inet_timewait_sock *tw,
+				  struct sock *sk,
+				  struct inet_hashinfo *hashinfo,
+				  int timeo);
 
 void __inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo,
 			  bool rearm);
@@ -111,7 +113,7 @@
 
 void inet_twsk_deschedule_put(struct inet_timewait_sock *tw);
 
-void inet_twsk_purge(struct inet_hashinfo *hashinfo, int family);
+void inet_twsk_purge(struct inet_hashinfo *hashinfo);
 
 static inline
 struct net *twsk_net(const struct inet_timewait_sock *twsk)
--- linux-qcom-6.8.0.orig/include/net/ip.h
+++ linux-qcom-6.8.0/include/net/ip.h
@@ -423,7 +423,7 @@
 
 static inline int ip_mtu_locked(const struct dst_entry *dst)
 {
-	const struct rtable *rt = (const struct rtable *)dst;
+	const struct rtable *rt = dst_rtable(dst);
 
 	return rt->rt_mtu_locked || dst_metric_locked(dst, RTAX_MTU);
 }
@@ -461,7 +461,7 @@
 static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
 						    bool forwarding)
 {
-	const struct rtable *rt = container_of(dst, struct rtable, dst);
+	const struct rtable *rt = dst_rtable(dst);
 	struct net *net = dev_net(dst->dev);
 	unsigned int mtu;
 
@@ -506,8 +506,7 @@
 	return mtu - lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu);
 }
 
-struct dst_metrics *ip_fib_metrics_init(struct net *net, struct nlattr *fc_mx,
-					int fc_mx_len,
+struct dst_metrics *ip_fib_metrics_init(struct nlattr *fc_mx, int fc_mx_len,
 					struct netlink_ext_ack *extack);
 static inline void ip_fib_metrics_put(struct dst_metrics *fib_metrics)
 {
@@ -796,6 +795,8 @@
 }
 
 bool icmp_global_allow(void);
+void icmp_global_consume(void);
+
 extern int sysctl_icmp_msgs_per_sec;
 extern int sysctl_icmp_msgs_burst;
 
--- linux-qcom-6.8.0.orig/include/net/ip6_fib.h
+++ linux-qcom-6.8.0/include/net/ip6_fib.h
@@ -237,9 +237,11 @@
 	for (rt = (w)->leaf; rt;					\
 	     rt = rcu_dereference_protected(rt->fib6_next, 1))
 
-static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
+#define dst_rt6_info(_ptr) container_of_const(_ptr, struct rt6_info, dst)
+
+static inline struct inet6_dev *ip6_dst_idev(const struct dst_entry *dst)
 {
-	return ((struct rt6_info *)dst)->rt6i_idev;
+	return dst_rt6_info(dst)->rt6i_idev;
 }
 
 static inline bool fib6_requires_src(const struct fib6_info *rt)
--- linux-qcom-6.8.0.orig/include/net/ip6_route.h
+++ linux-qcom-6.8.0/include/net/ip6_route.h
@@ -127,18 +127,26 @@
 
 static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,
 				      const struct in6_addr *daddr,
-				      unsigned int prefs,
+				      unsigned int prefs, int l3mdev_index,
 				      struct in6_addr *saddr)
 {
+	struct net_device *l3mdev;
+	struct net_device *dev;
+	bool same_vrf;
 	int err = 0;
 
-	if (f6i && f6i->fib6_prefsrc.plen) {
+	rcu_read_lock();
+
+	l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
+	if (!f6i || !f6i->fib6_prefsrc.plen || l3mdev)
+		dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
+	same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev;
+	if (f6i && f6i->fib6_prefsrc.plen && same_vrf)
 		*saddr = f6i->fib6_prefsrc.addr;
-	} else {
-		struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
+	else
+		err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);
 
-		err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr);
-	}
+	rcu_read_unlock();
 
 	return err;
 }
@@ -209,12 +217,11 @@
 static inline const struct rt6_info *skb_rt6_info(const struct sk_buff *skb)
 {
 	const struct dst_entry *dst = skb_dst(skb);
-	const struct rt6_info *rt6 = NULL;
 
 	if (dst)
-		rt6 = container_of(dst, struct rt6_info, dst);
+		return dst_rt6_info(dst);
 
-	return rt6;
+	return NULL;
 }
 
 /*
@@ -226,7 +233,7 @@
 {
 	struct ipv6_pinfo *np = inet6_sk(sk);
 
-	np->dst_cookie = rt6_get_cookie((struct rt6_info *)dst);
+	np->dst_cookie = rt6_get_cookie(dst_rt6_info(dst));
 	sk_setup_caps(sk, dst);
 	np->daddr_cache = daddr;
 #ifdef CONFIG_IPV6_SUBTREES
@@ -239,7 +246,7 @@
 
 static inline bool ipv6_unicast_destination(const struct sk_buff *skb)
 {
-	struct rt6_info *rt = (struct rt6_info *) skb_dst(skb);
+	const struct rt6_info *rt = dst_rt6_info(skb_dst(skb));
 
 	return rt->rt6i_flags & RTF_LOCAL;
 }
@@ -247,7 +254,7 @@
 static inline bool ipv6_anycast_destination(const struct dst_entry *dst,
 					    const struct in6_addr *daddr)
 {
-	struct rt6_info *rt = (struct rt6_info *)dst;
+	const struct rt6_info *rt = dst_rt6_info(dst);
 
 	return rt->rt6i_flags & RTF_ANYCAST ||
 		(rt->rt6i_dst.plen < 127 &&
--- linux-qcom-6.8.0.orig/include/net/ip_fib.h
+++ linux-qcom-6.8.0/include/net/ip_fib.h
@@ -173,6 +173,7 @@
 	unsigned char		type;
 	unsigned char		scope;
 	u32			tclassid;
+	dscp_t			dscp;
 	struct fib_nh_common	*nhc;
 	struct fib_info		*fi;
 	struct fib_table	*table;
--- linux-qcom-6.8.0.orig/include/net/ip_tunnels.h
+++ linux-qcom-6.8.0/include/net/ip_tunnels.h
@@ -109,6 +109,28 @@
 };
 
 struct metadata_dst;
+/* A fan overlay /8 (250.0.0.0/8, for example) maps to exactly one /16
+ * underlay (10.88.0.0/16, for example).  Multiple local addresses within
+ * the /16 may be used, but a particular overlay may not span
+ * multiple underlay subnets.
+ *
+ * We store one underlay, indexed by the overlay's high order octet.
+ */
+#define FAN_OVERLAY_CNT		256
+
+struct ip_fan_map {
+	__be32			underlay;
+	__be32			overlay;
+	u16			underlay_prefix;
+	u16			overlay_prefix;
+	u32			overlay_mask;
+	struct list_head	list;
+	struct rcu_head		rcu;
+};
+
+struct ip_tunnel_fan {
+	struct list_head	fan_maps;
+};
 
 struct ip_tunnel {
 	struct ip_tunnel __rcu	*next;
@@ -149,6 +171,7 @@
 #endif
 	struct ip_tunnel_prl_entry __rcu *prl;	/* potential router list */
 	unsigned int		prl_count;	/* # of entries in PRL */
+	struct ip_tunnel_fan	fan;
 	unsigned int		ip_tnl_net_id;
 	struct gro_cells	gro_cells;
 	__u32			fwmark;
@@ -156,6 +179,11 @@
 	bool			ignore_df;
 };
 
+static inline int fan_has_map(const struct ip_tunnel_fan *fan)
+{
+	return !list_empty(&fan->fan_maps);
+}
+
 struct tnl_ptk_info {
 	__be16 flags;
 	__be16 proto;
@@ -260,7 +288,7 @@
 	memset(fl4, 0, sizeof(*fl4));
 
 	if (oif) {
-		fl4->flowi4_l3mdev = l3mdev_master_upper_ifindex_by_index_rcu(net, oif);
+		fl4->flowi4_l3mdev = l3mdev_master_upper_ifindex_by_index(net, oif);
 		/* Legacy VRF/l3mdev use case */
 		fl4->flowi4_oif = fl4->flowi4_l3mdev ? 0 : oif;
 	}
@@ -360,6 +388,40 @@
 	return pskb_network_may_pull(skb, nhlen);
 }
 
+/* Variant of pskb_inet_may_pull().
+ */
+static inline bool skb_vlan_inet_prepare(struct sk_buff *skb,
+					 bool inner_proto_inherit)
+{
+	int nhlen = 0, maclen = inner_proto_inherit ? 0 : ETH_HLEN;
+	__be16 type = skb->protocol;
+
+	/* Essentially this is skb_protocol(skb, true)
+	 * And we get MAC len.
+	 */
+	if (eth_type_vlan(type))
+		type = __vlan_get_protocol(skb, type, &maclen);
+
+	switch (type) {
+#if IS_ENABLED(CONFIG_IPV6)
+	case htons(ETH_P_IPV6):
+		nhlen = sizeof(struct ipv6hdr);
+		break;
+#endif
+	case htons(ETH_P_IP):
+		nhlen = sizeof(struct iphdr);
+		break;
+	}
+	/* For ETH_P_IPV6/ETH_P_IP we make sure to pull
+	 * a base network header in skb->head.
+	 */
+	if (!pskb_may_pull(skb, maclen + nhlen))
+		return false;
+
+	skb_set_network_header(skb, maclen);
+	return true;
+}
+
 static inline int ip_encap_hlen(struct ip_tunnel_encap *e)
 {
 	const struct ip_tunnel_encap_ops *ops;
--- linux-qcom-6.8.0.orig/include/net/kcm.h
+++ linux-qcom-6.8.0/include/net/kcm.h
@@ -70,6 +70,7 @@
 	struct work_struct tx_work;
 	struct list_head wait_psock_list;
 	struct sk_buff *seq_skb;
+	struct mutex tx_mutex;
 	u32 tx_stopped : 1;
 
 	/* Don't use bit fields here, these are set under different locks */
--- linux-qcom-6.8.0.orig/include/net/lapb.h
+++ linux-qcom-6.8.0/include/net/lapb.h
@@ -4,7 +4,7 @@
 #include <linux/lapb.h>
 #include <linux/refcount.h>
 
-#define	LAPB_HEADER_LEN	20		/* LAPB over Ethernet + a bit more */
+#define	LAPB_HEADER_LEN MAX_HEADER		/* LAPB over Ethernet + a bit more */
 
 #define	LAPB_ACK_PENDING_CONDITION	0x01
 #define	LAPB_REJECT_CONDITION		0x02
--- linux-qcom-6.8.0.orig/include/net/mac80211.h
+++ linux-qcom-6.8.0/include/net/mac80211.h
@@ -375,7 +375,7 @@
 	BSS_CHANGED_HE_OBSS_PD		= 1<<28,
 	BSS_CHANGED_HE_BSS_COLOR	= 1<<29,
 	BSS_CHANGED_FILS_DISCOVERY      = 1<<30,
-	BSS_CHANGED_UNSOL_BCAST_PROBE_RESP = 1<<31,
+	BSS_CHANGED_UNSOL_BCAST_PROBE_RESP = BIT_ULL(31),
 	BSS_CHANGED_EHT_PUNCTURING	= BIT_ULL(32),
 	BSS_CHANGED_MLD_VALID_LINKS	= BIT_ULL(33),
 
@@ -932,6 +932,9 @@
  *	of their QoS TID or other priority field values.
  * @IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX: first MLO TX, used mostly internally
  *	for sequence number assignment
+ * @IEEE80211_TX_CTRL_DONT_USE_RATE_MASK: Don't use rate mask for this frame
+ *	which is transmitted due to scanning or offchannel TX, not in normal
+ *	operation on the interface.
  * @IEEE80211_TX_CTRL_MLO_LINK: If not @IEEE80211_LINK_UNSPECIFIED, this
  *	frame should be transmitted on the specific link. This really is
  *	only relevant for frames that do not have data present, and is
@@ -952,6 +955,7 @@
 	IEEE80211_TX_CTRL_NO_SEQNO		= BIT(7),
 	IEEE80211_TX_CTRL_DONT_REORDER		= BIT(8),
 	IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX	= BIT(9),
+	IEEE80211_TX_CTRL_DONT_USE_RATE_MASK	= BIT(10),
 	IEEE80211_TX_CTRL_MLO_LINK		= 0xf0000000,
 };
 
@@ -3047,6 +3051,19 @@
 void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
 
 /**
+ * ieee80211_purge_tx_queue - purge TX skb queue
+ * @hw: the hardware
+ * @skbs: the skbs
+ *
+ * Free a set of transmit skbs. Use this function when device is going to stop
+ * but some transmit skbs without TX status are still queued.
+ * This function does not take the list lock and the caller must hold the
+ * relevant locks to use it.
+ */
+void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
+			      struct sk_buff_head *skbs);
+
+/**
  * DOC: Hardware crypto acceleration
  *
  * mac80211 is capable of taking advantage of many hardware
@@ -6093,6 +6110,24 @@
 				       void (*iterator)(void *data,
 						struct ieee80211_sta *sta),
 				       void *data);
+
+/**
+ * ieee80211_iterate_stations_mtx - iterate stations
+ *
+ * This function iterates over all stations associated with a given
+ * hardware that are currently uploaded to the driver and calls the callback
+ * function for them. This version can only be used while holding the wiphy
+ * mutex.
+ *
+ * @hw: the hardware struct of which the interfaces should be iterated over
+ * @iterator: the iterator function to call
+ * @data: first argument of the iterator function
+ */
+void ieee80211_iterate_stations_mtx(struct ieee80211_hw *hw,
+				    void (*iterator)(void *data,
+						     struct ieee80211_sta *sta),
+				    void *data);
+
 /**
  * ieee80211_queue_work - add work onto the mac80211 workqueue
  *
--- linux-qcom-6.8.0.orig/include/net/macsec.h
+++ linux-qcom-6.8.0/include/net/macsec.h
@@ -321,6 +321,7 @@
  *	for the TX tag
  * @needed_tailroom: number of bytes reserved at the end of the sk_buff for the
  *	TX tag
+ * @rx_uses_md_dst: whether MACsec device offload supports sk_buff md_dst
  */
 struct macsec_ops {
 	/* Device wide */
@@ -352,6 +353,7 @@
 				 struct sk_buff *skb);
 	unsigned int needed_headroom;
 	unsigned int needed_tailroom;
+	bool rx_uses_md_dst;
 };
 
 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa);
--- linux-qcom-6.8.0.orig/include/net/mana/gdma.h
+++ linux-qcom-6.8.0/include/net/mana/gdma.h
@@ -224,7 +224,15 @@
 	struct auxiliary_device *adev;
 };
 
-#define MINIMUM_SUPPORTED_PAGE_SIZE PAGE_SIZE
+/* MANA_PAGE_SIZE is the DMA unit */
+#define MANA_PAGE_SHIFT 12
+#define MANA_PAGE_SIZE BIT(MANA_PAGE_SHIFT)
+#define MANA_PAGE_ALIGN(x) ALIGN((x), MANA_PAGE_SIZE)
+#define MANA_PAGE_ALIGNED(addr) IS_ALIGNED((unsigned long)(addr), MANA_PAGE_SIZE)
+#define MANA_PFN(a) ((a) >> MANA_PAGE_SHIFT)
+
+/* Required by HW */
+#define MANA_MIN_QSIZE MANA_PAGE_SIZE
 
 #define GDMA_CQE_SIZE 64
 #define GDMA_EQE_SIZE 16
--- linux-qcom-6.8.0.orig/include/net/mana/mana.h
+++ linux-qcom-6.8.0/include/net/mana/mana.h
@@ -39,11 +39,11 @@
 #define COMP_ENTRY_SIZE 64
 
 #define RX_BUFFERS_PER_QUEUE 512
-#define MANA_RX_DATA_ALIGN 64
 
 #define MAX_SEND_BUFFERS_PER_QUEUE 256
 
-#define EQ_SIZE (8 * PAGE_SIZE)
+#define EQ_SIZE (8 * MANA_PAGE_SIZE)
+
 #define LOG2_EQ_THROTTLE 3
 
 #define MAX_PORTS_IN_MANA_DEV 256
@@ -98,6 +98,8 @@
 
 	atomic_t pending_sends;
 
+	bool napi_initialized;
+
 	struct mana_stats_tx stats;
 };
 
@@ -275,6 +277,7 @@
 	/* NAPI data */
 	struct napi_struct napi;
 	int work_done;
+	int work_done_since_doorbell;
 	int budget;
 };
 
--- linux-qcom-6.8.0.orig/include/net/mctp.h
+++ linux-qcom-6.8.0/include/net/mctp.h
@@ -293,7 +293,7 @@
 int mctp_routes_init(void);
 void mctp_routes_exit(void);
 
-void mctp_device_init(void);
+int mctp_device_init(void);
 void mctp_device_exit(void);
 
 #endif /* __NET_MCTP_H */
--- linux-qcom-6.8.0.orig/include/net/net_debug.h
+++ linux-qcom-6.8.0/include/net/net_debug.h
@@ -27,7 +27,7 @@
 
 #define netdev_level_once(level, dev, fmt, ...)			\
 do {								\
-	static bool __section(".data.once") __print_once;	\
+	static bool __section(".data..once") __print_once;	\
 								\
 	if (!__print_once) {					\
 		__print_once = true;				\
--- linux-qcom-6.8.0.orig/include/net/net_namespace.h
+++ linux-qcom-6.8.0/include/net/net_namespace.h
@@ -82,6 +82,7 @@
 						 * or to unregister pernet ops
 						 * (pernet_ops_rwsem write locked).
 						 */
+	struct llist_node	defer_free_list;
 	struct llist_node	cleanup_list;	/* namespaces on death row */
 
 #ifdef CONFIG_KEYS
@@ -450,6 +451,9 @@
 	void (*pre_exit)(struct net *net);
 	void (*exit)(struct net *net);
 	void (*exit_batch)(struct list_head *net_exit_list);
+	/* Following method is called with RTNL held. */
+	void (*exit_batch_rtnl)(struct list_head *net_exit_list,
+				struct list_head *dev_kill_list);
 	unsigned int *id;
 	size_t size;
 };
--- linux-qcom-6.8.0.orig/include/net/netfilter/nf_flow_table.h
+++ linux-qcom-6.8.0/include/net/netfilter/nf_flow_table.h
@@ -336,7 +336,7 @@
 int nf_flow_table_offload_init(void);
 void nf_flow_table_offload_exit(void);
 
-static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb)
+static inline __be16 __nf_flow_pppoe_proto(const struct sk_buff *skb)
 {
 	__be16 proto;
 
@@ -352,6 +352,16 @@
 	return 0;
 }
 
+static inline bool nf_flow_pppoe_proto(struct sk_buff *skb, __be16 *inner_proto)
+{
+	if (!pskb_may_pull(skb, PPPOE_SES_HLEN))
+		return false;
+
+	*inner_proto = __nf_flow_pppoe_proto(skb);
+
+	return true;
+}
+
 #define NF_FLOW_TABLE_STAT_INC(net, count) __this_cpu_inc((net)->ft.stat->count)
 #define NF_FLOW_TABLE_STAT_DEC(net, count) __this_cpu_dec((net)->ft.stat->count)
 #define NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count)	\
--- linux-qcom-6.8.0.orig/include/net/netfilter/nf_tables.h
+++ linux-qcom-6.8.0/include/net/netfilter/nf_tables.h
@@ -307,9 +307,23 @@
 	return (void *)priv;
 }
 
+
+/**
+ * enum nft_iter_type - nftables set iterator type
+ *
+ * @NFT_ITER_READ: read-only iteration over set elements
+ * @NFT_ITER_UPDATE: iteration under mutex to update set element state
+ */
+enum nft_iter_type {
+	NFT_ITER_UNSPEC,
+	NFT_ITER_READ,
+	NFT_ITER_UPDATE,
+};
+
 struct nft_set;
 struct nft_set_iter {
 	u8		genmask;
+	enum nft_iter_type type:8;
 	unsigned int	count;
 	unsigned int	skip;
 	int		err;
@@ -605,6 +619,11 @@
 	return (void *)set->data;
 }
 
+static inline enum nft_data_types nft_set_datatype(const struct nft_set *set)
+{
+	return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;
+}
+
 static inline bool nft_set_gc_is_pending(const struct nft_set *s)
 {
 	return refcount_read(&s->refs) != 1;
@@ -712,15 +731,18 @@
 /**
  *	struct nft_set_ext - set extensions
  *
- *	@genmask: generation mask
+ *	@genmask: generation mask, but also flags (see NFT_SET_ELEM_DEAD_BIT)
  *	@offset: offsets of individual extension types
  *	@data: beginning of extension data
+ *
+ *	This structure must be aligned to word size, otherwise atomic bitops
+ *	on genmask field can cause alignment failure on some archs.
  */
 struct nft_set_ext {
 	u8	genmask;
 	u8	offset[NFT_SET_EXT_NUM];
 	char	data[];
-};
+} __aligned(BITS_PER_LONG / 8);
 
 static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl)
 {
@@ -1157,7 +1179,7 @@
 
 int nft_chain_add(struct nft_table *table, struct nft_chain *chain);
 void nft_chain_del(struct nft_chain *chain);
-void nf_tables_chain_destroy(struct nft_ctx *ctx);
+void nf_tables_chain_destroy(struct nft_chain *chain);
 
 struct nft_stats {
 	u64			bytes;
--- linux-qcom-6.8.0.orig/include/net/netfilter/nf_tables_core.h
+++ linux-qcom-6.8.0/include/net/netfilter/nf_tables_core.h
@@ -161,6 +161,7 @@
 };
 
 struct nft_inner_tun_ctx {
+	unsigned long cookie;
 	u16	type;
 	u16	inner_tunoff;
 	u16	inner_lloff;
--- linux-qcom-6.8.0.orig/include/net/netfilter/nf_tables_ipv4.h
+++ linux-qcom-6.8.0/include/net/netfilter/nf_tables_ipv4.h
@@ -19,7 +19,7 @@
 static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)
 {
 	struct iphdr *iph, _iph;
-	u32 len, thoff;
+	u32 len, thoff, skb_len;
 
 	iph = skb_header_pointer(pkt->skb, skb_network_offset(pkt->skb),
 				 sizeof(*iph), &_iph);
@@ -30,8 +30,10 @@
 		return -1;
 
 	len = iph_totlen(pkt->skb, iph);
-	thoff = skb_network_offset(pkt->skb) + (iph->ihl * 4);
-	if (pkt->skb->len < len)
+	thoff = iph->ihl * 4;
+	skb_len = pkt->skb->len - skb_network_offset(pkt->skb);
+
+	if (skb_len < len)
 		return -1;
 	else if (len < thoff)
 		return -1;
@@ -40,7 +42,7 @@
 
 	pkt->flags = NFT_PKTINFO_L4PROTO;
 	pkt->tprot = iph->protocol;
-	pkt->thoff = thoff;
+	pkt->thoff = skb_network_offset(pkt->skb) + thoff;
 	pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET;
 
 	return 0;
--- linux-qcom-6.8.0.orig/include/net/netfilter/nf_tables_ipv6.h
+++ linux-qcom-6.8.0/include/net/netfilter/nf_tables_ipv6.h
@@ -31,8 +31,8 @@
 	struct ipv6hdr *ip6h, _ip6h;
 	unsigned int thoff = 0;
 	unsigned short frag_off;
+	u32 pkt_len, skb_len;
 	int protohdr;
-	u32 pkt_len;
 
 	ip6h = skb_header_pointer(pkt->skb, skb_network_offset(pkt->skb),
 				  sizeof(*ip6h), &_ip6h);
@@ -43,7 +43,8 @@
 		return -1;
 
 	pkt_len = ntohs(ip6h->payload_len);
-	if (pkt_len + sizeof(*ip6h) > pkt->skb->len)
+	skb_len = pkt->skb->len - skb_network_offset(pkt->skb);
+	if (pkt_len + sizeof(*ip6h) > skb_len)
 		return -1;
 
 	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
--- linux-qcom-6.8.0.orig/include/net/netlabel.h
+++ linux-qcom-6.8.0/include/net/netlabel.h
@@ -97,7 +97,7 @@
 
 /* NetLabel audit information */
 struct netlbl_audit {
-	u32 secid;
+	struct lsmblob blob;
 	kuid_t loginuid;
 	unsigned int sessionid;
 };
--- linux-qcom-6.8.0.orig/include/net/netns/netfilter.h
+++ linux-qcom-6.8.0/include/net/netns/netfilter.h
@@ -15,6 +15,9 @@
 	const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO];
 #ifdef CONFIG_SYSCTL
 	struct ctl_table_header *nf_log_dir_header;
+#ifdef CONFIG_LWTUNNEL
+	struct ctl_table_header *nf_lwtnl_dir_header;
+#endif
 #endif
 	struct nf_hook_entries __rcu *hooks_ipv4[NF_INET_NUMHOOKS];
 	struct nf_hook_entries __rcu *hooks_ipv6[NF_INET_NUMHOOKS];
--- linux-qcom-6.8.0.orig/include/net/route.h
+++ linux-qcom-6.8.0/include/net/route.h
@@ -80,6 +80,17 @@
 				rt_pmtu:31;
 };
 
+#define dst_rtable(_ptr) container_of_const(_ptr, struct rtable, dst)
+
+/**
+ * skb_rtable - Returns the skb &rtable
+ * @skb: buffer
+ */
+static inline struct rtable *skb_rtable(const struct sk_buff *skb)
+{
+	return dst_rtable(skb_dst(skb));
+}
+
 static inline bool rt_is_input_route(const struct rtable *rt)
 {
 	return rt->rt_is_input != 0;
--- linux-qcom-6.8.0.orig/include/net/rtnetlink.h
+++ linux-qcom-6.8.0/include/net/rtnetlink.h
@@ -12,6 +12,7 @@
 enum rtnl_link_flags {
 	RTNL_FLAG_DOIT_UNLOCKED		= BIT(0),
 	RTNL_FLAG_BULK_DEL_SUPPORTED	= BIT(1),
+	RTNL_FLAG_DUMP_UNLOCKED		= BIT(2),
 };
 
 enum rtnl_kinds {
@@ -27,6 +28,15 @@
 	return msgtype & RTNL_KIND_MASK;
 }
 
+struct rtnl_msg_handler {
+	struct module *owner;
+	int protocol;
+	int msgtype;
+	rtnl_doit_func doit;
+	rtnl_dumpit_func dumpit;
+	int flags;
+};
+
 void rtnl_register(int protocol, int msgtype,
 		   rtnl_doit_func, rtnl_dumpit_func, unsigned int flags);
 int rtnl_register_module(struct module *owner, int protocol, int msgtype,
@@ -34,6 +44,14 @@
 int rtnl_unregister(int protocol, int msgtype);
 void rtnl_unregister_all(int protocol);
 
+int __rtnl_register_many(const struct rtnl_msg_handler *handlers, int n);
+void __rtnl_unregister_many(const struct rtnl_msg_handler *handlers, int n);
+
+#define rtnl_register_many(handlers)				\
+	__rtnl_register_many(handlers, ARRAY_SIZE(handlers))
+#define rtnl_unregister_many(handlers)				\
+	__rtnl_unregister_many(handlers, ARRAY_SIZE(handlers))
+
 static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
 {
 	if (nlmsg_len(nlh) >= sizeof(struct rtgenmsg))
--- linux-qcom-6.8.0.orig/include/net/sch_generic.h
+++ linux-qcom-6.8.0/include/net/sch_generic.h
@@ -117,6 +117,7 @@
 	struct qdisc_skb_head	q;
 	struct gnet_stats_basic_sync bstats;
 	struct gnet_stats_queue	qstats;
+	int                     owner;
 	unsigned long		state;
 	unsigned long		state2; /* must be written under qdisc spinlock */
 	struct Qdisc            *next_sched;
@@ -127,6 +128,7 @@
 
 	struct rcu_head		rcu;
 	netdevice_tracker	dev_tracker;
+	struct lock_class_key	root_lock_key;
 	/* private data */
 	long privdata[] ____cacheline_aligned;
 };
@@ -842,7 +844,6 @@
 static inline int qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 				struct sk_buff **to_free)
 {
-	qdisc_calculate_pkt_len(skb, sch);
 	return sch->enqueue(skb, sch, to_free);
 }
 
--- linux-qcom-6.8.0.orig/include/net/scm.h
+++ linux-qcom-6.8.0/include/net/scm.h
@@ -94,16 +94,16 @@
 #ifdef CONFIG_SECURITY_NETWORK
 static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
 {
-	char *secdata;
-	u32 seclen;
+	struct lsmcontext ctx;
 	int err;
 
 	if (test_bit(SOCK_PASSSEC, &sock->flags)) {
-		err = security_secid_to_secctx(scm->secid, &secdata, &seclen);
+		err = security_secid_to_secctx(scm->secid, &ctx);
 
-		if (!err) {
-			put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata);
-			security_release_secctx(secdata, seclen);
+		if (err >= 0) {
+			put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, ctx.len,
+				 ctx.context);
+			security_release_secctx(&ctx);
 		}
 	}
 }
--- linux-qcom-6.8.0.orig/include/net/smc.h
+++ linux-qcom-6.8.0/include/net/smc.h
@@ -63,12 +63,6 @@
 	int (*register_dmb)(struct smcd_dev *dev, struct smcd_dmb *dmb,
 			    struct ism_client *client);
 	int (*unregister_dmb)(struct smcd_dev *dev, struct smcd_dmb *dmb);
-	int (*add_vlan_id)(struct smcd_dev *dev, u64 vlan_id);
-	int (*del_vlan_id)(struct smcd_dev *dev, u64 vlan_id);
-	int (*set_vlan_required)(struct smcd_dev *dev);
-	int (*reset_vlan_required)(struct smcd_dev *dev);
-	int (*signal_event)(struct smcd_dev *dev, struct smcd_gid *rgid,
-			    u32 trigger_irq, u32 event_code, u64 info);
 	int (*move_data)(struct smcd_dev *dev, u64 dmb_tok, unsigned int idx,
 			 bool sf, unsigned int offset, void *data,
 			 unsigned int size);
@@ -76,6 +70,17 @@
 	void (*get_local_gid)(struct smcd_dev *dev, struct smcd_gid *gid);
 	u16 (*get_chid)(struct smcd_dev *dev);
 	struct device* (*get_dev)(struct smcd_dev *dev);
+
+	/* optional operations */
+	int (*add_vlan_id)(struct smcd_dev *dev, u64 vlan_id);
+	int (*del_vlan_id)(struct smcd_dev *dev, u64 vlan_id);
+	int (*set_vlan_required)(struct smcd_dev *dev);
+	int (*reset_vlan_required)(struct smcd_dev *dev);
+	int (*signal_event)(struct smcd_dev *dev, struct smcd_gid *rgid,
+			    u32 trigger_irq, u32 event_code, u64 info);
+	int (*support_dmb_nocopy)(struct smcd_dev *dev);
+	int (*attach_dmb)(struct smcd_dev *dev, struct smcd_dmb *dmb);
+	int (*detach_dmb)(struct smcd_dev *dev, u64 token);
 };
 
 struct smcd_dev {
--- linux-qcom-6.8.0.orig/include/net/sock.h
+++ linux-qcom-6.8.0/include/net/sock.h
@@ -873,6 +873,8 @@
 	hlist_for_each_entry_safe(__sk, tmp, list, sk_node)
 #define sk_for_each_bound(__sk, list) \
 	hlist_for_each_entry(__sk, list, sk_bind_node)
+#define sk_for_each_bound_safe(__sk, tmp, list) \
+	hlist_for_each_entry_safe(__sk, tmp, list, sk_bind_node)
 
 /**
  * sk_for_each_entry_offset_rcu - iterate over a list at a given struct offset
@@ -1429,33 +1431,36 @@
 
 /* 1 MB per cpu, in page units */
 #define SK_MEMORY_PCPU_RESERVE (1 << (20 - PAGE_SHIFT))
+extern int sysctl_mem_pcpu_rsv;
+
+static inline void proto_memory_pcpu_drain(struct proto *proto)
+{
+	int val = this_cpu_xchg(*proto->per_cpu_fw_alloc, 0);
+
+	if (val)
+		atomic_long_add(val, proto->memory_allocated);
+}
 
 static inline void
-sk_memory_allocated_add(struct sock *sk, int amt)
+sk_memory_allocated_add(const struct sock *sk, int val)
 {
-	int local_reserve;
+	struct proto *proto = sk->sk_prot;
 
-	preempt_disable();
-	local_reserve = __this_cpu_add_return(*sk->sk_prot->per_cpu_fw_alloc, amt);
-	if (local_reserve >= SK_MEMORY_PCPU_RESERVE) {
-		__this_cpu_sub(*sk->sk_prot->per_cpu_fw_alloc, local_reserve);
-		atomic_long_add(local_reserve, sk->sk_prot->memory_allocated);
-	}
-	preempt_enable();
+	val = this_cpu_add_return(*proto->per_cpu_fw_alloc, val);
+
+	if (unlikely(val >= READ_ONCE(sysctl_mem_pcpu_rsv)))
+		proto_memory_pcpu_drain(proto);
 }
 
 static inline void
-sk_memory_allocated_sub(struct sock *sk, int amt)
+sk_memory_allocated_sub(const struct sock *sk, int val)
 {
-	int local_reserve;
+	struct proto *proto = sk->sk_prot;
 
-	preempt_disable();
-	local_reserve = __this_cpu_sub_return(*sk->sk_prot->per_cpu_fw_alloc, amt);
-	if (local_reserve <= -SK_MEMORY_PCPU_RESERVE) {
-		__this_cpu_sub(*sk->sk_prot->per_cpu_fw_alloc, local_reserve);
-		atomic_long_add(local_reserve, sk->sk_prot->memory_allocated);
-	}
-	preempt_enable();
+	val = this_cpu_sub_return(*proto->per_cpu_fw_alloc, val);
+
+	if (unlikely(val <= -READ_ONCE(sysctl_mem_pcpu_rsv)))
+		proto_memory_pcpu_drain(proto);
 }
 
 #define SK_ALLOC_PERCPU_COUNTER_BATCH 16
@@ -1601,7 +1606,7 @@
 }
 
 static inline bool
-sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, int size)
+__sk_rmem_schedule(struct sock *sk, int size, bool pfmemalloc)
 {
 	int delta;
 
@@ -1609,7 +1614,13 @@
 		return true;
 	delta = size - sk->sk_forward_alloc;
 	return delta <= 0 || __sk_mem_schedule(sk, delta, SK_MEM_RECV) ||
-		skb_pfmemalloc(skb);
+	       pfmemalloc;
+}
+
+static inline bool
+sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, int size)
+{
+	return __sk_rmem_schedule(sk, size, skb_pfmemalloc(skb));
 }
 
 static inline int sk_unused_reserved_mem(const struct sock *sk)
@@ -1779,6 +1790,13 @@
 #endif
 }
 
+static inline void sock_not_owned_by_me(const struct sock *sk)
+{
+#ifdef CONFIG_LOCKDEP
+	WARN_ON_ONCE(lockdep_sock_is_held(sk) && debug_locks);
+#endif
+}
+
 static inline bool sock_owned_by_user(const struct sock *sk)
 {
 	sock_owned_by_me(sk);
@@ -2145,17 +2163,10 @@
 
 static inline void __dst_negative_advice(struct sock *sk)
 {
-	struct dst_entry *ndst, *dst = __sk_dst_get(sk);
-
-	if (dst && dst->ops->negative_advice) {
-		ndst = dst->ops->negative_advice(dst);
+	struct dst_entry *dst = __sk_dst_get(sk);
 
-		if (ndst != dst) {
-			rcu_assign_pointer(sk->sk_dst_cache, ndst);
-			sk_tx_queue_clear(sk);
-			WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
-		}
-	}
+	if (dst && dst->ops->negative_advice)
+		dst->ops->negative_advice(sk, dst);
 }
 
 static inline void dst_negative_advice(struct sock *sk)
@@ -2184,7 +2195,7 @@
 
 	sk_tx_queue_clear(sk);
 	WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
-	old_dst = xchg((__force struct dst_entry **)&sk->sk_dst_cache, dst);
+	old_dst = unrcu_pointer(xchg(&sk->sk_dst_cache, RCU_INITIALIZER(dst)));
 	dst_release(old_dst);
 }
 
@@ -2791,6 +2802,11 @@
 	return sk->sk_family == AF_UNIX && sk->sk_type == SOCK_STREAM;
 }
 
+static inline bool sk_is_vsock(const struct sock *sk)
+{
+	return sk->sk_family == AF_VSOCK;
+}
+
 /**
  * sk_eat_skb - Release a skb if it is no longer needed
  * @sk: socket to eat this skb from
--- linux-qcom-6.8.0.orig/include/net/tcp.h
+++ linux-qcom-6.8.0/include/net/tcp.h
@@ -353,7 +353,7 @@
 void tcp_rcv_space_adjust(struct sock *sk);
 int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp);
 void tcp_twsk_destructor(struct sock *sk);
-void tcp_twsk_purge(struct list_head *net_exit_list, int family);
+void tcp_twsk_purge(struct list_head *net_exit_list);
 ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos,
 			struct pipe_inode_info *pipe, size_t len,
 			unsigned int flags);
@@ -636,6 +636,7 @@
 /* tcp_input.c */
 void tcp_rearm_rto(struct sock *sk);
 void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req);
+void tcp_done_with_error(struct sock *sk, int err);
 void tcp_reset(struct sock *sk, struct sk_buff *skb);
 void tcp_fin(struct sock *sk);
 void tcp_check_space(struct sock *sk);
@@ -1173,7 +1174,7 @@
 
 struct tcp_congestion_ops *tcp_ca_find(const char *name);
 struct tcp_congestion_ops *tcp_ca_find_key(u32 key);
-u32 tcp_ca_get_key_by_name(struct net *net, const char *name, bool *ecn_ca);
+u32 tcp_ca_get_key_by_name(const char *name, bool *ecn_ca);
 #ifdef CONFIG_INET
 char *tcp_ca_get_name_by_key(u32 key, char *buffer);
 #else
@@ -1494,11 +1495,10 @@
 	return __tcp_space_from_win(tcp_sk(sk)->scaling_ratio, win);
 }
 
-/* Assume a conservative default of 1200 bytes of payload per 4K page.
+/* Assume a 50% default for skb->len/skb->truesize ratio.
  * This may be adjusted later in tcp_measure_rcv_mss().
  */
-#define TCP_DEFAULT_SCALING_RATIO ((1200 << TCP_RMEM_TO_WIN_SCALE) / \
-				   SKB_TRUESIZE(4096))
+#define TCP_DEFAULT_SCALING_RATIO (1 << (TCP_RMEM_TO_WIN_SCALE - 1))
 
 static inline void tcp_scaling_ratio_init(struct sock *sk)
 {
@@ -2391,9 +2391,26 @@
 {
 	const struct sk_buff *skb = tcp_rtx_queue_head(sk);
 	u32 rto = inet_csk(sk)->icsk_rto;
-	u64 rto_time_stamp_us = tcp_skb_timestamp_us(skb) + jiffies_to_usecs(rto);
 
-	return rto_time_stamp_us - tcp_sk(sk)->tcp_mstamp;
+	if (likely(skb)) {
+		u64 rto_time_stamp_us = tcp_skb_timestamp_us(skb) + jiffies_to_usecs(rto);
+
+		return rto_time_stamp_us - tcp_sk(sk)->tcp_mstamp;
+	} else {
+		WARN_ONCE(1,
+			"rtx queue emtpy: "
+			"out:%u sacked:%u lost:%u retrans:%u "
+			"tlp_high_seq:%u sk_state:%u ca_state:%u "
+			"advmss:%u mss_cache:%u pmtu:%u\n",
+			tcp_sk(sk)->packets_out, tcp_sk(sk)->sacked_out,
+			tcp_sk(sk)->lost_out, tcp_sk(sk)->retrans_out,
+			tcp_sk(sk)->tlp_high_seq, sk->sk_state,
+			inet_csk(sk)->icsk_ca_state,
+			tcp_sk(sk)->advmss, tcp_sk(sk)->mss_cache,
+			inet_csk(sk)->icsk_pmtu_cookie);
+		return jiffies_to_usecs(rto);
+	}
+
 }
 
 /*
--- linux-qcom-6.8.0.orig/include/net/tcp_ao.h
+++ linux-qcom-6.8.0/include/net/tcp_ao.h
@@ -86,7 +86,8 @@
 struct tcp_ao_info {
 	/* List of tcp_ao_key's */
 	struct hlist_head	head;
-	/* current_key and rnext_key aren't maintained on listen sockets.
+	/* current_key and rnext_key are maintained on sockets
+	 * in TCP_AO_ESTABLISHED states.
 	 * Their purpose is to cache keys on established connections,
 	 * saving needless lookups. Never dereference any of them from
 	 * listen sockets.
@@ -201,9 +202,9 @@
 };
 
 struct tcp_sigpool;
+/* Established states are fast-path and there always is current_key/rnext_key */
 #define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \
-			    TCPF_CLOSE | TCPF_CLOSE_WAIT | \
-			    TCPF_LAST_ACK | TCPF_CLOSING)
+			    TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING)
 
 int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb,
 			struct tcp_ao_key *key, struct tcphdr *th,
@@ -214,7 +215,8 @@
 		    const u8 *tkey, int hash_offset, u32 sne);
 int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family,
 		 sockptr_t optval, int optlen);
-struct tcp_ao_key *tcp_ao_established_key(struct tcp_ao_info *ao,
+struct tcp_ao_key *tcp_ao_established_key(const struct sock *sk,
+					  struct tcp_ao_info *ao,
 					  int sndid, int rcvid);
 int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk,
 			     struct request_sock *req, struct sk_buff *skb,
--- linux-qcom-6.8.0.orig/include/net/tcx.h
+++ linux-qcom-6.8.0/include/net/tcx.h
@@ -13,7 +13,7 @@
 struct tcx_entry {
 	struct mini_Qdisc __rcu *miniq;
 	struct bpf_mprog_bundle bundle;
-	bool miniq_active;
+	u32 miniq_active;
 	struct rcu_head rcu;
 };
 
@@ -124,11 +124,16 @@
 	tcx_dec();
 }
 
-static inline void tcx_miniq_set_active(struct bpf_mprog_entry *entry,
-					const bool active)
+static inline void tcx_miniq_inc(struct bpf_mprog_entry *entry)
 {
 	ASSERT_RTNL();
-	tcx_entry(entry)->miniq_active = active;
+	tcx_entry(entry)->miniq_active++;
+}
+
+static inline void tcx_miniq_dec(struct bpf_mprog_entry *entry)
+{
+	ASSERT_RTNL();
+	tcx_entry(entry)->miniq_active--;
 }
 
 static inline bool tcx_entry_is_active(struct bpf_mprog_entry *entry)
--- linux-qcom-6.8.0.orig/include/net/tls.h
+++ linux-qcom-6.8.0/include/net/tls.h
@@ -111,7 +111,8 @@
 	u32 stopped : 1;
 	u32 copy_mode : 1;
 	u32 mixed_decrypted : 1;
-	u32 msg_ready : 1;
+
+	bool msg_ready;
 
 	struct strp_msg stm;
 
@@ -389,8 +390,12 @@
 
 static inline bool tls_sw_has_ctx_tx(const struct sock *sk)
 {
-	struct tls_context *ctx = tls_get_ctx(sk);
+	struct tls_context *ctx;
+
+	if (!sk_is_inet(sk) || !inet_test_bit(IS_ICSK, sk))
+		return false;
 
+	ctx = tls_get_ctx(sk);
 	if (!ctx)
 		return false;
 	return !!tls_sw_ctx_tx(ctx);
@@ -398,8 +403,12 @@
 
 static inline bool tls_sw_has_ctx_rx(const struct sock *sk)
 {
-	struct tls_context *ctx = tls_get_ctx(sk);
+	struct tls_context *ctx;
+
+	if (!sk_is_inet(sk) || !inet_test_bit(IS_ICSK, sk))
+		return false;
 
+	ctx = tls_get_ctx(sk);
 	if (!ctx)
 		return false;
 	return !!tls_sw_ctx_rx(ctx);
--- linux-qcom-6.8.0.orig/include/net/vxlan.h
+++ linux-qcom-6.8.0/include/net/vxlan.h
@@ -294,6 +294,8 @@
 	struct net	  *net;		/* netns for packet i/o */
 	struct vxlan_rdst default_dst;	/* default destination */
 
+	struct ip_tunnel_fan fan;
+
 	struct timer_list age_timer;
 	spinlock_t	  hash_lock[FDB_HASH_SIZE];
 	unsigned int	  addrcnt;
--- linux-qcom-6.8.0.orig/include/net/xdp_sock.h
+++ linux-qcom-6.8.0/include/net/xdp_sock.h
@@ -188,6 +188,8 @@
 {
 	if (!compl)
 		return;
+	if (!compl->tx_timestamp)
+		return;
 
 	*compl->tx_timestamp = ops->tmo_fill_timestamp(priv);
 }
--- linux-qcom-6.8.0.orig/include/net/xfrm.h
+++ linux-qcom-6.8.0/include/net/xfrm.h
@@ -176,7 +176,10 @@
 		struct hlist_node	gclist;
 		struct hlist_node	bydst;
 	};
-	struct hlist_node	bysrc;
+	union {
+		struct hlist_node	dev_gclist;
+		struct hlist_node	bysrc;
+	};
 	struct hlist_node	byspi;
 	struct hlist_node	byseq;
 
@@ -339,20 +342,25 @@
 void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
 void xfrm_if_unregister_cb(void);
 
+struct xfrm_dst_lookup_params {
+	struct net *net;
+	int tos;
+	int oif;
+	xfrm_address_t *saddr;
+	xfrm_address_t *daddr;
+	u32 mark;
+	__u8 ipproto;
+	union flowi_uli uli;
+};
+
 struct net_device;
 struct xfrm_type;
 struct xfrm_dst;
 struct xfrm_policy_afinfo {
 	struct dst_ops		*dst_ops;
-	struct dst_entry	*(*dst_lookup)(struct net *net,
-					       int tos, int oif,
-					       const xfrm_address_t *saddr,
-					       const xfrm_address_t *daddr,
-					       u32 mark);
-	int			(*get_saddr)(struct net *net, int oif,
-					     xfrm_address_t *saddr,
-					     xfrm_address_t *daddr,
-					     u32 mark);
+	struct dst_entry	*(*dst_lookup)(const struct xfrm_dst_lookup_params *params);
+	int			(*get_saddr)(xfrm_address_t *saddr,
+					     const struct xfrm_dst_lookup_params *params);
 	int			(*fill_dst)(struct xfrm_dst *xdst,
 					    struct net_device *dev,
 					    const struct flowi *fl);
@@ -1047,6 +1055,9 @@
 #define CRYPTO_INVALID_PACKET_SYNTAX		64
 #define CRYPTO_INVALID_PROTOCOL			128
 
+	/* Used to keep whole l2 header for transport mode GRO */
+	__u32			orig_mac_len;
+
 	__u8			proto;
 	__u8			inner_ipproto;
 };
@@ -1581,7 +1592,7 @@
 static inline void xfrm_dev_state_update_curlft(struct xfrm_state *x)
 {
 	struct xfrm_dev_offload *xdo = &x->xso;
-	struct net_device *dev = xdo->dev;
+	struct net_device *dev = READ_ONCE(xdo->dev);
 
 	if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET)
 		return;
@@ -1724,10 +1735,7 @@
 }
 #endif
 
-struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,
-				    const xfrm_address_t *saddr,
-				    const xfrm_address_t *daddr,
-				    int family, u32 mark);
+struct dst_entry *__xfrm_dst_lookup(int family, const struct xfrm_dst_lookup_params *params);
 
 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
 
@@ -1942,13 +1950,16 @@
 			struct xfrm_user_offload *xuo, u8 dir,
 			struct netlink_ext_ack *extack);
 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
+void xfrm_dev_state_delete(struct xfrm_state *x);
+void xfrm_dev_state_free(struct xfrm_state *x);
 
 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
 {
 	struct xfrm_dev_offload *xso = &x->xso;
+	struct net_device *dev = READ_ONCE(xso->dev);
 
-	if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn)
-		xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
+	if (dev && dev->xfrmdev_ops->xdo_dev_state_advance_esn)
+		dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
 }
 
 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
@@ -1969,28 +1980,6 @@
 	return false;
 }
 
-static inline void xfrm_dev_state_delete(struct xfrm_state *x)
-{
-	struct xfrm_dev_offload *xso = &x->xso;
-
-	if (xso->dev)
-		xso->dev->xfrmdev_ops->xdo_dev_state_delete(x);
-}
-
-static inline void xfrm_dev_state_free(struct xfrm_state *x)
-{
-	struct xfrm_dev_offload *xso = &x->xso;
-	struct net_device *dev = xso->dev;
-
-	if (dev && dev->xfrmdev_ops) {
-		if (dev->xfrmdev_ops->xdo_dev_state_free)
-			dev->xfrmdev_ops->xdo_dev_state_free(x);
-		xso->dev = NULL;
-		xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED;
-		netdev_put(dev, &xso->dev_tracker);
-	}
-}
-
 static inline void xfrm_dev_policy_delete(struct xfrm_policy *x)
 {
 	struct xfrm_dev_offload *xdo = &x->xdo;
--- linux-qcom-6.8.0.orig/include/rdma/ib_verbs.h
+++ linux-qcom-6.8.0/include/rdma/ib_verbs.h
@@ -2940,6 +2940,14 @@
 				      size_t length, u32 min_pgoff,
 				      u32 max_pgoff);
 
+#if IS_ENABLED(CONFIG_INFINIBAND_USER_ACCESS)
+void rdma_user_mmap_disassociate(struct ib_device *device);
+#else
+static inline void rdma_user_mmap_disassociate(struct ib_device *device)
+{
+}
+#endif
+
 static inline int
 rdma_user_mmap_entry_insert_exact(struct ib_ucontext *ucontext,
 				  struct rdma_user_mmap_entry *entry,
--- linux-qcom-6.8.0.orig/include/scsi/scsi_cmnd.h
+++ linux-qcom-6.8.0/include/scsi/scsi_cmnd.h
@@ -234,7 +234,7 @@
 
 static inline unsigned int scsi_logical_block_count(struct scsi_cmnd *scmd)
 {
-	unsigned int shift = ilog2(scmd->device->sector_size) - SECTOR_SHIFT;
+	unsigned int shift = ilog2(scmd->device->sector_size);
 
 	return blk_rq_bytes(scsi_cmd_to_rq(scmd)) >> shift;
 }
--- linux-qcom-6.8.0.orig/include/scsi/scsi_driver.h
+++ linux-qcom-6.8.0/include/scsi/scsi_driver.h
@@ -12,6 +12,7 @@
 struct scsi_driver {
 	struct device_driver	gendrv;
 
+	int (*resume)(struct device *);
 	void (*rescan)(struct device *);
 	blk_status_t (*init_command)(struct scsi_cmnd *);
 	void (*uninit_command)(struct scsi_cmnd *);
--- linux-qcom-6.8.0.orig/include/scsi/scsi_host.h
+++ linux-qcom-6.8.0/include/scsi/scsi_host.h
@@ -767,6 +767,7 @@
 #define scsi_template_proc_dir(sht) NULL
 #endif
 extern void scsi_scan_host(struct Scsi_Host *);
+extern int scsi_resume_device(struct scsi_device *sdev);
 extern int scsi_rescan_device(struct scsi_device *sdev);
 extern void scsi_remove_host(struct Scsi_Host *);
 extern struct Scsi_Host *scsi_host_get(struct Scsi_Host *);
--- linux-qcom-6.8.0.orig/include/scsi/scsi_transport_sas.h
+++ linux-qcom-6.8.0/include/scsi/scsi_transport_sas.h
@@ -200,6 +200,8 @@
 void sas_disable_tlr(struct scsi_device *);
 void sas_enable_tlr(struct scsi_device *);
 
+bool sas_ata_ncq_prio_supported(struct scsi_device *sdev);
+
 extern struct sas_rphy *sas_end_device_alloc(struct sas_port *);
 extern struct sas_rphy *sas_expander_alloc(struct sas_port *, enum sas_device_type);
 void sas_rphy_free(struct sas_rphy *);
--- linux-qcom-6.8.0.orig/include/soc/mscc/ocelot.h
+++ linux-qcom-6.8.0/include/soc/mscc/ocelot.h
@@ -778,7 +778,6 @@
 
 	phy_interface_t			phy_mode;
 
-	unsigned int			ptp_skbs_in_flight;
 	struct sk_buff_head		tx_skbs;
 
 	unsigned int			trap_proto;
@@ -786,7 +785,6 @@
 	u16				mrp_ring_id;
 
 	u8				ptp_cmd;
-	u8				ts_id;
 
 	u8				index;
 
@@ -813,6 +811,9 @@
 	const u32 *const		*map;
 	struct list_head		stats_regions;
 
+	spinlock_t			inj_lock;
+	spinlock_t			xtr_lock;
+
 	u32				pool_size[OCELOT_SB_NUM][OCELOT_SB_POOL_NUM];
 	int				packet_buffer_size;
 	int				num_frame_refs;
@@ -966,10 +967,17 @@
 			      u32 val, u32 reg, u32 offset);
 
 /* Packet I/O */
+void ocelot_lock_inj_grp(struct ocelot *ocelot, int grp);
+void ocelot_unlock_inj_grp(struct ocelot *ocelot, int grp);
+void ocelot_lock_xtr_grp(struct ocelot *ocelot, int grp);
+void ocelot_unlock_xtr_grp(struct ocelot *ocelot, int grp);
+void ocelot_lock_xtr_grp_bh(struct ocelot *ocelot, int grp);
+void ocelot_unlock_xtr_grp_bh(struct ocelot *ocelot, int grp);
 bool ocelot_can_inject(struct ocelot *ocelot, int grp);
 void ocelot_port_inject_frame(struct ocelot *ocelot, int port, int grp,
 			      u32 rew_op, struct sk_buff *skb);
-void ocelot_ifh_port_set(void *ifh, int port, u32 rew_op, u32 vlan_tag);
+void ocelot_ifh_set_basic(void *ifh, struct ocelot *ocelot, int port,
+			  u32 rew_op, struct sk_buff *skb);
 int ocelot_xtr_poll_frame(struct ocelot *ocelot, int grp, struct sk_buff **skb);
 void ocelot_drain_cpu_queue(struct ocelot *ocelot, int grp);
 void ocelot_ptp_rx_timestamp(struct ocelot *ocelot, struct sk_buff *skb,
--- linux-qcom-6.8.0.orig/include/soc/qcom/cmd-db.h
+++ linux-qcom-6.8.0/include/soc/qcom/cmd-db.h
@@ -1,5 +1,8 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. */
+/*
+ * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
 
 #ifndef __QCOM_COMMAND_DB_H__
 #define __QCOM_COMMAND_DB_H__
@@ -21,6 +24,8 @@
 
 const void *cmd_db_read_aux_data(const char *resource_id, size_t *len);
 
+bool cmd_db_match_resource_addr(u32 addr1, u32 addr2);
+
 enum cmd_db_hw_type cmd_db_read_slave_id(const char *resource_id);
 
 int cmd_db_ready(void);
@@ -31,6 +36,9 @@
 static inline const void *cmd_db_read_aux_data(const char *resource_id, size_t *len)
 { return ERR_PTR(-ENODEV); }
 
+static inline bool cmd_db_match_resource_addr(u32 addr1, u32 addr2)
+{ return false; }
+
 static inline enum cmd_db_hw_type cmd_db_read_slave_id(const char *resource_id)
 { return -ENODEV; }
 
--- linux-qcom-6.8.0.orig/include/soc/qcom/ice.h
+++ linux-qcom-6.8.0/include/soc/qcom/ice.h
@@ -7,6 +7,7 @@
 #define __QCOM_ICE_H__
 
 #include <linux/types.h>
+#include <linux/blk-crypto.h>
 
 struct qcom_ice;
 
@@ -16,6 +17,7 @@
 	QCOM_ICE_CRYPTO_KEY_SIZE_192		= 0x2,
 	QCOM_ICE_CRYPTO_KEY_SIZE_256		= 0x3,
 	QCOM_ICE_CRYPTO_KEY_SIZE_512		= 0x4,
+	QCOM_ICE_CRYPTO_KEY_SIZE_WRAPPED	= 0x5,
 };
 
 enum qcom_ice_crypto_alg {
@@ -30,8 +32,21 @@
 int qcom_ice_suspend(struct qcom_ice *ice);
 int qcom_ice_program_key(struct qcom_ice *ice,
 			 u8 algorithm_id, u8 key_size,
-			 const u8 crypto_key[], u8 data_unit_size,
-			 int slot);
+			 const struct blk_crypto_key *bkey,
+			 u8 data_unit_size, int slot);
 int qcom_ice_evict_key(struct qcom_ice *ice, int slot);
+bool qcom_ice_hwkm_supported(struct qcom_ice *ice);
+int qcom_ice_derive_sw_secret(struct qcom_ice *ice, const u8 wkey[],
+			      unsigned int wkey_size,
+			      u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE]);
+int qcom_ice_generate_key(struct qcom_ice *ice,
+			  u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+int qcom_ice_prepare_key(struct qcom_ice *ice,
+			 const u8 *lt_key, size_t lt_key_size,
+			 u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+int qcom_ice_import_key(struct qcom_ice *ice,
+			const u8 *imp_key, size_t imp_key_size,
+			u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+int qcom_ice_scale_clk(struct qcom_ice *ice, bool scale_up);
 struct qcom_ice *of_qcom_ice_get(struct device *dev);
 #endif /* __QCOM_ICE_H__ */
--- linux-qcom-6.8.0.orig/include/soc/qcom/memory_dump.h
+++ linux-qcom-6.8.0/include/soc/qcom/memory_dump.h
@@ -0,0 +1,136 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012, 2014-2017, 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __MSM_MEMORY_DUMP_H
+#define __MSM_MEMORY_DUMP_H
+
+#include <linux/errno.h>
+#include <linux/types.h>
+
+enum dump_client_type {
+	MSM_CPU_CTXT = 0,
+	MSM_L1_CACHE,
+	MSM_L2_CACHE,
+	MSM_OCMEM,
+	MSM_TMC_ETFETB,
+	MSM_ETM0_REG,
+	MSM_ETM1_REG,
+	MSM_ETM2_REG,
+	MSM_ETM3_REG,
+	MSM_TMC0_REG, /* TMC_ETR */
+	MSM_TMC1_REG, /* TMC_ETF */
+	MSM_LOG_BUF,
+	MSM_LOG_BUF_FIRST_IDX,
+	MAX_NUM_CLIENTS,
+};
+
+struct msm_client_dump {
+	enum dump_client_type id;
+	unsigned long start_addr;
+	unsigned long end_addr;
+};
+
+#ifdef CONFIG_QCOM_MEMORY_DUMP
+extern int msm_dump_tbl_register(struct msm_client_dump *client_entry);
+#else
+static inline int msm_dump_tbl_register(struct msm_client_dump *entry)
+{
+	return -EIO;
+}
+#endif
+
+
+#if IS_ENABLED(CONFIG_QCOM_MEMORY_DUMP_V2)
+extern uint32_t msm_dump_table_version(void);
+#else
+static inline uint32_t msm_dump_table_version(void)
+{
+	return 0;
+}
+#endif
+
+#define MSM_DUMP_MAKE_VERSION(ma, mi)	((ma << 20) | mi)
+#define MSM_DUMP_MAJOR(val)		(val >> 20)
+#define MSM_DUMP_MINOR(val)		(val & 0xFFFFF)
+
+
+#define MAX_NUM_ENTRIES		0x150
+
+enum msm_dump_data_ids {
+	MSM_DUMP_DATA_CPU_CTX = 0x00,
+	MSM_DUMP_DATA_L1_INST_CACHE = 0x60,
+	MSM_DUMP_DATA_L1_DATA_CACHE = 0x80,
+	MSM_DUMP_DATA_ETM_REG = 0xA0,
+	MSM_DUMP_DATA_L2_CACHE = 0xC0,
+	MSM_DUMP_DATA_L3_CACHE = 0xD0,
+	MSM_DUMP_DATA_OCMEM = 0xE0,
+	MSM_DUMP_DATA_CNSS_WLAN = 0xE1,
+	MSM_DUMP_DATA_WIGIG = 0xE2,
+	MSM_DUMP_DATA_PMIC = 0xE4,
+	MSM_DUMP_DATA_DBGUI_REG = 0xE5,
+	MSM_DUMP_DATA_DCC_REG = 0xE6,
+	MSM_DUMP_DATA_DCC_SRAM = 0xE7,
+	MSM_DUMP_DATA_MISC = 0xE8,
+	MSM_DUMP_DATA_VSENSE = 0xE9,
+	MSM_DUMP_DATA_RPM = 0xEA,
+	MSM_DUMP_DATA_SCANDUMP = 0xEB,
+	MSM_DUMP_DATA_RPMH = 0xEC,
+	MSM_DUMP_DATA_TMC_ETF = 0xF0,
+	MSM_DUMP_DATA_TMC_ETF_SWAO = 0xF1,
+	MSM_DUMP_DATA_TMC_REG = 0x100,
+	MSM_DUMP_DATA_TMC_ETF_SWAO_REG = 0x102,
+	MSM_DUMP_DATA_LOG_BUF = 0x110,
+	MSM_DUMP_DATA_LOG_BUF_FIRST_IDX = 0x111,
+	MSM_DUMP_DATA_SCANDUMP_PER_CPU = 0x130,
+	MSM_DUMP_DATA_LLCC_PER_INSTANCE = 0x140,
+	MSM_DUMP_DATA_MAX = MAX_NUM_ENTRIES,
+};
+
+enum msm_dump_table_ids {
+	MSM_DUMP_TABLE_APPS,
+	MSM_DUMP_TABLE_MAX = MAX_NUM_ENTRIES,
+};
+
+enum msm_dump_type {
+	MSM_DUMP_TYPE_DATA,
+	MSM_DUMP_TYPE_TABLE,
+};
+
+struct msm_dump_data {
+	uint32_t version;
+	uint32_t magic;
+	char name[32];
+	uint64_t addr;
+	uint64_t len;
+	uint32_t reserved;
+};
+
+struct msm_dump_entry {
+	uint32_t id;
+	char name[32];
+	uint32_t type;
+	uint64_t addr;
+};
+
+#if IS_ENABLED(CONFIG_QCOM_MEMORY_DUMP_V2)
+extern int msm_dump_data_register(enum msm_dump_table_ids id,
+				  struct msm_dump_entry *entry);
+extern int msm_dump_data_register_nominidump(enum msm_dump_table_ids id,
+				  struct msm_dump_entry *entry);
+#else
+static inline int msm_dump_data_register(enum msm_dump_table_ids id,
+					 struct msm_dump_entry *entry)
+{
+	return -EINVAL;
+}
+static inline int msm_dump_data_register_nominidump(enum msm_dump_table_ids id,
+					 struct msm_dump_entry *entry)
+{
+	return -EINVAL;
+}
+#endif
+
+#endif
--- linux-qcom-6.8.0.orig/include/soc/qcom/qcom-spmi-pmic.h
+++ linux-qcom-6.8.0/include/soc/qcom/qcom-spmi-pmic.h
@@ -49,7 +49,7 @@
 #define PMK8350_SUBTYPE		0x2f
 #define PMR735B_SUBTYPE		0x34
 #define PM6350_SUBTYPE		0x36
-#define PM2250_SUBTYPE		0x37
+#define PM4125_SUBTYPE		0x37
 
 #define PMI8998_FAB_ID_SMIC	0x11
 #define PMI8998_FAB_ID_GF	0x30
--- linux-qcom-6.8.0.orig/include/soc/qcom/qup_fw_load.h
+++ linux-qcom-6.8.0/include/soc/qcom/qup_fw_load.h
@@ -0,0 +1,179 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _LINUX_QCOM_QUP_FW_LOAD
+#define _LINUX_QCOM_QUP_FW_LOAD
+
+#include <linux/device.h>
+#include <linux/elf.h>
+#include <linux/firmware.h>
+#include <linux/kernel.h>
+
+/*Magic numbers*/
+#define MAGIC_NUM_SE			0x57464553
+
+/* Common SE registers*/
+#define GENI_INIT_CFG_REVISION		0x0
+#define GENI_S_INIT_CFG_REVISION	0x4
+#define GENI_FORCE_DEFAULT_REG		0x20
+#define GENI_CGC_CTRL			0x28
+#define GENI_CFG_REG0			0x100
+
+#define	QUPV3_SE_HW_PARAM_1		0xE28
+#define	RX_FIFO_WIDTH_BIT		24
+#define	RX_FIFO_WIDTH_MASK		0x3F
+
+/*Same registers as GENI_DMA_MODE_EN*/
+#define QUPV3_SE_GENI_DMA_MODE_EN	0x258
+#define GENI_M_IRQ_ENABLE		0x614
+#define GENI_S_IRQ_ENABLE		0x644
+#define GENI_RX_RFR_WATERMARK_REG	0x814
+#define DMA_TX_IRQ_EN_SET		0xC4C
+#define DMA_RX_IRQ_EN_SET		0xD4C
+#define DMA_GENERAL_CFG			0xE30
+#define SE_GENI_FW_REVISION		0x1000
+#define SE_S_FW_REVISION		0x1004
+#define SE_GENI_CFG_RAMN		0x1010
+#define SE_GENI_CLK_CTRL		0x2000
+#define SE_DMA_IF_EN			0x2004
+#define SE_FIFO_IF_DISABLE		0x2008
+
+#define MAX_GENI_CFG_RAMn_CNT		455
+
+#define MI_PBT_NON_PAGED_SEGMENT	0x0
+#define MI_PBT_HASH_SEGMENT		0x2
+#define MI_PBT_NOTUSED_SEGMENT		0x3
+#define MI_PBT_SHARED_SEGMENT		0x4
+#define MI_PBT_FLAG_PAGE_MODE_MASK	0x100000
+#define MI_PBT_FLAG_PAGE_MODE_SHIFT	0x14
+#define MI_PBT_FLAG_SEGMENT_TYPE_MASK	0x7000000
+#define MI_PBT_FLAG_SEGMENT_TYPE_SHIFT	0x18
+#define MI_PBT_FLAG_ACCESS_TYPE_MASK	0xE00000
+#define MI_PBT_FLAG_ACCESS_TYPE_SHIFT	0x15
+
+#define MI_PBT_PAGE_MODE_VALUE(x) \
+	(((x) & MI_PBT_FLAG_PAGE_MODE_MASK) >> \
+	  MI_PBT_FLAG_PAGE_MODE_SHIFT)
+
+#define MI_PBT_SEGMENT_TYPE_VALUE(x) \
+	(((x) & MI_PBT_FLAG_SEGMENT_TYPE_MASK) >> \
+		MI_PBT_FLAG_SEGMENT_TYPE_SHIFT)
+
+#define MI_PBT_ACCESS_TYPE_VALUE(x) \
+	(((x) & MI_PBT_FLAG_ACCESS_TYPE_MASK) >> \
+	  MI_PBT_FLAG_ACCESS_TYPE_SHIFT)
+
+/* GENI_FORCE_DEFAULT_REG fields */
+#define FORCE_DEFAULT			BIT(0)
+
+/* FW_REVISION_RO fields */
+#define FW_REV_PROTOCOL_SHFT		8
+#define FW_REV_VERSION_SHFT		0
+
+#define GENI_FW_REVISION_RO		0x68
+#define GENI_S_FW_REVISION_RO		0x6C
+
+/* SE_GENI_DMA_MODE_EN */
+#define GENI_DMA_MODE_EN		BIT(0)
+
+/* GENI_M_IRQ_EN fields */
+#define M_CMD_DONE_EN			BIT(0)
+#define M_IO_DATA_DEASSERT_EN		BIT(22)
+#define M_IO_DATA_ASSERT_EN		BIT(23)
+#define M_RX_FIFO_RD_ERR_EN		BIT(24)
+#define M_RX_FIFO_WR_ERR_EN		BIT(25)
+#define M_RX_FIFO_WATERMARK_EN		BIT(26)
+#define M_RX_FIFO_LAST_EN		BIT(27)
+#define M_TX_FIFO_RD_ERR_EN		BIT(28)
+#define M_TX_FIFO_WR_ERR_EN		BIT(29)
+#define M_TX_FIFO_WATERMARK_EN		BIT(30)
+#define M_COMMON_GENI_M_IRQ_EN	(GENMASK(6, 1) | \
+				M_IO_DATA_DEASSERT_EN | \
+				M_IO_DATA_ASSERT_EN | M_RX_FIFO_RD_ERR_EN | \
+				M_RX_FIFO_WR_ERR_EN | M_TX_FIFO_RD_ERR_EN | \
+				M_TX_FIFO_WR_ERR_EN)
+
+/* GENI_S_IRQ_EN fields */
+#define S_CMD_OVERRUN_EN		BIT(1)
+#define S_ILLEGAL_CMD_EN		BIT(2)
+#define S_CMD_CANCEL_EN			BIT(4)
+#define S_CMD_ABORT_EN			BIT(5)
+#define S_GP_IRQ_0_EN			BIT(9)
+#define S_GP_IRQ_1_EN			BIT(10)
+#define S_GP_IRQ_2_EN			BIT(11)
+#define S_GP_IRQ_3_EN			BIT(12)
+#define S_RX_FIFO_RD_ERR_EN		BIT(24)
+#define S_RX_FIFO_WR_ERR_EN		BIT(25)
+#define S_COMMON_GENI_S_IRQ_EN	(GENMASK(5, 1) | GENMASK(13, 9) | \
+				 S_RX_FIFO_RD_ERR_EN | S_RX_FIFO_WR_ERR_EN)
+
+#define GENI_CGC_CTRL_PROG_RAM_SCLK_OFF_BMSK		0x00000200
+#define GENI_CGC_CTRL_PROG_RAM_HCLK_OFF_BMSK		0x00000100
+
+#define GENI_DMA_MODE_EN_GENI_DMA_MODE_EN_BMSK		0x00000001
+
+#define DMA_TX_IRQ_EN_SET_RESET_DONE_EN_SET_BMSK	0x00000008
+#define DMA_TX_IRQ_EN_SET_SBE_EN_SET_BMSK		0x00000004
+#define DMA_TX_IRQ_EN_SET_DMA_DONE_EN_SET_BMSK		0x00000001
+
+#define DMA_RX_IRQ_EN_SET_FLUSH_DONE_EN_SET_BMSK	0x00000010
+#define DMA_RX_IRQ_EN_SET_RESET_DONE_EN_SET_BMSK	0x00000008
+#define DMA_RX_IRQ_EN_SET_SBE_EN_SET_BMSK		0x00000004
+#define DMA_RX_IRQ_EN_SET_DMA_DONE_EN_SET_BMSK		0x00000001
+
+#define DMA_GENERAL_CFG_AHB_SEC_SLV_CLK_CGC_ON_BMSK	0x00000008
+#define DMA_GENERAL_CFG_DMA_AHB_SLV_CLK_CGC_ON_BMSK	0x00000004
+#define DMA_GENERAL_CFG_DMA_TX_CLK_CGC_ON_BMSK		0x00000002
+#define DMA_GENERAL_CFG_DMA_RX_CLK_CGC_ON_BMSK		0x00000001
+
+#define GENI_CLK_CTRL_SER_CLK_SEL_BMSK			0x00000001
+#define DMA_IF_EN_DMA_IF_EN_BMSK			0x00000001
+#define SE_GSI_EVENT_EN_BMSK				0x0000000f
+#define SE_IRQ_EN_RMSK					0x0000000f
+
+#define QUPV3_COMMON_CFG				0x0120
+#define FAST_SWITCH_TO_HIGH_DISABLE_BMASK		0x00000001
+
+#define QUPV3_SE_AHB_M_CFG				0x0118
+#define AHB_M_CLK_CGC_ON_BMASK				0x00000001
+
+#define QUPV3_COMMON_CGC_CTRL				0x021C
+#define COMMON_CSR_SLV_CLK_CGC_ON_BMASK			0x00000001
+
+/* access ports */
+#define setbits32(_addr, _v) out_be32((_addr), in_be32(_addr) |  (_v))
+#define clrbits32(_addr, _v) out_be32((_addr), in_be32(_addr) & ~(_v))
+
+#define out_be32(a, v) writel_relaxed(v, a)
+#define in_be32(a) readl_relaxed(a)
+
+/**
+ * struct elf_se_hdr - firmware configurations
+ *
+ * @magic: set to 'SEFW'
+ * @version: A 32-bit value indicating the structure’s version number
+ * @core_version: QUPV3_HW_VERSION
+ * @serial_protocol: Programmed into GENI_FW_REVISION
+ * @fw_version: Programmed into GENI_FW_REVISION
+ * @cfg_version: Programmed into GENI_INIT_CFG_REVISION
+ * @fw_size_in_items: Number of (uint32_t) GENI_FW_RAM words
+ * @fw_offset: Byte offset of GENI_FW_RAM array
+ * @cfg_size_in_items: Number of GENI_FW_CFG index/value pairs
+ * @cfg_idx_offset: Byte offset of GENI_FW_CFG index array
+ * @cfg_val_offset: Byte offset of GENI_FW_CFG values array
+ */
+struct elf_se_hdr {
+	u32 magic;
+	u32 version;
+	u32 core_version;
+	u16 serial_protocol;
+	u16 fw_version;
+	u16 cfg_version;
+	u16 fw_size_in_items;
+	u16 fw_offset;
+	u16 cfg_size_in_items;
+	u16 cfg_idx_offset;
+	u16 cfg_val_offset;
+};
+#endif /* _LINUX_QCOM_QUP_FW_LOAD */
--- linux-qcom-6.8.0.orig/include/soc/qcom/secure_buffer.h
+++ linux-qcom-6.8.0/include/soc/qcom/secure_buffer.h
@@ -0,0 +1,93 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __QCOM_SECURE_BUFFER_H__
+#define __QCOM_SECURE_BUFFER_H__
+
+#include <linux/scatterlist.h>
+
+/*
+ * if you add a secure VMID here make sure you update
+ * msm_secure_vmid_to_string.
+ * Make sure to keep the VMID_LAST as the last entry in the enum.
+ * This is needed in ion to create a list and it's sized using VMID_LAST.
+ */
+enum vmid {
+	VMID_TZ = 0x1,
+	VMID_HLOS = 0x3,
+	VMID_CP_TOUCH = 0x8,
+	VMID_CP_BITSTREAM = 0x9,
+	VMID_CP_PIXEL = 0xA,
+	VMID_CP_NON_PIXEL = 0xB,
+	VMID_CP_CAMERA = 0xD,
+	VMID_HLOS_FREE = 0xE,
+	VMID_MSS_MSA = 0xF,
+	VMID_MSS_NONMSA = 0x10,
+	VMID_CP_SEC_DISPLAY = 0x11,
+	VMID_CP_APP = 0x12,
+	VMID_LPASS = 0x16,
+	VMID_WLAN = 0x18,
+	VMID_WLAN_CE = 0x19,
+	VMID_CP_SPSS_SP = 0x1A,
+	VMID_CP_CAMERA_PREVIEW = 0x1D,
+	VMID_CP_SPSS_SP_SHARED = 0x22,
+	VMID_CP_SPSS_HLOS_SHARED = 0x24,
+	VMID_ADSP_HEAP = 0x25,
+	VMID_CP_CDSP = 0x2A,
+	VMID_NAV = 0x2B,
+	VMID_TVM = 0x2D,
+	VMID_OEMVM = 0x31,
+	VMID_LAST,
+	VMID_INVAL = -1
+};
+
+#define PERM_READ                       0x4
+#define PERM_WRITE                      0x2
+#define PERM_EXEC			0x1
+
+#if IS_ENABLED(CONFIG_QCOM_SECURE_BUFFER)
+int hyp_assign_table(struct sg_table *table,
+			u32 *source_vm_list, int source_nelems,
+			int *dest_vmids, int *dest_perms,
+			int dest_nelems);
+int hyp_assign_phys(phys_addr_t addr, u64 size,
+			u32 *source_vmlist, int source_nelems,
+			int *dest_vmids, int *dest_perms, int dest_nelems);
+const char *msm_secure_vmid_to_string(int secure_vmid);
+u32 msm_secure_get_vmid_perms(u32 vmid);
+int page_accessible(unsigned long pfn);
+#else
+static inline int hyp_assign_table(struct sg_table *table,
+			u32 *source_vm_list, int source_nelems,
+			int *dest_vmids, int *dest_perms,
+			int dest_nelems)
+{
+	return -EINVAL;
+}
+
+static inline int hyp_assign_phys(phys_addr_t addr, u64 size,
+			u32 *source_vmlist, int source_nelems,
+			int *dest_vmids, int *dest_perms, int dest_nelems)
+{
+	return -EINVAL;
+}
+
+static inline const char *msm_secure_vmid_to_string(int secure_vmid)
+{
+	return "N/A";
+}
+
+static inline u32 msm_secure_get_vmid_perms(u32 vmid)
+{
+	return 0;
+}
+
+static inline int page_accessible(unsigned long pfn)
+{
+	return 1;
+}
+#endif
+#endif
--- linux-qcom-6.8.0.orig/include/soc/qcom/smci_clientenv.h
+++ linux-qcom-6.8.0/include/soc/qcom/smci_clientenv.h
@@ -0,0 +1,159 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define IClientEnv_OP_open 0
+#define IClientEnv_OP_registerLegacy 1
+#define IClientEnv_OP_register 2
+#define IClientEnv_OP_registerWithWhitelist 3
+#define IClientEnv_OP_notifyDomainChange 4
+#define IClientEnv_OP_registerWithCredentials 5
+#define IClientEnv_OP_loadCmnlibFromBuffer 6
+#define IClientEnv_OP_configTaRegion 7
+#define IClientEnv_OP_adciAccept 8
+#define IClientEnv_OP_adciShutdown 9
+
+#include <soc/qcom/smci_object.h>
+
+static inline int32_t
+IClientEnv_release(struct Object self)
+{
+	return Object_invoke(self, Object_OP_release, 0, 0);
+}
+
+static inline int32_t
+IClientEnv_retain(struct Object self)
+{
+	return Object_invoke(self, Object_OP_retain, 0, 0);
+}
+
+static inline int32_t
+IClientEnv_open(struct Object self, uint32_t uid_val, struct Object *obj_ptr)
+{
+	union ObjectArg a[2];
+	int32_t result;
+
+	a[0].b = (struct ObjectBuf) { &uid_val, sizeof(uint32_t) };
+
+	result = Object_invoke(self, IClientEnv_OP_open, a, ObjectCounts_pack(1, 0, 0, 1));
+
+	*obj_ptr = a[1].o;
+
+	return result;
+}
+
+static inline int32_t
+IClientEnv_registerLegacy(struct Object self, const void *credentials_ptr, size_t credentials_len,
+		struct Object *clientEnv_ptr)
+{
+	union ObjectArg a[2];
+	int32_t result;
+
+	a[0].bi = (struct ObjectBufIn) { credentials_ptr, credentials_len * 1 };
+
+	result = Object_invoke(self, IClientEnv_OP_registerLegacy, a,
+			ObjectCounts_pack(1, 0, 0, 1));
+
+	*clientEnv_ptr = a[1].o;
+
+	return result;
+}
+
+static inline int32_t
+IClientEnv_register(struct Object self, struct Object credentials_val,
+		struct Object *clientEnv_ptr)
+{
+	union ObjectArg a[2];
+	int32_t result;
+
+	a[0].o = credentials_val;
+
+	result = Object_invoke(self, IClientEnv_OP_register, a,
+			ObjectCounts_pack(0, 0, 1, 1));
+
+	*clientEnv_ptr = a[1].o;
+
+	return result;
+}
+
+static inline int32_t
+IClientEnv_registerWithWhitelist(struct Object self,
+		struct Object credentials_val, const uint32_t *uids_ptr,
+		size_t uids_len, struct Object *clientEnv_ptr)
+{
+	union ObjectArg a[3];
+	int32_t result;
+
+	a[1].o = credentials_val;
+	a[0].bi = (struct ObjectBufIn) { uids_ptr, uids_len *
+		sizeof(uint32_t) };
+
+	result = Object_invoke(self, IClientEnv_OP_registerWithWhitelist, a,
+			ObjectCounts_pack(1, 0, 1, 1));
+
+	*clientEnv_ptr = a[2].o;
+
+	return result;
+}
+
+static inline int32_t
+IClientEnv_notifyDomainChange(struct Object self)
+{
+	return Object_invoke(self, IClientEnv_OP_notifyDomainChange, 0, 0);
+}
+
+static inline int32_t
+IClientEnv_registerWithCredentials(struct Object self, struct Object
+		credentials_val, struct Object *clientEnv_ptr)
+{
+	union ObjectArg a[2] = {{{0, 0}}};
+	int32_t result;
+
+	a[0].o = credentials_val;
+
+	result = Object_invoke(self, IClientEnv_OP_registerWithCredentials, a,
+			ObjectCounts_pack(0, 0, 1, 1));
+
+	*clientEnv_ptr = a[1].o;
+
+	return result;
+}
+
+static inline int32_t
+IClientEnv_loadCmnlibFromBuffer(struct Object self, const void *cmnlibElf_ptr, size_t cmnlibElf_len)
+{
+	union ObjectArg a[1] = {{{0, 0}}};
+
+	a[0].bi = (struct ObjectBufIn) { cmnlibElf_ptr, cmnlibElf_len * 1 };
+	return Object_invoke(self, IClientEnv_OP_loadCmnlibFromBuffer,
+			a, ObjectCounts_pack(1, 0, 0, 0));
+}
+
+static inline int32_t
+IClientEnv_configTaRegion(struct Object self, uint64_t appRgnAddr_val, uint32_t appRgnSize_val)
+{
+	union ObjectArg a[1] = {{{0, 0}}};
+	struct {
+		uint64_t m_appRgnAddr;
+		uint32_t m_appRgnSize;
+	} i;
+
+	a[0].b = (struct ObjectBuf) { &i, 12 };
+	i.m_appRgnAddr = appRgnAddr_val;
+	i.m_appRgnSize = appRgnSize_val;
+
+	return Object_invoke(self, IClientEnv_OP_configTaRegion, a, ObjectCounts_pack(1, 0, 0, 0));
+}
+
+static inline int32_t
+IClientEnv_adciAccept(struct Object self)
+{
+	return Object_invoke(self, IClientEnv_OP_adciAccept, 0, 0);
+}
+
+static inline int32_t
+IClientEnv_adciShutdown(struct Object self)
+{
+	return Object_invoke(self, IClientEnv_OP_adciShutdown, 0, 0);
+}
--- linux-qcom-6.8.0.orig/include/soc/qcom/smci_object.h
+++ linux-qcom-6.8.0/include/soc/qcom/smci_object.h
@@ -0,0 +1,203 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __SMCINVOKE_OBJECT_H
+#define __SMCINVOKE_OBJECT_H
+
+#include <linux/types.h>
+#include <linux/firmware.h>
+#include <linux/qtee_shmbridge.h>
+#include <linux/smcinvoke.h>
+
+/*
+ * Method bits are not modified by transport layers.  These describe the
+ * method (member function) being requested by the client.
+ */
+
+#define OBJECT_OP_METHOD_MASK     (0x0000FFFFu)
+#define OBJECT_OP_METHODID(op)    ((op) & OBJECT_OP_METHOD_MASK)
+#define OBJECT_OP_RELEASE       (OBJECT_OP_METHOD_MASK - 0)
+#define OBJECT_OP_RETAIN        (OBJECT_OP_METHOD_MASK - 1)
+#define OBJECT_OP_MAP_REGION    0
+#define OBJECT_OP_YIELD 1
+#define OBJECT_OP_SLEEP 2
+
+#define OBJECT_COUNTS_MAX_BI   0xF
+#define OBJECT_COUNTS_MAX_BO   0xF
+#define OBJECT_COUNTS_MAX_OI   0xF
+#define OBJECT_COUNTS_MAX_OO   0xF
+
+/* unpack counts */
+
+#define OBJECT_COUNTS_NUM_BI(k)  ((size_t) (((k) >> 0) & OBJECT_COUNTS_MAX_BI))
+#define OBJECT_COUNTS_NUM_BO(k)  ((size_t) (((k) >> 4) & OBJECT_COUNTS_MAX_BO))
+#define OBJECT_COUNTS_NUM_OI(k)  ((size_t) (((k) >> 8) & OBJECT_COUNTS_MAX_OI))
+#define OBJECT_COUNTS_NUM_OO(k)  ((size_t) (((k) >> 12) & OBJECT_COUNTS_MAX_OO))
+#define OBJECT_COUNTS_NUM_buffers(k)	\
+			(OBJECT_COUNTS_NUM_BI(k) + OBJECT_COUNTS_NUM_BO(k))
+
+#define OBJECT_COUNTS_NUM_objects(k)	\
+			(OBJECT_COUNTS_NUM_OI(k) + OBJECT_COUNTS_NUM_OO(k))
+
+/* Indices into args[] */
+
+#define OBJECT_COUNTS_INDEX_BI(k)   0
+#define OBJECT_COUNTS_INDEX_BO(k)		\
+			(OBJECT_COUNTS_INDEX_BI(k) + OBJECT_COUNTS_NUM_BI(k))
+#define OBJECT_COUNTS_INDEX_OI(k)		\
+			(OBJECT_COUNTS_INDEX_BO(k) + OBJECT_COUNTS_NUM_BO(k))
+#define OBJECT_COUNTS_INDEX_OO(k)		\
+			(OBJECT_COUNTS_INDEX_OI(k) + OBJECT_COUNTS_NUM_OI(k))
+#define OBJECT_COUNTS_TOTAL(k)		\
+			(OBJECT_COUNTS_INDEX_OO(k) + OBJECT_COUNTS_NUM_OO(k))
+
+#define OBJECT_COUNTS_PACK(in_bufs, out_bufs, in_objs, out_objs) \
+	((uint32_t) ((in_bufs) | ((out_bufs) << 4) | \
+			((in_objs) << 8) | ((out_objs) << 12)))
+
+#define OBJECT_COUNTS_INDEX_buffers(k)   OBJECT_COUNTS_INDEX_BI(k)
+
+/* Object_invoke return codes */
+
+#define OBJECT_isOK(err)        ((err) == 0)
+#define OBJECT_isERROR(err)     ((err) != 0)
+
+/* Generic error codes */
+
+#define OBJECT_OK                  0   /* non-specific success code */
+#define OBJECT_ERROR               1   /* non-specific error */
+#define OBJECT_ERROR_INVALID       2   /* unsupported/unrecognized request */
+#define OBJECT_ERROR_SIZE_IN       3   /* supplied buffer/string too large */
+#define OBJECT_ERROR_SIZE_OUT      4   /* supplied output buffer too small */
+
+#define OBJECT_ERROR_USERBASE     10   /* start of user-defined error range */
+
+/* Transport layer error codes */
+
+#define OBJECT_ERROR_DEFUNCT     -90   /* object no longer exists */
+#define OBJECT_ERROR_ABORT       -91   /* calling thread must exit */
+#define OBJECT_ERROR_BADOBJ      -92   /* invalid object context */
+#define OBJECT_ERROR_NOSLOTS     -93   /* caller's object table full */
+#define OBJECT_ERROR_MAXARGS     -94   /* too many args */
+#define OBJECT_ERROR_MAXDATA     -95   /* buffers too large */
+#define OBJECT_ERROR_UNAVAIL     -96   /* the request could not be processed */
+#define OBJECT_ERROR_KMEM        -97   /* kernel out of memory */
+#define OBJECT_ERROR_REMOTE      -98   /* local method sent to remote object */
+#define OBJECT_ERROR_BUSY        -99   /* Object is busy */
+#define Object_ERROR_TIMEOUT     -103  /* Call Back Object invocation timed out. */
+
+#define FOR_ARGS(ndxvar, counts, section) \
+	for (ndxvar = OBJECT_COUNTS_INDEX_##section(counts); \
+		ndxvar < (OBJECT_COUNTS_INDEX_##section(counts) \
+		+ OBJECT_COUNTS_NUM_##section(counts)); \
+		++ndxvar)
+
+/* ObjectOp */
+
+#define ObjectOp_METHOD_MASK     ((uint32_t) 0x0000FFFFu)
+#define ObjectOp_methodID(op)    ((op) & ObjectOp_METHOD_MASK)
+
+#define ObjectOp_LOCAL           ((uint32_t) 0x00008000U)
+
+#define ObjectOp_isLocal(op)     (((op) & ObjectOp_LOCAL) != 0)
+
+
+#define Object_OP_release       (ObjectOp_METHOD_MASK - 0)
+#define Object_OP_retain        (ObjectOp_METHOD_MASK - 1)
+
+/* Object */
+
+#define ObjectCounts_pack(nBuffersIn, nBuffersOut, nObjectsIn, nObjectsOut) \
+	((uint32_t) ((nBuffersIn) |	\
+	((nBuffersOut) << 4) |			\
+	((nObjectsIn) << 8)  |			\
+	((nObjectsOut) << 12)))
+
+union ObjectArg;
+struct smcinvoke_cmd_req;
+
+typedef int32_t (*ObjectInvoke)(void *h,
+				uint32_t op,
+				union ObjectArg *args,
+				uint32_t counts);
+
+struct Object {
+	ObjectInvoke invoke;
+	void *context;
+};
+
+struct ObjectBuf {
+	void *ptr;
+	size_t size;
+};
+
+struct ObjectBufIn {
+	const void *ptr;
+	size_t size;
+};
+
+union ObjectArg {
+	struct ObjectBuf b;
+	struct ObjectBufIn bi;
+	struct Object o;
+};
+
+static inline int32_t Object_invoke(struct Object o, uint32_t op,
+				union ObjectArg *args, uint32_t k)
+{
+	return o.invoke(o.context, op, args, k);
+}
+
+#define Object_NULL		((struct Object){NULL, NULL})
+
+
+#define OBJECT_NOT_RETAINED
+
+#define OBJECT_CONSUMED
+
+static inline int32_t Object_release(OBJECT_CONSUMED struct Object o)
+{
+	return Object_invoke((o), Object_OP_release, 0, 0);
+}
+static inline int32_t Object_retain(struct Object o)
+{
+	return Object_invoke((o), Object_OP_retain, 0, 0);
+}
+
+#define Object_isNull(o)	((o).invoke == NULL)
+
+#define Object_RELEASE_IF(o)				\
+	do {						\
+		struct Object o_ = (o);			\
+		if (!Object_isNull(o_))			\
+			(void) Object_release(o_);	\
+	} while (0)
+
+static inline void Object_replace(struct Object *loc, struct Object objNew)
+{
+	if (!Object_isNull(*loc))
+		Object_release(*loc);
+
+	if (!Object_isNull(objNew))
+		Object_retain(objNew);
+	*loc = objNew;
+}
+
+#define Object_ASSIGN_NULL(loc)  Object_replace(&(loc), Object_NULL)
+#define SMCINVOKE_INTERFACE_MAX_RETRY       5
+#define SMCINVOKE_INTERFACE_BUSY_WAIT_MS    5
+
+int smcinvoke_release_from_kernel_client(int fd);
+
+int get_root_fd(int *root_fd);
+int process_invoke_request_from_kernel_client(
+		int fd, struct smcinvoke_cmd_req *req);
+
+char *firmware_request_from_smcinvoke(const char *appname, size_t *fw_size, struct qtee_shm *shm);
+
+int32_t get_client_env_object(struct Object *clientEnvObj);
+
+int get_root_obj(struct Object *rootObj);
+
+#endif /* __SMCINVOKE_OBJECT_H */
--- linux-qcom-6.8.0.orig/include/soc/qcom/wdt_core.h
+++ linux-qcom-6.8.0/include/soc/qcom/wdt_core.h
@@ -0,0 +1,160 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _WDT_CORE_H_
+#define _WDT_CORE_H_
+
+#ifdef CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC
+#define WDOG_BITE_ON_PANIC 1
+#else
+#define WDOG_BITE_ON_PANIC 0
+#endif
+
+#ifdef CONFIG_QCOM_WDOG_BITE_EARLY_PANIC
+#define WDOG_BITE_EARLY_PANIC 1
+#else
+#define WDOG_BITE_EARLY_PANIC 0
+#endif
+
+#define MODE_FOR_DISABLE 0600
+
+/*
+ * Watchdog ipi optimization:
+ * Does not ping cores in low power mode at pet time to save power.
+ * This feature is enabled by default.
+ *
+ * Can be turned off, by enabling CONFIG_QCOM_WDOG_IPI_ENABLE.
+ */
+#ifdef CONFIG_QCOM_WDOG_IPI_ENABLE
+#define IPI_CORES_IN_LPM 1
+#else
+#define IPI_CORES_IN_LPM 0
+#endif
+
+#if IS_ENABLED(CONFIG_QCOM_WDT_CORE)
+#include <linux/platform_device.h>
+
+/**
+ *  The enable constant that can be used between the core framework and the
+ *  watchdog driver.
+ */
+#define ENABLE_WDT   0
+#define UNMASKED_INT_EN  1
+
+/* Watchdog property values */
+#define QCOM_WATCHDOG_BARK_TIME	    CONFIG_QCOM_WATCHDOG_BARK_TIME
+#define QCOM_WATCHDOG_PET_TIME	    CONFIG_QCOM_WATCHDOG_PET_TIME
+
+#ifdef CONFIG_QCOM_WATCHDOG_IPI_PING
+#define QCOM_WATCHDOG_IPI_PING 1
+#else
+#define QCOM_WATCHDOG_IPI_PING 0
+#endif
+
+#ifdef CONFIG_QCOM_WATCHDOG_WAKEUP_ENABLE
+#define QCOM_WATCHDOG_WAKEUP_ENABLE 1
+#else
+#define QCOM_WATCHDOG_WAKEUP_ENABLE 0
+#endif
+
+#ifdef CONFIG_QCOM_WATCHDOG_USERSPACE_PET
+#define QCOM_WATCHDOG_USERSPACE_PET 1
+#else
+#define QCOM_WATCHDOG_USERSPACE_PET 0
+#endif
+
+#define WDOG_NR_IPI	10
+#define NR_TOP_HITTERS 5
+
+struct qcom_wdt_ops;
+struct msm_watchdog_data;
+
+/** qcom_wdt_ops - The msm-watchdog-devices operations
+ *
+ * @set_bark_time:      The routine for setting the watchdog bark time.
+ * @set_bite_time:      The routine for setting the watchdog bite time.
+ * @reset_wdt:          The routine for resetting the watchdog timer.
+ * @enable_wdt:         The routine for enabling the watchdog.
+ * @disable_wdt:        The routine for disabling the watchdog.
+ * @show_wdt_status:     The routine that shows the status of the watchdog.
+ *
+ * The qcom_wdt_ops structure contains a list of operations that are
+ * used to control the watchdog.
+ */
+struct qcom_wdt_ops {
+	int (*set_bark_time)(u32 time, struct msm_watchdog_data *wdog_dd);
+	int (*set_bite_time)(u32 time, struct msm_watchdog_data *wdog_dd);
+	int (*reset_wdt)(struct msm_watchdog_data *wdog_dd);
+	int (*enable_wdt)(u32 val, struct msm_watchdog_data *wdog_dd);
+	int (*disable_wdt)(struct msm_watchdog_data *wdog_dd);
+	int (*show_wdt_status)(struct msm_watchdog_data *wdog_dd);
+};
+
+/*
+ * user_pet_enable:
+ *	Require userspace to write to a sysfs file every pet_time milliseconds.
+ *	Disabled by default on boot.
+ */
+struct msm_watchdog_data {
+	void __iomem *base;
+	struct device *dev;
+	struct qcom_wdt_ops *ops;
+	unsigned int pet_time;
+	unsigned int bark_time;
+	unsigned int bark_irq;
+	bool do_ipi_ping;
+	bool in_panic;
+	bool wakeup_irq_enable;
+	bool irq_ppi;
+	unsigned long long last_pet;
+	cpumask_t alive_mask;
+	struct mutex disable_lock;
+	struct msm_watchdog_data * __percpu *wdog_cpu_dd;
+	struct notifier_block panic_blk;
+	struct notifier_block die_blk;
+	struct notifier_block wdog_cpu_pm_nb;
+	struct notifier_block restart_blk;
+
+	bool enabled;
+	bool user_pet_enabled;
+
+	struct task_struct *watchdog_task;
+	struct timer_list pet_timer;
+	wait_queue_head_t pet_complete;
+
+	bool timer_expired;
+	bool user_pet_complete;
+	unsigned long long timer_fired;
+	unsigned long long thread_start;
+	unsigned long long ping_start[NR_CPUS];
+	unsigned long long ping_end[NR_CPUS];
+	int cpu_idle_pc_state[NR_CPUS];
+	bool freeze_in_progress;
+	spinlock_t freeze_lock;
+	struct timer_list user_pet_timer;
+	bool hibernate;
+};
+
+extern void qcom_wdt_trigger_bite(void);
+
+extern int qcom_wdt_register(struct platform_device *pdev,
+		      struct msm_watchdog_data *wdog_dd,
+		      char *wdog_dd_name);
+extern int qcom_wdt_pet_suspend(struct device *dev);
+extern int qcom_wdt_pet_resume(struct device *dev);
+extern int qcom_wdt_remove(struct platform_device *pdev);
+#else
+static inline void qcom_wdt_trigger_bite(void) { }
+static inline int qcom_wdt_register(struct platform_device *pdev,
+		      struct msm_watchdog_data *wdog_dd,
+		      char *wdog_dd_name) { return 0; }
+static inline int qcom_wdt_pet_suspend(struct device *dev) { return 0; }
+static inline int qcom_wdt_pet_resume(struct device *dev) { return 0; }
+static inline int qcom_wdt_remove(struct platform_device *pdev) { return 0; }
+
+#endif
+
+#endif
--- linux-qcom-6.8.0.orig/include/sound/cs35l56.h
+++ linux-qcom-6.8.0/include/sound/cs35l56.h
@@ -273,7 +273,6 @@
 extern const unsigned int cs35l56_tx_input_values[CS35L56_NUM_INPUT_SRC];
 
 int cs35l56_set_patch(struct cs35l56_base *cs35l56_base);
-int cs35l56_force_sync_asp1_registers_from_cache(struct cs35l56_base *cs35l56_base);
 int cs35l56_mbox_send(struct cs35l56_base *cs35l56_base, unsigned int command);
 int cs35l56_firmware_shutdown(struct cs35l56_base *cs35l56_base);
 int cs35l56_wait_for_firmware_boot(struct cs35l56_base *cs35l56_base);
--- linux-qcom-6.8.0.orig/include/sound/dmaengine_pcm.h
+++ linux-qcom-6.8.0/include/sound/dmaengine_pcm.h
@@ -36,6 +36,7 @@
 int snd_dmaengine_pcm_open(struct snd_pcm_substream *substream,
 	struct dma_chan *chan);
 int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream);
+int snd_dmaengine_pcm_sync_stop(struct snd_pcm_substream *substream);
 
 int snd_dmaengine_pcm_open_request_chan(struct snd_pcm_substream *substream,
 	dma_filter_fn filter_fn, void *filter_data);
--- linux-qcom-6.8.0.orig/include/sound/emu10k1.h
+++ linux-qcom-6.8.0/include/sound/emu10k1.h
@@ -1684,8 +1684,7 @@
 	unsigned int clock_fallback;
 	unsigned int optical_in; /* 0:SPDIF, 1:ADAT */
 	unsigned int optical_out; /* 0:SPDIF, 1:ADAT */
-	struct work_struct firmware_work;
-	struct work_struct clock_work;
+	struct work_struct work;
 };
 
 struct snd_emu10k1 {
--- linux-qcom-6.8.0.orig/include/sound/hdaudio_ext.h
+++ linux-qcom-6.8.0/include/sound/hdaudio_ext.h
@@ -56,6 +56,9 @@
 	u32 pphcldpl;
 	u32 pphcldpu;
 
+	u32 pplcllpl;
+	u32 pplcllpu;
+
 	bool decoupled:1;
 	bool link_locked:1;
 	bool link_prepared;
--- linux-qcom-6.8.0.orig/include/sound/tas2781-dsp.h
+++ linux-qcom-6.8.0/include/sound/tas2781-dsp.h
@@ -2,7 +2,7 @@
 //
 // ALSA SoC Texas Instruments TAS2781 Audio Smart Amplifier
 //
-// Copyright (C) 2022 - 2023 Texas Instruments Incorporated
+// Copyright (C) 2022 - 2024 Texas Instruments Incorporated
 // https://www.ti.com
 //
 // The TAS2781 driver implements a flexible and configurable
@@ -13,8 +13,8 @@
 // Author: Kevin Lu <kevin-lu@ti.com>
 //
 
-#ifndef __TASDEVICE_DSP_H__
-#define __TASDEVICE_DSP_H__
+#ifndef __TAS2781_DSP_H__
+#define __TAS2781_DSP_H__
 
 #define MAIN_ALL_DEVICES			0x0d
 #define MAIN_DEVICE_A				0x01
@@ -117,10 +117,17 @@
 	struct device *dev;
 };
 
-enum tasdevice_dsp_fw_state {
-	TASDEVICE_DSP_FW_NONE = 0,
+enum tasdevice_fw_state {
+	/* Driver in startup mode, not load any firmware. */
 	TASDEVICE_DSP_FW_PENDING,
+	/* DSP firmware in the system, but parsing error. */
 	TASDEVICE_DSP_FW_FAIL,
+	/*
+	 * Only RCA (Reconfigurable Architecture) firmware load
+	 * successfully.
+	 */
+	TASDEVICE_RCA_FW_OK,
+	/* Both RCA and DSP firmware load successfully. */
 	TASDEVICE_DSP_FW_ALL_OK,
 };
 
@@ -180,7 +187,6 @@
 int tasdevice_select_tuningprm_cfg(void *context, int prm,
 	int cfg_no, int rca_conf_no);
 int tasdevice_prmg_load(void *context, int prm_no);
-int tasdevice_prmg_calibdata_load(void *context, int prm_no);
 void tasdevice_tuning_switch(void *context, int state);
 int tas2781_load_calibration(void *context, char *file_name,
 	unsigned short i);
--- linux-qcom-6.8.0.orig/include/sound/tas2781-tlv.h
+++ linux-qcom-6.8.0/include/sound/tas2781-tlv.h
@@ -15,7 +15,7 @@
 #ifndef __TAS2781_TLV_H__
 #define __TAS2781_TLV_H__
 
-static const DECLARE_TLV_DB_SCALE(dvc_tlv, -10000, 100, 0);
+static const __maybe_unused DECLARE_TLV_DB_SCALE(dvc_tlv, -10000, 100, 0);
 static const DECLARE_TLV_DB_SCALE(amp_vol_tlv, 1100, 50, 0);
 
 #endif
--- linux-qcom-6.8.0.orig/include/sound/tas2781.h
+++ linux-qcom-6.8.0/include/sound/tas2781.h
@@ -80,11 +80,6 @@
 	bool is_loaderr;
 };
 
-struct tasdevice_irqinfo {
-	int irq_gpio;
-	int irq;
-};
-
 struct calidata {
 	unsigned char *data;
 	unsigned long total_sz;
@@ -92,7 +87,6 @@
 
 struct tasdevice_priv {
 	struct tasdevice tasdevice[TASDEVICE_MAX_CHANNELS];
-	struct tasdevice_irqinfo irq_info;
 	struct tasdevice_rca rcabin;
 	struct calidata cali_data;
 	struct tasdevice_fw *fmw;
@@ -103,7 +97,6 @@
 	struct tm tm;
 
 	enum device_catlog_id catlog_id;
-	const char *acpi_subsystem_id;
 	unsigned char cal_binaryname[TASDEVICE_MAX_CHANNELS][64];
 	unsigned char crc8_lkp_tbl[CRC8_TABLE_SIZE];
 	unsigned char coef_binaryname[64];
@@ -114,6 +107,7 @@
 	unsigned int chip_id;
 	unsigned int sysclk;
 
+	int irq;
 	int cur_prog;
 	int cur_conf;
 	int fw_state;
--- linux-qcom-6.8.0.orig/include/sound/ump.h
+++ linux-qcom-6.8.0/include/sound/ump.h
@@ -13,6 +13,14 @@
 struct ump_cvt_to_ump;
 struct snd_seq_ump_ops;
 
+struct snd_ump_group {
+	int group;			/* group index (0-based) */
+	unsigned int dir_bits;		/* directions */
+	bool active;			/* activeness */
+	bool valid;			/* valid group (referred by blocks) */
+	char name[64];			/* group name */
+};
+
 struct snd_ump_endpoint {
 	struct snd_rawmidi core;	/* raw UMP access */
 
@@ -41,6 +49,8 @@
 
 	struct mutex open_mutex;
 
+	struct snd_ump_group groups[SNDRV_UMP_MAX_GROUPS]; /* table of groups */
+
 #if IS_ENABLED(CONFIG_SND_UMP_LEGACY_RAWMIDI)
 	spinlock_t legacy_locks[2];
 	struct snd_rawmidi *legacy_rmidi;
@@ -112,6 +122,7 @@
 
 int snd_ump_receive_ump_val(struct snd_ump_endpoint *ump, u32 val);
 int snd_ump_switch_protocol(struct snd_ump_endpoint *ump, unsigned int protocol);
+void snd_ump_update_group_attrs(struct snd_ump_endpoint *ump);
 
 /*
  * Some definitions for UMP
--- linux-qcom-6.8.0.orig/include/sound/ump_convert.h
+++ linux-qcom-6.8.0/include/sound/ump_convert.h
@@ -13,6 +13,7 @@
 	unsigned char cc_nrpn_msb, cc_nrpn_lsb;
 	unsigned char cc_data_msb, cc_data_lsb;
 	unsigned char cc_bank_msb, cc_bank_lsb;
+	bool cc_data_msb_set, cc_data_lsb_set;
 };
 
 /* context for converting from MIDI1 byte stream to UMP packet */
--- linux-qcom-6.8.0.orig/include/trace/events/afs.h
+++ linux-qcom-6.8.0/include/trace/events/afs.h
@@ -331,7 +331,11 @@
 	EM(afs_edit_dir_delete,			"delete") \
 	EM(afs_edit_dir_delete_error,		"d_err ") \
 	EM(afs_edit_dir_delete_inval,		"d_invl") \
-	E_(afs_edit_dir_delete_noent,		"d_nent")
+	EM(afs_edit_dir_delete_noent,		"d_nent") \
+	EM(afs_edit_dir_update_dd,		"u_ddot") \
+	EM(afs_edit_dir_update_error,		"u_fail") \
+	EM(afs_edit_dir_update_inval,		"u_invl") \
+	E_(afs_edit_dir_update_nodd,		"u_nodd")
 
 #define afs_edit_dir_reasons				  \
 	EM(afs_edit_dir_for_create,		"Create") \
@@ -340,6 +344,7 @@
 	EM(afs_edit_dir_for_rename_0,		"Renam0") \
 	EM(afs_edit_dir_for_rename_1,		"Renam1") \
 	EM(afs_edit_dir_for_rename_2,		"Renam2") \
+	EM(afs_edit_dir_for_rename_sub,		"RnmSub") \
 	EM(afs_edit_dir_for_rmdir,		"RmDir ") \
 	EM(afs_edit_dir_for_silly_0,		"S_Ren0") \
 	EM(afs_edit_dir_for_silly_1,		"S_Ren1") \
--- linux-qcom-6.8.0.orig/include/trace/events/asoc.h
+++ linux-qcom-6.8.0/include/trace/events/asoc.h
@@ -12,6 +12,8 @@
 #define DAPM_DIRECT "(direct)"
 #define DAPM_ARROW(dir) (((dir) == SND_SOC_DAPM_DIR_OUT) ? "->" : "<-")
 
+TRACE_DEFINE_ENUM(SND_SOC_DAPM_DIR_OUT);
+
 struct snd_soc_jack;
 struct snd_soc_card;
 struct snd_soc_dapm_widget;
--- linux-qcom-6.8.0.orig/include/trace/events/btrfs.h
+++ linux-qcom-6.8.0/include/trace/events/btrfs.h
@@ -2409,6 +2409,14 @@
 	TP_ARGS(fs_info, sinfo, old, diff)
 );
 
+DEFINE_EVENT(btrfs__space_info_update, update_bytes_zone_unusable,
+
+	TP_PROTO(const struct btrfs_fs_info *fs_info,
+		 const struct btrfs_space_info *sinfo, u64 old, s64 diff),
+
+	TP_ARGS(fs_info, sinfo, old, diff)
+);
+
 DECLARE_EVENT_CLASS(btrfs_raid56_bio,
 
 	TP_PROTO(const struct btrfs_raid_bio *rbio,
--- linux-qcom-6.8.0.orig/include/trace/events/cachefiles.h
+++ linux-qcom-6.8.0/include/trace/events/cachefiles.h
@@ -33,6 +33,8 @@
 	cachefiles_obj_see_withdrawal,
 	cachefiles_obj_get_ondemand_fd,
 	cachefiles_obj_put_ondemand_fd,
+	cachefiles_obj_get_read_req,
+	cachefiles_obj_put_read_req,
 };
 
 enum fscache_why_object_killed {
@@ -127,7 +129,11 @@
 	EM(cachefiles_obj_see_lookup_cookie,	"SEE lookup_cookie")	\
 	EM(cachefiles_obj_see_lookup_failed,	"SEE lookup_failed")	\
 	EM(cachefiles_obj_see_withdraw_cookie,	"SEE withdraw_cookie")	\
-	E_(cachefiles_obj_see_withdrawal,	"SEE withdrawal")
+	EM(cachefiles_obj_see_withdrawal,	"SEE withdrawal")	\
+	EM(cachefiles_obj_get_ondemand_fd,      "GET ondemand_fd")	\
+	EM(cachefiles_obj_put_ondemand_fd,      "PUT ondemand_fd")	\
+	EM(cachefiles_obj_get_read_req,		"GET read_req")		\
+	E_(cachefiles_obj_put_read_req,		"PUT read_req")
 
 #define cachefiles_coherency_traces					\
 	EM(cachefiles_coherency_check_aux,	"BAD aux ")		\
--- linux-qcom-6.8.0.orig/include/trace/events/damon.h
+++ linux-qcom-6.8.0/include/trace/events/damon.h
@@ -15,7 +15,7 @@
 		unsigned int target_idx, struct damon_region *r,
 		unsigned int nr_regions, bool do_trace),
 
-	TP_ARGS(context_idx, target_idx, scheme_idx, r, nr_regions, do_trace),
+	TP_ARGS(context_idx, scheme_idx, target_idx, r, nr_regions, do_trace),
 
 	TP_CONDITION(do_trace),
 
--- linux-qcom-6.8.0.orig/include/trace/events/f2fs.h
+++ linux-qcom-6.8.0/include/trace/events/f2fs.h
@@ -139,7 +139,8 @@
 		{ CP_NODE_NEED_CP,	"node needs cp" },		\
 		{ CP_FASTBOOT_MODE,	"fastboot mode" },		\
 		{ CP_SPEC_LOG_NUM,	"log type is 2" },		\
-		{ CP_RECOVER_DIR,	"dir needs recovery" })
+		{ CP_RECOVER_DIR,	"dir needs recovery" },		\
+		{ CP_XATTR_DIR,		"dir's xattr updated" })
 
 #define show_shutdown_mode(type)					\
 	__print_symbolic(type,						\
--- linux-qcom-6.8.0.orig/include/trace/events/fscache.h
+++ linux-qcom-6.8.0/include/trace/events/fscache.h
@@ -35,12 +35,14 @@
 	fscache_volume_get_cookie,
 	fscache_volume_get_create_work,
 	fscache_volume_get_hash_collision,
+	fscache_volume_get_withdraw,
 	fscache_volume_free,
 	fscache_volume_new_acquire,
 	fscache_volume_put_cookie,
 	fscache_volume_put_create_work,
 	fscache_volume_put_hash_collision,
 	fscache_volume_put_relinquish,
+	fscache_volume_put_withdraw,
 	fscache_volume_see_create_work,
 	fscache_volume_see_hash_wake,
 	fscache_volume_wait_create_work,
@@ -120,12 +122,14 @@
 	EM(fscache_volume_get_cookie,		"GET cook ")		\
 	EM(fscache_volume_get_create_work,	"GET creat")		\
 	EM(fscache_volume_get_hash_collision,	"GET hcoll")		\
+	EM(fscache_volume_get_withdraw,		"GET withd")            \
 	EM(fscache_volume_free,			"FREE     ")		\
 	EM(fscache_volume_new_acquire,		"NEW acq  ")		\
 	EM(fscache_volume_put_cookie,		"PUT cook ")		\
 	EM(fscache_volume_put_create_work,	"PUT creat")		\
 	EM(fscache_volume_put_hash_collision,	"PUT hcoll")		\
 	EM(fscache_volume_put_relinquish,	"PUT relnq")		\
+	EM(fscache_volume_put_withdraw,		"PUT withd")            \
 	EM(fscache_volume_see_create_work,	"SEE creat")		\
 	EM(fscache_volume_see_hash_wake,	"SEE hwake")		\
 	E_(fscache_volume_wait_create_work,	"WAIT crea")
--- linux-qcom-6.8.0.orig/include/trace/events/huge_memory.h
+++ linux-qcom-6.8.0/include/trace/events/huge_memory.h
@@ -207,10 +207,10 @@
 );
 
 TRACE_EVENT(mm_khugepaged_collapse_file,
-	TP_PROTO(struct mm_struct *mm, struct page *hpage, pgoff_t index,
-			bool is_shmem, unsigned long addr, struct file *file,
+	TP_PROTO(struct mm_struct *mm, struct folio *new_folio, pgoff_t index,
+			unsigned long addr, bool is_shmem, struct file *file,
 			int nr, int result),
-	TP_ARGS(mm, hpage, index, addr, is_shmem, file, nr, result),
+	TP_ARGS(mm, new_folio, index, addr, is_shmem, file, nr, result),
 	TP_STRUCT__entry(
 		__field(struct mm_struct *, mm)
 		__field(unsigned long, hpfn)
@@ -224,7 +224,7 @@
 
 	TP_fast_assign(
 		__entry->mm = mm;
-		__entry->hpfn = hpage ? page_to_pfn(hpage) : -1;
+		__entry->hpfn = new_folio ? folio_pfn(new_folio) : -1;
 		__entry->index = index;
 		__entry->addr = addr;
 		__entry->is_shmem = is_shmem;
@@ -233,7 +233,7 @@
 		__entry->result = result;
 	),
 
-	TP_printk("mm=%p, hpage_pfn=0x%lx, index=%ld, addr=%ld, is_shmem=%d, filename=%s, nr=%d, result=%s",
+	TP_printk("mm=%p, hpage_pfn=0x%lx, index=%ld, addr=%lx, is_shmem=%d, filename=%s, nr=%d, result=%s",
 		__entry->mm,
 		__entry->hpfn,
 		__entry->index,
--- linux-qcom-6.8.0.orig/include/trace/events/mmflags.h
+++ linux-qcom-6.8.0/include/trace/events/mmflags.h
@@ -135,6 +135,7 @@
 #define DEF_PAGETYPE_NAME(_name) { PG_##_name, __stringify(_name) }
 
 #define __def_pagetype_names						\
+	DEF_PAGETYPE_NAME(hugetlb),					\
 	DEF_PAGETYPE_NAME(offline),					\
 	DEF_PAGETYPE_NAME(guard),					\
 	DEF_PAGETYPE_NAME(table),					\
--- linux-qcom-6.8.0.orig/include/trace/events/mptcp.h
+++ linux-qcom-6.8.0/include/trace/events/mptcp.h
@@ -34,7 +34,7 @@
 		struct sock *ssk;
 
 		__entry->active = mptcp_subflow_active(subflow);
-		__entry->backup = subflow->backup;
+		__entry->backup = subflow->backup || subflow->request_bkup;
 
 		if (subflow->tcp_sock && sk_fullsock(subflow->tcp_sock))
 			__entry->free = sk_stream_memory_free(subflow->tcp_sock);
--- linux-qcom-6.8.0.orig/include/trace/events/qdisc.h
+++ linux-qcom-6.8.0/include/trace/events/qdisc.h
@@ -81,14 +81,14 @@
 	TP_ARGS(q),
 
 	TP_STRUCT__entry(
-		__string(	dev,		qdisc_dev(q)->name	)
+		__string(	dev,		qdisc_dev(q) ? qdisc_dev(q)->name : "(null)"	)
 		__string(	kind,		q->ops->id		)
 		__field(	u32,		parent			)
 		__field(	u32,		handle			)
 	),
 
 	TP_fast_assign(
-		__assign_str(dev, qdisc_dev(q)->name);
+		__assign_str(dev, qdisc_dev(q) ? qdisc_dev(q)->name : "(null)");
 		__assign_str(kind, q->ops->id);
 		__entry->parent = q->parent;
 		__entry->handle = q->handle;
--- linux-qcom-6.8.0.orig/include/trace/events/qup_buses_trace.h
+++ linux-qcom-6.8.0/include/trace/events/qup_buses_trace.h
@@ -0,0 +1,113 @@
+/* SPDX-License-Identifier: GPL-2.0
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM qup_buses_trace
+
+#if !defined(_TRACE_QUP_BUSES_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_QUP_BUSES_TRACE_H
+
+#include <linux/ktime.h>
+#include <linux/tracepoint.h>
+
+#define MAX_MSG_LEN 256
+
+TRACE_EVENT(buses_log_info,
+
+	TP_PROTO(const char *name, struct va_format *vaf),
+
+	TP_ARGS(name, vaf),
+
+	TP_STRUCT__entry(
+		__string(name, name)
+		__dynamic_array(char, msg, MAX_MSG_LEN)
+	),
+
+	TP_fast_assign(
+		__assign_str_len(name, name, strlen(name));
+		WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+				       MAX_MSG_LEN, vaf->fmt,
+				       *vaf->va) >= MAX_MSG_LEN);
+	),
+
+	TP_printk("%s: %s", __get_str(name), __get_str(msg))
+);
+
+DECLARE_EVENT_CLASS(buses_info,
+
+	TP_PROTO(struct device *dev, const char *string1, char *string2),
+
+	TP_ARGS(dev, string1, string2),
+
+	TP_STRUCT__entry(
+		__string(name, dev_name(dev))
+		__string(string1, string1)
+		__string(string2, string2)
+	),
+
+	TP_fast_assign(
+		__assign_str_len(name, dev_name(dev), strlen(dev_name(dev)));
+		__assign_str_len(string1, string1, strlen(string1));
+		__assign_str_len(string2, string2, strlen(string2));
+	),
+
+	TP_printk("%s: %s: %s", __get_str(name), __get_str(string1), __get_str(string2))
+);
+
+DECLARE_EVENT_CLASS(serial_transmit_data,
+
+	TP_PROTO(struct device *dev, char *string, int size),
+
+	TP_ARGS(dev, string, size),
+
+	TP_STRUCT__entry(
+		__string(name, dev_name(dev))
+		__array(char, buf, 64)
+		__field(unsigned int, size)
+		__field(int, len)
+	),
+
+	TP_fast_assign(
+		__assign_str_len(name, dev_name(dev), strlen(dev_name(dev)));
+		__entry->len = min(32, size);
+		hex_dump_to_buffer(string, __entry->len, 32, 1, __entry->buf,
+				   sizeof(__entry->buf), false);
+	),
+
+	TP_printk("%s: %s\n", __get_str(name),  __entry->buf)
+);
+
+
+DEFINE_EVENT(buses_info, serial_info,
+
+	TP_PROTO(struct device *dev, const char *string1, char *string2),
+
+	TP_ARGS(dev, string1, string2)
+);
+
+DEFINE_EVENT(serial_transmit_data, serial_transmit_data_tx,
+
+	TP_PROTO(struct device *dev, char *string, int size),
+
+	TP_ARGS(dev, string, size)
+);
+
+DEFINE_EVENT(serial_transmit_data, serial_transmit_data_rx,
+
+	TP_PROTO(struct device *dev, char *string, int size),
+
+	TP_ARGS(dev, string, size)
+);
+
+DEFINE_EVENT(buses_info, spi_info,
+
+	TP_PROTO(struct device *dev, const char *string1, char *string2),
+
+	TP_ARGS(dev, string1, string2)
+);
+
+#endif /* _TRACE_QUP_BUSES_TRACE_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/include/trace/events/rpcgss.h
+++ linux-qcom-6.8.0/include/trace/events/rpcgss.h
@@ -54,7 +54,7 @@
 TRACE_DEFINE_ENUM(GSS_S_GAP_TOKEN);
 
 #define show_gss_status(x)						\
-	__print_flags(x, "|",						\
+	__print_symbolic(x, 						\
 		{ GSS_S_BAD_MECH, "GSS_S_BAD_MECH" },			\
 		{ GSS_S_BAD_NAME, "GSS_S_BAD_NAME" },			\
 		{ GSS_S_BAD_NAMETYPE, "GSS_S_BAD_NAMETYPE" },		\
@@ -609,7 +609,7 @@
 		__field(unsigned int, timeout)
 		__field(u32, window_size)
 		__field(int, len)
-		__string(acceptor, data)
+		__string_len(acceptor, data, len)
 	),
 
 	TP_fast_assign(
@@ -618,7 +618,7 @@
 		__entry->timeout = timeout;
 		__entry->window_size = window_size;
 		__entry->len = len;
-		strncpy(__get_str(acceptor), data, len);
+		__assign_str(acceptor, data);
 	),
 
 	TP_printk("win_size=%u expiry=%lu now=%lu timeout=%u acceptor=%.*s",
--- linux-qcom-6.8.0.orig/include/trace/events/rxrpc.h
+++ linux-qcom-6.8.0/include/trace/events/rxrpc.h
@@ -83,7 +83,7 @@
 	EM(rxrpc_badmsg_bad_abort,		"bad-abort")		\
 	EM(rxrpc_badmsg_bad_jumbo,		"bad-jumbo")		\
 	EM(rxrpc_badmsg_short_ack,		"short-ack")		\
-	EM(rxrpc_badmsg_short_ack_info,		"short-ack-info")	\
+	EM(rxrpc_badmsg_short_ack_trailer,	"short-ack-trailer")	\
 	EM(rxrpc_badmsg_short_hdr,		"short-hdr")		\
 	EM(rxrpc_badmsg_unsupported_packet,	"unsup-pkt")		\
 	EM(rxrpc_badmsg_zero_call,		"zero-call")		\
@@ -286,6 +286,7 @@
 	EM(rxrpc_call_see_input,		"SEE input   ") \
 	EM(rxrpc_call_see_release,		"SEE release ") \
 	EM(rxrpc_call_see_userid_exists,	"SEE u-exists") \
+	EM(rxrpc_call_see_waiting_call,		"SEE q-conn  ") \
 	E_(rxrpc_call_see_zap,			"SEE zap     ")
 
 #define rxrpc_txqueue_traces \
--- linux-qcom-6.8.0.orig/include/trace/trace_events.h
+++ linux-qcom-6.8.0/include/trace/trace_events.h
@@ -244,6 +244,9 @@
 	tstruct								\
 	{} };
 
+#undef DECLARE_EVENT_SYSCALL_CLASS
+#define DECLARE_EVENT_SYSCALL_CLASS DECLARE_EVENT_CLASS
+
 #undef DEFINE_EVENT_PRINT
 #define DEFINE_EVENT_PRINT(template, name, proto, args, print)
 
@@ -374,11 +377,11 @@
 
 #include "stages/stage6_event_callback.h"
 
-#undef DECLARE_EVENT_CLASS
-#define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print)	\
-									\
+
+#undef __DECLARE_EVENT_CLASS
+#define __DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print) \
 static notrace void							\
-trace_event_raw_event_##call(void *__data, proto)			\
+do_trace_event_raw_event_##call(void *__data, proto)			\
 {									\
 	struct trace_event_file *trace_file = __data;			\
 	struct trace_event_data_offsets_##call __maybe_unused __data_offsets;\
@@ -403,6 +406,29 @@
 									\
 	trace_event_buffer_commit(&fbuffer);				\
 }
+
+#undef DECLARE_EVENT_CLASS
+#define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print)	\
+__DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \
+		      PARAMS(assign), PARAMS(print))			\
+static notrace void							\
+trace_event_raw_event_##call(void *__data, proto)			\
+{									\
+	do_trace_event_raw_event_##call(__data, args);			\
+}
+
+#undef DECLARE_EVENT_SYSCALL_CLASS
+#define DECLARE_EVENT_SYSCALL_CLASS(call, proto, args, tstruct, assign, print) \
+__DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \
+		      PARAMS(assign), PARAMS(print))			\
+static notrace void							\
+trace_event_raw_event_##call(void *__data, proto)			\
+{									\
+	preempt_disable_notrace();					\
+	do_trace_event_raw_event_##call(__data, args);			\
+	preempt_enable_notrace();					\
+}
+
 /*
  * The ftrace_test_probe is compiled out, it is only here as a build time check
  * to make sure that if the tracepoint handling changes, the ftrace probe will
@@ -418,6 +444,8 @@
 
 #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
 
+#undef __DECLARE_EVENT_CLASS
+
 #include "stages/stage7_class_define.h"
 
 #undef DECLARE_EVENT_CLASS
--- linux-qcom-6.8.0.orig/include/uapi/asm-generic/fcntl.h
+++ linux-qcom-6.8.0/include/uapi/asm-generic/fcntl.h
@@ -115,13 +115,11 @@
 #define F_GETSIG	11	/* for sockets. */
 #endif
 
-#if __BITS_PER_LONG == 32 || defined(__KERNEL__)
 #ifndef F_GETLK64
 #define F_GETLK64	12	/*  using 'struct flock64' */
 #define F_SETLK64	13
 #define F_SETLKW64	14
 #endif
-#endif /* __BITS_PER_LONG == 32 || defined(__KERNEL__) */
 
 #ifndef F_SETOWN_EX
 #define F_SETOWN_EX	15
--- linux-qcom-6.8.0.orig/include/uapi/asm-generic/unistd.h
+++ linux-qcom-6.8.0/include/uapi/asm-generic/unistd.h
@@ -737,7 +737,7 @@
 #define __NR_ppoll_time64 414
 __SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64)
 #define __NR_io_pgetevents_time64 416
-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents)
+__SC_COMP(__NR_io_pgetevents_time64, sys_io_pgetevents, compat_sys_io_pgetevents_time64)
 #define __NR_recvmmsg_time64 417
 __SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64)
 #define __NR_mq_timedsend_time64 418
--- linux-qcom-6.8.0.orig/include/uapi/drm/drm_fourcc.h
+++ linux-qcom-6.8.0/include/uapi/drm/drm_fourcc.h
@@ -1476,6 +1476,7 @@
 #define AMD_FMT_MOD_TILE_VER_GFX10 2
 #define AMD_FMT_MOD_TILE_VER_GFX10_RBPLUS 3
 #define AMD_FMT_MOD_TILE_VER_GFX11 4
+#define AMD_FMT_MOD_TILE_VER_GFX12 5
 
 /*
  * 64K_S is the same for GFX9/GFX10/GFX10_RBPLUS and hence has GFX9 as canonical
@@ -1486,6 +1487,8 @@
 /*
  * 64K_D for non-32 bpp is the same for GFX9/GFX10/GFX10_RBPLUS and hence has
  * GFX9 as canonical version.
+ *
+ * 64K_D_2D on GFX12 is identical to 64K_D on GFX11.
  */
 #define AMD_FMT_MOD_TILE_GFX9_64K_D 10
 #define AMD_FMT_MOD_TILE_GFX9_64K_S_X 25
@@ -1493,6 +1496,21 @@
 #define AMD_FMT_MOD_TILE_GFX9_64K_R_X 27
 #define AMD_FMT_MOD_TILE_GFX11_256K_R_X 31
 
+/* Gfx12 swizzle modes:
+ *    0 - LINEAR
+ *    1 - 256B_2D  - 2D block dimensions
+ *    2 - 4KB_2D
+ *    3 - 64KB_2D
+ *    4 - 256KB_2D
+ *    5 - 4KB_3D   - 3D block dimensions
+ *    6 - 64KB_3D
+ *    7 - 256KB_3D
+ */
+#define AMD_FMT_MOD_TILE_GFX12_256B_2D 1
+#define AMD_FMT_MOD_TILE_GFX12_4K_2D 2
+#define AMD_FMT_MOD_TILE_GFX12_64K_2D 3
+#define AMD_FMT_MOD_TILE_GFX12_256K_2D 4
+
 #define AMD_FMT_MOD_DCC_BLOCK_64B 0
 #define AMD_FMT_MOD_DCC_BLOCK_128B 1
 #define AMD_FMT_MOD_DCC_BLOCK_256B 2
--- linux-qcom-6.8.0.orig/include/uapi/drm/nouveau_drm.h
+++ linux-qcom-6.8.0/include/uapi/drm/nouveau_drm.h
@@ -68,6 +68,13 @@
  */
 #define NOUVEAU_GETPARAM_VRAM_USED 19
 
+/*
+ * NOUVEAU_GETPARAM_HAS_VMA_TILEMODE
+ *
+ * Query whether tile mode and PTE kind are accepted with VM allocs or not.
+ */
+#define NOUVEAU_GETPARAM_HAS_VMA_TILEMODE 20
+
 struct drm_nouveau_getparam {
 	__u64 param;
 	__u64 value;
--- linux-qcom-6.8.0.orig/include/uapi/drm/xe_drm.h
+++ linux-qcom-6.8.0/include/uapi/drm/xe_drm.h
@@ -736,7 +736,13 @@
 #define DRM_XE_GEM_CPU_CACHING_WC                      2
 	/**
 	 * @cpu_caching: The CPU caching mode to select for this object. If
-	 * mmaping the object the mode selected here will also be used.
+	 * mmaping the object the mode selected here will also be used. The
+	 * exception is when mapping system memory (including data evicted
+	 * to system) on discrete GPUs. The caching mode selected will
+	 * then be overridden to DRM_XE_GEM_CPU_CACHING_WB, and coherency
+	 * between GPU- and CPU is guaranteed. The caching mode of
+	 * existing CPU-mappings will be updated transparently to
+	 * user-space clients.
 	 */
 	__u16 cpu_caching;
 	/** @pad: MBZ */
--- linux-qcom-6.8.0.orig/include/uapi/linux/apparmor.h
+++ linux-qcom-6.8.0/include/uapi/linux/apparmor.h
@@ -0,0 +1,131 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _UAPI_LINUX_APPARMOR_H
+#define _UAPI_LINUX_APPARMOR_H
+
+#include <linux/types.h>
+
+#define APPARMOR_MODESET_AUDIT 1
+#define APPARMOR_MODESET_ALLOWED 2
+#define APPARMOR_MODESET_ENFORCE 4
+#define APPARMOR_MODESET_HINT 8
+#define APPARMOR_MODESET_STATUS 16
+#define APPARMOR_MODESET_ERROR 32
+#define APPARMOR_MODESET_KILL 64
+#define APPARMOR_MODESET_USER 128
+
+#define APPARMOR_FLAG_NOCACHE 1
+
+enum apparmor_notif_type {
+	APPARMOR_NOTIF_RESP_PERM,
+	APPARMOR_NOTIF_CANCEL,
+	APPARMOR_NOTIF_INTERUPT,
+	APPARMOR_NOTIF_ALIVE,
+	APPARMOR_NOTIF_OP,
+	APPARMOR_NOTIF_RESP_NAME,
+};
+
+#define APPARMOR_NOTIFY_VERSION 3
+
+/* base notification struct embedded as head of notifications to userspace */
+struct apparmor_notif_common {
+	__u16 len;			/* actual len data */
+	__u16 version;			/* interface version */
+} __attribute__((packed));
+
+struct apparmor_notif_filter {
+	struct apparmor_notif_common base;
+	__u32 modeset;			/* which notification mode */
+	__u32 ns;			/* offset into data */
+	__u32 filter;			/* offset into data */
+
+	__u8 data[];
+} __attribute__((packed));
+
+// flags
+#define URESPONSE_NO_CACHE 1
+#define URESPONSE_LOOKUP 2
+#define URESPONSE_PROFILE 4
+#define URESPONSE_TAILGLOB 8
+
+struct apparmor_notif {
+	struct apparmor_notif_common base;
+	__u16 ntype;			/* notify type */
+	__u8 signalled;
+	__u8 flags;
+	__u64 id;			/* unique id, not gloablly unique*/
+	__s32 error;			/* error if unchanged */
+} __attribute__((packed));
+
+
+struct apparmor_notif_update {
+	struct apparmor_notif base;
+	__u16 ttl;			/* max keep alives left */
+} __attribute__((packed));
+
+/* userspace response to notification that expects a response */
+struct apparmor_notif_resp_perm {
+	struct apparmor_notif base;
+	__s32 error;			/* error if unchanged */
+	__u32 allow;
+	__u32 deny;
+} __attribute__((packed));
+
+struct apparmor_notif_resp_name {
+	union {
+		struct apparmor_notif base;
+		struct apparmor_notif_resp_perm perm;
+	};
+	__u32 name;
+	__u8 data[];
+} __attribute__((packed));
+
+union apparmor_notif_resp {
+	struct apparmor_notif base;
+	struct apparmor_notif_resp_perm perm;
+	struct apparmor_notif_resp_name name;
+} __attribute__((packed));
+
+struct apparmor_notif_op {
+	struct apparmor_notif base;
+	__u32 allow;
+	__u32 deny;
+	pid_t pid;			/* pid of task causing notification */
+	__u32 label;			/* offset into data */
+	__u16 class;
+	__u16 op;
+} __attribute__((packed));
+
+struct apparmor_notif_file {
+	struct apparmor_notif_op base;
+	uid_t subj_uid, obj_uid;
+	__u32 name;			/* offset into data */
+
+	__u8 data[];
+} __attribute__((packed));
+
+union apparmor_notif_all {
+	struct apparmor_notif_common common;
+	struct apparmor_notif_filter filter;
+	struct apparmor_notif base;
+	struct apparmor_notif_op op;
+	struct apparmor_notif_file file;
+	union apparmor_notif_resp respnse;
+};
+
+#define APPARMOR_IOC_MAGIC             0xF8
+
+/* Flags for apparmor notification fd ioctl. */
+
+#define APPARMOR_NOTIF_SET_FILTER      _IOW(APPARMOR_IOC_MAGIC, 0,     \
+						struct apparmor_notif_filter *)
+#define APPARMOR_NOTIF_GET_FILTER      _IOR(APPARMOR_IOC_MAGIC, 1,     \
+						struct apparmor_notif_filter *)
+#define APPARMOR_NOTIF_IS_ID_VALID     _IOR(APPARMOR_IOC_MAGIC, 3,     \
+						__u64)
+/* RECV/SEND from userspace pov */
+#define APPARMOR_NOTIF_RECV            _IOWR(APPARMOR_IOC_MAGIC, 4,     \
+						struct apparmor_notif *)
+#define APPARMOR_NOTIF_SEND            _IOWR(APPARMOR_IOC_MAGIC, 5,    \
+						union apparmor_notif_resp *)
+
+#endif /* _UAPI_LINUX_APPARMOR_H */
--- linux-qcom-6.8.0.orig/include/uapi/linux/audit.h
+++ linux-qcom-6.8.0/include/uapi/linux/audit.h
@@ -143,6 +143,8 @@
 #define AUDIT_MAC_UNLBL_STCDEL	1417	/* NetLabel: del a static label */
 #define AUDIT_MAC_CALIPSO_ADD	1418	/* NetLabel: add CALIPSO DOI entry */
 #define AUDIT_MAC_CALIPSO_DEL	1419	/* NetLabel: del CALIPSO DOI entry */
+#define AUDIT_MAC_TASK_CONTEXTS	1420	/* Multiple LSM task contexts */
+#define AUDIT_MAC_OBJ_CONTEXTS	1421	/* Multiple LSM objext contexts */
 
 #define AUDIT_FIRST_KERN_ANOM_MSG   1700
 #define AUDIT_LAST_KERN_ANOM_MSG    1799
--- linux-qcom-6.8.0.orig/include/uapi/linux/blk-crypto.h
+++ linux-qcom-6.8.0/include/uapi/linux/blk-crypto.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _UAPI_LINUX_BLK_CRYPTO_H
+#define _UAPI_LINUX_BLK_CRYPTO_H
+
+#include <linux/ioctl.h>
+#include <linux/types.h>
+
+struct blk_crypto_import_key_arg {
+	/* Raw key (input) */
+	__u64 raw_key_ptr;
+	__u64 raw_key_size;
+	/* Long-term wrapped key blob (output) */
+	__u64 lt_key_ptr;
+	__u64 lt_key_size;
+	__u64 reserved[4];
+};
+
+struct blk_crypto_generate_key_arg {
+	/* Long-term wrapped key blob (output) */
+	__u64 lt_key_ptr;
+	__u64 lt_key_size;
+	__u64 reserved[4];
+};
+
+struct blk_crypto_prepare_key_arg {
+	/* Long-term wrapped key blob (input) */
+	__u64 lt_key_ptr;
+	__u64 lt_key_size;
+	/* Ephemerally-wrapped key blob (output) */
+	__u64 eph_key_ptr;
+	__u64 eph_key_size;
+	__u64 reserved[4];
+};
+
+/*
+ * These ioctls share the block device ioctl space; see uapi/linux/fs.h.
+ * 140-141 are reserved for future blk-crypto ioctls; any more than that would
+ * require an additional allocation from the block device ioctl space.
+ */
+#define BLKCRYPTOIMPORTKEY _IOWR(0x12, 137, struct blk_crypto_import_key_arg)
+#define BLKCRYPTOGENERATEKEY _IOWR(0x12, 138, struct blk_crypto_generate_key_arg)
+#define BLKCRYPTOPREPAREKEY _IOWR(0x12, 139, struct blk_crypto_prepare_key_arg)
+
+#endif /* _UAPI_LINUX_BLK_CRYPTO_H */
--- linux-qcom-6.8.0.orig/include/uapi/linux/bpf.h
+++ linux-qcom-6.8.0/include/uapi/linux/bpf.h
@@ -77,12 +77,29 @@
 	__s32	imm;		/* signed immediate constant */
 };
 
-/* Key of an a BPF_MAP_TYPE_LPM_TRIE entry */
+/* Deprecated: use struct bpf_lpm_trie_key_u8 (when the "data" member is needed for
+ * byte access) or struct bpf_lpm_trie_key_hdr (when using an alternative type for
+ * the trailing flexible array member) instead.
+ */
 struct bpf_lpm_trie_key {
 	__u32	prefixlen;	/* up to 32 for AF_INET, 128 for AF_INET6 */
 	__u8	data[0];	/* Arbitrary size */
 };
 
+/* Header for bpf_lpm_trie_key structs */
+struct bpf_lpm_trie_key_hdr {
+	__u32	prefixlen;
+};
+
+/* Key of an a BPF_MAP_TYPE_LPM_TRIE entry, with trailing byte array. */
+struct bpf_lpm_trie_key_u8 {
+	union {
+		struct bpf_lpm_trie_key_hdr	hdr;
+		__u32				prefixlen;
+	};
+	__u8	data[];		/* Arbitrary size */
+};
+
 struct bpf_cgroup_storage_key {
 	__u64	cgroup_inode_id;	/* cgroup inode id */
 	__u32	attach_type;		/* program attach type (enum bpf_attach_type) */
@@ -5933,11 +5950,6 @@
 	BPF_F_MARK_ENFORCE		= (1ULL << 6),
 };
 
-/* BPF_FUNC_clone_redirect and BPF_FUNC_redirect flags. */
-enum {
-	BPF_F_INGRESS			= (1ULL << 0),
-};
-
 /* BPF_FUNC_skb_set_tunnel_key and BPF_FUNC_skb_get_tunnel_key flags. */
 enum {
 	BPF_F_TUNINFO_IPV6		= (1ULL << 0),
@@ -6084,10 +6096,12 @@
 	BPF_F_BPRM_SECUREEXEC	= (1ULL << 0),
 };
 
-/* Flags for bpf_redirect_map helper */
+/* Flags for bpf_redirect and bpf_redirect_map helpers */
 enum {
-	BPF_F_BROADCAST		= (1ULL << 3),
-	BPF_F_EXCLUDE_INGRESS	= (1ULL << 4),
+	BPF_F_INGRESS		= (1ULL << 0), /* used for skb path */
+	BPF_F_BROADCAST		= (1ULL << 3), /* used for XDP path */
+	BPF_F_EXCLUDE_INGRESS	= (1ULL << 4), /* used for XDP path */
+#define BPF_F_REDIRECT_FLAGS (BPF_F_INGRESS | BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS)
 };
 
 #define __bpf_md_ptr(type, name)	\
@@ -6096,12 +6110,17 @@
 	__u64 :64;			\
 } __attribute__((aligned(8)))
 
+/* The enum used in skb->tstamp_type. It specifies the clock type
+ * of the time stored in the skb->tstamp.
+ */
 enum {
-	BPF_SKB_TSTAMP_UNSPEC,
-	BPF_SKB_TSTAMP_DELIVERY_MONO,	/* tstamp has mono delivery time */
-	/* For any BPF_SKB_TSTAMP_* that the bpf prog cannot handle,
-	 * the bpf prog should handle it like BPF_SKB_TSTAMP_UNSPEC
-	 * and try to deduce it by ingress, egress or skb->sk->sk_clockid.
+	BPF_SKB_TSTAMP_UNSPEC = 0,		/* DEPRECATED */
+	BPF_SKB_TSTAMP_DELIVERY_MONO = 1,	/* DEPRECATED */
+	BPF_SKB_CLOCK_REALTIME = 0,
+	BPF_SKB_CLOCK_MONOTONIC = 1,
+	BPF_SKB_CLOCK_TAI = 2,
+	/* For any future BPF_SKB_CLOCK_* that the bpf prog cannot handle,
+	 * the bpf prog can try to deduce it by ingress/egress/skb->sk->sk_clockid.
 	 */
 };
 
@@ -6582,6 +6601,7 @@
 					__aligned_u64 file_name; /* in/out */
 					__u32 name_len;
 					__u32 offset; /* offset from file_name */
+					__u64 cookie;
 				} uprobe; /* BPF_PERF_EVENT_UPROBE, BPF_PERF_EVENT_URETPROBE */
 				struct {
 					__aligned_u64 func_name; /* in/out */
@@ -6589,14 +6609,19 @@
 					__u32 offset; /* offset from func_name */
 					__u64 addr;
 					__u64 missed;
+					__u64 cookie;
 				} kprobe; /* BPF_PERF_EVENT_KPROBE, BPF_PERF_EVENT_KRETPROBE */
 				struct {
 					__aligned_u64 tp_name;   /* in/out */
 					__u32 name_len;
+					__u32 :32;
+					__u64 cookie;
 				} tracepoint; /* BPF_PERF_EVENT_TRACEPOINT */
 				struct {
 					__u64 config;
 					__u32 type;
+					__u32 :32;
+					__u64 cookie;
 				} event; /* BPF_PERF_EVENT_EVENT */
 			};
 		} perf_event;
@@ -7040,7 +7065,7 @@
 
 		/* output: MTU value */
 		__u16	mtu_result;
-	};
+	} __attribute__((packed, aligned(2)));
 	/* input: L3 device index for lookup
 	 * output: device index from FIB lookup
 	 */
--- linux-qcom-6.8.0.orig/include/uapi/linux/btrfs.h
+++ linux-qcom-6.8.0/include/uapi/linux/btrfs.h
@@ -92,6 +92,7 @@
  * struct btrfs_qgroup_inherit.flags
  */
 #define BTRFS_QGROUP_INHERIT_SET_LIMITS	(1ULL << 0)
+#define BTRFS_QGROUP_INHERIT_FLAGS_SUPP (BTRFS_QGROUP_INHERIT_SET_LIMITS)
 
 struct btrfs_qgroup_inherit {
 	__u64	flags;
--- linux-qcom-6.8.0.orig/include/uapi/linux/cec.h
+++ linux-qcom-6.8.0/include/uapi/linux/cec.h
@@ -132,6 +132,8 @@
  * Set the msg destination to the orig initiator and the msg initiator to the
  * orig destination. Note that msg and orig may be the same pointer, in which
  * case the change is done in place.
+ *
+ * It also zeroes the reply, timeout and flags fields.
  */
 static inline void cec_msg_set_reply_to(struct cec_msg *msg,
 					struct cec_msg *orig)
@@ -139,7 +141,9 @@
 	/* The destination becomes the initiator and vice versa */
 	msg->msg[0] = (cec_msg_destination(orig) << 4) |
 		      cec_msg_initiator(orig);
-	msg->reply = msg->timeout = 0;
+	msg->reply = 0;
+	msg->timeout = 0;
+	msg->flags = 0;
 }
 
 /**
--- linux-qcom-6.8.0.orig/include/uapi/linux/cn_proc.h
+++ linux-qcom-6.8.0/include/uapi/linux/cn_proc.h
@@ -69,8 +69,7 @@
 
 static inline enum proc_cn_event valid_event(enum proc_cn_event ev_type)
 {
-	ev_type &= PROC_EVENT_ALL;
-	return ev_type;
+	return (enum proc_cn_event)(ev_type & PROC_EVENT_ALL);
 }
 
 /*
--- linux-qcom-6.8.0.orig/include/uapi/linux/dpll.h
+++ linux-qcom-6.8.0/include/uapi/linux/dpll.h
@@ -180,6 +180,9 @@
 	DPLL_A_PIN_PHASE_ADJUST,
 	DPLL_A_PIN_PHASE_OFFSET,
 	DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET,
+	DPLL_A_PIN_ESYNC_FREQUENCY,
+	DPLL_A_PIN_ESYNC_FREQUENCY_SUPPORTED,
+	DPLL_A_PIN_ESYNC_PULSE,
 
 	__DPLL_A_PIN_MAX,
 	DPLL_A_PIN_MAX = (__DPLL_A_PIN_MAX - 1)
--- linux-qcom-6.8.0.orig/include/uapi/linux/fanotify.h
+++ linux-qcom-6.8.0/include/uapi/linux/fanotify.h
@@ -60,6 +60,7 @@
 #define FAN_REPORT_DIR_FID	0x00000400	/* Report unique directory id */
 #define FAN_REPORT_NAME		0x00000800	/* Report events with name */
 #define FAN_REPORT_TARGET_FID	0x00001000	/* Report dirent target id  */
+#define FAN_REPORT_FD_ERROR	0x00002000	/* event->fd can report error */
 
 /* Convenience macro - FAN_REPORT_NAME requires FAN_REPORT_DIR_FID */
 #define FAN_REPORT_DFID_NAME	(FAN_REPORT_DIR_FID | FAN_REPORT_NAME)
--- linux-qcom-6.8.0.orig/include/uapi/linux/fs.h
+++ linux-qcom-6.8.0/include/uapi/linux/fs.h
@@ -185,10 +185,8 @@
 #define BLKROTATIONAL _IO(0x12,126)
 #define BLKZEROOUT _IO(0x12,127)
 #define BLKGETDISKSEQ _IOR(0x12,128,__u64)
-/*
- * A jump here: 130-136 are reserved for zoned block devices
- * (see uapi/linux/blkzoned.h)
- */
+/* 130-136 are used by zoned block device ioctls (uapi/linux/blkzoned.h) */
+/* 137-141 are used by blk-crypto ioctls (uapi/linux/blk-crypto.h) */
 
 #define BMAP_IOCTL 1		/* obsolete - kept for compatibility */
 #define FIBMAP	   _IO(0x00,1)	/* bmap access */
--- linux-qcom-6.8.0.orig/include/uapi/linux/fscrypt.h
+++ linux-qcom-6.8.0/include/uapi/linux/fscrypt.h
@@ -20,6 +20,7 @@
 #define FSCRYPT_POLICY_FLAG_DIRECT_KEY		0x04
 #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64	0x08
 #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32	0x10
+#define FSCRYPT_POLICY_FLAG_HW_WRAPPED_KEY	0x20
 
 /* Encryption algorithms */
 #define FSCRYPT_MODE_AES_256_XTS		1
@@ -119,7 +120,7 @@
  */
 struct fscrypt_provisioning_key_payload {
 	__u32 type;
-	__u32 __reserved;
+	__u32 flags;
 	__u8 raw[];
 };
 
@@ -128,7 +129,9 @@
 	struct fscrypt_key_specifier key_spec;
 	__u32 raw_size;
 	__u32 key_id;
-	__u32 __reserved[8];
+#define FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED			0x00000001
+	__u32 flags;
+	__u32 __reserved[7];
 	__u8 raw[];
 };
 
--- linux-qcom-6.8.0.orig/include/uapi/linux/gunyah.h
+++ linux-qcom-6.8.0/include/uapi/linux/gunyah.h
@@ -0,0 +1,303 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _UAPI_LINUX_GUNYAH_H
+#define _UAPI_LINUX_GUNYAH_H
+
+/*
+ * Userspace interface for /dev/gunyah - gunyah based virtual machine
+ */
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define GH_IOCTL_TYPE			'G'
+
+/*
+ * ioctls for /dev/gunyah fds:
+ */
+#define GH_CREATE_VM			_IO(GH_IOCTL_TYPE, 0x0) /* Returns a Gunyah VM fd */
+
+/*
+ * ioctls for VM fds
+ */
+
+/**
+ * enum gh_mem_flags - Possible flags on &struct gh_userspace_memory_region
+ * @GH_MEM_ALLOW_READ: Allow guest to read the memory
+ * @GH_MEM_ALLOW_WRITE: Allow guest to write to the memory
+ * @GH_MEM_ALLOW_EXEC: Allow guest to execute instructions in the memory
+ */
+enum gh_mem_flags {
+	GH_MEM_ALLOW_READ	= 1UL << 0,
+	GH_MEM_ALLOW_WRITE	= 1UL << 1,
+	GH_MEM_ALLOW_EXEC	= 1UL << 2,
+};
+
+/**
+ * struct gh_userspace_memory_region - Userspace memory descripion for GH_VM_SET_USER_MEM_REGION
+ * @label: Identifer to the region which is unique to the VM.
+ * @flags: Flags for memory parcel behavior. See &enum gh_mem_flags.
+ * @guest_phys_addr: Location of the memory region in guest's memory space (page-aligned)
+ * @memory_size: Size of the region (page-aligned)
+ * @userspace_addr: Location of the memory region in caller (userspace)'s memory
+ *
+ * See Documentation/virt/gunyah/vm-manager.rst for further details.
+ */
+struct gh_userspace_memory_region {
+	__u32 label;
+	__u32 flags;
+	__u64 guest_phys_addr;
+	__u64 memory_size;
+	__u64 userspace_addr;
+};
+
+#define GH_VM_SET_USER_MEM_REGION	_IOW(GH_IOCTL_TYPE, 0x1, \
+						struct gh_userspace_memory_region)
+
+/**
+ * struct gh_vm_dtb_config - Set the location of the VM's devicetree blob
+ * @guest_phys_addr: Address of the VM's devicetree in guest memory.
+ * @size: Maximum size of the devicetree including space for overlays.
+ *        Resource manager applies an overlay to the DTB and dtb_size should
+ *        include room for the overlay. A page of memory is typicaly plenty.
+ */
+struct gh_vm_dtb_config {
+	__u64 guest_phys_addr;
+	__u64 size;
+};
+#define GH_VM_SET_DTB_CONFIG	_IOW(GH_IOCTL_TYPE, 0x2, struct gh_vm_dtb_config)
+
+#define GH_VM_START		_IO(GH_IOCTL_TYPE, 0x3)
+
+/**
+ * enum gh_fn_type - Valid types of Gunyah VM functions
+ * @GH_FN_VCPU: create a vCPU instance to control a vCPU
+ *              &struct gh_fn_desc.arg is a pointer to &struct gh_fn_vcpu_arg
+ *              Return: file descriptor to manipulate the vcpu.
+ * @GH_FN_IRQFD: register eventfd to assert a Gunyah doorbell
+ *               &struct gh_fn_desc.arg is a pointer to &struct gh_fn_irqfd_arg
+ * @GH_FN_IOEVENTFD: register ioeventfd to trigger when VM faults on parameter
+ *                   &struct gh_fn_desc.arg is a pointer to &struct gh_fn_ioeventfd_arg
+ */
+enum gh_fn_type {
+	GH_FN_VCPU = 1,
+	GH_FN_IRQFD,
+	GH_FN_IOEVENTFD,
+};
+
+#define GH_FN_MAX_ARG_SIZE		256
+
+/**
+ * struct gh_fn_vcpu_arg - Arguments to create a vCPU.
+ * @id: vcpu id
+ *
+ * Create this function with &GH_VM_ADD_FUNCTION using type &GH_FN_VCPU.
+ *
+ * The vcpu type will register with the VM Manager to expect to control
+ * vCPU number `vcpu_id`. It returns a file descriptor allowing interaction with
+ * the vCPU. See the Gunyah vCPU API description sections for interacting with
+ * the Gunyah vCPU file descriptors.
+ */
+struct gh_fn_vcpu_arg {
+	__u32 id;
+};
+
+/**
+ * enum gh_irqfd_flags - flags for use in gh_fn_irqfd_arg
+ * @GH_IRQFD_FLAGS_LEVEL: make the interrupt operate like a level triggered
+ *                        interrupt on guest side. Triggering IRQFD before
+ *                        guest handles the interrupt causes interrupt to
+ *                        stay asserted.
+ */
+enum gh_irqfd_flags {
+	GH_IRQFD_FLAGS_LEVEL		= 1UL << 0,
+};
+
+/**
+ * struct gh_fn_irqfd_arg - Arguments to create an irqfd function.
+ *
+ * Create this function with &GH_VM_ADD_FUNCTION using type &GH_FN_IRQFD.
+ *
+ * Allows setting an eventfd to directly trigger a guest interrupt.
+ * irqfd.fd specifies the file descriptor to use as the eventfd.
+ * irqfd.label corresponds to the doorbell label used in the guest VM's devicetree.
+ *
+ * @fd: an eventfd which when written to will raise a doorbell
+ * @label: Label of the doorbell created on the guest VM
+ * @flags: see &enum gh_irqfd_flags
+ * @padding: padding bytes
+ */
+struct gh_fn_irqfd_arg {
+	__u32 fd;
+	__u32 label;
+	__u32 flags;
+	__u32 padding;
+};
+
+/**
+ * enum gh_ioeventfd_flags - flags for use in gh_fn_ioeventfd_arg
+ * @GH_IOEVENTFD_FLAGS_DATAMATCH: the event will be signaled only if the
+ *                                written value to the registered address is
+ *                                equal to &struct gh_fn_ioeventfd_arg.datamatch
+ */
+enum gh_ioeventfd_flags {
+	GH_IOEVENTFD_FLAGS_DATAMATCH	= 1UL << 0,
+};
+
+/**
+ * struct gh_fn_ioeventfd_arg - Arguments to create an ioeventfd function
+ * @datamatch: data used when GH_IOEVENTFD_DATAMATCH is set
+ * @addr: Address in guest memory
+ * @len: Length of access
+ * @fd: When ioeventfd is matched, this eventfd is written
+ * @flags: See &enum gh_ioeventfd_flags
+ * @padding: padding bytes
+ *
+ * Create this function with &GH_VM_ADD_FUNCTION using type &GH_FN_IOEVENTFD.
+ *
+ * Attaches an ioeventfd to a legal mmio address within the guest. A guest write
+ * in the registered address will signal the provided event instead of triggering
+ * an exit on the GH_VCPU_RUN ioctl.
+ */
+struct gh_fn_ioeventfd_arg {
+	__u64 datamatch;
+	__u64 addr;        /* legal mmio address */
+	__u32 len;         /* 1, 2, 4, or 8 bytes; or 0 to ignore length */
+	__s32 fd;
+	__u32 flags;
+	__u32 padding;
+};
+
+/**
+ * struct gh_fn_desc - Arguments to create a VM function
+ * @type: Type of the function. See &enum gh_fn_type.
+ * @arg_size: Size of argument to pass to the function. arg_size <= GH_FN_MAX_ARG_SIZE
+ * @arg: Pointer to argument given to the function. See &enum gh_fn_type for expected
+ *       arguments for a function type.
+ */
+struct gh_fn_desc {
+	__u32 type;
+	__u32 arg_size;
+	__u64 arg;
+};
+
+#define GH_VM_ADD_FUNCTION	_IOW(GH_IOCTL_TYPE, 0x4, struct gh_fn_desc)
+#define GH_VM_REMOVE_FUNCTION	_IOW(GH_IOCTL_TYPE, 0x7, struct gh_fn_desc)
+
+/*
+ * ioctls for vCPU fds
+ */
+
+/**
+ * enum gh_vm_status - Stores status reason why VM is not runnable (exited).
+ * @GH_VM_STATUS_LOAD_FAILED: VM didn't start because it couldn't be loaded.
+ * @GH_VM_STATUS_EXITED: VM requested shutdown/reboot.
+ *                       Use &struct gh_vm_exit_info.reason for further details.
+ * @GH_VM_STATUS_CRASHED: VM state is unknown and has crashed.
+ */
+enum gh_vm_status {
+	GH_VM_STATUS_LOAD_FAILED	= 1,
+	GH_VM_STATUS_EXITED		= 2,
+	GH_VM_STATUS_CRASHED		= 3,
+};
+
+/*
+ * Gunyah presently sends max 4 bytes of exit_reason.
+ * If that changes, this macro can be safely increased without breaking
+ * userspace so long as struct gh_vcpu_run < PAGE_SIZE.
+ */
+#define GH_VM_MAX_EXIT_REASON_SIZE	8u
+
+/**
+ * struct gh_vm_exit_info - Reason for VM exit as reported by Gunyah
+ * See Gunyah documentation for values.
+ * @type: Describes how VM exited
+ * @padding: padding bytes
+ * @reason_size: Number of bytes valid for `reason`
+ * @reason: See Gunyah documentation for interpretation. Note: these values are
+ *          not interpreted by Linux and need to be converted from little-endian
+ *          as applicable.
+ */
+struct gh_vm_exit_info {
+	__u16 type;
+	__u16 padding;
+	__u32 reason_size;
+	__u8 reason[GH_VM_MAX_EXIT_REASON_SIZE];
+};
+
+/**
+ * enum gh_vcpu_exit - Stores reason why &GH_VCPU_RUN ioctl recently exited with status 0
+ * @GH_VCPU_EXIT_UNKNOWN: Not used, status != 0
+ * @GH_VCPU_EXIT_MMIO: vCPU performed a read or write that could not be handled
+ *                     by hypervisor or Linux. Use @struct gh_vcpu_run.mmio for
+ *                     details of the read/write.
+ * @GH_VCPU_EXIT_STATUS: vCPU not able to run because the VM has exited.
+ *                       Use @struct gh_vcpu_run.status for why VM has exited.
+ */
+enum gh_vcpu_exit {
+	GH_VCPU_EXIT_UNKNOWN,
+	GH_VCPU_EXIT_MMIO,
+	GH_VCPU_EXIT_STATUS,
+};
+
+/**
+ * struct gh_vcpu_run - Application code obtains a pointer to the gh_vcpu_run
+ *                      structure by mmap()ing a vcpu fd.
+ * @immediate_exit: polled when scheduling the vcpu. If set, immediately returns -EINTR.
+ * @padding: padding bytes
+ * @exit_reason: Set when GH_VCPU_RUN returns successfully and gives reason why
+ *               GH_VCPU_RUN has stopped running the vCPU. See &enum gh_vcpu_exit.
+ * @mmio: Used when exit_reason == GH_VCPU_EXIT_MMIO
+ *        The guest has faulted on an memory-mapped I/O instruction that
+ *        couldn't be satisfied by gunyah.
+ * @mmio.phys_addr: Address guest tried to access
+ * @mmio.data: the value that was written if `is_write == 1`. Filled by
+ *        user for reads (`is_write == 0`).
+ * @mmio.len: Length of write. Only the first `len` bytes of `data`
+ *       are considered by Gunyah.
+ * @mmio.is_write: 1 if VM tried to perform a write, 0 for a read
+ * @status: Used when exit_reason == GH_VCPU_EXIT_STATUS.
+ *          The guest VM is no longer runnable. This struct informs why.
+ * @status.status: See &enum gh_vm_status for possible values
+ * @status.exit_info: Used when status == GH_VM_STATUS_EXITED
+ */
+struct gh_vcpu_run {
+	/* in */
+	__u8 immediate_exit;
+	__u8 padding[7];
+
+	/* out */
+	__u32 exit_reason;
+
+	union {
+		struct {
+			__u64 phys_addr;
+			__u8  data[8];
+			__u32 len;
+			__u8  is_write;
+		} mmio;
+
+		struct {
+			enum gh_vm_status status;
+			struct gh_vm_exit_info exit_info;
+		} status;
+	};
+};
+
+#define GH_VCPU_RUN		_IO(GH_IOCTL_TYPE, 0x5)
+#define GH_VCPU_MMAP_SIZE	_IO(GH_IOCTL_TYPE, 0x6)
+
+/**
+ * ANDROID: android14-6.1 unfortunately contains UAPI that won't be carried
+ * in kernel.org. Expose orthogonal ioctls that will never conflict with
+ * kernel.org for these UAPIs. See b/268234781.
+ */
+#define GH_ANDROID_IOCTL_TYPE		'A'
+
+#define GH_VM_ANDROID_LEND_USER_MEM	_IOW(GH_ANDROID_IOCTL_TYPE, 0x11, \
+						struct gh_userspace_memory_region)
+
+#endif
--- linux-qcom-6.8.0.orig/include/uapi/linux/if_link.h
+++ linux-qcom-6.8.0/include/uapi/linux/if_link.h
@@ -1292,6 +1292,19 @@
 	NETKIT_L3,
 };
 
+/* NETKIT_SCRUB_NONE leaves clearing skb->{mark,priority} up to
+ * the BPF program if attached. This also means the latter can
+ * consume the two fields if they were populated earlier.
+ *
+ * NETKIT_SCRUB_DEFAULT zeroes skb->{mark,priority} fields before
+ * invoking the attached BPF program when the peer device resides
+ * in a different network namespace. This is the default behavior.
+ */
+enum netkit_scrub {
+	NETKIT_SCRUB_NONE,
+	NETKIT_SCRUB_DEFAULT,
+};
+
 enum {
 	IFLA_NETKIT_UNSPEC,
 	IFLA_NETKIT_PEER_INFO,
@@ -1299,6 +1312,8 @@
 	IFLA_NETKIT_POLICY,
 	IFLA_NETKIT_PEER_POLICY,
 	IFLA_NETKIT_MODE,
+	IFLA_NETKIT_SCRUB,
+	IFLA_NETKIT_PEER_SCRUB,
 	__IFLA_NETKIT_MAX,
 };
 #define IFLA_NETKIT_MAX	(__IFLA_NETKIT_MAX - 1)
@@ -1378,6 +1393,7 @@
 	IFLA_VXLAN_VNIFILTER, /* only applicable with COLLECT_METADATA mode */
 	IFLA_VXLAN_LOCALBYPASS,
 	IFLA_VXLAN_LABEL_POLICY, /* IPv6 flow label policy; ifla_vxlan_label_policy */
+	IFLA_VXLAN_FAN_MAP = 33,
 	__IFLA_VXLAN_MAX
 };
 #define IFLA_VXLAN_MAX	(__IFLA_VXLAN_MAX - 1)
--- linux-qcom-6.8.0.orig/include/uapi/linux/if_tunnel.h
+++ linux-qcom-6.8.0/include/uapi/linux/if_tunnel.h
@@ -77,6 +77,10 @@
 	IFLA_IPTUN_ENCAP_DPORT,
 	IFLA_IPTUN_COLLECT_METADATA,
 	IFLA_IPTUN_FWMARK,
+
+	__IFLA_IPTUN_VENDOR_BREAK, /* Ensure new entries do not hit the below. */
+	IFLA_IPTUN_FAN_MAP = 33,
+
 	__IFLA_IPTUN_MAX,
 };
 #define IFLA_IPTUN_MAX	(__IFLA_IPTUN_MAX - 1)
@@ -182,4 +186,19 @@
 		(TUNNEL_GENEVE_OPT | TUNNEL_VXLAN_OPT | TUNNEL_ERSPAN_OPT | \
 		TUNNEL_GTP_OPT)
 
+enum {
+	IFLA_FAN_UNSPEC,
+	IFLA_FAN_MAPPING,
+	__IFLA_FAN_MAX,
+};
+
+#define IFLA_FAN_MAX (__IFLA_FAN_MAX - 1)
+
+struct ifla_fan_map {
+	__be32		underlay;
+	__be32		overlay;
+	__u16		underlay_prefix;
+	__u16		overlay_prefix;
+};
+
 #endif /* _UAPI_IF_TUNNEL_H_ */
--- linux-qcom-6.8.0.orig/include/uapi/linux/if_xdp.h
+++ linux-qcom-6.8.0/include/uapi/linux/if_xdp.h
@@ -41,6 +41,10 @@
  */
 #define XDP_UMEM_TX_SW_CSUM		(1 << 1)
 
+/* Request to reserve tx_metadata_len bytes of per-chunk metadata.
+ */
+#define XDP_UMEM_TX_METADATA_LEN	(1 << 2)
+
 struct sockaddr_xdp {
 	__u16 sxdp_family;
 	__u16 sxdp_flags;
--- linux-qcom-6.8.0.orig/include/uapi/linux/input-event-codes.h
+++ linux-qcom-6.8.0/include/uapi/linux/input-event-codes.h
@@ -602,6 +602,7 @@
 
 #define KEY_ALS_TOGGLE		0x230	/* Ambient light sensor */
 #define KEY_ROTATE_LOCK_TOGGLE	0x231	/* Display rotation lock */
+#define KEY_REFRESH_RATE_TOGGLE	0x232	/* Display refresh rate toggle */
 
 #define KEY_BUTTONCONFIG		0x240	/* AL Button Configuration */
 #define KEY_TASKMANAGER		0x241	/* AL Task/Project Manager */
@@ -617,6 +618,8 @@
 #define KEY_CAMERA_ACCESS_ENABLE	0x24b	/* Enables programmatic access to camera devices. (HUTRR72) */
 #define KEY_CAMERA_ACCESS_DISABLE	0x24c	/* Disables programmatic access to camera devices. (HUTRR72) */
 #define KEY_CAMERA_ACCESS_TOGGLE	0x24d	/* Toggles the current state of the camera access control. (HUTRR72) */
+#define KEY_ACCESSIBILITY		0x24e	/* Toggles the system bound accessibility UI/command (HUTRR116) */
+#define KEY_DO_NOT_DISTURB		0x24f	/* Toggles the system-wide "Do Not Disturb" control (HUTRR94)*/
 
 #define KEY_BRIGHTNESS_MIN		0x250	/* Set Brightness to Minimum */
 #define KEY_BRIGHTNESS_MAX		0x251	/* Set Brightness to Maximum */
--- linux-qcom-6.8.0.orig/include/uapi/linux/kfd_ioctl.h
+++ linux-qcom-6.8.0/include/uapi/linux/kfd_ioctl.h
@@ -912,14 +912,25 @@
 				 KFD_EC_MASK(EC_DEVICE_NEW))
 #define KFD_EC_MASK_PROCESS	(KFD_EC_MASK(EC_PROCESS_RUNTIME) |	\
 				 KFD_EC_MASK(EC_PROCESS_DEVICE_REMOVE))
+#define KFD_EC_MASK_PACKET	(KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_DIM_INVALID) |	\
+				 KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_GROUP_SEGMENT_SIZE_INVALID) |	\
+				 KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_CODE_INVALID) |	\
+				 KFD_EC_MASK(EC_QUEUE_PACKET_RESERVED) |	\
+				 KFD_EC_MASK(EC_QUEUE_PACKET_UNSUPPORTED) |	\
+				 KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_WORK_GROUP_SIZE_INVALID) |	\
+				 KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_REGISTER_INVALID) |	\
+				 KFD_EC_MASK(EC_QUEUE_PACKET_VENDOR_UNSUPPORTED))
 
 /* Checks for exception code types for KFD search */
+#define KFD_DBG_EC_IS_VALID(ecode) (ecode > EC_NONE && ecode < EC_MAX)
 #define KFD_DBG_EC_TYPE_IS_QUEUE(ecode)					\
-			(!!(KFD_EC_MASK(ecode) & KFD_EC_MASK_QUEUE))
+			(KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_QUEUE))
 #define KFD_DBG_EC_TYPE_IS_DEVICE(ecode)				\
-			(!!(KFD_EC_MASK(ecode) & KFD_EC_MASK_DEVICE))
+			(KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_DEVICE))
 #define KFD_DBG_EC_TYPE_IS_PROCESS(ecode)				\
-			(!!(KFD_EC_MASK(ecode) & KFD_EC_MASK_PROCESS))
+			(KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_PROCESS))
+#define KFD_DBG_EC_TYPE_IS_PACKET(ecode)				\
+			(KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_PACKET))
 
 
 /* Runtime enable states */
--- linux-qcom-6.8.0.orig/include/uapi/linux/mem-buf.h
+++ linux-qcom-6.8.0/include/uapi/linux/mem-buf.h
@@ -0,0 +1,252 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _UAPI_LINUX_MEM_BUF_H
+#define _UAPI_LINUX_MEM_BUF_H
+
+#include <linux/ioctl.h>
+#include <linux/types.h>
+
+#define MEM_BUF_IOC_MAGIC 'M'
+
+/**
+ * enum mem_buf_mem_type: Types of memory that can be allocated from and to
+ * @MEM_BUF_ION_MEM_TYPE: The memory for the source or destination is ION memory
+ */
+enum mem_buf_mem_type {
+	MEM_BUF_ION_MEM_TYPE,
+	MEM_BUF_MAX_MEM_TYPE,
+};
+#define MEM_BUF_DMAHEAP_MEM_TYPE (MEM_BUF_ION_MEM_TYPE + 1)
+/* RESERVED for MEM_BUF_BUDDY_MEM_TYPE: MEM_BUF_ION_MEM_TYPE + 2 */
+
+/* The mem-buf values that represent VMIDs for an ACL. */
+#define MEM_BUF_VMID_PRIMARY_VM 0
+#define	MEM_BUF_VMID_TRUSTED_VM 1
+
+#define MEM_BUF_PERM_FLAG_READ (1U << 0)
+#define MEM_BUF_PERM_FLAG_WRITE (1U << 1)
+#define MEM_BUF_PERM_FLAG_EXEC (1U << 2)
+#define MEM_BUF_PERM_VALID_FLAGS\
+	(MEM_BUF_PERM_FLAG_READ | MEM_BUF_PERM_FLAG_WRITE |\
+	 MEM_BUF_PERM_FLAG_EXEC)
+
+#define MEM_BUF_MAX_NR_ACL_ENTS 16
+
+/**
+ * struct acl_entry: Represents the access control permissions for a VMID.
+ * @vmid: The mem-buf VMID specifier associated with the VMID that will access
+ * the memory.
+ * @perms: The access permissions for the VMID in @vmid. This flag is
+ * interpreted as a bitmap, and thus, should be a combination of one or more
+ * of the MEM_BUF_PERM_FLAG_* flags.
+ */
+struct acl_entry {
+	__u32 vmid;
+	__u32 perms;
+};
+
+/**
+ * struct mem_buf_ion_data: Data that is unique to memory that is of type
+ * MEM_BUF_ION_MEM_TYPE.
+ * @heap_id: The heap ID of where memory should be allocated from or added to.
+ */
+struct mem_buf_ion_data {
+	__u32 heap_id;
+};
+
+#define MEM_BUF_MAX_DMAHEAP_NAME_LEN 128
+/**
+ * struct mem_buf_dmaheap_data: Data that is unique to memory that is of type
+ * MEM_BUF_DMAHEAP_MEM_TYPE.
+ * @heap_name: array of characters containing the heap name.
+ */
+struct mem_buf_dmaheap_data {
+	__u64 heap_name;
+};
+
+/**
+ * struct mem_buf_alloc_ioctl_arg: A request to allocate memory from another
+ * VM to other VMs.
+ * @size: The size of the allocation.
+ * @acl_list: An array of structures, where each structure specifies a VMID
+ * and the access permissions that the VMID will have to the memory to be
+ * allocated.
+ * @nr_acl_entries: The number of ACL entries in @acl_list.
+ * @src_mem_type: The type of memory that the source VM should allocate from.
+ * This should be one of the mem_buf_mem_type enum values.
+ * @src_data: A pointer to data that the source VM should interpret when
+ * performing the allocation.
+ * @dst_mem_type: The type of memory that the destination VM should treat the
+ * incoming allocation from the source VM as. This should be one of the
+ * mem_buf_mem_type enum values.
+ * @mem_buf_fd: A file descriptor representing the memory that was allocated
+ * from the source VM and added to the current VM. Calling close() on this file
+ * descriptor will deallocate the memory from the current VM, and return it
+ * to the source VM.
+ * * @dst_data: A pointer to data that the destination VM should interpret when
+ * adding the memory to the current VM.
+ *
+ * All reserved fields must be zeroed out by the caller prior to invoking the
+ * allocation IOCTL command with this argument.
+ */
+struct mem_buf_alloc_ioctl_arg {
+	__u64 size;
+	__u64 acl_list;
+	__u32 nr_acl_entries;
+	__u32 src_mem_type;
+	__u64 src_data;
+	__u32 dst_mem_type;
+	__u32 mem_buf_fd;
+	__u64 dst_data;
+	__u64 reserved0;
+	__u64 reserved1;
+	__u64 reserved2;
+};
+
+#define MEM_BUF_IOC_ALLOC		_IOWR(MEM_BUF_IOC_MAGIC, 0,\
+					      struct mem_buf_alloc_ioctl_arg)
+
+/**
+ * struct mem_buf_lend_ioctl_arg: A request to lend memory from the local VM
+ * VM to one or more remote VMs.
+ * @dma_buf_fd: The fd of the dma-buf that will be exported to another VM.
+ * @nr_acl_entries: The number of ACL entries in @acl_list.
+ * @acl_list: An array of structures, where each structure specifies a VMID
+ * and the access permissions that the VMID will have to the memory to be
+ * exported. Must not include the local VMID.
+ * @memparcel_hdl: The handle associated with the memparcel that was created by
+ * granting access to the dma-buf for the VMIDs specified in @acl_list.
+ *
+ * All reserved fields must be zeroed out by the caller prior to invoking the
+ * import IOCTL command with this argument.
+ */
+struct mem_buf_lend_ioctl_arg {
+	__u32 dma_buf_fd;
+	__u32 nr_acl_entries;
+	__u64 acl_list;
+	__u64 memparcel_hdl;
+	__u64 reserved0;
+	__u64 reserved1;
+	__u64 reserved2;
+};
+
+#define MEM_BUF_IOC_LEND		_IOWR(MEM_BUF_IOC_MAGIC, 3,\
+					      struct mem_buf_lend_ioctl_arg)
+
+#define MEM_BUF_VALID_FD_FLAGS (O_CLOEXEC | O_ACCMODE)
+/**
+ * struct mem_buf_retrieve_ioctl_arg: A request to retrieve memory from another
+ * VM as a dma-buf
+ * @sender_vm_fd: An open file descriptor identifing the VM who sent the handle.
+ * @nr_acl_entries: The number of ACL entries in @acl_list.
+ * @acl_list: An array of structures, where each structure specifies a VMID
+ * and the access permissions that the VMID should have for the memparcel.
+ * @memparcel_hdl: The handle that corresponds to the memparcel we are
+ * importing.
+ * @dma_buf_import_fd: A dma-buf file descriptor that the client can use to
+ * access the buffer. This fd must be closed to release the memory.
+ * @fd_flags:		file descriptor flags used when allocating
+ *
+ * All reserved fields must be zeroed out by the caller prior to invoking the
+ * import IOCTL command with this argument.
+ */
+struct mem_buf_retrieve_ioctl_arg {
+	__u32 sender_vm_fd;
+	__u32 nr_acl_entries;
+	__u64 acl_list;
+	__u64 memparcel_hdl;
+	__u32 dma_buf_import_fd;
+	__u32 fd_flags;
+	__u64 reserved0;
+	__u64 reserved1;
+	__u64 reserved2;
+};
+
+#define MEM_BUF_IOC_RETRIEVE		_IOWR(MEM_BUF_IOC_MAGIC, 4,\
+					      struct mem_buf_retrieve_ioctl_arg)
+
+/**
+ * struct mem_buf_reclaim_ioctl_arg: A request to reclaim memory from another
+ * VM. The other VM must have relinquished access, and the current VM must be
+ * the original owner of the memory. The dma-buf file will not be closed by
+ * this operation.
+ * @memparcel_hdl: The handle that corresponds to the memparcel we are
+ * reclaiming.
+ * @dma_buf_fd: A dma-buf file descriptor that the client can use to
+ * access the buffer.
+ *
+ * All reserved fields must be zeroed out by the caller prior to invoking the
+ * import IOCTL command with this argument.
+ */
+struct mem_buf_reclaim_ioctl_arg {
+	__u64 memparcel_hdl;
+	__u32 dma_buf_fd;
+	__u32 reserved0;
+	__u64 reserved1;
+	__u64 reserved2;
+};
+
+#define MEM_BUF_IOC_RECLAIM		_IOWR(MEM_BUF_IOC_MAGIC, 3,\
+					      struct mem_buf_reclaim_ioctl_arg)
+
+/**
+ * struct mem_buf_share_ioctl_arg: An request to share memory between the
+ * local VM and one or more remote VMs.
+ * @dma_buf_fd: The fd of the dma-buf that will be exported to another VM.
+ * @nr_acl_entries: The number of ACL entries in @acl_list.
+ * @acl_list: An array of structures, where each structure specifies a VMID
+ * and the access permissions that the VMID will have to the memory to be
+ * exported. Must include the local VMID.
+ * @memparcel_hdl: The handle associated with the memparcel that was created by
+ * granting access to the dma-buf for the VMIDs specified in @acl_list.
+ *
+ * All reserved fields must be zeroed out by the caller prior to invoking the
+ * import IOCTL command with this argument.
+ */
+struct mem_buf_share_ioctl_arg {
+	__u32 dma_buf_fd;
+	__u32 nr_acl_entries;
+	__u64 acl_list;
+	__u64 memparcel_hdl;
+	__u64 reserved0;
+	__u64 reserved1;
+	__u64 reserved2;
+};
+
+#define MEM_BUF_IOC_SHARE		_IOWR(MEM_BUF_IOC_MAGIC, 6,\
+					      struct mem_buf_share_ioctl_arg)
+
+/**
+ * struct mem_buf_exclusive_owner_ioctl_arg: A request to see if a DMA-BUF
+ * is owned by and belongs exclusively to this VM.
+ * @dma_buf_fd: The fd of the dma-buf the user wants to obtain information on
+ * @is_exclusive_owner:
+ */
+struct mem_buf_exclusive_owner_ioctl_arg {
+	__u32 dma_buf_fd;
+	__u32 is_exclusive_owner;
+};
+
+#define MEM_BUF_IOC_EXCLUSIVE_OWNER	_IOWR(MEM_BUF_IOC_MAGIC, 2,\
+					      struct mem_buf_exclusive_owner_ioctl_arg)
+
+/**
+ * struct mem_buf_get_memparcel_hdl_ioctl_arg: A request to get the Gunyah
+ * memparcel handle from a DMA-BUF, given that it has one.
+ * @memparcel_hdl: The handle associated with the DMA-BUF, if it exists
+ * @dma_buf_fd: The fd of the dma-buf the user wants to obtain a handle from
+ */
+struct mem_buf_get_memparcel_hdl_ioctl_arg {
+	__u64 memparcel_hdl;
+	__u32 dma_buf_fd;
+	__u32 padding;
+};
+
+#define MEM_BUF_IOC_GET_MEMPARCEL_HDL	_IOWR(MEM_BUF_IOC_MAGIC, 5,\
+					      struct mem_buf_get_memparcel_hdl_ioctl_arg)
+
+#endif /* _UAPI_LINUX_MEM_BUF_H */
--- linux-qcom-6.8.0.orig/include/uapi/linux/netfilter/nf_tables.h
+++ linux-qcom-6.8.0/include/uapi/linux/netfilter/nf_tables.h
@@ -1372,7 +1372,7 @@
 #define NFTA_SECMARK_MAX	(__NFTA_SECMARK_MAX - 1)
 
 /* Max security context length */
-#define NFT_SECMARK_CTX_MAXLEN		256
+#define NFT_SECMARK_CTX_MAXLEN		4096
 
 /**
  * enum nft_reject_types - nf_tables reject expression reject types
@@ -1690,7 +1690,7 @@
  *
  * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
  * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
- * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
+ * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED)
  * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
  * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
  * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
--- linux-qcom-6.8.0.orig/include/uapi/linux/rfkill.h
+++ linux-qcom-6.8.0/include/uapi/linux/rfkill.h
@@ -159,16 +159,8 @@
  * old behaviour for all userspace, unless it explicitly opts in to the
  * rules outlined here by using the new &struct rfkill_event_ext.
  *
- * Additionally, some other userspace (bluez, g-s-d) was reading with a
- * large size but as streaming reads rather than message-based, or with
- * too strict checks for the returned size. So eventually, we completely
- * reverted this, and extended messages need to be opted in to by using
- * an ioctl:
- *
- *  ioctl(fd, RFKILL_IOCTL_MAX_SIZE, sizeof(struct rfkill_event_ext));
- *
- * Userspace using &struct rfkill_event_ext and the ioctl must adhere to
- * the following rules:
+ * Userspace using &struct rfkill_event_ext must adhere to the following
+ * rules
  *
  * 1. accept short writes, optionally using them to detect that it's
  *    running on an older kernel;
@@ -183,8 +175,6 @@
 #define RFKILL_IOC_MAGIC	'R'
 #define RFKILL_IOC_NOINPUT	1
 #define RFKILL_IOCTL_NOINPUT	_IO(RFKILL_IOC_MAGIC, RFKILL_IOC_NOINPUT)
-#define RFKILL_IOC_MAX_SIZE	2
-#define RFKILL_IOCTL_MAX_SIZE	_IOW(RFKILL_IOC_MAGIC, RFKILL_IOC_MAX_SIZE, __u32)
 
 /* and that's all userspace gets */
 
--- linux-qcom-6.8.0.orig/include/uapi/linux/rtnetlink.h
+++ linux-qcom-6.8.0/include/uapi/linux/rtnetlink.h
@@ -174,7 +174,7 @@
 #define RTM_GETLINKPROP	RTM_GETLINKPROP
 
 	RTM_NEWVLAN = 112,
-#define RTM_NEWNVLAN	RTM_NEWVLAN
+#define RTM_NEWVLAN	RTM_NEWVLAN
 	RTM_DELVLAN,
 #define RTM_DELVLAN	RTM_DELVLAN
 	RTM_GETVLAN,
--- linux-qcom-6.8.0.orig/include/uapi/linux/smcinvoke.h
+++ linux-qcom-6.8.0/include/uapi/linux/smcinvoke.h
@@ -0,0 +1,109 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _UAPI_LINUX_SMCINVOKE_H_
+#define _UAPI_LINUX_SMCINVOKE_H_
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define SMCINVOKE_USERSPACE_OBJ_NULL	-1
+#define DEFAULT_CB_OBJ_THREAD_CNT	4
+#define SMCINVOKE_TZ_MIN_BUF_SIZE	4096
+
+struct smcinvoke_buf {
+	__u64 addr;
+	__u64 size;
+};
+
+struct smcinvoke_obj {
+	__s64 fd;
+	__s64 cb_server_fd;
+	__s64 reserved;
+};
+
+union smcinvoke_arg {
+	struct smcinvoke_buf b;
+	struct smcinvoke_obj o;
+};
+
+/*
+ * struct smcinvoke_cmd_req: This structure is transparently sent to TEE
+ * @op - Operation to be performed
+ * @counts - number of aruments passed
+ * @result - result of invoke operation
+ * @argsize - size of each of arguments
+ * @args - args is pointer to buffer having all arguments
+ * @reserved: IN/OUT: Usage is not defined but should be set to 0
+ */
+struct smcinvoke_cmd_req {
+	__u32 op;
+	__u32 counts;
+	__s32 result;
+	__u32 argsize;
+	__u64 args;
+	__s64 reserved;
+};
+
+/*
+ * struct smcinvoke_accept: structure to process CB req from TEE
+ * @has_resp: IN: Whether IOCTL is carrying response data
+ * @result: IN: Outcome of operation op
+ * @op: OUT: Operation to be performed on target object
+ * @counts: OUT: Number of arguments, embedded in buffer pointed by
+ *               buf_addr, to complete operation
+ * @reserved: IN/OUT: Usage is not defined but should be set to 0.
+ * @argsize: IN: Size of any argument, all of equal size, embedded
+ *               in buffer pointed by buf_addr
+ * @txn_id: OUT: An id that should be passed as it is for response
+ * @cbobj_id: OUT: Callback object which is target of operation op
+ * @buf_len: IN: Len of buffer pointed by buf_addr
+ * @buf_addr: IN: Buffer containing all arguments which are needed
+ *                to complete operation op
+ */
+struct smcinvoke_accept {
+	__u32 has_resp;
+	__s32 result;
+	__u32 op;
+	__u32 counts;
+	__s32 reserved;
+	__u32 argsize;
+	__u64 txn_id;
+	__s64 cbobj_id;
+	__u64 buf_len;
+	__u64 buf_addr;
+};
+
+/*
+ * @cb_buf_size: IN: Max buffer size for any callback obj implemented by client
+ * @reserved: IN/OUT: Usage is not defined but should be set to 0
+ */
+struct smcinvoke_server {
+	__u64 cb_buf_size;
+	__s64 reserved;
+};
+
+#define SMCINVOKE_IOC_MAGIC    0x98
+
+#define SMCINVOKE_IOCTL_INVOKE_REQ \
+	_IOWR(SMCINVOKE_IOC_MAGIC, 1, struct smcinvoke_cmd_req)
+
+#define SMCINVOKE_IOCTL_ACCEPT_REQ \
+	_IOWR(SMCINVOKE_IOC_MAGIC, 2, struct smcinvoke_accept)
+
+#define SMCINVOKE_IOCTL_SERVER_REQ \
+	_IOWR(SMCINVOKE_IOC_MAGIC, 3, struct smcinvoke_server)
+
+#define SMCINVOKE_IOCTL_ACK_LOCAL_OBJ \
+	_IOWR(SMCINVOKE_IOC_MAGIC, 4, __s64)
+
+/*
+ * smcinvoke logging buffer is for communicating with the smcinvoke driver
+ * additional info for debugging to be included in driver's log (if any)
+ */
+#define SMCINVOKE_LOG_BUF_SIZE 100
+#define SMCINVOKE_IOCTL_LOG \
+	_IOC(_IOC_READ|_IOC_WRITE, SMCINVOKE_IOC_MAGIC, 255, SMCINVOKE_LOG_BUF_SIZE)
+
+#endif /* _UAPI_LINUX_SMCINVOKE_H_ */
--- linux-qcom-6.8.0.orig/include/uapi/linux/stddef.h
+++ linux-qcom-6.8.0/include/uapi/linux/stddef.h
@@ -8,6 +8,13 @@
 #define __always_inline inline
 #endif
 
+/* Not all C++ standards support type declarations inside an anonymous union */
+#ifndef __cplusplus
+#define __struct_group_tag(TAG)		TAG
+#else
+#define __struct_group_tag(TAG)
+#endif
+
 /**
  * __struct_group() - Create a mirrored named and anonyomous struct
  *
@@ -20,13 +27,13 @@
  * and size: one anonymous and one named. The former's members can be used
  * normally without sub-struct naming, and the latter can be used to
  * reason about the start, end, and size of the group of struct members.
- * The named struct can also be explicitly tagged for layer reuse, as well
- * as both having struct attributes appended.
+ * The named struct can also be explicitly tagged for layer reuse (C only),
+ * as well as both having struct attributes appended.
  */
 #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
 	union { \
 		struct { MEMBERS } ATTRS; \
-		struct TAG { MEMBERS } ATTRS NAME; \
+		struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \
 	} ATTRS
 
 #ifdef __cplusplus
--- linux-qcom-6.8.0.orig/include/uapi/linux/sysctl.h
+++ linux-qcom-6.8.0/include/uapi/linux/sysctl.h
@@ -153,7 +153,7 @@
 	KERN_NMI_WATCHDOG=75, /* int: enable/disable nmi watchdog */
 	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
 	KERN_PANIC_ON_WARN=77, /* int: call panic() in WARN() functions */
-	KERN_PANIC_PRINT=78, /* ulong: bitmask to print system info on panic */
+	KERN_PANIC_PRINT=78, /* unsigned long: bitmask to print system info on panic */
 };
 
 
--- linux-qcom-6.8.0.orig/include/uapi/linux/tty_flags.h
+++ linux-qcom-6.8.0/include/uapi/linux/tty_flags.h
@@ -32,6 +32,7 @@
 #define ASYNCB_AUTOPROBE	15 /* [x] Port was autoprobed by PCI/PNP code */
 #define ASYNCB_MAGIC_MULTIPLIER	16 /* Use special CLK or divisor */
 #define ASYNCB_LAST_USER	16
+#define ASYNCB_INITIALIZED	31 /* Serial port was initialized */
 
 /*
  * Internal flags used only by kernel (read-only)
@@ -40,7 +41,6 @@
  *	    TTY_PORT_ flags in the iflags field (and not userspace-visible)
  */
 #ifndef __KERNEL__
-#define ASYNCB_INITIALIZED	31 /* Serial port was initialized */
 #define ASYNCB_SUSPENDED	30 /* Serial port is suspended */
 #define ASYNCB_NORMAL_ACTIVE	29 /* Normal device is active */
 #define ASYNCB_BOOT_AUTOCONF	28 /* Autoconfigure port on bootup */
--- linux-qcom-6.8.0.orig/include/uapi/linux/ublk_cmd.h
+++ linux-qcom-6.8.0/include/uapi/linux/ublk_cmd.h
@@ -173,7 +173,13 @@
 /* use ioctl encoding for uring command */
 #define UBLK_F_CMD_IOCTL_ENCODE	(1UL << 6)
 
-/* Copy between request and user buffer by pread()/pwrite() */
+/*
+ *  Copy between request and user buffer by pread()/pwrite()
+ *
+ *  Not available for UBLK_F_UNPRIVILEGED_DEV, otherwise userspace may
+ *  deceive us by not filling request buffer, then kernel uninitialized
+ *  data may be leaked.
+ */
 #define UBLK_F_USER_COPY	(1UL << 7)
 
 /*
--- linux-qcom-6.8.0.orig/include/uapi/linux/v4l2-controls.h
+++ linux-qcom-6.8.0/include/uapi/linux/v4l2-controls.h
@@ -393,6 +393,7 @@
 	V4L2_MPEG_VIDEO_BITRATE_MODE_VBR = 0,
 	V4L2_MPEG_VIDEO_BITRATE_MODE_CBR = 1,
 	V4L2_MPEG_VIDEO_BITRATE_MODE_CQ  = 2,
+	V4L2_MPEG_VIDEO_BITRATE_MODE_MBR = 3,
 };
 #define V4L2_CID_MPEG_VIDEO_BITRATE		(V4L2_CID_CODEC_BASE+207)
 #define V4L2_CID_MPEG_VIDEO_BITRATE_PEAK	(V4L2_CID_CODEC_BASE+208)
--- linux-qcom-6.8.0.orig/include/uapi/linux/virtio_bt.h
+++ linux-qcom-6.8.0/include/uapi/linux/virtio_bt.h
@@ -13,7 +13,6 @@
 
 enum virtio_bt_config_type {
 	VIRTIO_BT_CONFIG_TYPE_PRIMARY	= 0,
-	VIRTIO_BT_CONFIG_TYPE_AMP	= 1,
 };
 
 enum virtio_bt_config_vendor {
--- linux-qcom-6.8.0.orig/include/uapi/linux/virtio_pci.h
+++ linux-qcom-6.8.0/include/uapi/linux/virtio_pci.h
@@ -240,7 +240,7 @@
 #define VIRTIO_ADMIN_CMD_LEGACY_DEV_CFG_READ		0x5
 #define VIRTIO_ADMIN_CMD_LEGACY_NOTIFY_INFO		0x6
 
-struct __packed virtio_admin_cmd_hdr {
+struct virtio_admin_cmd_hdr {
 	__le16 opcode;
 	/*
 	 * 1 - SR-IOV
@@ -252,20 +252,20 @@
 	__le64 group_member_id;
 };
 
-struct __packed virtio_admin_cmd_status {
+struct virtio_admin_cmd_status {
 	__le16 status;
 	__le16 status_qualifier;
 	/* Unused, reserved for future extensions. */
 	__u8 reserved2[4];
 };
 
-struct __packed virtio_admin_cmd_legacy_wr_data {
+struct virtio_admin_cmd_legacy_wr_data {
 	__u8 offset; /* Starting offset of the register(s) to write. */
 	__u8 reserved[7];
 	__u8 registers[];
 };
 
-struct __packed virtio_admin_cmd_legacy_rd_data {
+struct virtio_admin_cmd_legacy_rd_data {
 	__u8 offset; /* Starting offset of the register(s) to read. */
 };
 
@@ -275,7 +275,7 @@
 
 #define VIRTIO_ADMIN_CMD_MAX_NOTIFY_INFO 4
 
-struct __packed virtio_admin_cmd_notify_info_data {
+struct virtio_admin_cmd_notify_info_data {
 	__u8 flags; /* 0 = end of list, 1 = owner device, 2 = member device */
 	__u8 bar; /* BAR of the member or the owner device */
 	__u8 padding[6];
--- linux-qcom-6.8.0.orig/include/uapi/linux/zorro_ids.h
+++ linux-qcom-6.8.0/include/uapi/linux/zorro_ids.h
@@ -449,6 +449,9 @@
 #define  ZORRO_PROD_VMC_ISDN_BLASTER_Z2				ZORRO_ID(VMC, 0x01, 0)
 #define  ZORRO_PROD_VMC_HYPERCOM_4				ZORRO_ID(VMC, 0x02, 0)
 
+#define ZORRO_MANUF_CSLAB					0x1400
+#define  ZORRO_PROD_CSLAB_WARP_1260				ZORRO_ID(CSLAB, 0x65, 0)
+
 #define ZORRO_MANUF_INFORMATION					0x157C
 #define  ZORRO_PROD_INFORMATION_ISDN_ENGINE_I			ZORRO_ID(INFORMATION, 0x64, 0)
 
--- linux-qcom-6.8.0.orig/include/uapi/scsi/scsi_bsg_mpi3mr.h
+++ linux-qcom-6.8.0/include/uapi/scsi/scsi_bsg_mpi3mr.h
@@ -296,6 +296,7 @@
  * multiple hdb entries.
  *
  * @num_hdb_types: Number of host diag buffer types supported
+ * @element_trigger_format: Element trigger format
  * @rsvd1: Reserved
  * @rsvd2: Reserved
  * @rsvd3: Reserved
@@ -303,7 +304,7 @@
  */
 struct mpi3mr_bsg_in_hdb_status {
 	__u8	num_hdb_types;
-	__u8	rsvd1;
+	__u8    element_trigger_format;
 	__u16	rsvd2;
 	__u32	rsvd3;
 	struct mpi3mr_hdb_entry entry[1];
@@ -382,7 +383,7 @@
 	__u8	mpi_reply_type;
 	__u8	rsvd1;
 	__u16	rsvd2;
-	__u8	reply_buf[1];
+	__u8	reply_buf[];
 };
 
 /**
--- linux-qcom-6.8.0.orig/include/uapi/sound/asoc.h
+++ linux-qcom-6.8.0/include/uapi/sound/asoc.h
@@ -88,7 +88,7 @@
 
 /* ABI version */
 #define SND_SOC_TPLG_ABI_VERSION	0x5	/* current version */
-#define SND_SOC_TPLG_ABI_VERSION_MIN	0x4	/* oldest version supported */
+#define SND_SOC_TPLG_ABI_VERSION_MIN	0x5	/* oldest version supported */
 
 /* Max size of TLV data */
 #define SND_SOC_TPLG_TLV_SIZE		32
--- linux-qcom-6.8.0.orig/include/uapi/sound/qcom/msm_audio.h
+++ linux-qcom-6.8.0/include/uapi/sound/qcom/msm_audio.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * include/linux/msm_audio.h
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#ifndef _UAPI_LINUX_MSM_AUDIO_H
+#define _UAPI_LINUX_MSM_AUDIO_H
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define AUDIO_IOCTL_MAGIC 'a'
+
+#define IOCTL_MAP_PHYS_ADDR _IOW(AUDIO_IOCTL_MAGIC, 97, int)
+#define IOCTL_UNMAP_PHYS_ADDR _IOW(AUDIO_IOCTL_MAGIC, 98, int)
+#define IOCTL_MAP_HYP_ASSIGN _IOW(AUDIO_IOCTL_MAGIC, 99, int)
+#define IOCTL_UNMAP_HYP_ASSIGN _IOW(AUDIO_IOCTL_MAGIC, 100, int)
+
+#endif
--- linux-qcom-6.8.0.orig/include/ufs/ufshcd.h
+++ linux-qcom-6.8.0/include/ufs/ufshcd.h
@@ -297,6 +297,8 @@
  * @name: variant name
  * @init: called when the driver is initialized
  * @exit: called to cleanup everything done in init
+ * @set_dma_mask: For setting another DMA mask than indicated by the 64AS
+ *	capability bit.
  * @get_ufs_hci_version: called to get UFS HCI version
  * @clk_scale_notify: notifies that clks are scaled up/down
  * @setup_clocks: called before touching any of the controller registers
@@ -306,7 +308,9 @@
  *                       to allow variant specific Uni-Pro initialization.
  * @pwr_change_notify: called before and after a power mode change
  *			is carried out to allow vendor spesific capabilities
- *			to be set.
+ *			to be set. PRE_CHANGE can modify final_params based
+ *			on desired_pwr_mode, but POST_CHANGE must not alter
+ *			the final_params parameter
  * @setup_xfer_req: called before any transfer request is issued
  *                  to set some things
  * @setup_task_mgmt: called before any task management request is issued
@@ -321,8 +325,11 @@
  * @device_reset: called to issue a reset pulse on the UFS device
  * @config_scaling_param: called to configure clock scaling parameters
  * @program_key: program or evict an inline encryption key
+ * @derive_sw_secret: derive sw secret from a wrapped key
+ * @generate_key: generate a storage key and return longterm wrapped key
+ * @prepare_key: unwrap longterm key and return ephemeral wrapped key
+ * @import_key: import sw storage key and return longterm wrapped key
  * @event_notify: called to notify important events
- * @reinit_notify: called to notify reinit of UFSHCD during max gear switch
  * @mcq_config_resource: called to configure MCQ platform resources
  * @get_hba_mac: called to get vendor specific mac value, mandatory for mcq mode
  * @op_runtime_config: called to config Operation and runtime regs Pointers
@@ -334,6 +341,7 @@
 	int	(*init)(struct ufs_hba *);
 	void    (*exit)(struct ufs_hba *);
 	u32	(*get_ufs_hci_version)(struct ufs_hba *);
+	int	(*set_dma_mask)(struct ufs_hba *);
 	int	(*clk_scale_notify)(struct ufs_hba *, bool,
 				    enum ufs_notify_change_status);
 	int	(*setup_clocks)(struct ufs_hba *, bool,
@@ -343,9 +351,9 @@
 	int	(*link_startup_notify)(struct ufs_hba *,
 				       enum ufs_notify_change_status);
 	int	(*pwr_change_notify)(struct ufs_hba *,
-					enum ufs_notify_change_status status,
-					struct ufs_pa_layer_attr *,
-					struct ufs_pa_layer_attr *);
+				enum ufs_notify_change_status status,
+				struct ufs_pa_layer_attr *desired_pwr_mode,
+				struct ufs_pa_layer_attr *final_params);
 	void	(*setup_xfer_req)(struct ufs_hba *hba, int tag,
 				  bool is_scsi_cmd);
 	void	(*setup_task_mgmt)(struct ufs_hba *, int, u8);
@@ -363,10 +371,21 @@
 				struct devfreq_dev_profile *profile,
 				struct devfreq_simple_ondemand_data *data);
 	int	(*program_key)(struct ufs_hba *hba,
+			       const struct blk_crypto_key *bkey,
 			       const union ufs_crypto_cfg_entry *cfg, int slot);
+	int	(*derive_sw_secret)(struct ufs_hba *hba, const u8 wrapped_key[],
+				    unsigned int wrapped_key_size,
+				    u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE]);
+	int	(*generate_key)(struct ufs_hba *hba,
+				u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+	int	(*prepare_key)(struct ufs_hba *hba,
+			       const u8 *lt_key, size_t lt_key_size,
+			       u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
+	int	(*import_key)(struct ufs_hba *hba,
+			      const u8 *imp_key, size_t imp_key_size,
+			      u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
 	void	(*event_notify)(struct ufs_hba *hba,
 				enum ufs_event_type evt, void *data);
-	void	(*reinit_notify)(struct ufs_hba *);
 	int	(*mcq_config_resource)(struct ufs_hba *hba);
 	int	(*get_hba_mac)(struct ufs_hba *hba);
 	int	(*op_runtime_config)(struct ufs_hba *hba);
@@ -615,12 +634,6 @@
 
 	/*
 	 * This quirk needs to be enabled if the host controller has
-	 * 64-bit addressing supported capability but it doesn't work.
-	 */
-	UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS		= 1 << 17,
-
-	/*
-	 * This quirk needs to be enabled if the host controller has
 	 * auto-hibernate capability but it's FASTAUTO only.
 	 */
 	UFSHCD_QUIRK_HIBERN_FASTAUTO			= 1 << 18,
@@ -643,6 +656,12 @@
 	 * thus need this quirk to skip related flow.
 	 */
 	UFSHCD_QUIRK_MCQ_BROKEN_RTC			= 1 << 21,
+
+	/*
+	 * This quirk indicates that UFS will be using HW wrapped keys
+	 * when using inline encryption.
+	 */
+	UFSHCD_QUIRK_USES_WRAPPED_CRYPTO_KEYS		= 1 << 22,
 };
 
 enum ufshcd_caps {
@@ -914,6 +933,8 @@
  * @dev_cmd_queue: Queue for issuing device management commands
  * @mcq_opr: MCQ operation and runtime registers
  * @ufs_rtc_update_work: A work for UFS RTC periodic update
+ * @pm_qos_req: PM QoS request handle
+ * @pm_qos_enabled: flag to check if pm qos is enabled
  */
 struct ufs_hba {
 	void __iomem *mmio_base;
@@ -1072,6 +1093,7 @@
 	bool ext_iid_sup;
 	bool scsi_host_added;
 	bool mcq_sup;
+	bool lsdb_sup;
 	bool mcq_enabled;
 	struct ufshcd_res_info res[RES_MAX];
 	void __iomem *mcq_base;
@@ -1080,6 +1102,8 @@
 	struct ufshcd_mcq_opr_info_t mcq_opr[OPR_MAX];
 
 	struct delayed_work ufs_rtc_update_work;
+	struct pm_qos_request pm_qos_req;
+	bool pm_qos_enabled;
 };
 
 /**
@@ -1127,6 +1151,12 @@
 	return hba->mcq_enabled;
 }
 
+static inline unsigned int ufshcd_mcq_opr_offset(struct ufs_hba *hba,
+		enum ufshcd_mcq_opr opr, int idx)
+{
+	return hba->mcq_opr[opr].offset + hba->mcq_opr[opr].stride * idx;
+}
+
 #ifdef CONFIG_SCSI_UFS_VARIABLE_SG_ENTRY_SIZE
 static inline size_t ufshcd_sg_entry_size(const struct ufs_hba *hba)
 {
@@ -1400,6 +1430,8 @@
 int __ufshcd_suspend_prepare(struct device *dev, bool rpm_ok_for_spm);
 void ufshcd_resume_complete(struct device *dev);
 bool ufshcd_is_hba_active(struct ufs_hba *hba);
+void ufshcd_pm_qos_init(struct ufs_hba *hba);
+void ufshcd_pm_qos_exit(struct ufs_hba *hba);
 
 /* Wrapper functions for safely calling variant operations */
 static inline int ufshcd_vops_init(struct ufs_hba *hba)
--- linux-qcom-6.8.0.orig/include/ufs/ufshci.h
+++ linux-qcom-6.8.0/include/ufs/ufshci.h
@@ -75,6 +75,7 @@
 	MASK_OUT_OF_ORDER_DATA_DELIVERY_SUPPORT	= 0x02000000,
 	MASK_UIC_DME_TEST_MODE_SUPPORT		= 0x04000000,
 	MASK_CRYPTO_SUPPORT			= 0x10000000,
+	MASK_LSDB_SUPPORT			= 0x20000000,
 	MASK_MCQ_SUPPORT			= 0x40000000,
 };
 
--- linux-qcom-6.8.0.orig/init/Kconfig
+++ linux-qcom-6.8.0/init/Kconfig
@@ -107,6 +107,15 @@
 config CC_HAS_NO_PROFILE_FN_ATTR
 	def_bool $(success,echo '__attribute__((no_profile_instrument_function)) int x();' | $(CC) -x c - -c -o /dev/null -Werror)
 
+config CC_HAS_COUNTED_BY
+	# TODO: when gcc 15 is released remove the build test and add
+	# a gcc version check
+	def_bool $(success,echo 'struct flex { int count; int array[] __attribute__((__counted_by__(count))); };' | $(CC) $(CLANG_FLAGS) -x c - -c -o /dev/null -Werror)
+	# clang needs to be at least 19.1.3 to avoid __bdos miscalculations
+	# https://github.com/llvm/llvm-project/pull/110497
+	# https://github.com/llvm/llvm-project/pull/112636
+	depends on !(CC_IS_CLANG && CLANG_VERSION < 190103)
+
 config PAHOLE_VERSION
 	int
 	default $(shell,$(srctree)/scripts/pahole-version.sh $(PAHOLE))
@@ -376,6 +385,15 @@
 	  but you may wish to use a different default here to make a minimal
 	  system more usable with less configuration.
 
+config VERSION_SIGNATURE
+	string "Arbitrary version signature"
+	help
+	  This string will be created in a file, /proc/version_signature. It
+	  is useful in determining arbitrary data about your kernel. For instance,
+	  if you have several kernels of the same version, but need to keep track
+	  of a revision of the same kernel, but not affect it's ability to load
+	  compatible modules, this is the easiest way to do that.
+
 config SYSVIPC
 	bool "System V IPC"
 	help
@@ -743,8 +761,8 @@
 	int "CPU kernel log buffer size contribution (13 => 8 KB, 17 => 128KB)"
 	depends on SMP
 	range 0 21
-	default 12 if !BASE_SMALL
-	default 0 if BASE_SMALL
+	default 0 if BASE_SMALL != 0
+	default 12
 	depends on PRINTK
 	help
 	  This option allows to increase the default ring buffer size
@@ -1791,24 +1809,6 @@
 	depends on KALLSYMS
 	default X86_64 && SMP
 
-config KALLSYMS_BASE_RELATIVE
-	bool
-	depends on KALLSYMS
-	default y
-	help
-	  Instead of emitting them as absolute values in the native word size,
-	  emit the symbol references in the kallsyms table as 32-bit entries,
-	  each containing a relative value in the range [base, base + U32_MAX]
-	  or, when KALLSYMS_ABSOLUTE_PERCPU is in effect, each containing either
-	  an absolute value in the range [0, S32_MAX] or a relative value in the
-	  range [base, base + S32_MAX], where base is the lowest relative symbol
-	  address encountered in the image.
-
-	  On 64-bit builds, this reduces the size of the address table by 50%,
-	  but more importantly, it results in entries whose values are build
-	  time constants, and no relocation pass is required at runtime to fix
-	  up the entries based on the runtime load address of the kernel.
-
 # end of the "standard kernel features (expert users)" menu
 
 config ARCH_HAS_MEMBARRIER_CALLBACKS
@@ -1904,11 +1904,11 @@
 	bool "Rust support"
 	depends on HAVE_RUST
 	depends on RUST_IS_AVAILABLE
-	depends on !MODVERSIONS
+	depends on !CFI_CLANG
 	depends on !GCC_PLUGINS
 	depends on !RANDSTRUCT
+	depends on !SHADOW_CALL_STACK
 	depends on !DEBUG_INFO_BTF || PAHOLE_HAS_LANG_EXCLUDE
-	select CONSTRUCTORS
 	help
 	  Enables Rust support in the kernel.
 
@@ -1925,12 +1925,15 @@
 config RUSTC_VERSION_TEXT
 	string
 	depends on RUST
-	default $(shell,command -v $(RUSTC) >/dev/null 2>&1 && $(RUSTC) --version || echo n)
+	default "$(shell,$(RUSTC) --version 2>/dev/null)"
 
 config BINDGEN_VERSION_TEXT
 	string
 	depends on RUST
-	default $(shell,command -v $(BINDGEN) >/dev/null 2>&1 && $(BINDGEN) --version || echo n)
+	# The dummy parameter `workaround-for-0.69.0` is required to support 0.69.0
+	# (https://github.com/rust-lang/rust-bindgen/pull/2678). It can be removed when
+	# the minimum version is upgraded past that (0.69.1 already fixed the issue).
+	default "$(shell,$(BINDGEN) --version workaround-for-0.69.0 2>/dev/null)"
 
 #
 # Place an empty function call at each tracepoint site. Can be
--- linux-qcom-6.8.0.orig/init/do_mounts.c
+++ linux-qcom-6.8.0/init/do_mounts.c
@@ -461,6 +461,8 @@
  */
 void __init prepare_namespace(void)
 {
+	int err;
+
 	if (root_delay) {
 		printk(KERN_INFO "Waiting %d sec before mounting root device...\n",
 		       root_delay);
@@ -491,6 +493,13 @@
 	devtmpfs_mount();
 	init_mount(".", "/", NULL, MS_MOVE, NULL);
 	init_chroot(".");
+#ifdef CONFIG_BLOCK
+	/* recreate the /dev/root */
+	err = create_dev("/dev/root", ROOT_DEV);
+
+	if (err < 0)
+		pr_emerg("Failed to create /dev/root: %d\n", err);
+#endif
 }
 
 static bool is_tmpfs;
--- linux-qcom-6.8.0.orig/init/init_task.c
+++ linux-qcom-6.8.0/init/init_task.c
@@ -147,6 +147,7 @@
 	.rcu_tasks_holdout = false,
 	.rcu_tasks_holdout_list = LIST_HEAD_INIT(init_task.rcu_tasks_holdout_list),
 	.rcu_tasks_idle_cpu = -1,
+	.rcu_tasks_exit_list = LIST_HEAD_INIT(init_task.rcu_tasks_exit_list),
 #endif
 #ifdef CONFIG_TASKS_TRACE_RCU
 	.trc_reader_nesting = 0,
--- linux-qcom-6.8.0.orig/init/initramfs.c
+++ linux-qcom-6.8.0/init/initramfs.c
@@ -358,6 +358,15 @@
 {
 	state = SkipIt;
 	next_state = Reset;
+
+	/* name_len > 0 && name_len <= PATH_MAX checked in do_header */
+	if (collected[name_len - 1] != '\0') {
+		pr_err("initramfs name without nulterm: %.*s\n",
+		       (int)name_len, collected);
+		error("malformed archive");
+		return 1;
+	}
+
 	if (strcmp(collected, "TRAILER!!!") == 0) {
 		free_hash();
 		return 0;
@@ -422,6 +431,12 @@
 
 static int __init do_symlink(void)
 {
+	if (collected[name_len - 1] != '\0') {
+		pr_err("initramfs symlink without nulterm: %.*s\n",
+		       (int)name_len, collected);
+		error("malformed archive");
+		return 1;
+	}
 	collected[N_ALIGN(name_len) + body_len] = '\0';
 	clean_path(collected, 0);
 	init_symlink(collected + N_ALIGN(name_len), collected);
@@ -683,7 +698,7 @@
 
 	printk(KERN_INFO "rootfs image is not initramfs (%s); looks like an initrd\n",
 			err);
-	file = filp_open("/initrd.image", O_WRONLY | O_CREAT, 0700);
+	file = filp_open("/initrd.image", O_WRONLY|O_CREAT|O_LARGEFILE, 0700);
 	if (IS_ERR(file))
 		return;
 
--- linux-qcom-6.8.0.orig/init/main.c
+++ linux-qcom-6.8.0/init/main.c
@@ -88,6 +88,7 @@
 #include <linux/sched/task_stack.h>
 #include <linux/context_tracking.h>
 #include <linux/random.h>
+#include <linux/moduleloader.h>
 #include <linux/list.h>
 #include <linux/integrity.h>
 #include <linux/proc_ns.h>
@@ -484,6 +485,11 @@
 
 early_param("bootconfig", warn_bootconfig);
 
+bool __init cmdline_has_extra_options(void)
+{
+	return extra_command_line || extra_init_args;
+}
+
 /* Change NUL term back to "=", to make "param" the whole string. */
 static void __init repair_env_string(char *param, char *val)
 {
@@ -603,7 +609,6 @@
 __setup("rdinit=", rdinit_setup);
 
 #ifndef CONFIG_SMP
-static const unsigned int setup_max_cpus = NR_CPUS;
 static inline void setup_nr_cpu_ids(void) { }
 static inline void smp_prepare_cpus(unsigned int maxcpus) { }
 #endif
@@ -629,6 +634,8 @@
 	if (!saved_command_line)
 		panic("%s: Failed to allocate %zu bytes\n", __func__, len + ilen);
 
+	len = xlen + strlen(command_line) + 1;
+
 	static_command_line = memblock_alloc(len, SMP_CACHE_BYTES);
 	if (!static_command_line)
 		panic("%s: Failed to allocate %zu bytes\n", __func__, len);
@@ -1402,11 +1409,11 @@
 	if (rodata_enabled) {
 		/*
 		 * load_module() results in W+X mappings, which are cleaned
-		 * up with call_rcu().  Let's make sure that queued work is
+		 * up with init_free_wq. Let's make sure that queued work is
 		 * flushed so that we don't hit false positives looking for
 		 * insecure pages which are W+X.
 		 */
-		rcu_barrier();
+		flush_module_init_free_work();
 		mark_rodata_ro();
 		rodata_test();
 	} else
--- linux-qcom-6.8.0.orig/init/version-timestamp.c
+++ linux-qcom-6.8.0/init/version-timestamp.c
@@ -27,4 +27,8 @@
 /* FIXED STRINGS! Don't touch! */
 const char linux_banner[] =
 	"Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@"
-	LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n";
+	LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION
+#ifdef CONFIG_VERSION_SIGNATURE
+	" (" CONFIG_VERSION_SIGNATURE ")"
+#endif
+	"\n";
--- linux-qcom-6.8.0.orig/io_uring/futex.c
+++ linux-qcom-6.8.0/io_uring/futex.c
@@ -159,6 +159,7 @@
 	hlist_for_each_entry_safe(req, tmp, &ctx->futex_list, hash_node) {
 		if (!io_match_task_safe(req, task, cancel_all))
 			continue;
+		hlist_del_init(&req->hash_node);
 		__io_futex_cancel(ctx, req);
 		found = true;
 	}
--- linux-qcom-6.8.0.orig/io_uring/io-wq.c
+++ linux-qcom-6.8.0/io_uring/io-wq.c
@@ -13,6 +13,7 @@
 #include <linux/slab.h>
 #include <linux/rculist_nulls.h>
 #include <linux/cpu.h>
+#include <linux/cpuset.h>
 #include <linux/task_work.h>
 #include <linux/audit.h>
 #include <linux/mmu_context.h>
@@ -23,12 +24,13 @@
 #include "io_uring.h"
 
 #define WORKER_IDLE_TIMEOUT	(5 * HZ)
+#define WORKER_INIT_LIMIT	3
 
 enum {
-	IO_WORKER_F_UP		= 1,	/* up and active */
-	IO_WORKER_F_RUNNING	= 2,	/* account as running */
-	IO_WORKER_F_FREE	= 4,	/* worker on free list */
-	IO_WORKER_F_BOUND	= 8,	/* is doing bounded work */
+	IO_WORKER_F_UP		= 0,	/* up and active */
+	IO_WORKER_F_RUNNING	= 1,	/* account as running */
+	IO_WORKER_F_FREE	= 2,	/* worker on free list */
+	IO_WORKER_F_BOUND	= 3,	/* is doing bounded work */
 };
 
 enum {
@@ -44,7 +46,8 @@
  */
 struct io_worker {
 	refcount_t ref;
-	unsigned flags;
+	int create_index;
+	unsigned long flags;
 	struct hlist_nulls_node nulls_node;
 	struct list_head all_list;
 	struct task_struct *task;
@@ -58,7 +61,7 @@
 
 	unsigned long create_state;
 	struct callback_head create_work;
-	int create_index;
+	int init_retries;
 
 	union {
 		struct rcu_head rcu;
@@ -165,7 +168,7 @@
 
 static inline struct io_wq_acct *io_wq_get_acct(struct io_worker *worker)
 {
-	return io_get_acct(worker->wq, worker->flags & IO_WORKER_F_BOUND);
+	return io_get_acct(worker->wq, test_bit(IO_WORKER_F_BOUND, &worker->flags));
 }
 
 static void io_worker_ref_put(struct io_wq *wq)
@@ -225,7 +228,7 @@
 	wait_for_completion(&worker->ref_done);
 
 	raw_spin_lock(&wq->lock);
-	if (worker->flags & IO_WORKER_F_FREE)
+	if (test_bit(IO_WORKER_F_FREE, &worker->flags))
 		hlist_nulls_del_rcu(&worker->nulls_node);
 	list_del_rcu(&worker->all_list);
 	raw_spin_unlock(&wq->lock);
@@ -410,7 +413,7 @@
 	struct io_wq_acct *acct = io_wq_get_acct(worker);
 	struct io_wq *wq = worker->wq;
 
-	if (!(worker->flags & IO_WORKER_F_UP))
+	if (!test_bit(IO_WORKER_F_UP, &worker->flags))
 		return;
 
 	if (!atomic_dec_and_test(&acct->nr_running))
@@ -430,8 +433,8 @@
  */
 static void __io_worker_busy(struct io_wq *wq, struct io_worker *worker)
 {
-	if (worker->flags & IO_WORKER_F_FREE) {
-		worker->flags &= ~IO_WORKER_F_FREE;
+	if (test_bit(IO_WORKER_F_FREE, &worker->flags)) {
+		clear_bit(IO_WORKER_F_FREE, &worker->flags);
 		raw_spin_lock(&wq->lock);
 		hlist_nulls_del_init_rcu(&worker->nulls_node);
 		raw_spin_unlock(&wq->lock);
@@ -444,8 +447,8 @@
 static void __io_worker_idle(struct io_wq *wq, struct io_worker *worker)
 	__must_hold(wq->lock)
 {
-	if (!(worker->flags & IO_WORKER_F_FREE)) {
-		worker->flags |= IO_WORKER_F_FREE;
+	if (!test_bit(IO_WORKER_F_FREE, &worker->flags)) {
+		set_bit(IO_WORKER_F_FREE, &worker->flags);
 		hlist_nulls_add_head_rcu(&worker->nulls_node, &wq->free_list);
 	}
 }
@@ -564,10 +567,7 @@
 		 * clear the stalled flag.
 		 */
 		work = io_get_next_work(acct, worker);
-		raw_spin_unlock(&acct->lock);
 		if (work) {
-			__io_worker_busy(wq, worker);
-
 			/*
 			 * Make sure cancelation can find this, even before
 			 * it becomes the active work. That avoids a window
@@ -578,9 +578,15 @@
 			raw_spin_lock(&worker->lock);
 			worker->next_work = work;
 			raw_spin_unlock(&worker->lock);
-		} else {
-			break;
 		}
+
+		raw_spin_unlock(&acct->lock);
+
+		if (!work)
+			break;
+
+		__io_worker_busy(wq, worker);
+
 		io_assign_current_work(worker, work);
 		__set_current_state(TASK_RUNNING);
 
@@ -631,7 +637,8 @@
 	bool exit_mask = false, last_timeout = false;
 	char buf[TASK_COMM_LEN];
 
-	worker->flags |= (IO_WORKER_F_UP | IO_WORKER_F_RUNNING);
+	set_mask_bits(&worker->flags, 0,
+		      BIT(IO_WORKER_F_UP) | BIT(IO_WORKER_F_RUNNING));
 
 	snprintf(buf, sizeof(buf), "iou-wrk-%d", wq->task->pid);
 	set_task_comm(current, buf);
@@ -695,11 +702,11 @@
 
 	if (!worker)
 		return;
-	if (!(worker->flags & IO_WORKER_F_UP))
+	if (!test_bit(IO_WORKER_F_UP, &worker->flags))
 		return;
-	if (worker->flags & IO_WORKER_F_RUNNING)
+	if (test_bit(IO_WORKER_F_RUNNING, &worker->flags))
 		return;
-	worker->flags |= IO_WORKER_F_RUNNING;
+	set_bit(IO_WORKER_F_RUNNING, &worker->flags);
 	io_wq_inc_running(worker);
 }
 
@@ -713,12 +720,12 @@
 
 	if (!worker)
 		return;
-	if (!(worker->flags & IO_WORKER_F_UP))
+	if (!test_bit(IO_WORKER_F_UP, &worker->flags))
 		return;
-	if (!(worker->flags & IO_WORKER_F_RUNNING))
+	if (!test_bit(IO_WORKER_F_RUNNING, &worker->flags))
 		return;
 
-	worker->flags &= ~IO_WORKER_F_RUNNING;
+	clear_bit(IO_WORKER_F_RUNNING, &worker->flags);
 	io_wq_dec_running(worker);
 }
 
@@ -732,7 +739,7 @@
 	raw_spin_lock(&wq->lock);
 	hlist_nulls_add_head_rcu(&worker->nulls_node, &wq->free_list);
 	list_add_tail_rcu(&worker->all_list, &wq->all_list);
-	worker->flags |= IO_WORKER_F_FREE;
+	set_bit(IO_WORKER_F_FREE, &worker->flags);
 	raw_spin_unlock(&wq->lock);
 	wake_up_new_task(tsk);
 }
@@ -742,7 +749,7 @@
 	return true;
 }
 
-static inline bool io_should_retry_thread(long err)
+static inline bool io_should_retry_thread(struct io_worker *worker, long err)
 {
 	/*
 	 * Prevent perpetual task_work retry, if the task (or its group) is
@@ -750,6 +757,8 @@
 	 */
 	if (fatal_signal_pending(current))
 		return false;
+	if (worker->init_retries++ >= WORKER_INIT_LIMIT)
+		return false;
 
 	switch (err) {
 	case -EAGAIN:
@@ -776,7 +785,7 @@
 		io_init_new_worker(wq, worker, tsk);
 		io_worker_release(worker);
 		return;
-	} else if (!io_should_retry_thread(PTR_ERR(tsk))) {
+	} else if (!io_should_retry_thread(worker, PTR_ERR(tsk))) {
 		struct io_wq_acct *acct = io_wq_get_acct(worker);
 
 		atomic_dec(&acct->nr_running);
@@ -838,12 +847,12 @@
 	init_completion(&worker->ref_done);
 
 	if (index == IO_WQ_ACCT_BOUND)
-		worker->flags |= IO_WORKER_F_BOUND;
+		set_bit(IO_WORKER_F_BOUND, &worker->flags);
 
 	tsk = create_io_thread(io_wq_worker, worker, NUMA_NO_NODE);
 	if (!IS_ERR(tsk)) {
 		io_init_new_worker(wq, worker, tsk);
-	} else if (!io_should_retry_thread(PTR_ERR(tsk))) {
+	} else if (!io_should_retry_thread(worker, PTR_ERR(tsk))) {
 		kfree(worker);
 		goto fail;
 	} else {
@@ -924,8 +933,12 @@
 void io_wq_enqueue(struct io_wq *wq, struct io_wq_work *work)
 {
 	struct io_wq_acct *acct = io_work_get_acct(wq, work);
-	struct io_cb_cancel_data match;
-	unsigned work_flags = work->flags;
+	unsigned long work_flags = work->flags;
+	struct io_cb_cancel_data match = {
+		.fn		= io_wq_work_match_item,
+		.data		= work,
+		.cancel_all	= false,
+	};
 	bool do_create;
 
 	/*
@@ -963,10 +976,6 @@
 		raw_spin_unlock(&wq->lock);
 
 		/* fatal condition, failed to create the first worker */
-		match.fn		= io_wq_work_match_item,
-		match.data		= work,
-		match.cancel_all	= false,
-
 		io_acct_cancel_pending_work(wq, acct, &match);
 	}
 }
@@ -1161,7 +1170,7 @@
 
 	if (!alloc_cpumask_var(&wq->cpu_mask, GFP_KERNEL))
 		goto err;
-	cpumask_copy(wq->cpu_mask, cpu_possible_mask);
+	cpuset_cpus_allowed(data->task, wq->cpu_mask);
 	wq->acct[IO_WQ_ACCT_BOUND].max_workers = bounded;
 	wq->acct[IO_WQ_ACCT_UNBOUND].max_workers =
 				task_rlimit(current, RLIMIT_NPROC);
@@ -1316,17 +1325,29 @@
 
 int io_wq_cpu_affinity(struct io_uring_task *tctx, cpumask_var_t mask)
 {
+	cpumask_var_t allowed_mask;
+	int ret = 0;
+
 	if (!tctx || !tctx->io_wq)
 		return -EINVAL;
 
+	if (!alloc_cpumask_var(&allowed_mask, GFP_KERNEL))
+		return -ENOMEM;
+
 	rcu_read_lock();
-	if (mask)
-		cpumask_copy(tctx->io_wq->cpu_mask, mask);
-	else
-		cpumask_copy(tctx->io_wq->cpu_mask, cpu_possible_mask);
+	cpuset_cpus_allowed(tctx->io_wq->task, allowed_mask);
+	if (mask) {
+		if (cpumask_subset(mask, allowed_mask))
+			cpumask_copy(tctx->io_wq->cpu_mask, mask);
+		else
+			ret = -EINVAL;
+	} else {
+		cpumask_copy(tctx->io_wq->cpu_mask, allowed_mask);
+	}
 	rcu_read_unlock();
 
-	return 0;
+	free_cpumask_var(allowed_mask);
+	return ret;
 }
 
 /*
--- linux-qcom-6.8.0.orig/io_uring/io_uring.c
+++ linux-qcom-6.8.0/io_uring/io_uring.c
@@ -152,6 +152,7 @@
 static void io_queue_sqe(struct io_kiocb *req);
 
 struct kmem_cache *req_cachep;
+static struct workqueue_struct *iou_wq __ro_after_init;
 
 static int __read_mostly sysctl_io_uring_disabled;
 static int __read_mostly sysctl_io_uring_group = -1;
@@ -353,7 +354,6 @@
 err:
 	kfree(ctx->cancel_table.hbs);
 	kfree(ctx->cancel_table_locked.hbs);
-	kfree(ctx->io_bl);
 	xa_destroy(&ctx->io_bl_xa);
 	kfree(ctx);
 	return NULL;
@@ -502,13 +502,17 @@
 	}
 }
 
-void io_queue_iowq(struct io_kiocb *req, struct io_tw_state *ts_dont_use)
+static void io_queue_iowq(struct io_kiocb *req)
 {
 	struct io_kiocb *link = io_prep_linked_timeout(req);
 	struct io_uring_task *tctx = req->task->io_uring;
 
 	BUG_ON(!tctx);
-	BUG_ON(!tctx->io_wq);
+
+	if ((current->flags & PF_KTHREAD) || !tctx->io_wq) {
+		io_req_task_queue_fail(req, -ECANCELED);
+		return;
+	}
 
 	/* init ->work of the whole link before punting */
 	io_prep_async_link(req);
@@ -543,6 +547,14 @@
 	}
 }
 
+static void io_eventfd_free(struct rcu_head *rcu)
+{
+	struct io_ev_fd *ev_fd = container_of(rcu, struct io_ev_fd, rcu);
+
+	eventfd_ctx_put(ev_fd->cq_ev_fd);
+	kfree(ev_fd);
+}
+
 void io_eventfd_ops(struct rcu_head *rcu)
 {
 	struct io_ev_fd *ev_fd = container_of(rcu, struct io_ev_fd, rcu);
@@ -555,10 +567,8 @@
 	 * ordering in a race but if references are 0 we know we have to free
 	 * it regardless.
 	 */
-	if (atomic_dec_and_test(&ev_fd->refs)) {
-		eventfd_ctx_put(ev_fd->cq_ev_fd);
-		kfree(ev_fd);
-	}
+	if (atomic_dec_and_test(&ev_fd->refs))
+		call_rcu(&ev_fd->rcu, io_eventfd_free);
 }
 
 static void io_eventfd_signal(struct io_ring_ctx *ctx)
@@ -676,6 +686,8 @@
 	struct io_overflow_cqe *ocqe;
 	LIST_HEAD(list);
 
+	lockdep_assert_held(&ctx->uring_lock);
+
 	spin_lock(&ctx->completion_lock);
 	list_splice_init(&ctx->cq_overflow_list, &list);
 	clear_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq);
@@ -692,6 +704,8 @@
 {
 	size_t cqe_size = sizeof(struct io_uring_cqe);
 
+	lockdep_assert_held(&ctx->uring_lock);
+
 	if (__io_cqring_events(ctx) == ctx->cq_entries)
 		return;
 
@@ -710,6 +724,21 @@
 		memcpy(cqe, &ocqe->cqe, cqe_size);
 		list_del(&ocqe->list);
 		kfree(ocqe);
+
+		/*
+		 * For silly syzbot cases that deliberately overflow by huge
+		 * amounts, check if we need to resched and drop and
+		 * reacquire the locks if so. Nothing real would ever hit this.
+		 * Ideally we'd have a non-posting unlock for this, but hard
+		 * to care for a non-real case.
+		 */
+		if (need_resched()) {
+			io_cq_unlock_post(ctx);
+			mutex_unlock(&ctx->uring_lock);
+			cond_resched();
+			mutex_lock(&ctx->uring_lock);
+			io_cq_lock(ctx);
+		}
 	}
 
 	if (list_empty(&ctx->cq_overflow_list)) {
@@ -721,12 +750,9 @@
 
 static void io_cqring_do_overflow_flush(struct io_ring_ctx *ctx)
 {
-	/* iopoll syncs against uring_lock, not completion_lock */
-	if (ctx->flags & IORING_SETUP_IOPOLL)
-		mutex_lock(&ctx->uring_lock);
+	mutex_lock(&ctx->uring_lock);
 	__io_cqring_overflow_flush(ctx);
-	if (ctx->flags & IORING_SETUP_IOPOLL)
-		mutex_unlock(&ctx->uring_lock);
+	mutex_unlock(&ctx->uring_lock);
 }
 
 static void io_cqring_overflow_flush(struct io_ring_ctx *ctx)
@@ -949,6 +975,8 @@
 	u64 user_data = req->cqe.user_data;
 	struct io_uring_cqe *cqe;
 
+	lockdep_assert(!io_wq_current_is_worker());
+
 	if (!defer)
 		return __io_post_aux_cqe(ctx, user_data, res, cflags, false);
 
@@ -1176,12 +1204,11 @@
 
 static unsigned int handle_tw_list(struct llist_node *node,
 				   struct io_ring_ctx **ctx,
-				   struct io_tw_state *ts,
-				   struct llist_node *last)
+				   struct io_tw_state *ts)
 {
 	unsigned int count = 0;
 
-	while (node && node != last) {
+	do {
 		struct llist_node *next = node->next;
 		struct io_kiocb *req = container_of(node, struct io_kiocb,
 						    io_task_work.node);
@@ -1205,7 +1232,7 @@
 			*ctx = NULL;
 			cond_resched();
 		}
-	}
+	} while (node);
 
 	return count;
 }
@@ -1224,22 +1251,6 @@
 	return xchg(&head->first, new);
 }
 
-/**
- * io_llist_cmpxchg - possibly swap all entries in a lock-less list
- * @head:	the head of lock-less list to delete all entries
- * @old:	expected old value of the first entry of the list
- * @new:	new entry as the head of the list
- *
- * perform a cmpxchg on the first entry of the list.
- */
-
-static inline struct llist_node *io_llist_cmpxchg(struct llist_head *head,
-						  struct llist_node *old,
-						  struct llist_node *new)
-{
-	return cmpxchg(&head->first, old, new);
-}
-
 static __cold void io_fallback_tw(struct io_uring_task *tctx, bool sync)
 {
 	struct llist_node *node = llist_del_all(&tctx->task_list);
@@ -1274,9 +1285,7 @@
 	struct io_ring_ctx *ctx = NULL;
 	struct io_uring_task *tctx = container_of(cb, struct io_uring_task,
 						  task_work);
-	struct llist_node fake = {};
 	struct llist_node *node;
-	unsigned int loops = 0;
 	unsigned int count = 0;
 
 	if (unlikely(current->flags & PF_EXITING)) {
@@ -1284,21 +1293,9 @@
 		return;
 	}
 
-	do {
-		loops++;
-		node = io_llist_xchg(&tctx->task_list, &fake);
-		count += handle_tw_list(node, &ctx, &ts, &fake);
-
-		/* skip expensive cmpxchg if there are items in the list */
-		if (READ_ONCE(tctx->task_list.first) != &fake)
-			continue;
-		if (ts.locked && !wq_list_empty(&ctx->submit_state.compl_reqs)) {
-			io_submit_flush_completions(ctx);
-			if (READ_ONCE(tctx->task_list.first) != &fake)
-				continue;
-		}
-		node = io_llist_cmpxchg(&tctx->task_list, &fake, NULL);
-	} while (node != &fake);
+	node = llist_del_all(&tctx->task_list);
+	if (node)
+		count = handle_tw_list(node, &ctx, &ts);
 
 	ctx_flush_and_put(ctx, &ts);
 
@@ -1306,7 +1303,7 @@
 	if (unlikely(atomic_read(&tctx->in_cancel)))
 		io_uring_drop_tctx_refs(current);
 
-	trace_io_uring_task_work_run(tctx, count, loops);
+	trace_io_uring_task_work_run(tctx, count, 1);
 }
 
 static inline void io_req_local_work_add(struct io_kiocb *req, unsigned flags)
@@ -1420,7 +1417,20 @@
 	}
 }
 
-static int __io_run_local_work(struct io_ring_ctx *ctx, struct io_tw_state *ts)
+static bool io_run_local_work_continue(struct io_ring_ctx *ctx, int events,
+				       int min_events)
+{
+	if (llist_empty(&ctx->work_llist))
+		return false;
+	if (events < min_events)
+		return true;
+	if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
+		atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);
+	return false;
+}
+
+static int __io_run_local_work(struct io_ring_ctx *ctx, struct io_tw_state *ts,
+			       int min_events)
 {
 	struct llist_node *node;
 	unsigned int loops = 0;
@@ -1449,18 +1459,20 @@
 	}
 	loops++;
 
-	if (!llist_empty(&ctx->work_llist))
+	if (io_run_local_work_continue(ctx, ret, min_events))
 		goto again;
 	if (ts->locked) {
 		io_submit_flush_completions(ctx);
-		if (!llist_empty(&ctx->work_llist))
+		if (io_run_local_work_continue(ctx, ret, min_events))
 			goto again;
 	}
+
 	trace_io_uring_local_work_run(ctx, ret, loops);
 	return ret;
 }
 
-static inline int io_run_local_work_locked(struct io_ring_ctx *ctx)
+static inline int io_run_local_work_locked(struct io_ring_ctx *ctx,
+					   int min_events)
 {
 	struct io_tw_state ts = { .locked = true, };
 	int ret;
@@ -1468,20 +1480,20 @@
 	if (llist_empty(&ctx->work_llist))
 		return 0;
 
-	ret = __io_run_local_work(ctx, &ts);
+	ret = __io_run_local_work(ctx, &ts, min_events);
 	/* shouldn't happen! */
 	if (WARN_ON_ONCE(!ts.locked))
 		mutex_lock(&ctx->uring_lock);
 	return ret;
 }
 
-static int io_run_local_work(struct io_ring_ctx *ctx)
+static int io_run_local_work(struct io_ring_ctx *ctx, int min_events)
 {
 	struct io_tw_state ts = {};
 	int ret;
 
 	ts.locked = mutex_trylock(&ctx->uring_lock);
-	ret = __io_run_local_work(ctx, &ts);
+	ret = __io_run_local_work(ctx, &ts, min_events);
 	if (ts.locked)
 		mutex_unlock(&ctx->uring_lock);
 
@@ -1501,7 +1513,7 @@
 	if (unlikely(req->task->flags & PF_EXITING))
 		io_req_defer_failed(req, -EFAULT);
 	else if (req->flags & REQ_F_FORCE_ASYNC)
-		io_queue_iowq(req, ts);
+		io_queue_iowq(req);
 	else
 		io_queue_sqe(req);
 }
@@ -1638,6 +1650,8 @@
 	unsigned int nr_events = 0;
 	unsigned long check_cq;
 
+	lockdep_assert_held(&ctx->uring_lock);
+
 	if (!io_allowed_run_tw(ctx))
 		return -EEXIST;
 
@@ -1677,7 +1691,7 @@
 		    io_task_work_pending(ctx)) {
 			u32 tail = ctx->cached_cq_tail;
 
-			(void) io_run_local_work_locked(ctx);
+			(void) io_run_local_work_locked(ctx, min);
 
 			if (task_work_pending(current) ||
 			    wq_list_empty(&ctx->iopoll_list)) {
@@ -1966,6 +1980,29 @@
 		goto fail;
 	}
 
+	/*
+	 * If DEFER_TASKRUN is set, it's only allowed to post CQEs from the
+	 * submitter task context. Final request completions are handed to the
+	 * right context, however this is not the case of auxiliary CQEs,
+	 * which is the main mean of operation for multishot requests.
+	 * Don't allow any multishot execution from io-wq. It's more restrictive
+	 * than necessary and also cleaner.
+	 */
+	if (req->flags & REQ_F_APOLL_MULTISHOT) {
+		err = -EBADFD;
+		if (!file_can_poll(req->file))
+			goto fail;
+		if (req->file->f_flags & O_NONBLOCK ||
+		    req->file->f_mode & FMODE_NOWAIT) {
+			err = -ECANCELED;
+			if (io_arm_poll_handler(req, issue_flags) != IO_APOLL_OK)
+				goto fail;
+			return;
+		} else {
+			req->flags &= ~REQ_F_APOLL_MULTISHOT;
+		}
+	}
+
 	if (req->flags & REQ_F_FORCE_ASYNC) {
 		bool opcode_poll = def->pollin || def->pollout;
 
@@ -2066,7 +2103,7 @@
 		break;
 	case IO_APOLL_ABORTED:
 		io_kbuf_recycle(req, 0);
-		io_queue_iowq(req, NULL);
+		io_queue_iowq(req);
 		break;
 	case IO_APOLL_OK:
 		break;
@@ -2113,7 +2150,7 @@
 		if (unlikely(req->ctx->drain_active))
 			io_drain_req(req);
 		else
-			io_queue_iowq(req, NULL);
+			io_queue_iowq(req);
 	}
 }
 
@@ -2159,6 +2196,13 @@
 	}
 }
 
+static __cold int io_init_fail_req(struct io_kiocb *req, int err)
+{
+	/* ensure per-opcode data is cleared if we fail before prep */
+	memset(&req->cmd.data, 0, sizeof(req->cmd.data));
+	return err;
+}
+
 static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
 		       const struct io_uring_sqe *sqe)
 	__must_hold(&ctx->uring_lock)
@@ -2179,29 +2223,29 @@
 
 	if (unlikely(opcode >= IORING_OP_LAST)) {
 		req->opcode = 0;
-		return -EINVAL;
+		return io_init_fail_req(req, -EINVAL);
 	}
 	def = &io_issue_defs[opcode];
 	if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) {
 		/* enforce forwards compatibility on users */
 		if (sqe_flags & ~SQE_VALID_FLAGS)
-			return -EINVAL;
+			return io_init_fail_req(req, -EINVAL);
 		if (sqe_flags & IOSQE_BUFFER_SELECT) {
 			if (!def->buffer_select)
-				return -EOPNOTSUPP;
+				return io_init_fail_req(req, -EOPNOTSUPP);
 			req->buf_index = READ_ONCE(sqe->buf_group);
 		}
 		if (sqe_flags & IOSQE_CQE_SKIP_SUCCESS)
 			ctx->drain_disabled = true;
 		if (sqe_flags & IOSQE_IO_DRAIN) {
 			if (ctx->drain_disabled)
-				return -EOPNOTSUPP;
+				return io_init_fail_req(req, -EOPNOTSUPP);
 			io_init_req_drain(req);
 		}
 	}
 	if (unlikely(ctx->restricted || ctx->drain_active || ctx->drain_next)) {
 		if (ctx->restricted && !io_check_restriction(ctx, req, sqe_flags))
-			return -EACCES;
+			return io_init_fail_req(req, -EACCES);
 		/* knock it to the slow queue path, will be drained there */
 		if (ctx->drain_active)
 			req->flags |= REQ_F_FORCE_ASYNC;
@@ -2214,9 +2258,9 @@
 	}
 
 	if (!def->ioprio && sqe->ioprio)
-		return -EINVAL;
+		return io_init_fail_req(req, -EINVAL);
 	if (!def->iopoll && (ctx->flags & IORING_SETUP_IOPOLL))
-		return -EINVAL;
+		return io_init_fail_req(req, -EINVAL);
 
 	if (def->needs_file) {
 		struct io_submit_state *state = &ctx->submit_state;
@@ -2240,12 +2284,12 @@
 
 		req->creds = xa_load(&ctx->personalities, personality);
 		if (!req->creds)
-			return -EINVAL;
+			return io_init_fail_req(req, -EINVAL);
 		get_cred(req->creds);
 		ret = security_uring_override_creds(req->creds);
 		if (ret) {
 			put_cred(req->creds);
-			return ret;
+			return io_init_fail_req(req, ret);
 		}
 		req->flags |= REQ_F_CREDS;
 	}
@@ -2520,7 +2564,7 @@
 {
 	if (!llist_empty(&ctx->work_llist)) {
 		__set_current_state(TASK_RUNNING);
-		if (io_run_local_work(ctx) > 0)
+		if (io_run_local_work(ctx, INT_MAX) > 0)
 			return 0;
 	}
 	if (io_run_task_work() > 0)
@@ -2530,46 +2574,28 @@
 	return 0;
 }
 
-static bool current_pending_io(void)
-{
-	struct io_uring_task *tctx = current->io_uring;
-
-	if (!tctx)
-		return false;
-	return percpu_counter_read_positive(&tctx->inflight);
-}
-
 /* when returns >0, the caller should retry */
 static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx,
 					  struct io_wait_queue *iowq)
 {
-	int io_wait, ret;
+	int ret;
 
 	if (unlikely(READ_ONCE(ctx->check_cq)))
 		return 1;
 	if (unlikely(!llist_empty(&ctx->work_llist)))
 		return 1;
-	if (unlikely(test_thread_flag(TIF_NOTIFY_SIGNAL)))
+	if (unlikely(task_work_pending(current)))
 		return 1;
 	if (unlikely(task_sigpending(current)))
 		return -EINTR;
 	if (unlikely(io_should_wake(iowq)))
 		return 0;
 
-	/*
-	 * Mark us as being in io_wait if we have pending requests, so cpufreq
-	 * can take into account that the task is waiting for IO - turns out
-	 * to be important for low QD IO.
-	 */
-	io_wait = current->in_iowait;
-	if (current_pending_io())
-		current->in_iowait = 1;
 	ret = 0;
 	if (iowq->timeout == KTIME_MAX)
 		schedule();
 	else if (!schedule_hrtimeout(&iowq->timeout, HRTIMER_MODE_ABS))
 		ret = -ETIME;
-	current->in_iowait = io_wait;
 	return ret;
 }
 
@@ -2588,26 +2614,13 @@
 	if (!io_allowed_run_tw(ctx))
 		return -EEXIST;
 	if (!llist_empty(&ctx->work_llist))
-		io_run_local_work(ctx);
+		io_run_local_work(ctx, min_events);
 	io_run_task_work();
 	io_cqring_overflow_flush(ctx);
 	/* if user messes with these they will just get an early return */
 	if (__io_cqring_events_user(ctx) >= min_events)
 		return 0;
 
-	if (sig) {
-#ifdef CONFIG_COMPAT
-		if (in_compat_syscall())
-			ret = set_compat_user_sigmask((const compat_sigset_t __user *)sig,
-						      sigsz);
-		else
-#endif
-			ret = set_user_sigmask(sig, sigsz);
-
-		if (ret)
-			return ret;
-	}
-
 	init_waitqueue_func_entry(&iowq.wq, io_wake_function);
 	iowq.wq.private = current;
 	INIT_LIST_HEAD(&iowq.wq.entry);
@@ -2624,13 +2637,25 @@
 		iowq.timeout = ktime_add_ns(timespec64_to_ktime(ts), ktime_get_ns());
 	}
 
+	if (sig) {
+#ifdef CONFIG_COMPAT
+		if (in_compat_syscall())
+			ret = set_compat_user_sigmask((const compat_sigset_t __user *)sig,
+						      sigsz);
+		else
+#endif
+			ret = set_user_sigmask(sig, sigsz);
+
+		if (ret)
+			return ret;
+	}
+
 	trace_io_uring_cqring_wait(ctx, min_events);
 	do {
+		int nr_wait = (int) iowq.cq_tail - READ_ONCE(ctx->rings->cq.tail);
 		unsigned long check_cq;
 
 		if (ctx->flags & IORING_SETUP_DEFER_TASKRUN) {
-			int nr_wait = (int) iowq.cq_tail - READ_ONCE(ctx->rings->cq.tail);
-
 			atomic_set(&ctx->cq_wait_nr, nr_wait);
 			set_current_state(TASK_INTERRUPTIBLE);
 		} else {
@@ -2647,9 +2672,9 @@
 		 * If we got woken because of task_work being processed, run it
 		 * now rather than let the caller do another wait loop.
 		 */
-		io_run_task_work();
 		if (!llist_empty(&ctx->work_llist))
-			io_run_local_work(ctx);
+			io_run_local_work(ctx, nr_wait);
+		io_run_task_work();
 
 		/*
 		 * Non-local task_work will be run on exit to userspace, but
@@ -2720,7 +2745,7 @@
 	struct page **page_array;
 	unsigned int nr_pages;
 	void *page_addr;
-	int ret, i;
+	int ret, i, pinned;
 
 	*npages = 0;
 
@@ -2734,12 +2759,12 @@
 	if (!page_array)
 		return ERR_PTR(-ENOMEM);
 
-	ret = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM,
-					page_array);
-	if (ret != nr_pages) {
-err:
-		io_pages_free(&page_array, ret > 0 ? ret : 0);
-		return ret < 0 ? ERR_PTR(ret) : ERR_PTR(-EFAULT);
+
+	pinned = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM,
+				     page_array);
+	if (pinned != nr_pages) {
+		ret = (pinned < 0) ? pinned : -EFAULT;
+		goto free_pages;
 	}
 
 	page_addr = page_address(page_array[0]);
@@ -2753,7 +2778,7 @@
 		 * didn't support this feature.
 		 */
 		if (PageHighMem(page_array[i]))
-			goto err;
+			goto free_pages;
 
 		/*
 		 * No support for discontig pages for now, should either be a
@@ -2762,13 +2787,17 @@
 		 * just fail them with EINVAL.
 		 */
 		if (page_address(page_array[i]) != page_addr)
-			goto err;
+			goto free_pages;
 		page_addr += PAGE_SIZE;
 	}
 
 	*pages = page_array;
 	*npages = nr_pages;
 	return page_to_virt(page_array[0]);
+
+free_pages:
+	io_pages_free(&page_array, pinned > 0 ? pinned : 0);
+	return ERR_PTR(ret);
 }
 
 static void *io_rings_map(struct io_ring_ctx *ctx, unsigned long uaddr,
@@ -2790,14 +2819,15 @@
 	if (!(ctx->flags & IORING_SETUP_NO_MMAP)) {
 		io_mem_free(ctx->rings);
 		io_mem_free(ctx->sq_sqes);
-		ctx->rings = NULL;
-		ctx->sq_sqes = NULL;
 	} else {
 		io_pages_free(&ctx->ring_pages, ctx->n_ring_pages);
 		ctx->n_ring_pages = 0;
 		io_pages_free(&ctx->sqe_pages, ctx->n_sqe_pages);
 		ctx->n_sqe_pages = 0;
 	}
+
+	ctx->rings = NULL;
+	ctx->sq_sqes = NULL;
 }
 
 void *io_mem_alloc(size_t size)
@@ -2919,7 +2949,6 @@
 		io_wq_put_hash(ctx->hash_map);
 	kfree(ctx->cancel_table.hbs);
 	kfree(ctx->cancel_table_locked.hbs);
-	kfree(ctx->io_bl);
 	xa_destroy(&ctx->io_bl_xa);
 	kfree(ctx);
 }
@@ -3154,7 +3183,7 @@
 	 * noise and overhead, there's no discernable change in runtime
 	 * over using system_wq.
 	 */
-	queue_work(system_unbound_wq, &ctx->exit_work);
+	queue_work(iou_wq, &ctx->exit_work);
 }
 
 static int io_uring_release(struct inode *inode, struct file *file)
@@ -3304,7 +3333,7 @@
 
 	if ((ctx->flags & IORING_SETUP_DEFER_TASKRUN) &&
 	    io_allowed_defer_tw_run(ctx))
-		ret |= io_run_local_work(ctx) > 0;
+		ret |= io_run_local_work(ctx, INT_MAX) > 0;
 	ret |= io_cancel_defer_files(ctx, task, cancel_all);
 	mutex_lock(&ctx->uring_lock);
 	ret |= io_poll_remove_all(ctx, task, cancel_all);
@@ -3350,8 +3379,11 @@
 		bool loop = false;
 
 		io_uring_drop_tctx_refs(current);
+		if (!tctx_inflight(tctx, !cancel_all))
+			break;
+
 		/* read completions before cancelations */
-		inflight = tctx_inflight(tctx, !cancel_all);
+		inflight = tctx_inflight(tctx, false);
 		if (!inflight)
 			break;
 
@@ -3410,6 +3442,7 @@
 
 void __io_uring_cancel(bool cancel_all)
 {
+	io_uring_unreg_ringfd();
 	io_uring_cancel_generic(cancel_all, NULL);
 }
 
@@ -3436,14 +3469,15 @@
 		ptr = ctx->sq_sqes;
 		break;
 	case IORING_OFF_PBUF_RING: {
+		struct io_buffer_list *bl;
 		unsigned int bgid;
 
 		bgid = (offset & ~IORING_OFF_MMAP_MASK) >> IORING_OFF_PBUF_SHIFT;
-		rcu_read_lock();
-		ptr = io_pbuf_get_address(ctx, bgid);
-		rcu_read_unlock();
-		if (!ptr)
-			return ERR_PTR(-EINVAL);
+		bl = io_pbuf_get_bl(ctx, bgid);
+		if (IS_ERR(bl))
+			return bl;
+		ptr = bl->buf_ring;
+		io_put_bl(ctx, bl);
 		break;
 		}
 	default:
@@ -3666,7 +3700,7 @@
 			 * it should handle ownership problems if any.
 			 */
 			if (ctx->flags & IORING_SETUP_DEFER_TASKRUN)
-				(void)io_run_local_work_locked(ctx);
+				(void)io_run_local_work_locked(ctx, min_complete);
 		}
 		mutex_unlock(&ctx->uring_lock);
 	}
@@ -4179,6 +4213,8 @@
 					  SLAB_HWCACHE_ALIGN | SLAB_PANIC | SLAB_ACCOUNT,
 					  NULL);
 
+	iou_wq = alloc_workqueue("iou_exit", WQ_UNBOUND, 64);
+
 #ifdef CONFIG_SYSCTL
 	register_sysctl_init("kernel", kernel_io_uring_disabled_table);
 #endif
--- linux-qcom-6.8.0.orig/io_uring/io_uring.h
+++ linux-qcom-6.8.0/io_uring/io_uring.h
@@ -52,7 +52,6 @@
 void __io_req_task_work_add(struct io_kiocb *req, unsigned flags);
 bool io_alloc_async_data(struct io_kiocb *req);
 void io_req_task_queue(struct io_kiocb *req);
-void io_queue_iowq(struct io_kiocb *req, struct io_tw_state *ts_dont_use);
 void io_req_task_complete(struct io_kiocb *req, struct io_tw_state *ts);
 void io_req_task_queue_fail(struct io_kiocb *req, int ret);
 void io_req_task_submit(struct io_kiocb *req, struct io_tw_state *ts);
@@ -259,7 +258,14 @@
 {
 	struct io_rings *r = ctx->rings;
 
-	return READ_ONCE(r->sq.tail) - ctx->cached_sq_head == ctx->sq_entries;
+	/*
+	 * SQPOLL must use the actual sqring head, as using the cached_sq_head
+	 * is race prone if the SQPOLL thread has grabbed entries but not yet
+	 * committed them to the ring. For !SQPOLL, this doesn't matter, but
+	 * since this helper is just used for SQPOLL sqring waits (or POLLOUT),
+	 * just read the actual sqring head unconditionally.
+	 */
+	return READ_ONCE(r->sq.tail) - READ_ONCE(r->sq.head) == ctx->sq_entries;
 }
 
 static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx)
@@ -301,7 +307,7 @@
 
 static inline bool io_task_work_pending(struct io_ring_ctx *ctx)
 {
-	return task_work_pending(current) || !wq_list_empty(&ctx->work_llist);
+	return task_work_pending(current) || !llist_empty(&ctx->work_llist);
 }
 
 static inline void io_tw_lock(struct io_ring_ctx *ctx, struct io_tw_state *ts)
--- linux-qcom-6.8.0.orig/io_uring/kbuf.c
+++ linux-qcom-6.8.0/io_uring/kbuf.c
@@ -17,8 +17,6 @@
 
 #define IO_BUFFER_LIST_BUF_PER_PAGE (PAGE_SIZE / sizeof(struct io_uring_buf))
 
-#define BGID_ARRAY	64
-
 /* BIDs are addressed by a 16-bit field in a CQE */
 #define MAX_BIDS_PER_BGID (1 << 16)
 
@@ -40,13 +38,9 @@
 	int				inuse;
 };
 
-static struct io_buffer_list *__io_buffer_get_list(struct io_ring_ctx *ctx,
-						   struct io_buffer_list *bl,
-						   unsigned int bgid)
+static inline struct io_buffer_list *__io_buffer_get_list(struct io_ring_ctx *ctx,
+							  unsigned int bgid)
 {
-	if (bl && bgid < BGID_ARRAY)
-		return &bl[bgid];
-
 	return xa_load(&ctx->io_bl_xa, bgid);
 }
 
@@ -55,7 +49,7 @@
 {
 	lockdep_assert_held(&ctx->uring_lock);
 
-	return __io_buffer_get_list(ctx, ctx->io_bl, bgid);
+	return __io_buffer_get_list(ctx, bgid);
 }
 
 static int io_buffer_add_list(struct io_ring_ctx *ctx,
@@ -67,11 +61,7 @@
 	 * always under the ->uring_lock, but the RCU lookup from mmap does.
 	 */
 	bl->bgid = bgid;
-	smp_store_release(&bl->is_ready, 1);
-
-	if (bgid < BGID_ARRAY)
-		return 0;
-
+	atomic_set(&bl->refs, 1);
 	return xa_err(xa_store(&ctx->io_bl_xa, bgid, bl, GFP_KERNEL));
 }
 
@@ -180,7 +170,8 @@
 	req->buf_list = bl;
 	req->buf_index = buf->bid;
 
-	if (issue_flags & IO_URING_F_UNLOCKED || !file_can_poll(req->file)) {
+	if (issue_flags & IO_URING_F_UNLOCKED ||
+	    (req->file && !file_can_poll(req->file))) {
 		/*
 		 * If we came in unlocked, we have no choice but to consume the
 		 * buffer here, otherwise nothing ensures that the buffer won't
@@ -217,24 +208,6 @@
 	return ret;
 }
 
-static __cold int io_init_bl_list(struct io_ring_ctx *ctx)
-{
-	struct io_buffer_list *bl;
-	int i;
-
-	bl = kcalloc(BGID_ARRAY, sizeof(struct io_buffer_list), GFP_KERNEL);
-	if (!bl)
-		return -ENOMEM;
-
-	for (i = 0; i < BGID_ARRAY; i++) {
-		INIT_LIST_HEAD(&bl[i].buf_list);
-		bl[i].bgid = i;
-	}
-
-	smp_store_release(&ctx->io_bl, bl);
-	return 0;
-}
-
 /*
  * Mark the given mapped range as free for reuse
  */
@@ -303,24 +276,24 @@
 	return i;
 }
 
+void io_put_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl)
+{
+	if (atomic_dec_and_test(&bl->refs)) {
+		__io_remove_buffers(ctx, bl, -1U);
+		kfree_rcu(bl, rcu);
+	}
+}
+
 void io_destroy_buffers(struct io_ring_ctx *ctx)
 {
 	struct io_buffer_list *bl;
 	struct list_head *item, *tmp;
 	struct io_buffer *buf;
 	unsigned long index;
-	int i;
-
-	for (i = 0; i < BGID_ARRAY; i++) {
-		if (!ctx->io_bl)
-			break;
-		__io_remove_buffers(ctx, &ctx->io_bl[i], -1U);
-	}
 
 	xa_for_each(&ctx->io_bl_xa, index, bl) {
 		xa_erase(&ctx->io_bl_xa, bl->bgid);
-		__io_remove_buffers(ctx, bl, -1U);
-		kfree_rcu(bl, rcu);
+		io_put_bl(ctx, bl);
 	}
 
 	/*
@@ -498,12 +471,6 @@
 
 	io_ring_submit_lock(ctx, issue_flags);
 
-	if (unlikely(p->bgid < BGID_ARRAY && !ctx->io_bl)) {
-		ret = io_init_bl_list(ctx);
-		if (ret)
-			goto err;
-	}
-
 	bl = io_buffer_get_list(ctx, p->bgid);
 	if (unlikely(!bl)) {
 		bl = kzalloc(sizeof(*bl), GFP_KERNEL_ACCOUNT);
@@ -516,14 +483,9 @@
 		if (ret) {
 			/*
 			 * Doesn't need rcu free as it was never visible, but
-			 * let's keep it consistent throughout. Also can't
-			 * be a lower indexed array group, as adding one
-			 * where lookup failed cannot happen.
+			 * let's keep it consistent throughout.
 			 */
-			if (p->bgid >= BGID_ARRAY)
-				kfree_rcu(bl, rcu);
-			else
-				WARN_ON_ONCE(1);
+			kfree_rcu(bl, rcu);
 			goto err;
 		}
 	}
@@ -688,12 +650,6 @@
 	if (reg.ring_entries >= 65536)
 		return -EINVAL;
 
-	if (unlikely(reg.bgid < BGID_ARRAY && !ctx->io_bl)) {
-		int ret = io_init_bl_list(ctx);
-		if (ret)
-			return ret;
-	}
-
 	bl = io_buffer_get_list(ctx, reg.bgid);
 	if (bl) {
 		/* if mapped buffer ring OR classic exists, don't allow */
@@ -742,11 +698,8 @@
 	if (!bl->is_mapped)
 		return -EINVAL;
 
-	__io_remove_buffers(ctx, bl, -1U);
-	if (bl->bgid >= BGID_ARRAY) {
-		xa_erase(&ctx->io_bl_xa, bl->bgid);
-		kfree_rcu(bl, rcu);
-	}
+	xa_erase(&ctx->io_bl_xa, bl->bgid);
+	io_put_bl(ctx, bl);
 	return 0;
 }
 
@@ -776,23 +729,35 @@
 	return 0;
 }
 
-void *io_pbuf_get_address(struct io_ring_ctx *ctx, unsigned long bgid)
+struct io_buffer_list *io_pbuf_get_bl(struct io_ring_ctx *ctx,
+				      unsigned long bgid)
 {
 	struct io_buffer_list *bl;
+	bool ret;
 
-	bl = __io_buffer_get_list(ctx, smp_load_acquire(&ctx->io_bl), bgid);
-
-	if (!bl || !bl->is_mmap)
-		return NULL;
 	/*
-	 * Ensure the list is fully setup. Only strictly needed for RCU lookup
-	 * via mmap, and in that case only for the array indexed groups. For
-	 * the xarray lookups, it's either visible and ready, or not at all.
+	 * We have to be a bit careful here - we're inside mmap and cannot grab
+	 * the uring_lock. This means the buffer_list could be simultaneously
+	 * going away, if someone is trying to be sneaky. Look it up under rcu
+	 * so we know it's not going away, and attempt to grab a reference to
+	 * it. If the ref is already zero, then fail the mapping. If successful,
+	 * the caller will call io_put_bl() to drop the the reference at at the
+	 * end. This may then safely free the buffer_list (and drop the pages)
+	 * at that point, vm_insert_pages() would've already grabbed the
+	 * necessary vma references.
 	 */
-	if (!smp_load_acquire(&bl->is_ready))
-		return NULL;
+	rcu_read_lock();
+	bl = xa_load(&ctx->io_bl_xa, bgid);
+	/* must be a mmap'able buffer ring and have pages */
+	ret = false;
+	if (bl && bl->is_mmap)
+		ret = atomic_inc_not_zero(&bl->refs);
+	rcu_read_unlock();
+
+	if (ret)
+		return bl;
 
-	return bl->buf_ring;
+	return ERR_PTR(-EINVAL);
 }
 
 /*
--- linux-qcom-6.8.0.orig/io_uring/kbuf.h
+++ linux-qcom-6.8.0/io_uring/kbuf.h
@@ -25,12 +25,12 @@
 	__u16 head;
 	__u16 mask;
 
+	atomic_t refs;
+
 	/* ring mapped provided buffers */
 	__u8 is_mapped;
 	/* ring mapped provided buffers, but mmap'ed by application */
 	__u8 is_mmap;
-	/* bl is visible from an RCU point of view for lookup */
-	__u8 is_ready;
 };
 
 struct io_buffer {
@@ -61,7 +61,9 @@
 
 bool io_kbuf_recycle_legacy(struct io_kiocb *req, unsigned issue_flags);
 
-void *io_pbuf_get_address(struct io_ring_ctx *ctx, unsigned long bgid);
+void io_put_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl);
+struct io_buffer_list *io_pbuf_get_bl(struct io_ring_ctx *ctx,
+				      unsigned long bgid);
 
 static inline bool io_kbuf_recycle_ring(struct io_kiocb *req)
 {
--- linux-qcom-6.8.0.orig/io_uring/net.c
+++ linux-qcom-6.8.0/io_uring/net.c
@@ -78,19 +78,6 @@
  */
 #define MULTISHOT_MAX_RETRY	32
 
-static inline bool io_check_multishot(struct io_kiocb *req,
-				      unsigned int issue_flags)
-{
-	/*
-	 * When ->locked_cq is set we only allow to post CQEs from the original
-	 * task context. Usual request completions will be handled in other
-	 * generic paths but multipoll may decide to post extra cqes.
-	 */
-	return !(issue_flags & IO_URING_F_IOWQ) ||
-		!(issue_flags & IO_URING_F_MULTISHOT) ||
-		!req->ctx->task_complete;
-}
-
 int io_shutdown_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
 	struct io_shutdown *shutdown = io_kiocb_to_cmd(req, struct io_shutdown);
@@ -204,16 +191,115 @@
 	return -EAGAIN;
 }
 
+#ifdef CONFIG_COMPAT
+static int io_compat_msg_copy_hdr(struct io_kiocb *req,
+				  struct io_async_msghdr *iomsg,
+				  struct compat_msghdr *msg, int ddir)
+{
+	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+	struct compat_iovec __user *uiov;
+	int ret;
+
+	if (copy_from_user(msg, sr->umsg_compat, sizeof(*msg)))
+		return -EFAULT;
+
+	uiov = compat_ptr(msg->msg_iov);
+	if (req->flags & REQ_F_BUFFER_SELECT) {
+		compat_ssize_t clen;
+
+		iomsg->free_iov = NULL;
+		if (msg->msg_iovlen == 0) {
+			sr->len = 0;
+		} else if (msg->msg_iovlen > 1) {
+			return -EINVAL;
+		} else {
+			if (!access_ok(uiov, sizeof(*uiov)))
+				return -EFAULT;
+			if (__get_user(clen, &uiov->iov_len))
+				return -EFAULT;
+			if (clen < 0)
+				return -EINVAL;
+			sr->len = clen;
+		}
+
+		return 0;
+	}
+
+	iomsg->free_iov = iomsg->fast_iov;
+	ret = __import_iovec(ddir, (struct iovec __user *)uiov, msg->msg_iovlen,
+				UIO_FASTIOV, &iomsg->free_iov,
+				&iomsg->msg.msg_iter, true);
+	if (unlikely(ret < 0))
+		return ret;
+
+	return 0;
+}
+#endif
+
+static int io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
+			   struct user_msghdr *msg, int ddir)
+{
+	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+	int ret;
+
+	if (copy_from_user(msg, sr->umsg, sizeof(*sr->umsg)))
+		return -EFAULT;
+
+	if (req->flags & REQ_F_BUFFER_SELECT) {
+		if (msg->msg_iovlen == 0) {
+			sr->len = iomsg->fast_iov[0].iov_len = 0;
+			iomsg->fast_iov[0].iov_base = NULL;
+			iomsg->free_iov = NULL;
+		} else if (msg->msg_iovlen > 1) {
+			return -EINVAL;
+		} else {
+			if (copy_from_user(iomsg->fast_iov, msg->msg_iov,
+					   sizeof(*msg->msg_iov)))
+				return -EFAULT;
+			sr->len = iomsg->fast_iov[0].iov_len;
+			iomsg->free_iov = NULL;
+		}
+
+		return 0;
+	}
+
+	iomsg->free_iov = iomsg->fast_iov;
+	ret = __import_iovec(ddir, msg->msg_iov, msg->msg_iovlen, UIO_FASTIOV,
+				&iomsg->free_iov, &iomsg->msg.msg_iter, false);
+	if (unlikely(ret < 0))
+		return ret;
+
+	return 0;
+}
+
 static int io_sendmsg_copy_hdr(struct io_kiocb *req,
 			       struct io_async_msghdr *iomsg)
 {
 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+	struct user_msghdr msg;
 	int ret;
 
 	iomsg->msg.msg_name = &iomsg->addr;
-	iomsg->free_iov = iomsg->fast_iov;
-	ret = sendmsg_copy_msghdr(&iomsg->msg, sr->umsg, sr->msg_flags,
-					&iomsg->free_iov);
+	iomsg->msg.msg_iter.nr_segs = 0;
+
+#ifdef CONFIG_COMPAT
+	if (unlikely(req->ctx->compat)) {
+		struct compat_msghdr cmsg;
+
+		ret = io_compat_msg_copy_hdr(req, iomsg, &cmsg, ITER_SOURCE);
+		if (unlikely(ret))
+			return ret;
+
+		return __get_compat_msghdr(&iomsg->msg, &cmsg, NULL);
+	}
+#endif
+
+	ret = io_msg_copy_hdr(req, iomsg, &msg, ITER_SOURCE);
+	if (unlikely(ret))
+		return ret;
+
+	ret = __copy_msghdr(&iomsg->msg, &msg, NULL);
+
 	/* save msg_control as sys_sendmsg() overwrites it */
 	sr->msg_control = iomsg->msg.msg_control_user;
 	return ret;
@@ -225,7 +311,10 @@
 	struct io_async_msghdr *io;
 	int ret;
 
-	if (!zc->addr || req_has_async_data(req))
+	if (req_has_async_data(req))
+		return 0;
+	zc->done_io = 0;
+	if (!zc->addr)
 		return 0;
 	io = io_msg_alloc_async_prep(req);
 	if (!io)
@@ -252,8 +341,10 @@
 
 int io_sendmsg_prep_async(struct io_kiocb *req)
 {
+	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
 	int ret;
 
+	sr->done_io = 0;
 	if (!io_msg_alloc_async_prep(req))
 		return -ENOMEM;
 	ret = io_sendmsg_copy_hdr(req, req->async_data);
@@ -273,6 +364,8 @@
 {
 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
 
+	sr->done_io = 0;
+
 	if (req->opcode == IORING_OP_SEND) {
 		if (READ_ONCE(sqe->__pad3[0]))
 			return -EINVAL;
@@ -295,7 +388,6 @@
 	if (req->ctx->compat)
 		sr->msg_flags |= MSG_CMSG_COMPAT;
 #endif
-	sr->done_io = 0;
 	return 0;
 }
 
@@ -435,142 +527,79 @@
 	return IOU_OK;
 }
 
-static bool io_recvmsg_multishot_overflow(struct io_async_msghdr *iomsg)
-{
-	int hdr;
+static int io_recvmsg_mshot_prep(struct io_kiocb *req,
+				 struct io_async_msghdr *iomsg,
+				 int namelen, size_t controllen)
+{
+	if ((req->flags & (REQ_F_APOLL_MULTISHOT|REQ_F_BUFFER_SELECT)) ==
+			  (REQ_F_APOLL_MULTISHOT|REQ_F_BUFFER_SELECT)) {
+		int hdr;
+
+		if (unlikely(namelen < 0))
+			return -EOVERFLOW;
+		if (check_add_overflow(sizeof(struct io_uring_recvmsg_out),
+					namelen, &hdr))
+			return -EOVERFLOW;
+		if (check_add_overflow(hdr, controllen, &hdr))
+			return -EOVERFLOW;
 
-	if (iomsg->namelen < 0)
-		return true;
-	if (check_add_overflow((int)sizeof(struct io_uring_recvmsg_out),
-			       iomsg->namelen, &hdr))
-		return true;
-	if (check_add_overflow(hdr, (int)iomsg->controllen, &hdr))
-		return true;
+		iomsg->namelen = namelen;
+		iomsg->controllen = controllen;
+		return 0;
+	}
 
-	return false;
+	return 0;
 }
 
-static int __io_recvmsg_copy_hdr(struct io_kiocb *req,
-				 struct io_async_msghdr *iomsg)
+static int io_recvmsg_copy_hdr(struct io_kiocb *req,
+			       struct io_async_msghdr *iomsg)
 {
-	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
 	struct user_msghdr msg;
 	int ret;
 
-	if (copy_from_user(&msg, sr->umsg, sizeof(*sr->umsg)))
-		return -EFAULT;
-
-	ret = __copy_msghdr(&iomsg->msg, &msg, &iomsg->uaddr);
-	if (ret)
-		return ret;
-
-	if (req->flags & REQ_F_BUFFER_SELECT) {
-		if (msg.msg_iovlen == 0) {
-			sr->len = iomsg->fast_iov[0].iov_len = 0;
-			iomsg->fast_iov[0].iov_base = NULL;
-			iomsg->free_iov = NULL;
-		} else if (msg.msg_iovlen > 1) {
-			return -EINVAL;
-		} else {
-			if (copy_from_user(iomsg->fast_iov, msg.msg_iov, sizeof(*msg.msg_iov)))
-				return -EFAULT;
-			sr->len = iomsg->fast_iov[0].iov_len;
-			iomsg->free_iov = NULL;
-		}
-
-		if (req->flags & REQ_F_APOLL_MULTISHOT) {
-			iomsg->namelen = msg.msg_namelen;
-			iomsg->controllen = msg.msg_controllen;
-			if (io_recvmsg_multishot_overflow(iomsg))
-				return -EOVERFLOW;
-		}
-	} else {
-		iomsg->free_iov = iomsg->fast_iov;
-		ret = __import_iovec(ITER_DEST, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV,
-				     &iomsg->free_iov, &iomsg->msg.msg_iter,
-				     false);
-		if (ret > 0)
-			ret = 0;
-	}
-
-	return ret;
-}
+	iomsg->msg.msg_name = &iomsg->addr;
+	iomsg->msg.msg_iter.nr_segs = 0;
 
 #ifdef CONFIG_COMPAT
-static int __io_compat_recvmsg_copy_hdr(struct io_kiocb *req,
-					struct io_async_msghdr *iomsg)
-{
-	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
-	struct compat_msghdr msg;
-	struct compat_iovec __user *uiov;
-	int ret;
-
-	if (copy_from_user(&msg, sr->umsg_compat, sizeof(msg)))
-		return -EFAULT;
+	if (unlikely(req->ctx->compat)) {
+		struct compat_msghdr cmsg;
 
-	ret = __get_compat_msghdr(&iomsg->msg, &msg, &iomsg->uaddr);
-	if (ret)
-		return ret;
-
-	uiov = compat_ptr(msg.msg_iov);
-	if (req->flags & REQ_F_BUFFER_SELECT) {
-		compat_ssize_t clen;
-
-		iomsg->free_iov = NULL;
-		if (msg.msg_iovlen == 0) {
-			sr->len = 0;
-		} else if (msg.msg_iovlen > 1) {
-			return -EINVAL;
-		} else {
-			if (!access_ok(uiov, sizeof(*uiov)))
-				return -EFAULT;
-			if (__get_user(clen, &uiov->iov_len))
-				return -EFAULT;
-			if (clen < 0)
-				return -EINVAL;
-			sr->len = clen;
-		}
+		ret = io_compat_msg_copy_hdr(req, iomsg, &cmsg, ITER_DEST);
+		if (unlikely(ret))
+			return ret;
 
-		if (req->flags & REQ_F_APOLL_MULTISHOT) {
-			iomsg->namelen = msg.msg_namelen;
-			iomsg->controllen = msg.msg_controllen;
-			if (io_recvmsg_multishot_overflow(iomsg))
-				return -EOVERFLOW;
-		}
-	} else {
-		iomsg->free_iov = iomsg->fast_iov;
-		ret = __import_iovec(ITER_DEST, (struct iovec __user *)uiov, msg.msg_iovlen,
-				   UIO_FASTIOV, &iomsg->free_iov,
-				   &iomsg->msg.msg_iter, true);
-		if (ret < 0)
+		ret = __get_compat_msghdr(&iomsg->msg, &cmsg, &iomsg->uaddr);
+		if (unlikely(ret))
 			return ret;
-	}
 
-	return 0;
-}
+		return io_recvmsg_mshot_prep(req, iomsg, cmsg.msg_namelen,
+						cmsg.msg_controllen);
+	}
 #endif
 
-static int io_recvmsg_copy_hdr(struct io_kiocb *req,
-			       struct io_async_msghdr *iomsg)
-{
-	iomsg->msg.msg_name = &iomsg->addr;
-	iomsg->msg.msg_iter.nr_segs = 0;
+	ret = io_msg_copy_hdr(req, iomsg, &msg, ITER_DEST);
+	if (unlikely(ret))
+		return ret;
 
-#ifdef CONFIG_COMPAT
-	if (req->ctx->compat)
-		return __io_compat_recvmsg_copy_hdr(req, iomsg);
-#endif
+	ret = __copy_msghdr(&iomsg->msg, &msg, &iomsg->uaddr);
+	if (unlikely(ret))
+		return ret;
 
-	return __io_recvmsg_copy_hdr(req, iomsg);
+	return io_recvmsg_mshot_prep(req, iomsg, msg.msg_namelen,
+					msg.msg_controllen);
 }
 
 int io_recvmsg_prep_async(struct io_kiocb *req)
 {
+	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+	struct io_async_msghdr *iomsg;
 	int ret;
 
+	sr->done_io = 0;
 	if (!io_msg_alloc_async_prep(req))
 		return -ENOMEM;
-	ret = io_recvmsg_copy_hdr(req, req->async_data);
+	iomsg = req->async_data;
+	ret = io_recvmsg_copy_hdr(req, iomsg);
 	if (!ret)
 		req->flags |= REQ_F_NEED_CLEANUP;
 	return ret;
@@ -582,6 +611,8 @@
 {
 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
 
+	sr->done_io = 0;
+
 	if (unlikely(sqe->file_index || sqe->addr2))
 		return -EINVAL;
 
@@ -618,7 +649,6 @@
 	if (req->ctx->compat)
 		sr->msg_flags |= MSG_CMSG_COMPAT;
 #endif
-	sr->done_io = 0;
 	sr->nr_multishot_loops = 0;
 	return 0;
 }
@@ -803,9 +833,6 @@
 	    (sr->flags & IORING_RECVSEND_POLL_FIRST))
 		return io_setup_async_msg(req, kmsg, issue_flags);
 
-	if (!io_check_multishot(req, issue_flags))
-		return io_setup_async_msg(req, kmsg, issue_flags);
-
 retry_multishot:
 	if (io_do_buffer_select(req)) {
 		void __user *buf;
@@ -881,7 +908,8 @@
 			kfree(kmsg->free_iov);
 		io_netmsg_recycle(req, issue_flags);
 		req->flags &= ~REQ_F_NEED_CLEANUP;
-	}
+	} else if (ret == -EAGAIN)
+		return io_setup_async_msg(req, kmsg, issue_flags);
 
 	return ret;
 }
@@ -895,14 +923,12 @@
 	int ret, min_ret = 0;
 	bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
 	size_t len = sr->len;
+	bool mshot_finished;
 
 	if (!(req->flags & REQ_F_POLLED) &&
 	    (sr->flags & IORING_RECVSEND_POLL_FIRST))
 		return -EAGAIN;
 
-	if (!io_check_multishot(req, issue_flags))
-		return -EAGAIN;
-
 	sock = sock_from_file(req->file);
 	if (unlikely(!sock))
 		return -ENOTSOCK;
@@ -964,6 +990,7 @@
 		req_set_fail(req);
 	}
 
+	mshot_finished = ret <= 0;
 	if (ret > 0)
 		ret += sr->done_io;
 	else if (sr->done_io)
@@ -971,7 +998,7 @@
 	else
 		io_kbuf_recycle(req, issue_flags);
 
-	if (!io_recv_finish(req, &ret, &msg, ret <= 0, issue_flags))
+	if (!io_recv_finish(req, &ret, &msg, mshot_finished, issue_flags))
 		goto retry_multishot;
 
 	return ret;
@@ -1003,6 +1030,9 @@
 	struct io_ring_ctx *ctx = req->ctx;
 	struct io_kiocb *notif;
 
+	zc->done_io = 0;
+	req->flags |= REQ_F_POLL_NO_LAZY;
+
 	if (unlikely(READ_ONCE(sqe->__pad2[0]) || READ_ONCE(sqe->addr3)))
 		return -EINVAL;
 	/* we don't support IOSQE_CQE_SKIP_SUCCESS just yet */
@@ -1055,8 +1085,6 @@
 	if (zc->msg_flags & MSG_DONTWAIT)
 		req->flags |= REQ_F_NOWAIT;
 
-	zc->done_io = 0;
-
 #ifdef CONFIG_COMPAT
 	if (req->ctx->compat)
 		zc->msg_flags |= MSG_CMSG_COMPAT;
@@ -1239,6 +1267,7 @@
 
 	if (req_has_async_data(req)) {
 		kmsg = req->async_data;
+		kmsg->msg.msg_control_user = sr->msg_control;
 	} else {
 		ret = io_sendmsg_copy_hdr(req, &iomsg);
 		if (ret)
@@ -1301,7 +1330,7 @@
 {
 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
 
-	if (req->flags & REQ_F_PARTIAL_IO)
+	if (sr->done_io)
 		req->cqe.res = sr->done_io;
 
 	if ((req->flags & REQ_F_NEED_CLEANUP) &&
@@ -1351,8 +1380,6 @@
 	struct file *file;
 	int ret, fd;
 
-	if (!io_check_multishot(req, issue_flags))
-		return -EAGAIN;
 retry:
 	if (!fixed) {
 		fd = __get_unused_fd_flags(accept->flags, accept->nofile);
--- linux-qcom-6.8.0.orig/io_uring/nop.c
+++ linux-qcom-6.8.0/io_uring/nop.c
@@ -12,6 +12,8 @@
 
 int io_nop_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
+	if (READ_ONCE(sqe->rw_flags))
+		return -EINVAL;
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/io_uring/opdef.c
+++ linux-qcom-6.8.0/io_uring/opdef.c
@@ -721,6 +721,14 @@
 	return "INVALID";
 }
 
+bool io_uring_op_supported(u8 opcode)
+{
+	if (opcode < IORING_OP_LAST &&
+	    io_issue_defs[opcode].prep != io_eopnotsupp_prep)
+		return true;
+	return false;
+}
+
 void __init io_uring_optable_init(void)
 {
 	int i;
--- linux-qcom-6.8.0.orig/io_uring/opdef.h
+++ linux-qcom-6.8.0/io_uring/opdef.h
@@ -17,8 +17,6 @@
 	unsigned		poll_exclusive : 1;
 	/* op supports buffer selection */
 	unsigned		buffer_select : 1;
-	/* opcode is not supported by this kernel */
-	unsigned		not_supported : 1;
 	/* skip auditing */
 	unsigned		audit_skip : 1;
 	/* supports ioprio */
@@ -50,5 +48,7 @@
 extern const struct io_issue_def io_issue_defs[];
 extern const struct io_cold_def io_cold_defs[];
 
+bool io_uring_op_supported(u8 opcode);
+
 void io_uring_optable_init(void);
 #endif
--- linux-qcom-6.8.0.orig/io_uring/poll.c
+++ linux-qcom-6.8.0/io_uring/poll.c
@@ -539,14 +539,6 @@
 	poll->wait.private = (void *) wqe_private;
 
 	if (poll->events & EPOLLEXCLUSIVE) {
-		/*
-		 * Exclusive waits may only wake a limited amount of entries
-		 * rather than all of them, this may interfere with lazy
-		 * wake if someone does wait(events > 1). Ensure we don't do
-		 * lazy wake for those, as we need to process each one as they
-		 * come in.
-		 */
-		req->flags |= REQ_F_POLL_NO_LAZY;
 		add_wait_queue_exclusive(head, &poll->wait);
 	} else {
 		add_wait_queue(head, &poll->wait);
@@ -618,6 +610,17 @@
 	if (issue_flags & IO_URING_F_UNLOCKED)
 		req->flags &= ~REQ_F_HASH_LOCKED;
 
+
+	/*
+	 * Exclusive waits may only wake a limited amount of entries
+	 * rather than all of them, this may interfere with lazy
+	 * wake if someone does wait(events > 1). Ensure we don't do
+	 * lazy wake for those, as we need to process each one as they
+	 * come in.
+	 */
+	if (poll->events & EPOLLEXCLUSIVE)
+		req->flags |= REQ_F_POLL_NO_LAZY;
+
 	mask = vfs_poll(req->file, &ipt->pt) & poll->events;
 
 	if (unlikely(ipt->error || !ipt->nr_entries)) {
@@ -995,7 +998,6 @@
 	struct io_hash_bucket *bucket;
 	struct io_kiocb *preq;
 	int ret2, ret = 0;
-	struct io_tw_state ts = { .locked = true };
 
 	io_ring_submit_lock(ctx, issue_flags);
 	preq = io_poll_find(ctx, true, &cd, &ctx->cancel_table, &bucket);
@@ -1044,7 +1046,8 @@
 
 	req_set_fail(preq);
 	io_req_set_res(preq, -ECANCELED, 0);
-	io_req_task_complete(preq, &ts);
+	preq->io_task_work.func = io_req_task_complete;
+	io_req_task_work_add(preq);
 out:
 	io_ring_submit_unlock(ctx, issue_flags);
 	if (ret < 0) {
--- linux-qcom-6.8.0.orig/io_uring/register.c
+++ linux-qcom-6.8.0/io_uring/register.c
@@ -112,7 +112,7 @@
 
 	for (i = 0; i < nr_args; i++) {
 		p->ops[i].op = i;
-		if (!io_issue_defs[i].not_supported)
+		if (io_uring_op_supported(i))
 			p->ops[i].flags = IO_URING_OP_SUPPORTED;
 	}
 	p->ops_len = i;
@@ -354,8 +354,10 @@
 	}
 
 	if (sqd) {
+		mutex_unlock(&ctx->uring_lock);
 		mutex_unlock(&sqd->lock);
 		io_put_sq_data(sqd);
+		mutex_lock(&ctx->uring_lock);
 	}
 
 	if (copy_to_user(arg, new_count, sizeof(new_count)))
@@ -380,8 +382,10 @@
 	return 0;
 err:
 	if (sqd) {
+		mutex_unlock(&ctx->uring_lock);
 		mutex_unlock(&sqd->lock);
 		io_put_sq_data(sqd);
+		mutex_lock(&ctx->uring_lock);
 	}
 	return ret;
 }
--- linux-qcom-6.8.0.orig/io_uring/rsrc.c
+++ linux-qcom-6.8.0/io_uring/rsrc.c
@@ -250,6 +250,7 @@
 
 		ret = io_run_task_work_sig(ctx);
 		if (ret < 0) {
+			__set_current_state(TASK_RUNNING);
 			mutex_lock(&ctx->uring_lock);
 			if (list_empty(&ctx->rsrc_ref_list))
 				ret = 0;
@@ -878,7 +879,12 @@
 	struct page **pages = NULL;
 	int ret;
 
-	end = (ubuf + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	if (check_add_overflow(ubuf, len, &end))
+		return ERR_PTR(-EOVERFLOW);
+	if (check_add_overflow(end, PAGE_SIZE - 1, &end))
+		return ERR_PTR(-EOVERFLOW);
+
+	end = end >> PAGE_SHIFT;
 	start = ubuf >> PAGE_SHIFT;
 	nr_pages = end - start;
 	WARN_ON(!nr_pages);
@@ -1104,7 +1110,6 @@
 			 * branch doesn't expect non PAGE_SIZE'd chunks.
 			 */
 			iter->bvec = bvec;
-			iter->nr_segs = bvec->bv_len;
 			iter->count -= offset;
 			iter->iov_offset = offset;
 		} else {
--- linux-qcom-6.8.0.orig/io_uring/rw.c
+++ linux-qcom-6.8.0/io_uring/rw.c
@@ -186,12 +186,6 @@
 	return NULL;
 }
 
-static void io_req_task_queue_reissue(struct io_kiocb *req)
-{
-	req->io_task_work.func = io_queue_iowq;
-	io_req_task_work_add(req);
-}
-
 #ifdef CONFIG_BLOCK
 static bool io_resubmit_prep(struct io_kiocb *req)
 {
@@ -404,7 +398,7 @@
 	if (req->flags & REQ_F_REISSUE) {
 		req->flags &= ~REQ_F_REISSUE;
 		if (io_resubmit_prep(req))
-			io_req_task_queue_reissue(req);
+			return -EAGAIN;
 		else
 			io_req_task_queue_fail(req, final_ret);
 	}
@@ -825,6 +819,14 @@
 
 	ret = io_iter_do_read(rw, &s->iter);
 
+	/*
+	 * Some file systems like to return -EOPNOTSUPP for an IOCB_NOWAIT
+	 * issue, even though they should be returning -EAGAIN. To be safe,
+	 * retry from blocking context for either.
+	 */
+	if (ret == -EOPNOTSUPP && force_nonblock)
+		ret = -EAGAIN;
+
 	if (ret == -EAGAIN || (req->flags & REQ_F_REISSUE)) {
 		req->flags &= ~REQ_F_REISSUE;
 		/*
@@ -936,6 +938,13 @@
 	ret = __io_read(req, issue_flags);
 
 	/*
+	 * If the file doesn't support proper NOWAIT, then disable multishot
+	 * and stay in single shot mode.
+	 */
+	if (!io_file_supports_nowait(req))
+		req->flags &= ~REQ_F_APOLL_MULTISHOT;
+
+	/*
 	 * If we get -EAGAIN, recycle our buffer and just let normal poll
 	 * handling arm it.
 	 */
@@ -946,18 +955,26 @@
 		 */
 		if (io_kbuf_recycle(req, issue_flags))
 			rw->len = 0;
+		if (issue_flags & IO_URING_F_MULTISHOT)
+			return IOU_ISSUE_SKIP_COMPLETE;
 		return -EAGAIN;
-	}
-
-	/*
-	 * Any successful return value will keep the multishot read armed.
-	 */
-	if (ret > 0) {
+	} else if (ret <= 0) {
+		io_kbuf_recycle(req, issue_flags);
+		if (ret < 0)
+			req_set_fail(req);
+	} else if (!(req->flags & REQ_F_APOLL_MULTISHOT)) {
+		cflags = io_put_kbuf(req, issue_flags);
+	} else {
 		/*
-		 * Put our buffer and post a CQE. If we fail to post a CQE, then
+		 * Any successful return value will keep the multishot read
+		 * armed, if it's still set. Put our buffer and post a CQE. If
+		 * we fail to post a CQE, or multishot is no longer set, then
 		 * jump to the termination path. This request is then done.
 		 */
 		cflags = io_put_kbuf(req, issue_flags);
+		if (!(req->flags & REQ_F_APOLL_MULTISHOT))
+			goto done;
+
 		rw->len = 0; /* similarly to above, reset len to 0 */
 
 		if (io_fill_cqe_req_aux(req,
@@ -980,12 +997,32 @@
 	 * Either an error, or we've hit overflow posting the CQE. For any
 	 * multishot request, hitting overflow will terminate it.
 	 */
+done:
 	io_req_set_res(req, ret, cflags);
 	if (issue_flags & IO_URING_F_MULTISHOT)
 		return IOU_STOP_MULTISHOT;
 	return IOU_OK;
 }
 
+static bool io_kiocb_start_write(struct io_kiocb *req, struct kiocb *kiocb)
+{
+	struct inode *inode;
+	bool ret;
+
+	if (!(req->flags & REQ_F_ISREG))
+		return true;
+	if (!(kiocb->ki_flags & IOCB_NOWAIT)) {
+		kiocb_start_write(kiocb);
+		return true;
+	}
+
+	inode = file_inode(kiocb->ki_filp);
+	ret = sb_start_write_trylock(inode->i_sb);
+	if (ret)
+		__sb_writers_release(inode->i_sb, SB_FREEZE_WRITE);
+	return ret;
+}
+
 int io_write(struct io_kiocb *req, unsigned int issue_flags)
 {
 	struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw);
@@ -1039,8 +1076,8 @@
 		return ret;
 	}
 
-	if (req->flags & REQ_F_ISREG)
-		kiocb_start_write(kiocb);
+	if (unlikely(!io_kiocb_start_write(req, kiocb)))
+		return -EAGAIN;
 	kiocb->ki_flags |= IOCB_WRITE;
 
 	if (likely(req->file->f_op->write_iter))
--- linux-qcom-6.8.0.orig/io_uring/sqpoll.c
+++ linux-qcom-6.8.0/io_uring/sqpoll.c
@@ -10,6 +10,7 @@
 #include <linux/slab.h>
 #include <linux/audit.h>
 #include <linux/security.h>
+#include <linux/cpuset.h>
 #include <linux/io_uring.h>
 
 #include <uapi/linux/io_uring.h>
@@ -240,6 +241,14 @@
 		sqd->sq_cpu = raw_smp_processor_id();
 	}
 
+	/*
+	 * Force audit context to get setup, in case we do prep side async
+	 * operations that would trigger an audit call before any issue side
+	 * audit has been done.
+	 */
+	audit_uring_entry(IORING_OP_NOP);
+	audit_uring_exit(true, 0);
+
 	mutex_lock(&sqd->lock);
 	while (1) {
 		bool cap_entries, sqt_spin = false;
@@ -343,6 +352,7 @@
 __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 				struct io_uring_params *p)
 {
+	struct task_struct *task_to_put = NULL;
 	int ret;
 
 	/* Retain compatibility with failing for an invalid attach attempt */
@@ -393,11 +403,22 @@
 			return 0;
 
 		if (p->flags & IORING_SETUP_SQ_AFF) {
+			cpumask_var_t allowed_mask;
 			int cpu = p->sq_thread_cpu;
 
 			ret = -EINVAL;
 			if (cpu >= nr_cpu_ids || !cpu_online(cpu))
 				goto err_sqpoll;
+			ret = -ENOMEM;
+			if (!alloc_cpumask_var(&allowed_mask, GFP_KERNEL))
+				goto err_sqpoll;
+			ret = -EINVAL;
+			cpuset_cpus_allowed(current, allowed_mask);
+			if (!cpumask_test_cpu(cpu, allowed_mask)) {
+				free_cpumask_var(allowed_mask);
+				goto err_sqpoll;
+			}
+			free_cpumask_var(allowed_mask);
 			sqd->sq_cpu = cpu;
 		} else {
 			sqd->sq_cpu = -1;
@@ -412,6 +433,7 @@
 		}
 
 		sqd->thread = tsk;
+		task_to_put = get_task_struct(tsk);
 		ret = io_uring_alloc_task_context(tsk, ctx);
 		wake_up_new_task(tsk);
 		if (ret)
@@ -422,11 +444,15 @@
 		goto err;
 	}
 
+	if (task_to_put)
+		put_task_struct(task_to_put);
 	return 0;
 err_sqpoll:
 	complete(&ctx->sq_data->exited);
 err:
 	io_sq_thread_finish(ctx);
+	if (task_to_put)
+		put_task_struct(task_to_put);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/io_uring/tctx.c
+++ linux-qcom-6.8.0/io_uring/tctx.c
@@ -47,8 +47,19 @@
 void __io_uring_free(struct task_struct *tsk)
 {
 	struct io_uring_task *tctx = tsk->io_uring;
+	struct io_tctx_node *node;
+	unsigned long index;
 
-	WARN_ON_ONCE(!xa_empty(&tctx->xa));
+	/*
+	 * Fault injection forcing allocation errors in the xa_store() path
+	 * can lead to xa_empty() returning false, even though no actual
+	 * node is stored in the xarray. Until that gets sorted out, attempt
+	 * an iteration here and warn if any entries are found.
+	 */
+	xa_for_each(&tctx->xa, index, node) {
+		WARN_ON_ONCE(1);
+		break;
+	}
 	WARN_ON_ONCE(tctx->io_wq);
 	WARN_ON_ONCE(tctx->cached_refs);
 
--- linux-qcom-6.8.0.orig/io_uring/timeout.c
+++ linux-qcom-6.8.0/io_uring/timeout.c
@@ -413,10 +413,12 @@
 
 	timeout->off = 0; /* noseq */
 	data = req->async_data;
+	data->ts = *ts;
+
 	list_add_tail(&timeout->list, &ctx->timeout_list);
 	hrtimer_init(&data->timer, io_timeout_get_clock(data), mode);
 	data->timer.function = io_timeout_fn;
-	hrtimer_start(&data->timer, timespec64_to_ktime(*ts), mode);
+	hrtimer_start(&data->timer, timespec64_to_ktime(data->ts), mode);
 	return 0;
 }
 
@@ -644,7 +646,7 @@
 
 static bool io_match_task(struct io_kiocb *head, struct task_struct *task,
 			  bool cancel_all)
-	__must_hold(&req->ctx->timeout_lock)
+	__must_hold(&head->ctx->timeout_lock)
 {
 	struct io_kiocb *req;
 
--- linux-qcom-6.8.0.orig/io_uring/uring_cmd.c
+++ linux-qcom-6.8.0/io_uring/uring_cmd.c
@@ -83,7 +83,7 @@
  * Called by consumers of io_uring_cmd, if they originally returned
  * -EIOCBQUEUED upon receiving the command.
  */
-void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, ssize_t res2,
+void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, u64 res2,
 		       unsigned issue_flags)
 {
 	struct io_kiocb *req = cmd_to_io_kiocb(ioucmd);
--- linux-qcom-6.8.0.orig/io_uring/waitid.c
+++ linux-qcom-6.8.0/io_uring/waitid.c
@@ -125,12 +125,6 @@
 
 	lockdep_assert_held(&req->ctx->uring_lock);
 
-	/*
-	 * Did cancel find it meanwhile?
-	 */
-	if (hlist_unhashed(&req->hash_node))
-		return;
-
 	hlist_del_init(&req->hash_node);
 
 	ret = io_waitid_finish(req, ret);
@@ -202,6 +196,7 @@
 	hlist_for_each_entry_safe(req, tmp, &ctx->waitid_list, hash_node) {
 		if (!io_match_task_safe(req, task, cancel_all))
 			continue;
+		hlist_del_init(&req->hash_node);
 		__io_waitid_cancel(ctx, req);
 		found = true;
 	}
--- linux-qcom-6.8.0.orig/ipc/ipc_sysctl.c
+++ linux-qcom-6.8.0/ipc/ipc_sysctl.c
@@ -14,6 +14,7 @@
 #include <linux/ipc_namespace.h>
 #include <linux/msg.h>
 #include <linux/slab.h>
+#include <linux/cred.h>
 #include "util.h"
 
 static int proc_ipc_dointvec_minmax_orphans(struct ctl_table *table, int write,
@@ -190,25 +191,56 @@
 	return &current->nsproxy->ipc_ns->ipc_set == set;
 }
 
+static void ipc_set_ownership(struct ctl_table_header *head,
+			      kuid_t *uid, kgid_t *gid)
+{
+	struct ipc_namespace *ns =
+		container_of(head->set, struct ipc_namespace, ipc_set);
+
+	kuid_t ns_root_uid = make_kuid(ns->user_ns, 0);
+	kgid_t ns_root_gid = make_kgid(ns->user_ns, 0);
+
+	*uid = uid_valid(ns_root_uid) ? ns_root_uid : GLOBAL_ROOT_UID;
+	*gid = gid_valid(ns_root_gid) ? ns_root_gid : GLOBAL_ROOT_GID;
+}
+
 static int ipc_permissions(struct ctl_table_header *head, struct ctl_table *table)
 {
 	int mode = table->mode;
 
 #ifdef CONFIG_CHECKPOINT_RESTORE
-	struct ipc_namespace *ns = current->nsproxy->ipc_ns;
+	struct ipc_namespace *ns =
+		container_of(head->set, struct ipc_namespace, ipc_set);
 
 	if (((table->data == &ns->ids[IPC_SEM_IDS].next_id) ||
 	     (table->data == &ns->ids[IPC_MSG_IDS].next_id) ||
 	     (table->data == &ns->ids[IPC_SHM_IDS].next_id)) &&
 	    checkpoint_restore_ns_capable(ns->user_ns))
 		mode = 0666;
+	else
 #endif
-	return mode;
+	{
+		kuid_t ns_root_uid;
+		kgid_t ns_root_gid;
+
+		ipc_set_ownership(head, &ns_root_uid, &ns_root_gid);
+
+		if (uid_eq(current_euid(), ns_root_uid))
+			mode >>= 6;
+
+		else if (in_egroup_p(ns_root_gid))
+			mode >>= 3;
+	}
+
+	mode &= 7;
+
+	return (mode << 6) | (mode << 3) | mode;
 }
 
 static struct ctl_table_root set_root = {
 	.lookup = set_lookup,
 	.permissions = ipc_permissions,
+	.set_ownership = ipc_set_ownership,
 };
 
 bool setup_ipc_sysctls(struct ipc_namespace *ns)
--- linux-qcom-6.8.0.orig/ipc/mq_sysctl.c
+++ linux-qcom-6.8.0/ipc/mq_sysctl.c
@@ -12,6 +12,7 @@
 #include <linux/stat.h>
 #include <linux/capability.h>
 #include <linux/slab.h>
+#include <linux/cred.h>
 
 static int msg_max_limit_min = MIN_MSGMAX;
 static int msg_max_limit_max = HARD_MSGMAX;
@@ -76,8 +77,42 @@
 	return &current->nsproxy->ipc_ns->mq_set == set;
 }
 
+static void mq_set_ownership(struct ctl_table_header *head,
+			     kuid_t *uid, kgid_t *gid)
+{
+	struct ipc_namespace *ns =
+		container_of(head->set, struct ipc_namespace, mq_set);
+
+	kuid_t ns_root_uid = make_kuid(ns->user_ns, 0);
+	kgid_t ns_root_gid = make_kgid(ns->user_ns, 0);
+
+	*uid = uid_valid(ns_root_uid) ? ns_root_uid : GLOBAL_ROOT_UID;
+	*gid = gid_valid(ns_root_gid) ? ns_root_gid : GLOBAL_ROOT_GID;
+}
+
+static int mq_permissions(struct ctl_table_header *head, struct ctl_table *table)
+{
+	int mode = table->mode;
+	kuid_t ns_root_uid;
+	kgid_t ns_root_gid;
+
+	mq_set_ownership(head, &ns_root_uid, &ns_root_gid);
+
+	if (uid_eq(current_euid(), ns_root_uid))
+		mode >>= 6;
+
+	else if (in_egroup_p(ns_root_gid))
+		mode >>= 3;
+
+	mode &= 7;
+
+	return (mode << 6) | (mode << 3) | mode;
+}
+
 static struct ctl_table_root set_root = {
 	.lookup = set_lookup,
+	.permissions = mq_permissions,
+	.set_ownership = mq_set_ownership,
 };
 
 bool setup_mq_sysctls(struct ipc_namespace *ns)
--- linux-qcom-6.8.0.orig/ipc/namespace.c
+++ linux-qcom-6.8.0/ipc/namespace.c
@@ -83,13 +83,15 @@
 
 	err = msg_init_ns(ns);
 	if (err)
-		goto fail_put;
+		goto fail_ipc;
 
 	sem_init_ns(ns);
 	shm_init_ns(ns);
 
 	return ns;
 
+fail_ipc:
+	retire_ipc_sysctls(ns);
 fail_mq:
 	retire_mq_sysctls(ns);
 
@@ -205,6 +207,23 @@
 			schedule_work(&free_ipc_work);
 	}
 }
+EXPORT_SYMBOL(put_ipc_ns);
+
+struct ipc_namespace *get_ipc_ns_exported(struct ipc_namespace *ns)
+{
+	return get_ipc_ns(ns);
+}
+EXPORT_SYMBOL(get_ipc_ns_exported);
+
+struct ipc_namespace *show_init_ipc_ns(void)
+{
+#if defined(CONFIG_IPC_NS)
+	return &init_ipc_ns;
+#else
+	return NULL;
+#endif
+}
+EXPORT_SYMBOL(show_init_ipc_ns);
 
 static inline struct ipc_namespace *to_ipc_ns(struct ns_common *ns)
 {
--- linux-qcom-6.8.0.orig/kernel/audit.c
+++ linux-qcom-6.8.0/kernel/audit.c
@@ -54,6 +54,7 @@
 #include <net/netlink.h>
 #include <linux/skbuff.h>
 #include <linux/security.h>
+#include <linux/lsm_hooks.h>
 #include <linux/freezer.h>
 #include <linux/pid_namespace.h>
 #include <net/netns/generic.h>
@@ -123,7 +124,7 @@
 /* The identity of the user shutting down the audit system. */
 static kuid_t		audit_sig_uid = INVALID_UID;
 static pid_t		audit_sig_pid = -1;
-static u32		audit_sig_sid;
+static struct lsmblob	audit_sig_lsm;
 
 /* Records can be lost in several ways:
    0) [suppressed in audit_alloc]
@@ -195,8 +196,10 @@
  * to place it on a transmit queue.  Multiple audit_buffers can be in
  * use simultaneously. */
 struct audit_buffer {
-	struct sk_buff       *skb;	/* formatted skb ready to send */
+	struct sk_buff       *skb;	/* the skb for audit_log functions */
+	struct sk_buff_head  skb_list;	/* formatted skbs, ready to send */
 	struct audit_context *ctx;	/* NULL or associated context */
+	struct audit_stamp   stamp;	/* audit stamp for these records */
 	gfp_t		     gfp_mask;
 };
 
@@ -1113,7 +1116,6 @@
 	return af.features & AUDIT_FEATURE_TO_MASK(i);
 }
 
-
 static int audit_get_feature(struct sk_buff *skb)
 {
 	u32 seq;
@@ -1221,8 +1223,7 @@
 	struct audit_buffer	*ab;
 	u16			msg_type = nlh->nlmsg_type;
 	struct audit_sig_info   *sig_data;
-	char			*ctx = NULL;
-	u32			len;
+	struct lsmcontext	lsmctx;
 
 	err = audit_netlink_ok(skb, msg_type);
 	if (err)
@@ -1471,29 +1472,33 @@
 		kfree(new);
 		break;
 	}
-	case AUDIT_SIGNAL_INFO:
-		len = 0;
-		if (audit_sig_sid) {
-			err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
-			if (err)
+	case AUDIT_SIGNAL_INFO: {
+		size_t sig_data_size;
+
+		if (lsmblob_is_set(&audit_sig_lsm)) {
+			err = security_lsmblob_to_secctx(&audit_sig_lsm,
+							 &lsmctx, LSM_ID_UNDEF);
+			if (err < 0)
 				return err;
 		}
-		sig_data = kmalloc(struct_size(sig_data, ctx, len), GFP_KERNEL);
+		sig_data_size = struct_size(sig_data, ctx, lsmctx.len);
+		sig_data = kmalloc(sig_data_size, GFP_KERNEL);
 		if (!sig_data) {
-			if (audit_sig_sid)
-				security_release_secctx(ctx, len);
+			if (lsmblob_is_set(&audit_sig_lsm))
+				security_release_secctx(&lsmctx);
 			return -ENOMEM;
 		}
 		sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
 		sig_data->pid = audit_sig_pid;
-		if (audit_sig_sid) {
-			memcpy(sig_data->ctx, ctx, len);
-			security_release_secctx(ctx, len);
+		if (lsmblob_is_set(&audit_sig_lsm)) {
+			memcpy(sig_data->ctx, lsmctx.context, lsmctx.len);
+			security_release_secctx(&lsmctx);
 		}
 		audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
-				 sig_data, struct_size(sig_data, ctx, len));
+				 sig_data, sig_data_size);
 		kfree(sig_data);
 		break;
+	}
 	case AUDIT_TTY_GET: {
 		struct audit_tty_status s;
 		unsigned int t;
@@ -1777,10 +1782,13 @@
 
 static void audit_buffer_free(struct audit_buffer *ab)
 {
+	struct sk_buff *skb;
+
 	if (!ab)
 		return;
 
-	kfree_skb(ab->skb);
+	while ((skb = skb_dequeue(&ab->skb_list)))
+		kfree_skb(skb);
 	kmem_cache_free(audit_buffer_cache, ab);
 }
 
@@ -1796,6 +1804,10 @@
 	ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
 	if (!ab->skb)
 		goto err;
+
+	skb_queue_head_init(&ab->skb_list);
+	skb_queue_tail(&ab->skb_list, ab->skb);
+
 	if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0))
 		goto err;
 
@@ -1834,11 +1846,11 @@
 }
 
 static inline void audit_get_stamp(struct audit_context *ctx,
-				   struct timespec64 *t, unsigned int *serial)
+				   struct audit_stamp *stamp)
 {
-	if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
-		ktime_get_coarse_real_ts64(t);
-		*serial = audit_serial();
+	if (!ctx || !auditsc_get_stamp(ctx, stamp)) {
+		ktime_get_coarse_real_ts64(&stamp->ctime);
+		stamp->serial = audit_serial();
 	}
 }
 
@@ -1861,8 +1873,6 @@
 				     int type)
 {
 	struct audit_buffer *ab;
-	struct timespec64 t;
-	unsigned int serial;
 
 	if (audit_initialized != AUDIT_INITIALIZED)
 		return NULL;
@@ -1917,12 +1927,14 @@
 		return NULL;
 	}
 
-	audit_get_stamp(ab->ctx, &t, &serial);
+	audit_get_stamp(ab->ctx, &ab->stamp);
 	/* cancel dummy context to enable supporting records */
 	if (ctx)
 		ctx->dummy = 0;
 	audit_log_format(ab, "audit(%llu.%03lu:%u): ",
-			 (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial);
+			 (unsigned long long)ab->stamp.ctime.tv_sec,
+			 ab->stamp.ctime.tv_nsec/1000000,
+			 ab->stamp.serial);
 
 	return ab;
 }
@@ -2178,34 +2190,171 @@
 		audit_log_format(ab, "(null)");
 }
 
-int audit_log_task_context(struct audit_buffer *ab)
+/**
+ * audit_buffer_aux_new - Add an aux record buffer to the skb list
+ * @ab: audit_buffer
+ * @type: message type
+ *
+ * Aux records are allocated and added to the skb list of
+ * the "main" record. The ab->skb is reset to point to the
+ * aux record on its creation. When the aux record in complete
+ * ab->skb has to be reset to point to the "main" record.
+ * This allows the audit_log_ functions to be ignorant of
+ * which kind of record it is logging to. It also avoids adding
+ * special data for aux records.
+ *
+ * On success ab->skb will point to the new aux record.
+ * Returns 0 on success, -ENOMEM should allocation fail.
+ */
+static int audit_buffer_aux_new(struct audit_buffer *ab, int type)
 {
-	char *ctx = NULL;
-	unsigned len;
+	WARN_ON(ab->skb != skb_peek(&ab->skb_list));
+
+	ab->skb = nlmsg_new(AUDIT_BUFSIZ, ab->gfp_mask);
+	if (!ab->skb)
+		goto err;
+	if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0))
+		goto err;
+	skb_queue_tail(&ab->skb_list, ab->skb);
+
+	audit_log_format(ab, "audit(%llu.%03lu:%u): ",
+			 (unsigned long long)ab->stamp.ctime.tv_sec,
+			 ab->stamp.ctime.tv_nsec/1000000,
+			 ab->stamp.serial);
+
+	return 0;
+
+err:
+	kfree_skb(ab->skb);
+	ab->skb = skb_peek(&ab->skb_list);
+	return -ENOMEM;
+}
+
+/**
+ * audit_buffer_aux_end - Switch back to the "main" record from an aux record
+ * @ab: audit_buffer
+ *
+ * Restores the "main" audit record to ab->skb.
+ */
+static void audit_buffer_aux_end(struct audit_buffer *ab)
+{
+	ab->skb = skb_peek(&ab->skb_list);
+}
+
+int audit_log_subject_context(struct audit_buffer *ab, struct lsmblob *blob)
+{
+	struct lsmcontext ctx;
+	bool space = false;
 	int error;
-	u32 sid;
+	int i;
 
-	security_current_getsecid_subj(&sid);
-	if (!sid)
+	if (!lsmblob_is_set(blob))
 		return 0;
 
-	error = security_secid_to_secctx(sid, &ctx, &len);
-	if (error) {
-		if (error != -EINVAL)
-			goto error_path;
+	if (lsm_blob_cnt < 2) {
+		error = security_lsmblob_to_secctx(blob, &ctx, LSM_ID_UNDEF);
+		if (error < 0) {
+			if (error != -EINVAL)
+				goto error_path;
+			return 0;
+		}
+		audit_log_format(ab, " subj=%s", ctx.context);
+		security_release_secctx(&ctx);
 		return 0;
 	}
+	/* Multiple LSMs provide contexts. Include an aux record. */
+	audit_log_format(ab, " subj=?");
+	error = audit_buffer_aux_new(ab, AUDIT_MAC_TASK_CONTEXTS);
+	if (error)
+		goto error_path;
 
-	audit_log_format(ab, " subj=%s", ctx);
-	security_release_secctx(ctx, len);
+	for (i = 0; i < lsm_active_cnt; i++) {
+		if (!lsm_idlist[i]->lsmblob)
+			continue;
+		error = security_lsmblob_to_secctx(blob, &ctx,
+						   lsm_idlist[i]->id);
+		if (error < 0) {
+			if (error == -EOPNOTSUPP)
+				continue;
+			audit_log_format(ab, "%ssubj_%s=?", space ? " " : "",
+					 lsm_idlist[i]->name);
+			if (error != -EINVAL)
+				audit_panic("error in audit_log_task_context");
+		} else {
+			audit_log_format(ab, "%ssubj_%s=%s", space ? " " : "",
+					 lsm_idlist[i]->name, ctx.context);
+			security_release_secctx(&ctx);
+		}
+		space = true;
+	}
+	audit_buffer_aux_end(ab);
 	return 0;
 
 error_path:
-	audit_panic("error in audit_log_task_context");
+	audit_panic("error in audit_log_subject_context");
 	return error;
 }
+EXPORT_SYMBOL(audit_log_subject_context);
+
+int audit_log_task_context(struct audit_buffer *ab)
+{
+	struct lsmblob blob;
+
+	security_current_getlsmblob_subj(&blob);
+	return audit_log_subject_context(ab, &blob);
+}
 EXPORT_SYMBOL(audit_log_task_context);
 
+void audit_log_object_context(struct audit_buffer *ab, struct lsmblob *blob)
+{
+	int i;
+	int error;
+	bool space = false;
+	struct lsmcontext context;
+
+	if (lsm_blob_cnt < 2) {
+		error = security_lsmblob_to_secctx(blob, &context,
+						   LSM_ID_UNDEF);
+		if (error) {
+			if (error != -EINVAL)
+				goto error_path;
+			return;
+		}
+		audit_log_format(ab, " obj=%s", context.context);
+		security_release_secctx(&context);
+		return;
+	}
+	audit_log_format(ab, " obj=?");
+	error = audit_buffer_aux_new(ab, AUDIT_MAC_OBJ_CONTEXTS);
+	if (error)
+		goto error_path;
+
+	for (i = 0; i < lsm_blob_cnt; i++) {
+		if (!lsm_idlist[i]->lsmblob)
+			continue;
+		error = security_lsmblob_to_secctx(blob, &context,
+						   lsm_idlist[i]->id);
+		if (error) {
+			audit_log_format(ab, "%sobj_%s=?",
+					 space ? " " : "", lsm_idlist[i]->name);
+			if (error != -EINVAL)
+				audit_panic("error in audit_log_object_context");
+		} else {
+			audit_log_format(ab, "%sobj_%s=%s",
+					 space ? " " : "", lsm_idlist[i]->name,
+					 context.context);
+			security_release_secctx(&context);
+		}
+		space = true;
+	}
+
+	audit_buffer_aux_end(ab);
+	return;
+
+error_path:
+	audit_panic("error in audit_log_object_context");
+}
+
 void audit_log_d_path_exe(struct audit_buffer *ab,
 			  struct mm_struct *mm)
 {
@@ -2406,33 +2555,21 @@
 			audit_sig_uid = auid;
 		else
 			audit_sig_uid = uid;
-		security_current_getsecid_subj(&audit_sig_sid);
+		security_current_getlsmblob_subj(&audit_sig_lsm);
 	}
 
 	return audit_signal_info_syscall(t);
 }
 
 /**
- * audit_log_end - end one audit record
- * @ab: the audit_buffer
- *
- * We can not do a netlink send inside an irq context because it blocks (last
- * arg, flags, is not set to MSG_DONTWAIT), so the audit buffer is placed on a
- * queue and a kthread is scheduled to remove them from the queue outside the
- * irq context.  May be called in any context.
+ * __audit_log_end - enqueue one audit record
+ * @skb: the buffer to send
  */
-void audit_log_end(struct audit_buffer *ab)
+static void __audit_log_end(struct sk_buff *skb)
 {
-	struct sk_buff *skb;
 	struct nlmsghdr *nlh;
 
-	if (!ab)
-		return;
-
 	if (audit_rate_check()) {
-		skb = ab->skb;
-		ab->skb = NULL;
-
 		/* setup the netlink header, see the comments in
 		 * kauditd_send_multicast_skb() for length quirks */
 		nlh = nlmsg_hdr(skb);
@@ -2443,6 +2580,26 @@
 		wake_up_interruptible(&kauditd_wait);
 	} else
 		audit_log_lost("rate limit exceeded");
+}
+
+/**
+ * audit_log_end - end one audit record
+ * @ab: the audit_buffer
+ *
+ * We can not do a netlink send inside an irq context because it blocks (last
+ * arg, flags, is not set to MSG_DONTWAIT), so the audit buffer is placed on a
+ * queue and a kthread is scheduled to remove them from the queue outside the
+ * irq context.  May be called in any context.
+ */
+void audit_log_end(struct audit_buffer *ab)
+{
+	struct sk_buff *skb;
+
+	if (!ab)
+		return;
+
+	while ((skb = skb_dequeue(&ab->skb_list)))
+		__audit_log_end(skb);
 
 	audit_buffer_free(ab);
 }
--- linux-qcom-6.8.0.orig/kernel/audit.h
+++ linux-qcom-6.8.0/kernel/audit.h
@@ -11,6 +11,7 @@
 
 #include <linux/fs.h>
 #include <linux/audit.h>
+#include <linux/security.h>
 #include <linux/skbuff.h>
 #include <uapi/linux/mqueue.h>
 #include <linux/tty.h>
@@ -81,7 +82,7 @@
 	kuid_t			uid;
 	kgid_t			gid;
 	dev_t			rdev;
-	u32			osid;
+	struct lsmblob		oblob;
 	struct audit_cap_data	fcap;
 	unsigned int		fcap_ver;
 	unsigned char		type;		/* record type */
@@ -98,6 +99,12 @@
 	char	*value;	/* the cmdline field */
 };
 
+/* A timestamp/serial pair to identify an event */
+struct audit_stamp {
+	struct timespec64	ctime;	/* time of syscall entry */
+	unsigned int		serial;	/* serial number for record */
+};
+
 /* The per-task audit context. */
 struct audit_context {
 	int		    dummy;	/* must be the first element */
@@ -107,10 +114,9 @@
 		AUDIT_CTX_URING,	/* in use by io_uring */
 	} context;
 	enum audit_state    state, current_state;
-	unsigned int	    serial;     /* serial number for record */
+	struct audit_stamp  stamp;	/* event identifier */
 	int		    major;      /* syscall number */
 	int		    uring_op;   /* uring operation */
-	struct timespec64   ctime;      /* time of syscall entry */
 	unsigned long	    argv[4];    /* syscall arguments */
 	long		    return_code;/* syscall return code */
 	u64		    prio;
@@ -143,7 +149,7 @@
 	kuid_t		    target_auid;
 	kuid_t		    target_uid;
 	unsigned int	    target_sessionid;
-	u32		    target_sid;
+	struct lsmblob	    target_blob;
 	char		    target_comm[TASK_COMM_LEN];
 
 	struct audit_tree_refs *trees, *first_trees;
@@ -160,7 +166,7 @@
 			kuid_t			uid;
 			kgid_t			gid;
 			umode_t			mode;
-			u32			osid;
+			struct lsmblob		oblob;
 			int			has_perm;
 			uid_t			perm_uid;
 			gid_t			perm_gid;
@@ -262,7 +268,7 @@
 extern unsigned int audit_serial(void);
 #ifdef CONFIG_AUDITSYSCALL
 extern int auditsc_get_stamp(struct audit_context *ctx,
-			      struct timespec64 *t, unsigned int *serial);
+			     struct audit_stamp *stamp);
 
 extern void audit_put_watch(struct audit_watch *watch);
 extern void audit_get_watch(struct audit_watch *watch);
@@ -303,7 +309,7 @@
 				struct audit_context *ctx);
 extern struct list_head *audit_killed_trees(void);
 #else /* CONFIG_AUDITSYSCALL */
-#define auditsc_get_stamp(c, t, s) 0
+#define auditsc_get_stamp(c, s) 0
 #define audit_put_watch(w) do { } while (0)
 #define audit_get_watch(w) do { } while (0)
 #define audit_to_watch(k, p, l, o) (-EINVAL)
--- linux-qcom-6.8.0.orig/kernel/auditfilter.c
+++ linux-qcom-6.8.0/kernel/auditfilter.c
@@ -529,7 +529,8 @@
 			entry->rule.buflen += f_val;
 			f->lsm_str = str;
 			err = security_audit_rule_init(f->type, f->op, str,
-						       (void **)&f->lsm_rule);
+						       (void **)&f->lsm_rule,
+						       GFP_KERNEL);
 			/* Keep currently invalid fields around in case they
 			 * become valid after a policy reload. */
 			if (err == -EINVAL) {
@@ -799,7 +800,7 @@
 
 	/* our own (refreshed) copy of lsm_rule */
 	ret = security_audit_rule_init(df->type, df->op, df->lsm_str,
-				       (void **)&df->lsm_rule);
+				       (void **)&df->lsm_rule, GFP_KERNEL);
 	/* Keep currently invalid fields around in case they
 	 * become valid after a policy reload. */
 	if (ret == -EINVAL) {
@@ -1338,8 +1339,8 @@
 
 		for (i = 0; i < e->rule.field_count; i++) {
 			struct audit_field *f = &e->rule.fields[i];
+			struct lsmblob blob = { };
 			pid_t pid;
-			u32 sid;
 
 			switch (f->type) {
 			case AUDIT_PID:
@@ -1369,9 +1370,10 @@
 			case AUDIT_SUBJ_SEN:
 			case AUDIT_SUBJ_CLR:
 				if (f->lsm_rule) {
-					security_current_getsecid_subj(&sid);
-					result = security_audit_rule_match(sid,
-						   f->type, f->op, f->lsm_rule);
+					security_current_getlsmblob_subj(&blob);
+					result = security_audit_rule_match(
+						   &blob, f->type, f->op,
+						   f->lsm_rule);
 				}
 				break;
 			case AUDIT_EXE:
--- linux-qcom-6.8.0.orig/kernel/auditsc.c
+++ linux-qcom-6.8.0/kernel/auditsc.c
@@ -100,7 +100,7 @@
 	kuid_t			target_auid[AUDIT_AUX_PIDS];
 	kuid_t			target_uid[AUDIT_AUX_PIDS];
 	unsigned int		target_sessionid[AUDIT_AUX_PIDS];
-	u32			target_sid[AUDIT_AUX_PIDS];
+	struct lsmblob		target_blob[AUDIT_AUX_PIDS];
 	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
 	int			pid_count;
 };
@@ -470,7 +470,7 @@
 {
 	const struct cred *cred;
 	int i, need_sid = 1;
-	u32 sid;
+	struct lsmblob blob = { };
 	unsigned int sessionid;
 
 	if (ctx && rule->prio <= ctx->prio)
@@ -674,14 +674,16 @@
 					 * fork()/copy_process() in which case
 					 * the new @tsk creds are still a dup
 					 * of @current's creds so we can still
-					 * use security_current_getsecid_subj()
+					 * use
+					 * security_current_getlsmblob_subj()
 					 * here even though it always refs
 					 * @current's creds
 					 */
-					security_current_getsecid_subj(&sid);
+					security_current_getlsmblob_subj(&blob);
 					need_sid = 0;
 				}
-				result = security_audit_rule_match(sid, f->type,
+				result = security_audit_rule_match(&blob,
+								   f->type,
 								   f->op,
 								   f->lsm_rule);
 			}
@@ -697,14 +699,14 @@
 				/* Find files that match */
 				if (name) {
 					result = security_audit_rule_match(
-								name->osid,
+								&name->oblob,
 								f->type,
 								f->op,
 								f->lsm_rule);
 				} else if (ctx) {
 					list_for_each_entry(n, &ctx->names_list, list) {
 						if (security_audit_rule_match(
-								n->osid,
+								&n->oblob,
 								f->type,
 								f->op,
 								f->lsm_rule)) {
@@ -716,7 +718,7 @@
 				/* Find ipc objects that match */
 				if (!ctx || ctx->type != AUDIT_IPC)
 					break;
-				if (security_audit_rule_match(ctx->ipc.osid,
+				if (security_audit_rule_match(&ctx->ipc.oblob,
 							      f->type, f->op,
 							      f->lsm_rule))
 					++result;
@@ -992,10 +994,10 @@
 	 */
 
 	ctx->current_state = ctx->state;
-	ctx->serial = 0;
+	ctx->stamp.serial = 0;
 	ctx->major = 0;
 	ctx->uring_op = 0;
-	ctx->ctime = (struct timespec64){ .tv_sec = 0, .tv_nsec = 0 };
+	ctx->stamp.ctime = (struct timespec64){ .tv_sec = 0, .tv_nsec = 0 };
 	memset(ctx->argv, 0, sizeof(ctx->argv));
 	ctx->return_code = 0;
 	ctx->prio = (ctx->state == AUDIT_STATE_RECORD ? ~0ULL : 0);
@@ -1017,7 +1019,7 @@
 	ctx->target_pid = 0;
 	ctx->target_auid = ctx->target_uid = KUIDT_INIT(0);
 	ctx->target_sessionid = 0;
-	ctx->target_sid = 0;
+	lsmblob_init(&ctx->target_blob);
 	ctx->target_comm[0] = '\0';
 	unroll_tree_refs(ctx, NULL, 0);
 	WARN_ON(!list_empty(&ctx->killed_trees));
@@ -1090,36 +1092,27 @@
 	kfree(context);
 }
 
-static int audit_log_pid_context(struct audit_context *context, pid_t pid,
-				 kuid_t auid, kuid_t uid, unsigned int sessionid,
-				 u32 sid, char *comm)
+static void audit_log_pid_context(struct audit_context *context, pid_t pid,
+				  kuid_t auid, kuid_t uid,
+				  unsigned int sessionid, struct lsmblob *blob,
+				  char *comm)
 {
 	struct audit_buffer *ab;
-	char *ctx = NULL;
-	u32 len;
-	int rc = 0;
 
 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
 	if (!ab)
-		return rc;
+		return;
 
 	audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
 			 from_kuid(&init_user_ns, auid),
 			 from_kuid(&init_user_ns, uid), sessionid);
-	if (sid) {
-		if (security_secid_to_secctx(sid, &ctx, &len)) {
-			audit_log_format(ab, " obj=(none)");
-			rc = 1;
-		} else {
-			audit_log_format(ab, " obj=%s", ctx);
-			security_release_secctx(ctx, len);
-		}
-	}
+	if (lsmblob_is_set(blob))
+		audit_log_object_context(ab, blob);
 	audit_log_format(ab, " ocomm=");
 	audit_log_untrustedstring(ab, comm);
 	audit_log_end(ab);
 
-	return rc;
+	return;
 }
 
 static void audit_log_execve_info(struct audit_context *context,
@@ -1384,25 +1377,13 @@
 			audit_log_format(ab, " a%d=%lx", i,
 				context->socketcall.args[i]);
 		break; }
-	case AUDIT_IPC: {
-		u32 osid = context->ipc.osid;
-
+	case AUDIT_IPC:
 		audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho",
 				 from_kuid(&init_user_ns, context->ipc.uid),
 				 from_kgid(&init_user_ns, context->ipc.gid),
 				 context->ipc.mode);
-		if (osid) {
-			char *ctx = NULL;
-			u32 len;
-
-			if (security_secid_to_secctx(osid, &ctx, &len)) {
-				audit_log_format(ab, " osid=%u", osid);
-				*call_panic = 1;
-			} else {
-				audit_log_format(ab, " obj=%s", ctx);
-				security_release_secctx(ctx, len);
-			}
-		}
+		if (lsmblob_is_set(&context->ipc.oblob))
+			audit_log_object_context(ab, &context->ipc.oblob);
 		if (context->ipc.has_perm) {
 			audit_log_end(ab);
 			ab = audit_log_start(context, GFP_KERNEL,
@@ -1416,7 +1397,7 @@
 				context->ipc.perm_gid,
 				context->ipc.perm_mode);
 		}
-		break; }
+		break;
 	case AUDIT_MQ_OPEN:
 		audit_log_format(ab,
 			"oflag=0x%x mode=%#ho mq_flags=0x%lx mq_maxmsg=%ld "
@@ -1558,20 +1539,8 @@
 				 from_kgid(&init_user_ns, n->gid),
 				 MAJOR(n->rdev),
 				 MINOR(n->rdev));
-	if (n->osid != 0) {
-		char *ctx = NULL;
-		u32 len;
-
-		if (security_secid_to_secctx(
-			n->osid, &ctx, &len)) {
-			audit_log_format(ab, " osid=%u", n->osid);
-			if (call_panic)
-				*call_panic = 2;
-		} else {
-			audit_log_format(ab, " obj=%s", ctx);
-			security_release_secctx(ctx, len);
-		}
-	}
+	if (lsmblob_is_set(&n->oblob))
+		audit_log_object_context(ab, &n->oblob);
 
 	/* log the audit_names record type */
 	switch (n->type) {
@@ -1776,21 +1745,20 @@
 		struct audit_aux_data_pids *axs = (void *)aux;
 
 		for (i = 0; i < axs->pid_count; i++)
-			if (audit_log_pid_context(context, axs->target_pid[i],
-						  axs->target_auid[i],
-						  axs->target_uid[i],
-						  axs->target_sessionid[i],
-						  axs->target_sid[i],
-						  axs->target_comm[i]))
-				call_panic = 1;
+			audit_log_pid_context(context, axs->target_pid[i],
+					      axs->target_auid[i],
+					      axs->target_uid[i],
+					      axs->target_sessionid[i],
+					      &axs->target_blob[i],
+					      axs->target_comm[i]);
 	}
 
-	if (context->target_pid &&
-	    audit_log_pid_context(context, context->target_pid,
-				  context->target_auid, context->target_uid,
-				  context->target_sessionid,
-				  context->target_sid, context->target_comm))
-			call_panic = 1;
+	if (context->target_pid)
+		audit_log_pid_context(context, context->target_pid,
+				      context->target_auid, context->target_uid,
+				      context->target_sessionid,
+				      &context->target_blob,
+				      context->target_comm);
 
 	if (context->pwd.dentry && context->pwd.mnt) {
 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
@@ -1921,7 +1889,7 @@
 
 	ctx->context = AUDIT_CTX_URING;
 	ctx->current_state = ctx->state;
-	ktime_get_coarse_real_ts64(&ctx->ctime);
+	ktime_get_coarse_real_ts64(&ctx->stamp.ctime);
 }
 
 /**
@@ -2043,7 +2011,7 @@
 	context->argv[3]    = a4;
 	context->context = AUDIT_CTX_SYSCALL;
 	context->current_state  = state;
-	ktime_get_coarse_real_ts64(&context->ctime);
+	ktime_get_coarse_real_ts64(&context->stamp.ctime);
 }
 
 /**
@@ -2278,7 +2246,7 @@
 	name->uid   = inode->i_uid;
 	name->gid   = inode->i_gid;
 	name->rdev  = inode->i_rdev;
-	security_inode_getsecid(inode, &name->osid);
+	security_inode_getlsmblob(inode, &name->oblob);
 	if (flags & AUDIT_INODE_NOEVAL) {
 		name->fcap_ver = -1;
 		return;
@@ -2514,21 +2482,17 @@
 /**
  * auditsc_get_stamp - get local copies of audit_context values
  * @ctx: audit_context for the task
- * @t: timespec64 to store time recorded in the audit_context
- * @serial: serial value that is recorded in the audit_context
+ * @stamp: timestamp to record
  *
  * Also sets the context as auditable.
  */
-int auditsc_get_stamp(struct audit_context *ctx,
-		       struct timespec64 *t, unsigned int *serial)
+int auditsc_get_stamp(struct audit_context *ctx, struct audit_stamp *stamp)
 {
 	if (ctx->context == AUDIT_CTX_UNUSED)
 		return 0;
-	if (!ctx->serial)
-		ctx->serial = audit_serial();
-	t->tv_sec  = ctx->ctime.tv_sec;
-	t->tv_nsec = ctx->ctime.tv_nsec;
-	*serial    = ctx->serial;
+	if (!ctx->stamp.serial)
+		ctx->stamp.serial = audit_serial();
+	*stamp = ctx->stamp;
 	if (!ctx->prio) {
 		ctx->prio = 1;
 		ctx->current_state = AUDIT_STATE_RECORD;
@@ -2632,7 +2596,7 @@
 	context->ipc.gid = ipcp->gid;
 	context->ipc.mode = ipcp->mode;
 	context->ipc.has_perm = 0;
-	security_ipc_getsecid(ipcp, &context->ipc.osid);
+	security_ipc_getlsmblob(ipcp, &context->ipc.oblob);
 	context->type = AUDIT_IPC;
 }
 
@@ -2729,7 +2693,7 @@
 	context->target_auid = audit_get_loginuid(t);
 	context->target_uid = task_uid(t);
 	context->target_sessionid = audit_get_sessionid(t);
-	security_task_getsecid_obj(t, &context->target_sid);
+	security_task_getlsmblob_obj(t, &context->target_blob);
 	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
 }
 
@@ -2756,7 +2720,7 @@
 		ctx->target_auid = audit_get_loginuid(t);
 		ctx->target_uid = t_uid;
 		ctx->target_sessionid = audit_get_sessionid(t);
-		security_task_getsecid_obj(t, &ctx->target_sid);
+		security_task_getlsmblob_obj(t, &ctx->target_blob);
 		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
 		return 0;
 	}
@@ -2777,7 +2741,7 @@
 	axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
 	axp->target_uid[axp->pid_count] = t_uid;
 	axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
-	security_task_getsecid_obj(t, &axp->target_sid[axp->pid_count]);
+	security_task_getlsmblob_obj(t, &axp->target_blob[axp->pid_count]);
 	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
 	axp->pid_count++;
 
--- linux-qcom-6.8.0.orig/kernel/bounds.c
+++ linux-qcom-6.8.0/kernel/bounds.c
@@ -19,7 +19,7 @@
 	DEFINE(NR_PAGEFLAGS, __NR_PAGEFLAGS);
 	DEFINE(MAX_NR_ZONES, __MAX_NR_ZONES);
 #ifdef CONFIG_SMP
-	DEFINE(NR_CPUS_BITS, ilog2(CONFIG_NR_CPUS));
+	DEFINE(NR_CPUS_BITS, order_base_2(CONFIG_NR_CPUS));
 #endif
 	DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t));
 #ifdef CONFIG_LRU_GEN
--- linux-qcom-6.8.0.orig/kernel/bpf/Makefile
+++ linux-qcom-6.8.0/kernel/bpf/Makefile
@@ -4,7 +4,7 @@
 # ___bpf_prog_run() needs GCSE disabled on x86; see 3193c0836f203 for details
 cflags-nogcse-$(CONFIG_X86)$(CONFIG_CC_IS_GCC) := -fno-gcse
 endif
-CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy)
+CFLAGS_core.o += -Wno-override-init $(cflags-nogcse-yy)
 
 obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o
 obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o
--- linux-qcom-6.8.0.orig/kernel/bpf/arraymap.c
+++ linux-qcom-6.8.0/kernel/bpf/arraymap.c
@@ -73,6 +73,9 @@
 	/* avoid overflow on round_up(map->value_size) */
 	if (attr->value_size > INT_MAX)
 		return -E2BIG;
+	/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */
+	if (percpu && round_up(attr->value_size, 8) > PCPU_MIN_UNIT_SIZE)
+		return -E2BIG;
 
 	return 0;
 }
@@ -906,22 +909,44 @@
 				   struct file *map_file, int fd)
 {
 	struct bpf_prog *prog = bpf_prog_get(fd);
+	bool is_extended;
 
 	if (IS_ERR(prog))
 		return prog;
 
-	if (!bpf_prog_map_compatible(map, prog)) {
+	if (prog->type == BPF_PROG_TYPE_EXT ||
+	    !bpf_prog_map_compatible(map, prog)) {
 		bpf_prog_put(prog);
 		return ERR_PTR(-EINVAL);
 	}
 
+	mutex_lock(&prog->aux->ext_mutex);
+	is_extended = prog->aux->is_extended;
+	if (!is_extended)
+		prog->aux->prog_array_member_cnt++;
+	mutex_unlock(&prog->aux->ext_mutex);
+	if (is_extended) {
+		/* Extended prog can not be tail callee. It's to prevent a
+		 * potential infinite loop like:
+		 * tail callee prog entry -> tail callee prog subprog ->
+		 * freplace prog entry --tailcall-> tail callee prog entry.
+		 */
+		bpf_prog_put(prog);
+		return ERR_PTR(-EBUSY);
+	}
+
 	return prog;
 }
 
 static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
 {
+	struct bpf_prog *prog = ptr;
+
+	mutex_lock(&prog->aux->ext_mutex);
+	prog->aux->prog_array_member_cnt--;
+	mutex_unlock(&prog->aux->ext_mutex);
 	/* bpf_prog is freed after one RCU or tasks trace grace period */
-	bpf_prog_put(ptr);
+	bpf_prog_put(prog);
 }
 
 static u32 prog_fd_array_sys_lookup_elem(void *ptr)
--- linux-qcom-6.8.0.orig/kernel/bpf/bloom_filter.c
+++ linux-qcom-6.8.0/kernel/bpf/bloom_filter.c
@@ -80,6 +80,18 @@
 	return -EOPNOTSUPP;
 }
 
+/* Called from syscall */
+static int bloom_map_alloc_check(union bpf_attr *attr)
+{
+	if (attr->value_size > KMALLOC_MAX_SIZE)
+		/* if value_size is bigger, the user space won't be able to
+		 * access the elements.
+		 */
+		return -E2BIG;
+
+	return 0;
+}
+
 static struct bpf_map *bloom_map_alloc(union bpf_attr *attr)
 {
 	u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits;
@@ -191,6 +203,7 @@
 BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter)
 const struct bpf_map_ops bloom_filter_map_ops = {
 	.map_meta_equal = bpf_map_meta_equal,
+	.map_alloc_check = bloom_map_alloc_check,
 	.map_alloc = bloom_map_alloc,
 	.map_free = bloom_map_free,
 	.map_get_next_key = bloom_map_get_next_key,
--- linux-qcom-6.8.0.orig/kernel/bpf/bpf_local_storage.c
+++ linux-qcom-6.8.0/kernel/bpf/bpf_local_storage.c
@@ -808,8 +808,8 @@
 	nbuckets = max_t(u32, 2, nbuckets);
 	smap->bucket_log = ilog2(nbuckets);
 
-	smap->buckets = bpf_map_kvcalloc(&smap->map, sizeof(*smap->buckets),
-					 nbuckets, GFP_USER | __GFP_NOWARN);
+	smap->buckets = bpf_map_kvcalloc(&smap->map, nbuckets,
+					 sizeof(*smap->buckets), GFP_USER | __GFP_NOWARN);
 	if (!smap->buckets) {
 		err = -ENOMEM;
 		goto free_smap;
--- linux-qcom-6.8.0.orig/kernel/bpf/bpf_lsm.c
+++ linux-qcom-6.8.0/kernel/bpf/bpf_lsm.c
@@ -11,7 +11,6 @@
 #include <linux/lsm_hooks.h>
 #include <linux/bpf_lsm.h>
 #include <linux/kallsyms.h>
-#include <linux/bpf_verifier.h>
 #include <net/bpf_sk_storage.h>
 #include <linux/bpf_local_storage.h>
 #include <linux/btf_ids.h>
@@ -386,3 +385,36 @@
 	.get_func_proto = bpf_lsm_func_proto,
 	.is_valid_access = btf_ctx_access,
 };
+
+/* hooks return 0 or 1 */
+BTF_SET_START(bool_lsm_hooks)
+#ifdef CONFIG_SECURITY_NETWORK_XFRM
+BTF_ID(func, bpf_lsm_xfrm_state_pol_flow_match)
+#endif
+#ifdef CONFIG_AUDIT
+BTF_ID(func, bpf_lsm_audit_rule_known)
+#endif
+BTF_ID(func, bpf_lsm_inode_xattr_skipcap)
+BTF_SET_END(bool_lsm_hooks)
+
+int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
+			     struct bpf_retval_range *retval_range)
+{
+	/* no return value range for void hooks */
+	if (!prog->aux->attach_func_proto->type)
+		return -EINVAL;
+
+	if (btf_id_set_contains(&bool_lsm_hooks, prog->aux->attach_btf_id)) {
+		retval_range->minval = 0;
+		retval_range->maxval = 1;
+	} else {
+		/* All other available LSM hooks, except task_prctl, return 0
+		 * on success and negative error code on failure.
+		 * To keep things simple, we only allow bpf progs to return 0
+		 * or negative errno for task_prctl too.
+		 */
+		retval_range->minval = -MAX_ERRNO;
+		retval_range->maxval = 0;
+	}
+	return 0;
+}
--- linux-qcom-6.8.0.orig/kernel/bpf/btf.c
+++ linux-qcom-6.8.0/kernel/bpf/btf.c
@@ -405,7 +405,7 @@
 struct btf_show {
 	u64 flags;
 	void *target;	/* target of show operation (seq file, buffer) */
-	void (*showfn)(struct btf_show *show, const char *fmt, va_list args);
+	__printf(2, 0) void (*showfn)(struct btf_show *show, const char *fmt, va_list args);
 	const struct btf *btf;
 	/* below are used during iteration */
 	struct {
@@ -6131,8 +6131,11 @@
 
 	if (arg == nr_args) {
 		switch (prog->expected_attach_type) {
-		case BPF_LSM_CGROUP:
 		case BPF_LSM_MAC:
+			/* mark we are accessing the return value */
+			info->is_retval = true;
+			fallthrough;
+		case BPF_LSM_CGROUP:
 		case BPF_TRACE_FEXIT:
 			/* When LSM programs are attached to void LSM hooks
 			 * they use FEXIT trampolines and when attached to
@@ -6193,6 +6196,12 @@
 		return false;
 	}
 
+	if (size != sizeof(u64)) {
+		bpf_log(log, "func '%s' size %d must be 8\n",
+			tname, size);
+		return false;
+	}
+
 	/* check for PTR_TO_RDONLY_BUF_OR_NULL or PTR_TO_RDWR_BUF_OR_NULL */
 	for (i = 0; i < prog->aux->ctx_arg_info_size; i++) {
 		const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i];
@@ -7009,6 +7018,8 @@
 	args = (const struct btf_param *)(t + 1);
 	nargs = btf_type_vlen(t);
 	if (nargs > MAX_BPF_FUNC_REG_ARGS) {
+		if (!is_global)
+			return -EINVAL;
 		bpf_log(log, "Global function %s() with %d > %d args. Buggy compiler.\n",
 			tname, nargs, MAX_BPF_FUNC_REG_ARGS);
 		return -EINVAL;
@@ -7018,6 +7029,8 @@
 	while (btf_type_is_modifier(t))
 		t = btf_type_by_id(btf, t->type);
 	if (!btf_type_is_int(t) && !btf_is_any_enum(t)) {
+		if (!is_global)
+			return -EINVAL;
 		bpf_log(log,
 			"Global function %s() doesn't return scalar. Only those are supported.\n",
 			tname);
@@ -7058,10 +7071,6 @@
 
 		while (btf_type_is_modifier(t))
 			t = btf_type_by_id(btf, t->type);
-		if (btf_type_is_int(t) || btf_is_any_enum(t)) {
-			sub->args[i].arg_type = ARG_ANYTHING;
-			continue;
-		}
 		if (btf_type_is_ptr(t) && btf_get_prog_ctx_type(log, btf, t, prog_type, i)) {
 			sub->args[i].arg_type = ARG_PTR_TO_CTX;
 			continue;
@@ -7091,6 +7100,12 @@
 			bpf_log(log, "arg#%d marked as non-null, but is not a pointer type\n", i);
 			return -EINVAL;
 		}
+		if (btf_type_is_int(t) || btf_is_any_enum(t)) {
+			sub->args[i].arg_type = ARG_ANYTHING;
+			continue;
+		}
+		if (!is_global)
+			return -EINVAL;
 		bpf_log(log, "Arg#%d type %s in %s() is not supported yet.\n",
 			i, btf_type_str(t), tname);
 		return -EINVAL;
@@ -7131,8 +7146,8 @@
 	btf_type_ops(t)->show(btf, t, type_id, obj, 0, show);
 }
 
-static void btf_seq_show(struct btf_show *show, const char *fmt,
-			 va_list args)
+__printf(2, 0) static void btf_seq_show(struct btf_show *show, const char *fmt,
+					va_list args)
 {
 	seq_vprintf((struct seq_file *)show->target, fmt, args);
 }
@@ -7165,8 +7180,8 @@
 	int len;		/* length we would have written */
 };
 
-static void btf_snprintf_show(struct btf_show *show, const char *fmt,
-			      va_list args)
+__printf(2, 0) static void btf_snprintf_show(struct btf_show *show, const char *fmt,
+					     va_list args)
 {
 	struct btf_show_snprintf *ssnprintf = (struct btf_show_snprintf *)show;
 	int len;
@@ -8482,6 +8497,7 @@
 	struct bpf_core_cand_list cands = {};
 	struct bpf_core_relo_res targ_res;
 	struct bpf_core_spec *specs;
+	const struct btf_type *type;
 	int err;
 
 	/* ~4k of temp memory necessary to convert LLVM spec like "0:1:0:5"
@@ -8491,6 +8507,14 @@
 	if (!specs)
 		return -ENOMEM;
 
+	type = btf_type_by_id(ctx->btf, relo->type_id);
+	if (!type) {
+		bpf_log(ctx->log, "relo #%u: bad type id %u\n",
+			relo_idx, relo->type_id);
+		kfree(specs);
+		return -EINVAL;
+	}
+
 	if (need_cands) {
 		struct bpf_cand_cache *cc;
 		int i;
--- linux-qcom-6.8.0.orig/kernel/bpf/cgroup.c
+++ linux-qcom-6.8.0/kernel/bpf/cgroup.c
@@ -24,6 +24,23 @@
 DEFINE_STATIC_KEY_ARRAY_FALSE(cgroup_bpf_enabled_key, MAX_CGROUP_BPF_ATTACH_TYPE);
 EXPORT_SYMBOL(cgroup_bpf_enabled_key);
 
+/*
+ * cgroup bpf destruction makes heavy use of work items and there can be a lot
+ * of concurrent destructions.  Use a separate workqueue so that cgroup bpf
+ * destruction work items don't end up filling up max_active of system_wq
+ * which may lead to deadlock.
+ */
+static struct workqueue_struct *cgroup_bpf_destroy_wq;
+
+static int __init cgroup_bpf_wq_init(void)
+{
+	cgroup_bpf_destroy_wq = alloc_workqueue("cgroup_bpf_destroy", 0, 1);
+	if (!cgroup_bpf_destroy_wq)
+		panic("Failed to alloc workqueue for cgroup bpf destroy.\n");
+	return 0;
+}
+core_initcall(cgroup_bpf_wq_init);
+
 /* __always_inline is necessary to prevent indirect call through run_prog
  * function pointer.
  */
@@ -334,7 +351,7 @@
 	struct cgroup *cgrp = container_of(ref, struct cgroup, bpf.refcnt);
 
 	INIT_WORK(&cgrp->bpf.release_work, cgroup_bpf_release);
-	queue_work(system_wq, &cgrp->bpf.release_work);
+	queue_work(cgroup_bpf_destroy_wq, &cgrp->bpf.release_work);
 }
 
 /* Get underlying bpf_prog of bpf_prog_list entry, regardless if it's through
--- linux-qcom-6.8.0.orig/kernel/bpf/core.c
+++ linux-qcom-6.8.0/kernel/bpf/core.c
@@ -125,6 +125,7 @@
 	INIT_LIST_HEAD_RCU(&fp->aux->ksym_prefix.lnode);
 #endif
 	mutex_init(&fp->aux->used_maps_mutex);
+	mutex_init(&fp->aux->ext_mutex);
 	mutex_init(&fp->aux->dst_mutex);
 
 	return fp;
@@ -532,6 +533,8 @@
 
 int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt)
 {
+	int err;
+
 	/* Branch offsets can't overflow when program is shrinking, no need
 	 * to call bpf_adj_branches(..., true) here
 	 */
@@ -539,7 +542,9 @@
 		sizeof(struct bpf_insn) * (prog->len - off - cnt));
 	prog->len -= cnt;
 
-	return WARN_ON_ONCE(bpf_adj_branches(prog, off, off + cnt, off, false));
+	err = bpf_adj_branches(prog, off, off + cnt, off, false);
+	WARN_ON_ONCE(err);
+	return err;
 }
 
 static void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)
@@ -730,11 +735,11 @@
 	return n ? container_of(n, struct bpf_ksym, tnode) : NULL;
 }
 
-const char *__bpf_address_lookup(unsigned long addr, unsigned long *size,
+int __bpf_address_lookup(unsigned long addr, unsigned long *size,
 				 unsigned long *off, char *sym)
 {
 	struct bpf_ksym *ksym;
-	char *ret = NULL;
+	int ret = 0;
 
 	rcu_read_lock();
 	ksym = bpf_ksym_find(addr);
@@ -742,9 +747,8 @@
 		unsigned long symbol_start = ksym->start;
 		unsigned long symbol_end = ksym->end;
 
-		strncpy(sym, ksym->name, KSYM_NAME_LEN);
+		ret = strscpy(sym, ksym->name, KSYM_NAME_LEN);
 
-		ret = sym;
 		if (size)
 			*size = symbol_end - symbol_start;
 		if (off)
@@ -808,7 +812,7 @@
 		if (it++ != symnum)
 			continue;
 
-		strncpy(sym, ksym->name, KSYM_NAME_LEN);
+		strscpy(sym, ksym->name, KSYM_NAME_LEN);
 
 		*value = ksym->start;
 		*type  = BPF_SYM_ELF_TYPE;
@@ -888,7 +892,12 @@
  * CONFIG_MMU=n. Use PAGE_SIZE in these cases.
  */
 #ifdef PMD_SIZE
-#define BPF_PROG_PACK_SIZE (PMD_SIZE * num_possible_nodes())
+/* PMD_SIZE is really big for some archs. It doesn't make sense to
+ * reserve too much memory in one allocation. Hardcode BPF_PROG_PACK_SIZE to
+ * 2MiB * num_possible_nodes(). On most architectures PMD_SIZE will be
+ * greater than or equal to 2MB.
+ */
+#define BPF_PROG_PACK_SIZE (SZ_2M * num_possible_nodes())
 #else
 #define BPF_PROG_PACK_SIZE PAGE_SIZE
 #endif
@@ -2193,6 +2202,7 @@
 	u64 stack[stack_size / sizeof(u64)]; \
 	u64 regs[MAX_BPF_EXT_REG] = {}; \
 \
+	kmsan_unpoison_memory(stack, sizeof(stack)); \
 	FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \
 	ARG1 = (u64) (unsigned long) ctx; \
 	return ___bpf_prog_run(regs, insn); \
@@ -2206,6 +2216,7 @@
 	u64 stack[stack_size / sizeof(u64)]; \
 	u64 regs[MAX_BPF_EXT_REG]; \
 \
+	kmsan_unpoison_memory(stack, sizeof(stack)); \
 	FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \
 	BPF_R1 = r1; \
 	BPF_R2 = r2; \
@@ -2276,6 +2287,7 @@
 {
 	enum bpf_prog_type prog_type = resolve_prog_type(fp);
 	bool ret;
+	struct bpf_prog_aux *aux = fp->aux;
 
 	if (fp->kprobe_override)
 		return false;
@@ -2285,7 +2297,7 @@
 	 * in the case of devmap and cpumap). Until device checks
 	 * are implemented, prohibit adding dev-bound programs to program maps.
 	 */
-	if (bpf_prog_is_dev_bound(fp->aux))
+	if (bpf_prog_is_dev_bound(aux))
 		return false;
 
 	spin_lock(&map->owner.lock);
@@ -2295,12 +2307,26 @@
 		 */
 		map->owner.type  = prog_type;
 		map->owner.jited = fp->jited;
-		map->owner.xdp_has_frags = fp->aux->xdp_has_frags;
+		map->owner.xdp_has_frags = aux->xdp_has_frags;
+		map->owner.attach_func_proto = aux->attach_func_proto;
 		ret = true;
 	} else {
 		ret = map->owner.type  == prog_type &&
 		      map->owner.jited == fp->jited &&
-		      map->owner.xdp_has_frags == fp->aux->xdp_has_frags;
+		      map->owner.xdp_has_frags == aux->xdp_has_frags;
+		if (ret &&
+		    map->owner.attach_func_proto != aux->attach_func_proto) {
+			switch (prog_type) {
+			case BPF_PROG_TYPE_TRACING:
+			case BPF_PROG_TYPE_LSM:
+			case BPF_PROG_TYPE_EXT:
+			case BPF_PROG_TYPE_STRUCT_OPS:
+				ret = false;
+				break;
+			default:
+				break;
+			}
+		}
 	}
 	spin_unlock(&map->owner.lock);
 
@@ -2392,7 +2418,9 @@
 	}
 
 finalize:
-	bpf_prog_lock_ro(fp);
+	*err = bpf_prog_lock_ro(fp);
+	if (*err)
+		return fp;
 
 	/* The tail call compatibility check can only be done at
 	 * this late stage as we need to determine, if we deal
@@ -2891,7 +2919,7 @@
 {
 }
 
-bool __weak bpf_helper_changes_pkt_data(void *func)
+bool __weak bpf_helper_changes_pkt_data(enum bpf_func_id func_id)
 {
 	return false;
 }
--- linux-qcom-6.8.0.orig/kernel/bpf/cpumap.c
+++ linux-qcom-6.8.0/kernel/bpf/cpumap.c
@@ -262,6 +262,7 @@
 static int cpu_map_kthread_run(void *data)
 {
 	struct bpf_cpu_map_entry *rcpu = data;
+	unsigned long last_qs = jiffies;
 
 	complete(&rcpu->kthread_running);
 	set_current_state(TASK_INTERRUPTIBLE);
@@ -287,10 +288,12 @@
 			if (__ptr_ring_empty(rcpu->queue)) {
 				schedule();
 				sched = 1;
+				last_qs = jiffies;
 			} else {
 				__set_current_state(TASK_RUNNING);
 			}
 		} else {
+			rcu_softirq_qs_periodic(last_qs);
 			sched = cond_resched();
 		}
 
--- linux-qcom-6.8.0.orig/kernel/bpf/devmap.c
+++ linux-qcom-6.8.0/kernel/bpf/devmap.c
@@ -130,13 +130,14 @@
 	bpf_map_init_from_attr(&dtab->map, attr);
 
 	if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
-		dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries);
-
-		if (!dtab->n_buckets) /* Overflow check */
+		/* hash table size must be power of 2; roundup_pow_of_two() can
+		 * overflow into UB on 32-bit arches, so check that first
+		 */
+		if (dtab->map.max_entries > 1UL << 31)
 			return -EINVAL;
-	}
 
-	if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+		dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries);
+
 		dtab->dev_index_head = dev_map_create_hash(dtab->n_buckets,
 							   dtab->map.numa_node);
 		if (!dtab->dev_index_head)
@@ -179,7 +180,7 @@
 static void dev_map_free(struct bpf_map *map)
 {
 	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
-	int i;
+	u32 i;
 
 	/* At this point bpf_prog->aux->refcnt == 0 and this map->refcnt == 0,
 	 * so the programs (can be more than one that used this map) were
@@ -321,9 +322,11 @@
 
 static int dev_map_bpf_prog_run(struct bpf_prog *xdp_prog,
 				struct xdp_frame **frames, int n,
-				struct net_device *dev)
+				struct net_device *tx_dev,
+				struct net_device *rx_dev)
 {
-	struct xdp_txq_info txq = { .dev = dev };
+	struct xdp_txq_info txq = { .dev = tx_dev };
+	struct xdp_rxq_info rxq = { .dev = rx_dev };
 	struct xdp_buff xdp;
 	int i, nframes = 0;
 
@@ -334,6 +337,7 @@
 
 		xdp_convert_frame_to_buff(xdpf, &xdp);
 		xdp.txq = &txq;
+		xdp.rxq = &rxq;
 
 		act = bpf_prog_run_xdp(xdp_prog, &xdp);
 		switch (act) {
@@ -348,7 +352,7 @@
 			bpf_warn_invalid_xdp_action(NULL, xdp_prog, act);
 			fallthrough;
 		case XDP_ABORTED:
-			trace_xdp_exception(dev, xdp_prog, act);
+			trace_xdp_exception(tx_dev, xdp_prog, act);
 			fallthrough;
 		case XDP_DROP:
 			xdp_return_frame_rx_napi(xdpf);
@@ -376,7 +380,7 @@
 	}
 
 	if (bq->xdp_prog) {
-		to_send = dev_map_bpf_prog_run(bq->xdp_prog, bq->q, cnt, dev);
+		to_send = dev_map_bpf_prog_run(bq->xdp_prog, bq->q, cnt, dev, bq->dev_rx);
 		if (!to_send)
 			goto out;
 	}
@@ -819,7 +823,7 @@
 {
 	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
 	struct bpf_dtab_netdev *old_dev;
-	int k = *(u32 *)key;
+	u32 k = *(u32 *)key;
 
 	if (k >= map->max_entries)
 		return -EINVAL;
@@ -836,7 +840,7 @@
 {
 	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
 	struct bpf_dtab_netdev *old_dev;
-	int k = *(u32 *)key;
+	u32 k = *(u32 *)key;
 	unsigned long flags;
 	int ret = -ENOENT;
 
--- linux-qcom-6.8.0.orig/kernel/bpf/hashtab.c
+++ linux-qcom-6.8.0/kernel/bpf/hashtab.c
@@ -459,6 +459,9 @@
 		 * kmalloc-able later in htab_map_update_elem()
 		 */
 		return -E2BIG;
+	/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */
+	if (percpu && round_up(attr->value_size, 8) > PCPU_MIN_UNIT_SIZE)
+		return -E2BIG;
 
 	return 0;
 }
@@ -499,7 +502,13 @@
 							  num_possible_cpus());
 	}
 
-	/* hash table size must be power of 2 */
+	/* hash table size must be power of 2; roundup_pow_of_two() can overflow
+	 * into UB on 32-bit arches, so check that first
+	 */
+	err = -E2BIG;
+	if (htab->map.max_entries > 1UL << 31)
+		goto free_htab;
+
 	htab->n_buckets = roundup_pow_of_two(htab->map.max_entries);
 
 	htab->elem_size = sizeof(struct htab_elem) +
@@ -509,10 +518,8 @@
 	else
 		htab->elem_size += round_up(htab->map.value_size, 8);
 
-	err = -E2BIG;
-	/* prevent zero size kmalloc and check for u32 overflow */
-	if (htab->n_buckets == 0 ||
-	    htab->n_buckets > U32_MAX / sizeof(struct bucket))
+	/* check for u32 overflow */
+	if (htab->n_buckets > U32_MAX / sizeof(struct bucket))
 		goto free_htab;
 
 	err = bpf_map_init_elem_count(&htab->map);
@@ -886,9 +893,12 @@
 static void htab_elem_free(struct bpf_htab *htab, struct htab_elem *l)
 {
 	check_and_free_fields(htab, l);
+
+	migrate_disable();
 	if (htab->map.map_type == BPF_MAP_TYPE_PERCPU_HASH)
 		bpf_mem_cache_free(&htab->pcpu_ma, l->ptr_to_pptr);
 	bpf_mem_cache_free(&htab->ma, l);
+	migrate_enable();
 }
 
 static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
@@ -938,7 +948,7 @@
 	if (htab_is_prealloc(htab)) {
 		bpf_map_dec_elem_count(&htab->map);
 		check_and_free_fields(htab, l);
-		__pcpu_freelist_push(&htab->freelist, &l->fnode);
+		pcpu_freelist_push(&htab->freelist, &l->fnode);
 	} else {
 		dec_elem_count(htab);
 		htab_elem_free(htab, l);
@@ -1008,7 +1018,6 @@
 			 */
 			pl_new = this_cpu_ptr(htab->extra_elems);
 			l_new = *pl_new;
-			htab_put_fd_value(htab, old_elem);
 			*pl_new = old_elem;
 		} else {
 			struct pcpu_freelist_node *l;
@@ -1094,6 +1103,7 @@
 	struct htab_elem *l_new = NULL, *l_old;
 	struct hlist_nulls_head *head;
 	unsigned long flags;
+	void *old_map_ptr;
 	struct bucket *b;
 	u32 key_size, hash;
 	int ret;
@@ -1172,12 +1182,27 @@
 	hlist_nulls_add_head_rcu(&l_new->hash_node, head);
 	if (l_old) {
 		hlist_nulls_del_rcu(&l_old->hash_node);
+
+		/* l_old has already been stashed in htab->extra_elems, free
+		 * its special fields before it is available for reuse. Also
+		 * save the old map pointer in htab of maps before unlock
+		 * and release it after unlock.
+		 */
+		old_map_ptr = NULL;
+		if (htab_is_prealloc(htab)) {
+			if (map->ops->map_fd_put_ptr)
+				old_map_ptr = fd_htab_map_get_ptr(map, l_old);
+			check_and_free_fields(htab, l_old);
+		}
+	}
+	htab_unlock_bucket(htab, b, hash, flags);
+	if (l_old) {
+		if (old_map_ptr)
+			map->ops->map_fd_put_ptr(map, old_map_ptr, true);
 		if (!htab_is_prealloc(htab))
 			free_htab_elem(htab, l_old);
-		else
-			check_and_free_fields(htab, l_old);
 	}
-	ret = 0;
+	return 0;
 err:
 	htab_unlock_bucket(htab, b, hash, flags);
 	return ret;
@@ -1421,15 +1446,15 @@
 		return ret;
 
 	l = lookup_elem_raw(head, hash, key, key_size);
-
-	if (l) {
+	if (l)
 		hlist_nulls_del_rcu(&l->hash_node);
-		free_htab_elem(htab, l);
-	} else {
+	else
 		ret = -ENOENT;
-	}
 
 	htab_unlock_bucket(htab, b, hash, flags);
+
+	if (l)
+		free_htab_elem(htab, l);
 	return ret;
 }
 
@@ -1836,13 +1861,14 @@
 			 * may cause deadlock. See comments in function
 			 * prealloc_lru_pop(). Let us do bpf_lru_push_free()
 			 * after releasing the bucket lock.
+			 *
+			 * For htab of maps, htab_put_fd_value() in
+			 * free_htab_elem() may acquire a spinlock with bucket
+			 * lock being held and it violates the lock rule, so
+			 * invoke free_htab_elem() after unlock as well.
 			 */
-			if (is_lru_map) {
-				l->batch_flink = node_to_free;
-				node_to_free = l;
-			} else {
-				free_htab_elem(htab, l);
-			}
+			l->batch_flink = node_to_free;
+			node_to_free = l;
 		}
 		dst_key += key_size;
 		dst_val += value_size;
@@ -1854,7 +1880,10 @@
 	while (node_to_free) {
 		l = node_to_free;
 		node_to_free = node_to_free->batch_flink;
-		htab_lru_push_free(htab, l);
+		if (is_lru_map)
+			htab_lru_push_free(htab, l);
+		else
+			free_htab_elem(htab, l);
 	}
 
 next_batch:
--- linux-qcom-6.8.0.orig/kernel/bpf/helpers.c
+++ linux-qcom-6.8.0/kernel/bpf/helpers.c
@@ -111,7 +111,7 @@
 	.gpl_only	= false,
 	.ret_type	= RET_INTEGER,
 	.arg1_type	= ARG_CONST_MAP_PTR,
-	.arg2_type	= ARG_PTR_TO_MAP_VALUE | MEM_UNINIT,
+	.arg2_type	= ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE,
 };
 
 BPF_CALL_2(bpf_map_peek_elem, struct bpf_map *, map, void *, value)
@@ -124,7 +124,7 @@
 	.gpl_only	= false,
 	.ret_type	= RET_INTEGER,
 	.arg1_type	= ARG_CONST_MAP_PTR,
-	.arg2_type	= ARG_PTR_TO_MAP_VALUE | MEM_UNINIT,
+	.arg2_type	= ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE,
 };
 
 BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu)
@@ -334,7 +334,7 @@
 	__this_cpu_write(irqsave_flags, flags);
 }
 
-notrace BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
+NOTRACE_BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
 {
 	__bpf_spin_lock_irqsave(lock);
 	return 0;
@@ -357,7 +357,7 @@
 	local_irq_restore(flags);
 }
 
-notrace BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
+NOTRACE_BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
 {
 	__bpf_spin_unlock_irqrestore(lock);
 	return 0;
@@ -517,11 +517,12 @@
 }
 
 BPF_CALL_4(bpf_strtol, const char *, buf, size_t, buf_len, u64, flags,
-	   long *, res)
+	   s64 *, res)
 {
 	long long _res;
 	int err;
 
+	*res = 0;
 	err = __bpf_strtoll(buf, buf_len, flags, &_res);
 	if (err < 0)
 		return err;
@@ -538,16 +539,18 @@
 	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
 	.arg2_type	= ARG_CONST_SIZE,
 	.arg3_type	= ARG_ANYTHING,
-	.arg4_type	= ARG_PTR_TO_LONG,
+	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,
+	.arg4_size	= sizeof(s64),
 };
 
 BPF_CALL_4(bpf_strtoul, const char *, buf, size_t, buf_len, u64, flags,
-	   unsigned long *, res)
+	   u64 *, res)
 {
 	unsigned long long _res;
 	bool is_negative;
 	int err;
 
+	*res = 0;
 	err = __bpf_strtoull(buf, buf_len, flags, &_res, &is_negative);
 	if (err < 0)
 		return err;
@@ -566,7 +569,8 @@
 	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
 	.arg2_type	= ARG_CONST_SIZE,
 	.arg3_type	= ARG_ANYTHING,
-	.arg4_type	= ARG_PTR_TO_LONG,
+	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,
+	.arg4_size	= sizeof(u64),
 };
 
 BPF_CALL_3(bpf_strncmp, const char *, s1, u32, s1_sz, const char *, s2)
@@ -1079,11 +1083,23 @@
 	.arg5_type	= ARG_CONST_SIZE_OR_ZERO,
 };
 
+struct bpf_async_cb {
+	struct bpf_map *map;
+	struct bpf_prog *prog;
+	void __rcu *callback_fn;
+	void *value;
+	union {
+		struct rcu_head rcu;
+		struct work_struct delete_work;
+	};
+	u64 flags;
+};
+
 /* BPF map elements can contain 'struct bpf_timer'.
  * Such map owns all of its BPF timers.
  * 'struct bpf_timer' is allocated as part of map element allocation
  * and it's zero initialized.
- * That space is used to keep 'struct bpf_timer_kern'.
+ * That space is used to keep 'struct bpf_async_kern'.
  * bpf_timer_init() allocates 'struct bpf_hrtimer', inits hrtimer, and
  * remembers 'struct bpf_map *' pointer it's part of.
  * bpf_timer_set_callback() increments prog refcnt and assign bpf callback_fn.
@@ -1096,17 +1112,17 @@
  * freeing the timers when inner map is replaced or deleted by user space.
  */
 struct bpf_hrtimer {
+	struct bpf_async_cb cb;
 	struct hrtimer timer;
-	struct bpf_map *map;
-	struct bpf_prog *prog;
-	void __rcu *callback_fn;
-	void *value;
-	struct rcu_head rcu;
+	atomic_t cancelling;
 };
 
 /* the actual struct hidden inside uapi struct bpf_timer */
-struct bpf_timer_kern {
-	struct bpf_hrtimer *timer;
+struct bpf_async_kern {
+	union {
+		struct bpf_async_cb *cb;
+		struct bpf_hrtimer *timer;
+	};
 	/* bpf_spin_lock is used here instead of spinlock_t to make
 	 * sure that it always fits into space reserved by struct bpf_timer
 	 * regardless of LOCKDEP and spinlock debug flags.
@@ -1114,19 +1130,23 @@
 	struct bpf_spin_lock lock;
 } __attribute__((aligned(8)));
 
+enum bpf_async_type {
+	BPF_ASYNC_TYPE_TIMER = 0,
+};
+
 static DEFINE_PER_CPU(struct bpf_hrtimer *, hrtimer_running);
 
 static enum hrtimer_restart bpf_timer_cb(struct hrtimer *hrtimer)
 {
 	struct bpf_hrtimer *t = container_of(hrtimer, struct bpf_hrtimer, timer);
-	struct bpf_map *map = t->map;
-	void *value = t->value;
+	struct bpf_map *map = t->cb.map;
+	void *value = t->cb.value;
 	bpf_callback_t callback_fn;
 	void *key;
 	u32 idx;
 
 	BTF_TYPE_EMIT(struct bpf_timer);
-	callback_fn = rcu_dereference_check(t->callback_fn, rcu_read_lock_bh_held());
+	callback_fn = rcu_dereference_check(t->cb.callback_fn, rcu_read_lock_bh_held());
 	if (!callback_fn)
 		goto out;
 
@@ -1155,46 +1175,72 @@
 	return HRTIMER_NORESTART;
 }
 
-BPF_CALL_3(bpf_timer_init, struct bpf_timer_kern *, timer, struct bpf_map *, map,
-	   u64, flags)
+static void bpf_timer_delete_work(struct work_struct *work)
 {
-	clockid_t clockid = flags & (MAX_CLOCKS - 1);
+	struct bpf_hrtimer *t = container_of(work, struct bpf_hrtimer, cb.delete_work);
+
+	/* Cancel the timer and wait for callback to complete if it was running.
+	 * If hrtimer_cancel() can be safely called it's safe to call
+	 * kfree_rcu(t) right after for both preallocated and non-preallocated
+	 * maps.  The async->cb = NULL was already done and no code path can see
+	 * address 't' anymore. Timer if armed for existing bpf_hrtimer before
+	 * bpf_timer_cancel_and_free will have been cancelled.
+	 */
+	hrtimer_cancel(&t->timer);
+	kfree_rcu(t, cb.rcu);
+}
+
+static int __bpf_async_init(struct bpf_async_kern *async, struct bpf_map *map, u64 flags,
+			    enum bpf_async_type type)
+{
+	struct bpf_async_cb *cb;
 	struct bpf_hrtimer *t;
+	clockid_t clockid;
+	size_t size;
 	int ret = 0;
 
-	BUILD_BUG_ON(MAX_CLOCKS != 16);
-	BUILD_BUG_ON(sizeof(struct bpf_timer_kern) > sizeof(struct bpf_timer));
-	BUILD_BUG_ON(__alignof__(struct bpf_timer_kern) != __alignof__(struct bpf_timer));
-
 	if (in_nmi())
 		return -EOPNOTSUPP;
 
-	if (flags >= MAX_CLOCKS ||
-	    /* similar to timerfd except _ALARM variants are not supported */
-	    (clockid != CLOCK_MONOTONIC &&
-	     clockid != CLOCK_REALTIME &&
-	     clockid != CLOCK_BOOTTIME))
+	switch (type) {
+	case BPF_ASYNC_TYPE_TIMER:
+		size = sizeof(struct bpf_hrtimer);
+		break;
+	default:
 		return -EINVAL;
-	__bpf_spin_lock_irqsave(&timer->lock);
-	t = timer->timer;
+	}
+
+	__bpf_spin_lock_irqsave(&async->lock);
+	t = async->timer;
 	if (t) {
 		ret = -EBUSY;
 		goto out;
 	}
+
 	/* allocate hrtimer via map_kmalloc to use memcg accounting */
-	t = bpf_map_kmalloc_node(map, sizeof(*t), GFP_ATOMIC, map->numa_node);
-	if (!t) {
+	cb = bpf_map_kmalloc_node(map, size, GFP_ATOMIC, map->numa_node);
+	if (!cb) {
 		ret = -ENOMEM;
 		goto out;
 	}
-	t->value = (void *)timer - map->record->timer_off;
-	t->map = map;
-	t->prog = NULL;
-	rcu_assign_pointer(t->callback_fn, NULL);
-	hrtimer_init(&t->timer, clockid, HRTIMER_MODE_REL_SOFT);
-	t->timer.function = bpf_timer_cb;
-	WRITE_ONCE(timer->timer, t);
-	/* Guarantee the order between timer->timer and map->usercnt. So
+
+	if (type == BPF_ASYNC_TYPE_TIMER) {
+		clockid = flags & (MAX_CLOCKS - 1);
+		t = (struct bpf_hrtimer *)cb;
+
+		atomic_set(&t->cancelling, 0);
+		INIT_WORK(&t->cb.delete_work, bpf_timer_delete_work);
+		hrtimer_init(&t->timer, clockid, HRTIMER_MODE_REL_SOFT);
+		t->timer.function = bpf_timer_cb;
+		cb->value = (void *)async - map->record->timer_off;
+	}
+	cb->map = map;
+	cb->prog = NULL;
+	cb->flags = flags;
+	rcu_assign_pointer(cb->callback_fn, NULL);
+
+	WRITE_ONCE(async->cb, cb);
+	/* Guarantee the order between async->cb and map->usercnt. So
 	 * when there are concurrent uref release and bpf timer init, either
 	 * bpf_timer_cancel_and_free() called by uref release reads a no-NULL
 	 * timer or atomic64_read() below returns a zero usercnt.
@@ -1204,15 +1250,34 @@
 		/* maps with timers must be either held by user space
 		 * or pinned in bpffs.
 		 */
-		WRITE_ONCE(timer->timer, NULL);
-		kfree(t);
+		WRITE_ONCE(async->cb, NULL);
+		kfree(cb);
 		ret = -EPERM;
 	}
 out:
-	__bpf_spin_unlock_irqrestore(&timer->lock);
+	__bpf_spin_unlock_irqrestore(&async->lock);
 	return ret;
 }
 
+BPF_CALL_3(bpf_timer_init, struct bpf_async_kern *, timer, struct bpf_map *, map,
+	   u64, flags)
+{
+	clock_t clockid = flags & (MAX_CLOCKS - 1);
+
+	BUILD_BUG_ON(MAX_CLOCKS != 16);
+	BUILD_BUG_ON(sizeof(struct bpf_async_kern) > sizeof(struct bpf_timer));
+	BUILD_BUG_ON(__alignof__(struct bpf_async_kern) != __alignof__(struct bpf_timer));
+
+	if (flags >= MAX_CLOCKS ||
+	    /* similar to timerfd except _ALARM variants are not supported */
+	    (clockid != CLOCK_MONOTONIC &&
+	     clockid != CLOCK_REALTIME &&
+	     clockid != CLOCK_BOOTTIME))
+		return -EINVAL;
+
+	return __bpf_async_init(timer, map, flags, BPF_ASYNC_TYPE_TIMER);
+}
+
 static const struct bpf_func_proto bpf_timer_init_proto = {
 	.func		= bpf_timer_init,
 	.gpl_only	= true,
@@ -1222,7 +1287,7 @@
 	.arg3_type	= ARG_ANYTHING,
 };
 
-BPF_CALL_3(bpf_timer_set_callback, struct bpf_timer_kern *, timer, void *, callback_fn,
+BPF_CALL_3(bpf_timer_set_callback, struct bpf_async_kern *, timer, void *, callback_fn,
 	   struct bpf_prog_aux *, aux)
 {
 	struct bpf_prog *prev, *prog = aux->prog;
@@ -1237,7 +1302,7 @@
 		ret = -EINVAL;
 		goto out;
 	}
-	if (!atomic64_read(&t->map->usercnt)) {
+	if (!atomic64_read(&t->cb.map->usercnt)) {
 		/* maps with timers must be either held by user space
 		 * or pinned in bpffs. Otherwise timer might still be
 		 * running even when bpf prog is detached and user space
@@ -1246,7 +1311,7 @@
 		ret = -EPERM;
 		goto out;
 	}
-	prev = t->prog;
+	prev = t->cb.prog;
 	if (prev != prog) {
 		/* Bump prog refcnt once. Every bpf_timer_set_callback()
 		 * can pick different callback_fn-s within the same prog.
@@ -1259,9 +1324,9 @@
 		if (prev)
 			/* Drop prev prog refcnt when swapping with new prog */
 			bpf_prog_put(prev);
-		t->prog = prog;
+		t->cb.prog = prog;
 	}
-	rcu_assign_pointer(t->callback_fn, callback_fn);
+	rcu_assign_pointer(t->cb.callback_fn, callback_fn);
 out:
 	__bpf_spin_unlock_irqrestore(&timer->lock);
 	return ret;
@@ -1275,7 +1340,7 @@
 	.arg2_type	= ARG_PTR_TO_FUNC,
 };
 
-BPF_CALL_3(bpf_timer_start, struct bpf_timer_kern *, timer, u64, nsecs, u64, flags)
+BPF_CALL_3(bpf_timer_start, struct bpf_async_kern *, timer, u64, nsecs, u64, flags)
 {
 	struct bpf_hrtimer *t;
 	int ret = 0;
@@ -1287,7 +1352,7 @@
 		return -EINVAL;
 	__bpf_spin_lock_irqsave(&timer->lock);
 	t = timer->timer;
-	if (!t || !t->prog) {
+	if (!t || !t->cb.prog) {
 		ret = -EINVAL;
 		goto out;
 	}
@@ -1315,20 +1380,21 @@
 	.arg3_type	= ARG_ANYTHING,
 };
 
-static void drop_prog_refcnt(struct bpf_hrtimer *t)
+static void drop_prog_refcnt(struct bpf_async_cb *async)
 {
-	struct bpf_prog *prog = t->prog;
+	struct bpf_prog *prog = async->prog;
 
 	if (prog) {
 		bpf_prog_put(prog);
-		t->prog = NULL;
-		rcu_assign_pointer(t->callback_fn, NULL);
+		async->prog = NULL;
+		rcu_assign_pointer(async->callback_fn, NULL);
 	}
 }
 
-BPF_CALL_1(bpf_timer_cancel, struct bpf_timer_kern *, timer)
+BPF_CALL_1(bpf_timer_cancel, struct bpf_async_kern *, timer)
 {
-	struct bpf_hrtimer *t;
+	struct bpf_hrtimer *t, *cur_t;
+	bool inc = false;
 	int ret = 0;
 
 	if (in_nmi())
@@ -1340,21 +1406,50 @@
 		ret = -EINVAL;
 		goto out;
 	}
-	if (this_cpu_read(hrtimer_running) == t) {
+
+	cur_t = this_cpu_read(hrtimer_running);
+	if (cur_t == t) {
 		/* If bpf callback_fn is trying to bpf_timer_cancel()
 		 * its own timer the hrtimer_cancel() will deadlock
-		 * since it waits for callback_fn to finish
+		 * since it waits for callback_fn to finish.
 		 */
 		ret = -EDEADLK;
 		goto out;
 	}
-	drop_prog_refcnt(t);
+
+	/* Only account in-flight cancellations when invoked from a timer
+	 * callback, since we want to avoid waiting only if other _callbacks_
+	 * are waiting on us, to avoid introducing lockups. Non-callback paths
+	 * are ok, since nobody would synchronously wait for their completion.
+	 */
+	if (!cur_t)
+		goto drop;
+	atomic_inc(&t->cancelling);
+	/* Need full barrier after relaxed atomic_inc */
+	smp_mb__after_atomic();
+	inc = true;
+	if (atomic_read(&cur_t->cancelling)) {
+		/* We're cancelling timer t, while some other timer callback is
+		 * attempting to cancel us. In such a case, it might be possible
+		 * that timer t belongs to the other callback, or some other
+		 * callback waiting upon it (creating transitive dependencies
+		 * upon us), and we will enter a deadlock if we continue
+		 * cancelling and waiting for it synchronously, since it might
+		 * do the same. Bail!
+		 */
+		ret = -EDEADLK;
+		goto out;
+	}
+drop:
+	drop_prog_refcnt(&t->cb);
 out:
 	__bpf_spin_unlock_irqrestore(&timer->lock);
 	/* Cancel the timer and wait for associated callback to finish
 	 * if it was running.
 	 */
 	ret = ret ?: hrtimer_cancel(&t->timer);
+	if (inc)
+		atomic_dec(&t->cancelling);
 	rcu_read_unlock();
 	return ret;
 }
@@ -1371,7 +1466,7 @@
  */
 void bpf_timer_cancel_and_free(void *val)
 {
-	struct bpf_timer_kern *timer = val;
+	struct bpf_async_kern *timer = val;
 	struct bpf_hrtimer *t;
 
 	/* Performance optimization: read timer->timer without lock first. */
@@ -1383,7 +1478,7 @@
 	t = timer->timer;
 	if (!t)
 		goto out;
-	drop_prog_refcnt(t);
+	drop_prog_refcnt(&t->cb);
 	/* The subsequent bpf_timer_start/cancel() helpers won't be able to use
 	 * this timer, since it won't be initialized.
 	 */
@@ -1392,25 +1487,39 @@
 	__bpf_spin_unlock_irqrestore(&timer->lock);
 	if (!t)
 		return;
-	/* Cancel the timer and wait for callback to complete if it was running.
-	 * If hrtimer_cancel() can be safely called it's safe to call kfree(t)
-	 * right after for both preallocated and non-preallocated maps.
-	 * The timer->timer = NULL was already done and no code path can
-	 * see address 't' anymore.
-	 *
-	 * Check that bpf_map_delete/update_elem() wasn't called from timer
-	 * callback_fn. In such case don't call hrtimer_cancel() (since it will
-	 * deadlock) and don't call hrtimer_try_to_cancel() (since it will just
-	 * return -1). Though callback_fn is still running on this cpu it's
+	/* We check that bpf_map_delete/update_elem() was called from timer
+	 * callback_fn. In such case we don't call hrtimer_cancel() (since it
+	 * will deadlock) and don't call hrtimer_try_to_cancel() (since it will
+	 * just return -1). Though callback_fn is still running on this cpu it's
 	 * safe to do kfree(t) because bpf_timer_cb() read everything it needed
 	 * from 't'. The bpf subprog callback_fn won't be able to access 't',
 	 * since timer->timer = NULL was already done. The timer will be
 	 * effectively cancelled because bpf_timer_cb() will return
 	 * HRTIMER_NORESTART.
+	 *
+	 * However, it is possible the timer callback_fn calling us armed the
+	 * timer _before_ calling us, such that failing to cancel it here will
+	 * cause it to possibly use struct hrtimer after freeing bpf_hrtimer.
+	 * Therefore, we _need_ to cancel any outstanding timers before we do
+	 * kfree_rcu, even though no more timers can be armed.
+	 *
+	 * Moreover, we need to schedule work even if timer does not belong to
+	 * the calling callback_fn, as on two different CPUs, we can end up in a
+	 * situation where both sides run in parallel, try to cancel one
+	 * another, and we end up waiting on both sides in hrtimer_cancel
+	 * without making forward progress, since timer1 depends on time2
+	 * callback to finish, and vice versa.
+	 *
+	 *  CPU 1 (timer1_cb)			CPU 2 (timer2_cb)
+	 *  bpf_timer_cancel_and_free(timer2)	bpf_timer_cancel_and_free(timer1)
+	 *
+	 * To avoid these issues, punt to workqueue context when we are in a
+	 * timer callback.
 	 */
-	if (this_cpu_read(hrtimer_running) != t)
-		hrtimer_cancel(&t->timer);
-	kfree_rcu(t, rcu);
+	if (this_cpu_read(hrtimer_running))
+		queue_work(system_unbound_wq, &t->cb.delete_work);
+	else
+		bpf_timer_delete_work(&t->cb.delete_work);
 }
 
 BPF_CALL_2(bpf_kptr_xchg, void *, map_value, void *, ptr)
@@ -1535,7 +1644,7 @@
 	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
 	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
 	.arg3_type	= ARG_ANYTHING,
-	.arg4_type	= ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL | MEM_UNINIT,
+	.arg4_type	= ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL | MEM_UNINIT | MEM_WRITE,
 };
 
 BPF_CALL_5(bpf_dynptr_read, void *, dst, u32, len, const struct bpf_dynptr_kern *, src,
--- linux-qcom-6.8.0.orig/kernel/bpf/log.c
+++ linux-qcom-6.8.0/kernel/bpf/log.c
@@ -424,9 +424,9 @@
 
 	if (type & PTR_MAYBE_NULL) {
 		if (base_type(type) == PTR_TO_BTF_ID)
-			strncpy(postfix, "or_null_", 16);
+			strscpy(postfix, "or_null_", 16);
 		else
-			strncpy(postfix, "_or_null", 16);
+			strscpy(postfix, "_or_null", 16);
 	}
 
 	snprintf(prefix, sizeof(prefix), "%s%s%s%s%s%s%s",
@@ -645,8 +645,7 @@
 	if (t == SCALAR_VALUE && reg->precise)
 		verbose(env, "P");
 	if (t == SCALAR_VALUE && tnum_is_const(reg->var_off)) {
-		/* reg->off should be 0 for SCALAR_VALUE */
-		verbose_snum(env, reg->var_off.value + reg->off);
+		verbose_snum(env, reg->var_off.value);
 		return;
 	}
 
--- linux-qcom-6.8.0.orig/kernel/bpf/lpm_trie.c
+++ linux-qcom-6.8.0/kernel/bpf/lpm_trie.c
@@ -164,13 +164,13 @@
  */
 static size_t longest_prefix_match(const struct lpm_trie *trie,
 				   const struct lpm_trie_node *node,
-				   const struct bpf_lpm_trie_key *key)
+				   const struct bpf_lpm_trie_key_u8 *key)
 {
 	u32 limit = min(node->prefixlen, key->prefixlen);
 	u32 prefixlen = 0, i = 0;
 
 	BUILD_BUG_ON(offsetof(struct lpm_trie_node, data) % sizeof(u32));
-	BUILD_BUG_ON(offsetof(struct bpf_lpm_trie_key, data) % sizeof(u32));
+	BUILD_BUG_ON(offsetof(struct bpf_lpm_trie_key_u8, data) % sizeof(u32));
 
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && defined(CONFIG_64BIT)
 
@@ -229,7 +229,7 @@
 {
 	struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
 	struct lpm_trie_node *node, *found = NULL;
-	struct bpf_lpm_trie_key *key = _key;
+	struct bpf_lpm_trie_key_u8 *key = _key;
 
 	if (key->prefixlen > trie->max_prefixlen)
 		return NULL;
@@ -302,14 +302,25 @@
 	return node;
 }
 
+static int trie_check_add_elem(struct lpm_trie *trie, u64 flags)
+{
+	if (flags == BPF_EXIST)
+		return -ENOENT;
+	if (trie->n_entries == trie->map.max_entries)
+		return -ENOSPC;
+	trie->n_entries++;
+	return 0;
+}
+
 /* Called from syscall or from eBPF program */
 static long trie_update_elem(struct bpf_map *map,
 			     void *_key, void *value, u64 flags)
 {
 	struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
-	struct lpm_trie_node *node, *im_node = NULL, *new_node = NULL;
+	struct lpm_trie_node *node, *im_node, *new_node = NULL;
+	struct lpm_trie_node *free_node = NULL;
 	struct lpm_trie_node __rcu **slot;
-	struct bpf_lpm_trie_key *key = _key;
+	struct bpf_lpm_trie_key_u8 *key = _key;
 	unsigned long irq_flags;
 	unsigned int next_bit;
 	size_t matchlen = 0;
@@ -324,20 +335,12 @@
 	spin_lock_irqsave(&trie->lock, irq_flags);
 
 	/* Allocate and fill a new node */
-
-	if (trie->n_entries == trie->map.max_entries) {
-		ret = -ENOSPC;
-		goto out;
-	}
-
 	new_node = lpm_trie_node_alloc(trie, value);
 	if (!new_node) {
 		ret = -ENOMEM;
 		goto out;
 	}
 
-	trie->n_entries++;
-
 	new_node->prefixlen = key->prefixlen;
 	RCU_INIT_POINTER(new_node->child[0], NULL);
 	RCU_INIT_POINTER(new_node->child[1], NULL);
@@ -367,6 +370,10 @@
 	 * simply assign the @new_node to that slot and be done.
 	 */
 	if (!node) {
+		ret = trie_check_add_elem(trie, flags);
+		if (ret)
+			goto out;
+
 		rcu_assign_pointer(*slot, new_node);
 		goto out;
 	}
@@ -375,18 +382,30 @@
 	 * which already has the correct data array set.
 	 */
 	if (node->prefixlen == matchlen) {
+		if (!(node->flags & LPM_TREE_NODE_FLAG_IM)) {
+			if (flags == BPF_NOEXIST) {
+				ret = -EEXIST;
+				goto out;
+			}
+		} else {
+			ret = trie_check_add_elem(trie, flags);
+			if (ret)
+				goto out;
+		}
+
 		new_node->child[0] = node->child[0];
 		new_node->child[1] = node->child[1];
 
-		if (!(node->flags & LPM_TREE_NODE_FLAG_IM))
-			trie->n_entries--;
-
 		rcu_assign_pointer(*slot, new_node);
-		kfree_rcu(node, rcu);
+		free_node = node;
 
 		goto out;
 	}
 
+	ret = trie_check_add_elem(trie, flags);
+	if (ret)
+		goto out;
+
 	/* If the new node matches the prefix completely, it must be inserted
 	 * as an ancestor. Simply insert it between @node and *@slot.
 	 */
@@ -399,6 +418,7 @@
 
 	im_node = lpm_trie_node_alloc(trie, NULL);
 	if (!im_node) {
+		trie->n_entries--;
 		ret = -ENOMEM;
 		goto out;
 	}
@@ -420,15 +440,10 @@
 	rcu_assign_pointer(*slot, im_node);
 
 out:
-	if (ret) {
-		if (new_node)
-			trie->n_entries--;
-
+	if (ret)
 		kfree(new_node);
-		kfree(im_node);
-	}
-
 	spin_unlock_irqrestore(&trie->lock, irq_flags);
+	kfree_rcu(free_node, rcu);
 
 	return ret;
 }
@@ -437,7 +452,8 @@
 static long trie_delete_elem(struct bpf_map *map, void *_key)
 {
 	struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
-	struct bpf_lpm_trie_key *key = _key;
+	struct lpm_trie_node *free_node = NULL, *free_parent = NULL;
+	struct bpf_lpm_trie_key_u8 *key = _key;
 	struct lpm_trie_node __rcu **trim, **trim2;
 	struct lpm_trie_node *node, *parent;
 	unsigned long irq_flags;
@@ -506,8 +522,8 @@
 		else
 			rcu_assign_pointer(
 				*trim2, rcu_access_pointer(parent->child[0]));
-		kfree_rcu(parent, rcu);
-		kfree_rcu(node, rcu);
+		free_parent = parent;
+		free_node = node;
 		goto out;
 	}
 
@@ -521,10 +537,12 @@
 		rcu_assign_pointer(*trim, rcu_access_pointer(node->child[1]));
 	else
 		RCU_INIT_POINTER(*trim, NULL);
-	kfree_rcu(node, rcu);
+	free_node = node;
 
 out:
 	spin_unlock_irqrestore(&trie->lock, irq_flags);
+	kfree_rcu(free_parent, rcu);
+	kfree_rcu(free_node, rcu);
 
 	return ret;
 }
@@ -536,7 +554,7 @@
 				 sizeof(struct lpm_trie_node))
 #define LPM_VAL_SIZE_MIN	1
 
-#define LPM_KEY_SIZE(X)		(sizeof(struct bpf_lpm_trie_key) + (X))
+#define LPM_KEY_SIZE(X)		(sizeof(struct bpf_lpm_trie_key_u8) + (X))
 #define LPM_KEY_SIZE_MAX	LPM_KEY_SIZE(LPM_DATA_SIZE_MAX)
 #define LPM_KEY_SIZE_MIN	LPM_KEY_SIZE(LPM_DATA_SIZE_MIN)
 
@@ -565,7 +583,7 @@
 	/* copy mandatory map attributes */
 	bpf_map_init_from_attr(&trie->map, attr);
 	trie->data_size = attr->key_size -
-			  offsetof(struct bpf_lpm_trie_key, data);
+			  offsetof(struct bpf_lpm_trie_key_u8, data);
 	trie->max_prefixlen = trie->data_size * 8;
 
 	spin_lock_init(&trie->lock);
@@ -616,11 +634,11 @@
 {
 	struct lpm_trie_node *node, *next_node = NULL, *parent, *search_root;
 	struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
-	struct bpf_lpm_trie_key *key = _key, *next_key = _next_key;
+	struct bpf_lpm_trie_key_u8 *key = _key, *next_key = _next_key;
 	struct lpm_trie_node **node_stack = NULL;
 	int err = 0, stack_ptr = -1;
 	unsigned int next_bit;
-	size_t matchlen;
+	size_t matchlen = 0;
 
 	/* The get_next_key follows postorder. For the 4 node example in
 	 * the top of this file, the trie_get_next_key() returns the following
@@ -642,7 +660,7 @@
 	if (!key || key->prefixlen > trie->max_prefixlen)
 		goto find_leftmost;
 
-	node_stack = kmalloc_array(trie->max_prefixlen,
+	node_stack = kmalloc_array(trie->max_prefixlen + 1,
 				   sizeof(struct lpm_trie_node *),
 				   GFP_ATOMIC | __GFP_NOWARN);
 	if (!node_stack)
@@ -659,7 +677,7 @@
 		next_bit = extract_bit(key->data, node->prefixlen);
 		node = rcu_dereference(node->child[next_bit]);
 	}
-	if (!node || node->prefixlen != key->prefixlen ||
+	if (!node || node->prefixlen != matchlen ||
 	    (node->flags & LPM_TREE_NODE_FLAG_IM))
 		goto find_leftmost;
 
@@ -703,7 +721,7 @@
 	}
 do_copy:
 	next_key->prefixlen = next_node->prefixlen;
-	memcpy((void *)next_key + offsetof(struct bpf_lpm_trie_key, data),
+	memcpy((void *)next_key + offsetof(struct bpf_lpm_trie_key_u8, data),
 	       next_node->data, trie->data_size);
 free_stack:
 	kfree(node_stack);
@@ -715,7 +733,7 @@
 			  const struct btf_type *key_type,
 			  const struct btf_type *value_type)
 {
-	/* Keys must have struct bpf_lpm_trie_key embedded. */
+	/* Keys must have struct bpf_lpm_trie_key_u8 embedded. */
 	return BTF_INFO_KIND(key_type->info) != BTF_KIND_STRUCT ?
 	       -EINVAL : 0;
 }
--- linux-qcom-6.8.0.orig/kernel/bpf/memalloc.c
+++ linux-qcom-6.8.0/kernel/bpf/memalloc.c
@@ -35,6 +35,8 @@
  */
 #define LLIST_NODE_SZ sizeof(struct llist_node)
 
+#define BPF_MEM_ALLOC_SIZE_MAX 4096
+
 /* similar to kmalloc, but sizeof == 8 bucket is gone */
 static u8 size_index[24] __ro_after_init = {
 	3,	/* 8 */
@@ -65,7 +67,7 @@
 
 static int bpf_mem_cache_idx(size_t size)
 {
-	if (!size || size > 4096)
+	if (!size || size > BPF_MEM_ALLOC_SIZE_MAX)
 		return -1;
 
 	if (size <= 192)
@@ -1010,3 +1012,13 @@
 
 	return !ret ? NULL : ret + LLIST_NODE_SZ;
 }
+
+int bpf_mem_alloc_check_size(bool percpu, size_t size)
+{
+	/* The size of percpu allocation doesn't have LLIST_NODE_SZ overhead */
+	if ((percpu && size > BPF_MEM_ALLOC_SIZE_MAX) ||
+	    (!percpu && size > BPF_MEM_ALLOC_SIZE_MAX - LLIST_NODE_SZ))
+		return -E2BIG;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/kernel/bpf/ringbuf.c
+++ linux-qcom-6.8.0/kernel/bpf/ringbuf.c
@@ -29,7 +29,7 @@
 	u64 mask;
 	struct page **pages;
 	int nr_pages;
-	spinlock_t spinlock ____cacheline_aligned_in_smp;
+	raw_spinlock_t spinlock ____cacheline_aligned_in_smp;
 	/* For user-space producer ring buffers, an atomic_t busy bit is used
 	 * to synchronize access to the ring buffers in the kernel, rather than
 	 * the spinlock that is used for kernel-producer ring buffers. This is
@@ -51,7 +51,8 @@
 	 * This prevents a user-space application from modifying the
 	 * position and ruining in-kernel tracking. The permissions of the
 	 * pages depend on who is producing samples: user-space or the
-	 * kernel.
+	 * kernel. Note that the pending counter is placed in the same
+	 * page as the producer, so that it shares the same cache line.
 	 *
 	 * Kernel-producer
 	 * ---------------
@@ -70,6 +71,7 @@
 	 */
 	unsigned long consumer_pos __aligned(PAGE_SIZE);
 	unsigned long producer_pos __aligned(PAGE_SIZE);
+	unsigned long pending_pos;
 	char data[] __aligned(PAGE_SIZE);
 };
 
@@ -171,7 +173,7 @@
 	if (!rb)
 		return NULL;
 
-	spin_lock_init(&rb->spinlock);
+	raw_spin_lock_init(&rb->spinlock);
 	atomic_set(&rb->busy, 0);
 	init_waitqueue_head(&rb->waitq);
 	init_irq_work(&rb->work, bpf_ringbuf_notify);
@@ -179,6 +181,7 @@
 	rb->mask = data_sz - 1;
 	rb->consumer_pos = 0;
 	rb->producer_pos = 0;
+	rb->pending_pos = 0;
 
 	return rb;
 }
@@ -404,9 +407,9 @@
 
 static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size)
 {
-	unsigned long cons_pos, prod_pos, new_prod_pos, flags;
-	u32 len, pg_off;
+	unsigned long cons_pos, prod_pos, new_prod_pos, pend_pos, flags;
 	struct bpf_ringbuf_hdr *hdr;
+	u32 len, pg_off, tmp_size, hdr_len;
 
 	if (unlikely(size > RINGBUF_MAX_RECORD_SZ))
 		return NULL;
@@ -418,20 +421,36 @@
 	cons_pos = smp_load_acquire(&rb->consumer_pos);
 
 	if (in_nmi()) {
-		if (!spin_trylock_irqsave(&rb->spinlock, flags))
+		if (!raw_spin_trylock_irqsave(&rb->spinlock, flags))
 			return NULL;
 	} else {
-		spin_lock_irqsave(&rb->spinlock, flags);
+		raw_spin_lock_irqsave(&rb->spinlock, flags);
 	}
 
+	pend_pos = rb->pending_pos;
 	prod_pos = rb->producer_pos;
 	new_prod_pos = prod_pos + len;
 
-	/* check for out of ringbuf space by ensuring producer position
-	 * doesn't advance more than (ringbuf_size - 1) ahead
+	while (pend_pos < prod_pos) {
+		hdr = (void *)rb->data + (pend_pos & rb->mask);
+		hdr_len = READ_ONCE(hdr->len);
+		if (hdr_len & BPF_RINGBUF_BUSY_BIT)
+			break;
+		tmp_size = hdr_len & ~BPF_RINGBUF_DISCARD_BIT;
+		tmp_size = round_up(tmp_size + BPF_RINGBUF_HDR_SZ, 8);
+		pend_pos += tmp_size;
+	}
+	rb->pending_pos = pend_pos;
+
+	/* check for out of ringbuf space:
+	 * - by ensuring producer position doesn't advance more than
+	 *   (ringbuf_size - 1) ahead
+	 * - by ensuring oldest not yet committed record until newest
+	 *   record does not span more than (ringbuf_size - 1)
 	 */
-	if (new_prod_pos - cons_pos > rb->mask) {
-		spin_unlock_irqrestore(&rb->spinlock, flags);
+	if (new_prod_pos - cons_pos > rb->mask ||
+	    new_prod_pos - pend_pos > rb->mask) {
+		raw_spin_unlock_irqrestore(&rb->spinlock, flags);
 		return NULL;
 	}
 
@@ -443,7 +462,7 @@
 	/* pairs with consumer's smp_load_acquire() */
 	smp_store_release(&rb->producer_pos, new_prod_pos);
 
-	spin_unlock_irqrestore(&rb->spinlock, flags);
+	raw_spin_unlock_irqrestore(&rb->spinlock, flags);
 
 	return (void *)hdr + BPF_RINGBUF_HDR_SZ;
 }
@@ -613,7 +632,7 @@
 	.arg1_type	= ARG_CONST_MAP_PTR,
 	.arg2_type	= ARG_ANYTHING,
 	.arg3_type	= ARG_ANYTHING,
-	.arg4_type	= ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_RINGBUF | MEM_UNINIT,
+	.arg4_type	= ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_RINGBUF | MEM_UNINIT | MEM_WRITE,
 };
 
 BPF_CALL_2(bpf_ringbuf_submit_dynptr, struct bpf_dynptr_kern *, ptr, u64, flags)
--- linux-qcom-6.8.0.orig/kernel/bpf/stackmap.c
+++ linux-qcom-6.8.0/kernel/bpf/stackmap.c
@@ -91,11 +91,14 @@
 	} else if (value_size / 8 > sysctl_perf_event_max_stack)
 		return ERR_PTR(-EINVAL);
 
-	/* hash table size must be power of 2 */
-	n_buckets = roundup_pow_of_two(attr->max_entries);
-	if (!n_buckets)
+	/* hash table size must be power of 2; roundup_pow_of_two() can overflow
+	 * into UB on 32-bit arches, so check that first
+	 */
+	if (attr->max_entries > 1UL << 31)
 		return ERR_PTR(-E2BIG);
 
+	n_buckets = roundup_pow_of_two(attr->max_entries);
+
 	cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap);
 	smap = bpf_map_area_alloc(cost, bpf_map_attr_numa_node(attr));
 	if (!smap)
--- linux-qcom-6.8.0.orig/kernel/bpf/syscall.c
+++ linux-qcom-6.8.0/kernel/bpf/syscall.c
@@ -687,15 +687,11 @@
 	}
 }
 
-/* called from workqueue */
-static void bpf_map_free_deferred(struct work_struct *work)
+static void bpf_map_free(struct bpf_map *map)
 {
-	struct bpf_map *map = container_of(work, struct bpf_map, work);
 	struct btf_record *rec = map->record;
 	struct btf *btf = map->btf;
 
-	security_bpf_map_free(map);
-	bpf_map_release_memcg(map);
 	/* implementation dependent freeing */
 	map->ops->map_free(map);
 	/* Delay freeing of btf_record for maps, as map_free
@@ -714,6 +710,16 @@
 	btf_put(btf);
 }
 
+/* called from workqueue */
+static void bpf_map_free_deferred(struct work_struct *work)
+{
+	struct bpf_map *map = container_of(work, struct bpf_map, work);
+
+	security_bpf_map_free(map);
+	bpf_map_release_memcg(map);
+	bpf_map_free(map);
+}
+
 static void bpf_map_put_uref(struct bpf_map *map)
 {
 	if (atomic64_dec_and_test(&map->usercnt)) {
@@ -1312,8 +1318,7 @@
 free_map_sec:
 	security_bpf_map_free(map);
 free_map:
-	btf_put(map->btf);
-	map->ops->map_free(map);
+	bpf_map_free(map);
 	return err;
 }
 
@@ -2856,6 +2861,7 @@
 void bpf_link_init(struct bpf_link *link, enum bpf_link_type type,
 		   const struct bpf_link_ops *ops, struct bpf_prog *prog)
 {
+	WARN_ON(ops->dealloc && ops->dealloc_deferred);
 	atomic64_set(&link->refcnt, 1);
 	link->type = type;
 	link->id = 0;
@@ -2895,17 +2901,58 @@
 	atomic64_inc(&link->refcnt);
 }
 
+static void bpf_link_dealloc(struct bpf_link *link)
+{
+	/* now that we know that bpf_link itself can't be reached, put underlying BPF program */
+	if (link->prog)
+		bpf_prog_put(link->prog);
+
+	/* free bpf_link and its containing memory */
+	if (link->ops->dealloc_deferred)
+		link->ops->dealloc_deferred(link);
+	else
+		link->ops->dealloc(link);
+}
+
+static void bpf_link_defer_dealloc_rcu_gp(struct rcu_head *rcu)
+{
+	struct bpf_link *link = container_of(rcu, struct bpf_link, rcu);
+
+	bpf_link_dealloc(link);
+}
+
+static void bpf_link_defer_dealloc_mult_rcu_gp(struct rcu_head *rcu)
+{
+	if (rcu_trace_implies_rcu_gp())
+		bpf_link_defer_dealloc_rcu_gp(rcu);
+	else
+		call_rcu(rcu, bpf_link_defer_dealloc_rcu_gp);
+}
+
 /* bpf_link_free is guaranteed to be called from process context */
 static void bpf_link_free(struct bpf_link *link)
 {
+	const struct bpf_link_ops *ops = link->ops;
+	bool sleepable = false;
+
 	bpf_link_free_id(link->id);
 	if (link->prog) {
+		sleepable = link->prog->aux->sleepable;
 		/* detach BPF program, clean up used resources */
-		link->ops->release(link);
-		bpf_prog_put(link->prog);
+		ops->release(link);
+	}
+	if (ops->dealloc_deferred) {
+		/* schedule BPF link deallocation; if underlying BPF program
+		 * is sleepable, we need to first wait for RCU tasks trace
+		 * sync, then go through "classic" RCU grace period
+		 */
+		if (sleepable)
+			call_rcu_tasks_trace(&link->rcu, bpf_link_defer_dealloc_mult_rcu_gp);
+		else
+			call_rcu(&link->rcu, bpf_link_defer_dealloc_rcu_gp);
+	} else if (ops->dealloc) {
+		bpf_link_dealloc(link);
 	}
-	/* free bpf_link and its containing memory */
-	link->ops->dealloc(link);
 }
 
 static void bpf_link_put_deferred(struct work_struct *work)
@@ -2959,13 +3006,17 @@
 {
 	const struct bpf_link *link = filp->private_data;
 	const struct bpf_prog *prog = link->prog;
+	enum bpf_link_type type = link->type;
 	char prog_tag[sizeof(prog->tag) * 2 + 1] = { };
 
-	seq_printf(m,
-		   "link_type:\t%s\n"
-		   "link_id:\t%u\n",
-		   bpf_link_type_strs[link->type],
-		   link->id);
+	if (type < ARRAY_SIZE(bpf_link_type_strs) && bpf_link_type_strs[type]) {
+		seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
+	} else {
+		WARN_ONCE(1, "missing BPF_LINK_TYPE(...) for link type %u\n", type);
+		seq_printf(m, "link_type:\t<%u>\n", type);
+	}
+	seq_printf(m, "link_id:\t%u\n", link->id);
+
 	if (prog) {
 		bin2hex(prog_tag, prog->tag, sizeof(prog->tag));
 		seq_printf(m,
@@ -3087,7 +3138,8 @@
 		container_of(link, struct bpf_tracing_link, link.link);
 
 	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link,
-						tr_link->trampoline));
+						tr_link->trampoline,
+						tr_link->tgt_prog));
 
 	bpf_trampoline_put(tr_link->trampoline);
 
@@ -3227,7 +3279,7 @@
 	 *   in prog->aux
 	 *
 	 * - if prog->aux->dst_trampoline is NULL, the program has already been
-         *   attached to a target and its initial target was cleared (below)
+	 *   attached to a target and its initial target was cleared (below)
 	 *
 	 * - if tgt_prog != NULL, the caller specified tgt_prog_fd +
 	 *   target_btf_id using the link_create API.
@@ -3302,7 +3354,7 @@
 	if (err)
 		goto out_unlock;
 
-	err = bpf_trampoline_link_prog(&link->link, tr);
+	err = bpf_trampoline_link_prog(&link->link, tr, tgt_prog);
 	if (err) {
 		bpf_link_cleanup(&link_primer);
 		link = NULL;
@@ -3415,7 +3467,7 @@
 
 static const struct bpf_link_ops bpf_raw_tp_link_lops = {
 	.release = bpf_raw_tp_link_release,
-	.dealloc = bpf_raw_tp_link_dealloc,
+	.dealloc_deferred = bpf_raw_tp_link_dealloc,
 	.show_fdinfo = bpf_raw_tp_link_show_fdinfo,
 	.fill_link_info = bpf_raw_tp_link_fill_link_info,
 };
@@ -3443,15 +3495,16 @@
 }
 
 static int bpf_perf_link_fill_common(const struct perf_event *event,
-				     char __user *uname, u32 ulen,
+				     char __user *uname, u32 *ulenp,
 				     u64 *probe_offset, u64 *probe_addr,
 				     u32 *fd_type, unsigned long *missed)
 {
 	const char *buf;
-	u32 prog_id;
+	u32 prog_id, ulen;
 	size_t len;
 	int err;
 
+	ulen = *ulenp;
 	if (!ulen ^ !uname)
 		return -EINVAL;
 
@@ -3459,10 +3512,17 @@
 				      probe_offset, probe_addr, missed);
 	if (err)
 		return err;
+
+	if (buf) {
+		len = strlen(buf);
+		*ulenp = len + 1;
+	} else {
+		*ulenp = 1;
+	}
 	if (!uname)
 		return 0;
+
 	if (buf) {
-		len = strlen(buf);
 		err = bpf_copy_to_user(uname, buf, ulen, len);
 		if (err)
 			return err;
@@ -3487,7 +3547,7 @@
 
 	uname = u64_to_user_ptr(info->perf_event.kprobe.func_name);
 	ulen = info->perf_event.kprobe.name_len;
-	err = bpf_perf_link_fill_common(event, uname, ulen, &offset, &addr,
+	err = bpf_perf_link_fill_common(event, uname, &ulen, &offset, &addr,
 					&type, &missed);
 	if (err)
 		return err;
@@ -3495,12 +3555,13 @@
 		info->perf_event.type = BPF_PERF_EVENT_KRETPROBE;
 	else
 		info->perf_event.type = BPF_PERF_EVENT_KPROBE;
-
+	info->perf_event.kprobe.name_len = ulen;
 	info->perf_event.kprobe.offset = offset;
 	info->perf_event.kprobe.missed = missed;
 	if (!kallsyms_show_value(current_cred()))
 		addr = 0;
 	info->perf_event.kprobe.addr = addr;
+	info->perf_event.kprobe.cookie = event->bpf_cookie;
 	return 0;
 }
 #endif
@@ -3516,7 +3577,7 @@
 
 	uname = u64_to_user_ptr(info->perf_event.uprobe.file_name);
 	ulen = info->perf_event.uprobe.name_len;
-	err = bpf_perf_link_fill_common(event, uname, ulen, &offset, &addr,
+	err = bpf_perf_link_fill_common(event, uname, &ulen, &offset, &addr,
 					&type, NULL);
 	if (err)
 		return err;
@@ -3525,7 +3586,9 @@
 		info->perf_event.type = BPF_PERF_EVENT_URETPROBE;
 	else
 		info->perf_event.type = BPF_PERF_EVENT_UPROBE;
+	info->perf_event.uprobe.name_len = ulen;
 	info->perf_event.uprobe.offset = offset;
+	info->perf_event.uprobe.cookie = event->bpf_cookie;
 	return 0;
 }
 #endif
@@ -3549,11 +3612,18 @@
 {
 	char __user *uname;
 	u32 ulen;
+	int err;
 
 	uname = u64_to_user_ptr(info->perf_event.tracepoint.tp_name);
 	ulen = info->perf_event.tracepoint.name_len;
+	err = bpf_perf_link_fill_common(event, uname, &ulen, NULL, NULL, NULL, NULL);
+	if (err)
+		return err;
+
 	info->perf_event.type = BPF_PERF_EVENT_TRACEPOINT;
-	return bpf_perf_link_fill_common(event, uname, ulen, NULL, NULL, NULL, NULL);
+	info->perf_event.tracepoint.name_len = ulen;
+	info->perf_event.tracepoint.cookie = event->bpf_cookie;
+	return 0;
 }
 
 static int bpf_perf_link_fill_perf_event(const struct perf_event *event,
@@ -3561,6 +3631,7 @@
 {
 	info->perf_event.event.type = event->attr.type;
 	info->perf_event.event.config = event->attr.config;
+	info->perf_event.event.cookie = event->bpf_cookie;
 	info->perf_event.type = BPF_PERF_EVENT_EVENT;
 	return 0;
 }
@@ -3823,6 +3894,11 @@
 			 * check permissions at attach time.
 			 */
 			return -EPERM;
+
+		ptype = attach_type_to_prog_type(attach_type);
+		if (prog->type != ptype)
+			return -EINVAL;
+
 		return prog->enforce_expected_attach_type &&
 			prog->expected_attach_type != attach_type ?
 			-EINVAL : 0;
@@ -5676,6 +5752,7 @@
 
 BPF_CALL_4(bpf_kallsyms_lookup_name, const char *, name, int, name_sz, int, flags, u64 *, res)
 {
+	*res = 0;
 	if (flags)
 		return -EINVAL;
 
@@ -5696,7 +5773,8 @@
 	.arg1_type	= ARG_PTR_TO_MEM,
 	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
 	.arg3_type	= ARG_ANYTHING,
-	.arg4_type	= ARG_PTR_TO_LONG,
+	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,
+	.arg4_size	= sizeof(u64),
 };
 
 static const struct bpf_func_proto *
--- linux-qcom-6.8.0.orig/kernel/bpf/task_iter.c
+++ linux-qcom-6.8.0/kernel/bpf/task_iter.c
@@ -99,7 +99,7 @@
 		rcu_read_lock();
 		pid = find_pid_ns(common->pid, common->ns);
 		if (pid) {
-			task = get_pid_task(pid, PIDTYPE_TGID);
+			task = get_pid_task(pid, PIDTYPE_PID);
 			*tid = common->pid;
 		}
 		rcu_read_unlock();
--- linux-qcom-6.8.0.orig/kernel/bpf/trampoline.c
+++ linux-qcom-6.8.0/kernel/bpf/trampoline.c
@@ -521,7 +521,27 @@
 	}
 }
 
-static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)
+static int bpf_freplace_check_tgt_prog(struct bpf_prog *tgt_prog)
+{
+	struct bpf_prog_aux *aux = tgt_prog->aux;
+
+	guard(mutex)(&aux->ext_mutex);
+	if (aux->prog_array_member_cnt)
+		/* Program extensions can not extend target prog when the target
+		 * prog has been updated to any prog_array map as tail callee.
+		 * It's to prevent a potential infinite loop like:
+		 * tgt prog entry -> tgt prog subprog -> freplace prog entry
+		 * --tailcall-> tgt prog entry.
+		 */
+		return -EBUSY;
+
+	aux->is_extended = true;
+	return 0;
+}
+
+static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link,
+				      struct bpf_trampoline *tr,
+				      struct bpf_prog *tgt_prog)
 {
 	enum bpf_tramp_prog_type kind;
 	struct bpf_tramp_link *link_exiting;
@@ -542,6 +562,9 @@
 		/* Cannot attach extension if fentry/fexit are in use. */
 		if (cnt)
 			return -EBUSY;
+		err = bpf_freplace_check_tgt_prog(tgt_prog);
+		if (err)
+			return err;
 		tr->extension_prog = link->link.prog;
 		return bpf_arch_text_poke(tr->func.addr, BPF_MOD_JUMP, NULL,
 					  link->link.prog->bpf_func);
@@ -568,17 +591,21 @@
 	return err;
 }
 
-int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)
+int bpf_trampoline_link_prog(struct bpf_tramp_link *link,
+			     struct bpf_trampoline *tr,
+			     struct bpf_prog *tgt_prog)
 {
 	int err;
 
 	mutex_lock(&tr->mutex);
-	err = __bpf_trampoline_link_prog(link, tr);
+	err = __bpf_trampoline_link_prog(link, tr, tgt_prog);
 	mutex_unlock(&tr->mutex);
 	return err;
 }
 
-static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)
+static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
+					struct bpf_trampoline *tr,
+					struct bpf_prog *tgt_prog)
 {
 	enum bpf_tramp_prog_type kind;
 	int err;
@@ -589,6 +616,8 @@
 		err = bpf_arch_text_poke(tr->func.addr, BPF_MOD_JUMP,
 					 tr->extension_prog->bpf_func, NULL);
 		tr->extension_prog = NULL;
+		guard(mutex)(&tgt_prog->aux->ext_mutex);
+		tgt_prog->aux->is_extended = false;
 		return err;
 	}
 	hlist_del_init(&link->tramp_hlist);
@@ -597,12 +626,14 @@
 }
 
 /* bpf_trampoline_unlink_prog() should never fail. */
-int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)
+int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
+			       struct bpf_trampoline *tr,
+			       struct bpf_prog *tgt_prog)
 {
 	int err;
 
 	mutex_lock(&tr->mutex);
-	err = __bpf_trampoline_unlink_prog(link, tr);
+	err = __bpf_trampoline_unlink_prog(link, tr, tgt_prog);
 	mutex_unlock(&tr->mutex);
 	return err;
 }
@@ -617,7 +648,7 @@
 	if (!shim_link->trampoline)
 		return;
 
-	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline));
+	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL));
 	bpf_trampoline_put(shim_link->trampoline);
 }
 
@@ -731,7 +762,7 @@
 		goto err;
 	}
 
-	err = __bpf_trampoline_link_prog(&shim_link->link, tr);
+	err = __bpf_trampoline_link_prog(&shim_link->link, tr, NULL);
 	if (err)
 		goto err;
 
--- linux-qcom-6.8.0.orig/kernel/bpf/verifier.c
+++ linux-qcom-6.8.0/kernel/bpf/verifier.c
@@ -1158,14 +1158,17 @@
 /* Mark stack slot as STACK_MISC, unless it is already STACK_INVALID, in which
  * case they are equivalent, or it's STACK_ZERO, in which case we preserve
  * more precise STACK_ZERO.
- * Note, in uprivileged mode leaving STACK_INVALID is wrong, so we take
- * env->allow_ptr_leaks into account and force STACK_MISC, if necessary.
+ * Regardless of allow_ptr_leaks setting (i.e., privileged or unprivileged
+ * mode), we won't promote STACK_INVALID to STACK_MISC. In privileged case it is
+ * unnecessary as both are considered equivalent when loading data and pruning,
+ * in case of unprivileged mode it will be incorrect to allow reads of invalid
+ * slots.
  */
 static void mark_stack_slot_misc(struct bpf_verifier_env *env, u8 *stype)
 {
 	if (*stype == STACK_ZERO)
 		return;
-	if (env->allow_ptr_leaks && *stype == STACK_INVALID)
+	if (*stype == STACK_INVALID)
 		return;
 	*stype = STACK_MISC;
 }
@@ -2294,6 +2297,25 @@
 	__mark_reg_unknown(env, regs + regno);
 }
 
+static int __mark_reg_s32_range(struct bpf_verifier_env *env,
+				struct bpf_reg_state *regs,
+				u32 regno,
+				s32 s32_min,
+				s32 s32_max)
+{
+	struct bpf_reg_state *reg = regs + regno;
+
+	reg->s32_min_value = max_t(s32, reg->s32_min_value, s32_min);
+	reg->s32_max_value = min_t(s32, reg->s32_max_value, s32_max);
+
+	reg->smin_value = max_t(s64, reg->smin_value, s32_min);
+	reg->smax_value = min_t(s64, reg->smax_value, s32_max);
+
+	reg_bounds_sync(reg);
+
+	return reg_bounds_sanity_check(env, reg, "s32_range");
+}
+
 static void __mark_reg_not_init(const struct bpf_verifier_env *env,
 				struct bpf_reg_state *reg)
 {
@@ -2328,6 +2350,8 @@
 	regs[regno].type = PTR_TO_BTF_ID | flag;
 	regs[regno].btf = btf;
 	regs[regno].btf_id = btf_id;
+	if (type_may_be_null(flag))
+		regs[regno].id = ++env->id_gen;
 }
 
 #define DEF_NOT_SUBREG	(0)
@@ -2653,10 +2677,16 @@
 		b->module = mod;
 		b->offset = offset;
 
+		/* sort() reorders entries by value, so b may no longer point
+		 * to the right entry after this
+		 */
 		sort(tab->descs, tab->nr_descs, sizeof(tab->descs[0]),
 		     kfunc_btf_cmp_by_off, NULL);
+	} else {
+		btf = b->btf;
 	}
-	return b->btf;
+
+	return btf;
 }
 
 void bpf_free_kfunc_btf_tab(struct bpf_kfunc_btf_tab *tab)
@@ -2939,8 +2969,10 @@
 
 		if (code == (BPF_JMP | BPF_CALL) &&
 		    insn[i].src_reg == 0 &&
-		    insn[i].imm == BPF_FUNC_tail_call)
+		    insn[i].imm == BPF_FUNC_tail_call) {
 			subprog[cur_subprog].has_tail_call = true;
+			subprog[cur_subprog].tail_call_reachable = true;
+		}
 		if (BPF_CLASS(code) == BPF_LD &&
 		    (BPF_MODE(code) == BPF_ABS || BPF_MODE(code) == BPF_IND))
 			subprog[cur_subprog].has_ld_abs = true;
@@ -3584,7 +3616,8 @@
 				 * sreg needs precision before this insn
 				 */
 				bt_clear_reg(bt, dreg);
-				bt_set_reg(bt, sreg);
+				if (sreg != BPF_REG_FP)
+					bt_set_reg(bt, sreg);
 			} else {
 				/* dreg = K
 				 * dreg needs precision after this insn.
@@ -3600,7 +3633,8 @@
 				 * both dreg and sreg need precision
 				 * before this insn
 				 */
-				bt_set_reg(bt, sreg);
+				if (sreg != BPF_REG_FP)
+					bt_set_reg(bt, sreg);
 			} /* else dreg += K
 			   * dreg still needs precision before this insn
 			   */
@@ -4458,6 +4492,7 @@
 	 */
 	if (!env->allow_ptr_leaks &&
 	    is_spilled_reg(&state->stack[spi]) &&
+	    !is_spilled_scalar_reg(&state->stack[spi]) &&
 	    size != BPF_REG_SIZE) {
 		verbose(env, "attempt to corrupt spilled pointer on stack\n");
 		return -EACCES;
@@ -5320,8 +5355,6 @@
 		 */
 		mark_btf_ld_reg(env, cur_regs(env), value_regno, PTR_TO_BTF_ID, kptr_field->kptr.btf,
 				kptr_field->kptr.btf_id, btf_ld_kptr_type(env, kptr_field));
-		/* For mark_ptr_or_null_reg */
-		val_reg->id = ++env->id_gen;
 	} else if (class == BPF_STX) {
 		val_reg = reg_state(env, value_regno);
 		if (!register_is_null(val_reg) &&
@@ -5491,11 +5524,13 @@
 /* check access to 'struct bpf_context' fields.  Supports fixed offsets only */
 static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size,
 			    enum bpf_access_type t, enum bpf_reg_type *reg_type,
-			    struct btf **btf, u32 *btf_id)
+			    struct btf **btf, u32 *btf_id, bool *is_retval, bool is_ldsx)
 {
 	struct bpf_insn_access_aux info = {
 		.reg_type = *reg_type,
 		.log = &env->log,
+		.is_retval = false,
+		.is_ldsx = is_ldsx,
 	};
 
 	if (env->ops->is_valid_access &&
@@ -5508,6 +5543,7 @@
 		 * type of narrower access.
 		 */
 		*reg_type = info.reg_type;
+		*is_retval = info.is_retval;
 
 		if (base_type(*reg_type) == PTR_TO_BTF_ID) {
 			*btf = info.btf;
@@ -5632,7 +5668,8 @@
 		return true;
 
 	/* Types listed in the reg2btf_ids are always trusted */
-	if (reg2btf_ids[base_type(reg->type)])
+	if (reg2btf_ids[base_type(reg->type)] &&
+	    !bpf_type_has_unsafe_modifiers(reg->type))
 		return true;
 
 	/* If a register is not referenced, it is trusted if it has the
@@ -6113,10 +6150,10 @@
 
 	/* both of s64_max/s64_min positive or negative */
 	if ((s64_max >= 0) == (s64_min >= 0)) {
-		reg->smin_value = reg->s32_min_value = s64_min;
-		reg->smax_value = reg->s32_max_value = s64_max;
-		reg->umin_value = reg->u32_min_value = s64_min;
-		reg->umax_value = reg->u32_max_value = s64_max;
+		reg->s32_min_value = reg->smin_value = s64_min;
+		reg->s32_max_value = reg->smax_value = s64_max;
+		reg->u32_min_value = reg->umin_value = s64_min;
+		reg->u32_max_value = reg->umax_value = s64_max;
 		reg->var_off = tnum_range(s64_min, s64_max);
 		return;
 	}
@@ -6137,6 +6174,7 @@
 	}
 	reg->u32_min_value = 0;
 	reg->u32_max_value = U32_MAX;
+	reg->var_off = tnum_subreg(tnum_unknown);
 }
 
 static void coerce_subreg_to_size_sx(struct bpf_reg_state *reg, int size)
@@ -6181,6 +6219,7 @@
 		reg->s32_max_value = s32_max;
 		reg->u32_min_value = (u32)s32_min;
 		reg->u32_max_value = (u32)s32_max;
+		reg->var_off = tnum_subreg(tnum_range(s32_min, s32_max));
 		return;
 	}
 
@@ -6242,6 +6281,7 @@
 #define BTF_TYPE_SAFE_RCU(__type)  __PASTE(__type, __safe_rcu)
 #define BTF_TYPE_SAFE_RCU_OR_NULL(__type)  __PASTE(__type, __safe_rcu_or_null)
 #define BTF_TYPE_SAFE_TRUSTED(__type)  __PASTE(__type, __safe_trusted)
+#define BTF_TYPE_SAFE_TRUSTED_OR_NULL(__type)  __PASTE(__type, __safe_trusted_or_null)
 
 /*
  * Allow list few fields as RCU trusted or full trusted.
@@ -6305,7 +6345,7 @@
 	struct inode *d_inode;
 };
 
-BTF_TYPE_SAFE_TRUSTED(struct socket) {
+BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct socket) {
 	struct sock *sk;
 };
 
@@ -6340,11 +6380,20 @@
 	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct linux_binprm));
 	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct file));
 	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct dentry));
-	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct socket));
 
 	return btf_nested_type_is_trusted(&env->log, reg, field_name, btf_id, "__safe_trusted");
 }
 
+static bool type_is_trusted_or_null(struct bpf_verifier_env *env,
+				    struct bpf_reg_state *reg,
+				    const char *field_name, u32 btf_id)
+{
+	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct socket));
+
+	return btf_nested_type_is_trusted(&env->log, reg, field_name, btf_id,
+					  "__safe_trusted_or_null");
+}
+
 static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 				   struct bpf_reg_state *regs,
 				   int regno, int off, int size,
@@ -6453,6 +6502,8 @@
 		 */
 		if (type_is_trusted(env, reg, field_name, btf_id)) {
 			flag |= PTR_TRUSTED;
+		} else if (type_is_trusted_or_null(env, reg, field_name, btf_id)) {
+			flag |= PTR_TRUSTED | PTR_MAYBE_NULL;
 		} else if (in_rcu_cs(env) && !type_may_be_null(reg->type)) {
 			if (type_is_rcu(env, reg, field_name, btf_id)) {
 				/* ignore __rcu tag and mark it MEM_RCU */
@@ -6618,6 +6669,11 @@
 	err = check_stack_slot_within_bounds(env, min_off, state, type);
 	if (!err && max_off > 0)
 		err = -EINVAL; /* out of stack access into non-negative offsets */
+	if (!err && access_size < 0)
+		/* access_size should not be negative (or overflow an int); others checks
+		 * along the way should have prevented such an access.
+		 */
+		err = -EFAULT; /* invalid negative access size; integer overflow? */
 
 	if (err) {
 		if (tnum_is_const(reg->var_off)) {
@@ -6639,6 +6695,17 @@
 	return grow_stack_state(env, state, -min_off /* size */);
 }
 
+static bool get_func_retval_range(struct bpf_prog *prog,
+				  struct bpf_retval_range *range)
+{
+	if (prog->type == BPF_PROG_TYPE_LSM &&
+		prog->expected_attach_type == BPF_LSM_MAC &&
+		!bpf_lsm_get_retval_range(prog, range)) {
+		return true;
+	}
+	return false;
+}
+
 /* check whether memory at (regno + off) is accessible for t = (read | write)
  * if t==write, value_regno is a register which value is stored into memory
  * if t==read, value_regno is a register which will receive the value from memory
@@ -6743,6 +6810,8 @@
 		if (!err && value_regno >= 0 && (t == BPF_READ || rdonly_mem))
 			mark_reg_unknown(env, regs, value_regno);
 	} else if (reg->type == PTR_TO_CTX) {
+		bool is_retval = false;
+		struct bpf_retval_range range;
 		enum bpf_reg_type reg_type = SCALAR_VALUE;
 		struct btf *btf = NULL;
 		u32 btf_id = 0;
@@ -6758,7 +6827,7 @@
 			return err;
 
 		err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf,
-				       &btf_id);
+				       &btf_id, &is_retval, is_ldsx);
 		if (err)
 			verbose_linfo(env, insn_idx, "; ");
 		if (!err && t == BPF_READ && value_regno >= 0) {
@@ -6767,7 +6836,14 @@
 			 * case, we know the offset is zero.
 			 */
 			if (reg_type == SCALAR_VALUE) {
-				mark_reg_unknown(env, regs, value_regno);
+				if (is_retval && get_func_retval_range(env->prog, &range)) {
+					err = __mark_reg_s32_range(env, regs, value_regno,
+								   range.minval, range.maxval);
+					if (err)
+						return err;
+				} else {
+					mark_reg_unknown(env, regs, value_regno);
+				}
 			} else {
 				mark_reg_known_zero(env, regs,
 						    value_regno);
@@ -7151,7 +7227,8 @@
 }
 
 static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
-				   int access_size, bool zero_size_allowed,
+				   int access_size, enum bpf_access_type access_type,
+				   bool zero_size_allowed,
 				   struct bpf_call_arg_meta *meta)
 {
 	struct bpf_reg_state *regs = cur_regs(env), *reg = &regs[regno];
@@ -7163,7 +7240,7 @@
 		return check_packet_access(env, regno, reg->off, access_size,
 					   zero_size_allowed);
 	case PTR_TO_MAP_KEY:
-		if (meta && meta->raw_mode) {
+		if (access_type == BPF_WRITE) {
 			verbose(env, "R%d cannot write into %s\n", regno,
 				reg_type_str(env, reg->type));
 			return -EACCES;
@@ -7171,15 +7248,13 @@
 		return check_mem_region_access(env, regno, reg->off, access_size,
 					       reg->map_ptr->key_size, false);
 	case PTR_TO_MAP_VALUE:
-		if (check_map_access_type(env, regno, reg->off, access_size,
-					  meta && meta->raw_mode ? BPF_WRITE :
-					  BPF_READ))
+		if (check_map_access_type(env, regno, reg->off, access_size, access_type))
 			return -EACCES;
 		return check_map_access(env, regno, reg->off, access_size,
 					zero_size_allowed, ACCESS_HELPER);
 	case PTR_TO_MEM:
 		if (type_is_rdonly_mem(reg->type)) {
-			if (meta && meta->raw_mode) {
+			if (access_type == BPF_WRITE) {
 				verbose(env, "R%d cannot write into %s\n", regno,
 					reg_type_str(env, reg->type));
 				return -EACCES;
@@ -7190,7 +7265,7 @@
 					       zero_size_allowed);
 	case PTR_TO_BUF:
 		if (type_is_rdonly_mem(reg->type)) {
-			if (meta && meta->raw_mode) {
+			if (access_type == BPF_WRITE) {
 				verbose(env, "R%d cannot write into %s\n", regno,
 					reg_type_str(env, reg->type));
 				return -EACCES;
@@ -7218,7 +7293,6 @@
 		 * Dynamically check it now.
 		 */
 		if (!env->ops->convert_ctx_access) {
-			enum bpf_access_type atype = meta && meta->raw_mode ? BPF_WRITE : BPF_READ;
 			int offset = access_size - 1;
 
 			/* Allow zero-byte read from PTR_TO_CTX */
@@ -7226,7 +7300,7 @@
 				return zero_size_allowed ? 0 : -EACCES;
 
 			return check_mem_access(env, env->insn_idx, regno, offset, BPF_B,
-						atype, -1, false, false);
+						access_type, -1, false, false);
 		}
 
 		fallthrough;
@@ -7251,6 +7325,7 @@
  */
 static int check_mem_size_reg(struct bpf_verifier_env *env,
 			      struct bpf_reg_state *reg, u32 regno,
+			      enum bpf_access_type access_type,
 			      bool zero_size_allowed,
 			      struct bpf_call_arg_meta *meta)
 {
@@ -7266,15 +7341,12 @@
 	 */
 	meta->msize_max_value = reg->umax_value;
 
-	/* The register is SCALAR_VALUE; the access check
-	 * happens using its boundaries.
+	/* The register is SCALAR_VALUE; the access check happens using
+	 * its boundaries. For unprivileged variable accesses, disable
+	 * raw mode so that the program is required to initialize all
+	 * the memory that the helper could just partially fill up.
 	 */
 	if (!tnum_is_const(reg->var_off))
-		/* For unprivileged variable accesses, disable raw
-		 * mode so that the program is required to
-		 * initialize all the memory that the helper could
-		 * just partially fill up.
-		 */
 		meta = NULL;
 
 	if (reg->smin_value < 0) {
@@ -7294,9 +7366,8 @@
 			regno);
 		return -EACCES;
 	}
-	err = check_helper_mem_access(env, regno - 1,
-				      reg->umax_value,
-				      zero_size_allowed, meta);
+	err = check_helper_mem_access(env, regno - 1, reg->umax_value,
+				      access_type, zero_size_allowed, meta);
 	if (!err)
 		err = mark_chain_precision(env, regno);
 	return err;
@@ -7307,13 +7378,11 @@
 {
 	bool may_be_null = type_may_be_null(reg->type);
 	struct bpf_reg_state saved_reg;
-	struct bpf_call_arg_meta meta;
 	int err;
 
 	if (register_is_null(reg))
 		return 0;
 
-	memset(&meta, 0, sizeof(meta));
 	/* Assuming that the register contains a value check if the memory
 	 * access is safe. Temporarily save and restore the register's state as
 	 * the conversion shouldn't be visible to a caller.
@@ -7323,10 +7392,8 @@
 		mark_ptr_not_null_reg(reg);
 	}
 
-	err = check_helper_mem_access(env, regno, mem_size, true, &meta);
-	/* Check access for BPF_WRITE */
-	meta.raw_mode = true;
-	err = err ?: check_helper_mem_access(env, regno, mem_size, true, &meta);
+	err = check_helper_mem_access(env, regno, mem_size, BPF_READ, true, NULL);
+	err = err ?: check_helper_mem_access(env, regno, mem_size, BPF_WRITE, true, NULL);
 
 	if (may_be_null)
 		*reg = saved_reg;
@@ -7352,13 +7419,12 @@
 		mark_ptr_not_null_reg(mem_reg);
 	}
 
-	err = check_mem_size_reg(env, reg, regno, true, &meta);
-	/* Check access for BPF_WRITE */
-	meta.raw_mode = true;
-	err = err ?: check_mem_size_reg(env, reg, regno, true, &meta);
+	err = check_mem_size_reg(env, reg, regno, BPF_READ, true, &meta);
+	err = err ?: check_mem_size_reg(env, reg, regno, BPF_WRITE, true, &meta);
 
 	if (may_be_null)
 		*mem_reg = saved_reg;
+
 	return err;
 }
 
@@ -7568,6 +7634,13 @@
 	struct bpf_reg_state *regs = cur_regs(env), *reg = &regs[regno];
 	int err;
 
+	if (reg->type != PTR_TO_STACK && reg->type != CONST_PTR_TO_DYNPTR) {
+		verbose(env,
+			"arg#%d expected pointer to stack or const struct bpf_dynptr\n",
+			regno);
+		return -EINVAL;
+	}
+
 	/* MEM_UNINIT and MEM_RDONLY are exclusive, when applied to an
 	 * ARG_PTR_TO_DYNPTR (or ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_*):
 	 */
@@ -7679,6 +7752,11 @@
 	int spi, err, i, nr_slots;
 	u32 btf_id;
 
+	if (reg->type != PTR_TO_STACK) {
+		verbose(env, "arg#%d expected pointer to an iterator on stack\n", regno - 1);
+		return -EINVAL;
+	}
+
 	/* btf_check_iter_kfuncs() ensures we don't need to validate anything here */
 	arg = &btf_params(meta->func_proto)[0];
 	t = btf_type_skip_modifiers(meta->btf, arg->type, NULL);	/* PTR */
@@ -7818,6 +7896,15 @@
 	return 0;
 }
 
+static struct bpf_reg_state *get_iter_from_state(struct bpf_verifier_state *cur_st,
+						 struct bpf_kfunc_call_arg_meta *meta)
+{
+	int iter_frameno = meta->iter.frameno;
+	int iter_spi = meta->iter.spi;
+
+	return &cur_st->frame[iter_frameno]->stack[iter_spi].spilled_ptr;
+}
+
 /* process_iter_next_call() is called when verifier gets to iterator's next
  * "method" (e.g., bpf_iter_num_next() for numbers iterator) call. We'll refer
  * to it as just "iter_next()" in comments below.
@@ -7902,12 +7989,10 @@
 	struct bpf_verifier_state *cur_st = env->cur_state, *queued_st, *prev_st;
 	struct bpf_func_state *cur_fr = cur_st->frame[cur_st->curframe], *queued_fr;
 	struct bpf_reg_state *cur_iter, *queued_iter;
-	int iter_frameno = meta->iter.frameno;
-	int iter_spi = meta->iter.spi;
 
 	BTF_TYPE_EMIT(struct bpf_iter);
 
-	cur_iter = &env->cur_state->frame[iter_frameno]->stack[iter_spi].spilled_ptr;
+	cur_iter = get_iter_from_state(cur_st, meta);
 
 	if (cur_iter->iter.state != BPF_ITER_STATE_ACTIVE &&
 	    cur_iter->iter.state != BPF_ITER_STATE_DRAINED) {
@@ -7935,7 +8020,7 @@
 		if (!queued_st)
 			return -ENOMEM;
 
-		queued_iter = &queued_st->frame[iter_frameno]->stack[iter_spi].spilled_ptr;
+		queued_iter = get_iter_from_state(queued_st, meta);
 		queued_iter->iter.state = BPF_ITER_STATE_ACTIVE;
 		queued_iter->iter.depth++;
 		if (prev_st)
@@ -7959,6 +8044,12 @@
 	       type == ARG_CONST_SIZE_OR_ZERO;
 }
 
+static bool arg_type_is_raw_mem(enum bpf_arg_type type)
+{
+	return base_type(type) == ARG_PTR_TO_MEM &&
+	       type & MEM_UNINIT;
+}
+
 static bool arg_type_is_release(enum bpf_arg_type type)
 {
 	return type & OBJ_RELEASE;
@@ -7969,16 +8060,6 @@
 	return base_type(type) == ARG_PTR_TO_DYNPTR;
 }
 
-static int int_ptr_type_to_size(enum bpf_arg_type type)
-{
-	if (type == ARG_PTR_TO_INT)
-		return sizeof(u32);
-	else if (type == ARG_PTR_TO_LONG)
-		return sizeof(u64);
-
-	return -EINVAL;
-}
-
 static int resolve_map_arg_type(struct bpf_verifier_env *env,
 				 const struct bpf_call_arg_meta *meta,
 				 enum bpf_arg_type *arg_type)
@@ -8051,16 +8132,6 @@
 	},
 };
 
-static const struct bpf_reg_types int_ptr_types = {
-	.types = {
-		PTR_TO_STACK,
-		PTR_TO_PACKET,
-		PTR_TO_PACKET_META,
-		PTR_TO_MAP_KEY,
-		PTR_TO_MAP_VALUE,
-	},
-};
-
 static const struct bpf_reg_types spin_lock_types = {
 	.types = {
 		PTR_TO_MAP_VALUE,
@@ -8116,8 +8187,6 @@
 	[ARG_PTR_TO_SPIN_LOCK]		= &spin_lock_types,
 	[ARG_PTR_TO_MEM]		= &mem_types,
 	[ARG_PTR_TO_RINGBUF_MEM]	= &ringbuf_mem_types,
-	[ARG_PTR_TO_INT]		= &int_ptr_types,
-	[ARG_PTR_TO_LONG]		= &int_ptr_types,
 	[ARG_PTR_TO_PERCPU_BTF_ID]	= &percpu_btf_ptr_types,
 	[ARG_PTR_TO_FUNC]		= &func_ptr_types,
 	[ARG_PTR_TO_STACK]		= &stack_ptr_types,
@@ -8615,9 +8684,8 @@
 			verbose(env, "invalid map_ptr to access map->key\n");
 			return -EACCES;
 		}
-		err = check_helper_mem_access(env, regno,
-					      meta->map_ptr->key_size, false,
-					      NULL);
+		err = check_helper_mem_access(env, regno, meta->map_ptr->key_size,
+					      BPF_READ, false, NULL);
 		break;
 	case ARG_PTR_TO_MAP_VALUE:
 		if (type_may_be_null(arg_type) && register_is_null(reg))
@@ -8632,9 +8700,9 @@
 			return -EACCES;
 		}
 		meta->raw_mode = arg_type & MEM_UNINIT;
-		err = check_helper_mem_access(env, regno,
-					      meta->map_ptr->value_size, false,
-					      meta);
+		err = check_helper_mem_access(env, regno, meta->map_ptr->value_size,
+					      arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ,
+					      false, meta);
 		break;
 	case ARG_PTR_TO_PERCPU_BTF_ID:
 		if (!reg->btf_id) {
@@ -8676,16 +8744,26 @@
 		 */
 		meta->raw_mode = arg_type & MEM_UNINIT;
 		if (arg_type & MEM_FIXED_SIZE) {
-			err = check_helper_mem_access(env, regno,
-						      fn->arg_size[arg], false,
-						      meta);
+			err = check_helper_mem_access(env, regno, fn->arg_size[arg],
+						      arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ,
+						      false, meta);
+			if (err)
+				return err;
+			if (arg_type & MEM_ALIGNED)
+				err = check_ptr_alignment(env, reg, 0, fn->arg_size[arg], true);
 		}
 		break;
 	case ARG_CONST_SIZE:
-		err = check_mem_size_reg(env, reg, regno, false, meta);
+		err = check_mem_size_reg(env, reg, regno,
+					 fn->arg_type[arg - 1] & MEM_WRITE ?
+					 BPF_WRITE : BPF_READ,
+					 false, meta);
 		break;
 	case ARG_CONST_SIZE_OR_ZERO:
-		err = check_mem_size_reg(env, reg, regno, true, meta);
+		err = check_mem_size_reg(env, reg, regno,
+					 fn->arg_type[arg - 1] & MEM_WRITE ?
+					 BPF_WRITE : BPF_READ,
+					 true, meta);
 		break;
 	case ARG_PTR_TO_DYNPTR:
 		err = process_dynptr_func(env, regno, insn_idx, arg_type, 0);
@@ -8703,17 +8781,6 @@
 		if (err)
 			return err;
 		break;
-	case ARG_PTR_TO_INT:
-	case ARG_PTR_TO_LONG:
-	{
-		int size = int_ptr_type_to_size(arg_type);
-
-		err = check_helper_mem_access(env, regno, size, false, meta);
-		if (err)
-			return err;
-		err = check_ptr_alignment(env, reg, 0, size, true);
-		break;
-	}
 	case ARG_PTR_TO_CONST_STR:
 	{
 		err = check_reg_const_str(env, reg, regno);
@@ -8736,7 +8803,8 @@
 	enum bpf_attach_type eatype = env->prog->expected_attach_type;
 	enum bpf_prog_type type = resolve_prog_type(env->prog);
 
-	if (func_id != BPF_FUNC_map_update_elem)
+	if (func_id != BPF_FUNC_map_update_elem &&
+	    func_id != BPF_FUNC_map_delete_elem)
 		return false;
 
 	/* It's not possible to get access to a locked struct sock in these
@@ -8747,6 +8815,11 @@
 		if (eatype == BPF_TRACE_ITER)
 			return true;
 		break;
+	case BPF_PROG_TYPE_SOCK_OPS:
+		/* map_update allowed only via dedicated helpers with event type checks */
+		if (func_id == BPF_FUNC_map_delete_elem)
+			return true;
+		break;
 	case BPF_PROG_TYPE_SOCKET_FILTER:
 	case BPF_PROG_TYPE_SCHED_CLS:
 	case BPF_PROG_TYPE_SCHED_ACT:
@@ -8842,7 +8915,6 @@
 	case BPF_MAP_TYPE_SOCKMAP:
 		if (func_id != BPF_FUNC_sk_redirect_map &&
 		    func_id != BPF_FUNC_sock_map_update &&
-		    func_id != BPF_FUNC_map_delete_elem &&
 		    func_id != BPF_FUNC_msg_redirect_map &&
 		    func_id != BPF_FUNC_sk_select_reuseport &&
 		    func_id != BPF_FUNC_map_lookup_elem &&
@@ -8852,7 +8924,6 @@
 	case BPF_MAP_TYPE_SOCKHASH:
 		if (func_id != BPF_FUNC_sk_redirect_hash &&
 		    func_id != BPF_FUNC_sock_hash_update &&
-		    func_id != BPF_FUNC_map_delete_elem &&
 		    func_id != BPF_FUNC_msg_redirect_hash &&
 		    func_id != BPF_FUNC_sk_select_reuseport &&
 		    func_id != BPF_FUNC_map_lookup_elem &&
@@ -9026,15 +9097,15 @@
 {
 	int count = 0;
 
-	if (fn->arg1_type == ARG_PTR_TO_UNINIT_MEM)
+	if (arg_type_is_raw_mem(fn->arg1_type))
 		count++;
-	if (fn->arg2_type == ARG_PTR_TO_UNINIT_MEM)
+	if (arg_type_is_raw_mem(fn->arg2_type))
 		count++;
-	if (fn->arg3_type == ARG_PTR_TO_UNINIT_MEM)
+	if (arg_type_is_raw_mem(fn->arg3_type))
 		count++;
-	if (fn->arg4_type == ARG_PTR_TO_UNINIT_MEM)
+	if (arg_type_is_raw_mem(fn->arg4_type))
 		count++;
-	if (fn->arg5_type == ARG_PTR_TO_UNINIT_MEM)
+	if (arg_type_is_raw_mem(fn->arg5_type))
 		count++;
 
 	/* We only support one arg being in raw mode at the moment,
@@ -9299,6 +9370,10 @@
 				return -EINVAL;
 			}
 		} else if (arg->arg_type == (ARG_PTR_TO_DYNPTR | MEM_RDONLY)) {
+			ret = check_func_arg_reg_off(env, reg, regno, ARG_PTR_TO_DYNPTR);
+			if (ret)
+				return ret;
+
 			ret = process_dynptr_func(env, regno, -1, arg->arg_type, 0);
 			if (ret)
 				return ret;
@@ -9711,9 +9786,13 @@
 	return is_rbtree_lock_required_kfunc(kfunc_btf_id);
 }
 
-static bool retval_range_within(struct bpf_retval_range range, const struct bpf_reg_state *reg)
+static bool retval_range_within(struct bpf_retval_range range, const struct bpf_reg_state *reg,
+				bool return_32bit)
 {
-	return range.minval <= reg->smin_value && reg->smax_value <= range.maxval;
+	if (return_32bit)
+		return range.minval <= reg->s32_min_value && reg->s32_max_value <= range.maxval;
+	else
+		return range.minval <= reg->smin_value && reg->smax_value <= range.maxval;
 }
 
 static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
@@ -9750,8 +9829,8 @@
 		if (err)
 			return err;
 
-		/* enforce R0 return value range */
-		if (!retval_range_within(callee->callback_ret_range, r0)) {
+		/* enforce R0 return value range, and bpf_callback_t returns 64bit */
+		if (!retval_range_within(callee->callback_ret_range, r0, false)) {
 			verbose_invalid_scalar(env, r0, callee->callback_ret_range,
 					       "At callback return", "R0");
 			return -EINVAL;
@@ -10100,7 +10179,7 @@
 	}
 
 	/* With LD_ABS/IND some JITs save/restore skb from r1. */
-	changes_data = bpf_helper_changes_pkt_data(fn->func);
+	changes_data = bpf_helper_changes_pkt_data(func_id);
 	if (changes_data && fn->arg1_type != ARG_PTR_TO_CTX) {
 		verbose(env, "kernel subsystem misconfigured func %s#%d: r1 != ctx\n",
 			func_id_name(func_id), func_id);
@@ -10205,11 +10284,21 @@
 
 	switch (func_id) {
 	case BPF_FUNC_tail_call:
+		if (env->cur_state->active_lock.ptr) {
+			verbose(env, "tail_call cannot be used inside bpf_spin_lock-ed region\n");
+			return -EINVAL;
+		}
+
 		err = check_reference_leak(env, false);
 		if (err) {
 			verbose(env, "tail_call would lead to reference leak\n");
 			return err;
 		}
+
+		if (env->cur_state->active_rcu_lock) {
+			verbose(env, "tail_call cannot be used inside bpf_rcu_read_lock-ed region\n");
+			return -EINVAL;
+		}
 		break;
 	case BPF_FUNC_get_local_storage:
 		/* check that flags argument in get_local_storage(map, flags) is 0,
@@ -11689,12 +11778,6 @@
 			enum bpf_arg_type dynptr_arg_type = ARG_PTR_TO_DYNPTR;
 			int clone_ref_obj_id = 0;
 
-			if (reg->type != PTR_TO_STACK &&
-			    reg->type != CONST_PTR_TO_DYNPTR) {
-				verbose(env, "arg#%d expected pointer to stack or dynptr_ptr\n", i);
-				return -EINVAL;
-			}
-
 			if (reg->type == CONST_PTR_TO_DYNPTR)
 				dynptr_arg_type |= MEM_RDONLY;
 
@@ -12326,6 +12409,17 @@
 			regs[BPF_REG_0].btf = desc_btf;
 			regs[BPF_REG_0].type = PTR_TO_BTF_ID;
 			regs[BPF_REG_0].btf_id = ptr_type_id;
+
+			if (is_iter_next_kfunc(&meta)) {
+				struct bpf_reg_state *cur_iter;
+
+				cur_iter = get_iter_from_state(env->cur_state, &meta);
+
+				if (cur_iter->type & MEM_RCU) /* KF_RCU_PROTECTED */
+					regs[BPF_REG_0].type |= MEM_RCU;
+				else
+					regs[BPF_REG_0].type |= PTR_TRUSTED;
+			}
 		}
 
 		if (is_kfunc_ret_null(&meta)) {
@@ -14789,8 +14883,11 @@
 	struct bpf_reg_state *reg;
 
 	bpf_for_each_reg_in_vstate(vstate, state, reg, ({
-		if (reg->type == SCALAR_VALUE && reg->id == known_reg->id)
+		if (reg->type == SCALAR_VALUE && reg->id == known_reg->id) {
+			s32 saved_subreg_def = reg->subreg_def;
 			copy_register_state(reg, known_reg);
+			reg->subreg_def = saved_subreg_def;
+		}
 	}));
 }
 
@@ -14802,7 +14899,6 @@
 	struct bpf_reg_state *regs = this_branch->frame[this_branch->curframe]->regs;
 	struct bpf_reg_state *dst_reg, *other_branch_regs, *src_reg = NULL;
 	struct bpf_reg_state *eq_branch_regs;
-	struct bpf_reg_state fake_reg = {};
 	u8 opcode = BPF_OP(insn->code);
 	bool is_jmp32;
 	int pred = -1;
@@ -14843,7 +14939,8 @@
 			verbose(env, "BPF_JMP/JMP32 uses reserved fields\n");
 			return -EINVAL;
 		}
-		src_reg = &fake_reg;
+		src_reg = &env->fake_reg[0];
+		memset(src_reg, 0, sizeof(*src_reg));
 		src_reg->type = SCALAR_VALUE;
 		__mark_reg_known(src_reg, insn->imm);
 	}
@@ -14903,10 +15000,16 @@
 				      &other_branch_regs[insn->src_reg],
 				      dst_reg, src_reg, opcode, is_jmp32);
 	} else /* BPF_SRC(insn->code) == BPF_K */ {
+		/* reg_set_min_max() can mangle the fake_reg. Make a copy
+		 * so that these are two different memory locations. The
+		 * src_reg is not used beyond here in context of K.
+		 */
+		memcpy(&env->fake_reg[1], &env->fake_reg[0],
+		       sizeof(env->fake_reg[0]));
 		err = reg_set_min_max(env,
 				      &other_branch_regs[insn->dst_reg],
-				      src_reg /* fake one */,
-				      dst_reg, src_reg /* same fake one */,
+				      &env->fake_reg[0],
+				      dst_reg, &env->fake_reg[1],
 				      opcode, is_jmp32);
 	}
 	if (err)
@@ -15200,6 +15303,7 @@
 	int err;
 	struct bpf_func_state *frame = env->cur_state->frame[0];
 	const bool is_subprog = frame->subprogno;
+	bool return_32bit = false;
 
 	/* LSM and struct_ops func-ptr's return type could be "void" */
 	if (!is_subprog || frame->in_exception_callback_fn) {
@@ -15305,12 +15409,14 @@
 
 	case BPF_PROG_TYPE_LSM:
 		if (env->prog->expected_attach_type != BPF_LSM_CGROUP) {
-			/* Regular BPF_PROG_TYPE_LSM programs can return
-			 * any value.
-			 */
-			return 0;
-		}
-		if (!env->prog->aux->attach_func_proto->type) {
+			/* no range found, any return value is allowed */
+			if (!get_func_retval_range(env->prog, &range))
+				return 0;
+			/* no restricted range, any return value is allowed */
+			if (range.minval == S32_MIN && range.maxval == S32_MAX)
+				return 0;
+			return_32bit = true;
+		} else if (!env->prog->aux->attach_func_proto->type) {
 			/* Make sure programs that attach to void
 			 * hooks don't try to modify return value.
 			 */
@@ -15340,7 +15446,7 @@
 	if (err)
 		return err;
 
-	if (!retval_range_within(range, reg)) {
+	if (!retval_range_within(range, reg, return_32bit)) {
 		verbose_invalid_scalar(env, reg, range, exit_ctx, reg_name);
 		if (!is_subprog &&
 		    prog->expected_attach_type == BPF_LSM_CGROUP &&
@@ -16462,8 +16568,9 @@
 		spi = i / BPF_REG_SIZE;
 
 		if (exact &&
-		    old->stack[spi].slot_type[i % BPF_REG_SIZE] !=
-		    cur->stack[spi].slot_type[i % BPF_REG_SIZE])
+		    (i >= cur->allocated_stack ||
+		     old->stack[spi].slot_type[i % BPF_REG_SIZE] !=
+		     cur->stack[spi].slot_type[i % BPF_REG_SIZE]))
 			return false;
 
 		if (!(old->stack[spi].spilled_ptr.live & REG_LIVE_READ) && !exact) {
@@ -16921,9 +17028,11 @@
 	struct bpf_verifier_state_list *sl, **pprev;
 	struct bpf_verifier_state *cur = env->cur_state, *new, *loop_entry;
 	int i, j, n, err, states_cnt = 0;
-	bool force_new_state = env->test_state_freq || is_force_checkpoint(env, insn_idx);
-	bool add_new_state = force_new_state;
-	bool force_exact;
+	bool force_new_state, add_new_state, force_exact;
+
+	force_new_state = env->test_state_freq || is_force_checkpoint(env, insn_idx) ||
+			  /* Avoid accumulating infinitely long jmp history */
+			  cur->jmp_history_cnt > 40;
 
 	/* bpf progs typically have pruning point every 4 instructions
 	 * http://vger.kernel.org/bpfconf2019.html#session-1
@@ -16933,6 +17042,7 @@
 	 * In tests that amounts to up to 50% reduction into total verifier
 	 * memory consumption and 20% verifier time speedup.
 	 */
+	add_new_state = force_new_state;
 	if (env->jmps_processed - env->prev_jmps_processed >= 2 &&
 	    env->insn_processed - env->prev_insn_processed >= 8)
 		add_new_state = true;
@@ -18035,8 +18145,7 @@
 			f = fdget(fd);
 			map = __bpf_map_get(f);
 			if (IS_ERR(map)) {
-				verbose(env, "fd %d is not pointing to valid bpf_map\n",
-					insn[0].imm);
+				verbose(env, "fd %d is not pointing to valid bpf_map\n", fd);
 				return PTR_ERR(map);
 			}
 
@@ -18989,10 +19098,14 @@
 	 * bpf_prog_load will add the kallsyms for the main program.
 	 */
 	for (i = 1; i < env->subprog_cnt; i++) {
-		bpf_prog_lock_ro(func[i]);
-		bpf_prog_kallsyms_add(func[i]);
+		err = bpf_prog_lock_ro(func[i]);
+		if (err)
+			goto out_free;
 	}
 
+	for (i = 1; i < env->subprog_cnt; i++)
+		bpf_prog_kallsyms_add(func[i]);
+
 	/* Last step: make now unused interpreter insns from main
 	 * prog consistent for later dump requests, so they can
 	 * later look the same as if they were interpreted only.
@@ -19320,13 +19433,46 @@
 	}
 
 	for (i = 0; i < insn_cnt; i++, insn++) {
-		/* Make divide-by-zero exceptions impossible. */
+		/* Make sdiv/smod divide-by-minus-one exceptions impossible. */
+		if ((insn->code == (BPF_ALU64 | BPF_MOD | BPF_K) ||
+		     insn->code == (BPF_ALU64 | BPF_DIV | BPF_K) ||
+		     insn->code == (BPF_ALU | BPF_MOD | BPF_K) ||
+		     insn->code == (BPF_ALU | BPF_DIV | BPF_K)) &&
+		    insn->off == 1 && insn->imm == -1) {
+			bool is64 = BPF_CLASS(insn->code) == BPF_ALU64;
+			bool isdiv = BPF_OP(insn->code) == BPF_DIV;
+			struct bpf_insn *patchlet;
+			struct bpf_insn chk_and_sdiv[] = {
+				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |
+					     BPF_NEG | BPF_K, insn->dst_reg,
+					     0, 0, 0),
+			};
+			struct bpf_insn chk_and_smod[] = {
+				BPF_MOV32_IMM(insn->dst_reg, 0),
+			};
+
+			patchlet = isdiv ? chk_and_sdiv : chk_and_smod;
+			cnt = isdiv ? ARRAY_SIZE(chk_and_sdiv) : ARRAY_SIZE(chk_and_smod);
+
+			new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt);
+			if (!new_prog)
+				return -ENOMEM;
+
+			delta    += cnt - 1;
+			env->prog = prog = new_prog;
+			insn      = new_prog->insnsi + i + delta;
+			continue;
+		}
+
+		/* Make divide-by-zero and divide-by-minus-one exceptions impossible. */
 		if (insn->code == (BPF_ALU64 | BPF_MOD | BPF_X) ||
 		    insn->code == (BPF_ALU64 | BPF_DIV | BPF_X) ||
 		    insn->code == (BPF_ALU | BPF_MOD | BPF_X) ||
 		    insn->code == (BPF_ALU | BPF_DIV | BPF_X)) {
 			bool is64 = BPF_CLASS(insn->code) == BPF_ALU64;
 			bool isdiv = BPF_OP(insn->code) == BPF_DIV;
+			bool is_sdiv = isdiv && insn->off == 1;
+			bool is_smod = !isdiv && insn->off == 1;
 			struct bpf_insn *patchlet;
 			struct bpf_insn chk_and_div[] = {
 				/* [R,W]x div 0 -> 0 */
@@ -19346,10 +19492,62 @@
 				BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 				BPF_MOV32_REG(insn->dst_reg, insn->dst_reg),
 			};
+			struct bpf_insn chk_and_sdiv[] = {
+				/* [R,W]x sdiv 0 -> 0
+				 * LLONG_MIN sdiv -1 -> LLONG_MIN
+				 * INT_MIN sdiv -1 -> INT_MIN
+				 */
+				BPF_MOV64_REG(BPF_REG_AX, insn->src_reg),
+				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |
+					     BPF_ADD | BPF_K, BPF_REG_AX,
+					     0, 0, 1),
+				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |
+					     BPF_JGT | BPF_K, BPF_REG_AX,
+					     0, 4, 1),
+				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |
+					     BPF_JEQ | BPF_K, BPF_REG_AX,
+					     0, 1, 0),
+				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |
+					     BPF_MOV | BPF_K, insn->dst_reg,
+					     0, 0, 0),
+				/* BPF_NEG(LLONG_MIN) == -LLONG_MIN == LLONG_MIN */
+				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |
+					     BPF_NEG | BPF_K, insn->dst_reg,
+					     0, 0, 0),
+				BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+				*insn,
+			};
+			struct bpf_insn chk_and_smod[] = {
+				/* [R,W]x mod 0 -> [R,W]x */
+				/* [R,W]x mod -1 -> 0 */
+				BPF_MOV64_REG(BPF_REG_AX, insn->src_reg),
+				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |
+					     BPF_ADD | BPF_K, BPF_REG_AX,
+					     0, 0, 1),
+				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |
+					     BPF_JGT | BPF_K, BPF_REG_AX,
+					     0, 3, 1),
+				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |
+					     BPF_JEQ | BPF_K, BPF_REG_AX,
+					     0, 3 + (is64 ? 0 : 1), 1),
+				BPF_MOV32_IMM(insn->dst_reg, 0),
+				BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+				*insn,
+				BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+				BPF_MOV32_REG(insn->dst_reg, insn->dst_reg),
+			};
 
-			patchlet = isdiv ? chk_and_div : chk_and_mod;
-			cnt = isdiv ? ARRAY_SIZE(chk_and_div) :
-				      ARRAY_SIZE(chk_and_mod) - (is64 ? 2 : 0);
+			if (is_sdiv) {
+				patchlet = chk_and_sdiv;
+				cnt = ARRAY_SIZE(chk_and_sdiv);
+			} else if (is_smod) {
+				patchlet = chk_and_smod;
+				cnt = ARRAY_SIZE(chk_and_smod) - (is64 ? 2 : 0);
+			} else {
+				patchlet = isdiv ? chk_and_div : chk_and_mod;
+				cnt = isdiv ? ARRAY_SIZE(chk_and_div) :
+					      ARRAY_SIZE(chk_and_mod) - (is64 ? 2 : 0);
+			}
 
 			new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt);
 			if (!new_prog)
@@ -20752,7 +20950,7 @@
 	/* 'struct bpf_verifier_env' can be global, but since it's not small,
 	 * allocate/free it every time bpf_check() is called
 	 */
-	env = kzalloc(sizeof(struct bpf_verifier_env), GFP_KERNEL);
+	env = kvzalloc(sizeof(struct bpf_verifier_env), GFP_KERNEL);
 	if (!env)
 		return -ENOMEM;
 
@@ -20977,6 +21175,6 @@
 		mutex_unlock(&bpf_verifier_lock);
 	vfree(env->insn_aux_data);
 err_free_env:
-	kfree(env);
+	kvfree(env);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/kernel/cgroup/cgroup.c
+++ linux-qcom-6.8.0/kernel/cgroup/cgroup.c
@@ -1839,9 +1839,9 @@
 		RCU_INIT_POINTER(scgrp->subsys[ssid], NULL);
 		rcu_assign_pointer(dcgrp->subsys[ssid], css);
 		ss->root = dst_root;
-		css->cgroup = dcgrp;
 
 		spin_lock_irq(&css_set_lock);
+		css->cgroup = dcgrp;
 		WARN_ON(!list_empty(&dcgrp->e_csets[ss->id]));
 		list_for_each_entry_safe(cset, cset_pos, &scgrp->e_csets[ss->id],
 					 e_cset_node[ss->id]) {
@@ -2118,8 +2118,10 @@
 	if (ret)
 		goto exit_stats;
 
-	ret = cgroup_bpf_inherit(root_cgrp);
-	WARN_ON_ONCE(ret);
+	if (root == &cgrp_dfl_root) {
+		ret = cgroup_bpf_inherit(root_cgrp);
+		WARN_ON_ONCE(ret);
+	}
 
 	trace_cgroup_setup_root(root);
 
@@ -2292,10 +2294,8 @@
 	 * And don't kill the default root.
 	 */
 	if (list_empty(&root->cgrp.self.children) && root != &cgrp_dfl_root &&
-	    !percpu_ref_is_dying(&root->cgrp.self.refcnt)) {
-		cgroup_bpf_offline(&root->cgrp);
+	    !percpu_ref_is_dying(&root->cgrp.self.refcnt))
 		percpu_ref_kill(&root->cgrp.self.refcnt);
-	}
 	cgroup_put(&root->cgrp);
 	kernfs_kill_sb(sb);
 }
@@ -5627,9 +5627,11 @@
 	if (ret)
 		goto out_kernfs_remove;
 
-	ret = cgroup_bpf_inherit(cgrp);
-	if (ret)
-		goto out_psi_free;
+	if (cgrp->root == &cgrp_dfl_root) {
+		ret = cgroup_bpf_inherit(cgrp);
+		if (ret)
+			goto out_psi_free;
+	}
 
 	/*
 	 * New cgroup inherits effective freeze counter, and
@@ -5706,7 +5708,7 @@
 {
 	struct cgroup *cgroup;
 	int ret = false;
-	int level = 1;
+	int level = 0;
 
 	lockdep_assert_held(&cgroup_mutex);
 
@@ -5714,7 +5716,7 @@
 		if (cgroup->nr_descendants >= cgroup->max_descendants)
 			goto fail;
 
-		if (level > cgroup->max_depth)
+		if (level >= cgroup->max_depth)
 			goto fail;
 
 		level++;
@@ -5943,7 +5945,8 @@
 
 	cgroup1_check_for_release(parent);
 
-	cgroup_bpf_offline(cgrp);
+	if (cgrp->root == &cgrp_dfl_root)
+		cgroup_bpf_offline(cgrp);
 
 	/* put the base reference */
 	percpu_ref_kill(&cgrp->self.refcnt);
--- linux-qcom-6.8.0.orig/kernel/cgroup/cpuset.c
+++ linux-qcom-6.8.0/kernel/cgroup/cpuset.c
@@ -21,6 +21,7 @@
  *  License.  See the file COPYING in the main directory of the Linux
  *  distribution for more details.
  */
+#include "cgroup-internal.h"
 
 #include <linux/cpu.h>
 #include <linux/cpumask.h>
@@ -169,7 +170,7 @@
 	/* for custom sched domain */
 	int relax_domain_level;
 
-	/* number of valid sub-partitions */
+	/* number of valid local child partitions */
 	int nr_subparts;
 
 	/* partition root state */
@@ -202,6 +203,14 @@
 };
 
 /*
+ * Legacy hierarchy call to cgroup_transfer_tasks() is handled asynchrously
+ */
+struct cpuset_remove_tasks_struct {
+	struct work_struct work;
+	struct cpuset *cs;
+};
+
+/*
  * Exclusive CPUs distributed out to sub-partitions of top_cpuset
  */
 static cpumask_var_t	subpartitions_cpus;
@@ -215,6 +224,13 @@
 static struct list_head remote_children;
 
 /*
+ * A flag to force sched domain rebuild at the end of an operation while
+ * inhibiting it in the intermediate stages when set. Currently it is only
+ * set in hotplug code.
+ */
+static bool force_sd_rebuild;
+
+/*
  * Partition root states:
  *
  *   0 - member (not a partition root)
@@ -449,12 +465,6 @@
 
 static struct workqueue_struct *cpuset_migrate_mm_wq;
 
-/*
- * CPU / memory hotplug is handled asynchronously.
- */
-static void cpuset_hotplug_workfn(struct work_struct *work);
-static DECLARE_WORK(cpuset_hotplug_work, cpuset_hotplug_workfn);
-
 static DECLARE_WAIT_QUEUE_HEAD(cpuset_attach_wq);
 
 static inline void check_insane_mems_config(nodemask_t *nodes)
@@ -540,22 +550,10 @@
 	rcu_read_lock();
 	cs = task_cs(tsk);
 
-	while (!cpumask_intersects(cs->effective_cpus, pmask)) {
+	while (!cpumask_intersects(cs->effective_cpus, pmask))
 		cs = parent_cs(cs);
-		if (unlikely(!cs)) {
-			/*
-			 * The top cpuset doesn't have any online cpu as a
-			 * consequence of a race between cpuset_hotplug_work
-			 * and cpu hotplug notifier.  But we know the top
-			 * cpuset's effective_cpus is on its way to be
-			 * identical to cpu_online_mask.
-			 */
-			goto out_unlock;
-		}
-	}
-	cpumask_and(pmask, pmask, cs->effective_cpus);
 
-out_unlock:
+	cpumask_and(pmask, pmask, cs->effective_cpus);
 	rcu_read_unlock();
 }
 
@@ -834,17 +832,41 @@
 
 	/*
 	 * If either I or some sibling (!= me) is exclusive, we can't
-	 * overlap
+	 * overlap. exclusive_cpus cannot overlap with each other if set.
 	 */
 	ret = -EINVAL;
 	cpuset_for_each_child(c, css, par) {
-		if ((is_cpu_exclusive(trial) || is_cpu_exclusive(c)) &&
-		    c != cur) {
+		bool txset, cxset;	/* Are exclusive_cpus set? */
+
+		if (c == cur)
+			continue;
+
+		txset = !cpumask_empty(trial->exclusive_cpus);
+		cxset = !cpumask_empty(c->exclusive_cpus);
+		if (is_cpu_exclusive(trial) || is_cpu_exclusive(c) ||
+		    (txset && cxset)) {
 			if (!cpusets_are_exclusive(trial, c))
 				goto out;
+		} else if (txset || cxset) {
+			struct cpumask *xcpus, *acpus;
+
+			/*
+			 * When just one of the exclusive_cpus's is set,
+			 * cpus_allowed of the other cpuset, if set, cannot be
+			 * a subset of it or none of those CPUs will be
+			 * available if these exclusive CPUs are activated.
+			 */
+			if (txset) {
+				xcpus = trial->exclusive_cpus;
+				acpus = c->cpus_allowed;
+			} else {
+				xcpus = c->exclusive_cpus;
+				acpus = trial->cpus_allowed;
+			}
+			if (!cpumask_empty(acpus) && cpumask_subset(acpus, xcpus))
+				goto out;
 		}
 		if ((is_mem_exclusive(trial) || is_mem_exclusive(c)) &&
-		    c != cur &&
 		    nodes_intersects(trial->mems_allowed, c->mems_allowed))
 			goto out;
 	}
@@ -966,13 +988,15 @@
 	int nslot;		/* next empty doms[] struct cpumask slot */
 	struct cgroup_subsys_state *pos_css;
 	bool root_load_balance = is_sched_load_balance(&top_cpuset);
+	bool cgrpv2 = cgroup_subsys_on_dfl(cpuset_cgrp_subsys);
 
 	doms = NULL;
 	dattr = NULL;
 	csa = NULL;
 
 	/* Special case for the 99% of systems with one, full, sched domain */
-	if (root_load_balance && !top_cpuset.nr_subparts) {
+	if (root_load_balance && cpumask_empty(subpartitions_cpus)) {
+single_root_domain:
 		ndoms = 1;
 		doms = alloc_sched_domains(ndoms);
 		if (!doms)
@@ -1000,16 +1024,18 @@
 	cpuset_for_each_descendant_pre(cp, pos_css, &top_cpuset) {
 		if (cp == &top_cpuset)
 			continue;
+
+		if (cgrpv2)
+			goto v2;
+
 		/*
+		 * v1:
 		 * Continue traversing beyond @cp iff @cp has some CPUs and
 		 * isn't load balancing.  The former is obvious.  The
 		 * latter: All child cpusets contain a subset of the
 		 * parent's cpus, so just skip them, and then we call
 		 * update_domain_attr_tree() to calc relax_domain_level of
 		 * the corresponding sched domain.
-		 *
-		 * If root is load-balancing, we can skip @cp if it
-		 * is a subset of the root's effective_cpus.
 		 */
 		if (!cpumask_empty(cp->cpus_allowed) &&
 		    !(is_sched_load_balance(cp) &&
@@ -1017,20 +1043,39 @@
 					 housekeeping_cpumask(HK_TYPE_DOMAIN))))
 			continue;
 
-		if (root_load_balance &&
-		    cpumask_subset(cp->cpus_allowed, top_cpuset.effective_cpus))
-			continue;
-
 		if (is_sched_load_balance(cp) &&
 		    !cpumask_empty(cp->effective_cpus))
 			csa[csn++] = cp;
 
-		/* skip @cp's subtree if not a partition root */
-		if (!is_partition_valid(cp))
+		/* skip @cp's subtree */
+		pos_css = css_rightmost_descendant(pos_css);
+		continue;
+
+v2:
+		/*
+		 * Only valid partition roots that are not isolated and with
+		 * non-empty effective_cpus will be saved into csn[].
+		 */
+		if ((cp->partition_root_state == PRS_ROOT) &&
+		    !cpumask_empty(cp->effective_cpus))
+			csa[csn++] = cp;
+
+		/*
+		 * Skip @cp's subtree if not a partition root and has no
+		 * exclusive CPUs to be granted to child cpusets.
+		 */
+		if (!is_partition_valid(cp) && cpumask_empty(cp->exclusive_cpus))
 			pos_css = css_rightmost_descendant(pos_css);
 	}
 	rcu_read_unlock();
 
+	/*
+	 * If there are only isolated partitions underneath the cgroup root,
+	 * we can optimize out unneeded sched domains scanning.
+	 */
+	if (root_load_balance && (csn == 1))
+		goto single_root_domain;
+
 	for (i = 0; i < csn; i++)
 		csa[i]->pn = i;
 	ndoms = csn;
@@ -1073,6 +1118,28 @@
 	dattr = kmalloc_array(ndoms, sizeof(struct sched_domain_attr),
 			      GFP_KERNEL);
 
+	/*
+	 * Cgroup v2 doesn't support domain attributes, just set all of them
+	 * to SD_ATTR_INIT. Also non-isolating partition root CPUs are a
+	 * subset of HK_TYPE_DOMAIN housekeeping CPUs.
+	 */
+	if (cgrpv2) {
+		for (i = 0; i < ndoms; i++) {
+			/*
+			 * The top cpuset may contain some boot time isolated
+			 * CPUs that need to be excluded from the sched domain.
+			 */
+			if (csa[i] == &top_cpuset)
+				cpumask_and(doms[i], csa[i]->effective_cpus,
+					    housekeeping_cpumask(HK_TYPE_DOMAIN));
+			else
+				cpumask_copy(doms[i], csa[i]->effective_cpus);
+			if (dattr)
+				dattr[i] = SD_ATTR_INIT;
+		}
+		goto done;
+	}
+
 	for (nslot = 0, i = 0; i < csn; i++) {
 		struct cpuset *a = csa[i];
 		struct cpumask *dp;
@@ -1217,7 +1284,7 @@
 	/*
 	 * If we have raced with CPU hotplug, return early to avoid
 	 * passing doms with offlined cpu to partition_sched_domains().
-	 * Anyways, cpuset_hotplug_workfn() will rebuild sched domains.
+	 * Anyways, cpuset_handle_hotplug() will rebuild sched domains.
 	 *
 	 * With no CPUs in any subpartitions, top_cpuset's effective CPUs
 	 * should be the same as the active CPUs, so checking only top_cpuset
@@ -1232,7 +1299,7 @@
 	 * root should be only a subset of the active CPUs.  Since a CPU in any
 	 * partition root could be offlined, all must be checked.
 	 */
-	if (top_cpuset.nr_subparts) {
+	if (!cpumask_empty(subpartitions_cpus)) {
 		rcu_read_lock();
 		cpuset_for_each_descendant_pre(cs, pos_css, &top_cpuset) {
 			if (!is_partition_valid(cs)) {
@@ -1260,12 +1327,17 @@
 }
 #endif /* CONFIG_SMP */
 
-void rebuild_sched_domains(void)
+static void rebuild_sched_domains_cpuslocked(void)
 {
-	cpus_read_lock();
 	mutex_lock(&cpuset_mutex);
 	rebuild_sched_domains_locked();
 	mutex_unlock(&cpuset_mutex);
+}
+
+void rebuild_sched_domains(void)
+{
+	cpus_read_lock();
+	rebuild_sched_domains_cpuslocked();
 	cpus_read_unlock();
 }
 
@@ -1342,7 +1414,7 @@
  */
 static int update_partition_exclusive(struct cpuset *cs, int new_prs)
 {
-	bool exclusive = (new_prs > 0);
+	bool exclusive = (new_prs > PRS_MEMBER);
 
 	if (exclusive && !is_cpu_exclusive(cs)) {
 		if (update_flag(CS_CPU_EXCLUSIVE, cs, 1))
@@ -1384,7 +1456,7 @@
 			clear_bit(CS_SCHED_LOAD_BALANCE, &cs->flags);
 	}
 
-	if (rebuild_domains)
+	if (rebuild_domains && !force_sd_rebuild)
 		rebuild_sched_domains_locked();
 }
 
@@ -1747,7 +1819,7 @@
 			remote_partition_disable(child, tmp);
 			disable_cnt++;
 		}
-	if (disable_cnt)
+	if (disable_cnt && !force_sd_rebuild)
 		rebuild_sched_domains_locked();
 }
 
@@ -1906,6 +1978,8 @@
 			part_error = PERR_CPUSEMPTY;
 			goto write_error;
 		}
+		/* Check newmask again, whether cpus are available for parent/cs */
+		nocpu |= tasks_nocpu_error(parent, cs, newmask);
 
 		/*
 		 * partcmd_update with newmask:
@@ -2079,14 +2153,11 @@
 
 	/*
 	 * For partcmd_update without newmask, it is being called from
-	 * cpuset_hotplug_workfn() where cpus_read_lock() wasn't taken.
-	 * Update the load balance flag and scheduling domain if
-	 * cpus_read_trylock() is successful.
+	 * cpuset_handle_hotplug(). Update the load balance flag and
+	 * scheduling domain accordingly.
 	 */
-	if ((cmd == partcmd_update) && !newmask && cpus_read_trylock()) {
+	if ((cmd == partcmd_update) && !newmask)
 		update_partition_sd_lb(cs, old_prs);
-		cpus_read_unlock();
-	}
 
 	notify_partition_change(cs, old_prs);
 	return 0;
@@ -2358,7 +2429,8 @@
 	}
 	rcu_read_unlock();
 
-	if (need_rebuild_sched_domains && !(flags & HIER_NO_SD_REBUILD))
+	if (need_rebuild_sched_domains && !(flags & HIER_NO_SD_REBUILD) &&
+	    !force_sd_rebuild)
 		rebuild_sched_domains_locked();
 }
 
@@ -2441,7 +2513,8 @@
 	 */
 	if (!*buf) {
 		cpumask_clear(trialcs->cpus_allowed);
-		cpumask_clear(trialcs->effective_xcpus);
+		if (cpumask_empty(trialcs->exclusive_cpus))
+			cpumask_clear(trialcs->effective_xcpus);
 	} else {
 		retval = cpulist_parse(buf, trialcs->cpus_allowed);
 		if (retval < 0)
@@ -2590,8 +2663,6 @@
 		retval = cpulist_parse(buf, trialcs->exclusive_cpus);
 		if (retval < 0)
 			return retval;
-		if (!is_cpu_exclusive(cs))
-			set_bit(CS_CPU_EXCLUSIVE, &trialcs->flags);
 	}
 
 	/* Nothing to do if the CPUs didn't change */
@@ -2948,7 +3019,7 @@
 static int update_relax_domain_level(struct cpuset *cs, s64 val)
 {
 #ifdef CONFIG_SMP
-	if (val < -1 || val >= sched_domain_level_max)
+	if (val < -1 || val > sched_domain_level_max + 1)
 		return -EINVAL;
 #endif
 
@@ -3021,7 +3092,8 @@
 	cs->flags = trialcs->flags;
 	spin_unlock_irq(&callback_lock);
 
-	if (!cpumask_empty(trialcs->cpus_allowed) && balance_flag_changed)
+	if (!cpumask_empty(trialcs->cpus_allowed) && balance_flag_changed &&
+	    !force_sd_rebuild)
 		rebuild_sched_domains_locked();
 
 	if (spread_flag_changed)
@@ -3587,30 +3659,6 @@
 	int retval = -ENODEV;
 
 	buf = strstrip(buf);
-
-	/*
-	 * CPU or memory hotunplug may leave @cs w/o any execution
-	 * resources, in which case the hotplug code asynchronously updates
-	 * configuration and transfers all tasks to the nearest ancestor
-	 * which can execute.
-	 *
-	 * As writes to "cpus" or "mems" may restore @cs's execution
-	 * resources, wait for the previously scheduled operations before
-	 * proceeding, so that we don't end up keep removing tasks added
-	 * after execution capability is restored.
-	 *
-	 * cpuset_hotplug_work calls back into cgroup core via
-	 * cgroup_transfer_tasks() and waiting for it from a cgroupfs
-	 * operation like this one can lead to a deadlock through kernfs
-	 * active_ref protection.  Let's break the protection.  Losing the
-	 * protection is okay as we check whether @cs is online after
-	 * grabbing cpuset_mutex anyway.  This only happens on the legacy
-	 * hierarchies.
-	 */
-	css_get(&cs->css);
-	kernfs_break_active_protection(of->kn);
-	flush_work(&cpuset_hotplug_work);
-
 	cpus_read_lock();
 	mutex_lock(&cpuset_mutex);
 	if (!is_cpuset_online(cs))
@@ -3641,8 +3689,6 @@
 out_unlock:
 	mutex_unlock(&cpuset_mutex);
 	cpus_read_unlock();
-	kernfs_unbreak_active_protection(of->kn);
-	css_put(&cs->css);
 	flush_workqueue(cpuset_migrate_mm_wq);
 	return retval ?: nbytes;
 }
@@ -4353,6 +4399,16 @@
 	}
 }
 
+static void cpuset_migrate_tasks_workfn(struct work_struct *work)
+{
+	struct cpuset_remove_tasks_struct *s;
+
+	s = container_of(work, struct cpuset_remove_tasks_struct, work);
+	remove_tasks_in_empty_cpuset(s->cs);
+	css_put(&s->cs->css);
+	kfree(s);
+}
+
 static void
 hotplug_update_tasks_legacy(struct cpuset *cs,
 			    struct cpumask *new_cpus, nodemask_t *new_mems,
@@ -4382,12 +4438,21 @@
 	/*
 	 * Move tasks to the nearest ancestor with execution resources,
 	 * This is full cgroup operation which will also call back into
-	 * cpuset. Should be done outside any lock.
+	 * cpuset. Execute it asynchronously using workqueue.
 	 */
-	if (is_empty) {
-		mutex_unlock(&cpuset_mutex);
-		remove_tasks_in_empty_cpuset(cs);
-		mutex_lock(&cpuset_mutex);
+	if (is_empty && cs->css.cgroup->nr_populated_csets &&
+	    css_tryget_online(&cs->css)) {
+		struct cpuset_remove_tasks_struct *s;
+
+		s = kzalloc(sizeof(*s), GFP_KERNEL);
+		if (WARN_ON_ONCE(!s)) {
+			css_put(&cs->css);
+			return;
+		}
+
+		s->cs = cs;
+		INIT_WORK(&s->work, cpuset_migrate_tasks_workfn);
+		schedule_work(&s->work);
 	}
 }
 
@@ -4413,35 +4478,9 @@
 		update_tasks_nodemask(cs);
 }
 
-static bool force_rebuild;
-
 void cpuset_force_rebuild(void)
 {
-	force_rebuild = true;
-}
-
-/*
- * Attempt to acquire a cpus_read_lock while a hotplug operation may be in
- * progress.
- * Return: true if successful, false otherwise
- *
- * To avoid circular lock dependency between cpuset_mutex and cpus_read_lock,
- * cpus_read_trylock() is used here to acquire the lock.
- */
-static bool cpuset_hotplug_cpus_read_trylock(void)
-{
-	int retries = 0;
-
-	while (!cpus_read_trylock()) {
-		/*
-		 * CPU hotplug still in progress. Retry 5 times
-		 * with a 10ms wait before bailing out.
-		 */
-		if (++retries > 5)
-			return false;
-		msleep(10);
-	}
-	return true;
+	force_sd_rebuild = true;
 }
 
 /**
@@ -4492,13 +4531,11 @@
 		compute_partition_effective_cpumask(cs, &new_cpus);
 
 	if (remote && cpumask_empty(&new_cpus) &&
-	    partition_is_populated(cs, NULL) &&
-	    cpuset_hotplug_cpus_read_trylock()) {
+	    partition_is_populated(cs, NULL)) {
 		remote_partition_disable(cs, tmp);
 		compute_effective_cpumask(&new_cpus, cs, parent);
 		remote = false;
 		cpuset_force_rebuild();
-		cpus_read_unlock();
 	}
 
 	/*
@@ -4518,18 +4555,8 @@
 	else if (is_partition_valid(parent) && is_partition_invalid(cs))
 		partcmd = partcmd_update;
 
-	/*
-	 * cpus_read_lock needs to be held before calling
-	 * update_parent_effective_cpumask(). To avoid circular lock
-	 * dependency between cpuset_mutex and cpus_read_lock,
-	 * cpus_read_trylock() is used here to acquire the lock.
-	 */
 	if (partcmd >= 0) {
-		if (!cpuset_hotplug_cpus_read_trylock())
-			goto update_tasks;
-
 		update_parent_effective_cpumask(cs, partcmd, NULL, tmp);
-		cpus_read_unlock();
 		if ((partcmd == partcmd_invalidate) || is_partition_valid(cs)) {
 			compute_partition_effective_cpumask(cs, &new_cpus);
 			cpuset_force_rebuild();
@@ -4557,8 +4584,7 @@
 }
 
 /**
- * cpuset_hotplug_workfn - handle CPU/memory hotunplug for a cpuset
- * @work: unused
+ * cpuset_handle_hotplug - handle CPU/memory hot{,un}plug for a cpuset
  *
  * This function is called after either CPU or memory configuration has
  * changed and updates cpuset accordingly.  The top_cpuset is always
@@ -4572,8 +4598,10 @@
  *
  * Note that CPU offlining during suspend is ignored.  We don't modify
  * cpusets across suspend/resume cycles at all.
+ *
+ * CPU / memory hotplug is handled synchronously.
  */
-static void cpuset_hotplug_workfn(struct work_struct *work)
+static void cpuset_handle_hotplug(void)
 {
 	static cpumask_t new_cpus;
 	static nodemask_t new_mems;
@@ -4584,6 +4612,7 @@
 	if (on_dfl && !alloc_cpumasks(NULL, &tmp))
 		ptmp = &tmp;
 
+	lockdep_assert_cpus_held();
 	mutex_lock(&cpuset_mutex);
 
 	/* fetch the available cpus/mems and find out which changed how */
@@ -4599,15 +4628,9 @@
 		       !cpumask_empty(subpartitions_cpus);
 	mems_updated = !nodes_equal(top_cpuset.effective_mems, new_mems);
 
-	/*
-	 * In the rare case that hotplug removes all the cpus in
-	 * subpartitions_cpus, we assumed that cpus are updated.
-	 */
-	if (!cpus_updated && top_cpuset.nr_subparts)
-		cpus_updated = true;
-
 	/* For v1, synchronize cpus_allowed to cpu_active_mask */
 	if (cpus_updated) {
+		cpuset_force_rebuild();
 		spin_lock_irq(&callback_lock);
 		if (!on_dfl)
 			cpumask_copy(top_cpuset.cpus_allowed, &new_cpus);
@@ -4663,9 +4686,9 @@
 	}
 
 	/* rebuild sched domains if cpus_allowed has changed */
-	if (cpus_updated || force_rebuild) {
-		force_rebuild = false;
-		rebuild_sched_domains();
+	if (force_sd_rebuild) {
+		force_sd_rebuild = false;
+		rebuild_sched_domains_cpuslocked();
 	}
 
 	free_cpumasks(NULL, ptmp);
@@ -4678,12 +4701,7 @@
 	 * inside cgroup synchronization.  Bounce actual hotplug processing
 	 * to a work item to avoid reverse locking order.
 	 */
-	schedule_work(&cpuset_hotplug_work);
-}
-
-void cpuset_wait_for_hotplug(void)
-{
-	flush_work(&cpuset_hotplug_work);
+	cpuset_handle_hotplug();
 }
 
 /*
@@ -4694,7 +4712,7 @@
 static int cpuset_track_online_nodes(struct notifier_block *self,
 				unsigned long action, void *arg)
 {
-	schedule_work(&cpuset_hotplug_work);
+	cpuset_handle_hotplug();
 	return NOTIFY_OK;
 }
 
@@ -5088,10 +5106,14 @@
 	if (!buf)
 		goto out;
 
-	css = task_get_css(tsk, cpuset_cgrp_id);
-	retval = cgroup_path_ns(css->cgroup, buf, PATH_MAX,
-				current->nsproxy->cgroup_ns);
-	css_put(css);
+	rcu_read_lock();
+	spin_lock_irq(&css_set_lock);
+	css = task_css(tsk, cpuset_cgrp_id);
+	retval = cgroup_path_ns_locked(css->cgroup, buf, PATH_MAX,
+				       current->nsproxy->cgroup_ns);
+	spin_unlock_irq(&css_set_lock);
+	rcu_read_unlock();
+
 	if (retval == -E2BIG)
 		retval = -ENAMETOOLONG;
 	if (retval < 0)
--- linux-qcom-6.8.0.orig/kernel/cpu.c
+++ linux-qcom-6.8.0/kernel/cpu.c
@@ -1209,52 +1209,6 @@
 	kthread_unpark(this_cpu_read(cpuhp_state.thread));
 }
 
-/*
- *
- * Serialize hotplug trainwrecks outside of the cpu_hotplug_lock
- * protected region.
- *
- * The operation is still serialized against concurrent CPU hotplug via
- * cpu_add_remove_lock, i.e. CPU map protection.  But it is _not_
- * serialized against other hotplug related activity like adding or
- * removing of state callbacks and state instances, which invoke either the
- * startup or the teardown callback of the affected state.
- *
- * This is required for subsystems which are unfixable vs. CPU hotplug and
- * evade lock inversion problems by scheduling work which has to be
- * completed _before_ cpu_up()/_cpu_down() returns.
- *
- * Don't even think about adding anything to this for any new code or even
- * drivers. It's only purpose is to keep existing lock order trainwrecks
- * working.
- *
- * For cpu_down() there might be valid reasons to finish cleanups which are
- * not required to be done under cpu_hotplug_lock, but that's a different
- * story and would be not invoked via this.
- */
-static void cpu_up_down_serialize_trainwrecks(bool tasks_frozen)
-{
-	/*
-	 * cpusets delegate hotplug operations to a worker to "solve" the
-	 * lock order problems. Wait for the worker, but only if tasks are
-	 * _not_ frozen (suspend, hibernate) as that would wait forever.
-	 *
-	 * The wait is required because otherwise the hotplug operation
-	 * returns with inconsistent state, which could even be observed in
-	 * user space when a new CPU is brought up. The CPU plug uevent
-	 * would be delivered and user space reacting on it would fail to
-	 * move tasks to the newly plugged CPU up to the point where the
-	 * work has finished because up to that point the newly plugged CPU
-	 * is not assignable in cpusets/cgroups. On unplug that's not
-	 * necessarily a visible issue, but it is still inconsistent state,
-	 * which is the real problem which needs to be "fixed". This can't
-	 * prevent the transient state between scheduling the work and
-	 * returning from waiting for it.
-	 */
-	if (!tasks_frozen)
-		cpuset_wait_for_hotplug();
-}
-
 #ifdef CONFIG_HOTPLUG_CPU
 #ifndef arch_clear_mm_cpumask_cpu
 #define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm))
@@ -1498,7 +1452,6 @@
 	 */
 	lockup_detector_cleanup();
 	arch_smt_update();
-	cpu_up_down_serialize_trainwrecks(tasks_frozen);
 	return ret;
 }
 
@@ -1732,7 +1685,6 @@
 out:
 	cpus_write_unlock();
 	arch_smt_update();
-	cpu_up_down_serialize_trainwrecks(tasks_frozen);
 	return ret;
 }
 
@@ -1911,6 +1863,9 @@
 
 void __init bringup_nonboot_cpus(unsigned int setup_max_cpus)
 {
+	if (!setup_max_cpus)
+		return;
+
 	/* Try parallel bringup optimization if enabled */
 	if (cpuhp_bringup_cpus_parallel(setup_max_cpus))
 		return;
@@ -2202,7 +2157,7 @@
 	},
 	[CPUHP_AP_HRTIMERS_DYING] = {
 		.name			= "hrtimers:dying",
-		.startup.single		= NULL,
+		.startup.single		= hrtimers_cpu_starting,
 		.teardown.single	= hrtimers_cpu_dying,
 	},
 
@@ -2494,7 +2449,7 @@
  * The caller needs to hold cpus read locked while calling this function.
  * Return:
  *   On success:
- *      Positive state number if @state is CPUHP_AP_ONLINE_DYN;
+ *      Positive state number if @state is CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN;
  *      0 for all other states
  *   On failure: proper (negative) error code
  */
@@ -2517,7 +2472,7 @@
 	ret = cpuhp_store_callbacks(state, name, startup, teardown,
 				    multi_instance);
 
-	dynstate = state == CPUHP_AP_ONLINE_DYN;
+	dynstate = state == CPUHP_AP_ONLINE_DYN || state == CPUHP_BP_PREPARE_DYN;
 	if (ret > 0 && dynstate) {
 		state = ret;
 		ret = 0;
@@ -2548,8 +2503,8 @@
 out:
 	mutex_unlock(&cpuhp_state_mutex);
 	/*
-	 * If the requested state is CPUHP_AP_ONLINE_DYN, return the
-	 * dynamically allocated state in case of success.
+	 * If the requested state is CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN,
+	 * return the dynamically allocated state in case of success.
 	 */
 	if (!ret && dynstate)
 		return state;
@@ -2724,6 +2679,16 @@
 	return ret;
 }
 
+/**
+ * Check if the core a CPU belongs to is online
+ */
+#if !defined(topology_is_core_online)
+static inline bool topology_is_core_online(unsigned int cpu)
+{
+	return true;
+}
+#endif
+
 int cpuhp_smt_enable(void)
 {
 	int cpu, ret = 0;
@@ -2734,7 +2699,7 @@
 		/* Skip online CPUs and CPUs on offline nodes */
 		if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
 			continue;
-		if (!cpu_smt_thread_allowed(cpu))
+		if (!cpu_smt_thread_allowed(cpu) || !topology_is_core_online(cpu))
 			continue;
 		ret = _cpu_up(cpu, 0, CPUHP_ONLINE);
 		if (ret)
@@ -3196,6 +3161,7 @@
 	this_cpu_write(cpuhp_state.target, CPUHP_ONLINE);
 }
 
+#ifdef CONFIG_CPU_MITIGATIONS
 /*
  * These are used for a global "mitigations=" cmdline option for toggling
  * optional CPU mitigations.
@@ -3206,8 +3172,7 @@
 	CPU_MITIGATIONS_AUTO_NOSMT,
 };
 
-static enum cpu_mitigations cpu_mitigations __ro_after_init =
-	CPU_MITIGATIONS_AUTO;
+static enum cpu_mitigations cpu_mitigations __ro_after_init = CPU_MITIGATIONS_AUTO;
 
 static int __init mitigations_parse_cmdline(char *arg)
 {
@@ -3223,7 +3188,6 @@
 
 	return 0;
 }
-early_param("mitigations", mitigations_parse_cmdline);
 
 /* mitigations=off */
 bool cpu_mitigations_off(void)
@@ -3238,3 +3202,11 @@
 	return cpu_mitigations == CPU_MITIGATIONS_AUTO_NOSMT;
 }
 EXPORT_SYMBOL_GPL(cpu_mitigations_auto_nosmt);
+#else
+static int __init mitigations_parse_cmdline(char *arg)
+{
+	pr_crit("Kernel compiled without mitigations, ignoring 'mitigations'; system may still be vulnerable\n");
+	return 0;
+}
+#endif
+early_param("mitigations", mitigations_parse_cmdline);
--- linux-qcom-6.8.0.orig/kernel/crash_core.c
+++ linux-qcom-6.8.0/kernel/crash_core.c
@@ -376,6 +376,9 @@
 
 	crashk_low_res.start = low_base;
 	crashk_low_res.end   = low_base + low_size - 1;
+#ifdef HAVE_ARCH_ADD_CRASH_RES_TO_IOMEM_EARLY
+	insert_resource(&iomem_resource, &crashk_low_res);
+#endif
 #endif
 	return 0;
 }
@@ -457,8 +460,12 @@
 
 	crashk_res.start = crash_base;
 	crashk_res.end = crash_base + crash_size - 1;
+#ifdef HAVE_ARCH_ADD_CRASH_RES_TO_IOMEM_EARLY
+	insert_resource(&iomem_resource, &crashk_res);
+#endif
 }
 
+#ifndef HAVE_ARCH_ADD_CRASH_RES_TO_IOMEM_EARLY
 static __init int insert_crashkernel_resources(void)
 {
 	if (crashk_res.start < crashk_res.end)
@@ -471,6 +478,7 @@
 }
 early_initcall(insert_crashkernel_resources);
 #endif
+#endif
 
 int crash_prepare_elf64_headers(struct crash_mem *mem, int need_kernel_map,
 			  void **addr, unsigned long *sz)
@@ -806,23 +814,18 @@
 	VMCOREINFO_NUMBER(PG_head_mask);
 #define PAGE_BUDDY_MAPCOUNT_VALUE	(~PG_buddy)
 	VMCOREINFO_NUMBER(PAGE_BUDDY_MAPCOUNT_VALUE);
-#ifdef CONFIG_HUGETLB_PAGE
-	VMCOREINFO_NUMBER(PG_hugetlb);
+#define PAGE_HUGETLB_MAPCOUNT_VALUE	(~PG_hugetlb)
+	VMCOREINFO_NUMBER(PAGE_HUGETLB_MAPCOUNT_VALUE);
 #define PAGE_OFFLINE_MAPCOUNT_VALUE	(~PG_offline)
 	VMCOREINFO_NUMBER(PAGE_OFFLINE_MAPCOUNT_VALUE);
-#endif
 
 #ifdef CONFIG_KALLSYMS
 	VMCOREINFO_SYMBOL(kallsyms_names);
 	VMCOREINFO_SYMBOL(kallsyms_num_syms);
 	VMCOREINFO_SYMBOL(kallsyms_token_table);
 	VMCOREINFO_SYMBOL(kallsyms_token_index);
-#ifdef CONFIG_KALLSYMS_BASE_RELATIVE
 	VMCOREINFO_SYMBOL(kallsyms_offsets);
 	VMCOREINFO_SYMBOL(kallsyms_relative_base);
-#else
-	VMCOREINFO_SYMBOL(kallsyms_addresses);
-#endif /* CONFIG_KALLSYMS_BASE_RELATIVE */
 #endif /* CONFIG_KALLSYMS */
 
 	arch_crash_save_vmcoreinfo();
--- linux-qcom-6.8.0.orig/kernel/debug/kdb/kdb_io.c
+++ linux-qcom-6.8.0/kernel/debug/kdb/kdb_io.c
@@ -184,6 +184,33 @@
 	unreachable();
 }
 
+/**
+ * kdb_position_cursor() - Place cursor in the correct horizontal position
+ * @prompt: Nil-terminated string containing the prompt string
+ * @buffer: Nil-terminated string containing the entire command line
+ * @cp: Cursor position, pointer the character in buffer where the cursor
+ *      should be positioned.
+ *
+ * The cursor is positioned by sending a carriage-return and then printing
+ * the content of the line until we reach the correct cursor position.
+ *
+ * There is some additional fine detail here.
+ *
+ * Firstly, even though kdb_printf() will correctly format zero-width fields
+ * we want the second call to kdb_printf() to be conditional. That keeps things
+ * a little cleaner when LOGGING=1.
+ *
+ * Secondly, we can't combine everything into one call to kdb_printf() since
+ * that renders into a fixed length buffer and the combined print could result
+ * in unwanted truncation.
+ */
+static void kdb_position_cursor(char *prompt, char *buffer, char *cp)
+{
+	kdb_printf("\r%s", prompt);
+	if (cp > buffer)
+		kdb_printf("%.*s", (int)(cp - buffer), buffer);
+}
+
 /*
  * kdb_read
  *
@@ -212,7 +239,6 @@
 						 * and null byte */
 	char *lastchar;
 	char *p_tmp;
-	char tmp;
 	static char tmpbuffer[CMD_BUFLEN];
 	int len = strlen(buffer);
 	int len_tmp;
@@ -249,12 +275,8 @@
 			}
 			*(--lastchar) = '\0';
 			--cp;
-			kdb_printf("\b%s \r", cp);
-			tmp = *cp;
-			*cp = '\0';
-			kdb_printf(kdb_prompt_str);
-			kdb_printf("%s", buffer);
-			*cp = tmp;
+			kdb_printf("\b%s ", cp);
+			kdb_position_cursor(kdb_prompt_str, buffer, cp);
 		}
 		break;
 	case 10: /* linefeed */
@@ -272,19 +294,14 @@
 			memcpy(tmpbuffer, cp+1, lastchar - cp - 1);
 			memcpy(cp, tmpbuffer, lastchar - cp - 1);
 			*(--lastchar) = '\0';
-			kdb_printf("%s \r", cp);
-			tmp = *cp;
-			*cp = '\0';
-			kdb_printf(kdb_prompt_str);
-			kdb_printf("%s", buffer);
-			*cp = tmp;
+			kdb_printf("%s ", cp);
+			kdb_position_cursor(kdb_prompt_str, buffer, cp);
 		}
 		break;
 	case 1: /* Home */
 		if (cp > buffer) {
-			kdb_printf("\r");
-			kdb_printf(kdb_prompt_str);
 			cp = buffer;
+			kdb_position_cursor(kdb_prompt_str, buffer, cp);
 		}
 		break;
 	case 5: /* End */
@@ -300,11 +317,10 @@
 		}
 		break;
 	case 14: /* Down */
-		memset(tmpbuffer, ' ',
-		       strlen(kdb_prompt_str) + (lastchar-buffer));
-		*(tmpbuffer+strlen(kdb_prompt_str) +
-		  (lastchar-buffer)) = '\0';
-		kdb_printf("\r%s\r", tmpbuffer);
+	case 16: /* Up */
+		kdb_printf("\r%*c\r",
+			   (int)(strlen(kdb_prompt_str) + (lastchar - buffer)),
+			   ' ');
 		*lastchar = (char)key;
 		*(lastchar+1) = '\0';
 		return lastchar;
@@ -314,15 +330,6 @@
 			++cp;
 		}
 		break;
-	case 16: /* Up */
-		memset(tmpbuffer, ' ',
-		       strlen(kdb_prompt_str) + (lastchar-buffer));
-		*(tmpbuffer+strlen(kdb_prompt_str) +
-		  (lastchar-buffer)) = '\0';
-		kdb_printf("\r%s\r", tmpbuffer);
-		*lastchar = (char)key;
-		*(lastchar+1) = '\0';
-		return lastchar;
 	case 9: /* Tab */
 		if (tab < 2)
 			++tab;
@@ -364,17 +371,27 @@
 			if (i >= dtab_count)
 				kdb_printf("...");
 			kdb_printf("\n");
-			kdb_printf(kdb_prompt_str);
+			kdb_printf("%s",  kdb_prompt_str);
 			kdb_printf("%s", buffer);
+			if (cp != lastchar)
+				kdb_position_cursor(kdb_prompt_str, buffer, cp);
 		} else if (tab != 2 && count > 0) {
-			len_tmp = strlen(p_tmp);
-			strncpy(p_tmp+len_tmp, cp, lastchar-cp+1);
-			len_tmp = strlen(p_tmp);
-			strncpy(cp, p_tmp+len, len_tmp-len + 1);
-			len = len_tmp - len;
-			kdb_printf("%s", cp);
-			cp += len;
-			lastchar += len;
+			/* How many new characters do we want from tmpbuffer? */
+			len_tmp = strlen(p_tmp) - len;
+			if (lastchar + len_tmp >= bufend)
+				len_tmp = bufend - lastchar;
+
+			if (len_tmp) {
+				/* + 1 ensures the '\0' is memmove'd */
+				memmove(cp+len_tmp, cp, (lastchar-cp) + 1);
+				memcpy(cp, p_tmp+len, len_tmp);
+				kdb_printf("%s", cp);
+				cp += len_tmp;
+				lastchar += len_tmp;
+				if (cp != lastchar)
+					kdb_position_cursor(kdb_prompt_str,
+							    buffer, cp);
+			}
 		}
 		kdb_nextline = 1; /* reset output line number */
 		break;
@@ -385,13 +402,9 @@
 				memcpy(cp+1, tmpbuffer, lastchar - cp);
 				*++lastchar = '\0';
 				*cp = key;
-				kdb_printf("%s\r", cp);
+				kdb_printf("%s", cp);
 				++cp;
-				tmp = *cp;
-				*cp = '\0';
-				kdb_printf(kdb_prompt_str);
-				kdb_printf("%s", buffer);
-				*cp = tmp;
+				kdb_position_cursor(kdb_prompt_str, buffer, cp);
 			} else {
 				*++lastchar = '\0';
 				*cp++ = key;
@@ -450,7 +463,7 @@
 {
 	if (prompt && kdb_prompt_str != prompt)
 		strscpy(kdb_prompt_str, prompt, CMD_BUFLEN);
-	kdb_printf(kdb_prompt_str);
+	kdb_printf("%s", kdb_prompt_str);
 	kdb_nextline = 1;	/* Prompt and input resets line number */
 	return kdb_read(buffer, bufsize);
 }
--- linux-qcom-6.8.0.orig/kernel/dma/debug.c
+++ linux-qcom-6.8.0/kernel/dma/debug.c
@@ -416,8 +416,11 @@
  * dma_active_cacheline entry to track per event.  dma_map_sg(), on the
  * other hand, consumes a single dma_debug_entry, but inserts 'nents'
  * entries into the tree.
+ *
+ * Use __GFP_NOWARN because the printk from an OOM, to netconsole, could end
+ * up right back in the DMA debugging code, leading to a deadlock.
  */
-static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC);
+static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC | __GFP_NOWARN);
 static DEFINE_SPINLOCK(radix_lock);
 #define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
 #define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
@@ -1049,9 +1052,13 @@
 	}
 
 	hash_bucket_del(entry);
-	dma_entry_free(entry);
-
 	put_hash_bucket(bucket, flags);
+
+	/*
+	 * Free the entry outside of bucket_lock to avoid ABBA deadlocks
+	 * between that and radix_lock.
+	 */
+	dma_entry_free(entry);
 }
 
 static void check_for_stack(struct device *dev,
--- linux-qcom-6.8.0.orig/kernel/dma/direct.c
+++ linux-qcom-6.8.0/kernel/dma/direct.c
@@ -286,7 +286,7 @@
 	} else {
 		ret = page_address(page);
 		if (dma_set_decrypted(dev, ret, size))
-			goto out_free_pages;
+			goto out_leak_pages;
 	}
 
 	memset(ret, 0, size);
@@ -307,6 +307,8 @@
 out_free_pages:
 	__dma_direct_free_pages(dev, page, size);
 	return NULL;
+out_leak_pages:
+	return NULL;
 }
 
 void dma_direct_free(struct device *dev, size_t size,
@@ -367,12 +369,11 @@
 
 	ret = page_address(page);
 	if (dma_set_decrypted(dev, ret, size))
-		goto out_free_pages;
+		goto out_leak_pages;
 	memset(ret, 0, size);
 	*dma_handle = phys_to_dma_direct(dev, page_to_phys(page));
 	return page;
-out_free_pages:
-	__dma_direct_free_pages(dev, page, size);
+out_leak_pages:
 	return NULL;
 }
 
--- linux-qcom-6.8.0.orig/kernel/dma/map_benchmark.c
+++ linux-qcom-6.8.0/kernel/dma/map_benchmark.c
@@ -89,6 +89,22 @@
 		atomic64_add(map_sq, &map->sum_sq_map);
 		atomic64_add(unmap_sq, &map->sum_sq_unmap);
 		atomic64_inc(&map->loops);
+
+		/*
+		 * We may test for a long time so periodically check whether
+		 * we need to schedule to avoid starving the others. Otherwise
+		 * we may hangup the kernel in a non-preemptible kernel when
+		 * the test kthreads number >= CPU number, the test kthreads
+		 * will run endless on every CPU since the thread resposible
+		 * for notifying the kthread stop (in do_map_benchmark())
+		 * could not be scheduled.
+		 *
+		 * Note this may degrade the test concurrency since the test
+		 * threads may need to share the CPU time with other load
+		 * in the system. So it's recommended to run this benchmark
+		 * on an idle system.
+		 */
+		cond_resched();
 	}
 
 out:
@@ -101,7 +117,6 @@
 	struct task_struct **tsk;
 	int threads = map->bparam.threads;
 	int node = map->bparam.node;
-	const cpumask_t *cpu_mask = cpumask_of_node(node);
 	u64 loops;
 	int ret = 0;
 	int i;
@@ -118,11 +133,13 @@
 		if (IS_ERR(tsk[i])) {
 			pr_err("create dma_map thread failed\n");
 			ret = PTR_ERR(tsk[i]);
+			while (--i >= 0)
+				kthread_stop(tsk[i]);
 			goto out;
 		}
 
 		if (node != NUMA_NO_NODE)
-			kthread_bind_mask(tsk[i], cpu_mask);
+			kthread_bind_mask(tsk[i], cpumask_of_node(node));
 	}
 
 	/* clear the old value in the previous benchmark */
@@ -139,13 +156,17 @@
 
 	msleep_interruptible(map->bparam.seconds * 1000);
 
-	/* wait for the completion of benchmark threads */
+	/* wait for the completion of all started benchmark threads */
 	for (i = 0; i < threads; i++) {
-		ret = kthread_stop(tsk[i]);
-		if (ret)
-			goto out;
+		int kthread_ret = kthread_stop_put(tsk[i]);
+
+		if (kthread_ret)
+			ret = kthread_ret;
 	}
 
+	if (ret)
+		goto out;
+
 	loops = atomic64_read(&map->loops);
 	if (likely(loops > 0)) {
 		u64 map_variance, unmap_variance;
@@ -170,8 +191,6 @@
 	}
 
 out:
-	for (i = 0; i < threads; i++)
-		put_task_struct(tsk[i]);
 	put_device(map->dev);
 	kfree(tsk);
 	return ret;
@@ -208,7 +227,8 @@
 		}
 
 		if (map->bparam.node != NUMA_NO_NODE &&
-		    !node_possible(map->bparam.node)) {
+		    (map->bparam.node < 0 || map->bparam.node >= MAX_NUMNODES ||
+		     !node_possible(map->bparam.node))) {
 			pr_err("invalid numa node\n");
 			return -EINVAL;
 		}
@@ -252,6 +272,9 @@
 		 * dma_mask changed by benchmark
 		 */
 		dma_set_mask(map->dev, old_dma_mask);
+
+		if (ret)
+			return ret;
 		break;
 	default:
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/kernel/dma/mapping.c
+++ linux-qcom-6.8.0/kernel/dma/mapping.c
@@ -67,8 +67,8 @@
 {
 	struct dma_devres match_data = { size, vaddr, dma_handle };
 
-	dma_free_coherent(dev, size, vaddr, dma_handle);
 	WARN_ON(devres_destroy(dev, dmam_release, dmam_match, &match_data));
+	dma_free_coherent(dev, size, vaddr, dma_handle);
 }
 EXPORT_SYMBOL(dmam_free_coherent);
 
--- linux-qcom-6.8.0.orig/kernel/dma/swiotlb.c
+++ linux-qcom-6.8.0/kernel/dma/swiotlb.c
@@ -69,11 +69,14 @@
  * @alloc_size:	Size of the allocated buffer.
  * @list:	The free list describing the number of free entries available
  *		from each index.
+ * @pad_slots:	Number of preceding padding slots. Valid only in the first
+ *		allocated non-padding slot.
  */
 struct io_tlb_slot {
 	phys_addr_t orig_addr;
 	size_t alloc_size;
-	unsigned int list;
+	unsigned short list;
+	unsigned short pad_slots;
 };
 
 static bool swiotlb_force_bounce;
@@ -287,6 +290,7 @@
 					 mem->nslabs - i);
 		mem->slots[i].orig_addr = INVALID_PHYS_ADDR;
 		mem->slots[i].alloc_size = 0;
+		mem->slots[i].pad_slots = 0;
 	}
 
 	memset(vaddr, 0, bytes);
@@ -821,12 +825,30 @@
 #endif
 }
 
-/*
- * Return the offset into a iotlb slot required to keep the device happy.
+/**
+ * swiotlb_align_offset() - Get required offset into an IO TLB allocation.
+ * @dev:         Owning device.
+ * @align_mask:  Allocation alignment mask.
+ * @addr:        DMA address.
+ *
+ * Return the minimum offset from the start of an IO TLB allocation which is
+ * required for a given buffer address and allocation alignment to keep the
+ * device happy.
+ *
+ * First, the address bits covered by min_align_mask must be identical in the
+ * original address and the bounce buffer address. High bits are preserved by
+ * choosing a suitable IO TLB slot, but bits below IO_TLB_SHIFT require extra
+ * padding bytes before the bounce buffer.
+ *
+ * Second, @align_mask specifies which bits of the first allocated slot must
+ * be zero. This may require allocating additional padding slots, and then the
+ * offset (in bytes) from the first such padding slot is returned.
  */
-static unsigned int swiotlb_align_offset(struct device *dev, u64 addr)
+static unsigned int swiotlb_align_offset(struct device *dev,
+					 unsigned int align_mask, u64 addr)
 {
-	return addr & dma_get_min_align_mask(dev) & (IO_TLB_SIZE - 1);
+	return addr & dma_get_min_align_mask(dev) &
+		(align_mask | (IO_TLB_SIZE - 1));
 }
 
 /*
@@ -847,7 +869,7 @@
 		return;
 
 	tlb_offset = tlb_addr & (IO_TLB_SIZE - 1);
-	orig_addr_offset = swiotlb_align_offset(dev, orig_addr);
+	orig_addr_offset = swiotlb_align_offset(dev, 0, orig_addr);
 	if (tlb_offset < orig_addr_offset) {
 		dev_WARN_ONCE(dev, 1,
 			"Access before mapping start detected. orig offset %u, requested offset %u.\n",
@@ -981,10 +1003,9 @@
 	dma_addr_t tbl_dma_addr =
 		phys_to_dma_unencrypted(dev, pool->start) & boundary_mask;
 	unsigned long max_slots = get_max_slots(boundary_mask);
-	unsigned int iotlb_align_mask =
-		dma_get_min_align_mask(dev) | alloc_align_mask;
+	unsigned int iotlb_align_mask = dma_get_min_align_mask(dev);
 	unsigned int nslots = nr_slots(alloc_size), stride;
-	unsigned int offset = swiotlb_align_offset(dev, orig_addr);
+	unsigned int offset = swiotlb_align_offset(dev, 0, orig_addr);
 	unsigned int index, slots_checked, count = 0, i;
 	unsigned long flags;
 	unsigned int slot_base;
@@ -994,18 +1015,29 @@
 	BUG_ON(area_index >= pool->nareas);
 
 	/*
-	 * For allocations of PAGE_SIZE or larger only look for page aligned
-	 * allocations.
+	 * Historically, swiotlb allocations >= PAGE_SIZE were guaranteed to be
+	 * page-aligned in the absence of any other alignment requirements.
+	 * 'alloc_align_mask' was later introduced to specify the alignment
+	 * explicitly, however this is passed as zero for streaming mappings
+	 * and so we preserve the old behaviour there in case any drivers are
+	 * relying on it.
+	 */
+	if (!alloc_align_mask && !iotlb_align_mask && alloc_size >= PAGE_SIZE)
+		alloc_align_mask = PAGE_SIZE - 1;
+
+	/*
+	 * Ensure that the allocation is at least slot-aligned and update
+	 * 'iotlb_align_mask' to ignore bits that will be preserved when
+	 * offsetting into the allocation.
 	 */
-	if (alloc_size >= PAGE_SIZE)
-		iotlb_align_mask |= ~PAGE_MASK;
-	iotlb_align_mask &= ~(IO_TLB_SIZE - 1);
+	alloc_align_mask |= (IO_TLB_SIZE - 1);
+	iotlb_align_mask &= ~alloc_align_mask;
 
 	/*
 	 * For mappings with an alignment requirement don't bother looping to
 	 * unaligned slots once we found an aligned one.
 	 */
-	stride = (iotlb_align_mask >> IO_TLB_SHIFT) + 1;
+	stride = get_max_slots(max(alloc_align_mask, iotlb_align_mask));
 
 	spin_lock_irqsave(&area->lock, flags);
 	if (unlikely(nslots > pool->area_nslabs - area->used))
@@ -1015,11 +1047,14 @@
 	index = area->index;
 
 	for (slots_checked = 0; slots_checked < pool->area_nslabs; ) {
+		phys_addr_t tlb_addr;
+
 		slot_index = slot_base + index;
+		tlb_addr = slot_addr(tbl_dma_addr, slot_index);
 
-		if (orig_addr &&
-		    (slot_addr(tbl_dma_addr, slot_index) &
-		     iotlb_align_mask) != (orig_addr & iotlb_align_mask)) {
+		if ((tlb_addr & alloc_align_mask) ||
+		    (orig_addr && (tlb_addr & iotlb_align_mask) !=
+				  (orig_addr & iotlb_align_mask))) {
 			index = wrap_area_index(pool, index + 1);
 			slots_checked++;
 			continue;
@@ -1292,11 +1327,12 @@
 		unsigned long attrs)
 {
 	struct io_tlb_mem *mem = dev->dma_io_tlb_mem;
-	unsigned int offset = swiotlb_align_offset(dev, orig_addr);
+	unsigned int offset;
 	struct io_tlb_pool *pool;
 	unsigned int i;
 	int index;
 	phys_addr_t tlb_addr;
+	unsigned short pad_slots;
 
 	if (!mem || !mem->nslabs) {
 		dev_warn_ratelimited(dev,
@@ -1313,6 +1349,7 @@
 		return (phys_addr_t)DMA_MAPPING_ERROR;
 	}
 
+	offset = swiotlb_align_offset(dev, alloc_align_mask, orig_addr);
 	index = swiotlb_find_slots(dev, orig_addr,
 				   alloc_size + offset, alloc_align_mask, &pool);
 	if (index == -1) {
@@ -1328,6 +1365,10 @@
 	 * This is needed when we sync the memory.  Then we sync the buffer if
 	 * needed.
 	 */
+	pad_slots = offset >> IO_TLB_SHIFT;
+	offset &= (IO_TLB_SIZE - 1);
+	index += pad_slots;
+	pool->slots[index].pad_slots = pad_slots;
 	for (i = 0; i < nr_slots(alloc_size + offset); i++)
 		pool->slots[index + i].orig_addr = slot_addr(orig_addr, i);
 	tlb_addr = slot_addr(pool->start, index) + offset;
@@ -1348,13 +1389,17 @@
 {
 	struct io_tlb_pool *mem = swiotlb_find_pool(dev, tlb_addr);
 	unsigned long flags;
-	unsigned int offset = swiotlb_align_offset(dev, tlb_addr);
-	int index = (tlb_addr - offset - mem->start) >> IO_TLB_SHIFT;
-	int nslots = nr_slots(mem->slots[index].alloc_size + offset);
-	int aindex = index / mem->area_nslabs;
-	struct io_tlb_area *area = &mem->areas[aindex];
+	unsigned int offset = swiotlb_align_offset(dev, 0, tlb_addr);
+	int index, nslots, aindex;
+	struct io_tlb_area *area;
 	int count, i;
 
+	index = (tlb_addr - offset - mem->start) >> IO_TLB_SHIFT;
+	index -= mem->slots[index].pad_slots;
+	nslots = nr_slots(mem->slots[index].alloc_size + offset);
+	aindex = index / mem->area_nslabs;
+	area = &mem->areas[aindex];
+
 	/*
 	 * Return the buffer to the free list by setting the corresponding
 	 * entries to indicate the number of contiguous entries available.
@@ -1377,6 +1422,7 @@
 		mem->slots[i].list = ++count;
 		mem->slots[i].orig_addr = INVALID_PHYS_ADDR;
 		mem->slots[i].alloc_size = 0;
+		mem->slots[i].pad_slots = 0;
 	}
 
 	/*
@@ -1631,16 +1677,24 @@
 	struct io_tlb_mem *mem = dev->dma_io_tlb_mem;
 	struct io_tlb_pool *pool;
 	phys_addr_t tlb_addr;
+	unsigned int align;
 	int index;
 
 	if (!mem)
 		return NULL;
 
-	index = swiotlb_find_slots(dev, 0, size, 0, &pool);
+	align = (1 << (get_order(size) + PAGE_SHIFT)) - 1;
+	index = swiotlb_find_slots(dev, 0, size, align, &pool);
 	if (index == -1)
 		return NULL;
 
 	tlb_addr = slot_addr(pool->start, index);
+	if (unlikely(!PAGE_ALIGNED(tlb_addr))) {
+		dev_WARN_ONCE(dev, 1, "Cannot allocate pages from non page-aligned swiotlb addr 0x%pa.\n",
+			      &tlb_addr);
+		swiotlb_release_slots(dev, tlb_addr);
+		return NULL;
+	}
 
 	return pfn_to_page(PFN_DOWN(tlb_addr));
 }
@@ -1706,6 +1760,7 @@
 		mem->for_alloc = true;
 #ifdef CONFIG_SWIOTLB_DYNAMIC
 		spin_lock_init(&mem->lock);
+		INIT_LIST_HEAD_RCU(&mem->pools);
 #endif
 		add_mem_pool(mem, pool);
 
--- linux-qcom-6.8.0.orig/kernel/entry/common.c
+++ linux-qcom-6.8.0/kernel/entry/common.c
@@ -57,8 +57,14 @@
 	/* Either of the above might have changed the syscall number */
 	syscall = syscall_get_nr(current, regs);
 
-	if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT))
+	if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT)) {
 		trace_sys_enter(regs, syscall);
+		/*
+		 * Probes or BPF hooks in the tracepoint may have changed the
+		 * system call number as well.
+		 */
+		syscall = syscall_get_nr(current, regs);
+	}
 
 	syscall_enter_audit(regs, syscall);
 
--- linux-qcom-6.8.0.orig/kernel/events/core.c
+++ linux-qcom-6.8.0/kernel/events/core.c
@@ -264,6 +264,7 @@
 {
 	struct perf_event_context *ctx = event->ctx;
 	struct task_struct *task = READ_ONCE(ctx->task); /* verified in event_function */
+	struct perf_cpu_context *cpuctx;
 	struct event_function_struct efs = {
 		.event = event,
 		.func = func,
@@ -291,22 +292,25 @@
 	if (!task_function_call(task, event_function, &efs))
 		return;
 
-	raw_spin_lock_irq(&ctx->lock);
+	local_irq_disable();
+	cpuctx = this_cpu_ptr(&perf_cpu_context);
+	perf_ctx_lock(cpuctx, ctx);
 	/*
 	 * Reload the task pointer, it might have been changed by
 	 * a concurrent perf_event_context_sched_out().
 	 */
 	task = ctx->task;
-	if (task == TASK_TOMBSTONE) {
-		raw_spin_unlock_irq(&ctx->lock);
-		return;
-	}
+	if (task == TASK_TOMBSTONE)
+		goto unlock;
 	if (ctx->is_active) {
-		raw_spin_unlock_irq(&ctx->lock);
+		perf_ctx_unlock(cpuctx, ctx);
+		local_irq_enable();
 		goto again;
 	}
 	func(event, NULL, ctx, data);
-	raw_spin_unlock_irq(&ctx->lock);
+unlock:
+	perf_ctx_unlock(cpuctx, ctx);
+	local_irq_enable();
 }
 
 /*
@@ -415,8 +419,13 @@
  *   0 - disallow raw tracepoint access for unpriv
  *   1 - disallow cpu events for unpriv
  *   2 - disallow kernel profiling for unpriv
+ *   4 - disallow all unpriv perf event use
  */
+#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT
+int sysctl_perf_event_paranoid __read_mostly = PERF_SECURITY_MAX;
+#else
 int sysctl_perf_event_paranoid __read_mostly = 2;
+#endif
 
 /* Minimum for 512 kiB + 1 user control page */
 int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
@@ -1255,8 +1264,9 @@
  *	  perf_event_context::mutex
  *	    perf_event::child_mutex;
  *	      perf_event_context::lock
- *	    perf_event::mmap_mutex
  *	    mmap_lock
+ *	      perf_event::mmap_mutex
+ *	        perf_buffer::aux_mutex
  *	      perf_addr_filters_head::lock
  *
  *    cpu_hotplug_lock
@@ -2284,18 +2294,14 @@
 	}
 
 	if (event->pending_sigtrap) {
-		bool dec = true;
-
 		event->pending_sigtrap = 0;
 		if (state != PERF_EVENT_STATE_OFF &&
-		    !event->pending_work) {
+		    !event->pending_work &&
+		    !task_work_add(current, &event->pending_task, TWA_RESUME)) {
 			event->pending_work = 1;
-			dec = false;
-			WARN_ON_ONCE(!atomic_long_inc_not_zero(&event->refcount));
-			task_work_add(current, &event->pending_task, TWA_RESUME);
-		}
-		if (dec)
+		} else {
 			local_dec(&event->ctx->nr_pending);
+		}
 	}
 
 	perf_event_set_state(event, state);
@@ -4103,7 +4109,11 @@
 	period = perf_calculate_period(event, nsec, count);
 
 	delta = (s64)(period - hwc->sample_period);
-	delta = (delta + 7) / 8; /* low pass filter */
+	if (delta >= 0)
+		delta += 7;
+	else
+		delta -= 7;
+	delta /= 8; /* low pass filter */
 
 	sample_period = hwc->sample_period + delta;
 
@@ -5187,9 +5197,35 @@
 static void perf_addr_filters_splice(struct perf_event *event,
 				       struct list_head *head);
 
+static void perf_pending_task_sync(struct perf_event *event)
+{
+	struct callback_head *head = &event->pending_task;
+
+	if (!event->pending_work)
+		return;
+	/*
+	 * If the task is queued to the current task's queue, we
+	 * obviously can't wait for it to complete. Simply cancel it.
+	 */
+	if (task_work_cancel(current, head)) {
+		event->pending_work = 0;
+		local_dec(&event->ctx->nr_pending);
+		return;
+	}
+
+	/*
+	 * All accesses related to the event are within the same
+	 * non-preemptible section in perf_pending_task(). The RCU
+	 * grace period before the event is freed will make sure all
+	 * those accesses are complete by then.
+	 */
+	rcuwait_wait_event(&event->pending_work_wait, !event->pending_work, TASK_UNINTERRUPTIBLE);
+}
+
 static void _free_event(struct perf_event *event)
 {
 	irq_work_sync(&event->pending_irq);
+	perf_pending_task_sync(event);
 
 	unaccount_event(event);
 
@@ -5365,6 +5401,7 @@
 again:
 	mutex_lock(&event->child_mutex);
 	list_for_each_entry(child, &event->child_list, child_list) {
+		void *var = NULL;
 
 		/*
 		 * Cannot change, child events are not migrated, see the
@@ -5405,11 +5442,23 @@
 			 * this can't be the last reference.
 			 */
 			put_event(event);
+		} else {
+			var = &ctx->refcount;
 		}
 
 		mutex_unlock(&event->child_mutex);
 		mutex_unlock(&ctx->mutex);
 		put_ctx(ctx);
+
+		if (var) {
+			/*
+			 * If perf_event_free_task() has deleted all events from the
+			 * ctx while the child_mutex got released above, make sure to
+			 * notify about the preceding put_ctx().
+			 */
+			smp_mb(); /* pairs with wait_var_event() */
+			wake_up_var(var);
+		}
 		goto again;
 	}
 	mutex_unlock(&event->child_mutex);
@@ -6329,12 +6378,11 @@
 		event->pmu->event_unmapped(event, vma->vm_mm);
 
 	/*
-	 * rb->aux_mmap_count will always drop before rb->mmap_count and
-	 * event->mmap_count, so it is ok to use event->mmap_mutex to
-	 * serialize with perf_mmap here.
+	 * The AUX buffer is strictly a sub-buffer, serialize using aux_mutex
+	 * to avoid complications.
 	 */
 	if (rb_has_aux(rb) && vma->vm_pgoff == rb->aux_pgoff &&
-	    atomic_dec_and_mutex_lock(&rb->aux_mmap_count, &event->mmap_mutex)) {
+	    atomic_dec_and_mutex_lock(&rb->aux_mmap_count, &rb->aux_mutex)) {
 		/*
 		 * Stop all AUX events that are writing to this buffer,
 		 * so that we can free its AUX pages and corresponding PMU
@@ -6351,7 +6399,7 @@
 		rb_free_aux(rb);
 		WARN_ON_ONCE(refcount_read(&rb->aux_refcount));
 
-		mutex_unlock(&event->mmap_mutex);
+		mutex_unlock(&rb->aux_mutex);
 	}
 
 	if (atomic_dec_and_test(&rb->mmap_count))
@@ -6439,6 +6487,7 @@
 	struct perf_event *event = file->private_data;
 	unsigned long user_locked, user_lock_limit;
 	struct user_struct *user = current_user();
+	struct mutex *aux_mutex = NULL;
 	struct perf_buffer *rb = NULL;
 	unsigned long locked, lock_limit;
 	unsigned long vma_size;
@@ -6477,6 +6526,8 @@
 			return -EINVAL;
 
 		nr_pages = vma_size / PAGE_SIZE;
+		if (nr_pages > INT_MAX)
+			return -ENOMEM;
 
 		mutex_lock(&event->mmap_mutex);
 		ret = -EINVAL;
@@ -6485,6 +6536,9 @@
 		if (!rb)
 			goto aux_unlock;
 
+		aux_mutex = &rb->aux_mutex;
+		mutex_lock(aux_mutex);
+
 		aux_offset = READ_ONCE(rb->user_page->aux_offset);
 		aux_size = READ_ONCE(rb->user_page->aux_size);
 
@@ -6635,6 +6689,8 @@
 		atomic_dec(&rb->mmap_count);
 	}
 aux_unlock:
+	if (aux_mutex)
+		mutex_unlock(aux_mutex);
 	mutex_unlock(&event->mmap_mutex);
 
 	/*
@@ -6808,23 +6864,27 @@
 	int rctx;
 
 	/*
+	 * All accesses to the event must belong to the same implicit RCU read-side
+	 * critical section as the ->pending_work reset. See comment in
+	 * perf_pending_task_sync().
+	 */
+	preempt_disable_notrace();
+	/*
 	 * If we 'fail' here, that's OK, it means recursion is already disabled
 	 * and we won't recurse 'further'.
 	 */
-	preempt_disable_notrace();
 	rctx = perf_swevent_get_recursion_context();
 
 	if (event->pending_work) {
 		event->pending_work = 0;
 		perf_sigtrap(event);
 		local_dec(&event->ctx->nr_pending);
+		rcuwait_wake_up(&event->pending_work_wait);
 	}
 
 	if (rctx >= 0)
 		perf_swevent_put_recursion_context(rctx);
 	preempt_enable_notrace();
-
-	put_event(event);
 }
 
 #ifdef CONFIG_GUEST_PERF_EVENTS
@@ -9278,21 +9338,19 @@
 	bool unregister = type == PERF_BPF_EVENT_PROG_UNLOAD;
 	int i;
 
-	if (prog->aux->func_cnt == 0) {
-		perf_event_ksymbol(PERF_RECORD_KSYMBOL_TYPE_BPF,
-				   (u64)(unsigned long)prog->bpf_func,
-				   prog->jited_len, unregister,
-				   prog->aux->ksym.name);
-	} else {
-		for (i = 0; i < prog->aux->func_cnt; i++) {
-			struct bpf_prog *subprog = prog->aux->func[i];
-
-			perf_event_ksymbol(
-				PERF_RECORD_KSYMBOL_TYPE_BPF,
-				(u64)(unsigned long)subprog->bpf_func,
-				subprog->jited_len, unregister,
-				subprog->aux->ksym.name);
-		}
+	perf_event_ksymbol(PERF_RECORD_KSYMBOL_TYPE_BPF,
+			   (u64)(unsigned long)prog->bpf_func,
+			   prog->jited_len, unregister,
+			   prog->aux->ksym.name);
+
+	for (i = 1; i < prog->aux->func_cnt; i++) {
+		struct bpf_prog *subprog = prog->aux->func[i];
+
+		perf_event_ksymbol(
+			PERF_RECORD_KSYMBOL_TYPE_BPF,
+			(u64)(unsigned long)subprog->bpf_func,
+			subprog->jited_len, unregister,
+			subprog->aux->ksym.name);
 	}
 }
 
@@ -11936,6 +11994,7 @@
 	init_waitqueue_head(&event->waitq);
 	init_irq_work(&event->pending_irq, perf_pending_irq);
 	init_task_work(&event->pending_task, perf_pending_task);
+	rcuwait_init(&event->pending_work_wait);
 
 	mutex_init(&event->mmap_mutex);
 	raw_spin_lock_init(&event->addr_filters.lock);
@@ -12440,6 +12499,9 @@
 	if (flags & ~PERF_FLAG_ALL)
 		return -EINVAL;
 
+	if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
+		return -EACCES;
+
 	err = perf_copy_attr(attr_uptr, &attr);
 	if (err)
 		return err;
@@ -13304,6 +13366,15 @@
 	return &event->attr;
 }
 
+int perf_allow_kernel(struct perf_event_attr *attr)
+{
+	if (sysctl_perf_event_paranoid > 1 && !perfmon_capable())
+		return -EACCES;
+
+	return security_perf_event_open(attr, PERF_SECURITY_KERNEL);
+}
+EXPORT_SYMBOL_GPL(perf_allow_kernel);
+
 /*
  * Inherit an event from parent task to child task.
  *
--- linux-qcom-6.8.0.orig/kernel/events/internal.h
+++ linux-qcom-6.8.0/kernel/events/internal.h
@@ -40,6 +40,7 @@
 	struct user_struct		*mmap_user;
 
 	/* AUX area */
+	struct mutex			aux_mutex;
 	long				aux_head;
 	unsigned int			aux_nest;
 	long				aux_wakeup;	/* last aux_watermark boundary crossed by aux_head */
@@ -128,7 +129,7 @@
 
 static inline unsigned long perf_aux_size(struct perf_buffer *rb)
 {
-	return rb->aux_nr_pages << PAGE_SHIFT;
+	return (unsigned long)rb->aux_nr_pages << PAGE_SHIFT;
 }
 
 #define __DEFINE_OUTPUT_COPY_BODY(advance_buf, memcpy_func, ...)	\
--- linux-qcom-6.8.0.orig/kernel/events/ring_buffer.c
+++ linux-qcom-6.8.0/kernel/events/ring_buffer.c
@@ -333,6 +333,8 @@
 	 */
 	if (!rb->nr_pages)
 		rb->paused = 1;
+
+	mutex_init(&rb->aux_mutex);
 }
 
 void perf_aux_output_flag(struct perf_output_handle *handle, u64 flags)
@@ -684,7 +686,9 @@
 		 * max_order, to aid PMU drivers in double buffering.
 		 */
 		if (!watermark)
-			watermark = nr_pages << (PAGE_SHIFT - 1);
+			watermark = min_t(unsigned long,
+					  U32_MAX,
+					  (unsigned long)nr_pages << (PAGE_SHIFT - 1));
 
 		/*
 		 * Use aux_watermark as the basis for chunking to
--- linux-qcom-6.8.0.orig/kernel/events/uprobes.c
+++ linux-qcom-6.8.0/kernel/events/uprobes.c
@@ -1480,7 +1480,7 @@
 	uprobe_opcode_t insn = UPROBE_SWBP_INSN;
 	struct xol_area *area;
 
-	area = kmalloc(sizeof(*area), GFP_KERNEL);
+	area = kzalloc(sizeof(*area), GFP_KERNEL);
 	if (unlikely(!area))
 		goto out;
 
@@ -1490,9 +1490,8 @@
 		goto free_area;
 
 	area->xol_mapping.name = "[uprobes]";
-	area->xol_mapping.fault = NULL;
 	area->xol_mapping.pages = area->pages;
-	area->pages[0] = alloc_page(GFP_HIGHUSER);
+	area->pages[0] = alloc_page(GFP_HIGHUSER | __GFP_ZERO);
 	if (!area->pages[0])
 		goto free_bitmap;
 	area->pages[1] = NULL;
@@ -1717,6 +1716,7 @@
 	if (!utask)
 		return;
 
+	t->utask = NULL;
 	if (utask->active_uprobe)
 		put_uprobe(utask->active_uprobe);
 
@@ -1726,7 +1726,6 @@
 
 	xol_free_insn_slot(t);
 	kfree(utask);
-	t->utask = NULL;
 }
 
 /*
@@ -2072,6 +2071,7 @@
 	bool need_prep = false; /* prepare return uprobe, when needed */
 
 	down_read(&uprobe->register_rwsem);
+	current->utask->auprobe = &uprobe->arch;
 	for (uc = uprobe->consumers; uc; uc = uc->next) {
 		int rc = 0;
 
@@ -2086,6 +2086,7 @@
 
 		remove &= rc;
 	}
+	current->utask->auprobe = NULL;
 
 	if (need_prep && !remove)
 		prepare_uretprobe(uprobe, regs); /* put bp at return */
--- linux-qcom-6.8.0.orig/kernel/exit.c
+++ linux-qcom-6.8.0/kernel/exit.c
@@ -278,7 +278,6 @@
 	}
 
 	write_unlock_irq(&tasklist_lock);
-	seccomp_filter_release(p);
 	proc_flush_pid(thread_pid);
 	put_pid(thread_pid);
 	release_thread(p);
@@ -488,6 +487,8 @@
 	 * Search through everything else, we should not get here often.
 	 */
 	for_each_process(g) {
+		if (atomic_read(&mm->mm_users) <= 1)
+			break;
 		if (g->flags & PF_KTHREAD)
 			continue;
 		for_each_thread(g, c) {
@@ -829,6 +830,8 @@
 	io_uring_files_cancel();
 	exit_signals(tsk);  /* sets PF_EXITING */
 
+	seccomp_filter_release(tsk);
+
 	acct_update_integrals(tsk);
 	group_dead = atomic_dec_and_test(&tsk->signal->live);
 	if (group_dead) {
--- linux-qcom-6.8.0.orig/kernel/fork.c
+++ linux-qcom-6.8.0/kernel/fork.c
@@ -101,6 +101,7 @@
 #include <linux/user_events.h>
 #include <linux/iommu.h>
 #include <linux/rseq.h>
+#include <linux/tick.h>
 
 #include <asm/pgalloc.h>
 #include <linux/uaccess.h>
@@ -112,6 +113,11 @@
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/task.h>
+#ifdef CONFIG_USER_NS
+extern int unprivileged_userns_clone;
+#else
+#define unprivileged_userns_clone 0
+#endif
 
 /*
  * Minimum number of threads to boot the kernel
@@ -632,11 +638,8 @@
 	LIST_HEAD(uf);
 	VMA_ITERATOR(vmi, mm, 0);
 
-	uprobe_start_dup_mmap();
-	if (mmap_write_lock_killable(oldmm)) {
-		retval = -EINTR;
-		goto fail_uprobe_end;
-	}
+	if (mmap_write_lock_killable(oldmm))
+		return -EINTR;
 	flush_cache_dup_mm(oldmm);
 	uprobe_dup_mmap(oldmm, mm);
 	/*
@@ -652,11 +655,6 @@
 	mm->exec_vm = oldmm->exec_vm;
 	mm->stack_vm = oldmm->stack_vm;
 
-	retval = ksm_fork(mm, oldmm);
-	if (retval)
-		goto out;
-	khugepaged_fork(mm, oldmm);
-
 	/* Use __mt_dup() to efficiently build an identical maple tree. */
 	retval = __mt_dup(&oldmm->mm_mt, &mm->mm_mt, GFP_KERNEL);
 	if (unlikely(retval))
@@ -712,6 +710,23 @@
 		} else if (anon_vma_fork(tmp, mpnt))
 			goto fail_nomem_anon_vma_fork;
 		vm_flags_clear(tmp, VM_LOCKED_MASK);
+		/*
+		 * Copy/update hugetlb private vma information.
+		 */
+		if (is_vm_hugetlb_page(tmp))
+			hugetlb_dup_vma_private(tmp);
+
+		/*
+		 * Link the vma into the MT. After using __mt_dup(), memory
+		 * allocation is not necessary here, so it cannot fail.
+		 */
+		vma_iter_bulk_store(&vmi, tmp);
+
+		mm->map_count++;
+
+		if (tmp->vm_ops && tmp->vm_ops->open)
+			tmp->vm_ops->open(tmp);
+
 		file = tmp->vm_file;
 		if (file) {
 			struct address_space *mapping = file->f_mapping;
@@ -728,25 +743,9 @@
 			i_mmap_unlock_write(mapping);
 		}
 
-		/*
-		 * Copy/update hugetlb private vma information.
-		 */
-		if (is_vm_hugetlb_page(tmp))
-			hugetlb_dup_vma_private(tmp);
-
-		/*
-		 * Link the vma into the MT. After using __mt_dup(), memory
-		 * allocation is not necessary here, so it cannot fail.
-		 */
-		vma_iter_bulk_store(&vmi, tmp);
-
-		mm->map_count++;
 		if (!(tmp->vm_flags & VM_WIPEONFORK))
 			retval = copy_page_range(tmp, mpnt);
 
-		if (tmp->vm_ops && tmp->vm_ops->open)
-			tmp->vm_ops->open(tmp);
-
 		if (retval) {
 			mpnt = vma_next(&vmi);
 			goto loop_out;
@@ -758,6 +757,8 @@
 	vma_iter_free(&vmi);
 	if (!retval) {
 		mt_set_in_rcu(vmi.mas.tree);
+		ksm_fork(mm, oldmm);
+		khugepaged_fork(mm, oldmm);
 	} else if (mpnt) {
 		/*
 		 * The entire maple tree has already been duplicated. If the
@@ -773,9 +774,10 @@
 	mmap_write_unlock(mm);
 	flush_tlb_mm(oldmm);
 	mmap_write_unlock(oldmm);
-	dup_userfaultfd_complete(&uf);
-fail_uprobe_end:
-	uprobe_end_dup_mmap();
+	if (!retval)
+		dup_userfaultfd_complete(&uf);
+	else
+		dup_userfaultfd_fail(&uf);
 	return retval;
 
 fail_nomem_anon_vma_fork:
@@ -1682,9 +1684,11 @@
 	if (!mm_init(mm, tsk, mm->user_ns))
 		goto fail_nomem;
 
+	uprobe_start_dup_mmap();
 	err = dup_mmap(mm, oldmm);
 	if (err)
 		goto free_pt;
+	uprobe_end_dup_mmap();
 
 	mm->hiwater_rss = get_mm_rss(mm);
 	mm->hiwater_vm = mm->total_vm;
@@ -1699,6 +1703,8 @@
 	mm->binfmt = NULL;
 	mm_init_owner(mm, NULL);
 	mmput(mm);
+	if (err)
+		uprobe_end_dup_mmap();
 
 fail_nomem:
 	return NULL;
@@ -1767,33 +1773,30 @@
 		      int no_files)
 {
 	struct files_struct *oldf, *newf;
-	int error = 0;
 
 	/*
 	 * A background process may not have any files ...
 	 */
 	oldf = current->files;
 	if (!oldf)
-		goto out;
+		return 0;
 
 	if (no_files) {
 		tsk->files = NULL;
-		goto out;
+		return 0;
 	}
 
 	if (clone_flags & CLONE_FILES) {
 		atomic_inc(&oldf->count);
-		goto out;
+		return 0;
 	}
 
-	newf = dup_fd(oldf, NR_OPEN_MAX, &error);
-	if (!newf)
-		goto out;
+	newf = dup_fd(oldf, NULL);
+	if (IS_ERR(newf))
+		return PTR_ERR(newf);
 
 	tsk->files = newf;
-	error = 0;
-out:
-	return error;
+	return 0;
 }
 
 static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
@@ -1976,6 +1979,7 @@
 	p->rcu_tasks_holdout = false;
 	INIT_LIST_HEAD(&p->rcu_tasks_holdout_list);
 	p->rcu_tasks_idle_cpu = -1;
+	INIT_LIST_HEAD(&p->rcu_tasks_exit_list);
 #endif /* #ifdef CONFIG_TASKS_RCU */
 #ifdef CONFIG_TASKS_TRACE_RCU
 	p->trc_reader_nesting = 0;
@@ -2260,6 +2264,10 @@
 	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
 		return ERR_PTR(-EINVAL);
 
+	if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
+		if (!capable(CAP_SYS_ADMIN))
+			return ERR_PTR(-EPERM);
+
 	/*
 	 * Thread groups must share signals as well, and detached threads
 	 * can only be started up within the thread group.
@@ -2416,6 +2424,7 @@
 	acct_clear_integrals(p);
 
 	posix_cputimers_init(&p->posix_cputimers);
+	tick_dep_init_task(p);
 
 	p->io_context = NULL;
 	audit_set_context(p, NULL);
@@ -3351,17 +3360,16 @@
 /*
  * Unshare file descriptor table if it is being shared
  */
-int unshare_fd(unsigned long unshare_flags, unsigned int max_fds,
-	       struct files_struct **new_fdp)
+static int unshare_fd(unsigned long unshare_flags, struct files_struct **new_fdp)
 {
 	struct files_struct *fd = current->files;
-	int error = 0;
 
 	if ((unshare_flags & CLONE_FILES) &&
 	    (fd && atomic_read(&fd->count) > 1)) {
-		*new_fdp = dup_fd(fd, max_fds, &error);
-		if (!*new_fdp)
-			return error;
+		fd = dup_fd(fd, NULL);
+		if (IS_ERR(fd))
+			return PTR_ERR(fd);
+		*new_fdp = fd;
 	}
 
 	return 0;
@@ -3406,6 +3414,12 @@
 	if (unshare_flags & CLONE_NEWNS)
 		unshare_flags |= CLONE_FS;
 
+	if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
+		err = -EPERM;
+		if (!capable(CAP_SYS_ADMIN))
+			goto bad_unshare_out;
+	}
+
 	err = check_unshare_flags(unshare_flags);
 	if (err)
 		goto bad_unshare_out;
@@ -3419,7 +3433,7 @@
 	err = unshare_fs(unshare_flags, &new_fs);
 	if (err)
 		goto bad_unshare_out;
-	err = unshare_fd(unshare_flags, NR_OPEN_MAX, &new_fd);
+	err = unshare_fd(unshare_flags, &new_fd);
 	if (err)
 		goto bad_unshare_cleanup_fs;
 	err = unshare_userns(unshare_flags, &new_cred);
@@ -3511,7 +3525,7 @@
 	struct files_struct *old, *copy = NULL;
 	int error;
 
-	error = unshare_fd(CLONE_FILES, NR_OPEN_MAX, &copy);
+	error = unshare_fd(CLONE_FILES, &copy);
 	if (error || !copy)
 		return error;
 
--- linux-qcom-6.8.0.orig/kernel/gcov/gcc_4_7.c
+++ linux-qcom-6.8.0/kernel/gcov/gcc_4_7.c
@@ -18,7 +18,9 @@
 #include <linux/mm.h>
 #include "gcov.h"
 
-#if (__GNUC__ >= 10)
+#if (__GNUC__ >= 14)
+#define GCOV_COUNTERS			9
+#elif (__GNUC__ >= 10)
 #define GCOV_COUNTERS			8
 #elif (__GNUC__ >= 7)
 #define GCOV_COUNTERS			9
--- linux-qcom-6.8.0.orig/kernel/gen_kheaders.sh
+++ linux-qcom-6.8.0/kernel/gen_kheaders.sh
@@ -14,7 +14,12 @@
 arch/$SRCARCH/include/
 "
 
-type cpio > /dev/null
+if ! command -v cpio >/dev/null; then
+	echo >&2 "***"
+	echo >&2 "*** 'cpio' could not be found."
+	echo >&2 "***"
+	exit 1
+fi
 
 # Support incremental builds by skipping archive generation
 # if timestamps of files being archived are not changed.
@@ -84,7 +89,8 @@
 
 # Create archive and try to normalize metadata for reproducibility.
 tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
-    --owner=0 --group=0 --sort=name --numeric-owner \
+    --exclude=".__afs*" --exclude=".nfs*" \
+    --owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \
     -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null
 
 echo $headers_md5 > kernel/kheaders.md5
--- linux-qcom-6.8.0.orig/kernel/irq/cpuhotplug.c
+++ linux-qcom-6.8.0/kernel/irq/cpuhotplug.c
@@ -70,6 +70,14 @@
 	}
 
 	/*
+	 * Complete an eventually pending irq move cleanup. If this
+	 * interrupt was moved in hard irq context, then the vectors need
+	 * to be cleaned up. It can't wait until this interrupt actually
+	 * happens and this CPU was involved.
+	 */
+	irq_force_complete_move(desc);
+
+	/*
 	 * No move required, if:
 	 * - Interrupt is per cpu
 	 * - Interrupt is not started
@@ -88,14 +96,6 @@
 	}
 
 	/*
-	 * Complete an eventually pending irq move cleanup. If this
-	 * interrupt was moved in hard irq context, then the vectors need
-	 * to be cleaned up. It can't wait until this interrupt actually
-	 * happens and this CPU was involved.
-	 */
-	irq_force_complete_move(desc);
-
-	/*
 	 * If there is a setaffinity pending, then try to reuse the pending
 	 * mask, so the last change of the affinity does not get lost. If
 	 * there is no move pending or the pending mask does not contain
@@ -130,6 +130,22 @@
 	 * CPU.
 	 */
 	err = irq_do_set_affinity(d, affinity, false);
+
+	/*
+	 * If there are online CPUs in the affinity mask, but they have no
+	 * vectors left to make the migration work, try to break the
+	 * affinity by migrating to any online CPU.
+	 */
+	if (err == -ENOSPC && !irqd_affinity_is_managed(d) && affinity != cpu_online_mask) {
+		pr_debug("IRQ%u: set affinity failed for %*pbl, re-try with online CPUs\n",
+			 d->irq, cpumask_pr_args(affinity));
+
+		affinity = cpu_online_mask;
+		brokeaff = true;
+
+		err = irq_do_set_affinity(d, affinity, false);
+	}
+
 	if (err) {
 		pr_warn_ratelimited("IRQ%u: set affinity failed(%d).\n",
 				    d->irq, err);
@@ -195,10 +211,15 @@
 	    !irq_data_get_irq_chip(data) || !cpumask_test_cpu(cpu, affinity))
 		return;
 
-	if (irqd_is_managed_and_shutdown(data)) {
-		irq_startup(desc, IRQ_RESEND, IRQ_START_COND);
+	/*
+	 * Don't restore suspended interrupts here when a system comes back
+	 * from S3. They are reenabled via resume_device_irqs().
+	 */
+	if (desc->istate & IRQS_SUSPENDED)
 		return;
-	}
+
+	if (irqd_is_managed_and_shutdown(data))
+		irq_startup(desc, IRQ_RESEND, IRQ_START_COND);
 
 	/*
 	 * If the interrupt can only be directed to a single target
--- linux-qcom-6.8.0.orig/kernel/irq/irqdesc.c
+++ linux-qcom-6.8.0/kernel/irq/irqdesc.c
@@ -148,7 +148,10 @@
 static unsigned int irq_find_at_or_after(unsigned int offset)
 {
 	unsigned long index = offset;
-	struct irq_desc *desc = mt_find(&sparse_irqs, &index, nr_irqs);
+	struct irq_desc *desc;
+
+	guard(rcu)();
+	desc = mt_find(&sparse_irqs, &index, nr_irqs);
 
 	return desc ? irq_desc_get_irq(desc) : nr_irqs;
 }
@@ -514,6 +517,7 @@
 				flags = IRQD_AFFINITY_MANAGED |
 					IRQD_MANAGED_SHUTDOWN;
 			}
+			flags |= IRQD_AFFINITY_SET;
 			mask = &affinity->mask;
 			node = cpu_to_node(cpumask_first(mask));
 			affinity++;
--- linux-qcom-6.8.0.orig/kernel/irq/irqdomain.c
+++ linux-qcom-6.8.0/kernel/irq/irqdomain.c
@@ -154,7 +154,6 @@
 		switch (fwid->type) {
 		case IRQCHIP_FWNODE_NAMED:
 		case IRQCHIP_FWNODE_NAMED_ID:
-			domain->fwnode = fwnode;
 			domain->name = kstrdup(fwid->name, GFP_KERNEL);
 			if (!domain->name) {
 				kfree(domain);
@@ -163,7 +162,6 @@
 			domain->flags |= IRQ_DOMAIN_NAME_ALLOCATED;
 			break;
 		default:
-			domain->fwnode = fwnode;
 			domain->name = fwid->name;
 			break;
 		}
@@ -183,7 +181,6 @@
 		}
 
 		domain->name = strreplace(name, '/', ':');
-		domain->fwnode = fwnode;
 		domain->flags |= IRQ_DOMAIN_NAME_ALLOCATED;
 	}
 
@@ -199,8 +196,8 @@
 		domain->flags |= IRQ_DOMAIN_NAME_ALLOCATED;
 	}
 
-	fwnode_handle_get(fwnode);
-	fwnode_dev_initialized(fwnode, true);
+	domain->fwnode = fwnode_handle_get(fwnode);
+	fwnode_dev_initialized(domain->fwnode, true);
 
 	/* Fill structure */
 	INIT_RADIX_TREE(&domain->revmap_tree, GFP_KERNEL);
--- linux-qcom-6.8.0.orig/kernel/irq/manage.c
+++ linux-qcom-6.8.0/kernel/irq/manage.c
@@ -796,10 +796,14 @@
 		irq_settings_set_noprobe(desc);
 		/*
 		 * Call irq_startup() not irq_enable() here because the
-		 * interrupt might be marked NOAUTOEN. So irq_startup()
-		 * needs to be invoked when it gets enabled the first
-		 * time. If it was already started up, then irq_startup()
-		 * will invoke irq_enable() under the hood.
+		 * interrupt might be marked NOAUTOEN so irq_startup()
+		 * needs to be invoked when it gets enabled the first time.
+		 * This is also required when __enable_irq() is invoked for
+		 * a managed and shutdown interrupt from the S3 resume
+		 * path.
+		 *
+		 * If it was already started up, then irq_startup() will
+		 * invoke irq_enable() under the hood.
 		 */
 		irq_startup(desc, IRQ_RESEND, IRQ_START_FORCE);
 		break;
@@ -1332,7 +1336,7 @@
 	 * synchronize_hardirq(). So neither IRQTF_RUNTHREAD nor the
 	 * oneshot mask bit can be set.
 	 */
-	task_work_cancel(current, irq_thread_dtor);
+	task_work_cancel_func(current, irq_thread_dtor);
 	return 0;
 }
 
@@ -1642,8 +1646,13 @@
 		}
 
 		if (!((old->flags & new->flags) & IRQF_SHARED) ||
-		    (oldtype != (new->flags & IRQF_TRIGGER_MASK)) ||
-		    ((old->flags ^ new->flags) & IRQF_ONESHOT))
+		    (oldtype != (new->flags & IRQF_TRIGGER_MASK)))
+			goto mismatch;
+
+		if ((old->flags & IRQF_ONESHOT) &&
+		    (new->flags & IRQF_COND_ONESHOT))
+			new->flags |= IRQF_ONESHOT;
+		else if ((old->flags ^ new->flags) & IRQF_ONESHOT)
 			goto mismatch;
 
 		/* All handlers must agree on per-cpuness */
--- linux-qcom-6.8.0.orig/kernel/jump_label.c
+++ linux-qcom-6.8.0/kernel/jump_label.c
@@ -131,7 +131,7 @@
 	STATIC_KEY_CHECK_USE(key);
 	/*
 	 * Negative key->enabled has a special meaning: it sends
-	 * static_key_slow_inc() down the slow path, and it is non-zero
+	 * static_key_slow_inc/dec() down the slow path, and it is non-zero
 	 * so it counts as "enabled" in jump_label_update().  Note that
 	 * atomic_inc_unless_negative() checks >= 0, so roll our own.
 	 */
@@ -150,7 +150,7 @@
 	lockdep_assert_cpus_held();
 
 	/*
-	 * Careful if we get concurrent static_key_slow_inc() calls;
+	 * Careful if we get concurrent static_key_slow_inc/dec() calls;
 	 * later calls must wait for the first one to _finish_ the
 	 * jump_label_update() process.  At the same time, however,
 	 * the jump_label_update() call below wants to see
@@ -159,22 +159,24 @@
 	if (static_key_fast_inc_not_disabled(key))
 		return true;
 
-	jump_label_lock();
-	if (atomic_read(&key->enabled) == 0) {
-		atomic_set(&key->enabled, -1);
+	guard(mutex)(&jump_label_mutex);
+	/* Try to mark it as 'enabling in progress. */
+	if (!atomic_cmpxchg(&key->enabled, 0, -1)) {
 		jump_label_update(key);
 		/*
-		 * Ensure that if the above cmpxchg loop observes our positive
-		 * value, it must also observe all the text changes.
+		 * Ensure that when static_key_fast_inc_not_disabled() or
+		 * static_key_dec_not_one() observe the positive value,
+		 * they must also observe all the text changes.
 		 */
 		atomic_set_release(&key->enabled, 1);
 	} else {
-		if (WARN_ON_ONCE(!static_key_fast_inc_not_disabled(key))) {
-			jump_label_unlock();
+		/*
+		 * While holding the mutex this should never observe
+		 * anything else than a value >= 1 and succeed
+		 */
+		if (WARN_ON_ONCE(!static_key_fast_inc_not_disabled(key)))
 			return false;
-		}
 	}
-	jump_label_unlock();
 	return true;
 }
 
@@ -231,7 +233,7 @@
 	}
 
 	jump_label_lock();
-	if (atomic_cmpxchg(&key->enabled, 1, 0))
+	if (atomic_cmpxchg(&key->enabled, 1, 0) == 1)
 		jump_label_update(key);
 	jump_label_unlock();
 }
@@ -245,36 +247,69 @@
 }
 EXPORT_SYMBOL_GPL(static_key_disable);
 
-static bool static_key_slow_try_dec(struct static_key *key)
+static bool static_key_dec_not_one(struct static_key *key)
 {
-	int val;
-
-	val = atomic_fetch_add_unless(&key->enabled, -1, 1);
-	if (val == 1)
-		return false;
+	int v;
 
 	/*
-	 * The negative count check is valid even when a negative
-	 * key->enabled is in use by static_key_slow_inc(); a
-	 * __static_key_slow_dec() before the first static_key_slow_inc()
-	 * returns is unbalanced, because all other static_key_slow_inc()
-	 * instances block while the update is in progress.
+	 * Go into the slow path if key::enabled is less than or equal than
+	 * one. One is valid to shut down the key, anything less than one
+	 * is an imbalance, which is handled at the call site.
+	 *
+	 * That includes the special case of '-1' which is set in
+	 * static_key_slow_inc_cpuslocked(), but that's harmless as it is
+	 * fully serialized in the slow path below. By the time this task
+	 * acquires the jump label lock the value is back to one and the
+	 * retry under the lock must succeed.
 	 */
-	WARN(val < 0, "jump label: negative count!\n");
+	v = atomic_read(&key->enabled);
+	do {
+		/*
+		 * Warn about the '-1' case though; since that means a
+		 * decrement is concurrent with a first (0->1) increment. IOW
+		 * people are trying to disable something that wasn't yet fully
+		 * enabled. This suggests an ordering problem on the user side.
+		 */
+		WARN_ON_ONCE(v < 0);
+
+		/*
+		 * Warn about underflow, and lie about success in an attempt to
+		 * not make things worse.
+		 */
+		if (WARN_ON_ONCE(v == 0))
+			return true;
+
+		if (v <= 1)
+			return false;
+	} while (!likely(atomic_try_cmpxchg(&key->enabled, &v, v - 1)));
+
 	return true;
 }
 
 static void __static_key_slow_dec_cpuslocked(struct static_key *key)
 {
 	lockdep_assert_cpus_held();
+	int val;
 
-	if (static_key_slow_try_dec(key))
+	if (static_key_dec_not_one(key))
+		return;
+
+	guard(mutex)(&jump_label_mutex);
+	val = atomic_read(&key->enabled);
+	/*
+	 * It should be impossible to observe -1 with jump_label_mutex held,
+	 * see static_key_slow_inc_cpuslocked().
+	 */
+	if (WARN_ON_ONCE(val == -1))
+		return;
+	/*
+	 * Cannot already be 0, something went sideways.
+	 */
+	if (WARN_ON_ONCE(val == 0))
 		return;
 
-	jump_label_lock();
 	if (atomic_dec_and_test(&key->enabled))
 		jump_label_update(key);
-	jump_label_unlock();
 }
 
 static void __static_key_slow_dec(struct static_key *key)
@@ -311,7 +346,7 @@
 {
 	STATIC_KEY_CHECK_USE(key);
 
-	if (static_key_slow_try_dec(key))
+	if (static_key_dec_not_one(key))
 		return;
 
 	schedule_delayed_work(work, timeout);
--- linux-qcom-6.8.0.orig/kernel/kallsyms.c
+++ linux-qcom-6.8.0/kernel/kallsyms.c
@@ -148,9 +148,6 @@
 
 unsigned long kallsyms_sym_address(int idx)
 {
-	if (!IS_ENABLED(CONFIG_KALLSYMS_BASE_RELATIVE))
-		return kallsyms_addresses[idx];
-
 	/* values are unsigned offsets if --absolute-percpu is not in effect */
 	if (!IS_ENABLED(CONFIG_KALLSYMS_ABSOLUTE_PERCPU))
 		return kallsyms_relative_base + (u32)kallsyms_offsets[idx];
@@ -163,38 +160,6 @@
 	return kallsyms_relative_base - 1 - kallsyms_offsets[idx];
 }
 
-static void cleanup_symbol_name(char *s)
-{
-	char *res;
-
-	if (!IS_ENABLED(CONFIG_LTO_CLANG))
-		return;
-
-	/*
-	 * LLVM appends various suffixes for local functions and variables that
-	 * must be promoted to global scope as part of LTO.  This can break
-	 * hooking of static functions with kprobes. '.' is not a valid
-	 * character in an identifier in C. Suffixes only in LLVM LTO observed:
-	 * - foo.llvm.[0-9a-f]+
-	 */
-	res = strstr(s, ".llvm.");
-	if (res)
-		*res = '\0';
-
-	return;
-}
-
-static int compare_symbol_name(const char *name, char *namebuf)
-{
-	/* The kallsyms_seqs_of_names is sorted based on names after
-	 * cleanup_symbol_name() (see scripts/kallsyms.c) if clang lto is enabled.
-	 * To ensure correct bisection in kallsyms_lookup_names(), do
-	 * cleanup_symbol_name(namebuf) before comparing name and namebuf.
-	 */
-	cleanup_symbol_name(namebuf);
-	return strcmp(name, namebuf);
-}
-
 static unsigned int get_symbol_seq(int index)
 {
 	unsigned int i, seq = 0;
@@ -222,7 +187,7 @@
 		seq = get_symbol_seq(mid);
 		off = get_symbol_offset(seq);
 		kallsyms_expand_symbol(off, namebuf, ARRAY_SIZE(namebuf));
-		ret = compare_symbol_name(name, namebuf);
+		ret = strcmp(name, namebuf);
 		if (ret > 0)
 			low = mid + 1;
 		else if (ret < 0)
@@ -239,7 +204,7 @@
 		seq = get_symbol_seq(low - 1);
 		off = get_symbol_offset(seq);
 		kallsyms_expand_symbol(off, namebuf, ARRAY_SIZE(namebuf));
-		if (compare_symbol_name(name, namebuf))
+		if (strcmp(name, namebuf))
 			break;
 		low--;
 	}
@@ -251,7 +216,7 @@
 			seq = get_symbol_seq(high + 1);
 			off = get_symbol_offset(seq);
 			kallsyms_expand_symbol(off, namebuf, ARRAY_SIZE(namebuf));
-			if (compare_symbol_name(name, namebuf))
+			if (strcmp(name, namebuf))
 				break;
 			high++;
 		}
@@ -325,13 +290,7 @@
 	unsigned long symbol_start = 0, symbol_end = 0;
 	unsigned long i, low, high, mid;
 
-	/* This kernel should never had been booted. */
-	if (!IS_ENABLED(CONFIG_KALLSYMS_BASE_RELATIVE))
-		BUG_ON(!kallsyms_addresses);
-	else
-		BUG_ON(!kallsyms_offsets);
-
-	/* Do a binary search on the sorted kallsyms_addresses array. */
+	/* Do a binary search on the sorted kallsyms_offsets array. */
 	low = 0;
 	high = kallsyms_num_syms;
 
@@ -394,12 +353,12 @@
 	       !!__bpf_address_lookup(addr, symbolsize, offset, namebuf);
 }
 
-static const char *kallsyms_lookup_buildid(unsigned long addr,
+static int kallsyms_lookup_buildid(unsigned long addr,
 			unsigned long *symbolsize,
 			unsigned long *offset, char **modname,
 			const unsigned char **modbuildid, char *namebuf)
 {
-	const char *ret;
+	int ret;
 
 	namebuf[KSYM_NAME_LEN - 1] = 0;
 	namebuf[0] = 0;
@@ -416,8 +375,7 @@
 		if (modbuildid)
 			*modbuildid = NULL;
 
-		ret = namebuf;
-		goto found;
+		return strlen(namebuf);
 	}
 
 	/* See if it's in a module or a BPF JITed image. */
@@ -431,8 +389,6 @@
 		ret = ftrace_mod_address_lookup(addr, symbolsize,
 						offset, modname, namebuf);
 
-found:
-	cleanup_symbol_name(namebuf);
 	return ret;
 }
 
@@ -448,14 +404,17 @@
 			    unsigned long *offset,
 			    char **modname, char *namebuf)
 {
-	return kallsyms_lookup_buildid(addr, symbolsize, offset, modname,
-				       NULL, namebuf);
+	int ret = kallsyms_lookup_buildid(addr, symbolsize, offset, modname,
+					  NULL, namebuf);
+
+	if (!ret)
+		return NULL;
+
+	return namebuf;
 }
 
 int lookup_symbol_name(unsigned long addr, char *symname)
 {
-	int res;
-
 	symname[0] = '\0';
 	symname[KSYM_NAME_LEN - 1] = '\0';
 
@@ -466,16 +425,10 @@
 		/* Grab name */
 		kallsyms_expand_symbol(get_symbol_offset(pos),
 				       symname, KSYM_NAME_LEN);
-		goto found;
+		return 0;
 	}
 	/* See if it's in a module. */
-	res = lookup_module_symbol_name(addr, symname);
-	if (res)
-		return res;
-
-found:
-	cleanup_symbol_name(symname);
-	return 0;
+	return lookup_module_symbol_name(addr, symname);
 }
 
 /* Look up a kernel symbol and return it in a text buffer. */
@@ -484,19 +437,15 @@
 {
 	char *modname;
 	const unsigned char *buildid;
-	const char *name;
 	unsigned long offset, size;
 	int len;
 
 	address += symbol_offset;
-	name = kallsyms_lookup_buildid(address, &size, &offset, &modname, &buildid,
+	len = kallsyms_lookup_buildid(address, &size, &offset, &modname, &buildid,
 				       buffer);
-	if (!name)
+	if (!len)
 		return sprintf(buffer, "0x%lx", address - symbol_offset);
 
-	if (name != buffer)
-		strcpy(buffer, name);
-	len = strlen(buffer);
 	offset -= symbol_offset;
 
 	if (add_offset)
--- linux-qcom-6.8.0.orig/kernel/kallsyms_internal.h
+++ linux-qcom-6.8.0/kernel/kallsyms_internal.h
@@ -4,28 +4,16 @@
 
 #include <linux/types.h>
 
-/*
- * These will be re-linked against their real values
- * during the second link stage.
- */
-extern const unsigned long kallsyms_addresses[] __weak;
-extern const int kallsyms_offsets[] __weak;
-extern const u8 kallsyms_names[] __weak;
-
-/*
- * Tell the compiler that the count isn't in the small data section if the arch
- * has one (eg: FRV).
- */
-extern const unsigned int kallsyms_num_syms
-__section(".rodata") __attribute__((weak));
+extern const int kallsyms_offsets[];
+extern const u8 kallsyms_names[];
 
-extern const unsigned long kallsyms_relative_base
-__section(".rodata") __attribute__((weak));
+extern const unsigned int kallsyms_num_syms;
+extern const unsigned long kallsyms_relative_base;
 
-extern const char kallsyms_token_table[] __weak;
-extern const u16 kallsyms_token_index[] __weak;
+extern const char kallsyms_token_table[];
+extern const u16 kallsyms_token_index[];
 
-extern const unsigned int kallsyms_markers[] __weak;
-extern const u8 kallsyms_seqs_of_names[] __weak;
+extern const unsigned int kallsyms_markers[];
+extern const u8 kallsyms_seqs_of_names[];
 
 #endif // LINUX_KALLSYMS_INTERNAL_H_
--- linux-qcom-6.8.0.orig/kernel/kallsyms_selftest.c
+++ linux-qcom-6.8.0/kernel/kallsyms_selftest.c
@@ -188,31 +188,11 @@
 		stat.min, stat.max, div_u64(stat.sum, stat.real_cnt));
 }
 
-static bool match_cleanup_name(const char *s, const char *name)
-{
-	char *p;
-	int len;
-
-	if (!IS_ENABLED(CONFIG_LTO_CLANG))
-		return false;
-
-	p = strstr(s, ".llvm.");
-	if (!p)
-		return false;
-
-	len = strlen(name);
-	if (p - s != len)
-		return false;
-
-	return !strncmp(s, name, len);
-}
-
 static int find_symbol(void *data, const char *name, unsigned long addr)
 {
 	struct test_stat *stat = (struct test_stat *)data;
 
-	if (strcmp(name, stat->name) == 0 ||
-	    (!stat->perf && match_cleanup_name(name, stat->name))) {
+	if (!strcmp(name, stat->name)) {
 		stat->real_cnt++;
 		stat->addr = addr;
 
--- linux-qcom-6.8.0.orig/kernel/kcov.c
+++ linux-qcom-6.8.0/kernel/kcov.c
@@ -161,6 +161,15 @@
 	kmsan_unpoison_memory(&area->list, sizeof(area->list));
 }
 
+/*
+ * Unlike in_serving_softirq(), this function returns false when called during
+ * a hardirq or an NMI that happened in the softirq context.
+ */
+static __always_inline bool in_softirq_really(void)
+{
+	return in_serving_softirq() && !in_hardirq() && !in_nmi();
+}
+
 static notrace bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
 {
 	unsigned int mode;
@@ -170,7 +179,7 @@
 	 * so we ignore code executed in interrupts, unless we are in a remote
 	 * coverage collection section in a softirq.
 	 */
-	if (!in_task() && !(in_serving_softirq() && t->kcov_softirq))
+	if (!in_task() && !(in_softirq_really() && t->kcov_softirq))
 		return false;
 	mode = READ_ONCE(t->kcov_mode);
 	/*
@@ -631,6 +640,7 @@
 			return -EINVAL;
 		kcov->mode = mode;
 		t->kcov = kcov;
+	        t->kcov_mode = KCOV_MODE_REMOTE;
 		kcov->t = t;
 		kcov->remote = true;
 		kcov->remote_size = remote_arg->area_size;
@@ -847,7 +857,7 @@
 
 	if (WARN_ON(!kcov_check_handle(handle, true, true, true)))
 		return;
-	if (!in_task() && !in_serving_softirq())
+	if (!in_task() && !in_softirq_really())
 		return;
 
 	local_lock_irqsave(&kcov_percpu_data.lock, flags);
@@ -989,7 +999,7 @@
 	int sequence;
 	unsigned long flags;
 
-	if (!in_task() && !in_serving_softirq())
+	if (!in_task() && !in_softirq_really())
 		return;
 
 	local_lock_irqsave(&kcov_percpu_data.lock, flags);
--- linux-qcom-6.8.0.orig/kernel/kcsan/debugfs.c
+++ linux-qcom-6.8.0/kernel/kcsan/debugfs.c
@@ -46,14 +46,8 @@
 	int		used;		/* number of elements used */
 	bool		sorted;		/* if elements are sorted */
 	bool		whitelist;	/* if list is a blacklist or whitelist */
-} report_filterlist = {
-	.addrs		= NULL,
-	.size		= 8,		/* small initial size */
-	.used		= 0,
-	.sorted		= false,
-	.whitelist	= false,	/* default is blacklist */
-};
-static DEFINE_SPINLOCK(report_filterlist_lock);
+} report_filterlist;
+static DEFINE_RAW_SPINLOCK(report_filterlist_lock);
 
 /*
  * The microbenchmark allows benchmarking KCSAN core runtime only. To run
@@ -110,7 +104,7 @@
 		return false;
 	func_addr -= offset; /* Get function start */
 
-	spin_lock_irqsave(&report_filterlist_lock, flags);
+	raw_spin_lock_irqsave(&report_filterlist_lock, flags);
 	if (report_filterlist.used == 0)
 		goto out;
 
@@ -127,7 +121,7 @@
 		ret = !ret;
 
 out:
-	spin_unlock_irqrestore(&report_filterlist_lock, flags);
+	raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
 	return ret;
 }
 
@@ -135,9 +129,9 @@
 {
 	unsigned long flags;
 
-	spin_lock_irqsave(&report_filterlist_lock, flags);
+	raw_spin_lock_irqsave(&report_filterlist_lock, flags);
 	report_filterlist.whitelist = whitelist;
-	spin_unlock_irqrestore(&report_filterlist_lock, flags);
+	raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
 }
 
 /* Returns 0 on success, error-code otherwise. */
@@ -145,6 +139,9 @@
 {
 	unsigned long flags;
 	unsigned long addr = kallsyms_lookup_name(func);
+	unsigned long *delay_free = NULL;
+	unsigned long *new_addrs = NULL;
+	size_t new_size = 0;
 	ssize_t ret = 0;
 
 	if (!addr) {
@@ -152,32 +149,33 @@
 		return -ENOENT;
 	}
 
-	spin_lock_irqsave(&report_filterlist_lock, flags);
+retry_alloc:
+	/*
+	 * Check if we need an allocation, and re-validate under the lock. Since
+	 * the report_filterlist_lock is a raw, cannot allocate under the lock.
+	 */
+	if (data_race(report_filterlist.used == report_filterlist.size)) {
+		new_size = (report_filterlist.size ?: 4) * 2;
+		delay_free = new_addrs = kmalloc_array(new_size, sizeof(unsigned long), GFP_KERNEL);
+		if (!new_addrs)
+			return -ENOMEM;
+	}
 
-	if (report_filterlist.addrs == NULL) {
-		/* initial allocation */
-		report_filterlist.addrs =
-			kmalloc_array(report_filterlist.size,
-				      sizeof(unsigned long), GFP_ATOMIC);
-		if (report_filterlist.addrs == NULL) {
-			ret = -ENOMEM;
-			goto out;
-		}
-	} else if (report_filterlist.used == report_filterlist.size) {
-		/* resize filterlist */
-		size_t new_size = report_filterlist.size * 2;
-		unsigned long *new_addrs =
-			krealloc(report_filterlist.addrs,
-				 new_size * sizeof(unsigned long), GFP_ATOMIC);
-
-		if (new_addrs == NULL) {
-			/* leave filterlist itself untouched */
-			ret = -ENOMEM;
-			goto out;
+	raw_spin_lock_irqsave(&report_filterlist_lock, flags);
+	if (report_filterlist.used == report_filterlist.size) {
+		/* Check we pre-allocated enough, and retry if not. */
+		if (report_filterlist.used >= new_size) {
+			raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
+			kfree(new_addrs); /* kfree(NULL) is safe */
+			delay_free = new_addrs = NULL;
+			goto retry_alloc;
 		}
 
+		if (report_filterlist.used)
+			memcpy(new_addrs, report_filterlist.addrs, report_filterlist.used * sizeof(unsigned long));
+		delay_free = report_filterlist.addrs; /* free the old list */
+		report_filterlist.addrs = new_addrs;  /* switch to the new list */
 		report_filterlist.size = new_size;
-		report_filterlist.addrs = new_addrs;
 	}
 
 	/* Note: deduplicating should be done in userspace. */
@@ -185,9 +183,9 @@
 		kallsyms_lookup_name(func);
 	report_filterlist.sorted = false;
 
-out:
-	spin_unlock_irqrestore(&report_filterlist_lock, flags);
+	raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
 
+	kfree(delay_free);
 	return ret;
 }
 
@@ -204,13 +202,13 @@
 	}
 
 	/* show filter functions, and filter type */
-	spin_lock_irqsave(&report_filterlist_lock, flags);
+	raw_spin_lock_irqsave(&report_filterlist_lock, flags);
 	seq_printf(file, "\n%s functions: %s\n",
 		   report_filterlist.whitelist ? "whitelisted" : "blacklisted",
 		   report_filterlist.used == 0 ? "none" : "");
 	for (i = 0; i < report_filterlist.used; ++i)
 		seq_printf(file, " %ps\n", (void *)report_filterlist.addrs[i]);
-	spin_unlock_irqrestore(&report_filterlist_lock, flags);
+	raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/kernel/kexec_file.c
+++ linux-qcom-6.8.0/kernel/kexec_file.c
@@ -738,7 +738,7 @@
 
 #ifdef CONFIG_CRASH_HOTPLUG
 		/* Exclude elfcorehdr segment to allow future changes via hotplug */
-		if (j == image->elfcorehdr_index)
+		if (i == image->elfcorehdr_index)
 			continue;
 #endif
 
--- linux-qcom-6.8.0.orig/kernel/kprobes.c
+++ linux-qcom-6.8.0/kernel/kprobes.c
@@ -1068,6 +1068,7 @@
 
 static int kprobe_ipmodify_enabled;
 static int kprobe_ftrace_enabled;
+bool kprobe_ftrace_disabled;
 
 static int __arm_kprobe_ftrace(struct kprobe *p, struct ftrace_ops *ops,
 			       int *cnt)
@@ -1136,6 +1137,11 @@
 		ipmodify ? &kprobe_ipmodify_ops : &kprobe_ftrace_ops,
 		ipmodify ? &kprobe_ipmodify_enabled : &kprobe_ftrace_enabled);
 }
+
+void kprobe_ftrace_kill(void)
+{
+	kprobe_ftrace_disabled = true;
+}
 #else	/* !CONFIG_KPROBES_ON_FTRACE */
 static inline int arm_kprobe_ftrace(struct kprobe *p)
 {
@@ -1552,8 +1558,8 @@
 	if (lookup_symbol_name(addr, symbuf))
 		return false;
 
-	return str_has_prefix("__cfi_", symbuf) ||
-		str_has_prefix("__pfx_", symbuf);
+	return str_has_prefix(symbuf, "__cfi_") ||
+		str_has_prefix(symbuf, "__pfx_");
 }
 
 static int check_kprobe_address_safe(struct kprobe *p,
@@ -1567,10 +1573,17 @@
 	jump_label_lock();
 	preempt_disable();
 
-	/* Ensure it is not in reserved area nor out of text */
-	if (!(core_kernel_text((unsigned long) p->addr) ||
-	    is_module_text_address((unsigned long) p->addr)) ||
-	    in_gate_area_no_mm((unsigned long) p->addr) ||
+	/* Ensure the address is in a text area, and find a module if exists. */
+	*probed_mod = NULL;
+	if (!core_kernel_text((unsigned long) p->addr)) {
+		*probed_mod = __module_text_address((unsigned long) p->addr);
+		if (!(*probed_mod)) {
+			ret = -EINVAL;
+			goto out;
+		}
+	}
+	/* Ensure it is not in reserved area. */
+	if (in_gate_area_no_mm((unsigned long) p->addr) ||
 	    within_kprobe_blacklist((unsigned long) p->addr) ||
 	    jump_label_text_reserved(p->addr, p->addr) ||
 	    static_call_text_reserved(p->addr, p->addr) ||
@@ -1580,8 +1593,7 @@
 		goto out;
 	}
 
-	/* Check if 'p' is probing a module. */
-	*probed_mod = __module_text_address((unsigned long) p->addr);
+	/* Get module refcount and reject __init functions for loaded modules. */
 	if (*probed_mod) {
 		/*
 		 * We must hold a refcount of the probed module while updating
--- linux-qcom-6.8.0.orig/kernel/kthread.c
+++ linux-qcom-6.8.0/kernel/kthread.c
@@ -458,6 +458,17 @@
 	 * new kernel thread.
 	 */
 	if (unlikely(wait_for_completion_killable(&done))) {
+		int i = 0;
+
+		/*
+		 * I got SIGKILL, but wait for 10 more seconds for completion
+		 * unless chosen by the OOM killer. This delay is there as a
+		 * workaround for boot failure caused by SIGKILL upon device
+		 * driver initialization timeout.
+		 */
+		while (i++ < 10 && !test_tsk_thread_flag(current, TIF_MEMDIE))
+			if (wait_for_completion_timeout(&done, HZ))
+				goto ready;
 		/*
 		 * If I was killed by a fatal signal before kthreadd (or new
 		 * kernel thread) calls complete(), leave the cleanup of this
@@ -471,6 +482,7 @@
 		 */
 		wait_for_completion(&done);
 	}
+ready:
 	task = create->result;
 free_create:
 	kfree(create);
@@ -622,6 +634,8 @@
 {
 	struct kthread *kthread = to_kthread(k);
 
+	if (!test_bit(KTHREAD_SHOULD_PARK, &kthread->flags))
+		return;
 	/*
 	 * Newly created kthread was parked when the CPU was offline.
 	 * The binding was lost and we need to set it again.
@@ -844,8 +858,16 @@
 		 * event only cares about the address.
 		 */
 		trace_sched_kthread_work_execute_end(work, func);
-	} else if (!freezing(current))
+	} else if (!freezing(current)) {
 		schedule();
+	} else {
+		/*
+		 * Handle the case where the current remains
+		 * TASK_INTERRUPTIBLE. try_to_freeze() expects
+		 * the current to be TASK_RUNNING.
+		 */
+		__set_current_state(TASK_RUNNING);
+	}
 
 	try_to_freeze();
 	cond_resched();
--- linux-qcom-6.8.0.orig/kernel/locking/lockdep.c
+++ linux-qcom-6.8.0/kernel/locking/lockdep.c
@@ -6184,25 +6184,27 @@
 static void free_zapped_rcu(struct rcu_head *cb);
 
 /*
- * Schedule an RCU callback if no RCU callback is pending. Must be called with
- * the graph lock held.
- */
-static void call_rcu_zapped(struct pending_free *pf)
+* See if we need to queue an RCU callback, must called with
+* the lockdep lock held, returns false if either we don't have
+* any pending free or the callback is already scheduled.
+* Otherwise, a call_rcu() must follow this function call.
+*/
+static bool prepare_call_rcu_zapped(struct pending_free *pf)
 {
 	WARN_ON_ONCE(inside_selftest());
 
 	if (list_empty(&pf->zapped))
-		return;
+		return false;
 
 	if (delayed_free.scheduled)
-		return;
+		return false;
 
 	delayed_free.scheduled = true;
 
 	WARN_ON_ONCE(delayed_free.pf + delayed_free.index != pf);
 	delayed_free.index ^= 1;
 
-	call_rcu(&delayed_free.rcu_head, free_zapped_rcu);
+	return true;
 }
 
 /* The caller must hold the graph lock. May be called from RCU context. */
@@ -6228,6 +6230,7 @@
 {
 	struct pending_free *pf;
 	unsigned long flags;
+	bool need_callback;
 
 	if (WARN_ON_ONCE(ch != &delayed_free.rcu_head))
 		return;
@@ -6239,14 +6242,18 @@
 	pf = delayed_free.pf + (delayed_free.index ^ 1);
 	__free_zapped_classes(pf);
 	delayed_free.scheduled = false;
+	need_callback =
+		prepare_call_rcu_zapped(delayed_free.pf + delayed_free.index);
+	lockdep_unlock();
+	raw_local_irq_restore(flags);
 
 	/*
-	 * If there's anything on the open list, close and start a new callback.
-	 */
-	call_rcu_zapped(delayed_free.pf + delayed_free.index);
+	* If there's pending free and its callback has not been scheduled,
+	* queue an RCU callback.
+	*/
+	if (need_callback)
+		call_rcu(&delayed_free.rcu_head, free_zapped_rcu);
 
-	lockdep_unlock();
-	raw_local_irq_restore(flags);
 }
 
 /*
@@ -6286,6 +6293,7 @@
 {
 	struct pending_free *pf;
 	unsigned long flags;
+	bool need_callback;
 
 	init_data_structures_once();
 
@@ -6293,10 +6301,11 @@
 	lockdep_lock();
 	pf = get_pending_free();
 	__lockdep_free_key_range(pf, start, size);
-	call_rcu_zapped(pf);
+	need_callback = prepare_call_rcu_zapped(pf);
 	lockdep_unlock();
 	raw_local_irq_restore(flags);
-
+	if (need_callback)
+		call_rcu(&delayed_free.rcu_head, free_zapped_rcu);
 	/*
 	 * Wait for any possible iterators from look_up_lock_class() to pass
 	 * before continuing to free the memory they refer to.
@@ -6390,6 +6399,7 @@
 	struct pending_free *pf;
 	unsigned long flags;
 	int locked;
+	bool need_callback = false;
 
 	raw_local_irq_save(flags);
 	locked = graph_lock();
@@ -6398,11 +6408,13 @@
 
 	pf = get_pending_free();
 	__lockdep_reset_lock(pf, lock);
-	call_rcu_zapped(pf);
+	need_callback = prepare_call_rcu_zapped(pf);
 
 	graph_unlock();
 out_irq:
 	raw_local_irq_restore(flags);
+	if (need_callback)
+		call_rcu(&delayed_free.rcu_head, free_zapped_rcu);
 }
 
 /*
@@ -6446,6 +6458,7 @@
 	struct pending_free *pf;
 	unsigned long flags;
 	bool found = false;
+	bool need_callback = false;
 
 	might_sleep();
 
@@ -6466,11 +6479,14 @@
 	if (found) {
 		pf = get_pending_free();
 		__lockdep_free_key_range(pf, key, 1);
-		call_rcu_zapped(pf);
+		need_callback = prepare_call_rcu_zapped(pf);
 	}
 	lockdep_unlock();
 	raw_local_irq_restore(flags);
 
+	if (need_callback)
+		call_rcu(&delayed_free.rcu_head, free_zapped_rcu);
+
 	/* Wait until is_dynamic_key() has finished accessing k->hash_entry. */
 	synchronize_rcu();
 }
--- linux-qcom-6.8.0.orig/kernel/locking/mutex-debug.c
+++ linux-qcom-6.8.0/kernel/locking/mutex-debug.c
@@ -12,6 +12,7 @@
  */
 #include <linux/mutex.h>
 #include <linux/delay.h>
+#include <linux/device.h>
 #include <linux/export.h>
 #include <linux/poison.h>
 #include <linux/sched.h>
@@ -89,6 +90,17 @@
 	lock->magic = lock;
 }
 
+static void devm_mutex_release(void *res)
+{
+	mutex_destroy(res);
+}
+
+int __devm_mutex_init(struct device *dev, struct mutex *lock)
+{
+	return devm_add_action_or_reset(dev, devm_mutex_release, lock);
+}
+EXPORT_SYMBOL_GPL(__devm_mutex_init);
+
 /***
  * mutex_destroy - mark a mutex unusable
  * @lock: the mutex to be destroyed
--- linux-qcom-6.8.0.orig/kernel/locking/rtmutex.c
+++ linux-qcom-6.8.0/kernel/locking/rtmutex.c
@@ -1643,6 +1643,7 @@
 }
 
 static void __sched rt_mutex_handle_deadlock(int res, int detect_deadlock,
+					     struct rt_mutex_base *lock,
 					     struct rt_mutex_waiter *w)
 {
 	/*
@@ -1655,10 +1656,10 @@
 	if (build_ww_mutex() && w->ww_ctx)
 		return;
 
-	/*
-	 * Yell loudly and stop the task right here.
-	 */
+	raw_spin_unlock_irq(&lock->wait_lock);
+
 	WARN(1, "rtmutex deadlock detected\n");
+
 	while (1) {
 		set_current_state(TASK_INTERRUPTIBLE);
 		rt_mutex_schedule();
@@ -1712,7 +1713,7 @@
 	} else {
 		__set_current_state(TASK_RUNNING);
 		remove_waiter(lock, waiter);
-		rt_mutex_handle_deadlock(ret, chwalk, waiter);
+		rt_mutex_handle_deadlock(ret, chwalk, lock, waiter);
 	}
 
 	/*
--- linux-qcom-6.8.0.orig/kernel/locking/rwsem.c
+++ linux-qcom-6.8.0/kernel/locking/rwsem.c
@@ -1297,7 +1297,7 @@
 /*
  * lock for writing
  */
-static inline int __down_write_common(struct rw_semaphore *sem, int state)
+static __always_inline int __down_write_common(struct rw_semaphore *sem, int state)
 {
 	int ret = 0;
 
@@ -1310,12 +1310,12 @@
 	return ret;
 }
 
-static inline void __down_write(struct rw_semaphore *sem)
+static __always_inline void __down_write(struct rw_semaphore *sem)
 {
 	__down_write_common(sem, TASK_UNINTERRUPTIBLE);
 }
 
-static inline int __down_write_killable(struct rw_semaphore *sem)
+static __always_inline int __down_write_killable(struct rw_semaphore *sem)
 {
 	return __down_write_common(sem, TASK_KILLABLE);
 }
--- linux-qcom-6.8.0.orig/kernel/module/Kconfig
+++ linux-qcom-6.8.0/kernel/module/Kconfig
@@ -236,6 +236,10 @@
 	  possible to load a signed module containing the algorithm to check
 	  the signature on that module.
 
+config MODULE_SIG_SHA1
+	bool "Sign modules with SHA-1"
+	select CRYPTO_SHA1
+
 config MODULE_SIG_SHA256
 	bool "Sign modules with SHA-256"
 	select CRYPTO_SHA256
@@ -265,6 +269,7 @@
 config MODULE_SIG_HASH
 	string
 	depends on MODULE_SIG || IMA_APPRAISE_MODSIG
+	default "sha1" if MODULE_SIG_SHA1
 	default "sha256" if MODULE_SIG_SHA256
 	default "sha384" if MODULE_SIG_SHA384
 	default "sha512" if MODULE_SIG_SHA512
--- linux-qcom-6.8.0.orig/kernel/module/Makefile
+++ linux-qcom-6.8.0/kernel/module/Makefile
@@ -5,7 +5,7 @@
 
 # These are called from save_stack_trace() on slub debug path,
 # and produce insane amounts of uninteresting coverage.
-KCOV_INSTRUMENT_module.o := n
+KCOV_INSTRUMENT_main.o := n
 
 obj-y += main.o
 obj-y += strict_rwx.o
--- linux-qcom-6.8.0.orig/kernel/module/kallsyms.c
+++ linux-qcom-6.8.0/kernel/module/kallsyms.c
@@ -321,14 +321,15 @@
  * For kallsyms to ask for address resolution.  NULL means not found.  Careful
  * not to lock to avoid deadlock on oopses, simply disable preemption.
  */
-const char *module_address_lookup(unsigned long addr,
-				  unsigned long *size,
-			    unsigned long *offset,
-			    char **modname,
-			    const unsigned char **modbuildid,
-			    char *namebuf)
+int module_address_lookup(unsigned long addr,
+			  unsigned long *size,
+			  unsigned long *offset,
+			  char **modname,
+			  const unsigned char **modbuildid,
+			  char *namebuf)
 {
-	const char *ret = NULL;
+	const char *sym;
+	int ret = 0;
 	struct module *mod;
 
 	preempt_disable();
@@ -344,12 +345,10 @@
 #endif
 		}
 
-		ret = find_kallsyms_symbol(mod, addr, size, offset);
-	}
-	/* Make a copy in here where it's safe */
-	if (ret) {
-		strncpy(namebuf, ret, KSYM_NAME_LEN - 1);
-		ret = namebuf;
+		sym = find_kallsyms_symbol(mod, addr, size, offset);
+
+		if (sym)
+			ret = strscpy(namebuf, sym, KSYM_NAME_LEN);
 	}
 	preempt_enable();
 
--- linux-qcom-6.8.0.orig/kernel/module/main.c
+++ linux-qcom-6.8.0/kernel/module/main.c
@@ -2489,6 +2489,11 @@
 	}
 }
 
+void flush_module_init_free_work(void)
+{
+	flush_work(&init_free_wq);
+}
+
 #undef MODULE_PARAM_PREFIX
 #define MODULE_PARAM_PREFIX "module."
 /* Default value for module->async_probe_requested */
@@ -2593,8 +2598,8 @@
 	 * Note that module_alloc() on most architectures creates W+X page
 	 * mappings which won't be cleaned up until do_free_init() runs.  Any
 	 * code such as mark_rodata_ro() which depends on those mappings to
-	 * be cleaned up needs to sync with the queued work - ie
-	 * rcu_barrier()
+	 * be cleaned up needs to sync with the queued work by invoking
+	 * flush_module_init_free_work().
 	 */
 	if (llist_add(&freeinit->node, &init_free_list))
 		schedule_work(&init_free_wq);
@@ -3079,7 +3084,7 @@
 	struct idempotent *existing;
 	bool first;
 
-	u->ret = 0;
+	u->ret = -EINTR;
 	u->cookie = cookie;
 	init_completion(&u->complete);
 
@@ -3115,7 +3120,7 @@
 	hlist_for_each_entry_safe(pos, next, head, entry) {
 		if (pos->cookie != cookie)
 			continue;
-		hlist_del(&pos->entry);
+		hlist_del_init(&pos->entry);
 		pos->ret = ret;
 		complete(&pos->complete);
 	}
@@ -3123,6 +3128,28 @@
 	return ret;
 }
 
+/*
+ * Wait for the idempotent worker.
+ *
+ * If we get interrupted, we need to remove ourselves from the
+ * the idempotent list, and the completion may still come in.
+ *
+ * The 'idem_lock' protects against the race, and 'idem.ret' was
+ * initialized to -EINTR and is thus always the right return
+ * value even if the idempotent work then completes between
+ * the wait_for_completion and the cleanup.
+ */
+static int idempotent_wait_for_completion(struct idempotent *u)
+{
+	if (wait_for_completion_interruptible(&u->complete)) {
+		spin_lock(&idem_lock);
+		if (!hlist_unhashed(&u->entry))
+			hlist_del(&u->entry);
+		spin_unlock(&idem_lock);
+	}
+	return u->ret;
+}
+
 static int init_module_from_file(struct file *f, const char __user * uargs, int flags)
 {
 	struct load_info info = { };
@@ -3158,15 +3185,16 @@
 	if (!f || !(f->f_mode & FMODE_READ))
 		return -EBADF;
 
-	/* See if somebody else is doing the operation? */
-	if (idempotent(&idem, file_inode(f))) {
-		wait_for_completion(&idem.complete);
-		return idem.ret;
+	/* Are we the winners of the race and get to do this? */
+	if (!idempotent(&idem, file_inode(f))) {
+		int ret = init_module_from_file(f, uargs, flags);
+		return idempotent_complete(&idem, ret);
 	}
 
-	/* Otherwise, we'll do it and complete others */
-	return idempotent_complete(&idem,
-		init_module_from_file(f, uargs, flags));
+	/*
+	 * Somebody else won the race and is loading the module.
+	 */
+	return idempotent_wait_for_completion(&idem);
 }
 
 SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs, int, flags)
--- linux-qcom-6.8.0.orig/kernel/module/signing.c
+++ linux-qcom-6.8.0/kernel/module/signing.c
@@ -61,10 +61,17 @@
 	modlen -= sig_len + sizeof(ms);
 	info->len = modlen;
 
-	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+	ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
 				      VERIFY_USE_SECONDARY_KEYRING,
 				      VERIFYING_MODULE_SIGNATURE,
 				      NULL, NULL);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+		ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+				VERIFY_USE_PLATFORM_KEYRING,
+				VERIFYING_MODULE_SIGNATURE,
+				NULL, NULL);
+	}
+	return ret;
 }
 
 int module_sig_check(struct load_info *info, int flags)
--- linux-qcom-6.8.0.orig/kernel/module/version.c
+++ linux-qcom-6.8.0/kernel/module/version.c
@@ -17,32 +17,30 @@
 {
 	Elf_Shdr *sechdrs = info->sechdrs;
 	unsigned int versindex = info->index.vers;
-	unsigned int i, num_versions;
-	struct modversion_info *versions;
+	struct modversion_info *versions, *end;
+	u32 crcval;
 
 	/* Exporting module didn't supply crcs?  OK, we're already tainted. */
 	if (!crc)
 		return 1;
+	crcval = *crc;
 
 	/* No versions at all?  modprobe --force does this. */
 	if (versindex == 0)
 		return try_to_force_load(mod, symname) == 0;
 
 	versions = (void *)sechdrs[versindex].sh_addr;
-	num_versions = sechdrs[versindex].sh_size
-		/ sizeof(struct modversion_info);
+	end = (void *)versions + sechdrs[versindex].sh_size;
 
-	for (i = 0; i < num_versions; i++) {
-		u32 crcval;
-
-		if (strcmp(versions[i].name, symname) != 0)
+	for (; versions < end && versions->next;
+	       versions = (void *)versions + versions->next) {
+		if (strcmp(versions->name, symname) != 0)
 			continue;
 
-		crcval = *crc;
-		if (versions[i].crc == crcval)
+		if (versions->crc == crcval)
 			return 1;
-		pr_debug("Found checksum %X vs module %lX\n",
-			 crcval, versions[i].crc);
+		pr_debug("Found checksum %X vs module %X\n",
+			 crcval, versions->crc);
 		goto bad_version;
 	}
 
--- linux-qcom-6.8.0.orig/kernel/padata.c
+++ linux-qcom-6.8.0/kernel/padata.c
@@ -106,7 +106,7 @@
 {
 	int i;
 
-	spin_lock(&padata_works_lock);
+	spin_lock_bh(&padata_works_lock);
 	/* Start at 1 because the current task participates in the job. */
 	for (i = 1; i < nworks; ++i) {
 		struct padata_work *pw = padata_work_alloc();
@@ -116,7 +116,7 @@
 		padata_work_init(pw, padata_mt_helper, data, 0);
 		list_add(&pw->pw_list, head);
 	}
-	spin_unlock(&padata_works_lock);
+	spin_unlock_bh(&padata_works_lock);
 
 	return i;
 }
@@ -134,12 +134,12 @@
 	if (list_empty(works))
 		return;
 
-	spin_lock(&padata_works_lock);
+	spin_lock_bh(&padata_works_lock);
 	list_for_each_entry_safe(cur, next, works, pw_list) {
 		list_del(&cur->pw_list);
 		padata_work_free(cur);
 	}
-	spin_unlock(&padata_works_lock);
+	spin_unlock_bh(&padata_works_lock);
 }
 
 static void padata_parallel_worker(struct work_struct *parallel_work)
@@ -404,7 +404,8 @@
 	/* Sort in ascending order of sequence number. */
 	list_for_each_prev(pos, &reorder->list) {
 		cur = list_entry(pos, struct padata_priv, list);
-		if (cur->seq_nr < padata->seq_nr)
+		/* Compare by difference to consider integer wrap around */
+		if ((signed int)(cur->seq_nr - padata->seq_nr) < 0)
 			break;
 	}
 	list_add(&padata->list, pos);
@@ -511,11 +512,21 @@
 	 * thread function.  Load balance large jobs between threads by
 	 * increasing the number of chunks, guarantee at least the minimum
 	 * chunk size from the caller, and honor the caller's alignment.
+	 * Ensure chunk_size is at least 1 to prevent divide-by-0
+	 * panic in padata_mt_helper().
 	 */
 	ps.chunk_size = job->size / (ps.nworks * load_balance_factor);
 	ps.chunk_size = max(ps.chunk_size, job->min_chunk);
+	ps.chunk_size = max(ps.chunk_size, 1ul);
 	ps.chunk_size = roundup(ps.chunk_size, job->align);
 
+	/*
+	 * chunk_size can be 0 if the caller sets min_chunk to 0. So force it
+	 * to at least 1 to prevent divide-by-0 panic in padata_mt_helper().`
+	 */
+	if (!ps.chunk_size)
+		ps.chunk_size = 1U;
+
 	list_for_each_entry(pw, &works, pw_list)
 		queue_work(system_unbound_wq, &pw->pw_work);
 
--- linux-qcom-6.8.0.orig/kernel/panic.c
+++ linux-qcom-6.8.0/kernel/panic.c
@@ -446,6 +446,14 @@
 
 	/* Do not scroll important messages printed above */
 	suppress_printk = 1;
+
+	/*
+	 * The final messages may not have been printed if in a context that
+	 * defers printing (such as NMI) and irq_work is not available.
+	 * Explicitly flush the kernel log buffer one last time.
+	 */
+	console_flush_on_panic(CONSOLE_FLUSH_PENDING);
+
 	local_irq_enable();
 	for (i = 0; ; i += PANIC_TIMER_STEP) {
 		touch_softlockup_watchdog();
--- linux-qcom-6.8.0.orig/kernel/pid_namespace.c
+++ linux-qcom-6.8.0/kernel/pid_namespace.c
@@ -218,6 +218,7 @@
 	 */
 	do {
 		clear_thread_flag(TIF_SIGPENDING);
+		clear_thread_flag(TIF_NOTIFY_SIGNAL);
 		rc = kernel_wait4(-1, NULL, __WALL, NULL);
 	} while (rc != -ECHILD);
 
--- linux-qcom-6.8.0.orig/kernel/power/process.c
+++ linux-qcom-6.8.0/kernel/power/process.c
@@ -194,8 +194,6 @@
 	__usermodehelper_set_disable_depth(UMH_FREEZING);
 	thaw_workqueues();
 
-	cpuset_wait_for_hotplug();
-
 	read_lock(&tasklist_lock);
 	for_each_process_thread(g, p) {
 		/* No other threads should have PF_SUSPEND_TASK set */
--- linux-qcom-6.8.0.orig/kernel/power/suspend.c
+++ linux-qcom-6.8.0/kernel/power/suspend.c
@@ -106,6 +106,12 @@
 	swait_event_exclusive(s2idle_wait_head,
 		    s2idle_state == S2IDLE_STATE_WAKE);
 
+	/*
+	 * Kick all CPUs to ensure that they resume their timers and restore
+	 * consistent system state.
+	 */
+	wake_up_all_idle_cpus();
+
 	cpus_read_unlock();
 
 	raw_spin_lock_irq(&s2idle_lock);
@@ -192,6 +198,7 @@
 		if (mem_sleep_labels[state] &&
 		    !strcmp(str, mem_sleep_labels[state])) {
 			mem_sleep_default = state;
+			mem_sleep_current = state;
 			break;
 		}
 
--- linux-qcom-6.8.0.orig/kernel/printk/nbcon.c
+++ linux-qcom-6.8.0/kernel/printk/nbcon.c
@@ -140,39 +140,6 @@
 	return atomic_try_cmpxchg(&ACCESS_PRIVATE(con, nbcon_state), &cur->atom, new->atom);
 }
 
-#ifdef CONFIG_64BIT
-
-#define __seq_to_nbcon_seq(seq) (seq)
-#define __nbcon_seq_to_seq(seq) (seq)
-
-#else /* CONFIG_64BIT */
-
-#define __seq_to_nbcon_seq(seq) ((u32)seq)
-
-static inline u64 __nbcon_seq_to_seq(u32 nbcon_seq)
-{
-	u64 seq;
-	u64 rb_next_seq;
-
-	/*
-	 * The provided sequence is only the lower 32 bits of the ringbuffer
-	 * sequence. It needs to be expanded to 64bit. Get the next sequence
-	 * number from the ringbuffer and fold it.
-	 *
-	 * Having a 32bit representation in the console is sufficient.
-	 * If a console ever gets more than 2^31 records behind
-	 * the ringbuffer then this is the least of the problems.
-	 *
-	 * Also the access to the ring buffer is always safe.
-	 */
-	rb_next_seq = prb_next_seq(prb);
-	seq = rb_next_seq - ((u32)rb_next_seq - nbcon_seq);
-
-	return seq;
-}
-
-#endif /* CONFIG_64BIT */
-
 /**
  * nbcon_seq_read - Read the current console sequence
  * @con:	Console to read the sequence of
@@ -183,7 +150,7 @@
 {
 	unsigned long nbcon_seq = atomic_long_read(&ACCESS_PRIVATE(con, nbcon_seq));
 
-	return __nbcon_seq_to_seq(nbcon_seq);
+	return __ulseq_to_u64seq(prb, nbcon_seq);
 }
 
 /**
@@ -204,7 +171,7 @@
 	 */
 	u64 valid_seq = max_t(u64, seq, prb_first_valid_seq(prb));
 
-	atomic_long_set(&ACCESS_PRIVATE(con, nbcon_seq), __seq_to_nbcon_seq(valid_seq));
+	atomic_long_set(&ACCESS_PRIVATE(con, nbcon_seq), __u64seq_to_ulseq(valid_seq));
 
 	/* Clear con->seq since nbcon consoles use con->nbcon_seq instead. */
 	con->seq = 0;
@@ -223,11 +190,11 @@
  */
 static void nbcon_seq_try_update(struct nbcon_context *ctxt, u64 new_seq)
 {
-	unsigned long nbcon_seq = __seq_to_nbcon_seq(ctxt->seq);
+	unsigned long nbcon_seq = __u64seq_to_ulseq(ctxt->seq);
 	struct console *con = ctxt->console;
 
 	if (atomic_long_try_cmpxchg(&ACCESS_PRIVATE(con, nbcon_seq), &nbcon_seq,
-				    __seq_to_nbcon_seq(new_seq))) {
+				    __u64seq_to_ulseq(new_seq))) {
 		ctxt->seq = new_seq;
 	} else {
 		ctxt->seq = nbcon_seq_read(con);
--- linux-qcom-6.8.0.orig/kernel/printk/printk.c
+++ linux-qcom-6.8.0/kernel/printk/printk.c
@@ -347,6 +347,29 @@
 	return unlikely(atomic_read(&panic_cpu) != PANIC_CPU_INVALID);
 }
 
+/* Return true if a panic is in progress on the current CPU. */
+bool this_cpu_in_panic(void)
+{
+	/*
+	 * We can use raw_smp_processor_id() here because it is impossible for
+	 * the task to be migrated to the panic_cpu, or away from it. If
+	 * panic_cpu has already been set, and we're not currently executing on
+	 * that CPU, then we never will be.
+	 */
+	return unlikely(atomic_read(&panic_cpu) == raw_smp_processor_id());
+}
+
+/*
+ * Return true if a panic is in progress on a remote CPU.
+ *
+ * On true, the local CPU should immediately release any printing resources
+ * that may be needed by the panic CPU.
+ */
+bool other_cpu_in_panic(void)
+{
+	return (panic_in_progress() && !this_cpu_in_panic());
+}
+
 /*
  * This is used for debugging the mess that is the VT code by
  * keeping track if we have the console semaphore held. It's
@@ -1846,10 +1869,23 @@
  */
 static void console_lock_spinning_enable(void)
 {
+	/*
+	 * Do not use spinning in panic(). The panic CPU wants to keep the lock.
+	 * Non-panic CPUs abandon the flush anyway.
+	 *
+	 * Just keep the lockdep annotation. The panic-CPU should avoid
+	 * taking console_owner_lock because it might cause a deadlock.
+	 * This looks like the easiest way how to prevent false lockdep
+	 * reports without handling races a lockless way.
+	 */
+	if (panic_in_progress())
+		goto lockdep;
+
 	raw_spin_lock(&console_owner_lock);
 	console_owner = current;
 	raw_spin_unlock(&console_owner_lock);
 
+lockdep:
 	/* The waiter may spin on us after setting console_owner */
 	spin_acquire(&console_owner_dep_map, 0, 0, _THIS_IP_);
 }
@@ -1874,6 +1910,22 @@
 {
 	int waiter;
 
+	/*
+	 * Ignore spinning waiters during panic() because they might get stopped
+	 * or blocked at any time,
+	 *
+	 * It is safe because nobody is allowed to start spinning during panic
+	 * in the first place. If there has been a waiter then non panic CPUs
+	 * might stay spinning. They would get stopped anyway. The panic context
+	 * will never start spinning and an interrupted spin on panic CPU will
+	 * never continue.
+	 */
+	if (panic_in_progress()) {
+		/* Keep lockdep happy. */
+		spin_release(&console_owner_dep_map, _THIS_IP_);
+		return 0;
+	}
+
 	raw_spin_lock(&console_owner_lock);
 	waiter = READ_ONCE(console_waiter);
 	console_owner = NULL;
@@ -1974,6 +2026,12 @@
 	 */
 	mutex_acquire(&console_lock_dep_map, 0, 1, _THIS_IP_);
 
+	/*
+	 * Update @console_may_schedule for trylock because the previous
+	 * owner may have been schedulable.
+	 */
+	console_may_schedule = 0;
+
 	return 1;
 }
 
@@ -2270,8 +2328,7 @@
 	if (unlikely(suppress_printk))
 		return 0;
 
-	if (unlikely(suppress_panic_printk) &&
-	    atomic_read(&panic_cpu) != raw_smp_processor_id())
+	if (unlikely(suppress_panic_printk) && other_cpu_in_panic())
 		return 0;
 
 	if (level == LOGLEVEL_SCHED) {
@@ -2601,26 +2658,6 @@
 	return 0;
 }
 
-/*
- * Return true if a panic is in progress on a remote CPU.
- *
- * On true, the local CPU should immediately release any printing resources
- * that may be needed by the panic CPU.
- */
-bool other_cpu_in_panic(void)
-{
-	if (!panic_in_progress())
-		return false;
-
-	/*
-	 * We can use raw_smp_processor_id() here because it is impossible for
-	 * the task to be migrated to the panic_cpu, or away from it. If
-	 * panic_cpu has already been set, and we're not currently executing on
-	 * that CPU, then we never will be.
-	 */
-	return atomic_read(&panic_cpu) != raw_smp_processor_id();
-}
-
 /**
  * console_lock - block the console subsystem from printing
  *
@@ -3263,6 +3300,21 @@
 
 early_param("keep_bootcon", keep_bootcon_setup);
 
+static int console_call_setup(struct console *newcon, char *options)
+{
+	int err;
+
+	if (!newcon->setup)
+		return 0;
+
+	/* Synchronize with possible boot console. */
+	console_lock();
+	err = newcon->setup(newcon, options);
+	console_unlock();
+
+	return err;
+}
+
 /*
  * This is called by register_console() to try to match
  * the newly registered console with any of the ones selected
@@ -3298,8 +3350,8 @@
 			if (_braille_register_console(newcon, c))
 				return 0;
 
-			if (newcon->setup &&
-			    (err = newcon->setup(newcon, c->options)) != 0)
+			err = console_call_setup(newcon, c->options);
+			if (err)
 				return err;
 		}
 		newcon->flags |= CON_ENABLED;
@@ -3325,7 +3377,7 @@
 	if (newcon->index < 0)
 		newcon->index = 0;
 
-	if (newcon->setup && newcon->setup(newcon, NULL) != 0)
+	if (console_call_setup(newcon, NULL) != 0)
 		return;
 
 	newcon->flags |= CON_ENABLED;
@@ -3761,7 +3813,7 @@
 
 	might_sleep();
 
-	seq = prb_next_seq(prb);
+	seq = prb_next_reserve_seq(prb);
 
 	/* Flush the consoles so that records up to @seq are printed. */
 	console_lock();
--- linux-qcom-6.8.0.orig/kernel/printk/printk_ringbuffer.c
+++ linux-qcom-6.8.0/kernel/printk/printk_ringbuffer.c
@@ -6,6 +6,7 @@
 #include <linux/errno.h>
 #include <linux/bug.h>
 #include "printk_ringbuffer.h"
+#include "internal.h"
 
 /**
  * DOC: printk_ringbuffer overview
@@ -303,6 +304,9 @@
  *
  *   desc_push_tail:B / desc_reserve:D
  *     set descriptor reusable (state), then push descriptor tail (id)
+ *
+ *   desc_update_last_finalized:A / desc_last_finalized_seq:A
+ *     store finalized record, then set new highest finalized sequence number
  */
 
 #define DATA_SIZE(data_ring)		_DATA_SIZE((data_ring)->size_bits)
@@ -1442,19 +1446,117 @@
 }
 
 /*
+ * @last_finalized_seq value guarantees that all records up to and including
+ * this sequence number are finalized and can be read. The only exception are
+ * too old records which have already been overwritten.
+ *
+ * It is also guaranteed that @last_finalized_seq only increases.
+ *
+ * Be aware that finalized records following non-finalized records are not
+ * reported because they are not yet available to the reader. For example,
+ * a new record stored via printk() will not be available to a printer if
+ * it follows a record that has not been finalized yet. However, once that
+ * non-finalized record becomes finalized, @last_finalized_seq will be
+ * appropriately updated and the full set of finalized records will be
+ * available to the printer. And since each printk() caller will either
+ * directly print or trigger deferred printing of all available unprinted
+ * records, all printk() messages will get printed.
+ */
+static u64 desc_last_finalized_seq(struct printk_ringbuffer *rb)
+{
+	struct prb_desc_ring *desc_ring = &rb->desc_ring;
+	unsigned long ulseq;
+
+	/*
+	 * Guarantee the sequence number is loaded before loading the
+	 * associated record in order to guarantee that the record can be
+	 * seen by this CPU. This pairs with desc_update_last_finalized:A.
+	 */
+	ulseq = atomic_long_read_acquire(&desc_ring->last_finalized_seq
+					); /* LMM(desc_last_finalized_seq:A) */
+
+	return __ulseq_to_u64seq(rb, ulseq);
+}
+
+static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
+			    struct printk_record *r, unsigned int *line_count);
+
+/*
+ * Check if there are records directly following @last_finalized_seq that are
+ * finalized. If so, update @last_finalized_seq to the latest of these
+ * records. It is not allowed to skip over records that are not yet finalized.
+ */
+static void desc_update_last_finalized(struct printk_ringbuffer *rb)
+{
+	struct prb_desc_ring *desc_ring = &rb->desc_ring;
+	u64 old_seq = desc_last_finalized_seq(rb);
+	unsigned long oldval;
+	unsigned long newval;
+	u64 finalized_seq;
+	u64 try_seq;
+
+try_again:
+	finalized_seq = old_seq;
+	try_seq = finalized_seq + 1;
+
+	/* Try to find later finalized records. */
+	while (_prb_read_valid(rb, &try_seq, NULL, NULL)) {
+		finalized_seq = try_seq;
+		try_seq++;
+	}
+
+	/* No update needed if no later finalized record was found. */
+	if (finalized_seq == old_seq)
+		return;
+
+	oldval = __u64seq_to_ulseq(old_seq);
+	newval = __u64seq_to_ulseq(finalized_seq);
+
+	/*
+	 * Set the sequence number of a later finalized record that has been
+	 * seen.
+	 *
+	 * Guarantee the record data is visible to other CPUs before storing
+	 * its sequence number. This pairs with desc_last_finalized_seq:A.
+	 *
+	 * Memory barrier involvement:
+	 *
+	 * If desc_last_finalized_seq:A reads from
+	 * desc_update_last_finalized:A, then desc_read:A reads from
+	 * _prb_commit:B.
+	 *
+	 * Relies on:
+	 *
+	 * RELEASE from _prb_commit:B to desc_update_last_finalized:A
+	 *    matching
+	 * ACQUIRE from desc_last_finalized_seq:A to desc_read:A
+	 *
+	 * Note: _prb_commit:B and desc_update_last_finalized:A can be
+	 *       different CPUs. However, the desc_update_last_finalized:A
+	 *       CPU (which performs the release) must have previously seen
+	 *       _prb_commit:B.
+	 */
+	if (!atomic_long_try_cmpxchg_release(&desc_ring->last_finalized_seq,
+				&oldval, newval)) { /* LMM(desc_update_last_finalized:A) */
+		old_seq = __ulseq_to_u64seq(rb, oldval);
+		goto try_again;
+	}
+}
+
+/*
  * Attempt to finalize a specified descriptor. If this fails, the descriptor
  * is either already final or it will finalize itself when the writer commits.
  */
-static void desc_make_final(struct prb_desc_ring *desc_ring, unsigned long id)
+static void desc_make_final(struct printk_ringbuffer *rb, unsigned long id)
 {
+	struct prb_desc_ring *desc_ring = &rb->desc_ring;
 	unsigned long prev_state_val = DESC_SV(id, desc_committed);
 	struct prb_desc *d = to_desc(desc_ring, id);
 
-	atomic_long_cmpxchg_relaxed(&d->state_var, prev_state_val,
-			DESC_SV(id, desc_finalized)); /* LMM(desc_make_final:A) */
-
-	/* Best effort to remember the last finalized @id. */
-	atomic_long_set(&desc_ring->last_finalized_id, id);
+	if (atomic_long_try_cmpxchg_relaxed(&d->state_var, &prev_state_val,
+			DESC_SV(id, desc_finalized))) { /* LMM(desc_make_final:A) */
+		desc_update_last_finalized(rb);
+	}
 }
 
 /**
@@ -1550,7 +1652,7 @@
 	 * readers. (For seq==0 there is no previous descriptor.)
 	 */
 	if (info->seq > 0)
-		desc_make_final(desc_ring, DESC_ID(id - 1));
+		desc_make_final(rb, DESC_ID(id - 1));
 
 	r->text_buf = data_alloc(rb, r->text_buf_size, &d->text_blk_lpos, id);
 	/* If text data allocation fails, a data-less record is committed. */
@@ -1643,7 +1745,7 @@
 	 */
 	head_id = atomic_long_read(&desc_ring->head_id); /* LMM(prb_commit:A) */
 	if (head_id != e->id)
-		desc_make_final(desc_ring, e->id);
+		desc_make_final(e->rb, e->id);
 }
 
 /**
@@ -1663,12 +1765,9 @@
  */
 void prb_final_commit(struct prb_reserved_entry *e)
 {
-	struct prb_desc_ring *desc_ring = &e->rb->desc_ring;
-
 	_prb_commit(e, desc_finalized);
 
-	/* Best effort to remember the last finalized @id. */
-	atomic_long_set(&desc_ring->last_finalized_id, e->id);
+	desc_update_last_finalized(e->rb);
 }
 
 /*
@@ -1832,7 +1931,7 @@
 }
 
 /* Get the sequence number of the tail descriptor. */
-static u64 prb_first_seq(struct printk_ringbuffer *rb)
+u64 prb_first_seq(struct printk_ringbuffer *rb)
 {
 	struct prb_desc_ring *desc_ring = &rb->desc_ring;
 	enum desc_state d_state;
@@ -1875,12 +1974,123 @@
 	return seq;
 }
 
+/**
+ * prb_next_reserve_seq() - Get the sequence number after the most recently
+ *                  reserved record.
+ *
+ * @rb:  The ringbuffer to get the sequence number from.
+ *
+ * This is the public function available to readers to see what sequence
+ * number will be assigned to the next reserved record.
+ *
+ * Note that depending on the situation, this value can be equal to or
+ * higher than the sequence number returned by prb_next_seq().
+ *
+ * Context: Any context.
+ * Return: The sequence number that will be assigned to the next record
+ *         reserved.
+ */
+u64 prb_next_reserve_seq(struct printk_ringbuffer *rb)
+{
+	struct prb_desc_ring *desc_ring = &rb->desc_ring;
+	unsigned long last_finalized_id;
+	atomic_long_t *state_var;
+	u64 last_finalized_seq;
+	unsigned long head_id;
+	struct prb_desc desc;
+	unsigned long diff;
+	struct prb_desc *d;
+	int err;
+
+	/*
+	 * It may not be possible to read a sequence number for @head_id.
+	 * So the ID of @last_finailzed_seq is used to calculate what the
+	 * sequence number of @head_id will be.
+	 */
+
+try_again:
+	last_finalized_seq = desc_last_finalized_seq(rb);
+
+	/*
+	 * @head_id is loaded after @last_finalized_seq to ensure that
+	 * it points to the record with @last_finalized_seq or newer.
+	 *
+	 * Memory barrier involvement:
+	 *
+	 * If desc_last_finalized_seq:A reads from
+	 * desc_update_last_finalized:A, then
+	 * prb_next_reserve_seq:A reads from desc_reserve:D.
+	 *
+	 * Relies on:
+	 *
+	 * RELEASE from desc_reserve:D to desc_update_last_finalized:A
+	 *    matching
+	 * ACQUIRE from desc_last_finalized_seq:A to prb_next_reserve_seq:A
+	 *
+	 * Note: desc_reserve:D and desc_update_last_finalized:A can be
+	 *       different CPUs. However, the desc_update_last_finalized:A CPU
+	 *       (which performs the release) must have previously seen
+	 *       desc_read:C, which implies desc_reserve:D can be seen.
+	 */
+	head_id = atomic_long_read(&desc_ring->head_id); /* LMM(prb_next_reserve_seq:A) */
+
+	d = to_desc(desc_ring, last_finalized_seq);
+	state_var = &d->state_var;
+
+	/* Extract the ID, used to specify the descriptor to read. */
+	last_finalized_id = DESC_ID(atomic_long_read(state_var));
+
+	/* Ensure @last_finalized_id is correct. */
+	err = desc_read_finalized_seq(desc_ring, last_finalized_id, last_finalized_seq, &desc);
+
+	if (err == -EINVAL) {
+		if (last_finalized_seq == 0) {
+			/*
+			 * No record has been finalized or even reserved yet.
+			 *
+			 * The @head_id is initialized such that the first
+			 * increment will yield the first record (seq=0).
+			 * Handle it separately to avoid a negative @diff
+			 * below.
+			 */
+			if (head_id == DESC0_ID(desc_ring->count_bits))
+				return 0;
+
+			/*
+			 * One or more descriptors are already reserved. Use
+			 * the descriptor ID of the first one (@seq=0) for
+			 * the @diff below.
+			 */
+			last_finalized_id = DESC0_ID(desc_ring->count_bits) + 1;
+		} else {
+			/* Record must have been overwritten. Try again. */
+			goto try_again;
+		}
+	}
+
+	/* Diff of known descriptor IDs to compute related sequence numbers. */
+	diff = head_id - last_finalized_id;
+
+	/*
+	 * @head_id points to the most recently reserved record, but this
+	 * function returns the sequence number that will be assigned to the
+	 * next (not yet reserved) record. Thus +1 is needed.
+	 */
+	return (last_finalized_seq + diff + 1);
+}
+
 /*
- * Non-blocking read of a record. Updates @seq to the last finalized record
- * (which may have no data available).
+ * Non-blocking read of a record.
+ *
+ * On success @seq is updated to the record that was read and (if provided)
+ * @r and @line_count will contain the read/calculated data.
+ *
+ * On failure @seq is updated to a record that is not yet available to the
+ * reader, but it will be the next record available to the reader.
  *
- * See the description of prb_read_valid() and prb_read_valid_info()
- * for details.
+ * Note: When the current CPU is in panic, this function will skip over any
+ *       non-existent/non-finalized records in order to allow the panic CPU
+ *       to print any and all records that have been finalized.
  */
 static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
 			    struct printk_record *r, unsigned int *line_count)
@@ -1899,12 +2109,32 @@
 			*seq = tail_seq;
 
 		} else if (err == -ENOENT) {
-			/* Record exists, but no data available. Skip. */
+			/* Record exists, but the data was lost. Skip. */
 			(*seq)++;
 
 		} else {
-			/* Non-existent/non-finalized record. Must stop. */
-			return false;
+			/*
+			 * Non-existent/non-finalized record. Must stop.
+			 *
+			 * For panic situations it cannot be expected that
+			 * non-finalized records will become finalized. But
+			 * there may be other finalized records beyond that
+			 * need to be printed for a panic situation. If this
+			 * is the panic CPU, skip this
+			 * non-existent/non-finalized record unless it is
+			 * at or beyond the head, in which case it is not
+			 * possible to continue.
+			 *
+			 * Note that new messages printed on panic CPU are
+			 * finalized when we are here. The only exception
+			 * might be the last message without trailing newline.
+			 * But it would have the sequence number returned
+			 * by "prb_next_reserve_seq() - 1".
+			 */
+			if (this_cpu_in_panic() && ((*seq + 1) < prb_next_reserve_seq(rb)))
+				(*seq)++;
+			else
+				return false;
 		}
 	}
 
@@ -1932,7 +2162,7 @@
  * On success, the reader must check r->info.seq to see which record was
  * actually read. This allows the reader to detect dropped records.
  *
- * Failure means @seq refers to a not yet written record.
+ * Failure means @seq refers to a record not yet available to the reader.
  */
 bool prb_read_valid(struct printk_ringbuffer *rb, u64 seq,
 		    struct printk_record *r)
@@ -1962,7 +2192,7 @@
  * On success, the reader must check info->seq to see which record meta data
  * was actually read. This allows the reader to detect dropped records.
  *
- * Failure means @seq refers to a not yet written record.
+ * Failure means @seq refers to a record not yet available to the reader.
  */
 bool prb_read_valid_info(struct printk_ringbuffer *rb, u64 seq,
 			 struct printk_info *info, unsigned int *line_count)
@@ -2008,7 +2238,9 @@
  * newest sequence number available to readers will be.
  *
  * This provides readers a sequence number to jump to if all currently
- * available records should be skipped.
+ * available records should be skipped. It is guaranteed that all records
+ * previous to the returned value have been finalized and are (or were)
+ * available to the reader.
  *
  * Context: Any context.
  * Return: The sequence number of the next newest (not yet available) record
@@ -2016,34 +2248,19 @@
  */
 u64 prb_next_seq(struct printk_ringbuffer *rb)
 {
-	struct prb_desc_ring *desc_ring = &rb->desc_ring;
-	enum desc_state d_state;
-	unsigned long id;
 	u64 seq;
 
-	/* Check if the cached @id still points to a valid @seq. */
-	id = atomic_long_read(&desc_ring->last_finalized_id);
-	d_state = desc_read(desc_ring, id, NULL, &seq, NULL);
+	seq = desc_last_finalized_seq(rb);
 
-	if (d_state == desc_finalized || d_state == desc_reusable) {
-		/*
-		 * Begin searching after the last finalized record.
-		 *
-		 * On 0, the search must begin at 0 because of hack#2
-		 * of the bootstrapping phase it is not known if a
-		 * record at index 0 exists.
-		 */
-		if (seq != 0)
-			seq++;
-	} else {
-		/*
-		 * The information about the last finalized sequence number
-		 * has gone. It should happen only when there is a flood of
-		 * new messages and the ringbuffer is rapidly recycled.
-		 * Give up and start from the beginning.
-		 */
-		seq = 0;
-	}
+	/*
+	 * Begin searching after the last finalized record.
+	 *
+	 * On 0, the search must begin at 0 because of hack#2
+	 * of the bootstrapping phase it is not known if a
+	 * record at index 0 exists.
+	 */
+	if (seq != 0)
+		seq++;
 
 	/*
 	 * The information about the last finalized @seq might be inaccurate.
@@ -2085,7 +2302,7 @@
 	rb->desc_ring.infos = infos;
 	atomic_long_set(&rb->desc_ring.head_id, DESC0_ID(descbits));
 	atomic_long_set(&rb->desc_ring.tail_id, DESC0_ID(descbits));
-	atomic_long_set(&rb->desc_ring.last_finalized_id, DESC0_ID(descbits));
+	atomic_long_set(&rb->desc_ring.last_finalized_seq, 0);
 
 	rb->text_data_ring.size_bits = textbits;
 	rb->text_data_ring.data = text_buf;
--- linux-qcom-6.8.0.orig/kernel/printk/printk_ringbuffer.h
+++ linux-qcom-6.8.0/kernel/printk/printk_ringbuffer.h
@@ -75,7 +75,7 @@
 	struct printk_info	*infos;
 	atomic_long_t		head_id;
 	atomic_long_t		tail_id;
-	atomic_long_t		last_finalized_id;
+	atomic_long_t		last_finalized_seq;
 };
 
 /*
@@ -259,7 +259,7 @@
 		.infos		= &_##name##_infos[0],						\
 		.head_id	= ATOMIC_INIT(DESC0_ID(descbits)),				\
 		.tail_id	= ATOMIC_INIT(DESC0_ID(descbits)),				\
-		.last_finalized_id = ATOMIC_INIT(DESC0_ID(descbits)),				\
+		.last_finalized_seq = ATOMIC_INIT(0),						\
 	},											\
 	.text_data_ring = {									\
 		.size_bits	= (avgtextbits) + (descbits),					\
@@ -378,7 +378,41 @@
 bool prb_read_valid_info(struct printk_ringbuffer *rb, u64 seq,
 			 struct printk_info *info, unsigned int *line_count);
 
+u64 prb_first_seq(struct printk_ringbuffer *rb);
 u64 prb_first_valid_seq(struct printk_ringbuffer *rb);
 u64 prb_next_seq(struct printk_ringbuffer *rb);
+u64 prb_next_reserve_seq(struct printk_ringbuffer *rb);
+
+#ifdef CONFIG_64BIT
+
+#define __u64seq_to_ulseq(u64seq) (u64seq)
+#define __ulseq_to_u64seq(rb, ulseq) (ulseq)
+
+#else /* CONFIG_64BIT */
+
+#define __u64seq_to_ulseq(u64seq) ((u32)u64seq)
+
+static inline u64 __ulseq_to_u64seq(struct printk_ringbuffer *rb, u32 ulseq)
+{
+	u64 rb_first_seq = prb_first_seq(rb);
+	u64 seq;
+
+	/*
+	 * The provided sequence is only the lower 32 bits of the ringbuffer
+	 * sequence. It needs to be expanded to 64bit. Get the first sequence
+	 * number from the ringbuffer and fold it.
+	 *
+	 * Having a 32bit representation in the console is sufficient.
+	 * If a console ever gets more than 2^31 records behind
+	 * the ringbuffer then this is the least of the problems.
+	 *
+	 * Also the access to the ring buffer is always safe.
+	 */
+	seq = rb_first_seq - (s32)((u32)rb_first_seq - ulseq);
+
+	return seq;
+}
+
+#endif /* CONFIG_64BIT */
 
 #endif /* _KERNEL_PRINTK_RINGBUFFER_H */
--- linux-qcom-6.8.0.orig/kernel/profile.c
+++ linux-qcom-6.8.0/kernel/profile.c
@@ -57,20 +57,11 @@
 int profile_setup(char *str)
 {
 	static const char schedstr[] = "schedule";
-	static const char sleepstr[] = "sleep";
 	static const char kvmstr[] = "kvm";
 	const char *select = NULL;
 	int par;
 
-	if (!strncmp(str, sleepstr, strlen(sleepstr))) {
-#ifdef CONFIG_SCHEDSTATS
-		force_schedstat_enabled();
-		prof_on = SLEEP_PROFILING;
-		select = sleepstr;
-#else
-		pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n");
-#endif /* CONFIG_SCHEDSTATS */
-	} else if (!strncmp(str, schedstr, strlen(schedstr))) {
+	if (!strncmp(str, schedstr, strlen(schedstr))) {
 		prof_on = SCHED_PROFILING;
 		select = schedstr;
 	} else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
--- linux-qcom-6.8.0.orig/kernel/rcu/Kconfig
+++ linux-qcom-6.8.0/kernel/rcu/Kconfig
@@ -314,6 +314,19 @@
 	  To save power, batch RCU callbacks and flush after delay, memory
 	  pressure, or callback list growing too big.
 
+	  Requires rcu_nocbs=all to be set.
+
+	  Use rcutree.enable_rcu_lazy=0 to turn it off at boot time.
+
+config RCU_LAZY_DEFAULT_OFF
+	bool "Turn RCU lazy invocation off by default"
+	depends on RCU_LAZY
+	default n
+	help
+	  Allows building the kernel with CONFIG_RCU_LAZY=y yet keep it default
+	  off. Boot time param rcutree.enable_rcu_lazy=1 can be used to switch
+	  it back on.
+
 config RCU_DOUBLE_CHECK_CB_TIME
 	bool "RCU callback-batch backup time check"
 	depends on RCU_EXPERT
--- linux-qcom-6.8.0.orig/kernel/rcu/rcuscale.c
+++ linux-qcom-6.8.0/kernel/rcu/rcuscale.c
@@ -498,7 +498,7 @@
 			schedule_timeout_idle(torture_random(&tr) % writer_holdoff_jiffies + 1);
 		wdp = &wdpp[i];
 		*wdp = ktime_get_mono_fast_ns();
-		if (gp_async) {
+		if (gp_async && !WARN_ON_ONCE(!cur_ops->async)) {
 retry:
 			if (!rhp)
 				rhp = kmalloc(sizeof(*rhp), GFP_KERNEL);
@@ -554,7 +554,7 @@
 			i++;
 		rcu_scale_wait_shutdown();
 	} while (!torture_must_stop());
-	if (gp_async) {
+	if (gp_async && cur_ops->async) {
 		cur_ops->gp_barrier();
 	}
 	writer_n_durations[me] = i_max + 1;
@@ -780,13 +780,15 @@
 		if (WARN_ON_ONCE(jiffies_at_lazy_cb - jif_start < 2 * HZ)) {
 			pr_alert("ERROR: call_rcu() CBs are not being lazy as expected!\n");
 			WARN_ON_ONCE(1);
-			return -1;
+			firsterr = -1;
+			goto unwind;
 		}
 
 		if (WARN_ON_ONCE(jiffies_at_lazy_cb - jif_start > 3 * HZ)) {
 			pr_alert("ERROR: call_rcu() CBs are being too lazy!\n");
 			WARN_ON_ONCE(1);
-			return -1;
+			firsterr = -1;
+			goto unwind;
 		}
 	}
 
--- linux-qcom-6.8.0.orig/kernel/rcu/rcutorture.c
+++ linux-qcom-6.8.0/kernel/rcu/rcutorture.c
@@ -1993,7 +1993,8 @@
 	preempt_disable();
 	pipe_count = READ_ONCE(p->rtort_pipe_count);
 	if (pipe_count > RCU_TORTURE_PIPE_LEN) {
-		/* Should not happen, but... */
+		// Should not happen in a correct RCU implementation,
+		// happens quite often for torture_type=busted.
 		pipe_count = RCU_TORTURE_PIPE_LEN;
 	}
 	completed = cur_ops->get_gp_seq();
@@ -2481,8 +2482,8 @@
 			preempt_disable();
 		pr_alert("%s start on CPU %d.\n",
 			  __func__, raw_smp_processor_id());
-		while (ULONG_CMP_LT((unsigned long)ktime_get_seconds(),
-				    stop_at))
+		while (ULONG_CMP_LT((unsigned long)ktime_get_seconds(), stop_at) &&
+		       !kthread_should_stop())
 			if (stall_cpu_block) {
 #ifdef CONFIG_PREEMPTION
 				preempt_schedule();
@@ -2614,7 +2615,7 @@
 	spin_lock_irqsave(&rfp->rcu_fwd_lock, flags);
 	rfcpp = rfp->rcu_fwd_cb_tail;
 	rfp->rcu_fwd_cb_tail = &rfcp->rfc_next;
-	WRITE_ONCE(*rfcpp, rfcp);
+	smp_store_release(rfcpp, rfcp);
 	WRITE_ONCE(rfp->n_launders_cb, rfp->n_launders_cb + 1);
 	i = ((jiffies - rfp->rcu_fwd_startat) / (HZ / FWD_CBS_HIST_DIV));
 	if (i >= ARRAY_SIZE(rfp->n_launders_hist))
@@ -3035,11 +3036,12 @@
 }
 
 /* IPI handler to get callback posted on desired CPU, if online. */
-static void rcu_torture_barrier1cb(void *rcu_void)
+static int rcu_torture_barrier1cb(void *rcu_void)
 {
 	struct rcu_head *rhp = rcu_void;
 
 	cur_ops->call(rhp, rcu_torture_barrier_cbf);
+	return 0;
 }
 
 /* kthread function to register callbacks used to test RCU barriers. */
@@ -3065,11 +3067,9 @@
 		 * The above smp_load_acquire() ensures barrier_phase load
 		 * is ordered before the following ->call().
 		 */
-		if (smp_call_function_single(myid, rcu_torture_barrier1cb,
-					     &rcu, 1)) {
-			// IPI failed, so use direct call from current CPU.
+		if (smp_call_on_cpu(myid, rcu_torture_barrier1cb, &rcu, 1))
 			cur_ops->call(&rcu, rcu_torture_barrier_cbf);
-		}
+
 		if (atomic_dec_and_test(&barrier_cbs_count))
 			wake_up(&barrier_wq);
 	} while (!torture_must_stop());
--- linux-qcom-6.8.0.orig/kernel/rcu/tasks.h
+++ linux-qcom-6.8.0/kernel/rcu/tasks.h
@@ -32,7 +32,9 @@
  * @rtp_irq_work: IRQ work queue for deferred wakeups.
  * @barrier_q_head: RCU callback for barrier operation.
  * @rtp_blkd_tasks: List of tasks blocked as readers.
+ * @rtp_exit_list: List of tasks in the latter portion of do_exit().
  * @cpu: CPU number corresponding to this entry.
+ * @index: Index of this CPU in rtpcp_array of the rcu_tasks structure.
  * @rtpp: Pointer to the rcu_tasks structure.
  */
 struct rcu_tasks_percpu {
@@ -46,7 +48,9 @@
 	struct irq_work rtp_irq_work;
 	struct rcu_head barrier_q_head;
 	struct list_head rtp_blkd_tasks;
+	struct list_head rtp_exit_list;
 	int cpu;
+	int index;
 	struct rcu_tasks *rtpp;
 };
 
@@ -73,6 +77,7 @@
  * @postgp_func: This flavor's post-grace-period function (optional).
  * @call_func: This flavor's call_rcu()-equivalent function.
  * @rtpcpu: This flavor's rcu_tasks_percpu structure.
+ * @rtpcp_array: Array of pointers to rcu_tasks_percpu structure of CPUs in cpu_possible_mask.
  * @percpu_enqueue_shift: Shift down CPU ID this much when enqueuing callbacks.
  * @percpu_enqueue_lim: Number of per-CPU callback queues in use for enqueuing.
  * @percpu_dequeue_lim: Number of per-CPU callback queues in use for dequeuing.
@@ -106,6 +111,7 @@
 	postgp_func_t postgp_func;
 	call_rcu_func_t call_func;
 	struct rcu_tasks_percpu __percpu *rtpcpu;
+	struct rcu_tasks_percpu **rtpcp_array;
 	int percpu_enqueue_shift;
 	int percpu_enqueue_lim;
 	int percpu_dequeue_lim;
@@ -179,6 +185,8 @@
 static int rcu_task_lazy_lim __read_mostly = 32;
 module_param(rcu_task_lazy_lim, int, 0444);
 
+static int rcu_task_cpu_ids;
+
 /* RCU tasks grace-period state for debugging. */
 #define RTGS_INIT		 0
 #define RTGS_WAIT_WAIT_CBS	 1
@@ -243,6 +251,8 @@
 	unsigned long flags;
 	int lim;
 	int shift;
+	int maxcpu;
+	int index = 0;
 
 	if (rcu_task_enqueue_lim < 0) {
 		rcu_task_enqueue_lim = 1;
@@ -252,14 +262,9 @@
 	}
 	lim = rcu_task_enqueue_lim;
 
-	if (lim > nr_cpu_ids)
-		lim = nr_cpu_ids;
-	shift = ilog2(nr_cpu_ids / lim);
-	if (((nr_cpu_ids - 1) >> shift) >= lim)
-		shift++;
-	WRITE_ONCE(rtp->percpu_enqueue_shift, shift);
-	WRITE_ONCE(rtp->percpu_dequeue_lim, lim);
-	smp_store_release(&rtp->percpu_enqueue_lim, lim);
+	rtp->rtpcp_array = kcalloc(num_possible_cpus(), sizeof(struct rcu_tasks_percpu *), GFP_KERNEL);
+	BUG_ON(!rtp->rtpcp_array);
+
 	for_each_possible_cpu(cpu) {
 		struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu);
 
@@ -273,12 +278,29 @@
 		INIT_WORK(&rtpcp->rtp_work, rcu_tasks_invoke_cbs_wq);
 		rtpcp->cpu = cpu;
 		rtpcp->rtpp = rtp;
+		rtpcp->index = index;
+		rtp->rtpcp_array[index] = rtpcp;
+		index++;
 		if (!rtpcp->rtp_blkd_tasks.next)
 			INIT_LIST_HEAD(&rtpcp->rtp_blkd_tasks);
+		if (!rtpcp->rtp_exit_list.next)
+			INIT_LIST_HEAD(&rtpcp->rtp_exit_list);
+		maxcpu = cpu;
 	}
 
-	pr_info("%s: Setting shift to %d and lim to %d rcu_task_cb_adjust=%d.\n", rtp->name,
-			data_race(rtp->percpu_enqueue_shift), data_race(rtp->percpu_enqueue_lim), rcu_task_cb_adjust);
+	rcu_task_cpu_ids = maxcpu + 1;
+	if (lim > rcu_task_cpu_ids)
+		lim = rcu_task_cpu_ids;
+	shift = ilog2(rcu_task_cpu_ids / lim);
+	if (((rcu_task_cpu_ids - 1) >> shift) >= lim)
+		shift++;
+	WRITE_ONCE(rtp->percpu_enqueue_shift, shift);
+	WRITE_ONCE(rtp->percpu_dequeue_lim, lim);
+	smp_store_release(&rtp->percpu_enqueue_lim, lim);
+
+	pr_info("%s: Setting shift to %d and lim to %d rcu_task_cb_adjust=%d rcu_task_cpu_ids=%d.\n",
+			rtp->name, data_race(rtp->percpu_enqueue_shift), data_race(rtp->percpu_enqueue_lim),
+			rcu_task_cb_adjust, rcu_task_cpu_ids);
 }
 
 // Compute wakeup time for lazy callback timer.
@@ -346,7 +368,7 @@
 			rtpcp->rtp_n_lock_retries = 0;
 		}
 		if (rcu_task_cb_adjust && ++rtpcp->rtp_n_lock_retries > rcu_task_contend_lim &&
-		    READ_ONCE(rtp->percpu_enqueue_lim) != nr_cpu_ids)
+		    READ_ONCE(rtp->percpu_enqueue_lim) != rcu_task_cpu_ids)
 			needadjust = true;  // Defer adjustment to avoid deadlock.
 	}
 	// Queuing callbacks before initialization not yet supported.
@@ -366,10 +388,10 @@
 	raw_spin_unlock_irqrestore_rcu_node(rtpcp, flags);
 	if (unlikely(needadjust)) {
 		raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags);
-		if (rtp->percpu_enqueue_lim != nr_cpu_ids) {
+		if (rtp->percpu_enqueue_lim != rcu_task_cpu_ids) {
 			WRITE_ONCE(rtp->percpu_enqueue_shift, 0);
-			WRITE_ONCE(rtp->percpu_dequeue_lim, nr_cpu_ids);
-			smp_store_release(&rtp->percpu_enqueue_lim, nr_cpu_ids);
+			WRITE_ONCE(rtp->percpu_dequeue_lim, rcu_task_cpu_ids);
+			smp_store_release(&rtp->percpu_enqueue_lim, rcu_task_cpu_ids);
 			pr_info("Switching %s to per-CPU callback queuing.\n", rtp->name);
 		}
 		raw_spin_unlock_irqrestore(&rtp->cbs_gbl_lock, flags);
@@ -442,6 +464,8 @@
 
 	dequeue_limit = smp_load_acquire(&rtp->percpu_dequeue_lim);
 	for (cpu = 0; cpu < dequeue_limit; cpu++) {
+		if (!cpu_possible(cpu))
+			continue;
 		struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu);
 
 		/* Advance and accelerate any new callbacks. */
@@ -479,7 +503,7 @@
 	if (rcu_task_cb_adjust && ncbs <= rcu_task_collapse_lim) {
 		raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags);
 		if (rtp->percpu_enqueue_lim > 1) {
-			WRITE_ONCE(rtp->percpu_enqueue_shift, order_base_2(nr_cpu_ids));
+			WRITE_ONCE(rtp->percpu_enqueue_shift, order_base_2(rcu_task_cpu_ids));
 			smp_store_release(&rtp->percpu_enqueue_lim, 1);
 			rtp->percpu_dequeue_gpseq = get_state_synchronize_rcu();
 			gpdone = false;
@@ -494,7 +518,9 @@
 			pr_info("Completing switch %s to CPU-0 callback queuing.\n", rtp->name);
 		}
 		if (rtp->percpu_dequeue_lim == 1) {
-			for (cpu = rtp->percpu_dequeue_lim; cpu < nr_cpu_ids; cpu++) {
+			for (cpu = rtp->percpu_dequeue_lim; cpu < rcu_task_cpu_ids; cpu++) {
+				if (!cpu_possible(cpu))
+					continue;
 				struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu);
 
 				WARN_ON_ONCE(rcu_segcblist_n_cbs(&rtpcp->cblist));
@@ -509,30 +535,32 @@
 // Advance callbacks and invoke any that are ready.
 static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpu *rtpcp)
 {
-	int cpu;
-	int cpunext;
 	int cpuwq;
 	unsigned long flags;
 	int len;
+	int index;
 	struct rcu_head *rhp;
 	struct rcu_cblist rcl = RCU_CBLIST_INITIALIZER(rcl);
 	struct rcu_tasks_percpu *rtpcp_next;
 
-	cpu = rtpcp->cpu;
-	cpunext = cpu * 2 + 1;
-	if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) {
-		rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext);
-		cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND;
-		queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work);
-		cpunext++;
-		if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) {
-			rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext);
-			cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND;
+	index = rtpcp->index * 2 + 1;
+	if (index < num_possible_cpus()) {
+		rtpcp_next = rtp->rtpcp_array[index];
+		if (rtpcp_next->cpu < smp_load_acquire(&rtp->percpu_dequeue_lim)) {
+			cpuwq = rcu_cpu_beenfullyonline(rtpcp_next->cpu) ? rtpcp_next->cpu : WORK_CPU_UNBOUND;
 			queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work);
+			index++;
+			if (index < num_possible_cpus()) {
+				rtpcp_next = rtp->rtpcp_array[index];
+				if (rtpcp_next->cpu < smp_load_acquire(&rtp->percpu_dequeue_lim)) {
+					cpuwq = rcu_cpu_beenfullyonline(rtpcp_next->cpu) ? rtpcp_next->cpu : WORK_CPU_UNBOUND;
+					queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work);
+				}
+			}
 		}
 	}
 
-	if (rcu_segcblist_empty(&rtpcp->cblist) || !cpu_possible(cpu))
+	if (rcu_segcblist_empty(&rtpcp->cblist))
 		return;
 	raw_spin_lock_irqsave_rcu_node(rtpcp, flags);
 	rcu_segcblist_advance(&rtpcp->cblist, rcu_seq_current(&rtp->tasks_gp_seq));
@@ -1678,6 +1706,16 @@
 	// allow safe access to the hop list.
 	for_each_online_cpu(cpu) {
 		rcu_read_lock();
+		// Note that cpu_curr_snapshot() picks up the target
+		// CPU's current task while its runqueue is locked with
+		// an smp_mb__after_spinlock().  This ensures that either
+		// the grace-period kthread will see that task's read-side
+		// critical section or the task will see the updater's pre-GP
+		// accesses.  The trailing smp_mb() in cpu_curr_snapshot()
+		// does not currently play a role other than simplify
+		// that function's ordering semantics.  If these simplified
+		// ordering semantics continue to be redundant, that smp_mb()
+		// might be removed.
 		t = cpu_curr_snapshot(cpu);
 		if (rcu_tasks_trace_pertask_prep(t, true))
 			trc_add_holdout(t, hop);
@@ -1941,7 +1979,7 @@
 {
 	char buf[64];
 
-	sprintf(buf, "N%lu h:%lu/%lu/%lu",
+	snprintf(buf, sizeof(buf), "N%lu h:%lu/%lu/%lu",
 		data_race(n_trc_holdouts),
 		data_race(n_heavy_reader_ofl_updates),
 		data_race(n_heavy_reader_updates),
--- linux-qcom-6.8.0.orig/kernel/rcu/tree.c
+++ linux-qcom-6.8.0/kernel/rcu/tree.c
@@ -2729,8 +2729,10 @@
 	}
 
 	check_cb_ovld(rdp);
-	if (rcu_nocb_try_bypass(rdp, head, &was_alldone, flags, lazy))
+	if (rcu_nocb_try_bypass(rdp, head, &was_alldone, flags, lazy)) {
+		local_irq_restore(flags);
 		return; // Enqueued onto ->nocb_bypass, so just leave.
+	}
 	// If no-CBs CPU gets here, rcu_nocb_try_bypass() acquired ->nocb_lock.
 	rcu_segcblist_enqueue(&rdp->cblist, head);
 	if (__is_kvfree_rcu_offset((unsigned long)func))
@@ -2748,11 +2750,14 @@
 		__call_rcu_nocb_wake(rdp, was_alldone, flags); /* unlocks */
 	} else {
 		__call_rcu_core(rdp, head, flags);
-		local_irq_restore(flags);
 	}
+	local_irq_restore(flags);
 }
 
 #ifdef CONFIG_RCU_LAZY
+static bool enable_rcu_lazy __read_mostly = !IS_ENABLED(CONFIG_RCU_LAZY_DEFAULT_OFF);
+module_param(enable_rcu_lazy, bool, 0444);
+
 /**
  * call_rcu_hurry() - Queue RCU callback for invocation after grace period, and
  * flush all lazy callbacks (including the new one) to the main ->cblist while
@@ -2778,6 +2783,8 @@
 	__call_rcu_common(head, func, false);
 }
 EXPORT_SYMBOL_GPL(call_rcu_hurry);
+#else
+#define enable_rcu_lazy		false
 #endif
 
 /**
@@ -2826,7 +2833,7 @@
  */
 void call_rcu(struct rcu_head *head, rcu_callback_t func)
 {
-	__call_rcu_common(head, func, IS_ENABLED(CONFIG_RCU_LAZY));
+	__call_rcu_common(head, func, enable_rcu_lazy);
 }
 EXPORT_SYMBOL_GPL(call_rcu);
 
@@ -3150,7 +3157,7 @@
 }
 
 static void
-schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp)
+__schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp)
 {
 	long delay, delay_left;
 
@@ -3165,6 +3172,16 @@
 }
 
 static void
+schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp)
+{
+	unsigned long flags;
+
+	raw_spin_lock_irqsave(&krcp->lock, flags);
+	__schedule_delayed_monitor_work(krcp);
+	raw_spin_unlock_irqrestore(&krcp->lock, flags);
+}
+
+static void
 kvfree_rcu_drain_ready(struct kfree_rcu_cpu *krcp)
 {
 	struct list_head bulk_ready[FREE_N_CHANNELS];
@@ -3203,18 +3220,15 @@
 }
 
 /*
- * This function is invoked after the KFREE_DRAIN_JIFFIES timeout.
+ * Return: %true if a work is queued, %false otherwise.
  */
-static void kfree_rcu_monitor(struct work_struct *work)
+static bool
+kvfree_rcu_queue_batch(struct kfree_rcu_cpu *krcp)
 {
-	struct kfree_rcu_cpu *krcp = container_of(work,
-		struct kfree_rcu_cpu, monitor_work.work);
 	unsigned long flags;
+	bool queued = false;
 	int i, j;
 
-	// Drain ready for reclaim.
-	kvfree_rcu_drain_ready(krcp);
-
 	raw_spin_lock_irqsave(&krcp->lock, flags);
 
 	// Attempt to start a new batch.
@@ -3249,15 +3263,32 @@
 			}
 
 			// One work is per one batch, so there are three
-			// "free channels", the batch can handle. It can
-			// be that the work is in the pending state when
-			// channels have been detached following by each
-			// other.
-			queue_rcu_work(system_wq, &krwp->rcu_work);
+			// "free channels", the batch can handle. Break
+			// the loop since it is done with this CPU thus
+			// queuing an RCU work is _always_ success here.
+			queued = queue_rcu_work(system_wq, &krwp->rcu_work);
+			WARN_ON_ONCE(!queued);
+			break;
 		}
 	}
 
 	raw_spin_unlock_irqrestore(&krcp->lock, flags);
+	return queued;
+}
+
+/*
+ * This function is invoked after the KFREE_DRAIN_JIFFIES timeout.
+ */
+static void kfree_rcu_monitor(struct work_struct *work)
+{
+	struct kfree_rcu_cpu *krcp = container_of(work,
+		struct kfree_rcu_cpu, monitor_work.work);
+
+	// Drain ready for reclaim.
+	kvfree_rcu_drain_ready(krcp);
+
+	// Queue a batch for a rest.
+	kvfree_rcu_queue_batch(krcp);
 
 	// If there is nothing to detach, it means that our job is
 	// successfully done here. In case of having at least one
@@ -3460,7 +3491,7 @@
 
 	// Set timer to drain after KFREE_DRAIN_JIFFIES.
 	if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING)
-		schedule_delayed_monitor_work(krcp);
+		__schedule_delayed_monitor_work(krcp);
 
 unlock_return:
 	krc_this_cpu_unlock(krcp, flags);
@@ -3478,6 +3509,86 @@
 }
 EXPORT_SYMBOL_GPL(kvfree_call_rcu);
 
+/**
+ * kvfree_rcu_barrier - Wait until all in-flight kvfree_rcu() complete.
+ *
+ * Note that a single argument of kvfree_rcu() call has a slow path that
+ * triggers synchronize_rcu() following by freeing a pointer. It is done
+ * before the return from the function. Therefore for any single-argument
+ * call that will result in a kfree() to a cache that is to be destroyed
+ * during module exit, it is developer's responsibility to ensure that all
+ * such calls have returned before the call to kmem_cache_destroy().
+ */
+void kvfree_rcu_barrier(void)
+{
+	struct kfree_rcu_cpu_work *krwp;
+	struct kfree_rcu_cpu *krcp;
+	bool queued;
+	int i, cpu;
+
+	/*
+	 * Firstly we detach objects and queue them over an RCU-batch
+	 * for all CPUs. Finally queued works are flushed for each CPU.
+	 *
+	 * Please note. If there are outstanding batches for a particular
+	 * CPU, those have to be finished first following by queuing a new.
+	 */
+	for_each_possible_cpu(cpu) {
+		krcp = per_cpu_ptr(&krc, cpu);
+
+		/*
+		 * Check if this CPU has any objects which have been queued for a
+		 * new GP completion. If not(means nothing to detach), we are done
+		 * with it. If any batch is pending/running for this "krcp", below
+		 * per-cpu flush_rcu_work() waits its completion(see last step).
+		 */
+		if (!need_offload_krc(krcp))
+			continue;
+
+		while (1) {
+			/*
+			 * If we are not able to queue a new RCU work it means:
+			 * - batches for this CPU are still in flight which should
+			 *   be flushed first and then repeat;
+			 * - no objects to detach, because of concurrency.
+			 */
+			queued = kvfree_rcu_queue_batch(krcp);
+
+			/*
+			 * Bail out, if there is no need to offload this "krcp"
+			 * anymore. As noted earlier it can run concurrently.
+			 */
+			if (queued || !need_offload_krc(krcp))
+				break;
+
+			/* There are ongoing batches. */
+			for (i = 0; i < KFREE_N_BATCHES; i++) {
+				krwp = &(krcp->krw_arr[i]);
+				flush_rcu_work(&krwp->rcu_work);
+			}
+		}
+	}
+
+	/*
+	 * Now we guarantee that all objects are flushed.
+	 */
+	for_each_possible_cpu(cpu) {
+		krcp = per_cpu_ptr(&krc, cpu);
+
+		/*
+		 * A monitor work can drain ready to reclaim objects
+		 * directly. Wait its completion if running or pending.
+		 */
+		cancel_delayed_work_sync(&krcp->monitor_work);
+
+		for (i = 0; i < KFREE_N_BATCHES; i++) {
+			krwp = &(krcp->krw_arr[i]);
+			flush_rcu_work(&krwp->rcu_work);
+		}
+	}
+}
+EXPORT_SYMBOL_GPL(kvfree_rcu_barrier);
+
 static unsigned long
 kfree_rcu_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
 {
@@ -4614,11 +4725,15 @@
 	struct rcu_data *rdp = per_cpu_ptr(&rcu_data, cpu);
 	bool needwake;
 
-	if (rcu_rdp_is_offloaded(rdp) ||
-	    rcu_segcblist_empty(&rdp->cblist))
-		return;  /* No callbacks to migrate. */
+	if (rcu_rdp_is_offloaded(rdp))
+		return;
 
 	raw_spin_lock_irqsave(&rcu_state.barrier_lock, flags);
+	if (rcu_segcblist_empty(&rdp->cblist)) {
+		raw_spin_unlock_irqrestore(&rcu_state.barrier_lock, flags);
+		return;  /* No callbacks to migrate. */
+	}
+
 	WARN_ON_ONCE(rcu_rdp_cpu_online(rdp));
 	rcu_barrier_entrain(rdp);
 	my_rdp = this_cpu_ptr(&rcu_data);
@@ -4640,8 +4755,9 @@
 		__call_rcu_nocb_wake(my_rdp, true, flags);
 	} else {
 		rcu_nocb_unlock(my_rdp); /* irqs remain disabled. */
-		raw_spin_unlock_irqrestore_rcu_node(my_rnp, flags);
+		raw_spin_unlock_rcu_node(my_rnp); /* irqs remain disabled. */
 	}
+	local_irq_restore(flags);
 	if (needwake)
 		rcu_gp_kthread_wake();
 	lockdep_assert_irqs_enabled();
@@ -4743,13 +4859,16 @@
 	rcu_exp_gp_kworker = kthread_create_worker(0, gp_kworker_name);
 	if (IS_ERR_OR_NULL(rcu_exp_gp_kworker)) {
 		pr_err("Failed to create %s!\n", gp_kworker_name);
+		rcu_exp_gp_kworker = NULL;
 		return;
 	}
 
 	rcu_exp_par_gp_kworker = kthread_create_worker(0, par_gp_kworker_name);
 	if (IS_ERR_OR_NULL(rcu_exp_par_gp_kworker)) {
 		pr_err("Failed to create %s!\n", par_gp_kworker_name);
+		rcu_exp_par_gp_kworker = NULL;
 		kthread_destroy_worker(rcu_exp_gp_kworker);
+		rcu_exp_gp_kworker = NULL;
 		return;
 	}
 
--- linux-qcom-6.8.0.orig/kernel/rcu/tree.h
+++ linux-qcom-6.8.0/kernel/rcu/tree.h
@@ -224,7 +224,6 @@
 	struct swait_queue_head nocb_state_wq; /* For offloading state changes */
 	struct task_struct *nocb_gp_kthread;
 	raw_spinlock_t nocb_lock;	/* Guard following pair of fields. */
-	atomic_t nocb_lock_contended;	/* Contention experienced. */
 	int nocb_defer_wakeup;		/* Defer wakeup of nocb_kthread. */
 	struct timer_list nocb_timer;	/* Enforce finite deferral. */
 	unsigned long nocb_gp_adv_time;	/* Last call_rcu() CB adv (jiffies). */
--- linux-qcom-6.8.0.orig/kernel/rcu/tree_exp.h
+++ linux-qcom-6.8.0/kernel/rcu/tree_exp.h
@@ -428,7 +428,12 @@
 	__sync_rcu_exp_select_node_cpus(rewp);
 }
 
-static inline bool rcu_gp_par_worker_started(void)
+static inline bool rcu_exp_worker_started(void)
+{
+	return !!READ_ONCE(rcu_exp_gp_kworker);
+}
+
+static inline bool rcu_exp_par_worker_started(void)
 {
 	return !!READ_ONCE(rcu_exp_par_gp_kworker);
 }
@@ -478,7 +483,12 @@
 	__sync_rcu_exp_select_node_cpus(rewp);
 }
 
-static inline bool rcu_gp_par_worker_started(void)
+static inline bool rcu_exp_worker_started(void)
+{
+	return !!READ_ONCE(rcu_gp_wq);
+}
+
+static inline bool rcu_exp_par_worker_started(void)
 {
 	return !!READ_ONCE(rcu_par_gp_wq);
 }
@@ -541,7 +551,7 @@
 		rnp->exp_need_flush = false;
 		if (!READ_ONCE(rnp->expmask))
 			continue; /* Avoid early boot non-existent wq. */
-		if (!rcu_gp_par_worker_started() ||
+		if (!rcu_exp_par_worker_started() ||
 		    rcu_scheduler_active != RCU_SCHEDULER_RUNNING ||
 		    rcu_is_last_leaf_node(rnp)) {
 			/* No worker started yet or last leaf, do direct call. */
@@ -956,7 +966,7 @@
  */
 void synchronize_rcu_expedited(void)
 {
-	bool boottime = (rcu_scheduler_active == RCU_SCHEDULER_INIT);
+	bool use_worker;
 	unsigned long flags;
 	struct rcu_exp_work rew;
 	struct rcu_node *rnp;
@@ -967,6 +977,9 @@
 			 lock_is_held(&rcu_sched_lock_map),
 			 "Illegal synchronize_rcu_expedited() in RCU read-side critical section");
 
+	use_worker = (rcu_scheduler_active != RCU_SCHEDULER_INIT) &&
+		      rcu_exp_worker_started();
+
 	/* Is the state is such that the call is a grace period? */
 	if (rcu_blocking_is_gp()) {
 		// Note well that this code runs with !PREEMPT && !SMP.
@@ -996,7 +1009,7 @@
 		return;  /* Someone else did our work for us. */
 
 	/* Ensure that load happens before action based on it. */
-	if (unlikely(boottime)) {
+	if (unlikely(!use_worker)) {
 		/* Direct call during scheduler init and early_initcalls(). */
 		rcu_exp_sel_wait_wake(s);
 	} else {
@@ -1014,7 +1027,7 @@
 	/* Let the next expedited grace period start. */
 	mutex_unlock(&rcu_state.exp_mutex);
 
-	if (likely(!boottime))
+	if (likely(use_worker))
 		synchronize_rcu_expedited_destroy_work(&rew);
 }
 EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
--- linux-qcom-6.8.0.orig/kernel/rcu/tree_nocb.h
+++ linux-qcom-6.8.0/kernel/rcu/tree_nocb.h
@@ -91,8 +91,7 @@
 
 /*
  * Acquire the specified rcu_data structure's ->nocb_bypass_lock.  If the
- * lock isn't immediately available, increment ->nocb_lock_contended to
- * flag the contention.
+ * lock isn't immediately available, perform minimal sanity check.
  */
 static void rcu_nocb_bypass_lock(struct rcu_data *rdp)
 	__acquires(&rdp->nocb_bypass_lock)
@@ -100,29 +99,12 @@
 	lockdep_assert_irqs_disabled();
 	if (raw_spin_trylock(&rdp->nocb_bypass_lock))
 		return;
-	atomic_inc(&rdp->nocb_lock_contended);
+	/*
+	 * Contention expected only when local enqueue collide with
+	 * remote flush from kthreads.
+	 */
 	WARN_ON_ONCE(smp_processor_id() != rdp->cpu);
-	smp_mb__after_atomic(); /* atomic_inc() before lock. */
 	raw_spin_lock(&rdp->nocb_bypass_lock);
-	smp_mb__before_atomic(); /* atomic_dec() after lock. */
-	atomic_dec(&rdp->nocb_lock_contended);
-}
-
-/*
- * Spinwait until the specified rcu_data structure's ->nocb_lock is
- * not contended.  Please note that this is extremely special-purpose,
- * relying on the fact that at most two kthreads and one CPU contend for
- * this lock, and also that the two kthreads are guaranteed to have frequent
- * grace-period-duration time intervals between successive acquisitions
- * of the lock.  This allows us to use an extremely simple throttling
- * mechanism, and further to apply it only to the CPU doing floods of
- * call_rcu() invocations.  Don't try this at home!
- */
-static void rcu_nocb_wait_contended(struct rcu_data *rdp)
-{
-	WARN_ON_ONCE(smp_processor_id() != rdp->cpu);
-	while (WARN_ON_ONCE(atomic_read(&rdp->nocb_lock_contended)))
-		cpu_relax();
 }
 
 /*
@@ -238,7 +220,10 @@
 	raw_spin_unlock_irqrestore(&rdp_gp->nocb_gp_lock, flags);
 	if (needwake) {
 		trace_rcu_nocb_wake(rcu_state.name, rdp->cpu, TPS("DoWake"));
-		wake_up_process(rdp_gp->nocb_gp_kthread);
+		if (cpu_is_offline(raw_smp_processor_id()))
+			swake_up_one_online(&rdp_gp->nocb_gp_wq);
+		else
+			wake_up_process(rdp_gp->nocb_gp_kthread);
 	}
 
 	return needwake;
@@ -510,7 +495,6 @@
 	}
 
 	// We need to use the bypass.
-	rcu_nocb_wait_contended(rdp);
 	rcu_nocb_bypass_lock(rdp);
 	ncbs = rcu_cblist_n_cbs(&rdp->nocb_bypass);
 	rcu_segcblist_inc_len(&rdp->cblist); /* Must precede enqueue. */
@@ -532,9 +516,7 @@
 	// 2. Both of these conditions are met:
 	//    a. The bypass list previously had only lazy CBs, and:
 	//    b. The new CB is non-lazy.
-	if (ncbs && (!bypass_is_lazy || lazy)) {
-		local_irq_restore(flags);
-	} else {
+	if (!ncbs || (bypass_is_lazy && !lazy)) {
 		// No-CBs GP kthread might be indefinitely asleep, if so, wake.
 		rcu_nocb_lock(rdp); // Rare during call_rcu() flood.
 		if (!rcu_segcblist_pend_cbs(&rdp->cblist)) {
@@ -544,7 +526,7 @@
 		} else {
 			trace_rcu_nocb_wake(rcu_state.name, rdp->cpu,
 					    TPS("FirstBQnoWake"));
-			rcu_nocb_unlock_irqrestore(rdp, flags);
+			rcu_nocb_unlock(rdp);
 		}
 	}
 	return true; // Callback already enqueued.
@@ -570,7 +552,7 @@
 	// If we are being polled or there is no kthread, just leave.
 	t = READ_ONCE(rdp->nocb_gp_kthread);
 	if (rcu_nocb_poll || !t) {
-		rcu_nocb_unlock_irqrestore(rdp, flags);
+		rcu_nocb_unlock(rdp);
 		trace_rcu_nocb_wake(rcu_state.name, rdp->cpu,
 				    TPS("WakeNotPoll"));
 		return;
@@ -583,17 +565,23 @@
 		rdp->qlen_last_fqs_check = len;
 		// Only lazy CBs in bypass list
 		if (lazy_len && bypass_len == lazy_len) {
-			rcu_nocb_unlock_irqrestore(rdp, flags);
+			rcu_nocb_unlock(rdp);
 			wake_nocb_gp_defer(rdp, RCU_NOCB_WAKE_LAZY,
 					   TPS("WakeLazy"));
-		} else if (!irqs_disabled_flags(flags)) {
+		} else if (!irqs_disabled_flags(flags) && cpu_online(rdp->cpu)) {
 			/* ... if queue was empty ... */
-			rcu_nocb_unlock_irqrestore(rdp, flags);
+			rcu_nocb_unlock(rdp);
 			wake_nocb_gp(rdp, false);
 			trace_rcu_nocb_wake(rcu_state.name, rdp->cpu,
 					    TPS("WakeEmpty"));
 		} else {
-			rcu_nocb_unlock_irqrestore(rdp, flags);
+			/*
+			 * Don't do the wake-up upfront on fragile paths.
+			 * Also offline CPUs can't call swake_up_one_online() from
+			 * (soft-)IRQs. Rely on the final deferred wake-up from
+			 * rcutree_report_cpu_dead()
+			 */
+			rcu_nocb_unlock(rdp);
 			wake_nocb_gp_defer(rdp, RCU_NOCB_WAKE,
 					   TPS("WakeEmptyIsDeferred"));
 		}
@@ -611,15 +599,15 @@
 		if ((rdp->nocb_cb_sleep ||
 		     !rcu_segcblist_ready_cbs(&rdp->cblist)) &&
 		    !timer_pending(&rdp->nocb_timer)) {
-			rcu_nocb_unlock_irqrestore(rdp, flags);
+			rcu_nocb_unlock(rdp);
 			wake_nocb_gp_defer(rdp, RCU_NOCB_WAKE_FORCE,
 					   TPS("WakeOvfIsDeferred"));
 		} else {
-			rcu_nocb_unlock_irqrestore(rdp, flags);
+			rcu_nocb_unlock(rdp);
 			trace_rcu_nocb_wake(rcu_state.name, rdp->cpu, TPS("WakeNot"));
 		}
 	} else {
-		rcu_nocb_unlock_irqrestore(rdp, flags);
+		rcu_nocb_unlock(rdp);
 		trace_rcu_nocb_wake(rcu_state.name, rdp->cpu, TPS("WakeNot"));
 	}
 }
@@ -1383,7 +1371,7 @@
 			rcu_nocb_unlock_irqrestore(rdp, flags);
 			continue;
 		}
-		WARN_ON_ONCE(!rcu_nocb_flush_bypass(rdp, NULL, jiffies, false));
+		rcu_nocb_try_flush_bypass(rdp, jiffies);
 		rcu_nocb_unlock_irqrestore(rdp, flags);
 		wake_nocb_gp(rdp, false);
 		sc->nr_to_scan -= _count;
@@ -1669,12 +1657,11 @@
 
 	sprintf(bufw, "%ld", rsclp->gp_seq[RCU_WAIT_TAIL]);
 	sprintf(bufr, "%ld", rsclp->gp_seq[RCU_NEXT_READY_TAIL]);
-	pr_info("   CB %d^%d->%d %c%c%c%c%c%c F%ld L%ld C%d %c%c%s%c%s%c%c q%ld %c CPU %d%s\n",
+	pr_info("   CB %d^%d->%d %c%c%c%c%c F%ld L%ld C%d %c%c%s%c%s%c%c q%ld %c CPU %d%s\n",
 		rdp->cpu, rdp->nocb_gp_rdp->cpu,
 		nocb_next_rdp ? nocb_next_rdp->cpu : -1,
 		"kK"[!!rdp->nocb_cb_kthread],
 		"bB"[raw_spin_is_locked(&rdp->nocb_bypass_lock)],
-		"cC"[!!atomic_read(&rdp->nocb_lock_contended)],
 		"lL"[raw_spin_is_locked(&rdp->nocb_lock)],
 		"sS"[!!rdp->nocb_cb_sleep],
 		".W"[swait_active(&rdp->nocb_cb_wq)],
--- linux-qcom-6.8.0.orig/kernel/rcu/tree_stall.h
+++ linux-qcom-6.8.0/kernel/rcu/tree_stall.h
@@ -504,7 +504,8 @@
 			rcu_dynticks_in_eqs(rcu_dynticks_snap(cpu));
 	rcuc_starved = rcu_is_rcuc_kthread_starving(rdp, &j);
 	if (rcuc_starved)
-		sprintf(buf, " rcuc=%ld jiffies(starved)", j);
+		// Print signed value, as negative values indicate a probable bug.
+		snprintf(buf, sizeof(buf), " rcuc=%ld jiffies(starved)", j);
 	pr_err("\t%d-%c%c%c%c: (%lu %s) idle=%04x/%ld/%#lx softirq=%u/%u fqs=%ld%s%s\n",
 	       cpu,
 	       "O."[!!cpu_online(cpu)],
--- linux-qcom-6.8.0.orig/kernel/resource.c
+++ linux-qcom-6.8.0/kernel/resource.c
@@ -468,9 +468,7 @@
 			rams_size += 16;
 		}
 
-		rams[i].start = res.start;
-		rams[i++].end = res.end;
-
+		rams[i++] = res;
 		start = res.end + 1;
 	}
 
@@ -548,20 +546,62 @@
 			       size_t size, unsigned long flags,
 			       unsigned long desc)
 {
-	struct resource res;
+	resource_size_t ostart, oend;
 	int type = 0; int other = 0;
-	struct resource *p;
+	struct resource *p, *dp;
+	bool is_type, covered;
+	struct resource res;
 
 	res.start = start;
 	res.end = start + size - 1;
 
 	for (p = parent->child; p ; p = p->sibling) {
-		bool is_type = (((p->flags & flags) == flags) &&
-				((desc == IORES_DESC_NONE) ||
-				 (desc == p->desc)));
-
-		if (resource_overlaps(p, &res))
-			is_type ? type++ : other++;
+		if (!resource_overlaps(p, &res))
+			continue;
+		is_type = (p->flags & flags) == flags &&
+			(desc == IORES_DESC_NONE || desc == p->desc);
+		if (is_type) {
+			type++;
+			continue;
+		}
+		/*
+		 * Continue to search in descendant resources as if the
+		 * matched descendant resources cover some ranges of 'p'.
+		 *
+		 * |------------- "CXL Window 0" ------------|
+		 * |-- "System RAM" --|
+		 *
+		 * will behave similar as the following fake resource
+		 * tree when searching "System RAM".
+		 *
+		 * |-- "System RAM" --||-- "CXL Window 0a" --|
+		 */
+		covered = false;
+		ostart = max(res.start, p->start);
+		oend = min(res.end, p->end);
+		for_each_resource(p, dp, false) {
+			if (!resource_overlaps(dp, &res))
+				continue;
+			is_type = (dp->flags & flags) == flags &&
+				(desc == IORES_DESC_NONE || desc == dp->desc);
+			if (is_type) {
+				type++;
+				/*
+				 * Range from 'ostart' to 'dp->start'
+				 * isn't covered by matched resource.
+				 */
+				if (dp->start > ostart)
+					break;
+				if (dp->end >= oend) {
+					covered = true;
+					break;
+				}
+				/* Remove covered range */
+				ostart = max(ostart, dp->end + 1);
+			}
+		}
+		if (!covered)
+			other++;
 	}
 
 	if (type == 0)
@@ -1832,8 +1872,7 @@
 	if (flags & GFR_DESCENDING) {
 		resource_size_t end;
 
-		end = min_t(resource_size_t, base->end,
-			    (1ULL << MAX_PHYSMEM_BITS) - 1);
+		end = min_t(resource_size_t, base->end, PHYSMEM_END);
 		return end - size + 1;
 	}
 
@@ -1850,8 +1889,7 @@
 	 * @size did not wrap 0.
 	 */
 	return addr > addr - size &&
-	       addr <= min_t(resource_size_t, base->end,
-			     (1ULL << MAX_PHYSMEM_BITS) - 1);
+	       addr <= min_t(resource_size_t, base->end, PHYSMEM_END);
 }
 
 static resource_size_t gfr_next(resource_size_t addr, resource_size_t size,
--- linux-qcom-6.8.0.orig/kernel/sched/core.c
+++ linux-qcom-6.8.0/kernel/sched/core.c
@@ -723,7 +723,6 @@
 
 	rq->prev_irq_time += irq_delta;
 	delta -= irq_delta;
-	psi_account_irqtime(rq->curr, irq_delta);
 	delayacct_irq(rq->curr, irq_delta);
 #endif
 #ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING
@@ -745,7 +744,7 @@
 	if ((irq_delta + steal) && sched_feat(NONTASK_CAPACITY))
 		update_irq_load_avg(rq, irq_delta + steal);
 #endif
-	update_rq_clock_pelt(rq, delta);
+	update_rq_clock_task_mult(rq, delta);
 }
 
 void update_rq_clock(struct rq *rq)
@@ -1204,9 +1203,9 @@
 	WARN_ON(!(flags & NOHZ_KICK_MASK));
 
 	rq->idle_balance = idle_cpu(cpu);
-	if (rq->idle_balance && !need_resched()) {
+	if (rq->idle_balance) {
 		rq->nohz_idle_balance = flags;
-		raise_softirq_irqoff(SCHED_SOFTIRQ);
+		__raise_softirq_irqoff(SCHED_SOFTIRQ);
 	}
 }
 
@@ -1327,27 +1326,24 @@
 static void set_load_weight(struct task_struct *p, bool update_load)
 {
 	int prio = p->static_prio - MAX_RT_PRIO;
-	struct load_weight *load = &p->se.load;
+	struct load_weight lw;
 
-	/*
-	 * SCHED_IDLE tasks get minimal weight:
-	 */
 	if (task_has_idle_policy(p)) {
-		load->weight = scale_load(WEIGHT_IDLEPRIO);
-		load->inv_weight = WMULT_IDLEPRIO;
-		return;
+		lw.weight = scale_load(WEIGHT_IDLEPRIO);
+		lw.inv_weight = WMULT_IDLEPRIO;
+	} else {
+		lw.weight = scale_load(sched_prio_to_weight[prio]);
+		lw.inv_weight = sched_prio_to_wmult[prio];
 	}
 
 	/*
 	 * SCHED_OTHER tasks have to update their load when changing their
 	 * weight
 	 */
-	if (update_load && p->sched_class == &fair_sched_class) {
-		reweight_task(p, prio);
-	} else {
-		load->weight = scale_load(sched_prio_to_weight[prio]);
-		load->inv_weight = sched_prio_to_wmult[prio];
-	}
+	if (update_load && p->sched_class == &fair_sched_class)
+		reweight_task(p, &lw);
+	else
+		p->se.load = lw;
 }
 
 #ifdef CONFIG_UCLAMP_TASK
@@ -4458,12 +4454,7 @@
  * @cpu: The CPU on which to snapshot the task.
  *
  * Returns the task_struct pointer of the task "currently" running on
- * the specified CPU.  If the same task is running on that CPU throughout,
- * the return value will be a pointer to that task's task_struct structure.
- * If the CPU did any context switches even vaguely concurrently with the
- * execution of this function, the return value will be a pointer to the
- * task_struct structure of a randomly chosen task that was running on
- * that CPU somewhere around the time that this function was executing.
+ * the specified CPU.
  *
  * If the specified CPU was offline, the return value is whatever it
  * is, perhaps a pointer to the task_struct structure of that CPU's idle
@@ -4477,11 +4468,16 @@
  */
 struct task_struct *cpu_curr_snapshot(int cpu)
 {
+	struct rq *rq = cpu_rq(cpu);
 	struct task_struct *t;
+	struct rq_flags rf;
 
-	smp_mb(); /* Pairing determined by caller's synchronization design. */
+	rq_lock_irqsave(rq, &rf);
+	smp_mb__after_spinlock(); /* Pairing determined by caller's synchronization design. */
 	t = rcu_dereference(cpu_curr(cpu));
+	rq_unlock_irqrestore(rq, &rf);
 	smp_mb(); /* Pairing determined by caller's synchronization design. */
+
 	return t;
 }
 
@@ -4511,7 +4507,8 @@
  * Perform scheduler related setup for a newly forked process p.
  * p is forked by current.
  *
- * __sched_fork() is basic setup used by init_idle() too:
+ * __sched_fork() is basic setup which is also used by sched_init() to
+ * initialize the boot CPU's idle task.
  */
 static void __sched_fork(unsigned long clone_flags, struct task_struct *p)
 {
@@ -5657,7 +5654,7 @@
 {
 	int cpu = smp_processor_id();
 	struct rq *rq = cpu_rq(cpu);
-	struct task_struct *curr = rq->curr;
+	struct task_struct *curr;
 	struct rq_flags rf;
 	unsigned long thermal_pressure;
 	u64 resched_latency;
@@ -5669,6 +5666,9 @@
 
 	rq_lock(rq, &rf);
 
+	curr = rq->curr;
+	psi_account_irqtime(rq, curr, NULL);
+
 	update_rq_clock(rq);
 	thermal_pressure = arch_scale_thermal_pressure(cpu_of(rq));
 	update_thermal_load_avg(rq_clock_thermal(rq), rq, thermal_pressure);
@@ -5998,6 +5998,14 @@
 #endif
 
 	put_prev_task(rq, prev);
+
+	/*
+	 * We've updated @prev and no longer need the server link, clear it.
+	 * Must be done before ->pick_next_task() because that can (re)set
+	 * ->dl_server.
+	 */
+	if (prev->dl_server)
+		prev->dl_server = NULL;
 }
 
 /*
@@ -6029,6 +6037,13 @@
 		}
 
 		/*
+		 * This is a normal CFS pick, but the previous could be a DL pick.
+		 * Clear it as previous is no longer picked.
+		 */
+		if (prev->dl_server)
+			prev->dl_server = NULL;
+
+		/*
 		 * This is the fast path; it cannot be a DL server pick;
 		 * therefore even if @p == @prev, ->dl_server must be NULL.
 		 */
@@ -6041,14 +6056,6 @@
 restart:
 	put_prev_task_balance(rq, prev, rf);
 
-	/*
-	 * We've updated @prev and no longer need the server link, clear it.
-	 * Must be done before ->pick_next_task() because that can (re)set
-	 * ->dl_server.
-	 */
-	if (prev->dl_server)
-		prev->dl_server = NULL;
-
 	for_each_class(class) {
 		p = class->pick_next_task(rq);
 		if (p)
@@ -6709,8 +6716,9 @@
 		 *
 		 * Here are the schemes providing that barrier on the
 		 * various architectures:
-		 * - mm ? switch_mm() : mmdrop() for x86, s390, sparc, PowerPC.
-		 *   switch_mm() rely on membarrier_arch_switch_mm() on PowerPC.
+		 * - mm ? switch_mm() : mmdrop() for x86, s390, sparc, PowerPC,
+		 *   RISC-V.  switch_mm() relies on membarrier_arch_switch_mm()
+		 *   on PowerPC and on RISC-V.
 		 * - finish_lock_switch() for weakly-ordered
 		 *   architectures where spin_unlock is a full barrier,
 		 * - switch_to() for arm64 (weakly-ordered, spin_unlock
@@ -6719,6 +6727,7 @@
 		++*switch_count;
 
 		migrate_disable_switch(rq, prev);
+		psi_account_irqtime(rq, prev, next);
 		psi_sched_switch(prev, next, !task_on_rq_queued(prev));
 
 		trace_sched_switch(sched_mode & SM_MASK_PREEMPT, prev, next, prev_state);
@@ -7328,6 +7337,7 @@
 {
 	return is_nice_reduction(p, nice) || capable(CAP_SYS_NICE);
 }
+EXPORT_SYMBOL(can_nice);
 
 #ifdef __ARCH_WANT_SYS_NICE
 
@@ -8379,7 +8389,7 @@
 			bool empty = !cpumask_and(new_mask, new_mask,
 						  ctx->user_mask);
 
-			if (WARN_ON_ONCE(empty))
+			if (empty)
 				cpumask_copy(new_mask, cpus_allowed);
 		}
 		__set_cpus_allowed_ptr(p, ctx);
@@ -9247,8 +9257,6 @@
 	struct rq *rq = cpu_rq(cpu);
 	unsigned long flags;
 
-	__sched_fork(0, idle);
-
 	raw_spin_lock_irqsave(&idle->pi_lock, flags);
 	raw_spin_rq_lock(rq);
 
@@ -9263,10 +9271,8 @@
 
 #ifdef CONFIG_SMP
 	/*
-	 * It's possible that init_idle() gets called multiple times on a task,
-	 * in that case do_set_cpus_allowed() will not do the right thing.
-	 *
-	 * And since this is boot we can forgo the serialization.
+	 * No validation and serialization required at boot time and for
+	 * setting up the idle tasks of not yet online CPUs.
 	 */
 	set_cpus_allowed_common(idle, &ac);
 #endif
@@ -9584,6 +9590,30 @@
 	}
 }
 
+static inline void sched_set_rq_online(struct rq *rq, int cpu)
+{
+	struct rq_flags rf;
+
+	rq_lock_irqsave(rq, &rf);
+	if (rq->rd) {
+		BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span));
+		set_rq_online(rq);
+	}
+	rq_unlock_irqrestore(rq, &rf);
+}
+
+static inline void sched_set_rq_offline(struct rq *rq, int cpu)
+{
+	struct rq_flags rf;
+
+	rq_lock_irqsave(rq, &rf);
+	if (rq->rd) {
+		BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span));
+		set_rq_offline(rq);
+	}
+	rq_unlock_irqrestore(rq, &rf);
+}
+
 /*
  * used to mark begin/end of suspend/resume:
  */
@@ -9634,10 +9664,25 @@
 	return 0;
 }
 
+static inline void sched_smt_present_inc(int cpu)
+{
+#ifdef CONFIG_SCHED_SMT
+	if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
+		static_branch_inc_cpuslocked(&sched_smt_present);
+#endif
+}
+
+static inline void sched_smt_present_dec(int cpu)
+{
+#ifdef CONFIG_SCHED_SMT
+	if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
+		static_branch_dec_cpuslocked(&sched_smt_present);
+#endif
+}
+
 int sched_cpu_activate(unsigned int cpu)
 {
 	struct rq *rq = cpu_rq(cpu);
-	struct rq_flags rf;
 
 	/*
 	 * Clear the balance_push callback and prepare to schedule
@@ -9645,13 +9690,10 @@
 	 */
 	balance_push_set(cpu, false);
 
-#ifdef CONFIG_SCHED_SMT
 	/*
 	 * When going up, increment the number of cores with SMT present.
 	 */
-	if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
-		static_branch_inc_cpuslocked(&sched_smt_present);
-#endif
+	sched_smt_present_inc(cpu);
 	set_cpu_active(cpu, true);
 
 	if (sched_smp_initialized) {
@@ -9669,12 +9711,7 @@
 	 * 2) At runtime, if cpuset_cpu_active() fails to rebuild the
 	 *    domains.
 	 */
-	rq_lock_irqsave(rq, &rf);
-	if (rq->rd) {
-		BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span));
-		set_rq_online(rq);
-	}
-	rq_unlock_irqrestore(rq, &rf);
+	sched_set_rq_online(rq, cpu);
 
 	return 0;
 }
@@ -9682,7 +9719,6 @@
 int sched_cpu_deactivate(unsigned int cpu)
 {
 	struct rq *rq = cpu_rq(cpu);
-	struct rq_flags rf;
 	int ret;
 
 	/*
@@ -9713,20 +9749,14 @@
 	 */
 	synchronize_rcu();
 
-	rq_lock_irqsave(rq, &rf);
-	if (rq->rd) {
-		BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span));
-		set_rq_offline(rq);
-	}
-	rq_unlock_irqrestore(rq, &rf);
+	sched_set_rq_offline(rq, cpu);
 
-#ifdef CONFIG_SCHED_SMT
 	/*
 	 * When going down, decrement the number of cores with SMT present.
 	 */
-	if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
-		static_branch_dec_cpuslocked(&sched_smt_present);
+	sched_smt_present_dec(cpu);
 
+#ifdef CONFIG_SCHED_SMT
 	sched_core_cpu_deactivate(cpu);
 #endif
 
@@ -9736,6 +9766,8 @@
 	sched_update_numa(cpu, false);
 	ret = cpuset_cpu_inactive(cpu);
 	if (ret) {
+		sched_smt_present_inc(cpu);
+		sched_set_rq_online(rq, cpu);
 		balance_push_set(cpu, false);
 		set_cpu_active(cpu, true);
 		sched_update_numa(cpu, true);
@@ -10067,6 +10099,7 @@
 	 * but because we are the idle thread, we just pick up running again
 	 * when this runqueue becomes "idle".
 	 */
+	__sched_fork(0, current);
 	init_idle(current, smp_processor_id());
 
 	calc_load_update = jiffies + LOAD_FREQ;
@@ -11381,7 +11414,7 @@
 {
 	struct task_group *tg = css_tg(of_css(of));
 	u64 period = tg_get_cfs_period(tg);
-	u64 burst = tg_get_cfs_burst(tg);
+	u64 burst = tg->cfs_bandwidth.burst;
 	u64 quota;
 	int ret;
 
@@ -11968,7 +12001,9 @@
 		return;
 	if (time_before(now, READ_ONCE(curr->mm->mm_cid_next_scan)))
 		return;
-	task_work_add(curr, work, TWA_RESUME);
+
+	/* No page allocation under rq lock */
+	task_work_add(curr, work, TWA_RESUME | TWAF_NO_ALLOC);
 }
 
 void sched_mm_cid_exit_signals(struct task_struct *t)
--- linux-qcom-6.8.0.orig/kernel/sched/cpufreq_schedutil.c
+++ linux-qcom-6.8.0/kernel/sched/cpufreq_schedutil.c
@@ -775,9 +775,8 @@
 	if (ret)
 		goto fail;
 
-	sugov_eas_rebuild_sd();
-
 out:
+	sugov_eas_rebuild_sd();
 	mutex_unlock(&global_tunables_lock);
 	return 0;
 
--- linux-qcom-6.8.0.orig/kernel/sched/cputime.c
+++ linux-qcom-6.8.0/kernel/sched/cputime.c
@@ -595,6 +595,12 @@
 	}
 
 	stime = mul_u64_u64_div_u64(stime, rtime, stime + utime);
+	/*
+	 * Because mul_u64_u64_div_u64() can approximate on some
+	 * achitectures; enforce the constraint that: a*b/(b+c) <= a.
+	 */
+	if (unlikely(stime > rtime))
+		stime = rtime;
 
 update:
 	/*
--- linux-qcom-6.8.0.orig/kernel/sched/deadline.c
+++ linux-qcom-6.8.0/kernel/sched/deadline.c
@@ -1600,46 +1600,40 @@
 	return dl_time_before(__node_2_dle(a)->deadline, __node_2_dle(b)->deadline);
 }
 
-static inline struct sched_statistics *
+static __always_inline struct sched_statistics *
 __schedstats_from_dl_se(struct sched_dl_entity *dl_se)
 {
+	if (!schedstat_enabled())
+		return NULL;
+
+	if (dl_server(dl_se))
+		return NULL;
+
 	return &dl_task_of(dl_se)->stats;
 }
 
 static inline void
 update_stats_wait_start_dl(struct dl_rq *dl_rq, struct sched_dl_entity *dl_se)
 {
-	struct sched_statistics *stats;
-
-	if (!schedstat_enabled())
-		return;
-
-	stats = __schedstats_from_dl_se(dl_se);
-	__update_stats_wait_start(rq_of_dl_rq(dl_rq), dl_task_of(dl_se), stats);
+	struct sched_statistics *stats = __schedstats_from_dl_se(dl_se);
+	if (stats)
+		__update_stats_wait_start(rq_of_dl_rq(dl_rq), dl_task_of(dl_se), stats);
 }
 
 static inline void
 update_stats_wait_end_dl(struct dl_rq *dl_rq, struct sched_dl_entity *dl_se)
 {
-	struct sched_statistics *stats;
-
-	if (!schedstat_enabled())
-		return;
-
-	stats = __schedstats_from_dl_se(dl_se);
-	__update_stats_wait_end(rq_of_dl_rq(dl_rq), dl_task_of(dl_se), stats);
+	struct sched_statistics *stats = __schedstats_from_dl_se(dl_se);
+	if (stats)
+		__update_stats_wait_end(rq_of_dl_rq(dl_rq), dl_task_of(dl_se), stats);
 }
 
 static inline void
 update_stats_enqueue_sleeper_dl(struct dl_rq *dl_rq, struct sched_dl_entity *dl_se)
 {
-	struct sched_statistics *stats;
-
-	if (!schedstat_enabled())
-		return;
-
-	stats = __schedstats_from_dl_se(dl_se);
-	__update_stats_enqueue_sleeper(rq_of_dl_rq(dl_rq), dl_task_of(dl_se), stats);
+	struct sched_statistics *stats = __schedstats_from_dl_se(dl_se);
+	if (stats)
+		__update_stats_enqueue_sleeper(rq_of_dl_rq(dl_rq), dl_task_of(dl_se), stats);
 }
 
 static inline void
@@ -1754,6 +1748,7 @@
 	} else if (flags & ENQUEUE_REPLENISH) {
 		replenish_dl_entity(dl_se);
 	} else if ((flags & ENQUEUE_RESTORE) &&
+		  !is_dl_boosted(dl_se) &&
 		   dl_time_before(dl_se->deadline, rq_clock(rq_of_dl_se(dl_se)))) {
 		setup_new_dl_entity(dl_se);
 	}
@@ -1805,8 +1800,13 @@
 			 * The replenish timer needs to be canceled. No
 			 * problem if it fires concurrently: boosted threads
 			 * are ignored in dl_task_timer().
+			 *
+			 * If the timer callback was running (hrtimer_try_to_cancel == -1),
+			 * it will eventually call put_task_struct().
 			 */
-			hrtimer_try_to_cancel(&p->dl.dl_timer);
+			if (hrtimer_try_to_cancel(&p->dl.dl_timer) == 1 &&
+			    !dl_server(&p->dl))
+				put_task_struct(p);
 			p->dl.dl_throttled = 0;
 		}
 	} else if (!dl_prio(p->normal_prio)) {
--- linux-qcom-6.8.0.orig/kernel/sched/fair.c
+++ linux-qcom-6.8.0/kernel/sched/fair.c
@@ -518,7 +518,7 @@
 
 static int se_is_idle(struct sched_entity *se)
 {
-	return 0;
+	return task_has_idle_policy(task_of(se));
 }
 
 #endif	/* CONFIG_FAIR_GROUP_SCHED */
@@ -696,15 +696,21 @@
  *
  * XXX could add max_slice to the augmented data to track this.
  */
-static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se)
+static s64 entity_lag(u64 avruntime, struct sched_entity *se)
 {
-	s64 lag, limit;
+	s64 vlag, limit;
+
+	vlag = avruntime - se->vruntime;
+	limit = calc_delta_fair(max_t(u64, 2*se->slice, TICK_NSEC), se);
 
+	return clamp(vlag, -limit, limit);
+}
+
+static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se)
+{
 	SCHED_WARN_ON(!se->on_rq);
-	lag = avg_vruntime(cfs_rq) - se->vruntime;
 
-	limit = calc_delta_fair(max_t(u64, 2*se->slice, TICK_NSEC), se);
-	se->vlag = clamp(lag, -limit, limit);
+	se->vlag = entity_lag(avg_vruntime(cfs_rq), se);
 }
 
 /*
@@ -3182,6 +3188,15 @@
 		return true;
 	}
 
+	/*
+	 * This vma has not been accessed for a while, and if the number
+	 * the threads in the same process is low, which means no other
+	 * threads can help scan this vma, force a vma scan.
+	 */
+	if (READ_ONCE(mm->numa_scan_seq) >
+	   (vma->numab_state->prev_scan_seq + get_nr_threads(current)))
+		return true;
+
 	return false;
 }
 
@@ -3274,7 +3289,7 @@
 		vma = vma_next(&vmi);
 	}
 
-	do {
+	for (; vma; vma = vma_next(&vmi)) {
 		if (!vma_migratable(vma) || !vma_policy_mof(vma) ||
 			is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_MIXEDMAP)) {
 			trace_sched_skip_vma_numa(mm, vma, NUMAB_SKIP_UNSUITABLE);
@@ -3304,11 +3319,17 @@
 
 		/* Initialise new per-VMA NUMAB state. */
 		if (!vma->numab_state) {
-			vma->numab_state = kzalloc(sizeof(struct vma_numab_state),
-				GFP_KERNEL);
-			if (!vma->numab_state)
+			struct vma_numab_state *ptr;
+
+			ptr = kzalloc(sizeof(*ptr), GFP_KERNEL);
+			if (!ptr)
 				continue;
 
+			if (cmpxchg(&vma->numab_state, NULL, ptr)) {
+				kfree(ptr);
+				continue;
+			}
+
 			vma->numab_state->start_scan_seq = mm->numa_scan_seq;
 
 			vma->numab_state->next_scan = now +
@@ -3396,7 +3417,7 @@
 		 */
 		if (vma_pids_forced)
 			break;
-	} for_each_vma(vmi, vma);
+	}
 
 	/*
 	 * If no VMAs are remaining and VMAs were skipped due to the PID
@@ -3670,11 +3691,10 @@
 dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) { }
 #endif
 
-static void reweight_eevdf(struct cfs_rq *cfs_rq, struct sched_entity *se,
+static void reweight_eevdf(struct sched_entity *se, u64 avruntime,
 			   unsigned long weight)
 {
 	unsigned long old_weight = se->load.weight;
-	u64 avruntime = avg_vruntime(cfs_rq);
 	s64 vlag, vslice;
 
 	/*
@@ -3755,7 +3775,7 @@
 	 *	   = V  - vl'
 	 */
 	if (avruntime != se->vruntime) {
-		vlag = (s64)(avruntime - se->vruntime);
+		vlag = entity_lag(avruntime, se);
 		vlag = div_s64(vlag * old_weight, weight);
 		se->vruntime = avruntime - vlag;
 	}
@@ -3781,25 +3801,26 @@
 			    unsigned long weight)
 {
 	bool curr = cfs_rq->curr == se;
+	u64 avruntime;
 
 	if (se->on_rq) {
 		/* commit outstanding execution time */
-		if (curr)
-			update_curr(cfs_rq);
-		else
+		update_curr(cfs_rq);
+		avruntime = avg_vruntime(cfs_rq);
+		if (!curr)
 			__dequeue_entity(cfs_rq, se);
 		update_load_sub(&cfs_rq->load, se->load.weight);
 	}
 	dequeue_load_avg(cfs_rq, se);
 
-	if (!se->on_rq) {
+	if (se->on_rq) {
+		reweight_eevdf(se, avruntime, weight);
+	} else {
 		/*
 		 * Because we keep se->vlag = V - v_i, while: lag_i = w_i*(V - v_i),
 		 * we need to scale se->vlag when w_i changes.
 		 */
 		se->vlag = div_s64(se->vlag * se->load.weight, weight);
-	} else {
-		reweight_eevdf(cfs_rq, se, weight);
 	}
 
 	update_load_set(&se->load, weight);
@@ -3829,15 +3850,14 @@
 	}
 }
 
-void reweight_task(struct task_struct *p, int prio)
+void reweight_task(struct task_struct *p, const struct load_weight *lw)
 {
 	struct sched_entity *se = &p->se;
 	struct cfs_rq *cfs_rq = cfs_rq_of(se);
 	struct load_weight *load = &se->load;
-	unsigned long weight = scale_load(sched_prio_to_weight[prio]);
 
-	reweight_entity(cfs_rq, se, weight);
-	load->inv_weight = sched_prio_to_wmult[prio];
+	reweight_entity(cfs_rq, se, lw->weight);
+	load->inv_weight = lw->inv_weight;
 }
 
 static inline int throttled_hierarchy(struct cfs_rq *cfs_rq);
@@ -6663,22 +6683,42 @@
 #ifdef CONFIG_SMP
 static inline bool cpu_overutilized(int cpu)
 {
-	unsigned long rq_util_min = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MIN);
-	unsigned long rq_util_max = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MAX);
+	unsigned long  rq_util_min, rq_util_max;
+
+	if (!sched_energy_enabled())
+		return false;
+
+	rq_util_min = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MIN);
+	rq_util_max = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MAX);
 
 	/* Return true only if the utilization doesn't fit CPU's capacity */
 	return !util_fits_cpu(cpu_util_cfs(cpu), rq_util_min, rq_util_max, cpu);
 }
 
-static inline void update_overutilized_status(struct rq *rq)
+static inline void set_rd_overutilized_status(struct root_domain *rd,
+					      unsigned int status)
 {
-	if (!READ_ONCE(rq->rd->overutilized) && cpu_overutilized(rq->cpu)) {
-		WRITE_ONCE(rq->rd->overutilized, SG_OVERUTILIZED);
-		trace_sched_overutilized_tp(rq->rd, SG_OVERUTILIZED);
-	}
+	if (!sched_energy_enabled())
+		return;
+
+	WRITE_ONCE(rd->overutilized, status);
+	trace_sched_overutilized_tp(rd, !!status);
+}
+
+static inline void check_update_overutilized_status(struct rq *rq)
+{
+	/*
+	 * overutilized field is used for load balancing decisions only
+	 * if energy aware scheduler is being used
+	 */
+	if (!sched_energy_enabled())
+		return;
+
+	if (!READ_ONCE(rq->rd->overutilized) && cpu_overutilized(rq->cpu))
+		set_rd_overutilized_status(rq->rd, SG_OVERUTILIZED);
 }
 #else
-static inline void update_overutilized_status(struct rq *rq) { }
+static inline void check_update_overutilized_status(struct rq *rq) { }
 #endif
 
 /* Runqueue only has SCHED_IDLE tasks enqueued */
@@ -6779,7 +6819,7 @@
 	 * and the following generally works well enough in practice.
 	 */
 	if (!task_new)
-		update_overutilized_status(rq);
+		check_update_overutilized_status(rq);
 
 enqueue_throttle:
 	assert_list_leaf_cfs_rq(rq);
@@ -7289,7 +7329,7 @@
 		if (!available_idle_cpu(cpu)) {
 			idle = false;
 			if (*idle_cpu == -1) {
-				if (sched_idle_cpu(cpu) && cpumask_test_cpu(cpu, p->cpus_ptr)) {
+				if (sched_idle_cpu(cpu) && cpumask_test_cpu(cpu, cpus)) {
 					*idle_cpu = cpu;
 					break;
 				}
@@ -7297,7 +7337,7 @@
 			}
 			break;
 		}
-		if (*idle_cpu == -1 && cpumask_test_cpu(cpu, p->cpus_ptr))
+		if (*idle_cpu == -1 && cpumask_test_cpu(cpu, cpus))
 			*idle_cpu = cpu;
 	}
 
@@ -7311,13 +7351,19 @@
 /*
  * Scan the local SMT mask for idle CPUs.
  */
-static int select_idle_smt(struct task_struct *p, int target)
+static int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target)
 {
 	int cpu;
 
 	for_each_cpu_and(cpu, cpu_smt_mask(target), p->cpus_ptr) {
 		if (cpu == target)
 			continue;
+		/*
+		 * Check if the CPU is in the LLC scheduling domain of @target.
+		 * Due to isolcpus, there is no guarantee that all the siblings are in the domain.
+		 */
+		if (!cpumask_test_cpu(cpu, sched_domain_span(sd)))
+			continue;
 		if (available_idle_cpu(cpu) || sched_idle_cpu(cpu))
 			return cpu;
 	}
@@ -7341,7 +7387,7 @@
 	return __select_idle_cpu(core, p);
 }
 
-static inline int select_idle_smt(struct task_struct *p, int target)
+static inline int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target)
 {
 	return -1;
 }
@@ -7591,7 +7637,7 @@
 		has_idle_core = test_idle_cores(target);
 
 		if (!has_idle_core && cpus_share_cache(prev, target)) {
-			i = select_idle_smt(p, prev);
+			i = select_idle_smt(p, sd, prev);
 			if ((unsigned int)i < nr_cpumask_bits)
 				return i;
 		}
@@ -8301,16 +8347,7 @@
 	if (test_tsk_need_resched(curr))
 		return;
 
-	/* Idle tasks are by definition preempted by non-idle tasks. */
-	if (unlikely(task_has_idle_policy(curr)) &&
-	    likely(!task_has_idle_policy(p)))
-		goto preempt;
-
-	/*
-	 * Batch and idle tasks do not preempt non-idle tasks (their preemption
-	 * is driven by the tick):
-	 */
-	if (unlikely(p->policy != SCHED_NORMAL) || !sched_feat(WAKEUP_PREEMPTION))
+	if (!sched_feat(WAKEUP_PREEMPTION))
 		return;
 
 	find_matching_se(&se, &pse);
@@ -8320,7 +8357,7 @@
 	pse_is_idle = se_is_idle(pse);
 
 	/*
-	 * Preempt an idle group in favor of a non-idle group (and don't preempt
+	 * Preempt an idle entity in favor of a non-idle entity (and don't preempt
 	 * in the inverse case).
 	 */
 	if (cse_is_idle && !pse_is_idle)
@@ -8328,9 +8365,14 @@
 	if (cse_is_idle != pse_is_idle)
 		return;
 
+	/*
+	 * BATCH and IDLE tasks do not preempt others.
+	 */
+	if (unlikely(p->policy != SCHED_NORMAL))
+		return;
+
 	cfs_rq = cfs_rq_of(se);
 	update_curr(cfs_rq);
-
 	/*
 	 * XXX pick_eevdf(cfs_rq) != se ?
 	 */
@@ -9068,12 +9110,8 @@
 			break;
 
 		env->loop++;
-		/*
-		 * We've more or less seen every task there is, call it quits
-		 * unless we haven't found any movable task yet.
-		 */
-		if (env->loop > env->loop_max &&
-		    !(env->flags & LBF_ALL_PINNED))
+		/* We've more or less seen every task there is, call it quits */
+		if (env->loop > env->loop_max)
 			break;
 
 		/* take a breather every nr_migrate tasks */
@@ -10609,19 +10647,14 @@
 		env->fbq_type = fbq_classify_group(&sds->busiest_stat);
 
 	if (!env->sd->parent) {
-		struct root_domain *rd = env->dst_rq->rd;
-
 		/* update overload indicator if we are at root domain */
-		WRITE_ONCE(rd->overload, sg_status & SG_OVERLOAD);
+		WRITE_ONCE(env->dst_rq->rd->overload, sg_status & SG_OVERLOAD);
 
 		/* Update over-utilization (tipping point, U >= 0) indicator */
-		WRITE_ONCE(rd->overutilized, sg_status & SG_OVERUTILIZED);
-		trace_sched_overutilized_tp(rd, sg_status & SG_OVERUTILIZED);
+		set_rd_overutilized_status(env->dst_rq->rd,
+					   sg_status & SG_OVERUTILIZED);
 	} else if (sg_status & SG_OVERUTILIZED) {
-		struct root_domain *rd = env->dst_rq->rd;
-
-		WRITE_ONCE(rd->overutilized, SG_OVERUTILIZED);
-		trace_sched_overutilized_tp(rd, SG_OVERUTILIZED);
+		set_rd_overutilized_status(env->dst_rq->rd, SG_OVERUTILIZED);
 	}
 
 	update_idle_cpu_scan(env, sum_util);
@@ -11353,9 +11386,7 @@
 
 		if (env.flags & LBF_NEED_BREAK) {
 			env.flags &= ~LBF_NEED_BREAK;
-			/* Stop if we tried all running tasks */
-			if (env.loop < busiest->nr_running)
-				goto more_balance;
+			goto more_balance;
 		}
 
 		/*
@@ -12143,7 +12174,7 @@
 		 * work being done for other CPUs. Next load
 		 * balancing owner will pick it up.
 		 */
-		if (need_resched()) {
+		if (!idle_cpu(this_cpu) && need_resched()) {
 			if (flags & NOHZ_STATS_KICK)
 				has_blocked_load = true;
 			if (flags & NOHZ_NEXT_KICK)
@@ -12627,7 +12658,7 @@
 		task_tick_numa(rq, curr);
 
 	update_misfit_status(curr, rq);
-	update_overutilized_status(task_rq(curr));
+	check_update_overutilized_status(task_rq(curr));
 
 	task_tick_core(rq, curr);
 }
--- linux-qcom-6.8.0.orig/kernel/sched/isolation.c
+++ linux-qcom-6.8.0/kernel/sched/isolation.c
@@ -109,6 +109,7 @@
 static int __init housekeeping_setup(char *str, unsigned long flags)
 {
 	cpumask_var_t non_housekeeping_mask, housekeeping_staging;
+	unsigned int first_cpu;
 	int err = 0;
 
 	if ((flags & HK_FLAG_TICK) && !(housekeeping.flags & HK_FLAG_TICK)) {
@@ -129,7 +130,8 @@
 	cpumask_andnot(housekeeping_staging,
 		       cpu_possible_mask, non_housekeeping_mask);
 
-	if (!cpumask_intersects(cpu_present_mask, housekeeping_staging)) {
+	first_cpu = cpumask_first_and(cpu_present_mask, housekeeping_staging);
+	if (first_cpu >= nr_cpu_ids || first_cpu >= setup_max_cpus) {
 		__cpumask_set_cpu(smp_processor_id(), housekeeping_staging);
 		__cpumask_clear_cpu(smp_processor_id(), non_housekeeping_mask);
 		if (!housekeeping.flags) {
@@ -138,6 +140,9 @@
 		}
 	}
 
+	if (cpumask_empty(non_housekeeping_mask))
+		goto free_housekeeping_staging;
+
 	if (!housekeeping.flags) {
 		/* First setup call ("nohz_full=" or "isolcpus=") */
 		enum hk_type type;
--- linux-qcom-6.8.0.orig/kernel/sched/pelt.c
+++ linux-qcom-6.8.0/kernel/sched/pelt.c
@@ -358,6 +358,54 @@
 	return 0;
 }
 
+__read_mostly unsigned int sched_pelt_lshift;
+static unsigned int sched_pelt_multiplier = 1;
+
+static int set_sched_pelt_multiplier(const char *val, const struct kernel_param *kp)
+{
+	int ret;
+
+	ret = param_set_int(val, kp);
+	if (ret)
+		goto error;
+
+	switch (sched_pelt_multiplier)  {
+	case 1:
+		fallthrough;
+	case 2:
+		fallthrough;
+	case 4:
+		WRITE_ONCE(sched_pelt_lshift,
+			   sched_pelt_multiplier >> 1);
+		break;
+	default:
+		ret = -EINVAL;
+		goto error;
+	}
+
+	return 0;
+
+error:
+	sched_pelt_multiplier = 1;
+	return ret;
+}
+
+static const struct kernel_param_ops sched_pelt_multiplier_ops = {
+	.set = set_sched_pelt_multiplier,
+	.get = param_get_int,
+};
+
+#ifdef MODULE_PARAM_PREFIX
+#undef MODULE_PARAM_PREFIX
+#endif
+/* XXX: should we use sched as prefix? */
+#define MODULE_PARAM_PREFIX "kernel."
+module_param_cb(sched_pelt_multiplier, &sched_pelt_multiplier_ops, &sched_pelt_multiplier, 0444);
+MODULE_PARM_DESC(sched_pelt_multiplier, "PELT HALFLIFE helps control the responsiveness of the system.");
+MODULE_PARM_DESC(sched_pelt_multiplier, "Accepted value: 1 32ms PELT HALIFE - roughly 200ms to go from 0 to max performance point (default).");
+MODULE_PARM_DESC(sched_pelt_multiplier, "                2 16ms PELT HALIFE - roughly 100ms to go from 0 to max performance point.");
+MODULE_PARM_DESC(sched_pelt_multiplier, "                4  8ms PELT HALIFE - roughly  50ms to go from 0 to max performance point.");
+
 /*
  * dl_rq:
  *
--- linux-qcom-6.8.0.orig/kernel/sched/pelt.h
+++ linux-qcom-6.8.0/kernel/sched/pelt.h
@@ -61,6 +61,14 @@
 	WRITE_ONCE(avg->util_est, enqueued);
 }
 
+static inline u64 rq_clock_task_mult(struct rq *rq)
+{
+	lockdep_assert_rq_held(rq);
+	assert_clock_updated(rq);
+
+	return rq->clock_task_mult;
+}
+
 static inline u64 rq_clock_pelt(struct rq *rq)
 {
 	lockdep_assert_rq_held(rq);
@@ -72,7 +80,7 @@
 /* The rq is idle, we can sync to clock_task */
 static inline void _update_idle_rq_clock_pelt(struct rq *rq)
 {
-	rq->clock_pelt  = rq_clock_task(rq);
+	rq->clock_pelt = rq_clock_task_mult(rq);
 
 	u64_u32_store(rq->clock_idle, rq_clock(rq));
 	/* Paired with smp_rmb in migrate_se_pelt_lag() */
@@ -121,6 +129,27 @@
 	rq->clock_pelt += delta;
 }
 
+extern unsigned int sched_pelt_lshift;
+
+/*
+ * absolute time   |1      |2      |3      |4      |5      |6      |
+ * @ mult = 1      --------****************--------****************-
+ * @ mult = 2      --------********----------------********---------
+ * @ mult = 4      --------****--------------------****-------------
+ * clock task mult
+ * @ mult = 2      |   |   |2  |3  |   |   |   |   |5  |6  |   |   |
+ * @ mult = 4      | | | | |2|3| | | | | | | | | | |5|6| | | | | | |
+ *
+ */
+static inline void update_rq_clock_task_mult(struct rq *rq, s64 delta)
+{
+	delta <<= READ_ONCE(sched_pelt_lshift);
+
+	rq->clock_task_mult += delta;
+
+	update_rq_clock_pelt(rq, delta);
+}
+
 /*
  * When rq becomes idle, we have to check if it has lost idle time
  * because it was fully busy. A rq is fully used when the /Sum util_sum
@@ -147,7 +176,7 @@
 	 * rq's clock_task.
 	 */
 	if (util_sum >= divider)
-		rq->lost_idle_time += rq_clock_task(rq) - rq->clock_pelt;
+		rq->lost_idle_time += rq_clock_task_mult(rq) - rq->clock_pelt;
 
 	_update_idle_rq_clock_pelt(rq);
 }
@@ -218,13 +247,18 @@
 	return 0;
 }
 
-static inline u64 rq_clock_pelt(struct rq *rq)
+static inline u64 rq_clock_task_mult(struct rq *rq)
 {
 	return rq_clock_task(rq);
 }
 
+static inline u64 rq_clock_pelt(struct rq *rq)
+{
+	return rq_clock_task_mult(rq);
+}
+
 static inline void
-update_rq_clock_pelt(struct rq *rq, s64 delta) { }
+update_rq_clock_task_mult(struct rq *rq, s64 delta) { }
 
 static inline void
 update_idle_rq_clock_pelt(struct rq *rq) { }
--- linux-qcom-6.8.0.orig/kernel/sched/psi.c
+++ linux-qcom-6.8.0/kernel/sched/psi.c
@@ -765,14 +765,16 @@
 }
 
 static void psi_group_change(struct psi_group *group, int cpu,
-			     unsigned int clear, unsigned int set, u64 now,
+			     unsigned int clear, unsigned int set,
 			     bool wake_clock)
 {
 	struct psi_group_cpu *groupc;
 	unsigned int t, m;
 	enum psi_states s;
 	u32 state_mask;
+	u64 now;
 
+	lockdep_assert_rq_held(cpu_rq(cpu));
 	groupc = per_cpu_ptr(group->pcpu, cpu);
 
 	/*
@@ -785,6 +787,7 @@
 	 * SOME and FULL time these may have resulted in.
 	 */
 	write_seqcount_begin(&groupc->seq);
+	now = cpu_clock(cpu);
 
 	/*
 	 * Start with TSK_ONCPU, which doesn't have a corresponding
@@ -898,18 +901,15 @@
 {
 	int cpu = task_cpu(task);
 	struct psi_group *group;
-	u64 now;
 
 	if (!task->pid)
 		return;
 
 	psi_flags_change(task, clear, set);
 
-	now = cpu_clock(cpu);
-
 	group = task_psi_group(task);
 	do {
-		psi_group_change(group, cpu, clear, set, now, true);
+		psi_group_change(group, cpu, clear, set, true);
 	} while ((group = group->parent));
 }
 
@@ -918,7 +918,6 @@
 {
 	struct psi_group *group, *common = NULL;
 	int cpu = task_cpu(prev);
-	u64 now = cpu_clock(cpu);
 
 	if (next->pid) {
 		psi_flags_change(next, 0, TSK_ONCPU);
@@ -935,7 +934,7 @@
 				break;
 			}
 
-			psi_group_change(group, cpu, 0, TSK_ONCPU, now, true);
+			psi_group_change(group, cpu, 0, TSK_ONCPU, true);
 		} while ((group = group->parent));
 	}
 
@@ -973,7 +972,7 @@
 		do {
 			if (group == common)
 				break;
-			psi_group_change(group, cpu, clear, set, now, wake_clock);
+			psi_group_change(group, cpu, clear, set, wake_clock);
 		} while ((group = group->parent));
 
 		/*
@@ -985,35 +984,47 @@
 		if ((prev->psi_flags ^ next->psi_flags) & ~TSK_ONCPU) {
 			clear &= ~TSK_ONCPU;
 			for (; group; group = group->parent)
-				psi_group_change(group, cpu, clear, set, now, wake_clock);
+				psi_group_change(group, cpu, clear, set, wake_clock);
 		}
 	}
 }
 
 #ifdef CONFIG_IRQ_TIME_ACCOUNTING
-void psi_account_irqtime(struct task_struct *task, u32 delta)
+void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_struct *prev)
 {
-	int cpu = task_cpu(task);
+	int cpu = task_cpu(curr);
 	struct psi_group *group;
 	struct psi_group_cpu *groupc;
-	u64 now;
+	s64 delta;
+	u64 irq;
 
 	if (static_branch_likely(&psi_disabled))
 		return;
 
-	if (!task->pid)
+	if (!curr->pid)
 		return;
 
-	now = cpu_clock(cpu);
+	lockdep_assert_rq_held(rq);
+	group = task_psi_group(curr);
+	if (prev && task_psi_group(prev) == group)
+		return;
+
+	irq = irq_time_read(cpu);
+	delta = (s64)(irq - rq->psi_irq_time);
+	if (delta < 0)
+		return;
+	rq->psi_irq_time = irq;
 
-	group = task_psi_group(task);
 	do {
+		u64 now;
+
 		if (!group->enabled)
 			continue;
 
 		groupc = per_cpu_ptr(group->pcpu, cpu);
 
 		write_seqcount_begin(&groupc->seq);
+		now = cpu_clock(cpu);
 
 		record_times(groupc, now);
 		groupc->times[PSI_IRQ_FULL] += delta;
@@ -1212,11 +1223,9 @@
 	for_each_possible_cpu(cpu) {
 		struct rq *rq = cpu_rq(cpu);
 		struct rq_flags rf;
-		u64 now;
 
 		rq_lock_irq(rq, &rf);
-		now = cpu_clock(cpu);
-		psi_group_change(group, cpu, 0, 0, now, true);
+		psi_group_change(group, cpu, 0, 0, true);
 		rq_unlock_irq(rq, &rf);
 	}
 }
--- linux-qcom-6.8.0.orig/kernel/sched/sched.h
+++ linux-qcom-6.8.0/kernel/sched/sched.h
@@ -79,6 +79,8 @@
 # include <asm/paravirt_api_clock.h>
 #endif
 
+#include <asm/barrier.h>
+
 #include "cpupri.h"
 #include "cpudeadline.h"
 
@@ -1040,6 +1042,7 @@
 	u64			clock;
 	/* Ensure that all clocks are in the same cache line */
 	u64			clock_task ____cacheline_aligned;
+	u64			clock_task_mult;
 	u64			clock_pelt;
 	unsigned long		lost_idle_time;
 	u64			clock_pelt_idle;
@@ -1105,6 +1108,7 @@
 
 #ifdef CONFIG_IRQ_TIME_ACCOUNTING
 	u64			prev_irq_time;
+	u64			psi_irq_time;
 #endif
 #ifdef CONFIG_PARAVIRT
 	u64			prev_steal_time;
@@ -2460,7 +2464,7 @@
 extern void init_sched_rt_class(void);
 extern void init_sched_fair_class(void);
 
-extern void reweight_task(struct task_struct *p, int prio);
+extern void reweight_task(struct task_struct *p, const struct load_weight *lw);
 
 extern void resched_curr(struct rq *rq);
 extern void resched_cpu(int cpu);
@@ -3445,13 +3449,19 @@
 		 * between rq->curr store and load of {prev,next}->mm->pcpu_cid[cpu].
 		 * Provide it here.
 		 */
-		if (!prev->mm)                          // from kernel
+		if (!prev->mm) {                        // from kernel
 			smp_mb();
-		/*
-		 * user -> user transition guarantees a memory barrier through
-		 * switch_mm() when current->mm changes. If current->mm is
-		 * unchanged, no barrier is needed.
-		 */
+		} else {				// from user
+			/*
+			 * user->user transition relies on an implicit
+			 * memory barrier in switch_mm() when
+			 * current->mm changes. If the architecture
+			 * switch_mm() does not have an implicit memory
+			 * barrier, it is emitted here.  If current->mm
+			 * is unchanged, no barrier is needed.
+			 */
+			smp_mb__after_switch_mm();
+		}
 	}
 	if (prev->mm_cid_active) {
 		mm_cid_snapshot_time(rq, prev->mm);
--- linux-qcom-6.8.0.orig/kernel/sched/stats.c
+++ linux-qcom-6.8.0/kernel/sched/stats.c
@@ -92,16 +92,6 @@
 
 			trace_sched_stat_blocked(p, delta);
 
-			/*
-			 * Blocking time is in units of nanosecs, so shift by
-			 * 20 to get a milliseconds-range estimation of the
-			 * amount of time that the task spent sleeping:
-			 */
-			if (unlikely(prof_on == SLEEP_PROFILING)) {
-				profile_hits(SLEEP_PROFILING,
-					     (void *)get_wchan(p),
-					     delta >> 20);
-			}
 			account_scheduler_latency(p, delta >> 10, 0);
 		}
 	}
--- linux-qcom-6.8.0.orig/kernel/sched/stats.h
+++ linux-qcom-6.8.0/kernel/sched/stats.h
@@ -110,8 +110,12 @@
 void psi_task_change(struct task_struct *task, int clear, int set);
 void psi_task_switch(struct task_struct *prev, struct task_struct *next,
 		     bool sleep);
-void psi_account_irqtime(struct task_struct *task, u32 delta);
-
+#ifdef CONFIG_IRQ_TIME_ACCOUNTING
+void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_struct *prev);
+#else
+static inline void psi_account_irqtime(struct rq *rq, struct task_struct *curr,
+				       struct task_struct *prev) {}
+#endif /*CONFIG_IRQ_TIME_ACCOUNTING */
 /*
  * PSI tracks state that persists across sleeps, such as iowaits and
  * memory stalls. As a result, it has to distinguish between sleeps,
@@ -192,7 +196,8 @@
 static inline void psi_sched_switch(struct task_struct *prev,
 				    struct task_struct *next,
 				    bool sleep) {}
-static inline void psi_account_irqtime(struct task_struct *task, u32 delta) {}
+static inline void psi_account_irqtime(struct rq *rq, struct task_struct *curr,
+				       struct task_struct *prev) {}
 #endif /* CONFIG_PSI */
 
 #ifdef CONFIG_SCHED_INFO
--- linux-qcom-6.8.0.orig/kernel/sched/topology.c
+++ linux-qcom-6.8.0/kernel/sched/topology.c
@@ -1468,7 +1468,7 @@
 	} else
 		request = attr->relax_domain_level;
 
-	if (sd->level > request) {
+	if (sd->level >= request) {
 		/* Turn off idle balance on this domain: */
 		sd->flags &= ~(SD_BALANCE_WAKE|SD_BALANCE_NEWIDLE);
 	}
--- linux-qcom-6.8.0.orig/kernel/sched/wait.c
+++ linux-qcom-6.8.0/kernel/sched/wait.c
@@ -212,6 +212,7 @@
 	/* POLLFREE must have cleared the queue. */
 	WARN_ON_ONCE(waitqueue_active(wq_head));
 }
+EXPORT_SYMBOL_GPL(__wake_up_pollfree);
 
 /*
  * Note: we use "set_current_state()" _after_ the wait-queue add,
--- linux-qcom-6.8.0.orig/kernel/seccomp.c
+++ linux-qcom-6.8.0/kernel/seccomp.c
@@ -502,6 +502,9 @@
 		/* Skip current, since it is initiating the sync. */
 		if (thread == caller)
 			continue;
+		/* Skip exited threads. */
+		if (thread->flags & PF_EXITING)
+			continue;
 
 		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
 		    (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
@@ -563,18 +566,21 @@
  * @tsk: task the filter should be released from.
  *
  * This function should only be called when the task is exiting as
- * it detaches it from its filter tree. As such, READ_ONCE() and
- * barriers are not needed here, as would normally be needed.
+ * it detaches it from its filter tree. PF_EXITING has to be set
+ * for the task.
  */
 void seccomp_filter_release(struct task_struct *tsk)
 {
-	struct seccomp_filter *orig = tsk->seccomp.filter;
+	struct seccomp_filter *orig;
 
-	/* We are effectively holding the siglock by not having any sighand. */
-	WARN_ON(tsk->sighand != NULL);
+	if (WARN_ON((tsk->flags & PF_EXITING) == 0))
+		return;
 
+	spin_lock_irq(&tsk->sighand->siglock);
+	orig = tsk->seccomp.filter;
 	/* Detach task from its filter tree. */
 	tsk->seccomp.filter = NULL;
+	spin_unlock_irq(&tsk->sighand->siglock);
 	__seccomp_filter_release(orig);
 }
 
@@ -602,6 +608,13 @@
 		if (thread == caller)
 			continue;
 
+		/*
+		 * Skip exited threads. seccomp_filter_release could have
+		 * been already called for this task.
+		 */
+		if (thread->flags & PF_EXITING)
+			continue;
+
 		/* Get a task reference for the new leaf node. */
 		get_seccomp_filter(caller);
 
--- linux-qcom-6.8.0.orig/kernel/signal.c
+++ linux-qcom-6.8.0/kernel/signal.c
@@ -418,7 +418,8 @@
 	 */
 	rcu_read_lock();
 	ucounts = task_ucounts(t);
-	sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING);
+	sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING,
+					    override_rlimit);
 	rcu_read_unlock();
 	if (!sigpending)
 		return NULL;
@@ -1975,14 +1976,15 @@
 	 * into t->pending).
 	 *
 	 * Where type is not PIDTYPE_PID, signals must be delivered to the
-	 * process. In this case, prefer to deliver to current if it is in
-	 * the same thread group as the target process, which avoids
-	 * unnecessarily waking up a potentially idle task.
+	 * process. In this case, prefer to deliver to current if it is in the
+	 * same thread group as the target process and its sighand is stable,
+	 * which avoids unnecessarily waking up a potentially idle task.
 	 */
 	t = pid_task(pid, type);
 	if (!t)
 		goto ret;
-	if (type != PIDTYPE_PID && same_thread_group(t, current))
+	if (type != PIDTYPE_PID &&
+	    same_thread_group(t, current) && !current->exit_state)
 		t = current;
 	if (!likely(lock_task_sighand(t, &flags)))
 		goto ret;
@@ -2588,6 +2590,14 @@
 	spin_unlock_irq(&current->sighand->siglock);
 	cgroup_enter_frozen();
 	schedule();
+
+	/*
+	 * We could've been woken by task_work, run it to clear
+	 * TIF_NOTIFY_SIGNAL. The caller will retry if necessary.
+	 */
+	clear_notify_signal();
+	if (unlikely(task_work_pending(current)))
+		task_work_run();
 }
 
 static int ptrace_signal(int signr, kernel_siginfo_t *info, enum pid_type type)
--- linux-qcom-6.8.0.orig/kernel/smp.c
+++ linux-qcom-6.8.0/kernel/smp.c
@@ -1119,6 +1119,7 @@
 
 	queue_work_on(cpu, system_wq, &sscs.work);
 	wait_for_completion(&sscs.done);
+	destroy_work_on_stack(&sscs.work);
 
 	return sscs.ret;
 }
--- linux-qcom-6.8.0.orig/kernel/softirq.c
+++ linux-qcom-6.8.0/kernel/softirq.c
@@ -279,17 +279,24 @@
 		wakeup_softirqd();
 }
 
+#define SCHED_SOFTIRQ_MASK	BIT(SCHED_SOFTIRQ)
+
 /*
  * flush_smp_call_function_queue() can raise a soft interrupt in a function
- * call. On RT kernels this is undesired and the only known functionality
- * in the block layer which does this is disabled on RT. If soft interrupts
- * get raised which haven't been raised before the flush, warn so it can be
+ * call. On RT kernels this is undesired and the only known functionalities
+ * are in the block layer which is disabled on RT, and in the scheduler for
+ * idle load balancing. If soft interrupts get raised which haven't been
+ * raised before the flush, warn if it is not a SCHED_SOFTIRQ so it can be
  * investigated.
  */
 void do_softirq_post_smp_call_flush(unsigned int was_pending)
 {
-	if (WARN_ON_ONCE(was_pending != local_softirq_pending()))
+	unsigned int is_pending = local_softirq_pending();
+
+	if (unlikely(was_pending != is_pending)) {
+		WARN_ON_ONCE(was_pending != (is_pending & ~SCHED_SOFTIRQ_MASK));
 		invoke_softirq();
+	}
 }
 
 #else /* CONFIG_PREEMPT_RT */
@@ -507,7 +514,7 @@
 static inline void lockdep_softirq_end(bool in_hardirq) { }
 #endif
 
-asmlinkage __visible void __softirq_entry __do_softirq(void)
+static void handle_softirqs(bool ksirqd)
 {
 	unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
 	unsigned long old_flags = current->flags;
@@ -562,8 +569,7 @@
 		pending >>= softirq_bit;
 	}
 
-	if (!IS_ENABLED(CONFIG_PREEMPT_RT) &&
-	    __this_cpu_read(ksoftirqd) == current)
+	if (!IS_ENABLED(CONFIG_PREEMPT_RT) && ksirqd)
 		rcu_softirq_qs();
 
 	local_irq_disable();
@@ -583,6 +589,11 @@
 	current_restore_flags(old_flags, PF_MEMALLOC);
 }
 
+asmlinkage __visible void __softirq_entry __do_softirq(void)
+{
+	handle_softirqs(false);
+}
+
 /**
  * irq_enter_rcu - Enter an interrupt context with RCU watching
  */
@@ -918,7 +929,7 @@
 		 * We can safely run softirq on inline stack, as we are not deep
 		 * in the task stack here.
 		 */
-		__do_softirq();
+		handle_softirqs(true);
 		ksoftirqd_run_end();
 		cond_resched();
 		return;
--- linux-qcom-6.8.0.orig/kernel/static_call_inline.c
+++ linux-qcom-6.8.0/kernel/static_call_inline.c
@@ -15,7 +15,7 @@
 extern struct static_call_tramp_key __start_static_call_tramp_key[],
 				    __stop_static_call_tramp_key[];
 
-static int static_call_initialized;
+int static_call_initialized;
 
 /*
  * Must be called before early_initcall() to be effective.
@@ -411,6 +411,17 @@
 
 	for (site = start; site < stop; site++) {
 		key = static_call_key(site);
+
+		/*
+		 * If the key was not updated due to a memory allocation
+		 * failure in __static_call_init() then treating key::sites
+		 * as key::mods in the code below would cause random memory
+		 * access and #GP. In that case all subsequent sites have
+		 * not been touched either, so stop iterating.
+		 */
+		if (!static_call_key_has_mods(key))
+			break;
+
 		if (key == prev_key)
 			continue;
 
@@ -442,7 +453,7 @@
 	case MODULE_STATE_COMING:
 		ret = static_call_add_module(mod);
 		if (ret) {
-			WARN(1, "Failed to allocate memory for static calls");
+			pr_warn("Failed to allocate memory for static calls\n");
 			static_call_del_module(mod);
 		}
 		break;
--- linux-qcom-6.8.0.orig/kernel/sys.c
+++ linux-qcom-6.8.0/kernel/sys.c
@@ -1263,6 +1263,21 @@
 DECLARE_RWSEM(uts_sem);
 
 #ifdef COMPAT_UTS_MACHINE
+static char compat_uts_machine[__OLD_UTS_LEN+1] = COMPAT_UTS_MACHINE;
+
+static int __init parse_compat_uts_machine(char *arg)
+{
+	strncpy(compat_uts_machine, arg, __OLD_UTS_LEN);
+	compat_uts_machine[__OLD_UTS_LEN] = 0;
+	return 0;
+}
+early_param("compat_uts_machine", parse_compat_uts_machine);
+
+#undef COMPAT_UTS_MACHINE
+#define COMPAT_UTS_MACHINE compat_uts_machine
+#endif
+
+#ifdef COMPAT_UTS_MACHINE
 #define override_architecture(name) \
 	(personality(current->personality) == PER_LINUX32 && \
 	 copy_to_user(name->machine, COMPAT_UTS_MACHINE, \
@@ -2408,8 +2423,11 @@
 	if (bits & PR_MDWE_NO_INHERIT && !(bits & PR_MDWE_REFUSE_EXEC_GAIN))
 		return -EINVAL;
 
-	/* PARISC cannot allow mdwe as it needs writable stacks */
-	if (IS_ENABLED(CONFIG_PARISC))
+	/*
+	 * EOPNOTSUPP might be more appropriate here in principle, but
+	 * existing userspace depends on EINVAL specifically.
+	 */
+	if (!arch_memory_deny_write_exec_supported())
 		return -EINVAL;
 
 	current_bits = get_current_mdwe();
--- linux-qcom-6.8.0.orig/kernel/sys_ni.c
+++ linux-qcom-6.8.0/kernel/sys_ni.c
@@ -46,8 +46,8 @@
 COND_SYSCALL(io_getevents);
 COND_SYSCALL(io_pgetevents_time32);
 COND_SYSCALL(io_pgetevents);
-COND_SYSCALL_COMPAT(io_pgetevents_time32);
 COND_SYSCALL_COMPAT(io_pgetevents);
+COND_SYSCALL_COMPAT(io_pgetevents_time64);
 COND_SYSCALL(io_uring_setup);
 COND_SYSCALL(io_uring_enter);
 COND_SYSCALL(io_uring_register);
--- linux-qcom-6.8.0.orig/kernel/sysctl.c
+++ linux-qcom-6.8.0/kernel/sysctl.c
@@ -63,6 +63,7 @@
 #include <linux/mount.h>
 #include <linux/userfaultfd_k.h>
 #include <linux/pid.h>
+#include <linux/user_namespace.h>
 
 #include "../lib/kstrtox.h"
 
@@ -1766,6 +1767,15 @@
 		.proc_handler	= sysrq_sysctl_handler,
 	},
 #endif
+#ifdef CONFIG_USER_NS
+	{
+		.procname	= "unprivileged_userns_clone",
+		.data		= &unprivileged_userns_clone,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec,
+	},
+#endif
 #ifdef CONFIG_PROC_SYSCTL
 	{
 		.procname	= "cad_pid",
--- linux-qcom-6.8.0.orig/kernel/task_work.c
+++ linux-qcom-6.8.0/kernel/task_work.c
@@ -1,10 +1,20 @@
 // SPDX-License-Identifier: GPL-2.0
+#include <linux/irq_work.h>
 #include <linux/spinlock.h>
 #include <linux/task_work.h>
 #include <linux/resume_user_mode.h>
 
 static struct callback_head work_exited; /* all we need is ->next == NULL */
 
+#ifdef CONFIG_IRQ_WORK
+static void task_work_set_notify_irq(struct irq_work *entry)
+{
+	test_and_set_tsk_thread_flag(current, TIF_NOTIFY_RESUME);
+}
+static DEFINE_PER_CPU(struct irq_work, irq_work_NMI_resume) =
+	IRQ_WORK_INIT_HARD(task_work_set_notify_irq);
+#endif
+
 /**
  * task_work_add - ask the @task to execute @work->func()
  * @task: the task which should run the callback
@@ -12,7 +22,7 @@
  * @notify: how to notify the targeted task
  *
  * Queue @work for task_work_run() below and notify the @task if @notify
- * is @TWA_RESUME, @TWA_SIGNAL, or @TWA_SIGNAL_NO_IPI.
+ * is @TWA_RESUME, @TWA_SIGNAL, @TWA_SIGNAL_NO_IPI or @TWA_NMI_CURRENT.
  *
  * @TWA_SIGNAL works like signals, in that the it will interrupt the targeted
  * task and run the task_work, regardless of whether the task is currently
@@ -24,6 +34,8 @@
  * kernel anyway.
  * @TWA_RESUME work is run only when the task exits the kernel and returns to
  * user mode, or before entering guest mode.
+ * @TWA_NMI_CURRENT works like @TWA_RESUME, except it can only be used for the
+ * current @task and if the current context is NMI.
  *
  * Fails if the @task is exiting/exited and thus it can't process this @work.
  * Otherwise @work->func() will be called when the @task goes through one of
@@ -43,9 +55,27 @@
 		  enum task_work_notify_mode notify)
 {
 	struct callback_head *head;
+	int flags = notify & TWA_FLAGS;
 
-	/* record the work call stack in order to print it in KASAN reports */
-	kasan_record_aux_stack(work);
+	notify &= ~TWA_FLAGS;
+	if (notify == TWA_NMI_CURRENT) {
+		if (WARN_ON_ONCE(task != current))
+			return -EINVAL;
+		if (!IS_ENABLED(CONFIG_IRQ_WORK))
+			return -EINVAL;
+	} else {
+		/*
+		 * Record the work call stack in order to print it in KASAN
+		 * reports.
+		 *
+		 * Note that stack allocation can fail if TWAF_NO_ALLOC flag
+		 * is set and new page is needed to expand the stack buffer.
+		 */
+		if (flags & TWAF_NO_ALLOC)
+			kasan_record_aux_stack_noalloc(work);
+		else
+			kasan_record_aux_stack(work);
+	}
 
 	head = READ_ONCE(task->task_works);
 	do {
@@ -66,6 +96,11 @@
 	case TWA_SIGNAL_NO_IPI:
 		__set_notify_signal(task);
 		break;
+#ifdef CONFIG_IRQ_WORK
+	case TWA_NMI_CURRENT:
+		irq_work_queue(this_cpu_ptr(&irq_work_NMI_resume));
+		break;
+#endif
 	default:
 		WARN_ON_ONCE(1);
 		break;
@@ -73,6 +108,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL(task_work_add);
 
 /**
  * task_work_cancel_match - cancel a pending work added by task_work_add()
@@ -120,9 +156,9 @@
 }
 
 /**
- * task_work_cancel - cancel a pending work added by task_work_add()
- * @task: the task which should execute the work
- * @func: identifies the work to remove
+ * task_work_cancel_func - cancel a pending work matching a function added by task_work_add()
+ * @task: the task which should execute the func's work
+ * @func: identifies the func to match with a work to remove
  *
  * Find the last queued pending work with ->func == @func and remove
  * it from queue.
@@ -131,11 +167,35 @@
  * The found work or NULL if not found.
  */
 struct callback_head *
-task_work_cancel(struct task_struct *task, task_work_func_t func)
+task_work_cancel_func(struct task_struct *task, task_work_func_t func)
 {
 	return task_work_cancel_match(task, task_work_func_match, func);
 }
 
+static bool task_work_match(struct callback_head *cb, void *data)
+{
+	return cb == data;
+}
+
+/**
+ * task_work_cancel - cancel a pending work added by task_work_add()
+ * @task: the task which should execute the work
+ * @cb: the callback to remove if queued
+ *
+ * Remove a callback from a task's queue if queued.
+ *
+ * RETURNS:
+ * True if the callback was queued and got cancelled, false otherwise.
+ */
+bool task_work_cancel(struct task_struct *task, struct callback_head *cb)
+{
+	struct callback_head *ret;
+
+	ret = task_work_cancel_match(task, task_work_match, cb);
+
+	return ret == cb;
+}
+
 /**
  * task_work_run - execute the works added by task_work_add()
  *
@@ -168,7 +228,7 @@
 		if (!work)
 			break;
 		/*
-		 * Synchronize with task_work_cancel(). It can not remove
+		 * Synchronize with task_work_cancel_match(). It can not remove
 		 * the first entry == work, cmpxchg(task_works) must fail.
 		 * But it can remove another entry from the ->next list.
 		 */
--- linux-qcom-6.8.0.orig/kernel/time/clocksource-wdtest.c
+++ linux-qcom-6.8.0/kernel/time/clocksource-wdtest.c
@@ -104,8 +104,8 @@
 static int wdtest_func(void *arg)
 {
 	unsigned long j1, j2;
+	int i, max_retries;
 	char *s;
-	int i;
 
 	schedule_timeout_uninterruptible(holdoff * HZ);
 
@@ -139,18 +139,19 @@
 	WARN_ON_ONCE(time_before(j2, j1 + NSEC_PER_USEC));
 
 	/* Verify tsc-like stability with various numbers of errors injected. */
-	for (i = 0; i <= max_cswd_read_retries + 1; i++) {
-		if (i <= 1 && i < max_cswd_read_retries)
+	max_retries = clocksource_get_max_watchdog_retry();
+	for (i = 0; i <= max_retries + 1; i++) {
+		if (i <= 1 && i < max_retries)
 			s = "";
-		else if (i <= max_cswd_read_retries)
+		else if (i <= max_retries)
 			s = ", expect message";
 		else
 			s = ", expect clock skew";
-		pr_info("--- Watchdog with %dx error injection, %lu retries%s.\n", i, max_cswd_read_retries, s);
+		pr_info("--- Watchdog with %dx error injection, %d retries%s.\n", i, max_retries, s);
 		WRITE_ONCE(wdtest_ktime_read_ndelays, i);
 		schedule_timeout_uninterruptible(2 * HZ);
 		WARN_ON_ONCE(READ_ONCE(wdtest_ktime_read_ndelays));
-		WARN_ON_ONCE((i <= max_cswd_read_retries) !=
+		WARN_ON_ONCE((i <= max_retries) !=
 			     !(clocksource_wdtest_ktime.flags & CLOCK_SOURCE_UNSTABLE));
 		wdtest_ktime_clocksource_reset();
 	}
--- linux-qcom-6.8.0.orig/kernel/time/clocksource.c
+++ linux-qcom-6.8.0/kernel/time/clocksource.c
@@ -20,6 +20,16 @@
 #include "tick-internal.h"
 #include "timekeeping_internal.h"
 
+static noinline u64 cycles_to_nsec_safe(struct clocksource *cs, u64 start, u64 end)
+{
+	u64 delta = clocksource_delta(end, start, cs->mask);
+
+	if (likely(delta < cs->max_cycles))
+		return clocksource_cyc2ns(delta, cs->mult, cs->shift);
+
+	return mul_u64_u32_shr(delta, cs->mult, cs->shift);
+}
+
 /**
  * clocks_calc_mult_shift - calculate mult/shift factors for scaled math of clocks
  * @mult:	pointer to mult variable
@@ -210,9 +220,6 @@
 	spin_unlock_irqrestore(&watchdog_lock, flags);
 }
 
-ulong max_cswd_read_retries = 2;
-module_param(max_cswd_read_retries, ulong, 0644);
-EXPORT_SYMBOL_GPL(max_cswd_read_retries);
 static int verify_n_cpus = 8;
 module_param(verify_n_cpus, int, 0644);
 
@@ -224,11 +231,12 @@
 
 static enum wd_read_status cs_watchdog_read(struct clocksource *cs, u64 *csnow, u64 *wdnow)
 {
-	unsigned int nretries;
-	u64 wd_end, wd_end2, wd_delta;
+	unsigned int nretries, max_retries;
 	int64_t wd_delay, wd_seq_delay;
+	u64 wd_end, wd_end2;
 
-	for (nretries = 0; nretries <= max_cswd_read_retries; nretries++) {
+	max_retries = clocksource_get_max_watchdog_retry();
+	for (nretries = 0; nretries <= max_retries; nretries++) {
 		local_irq_disable();
 		*wdnow = watchdog->read(watchdog);
 		*csnow = cs->read(cs);
@@ -236,11 +244,9 @@
 		wd_end2 = watchdog->read(watchdog);
 		local_irq_enable();
 
-		wd_delta = clocksource_delta(wd_end, *wdnow, watchdog->mask);
-		wd_delay = clocksource_cyc2ns(wd_delta, watchdog->mult,
-					      watchdog->shift);
+		wd_delay = cycles_to_nsec_safe(watchdog, *wdnow, wd_end);
 		if (wd_delay <= WATCHDOG_MAX_SKEW) {
-			if (nretries > 1 || nretries >= max_cswd_read_retries) {
+			if (nretries > 1 && nretries >= max_retries) {
 				pr_warn("timekeeping watchdog on CPU%d: %s retried %d times before success\n",
 					smp_processor_id(), watchdog->name, nretries);
 			}
@@ -256,8 +262,7 @@
 		 * report system busy, reinit the watchdog and skip the current
 		 * watchdog test.
 		 */
-		wd_delta = clocksource_delta(wd_end2, wd_end, watchdog->mask);
-		wd_seq_delay = clocksource_cyc2ns(wd_delta, watchdog->mult, watchdog->shift);
+		wd_seq_delay = cycles_to_nsec_safe(watchdog, wd_end, wd_end2);
 		if (wd_seq_delay > WATCHDOG_MAX_SKEW/2)
 			goto skip_test;
 	}
@@ -368,8 +373,7 @@
 		delta = (csnow_end - csnow_mid) & cs->mask;
 		if (delta < 0)
 			cpumask_set_cpu(cpu, &cpus_ahead);
-		delta = clocksource_delta(csnow_end, csnow_begin, cs->mask);
-		cs_nsec = clocksource_cyc2ns(delta, cs->mult, cs->shift);
+		cs_nsec = cycles_to_nsec_safe(cs, csnow_begin, csnow_end);
 		if (cs_nsec > cs_nsec_max)
 			cs_nsec_max = cs_nsec;
 		if (cs_nsec < cs_nsec_min)
@@ -400,8 +404,8 @@
 
 static void clocksource_watchdog(struct timer_list *unused)
 {
-	u64 csnow, wdnow, cslast, wdlast, delta;
 	int64_t wd_nsec, cs_nsec, interval;
+	u64 csnow, wdnow, cslast, wdlast;
 	int next_cpu, reset_pending;
 	struct clocksource *cs;
 	enum wd_read_status read_ret;
@@ -458,12 +462,8 @@
 			continue;
 		}
 
-		delta = clocksource_delta(wdnow, cs->wd_last, watchdog->mask);
-		wd_nsec = clocksource_cyc2ns(delta, watchdog->mult,
-					     watchdog->shift);
-
-		delta = clocksource_delta(csnow, cs->cs_last, cs->mask);
-		cs_nsec = clocksource_cyc2ns(delta, cs->mult, cs->shift);
+		wd_nsec = cycles_to_nsec_safe(watchdog, cs->wd_last, wdnow);
+		cs_nsec = cycles_to_nsec_safe(cs, cs->cs_last, csnow);
 		wdlast = cs->wd_last; /* save these in case we print them */
 		cslast = cs->cs_last;
 		cs->cs_last = csnow;
@@ -834,7 +834,7 @@
  */
 u64 clocksource_stop_suspend_timing(struct clocksource *cs, u64 cycle_now)
 {
-	u64 now, delta, nsec = 0;
+	u64 now, nsec = 0;
 
 	if (!suspend_clocksource)
 		return 0;
@@ -849,12 +849,8 @@
 	else
 		now = suspend_clocksource->read(suspend_clocksource);
 
-	if (now > suspend_start) {
-		delta = clocksource_delta(now, suspend_start,
-					  suspend_clocksource->mask);
-		nsec = mul_u64_u32_shr(delta, suspend_clocksource->mult,
-				       suspend_clocksource->shift);
-	}
+	if (now > suspend_start)
+		nsec = cycles_to_nsec_safe(suspend_clocksource, suspend_start, now);
 
 	/*
 	 * Disable the suspend timer to save power if current clocksource is
--- linux-qcom-6.8.0.orig/kernel/time/hrtimer.c
+++ linux-qcom-6.8.0/kernel/time/hrtimer.c
@@ -38,6 +38,7 @@
 #include <linux/sched/deadline.h>
 #include <linux/sched/nohz.h>
 #include <linux/sched/debug.h>
+#include <linux/sched/isolation.h>
 #include <linux/timer.h>
 #include <linux/freezer.h>
 #include <linux/compat.h>
@@ -1287,6 +1288,8 @@
 	struct hrtimer_clock_base *base;
 	unsigned long flags;
 
+	if (WARN_ON_ONCE(!timer->function))
+		return;
 	/*
 	 * Check whether the HRTIMER_MODE_SOFT bit and hrtimer.is_soft
 	 * match on CONFIG_PREEMPT_RT = n. With PREEMPT_RT check the hard
@@ -2177,6 +2180,15 @@
 	}
 
 	cpu_base->cpu = cpu;
+	hrtimer_cpu_base_init_expiry_lock(cpu_base);
+	return 0;
+}
+
+int hrtimers_cpu_starting(unsigned int cpu)
+{
+	struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases);
+
+	/* Clear out any left over state from a CPU down operation */
 	cpu_base->active_bases = 0;
 	cpu_base->hres_active = 0;
 	cpu_base->hang_detected = 0;
@@ -2185,7 +2197,6 @@
 	cpu_base->expires_next = KTIME_MAX;
 	cpu_base->softirq_expires_next = KTIME_MAX;
 	cpu_base->online = 1;
-	hrtimer_cpu_base_init_expiry_lock(cpu_base);
 	return 0;
 }
 
@@ -2223,8 +2234,8 @@
 
 int hrtimers_cpu_dying(unsigned int dying_cpu)
 {
+	int i, ncpu = cpumask_any_and(cpu_active_mask, housekeeping_cpumask(HK_TYPE_TIMER));
 	struct hrtimer_cpu_base *old_base, *new_base;
-	int i, ncpu = cpumask_first(cpu_active_mask);
 
 	tick_cancel_sched_timer(dying_cpu);
 
@@ -2263,6 +2274,7 @@
 void __init hrtimers_init(void)
 {
 	hrtimers_prepare_cpu(smp_processor_id());
+	hrtimers_cpu_starting(smp_processor_id());
 	open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq);
 }
 
--- linux-qcom-6.8.0.orig/kernel/time/ntp.c
+++ linux-qcom-6.8.0/kernel/time/ntp.c
@@ -727,17 +727,16 @@
 	}
 
 	if (txc->modes & ADJ_MAXERROR)
-		time_maxerror = txc->maxerror;
+		time_maxerror = clamp(txc->maxerror, 0, NTP_PHASE_LIMIT);
 
 	if (txc->modes & ADJ_ESTERROR)
-		time_esterror = txc->esterror;
+		time_esterror = clamp(txc->esterror, 0, NTP_PHASE_LIMIT);
 
 	if (txc->modes & ADJ_TIMECONST) {
-		time_constant = txc->constant;
+		time_constant = clamp(txc->constant, 0, MAXTC);
 		if (!(time_status & STA_NANO))
 			time_constant += 4;
-		time_constant = min(time_constant, (long)MAXTC);
-		time_constant = max(time_constant, 0l);
+		time_constant = clamp(time_constant, 0, MAXTC);
 	}
 
 	if (txc->modes & ADJ_TAI &&
@@ -797,7 +796,7 @@
 		txc->offset = shift_right(time_offset * NTP_INTERVAL_FREQ,
 				  NTP_SCALE_SHIFT);
 		if (!(time_status & STA_NANO))
-			txc->offset = (u32)txc->offset / NSEC_PER_USEC;
+			txc->offset = div_s64(txc->offset, NSEC_PER_USEC);
 	}
 
 	result = time_state;	/* mostly `TIME_OK' */
--- linux-qcom-6.8.0.orig/kernel/time/posix-clock.c
+++ linux-qcom-6.8.0/kernel/time/posix-clock.c
@@ -129,15 +129,17 @@
 		goto out;
 	}
 	pccontext->clk = clk;
-	fp->private_data = pccontext;
-	if (clk->ops.open)
+	if (clk->ops.open) {
 		err = clk->ops.open(pccontext, fp->f_mode);
-	else
-		err = 0;
-
-	if (!err) {
-		get_device(clk->dev);
+		if (err) {
+			kfree(pccontext);
+			goto out;
+		}
 	}
+
+	fp->private_data = pccontext;
+	get_device(clk->dev);
+	err = 0;
 out:
 	up_read(&clk->rwsem);
 	return err;
@@ -289,6 +291,9 @@
 	struct posix_clock_desc cd;
 	int err;
 
+	if (!timespec64_valid_strict(ts))
+		return -EINVAL;
+
 	err = get_clock_desc(id, &cd);
 	if (err)
 		return err;
--- linux-qcom-6.8.0.orig/kernel/time/tick-broadcast.c
+++ linux-qcom-6.8.0/kernel/time/tick-broadcast.c
@@ -1148,6 +1148,30 @@
 	bc = tick_broadcast_device.evtdev;
 
 	if (bc && broadcast_needs_cpu(bc, deadcpu)) {
+		/*
+		 * If the broadcast force bit of the current CPU is set,
+		 * then the current CPU has not yet reprogrammed the local
+		 * timer device to avoid a ping-pong race. See
+		 * ___tick_broadcast_oneshot_control().
+		 *
+		 * If the broadcast device is hrtimer based then
+		 * programming the broadcast event below does not have any
+		 * effect because the local clockevent device is not
+		 * running and not programmed because the broadcast event
+		 * is not earlier than the pending event of the local clock
+		 * event device. As a consequence all CPUs waiting for a
+		 * broadcast event are stuck forever.
+		 *
+		 * Detect this condition and reprogram the cpu local timer
+		 * device to avoid the starvation.
+		 */
+		if (tick_check_broadcast_expired()) {
+			struct tick_device *td = this_cpu_ptr(&tick_cpu_device);
+
+			cpumask_clear_cpu(smp_processor_id(), tick_broadcast_force_mask);
+			tick_program_event(td->evtdev->next_event, 1);
+		}
+
 		/* This moves the broadcast assignment to this CPU: */
 		clockevents_program_event(bc, bc->next_event, 1);
 	}
--- linux-qcom-6.8.0.orig/kernel/time/tick-common.c
+++ linux-qcom-6.8.0/kernel/time/tick-common.c
@@ -179,26 +179,6 @@
 	}
 }
 
-#ifdef CONFIG_NO_HZ_FULL
-static void giveup_do_timer(void *info)
-{
-	int cpu = *(unsigned int *)info;
-
-	WARN_ON(tick_do_timer_cpu != smp_processor_id());
-
-	tick_do_timer_cpu = cpu;
-}
-
-static void tick_take_do_timer_from_boot(void)
-{
-	int cpu = smp_processor_id();
-	int from = tick_do_timer_boot_cpu;
-
-	if (from >= 0 && from != cpu)
-		smp_call_function_single(from, giveup_do_timer, &cpu, 1);
-}
-#endif
-
 /*
  * Setup the tick device
  */
@@ -222,19 +202,25 @@
 			tick_next_period = ktime_get();
 #ifdef CONFIG_NO_HZ_FULL
 			/*
-			 * The boot CPU may be nohz_full, in which case set
-			 * tick_do_timer_boot_cpu so the first housekeeping
-			 * secondary that comes up will take do_timer from
-			 * us.
+			 * The boot CPU may be nohz_full, in which case the
+			 * first housekeeping secondary will take do_timer()
+			 * from it.
 			 */
 			if (tick_nohz_full_cpu(cpu))
 				tick_do_timer_boot_cpu = cpu;
 
-		} else if (tick_do_timer_boot_cpu != -1 &&
-						!tick_nohz_full_cpu(cpu)) {
-			tick_take_do_timer_from_boot();
+		} else if (tick_do_timer_boot_cpu != -1 && !tick_nohz_full_cpu(cpu)) {
 			tick_do_timer_boot_cpu = -1;
-			WARN_ON(tick_do_timer_cpu != cpu);
+			/*
+			 * The boot CPU will stay in periodic (NOHZ disabled)
+			 * mode until clocksource_done_booting() called after
+			 * smp_init() selects a high resolution clocksource and
+			 * timekeeping_notify() kicks the NOHZ stuff alive.
+			 *
+			 * So this WRITE_ONCE can only race with the READ_ONCE
+			 * check in tick_periodic() but this race is harmless.
+			 */
+			WRITE_ONCE(tick_do_timer_cpu, cpu);
 #endif
 		}
 
--- linux-qcom-6.8.0.orig/kernel/time/tick-sched.h
+++ linux-qcom-6.8.0/kernel/time/tick-sched.h
@@ -61,7 +61,6 @@
 	unsigned int			tick_stopped	: 1;
 	unsigned int			idle_active	: 1;
 	unsigned int			do_timer_last	: 1;
-	unsigned int			got_idle_tick	: 1;
 
 	/* Tick handling: jiffies stall check */
 	unsigned int			stalled_jiffies;
@@ -73,6 +72,7 @@
 	ktime_t				next_tick;
 	unsigned long			idle_jiffies;
 	ktime_t				idle_waketime;
+	unsigned int			got_idle_tick;
 
 	/* Idle entry */
 	seqcount_t			idle_sleeptime_seq;
--- linux-qcom-6.8.0.orig/kernel/time/time.c
+++ linux-qcom-6.8.0/kernel/time/time.c
@@ -556,9 +556,9 @@
  * - all other values are converted to jiffies by either multiplying
  *   the input value by a factor or dividing it with a factor and
  *   handling any 32-bit overflows.
- *   for the details see __msecs_to_jiffies()
+ *   for the details see _msecs_to_jiffies()
  *
- * __msecs_to_jiffies() checks for the passed in value being a constant
+ * msecs_to_jiffies() checks for the passed in value being a constant
  * via __builtin_constant_p() allowing gcc to eliminate most of the
  * code, __msecs_to_jiffies() is called if the value passed does not
  * allow constant folding and the actual conversion must be done at
--- linux-qcom-6.8.0.orig/kernel/time/time_test.c
+++ linux-qcom-6.8.0/kernel/time/time_test.c
@@ -73,7 +73,7 @@
 
 		days = div_s64(secs, 86400);
 
-		#define FAIL_MSG "%05ld/%02d/%02d (%2d) : %ld", \
+		#define FAIL_MSG "%05ld/%02d/%02d (%2d) : %lld", \
 			year, month, mdday, yday, days
 
 		KUNIT_ASSERT_EQ_MSG(test, year - 1900, result.tm_year, FAIL_MSG);
--- linux-qcom-6.8.0.orig/kernel/time/timekeeping.c
+++ linux-qcom-6.8.0/kernel/time/timekeeping.c
@@ -1180,13 +1180,15 @@
 }
 
 /*
- * cycle_between - true if test occurs chronologically between before and after
+ * timestamp_in_interval - true if ts is chronologically in [start, end]
+ *
+ * True if ts occurs chronologically at or after start, and before or at end.
  */
-static bool cycle_between(u64 before, u64 test, u64 after)
+static bool timestamp_in_interval(u64 start, u64 end, u64 ts)
 {
-	if (test > before && test < after)
+	if (ts >= start && ts <= end)
 		return true;
-	if (test < before && before > after)
+	if (start > end && (ts >= start || ts <= end))
 		return true;
 	return false;
 }
@@ -1246,7 +1248,7 @@
 		 */
 		now = tk_clock_read(&tk->tkr_mono);
 		interval_start = tk->tkr_mono.cycle_last;
-		if (!cycle_between(interval_start, cycles, now)) {
+		if (!timestamp_in_interval(interval_start, now, cycles)) {
 			clock_was_set_seq = tk->clock_was_set_seq;
 			cs_was_changed_seq = tk->cs_was_changed_seq;
 			cycles = interval_start;
@@ -1259,10 +1261,8 @@
 				      tk_core.timekeeper.offs_real);
 		base_raw = tk->tkr_raw.base;
 
-		nsec_real = timekeeping_cycles_to_ns(&tk->tkr_mono,
-						     system_counterval.cycles);
-		nsec_raw = timekeeping_cycles_to_ns(&tk->tkr_raw,
-						    system_counterval.cycles);
+		nsec_real = timekeeping_cycles_to_ns(&tk->tkr_mono, cycles);
+		nsec_raw = timekeeping_cycles_to_ns(&tk->tkr_raw, cycles);
 	} while (read_seqcount_retry(&tk_core.seq, seq));
 
 	xtstamp->sys_realtime = ktime_add_ns(base_real, nsec_real);
@@ -1277,13 +1277,13 @@
 		bool discontinuity;
 
 		/*
-		 * Check that the counter value occurs after the provided
+		 * Check that the counter value is not before the provided
 		 * history reference and that the history doesn't cross a
 		 * clocksource change
 		 */
 		if (!history_begin ||
-		    !cycle_between(history_begin->cycles,
-				   system_counterval.cycles, cycles) ||
+		    !timestamp_in_interval(history_begin->cycles,
+					   cycles, system_counterval.cycles) ||
 		    history_begin->cs_was_changed_seq != cs_was_changed_seq)
 			return -EINVAL;
 		partial_history_cycles = cycles - system_counterval.cycles;
@@ -2476,7 +2476,7 @@
 		clock_set |= timekeeping_advance(TK_ADV_FREQ);
 
 	if (clock_set)
-		clock_was_set(CLOCK_REALTIME);
+		clock_was_set(CLOCK_SET_WALL);
 
 	ntp_notify_cmos_timer();
 
--- linux-qcom-6.8.0.orig/kernel/trace/Kconfig
+++ linux-qcom-6.8.0/kernel/trace/Kconfig
@@ -1123,7 +1123,7 @@
 
 config SYNTH_EVENT_GEN_TEST
 	tristate "Test module for in-kernel synthetic event generation"
-	depends on SYNTH_EVENTS
+	depends on SYNTH_EVENTS && m
 	help
           This option creates a test module to check the base
           functionality of in-kernel synthetic event definition and
@@ -1136,7 +1136,7 @@
 
 config KPROBE_EVENT_GEN_TEST
 	tristate "Test module for in-kernel kprobe event generation"
-	depends on KPROBE_EVENTS
+	depends on KPROBE_EVENTS && m
 	help
           This option creates a test module to check the base
           functionality of in-kernel kprobe event definition.
--- linux-qcom-6.8.0.orig/kernel/trace/bpf_trace.c
+++ linux-qcom-6.8.0/kernel/trace/bpf_trace.c
@@ -1224,7 +1224,8 @@
 	.ret_type	= RET_INTEGER,
 	.arg1_type	= ARG_PTR_TO_CTX,
 	.arg2_type	= ARG_ANYTHING,
-	.arg3_type	= ARG_PTR_TO_LONG,
+	.arg3_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,
+	.arg3_size	= sizeof(u64),
 };
 
 BPF_CALL_2(get_func_ret, void *, ctx, u64 *, value)
@@ -1240,7 +1241,8 @@
 	.func		= get_func_ret,
 	.ret_type	= RET_INTEGER,
 	.arg1_type	= ARG_PTR_TO_CTX,
-	.arg2_type	= ARG_PTR_TO_LONG,
+	.arg2_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,
+	.arg2_size	= sizeof(u64),
 };
 
 BPF_CALL_1(get_func_arg_cnt, void *, ctx)
@@ -2286,9 +2288,10 @@
 		goto unlock;
 
 	old_array = bpf_event_rcu_dereference(event->tp_event->prog_array);
+	if (!old_array)
+		goto put;
+
 	ret = bpf_prog_array_copy(old_array, event->prog, NULL, 0, &new_array);
-	if (ret == -ENOENT)
-		goto unlock;
 	if (ret < 0) {
 		bpf_prog_array_delete_safe(old_array, event->prog);
 	} else {
@@ -2296,6 +2299,14 @@
 		bpf_prog_array_free_sleepable(old_array);
 	}
 
+put:
+	/*
+	 * It could be that the bpf_prog is not sleepable (and will be freed
+	 * via normal RCU), but is called from a point that supports sleepable
+	 * programs and uses tasks-trace-RCU.
+	 */
+	synchronize_rcu_tasks_trace();
+
 	bpf_prog_put(event->prog);
 	event->prog = NULL;
 
@@ -2713,7 +2724,7 @@
 
 static const struct bpf_link_ops bpf_kprobe_multi_link_lops = {
 	.release = bpf_kprobe_multi_link_release,
-	.dealloc = bpf_kprobe_multi_link_dealloc,
+	.dealloc_deferred = bpf_kprobe_multi_link_dealloc,
 	.fill_link_info = bpf_kprobe_multi_link_fill_link_info,
 };
 
@@ -3142,6 +3153,9 @@
 
 	umulti_link = container_of(link, struct bpf_uprobe_multi_link, link);
 	bpf_uprobe_unregister(&umulti_link->path, umulti_link->uprobes, umulti_link->cnt);
+	if (umulti_link->task)
+		put_task_struct(umulti_link->task);
+	path_put(&umulti_link->path);
 }
 
 static void bpf_uprobe_multi_link_dealloc(struct bpf_link *link)
@@ -3149,9 +3163,6 @@
 	struct bpf_uprobe_multi_link *umulti_link;
 
 	umulti_link = container_of(link, struct bpf_uprobe_multi_link, link);
-	if (umulti_link->task)
-		put_task_struct(umulti_link->task);
-	path_put(&umulti_link->path);
 	kvfree(umulti_link->uprobes);
 	kfree(umulti_link);
 }
@@ -3167,7 +3178,8 @@
 	struct bpf_uprobe_multi_link *umulti_link;
 	u32 ucount = info->uprobe_multi.count;
 	int err = 0, i;
-	long left;
+	char *p, *buf;
+	long left = 0;
 
 	if (!upath ^ !upath_size)
 		return -EINVAL;
@@ -3181,26 +3193,23 @@
 	info->uprobe_multi.pid = umulti_link->task ?
 				 task_pid_nr_ns(umulti_link->task, task_active_pid_ns(current)) : 0;
 
-	if (upath) {
-		char *p, *buf;
-
-		upath_size = min_t(u32, upath_size, PATH_MAX);
-
-		buf = kmalloc(upath_size, GFP_KERNEL);
-		if (!buf)
-			return -ENOMEM;
-		p = d_path(&umulti_link->path, buf, upath_size);
-		if (IS_ERR(p)) {
-			kfree(buf);
-			return PTR_ERR(p);
-		}
-		upath_size = buf + upath_size - p;
-		left = copy_to_user(upath, p, upath_size);
+	upath_size = upath_size ? min_t(u32, upath_size, PATH_MAX) : PATH_MAX;
+	buf = kmalloc(upath_size, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	p = d_path(&umulti_link->path, buf, upath_size);
+	if (IS_ERR(p)) {
 		kfree(buf);
-		if (left)
-			return -EFAULT;
-		info->uprobe_multi.path_size = upath_size;
+		return PTR_ERR(p);
 	}
+	upath_size = buf + upath_size - p;
+
+	if (upath)
+		left = copy_to_user(upath, p, upath_size);
+	kfree(buf);
+	if (left)
+		return -EFAULT;
+	info->uprobe_multi.path_size = upath_size;
 
 	if (!uoffsets && !ucookies && !uref_ctr_offsets)
 		return 0;
@@ -3227,7 +3236,7 @@
 
 static const struct bpf_link_ops bpf_uprobe_multi_link_lops = {
 	.release = bpf_uprobe_multi_link_release,
-	.dealloc = bpf_uprobe_multi_link_dealloc,
+	.dealloc_deferred = bpf_uprobe_multi_link_dealloc,
 	.fill_link_info = bpf_uprobe_multi_link_fill_link_info,
 };
 
@@ -3243,9 +3252,8 @@
 	struct bpf_prog *prog = link->link.prog;
 	bool sleepable = prog->aux->sleepable;
 	struct bpf_run_ctx *old_run_ctx;
-	int err = 0;
 
-	if (link->task && current != link->task)
+	if (link->task && current->mm != link->task->mm)
 		return 0;
 
 	if (sleepable)
@@ -3256,7 +3264,7 @@
 	migrate_disable();
 
 	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
-	err = bpf_prog_run(link->link.prog, regs);
+	bpf_prog_run(link->link.prog, regs);
 	bpf_reset_run_ctx(old_run_ctx);
 
 	migrate_enable();
@@ -3265,7 +3273,7 @@
 		rcu_read_unlock_trace();
 	else
 		rcu_read_unlock();
-	return err;
+	return 0;
 }
 
 static bool
@@ -3346,8 +3354,9 @@
 	upath = u64_to_user_ptr(attr->link_create.uprobe_multi.path);
 	uoffsets = u64_to_user_ptr(attr->link_create.uprobe_multi.offsets);
 	cnt = attr->link_create.uprobe_multi.cnt;
+	pid = attr->link_create.uprobe_multi.pid;
 
-	if (!upath || !uoffsets || !cnt)
+	if (!upath || !uoffsets || !cnt || pid < 0)
 		return -EINVAL;
 	if (cnt > MAX_UPROBE_MULTI_CNT)
 		return -E2BIG;
@@ -3371,10 +3380,9 @@
 		goto error_path_put;
 	}
 
-	pid = attr->link_create.uprobe_multi.pid;
 	if (pid) {
 		rcu_read_lock();
-		task = get_pid_task(find_vpid(pid), PIDTYPE_PID);
+		task = get_pid_task(find_vpid(pid), PIDTYPE_TGID);
 		rcu_read_unlock();
 		if (!task) {
 			err = -ESRCH;
@@ -3434,17 +3442,20 @@
 					     uprobes[i].ref_ctr_offset,
 					     &uprobes[i].consumer);
 		if (err) {
-			bpf_uprobe_unregister(&path, uprobes, i);
-			goto error_free;
+			link->cnt = i;
+			goto error_unregister;
 		}
 	}
 
 	err = bpf_link_prime(&link->link, &link_primer);
 	if (err)
-		goto error_free;
+		goto error_unregister;
 
 	return bpf_link_settle(&link_primer);
 
+error_unregister:
+	bpf_uprobe_unregister(&path, uprobes, link->cnt);
+
 error_free:
 	kvfree(uprobes);
 	kfree(link);
--- linux-qcom-6.8.0.orig/kernel/trace/fgraph.c
+++ linux-qcom-6.8.0/kernel/trace/fgraph.c
@@ -630,25 +630,43 @@
 	return ret;
 }
 
+/* The cpu_boot init_task->ret_stack will never be freed */
+static int fgraph_cpu_init(unsigned int cpu)
+{
+	if (!idle_task(cpu)->ret_stack)
+		ftrace_graph_init_idle_task(idle_task(cpu), cpu);
+	return 0;
+}
+
 int register_ftrace_graph(struct fgraph_ops *gops)
 {
+	static bool fgraph_initialized;
 	int ret = 0;
 
-	mutex_lock(&ftrace_lock);
+	guard(mutex)(&ftrace_lock);
 
-	/* we currently allow only one tracer registered at a time */
-	if (ftrace_graph_active) {
-		ret = -EBUSY;
-		goto out;
+	if (!fgraph_initialized) {
+		ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "fgraph:online",
+					fgraph_cpu_init, NULL);
+		if (ret < 0) {
+			pr_warn("fgraph: Error to init cpu hotplug support\n");
+			return ret;
+		}
+		fgraph_initialized = true;
+		ret = 0;
 	}
 
+	/* we currently allow only one tracer registered at a time */
+	if (ftrace_graph_active)
+		return -EBUSY;
+
 	register_pm_notifier(&ftrace_suspend_notifier);
 
 	ftrace_graph_active++;
 	ret = start_graph_tracing();
 	if (ret) {
 		ftrace_graph_active--;
-		goto out;
+		return ret;
 	}
 
 	ftrace_graph_return = gops->retfunc;
@@ -664,8 +682,6 @@
 	update_function_graph_func();
 
 	ret = ftrace_startup(&graph_ops, FTRACE_START_FUNC_RET);
-out:
-	mutex_unlock(&ftrace_lock);
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/kernel/trace/ftrace.c
+++ linux-qcom-6.8.0/kernel/trace/ftrace.c
@@ -1595,12 +1595,15 @@
 unsigned long ftrace_location_range(unsigned long start, unsigned long end)
 {
 	struct dyn_ftrace *rec;
+	unsigned long ip = 0;
 
+	rcu_read_lock();
 	rec = lookup_rec(start, end);
 	if (rec)
-		return rec->ip;
+		ip = rec->ip;
+	rcu_read_unlock();
 
-	return 0;
+	return ip;
 }
 
 /**
@@ -1613,25 +1616,22 @@
  */
 unsigned long ftrace_location(unsigned long ip)
 {
-	struct dyn_ftrace *rec;
+	unsigned long loc;
 	unsigned long offset;
 	unsigned long size;
 
-	rec = lookup_rec(ip, ip);
-	if (!rec) {
+	loc = ftrace_location_range(ip, ip);
+	if (!loc) {
 		if (!kallsyms_lookup_size_offset(ip, &size, &offset))
 			goto out;
 
 		/* map sym+0 to __fentry__ */
 		if (!offset)
-			rec = lookup_rec(ip, ip + size - 1);
+			loc = ftrace_location_range(ip, ip + size - 1);
 	}
 
-	if (rec)
-		return rec->ip;
-
 out:
-	return 0;
+	return loc;
 }
 
 /**
@@ -4562,6 +4562,9 @@
 	char *func;
 	int ret;
 
+	if (!tr)
+		return -ENODEV;
+
 	/* match_records() modifies func, and we need the original */
 	func = kstrdup(func_orig, GFP_KERNEL);
 	if (!func)
@@ -6593,6 +6596,8 @@
 	/* We should have used all pages unless we skipped some */
 	if (pg_unuse) {
 		WARN_ON(!skipped);
+		/* Need to synchronize with ftrace_location_range() */
+		synchronize_rcu();
 		ftrace_free_pages(pg_unuse);
 	}
 	return ret;
@@ -6806,6 +6811,9 @@
  out_unlock:
 	mutex_unlock(&ftrace_lock);
 
+	/* Need to synchronize with ftrace_location_range() */
+	if (tmp_page)
+		synchronize_rcu();
 	for (pg = tmp_page; pg; pg = tmp_page) {
 
 		/* Needs to be called outside of ftrace_lock */
@@ -6967,7 +6975,7 @@
 	return mod_map;
 }
 
-static const char *
+static int
 ftrace_func_address_lookup(struct ftrace_mod_map *mod_map,
 			   unsigned long addr, unsigned long *size,
 			   unsigned long *off, char *sym)
@@ -6988,21 +6996,18 @@
 			*size = found_func->size;
 		if (off)
 			*off = addr - found_func->ip;
-		if (sym)
-			strscpy(sym, found_func->name, KSYM_NAME_LEN);
-
-		return found_func->name;
+		return strscpy(sym, found_func->name, KSYM_NAME_LEN);
 	}
 
-	return NULL;
+	return 0;
 }
 
-const char *
+int
 ftrace_mod_address_lookup(unsigned long addr, unsigned long *size,
 		   unsigned long *off, char **modname, char *sym)
 {
 	struct ftrace_mod_map *mod_map;
-	const char *ret = NULL;
+	int ret = 0;
 
 	/* mod_map is freed via call_rcu() */
 	preempt_disable();
@@ -7139,6 +7144,7 @@
 	unsigned long start = (unsigned long)(start_ptr);
 	unsigned long end = (unsigned long)(end_ptr);
 	struct ftrace_page **last_pg = &ftrace_pages_start;
+	struct ftrace_page *tmp_page = NULL;
 	struct ftrace_page *pg;
 	struct dyn_ftrace *rec;
 	struct dyn_ftrace key;
@@ -7180,12 +7186,8 @@
 		ftrace_update_tot_cnt--;
 		if (!pg->index) {
 			*last_pg = pg->next;
-			if (pg->records) {
-				free_pages((unsigned long)pg->records, pg->order);
-				ftrace_number_of_pages -= 1 << pg->order;
-			}
-			ftrace_number_of_groups--;
-			kfree(pg);
+			pg->next = tmp_page;
+			tmp_page = pg;
 			pg = container_of(last_pg, struct ftrace_page, next);
 			if (!(*last_pg))
 				ftrace_pages = pg;
@@ -7202,6 +7204,11 @@
 		clear_func_from_hashes(func);
 		kfree(func);
 	}
+	/* Need to synchronize with ftrace_location_range() */
+	if (tmp_page) {
+		synchronize_rcu();
+		ftrace_free_pages(tmp_page);
+	}
 }
 
 void __init ftrace_free_init_mem(void)
@@ -7892,6 +7899,7 @@
 	ftrace_disabled = 1;
 	ftrace_enabled = 0;
 	ftrace_trace_function = ftrace_stub;
+	kprobe_ftrace_kill();
 }
 
 /**
--- linux-qcom-6.8.0.orig/kernel/trace/pid_list.c
+++ linux-qcom-6.8.0/kernel/trace/pid_list.c
@@ -354,7 +354,7 @@
 	while (upper_count-- > 0) {
 		union upper_chunk *chunk;
 
-		chunk = kzalloc(sizeof(*chunk), GFP_KERNEL);
+		chunk = kzalloc(sizeof(*chunk), GFP_NOWAIT);
 		if (!chunk)
 			break;
 		*upper_next = chunk;
@@ -365,7 +365,7 @@
 	while (lower_count-- > 0) {
 		union lower_chunk *chunk;
 
-		chunk = kzalloc(sizeof(*chunk), GFP_KERNEL);
+		chunk = kzalloc(sizeof(*chunk), GFP_NOWAIT);
 		if (!chunk)
 			break;
 		*lower_next = chunk;
--- linux-qcom-6.8.0.orig/kernel/trace/preemptirq_delay_test.c
+++ linux-qcom-6.8.0/kernel/trace/preemptirq_delay_test.c
@@ -215,4 +215,5 @@
 
 module_init(preemptirq_delay_init)
 module_exit(preemptirq_delay_exit)
+MODULE_DESCRIPTION("Preempt / IRQ disable delay thread to test latency tracers");
 MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/kernel/trace/ring_buffer.c
+++ linux-qcom-6.8.0/kernel/trace/ring_buffer.c
@@ -384,6 +384,7 @@
 	struct irq_work			work;
 	wait_queue_head_t		waiters;
 	wait_queue_head_t		full_waiters;
+	atomic_t			seq;
 	bool				waiters_pending;
 	bool				full_waiters_pending;
 	bool				wakeup_full;
@@ -456,6 +457,8 @@
 	unsigned long			nr_pages;
 	unsigned int			current_context;
 	struct list_head		*pages;
+	/* pages generation counter, incremented when the list changes */
+	unsigned long			cnt;
 	struct buffer_page		*head_page;	/* read from head */
 	struct buffer_page		*tail_page;	/* write to tail */
 	struct buffer_page		*commit_page;	/* committed pages */
@@ -753,6 +756,9 @@
 {
 	struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work);
 
+	/* For waiters waiting for the first wake up */
+	(void)atomic_fetch_inc_release(&rbwork->seq);
+
 	wake_up_all(&rbwork->waiters);
 	if (rbwork->full_waiters_pending || rbwork->wakeup_full) {
 		/* Only cpu_buffer sets the above flags */
@@ -834,29 +840,89 @@
 		pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page;
 		ret = !pagebusy && full_hit(buffer, cpu, full);
 
-		if (!cpu_buffer->shortest_full ||
-		    cpu_buffer->shortest_full > full)
-			cpu_buffer->shortest_full = full;
+		if (!ret && (!cpu_buffer->shortest_full ||
+			     cpu_buffer->shortest_full > full)) {
+		    cpu_buffer->shortest_full = full;
+		}
 		raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
 	}
 	return ret;
 }
 
+static inline bool
+rb_wait_cond(struct rb_irq_work *rbwork, struct trace_buffer *buffer,
+	     int cpu, int full, ring_buffer_cond_fn cond, void *data)
+{
+	if (rb_watermark_hit(buffer, cpu, full))
+		return true;
+
+	if (cond(data))
+		return true;
+
+	/*
+	 * The events can happen in critical sections where
+	 * checking a work queue can cause deadlocks.
+	 * After adding a task to the queue, this flag is set
+	 * only to notify events to try to wake up the queue
+	 * using irq_work.
+	 *
+	 * We don't clear it even if the buffer is no longer
+	 * empty. The flag only causes the next event to run
+	 * irq_work to do the work queue wake up. The worse
+	 * that can happen if we race with !trace_empty() is that
+	 * an event will cause an irq_work to try to wake up
+	 * an empty queue.
+	 *
+	 * There's no reason to protect this flag either, as
+	 * the work queue and irq_work logic will do the necessary
+	 * synchronization for the wake ups. The only thing
+	 * that is necessary is that the wake up happens after
+	 * a task has been queued. It's OK for spurious wake ups.
+	 */
+	if (full)
+		rbwork->full_waiters_pending = true;
+	else
+		rbwork->waiters_pending = true;
+
+	return false;
+}
+
+struct rb_wait_data {
+	struct rb_irq_work		*irq_work;
+	int				seq;
+};
+
+/*
+ * The default wait condition for ring_buffer_wait() is to just to exit the
+ * wait loop the first time it is woken up.
+ */
+static bool rb_wait_once(void *data)
+{
+	struct rb_wait_data *rdata = data;
+	struct rb_irq_work *rbwork = rdata->irq_work;
+
+	return atomic_read_acquire(&rbwork->seq) != rdata->seq;
+}
+
 /**
  * ring_buffer_wait - wait for input to the ring buffer
  * @buffer: buffer to wait on
  * @cpu: the cpu buffer to wait on
  * @full: wait until the percentage of pages are available, if @cpu != RING_BUFFER_ALL_CPUS
+ * @cond: condition function to break out of wait (NULL to run once)
+ * @data: the data to pass to @cond.
  *
  * If @cpu == RING_BUFFER_ALL_CPUS then the task will wake up as soon
  * as data is added to any of the @buffer's cpu buffers. Otherwise
  * it will wait for data to be added to a specific cpu buffer.
  */
-int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full)
+int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full,
+		     ring_buffer_cond_fn cond, void *data)
 {
 	struct ring_buffer_per_cpu *cpu_buffer;
-	DEFINE_WAIT(wait);
-	struct rb_irq_work *work;
+	struct wait_queue_head *waitq;
+	struct rb_irq_work *rbwork;
+	struct rb_wait_data rdata;
 	int ret = 0;
 
 	/*
@@ -865,63 +931,31 @@
 	 * caller on the appropriate wait queue.
 	 */
 	if (cpu == RING_BUFFER_ALL_CPUS) {
-		work = &buffer->irq_work;
+		rbwork = &buffer->irq_work;
 		/* Full only makes sense on per cpu reads */
 		full = 0;
 	} else {
 		if (!cpumask_test_cpu(cpu, buffer->cpumask))
 			return -ENODEV;
 		cpu_buffer = buffer->buffers[cpu];
-		work = &cpu_buffer->irq_work;
+		rbwork = &cpu_buffer->irq_work;
 	}
 
 	if (full)
-		prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE);
-	else
-		prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
-
-	/*
-	 * The events can happen in critical sections where
-	 * checking a work queue can cause deadlocks.
-	 * After adding a task to the queue, this flag is set
-	 * only to notify events to try to wake up the queue
-	 * using irq_work.
-	 *
-	 * We don't clear it even if the buffer is no longer
-	 * empty. The flag only causes the next event to run
-	 * irq_work to do the work queue wake up. The worse
-	 * that can happen if we race with !trace_empty() is that
-	 * an event will cause an irq_work to try to wake up
-	 * an empty queue.
-	 *
-	 * There's no reason to protect this flag either, as
-	 * the work queue and irq_work logic will do the necessary
-	 * synchronization for the wake ups. The only thing
-	 * that is necessary is that the wake up happens after
-	 * a task has been queued. It's OK for spurious wake ups.
-	 */
-	if (full)
-		work->full_waiters_pending = true;
+		waitq = &rbwork->full_waiters;
 	else
-		work->waiters_pending = true;
+		waitq = &rbwork->waiters;
 
-	if (rb_watermark_hit(buffer, cpu, full))
-		goto out;
-
-	if (signal_pending(current)) {
-		ret = -EINTR;
-		goto out;
+	/* Set up to exit loop as soon as it is woken */
+	if (!cond) {
+		cond = rb_wait_once;
+		rdata.irq_work = rbwork;
+		rdata.seq = atomic_read_acquire(&rbwork->seq);
+		data = &rdata;
 	}
 
-	schedule();
- out:
-	if (full)
-		finish_wait(&work->full_waiters, &wait);
-	else
-		finish_wait(&work->waiters, &wait);
-
-	if (!ret && !rb_watermark_hit(buffer, cpu, full) && signal_pending(current))
-		ret = -EINTR;
+	ret = wait_event_interruptible((*waitq),
+				rb_wait_cond(rbwork, buffer, cpu, full, cond, data));
 
 	return ret;
 }
@@ -964,16 +998,32 @@
 		poll_wait(filp, &rbwork->full_waiters, poll_table);
 
 		raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
-		rbwork->full_waiters_pending = true;
 		if (!cpu_buffer->shortest_full ||
 		    cpu_buffer->shortest_full > full)
 			cpu_buffer->shortest_full = full;
 		raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
-	} else {
-		poll_wait(filp, &rbwork->waiters, poll_table);
-		rbwork->waiters_pending = true;
+		if (full_hit(buffer, cpu, full))
+			return EPOLLIN | EPOLLRDNORM;
+		/*
+		 * Only allow full_waiters_pending update to be seen after
+		 * the shortest_full is set. If the writer sees the
+		 * full_waiters_pending flag set, it will compare the
+		 * amount in the ring buffer to shortest_full. If the amount
+		 * in the ring buffer is greater than the shortest_full
+		 * percent, it will call the irq_work handler to wake up
+		 * this list. The irq_handler will reset shortest_full
+		 * back to zero. That's done under the reader_lock, but
+		 * the below smp_mb() makes sure that the update to
+		 * full_waiters_pending doesn't leak up into the above.
+		 */
+		smp_mb();
+		rbwork->full_waiters_pending = true;
+		return 0;
 	}
 
+	poll_wait(filp, &rbwork->waiters, poll_table);
+	rbwork->waiters_pending = true;
+
 	/*
 	 * There's a tight race between setting the waiters_pending and
 	 * checking if the ring buffer is empty.  Once the waiters_pending bit
@@ -989,9 +1039,6 @@
 	 */
 	smp_mb();
 
-	if (full)
-		return full_hit(buffer, cpu, full) ? EPOLLIN | EPOLLRDNORM : 0;
-
 	if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) ||
 	    (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu)))
 		return EPOLLIN | EPOLLRDNORM;
@@ -1355,7 +1402,6 @@
 	old_write = local_add_return(RB_WRITE_INTCNT, &next_page->write);
 	old_entries = local_add_return(RB_WRITE_INTCNT, &next_page->entries);
 
-	local_inc(&cpu_buffer->pages_touched);
 	/*
 	 * Just make sure we have seen our old_write and synchronize
 	 * with any interrupts that come in.
@@ -1392,8 +1438,9 @@
 		 */
 		local_set(&next_page->page->commit, 0);
 
-		/* Again, either we update tail_page or an interrupt does */
-		(void)cmpxchg(&cpu_buffer->tail_page, tail_page, next_page);
+		/* Either we update tail_page or an interrupt does */
+		if (try_cmpxchg(&cpu_buffer->tail_page, &tail_page, next_page))
+			local_inc(&cpu_buffer->pages_touched);
 	}
 }
 
@@ -1405,6 +1452,20 @@
 	RB_WARN_ON(cpu_buffer, val & RB_FLAG_MASK);
 }
 
+static bool rb_check_links(struct ring_buffer_per_cpu *cpu_buffer,
+			   struct list_head *list)
+{
+	if (RB_WARN_ON(cpu_buffer,
+		       rb_list_head(rb_list_head(list->next)->prev) != list))
+		return false;
+
+	if (RB_WARN_ON(cpu_buffer,
+		       rb_list_head(rb_list_head(list->prev)->next) != list))
+		return false;
+
+	return true;
+}
+
 /**
  * rb_check_pages - integrity check of buffer pages
  * @cpu_buffer: CPU buffer with pages to test
@@ -1414,26 +1475,64 @@
  */
 static void rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer)
 {
-	struct list_head *head = rb_list_head(cpu_buffer->pages);
-	struct list_head *tmp;
+	struct list_head *head, *tmp;
+	unsigned long buffer_cnt;
+	unsigned long flags;
+	int nr_loops = 0;
 
-	if (RB_WARN_ON(cpu_buffer,
-			rb_list_head(rb_list_head(head->next)->prev) != head))
+	/*
+	 * Walk the linked list underpinning the ring buffer and validate all
+	 * its next and prev links.
+	 *
+	 * The check acquires the reader_lock to avoid concurrent processing
+	 * with code that could be modifying the list. However, the lock cannot
+	 * be held for the entire duration of the walk, as this would make the
+	 * time when interrupts are disabled non-deterministic, dependent on the
+	 * ring buffer size. Therefore, the code releases and re-acquires the
+	 * lock after checking each page. The ring_buffer_per_cpu.cnt variable
+	 * is then used to detect if the list was modified while the lock was
+	 * not held, in which case the check needs to be restarted.
+	 *
+	 * The code attempts to perform the check at most three times before
+	 * giving up. This is acceptable because this is only a self-validation
+	 * to detect problems early on. In practice, the list modification
+	 * operations are fairly spaced, and so this check typically succeeds at
+	 * most on the second try.
+	 */
+again:
+	if (++nr_loops > 3)
 		return;
 
-	if (RB_WARN_ON(cpu_buffer,
-			rb_list_head(rb_list_head(head->prev)->next) != head))
-		return;
+	raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+	head = rb_list_head(cpu_buffer->pages);
+	if (!rb_check_links(cpu_buffer, head))
+		goto out_locked;
+	buffer_cnt = cpu_buffer->cnt;
+	tmp = head;
+	raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
 
-	for (tmp = rb_list_head(head->next); tmp != head; tmp = rb_list_head(tmp->next)) {
-		if (RB_WARN_ON(cpu_buffer,
-				rb_list_head(rb_list_head(tmp->next)->prev) != tmp))
-			return;
+	while (true) {
+		raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
 
-		if (RB_WARN_ON(cpu_buffer,
-				rb_list_head(rb_list_head(tmp->prev)->next) != tmp))
-			return;
+		if (buffer_cnt != cpu_buffer->cnt) {
+			/* The list was updated, try again. */
+			raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+			goto again;
+		}
+
+		tmp = rb_list_head(tmp->next);
+		if (tmp == head)
+			/* The iteration circled back, all is done. */
+			goto out_locked;
+
+		if (!rb_check_links(cpu_buffer, tmp))
+			goto out_locked;
+
+		raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
 	}
+
+out_locked:
+	raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
 }
 
 static int __rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer,
@@ -1819,6 +1918,7 @@
 
 	/* make sure pages points to a valid page in the ring buffer */
 	cpu_buffer->pages = next_page;
+	cpu_buffer->cnt++;
 
 	/* update head page */
 	if (head_bit)
@@ -1925,6 +2025,7 @@
 			 * pointer to point to end of list
 			 */
 			head_page->prev = last_page;
+			cpu_buffer->cnt++;
 			success = true;
 			break;
 		}
@@ -4350,7 +4451,7 @@
 	cpu_buffer = iter->cpu_buffer;
 	reader = cpu_buffer->reader_page;
 	head_page = cpu_buffer->head_page;
-	commit_page = cpu_buffer->commit_page;
+	commit_page = READ_ONCE(cpu_buffer->commit_page);
 	commit_ts = commit_page->page->time_stamp;
 
 	/*
@@ -4552,6 +4653,7 @@
 	rb_list_head(reader->list.next)->prev = &cpu_buffer->reader_page->list;
 	rb_inc_page(&cpu_buffer->head_page);
 
+	cpu_buffer->cnt++;
 	local_inc(&cpu_buffer->pages_read);
 
 	/* Finally update the reader page to the new head */
@@ -4996,13 +5098,9 @@
  * @flags: gfp flags to use for memory allocation
  *
  * This performs the initial preparations necessary to iterate
- * through the buffer.  Memory is allocated, buffer recording
+ * through the buffer.  Memory is allocated, buffer resizing
  * is disabled, and the iterator pointer is returned to the caller.
  *
- * Disabling buffer recording prevents the reading from being
- * corrupted. This is not a consuming read, so a producer is not
- * expected.
- *
  * After a sequence of ring_buffer_read_prepare calls, the user is
  * expected to make at least one call to ring_buffer_read_prepare_sync.
  * Afterwards, ring_buffer_read_start is invoked to get things going
@@ -5089,24 +5187,15 @@
  * ring_buffer_read_finish - finish reading the iterator of the buffer
  * @iter: The iterator retrieved by ring_buffer_start
  *
- * This re-enables the recording to the buffer, and frees the
- * iterator.
+ * This re-enables resizing of the buffer, and frees the iterator.
  */
 void
 ring_buffer_read_finish(struct ring_buffer_iter *iter)
 {
 	struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
-	unsigned long flags;
 
-	/*
-	 * Ring buffer is disabled from recording, here's a good place
-	 * to check the integrity of the ring buffer.
-	 * Must prevent readers from trying to read, as the check
-	 * clears the HEAD page and readers require it.
-	 */
-	raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+	/* Use this opportunity to check the integrity of the ring buffer. */
 	rb_check_pages(cpu_buffer);
-	raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
 
 	atomic_dec(&cpu_buffer->resize_disabled);
 	kfree(iter->event);
@@ -5939,39 +6028,39 @@
 	}
 
 	for_each_buffer_cpu(buffer, cpu) {
+		struct buffer_data_page *old_free_data_page;
+		struct list_head old_pages;
+		unsigned long flags;
 
 		if (!cpumask_test_cpu(cpu, buffer->cpumask))
 			continue;
 
 		cpu_buffer = buffer->buffers[cpu];
 
+		raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+
 		/* Clear the head bit to make the link list normal to read */
 		rb_head_page_deactivate(cpu_buffer);
 
-		/* Now walk the list and free all the old sub buffers */
-		list_for_each_entry_safe(bpage, tmp, cpu_buffer->pages, list) {
-			list_del_init(&bpage->list);
-			free_buffer_page(bpage);
-		}
-		/* The above loop stopped an the last page needing to be freed */
-		bpage = list_entry(cpu_buffer->pages, struct buffer_page, list);
-		free_buffer_page(bpage);
-
-		/* Free the current reader page */
-		free_buffer_page(cpu_buffer->reader_page);
+		/*
+		 * Collect buffers from the cpu_buffer pages list and the
+		 * reader_page on old_pages, so they can be freed later when not
+		 * under a spinlock. The pages list is a linked list with no
+		 * head, adding old_pages turns it into a regular list with
+		 * old_pages being the head.
+		 */
+		list_add(&old_pages, cpu_buffer->pages);
+		list_add(&cpu_buffer->reader_page->list, &old_pages);
 
 		/* One page was allocated for the reader page */
 		cpu_buffer->reader_page = list_entry(cpu_buffer->new_pages.next,
 						     struct buffer_page, list);
 		list_del_init(&cpu_buffer->reader_page->list);
 
-		/* The cpu_buffer pages are a link list with no head */
+		/* Install the new pages, remove the head from the list */
 		cpu_buffer->pages = cpu_buffer->new_pages.next;
-		cpu_buffer->new_pages.next->prev = cpu_buffer->new_pages.prev;
-		cpu_buffer->new_pages.prev->next = cpu_buffer->new_pages.next;
-
-		/* Clear the new_pages list */
-		INIT_LIST_HEAD(&cpu_buffer->new_pages);
+		list_del_init(&cpu_buffer->new_pages);
+		cpu_buffer->cnt++;
 
 		cpu_buffer->head_page
 			= list_entry(cpu_buffer->pages, struct buffer_page, list);
@@ -5980,11 +6069,20 @@
 		cpu_buffer->nr_pages = cpu_buffer->nr_pages_to_update;
 		cpu_buffer->nr_pages_to_update = 0;
 
-		free_pages((unsigned long)cpu_buffer->free_page, old_order);
+		old_free_data_page = cpu_buffer->free_page;
 		cpu_buffer->free_page = NULL;
 
 		rb_head_page_activate(cpu_buffer);
 
+		raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+
+		/* Free old sub buffers */
+		list_for_each_entry_safe(bpage, tmp, &old_pages, list) {
+			list_del_init(&bpage->list);
+			free_buffer_page(bpage);
+		}
+		free_pages((unsigned long)old_free_data_page, old_order);
+
 		rb_check_pages(cpu_buffer);
 	}
 
--- linux-qcom-6.8.0.orig/kernel/trace/rv/rv.c
+++ linux-qcom-6.8.0/kernel/trace/rv/rv.c
@@ -245,6 +245,7 @@
 
 /**
  * rv_disable_monitor - disable a given runtime monitor
+ * @mdef: Pointer to the monitor definition structure.
  *
  * Returns 0 on success.
  */
@@ -256,6 +257,7 @@
 
 /**
  * rv_enable_monitor - enable a given runtime monitor
+ * @mdef: Pointer to the monitor definition structure.
  *
  * Returns 0 on success, error otherwise.
  */
--- linux-qcom-6.8.0.orig/kernel/trace/trace.c
+++ linux-qcom-6.8.0/kernel/trace/trace.c
@@ -1955,15 +1955,36 @@
 
 #endif /* CONFIG_TRACER_MAX_TRACE */
 
+struct pipe_wait {
+	struct trace_iterator		*iter;
+	int				wait_index;
+};
+
+static bool wait_pipe_cond(void *data)
+{
+	struct pipe_wait *pwait = data;
+	struct trace_iterator *iter = pwait->iter;
+
+	if (atomic_read_acquire(&iter->wait_index) != pwait->wait_index)
+		return true;
+
+	return iter->closed;
+}
+
 static int wait_on_pipe(struct trace_iterator *iter, int full)
 {
+	struct pipe_wait pwait;
 	int ret;
 
 	/* Iterators are static, they should be filled or empty */
 	if (trace_buffer_iter(iter, iter->cpu_file))
 		return 0;
 
-	ret = ring_buffer_wait(iter->array_buffer->buffer, iter->cpu_file, full);
+	pwait.wait_index = atomic_read_acquire(&iter->wait_index);
+	pwait.iter = iter;
+
+	ret = ring_buffer_wait(iter->array_buffer->buffer, iter->cpu_file, full,
+			       wait_pipe_cond, &pwait);
 
 #ifdef CONFIG_TRACER_MAX_TRACE
 	/*
@@ -2325,6 +2346,10 @@
 };
 static struct saved_cmdlines_buffer *savedcmd;
 
+/* Holds the size of a cmdline and pid element */
+#define SAVED_CMDLINE_MAP_ELEMENT_SIZE(s)			\
+	(TASK_COMM_LEN + sizeof((s)->map_cmdline_to_pid[0]))
+
 static inline char *get_saved_cmdlines(int idx)
 {
 	return &savedcmd->saved_cmdlines[idx * TASK_COMM_LEN];
@@ -2339,7 +2364,6 @@
 {
 	int order = get_order(sizeof(*s) + s->cmdline_num * TASK_COMM_LEN);
 
-	kfree(s->map_cmdline_to_pid);
 	kmemleak_free(s);
 	free_pages((unsigned long)s, order);
 }
@@ -2352,7 +2376,7 @@
 	int order;
 
 	/* Figure out how much is needed to hold the given number of cmdlines */
-	orig_size = sizeof(*s) + val * TASK_COMM_LEN;
+	orig_size = sizeof(*s) + val * SAVED_CMDLINE_MAP_ELEMENT_SIZE(s);
 	order = get_order(orig_size);
 	size = 1 << (order + PAGE_SHIFT);
 	page = alloc_pages(GFP_KERNEL, order);
@@ -2364,16 +2388,11 @@
 	memset(s, 0, sizeof(*s));
 
 	/* Round up to actual allocation */
-	val = (size - sizeof(*s)) / TASK_COMM_LEN;
+	val = (size - sizeof(*s)) / SAVED_CMDLINE_MAP_ELEMENT_SIZE(s);
 	s->cmdline_num = val;
 
-	s->map_cmdline_to_pid = kmalloc_array(val,
-					      sizeof(*s->map_cmdline_to_pid),
-					      GFP_KERNEL);
-	if (!s->map_cmdline_to_pid) {
-		free_saved_cmdlines_buffer(s);
-		return NULL;
-	}
+	/* Place map_cmdline_to_pid array right after saved_cmdlines */
+	s->map_cmdline_to_pid = (unsigned *)&s->saved_cmdlines[val * TASK_COMM_LEN];
 
 	s->cmdline_idx = 0;
 	memset(&s->map_pid_to_cmdline, NO_CMDLINE_MAP,
@@ -3771,17 +3790,12 @@
 }
 
 /* Returns true if the string is safe to dereference from an event */
-static bool trace_safe_str(struct trace_iterator *iter, const char *str,
-			   bool star, int len)
+static bool trace_safe_str(struct trace_iterator *iter, const char *str)
 {
 	unsigned long addr = (unsigned long)str;
 	struct trace_event *trace_event;
 	struct trace_event_call *event;
 
-	/* Ignore strings with no length */
-	if (star && !len)
-		return true;
-
 	/* OK if part of the event data */
 	if ((addr >= (unsigned long)iter->ent) &&
 	    (addr < (unsigned long)iter->ent + iter->ent_size))
@@ -3821,133 +3835,69 @@
 	return false;
 }
 
-static DEFINE_STATIC_KEY_FALSE(trace_no_verify);
-
-static int test_can_verify_check(const char *fmt, ...)
-{
-	char buf[16];
-	va_list ap;
-	int ret;
-
-	/*
-	 * The verifier is dependent on vsnprintf() modifies the va_list
-	 * passed to it, where it is sent as a reference. Some architectures
-	 * (like x86_32) passes it by value, which means that vsnprintf()
-	 * does not modify the va_list passed to it, and the verifier
-	 * would then need to be able to understand all the values that
-	 * vsnprintf can use. If it is passed by value, then the verifier
-	 * is disabled.
-	 */
-	va_start(ap, fmt);
-	vsnprintf(buf, 16, "%d", ap);
-	ret = va_arg(ap, int);
-	va_end(ap);
-
-	return ret;
-}
-
-static void test_can_verify(void)
-{
-	if (!test_can_verify_check("%d %d", 0, 1)) {
-		pr_info("trace event string verifier disabled\n");
-		static_branch_inc(&trace_no_verify);
-	}
-}
-
 /**
- * trace_check_vprintf - Check dereferenced strings while writing to the seq buffer
+ * ignore_event - Check dereferenced fields while writing to the seq buffer
  * @iter: The iterator that holds the seq buffer and the event being printed
- * @fmt: The format used to print the event
- * @ap: The va_list holding the data to print from @fmt.
  *
- * This writes the data into the @iter->seq buffer using the data from
- * @fmt and @ap. If the format has a %s, then the source of the string
- * is examined to make sure it is safe to print, otherwise it will
- * warn and print "[UNSAFE MEMORY]" in place of the dereferenced string
- * pointer.
+ * At boot up, test_event_printk() will flag any event that dereferences
+ * a string with "%s" that does exist in the ring buffer. It may still
+ * be valid, as the string may point to a static string in the kernel
+ * rodata that never gets freed. But if the string pointer is pointing
+ * to something that was allocated, there's a chance that it can be freed
+ * by the time the user reads the trace. This would cause a bad memory
+ * access by the kernel and possibly crash the system.
+ *
+ * This function will check if the event has any fields flagged as needing
+ * to be checked at runtime and perform those checks.
+ *
+ * If it is found that a field is unsafe, it will write into the @iter->seq
+ * a message stating what was found to be unsafe.
+ *
+ * @return: true if the event is unsafe and should be ignored,
+ *          false otherwise.
  */
-void trace_check_vprintf(struct trace_iterator *iter, const char *fmt,
-			 va_list ap)
+bool ignore_event(struct trace_iterator *iter)
 {
-	const char *p = fmt;
-	const char *str;
-	int i, j;
-
-	if (WARN_ON_ONCE(!fmt))
-		return;
+	struct ftrace_event_field *field;
+	struct trace_event *trace_event;
+	struct trace_event_call *event;
+	struct list_head *head;
+	struct trace_seq *seq;
+	const void *ptr;
 
-	if (static_branch_unlikely(&trace_no_verify))
-		goto print;
+	trace_event = ftrace_find_event(iter->ent->type);
 
-	/* Don't bother checking when doing a ftrace_dump() */
-	if (iter->fmt == static_fmt_buf)
-		goto print;
+	seq = &iter->seq;
 
-	while (*p) {
-		bool star = false;
-		int len = 0;
+	if (!trace_event) {
+		trace_seq_printf(seq, "EVENT ID %d NOT FOUND?\n", iter->ent->type);
+		return true;
+	}
 
-		j = 0;
+	event = container_of(trace_event, struct trace_event_call, event);
+	if (!(event->flags & TRACE_EVENT_FL_TEST_STR))
+		return false;
 
-		/* We only care about %s and variants */
-		for (i = 0; p[i]; i++) {
-			if (i + 1 >= iter->fmt_size) {
-				/*
-				 * If we can't expand the copy buffer,
-				 * just print it.
-				 */
-				if (!trace_iter_expand_format(iter))
-					goto print;
-			}
+	head = trace_get_fields(event);
+	if (!head) {
+		trace_seq_printf(seq, "FIELDS FOR EVENT '%s' NOT FOUND?\n",
+				 trace_event_name(event));
+		return true;
+	}
 
-			if (p[i] == '\\' && p[i+1]) {
-				i++;
-				continue;
-			}
-			if (p[i] == '%') {
-				/* Need to test cases like %08.*s */
-				for (j = 1; p[i+j]; j++) {
-					if (isdigit(p[i+j]) ||
-					    p[i+j] == '.')
-						continue;
-					if (p[i+j] == '*') {
-						star = true;
-						continue;
-					}
-					break;
-				}
-				if (p[i+j] == 's')
-					break;
-				star = false;
-			}
-			j = 0;
-		}
-		/* If no %s found then just print normally */
-		if (!p[i])
-			break;
+	/* Offsets are from the iter->ent that points to the raw event */
+	ptr = iter->ent;
 
-		/* Copy up to the %s, and print that */
-		strncpy(iter->fmt, p, i);
-		iter->fmt[i] = '\0';
-		trace_seq_vprintf(&iter->seq, iter->fmt, ap);
+	list_for_each_entry(field, head, link) {
+		const char *str;
+		bool good;
 
-		/*
-		 * If iter->seq is full, the above call no longer guarantees
-		 * that ap is in sync with fmt processing, and further calls
-		 * to va_arg() can return wrong positional arguments.
-		 *
-		 * Ensure that ap is no longer used in this case.
-		 */
-		if (iter->seq.full) {
-			p = "";
-			break;
-		}
+		if (!field->needs_test)
+			continue;
 
-		if (star)
-			len = va_arg(ap, int);
+		str = *(const char **)(ptr + field->offset);
 
-		/* The ap now points to the string data of the %s */
-		str = va_arg(ap, const char *);
+		good = trace_safe_str(iter, str);
 
 		/*
 		 * If you hit this warning, it is likely that the
@@ -3958,45 +3908,14 @@
 		 * instead. See samples/trace_events/trace-events-sample.h
 		 * for reference.
 		 */
-		if (WARN_ONCE(!trace_safe_str(iter, str, star, len),
-			      "fmt: '%s' current_buffer: '%s'",
-			      fmt, seq_buf_str(&iter->seq.seq))) {
-			int ret;
-
-			/* Try to safely read the string */
-			if (star) {
-				if (len + 1 > iter->fmt_size)
-					len = iter->fmt_size - 1;
-				if (len < 0)
-					len = 0;
-				ret = copy_from_kernel_nofault(iter->fmt, str, len);
-				iter->fmt[len] = 0;
-				star = false;
-			} else {
-				ret = strncpy_from_kernel_nofault(iter->fmt, str,
-								  iter->fmt_size);
-			}
-			if (ret < 0)
-				trace_seq_printf(&iter->seq, "(0x%px)", str);
-			else
-				trace_seq_printf(&iter->seq, "(0x%px:%s)",
-						 str, iter->fmt);
-			str = "[UNSAFE-MEMORY]";
-			strcpy(iter->fmt, "%s");
-		} else {
-			strncpy(iter->fmt, p + i, j + 1);
-			iter->fmt[j+1] = '\0';
+		if (WARN_ONCE(!good, "event '%s' has unsafe pointer field '%s'",
+			      trace_event_name(event), field->name)) {
+			trace_seq_printf(seq, "EVENT %s: HAS UNSAFE POINTER FIELD '%s'\n",
+					 trace_event_name(event), field->name);
+			return true;
 		}
-		if (star)
-			trace_seq_printf(&iter->seq, iter->fmt, len, str);
-		else
-			trace_seq_printf(&iter->seq, iter->fmt, str);
-
-		p += i + j + 1;
 	}
- print:
-	if (*p)
-		trace_seq_vprintf(&iter->seq, p, ap);
+	return false;
 }
 
 const char *trace_event_format(struct trace_iterator *iter, const char *fmt)
@@ -4156,6 +4075,8 @@
 			break;
 		entries++;
 		ring_buffer_iter_advance(buf_iter);
+		/* This could be a big loop */
+		cond_resched();
 	}
 
 	per_cpu_ptr(iter->array_buffer->data, cpu)->skipped_entries = entries;
@@ -5331,6 +5252,9 @@
 	cpumask_var_t tracing_cpumask_new;
 	int err;
 
+	if (count == 0 || count > KMALLOC_MAX_SIZE)
+		return -EINVAL;
+
 	if (!zalloc_cpumask_var(&tracing_cpumask_new, GFP_KERNEL))
 		return -ENOMEM;
 
@@ -5757,6 +5681,7 @@
 	"\t           $stack<index>, $stack, $retval, $comm,\n"
 #endif
 	"\t           +|-[u]<offset>(<fetcharg>), \\imm-value, \\\"imm-string\"\n"
+	"\t     kernel return probes support: $retval, $arg<N>, $comm\n"
 	"\t     type: s8/16/32/64, u8/16/32/64, x8/16/32/64, char, string, symbol,\n"
 	"\t           b<bit-width>@<bit-offset>/<container-size>, ustring,\n"
 	"\t           symstr, <type>\\[<array-size>\\]\n"
@@ -8362,7 +8287,7 @@
 	trace_access_unlock(iter->cpu_file);
 
 	if (ret < 0) {
-		if (trace_empty(iter)) {
+		if (trace_empty(iter) && !iter->closed) {
 			if ((filp->f_flags & O_NONBLOCK))
 				return -EAGAIN;
 
@@ -8398,9 +8323,9 @@
 	struct ftrace_buffer_info *info = file->private_data;
 	struct trace_iterator *iter = &info->iter;
 
-	iter->wait_index++;
+	iter->closed = true;
 	/* Make sure the waiters see the new wait_index */
-	smp_wmb();
+	(void)atomic_fetch_inc_release(&iter->wait_index);
 
 	ring_buffer_wake_waiters(iter->array_buffer->buffer, iter->cpu_file);
 
@@ -8500,6 +8425,7 @@
 		.spd_release	= buffer_spd_release,
 	};
 	struct buffer_ref *ref;
+	bool woken = false;
 	int page_size;
 	int entries, i;
 	ssize_t ret = 0;
@@ -8573,17 +8499,17 @@
 
 	/* did we read anything? */
 	if (!spd.nr_pages) {
-		long wait_index;
 
 		if (ret)
 			goto out;
 
+		if (woken)
+			goto out;
+
 		ret = -EAGAIN;
 		if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK))
 			goto out;
 
-		wait_index = READ_ONCE(iter->wait_index);
-
 		ret = wait_on_pipe(iter, iter->snapshot ? 0 : iter->tr->buffer_percent);
 		if (ret)
 			goto out;
@@ -8592,10 +8518,8 @@
 		if (!tracer_tracing_is_on(iter->tr))
 			goto out;
 
-		/* Make sure we see the new wait_index */
-		smp_rmb();
-		if (wait_index != iter->wait_index)
-			goto out;
+		/* Iterate one more time to collect any new data then exit */
+		woken = true;
 
 		goto again;
 	}
@@ -8618,9 +8542,8 @@
 
 	mutex_lock(&trace_types_lock);
 
-	iter->wait_index++;
 	/* Make sure the waiters see the new wait_index */
-	smp_wmb();
+	(void)atomic_fetch_inc_release(&iter->wait_index);
 
 	ring_buffer_wake_waiters(iter->array_buffer->buffer, iter->cpu_file);
 
@@ -10689,8 +10612,6 @@
 
 	register_snapshot_cmd();
 
-	test_can_verify();
-
 	return 0;
 
 out_free_pipe_cpumask:
--- linux-qcom-6.8.0.orig/kernel/trace/trace.h
+++ linux-qcom-6.8.0/kernel/trace/trace.h
@@ -651,9 +651,8 @@
 
 bool trace_is_tracepoint_string(const char *str);
 const char *trace_event_format(struct trace_iterator *iter, const char *fmt);
-void trace_check_vprintf(struct trace_iterator *iter, const char *fmt,
-			 va_list ap) __printf(2, 0);
 char *trace_iter_expand_format(struct trace_iterator *iter);
+bool ignore_event(struct trace_iterator *iter);
 
 int trace_empty(struct trace_iterator *iter);
 
@@ -1330,7 +1329,8 @@
 	int			filter_type;
 	int			offset;
 	int			size;
-	int			is_signed;
+	unsigned int		is_signed:1;
+	unsigned int		needs_test:1;
 	int			len;
 };
 
@@ -1562,6 +1562,29 @@
 extern struct mutex event_mutex;
 extern struct list_head ftrace_events;
 
+/*
+ * When the trace_event_file is the filp->i_private pointer,
+ * it must be taken under the event_mutex lock, and then checked
+ * if the EVENT_FILE_FL_FREED flag is set. If it is, then the
+ * data pointed to by the trace_event_file can not be trusted.
+ *
+ * Use the event_file_file() to access the trace_event_file from
+ * the filp the first time under the event_mutex and check for
+ * NULL. If it is needed to be retrieved again and the event_mutex
+ * is still held, then the event_file_data() can be used and it
+ * is guaranteed to be valid.
+ */
+static inline struct trace_event_file *event_file_file(struct file *filp)
+{
+	struct trace_event_file *file;
+
+	lockdep_assert_held(&event_mutex);
+	file = READ_ONCE(file_inode(filp)->i_private);
+	if (!file || file->flags & EVENT_FILE_FL_FREED)
+		return NULL;
+	return file;
+}
+
 extern const struct file_operations event_trigger_fops;
 extern const struct file_operations event_hist_fops;
 extern const struct file_operations event_hist_debug_fops;
--- linux-qcom-6.8.0.orig/kernel/trace/trace_clock.c
+++ linux-qcom-6.8.0/kernel/trace/trace_clock.c
@@ -154,5 +154,5 @@
  */
 u64 notrace trace_clock_counter(void)
 {
-	return atomic64_add_return(1, &trace_counter);
+	return atomic64_inc_return(&trace_counter);
 }
--- linux-qcom-6.8.0.orig/kernel/trace/trace_eprobe.c
+++ linux-qcom-6.8.0/kernel/trace/trace_eprobe.c
@@ -220,7 +220,7 @@
 	if (!ep->event_system)
 		goto error;
 
-	ret = trace_probe_init(&ep->tp, this_event, group, false);
+	ret = trace_probe_init(&ep->tp, this_event, group, false, nargs);
 	if (ret < 0)
 		goto error;
 
@@ -390,8 +390,8 @@
 
 /* Note that we don't verify it, since the code does not come from user space */
 static int
-process_fetch_insn(struct fetch_insn *code, void *rec, void *dest,
-		   void *base)
+process_fetch_insn(struct fetch_insn *code, void *rec, void *edata,
+		   void *dest, void *base)
 {
 	unsigned long val;
 	int ret;
@@ -438,7 +438,7 @@
 		return;
 
 	entry = fbuffer.entry = ring_buffer_event_data(fbuffer.event);
-	store_trace_args(&entry[1], &edata->ep->tp, rec, sizeof(*entry), dsize);
+	store_trace_args(&entry[1], &edata->ep->tp, rec, NULL, sizeof(*entry), dsize);
 
 	trace_event_buffer_commit(&fbuffer);
 }
@@ -912,6 +912,11 @@
 		}
 	}
 
+	if (argc - 2 > MAX_TRACE_ARGS) {
+		ret = -E2BIG;
+		goto error;
+	}
+
 	mutex_lock(&event_mutex);
 	event_call = find_and_get_event(sys_name, sys_event);
 	ep = alloc_event_probe(group, event, event_call, argc - 2);
@@ -937,7 +942,7 @@
 
 	argc -= 2; argv += 2;
 	/* parse arguments */
-	for (i = 0; i < argc && i < MAX_TRACE_ARGS; i++) {
+	for (i = 0; i < argc; i++) {
 		trace_probe_log_set_index(i + 2);
 		ret = trace_eprobe_tp_update_arg(ep, argv, i);
 		if (ret)
@@ -958,6 +963,11 @@
 		goto error;
 	}
 	ret = dyn_event_add(&ep->devent, &ep->tp.event->call);
+	if (ret < 0) {
+		trace_probe_unregister_event_call(&ep->tp);
+		mutex_unlock(&event_mutex);
+		goto error;
+	}
 	mutex_unlock(&event_mutex);
 	return ret;
 parse_error:
--- linux-qcom-6.8.0.orig/kernel/trace/trace_event_perf.c
+++ linux-qcom-6.8.0/kernel/trace/trace_event_perf.c
@@ -352,10 +352,16 @@
 int perf_trace_add(struct perf_event *p_event, int flags)
 {
 	struct trace_event_call *tp_event = p_event->tp_event;
+	struct hw_perf_event *hwc = &p_event->hw;
 
 	if (!(flags & PERF_EF_START))
 		p_event->hw.state = PERF_HES_STOPPED;
 
+	if (is_sampling_event(p_event)) {
+		hwc->last_period = hwc->sample_period;
+		perf_swevent_set_period(p_event);
+	}
+
 	/*
 	 * If TRACE_REG_PERF_ADD returns false; no custom action was performed
 	 * and we need to take the default action of enqueueing our event on
--- linux-qcom-6.8.0.orig/kernel/trace/trace_events.c
+++ linux-qcom-6.8.0/kernel/trace/trace_events.c
@@ -82,7 +82,7 @@
 	}
 
 static struct ftrace_event_field *
-__find_event_field(struct list_head *head, char *name)
+__find_event_field(struct list_head *head, const char *name)
 {
 	struct ftrace_event_field *field;
 
@@ -114,7 +114,8 @@
 
 static int __trace_define_field(struct list_head *head, const char *type,
 				const char *name, int offset, int size,
-				int is_signed, int filter_type, int len)
+				int is_signed, int filter_type, int len,
+				int need_test)
 {
 	struct ftrace_event_field *field;
 
@@ -133,6 +134,7 @@
 	field->offset = offset;
 	field->size = size;
 	field->is_signed = is_signed;
+	field->needs_test = need_test;
 	field->len = len;
 
 	list_add(&field->link, head);
@@ -151,13 +153,13 @@
 
 	head = trace_get_fields(call);
 	return __trace_define_field(head, type, name, offset, size,
-				    is_signed, filter_type, 0);
+				    is_signed, filter_type, 0, 0);
 }
 EXPORT_SYMBOL_GPL(trace_define_field);
 
 static int trace_define_field_ext(struct trace_event_call *call, const char *type,
 		       const char *name, int offset, int size, int is_signed,
-		       int filter_type, int len)
+		       int filter_type, int len, int need_test)
 {
 	struct list_head *head;
 
@@ -166,13 +168,13 @@
 
 	head = trace_get_fields(call);
 	return __trace_define_field(head, type, name, offset, size,
-				    is_signed, filter_type, len);
+				    is_signed, filter_type, len, need_test);
 }
 
 #define __generic_field(type, item, filter_type)			\
 	ret = __trace_define_field(&ftrace_generic_fields, #type,	\
 				   #item, 0, 0, is_signed_type(type),	\
-				   filter_type, 0);			\
+				   filter_type, 0, 0);			\
 	if (ret)							\
 		return ret;
 
@@ -181,7 +183,8 @@
 				   "common_" #item,			\
 				   offsetof(typeof(ent), item),		\
 				   sizeof(ent.item),			\
-				   is_signed_type(type), FILTER_OTHER, 0);	\
+				   is_signed_type(type), FILTER_OTHER,	\
+				   0, 0);				\
 	if (ret)							\
 		return ret;
 
@@ -244,19 +247,16 @@
 	return tail->offset + tail->size;
 }
 
-/*
- * Check if the referenced field is an array and return true,
- * as arrays are OK to dereference.
- */
-static bool test_field(const char *fmt, struct trace_event_call *call)
+
+static struct trace_event_fields *find_event_field(const char *fmt,
+						   struct trace_event_call *call)
 {
 	struct trace_event_fields *field = call->class->fields_array;
-	const char *array_descriptor;
 	const char *p = fmt;
 	int len;
 
 	if (!(len = str_has_prefix(fmt, "REC->")))
-		return false;
+		return NULL;
 	fmt += len;
 	for (p = fmt; *p; p++) {
 		if (!isalnum(*p) && *p != '_')
@@ -265,16 +265,141 @@
 	len = p - fmt;
 
 	for (; field->type; field++) {
-		if (strncmp(field->name, fmt, len) ||
-		    field->name[len])
+		if (strncmp(field->name, fmt, len) || field->name[len])
 			continue;
-		array_descriptor = strchr(field->type, '[');
-		/* This is an array and is OK to dereference. */
-		return array_descriptor != NULL;
+
+		return field;
+	}
+	return NULL;
+}
+
+/*
+ * Check if the referenced field is an array and return true,
+ * as arrays are OK to dereference.
+ */
+static bool test_field(const char *fmt, struct trace_event_call *call)
+{
+	struct trace_event_fields *field;
+
+	field = find_event_field(fmt, call);
+	if (!field)
+		return false;
+
+	/* This is an array and is OK to dereference. */
+	return strchr(field->type, '[') != NULL;
+}
+
+/* Look for a string within an argument */
+static bool find_print_string(const char *arg, const char *str, const char *end)
+{
+	const char *r;
+
+	r = strstr(arg, str);
+	return r && r < end;
+}
+
+/* Return true if the argument pointer is safe */
+static bool process_pointer(const char *fmt, int len, struct trace_event_call *call)
+{
+	const char *r, *e, *a;
+
+	e = fmt + len;
+
+	/* Find the REC-> in the argument */
+	r = strstr(fmt, "REC->");
+	if (r && r < e) {
+		/*
+		 * Addresses of events on the buffer, or an array on the buffer is
+		 * OK to dereference. There's ways to fool this, but
+		 * this is to catch common mistakes, not malicious code.
+		 */
+		a = strchr(fmt, '&');
+		if ((a && (a < r)) || test_field(r, call))
+			return true;
+	} else if (find_print_string(fmt, "__get_dynamic_array(", e)) {
+		return true;
+	} else if (find_print_string(fmt, "__get_rel_dynamic_array(", e)) {
+		return true;
+	} else if (find_print_string(fmt, "__get_dynamic_array_len(", e)) {
+		return true;
+	} else if (find_print_string(fmt, "__get_rel_dynamic_array_len(", e)) {
+		return true;
+	} else if (find_print_string(fmt, "__get_sockaddr(", e)) {
+		return true;
+	} else if (find_print_string(fmt, "__get_rel_sockaddr(", e)) {
+		return true;
 	}
 	return false;
 }
 
+/* Return true if the string is safe */
+static bool process_string(const char *fmt, int len, struct trace_event_call *call)
+{
+	struct trace_event_fields *field;
+	const char *r, *e, *s;
+
+	e = fmt + len;
+
+	/*
+	 * There are several helper functions that return strings.
+	 * If the argument contains a function, then assume its field is valid.
+	 * It is considered that the argument has a function if it has:
+	 *   alphanumeric or '_' before a parenthesis.
+	 */
+	s = fmt;
+	do {
+		r = strstr(s, "(");
+		if (!r || r >= e)
+			break;
+		for (int i = 1; r - i >= s; i++) {
+			char ch = *(r - i);
+			if (isspace(ch))
+				continue;
+			if (isalnum(ch) || ch == '_')
+				return true;
+			/* Anything else, this isn't a function */
+			break;
+		}
+		/* A function could be wrapped in parethesis, try the next one */
+		s = r + 1;
+	} while (s < e);
+
+	/*
+	 * Check for arrays. If the argument has: foo[REC->val]
+	 * then it is very likely that foo is an array of strings
+	 * that are safe to use.
+	 */
+	r = strstr(s, "[");
+	if (r && r < e) {
+		r = strstr(r, "REC->");
+		if (r && r < e)
+			return true;
+	}
+
+	/*
+	 * If there's any strings in the argument consider this arg OK as it
+	 * could be: REC->field ? "foo" : "bar" and we don't want to get into
+	 * verifying that logic here.
+	 */
+	if (find_print_string(fmt, "\"", e))
+		return true;
+
+	/* Dereferenced strings are also valid like any other pointer */
+	if (process_pointer(fmt, len, call))
+		return true;
+
+	/* Make sure the field is found */
+	field = find_event_field(fmt, call);
+	if (!field)
+		return false;
+
+	/* Test this field's string before printing the event */
+	call->flags |= TRACE_EVENT_FL_TEST_STR;
+	field->needs_test = 1;
+
+	return true;
+}
+
 /*
  * Examine the print fmt of the event looking for unsafe dereference
  * pointers using %p* that could be recorded in the trace event and
@@ -284,13 +409,14 @@
 static void test_event_printk(struct trace_event_call *call)
 {
 	u64 dereference_flags = 0;
+	u64 string_flags = 0;
 	bool first = true;
-	const char *fmt, *c, *r, *a;
+	const char *fmt;
 	int parens = 0;
 	char in_quote = 0;
 	int start_arg = 0;
 	int arg = 0;
-	int i;
+	int i, e;
 
 	fmt = call->print_fmt;
 
@@ -374,8 +500,16 @@
 						star = true;
 						continue;
 					}
-					if ((fmt[i + j] == 's') && star)
-						arg++;
+					if ((fmt[i + j] == 's')) {
+						if (star)
+							arg++;
+						if (WARN_ONCE(arg == 63,
+							      "Too many args for event: %s",
+							      trace_event_name(call)))
+							return;
+						dereference_flags |= 1ULL << arg;
+						string_flags |= 1ULL << arg;
+					}
 					break;
 				}
 				break;
@@ -403,42 +537,47 @@
 		case ',':
 			if (in_quote || parens)
 				continue;
+			e = i;
 			i++;
 			while (isspace(fmt[i]))
 				i++;
-			start_arg = i;
-			if (!(dereference_flags & (1ULL << arg)))
-				goto next_arg;
 
-			/* Find the REC-> in the argument */
-			c = strchr(fmt + i, ',');
-			r = strstr(fmt + i, "REC->");
-			if (r && (!c || r < c)) {
-				/*
-				 * Addresses of events on the buffer,
-				 * or an array on the buffer is
-				 * OK to dereference.
-				 * There's ways to fool this, but
-				 * this is to catch common mistakes,
-				 * not malicious code.
-				 */
-				a = strchr(fmt + i, '&');
-				if ((a && (a < r)) || test_field(r, call))
+			/*
+			 * If start_arg is zero, then this is the start of the
+			 * first argument. The processing of the argument happens
+			 * when the end of the argument is found, as it needs to
+			 * handle paranthesis and such.
+			 */
+			if (!start_arg) {
+				start_arg = i;
+				/* Balance out the i++ in the for loop */
+				i--;
+				continue;
+			}
+
+			if (dereference_flags & (1ULL << arg)) {
+				if (string_flags & (1ULL << arg)) {
+					if (process_string(fmt + start_arg, e - start_arg, call))
+						dereference_flags &= ~(1ULL << arg);
+				} else if (process_pointer(fmt + start_arg, e - start_arg, call))
 					dereference_flags &= ~(1ULL << arg);
-			} else if ((r = strstr(fmt + i, "__get_dynamic_array(")) &&
-				   (!c || r < c)) {
-				dereference_flags &= ~(1ULL << arg);
-			} else if ((r = strstr(fmt + i, "__get_sockaddr(")) &&
-				   (!c || r < c)) {
-				dereference_flags &= ~(1ULL << arg);
 			}
 
-		next_arg:
-			i--;
+			start_arg = i;
 			arg++;
+			/* Balance out the i++ in the for loop */
+			i--;
 		}
 	}
 
+	if (dereference_flags & (1ULL << arg)) {
+		if (string_flags & (1ULL << arg)) {
+			if (process_string(fmt + start_arg, i - start_arg, call))
+				dereference_flags &= ~(1ULL << arg);
+		} else if (process_pointer(fmt + start_arg, i - start_arg, call))
+			dereference_flags &= ~(1ULL << arg);
+	}
+
 	/*
 	 * If you triggered the below warning, the trace event reported
 	 * uses an unsafe dereference pointer %p*. As the data stored
@@ -1386,12 +1525,12 @@
 	char buf[4] = "0";
 
 	mutex_lock(&event_mutex);
-	file = event_file_data(filp);
+	file = event_file_file(filp);
 	if (likely(file))
 		flags = file->flags;
 	mutex_unlock(&event_mutex);
 
-	if (!file || flags & EVENT_FILE_FL_FREED)
+	if (!file)
 		return -ENODEV;
 
 	if (flags & EVENT_FILE_FL_ENABLED &&
@@ -1424,8 +1563,8 @@
 	case 1:
 		ret = -ENODEV;
 		mutex_lock(&event_mutex);
-		file = event_file_data(filp);
-		if (likely(file && !(file->flags & EVENT_FILE_FL_FREED))) {
+		file = event_file_file(filp);
+		if (likely(file)) {
 			ret = tracing_update_buffers(file->tr);
 			if (ret < 0) {
 				mutex_unlock(&event_mutex);
@@ -1540,7 +1679,8 @@
 
 static void *f_next(struct seq_file *m, void *v, loff_t *pos)
 {
-	struct trace_event_call *call = event_file_data(m->private);
+	struct trace_event_file *file = event_file_data(m->private);
+	struct trace_event_call *call = file->event_call;
 	struct list_head *common_head = &ftrace_common_fields;
 	struct list_head *head = trace_get_fields(call);
 	struct list_head *node = v;
@@ -1572,7 +1712,8 @@
 
 static int f_show(struct seq_file *m, void *v)
 {
-	struct trace_event_call *call = event_file_data(m->private);
+	struct trace_event_file *file = event_file_data(m->private);
+	struct trace_event_call *call = file->event_call;
 	struct ftrace_event_field *field;
 	const char *array_descriptor;
 
@@ -1627,12 +1768,14 @@
 
 static void *f_start(struct seq_file *m, loff_t *pos)
 {
+	struct trace_event_file *file;
 	void *p = (void *)FORMAT_HEADER;
 	loff_t l = 0;
 
 	/* ->stop() is called even if ->start() fails */
 	mutex_lock(&event_mutex);
-	if (!event_file_data(m->private))
+	file = event_file_file(m->private);
+	if (!file)
 		return ERR_PTR(-ENODEV);
 
 	while (l < *pos && p)
@@ -1670,6 +1813,7 @@
 	return 0;
 }
 
+#ifdef CONFIG_PERF_EVENTS
 static ssize_t
 event_id_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
 {
@@ -1684,6 +1828,7 @@
 
 	return simple_read_from_buffer(ubuf, cnt, ppos, buf, len);
 }
+#endif
 
 static ssize_t
 event_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
@@ -1704,8 +1849,8 @@
 	trace_seq_init(s);
 
 	mutex_lock(&event_mutex);
-	file = event_file_data(filp);
-	if (file && !(file->flags & EVENT_FILE_FL_FREED))
+	file = event_file_file(filp);
+	if (file)
 		print_event_filter(file, s);
 	mutex_unlock(&event_mutex);
 
@@ -1734,9 +1879,13 @@
 		return PTR_ERR(buf);
 
 	mutex_lock(&event_mutex);
-	file = event_file_data(filp);
-	if (file)
-		err = apply_event_filter(file, buf);
+	file = event_file_file(filp);
+	if (file) {
+		if (file->flags & EVENT_FILE_FL_FREED)
+			err = -ENODEV;
+		else
+			err = apply_event_filter(file, buf);
+	}
 	mutex_unlock(&event_mutex);
 
 	kfree(buf);
@@ -2152,10 +2301,12 @@
 	.release = seq_release,
 };
 
+#ifdef CONFIG_PERF_EVENTS
 static const struct file_operations ftrace_event_id_fops = {
 	.read = event_id_read,
 	.llseek = default_llseek,
 };
+#endif
 
 static const struct file_operations ftrace_event_filter_fops = {
 	.open = tracing_open_file_tr,
@@ -2459,7 +2610,7 @@
 			ret = trace_define_field_ext(call, field->type, field->name,
 						 offset, field->size,
 						 field->is_signed, field->filter_type,
-						 field->len);
+						 field->len, field->needs_test);
 			if (WARN_ON_ONCE(ret)) {
 				pr_err("error code is %d\n", ret);
 				break;
@@ -2481,7 +2632,6 @@
 	if (strcmp(name, "format") == 0) {
 		*mode = TRACE_MODE_READ;
 		*fops = &ftrace_event_format_fops;
-		*data = call;
 		return 1;
 	}
 
@@ -2548,6 +2698,14 @@
 	return 0;
 }
 
+/* The file is incremented on creation and freeing the enable file decrements it */
+static void event_release(const char *name, void *data)
+{
+	struct trace_event_file *file = data;
+
+	event_file_put(file);
+}
+
 static int
 event_create_dir(struct eventfs_inode *parent, struct trace_event_file *file)
 {
@@ -2562,6 +2720,7 @@
 		{
 			.name		= "enable",
 			.callback	= event_callback,
+			.release	= event_release,
 		},
 		{
 			.name		= "filter",
@@ -2630,6 +2789,9 @@
 		return ret;
 	}
 
+	/* Gets decremented on freeing of the "enable" file */
+	event_file_get(file);
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/kernel/trace/trace_events_hist.c
+++ linux-qcom-6.8.0/kernel/trace/trace_events_hist.c
@@ -5601,7 +5601,7 @@
 
 	mutex_lock(&event_mutex);
 
-	event_file = event_file_data(m->private);
+	event_file = event_file_file(m->private);
 	if (unlikely(!event_file)) {
 		ret = -ENODEV;
 		goto out_unlock;
@@ -5880,7 +5880,7 @@
 
 	mutex_lock(&event_mutex);
 
-	event_file = event_file_data(m->private);
+	event_file = event_file_file(m->private);
 	if (unlikely(!event_file)) {
 		ret = -ENODEV;
 		goto out_unlock;
--- linux-qcom-6.8.0.orig/kernel/trace/trace_events_inject.c
+++ linux-qcom-6.8.0/kernel/trace/trace_events_inject.c
@@ -299,7 +299,7 @@
 	strim(buf);
 
 	mutex_lock(&event_mutex);
-	file = event_file_data(filp);
+	file = event_file_file(filp);
 	if (file) {
 		call = file->event_call;
 		size = parse_entry(buf, call, &entry);
--- linux-qcom-6.8.0.orig/kernel/trace/trace_events_trigger.c
+++ linux-qcom-6.8.0/kernel/trace/trace_events_trigger.c
@@ -159,7 +159,7 @@
 
 	/* ->stop() is called even if ->start() fails */
 	mutex_lock(&event_mutex);
-	event_file = event_file_data(m->private);
+	event_file = event_file_file(m->private);
 	if (unlikely(!event_file))
 		return ERR_PTR(-ENODEV);
 
@@ -213,7 +213,7 @@
 
 	mutex_lock(&event_mutex);
 
-	if (unlikely(!event_file_data(file))) {
+	if (unlikely(!event_file_file(file))) {
 		mutex_unlock(&event_mutex);
 		return -ENODEV;
 	}
@@ -293,7 +293,7 @@
 	strim(buf);
 
 	mutex_lock(&event_mutex);
-	event_file = event_file_data(file);
+	event_file = event_file_file(file);
 	if (unlikely(!event_file)) {
 		mutex_unlock(&event_mutex);
 		kfree(buf);
--- linux-qcom-6.8.0.orig/kernel/trace/trace_events_user.c
+++ linux-qcom-6.8.0/kernel/trace/trace_events_user.c
@@ -202,6 +202,8 @@
 static struct user_event_mm *user_event_mm_get_all(struct user_event *user);
 static void user_event_mm_put(struct user_event_mm *mm);
 static int destroy_user_event(struct user_event *user);
+static bool user_fields_match(struct user_event *user, int argc,
+			      const char **argv);
 
 static u32 user_event_key(char *name)
 {
@@ -1493,17 +1495,24 @@
 }
 
 static struct user_event *find_user_event(struct user_event_group *group,
-					  char *name, u32 *outkey)
+					  char *name, int argc, const char **argv,
+					  u32 flags, u32 *outkey)
 {
 	struct user_event *user;
 	u32 key = user_event_key(name);
 
 	*outkey = key;
 
-	hash_for_each_possible(group->register_table, user, node, key)
-		if (!strcmp(EVENT_NAME(user), name))
+	hash_for_each_possible(group->register_table, user, node, key) {
+		if (strcmp(EVENT_NAME(user), name))
+			continue;
+
+		if (user_fields_match(user, argc, argv))
 			return user_event_get(user);
 
+		return ERR_PTR(-EADDRINUSE);
+	}
+
 	return NULL;
 }
 
@@ -1860,6 +1869,9 @@
 	struct list_head *head = &user->fields;
 	int i = 0;
 
+	if (argc == 0)
+		return list_empty(head);
+
 	list_for_each_entry_reverse(field, head, link) {
 		if (!user_field_match(field, argc, argv, &i))
 			return false;
@@ -1880,10 +1892,8 @@
 	match = strcmp(EVENT_NAME(user), event) == 0 &&
 		(!system || strcmp(system, USER_EVENTS_SYSTEM) == 0);
 
-	if (match && argc > 0)
+	if (match)
 		match = user_fields_match(user, argc, argv);
-	else if (match && argc == 0)
-		match = list_empty(&user->fields);
 
 	return match;
 }
@@ -1914,6 +1924,80 @@
 }
 
 /*
+ * Counts how many ';' without a trailing space are in the args.
+ */
+static int count_semis_no_space(char *args)
+{
+	int count = 0;
+
+	while ((args = strchr(args, ';'))) {
+		args++;
+
+		if (!isspace(*args))
+			count++;
+	}
+
+	return count;
+}
+
+/*
+ * Copies the arguments while ensuring all ';' have a trailing space.
+ */
+static char *insert_space_after_semis(char *args, int count)
+{
+	char *fixed, *pos;
+	int len;
+
+	len = strlen(args) + count;
+	fixed = kmalloc(len + 1, GFP_KERNEL);
+
+	if (!fixed)
+		return NULL;
+
+	pos = fixed;
+
+	/* Insert a space after ';' if there is no trailing space. */
+	while (*args) {
+		*pos = *args++;
+
+		if (*pos++ == ';' && !isspace(*args))
+			*pos++ = ' ';
+	}
+
+	*pos = '\0';
+
+	return fixed;
+}
+
+static char **user_event_argv_split(char *args, int *argc)
+{
+	char **split;
+	char *fixed;
+	int count;
+
+	/* Count how many ';' without a trailing space */
+	count = count_semis_no_space(args);
+
+	/* No fixup is required */
+	if (!count)
+		return argv_split(GFP_KERNEL, args, argc);
+
+	/* We must fixup 'field;field' to 'field; field' */
+	fixed = insert_space_after_semis(args, count);
+
+	if (!fixed)
+		return NULL;
+
+	/* We do a normal split afterwards */
+	split = argv_split(GFP_KERNEL, fixed, argc);
+
+	/* We can free since argv_split makes a copy */
+	kfree(fixed);
+
+	return split;
+}
+
+/*
  * Parses the event name, arguments and flags then registers if successful.
  * The name buffer lifetime is owned by this method for success cases only.
  * Upon success the returned user_event has its ref count increased by 1.
@@ -1922,11 +2006,11 @@
 			    char *args, char *flags,
 			    struct user_event **newuser, int reg_flags)
 {
-	int ret;
-	u32 key;
 	struct user_event *user;
+	char **argv = NULL;
 	int argc = 0;
-	char **argv;
+	int ret;
+	u32 key;
 
 	/* Currently don't support any text based flags */
 	if (flags != NULL)
@@ -1935,41 +2019,34 @@
 	if (!user_event_capable(reg_flags))
 		return -EPERM;
 
+	if (args) {
+		argv = user_event_argv_split(args, &argc);
+
+		if (!argv)
+			return -ENOMEM;
+	}
+
 	/* Prevent dyn_event from racing */
 	mutex_lock(&event_mutex);
-	user = find_user_event(group, name, &key);
+	user = find_user_event(group, name, argc, (const char **)argv,
+			       reg_flags, &key);
 	mutex_unlock(&event_mutex);
 
-	if (user) {
-		if (args) {
-			argv = argv_split(GFP_KERNEL, args, &argc);
-			if (!argv) {
-				ret = -ENOMEM;
-				goto error;
-			}
-
-			ret = user_fields_match(user, argc, (const char **)argv);
-			argv_free(argv);
+	if (argv)
+		argv_free(argv);
 
-		} else
-			ret = list_empty(&user->fields);
+	if (IS_ERR(user))
+		return PTR_ERR(user);
 
-		if (ret) {
-			*newuser = user;
-			/*
-			 * Name is allocated by caller, free it since it already exists.
-			 * Caller only worries about failure cases for freeing.
-			 */
-			kfree(name);
-		} else {
-			ret = -EADDRINUSE;
-			goto error;
-		}
+	if (user) {
+		*newuser = user;
+		/*
+		 * Name is allocated by caller, free it since it already exists.
+		 * Caller only worries about failure cases for freeing.
+		 */
+		kfree(name);
 
 		return 0;
-error:
-		user_event_put(user, false);
-		return ret;
 	}
 
 	user = kzalloc(sizeof(*user), GFP_KERNEL_ACCOUNT);
@@ -2052,25 +2129,33 @@
 }
 
 /*
- * Deletes a previously created event if it is no longer being used.
+ * Deletes previously created events if they are no longer being used.
  */
 static int delete_user_event(struct user_event_group *group, char *name)
 {
-	u32 key;
-	struct user_event *user = find_user_event(group, name, &key);
+	struct user_event *user;
+	struct hlist_node *tmp;
+	u32 key = user_event_key(name);
+	int ret = -ENOENT;
 
-	if (!user)
-		return -ENOENT;
+	/* Attempt to delete all event(s) with the name passed in */
+	hash_for_each_possible_safe(group->register_table, user, tmp, node, key) {
+		if (strcmp(EVENT_NAME(user), name))
+			continue;
 
-	user_event_put(user, true);
+		if (!user_event_last_ref(user))
+			return -EBUSY;
 
-	if (!user_event_last_ref(user))
-		return -EBUSY;
+		if (!user_event_capable(user->reg_flags))
+			return -EPERM;
 
-	if (!user_event_capable(user->reg_flags))
-		return -EPERM;
+		ret = destroy_user_event(user);
 
-	return destroy_user_event(user);
+		if (ret)
+			goto out;
+	}
+out:
+	return ret;
 }
 
 /*
--- linux-qcom-6.8.0.orig/kernel/trace/trace_fprobe.c
+++ linux-qcom-6.8.0/kernel/trace/trace_fprobe.c
@@ -4,6 +4,7 @@
  * Copyright (C) 2022 Google LLC.
  */
 #define pr_fmt(fmt)	"trace_fprobe: " fmt
+#include <asm/ptrace.h>
 
 #include <linux/fprobe.h>
 #include <linux/module.h>
@@ -129,8 +130,8 @@
  * from user space.
  */
 static int
-process_fetch_insn(struct fetch_insn *code, void *rec, void *dest,
-		   void *base)
+process_fetch_insn(struct fetch_insn *code, void *rec, void *edata,
+		   void *dest, void *base)
 {
 	struct pt_regs *regs = rec;
 	unsigned long val;
@@ -152,6 +153,9 @@
 	case FETCH_OP_ARG:
 		val = regs_get_kernel_argument(regs, code->param);
 		break;
+	case FETCH_OP_EDATA:
+		val = *(unsigned long *)((unsigned long)edata + code->offset);
+		break;
 #endif
 	case FETCH_NOP_SYMBOL:	/* Ignore a place holder */
 		code++;
@@ -184,7 +188,7 @@
 	if (trace_trigger_soft_disabled(trace_file))
 		return;
 
-	dsize = __get_data_size(&tf->tp, regs);
+	dsize = __get_data_size(&tf->tp, regs, NULL);
 
 	entry = trace_event_buffer_reserve(&fbuffer, trace_file,
 					   sizeof(*entry) + tf->tp.size + dsize);
@@ -194,7 +198,7 @@
 	fbuffer.regs = regs;
 	entry = fbuffer.entry = ring_buffer_event_data(fbuffer.event);
 	entry->ip = entry_ip;
-	store_trace_args(&entry[1], &tf->tp, regs, sizeof(*entry), dsize);
+	store_trace_args(&entry[1], &tf->tp, regs, NULL, sizeof(*entry), dsize);
 
 	trace_event_buffer_commit(&fbuffer);
 }
@@ -210,11 +214,24 @@
 }
 NOKPROBE_SYMBOL(fentry_trace_func);
 
-/* Kretprobe handler */
+/* function exit handler */
+static int trace_fprobe_entry_handler(struct fprobe *fp, unsigned long entry_ip,
+				unsigned long ret_ip, struct pt_regs *regs,
+				void *entry_data)
+{
+	struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp);
+
+	if (tf->tp.entry_arg)
+		store_trace_entry_data(entry_data, &tf->tp, regs);
+
+	return 0;
+}
+NOKPROBE_SYMBOL(trace_fprobe_entry_handler)
+
 static nokprobe_inline void
 __fexit_trace_func(struct trace_fprobe *tf, unsigned long entry_ip,
 		   unsigned long ret_ip, struct pt_regs *regs,
-		   struct trace_event_file *trace_file)
+		   void *entry_data, struct trace_event_file *trace_file)
 {
 	struct fexit_trace_entry_head *entry;
 	struct trace_event_buffer fbuffer;
@@ -227,7 +244,7 @@
 	if (trace_trigger_soft_disabled(trace_file))
 		return;
 
-	dsize = __get_data_size(&tf->tp, regs);
+	dsize = __get_data_size(&tf->tp, regs, entry_data);
 
 	entry = trace_event_buffer_reserve(&fbuffer, trace_file,
 					   sizeof(*entry) + tf->tp.size + dsize);
@@ -238,19 +255,19 @@
 	entry = fbuffer.entry = ring_buffer_event_data(fbuffer.event);
 	entry->func = entry_ip;
 	entry->ret_ip = ret_ip;
-	store_trace_args(&entry[1], &tf->tp, regs, sizeof(*entry), dsize);
+	store_trace_args(&entry[1], &tf->tp, regs, entry_data, sizeof(*entry), dsize);
 
 	trace_event_buffer_commit(&fbuffer);
 }
 
 static void
 fexit_trace_func(struct trace_fprobe *tf, unsigned long entry_ip,
-		 unsigned long ret_ip, struct pt_regs *regs)
+		 unsigned long ret_ip, struct pt_regs *regs, void *entry_data)
 {
 	struct event_file_link *link;
 
 	trace_probe_for_each_link_rcu(link, &tf->tp)
-		__fexit_trace_func(tf, entry_ip, ret_ip, regs, link->file);
+		__fexit_trace_func(tf, entry_ip, ret_ip, regs, entry_data, link->file);
 }
 NOKPROBE_SYMBOL(fexit_trace_func);
 
@@ -269,7 +286,7 @@
 	if (hlist_empty(head))
 		return 0;
 
-	dsize = __get_data_size(&tf->tp, regs);
+	dsize = __get_data_size(&tf->tp, regs, NULL);
 	__size = sizeof(*entry) + tf->tp.size + dsize;
 	size = ALIGN(__size + sizeof(u32), sizeof(u64));
 	size -= sizeof(u32);
@@ -280,7 +297,7 @@
 
 	entry->ip = entry_ip;
 	memset(&entry[1], 0, dsize);
-	store_trace_args(&entry[1], &tf->tp, regs, sizeof(*entry), dsize);
+	store_trace_args(&entry[1], &tf->tp, regs, NULL, sizeof(*entry), dsize);
 	perf_trace_buf_submit(entry, size, rctx, call->event.type, 1, regs,
 			      head, NULL);
 	return 0;
@@ -289,7 +306,8 @@
 
 static void
 fexit_perf_func(struct trace_fprobe *tf, unsigned long entry_ip,
-		unsigned long ret_ip, struct pt_regs *regs)
+		unsigned long ret_ip, struct pt_regs *regs,
+		void *entry_data)
 {
 	struct trace_event_call *call = trace_probe_event_call(&tf->tp);
 	struct fexit_trace_entry_head *entry;
@@ -301,7 +319,7 @@
 	if (hlist_empty(head))
 		return;
 
-	dsize = __get_data_size(&tf->tp, regs);
+	dsize = __get_data_size(&tf->tp, regs, entry_data);
 	__size = sizeof(*entry) + tf->tp.size + dsize;
 	size = ALIGN(__size + sizeof(u32), sizeof(u64));
 	size -= sizeof(u32);
@@ -312,7 +330,7 @@
 
 	entry->func = entry_ip;
 	entry->ret_ip = ret_ip;
-	store_trace_args(&entry[1], &tf->tp, regs, sizeof(*entry), dsize);
+	store_trace_args(&entry[1], &tf->tp, regs, entry_data, sizeof(*entry), dsize);
 	perf_trace_buf_submit(entry, size, rctx, call->event.type, 1, regs,
 			      head, NULL);
 }
@@ -343,10 +361,10 @@
 	struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp);
 
 	if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE))
-		fexit_trace_func(tf, entry_ip, ret_ip, regs);
+		fexit_trace_func(tf, entry_ip, ret_ip, regs, entry_data);
 #ifdef CONFIG_PERF_EVENTS
 	if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE))
-		fexit_perf_func(tf, entry_ip, ret_ip, regs);
+		fexit_perf_func(tf, entry_ip, ret_ip, regs, entry_data);
 #endif
 }
 NOKPROBE_SYMBOL(fexit_dispatcher);
@@ -389,7 +407,7 @@
 	tf->tpoint = tpoint;
 	tf->fp.nr_maxactive = maxactive;
 
-	ret = trace_probe_init(&tf->tp, event, group, false);
+	ret = trace_probe_init(&tf->tp, event, group, false, nargs);
 	if (ret < 0)
 		goto error;
 
@@ -1085,6 +1103,10 @@
 		argc = new_argc;
 		argv = new_argv;
 	}
+	if (argc > MAX_TRACE_ARGS) {
+		ret = -E2BIG;
+		goto out;
+	}
 
 	/* setup a probe */
 	tf = alloc_trace_fprobe(group, event, symbol, tpoint, maxactive,
@@ -1101,7 +1123,7 @@
 				(unsigned long)tf->tpoint->probestub);
 
 	/* parse arguments */
-	for (i = 0; i < argc && i < MAX_TRACE_ARGS; i++) {
+	for (i = 0; i < argc; i++) {
 		trace_probe_log_set_index(i + 2);
 		ctx.offset = 0;
 		ret = traceprobe_parse_probe_arg(&tf->tp, i, argv[i], &ctx);
@@ -1109,6 +1131,11 @@
 			goto error;	/* This can be -ENOMEM */
 	}
 
+	if (is_return && tf->tp.entry_arg) {
+		tf->fp.entry_handler = trace_fprobe_entry_handler;
+		tf->fp.entry_data_size = traceprobe_get_entry_data_size(&tf->tp);
+	}
+
 	ret = traceprobe_set_print_fmt(&tf->tp,
 			is_return ? PROBE_PRINT_RETURN : PROBE_PRINT_NORMAL);
 	if (ret < 0)
--- linux-qcom-6.8.0.orig/kernel/trace/trace_hwlat.c
+++ linux-qcom-6.8.0/kernel/trace/trace_hwlat.c
@@ -520,6 +520,8 @@
 	if (!hwlat_busy || hwlat_data.thread_mode != MODE_PER_CPU)
 		goto out_unlock;
 
+	if (!cpu_online(cpu))
+		goto out_unlock;
 	if (!cpumask_test_cpu(cpu, tr->tracing_cpumask))
 		goto out_unlock;
 
--- linux-qcom-6.8.0.orig/kernel/trace/trace_kprobe.c
+++ linux-qcom-6.8.0/kernel/trace/trace_kprobe.c
@@ -290,7 +290,7 @@
 	INIT_HLIST_NODE(&tk->rp.kp.hlist);
 	INIT_LIST_HEAD(&tk->rp.kp.list);
 
-	ret = trace_probe_init(&tk->tp, event, group, false);
+	ret = trace_probe_init(&tk->tp, event, group, false, nargs);
 	if (ret < 0)
 		goto error;
 
@@ -670,6 +670,21 @@
 	return ret;
 }
 
+static int validate_module_probe_symbol(const char *modname, const char *symbol);
+
+static int register_module_trace_kprobe(struct module *mod, struct trace_kprobe *tk)
+{
+	const char *p;
+	int ret = 0;
+
+	p = strchr(trace_kprobe_symbol(tk), ':');
+	if (p)
+		ret = validate_module_probe_symbol(module_name(mod), p + 1);
+	if (!ret)
+		ret = __register_trace_kprobe(tk);
+	return ret;
+}
+
 /* Module notifier call back, checking event on the module */
 static int trace_kprobe_module_callback(struct notifier_block *nb,
 				       unsigned long val, void *data)
@@ -688,7 +703,7 @@
 		if (trace_kprobe_within_module(tk, mod)) {
 			/* Don't need to check busy - this should have gone. */
 			__unregister_trace_kprobe(tk);
-			ret = __register_trace_kprobe(tk);
+			ret = register_module_trace_kprobe(mod, tk);
 			if (ret)
 				pr_warn("Failed to re-register probe %s on %s: %d\n",
 					trace_probe_name(&tk->tp),
@@ -702,7 +717,7 @@
 
 static struct notifier_block trace_kprobe_module_nb = {
 	.notifier_call = trace_kprobe_module_callback,
-	.priority = 1	/* Invoked after kprobe module callback */
+	.priority = 2	/* Invoked after kprobe and jump_label module callback */
 };
 
 static int count_symbols(void *data, unsigned long unused)
@@ -729,17 +744,84 @@
 	return 0;
 }
 
-static unsigned int number_of_same_symbols(char *func_name)
+static unsigned int number_of_same_symbols(const char *mod, const char *func_name)
 {
 	struct sym_count_ctx ctx = { .count = 0, .name = func_name };
 
-	kallsyms_on_each_match_symbol(count_symbols, func_name, &ctx.count);
+	if (!mod)
+		kallsyms_on_each_match_symbol(count_symbols, func_name, &ctx.count);
 
-	module_kallsyms_on_each_symbol(NULL, count_mod_symbols, &ctx);
+	module_kallsyms_on_each_symbol(mod, count_mod_symbols, &ctx);
 
 	return ctx.count;
 }
 
+static int validate_module_probe_symbol(const char *modname, const char *symbol)
+{
+	unsigned int count = number_of_same_symbols(modname, symbol);
+
+	if (count > 1) {
+		/*
+		 * Users should use ADDR to remove the ambiguity of
+		 * using KSYM only.
+		 */
+		return -EADDRNOTAVAIL;
+	} else if (count == 0) {
+		/*
+		 * We can return ENOENT earlier than when register the
+		 * kprobe.
+		 */
+		return -ENOENT;
+	}
+	return 0;
+}
+
+#ifdef CONFIG_MODULES
+/* Return NULL if the module is not loaded or under unloading. */
+static struct module *try_module_get_by_name(const char *name)
+{
+	struct module *mod;
+
+	rcu_read_lock_sched();
+	mod = find_module(name);
+	if (mod && !try_module_get(mod))
+		mod = NULL;
+	rcu_read_unlock_sched();
+
+	return mod;
+}
+#else
+#define try_module_get_by_name(name)	(NULL)
+#endif
+
+static int validate_probe_symbol(char *symbol)
+{
+	struct module *mod = NULL;
+	char *modname = NULL, *p;
+	int ret = 0;
+
+	p = strchr(symbol, ':');
+	if (p) {
+		modname = symbol;
+		symbol = p + 1;
+		*p = '\0';
+		mod = try_module_get_by_name(modname);
+		if (!mod)
+			goto out;
+	}
+
+	ret = validate_module_probe_symbol(modname, symbol);
+out:
+	if (p)
+		*p = ':';
+	if (mod)
+		module_put(mod);
+	return ret;
+}
+
+static int trace_kprobe_entry_handler(struct kretprobe_instance *ri,
+				      struct pt_regs *regs);
+
 static int __trace_kprobe_create(int argc, const char *argv[])
 {
 	/*
@@ -859,6 +941,14 @@
 			trace_probe_log_err(0, BAD_PROBE_ADDR);
 			goto parse_error;
 		}
+		ret = validate_probe_symbol(symbol);
+		if (ret) {
+			if (ret == -EADDRNOTAVAIL)
+				trace_probe_log_err(0, NON_UNIQ_SYMBOL);
+			else
+				trace_probe_log_err(0, BAD_PROBE_ADDR);
+			goto parse_error;
+		}
 		if (is_return)
 			ctx.flags |= TPARG_FL_RETURN;
 		ret = kprobe_on_func_entry(NULL, symbol, offset);
@@ -871,31 +961,6 @@
 		}
 	}
 
-	if (symbol && !strchr(symbol, ':')) {
-		unsigned int count;
-
-		count = number_of_same_symbols(symbol);
-		if (count > 1) {
-			/*
-			 * Users should use ADDR to remove the ambiguity of
-			 * using KSYM only.
-			 */
-			trace_probe_log_err(0, NON_UNIQ_SYMBOL);
-			ret = -EADDRNOTAVAIL;
-
-			goto error;
-		} else if (count == 0) {
-			/*
-			 * We can return ENOENT earlier than when register the
-			 * kprobe.
-			 */
-			trace_probe_log_err(0, BAD_PROBE_ADDR);
-			ret = -ENOENT;
-
-			goto error;
-		}
-	}
-
 	trace_probe_log_set_index(0);
 	if (event) {
 		ret = traceprobe_parse_event_name(&event, &group, gbuf,
@@ -929,6 +994,10 @@
 		argc = new_argc;
 		argv = new_argv;
 	}
+	if (argc > MAX_TRACE_ARGS) {
+		ret = -E2BIG;
+		goto out;
+	}
 
 	/* setup a probe */
 	tk = alloc_trace_kprobe(group, event, addr, symbol, offset, maxactive,
@@ -941,13 +1010,18 @@
 	}
 
 	/* parse arguments */
-	for (i = 0; i < argc && i < MAX_TRACE_ARGS; i++) {
+	for (i = 0; i < argc; i++) {
 		trace_probe_log_set_index(i + 2);
 		ctx.offset = 0;
 		ret = traceprobe_parse_probe_arg(&tk->tp, i, argv[i], &ctx);
 		if (ret)
 			goto error;	/* This can be -ENOMEM */
 	}
+	/* entry handler for kretprobe */
+	if (is_return && tk->tp.entry_arg) {
+		tk->rp.entry_handler = trace_kprobe_entry_handler;
+		tk->rp.data_size = traceprobe_get_entry_data_size(&tk->tp);
+	}
 
 	ptype = is_return ? PROBE_PRINT_RETURN : PROBE_PRINT_NORMAL;
 	ret = traceprobe_set_print_fmt(&tk->tp, ptype);
@@ -1303,8 +1377,8 @@
 
 /* Note that we don't verify it, since the code does not come from user space */
 static int
-process_fetch_insn(struct fetch_insn *code, void *rec, void *dest,
-		   void *base)
+process_fetch_insn(struct fetch_insn *code, void *rec, void *edata,
+		   void *dest, void *base)
 {
 	struct pt_regs *regs = rec;
 	unsigned long val;
@@ -1329,6 +1403,9 @@
 	case FETCH_OP_ARG:
 		val = regs_get_kernel_argument(regs, code->param);
 		break;
+	case FETCH_OP_EDATA:
+		val = *(unsigned long *)((unsigned long)edata + code->offset);
+		break;
 #endif
 	case FETCH_NOP_SYMBOL:	/* Ignore a place holder */
 		code++;
@@ -1359,7 +1436,7 @@
 	if (trace_trigger_soft_disabled(trace_file))
 		return;
 
-	dsize = __get_data_size(&tk->tp, regs);
+	dsize = __get_data_size(&tk->tp, regs, NULL);
 
 	entry = trace_event_buffer_reserve(&fbuffer, trace_file,
 					   sizeof(*entry) + tk->tp.size + dsize);
@@ -1368,7 +1445,7 @@
 
 	fbuffer.regs = regs;
 	entry->ip = (unsigned long)tk->rp.kp.addr;
-	store_trace_args(&entry[1], &tk->tp, regs, sizeof(*entry), dsize);
+	store_trace_args(&entry[1], &tk->tp, regs, NULL, sizeof(*entry), dsize);
 
 	trace_event_buffer_commit(&fbuffer);
 }
@@ -1384,6 +1461,31 @@
 NOKPROBE_SYMBOL(kprobe_trace_func);
 
 /* Kretprobe handler */
+
+static int trace_kprobe_entry_handler(struct kretprobe_instance *ri,
+				      struct pt_regs *regs)
+{
+	struct kretprobe *rp = get_kretprobe(ri);
+	struct trace_kprobe *tk;
+
+	/*
+	 * There is a small chance that get_kretprobe(ri) returns NULL when
+	 * the kretprobe is unregister on another CPU between kretprobe's
+	 * trampoline_handler and this function.
+	 */
+	if (unlikely(!rp))
+		return -ENOENT;
+
+	tk = container_of(rp, struct trace_kprobe, rp);
+
+	/* store argument values into ri->data as entry data */
+	if (tk->tp.entry_arg)
+		store_trace_entry_data(ri->data, &tk->tp, regs);
+
+	return 0;
+}
+
+
 static nokprobe_inline void
 __kretprobe_trace_func(struct trace_kprobe *tk, struct kretprobe_instance *ri,
 		       struct pt_regs *regs,
@@ -1399,7 +1501,7 @@
 	if (trace_trigger_soft_disabled(trace_file))
 		return;
 
-	dsize = __get_data_size(&tk->tp, regs);
+	dsize = __get_data_size(&tk->tp, regs, ri->data);
 
 	entry = trace_event_buffer_reserve(&fbuffer, trace_file,
 					   sizeof(*entry) + tk->tp.size + dsize);
@@ -1409,7 +1511,7 @@
 	fbuffer.regs = regs;
 	entry->func = (unsigned long)tk->rp.kp.addr;
 	entry->ret_ip = get_kretprobe_retaddr(ri);
-	store_trace_args(&entry[1], &tk->tp, regs, sizeof(*entry), dsize);
+	store_trace_args(&entry[1], &tk->tp, regs, ri->data, sizeof(*entry), dsize);
 
 	trace_event_buffer_commit(&fbuffer);
 }
@@ -1557,7 +1659,7 @@
 	if (hlist_empty(head))
 		return 0;
 
-	dsize = __get_data_size(&tk->tp, regs);
+	dsize = __get_data_size(&tk->tp, regs, NULL);
 	__size = sizeof(*entry) + tk->tp.size + dsize;
 	size = ALIGN(__size + sizeof(u32), sizeof(u64));
 	size -= sizeof(u32);
@@ -1568,7 +1670,7 @@
 
 	entry->ip = (unsigned long)tk->rp.kp.addr;
 	memset(&entry[1], 0, dsize);
-	store_trace_args(&entry[1], &tk->tp, regs, sizeof(*entry), dsize);
+	store_trace_args(&entry[1], &tk->tp, regs, NULL, sizeof(*entry), dsize);
 	perf_trace_buf_submit(entry, size, rctx, call->event.type, 1, regs,
 			      head, NULL);
 	return 0;
@@ -1593,7 +1695,7 @@
 	if (hlist_empty(head))
 		return;
 
-	dsize = __get_data_size(&tk->tp, regs);
+	dsize = __get_data_size(&tk->tp, regs, ri->data);
 	__size = sizeof(*entry) + tk->tp.size + dsize;
 	size = ALIGN(__size + sizeof(u32), sizeof(u64));
 	size -= sizeof(u32);
@@ -1604,7 +1706,7 @@
 
 	entry->func = (unsigned long)tk->rp.kp.addr;
 	entry->ret_ip = get_kretprobe_retaddr(ri);
-	store_trace_args(&entry[1], &tk->tp, regs, sizeof(*entry), dsize);
+	store_trace_args(&entry[1], &tk->tp, regs, ri->data, sizeof(*entry), dsize);
 	perf_trace_buf_submit(entry, size, rctx, call->event.type, 1, regs,
 			      head, NULL);
 }
@@ -1775,21 +1877,9 @@
 	char *event;
 
 	if (func) {
-		unsigned int count;
-
-		count = number_of_same_symbols(func);
-		if (count > 1)
-			/*
-			 * Users should use addr to remove the ambiguity of
-			 * using func only.
-			 */
-			return ERR_PTR(-EADDRNOTAVAIL);
-		else if (count == 0)
-			/*
-			 * We can return ENOENT earlier than when register the
-			 * kprobe.
-			 */
-			return ERR_PTR(-ENOENT);
+		ret = validate_probe_symbol(func);
+		if (ret)
+			return ERR_PTR(ret);
 	}
 
 	/*
--- linux-qcom-6.8.0.orig/kernel/trace/trace_osnoise.c
+++ linux-qcom-6.8.0/kernel/trace/trace_osnoise.c
@@ -228,6 +228,11 @@
 	return this_cpu_ptr(&per_cpu_osnoise_var);
 }
 
+/*
+ * Protect the interface.
+ */
+static struct mutex interface_lock;
+
 #ifdef CONFIG_TIMERLAT_TRACER
 /*
  * Runtime information for the timer mode.
@@ -259,14 +264,20 @@
 {
 	struct timerlat_variables *tlat_var;
 	int cpu;
+
+	/* Synchronize with the timerlat interfaces */
+	mutex_lock(&interface_lock);
 	/*
 	 * So far, all the values are initialized as 0, so
 	 * zeroing the structure is perfect.
 	 */
 	for_each_cpu(cpu, cpu_online_mask) {
 		tlat_var = per_cpu_ptr(&per_cpu_timerlat_var, cpu);
+		if (tlat_var->kthread)
+			hrtimer_cancel(&tlat_var->timer);
 		memset(tlat_var, 0, sizeof(*tlat_var));
 	}
+	mutex_unlock(&interface_lock);
 }
 #else /* CONFIG_TIMERLAT_TRACER */
 #define tlat_var_reset()	do {} while (0)
@@ -332,11 +343,6 @@
 #endif
 
 /*
- * Protect the interface.
- */
-static struct mutex interface_lock;
-
-/*
  * Tracer data.
  */
 static struct osnoise_data {
@@ -1612,6 +1618,7 @@
 
 static struct cpumask osnoise_cpumask;
 static struct cpumask save_cpumask;
+static struct cpumask kthread_cpumask;
 
 /*
  * osnoise_sleep - sleep until the next period
@@ -1675,6 +1682,7 @@
 	 */
 	mutex_lock(&interface_lock);
 	this_cpu_osn_var()->kthread = NULL;
+	cpumask_clear_cpu(smp_processor_id(), &kthread_cpumask);
 	mutex_unlock(&interface_lock);
 
 	return 1;
@@ -1945,11 +1953,12 @@
 {
 	struct task_struct *kthread;
 
-	kthread = per_cpu(per_cpu_osnoise_var, cpu).kthread;
+	kthread = xchg_relaxed(&(per_cpu(per_cpu_osnoise_var, cpu).kthread), NULL);
 	if (kthread) {
-		if (test_bit(OSN_WORKLOAD, &osnoise_options)) {
+		if (cpumask_test_and_clear_cpu(cpu, &kthread_cpumask) &&
+		    !WARN_ON(!test_bit(OSN_WORKLOAD, &osnoise_options))) {
 			kthread_stop(kthread);
-		} else {
+		} else if (!WARN_ON(test_bit(OSN_WORKLOAD, &osnoise_options))) {
 			/*
 			 * This is a user thread waiting on the timerlat_fd. We need
 			 * to close all users, and the best way to guarantee this is
@@ -1958,7 +1967,6 @@
 			kill_pid(kthread->thread_pid, SIGKILL, 1);
 			put_task_struct(kthread);
 		}
-		per_cpu(per_cpu_osnoise_var, cpu).kthread = NULL;
 	} else {
 		/* if no workload, just return */
 		if (!test_bit(OSN_WORKLOAD, &osnoise_options)) {
@@ -1967,7 +1975,6 @@
 			 */
 			per_cpu(per_cpu_osnoise_var, cpu).sampling = false;
 			barrier();
-			return;
 		}
 	}
 }
@@ -1999,6 +2006,10 @@
 	void *main = osnoise_main;
 	char comm[24];
 
+	/* Do not start a new thread if it is already running */
+	if (per_cpu(per_cpu_osnoise_var, cpu).kthread)
+		return 0;
+
 	if (timerlat_enabled()) {
 		snprintf(comm, 24, "timerlat/%d", cpu);
 		main = timerlat_main;
@@ -2021,6 +2032,7 @@
 	}
 
 	per_cpu(per_cpu_osnoise_var, cpu).kthread = kthread;
+	cpumask_set_cpu(cpu, &kthread_cpumask);
 
 	return 0;
 }
@@ -2048,8 +2060,15 @@
 	 */
 	cpumask_and(current_mask, cpu_online_mask, &osnoise_cpumask);
 
-	for_each_possible_cpu(cpu)
-		per_cpu(per_cpu_osnoise_var, cpu).kthread = NULL;
+	for_each_possible_cpu(cpu) {
+		if (cpumask_test_and_clear_cpu(cpu, &kthread_cpumask)) {
+			struct task_struct *kthread;
+
+			kthread = xchg_relaxed(&(per_cpu(per_cpu_osnoise_var, cpu).kthread), NULL);
+			if (!WARN_ON(!kthread))
+				kthread_stop(kthread);
+		}
+	}
 
 	for_each_cpu(cpu, current_mask) {
 		retval = start_kthread(cpu);
@@ -2078,6 +2097,8 @@
 	mutex_lock(&interface_lock);
 	cpus_read_lock();
 
+	if (!cpu_online(cpu))
+		goto out_unlock;
 	if (!cpumask_test_cpu(cpu, &osnoise_cpumask))
 		goto out_unlock;
 
@@ -2579,7 +2600,8 @@
 	osn_var = per_cpu_ptr(&per_cpu_osnoise_var, cpu);
 	tlat_var = per_cpu_ptr(&per_cpu_timerlat_var, cpu);
 
-	hrtimer_cancel(&tlat_var->timer);
+	if (tlat_var->kthread)
+		hrtimer_cancel(&tlat_var->timer);
 	memset(tlat_var, 0, sizeof(*tlat_var));
 
 	osn_var->sampling = 0;
--- linux-qcom-6.8.0.orig/kernel/trace/trace_output.c
+++ linux-qcom-6.8.0/kernel/trace/trace_output.c
@@ -317,10 +317,14 @@
 
 void trace_event_printf(struct trace_iterator *iter, const char *fmt, ...)
 {
+	struct trace_seq *s = &iter->seq;
 	va_list ap;
 
+	if (ignore_event(iter))
+		return;
+
 	va_start(ap, fmt);
-	trace_check_vprintf(iter, trace_event_format(iter, fmt), ap);
+	trace_seq_vprintf(s, trace_event_format(iter, fmt), ap);
 	va_end(ap);
 }
 EXPORT_SYMBOL(trace_event_printf);
--- linux-qcom-6.8.0.orig/kernel/trace/trace_probe.c
+++ linux-qcom-6.8.0/kernel/trace/trace_probe.c
@@ -275,7 +275,7 @@
 		}
 		trace_probe_log_err(offset, NO_EVENT_NAME);
 		return -EINVAL;
-	} else if (len > MAX_EVENT_NAME_LEN) {
+	} else if (len >= MAX_EVENT_NAME_LEN) {
 		trace_probe_log_err(offset, EVENT_TOO_LONG);
 		return -EINVAL;
 	}
@@ -553,6 +553,10 @@
 			anon_offs = 0;
 			field = btf_find_struct_member(ctx->btf, type, fieldname,
 						       &anon_offs);
+			if (IS_ERR(field)) {
+				trace_probe_log_err(ctx->offset, BAD_BTF_TID);
+				return PTR_ERR(field);
+			}
 			if (!field) {
 				trace_probe_log_err(ctx->offset, NO_BTF_FIELD);
 				return -ENOENT;
@@ -594,6 +598,8 @@
 	return 0;
 }
 
+static int __store_entry_arg(struct trace_probe *tp, int argnum);
+
 static int parse_btf_arg(char *varname,
 			 struct fetch_insn **pcode, struct fetch_insn *end,
 			 struct traceprobe_parse_context *ctx)
@@ -618,11 +624,7 @@
 		return -EOPNOTSUPP;
 	}
 
-	if (ctx->flags & TPARG_FL_RETURN) {
-		if (strcmp(varname, "$retval") != 0) {
-			trace_probe_log_err(ctx->offset, NO_BTFARG);
-			return -ENOENT;
-		}
+	if (ctx->flags & TPARG_FL_RETURN && !strcmp(varname, "$retval")) {
 		code->op = FETCH_OP_RETVAL;
 		/* Check whether the function return type is not void */
 		if (query_btf_context(ctx) == 0) {
@@ -654,11 +656,21 @@
 		const char *name = btf_name_by_offset(ctx->btf, params[i].name_off);
 
 		if (name && !strcmp(name, varname)) {
-			code->op = FETCH_OP_ARG;
-			if (ctx->flags & TPARG_FL_TPOINT)
-				code->param = i + 1;
-			else
-				code->param = i;
+			if (tparg_is_function_entry(ctx->flags)) {
+				code->op = FETCH_OP_ARG;
+				if (ctx->flags & TPARG_FL_TPOINT)
+					code->param = i + 1;
+				else
+					code->param = i;
+			} else if (tparg_is_function_return(ctx->flags)) {
+				code->op = FETCH_OP_EDATA;
+				ret = __store_entry_arg(ctx->tp, i);
+				if (ret < 0) {
+					/* internal error */
+					return ret;
+				}
+				code->offset = ret;
+			}
 			tid = params[i].type;
 			goto found;
 		}
@@ -755,6 +767,110 @@
 
 #endif
 
+#ifdef CONFIG_HAVE_FUNCTION_ARG_ACCESS_API
+
+static int __store_entry_arg(struct trace_probe *tp, int argnum)
+{
+	struct probe_entry_arg *earg = tp->entry_arg;
+	bool match = false;
+	int i, offset;
+
+	if (!earg) {
+		earg = kzalloc(sizeof(*tp->entry_arg), GFP_KERNEL);
+		if (!earg)
+			return -ENOMEM;
+		earg->size = 2 * tp->nr_args + 1;
+		earg->code = kcalloc(earg->size, sizeof(struct fetch_insn),
+				     GFP_KERNEL);
+		if (!earg->code) {
+			kfree(earg);
+			return -ENOMEM;
+		}
+		/* Fill the code buffer with 'end' to simplify it */
+		for (i = 0; i < earg->size; i++)
+			earg->code[i].op = FETCH_OP_END;
+		tp->entry_arg = earg;
+	}
+
+	offset = 0;
+	for (i = 0; i < earg->size - 1; i++) {
+		switch (earg->code[i].op) {
+		case FETCH_OP_END:
+			earg->code[i].op = FETCH_OP_ARG;
+			earg->code[i].param = argnum;
+			earg->code[i + 1].op = FETCH_OP_ST_EDATA;
+			earg->code[i + 1].offset = offset;
+			return offset;
+		case FETCH_OP_ARG:
+			match = (earg->code[i].param == argnum);
+			break;
+		case FETCH_OP_ST_EDATA:
+			offset = earg->code[i].offset;
+			if (match)
+				return offset;
+			offset += sizeof(unsigned long);
+			break;
+		default:
+			break;
+		}
+	}
+	return -ENOSPC;
+}
+
+int traceprobe_get_entry_data_size(struct trace_probe *tp)
+{
+	struct probe_entry_arg *earg = tp->entry_arg;
+	int i, size = 0;
+
+	if (!earg)
+		return 0;
+
+	for (i = 0; i < earg->size; i++) {
+		switch (earg->code[i].op) {
+		case FETCH_OP_END:
+			goto out;
+		case FETCH_OP_ST_EDATA:
+			size = earg->code[i].offset + sizeof(unsigned long);
+			break;
+		default:
+			break;
+		}
+	}
+out:
+	return size;
+}
+
+void store_trace_entry_data(void *edata, struct trace_probe *tp, struct pt_regs *regs)
+{
+	struct probe_entry_arg *earg = tp->entry_arg;
+	unsigned long val = 0;
+	int i;
+
+	if (!earg)
+		return;
+
+	for (i = 0; i < earg->size; i++) {
+		struct fetch_insn *code = &earg->code[i];
+
+		switch (code->op) {
+		case FETCH_OP_ARG:
+			val = regs_get_kernel_argument(regs, code->param);
+			break;
+		case FETCH_OP_ST_EDATA:
+			*(unsigned long *)((unsigned long)edata + code->offset) = val;
+			break;
+		case FETCH_OP_END:
+			goto end;
+		default:
+			break;
+		}
+	}
+end:
+	return;
+}
+NOKPROBE_SYMBOL(store_trace_entry_data)
+#endif
+
 #define PARAM_MAX_STACK (THREAD_SIZE / sizeof(unsigned long))
 
 /* Parse $vars. @orig_arg points '$', which syncs to @ctx->offset */
@@ -830,7 +946,7 @@
 
 #ifdef CONFIG_HAVE_FUNCTION_ARG_ACCESS_API
 	len = str_has_prefix(arg, "arg");
-	if (len && tparg_is_function_entry(ctx->flags)) {
+	if (len) {
 		ret = kstrtoul(arg + len, 10, &param);
 		if (ret)
 			goto inval;
@@ -839,15 +955,29 @@
 			err = TP_ERR_BAD_ARG_NUM;
 			goto inval;
 		}
+		param--; /* argN starts from 1, but internal arg[N] starts from 0 */
 
-		code->op = FETCH_OP_ARG;
-		code->param = (unsigned int)param - 1;
-		/*
-		 * The tracepoint probe will probe a stub function, and the
-		 * first parameter of the stub is a dummy and should be ignored.
-		 */
-		if (ctx->flags & TPARG_FL_TPOINT)
-			code->param++;
+		if (tparg_is_function_entry(ctx->flags)) {
+			code->op = FETCH_OP_ARG;
+			code->param = (unsigned int)param;
+			/*
+			 * The tracepoint probe will probe a stub function, and the
+			 * first parameter of the stub is a dummy and should be ignored.
+			 */
+			if (ctx->flags & TPARG_FL_TPOINT)
+				code->param++;
+		} else if (tparg_is_function_return(ctx->flags)) {
+			/* function entry argument access from return probe */
+			ret = __store_entry_arg(ctx->tp, param);
+			if (ret < 0)	/* This error should be an internal error */
+				return ret;
+
+			code->op = FETCH_OP_EDATA;
+			code->offset = ret;
+		} else {
+			err = TP_ERR_NOFENTRY_ARGS;
+			goto inval;
+		}
 		return 0;
 	}
 #endif
@@ -1037,7 +1167,8 @@
 		break;
 	default:
 		if (isalpha(arg[0]) || arg[0] == '_') {	/* BTF variable */
-			if (!tparg_is_function_entry(ctx->flags)) {
+			if (!tparg_is_function_entry(ctx->flags) &&
+			    !tparg_is_function_return(ctx->flags)) {
 				trace_probe_log_err(ctx->offset, NOSUP_BTFARG);
 				return -EINVAL;
 			}
@@ -1379,9 +1510,7 @@
 	struct probe_arg *parg = &tp->args[i];
 	const char *body;
 
-	/* Increment count for freeing args in error case */
-	tp->nr_args++;
-
+	ctx->tp = tp;
 	body = strchr(arg, '=');
 	if (body) {
 		if (body - arg > MAX_ARG_NAME_LEN) {
@@ -1438,7 +1567,8 @@
 		if (str_has_prefix(argv[i], "$arg")) {
 			trace_probe_log_set_index(i + 2);
 
-			if (!tparg_is_function_entry(ctx->flags)) {
+			if (!tparg_is_function_entry(ctx->flags) &&
+			    !tparg_is_function_return(ctx->flags)) {
 				trace_probe_log_err(0, NOFENTRY_ARGS);
 				return -EINVAL;
 			}
@@ -1761,12 +1891,18 @@
 	for (i = 0; i < tp->nr_args; i++)
 		traceprobe_free_probe_arg(&tp->args[i]);
 
+	if (tp->entry_arg) {
+		kfree(tp->entry_arg->code);
+		kfree(tp->entry_arg);
+		tp->entry_arg = NULL;
+	}
+
 	if (tp->event)
 		trace_probe_unlink(tp);
 }
 
 int trace_probe_init(struct trace_probe *tp, const char *event,
-		     const char *group, bool alloc_filter)
+		     const char *group, bool alloc_filter, int nargs)
 {
 	struct trace_event_call *call;
 	size_t size = sizeof(struct trace_probe_event);
@@ -1802,6 +1938,11 @@
 		goto error;
 	}
 
+	tp->nr_args = nargs;
+	/* Make sure pointers in args[] are NULL */
+	if (nargs)
+		memset(tp->args, 0, sizeof(tp->args[0]) * nargs);
+
 	return 0;
 
 error:
--- linux-qcom-6.8.0.orig/kernel/trace/trace_probe.h
+++ linux-qcom-6.8.0/kernel/trace/trace_probe.h
@@ -92,6 +92,7 @@
 	FETCH_OP_ARG,		/* Function argument : .param */
 	FETCH_OP_FOFFS,		/* File offset: .immediate */
 	FETCH_OP_DATA,		/* Allocated data: .data */
+	FETCH_OP_EDATA,		/* Entry data: .offset */
 	// Stage 2 (dereference) op
 	FETCH_OP_DEREF,		/* Dereference: .offset */
 	FETCH_OP_UDEREF,	/* User-space Dereference: .offset */
@@ -102,6 +103,7 @@
 	FETCH_OP_ST_STRING,	/* String: .offset, .size */
 	FETCH_OP_ST_USTRING,	/* User String: .offset, .size */
 	FETCH_OP_ST_SYMSTR,	/* Kernel Symbol String: .offset, .size */
+	FETCH_OP_ST_EDATA,	/* Store Entry Data: .offset */
 	// Stage 4 (modify) op
 	FETCH_OP_MOD_BF,	/* Bitfield: .basesize, .lshift, .rshift */
 	// Stage 5 (loop) op
@@ -232,6 +234,11 @@
 	const struct fetch_type	*type;	/* Type of this argument */
 };
 
+struct probe_entry_arg {
+	struct fetch_insn	*code;
+	unsigned int		size;	/* The entry data size */
+};
+
 struct trace_uprobe_filter {
 	rwlock_t		rwlock;
 	int			nr_systemwide;
@@ -253,6 +260,7 @@
 	struct trace_probe_event	*event;
 	ssize_t				size;	/* trace entry size */
 	unsigned int			nr_args;
+	struct probe_entry_arg		*entry_arg;	/* This is only for return probe */
 	struct probe_arg		args[];
 };
 
@@ -338,7 +346,7 @@
 }
 
 int trace_probe_init(struct trace_probe *tp, const char *event,
-		     const char *group, bool alloc_filter);
+		     const char *group, bool alloc_filter, int nargs);
 void trace_probe_cleanup(struct trace_probe *tp);
 int trace_probe_append(struct trace_probe *tp, struct trace_probe *to);
 void trace_probe_unlink(struct trace_probe *tp);
@@ -355,6 +363,18 @@
 int trace_probe_print_args(struct trace_seq *s, struct probe_arg *args, int nr_args,
 		 u8 *data, void *field);
 
+#ifdef CONFIG_HAVE_FUNCTION_ARG_ACCESS_API
+int traceprobe_get_entry_data_size(struct trace_probe *tp);
+/* This is a runtime function to store entry data */
+void store_trace_entry_data(void *edata, struct trace_probe *tp, struct pt_regs *regs);
+#else /* !CONFIG_HAVE_FUNCTION_ARG_ACCESS_API */
+static inline int traceprobe_get_entry_data_size(struct trace_probe *tp)
+{
+	return 0;
+}
+#define store_trace_entry_data(edata, tp, regs) do { } while (0)
+#endif
+
 #define trace_probe_for_each_link(pos, tp)	\
 	list_for_each_entry(pos, &(tp)->event->files, list)
 #define trace_probe_for_each_link_rcu(pos, tp)	\
@@ -381,6 +401,11 @@
 	return (flags & TPARG_FL_LOC_MASK) == (TPARG_FL_KERNEL | TPARG_FL_FENTRY);
 }
 
+static inline bool tparg_is_function_return(unsigned int flags)
+{
+	return (flags & TPARG_FL_LOC_MASK) == (TPARG_FL_KERNEL | TPARG_FL_RETURN);
+}
+
 struct traceprobe_parse_context {
 	struct trace_event_call *event;
 	/* BTF related parameters */
@@ -392,6 +417,7 @@
 	const struct btf_type *last_type;	/* Saved type */
 	u32 last_bitoffs;		/* Saved bitoffs */
 	u32 last_bitsize;		/* Saved bitsize */
+	struct trace_probe *tp;
 	unsigned int flags;
 	int offset;
 };
@@ -506,7 +532,7 @@
 	C(NO_BTFARG,		"This variable is not found at this probe point"),\
 	C(NO_BTF_ENTRY,		"No BTF entry for this probe point"),	\
 	C(BAD_VAR_ARGS,		"$arg* must be an independent parameter without name etc."),\
-	C(NOFENTRY_ARGS,	"$arg* can be used only on function entry"),	\
+	C(NOFENTRY_ARGS,	"$arg* can be used only on function entry or exit"),	\
 	C(DOUBLE_ARGS,		"$arg* can be used only once in the parameters"),	\
 	C(ARGS_2LONG,		"$arg* failed because the argument list is too long"),	\
 	C(ARGIDX_2BIG,		"$argN index is too big"),		\
--- linux-qcom-6.8.0.orig/kernel/trace/trace_probe_tmpl.h
+++ linux-qcom-6.8.0/kernel/trace/trace_probe_tmpl.h
@@ -54,7 +54,7 @@
  * If dest is NULL, don't store result and return required dynamic data size.
  */
 static int
-process_fetch_insn(struct fetch_insn *code, void *rec,
+process_fetch_insn(struct fetch_insn *code, void *rec, void *edata,
 		   void *dest, void *base);
 static nokprobe_inline int fetch_store_strlen(unsigned long addr);
 static nokprobe_inline int
@@ -232,7 +232,7 @@
 
 /* Sum up total data length for dynamic arrays (strings) */
 static nokprobe_inline int
-__get_data_size(struct trace_probe *tp, struct pt_regs *regs)
+__get_data_size(struct trace_probe *tp, struct pt_regs *regs, void *edata)
 {
 	struct probe_arg *arg;
 	int i, len, ret = 0;
@@ -240,7 +240,7 @@
 	for (i = 0; i < tp->nr_args; i++) {
 		arg = tp->args + i;
 		if (unlikely(arg->dynamic)) {
-			len = process_fetch_insn(arg->code, regs, NULL, NULL);
+			len = process_fetch_insn(arg->code, regs, edata, NULL, NULL);
 			if (len > 0)
 				ret += len;
 		}
@@ -251,7 +251,7 @@
 
 /* Store the value of each argument */
 static nokprobe_inline void
-store_trace_args(void *data, struct trace_probe *tp, void *rec,
+store_trace_args(void *data, struct trace_probe *tp, void *rec, void *edata,
 		 int header_size, int maxlen)
 {
 	struct probe_arg *arg;
@@ -266,7 +266,7 @@
 		/* Point the dynamic data area if needed */
 		if (unlikely(arg->dynamic))
 			*dl = make_data_loc(maxlen, dyndata - base);
-		ret = process_fetch_insn(arg->code, rec, dl, base);
+		ret = process_fetch_insn(arg->code, rec, edata, dl, base);
 		if (arg->dynamic && likely(ret > 0)) {
 			dyndata += ret;
 			maxlen -= ret;
--- linux-qcom-6.8.0.orig/kernel/trace/trace_syscalls.c
+++ linux-qcom-6.8.0/kernel/trace/trace_syscalls.c
@@ -299,6 +299,12 @@
 	int syscall_nr;
 	int size;
 
+	/*
+	 * Syscall probe called with preemption enabled, but the ring
+	 * buffer and per-cpu data require preemption to be disabled.
+	 */
+	guard(preempt_notrace)();
+
 	syscall_nr = trace_get_syscall_nr(current, regs);
 	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
 		return;
@@ -338,6 +344,12 @@
 	struct trace_event_buffer fbuffer;
 	int syscall_nr;
 
+	/*
+	 * Syscall probe called with preemption enabled, but the ring
+	 * buffer and per-cpu data require preemption to be disabled.
+	 */
+	guard(preempt_notrace)();
+
 	syscall_nr = trace_get_syscall_nr(current, regs);
 	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
 		return;
--- linux-qcom-6.8.0.orig/kernel/trace/trace_uprobe.c
+++ linux-qcom-6.8.0/kernel/trace/trace_uprobe.c
@@ -211,8 +211,8 @@
 
 /* Note that we don't verify it, since the code does not come from user space */
 static int
-process_fetch_insn(struct fetch_insn *code, void *rec, void *dest,
-		   void *base)
+process_fetch_insn(struct fetch_insn *code, void *rec, void *edata,
+		   void *dest, void *base)
 {
 	struct pt_regs *regs = rec;
 	unsigned long val;
@@ -337,7 +337,7 @@
 	if (!tu)
 		return ERR_PTR(-ENOMEM);
 
-	ret = trace_probe_init(&tu->tp, event, group, true);
+	ret = trace_probe_init(&tu->tp, event, group, true, nargs);
 	if (ret < 0)
 		goto error;
 
@@ -556,6 +556,8 @@
 
 	if (argc < 2)
 		return -ECANCELED;
+	if (argc - 2 > MAX_TRACE_ARGS)
+		return -E2BIG;
 
 	if (argv[0][1] == ':')
 		event = &argv[0][2];
@@ -681,7 +683,7 @@
 	tu->filename = filename;
 
 	/* parse arguments */
-	for (i = 0; i < argc && i < MAX_TRACE_ARGS; i++) {
+	for (i = 0; i < argc; i++) {
 		struct traceprobe_parse_context ctx = {
 			.flags = (is_return ? TPARG_FL_RETURN : 0) | TPARG_FL_USER,
 		};
@@ -854,9 +856,11 @@
 struct uprobe_cpu_buffer {
 	struct mutex mutex;
 	void *buf;
+	int dsize;
 };
 static struct uprobe_cpu_buffer __percpu *uprobe_cpu_buffer;
 static int uprobe_buffer_refcnt;
+#define MAX_UCB_BUFFER_SIZE PAGE_SIZE
 
 static int uprobe_buffer_init(void)
 {
@@ -940,12 +944,41 @@
 
 static void uprobe_buffer_put(struct uprobe_cpu_buffer *ucb)
 {
+	if (!ucb)
+		return;
 	mutex_unlock(&ucb->mutex);
 }
 
+static struct uprobe_cpu_buffer *prepare_uprobe_buffer(struct trace_uprobe *tu,
+						       struct pt_regs *regs,
+						       struct uprobe_cpu_buffer **ucbp)
+{
+	struct uprobe_cpu_buffer *ucb;
+	int dsize, esize;
+
+	if (*ucbp)
+		return *ucbp;
+
+	esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
+	dsize = __get_data_size(&tu->tp, regs, NULL);
+
+	ucb = uprobe_buffer_get();
+	ucb->dsize = tu->tp.size + dsize;
+
+	if (WARN_ON_ONCE(ucb->dsize > MAX_UCB_BUFFER_SIZE)) {
+		ucb->dsize = MAX_UCB_BUFFER_SIZE;
+		dsize = MAX_UCB_BUFFER_SIZE - tu->tp.size;
+	}
+
+	store_trace_args(ucb->buf, &tu->tp, regs, NULL, esize, dsize);
+
+	*ucbp = ucb;
+	return ucb;
+}
+
 static void __uprobe_trace_func(struct trace_uprobe *tu,
 				unsigned long func, struct pt_regs *regs,
-				struct uprobe_cpu_buffer *ucb, int dsize,
+				struct uprobe_cpu_buffer *ucb,
 				struct trace_event_file *trace_file)
 {
 	struct uprobe_trace_entry_head *entry;
@@ -956,14 +989,11 @@
 
 	WARN_ON(call != trace_file->event_call);
 
-	if (WARN_ON_ONCE(tu->tp.size + dsize > PAGE_SIZE))
-		return;
-
 	if (trace_trigger_soft_disabled(trace_file))
 		return;
 
 	esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
-	size = esize + tu->tp.size + dsize;
+	size = esize + ucb->dsize;
 	entry = trace_event_buffer_reserve(&fbuffer, trace_file, size);
 	if (!entry)
 		return;
@@ -977,23 +1007,26 @@
 		data = DATAOF_TRACE_ENTRY(entry, false);
 	}
 
-	memcpy(data, ucb->buf, tu->tp.size + dsize);
+	memcpy(data, ucb->buf, ucb->dsize);
 
 	trace_event_buffer_commit(&fbuffer);
 }
 
 /* uprobe handler */
 static int uprobe_trace_func(struct trace_uprobe *tu, struct pt_regs *regs,
-			     struct uprobe_cpu_buffer *ucb, int dsize)
+			     struct uprobe_cpu_buffer **ucbp)
 {
 	struct event_file_link *link;
+	struct uprobe_cpu_buffer *ucb;
 
 	if (is_ret_probe(tu))
 		return 0;
 
+	ucb = prepare_uprobe_buffer(tu, regs, ucbp);
+
 	rcu_read_lock();
 	trace_probe_for_each_link_rcu(link, &tu->tp)
-		__uprobe_trace_func(tu, 0, regs, ucb, dsize, link->file);
+		__uprobe_trace_func(tu, 0, regs, ucb, link->file);
 	rcu_read_unlock();
 
 	return 0;
@@ -1001,13 +1034,16 @@
 
 static void uretprobe_trace_func(struct trace_uprobe *tu, unsigned long func,
 				 struct pt_regs *regs,
-				 struct uprobe_cpu_buffer *ucb, int dsize)
+				 struct uprobe_cpu_buffer **ucbp)
 {
 	struct event_file_link *link;
+	struct uprobe_cpu_buffer *ucb;
+
+	ucb = prepare_uprobe_buffer(tu, regs, ucbp);
 
 	rcu_read_lock();
 	trace_probe_for_each_link_rcu(link, &tu->tp)
-		__uprobe_trace_func(tu, func, regs, ucb, dsize, link->file);
+		__uprobe_trace_func(tu, func, regs, ucb, link->file);
 	rcu_read_unlock();
 }
 
@@ -1335,10 +1371,11 @@
 
 static void __uprobe_perf_func(struct trace_uprobe *tu,
 			       unsigned long func, struct pt_regs *regs,
-			       struct uprobe_cpu_buffer *ucb, int dsize)
+			       struct uprobe_cpu_buffer **ucbp)
 {
 	struct trace_event_call *call = trace_probe_event_call(&tu->tp);
 	struct uprobe_trace_entry_head *entry;
+	struct uprobe_cpu_buffer *ucb;
 	struct hlist_head *head;
 	void *data;
 	int size, esize;
@@ -1346,9 +1383,13 @@
 
 #ifdef CONFIG_BPF_EVENTS
 	if (bpf_prog_array_valid(call)) {
+		const struct bpf_prog_array *array;
 		u32 ret;
 
-		ret = bpf_prog_run_array_uprobe(call->prog_array, regs, bpf_prog_run);
+		rcu_read_lock_trace();
+		array = rcu_dereference_check(call->prog_array, rcu_read_lock_trace_held());
+		ret = bpf_prog_run_array_uprobe(array, regs, bpf_prog_run);
+		rcu_read_unlock_trace();
 		if (!ret)
 			return;
 	}
@@ -1356,7 +1397,8 @@
 
 	esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
 
-	size = esize + tu->tp.size + dsize;
+	ucb = prepare_uprobe_buffer(tu, regs, ucbp);
+	size = esize + ucb->dsize;
 	size = ALIGN(size + sizeof(u32), sizeof(u64)) - sizeof(u32);
 	if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE, "profile buffer not large enough"))
 		return;
@@ -1379,13 +1421,10 @@
 		data = DATAOF_TRACE_ENTRY(entry, false);
 	}
 
-	memcpy(data, ucb->buf, tu->tp.size + dsize);
-
-	if (size - esize > tu->tp.size + dsize) {
-		int len = tu->tp.size + dsize;
+	memcpy(data, ucb->buf, ucb->dsize);
 
-		memset(data + len, 0, size - esize - len);
-	}
+	if (size - esize > ucb->dsize)
+		memset(data + ucb->dsize, 0, size - esize - ucb->dsize);
 
 	perf_trace_buf_submit(entry, size, rctx, call->event.type, 1, regs,
 			      head, NULL);
@@ -1395,21 +1434,21 @@
 
 /* uprobe profile handler */
 static int uprobe_perf_func(struct trace_uprobe *tu, struct pt_regs *regs,
-			    struct uprobe_cpu_buffer *ucb, int dsize)
+			    struct uprobe_cpu_buffer **ucbp)
 {
 	if (!uprobe_perf_filter(&tu->consumer, 0, current->mm))
 		return UPROBE_HANDLER_REMOVE;
 
 	if (!is_ret_probe(tu))
-		__uprobe_perf_func(tu, 0, regs, ucb, dsize);
+		__uprobe_perf_func(tu, 0, regs, ucbp);
 	return 0;
 }
 
 static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func,
 				struct pt_regs *regs,
-				struct uprobe_cpu_buffer *ucb, int dsize)
+				struct uprobe_cpu_buffer **ucbp)
 {
-	__uprobe_perf_func(tu, func, regs, ucb, dsize);
+	__uprobe_perf_func(tu, func, regs, ucbp);
 }
 
 int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type,
@@ -1474,11 +1513,9 @@
 {
 	struct trace_uprobe *tu;
 	struct uprobe_dispatch_data udd;
-	struct uprobe_cpu_buffer *ucb;
-	int dsize, esize;
+	struct uprobe_cpu_buffer *ucb = NULL;
 	int ret = 0;
 
-
 	tu = container_of(con, struct trace_uprobe, consumer);
 	tu->nhit++;
 
@@ -1490,18 +1527,12 @@
 	if (WARN_ON_ONCE(!uprobe_cpu_buffer))
 		return 0;
 
-	dsize = __get_data_size(&tu->tp, regs);
-	esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
-
-	ucb = uprobe_buffer_get();
-	store_trace_args(ucb->buf, &tu->tp, regs, esize, dsize);
-
 	if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
-		ret |= uprobe_trace_func(tu, regs, ucb, dsize);
+		ret |= uprobe_trace_func(tu, regs, &ucb);
 
 #ifdef CONFIG_PERF_EVENTS
 	if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
-		ret |= uprobe_perf_func(tu, regs, ucb, dsize);
+		ret |= uprobe_perf_func(tu, regs, &ucb);
 #endif
 	uprobe_buffer_put(ucb);
 	return ret;
@@ -1512,8 +1543,7 @@
 {
 	struct trace_uprobe *tu;
 	struct uprobe_dispatch_data udd;
-	struct uprobe_cpu_buffer *ucb;
-	int dsize, esize;
+	struct uprobe_cpu_buffer *ucb = NULL;
 
 	tu = container_of(con, struct trace_uprobe, consumer);
 
@@ -1525,18 +1555,12 @@
 	if (WARN_ON_ONCE(!uprobe_cpu_buffer))
 		return 0;
 
-	dsize = __get_data_size(&tu->tp, regs);
-	esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));
-
-	ucb = uprobe_buffer_get();
-	store_trace_args(ucb->buf, &tu->tp, regs, esize, dsize);
-
 	if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
-		uretprobe_trace_func(tu, func, regs, ucb, dsize);
+		uretprobe_trace_func(tu, func, regs, &ucb);
 
 #ifdef CONFIG_PERF_EVENTS
 	if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
-		uretprobe_perf_func(tu, func, regs, ucb, dsize);
+		uretprobe_perf_func(tu, func, regs, &ucb);
 #endif
 	uprobe_buffer_put(ucb);
 	return 0;
--- linux-qcom-6.8.0.orig/kernel/trace/tracing_map.c
+++ linux-qcom-6.8.0/kernel/trace/tracing_map.c
@@ -454,7 +454,7 @@
 	struct tracing_map_elt *elt = NULL;
 	int idx;
 
-	idx = atomic_inc_return(&map->next_elt);
+	idx = atomic_fetch_add_unless(&map->next_elt, 1, map->max_elts);
 	if (idx < map->max_elts) {
 		elt = *(TRACING_MAP_ELT(map->elts, idx));
 		if (map->ops && map->ops->elt_init)
@@ -699,7 +699,7 @@
 {
 	unsigned int i;
 
-	atomic_set(&map->next_elt, -1);
+	atomic_set(&map->next_elt, 0);
 	atomic64_set(&map->hits, 0);
 	atomic64_set(&map->drops, 0);
 
@@ -783,7 +783,7 @@
 
 	map->map_bits = map_bits;
 	map->max_elts = (1 << map_bits);
-	atomic_set(&map->next_elt, -1);
+	atomic_set(&map->next_elt, 0);
 
 	map->map_size = (1 << (map_bits + 1));
 	map->ops = ops;
@@ -845,15 +845,11 @@
 static int cmp_entries_dup(const void *A, const void *B)
 {
 	const struct tracing_map_sort_entry *a, *b;
-	int ret = 0;
 
 	a = *(const struct tracing_map_sort_entry **)A;
 	b = *(const struct tracing_map_sort_entry **)B;
 
-	if (memcmp(a->key, b->key, a->elt->map->key_size))
-		ret = 1;
-
-	return ret;
+	return memcmp(a->key, b->key, a->elt->map->key_size);
 }
 
 static int cmp_entries_sum(const void *A, const void *B)
--- linux-qcom-6.8.0.orig/kernel/ucount.c
+++ linux-qcom-6.8.0/kernel/ucount.c
@@ -308,7 +308,8 @@
 	do_dec_rlimit_put_ucounts(ucounts, NULL, type);
 }
 
-long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type)
+long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type,
+			    bool override_rlimit)
 {
 	/* Caller must hold a reference to ucounts */
 	struct ucounts *iter;
@@ -318,10 +319,11 @@
 	for (iter = ucounts; iter; iter = iter->ns->ucounts) {
 		long new = atomic_long_add_return(1, &iter->rlimit[type]);
 		if (new < 0 || new > max)
-			goto unwind;
+			goto dec_unwind;
 		if (iter == ucounts)
 			ret = new;
-		max = get_userns_rlimit_max(iter->ns, type);
+		if (!override_rlimit)
+			max = get_userns_rlimit_max(iter->ns, type);
 		/*
 		 * Grab an extra ucount reference for the caller when
 		 * the rlimit count was previously 0.
@@ -335,7 +337,6 @@
 dec_unwind:
 	dec = atomic_long_sub_return(1, &iter->rlimit[type]);
 	WARN_ON_ONCE(dec < 0);
-unwind:
 	do_dec_rlimit_put_ucounts(ucounts, iter, type);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/kernel/user_namespace.c
+++ linux-qcom-6.8.0/kernel/user_namespace.c
@@ -22,6 +22,12 @@
 #include <linux/bsearch.h>
 #include <linux/sort.h>
 
+/*
+ * sysctl determining whether unprivileged users may unshare a new
+ * userns.  Allowed by default
+ */
+int unprivileged_userns_clone = 1;
+
 static struct kmem_cache *user_ns_cachep __ro_after_init;
 static DEFINE_MUTEX(userns_state_mutex);
 
--- linux-qcom-6.8.0.orig/kernel/vhost_task.c
+++ linux-qcom-6.8.0/kernel/vhost_task.c
@@ -10,38 +10,32 @@
 
 enum vhost_task_flags {
 	VHOST_TASK_FLAGS_STOP,
+	VHOST_TASK_FLAGS_KILLED,
 };
 
 struct vhost_task {
 	bool (*fn)(void *data);
+	void (*handle_sigkill)(void *data);
 	void *data;
 	struct completion exited;
 	unsigned long flags;
 	struct task_struct *task;
+	/* serialize SIGKILL and vhost_task_stop calls */
+	struct mutex exit_mutex;
 };
 
 static int vhost_task_fn(void *data)
 {
 	struct vhost_task *vtsk = data;
-	bool dead = false;
 
 	for (;;) {
 		bool did_work;
 
-		if (!dead && signal_pending(current)) {
+		if (signal_pending(current)) {
 			struct ksignal ksig;
-			/*
-			 * Calling get_signal will block in SIGSTOP,
-			 * or clear fatal_signal_pending, but remember
-			 * what was set.
-			 *
-			 * This thread won't actually exit until all
-			 * of the file descriptors are closed, and
-			 * the release function is called.
-			 */
-			dead = get_signal(&ksig);
-			if (dead)
-				clear_thread_flag(TIF_SIGPENDING);
+
+			if (get_signal(&ksig))
+				break;
 		}
 
 		/* mb paired w/ vhost_task_stop */
@@ -57,7 +51,19 @@
 			schedule();
 	}
 
+	mutex_lock(&vtsk->exit_mutex);
+	/*
+	 * If a vhost_task_stop and SIGKILL race, we can ignore the SIGKILL.
+	 * When the vhost layer has called vhost_task_stop it's already stopped
+	 * new work and flushed.
+	 */
+	if (!test_bit(VHOST_TASK_FLAGS_STOP, &vtsk->flags)) {
+		set_bit(VHOST_TASK_FLAGS_KILLED, &vtsk->flags);
+		vtsk->handle_sigkill(vtsk->data);
+	}
+	mutex_unlock(&vtsk->exit_mutex);
 	complete(&vtsk->exited);
+
 	do_exit(0);
 }
 
@@ -78,12 +84,17 @@
  * @vtsk: vhost_task to stop
  *
  * vhost_task_fn ensures the worker thread exits after
- * VHOST_TASK_FLAGS_SOP becomes true.
+ * VHOST_TASK_FLAGS_STOP becomes true.
  */
 void vhost_task_stop(struct vhost_task *vtsk)
 {
-	set_bit(VHOST_TASK_FLAGS_STOP, &vtsk->flags);
-	vhost_task_wake(vtsk);
+	mutex_lock(&vtsk->exit_mutex);
+	if (!test_bit(VHOST_TASK_FLAGS_KILLED, &vtsk->flags)) {
+		set_bit(VHOST_TASK_FLAGS_STOP, &vtsk->flags);
+		vhost_task_wake(vtsk);
+	}
+	mutex_unlock(&vtsk->exit_mutex);
+
 	/*
 	 * Make sure vhost_task_fn is no longer accessing the vhost_task before
 	 * freeing it below.
@@ -96,14 +107,16 @@
 /**
  * vhost_task_create - create a copy of a task to be used by the kernel
  * @fn: vhost worker function
- * @arg: data to be passed to fn
+ * @handle_sigkill: vhost function to handle when we are killed
+ * @arg: data to be passed to fn and handled_kill
  * @name: the thread's name
  *
  * This returns a specialized task for use by the vhost layer or NULL on
  * failure. The returned task is inactive, and the caller must fire it up
  * through vhost_task_start().
  */
-struct vhost_task *vhost_task_create(bool (*fn)(void *), void *arg,
+struct vhost_task *vhost_task_create(bool (*fn)(void *),
+				     void (*handle_sigkill)(void *), void *arg,
 				     const char *name)
 {
 	struct kernel_clone_args args = {
@@ -120,17 +133,19 @@
 
 	vtsk = kzalloc(sizeof(*vtsk), GFP_KERNEL);
 	if (!vtsk)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 	init_completion(&vtsk->exited);
+	mutex_init(&vtsk->exit_mutex);
 	vtsk->data = arg;
 	vtsk->fn = fn;
+	vtsk->handle_sigkill = handle_sigkill;
 
 	args.fn_arg = vtsk;
 
 	tsk = copy_process(NULL, 0, NUMA_NO_NODE, &args);
 	if (IS_ERR(tsk)) {
 		kfree(vtsk);
-		return NULL;
+		return ERR_PTR(PTR_ERR(tsk));
 	}
 
 	vtsk->task = tsk;
--- linux-qcom-6.8.0.orig/kernel/watchdog_perf.c
+++ linux-qcom-6.8.0/kernel/watchdog_perf.c
@@ -75,11 +75,15 @@
 	__this_cpu_write(last_timestamp, now);
 	return true;
 }
-#else
-static inline bool watchdog_check_timestamp(void)
+
+static void watchdog_init_timestamp(void)
 {
-	return true;
+	__this_cpu_write(nmi_rearmed, 0);
+	__this_cpu_write(last_timestamp, ktime_get_mono_fast_ns());
 }
+#else
+static inline bool watchdog_check_timestamp(void) { return true; }
+static inline void watchdog_init_timestamp(void) { }
 #endif
 
 static struct perf_event_attr wd_hw_attr = {
@@ -147,6 +151,7 @@
 	if (!atomic_fetch_inc(&watchdog_cpus))
 		pr_info("Enabled. Permanently consumes one hw-PMU counter.\n");
 
+	watchdog_init_timestamp();
 	perf_event_enable(this_cpu_read(watchdog_ev));
 }
 
--- linux-qcom-6.8.0.orig/kernel/workqueue.c
+++ linux-qcom-6.8.0/kernel/workqueue.c
@@ -1141,8 +1141,12 @@
 	    !cpumask_test_cpu(p->wake_cpu, pool->attrs->__pod_cpumask)) {
 		struct work_struct *work = list_first_entry(&pool->worklist,
 						struct work_struct, entry);
-		p->wake_cpu = cpumask_any_distribute(pool->attrs->__pod_cpumask);
-		get_work_pwq(work)->stats[PWQ_STAT_REPATRIATED]++;
+		int wake_cpu = cpumask_any_and_distribute(pool->attrs->__pod_cpumask,
+							  cpu_online_mask);
+		if (wake_cpu < nr_cpu_ids) {
+			p->wake_cpu = wake_cpu;
+			get_work_pwq(work)->stats[PWQ_STAT_REPATRIATED]++;
+		}
 	}
 #endif
 	wake_up_process(p);
@@ -1744,9 +1748,13 @@
 	 * If @work was previously on a different pool, it might still be
 	 * running there, in which case the work needs to be queued on that
 	 * pool to guarantee non-reentrancy.
+	 *
+	 * For ordered workqueue, work items must be queued on the newest pwq
+	 * for accurate order management.  Guaranteed order also guarantees
+	 * non-reentrancy.  See the comments above unplug_oldest_pwq().
 	 */
 	last_pool = get_work_pool(work);
-	if (last_pool && last_pool != pool) {
+	if (last_pool && last_pool != pool && !(wq->flags & __WQ_ORDERED)) {
 		struct worker *worker;
 
 		raw_spin_lock(&last_pool->lock);
@@ -2543,6 +2551,7 @@
 	struct pool_workqueue *pwq = get_work_pwq(work);
 	struct worker_pool *pool = worker->pool;
 	unsigned long work_data;
+	int lockdep_start_depth, rcu_start_depth;
 #ifdef CONFIG_LOCKDEP
 	/*
 	 * It is permissible to free the struct work_struct from
@@ -2605,6 +2614,8 @@
 	pwq->stats[PWQ_STAT_STARTED]++;
 	raw_spin_unlock_irq(&pool->lock);
 
+	rcu_start_depth = rcu_preempt_depth();
+	lockdep_start_depth = lockdep_depth(current);
 	lock_map_acquire(&pwq->wq->lockdep_map);
 	lock_map_acquire(&lockdep_map);
 	/*
@@ -2640,10 +2651,14 @@
 	lock_map_release(&lockdep_map);
 	lock_map_release(&pwq->wq->lockdep_map);
 
-	if (unlikely(in_atomic() || lockdep_depth(current) > 0)) {
-		pr_err("BUG: workqueue leaked lock or atomic: %s/0x%08x/%d\n"
-		       "     last function: %ps\n",
-		       current->comm, preempt_count(), task_pid_nr(current),
+	if (unlikely((worker->task && in_atomic()) ||
+		     lockdep_depth(current) != lockdep_start_depth ||
+		     rcu_preempt_depth() != rcu_start_depth)) {
+		pr_err("BUG: workqueue leaked atomic, lock or RCU: %s[%d]\n"
+		       "     preempt=0x%08x lock=%d->%d RCU=%d->%d workfn=%ps\n",
+		       current->comm, task_pid_nr(current), preempt_count(),
+		       lockdep_start_depth, lockdep_depth(current),
+		       rcu_start_depth, rcu_preempt_depth(),
 		       worker->current_func);
 		debug_show_held_locks(current);
 		dump_stack();
@@ -2942,23 +2957,27 @@
  * check_flush_dependency - check for flush dependency sanity
  * @target_wq: workqueue being flushed
  * @target_work: work item being flushed (NULL for workqueue flushes)
+ * @from_cancel: are we called from the work cancel path
  *
  * %current is trying to flush the whole @target_wq or @target_work on it.
- * If @target_wq doesn't have %WQ_MEM_RECLAIM, verify that %current is not
- * reclaiming memory or running on a workqueue which doesn't have
- * %WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to
- * a deadlock.
+ * If this is not the cancel path (which implies work being flushed is either
+ * already running, or will not be at all), check if @target_wq doesn't have
+ * %WQ_MEM_RECLAIM and verify that %current is not reclaiming memory or running
+ * on a workqueue which doesn't have %WQ_MEM_RECLAIM as that can break forward-
+ * progress guarantee leading to a deadlock.
  */
 static void check_flush_dependency(struct workqueue_struct *target_wq,
-				   struct work_struct *target_work)
+				   struct work_struct *target_work,
+				   bool from_cancel)
 {
-	work_func_t target_func = target_work ? target_work->func : NULL;
+	work_func_t target_func;
 	struct worker *worker;
 
-	if (target_wq->flags & WQ_MEM_RECLAIM)
+	if (from_cancel || target_wq->flags & WQ_MEM_RECLAIM)
 		return;
 
 	worker = current_wq_worker();
+	target_func = target_work ? target_work->func : NULL;
 
 	WARN_ONCE(current->flags & PF_MEMALLOC,
 		  "workqueue: PF_MEMALLOC task %d(%s) is flushing !WQ_MEM_RECLAIM %s:%ps",
@@ -3124,6 +3143,19 @@
 	return wait;
 }
 
+static void touch_wq_lockdep_map(struct workqueue_struct *wq)
+{
+	lock_map_acquire(&wq->lockdep_map);
+	lock_map_release(&wq->lockdep_map);
+}
+
+static void touch_work_lockdep_map(struct work_struct *work,
+				   struct workqueue_struct *wq)
+{
+	lock_map_acquire(&work->lockdep_map);
+	lock_map_release(&work->lockdep_map);
+}
+
 /**
  * __flush_workqueue - ensure that any scheduled work has run to completion.
  * @wq: workqueue to flush
@@ -3143,8 +3175,7 @@
 	if (WARN_ON(!wq_online))
 		return;
 
-	lock_map_acquire(&wq->lockdep_map);
-	lock_map_release(&wq->lockdep_map);
+	touch_wq_lockdep_map(wq);
 
 	mutex_lock(&wq->mutex);
 
@@ -3191,7 +3222,7 @@
 		list_add_tail(&this_flusher.list, &wq->flusher_overflow);
 	}
 
-	check_flush_dependency(wq, NULL);
+	check_flush_dependency(wq, NULL, false);
 
 	mutex_unlock(&wq->mutex);
 
@@ -3343,6 +3374,7 @@
 	struct worker *worker = NULL;
 	struct worker_pool *pool;
 	struct pool_workqueue *pwq;
+	struct workqueue_struct *wq;
 
 	might_sleep();
 
@@ -3366,11 +3398,14 @@
 		pwq = worker->current_pwq;
 	}
 
-	check_flush_dependency(pwq->wq, work);
+	wq = pwq->wq;
+	check_flush_dependency(wq, work, from_cancel);
 
 	insert_wq_barrier(pwq, barr, work, worker);
 	raw_spin_unlock_irq(&pool->lock);
 
+	touch_work_lockdep_map(work, wq);
+
 	/*
 	 * Force a lock recursion deadlock when using flush_work() inside a
 	 * single-threaded or rescuer equipped workqueue.
@@ -3380,11 +3415,9 @@
 	 * workqueues the deadlock happens when the rescuer stalls, blocking
 	 * forward progress.
 	 */
-	if (!from_cancel &&
-	    (pwq->wq->saved_max_active == 1 || pwq->wq->rescuer)) {
-		lock_map_acquire(&pwq->wq->lockdep_map);
-		lock_map_release(&pwq->wq->lockdep_map);
-	}
+	if (!from_cancel && (wq->saved_max_active == 1 || wq->rescuer))
+		touch_wq_lockdep_map(wq);
+
 	rcu_read_unlock();
 	return true;
 already_gone:
@@ -3403,9 +3436,6 @@
 	if (WARN_ON(!work->func))
 		return false;
 
-	lock_map_acquire(&work->lockdep_map);
-	lock_map_release(&work->lockdep_map);
-
 	if (start_flush_work(work, &barr, from_cancel)) {
 		wait_for_completion(&barr.done);
 		destroy_work_on_stack(&barr.work);
@@ -6524,10 +6554,18 @@
 
 notrace void wq_watchdog_touch(int cpu)
 {
+	unsigned long thresh = READ_ONCE(wq_watchdog_thresh) * HZ;
+	unsigned long touch_ts = READ_ONCE(wq_watchdog_touched);
+	unsigned long now = jiffies;
+
 	if (cpu >= 0)
-		per_cpu(wq_watchdog_touched_cpu, cpu) = jiffies;
+		per_cpu(wq_watchdog_touched_cpu, cpu) = now;
+	else
+		WARN_ONCE(1, "%s should be called with valid CPU", __func__);
 
-	wq_watchdog_touched = jiffies;
+	/* Don't unnecessarily store to global cacheline */
+	if (time_after(now, touch_ts + thresh / 4))
+		WRITE_ONCE(wq_watchdog_touched, jiffies);
 }
 
 static void wq_watchdog_set_thresh(unsigned long thresh)
--- linux-qcom-6.8.0.orig/lib/Kconfig
+++ linux-qcom-6.8.0/lib/Kconfig
@@ -542,13 +542,7 @@
 	  stack overflow.
 
 config FORCE_NR_CPUS
-       bool "Set number of CPUs at compile time"
-       depends on SMP && EXPERT && !COMPILE_TEST
-       help
-         Say Yes if you have NR_CPUS set to an actual number of possible
-         CPUs in your system, not to a default value. This forces the core
-         code to rely on compile-time value and optimize kernel routines
-         better.
+	def_bool !SMP
 
 config CPU_RMAP
 	bool
--- linux-qcom-6.8.0.orig/lib/Kconfig.debug
+++ linux-qcom-6.8.0/lib/Kconfig.debug
@@ -375,7 +375,7 @@
 	  Incompatible with older versions of ccache.
 
 config DEBUG_INFO_BTF
-	bool "Generate BTF typeinfo"
+	bool "Generate BTF type information"
 	depends on !DEBUG_INFO_SPLIT && !DEBUG_INFO_REDUCED
 	depends on !GCC_PLUGIN_RANDSTRUCT || COMPILE_TEST
 	depends on BPF_SYSCALL
@@ -408,7 +408,8 @@
 	  using DEBUG_INFO_BTF_MODULES.
 
 config DEBUG_INFO_BTF_MODULES
-	def_bool y
+	bool "Generate BTF type information for kernel modules"
+	default y
 	depends on DEBUG_INFO_BTF && MODULES && PAHOLE_HAS_SPLIT_BTF
 	help
 	  Generate compact split BTF type information for kernel modules.
@@ -3019,7 +3020,7 @@
 	bool "Allow unoptimized build-time assertions"
 	depends on RUST
 	help
-	  Controls how are `build_error!` and `build_assert!` handled during build.
+	  Controls how `build_error!` and `build_assert!` are handled during the build.
 
 	  If calls to them exist in the binary, it may indicate a violated invariant
 	  or that the optimizer failed to verify the invariant during compilation.
--- linux-qcom-6.8.0.orig/lib/Kconfig.ubsan
+++ linux-qcom-6.8.0/lib/Kconfig.ubsan
@@ -1,9 +1,10 @@
 # SPDX-License-Identifier: GPL-2.0-only
-config ARCH_HAS_UBSAN_SANITIZE_ALL
+config ARCH_HAS_UBSAN
 	bool
 
 menuconfig UBSAN
 	bool "Undefined behaviour sanity checker"
+	depends on ARCH_HAS_UBSAN
 	help
 	  This option enables the Undefined Behaviour sanity checker.
 	  Compile-time instrumentation is used to detect various undefined
@@ -28,8 +29,8 @@
 
 	  Also note that selecting Y will cause your kernel to Oops
 	  with an "illegal instruction" error with no further details
-	  when a UBSAN violation occurs. (Except on arm64, which will
-	  report which Sanitizer failed.) This may make it hard to
+	  when a UBSAN violation occurs. (Except on arm64 and x86, which
+	  will report which Sanitizer failed.) This may make it hard to
 	  determine whether an Oops was caused by UBSAN or to figure
 	  out the details of a UBSAN violation. It makes the kernel log
 	  output less useful for bug reports.
@@ -142,17 +143,6 @@
 	  Enabling this option on architectures that support unaligned
 	  accesses may produce a lot of false positives.
 
-config UBSAN_SANITIZE_ALL
-	bool "Enable instrumentation for the entire kernel"
-	depends on ARCH_HAS_UBSAN_SANITIZE_ALL
-	default y
-	help
-	  This option activates instrumentation for the entire kernel.
-	  If you don't enable this option, you have to explicitly specify
-	  UBSAN_SANITIZE := y for the files/directories you want to check for UB.
-	  Enabling this option will get kernel image size increased
-	  significantly.
-
 config TEST_UBSAN
 	tristate "Module for testing for undefined behavior detection"
 	depends on m
--- linux-qcom-6.8.0.orig/lib/bootconfig.c
+++ linux-qcom-6.8.0/lib/bootconfig.c
@@ -61,9 +61,12 @@
 	return memblock_alloc(size, SMP_CACHE_BYTES);
 }
 
-static inline void __init xbc_free_mem(void *addr, size_t size)
+static inline void __init xbc_free_mem(void *addr, size_t size, bool early)
 {
-	memblock_free(addr, size);
+	if (early)
+		memblock_free(addr, size);
+	else if (addr)
+		memblock_free_late(__pa(addr), size);
 }
 
 #else /* !__KERNEL__ */
@@ -73,7 +76,7 @@
 	return malloc(size);
 }
 
-static inline void xbc_free_mem(void *addr, size_t size)
+static inline void xbc_free_mem(void *addr, size_t size, bool early)
 {
 	free(addr);
 }
@@ -898,19 +901,20 @@
 }
 
 /**
- * xbc_exit() - Clean up all parsed bootconfig
+ * _xbc_exit() - Clean up all parsed bootconfig
+ * @early: Set true if this is called before budy system is initialized.
  *
  * This clears all data structures of parsed bootconfig on memory.
  * If you need to reuse xbc_init() with new boot config, you can
  * use this.
  */
-void __init xbc_exit(void)
+void __init _xbc_exit(bool early)
 {
-	xbc_free_mem(xbc_data, xbc_data_size);
+	xbc_free_mem(xbc_data, xbc_data_size, early);
 	xbc_data = NULL;
 	xbc_data_size = 0;
 	xbc_node_num = 0;
-	xbc_free_mem(xbc_nodes, sizeof(struct xbc_node) * XBC_NODE_MAX);
+	xbc_free_mem(xbc_nodes, sizeof(struct xbc_node) * XBC_NODE_MAX, early);
 	xbc_nodes = NULL;
 	brace_index = 0;
 }
@@ -963,7 +967,7 @@
 	if (!xbc_nodes) {
 		if (emsg)
 			*emsg = "Failed to allocate bootconfig nodes";
-		xbc_exit();
+		_xbc_exit(true);
 		return -ENOMEM;
 	}
 	memset(xbc_nodes, 0, sizeof(struct xbc_node) * XBC_NODE_MAX);
@@ -977,7 +981,7 @@
 			*epos = xbc_err_pos;
 		if (emsg)
 			*emsg = xbc_err_msg;
-		xbc_exit();
+		_xbc_exit(true);
 	} else
 		ret = xbc_node_num;
 
--- linux-qcom-6.8.0.orig/lib/build_OID_registry
+++ linux-qcom-6.8.0/lib/build_OID_registry
@@ -8,6 +8,7 @@
 #
 
 use strict;
+use Cwd qw(abs_path);
 
 my @names = ();
 my @oids = ();
@@ -17,6 +18,8 @@
     exit(2);
 }
 
+my $abs_srctree = abs_path($ENV{'srctree'});
+
 #
 # Open the file to read from
 #
@@ -35,7 +38,9 @@
 #
 open C_FILE, ">$ARGV[1]" or die;
 print C_FILE "/*\n";
-print C_FILE " * Automatically generated by ", $0, ".  Do not edit\n";
+my $scriptname = $0;
+$scriptname =~ s#^\Q$abs_srctree/\E##;
+print C_FILE " * Automatically generated by ", $scriptname, ".  Do not edit\n";
 print C_FILE " */\n";
 
 #
--- linux-qcom-6.8.0.orig/lib/buildid.c
+++ linux-qcom-6.8.0/lib/buildid.c
@@ -18,31 +18,37 @@
 			      const void *note_start,
 			      Elf32_Word note_size)
 {
-	Elf32_Word note_offs = 0, new_offs;
-
-	while (note_offs + sizeof(Elf32_Nhdr) < note_size) {
-		Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_offs);
+	const char note_name[] = "GNU";
+	const size_t note_name_sz = sizeof(note_name);
+	u64 note_off = 0, new_off, name_sz, desc_sz;
+	const char *data;
+
+	while (note_off + sizeof(Elf32_Nhdr) < note_size &&
+	       note_off + sizeof(Elf32_Nhdr) > note_off /* overflow */) {
+		Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_off);
+
+		name_sz = READ_ONCE(nhdr->n_namesz);
+		desc_sz = READ_ONCE(nhdr->n_descsz);
+
+		new_off = note_off + sizeof(Elf32_Nhdr);
+		if (check_add_overflow(new_off, ALIGN(name_sz, 4), &new_off) ||
+		    check_add_overflow(new_off, ALIGN(desc_sz, 4), &new_off) ||
+		    new_off > note_size)
+			break;
 
 		if (nhdr->n_type == BUILD_ID &&
-		    nhdr->n_namesz == sizeof("GNU") &&
-		    !strcmp((char *)(nhdr + 1), "GNU") &&
-		    nhdr->n_descsz > 0 &&
-		    nhdr->n_descsz <= BUILD_ID_SIZE_MAX) {
-			memcpy(build_id,
-			       note_start + note_offs +
-			       ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr),
-			       nhdr->n_descsz);
-			memset(build_id + nhdr->n_descsz, 0,
-			       BUILD_ID_SIZE_MAX - nhdr->n_descsz);
+		    name_sz == note_name_sz &&
+		    memcmp(nhdr + 1, note_name, note_name_sz) == 0 &&
+		    desc_sz > 0 && desc_sz <= BUILD_ID_SIZE_MAX) {
+			data = note_start + note_off + sizeof(Elf32_Nhdr) + ALIGN(note_name_sz, 4);
+			memcpy(build_id, data, desc_sz);
+			memset(build_id + desc_sz, 0, BUILD_ID_SIZE_MAX - desc_sz);
 			if (size)
-				*size = nhdr->n_descsz;
+				*size = desc_sz;
 			return 0;
 		}
-		new_offs = note_offs + sizeof(Elf32_Nhdr) +
-			ALIGN(nhdr->n_namesz, 4) + ALIGN(nhdr->n_descsz, 4);
-		if (new_offs <= note_offs)  /* overflow */
-			break;
-		note_offs = new_offs;
+
+		note_off = new_off;
 	}
 
 	return -EINVAL;
@@ -71,20 +77,28 @@
 {
 	Elf32_Ehdr *ehdr = (Elf32_Ehdr *)page_addr;
 	Elf32_Phdr *phdr;
-	int i;
+	__u32 i, phnum;
 
+	/*
+	 * FIXME
+	 * Neither ELF spec nor ELF loader require that program headers
+	 * start immediately after ELF header.
+	 */
+	if (ehdr->e_phoff != sizeof(Elf32_Ehdr))
+		return -EINVAL;
+
+	phnum = READ_ONCE(ehdr->e_phnum);
 	/* only supports phdr that fits in one page */
-	if (ehdr->e_phnum >
-	    (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr))
+	if (phnum > (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr))
 		return -EINVAL;
 
 	phdr = (Elf32_Phdr *)(page_addr + sizeof(Elf32_Ehdr));
 
-	for (i = 0; i < ehdr->e_phnum; ++i) {
+	for (i = 0; i < phnum; ++i) {
 		if (phdr[i].p_type == PT_NOTE &&
 		    !parse_build_id(page_addr, build_id, size,
-				    page_addr + phdr[i].p_offset,
-				    phdr[i].p_filesz))
+				    page_addr + READ_ONCE(phdr[i].p_offset),
+				    READ_ONCE(phdr[i].p_filesz)))
 			return 0;
 	}
 	return -EINVAL;
@@ -96,20 +110,28 @@
 {
 	Elf64_Ehdr *ehdr = (Elf64_Ehdr *)page_addr;
 	Elf64_Phdr *phdr;
-	int i;
+	__u32 i, phnum;
+
+	/*
+	 * FIXME
+	 * Neither ELF spec nor ELF loader require that program headers
+	 * start immediately after ELF header.
+	 */
+	if (ehdr->e_phoff != sizeof(Elf64_Ehdr))
+		return -EINVAL;
 
+	phnum = READ_ONCE(ehdr->e_phnum);
 	/* only supports phdr that fits in one page */
-	if (ehdr->e_phnum >
-	    (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr))
+	if (phnum > (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr))
 		return -EINVAL;
 
 	phdr = (Elf64_Phdr *)(page_addr + sizeof(Elf64_Ehdr));
 
-	for (i = 0; i < ehdr->e_phnum; ++i) {
+	for (i = 0; i < phnum; ++i) {
 		if (phdr[i].p_type == PT_NOTE &&
 		    !parse_build_id(page_addr, build_id, size,
-				    page_addr + phdr[i].p_offset,
-				    phdr[i].p_filesz))
+				    page_addr + READ_ONCE(phdr[i].p_offset),
+				    READ_ONCE(phdr[i].p_filesz)))
 			return 0;
 	}
 	return -EINVAL;
@@ -138,6 +160,10 @@
 	page = find_get_page(vma->vm_file->f_mapping, 0);
 	if (!page)
 		return -EFAULT;	/* page not mapped */
+	if (!PageUptodate(page)) {
+		put_page(page);
+		return -EFAULT;
+	}
 
 	ret = -EINVAL;
 	page_addr = kmap_atomic(page);
--- linux-qcom-6.8.0.orig/lib/checksum_kunit.c
+++ linux-qcom-6.8.0/lib/checksum_kunit.c
@@ -594,13 +594,15 @@
 
 static void test_csum_ipv6_magic(struct kunit *test)
 {
-#if defined(CONFIG_NET)
 	const struct in6_addr *saddr;
 	const struct in6_addr *daddr;
 	unsigned int len;
 	unsigned char proto;
 	__wsum csum;
 
+	if (!IS_ENABLED(CONFIG_NET))
+		return;
+
 	const int daddr_offset = sizeof(struct in6_addr);
 	const int len_offset = sizeof(struct in6_addr) + sizeof(struct in6_addr);
 	const int proto_offset = sizeof(struct in6_addr) + sizeof(struct in6_addr) +
@@ -618,7 +620,6 @@
 		CHECK_EQ(to_sum16(expected_csum_ipv6_magic[i]),
 			 csum_ipv6_magic(saddr, daddr, len, proto, csum));
 	}
-#endif /* !CONFIG_NET */
 }
 
 static struct kunit_case __refdata checksum_test_cases[] = {
--- linux-qcom-6.8.0.orig/lib/closure.c
+++ linux-qcom-6.8.0/lib/closure.c
@@ -17,12 +17,18 @@
 {
 	int r = flags & CLOSURE_REMAINING_MASK;
 
-	BUG_ON(flags & CLOSURE_GUARD_MASK);
-	BUG_ON(!r && (flags & ~CLOSURE_DESTRUCTOR));
+	if (WARN(flags & CLOSURE_GUARD_MASK,
+		 "closure has guard bits set: %x (%u)",
+		 flags & CLOSURE_GUARD_MASK, (unsigned) __fls(r)))
+		r &= ~CLOSURE_GUARD_MASK;
 
 	if (!r) {
 		smp_acquire__after_ctrl_dep();
 
+		WARN(flags & ~CLOSURE_DESTRUCTOR,
+		     "closure ref hit 0 with incorrect flags set: %x (%u)",
+		     flags & ~CLOSURE_DESTRUCTOR, (unsigned) __fls(flags));
+
 		cl->closure_get_happened = false;
 
 		if (cl->fn && !(flags & CLOSURE_DESTRUCTOR)) {
--- linux-qcom-6.8.0.orig/lib/cmdline_kunit.c
+++ linux-qcom-6.8.0/lib/cmdline_kunit.c
@@ -124,7 +124,7 @@
 			    n, e[0], r[0]);
 
 	p = memchr_inv(&r[1], 0, sizeof(r) - sizeof(r[0]));
-	KUNIT_EXPECT_PTR_EQ_MSG(test, p, NULL, "in test %u at %u out of bound", n, p - r);
+	KUNIT_EXPECT_PTR_EQ_MSG(test, p, NULL, "in test %u at %td out of bound", n, p - r);
 }
 
 static void cmdline_test_range(struct kunit *test)
--- linux-qcom-6.8.0.orig/lib/debugobjects.c
+++ linux-qcom-6.8.0/lib/debugobjects.c
@@ -78,16 +78,17 @@
 /* The number of objs on the global free list */
 static int			obj_nr_tofree;
 
-static int			debug_objects_maxchain __read_mostly;
-static int __maybe_unused	debug_objects_maxchecked __read_mostly;
-static int			debug_objects_fixups __read_mostly;
-static int			debug_objects_warnings __read_mostly;
-static int			debug_objects_enabled __read_mostly
-				= CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT;
-static int			debug_objects_pool_size __read_mostly
-				= ODEBUG_POOL_SIZE;
-static int			debug_objects_pool_min_level __read_mostly
-				= ODEBUG_POOL_MIN_LEVEL;
+static int __data_racy			debug_objects_maxchain __read_mostly;
+static int __data_racy __maybe_unused	debug_objects_maxchecked __read_mostly;
+static int __data_racy			debug_objects_fixups __read_mostly;
+static int __data_racy			debug_objects_warnings __read_mostly;
+static int __data_racy			debug_objects_enabled __read_mostly
+					= CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT;
+static int __data_racy			debug_objects_pool_size __read_mostly
+					= ODEBUG_POOL_SIZE;
+static int __data_racy			debug_objects_pool_min_level __read_mostly
+					= ODEBUG_POOL_MIN_LEVEL;
+
 static const struct debug_obj_descr *descr_test  __read_mostly;
 static struct kmem_cache	*obj_cache __ro_after_init;
 
@@ -141,13 +142,14 @@
 	 * READ_ONCE()s pair with the WRITE_ONCE()s in pool_lock critical
 	 * sections.
 	 */
-	while (READ_ONCE(obj_nr_tofree) && (READ_ONCE(obj_pool_free) < obj_pool_min_free)) {
+	while (READ_ONCE(obj_nr_tofree) &&
+	       READ_ONCE(obj_pool_free) < debug_objects_pool_min_level) {
 		raw_spin_lock_irqsave(&pool_lock, flags);
 		/*
 		 * Recheck with the lock held as the worker thread might have
 		 * won the race and freed the global free list already.
 		 */
-		while (obj_nr_tofree && (obj_pool_free < obj_pool_min_free)) {
+		while (obj_nr_tofree && (obj_pool_free < debug_objects_pool_min_level)) {
 			obj = hlist_entry(obj_to_free.first, typeof(*obj), node);
 			hlist_del(&obj->node);
 			WRITE_ONCE(obj_nr_tofree, obj_nr_tofree - 1);
--- linux-qcom-6.8.0.orig/lib/decompress_bunzip2.c
+++ linux-qcom-6.8.0/lib/decompress_bunzip2.c
@@ -232,7 +232,8 @@
 	   RUNB) */
 	symCount = symTotal+2;
 	for (j = 0; j < groupCount; j++) {
-		unsigned char length[MAX_SYMBOLS], temp[MAX_HUFCODE_BITS+1];
+		unsigned char length[MAX_SYMBOLS];
+		unsigned short temp[MAX_HUFCODE_BITS+1];
 		int	minLen,	maxLen, pp;
 		/* Read Huffman code lengths for each symbol.  They're
 		   stored in a way similar to mtf; record a starting
--- linux-qcom-6.8.0.orig/lib/dump_stack.c
+++ linux-qcom-6.8.0/lib/dump_stack.c
@@ -96,15 +96,25 @@
  */
 asmlinkage __visible void dump_stack_lvl(const char *log_lvl)
 {
+	bool in_panic = this_cpu_in_panic();
 	unsigned long flags;
 
 	/*
 	 * Permit this cpu to perform nested stack dumps while serialising
-	 * against other CPUs
+	 * against other CPUs, unless this CPU is in panic.
+	 *
+	 * When in panic, non-panic CPUs are not permitted to store new
+	 * printk messages so there is no need to synchronize the output.
+	 * This avoids potential deadlock in panic() if another CPU is
+	 * holding and unable to release the printk_cpu_sync.
 	 */
-	printk_cpu_sync_get_irqsave(flags);
+	if (!in_panic)
+		printk_cpu_sync_get_irqsave(flags);
+
 	__dump_stack(log_lvl);
-	printk_cpu_sync_put_irqrestore(flags);
+
+	if (!in_panic)
+		printk_cpu_sync_put_irqrestore(flags);
 }
 EXPORT_SYMBOL(dump_stack_lvl);
 
--- linux-qcom-6.8.0.orig/lib/dynamic_debug.c
+++ linux-qcom-6.8.0/lib/dynamic_debug.c
@@ -302,7 +302,11 @@
 		} else {
 			for (end = buf; *end && !isspace(*end); end++)
 				;
-			BUG_ON(end == buf);
+			if (end == buf) {
+				pr_err("parse err after word:%d=%s\n", nwords,
+				       nwords ? words[nwords - 1] : "<none>");
+				return -EINVAL;
+			}
 		}
 
 		/* `buf' is start of word, `end' is one past its end */
--- linux-qcom-6.8.0.orig/lib/fortify_kunit.c
+++ linux-qcom-6.8.0/lib/fortify_kunit.c
@@ -229,28 +229,28 @@
 									\
 	checker((expected_pages) * PAGE_SIZE,				\
 		kvmalloc((alloc_pages) * PAGE_SIZE, gfp),		\
-		vfree(p));						\
+		kvfree(p));						\
 	checker((expected_pages) * PAGE_SIZE,				\
 		kvmalloc_node((alloc_pages) * PAGE_SIZE, gfp, NUMA_NO_NODE), \
-		vfree(p));						\
+		kvfree(p));						\
 	checker((expected_pages) * PAGE_SIZE,				\
 		kvzalloc((alloc_pages) * PAGE_SIZE, gfp),		\
-		vfree(p));						\
+		kvfree(p));						\
 	checker((expected_pages) * PAGE_SIZE,				\
 		kvzalloc_node((alloc_pages) * PAGE_SIZE, gfp, NUMA_NO_NODE), \
-		vfree(p));						\
+		kvfree(p));						\
 	checker((expected_pages) * PAGE_SIZE,				\
 		kvcalloc(1, (alloc_pages) * PAGE_SIZE, gfp),		\
-		vfree(p));						\
+		kvfree(p));						\
 	checker((expected_pages) * PAGE_SIZE,				\
 		kvcalloc((alloc_pages) * PAGE_SIZE, 1, gfp),		\
-		vfree(p));						\
+		kvfree(p));						\
 	checker((expected_pages) * PAGE_SIZE,				\
 		kvmalloc_array(1, (alloc_pages) * PAGE_SIZE, gfp),	\
-		vfree(p));						\
+		kvfree(p));						\
 	checker((expected_pages) * PAGE_SIZE,				\
 		kvmalloc_array((alloc_pages) * PAGE_SIZE, 1, gfp),	\
-		vfree(p));						\
+		kvfree(p));						\
 									\
 	prev_size = (expected_pages) * PAGE_SIZE;			\
 	orig = kvmalloc(prev_size, gfp);				\
--- linux-qcom-6.8.0.orig/lib/generic-radix-tree.c
+++ linux-qcom-6.8.0/lib/generic-radix-tree.c
@@ -132,6 +132,8 @@
 		if ((v = cmpxchg_release(&radix->root, r, new_root)) == r) {
 			v = new_root;
 			new_node = NULL;
+		} else {
+			new_node->children[0] = NULL;
 		}
 	}
 
--- linux-qcom-6.8.0.orig/lib/iov_iter.c
+++ linux-qcom-6.8.0/lib/iov_iter.c
@@ -461,6 +461,8 @@
 		size_t bytes, struct iov_iter *i)
 {
 	size_t n, copied = 0;
+	bool uses_kmap = IS_ENABLED(CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP) ||
+			 PageHighMem(page);
 
 	if (!page_copy_sane(page, offset, bytes))
 		return 0;
@@ -471,7 +473,7 @@
 		char *p;
 
 		n = bytes - copied;
-		if (PageHighMem(page)) {
+		if (uses_kmap) {
 			page += offset / PAGE_SIZE;
 			offset %= PAGE_SIZE;
 			n = min_t(size_t, n, PAGE_SIZE - offset);
@@ -482,7 +484,7 @@
 		kunmap_atomic(p);
 		copied += n;
 		offset += n;
-	} while (PageHighMem(page) && copied != bytes && n > 0);
+	} while (uses_kmap && copied != bytes && n > 0);
 
 	return copied;
 }
--- linux-qcom-6.8.0.orig/lib/kobject_uevent.c
+++ linux-qcom-6.8.0/lib/kobject_uevent.c
@@ -432,8 +432,23 @@
 		len = strlen(env->envp[i]) + 1;
 
 		if (i != env->envp_idx - 1) {
+			/* @env->envp[] contains pointers to @env->buf[]
+			 * with @env->buflen chars, and we are removing
+			 * variable MODALIAS here pointed by @env->envp[i]
+			 * with length @len as shown below:
+			 *
+			 * 0               @env->buf[]      @env->buflen
+			 * ---------------------------------------------
+			 * ^             ^              ^              ^
+			 * |             |->   @len   <-| target block |
+			 * @env->envp[0] @env->envp[i]  @env->envp[i + 1]
+			 *
+			 * so the "target block" indicated above is moved
+			 * backward by @len, and its right size is
+			 * @env->buflen - (@env->envp[i + 1] - @env->envp[0]).
+			 */
 			memmove(env->envp[i], env->envp[i + 1],
-				env->buflen - len);
+				env->buflen - (env->envp[i + 1] - env->envp[0]));
 
 			for (j = i; j < env->envp_idx - 1; j++)
 				env->envp[j] = env->envp[j + 1] - len;
--- linux-qcom-6.8.0.orig/lib/kunit/debugfs.c
+++ linux-qcom-6.8.0/lib/kunit/debugfs.c
@@ -212,8 +212,11 @@
 
 err:
 	string_stream_destroy(suite->log);
-	kunit_suite_for_each_test_case(suite, test_case)
+	suite->log = NULL;
+	kunit_suite_for_each_test_case(suite, test_case) {
 		string_stream_destroy(test_case->log);
+		test_case->log = NULL;
+	}
 }
 
 void kunit_debugfs_destroy_suite(struct kunit_suite *suite)
--- linux-qcom-6.8.0.orig/lib/kunit/device.c
+++ linux-qcom-6.8.0/lib/kunit/device.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/device.h>
+#include <linux/dma-mapping.h>
 
 #include <kunit/test.h>
 #include <kunit/device.h>
@@ -50,7 +51,7 @@
 
 	error = bus_register(&kunit_bus_type);
 	if (error)
-		bus_unregister(&kunit_bus_type);
+		root_device_unregister(kunit_bus_device);
 	return error;
 }
 
@@ -133,6 +134,9 @@
 		return ERR_PTR(err);
 	}
 
+	kunit_dev->dev.dma_mask = &kunit_dev->dev.coherent_dma_mask;
+	kunit_dev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
+
 	kunit_add_action(test, device_unregister_wrapper, &kunit_dev->dev);
 
 	return kunit_dev;
--- linux-qcom-6.8.0.orig/lib/kunit/executor_test.c
+++ linux-qcom-6.8.0/lib/kunit/executor_test.c
@@ -129,7 +129,7 @@
 			GFP_KERNEL);
 	for (j = 0; j < filter_count; j++) {
 		parsed_filters[j] = kunit_next_attr_filter(&filter, &err);
-		KUNIT_ASSERT_EQ_MSG(test, err, 0, "failed to parse filter '%s'", filters[j]);
+		KUNIT_ASSERT_EQ_MSG(test, err, 0, "failed to parse filter from '%s'", filters);
 	}
 
 	KUNIT_EXPECT_STREQ(test, kunit_attr_filter_name(parsed_filters[0]), "speed");
--- linux-qcom-6.8.0.orig/lib/kunit/kunit-test.c
+++ linux-qcom-6.8.0/lib/kunit/kunit-test.c
@@ -763,6 +763,8 @@
 	struct device *test_device;
 	struct driver_test_state *test_state = kunit_kzalloc(test, sizeof(*test_state), GFP_KERNEL);
 
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, test_state);
+
 	test->priv = test_state;
 	test_driver = kunit_driver_create(test, "my_driver");
 
--- linux-qcom-6.8.0.orig/lib/kunit/test.c
+++ linux-qcom-6.8.0/lib/kunit/test.c
@@ -712,6 +712,9 @@
 {
 	unsigned int i;
 
+	if (num_suites == 0)
+		return 0;
+
 	if (!kunit_enabled() && num_suites > 0) {
 		pr_info("kunit: disabled\n");
 		return 0;
--- linux-qcom-6.8.0.orig/lib/kunit/try-catch.c
+++ linux-qcom-6.8.0/lib/kunit/try-catch.c
@@ -11,6 +11,7 @@
 #include <linux/completion.h>
 #include <linux/kernel.h>
 #include <linux/kthread.h>
+#include <linux/sched/task.h>
 
 #include "try-catch-impl.h"
 
@@ -65,22 +66,23 @@
 	try_catch->context = context;
 	try_catch->try_completion = &try_completion;
 	try_catch->try_result = 0;
-	task_struct = kthread_run(kunit_generic_run_threadfn_adapter,
-				  try_catch,
-				  "kunit_try_catch_thread");
+	task_struct = kthread_create(kunit_generic_run_threadfn_adapter,
+				     try_catch, "kunit_try_catch_thread");
 	if (IS_ERR(task_struct)) {
 		try_catch->catch(try_catch->context);
 		return;
 	}
+	get_task_struct(task_struct);
+	wake_up_process(task_struct);
 
 	time_remaining = wait_for_completion_timeout(&try_completion,
 						     kunit_test_timeout());
 	if (time_remaining == 0) {
-		kunit_err(test, "try timed out\n");
 		try_catch->try_result = -ETIMEDOUT;
 		kthread_stop(task_struct);
 	}
 
+	put_task_struct(task_struct);
 	exit_code = try_catch->try_result;
 
 	if (!exit_code)
@@ -90,6 +92,8 @@
 		try_catch->try_result = 0;
 	else if (exit_code == -EINTR)
 		kunit_err(test, "wake_up_process() was never called\n");
+	else if (exit_code == -ETIMEDOUT)
+		kunit_err(test, "try timed out\n");
 	else if (exit_code)
 		kunit_err(test, "Unknown error: %d\n", exit_code);
 
--- linux-qcom-6.8.0.orig/lib/maple_tree.c
+++ linux-qcom-6.8.0/lib/maple_tree.c
@@ -2196,6 +2196,8 @@
 
 /*
  * mas_wr_node_walk() - Find the correct offset for the index in the @mas.
+ *                      If @mas->index cannot be found within the containing
+ *                      node, we traverse to the last entry in the node.
  * @wr_mas: The maple write state
  *
  * Uses mas_slot_locked() and does not need to worry about dead nodes.
@@ -3513,9 +3515,20 @@
 	return slot;
 }
 
+/*
+ * mas_store_root() - Storing value into root.
+ * @mas: The maple state
+ * @entry: The entry to store.
+ *
+ * There is no root node now and we are storing a value into the root - this
+ * function either assigns the pointer or expands into a node.
+ */
 static inline void mas_store_root(struct ma_state *mas, void *entry)
 {
-	if (likely((mas->last != 0) || (mas->index != 0)))
+	if (!entry) {
+		if (!mas->index)
+			rcu_assign_pointer(mas->tree->ma_root, NULL);
+	} else if (likely((mas->last != 0) || (mas->index != 0)))
 		mas_root_expand(mas, entry);
 	else if (((unsigned long) (entry) & 3) == 2)
 		mas_root_expand(mas, entry);
@@ -3611,7 +3624,7 @@
 	return true;
 }
 
-static bool mas_wr_walk_index(struct ma_wr_state *wr_mas)
+static void mas_wr_walk_index(struct ma_wr_state *wr_mas)
 {
 	struct ma_state *mas = wr_mas->mas;
 
@@ -3620,11 +3633,9 @@
 		wr_mas->content = mas_slot_locked(mas, wr_mas->slots,
 						  mas->offset);
 		if (ma_is_leaf(wr_mas->type))
-			return true;
+			return;
 		mas_wr_walk_traverse(wr_mas);
-
 	}
-	return true;
 }
 /*
  * mas_extend_spanning_null() - Extend a store of a %NULL to include surrounding %NULLs.
@@ -3855,8 +3866,8 @@
 	memset(&b_node, 0, sizeof(struct maple_big_node));
 	/* Copy l_mas and store the value in b_node. */
 	mas_store_b_node(&l_wr_mas, &b_node, l_mas.end);
-	/* Copy r_mas into b_node. */
-	if (r_mas.offset <= r_mas.end)
+	/* Copy r_mas into b_node if there is anything to copy. */
+	if (r_mas.max > r_mas.last)
 		mas_mab_cp(&r_mas, r_mas.offset, r_mas.end,
 			   &b_node, b_node.b_end + 1);
 	else
@@ -4290,6 +4301,57 @@
 
 }
 
+/**
+ * mas_alloc_cyclic() - Internal call to find somewhere to store an entry
+ * @mas: The maple state.
+ * @startp: Pointer to ID.
+ * @range_lo: Lower bound of range to search.
+ * @range_hi: Upper bound of range to search.
+ * @entry: The entry to store.
+ * @next: Pointer to next ID to allocate.
+ * @gfp: The GFP_FLAGS to use for allocations.
+ *
+ * Return: 0 if the allocation succeeded without wrapping, 1 if the
+ * allocation succeeded after wrapping, or -EBUSY if there are no
+ * free entries.
+ */
+int mas_alloc_cyclic(struct ma_state *mas, unsigned long *startp,
+		void *entry, unsigned long range_lo, unsigned long range_hi,
+		unsigned long *next, gfp_t gfp)
+{
+	unsigned long min = range_lo;
+	int ret = 0;
+
+	range_lo = max(min, *next);
+	ret = mas_empty_area(mas, range_lo, range_hi, 1);
+	if ((mas->tree->ma_flags & MT_FLAGS_ALLOC_WRAPPED) && ret == 0) {
+		mas->tree->ma_flags &= ~MT_FLAGS_ALLOC_WRAPPED;
+		ret = 1;
+	}
+	if (ret < 0 && range_lo > min) {
+		mas_reset(mas);
+		ret = mas_empty_area(mas, min, range_hi, 1);
+		if (ret == 0)
+			ret = 1;
+	}
+	if (ret < 0)
+		return ret;
+
+	do {
+		mas_insert(mas, entry);
+	} while (mas_nomem(mas, gfp));
+	if (mas_is_err(mas))
+		return xa_err(mas->node);
+
+	*startp = mas->index;
+	*next = *startp + 1;
+	if (*next == 0)
+		mas->tree->ma_flags |= MT_FLAGS_ALLOC_WRAPPED;
+
+	return ret;
+}
+EXPORT_SYMBOL(mas_alloc_cyclic);
+
 static __always_inline void mas_rewalk(struct ma_state *mas, unsigned long index)
 {
 retry:
@@ -5061,18 +5123,18 @@
 	if (size == 0 || max - min < size - 1)
 		return -EINVAL;
 
-	if (mas_is_start(mas)) {
+	if (mas_is_start(mas))
 		mas_start(mas);
-		mas->offset = mas_data_end(mas);
-	} else if (mas->offset >= 2) {
-		mas->offset -= 2;
-	} else if (!mas_rewind_node(mas)) {
+	else if ((mas->offset < 2) && (!mas_rewind_node(mas)))
 		return -EBUSY;
-	}
 
-	/* Empty set. */
-	if (mas_is_none(mas) || mas_is_ptr(mas))
+	if (unlikely(mas_is_none(mas) || mas_is_ptr(mas)))
 		return mas_sparse_area(mas, min, max, size, false);
+	else if (mas->offset >= 2)
+		mas->offset -= 2;
+	else
+		mas->offset = mas_data_end(mas);
+
 
 	/* The start of the window can only be within these values. */
 	mas->index = min;
@@ -6443,6 +6505,49 @@
 }
 EXPORT_SYMBOL(mtree_alloc_range);
 
+/**
+ * mtree_alloc_cyclic() - Find somewhere to store this entry in the tree.
+ * @mt: The maple tree.
+ * @startp: Pointer to ID.
+ * @range_lo: Lower bound of range to search.
+ * @range_hi: Upper bound of range to search.
+ * @entry: The entry to store.
+ * @next: Pointer to next ID to allocate.
+ * @gfp: The GFP_FLAGS to use for allocations.
+ *
+ * Finds an empty entry in @mt after @next, stores the new index into
+ * the @id pointer, stores the entry at that index, then updates @next.
+ *
+ * @mt must be initialized with the MT_FLAGS_ALLOC_RANGE flag.
+ *
+ * Context: Any context.  Takes and releases the mt.lock.  May sleep if
+ * the @gfp flags permit.
+ *
+ * Return: 0 if the allocation succeeded without wrapping, 1 if the
+ * allocation succeeded after wrapping, -ENOMEM if memory could not be
+ * allocated, -EINVAL if @mt cannot be used, or -EBUSY if there are no
+ * free entries.
+ */
+int mtree_alloc_cyclic(struct maple_tree *mt, unsigned long *startp,
+		void *entry, unsigned long range_lo, unsigned long range_hi,
+		unsigned long *next, gfp_t gfp)
+{
+	int ret;
+
+	MA_STATE(mas, mt, 0, 0);
+
+	if (!mt_is_alloc(mt))
+		return -EINVAL;
+	if (WARN_ON_ONCE(mt_is_reserved(entry)))
+		return -EINVAL;
+	mtree_lock(mt);
+	ret = mas_alloc_cyclic(&mas, startp, entry, range_lo, range_hi,
+			       next, gfp);
+	mtree_unlock(mt);
+	return ret;
+}
+EXPORT_SYMBOL(mtree_alloc_cyclic);
+
 int mtree_alloc_rrange(struct maple_tree *mt, unsigned long *startp,
 		void *entry, unsigned long size, unsigned long min,
 		unsigned long max, gfp_t gfp)
@@ -7478,14 +7583,14 @@
  * 2. The gap is correctly set in the parents
  */
 void mt_validate(struct maple_tree *mt)
+	__must_hold(mas->tree->ma_lock)
 {
 	unsigned char end;
 
 	MA_STATE(mas, mt, 0, 0);
-	rcu_read_lock();
 	mas_start(&mas);
 	if (!mas_is_active(&mas))
-		goto done;
+		return;
 
 	while (!mte_is_leaf(mas.node))
 		mas_descend(&mas);
@@ -7506,9 +7611,6 @@
 		mas_dfs_postorder(&mas, ULONG_MAX);
 	}
 	mt_validate_nulls(mt);
-done:
-	rcu_read_unlock();
-
 }
 EXPORT_SYMBOL_GPL(mt_validate);
 
--- linux-qcom-6.8.0.orig/lib/math/prime_numbers.c
+++ linux-qcom-6.8.0/lib/math/prime_numbers.c
@@ -6,8 +6,6 @@
 #include <linux/prime_numbers.h>
 #include <linux/slab.h>
 
-#define bitmap_size(nbits) (BITS_TO_LONGS(nbits) * sizeof(unsigned long))
-
 struct primes {
 	struct rcu_head rcu;
 	unsigned long last, sz;
--- linux-qcom-6.8.0.orig/lib/memcpy_kunit.c
+++ linux-qcom-6.8.0/lib/memcpy_kunit.c
@@ -32,7 +32,7 @@
 	BUILD_BUG_ON(sizeof(instance.data) != 32);	\
 	for (size_t i = 0; i < sizeof(instance.data); i++) {	\
 		KUNIT_ASSERT_EQ_MSG(test, instance.data[i], v, \
-			"line %d: '%s' not initialized to 0x%02x @ %d (saw 0x%02x)\n", \
+			"line %d: '%s' not initialized to 0x%02x @ %zu (saw 0x%02x)\n", \
 			__LINE__, #instance, v, i, instance.data[i]);	\
 	}	\
 } while (0)
@@ -41,7 +41,7 @@
 	BUILD_BUG_ON(sizeof(one) != sizeof(two)); \
 	for (size_t i = 0; i < sizeof(one); i++) {	\
 		KUNIT_EXPECT_EQ_MSG(test, one.data[i], two.data[i], \
-			"line %d: %s.data[%d] (0x%02x) != %s.data[%d] (0x%02x)\n", \
+			"line %d: %s.data[%zu] (0x%02x) != %s.data[%zu] (0x%02x)\n", \
 			__LINE__, #one, i, one.data[i], #two, i, two.data[i]); \
 	}	\
 	kunit_info(test, "ok: " TEST_OP "() " name "\n");	\
--- linux-qcom-6.8.0.orig/lib/objagg.c
+++ linux-qcom-6.8.0/lib/objagg.c
@@ -167,6 +167,9 @@
 {
 	void *delta_priv;
 
+	if (WARN_ON(!objagg_obj_is_root(parent)))
+		return -EINVAL;
+
 	delta_priv = objagg->ops->delta_create(objagg->priv, parent->obj,
 					       objagg_obj->obj);
 	if (IS_ERR(delta_priv))
@@ -903,20 +906,6 @@
 	[OBJAGG_OPT_ALGO_SIMPLE_GREEDY] = &objagg_opt_simple_greedy,
 };
 
-static int objagg_hints_obj_cmp(struct rhashtable_compare_arg *arg,
-				const void *obj)
-{
-	struct rhashtable *ht = arg->ht;
-	struct objagg_hints *objagg_hints =
-			container_of(ht, struct objagg_hints, node_ht);
-	const struct objagg_ops *ops = objagg_hints->ops;
-	const char *ptr = obj;
-
-	ptr += ht->p.key_offset;
-	return ops->hints_obj_cmp ? ops->hints_obj_cmp(ptr, arg->key) :
-				    memcmp(ptr, arg->key, ht->p.key_len);
-}
-
 /**
  * objagg_hints_get - obtains hints instance
  * @objagg:		objagg instance
@@ -955,7 +944,6 @@
 				offsetof(struct objagg_hints_node, obj);
 	objagg_hints->ht_params.head_offset =
 				offsetof(struct objagg_hints_node, ht_node);
-	objagg_hints->ht_params.obj_cmpfn = objagg_hints_obj_cmp;
 
 	err = rhashtable_init(&objagg_hints->node_ht, &objagg_hints->ht_params);
 	if (err)
--- linux-qcom-6.8.0.orig/lib/objpool.c
+++ linux-qcom-6.8.0/lib/objpool.c
@@ -74,15 +74,21 @@
 		 * warm caches and TLB hits. in default vmalloc is used to
 		 * reduce the pressure of kernel slab system. as we know,
 		 * mimimal size of vmalloc is one page since vmalloc would
-		 * always align the requested size to page size
+		 * always align the requested size to page size.
+		 * but if vmalloc fails or it is not available (e.g. GFP_ATOMIC)
+		 * allocate percpu slot with kmalloc.
 		 */
-		if (pool->gfp & GFP_ATOMIC)
-			slot = kmalloc_node(size, pool->gfp, cpu_to_node(i));
-		else
+		slot = NULL;
+
+		if ((pool->gfp & (GFP_ATOMIC | GFP_KERNEL)) != GFP_ATOMIC)
 			slot = __vmalloc_node(size, sizeof(void *), pool->gfp,
 				cpu_to_node(i), __builtin_return_address(0));
-		if (!slot)
-			return -ENOMEM;
+
+		if (!slot) {
+			slot = kmalloc_node(size, pool->gfp, cpu_to_node(i));
+			if (!slot)
+				return -ENOMEM;
+		}
 		memset(slot, 0, size);
 		pool->cpu_slots[i] = slot;
 
--- linux-qcom-6.8.0.orig/lib/overflow_kunit.c
+++ linux-qcom-6.8.0/lib/overflow_kunit.c
@@ -609,7 +609,6 @@
 
 static void overflow_allocation_test(struct kunit *test)
 {
-	const char device_name[] = "overflow-test";
 	struct device *dev;
 	int count = 0;
 
@@ -619,7 +618,7 @@
 } while (0)
 
 	/* Create dummy device for devm_kmalloc()-family tests. */
-	dev = kunit_device_register(test, device_name);
+	dev = kunit_device_register(test, "overflow-test");
 	KUNIT_ASSERT_FALSE_MSG(test, IS_ERR(dev),
 			       "Cannot register test device\n");
 
@@ -1113,6 +1112,24 @@
 #undef TEST_CASTABLE_TO_TYPE
 }
 
+struct foo {
+	int a;
+	u32 counter;
+	s16 array[] __counted_by(counter);
+};
+
+static void DEFINE_FLEX_test(struct kunit *test)
+{
+	DEFINE_RAW_FLEX(struct foo, two, array, 2);
+	DEFINE_FLEX(struct foo, eight, array, counter, 8);
+	DEFINE_FLEX(struct foo, empty, array, counter, 0);
+
+	KUNIT_EXPECT_EQ(test, __struct_size(two),
+			sizeof(struct foo) + sizeof(s16) + sizeof(s16));
+	KUNIT_EXPECT_EQ(test, __struct_size(eight), 24);
+	KUNIT_EXPECT_EQ(test, __struct_size(empty), sizeof(struct foo));
+}
+
 static struct kunit_case overflow_test_cases[] = {
 	KUNIT_CASE(u8_u8__u8_overflow_test),
 	KUNIT_CASE(s8_s8__s8_overflow_test),
@@ -1135,6 +1152,7 @@
 	KUNIT_CASE(overflows_type_test),
 	KUNIT_CASE(same_type_test),
 	KUNIT_CASE(castable_to_type_test),
+	KUNIT_CASE(DEFINE_FLEX_test),
 	{}
 };
 
--- linux-qcom-6.8.0.orig/lib/pci_iomap.c
+++ linux-qcom-6.8.0/lib/pci_iomap.c
@@ -170,8 +170,8 @@
 
 	if (addr >= start && addr < start + IO_SPACE_LIMIT)
 		return;
-	iounmap(p);
 #endif
+	iounmap(p);
 }
 EXPORT_SYMBOL(pci_iounmap);
 
--- linux-qcom-6.8.0.orig/lib/sbitmap.c
+++ linux-qcom-6.8.0/lib/sbitmap.c
@@ -60,12 +60,30 @@
 /*
  * See if we have deferred clears that we can batch move
  */
-static inline bool sbitmap_deferred_clear(struct sbitmap_word *map)
+static inline bool sbitmap_deferred_clear(struct sbitmap_word *map,
+		unsigned int depth, unsigned int alloc_hint, bool wrap)
 {
-	unsigned long mask;
+	unsigned long mask, word_mask;
 
-	if (!READ_ONCE(map->cleared))
-		return false;
+	guard(raw_spinlock_irqsave)(&map->swap_lock);
+
+	if (!map->cleared) {
+		if (depth == 0)
+			return false;
+
+		word_mask = (~0UL) >> (BITS_PER_LONG - depth);
+		/*
+		 * The current behavior is to always retry after moving
+		 * ->cleared to word, and we change it to retry in case
+		 * of any free bits. To avoid an infinite loop, we need
+		 * to take wrap & alloc_hint into account, otherwise a
+		 * soft lockup may occur.
+		 */
+		if (!wrap && alloc_hint)
+			word_mask &= ~((1UL << alloc_hint) - 1);
+
+		return (READ_ONCE(map->word) & word_mask) != word_mask;
+	}
 
 	/*
 	 * First get a stable cleared mask, setting the old mask to 0.
@@ -85,6 +103,7 @@
 		      bool alloc_hint)
 {
 	unsigned int bits_per_word;
+	int i;
 
 	if (shift < 0)
 		shift = sbitmap_calculate_shift(depth);
@@ -116,6 +135,9 @@
 		return -ENOMEM;
 	}
 
+	for (i = 0; i < sb->map_nr; i++)
+		raw_spin_lock_init(&sb->map[i].swap_lock);
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(sbitmap_init_node);
@@ -126,7 +148,7 @@
 	unsigned int i;
 
 	for (i = 0; i < sb->map_nr; i++)
-		sbitmap_deferred_clear(&sb->map[i]);
+		sbitmap_deferred_clear(&sb->map[i], 0, 0, 0);
 
 	sb->depth = depth;
 	sb->map_nr = DIV_ROUND_UP(sb->depth, bits_per_word);
@@ -179,7 +201,7 @@
 					alloc_hint, wrap);
 		if (nr != -1)
 			break;
-		if (!sbitmap_deferred_clear(map))
+		if (!sbitmap_deferred_clear(map, depth, alloc_hint, wrap))
 			break;
 	} while (1);
 
@@ -494,18 +516,18 @@
 		struct sbitmap_word *map = &sb->map[index];
 		unsigned long get_mask;
 		unsigned int map_depth = __map_depth(sb, index);
+		unsigned long val;
 
-		sbitmap_deferred_clear(map);
-		if (map->word == (1UL << (map_depth - 1)) - 1)
+		sbitmap_deferred_clear(map, 0, 0, 0);
+		val = READ_ONCE(map->word);
+		if (val == (1UL << (map_depth - 1)) - 1)
 			goto next;
 
-		nr = find_first_zero_bit(&map->word, map_depth);
+		nr = find_first_zero_bit(&val, map_depth);
 		if (nr + nr_tags <= map_depth) {
 			atomic_long_t *ptr = (atomic_long_t *) &map->word;
-			unsigned long val;
 
 			get_mask = ((1UL << nr_tags) - 1) << nr;
-			val = READ_ONCE(map->word);
 			while (!atomic_long_try_cmpxchg(ptr, &val,
 							  get_mask | val))
 				;
--- linux-qcom-6.8.0.orig/lib/scatterlist.c
+++ linux-qcom-6.8.0/lib/scatterlist.c
@@ -1124,7 +1124,7 @@
 	do {
 		res = iov_iter_extract_pages(iter, &pages, maxsize, sg_max,
 					     extraction_flags, &off);
-		if (res < 0)
+		if (res <= 0)
 			goto failed;
 
 		len = res;
--- linux-qcom-6.8.0.orig/lib/slub_kunit.c
+++ linux-qcom-6.8.0/lib/slub_kunit.c
@@ -55,7 +55,7 @@
 
 	ptr_addr = (unsigned long *)(p + s->offset);
 	tmp = *ptr_addr;
-	p[s->offset] = 0x12;
+	p[s->offset] = ~p[s->offset];
 
 	/*
 	 * Expecting three errors.
--- linux-qcom-6.8.0.orig/lib/stackdepot.c
+++ linux-qcom-6.8.0/lib/stackdepot.c
@@ -36,53 +36,11 @@
 #include <linux/memblock.h>
 #include <linux/kasan-enabled.h>
 
-#define DEPOT_HANDLE_BITS (sizeof(depot_stack_handle_t) * 8)
-
-#define DEPOT_POOL_ORDER 2 /* Pool size order, 4 pages */
-#define DEPOT_POOL_SIZE (1LL << (PAGE_SHIFT + DEPOT_POOL_ORDER))
-#define DEPOT_STACK_ALIGN 4
-#define DEPOT_OFFSET_BITS (DEPOT_POOL_ORDER + PAGE_SHIFT - DEPOT_STACK_ALIGN)
-#define DEPOT_POOL_INDEX_BITS (DEPOT_HANDLE_BITS - DEPOT_OFFSET_BITS - \
-			       STACK_DEPOT_EXTRA_BITS)
 #define DEPOT_POOLS_CAP 8192
+/* The pool_index is offset by 1 so the first record does not have a 0 handle. */
 #define DEPOT_MAX_POOLS \
-	(((1LL << (DEPOT_POOL_INDEX_BITS)) < DEPOT_POOLS_CAP) ? \
-	 (1LL << (DEPOT_POOL_INDEX_BITS)) : DEPOT_POOLS_CAP)
-
-/* Compact structure that stores a reference to a stack. */
-union handle_parts {
-	depot_stack_handle_t handle;
-	struct {
-		u32 pool_index	: DEPOT_POOL_INDEX_BITS;
-		u32 offset	: DEPOT_OFFSET_BITS;
-		u32 extra	: STACK_DEPOT_EXTRA_BITS;
-	};
-};
-
-struct stack_record {
-	struct list_head hash_list;	/* Links in the hash table */
-	u32 hash;			/* Hash in hash table */
-	u32 size;			/* Number of stored frames */
-	union handle_parts handle;	/* Constant after initialization */
-	refcount_t count;
-	union {
-		unsigned long entries[CONFIG_STACKDEPOT_MAX_FRAMES];	/* Frames */
-		struct {
-			/*
-			 * An important invariant of the implementation is to
-			 * only place a stack record onto the freelist iff its
-			 * refcount is zero. Because stack records with a zero
-			 * refcount are never considered as valid, it is safe to
-			 * union @entries and freelist management state below.
-			 * Conversely, as soon as an entry is off the freelist
-			 * and its refcount becomes non-zero, the below must not
-			 * be accessed until being placed back on the freelist.
-			 */
-			struct list_head free_list;	/* Links in the freelist */
-			unsigned long rcu_state;	/* RCU cookie */
-		};
-	};
-};
+	(((1LL << (DEPOT_POOL_INDEX_BITS)) - 1 < DEPOT_POOLS_CAP) ? \
+	 (1LL << (DEPOT_POOL_INDEX_BITS)) - 1 : DEPOT_POOLS_CAP)
 
 static bool stack_depot_disabled;
 static bool __stack_depot_early_init_requested __initdata = IS_ENABLED(CONFIG_STACKDEPOT_ALWAYS_INIT);
@@ -372,7 +330,7 @@
 	stack = current_pool + pool_offset;
 
 	/* Pre-initialize handle once. */
-	stack->handle.pool_index = pool_index;
+	stack->handle.pool_index_plus_1 = pool_index + 1;
 	stack->handle.offset = pool_offset >> DEPOT_STACK_ALIGN;
 	stack->handle.extra = 0;
 	INIT_LIST_HEAD(&stack->hash_list);
@@ -483,18 +441,19 @@
 	const int pools_num_cached = READ_ONCE(pools_num);
 	union handle_parts parts = { .handle = handle };
 	void *pool;
+	u32 pool_index = parts.pool_index_plus_1 - 1;
 	size_t offset = parts.offset << DEPOT_STACK_ALIGN;
 	struct stack_record *stack;
 
 	lockdep_assert_not_held(&pool_lock);
 
-	if (parts.pool_index > pools_num_cached) {
+	if (pool_index >= pools_num_cached) {
 		WARN(1, "pool index %d out of bounds (%d) for stack id %08x\n",
-		     parts.pool_index, pools_num_cached, handle);
+		     pool_index, pools_num_cached, handle);
 		return NULL;
 	}
 
-	pool = stack_pools[parts.pool_index];
+	pool = stack_pools[pool_index];
 	if (WARN_ON(!pool))
 		return NULL;
 
@@ -668,17 +627,25 @@
 		/*
 		 * Zero out zone modifiers, as we don't have specific zone
 		 * requirements. Keep the flags related to allocation in atomic
-		 * contexts and I/O.
+		 * contexts, I/O, nolockdep.
 		 */
 		alloc_flags &= ~GFP_ZONEMASK;
-		alloc_flags &= (GFP_ATOMIC | GFP_KERNEL);
+		alloc_flags &= (GFP_ATOMIC | GFP_KERNEL | __GFP_NOLOCKDEP);
 		alloc_flags |= __GFP_NOWARN;
 		page = alloc_pages(alloc_flags, DEPOT_POOL_ORDER);
 		if (page)
 			prealloc = page_address(page);
 	}
 
-	raw_spin_lock_irqsave(&pool_lock, flags);
+	if (in_nmi()) {
+		/* We can never allocate in NMI context. */
+		WARN_ON_ONCE(can_alloc);
+		/* Best effort; bail if we fail to take the lock. */
+		if (!raw_spin_trylock_irqsave(&pool_lock, flags))
+			goto exit;
+	} else {
+		raw_spin_lock_irqsave(&pool_lock, flags);
+	}
 	printk_deferred_enter();
 
 	/* Try to find again, to avoid concurrently inserting duplicates. */
--- linux-qcom-6.8.0.orig/lib/stackinit_kunit.c
+++ linux-qcom-6.8.0/lib/stackinit_kunit.c
@@ -199,6 +199,7 @@
 static noinline DO_NOTHING_TYPE_ ## which(var_type)		\
 do_nothing_ ## name(var_type *ptr)				\
 {								\
+	OPTIMIZER_HIDE_VAR(ptr);				\
 	/* Will always be true, but compiler doesn't know. */	\
 	if ((unsigned long)ptr > 0x2)				\
 		return DO_NOTHING_RETURN_ ## which(ptr);	\
--- linux-qcom-6.8.0.orig/lib/strcat_kunit.c
+++ linux-qcom-6.8.0/lib/strcat_kunit.c
@@ -10,7 +10,7 @@
 
 static volatile int unconst;
 
-static void strcat_test(struct kunit *test)
+static void test_strcat(struct kunit *test)
 {
 	char dest[8];
 
@@ -29,7 +29,7 @@
 	KUNIT_EXPECT_STREQ(test, dest, "fourAB");
 }
 
-static void strncat_test(struct kunit *test)
+static void test_strncat(struct kunit *test)
 {
 	char dest[8];
 
@@ -56,7 +56,7 @@
 	KUNIT_EXPECT_STREQ(test, dest, "fourAB");
 }
 
-static void strlcat_test(struct kunit *test)
+static void test_strlcat(struct kunit *test)
 {
 	char dest[8] = "";
 	int len = sizeof(dest) + unconst;
@@ -88,9 +88,9 @@
 }
 
 static struct kunit_case strcat_test_cases[] = {
-	KUNIT_CASE(strcat_test),
-	KUNIT_CASE(strncat_test),
-	KUNIT_CASE(strlcat_test),
+	KUNIT_CASE(test_strcat),
+	KUNIT_CASE(test_strncat),
+	KUNIT_CASE(test_strlcat),
 	{}
 };
 
--- linux-qcom-6.8.0.orig/lib/string_helpers.c
+++ linux-qcom-6.8.0/lib/string_helpers.c
@@ -54,7 +54,7 @@
 	static const unsigned int rounding[] = { 500, 50, 5 };
 	int i = 0, j;
 	u32 remainder = 0, sf_cap;
-	char tmp[8];
+	char tmp[12];
 	const char *unit;
 
 	tmp[0] = '\0';
--- linux-qcom-6.8.0.orig/lib/strncpy_from_user.c
+++ linux-qcom-6.8.0/lib/strncpy_from_user.c
@@ -120,6 +120,18 @@
 	if (unlikely(count <= 0))
 		return 0;
 
+	kasan_check_write(dst, count);
+	check_object_size(dst, count, false);
+
+	if (can_do_masked_user_access()) {
+		long retval;
+
+		src = masked_user_access_begin(src);
+		retval = do_strncpy_from_user(dst, src, count, count);
+		user_read_access_end();
+		return retval;
+	}
+
 	max_addr = TASK_SIZE_MAX;
 	src_addr = (unsigned long)untagged_addr(src);
 	if (likely(src_addr < max_addr)) {
@@ -133,8 +145,6 @@
 		if (max > count)
 			max = count;
 
-		kasan_check_write(dst, count);
-		check_object_size(dst, count, false);
 		if (user_read_access_begin(src, max)) {
 			retval = do_strncpy_from_user(dst, src, count, max);
 			user_read_access_end();
--- linux-qcom-6.8.0.orig/lib/strnlen_user.c
+++ linux-qcom-6.8.0/lib/strnlen_user.c
@@ -96,6 +96,15 @@
 	if (unlikely(count <= 0))
 		return 0;
 
+	if (can_do_masked_user_access()) {
+		long retval;
+
+		str = masked_user_access_begin(str);
+		retval = do_strnlen_user(str, count, count);
+		user_read_access_end();
+		return retval;
+	}
+
 	max_addr = TASK_SIZE_MAX;
 	src_addr = (unsigned long)untagged_addr(str);
 	if (likely(src_addr < max_addr)) {
--- linux-qcom-6.8.0.orig/lib/strscpy_kunit.c
+++ linux-qcom-6.8.0/lib/strscpy_kunit.c
@@ -8,22 +8,23 @@
 #include <kunit/test.h>
 #include <linux/string.h>
 
-/*
- * tc() - Run a specific test case.
+/**
+ * strscpy_check() - Run a specific test case.
+ * @test: KUnit test context pointer
  * @src: Source string, argument to strscpy_pad()
  * @count: Size of destination buffer, argument to strscpy_pad()
  * @expected: Expected return value from call to strscpy_pad()
- * @terminator: 1 if there should be a terminating null byte 0 otherwise.
  * @chars: Number of characters from the src string expected to be
  *         written to the dst buffer.
+ * @terminator: 1 if there should be a terminating null byte 0 otherwise.
  * @pad: Number of pad characters expected (in the tail of dst buffer).
  *       (@pad does not include the null terminator byte.)
  *
  * Calls strscpy_pad() and verifies the return value and state of the
  * destination buffer after the call returns.
  */
-static void tc(struct kunit *test, char *src, int count, int expected,
-	       int chars, int terminator, int pad)
+static void strscpy_check(struct kunit *test, char *src, int count,
+			  int expected, int chars, int terminator, int pad)
 {
 	int nr_bytes_poison;
 	int max_expected;
@@ -79,12 +80,12 @@
 	}
 }
 
-static void strscpy_test(struct kunit *test)
+static void test_strscpy(struct kunit *test)
 {
 	char dest[8];
 
 	/*
-	 * tc() uses a destination buffer of size 6 and needs at
+	 * strscpy_check() uses a destination buffer of size 6 and needs at
 	 * least 2 characters spare (one for null and one to check for
 	 * overflow).  This means we should only call tc() with
 	 * strings up to a maximum of 4 characters long and 'count'
@@ -92,27 +93,27 @@
 	 * the buffer size in tc().
 	 */
 
-	/* tc(test, src, count, expected, chars, terminator, pad) */
-	tc(test, "a", 0, -E2BIG, 0, 0, 0);
-	tc(test, "",  0, -E2BIG, 0, 0, 0);
-
-	tc(test, "a", 1, -E2BIG, 0, 1, 0);
-	tc(test, "",  1, 0,	 0, 1, 0);
-
-	tc(test, "ab", 2, -E2BIG, 1, 1, 0);
-	tc(test, "a",  2, 1,	  1, 1, 0);
-	tc(test, "",   2, 0,	  0, 1, 1);
-
-	tc(test, "abc", 3, -E2BIG, 2, 1, 0);
-	tc(test, "ab",  3, 2,	   2, 1, 0);
-	tc(test, "a",   3, 1,	   1, 1, 1);
-	tc(test, "",    3, 0,	   0, 1, 2);
-
-	tc(test, "abcd", 4, -E2BIG, 3, 1, 0);
-	tc(test, "abc",  4, 3,	    3, 1, 0);
-	tc(test, "ab",   4, 2,	    2, 1, 1);
-	tc(test, "a",    4, 1,	    1, 1, 2);
-	tc(test, "",     4, 0,	    0, 1, 3);
+	/* strscpy_check(test, src, count, expected, chars, terminator, pad) */
+	strscpy_check(test, "a", 0, -E2BIG, 0, 0, 0);
+	strscpy_check(test, "",  0, -E2BIG, 0, 0, 0);
+
+	strscpy_check(test, "a", 1, -E2BIG, 0, 1, 0);
+	strscpy_check(test, "",  1, 0,	 0, 1, 0);
+
+	strscpy_check(test, "ab", 2, -E2BIG, 1, 1, 0);
+	strscpy_check(test, "a",  2, 1,	  1, 1, 0);
+	strscpy_check(test, "",   2, 0,	  0, 1, 1);
+
+	strscpy_check(test, "abc", 3, -E2BIG, 2, 1, 0);
+	strscpy_check(test, "ab",  3, 2,	   2, 1, 0);
+	strscpy_check(test, "a",   3, 1,	   1, 1, 1);
+	strscpy_check(test, "",    3, 0,	   0, 1, 2);
+
+	strscpy_check(test, "abcd", 4, -E2BIG, 3, 1, 0);
+	strscpy_check(test, "abc",  4, 3,	    3, 1, 0);
+	strscpy_check(test, "ab",   4, 2,	    2, 1, 1);
+	strscpy_check(test, "a",    4, 1,	    1, 1, 2);
+	strscpy_check(test, "",     4, 0,	    0, 1, 3);
 
 	/* Compile-time-known source strings. */
 	KUNIT_EXPECT_EQ(test, strscpy(dest, "", ARRAY_SIZE(dest)), 0);
@@ -127,7 +128,7 @@
 }
 
 static struct kunit_case strscpy_test_cases[] = {
-	KUNIT_CASE(strscpy_test),
+	KUNIT_CASE(test_strscpy),
 	{}
 };
 
--- linux-qcom-6.8.0.orig/lib/test_blackhole_dev.c
+++ linux-qcom-6.8.0/lib/test_blackhole_dev.c
@@ -29,7 +29,6 @@
 {
 	struct ipv6hdr *ip6h;
 	struct sk_buff *skb;
-	struct ethhdr *ethh;
 	struct udphdr *uh;
 	int data_len;
 	int ret;
@@ -61,7 +60,7 @@
 	ip6h->saddr = in6addr_loopback;
 	ip6h->daddr = in6addr_loopback;
 	/* Ether */
-	ethh = (struct ethhdr *)skb_push(skb, sizeof(struct ethhdr));
+	skb_push(skb, sizeof(struct ethhdr));
 	skb_set_mac_header(skb, 0);
 
 	skb->protocol = htons(ETH_P_IPV6);
--- linux-qcom-6.8.0.orig/lib/test_hmm.c
+++ linux-qcom-6.8.0/lib/test_hmm.c
@@ -1226,8 +1226,8 @@
 	unsigned long *src_pfns;
 	unsigned long *dst_pfns;
 
-	src_pfns = kcalloc(npages, sizeof(*src_pfns), GFP_KERNEL);
-	dst_pfns = kcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL);
+	src_pfns = kvcalloc(npages, sizeof(*src_pfns), GFP_KERNEL | __GFP_NOFAIL);
+	dst_pfns = kvcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL | __GFP_NOFAIL);
 
 	migrate_device_range(src_pfns, start_pfn, npages);
 	for (i = 0; i < npages; i++) {
@@ -1250,8 +1250,8 @@
 	}
 	migrate_device_pages(src_pfns, dst_pfns, npages);
 	migrate_device_finalize(src_pfns, dst_pfns, npages);
-	kfree(src_pfns);
-	kfree(dst_pfns);
+	kvfree(src_pfns);
+	kvfree(dst_pfns);
 }
 
 /* Removes free pages from the free list so they can't be re-allocated */
--- linux-qcom-6.8.0.orig/lib/test_xarray.c
+++ linux-qcom-6.8.0/lib/test_xarray.c
@@ -1756,6 +1756,97 @@
 	}
 }
 
+static noinline void check_xas_get_order(struct xarray *xa)
+{
+	XA_STATE(xas, xa, 0);
+
+	unsigned int max_order = IS_ENABLED(CONFIG_XARRAY_MULTI) ? 20 : 1;
+	unsigned int order;
+	unsigned long i, j;
+
+	for (order = 0; order < max_order; order++) {
+		for (i = 0; i < 10; i++) {
+			xas_set_order(&xas, i << order, order);
+			do {
+				xas_lock(&xas);
+				xas_store(&xas, xa_mk_value(i));
+				xas_unlock(&xas);
+			} while (xas_nomem(&xas, GFP_KERNEL));
+
+			for (j = i << order; j < (i + 1) << order; j++) {
+				xas_set_order(&xas, j, 0);
+				rcu_read_lock();
+				xas_load(&xas);
+				XA_BUG_ON(xa, xas_get_order(&xas) != order);
+				rcu_read_unlock();
+			}
+
+			xas_lock(&xas);
+			xas_set_order(&xas, i << order, order);
+			xas_store(&xas, NULL);
+			xas_unlock(&xas);
+		}
+	}
+}
+
+static noinline void check_xas_conflict_get_order(struct xarray *xa)
+{
+	XA_STATE(xas, xa, 0);
+
+	void *entry;
+	int only_once;
+	unsigned int max_order = IS_ENABLED(CONFIG_XARRAY_MULTI) ? 20 : 1;
+	unsigned int order;
+	unsigned long i, j, k;
+
+	for (order = 0; order < max_order; order++) {
+		for (i = 0; i < 10; i++) {
+			xas_set_order(&xas, i << order, order);
+			do {
+				xas_lock(&xas);
+				xas_store(&xas, xa_mk_value(i));
+				xas_unlock(&xas);
+			} while (xas_nomem(&xas, GFP_KERNEL));
+
+			/*
+			 * Ensure xas_get_order works with xas_for_each_conflict.
+			 */
+			j = i << order;
+			for (k = 0; k < order; k++) {
+				only_once = 0;
+				xas_set_order(&xas, j + (1 << k), k);
+				xas_lock(&xas);
+				xas_for_each_conflict(&xas, entry) {
+					XA_BUG_ON(xa, entry != xa_mk_value(i));
+					XA_BUG_ON(xa, xas_get_order(&xas) != order);
+					only_once++;
+				}
+				XA_BUG_ON(xa, only_once != 1);
+				xas_unlock(&xas);
+			}
+
+			if (order < max_order - 1) {
+				only_once = 0;
+				xas_set_order(&xas, (i & ~1UL) << order, order + 1);
+				xas_lock(&xas);
+				xas_for_each_conflict(&xas, entry) {
+					XA_BUG_ON(xa, entry != xa_mk_value(i));
+					XA_BUG_ON(xa, xas_get_order(&xas) != order);
+					only_once++;
+				}
+				XA_BUG_ON(xa, only_once != 1);
+				xas_unlock(&xas);
+			}
+
+			xas_set_order(&xas, i << order, order);
+			xas_lock(&xas);
+			xas_store(&xas, NULL);
+			xas_unlock(&xas);
+		}
+	}
+}
+
+
 static noinline void check_destroy(struct xarray *xa)
 {
 	unsigned long index;
@@ -1805,6 +1896,8 @@
 	check_reserve(&xa0);
 	check_multi_store(&array);
 	check_get_order(&array);
+	check_xas_get_order(&array);
+	check_xas_conflict_get_order(&array);
 	check_xa_alloc();
 	check_find(&array);
 	check_find_entry(&array);
--- linux-qcom-6.8.0.orig/lib/ubsan.h
+++ linux-qcom-6.8.0/lib/ubsan.h
@@ -124,15 +124,28 @@
 typedef u64 u_max;
 #endif
 
-void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs);
-void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, void *ptr);
-void __ubsan_handle_type_mismatch_v1(void *_data, void *ptr);
-void __ubsan_handle_out_of_bounds(void *_data, void *index);
-void __ubsan_handle_shift_out_of_bounds(void *_data, void *lhs, void *rhs);
-void __ubsan_handle_builtin_unreachable(void *_data);
-void __ubsan_handle_load_invalid_value(void *_data, void *val);
-void __ubsan_handle_alignment_assumption(void *_data, unsigned long ptr,
-					 unsigned long align,
-					 unsigned long offset);
+/*
+ * When generating Runtime Calls, Clang doesn't respect the -mregparm=3
+ * option used on i386: https://github.com/llvm/llvm-project/issues/89670
+ * Fix this for earlier Clang versions by forcing the calling convention
+ * to use non-register arguments.
+ */
+#if defined(CONFIG_X86_32) && \
+    defined(CONFIG_CC_IS_CLANG) && CONFIG_CLANG_VERSION < 190000
+# define ubsan_linkage asmlinkage
+#else
+# define ubsan_linkage
+#endif
+
+void ubsan_linkage __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs);
+void ubsan_linkage __ubsan_handle_type_mismatch(struct type_mismatch_data *data, void *ptr);
+void ubsan_linkage __ubsan_handle_type_mismatch_v1(void *_data, void *ptr);
+void ubsan_linkage __ubsan_handle_out_of_bounds(void *_data, void *index);
+void ubsan_linkage __ubsan_handle_shift_out_of_bounds(void *_data, void *lhs, void *rhs);
+void ubsan_linkage __ubsan_handle_builtin_unreachable(void *_data);
+void ubsan_linkage __ubsan_handle_load_invalid_value(void *_data, void *val);
+void ubsan_linkage __ubsan_handle_alignment_assumption(void *_data, unsigned long ptr,
+						       unsigned long align,
+						       unsigned long offset);
 
 #endif
--- linux-qcom-6.8.0.orig/lib/xarray.c
+++ linux-qcom-6.8.0/lib/xarray.c
@@ -1750,39 +1750,52 @@
 EXPORT_SYMBOL(xa_store_range);
 
 /**
- * xa_get_order() - Get the order of an entry.
- * @xa: XArray.
- * @index: Index of the entry.
+ * xas_get_order() - Get the order of an entry.
+ * @xas: XArray operation state.
+ *
+ * Called after xas_load, the xas should not be in an error state.
  *
  * Return: A number between 0 and 63 indicating the order of the entry.
  */
-int xa_get_order(struct xarray *xa, unsigned long index)
+int xas_get_order(struct xa_state *xas)
 {
-	XA_STATE(xas, xa, index);
-	void *entry;
 	int order = 0;
 
-	rcu_read_lock();
-	entry = xas_load(&xas);
-
-	if (!entry)
-		goto unlock;
-
-	if (!xas.xa_node)
-		goto unlock;
+	if (!xas->xa_node)
+		return 0;
 
 	for (;;) {
-		unsigned int slot = xas.xa_offset + (1 << order);
+		unsigned int slot = xas->xa_offset + (1 << order);
 
 		if (slot >= XA_CHUNK_SIZE)
 			break;
-		if (!xa_is_sibling(xas.xa_node->slots[slot]))
+		if (!xa_is_sibling(xa_entry(xas->xa, xas->xa_node, slot)))
 			break;
 		order++;
 	}
 
-	order += xas.xa_node->shift;
-unlock:
+	order += xas->xa_node->shift;
+	return order;
+}
+EXPORT_SYMBOL_GPL(xas_get_order);
+
+/**
+ * xa_get_order() - Get the order of an entry.
+ * @xa: XArray.
+ * @index: Index of the entry.
+ *
+ * Return: A number between 0 and 63 indicating the order of the entry.
+ */
+int xa_get_order(struct xarray *xa, unsigned long index)
+{
+	XA_STATE(xas, xa, index);
+	int order = 0;
+	void *entry;
+
+	rcu_read_lock();
+	entry = xas_load(&xas);
+	if (entry)
+		order = xas_get_order(&xas);
 	rcu_read_unlock();
 
 	return order;
--- linux-qcom-6.8.0.orig/lib/xz/xz_crc32.c
+++ linux-qcom-6.8.0/lib/xz/xz_crc32.c
@@ -29,7 +29,7 @@
 
 XZ_EXTERN void xz_crc32_init(void)
 {
-	const uint32_t poly = CRC32_POLY_LE;
+	const uint32_t poly = 0xEDB88320;
 
 	uint32_t i;
 	uint32_t j;
--- linux-qcom-6.8.0.orig/lib/xz/xz_private.h
+++ linux-qcom-6.8.0/lib/xz/xz_private.h
@@ -105,10 +105,6 @@
 #	endif
 #endif
 
-#ifndef CRC32_POLY_LE
-#define CRC32_POLY_LE 0xedb88320
-#endif
-
 /*
  * Allocate memory for LZMA2 decoder. xz_dec_lzma2_reset() must be used
  * before calling xz_dec_lzma2_run().
--- linux-qcom-6.8.0.orig/mm/Kconfig
+++ linux-qcom-6.8.0/mm/Kconfig
@@ -162,12 +162,15 @@
 	help
 	  Use the zbud allocator as the default allocator.
 
-config ZSWAP_ZPOOL_DEFAULT_Z3FOLD
-	bool "z3fold"
-	select Z3FOLD
+config ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED
+	bool "z3foldi (DEPRECATED)"
+	select Z3FOLD_DEPRECATED
 	help
 	  Use the z3fold allocator as the default allocator.
 
+	  Deprecated and scheduled for removal in a few cycles,
+	  see CONFIG_Z3FOLD_DEPRECATED.
+
 config ZSWAP_ZPOOL_DEFAULT_ZSMALLOC
 	bool "zsmalloc"
 	select ZSMALLOC
@@ -179,7 +182,7 @@
        string
        depends on ZSWAP
        default "zbud" if ZSWAP_ZPOOL_DEFAULT_ZBUD
-       default "z3fold" if ZSWAP_ZPOOL_DEFAULT_Z3FOLD
+       default "z3fold" if ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED
        default "zsmalloc" if ZSWAP_ZPOOL_DEFAULT_ZSMALLOC
        default ""
 
@@ -193,15 +196,25 @@
 	  deterministic reclaim properties that make it preferable to a higher
 	  density approach when reclaim will be used.
 
-config Z3FOLD
-	tristate "3:1 compression allocator (z3fold)"
+config Z3FOLD_DEPRECATED
+	tristate "3:1 compression allocator (z3fold) (DEPRECATED)"
 	depends on ZSWAP
 	help
+	  Deprecated and scheduled for removal in a few cycles. If you have
+	  a good reason for using Z3FOLD over ZSMALLOC, please contact
+	  linux-mm@kvack.org and the zswap maintainers.
+
 	  A special purpose allocator for storing compressed pages.
 	  It is designed to store up to three compressed pages per physical
 	  page. It is a ZBUD derivative so the simplicity and determinism are
 	  still there.
 
+config Z3FOLD
+	tristate
+	default y if Z3FOLD_DEPRECATED=y
+	default m if Z3FOLD_DEPRECATED=m
+	depends on Z3FOLD_DEPRECATED
+
 config ZSMALLOC
 	tristate
 	prompt "N:1 compression allocator (zsmalloc)" if ZSWAP
--- linux-qcom-6.8.0.orig/mm/Makefile
+++ linux-qcom-6.8.0/mm/Makefile
@@ -29,8 +29,7 @@
 KCOV_INSTRUMENT_vmstat.o := n
 KCOV_INSTRUMENT_failslab.o := n
 
-CFLAGS_init-mm.o += $(call cc-disable-warning, override-init)
-CFLAGS_init-mm.o += $(call cc-disable-warning, initializer-overrides)
+CFLAGS_init-mm.o += -Wno-override-init
 
 mmu-y			:= nommu.o
 mmu-$(CONFIG_MMU)	:= highmem.o memory.o mincore.o \
--- linux-qcom-6.8.0.orig/mm/cma.c
+++ linux-qcom-6.8.0/mm/cma.c
@@ -187,10 +187,6 @@
 	if (!size || !memblock_is_region_reserved(base, size))
 		return -EINVAL;
 
-	/* alignment should be aligned with order_per_bit */
-	if (!IS_ALIGNED(CMA_MIN_ALIGNMENT_PAGES, 1 << order_per_bit))
-		return -EINVAL;
-
 	/* ensure minimal alignment required by mm core */
 	if (!IS_ALIGNED(base | size, CMA_MIN_ALIGNMENT_BYTES))
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/mm/damon/core.c
+++ linux-qcom-6.8.0/mm/damon/core.c
@@ -1026,7 +1026,7 @@
 	damon_for_each_scheme(s, c) {
 		struct damos_quota *quota = &s->quota;
 
-		if (c->passed_sample_intervals != s->next_apply_sis)
+		if (c->passed_sample_intervals < s->next_apply_sis)
 			continue;
 
 		if (!s->wmarks.activated)
@@ -1070,17 +1070,31 @@
 		unsigned long score)
 {
 	const unsigned long goal = 10000;
-	unsigned long score_goal_diff = max(goal, score) - min(goal, score);
-	unsigned long score_goal_diff_bp = score_goal_diff * 10000 / goal;
-	unsigned long compensation = last_input * score_goal_diff_bp / 10000;
 	/* Set minimum input as 10000 to avoid compensation be zero */
 	const unsigned long min_input = 10000;
+	unsigned long score_goal_diff, compensation;
+	bool over_achieving = score > goal;
 
-	if (goal > score)
+	if (score == goal)
+		return last_input;
+	if (score >= goal * 2)
+		return min_input;
+
+	if (over_achieving)
+		score_goal_diff = score - goal;
+	else
+		score_goal_diff = goal - score;
+
+	if (last_input < ULONG_MAX / score_goal_diff)
+		compensation = last_input * score_goal_diff / goal;
+	else
+		compensation = last_input / goal * score_goal_diff;
+
+	if (over_achieving)
+		return max(last_input - compensation, min_input);
+	if (last_input < ULONG_MAX - compensation)
 		return last_input + compensation;
-	if (last_input > compensation + min_input)
-		return last_input - compensation;
-	return min_input;
+	return ULONG_MAX;
 }
 
 /* Shouldn't be called if quota->ms, quota->sz, and quota->get_score unset */
@@ -1176,7 +1190,7 @@
 	bool has_schemes_to_apply = false;
 
 	damon_for_each_scheme(s, c) {
-		if (c->passed_sample_intervals != s->next_apply_sis)
+		if (c->passed_sample_intervals < s->next_apply_sis)
 			continue;
 
 		if (!s->wmarks.activated)
@@ -1196,9 +1210,9 @@
 	}
 
 	damon_for_each_scheme(s, c) {
-		if (c->passed_sample_intervals != s->next_apply_sis)
+		if (c->passed_sample_intervals < s->next_apply_sis)
 			continue;
-		s->next_apply_sis +=
+		s->next_apply_sis = c->passed_sample_intervals +
 			(s->apply_interval_us ? s->apply_interval_us :
 			 c->attrs.aggr_interval) / sample_interval;
 	}
@@ -1257,14 +1271,31 @@
  * access frequencies are similar.  This is for minimizing the monitoring
  * overhead under the dynamically changeable access pattern.  If a merge was
  * unnecessarily made, later 'kdamond_split_regions()' will revert it.
+ *
+ * The total number of regions could be higher than the user-defined limit,
+ * max_nr_regions for some cases.  For example, the user can update
+ * max_nr_regions to a number that lower than the current number of regions
+ * while DAMON is running.  For such a case, repeat merging until the limit is
+ * met while increasing @threshold up to possible maximum level.
  */
 static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
 				  unsigned long sz_limit)
 {
 	struct damon_target *t;
+	unsigned int nr_regions;
+	unsigned int max_thres;
 
-	damon_for_each_target(t, c)
-		damon_merge_regions_of(t, threshold, sz_limit);
+	max_thres = c->attrs.aggr_interval /
+		(c->attrs.sample_interval ?  c->attrs.sample_interval : 1);
+	do {
+		nr_regions = 0;
+		damon_for_each_target(t, c) {
+			damon_merge_regions_of(t, threshold, sz_limit);
+			nr_regions += damon_nr_regions(t);
+		}
+		threshold = max(1, threshold * 2);
+	} while (nr_regions > c->attrs.max_nr_regions &&
+			threshold / 2 < max_thres);
 }
 
 /*
@@ -1532,7 +1563,7 @@
 		if (ctx->ops.check_accesses)
 			max_nr_accesses = ctx->ops.check_accesses(ctx);
 
-		if (ctx->passed_sample_intervals == next_aggregation_sis) {
+		if (ctx->passed_sample_intervals >= next_aggregation_sis) {
 			kdamond_merge_regions(ctx,
 					max_nr_accesses / 10,
 					sz_limit);
@@ -1550,7 +1581,7 @@
 
 		sample_interval = ctx->attrs.sample_interval ?
 			ctx->attrs.sample_interval : 1;
-		if (ctx->passed_sample_intervals == next_aggregation_sis) {
+		if (ctx->passed_sample_intervals >= next_aggregation_sis) {
 			ctx->next_aggregation_sis = next_aggregation_sis +
 				ctx->attrs.aggr_interval / sample_interval;
 
@@ -1560,7 +1591,7 @@
 				ctx->ops.reset_aggregated(ctx);
 		}
 
-		if (ctx->passed_sample_intervals == next_ops_update_sis) {
+		if (ctx->passed_sample_intervals >= next_ops_update_sis) {
 			ctx->next_ops_update_sis = next_ops_update_sis +
 				ctx->attrs.ops_update_interval /
 				sample_interval;
--- linux-qcom-6.8.0.orig/mm/damon/sysfs-test.h
+++ linux-qcom-6.8.0/mm/damon/sysfs-test.h
@@ -67,6 +67,7 @@
 	damon_destroy_ctx(ctx);
 	kfree(sysfs_targets->targets_arr);
 	kfree(sysfs_targets);
+	kfree(sysfs_target->regions);
 	kfree(sysfs_target);
 }
 
--- linux-qcom-6.8.0.orig/mm/damon/vaddr-test.h
+++ linux-qcom-6.8.0/mm/damon/vaddr-test.h
@@ -300,6 +300,7 @@
 	damon_test_split_evenly_fail(test, 0, 100, 0);
 	damon_test_split_evenly_succ(test, 0, 100, 10);
 	damon_test_split_evenly_succ(test, 5, 59, 5);
+	damon_test_split_evenly_succ(test, 0, 3, 2);
 	damon_test_split_evenly_fail(test, 5, 6, 2);
 }
 
--- linux-qcom-6.8.0.orig/mm/damon/vaddr.c
+++ linux-qcom-6.8.0/mm/damon/vaddr.c
@@ -67,6 +67,7 @@
 	unsigned long sz_orig, sz_piece, orig_end;
 	struct damon_region *n = NULL, *next;
 	unsigned long start;
+	unsigned int i;
 
 	if (!r || !nr_pieces)
 		return -EINVAL;
@@ -80,8 +81,7 @@
 
 	r->ar.end = r->ar.start + sz_piece;
 	next = damon_next_region(r);
-	for (start = r->ar.end; start + sz_piece <= orig_end;
-			start += sz_piece) {
+	for (start = r->ar.end, i = 1; i < nr_pieces; start += sz_piece, i++) {
 		n = damon_new_region(start, start + sz_piece);
 		if (!n)
 			return -ENOMEM;
@@ -126,6 +126,7 @@
 	 * If this is too slow, it can be optimised to examine the maple
 	 * tree gaps.
 	 */
+	rcu_read_lock();
 	for_each_vma(vmi, vma) {
 		unsigned long gap;
 
@@ -146,6 +147,7 @@
 next:
 		prev = vma;
 	}
+	rcu_read_unlock();
 
 	if (!sz_range(&second_gap) || !sz_range(&first_gap))
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/mm/debug_vm_pgtable.c
+++ linux-qcom-6.8.0/mm/debug_vm_pgtable.c
@@ -39,22 +39,7 @@
  * Please refer Documentation/mm/arch_pgtable_helpers.rst for the semantics
  * expectations that are being validated here. All future changes in here
  * or the documentation need to be in sync.
- *
- * On s390 platform, the lower 4 bits are used to identify given page table
- * entry type. But these bits might affect the ability to clear entries with
- * pxx_clear() because of how dynamic page table folding works on s390. So
- * while loading up the entries do not change the lower 4 bits. It does not
- * have affect any other platform. Also avoid the 62nd bit on ppc64 that is
- * used to mark a pte entry.
  */
-#define S390_SKIP_MASK		GENMASK(3, 0)
-#if __BITS_PER_LONG == 64
-#define PPC64_SKIP_MASK		GENMASK(62, 62)
-#else
-#define PPC64_SKIP_MASK		0x0
-#endif
-#define ARCH_SKIP_MASK (S390_SKIP_MASK | PPC64_SKIP_MASK)
-#define RANDOM_ORVALUE (GENMASK(BITS_PER_LONG - 1, 0) & ~ARCH_SKIP_MASK)
 #define RANDOM_NZVALUE	GENMASK(7, 0)
 
 struct pgtable_debug_args {
@@ -510,8 +495,7 @@
 		return;
 
 	pr_debug("Validating PUD clear\n");
-	pud = __pud(pud_val(pud) | RANDOM_ORVALUE);
-	WRITE_ONCE(*args->pudp, pud);
+	WARN_ON(pud_none(pud));
 	pud_clear(args->pudp);
 	pud = READ_ONCE(*args->pudp);
 	WARN_ON(!pud_none(pud));
@@ -547,8 +531,7 @@
 		return;
 
 	pr_debug("Validating P4D clear\n");
-	p4d = __p4d(p4d_val(p4d) | RANDOM_ORVALUE);
-	WRITE_ONCE(*args->p4dp, p4d);
+	WARN_ON(p4d_none(p4d));
 	p4d_clear(args->p4dp);
 	p4d = READ_ONCE(*args->p4dp);
 	WARN_ON(!p4d_none(p4d));
@@ -581,8 +564,7 @@
 		return;
 
 	pr_debug("Validating PGD clear\n");
-	pgd = __pgd(pgd_val(pgd) | RANDOM_ORVALUE);
-	WRITE_ONCE(*args->pgdp, pgd);
+	WARN_ON(pgd_none(pgd));
 	pgd_clear(args->pgdp);
 	pgd = READ_ONCE(*args->pgdp);
 	WARN_ON(!pgd_none(pgd));
@@ -633,10 +615,8 @@
 	if (WARN_ON(!args->ptep))
 		return;
 
-#ifndef CONFIG_RISCV
-	pte = __pte(pte_val(pte) | RANDOM_ORVALUE);
-#endif
 	set_pte_at(args->mm, args->vaddr, args->ptep, pte);
+	WARN_ON(pte_none(pte));
 	flush_dcache_page(page);
 	barrier();
 	ptep_clear(args->mm, args->vaddr, args->ptep);
@@ -649,8 +629,7 @@
 	pmd_t pmd = READ_ONCE(*args->pmdp);
 
 	pr_debug("Validating PMD clear\n");
-	pmd = __pmd(pmd_val(pmd) | RANDOM_ORVALUE);
-	WRITE_ONCE(*args->pmdp, pmd);
+	WARN_ON(pmd_none(pmd));
 	pmd_clear(args->pmdp);
 	pmd = READ_ONCE(*args->pmdp);
 	WARN_ON(!pmd_none(pmd));
--- linux-qcom-6.8.0.orig/mm/filemap.c
+++ linux-qcom-6.8.0/mm/filemap.c
@@ -844,6 +844,8 @@
 {
 	XA_STATE(xas, &mapping->i_pages, index);
 	int huge = folio_test_hugetlb(folio);
+	void *alloced_shadow = NULL;
+	int alloced_order = 0;
 	bool charged = false;
 	long nr = 1;
 
@@ -867,13 +869,10 @@
 	folio->mapping = mapping;
 	folio->index = xas.xa_index;
 
-	do {
-		unsigned int order = xa_get_order(xas.xa, xas.xa_index);
+	for (;;) {
+		int order = -1, split_order = 0;
 		void *entry, *old = NULL;
 
-		if (order > folio_order(folio))
-			xas_split_alloc(&xas, xa_load(xas.xa, xas.xa_index),
-					order, gfp);
 		xas_lock_irq(&xas);
 		xas_for_each_conflict(&xas, entry) {
 			old = entry;
@@ -881,19 +880,33 @@
 				xas_set_err(&xas, -EEXIST);
 				goto unlock;
 			}
+			/*
+			 * If a larger entry exists,
+			 * it will be the first and only entry iterated.
+			 */
+			if (order == -1)
+				order = xas_get_order(&xas);
+		}
+
+		/* entry may have changed before we re-acquire the lock */
+		if (alloced_order && (old != alloced_shadow || order != alloced_order)) {
+			xas_destroy(&xas);
+			alloced_order = 0;
 		}
 
 		if (old) {
-			if (shadowp)
-				*shadowp = old;
-			/* entry may have been split before we acquired lock */
-			order = xa_get_order(xas.xa, xas.xa_index);
-			if (order > folio_order(folio)) {
+			if (order > 0 && order > folio_order(folio)) {
 				/* How to handle large swap entries? */
 				BUG_ON(shmem_mapping(mapping));
+				if (!alloced_order) {
+					split_order = order;
+					goto unlock;
+				}
 				xas_split(&xas, old, order);
 				xas_reset(&xas);
 			}
+			if (shadowp)
+				*shadowp = old;
 		}
 
 		xas_store(&xas, folio);
@@ -909,9 +922,24 @@
 				__lruvec_stat_mod_folio(folio,
 						NR_FILE_THPS, nr);
 		}
+
 unlock:
 		xas_unlock_irq(&xas);
-	} while (xas_nomem(&xas, gfp));
+
+		/* split needed, alloc here and retry. */
+		if (split_order) {
+			xas_split_alloc(&xas, old, split_order, gfp);
+			if (xas_error(&xas))
+				goto error;
+			alloced_shadow = old;
+			alloced_order = split_order;
+			xas_reset(&xas);
+			continue;
+		}
+
+		if (!xas_nomem(&xas, gfp))
+			break;
+	}
 
 	if (xas_error(&xas))
 		goto error;
@@ -969,10 +997,12 @@
 			n = cpuset_mem_spread_node();
 			folio = __folio_alloc_node(gfp, order, n);
 		} while (!folio && read_mems_allowed_retry(cpuset_mems_cookie));
-
-		return folio;
+	} else {
+		folio = folio_alloc(gfp, order);
 	}
-	return folio_alloc(gfp, order);
+	if (folio)
+		VM_BUG_ON_FOLIO(folio->private, folio);
+	return folio;
 }
 EXPORT_SYMBOL(filemap_alloc_folio);
 #endif
@@ -1814,7 +1844,7 @@
 	if (!folio || xa_is_value(folio))
 		goto out;
 
-	if (!folio_try_get_rcu(folio))
+	if (!folio_try_get(folio))
 		goto repeat;
 
 	if (unlikely(folio != xas_reload(&xas))) {
@@ -1912,8 +1942,6 @@
 			gfp_t alloc_gfp = gfp;
 
 			err = -ENOMEM;
-			if (order == 1)
-				order = 0;
 			if (order > 0)
 				alloc_gfp |= __GFP_NORETRY | __GFP_NOWARN;
 			folio = filemap_alloc_folio(alloc_gfp, order);
@@ -1970,7 +1998,7 @@
 	if (!folio || xa_is_value(folio))
 		return folio;
 
-	if (!folio_try_get_rcu(folio))
+	if (!folio_try_get(folio))
 		goto reset;
 
 	if (unlikely(folio != xas_reload(xas))) {
@@ -2150,7 +2178,7 @@
 		if (xa_is_value(folio))
 			goto update_start;
 
-		if (!folio_try_get_rcu(folio))
+		if (!folio_try_get(folio))
 			goto retry;
 
 		if (unlikely(folio != xas_reload(&xas)))
@@ -2282,7 +2310,7 @@
 			break;
 		if (xa_is_sibling(folio))
 			break;
-		if (!folio_try_get_rcu(folio))
+		if (!folio_try_get(folio))
 			goto retry;
 
 		if (unlikely(folio != xas_reload(&xas)))
@@ -2574,7 +2602,7 @@
 	if (unlikely(!iov_iter_count(iter)))
 		return 0;
 
-	iov_iter_truncate(iter, inode->i_sb->s_maxbytes);
+	iov_iter_truncate(iter, inode->i_sb->s_maxbytes - iocb->ki_pos);
 	folio_batch_init(&fbatch);
 
 	do {
@@ -2955,7 +2983,7 @@
 		if (ops->is_partially_uptodate(folio, offset, bsz) ==
 							seek_data)
 			break;
-		start = (start + bsz) & ~(bsz - 1);
+		start = (start + bsz) & ~((u64)bsz - 1);
 		offset += bsz;
 	} while (offset < folio_size(folio));
 unlock:
@@ -3102,7 +3130,7 @@
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 	/* Use the readahead code, even if readahead is disabled */
-	if (vm_flags & VM_HUGEPAGE) {
+	if ((vm_flags & VM_HUGEPAGE) && HPAGE_PMD_ORDER <= MAX_PAGECACHE_ORDER) {
 		fpin = maybe_unlock_mmap_for_io(vmf, fpin);
 		ractl._index &= ~((unsigned long)HPAGE_PMD_NR - 1);
 		ra->size = HPAGE_PMD_NR;
@@ -3404,7 +3432,7 @@
 			continue;
 		if (folio_test_locked(folio))
 			continue;
-		if (!folio_try_get_rcu(folio))
+		if (!folio_try_get(folio))
 			continue;
 		/* Has the page moved or been split? */
 		if (unlikely(folio != xas_reload(xas)))
@@ -4090,6 +4118,60 @@
 }
 EXPORT_SYMBOL(filemap_release_folio);
 
+/**
+ * filemap_invalidate_inode - Invalidate/forcibly write back a range of an inode's pagecache
+ * @inode: The inode to flush
+ * @flush: Set to write back rather than simply invalidate.
+ * @start: First byte to in range.
+ * @end: Last byte in range (inclusive), or LLONG_MAX for everything from start
+ *       onwards.
+ *
+ * Invalidate all the folios on an inode that contribute to the specified
+ * range, possibly writing them back first.  Whilst the operation is
+ * undertaken, the invalidate lock is held to prevent new folios from being
+ * installed.
+ */
+int filemap_invalidate_inode(struct inode *inode, bool flush,
+			     loff_t start, loff_t end)
+{
+	struct address_space *mapping = inode->i_mapping;
+	pgoff_t first = start >> PAGE_SHIFT;
+	pgoff_t last = end >> PAGE_SHIFT;
+	pgoff_t nr = end == LLONG_MAX ? ULONG_MAX : last - first + 1;
+
+	if (!mapping || !mapping->nrpages || end < start)
+		goto out;
+
+	/* Prevent new folios from being added to the inode. */
+	filemap_invalidate_lock(mapping);
+
+	if (!mapping->nrpages)
+		goto unlock;
+
+	unmap_mapping_pages(mapping, first, nr, false);
+
+	/* Write back the data if we're asked to. */
+	if (flush) {
+		struct writeback_control wbc = {
+			.sync_mode	= WB_SYNC_ALL,
+			.nr_to_write	= LONG_MAX,
+			.range_start	= start,
+			.range_end	= end,
+		};
+
+		filemap_fdatawrite_wbc(mapping, &wbc);
+	}
+
+	/* Wait for writeback to complete on all folios and discard. */
+	truncate_inode_pages_range(mapping, start, end);
+
+unlock:
+	filemap_invalidate_unlock(mapping);
+out:
+	return filemap_check_errors(mapping);
+}
+EXPORT_SYMBOL_GPL(filemap_invalidate_inode);
+
 #ifdef CONFIG_CACHESTAT_SYSCALL
 /**
  * filemap_cachestat() - compute the page cache statistics of a mapping
@@ -4109,6 +4191,9 @@
 	XA_STATE(xas, &mapping->i_pages, first_index);
 	struct folio *folio;
 
+	/* Flush stats (and potentially sleep) outside the RCU read section. */
+	mem_cgroup_flush_stats_ratelimited(NULL);
+
 	rcu_read_lock();
 	xas_for_each(&xas, folio, last_index) {
 		int order;
@@ -4153,10 +4238,26 @@
 				/* shmem file - in swap cache */
 				swp_entry_t swp = radix_to_swp_entry(folio);
 
+				/* swapin error results in poisoned entry */
+				if (non_swap_entry(swp))
+					goto resched;
+
+				/*
+				 * Getting a swap entry from the shmem
+				 * inode means we beat
+				 * shmem_unuse(). rcu_read_lock()
+				 * ensures swapoff waits for us before
+				 * freeing the swapper space. However,
+				 * we can race with swapping and
+				 * invalidation, so there might not be
+				 * a shadow in the swapcache (yet).
+				 */
 				shadow = get_shadow_from_swap_cache(swp);
+				if (!shadow)
+					goto resched;
 			}
 #endif
-			if (workingset_test_recent(shadow, true, &workingset))
+			if (workingset_test_recent(shadow, true, &workingset, false))
 				cs->nr_recently_evicted += nr_pages;
 
 			goto resched;
@@ -4181,6 +4282,20 @@
 }
 
 /*
+ * See mincore: reveal pagecache information only for files
+ * that the calling process has write access to, or could (if
+ * tried) open for writing.
+ */
+static inline bool can_do_cachestat(struct file *f)
+{
+	if (f->f_mode & FMODE_WRITE)
+		return true;
+	if (inode_owner_or_capable(file_mnt_idmap(f), file_inode(f)))
+		return true;
+	return file_permission(f, MAY_WRITE) == 0;
+}
+
+/*
  * The cachestat(2) system call.
  *
  * cachestat() returns the page cache statistics of a file in the
@@ -4239,6 +4354,11 @@
 		return -EOPNOTSUPP;
 	}
 
+	if (!can_do_cachestat(f.file)) {
+		fdput(f);
+		return -EPERM;
+	}
+
 	if (flags != 0) {
 		fdput(f);
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/mm/gup.c
+++ linux-qcom-6.8.0/mm/gup.c
@@ -76,7 +76,7 @@
 	folio = page_folio(page);
 	if (WARN_ON_ONCE(folio_ref_count(folio) < 0))
 		return NULL;
-	if (unlikely(!folio_ref_try_add_rcu(folio, refs)))
+	if (unlikely(!folio_ref_try_add(folio, refs)))
 		return NULL;
 
 	/*
@@ -97,95 +97,6 @@
 	return folio;
 }
 
-/**
- * try_grab_folio() - Attempt to get or pin a folio.
- * @page:  pointer to page to be grabbed
- * @refs:  the value to (effectively) add to the folio's refcount
- * @flags: gup flags: these are the FOLL_* flag values.
- *
- * "grab" names in this file mean, "look at flags to decide whether to use
- * FOLL_PIN or FOLL_GET behavior, when incrementing the folio's refcount.
- *
- * Either FOLL_PIN or FOLL_GET (or neither) must be set, but not both at the
- * same time. (That's true throughout the get_user_pages*() and
- * pin_user_pages*() APIs.) Cases:
- *
- *    FOLL_GET: folio's refcount will be incremented by @refs.
- *
- *    FOLL_PIN on large folios: folio's refcount will be incremented by
- *    @refs, and its pincount will be incremented by @refs.
- *
- *    FOLL_PIN on single-page folios: folio's refcount will be incremented by
- *    @refs * GUP_PIN_COUNTING_BIAS.
- *
- * Return: The folio containing @page (with refcount appropriately
- * incremented) for success, or NULL upon failure. If neither FOLL_GET
- * nor FOLL_PIN was set, that's considered failure, and furthermore,
- * a likely bug in the caller, so a warning is also emitted.
- */
-struct folio *try_grab_folio(struct page *page, int refs, unsigned int flags)
-{
-	struct folio *folio;
-
-	if (WARN_ON_ONCE((flags & (FOLL_GET | FOLL_PIN)) == 0))
-		return NULL;
-
-	if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(page)))
-		return NULL;
-
-	if (flags & FOLL_GET)
-		return try_get_folio(page, refs);
-
-	/* FOLL_PIN is set */
-
-	/*
-	 * Don't take a pin on the zero page - it's not going anywhere
-	 * and it is used in a *lot* of places.
-	 */
-	if (is_zero_page(page))
-		return page_folio(page);
-
-	folio = try_get_folio(page, refs);
-	if (!folio)
-		return NULL;
-
-	/*
-	 * Can't do FOLL_LONGTERM + FOLL_PIN gup fast path if not in a
-	 * right zone, so fail and let the caller fall back to the slow
-	 * path.
-	 */
-	if (unlikely((flags & FOLL_LONGTERM) &&
-		     !folio_is_longterm_pinnable(folio))) {
-		if (!put_devmap_managed_page_refs(&folio->page, refs))
-			folio_put_refs(folio, refs);
-		return NULL;
-	}
-
-	/*
-	 * When pinning a large folio, use an exact count to track it.
-	 *
-	 * However, be sure to *also* increment the normal folio
-	 * refcount field at least once, so that the folio really
-	 * is pinned.  That's why the refcount from the earlier
-	 * try_get_folio() is left intact.
-	 */
-	if (folio_test_large(folio))
-		atomic_add(refs, &folio->_pincount);
-	else
-		folio_ref_add(folio,
-				refs * (GUP_PIN_COUNTING_BIAS - 1));
-	/*
-	 * Adjust the pincount before re-checking the PTE for changes.
-	 * This is essentially a smp_mb() and is paired with a memory
-	 * barrier in folio_try_share_anon_rmap_*().
-	 */
-	smp_mb__after_atomic();
-
-	node_stat_mod_folio(folio, NR_FOLL_PIN_ACQUIRED, refs);
-
-	return folio;
-}
-
 static void gup_put_folio(struct folio *folio, int refs, unsigned int flags)
 {
 	if (flags & FOLL_PIN) {
@@ -203,58 +114,59 @@
 }
 
 /**
- * try_grab_page() - elevate a page's refcount by a flag-dependent amount
- * @page:    pointer to page to be grabbed
- * @flags:   gup flags: these are the FOLL_* flag values.
+ * try_grab_folio() - add a folio's refcount by a flag-dependent amount
+ * @folio:    pointer to folio to be grabbed
+ * @refs:     the value to (effectively) add to the folio's refcount
+ * @flags:    gup flags: these are the FOLL_* flag values
  *
  * This might not do anything at all, depending on the flags argument.
  *
  * "grab" names in this file mean, "look at flags to decide whether to use
- * FOLL_PIN or FOLL_GET behavior, when incrementing the page's refcount.
+ * FOLL_PIN or FOLL_GET behavior, when incrementing the folio's refcount.
  *
  * Either FOLL_PIN or FOLL_GET (or neither) may be set, but not both at the same
- * time. Cases: please see the try_grab_folio() documentation, with
- * "refs=1".
+ * time.
  *
  * Return: 0 for success, or if no action was required (if neither FOLL_PIN
  * nor FOLL_GET was set, nothing is done). A negative error code for failure:
  *
- *   -ENOMEM		FOLL_GET or FOLL_PIN was set, but the page could not
+ *   -ENOMEM		FOLL_GET or FOLL_PIN was set, but the folio could not
  *			be grabbed.
+ *
+ * It is called when we have a stable reference for the folio, typically in
+ * GUP slow path.
  */
-int __must_check try_grab_page(struct page *page, unsigned int flags)
+int __must_check try_grab_folio(struct folio *folio, int refs,
+				unsigned int flags)
 {
-	struct folio *folio = page_folio(page);
-
 	if (WARN_ON_ONCE(folio_ref_count(folio) <= 0))
 		return -ENOMEM;
 
-	if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(page)))
+	if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(&folio->page)))
 		return -EREMOTEIO;
 
 	if (flags & FOLL_GET)
-		folio_ref_inc(folio);
+		folio_ref_add(folio, refs);
 	else if (flags & FOLL_PIN) {
 		/*
 		 * Don't take a pin on the zero page - it's not going anywhere
 		 * and it is used in a *lot* of places.
 		 */
-		if (is_zero_page(page))
+		if (is_zero_folio(folio))
 			return 0;
 
 		/*
-		 * Similar to try_grab_folio(): be sure to *also*
-		 * increment the normal page refcount field at least once,
+		 * Increment the normal page refcount field at least once,
 		 * so that the page really is pinned.
 		 */
 		if (folio_test_large(folio)) {
-			folio_ref_add(folio, 1);
-			atomic_add(1, &folio->_pincount);
+			folio_ref_add(folio, refs);
+			atomic_add(refs, &folio->_pincount);
 		} else {
-			folio_ref_add(folio, GUP_PIN_COUNTING_BIAS);
+			folio_ref_add(folio, refs * GUP_PIN_COUNTING_BIAS);
 		}
 
-		node_stat_mod_folio(folio, NR_FOLL_PIN_ACQUIRED, 1);
+		node_stat_mod_folio(folio, NR_FOLL_PIN_ACQUIRED, refs);
 	}
 
 	return 0;
@@ -647,8 +559,8 @@
 	VM_BUG_ON_PAGE((flags & FOLL_PIN) && PageAnon(page) &&
 		       !PageAnonExclusive(page), page);
 
-	/* try_grab_page() does nothing unless FOLL_GET or FOLL_PIN is set. */
-	ret = try_grab_page(page, flags);
+	/* try_grab_folio() does nothing unless FOLL_GET or FOLL_PIN is set. */
+	ret = try_grab_folio(page_folio(page), 1, flags);
 	if (unlikely(ret)) {
 		page = ERR_PTR(ret);
 		goto out;
@@ -901,7 +813,7 @@
 			goto unmap;
 		*page = pte_page(entry);
 	}
-	ret = try_grab_page(*page, gup_flags);
+	ret = try_grab_folio(page_folio(*page), 1, gup_flags);
 	if (unlikely(ret))
 		goto unmap;
 out:
@@ -1206,6 +1118,22 @@
 
 		/* first iteration or cross vma bound */
 		if (!vma || start >= vma->vm_end) {
+			/*
+			 * MADV_POPULATE_(READ|WRITE) wants to handle VMA
+			 * lookups+error reporting differently.
+			 */
+			if (gup_flags & FOLL_MADV_POPULATE) {
+				vma = vma_lookup(mm, start);
+				if (!vma) {
+					ret = -ENOMEM;
+					goto out;
+				}
+				if (check_vma_flags(vma, gup_flags)) {
+					ret = -EINVAL;
+					goto out;
+				}
+				goto retry;
+			}
 			vma = gup_vma_lookup(mm, start);
 			if (!vma && in_gate_area(mm, start)) {
 				ret = get_gate_page(mm, start & PAGE_MASK,
@@ -1288,20 +1216,19 @@
 			 * pages.
 			 */
 			if (page_increm > 1) {
-				struct folio *folio;
+				struct folio *folio = page_folio(page);
 
 				/*
 				 * Since we already hold refcount on the
 				 * large folio, this should never fail.
 				 */
-				folio = try_grab_folio(page, page_increm - 1,
-						       foll_flags);
-				if (WARN_ON_ONCE(!folio)) {
+				if (try_grab_folio(folio, page_increm - 1,
+						       foll_flags)) {
 					/*
 					 * Release the 1st page ref if the
 					 * folio is problematic, fail hard.
 					 */
-					gup_put_folio(page_folio(page), 1,
+					gup_put_folio(folio, 1,
 						      foll_flags);
 					ret = -EFAULT;
 					goto out;
@@ -1683,35 +1610,35 @@
 }
 
 /*
- * faultin_vma_page_range() - populate (prefault) page tables inside the
- *			      given VMA range readable/writable
+ * faultin_page_range() - populate (prefault) page tables inside the
+ *			  given range readable/writable
  *
  * This takes care of mlocking the pages, too, if VM_LOCKED is set.
  *
- * @vma: target vma
+ * @mm: the mm to populate page tables in
  * @start: start address
  * @end: end address
  * @write: whether to prefault readable or writable
  * @locked: whether the mmap_lock is still held
  *
- * Returns either number of processed pages in the vma, or a negative error
- * code on error (see __get_user_pages()).
+ * Returns either number of processed pages in the MM, or a negative error
+ * code on error (see __get_user_pages()). Note that this function reports
+ * errors related to VMAs, such as incompatible mappings, as expected by
+ * MADV_POPULATE_(READ|WRITE).
  *
- * vma->vm_mm->mmap_lock must be held. The range must be page-aligned and
- * covered by the VMA. If it's released, *@locked will be set to 0.
+ * The range must be page-aligned.
+ *
+ * mm->mmap_lock must be held. If it's released, *@locked will be set to 0.
  */
-long faultin_vma_page_range(struct vm_area_struct *vma, unsigned long start,
-			    unsigned long end, bool write, int *locked)
+long faultin_page_range(struct mm_struct *mm, unsigned long start,
+			unsigned long end, bool write, int *locked)
 {
-	struct mm_struct *mm = vma->vm_mm;
 	unsigned long nr_pages = (end - start) / PAGE_SIZE;
 	int gup_flags;
 	long ret;
 
 	VM_BUG_ON(!PAGE_ALIGNED(start));
 	VM_BUG_ON(!PAGE_ALIGNED(end));
-	VM_BUG_ON_VMA(start < vma->vm_start, vma);
-	VM_BUG_ON_VMA(end > vma->vm_end, vma);
 	mmap_assert_locked(mm);
 
 	/*
@@ -1723,19 +1650,13 @@
 	 *		  a poisoned page.
 	 * !FOLL_FORCE: Require proper access permissions.
 	 */
-	gup_flags = FOLL_TOUCH | FOLL_HWPOISON | FOLL_UNLOCKABLE;
+	gup_flags = FOLL_TOUCH | FOLL_HWPOISON | FOLL_UNLOCKABLE |
+		    FOLL_MADV_POPULATE;
 	if (write)
 		gup_flags |= FOLL_WRITE;
 
-	/*
-	 * We want to report -EINVAL instead of -EFAULT for any permission
-	 * problems or incompatible mappings.
-	 */
-	if (check_vma_flags(vma, gup_flags))
-		return -EINVAL;
-
-	ret = __get_user_pages(mm, start, nr_pages, gup_flags,
-			       NULL, locked);
+	ret = __get_user_pages_locked(mm, start, nr_pages, NULL, locked,
+				      gup_flags);
 	lru_add_drain();
 	return ret;
 }
@@ -2544,6 +2465,102 @@
 	}
 }
 
+/**
+ * try_grab_folio_fast() - Attempt to get or pin a folio in fast path.
+ * @page:  pointer to page to be grabbed
+ * @refs:  the value to (effectively) add to the folio's refcount
+ * @flags: gup flags: these are the FOLL_* flag values.
+ *
+ * "grab" names in this file mean, "look at flags to decide whether to use
+ * FOLL_PIN or FOLL_GET behavior, when incrementing the folio's refcount.
+ *
+ * Either FOLL_PIN or FOLL_GET (or neither) must be set, but not both at the
+ * same time. (That's true throughout the get_user_pages*() and
+ * pin_user_pages*() APIs.) Cases:
+ *
+ *    FOLL_GET: folio's refcount will be incremented by @refs.
+ *
+ *    FOLL_PIN on large folios: folio's refcount will be incremented by
+ *    @refs, and its pincount will be incremented by @refs.
+ *
+ *    FOLL_PIN on single-page folios: folio's refcount will be incremented by
+ *    @refs * GUP_PIN_COUNTING_BIAS.
+ *
+ * Return: The folio containing @page (with refcount appropriately
+ * incremented) for success, or NULL upon failure. If neither FOLL_GET
+ * nor FOLL_PIN was set, that's considered failure, and furthermore,
+ * a likely bug in the caller, so a warning is also emitted.
+ *
+ * It uses add ref unless zero to elevate the folio refcount and must be called
+ * in fast path only.
+ */
+static struct folio *try_grab_folio_fast(struct page *page, int refs,
+					 unsigned int flags)
+{
+	struct folio *folio;
+
+	/* Raise warn if it is not called in fast GUP */
+	VM_WARN_ON_ONCE(!irqs_disabled());
+
+	if (WARN_ON_ONCE((flags & (FOLL_GET | FOLL_PIN)) == 0))
+		return NULL;
+
+	if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(page)))
+		return NULL;
+
+	if (flags & FOLL_GET)
+		return try_get_folio(page, refs);
+
+	/* FOLL_PIN is set */
+
+	/*
+	 * Don't take a pin on the zero page - it's not going anywhere
+	 * and it is used in a *lot* of places.
+	 */
+	if (is_zero_page(page))
+		return page_folio(page);
+
+	folio = try_get_folio(page, refs);
+	if (!folio)
+		return NULL;
+
+	/*
+	 * Can't do FOLL_LONGTERM + FOLL_PIN gup fast path if not in a
+	 * right zone, so fail and let the caller fall back to the slow
+	 * path.
+	 */
+	if (unlikely((flags & FOLL_LONGTERM) &&
+		     !folio_is_longterm_pinnable(folio))) {
+		if (!put_devmap_managed_page_refs(&folio->page, refs))
+			folio_put_refs(folio, refs);
+		return NULL;
+	}
+
+	/*
+	 * When pinning a large folio, use an exact count to track it.
+	 *
+	 * However, be sure to *also* increment the normal folio
+	 * refcount field at least once, so that the folio really
+	 * is pinned.  That's why the refcount from the earlier
+	 * try_get_folio() is left intact.
+	 */
+	if (folio_test_large(folio))
+		atomic_add(refs, &folio->_pincount);
+	else
+		folio_ref_add(folio,
+				refs * (GUP_PIN_COUNTING_BIAS - 1));
+	/*
+	 * Adjust the pincount before re-checking the PTE for changes.
+	 * This is essentially a smp_mb() and is paired with a memory
+	 * barrier in folio_try_share_anon_rmap_*().
+	 */
+	smp_mb__after_atomic();
+
+	node_stat_mod_folio(folio, NR_FOLL_PIN_ACQUIRED, refs);
+
+	return folio;
+}
+
 #ifdef CONFIG_ARCH_HAS_PTE_SPECIAL
 /*
  * Fast-gup relies on pte change detection to avoid concurrent pgtable
@@ -2608,7 +2625,7 @@
 		VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
 		page = pte_page(pte);
 
-		folio = try_grab_folio(page, 1, flags);
+		folio = try_grab_folio_fast(page, 1, flags);
 		if (!folio)
 			goto pte_unmap;
 
@@ -2702,7 +2719,7 @@
 
 		SetPageReferenced(page);
 		pages[*nr] = page;
-		if (unlikely(try_grab_page(page, flags))) {
+		if (unlikely(try_grab_folio(page_folio(page), 1, flags))) {
 			undo_dev_pagemap(nr, nr_start, flags, pages);
 			break;
 		}
@@ -2811,7 +2828,7 @@
 	page = nth_page(pte_page(pte), (addr & (sz - 1)) >> PAGE_SHIFT);
 	refs = record_subpages(page, addr, end, pages + *nr);
 
-	folio = try_grab_folio(page, refs, flags);
+	folio = try_grab_folio_fast(page, refs, flags);
 	if (!folio)
 		return 0;
 
@@ -2882,7 +2899,7 @@
 	page = nth_page(pmd_page(orig), (addr & ~PMD_MASK) >> PAGE_SHIFT);
 	refs = record_subpages(page, addr, end, pages + *nr);
 
-	folio = try_grab_folio(page, refs, flags);
+	folio = try_grab_folio_fast(page, refs, flags);
 	if (!folio)
 		return 0;
 
@@ -2926,7 +2943,7 @@
 	page = nth_page(pud_page(orig), (addr & ~PUD_MASK) >> PAGE_SHIFT);
 	refs = record_subpages(page, addr, end, pages + *nr);
 
-	folio = try_grab_folio(page, refs, flags);
+	folio = try_grab_folio_fast(page, refs, flags);
 	if (!folio)
 		return 0;
 
@@ -2966,7 +2983,7 @@
 	page = nth_page(pgd_page(orig), (addr & ~PGDIR_MASK) >> PAGE_SHIFT);
 	refs = record_subpages(page, addr, end, pages + *nr);
 
-	folio = try_grab_folio(page, refs, flags);
+	folio = try_grab_folio_fast(page, refs, flags);
 	if (!folio)
 		return 0;
 
--- linux-qcom-6.8.0.orig/mm/huge_memory.c
+++ linux-qcom-6.8.0/mm/huge_memory.c
@@ -84,27 +84,24 @@
 					 bool in_pf, bool enforce_sysfs,
 					 unsigned long orders)
 {
+	unsigned long supported_orders;
+
 	/* Check the intersection of requested and supported orders. */
-	orders &= vma_is_anonymous(vma) ?
-			THP_ORDERS_ALL_ANON : THP_ORDERS_ALL_FILE;
+	if (vma_is_anonymous(vma))
+		supported_orders = THP_ORDERS_ALL_ANON;
+	else if (vma_is_dax(vma))
+		supported_orders = THP_ORDERS_ALL_FILE_DAX;
+	else
+		supported_orders = THP_ORDERS_ALL_FILE_DEFAULT;
+
+	orders &= supported_orders;
 	if (!orders)
 		return 0;
 
 	if (!vma->vm_mm)		/* vdso */
 		return 0;
 
-	/*
-	 * Explicitly disabled through madvise or prctl, or some
-	 * architectures may disable THP for some mappings, for
-	 * example, s390 kvm.
-	 * */
-	if ((vm_flags & VM_NOHUGEPAGE) ||
-	    test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags))
-		return 0;
-	/*
-	 * If the hardware/firmware marked hugepage support disabled.
-	 */
-	if (transparent_hugepage_flags & (1 << TRANSPARENT_HUGEPAGE_UNSUPPORTED))
+	if (thp_disabled_by_hw() || vma_thp_disabled(vma, vm_flags))
 		return 0;
 
 	/* khugepaged doesn't collapse DAX vma, but page fault is fine. */
@@ -505,6 +502,13 @@
 	} else
 		ret = -EINVAL;
 
+	if (ret > 0) {
+		int err;
+
+		err = start_stop_khugepaged();
+		if (err)
+			ret = err;
+	}
 	return ret;
 }
 
@@ -790,8 +794,8 @@
 
 void folio_prep_large_rmappable(struct folio *folio)
 {
-	VM_BUG_ON_FOLIO(folio_order(folio) < 2, folio);
-	INIT_LIST_HEAD(&folio->_deferred_list);
+	if (!folio || !folio_test_large(folio))
+		return;
 	folio_set_large_rmappable(folio);
 }
 
@@ -812,7 +816,7 @@
 	loff_t off_align = round_up(off, size);
 	unsigned long len_pad, ret, off_sub;
 
-	if (IS_ENABLED(CONFIG_32BIT) || in_compat_syscall())
+	if (!IS_ENABLED(CONFIG_64BIT) || in_compat_syscall())
 		return 0;
 
 	if (off_end <= off_align || (off_end - off_align) < size)
@@ -1272,7 +1276,7 @@
 	if (!*pgmap)
 		return ERR_PTR(-EFAULT);
 	page = pfn_to_page(pfn);
-	ret = try_grab_page(page, flags);
+	ret = try_grab_folio(page_folio(page), 1, flags);
 	if (ret)
 		page = ERR_PTR(ret);
 
@@ -1432,7 +1436,7 @@
 		return ERR_PTR(-EFAULT);
 	page = pfn_to_page(pfn);
 
-	ret = try_grab_page(page, flags);
+	ret = try_grab_folio(page_folio(page), 1, flags);
 	if (ret)
 		page = ERR_PTR(ret);
 
@@ -1694,7 +1698,7 @@
 	VM_BUG_ON_PAGE((flags & FOLL_PIN) && PageAnon(page) &&
 			!PageAnonExclusive(page), page);
 
-	ret = try_grab_page(page, flags);
+	ret = try_grab_folio(page_folio(page), 1, flags);
 	if (ret)
 		return ERR_PTR(ret);
 
@@ -1717,13 +1721,13 @@
 	unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
 	int nid = NUMA_NO_NODE;
 	int target_nid, last_cpupid = (-1 & LAST_CPUPID_MASK);
-	bool migrated = false, writable = false;
+	bool writable = false;
 	int flags = 0;
 
 	vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
 	if (unlikely(!pmd_same(oldpmd, *vmf->pmd))) {
 		spin_unlock(vmf->ptl);
-		goto out;
+		return 0;
 	}
 
 	pmd = pmd_modify(oldpmd, vma->vm_page_prot);
@@ -1752,35 +1756,30 @@
 	 */
 	if (node_is_toptier(nid))
 		last_cpupid = folio_last_cpupid(folio);
-	target_nid = numa_migrate_prep(folio, vma, haddr, nid, &flags);
-	if (target_nid == NUMA_NO_NODE) {
-		folio_put(folio);
+	target_nid = numa_migrate_prep(folio, vmf, haddr, nid, &flags);
+	if (target_nid == NUMA_NO_NODE)
+		goto out_map;
+	if (migrate_misplaced_folio_prepare(folio, vma, target_nid)) {
+		flags |= TNF_MIGRATE_FAIL;
 		goto out_map;
 	}
-
+	/* The folio is isolated and isolation code holds a folio reference. */
 	spin_unlock(vmf->ptl);
 	writable = false;
 
-	migrated = migrate_misplaced_folio(folio, vma, target_nid);
-	if (migrated) {
+	if (!migrate_misplaced_folio(folio, vma, target_nid)) {
 		flags |= TNF_MIGRATED;
 		nid = target_nid;
-	} else {
-		flags |= TNF_MIGRATE_FAIL;
-		vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
-		if (unlikely(!pmd_same(oldpmd, *vmf->pmd))) {
-			spin_unlock(vmf->ptl);
-			goto out;
-		}
-		goto out_map;
-	}
-
-out:
-	if (nid != NUMA_NO_NODE)
 		task_numa_fault(last_cpupid, nid, HPAGE_PMD_NR, flags);
+		return 0;
+	}
 
-	return 0;
-
+	flags |= TNF_MIGRATE_FAIL;
+	vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
+	if (unlikely(!pmd_same(oldpmd, *vmf->pmd))) {
+		spin_unlock(vmf->ptl);
+		return 0;
+	}
 out_map:
 	/* Restore the PMD */
 	pmd = pmd_modify(oldpmd, vma->vm_page_prot);
@@ -1790,7 +1789,10 @@
 	set_pmd_at(vma->vm_mm, haddr, vmf->pmd, pmd);
 	update_mmu_cache_pmd(vma, vmf->address, vmf->pmd);
 	spin_unlock(vmf->ptl);
-	goto out;
+
+	if (nid != NUMA_NO_NODE)
+		task_numa_fault(last_cpupid, nid, HPAGE_PMD_NR, flags);
+	return 0;
 }
 
 /*
@@ -1827,7 +1829,7 @@
 	 * If other processes are mapping this folio, we couldn't discard
 	 * the folio unless they all do MADV_FREE so let's skip the folio.
 	 */
-	if (folio_estimated_sharers(folio) != 1)
+	if (folio_likely_mapped_shared(folio))
 		goto out;
 
 	if (!folio_trylock(folio))
@@ -2244,9 +2246,6 @@
 		goto unlock_ptls;
 	}
 
-	folio_move_anon_rmap(src_folio, dst_vma);
-	WRITE_ONCE(src_folio->index, linear_page_index(dst_vma, dst_addr));
-
 	src_pmdval = pmdp_huge_clear_flush(src_vma, src_addr, src_pmd);
 	/* Folio got pinned from under us. Put it back and fail the move. */
 	if (folio_maybe_dma_pinned(src_folio)) {
@@ -2255,6 +2254,9 @@
 		goto unlock_ptls;
 	}
 
+	folio_move_anon_rmap(src_folio, dst_vma);
+	WRITE_ONCE(src_folio->index, linear_page_index(dst_vma, dst_addr));
+
 	_dst_pmd = mk_huge_pmd(&src_folio->page, dst_vma->vm_page_prot);
 	/* Follow mremap() behavior and treat the entry dirty after the move */
 	_dst_pmd = pmd_mkwrite(pmd_mkdirty(_dst_pmd), dst_vma);
@@ -2470,32 +2472,11 @@
 		return __split_huge_zero_page_pmd(vma, haddr, pmd);
 	}
 
-	/*
-	 * Up to this point the pmd is present and huge and userland has the
-	 * whole access to the hugepage during the split (which happens in
-	 * place). If we overwrite the pmd with the not-huge version pointing
-	 * to the pte here (which of course we could if all CPUs were bug
-	 * free), userland could trigger a small page size TLB miss on the
-	 * small sized TLB while the hugepage TLB entry is still established in
-	 * the huge TLB. Some CPU doesn't like that.
-	 * See http://support.amd.com/TechDocs/41322_10h_Rev_Gd.pdf, Erratum
-	 * 383 on page 105. Intel should be safe but is also warns that it's
-	 * only safe if the permission and cache attributes of the two entries
-	 * loaded in the two TLB is identical (which should be the case here).
-	 * But it is generally safer to never allow small and huge TLB entries
-	 * for the same virtual address to be loaded simultaneously. So instead
-	 * of doing "pmd_populate(); flush_pmd_tlb_range();" we first mark the
-	 * current pmd notpresent (atomically because here the pmd_trans_huge
-	 * must remain set at all times on the pmd until the split is complete
-	 * for this pmd), then we flush the SMP TLB and finally we write the
-	 * non-huge version of the pmd entry with pmd_populate.
-	 */
-	old_pmd = pmdp_invalidate(vma, haddr, pmd);
-
-	pmd_migration = is_pmd_migration_entry(old_pmd);
+	pmd_migration = is_pmd_migration_entry(*pmd);
 	if (unlikely(pmd_migration)) {
 		swp_entry_t entry;
 
+		old_pmd = *pmd;
 		entry = pmd_to_swp_entry(old_pmd);
 		page = pfn_swap_entry_to_page(entry);
 		write = is_writable_migration_entry(entry);
@@ -2506,6 +2487,30 @@
 		soft_dirty = pmd_swp_soft_dirty(old_pmd);
 		uffd_wp = pmd_swp_uffd_wp(old_pmd);
 	} else {
+		/*
+		 * Up to this point the pmd is present and huge and userland has
+		 * the whole access to the hugepage during the split (which
+		 * happens in place). If we overwrite the pmd with the not-huge
+		 * version pointing to the pte here (which of course we could if
+		 * all CPUs were bug free), userland could trigger a small page
+		 * size TLB miss on the small sized TLB while the hugepage TLB
+		 * entry is still established in the huge TLB. Some CPU doesn't
+		 * like that. See
+		 * http://support.amd.com/TechDocs/41322_10h_Rev_Gd.pdf, Erratum
+		 * 383 on page 105. Intel should be safe but is also warns that
+		 * it's only safe if the permission and cache attributes of the
+		 * two entries loaded in the two TLB is identical (which should
+		 * be the case here). But it is generally safer to never allow
+		 * small and huge TLB entries for the same virtual address to be
+		 * loaded simultaneously. So instead of doing "pmd_populate();
+		 * flush_pmd_tlb_range();" we first mark the current pmd
+		 * notpresent (atomically because here the pmd_trans_huge must
+		 * remain set at all times on the pmd until the split is
+		 * complete for this pmd), then we flush the SMP TLB and finally
+		 * we write the non-huge version of the pmd entry with
+		 * pmd_populate.
+		 */
+		old_pmd = pmdp_invalidate(vma, haddr, pmd);
 		page = pmd_page(old_pmd);
 		folio = page_folio(page);
 		if (pmd_dirty(old_pmd)) {
@@ -3082,9 +3087,10 @@
 	/* Prevent deferred_split_scan() touching ->_refcount */
 	spin_lock(&ds_queue->split_queue_lock);
 	if (folio_ref_freeze(folio, 1 + extra_pins)) {
-		if (!list_empty(&folio->_deferred_list)) {
+		if (folio_order(folio) > 1 &&
+		    !list_empty(&folio->_deferred_list)) {
 			ds_queue->split_queue_len--;
-			list_del(&folio->_deferred_list);
+			list_del_init(&folio->_deferred_list);
 		}
 		spin_unlock(&ds_queue->split_queue_lock);
 		if (mapping) {
@@ -3128,26 +3134,38 @@
 	return ret;
 }
 
-void folio_undo_large_rmappable(struct folio *folio)
+/*
+ * __folio_unqueue_deferred_split() is not to be called directly:
+ * the folio_unqueue_deferred_split() inline wrapper in mm/internal.h
+ * limits its calls to those folios which may have a _deferred_list for
+ * queueing THP splits, and that list is (racily observed to be) non-empty.
+ *
+ * It is unsafe to call folio_unqueue_deferred_split() until folio refcount is
+ * zero: because even when split_queue_lock is held, a non-empty _deferred_list
+ * might be in use on deferred_split_scan()'s unlocked on-stack list.
+ *
+ * If memory cgroups are enabled, split_queue_lock is in the mem_cgroup: it is
+ * therefore important to unqueue deferred split before changing folio memcg.
+ */
+bool __folio_unqueue_deferred_split(struct folio *folio)
 {
 	struct deferred_split *ds_queue;
 	unsigned long flags;
+	bool unqueued = false;
 
-	/*
-	 * At this point, there is no one trying to add the folio to
-	 * deferred_list. If folio is not in deferred_list, it's safe
-	 * to check without acquiring the split_queue_lock.
-	 */
-	if (data_race(list_empty(&folio->_deferred_list)))
-		return;
+	WARN_ON_ONCE(folio_ref_count(folio));
+	WARN_ON_ONCE(!mem_cgroup_disabled() && !folio_memcg(folio));
 
 	ds_queue = get_deferred_split_queue(folio);
 	spin_lock_irqsave(&ds_queue->split_queue_lock, flags);
 	if (!list_empty(&folio->_deferred_list)) {
 		ds_queue->split_queue_len--;
 		list_del_init(&folio->_deferred_list);
+		unqueued = true;
 	}
 	spin_unlock_irqrestore(&ds_queue->split_queue_lock, flags);
+
+	return unqueued;	/* useful for debug warnings */
 }
 
 void deferred_split_folio(struct folio *folio)
@@ -3158,17 +3176,19 @@
 #endif
 	unsigned long flags;
 
-	VM_BUG_ON_FOLIO(folio_order(folio) < 2, folio);
+	/*
+	 * Order 1 folios have no space for a deferred list, but we also
+	 * won't waste much memory by not adding them to the deferred list.
+	 */
+	if (folio_order(folio) <= 1)
+		return;
 
 	/*
-	 * The try_to_unmap() in page reclaim path might reach here too,
-	 * this may cause a race condition to corrupt deferred split queue.
-	 * And, if page reclaim is already handling the same folio, it is
-	 * unnecessary to handle it again in shrinker.
-	 *
-	 * Check the swapcache flag to determine if the folio is being
-	 * handled by page reclaim since THP swap would add the folio into
-	 * swap cache before calling try_to_unmap().
+	 * Exclude swapcache: originally to avoid a corrupt deferred split
+	 * queue. Nowadays that is fully prevented by mem_cgroup_swapout();
+	 * but if page reclaim is already handling the same folio, it is
+	 * unnecessary to handle it again in the shrinker, so excluding
+	 * swapcache here may still be a useful optimization.
 	 */
 	if (folio_test_swapcache(folio))
 		return;
--- linux-qcom-6.8.0.orig/mm/hugetlb.c
+++ linux-qcom-6.8.0/mm/hugetlb.c
@@ -1623,7 +1623,7 @@
 {
 	lockdep_assert_held(&hugetlb_lock);
 
-	folio_clear_hugetlb(folio);
+	__folio_clear_hugetlb(folio);
 }
 
 /*
@@ -1710,7 +1710,7 @@
 		h->surplus_huge_pages_node[nid]++;
 	}
 
-	folio_set_hugetlb(folio);
+	__folio_set_hugetlb(folio);
 	folio_change_private(folio, NULL);
 	/*
 	 * We have to set hugetlb_vmemmap_optimized again as above
@@ -1770,23 +1770,23 @@
 	}
 
 	/*
-	 * Move PageHWPoison flag from head page to the raw error pages,
-	 * which makes any healthy subpages reusable.
-	 */
-	if (unlikely(folio_test_hwpoison(folio)))
-		folio_clear_hugetlb_hwpoison(folio);
-
-	/*
 	 * If vmemmap pages were allocated above, then we need to clear the
 	 * hugetlb destructor under the hugetlb lock.
 	 */
-	if (clear_dtor) {
+	if (folio_test_hugetlb(folio)) {
 		spin_lock_irq(&hugetlb_lock);
 		__clear_hugetlb_destructor(h, folio);
 		spin_unlock_irq(&hugetlb_lock);
 	}
 
 	/*
+	 * Move PageHWPoison flag from head page to the raw error pages,
+	 * which makes any healthy subpages reusable.
+	 */
+	if (unlikely(folio_test_hwpoison(folio)))
+		folio_clear_hugetlb_hwpoison(folio);
+
+	/*
 	 * Non-gigantic pages demoted from CMA allocated gigantic pages
 	 * need to be given back to CMA in free_gigantic_folio.
 	 */
@@ -1795,6 +1795,7 @@
 		destroy_compound_gigantic_folio(folio, huge_page_order(h));
 		free_gigantic_folio(folio, huge_page_order(h));
 	} else {
+		INIT_LIST_HEAD(&folio->_deferred_list);
 		__free_pages(&folio->page, huge_page_order(h));
 	}
 }
@@ -2048,7 +2049,7 @@
 
 static void init_new_hugetlb_folio(struct hstate *h, struct folio *folio)
 {
-	folio_set_hugetlb(folio);
+	__folio_set_hugetlb(folio);
 	INIT_LIST_HEAD(&folio->lru);
 	hugetlb_set_folio_subpool(folio, NULL);
 	set_hugetlb_cgroup(folio, NULL);
@@ -2159,22 +2160,6 @@
 }
 
 /*
- * PageHuge() only returns true for hugetlbfs pages, but not for normal or
- * transparent huge pages.  See the PageTransHuge() documentation for more
- * details.
- */
-int PageHuge(struct page *page)
-{
-	struct folio *folio;
-
-	if (!PageCompound(page))
-		return 0;
-	folio = page_folio(page);
-	return folio_test_hugetlb(folio);
-}
-EXPORT_SYMBOL_GPL(PageHuge);
-
-/*
  * Find and lock address space (mapping) in write mode.
  *
  * Upon entry, the page is locked which means that page_mapping() is
@@ -2637,6 +2622,23 @@
 	return alloc_migrate_hugetlb_folio(h, gfp_mask, preferred_nid, nmask);
 }
 
+static nodemask_t *policy_mbind_nodemask(gfp_t gfp)
+{
+#ifdef CONFIG_NUMA
+	struct mempolicy *mpol = get_task_policy(current);
+
+	/*
+	 * Only enforce MPOL_BIND policy which overlaps with cpuset policy
+	 * (from policy_nodemask) specifically for hugetlb case
+	 */
+	if (mpol->mode == MPOL_BIND &&
+		(apply_policy_zone(mpol, gfp_zone(gfp)) &&
+		 cpuset_nodemask_valid_mems_allowed(&mpol->nodes)))
+		return &mpol->nodes;
+#endif
+	return NULL;
+}
+
 /*
  * Increase the hugetlb pool such that it can accommodate a reservation
  * of size 'delta'.
@@ -2650,6 +2652,8 @@
 	long i;
 	long needed, allocated;
 	bool alloc_ok = true;
+	int node;
+	nodemask_t *mbind_nodemask = policy_mbind_nodemask(htlb_alloc_mask(h));
 
 	lockdep_assert_held(&hugetlb_lock);
 	needed = (h->resv_huge_pages + delta) - h->free_huge_pages;
@@ -2664,8 +2668,15 @@
 retry:
 	spin_unlock_irq(&hugetlb_lock);
 	for (i = 0; i < needed; i++) {
-		folio = alloc_surplus_hugetlb_folio(h, htlb_alloc_mask(h),
-				NUMA_NO_NODE, NULL);
+		folio = NULL;
+		for_each_node_mask(node, cpuset_current_mems_allowed) {
+			if (!mbind_nodemask || node_isset(node, *mbind_nodemask)) {
+				folio = alloc_surplus_hugetlb_folio(h, htlb_alloc_mask(h),
+						node, NULL);
+				if (folio)
+					break;
+			}
+		}
 		if (!folio) {
 			alloc_ok = false;
 			break;
@@ -3266,9 +3277,12 @@
 
 		rsv_adjust = hugepage_subpool_put_pages(spool, 1);
 		hugetlb_acct_memory(h, -rsv_adjust);
-		if (deferred_reserve)
+		if (deferred_reserve) {
+			spin_lock_irq(&hugetlb_lock);
 			hugetlb_cgroup_uncharge_folio_rsvd(hstate_index(h),
 					pages_per_huge_page(h), folio);
+			spin_unlock_irq(&hugetlb_lock);
+		}
 	}
 
 	if (!memcg_charge_ret)
@@ -4584,7 +4598,7 @@
 	BUG_ON(hugetlb_max_hstate >= HUGE_MAX_HSTATE);
 	BUG_ON(order < order_base_2(__NR_USED_SUBPAGE));
 	h = &hstates[hugetlb_max_hstate++];
-	mutex_init(&h->resize_lock);
+	__mutex_init(&h->resize_lock, "resize mutex", &h->resize_key);
 	h->order = order;
 	h->mask = ~(huge_page_size(h) - 1);
 	for (i = 0; i < MAX_NUMNODES; ++i)
@@ -4807,23 +4821,6 @@
 }
 __setup("default_hugepagesz=", default_hugepagesz_setup);
 
-static nodemask_t *policy_mbind_nodemask(gfp_t gfp)
-{
-#ifdef CONFIG_NUMA
-	struct mempolicy *mpol = get_task_policy(current);
-
-	/*
-	 * Only enforce MPOL_BIND policy which overlaps with cpuset policy
-	 * (from policy_nodemask) specifically for hugetlb case
-	 */
-	if (mpol->mode == MPOL_BIND &&
-		(apply_policy_zone(mpol, gfp_zone(gfp)) &&
-		 cpuset_nodemask_valid_mems_allowed(&mpol->nodes)))
-		return &mpol->nodes;
-#endif
-	return NULL;
-}
-
 static unsigned int allowed_mems_nr(struct hstate *h)
 {
 	int node;
@@ -6828,7 +6825,7 @@
 		 * try_grab_page() should always be able to get the page here,
 		 * because we hold the ptl lock and have verified pte_present().
 		 */
-		ret = try_grab_page(page, flags);
+		ret = try_grab_folio(page_folio(page), 1, flags);
 
 		if (WARN_ON_ONCE(ret)) {
 			page = ERR_PTR(ret);
@@ -6943,9 +6940,13 @@
 			if (!pte_same(pte, newpte))
 				set_huge_pte_at(mm, address, ptep, newpte, psize);
 		} else if (unlikely(is_pte_marker(pte))) {
-			/* No other markers apply for now. */
-			WARN_ON_ONCE(!pte_marker_uffd_wp(pte));
-			if (uffd_wp_resolve)
+			/*
+			 * Do nothing on a poison marker; page is
+			 * corrupted, permissons do not apply.  Here
+			 * pte_marker_uffd_wp()==true implies !poison
+			 * because they're mutual exclusive.
+			 */
+			if (pte_marker_uffd_wp(pte) && uffd_wp_resolve)
 				/* Safe to modify directly (non-present->none). */
 				huge_pte_clear(mm, address, ptep, psize);
 		} else if (!huge_pte_none(pte)) {
@@ -7198,7 +7199,7 @@
 	return 0;
 }
 
-#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING
 static unsigned long page_table_shareable(struct vm_area_struct *svma,
 				struct vm_area_struct *vma,
 				unsigned long addr, pgoff_t idx)
@@ -7305,7 +7306,7 @@
 			spte = hugetlb_walk(svma, saddr,
 					    vma_mmu_pagesize(svma));
 			if (spte) {
-				get_page(virt_to_page(spte));
+				ptdesc_pmd_pts_inc(virt_to_ptdesc(spte));
 				break;
 			}
 		}
@@ -7320,7 +7321,7 @@
 				(pmd_t *)((unsigned long)spte & PAGE_MASK));
 		mm_inc_nr_pmds(mm);
 	} else {
-		put_page(virt_to_page(spte));
+		ptdesc_pmd_pts_dec(virt_to_ptdesc(spte));
 	}
 	spin_unlock(&mm->page_table_lock);
 out:
@@ -7332,10 +7333,6 @@
 /*
  * unmap huge page backed by shared pte.
  *
- * Hugetlb pte page is ref counted at the time of mapping.  If pte is shared
- * indicated by page_count > 1, unmap is achieved by clearing pud and
- * decrementing the ref count. If count == 1, the pte page is not shared.
- *
  * Called with page table lock held.
  *
  * returns: 1 successfully unmapped a shared pte page
@@ -7344,23 +7341,25 @@
 int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma,
 					unsigned long addr, pte_t *ptep)
 {
+	unsigned long sz = huge_page_size(hstate_vma(vma));
 	pgd_t *pgd = pgd_offset(mm, addr);
 	p4d_t *p4d = p4d_offset(pgd, addr);
 	pud_t *pud = pud_offset(p4d, addr);
 
 	i_mmap_assert_write_locked(vma->vm_file->f_mapping);
 	hugetlb_vma_assert_locked(vma);
-	BUG_ON(page_count(virt_to_page(ptep)) == 0);
-	if (page_count(virt_to_page(ptep)) == 1)
+	if (sz != PMD_SIZE)
+		return 0;
+	if (!ptdesc_pmd_pts_count(virt_to_ptdesc(ptep)))
 		return 0;
 
 	pud_clear(pud);
-	put_page(virt_to_page(ptep));
+	ptdesc_pmd_pts_dec(virt_to_ptdesc(ptep));
 	mm_dec_nr_pmds(mm);
 	return 1;
 }
 
-#else /* !CONFIG_ARCH_WANT_HUGE_PMD_SHARE */
+#else /* !CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */
 
 pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma,
 		      unsigned long addr, pud_t *pud)
@@ -7383,7 +7382,7 @@
 {
 	return false;
 }
-#endif /* CONFIG_ARCH_WANT_HUGE_PMD_SHARE */
+#endif /* CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */
 
 #ifdef CONFIG_ARCH_WANT_GENERAL_HUGETLB
 pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
@@ -7481,7 +7480,7 @@
 /* See description above.  Architectures can provide their own version. */
 __weak unsigned long hugetlb_mask_last_page(struct hstate *h)
 {
-#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
+#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING
 	if (huge_page_size(h) == PMD_SIZE)
 		return PUD_SIZE - PMD_SIZE;
 #endif
@@ -7765,9 +7764,9 @@
 		 * huge page demotion.
 		 */
 		res = cma_declare_contiguous_nid(0, size, 0,
-						PAGE_SIZE << HUGETLB_PAGE_ORDER,
-						 0, false, name,
-						 &hugetlb_cma[nid], nid);
+					PAGE_SIZE << HUGETLB_PAGE_ORDER,
+					HUGETLB_PAGE_ORDER, false, name,
+					&hugetlb_cma[nid], nid);
 		if (res) {
 			pr_warn("hugetlb_cma: reservation failed: err %d, node %d",
 				res, nid);
--- linux-qcom-6.8.0.orig/mm/internal.h
+++ linux-qcom-6.8.0/mm/internal.h
@@ -40,7 +40,7 @@
  * when we specify __GFP_NOWARN.
  */
 #define WARN_ON_ONCE_GFP(cond, gfp)	({				\
-	static bool __section(".data.once") __warned;			\
+	static bool __section(".data..once") __warned;			\
 	int __ret_warn_once = !!(cond);					\
 									\
 	if (unlikely(!(gfp & __GFP_NOWARN) && __ret_warn_once && !__warned)) { \
@@ -83,6 +83,51 @@
 	return (void *)(mapping & ~PAGE_MAPPING_FLAGS);
 }
 
+/*
+ * This is a file-backed mapping, and is about to be memory mapped - invoke its
+ * mmap hook and safely handle error conditions. On error, VMA hooks will be
+ * mutated.
+ *
+ * @file: File which backs the mapping.
+ * @vma:  VMA which we are mapping.
+ *
+ * Returns: 0 if success, error otherwise.
+ */
+static inline int mmap_file(struct file *file, struct vm_area_struct *vma)
+{
+	int err = call_mmap(file, vma);
+
+	if (likely(!err))
+		return 0;
+
+	/*
+	 * OK, we tried to call the file hook for mmap(), but an error
+	 * arose. The mapping is in an inconsistent state and we most not invoke
+	 * any further hooks on it.
+	 */
+	vma->vm_ops = &vma_dummy_vm_ops;
+
+	return err;
+}
+
+/*
+ * If the VMA has a close hook then close it, and since closing it might leave
+ * it in an inconsistent state which makes the use of any hooks suspect, clear
+ * them down by installing dummy empty hooks.
+ */
+static inline void vma_close(struct vm_area_struct *vma)
+{
+	if (vma->vm_ops && vma->vm_ops->close) {
+		vma->vm_ops->close(vma);
+
+		/*
+		 * The mapping is in an inconsistent state, and no further hooks
+		 * may be invoked upon it.
+		 */
+		vma->vm_ops = &vma_dummy_vm_ops;
+	}
+}
+
 void __acct_reclaim_writeback(pg_data_t *pgdat, struct folio *folio,
 						int nr_throttled);
 static inline void acct_reclaim_writeback(struct folio *folio)
@@ -413,14 +458,28 @@
 #endif
 }
 
-void folio_undo_large_rmappable(struct folio *folio);
+bool __folio_unqueue_deferred_split(struct folio *folio);
+static inline bool folio_unqueue_deferred_split(struct folio *folio)
+{
+	if (folio_order(folio) <= 1 || !folio_test_large_rmappable(folio))
+		return false;
+
+	/*
+	 * At this point, there is no one trying to add the folio to
+	 * deferred_list. If folio is not in deferred_list, it's safe
+	 * to check without acquiring the split_queue_lock.
+	 */
+	if (data_race(list_empty(&folio->_deferred_list)))
+		return false;
+
+	return __folio_unqueue_deferred_split(folio);
+}
 
 static inline struct folio *page_rmappable_folio(struct page *page)
 {
 	struct folio *folio = (struct folio *)page;
 
-	if (folio && folio_order(folio) > 1)
-		folio_prep_large_rmappable(folio);
+	folio_prep_large_rmappable(folio);
 	return folio;
 }
 
@@ -432,6 +491,8 @@
 	atomic_set(&folio->_entire_mapcount, -1);
 	atomic_set(&folio->_nr_pages_mapped, 0);
 	atomic_set(&folio->_pincount, 0);
+	if (order > 1)
+		INIT_LIST_HEAD(&folio->_deferred_list);
 }
 
 static inline void prep_compound_tail(struct page *head, int tail_idx)
@@ -590,9 +651,8 @@
 void unmap_mapping_folio(struct folio *folio);
 extern long populate_vma_page_range(struct vm_area_struct *vma,
 		unsigned long start, unsigned long end, int *locked);
-extern long faultin_vma_page_range(struct vm_area_struct *vma,
-				   unsigned long start, unsigned long end,
-				   bool write, int *locked);
+extern long faultin_page_range(struct mm_struct *mm, unsigned long start,
+		unsigned long end, bool write, int *locked);
 extern bool mlock_future_ok(struct mm_struct *mm, unsigned long flags,
 			       unsigned long bytes);
 
@@ -992,7 +1052,7 @@
 
 void __vunmap_range_noflush(unsigned long start, unsigned long end);
 
-int numa_migrate_prep(struct folio *folio, struct vm_area_struct *vma,
+int numa_migrate_prep(struct folio *folio, struct vm_fault *vmf,
 		      unsigned long addr, int page_nid, int *flags);
 
 void free_zone_device_page(struct page *page);
@@ -1001,8 +1061,8 @@
 /*
  * mm/gup.c
  */
-struct folio *try_grab_folio(struct page *page, int refs, unsigned int flags);
-int __must_check try_grab_page(struct page *page, unsigned int flags);
+int __must_check try_grab_folio(struct folio *folio, int refs,
+				unsigned int flags);
 
 /*
  * mm/huge_memory.c
@@ -1031,10 +1091,13 @@
 	FOLL_FAST_ONLY = 1 << 20,
 	/* allow unlocking the mmap lock */
 	FOLL_UNLOCKABLE = 1 << 21,
+	/* VMA lookup+checks compatible with MADV_POPULATE_(READ|WRITE) */
+	FOLL_MADV_POPULATE = 1 << 22,
 };
 
 #define INTERNAL_GUP_FLAGS (FOLL_TOUCH | FOLL_TRIED | FOLL_REMOTE | FOLL_PIN | \
-			    FOLL_FAST_ONLY | FOLL_UNLOCKABLE)
+			    FOLL_FAST_ONLY | FOLL_UNLOCKABLE | \
+			    FOLL_MADV_POPULATE)
 
 /*
  * Indicates for which pages that are write-protected in the page table,
--- linux-qcom-6.8.0.orig/mm/kasan/common.c
+++ linux-qcom-6.8.0/mm/kasan/common.c
@@ -532,7 +532,7 @@
 		return;
 
 	/* Unpoison the object and save alloc info for non-kmalloc() allocations. */
-	unpoison_slab_object(slab->slab_cache, ptr, size, flags);
+	unpoison_slab_object(slab->slab_cache, ptr, flags, false);
 
 	/* Poison the redzone and save alloc info for kmalloc() allocations. */
 	if (is_kmalloc_cache(slab->slab_cache))
--- linux-qcom-6.8.0.orig/mm/kasan/kasan_test.c
+++ linux-qcom-6.8.0/mm/kasan/kasan_test.c
@@ -440,7 +440,8 @@
 	/* This test is specifically crafted for the generic mode. */
 	KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC);
 
-	ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
+	/* RELOC_HIDE to prevent gcc from warning about short alloc */
+	ptr1 = RELOC_HIDE(kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL), 0);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
 
 	ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
@@ -1686,32 +1687,6 @@
 	free_pages((unsigned long)p_ptr, 1);
 }
 
-static void vmalloc_percpu(struct kunit *test)
-{
-	char __percpu *ptr;
-	int cpu;
-
-	/*
-	 * This test is specifically crafted for the software tag-based mode,
-	 * the only tag-based mode that poisons percpu mappings.
-	 */
-	KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS);
-
-	ptr = __alloc_percpu(PAGE_SIZE, PAGE_SIZE);
-
-	for_each_possible_cpu(cpu) {
-		char *c_ptr = per_cpu_ptr(ptr, cpu);
-
-		KUNIT_EXPECT_GE(test, (u8)get_tag(c_ptr), (u8)KASAN_TAG_MIN);
-		KUNIT_EXPECT_LT(test, (u8)get_tag(c_ptr), (u8)KASAN_TAG_KERNEL);
-
-		/* Make sure that in-bounds accesses don't crash the kernel. */
-		*c_ptr = 0;
-	}
-
-	free_percpu(ptr);
-}
-
 /*
  * Check that the assigned pointer tag falls within the [KASAN_TAG_MIN,
  * KASAN_TAG_KERNEL) range (note: excluding the match-all tag) for tag-based
@@ -1887,7 +1862,6 @@
 	KUNIT_CASE(vmalloc_oob),
 	KUNIT_CASE(vmap_tags),
 	KUNIT_CASE(vm_map_ram_tags),
-	KUNIT_CASE(vmalloc_percpu),
 	KUNIT_CASE(match_all_not_assigned),
 	KUNIT_CASE(match_all_ptr_tag),
 	KUNIT_CASE(match_all_mem_tag),
--- linux-qcom-6.8.0.orig/mm/kasan/report.c
+++ linux-qcom-6.8.0/mm/kasan/report.c
@@ -200,7 +200,7 @@
 
 #endif /* CONFIG_KUNIT */
 
-static DEFINE_SPINLOCK(report_lock);
+static DEFINE_RAW_SPINLOCK(report_lock);
 
 static void start_report(unsigned long *flags, bool sync)
 {
@@ -211,7 +211,7 @@
 	lockdep_off();
 	/* Make sure we don't end up in loop. */
 	report_suppress_start();
-	spin_lock_irqsave(&report_lock, *flags);
+	raw_spin_lock_irqsave(&report_lock, *flags);
 	pr_err("==================================================================\n");
 }
 
@@ -221,7 +221,7 @@
 		trace_error_report_end(ERROR_DETECTOR_KASAN,
 				       (unsigned long)addr);
 	pr_err("==================================================================\n");
-	spin_unlock_irqrestore(&report_lock, *flags);
+	raw_spin_unlock_irqrestore(&report_lock, *flags);
 	if (!test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
 		check_panic_on_warn("KASAN");
 	switch (kasan_arg_fault) {
--- linux-qcom-6.8.0.orig/mm/khugepaged.c
+++ linux-qcom-6.8.0/mm/khugepaged.c
@@ -410,6 +410,26 @@
 	return atomic_read(&mm->mm_users) == 0;
 }
 
+static bool hugepage_pmd_enabled(void)
+{
+	/*
+	 * We cover both the anon and the file-backed case here; file-backed
+	 * hugepages, when configured in, are determined by the global control.
+	 * Anon pmd-sized hugepages are determined by the pmd-size control.
+	 */
+	if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) &&
+	    hugepage_global_enabled())
+		return true;
+	if (test_bit(PMD_ORDER, &huge_anon_orders_always))
+		return true;
+	if (test_bit(PMD_ORDER, &huge_anon_orders_madvise))
+		return true;
+	if (test_bit(PMD_ORDER, &huge_anon_orders_inherit) &&
+	    hugepage_global_enabled())
+		return true;
+	return false;
+}
+
 void __khugepaged_enter(struct mm_struct *mm)
 {
 	struct khugepaged_mm_slot *mm_slot;
@@ -446,7 +466,7 @@
 			  unsigned long vm_flags)
 {
 	if (!test_bit(MMF_VM_HUGEPAGE, &vma->vm_mm->flags) &&
-	    hugepage_flags_enabled()) {
+	    hugepage_pmd_enabled()) {
 		if (thp_vma_allowable_order(vma, vm_flags, false, false, true,
 					    PMD_ORDER))
 			__khugepaged_enter(vma->vm_mm);
@@ -887,20 +907,6 @@
 }
 #endif
 
-static bool hpage_collapse_alloc_folio(struct folio **folio, gfp_t gfp, int node,
-				      nodemask_t *nmask)
-{
-	*folio = __folio_alloc(gfp, HPAGE_PMD_ORDER, node, nmask);
-
-	if (unlikely(!*folio)) {
-		count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
-		return false;
-	}
-
-	count_vm_event(THP_COLLAPSE_ALLOC);
-	return true;
-}
-
 /*
  * If mmap_lock temporarily dropped, revalidate vma
  * before taking mmap_lock.
@@ -1055,7 +1061,7 @@
 	return result;
 }
 
-static int alloc_charge_hpage(struct page **hpage, struct mm_struct *mm,
+static int alloc_charge_folio(struct folio **foliop, struct mm_struct *mm,
 			      struct collapse_control *cc)
 {
 	gfp_t gfp = (cc->is_khugepaged ? alloc_hugepage_khugepaged_gfpmask() :
@@ -1063,20 +1069,23 @@
 	int node = hpage_collapse_find_target_node(cc);
 	struct folio *folio;
 
-	if (!hpage_collapse_alloc_folio(&folio, gfp, node, &cc->alloc_nmask)) {
-		*hpage = NULL;
+	folio = __folio_alloc(gfp, HPAGE_PMD_ORDER, node, &cc->alloc_nmask);
+	if (!folio) {
+		*foliop = NULL;
+		count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
 		return SCAN_ALLOC_HUGE_PAGE_FAIL;
 	}
 
+	count_vm_event(THP_COLLAPSE_ALLOC);
 	if (unlikely(mem_cgroup_charge(folio, mm, gfp))) {
 		folio_put(folio);
-		*hpage = NULL;
+		*foliop = NULL;
 		return SCAN_CGROUP_CHARGE_FAIL;
 	}
 
 	count_memcg_folio_events(folio, THP_COLLAPSE_ALLOC, 1);
 
-	*hpage = folio_page(folio, 0);
+	*foliop = folio;
 	return SCAN_SUCCEED;
 }
 
@@ -1105,7 +1114,8 @@
 	 */
 	mmap_read_unlock(mm);
 
-	result = alloc_charge_hpage(&hpage, mm, cc);
+	result = alloc_charge_folio(&folio, mm, cc);
+	hpage = &folio->page;
 	if (result != SCAN_SUCCEED)
 		goto out_nolock;
 
@@ -1211,7 +1221,6 @@
 	if (unlikely(result != SCAN_SUCCEED))
 		goto out_up_write;
 
-	folio = page_folio(hpage);
 	/*
 	 * The smp_wmb() inside __folio_mark_uptodate() ensures the
 	 * copy_huge_page writes become visible before the set_pmd_at()
@@ -1793,29 +1802,27 @@
 			 struct collapse_control *cc)
 {
 	struct address_space *mapping = file->f_mapping;
-	struct page *hpage;
 	struct page *page;
-	struct page *tmp;
-	struct folio *folio;
+	struct page *tmp, *dst;
+	struct folio *folio, *new_folio;
 	pgoff_t index = 0, end = start + HPAGE_PMD_NR;
 	LIST_HEAD(pagelist);
 	XA_STATE_ORDER(xas, &mapping->i_pages, start, HPAGE_PMD_ORDER);
 	int nr_none = 0, result = SCAN_SUCCEED;
 	bool is_shmem = shmem_file(file);
-	int nr = 0;
 
 	VM_BUG_ON(!IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && !is_shmem);
 	VM_BUG_ON(start & (HPAGE_PMD_NR - 1));
 
-	result = alloc_charge_hpage(&hpage, mm, cc);
+	result = alloc_charge_folio(&new_folio, mm, cc);
 	if (result != SCAN_SUCCEED)
 		goto out;
 
-	__SetPageLocked(hpage);
+	__folio_set_locked(new_folio);
 	if (is_shmem)
-		__SetPageSwapBacked(hpage);
-	hpage->index = start;
-	hpage->mapping = mapping;
+		__folio_set_swapbacked(new_folio);
+	new_folio->index = start;
+	new_folio->mapping = mapping;
 
 	/*
 	 * Ensure we have slots for all the pages in the range.  This is
@@ -2048,20 +2055,24 @@
 	 * The old pages are locked, so they won't change anymore.
 	 */
 	index = start;
+	dst = folio_page(new_folio, 0);
 	list_for_each_entry(page, &pagelist, lru) {
 		while (index < page->index) {
-			clear_highpage(hpage + (index % HPAGE_PMD_NR));
+			clear_highpage(dst);
 			index++;
+			dst++;
 		}
-		if (copy_mc_highpage(hpage + (page->index % HPAGE_PMD_NR), page) > 0) {
+		if (copy_mc_highpage(dst, page) > 0) {
 			result = SCAN_COPY_MC;
 			goto rollback;
 		}
 		index++;
+		dst++;
 	}
 	while (index < end) {
-		clear_highpage(hpage + (index % HPAGE_PMD_NR));
+		clear_highpage(dst);
 		index++;
+		dst++;
 	}
 
 	if (nr_none) {
@@ -2089,16 +2100,17 @@
 		}
 
 		/*
-		 * If userspace observed a missing page in a VMA with a MODE_MISSING
-		 * userfaultfd, then it might expect a UFFD_EVENT_PAGEFAULT for that
-		 * page. If so, we need to roll back to avoid suppressing such an
-		 * event. Since wp/minor userfaultfds don't give userspace any
-		 * guarantees that the kernel doesn't fill a missing page with a zero
-		 * page, so they don't matter here.
+		 * If userspace observed a missing page in a VMA with
+		 * a MODE_MISSING userfaultfd, then it might expect a
+		 * UFFD_EVENT_PAGEFAULT for that page. If so, we need to
+		 * roll back to avoid suppressing such an event. Since
+		 * wp/minor userfaultfds don't give userspace any
+		 * guarantees that the kernel doesn't fill a missing
+		 * page with a zero page, so they don't matter here.
 		 *
-		 * Any userfaultfds registered after this point will not be able to
-		 * observe any missing pages due to the previously inserted retry
-		 * entries.
+		 * Any userfaultfds registered after this point will
+		 * not be able to observe any missing pages due to the
+		 * previously inserted retry entries.
 		 */
 		vma_interval_tree_foreach(vma, &mapping->i_mmap, start, end) {
 			if (userfaultfd_missing(vma)) {
@@ -2123,33 +2135,32 @@
 		xas_lock_irq(&xas);
 	}
 
-	folio = page_folio(hpage);
-	nr = folio_nr_pages(folio);
 	if (is_shmem)
-		__lruvec_stat_mod_folio(folio, NR_SHMEM_THPS, nr);
+		__lruvec_stat_mod_folio(new_folio, NR_SHMEM_THPS, HPAGE_PMD_NR);
 	else
-		__lruvec_stat_mod_folio(folio, NR_FILE_THPS, nr);
+		__lruvec_stat_mod_folio(new_folio, NR_FILE_THPS, HPAGE_PMD_NR);
 
 	if (nr_none) {
-		__lruvec_stat_mod_folio(folio, NR_FILE_PAGES, nr_none);
+		__lruvec_stat_mod_folio(new_folio, NR_FILE_PAGES, nr_none);
 		/* nr_none is always 0 for non-shmem. */
-		__lruvec_stat_mod_folio(folio, NR_SHMEM, nr_none);
+		__lruvec_stat_mod_folio(new_folio, NR_SHMEM, nr_none);
 	}
 
 	/*
-	 * Mark hpage as uptodate before inserting it into the page cache so
-	 * that it isn't mistaken for an fallocated but unwritten page.
+	 * Mark new_folio as uptodate before inserting it into the
+	 * page cache so that it isn't mistaken for an fallocated but
+	 * unwritten page.
 	 */
-	folio_mark_uptodate(folio);
-	folio_ref_add(folio, HPAGE_PMD_NR - 1);
+	folio_mark_uptodate(new_folio);
+	folio_ref_add(new_folio, HPAGE_PMD_NR - 1);
 
 	if (is_shmem)
-		folio_mark_dirty(folio);
-	folio_add_lru(folio);
+		folio_mark_dirty(new_folio);
+	folio_add_lru(new_folio);
 
 	/* Join all the small entries into a single multi-index entry. */
 	xas_set_order(&xas, start, HPAGE_PMD_ORDER);
-	xas_store(&xas, folio);
+	xas_store(&xas, new_folio);
 	WARN_ON_ONCE(xas_error(&xas));
 	xas_unlock_irq(&xas);
 
@@ -2160,7 +2171,7 @@
 	retract_page_tables(mapping, start);
 	if (cc && !cc->is_khugepaged)
 		result = SCAN_PTE_MAPPED_HUGEPAGE;
-	folio_unlock(folio);
+	folio_unlock(new_folio);
 
 	/*
 	 * The collapse has succeeded, so free the old pages.
@@ -2205,13 +2216,13 @@
 		smp_mb();
 	}
 
-	hpage->mapping = NULL;
+	new_folio->mapping = NULL;
 
-	unlock_page(hpage);
-	put_page(hpage);
+	folio_unlock(new_folio);
+	folio_put(new_folio);
 out:
 	VM_BUG_ON(!list_empty(&pagelist));
-	trace_mm_khugepaged_collapse_file(mm, hpage, index, is_shmem, addr, file, nr, result);
+	trace_mm_khugepaged_collapse_file(mm, new_folio, index, addr, is_shmem, file, HPAGE_PMD_NR, result);
 	return result;
 }
 
@@ -2475,8 +2486,7 @@
 
 static int khugepaged_has_work(void)
 {
-	return !list_empty(&khugepaged_scan.mm_head) &&
-		hugepage_flags_enabled();
+	return !list_empty(&khugepaged_scan.mm_head) && hugepage_pmd_enabled();
 }
 
 static int khugepaged_wait_event(void)
@@ -2549,7 +2559,7 @@
 		return;
 	}
 
-	if (hugepage_flags_enabled())
+	if (hugepage_pmd_enabled())
 		wait_event_freezable(khugepaged_wait, khugepaged_wait_event());
 }
 
@@ -2580,7 +2590,7 @@
 	int nr_zones = 0;
 	unsigned long recommended_min;
 
-	if (!hugepage_flags_enabled()) {
+	if (!hugepage_pmd_enabled()) {
 		calculate_min_free_kbytes();
 		goto update_wmarks;
 	}
@@ -2630,7 +2640,7 @@
 	int err = 0;
 
 	mutex_lock(&khugepaged_mutex);
-	if (hugepage_flags_enabled()) {
+	if (hugepage_pmd_enabled()) {
 		if (!khugepaged_thread)
 			khugepaged_thread = kthread_run(khugepaged, NULL,
 							"khugepaged");
@@ -2656,7 +2666,7 @@
 void khugepaged_min_free_kbytes_update(void)
 {
 	mutex_lock(&khugepaged_mutex);
-	if (hugepage_flags_enabled() && khugepaged_thread)
+	if (hugepage_pmd_enabled() && khugepaged_thread)
 		set_recommended_min_free_kbytes();
 	mutex_unlock(&khugepaged_mutex);
 }
--- linux-qcom-6.8.0.orig/mm/kmemleak.c
+++ linux-qcom-6.8.0/mm/kmemleak.c
@@ -368,7 +368,7 @@
 
 	for (i = 0; i < nr_entries; i++) {
 		void *ptr = (void *)entries[i];
-		warn_or_seq_printf(seq, "    [<%pK>] %pS\n", ptr, ptr);
+		warn_or_seq_printf(seq, "    %pS\n", ptr);
 	}
 }
 
--- linux-qcom-6.8.0.orig/mm/kmsan/core.c
+++ linux-qcom-6.8.0/mm/kmsan/core.c
@@ -196,8 +196,7 @@
 				      u32 origin, bool checked)
 {
 	u64 address = (u64)addr;
-	void *shadow_start;
-	u32 *origin_start;
+	u32 *shadow_start, *origin_start;
 	size_t pad = 0;
 
 	KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size));
@@ -225,8 +224,16 @@
 	origin_start =
 		(u32 *)kmsan_get_metadata((void *)address, KMSAN_META_ORIGIN);
 
-	for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++)
-		origin_start[i] = origin;
+	/*
+	 * If the new origin is non-zero, assume that the shadow byte is also non-zero,
+	 * and unconditionally overwrite the old origin slot.
+	 * If the new origin is zero, overwrite the old origin slot iff the
+	 * corresponding shadow slot is zero.
+	 */
+	for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) {
+		if (origin || !shadow_start[i])
+			origin_start[i] = origin;
+	}
 }
 
 struct page *kmsan_vmalloc_to_page_or_null(void *vaddr)
--- linux-qcom-6.8.0.orig/mm/ksm.c
+++ linux-qcom-6.8.0/mm/ksm.c
@@ -296,7 +296,7 @@
 static bool ksm_smart_scan = true;
 
 /* The number of zero pages which is placed by KSM */
-unsigned long ksm_zero_pages;
+atomic_long_t ksm_zero_pages = ATOMIC_LONG_INIT(0);
 
 /* The number of pages that have been skipped due to "smart scanning" */
 static unsigned long ksm_pages_skipped;
@@ -1428,8 +1428,7 @@
 		 * the dirty bit in zero page's PTE is set.
 		 */
 		newpte = pte_mkdirty(pte_mkspecial(pfn_pte(page_to_pfn(kpage), vma->vm_page_prot)));
-		ksm_zero_pages++;
-		mm->ksm_zero_pages++;
+		ksm_map_zero_page(mm);
 		/*
 		 * We're replacing an anonymous page with a zero page, which is
 		 * not anonymous. We need to do proper accounting otherwise we
@@ -2747,18 +2746,16 @@
 {
 	struct ksm_rmap_item *rmap_item;
 	struct page *page;
-	unsigned int npages = scan_npages;
 
-	while (npages-- && likely(!freezing(current))) {
+	while (scan_npages-- && likely(!freezing(current))) {
 		cond_resched();
 		rmap_item = scan_get_next_rmap_item(&page);
 		if (!rmap_item)
 			return;
 		cmp_and_merge_page(page, rmap_item);
 		put_page(page);
+		ksm_pages_scanned++;
 	}
-
-	ksm_pages_scanned += scan_npages - npages;
 }
 
 static int ksmd_should_run(void)
@@ -2782,9 +2779,14 @@
 
 		if (ksmd_should_run()) {
 			sleep_ms = READ_ONCE(ksm_thread_sleep_millisecs);
-			wait_event_freezable_timeout(ksm_iter_wait,
-				sleep_ms != READ_ONCE(ksm_thread_sleep_millisecs),
-				msecs_to_jiffies(sleep_ms));
+			if (sleep_ms >= 1000)
+				wait_event_freezable_timeout(ksm_iter_wait,
+					sleep_ms != READ_ONCE(ksm_thread_sleep_millisecs),
+					msecs_to_jiffies(round_jiffies_relative(sleep_ms)));
+			else
+				wait_event_freezable_timeout(ksm_iter_wait,
+					sleep_ms != READ_ONCE(ksm_thread_sleep_millisecs),
+					msecs_to_jiffies(sleep_ms));
 		} else {
 			wait_event_freezable(ksm_thread_wait,
 				ksmd_should_run() || kthread_should_stop());
@@ -3370,7 +3372,7 @@
 #ifdef CONFIG_PROC_FS
 long ksm_process_profit(struct mm_struct *mm)
 {
-	return (long)(mm->ksm_merging_pages + mm->ksm_zero_pages) * PAGE_SIZE -
+	return (long)(mm->ksm_merging_pages + mm_ksm_zero_pages(mm)) * PAGE_SIZE -
 		mm->ksm_rmap_items * sizeof(struct ksm_rmap_item);
 }
 #endif /* CONFIG_PROC_FS */
@@ -3659,7 +3661,7 @@
 static ssize_t ksm_zero_pages_show(struct kobject *kobj,
 				struct kobj_attribute *attr, char *buf)
 {
-	return sysfs_emit(buf, "%ld\n", ksm_zero_pages);
+	return sysfs_emit(buf, "%ld\n", atomic_long_read(&ksm_zero_pages));
 }
 KSM_ATTR_RO(ksm_zero_pages);
 
@@ -3668,7 +3670,7 @@
 {
 	long general_profit;
 
-	general_profit = (ksm_pages_sharing + ksm_zero_pages) * PAGE_SIZE -
+	general_profit = (ksm_pages_sharing + atomic_long_read(&ksm_zero_pages)) * PAGE_SIZE -
 				ksm_rmap_items * sizeof(struct ksm_rmap_item);
 
 	return sysfs_emit(buf, "%ld\n", general_profit);
--- linux-qcom-6.8.0.orig/mm/list_lru.c
+++ linux-qcom-6.8.0/mm/list_lru.c
@@ -85,6 +85,7 @@
 }
 #endif /* CONFIG_MEMCG_KMEM */
 
+/* The caller must ensure the memcg lifetime. */
 bool list_lru_add(struct list_lru *lru, struct list_head *item, int nid,
 		    struct mem_cgroup *memcg)
 {
@@ -109,14 +110,22 @@
 
 bool list_lru_add_obj(struct list_lru *lru, struct list_head *item)
 {
+	bool ret;
 	int nid = page_to_nid(virt_to_page(item));
-	struct mem_cgroup *memcg = list_lru_memcg_aware(lru) ?
-		mem_cgroup_from_slab_obj(item) : NULL;
 
-	return list_lru_add(lru, item, nid, memcg);
+	if (list_lru_memcg_aware(lru)) {
+		rcu_read_lock();
+		ret = list_lru_add(lru, item, nid, mem_cgroup_from_slab_obj(item));
+		rcu_read_unlock();
+	} else {
+		ret = list_lru_add(lru, item, nid, NULL);
+	}
+
+	return ret;
 }
 EXPORT_SYMBOL_GPL(list_lru_add_obj);
 
+/* The caller must ensure the memcg lifetime. */
 bool list_lru_del(struct list_lru *lru, struct list_head *item, int nid,
 		    struct mem_cgroup *memcg)
 {
@@ -139,11 +148,18 @@
 
 bool list_lru_del_obj(struct list_lru *lru, struct list_head *item)
 {
+	bool ret;
 	int nid = page_to_nid(virt_to_page(item));
-	struct mem_cgroup *memcg = list_lru_memcg_aware(lru) ?
-		mem_cgroup_from_slab_obj(item) : NULL;
 
-	return list_lru_del(lru, item, nid, memcg);
+	if (list_lru_memcg_aware(lru)) {
+		rcu_read_lock();
+		ret = list_lru_del(lru, item, nid, mem_cgroup_from_slab_obj(item));
+		rcu_read_unlock();
+	} else {
+		ret = list_lru_del(lru, item, nid, NULL);
+	}
+
+	return ret;
 }
 EXPORT_SYMBOL_GPL(list_lru_del_obj);
 
--- linux-qcom-6.8.0.orig/mm/madvise.c
+++ linux-qcom-6.8.0/mm/madvise.c
@@ -366,7 +366,7 @@
 		folio = pfn_folio(pmd_pfn(orig_pmd));
 
 		/* Do not interfere with other mappings of this folio */
-		if (folio_estimated_sharers(folio) != 1)
+		if (folio_likely_mapped_shared(folio))
 			goto huge_unlock;
 
 		if (pageout_anon_only_filter && !folio_test_anon(folio))
@@ -453,7 +453,7 @@
 		if (folio_test_large(folio)) {
 			int err;
 
-			if (folio_estimated_sharers(folio) != 1)
+			if (folio_likely_mapped_shared(folio))
 				break;
 			if (pageout_anon_only_filter && !folio_test_anon(folio))
 				break;
@@ -677,7 +677,7 @@
 		if (folio_test_large(folio)) {
 			int err;
 
-			if (folio_estimated_sharers(folio) != 1)
+			if (folio_likely_mapped_shared(folio))
 				break;
 			if (!folio_trylock(folio))
 				break;
@@ -908,27 +908,14 @@
 {
 	const bool write = behavior == MADV_POPULATE_WRITE;
 	struct mm_struct *mm = vma->vm_mm;
-	unsigned long tmp_end;
 	int locked = 1;
 	long pages;
 
 	*prev = vma;
 
 	while (start < end) {
-		/*
-		 * We might have temporarily dropped the lock. For example,
-		 * our VMA might have been split.
-		 */
-		if (!vma || start >= vma->vm_end) {
-			vma = vma_lookup(mm, start);
-			if (!vma)
-				return -ENOMEM;
-		}
-
-		tmp_end = min_t(unsigned long, end, vma->vm_end);
 		/* Populate (prefault) page tables readable/writable. */
-		pages = faultin_vma_page_range(vma, start, tmp_end, write,
-					       &locked);
+		pages = faultin_page_range(mm, start, end, write, &locked);
 		if (!locked) {
 			mmap_read_lock(mm);
 			locked = 1;
@@ -949,7 +936,7 @@
 				pr_warn_once("%s: unhandled return value: %ld\n",
 					     __func__, pages);
 				fallthrough;
-			case -ENOMEM:
+			case -ENOMEM: /* No VMA or out of memory. */
 				return -ENOMEM;
 			}
 		}
--- linux-qcom-6.8.0.orig/mm/memblock.c
+++ linux-qcom-6.8.0/mm/memblock.c
@@ -738,7 +738,7 @@
 /**
  * memblock_validate_numa_coverage - check if amount of memory with
  * no node ID assigned is less than a threshold
- * @threshold_bytes: maximal number of pages that can have unassigned node
+ * @threshold_bytes: maximal memory size that can have unassigned node
  * ID (in bytes).
  *
  * A buggy firmware may report memory that does not belong to any node.
@@ -754,11 +754,11 @@
 
 	/* calculate lose page */
 	for_each_mem_pfn_range(i, MAX_NUMNODES, &start_pfn, &end_pfn, &nid) {
-		if (nid == NUMA_NO_NODE)
+		if (!numa_valid_node(nid))
 			nr_pages += end_pfn - start_pfn;
 	}
 
-	if ((nr_pages << PAGE_SHIFT) >= threshold_bytes) {
+	if ((nr_pages << PAGE_SHIFT) > threshold_bytes) {
 		mem_size_mb = memblock_phys_mem_size() >> 20;
 		pr_err("NUMA: no nodes coverage for %luMB of %luMB RAM\n",
 		       (nr_pages << PAGE_SHIFT) >> 20, mem_size_mb);
@@ -1061,7 +1061,7 @@
 		return false;
 
 	/* only memory regions are associated with nodes, check it */
-	if (nid != NUMA_NO_NODE && nid != m_nid)
+	if (numa_valid_node(nid) && nid != m_nid)
 		return true;
 
 	/* skip hotpluggable memory regions if needed */
@@ -1118,10 +1118,6 @@
 	int idx_a = *idx & 0xffffffff;
 	int idx_b = *idx >> 32;
 
-	if (WARN_ONCE(nid == MAX_NUMNODES,
-	"Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n"))
-		nid = NUMA_NO_NODE;
-
 	for (; idx_a < type_a->cnt; idx_a++) {
 		struct memblock_region *m = &type_a->regions[idx_a];
 
@@ -1215,9 +1211,6 @@
 	int idx_a = *idx & 0xffffffff;
 	int idx_b = *idx >> 32;
 
-	if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n"))
-		nid = NUMA_NO_NODE;
-
 	if (*idx == (u64)ULLONG_MAX) {
 		idx_a = type_a->cnt - 1;
 		if (type_b != NULL)
@@ -1303,7 +1296,7 @@
 
 		if (PFN_UP(r->base) >= PFN_DOWN(r->base + r->size))
 			continue;
-		if (nid == MAX_NUMNODES || nid == r_nid)
+		if (!numa_valid_node(nid) || nid == r_nid)
 			break;
 	}
 	if (*idx >= type->cnt) {
@@ -1448,9 +1441,6 @@
 	enum memblock_flags flags = choose_memblock_flags();
 	phys_addr_t found;
 
-	if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n"))
-		nid = NUMA_NO_NODE;
-
 	if (!align) {
 		/* Can't use WARNs this early in boot on powerpc */
 		dump_stack();
@@ -1463,7 +1453,7 @@
 	if (found && !memblock_reserve(found, size))
 		goto done;
 
-	if (nid != NUMA_NO_NODE && !exact_nid) {
+	if (numa_valid_node(nid) && !exact_nid) {
 		found = memblock_find_in_range_node(size, align, start,
 						    end, NUMA_NO_NODE,
 						    flags);
@@ -1983,7 +1973,7 @@
 		end = base + size - 1;
 		flags = rgn->flags;
 #ifdef CONFIG_NUMA
-		if (memblock_get_region_node(rgn) != MAX_NUMNODES)
+		if (numa_valid_node(memblock_get_region_node(rgn)))
 			snprintf(nid_buf, sizeof(nid_buf), " on node %d",
 				 memblock_get_region_node(rgn));
 #endif
@@ -2177,7 +2167,7 @@
 			start = region->base;
 			end = start + region->size;
 
-			if (nid == NUMA_NO_NODE || nid >= MAX_NUMNODES)
+			if (!numa_valid_node(nid))
 				nid = early_pfn_to_nid(PFN_DOWN(start));
 
 			reserve_bootmem_region(start, end, nid);
@@ -2268,7 +2258,7 @@
 
 		seq_printf(m, "%4d: ", i);
 		seq_printf(m, "%pa..%pa ", &reg->base, &end);
-		if (nid != MAX_NUMNODES)
+		if (numa_valid_node(nid))
 			seq_printf(m, "%4d ", nid);
 		else
 			seq_printf(m, "%4c ", 'x');
--- linux-qcom-6.8.0.orig/mm/memcontrol.c
+++ linux-qcom-6.8.0/mm/memcontrol.c
@@ -5077,9 +5077,12 @@
 	buf = endp + 1;
 
 	cfd = simple_strtoul(buf, &endp, 10);
-	if ((*endp != ' ') && (*endp != '\0'))
+	if (*endp == '\0')
+		buf = endp;
+	else if (*endp == ' ')
+		buf = endp + 1;
+	else
 		return -EINVAL;
-	buf = endp + 1;
 
 	event = kzalloc(sizeof(*event), GFP_KERNEL);
 	if (!event)
@@ -5363,11 +5366,28 @@
 
 #define MEM_CGROUP_ID_MAX	((1UL << MEM_CGROUP_ID_SHIFT) - 1)
 static DEFINE_IDR(mem_cgroup_idr);
+static DEFINE_SPINLOCK(memcg_idr_lock);
+
+static int mem_cgroup_alloc_id(void)
+{
+	int ret;
+
+	idr_preload(GFP_KERNEL);
+	spin_lock(&memcg_idr_lock);
+	ret = idr_alloc(&mem_cgroup_idr, NULL, 1, MEM_CGROUP_ID_MAX + 1,
+			GFP_NOWAIT);
+	spin_unlock(&memcg_idr_lock);
+	idr_preload_end();
+	return ret;
+}
 
 static void mem_cgroup_id_remove(struct mem_cgroup *memcg)
 {
 	if (memcg->id.id > 0) {
+		spin_lock(&memcg_idr_lock);
 		idr_remove(&mem_cgroup_idr, memcg->id.id);
+		spin_unlock(&memcg_idr_lock);
+
 		memcg->id.id = 0;
 	}
 }
@@ -5494,8 +5514,7 @@
 	if (!memcg)
 		return ERR_PTR(error);
 
-	memcg->id.id = idr_alloc(&mem_cgroup_idr, NULL,
-				 1, MEM_CGROUP_ID_MAX + 1, GFP_KERNEL);
+	memcg->id.id = mem_cgroup_alloc_id();
 	if (memcg->id.id < 0) {
 		error = memcg->id.id;
 		goto fail;
@@ -5572,8 +5591,7 @@
 	WRITE_ONCE(memcg->soft_limit, PAGE_COUNTER_MAX);
 #if defined(CONFIG_MEMCG_KMEM) && defined(CONFIG_ZSWAP)
 	memcg->zswap_max = PAGE_COUNTER_MAX;
-	WRITE_ONCE(memcg->zswap_writeback,
-		!parent || READ_ONCE(parent->zswap_writeback));
+	WRITE_ONCE(memcg->zswap_writeback, true);
 #endif
 	page_counter_set_high(&memcg->swap, PAGE_COUNTER_MAX);
 	if (parent) {
@@ -5640,7 +5658,9 @@
 	 * publish it here at the end of onlining. This matches the
 	 * regular ID destruction during offlining.
 	 */
+	spin_lock(&memcg_idr_lock);
 	idr_replace(&mem_cgroup_idr, memcg, memcg->id.id);
+	spin_unlock(&memcg_idr_lock);
 
 	return 0;
 offline_kmem:
@@ -6068,6 +6088,8 @@
 	css_get(&to->css);
 	css_put(&from->css);
 
+	/* Warning should never happen, so don't worry about refcount non-0 */
+	WARN_ON_ONCE(folio_unqueue_deferred_split(folio));
 	folio->memcg_data = (unsigned long)to;
 
 	__folio_memcg_unlock(from);
@@ -6432,7 +6454,10 @@
 	enum mc_target_type target_type;
 	union mc_target target;
 	struct page *page;
+	struct folio *folio;
+	bool tried_split_before = false;
 
+retry_pmd:
 	ptl = pmd_trans_huge_lock(pmd, vma);
 	if (ptl) {
 		if (mc.precharge < HPAGE_PMD_NR) {
@@ -6442,6 +6467,28 @@
 		target_type = get_mctgt_type_thp(vma, addr, *pmd, &target);
 		if (target_type == MC_TARGET_PAGE) {
 			page = target.page;
+			folio = page_folio(page);
+			/*
+			 * Deferred split queue locking depends on memcg,
+			 * and unqueue is unsafe unless folio refcount is 0:
+			 * split or skip if on the queue? first try to split.
+			 */
+			if (!list_empty(&folio->_deferred_list)) {
+				spin_unlock(ptl);
+				if (!tried_split_before)
+					split_folio(folio);
+				folio_unlock(folio);
+				folio_put(folio);
+				if (tried_split_before)
+					return 0;
+				tried_split_before = true;
+				goto retry_pmd;
+			}
+			/*
+			 * So long as that pmd lock is held, the folio cannot
+			 * be racily added to the _deferred_list, because
+			 * page_remove_rmap() will find it still pmdmapped.
+			 */
 			if (isolate_lru_page(page)) {
 				if (!mem_cgroup_move_account(page, true,
 							     mc.from, mc.to)) {
@@ -7486,6 +7533,7 @@
 			ug->nr_memory += nr_pages;
 		ug->pgpgout++;
 
+		WARN_ON_ONCE(folio_unqueue_deferred_split(folio));
 		folio->memcg_data = 0;
 	}
 
@@ -7530,8 +7578,7 @@
  * @new: Replacement folio.
  *
  * Charge @new as a replacement folio for @old. @old will
- * be uncharged upon free. This is only used by the page cache
- * (in replace_page_cache_folio()).
+ * be uncharged upon free.
  *
  * Both folios must be locked, @new->mapping must be set up.
  */
@@ -7609,17 +7656,6 @@
 
 	/* Transfer the charge and the css ref */
 	commit_charge(new, memcg);
-	/*
-	 * If the old folio is a large folio and is in the split queue, it needs
-	 * to be removed from the split queue now, in case getting an incorrect
-	 * split queue in destroy_large_folio() after the memcg of the old folio
-	 * is cleared.
-	 *
-	 * In addition, the old folio is about to be freed after migration, so
-	 * removing from the split queue a bit earlier seems reasonable.
-	 */
-	if (folio_test_large(old) && folio_test_large_rmappable(old))
-		folio_undo_large_rmappable(old);
 	old->memcg_data = 0;
 }
 
@@ -7829,6 +7865,7 @@
 	VM_BUG_ON_FOLIO(oldid, folio);
 	mod_memcg_state(swap_memcg, MEMCG_SWAP, nr_entries);
 
+	folio_unqueue_deferred_split(folio);
 	folio->memcg_data = 0;
 
 	if (!mem_cgroup_is_root(memcg))
@@ -8220,7 +8257,14 @@
 bool mem_cgroup_zswap_writeback_enabled(struct mem_cgroup *memcg)
 {
 	/* if zswap is disabled, do not block pages going to the swapping device */
-	return !is_zswap_enabled() || !memcg || READ_ONCE(memcg->zswap_writeback);
+	if (!zswap_is_enabled())
+		return true;
+
+	for (; memcg; memcg = parent_mem_cgroup(memcg))
+		if (!READ_ONCE(memcg->zswap_writeback))
+			return false;
+
+	return true;
 }
 
 static u64 zswap_current_read(struct cgroup_subsys_state *css,
--- linux-qcom-6.8.0.orig/mm/memfd.c
+++ linux-qcom-6.8.0/mm/memfd.c
@@ -134,7 +134,7 @@
 	return error;
 }
 
-static unsigned int *memfd_file_seals_ptr(struct file *file)
+unsigned int *memfd_file_seals_ptr(struct file *file)
 {
 	if (shmem_file(file))
 		return &SHMEM_I(file_inode(file))->seals;
--- linux-qcom-6.8.0.orig/mm/memory-failure.c
+++ linux-qcom-6.8.0/mm/memory-failure.c
@@ -154,11 +154,23 @@
 {
 	int ret;
 
-	zone_pcp_disable(page_zone(page));
+	/*
+	 * zone_pcp_disable() can't be used here. It will
+	 * hold pcp_batch_high_lock and dissolve_free_huge_page() might hold
+	 * cpu_hotplug_lock via static_key_slow_dec() when hugetlb vmemmap
+	 * optimization is enabled. This will break current lock dependency
+	 * chain and leads to deadlock.
+	 * Disabling pcp before dissolving the page was a deterministic
+	 * approach because we made sure that those pages cannot end up in any
+	 * PCP list. Draining PCP lists expels those pages to the buddy system,
+	 * but nothing guarantees that those pages do not get back to a PCP
+	 * queue if we need to refill those.
+	 */
 	ret = dissolve_free_huge_page(page);
-	if (!ret)
+	if (!ret) {
+		drain_all_pages(page_zone(page));
 		ret = take_page_off_buddy(page);
-	zone_pcp_enable(page_zone(page));
+	}
 
 	return ret;
 }
@@ -1206,7 +1218,7 @@
 		 * subpages.
 		 */
 		folio_put(folio);
-		if (__page_handle_poison(p) >= 0) {
+		if (__page_handle_poison(p) > 0) {
 			page_ref_inc(p);
 			res = MF_RECOVERED;
 		} else {
@@ -2085,7 +2097,7 @@
 	 */
 	if (res == 0) {
 		folio_unlock(folio);
-		if (__page_handle_poison(p) >= 0) {
+		if (__page_handle_poison(p) > 0) {
 			page_ref_inc(p);
 			res = MF_RECOVERED;
 		} else {
@@ -2398,7 +2410,7 @@
 struct memory_failure_cpu {
 	DECLARE_KFIFO(fifo, struct memory_failure_entry,
 		      MEMORY_FAILURE_FIFO_SIZE);
-	spinlock_t lock;
+	raw_spinlock_t lock;
 	struct work_struct work;
 };
 
@@ -2424,20 +2436,22 @@
 {
 	struct memory_failure_cpu *mf_cpu;
 	unsigned long proc_flags;
+	bool buffer_overflow;
 	struct memory_failure_entry entry = {
 		.pfn =		pfn,
 		.flags =	flags,
 	};
 
 	mf_cpu = &get_cpu_var(memory_failure_cpu);
-	spin_lock_irqsave(&mf_cpu->lock, proc_flags);
-	if (kfifo_put(&mf_cpu->fifo, entry))
+	raw_spin_lock_irqsave(&mf_cpu->lock, proc_flags);
+	buffer_overflow = !kfifo_put(&mf_cpu->fifo, entry);
+	if (!buffer_overflow)
 		schedule_work_on(smp_processor_id(), &mf_cpu->work);
-	else
+	raw_spin_unlock_irqrestore(&mf_cpu->lock, proc_flags);
+	put_cpu_var(memory_failure_cpu);
+	if (buffer_overflow)
 		pr_err("buffer overflow when queuing memory failure at %#lx\n",
 		       pfn);
-	spin_unlock_irqrestore(&mf_cpu->lock, proc_flags);
-	put_cpu_var(memory_failure_cpu);
 }
 EXPORT_SYMBOL_GPL(memory_failure_queue);
 
@@ -2450,9 +2464,9 @@
 
 	mf_cpu = container_of(work, struct memory_failure_cpu, work);
 	for (;;) {
-		spin_lock_irqsave(&mf_cpu->lock, proc_flags);
+		raw_spin_lock_irqsave(&mf_cpu->lock, proc_flags);
 		gotten = kfifo_get(&mf_cpu->fifo, &entry);
-		spin_unlock_irqrestore(&mf_cpu->lock, proc_flags);
+		raw_spin_unlock_irqrestore(&mf_cpu->lock, proc_flags);
 		if (!gotten)
 			break;
 		if (entry.flags & MF_SOFT_OFFLINE)
@@ -2482,7 +2496,7 @@
 
 	for_each_possible_cpu(cpu) {
 		mf_cpu = &per_cpu(memory_failure_cpu, cpu);
-		spin_lock_init(&mf_cpu->lock);
+		raw_spin_lock_init(&mf_cpu->lock);
 		INIT_KFIFO(mf_cpu->fifo);
 		INIT_WORK(&mf_cpu->work, memory_failure_work_func);
 	}
@@ -2536,6 +2550,13 @@
 				 pfn, &unpoison_rs);
 		ret = -EOPNOTSUPP;
 		goto unlock_mutex;
+	}
+
+	if (is_huge_zero_page(&folio->page)) {
+		unpoison_pr_info("Unpoison: huge zero page is not supported %#lx\n",
+				 pfn, &unpoison_rs);
+		ret = -EOPNOTSUPP;
+		goto unlock_mutex;
 	}
 
 	if (!PageHWPoison(p)) {
--- linux-qcom-6.8.0.orig/mm/memory.c
+++ linux-qcom-6.8.0/mm/memory.c
@@ -1795,6 +1795,7 @@
 	tlb_finish_mmu(&tlb);
 	hugetlb_zap_end(vma, details);
 }
+EXPORT_SYMBOL(zap_page_range_single);
 
 /**
  * zap_vma_ptes - remove ptes mapping the vma
@@ -2454,11 +2455,7 @@
 	return 0;
 }
 
-/*
- * Variant of remap_pfn_range that does not call track_pfn_remap.  The caller
- * must have pre-validated the caching bits of the pgprot_t.
- */
-int remap_pfn_range_notrack(struct vm_area_struct *vma, unsigned long addr,
+static int remap_pfn_range_internal(struct vm_area_struct *vma, unsigned long addr,
 		unsigned long pfn, unsigned long size, pgprot_t prot)
 {
 	pgd_t *pgd;
@@ -2511,6 +2508,27 @@
 	return 0;
 }
 
+/*
+ * Variant of remap_pfn_range that does not call track_pfn_remap.  The caller
+ * must have pre-validated the caching bits of the pgprot_t.
+ */
+int remap_pfn_range_notrack(struct vm_area_struct *vma, unsigned long addr,
+		unsigned long pfn, unsigned long size, pgprot_t prot)
+{
+	int error = remap_pfn_range_internal(vma, addr, pfn, size, prot);
+
+	if (!error)
+		return 0;
+
+	/*
+	 * A partial pfn range mapping is dangerous: it does not
+	 * maintain page reference counts, and callers may free
+	 * pages due to the error. So zap it early.
+	 */
+	zap_page_range_single(vma, addr, size, NULL);
+	return error;
+}
+
 /**
  * remap_pfn_range - remap kernel memory to userspace
  * @vma: user vma to map to
@@ -4445,11 +4463,21 @@
 	pmd_t entry;
 	vm_fault_t ret = VM_FAULT_FALLBACK;
 
+	/*
+	 * It is too late to allocate a small folio, we already have a large
+	 * folio in the pagecache: especially s390 KVM cannot tolerate any
+	 * PMD mappings, but PTE-mapped THP are fine. So let's simply refuse any
+	 * PMD mappings if THPs are disabled.
+	 */
+	if (thp_disabled_by_hw() || vma_thp_disabled(vma, vma->vm_flags))
+		return ret;
+
 	if (!thp_vma_suitable_order(vma, haddr, PMD_ORDER))
 		return ret;
 
-	if (page != &folio->page || folio_order(folio) != HPAGE_PMD_ORDER)
+	if (folio_order(folio) != HPAGE_PMD_ORDER)
 		return ret;
+	page = &folio->page;
 
 	/*
 	 * Just backoff if any subpage of a THP is corrupted otherwise
@@ -4521,7 +4549,7 @@
 	struct vm_area_struct *vma = vmf->vma;
 	bool uffd_wp = vmf_orig_pte_uffd_wp(vmf);
 	bool write = vmf->flags & FAULT_FLAG_WRITE;
-	bool prefault = in_range(vmf->address, addr, nr * PAGE_SIZE);
+	bool prefault = !in_range(vmf->address, addr, nr * PAGE_SIZE);
 	pte_t entry;
 
 	flush_icache_pages(vma, page, nr);
@@ -4899,10 +4927,10 @@
 	return ret;
 }
 
-int numa_migrate_prep(struct folio *folio, struct vm_area_struct *vma,
+int numa_migrate_prep(struct folio *folio, struct vm_fault *vmf,
 		      unsigned long addr, int page_nid, int *flags)
 {
-	folio_get(folio);
+	struct vm_area_struct *vma = vmf->vma;
 
 	/* Record the current PID acceesing VMA */
 	vma_set_access_pid_bit(vma);
@@ -4913,7 +4941,61 @@
 		*flags |= TNF_FAULT_LOCAL;
 	}
 
-	return mpol_misplaced(folio, vma, addr);
+	return mpol_misplaced(folio, vmf, addr);
+}
+
+static void numa_rebuild_single_mapping(struct vm_fault *vmf, struct vm_area_struct *vma,
+					unsigned long fault_addr, pte_t *fault_pte,
+					bool writable)
+{
+	pte_t pte, old_pte;
+
+	old_pte = ptep_modify_prot_start(vma, fault_addr, fault_pte);
+	pte = pte_modify(old_pte, vma->vm_page_prot);
+	pte = pte_mkyoung(pte);
+	if (writable)
+		pte = pte_mkwrite(pte, vma);
+	ptep_modify_prot_commit(vma, fault_addr, fault_pte, old_pte, pte);
+	update_mmu_cache_range(vmf, vma, fault_addr, fault_pte, 1);
+}
+
+static void numa_rebuild_large_mapping(struct vm_fault *vmf, struct vm_area_struct *vma,
+				       struct folio *folio, pte_t fault_pte,
+				       bool ignore_writable, bool pte_write_upgrade)
+{
+	int nr = pte_pfn(fault_pte) - folio_pfn(folio);
+	unsigned long start, end, addr = vmf->address;
+	unsigned long addr_start = addr - (nr << PAGE_SHIFT);
+	unsigned long pt_start = ALIGN_DOWN(addr, PMD_SIZE);
+	pte_t *start_ptep;
+
+	/* Stay within the VMA and within the page table. */
+	start = max3(addr_start, pt_start, vma->vm_start);
+	end = min3(addr_start + folio_size(folio), pt_start + PMD_SIZE,
+		   vma->vm_end);
+	start_ptep = vmf->pte - ((addr - start) >> PAGE_SHIFT);
+
+	/* Restore all PTEs' mapping of the large folio */
+	for (addr = start; addr != end; start_ptep++, addr += PAGE_SIZE) {
+		pte_t ptent = ptep_get(start_ptep);
+		bool writable = false;
+
+		if (!pte_present(ptent) || !pte_protnone(ptent))
+			continue;
+
+		if (pfn_folio(pte_pfn(ptent)) != folio)
+			continue;
+
+		if (!ignore_writable) {
+			ptent = pte_modify(ptent, vma->vm_page_prot);
+			writable = pte_write(ptent);
+			if (!writable && pte_write_upgrade &&
+			    can_change_pte_writable(vma, addr, ptent))
+				writable = true;
+		}
+
+		numa_rebuild_single_mapping(vmf, vma, addr, start_ptep, writable);
+	}
 }
 
 static vm_fault_t do_numa_page(struct vm_fault *vmf)
@@ -4921,11 +5003,12 @@
 	struct vm_area_struct *vma = vmf->vma;
 	struct folio *folio = NULL;
 	int nid = NUMA_NO_NODE;
-	bool writable = false;
+	bool writable = false, ignore_writable = false;
+	bool pte_write_upgrade = vma_wants_manual_pte_write_upgrade(vma);
 	int last_cpupid;
 	int target_nid;
 	pte_t pte, old_pte;
-	int flags = 0;
+	int flags = 0, nr_pages;
 
 	/*
 	 * The "pte" at this point cannot be used safely without
@@ -4935,7 +5018,7 @@
 	spin_lock(vmf->ptl);
 	if (unlikely(!pte_same(ptep_get(vmf->pte), vmf->orig_pte))) {
 		pte_unmap_unlock(vmf->pte, vmf->ptl);
-		goto out;
+		return 0;
 	}
 
 	/* Get the normal PTE  */
@@ -4947,7 +5030,7 @@
 	 * is only valid while holding the PT lock.
 	 */
 	writable = pte_write(pte);
-	if (!writable && vma_wants_manual_pte_write_upgrade(vma) &&
+	if (!writable && pte_write_upgrade &&
 	    can_change_pte_writable(vma, vmf->address, pte))
 		writable = true;
 
@@ -4955,10 +5038,6 @@
 	if (!folio || folio_is_zone_device(folio))
 		goto out_map;
 
-	/* TODO: handle PTE-mapped THP */
-	if (folio_test_large(folio))
-		goto out_map;
-
 	/*
 	 * Avoid grouping on RO pages in general. RO pages shouldn't hurt as
 	 * much anyway since they can be in shared cache state. This misses
@@ -4974,10 +5053,11 @@
 	 * Flag if the folio is shared between multiple address spaces. This
 	 * is later used when determining whether to group tasks together
 	 */
-	if (folio_estimated_sharers(folio) > 1 && (vma->vm_flags & VM_SHARED))
+	if (folio_likely_mapped_shared(folio) && (vma->vm_flags & VM_SHARED))
 		flags |= TNF_SHARED;
 
 	nid = folio_nid(folio);
+	nr_pages = folio_nr_pages(folio);
 	/*
 	 * For memory tiering mode, cpupid of slow memory page is used
 	 * to record page access time.  So use default value.
@@ -4987,49 +5067,51 @@
 		last_cpupid = (-1 & LAST_CPUPID_MASK);
 	else
 		last_cpupid = folio_last_cpupid(folio);
-	target_nid = numa_migrate_prep(folio, vma, vmf->address, nid, &flags);
-	if (target_nid == NUMA_NO_NODE) {
-		folio_put(folio);
+	target_nid = numa_migrate_prep(folio, vmf, vmf->address, nid, &flags);
+	if (target_nid == NUMA_NO_NODE)
+		goto out_map;
+	if (migrate_misplaced_folio_prepare(folio, vma, target_nid)) {
+		flags |= TNF_MIGRATE_FAIL;
 		goto out_map;
 	}
+	/* The folio is isolated and isolation code holds a folio reference. */
 	pte_unmap_unlock(vmf->pte, vmf->ptl);
 	writable = false;
+	ignore_writable = true;
 
 	/* Migrate to the requested node */
-	if (migrate_misplaced_folio(folio, vma, target_nid)) {
+	if (!migrate_misplaced_folio(folio, vma, target_nid)) {
 		nid = target_nid;
 		flags |= TNF_MIGRATED;
-	} else {
-		flags |= TNF_MIGRATE_FAIL;
-		vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd,
-					       vmf->address, &vmf->ptl);
-		if (unlikely(!vmf->pte))
-			goto out;
-		if (unlikely(!pte_same(ptep_get(vmf->pte), vmf->orig_pte))) {
-			pte_unmap_unlock(vmf->pte, vmf->ptl);
-			goto out;
-		}
-		goto out_map;
+		task_numa_fault(last_cpupid, nid, nr_pages, flags);
+		return 0;
 	}
 
-out:
-	if (nid != NUMA_NO_NODE)
-		task_numa_fault(last_cpupid, nid, 1, flags);
-	return 0;
+	flags |= TNF_MIGRATE_FAIL;
+	vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd,
+				       vmf->address, &vmf->ptl);
+	if (unlikely(!vmf->pte))
+		return 0;
+	if (unlikely(!pte_same(ptep_get(vmf->pte), vmf->orig_pte))) {
+		pte_unmap_unlock(vmf->pte, vmf->ptl);
+		return 0;
+	}
 out_map:
 	/*
 	 * Make it present again, depending on how arch implements
 	 * non-accessible ptes, some can allow access by kernel mode.
 	 */
-	old_pte = ptep_modify_prot_start(vma, vmf->address, vmf->pte);
-	pte = pte_modify(old_pte, vma->vm_page_prot);
-	pte = pte_mkyoung(pte);
-	if (writable)
-		pte = pte_mkwrite(pte, vma);
-	ptep_modify_prot_commit(vma, vmf->address, vmf->pte, old_pte, pte);
-	update_mmu_cache_range(vmf, vma, vmf->address, vmf->pte, 1);
+	if (folio && folio_test_large(folio))
+		numa_rebuild_large_mapping(vmf, vma, folio, pte, ignore_writable,
+					   pte_write_upgrade);
+	else
+		numa_rebuild_single_mapping(vmf, vma, vmf->address, vmf->pte,
+					    writable);
 	pte_unmap_unlock(vmf->pte, vmf->ptl);
-	goto out;
+
+	if (nid != NUMA_NO_NODE)
+		task_numa_fault(last_cpupid, nid, nr_pages, flags);
+	return 0;
 }
 
 static inline vm_fault_t create_huge_pmd(struct vm_fault *vmf)
@@ -5837,6 +5919,10 @@
 		goto out;
 	pte = ptep_get(ptep);
 
+	/* Never return PFNs of anon folios in COW mappings. */
+	if (vm_normal_folio(vma, address, pte))
+		goto unlock;
+
 	if ((flags & FOLL_WRITE) && !pte_write(pte))
 		goto unlock;
 
--- linux-qcom-6.8.0.orig/mm/memory_hotplug.c
+++ linux-qcom-6.8.0/mm/memory_hotplug.c
@@ -1087,7 +1087,7 @@
 }
 
 int mhp_init_memmap_on_memory(unsigned long pfn, unsigned long nr_pages,
-			      struct zone *zone)
+			      struct zone *zone, bool mhp_off_inaccessible)
 {
 	unsigned long end_pfn = pfn + nr_pages;
 	int ret, i;
@@ -1096,6 +1096,15 @@
 	if (ret)
 		return ret;
 
+	/*
+	 * Memory block is accessible at this stage and hence poison the struct
+	 * pages now.  If the memory block is accessible during memory hotplug
+	 * addition phase, then page poisining is already performed in
+	 * sparse_add_section().
+	 */
+	if (mhp_off_inaccessible)
+		page_init_poison(pfn_to_page(pfn), sizeof(struct page) * nr_pages);
+
 	move_pfn_range_to_zone(zone, pfn, nr_pages, NULL, MIGRATE_UNMOVABLE);
 
 	for (i = 0; i < nr_pages; i++)
@@ -1415,7 +1424,7 @@
 }
 
 static int create_altmaps_and_memory_blocks(int nid, struct memory_group *group,
-					    u64 start, u64 size)
+					    u64 start, u64 size, mhp_t mhp_flags)
 {
 	unsigned long memblock_size = memory_block_size_bytes();
 	u64 cur_start;
@@ -1431,6 +1440,8 @@
 		};
 
 		mhp_altmap.free = memory_block_memmap_on_memory_pages();
+		if (mhp_flags & MHP_OFFLINE_INACCESSIBLE)
+			mhp_altmap.inaccessible = true;
 		params.altmap = kmemdup(&mhp_altmap, sizeof(struct vmem_altmap),
 					GFP_KERNEL);
 		if (!params.altmap) {
@@ -1516,7 +1527,7 @@
 	 */
 	if ((mhp_flags & MHP_MEMMAP_ON_MEMORY) &&
 	    mhp_supports_memmap_on_memory(memory_block_size_bytes())) {
-		ret = create_altmaps_and_memory_blocks(nid, group, start, size);
+		ret = create_altmaps_and_memory_blocks(nid, group, start, size, mhp_flags);
 		if (ret)
 			goto error;
 	} else {
@@ -1676,7 +1687,7 @@
 
 struct range mhp_get_pluggable_range(bool need_mapping)
 {
-	const u64 max_phys = (1ULL << MAX_PHYSMEM_BITS) - 1;
+	const u64 max_phys = PHYSMEM_END;
 	struct range mhp_range;
 
 	if (need_mapping) {
--- linux-qcom-6.8.0.orig/mm/mempolicy.c
+++ linux-qcom-6.8.0/mm/mempolicy.c
@@ -605,12 +605,11 @@
 	 * Unless MPOL_MF_MOVE_ALL, we try to avoid migrating a shared folio.
 	 * Choosing not to migrate a shared folio is not counted as a failure.
 	 *
-	 * To check if the folio is shared, ideally we want to make sure
-	 * every page is mapped to the same process. Doing that is very
-	 * expensive, so check the estimated sharers of the folio instead.
+	 * See folio_likely_mapped_shared() on possible imprecision when we
+	 * cannot easily detect if a folio is shared.
 	 */
 	if ((flags & MPOL_MF_MOVE_ALL) ||
-	    (folio_estimated_sharers(folio) == 1 && !hugetlb_pmd_shared(pte)))
+	    (!folio_likely_mapped_shared(folio) && !hugetlb_pmd_shared(pte)))
 		if (!isolate_hugetlb(folio, qp->pagelist))
 			qp->nr_failed++;
 unlock:
@@ -988,11 +987,10 @@
 	 * Unless MPOL_MF_MOVE_ALL, we try to avoid migrating a shared folio.
 	 * Choosing not to migrate a shared folio is not counted as a failure.
 	 *
-	 * To check if the folio is shared, ideally we want to make sure
-	 * every page is mapped to the same process. Doing that is very
-	 * expensive, so check the estimated sharers of the folio instead.
+	 * See folio_likely_mapped_shared() on possible imprecision when we
+	 * cannot easily detect if a folio is shared.
 	 */
-	if ((flags & MPOL_MF_MOVE_ALL) || folio_estimated_sharers(folio) == 1) {
+	if ((flags & MPOL_MF_MOVE_ALL) || !folio_likely_mapped_shared(folio)) {
 		if (folio_isolate_lru(folio)) {
 			list_add_tail(&folio->lru, foliolist);
 			node_stat_mod_folio(folio,
@@ -1035,6 +1033,10 @@
 
 	mmap_read_lock(mm);
 	vma = find_vma(mm, 0);
+	if (unlikely(!vma)) {
+		mmap_read_unlock(mm);
+		return 0;
+	}
 
 	/*
 	 * This does not migrate the range, but isolates all pages that
@@ -1458,9 +1460,10 @@
 	if ((*flags & MPOL_F_STATIC_NODES) && (*flags & MPOL_F_RELATIVE_NODES))
 		return -EINVAL;
 	if (*flags & MPOL_F_NUMA_BALANCING) {
-		if (*mode != MPOL_BIND)
+		if (*mode == MPOL_BIND || *mode == MPOL_PREFERRED_MANY)
+			*flags |= (MPOL_F_MOF | MPOL_F_MORON);
+		else
 			return -EINVAL;
-		*flags |= (MPOL_F_MOF | MPOL_F_MORON);
 	}
 	return 0;
 }
@@ -2467,7 +2470,7 @@
  * mpol_misplaced - check whether current folio node is valid in policy
  *
  * @folio: folio to be checked
- * @vma: vm area where folio mapped
+ * @vmf: structure describing the fault
  * @addr: virtual address in @vma for shared policy lookup and interleave policy
  *
  * Lookup current policy node id for vma,addr and "compare to" folio's
@@ -2477,18 +2480,24 @@
  * Return: NUMA_NO_NODE if the page is in a node that is valid for this
  * policy, or a suitable node ID to allocate a replacement folio from.
  */
-int mpol_misplaced(struct folio *folio, struct vm_area_struct *vma,
+int mpol_misplaced(struct folio *folio, struct vm_fault *vmf,
 		   unsigned long addr)
 {
 	struct mempolicy *pol;
 	pgoff_t ilx;
 	struct zoneref *z;
 	int curnid = folio_nid(folio);
+	struct vm_area_struct *vma = vmf->vma;
 	int thiscpu = raw_smp_processor_id();
-	int thisnid = cpu_to_node(thiscpu);
+	int thisnid = numa_node_id();
 	int polnid = NUMA_NO_NODE;
 	int ret = NUMA_NO_NODE;
 
+	/*
+	 * Make sure ptl is held so that we don't preempt and we
+	 * have a stable smp processor id
+	 */
+	lockdep_assert_held(vmf->ptl);
 	pol = get_vma_policy(vma, addr, folio_order(folio), &ilx);
 	if (!(pol->flags & MPOL_F_MOF))
 		goto out;
@@ -2509,15 +2518,26 @@
 		break;
 
 	case MPOL_BIND:
-		/* Optimize placement among multiple nodes via NUMA balancing */
+	case MPOL_PREFERRED_MANY:
+		/*
+		 * Even though MPOL_PREFERRED_MANY can allocate pages outside
+		 * policy nodemask we don't allow numa migration to nodes
+		 * outside policy nodemask for now. This is done so that if we
+		 * want demotion to slow memory to happen, before allocating
+		 * from some DRAM node say 'x', we will end up using a
+		 * MPOL_PREFERRED_MANY mask excluding node 'x'. In such scenario
+		 * we should not promote to node 'x' from slow memory node.
+		 */
 		if (pol->flags & MPOL_F_MORON) {
+			/*
+			 * Optimize placement among multiple nodes
+			 * via NUMA balancing
+			 */
 			if (node_isset(thisnid, pol->nodes))
 				break;
 			goto out;
 		}
-		fallthrough;
 
-	case MPOL_PREFERRED_MANY:
 		/*
 		 * use current page if in policy nodemask,
 		 * else select nearest allowed node, if any.
@@ -2526,7 +2546,7 @@
 		if (node_isset(curnid, pol->nodes))
 			goto out;
 		z = first_zones_zonelist(
-				node_zonelist(numa_node_id(), GFP_HIGHUSER),
+				node_zonelist(thisnid, GFP_HIGHUSER),
 				gfp_zone(GFP_HIGHUSER),
 				&pol->nodes);
 		polnid = zone_to_nid(z->zone);
@@ -3018,8 +3038,9 @@
  * @pol:  pointer to mempolicy to be formatted
  *
  * Convert @pol into a string.  If @buffer is too short, truncate the string.
- * Recommend a @maxlen of at least 32 for the longest mode, "interleave", the
- * longest flag, "relative", and to display at least a few node ids.
+ * Recommend a @maxlen of at least 51 for the longest mode, "weighted
+ * interleave", plus the longest flag flags, "relative|balancing", and to
+ * display at least a few node ids.
  */
 void mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol)
 {
@@ -3028,7 +3049,10 @@
 	unsigned short mode = MPOL_DEFAULT;
 	unsigned short flags = 0;
 
-	if (pol && pol != &default_policy && !(pol->flags & MPOL_F_MORON)) {
+	if (pol &&
+	    pol != &default_policy &&
+	    !(pol >= &preferred_node_policy[0] &&
+	      pol <= &preferred_node_policy[ARRAY_SIZE(preferred_node_policy) - 1])) {
 		mode = pol->mode;
 		flags = pol->flags;
 	}
@@ -3055,12 +3079,18 @@
 		p += snprintf(p, buffer + maxlen - p, "=");
 
 		/*
-		 * Currently, the only defined flags are mutually exclusive
+		 * Static and relative are mutually exclusive.
 		 */
 		if (flags & MPOL_F_STATIC_NODES)
 			p += snprintf(p, buffer + maxlen - p, "static");
 		else if (flags & MPOL_F_RELATIVE_NODES)
 			p += snprintf(p, buffer + maxlen - p, "relative");
+
+		if (flags & MPOL_F_NUMA_BALANCING) {
+			if (!is_power_of_2(flags & MPOL_MODE_FLAGS))
+				p += snprintf(p, buffer + maxlen - p, "|");
+			p += snprintf(p, buffer + maxlen - p, "balancing");
+		}
 	}
 
 	if (!nodes_empty(nodes))
--- linux-qcom-6.8.0.orig/mm/memtest.c
+++ linux-qcom-6.8.0/mm/memtest.c
@@ -51,10 +51,10 @@
 	last_bad = 0;
 
 	for (p = start; p < end; p++)
-		*p = pattern;
+		WRITE_ONCE(*p, pattern);
 
 	for (p = start; p < end; p++, start_phys_aligned += incr) {
-		if (*p == pattern)
+		if (READ_ONCE(*p) == pattern)
 			continue;
 		if (start_phys_aligned == last_bad + incr) {
 			last_bad += incr;
--- linux-qcom-6.8.0.orig/mm/migrate.c
+++ linux-qcom-6.8.0/mm/migrate.c
@@ -412,6 +412,15 @@
 		if (folio_ref_count(folio) != expected_count)
 			return -EAGAIN;
 
+		/* Take off deferred split queue while frozen and memcg set */
+		if (folio_test_large(folio) &&
+		    folio_test_large_rmappable(folio)) {
+			if (!folio_ref_freeze(folio, expected_count))
+				return -EAGAIN;
+			folio_unqueue_deferred_split(folio);
+			folio_ref_unfreeze(folio, expected_count);
+		}
+
 		/* No turning back from here */
 		newfolio->index = folio->index;
 		newfolio->mapping = folio->mapping;
@@ -430,6 +439,10 @@
 		return -EAGAIN;
 	}
 
+	/* Take off deferred split queue while frozen and memcg set */
+	if (folio_test_large(folio) && folio_test_large_rmappable(folio))
+		folio_unqueue_deferred_split(folio);
+
 	/*
 	 * Now we know that no one else is looking at the folio:
 	 * no turning back from here.
@@ -1094,7 +1107,7 @@
 	 * not accounted to NR_ISOLATED_*. They can be recognized
 	 * as __folio_test_movable
 	 */
-	if (likely(!__folio_test_movable(src)))
+	if (likely(!__folio_test_movable(src)) && reason != MR_DEMOTION)
 		mod_node_page_state(folio_pgdat(src), NR_ISOLATED_ANON +
 				    folio_is_file_lru(src), -folio_nr_pages(src));
 
@@ -1113,7 +1126,7 @@
 	int rc = -EAGAIN;
 	int old_page_state = 0;
 	struct anon_vma *anon_vma = NULL;
-	bool is_lru = !__folio_test_movable(src);
+	bool is_lru = data_race(!__folio_test_movable(src));
 	bool locked = false;
 	bool dst_locked = false;
 
@@ -2505,16 +2518,44 @@
 	return __folio_alloc_node(gfp, order, nid);
 }
 
-static int numamigrate_isolate_folio(pg_data_t *pgdat, struct folio *folio)
+/*
+ * Prepare for calling migrate_misplaced_folio() by isolating the folio if
+ * permitted. Must be called with the PTL still held.
+ */
+int migrate_misplaced_folio_prepare(struct folio *folio,
+		struct vm_area_struct *vma, int node)
 {
 	int nr_pages = folio_nr_pages(folio);
+	pg_data_t *pgdat = NODE_DATA(node);
+
+	if (folio_is_file_lru(folio)) {
+		/*
+		 * Do not migrate file folios that are mapped in multiple
+		 * processes with execute permissions as they are probably
+		 * shared libraries.
+		 *
+		 * See folio_likely_mapped_shared() on possible imprecision
+		 * when we cannot easily detect if a folio is shared.
+		 */
+		if ((vma->vm_flags & VM_EXEC) &&
+		    folio_likely_mapped_shared(folio))
+			return -EACCES;
+
+		/*
+		 * Do not migrate dirty folios as not all filesystems can move
+		 * dirty folios in MIGRATE_ASYNC mode which is a waste of
+		 * cycles.
+		 */
+		if (folio_test_dirty(folio))
+			return -EAGAIN;
+	}
 
 	/* Avoid migrating to a node that is nearly full */
 	if (!migrate_balanced_pgdat(pgdat, nr_pages)) {
 		int z;
 
 		if (!(sysctl_numa_balancing_mode & NUMA_BALANCING_MEMORY_TIERING))
-			return 0;
+			return -EAGAIN;
 		for (z = pgdat->nr_zones - 1; z >= 0; z--) {
 			if (managed_zone(pgdat->node_zones + z))
 				break;
@@ -2525,65 +2566,37 @@
 		 * further.
 		 */
 		if (z < 0)
-			return 0;
+			return -EAGAIN;
 
 		wakeup_kswapd(pgdat->node_zones + z, 0,
 			      folio_order(folio), ZONE_MOVABLE);
-		return 0;
+		return -EAGAIN;
 	}
 
 	if (!folio_isolate_lru(folio))
-		return 0;
+		return -EAGAIN;
 
 	node_stat_mod_folio(folio, NR_ISOLATED_ANON + folio_is_file_lru(folio),
 			    nr_pages);
-
-	/*
-	 * Isolating the folio has taken another reference, so the
-	 * caller's reference can be safely dropped without the folio
-	 * disappearing underneath us during migration.
-	 */
-	folio_put(folio);
-	return 1;
+	return 0;
 }
 
 /*
  * Attempt to migrate a misplaced folio to the specified destination
- * node. Caller is expected to have an elevated reference count on
- * the folio that will be dropped by this function before returning.
+ * node. Caller is expected to have isolated the folio by calling
+ * migrate_misplaced_folio_prepare(), which will result in an
+ * elevated reference count on the folio. This function will un-isolate the
+ * folio, dereferencing the folio before returning.
  */
 int migrate_misplaced_folio(struct folio *folio, struct vm_area_struct *vma,
 			    int node)
 {
 	pg_data_t *pgdat = NODE_DATA(node);
-	int isolated;
 	int nr_remaining;
 	unsigned int nr_succeeded;
 	LIST_HEAD(migratepages);
 	int nr_pages = folio_nr_pages(folio);
 
-	/*
-	 * Don't migrate file folios that are mapped in multiple processes
-	 * with execute permissions as they are probably shared libraries.
-	 * To check if the folio is shared, ideally we want to make sure
-	 * every page is mapped to the same process. Doing that is very
-	 * expensive, so check the estimated mapcount of the folio instead.
-	 */
-	if (folio_estimated_sharers(folio) != 1 && folio_is_file_lru(folio) &&
-	    (vma->vm_flags & VM_EXEC))
-		goto out;
-
-	/*
-	 * Also do not migrate dirty folios as not all filesystems can move
-	 * dirty folios in MIGRATE_ASYNC mode which is a waste of cycles.
-	 */
-	if (folio_is_file_lru(folio) && folio_test_dirty(folio))
-		goto out;
-
-	isolated = numamigrate_isolate_folio(pgdat, folio);
-	if (!isolated)
-		goto out;
-
 	list_add(&folio->lru, &migratepages);
 	nr_remaining = migrate_pages(&migratepages, alloc_misplaced_dst_folio,
 				     NULL, node, MIGRATE_ASYNC,
@@ -2595,7 +2608,6 @@
 					folio_is_file_lru(folio), -nr_pages);
 			folio_putback_lru(folio);
 		}
-		isolated = 0;
 	}
 	if (nr_succeeded) {
 		count_vm_numa_events(NUMA_PAGE_MIGRATE, nr_succeeded);
@@ -2604,11 +2616,7 @@
 					    nr_succeeded);
 	}
 	BUG_ON(!list_empty(&migratepages));
-	return isolated;
-
-out:
-	folio_put(folio);
-	return 0;
+	return nr_remaining ? -EAGAIN : 0;
 }
 #endif /* CONFIG_NUMA_BALANCING */
 #endif /* CONFIG_NUMA */
--- linux-qcom-6.8.0.orig/mm/mlock.c
+++ linux-qcom-6.8.0/mm/mlock.c
@@ -737,14 +737,17 @@
 	}
 
 	for_each_vma(vmi, vma) {
+		int error;
 		vm_flags_t newflags;
 
 		newflags = vma->vm_flags & ~VM_LOCKED_MASK;
 		newflags |= to_add;
 
-		/* Ignore errors */
-		mlock_fixup(&vmi, vma, &prev, vma->vm_start, vma->vm_end,
-			    newflags);
+		error = mlock_fixup(&vmi, vma, &prev, vma->vm_start, vma->vm_end,
+				    newflags);
+		/* Ignore errors, but prev needs fixing up. */
+		if (error)
+			prev = vma;
 		cond_resched();
 	}
 out:
--- linux-qcom-6.8.0.orig/mm/mmap.c
+++ linux-qcom-6.8.0/mm/mmap.c
@@ -47,6 +47,7 @@
 #include <linux/oom.h>
 #include <linux/sched/mm.h>
 #include <linux/ksm.h>
+#include <linux/memfd.h>
 
 #include <linux/uaccess.h>
 #include <asm/cacheflush.h>
@@ -137,8 +138,7 @@
 static void remove_vma(struct vm_area_struct *vma, bool unreachable)
 {
 	might_sleep();
-	if (vma->vm_ops && vma->vm_ops->close)
-		vma->vm_ops->close(vma);
+	vma_close(vma);
 	if (vma->vm_file)
 		fput(vma->vm_file);
 	mpol_put(vma_policy(vma));
@@ -1279,7 +1279,7 @@
 	 * to. we assume access permissions have been handled by the open
 	 * of the memory object, so we don't do any here.
 	 */
-	vm_flags |= calc_vm_prot_bits(prot, pkey) | calc_vm_flag_bits(flags) |
+	vm_flags |= calc_vm_prot_bits(prot, pkey) | calc_vm_flag_bits(file, flags) |
 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
 
 	if (flags & MAP_LOCKED)
@@ -1291,6 +1291,7 @@
 
 	if (file) {
 		struct inode *inode = file_inode(file);
+		unsigned int seals = memfd_file_seals(file);
 		unsigned long flags_mask;
 
 		if (!file_mmap_ok(file, inode, pgoff, len))
@@ -1329,6 +1330,8 @@
 			vm_flags |= VM_SHARED | VM_MAYSHARE;
 			if (!(file->f_mode & FMODE_WRITE))
 				vm_flags &= ~(VM_MAYWRITE | VM_SHARED);
+			else if (is_readonly_sealed(seals, vm_flags))
+				vm_flags &= ~VM_MAYWRITE;
 			fallthrough;
 		case MAP_PRIVATE:
 			if (!(file->f_mode & FMODE_READ))
@@ -1835,7 +1838,9 @@
 		 * so use shmem's get_unmapped_area in case it can be huge.
 		 */
 		get_area = shmem_get_unmapped_area;
-	} else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) {
+	} else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)
+		   && !addr /* no hint */
+		   && IS_ALIGNED(len, PMD_SIZE)) {
 		/* Ensures that larger anonymous mappings are THP aligned. */
 		get_area = thp_get_unmapped_area;
 	}
@@ -2719,18 +2724,17 @@
 	return do_vmi_munmap(&vmi, mm, start, len, uf, false);
 }
 
-unsigned long mmap_region(struct file *file, unsigned long addr,
+static unsigned long __mmap_region(struct file *file, unsigned long addr,
 		unsigned long len, vm_flags_t vm_flags, unsigned long pgoff,
 		struct list_head *uf)
 {
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma = NULL;
 	struct vm_area_struct *next, *prev, *merge;
-	pgoff_t pglen = len >> PAGE_SHIFT;
+	pgoff_t pglen = PHYS_PFN(len);
 	unsigned long charged = 0;
 	unsigned long end = addr + len;
 	unsigned long merge_start = addr, merge_end = end;
-	bool writable_file_mapping = false;
 	pgoff_t vm_pgoff;
 	int error;
 	VMA_ITERATOR(vmi, mm, addr);
@@ -2824,37 +2828,37 @@
 	vma->vm_page_prot = vm_get_page_prot(vm_flags);
 	vma->vm_pgoff = pgoff;
 
+	if (vma_iter_prealloc(&vmi, vma)) {
+		error = -ENOMEM;
+		goto free_vma;
+	}
+
 	if (file) {
 		vma->vm_file = get_file(file);
-		error = call_mmap(file, vma);
+		error = mmap_file(file, vma);
 		if (error)
-			goto unmap_and_free_vma;
-
-		if (vma_is_shared_maywrite(vma)) {
-			error = mapping_map_writable(file->f_mapping);
-			if (error)
-				goto close_and_free_vma;
-
-			writable_file_mapping = true;
-		}
+			goto unmap_and_free_file_vma;
 
+		/* Drivers cannot alter the address of the VMA. */
+		WARN_ON_ONCE(addr != vma->vm_start);
 		/*
-		 * Expansion is handled above, merging is handled below.
-		 * Drivers should not alter the address of the VMA.
+		 * Drivers should not permit writability when previously it was
+		 * disallowed.
 		 */
-		error = -EINVAL;
-		if (WARN_ON((addr != vma->vm_start)))
-			goto close_and_free_vma;
+		VM_WARN_ON_ONCE(vm_flags != vma->vm_flags &&
+				!(vm_flags & VM_MAYWRITE) &&
+				(vma->vm_flags & VM_MAYWRITE));
 
 		vma_iter_config(&vmi, addr, end);
 		/*
-		 * If vm_flags changed after call_mmap(), we should try merge
+		 * If vm_flags changed after mmap_file(), we should try merge
 		 * vma again as we may succeed this time.
 		 */
 		if (unlikely(vm_flags != vma->vm_flags && prev)) {
 			merge = vma_merge_new_vma(&vmi, prev, vma,
 						  vma->vm_start, vma->vm_end,
 						  vma->vm_pgoff);
+
 			if (merge) {
 				/*
 				 * ->mmap() can change vma->vm_file and fput
@@ -2868,7 +2872,7 @@
 				vma = merge;
 				/* Update vm_flags to pick up the change. */
 				vm_flags = vma->vm_flags;
-				goto unmap_writable;
+				goto file_expanded;
 			}
 		}
 
@@ -2876,24 +2880,15 @@
 	} else if (vm_flags & VM_SHARED) {
 		error = shmem_zero_setup(vma);
 		if (error)
-			goto free_vma;
+			goto free_iter_vma;
 	} else {
 		vma_set_anonymous(vma);
 	}
 
-	if (map_deny_write_exec(vma, vma->vm_flags)) {
-		error = -EACCES;
-		goto close_and_free_vma;
-	}
-
-	/* Allow architectures to sanity-check the vm_flags */
-	error = -EINVAL;
-	if (!arch_validate_flags(vma->vm_flags))
-		goto close_and_free_vma;
-
-	error = -ENOMEM;
-	if (vma_iter_prealloc(&vmi, vma))
-		goto close_and_free_vma;
+#ifdef CONFIG_SPARC64
+	/* TODO: Fix SPARC ADI! */
+	WARN_ON_ONCE(!arch_validate_flags(vm_flags));
+#endif
 
 	/* Lock the VMA since it is modified after insertion into VMA tree */
 	vma_start_write(vma);
@@ -2916,10 +2911,7 @@
 	 */
 	khugepaged_enter_vma(vma, vma->vm_flags);
 
-	/* Once vma denies write, undo our temporary denial count */
-unmap_writable:
-	if (writable_file_mapping)
-		mapping_unmap_writable(file->f_mapping);
+file_expanded:
 	file = vma->vm_file;
 	ksm_add_vma(vma);
 expanded:
@@ -2949,34 +2941,60 @@
 
 	vma_set_page_prot(vma);
 
-	validate_mm(mm);
 	return addr;
 
-close_and_free_vma:
-	if (file && vma->vm_ops && vma->vm_ops->close)
-		vma->vm_ops->close(vma);
-
-	if (file || vma->vm_file) {
-unmap_and_free_vma:
-		fput(vma->vm_file);
-		vma->vm_file = NULL;
-
-		vma_iter_set(&vmi, vma->vm_end);
-		/* Undo any partial mapping done by a device driver. */
-		unmap_region(mm, &vmi.mas, vma, prev, next, vma->vm_start,
-			     vma->vm_end, vma->vm_end, true);
-	}
-	if (writable_file_mapping)
-		mapping_unmap_writable(file->f_mapping);
+unmap_and_free_file_vma:
+	fput(vma->vm_file);
+	vma->vm_file = NULL;
+
+	vma_iter_set(&vmi, vma->vm_end);
+	/* Undo any partial mapping done by a device driver. */
+	unmap_region(mm, &vmi.mas, vma, prev, next, vma->vm_start,
+		     vma->vm_end, vma->vm_end, true);
+free_iter_vma:
+	vma_iter_free(&vmi);
 free_vma:
 	vm_area_free(vma);
 unacct_error:
 	if (charged)
 		vm_unacct_memory(charged);
-	validate_mm(mm);
 	return error;
 }
 
+unsigned long mmap_region(struct file *file, unsigned long addr,
+			  unsigned long len, vm_flags_t vm_flags, unsigned long pgoff,
+			  struct list_head *uf)
+{
+	unsigned long ret;
+	bool writable_file_mapping = false;
+
+	/* Check to see if MDWE is applicable. */
+	if (map_deny_write_exec(vm_flags, vm_flags))
+		return -EACCES;
+
+	/* Allow architectures to sanity-check the vm_flags. */
+	if (!arch_validate_flags(vm_flags))
+		return -EINVAL;
+
+	/* Map writable and ensure this isn't a sealed memfd. */
+	if (file && (vm_flags & VM_SHARED)) {
+		int error = mapping_map_writable(file->f_mapping);
+
+		if (error)
+			return error;
+		writable_file_mapping = true;
+	}
+
+	ret = __mmap_region(file, addr, len, vm_flags, pgoff, uf);
+
+	/* Clear our write mapping regardless of error. */
+	if (writable_file_mapping)
+		mapping_unmap_writable(file->f_mapping);
+
+	validate_mm(current->mm);
+	return ret;
+}
+
 static int __vm_munmap(unsigned long start, size_t len, bool unlock)
 {
 	int ret;
@@ -3079,8 +3097,12 @@
 		flags |= MAP_LOCKED;
 
 	file = get_file(vma->vm_file);
+	ret = security_mmap_file(vma->vm_file, prot, flags);
+	if (ret)
+		goto out_fput;
 	ret = do_mmap(vma->vm_file, start, size,
 			prot, flags, 0, pgoff, &populate, NULL);
+out_fput:
 	fput(file);
 out:
 	mmap_write_unlock(mm);
@@ -3438,8 +3460,7 @@
 	return new_vma;
 
 out_vma_link:
-	if (new_vma->vm_ops && new_vma->vm_ops->close)
-		new_vma->vm_ops->close(new_vma);
+	vma_close(new_vma);
 
 	if (new_vma->vm_file)
 		fput(new_vma->vm_file);
--- linux-qcom-6.8.0.orig/mm/mmap_lock.c
+++ linux-qcom-6.8.0/mm/mmap_lock.c
@@ -19,14 +19,7 @@
 
 #ifdef CONFIG_MEMCG
 
-/*
- * Our various events all share the same buffer (because we don't want or need
- * to allocate a set of buffers *per event type*), so we need to protect against
- * concurrent _reg() and _unreg() calls, and count how many _reg() calls have
- * been made.
- */
-static DEFINE_MUTEX(reg_lock);
-static int reg_refcount; /* Protected by reg_lock. */
+static atomic_t reg_refcount;
 
 /*
  * Size of the buffer for memcg path names. Ignoring stack trace support,
@@ -34,136 +27,22 @@
  */
 #define MEMCG_PATH_BUF_SIZE MAX_FILTER_STR_VAL
 
-/*
- * How many contexts our trace events might be called in: normal, softirq, irq,
- * and NMI.
- */
-#define CONTEXT_COUNT 4
-
-struct memcg_path {
-	local_lock_t lock;
-	char __rcu *buf;
-	local_t buf_idx;
-};
-static DEFINE_PER_CPU(struct memcg_path, memcg_paths) = {
-	.lock = INIT_LOCAL_LOCK(lock),
-	.buf_idx = LOCAL_INIT(0),
-};
-
-static char **tmp_bufs;
-
-/* Called with reg_lock held. */
-static void free_memcg_path_bufs(void)
-{
-	struct memcg_path *memcg_path;
-	int cpu;
-	char **old = tmp_bufs;
-
-	for_each_possible_cpu(cpu) {
-		memcg_path = per_cpu_ptr(&memcg_paths, cpu);
-		*(old++) = rcu_dereference_protected(memcg_path->buf,
-			lockdep_is_held(&reg_lock));
-		rcu_assign_pointer(memcg_path->buf, NULL);
-	}
-
-	/* Wait for inflight memcg_path_buf users to finish. */
-	synchronize_rcu();
-
-	old = tmp_bufs;
-	for_each_possible_cpu(cpu) {
-		kfree(*(old++));
-	}
-
-	kfree(tmp_bufs);
-	tmp_bufs = NULL;
-}
-
 int trace_mmap_lock_reg(void)
 {
-	int cpu;
-	char *new;
-
-	mutex_lock(&reg_lock);
-
-	/* If the refcount is going 0->1, proceed with allocating buffers. */
-	if (reg_refcount++)
-		goto out;
-
-	tmp_bufs = kmalloc_array(num_possible_cpus(), sizeof(*tmp_bufs),
-				 GFP_KERNEL);
-	if (tmp_bufs == NULL)
-		goto out_fail;
-
-	for_each_possible_cpu(cpu) {
-		new = kmalloc(MEMCG_PATH_BUF_SIZE * CONTEXT_COUNT, GFP_KERNEL);
-		if (new == NULL)
-			goto out_fail_free;
-		rcu_assign_pointer(per_cpu_ptr(&memcg_paths, cpu)->buf, new);
-		/* Don't need to wait for inflights, they'd have gotten NULL. */
-	}
-
-out:
-	mutex_unlock(&reg_lock);
+	atomic_inc(&reg_refcount);
 	return 0;
-
-out_fail_free:
-	free_memcg_path_bufs();
-out_fail:
-	/* Since we failed, undo the earlier ref increment. */
-	--reg_refcount;
-
-	mutex_unlock(&reg_lock);
-	return -ENOMEM;
 }
 
 void trace_mmap_lock_unreg(void)
 {
-	mutex_lock(&reg_lock);
-
-	/* If the refcount is going 1->0, proceed with freeing buffers. */
-	if (--reg_refcount)
-		goto out;
-
-	free_memcg_path_bufs();
-
-out:
-	mutex_unlock(&reg_lock);
-}
-
-static inline char *get_memcg_path_buf(void)
-{
-	struct memcg_path *memcg_path = this_cpu_ptr(&memcg_paths);
-	char *buf;
-	int idx;
-
-	rcu_read_lock();
-	buf = rcu_dereference(memcg_path->buf);
-	if (buf == NULL) {
-		rcu_read_unlock();
-		return NULL;
-	}
-	idx = local_add_return(MEMCG_PATH_BUF_SIZE, &memcg_path->buf_idx) -
-	      MEMCG_PATH_BUF_SIZE;
-	return &buf[idx];
+	atomic_dec(&reg_refcount);
 }
 
-static inline void put_memcg_path_buf(void)
-{
-	local_sub(MEMCG_PATH_BUF_SIZE, &this_cpu_ptr(&memcg_paths)->buf_idx);
-	rcu_read_unlock();
-}
-
-#define TRACE_MMAP_LOCK_EVENT(type, mm, ...)                                   \
-	do {                                                                   \
-		const char *memcg_path;                                        \
-		local_lock(&memcg_paths.lock);                                 \
-		memcg_path = get_mm_memcg_path(mm);                            \
-		trace_mmap_lock_##type(mm,                                     \
-				       memcg_path != NULL ? memcg_path : "",   \
-				       ##__VA_ARGS__);                         \
-		if (likely(memcg_path != NULL))                                \
-			put_memcg_path_buf();                                  \
-		local_unlock(&memcg_paths.lock);                               \
+#define TRACE_MMAP_LOCK_EVENT(type, mm, ...)                    \
+	do {                                                    \
+		char buf[MEMCG_PATH_BUF_SIZE];                  \
+		get_mm_memcg_path(mm, buf, sizeof(buf));        \
+		trace_mmap_lock_##type(mm, buf, ##__VA_ARGS__); \
 	} while (0)
 
 #else /* !CONFIG_MEMCG */
@@ -185,37 +64,23 @@
 #ifdef CONFIG_TRACING
 #ifdef CONFIG_MEMCG
 /*
- * Write the given mm_struct's memcg path to a percpu buffer, and return a
- * pointer to it. If the path cannot be determined, or no buffer was available
- * (because the trace event is being unregistered), NULL is returned.
- *
- * Note: buffers are allocated per-cpu to avoid locking, so preemption must be
- * disabled by the caller before calling us, and re-enabled only after the
- * caller is done with the pointer.
- *
- * The caller must call put_memcg_path_buf() once the buffer is no longer
- * needed. This must be done while preemption is still disabled.
+ * Write the given mm_struct's memcg path to a buffer. If the path cannot be
+ * determined or the trace event is being unregistered, empty string is written.
  */
-static const char *get_mm_memcg_path(struct mm_struct *mm)
+static void get_mm_memcg_path(struct mm_struct *mm, char *buf, size_t buflen)
 {
-	char *buf = NULL;
-	struct mem_cgroup *memcg = get_mem_cgroup_from_mm(mm);
+	struct mem_cgroup *memcg;
 
+	buf[0] = '\0';
+	/* No need to get path if no trace event is registered. */
+	if (!atomic_read(&reg_refcount))
+		return;
+	memcg = get_mem_cgroup_from_mm(mm);
 	if (memcg == NULL)
-		goto out;
-	if (unlikely(memcg->css.cgroup == NULL))
-		goto out_put;
-
-	buf = get_memcg_path_buf();
-	if (buf == NULL)
-		goto out_put;
-
-	cgroup_path(memcg->css.cgroup, buf, MEMCG_PATH_BUF_SIZE);
-
-out_put:
+		return;
+	if (memcg->css.cgroup)
+		cgroup_path(memcg->css.cgroup, buf, buflen);
 	css_put(&memcg->css);
-out:
-	return buf;
 }
 
 #endif /* CONFIG_MEMCG */
--- linux-qcom-6.8.0.orig/mm/mprotect.c
+++ linux-qcom-6.8.0/mm/mprotect.c
@@ -129,7 +129,8 @@
 
 				/* Also skip shared copy-on-write pages */
 				if (is_cow_mapping(vma->vm_flags) &&
-				    folio_ref_count(folio) != 1)
+				    (folio_maybe_dma_pinned(folio) ||
+				     folio_likely_mapped_shared(folio)))
 					continue;
 
 				/*
@@ -781,7 +782,7 @@
 			break;
 		}
 
-		if (map_deny_write_exec(vma, newflags)) {
+		if (map_deny_write_exec(vma->vm_flags, newflags)) {
 			error = -EACCES;
 			break;
 		}
--- linux-qcom-6.8.0.orig/mm/mremap.c
+++ linux-qcom-6.8.0/mm/mremap.c
@@ -238,6 +238,7 @@
 {
 	spinlock_t *old_ptl, *new_ptl;
 	struct mm_struct *mm = vma->vm_mm;
+	bool res = false;
 	pmd_t pmd;
 
 	if (!arch_supports_page_table_move())
@@ -277,19 +278,25 @@
 	if (new_ptl != old_ptl)
 		spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
 
-	/* Clear the pmd */
 	pmd = *old_pmd;
+
+	/* Racing with collapse? */
+	if (unlikely(!pmd_present(pmd) || pmd_leaf(pmd)))
+		goto out_unlock;
+	/* Clear the pmd */
 	pmd_clear(old_pmd);
+	res = true;
 
 	VM_BUG_ON(!pmd_none(*new_pmd));
 
 	pmd_populate(mm, new_pmd, pmd_pgtable(pmd));
 	flush_tlb_range(vma, old_addr, old_addr + PMD_SIZE);
+out_unlock:
 	if (new_ptl != old_ptl)
 		spin_unlock(new_ptl);
 	spin_unlock(old_ptl);
 
-	return true;
+	return res;
 }
 #else
 static inline bool move_normal_pmd(struct vm_area_struct *vma,
@@ -641,7 +648,7 @@
 	 * Prevent negative return values when {old,new}_addr was realigned
 	 * but we broke out of the above loop for the first PMD itself.
 	 */
-	if (len + old_addr < old_end)
+	if (old_addr < old_end - len)
 		return 0;
 
 	return len + old_addr - old_end;	/* how much done */
--- linux-qcom-6.8.0.orig/mm/nommu.c
+++ linux-qcom-6.8.0/mm/nommu.c
@@ -584,7 +584,7 @@
 	VMA_ITERATOR(vmi, vma->vm_mm, vma->vm_start);
 
 	vma_iter_config(&vmi, vma->vm_start, vma->vm_end);
-	if (vma_iter_prealloc(&vmi, vma)) {
+	if (vma_iter_prealloc(&vmi, NULL)) {
 		pr_warn("Allocation of vma tree for process %d failed\n",
 		       current->pid);
 		return -ENOMEM;
@@ -600,8 +600,7 @@
  */
 static void delete_vma(struct mm_struct *mm, struct vm_area_struct *vma)
 {
-	if (vma->vm_ops && vma->vm_ops->close)
-		vma->vm_ops->close(vma);
+	vma_close(vma);
 	if (vma->vm_file)
 		fput(vma->vm_file);
 	put_nommu_region(vma->vm_region);
@@ -854,7 +853,7 @@
 {
 	unsigned long vm_flags;
 
-	vm_flags = calc_vm_prot_bits(prot, 0) | calc_vm_flag_bits(flags);
+	vm_flags = calc_vm_prot_bits(prot, 0) | calc_vm_flag_bits(file, flags);
 
 	if (!file) {
 		/*
@@ -896,7 +895,7 @@
 {
 	int ret;
 
-	ret = call_mmap(vma->vm_file, vma);
+	ret = mmap_file(vma->vm_file, vma);
 	if (ret == 0) {
 		vma->vm_region->vm_top = vma->vm_region->vm_end;
 		return 0;
@@ -929,7 +928,7 @@
 	 * happy.
 	 */
 	if (capabilities & NOMMU_MAP_DIRECT) {
-		ret = call_mmap(vma->vm_file, vma);
+		ret = mmap_file(vma->vm_file, vma);
 		/* shouldn't return success if we're not sharing */
 		if (WARN_ON_ONCE(!is_nommu_shared_mapping(vma->vm_flags)))
 			ret = -ENOSYS;
--- linux-qcom-6.8.0.orig/mm/page-writeback.c
+++ linux-qcom-6.8.0/mm/page-writeback.c
@@ -415,13 +415,20 @@
 	else
 		bg_thresh = (bg_ratio * available_memory) / PAGE_SIZE;
 
-	if (bg_thresh >= thresh)
-		bg_thresh = thresh / 2;
 	tsk = current;
 	if (rt_task(tsk)) {
 		bg_thresh += bg_thresh / 4 + global_wb_domain.dirty_limit / 32;
 		thresh += thresh / 4 + global_wb_domain.dirty_limit / 32;
 	}
+	/*
+	 * Dirty throttling logic assumes the limits in page units fit into
+	 * 32-bits. This gives 16TB dirty limits max which is hopefully enough.
+	 */
+	if (thresh > UINT_MAX)
+		thresh = UINT_MAX;
+	/* This makes sure bg_thresh is within 32-bits as well */
+	if (bg_thresh >= thresh)
+		bg_thresh = thresh / 2;
 	dtc->thresh = thresh;
 	dtc->bg_thresh = bg_thresh;
 
@@ -471,7 +478,11 @@
 	if (rt_task(tsk))
 		dirty += dirty / 4;
 
-	return dirty;
+	/*
+	 * Dirty throttling logic assumes the limits in page units fit into
+	 * 32-bits. This gives 16TB dirty limits max which is hopefully enough.
+	 */
+	return min_t(unsigned long, dirty, UINT_MAX);
 }
 
 /**
@@ -508,10 +519,17 @@
 		void *buffer, size_t *lenp, loff_t *ppos)
 {
 	int ret;
+	unsigned long old_bytes = dirty_background_bytes;
 
 	ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
-	if (ret == 0 && write)
+	if (ret == 0 && write) {
+		if (DIV_ROUND_UP(dirty_background_bytes, PAGE_SIZE) >
+								UINT_MAX) {
+			dirty_background_bytes = old_bytes;
+			return -ERANGE;
+		}
 		dirty_background_ratio = 0;
+	}
 	return ret;
 }
 
@@ -537,6 +555,10 @@
 
 	ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
 	if (ret == 0 && write && vm_dirty_bytes != old_bytes) {
+		if (DIV_ROUND_UP(vm_dirty_bytes, PAGE_SIZE) > UINT_MAX) {
+			vm_dirty_bytes = old_bytes;
+			return -ERANGE;
+		}
 		writeback_set_ratelimit();
 		vm_dirty_ratio = 0;
 	}
@@ -1638,7 +1660,7 @@
 	 */
 	dtc->wb_thresh = __wb_calc_thresh(dtc);
 	dtc->wb_bg_thresh = dtc->thresh ?
-		div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0;
+		div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0;
 
 	/*
 	 * In order to avoid the stacked BDI deadlock we need
--- linux-qcom-6.8.0.orig/mm/page_alloc.c
+++ linux-qcom-6.8.0/mm/page_alloc.c
@@ -303,7 +303,7 @@
 
 static bool page_contains_unaccepted(struct page *page, unsigned int order);
 static void accept_page(struct page *page, unsigned int order);
-static bool try_to_accept_memory(struct zone *zone, unsigned int order);
+static bool cond_accept_memory(struct zone *zone, unsigned int order);
 static inline bool has_unaccepted_memory(void);
 static bool __free_unaccepted(struct page *page);
 
@@ -520,10 +520,15 @@
 
 static inline unsigned int order_to_pindex(int migratetype, int order)
 {
+	bool __maybe_unused movable;
+
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 	if (order > PAGE_ALLOC_COSTLY_ORDER) {
 		VM_BUG_ON(order != pageblock_order);
-		return NR_LOWORDER_PCP_LISTS;
+
+		movable = migratetype == MIGRATE_MOVABLE;
+
+		return NR_LOWORDER_PCP_LISTS + movable;
 	}
 #else
 	VM_BUG_ON(order > PAGE_ALLOC_COSTLY_ORDER);
@@ -537,7 +542,7 @@
 	int order = pindex / MIGRATE_PCPTYPES;
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
-	if (pindex == NR_LOWORDER_PCP_LISTS)
+	if (pindex >= NR_LOWORDER_PCP_LISTS)
 		order = pageblock_order;
 #else
 	VM_BUG_ON(order > PAGE_ALLOC_COSTLY_ORDER);
@@ -596,9 +601,7 @@
 		return;
 	}
 
-	if (folio_test_large_rmappable(folio))
-		folio_undo_large_rmappable(folio);
-
+	folio_unqueue_deferred_split(folio);
 	mem_cgroup_uncharge(folio);
 	free_the_page(&folio->page, folio_order(folio));
 }
@@ -1005,10 +1008,11 @@
 		}
 		break;
 	case 2:
-		/*
-		 * the second tail page: ->mapping is
-		 * deferred_list.next -- ignore value.
-		 */
+		/* the second tail page: deferred_list overlaps ->mapping */
+		if (unlikely(!list_empty(&folio->_deferred_list))) {
+			bad_page(page, "on deferred list");
+			goto out;
+		}
 		break;
 	default:
 		if (page->mapping != TAIL_MAPPING) {
@@ -1087,6 +1091,7 @@
 	bool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags);
 	bool init = want_init_on_free();
 	bool compound = PageCompound(page);
+	struct folio *folio = page_folio(page);
 
 	VM_BUG_ON_PAGE(PageTail(page), page);
 
@@ -1096,6 +1101,20 @@
 	if (memcg_kmem_online() && PageMemcgKmem(page))
 		__memcg_kmem_uncharge_page(page, order);
 
+	/*
+	 * In rare cases, when truncation or holepunching raced with
+	 * munlock after VM_LOCKED was cleared, Mlocked may still be
+	 * found set here.  This does not indicate a problem, unless
+	 * "unevictable_pgs_cleared" appears worryingly large.
+	 */
+	if (unlikely(folio_test_mlocked(folio))) {
+		long nr_pages = folio_nr_pages(folio);
+
+		__folio_clear_mlocked(folio);
+		zone_stat_mod_folio(folio, NR_MLOCK, -nr_pages);
+		count_vm_events(UNEVICTABLE_PGCLEARED, nr_pages);
+	}
+
 	if (unlikely(PageHWPoison(page)) && !order) {
 		/* Do not let hwpoison pages hit pcplists/buddy */
 		reset_page_owner(page, order);
@@ -2215,14 +2234,21 @@
  */
 static void drain_pages_zone(unsigned int cpu, struct zone *zone)
 {
-	struct per_cpu_pages *pcp;
+	struct per_cpu_pages *pcp = per_cpu_ptr(zone->per_cpu_pageset, cpu);
+	int count;
 
-	pcp = per_cpu_ptr(zone->per_cpu_pageset, cpu);
-	if (pcp->count) {
+	do {
 		spin_lock(&pcp->lock);
-		free_pcppages_bulk(zone, pcp->count, pcp, 0);
+		count = pcp->count;
+		if (count) {
+			int to_drain = min(count,
+				pcp->batch << CONFIG_PCP_BATCH_SCALE_MAX);
+
+			free_pcppages_bulk(zone, to_drain, pcp, 0);
+			count -= to_drain;
+		}
 		spin_unlock(&pcp->lock);
-	}
+	} while (count);
 }
 
 /*
@@ -2728,12 +2754,12 @@
 			page = __rmqueue(zone, order, migratetype, alloc_flags);
 
 			/*
-			 * If the allocation fails, allow OOM handling access
-			 * to HIGHATOMIC reserves as failing now is worse than
-			 * failing a high-order atomic allocation in the
-			 * future.
+			 * If the allocation fails, allow OOM handling and
+			 * order-0 (atomic) allocs access to HIGHATOMIC
+			 * reserves as failing now is worse than failing a
+			 * high-order atomic allocation in the future.
 			 */
-			if (!page && (alloc_flags & ALLOC_OOM))
+			if (!page && (alloc_flags & (ALLOC_OOM|ALLOC_NON_BLOCK)))
 				page = __rmqueue_smallest(zone, order, MIGRATE_HIGHATOMIC);
 
 			if (!page) {
@@ -2941,9 +2967,6 @@
 	if (!(alloc_flags & ALLOC_CMA))
 		unusable_free += zone_page_state(z, NR_FREE_CMA_PAGES);
 #endif
-#ifdef CONFIG_UNACCEPTED_MEMORY
-	unusable_free += zone_page_state(z, NR_UNACCEPTED);
-#endif
 
 	return unusable_free;
 }
@@ -3237,6 +3260,8 @@
 			}
 		}
 
+		cond_accept_memory(zone, order);
+
 		/*
 		 * Detect whether the number of free pages is below high
 		 * watermark.  If so, we will decrease pcp->high and free
@@ -3262,10 +3287,8 @@
 				       gfp_mask)) {
 			int ret;
 
-			if (has_unaccepted_memory()) {
-				if (try_to_accept_memory(zone, order))
-					goto try_this_zone;
-			}
+			if (cond_accept_memory(zone, order))
+				goto try_this_zone;
 
 #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
 			/*
@@ -3319,10 +3342,8 @@
 
 			return page;
 		} else {
-			if (has_unaccepted_memory()) {
-				if (try_to_accept_memory(zone, order))
-					goto try_this_zone;
-			}
+			if (cond_accept_memory(zone, order))
+				goto try_this_zone;
 
 #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
 			/* Try again if zone has deferred pages */
@@ -4437,7 +4458,8 @@
 	gfp = alloc_gfp;
 
 	/* Find an allowed local zone that meets the low watermark. */
-	for_each_zone_zonelist_nodemask(zone, z, ac.zonelist, ac.highest_zoneidx, ac.nodemask) {
+	z = ac.preferred_zoneref;
+	for_next_zone_zonelist_nodemask(zone, z, ac.highest_zoneidx, ac.nodemask) {
 		unsigned long mark;
 
 		if (cpusets_enabled() && (alloc_flags & ALLOC_CPUSET) &&
@@ -6798,9 +6820,6 @@
 	struct page *page;
 	bool last;
 
-	if (list_empty(&zone->unaccepted_pages))
-		return false;
-
 	spin_lock_irqsave(&zone->lock, flags);
 	page = list_first_entry_or_null(&zone->unaccepted_pages,
 					struct page, lru);
@@ -6826,23 +6845,29 @@
 	return true;
 }
 
-static bool try_to_accept_memory(struct zone *zone, unsigned int order)
+static bool cond_accept_memory(struct zone *zone, unsigned int order)
 {
 	long to_accept;
-	int ret = false;
+	bool ret = false;
+
+	if (!has_unaccepted_memory())
+		return false;
+
+	if (list_empty(&zone->unaccepted_pages))
+		return false;
 
 	/* How much to accept to get to high watermark? */
 	to_accept = high_wmark_pages(zone) -
 		    (zone_page_state(zone, NR_FREE_PAGES) -
-		    __zone_watermark_unusable_free(zone, order, 0));
+		    __zone_watermark_unusable_free(zone, order, 0) -
+		    zone_page_state(zone, NR_UNACCEPTED));
 
-	/* Accept at least one page */
-	do {
+	while (to_accept > 0) {
 		if (!try_to_accept_memory_one(zone))
 			break;
 		ret = true;
 		to_accept -= MAX_ORDER_NR_PAGES;
-	} while (to_accept > 0);
+	}
 
 	return ret;
 }
@@ -6885,7 +6910,7 @@
 {
 }
 
-static bool try_to_accept_memory(struct zone *zone, unsigned int order)
+static bool cond_accept_memory(struct zone *zone, unsigned int order)
 {
 	return false;
 }
--- linux-qcom-6.8.0.orig/mm/page_table_check.c
+++ linux-qcom-6.8.0/mm/page_table_check.c
@@ -7,6 +7,8 @@
 #include <linux/kstrtox.h>
 #include <linux/mm.h>
 #include <linux/page_table_check.h>
+#include <linux/swap.h>
+#include <linux/swapops.h>
 
 #undef pr_fmt
 #define pr_fmt(fmt)	"page_table_check: " fmt
@@ -71,6 +73,9 @@
 	page = pfn_to_page(pfn);
 	page_ext = page_ext_get(page);
 
+	if (!page_ext)
+		return;
+
 	BUG_ON(PageSlab(page));
 	anon = PageAnon(page);
 
@@ -108,6 +113,9 @@
 	page = pfn_to_page(pfn);
 	page_ext = page_ext_get(page);
 
+	if (!page_ext)
+		return;
+
 	BUG_ON(PageSlab(page));
 	anon = PageAnon(page);
 
@@ -138,7 +146,10 @@
 	BUG_ON(PageSlab(page));
 
 	page_ext = page_ext_get(page);
-	BUG_ON(!page_ext);
+
+	if (!page_ext)
+		return;
+
 	for (i = 0; i < (1ul << order); i++) {
 		struct page_table_check *ptc = get_page_table_check(page_ext);
 
@@ -182,6 +193,22 @@
 }
 EXPORT_SYMBOL(__page_table_check_pud_clear);
 
+/* Whether the swap entry cached writable information */
+static inline bool swap_cached_writable(swp_entry_t entry)
+{
+	return is_writable_device_exclusive_entry(entry) ||
+	    is_writable_device_private_entry(entry) ||
+	    is_writable_migration_entry(entry);
+}
+
+static inline void page_table_check_pte_flags(pte_t pte)
+{
+	if (pte_present(pte) && pte_uffd_wp(pte))
+		WARN_ON_ONCE(pte_write(pte));
+	else if (is_swap_pte(pte) && pte_swp_uffd_wp(pte))
+		WARN_ON_ONCE(swap_cached_writable(pte_to_swp_entry(pte)));
+}
+
 void __page_table_check_ptes_set(struct mm_struct *mm, pte_t *ptep, pte_t pte,
 		unsigned int nr)
 {
@@ -190,6 +217,8 @@
 	if (&init_mm == mm)
 		return;
 
+	page_table_check_pte_flags(pte);
+
 	for (i = 0; i < nr; i++)
 		__page_table_check_pte_clear(mm, ptep_get(ptep + i));
 	if (pte_user_accessible_page(pte))
@@ -197,11 +226,21 @@
 }
 EXPORT_SYMBOL(__page_table_check_ptes_set);
 
+static inline void page_table_check_pmd_flags(pmd_t pmd)
+{
+	if (pmd_present(pmd) && pmd_uffd_wp(pmd))
+		WARN_ON_ONCE(pmd_write(pmd));
+	else if (is_swap_pmd(pmd) && pmd_swp_uffd_wp(pmd))
+		WARN_ON_ONCE(swap_cached_writable(pmd_to_swp_entry(pmd)));
+}
+
 void __page_table_check_pmd_set(struct mm_struct *mm, pmd_t *pmdp, pmd_t pmd)
 {
 	if (&init_mm == mm)
 		return;
 
+	page_table_check_pmd_flags(pmd);
+
 	__page_table_check_pmd_clear(mm, *pmdp);
 	if (pmd_user_accessible_page(pmd)) {
 		page_table_check_set(pmd_pfn(pmd), PMD_SIZE >> PAGE_SHIFT,
--- linux-qcom-6.8.0.orig/mm/pgtable-generic.c
+++ linux-qcom-6.8.0/mm/pgtable-generic.c
@@ -198,6 +198,7 @@
 pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
 		     pmd_t *pmdp)
 {
+	VM_WARN_ON_ONCE(!pmd_present(*pmdp));
 	pmd_t old = pmdp_establish(vma, address, pmdp, pmd_mkinvalid(*pmdp));
 	flush_pmd_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
 	return old;
@@ -208,6 +209,7 @@
 pmd_t pmdp_invalidate_ad(struct vm_area_struct *vma, unsigned long address,
 			 pmd_t *pmdp)
 {
+	VM_WARN_ON_ONCE(!pmd_present(*pmdp));
 	return pmdp_invalidate(vma, address, pmdp);
 }
 #endif
--- linux-qcom-6.8.0.orig/mm/readahead.c
+++ linux-qcom-6.8.0/mm/readahead.c
@@ -490,6 +490,7 @@
 	pgoff_t index = readahead_index(ractl);
 	pgoff_t limit = (i_size_read(mapping->host) - 1) >> PAGE_SHIFT;
 	pgoff_t mark = index + ra->size - ra->async_size;
+	unsigned int nofs;
 	int err = 0;
 	gfp_t gfp = readahead_gfp_mask(mapping);
 
@@ -498,14 +499,14 @@
 
 	limit = min(limit, index + ra->size - 1);
 
-	if (new_order < MAX_PAGECACHE_ORDER) {
+	if (new_order < MAX_PAGECACHE_ORDER)
 		new_order += 2;
-		if (new_order > MAX_PAGECACHE_ORDER)
-			new_order = MAX_PAGECACHE_ORDER;
-		while ((1 << new_order) > ra->size)
-			new_order--;
-	}
 
+	new_order = min_t(unsigned int, MAX_PAGECACHE_ORDER, new_order);
+	new_order = min_t(unsigned int, new_order, ilog2(ra->size));
+
+	/* See comment in page_cache_ra_unbounded() */
+	nofs = memalloc_nofs_save();
 	filemap_invalidate_lock_shared(mapping);
 	while (index <= limit) {
 		unsigned int order = new_order;
@@ -516,9 +517,6 @@
 		/* Don't allocate pages past EOF */
 		while (index + (1UL << order) - 1 > limit)
 			order--;
-		/* THP machinery does not support order-1 */
-		if (order == 1)
-			order = 0;
 		err = ra_alloc_folio(ractl, index, mark, order, gfp);
 		if (err)
 			break;
@@ -532,6 +530,7 @@
 
 	read_pages(ractl);
 	filemap_invalidate_unlock_shared(mapping);
+	memalloc_nofs_restore(nofs);
 
 	/*
 	 * If there were already pages in the page cache, then we may have
@@ -579,7 +578,11 @@
 			1UL << order);
 	if (index == expected || index == (ra->start + ra->size)) {
 		ra->start += ra->size;
-		ra->size = get_next_ra_size(ra, max_pages);
+		/*
+		 * In the case of MADV_HUGEPAGE, the actual size might exceed
+		 * the readahead window.
+		 */
+		ra->size = max(ra->size, get_next_ra_size(ra, max_pages));
 		ra->async_size = ra->size;
 		goto readit;
 	}
--- linux-qcom-6.8.0.orig/mm/rmap.c
+++ linux-qcom-6.8.0/mm/rmap.c
@@ -75,6 +75,7 @@
 #include <linux/memremap.h>
 #include <linux/userfaultfd_k.h>
 #include <linux/mm_inline.h>
+#include <linux/oom.h>
 
 #include <asm/tlbflush.h>
 
@@ -867,13 +868,24 @@
 			continue;
 		}
 
-		if (pvmw.pte) {
-			if (lru_gen_enabled() &&
-			    pte_young(ptep_get(pvmw.pte))) {
-				lru_gen_look_around(&pvmw);
-				referenced++;
-			}
+		/*
+		 * Skip the non-shared swapbacked folio mapped solely by
+		 * the exiting or OOM-reaped process. This avoids redundant
+		 * swap-out followed by an immediate unmap.
+		 */
+		if ((!atomic_read(&vma->vm_mm->mm_users) ||
+		    check_stable_address_space(vma->vm_mm)) &&
+		    folio_test_anon(folio) && folio_test_swapbacked(folio) &&
+		    !folio_likely_mapped_shared(folio)) {
+			pra->referenced = -1;
+			page_vma_mapped_walk_done(&pvmw);
+			return false;
+		}
 
+		if (lru_gen_enabled() && pvmw.pte) {
+			if (lru_gen_look_around(&pvmw))
+				referenced++;
+		} else if (pvmw.pte) {
 			if (ptep_clear_flush_young_notify(vma, address,
 						pvmw.pte))
 				referenced++;
--- linux-qcom-6.8.0.orig/mm/secretmem.c
+++ linux-qcom-6.8.0/mm/secretmem.c
@@ -238,7 +238,7 @@
 	/* make sure local flags do not confict with global fcntl.h */
 	BUILD_BUG_ON(SECRETMEM_FLAGS_MASK & O_CLOEXEC);
 
-	if (!secretmem_enable)
+	if (!secretmem_enable || !can_set_direct_map())
 		return -ENOSYS;
 
 	if (flags & ~(SECRETMEM_FLAGS_MASK | O_CLOEXEC))
@@ -280,7 +280,7 @@
 
 static int __init secretmem_init(void)
 {
-	if (!secretmem_enable)
+	if (!secretmem_enable || !can_set_direct_map())
 		return 0;
 
 	secretmem_mnt = kern_mount(&secretmem_fs);
--- linux-qcom-6.8.0.orig/mm/shmem.c
+++ linux-qcom-6.8.0/mm/shmem.c
@@ -311,7 +311,7 @@
 		dquot_quota_off(sb, type);
 }
 
-static struct dquot **shmem_get_dquots(struct inode *inode)
+static struct dquot __rcu **shmem_get_dquots(struct inode *inode)
 {
 	return SHMEM_I(inode)->i_dquot;
 }
@@ -535,8 +535,9 @@
 
 static int shmem_huge __read_mostly = SHMEM_HUGE_NEVER;
 
-bool shmem_is_huge(struct inode *inode, pgoff_t index, bool shmem_huge_force,
-		   struct mm_struct *mm, unsigned long vm_flags)
+static bool __shmem_is_huge(struct inode *inode, pgoff_t index,
+			    bool shmem_huge_force, struct mm_struct *mm,
+			    unsigned long vm_flags)
 {
 	loff_t i_size;
 
@@ -567,6 +568,16 @@
 	}
 }
 
+bool shmem_is_huge(struct inode *inode, pgoff_t index,
+		   bool shmem_huge_force, struct mm_struct *mm,
+		   unsigned long vm_flags)
+{
+	if (HPAGE_PMD_ORDER > MAX_PAGECACHE_ORDER)
+		return false;
+
+	return __shmem_is_huge(inode, index, shmem_huge_force, mm, vm_flags);
+}
+
 #if defined(CONFIG_SYSFS)
 static int shmem_parse_huge(const char *str)
 {
@@ -742,12 +753,6 @@
 
 #define shmem_huge SHMEM_HUGE_DENY
 
-bool shmem_is_huge(struct inode *inode, pgoff_t index, bool shmem_huge_force,
-		   struct mm_struct *mm, unsigned long vm_flags)
-{
-	return false;
-}
-
 static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
 		struct shrink_control *sc, unsigned long nr_to_split)
 {
@@ -1786,7 +1791,7 @@
 	xa_lock_irq(&swap_mapping->i_pages);
 	error = shmem_replace_entry(swap_mapping, swap_index, old, new);
 	if (!error) {
-		mem_cgroup_migrate(old, new);
+		mem_cgroup_replace_folio(old, new);
 		__lruvec_stat_mod_folio(new, NR_FILE_PAGES, 1);
 		__lruvec_stat_mod_folio(new, NR_SHMEM, 1);
 		__lruvec_stat_mod_folio(old, NR_FILE_PAGES, -1);
@@ -2407,9 +2412,6 @@
 	if (ret)
 		return ret;
 
-	/* arm64 - allow memory tagging on RAM-based files */
-	vm_flags_set(vma, VM_MTE_ALLOWED);
-
 	file_accessed(file);
 	/* This is anonymous shared memory if it is unlinked at the time of mmap */
 	if (inode->i_nlink)
@@ -3440,8 +3442,7 @@
 			return error;
 	}
 
-	simple_offset_remove(shmem_get_offset_ctx(old_dir), old_dentry);
-	error = simple_offset_add(shmem_get_offset_ctx(new_dir), old_dentry);
+	error = simple_offset_rename(old_dir, old_dentry, new_dir, new_dentry);
 	if (error)
 		return error;
 
--- linux-qcom-6.8.0.orig/mm/shmem_quota.c
+++ linux-qcom-6.8.0/mm/shmem_quota.c
@@ -116,7 +116,7 @@
 static int shmem_get_next_id(struct super_block *sb, struct kqid *qid)
 {
 	struct mem_dqinfo *info = sb_dqinfo(sb, qid->type);
-	struct rb_node *node = ((struct rb_root *)info->dqi_priv)->rb_node;
+	struct rb_node *node;
 	qid_t id = from_kqid(&init_user_ns, *qid);
 	struct quota_info *dqopt = sb_dqopt(sb);
 	struct quota_id *entry = NULL;
@@ -126,6 +126,7 @@
 		return -ESRCH;
 
 	down_read(&dqopt->dqio_sem);
+	node = ((struct rb_root *)info->dqi_priv)->rb_node;
 	while (node) {
 		entry = rb_entry(node, struct quota_id, node);
 
@@ -165,7 +166,7 @@
 static int shmem_acquire_dquot(struct dquot *dquot)
 {
 	struct mem_dqinfo *info = sb_dqinfo(dquot->dq_sb, dquot->dq_id.type);
-	struct rb_node **n = &((struct rb_root *)info->dqi_priv)->rb_node;
+	struct rb_node **n;
 	struct shmem_sb_info *sbinfo = dquot->dq_sb->s_fs_info;
 	struct rb_node *parent = NULL, *new_node = NULL;
 	struct quota_id *new_entry, *entry;
@@ -176,6 +177,8 @@
 	mutex_lock(&dquot->dq_lock);
 
 	down_write(&dqopt->dqio_sem);
+	n = &((struct rb_root *)info->dqi_priv)->rb_node;
+
 	while (*n) {
 		parent = *n;
 		entry = rb_entry(parent, struct quota_id, node);
@@ -264,7 +267,7 @@
 static int shmem_release_dquot(struct dquot *dquot)
 {
 	struct mem_dqinfo *info = sb_dqinfo(dquot->dq_sb, dquot->dq_id.type);
-	struct rb_node *node = ((struct rb_root *)info->dqi_priv)->rb_node;
+	struct rb_node *node;
 	qid_t id = from_kqid(&init_user_ns, dquot->dq_id);
 	struct quota_info *dqopt = sb_dqopt(dquot->dq_sb);
 	struct quota_id *entry = NULL;
@@ -275,6 +278,7 @@
 		goto out_dqlock;
 
 	down_write(&dqopt->dqio_sem);
+	node = ((struct rb_root *)info->dqi_priv)->rb_node;
 	while (node) {
 		entry = rb_entry(node, struct quota_id, node);
 
--- linux-qcom-6.8.0.orig/mm/shrinker.c
+++ linux-qcom-6.8.0/mm/shrinker.c
@@ -76,19 +76,21 @@
 
 int alloc_shrinker_info(struct mem_cgroup *memcg)
 {
-	struct shrinker_info *info;
 	int nid, ret = 0;
 	int array_size = 0;
 
 	mutex_lock(&shrinker_mutex);
 	array_size = shrinker_unit_size(shrinker_nr_max);
 	for_each_node(nid) {
-		info = kvzalloc_node(sizeof(*info) + array_size, GFP_KERNEL, nid);
+		struct shrinker_info *info = kvzalloc_node(sizeof(*info) + array_size,
+							   GFP_KERNEL, nid);
 		if (!info)
 			goto err;
 		info->map_nr_max = shrinker_nr_max;
-		if (shrinker_unit_alloc(info, NULL, nid))
+		if (shrinker_unit_alloc(info, NULL, nid)) {
+			kvfree(info);
 			goto err;
+		}
 		rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, info);
 	}
 	mutex_unlock(&shrinker_mutex);
--- linux-qcom-6.8.0.orig/mm/slab.h
+++ linux-qcom-6.8.0/mm/slab.h
@@ -73,6 +73,11 @@
 						struct {
 							unsigned inuse:16;
 							unsigned objects:15;
+							/*
+							 * If slab debugging is enabled then the
+							 * frozen bit can be reused to indicate
+							 * that the slab was corrupted
+							 */
 							unsigned frozen:1;
 						};
 					};
--- linux-qcom-6.8.0.orig/mm/slab_common.c
+++ linux-qcom-6.8.0/mm/slab_common.c
@@ -1180,6 +1180,13 @@
 
 	/* If the object still fits, repoison it precisely. */
 	if (ks >= new_size) {
+		/* Zero out spare memory. */
+		if (want_init_on_alloc(flags)) {
+			kasan_disable_current();
+			memset(kasan_reset_tag(p) + new_size, 0, ks - new_size);
+			kasan_enable_current();
+		}
+
 		p = kasan_krealloc((void *)p, new_size, flags);
 		return (void *)p;
 	}
--- linux-qcom-6.8.0.orig/mm/slub.c
+++ linux-qcom-6.8.0/mm/slub.c
@@ -557,6 +557,26 @@
 	*(freeptr_t *)freeptr_addr = freelist_ptr_encode(s, fp, freeptr_addr);
 }
 
+/*
+ * See comment in calculate_sizes().
+ */
+static inline bool freeptr_outside_object(struct kmem_cache *s)
+{
+	return s->offset >= s->inuse;
+}
+
+/*
+ * Return offset of the end of info block which is inuse + free pointer if
+ * not overlapping with object.
+ */
+static inline unsigned int get_info_end(struct kmem_cache *s)
+{
+	if (freeptr_outside_object(s))
+		return s->inuse + sizeof(void *);
+	else
+		return s->inuse;
+}
+
 /* Loop over all objects in a slab */
 #define for_each_object(__p, __s, __addr, __objects) \
 	for (__p = fixup_red_left(__s, __addr); \
@@ -732,6 +752,50 @@
 	return false;
 }
 
+/*
+ * kmalloc caches has fixed sizes (mostly power of 2), and kmalloc() API
+ * family will round up the real request size to these fixed ones, so
+ * there could be an extra area than what is requested. Save the original
+ * request size in the meta data area, for better debug and sanity check.
+ */
+static inline void set_orig_size(struct kmem_cache *s,
+				void *object, unsigned int orig_size)
+{
+	void *p = kasan_reset_tag(object);
+	unsigned int kasan_meta_size;
+
+	if (!slub_debug_orig_size(s))
+		return;
+
+	/*
+	 * KASAN can save its free meta data inside of the object at offset 0.
+	 * If this meta data size is larger than 'orig_size', it will overlap
+	 * the data redzone in [orig_size+1, object_size]. Thus, we adjust
+	 * 'orig_size' to be as at least as big as KASAN's meta data.
+	 */
+	kasan_meta_size = kasan_metadata_size(s, true);
+	if (kasan_meta_size > orig_size)
+		orig_size = kasan_meta_size;
+
+	p += get_info_end(s);
+	p += sizeof(struct track) * 2;
+
+	*(unsigned int *)p = orig_size;
+}
+
+static inline unsigned int get_orig_size(struct kmem_cache *s, void *object)
+{
+	void *p = kasan_reset_tag(object);
+
+	if (!slub_debug_orig_size(s))
+		return s->object_size;
+
+	p += get_info_end(s);
+	p += sizeof(struct track) * 2;
+
+	return *(unsigned int *)p;
+}
+
 #ifdef CONFIG_SLUB_DEBUG
 static unsigned long object_map[BITS_TO_LONGS(MAX_OBJS_PER_PAGE)];
 static DEFINE_SPINLOCK(object_map_lock);
@@ -845,26 +909,6 @@
 	metadata_access_disable();
 }
 
-/*
- * See comment in calculate_sizes().
- */
-static inline bool freeptr_outside_object(struct kmem_cache *s)
-{
-	return s->offset >= s->inuse;
-}
-
-/*
- * Return offset of the end of info block which is inuse + free pointer if
- * not overlapping with object.
- */
-static inline unsigned int get_info_end(struct kmem_cache *s)
-{
-	if (freeptr_outside_object(s))
-		return s->inuse + sizeof(void *);
-	else
-		return s->inuse;
-}
-
 static struct track *get_track(struct kmem_cache *s, void *object,
 	enum track_item alloc)
 {
@@ -965,50 +1009,6 @@
 	       folio_flags(folio, 0));
 }
 
-/*
- * kmalloc caches has fixed sizes (mostly power of 2), and kmalloc() API
- * family will round up the real request size to these fixed ones, so
- * there could be an extra area than what is requested. Save the original
- * request size in the meta data area, for better debug and sanity check.
- */
-static inline void set_orig_size(struct kmem_cache *s,
-				void *object, unsigned int orig_size)
-{
-	void *p = kasan_reset_tag(object);
-	unsigned int kasan_meta_size;
-
-	if (!slub_debug_orig_size(s))
-		return;
-
-	/*
-	 * KASAN can save its free meta data inside of the object at offset 0.
-	 * If this meta data size is larger than 'orig_size', it will overlap
-	 * the data redzone in [orig_size+1, object_size]. Thus, we adjust
-	 * 'orig_size' to be as at least as big as KASAN's meta data.
-	 */
-	kasan_meta_size = kasan_metadata_size(s, true);
-	if (kasan_meta_size > orig_size)
-		orig_size = kasan_meta_size;
-
-	p += get_info_end(s);
-	p += sizeof(struct track) * 2;
-
-	*(unsigned int *)p = orig_size;
-}
-
-static inline unsigned int get_orig_size(struct kmem_cache *s, void *object)
-{
-	void *p = kasan_reset_tag(object);
-
-	if (!slub_debug_orig_size(s))
-		return s->object_size;
-
-	p += get_info_end(s);
-	p += sizeof(struct track) * 2;
-
-	return *(unsigned int *)p;
-}
-
 void skip_orig_size_check(struct kmem_cache *s, const void *object)
 {
 	set_orig_size(s, (void *)object, s->object_size);
@@ -1391,6 +1391,11 @@
 			slab->inuse, slab->objects);
 		return 0;
 	}
+	if (slab->frozen) {
+		slab_err(s, slab, "Slab disabled since SLUB metadata consistency check failed");
+		return 0;
+	}
+
 	/* Slab_pad_check fixes things up after itself */
 	slab_pad_check(s, slab);
 	return 1;
@@ -1579,6 +1584,7 @@
 		slab_fix(s, "Marking all objects used");
 		slab->inuse = slab->objects;
 		slab->freelist = NULL;
+		slab->frozen = 1; /* mark consistency-failed slab as frozen */
 	}
 	return false;
 }
@@ -1865,7 +1871,6 @@
 							int objects) {}
 static inline void dec_slabs_node(struct kmem_cache *s, int node,
 							int objects) {}
-
 #ifndef CONFIG_SLUB_TINY
 static bool freelist_corrupted(struct kmem_cache *s, struct slab *slab,
 			       void **freelist, void *nextfree)
@@ -2107,15 +2112,27 @@
 	 *
 	 * The initialization memset's clear the object and the metadata,
 	 * but don't touch the SLAB redzone.
+	 *
+	 * The object's freepointer is also avoided if stored outside the
+	 * object.
 	 */
 	if (unlikely(init)) {
 		int rsize;
+		unsigned int inuse, orig_size;
 
+		inuse = get_info_end(s);
+		orig_size = get_orig_size(s, x);
 		if (!kasan_has_integrated_init())
-			memset(kasan_reset_tag(x), 0, s->object_size);
+			memset(kasan_reset_tag(x), 0, orig_size);
 		rsize = (s->flags & SLAB_RED_ZONE) ? s->red_left_pad : 0;
-		memset((char *)kasan_reset_tag(x) + s->inuse, 0,
-		       s->size - s->inuse - rsize);
+		memset((char *)kasan_reset_tag(x) + inuse, 0,
+		       s->size - inuse - rsize);
+		/*
+		 * Restore orig_size, otherwize kmalloc redzone overwritten
+		 * would be reported
+		 */
+		set_orig_size(s, x, orig_size);
+
 	}
 	/* KASAN might put x into memory quarantine, delaying its reuse. */
 	return !kasan_slab_free(s, x, init);
@@ -2520,7 +2537,8 @@
 	slab->inuse++;
 
 	if (!alloc_debug_processing(s, slab, object, orig_size)) {
-		remove_partial(n, slab);
+		if (folio_test_slab(slab_folio(slab)))
+			remove_partial(n, slab);
 		return NULL;
 	}
 
@@ -3737,7 +3755,8 @@
 static __always_inline void maybe_wipe_obj_freeptr(struct kmem_cache *s,
 						   void *obj)
 {
-	if (unlikely(slab_want_init_on_free(s)) && obj)
+	if (unlikely(slab_want_init_on_free(s)) && obj &&
+	    !freeptr_outside_object(s))
 		memset((void *)((char *)kasan_reset_tag(obj) + s->offset),
 			0, sizeof(void *));
 }
@@ -4505,6 +4524,9 @@
 		if (!df.slab)
 			continue;
 
+		if (kfence_free(df.freelist))
+			continue;
+
 		do_slab_free(df.s, df.slab, df.freelist, df.tail, df.cnt,
 			     _RET_IP_);
 	} while (likely(size));
--- linux-qcom-6.8.0.orig/mm/sparse.c
+++ linux-qcom-6.8.0/mm/sparse.c
@@ -129,7 +129,7 @@
 static void __meminit mminit_validate_memmodel_limits(unsigned long *start_pfn,
 						unsigned long *end_pfn)
 {
-	unsigned long max_sparsemem_pfn = 1UL << (MAX_PHYSMEM_BITS-PAGE_SHIFT);
+	unsigned long max_sparsemem_pfn = (PHYSMEM_END + 1) >> PAGE_SHIFT;
 
 	/*
 	 * Sanity checks - do not allow an architecture to pass
@@ -908,7 +908,8 @@
 	 * Poison uninitialized struct pages in order to catch invalid flags
 	 * combinations.
 	 */
-	page_init_poison(memmap, sizeof(struct page) * nr_pages);
+	if (!altmap || !altmap->inaccessible)
+		page_init_poison(memmap, sizeof(struct page) * nr_pages);
 
 	ms = __nr_to_section(section_nr);
 	set_section_nid(section_nr, nid);
--- linux-qcom-6.8.0.orig/mm/swap.c
+++ linux-qcom-6.8.0/mm/swap.c
@@ -89,14 +89,6 @@
 		__folio_clear_lru_flags(folio);
 		unlock_page_lruvec_irqrestore(lruvec, flags);
 	}
-	/* See comment on folio_test_mlocked in release_pages() */
-	if (unlikely(folio_test_mlocked(folio))) {
-		long nr_pages = folio_nr_pages(folio);
-
-		__folio_clear_mlocked(folio);
-		zone_stat_mod_folio(folio, NR_MLOCK, -nr_pages);
-		count_vm_events(UNEVICTABLE_PGCLEARED, nr_pages);
-	}
 }
 
 static void __folio_put_small(struct folio *folio)
@@ -1021,18 +1013,6 @@
 			__folio_clear_lru_flags(folio);
 		}
 
-		/*
-		 * In rare cases, when truncation or holepunching raced with
-		 * munlock after VM_LOCKED was cleared, Mlocked may still be
-		 * found set here.  This does not indicate a problem, unless
-		 * "unevictable_pgs_cleared" appears worryingly large.
-		 */
-		if (unlikely(folio_test_mlocked(folio))) {
-			__folio_clear_mlocked(folio);
-			zone_stat_sub_folio(folio, NR_MLOCK);
-			count_vm_event(UNEVICTABLE_PGCLEARED);
-		}
-
 		list_add(&folio->lru, &pages_to_free);
 	}
 	if (lruvec)
--- linux-qcom-6.8.0.orig/mm/swapfile.c
+++ linux-qcom-6.8.0/mm/swapfile.c
@@ -1227,6 +1227,11 @@
  * with get_swap_device() and put_swap_device(), unless the swap
  * functions call get/put_swap_device() by themselves.
  *
+ * Note that when only holding the PTL, swapoff might succeed immediately
+ * after freeing a swap entry. Therefore, immediately after
+ * __swap_entry_free(), the swap info might become stale and should not
+ * be touched without a prior get_swap_device().
+ *
  * Check whether swap entry is valid in the swap device.  If so,
  * return pointer to swap_info_struct, and keep the swap entry valid
  * via preventing the swap device from being swapoff, until
@@ -1604,13 +1609,19 @@
 	if (non_swap_entry(entry))
 		return 1;
 
-	p = _swap_info_get(entry);
+	p = get_swap_device(entry);
 	if (p) {
+		if (WARN_ON(data_race(!p->swap_map[swp_offset(entry)]))) {
+			put_swap_device(p);
+			return 0;
+		}
+
 		count = __swap_entry_free(p, entry);
 		if (count == SWAP_HAS_CACHE &&
 		    !swap_page_trans_huge_swapped(p, entry))
 			__try_to_reclaim_swap(p, swp_offset(entry),
 					      TTRS_UNMAPPED | TTRS_FULL);
+		put_swap_device(p);
 	}
 	return p != NULL;
 }
@@ -1994,7 +2005,7 @@
 
 	mmap_read_lock(mm);
 	for_each_vma(vmi, vma) {
-		if (vma->anon_vma) {
+		if (vma->anon_vma && !is_vm_hugetlb_page(vma)) {
 			ret = unuse_vma(vma, type);
 			if (ret)
 				break;
--- linux-qcom-6.8.0.orig/mm/truncate.c
+++ linux-qcom-6.8.0/mm/truncate.c
@@ -174,7 +174,7 @@
 	if (folio_mapped(folio))
 		unmap_mapping_folio(folio);
 
-	if (folio_has_private(folio))
+	if (folio_needs_release(folio))
 		folio_invalidate(folio, 0, folio_size(folio));
 
 	/*
@@ -235,7 +235,7 @@
 	 */
 	folio_zero_range(folio, offset, length);
 
-	if (folio_has_private(folio))
+	if (folio_needs_release(folio))
 		folio_invalidate(folio, offset, length);
 	if (!folio_test_large(folio))
 		return true;
--- linux-qcom-6.8.0.orig/mm/userfaultfd.c
+++ linux-qcom-6.8.0/mm/userfaultfd.c
@@ -213,6 +213,38 @@
 	goto out;
 }
 
+static int mfill_atomic_pte_zeroed_folio(pmd_t *dst_pmd,
+					 struct vm_area_struct *dst_vma,
+					 unsigned long dst_addr)
+{
+	struct folio *folio;
+	int ret = -ENOMEM;
+
+	folio = vma_alloc_zeroed_movable_folio(dst_vma, dst_addr);
+	if (!folio)
+		return ret;
+
+	if (mem_cgroup_charge(folio, dst_vma->vm_mm, GFP_KERNEL))
+		goto out_put;
+
+	/*
+	 * The memory barrier inside __folio_mark_uptodate makes sure that
+	 * zeroing out the folio become visible before mapping the page
+	 * using set_pte_at(). See do_anonymous_page().
+	 */
+	__folio_mark_uptodate(folio);
+
+	ret = mfill_atomic_install_pte(dst_pmd, dst_vma, dst_addr,
+				       &folio->page, true, 0);
+	if (ret)
+		goto out_put;
+
+	return 0;
+out_put:
+	folio_put(folio);
+	return ret;
+}
+
 static int mfill_atomic_pte_zeropage(pmd_t *dst_pmd,
 				     struct vm_area_struct *dst_vma,
 				     unsigned long dst_addr)
@@ -221,6 +253,9 @@
 	spinlock_t *ptl;
 	int ret;
 
+	if (mm_forbids_zeropage(dst_vma->vm_mm))
+		return mfill_atomic_pte_zeroed_folio(dst_pmd, dst_vma, dst_addr);
+
 	_dst_pte = pte_mkspecial(pfn_pte(my_zero_pfn(dst_addr),
 					 dst_vma->vm_page_prot));
 	ret = -EAGAIN;
@@ -664,27 +699,30 @@
 		}
 
 		dst_pmdval = pmdp_get_lockless(dst_pmd);
-		/*
-		 * If the dst_pmd is mapped as THP don't
-		 * override it and just be strict.
-		 */
-		if (unlikely(pmd_trans_huge(dst_pmdval))) {
-			err = -EEXIST;
-			break;
-		}
 		if (unlikely(pmd_none(dst_pmdval)) &&
 		    unlikely(__pte_alloc(dst_mm, dst_pmd))) {
 			err = -ENOMEM;
 			break;
 		}
-		/* If an huge pmd materialized from under us fail */
-		if (unlikely(pmd_trans_huge(*dst_pmd))) {
+		dst_pmdval = pmdp_get_lockless(dst_pmd);
+		/*
+		 * If the dst_pmd is THP don't override it and just be strict.
+		 * (This includes the case where the PMD used to be THP and
+		 * changed back to none after __pte_alloc().)
+		 */
+		if (unlikely(!pmd_present(dst_pmdval) || pmd_trans_huge(dst_pmdval) ||
+			     pmd_devmap(dst_pmdval))) {
+			err = -EEXIST;
+			break;
+		}
+		if (unlikely(pmd_bad(dst_pmdval))) {
 			err = -EFAULT;
 			break;
 		}
-
-		BUG_ON(pmd_none(*dst_pmd));
-		BUG_ON(pmd_trans_huge(*dst_pmd));
+		/*
+		 * For shmem mappings, khugepaged is allowed to remove page
+		 * tables under us; pte_offset_map_lock() will deal with that.
+		 */
 
 		err = mfill_atomic_pte(dst_pmd, dst_vma, dst_addr,
 				       src_addr, flags, &folio);
--- linux-qcom-6.8.0.orig/mm/util.c
+++ linux-qcom-6.8.0/mm/util.c
@@ -434,7 +434,7 @@
 	if (gap + pad > gap)
 		gap += pad;
 
-	if (gap < MIN_GAP)
+	if (gap < MIN_GAP && MIN_GAP < MAX_GAP)
 		gap = MIN_GAP;
 	else if (gap > MAX_GAP)
 		gap = MAX_GAP;
--- linux-qcom-6.8.0.orig/mm/vmalloc.c
+++ linux-qcom-6.8.0/mm/vmalloc.c
@@ -1939,6 +1939,7 @@
 	struct list_head free_list;
 	struct rcu_head rcu_head;
 	struct list_head purge;
+	unsigned int cpu;
 };
 
 /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */
@@ -1983,7 +1984,15 @@
 static struct xarray *
 addr_to_vb_xa(unsigned long addr)
 {
-	int index = (addr / VMAP_BLOCK_SIZE) % num_possible_cpus();
+	int index = (addr / VMAP_BLOCK_SIZE) % nr_cpu_ids;
+
+	/*
+	 * Please note, nr_cpu_ids points on a highest set
+	 * possible bit, i.e. we never invoke cpumask_next()
+	 * if an index points on it which is nr_cpu_ids - 1.
+	 */
+	if (!cpu_possible(index))
+		index = cpumask_next(index, cpu_possible_mask);
 
 	return &per_cpu(vmap_block_queue, index).vmap_blocks;
 }
@@ -2057,6 +2066,7 @@
 	vb->dirty_max = 0;
 	bitmap_set(vb->used_map, 0, (1UL << order));
 	INIT_LIST_HEAD(&vb->free_list);
+	vb->cpu = raw_smp_processor_id();
 
 	xa = addr_to_vb_xa(va->va_start);
 	vb_idx = addr_to_vb_idx(va->va_start);
@@ -2066,8 +2076,14 @@
 		free_vmap_area(va);
 		return ERR_PTR(err);
 	}
-
-	vbq = raw_cpu_ptr(&vmap_block_queue);
+	/*
+	 * list_add_tail_rcu could happened in another core
+	 * rather than vb->cpu due to task migration, which
+	 * is safe as list_add_tail_rcu will ensure the list's
+	 * integrity together with list_for_each_rcu from read
+	 * side.
+	 */
+	vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu);
 	spin_lock(&vbq->lock);
 	list_add_tail_rcu(&vb->free_list, &vbq->free);
 	spin_unlock(&vbq->lock);
@@ -2093,9 +2109,10 @@
 }
 
 static bool purge_fragmented_block(struct vmap_block *vb,
-		struct vmap_block_queue *vbq, struct list_head *purge_list,
-		bool force_purge)
+		struct list_head *purge_list, bool force_purge)
 {
+	struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu);
+
 	if (vb->free + vb->dirty != VMAP_BBMAP_BITS ||
 	    vb->dirty == VMAP_BBMAP_BITS)
 		return false;
@@ -2143,7 +2160,7 @@
 			continue;
 
 		spin_lock(&vb->lock);
-		purge_fragmented_block(vb, vbq, &purge, true);
+		purge_fragmented_block(vb, &purge, true);
 		spin_unlock(&vb->lock);
 	}
 	rcu_read_unlock();
@@ -2280,7 +2297,7 @@
 			 * not purgeable, check whether there is dirty
 			 * space to be flushed.
 			 */
-			if (!purge_fragmented_block(vb, vbq, &purge_list, false) &&
+			if (!purge_fragmented_block(vb, &purge_list, false) &&
 			    vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) {
 				unsigned long va_start = vb->va->va_start;
 				unsigned long s, e;
@@ -2641,6 +2658,7 @@
 				  NUMA_NO_NODE, GFP_KERNEL,
 				  __builtin_return_address(0));
 }
+EXPORT_SYMBOL(get_vm_area);
 
 struct vm_struct *get_vm_area_caller(unsigned long size, unsigned long flags,
 				const void *caller)
@@ -2834,7 +2852,8 @@
 		struct page *page = vm->pages[i];
 
 		BUG_ON(!page);
-		mod_memcg_page_state(page, MEMCG_VMALLOC, -1);
+		if (!(vm->flags & VM_MAP_PUT_PAGES))
+			mod_memcg_page_state(page, MEMCG_VMALLOC, -1);
 		/*
 		 * High-order allocs for huge vmallocs are split, so
 		 * can be freed as an array of order-0 allocations
@@ -2842,7 +2861,8 @@
 		__free_page(page);
 		cond_resched();
 	}
-	atomic_long_sub(vm->nr_pages, &nr_vmalloc_pages);
+	if (!(vm->flags & VM_MAP_PUT_PAGES))
+		atomic_long_sub(vm->nr_pages, &nr_vmalloc_pages);
 	kvfree(vm->pages);
 	kfree(vm);
 }
@@ -2994,7 +3014,7 @@
 {
 	unsigned int nr_allocated = 0;
 	gfp_t alloc_gfp = gfp;
-	bool nofail = false;
+	bool nofail = gfp & __GFP_NOFAIL;
 	struct page *page;
 	int i;
 
@@ -3051,27 +3071,19 @@
 		 * and compaction etc.
 		 */
 		alloc_gfp &= ~__GFP_NOFAIL;
-		nofail = true;
 	}
 
 	/* High-order pages or fallback path if "bulk" fails. */
 	while (nr_allocated < nr_pages) {
-		if (fatal_signal_pending(current))
+		if (!nofail && fatal_signal_pending(current))
 			break;
 
 		if (nid == NUMA_NO_NODE)
 			page = alloc_pages(alloc_gfp, order);
 		else
 			page = alloc_pages_node(nid, alloc_gfp, order);
-		if (unlikely(!page)) {
-			if (!nofail)
-				break;
-
-			/* fall back to the zero order allocations */
-			alloc_gfp |= __GFP_NOFAIL;
-			order = 0;
-			continue;
-		}
+		if (unlikely(!page))
+			break;
 
 		/*
 		 * Higher order allocations must be able to be treated as
--- linux-qcom-6.8.0.orig/mm/vmscan.c
+++ linux-qcom-6.8.0/mm/vmscan.c
@@ -56,6 +56,7 @@
 #include <linux/khugepaged.h>
 #include <linux/rculist_nulls.h>
 #include <linux/random.h>
+#include <linux/mmu_notifier.h>
 
 #include <asm/tlbflush.h>
 #include <asm/div64.h>
@@ -347,7 +348,14 @@
 	if (can_reclaim_anon_pages(NULL, zone_to_nid(zone), NULL))
 		nr += zone_page_state_snapshot(zone, NR_ZONE_INACTIVE_ANON) +
 			zone_page_state_snapshot(zone, NR_ZONE_ACTIVE_ANON);
-
+	/*
+	 * If there are no reclaimable file-backed or anonymous pages,
+	 * ensure zones with sufficient free pages are not skipped.
+	 * This prevents zones like DMA32 from being ignored in reclaim
+	 * scenarios where they can still help alleviate memory pressure.
+	 */
+	if (nr == 0)
+		nr = zone_page_state_snapshot(zone, NR_FREE_PAGES);
 	return nr;
 }
 
@@ -837,7 +845,12 @@
 	if (vm_flags & VM_LOCKED)
 		return FOLIOREF_ACTIVATE;
 
-	/* rmap lock contention: rotate */
+	/*
+	 * There are two cases to consider.
+	 * 1) Rmap lock contention: rotate.
+	 * 2) Skip the non-shared swapbacked folio mapped solely by
+	 *    the exiting or OOM-reaped process.
+	 */
 	if (referenced_ptes == -1)
 		return FOLIOREF_KEEP;
 
@@ -1249,6 +1262,20 @@
 
 			if (folio_test_pmd_mappable(folio))
 				flags |= TTU_SPLIT_HUGE_PMD;
+			/*
+			 * Without TTU_SYNC, try_to_unmap will only begin to
+			 * hold PTL from the first present PTE within a large
+			 * folio. Some initial PTEs might be skipped due to
+			 * races with parallel PTE writes in which PTEs can be
+			 * cleared temporarily before being written new present
+			 * values. This will lead to a large folio is still
+			 * mapped while some subpages have been partially
+			 * unmapped after try_to_unmap; TTU_SYNC helps
+			 * try_to_unmap acquire PTL from the first PTE,
+			 * eliminating the influence of temporary PTE values.
+			 */
+			if (folio_test_large(folio) && list_empty(&folio->_deferred_list))
+				flags |= TTU_SYNC;
 
 			try_to_unmap(folio, flags);
 			if (folio_mapped(folio)) {
@@ -1562,25 +1589,6 @@
 
 }
 
-#ifdef CONFIG_CMA
-/*
- * It is waste of effort to scan and reclaim CMA pages if it is not available
- * for current allocation context. Kswapd can not be enrolled as it can not
- * distinguish this scenario by using sc->gfp_mask = GFP_KERNEL
- */
-static bool skip_cma(struct folio *folio, struct scan_control *sc)
-{
-	return !current_is_kswapd() &&
-			gfp_migratetype(sc->gfp_mask) != MIGRATE_MOVABLE &&
-			folio_migratetype(folio) == MIGRATE_CMA;
-}
-#else
-static bool skip_cma(struct folio *folio, struct scan_control *sc)
-{
-	return false;
-}
-#endif
-
 /*
  * Isolating page from the lruvec to fill in @dst list by nr_to_scan times.
  *
@@ -1627,8 +1635,7 @@
 		nr_pages = folio_nr_pages(folio);
 		total_scan += nr_pages;
 
-		if (folio_zonenum(folio) > sc->reclaim_idx ||
-				skip_cma(folio, sc)) {
+		if (folio_zonenum(folio) > sc->reclaim_idx) {
 			nr_skipped[folio_zonenum(folio)] += nr_pages;
 			move_to = &folios_skipped;
 			goto move;
@@ -3252,7 +3259,8 @@
 	return false;
 }
 
-static unsigned long get_pte_pfn(pte_t pte, struct vm_area_struct *vma, unsigned long addr)
+static unsigned long get_pte_pfn(pte_t pte, struct vm_area_struct *vma, unsigned long addr,
+				 struct pglist_data *pgdat)
 {
 	unsigned long pfn = pte_pfn(pte);
 
@@ -3264,13 +3272,20 @@
 	if (WARN_ON_ONCE(pte_devmap(pte) || pte_special(pte)))
 		return -1;
 
+	if (!pte_young(pte) && !mm_has_notifiers(vma->vm_mm))
+		return -1;
+
 	if (WARN_ON_ONCE(!pfn_valid(pfn)))
 		return -1;
 
+	if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat))
+		return -1;
+
 	return pfn;
 }
 
-static unsigned long get_pmd_pfn(pmd_t pmd, struct vm_area_struct *vma, unsigned long addr)
+static unsigned long get_pmd_pfn(pmd_t pmd, struct vm_area_struct *vma, unsigned long addr,
+				 struct pglist_data *pgdat)
 {
 	unsigned long pfn = pmd_pfn(pmd);
 
@@ -3282,9 +3297,15 @@
 	if (WARN_ON_ONCE(pmd_devmap(pmd)))
 		return -1;
 
+	if (!pmd_young(pmd) && !mm_has_notifiers(vma->vm_mm))
+		return -1;
+
 	if (WARN_ON_ONCE(!pfn_valid(pfn)))
 		return -1;
 
+	if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat))
+		return -1;
+
 	return pfn;
 }
 
@@ -3293,10 +3314,6 @@
 {
 	struct folio *folio;
 
-	/* try to avoid unnecessary memory loads */
-	if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat))
-		return NULL;
-
 	folio = pfn_folio(pfn);
 	if (folio_nid(folio) != pgdat->node_id)
 		return NULL;
@@ -3351,21 +3368,16 @@
 		total++;
 		walk->mm_stats[MM_LEAF_TOTAL]++;
 
-		pfn = get_pte_pfn(ptent, args->vma, addr);
+		pfn = get_pte_pfn(ptent, args->vma, addr, pgdat);
 		if (pfn == -1)
 			continue;
 
-		if (!pte_young(ptent)) {
-			walk->mm_stats[MM_LEAF_OLD]++;
-			continue;
-		}
-
 		folio = get_pfn_folio(pfn, memcg, pgdat, walk->can_swap);
 		if (!folio)
 			continue;
 
-		if (!ptep_test_and_clear_young(args->vma, addr, pte + i))
-			VM_WARN_ON_ONCE(true);
+		if (!ptep_clear_young_notify(args->vma, addr, pte + i))
+			continue;
 
 		young++;
 		walk->mm_stats[MM_LEAF_YOUNG]++;
@@ -3430,21 +3442,25 @@
 		/* don't round down the first address */
 		addr = i ? (*first & PMD_MASK) + i * PMD_SIZE : *first;
 
-		pfn = get_pmd_pfn(pmd[i], vma, addr);
-		if (pfn == -1)
+		if (!pmd_present(pmd[i]))
 			goto next;
 
 		if (!pmd_trans_huge(pmd[i])) {
-			if (should_clear_pmd_young())
+			if (!walk->force_scan && should_clear_pmd_young() &&
+			    !mm_has_notifiers(args->mm))
 				pmdp_test_and_clear_young(vma, addr, pmd + i);
 			goto next;
 		}
 
+		pfn = get_pmd_pfn(pmd[i], vma, addr, pgdat);
+		if (pfn == -1)
+			goto next;
+
 		folio = get_pfn_folio(pfn, memcg, pgdat, walk->can_swap);
 		if (!folio)
 			goto next;
 
-		if (!pmdp_test_and_clear_young(vma, addr, pmd + i))
+		if (!pmdp_clear_young_notify(vma, addr, pmd + i))
 			goto next;
 
 		walk->mm_stats[MM_LEAF_YOUNG]++;
@@ -3502,27 +3518,18 @@
 		}
 
 		if (pmd_trans_huge(val)) {
-			unsigned long pfn = pmd_pfn(val);
 			struct pglist_data *pgdat = lruvec_pgdat(walk->lruvec);
+			unsigned long pfn = get_pmd_pfn(val, vma, addr, pgdat);
 
 			walk->mm_stats[MM_LEAF_TOTAL]++;
 
-			if (!pmd_young(val)) {
-				walk->mm_stats[MM_LEAF_OLD]++;
-				continue;
-			}
-
-			/* try to avoid unnecessary memory loads */
-			if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat))
-				continue;
-
-			walk_pmd_range_locked(pud, addr, vma, args, bitmap, &first);
+			if (pfn != -1)
+				walk_pmd_range_locked(pud, addr, vma, args, bitmap, &first);
 			continue;
 		}
 
-		walk->mm_stats[MM_NONLEAF_TOTAL]++;
-
-		if (should_clear_pmd_young()) {
+		if (!walk->force_scan && should_clear_pmd_young() &&
+		    !mm_has_notifiers(args->mm)) {
 			if (!pmd_young(val))
 				continue;
 
@@ -3873,6 +3880,32 @@
  *                          working set protection
  ******************************************************************************/
 
+static void set_initial_priority(struct pglist_data *pgdat, struct scan_control *sc)
+{
+	int priority;
+	unsigned long reclaimable;
+
+	if (sc->priority != DEF_PRIORITY || sc->nr_to_reclaim < MIN_LRU_BATCH)
+		return;
+	/*
+	 * Determine the initial priority based on
+	 * (total >> priority) * reclaimed_to_scanned_ratio = nr_to_reclaim,
+	 * where reclaimed_to_scanned_ratio = inactive / total.
+	 */
+	reclaimable = node_page_state(pgdat, NR_INACTIVE_FILE);
+	if (can_reclaim_anon_pages(NULL, pgdat->node_id, sc))
+		reclaimable += node_page_state(pgdat, NR_INACTIVE_ANON);
+
+	/* round down reclaimable and round up sc->nr_to_reclaim */
+	priority = fls_long(reclaimable) - 1 - fls_long(sc->nr_to_reclaim - 1);
+
+	/*
+	 * The estimation is based on LRU pages only, so cap it to prevent
+	 * overshoots of shrinker objects by large margins.
+	 */
+	sc->priority = clamp(priority, DEF_PRIORITY / 2, DEF_PRIORITY);
+}
+
 static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc)
 {
 	int gen, type, zone;
@@ -3906,19 +3939,17 @@
 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
 	DEFINE_MIN_SEQ(lruvec);
 
-	/* see the comment on lru_gen_folio */
-	gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]);
-	birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
-
-	if (time_is_after_jiffies(birth + min_ttl))
+	if (mem_cgroup_below_min(NULL, memcg))
 		return false;
 
 	if (!lruvec_is_sizable(lruvec, sc))
 		return false;
 
-	mem_cgroup_calculate_protection(NULL, memcg);
+	/* see the comment on lru_gen_folio */
+	gen = lru_gen_from_seq(min_seq[LRU_GEN_FILE]);
+	birth = READ_ONCE(lruvec->lrugen.timestamps[gen]);
 
-	return !mem_cgroup_below_min(NULL, memcg);
+	return time_is_before_jiffies(birth + min_ttl);
 }
 
 /* to protect the working set of the last N jiffies */
@@ -3928,23 +3959,20 @@
 {
 	struct mem_cgroup *memcg;
 	unsigned long min_ttl = READ_ONCE(lru_gen_min_ttl);
+	bool reclaimable = !min_ttl;
 
 	VM_WARN_ON_ONCE(!current_is_kswapd());
 
-	/* check the order to exclude compaction-induced reclaim */
-	if (!min_ttl || sc->order || sc->priority == DEF_PRIORITY)
-		return;
+	set_initial_priority(pgdat, sc);
 
 	memcg = mem_cgroup_iter(NULL, NULL, NULL);
 	do {
 		struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat);
 
-		if (lruvec_is_reclaimable(lruvec, sc, min_ttl)) {
-			mem_cgroup_iter_break(NULL, memcg);
-			return;
-		}
+		mem_cgroup_calculate_protection(NULL, memcg);
 
-		cond_resched();
+		if (!reclaimable)
+			reclaimable = lruvec_is_reclaimable(lruvec, sc, min_ttl);
 	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
 
 	/*
@@ -3952,7 +3980,7 @@
 	 * younger than min_ttl. However, another possibility is all memcgs are
 	 * either too small or below min.
 	 */
-	if (mutex_trylock(&oom_lock)) {
+	if (!reclaimable && mutex_trylock(&oom_lock)) {
 		struct oom_control oc = {
 			.gfp_mask = sc->gfp_mask,
 		};
@@ -3974,13 +4002,13 @@
  * the PTE table to the Bloom filter. This forms a feedback loop between the
  * eviction and the aging.
  */
-void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
+bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
 {
 	int i;
 	unsigned long start;
 	unsigned long end;
 	struct lru_gen_mm_walk *walk;
-	int young = 0;
+	int young = 1;
 	pte_t *pte = pvmw->pte;
 	unsigned long addr = pvmw->address;
 	struct vm_area_struct *vma = pvmw->vma;
@@ -3996,12 +4024,15 @@
 	lockdep_assert_held(pvmw->ptl);
 	VM_WARN_ON_ONCE_FOLIO(folio_test_lru(folio), folio);
 
+	if (!ptep_clear_young_notify(vma, addr, pte))
+		return false;
+
 	if (spin_is_contended(pvmw->ptl))
-		return;
+		return true;
 
 	/* exclude special VMAs containing anon pages from COW */
 	if (vma->vm_flags & VM_SPECIAL)
-		return;
+		return true;
 
 	/* avoid taking the LRU lock under the PTL when possible */
 	walk = current->reclaim_state ? current->reclaim_state->mm_walk : NULL;
@@ -4009,6 +4040,9 @@
 	start = max(addr & PMD_MASK, vma->vm_start);
 	end = min(addr | ~PMD_MASK, vma->vm_end - 1) + 1;
 
+	if (end - start == PAGE_SIZE)
+		return true;
+
 	if (end - start > MIN_LRU_BATCH * PAGE_SIZE) {
 		if (addr - start < MIN_LRU_BATCH * PAGE_SIZE / 2)
 			end = start + MIN_LRU_BATCH * PAGE_SIZE;
@@ -4022,7 +4056,7 @@
 
 	/* folio_update_gen() requires stable folio_memcg() */
 	if (!mem_cgroup_trylock_pages(memcg))
-		return;
+		return true;
 
 	arch_enter_lazy_mmu_mode();
 
@@ -4032,19 +4066,16 @@
 		unsigned long pfn;
 		pte_t ptent = ptep_get(pte + i);
 
-		pfn = get_pte_pfn(ptent, vma, addr);
+		pfn = get_pte_pfn(ptent, vma, addr, pgdat);
 		if (pfn == -1)
 			continue;
 
-		if (!pte_young(ptent))
-			continue;
-
 		folio = get_pfn_folio(pfn, memcg, pgdat, can_swap);
 		if (!folio)
 			continue;
 
-		if (!ptep_test_and_clear_young(vma, addr, pte + i))
-			VM_WARN_ON_ONCE(true);
+		if (!ptep_clear_young_notify(vma, addr, pte + i))
+			continue;
 
 		young++;
 
@@ -4074,6 +4105,8 @@
 	/* feedback from rmap walkers to page table walkers */
 	if (mm_state && suitable_to_scan(i, young))
 		update_bloom_filter(mm_state, max_seq, pvmw->pmd);
+
+	return true;
 }
 
 /******************************************************************************
@@ -4218,6 +4251,7 @@
 		       int tier_idx)
 {
 	bool success;
+	bool dirty, writeback;
 	int gen = folio_lru_gen(folio);
 	int type = folio_is_file_lru(folio);
 	int zone = folio_zonenum(folio);
@@ -4266,15 +4300,23 @@
 	}
 
 	/* ineligible */
-	if (zone > sc->reclaim_idx || skip_cma(folio, sc)) {
+	if (!folio_test_lru(folio) || zone > sc->reclaim_idx) {
 		gen = folio_inc_gen(lruvec, folio, false);
 		list_move_tail(&folio->lru, &lrugen->folios[gen][type][zone]);
 		return true;
 	}
 
+	dirty = folio_test_dirty(folio);
+	writeback = folio_test_writeback(folio);
+	if (type == LRU_GEN_FILE && dirty) {
+		sc->nr.file_taken += delta;
+		if (!writeback)
+			sc->nr.unqueued_dirty += delta;
+	}
+
 	/* waiting for writeback */
-	if (folio_test_locked(folio) || folio_test_writeback(folio) ||
-	    (type == LRU_GEN_FILE && folio_test_dirty(folio))) {
+	if (folio_test_locked(folio) || writeback ||
+	    (type == LRU_GEN_FILE && dirty)) {
 		gen = folio_inc_gen(lruvec, folio, true);
 		list_move(&folio->lru, &lrugen->folios[gen][type][zone]);
 		return true;
@@ -4390,7 +4432,8 @@
 	trace_mm_vmscan_lru_isolate(sc->reclaim_idx, sc->order, MAX_LRU_BATCH,
 				scanned, skipped, isolated,
 				type ? LRU_INACTIVE_FILE : LRU_INACTIVE_ANON);
-
+	if (type == LRU_GEN_FILE)
+		sc->nr.file_taken += isolated;
 	/*
 	 * There might not be eligible folios due to reclaim_idx. Check the
 	 * remaining to prevent livelock if it's not making progress.
@@ -4519,6 +4562,7 @@
 		return scanned;
 retry:
 	reclaimed = shrink_folio_list(&list, pgdat, sc, &stat, false);
+	sc->nr.unqueued_dirty += stat.nr_unqueued_dirty;
 	sc->nr_reclaimed += reclaimed;
 	trace_mm_vmscan_lru_shrink_inactive(pgdat->node_id,
 			scanned, reclaimed, &stat, sc->priority,
@@ -4550,7 +4594,6 @@
 
 		/* retry folios that may have missed folio_rotate_reclaimable() */
 		list_move(&folio->lru, &clean);
-		sc->nr_scanned -= folio_nr_pages(folio);
 	}
 
 	spin_lock_irq(&lruvec->lru_lock);
@@ -4737,6 +4780,13 @@
 		cond_resched();
 	}
 
+	/*
+	 * If too many file cache in the coldest generation can't be evicted
+	 * due to being dirty, wake up the flusher.
+	 */
+	if (sc->nr.unqueued_dirty && sc->nr.unqueued_dirty == sc->nr.file_taken)
+		wakeup_flusher_threads(WB_REASON_VMSCAN);
+
 	/* whether this lruvec should be rotated */
 	return nr_to_scan < 0;
 }
@@ -4749,8 +4799,7 @@
 	struct mem_cgroup *memcg = lruvec_memcg(lruvec);
 	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
 
-	mem_cgroup_calculate_protection(NULL, memcg);
-
+	/* lru_gen_age_node() called mem_cgroup_calculate_protection() */
 	if (mem_cgroup_below_min(NULL, memcg))
 		return MEMCG_LRU_YOUNG;
 
@@ -4874,29 +4923,6 @@
 	blk_finish_plug(&plug);
 }
 
-static void set_initial_priority(struct pglist_data *pgdat, struct scan_control *sc)
-{
-	int priority;
-	unsigned long reclaimable;
-	struct lruvec *lruvec = mem_cgroup_lruvec(NULL, pgdat);
-
-	if (sc->priority != DEF_PRIORITY || sc->nr_to_reclaim < MIN_LRU_BATCH)
-		return;
-	/*
-	 * Determine the initial priority based on
-	 * (total >> priority) * reclaimed_to_scanned_ratio = nr_to_reclaim,
-	 * where reclaimed_to_scanned_ratio = inactive / total.
-	 */
-	reclaimable = node_page_state(pgdat, NR_INACTIVE_FILE);
-	if (get_swappiness(lruvec, sc))
-		reclaimable += node_page_state(pgdat, NR_INACTIVE_ANON);
-
-	/* round down reclaimable and round up sc->nr_to_reclaim */
-	priority = fls_long(reclaimable) - 1 - fls_long(sc->nr_to_reclaim - 1);
-
-	sc->priority = clamp(priority, 0, DEF_PRIORITY);
-}
-
 static void lru_gen_shrink_node(struct pglist_data *pgdat, struct scan_control *sc)
 {
 	struct blk_plug plug;
@@ -4935,8 +4961,8 @@
 
 	blk_finish_plug(&plug);
 done:
-	/* kswapd should never fail */
-	pgdat->kswapd_failures = 0;
+	if (sc->nr_reclaimed > reclaimed)
+		pgdat->kswapd_failures = 0;
 }
 
 /******************************************************************************
@@ -5226,11 +5252,11 @@
 	for (tier = 0; tier < MAX_NR_TIERS; tier++) {
 		seq_printf(m, "            %10d", tier);
 		for (type = 0; type < ANON_AND_FILE; type++) {
-			const char *s = "   ";
+			const char *s = "xxx";
 			unsigned long n[3] = {};
 
 			if (seq == max_seq) {
-				s = "RT ";
+				s = "RTx";
 				n[0] = READ_ONCE(lrugen->avg_refaulted[type][tier]);
 				n[1] = READ_ONCE(lrugen->avg_total[type][tier]);
 			} else if (seq == min_seq[type] || NR_HIST_GENS > 1) {
@@ -5252,14 +5278,14 @@
 
 	seq_puts(m, "                      ");
 	for (i = 0; i < NR_MM_STATS; i++) {
-		const char *s = "      ";
+		const char *s = "xxxx";
 		unsigned long n = 0;
 
 		if (seq == max_seq && NR_HIST_GENS == 1) {
-			s = "LOYNFA";
+			s = "TYFA";
 			n = READ_ONCE(mm_state->stats[hist][i]);
 		} else if (seq != max_seq && NR_HIST_GENS > 1) {
-			s = "loynfa";
+			s = "tyfa";
 			n = READ_ONCE(mm_state->stats[hist][i]);
 		}
 
@@ -5885,6 +5911,7 @@
 	bool reclaimable = false;
 
 	if (lru_gen_enabled() && root_reclaim(sc)) {
+		memset(&sc->nr, 0, sizeof(sc->nr));
 		lru_gen_shrink_node(pgdat, sc);
 		return;
 	}
@@ -6678,6 +6705,7 @@
 {
 	struct zone *zone;
 	int z;
+	unsigned long nr_reclaimed = sc->nr_reclaimed;
 
 	/* Reclaim a number of pages proportional to the number of zones */
 	sc->nr_to_reclaim = 0;
@@ -6705,7 +6733,8 @@
 	if (sc->order && sc->nr_reclaimed >= compact_gap(sc->order))
 		sc->order = 0;
 
-	return sc->nr_scanned >= sc->nr_to_reclaim;
+	/* account for progress from mm_account_reclaimed_pages() */
+	return max(sc->nr_scanned, sc->nr_reclaimed - nr_reclaimed) >= sc->nr_to_reclaim;
 }
 
 /* Page allocator PCP high watermark is lowered if reclaim is active. */
--- linux-qcom-6.8.0.orig/mm/vmstat.c
+++ linux-qcom-6.8.0/mm/vmstat.c
@@ -1728,6 +1728,7 @@
 			   zone_page_state(zone, i));
 
 #ifdef CONFIG_NUMA
+	fold_vm_zone_numa_events(zone);
 	for (i = 0; i < NR_VM_NUMA_EVENT_ITEMS; i++)
 		seq_printf(m, "\n      %-12s %lu", numa_stat_name(i),
 			   zone_numa_event_state(zone, i));
--- linux-qcom-6.8.0.orig/mm/workingset.c
+++ linux-qcom-6.8.0/mm/workingset.c
@@ -411,10 +411,12 @@
  * @file: whether the corresponding folio is from the file lru.
  * @workingset: where the workingset value unpacked from shadow should
  * be stored.
+ * @flush: whether to flush cgroup rstat.
  *
  * Return: true if the shadow is for a recently evicted folio; false otherwise.
  */
-bool workingset_test_recent(void *shadow, bool file, bool *workingset)
+bool workingset_test_recent(void *shadow, bool file, bool *workingset,
+				bool flush)
 {
 	struct mem_cgroup *eviction_memcg;
 	struct lruvec *eviction_lruvec;
@@ -466,10 +468,16 @@
 
 	/*
 	 * Flush stats (and potentially sleep) outside the RCU read section.
+	 *
+	 * Note that workingset_test_recent() itself might be called in RCU read
+	 * section (for e.g, in cachestat) - these callers need to skip flushing
+	 * stats (via the flush argument).
+	 *
 	 * XXX: With per-memcg flushing and thresholding, is ratelimiting
 	 * still needed here?
 	 */
-	mem_cgroup_flush_stats_ratelimited(eviction_memcg);
+	if (flush)
+		mem_cgroup_flush_stats_ratelimited(eviction_memcg);
 
 	eviction_lruvec = mem_cgroup_lruvec(eviction_memcg, pgdat);
 	refault = atomic_long_read(&eviction_lruvec->nonresident_age);
@@ -557,7 +565,7 @@
 
 	mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + file, nr);
 
-	if (!workingset_test_recent(shadow, file, &workingset))
+	if (!workingset_test_recent(shadow, file, &workingset, true))
 		return;
 
 	folio_set_active(folio);
--- linux-qcom-6.8.0.orig/mm/zswap.c
+++ linux-qcom-6.8.0/mm/zswap.c
@@ -153,7 +153,7 @@
 		CONFIG_ZSWAP_SHRINKER_DEFAULT_ON);
 module_param_named(shrinker_enabled, zswap_shrinker_enabled, bool, 0644);
 
-bool is_zswap_enabled(void)
+bool zswap_is_enabled(void)
 {
 	return zswap_enabled;
 }
@@ -645,15 +645,30 @@
 	if (!zswap_shrinker_enabled || !mem_cgroup_zswap_writeback_enabled(memcg))
 		return 0;
 
-#ifdef CONFIG_MEMCG_KMEM
-	mem_cgroup_flush_stats(memcg);
-	nr_backing = memcg_page_state(memcg, MEMCG_ZSWAP_B) >> PAGE_SHIFT;
-	nr_stored = memcg_page_state(memcg, MEMCG_ZSWAPPED);
-#else
-	/* use pool stats instead of memcg stats */
-	nr_backing = get_zswap_pool_size(pool) >> PAGE_SHIFT;
-	nr_stored = atomic_read(&pool->nr_stored);
-#endif
+	/*
+	 * The shrinker resumes swap writeback, which will enter block
+	 * and may enter fs. XXX: Harmonize with vmscan.c __GFP_FS
+	 * rules (may_enter_fs()), which apply on a per-folio basis.
+	 */
+	if (!gfp_has_io_fs(sc->gfp_mask))
+		return 0;
+
+	/*
+	 * For memcg, use the cgroup-wide ZSWAP stats since we don't
+	 * have them per-node and thus per-lruvec. Careful if memcg is
+	 * runtime-disabled: we can get sc->memcg == NULL, which is ok
+	 * for the lruvec, but not for memcg_page_state().
+	 *
+	 * Without memcg, use the zswap pool-wide metrics.
+	 */
+	if (!mem_cgroup_disabled()) {
+		mem_cgroup_flush_stats(memcg);
+		nr_backing = memcg_page_state(memcg, MEMCG_ZSWAP_B) >> PAGE_SHIFT;
+		nr_stored = memcg_page_state(memcg, MEMCG_ZSWAPPED);
+	} else {
+		nr_backing = get_zswap_pool_size(pool) >> PAGE_SHIFT;
+		nr_stored = atomic_read(&pool->nr_stored);
+	}
 
 	if (!nr_stored)
 		return 0;
--- linux-qcom-6.8.0.orig/net/802/psnap.c
+++ linux-qcom-6.8.0/net/802/psnap.c
@@ -55,11 +55,11 @@
 		goto drop;
 
 	rcu_read_lock();
-	proto = find_snap_client(skb_transport_header(skb));
+	proto = find_snap_client(skb->data);
 	if (proto) {
 		/* Pass the frame on. */
-		skb->transport_header += 5;
 		skb_pull_rcsum(skb, 5);
+		skb_reset_transport_header(skb);
 		rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev);
 	}
 	rcu_read_unlock();
--- linux-qcom-6.8.0.orig/net/8021q/vlan_core.c
+++ linux-qcom-6.8.0/net/8021q/vlan_core.c
@@ -478,6 +478,8 @@
 	if (unlikely(!vhdr))
 		goto out;
 
+	NAPI_GRO_CB(skb)->network_offsets[NAPI_GRO_CB(skb)->encap_mark] = hlen;
+
 	type = vhdr->h_vlan_encapsulated_proto;
 
 	ptype = gro_find_receive_by_type(type);
--- linux-qcom-6.8.0.orig/net/9p/client.c
+++ linux-qcom-6.8.0/net/9p/client.c
@@ -235,6 +235,8 @@
 	if (!fc->sdata)
 		return -ENOMEM;
 	fc->capacity = alloc_msize;
+	fc->id = 0;
+	fc->tag = P9_NOTAG;
 	return 0;
 }
 
@@ -974,8 +976,10 @@
 struct p9_client *p9_client_create(const char *dev_name, char *options)
 {
 	int err;
+	static atomic_t seqno = ATOMIC_INIT(0);
 	struct p9_client *clnt;
 	char *client_id;
+	char *cache_name;
 
 	clnt = kmalloc(sizeof(*clnt), GFP_KERNEL);
 	if (!clnt)
@@ -1032,15 +1036,23 @@
 	if (err)
 		goto close_trans;
 
+	cache_name = kasprintf(GFP_KERNEL,
+		"9p-fcall-cache-%u", atomic_inc_return(&seqno));
+	if (!cache_name) {
+		err = -ENOMEM;
+		goto close_trans;
+	}
+
 	/* P9_HDRSZ + 4 is the smallest packet header we can have that is
 	 * followed by data accessed from userspace by read
 	 */
 	clnt->fcall_cache =
-		kmem_cache_create_usercopy("9p-fcall-cache", clnt->msize,
+		kmem_cache_create_usercopy(cache_name, clnt->msize,
 					   0, 0, P9_HDRSZ + 4,
 					   clnt->msize - (P9_HDRSZ + 4),
 					   NULL);
 
+	kfree(cache_name);
 	return clnt;
 
 close_trans:
@@ -1583,7 +1595,7 @@
 		received = rsize;
 	}
 
-	p9_debug(P9_DEBUG_9P, "<<< RREAD count %d\n", count);
+	p9_debug(P9_DEBUG_9P, "<<< RREAD count %d\n", received);
 
 	if (non_zc) {
 		int n = copy_to_iter(dataptr, received, to);
@@ -1609,9 +1621,6 @@
 	int total = 0;
 	*err = 0;
 
-	p9_debug(P9_DEBUG_9P, ">>> TWRITE fid %d offset %llu count %zd\n",
-		 fid->fid, offset, iov_iter_count(from));
-
 	while (iov_iter_count(from)) {
 		int count = iov_iter_count(from);
 		int rsize = fid->iounit;
@@ -1623,6 +1632,9 @@
 		if (count < rsize)
 			rsize = count;
 
+		p9_debug(P9_DEBUG_9P, ">>> TWRITE fid %d offset %llu count %d (/%d)\n",
+			 fid->fid, offset, rsize, count);
+
 		/* Don't bother zerocopy for small IO (< 1024) */
 		if (clnt->trans_mod->zc_request && rsize > 1024) {
 			req = p9_client_zc_rpc(clnt, P9_TWRITE, NULL, from, 0,
@@ -1650,7 +1662,7 @@
 			written = rsize;
 		}
 
-		p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", count);
+		p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", written);
 
 		p9_req_put(clnt, req);
 		iov_iter_revert(from, count - written - iov_iter_count(from));
--- linux-qcom-6.8.0.orig/net/9p/trans_xen.c
+++ linux-qcom-6.8.0/net/9p/trans_xen.c
@@ -286,7 +286,7 @@
 		if (!priv->rings[i].intf)
 			break;
 		if (priv->rings[i].irq > 0)
-			unbind_from_irqhandler(priv->rings[i].irq, priv->dev);
+			unbind_from_irqhandler(priv->rings[i].irq, ring);
 		if (priv->rings[i].data.in) {
 			for (j = 0;
 			     j < (1 << priv->rings[i].intf->ring_order);
@@ -465,6 +465,7 @@
 		goto error;
 	}
 
+	xenbus_switch_state(dev, XenbusStateInitialised);
 	return 0;
 
  error_xenbus:
@@ -512,8 +513,10 @@
 		break;
 
 	case XenbusStateInitWait:
-		if (!xen_9pfs_front_init(dev))
-			xenbus_switch_state(dev, XenbusStateInitialised);
+		if (dev->state != XenbusStateInitialising)
+			break;
+
+		xen_9pfs_front_init(dev);
 		break;
 
 	case XenbusStateConnected:
--- linux-qcom-6.8.0.orig/net/atm/clip.c
+++ linux-qcom-6.8.0/net/atm/clip.c
@@ -345,7 +345,7 @@
 		dev->stats.tx_dropped++;
 		return NETDEV_TX_OK;
 	}
-	rt = (struct rtable *) dst;
+	rt = dst_rtable(dst);
 	if (rt->rt_gw_family == AF_INET)
 		daddr = &rt->rt_gw4;
 	else
--- linux-qcom-6.8.0.orig/net/ax25/af_ax25.c
+++ linux-qcom-6.8.0/net/ax25/af_ax25.c
@@ -103,7 +103,7 @@
 			s->ax25_dev = NULL;
 			if (sk->sk_socket) {
 				netdev_put(ax25_dev->dev,
-					   &ax25_dev->dev_tracker);
+					   &s->dev_tracker);
 				ax25_dev_put(ax25_dev);
 			}
 			ax25_cb_del(s);
@@ -1378,8 +1378,10 @@
 {
 	struct sk_buff *skb;
 	struct sock *newsk;
+	ax25_dev *ax25_dev;
 	DEFINE_WAIT(wait);
 	struct sock *sk;
+	ax25_cb *ax25;
 	int err = 0;
 
 	if (sock->state != SS_UNCONNECTED)
@@ -1434,6 +1436,10 @@
 	kfree_skb(skb);
 	sk_acceptq_removed(sk);
 	newsock->state = SS_CONNECTED;
+	ax25 = sk_to_ax25(newsk);
+	ax25_dev = ax25->ax25_dev;
+	netdev_hold(ax25_dev->dev, &ax25->dev_tracker, GFP_ATOMIC);
+	ax25_dev_hold(ax25_dev);
 
 out:
 	release_sock(sk);
--- linux-qcom-6.8.0.orig/net/ax25/ax25_dev.c
+++ linux-qcom-6.8.0/net/ax25/ax25_dev.c
@@ -22,11 +22,12 @@
 #include <net/sock.h>
 #include <linux/uaccess.h>
 #include <linux/fcntl.h>
+#include <linux/list.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
 
-ax25_dev *ax25_dev_list;
+static LIST_HEAD(ax25_dev_list);
 DEFINE_SPINLOCK(ax25_dev_lock);
 
 ax25_dev *ax25_addr_ax25dev(ax25_address *addr)
@@ -34,10 +35,11 @@
 	ax25_dev *ax25_dev, *res = NULL;
 
 	spin_lock_bh(&ax25_dev_lock);
-	for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
+	list_for_each_entry(ax25_dev, &ax25_dev_list, list)
 		if (ax25cmp(addr, (const ax25_address *)ax25_dev->dev->dev_addr) == 0) {
 			res = ax25_dev;
 			ax25_dev_hold(ax25_dev);
+			break;
 		}
 	spin_unlock_bh(&ax25_dev_lock);
 
@@ -59,7 +61,6 @@
 	}
 
 	refcount_set(&ax25_dev->refcount, 1);
-	dev->ax25_ptr     = ax25_dev;
 	ax25_dev->dev     = dev;
 	netdev_hold(dev, &ax25_dev->dev_tracker, GFP_KERNEL);
 	ax25_dev->forward = NULL;
@@ -85,10 +86,9 @@
 #endif
 
 	spin_lock_bh(&ax25_dev_lock);
-	ax25_dev->next = ax25_dev_list;
-	ax25_dev_list  = ax25_dev;
+	list_add(&ax25_dev->list, &ax25_dev_list);
+	dev->ax25_ptr     = ax25_dev;
 	spin_unlock_bh(&ax25_dev_lock);
-	ax25_dev_hold(ax25_dev);
 
 	ax25_register_dev_sysctl(ax25_dev);
 }
@@ -105,38 +105,25 @@
 	spin_lock_bh(&ax25_dev_lock);
 
 #ifdef CONFIG_AX25_DAMA_SLAVE
-	ax25_ds_del_timer(ax25_dev);
+	timer_shutdown_sync(&ax25_dev->dama.slave_timer);
 #endif
 
 	/*
 	 *	Remove any packet forwarding that points to this device.
 	 */
-	for (s = ax25_dev_list; s != NULL; s = s->next)
+	list_for_each_entry(s, &ax25_dev_list, list)
 		if (s->forward == dev)
 			s->forward = NULL;
 
-	if ((s = ax25_dev_list) == ax25_dev) {
-		ax25_dev_list = s->next;
-		goto unlock_put;
-	}
-
-	while (s != NULL && s->next != NULL) {
-		if (s->next == ax25_dev) {
-			s->next = ax25_dev->next;
-			goto unlock_put;
+	list_for_each_entry(s, &ax25_dev_list, list) {
+		if (s == ax25_dev) {
+			list_del(&s->list);
+			break;
 		}
-
-		s = s->next;
 	}
-	spin_unlock_bh(&ax25_dev_lock);
-	dev->ax25_ptr = NULL;
-	ax25_dev_put(ax25_dev);
-	return;
 
-unlock_put:
-	spin_unlock_bh(&ax25_dev_lock);
-	ax25_dev_put(ax25_dev);
 	dev->ax25_ptr = NULL;
+	spin_unlock_bh(&ax25_dev_lock);
 	netdev_put(dev, &ax25_dev->dev_tracker);
 	ax25_dev_put(ax25_dev);
 }
@@ -200,16 +187,13 @@
  */
 void __exit ax25_dev_free(void)
 {
-	ax25_dev *s, *ax25_dev;
+	ax25_dev *s, *n;
 
 	spin_lock_bh(&ax25_dev_lock);
-	ax25_dev = ax25_dev_list;
-	while (ax25_dev != NULL) {
-		s        = ax25_dev;
-		netdev_put(ax25_dev->dev, &ax25_dev->dev_tracker);
-		ax25_dev = ax25_dev->next;
-		kfree(s);
+	list_for_each_entry_safe(s, n, &ax25_dev_list, list) {
+		netdev_put(s->dev, &s->dev_tracker);
+		list_del(&s->list);
+		ax25_dev_put(s);
 	}
-	ax25_dev_list = NULL;
 	spin_unlock_bh(&ax25_dev_lock);
 }
--- linux-qcom-6.8.0.orig/net/batman-adv/originator.c
+++ linux-qcom-6.8.0/net/batman-adv/originator.c
@@ -12,6 +12,7 @@
 #include <linux/errno.h>
 #include <linux/etherdevice.h>
 #include <linux/gfp.h>
+#include <linux/if_vlan.h>
 #include <linux/jiffies.h>
 #include <linux/kref.h>
 #include <linux/list.h>
@@ -132,6 +133,29 @@
 }
 
 /**
+ * batadv_vlan_id_valid() - check if vlan id is in valid batman-adv encoding
+ * @vid: the VLAN identifier
+ *
+ * Return: true when either no vlan is set or if VLAN is in correct range,
+ *  false otherwise
+ */
+static bool batadv_vlan_id_valid(unsigned short vid)
+{
+	unsigned short non_vlan = vid & ~(BATADV_VLAN_HAS_TAG | VLAN_VID_MASK);
+
+	if (vid == 0)
+		return true;
+
+	if (!(vid & BATADV_VLAN_HAS_TAG))
+		return false;
+
+	if (non_vlan)
+		return false;
+
+	return true;
+}
+
+/**
  * batadv_orig_node_vlan_new() - search and possibly create an orig_node_vlan
  *  object
  * @orig_node: the originator serving the VLAN
@@ -149,6 +173,9 @@
 {
 	struct batadv_orig_node_vlan *vlan;
 
+	if (!batadv_vlan_id_valid(vid))
+		return NULL;
+
 	spin_lock_bh(&orig_node->vlan_list_lock);
 
 	/* first look if an object for this vid already exists */
@@ -1266,6 +1293,8 @@
 	/* for all origins... */
 	for (i = 0; i < hash->size; i++) {
 		head = &hash->table[i];
+		if (hlist_empty(head))
+			continue;
 		list_lock = &hash->list_locks[i];
 
 		spin_lock_bh(list_lock);
--- linux-qcom-6.8.0.orig/net/batman-adv/translation-table.c
+++ linux-qcom-6.8.0/net/batman-adv/translation-table.c
@@ -990,16 +990,25 @@
 	int tt_diff_len, tt_change_len = 0;
 	int tt_diff_entries_num = 0;
 	int tt_diff_entries_count = 0;
+	bool drop_changes = false;
+	size_t tt_extra_len = 0;
 	u16 tvlv_len;
 
 	tt_diff_entries_num = atomic_read(&bat_priv->tt.local_changes);
 	tt_diff_len = batadv_tt_len(tt_diff_entries_num);
 
 	/* if we have too many changes for one packet don't send any
-	 * and wait for the tt table request which will be fragmented
+	 * and wait for the tt table request so we can reply with the full
+	 * (fragmented) table.
+	 *
+	 * The local change history should still be cleaned up so the next
+	 * TT round can start again with a clean state.
 	 */
-	if (tt_diff_len > bat_priv->soft_iface->mtu)
+	if (tt_diff_len > bat_priv->soft_iface->mtu) {
 		tt_diff_len = 0;
+		tt_diff_entries_num = 0;
+		drop_changes = true;
+	}
 
 	tvlv_len = batadv_tt_prepare_tvlv_local_data(bat_priv, &tt_data,
 						     &tt_change, &tt_diff_len);
@@ -1008,7 +1017,7 @@
 
 	tt_data->flags = BATADV_TT_OGM_DIFF;
 
-	if (tt_diff_len == 0)
+	if (!drop_changes && tt_diff_len == 0)
 		goto container_register;
 
 	spin_lock_bh(&bat_priv->tt.changes_list_lock);
@@ -1027,6 +1036,9 @@
 	}
 	spin_unlock_bh(&bat_priv->tt.changes_list_lock);
 
+	tt_extra_len = batadv_tt_len(tt_diff_entries_num -
+				     tt_diff_entries_count);
+
 	/* Keep the buffer for possible tt_request */
 	spin_lock_bh(&bat_priv->tt.last_changeset_lock);
 	kfree(bat_priv->tt.last_changeset);
@@ -1035,6 +1047,7 @@
 	tt_change_len = batadv_tt_len(tt_diff_entries_count);
 	/* check whether this new OGM has no changes due to size problems */
 	if (tt_diff_entries_count > 0) {
+		tt_diff_len -= tt_extra_len;
 		/* if kmalloc() fails we will reply with the full table
 		 * instead of providing the diff
 		 */
@@ -1047,6 +1060,8 @@
 	}
 	spin_unlock_bh(&bat_priv->tt.last_changeset_lock);
 
+	/* Remove extra packet space for OGM */
+	tvlv_len -= tt_extra_len;
 container_register:
 	batadv_tvlv_container_register(bat_priv, BATADV_TVLV_TT, 1, tt_data,
 				       tvlv_len);
@@ -2747,14 +2762,16 @@
  *
  * Fills the tvlv buff with the tt entries from the specified hash. If valid_cb
  * is not provided then this becomes a no-op.
+ *
+ * Return: Remaining unused length in tvlv_buff.
  */
-static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv,
-				    struct batadv_hashtable *hash,
-				    void *tvlv_buff, u16 tt_len,
-				    bool (*valid_cb)(const void *,
-						     const void *,
-						     u8 *flags),
-				    void *cb_data)
+static u16 batadv_tt_tvlv_generate(struct batadv_priv *bat_priv,
+				   struct batadv_hashtable *hash,
+				   void *tvlv_buff, u16 tt_len,
+				   bool (*valid_cb)(const void *,
+						    const void *,
+						    u8 *flags),
+				   void *cb_data)
 {
 	struct batadv_tt_common_entry *tt_common_entry;
 	struct batadv_tvlv_tt_change *tt_change;
@@ -2768,7 +2785,7 @@
 	tt_change = tvlv_buff;
 
 	if (!valid_cb)
-		return;
+		return tt_len;
 
 	rcu_read_lock();
 	for (i = 0; i < hash->size; i++) {
@@ -2794,6 +2811,8 @@
 		}
 	}
 	rcu_read_unlock();
+
+	return batadv_tt_len(tt_tot - tt_num_entries);
 }
 
 /**
@@ -3069,10 +3088,11 @@
 			goto out;
 
 		/* fill the rest of the tvlv with the real TT entries */
-		batadv_tt_tvlv_generate(bat_priv, bat_priv->tt.global_hash,
-					tt_change, tt_len,
-					batadv_tt_global_valid,
-					req_dst_orig_node);
+		tvlv_len -= batadv_tt_tvlv_generate(bat_priv,
+						    bat_priv->tt.global_hash,
+						    tt_change, tt_len,
+						    batadv_tt_global_valid,
+						    req_dst_orig_node);
 	}
 
 	/* Don't send the response, if larger than fragmented packet. */
@@ -3196,9 +3216,11 @@
 			goto out;
 
 		/* fill the rest of the tvlv with the real TT entries */
-		batadv_tt_tvlv_generate(bat_priv, bat_priv->tt.local_hash,
-					tt_change, tt_len,
-					batadv_tt_local_valid, NULL);
+		tvlv_len -= batadv_tt_tvlv_generate(bat_priv,
+						    bat_priv->tt.local_hash,
+						    tt_change, tt_len,
+						    batadv_tt_local_valid,
+						    NULL);
 	}
 
 	tvlv_tt_data->flags = BATADV_TT_RESPONSE;
@@ -3948,7 +3970,7 @@
 
 	spin_lock_bh(&bat_priv->tt.commit_lock);
 
-	while (true) {
+	while (timeout) {
 		table_size = batadv_tt_local_table_transmit_size(bat_priv);
 		if (packet_size_max >= table_size)
 			break;
--- linux-qcom-6.8.0.orig/net/bluetooth/6lowpan.c
+++ linux-qcom-6.8.0/net/bluetooth/6lowpan.c
@@ -133,7 +133,7 @@
 						  struct in6_addr *daddr,
 						  struct sk_buff *skb)
 {
-	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
+	struct rt6_info *rt = dst_rt6_info(skb_dst(skb));
 	int count = atomic_read(&dev->peer_count);
 	const struct in6_addr *nexthop;
 	struct lowpan_peer *peer;
@@ -892,7 +892,7 @@
 	chan->ops = &bt_6lowpan_chan_ops;
 
 	err = l2cap_chan_connect(chan, cpu_to_le16(L2CAP_PSM_IPSP), 0,
-				 addr, dst_type);
+				 addr, dst_type, L2CAP_CONN_TIMEOUT);
 
 	BT_DBG("chan %p err %d", chan, err);
 	if (err < 0)
--- linux-qcom-6.8.0.orig/net/bluetooth/Kconfig
+++ linux-qcom-6.8.0/net/bluetooth/Kconfig
@@ -62,14 +62,6 @@
 
 source "net/bluetooth/hidp/Kconfig"
 
-config BT_HS
-	bool "Bluetooth High Speed (HS) features"
-	depends on BT_BREDR
-	help
-	  Bluetooth High Speed includes support for off-loading
-	  Bluetooth connections via 802.11 (wifi) physical layer
-	  available with Bluetooth version 3.0 or later.
-
 config BT_LE
 	bool "Bluetooth Low Energy (LE) features"
 	depends on BT
--- linux-qcom-6.8.0.orig/net/bluetooth/Makefile
+++ linux-qcom-6.8.0/net/bluetooth/Makefile
@@ -21,7 +21,6 @@
 
 bluetooth-$(CONFIG_BT_BREDR) += sco.o
 bluetooth-$(CONFIG_BT_LE) += iso.o
-bluetooth-$(CONFIG_BT_HS) += a2mp.o amp.o
 bluetooth-$(CONFIG_BT_LEDS) += leds.o
 bluetooth-$(CONFIG_BT_MSFTEXT) += msft.o
 bluetooth-$(CONFIG_BT_AOSPEXT) += aosp.o
--- linux-qcom-6.8.0.orig/net/bluetooth/af_bluetooth.c
+++ linux-qcom-6.8.0/net/bluetooth/af_bluetooth.c
@@ -185,6 +185,28 @@
 }
 EXPORT_SYMBOL(bt_sock_unlink);
 
+bool bt_sock_linked(struct bt_sock_list *l, struct sock *s)
+{
+	struct sock *sk;
+
+	if (!l || !s)
+		return false;
+
+	read_lock(&l->lock);
+
+	sk_for_each(sk, &l->head) {
+		if (s == sk) {
+			read_unlock(&l->lock);
+			return true;
+		}
+	}
+
+	read_unlock(&l->lock);
+
+	return false;
+}
+EXPORT_SYMBOL(bt_sock_linked);
+
 void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
 {
 	const struct cred *old_cred;
@@ -309,14 +331,11 @@
 	if (flags & MSG_OOB)
 		return -EOPNOTSUPP;
 
-	lock_sock(sk);
-
 	skb = skb_recv_datagram(sk, flags, &err);
 	if (!skb) {
 		if (sk->sk_shutdown & RCV_SHUTDOWN)
 			err = 0;
 
-		release_sock(sk);
 		return err;
 	}
 
@@ -346,8 +365,6 @@
 
 	skb_free_datagram(sk, skb);
 
-	release_sock(sk);
-
 	if (flags & MSG_TRUNC)
 		copied = skblen;
 
@@ -570,10 +587,11 @@
 		if (sk->sk_state == BT_LISTEN)
 			return -EINVAL;
 
-		lock_sock(sk);
+		spin_lock(&sk->sk_receive_queue.lock);
 		skb = skb_peek(&sk->sk_receive_queue);
 		amount = skb ? skb->len : 0;
-		release_sock(sk);
+		spin_unlock(&sk->sk_receive_queue.lock);
+
 		err = put_user(amount, (int __user *)arg);
 		break;
 
@@ -829,11 +847,14 @@
 	bt_sysfs_cleanup();
 cleanup_led:
 	bt_leds_cleanup();
+	debugfs_remove_recursive(bt_debugfs);
 	return err;
 }
 
 static void __exit bt_exit(void)
 {
+	iso_exit();
+
 	mgmt_exit();
 
 	sco_exit();
--- linux-qcom-6.8.0.orig/net/bluetooth/bnep/core.c
+++ linux-qcom-6.8.0/net/bluetooth/bnep/core.c
@@ -385,7 +385,8 @@
 
 	case BNEP_COMPRESSED_DST_ONLY:
 		__skb_put_data(nskb, skb_mac_header(skb), ETH_ALEN);
-		__skb_put_data(nskb, s->eh.h_source, ETH_ALEN + 2);
+		__skb_put_data(nskb, s->eh.h_source, ETH_ALEN);
+		put_unaligned(s->eh.h_proto, (__be16 *)__skb_put(nskb, 2));
 		break;
 
 	case BNEP_GENERAL:
@@ -744,8 +745,7 @@
 	if (flt[0])
 		BT_INFO("BNEP filters: %s", flt);
 
-	bnep_sock_init();
-	return 0;
+	return bnep_sock_init();
 }
 
 static void __exit bnep_exit(void)
--- linux-qcom-6.8.0.orig/net/bluetooth/eir.c
+++ linux-qcom-6.8.0/net/bluetooth/eir.c
@@ -13,48 +13,33 @@
 
 #define PNP_INFO_SVCLASS_ID		0x1200
 
-static u8 eir_append_name(u8 *eir, u16 eir_len, u8 type, u8 *data, u8 data_len)
-{
-	u8 name[HCI_MAX_SHORT_NAME_LENGTH + 1];
-
-	/* If data is already NULL terminated just pass it directly */
-	if (data[data_len - 1] == '\0')
-		return eir_append_data(eir, eir_len, type, data, data_len);
-
-	memcpy(name, data, HCI_MAX_SHORT_NAME_LENGTH);
-	name[HCI_MAX_SHORT_NAME_LENGTH] = '\0';
-
-	return eir_append_data(eir, eir_len, type, name, sizeof(name));
-}
-
 u8 eir_append_local_name(struct hci_dev *hdev, u8 *ptr, u8 ad_len)
 {
 	size_t short_len;
 	size_t complete_len;
 
-	/* no space left for name (+ NULL + type + len) */
-	if ((max_adv_len(hdev) - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 3)
+	/* no space left for name (+ type + len) */
+	if ((max_adv_len(hdev) - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 2)
 		return ad_len;
 
 	/* use complete name if present and fits */
 	complete_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
 	if (complete_len && complete_len <= HCI_MAX_SHORT_NAME_LENGTH)
-		return eir_append_name(ptr, ad_len, EIR_NAME_COMPLETE,
-				       hdev->dev_name, complete_len + 1);
+		return eir_append_data(ptr, ad_len, EIR_NAME_COMPLETE,
+				       hdev->dev_name, complete_len);
 
 	/* use short name if present */
 	short_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
 	if (short_len)
-		return eir_append_name(ptr, ad_len, EIR_NAME_SHORT,
+		return eir_append_data(ptr, ad_len, EIR_NAME_SHORT,
 				       hdev->short_name,
-				       short_len == HCI_MAX_SHORT_NAME_LENGTH ?
-				       short_len : short_len + 1);
+				       short_len);
 
 	/* use shortened full name if present, we already know that name
 	 * is longer then HCI_MAX_SHORT_NAME_LENGTH
 	 */
 	if (complete_len)
-		return eir_append_name(ptr, ad_len, EIR_NAME_SHORT,
+		return eir_append_data(ptr, ad_len, EIR_NAME_SHORT,
 				       hdev->dev_name,
 				       HCI_MAX_SHORT_NAME_LENGTH);
 
--- linux-qcom-6.8.0.orig/net/bluetooth/hci_conn.c
+++ linux-qcom-6.8.0/net/bluetooth/hci_conn.c
@@ -1,7 +1,7 @@
 /*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
-   Copyright 2023 NXP
+   Copyright 2023-2024 NXP
 
    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
 
@@ -36,7 +36,6 @@
 
 #include "hci_request.h"
 #include "smp.h"
-#include "a2mp.h"
 #include "eir.h"
 
 struct sco_param {
@@ -69,7 +68,7 @@
 };
 
 /* This function requires the caller holds hdev->lock */
-static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
+void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
 {
 	struct hci_conn_params *params;
 	struct hci_dev *hdev = conn->hdev;
@@ -108,8 +107,7 @@
 	 * where a timeout + cancel does indicate an actual failure.
 	 */
 	if (status && status != HCI_ERROR_UNKNOWN_CONN_ID)
-		mgmt_connect_failed(hdev, &conn->dst, conn->type,
-				    conn->dst_type, status);
+		mgmt_connect_failed(hdev, conn, status);
 
 	/* The connection attempt was doing scan for new RPA, and is
 	 * in scan phase. If params are not associated with any other
@@ -179,64 +177,6 @@
 	hci_dev_put(hdev);
 }
 
-static void hci_acl_create_connection(struct hci_conn *conn)
-{
-	struct hci_dev *hdev = conn->hdev;
-	struct inquiry_entry *ie;
-	struct hci_cp_create_conn cp;
-
-	BT_DBG("hcon %p", conn);
-
-	/* Many controllers disallow HCI Create Connection while it is doing
-	 * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create
-	 * Connection. This may cause the MGMT discovering state to become false
-	 * without user space's request but it is okay since the MGMT Discovery
-	 * APIs do not promise that discovery should be done forever. Instead,
-	 * the user space monitors the status of MGMT discovering and it may
-	 * request for discovery again when this flag becomes false.
-	 */
-	if (test_bit(HCI_INQUIRY, &hdev->flags)) {
-		/* Put this connection to "pending" state so that it will be
-		 * executed after the inquiry cancel command complete event.
-		 */
-		conn->state = BT_CONNECT2;
-		hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
-		return;
-	}
-
-	conn->state = BT_CONNECT;
-	conn->out = true;
-	conn->role = HCI_ROLE_MASTER;
-
-	conn->attempt++;
-
-	conn->link_policy = hdev->link_policy;
-
-	memset(&cp, 0, sizeof(cp));
-	bacpy(&cp.bdaddr, &conn->dst);
-	cp.pscan_rep_mode = 0x02;
-
-	ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
-	if (ie) {
-		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
-			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
-			cp.pscan_mode     = ie->data.pscan_mode;
-			cp.clock_offset   = ie->data.clock_offset |
-					    cpu_to_le16(0x8000);
-		}
-
-		memcpy(conn->dev_class, ie->data.dev_class, 3);
-	}
-
-	cp.pkt_type = cpu_to_le16(conn->pkt_type);
-	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
-		cp.role_switch = 0x01;
-	else
-		cp.role_switch = 0x00;
-
-	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
-}
-
 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 {
 	BT_DBG("hcon %p", conn);
@@ -350,6 +290,9 @@
 
 	kfree(conn_handle);
 
+	if (!hci_conn_valid(hdev, conn))
+		return -ECANCELED;
+
 	bt_dev_dbg(hdev, "hcon %p", conn);
 
 	configure_datapath_sync(hdev, &conn->codec);
@@ -963,16 +906,42 @@
 			       U16_MAX, GFP_ATOMIC);
 }
 
-struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
-			      u8 role, u16 handle)
+static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
+				       u8 role, u16 handle)
 {
 	struct hci_conn *conn;
 
+	switch (type) {
+	case ACL_LINK:
+		if (!hdev->acl_mtu)
+			return ERR_PTR(-ECONNREFUSED);
+		break;
+	case ISO_LINK:
+		if (hdev->iso_mtu)
+			/* Dedicated ISO Buffer exists */
+			break;
+		fallthrough;
+	case LE_LINK:
+		if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)
+			return ERR_PTR(-ECONNREFUSED);
+		if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU)
+			return ERR_PTR(-ECONNREFUSED);
+		break;
+	case SCO_LINK:
+	case ESCO_LINK:
+		if (!hdev->sco_pkts)
+			/* Controller does not support SCO or eSCO over HCI */
+			return ERR_PTR(-ECONNREFUSED);
+		break;
+	default:
+		return ERR_PTR(-ECONNREFUSED);
+	}
+
 	bt_dev_dbg(hdev, "dst %pMR handle 0x%4.4x", dst, handle);
 
 	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 	if (!conn)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	bacpy(&conn->dst, dst);
 	bacpy(&conn->src, &hdev->bdaddr);
@@ -990,6 +959,7 @@
 	conn->tx_power = HCI_TX_POWER_INVALID;
 	conn->max_tx_power = HCI_TX_POWER_INVALID;
 	conn->sync_handle = HCI_SYNC_HANDLE_INVALID;
+	conn->sid = HCI_SID_INVALID;
 
 	set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
@@ -1003,10 +973,12 @@
 	switch (type) {
 	case ACL_LINK:
 		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
+		conn->mtu = hdev->acl_mtu;
 		break;
 	case LE_LINK:
 		/* conn->src should reflect the local identity address */
 		hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
+		conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu;
 		break;
 	case ISO_LINK:
 		/* conn->src should reflect the local identity address */
@@ -1018,6 +990,8 @@
 		else if (conn->role == HCI_ROLE_MASTER)
 			conn->cleanup = cis_cleanup;
 
+		conn->mtu = hdev->iso_mtu ? hdev->iso_mtu :
+			    hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu;
 		break;
 	case SCO_LINK:
 		if (lmp_esco_capable(hdev))
@@ -1025,9 +999,12 @@
 					(hdev->esco_type & EDR_ESCO_MASK);
 		else
 			conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
+
+		conn->mtu = hdev->sco_mtu;
 		break;
 	case ESCO_LINK:
 		conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
+		conn->mtu = hdev->sco_mtu;
 		break;
 	}
 
@@ -1070,9 +1047,18 @@
 
 	handle = hci_conn_hash_alloc_unset(hdev);
 	if (unlikely(handle < 0))
-		return NULL;
+		return ERR_PTR(-ECONNREFUSED);
+
+	return __hci_conn_add(hdev, type, dst, role, handle);
+}
+
+struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
+			      u8 role, u16 handle)
+{
+	if (handle > HCI_CONN_HANDLE_MAX)
+		return ERR_PTR(-EINVAL);
 
-	return hci_conn_add(hdev, type, dst, role, handle);
+	return __hci_conn_add(hdev, type, dst, role, handle);
 }
 
 static void hci_conn_cleanup_child(struct hci_conn *conn, u8 reason)
@@ -1175,9 +1161,6 @@
 		}
 	}
 
-	if (conn->amp_mgr)
-		amp_mgr_put(conn->amp_mgr);
-
 	skb_queue_purge(&conn->data_q);
 
 	/* Remove the connection from the list and cleanup its remaining
@@ -1186,6 +1169,9 @@
 	 * rest of hci_conn_del.
 	 */
 	hci_conn_cleanup(conn);
+
+	/* Dequeue callbacks using connection pointer as data */
+	hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
 }
 
 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
@@ -1199,8 +1185,7 @@
 
 	list_for_each_entry(d, &hci_dev_list, list) {
 		if (!test_bit(HCI_UP, &d->flags) ||
-		    hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
-		    d->dev_type != HCI_PRIMARY)
+		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
 			continue;
 
 		/* Simple routing:
@@ -1274,8 +1259,7 @@
 		hci_le_conn_failed(conn, status);
 		break;
 	case ACL_LINK:
-		mgmt_connect_failed(hdev, &conn->dst, conn->type,
-				    conn->dst_type, status);
+		mgmt_connect_failed(hdev, conn, status);
 		break;
 	}
 
@@ -1320,56 +1304,9 @@
 	return 0;
 }
 
-static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
-{
-	struct hci_conn *conn;
-	u16 handle = PTR_UINT(data);
-
-	conn = hci_conn_hash_lookup_handle(hdev, handle);
-	if (!conn)
-		return;
-
-	bt_dev_dbg(hdev, "err %d", err);
-
-	hci_dev_lock(hdev);
-
-	if (!err) {
-		hci_connect_le_scan_cleanup(conn, 0x00);
-		goto done;
-	}
-
-	/* Check if connection is still pending */
-	if (conn != hci_lookup_le_connect(hdev))
-		goto done;
-
-	/* Flush to make sure we send create conn cancel command if needed */
-	flush_delayed_work(&conn->le_conn_timeout);
-	hci_conn_failed(conn, bt_status(err));
-
-done:
-	hci_dev_unlock(hdev);
-}
-
-static int hci_connect_le_sync(struct hci_dev *hdev, void *data)
-{
-	struct hci_conn *conn;
-	u16 handle = PTR_UINT(data);
-
-	conn = hci_conn_hash_lookup_handle(hdev, handle);
-	if (!conn)
-		return 0;
-
-	bt_dev_dbg(hdev, "conn %p", conn);
-
-	clear_bit(HCI_CONN_SCANNING, &conn->flags);
-	conn->state = BT_CONNECT;
-
-	return hci_le_create_conn_sync(hdev, conn);
-}
-
 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 				u8 dst_type, bool dst_resolved, u8 sec_level,
-				u16 conn_timeout, u8 role)
+				u16 conn_timeout, u8 role, u8 phy, u8 sec_phy)
 {
 	struct hci_conn *conn;
 	struct smp_irk *irk;
@@ -1423,8 +1360,8 @@
 		bacpy(&conn->dst, dst);
 	} else {
 		conn = hci_conn_add_unset(hdev, LE_LINK, dst, role);
-		if (!conn)
-			return ERR_PTR(-ENOMEM);
+		if (IS_ERR(conn))
+			return conn;
 		hci_conn_hold(conn);
 		conn->pending_sec_level = sec_level;
 	}
@@ -1432,10 +1369,10 @@
 	conn->dst_type = dst_type;
 	conn->sec_level = BT_SECURITY_LOW;
 	conn->conn_timeout = conn_timeout;
+	conn->le_adv_phy = phy;
+	conn->le_adv_sec_phy = sec_phy;
 
-	err = hci_cmd_sync_queue(hdev, hci_connect_le_sync,
-				 UINT_PTR(conn->handle),
-				 create_le_conn_complete);
+	err = hci_connect_le_sync(hdev, conn);
 	if (err) {
 		hci_conn_del(conn);
 		return ERR_PTR(err);
@@ -1600,8 +1537,8 @@
 		return ERR_PTR(-EADDRINUSE);
 
 	conn = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
-	if (!conn)
-		return ERR_PTR(-ENOMEM);
+	if (IS_ERR(conn))
+		return conn;
 
 	conn->state = BT_CONNECT;
 
@@ -1644,8 +1581,8 @@
 	BT_DBG("requesting refresh of dst_addr");
 
 	conn = hci_conn_add_unset(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
-	if (!conn)
-		return ERR_PTR(-ENOMEM);
+	if (IS_ERR(conn))
+		return conn;
 
 	if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
 		hci_conn_del(conn);
@@ -1669,7 +1606,7 @@
 
 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 				 u8 sec_level, u8 auth_type,
-				 enum conn_reasons conn_reason)
+				 enum conn_reasons conn_reason, u16 timeout)
 {
 	struct hci_conn *acl;
 
@@ -1692,18 +1629,26 @@
 	acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 	if (!acl) {
 		acl = hci_conn_add_unset(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
-		if (!acl)
-			return ERR_PTR(-ENOMEM);
+		if (IS_ERR(acl))
+			return acl;
 	}
 
 	hci_conn_hold(acl);
 
 	acl->conn_reason = conn_reason;
 	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
+		int err;
+
 		acl->sec_level = BT_SECURITY_LOW;
 		acl->pending_sec_level = sec_level;
 		acl->auth_type = auth_type;
-		hci_acl_create_connection(acl);
+		acl->conn_timeout = timeout;
+
+		err = hci_connect_acl_sync(hdev, acl);
+		if (err) {
+			hci_conn_del(acl);
+			return ERR_PTR(err);
+		}
 	}
 
 	return acl;
@@ -1738,23 +1683,24 @@
 }
 
 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
-				 __u16 setting, struct bt_codec *codec)
+				 __u16 setting, struct bt_codec *codec,
+				 u16 timeout)
 {
 	struct hci_conn *acl;
 	struct hci_conn *sco;
 	struct hci_link *link;
 
 	acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
-			      CONN_REASON_SCO_CONNECT);
+			      CONN_REASON_SCO_CONNECT, timeout);
 	if (IS_ERR(acl))
 		return acl;
 
 	sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 	if (!sco) {
 		sco = hci_conn_add_unset(hdev, type, dst, HCI_ROLE_MASTER);
-		if (!sco) {
+		if (IS_ERR(sco)) {
 			hci_conn_drop(acl);
-			return ERR_PTR(-ENOMEM);
+			return sco;
 		}
 	}
 
@@ -1944,8 +1890,8 @@
 				       qos->ucast.cis);
 	if (!cis) {
 		cis = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
-		if (!cis)
-			return ERR_PTR(-ENOMEM);
+		if (IS_ERR(cis))
+			return cis;
 		cis->cleanup = cis_cleanup;
 		cis->dst_type = dst_type;
 		cis->iso_qos.ucast.cig = BT_ISO_QOS_CIG_UNSET;
@@ -2080,14 +2026,8 @@
 			      struct bt_iso_io_qos *qos, __u8 phy)
 {
 	/* Only set MTU if PHY is enabled */
-	if (!qos->sdu && qos->phy) {
-		if (hdev->iso_mtu > 0)
-			qos->sdu = hdev->iso_mtu;
-		else if (hdev->le_mtu > 0)
-			qos->sdu = hdev->le_mtu;
-		else
-			qos->sdu = hdev->acl_mtu;
-	}
+	if (!qos->sdu && qos->phy)
+		qos->sdu = conn->mtu;
 
 	/* Use the same PHY as ACL if set to any */
 	if (qos->phy == BT_ISO_PHY_ANY)
@@ -2131,89 +2071,225 @@
 
 static void create_pa_complete(struct hci_dev *hdev, void *data, int err)
 {
-	struct hci_cp_le_pa_create_sync *cp = data;
-
 	bt_dev_dbg(hdev, "");
 
 	if (err)
 		bt_dev_err(hdev, "Unable to create PA: %d", err);
+}
 
-	kfree(cp);
+static bool hci_conn_check_create_pa_sync(struct hci_conn *conn)
+{
+	if (conn->type != ISO_LINK || conn->sid == HCI_SID_INVALID)
+		return false;
+
+	return true;
 }
 
 static int create_pa_sync(struct hci_dev *hdev, void *data)
 {
-	struct hci_cp_le_pa_create_sync *cp = data;
-	int err;
+	struct hci_cp_le_pa_create_sync *cp = NULL;
+	struct hci_conn *conn;
+	int err = 0;
 
-	err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC,
-				    sizeof(*cp), cp, HCI_CMD_TIMEOUT);
-	if (err) {
-		hci_dev_clear_flag(hdev, HCI_PA_SYNC);
-		return err;
+	hci_dev_lock(hdev);
+
+	rcu_read_lock();
+
+	/* The spec allows only one pending LE Periodic Advertising Create
+	 * Sync command at a time. If the command is pending now, don't do
+	 * anything. We check for pending connections after each PA Sync
+	 * Established event.
+	 *
+	 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
+	 * page 2493:
+	 *
+	 * If the Host issues this command when another HCI_LE_Periodic_
+	 * Advertising_Create_Sync command is pending, the Controller shall
+	 * return the error code Command Disallowed (0x0C).
+	 */
+	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
+		if (test_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags))
+			goto unlock;
 	}
 
-	return hci_update_passive_scan_sync(hdev);
+	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
+		if (hci_conn_check_create_pa_sync(conn)) {
+			struct bt_iso_qos *qos = &conn->iso_qos;
+
+			cp = kzalloc(sizeof(*cp), GFP_KERNEL);
+			if (!cp) {
+				err = -ENOMEM;
+				goto unlock;
+			}
+
+			cp->options = qos->bcast.options;
+			cp->sid = conn->sid;
+			cp->addr_type = conn->dst_type;
+			bacpy(&cp->addr, &conn->dst);
+			cp->skip = cpu_to_le16(qos->bcast.skip);
+			cp->sync_timeout = cpu_to_le16(qos->bcast.sync_timeout);
+			cp->sync_cte_type = qos->bcast.sync_cte_type;
+
+			break;
+		}
+	}
+
+unlock:
+	rcu_read_unlock();
+
+	hci_dev_unlock(hdev);
+
+	if (cp) {
+		hci_dev_set_flag(hdev, HCI_PA_SYNC);
+		set_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags);
+
+		err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC,
+					    sizeof(*cp), cp, HCI_CMD_TIMEOUT);
+		if (!err)
+			err = hci_update_passive_scan_sync(hdev);
+
+		kfree(cp);
+
+		if (err) {
+			hci_dev_clear_flag(hdev, HCI_PA_SYNC);
+			clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags);
+		}
+	}
+
+	return err;
 }
 
-int hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst, __u8 dst_type,
-		       __u8 sid, struct bt_iso_qos *qos)
+int hci_pa_create_sync_pending(struct hci_dev *hdev)
 {
-	struct hci_cp_le_pa_create_sync *cp;
+	/* Queue start pa_create_sync and scan */
+	return hci_cmd_sync_queue(hdev, create_pa_sync,
+				  NULL, create_pa_complete);
+}
 
-	if (hci_dev_test_and_set_flag(hdev, HCI_PA_SYNC))
-		return -EBUSY;
+struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
+				    __u8 dst_type, __u8 sid,
+				    struct bt_iso_qos *qos)
+{
+	struct hci_conn *conn;
 
-	cp = kzalloc(sizeof(*cp), GFP_KERNEL);
-	if (!cp) {
-		hci_dev_clear_flag(hdev, HCI_PA_SYNC);
-		return -ENOMEM;
+	conn = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_SLAVE);
+	if (!conn)
+		return ERR_PTR(-ENOMEM);
+
+	conn->iso_qos = *qos;
+	conn->dst_type = dst_type;
+	conn->sid = sid;
+	conn->state = BT_LISTEN;
+
+	hci_conn_hold(conn);
+
+	hci_pa_create_sync_pending(hdev);
+
+	return conn;
+}
+
+static bool hci_conn_check_create_big_sync(struct hci_conn *conn)
+{
+	if (!conn->num_bis)
+		return false;
+
+	return true;
+}
+
+static void big_create_sync_complete(struct hci_dev *hdev, void *data, int err)
+{
+	bt_dev_dbg(hdev, "");
+
+	if (err)
+		bt_dev_err(hdev, "Unable to create BIG sync: %d", err);
+}
+
+static int big_create_sync(struct hci_dev *hdev, void *data)
+{
+	DEFINE_FLEX(struct hci_cp_le_big_create_sync, pdu, bis, num_bis, 0x11);
+	struct hci_conn *conn;
+
+	rcu_read_lock();
+
+	pdu->num_bis = 0;
+
+	/* The spec allows only one pending LE BIG Create Sync command at
+	 * a time. If the command is pending now, don't do anything. We
+	 * check for pending connections after each BIG Sync Established
+	 * event.
+	 *
+	 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
+	 * page 2586:
+	 *
+	 * If the Host sends this command when the Controller is in the
+	 * process of synchronizing to any BIG, i.e. the HCI_LE_BIG_Sync_
+	 * Established event has not been generated, the Controller shall
+	 * return the error code Command Disallowed (0x0C).
+	 */
+	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
+		if (test_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags))
+			goto unlock;
 	}
 
-	cp->options = qos->bcast.options;
-	cp->sid = sid;
-	cp->addr_type = dst_type;
-	bacpy(&cp->addr, dst);
-	cp->skip = cpu_to_le16(qos->bcast.skip);
-	cp->sync_timeout = cpu_to_le16(qos->bcast.sync_timeout);
-	cp->sync_cte_type = qos->bcast.sync_cte_type;
+	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
+		if (hci_conn_check_create_big_sync(conn)) {
+			struct bt_iso_qos *qos = &conn->iso_qos;
 
-	/* Queue start pa_create_sync and scan */
-	return hci_cmd_sync_queue(hdev, create_pa_sync, cp, create_pa_complete);
+			set_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags);
+
+			pdu->handle = qos->bcast.big;
+			pdu->sync_handle = cpu_to_le16(conn->sync_handle);
+			pdu->encryption = qos->bcast.encryption;
+			memcpy(pdu->bcode, qos->bcast.bcode,
+			       sizeof(pdu->bcode));
+			pdu->mse = qos->bcast.mse;
+			pdu->timeout = cpu_to_le16(qos->bcast.timeout);
+			pdu->num_bis = conn->num_bis;
+			memcpy(pdu->bis, conn->bis, conn->num_bis);
+
+			break;
+		}
+	}
+
+unlock:
+	rcu_read_unlock();
+
+	if (!pdu->num_bis)
+		return 0;
+
+	return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC,
+			    struct_size(pdu, bis, pdu->num_bis), pdu);
+}
+
+int hci_le_big_create_sync_pending(struct hci_dev *hdev)
+{
+	/* Queue big_create_sync */
+	return hci_cmd_sync_queue_once(hdev, big_create_sync,
+				       NULL, big_create_sync_complete);
 }
 
 int hci_le_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
 			   struct bt_iso_qos *qos,
 			   __u16 sync_handle, __u8 num_bis, __u8 bis[])
 {
-	struct _packed {
-		struct hci_cp_le_big_create_sync cp;
-		__u8  bis[0x11];
-	} pdu;
 	int err;
 
-	if (num_bis < 0x01 || num_bis > sizeof(pdu.bis))
+	if (num_bis < 0x01 || num_bis > ISO_MAX_NUM_BIS)
 		return -EINVAL;
 
 	err = qos_set_big(hdev, qos);
 	if (err)
 		return err;
 
-	if (hcon)
-		hcon->iso_qos.bcast.big = qos->bcast.big;
+	if (hcon) {
+		/* Update hcon QoS */
+		hcon->iso_qos = *qos;
 
-	memset(&pdu, 0, sizeof(pdu));
-	pdu.cp.handle = qos->bcast.big;
-	pdu.cp.sync_handle = cpu_to_le16(sync_handle);
-	pdu.cp.encryption = qos->bcast.encryption;
-	memcpy(pdu.cp.bcode, qos->bcast.bcode, sizeof(pdu.cp.bcode));
-	pdu.cp.mse = qos->bcast.mse;
-	pdu.cp.timeout = cpu_to_le16(qos->bcast.timeout);
-	pdu.cp.num_bis = num_bis;
-	memcpy(pdu.bis, bis, num_bis);
+		hcon->num_bis = num_bis;
+		memcpy(hcon->bis, bis, num_bis);
+	}
 
-	return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC,
-			    sizeof(pdu.cp) + num_bis, &pdu);
+	return hci_le_big_create_sync_pending(hdev);
 }
 
 static void create_big_complete(struct hci_dev *hdev, void *data, int err)
@@ -2277,13 +2353,9 @@
 					  conn->iso_qos.bcast.big);
 	if (parent && parent != conn) {
 		link = hci_conn_link(parent, conn);
-		if (!link) {
-			hci_conn_drop(conn);
-			return ERR_PTR(-ENOLINK);
-		}
-
-		/* Link takes the refcount */
 		hci_conn_drop(conn);
+		if (!link)
+			return ERR_PTR(-ENOLINK);
 	}
 
 	return conn;
@@ -2352,7 +2424,7 @@
 		le = hci_connect_le(hdev, dst, dst_type, false,
 				    BT_SECURITY_LOW,
 				    HCI_LE_CONN_TIMEOUT,
-				    HCI_ROLE_SLAVE);
+				    HCI_ROLE_SLAVE, 0, 0);
 	else
 		le = hci_connect_le_scan(hdev, dst, dst_type,
 					 BT_SECURITY_LOW,
@@ -2373,15 +2445,12 @@
 	}
 
 	link = hci_conn_link(le, cis);
+	hci_conn_drop(cis);
 	if (!link) {
 		hci_conn_drop(le);
-		hci_conn_drop(cis);
 		return ERR_PTR(-ENOLINK);
 	}
 
-	/* Link takes the refcount */
-	hci_conn_drop(cis);
-
 	cis->state = BT_CONNECT;
 
 	hci_le_create_cis_pending(hdev);
@@ -2647,22 +2716,6 @@
 	}
 }
 
-/* Check pending connect attempts */
-void hci_conn_check_pending(struct hci_dev *hdev)
-{
-	struct hci_conn *conn;
-
-	BT_DBG("hdev %s", hdev->name);
-
-	hci_dev_lock(hdev);
-
-	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
-	if (conn)
-		hci_acl_create_connection(conn);
-
-	hci_dev_unlock(hdev);
-}
-
 static u32 get_link_mode(struct hci_conn *conn)
 {
 	u32 link_mode = 0;
@@ -2978,12 +3031,10 @@
 
 static int abort_conn_sync(struct hci_dev *hdev, void *data)
 {
-	struct hci_conn *conn;
-	u16 handle = PTR_UINT(data);
+	struct hci_conn *conn = data;
 
-	conn = hci_conn_hash_lookup_handle(hdev, handle);
-	if (!conn)
-		return 0;
+	if (!hci_conn_valid(hdev, conn))
+		return -ECANCELED;
 
 	return hci_abort_conn_sync(hdev, conn, conn->abort_reason);
 }
@@ -3011,14 +3062,21 @@
 	 */
 	if (conn->state == BT_CONNECT && hdev->req_status == HCI_REQ_PEND) {
 		switch (hci_skb_event(hdev->sent_cmd)) {
+		case HCI_EV_CONN_COMPLETE:
 		case HCI_EV_LE_CONN_COMPLETE:
 		case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
 		case HCI_EVT_LE_CIS_ESTABLISHED:
-			hci_cmd_sync_cancel(hdev, -ECANCELED);
+			hci_cmd_sync_cancel(hdev, ECANCELED);
 			break;
 		}
+	/* Cancel connect attempt if still queued/pending */
+	} else if (!hci_cancel_connect_sync(hdev, conn)) {
+		return 0;
 	}
 
-	return hci_cmd_sync_queue(hdev, abort_conn_sync, UINT_PTR(conn->handle),
-				  NULL);
+	/* Run immediately if on cmd_sync_work since this may be called
+	 * as a result to MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR which does
+	 * already queue its callback on cmd_sync_work.
+	 */
+	return hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
 }
--- linux-qcom-6.8.0.orig/net/bluetooth/hci_core.c
+++ linux-qcom-6.8.0/net/bluetooth/hci_core.c
@@ -63,50 +63,6 @@
 /* HCI ID Numbering */
 static DEFINE_IDA(hci_index_ida);
 
-static int hci_scan_req(struct hci_request *req, unsigned long opt)
-{
-	__u8 scan = opt;
-
-	BT_DBG("%s %x", req->hdev->name, scan);
-
-	/* Inquiry and Page scans */
-	hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
-	return 0;
-}
-
-static int hci_auth_req(struct hci_request *req, unsigned long opt)
-{
-	__u8 auth = opt;
-
-	BT_DBG("%s %x", req->hdev->name, auth);
-
-	/* Authentication */
-	hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
-	return 0;
-}
-
-static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
-{
-	__u8 encrypt = opt;
-
-	BT_DBG("%s %x", req->hdev->name, encrypt);
-
-	/* Encryption */
-	hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
-	return 0;
-}
-
-static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
-{
-	__le16 policy = cpu_to_le16(opt);
-
-	BT_DBG("%s %x", req->hdev->name, policy);
-
-	/* Default link policy */
-	hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
-	return 0;
-}
-
 /* Get HCI device by index.
  * Device is held on return. */
 struct hci_dev *hci_dev_get(int index)
@@ -395,11 +351,6 @@
 		goto done;
 	}
 
-	if (hdev->dev_type != HCI_PRIMARY) {
-		err = -EOPNOTSUPP;
-		goto done;
-	}
-
 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
 		err = -EOPNOTSUPP;
 		goto done;
@@ -733,6 +684,7 @@
 {
 	struct hci_dev *hdev;
 	struct hci_dev_req dr;
+	__le16 policy;
 	int err = 0;
 
 	if (copy_from_user(&dr, arg, sizeof(dr)))
@@ -752,11 +704,6 @@
 		goto done;
 	}
 
-	if (hdev->dev_type != HCI_PRIMARY) {
-		err = -EOPNOTSUPP;
-		goto done;
-	}
-
 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
 		err = -EOPNOTSUPP;
 		goto done;
@@ -764,8 +711,8 @@
 
 	switch (cmd) {
 	case HCISETAUTH:
-		err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
-				   HCI_INIT_TIMEOUT, NULL);
+		err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE,
+					  1, &dr.dev_opt, HCI_CMD_TIMEOUT);
 		break;
 
 	case HCISETENCRYPT:
@@ -776,19 +723,21 @@
 
 		if (!test_bit(HCI_AUTH, &hdev->flags)) {
 			/* Auth must be enabled first */
-			err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
-					   HCI_INIT_TIMEOUT, NULL);
+			err = hci_cmd_sync_status(hdev,
+						  HCI_OP_WRITE_AUTH_ENABLE,
+						  1, &dr.dev_opt,
+						  HCI_CMD_TIMEOUT);
 			if (err)
 				break;
 		}
 
-		err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
-				   HCI_INIT_TIMEOUT, NULL);
+		err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_ENCRYPT_MODE,
+					  1, &dr.dev_opt, HCI_CMD_TIMEOUT);
 		break;
 
 	case HCISETSCAN:
-		err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
-				   HCI_INIT_TIMEOUT, NULL);
+		err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE,
+					  1, &dr.dev_opt, HCI_CMD_TIMEOUT);
 
 		/* Ensure that the connectable and discoverable states
 		 * get correctly modified as this was a non-mgmt change.
@@ -798,8 +747,10 @@
 		break;
 
 	case HCISETLINKPOL:
-		err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
-				   HCI_INIT_TIMEOUT, NULL);
+		policy = cpu_to_le16(dr.dev_opt);
+
+		err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
+					  2, &policy, HCI_CMD_TIMEOUT);
 		break;
 
 	case HCISETLINKMODE:
@@ -908,9 +859,9 @@
 	else
 		flags = hdev->flags;
 
-	strcpy(di.name, hdev->name);
+	strscpy(di.name, hdev->name, sizeof(di.name));
 	di.bdaddr   = hdev->bdaddr;
-	di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
+	di.type     = (hdev->bus & 0x0f);
 	di.flags    = flags;
 	di.pkt_type = hdev->pkt_type;
 	if (lmp_bredr_capable(hdev)) {
@@ -995,8 +946,7 @@
 	 */
 	if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
 	    hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
-	    (hdev->dev_type == HCI_PRIMARY &&
-	     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
+	    (!bacmp(&hdev->bdaddr, BDADDR_ANY) &&
 	     !bacmp(&hdev->static_addr, BDADDR_ANY))) {
 		hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
 		hci_dev_do_close(hdev);
@@ -1491,11 +1441,12 @@
 	struct hci_dev *hdev = container_of(work, struct hci_dev,
 					    cmd_timer.work);
 
-	if (hdev->sent_cmd) {
-		struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
-		u16 opcode = __le16_to_cpu(sent->opcode);
+	if (hdev->req_skb) {
+		u16 opcode = hci_skb_opcode(hdev->req_skb);
 
 		bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
+
+		hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT);
 	} else {
 		bt_dev_err(hdev, "command tx timeout");
 	}
@@ -1737,6 +1688,15 @@
 
 		adv->pending = true;
 		adv->instance = instance;
+
+		/* If controller support only one set and the instance is set to
+		 * 1 then there is no option other than using handle 0x00.
+		 */
+		if (hdev->le_num_of_adv_sets == 1 && instance == 1)
+			adv->handle = 0x00;
+		else
+			adv->handle = instance;
+
 		list_add(&adv->list, &hdev->adv_instances);
 		hdev->adv_instance_cnt++;
 	}
@@ -2440,10 +2400,16 @@
 	/* To avoid a potential race with hci_unregister_dev. */
 	hci_dev_hold(hdev);
 
-	if (action == PM_SUSPEND_PREPARE)
+	switch (action) {
+	case PM_HIBERNATION_PREPARE:
+	case PM_SUSPEND_PREPARE:
 		ret = hci_suspend_dev(hdev);
-	else if (action == PM_POST_SUSPEND)
+		break;
+	case PM_POST_HIBERNATION:
+	case PM_POST_SUSPEND:
 		ret = hci_resume_dev(hdev);
+		break;
+	}
 
 	if (ret)
 		bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
@@ -2603,20 +2569,7 @@
 	if (!hdev->open || !hdev->close || !hdev->send)
 		return -EINVAL;
 
-	/* Do not allow HCI_AMP devices to register at index 0,
-	 * so the index can be used as the AMP controller ID.
-	 */
-	switch (hdev->dev_type) {
-	case HCI_PRIMARY:
-		id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
-		break;
-	case HCI_AMP:
-		id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
-		break;
-	default:
-		return -EINVAL;
-	}
-
+	id = ida_alloc_max(&hci_index_ida, HCI_MAX_ID - 1, GFP_KERNEL);
 	if (id < 0)
 		return id;
 
@@ -2668,12 +2621,10 @@
 	hci_dev_set_flag(hdev, HCI_SETUP);
 	hci_dev_set_flag(hdev, HCI_AUTO_OFF);
 
-	if (hdev->dev_type == HCI_PRIMARY) {
-		/* Assume BR/EDR support until proven otherwise (such as
-		 * through reading supported features during init.
-		 */
-		hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
-	}
+	/* Assume BR/EDR support until proven otherwise (such as
+	 * through reading supported features during init.
+	 */
+	hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
 
 	write_lock(&hci_dev_list_lock);
 	list_add(&hdev->list, &hci_dev_list);
@@ -2710,7 +2661,7 @@
 	destroy_workqueue(hdev->workqueue);
 	destroy_workqueue(hdev->req_workqueue);
 err:
-	ida_simple_remove(&hci_index_ida, hdev->id);
+	ida_free(&hci_index_ida, hdev->id);
 
 	return error;
 }
@@ -2729,14 +2680,16 @@
 	list_del(&hdev->list);
 	write_unlock(&hci_dev_list_lock);
 
+	cancel_work_sync(&hdev->rx_work);
+	cancel_work_sync(&hdev->cmd_work);
+	cancel_work_sync(&hdev->tx_work);
 	cancel_work_sync(&hdev->power_on);
+	cancel_work_sync(&hdev->error_reset);
 
 	hci_cmd_sync_clear(hdev);
 
 	hci_unregister_suspend_notifier(hdev);
 
-	msft_unregister(hdev);
-
 	hci_dev_do_close(hdev);
 
 	if (!test_bit(HCI_INIT, &hdev->flags) &&
@@ -2790,11 +2743,13 @@
 	hci_discovery_filter_clear(hdev);
 	hci_blocked_keys_clear(hdev);
 	hci_codec_list_clear(&hdev->local_codecs);
+	msft_release(hdev);
 	hci_dev_unlock(hdev);
 
 	ida_destroy(&hdev->unset_handle_ida);
-	ida_simple_remove(&hci_index_ida, hdev->id);
+	ida_free(&hci_index_ida, hdev->id);
 	kfree_skb(hdev->sent_cmd);
+	kfree_skb(hdev->req_skb);
 	kfree_skb(hdev->recv_event);
 	kfree(hdev);
 }
@@ -2826,6 +2781,23 @@
 	return ret;
 }
 
+/* Cancel ongoing command synchronously:
+ *
+ * - Cancel command timer
+ * - Reset command counter
+ * - Cancel command request
+ */
+static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err)
+{
+	bt_dev_dbg(hdev, "err 0x%2.2x", err);
+
+	cancel_delayed_work_sync(&hdev->cmd_timer);
+	cancel_delayed_work_sync(&hdev->ncmd_timer);
+	atomic_set(&hdev->cmd_cnt, 1);
+
+	hci_cmd_sync_cancel_sync(hdev, err);
+}
+
 /* Suspend HCI device */
 int hci_suspend_dev(struct hci_dev *hdev)
 {
@@ -2843,7 +2815,7 @@
 		return 0;
 
 	/* Cancel potentially blocking sync operation before suspend */
-	__hci_cmd_sync_cancel(hdev, -EHOSTDOWN);
+	hci_cancel_cmd_sync(hdev, EHOSTDOWN);
 
 	hci_req_sync_lock(hdev);
 	ret = hci_suspend_sync(hdev);
@@ -3107,21 +3079,33 @@
 EXPORT_SYMBOL(__hci_cmd_send);
 
 /* Get data from the previously sent command */
-void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
+static void *hci_cmd_data(struct sk_buff *skb, __u16 opcode)
 {
 	struct hci_command_hdr *hdr;
 
-	if (!hdev->sent_cmd)
+	if (!skb || skb->len < HCI_COMMAND_HDR_SIZE)
 		return NULL;
 
-	hdr = (void *) hdev->sent_cmd->data;
+	hdr = (void *)skb->data;
 
 	if (hdr->opcode != cpu_to_le16(opcode))
 		return NULL;
 
-	BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
+	return skb->data + HCI_COMMAND_HDR_SIZE;
+}
+
+/* Get data from the previously sent command */
+void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
+{
+	void *data;
 
-	return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
+	/* Check if opcode matches last sent command */
+	data = hci_cmd_data(hdev->sent_cmd, opcode);
+	if (!data)
+		/* Check if opcode matches last request */
+		data = hci_cmd_data(hdev->req_skb, opcode);
+
+	return data;
 }
 
 /* Get data from last received event */
@@ -3180,17 +3164,7 @@
 
 	hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
 
-	switch (hdev->dev_type) {
-	case HCI_PRIMARY:
-		hci_add_acl_hdr(skb, conn->handle, flags);
-		break;
-	case HCI_AMP:
-		hci_add_acl_hdr(skb, chan->handle, flags);
-		break;
-	default:
-		bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
-		return;
-	}
+	hci_add_acl_hdr(skb, conn->handle, flags);
 
 	list = skb_shinfo(skb)->frag_list;
 	if (!list) {
@@ -3350,9 +3324,6 @@
 	case ACL_LINK:
 		cnt = hdev->acl_cnt;
 		break;
-	case AMP_LINK:
-		cnt = hdev->block_cnt;
-		break;
 	case SCO_LINK:
 	case ESCO_LINK:
 		cnt = hdev->sco_cnt;
@@ -3550,12 +3521,6 @@
 
 }
 
-static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
-{
-	/* Calculate count of blocks used by this packet */
-	return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
-}
-
 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
 {
 	unsigned long last_tx;
@@ -3669,100 +3634,34 @@
 		hci_prio_recalculate(hdev, ACL_LINK);
 }
 
-static void hci_sched_acl_blk(struct hci_dev *hdev)
-{
-	unsigned int cnt = hdev->block_cnt;
-	struct hci_chan *chan;
-	struct sk_buff *skb;
-	int quote;
-	u8 type;
-
-	BT_DBG("%s", hdev->name);
-
-	if (hdev->dev_type == HCI_AMP)
-		type = AMP_LINK;
-	else
-		type = ACL_LINK;
-
-	__check_timeout(hdev, cnt, type);
-
-	while (hdev->block_cnt > 0 &&
-	       (chan = hci_chan_sent(hdev, type, &quote))) {
-		u32 priority = (skb_peek(&chan->data_q))->priority;
-		while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
-			int blocks;
-
-			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
-			       skb->len, skb->priority);
-
-			/* Stop if priority has changed */
-			if (skb->priority < priority)
-				break;
-
-			skb = skb_dequeue(&chan->data_q);
-
-			blocks = __get_blocks(hdev, skb);
-			if (blocks > hdev->block_cnt)
-				return;
-
-			hci_conn_enter_active_mode(chan->conn,
-						   bt_cb(skb)->force_active);
-
-			hci_send_frame(hdev, skb);
-			hdev->acl_last_tx = jiffies;
-
-			hdev->block_cnt -= blocks;
-			quote -= blocks;
-
-			chan->sent += blocks;
-			chan->conn->sent += blocks;
-		}
-	}
-
-	if (cnt != hdev->block_cnt)
-		hci_prio_recalculate(hdev, type);
-}
-
 static void hci_sched_acl(struct hci_dev *hdev)
 {
 	BT_DBG("%s", hdev->name);
 
 	/* No ACL link over BR/EDR controller */
-	if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
+	if (!hci_conn_num(hdev, ACL_LINK))
 		return;
 
-	/* No AMP link over AMP controller */
-	if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
-		return;
-
-	switch (hdev->flow_ctl_mode) {
-	case HCI_FLOW_CTL_MODE_PACKET_BASED:
-		hci_sched_acl_pkt(hdev);
-		break;
-
-	case HCI_FLOW_CTL_MODE_BLOCK_BASED:
-		hci_sched_acl_blk(hdev);
-		break;
-	}
+	hci_sched_acl_pkt(hdev);
 }
 
 static void hci_sched_le(struct hci_dev *hdev)
 {
 	struct hci_chan *chan;
 	struct sk_buff *skb;
-	int quote, cnt, tmp;
+	int quote, *cnt, tmp;
 
 	BT_DBG("%s", hdev->name);
 
 	if (!hci_conn_num(hdev, LE_LINK))
 		return;
 
-	cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
+	cnt = hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
 
-	__check_timeout(hdev, cnt, LE_LINK);
+	__check_timeout(hdev, *cnt, LE_LINK);
 
-	tmp = cnt;
-	while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
+	tmp = *cnt;
+	while (*cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
 		u32 priority = (skb_peek(&chan->data_q))->priority;
 		while (quote-- && (skb = skb_peek(&chan->data_q))) {
 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
@@ -3777,7 +3676,7 @@
 			hci_send_frame(hdev, skb);
 			hdev->le_last_tx = jiffies;
 
-			cnt--;
+			(*cnt)--;
 			chan->sent++;
 			chan->conn->sent++;
 
@@ -3787,12 +3686,7 @@
 		}
 	}
 
-	if (hdev->le_pkts)
-		hdev->le_cnt = cnt;
-	else
-		hdev->acl_cnt = cnt;
-
-	if (cnt != tmp)
+	if (*cnt != tmp)
 		hci_prio_recalculate(hdev, LE_LINK);
 }
 
@@ -3850,18 +3744,22 @@
 /* ACL data packet */
 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 {
-	struct hci_acl_hdr *hdr = (void *) skb->data;
+	struct hci_acl_hdr *hdr;
 	struct hci_conn *conn;
 	__u16 handle, flags;
 
-	skb_pull(skb, HCI_ACL_HDR_SIZE);
+	hdr = skb_pull_data(skb, sizeof(*hdr));
+	if (!hdr) {
+		bt_dev_err(hdev, "ACL packet too small");
+		goto drop;
+	}
 
 	handle = __le16_to_cpu(hdr->handle);
 	flags  = hci_flags(handle);
 	handle = hci_handle(handle);
 
-	BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
-	       handle, flags);
+	bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
+		   handle, flags);
 
 	hdev->stat.acl_rx++;
 
@@ -3880,6 +3778,7 @@
 			   handle);
 	}
 
+drop:
 	kfree_skb(skb);
 }
 
@@ -4022,17 +3921,19 @@
 	if (!status && !hci_req_is_complete(hdev))
 		return;
 
+	skb = hdev->req_skb;
+
 	/* If this was the last command in a request the complete
-	 * callback would be found in hdev->sent_cmd instead of the
+	 * callback would be found in hdev->req_skb instead of the
 	 * command queue (hdev->cmd_q).
 	 */
-	if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
-		*req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
+	if (skb && bt_cb(skb)->hci.req_flags & HCI_REQ_SKB) {
+		*req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
 		return;
 	}
 
-	if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
-		*req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
+	if (skb && bt_cb(skb)->hci.req_complete) {
+		*req_complete = bt_cb(skb)->hci.req_complete;
 		return;
 	}
 
@@ -4128,6 +4029,36 @@
 	}
 }
 
+static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
+{
+	int err;
+
+	bt_dev_dbg(hdev, "skb %p", skb);
+
+	kfree_skb(hdev->sent_cmd);
+
+	hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
+	if (!hdev->sent_cmd) {
+		skb_queue_head(&hdev->cmd_q, skb);
+		queue_work(hdev->workqueue, &hdev->cmd_work);
+		return;
+	}
+
+	err = hci_send_frame(hdev, skb);
+	if (err < 0) {
+		hci_cmd_sync_cancel_sync(hdev, -err);
+		return;
+	}
+
+	if (hci_req_status_pend(hdev) &&
+	    !hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) {
+		kfree_skb(hdev->req_skb);
+		hdev->req_skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
+	}
+
+	atomic_dec(&hdev->cmd_cnt);
+}
+
 static void hci_cmd_work(struct work_struct *work)
 {
 	struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
@@ -4142,30 +4073,15 @@
 		if (!skb)
 			return;
 
-		kfree_skb(hdev->sent_cmd);
-
-		hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
-		if (hdev->sent_cmd) {
-			int res;
-			if (hci_req_status_pend(hdev))
-				hci_dev_set_flag(hdev, HCI_CMD_PENDING);
-			atomic_dec(&hdev->cmd_cnt);
-
-			res = hci_send_frame(hdev, skb);
-			if (res < 0)
-				__hci_cmd_sync_cancel(hdev, -res);
+		hci_send_cmd_sync(hdev, skb);
 
-			rcu_read_lock();
-			if (test_bit(HCI_RESET, &hdev->flags) ||
-			    hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
-				cancel_delayed_work(&hdev->cmd_timer);
-			else
-				queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
-						   HCI_CMD_TIMEOUT);
-			rcu_read_unlock();
-		} else {
-			skb_queue_head(&hdev->cmd_q, skb);
-			queue_work(hdev->workqueue, &hdev->cmd_work);
-		}
+		rcu_read_lock();
+		if (test_bit(HCI_RESET, &hdev->flags) ||
+		    hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
+			cancel_delayed_work(&hdev->cmd_timer);
+		else
+			queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
+					   HCI_CMD_TIMEOUT);
+		rcu_read_unlock();
 	}
 }
--- linux-qcom-6.8.0.orig/net/bluetooth/hci_debugfs.c
+++ linux-qcom-6.8.0/net/bluetooth/hci_debugfs.c
@@ -218,10 +218,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val > hdev->conn_info_max_age)
+	hci_dev_lock(hdev);
+	if (val == 0 || val > hdev->conn_info_max_age) {
+		hci_dev_unlock(hdev);
 		return -EINVAL;
+	}
 
-	hci_dev_lock(hdev);
 	hdev->conn_info_min_age = val;
 	hci_dev_unlock(hdev);
 
@@ -246,10 +248,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val < hdev->conn_info_min_age)
+	hci_dev_lock(hdev);
+	if (val == 0 || val < hdev->conn_info_min_age) {
+		hci_dev_unlock(hdev);
 		return -EINVAL;
+	}
 
-	hci_dev_lock(hdev);
 	hdev->conn_info_max_age = val;
 	hci_dev_unlock(hdev);
 
@@ -567,10 +571,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
+	hci_dev_lock(hdev);
+	if (val == 0 || val % 2 || val > hdev->sniff_max_interval) {
+		hci_dev_unlock(hdev);
 		return -EINVAL;
+	}
 
-	hci_dev_lock(hdev);
 	hdev->sniff_min_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -595,10 +601,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
+	hci_dev_lock(hdev);
+	if (val == 0 || val % 2 || val < hdev->sniff_min_interval) {
+		hci_dev_unlock(hdev);
 		return -EINVAL;
+	}
 
-	hci_dev_lock(hdev);
 	hdev->sniff_max_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -850,10 +858,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval)
+	hci_dev_lock(hdev);
+	if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval) {
+		hci_dev_unlock(hdev);
 		return -EINVAL;
+	}
 
-	hci_dev_lock(hdev);
 	hdev->le_conn_min_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -878,10 +888,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval)
+	hci_dev_lock(hdev);
+	if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval) {
+		hci_dev_unlock(hdev);
 		return -EINVAL;
+	}
 
-	hci_dev_lock(hdev);
 	hdev->le_conn_max_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -990,10 +1002,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0020 || val > 0x4000 || val > hdev->le_adv_max_interval)
+	hci_dev_lock(hdev);
+	if (val < 0x0020 || val > 0x4000 || val > hdev->le_adv_max_interval) {
+		hci_dev_unlock(hdev);
 		return -EINVAL;
+	}
 
-	hci_dev_lock(hdev);
 	hdev->le_adv_min_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -1018,10 +1032,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0020 || val > 0x4000 || val < hdev->le_adv_min_interval)
+	hci_dev_lock(hdev);
+	if (val < 0x0020 || val > 0x4000 || val < hdev->le_adv_min_interval) {
+		hci_dev_unlock(hdev);
 		return -EINVAL;
+	}
 
-	hci_dev_lock(hdev);
 	hdev->le_adv_max_interval = val;
 	hci_dev_unlock(hdev);
 
--- linux-qcom-6.8.0.orig/net/bluetooth/hci_event.c
+++ linux-qcom-6.8.0/net/bluetooth/hci_event.c
@@ -1,7 +1,7 @@
 /*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
-   Copyright 2023 NXP
+   Copyright 2023-2024 NXP
 
    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
 
@@ -36,8 +36,6 @@
 #include "hci_request.h"
 #include "hci_debugfs.h"
 #include "hci_codec.h"
-#include "a2mp.h"
-#include "amp.h"
 #include "smp.h"
 #include "msft.h"
 #include "eir.h"
@@ -95,11 +93,11 @@
 	/* It is possible that we receive Inquiry Complete event right
 	 * before we receive Inquiry Cancel Command Complete event, in
 	 * which case the latter event should have status of Command
-	 * Disallowed (0x0c). This should not be treated as error, since
+	 * Disallowed. This should not be treated as error, since
 	 * we actually achieve what Inquiry Cancel wants to achieve,
 	 * which is to end the last Inquiry session.
 	 */
-	if (rp->status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
+	if (rp->status == HCI_ERROR_COMMAND_DISALLOWED && !test_bit(HCI_INQUIRY, &hdev->flags)) {
 		bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
 		rp->status = 0x00;
 	}
@@ -120,8 +118,6 @@
 		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 	hci_dev_unlock(hdev);
 
-	hci_conn_check_pending(hdev);
-
 	return rp->status;
 }
 
@@ -152,8 +148,6 @@
 
 	hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 
-	hci_conn_check_pending(hdev);
-
 	return rp->status;
 }
 
@@ -919,21 +913,6 @@
 	return rp->status;
 }
 
-static u8 hci_cc_read_flow_control_mode(struct hci_dev *hdev, void *data,
-					struct sk_buff *skb)
-{
-	struct hci_rp_read_flow_control_mode *rp = data;
-
-	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
-
-	if (rp->status)
-		return rp->status;
-
-	hdev->flow_ctl_mode = rp->mode;
-
-	return rp->status;
-}
-
 static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data,
 				  struct sk_buff *skb)
 {
@@ -960,6 +939,9 @@
 	BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 	       hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 
+	if (!hdev->acl_mtu || !hdev->acl_pkts)
+		return HCI_ERROR_INVALID_PARAMETERS;
+
 	return rp->status;
 }
 
@@ -1074,28 +1056,6 @@
 	return rp->status;
 }
 
-static u8 hci_cc_read_data_block_size(struct hci_dev *hdev, void *data,
-				      struct sk_buff *skb)
-{
-	struct hci_rp_read_data_block_size *rp = data;
-
-	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
-
-	if (rp->status)
-		return rp->status;
-
-	hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
-	hdev->block_len = __le16_to_cpu(rp->block_len);
-	hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
-
-	hdev->block_cnt = hdev->num_blocks;
-
-	BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
-	       hdev->block_cnt, hdev->block_len);
-
-	return rp->status;
-}
-
 static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data,
 			    struct sk_buff *skb)
 {
@@ -1130,30 +1090,6 @@
 	return rp->status;
 }
 
-static u8 hci_cc_read_local_amp_info(struct hci_dev *hdev, void *data,
-				     struct sk_buff *skb)
-{
-	struct hci_rp_read_local_amp_info *rp = data;
-
-	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
-
-	if (rp->status)
-		return rp->status;
-
-	hdev->amp_status = rp->amp_status;
-	hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
-	hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
-	hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
-	hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
-	hdev->amp_type = rp->amp_type;
-	hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
-	hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
-	hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
-	hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
-
-	return rp->status;
-}
-
 static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data,
 				       struct sk_buff *skb)
 {
@@ -1269,6 +1205,9 @@
 
 	BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 
+	if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)
+		return HCI_ERROR_INVALID_PARAMETERS;
+
 	return rp->status;
 }
 
@@ -2314,10 +2253,8 @@
 {
 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
 
-	if (status) {
-		hci_conn_check_pending(hdev);
+	if (status)
 		return;
-	}
 
 	if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY))
 		set_bit(HCI_INQUIRY, &hdev->flags);
@@ -2342,19 +2279,16 @@
 
 	if (status) {
 		if (conn && conn->state == BT_CONNECT) {
-			if (status != 0x0c || conn->attempt > 2) {
-				conn->state = BT_CLOSED;
-				hci_connect_cfm(conn, status);
-				hci_conn_del(conn);
-			} else
-				conn->state = BT_CONNECT2;
+			conn->state = BT_CLOSED;
+			hci_connect_cfm(conn, status);
+			hci_conn_del(conn);
 		}
 	} else {
 		if (!conn) {
 			conn = hci_conn_add_unset(hdev, ACL_LINK, &cp->bdaddr,
 						  HCI_ROLE_MASTER);
-			if (!conn)
-				bt_dev_err(hdev, "no memory for new connection");
+			if (IS_ERR(conn))
+				bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
 		}
 	}
 
@@ -2526,9 +2460,7 @@
 	 * Only those in BT_CONFIG or BT_CONNECTED states can be
 	 * considered connected.
 	 */
-	if (conn &&
-	    (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
-	    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+	if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED))
 		mgmt_device_connected(hdev, conn, name, name_len);
 
 	if (discov->state == DISCOVERY_STOPPED)
@@ -3039,8 +2971,6 @@
 
 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
 
-	hci_conn_check_pending(hdev);
-
 	if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
 		return;
 
@@ -3169,8 +3099,8 @@
 						      BDADDR_BREDR)) {
 			conn = hci_conn_add_unset(hdev, ev->link_type,
 						  &ev->bdaddr, HCI_ROLE_SLAVE);
-			if (!conn) {
-				bt_dev_err(hdev, "no memory for new conn");
+			if (IS_ERR(conn)) {
+				bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
 				goto unlock;
 			}
 		} else {
@@ -3223,6 +3153,31 @@
 		if (test_bit(HCI_ENCRYPT, &hdev->flags))
 			set_bit(HCI_CONN_ENCRYPT, &conn->flags);
 
+		/* "Link key request" completed ahead of "connect request" completes */
+		if (ev->encr_mode == 1 && !test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
+		    ev->link_type == ACL_LINK) {
+			struct link_key *key;
+			struct hci_cp_read_enc_key_size cp;
+
+			key = hci_find_link_key(hdev, &ev->bdaddr);
+			if (key) {
+				set_bit(HCI_CONN_ENCRYPT, &conn->flags);
+
+				if (!read_key_size_capable(hdev)) {
+					conn->enc_key_size = HCI_LINK_KEY_SIZE;
+				} else {
+					cp.handle = cpu_to_le16(conn->handle);
+					if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
+							 sizeof(cp), &cp)) {
+						bt_dev_err(hdev, "sending read key size failed");
+						conn->enc_key_size = HCI_LINK_KEY_SIZE;
+					}
+				}
+
+				hci_encrypt_cfm(conn, ev->status);
+			}
+		}
+
 		/* Get remote features */
 		if (conn->type == ACL_LINK) {
 			struct hci_cp_read_remote_features cp;
@@ -3262,8 +3217,6 @@
 
 unlock:
 	hci_dev_unlock(hdev);
-
-	hci_conn_check_pending(hdev);
 }
 
 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
@@ -3335,8 +3288,8 @@
 	if (!conn) {
 		conn = hci_conn_add_unset(hdev, ev->link_type, &ev->bdaddr,
 					  HCI_ROLE_SLAVE);
-		if (!conn) {
-			bt_dev_err(hdev, "no memory for new connection");
+		if (IS_ERR(conn)) {
+			bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
 			goto unlock;
 		}
 	}
@@ -3556,8 +3509,6 @@
 
 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
 
-	hci_conn_check_pending(hdev);
-
 	hci_dev_lock(hdev);
 
 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
@@ -3660,7 +3611,7 @@
 		 * controller really supports it. If it doesn't, assume
 		 * the default size (16).
 		 */
-		if (!(hdev->commands[20] & 0x10)) {
+		if (!read_key_size_capable(hdev)) {
 			conn->enc_key_size = HCI_LINK_KEY_SIZE;
 			goto notify;
 		}
@@ -3676,6 +3627,13 @@
 		goto unlock;
 	}
 
+	/* We skip the WRITE_AUTH_PAYLOAD_TIMEOUT for ATS2851 based controllers
+	 * to avoid unexpected SMP command errors when pairing.
+	 */
+	if (test_bit(HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT,
+		     &hdev->quirks))
+		goto notify;
+
 	/* Set the default Authenticated Payload Timeout after
 	 * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
 	 * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
@@ -3756,14 +3714,15 @@
 		goto unlock;
 	}
 
-	if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
+	if (!ev->status) {
 		struct hci_cp_remote_name_req cp;
 		memset(&cp, 0, sizeof(cp));
 		bacpy(&cp.bdaddr, &conn->dst);
 		cp.pscan_rep_mode = 0x02;
 		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
-	} else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+	} else {
 		mgmt_device_connected(hdev, conn, NULL, 0);
+	}
 
 	if (!hci_outgoing_auth_needed(hdev, conn)) {
 		conn->state = BT_CONNECTED;
@@ -3814,6 +3773,9 @@
 	BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu,
 	       hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts);
 
+	if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)
+		return HCI_ERROR_INVALID_PARAMETERS;
+
 	return rp->status;
 }
 
@@ -3936,6 +3898,11 @@
 		 * last.
 		 */
 		hci_connect_cfm(conn, rp->status);
+
+		/* Notify device connected in case it is a BIG Sync */
+		if (!rp->status && test_bit(HCI_CONN_BIG_SYNC, &conn->flags))
+			mgmt_device_connected(hdev, conn, NULL, 0);
+
 		break;
 	}
 
@@ -4100,12 +4067,6 @@
 	HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type,
 	       sizeof(struct hci_rp_read_page_scan_type)),
 	HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type),
-	HCI_CC(HCI_OP_READ_DATA_BLOCK_SIZE, hci_cc_read_data_block_size,
-	       sizeof(struct hci_rp_read_data_block_size)),
-	HCI_CC(HCI_OP_READ_FLOW_CONTROL_MODE, hci_cc_read_flow_control_mode,
-	       sizeof(struct hci_rp_read_flow_control_mode)),
-	HCI_CC(HCI_OP_READ_LOCAL_AMP_INFO, hci_cc_read_local_amp_info,
-	       sizeof(struct hci_rp_read_local_amp_info)),
 	HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock,
 	       sizeof(struct hci_rp_read_clock)),
 	HCI_CC(HCI_OP_READ_ENC_KEY_SIZE, hci_cc_read_enc_key_size,
@@ -4296,7 +4257,7 @@
 	hci_dev_lock(hdev);
 
 	/* Remove connection if command failed */
-	for (i = 0; cp->num_cis; cp->num_cis--, i++) {
+	for (i = 0; i < cp->num_cis; i++) {
 		struct hci_conn *conn;
 		u16 handle;
 
@@ -4312,6 +4273,7 @@
 			hci_conn_del(conn);
 		}
 	}
+	cp->num_cis = 0;
 
 	if (pending)
 		hci_le_create_cis_pending(hdev);
@@ -4381,7 +4343,7 @@
 	 * (since for this kind of commands there will not be a command
 	 * complete event).
 	 */
-	if (ev->status || (hdev->sent_cmd && !hci_skb_event(hdev->sent_cmd))) {
+	if (ev->status || (hdev->req_skb && !hci_skb_event(hdev->req_skb))) {
 		hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
 				     req_complete_skb);
 		if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
@@ -4440,11 +4402,6 @@
 			     flex_array_size(ev, handles, ev->num)))
 		return;
 
-	if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
-		bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
-		return;
-	}
-
 	bt_dev_dbg(hdev, "num %d", ev->num);
 
 	for (i = 0; i < ev->num; i++) {
@@ -4512,78 +4469,6 @@
 	queue_work(hdev->workqueue, &hdev->tx_work);
 }
 
-static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
-						 __u16 handle)
-{
-	struct hci_chan *chan;
-
-	switch (hdev->dev_type) {
-	case HCI_PRIMARY:
-		return hci_conn_hash_lookup_handle(hdev, handle);
-	case HCI_AMP:
-		chan = hci_chan_lookup_handle(hdev, handle);
-		if (chan)
-			return chan->conn;
-		break;
-	default:
-		bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
-		break;
-	}
-
-	return NULL;
-}
-
-static void hci_num_comp_blocks_evt(struct hci_dev *hdev, void *data,
-				    struct sk_buff *skb)
-{
-	struct hci_ev_num_comp_blocks *ev = data;
-	int i;
-
-	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_BLOCKS,
-			     flex_array_size(ev, handles, ev->num_hndl)))
-		return;
-
-	if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
-		bt_dev_err(hdev, "wrong event for mode %d",
-			   hdev->flow_ctl_mode);
-		return;
-	}
-
-	bt_dev_dbg(hdev, "num_blocks %d num_hndl %d", ev->num_blocks,
-		   ev->num_hndl);
-
-	for (i = 0; i < ev->num_hndl; i++) {
-		struct hci_comp_blocks_info *info = &ev->handles[i];
-		struct hci_conn *conn = NULL;
-		__u16  handle, block_count;
-
-		handle = __le16_to_cpu(info->handle);
-		block_count = __le16_to_cpu(info->blocks);
-
-		conn = __hci_conn_lookup_handle(hdev, handle);
-		if (!conn)
-			continue;
-
-		conn->sent -= block_count;
-
-		switch (conn->type) {
-		case ACL_LINK:
-		case AMP_LINK:
-			hdev->block_cnt += block_count;
-			if (hdev->block_cnt > hdev->num_blocks)
-				hdev->block_cnt = hdev->num_blocks;
-			break;
-
-		default:
-			bt_dev_err(hdev, "unknown type %d conn %p",
-				   conn->type, conn);
-			break;
-		}
-	}
-
-	queue_work(hdev->workqueue, &hdev->tx_work);
-}
-
 static void hci_mode_change_evt(struct hci_dev *hdev, void *data,
 				struct sk_buff *skb)
 {
@@ -5010,8 +4895,9 @@
 		bacpy(&cp.bdaddr, &conn->dst);
 		cp.pscan_rep_mode = 0x02;
 		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
-	} else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+	} else {
 		mgmt_device_connected(hdev, conn, NULL, 0);
+	}
 
 	if (!hci_outgoing_auth_needed(hdev, conn)) {
 		conn->state = BT_CONNECTED;
@@ -5446,19 +5332,16 @@
 		goto unlock;
 	}
 
-	/* If no side requires MITM protection; auto-accept */
+	/* If no side requires MITM protection; use JUST_CFM method */
 	if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
 	    (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
 
-		/* If we're not the initiators request authorization to
-		 * proceed from user space (mgmt_user_confirm with
-		 * confirm_hint set to 1). The exception is if neither
-		 * side had MITM or if the local IO capability is
-		 * NoInputNoOutput, in which case we do auto-accept
+		/* If we're not the initiator of request authorization and the
+		 * local IO capability is not NoInputNoOutput, use JUST_WORKS
+		 * method (mgmt_user_confirm with confirm_hint set to 1).
 		 */
 		if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
-		    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
-		    (loc_mitm || rem_mitm)) {
+		    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT) {
 			bt_dev_dbg(hdev, "Confirming auto-accept as acceptor");
 			confirm_hint = 1;
 			goto confirm;
@@ -5675,150 +5558,6 @@
 	hci_dev_unlock(hdev);
 }
 
-#if IS_ENABLED(CONFIG_BT_HS)
-static void hci_chan_selected_evt(struct hci_dev *hdev, void *data,
-				  struct sk_buff *skb)
-{
-	struct hci_ev_channel_selected *ev = data;
-	struct hci_conn *hcon;
-
-	bt_dev_dbg(hdev, "handle 0x%2.2x", ev->phy_handle);
-
-	hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
-	if (!hcon)
-		return;
-
-	amp_read_loc_assoc_final_data(hdev, hcon);
-}
-
-static void hci_phy_link_complete_evt(struct hci_dev *hdev, void *data,
-				      struct sk_buff *skb)
-{
-	struct hci_ev_phy_link_complete *ev = data;
-	struct hci_conn *hcon, *bredr_hcon;
-
-	bt_dev_dbg(hdev, "handle 0x%2.2x status 0x%2.2x", ev->phy_handle,
-		   ev->status);
-
-	hci_dev_lock(hdev);
-
-	hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
-	if (!hcon)
-		goto unlock;
-
-	if (!hcon->amp_mgr)
-		goto unlock;
-
-	if (ev->status) {
-		hci_conn_del(hcon);
-		goto unlock;
-	}
-
-	bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
-
-	hcon->state = BT_CONNECTED;
-	bacpy(&hcon->dst, &bredr_hcon->dst);
-
-	hci_conn_hold(hcon);
-	hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
-	hci_conn_drop(hcon);
-
-	hci_debugfs_create_conn(hcon);
-	hci_conn_add_sysfs(hcon);
-
-	amp_physical_cfm(bredr_hcon, hcon);
-
-unlock:
-	hci_dev_unlock(hdev);
-}
-
-static void hci_loglink_complete_evt(struct hci_dev *hdev, void *data,
-				     struct sk_buff *skb)
-{
-	struct hci_ev_logical_link_complete *ev = data;
-	struct hci_conn *hcon;
-	struct hci_chan *hchan;
-	struct amp_mgr *mgr;
-
-	bt_dev_dbg(hdev, "log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
-		   le16_to_cpu(ev->handle), ev->phy_handle, ev->status);
-
-	hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
-	if (!hcon)
-		return;
-
-	/* Create AMP hchan */
-	hchan = hci_chan_create(hcon);
-	if (!hchan)
-		return;
-
-	hchan->handle = le16_to_cpu(ev->handle);
-	hchan->amp = true;
-
-	BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
-
-	mgr = hcon->amp_mgr;
-	if (mgr && mgr->bredr_chan) {
-		struct l2cap_chan *bredr_chan = mgr->bredr_chan;
-
-		l2cap_chan_lock(bredr_chan);
-
-		bredr_chan->conn->mtu = hdev->block_mtu;
-		l2cap_logical_cfm(bredr_chan, hchan, 0);
-		hci_conn_hold(hcon);
-
-		l2cap_chan_unlock(bredr_chan);
-	}
-}
-
-static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, void *data,
-					     struct sk_buff *skb)
-{
-	struct hci_ev_disconn_logical_link_complete *ev = data;
-	struct hci_chan *hchan;
-
-	bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x",
-		   le16_to_cpu(ev->handle), ev->status);
-
-	if (ev->status)
-		return;
-
-	hci_dev_lock(hdev);
-
-	hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
-	if (!hchan || !hchan->amp)
-		goto unlock;
-
-	amp_destroy_logical_link(hchan, ev->reason);
-
-unlock:
-	hci_dev_unlock(hdev);
-}
-
-static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, void *data,
-					     struct sk_buff *skb)
-{
-	struct hci_ev_disconn_phy_link_complete *ev = data;
-	struct hci_conn *hcon;
-
-	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
-
-	if (ev->status)
-		return;
-
-	hci_dev_lock(hdev);
-
-	hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
-	if (hcon && hcon->type == AMP_LINK) {
-		hcon->state = BT_CLOSED;
-		hci_disconn_cfm(hcon, ev->reason);
-		hci_conn_del(hcon);
-	}
-
-	hci_dev_unlock(hdev);
-}
-#endif
-
 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
 				u8 bdaddr_type, bdaddr_t *local_rpa)
 {
@@ -5899,8 +5638,8 @@
 			goto unlock;
 
 		conn = hci_conn_add_unset(hdev, LE_LINK, bdaddr, role);
-		if (!conn) {
-			bt_dev_err(hdev, "no memory for new connection");
+		if (IS_ERR(conn)) {
+			bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
 			goto unlock;
 		}
 
@@ -5984,8 +5723,7 @@
 		goto unlock;
 	}
 
-	if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-		mgmt_device_connected(hdev, conn, NULL, 0);
+	mgmt_device_connected(hdev, conn, NULL, 0);
 
 	conn->sec_level = BT_SECURITY_LOW;
 	conn->state = BT_CONFIG;
@@ -6169,7 +5907,7 @@
 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
 					      bdaddr_t *addr,
 					      u8 addr_type, bool addr_resolved,
-					      u8 adv_type)
+					      u8 adv_type, u8 phy, u8 sec_phy)
 {
 	struct hci_conn *conn;
 	struct hci_conn_params *params;
@@ -6187,7 +5925,7 @@
 	 * while we have an existing one in peripheral role.
 	 */
 	if (hdev->conn_hash.le_num_peripheral > 0 &&
-	    (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
+	    (test_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks) ||
 	     !(hdev->le_states[3] & 0x10)))
 		return NULL;
 
@@ -6224,7 +5962,7 @@
 
 	conn = hci_connect_le(hdev, addr, addr_type, addr_resolved,
 			      BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout,
-			      HCI_ROLE_MASTER);
+			      HCI_ROLE_MASTER, phy, sec_phy);
 	if (!IS_ERR(conn)) {
 		/* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
 		 * by higher layer that tried to connect, if no then
@@ -6259,8 +5997,9 @@
 
 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 			       u8 bdaddr_type, bdaddr_t *direct_addr,
-			       u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
-			       bool ext_adv, bool ctl_time, u64 instant)
+			       u8 direct_addr_type, u8 phy, u8 sec_phy, s8 rssi,
+			       u8 *data, u8 len, bool ext_adv, bool ctl_time,
+			       u64 instant)
 {
 	struct discovery_state *d = &hdev->discovery;
 	struct smp_irk *irk;
@@ -6348,7 +6087,7 @@
 	 * for advertising reports) and is already verified to be RPA above.
 	 */
 	conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved,
-				     type);
+				     type, phy, sec_phy);
 	if (!ext_adv && conn && type == LE_ADV_IND &&
 	    len <= max_adv_len(hdev)) {
 		/* Store report for later inclusion by
@@ -6494,7 +6233,8 @@
 		if (info->length <= max_adv_len(hdev)) {
 			rssi = info->data[info->length];
 			process_adv_report(hdev, info->type, &info->bdaddr,
-					   info->bdaddr_type, NULL, 0, rssi,
+					   info->bdaddr_type, NULL, 0,
+					   HCI_ADV_PHY_1M, 0, rssi,
 					   info->data, info->length, false,
 					   false, instant);
 		} else {
@@ -6576,9 +6316,18 @@
 
 		evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK;
 		legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
+
+		if (test_bit(HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY,
+			     &hdev->quirks)) {
+			info->primary_phy &= 0x1f;
+			info->secondary_phy &= 0x1f;
+		}
+
 		if (legacy_evt_type != LE_ADV_INVALID) {
 			process_adv_report(hdev, legacy_evt_type, &info->bdaddr,
 					   info->bdaddr_type, NULL, 0,
+					   info->primary_phy,
+					   info->secondary_phy,
 					   info->rssi, info->data, info->length,
 					   !(evt_type & LE_EXT_ADV_LEGACY_PDU),
 					   false, instant);
@@ -6604,7 +6353,7 @@
 	struct hci_ev_le_pa_sync_established *ev = data;
 	int mask = hdev->link_mode;
 	__u8 flags = 0;
-	struct hci_conn *pa_sync;
+	struct hci_conn *pa_sync, *conn;
 
 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
 
@@ -6612,6 +6361,20 @@
 
 	hci_dev_clear_flag(hdev, HCI_PA_SYNC);
 
+	conn = hci_conn_hash_lookup_sid(hdev, ev->sid, &ev->bdaddr,
+					ev->bdaddr_type);
+	if (!conn) {
+		bt_dev_err(hdev,
+			   "Unable to find connection for dst %pMR sid 0x%2.2x",
+			   &ev->bdaddr, ev->sid);
+		goto unlock;
+	}
+
+	clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags);
+
+	conn->sync_handle = le16_to_cpu(ev->handle);
+	conn->sid = HCI_SID_INVALID;
+
 	mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ISO_LINK, &flags);
 	if (!(mask & HCI_LM_ACCEPT)) {
 		hci_le_pa_term_sync(hdev, ev->handle);
@@ -6621,14 +6384,16 @@
 	if (!(flags & HCI_PROTO_DEFER))
 		goto unlock;
 
-	if (ev->status) {
-		/* Add connection to indicate the failed PA sync event */
-		pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
-					     HCI_ROLE_SLAVE);
+	/* Add connection to indicate PA sync event */
+	pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
+				     HCI_ROLE_SLAVE);
 
-		if (!pa_sync)
-			goto unlock;
+	if (IS_ERR(pa_sync))
+		goto unlock;
+
+	pa_sync->sync_handle = le16_to_cpu(ev->handle);
 
+	if (ev->status) {
 		set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags);
 
 		/* Notify iso layer */
@@ -6636,6 +6401,9 @@
 	}
 
 unlock:
+	/* Handle any other pending PA sync command */
+	hci_pa_create_sync_pending(hdev);
+
 	hci_dev_unlock(hdev);
 }
 
@@ -6645,6 +6413,7 @@
 	struct hci_ev_le_per_adv_report *ev = data;
 	int mask = hdev->link_mode;
 	__u8 flags = 0;
+	struct hci_conn *pa_sync;
 
 	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
 
@@ -6652,8 +6421,28 @@
 
 	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
 	if (!(mask & HCI_LM_ACCEPT))
-		hci_le_pa_term_sync(hdev, ev->sync_handle);
+		goto unlock;
+
+	if (!(flags & HCI_PROTO_DEFER))
+		goto unlock;
+
+	pa_sync = hci_conn_hash_lookup_pa_sync_handle
+			(hdev,
+			le16_to_cpu(ev->sync_handle));
 
+	if (!pa_sync)
+		goto unlock;
+
+	if (ev->data_status == LE_PA_DATA_COMPLETE &&
+	    !test_and_set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags)) {
+		/* Notify iso layer */
+		hci_connect_cfm(pa_sync, 0);
+
+		/* Notify MGMT layer */
+		mgmt_device_connected(hdev, pa_sync, NULL, 0);
+	}
+
+unlock:
 	hci_dev_unlock(hdev);
 }
 
@@ -6684,7 +6473,7 @@
 			 * transition into connected state and mark it as
 			 * successful.
 			 */
-			if (!conn->out && ev->status == 0x1a &&
+			if (!conn->out && ev->status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE &&
 			    (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
 				status = 0x00;
 			else
@@ -6861,8 +6650,8 @@
 
 		process_adv_report(hdev, info->type, &info->bdaddr,
 				   info->bdaddr_type, &info->direct_addr,
-				   info->direct_addr_type, info->rssi, NULL, 0,
-				   false, false, instant);
+				   info->direct_addr_type, HCI_ADV_PHY_1M, 0,
+				   info->rssi, NULL, 0, false, false, instant);
 	}
 
 	hci_dev_unlock(hdev);
@@ -6900,6 +6689,7 @@
 	struct bt_iso_qos *qos;
 	bool pending = false;
 	u16 handle = __le16_to_cpu(ev->handle);
+	u32 c_sdu_interval, p_sdu_interval;
 
 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
 
@@ -6924,12 +6714,25 @@
 
 	pending = test_and_clear_bit(HCI_CONN_CREATE_CIS, &conn->flags);
 
-	/* Convert ISO Interval (1.25 ms slots) to SDU Interval (us) */
-	qos->ucast.in.interval = le16_to_cpu(ev->interval) * 1250;
-	qos->ucast.out.interval = qos->ucast.in.interval;
+	/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 6, Part G
+	 * page 3075:
+	 * Transport_Latency_C_To_P = CIG_Sync_Delay + (FT_C_To_P) ×
+	 * ISO_Interval + SDU_Interval_C_To_P
+	 * ...
+	 * SDU_Interval = (CIG_Sync_Delay + (FT) x ISO_Interval) -
+	 *					Transport_Latency
+	 */
+	c_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) +
+			 (ev->c_ft * le16_to_cpu(ev->interval) * 1250)) -
+			get_unaligned_le24(ev->c_latency);
+	p_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) +
+			 (ev->p_ft * le16_to_cpu(ev->interval) * 1250)) -
+			get_unaligned_le24(ev->p_latency);
 
 	switch (conn->role) {
 	case HCI_ROLE_SLAVE:
+		qos->ucast.in.interval = c_sdu_interval;
+		qos->ucast.out.interval = p_sdu_interval;
 		/* Convert Transport Latency (us) to Latency (msec) */
 		qos->ucast.in.latency =
 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
@@ -6943,6 +6746,8 @@
 		qos->ucast.out.phy = ev->p_phy;
 		break;
 	case HCI_ROLE_MASTER:
+		qos->ucast.in.interval = p_sdu_interval;
+		qos->ucast.out.interval = c_sdu_interval;
 		/* Convert Transport Latency (us) to Latency (msec) */
 		qos->ucast.out.latency =
 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
@@ -7026,7 +6831,7 @@
 	if (!cis) {
 		cis = hci_conn_add(hdev, ISO_LINK, &acl->dst, HCI_ROLE_SLAVE,
 				   cis_handle);
-		if (!cis) {
+		if (IS_ERR(cis)) {
 			hci_le_reject_cis(hdev, ev->cis_handle);
 			goto unlock;
 		}
@@ -7068,38 +6873,27 @@
 		return;
 
 	hci_dev_lock(hdev);
-	rcu_read_lock();
 
 	/* Connect all BISes that are bound to the BIG */
-	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
-		if (bacmp(&conn->dst, BDADDR_ANY) ||
-		    conn->type != ISO_LINK ||
-		    conn->iso_qos.bcast.big != ev->handle)
+	while ((conn = hci_conn_hash_lookup_big_state(hdev, ev->handle,
+						      BT_BOUND))) {
+		if (ev->status) {
+			hci_connect_cfm(conn, ev->status);
+			hci_conn_del(conn);
 			continue;
+		}
 
 		if (hci_conn_set_handle(conn,
 					__le16_to_cpu(ev->bis_handle[i++])))
 			continue;
 
-		if (!ev->status) {
-			conn->state = BT_CONNECTED;
-			set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
-			rcu_read_unlock();
-			hci_debugfs_create_conn(conn);
-			hci_conn_add_sysfs(conn);
-			hci_iso_setup_path(conn);
-			rcu_read_lock();
-			continue;
-		}
-
-		hci_connect_cfm(conn, ev->status);
-		rcu_read_unlock();
-		hci_conn_del(conn);
-		rcu_read_lock();
+		conn->state = BT_CONNECTED;
+		set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
+		hci_debugfs_create_conn(conn);
+		hci_conn_add_sysfs(conn);
+		hci_iso_setup_path(conn);
 	}
 
-	rcu_read_unlock();
-
 	if (!ev->status && !i)
 		/* If no BISes have been connected for the BIG,
 		 * terminate. This is in case all bound connections
@@ -7116,7 +6910,7 @@
 					    struct sk_buff *skb)
 {
 	struct hci_evt_le_big_sync_estabilished *ev = data;
-	struct hci_conn *bis;
+	struct hci_conn *bis, *conn;
 	int i;
 
 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
@@ -7127,15 +6921,33 @@
 
 	hci_dev_lock(hdev);
 
+	conn = hci_conn_hash_lookup_big_sync_pend(hdev, ev->handle,
+						  ev->num_bis);
+	if (!conn) {
+		bt_dev_err(hdev,
+			   "Unable to find connection for big 0x%2.2x",
+			   ev->handle);
+		goto unlock;
+	}
+
+	clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags);
+
+	conn->num_bis = 0;
+	memset(conn->bis, 0, sizeof(conn->num_bis));
+
 	for (i = 0; i < ev->num_bis; i++) {
 		u16 handle = le16_to_cpu(ev->bis[i]);
 		__le32 interval;
 
 		bis = hci_conn_hash_lookup_handle(hdev, handle);
 		if (!bis) {
+			if (handle > HCI_CONN_HANDLE_MAX) {
+				bt_dev_dbg(hdev, "ignore too large handle %u", handle);
+				continue;
+			}
 			bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY,
 					   HCI_ROLE_SLAVE, handle);
-			if (!bis)
+			if (IS_ERR(bis))
 				continue;
 		}
 
@@ -7165,11 +6977,17 @@
 			u16 handle = le16_to_cpu(ev->bis[i]);
 
 			bis = hci_conn_hash_lookup_handle(hdev, handle);
+			if (!bis)
+				continue;
 
 			set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags);
 			hci_connect_cfm(bis, ev->status);
 		}
 
+unlock:
+	/* Handle any other pending BIG sync command */
+	hci_le_big_create_sync_pending(hdev);
+
 	hci_dev_unlock(hdev);
 }
 
@@ -7186,10 +7004,8 @@
 	hci_dev_lock(hdev);
 
 	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
-	if (!(mask & HCI_LM_ACCEPT)) {
-		hci_le_pa_term_sync(hdev, ev->sync_handle);
+	if (!(mask & HCI_LM_ACCEPT))
 		goto unlock;
-	}
 
 	if (!(flags & HCI_PROTO_DEFER))
 		goto unlock;
@@ -7198,21 +7014,13 @@
 			(hdev,
 			le16_to_cpu(ev->sync_handle));
 
-	if (pa_sync)
-		goto unlock;
-
-	/* Add connection to indicate the PA sync event */
-	pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
-				     HCI_ROLE_SLAVE);
-
-	if (!pa_sync)
+	if (IS_ERR(pa_sync))
 		goto unlock;
 
-	pa_sync->sync_handle = le16_to_cpu(ev->sync_handle);
-	set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags);
+	pa_sync->iso_qos.bcast.encryption = ev->encryption;
 
 	/* Notify iso layer */
-	hci_connect_cfm(pa_sync, 0x00);
+	hci_connect_cfm(pa_sync, 0);
 
 unlock:
 	hci_dev_unlock(hdev);
@@ -7324,10 +7132,10 @@
 	bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);
 
 	/* Only match event if command OGF is for LE */
-	if (hdev->sent_cmd &&
-	    hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) == 0x08 &&
-	    hci_skb_event(hdev->sent_cmd) == ev->subevent) {
-		*opcode = hci_skb_opcode(hdev->sent_cmd);
+	if (hdev->req_skb &&
+	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) == 0x08 &&
+	    hci_skb_event(hdev->req_skb) == ev->subevent) {
+		*opcode = hci_skb_opcode(hdev->req_skb);
 		hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete,
 				     req_complete_skb);
 	}
@@ -7626,28 +7434,6 @@
 	/* [0x3e = HCI_EV_LE_META] */
 	HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
 		      sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE),
-#if IS_ENABLED(CONFIG_BT_HS)
-	/* [0x40 = HCI_EV_PHY_LINK_COMPLETE] */
-	HCI_EV(HCI_EV_PHY_LINK_COMPLETE, hci_phy_link_complete_evt,
-	       sizeof(struct hci_ev_phy_link_complete)),
-	/* [0x41 = HCI_EV_CHANNEL_SELECTED] */
-	HCI_EV(HCI_EV_CHANNEL_SELECTED, hci_chan_selected_evt,
-	       sizeof(struct hci_ev_channel_selected)),
-	/* [0x42 = HCI_EV_DISCONN_PHY_LINK_COMPLETE] */
-	HCI_EV(HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE,
-	       hci_disconn_loglink_complete_evt,
-	       sizeof(struct hci_ev_disconn_logical_link_complete)),
-	/* [0x45 = HCI_EV_LOGICAL_LINK_COMPLETE] */
-	HCI_EV(HCI_EV_LOGICAL_LINK_COMPLETE, hci_loglink_complete_evt,
-	       sizeof(struct hci_ev_logical_link_complete)),
-	/* [0x46 = HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE] */
-	HCI_EV(HCI_EV_DISCONN_PHY_LINK_COMPLETE,
-	       hci_disconn_phylink_complete_evt,
-	       sizeof(struct hci_ev_disconn_phy_link_complete)),
-#endif
-	/* [0x48 = HCI_EV_NUM_COMP_BLOCKS] */
-	HCI_EV(HCI_EV_NUM_COMP_BLOCKS, hci_num_comp_blocks_evt,
-	       sizeof(struct hci_ev_num_comp_blocks)),
 	/* [0xff = HCI_EV_VENDOR] */
 	HCI_EV_VL(HCI_EV_VENDOR, msft_vendor_evt, 0, HCI_MAX_EVENT_SIZE),
 };
@@ -7714,10 +7500,10 @@
 	}
 
 	/* Only match event if command OGF is not for LE */
-	if (hdev->sent_cmd &&
-	    hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) != 0x08 &&
-	    hci_skb_event(hdev->sent_cmd) == event) {
-		hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->sent_cmd),
+	if (hdev->req_skb &&
+	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) != 0x08 &&
+	    hci_skb_event(hdev->req_skb) == event) {
+		hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->req_skb),
 				     status, &req_complete, &req_complete_skb);
 		req_evt = event;
 	}
--- linux-qcom-6.8.0.orig/net/bluetooth/hci_request.c
+++ linux-qcom-6.8.0/net/bluetooth/hci_request.c
@@ -105,8 +105,10 @@
 	if (hdev->req_status == HCI_REQ_PEND) {
 		hdev->req_result = result;
 		hdev->req_status = HCI_REQ_DONE;
-		if (skb)
+		if (skb) {
+			kfree_skb(hdev->req_skb);
 			hdev->req_skb = skb_get(skb);
+		}
 		wake_up_interruptible(&hdev->req_wait_q);
 	}
 }
@@ -895,7 +897,7 @@
 
 void hci_request_cancel_all(struct hci_dev *hdev)
 {
-	__hci_cmd_sync_cancel(hdev, ENODEV);
+	hci_cmd_sync_cancel_sync(hdev, ENODEV);
 
 	cancel_interleave_scan(hdev);
 }
--- linux-qcom-6.8.0.orig/net/bluetooth/hci_sock.c
+++ linux-qcom-6.8.0/net/bluetooth/hci_sock.c
@@ -101,7 +101,7 @@
 	int id = hci_pi(sk)->cookie;
 
 	if (!id) {
-		id = ida_simple_get(&sock_cookie_ida, 1, 0, GFP_KERNEL);
+		id = ida_alloc_min(&sock_cookie_ida, 1, GFP_KERNEL);
 		if (id < 0)
 			id = 0xffffffff;
 
@@ -119,7 +119,7 @@
 
 	if (id) {
 		hci_pi(sk)->cookie = 0xffffffff;
-		ida_simple_remove(&sock_cookie_ida, id);
+		ida_free(&sock_cookie_ida, id);
 	}
 }
 
@@ -485,7 +485,7 @@
 			return NULL;
 
 		ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE);
-		ni->type = hdev->dev_type;
+		ni->type = 0x00; /* Old hdev->dev_type */
 		ni->bus = hdev->bus;
 		bacpy(&ni->bdaddr, &hdev->bdaddr);
 		memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name,
@@ -1007,9 +1007,6 @@
 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
 		return -EOPNOTSUPP;
 
-	if (hdev->dev_type != HCI_PRIMARY)
-		return -EOPNOTSUPP;
-
 	switch (cmd) {
 	case HCISETRAW:
 		if (!capable(CAP_NET_ADMIN))
@@ -1929,7 +1926,7 @@
 }
 
 static int hci_sock_setsockopt_old(struct socket *sock, int level, int optname,
-				   sockptr_t optval, unsigned int len)
+				   sockptr_t optval, unsigned int optlen)
 {
 	struct hci_ufilter uf = { .opcode = 0 };
 	struct sock *sk = sock->sk;
@@ -1946,10 +1943,9 @@
 
 	switch (optname) {
 	case HCI_DATA_DIR:
-		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
@@ -1958,10 +1954,9 @@
 		break;
 
 	case HCI_TIME_STAMP:
-		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
@@ -1979,11 +1974,9 @@
 			uf.event_mask[1] = *((u32 *) f->event_mask + 1);
 		}
 
-		len = min_t(unsigned int, len, sizeof(uf));
-		if (copy_from_sockptr(&uf, optval, len)) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&uf, sizeof(uf), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (!capable(CAP_NET_RAW)) {
 			uf.type_mask &= hci_sec_filter.type_mask;
@@ -2012,7 +2005,7 @@
 }
 
 static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
-			       sockptr_t optval, unsigned int len)
+			       sockptr_t optval, unsigned int optlen)
 {
 	struct sock *sk = sock->sk;
 	int err = 0;
@@ -2022,7 +2015,7 @@
 
 	if (level == SOL_HCI)
 		return hci_sock_setsockopt_old(sock, level, optname, optval,
-					       len);
+					       optlen);
 
 	if (level != SOL_BLUETOOTH)
 		return -ENOPROTOOPT;
@@ -2042,10 +2035,9 @@
 			goto done;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		hci_pi(sk)->mtu = opt;
 		break;
--- linux-qcom-6.8.0.orig/net/bluetooth/hci_sync.c
+++ linux-qcom-6.8.0/net/bluetooth/hci_sync.c
@@ -32,6 +32,10 @@
 	hdev->req_result = result;
 	hdev->req_status = HCI_REQ_DONE;
 
+	/* Free the request command so it is not used as response */
+	kfree_skb(hdev->req_skb);
+	hdev->req_skb = NULL;
+
 	if (skb) {
 		struct sock *sk = hci_skb_sk(skb);
 
@@ -39,7 +43,7 @@
 		if (sk)
 			sock_put(sk);
 
-		hdev->req_skb = skb_get(skb);
+		hdev->req_rsp = skb_get(skb);
 	}
 
 	wake_up_interruptible(&hdev->req_wait_q);
@@ -110,7 +114,7 @@
 	skb_queue_tail(&req->cmd_q, skb);
 }
 
-static int hci_cmd_sync_run(struct hci_request *req)
+static int hci_req_sync_run(struct hci_request *req)
 {
 	struct hci_dev *hdev = req->hdev;
 	struct sk_buff *skb;
@@ -160,7 +164,7 @@
 
 	hdev->req_status = HCI_REQ_PEND;
 
-	err = hci_cmd_sync_run(&req);
+	err = hci_req_sync_run(&req);
 	if (err < 0)
 		return ERR_PTR(err);
 
@@ -187,8 +191,8 @@
 
 	hdev->req_status = 0;
 	hdev->req_result = 0;
-	skb = hdev->req_skb;
-	hdev->req_skb = NULL;
+	skb = hdev->req_rsp;
+	hdev->req_rsp = NULL;
 
 	bt_dev_dbg(hdev, "end: err %d", err);
 
@@ -197,6 +201,12 @@
 		return ERR_PTR(err);
 	}
 
+	/* If command return a status event skb will be set to NULL as there are
+	 * no parameters.
+	 */
+	if (!skb)
+		return ERR_PTR(-ENODATA);
+
 	return skb;
 }
 EXPORT_SYMBOL(__hci_cmd_sync_sk);
@@ -246,6 +256,11 @@
 	u8 status;
 
 	skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk);
+
+	/* If command return a status event, skb will be set to -ENODATA */
+	if (skb == ERR_PTR(-ENODATA))
+		return 0;
+
 	if (IS_ERR(skb)) {
 		if (!event)
 			bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode,
@@ -253,13 +268,6 @@
 		return PTR_ERR(skb);
 	}
 
-	/* If command return a status event skb will be set to NULL as there are
-	 * no parameters, in case of failure IS_ERR(skb) would have be set to
-	 * the actual error would be found with PTR_ERR(skb).
-	 */
-	if (!skb)
-		return 0;
-
 	status = skb->data[0];
 
 	kfree_skb(skb);
@@ -276,6 +284,19 @@
 }
 EXPORT_SYMBOL(__hci_cmd_sync_status);
 
+int hci_cmd_sync_status(struct hci_dev *hdev, u16 opcode, u32 plen,
+			const void *param, u32 timeout)
+{
+	int err;
+
+	hci_req_sync_lock(hdev);
+	err = __hci_cmd_sync_status(hdev, opcode, plen, param, timeout);
+	hci_req_sync_unlock(hdev);
+
+	return err;
+}
+EXPORT_SYMBOL(hci_cmd_sync_status);
+
 static void hci_cmd_sync_work(struct work_struct *work)
 {
 	struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_sync_work);
@@ -354,8 +375,6 @@
 		goto _return;
 	}
 
-	hdev->discovery.scan_start = 0;
-
 	/* If we were running LE only scan, change discovery state. If
 	 * we were running both LE and BR/EDR inquiry simultaneously,
 	 * and BR/EDR inquiry is already finished, stop discovery,
@@ -566,6 +585,17 @@
 	INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire);
 }
 
+static void _hci_cmd_sync_cancel_entry(struct hci_dev *hdev,
+				       struct hci_cmd_sync_work_entry *entry,
+				       int err)
+{
+	if (entry->destroy)
+		entry->destroy(hdev, entry->data, err);
+
+	list_del(&entry->list);
+	kfree(entry);
+}
+
 void hci_cmd_sync_clear(struct hci_dev *hdev)
 {
 	struct hci_cmd_sync_work_entry *entry, *tmp;
@@ -574,17 +604,12 @@
 	cancel_work_sync(&hdev->reenable_adv_work);
 
 	mutex_lock(&hdev->cmd_sync_work_lock);
-	list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) {
-		if (entry->destroy)
-			entry->destroy(hdev, entry->data, -ECANCELED);
-
-		list_del(&entry->list);
-		kfree(entry);
-	}
+	list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list)
+		_hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
 	mutex_unlock(&hdev->cmd_sync_work_lock);
 }
 
-void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
+void hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
 {
 	bt_dev_dbg(hdev, "err 0x%2.2x", err);
 
@@ -592,26 +617,31 @@
 		hdev->req_result = err;
 		hdev->req_status = HCI_REQ_CANCELED;
 
-		cancel_delayed_work_sync(&hdev->cmd_timer);
-		cancel_delayed_work_sync(&hdev->ncmd_timer);
-		atomic_set(&hdev->cmd_cnt, 1);
-
-		wake_up_interruptible(&hdev->req_wait_q);
+		queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work);
 	}
 }
+EXPORT_SYMBOL(hci_cmd_sync_cancel);
 
-void hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
+/* Cancel ongoing command request synchronously:
+ *
+ * - Set result and mark status to HCI_REQ_CANCELED
+ * - Wakeup command sync thread
+ */
+void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err)
 {
 	bt_dev_dbg(hdev, "err 0x%2.2x", err);
 
 	if (hdev->req_status == HCI_REQ_PEND) {
-		hdev->req_result = err;
+		/* req_result is __u32 so error must be positive to be properly
+		 * propagated.
+		 */
+		hdev->req_result = err < 0 ? -err : err;
 		hdev->req_status = HCI_REQ_CANCELED;
 
-		queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work);
+		wake_up_interruptible(&hdev->req_wait_q);
 	}
 }
-EXPORT_SYMBOL(hci_cmd_sync_cancel);
+EXPORT_SYMBOL(hci_cmd_sync_cancel_sync);
 
 /* Submit HCI command to be run in as cmd_sync_work:
  *
@@ -667,6 +697,153 @@
 }
 EXPORT_SYMBOL(hci_cmd_sync_queue);
 
+static struct hci_cmd_sync_work_entry *
+_hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+			   void *data, hci_cmd_sync_work_destroy_t destroy)
+{
+	struct hci_cmd_sync_work_entry *entry, *tmp;
+
+	list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) {
+		if (func && entry->func != func)
+			continue;
+
+		if (data && entry->data != data)
+			continue;
+
+		if (destroy && entry->destroy != destroy)
+			continue;
+
+		return entry;
+	}
+
+	return NULL;
+}
+
+/* Queue HCI command entry once:
+ *
+ * - Lookup if an entry already exist and only if it doesn't creates a new entry
+ *   and queue it.
+ */
+int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+			    void *data, hci_cmd_sync_work_destroy_t destroy)
+{
+	if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy))
+		return 0;
+
+	return hci_cmd_sync_queue(hdev, func, data, destroy);
+}
+EXPORT_SYMBOL(hci_cmd_sync_queue_once);
+
+/* Run HCI command:
+ *
+ * - hdev must be running
+ * - if on cmd_sync_work then run immediately otherwise queue
+ */
+int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+		     void *data, hci_cmd_sync_work_destroy_t destroy)
+{
+	/* Only queue command if hdev is running which means it had been opened
+	 * and is either on init phase or is already up.
+	 */
+	if (!test_bit(HCI_RUNNING, &hdev->flags))
+		return -ENETDOWN;
+
+	/* If on cmd_sync_work then run immediately otherwise queue */
+	if (current_work() == &hdev->cmd_sync_work)
+		return func(hdev, data);
+
+	return hci_cmd_sync_submit(hdev, func, data, destroy);
+}
+EXPORT_SYMBOL(hci_cmd_sync_run);
+
+/* Run HCI command entry once:
+ *
+ * - Lookup if an entry already exist and only if it doesn't creates a new entry
+ *   and run it.
+ * - if on cmd_sync_work then run immediately otherwise queue
+ */
+int hci_cmd_sync_run_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+			  void *data, hci_cmd_sync_work_destroy_t destroy)
+{
+	if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy))
+		return 0;
+
+	return hci_cmd_sync_run(hdev, func, data, destroy);
+}
+EXPORT_SYMBOL(hci_cmd_sync_run_once);
+
+/* Lookup HCI command entry:
+ *
+ * - Return first entry that matches by function callback or data or
+ *   destroy callback.
+ */
+struct hci_cmd_sync_work_entry *
+hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+			  void *data, hci_cmd_sync_work_destroy_t destroy)
+{
+	struct hci_cmd_sync_work_entry *entry;
+
+	mutex_lock(&hdev->cmd_sync_work_lock);
+	entry = _hci_cmd_sync_lookup_entry(hdev, func, data, destroy);
+	mutex_unlock(&hdev->cmd_sync_work_lock);
+
+	return entry;
+}
+EXPORT_SYMBOL(hci_cmd_sync_lookup_entry);
+
+/* Cancel HCI command entry */
+void hci_cmd_sync_cancel_entry(struct hci_dev *hdev,
+			       struct hci_cmd_sync_work_entry *entry)
+{
+	mutex_lock(&hdev->cmd_sync_work_lock);
+	_hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
+	mutex_unlock(&hdev->cmd_sync_work_lock);
+}
+EXPORT_SYMBOL(hci_cmd_sync_cancel_entry);
+
+/* Dequeue one HCI command entry:
+ *
+ * - Lookup and cancel first entry that matches.
+ */
+bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev,
+			       hci_cmd_sync_work_func_t func,
+			       void *data, hci_cmd_sync_work_destroy_t destroy)
+{
+	struct hci_cmd_sync_work_entry *entry;
+
+	entry = hci_cmd_sync_lookup_entry(hdev, func, data, destroy);
+	if (!entry)
+		return false;
+
+	hci_cmd_sync_cancel_entry(hdev, entry);
+
+	return true;
+}
+EXPORT_SYMBOL(hci_cmd_sync_dequeue_once);
+
+/* Dequeue HCI command entry:
+ *
+ * - Lookup and cancel any entry that matches by function callback or data or
+ *   destroy callback.
+ */
+bool hci_cmd_sync_dequeue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+			  void *data, hci_cmd_sync_work_destroy_t destroy)
+{
+	struct hci_cmd_sync_work_entry *entry;
+	bool ret = false;
+
+	mutex_lock(&hdev->cmd_sync_work_lock);
+	while ((entry = _hci_cmd_sync_lookup_entry(hdev, func, data,
+						   destroy))) {
+		_hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
+		ret = true;
+	}
+	mutex_unlock(&hdev->cmd_sync_work_lock);
+
+	return ret;
+}
+EXPORT_SYMBOL(hci_cmd_sync_dequeue);
+
 int hci_update_eir_sync(struct hci_dev *hdev)
 {
 	struct hci_cp_write_eir cp;
@@ -802,9 +979,9 @@
 
 static int hci_set_random_addr_sync(struct hci_dev *hdev, bdaddr_t *rpa)
 {
-	/* If we're advertising or initiating an LE connection we can't
-	 * go ahead and change the random address at this time. This is
-	 * because the eventual initiator address used for the
+	/* If a random_addr has been set we're advertising or initiating an LE
+	 * connection we can't go ahead and change the random address at this
+	 * time. This is because the eventual initiator address used for the
 	 * subsequently created connection will be undefined (some
 	 * controllers use the new address and others the one we had
 	 * when the operation started).
@@ -812,8 +989,9 @@
 	 * In this kind of scenario skip the update and let the random
 	 * address be updated at the next cycle.
 	 */
-	if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
-	    hci_lookup_le_connect(hdev)) {
+	if (bacmp(&hdev->random_addr, BDADDR_ANY) &&
+	    (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
+	    hci_lookup_le_connect(hdev))) {
 		bt_dev_dbg(hdev, "Deferring random address update");
 		hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 		return 0;
@@ -919,11 +1097,10 @@
 	struct hci_cp_ext_adv_set *set;
 	u8 data[sizeof(*cp) + sizeof(*set) * 1];
 	u8 size;
+	struct adv_info *adv = NULL;
 
 	/* If request specifies an instance that doesn't exist, fail */
 	if (instance > 0) {
-		struct adv_info *adv;
-
 		adv = hci_find_adv_instance(hdev, instance);
 		if (!adv)
 			return -EINVAL;
@@ -942,7 +1119,7 @@
 	cp->num_of_sets = !!instance;
 	cp->enable = 0x00;
 
-	set->handle = instance;
+	set->handle = adv ? adv->handle : instance;
 
 	size = sizeof(*cp) + sizeof(*set) * cp->num_of_sets;
 
@@ -1071,7 +1248,7 @@
 
 	cp.own_addr_type = own_addr_type;
 	cp.channel_map = hdev->le_adv_channel_map;
-	cp.handle = instance;
+	cp.handle = adv ? adv->handle : instance;
 
 	if (flags & MGMT_ADV_FLAG_SEC_2M) {
 		cp.primary_phy = HCI_ADV_PHY_1M;
@@ -1111,31 +1288,27 @@
 
 static int hci_set_ext_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance)
 {
-	struct {
-		struct hci_cp_le_set_ext_scan_rsp_data cp;
-		u8 data[HCI_MAX_EXT_AD_LENGTH];
-	} pdu;
+	DEFINE_FLEX(struct hci_cp_le_set_ext_scan_rsp_data, pdu, data, length,
+		    HCI_MAX_EXT_AD_LENGTH);
 	u8 len;
 	struct adv_info *adv = NULL;
 	int err;
 
-	memset(&pdu, 0, sizeof(pdu));
-
 	if (instance) {
 		adv = hci_find_adv_instance(hdev, instance);
 		if (!adv || !adv->scan_rsp_changed)
 			return 0;
 	}
 
-	len = eir_create_scan_rsp(hdev, instance, pdu.data);
+	len = eir_create_scan_rsp(hdev, instance, pdu->data);
 
-	pdu.cp.handle = instance;
-	pdu.cp.length = len;
-	pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
-	pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG;
+	pdu->handle = adv ? adv->handle : instance;
+	pdu->length = len;
+	pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE;
+	pdu->frag_pref = LE_SET_ADV_DATA_NO_FRAG;
 
 	err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA,
-				    sizeof(pdu.cp) + len, &pdu.cp,
+				    struct_size(pdu, data, len), pdu,
 				    HCI_CMD_TIMEOUT);
 	if (err)
 		return err;
@@ -1143,7 +1316,7 @@
 	if (adv) {
 		adv->scan_rsp_changed = false;
 	} else {
-		memcpy(hdev->scan_rsp_data, pdu.data, len);
+		memcpy(hdev->scan_rsp_data, pdu->data, len);
 		hdev->scan_rsp_data_len = len;
 	}
 
@@ -1211,7 +1384,7 @@
 
 	memset(set, 0, sizeof(*set));
 
-	set->handle = instance;
+	set->handle = adv ? adv->handle : instance;
 
 	/* Set duration per instance since controller is responsible for
 	 * scheduling it.
@@ -1287,29 +1460,25 @@
 
 static int hci_set_per_adv_data_sync(struct hci_dev *hdev, u8 instance)
 {
-	struct {
-		struct hci_cp_le_set_per_adv_data cp;
-		u8 data[HCI_MAX_PER_AD_LENGTH];
-	} pdu;
+	DEFINE_FLEX(struct hci_cp_le_set_per_adv_data, pdu, data, length,
+		    HCI_MAX_PER_AD_LENGTH);
 	u8 len;
-
-	memset(&pdu, 0, sizeof(pdu));
+	struct adv_info *adv = NULL;
 
 	if (instance) {
-		struct adv_info *adv = hci_find_adv_instance(hdev, instance);
-
+		adv = hci_find_adv_instance(hdev, instance);
 		if (!adv || !adv->periodic)
 			return 0;
 	}
 
-	len = eir_create_per_adv_data(hdev, instance, pdu.data);
+	len = eir_create_per_adv_data(hdev, instance, pdu->data);
 
-	pdu.cp.length = len;
-	pdu.cp.handle = instance;
-	pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
+	pdu->length = len;
+	pdu->handle = adv ? adv->handle : instance;
+	pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE;
 
 	return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_DATA,
-				     sizeof(pdu.cp) + len, &pdu,
+				     struct_size(pdu, data, len), pdu,
 				     HCI_CMD_TIMEOUT);
 }
 
@@ -1603,31 +1772,27 @@
 
 static int hci_set_ext_adv_data_sync(struct hci_dev *hdev, u8 instance)
 {
-	struct {
-		struct hci_cp_le_set_ext_adv_data cp;
-		u8 data[HCI_MAX_EXT_AD_LENGTH];
-	} pdu;
+	DEFINE_FLEX(struct hci_cp_le_set_ext_adv_data, pdu, data, length,
+		    HCI_MAX_EXT_AD_LENGTH);
 	u8 len;
 	struct adv_info *adv = NULL;
 	int err;
 
-	memset(&pdu, 0, sizeof(pdu));
-
 	if (instance) {
 		adv = hci_find_adv_instance(hdev, instance);
 		if (!adv || !adv->adv_data_changed)
 			return 0;
 	}
 
-	len = eir_create_adv_data(hdev, instance, pdu.data);
+	len = eir_create_adv_data(hdev, instance, pdu->data);
 
-	pdu.cp.length = len;
-	pdu.cp.handle = instance;
-	pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
-	pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG;
+	pdu->length = len;
+	pdu->handle = adv ? adv->handle : instance;
+	pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE;
+	pdu->frag_pref = LE_SET_ADV_DATA_NO_FRAG;
 
 	err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_DATA,
-				    sizeof(pdu.cp) + len, &pdu.cp,
+				    struct_size(pdu, data, len), pdu,
 				    HCI_CMD_TIMEOUT);
 	if (err)
 		return err;
@@ -1636,7 +1801,7 @@
 	if (adv) {
 		adv->adv_data_changed = false;
 	} else {
-		memcpy(hdev->adv_data, pdu.data, len);
+		memcpy(hdev->adv_data, pdu->data, len);
 		hdev->adv_data_len = len;
 	}
 
@@ -2602,6 +2767,14 @@
 	return filter_policy;
 }
 
+static void hci_le_scan_phy_params(struct hci_cp_le_scan_phy_params *cp,
+				   u8 type, u16 interval, u16 window)
+{
+	cp->type = type;
+	cp->interval = cpu_to_le16(interval);
+	cp->window = cpu_to_le16(window);
+}
+
 static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type,
 					  u16 interval, u16 window,
 					  u8 own_addr_type, u8 filter_policy)
@@ -2609,7 +2782,7 @@
 	struct hci_cp_le_set_ext_scan_params *cp;
 	struct hci_cp_le_scan_phy_params *phy;
 	u8 data[sizeof(*cp) + sizeof(*phy) * 2];
-	u8 num_phy = 0;
+	u8 num_phy = 0x00;
 
 	cp = (void *)data;
 	phy = (void *)cp->data;
@@ -2619,28 +2792,64 @@
 	cp->own_addr_type = own_addr_type;
 	cp->filter_policy = filter_policy;
 
-	if (scan_1m(hdev) || scan_2m(hdev)) {
-		cp->scanning_phys |= LE_SCAN_PHY_1M;
+	/* Check if PA Sync is in progress then select the PHY based on the
+	 * hci_conn.iso_qos.
+	 */
+	if (hci_dev_test_flag(hdev, HCI_PA_SYNC)) {
+		struct hci_cp_le_add_to_accept_list *sent;
+
+		sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
+		if (sent) {
+			struct hci_conn *conn;
+
+			conn = hci_conn_hash_lookup_ba(hdev, ISO_LINK,
+						       &sent->bdaddr);
+			if (conn) {
+				struct bt_iso_qos *qos = &conn->iso_qos;
+
+				if (qos->bcast.in.phy & BT_ISO_PHY_1M ||
+				    qos->bcast.in.phy & BT_ISO_PHY_2M) {
+					cp->scanning_phys |= LE_SCAN_PHY_1M;
+					hci_le_scan_phy_params(phy, type,
+							       interval,
+							       window);
+					num_phy++;
+					phy++;
+				}
+
+				if (qos->bcast.in.phy & BT_ISO_PHY_CODED) {
+					cp->scanning_phys |= LE_SCAN_PHY_CODED;
+					hci_le_scan_phy_params(phy, type,
+							       interval * 3,
+							       window * 3);
+					num_phy++;
+					phy++;
+				}
 
-		phy->type = type;
-		phy->interval = cpu_to_le16(interval);
-		phy->window = cpu_to_le16(window);
+				if (num_phy)
+					goto done;
+			}
+		}
+	}
 
+	if (scan_1m(hdev) || scan_2m(hdev)) {
+		cp->scanning_phys |= LE_SCAN_PHY_1M;
+		hci_le_scan_phy_params(phy, type, interval, window);
 		num_phy++;
 		phy++;
 	}
 
 	if (scan_coded(hdev)) {
 		cp->scanning_phys |= LE_SCAN_PHY_CODED;
-
-		phy->type = type;
-		phy->interval = cpu_to_le16(interval);
-		phy->window = cpu_to_le16(window);
-
+		hci_le_scan_phy_params(phy, type, interval * 3, window * 3);
 		num_phy++;
 		phy++;
 	}
 
+done:
+	if (!num_phy)
+		return -EINVAL;
+
 	return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS,
 				     sizeof(*cp) + sizeof(*phy) * num_phy,
 				     data, HCI_CMD_TIMEOUT);
@@ -2728,6 +2937,27 @@
 	 */
 	filter_policy = hci_update_accept_list_sync(hdev);
 
+	/* If suspended and filter_policy set to 0x00 (no acceptlist) then
+	 * passive scanning cannot be started since that would require the host
+	 * to be woken up to process the reports.
+	 */
+	if (hdev->suspended && !filter_policy) {
+		/* Check if accept list is empty then there is no need to scan
+		 * while suspended.
+		 */
+		if (list_empty(&hdev->le_accept_list))
+			return 0;
+
+		/* If there are devices is the accept_list that means some
+		 * devices could not be programmed which in non-suspended case
+		 * means filter_policy needs to be set to 0x00 so the host needs
+		 * to filter, but since this is treating suspended case we
+		 * can ignore device needing host to filter to allow devices in
+		 * the acceptlist to be able to wakeup the system.
+		 */
+		filter_policy = 0x01;
+	}
+
 	/* When the controller is using random resolvable addresses and
 	 * with that having LE privacy enabled, then controllers with
 	 * Extended Scanner Filter Policies support can now enable support
@@ -2750,6 +2980,20 @@
 	} else if (hci_is_adv_monitoring(hdev)) {
 		window = hdev->le_scan_window_adv_monitor;
 		interval = hdev->le_scan_int_adv_monitor;
+
+		/* Disable duplicates filter when scanning for advertisement
+		 * monitor for the following reasons.
+		 *
+		 * For HW pattern filtering (ex. MSFT), Realtek and Qualcomm
+		 * controllers ignore RSSI_Sampling_Period when the duplicates
+		 * filter is enabled.
+		 *
+		 * For SW pattern filtering, when we're not doing interleaved
+		 * scanning, it is necessary to disable duplicates filter,
+		 * otherwise hosts can only receive one advertisement and it's
+		 * impossible to know if a peer is still in range.
+		 */
+		filter_dups = LE_SCAN_FILTER_DUP_DISABLE;
 	} else {
 		window = hdev->le_scan_window;
 		interval = hdev->le_scan_interval;
@@ -2879,7 +3123,8 @@
 	    hci_dev_test_flag(hdev, HCI_UNREGISTER))
 		return 0;
 
-	return hci_cmd_sync_queue(hdev, update_passive_scan_sync, NULL, NULL);
+	return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL,
+				       NULL);
 }
 
 int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val)
@@ -3215,7 +3460,10 @@
 	if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
 		return;
 
-	bacpy(&hdev->public_addr, &ba);
+	if (test_bit(HCI_QUIRK_BDADDR_PROPERTY_BROKEN, &hdev->quirks))
+		baswap(&hdev->public_addr, &ba);
+	else
+		bacpy(&hdev->public_addr, &ba);
 }
 
 struct hci_init_stage {
@@ -3316,10 +3564,6 @@
 /* Read Local Supported Features. */
 static int hci_read_local_features_sync(struct hci_dev *hdev)
 {
-	 /* Not all AMP controllers support this command */
-	if (hdev->dev_type == HCI_AMP && !(hdev->commands[14] & 0x20))
-		return 0;
-
 	return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_FEATURES,
 				     0, NULL, HCI_CMD_TIMEOUT);
 }
@@ -3354,51 +3598,6 @@
 	return 0;
 }
 
-/* Read Local AMP Info */
-static int hci_read_local_amp_info_sync(struct hci_dev *hdev)
-{
-	return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_AMP_INFO,
-				     0, NULL, HCI_CMD_TIMEOUT);
-}
-
-/* Read Data Blk size */
-static int hci_read_data_block_size_sync(struct hci_dev *hdev)
-{
-	return __hci_cmd_sync_status(hdev, HCI_OP_READ_DATA_BLOCK_SIZE,
-				     0, NULL, HCI_CMD_TIMEOUT);
-}
-
-/* Read Flow Control Mode */
-static int hci_read_flow_control_mode_sync(struct hci_dev *hdev)
-{
-	return __hci_cmd_sync_status(hdev, HCI_OP_READ_FLOW_CONTROL_MODE,
-				     0, NULL, HCI_CMD_TIMEOUT);
-}
-
-/* Read Location Data */
-static int hci_read_location_data_sync(struct hci_dev *hdev)
-{
-	return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCATION_DATA,
-				     0, NULL, HCI_CMD_TIMEOUT);
-}
-
-/* AMP Controller init stage 1 command sequence */
-static const struct hci_init_stage amp_init1[] = {
-	/* HCI_OP_READ_LOCAL_VERSION */
-	HCI_INIT(hci_read_local_version_sync),
-	/* HCI_OP_READ_LOCAL_COMMANDS */
-	HCI_INIT(hci_read_local_cmds_sync),
-	/* HCI_OP_READ_LOCAL_AMP_INFO */
-	HCI_INIT(hci_read_local_amp_info_sync),
-	/* HCI_OP_READ_DATA_BLOCK_SIZE */
-	HCI_INIT(hci_read_data_block_size_sync),
-	/* HCI_OP_READ_FLOW_CONTROL_MODE */
-	HCI_INIT(hci_read_flow_control_mode_sync),
-	/* HCI_OP_READ_LOCATION_DATA */
-	HCI_INIT(hci_read_location_data_sync),
-	{}
-};
-
 static int hci_init1_sync(struct hci_dev *hdev)
 {
 	int err;
@@ -3412,28 +3611,9 @@
 			return err;
 	}
 
-	switch (hdev->dev_type) {
-	case HCI_PRIMARY:
-		hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
-		return hci_init_stage_sync(hdev, br_init1);
-	case HCI_AMP:
-		hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
-		return hci_init_stage_sync(hdev, amp_init1);
-	default:
-		bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
-		break;
-	}
-
-	return 0;
+	return hci_init_stage_sync(hdev, br_init1);
 }
 
-/* AMP Controller init stage 2 command sequence */
-static const struct hci_init_stage amp_init2[] = {
-	/* HCI_OP_READ_LOCAL_FEATURES */
-	HCI_INIT(hci_read_local_features_sync),
-	{}
-};
-
 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 static int hci_read_buffer_size_sync(struct hci_dev *hdev)
 {
@@ -3691,9 +3871,6 @@
 
 	bt_dev_dbg(hdev, "");
 
-	if (hdev->dev_type == HCI_AMP)
-		return hci_init_stage_sync(hdev, amp_init2);
-
 	err = hci_init_stage_sync(hdev, hci_init2);
 	if (err)
 		return err;
@@ -4531,13 +4708,6 @@
 	if (err < 0)
 		return err;
 
-	/* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
-	 * BR/EDR/LE type controllers. AMP controllers only need the
-	 * first two stages of init.
-	 */
-	if (hdev->dev_type != HCI_PRIMARY)
-		return 0;
-
 	err = hci_init3_sync(hdev);
 	if (err < 0)
 		return err;
@@ -4601,6 +4771,13 @@
 	HCI_QUIRK_BROKEN(SET_RPA_TIMEOUT,
 			 "HCI LE Set Random Private Address Timeout command is "
 			 "advertised, but not supported."),
+	HCI_QUIRK_BROKEN(EXT_CREATE_CONN,
+			 "HCI LE Extended Create Connection command is "
+			 "advertised, but not supported."),
+	HCI_QUIRK_BROKEN(WRITE_AUTH_PAYLOAD_TIMEOUT,
+			 "HCI WRITE AUTH PAYLOAD TIMEOUT command leads "
+			 "to unexpected SMP errors when pairing "
+			 "and will not be used."),
 	HCI_QUIRK_BROKEN(LE_CODED,
 			 "HCI LE Coded PHY feature bit is set, "
 			 "but its usage is not supported.")
@@ -4766,12 +4943,8 @@
 		 * In case of user channel usage, it is not important
 		 * if a public address or static random address is
 		 * available.
-		 *
-		 * This check is only valid for BR/EDR controllers
-		 * since AMP controllers do not have an address.
 		 */
 		if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
-		    hdev->dev_type == HCI_PRIMARY &&
 		    !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
 		    !bacmp(&hdev->static_addr, BDADDR_ANY)) {
 			ret = -EADDRNOTAVAIL;
@@ -4806,8 +4979,7 @@
 		    !hci_dev_test_flag(hdev, HCI_CONFIG) &&
 		    !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
 		    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
-		    hci_dev_test_flag(hdev, HCI_MGMT) &&
-		    hdev->dev_type == HCI_PRIMARY) {
+		    hci_dev_test_flag(hdev, HCI_MGMT)) {
 			ret = hci_powered_update_sync(hdev);
 			mgmt_power_on(hdev, ret);
 		}
@@ -4834,6 +5006,11 @@
 			hdev->sent_cmd = NULL;
 		}
 
+		if (hdev->req_skb) {
+			kfree_skb(hdev->req_skb);
+			hdev->req_skb = NULL;
+		}
+
 		clear_bit(HCI_RUNNING, &hdev->flags);
 		hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
 
@@ -4891,6 +5068,7 @@
 {
 	bool auto_off;
 	int err = 0;
+	struct hci_cmd_sync_work_entry *entry, *tmp;
 
 	bt_dev_dbg(hdev, "");
 
@@ -4947,8 +5125,7 @@
 
 	auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
 
-	if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
-	    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
+	if (!auto_off && !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
 	    hci_dev_test_flag(hdev, HCI_MGMT))
 		__mgmt_power_off(hdev);
 
@@ -4994,9 +5171,20 @@
 		hdev->sent_cmd = NULL;
 	}
 
+	/* Drop last request */
+	if (hdev->req_skb) {
+		kfree_skb(hdev->req_skb);
+		hdev->req_skb = NULL;
+	}
+
 	clear_bit(HCI_RUNNING, &hdev->flags);
 	hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
 
+	mutex_lock(&hdev->cmd_sync_work_lock);
+	list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list)
+		_hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
+	mutex_unlock(&hdev->cmd_sync_work_lock);
+
 	/* After this point our queues are empty and no tasks are scheduled. */
 	hdev->close(hdev);
 
@@ -5004,9 +5192,6 @@
 	hdev->flags &= BIT(HCI_RAW);
 	hci_dev_clear_volatile_flags(hdev);
 
-	/* Controller radio is available but is currently powered down */
-	hdev->amp_status = AMP_STATUS_POWERED_DOWN;
-
 	memset(hdev->eir, 0, sizeof(hdev->eir));
 	memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
 	bacpy(&hdev->random_addr, BDADDR_ANY);
@@ -5043,8 +5228,7 @@
 	 */
 	if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
 	    hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
-	    (hdev->dev_type == HCI_PRIMARY &&
-	     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
+	    (!bacmp(&hdev->bdaddr, BDADDR_ANY) &&
 	     !bacmp(&hdev->static_addr, BDADDR_ANY))) {
 		hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
 		hci_dev_close_sync(hdev);
@@ -5140,33 +5324,20 @@
 		if (!e)
 			return 0;
 
-		return hci_remote_name_cancel_sync(hdev, &e->data.bdaddr);
+		/* Ignore cancel errors since it should interfere with stopping
+		 * of the discovery.
+		 */
+		hci_remote_name_cancel_sync(hdev, &e->data.bdaddr);
 	}
 
 	return 0;
 }
 
-static int hci_disconnect_phy_link_sync(struct hci_dev *hdev, u16 handle,
-					u8 reason)
-{
-	struct hci_cp_disconn_phy_link cp;
-
-	memset(&cp, 0, sizeof(cp));
-	cp.phy_handle = HCI_PHY_HANDLE(handle);
-	cp.reason = reason;
-
-	return __hci_cmd_sync_status(hdev, HCI_OP_DISCONN_PHY_LINK,
-				     sizeof(cp), &cp, HCI_CMD_TIMEOUT);
-}
-
 static int hci_disconnect_sync(struct hci_dev *hdev, struct hci_conn *conn,
 			       u8 reason)
 {
 	struct hci_cp_disconnect cp;
 
-	if (conn->type == AMP_LINK)
-		return hci_disconnect_phy_link_sync(hdev, conn->handle, reason);
-
 	if (test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) {
 		/* This is a BIS connection, hci_conn_del will
 		 * do the necessary cleanup.
@@ -6132,7 +6303,8 @@
 
 	plen = sizeof(*cp);
 
-	if (scan_1m(hdev)) {
+	if (scan_1m(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_1M ||
+			      conn->le_adv_sec_phy == HCI_ADV_PHY_1M)) {
 		cp->phys |= LE_SCAN_PHY_1M;
 		set_ext_conn_params(conn, p);
 
@@ -6140,7 +6312,8 @@
 		plen += sizeof(*p);
 	}
 
-	if (scan_2m(hdev)) {
+	if (scan_2m(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_2M ||
+			      conn->le_adv_sec_phy == HCI_ADV_PHY_2M)) {
 		cp->phys |= LE_SCAN_PHY_2M;
 		set_ext_conn_params(conn, p);
 
@@ -6148,7 +6321,8 @@
 		plen += sizeof(*p);
 	}
 
-	if (scan_coded(hdev)) {
+	if (scan_coded(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_CODED ||
+				 conn->le_adv_sec_phy == HCI_ADV_PHY_CODED)) {
 		cp->phys |= LE_SCAN_PHY_CODED;
 		set_ext_conn_params(conn, p);
 
@@ -6161,12 +6335,21 @@
 					conn->conn_timeout, NULL);
 }
 
-int hci_le_create_conn_sync(struct hci_dev *hdev, struct hci_conn *conn)
+static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data)
 {
 	struct hci_cp_le_create_conn cp;
 	struct hci_conn_params *params;
 	u8 own_addr_type;
 	int err;
+	struct hci_conn *conn = data;
+
+	if (!hci_conn_valid(hdev, conn))
+		return -ECANCELED;
+
+	bt_dev_dbg(hdev, "conn %p", conn);
+
+	clear_bit(HCI_CONN_SCANNING, &conn->flags);
+	conn->state = BT_CONNECT;
 
 	/* If requested to connect as peripheral use directed advertising */
 	if (conn->role == HCI_ROLE_SLAVE) {
@@ -6222,7 +6405,7 @@
 					     &own_addr_type);
 	if (err)
 		goto done;
-
+	/* Send command LE Extended Create Connection if supported */
 	if (use_ext_conn(hdev)) {
 		err = hci_le_ext_create_conn_sync(hdev, conn, own_addr_type);
 		goto done;
@@ -6267,10 +6450,8 @@
 
 int hci_le_create_cis_sync(struct hci_dev *hdev)
 {
-	struct {
-		struct hci_cp_le_create_cis cp;
-		struct hci_cis cis[0x1f];
-	} cmd;
+	DEFINE_FLEX(struct hci_cp_le_create_cis, cmd, cis, num_cis, 0x1f);
+	size_t aux_num_cis = 0;
 	struct hci_conn *conn;
 	u8 cig = BT_ISO_QOS_CIG_UNSET;
 
@@ -6297,8 +6478,6 @@
 	 * remains pending.
 	 */
 
-	memset(&cmd, 0, sizeof(cmd));
-
 	hci_dev_lock(hdev);
 
 	rcu_read_lock();
@@ -6335,7 +6514,7 @@
 		goto done;
 
 	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
-		struct hci_cis *cis = &cmd.cis[cmd.cp.num_cis];
+		struct hci_cis *cis = &cmd->cis[aux_num_cis];
 
 		if (hci_conn_check_create_cis(conn) ||
 		    conn->iso_qos.ucast.cig != cig)
@@ -6344,25 +6523,25 @@
 		set_bit(HCI_CONN_CREATE_CIS, &conn->flags);
 		cis->acl_handle = cpu_to_le16(conn->parent->handle);
 		cis->cis_handle = cpu_to_le16(conn->handle);
-		cmd.cp.num_cis++;
+		aux_num_cis++;
 
-		if (cmd.cp.num_cis >= ARRAY_SIZE(cmd.cis))
+		if (aux_num_cis >= 0x1f)
 			break;
 	}
+	cmd->num_cis = aux_num_cis;
 
 done:
 	rcu_read_unlock();
 
 	hci_dev_unlock(hdev);
 
-	if (!cmd.cp.num_cis)
+	if (!aux_num_cis)
 		return 0;
 
 	/* Wait for HCI_LE_CIS_Established */
 	return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CIS,
-					sizeof(cmd.cp) + sizeof(cmd.cis[0]) *
-					cmd.cp.num_cis, &cmd,
-					HCI_EVT_LE_CIS_ESTABLISHED,
+					struct_size(cmd, cis, cmd->num_cis),
+					cmd, HCI_EVT_LE_CIS_ESTABLISHED,
 					conn->conn_timeout, NULL);
 }
 
@@ -6484,3 +6663,125 @@
 	return hci_cmd_sync_queue(hdev, _update_adv_data_sync,
 				  UINT_PTR(instance), NULL);
 }
+
+static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
+{
+	struct hci_conn *conn = data;
+	struct inquiry_entry *ie;
+	struct hci_cp_create_conn cp;
+	int err;
+
+	if (!hci_conn_valid(hdev, conn))
+		return -ECANCELED;
+
+	/* Many controllers disallow HCI Create Connection while it is doing
+	 * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create
+	 * Connection. This may cause the MGMT discovering state to become false
+	 * without user space's request but it is okay since the MGMT Discovery
+	 * APIs do not promise that discovery should be done forever. Instead,
+	 * the user space monitors the status of MGMT discovering and it may
+	 * request for discovery again when this flag becomes false.
+	 */
+	if (test_bit(HCI_INQUIRY, &hdev->flags)) {
+		err = __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY_CANCEL, 0,
+					    NULL, HCI_CMD_TIMEOUT);
+		if (err)
+			bt_dev_warn(hdev, "Failed to cancel inquiry %d", err);
+	}
+
+	conn->state = BT_CONNECT;
+	conn->out = true;
+	conn->role = HCI_ROLE_MASTER;
+
+	conn->attempt++;
+
+	conn->link_policy = hdev->link_policy;
+
+	memset(&cp, 0, sizeof(cp));
+	bacpy(&cp.bdaddr, &conn->dst);
+	cp.pscan_rep_mode = 0x02;
+
+	ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
+	if (ie) {
+		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
+			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
+			cp.pscan_mode     = ie->data.pscan_mode;
+			cp.clock_offset   = ie->data.clock_offset |
+					    cpu_to_le16(0x8000);
+		}
+
+		memcpy(conn->dev_class, ie->data.dev_class, 3);
+	}
+
+	cp.pkt_type = cpu_to_le16(conn->pkt_type);
+	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
+		cp.role_switch = 0x01;
+	else
+		cp.role_switch = 0x00;
+
+	return __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN,
+					sizeof(cp), &cp,
+					HCI_EV_CONN_COMPLETE,
+					conn->conn_timeout, NULL);
+}
+
+int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn)
+{
+	return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn,
+				       NULL);
+}
+
+static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
+{
+	struct hci_conn *conn = data;
+
+	bt_dev_dbg(hdev, "err %d", err);
+
+	if (err == -ECANCELED)
+		return;
+
+	hci_dev_lock(hdev);
+
+	if (!hci_conn_valid(hdev, conn))
+		goto done;
+
+	if (!err) {
+		hci_connect_le_scan_cleanup(conn, 0x00);
+		goto done;
+	}
+
+	/* Check if connection is still pending */
+	if (conn != hci_lookup_le_connect(hdev))
+		goto done;
+
+	/* Flush to make sure we send create conn cancel command if needed */
+	flush_delayed_work(&conn->le_conn_timeout);
+	hci_conn_failed(conn, bt_status(err));
+
+done:
+	hci_dev_unlock(hdev);
+}
+
+int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn)
+{
+	return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn,
+				       create_le_conn_complete);
+}
+
+int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn)
+{
+	if (conn->state != BT_OPEN)
+		return -EINVAL;
+
+	switch (conn->type) {
+	case ACL_LINK:
+		return !hci_cmd_sync_dequeue_once(hdev,
+						  hci_acl_create_conn_sync,
+						  conn, NULL);
+	case LE_LINK:
+		return !hci_cmd_sync_dequeue_once(hdev, hci_le_create_conn_sync,
+						  conn, create_le_conn_complete);
+	}
+
+	return -ENOENT;
+}
--- linux-qcom-6.8.0.orig/net/bluetooth/hci_sysfs.c
+++ linux-qcom-6.8.0/net/bluetooth/hci_sysfs.c
@@ -21,16 +21,6 @@
 	.release = bt_link_release,
 };
 
-/*
- * The rfcomm tty device will possibly retain even when conn
- * is down, and sysfs doesn't support move zombie device,
- * so we should move the device before conn device is destroyed.
- */
-static int __match_tty(struct device *dev, void *data)
-{
-	return !strncmp(dev_name(dev), "rfcomm", 6);
-}
-
 void hci_conn_init_sysfs(struct hci_conn *conn)
 {
 	struct hci_dev *hdev = conn->hdev;
@@ -73,10 +63,13 @@
 		return;
 	}
 
+	/* If there are devices using the connection as parent reset it to NULL
+	 * before unregistering the device.
+	 */
 	while (1) {
 		struct device *dev;
 
-		dev = device_find_child(&conn->dev, NULL, __match_tty);
+		dev = device_find_any_child(&conn->dev);
 		if (!dev)
 			break;
 		device_move(dev, NULL, DPM_ORDER_DEV_LAST);
--- linux-qcom-6.8.0.orig/net/bluetooth/iso.c
+++ linux-qcom-6.8.0/net/bluetooth/iso.c
@@ -3,7 +3,7 @@
  * BlueZ - Bluetooth protocol stack for Linux
  *
  * Copyright (C) 2022 Intel Corporation
- * Copyright 2023 NXP
+ * Copyright 2023-2024 NXP
  */
 
 #include <linux/module.h>
@@ -35,6 +35,7 @@
 	struct sk_buff	*rx_skb;
 	__u32		rx_len;
 	__u16		tx_sn;
+	struct kref	ref;
 };
 
 #define iso_conn_lock(c)	spin_lock(&(c)->lock)
@@ -54,7 +55,6 @@
 enum {
 	BT_SK_BIG_SYNC,
 	BT_SK_PA_SYNC,
-	BT_SK_PA_SYNC_TERM,
 };
 
 struct iso_pinfo {
@@ -81,28 +81,86 @@
 static bool check_bcast_qos(struct bt_iso_qos *qos);
 static bool iso_match_sid(struct sock *sk, void *data);
 static bool iso_match_sync_handle(struct sock *sk, void *data);
+static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data);
 static void iso_sock_disconn(struct sock *sk);
 
 typedef bool (*iso_sock_match_t)(struct sock *sk, void *data);
 
-static struct sock *iso_get_sock_listen(bdaddr_t *src, bdaddr_t *dst,
-					iso_sock_match_t match, void *data);
+static struct sock *iso_get_sock(bdaddr_t *src, bdaddr_t *dst,
+				 enum bt_sock_state state,
+				 iso_sock_match_t match, void *data);
 
 /* ---- ISO timers ---- */
 #define ISO_CONN_TIMEOUT	(HZ * 40)
 #define ISO_DISCONN_TIMEOUT	(HZ * 2)
 
+static void iso_conn_free(struct kref *ref)
+{
+	struct iso_conn *conn = container_of(ref, struct iso_conn, ref);
+
+	BT_DBG("conn %p", conn);
+
+	if (conn->sk)
+		iso_pi(conn->sk)->conn = NULL;
+
+	if (conn->hcon) {
+		conn->hcon->iso_data = NULL;
+		hci_conn_drop(conn->hcon);
+	}
+
+	/* Ensure no more work items will run since hci_conn has been dropped */
+	cancel_delayed_work_sync(&conn->timeout_work);
+
+	kfree(conn);
+}
+
+static void iso_conn_put(struct iso_conn *conn)
+{
+	if (!conn)
+		return;
+
+	BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref));
+
+	kref_put(&conn->ref, iso_conn_free);
+}
+
+static struct iso_conn *iso_conn_hold_unless_zero(struct iso_conn *conn)
+{
+	if (!conn)
+		return NULL;
+
+	BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));
+
+	if (!kref_get_unless_zero(&conn->ref))
+		return NULL;
+
+	return conn;
+}
+
+static struct sock *iso_sock_hold(struct iso_conn *conn)
+{
+	if (!conn || !bt_sock_linked(&iso_sk_list, conn->sk))
+		return NULL;
+
+	sock_hold(conn->sk);
+
+	return conn->sk;
+}
+
 static void iso_sock_timeout(struct work_struct *work)
 {
 	struct iso_conn *conn = container_of(work, struct iso_conn,
 					     timeout_work.work);
 	struct sock *sk;
 
+	conn = iso_conn_hold_unless_zero(conn);
+	if (!conn)
+		return;
+
 	iso_conn_lock(conn);
-	sk = conn->sk;
-	if (sk)
-		sock_hold(sk);
+	sk = iso_sock_hold(conn);
 	iso_conn_unlock(conn);
+	iso_conn_put(conn);
 
 	if (!sk)
 		return;
@@ -140,9 +198,14 @@
 {
 	struct iso_conn *conn = hcon->iso_data;
 
+	conn = iso_conn_hold_unless_zero(conn);
 	if (conn) {
-		if (!conn->hcon)
+		if (!conn->hcon) {
+			iso_conn_lock(conn);
 			conn->hcon = hcon;
+			iso_conn_unlock(conn);
+		}
+		iso_conn_put(conn);
 		return conn;
 	}
 
@@ -150,6 +213,7 @@
 	if (!conn)
 		return NULL;
 
+	kref_init(&conn->ref);
 	spin_lock_init(&conn->lock);
 	INIT_DELAYED_WORK(&conn->timeout_work, iso_sock_timeout);
 
@@ -169,17 +233,15 @@
 	struct sock *parent;
 
 	conn = iso_pi(sk)->conn;
+	iso_pi(sk)->conn = NULL;
 
 	BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 
 	if (conn) {
 		iso_conn_lock(conn);
 		conn->sk = NULL;
-		iso_pi(sk)->conn = NULL;
 		iso_conn_unlock(conn);
-
-		if (conn->hcon)
-			hci_conn_drop(conn->hcon);
+		iso_conn_put(conn);
 	}
 
 	sk->sk_state = BT_CLOSED;
@@ -196,22 +258,12 @@
 	sock_set_flag(sk, SOCK_ZAPPED);
 }
 
-static bool iso_match_conn_sync_handle(struct sock *sk, void *data)
-{
-	struct hci_conn *hcon = data;
-
-	if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags))
-		return false;
-
-	return hcon->sync_handle == iso_pi(sk)->sync_handle;
-}
-
 static void iso_conn_del(struct hci_conn *hcon, int err)
 {
 	struct iso_conn *conn = hcon->iso_data;
 	struct sock *sk;
-	struct sock *parent;
 
+	conn = iso_conn_hold_unless_zero(conn);
 	if (!conn)
 		return;
 
@@ -219,43 +271,20 @@
 
 	/* Kill socket */
 	iso_conn_lock(conn);
-	sk = conn->sk;
-	if (sk)
-		sock_hold(sk);
+	sk = iso_sock_hold(conn);
 	iso_conn_unlock(conn);
+	iso_conn_put(conn);
 
-	if (sk) {
-		lock_sock(sk);
-
-		/* While a PA sync hcon is in the process of closing,
-		 * mark parent socket with a flag, so that any residual
-		 * BIGInfo adv reports that arrive before PA sync is
-		 * terminated are not processed anymore.
-		 */
-		if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
-			parent = iso_get_sock_listen(&hcon->src,
-						     &hcon->dst,
-						     iso_match_conn_sync_handle,
-						     hcon);
-
-			if (parent) {
-				set_bit(BT_SK_PA_SYNC_TERM,
-					&iso_pi(parent)->flags);
-				sock_put(parent);
-			}
-		}
-
-		iso_sock_clear_timer(sk);
-		iso_chan_del(sk, err);
-		release_sock(sk);
-		sock_put(sk);
+	if (!sk) {
+		iso_conn_put(conn);
+		return;
 	}
 
-	/* Ensure no more work items will run before freeing conn. */
-	cancel_delayed_work_sync(&conn->timeout_work);
-
-	hcon->iso_data = NULL;
-	kfree(conn);
+	lock_sock(sk);
+	iso_sock_clear_timer(sk);
+	iso_chan_del(sk, err);
+	release_sock(sk);
+	sock_put(sk);
 }
 
 static int __iso_chan_add(struct iso_conn *conn, struct sock *sk,
@@ -581,22 +610,23 @@
 	return NULL;
 }
 
-/* Find socket listening:
+/* Find socket in given state:
  * source bdaddr (Unicast)
  * destination bdaddr (Broadcast only)
  * match func - pass NULL to ignore
  * match func data - pass -1 to ignore
  * Returns closest match.
  */
-static struct sock *iso_get_sock_listen(bdaddr_t *src, bdaddr_t *dst,
-					iso_sock_match_t match, void *data)
+static struct sock *iso_get_sock(bdaddr_t *src, bdaddr_t *dst,
+				 enum bt_sock_state state,
+				 iso_sock_match_t match, void *data)
 {
 	struct sock *sk = NULL, *sk1 = NULL;
 
 	read_lock(&iso_sk_list.lock);
 
 	sk_for_each(sk, &iso_sk_list.head) {
-		if (sk->sk_state != BT_LISTEN)
+		if (sk->sk_state != state)
 			continue;
 
 		/* Match Broadcast destination */
@@ -674,6 +704,8 @@
 {
 	BT_DBG("sk %p", sk);
 
+	iso_conn_put(iso_pi(sk)->conn);
+
 	skb_queue_purge(&sk->sk_receive_queue);
 	skb_queue_purge(&sk->sk_write_queue);
 }
@@ -690,11 +722,8 @@
 		iso_sock_kill(sk);
 	}
 
-	/* If listening socket stands for a PA sync connection,
-	 * properly disconnect the hcon and socket.
-	 */
-	if (iso_pi(parent)->conn && iso_pi(parent)->conn->hcon &&
-	    test_bit(HCI_CONN_PA_SYNC, &iso_pi(parent)->conn->hcon->flags)) {
+	/* If listening socket has a hcon, properly disconnect it */
+	if (iso_pi(parent)->conn && iso_pi(parent)->conn->hcon) {
 		iso_sock_disconn(parent);
 		return;
 	}
@@ -736,6 +765,7 @@
 		 */
 		if (bis_sk) {
 			hcon->state = BT_OPEN;
+			hcon->iso_data = NULL;
 			iso_pi(sk)->conn->hcon = NULL;
 			iso_sock_clear_timer(sk);
 			iso_chan_del(sk, bt_to_errno(hcon->abort_reason));
@@ -745,7 +775,6 @@
 	}
 
 	sk->sk_state = BT_DISCONN;
-	iso_sock_set_timer(sk, ISO_DISCONN_TIMEOUT);
 	iso_conn_lock(iso_pi(sk)->conn);
 	hci_conn_drop(iso_pi(sk)->conn->hcon);
 	iso_pi(sk)->conn->hcon = NULL;
@@ -837,10 +866,10 @@
 		.bcode			= {0x00},
 		.options		= 0x00,
 		.skip			= 0x0000,
-		.sync_timeout		= 0x4000,
+		.sync_timeout		= BT_ISO_SYNC_TIMEOUT,
 		.sync_cte_type		= 0x00,
 		.mse			= 0x00,
-		.timeout		= 0x4000,
+		.timeout		= BT_ISO_SYNC_TIMEOUT,
 	},
 };
 
@@ -860,6 +889,7 @@
 	iso_pi(sk)->src_type = BDADDR_LE_PUBLIC;
 
 	iso_pi(sk)->qos = default_qos;
+	iso_pi(sk)->sync_handle = -1;
 
 	bt_sock_link(&iso_sk_list, sk);
 	return sk;
@@ -907,7 +937,6 @@
 		return -EINVAL;
 
 	iso_pi(sk)->dst_type = sa->iso_bc->bc_bdaddr_type;
-	iso_pi(sk)->sync_handle = -1;
 
 	if (sa->iso_bc->bc_sid > 0x0f)
 		return -EINVAL;
@@ -984,7 +1013,8 @@
 	/* Allow the user to bind a PA sync socket to a number
 	 * of BISes to sync to.
 	 */
-	if (sk->sk_state == BT_CONNECT2 &&
+	if ((sk->sk_state == BT_CONNECT2 ||
+	     sk->sk_state == BT_CONNECTED) &&
 	    test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
 		err = iso_sock_bind_pa_sk(sk, sa, addr_len);
 		goto done;
@@ -1076,6 +1106,8 @@
 {
 	struct hci_dev *hdev;
 	int err = 0;
+	struct iso_conn *conn;
+	struct hci_conn *hcon;
 
 	BT_DBG("%pMR -> %pMR (SID 0x%2.2x)", &iso_pi(sk)->src,
 	       &iso_pi(sk)->dst, iso_pi(sk)->bc_sid);
@@ -1096,18 +1128,41 @@
 	if (!hdev)
 		return -EHOSTUNREACH;
 
+	hci_dev_lock(hdev);
+	lock_sock(sk);
+
 	/* Fail if user set invalid QoS */
 	if (iso_pi(sk)->qos_user_set && !check_bcast_qos(&iso_pi(sk)->qos)) {
 		iso_pi(sk)->qos = default_qos;
-		return -EINVAL;
+		err = -EINVAL;
+		goto unlock;
 	}
 
-	err = hci_pa_create_sync(hdev, &iso_pi(sk)->dst,
-				 le_addr_type(iso_pi(sk)->dst_type),
-				 iso_pi(sk)->bc_sid, &iso_pi(sk)->qos);
+	hcon = hci_pa_create_sync(hdev, &iso_pi(sk)->dst,
+				  le_addr_type(iso_pi(sk)->dst_type),
+				  iso_pi(sk)->bc_sid, &iso_pi(sk)->qos);
+	if (IS_ERR(hcon)) {
+		err = PTR_ERR(hcon);
+		goto unlock;
+	}
 
-	hci_dev_put(hdev);
+	conn = iso_conn_add(hcon);
+	if (!conn) {
+		hci_conn_drop(hcon);
+		err = -ENOMEM;
+		goto unlock;
+	}
+
+	err = iso_chan_add(conn, sk, NULL);
+	if (err) {
+		hci_conn_drop(hcon);
+		goto unlock;
+	}
 
+unlock:
+	release_sock(sk);
+	hci_dev_unlock(hdev);
+	hci_dev_put(hdev);
 	return err;
 }
 
@@ -1134,6 +1189,7 @@
 
 	BT_DBG("sk %p backlog %d", sk, backlog);
 
+	sock_hold(sk);
 	lock_sock(sk);
 
 	if (sk->sk_state != BT_BOUND) {
@@ -1146,10 +1202,16 @@
 		goto done;
 	}
 
-	if (!bacmp(&iso_pi(sk)->dst, BDADDR_ANY))
+	if (!bacmp(&iso_pi(sk)->dst, BDADDR_ANY)) {
 		err = iso_listen_cis(sk);
-	else
+	} else {
+		/* Drop sock lock to avoid potential
+		 * deadlock with the hdev lock.
+		 */
+		release_sock(sk);
 		err = iso_listen_bis(sk);
+		lock_sock(sk);
+	}
 
 	if (err)
 		goto done;
@@ -1161,6 +1223,7 @@
 
 done:
 	release_sock(sk);
+	sock_put(sk);
 	return err;
 }
 
@@ -1172,7 +1235,11 @@
 	long timeo;
 	int err = 0;
 
-	lock_sock(sk);
+	/* Use explicit nested locking to avoid lockdep warnings generated
+	 * because the parent socket and the child socket are locked on the
+	 * same thread.
+	 */
+	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 
 	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 
@@ -1203,7 +1270,7 @@
 		release_sock(sk);
 
 		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
-		lock_sock(sk);
+		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 	}
 	remove_wait_queue(sk_sleep(sk), &wait);
 
@@ -1264,7 +1331,7 @@
 		return -ENOTCONN;
 	}
 
-	mtu = iso_pi(sk)->conn->hcon->hdev->iso_mtu;
+	mtu = iso_pi(sk)->conn->hcon->mtu;
 
 	release_sock(sk);
 
@@ -1338,6 +1405,14 @@
 	if (!hdev)
 		return;
 
+	/* hci_le_big_create_sync requires hdev lock to be held, since
+	 * it enqueues the HCI LE BIG Create Sync command via
+	 * hci_cmd_sync_queue_once, which checks hdev flags that might
+	 * change.
+	 */
+	hci_dev_lock(hdev);
+	lock_sock(sk);
+
 	if (!test_and_set_bit(BT_SK_BIG_SYNC, &iso_pi(sk)->flags)) {
 		err = hci_le_big_create_sync(hdev, iso_pi(sk)->conn->hcon,
 					     &iso_pi(sk)->qos,
@@ -1348,6 +1423,9 @@
 			bt_dev_err(hdev, "hci_le_big_create_sync: %d",
 				   err);
 	}
+
+	release_sock(sk);
+	hci_dev_unlock(hdev);
 }
 
 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
@@ -1355,30 +1433,57 @@
 {
 	struct sock *sk = sock->sk;
 	struct iso_pinfo *pi = iso_pi(sk);
+	bool early_ret = false;
+	int err = 0;
 
 	BT_DBG("sk %p", sk);
 
 	if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
+		sock_hold(sk);
 		lock_sock(sk);
+
 		switch (sk->sk_state) {
 		case BT_CONNECT2:
-			if (pi->conn->hcon &&
-			    test_bit(HCI_CONN_PA_SYNC, &pi->conn->hcon->flags)) {
+			if (test_bit(BT_SK_PA_SYNC, &pi->flags)) {
+				release_sock(sk);
 				iso_conn_big_sync(sk);
+				lock_sock(sk);
+
 				sk->sk_state = BT_LISTEN;
 			} else {
 				iso_conn_defer_accept(pi->conn->hcon);
 				sk->sk_state = BT_CONFIG;
 			}
-			release_sock(sk);
-			return 0;
+
+			early_ret = true;
+			break;
+		case BT_CONNECTED:
+			if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
+				release_sock(sk);
+				iso_conn_big_sync(sk);
+				lock_sock(sk);
+
+				sk->sk_state = BT_LISTEN;
+				early_ret = true;
+			}
+
+			break;
 		case BT_CONNECT:
 			release_sock(sk);
-			return iso_connect_cis(sk);
+			err = iso_connect_cis(sk);
+			lock_sock(sk);
+
+			early_ret = true;
+			break;
 		default:
-			release_sock(sk);
 			break;
 		}
+
+		release_sock(sk);
+		sock_put(sk);
+
+		if (early_ret)
+			return err;
 	}
 
 	return bt_sock_recvmsg(sock, msg, len, flags);
@@ -1430,8 +1535,8 @@
 
 static bool check_bcast_qos(struct bt_iso_qos *qos)
 {
-	if (qos->bcast.sync_factor == 0x00)
-		return false;
+	if (!qos->bcast.sync_factor)
+		qos->bcast.sync_factor = 0x01;
 
 	if (qos->bcast.packing > 0x01)
 		return false;
@@ -1454,6 +1559,9 @@
 	if (qos->bcast.skip > 0x01f3)
 		return false;
 
+	if (!qos->bcast.sync_timeout)
+		qos->bcast.sync_timeout = BT_ISO_SYNC_TIMEOUT;
+
 	if (qos->bcast.sync_timeout < 0x000a || qos->bcast.sync_timeout > 0x4000)
 		return false;
 
@@ -1463,6 +1571,9 @@
 	if (qos->bcast.mse > 0x1f)
 		return false;
 
+	if (!qos->bcast.timeout)
+		qos->bcast.sync_timeout = BT_ISO_SYNC_TIMEOUT;
+
 	if (qos->bcast.timeout < 0x000a || qos->bcast.timeout > 0x4000)
 		return false;
 
@@ -1473,7 +1584,7 @@
 			       sockptr_t optval, unsigned int optlen)
 {
 	struct sock *sk = sock->sk;
-	int len, err = 0;
+	int err = 0;
 	struct bt_iso_qos qos = default_qos;
 	u32 opt;
 
@@ -1488,10 +1599,9 @@
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -1500,10 +1610,9 @@
 		break;
 
 	case BT_PKT_STATUS:
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
@@ -1513,22 +1622,16 @@
 
 	case BT_ISO_QOS:
 		if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
-		    sk->sk_state != BT_CONNECT2) {
+		    sk->sk_state != BT_CONNECT2 &&
+		    (!test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags) ||
+		    sk->sk_state != BT_CONNECTED)) {
 			err = -EINVAL;
 			break;
 		}
 
-		len = min_t(unsigned int, sizeof(qos), optlen);
-
-		if (copy_from_sockptr(&qos, optval, len)) {
-			err = -EFAULT;
-			break;
-		}
-
-		if (len == sizeof(qos.ucast) && !check_ucast_qos(&qos)) {
-			err = -EINVAL;
+		err = copy_safe_from_sockptr(&qos, sizeof(qos), optval, optlen);
+		if (err)
 			break;
-		}
 
 		iso_pi(sk)->qos = qos;
 		iso_pi(sk)->qos_user_set = true;
@@ -1543,18 +1646,16 @@
 		}
 
 		if (optlen > sizeof(iso_pi(sk)->base)) {
-			err = -EOVERFLOW;
+			err = -EINVAL;
 			break;
 		}
 
-		len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen);
-
-		if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(iso_pi(sk)->base, optlen, optval,
+					     optlen);
+		if (err)
 			break;
-		}
 
-		iso_pi(sk)->base_len = len;
+		iso_pi(sk)->base_len = optlen;
 
 		break;
 
@@ -1744,7 +1845,7 @@
 	struct sock *sk = conn->sk;
 	struct hci_ev_le_big_sync_estabilished *ev = NULL;
 	struct hci_ev_le_pa_sync_established *ev2 = NULL;
-	struct hci_evt_le_big_info_adv_report *ev3 = NULL;
+	struct hci_ev_le_per_adv_report *ev3 = NULL;
 	struct hci_conn *hcon;
 
 	BT_DBG("conn %p", conn);
@@ -1762,32 +1863,37 @@
 						 HCI_EVT_LE_BIG_SYNC_ESTABILISHED);
 
 			/* Get reference to PA sync parent socket, if it exists */
-			parent = iso_get_sock_listen(&hcon->src,
-						     &hcon->dst,
-						     iso_match_pa_sync_flag, NULL);
+			parent = iso_get_sock(&hcon->src, &hcon->dst,
+					      BT_LISTEN,
+					      iso_match_pa_sync_flag,
+					      NULL);
 			if (!parent && ev)
-				parent = iso_get_sock_listen(&hcon->src,
-							     &hcon->dst,
-							     iso_match_big, ev);
+				parent = iso_get_sock(&hcon->src,
+						      &hcon->dst,
+						      BT_LISTEN,
+						      iso_match_big, ev);
 		} else if (test_bit(HCI_CONN_PA_SYNC_FAILED, &hcon->flags)) {
 			ev2 = hci_recv_event_data(hcon->hdev,
 						  HCI_EV_LE_PA_SYNC_ESTABLISHED);
 			if (ev2)
-				parent = iso_get_sock_listen(&hcon->src,
-							     &hcon->dst,
-							     iso_match_sid, ev2);
+				parent = iso_get_sock(&hcon->src,
+						      &hcon->dst,
+						      BT_LISTEN,
+						      iso_match_sid, ev2);
 		} else if (test_bit(HCI_CONN_PA_SYNC, &hcon->flags)) {
 			ev3 = hci_recv_event_data(hcon->hdev,
-						  HCI_EVT_LE_BIG_INFO_ADV_REPORT);
+						  HCI_EV_LE_PER_ADV_REPORT);
 			if (ev3)
-				parent = iso_get_sock_listen(&hcon->src,
-							     &hcon->dst,
-							     iso_match_sync_handle, ev3);
+				parent = iso_get_sock(&hcon->src,
+						      &hcon->dst,
+						      BT_LISTEN,
+						      iso_match_sync_handle_pa_report,
+						      ev3);
 		}
 
 		if (!parent)
-			parent = iso_get_sock_listen(&hcon->src,
-							BDADDR_ANY, NULL, NULL);
+			parent = iso_get_sock(&hcon->src, BDADDR_ANY,
+					      BT_LISTEN, NULL, NULL);
 
 		if (!parent)
 			return;
@@ -1824,7 +1930,6 @@
 
 		if (ev3) {
 			iso_pi(sk)->qos = iso_pi(parent)->qos;
-			iso_pi(sk)->qos.bcast.encryption = ev3->encryption;
 			hcon->iso_qos = iso_pi(sk)->qos;
 			iso_pi(sk)->bc_num_bis = iso_pi(parent)->bc_num_bis;
 			memcpy(iso_pi(sk)->bc_bis, iso_pi(parent)->bc_bis, ISO_MAX_NUM_BIS);
@@ -1889,7 +1994,6 @@
 	struct hci_evt_le_big_info_adv_report *ev2;
 	struct hci_ev_le_per_adv_report *ev3;
 	struct sock *sk;
-	int lm = 0;
 
 	bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
 
@@ -1909,8 +2013,8 @@
 	 */
 	ev1 = hci_recv_event_data(hdev, HCI_EV_LE_PA_SYNC_ESTABLISHED);
 	if (ev1) {
-		sk = iso_get_sock_listen(&hdev->bdaddr, bdaddr, iso_match_sid,
-					 ev1);
+		sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_LISTEN,
+				  iso_match_sid, ev1);
 		if (sk && !ev1->status)
 			iso_pi(sk)->sync_handle = le16_to_cpu(ev1->handle);
 
@@ -1919,32 +2023,37 @@
 
 	ev2 = hci_recv_event_data(hdev, HCI_EVT_LE_BIG_INFO_ADV_REPORT);
 	if (ev2) {
-		/* Try to get PA sync listening socket, if it exists */
-		sk = iso_get_sock_listen(&hdev->bdaddr, bdaddr,
-						iso_match_pa_sync_flag, NULL);
-
-		if (!sk) {
-			sk = iso_get_sock_listen(&hdev->bdaddr, bdaddr,
-						 iso_match_sync_handle, ev2);
-
-			/* If PA Sync is in process of terminating,
-			 * do not handle any more BIGInfo adv reports.
-			 */
-
-			if (sk && test_bit(BT_SK_PA_SYNC_TERM,
-					   &iso_pi(sk)->flags))
-				return lm;
+		/* Check if BIGInfo report has already been handled */
+		sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_CONNECTED,
+				  iso_match_sync_handle, ev2);
+		if (sk) {
+			sock_put(sk);
+			sk = NULL;
+			goto done;
 		}
 
+		/* Try to get PA sync socket, if it exists */
+		sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_CONNECT2,
+				  iso_match_sync_handle, ev2);
+		if (!sk)
+			sk = iso_get_sock(&hdev->bdaddr, bdaddr,
+					  BT_LISTEN,
+					  iso_match_sync_handle,
+					  ev2);
+
 		if (sk) {
 			int err;
+			struct hci_conn	*hcon = iso_pi(sk)->conn->hcon;
+
+			iso_pi(sk)->qos.bcast.encryption = ev2->encryption;
 
 			if (ev2->num_bis < iso_pi(sk)->bc_num_bis)
 				iso_pi(sk)->bc_num_bis = ev2->num_bis;
 
 			if (!test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags) &&
 			    !test_and_set_bit(BT_SK_BIG_SYNC, &iso_pi(sk)->flags)) {
-				err = hci_le_big_create_sync(hdev, NULL,
+				err = hci_le_big_create_sync(hdev,
+							     hcon,
 							     &iso_pi(sk)->qos,
 							     iso_pi(sk)->sync_handle,
 							     iso_pi(sk)->bc_num_bis,
@@ -1957,37 +2066,80 @@
 				}
 			}
 		}
+
+		goto done;
 	}
 
 	ev3 = hci_recv_event_data(hdev, HCI_EV_LE_PER_ADV_REPORT);
 	if (ev3) {
-		size_t base_len = ev3->length;
+		size_t base_len = 0;
 		u8 *base;
+		struct hci_conn *hcon;
+
+		sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_LISTEN,
+				  iso_match_sync_handle_pa_report, ev3);
+		if (!sk)
+			goto done;
+
+		hcon = iso_pi(sk)->conn->hcon;
+		if (!hcon)
+			goto done;
+
+		if (ev3->data_status == LE_PA_DATA_TRUNCATED) {
+			/* The controller was unable to retrieve PA data. */
+			memset(hcon->le_per_adv_data, 0,
+			       HCI_MAX_PER_AD_TOT_LEN);
+			hcon->le_per_adv_data_len = 0;
+			hcon->le_per_adv_data_offset = 0;
+			goto done;
+		}
+
+		if (hcon->le_per_adv_data_offset + ev3->length >
+		    HCI_MAX_PER_AD_TOT_LEN)
+			goto done;
+
+		memcpy(hcon->le_per_adv_data + hcon->le_per_adv_data_offset,
+		       ev3->data, ev3->length);
+		hcon->le_per_adv_data_offset += ev3->length;
+
+		if (ev3->data_status == LE_PA_DATA_COMPLETE) {
+			/* All PA data has been received. */
+			hcon->le_per_adv_data_len =
+				hcon->le_per_adv_data_offset;
+			hcon->le_per_adv_data_offset = 0;
+
+			/* Extract BASE */
+			base = eir_get_service_data(hcon->le_per_adv_data,
+						    hcon->le_per_adv_data_len,
+						    EIR_BAA_SERVICE_UUID,
+						    &base_len);
+
+			if (!base || base_len > BASE_MAX_LENGTH)
+				goto done;
 
-		sk = iso_get_sock_listen(&hdev->bdaddr, bdaddr,
-					 iso_match_sync_handle_pa_report, ev3);
-		base = eir_get_service_data(ev3->data, ev3->length,
-					    EIR_BAA_SERVICE_UUID, &base_len);
-		if (base && sk && base_len <= sizeof(iso_pi(sk)->base)) {
 			memcpy(iso_pi(sk)->base, base, base_len);
 			iso_pi(sk)->base_len = base_len;
+		} else {
+			/* This is a PA data fragment. Keep pa_data_len set to 0
+			 * until all data has been reassembled.
+			 */
+			hcon->le_per_adv_data_len = 0;
 		}
 	} else {
-		sk = iso_get_sock_listen(&hdev->bdaddr, BDADDR_ANY, NULL, NULL);
+		sk = iso_get_sock(&hdev->bdaddr, BDADDR_ANY,
+				  BT_LISTEN, NULL, NULL);
 	}
 
 done:
 	if (!sk)
-		return lm;
-
-	lm |= HCI_LM_ACCEPT;
+		return 0;
 
 	if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
 		*flags |= HCI_PROTO_DEFER;
 
 	sock_put(sk);
 
-	return lm;
+	return HCI_LM_ACCEPT;
 }
 
 static void iso_connect_cfm(struct hci_conn *hcon, __u8 status)
@@ -2258,13 +2410,9 @@
 
 	hci_register_cb(&iso_cb);
 
-	if (IS_ERR_OR_NULL(bt_debugfs))
-		return 0;
-
-	if (!iso_debugfs) {
+	if (!IS_ERR_OR_NULL(bt_debugfs))
 		iso_debugfs = debugfs_create_file("iso", 0444, bt_debugfs,
 						  NULL, &iso_debugfs_fops);
-	}
 
 	iso_inited = true;
 
--- linux-qcom-6.8.0.orig/net/bluetooth/l2cap_core.c
+++ linux-qcom-6.8.0/net/bluetooth/l2cap_core.c
@@ -39,8 +39,6 @@
 #include <net/bluetooth/l2cap.h>
 
 #include "smp.h"
-#include "a2mp.h"
-#include "amp.h"
 
 #define LE_FLOWCTL_MAX_CREDITS 65535
 
@@ -167,24 +165,6 @@
 	return NULL;
 }
 
-static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
-						  u8 ident)
-{
-	struct l2cap_chan *c;
-
-	mutex_lock(&conn->chan_lock);
-	c = __l2cap_get_chan_by_ident(conn, ident);
-	if (c) {
-		/* Only lock if chan reference is not 0 */
-		c = l2cap_chan_hold_unless_zero(c);
-		if (c)
-			l2cap_chan_lock(c);
-	}
-	mutex_unlock(&conn->chan_lock);
-
-	return c;
-}
-
 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
 						      u8 src_type)
 {
@@ -435,6 +415,9 @@
 
 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
+	if (!conn)
+		return;
+
 	mutex_lock(&conn->chan_lock);
 	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
 	 * this work. No need to call l2cap_chan_hold(chan) here again.
@@ -474,6 +457,9 @@
 	/* Set default lock nesting level */
 	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
 
+	/* Available receive buffer space is initially unknown */
+	chan->rx_avail = -1;
+
 	write_lock(&chan_list_lock);
 	list_add(&chan->global_l, &chan_list);
 	write_unlock(&chan_list_lock);
@@ -555,6 +541,28 @@
 }
 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
 
+static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan)
+{
+	size_t sdu_len = chan->sdu ? chan->sdu->len : 0;
+
+	if (chan->mps == 0)
+		return 0;
+
+	/* If we don't know the available space in the receiver buffer, give
+	 * enough credits for a full packet.
+	 */
+	if (chan->rx_avail == -1)
+		return (chan->imtu / chan->mps) + 1;
+
+	/* If we know how much space is available in the receive buffer, give
+	 * out as many credits as would fill the buffer.
+	 */
+	if (chan->rx_avail <= sdu_len)
+		return 0;
+
+	return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps);
+}
+
 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
 {
 	chan->sdu = NULL;
@@ -563,8 +571,7 @@
 	chan->tx_credits = tx_credits;
 	/* Derive MPS from connection MTU to stop HCI fragmentation */
 	chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
-	/* Give enough credits for a full packet */
-	chan->rx_credits = (chan->imtu / chan->mps) + 1;
+	chan->rx_credits = l2cap_le_rx_credits(chan);
 
 	skb_queue_head_init(&chan->tx_q);
 }
@@ -576,7 +583,7 @@
 	/* L2CAP implementations shall support a minimum MPS of 64 octets */
 	if (chan->mps < L2CAP_ECRED_MIN_MPS) {
 		chan->mps = L2CAP_ECRED_MIN_MPS;
-		chan->rx_credits = (chan->imtu / chan->mps) + 1;
+		chan->rx_credits = l2cap_le_rx_credits(chan);
 	}
 }
 
@@ -651,7 +658,6 @@
 	chan->ops->teardown(chan, err);
 
 	if (conn) {
-		struct amp_mgr *mgr = conn->hcon->amp_mgr;
 		/* Delete from channel list */
 		list_del(&chan->list);
 
@@ -666,16 +672,6 @@
 		if (chan->chan_type != L2CAP_CHAN_FIXED ||
 		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
 			hci_conn_drop(conn->hcon);
-
-		if (mgr && mgr->bredr_chan == chan)
-			mgr->bredr_chan = NULL;
-	}
-
-	if (chan->hs_hchan) {
-		struct hci_chan *hs_hchan = chan->hs_hchan;
-
-		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
-		amp_disconnect_logical_link(hs_hchan);
 	}
 
 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
@@ -977,12 +973,6 @@
 	hci_send_acl(conn->hchan, skb, flags);
 }
 
-static bool __chan_is_moving(struct l2cap_chan *chan)
-{
-	return chan->move_state != L2CAP_MOVE_STABLE &&
-	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
-}
-
 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
 {
 	struct hci_conn *hcon = chan->conn->hcon;
@@ -991,15 +981,6 @@
 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
 	       skb->priority);
 
-	if (chan->hs_hcon && !__chan_is_moving(chan)) {
-		if (chan->hs_hchan)
-			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
-		else
-			kfree_skb(skb);
-
-		return;
-	}
-
 	/* Use NO_FLUSH for LE links (where this is the only option) or
 	 * if the BR/EDR link supports it and flushing has not been
 	 * explicitly requested (through FLAG_FLUSHABLE).
@@ -1180,9 +1161,6 @@
 	if (!control->sframe)
 		return;
 
-	if (__chan_is_moving(chan))
-		return;
-
 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
 	    !control->poll)
 		control->final = 1;
@@ -1237,40 +1215,6 @@
 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
 }
 
-static bool __amp_capable(struct l2cap_chan *chan)
-{
-	struct l2cap_conn *conn = chan->conn;
-	struct hci_dev *hdev;
-	bool amp_available = false;
-
-	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
-		return false;
-
-	if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP))
-		return false;
-
-	read_lock(&hci_dev_list_lock);
-	list_for_each_entry(hdev, &hci_dev_list, list) {
-		if (hdev->amp_type != AMP_TYPE_BREDR &&
-		    test_bit(HCI_UP, &hdev->flags)) {
-			amp_available = true;
-			break;
-		}
-	}
-	read_unlock(&hci_dev_list_lock);
-
-	if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
-		return amp_available;
-
-	return false;
-}
-
-static bool l2cap_check_efs(struct l2cap_chan *chan)
-{
-	/* Check EFS parameters */
-	return true;
-}
-
 void l2cap_send_conn_req(struct l2cap_chan *chan)
 {
 	struct l2cap_conn *conn = chan->conn;
@@ -1286,76 +1230,6 @@
 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
 }
 
-static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
-{
-	struct l2cap_create_chan_req req;
-	req.scid = cpu_to_le16(chan->scid);
-	req.psm  = chan->psm;
-	req.amp_id = amp_id;
-
-	chan->ident = l2cap_get_ident(chan->conn);
-
-	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
-		       sizeof(req), &req);
-}
-
-static void l2cap_move_setup(struct l2cap_chan *chan)
-{
-	struct sk_buff *skb;
-
-	BT_DBG("chan %p", chan);
-
-	if (chan->mode != L2CAP_MODE_ERTM)
-		return;
-
-	__clear_retrans_timer(chan);
-	__clear_monitor_timer(chan);
-	__clear_ack_timer(chan);
-
-	chan->retry_count = 0;
-	skb_queue_walk(&chan->tx_q, skb) {
-		if (bt_cb(skb)->l2cap.retries)
-			bt_cb(skb)->l2cap.retries = 1;
-		else
-			break;
-	}
-
-	chan->expected_tx_seq = chan->buffer_seq;
-
-	clear_bit(CONN_REJ_ACT, &chan->conn_state);
-	clear_bit(CONN_SREJ_ACT, &chan->conn_state);
-	l2cap_seq_list_clear(&chan->retrans_list);
-	l2cap_seq_list_clear(&chan->srej_list);
-	skb_queue_purge(&chan->srej_q);
-
-	chan->tx_state = L2CAP_TX_STATE_XMIT;
-	chan->rx_state = L2CAP_RX_STATE_MOVE;
-
-	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
-}
-
-static void l2cap_move_done(struct l2cap_chan *chan)
-{
-	u8 move_role = chan->move_role;
-	BT_DBG("chan %p", chan);
-
-	chan->move_state = L2CAP_MOVE_STABLE;
-	chan->move_role = L2CAP_MOVE_ROLE_NONE;
-
-	if (chan->mode != L2CAP_MODE_ERTM)
-		return;
-
-	switch (move_role) {
-	case L2CAP_MOVE_ROLE_INITIATOR:
-		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
-		chan->rx_state = L2CAP_RX_STATE_WAIT_F;
-		break;
-	case L2CAP_MOVE_ROLE_RESPONDER:
-		chan->rx_state = L2CAP_RX_STATE_WAIT_P;
-		break;
-	}
-}
-
 static void l2cap_chan_ready(struct l2cap_chan *chan)
 {
 	/* The channel may have already been flagged as connected in
@@ -1505,10 +1379,7 @@
 
 static void l2cap_start_connection(struct l2cap_chan *chan)
 {
-	if (__amp_capable(chan)) {
-		BT_DBG("chan %p AMP capable: discover AMPs", chan);
-		a2mp_discover_amp(chan);
-	} else if (chan->conn->hcon->type == LE_LINK) {
+	if (chan->conn->hcon->type == LE_LINK) {
 		l2cap_le_start(chan);
 	} else {
 		l2cap_send_conn_req(chan);
@@ -1611,11 +1482,6 @@
 		__clear_ack_timer(chan);
 	}
 
-	if (chan->scid == L2CAP_CID_A2MP) {
-		l2cap_state_change(chan, BT_DISCONN);
-		return;
-	}
-
 	req.dcid = cpu_to_le16(chan->dcid);
 	req.scid = cpu_to_le16(chan->scid);
 	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
@@ -1754,11 +1620,6 @@
 
 		l2cap_chan_lock(chan);
 
-		if (chan->scid == L2CAP_CID_A2MP) {
-			l2cap_chan_unlock(chan);
-			continue;
-		}
-
 		if (hcon->type == LE_LINK) {
 			l2cap_le_start(chan);
 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
@@ -2067,9 +1928,6 @@
 
 	BT_DBG("chan %p, skbs %p", chan, skbs);
 
-	if (__chan_is_moving(chan))
-		return;
-
 	skb_queue_splice_tail_init(skbs, &chan->tx_q);
 
 	while (!skb_queue_empty(&chan->tx_q)) {
@@ -2112,9 +1970,6 @@
 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
 		return 0;
 
-	if (__chan_is_moving(chan))
-		return 0;
-
 	while (chan->tx_send_head &&
 	       chan->unacked_frames < chan->remote_tx_win &&
 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {
@@ -2180,9 +2035,6 @@
 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
 		return;
 
-	if (__chan_is_moving(chan))
-		return;
-
 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
 		seq = l2cap_seq_list_pop(&chan->retrans_list);
 
@@ -2522,8 +2374,7 @@
 	pdu_len = chan->conn->mtu;
 
 	/* Constrain PDU size for BR/EDR connections */
-	if (!chan->hs_hcon)
-		pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
+	pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
 
 	/* Adjust for largest possible L2CAP overhead. */
 	if (chan->fcs)
@@ -3287,11 +3138,6 @@
 
 	skb_queue_head_init(&chan->tx_q);
 
-	chan->local_amp_id = AMP_ID_BREDR;
-	chan->move_id = AMP_ID_BREDR;
-	chan->move_state = L2CAP_MOVE_STABLE;
-	chan->move_role = L2CAP_MOVE_ROLE_NONE;
-
 	if (chan->mode != L2CAP_MODE_ERTM)
 		return 0;
 
@@ -3326,52 +3172,19 @@
 
 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
 {
-	return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
-		(conn->feat_mask & L2CAP_FEAT_EXT_WINDOW));
+	return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
 }
 
 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
 {
-	return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
-		(conn->feat_mask & L2CAP_FEAT_EXT_FLOW));
+	return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
 }
 
 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
 				      struct l2cap_conf_rfc *rfc)
 {
-	if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
-		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
-
-		/* Class 1 devices have must have ERTM timeouts
-		 * exceeding the Link Supervision Timeout.  The
-		 * default Link Supervision Timeout for AMP
-		 * controllers is 10 seconds.
-		 *
-		 * Class 1 devices use 0xffffffff for their
-		 * best-effort flush timeout, so the clamping logic
-		 * will result in a timeout that meets the above
-		 * requirement.  ERTM timeouts are 16-bit values, so
-		 * the maximum timeout is 65.535 seconds.
-		 */
-
-		/* Convert timeout to milliseconds and round */
-		ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
-
-		/* This is the recommended formula for class 2 devices
-		 * that start ERTM timers when packets are sent to the
-		 * controller.
-		 */
-		ertm_to = 3 * ertm_to + 500;
-
-		if (ertm_to > 0xffff)
-			ertm_to = 0xffff;
-
-		rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
-		rfc->monitor_timeout = rfc->retrans_timeout;
-	} else {
-		rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
-		rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
-	}
+	rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
+	rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
 }
 
 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
@@ -3623,13 +3436,7 @@
 		case L2CAP_CONF_EWS:
 			if (olen != 2)
 				break;
-			if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
-				return -ECONNREFUSED;
-			set_bit(FLAG_EXT_CTRL, &chan->flags);
-			set_bit(CONF_EWS_RECV, &chan->conf_state);
-			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
-			chan->remote_tx_win = val;
-			break;
+			return -ECONNREFUSED;
 
 		default:
 			if (hint)
@@ -4027,11 +3834,7 @@
 	rsp.dcid   = cpu_to_le16(chan->scid);
 	rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
 	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-
-	if (chan->hs_hcon)
-		rsp_code = L2CAP_CREATE_CHAN_RSP;
-	else
-		rsp_code = L2CAP_CONN_RSP;
+	rsp_code = L2CAP_CONN_RSP;
 
 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);
 
@@ -4126,13 +3929,12 @@
 	return 0;
 }
 
-static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
-					struct l2cap_cmd_hdr *cmd,
-					u8 *data, u8 rsp_code, u8 amp_id)
+static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
+			  u8 *data, u8 rsp_code)
 {
 	struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
 	struct l2cap_conn_rsp rsp;
-	struct l2cap_chan *chan = NULL, *pchan;
+	struct l2cap_chan *chan = NULL, *pchan = NULL;
 	int result, status = L2CAP_CS_NO_INFO;
 
 	u16 dcid = 0, scid = __le16_to_cpu(req->scid);
@@ -4145,7 +3947,7 @@
 					 &conn->hcon->dst, ACL_LINK);
 	if (!pchan) {
 		result = L2CAP_CR_BAD_PSM;
-		goto sendresp;
+		goto response;
 	}
 
 	mutex_lock(&conn->chan_lock);
@@ -4190,7 +3992,6 @@
 	chan->dst_type = bdaddr_dst_type(conn->hcon);
 	chan->psm  = psm;
 	chan->dcid = scid;
-	chan->local_amp_id = amp_id;
 
 	__l2cap_chan_add(conn, chan);
 
@@ -4208,17 +4009,8 @@
 				status = L2CAP_CS_AUTHOR_PEND;
 				chan->ops->defer(chan);
 			} else {
-				/* Force pending result for AMP controllers.
-				 * The connection will succeed after the
-				 * physical link is up.
-				 */
-				if (amp_id == AMP_ID_BREDR) {
-					l2cap_state_change(chan, BT_CONFIG);
-					result = L2CAP_CR_SUCCESS;
-				} else {
-					l2cap_state_change(chan, BT_CONNECT2);
-					result = L2CAP_CR_PEND;
-				}
+				l2cap_state_change(chan, BT_CONFIG);
+				result = L2CAP_CR_SUCCESS;
 				status = L2CAP_CS_NO_INFO;
 			}
 		} else {
@@ -4233,17 +4025,15 @@
 	}
 
 response:
-	l2cap_chan_unlock(pchan);
-	mutex_unlock(&conn->chan_lock);
-	l2cap_chan_put(pchan);
-
-sendresp:
 	rsp.scid   = cpu_to_le16(scid);
 	rsp.dcid   = cpu_to_le16(dcid);
 	rsp.result = cpu_to_le16(result);
 	rsp.status = cpu_to_le16(status);
 	l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
 
+	if (!pchan)
+		return;
+
 	if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
 		struct l2cap_info_req info;
 		info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
@@ -4266,25 +4056,18 @@
 		chan->num_conf_req++;
 	}
 
-	return chan;
+	l2cap_chan_unlock(pchan);
+	mutex_unlock(&conn->chan_lock);
+	l2cap_chan_put(pchan);
 }
 
 static int l2cap_connect_req(struct l2cap_conn *conn,
 			     struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
-	struct hci_dev *hdev = conn->hcon->hdev;
-	struct hci_conn *hcon = conn->hcon;
-
 	if (cmd_len < sizeof(struct l2cap_conn_req))
 		return -EPROTO;
 
-	hci_dev_lock(hdev);
-	if (hci_dev_test_flag(hdev, HCI_MGMT) &&
-	    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
-		mgmt_device_connected(hdev, hcon, NULL, 0);
-	hci_dev_unlock(hdev);
-
-	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
+	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
 	return 0;
 }
 
@@ -4516,10 +4299,7 @@
 		/* check compatibility */
 
 		/* Send rsp for BR/EDR channel */
-		if (!chan->hs_hcon)
-			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
-		else
-			chan->ident = cmd->ident;
+		l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
 	}
 
 unlock:
@@ -4571,15 +4351,7 @@
 				goto done;
 			}
 
-			if (!chan->hs_hcon) {
-				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
-							0);
-			} else {
-				if (l2cap_check_efs(chan)) {
-					amp_create_logical_link(chan);
-					chan->ident = cmd->ident;
-				}
-			}
+			l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
 		}
 		goto done;
 
@@ -4750,9 +4522,6 @@
 		if (!disable_ertm)
 			feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
 				| L2CAP_FEAT_FCS;
-		if (conn->local_fixed_chan & L2CAP_FC_A2MP)
-			feat_mask |= L2CAP_FEAT_EXT_FLOW
-				| L2CAP_FEAT_EXT_WINDOW;
 
 		put_unaligned_le32(feat_mask, rsp->data);
 		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
@@ -4841,751 +4610,6 @@
 	return 0;
 }
 
-static int l2cap_create_channel_req(struct l2cap_conn *conn,
-				    struct l2cap_cmd_hdr *cmd,
-				    u16 cmd_len, void *data)
-{
-	struct l2cap_create_chan_req *req = data;
-	struct l2cap_create_chan_rsp rsp;
-	struct l2cap_chan *chan;
-	struct hci_dev *hdev;
-	u16 psm, scid;
-
-	if (cmd_len != sizeof(*req))
-		return -EPROTO;
-
-	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
-		return -EINVAL;
-
-	psm = le16_to_cpu(req->psm);
-	scid = le16_to_cpu(req->scid);
-
-	BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
-
-	/* For controller id 0 make BR/EDR connection */
-	if (req->amp_id == AMP_ID_BREDR) {
-		l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
-			      req->amp_id);
-		return 0;
-	}
-
-	/* Validate AMP controller id */
-	hdev = hci_dev_get(req->amp_id);
-	if (!hdev)
-		goto error;
-
-	if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
-		hci_dev_put(hdev);
-		goto error;
-	}
-
-	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
-			     req->amp_id);
-	if (chan) {
-		struct amp_mgr *mgr = conn->hcon->amp_mgr;
-		struct hci_conn *hs_hcon;
-
-		hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
-						  &conn->hcon->dst);
-		if (!hs_hcon) {
-			hci_dev_put(hdev);
-			cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
-					       chan->dcid);
-			return 0;
-		}
-
-		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
-
-		mgr->bredr_chan = chan;
-		chan->hs_hcon = hs_hcon;
-		chan->fcs = L2CAP_FCS_NONE;
-		conn->mtu = hdev->block_mtu;
-	}
-
-	hci_dev_put(hdev);
-
-	return 0;
-
-error:
-	rsp.dcid = 0;
-	rsp.scid = cpu_to_le16(scid);
-	rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
-	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-
-	l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
-		       sizeof(rsp), &rsp);
-
-	return 0;
-}
-
-static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
-{
-	struct l2cap_move_chan_req req;
-	u8 ident;
-
-	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
-
-	ident = l2cap_get_ident(chan->conn);
-	chan->ident = ident;
-
-	req.icid = cpu_to_le16(chan->scid);
-	req.dest_amp_id = dest_amp_id;
-
-	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
-		       &req);
-
-	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
-}
-
-static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
-{
-	struct l2cap_move_chan_rsp rsp;
-
-	BT_DBG("chan %p, result 0x%4.4x", chan, result);
-
-	rsp.icid = cpu_to_le16(chan->dcid);
-	rsp.result = cpu_to_le16(result);
-
-	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
-		       sizeof(rsp), &rsp);
-}
-
-static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
-{
-	struct l2cap_move_chan_cfm cfm;
-
-	BT_DBG("chan %p, result 0x%4.4x", chan, result);
-
-	chan->ident = l2cap_get_ident(chan->conn);
-
-	cfm.icid = cpu_to_le16(chan->scid);
-	cfm.result = cpu_to_le16(result);
-
-	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
-		       sizeof(cfm), &cfm);
-
-	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
-}
-
-static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
-{
-	struct l2cap_move_chan_cfm cfm;
-
-	BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
-
-	cfm.icid = cpu_to_le16(icid);
-	cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
-
-	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
-		       sizeof(cfm), &cfm);
-}
-
-static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
-					 u16 icid)
-{
-	struct l2cap_move_chan_cfm_rsp rsp;
-
-	BT_DBG("icid 0x%4.4x", icid);
-
-	rsp.icid = cpu_to_le16(icid);
-	l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
-}
-
-static void __release_logical_link(struct l2cap_chan *chan)
-{
-	chan->hs_hchan = NULL;
-	chan->hs_hcon = NULL;
-
-	/* Placeholder - release the logical link */
-}
-
-static void l2cap_logical_fail(struct l2cap_chan *chan)
-{
-	/* Logical link setup failed */
-	if (chan->state != BT_CONNECTED) {
-		/* Create channel failure, disconnect */
-		l2cap_send_disconn_req(chan, ECONNRESET);
-		return;
-	}
-
-	switch (chan->move_role) {
-	case L2CAP_MOVE_ROLE_RESPONDER:
-		l2cap_move_done(chan);
-		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
-		break;
-	case L2CAP_MOVE_ROLE_INITIATOR:
-		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
-		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
-			/* Remote has only sent pending or
-			 * success responses, clean up
-			 */
-			l2cap_move_done(chan);
-		}
-
-		/* Other amp move states imply that the move
-		 * has already aborted
-		 */
-		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
-		break;
-	}
-}
-
-static void l2cap_logical_finish_create(struct l2cap_chan *chan,
-					struct hci_chan *hchan)
-{
-	struct l2cap_conf_rsp rsp;
-
-	chan->hs_hchan = hchan;
-	chan->hs_hcon->l2cap_data = chan->conn;
-
-	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
-
-	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
-		int err;
-
-		set_default_fcs(chan);
-
-		err = l2cap_ertm_init(chan);
-		if (err < 0)
-			l2cap_send_disconn_req(chan, -err);
-		else
-			l2cap_chan_ready(chan);
-	}
-}
-
-static void l2cap_logical_finish_move(struct l2cap_chan *chan,
-				      struct hci_chan *hchan)
-{
-	chan->hs_hcon = hchan->conn;
-	chan->hs_hcon->l2cap_data = chan->conn;
-
-	BT_DBG("move_state %d", chan->move_state);
-
-	switch (chan->move_state) {
-	case L2CAP_MOVE_WAIT_LOGICAL_COMP:
-		/* Move confirm will be sent after a success
-		 * response is received
-		 */
-		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
-		break;
-	case L2CAP_MOVE_WAIT_LOGICAL_CFM:
-		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
-			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
-		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
-			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
-		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
-			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
-		}
-		break;
-	default:
-		/* Move was not in expected state, free the channel */
-		__release_logical_link(chan);
-
-		chan->move_state = L2CAP_MOVE_STABLE;
-	}
-}
-
-/* Call with chan locked */
-void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
-		       u8 status)
-{
-	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
-
-	if (status) {
-		l2cap_logical_fail(chan);
-		__release_logical_link(chan);
-		return;
-	}
-
-	if (chan->state != BT_CONNECTED) {
-		/* Ignore logical link if channel is on BR/EDR */
-		if (chan->local_amp_id != AMP_ID_BREDR)
-			l2cap_logical_finish_create(chan, hchan);
-	} else {
-		l2cap_logical_finish_move(chan, hchan);
-	}
-}
-
-void l2cap_move_start(struct l2cap_chan *chan)
-{
-	BT_DBG("chan %p", chan);
-
-	if (chan->local_amp_id == AMP_ID_BREDR) {
-		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
-			return;
-		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
-		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
-		/* Placeholder - start physical link setup */
-	} else {
-		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
-		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
-		chan->move_id = 0;
-		l2cap_move_setup(chan);
-		l2cap_send_move_chan_req(chan, 0);
-	}
-}
-
-static void l2cap_do_create(struct l2cap_chan *chan, int result,
-			    u8 local_amp_id, u8 remote_amp_id)
-{
-	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
-	       local_amp_id, remote_amp_id);
-
-	chan->fcs = L2CAP_FCS_NONE;
-
-	/* Outgoing channel on AMP */
-	if (chan->state == BT_CONNECT) {
-		if (result == L2CAP_CR_SUCCESS) {
-			chan->local_amp_id = local_amp_id;
-			l2cap_send_create_chan_req(chan, remote_amp_id);
-		} else {
-			/* Revert to BR/EDR connect */
-			l2cap_send_conn_req(chan);
-		}
-
-		return;
-	}
-
-	/* Incoming channel on AMP */
-	if (__l2cap_no_conn_pending(chan)) {
-		struct l2cap_conn_rsp rsp;
-		char buf[128];
-		rsp.scid = cpu_to_le16(chan->dcid);
-		rsp.dcid = cpu_to_le16(chan->scid);
-
-		if (result == L2CAP_CR_SUCCESS) {
-			/* Send successful response */
-			rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
-			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-		} else {
-			/* Send negative response */
-			rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
-			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-		}
-
-		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
-			       sizeof(rsp), &rsp);
-
-		if (result == L2CAP_CR_SUCCESS) {
-			l2cap_state_change(chan, BT_CONFIG);
-			set_bit(CONF_REQ_SENT, &chan->conf_state);
-			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
-				       L2CAP_CONF_REQ,
-				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
-			chan->num_conf_req++;
-		}
-	}
-}
-
-static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
-				   u8 remote_amp_id)
-{
-	l2cap_move_setup(chan);
-	chan->move_id = local_amp_id;
-	chan->move_state = L2CAP_MOVE_WAIT_RSP;
-
-	l2cap_send_move_chan_req(chan, remote_amp_id);
-}
-
-static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
-{
-	struct hci_chan *hchan = NULL;
-
-	/* Placeholder - get hci_chan for logical link */
-
-	if (hchan) {
-		if (hchan->state == BT_CONNECTED) {
-			/* Logical link is ready to go */
-			chan->hs_hcon = hchan->conn;
-			chan->hs_hcon->l2cap_data = chan->conn;
-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
-			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
-
-			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
-		} else {
-			/* Wait for logical link to be ready */
-			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
-		}
-	} else {
-		/* Logical link not available */
-		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
-	}
-}
-
-static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
-{
-	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
-		u8 rsp_result;
-		if (result == -EINVAL)
-			rsp_result = L2CAP_MR_BAD_ID;
-		else
-			rsp_result = L2CAP_MR_NOT_ALLOWED;
-
-		l2cap_send_move_chan_rsp(chan, rsp_result);
-	}
-
-	chan->move_role = L2CAP_MOVE_ROLE_NONE;
-	chan->move_state = L2CAP_MOVE_STABLE;
-
-	/* Restart data transmission */
-	l2cap_ertm_send(chan);
-}
-
-/* Invoke with locked chan */
-void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
-{
-	u8 local_amp_id = chan->local_amp_id;
-	u8 remote_amp_id = chan->remote_amp_id;
-
-	BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
-	       chan, result, local_amp_id, remote_amp_id);
-
-	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)
-		return;
-
-	if (chan->state != BT_CONNECTED) {
-		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
-	} else if (result != L2CAP_MR_SUCCESS) {
-		l2cap_do_move_cancel(chan, result);
-	} else {
-		switch (chan->move_role) {
-		case L2CAP_MOVE_ROLE_INITIATOR:
-			l2cap_do_move_initiate(chan, local_amp_id,
-					       remote_amp_id);
-			break;
-		case L2CAP_MOVE_ROLE_RESPONDER:
-			l2cap_do_move_respond(chan, result);
-			break;
-		default:
-			l2cap_do_move_cancel(chan, result);
-			break;
-		}
-	}
-}
-
-static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
-					 struct l2cap_cmd_hdr *cmd,
-					 u16 cmd_len, void *data)
-{
-	struct l2cap_move_chan_req *req = data;
-	struct l2cap_move_chan_rsp rsp;
-	struct l2cap_chan *chan;
-	u16 icid = 0;
-	u16 result = L2CAP_MR_NOT_ALLOWED;
-
-	if (cmd_len != sizeof(*req))
-		return -EPROTO;
-
-	icid = le16_to_cpu(req->icid);
-
-	BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
-
-	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
-		return -EINVAL;
-
-	chan = l2cap_get_chan_by_dcid(conn, icid);
-	if (!chan) {
-		rsp.icid = cpu_to_le16(icid);
-		rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
-		l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
-			       sizeof(rsp), &rsp);
-		return 0;
-	}
-
-	chan->ident = cmd->ident;
-
-	if (chan->scid < L2CAP_CID_DYN_START ||
-	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
-	    (chan->mode != L2CAP_MODE_ERTM &&
-	     chan->mode != L2CAP_MODE_STREAMING)) {
-		result = L2CAP_MR_NOT_ALLOWED;
-		goto send_move_response;
-	}
-
-	if (chan->local_amp_id == req->dest_amp_id) {
-		result = L2CAP_MR_SAME_ID;
-		goto send_move_response;
-	}
-
-	if (req->dest_amp_id != AMP_ID_BREDR) {
-		struct hci_dev *hdev;
-		hdev = hci_dev_get(req->dest_amp_id);
-		if (!hdev || hdev->dev_type != HCI_AMP ||
-		    !test_bit(HCI_UP, &hdev->flags)) {
-			if (hdev)
-				hci_dev_put(hdev);
-
-			result = L2CAP_MR_BAD_ID;
-			goto send_move_response;
-		}
-		hci_dev_put(hdev);
-	}
-
-	/* Detect a move collision.  Only send a collision response
-	 * if this side has "lost", otherwise proceed with the move.
-	 * The winner has the larger bd_addr.
-	 */
-	if ((__chan_is_moving(chan) ||
-	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
-	    bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
-		result = L2CAP_MR_COLLISION;
-		goto send_move_response;
-	}
-
-	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
-	l2cap_move_setup(chan);
-	chan->move_id = req->dest_amp_id;
-
-	if (req->dest_amp_id == AMP_ID_BREDR) {
-		/* Moving to BR/EDR */
-		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
-			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
-			result = L2CAP_MR_PEND;
-		} else {
-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
-			result = L2CAP_MR_SUCCESS;
-		}
-	} else {
-		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
-		/* Placeholder - uncomment when amp functions are available */
-		/*amp_accept_physical(chan, req->dest_amp_id);*/
-		result = L2CAP_MR_PEND;
-	}
-
-send_move_response:
-	l2cap_send_move_chan_rsp(chan, result);
-
-	l2cap_chan_unlock(chan);
-	l2cap_chan_put(chan);
-
-	return 0;
-}
-
-static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
-{
-	struct l2cap_chan *chan;
-	struct hci_chan *hchan = NULL;
-
-	chan = l2cap_get_chan_by_scid(conn, icid);
-	if (!chan) {
-		l2cap_send_move_chan_cfm_icid(conn, icid);
-		return;
-	}
-
-	__clear_chan_timer(chan);
-	if (result == L2CAP_MR_PEND)
-		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
-
-	switch (chan->move_state) {
-	case L2CAP_MOVE_WAIT_LOGICAL_COMP:
-		/* Move confirm will be sent when logical link
-		 * is complete.
-		 */
-		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
-		break;
-	case L2CAP_MOVE_WAIT_RSP_SUCCESS:
-		if (result == L2CAP_MR_PEND) {
-			break;
-		} else if (test_bit(CONN_LOCAL_BUSY,
-				    &chan->conn_state)) {
-			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
-		} else {
-			/* Logical link is up or moving to BR/EDR,
-			 * proceed with move
-			 */
-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
-			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
-		}
-		break;
-	case L2CAP_MOVE_WAIT_RSP:
-		/* Moving to AMP */
-		if (result == L2CAP_MR_SUCCESS) {
-			/* Remote is ready, send confirm immediately
-			 * after logical link is ready
-			 */
-			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
-		} else {
-			/* Both logical link and move success
-			 * are required to confirm
-			 */
-			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
-		}
-
-		/* Placeholder - get hci_chan for logical link */
-		if (!hchan) {
-			/* Logical link not available */
-			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
-			break;
-		}
-
-		/* If the logical link is not yet connected, do not
-		 * send confirmation.
-		 */
-		if (hchan->state != BT_CONNECTED)
-			break;
-
-		/* Logical link is already ready to go */
-
-		chan->hs_hcon = hchan->conn;
-		chan->hs_hcon->l2cap_data = chan->conn;
-
-		if (result == L2CAP_MR_SUCCESS) {
-			/* Can confirm now */
-			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
-		} else {
-			/* Now only need move success
-			 * to confirm
-			 */
-			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
-		}
-
-		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
-		break;
-	default:
-		/* Any other amp move state means the move failed. */
-		chan->move_id = chan->local_amp_id;
-		l2cap_move_done(chan);
-		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
-	}
-
-	l2cap_chan_unlock(chan);
-	l2cap_chan_put(chan);
-}
-
-static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
-			    u16 result)
-{
-	struct l2cap_chan *chan;
-
-	chan = l2cap_get_chan_by_ident(conn, ident);
-	if (!chan) {
-		/* Could not locate channel, icid is best guess */
-		l2cap_send_move_chan_cfm_icid(conn, icid);
-		return;
-	}
-
-	__clear_chan_timer(chan);
-
-	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
-		if (result == L2CAP_MR_COLLISION) {
-			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
-		} else {
-			/* Cleanup - cancel move */
-			chan->move_id = chan->local_amp_id;
-			l2cap_move_done(chan);
-		}
-	}
-
-	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
-
-	l2cap_chan_unlock(chan);
-	l2cap_chan_put(chan);
-}
-
-static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
-				  struct l2cap_cmd_hdr *cmd,
-				  u16 cmd_len, void *data)
-{
-	struct l2cap_move_chan_rsp *rsp = data;
-	u16 icid, result;
-
-	if (cmd_len != sizeof(*rsp))
-		return -EPROTO;
-
-	icid = le16_to_cpu(rsp->icid);
-	result = le16_to_cpu(rsp->result);
-
-	BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
-
-	if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
-		l2cap_move_continue(conn, icid, result);
-	else
-		l2cap_move_fail(conn, cmd->ident, icid, result);
-
-	return 0;
-}
-
-static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
-				      struct l2cap_cmd_hdr *cmd,
-				      u16 cmd_len, void *data)
-{
-	struct l2cap_move_chan_cfm *cfm = data;
-	struct l2cap_chan *chan;
-	u16 icid, result;
-
-	if (cmd_len != sizeof(*cfm))
-		return -EPROTO;
-
-	icid = le16_to_cpu(cfm->icid);
-	result = le16_to_cpu(cfm->result);
-
-	BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
-
-	chan = l2cap_get_chan_by_dcid(conn, icid);
-	if (!chan) {
-		/* Spec requires a response even if the icid was not found */
-		l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
-		return 0;
-	}
-
-	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
-		if (result == L2CAP_MC_CONFIRMED) {
-			chan->local_amp_id = chan->move_id;
-			if (chan->local_amp_id == AMP_ID_BREDR)
-				__release_logical_link(chan);
-		} else {
-			chan->move_id = chan->local_amp_id;
-		}
-
-		l2cap_move_done(chan);
-	}
-
-	l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
-
-	l2cap_chan_unlock(chan);
-	l2cap_chan_put(chan);
-
-	return 0;
-}
-
-static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
-						 struct l2cap_cmd_hdr *cmd,
-						 u16 cmd_len, void *data)
-{
-	struct l2cap_move_chan_cfm_rsp *rsp = data;
-	struct l2cap_chan *chan;
-	u16 icid;
-
-	if (cmd_len != sizeof(*rsp))
-		return -EPROTO;
-
-	icid = le16_to_cpu(rsp->icid);
-
-	BT_DBG("icid 0x%4.4x", icid);
-
-	chan = l2cap_get_chan_by_scid(conn, icid);
-	if (!chan)
-		return 0;
-
-	__clear_chan_timer(chan);
-
-	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
-		chan->local_amp_id = chan->move_id;
-
-		if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
-			__release_logical_link(chan);
-
-		l2cap_move_done(chan);
-	}
-
-	l2cap_chan_unlock(chan);
-	l2cap_chan_put(chan);
-
-	return 0;
-}
-
 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
 					      struct l2cap_cmd_hdr *cmd,
 					      u16 cmd_len, u8 *data)
@@ -5613,13 +4637,7 @@
 
 	memset(&rsp, 0, sizeof(rsp));
 
-	if (max > hcon->le_conn_max_interval) {
-		BT_DBG("requested connection interval exceeds current bounds.");
-		err = -EINVAL;
-	} else {
-		err = hci_check_conn_params(min, max, latency, to_multiplier);
-	}
-
+	err = hci_check_conn_params(min, max, latency, to_multiplier);
 	if (err)
 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
 	else
@@ -5745,7 +4763,6 @@
 		break;
 
 	case L2CAP_CONN_RSP:
-	case L2CAP_CREATE_CHAN_RSP:
 		l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
 		break;
 
@@ -5780,26 +4797,6 @@
 		l2cap_information_rsp(conn, cmd, cmd_len, data);
 		break;
 
-	case L2CAP_CREATE_CHAN_REQ:
-		err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
-		break;
-
-	case L2CAP_MOVE_CHAN_REQ:
-		err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
-		break;
-
-	case L2CAP_MOVE_CHAN_RSP:
-		l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
-		break;
-
-	case L2CAP_MOVE_CHAN_CFM:
-		err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
-		break;
-
-	case L2CAP_MOVE_CHAN_CFM_RSP:
-		l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
-		break;
-
 	default:
 		BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
 		err = -EINVAL;
@@ -7051,8 +6048,8 @@
 		if (control->final) {
 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
-			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
-			    !__chan_is_moving(chan)) {
+			if (!test_and_clear_bit(CONN_REJ_ACT,
+						&chan->conn_state)) {
 				control->final = 0;
 				l2cap_retransmit_all(chan, control);
 			}
@@ -7245,11 +6242,7 @@
 	BT_DBG("chan %p", chan);
 
 	chan->rx_state = L2CAP_RX_STATE_RECV;
-
-	if (chan->hs_hcon)
-		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
-	else
-		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
+	chan->conn->mtu = chan->conn->hcon->mtu;
 
 	return l2cap_resegment(chan);
 }
@@ -7316,11 +6309,7 @@
 	 */
 	chan->next_tx_seq = control->reqseq;
 	chan->unacked_frames = 0;
-
-	if (chan->hs_hcon)
-		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
-	else
-		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
+	chan->conn->mtu = chan->conn->hcon->mtu;
 
 	err = l2cap_resegment(chan);
 
@@ -7525,9 +6514,7 @@
 {
 	struct l2cap_conn *conn = chan->conn;
 	struct l2cap_le_credits pkt;
-	u16 return_credits;
-
-	return_credits = (chan->imtu / chan->mps) + 1;
+	u16 return_credits = l2cap_le_rx_credits(chan);
 
 	if (chan->rx_credits >= return_credits)
 		return;
@@ -7546,6 +6533,19 @@
 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
 }
 
+void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail)
+{
+	if (chan->rx_avail == rx_avail)
+		return;
+
+	BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail);
+
+	chan->rx_avail = rx_avail;
+
+	if (chan->state == BT_CONNECTED)
+		l2cap_chan_le_send_credits(chan);
+}
+
 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
 {
 	int err;
@@ -7555,6 +6555,12 @@
 	/* Wait recv to confirm reception before updating the credits */
 	err = chan->ops->recv(chan, skb);
 
+	if (err < 0 && chan->rx_avail != -1) {
+		BT_ERR("Queueing received LE L2CAP data failed");
+		l2cap_send_disconn_req(chan, ECONNRESET);
+		return err;
+	}
+
 	/* Update credits whenever an SDU is received */
 	l2cap_chan_le_send_credits(chan);
 
@@ -7577,7 +6583,8 @@
 	}
 
 	chan->rx_credits--;
-	BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);
+	BT_DBG("chan %p: rx_credits %u -> %u",
+	       chan, chan->rx_credits + 1, chan->rx_credits);
 
 	/* Update if remote had run out of credits, this should only happens
 	 * if the remote is not using the entire MPS.
@@ -7672,21 +6679,10 @@
 
 	chan = l2cap_get_chan_by_scid(conn, cid);
 	if (!chan) {
-		if (cid == L2CAP_CID_A2MP) {
-			chan = a2mp_channel_create(conn, skb);
-			if (!chan) {
-				kfree_skb(skb);
-				return;
-			}
-
-			l2cap_chan_hold(chan);
-			l2cap_chan_lock(chan);
-		} else {
-			BT_DBG("unknown cid 0x%4.4x", cid);
-			/* Drop packet and return */
-			kfree_skb(skb);
-			return;
-		}
+		BT_DBG("unknown cid 0x%4.4x", cid);
+		/* Drop packet and return */
+		kfree_skb(skb);
+		return;
 	}
 
 	BT_DBG("chan %p, len %d", chan, skb->len);
@@ -7758,6 +6754,8 @@
 
 	BT_DBG("chan %p, len %d", chan, skb->len);
 
+	l2cap_chan_lock(chan);
+
 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
 		goto drop;
 
@@ -7769,11 +6767,13 @@
 	bt_cb(skb)->l2cap.psm = psm;
 
 	if (!chan->ops->recv(chan, skb)) {
+		l2cap_chan_unlock(chan);
 		l2cap_chan_put(chan);
 		return;
 	}
 
 drop:
+	l2cap_chan_unlock(chan);
 	l2cap_chan_put(chan);
 free_skb:
 	kfree_skb(skb);
@@ -7871,26 +6871,11 @@
 
 	BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
 
-	switch (hcon->type) {
-	case LE_LINK:
-		if (hcon->hdev->le_mtu) {
-			conn->mtu = hcon->hdev->le_mtu;
-			break;
-		}
-		fallthrough;
-	default:
-		conn->mtu = hcon->hdev->acl_mtu;
-		break;
-	}
-
+	conn->mtu = hcon->mtu;
 	conn->feat_mask = 0;
 
 	conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
 
-	if (hcon->type == ACL_LINK &&
-	    hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED))
-		conn->local_fixed_chan |= L2CAP_FC_A2MP;
-
 	if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
 	    (bredr_sc_enabled(hcon->hdev) ||
 	     hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
@@ -7953,7 +6938,7 @@
 }
 
 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
-		       bdaddr_t *dst, u8 dst_type)
+		       bdaddr_t *dst, u8 dst_type, u16 timeout)
 {
 	struct l2cap_conn *conn;
 	struct hci_conn *hcon;
@@ -8046,19 +7031,17 @@
 
 		if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 			hcon = hci_connect_le(hdev, dst, dst_type, false,
-					      chan->sec_level,
-					      HCI_LE_CONN_TIMEOUT,
-					      HCI_ROLE_SLAVE);
+					      chan->sec_level, timeout,
+					      HCI_ROLE_SLAVE, 0, 0);
 		else
 			hcon = hci_connect_le_scan(hdev, dst, dst_type,
-						   chan->sec_level,
-						   HCI_LE_CONN_TIMEOUT,
+						   chan->sec_level, timeout,
 						   CONN_REASON_L2CAP_CHAN);
 
 	} else {
 		u8 auth_type = l2cap_get_auth_type(chan);
 		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
-				       CONN_REASON_L2CAP_CHAN);
+				       CONN_REASON_L2CAP_CHAN, timeout);
 	}
 
 	if (IS_ERR(hcon)) {
@@ -8355,11 +7338,6 @@
 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
 		       state_to_string(chan->state));
 
-		if (chan->scid == L2CAP_CID_A2MP) {
-			l2cap_chan_unlock(chan);
-			continue;
-		}
-
 		if (!status && encrypt)
 			chan->sec_level = hcon->sec_level;
 
@@ -8498,10 +7476,6 @@
 	struct l2cap_conn *conn = hcon->l2cap_data;
 	int len;
 
-	/* For AMP controller do not create l2cap conn */
-	if (!conn && hcon->hdev->dev_type != HCI_PRIMARY)
-		goto drop;
-
 	if (!conn)
 		conn = l2cap_conn_add(hcon);
 
--- linux-qcom-6.8.0.orig/net/bluetooth/l2cap_sock.c
+++ linux-qcom-6.8.0/net/bluetooth/l2cap_sock.c
@@ -254,7 +254,8 @@
 		chan->mode = L2CAP_MODE_LE_FLOWCTL;
 
 	err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
-				 &la.l2_bdaddr, la.l2_bdaddr_type);
+				 &la.l2_bdaddr, la.l2_bdaddr_type,
+				 sk->sk_sndtimeo);
 	if (err)
 		return err;
 
@@ -438,7 +439,8 @@
 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 	struct l2cap_options opts;
 	struct l2cap_conninfo cinfo;
-	int len, err = 0;
+	int err = 0;
+	size_t len;
 	u32 opt;
 
 	BT_DBG("sk %p", sk);
@@ -485,7 +487,7 @@
 
 		BT_DBG("mode 0x%2.2x", chan->mode);
 
-		len = min_t(unsigned int, len, sizeof(opts));
+		len = min(len, sizeof(opts));
 		if (copy_to_user(optval, (char *) &opts, len))
 			err = -EFAULT;
 
@@ -535,7 +537,7 @@
 		cinfo.hci_handle = chan->conn->hcon->handle;
 		memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 
-		len = min_t(unsigned int, len, sizeof(cinfo));
+		len = min(len, sizeof(cinfo));
 		if (copy_to_user(optval, (char *) &cinfo, len))
 			err = -EFAULT;
 
@@ -726,7 +728,7 @@
 	struct sock *sk = sock->sk;
 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 	struct l2cap_options opts;
-	int len, err = 0;
+	int err = 0;
 	u32 opt;
 
 	BT_DBG("sk %p", sk);
@@ -753,11 +755,10 @@
 		opts.max_tx   = chan->max_tx;
 		opts.txwin_size = chan->tx_win;
 
-		len = min_t(unsigned int, sizeof(opts), optlen);
-		if (copy_from_sockptr(&opts, optval, len)) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opts, sizeof(opts), optval,
+					     optlen);
+		if (err)
 			break;
-		}
 
 		if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 			err = -EINVAL;
@@ -800,10 +801,9 @@
 		break;
 
 	case L2CAP_LM:
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt & L2CAP_LM_FIPS) {
 			err = -EINVAL;
@@ -884,7 +884,7 @@
 	struct bt_security sec;
 	struct bt_power pwr;
 	struct l2cap_conn *conn;
-	int len, err = 0;
+	int err = 0;
 	u32 opt;
 	u16 mtu;
 	u8 mode;
@@ -910,11 +910,9 @@
 
 		sec.level = BT_SECURITY_LOW;
 
-		len = min_t(unsigned int, sizeof(sec), optlen);
-		if (copy_from_sockptr(&sec, optval, len)) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (sec.level < BT_SECURITY_LOW ||
 		    sec.level > BT_SECURITY_FIPS) {
@@ -959,10 +957,9 @@
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt) {
 			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -974,10 +971,9 @@
 		break;
 
 	case BT_FLUSHABLE:
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt > BT_FLUSHABLE_ON) {
 			err = -EINVAL;
@@ -1009,11 +1005,9 @@
 
 		pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 
-		len = min_t(unsigned int, sizeof(pwr), optlen);
-		if (copy_from_sockptr(&pwr, optval, len)) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (pwr.force_active)
 			set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
@@ -1022,28 +1016,11 @@
 		break;
 
 	case BT_CHANNEL_POLICY:
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
-			break;
-		}
-
-		if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
-			err = -EINVAL;
-			break;
-		}
-
-		if (chan->mode != L2CAP_MODE_ERTM &&
-		    chan->mode != L2CAP_MODE_STREAMING) {
-			err = -EOPNOTSUPP;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
-
-		chan->chan_policy = (u8) opt;
-
-		if (sk->sk_state == BT_CONNECTED &&
-		    chan->move_role == L2CAP_MOVE_ROLE_NONE)
-			l2cap_move_start(chan);
 
+		err = -EOPNOTSUPP;
 		break;
 
 	case BT_SNDMTU:
@@ -1070,10 +1047,9 @@
 			break;
 		}
 
-		if (copy_from_sockptr(&mtu, optval, sizeof(u16))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
 		    sk->sk_state == BT_CONNECTED)
@@ -1101,10 +1077,10 @@
 			break;
 		}
 
-		if (copy_from_sockptr(&mode, optval, sizeof(u8))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&mode, sizeof(mode), optval,
+					     optlen);
+		if (err)
 			break;
-		}
 
 		BT_DBG("mode %u", mode);
 
@@ -1157,6 +1133,34 @@
 	return err;
 }
 
+static void l2cap_publish_rx_avail(struct l2cap_chan *chan)
+{
+	struct sock *sk = chan->data;
+	ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc);
+	int expected_skbs, skb_overhead;
+
+	if (avail <= 0) {
+		l2cap_chan_rx_avail(chan, 0);
+		return;
+	}
+
+	if (!chan->mps) {
+		l2cap_chan_rx_avail(chan, -1);
+		return;
+	}
+
+	/* Correct available memory by estimated sk_buff overhead.
+	 * This is significant due to small transfer sizes. However, accept
+	 * at least one full packet if receive space is non-zero.
+	 */
+	expected_skbs = DIV_ROUND_UP(avail, chan->mps);
+	skb_overhead = expected_skbs * sizeof(struct sk_buff);
+	if (skb_overhead < avail)
+		l2cap_chan_rx_avail(chan, avail - skb_overhead);
+	else
+		l2cap_chan_rx_avail(chan, -1);
+}
+
 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 			      size_t len, int flags)
 {
@@ -1193,28 +1197,33 @@
 	else
 		err = bt_sock_recvmsg(sock, msg, len, flags);
 
-	if (pi->chan->mode != L2CAP_MODE_ERTM)
+	if (pi->chan->mode != L2CAP_MODE_ERTM &&
+	    pi->chan->mode != L2CAP_MODE_LE_FLOWCTL &&
+	    pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 		return err;
 
-	/* Attempt to put pending rx data in the socket buffer */
-
 	lock_sock(sk);
 
-	if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
-		goto done;
+	l2cap_publish_rx_avail(pi->chan);
 
-	if (pi->rx_busy_skb) {
-		if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
-			pi->rx_busy_skb = NULL;
-		else
+	/* Attempt to put pending rx data in the socket buffer */
+	while (!list_empty(&pi->rx_busy)) {
+		struct l2cap_rx_busy *rx_busy =
+			list_first_entry(&pi->rx_busy,
+					 struct l2cap_rx_busy,
+					 list);
+		if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0)
 			goto done;
+		list_del(&rx_busy->list);
+		kfree(rx_busy);
 	}
 
 	/* Restore data flow when half of the receive buffer is
 	 * available.  This avoids resending large numbers of
 	 * frames.
 	 */
-	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
+	if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) &&
+	    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
 		l2cap_chan_busy(pi->chan, 0);
 
 done:
@@ -1232,6 +1241,10 @@
 
 	BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
 
+	/* Sock is dead, so set chan data to NULL, avoid other task use invalid
+	 * sock pointer.
+	 */
+	l2cap_pi(sk)->chan->data = NULL;
 	/* Kill poor orphan */
 
 	l2cap_chan_put(l2cap_pi(sk)->chan);
@@ -1474,18 +1487,25 @@
 
 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 {
-	struct sock *sk = chan->data;
+	struct sock *sk;
+	struct l2cap_pinfo *pi;
 	int err;
 
-	lock_sock(sk);
+	sk = chan->data;
+	if (!sk)
+		return -ENXIO;
 
-	if (l2cap_pi(sk)->rx_busy_skb) {
+	pi = l2cap_pi(sk);
+	lock_sock(sk);
+	if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) {
 		err = -ENOMEM;
 		goto done;
 	}
 
 	if (chan->mode != L2CAP_MODE_ERTM &&
-	    chan->mode != L2CAP_MODE_STREAMING) {
+	    chan->mode != L2CAP_MODE_STREAMING &&
+	    chan->mode != L2CAP_MODE_LE_FLOWCTL &&
+	    chan->mode != L2CAP_MODE_EXT_FLOWCTL) {
 		/* Even if no filter is attached, we could potentially
 		 * get errors from security modules, etc.
 		 */
@@ -1496,7 +1516,9 @@
 
 	err = __sock_queue_rcv_skb(sk, skb);
 
-	/* For ERTM, handle one skb that doesn't fit into the recv
+	l2cap_publish_rx_avail(chan);
+
+	/* For ERTM and LE, handle a skb that doesn't fit into the recv
 	 * buffer.  This is important to do because the data frames
 	 * have already been acked, so the skb cannot be discarded.
 	 *
@@ -1505,8 +1527,18 @@
 	 * acked and reassembled until there is buffer space
 	 * available.
 	 */
-	if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
-		l2cap_pi(sk)->rx_busy_skb = skb;
+	if (err < 0 &&
+	    (chan->mode == L2CAP_MODE_ERTM ||
+	     chan->mode == L2CAP_MODE_LE_FLOWCTL ||
+	     chan->mode == L2CAP_MODE_EXT_FLOWCTL)) {
+		struct l2cap_rx_busy *rx_busy =
+			kmalloc(sizeof(*rx_busy), GFP_KERNEL);
+		if (!rx_busy) {
+			err = -ENOMEM;
+			goto done;
+		}
+		rx_busy->skb = skb;
+		list_add_tail(&rx_busy->list, &pi->rx_busy);
 		l2cap_chan_busy(chan, 1);
 		err = 0;
 	}
@@ -1732,6 +1764,8 @@
 
 static void l2cap_sock_destruct(struct sock *sk)
 {
+	struct l2cap_rx_busy *rx_busy, *next;
+
 	BT_DBG("sk %p", sk);
 
 	if (l2cap_pi(sk)->chan) {
@@ -1739,9 +1773,10 @@
 		l2cap_chan_put(l2cap_pi(sk)->chan);
 	}
 
-	if (l2cap_pi(sk)->rx_busy_skb) {
-		kfree_skb(l2cap_pi(sk)->rx_busy_skb);
-		l2cap_pi(sk)->rx_busy_skb = NULL;
+	list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) {
+		kfree_skb(rx_busy->skb);
+		list_del(&rx_busy->list);
+		kfree(rx_busy);
 	}
 
 	skb_queue_purge(&sk->sk_receive_queue);
@@ -1825,6 +1860,8 @@
 
 	chan->data = sk;
 	chan->ops = &l2cap_chan_ops;
+
+	l2cap_publish_rx_avail(chan);
 }
 
 static struct proto l2cap_proto = {
@@ -1846,9 +1883,13 @@
 	sk->sk_destruct = l2cap_sock_destruct;
 	sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
 
+	INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy);
+
 	chan = l2cap_chan_create();
 	if (!chan) {
 		sk_free(sk);
+		if (sock)
+			sock->sk = NULL;
 		return NULL;
 	}
 
--- linux-qcom-6.8.0.orig/net/bluetooth/mgmt.c
+++ linux-qcom-6.8.0/net/bluetooth/mgmt.c
@@ -443,8 +443,7 @@
 
 	count = 0;
 	list_for_each_entry(d, &hci_dev_list, list) {
-		if (d->dev_type == HCI_PRIMARY &&
-		    !hci_dev_test_flag(d, HCI_UNCONFIGURED))
+		if (!hci_dev_test_flag(d, HCI_UNCONFIGURED))
 			count++;
 	}
 
@@ -468,8 +467,7 @@
 		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 			continue;
 
-		if (d->dev_type == HCI_PRIMARY &&
-		    !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
+		if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 			rp->index[count++] = cpu_to_le16(d->id);
 			bt_dev_dbg(hdev, "Added hci%u", d->id);
 		}
@@ -503,8 +501,7 @@
 
 	count = 0;
 	list_for_each_entry(d, &hci_dev_list, list) {
-		if (d->dev_type == HCI_PRIMARY &&
-		    hci_dev_test_flag(d, HCI_UNCONFIGURED))
+		if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 			count++;
 	}
 
@@ -528,8 +525,7 @@
 		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 			continue;
 
-		if (d->dev_type == HCI_PRIMARY &&
-		    hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
+		if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 			rp->index[count++] = cpu_to_le16(d->id);
 			bt_dev_dbg(hdev, "Added hci%u", d->id);
 		}
@@ -561,10 +557,8 @@
 	read_lock(&hci_dev_list_lock);
 
 	count = 0;
-	list_for_each_entry(d, &hci_dev_list, list) {
-		if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
-			count++;
-	}
+	list_for_each_entry(d, &hci_dev_list, list)
+		count++;
 
 	rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 	if (!rp) {
@@ -585,16 +579,10 @@
 		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 			continue;
 
-		if (d->dev_type == HCI_PRIMARY) {
-			if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
-				rp->entry[count].type = 0x01;
-			else
-				rp->entry[count].type = 0x00;
-		} else if (d->dev_type == HCI_AMP) {
-			rp->entry[count].type = 0x02;
-		} else {
-			continue;
-		}
+		if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
+			rp->entry[count].type = 0x01;
+		else
+			rp->entry[count].type = 0x00;
 
 		rp->entry[count].bus = d->bus;
 		rp->entry[count++].index = cpu_to_le16(d->id);
@@ -835,8 +823,6 @@
 
 		if (lmp_ssp_capable(hdev)) {
 			settings |= MGMT_SETTING_SSP;
-			if (IS_ENABLED(CONFIG_BT_HS))
-				settings |= MGMT_SETTING_HS;
 		}
 
 		if (lmp_sc_capable(hdev))
@@ -901,9 +887,6 @@
 	if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 		settings |= MGMT_SETTING_SSP;
 
-	if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
-		settings |= MGMT_SETTING_HS;
-
 	if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 		settings |= MGMT_SETTING_ADVERTISING;
 
@@ -1335,7 +1318,8 @@
 	struct mgmt_mode *cp;
 
 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
 		return;
 
 	cp = cmd->param;
@@ -1368,7 +1352,13 @@
 static int set_powered_sync(struct hci_dev *hdev, void *data)
 {
 	struct mgmt_pending_cmd *cmd = data;
-	struct mgmt_mode *cp = cmd->param;
+	struct mgmt_mode *cp;
+
+	/* Make sure cmd still outstanding. */
+	if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
+		return -ECANCELED;
+
+	cp = cmd->param;
 
 	BT_DBG("%s", hdev->name);
 
@@ -1409,7 +1399,7 @@
 
 	/* Cancel potentially blocking sync operation before power off */
 	if (cp->val == 0x00) {
-		__hci_cmd_sync_cancel(hdev, -EHOSTDOWN);
+		hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN);
 		err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
 					 mgmt_set_powered_complete);
 	} else {
@@ -1463,10 +1453,15 @@
 
 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
 {
-	if (cmd->cmd_complete) {
-		u8 *status = data;
+	struct cmd_lookup *match = data;
+
+	/* dequeue cmd_sync entries using cmd as data as that is about to be
+	 * removed/freed.
+	 */
+	hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
 
-		cmd->cmd_complete(cmd, *status);
+	if (cmd->cmd_complete) {
+		cmd->cmd_complete(cmd, match->mgmt_status);
 		mgmt_pending_remove(cmd);
 
 		return;
@@ -1515,7 +1510,8 @@
 	bt_dev_dbg(hdev, "err %d", err);
 
 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
 		return;
 
 	hci_dev_lock(hdev);
@@ -1689,7 +1685,8 @@
 	bt_dev_dbg(hdev, "err %d", err);
 
 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
 		return;
 
 	hci_dev_lock(hdev);
@@ -1922,7 +1919,7 @@
 	bool changed;
 
 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
+	if (err == -ECANCELED || cmd != pending_find(MGMT_OP_SET_SSP, hdev))
 		return;
 
 	if (err) {
@@ -1930,7 +1927,6 @@
 
 		if (enable && hci_dev_test_and_clear_flag(hdev,
 							  HCI_SSP_ENABLED)) {
-			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
 			new_settings(hdev, NULL);
 		}
 
@@ -1943,12 +1939,6 @@
 		changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
 	} else {
 		changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
-
-		if (!changed)
-			changed = hci_dev_test_and_clear_flag(hdev,
-							      HCI_HS_ENABLED);
-		else
-			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
 	}
 
 	mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
@@ -2012,11 +2002,6 @@
 		} else {
 			changed = hci_dev_test_and_clear_flag(hdev,
 							      HCI_SSP_ENABLED);
-			if (!changed)
-				changed = hci_dev_test_and_clear_flag(hdev,
-								      HCI_HS_ENABLED);
-			else
-				hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
 		}
 
 		err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
@@ -2062,63 +2047,10 @@
 
 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
-	struct mgmt_mode *cp = data;
-	bool changed;
-	u8 status;
-	int err;
-
 	bt_dev_dbg(hdev, "sock %p", sk);
 
-	if (!IS_ENABLED(CONFIG_BT_HS))
-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-				       MGMT_STATUS_NOT_SUPPORTED);
-
-	status = mgmt_bredr_support(hdev);
-	if (status)
-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
-
-	if (!lmp_ssp_capable(hdev))
-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+	return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
 				       MGMT_STATUS_NOT_SUPPORTED);
-
-	if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-				       MGMT_STATUS_REJECTED);
-
-	if (cp->val != 0x00 && cp->val != 0x01)
-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-				       MGMT_STATUS_INVALID_PARAMS);
-
-	hci_dev_lock(hdev);
-
-	if (pending_find(MGMT_OP_SET_SSP, hdev)) {
-		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-				      MGMT_STATUS_BUSY);
-		goto unlock;
-	}
-
-	if (cp->val) {
-		changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
-	} else {
-		if (hdev_is_powered(hdev)) {
-			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-					      MGMT_STATUS_REJECTED);
-			goto unlock;
-		}
-
-		changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
-	}
-
-	err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
-	if (err < 0)
-		goto unlock;
-
-	if (changed)
-		err = new_settings(hdev, sk);
-
-unlock:
-	hci_dev_unlock(hdev);
-	return err;
 }
 
 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
@@ -2686,7 +2618,11 @@
 		goto failed;
 	}
 
-	err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
+	/* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use
+	 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
+	 */
+	err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd,
+				  mgmt_class_complete);
 	if (err < 0) {
 		mgmt_pending_free(cmd);
 		goto failed;
@@ -2780,8 +2716,11 @@
 		goto unlock;
 	}
 
-	err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
-				 mgmt_class_complete);
+	/* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use
+	 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
+	 */
+	err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd,
+				  mgmt_class_complete);
 	if (err < 0)
 		mgmt_pending_free(cmd);
 
@@ -2847,8 +2786,11 @@
 		goto unlock;
 	}
 
-	err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
-				 mgmt_class_complete);
+	/* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use
+	 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
+	 */
+	err = hci_cmd_sync_submit(hdev, set_class_sync, cmd,
+				  mgmt_class_complete);
 	if (err < 0)
 		mgmt_pending_free(cmd);
 
@@ -2896,16 +2838,6 @@
 	bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
 		   key_count);
 
-	for (i = 0; i < key_count; i++) {
-		struct mgmt_link_key_info *key = &cp->keys[i];
-
-		/* Considering SMP over BREDR/LE, there is no need to check addr_type */
-		if (key->type > 0x08)
-			return mgmt_cmd_status(sk, hdev->id,
-					       MGMT_OP_LOAD_LINK_KEYS,
-					       MGMT_STATUS_INVALID_PARAMS);
-	}
-
 	hci_dev_lock(hdev);
 
 	hci_link_keys_clear(hdev);
@@ -2930,6 +2862,19 @@
 			continue;
 		}
 
+		if (key->addr.type != BDADDR_BREDR) {
+			bt_dev_warn(hdev,
+				    "Invalid link address type %u for %pMR",
+				    key->addr.type, &key->addr.bdaddr);
+			continue;
+		}
+
+		if (key->type > 0x08) {
+			bt_dev_warn(hdev, "Invalid link key type %u for %pMR",
+				    key->type, &key->addr.bdaddr);
+			continue;
+		}
+
 		/* Always ignore debug keys and require a new pairing if
 		 * the user wants to use them.
 		 */
@@ -2987,7 +2932,12 @@
 	if (!conn)
 		return 0;
 
-	return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
+	/* Disregard any possible error since the likes of hci_abort_conn_sync
+	 * will clean up the connection no matter the error.
+	 */
+	hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
+
+	return 0;
 }
 
 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -3119,13 +3069,44 @@
 	return err;
 }
 
+static void disconnect_complete(struct hci_dev *hdev, void *data, int err)
+{
+	struct mgmt_pending_cmd *cmd = data;
+
+	cmd->cmd_complete(cmd, mgmt_status(err));
+	mgmt_pending_free(cmd);
+}
+
+static int disconnect_sync(struct hci_dev *hdev, void *data)
+{
+	struct mgmt_pending_cmd *cmd = data;
+	struct mgmt_cp_disconnect *cp = cmd->param;
+	struct hci_conn *conn;
+
+	if (cp->addr.type == BDADDR_BREDR)
+		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
+					       &cp->addr.bdaddr);
+	else
+		conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
+					       le_addr_type(cp->addr.type));
+
+	if (!conn)
+		return -ENOTCONN;
+
+	/* Disregard any possible error since the likes of hci_abort_conn_sync
+	 * will clean up the connection no matter the error.
+	 */
+	hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
+
+	return 0;
+}
+
 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
 		      u16 len)
 {
 	struct mgmt_cp_disconnect *cp = data;
 	struct mgmt_rp_disconnect rp;
 	struct mgmt_pending_cmd *cmd;
-	struct hci_conn *conn;
 	int err;
 
 	bt_dev_dbg(hdev, "sock %p", sk);
@@ -3148,27 +3129,7 @@
 		goto failed;
 	}
 
-	if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
-		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
-					MGMT_STATUS_BUSY, &rp, sizeof(rp));
-		goto failed;
-	}
-
-	if (cp->addr.type == BDADDR_BREDR)
-		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
-					       &cp->addr.bdaddr);
-	else
-		conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
-					       le_addr_type(cp->addr.type));
-
-	if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
-		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
-					MGMT_STATUS_NOT_CONNECTED, &rp,
-					sizeof(rp));
-		goto failed;
-	}
-
-	cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
+	cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len);
 	if (!cmd) {
 		err = -ENOMEM;
 		goto failed;
@@ -3176,9 +3137,10 @@
 
 	cmd->cmd_complete = generic_cmd_complete;
 
-	err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
+	err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd,
+				 disconnect_complete);
 	if (err < 0)
-		mgmt_pending_remove(cmd);
+		mgmt_pending_free(cmd);
 
 failed:
 	hci_dev_unlock(hdev);
@@ -3188,6 +3150,7 @@
 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
 {
 	switch (link_type) {
+	case ISO_LINK:
 	case LE_LINK:
 		switch (addr_type) {
 		case ADDR_LE_DEV_PUBLIC:
@@ -3505,7 +3468,8 @@
 
 	if (cp->addr.type == BDADDR_BREDR) {
 		conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
-				       auth_type, CONN_REASON_PAIR_DEVICE);
+				       auth_type, CONN_REASON_PAIR_DEVICE,
+				       HCI_ACL_CONN_TIMEOUT);
 	} else {
 		u8 addr_type = le_addr_type(cp->addr.type);
 		struct hci_conn_params *p;
@@ -3520,6 +3484,10 @@
 		 * will be kept and this function does nothing.
 		 */
 		p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
+		if (!p) {
+			err = -EIO;
+			goto unlock;
+		}
 
 		if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
 			p->auto_connect = HCI_AUTO_CONN_DISABLED;
@@ -3817,7 +3785,8 @@
 
 	bt_dev_dbg(hdev, "err %d", err);
 
-	if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
 		return;
 
 	if (status) {
@@ -3992,7 +3961,8 @@
 	struct sk_buff *skb = cmd->skb;
 	u8 status = mgmt_status(err);
 
-	if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
 		return;
 
 	if (!status) {
@@ -5536,8 +5506,8 @@
 		goto unlock;
 	}
 
-	err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
-				 mgmt_remove_adv_monitor_complete);
+	err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd,
+				  mgmt_remove_adv_monitor_complete);
 
 	if (err) {
 		mgmt_pending_remove(cmd);
@@ -5883,13 +5853,16 @@
 {
 	struct mgmt_pending_cmd *cmd = data;
 
+	bt_dev_dbg(hdev, "err %d", err);
+
+	if (err == -ECANCELED)
+		return;
+
 	if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
 	    cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
 	    cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
 		return;
 
-	bt_dev_dbg(hdev, "err %d", err);
-
 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
 			  cmd->param, 1);
 	mgmt_pending_remove(cmd);
@@ -6122,7 +6095,8 @@
 {
 	struct mgmt_pending_cmd *cmd = data;
 
-	if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
 		return;
 
 	bt_dev_dbg(hdev, "err %d", err);
@@ -6766,7 +6740,6 @@
 			hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 			hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
 			hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
-			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
 		}
 
 		hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
@@ -7133,7 +7106,6 @@
 
 	for (i = 0; i < irk_count; i++) {
 		struct mgmt_irk_info *irk = &cp->irks[i];
-		u8 addr_type = le_addr_type(irk->addr.type);
 
 		if (hci_is_blocked_key(hdev,
 				       HCI_BLOCKED_KEY_TYPE_IRK,
@@ -7143,12 +7115,8 @@
 			continue;
 		}
 
-		/* When using SMP over BR/EDR, the addr type should be set to BREDR */
-		if (irk->addr.type == BDADDR_BREDR)
-			addr_type = BDADDR_BREDR;
-
 		hci_add_irk(hdev, &irk->addr.bdaddr,
-			    addr_type, irk->val,
+			    le_addr_type(irk->addr.type), irk->val,
 			    BDADDR_ANY);
 	}
 
@@ -7213,15 +7181,6 @@
 
 	bt_dev_dbg(hdev, "key_count %u", key_count);
 
-	for (i = 0; i < key_count; i++) {
-		struct mgmt_ltk_info *key = &cp->keys[i];
-
-		if (!ltk_is_valid(key))
-			return mgmt_cmd_status(sk, hdev->id,
-					       MGMT_OP_LOAD_LONG_TERM_KEYS,
-					       MGMT_STATUS_INVALID_PARAMS);
-	}
-
 	hci_dev_lock(hdev);
 
 	hci_smp_ltks_clear(hdev);
@@ -7229,7 +7188,6 @@
 	for (i = 0; i < key_count; i++) {
 		struct mgmt_ltk_info *key = &cp->keys[i];
 		u8 type, authenticated;
-		u8 addr_type = le_addr_type(key->addr.type);
 
 		if (hci_is_blocked_key(hdev,
 				       HCI_BLOCKED_KEY_TYPE_LTK,
@@ -7239,6 +7197,12 @@
 			continue;
 		}
 
+		if (!ltk_is_valid(key)) {
+			bt_dev_warn(hdev, "Invalid LTK for %pMR",
+				    &key->addr.bdaddr);
+			continue;
+		}
+
 		switch (key->type) {
 		case MGMT_LTK_UNAUTHENTICATED:
 			authenticated = 0x00;
@@ -7264,12 +7228,8 @@
 			continue;
 		}
 
-		/* When using SMP over BR/EDR, the addr type should be set to BREDR */
-		if (key->addr.type == BDADDR_BREDR)
-			addr_type = BDADDR_BREDR;
-
 		hci_add_ltk(hdev, &key->addr.bdaddr,
-			    addr_type, type, authenticated,
+			    le_addr_type(key->addr.type), type, authenticated,
 			    key->val, key->enc_size, key->ediv, key->rand);
 	}
 
@@ -7630,6 +7590,24 @@
 	mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
 }
 
+static void add_device_complete(struct hci_dev *hdev, void *data, int err)
+{
+	struct mgmt_pending_cmd *cmd = data;
+	struct mgmt_cp_add_device *cp = cmd->param;
+
+	if (!err) {
+		device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+			     cp->action);
+		device_flags_changed(NULL, hdev, &cp->addr.bdaddr,
+				     cp->addr.type, hdev->conn_flags,
+				     PTR_UINT(cmd->user_data));
+	}
+
+	mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE,
+			  mgmt_status(err), &cp->addr, sizeof(cp->addr));
+	mgmt_pending_free(cmd);
+}
+
 static int add_device_sync(struct hci_dev *hdev, void *data)
 {
 	return hci_update_passive_scan_sync(hdev);
@@ -7638,6 +7616,7 @@
 static int add_device(struct sock *sk, struct hci_dev *hdev,
 		      void *data, u16 len)
 {
+	struct mgmt_pending_cmd *cmd;
 	struct mgmt_cp_add_device *cp = data;
 	u8 auto_conn, addr_type;
 	struct hci_conn_params *params;
@@ -7718,9 +7697,24 @@
 			current_flags = params->flags;
 	}
 
-	err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
-	if (err < 0)
+	cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
+	if (!cmd) {
+		err = -ENOMEM;
 		goto unlock;
+	}
+
+	cmd->user_data = UINT_PTR(current_flags);
+
+	err = hci_cmd_sync_queue(hdev, add_device_sync, cmd,
+				 add_device_complete);
+	if (err < 0) {
+		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
+					MGMT_STATUS_FAILED, &cp->addr,
+					sizeof(cp->addr));
+		mgmt_pending_free(cmd);
+	}
+
+	goto unlock;
 
 added:
 	device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
@@ -8081,7 +8075,8 @@
 	u8 status = mgmt_status(err);
 	u16 eir_len;
 
-	if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
 		return;
 
 	if (!status) {
@@ -8470,7 +8465,7 @@
 
 static u8 calculate_name_len(struct hci_dev *hdev)
 {
-	u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
+	u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */
 
 	return eir_append_local_name(hdev, buf, 0);
 }
@@ -9384,23 +9379,14 @@
 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 		return;
 
-	switch (hdev->dev_type) {
-	case HCI_PRIMARY:
-		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
-			mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
-					 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
-			ev.type = 0x01;
-		} else {
-			mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
-					 HCI_MGMT_INDEX_EVENTS);
-			ev.type = 0x00;
-		}
-		break;
-	case HCI_AMP:
-		ev.type = 0x02;
-		break;
-	default:
-		return;
+	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
+		mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0,
+				 HCI_MGMT_UNCONF_INDEX_EVENTS);
+		ev.type = 0x01;
+	} else {
+		mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
+				 HCI_MGMT_INDEX_EVENTS);
+		ev.type = 0x00;
 	}
 
 	ev.bus = hdev->bus;
@@ -9412,30 +9398,21 @@
 void mgmt_index_removed(struct hci_dev *hdev)
 {
 	struct mgmt_ev_ext_index ev;
-	u8 status = MGMT_STATUS_INVALID_INDEX;
+	struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX };
 
 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 		return;
 
-	switch (hdev->dev_type) {
-	case HCI_PRIMARY:
-		mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
-
-		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
-			mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
-					 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
-			ev.type = 0x01;
-		} else {
-			mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
-					 HCI_MGMT_INDEX_EVENTS);
-			ev.type = 0x00;
-		}
-		break;
-	case HCI_AMP:
-		ev.type = 0x02;
-		break;
-	default:
-		return;
+	mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &match);
+
+	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
+		mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,
+				 HCI_MGMT_UNCONF_INDEX_EVENTS);
+		ev.type = 0x01;
+	} else {
+		mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
+				 HCI_MGMT_INDEX_EVENTS);
+		ev.type = 0x00;
 	}
 
 	ev.bus = hdev->bus;
@@ -9477,7 +9454,7 @@
 void __mgmt_power_off(struct hci_dev *hdev)
 {
 	struct cmd_lookup match = { NULL, hdev };
-	u8 status, zero_cod[] = { 0, 0, 0 };
+	u8 zero_cod[] = { 0, 0, 0 };
 
 	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
 
@@ -9489,11 +9466,11 @@
 	 * status responses.
 	 */
 	if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
-		status = MGMT_STATUS_INVALID_INDEX;
+		match.mgmt_status = MGMT_STATUS_INVALID_INDEX;
 	else
-		status = MGMT_STATUS_NOT_POWERED;
+		match.mgmt_status = MGMT_STATUS_NOT_POWERED;
 
-	mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
+	mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &match);
 
 	if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
 		mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
@@ -9536,7 +9513,7 @@
 
 	ev.store_hint = persistent;
 	bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
-	ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
+	ev.key.addr.type = BDADDR_BREDR;
 	ev.key.type = key->type;
 	memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
 	ev.key.pin_len = key->pin_len;
@@ -9587,7 +9564,7 @@
 		ev.store_hint = persistent;
 
 	bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
-	ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
+	ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
 	ev.key.type = mgmt_ltk_type(key);
 	ev.key.enc_size = key->enc_size;
 	ev.key.ediv = key->ediv;
@@ -9616,7 +9593,7 @@
 
 	bacpy(&ev.rpa, &irk->rpa);
 	bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
-	ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type);
+	ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
 	memcpy(ev.irk.val, irk->val, sizeof(irk->val));
 
 	mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
@@ -9645,7 +9622,7 @@
 		ev.store_hint = persistent;
 
 	bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
-	ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type);
+	ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
 	ev.key.type = csrk->type;
 	memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
 
@@ -9681,6 +9658,9 @@
 	u16 eir_len = 0;
 	u32 flags = 0;
 
+	if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+		return;
+
 	/* allocate buff for LE or BR/EDR adv */
 	if (conn->le_adv_data_len > 0)
 		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
@@ -9720,18 +9700,6 @@
 	mgmt_event_skb(skb, NULL);
 }
 
-static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
-{
-	struct sock **sk = data;
-
-	cmd->cmd_complete(cmd, 0);
-
-	*sk = cmd->sk;
-	sock_hold(*sk);
-
-	mgmt_pending_remove(cmd);
-}
-
 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
 {
 	struct hci_dev *hdev = data;
@@ -9766,22 +9734,12 @@
 	struct mgmt_ev_device_disconnected ev;
 	struct sock *sk = NULL;
 
-	/* The connection is still in hci_conn_hash so test for 1
-	 * instead of 0 to know if this is the last one.
-	 */
-	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
-		cancel_delayed_work(&hdev->power_off);
-		queue_work(hdev->req_workqueue, &hdev->power_off.work);
-	}
-
 	if (!mgmt_connected)
 		return;
 
 	if (link_type != ACL_LINK && link_type != LE_LINK)
 		return;
 
-	mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
-
 	bacpy(&ev.addr.bdaddr, bdaddr);
 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
 	ev.reason = reason;
@@ -9794,9 +9752,6 @@
 
 	if (sk)
 		sock_put(sk);
-
-	mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
-			     hdev);
 }
 
 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
@@ -9825,21 +9780,18 @@
 	mgmt_pending_remove(cmd);
 }
 
-void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-			 u8 addr_type, u8 status)
+void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status)
 {
 	struct mgmt_ev_connect_failed ev;
 
-	/* The connection is still in hci_conn_hash so test for 1
-	 * instead of 0 to know if this is the last one.
-	 */
-	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
-		cancel_delayed_work(&hdev->power_off);
-		queue_work(hdev->req_workqueue, &hdev->power_off.work);
+	if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
+		mgmt_device_disconnected(hdev, &conn->dst, conn->type,
+					 conn->dst_type, status, true);
+		return;
 	}
 
-	bacpy(&ev.addr.bdaddr, bdaddr);
-	ev.addr.type = link_to_bdaddr(link_type, addr_type);
+	bacpy(&ev.addr.bdaddr, &conn->dst);
+	ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
 	ev.status = mgmt_status(status);
 
 	mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
--- linux-qcom-6.8.0.orig/net/bluetooth/msft.c
+++ linux-qcom-6.8.0/net/bluetooth/msft.c
@@ -769,7 +769,7 @@
 	mutex_init(&msft->filter_lock);
 }
 
-void msft_unregister(struct hci_dev *hdev)
+void msft_release(struct hci_dev *hdev)
 {
 	struct msft_data *msft = hdev->msft_data;
 
@@ -875,6 +875,7 @@
 		remove = true;
 		goto done;
 	}
+
 	cp->sub_opcode           = MSFT_OP_LE_MONITOR_ADVERTISEMENT;
 	cp->rssi_high		 = address_filter->rssi_high;
 	cp->rssi_low		 = address_filter->rssi_low;
@@ -887,6 +888,8 @@
 
 	skb = __hci_cmd_sync(hdev, hdev->msft_opcode, size, cp,
 			     HCI_CMD_TIMEOUT);
+	kfree(cp);
+
 	if (IS_ERR(skb)) {
 		bt_dev_err(hdev, "Failed to enable address %pMR filter",
 			   &address_filter->bdaddr);
--- linux-qcom-6.8.0.orig/net/bluetooth/msft.h
+++ linux-qcom-6.8.0/net/bluetooth/msft.h
@@ -14,7 +14,7 @@
 
 bool msft_monitor_supported(struct hci_dev *hdev);
 void msft_register(struct hci_dev *hdev);
-void msft_unregister(struct hci_dev *hdev);
+void msft_release(struct hci_dev *hdev);
 void msft_do_open(struct hci_dev *hdev);
 void msft_do_close(struct hci_dev *hdev);
 void msft_vendor_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb);
@@ -35,7 +35,7 @@
 }
 
 static inline void msft_register(struct hci_dev *hdev) {}
-static inline void msft_unregister(struct hci_dev *hdev) {}
+static inline void msft_release(struct hci_dev *hdev) {}
 static inline void msft_do_open(struct hci_dev *hdev) {}
 static inline void msft_do_close(struct hci_dev *hdev) {}
 static inline void msft_vendor_evt(struct hci_dev *hdev, void *data,
--- linux-qcom-6.8.0.orig/net/bluetooth/rfcomm/sock.c
+++ linux-qcom-6.8.0/net/bluetooth/rfcomm/sock.c
@@ -274,13 +274,13 @@
 	struct rfcomm_dlc *d;
 	struct sock *sk;
 
-	sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern);
-	if (!sk)
+	d = rfcomm_dlc_alloc(prio);
+	if (!d)
 		return NULL;
 
-	d = rfcomm_dlc_alloc(prio);
-	if (!d) {
-		sk_free(sk);
+	sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern);
+	if (!sk) {
+		rfcomm_dlc_free(d);
 		return NULL;
 	}
 
@@ -629,10 +629,9 @@
 
 	switch (optname) {
 	case RFCOMM_LM:
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt & RFCOMM_LM_FIPS) {
 			err = -EINVAL;
@@ -664,7 +663,6 @@
 	struct sock *sk = sock->sk;
 	struct bt_security sec;
 	int err = 0;
-	size_t len;
 	u32 opt;
 
 	BT_DBG("sk %p", sk);
@@ -686,11 +684,9 @@
 
 		sec.level = BT_SECURITY_LOW;
 
-		len = min_t(unsigned int, sizeof(sec), optlen);
-		if (copy_from_sockptr(&sec, optval, len)) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (sec.level > BT_SECURITY_HIGH) {
 			err = -EINVAL;
@@ -706,10 +702,9 @@
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -733,7 +728,8 @@
 	struct sock *l2cap_sk;
 	struct l2cap_conn *conn;
 	struct rfcomm_conninfo cinfo;
-	int len, err = 0;
+	int err = 0;
+	size_t len;
 	u32 opt;
 
 	BT_DBG("sk %p", sk);
@@ -787,7 +783,7 @@
 		cinfo.hci_handle = conn->hcon->handle;
 		memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 
-		len = min_t(unsigned int, len, sizeof(cinfo));
+		len = min(len, sizeof(cinfo));
 		if (copy_to_user(optval, (char *) &cinfo, len))
 			err = -EFAULT;
 
@@ -806,7 +802,8 @@
 {
 	struct sock *sk = sock->sk;
 	struct bt_security sec;
-	int len, err = 0;
+	int err = 0;
+	size_t len;
 
 	BT_DBG("sk %p", sk);
 
@@ -831,7 +828,7 @@
 		sec.level = rfcomm_pi(sk)->sec_level;
 		sec.key_size = 0;
 
-		len = min_t(unsigned int, len, sizeof(sec));
+		len = min(len, sizeof(sec));
 		if (copy_to_user(optval, (char *) &sec, len))
 			err = -EFAULT;
 
@@ -869,9 +866,7 @@
 
 	if (err == -ENOIOCTLCMD) {
 #ifdef CONFIG_BT_RFCOMM_TTY
-		lock_sock(sk);
 		err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
-		release_sock(sk);
 #else
 		err = -EOPNOTSUPP;
 #endif
--- linux-qcom-6.8.0.orig/net/bluetooth/sco.c
+++ linux-qcom-6.8.0/net/bluetooth/sco.c
@@ -76,6 +76,16 @@
 #define SCO_CONN_TIMEOUT	(HZ * 40)
 #define SCO_DISCONN_TIMEOUT	(HZ * 2)
 
+static struct sock *sco_sock_hold(struct sco_conn *conn)
+{
+	if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk))
+		return NULL;
+
+	sock_hold(conn->sk);
+
+	return conn->sk;
+}
+
 static void sco_sock_timeout(struct work_struct *work)
 {
 	struct sco_conn *conn = container_of(work, struct sco_conn,
@@ -83,9 +93,11 @@
 	struct sock *sk;
 
 	sco_conn_lock(conn);
-	sk = conn->sk;
-	if (sk)
-		sock_hold(sk);
+	if (!conn->hcon) {
+		sco_conn_unlock(conn);
+		return;
+	}
+	sk = sco_sock_hold(conn);
 	sco_conn_unlock(conn);
 
 	if (!sk)
@@ -122,7 +134,6 @@
 /* ---- SCO connections ---- */
 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
 {
-	struct hci_dev *hdev = hcon->hdev;
 	struct sco_conn *conn = hcon->sco_data;
 
 	if (conn) {
@@ -140,9 +151,10 @@
 
 	hcon->sco_data = conn;
 	conn->hcon = hcon;
+	conn->mtu = hcon->mtu;
 
-	if (hdev->sco_mtu > 0)
-		conn->mtu = hdev->sco_mtu;
+	if (hcon->mtu > 0)
+		conn->mtu = hcon->mtu;
 	else
 		conn->mtu = 60;
 
@@ -190,9 +202,7 @@
 
 	/* Kill socket */
 	sco_conn_lock(conn);
-	sk = conn->sk;
-	if (sk)
-		sock_hold(sk);
+	sk = sco_sock_hold(conn);
 	sco_conn_unlock(conn);
 
 	if (sk) {
@@ -257,14 +267,18 @@
 	else
 		type = SCO_LINK;
 
-	if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
-	    (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
-		err = -EOPNOTSUPP;
-		goto unlock;
+	switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) {
+	case SCO_AIRMODE_TRANSP:
+		if (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)) {
+			err = -EOPNOTSUPP;
+			goto unlock;
+		}
+		break;
 	}
 
 	hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
-			       sco_pi(sk)->setting, &sco_pi(sk)->codec);
+			       sco_pi(sk)->setting, &sco_pi(sk)->codec,
+			       sk->sk_sndtimeo);
 	if (IS_ERR(hcon)) {
 		err = PTR_ERR(hcon);
 		goto unlock;
@@ -823,7 +837,7 @@
 			       sockptr_t optval, unsigned int optlen)
 {
 	struct sock *sk = sock->sk;
-	int len, err = 0;
+	int err = 0;
 	struct bt_voice voice;
 	u32 opt;
 	struct bt_codecs *codecs;
@@ -842,10 +856,9 @@
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@@ -862,18 +875,10 @@
 
 		voice.setting = sco_pi(sk)->setting;
 
-		len = min_t(unsigned int, sizeof(voice), optlen);
-		if (copy_from_sockptr(&voice, optval, len)) {
-			err = -EFAULT;
-			break;
-		}
-
-		/* Explicitly check for these values */
-		if (voice.setting != BT_VOICE_TRANSPARENT &&
-		    voice.setting != BT_VOICE_CVSD_16BIT) {
-			err = -EINVAL;
+		err = copy_safe_from_sockptr(&voice, sizeof(voice), optval,
+					     optlen);
+		if (err)
 			break;
-		}
 
 		sco_pi(sk)->setting = voice.setting;
 		hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
@@ -882,17 +887,21 @@
 			err = -EBADFD;
 			break;
 		}
-		if (enhanced_sync_conn_capable(hdev) &&
-		    voice.setting == BT_VOICE_TRANSPARENT)
-			sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT;
+
+		switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) {
+		case SCO_AIRMODE_TRANSP:
+			if (enhanced_sync_conn_capable(hdev))
+				sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT;
+			break;
+		}
+
 		hci_dev_put(hdev);
 		break;
 
 	case BT_PKT_STATUS:
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt)
 			set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
@@ -933,9 +942,10 @@
 			break;
 		}
 
-		if (copy_from_sockptr(buffer, optval, optlen)) {
+		err = copy_struct_from_sockptr(buffer, sizeof(buffer), optval,
+					       optlen);
+		if (err) {
 			hci_dev_put(hdev);
-			err = -EFAULT;
 			break;
 		}
 
@@ -966,7 +976,8 @@
 	struct sock *sk = sock->sk;
 	struct sco_options opts;
 	struct sco_conninfo cinfo;
-	int len, err = 0;
+	int err = 0;
+	size_t len;
 
 	BT_DBG("sk %p", sk);
 
@@ -988,7 +999,7 @@
 
 		BT_DBG("mtu %u", opts.mtu);
 
-		len = min_t(unsigned int, len, sizeof(opts));
+		len = min(len, sizeof(opts));
 		if (copy_to_user(optval, (char *)&opts, len))
 			err = -EFAULT;
 
@@ -1006,7 +1017,7 @@
 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
 
-		len = min_t(unsigned int, len, sizeof(cinfo));
+		len = min(len, sizeof(cinfo));
 		if (copy_to_user(optval, (char *)&cinfo, len))
 			err = -EFAULT;
 
--- linux-qcom-6.8.0.orig/net/bluetooth/smp.c
+++ linux-qcom-6.8.0/net/bluetooth/smp.c
@@ -914,7 +914,7 @@
 	 * Confirms and the responder Enters the passkey.
 	 */
 	if (smp->method == OVERLAP) {
-		if (hcon->role == HCI_ROLE_MASTER)
+		if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 			smp->method = CFM_PASSKEY;
 		else
 			smp->method = REQ_PASSKEY;
@@ -964,7 +964,7 @@
 
 	smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
 
-	if (conn->hcon->out)
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
 	else
 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
@@ -980,7 +980,8 @@
 	int ret;
 
 	bt_dev_dbg(conn->hcon->hdev, "conn %p %s", conn,
-		   conn->hcon->out ? "initiator" : "responder");
+		   test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" :
+		   "responder");
 
 	ret = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp,
 		     hcon->init_addr_type, &hcon->init_addr,
@@ -994,7 +995,7 @@
 		return SMP_CONFIRM_FAILED;
 	}
 
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		u8 stk[16];
 		__le64 rand = 0;
 		__le16 ediv = 0;
@@ -1059,7 +1060,6 @@
 	}
 
 	if (smp->remote_irk) {
-		smp->remote_irk->link_type = hcon->type;
 		mgmt_new_irk(hdev, smp->remote_irk, persistent);
 
 		/* Now that user space can be considered to know the
@@ -1079,28 +1079,24 @@
 	}
 
 	if (smp->csrk) {
-		smp->csrk->link_type = hcon->type;
 		smp->csrk->bdaddr_type = hcon->dst_type;
 		bacpy(&smp->csrk->bdaddr, &hcon->dst);
 		mgmt_new_csrk(hdev, smp->csrk, persistent);
 	}
 
 	if (smp->responder_csrk) {
-		smp->responder_csrk->link_type = hcon->type;
 		smp->responder_csrk->bdaddr_type = hcon->dst_type;
 		bacpy(&smp->responder_csrk->bdaddr, &hcon->dst);
 		mgmt_new_csrk(hdev, smp->responder_csrk, persistent);
 	}
 
 	if (smp->ltk) {
-		smp->ltk->link_type = hcon->type;
 		smp->ltk->bdaddr_type = hcon->dst_type;
 		bacpy(&smp->ltk->bdaddr, &hcon->dst);
 		mgmt_new_ltk(hdev, smp->ltk, persistent);
 	}
 
 	if (smp->responder_ltk) {
-		smp->responder_ltk->link_type = hcon->type;
 		smp->responder_ltk->bdaddr_type = hcon->dst_type;
 		bacpy(&smp->responder_ltk->bdaddr, &hcon->dst);
 		mgmt_new_ltk(hdev, smp->responder_ltk, persistent);
@@ -1120,8 +1116,6 @@
 		key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst,
 				       smp->link_key, type, 0, &persistent);
 		if (key) {
-			key->link_type = hcon->type;
-			key->bdaddr_type = hcon->dst_type;
 			mgmt_new_link_key(hdev, key, persistent);
 
 			/* Don't keep debug keys around if the relevant
@@ -1256,14 +1250,15 @@
 	rsp = (void *) &smp->prsp[1];
 
 	/* The responder sends its keys first */
-	if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags) &&
+	    (smp->remote_key_dist & KEY_DIST_MASK)) {
 		smp_allow_key_dist(smp);
 		return;
 	}
 
 	req = (void *) &smp->preq[1];
 
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		keydist = &rsp->init_key_dist;
 		*keydist &= req->init_key_dist;
 	} else {
@@ -1432,7 +1427,7 @@
 	struct hci_conn *hcon = smp->conn->hcon;
 	u8 *na, *nb, a[7], b[7];
 
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		na   = smp->prnd;
 		nb   = smp->rrnd;
 	} else {
@@ -1460,7 +1455,7 @@
 	a[6] = hcon->init_addr_type;
 	b[6] = hcon->resp_addr_type;
 
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		local_addr = a;
 		remote_addr = b;
 		memcpy(io_cap, &smp->preq[1], 3);
@@ -1539,7 +1534,7 @@
 		/* The round is only complete when the initiator
 		 * receives pairing random.
 		 */
-		if (!hcon->out) {
+		if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
 				     sizeof(smp->prnd), smp->prnd);
 			if (smp->passkey_round == 20)
@@ -1567,7 +1562,7 @@
 
 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
 
-		if (hcon->out) {
+		if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
 				     sizeof(smp->prnd), smp->prnd);
 			return 0;
@@ -1578,7 +1573,7 @@
 	case SMP_CMD_PUBLIC_KEY:
 	default:
 		/* Initiating device starts the round */
-		if (!hcon->out)
+		if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 			return 0;
 
 		bt_dev_dbg(hdev, "Starting passkey round %u",
@@ -1623,7 +1618,7 @@
 	}
 
 	/* Initiator sends DHKey check first */
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		sc_dhkey_check(smp);
 		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
 	} else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) {
@@ -1746,7 +1741,7 @@
 	struct smp_cmd_pairing rsp, *req = (void *) skb->data;
 	struct l2cap_chan *chan = conn->smp;
 	struct hci_dev *hdev = conn->hcon->hdev;
-	struct smp_chan *smp;
+	struct smp_chan *smp = chan->data;
 	u8 key_size, auth, sec_level;
 	int ret;
 
@@ -1755,16 +1750,14 @@
 	if (skb->len < sizeof(*req))
 		return SMP_INVALID_PARAMS;
 
-	if (conn->hcon->role != HCI_ROLE_SLAVE)
+	if (smp && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 		return SMP_CMD_NOTSUPP;
 
-	if (!chan->data)
+	if (!smp) {
 		smp = smp_chan_create(conn);
-	else
-		smp = chan->data;
-
-	if (!smp)
-		return SMP_UNSPECIFIED;
+		if (!smp)
+			return SMP_UNSPECIFIED;
+	}
 
 	/* We didn't start the pairing, so match remote */
 	auth = req->auth_req & AUTH_REQ_MASK(hdev);
@@ -1946,7 +1939,7 @@
 	if (skb->len < sizeof(*rsp))
 		return SMP_INVALID_PARAMS;
 
-	if (conn->hcon->role != HCI_ROLE_MASTER)
+	if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 		return SMP_CMD_NOTSUPP;
 
 	skb_pull(skb, sizeof(*rsp));
@@ -2041,7 +2034,7 @@
 	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
 		return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM);
 
-	if (conn->hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
 			     smp->prnd);
 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
@@ -2063,7 +2056,7 @@
 	u8 auth;
 
 	/* The issue is only observed when we're in responder role */
-	if (hcon->out)
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 		return SMP_UNSPECIFIED;
 
 	if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
@@ -2099,7 +2092,8 @@
 	struct hci_dev *hdev = hcon->hdev;
 
 	bt_dev_dbg(hdev, "conn %p %s", conn,
-		   hcon->out ? "initiator" : "responder");
+		   test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" :
+		   "responder");
 
 	if (skb->len < sizeof(smp->pcnf))
 		return SMP_INVALID_PARAMS;
@@ -2121,7 +2115,7 @@
 			return ret;
 	}
 
-	if (conn->hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
 			     smp->prnd);
 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
@@ -2156,7 +2150,7 @@
 	if (!test_bit(SMP_FLAG_SC, &smp->flags))
 		return smp_random(smp);
 
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		pkax = smp->local_pk;
 		pkbx = smp->remote_pk;
 		na   = smp->prnd;
@@ -2169,7 +2163,7 @@
 	}
 
 	if (smp->method == REQ_OOB) {
-		if (!hcon->out)
+		if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
 				     sizeof(smp->prnd), smp->prnd);
 		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
@@ -2180,7 +2174,7 @@
 	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
 		return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM);
 
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		u8 cfm[16];
 
 		err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk,
@@ -2221,7 +2215,7 @@
 		return SMP_UNSPECIFIED;
 
 	if (smp->method == REQ_OOB) {
-		if (hcon->out) {
+		if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 			sc_dhkey_check(smp);
 			SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
 		}
@@ -2295,10 +2289,27 @@
 	return false;
 }
 
+static void smp_send_pairing_req(struct smp_chan *smp, __u8 auth)
+{
+	struct smp_cmd_pairing cp;
+
+	if (smp->conn->hcon->type == ACL_LINK)
+		build_bredr_pairing_cmd(smp, &cp, NULL);
+	else
+		build_pairing_cmd(smp->conn, &cp, NULL, auth);
+
+	smp->preq[0] = SMP_CMD_PAIRING_REQ;
+	memcpy(&smp->preq[1], &cp, sizeof(cp));
+
+	smp_send_cmd(smp->conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
+	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
+
+	set_bit(SMP_FLAG_INITIATOR, &smp->flags);
+}
+
 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 {
 	struct smp_cmd_security_req *rp = (void *) skb->data;
-	struct smp_cmd_pairing cp;
 	struct hci_conn *hcon = conn->hcon;
 	struct hci_dev *hdev = hcon->hdev;
 	struct smp_chan *smp;
@@ -2347,16 +2358,20 @@
 
 	skb_pull(skb, sizeof(*rp));
 
-	memset(&cp, 0, sizeof(cp));
-	build_pairing_cmd(conn, &cp, NULL, auth);
+	smp_send_pairing_req(smp, auth);
 
-	smp->preq[0] = SMP_CMD_PAIRING_REQ;
-	memcpy(&smp->preq[1], &cp, sizeof(cp));
+	return 0;
+}
 
-	smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
-	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
+static void smp_send_security_req(struct smp_chan *smp, __u8 auth)
+{
+	struct smp_cmd_security_req cp;
 
-	return 0;
+	cp.auth_req = auth;
+	smp_send_cmd(smp->conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
+	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
+
+	clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
 }
 
 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
@@ -2427,23 +2442,11 @@
 			authreq |= SMP_AUTH_MITM;
 	}
 
-	if (hcon->role == HCI_ROLE_MASTER) {
-		struct smp_cmd_pairing cp;
-
-		build_pairing_cmd(conn, &cp, NULL, authreq);
-		smp->preq[0] = SMP_CMD_PAIRING_REQ;
-		memcpy(&smp->preq[1], &cp, sizeof(cp));
-
-		smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
-		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
-	} else {
-		struct smp_cmd_security_req cp;
-		cp.auth_req = authreq;
-		smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
-		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
-	}
+	if (hcon->role == HCI_ROLE_MASTER)
+		smp_send_pairing_req(smp, authreq);
+	else
+		smp_send_security_req(smp, authreq);
 
-	set_bit(SMP_FLAG_INITIATOR, &smp->flags);
 	ret = 0;
 
 unlock:
@@ -2694,8 +2697,6 @@
 
 static u8 sc_select_method(struct smp_chan *smp)
 {
-	struct l2cap_conn *conn = smp->conn;
-	struct hci_conn *hcon = conn->hcon;
 	struct smp_cmd_pairing *local, *remote;
 	u8 local_mitm, remote_mitm, local_io, remote_io, method;
 
@@ -2708,7 +2709,7 @@
 	 * the "struct smp_cmd_pairing" from them we need to skip the
 	 * first byte which contains the opcode.
 	 */
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		local = (void *) &smp->preq[1];
 		remote = (void *) &smp->prsp[1];
 	} else {
@@ -2777,7 +2778,7 @@
 	/* Non-initiating device sends its public key after receiving
 	 * the key from the initiating device.
 	 */
-	if (!hcon->out) {
+	if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		err = sc_send_public_key(smp);
 		if (err)
 			return err;
@@ -2839,7 +2840,7 @@
 	}
 
 	if (smp->method == REQ_OOB) {
-		if (hcon->out)
+		if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
 				     sizeof(smp->prnd), smp->prnd);
 
@@ -2848,7 +2849,7 @@
 		return 0;
 	}
 
-	if (hcon->out)
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
 
 	if (smp->method == REQ_PASSKEY) {
@@ -2863,7 +2864,7 @@
 	/* The Initiating device waits for the non-initiating device to
 	 * send the confirm value.
 	 */
-	if (conn->hcon->out)
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 		return 0;
 
 	err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd,
@@ -2897,7 +2898,7 @@
 	a[6] = hcon->init_addr_type;
 	b[6] = hcon->resp_addr_type;
 
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		local_addr = a;
 		remote_addr = b;
 		memcpy(io_cap, &smp->prsp[1], 3);
@@ -2922,7 +2923,7 @@
 	if (crypto_memneq(check->e, e, 16))
 		return SMP_DHKEY_CHECK_FAILED;
 
-	if (!hcon->out) {
+	if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
 			set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags);
 			return 0;
@@ -2934,7 +2935,7 @@
 
 	sc_add_ltk(smp);
 
-	if (hcon->out) {
+	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 		hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size);
 		hcon->enc_key_size = smp->enc_key_size;
 	}
@@ -3083,7 +3084,6 @@
 	struct l2cap_conn *conn = chan->conn;
 	struct hci_conn *hcon = conn->hcon;
 	struct hci_dev *hdev = hcon->hdev;
-	struct smp_cmd_pairing req;
 	struct smp_chan *smp;
 
 	bt_dev_dbg(hdev, "chan %p", chan);
@@ -3135,14 +3135,7 @@
 
 	bt_dev_dbg(hdev, "starting SMP over BR/EDR");
 
-	/* Prepare and send the BR/EDR SMP Pairing Request */
-	build_bredr_pairing_cmd(smp, &req, NULL);
-
-	smp->preq[0] = SMP_CMD_PAIRING_REQ;
-	memcpy(&smp->preq[1], &req, sizeof(req));
-
-	smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(req), &req);
-	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
+	smp_send_pairing_req(smp, 0x00);
 }
 
 static void smp_resume_cb(struct l2cap_chan *chan)
--- linux-qcom-6.8.0.orig/net/bpf/bpf_dummy_struct_ops.c
+++ linux-qcom-6.8.0/net/bpf/bpf_dummy_struct_ops.c
@@ -225,7 +225,7 @@
 {
 }
 
-static int bpf_dummy_test_1(struct bpf_dummy_ops_state *cb)
+static int bpf_dummy_ops__test_1(struct bpf_dummy_ops_state *cb__nullable)
 {
 	return 0;
 }
@@ -242,7 +242,7 @@
 }
 
 static struct bpf_dummy_ops __bpf_bpf_dummy_ops = {
-	.test_1 = bpf_dummy_test_1,
+	.test_1 = bpf_dummy_ops__test_1,
 	.test_2 = bpf_dummy_test_2,
 	.test_sleepable = bpf_dummy_test_sleepable,
 };
--- linux-qcom-6.8.0.orig/net/bpf/test_run.c
+++ linux-qcom-6.8.0/net/bpf/test_run.c
@@ -244,6 +244,7 @@
 	head->ctx.data_meta = head->orig_ctx.data_meta;
 	head->ctx.data_end = head->orig_ctx.data_end;
 	xdp_update_frame_from_buff(&head->ctx, head->frame);
+	head->frame->mem = head->orig_ctx.rxq->mem;
 }
 
 static int xdp_recv_frames(struct xdp_frame **frames, int nframes,
@@ -717,10 +718,16 @@
 __bpf_prog_test_run_raw_tp(void *data)
 {
 	struct bpf_raw_tp_test_run_info *info = data;
+	struct bpf_trace_run_ctx run_ctx = {};
+	struct bpf_run_ctx *old_run_ctx;
+
+	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
 
 	rcu_read_lock();
 	info->retval = bpf_prog_run(info->prog, info->ctx);
 	rcu_read_unlock();
+
+	bpf_reset_run_ctx(old_run_ctx);
 }
 
 int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,
--- linux-qcom-6.8.0.orig/net/bridge/br_device.c
+++ linux-qcom-6.8.0/net/bridge/br_device.c
@@ -27,6 +27,7 @@
 /* net device transmit always called with BH disabled */
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
+	enum skb_drop_reason reason = pskb_may_pull_reason(skb, ETH_HLEN);
 	struct net_bridge_mcast_port *pmctx_null = NULL;
 	struct net_bridge *br = netdev_priv(dev);
 	struct net_bridge_mcast *brmctx = &br->multicast_ctx;
@@ -38,6 +39,11 @@
 	const unsigned char *dest;
 	u16 vid = 0;
 
+	if (unlikely(reason != SKB_NOT_DROPPED_YET)) {
+		kfree_skb_reason(skb, reason);
+		return NETDEV_TX_OK;
+	}
+
 	memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
 	br_tc_skb_miss_set(skb, false);
 
--- linux-qcom-6.8.0.orig/net/bridge/br_fdb.c
+++ linux-qcom-6.8.0/net/bridge/br_fdb.c
@@ -1472,12 +1472,10 @@
 			modified = true;
 		}
 
-		if (test_bit(BR_FDB_ADDED_BY_EXT_LEARN, &fdb->flags)) {
+		if (test_and_set_bit(BR_FDB_ADDED_BY_EXT_LEARN, &fdb->flags)) {
 			/* Refresh entry */
 			fdb->used = jiffies;
-		} else if (!test_bit(BR_FDB_ADDED_BY_USER, &fdb->flags)) {
-			/* Take over SW learned entry */
-			set_bit(BR_FDB_ADDED_BY_EXT_LEARN, &fdb->flags);
+		} else {
 			modified = true;
 		}
 
--- linux-qcom-6.8.0.orig/net/bridge/br_forward.c
+++ linux-qcom-6.8.0/net/bridge/br_forward.c
@@ -25,8 +25,8 @@
 
 	vg = nbp_vlan_group_rcu(p);
 	return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
-		p->state == BR_STATE_FORWARDING && br_allowed_egress(vg, skb) &&
-		nbp_switchdev_allowed_egress(p, skb) &&
+		(br_mst_is_enabled(p->br) || p->state == BR_STATE_FORWARDING) &&
+		br_allowed_egress(vg, skb) && nbp_switchdev_allowed_egress(p, skb) &&
 		!br_skb_isolated(p, skb);
 }
 
@@ -258,6 +258,7 @@
 {
 	struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
 	const unsigned char *src = eth_hdr(skb)->h_source;
+	struct sk_buff *nskb;
 
 	if (!should_deliver(p, skb))
 		return;
@@ -266,12 +267,16 @@
 	if (skb->dev == p->dev && ether_addr_equal(src, addr))
 		return;
 
-	skb = skb_copy(skb, GFP_ATOMIC);
-	if (!skb) {
+	__skb_push(skb, ETH_HLEN);
+	nskb = pskb_copy(skb, GFP_ATOMIC);
+	__skb_pull(skb, ETH_HLEN);
+	if (!nskb) {
 		DEV_STATS_INC(dev, tx_dropped);
 		return;
 	}
 
+	skb = nskb;
+	__skb_pull(skb, ETH_HLEN);
 	if (!is_broadcast_ether_addr(addr))
 		memcpy(eth_hdr(skb)->h_dest, addr, ETH_ALEN);
 
--- linux-qcom-6.8.0.orig/net/bridge/br_input.c
+++ linux-qcom-6.8.0/net/bridge/br_input.c
@@ -30,7 +30,7 @@
 	return netif_receive_skb(skb);
 }
 
-static int br_pass_frame_up(struct sk_buff *skb)
+static int br_pass_frame_up(struct sk_buff *skb, bool promisc)
 {
 	struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
 	struct net_bridge *br = netdev_priv(brdev);
@@ -65,6 +65,8 @@
 	br_multicast_count(br, NULL, skb, br_multicast_igmp_type(skb),
 			   BR_MCAST_DIR_TX);
 
+	BR_INPUT_SKB_CB(skb)->promisc = promisc;
+
 	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
 		       dev_net(indev), NULL, skb, indev, NULL,
 		       br_netif_receive_skb);
@@ -82,6 +84,7 @@
 	struct net_bridge_mcast *brmctx;
 	struct net_bridge_vlan *vlan;
 	struct net_bridge *br;
+	bool promisc;
 	u16 vid = 0;
 	u8 state;
 
@@ -137,7 +140,9 @@
 	if (p->flags & BR_LEARNING)
 		br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, 0);
 
-	local_rcv = !!(br->dev->flags & IFF_PROMISC);
+	promisc = !!(br->dev->flags & IFF_PROMISC);
+	local_rcv = promisc;
+
 	if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) {
 		/* by definition the broadcast is also a multicast address */
 		if (is_broadcast_ether_addr(eth_hdr(skb)->h_dest)) {
@@ -200,7 +205,7 @@
 		unsigned long now = jiffies;
 
 		if (test_bit(BR_FDB_LOCAL, &dst->flags))
-			return br_pass_frame_up(skb);
+			return br_pass_frame_up(skb, false);
 
 		if (now != dst->used)
 			dst->used = now;
@@ -213,7 +218,7 @@
 	}
 
 	if (local_rcv)
-		return br_pass_frame_up(skb);
+		return br_pass_frame_up(skb, promisc);
 
 out:
 	return 0;
@@ -386,6 +391,8 @@
 				goto forward;
 		}
 
+		BR_INPUT_SKB_CB(skb)->promisc = false;
+
 		/* The else clause should be hit when nf_hook():
 		 *   - returns < 0 (drop/error)
 		 *   - returns = 0 (stolen/nf_queue)
--- linux-qcom-6.8.0.orig/net/bridge/br_mdb.c
+++ linux-qcom-6.8.0/net/bridge/br_mdb.c
@@ -1674,7 +1674,7 @@
 	spin_lock_bh(&br->multicast_lock);
 
 	mp = br_mdb_ip_get(br, &group);
-	if (!mp) {
+	if (!mp || (!mp->ports && !mp->host_joined)) {
 		NL_SET_ERR_MSG_MOD(extack, "MDB entry not found");
 		err = -ENOENT;
 		goto unlock;
--- linux-qcom-6.8.0.orig/net/bridge/br_mst.c
+++ linux-qcom-6.8.0/net/bridge/br_mst.c
@@ -73,12 +73,11 @@
 }
 EXPORT_SYMBOL_GPL(br_mst_get_state);
 
-static void br_mst_vlan_set_state(struct net_bridge_port *p, struct net_bridge_vlan *v,
+static void br_mst_vlan_set_state(struct net_bridge_vlan_group *vg,
+				  struct net_bridge_vlan *v,
 				  u8 state)
 {
-	struct net_bridge_vlan_group *vg = nbp_vlan_group(p);
-
-	if (v->state == state)
+	if (br_vlan_get_state(v) == state)
 		return;
 
 	br_vlan_set_state(v, state);
@@ -100,11 +99,12 @@
 	};
 	struct net_bridge_vlan_group *vg;
 	struct net_bridge_vlan *v;
-	int err;
+	int err = 0;
 
-	vg = nbp_vlan_group(p);
+	rcu_read_lock();
+	vg = nbp_vlan_group_rcu(p);
 	if (!vg)
-		return 0;
+		goto out;
 
 	/* MSTI 0 (CST) state changes are notified via the regular
 	 * SWITCHDEV_ATTR_ID_PORT_STP_STATE.
@@ -112,17 +112,20 @@
 	if (msti) {
 		err = switchdev_port_attr_set(p->dev, &attr, extack);
 		if (err && err != -EOPNOTSUPP)
-			return err;
+			goto out;
 	}
 
-	list_for_each_entry(v, &vg->vlan_list, vlist) {
+	err = 0;
+	list_for_each_entry_rcu(v, &vg->vlan_list, vlist) {
 		if (v->brvlan->msti != msti)
 			continue;
 
-		br_mst_vlan_set_state(p, v, state);
+		br_mst_vlan_set_state(vg, v, state);
 	}
 
-	return 0;
+out:
+	rcu_read_unlock();
+	return err;
 }
 
 static void br_mst_vlan_sync_state(struct net_bridge_vlan *pv, u16 msti)
@@ -136,13 +139,13 @@
 		 * it.
 		 */
 		if (v != pv && v->brvlan->msti == msti) {
-			br_mst_vlan_set_state(pv->port, pv, v->state);
+			br_mst_vlan_set_state(vg, pv, v->state);
 			return;
 		}
 	}
 
 	/* Otherwise, start out in a new MSTI with all ports disabled. */
-	return br_mst_vlan_set_state(pv->port, pv, BR_STATE_DISABLED);
+	return br_mst_vlan_set_state(vg, pv, BR_STATE_DISABLED);
 }
 
 int br_mst_vlan_set_msti(struct net_bridge_vlan *mv, u16 msti)
--- linux-qcom-6.8.0.orig/net/bridge/br_multicast.c
+++ linux-qcom-6.8.0/net/bridge/br_multicast.c
@@ -2045,16 +2045,14 @@
 {
 	struct net_bridge *br = port->br;
 	struct net_bridge_port_group *pg;
-	HLIST_HEAD(deleted_head);
 	struct hlist_node *n;
 
 	/* Take care of the remaining groups, only perm ones should be left */
 	spin_lock_bh(&br->multicast_lock);
 	hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
 		br_multicast_find_del_pg(br, pg);
-	hlist_move_list(&br->mcast_gc_list, &deleted_head);
 	spin_unlock_bh(&br->multicast_lock);
-	br_multicast_gc(&deleted_head);
+	flush_work(&br->mcast_gc_work);
 	br_multicast_port_ctx_deinit(&port->multicast_ctx);
 	free_percpu(port->mcast_stats);
 }
--- linux-qcom-6.8.0.orig/net/bridge/br_netfilter_hooks.c
+++ linux-qcom-6.8.0/net/bridge/br_netfilter_hooks.c
@@ -33,6 +33,7 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/addrconf.h>
+#include <net/dst_metadata.h>
 #include <net/route.h>
 #include <net/netfilter/br_netfilter.h>
 #include <net/netns/generic.h>
@@ -600,11 +601,17 @@
 				   struct sk_buff *skb,
 				   const struct nf_hook_state *state)
 {
+	bool promisc = BR_INPUT_SKB_CB(skb)->promisc;
 	struct nf_conntrack *nfct = skb_nfct(skb);
 	const struct nf_ct_hook *ct_hook;
 	struct nf_conn *ct;
 	int ret;
 
+	if (promisc) {
+		nf_reset_ct(skb);
+		return NF_ACCEPT;
+	}
+
 	if (!nfct || skb->pkt_type == PACKET_HOST)
 		return NF_ACCEPT;
 
@@ -612,8 +619,12 @@
 	if (likely(nf_ct_is_confirmed(ct)))
 		return NF_ACCEPT;
 
+	if (WARN_ON_ONCE(refcount_read(&nfct->use) != 1)) {
+		nf_reset_ct(skb);
+		return NF_ACCEPT;
+	}
+
 	WARN_ON_ONCE(skb_shared(skb));
-	WARN_ON_ONCE(refcount_read(&nfct->use) != 1);
 
 	/* We can't call nf_confirm here, it would create a dependency
 	 * on nf_conntrack module.
@@ -863,6 +874,10 @@
 		return br_dev_queue_push_xmit(net, sk, skb);
 	}
 
+	/* Fragmentation on metadata/template dst is not supported */
+	if (unlikely(!skb_valid_dst(skb)))
+		goto drop;
+
 	/* This is wrong! We should preserve the original fragment
 	 * boundaries by preserving frag_list rather than refragmenting.
 	 */
--- linux-qcom-6.8.0.orig/net/bridge/br_netlink.c
+++ linux-qcom-6.8.0/net/bridge/br_netlink.c
@@ -455,7 +455,8 @@
 			  u32 filter_mask, const struct net_device *dev,
 			  bool getlink)
 {
-	u8 operstate = netif_running(dev) ? dev->operstate : IF_OPER_DOWN;
+	u8 operstate = netif_running(dev) ? READ_ONCE(dev->operstate) :
+					    IF_OPER_DOWN;
 	struct nlattr *af = NULL;
 	struct net_bridge *br;
 	struct ifinfomsg *hdr;
@@ -666,7 +667,7 @@
 {
 	u32 filter = RTEXT_FILTER_BRVLAN_COMPRESSED;
 
-	return br_info_notify(event, br, port, filter);
+	br_info_notify(event, br, port, filter);
 }
 
 /*
@@ -1919,7 +1920,10 @@
 {
 	int err;
 
-	br_vlan_rtnl_init();
+	err = br_vlan_rtnl_init();
+	if (err)
+		goto out;
+
 	rtnl_af_register(&br_af_ops);
 
 	err = rtnl_link_register(&br_link_ops);
@@ -1930,6 +1934,7 @@
 
 out_af:
 	rtnl_af_unregister(&br_af_ops);
+out:
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/net/bridge/br_private.h
+++ linux-qcom-6.8.0/net/bridge/br_private.h
@@ -589,6 +589,7 @@
 #endif
 	u8 proxyarp_replied:1;
 	u8 src_port_isolated:1;
+	u8 promisc:1;
 #ifdef CONFIG_BRIDGE_VLAN_FILTERING
 	u8 vlan_filtered:1;
 #endif
@@ -1570,7 +1571,7 @@
 void br_vlan_port_event(struct net_bridge_port *p, unsigned long event);
 int br_vlan_bridge_event(struct net_device *dev, unsigned long event,
 			 void *ptr);
-void br_vlan_rtnl_init(void);
+int br_vlan_rtnl_init(void);
 void br_vlan_rtnl_uninit(void);
 void br_vlan_notify(const struct net_bridge *br,
 		    const struct net_bridge_port *p,
@@ -1801,8 +1802,9 @@
 	return 0;
 }
 
-static inline void br_vlan_rtnl_init(void)
+static inline int br_vlan_rtnl_init(void)
 {
+	return 0;
 }
 
 static inline void br_vlan_rtnl_uninit(void)
--- linux-qcom-6.8.0.orig/net/bridge/br_vlan.c
+++ linux-qcom-6.8.0/net/bridge/br_vlan.c
@@ -2296,19 +2296,18 @@
 	return err;
 }
 
-void br_vlan_rtnl_init(void)
+static const struct rtnl_msg_handler br_vlan_rtnl_msg_handlers[] = {
+	{THIS_MODULE, PF_BRIDGE, RTM_NEWVLAN, br_vlan_rtm_process, NULL, 0},
+	{THIS_MODULE, PF_BRIDGE, RTM_DELVLAN, br_vlan_rtm_process, NULL, 0},
+	{THIS_MODULE, PF_BRIDGE, RTM_GETVLAN, NULL, br_vlan_rtm_dump, 0},
+};
+
+int br_vlan_rtnl_init(void)
 {
-	rtnl_register_module(THIS_MODULE, PF_BRIDGE, RTM_GETVLAN, NULL,
-			     br_vlan_rtm_dump, 0);
-	rtnl_register_module(THIS_MODULE, PF_BRIDGE, RTM_NEWVLAN,
-			     br_vlan_rtm_process, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_BRIDGE, RTM_DELVLAN,
-			     br_vlan_rtm_process, NULL, 0);
+	return rtnl_register_many(br_vlan_rtnl_msg_handlers);
 }
 
 void br_vlan_rtnl_uninit(void)
 {
-	rtnl_unregister(PF_BRIDGE, RTM_GETVLAN);
-	rtnl_unregister(PF_BRIDGE, RTM_NEWVLAN);
-	rtnl_unregister(PF_BRIDGE, RTM_DELVLAN);
+	rtnl_unregister_many(br_vlan_rtnl_msg_handlers);
 }
--- linux-qcom-6.8.0.orig/net/bridge/netfilter/ebtables.c
+++ linux-qcom-6.8.0/net/bridge/netfilter/ebtables.c
@@ -1111,6 +1111,8 @@
 	struct ebt_table_info *newinfo;
 	struct ebt_replace tmp;
 
+	if (len < sizeof(tmp))
+		return -EINVAL;
 	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
 		return -EFAULT;
 
@@ -1423,6 +1425,8 @@
 {
 	struct ebt_replace hlp;
 
+	if (len < sizeof(hlp))
+		return -EINVAL;
 	if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
 		return -EFAULT;
 
@@ -2352,6 +2356,8 @@
 {
 	struct compat_ebt_replace hlp;
 
+	if (len < sizeof(hlp))
+		return -EINVAL;
 	if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
 		return -EFAULT;
 
--- linux-qcom-6.8.0.orig/net/bridge/netfilter/nf_conntrack_bridge.c
+++ linux-qcom-6.8.0/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -32,7 +32,7 @@
 					   struct sk_buff *))
 {
 	int frag_max_size = BR_INPUT_SKB_CB(skb)->frag_max_size;
-	bool mono_delivery_time = skb->mono_delivery_time;
+	u8 tstamp_type = skb->tstamp_type;
 	unsigned int hlen, ll_rs, mtu;
 	ktime_t tstamp = skb->tstamp;
 	struct ip_frag_state state;
@@ -82,7 +82,7 @@
 			if (iter.frag)
 				ip_fraglist_prepare(skb, &iter);
 
-			skb_set_delivery_time(skb, tstamp, mono_delivery_time);
+			skb_set_delivery_time(skb, tstamp, tstamp_type);
 			err = output(net, sk, data, skb);
 			if (err || !iter.frag)
 				break;
@@ -113,7 +113,7 @@
 			goto blackhole;
 		}
 
-		skb_set_delivery_time(skb2, tstamp, mono_delivery_time);
+		skb_set_delivery_time(skb2, tstamp, tstamp_type);
 		err = output(net, sk, data, skb2);
 		if (err)
 			goto blackhole;
@@ -294,18 +294,24 @@
 static unsigned int nf_ct_bridge_in(void *priv, struct sk_buff *skb,
 				    const struct nf_hook_state *state)
 {
-	enum ip_conntrack_info ctinfo;
+	bool promisc = BR_INPUT_SKB_CB(skb)->promisc;
+	struct nf_conntrack *nfct = skb_nfct(skb);
 	struct nf_conn *ct;
 
-	if (skb->pkt_type == PACKET_HOST)
+	if (promisc) {
+		nf_reset_ct(skb);
+		return NF_ACCEPT;
+	}
+
+	if (!nfct || skb->pkt_type == PACKET_HOST)
 		return NF_ACCEPT;
 
 	/* nf_conntrack_confirm() cannot handle concurrent clones,
 	 * this happens for broad/multicast frames with e.g. macvlan on top
 	 * of the bridge device.
 	 */
-	ct = nf_ct_get(skb, &ctinfo);
-	if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct))
+	ct = container_of(nfct, struct nf_conn, ct_general);
+	if (nf_ct_is_confirmed(ct) || nf_ct_is_template(ct))
 		return NF_ACCEPT;
 
 	/* let inet prerouting call conntrack again */
--- linux-qcom-6.8.0.orig/net/can/af_can.c
+++ linux-qcom-6.8.0/net/can/af_can.c
@@ -171,6 +171,7 @@
 		/* release sk on errors */
 		sock_orphan(sk);
 		sock_put(sk);
+		sock->sk = NULL;
 	}
 
  errout:
--- linux-qcom-6.8.0.orig/net/can/bcm.c
+++ linux-qcom-6.8.0/net/can/bcm.c
@@ -1428,6 +1428,12 @@
 
 		/* remove device reference, if this is our bound device */
 		if (bo->bound && bo->ifindex == dev->ifindex) {
+#if IS_ENABLED(CONFIG_PROC_FS)
+			if (sock_net(sk)->can.bcmproc_dir && bo->bcm_proc_read) {
+				remove_proc_entry(bo->procname, sock_net(sk)->can.bcmproc_dir);
+				bo->bcm_proc_read = NULL;
+			}
+#endif
 			bo->bound   = 0;
 			bo->ifindex = 0;
 			notify_enodev = 1;
--- linux-qcom-6.8.0.orig/net/can/j1939/main.c
+++ linux-qcom-6.8.0/net/can/j1939/main.c
@@ -30,10 +30,6 @@
 /* CAN_HDR: #bytes before can_frame data part */
 #define J1939_CAN_HDR (offsetof(struct can_frame, data))
 
-/* CAN_FTR: #bytes beyond data part */
-#define J1939_CAN_FTR (sizeof(struct can_frame) - J1939_CAN_HDR - \
-		 sizeof(((struct can_frame *)0)->data))
-
 /* lowest layer */
 static void j1939_can_recv(struct sk_buff *iskb, void *data)
 {
@@ -342,7 +338,7 @@
 	memset(cf, 0, J1939_CAN_HDR);
 
 	/* make it a full can frame again */
-	skb_put(skb, J1939_CAN_FTR + (8 - dlc));
+	skb_put_zero(skb, 8 - dlc);
 
 	canid = CAN_EFF_FLAG |
 		(skcb->priority << 26) |
--- linux-qcom-6.8.0.orig/net/can/j1939/transport.c
+++ linux-qcom-6.8.0/net/can/j1939/transport.c
@@ -1179,10 +1179,10 @@
 		break;
 	case -ENETDOWN:
 		/* In this case we should get a netdev_event(), all active
-		 * sessions will be cleared by
-		 * j1939_cancel_all_active_sessions(). So handle this as an
-		 * error, but let j1939_cancel_all_active_sessions() do the
-		 * cleanup including propagation of the error to user space.
+		 * sessions will be cleared by j1939_cancel_active_session().
+		 * So handle this as an error, but let
+		 * j1939_cancel_active_session() do the cleanup including
+		 * propagation of the error to user space.
 		 */
 		break;
 	case -EOVERFLOW:
@@ -1505,7 +1505,7 @@
 	session->state = J1939_SESSION_NEW;
 
 	skb_queue_head_init(&session->skb_queue);
-	skb_queue_tail(&session->skb_queue, skb);
+	skb_queue_tail(&session->skb_queue, skb_get(skb));
 
 	skcb = j1939_skb_to_cb(skb);
 	memcpy(&session->skcb, skcb, sizeof(session->skcb));
@@ -1593,8 +1593,8 @@
 	struct j1939_sk_buff_cb skcb = *j1939_skb_to_cb(skb);
 	struct j1939_session *session;
 	const u8 *dat;
+	int len, ret;
 	pgn_t pgn;
-	int len;
 
 	netdev_dbg(priv->ndev, "%s\n", __func__);
 
@@ -1653,7 +1653,22 @@
 	session->tskey = priv->rx_tskey++;
 	j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_RTS);
 
-	WARN_ON_ONCE(j1939_session_activate(session));
+	ret = j1939_session_activate(session);
+	if (ret) {
+		/* Entering this scope indicates an issue with the J1939 bus.
+		 * Possible scenarios include:
+		 * - A time lapse occurred, and a new session was initiated
+		 *   due to another packet being sent correctly. This could
+		 *   have been caused by too long interrupt, debugger, or being
+		 *   out-scheduled by another task.
+		 * - The bus is receiving numerous erroneous packets, either
+		 *   from a malfunctioning device or during a test scenario.
+		 */
+		netdev_alert(priv->ndev, "%s: 0x%p: concurrent session with same addr (%02x %02x) is already active.\n",
+			     __func__, session, skcb.addr.sa, skcb.addr.da);
+		j1939_session_put(session);
+		return NULL;
+	}
 
 	return session;
 }
@@ -1681,6 +1696,8 @@
 
 		j1939_session_timers_cancel(session);
 		j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
+		if (session->transmission)
+			j1939_session_deactivate_activate_next(session);
 
 		return -EBUSY;
 	}
--- linux-qcom-6.8.0.orig/net/ceph/mon_client.c
+++ linux-qcom-6.8.0/net/ceph/mon_client.c
@@ -1085,13 +1085,19 @@
 	struct ceph_mon_client *monc =
 		container_of(work, struct ceph_mon_client, delayed_work.work);
 
-	dout("monc delayed_work\n");
 	mutex_lock(&monc->mutex);
+	dout("%s mon%d\n", __func__, monc->cur_mon);
+	if (monc->cur_mon < 0) {
+		goto out;
+	}
+
 	if (monc->hunting) {
 		dout("%s continuing hunt\n", __func__);
 		reopen_session(monc);
 	} else {
 		int is_auth = ceph_auth_is_authenticated(monc->auth);
+
+		dout("%s is_authed %d\n", __func__, is_auth);
 		if (ceph_con_keepalive_expired(&monc->con,
 					       CEPH_MONC_PING_TIMEOUT)) {
 			dout("monc keepalive timeout\n");
@@ -1116,6 +1122,8 @@
 		}
 	}
 	__schedule_delayed(monc);
+
+out:
 	mutex_unlock(&monc->mutex);
 }
 
@@ -1232,13 +1240,15 @@
 void ceph_monc_stop(struct ceph_mon_client *monc)
 {
 	dout("stop\n");
-	cancel_delayed_work_sync(&monc->delayed_work);
 
 	mutex_lock(&monc->mutex);
 	__close_session(monc);
+	monc->hunting = false;
 	monc->cur_mon = -1;
 	mutex_unlock(&monc->mutex);
 
+	cancel_delayed_work_sync(&monc->delayed_work);
+
 	/*
 	 * flush msgr queue before we destroy ourselves to ensure that:
 	 *  - any work that references our embedded con is finished.
--- linux-qcom-6.8.0.orig/net/ceph/osd_client.c
+++ linux-qcom-6.8.0/net/ceph/osd_client.c
@@ -1173,6 +1173,8 @@
 
 int __ceph_alloc_sparse_ext_map(struct ceph_osd_req_op *op, int cnt)
 {
+	WARN_ON(op->op != CEPH_OSD_OP_SPARSE_READ);
+
 	op->extent.sparse_ext_cnt = cnt;
 	op->extent.sparse_ext = kmalloc_array(cnt,
 					      sizeof(*op->extent.sparse_ext),
--- linux-qcom-6.8.0.orig/net/core/datagram.c
+++ linux-qcom-6.8.0/net/core/datagram.c
@@ -435,15 +435,23 @@
 
 		end = start + skb_frag_size(frag);
 		if ((copy = end - offset) > 0) {
-			struct page *page = skb_frag_page(frag);
-			u8 *vaddr = kmap(page);
+			u32 p_off, p_len, copied;
+			struct page *p;
+			u8 *vaddr;
 
 			if (copy > len)
 				copy = len;
-			n = INDIRECT_CALL_1(cb, simple_copy_to_iter,
-					vaddr + skb_frag_off(frag) + offset - start,
-					copy, data, to);
-			kunmap(page);
+
+			n = 0;
+			skb_frag_foreach_page(frag,
+					      skb_frag_off(frag) + offset - start,
+					      copy, p, p_off, p_len, copied) {
+				vaddr = kmap_local_page(p);
+				n += INDIRECT_CALL_1(cb, simple_copy_to_iter,
+					vaddr + p_off, p_len, data, to);
+				kunmap_local(vaddr);
+			}
+
 			offset += n;
 			if (n != copy)
 				goto short_copy;
--- linux-qcom-6.8.0.orig/net/core/dev.c
+++ linux-qcom-6.8.0/net/core/dev.c
@@ -733,6 +733,36 @@
 }
 EXPORT_SYMBOL_GPL(dev_fill_forward_path);
 
+/* must be called under rcu_read_lock(), as we dont take a reference */
+static struct napi_struct *napi_by_id(unsigned int napi_id)
+{
+	unsigned int hash = napi_id % HASH_SIZE(napi_hash);
+	struct napi_struct *napi;
+
+	hlist_for_each_entry_rcu(napi, &napi_hash[hash], napi_hash_node)
+		if (napi->napi_id == napi_id)
+			return napi;
+
+	return NULL;
+}
+
+/* must be called under rcu_read_lock(), as we dont take a reference */
+struct napi_struct *netdev_napi_by_id(struct net *net, unsigned int napi_id)
+{
+	struct napi_struct *napi;
+
+	napi = napi_by_id(napi_id);
+	if (!napi)
+		return NULL;
+
+	if (WARN_ON_ONCE(!napi->dev))
+		return NULL;
+	if (!net_eq(net, dev_net(napi->dev)))
+		return NULL;
+
+	return napi;
+}
+
 /**
  *	__dev_get_by_name	- find a device by its name
  *	@net: the applicable net namespace
@@ -2129,7 +2159,7 @@
 static inline void net_timestamp_set(struct sk_buff *skb)
 {
 	skb->tstamp = 0;
-	skb->mono_delivery_time = 0;
+	skb->tstamp_type = SKB_CLOCK_REALTIME;
 	if (static_branch_unlikely(&netstamp_needed_key))
 		skb->tstamp = ktime_get_real();
 }
@@ -2261,7 +2291,7 @@
 	rcu_read_lock();
 again:
 	list_for_each_entry_rcu(ptype, ptype_list, list) {
-		if (ptype->ignore_outgoing)
+		if (READ_ONCE(ptype->ignore_outgoing))
 			continue;
 
 		/* Never send packets back to the socket
@@ -3471,7 +3501,7 @@
 	if (gso_segs > READ_ONCE(dev->gso_max_segs))
 		return features & ~NETIF_F_GSO_MASK;
 
-	if (unlikely(skb->len >= READ_ONCE(dev->gso_max_size)))
+	if (unlikely(skb->len >= netif_get_gso_max_size(dev, skb)))
 		return features & ~NETIF_F_GSO_MASK;
 
 	if (!skb_shinfo(skb)->gso_type) {
@@ -3598,6 +3628,11 @@
 		return 0;
 
 	if (features & (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM)) {
+		if (vlan_get_protocol(skb) == htons(ETH_P_IPV6) &&
+		    skb_network_header_len(skb) != sizeof(struct ipv6hdr) &&
+		    !ipv6_has_hopopt_jumbo(skb))
+			goto sw_checksum;
+
 		switch (skb->csum_offset) {
 		case offsetof(struct tcphdr, check):
 		case offsetof(struct udphdr, check):
@@ -3605,6 +3640,7 @@
 		}
 	}
 
+sw_checksum:
 	return skb_checksum_help(skb);
 }
 EXPORT_SYMBOL(skb_csum_hwoffload_help);
@@ -3717,7 +3753,7 @@
 						sizeof(_tcphdr), &_tcphdr);
 			if (likely(th))
 				hdr_len += __tcp_hdrlen(th);
-		} else {
+		} else if (shinfo->gso_type & SKB_GSO_UDP_L4) {
 			struct udphdr _udphdr;
 
 			if (skb_header_pointer(skb, hdr_len,
@@ -3725,10 +3761,14 @@
 				hdr_len += sizeof(struct udphdr);
 		}
 
-		if (shinfo->gso_type & SKB_GSO_DODGY)
-			gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
-						shinfo->gso_size);
+		if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) {
+			int payload = skb->len - hdr_len;
 
+			/* Malicious packet. */
+			if (payload <= 0)
+				return;
+			gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size);
+		}
 		qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len;
 	}
 }
@@ -3791,6 +3831,10 @@
 		return rc;
 	}
 
+	if (unlikely(READ_ONCE(q->owner) == smp_processor_id())) {
+		kfree_skb_reason(skb, SKB_DROP_REASON_TC_RECLASSIFY_LOOP);
+		return NET_XMIT_DROP;
+	}
 	/*
 	 * Heuristic to force contended enqueues to serialize on a
 	 * separate lock before trying to get qdisc main lock.
@@ -3830,7 +3874,9 @@
 		qdisc_run_end(q);
 		rc = NET_XMIT_SUCCESS;
 	} else {
+		WRITE_ONCE(q->owner, smp_processor_id());
 		rc = dev_qdisc_enqueue(skb, q, &to_free, txq);
+		WRITE_ONCE(q->owner, -1);
 		if (qdisc_run_begin(q)) {
 			if (unlikely(contended)) {
 				spin_unlock(&q->busylock);
@@ -6143,19 +6189,6 @@
 }
 EXPORT_SYMBOL(napi_complete_done);
 
-/* must be called under rcu_read_lock(), as we dont take a reference */
-struct napi_struct *napi_by_id(unsigned int napi_id)
-{
-	unsigned int hash = napi_id % HASH_SIZE(napi_hash);
-	struct napi_struct *napi;
-
-	hlist_for_each_entry_rcu(napi, &napi_hash[hash], napi_hash_node)
-		if (napi->napi_id == napi_id)
-			return napi;
-
-	return NULL;
-}
-
 #if defined(CONFIG_NET_RX_BUSY_POLL)
 
 static void __busy_poll_stop(struct napi_struct *napi, bool skip_schedule)
@@ -6708,6 +6741,8 @@
 	void *have;
 
 	while (!napi_thread_wait(napi)) {
+		unsigned long last_qs = jiffies;
+
 		for (;;) {
 			bool repoll = false;
 
@@ -6732,6 +6767,7 @@
 			if (!repoll)
 				break;
 
+			rcu_softirq_qs_periodic(last_qs);
 			cond_resched();
 		}
 	}
@@ -10446,8 +10482,9 @@
 			rebroadcast_time = jiffies;
 		}
 
+		rcu_barrier();
+
 		if (!wait) {
-			rcu_barrier();
 			wait = WAIT_REFS_MIN_MSECS;
 		} else {
 			msleep(wait);
@@ -11631,11 +11668,12 @@
 
 	/* TXRX read-mostly hotpath */
 	CACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_txrx, lstats);
+	CACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_txrx, state);
 	CACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_txrx, flags);
 	CACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_txrx, hard_header_len);
 	CACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_txrx, features);
 	CACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_txrx, ip6_ptr);
-	CACHELINE_ASSERT_GROUP_SIZE(struct net_device, net_device_read_txrx, 38);
+	CACHELINE_ASSERT_GROUP_SIZE(struct net_device, net_device_read_txrx, 46);
 
 	/* RX read-mostly hotpath */
 	CACHELINE_ASSERT_GROUP_MEMBER(struct net_device, net_device_read_rx, ptype_specific);
--- linux-qcom-6.8.0.orig/net/core/dev.h
+++ linux-qcom-6.8.0/net/core/dev.h
@@ -23,6 +23,8 @@
 
 extern int netdev_flow_limit_table_len;
 
+struct napi_struct *netdev_napi_by_id(struct net *net, unsigned int napi_id);
+
 #ifdef CONFIG_PROC_FS
 int __init dev_proc_init(void);
 #else
@@ -148,5 +150,4 @@
 static inline void xdp_do_check_flushed(struct napi_struct *napi) { }
 #endif
 
-struct napi_struct *napi_by_id(unsigned int napi_id);
 #endif
--- linux-qcom-6.8.0.orig/net/core/drop_monitor.c
+++ linux-qcom-6.8.0/net/core/drop_monitor.c
@@ -74,7 +74,7 @@
 };
 
 struct per_cpu_dm_data {
-	spinlock_t		lock;	/* Protects 'skb', 'hw_entries' and
+	raw_spinlock_t		lock;	/* Protects 'skb', 'hw_entries' and
 					 * 'send_timer'
 					 */
 	union {
@@ -168,9 +168,9 @@
 err:
 	mod_timer(&data->send_timer, jiffies + HZ / 10);
 out:
-	spin_lock_irqsave(&data->lock, flags);
+	raw_spin_lock_irqsave(&data->lock, flags);
 	swap(data->skb, skb);
-	spin_unlock_irqrestore(&data->lock, flags);
+	raw_spin_unlock_irqrestore(&data->lock, flags);
 
 	if (skb) {
 		struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data;
@@ -225,7 +225,7 @@
 
 	local_irq_save(flags);
 	data = this_cpu_ptr(&dm_cpu_data);
-	spin_lock(&data->lock);
+	raw_spin_lock(&data->lock);
 	dskb = data->skb;
 
 	if (!dskb)
@@ -259,7 +259,7 @@
 	}
 
 out:
-	spin_unlock_irqrestore(&data->lock, flags);
+	raw_spin_unlock_irqrestore(&data->lock, flags);
 }
 
 static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb,
@@ -314,9 +314,9 @@
 		mod_timer(&hw_data->send_timer, jiffies + HZ / 10);
 	}
 
-	spin_lock_irqsave(&hw_data->lock, flags);
+	raw_spin_lock_irqsave(&hw_data->lock, flags);
 	swap(hw_data->hw_entries, hw_entries);
-	spin_unlock_irqrestore(&hw_data->lock, flags);
+	raw_spin_unlock_irqrestore(&hw_data->lock, flags);
 
 	return hw_entries;
 }
@@ -448,7 +448,7 @@
 		return;
 
 	hw_data = this_cpu_ptr(&dm_hw_cpu_data);
-	spin_lock_irqsave(&hw_data->lock, flags);
+	raw_spin_lock_irqsave(&hw_data->lock, flags);
 	hw_entries = hw_data->hw_entries;
 
 	if (!hw_entries)
@@ -477,7 +477,7 @@
 	}
 
 out:
-	spin_unlock_irqrestore(&hw_data->lock, flags);
+	raw_spin_unlock_irqrestore(&hw_data->lock, flags);
 }
 
 static const struct net_dm_alert_ops net_dm_alert_summary_ops = {
@@ -1673,7 +1673,7 @@
 
 static void __net_dm_cpu_data_init(struct per_cpu_dm_data *data)
 {
-	spin_lock_init(&data->lock);
+	raw_spin_lock_init(&data->lock);
 	skb_queue_head_init(&data->drop_queue);
 	u64_stats_init(&data->stats.syncp);
 }
--- linux-qcom-6.8.0.orig/net/core/dst.c
+++ linux-qcom-6.8.0/net/core/dst.c
@@ -109,9 +109,6 @@
 		child = xdst->child;
 	}
 #endif
-	if (!(dst->flags & DST_NOCOUNT))
-		dst_entries_add(dst->ops, -1);
-
 	if (dst->ops->destroy)
 		dst->ops->destroy(dst);
 	netdev_put(dst->dev, &dst->dev_tracker);
@@ -161,17 +158,27 @@
 }
 EXPORT_SYMBOL(dst_dev_put);
 
+static void dst_count_dec(struct dst_entry *dst)
+{
+	if (!(dst->flags & DST_NOCOUNT))
+		dst_entries_add(dst->ops, -1);
+}
+
 void dst_release(struct dst_entry *dst)
 {
-	if (dst && rcuref_put(&dst->__rcuref))
+	if (dst && rcuref_put(&dst->__rcuref)) {
+		dst_count_dec(dst);
 		call_rcu_hurry(&dst->rcu_head, dst_destroy_rcu);
+	}
 }
 EXPORT_SYMBOL(dst_release);
 
 void dst_release_immediate(struct dst_entry *dst)
 {
-	if (dst && rcuref_put(&dst->__rcuref))
+	if (dst && rcuref_put(&dst->__rcuref)) {
+		dst_count_dec(dst);
 		dst_destroy(dst);
+	}
 }
 EXPORT_SYMBOL(dst_release_immediate);
 
--- linux-qcom-6.8.0.orig/net/core/dst_cache.c
+++ linux-qcom-6.8.0/net/core/dst_cache.c
@@ -83,7 +83,7 @@
 		return NULL;
 
 	*saddr = idst->in_saddr.s_addr;
-	return container_of(dst, struct rtable, dst);
+	return dst_rtable(dst);
 }
 EXPORT_SYMBOL_GPL(dst_cache_get_ip4);
 
@@ -112,7 +112,7 @@
 
 	idst = this_cpu_ptr(dst_cache->cache);
 	dst_cache_per_cpu_dst_set(this_cpu_ptr(dst_cache->cache), dst,
-				  rt6_get_cookie((struct rt6_info *)dst));
+				  rt6_get_cookie(dst_rt6_info(dst)));
 	idst->in6_saddr = *saddr;
 }
 EXPORT_SYMBOL_GPL(dst_cache_set_ip6);
--- linux-qcom-6.8.0.orig/net/core/filter.c
+++ linux-qcom-6.8.0/net/core/filter.c
@@ -87,6 +87,9 @@
 
 #include "dev.h"
 
+/* Keep the struct bpf_fib_lookup small so that it fits into a cacheline */
+static_assert(sizeof(struct bpf_fib_lookup) == 64, "struct bpf_fib_lookup size check");
+
 static const struct bpf_func_proto *
 bpf_sk_base_func_proto(enum bpf_func_id func_id);
 
@@ -1662,6 +1665,11 @@
 static inline int __bpf_try_make_writable(struct sk_buff *skb,
 					  unsigned int write_len)
 {
+#ifdef CONFIG_DEBUG_NET
+	/* Avoid a splat in pskb_may_pull_reason() */
+	if (write_len > INT_MAX)
+		return -EINVAL;
+#endif
 	return skb_ensure_writable(skb, write_len);
 }
 
@@ -2215,7 +2223,7 @@
 	rcu_read_lock();
 	if (!nh) {
 		dst = skb_dst(skb);
-		nexthop = rt6_nexthop(container_of(dst, struct rt6_info, dst),
+		nexthop = rt6_nexthop(dst_rt6_info(dst),
 				      &ipv6_hdr(skb)->daddr);
 	} else {
 		nexthop = &nh->ipv6_nh;
@@ -2233,7 +2241,7 @@
 		rcu_read_unlock();
 		return ret;
 	}
-	rcu_read_unlock_bh();
+	rcu_read_unlock();
 	if (dst)
 		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
 out_drop:
@@ -2271,12 +2279,12 @@
 
 	err = bpf_out_neigh_v6(net, skb, dev, nh);
 	if (unlikely(net_xmit_eval(err)))
-		dev->stats.tx_errors++;
+		DEV_STATS_INC(dev, tx_errors);
 	else
 		ret = NET_XMIT_SUCCESS;
 	goto out_xmit;
 out_drop:
-	dev->stats.tx_errors++;
+	DEV_STATS_INC(dev, tx_errors);
 	kfree_skb(skb);
 out_xmit:
 	return ret;
@@ -2314,8 +2322,7 @@
 
 	rcu_read_lock();
 	if (!nh) {
-		struct dst_entry *dst = skb_dst(skb);
-		struct rtable *rt = container_of(dst, struct rtable, dst);
+		struct rtable *rt = skb_rtable(skb);
 
 		neigh = ip_neigh_for_gw(rt, skb, &is_v6gw);
 	} else if (nh->nh_family == AF_INET6) {
@@ -2378,12 +2385,12 @@
 
 	err = bpf_out_neigh_v4(net, skb, dev, nh);
 	if (unlikely(net_xmit_eval(err)))
-		dev->stats.tx_errors++;
+		DEV_STATS_INC(dev, tx_errors);
 	else
 		ret = NET_XMIT_SUCCESS;
 	goto out_xmit;
 out_drop:
-	dev->stats.tx_errors++;
+	DEV_STATS_INC(dev, tx_errors);
 	kfree_skb(skb);
 out_xmit:
 	return ret;
@@ -2423,9 +2430,9 @@
 
 /* Internal, non-exposed redirect flags. */
 enum {
-	BPF_F_NEIGH	= (1ULL << 1),
-	BPF_F_PEER	= (1ULL << 2),
-	BPF_F_NEXTHOP	= (1ULL << 3),
+	BPF_F_NEIGH	= (1ULL << 16),
+	BPF_F_PEER	= (1ULL << 17),
+	BPF_F_NEXTHOP	= (1ULL << 18),
 #define BPF_F_REDIRECT_INTERNAL	(BPF_F_NEIGH | BPF_F_PEER | BPF_F_NEXTHOP)
 };
 
@@ -2435,6 +2442,8 @@
 	struct sk_buff *clone;
 	int ret;
 
+	BUILD_BUG_ON(BPF_F_REDIRECT_INTERNAL & BPF_F_REDIRECT_FLAGS);
+
 	if (unlikely(flags & (~(BPF_F_INGRESS) | BPF_F_REDIRECT_INTERNAL)))
 		return -EINVAL;
 
@@ -2607,18 +2616,16 @@
 
 static void sk_msg_reset_curr(struct sk_msg *msg)
 {
-	u32 i = msg->sg.start;
-	u32 len = 0;
-
-	do {
-		len += sk_msg_elem(msg, i)->length;
-		sk_msg_iter_var_next(i);
-		if (len >= msg->sg.size)
-			break;
-	} while (i != msg->sg.end);
+	if (!msg->sg.size) {
+		msg->sg.curr = msg->sg.start;
+		msg->sg.copybreak = 0;
+	} else {
+		u32 i = msg->sg.end;
 
-	msg->sg.curr = i;
-	msg->sg.copybreak = 0;
+		sk_msg_iter_var_prev(i);
+		msg->sg.curr = i;
+		msg->sg.copybreak = msg->sg.data[i].length;
+	}
 }
 
 static const struct bpf_func_proto bpf_msg_cork_bytes_proto = {
@@ -2781,7 +2788,7 @@
 		sk_msg_iter_var_next(i);
 	} while (i != msg->sg.end);
 
-	if (start >= offset + l)
+	if (start > offset + l)
 		return -EINVAL;
 
 	space = MAX_MSG_FRAGS - sk_msg_elem_used(msg);
@@ -2806,6 +2813,8 @@
 
 		raw = page_address(page);
 
+		if (i == msg->sg.end)
+			sk_msg_iter_var_prev(i);
 		psge = sk_msg_elem(msg, i);
 		front = start - offset;
 		back = psge->length - front;
@@ -2822,7 +2831,13 @@
 		}
 
 		put_page(sg_page(psge));
-	} else if (start - offset) {
+		new = i;
+		goto place_new;
+	}
+
+	if (start - offset) {
+		if (i == msg->sg.end)
+			sk_msg_iter_var_prev(i);
 		psge = sk_msg_elem(msg, i);
 		rsge = sk_msg_elem_cpy(msg, i);
 
@@ -2833,39 +2848,44 @@
 		sk_msg_iter_var_next(i);
 		sg_unmark_end(psge);
 		sg_unmark_end(&rsge);
-		sk_msg_iter_next(msg, end);
 	}
 
 	/* Slot(s) to place newly allocated data */
+	sk_msg_iter_next(msg, end);
 	new = i;
+	sk_msg_iter_var_next(i);
+
+	if (i == msg->sg.end) {
+		if (!rsge.length)
+			goto place_new;
+		sk_msg_iter_next(msg, end);
+		goto place_new;
+	}
 
 	/* Shift one or two slots as needed */
-	if (!copy) {
-		sge = sk_msg_elem_cpy(msg, i);
+	sge = sk_msg_elem_cpy(msg, new);
+	sg_unmark_end(&sge);
 
+	nsge = sk_msg_elem_cpy(msg, i);
+	if (rsge.length) {
 		sk_msg_iter_var_next(i);
-		sg_unmark_end(&sge);
+		nnsge = sk_msg_elem_cpy(msg, i);
 		sk_msg_iter_next(msg, end);
+	}
 
-		nsge = sk_msg_elem_cpy(msg, i);
+	while (i != msg->sg.end) {
+		msg->sg.data[i] = sge;
+		sge = nsge;
+		sk_msg_iter_var_next(i);
 		if (rsge.length) {
-			sk_msg_iter_var_next(i);
+			nsge = nnsge;
 			nnsge = sk_msg_elem_cpy(msg, i);
-		}
-
-		while (i != msg->sg.end) {
-			msg->sg.data[i] = sge;
-			sge = nsge;
-			sk_msg_iter_var_next(i);
-			if (rsge.length) {
-				nsge = nnsge;
-				nnsge = sk_msg_elem_cpy(msg, i);
-			} else {
-				nsge = sk_msg_elem_cpy(msg, i);
-			}
+		} else {
+			nsge = sk_msg_elem_cpy(msg, i);
 		}
 	}
 
+place_new:
 	/* Place newly allocated data buffer */
 	sk_mem_charge(msg->sk, len);
 	msg->sg.size += len;
@@ -2894,8 +2914,10 @@
 
 static void sk_msg_shift_left(struct sk_msg *msg, int i)
 {
+	struct scatterlist *sge = sk_msg_elem(msg, i);
 	int prev;
 
+	put_page(sg_page(sge));
 	do {
 		prev = i;
 		sk_msg_iter_var_next(i);
@@ -2932,6 +2954,9 @@
 	if (unlikely(flags))
 		return -EINVAL;
 
+	if (unlikely(len == 0))
+		return 0;
+
 	/* First find the starting scatterlist element */
 	i = msg->sg.start;
 	do {
@@ -2944,7 +2969,7 @@
 	} while (i != msg->sg.end);
 
 	/* Bounds checks: start and pop must be inside message */
-	if (start >= offset + l || last >= msg->sg.size)
+	if (start >= offset + l || last > msg->sg.size)
 		return -EINVAL;
 
 	space = MAX_MSG_FRAGS - sk_msg_elem_used(msg);
@@ -2973,12 +2998,12 @@
 	 */
 	if (start != offset) {
 		struct scatterlist *nsge, *sge = sk_msg_elem(msg, i);
-		int a = start;
+		int a = start - offset;
 		int b = sge->length - pop - a;
 
 		sk_msg_iter_var_next(i);
 
-		if (pop < sge->length - a) {
+		if (b > 0) {
 			if (space) {
 				sge->length = a;
 				sk_msg_shift_right(msg, i);
@@ -2997,7 +3022,6 @@
 				if (unlikely(!page))
 					return -ENOMEM;
 
-				sge->length = a;
 				orig = sg_page(sge);
 				from = sg_virt(sge);
 				to = page_address(page);
@@ -3007,7 +3031,7 @@
 				put_page(orig);
 			}
 			pop = 0;
-		} else if (pop >= sge->length - a) {
+		} else {
 			pop -= (sge->length - a);
 			sge->length = a;
 		}
@@ -3041,7 +3065,6 @@
 			pop -= sge->length;
 			sk_msg_shift_left(msg, i);
 		}
-		sk_msg_iter_var_next(i);
 	}
 
 	sk_mem_uncharge(msg->sk, len - pop);
@@ -3537,13 +3560,20 @@
 	if (skb_is_gso(skb)) {
 		struct skb_shared_info *shinfo = skb_shinfo(skb);
 
-		/* Due to header grow, MSS needs to be downgraded. */
-		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
-			skb_decrease_gso_size(shinfo, len_diff);
-
 		/* Header must be checked, and gso_segs recomputed. */
 		shinfo->gso_type |= gso_type;
 		shinfo->gso_segs = 0;
+
+		/* Due to header growth, MSS needs to be downgraded.
+		 * There is a BUG_ON() when segmenting the frag_list with
+		 * head_frag true, so linearize the skb after downgrading
+		 * the MSS.
+		 */
+		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) {
+			skb_decrease_gso_size(shinfo, len_diff);
+			if (shinfo->frag_list)
+				return skb_linearize(skb);
+		}
 	}
 
 	return 0;
@@ -3715,13 +3745,22 @@
 
 static u32 __bpf_skb_min_len(const struct sk_buff *skb)
 {
-	u32 min_len = skb_network_offset(skb);
+	int offset = skb_network_offset(skb);
+	u32 min_len = 0;
 
-	if (skb_transport_header_was_set(skb))
-		min_len = skb_transport_offset(skb);
-	if (skb->ip_summed == CHECKSUM_PARTIAL)
-		min_len = skb_checksum_start_offset(skb) +
-			  skb->csum_offset + sizeof(__sum16);
+	if (offset > 0)
+		min_len = offset;
+	if (skb_transport_header_was_set(skb)) {
+		offset = skb_transport_offset(skb);
+		if (offset > 0)
+			min_len = offset;
+	}
+	if (skb->ip_summed == CHECKSUM_PARTIAL) {
+		offset = skb_checksum_start_offset(skb) +
+			 skb->csum_offset + sizeof(__sum16);
+		if (offset > 0)
+			min_len = offset;
+	}
 	return min_len;
 }
 
@@ -4360,10 +4399,12 @@
 	enum bpf_map_type map_type = ri->map_type;
 	void *fwd = ri->tgt_value;
 	u32 map_id = ri->map_id;
+	u32 flags = ri->flags;
 	struct bpf_map *map;
 	int err;
 
 	ri->map_id = 0; /* Valid map id idr range: [1,INT_MAX[ */
+	ri->flags = 0;
 	ri->map_type = BPF_MAP_TYPE_UNSPEC;
 
 	if (unlikely(!xdpf)) {
@@ -4375,11 +4416,20 @@
 	case BPF_MAP_TYPE_DEVMAP:
 		fallthrough;
 	case BPF_MAP_TYPE_DEVMAP_HASH:
-		map = READ_ONCE(ri->map);
-		if (unlikely(map)) {
+		if (unlikely(flags & BPF_F_BROADCAST)) {
+			map = READ_ONCE(ri->map);
+
+			/* The map pointer is cleared when the map is being torn
+			 * down by bpf_clear_redirect_map()
+			 */
+			if (unlikely(!map)) {
+				err = -ENOENT;
+				break;
+			}
+
 			WRITE_ONCE(ri->map, NULL);
 			err = dev_map_enqueue_multi(xdpf, dev, map,
-						    ri->flags & BPF_F_EXCLUDE_INGRESS);
+						    flags & BPF_F_EXCLUDE_INGRESS);
 		} else {
 			err = dev_map_enqueue(fwd, xdpf, dev);
 		}
@@ -4442,9 +4492,9 @@
 static int xdp_do_generic_redirect_map(struct net_device *dev,
 				       struct sk_buff *skb,
 				       struct xdp_buff *xdp,
-				       struct bpf_prog *xdp_prog,
-				       void *fwd,
-				       enum bpf_map_type map_type, u32 map_id)
+				       struct bpf_prog *xdp_prog, void *fwd,
+				       enum bpf_map_type map_type, u32 map_id,
+				       u32 flags)
 {
 	struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info);
 	struct bpf_map *map;
@@ -4454,11 +4504,20 @@
 	case BPF_MAP_TYPE_DEVMAP:
 		fallthrough;
 	case BPF_MAP_TYPE_DEVMAP_HASH:
-		map = READ_ONCE(ri->map);
-		if (unlikely(map)) {
+		if (unlikely(flags & BPF_F_BROADCAST)) {
+			map = READ_ONCE(ri->map);
+
+			/* The map pointer is cleared when the map is being torn
+			 * down by bpf_clear_redirect_map()
+			 */
+			if (unlikely(!map)) {
+				err = -ENOENT;
+				break;
+			}
+
 			WRITE_ONCE(ri->map, NULL);
 			err = dev_map_redirect_multi(dev, skb, xdp_prog, map,
-						     ri->flags & BPF_F_EXCLUDE_INGRESS);
+						     flags & BPF_F_EXCLUDE_INGRESS);
 		} else {
 			err = dev_map_generic_redirect(fwd, skb, xdp_prog);
 		}
@@ -4495,9 +4554,11 @@
 	enum bpf_map_type map_type = ri->map_type;
 	void *fwd = ri->tgt_value;
 	u32 map_id = ri->map_id;
+	u32 flags = ri->flags;
 	int err;
 
 	ri->map_id = 0; /* Valid map id idr range: [1,INT_MAX[ */
+	ri->flags = 0;
 	ri->map_type = BPF_MAP_TYPE_UNSPEC;
 
 	if (map_type == BPF_MAP_TYPE_UNSPEC && map_id == INT_MAX) {
@@ -4517,7 +4578,7 @@
 		return 0;
 	}
 
-	return xdp_do_generic_redirect_map(dev, skb, xdp, xdp_prog, fwd, map_type, map_id);
+	return xdp_do_generic_redirect_map(dev, skb, xdp, xdp_prog, fwd, map_type, map_id, flags);
 err:
 	_trace_xdp_redirect_err(dev, xdp_prog, ri->tgt_index, err);
 	return err;
@@ -6213,12 +6274,10 @@
 {
 	int ret = BPF_MTU_CHK_RET_FRAG_NEEDED;
 	struct net_device *dev = skb->dev;
-	int skb_len, dev_len;
-	int mtu;
+	int mtu, dev_len, skb_len;
 
 	if (unlikely(flags & ~(BPF_MTU_CHK_SEGS)))
 		return -EINVAL;
-
 	if (unlikely(flags & BPF_MTU_CHK_SEGS && (len_diff || *mtu_len)))
 		return -EINVAL;
 
@@ -6227,7 +6286,6 @@
 		return -ENODEV;
 
 	mtu = READ_ONCE(dev->mtu);
-
 	dev_len = mtu + dev->hard_header_len;
 
 	/* If set use *mtu_len as input, L3 as iph->tot_len (like fib_lookup) */
@@ -6245,15 +6303,12 @@
 	 */
 	if (skb_is_gso(skb)) {
 		ret = BPF_MTU_CHK_RET_SUCCESS;
-
 		if (flags & BPF_MTU_CHK_SEGS &&
 		    !skb_gso_validate_network_len(skb, mtu))
 			ret = BPF_MTU_CHK_RET_SEGS_TOOBIG;
 	}
 out:
-	/* BPF verifier guarantees valid pointer */
 	*mtu_len = mtu;
-
 	return ret;
 }
 
@@ -6274,8 +6329,6 @@
 		return -ENODEV;
 
 	mtu = READ_ONCE(dev->mtu);
-
-	/* Add L2-header as dev MTU is L3 size */
 	dev_len = mtu + dev->hard_header_len;
 
 	/* Use *mtu_len as input, L3 as iph->tot_len (like fib_lookup) */
@@ -6286,9 +6339,7 @@
 	if (xdp_len > dev_len)
 		ret = BPF_MTU_CHK_RET_FRAG_NEEDED;
 
-	/* BPF verifier guarantees valid pointer */
 	*mtu_len = mtu;
-
 	return ret;
 }
 
@@ -6298,7 +6349,8 @@
 	.ret_type	= RET_INTEGER,
 	.arg1_type      = ARG_PTR_TO_CTX,
 	.arg2_type      = ARG_ANYTHING,
-	.arg3_type      = ARG_PTR_TO_INT,
+	.arg3_type      = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_WRITE | MEM_ALIGNED,
+	.arg3_size	= sizeof(u32),
 	.arg4_type      = ARG_ANYTHING,
 	.arg5_type      = ARG_ANYTHING,
 };
@@ -6309,7 +6361,8 @@
 	.ret_type	= RET_INTEGER,
 	.arg1_type      = ARG_PTR_TO_CTX,
 	.arg2_type      = ARG_ANYTHING,
-	.arg3_type      = ARG_PTR_TO_INT,
+	.arg3_type      = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_WRITE | MEM_ALIGNED,
+	.arg3_size	= sizeof(u32),
 	.arg4_type      = ARG_ANYTHING,
 	.arg5_type      = ARG_ANYTHING,
 };
@@ -7694,17 +7747,21 @@
 		return -EOPNOTSUPP;
 
 	switch (tstamp_type) {
-	case BPF_SKB_TSTAMP_DELIVERY_MONO:
+	case BPF_SKB_CLOCK_REALTIME:
+		skb->tstamp = tstamp;
+		skb->tstamp_type = SKB_CLOCK_REALTIME;
+		break;
+	case BPF_SKB_CLOCK_MONOTONIC:
 		if (!tstamp)
 			return -EINVAL;
 		skb->tstamp = tstamp;
-		skb->mono_delivery_time = 1;
+		skb->tstamp_type = SKB_CLOCK_MONOTONIC;
 		break;
-	case BPF_SKB_TSTAMP_UNSPEC:
-		if (tstamp)
+	case BPF_SKB_CLOCK_TAI:
+		if (!tstamp)
 			return -EINVAL;
-		skb->tstamp = 0;
-		skb->mono_delivery_time = 0;
+		skb->tstamp = tstamp;
+		skb->tstamp_type = SKB_CLOCK_TAI;
 		break;
 	default:
 		return -EINVAL;
@@ -7828,42 +7885,37 @@
 
 #endif /* CONFIG_INET */
 
-bool bpf_helper_changes_pkt_data(void *func)
+bool bpf_helper_changes_pkt_data(enum bpf_func_id func_id)
 {
-	if (func == bpf_skb_vlan_push ||
-	    func == bpf_skb_vlan_pop ||
-	    func == bpf_skb_store_bytes ||
-	    func == bpf_skb_change_proto ||
-	    func == bpf_skb_change_head ||
-	    func == sk_skb_change_head ||
-	    func == bpf_skb_change_tail ||
-	    func == sk_skb_change_tail ||
-	    func == bpf_skb_adjust_room ||
-	    func == sk_skb_adjust_room ||
-	    func == bpf_skb_pull_data ||
-	    func == sk_skb_pull_data ||
-	    func == bpf_clone_redirect ||
-	    func == bpf_l3_csum_replace ||
-	    func == bpf_l4_csum_replace ||
-	    func == bpf_xdp_adjust_head ||
-	    func == bpf_xdp_adjust_meta ||
-	    func == bpf_msg_pull_data ||
-	    func == bpf_msg_push_data ||
-	    func == bpf_msg_pop_data ||
-	    func == bpf_xdp_adjust_tail ||
-#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
-	    func == bpf_lwt_seg6_store_bytes ||
-	    func == bpf_lwt_seg6_adjust_srh ||
-	    func == bpf_lwt_seg6_action ||
-#endif
-#ifdef CONFIG_INET
-	    func == bpf_sock_ops_store_hdr_opt ||
-#endif
-	    func == bpf_lwt_in_push_encap ||
-	    func == bpf_lwt_xmit_push_encap)
+	switch (func_id) {
+	case BPF_FUNC_clone_redirect:
+	case BPF_FUNC_l3_csum_replace:
+	case BPF_FUNC_l4_csum_replace:
+	case BPF_FUNC_lwt_push_encap:
+	case BPF_FUNC_lwt_seg6_action:
+	case BPF_FUNC_lwt_seg6_adjust_srh:
+	case BPF_FUNC_lwt_seg6_store_bytes:
+	case BPF_FUNC_msg_pop_data:
+	case BPF_FUNC_msg_pull_data:
+	case BPF_FUNC_msg_push_data:
+	case BPF_FUNC_skb_adjust_room:
+	case BPF_FUNC_skb_change_head:
+	case BPF_FUNC_skb_change_proto:
+	case BPF_FUNC_skb_change_tail:
+	case BPF_FUNC_skb_pull_data:
+	case BPF_FUNC_skb_store_bytes:
+	case BPF_FUNC_skb_vlan_pop:
+	case BPF_FUNC_skb_vlan_push:
+	case BPF_FUNC_store_hdr_opt:
+	case BPF_FUNC_xdp_adjust_head:
+	case BPF_FUNC_xdp_adjust_meta:
+	case BPF_FUNC_xdp_adjust_tail:
+	/* tail-called program could call any of the above */
+	case BPF_FUNC_tail_call:
 		return true;
-
-	return false;
+	default:
+		return false;
+	}
 }
 
 const struct bpf_func_proto bpf_event_output_data_proto __weak;
@@ -8526,13 +8578,16 @@
 		if (off + size > offsetofend(struct __sk_buff, cb[4]))
 			return false;
 		break;
+	case bpf_ctx_range(struct __sk_buff, data):
+	case bpf_ctx_range(struct __sk_buff, data_meta):
+	case bpf_ctx_range(struct __sk_buff, data_end):
+		if (info->is_ldsx || size != size_default)
+			return false;
+		break;
 	case bpf_ctx_range_till(struct __sk_buff, remote_ip6[0], remote_ip6[3]):
 	case bpf_ctx_range_till(struct __sk_buff, local_ip6[0], local_ip6[3]):
 	case bpf_ctx_range_till(struct __sk_buff, remote_ip4, remote_ip4):
 	case bpf_ctx_range_till(struct __sk_buff, local_ip4, local_ip4):
-	case bpf_ctx_range(struct __sk_buff, data):
-	case bpf_ctx_range(struct __sk_buff, data_meta):
-	case bpf_ctx_range(struct __sk_buff, data_end):
 		if (size != size_default)
 			return false;
 		break;
@@ -8976,6 +9031,14 @@
 			}
 		}
 		return false;
+	} else {
+		switch (off) {
+		case offsetof(struct xdp_md, data_meta):
+		case offsetof(struct xdp_md, data):
+		case offsetof(struct xdp_md, data_end):
+			if (info->is_ldsx)
+				return false;
+		}
 	}
 
 	switch (off) {
@@ -9301,12 +9364,12 @@
 
 	switch (off) {
 	case bpf_ctx_range(struct __sk_buff, data):
-		if (size != size_default)
+		if (info->is_ldsx || size != size_default)
 			return false;
 		info->reg_type = PTR_TO_PACKET;
 		return true;
 	case bpf_ctx_range(struct __sk_buff, data_end):
-		if (size != size_default)
+		if (info->is_ldsx || size != size_default)
 			return false;
 		info->reg_type = PTR_TO_PACKET_END;
 		return true;
@@ -9357,16 +9420,17 @@
 {
 	__u8 value_reg = si->dst_reg;
 	__u8 skb_reg = si->src_reg;
-	/* AX is needed because src_reg and dst_reg could be the same */
-	__u8 tmp_reg = BPF_REG_AX;
-
-	*insn++ = BPF_LDX_MEM(BPF_B, tmp_reg, skb_reg,
-			      SKB_BF_MONO_TC_OFFSET);
-	*insn++ = BPF_JMP32_IMM(BPF_JSET, tmp_reg,
-				SKB_MONO_DELIVERY_TIME_MASK, 2);
-	*insn++ = BPF_MOV32_IMM(value_reg, BPF_SKB_TSTAMP_UNSPEC);
-	*insn++ = BPF_JMP_A(1);
-	*insn++ = BPF_MOV32_IMM(value_reg, BPF_SKB_TSTAMP_DELIVERY_MONO);
+	BUILD_BUG_ON(__SKB_CLOCK_MAX != (int)BPF_SKB_CLOCK_TAI);
+	BUILD_BUG_ON(SKB_CLOCK_REALTIME != (int)BPF_SKB_CLOCK_REALTIME);
+	BUILD_BUG_ON(SKB_CLOCK_MONOTONIC != (int)BPF_SKB_CLOCK_MONOTONIC);
+	BUILD_BUG_ON(SKB_CLOCK_TAI != (int)BPF_SKB_CLOCK_TAI);
+	*insn++ = BPF_LDX_MEM(BPF_B, value_reg, skb_reg, SKB_BF_MONO_TC_OFFSET);
+	*insn++ = BPF_ALU32_IMM(BPF_AND, value_reg, SKB_TSTAMP_TYPE_MASK);
+#ifdef __BIG_ENDIAN_BITFIELD
+	*insn++ = BPF_ALU32_IMM(BPF_RSH, value_reg, SKB_TSTAMP_TYPE_RSHIFT);
+#else
+	BUILD_BUG_ON(!(SKB_TSTAMP_TYPE_MASK & 0x1));
+#endif
 
 	return insn;
 }
@@ -9409,11 +9473,12 @@
 		__u8 tmp_reg = BPF_REG_AX;
 
 		*insn++ = BPF_LDX_MEM(BPF_B, tmp_reg, skb_reg, SKB_BF_MONO_TC_OFFSET);
-		*insn++ = BPF_ALU32_IMM(BPF_AND, tmp_reg,
-					TC_AT_INGRESS_MASK | SKB_MONO_DELIVERY_TIME_MASK);
-		*insn++ = BPF_JMP32_IMM(BPF_JNE, tmp_reg,
-					TC_AT_INGRESS_MASK | SKB_MONO_DELIVERY_TIME_MASK, 2);
-		/* skb->tc_at_ingress && skb->mono_delivery_time,
+		/* check if ingress mask bits is set */
+		*insn++ = BPF_JMP32_IMM(BPF_JSET, tmp_reg, TC_AT_INGRESS_MASK, 1);
+		*insn++ = BPF_JMP_A(4);
+		*insn++ = BPF_JMP32_IMM(BPF_JSET, tmp_reg, SKB_TSTAMP_TYPE_MASK, 1);
+		*insn++ = BPF_JMP_A(2);
+		/* skb->tc_at_ingress && skb->tstamp_type,
 		 * read 0 as the (rcv) timestamp.
 		 */
 		*insn++ = BPF_MOV64_IMM(value_reg, 0);
@@ -9438,7 +9503,7 @@
 	 * the bpf prog is aware the tstamp could have delivery time.
 	 * Thus, write skb->tstamp as is if tstamp_type_access is true.
 	 * Otherwise, writing at ingress will have to clear the
-	 * mono_delivery_time bit also.
+	 * skb->tstamp_type bit also.
 	 */
 	if (!prog->tstamp_type_access) {
 		__u8 tmp_reg = BPF_REG_AX;
@@ -9448,8 +9513,8 @@
 		*insn++ = BPF_JMP32_IMM(BPF_JSET, tmp_reg, TC_AT_INGRESS_MASK, 1);
 		/* goto <store> */
 		*insn++ = BPF_JMP_A(2);
-		/* <clear>: mono_delivery_time */
-		*insn++ = BPF_ALU32_IMM(BPF_AND, tmp_reg, ~SKB_MONO_DELIVERY_TIME_MASK);
+		/* <clear>: skb->tstamp_type */
+		*insn++ = BPF_ALU32_IMM(BPF_AND, tmp_reg, ~SKB_TSTAMP_TYPE_MASK);
 		*insn++ = BPF_STX_MEM(BPF_B, skb_reg, tmp_reg, SKB_BF_MONO_TC_OFFSET);
 	}
 #endif
@@ -11005,7 +11070,6 @@
 };
 
 const struct bpf_prog_ops lwt_seg6local_prog_ops = {
-	.test_run		= bpf_prog_test_run_skb,
 };
 
 const struct bpf_verifier_ops cg_sock_verifier_ops = {
@@ -11168,6 +11232,7 @@
 	bool is_sockarray = map->map_type == BPF_MAP_TYPE_REUSEPORT_SOCKARRAY;
 	struct sock_reuseport *reuse;
 	struct sock *selected_sk;
+	int err;
 
 	selected_sk = map->ops->map_lookup_elem(map, key);
 	if (!selected_sk)
@@ -11175,10 +11240,6 @@
 
 	reuse = rcu_dereference(selected_sk->sk_reuseport_cb);
 	if (!reuse) {
-		/* Lookup in sock_map can return TCP ESTABLISHED sockets. */
-		if (sk_is_refcounted(selected_sk))
-			sock_put(selected_sk);
-
 		/* reuseport_array has only sk with non NULL sk_reuseport_cb.
 		 * The only (!reuse) case here is - the sk has already been
 		 * unhashed (e.g. by close()), so treat it as -ENOENT.
@@ -11186,24 +11247,33 @@
 		 * Other maps (e.g. sock_map) do not provide this guarantee and
 		 * the sk may never be in the reuseport group to begin with.
 		 */
-		return is_sockarray ? -ENOENT : -EINVAL;
+		err = is_sockarray ? -ENOENT : -EINVAL;
+		goto error;
 	}
 
 	if (unlikely(reuse->reuseport_id != reuse_kern->reuseport_id)) {
 		struct sock *sk = reuse_kern->sk;
 
-		if (sk->sk_protocol != selected_sk->sk_protocol)
-			return -EPROTOTYPE;
-		else if (sk->sk_family != selected_sk->sk_family)
-			return -EAFNOSUPPORT;
-
-		/* Catch all. Likely bound to a different sockaddr. */
-		return -EBADFD;
+		if (sk->sk_protocol != selected_sk->sk_protocol) {
+			err = -EPROTOTYPE;
+		} else if (sk->sk_family != selected_sk->sk_family) {
+			err = -EAFNOSUPPORT;
+		} else {
+			/* Catch all. Likely bound to a different sockaddr. */
+			err = -EBADFD;
+		}
+		goto error;
 	}
 
 	reuse_kern->selected_sk = selected_sk;
 
 	return 0;
+error:
+	/* Lookup in sock_map can return TCP ESTABLISHED sockets. */
+	if (sk_is_refcounted(selected_sk))
+		sock_put(selected_sk);
+
+	return err;
 }
 
 static const struct bpf_func_proto sk_select_reuseport_proto = {
--- linux-qcom-6.8.0.orig/net/core/flow_dissector.c
+++ linux-qcom-6.8.0/net/core/flow_dissector.c
@@ -1093,7 +1093,7 @@
 		}
 	}
 
-	WARN_ON_ONCE(!net);
+	DEBUG_NET_WARN_ON_ONCE(!net);
 	if (net) {
 		enum netns_bpf_attach_type type = NETNS_BPF_FLOW_DISSECTOR;
 		struct bpf_prog_array *run_array;
--- linux-qcom-6.8.0.orig/net/core/gen_estimator.c
+++ linux-qcom-6.8.0/net/core/gen_estimator.c
@@ -206,7 +206,7 @@
 {
 	struct net_rate_estimator *est;
 
-	est = xchg((__force struct net_rate_estimator **)rate_est, NULL);
+	est = unrcu_pointer(xchg(rate_est, NULL));
 	if (est) {
 		timer_shutdown_sync(&est->timer);
 		kfree_rcu(est, rcu);
--- linux-qcom-6.8.0.orig/net/core/gro.c
+++ linux-qcom-6.8.0/net/core/gro.c
@@ -100,7 +100,6 @@
 	unsigned int headlen = skb_headlen(skb);
 	unsigned int len = skb_gro_len(skb);
 	unsigned int delta_truesize;
-	unsigned int gro_max_size;
 	unsigned int new_truesize;
 	struct sk_buff *lp;
 	int segs;
@@ -114,12 +113,8 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
-	/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */
-	gro_max_size = p->protocol == htons(ETH_P_IPV6) ?
-			READ_ONCE(p->dev->gro_max_size) :
-			READ_ONCE(p->dev->gro_ipv4_max_size);
-
-	if (unlikely(p->len + len >= gro_max_size || NAPI_GRO_CB(skb)->flush))
+	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
+		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;
 
 	if (unlikely(p->len + len >= GRO_LEGACY_MAX_SIZE)) {
@@ -195,8 +190,9 @@
 	}
 
 merge:
-	/* sk owenrship - if any - completely transferred to the aggregated packet */
+	/* sk ownership - if any - completely transferred to the aggregated packet */
 	skb->destructor = NULL;
+	skb->sk = NULL;
 	delta_truesize = skb->truesize;
 	if (offset > headlen) {
 		unsigned int eat = offset - headlen;
@@ -372,6 +368,7 @@
 	const struct skb_shared_info *pinfo = skb_shinfo(skb);
 	const skb_frag_t *frag0 = &pinfo->frags[0];
 
+	NAPI_GRO_CB(skb)->network_offset = 0;
 	NAPI_GRO_CB(skb)->data_offset = 0;
 	NAPI_GRO_CB(skb)->frag0 = NULL;
 	NAPI_GRO_CB(skb)->frag0_len = 0;
--- linux-qcom-6.8.0.orig/net/core/gso_test.c
+++ linux-qcom-6.8.0/net/core/gso_test.c
@@ -225,7 +225,7 @@
 
 	segs = skb_segment(skb, features);
 	if (IS_ERR(segs)) {
-		KUNIT_FAIL(test, "segs error %lld", PTR_ERR(segs));
+		KUNIT_FAIL(test, "segs error %pe", segs);
 		goto free_gso_skb;
 	} else if (!segs) {
 		KUNIT_FAIL(test, "no segments");
--- linux-qcom-6.8.0.orig/net/core/link_watch.c
+++ linux-qcom-6.8.0/net/core/link_watch.c
@@ -42,12 +42,21 @@
 	 * first check whether lower is indeed the source of its down state.
 	 */
 	if (!netif_carrier_ok(dev)) {
-		int iflink = dev_get_iflink(dev);
 		struct net_device *peer;
+		int iflink;
+
+		/* If called from netdev_run_todo()/linkwatch_sync_dev(),
+		 * dev_net(dev) can be already freed, and RTNL is not held.
+		 */
+		if (dev->reg_state <= NETREG_REGISTERED)
+			iflink = dev_get_iflink(dev);
+		else
+			iflink = dev->ifindex;
 
 		if (iflink == dev->ifindex)
 			return IF_OPER_DOWN;
 
+		ASSERT_RTNL();
 		peer = __dev_get_by_index(dev_net(dev), iflink);
 		if (!peer)
 			return IF_OPER_DOWN;
@@ -67,7 +76,7 @@
 {
 	unsigned char operstate = default_operstate(dev);
 
-	if (operstate == dev->operstate)
+	if (operstate == READ_ONCE(dev->operstate))
 		return;
 
 	write_lock(&dev_base_lock);
@@ -87,7 +96,7 @@
 		break;
 	}
 
-	dev->operstate = operstate;
+	WRITE_ONCE(dev->operstate, operstate);
 
 	write_unlock(&dev_base_lock);
 }
@@ -153,9 +162,9 @@
 	 * override the existing timer.
 	 */
 	if (test_bit(LW_URGENT, &linkwatch_flags))
-		mod_delayed_work(system_wq, &linkwatch_work, 0);
+		mod_delayed_work(system_unbound_wq, &linkwatch_work, 0);
 	else
-		schedule_delayed_work(&linkwatch_work, delay);
+		queue_delayed_work(system_unbound_wq, &linkwatch_work, delay);
 }
 
 
--- linux-qcom-6.8.0.orig/net/core/neighbour.c
+++ linux-qcom-6.8.0/net/core/neighbour.c
@@ -2875,6 +2875,7 @@
 	err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack);
 	if (err < 0 && cb->strict_check)
 		return err;
+	err = 0;
 
 	s_t = cb->args[0];
 
--- linux-qcom-6.8.0.orig/net/core/net-sysfs.c
+++ linux-qcom-6.8.0/net/core/net-sysfs.c
@@ -31,6 +31,7 @@
 #ifdef CONFIG_SYSFS
 static const char fmt_hex[] = "%#x\n";
 static const char fmt_dec[] = "%d\n";
+static const char fmt_uint[] = "%u\n";
 static const char fmt_ulong[] = "%lu\n";
 static const char fmt_u64[] = "%llu\n";
 
@@ -227,7 +228,7 @@
 	if (!rtnl_trylock())
 		return restart_syscall();
 
-	if (netif_running(netdev) && netif_device_present(netdev)) {
+	if (netif_running(netdev)) {
 		struct ethtool_link_ksettings cmd;
 
 		if (!__ethtool_get_link_ksettings(netdev, &cmd))
@@ -318,11 +319,9 @@
 	const struct net_device *netdev = to_net_dev(dev);
 	unsigned char operstate;
 
-	read_lock(&dev_base_lock);
-	operstate = netdev->operstate;
+	operstate = READ_ONCE(netdev->operstate);
 	if (!netif_running(netdev))
 		operstate = IF_OPER_DOWN;
-	read_unlock(&dev_base_lock);
 
 	if (operstate >= ARRAY_SIZE(operstates))
 		return -EINVAL; /* should not happen */
@@ -419,6 +418,9 @@
 
 static int change_napi_defer_hard_irqs(struct net_device *dev, unsigned long val)
 {
+	if (val > S32_MAX)
+		return -ERANGE;
+
 	WRITE_ONCE(dev->napi_defer_hard_irqs, val);
 	return 0;
 }
@@ -432,7 +434,7 @@
 
 	return netdev_store(dev, attr, buf, len, change_napi_defer_hard_irqs);
 }
-NETDEVICE_SHOW_RW(napi_defer_hard_irqs, fmt_dec);
+NETDEVICE_SHOW_RW(napi_defer_hard_irqs, fmt_uint);
 
 static ssize_t ifalias_store(struct device *dev, struct device_attribute *attr,
 			     const char *buf, size_t len)
--- linux-qcom-6.8.0.orig/net/core/net_namespace.c
+++ linux-qcom-6.8.0/net/core/net_namespace.c
@@ -69,12 +69,15 @@
 
 static struct net_generic *net_alloc_generic(void)
 {
+	unsigned int gen_ptrs = READ_ONCE(max_gen_ptrs);
+	unsigned int generic_size;
 	struct net_generic *ng;
-	unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
+
+	generic_size = offsetof(struct net_generic, ptr[gen_ptrs]);
 
 	ng = kzalloc(generic_size, GFP_KERNEL);
 	if (ng)
-		ng->s.len = max_gen_ptrs;
+		ng->s.len = gen_ptrs;
 
 	return ng;
 }
@@ -318,8 +321,9 @@
 {
 	/* Must be called with pernet_ops_rwsem held */
 	const struct pernet_operations *ops, *saved_ops;
-	int error = 0;
 	LIST_HEAD(net_exit_list);
+	LIST_HEAD(dev_kill_list);
+	int error = 0;
 
 	refcount_set(&net->ns.count, 1);
 	ref_tracker_dir_init(&net->refcnt_tracker, 128, "net refcnt");
@@ -358,6 +362,15 @@
 	synchronize_rcu();
 
 	ops = saved_ops;
+	rtnl_lock();
+	list_for_each_entry_continue_reverse(ops, &pernet_list, list) {
+		if (ops->exit_batch_rtnl)
+			ops->exit_batch_rtnl(&net_exit_list, &dev_kill_list);
+	}
+	unregister_netdevice_many(&dev_kill_list);
+	rtnl_unlock();
+
+	ops = saved_ops;
 	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 		ops_exit_list(ops, &net_exit_list);
 
@@ -443,6 +456,21 @@
 	goto out;
 }
 
+static LLIST_HEAD(defer_free_list);
+
+static void net_complete_free(void)
+{
+	struct llist_node *kill_list;
+	struct net *net, *next;
+
+	/* Get the list of namespaces to free from last round. */
+	kill_list = llist_del_all(&defer_free_list);
+
+	llist_for_each_entry_safe(net, next, kill_list, defer_free_list)
+		kmem_cache_free(net_cachep, net);
+
+}
+
 static void net_free(struct net *net)
 {
 	if (refcount_dec_and_test(&net->passive)) {
@@ -451,7 +479,8 @@
 		/* There should not be any trackers left there. */
 		ref_tracker_dir_exit(&net->notrefcnt_tracker);
 
-		kmem_cache_free(net_cachep, net);
+		/* Wait for an extra rcu_barrier() before final free. */
+		llist_add(&net->defer_free_list, &defer_free_list);
 	}
 }
 
@@ -573,6 +602,7 @@
 	struct net *net, *tmp, *last;
 	struct llist_node *net_kill_list;
 	LIST_HEAD(net_exit_list);
+	LIST_HEAD(dev_kill_list);
 
 	/* Atomically snapshot the list of namespaces to cleanup */
 	net_kill_list = llist_del_all(&cleanup_list);
@@ -613,6 +643,14 @@
 	 */
 	synchronize_rcu();
 
+	rtnl_lock();
+	list_for_each_entry_reverse(ops, &pernet_list, list) {
+		if (ops->exit_batch_rtnl)
+			ops->exit_batch_rtnl(&net_exit_list, &dev_kill_list);
+	}
+	unregister_netdevice_many(&dev_kill_list);
+	rtnl_unlock();
+
 	/* Run all of the network namespace exit methods */
 	list_for_each_entry_reverse(ops, &pernet_list, list)
 		ops_exit_list(ops, &net_exit_list);
@@ -628,6 +666,8 @@
 	 */
 	rcu_barrier();
 
+	net_complete_free();
+
 	/* Finally it is safe to free my network namespace structure */
 	list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
 		list_del_init(&net->exit_list);
@@ -671,11 +711,16 @@
  * get_net_ns - increment the refcount of the network namespace
  * @ns: common namespace (net)
  *
- * Returns the net's common namespace.
+ * Returns the net's common namespace or ERR_PTR() if ref is zero.
  */
 struct ns_common *get_net_ns(struct ns_common *ns)
 {
-	return &get_net(container_of(ns, struct net, ns))->ns;
+	struct net *net;
+
+	net = maybe_get_net(container_of(ns, struct net, ns));
+	if (net)
+		return &net->ns;
+	return ERR_PTR(-EINVAL);
 }
 EXPORT_SYMBOL_GPL(get_net_ns);
 
@@ -1193,7 +1238,17 @@
 {
 	ops_pre_exit_list(ops, net_exit_list);
 	synchronize_rcu();
+
+	if (ops->exit_batch_rtnl) {
+		LIST_HEAD(dev_kill_list);
+
+		rtnl_lock();
+		ops->exit_batch_rtnl(net_exit_list, &dev_kill_list);
+		unregister_netdevice_many(&dev_kill_list);
+		rtnl_unlock();
+	}
 	ops_exit_list(ops, net_exit_list);
+
 	ops_free_list(ops, net_exit_list);
 }
 
@@ -1278,7 +1333,11 @@
 		if (error < 0)
 			return error;
 		*ops->id = error;
-		max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1);
+		/* This does not require READ_ONCE as writers already hold
+		 * pernet_ops_rwsem. But WRITE_ONCE is needed to protect
+		 * net_alloc_generic.
+		 */
+		WRITE_ONCE(max_gen_ptrs, max(max_gen_ptrs, *ops->id + 1));
 	}
 	error = __register_pernet_operations(list, ops);
 	if (error) {
--- linux-qcom-6.8.0.orig/net/core/netdev-genl.c
+++ linux-qcom-6.8.0/net/core/netdev-genl.c
@@ -58,22 +58,22 @@
 	    nla_put_u64_64bit(rsp, NETDEV_A_DEV_XDP_RX_METADATA_FEATURES,
 			      xdp_rx_meta, NETDEV_A_DEV_PAD) ||
 	    nla_put_u64_64bit(rsp, NETDEV_A_DEV_XSK_FEATURES,
-			      xsk_features, NETDEV_A_DEV_PAD)) {
-		genlmsg_cancel(rsp, hdr);
-		return -EINVAL;
-	}
+			      xsk_features, NETDEV_A_DEV_PAD))
+		goto err_cancel_msg;
 
 	if (netdev->xdp_features & NETDEV_XDP_ACT_XSK_ZEROCOPY) {
 		if (nla_put_u32(rsp, NETDEV_A_DEV_XDP_ZC_MAX_SEGS,
-				netdev->xdp_zc_max_segs)) {
-			genlmsg_cancel(rsp, hdr);
-			return -EINVAL;
-		}
+				netdev->xdp_zc_max_segs))
+			goto err_cancel_msg;
 	}
 
 	genlmsg_end(rsp, hdr);
 
 	return 0;
+
+err_cancel_msg:
+	genlmsg_cancel(rsp, hdr);
+	return -EMSGSIZE;
 }
 
 static void
@@ -152,10 +152,7 @@
 	}
 	rtnl_unlock();
 
-	if (err != -EMSGSIZE)
-		return err;
-
-	return skb->len;
+	return err;
 }
 
 static int
@@ -165,8 +162,6 @@
 	void *hdr;
 	pid_t pid;
 
-	if (WARN_ON_ONCE(!napi->dev))
-		return -EINVAL;
 	if (!(napi->dev->flags & IFF_UP))
 		return 0;
 
@@ -174,8 +169,7 @@
 	if (!hdr)
 		return -EMSGSIZE;
 
-	if (napi->napi_id >= MIN_NAPI_ID &&
-	    nla_put_u32(rsp, NETDEV_A_NAPI_ID, napi->napi_id))
+	if (nla_put_u32(rsp, NETDEV_A_NAPI_ID, napi->napi_id))
 		goto nla_put_failure;
 
 	if (nla_put_u32(rsp, NETDEV_A_NAPI_IFINDEX, napi->dev->ifindex))
@@ -216,17 +210,25 @@
 		return -ENOMEM;
 
 	rtnl_lock();
+	rcu_read_lock();
 
-	napi = napi_by_id(napi_id);
-	if (napi)
+	napi = netdev_napi_by_id(genl_info_net(info), napi_id);
+	if (napi) {
 		err = netdev_nl_napi_fill_one(rsp, napi, info);
-	else
-		err = -EINVAL;
+	} else {
+		NL_SET_BAD_ATTR(info->extack, info->attrs[NETDEV_A_NAPI_ID]);
+		err = -ENOENT;
+	}
 
+	rcu_read_unlock();
 	rtnl_unlock();
 
-	if (err)
+	if (err) {
+		goto err_free_msg;
+	} else if (!rsp->len) {
+		err = -ENOENT;
 		goto err_free_msg;
+	}
 
 	return genlmsg_reply(rsp, info);
 
@@ -247,6 +249,8 @@
 		return err;
 
 	list_for_each_entry(napi, &netdev->napi_list, dev_list) {
+		if (napi->napi_id < MIN_NAPI_ID)
+			continue;
 		if (ctx->napi_id && napi->napi_id >= ctx->napi_id)
 			continue;
 
@@ -287,10 +291,7 @@
 	}
 	rtnl_unlock();
 
-	if (err != -EMSGSIZE)
-		return err;
-
-	return skb->len;
+	return err;
 }
 
 static int
@@ -352,10 +353,10 @@
 netdev_nl_queue_fill(struct sk_buff *rsp, struct net_device *netdev, u32 q_idx,
 		     u32 q_type, const struct genl_info *info)
 {
-	int err = 0;
+	int err;
 
 	if (!(netdev->flags & IFF_UP))
-		return err;
+		return -ENOENT;
 
 	err = netdev_nl_queue_validate(netdev, q_idx, q_type);
 	if (err)
@@ -410,24 +411,21 @@
 			 struct netdev_nl_dump_ctx *ctx)
 {
 	int err = 0;
-	int i;
 
 	if (!(netdev->flags & IFF_UP))
 		return err;
 
-	for (i = ctx->rxq_idx; i < netdev->real_num_rx_queues;) {
-		err = netdev_nl_queue_fill_one(rsp, netdev, i,
+	for (; ctx->rxq_idx < netdev->real_num_rx_queues; ctx->rxq_idx++) {
+		err = netdev_nl_queue_fill_one(rsp, netdev, ctx->rxq_idx,
 					       NETDEV_QUEUE_TYPE_RX, info);
 		if (err)
 			return err;
-		ctx->rxq_idx = i++;
 	}
-	for (i = ctx->txq_idx; i < netdev->real_num_tx_queues;) {
-		err = netdev_nl_queue_fill_one(rsp, netdev, i,
+	for (; ctx->txq_idx < netdev->real_num_tx_queues; ctx->txq_idx++) {
+		err = netdev_nl_queue_fill_one(rsp, netdev, ctx->txq_idx,
 					       NETDEV_QUEUE_TYPE_TX, info);
 		if (err)
 			return err;
-		ctx->txq_idx = i++;
 	}
 
 	return err;
@@ -463,10 +461,7 @@
 	}
 	rtnl_unlock();
 
-	if (err != -EMSGSIZE)
-		return err;
-
-	return skb->len;
+	return err;
 }
 
 static int netdev_genl_netdevice_event(struct notifier_block *nb,
--- linux-qcom-6.8.0.orig/net/core/netpoll.c
+++ linux-qcom-6.8.0/net/core/netpoll.c
@@ -316,7 +316,7 @@
 	struct napi_struct *napi;
 
 	list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) {
-		if (napi->poll_owner == smp_processor_id())
+		if (READ_ONCE(napi->poll_owner) == smp_processor_id())
 			return 1;
 	}
 	return 0;
@@ -626,17 +626,14 @@
 	const struct net_device_ops *ops;
 	int err;
 
-	np->dev = ndev;
-	strscpy(np->dev_name, ndev->name, IFNAMSIZ);
-
 	if (ndev->priv_flags & IFF_DISABLE_NETPOLL) {
 		np_err(np, "%s doesn't support polling, aborting\n",
-		       np->dev_name);
+		       ndev->name);
 		err = -ENOTSUPP;
 		goto out;
 	}
 
-	if (!ndev->npinfo) {
+	if (!rcu_access_pointer(ndev->npinfo)) {
 		npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL);
 		if (!npinfo) {
 			err = -ENOMEM;
@@ -649,7 +646,7 @@
 
 		refcount_set(&npinfo->refcnt, 1);
 
-		ops = np->dev->netdev_ops;
+		ops = ndev->netdev_ops;
 		if (ops->ndo_netpoll_setup) {
 			err = ops->ndo_netpoll_setup(ndev, npinfo);
 			if (err)
@@ -660,6 +657,8 @@
 		refcount_inc(&npinfo->refcnt);
 	}
 
+	np->dev = ndev;
+	strscpy(np->dev_name, ndev->name, IFNAMSIZ);
 	npinfo->netpoll = np;
 
 	/* last thing to do is link it to the net device structure */
@@ -677,6 +676,7 @@
 int netpoll_setup(struct netpoll *np)
 {
 	struct net_device *ndev = NULL;
+	bool ip_overwritten = false;
 	struct in_device *in_dev;
 	int err;
 
@@ -741,6 +741,7 @@
 			}
 
 			np->local_ip.ip = ifa->ifa_local;
+			ip_overwritten = true;
 			np_info(np, "local IP %pI4\n", &np->local_ip.ip);
 		} else {
 #if IS_ENABLED(CONFIG_IPV6)
@@ -757,6 +758,7 @@
 					    !!(ipv6_addr_type(&np->remote_ip.in6) & IPV6_ADDR_LINKLOCAL))
 						continue;
 					np->local_ip.in6 = ifp->addr;
+					ip_overwritten = true;
 					err = 0;
 					break;
 				}
@@ -787,6 +789,9 @@
 	return 0;
 
 put:
+	DEBUG_NET_WARN_ON_ONCE(np->dev);
+	if (ip_overwritten)
+		memset(&np->local_ip, 0, sizeof(np->local_ip));
 	netdev_put(ndev, &np->dev_tracker);
 unlock:
 	rtnl_unlock();
--- linux-qcom-6.8.0.orig/net/core/page_pool.c
+++ linux-qcom-6.8.0/net/core/page_pool.c
@@ -393,7 +393,7 @@
 	return true;
 
 unmap_failed:
-	WARN_ON_ONCE("unexpected DMA address, please report to netdev@");
+	WARN_ONCE(1, "unexpected DMA address, please report to netdev@");
 	dma_unmap_page_attrs(pool->p.dev, dma,
 			     PAGE_SIZE << pool->p.order, pool->p.dma_dir,
 			     DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_WEAK_ORDERING);
--- linux-qcom-6.8.0.orig/net/core/page_pool_user.c
+++ linux-qcom-6.8.0/net/core/page_pool_user.c
@@ -103,8 +103,6 @@
 	mutex_unlock(&page_pools_lock);
 	rtnl_unlock();
 
-	if (skb->len && err == -EMSGSIZE)
-		return skb->len;
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/net/core/pktgen.c
+++ linux-qcom-6.8.0/net/core/pktgen.c
@@ -168,6 +168,7 @@
 #include <linux/io.h>
 #include <linux/timex.h>
 #include <linux/uaccess.h>
+#include <linux/cpu.h>
 #include <asm/dma.h>
 #include <asm/div64.h>		/* do_div */
 
@@ -851,6 +852,9 @@
 		unsigned long weight;
 		unsigned long size;
 
+		if (pkt_dev->n_imix_entries >= MAX_IMIX_ENTRIES)
+			return -E2BIG;
+
 		len = num_arg(&buffer[i], max_digits, &size);
 		if (len < 0)
 			return len;
@@ -880,9 +884,6 @@
 
 		i++;
 		pkt_dev->n_imix_entries++;
-
-		if (pkt_dev->n_imix_entries > MAX_IMIX_ENTRIES)
-			return -E2BIG;
 	} while (c == ' ');
 
 	return i;
@@ -3654,7 +3655,7 @@
 	struct pktgen_dev *pkt_dev = NULL;
 	int cpu = t->cpu;
 
-	WARN_ON(smp_processor_id() != cpu);
+	WARN_ON_ONCE(smp_processor_id() != cpu);
 
 	init_waitqueue_head(&t->queue);
 	complete(&t->start_done);
@@ -3989,6 +3990,7 @@
 		goto remove;
 	}
 
+	cpus_read_lock();
 	for_each_online_cpu(cpu) {
 		int err;
 
@@ -3997,6 +3999,7 @@
 			pr_warn("Cannot create thread for cpu %d (%d)\n",
 				   cpu, err);
 	}
+	cpus_read_unlock();
 
 	if (list_empty(&pn->pktgen_threads)) {
 		pr_err("Initialization failed for all threads\n");
--- linux-qcom-6.8.0.orig/net/core/rtnetlink.c
+++ linux-qcom-6.8.0/net/core/rtnetlink.c
@@ -384,6 +384,35 @@
 }
 EXPORT_SYMBOL_GPL(rtnl_unregister_all);
 
+int __rtnl_register_many(const struct rtnl_msg_handler *handlers, int n)
+{
+	const struct rtnl_msg_handler *handler;
+	int i, err;
+
+	for (i = 0, handler = handlers; i < n; i++, handler++) {
+		err = rtnl_register_internal(handler->owner, handler->protocol,
+					     handler->msgtype, handler->doit,
+					     handler->dumpit, handler->flags);
+		if (err) {
+			__rtnl_unregister_many(handlers, i);
+			break;
+		}
+	}
+
+	return err;
+}
+EXPORT_SYMBOL_GPL(__rtnl_register_many);
+
+void __rtnl_unregister_many(const struct rtnl_msg_handler *handlers, int n)
+{
+	const struct rtnl_msg_handler *handler;
+	int i;
+
+	for (i = n - 1, handler = handlers + n - 1; i >= 0; i--, handler--)
+		rtnl_unregister(handler->protocol, handler->msgtype);
+}
+EXPORT_SYMBOL_GPL(__rtnl_unregister_many);
+
 static LIST_HEAD(link_ops);
 
 static const struct rtnl_link_ops *rtnl_link_ops_get(const char *kind)
@@ -875,9 +904,9 @@
 		break;
 	}
 
-	if (dev->operstate != operstate) {
+	if (READ_ONCE(dev->operstate) != operstate) {
 		write_lock(&dev_base_lock);
-		dev->operstate = operstate;
+		WRITE_ONCE(dev->operstate, operstate);
 		write_unlock(&dev_base_lock);
 		netdev_state_change(dev);
 	}
@@ -1988,7 +2017,7 @@
 	[IFLA_NUM_TX_QUEUES]	= { .type = NLA_U32 },
 	[IFLA_NUM_RX_QUEUES]	= { .type = NLA_U32 },
 	[IFLA_GSO_MAX_SEGS]	= { .type = NLA_U32 },
-	[IFLA_GSO_MAX_SIZE]	= { .type = NLA_U32 },
+	[IFLA_GSO_MAX_SIZE]	= NLA_POLICY_MIN(NLA_U32, MAX_TCP_HEADER + 1),
 	[IFLA_PHYS_PORT_ID]	= { .type = NLA_BINARY, .len = MAX_PHYS_ITEM_ID_LEN },
 	[IFLA_CARRIER_CHANGES]	= { .type = NLA_U32 },  /* ignored */
 	[IFLA_PHYS_SWITCH_ID]	= { .type = NLA_BINARY, .len = MAX_PHYS_ITEM_ID_LEN },
@@ -2013,7 +2042,7 @@
 	[IFLA_TSO_MAX_SIZE]	= { .type = NLA_REJECT },
 	[IFLA_TSO_MAX_SEGS]	= { .type = NLA_REJECT },
 	[IFLA_ALLMULTI]		= { .type = NLA_REJECT },
-	[IFLA_GSO_IPV4_MAX_SIZE]	= { .type = NLA_U32 },
+	[IFLA_GSO_IPV4_MAX_SIZE]	= NLA_POLICY_MIN(NLA_U32, MAX_TCP_HEADER + 1),
 	[IFLA_GRO_IPV4_MAX_SIZE]	= { .type = NLA_U32 },
 };
 
@@ -2552,7 +2581,7 @@
 
 		nla_for_each_nested(attr, tb[IFLA_VF_VLAN_LIST], rem) {
 			if (nla_type(attr) != IFLA_VF_VLAN_INFO ||
-			    nla_len(attr) < NLA_HDRLEN) {
+			    nla_len(attr) < sizeof(struct ifla_vf_vlan_info)) {
 				return -EINVAL;
 			}
 			if (len >= MAX_VLAN_LIST_LEN)
@@ -3296,7 +3325,7 @@
 	if (ifm->ifi_index > 0)
 		dev = __dev_get_by_index(tgt_net, ifm->ifi_index);
 	else if (tb[IFLA_IFNAME] || tb[IFLA_ALT_IFNAME])
-		dev = rtnl_dev_get(net, tb);
+		dev = rtnl_dev_get(tgt_net, tb);
 	else if (tb[IFLA_GROUP])
 		err = rtnl_group_dellink(tgt_net, nla_get_u32(tb[IFLA_GROUP]));
 	else
@@ -6552,6 +6581,7 @@
 		}
 		owner = link->owner;
 		dumpit = link->dumpit;
+		flags = link->flags;
 
 		if (type == RTM_GETLINK - RTM_BASE)
 			min_dump_alloc = rtnl_calcit(skb, nlh);
@@ -6569,6 +6599,7 @@
 				.dump		= dumpit,
 				.min_dump_alloc	= min_dump_alloc,
 				.module		= owner,
+				.flags		= flags,
 			};
 			err = netlink_dump_start(rtnl, skb, nlh, &c);
 			/* netlink_dump_start() will keep a reference on
--- linux-qcom-6.8.0.orig/net/core/skbuff.c
+++ linux-qcom-6.8.0/net/core/skbuff.c
@@ -297,7 +297,7 @@
 
 	fragsz = SKB_DATA_ALIGN(fragsz);
 
-	return page_frag_alloc_align(&nc->page, fragsz, GFP_ATOMIC, align_mask);
+	return page_frag_alloc_align(&nc->page, fragsz, GFP_ATOMIC | __GFP_NOWARN, align_mask);
 }
 EXPORT_SYMBOL(__napi_alloc_frag_align);
 
@@ -309,13 +309,13 @@
 	if (in_hardirq() || irqs_disabled()) {
 		struct page_frag_cache *nc = this_cpu_ptr(&netdev_alloc_cache);
 
-		data = page_frag_alloc_align(nc, fragsz, GFP_ATOMIC, align_mask);
+		data = page_frag_alloc_align(nc, fragsz, GFP_ATOMIC | __GFP_NOWARN, align_mask);
 	} else {
 		struct napi_alloc_cache *nc;
 
 		local_bh_disable();
 		nc = this_cpu_ptr(&napi_alloc_cache);
-		data = page_frag_alloc_align(&nc->page, fragsz, GFP_ATOMIC, align_mask);
+		data = page_frag_alloc_align(&nc->page, fragsz, GFP_ATOMIC | __GFP_NOWARN, align_mask);
 		local_bh_enable();
 	}
 	return data;
@@ -329,7 +329,7 @@
 
 	if (unlikely(!nc->skb_count)) {
 		nc->skb_count = kmem_cache_alloc_bulk(skbuff_cache,
-						      GFP_ATOMIC,
+						      GFP_ATOMIC | __GFP_NOWARN,
 						      NAPI_SKB_CACHE_BULK,
 						      nc->skb_cache);
 		if (unlikely(!nc->skb_count))
@@ -395,7 +395,7 @@
 	struct sk_buff *skb;
 	unsigned int size;
 
-	skb = kmem_cache_alloc(skbuff_cache, GFP_ATOMIC);
+	skb = kmem_cache_alloc(skbuff_cache, GFP_ATOMIC | __GFP_NOWARN);
 	if (unlikely(!skb))
 		return NULL;
 
@@ -446,7 +446,7 @@
 {
 	struct sk_buff *skb;
 
-	skb = kmem_cache_alloc(skbuff_cache, GFP_ATOMIC);
+	skb = kmem_cache_alloc(skbuff_cache, GFP_ATOMIC | __GFP_NOWARN);
 	if (unlikely(!skb))
 		return NULL;
 
@@ -2014,11 +2014,17 @@
 
 struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
 {
-	int headerlen = skb_headroom(skb);
-	unsigned int size = skb_end_offset(skb) + skb->data_len;
-	struct sk_buff *n = __alloc_skb(size, gfp_mask,
-					skb_alloc_rx_flag(skb), NUMA_NO_NODE);
+	struct sk_buff *n;
+	unsigned int size;
+	int headerlen;
 
+	if (WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST))
+		return NULL;
+
+	headerlen = skb_headroom(skb);
+	size = skb_end_offset(skb) + skb->data_len;
+	n = __alloc_skb(size, gfp_mask,
+			skb_alloc_rx_flag(skb), NUMA_NO_NODE);
 	if (!n)
 		return NULL;
 
@@ -2346,12 +2352,17 @@
 	/*
 	 *	Allocate the copy buffer
 	 */
-	struct sk_buff *n = __alloc_skb(newheadroom + skb->len + newtailroom,
-					gfp_mask, skb_alloc_rx_flag(skb),
-					NUMA_NO_NODE);
-	int oldheadroom = skb_headroom(skb);
 	int head_copy_len, head_copy_off;
+	struct sk_buff *n;
+	int oldheadroom;
 
+	if (WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST))
+		return NULL;
+
+	oldheadroom = skb_headroom(skb);
+	n = __alloc_skb(newheadroom + skb->len + newtailroom,
+			gfp_mask, skb_alloc_rx_flag(skb),
+			NUMA_NO_NODE);
 	if (!n)
 		return NULL;
 
@@ -6737,6 +6748,14 @@
 			xfrm_state_hold(sp->xvec[i]);
 	}
 #endif
+#ifdef CONFIG_MCTP_FLOWS
+	if (old_active & (1 << SKB_EXT_MCTP)) {
+		struct mctp_flow *flow = skb_ext_get_ptr(old, SKB_EXT_MCTP);
+
+		if (flow->key)
+			refcount_inc(&flow->key->refs);
+	}
+#endif
 	__skb_ext_put(old);
 	return new;
 }
--- linux-qcom-6.8.0.orig/net/core/skmsg.c
+++ linux-qcom-6.8.0/net/core/skmsg.c
@@ -434,7 +434,8 @@
 			page = sg_page(sge);
 			if (copied + copy > len)
 				copy = len - copied;
-			copy = copy_page_to_iter(page, sge->offset, copy, iter);
+			if (copy)
+				copy = copy_page_to_iter(page, sge->offset, copy, iter);
 			if (!copy) {
 				copied = copied ? copied : -EFAULT;
 				goto out;
@@ -444,8 +445,10 @@
 			if (likely(!peek)) {
 				sge->offset += copy;
 				sge->length -= copy;
-				if (!msg_rx->skb)
+				if (!msg_rx->skb) {
 					sk_mem_uncharge(sk, copy);
+					atomic_sub(copy, &sk->sk_rmem_alloc);
+				}
 				msg_rx->sg.size -= copy;
 
 				if (!sge->length) {
@@ -771,6 +774,8 @@
 
 	list_for_each_entry_safe(msg, tmp, &psock->ingress_msg, list) {
 		list_del(&msg->list);
+		if (!msg->skb)
+			atomic_sub(msg->sg.size, &psock->sk->sk_rmem_alloc);
 		sk_msg_free(psock->sk, msg);
 		kfree(msg);
 	}
@@ -1116,9 +1121,9 @@
 		if (tls_sw_has_ctx_rx(sk)) {
 			psock->saved_data_ready(sk);
 		} else {
-			write_lock_bh(&sk->sk_callback_lock);
+			read_lock_bh(&sk->sk_callback_lock);
 			strp_data_ready(&psock->strp);
-			write_unlock_bh(&sk->sk_callback_lock);
+			read_unlock_bh(&sk->sk_callback_lock);
 		}
 	}
 	rcu_read_unlock();
@@ -1226,11 +1231,8 @@
 
 		rcu_read_lock();
 		psock = sk_psock(sk);
-		if (psock) {
-			read_lock_bh(&sk->sk_callback_lock);
+		if (psock)
 			sk_psock_data_ready(sk, psock);
-			read_unlock_bh(&sk->sk_callback_lock);
-		}
 		rcu_read_unlock();
 	}
 }
--- linux-qcom-6.8.0.orig/net/core/sock.c
+++ linux-qcom-6.8.0/net/core/sock.c
@@ -283,6 +283,7 @@
 EXPORT_SYMBOL(sysctl_rmem_max);
 __u32 sysctl_wmem_default __read_mostly = SK_WMEM_MAX;
 __u32 sysctl_rmem_default __read_mostly = SK_RMEM_MAX;
+int sysctl_mem_pcpu_rsv __read_mostly = SK_MEMORY_PCPU_RESERVE;
 
 int sysctl_tstamp_allow_data __read_mostly = 1;
 
@@ -481,7 +482,7 @@
 	unsigned long flags;
 	struct sk_buff_head *list = &sk->sk_receive_queue;
 
-	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) {
+	if (atomic_read(&sk->sk_rmem_alloc) >= READ_ONCE(sk->sk_rcvbuf)) {
 		atomic_inc(&sk->sk_drops);
 		trace_sock_rcvqueue_full(sk, skb);
 		return -ENOMEM;
@@ -551,7 +552,7 @@
 
 	skb->dev = NULL;
 
-	if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
+	if (sk_rcvqueues_full(sk, READ_ONCE(sk->sk_rcvbuf))) {
 		atomic_inc(&sk->sk_drops);
 		goto discard_and_relse;
 	}
@@ -1082,6 +1083,17 @@
 }
 EXPORT_SYMBOL(sockopt_capable);
 
+static int sockopt_validate_clockid(__kernel_clockid_t value)
+{
+	switch (value) {
+	case CLOCK_REALTIME:
+	case CLOCK_MONOTONIC:
+	case CLOCK_TAI:
+		return 0;
+	}
+	return -EINVAL;
+}
+
 /*
  *	This is meant for all protocols to use and covers goings on
  *	at the socket level. Everything here is generic.
@@ -1214,7 +1226,10 @@
 		sk->sk_reuse = (valbool ? SK_CAN_REUSE : SK_NO_REUSE);
 		break;
 	case SO_REUSEPORT:
-		sk->sk_reuseport = valbool;
+		if (valbool && !sk_is_inet(sk))
+			ret = -EOPNOTSUPP;
+		else
+			sk->sk_reuseport = valbool;
 		break;
 	case SO_DONTROUTE:
 		sock_valbool_flag(sk, SOCK_LOCALROUTE, valbool);
@@ -1496,6 +1511,11 @@
 			ret = -EPERM;
 			break;
 		}
+
+		ret = sockopt_validate_clockid(sk_txtime.clockid);
+		if (ret)
+			break;
+
 		sock_valbool_flag(sk, SOCK_TXTIME, true);
 		sk->sk_clockid = sk_txtime.clockid;
 		sk->sk_txtime_deadline_mode =
@@ -3731,6 +3751,9 @@
 
 	sk->sk_prot->unhash(sk);
 
+	if (sk->sk_socket)
+		sk->sk_socket->sk = NULL;
+
 	/*
 	 * In this point socket cannot receive new packets, but it is possible
 	 * that some packets are in flight because some CPU runs receiver and
--- linux-qcom-6.8.0.orig/net/core/sock_diag.c
+++ linux-qcom-6.8.0/net/core/sock_diag.c
@@ -16,9 +16,10 @@
 #include <linux/inet_diag.h>
 #include <linux/sock_diag.h>
 
-static const struct sock_diag_handler *sock_diag_handlers[AF_MAX];
-static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh);
-static DEFINE_MUTEX(sock_diag_table_mutex);
+static const struct sock_diag_handler __rcu *sock_diag_handlers[AF_MAX];
+
+static const struct sock_diag_inet_compat __rcu *inet_rcv_compat;
+
 static struct workqueue_struct *broadcast_wq;
 
 DEFINE_COOKIE(sock_cookie);
@@ -122,6 +123,24 @@
 	       + nla_total_size_64bit(sizeof(struct tcp_info))); /* INET_DIAG_INFO */
 }
 
+static const struct sock_diag_handler *sock_diag_lock_handler(int family)
+{
+	const struct sock_diag_handler *handler;
+
+	rcu_read_lock();
+	handler = rcu_dereference(sock_diag_handlers[family]);
+	if (handler && !try_module_get(handler->owner))
+		handler = NULL;
+	rcu_read_unlock();
+
+	return handler;
+}
+
+static void sock_diag_unlock_handler(const struct sock_diag_handler *handler)
+{
+	module_put(handler->owner);
+}
+
 static void sock_diag_broadcast_destroy_work(struct work_struct *work)
 {
 	struct broadcast_sk *bsk =
@@ -138,12 +157,12 @@
 	if (!skb)
 		goto out;
 
-	mutex_lock(&sock_diag_table_mutex);
-	hndl = sock_diag_handlers[sk->sk_family];
-	if (hndl && hndl->get_info)
-		err = hndl->get_info(skb, sk);
-	mutex_unlock(&sock_diag_table_mutex);
-
+	hndl = sock_diag_lock_handler(sk->sk_family);
+	if (hndl) {
+		if (hndl->get_info)
+			err = hndl->get_info(skb, sk);
+		sock_diag_unlock_handler(hndl);
+	}
 	if (!err)
 		nlmsg_multicast(sock_net(sk)->diag_nlsk, skb, 0, group,
 				GFP_KERNEL);
@@ -166,51 +185,43 @@
 	queue_work(broadcast_wq, &bsk->work);
 }
 
-void sock_diag_register_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh))
+void sock_diag_register_inet_compat(const struct sock_diag_inet_compat *ptr)
 {
-	mutex_lock(&sock_diag_table_mutex);
-	inet_rcv_compat = fn;
-	mutex_unlock(&sock_diag_table_mutex);
+	xchg(&inet_rcv_compat, RCU_INITIALIZER(ptr));
 }
 EXPORT_SYMBOL_GPL(sock_diag_register_inet_compat);
 
-void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh))
+void sock_diag_unregister_inet_compat(const struct sock_diag_inet_compat *ptr)
 {
-	mutex_lock(&sock_diag_table_mutex);
-	inet_rcv_compat = NULL;
-	mutex_unlock(&sock_diag_table_mutex);
+	const struct sock_diag_inet_compat *old;
+
+	old = unrcu_pointer(xchg(&inet_rcv_compat, NULL));
+	WARN_ON_ONCE(old != ptr);
 }
 EXPORT_SYMBOL_GPL(sock_diag_unregister_inet_compat);
 
 int sock_diag_register(const struct sock_diag_handler *hndl)
 {
-	int err = 0;
+	int family = hndl->family;
 
-	if (hndl->family >= AF_MAX)
+	if (family >= AF_MAX)
 		return -EINVAL;
 
-	mutex_lock(&sock_diag_table_mutex);
-	if (sock_diag_handlers[hndl->family])
-		err = -EBUSY;
-	else
-		sock_diag_handlers[hndl->family] = hndl;
-	mutex_unlock(&sock_diag_table_mutex);
-
-	return err;
+	return !cmpxchg((const struct sock_diag_handler **)
+				&sock_diag_handlers[family],
+			NULL, hndl) ? 0 : -EBUSY;
 }
 EXPORT_SYMBOL_GPL(sock_diag_register);
 
-void sock_diag_unregister(const struct sock_diag_handler *hnld)
+void sock_diag_unregister(const struct sock_diag_handler *hndl)
 {
-	int family = hnld->family;
+	int family = hndl->family;
 
 	if (family >= AF_MAX)
 		return;
 
-	mutex_lock(&sock_diag_table_mutex);
-	BUG_ON(sock_diag_handlers[family] != hnld);
-	sock_diag_handlers[family] = NULL;
-	mutex_unlock(&sock_diag_table_mutex);
+	xchg((const struct sock_diag_handler **)&sock_diag_handlers[family],
+	     NULL);
 }
 EXPORT_SYMBOL_GPL(sock_diag_unregister);
 
@@ -227,20 +238,20 @@
 		return -EINVAL;
 	req->sdiag_family = array_index_nospec(req->sdiag_family, AF_MAX);
 
-	if (sock_diag_handlers[req->sdiag_family] == NULL)
+	if (!rcu_access_pointer(sock_diag_handlers[req->sdiag_family]))
 		sock_load_diag_module(req->sdiag_family, 0);
 
-	mutex_lock(&sock_diag_table_mutex);
-	hndl = sock_diag_handlers[req->sdiag_family];
+	hndl = sock_diag_lock_handler(req->sdiag_family);
 	if (hndl == NULL)
-		err = -ENOENT;
-	else if (nlh->nlmsg_type == SOCK_DIAG_BY_FAMILY)
+		return -ENOENT;
+
+	if (nlh->nlmsg_type == SOCK_DIAG_BY_FAMILY)
 		err = hndl->dump(skb, nlh);
 	else if (nlh->nlmsg_type == SOCK_DESTROY && hndl->destroy)
 		err = hndl->destroy(skb, nlh);
 	else
 		err = -EOPNOTSUPP;
-	mutex_unlock(&sock_diag_table_mutex);
+	sock_diag_unlock_handler(hndl);
 
 	return err;
 }
@@ -248,20 +259,27 @@
 static int sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
 			     struct netlink_ext_ack *extack)
 {
+	const struct sock_diag_inet_compat *ptr;
 	int ret;
 
 	switch (nlh->nlmsg_type) {
 	case TCPDIAG_GETSOCK:
 	case DCCPDIAG_GETSOCK:
-		if (inet_rcv_compat == NULL)
+
+		if (!rcu_access_pointer(inet_rcv_compat))
 			sock_load_diag_module(AF_INET, 0);
 
-		mutex_lock(&sock_diag_table_mutex);
-		if (inet_rcv_compat != NULL)
-			ret = inet_rcv_compat(skb, nlh);
-		else
-			ret = -EOPNOTSUPP;
-		mutex_unlock(&sock_diag_table_mutex);
+		rcu_read_lock();
+		ptr = rcu_dereference(inet_rcv_compat);
+		if (ptr && !try_module_get(ptr->owner))
+			ptr = NULL;
+		rcu_read_unlock();
+
+		ret = -EOPNOTSUPP;
+		if (ptr) {
+			ret = ptr->fn(skb, nlh);
+			module_put(ptr->owner);
+		}
 
 		return ret;
 	case SOCK_DIAG_BY_FAMILY:
@@ -286,12 +304,12 @@
 	switch (group) {
 	case SKNLGRP_INET_TCP_DESTROY:
 	case SKNLGRP_INET_UDP_DESTROY:
-		if (!sock_diag_handlers[AF_INET])
+		if (!rcu_access_pointer(sock_diag_handlers[AF_INET]))
 			sock_load_diag_module(AF_INET, 0);
 		break;
 	case SKNLGRP_INET6_TCP_DESTROY:
 	case SKNLGRP_INET6_UDP_DESTROY:
-		if (!sock_diag_handlers[AF_INET6])
+		if (!rcu_access_pointer(sock_diag_handlers[AF_INET6]))
 			sock_load_diag_module(AF_INET6, 0);
 		break;
 	}
--- linux-qcom-6.8.0.orig/net/core/sock_map.c
+++ linux-qcom-6.8.0/net/core/sock_map.c
@@ -156,6 +156,7 @@
 				verdict_stop = true;
 			list_del(&link->list);
 			sk_psock_free_link(link);
+			break;
 		}
 	}
 	spin_unlock_bh(&psock->link_lock);
@@ -408,12 +409,11 @@
 static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
 			     struct sock **psk)
 {
-	struct sock *sk;
+	struct sock *sk = NULL;
 	int err = 0;
 
 	spin_lock_bh(&stab->lock);
-	sk = *psk;
-	if (!sk_test || sk_test == sk)
+	if (!sk_test || sk_test == *psk)
 		sk = xchg(psk, NULL);
 
 	if (likely(sk))
@@ -644,6 +644,8 @@
 	sk = __sock_map_lookup_elem(map, key);
 	if (unlikely(!sk || !sock_map_redirect_allowed(sk)))
 		return SK_DROP;
+	if ((flags & BPF_F_INGRESS) && sk_is_vsock(sk))
+		return SK_DROP;
 
 	skb_bpf_set_redir(skb, sk, flags & BPF_F_INGRESS);
 	return SK_PASS;
@@ -672,6 +674,8 @@
 		return SK_DROP;
 	if (!(flags & BPF_F_INGRESS) && !sk_is_tcp(sk))
 		return SK_DROP;
+	if (sk_is_vsock(sk))
+		return SK_DROP;
 
 	msg->flags = flags;
 	msg->sk_redir = sk;
@@ -1171,6 +1175,7 @@
 			sock_put(elem->sk);
 			sock_hash_free_elem(htab, elem);
 		}
+		cond_resched();
 	}
 
 	/* wait for psock readers accessing its map link */
@@ -1245,6 +1250,8 @@
 	sk = __sock_hash_lookup_elem(map, key);
 	if (unlikely(!sk || !sock_map_redirect_allowed(sk)))
 		return SK_DROP;
+	if ((flags & BPF_F_INGRESS) && sk_is_vsock(sk))
+		return SK_DROP;
 
 	skb_bpf_set_redir(skb, sk, flags & BPF_F_INGRESS);
 	return SK_PASS;
@@ -1273,6 +1280,8 @@
 		return SK_DROP;
 	if (!(flags & BPF_F_INGRESS) && !sk_is_tcp(sk))
 		return SK_DROP;
+	if (sk_is_vsock(sk))
+		return SK_DROP;
 
 	msg->flags = flags;
 	msg->sk_redir = sk;
@@ -1633,19 +1642,23 @@
 
 	lock_sock(sk);
 	rcu_read_lock();
-	psock = sk_psock_get(sk);
-	if (unlikely(!psock)) {
-		rcu_read_unlock();
-		release_sock(sk);
-		saved_close = READ_ONCE(sk->sk_prot)->close;
-	} else {
+	psock = sk_psock(sk);
+	if (likely(psock)) {
 		saved_close = psock->saved_close;
 		sock_map_remove_links(sk, psock);
+		psock = sk_psock_get(sk);
+		if (unlikely(!psock))
+			goto no_psock;
 		rcu_read_unlock();
 		sk_psock_stop(psock);
 		release_sock(sk);
 		cancel_delayed_work_sync(&psock->work);
 		sk_psock_put(sk, psock);
+	} else {
+		saved_close = READ_ONCE(sk->sk_prot)->close;
+no_psock:
+		rcu_read_unlock();
+		release_sock(sk);
 	}
 
 	/* Make sure we do not recurse. This is a bug.
--- linux-qcom-6.8.0.orig/net/core/sysctl_net_core.c
+++ linux-qcom-6.8.0/net/core/sysctl_net_core.c
@@ -30,6 +30,7 @@
 static int min_sndbuf = SOCK_MIN_SNDBUF;
 static int min_rcvbuf = SOCK_MIN_RCVBUF;
 static int max_skb_frags = MAX_SKB_FRAGS;
+static int min_mem_pcpu_rsv = SK_MEMORY_PCPU_RESERVE;
 
 static int net_msg_warn;	/* Unused, but still a sysctl */
 
@@ -408,6 +409,14 @@
 		.extra1		= &min_rcvbuf,
 	},
 	{
+		.procname	= "mem_pcpu_rsv",
+		.data		= &sysctl_mem_pcpu_rsv,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= &min_mem_pcpu_rsv,
+	},
+	{
 		.procname	= "dev_weight",
 		.data		= &weight_p,
 		.maxlen		= sizeof(int),
--- linux-qcom-6.8.0.orig/net/core/xdp.c
+++ linux-qcom-6.8.0/net/core/xdp.c
@@ -126,10 +126,8 @@
 		return;
 
 	if (type == MEM_TYPE_PAGE_POOL) {
-		rcu_read_lock();
-		xa = rhashtable_lookup(mem_id_ht, &id, mem_id_rht_params);
+		xa = rhashtable_lookup_fast(mem_id_ht, &id, mem_id_rht_params);
 		page_pool_destroy(xa->page_pool);
-		rcu_read_unlock();
 	}
 }
 EXPORT_SYMBOL_GPL(xdp_unreg_mem_model);
@@ -294,10 +292,8 @@
 		mutex_lock(&mem_id_lock);
 		ret = __mem_id_init_hash_table();
 		mutex_unlock(&mem_id_lock);
-		if (ret < 0) {
-			WARN_ON(1);
+		if (ret < 0)
 			return ERR_PTR(ret);
-		}
 	}
 
 	xdp_alloc = kzalloc(sizeof(*xdp_alloc), gfp);
--- linux-qcom-6.8.0.orig/net/dccp/feat.c
+++ linux-qcom-6.8.0/net/dccp/feat.c
@@ -1166,8 +1166,12 @@
 			goto not_valid_or_not_known;
 		}
 
-		return dccp_feat_push_confirm(fn, feat, local, &fval);
+		if (dccp_feat_push_confirm(fn, feat, local, &fval)) {
+			kfree(fval.sp.vec);
+			return DCCP_RESET_CODE_TOO_BUSY;
+		}
 
+		return 0;
 	} else if (entry->state == FEAT_UNSTABLE) {	/* 6.6.2 */
 		return 0;
 	}
--- linux-qcom-6.8.0.orig/net/dccp/ipv4.c
+++ linux-qcom-6.8.0/net/dccp/ipv4.c
@@ -655,8 +655,11 @@
 	if (dccp_v4_send_response(sk, req))
 		goto drop_and_free;
 
-	inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
-	reqsk_put(req);
+	if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT)))
+		reqsk_free(req);
+	else
+		reqsk_put(req);
+
 	return 0;
 
 drop_and_free:
@@ -1039,7 +1042,7 @@
 
 static void __net_exit dccp_v4_exit_batch(struct list_head *net_exit_list)
 {
-	inet_twsk_purge(&dccp_hashinfo, AF_INET);
+	inet_twsk_purge(&dccp_hashinfo);
 }
 
 static struct pernet_operations dccp_v4_ops = {
--- linux-qcom-6.8.0.orig/net/dccp/ipv6.c
+++ linux-qcom-6.8.0/net/dccp/ipv6.c
@@ -398,8 +398,11 @@
 	if (dccp_v6_send_response(sk, req))
 		goto drop_and_free;
 
-	inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
-	reqsk_put(req);
+	if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT)))
+		reqsk_free(req);
+	else
+		reqsk_put(req);
+
 	return 0;
 
 drop_and_free:
@@ -613,7 +616,7 @@
 	   by tcp. Feel free to propose better solution.
 					       --ANK (980728)
 	 */
-	if (np->rxopt.all)
+	if (np->rxopt.all && sk->sk_state != DCCP_LISTEN)
 		opt_skb = skb_clone_and_charge_r(skb, sk);
 
 	if (sk->sk_state == DCCP_OPEN) { /* Fast path */
@@ -1119,15 +1122,9 @@
 	inet_ctl_sock_destroy(pn->v6_ctl_sk);
 }
 
-static void __net_exit dccp_v6_exit_batch(struct list_head *net_exit_list)
-{
-	inet_twsk_purge(&dccp_hashinfo, AF_INET6);
-}
-
 static struct pernet_operations dccp_v6_ops = {
 	.init   = dccp_v6_init_net,
 	.exit   = dccp_v6_exit_net,
-	.exit_batch = dccp_v6_exit_batch,
 	.id	= &dccp_v6_pernet_id,
 	.size   = sizeof(struct dccp_v6_pernet),
 };
--- linux-qcom-6.8.0.orig/net/dccp/minisocks.c
+++ linux-qcom-6.8.0/net/dccp/minisocks.c
@@ -58,11 +58,10 @@
 		 * we complete the initialization.
 		 */
 		local_bh_disable();
-		inet_twsk_schedule(tw, timeo);
 		/* Linkage updates.
 		 * Note that access to tw after this point is illegal.
 		 */
-		inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
+		inet_twsk_hashdance_schedule(tw, sk, &dccp_hashinfo, timeo);
 		local_bh_enable();
 	} else {
 		/* Sorry, if we're out of memory, just CLOSE this
@@ -94,6 +93,8 @@
 
 		newdp->dccps_role	    = DCCP_ROLE_SERVER;
 		newdp->dccps_hc_rx_ackvec   = NULL;
+		newdp->dccps_hc_rx_ccid = NULL;
+		newdp->dccps_hc_tx_ccid = NULL;
 		newdp->dccps_service_list   = NULL;
 		newdp->dccps_hc_rx_ccid     = NULL;
 		newdp->dccps_hc_tx_ccid     = NULL;
--- linux-qcom-6.8.0.orig/net/devlink/core.c
+++ linux-qcom-6.8.0/net/devlink/core.c
@@ -314,7 +314,7 @@
 	mutex_destroy(&devlink->lock);
 	lockdep_unregister_key(&devlink->lock_key);
 	put_device(devlink->dev);
-	kfree(devlink);
+	kvfree(devlink);
 }
 
 void devlink_put(struct devlink *devlink)
@@ -420,7 +420,7 @@
 	if (!devlink_reload_actions_valid(ops))
 		return NULL;
 
-	devlink = kzalloc(sizeof(*devlink) + priv_size, GFP_KERNEL);
+	devlink = kvzalloc(struct_size(devlink, priv, priv_size), GFP_KERNEL);
 	if (!devlink)
 		return NULL;
 
@@ -455,7 +455,7 @@
 	return devlink;
 
 err_xa_alloc:
-	kfree(devlink);
+	kvfree(devlink);
 	return NULL;
 }
 EXPORT_SYMBOL_GPL(devlink_alloc_ns);
--- linux-qcom-6.8.0.orig/net/devlink/netlink.c
+++ linux-qcom-6.8.0/net/devlink/netlink.c
@@ -193,12 +193,13 @@
 	devname = nla_data(attrs[DEVLINK_ATTR_DEV_NAME]);
 
 	devlinks_xa_for_each_registered_get(net, index, devlink) {
-		devl_dev_lock(devlink, dev_lock);
-		if (devl_is_registered(devlink) &&
-		    strcmp(devlink->dev->bus->name, busname) == 0 &&
-		    strcmp(dev_name(devlink->dev), devname) == 0)
-			return devlink;
-		devl_dev_unlock(devlink, dev_lock);
+		if (strcmp(devlink->dev->bus->name, busname) == 0 &&
+		    strcmp(dev_name(devlink->dev), devname) == 0) {
+			devl_dev_lock(devlink, dev_lock);
+			if (devl_is_registered(devlink))
+				return devlink;
+			devl_dev_unlock(devlink, dev_lock);
+		}
 		devlink_put(devlink);
 	}
 
--- linux-qcom-6.8.0.orig/net/devlink/netlink_gen.c
+++ linux-qcom-6.8.0/net/devlink/netlink_gen.c
@@ -198,7 +198,7 @@
 	[DEVLINK_ATTR_BUS_NAME] = { .type = NLA_NUL_STRING, },
 	[DEVLINK_ATTR_DEV_NAME] = { .type = NLA_NUL_STRING, },
 	[DEVLINK_ATTR_ESWITCH_MODE] = NLA_POLICY_MAX(NLA_U16, 1),
-	[DEVLINK_ATTR_ESWITCH_INLINE_MODE] = NLA_POLICY_MAX(NLA_U16, 3),
+	[DEVLINK_ATTR_ESWITCH_INLINE_MODE] = NLA_POLICY_MAX(NLA_U8, 3),
 	[DEVLINK_ATTR_ESWITCH_ENCAP_MODE] = NLA_POLICY_MAX(NLA_U8, 1),
 };
 
--- linux-qcom-6.8.0.orig/net/devlink/port.c
+++ linux-qcom-6.8.0/net/devlink/port.c
@@ -889,7 +889,7 @@
 		err = -ENOMEM;
 		goto err_out_port_del;
 	}
-	err = devlink_nl_port_fill(msg, devlink_port, DEVLINK_CMD_NEW,
+	err = devlink_nl_port_fill(msg, devlink_port, DEVLINK_CMD_PORT_NEW,
 				   info->snd_portid, info->snd_seq, 0, NULL);
 	if (WARN_ON_ONCE(err))
 		goto err_out_msg_free;
--- linux-qcom-6.8.0.orig/net/dsa/dsa.c
+++ linux-qcom-6.8.0/net/dsa/dsa.c
@@ -1574,6 +1574,7 @@
 void dsa_switch_shutdown(struct dsa_switch *ds)
 {
 	struct net_device *conduit, *user_dev;
+	LIST_HEAD(close_list);
 	struct dsa_port *dp;
 
 	mutex_lock(&dsa2_mutex);
@@ -1583,10 +1584,16 @@
 
 	rtnl_lock();
 
+	dsa_switch_for_each_cpu_port(dp, ds)
+		list_add(&dp->conduit->close_list, &close_list);
+
+	dev_close_many(&close_list, true);
+
 	dsa_switch_for_each_user_port(dp, ds) {
 		conduit = dsa_port_to_conduit(dp);
 		user_dev = dp->user;
 
+		netif_device_detach(user_dev);
 		netdev_upper_dev_unlink(conduit, user_dev);
 	}
 
--- linux-qcom-6.8.0.orig/net/dsa/tag_ocelot.c
+++ linux-qcom-6.8.0/net/dsa/tag_ocelot.c
@@ -8,40 +8,6 @@
 #define OCELOT_NAME	"ocelot"
 #define SEVILLE_NAME	"seville"
 
-/* If the port is under a VLAN-aware bridge, remove the VLAN header from the
- * payload and move it into the DSA tag, which will make the switch classify
- * the packet to the bridge VLAN. Otherwise, leave the classified VLAN at zero,
- * which is the pvid of standalone and VLAN-unaware bridge ports.
- */
-static void ocelot_xmit_get_vlan_info(struct sk_buff *skb, struct dsa_port *dp,
-				      u64 *vlan_tci, u64 *tag_type)
-{
-	struct net_device *br = dsa_port_bridge_dev_get(dp);
-	struct vlan_ethhdr *hdr;
-	u16 proto, tci;
-
-	if (!br || !br_vlan_enabled(br)) {
-		*vlan_tci = 0;
-		*tag_type = IFH_TAG_TYPE_C;
-		return;
-	}
-
-	hdr = skb_vlan_eth_hdr(skb);
-	br_vlan_get_proto(br, &proto);
-
-	if (ntohs(hdr->h_vlan_proto) == proto) {
-		vlan_remove_tag(skb, &tci);
-		*vlan_tci = tci;
-	} else {
-		rcu_read_lock();
-		br_vlan_get_pvid_rcu(br, &tci);
-		rcu_read_unlock();
-		*vlan_tci = tci;
-	}
-
-	*tag_type = (proto != ETH_P_8021Q) ? IFH_TAG_TYPE_S : IFH_TAG_TYPE_C;
-}
-
 static void ocelot_xmit_common(struct sk_buff *skb, struct net_device *netdev,
 			       __be32 ifh_prefix, void **ifh)
 {
@@ -53,7 +19,8 @@
 	u32 rew_op = 0;
 	u64 qos_class;
 
-	ocelot_xmit_get_vlan_info(skb, dp, &vlan_tci, &tag_type);
+	ocelot_xmit_get_vlan_info(skb, dsa_port_bridge_dev_get(dp), &vlan_tci,
+				  &tag_type);
 
 	qos_class = netdev_get_num_tc(netdev) ?
 		    netdev_get_prio_tc_map(netdev, skb->priority) : skb->priority;
--- linux-qcom-6.8.0.orig/net/dsa/user.c
+++ linux-qcom-6.8.0/net/dsa/user.c
@@ -1389,6 +1389,14 @@
 	if (!dsa_user_dev_check(act->dev))
 		return -EOPNOTSUPP;
 
+	to_dp = dsa_user_to_port(act->dev);
+
+	if (dp->ds != to_dp->ds) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "Cross-chip mirroring not implemented");
+		return -EOPNOTSUPP;
+	}
+
 	mall_tc_entry = kzalloc(sizeof(*mall_tc_entry), GFP_KERNEL);
 	if (!mall_tc_entry)
 		return -ENOMEM;
@@ -1396,9 +1404,6 @@
 	mall_tc_entry->cookie = cls->cookie;
 	mall_tc_entry->type = DSA_PORT_MALL_MIRROR;
 	mirror = &mall_tc_entry->mirror;
-
-	to_dp = dsa_user_to_port(act->dev);
-
 	mirror->to_local_port = to_dp->index;
 	mirror->ingress = ingress;
 
--- linux-qcom-6.8.0.orig/net/ethernet/eth.c
+++ linux-qcom-6.8.0/net/ethernet/eth.c
@@ -161,20 +161,8 @@
 	skb->dev = dev;
 	skb_reset_mac_header(skb);
 
-	eth = (struct ethhdr *)skb->data;
-	skb_pull_inline(skb, ETH_HLEN);
-
-	if (unlikely(!ether_addr_equal_64bits(eth->h_dest,
-					      dev->dev_addr))) {
-		if (unlikely(is_multicast_ether_addr_64bits(eth->h_dest))) {
-			if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
-				skb->pkt_type = PACKET_BROADCAST;
-			else
-				skb->pkt_type = PACKET_MULTICAST;
-		} else {
-			skb->pkt_type = PACKET_OTHERHOST;
-		}
-	}
+	eth = eth_skb_pull_mac(skb);
+	eth_skb_pkt_type(skb, dev);
 
 	/*
 	 * Some variants of DSA tagging don't have an ethertype field
--- linux-qcom-6.8.0.orig/net/ethtool/bitset.c
+++ linux-qcom-6.8.0/net/ethtool/bitset.c
@@ -425,12 +425,32 @@
 	return 0;
 }
 
+/**
+ * ethnl_bitmap32_equal() - Compare two bitmaps
+ * @map1:  first bitmap
+ * @map2:  second bitmap
+ * @nbits: bit size to compare
+ *
+ * Return: true if first @nbits are equal, false if not
+ */
+static bool ethnl_bitmap32_equal(const u32 *map1, const u32 *map2,
+				 unsigned int nbits)
+{
+	if (memcmp(map1, map2, nbits / 32 * sizeof(u32)))
+		return false;
+	if (nbits % 32 == 0)
+		return true;
+	return !((map1[nbits / 32] ^ map2[nbits / 32]) &
+		 ethnl_lower_bits(nbits % 32));
+}
+
 static int
 ethnl_update_bitset32_verbose(u32 *bitmap, unsigned int nbits,
 			      const struct nlattr *attr, struct nlattr **tb,
 			      ethnl_string_array_t names,
 			      struct netlink_ext_ack *extack, bool *mod)
 {
+	u32 *saved_bitmap = NULL;
 	struct nlattr *bit_attr;
 	bool no_mask;
 	int rem;
@@ -448,8 +468,20 @@
 	}
 
 	no_mask = tb[ETHTOOL_A_BITSET_NOMASK];
-	if (no_mask)
-		ethnl_bitmap32_clear(bitmap, 0, nbits, mod);
+	if (no_mask) {
+		unsigned int nwords = DIV_ROUND_UP(nbits, 32);
+		unsigned int nbytes = nwords * sizeof(u32);
+		bool dummy;
+
+		/* The bitmap size is only the size of the map part without
+		 * its mask part.
+		 */
+		saved_bitmap = kcalloc(nwords, sizeof(u32), GFP_KERNEL);
+		if (!saved_bitmap)
+			return -ENOMEM;
+		memcpy(saved_bitmap, bitmap, nbytes);
+		ethnl_bitmap32_clear(bitmap, 0, nbits, &dummy);
+	}
 
 	nla_for_each_nested(bit_attr, tb[ETHTOOL_A_BITSET_BITS], rem) {
 		bool old_val, new_val;
@@ -458,22 +490,30 @@
 		if (nla_type(bit_attr) != ETHTOOL_A_BITSET_BITS_BIT) {
 			NL_SET_ERR_MSG_ATTR(extack, bit_attr,
 					    "only ETHTOOL_A_BITSET_BITS_BIT allowed in ETHTOOL_A_BITSET_BITS");
+			kfree(saved_bitmap);
 			return -EINVAL;
 		}
 		ret = ethnl_parse_bit(&idx, &new_val, nbits, bit_attr, no_mask,
 				      names, extack);
-		if (ret < 0)
+		if (ret < 0) {
+			kfree(saved_bitmap);
 			return ret;
+		}
 		old_val = bitmap[idx / 32] & ((u32)1 << (idx % 32));
 		if (new_val != old_val) {
 			if (new_val)
 				bitmap[idx / 32] |= ((u32)1 << (idx % 32));
 			else
 				bitmap[idx / 32] &= ~((u32)1 << (idx % 32));
-			*mod = true;
+			if (!no_mask)
+				*mod = true;
 		}
 	}
 
+	if (no_mask && !ethnl_bitmap32_equal(saved_bitmap, bitmap, nbits))
+		*mod = true;
+
+	kfree(saved_bitmap);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/net/ethtool/channels.c
+++ linux-qcom-6.8.0/net/ethtool/channels.c
@@ -171,11 +171,9 @@
 	 */
 	if (ethtool_get_max_rxnfc_channel(dev, &max_rxnfc_in_use))
 		max_rxnfc_in_use = 0;
-	if (!netif_is_rxfh_configured(dev) ||
-	    ethtool_get_max_rxfh_channel(dev, &max_rxfh_in_use))
-		max_rxfh_in_use = 0;
+	max_rxfh_in_use = ethtool_get_max_rxfh_channel(dev);
 	if (channels.combined_count + channels.rx_count <= max_rxfh_in_use) {
-		GENL_SET_ERR_MSG(info, "requested channel counts are too low for existing indirection table settings");
+		GENL_SET_ERR_MSG_FMT(info, "requested channel counts are too low for existing indirection table (%d)", max_rxfh_in_use);
 		return -EINVAL;
 	}
 	if (channels.combined_count + channels.rx_count <= max_rxnfc_in_use) {
--- linux-qcom-6.8.0.orig/net/ethtool/common.c
+++ linux-qcom-6.8.0/net/ethtool/common.c
@@ -587,35 +587,39 @@
 	return err;
 }
 
-int ethtool_get_max_rxfh_channel(struct net_device *dev, u32 *max)
+u32 ethtool_get_max_rxfh_channel(struct net_device *dev)
 {
 	struct ethtool_rxfh_param rxfh = {};
-	u32 dev_size, current_max = 0;
+	u32 dev_size, current_max;
 	int ret;
 
+	if (!netif_is_rxfh_configured(dev))
+		return 0;
+
 	if (!dev->ethtool_ops->get_rxfh_indir_size ||
 	    !dev->ethtool_ops->get_rxfh)
-		return -EOPNOTSUPP;
+		return 0;
 	dev_size = dev->ethtool_ops->get_rxfh_indir_size(dev);
 	if (dev_size == 0)
-		return -EOPNOTSUPP;
+		return 0;
 
 	rxfh.indir = kcalloc(dev_size, sizeof(rxfh.indir[0]), GFP_USER);
 	if (!rxfh.indir)
-		return -ENOMEM;
+		return U32_MAX;
 
 	ret = dev->ethtool_ops->get_rxfh(dev, &rxfh);
-	if (ret)
-		goto out;
+	if (ret) {
+		current_max = U32_MAX;
+		goto out_free;
+	}
 
+	current_max = 0;
 	while (dev_size--)
 		current_max = max(current_max, rxfh.indir[dev_size]);
 
-	*max = current_max;
-
-out:
+out_free:
 	kfree(rxfh.indir);
-	return ret;
+	return current_max;
 }
 
 int ethtool_check_ops(const struct ethtool_ops *ops)
--- linux-qcom-6.8.0.orig/net/ethtool/common.h
+++ linux-qcom-6.8.0/net/ethtool/common.h
@@ -42,7 +42,7 @@
 bool convert_legacy_settings_to_link_ksettings(
 	struct ethtool_link_ksettings *link_ksettings,
 	const struct ethtool_cmd *legacy_settings);
-int ethtool_get_max_rxfh_channel(struct net_device *dev, u32 *max);
+u32 ethtool_get_max_rxfh_channel(struct net_device *dev);
 int ethtool_get_max_rxnfc_channel(struct net_device *dev, u64 *max);
 int __ethtool_get_ts_info(struct net_device *dev, struct ethtool_ts_info *info);
 
--- linux-qcom-6.8.0.orig/net/ethtool/ioctl.c
+++ linux-qcom-6.8.0/net/ethtool/ioctl.c
@@ -441,6 +441,9 @@
 	if (!dev->ethtool_ops->get_link_ksettings)
 		return -EOPNOTSUPP;
 
+	if (!netif_device_present(dev))
+		return -ENODEV;
+
 	memset(link_ksettings, 0, sizeof(*link_ksettings));
 	return dev->ethtool_ops->get_link_ksettings(dev, link_ksettings);
 }
@@ -1276,11 +1279,11 @@
 	u32 rss_cfg_offset = offsetof(struct ethtool_rxfh, rss_config[0]);
 	const struct ethtool_ops *ops = dev->ethtool_ops;
 	u32 dev_indir_size = 0, dev_key_size = 0, i;
+	u32 user_indir_len = 0, indir_bytes = 0;
 	struct ethtool_rxfh_param rxfh_dev = {};
 	struct netlink_ext_ack *extack = NULL;
 	struct ethtool_rxnfc rx_rings;
 	struct ethtool_rxfh rxfh;
-	u32 indir_bytes = 0;
 	u8 *rss_config;
 	int ret;
 
@@ -1305,7 +1308,8 @@
 	if (rxfh.input_xfrm && rxfh.input_xfrm != RXH_XFRM_SYM_XOR &&
 	    rxfh.input_xfrm != RXH_XFRM_NO_CHANGE)
 		return -EINVAL;
-	if ((rxfh.input_xfrm & RXH_XFRM_SYM_XOR) &&
+	if (rxfh.input_xfrm != RXH_XFRM_NO_CHANGE &&
+	    (rxfh.input_xfrm & RXH_XFRM_SYM_XOR) &&
 	    !ops->cap_rss_sym_xor_supported)
 		return -EOPNOTSUPP;
 
@@ -1340,6 +1344,7 @@
 	 */
 	if (rxfh.indir_size &&
 	    rxfh.indir_size != ETH_RXFH_INDIR_NO_CHANGE) {
+		user_indir_len = indir_bytes;
 		rxfh_dev.indir = (u32 *)rss_config;
 		rxfh_dev.indir_size = dev_indir_size;
 		ret = ethtool_copy_validate_indir(rxfh_dev.indir,
@@ -1366,7 +1371,7 @@
 		rxfh_dev.key_size = dev_key_size;
 		rxfh_dev.key = rss_config + indir_bytes;
 		if (copy_from_user(rxfh_dev.key,
-				   useraddr + rss_cfg_offset + indir_bytes,
+				   useraddr + rss_cfg_offset + user_indir_len,
 				   rxfh.key_size)) {
 			ret = -EFAULT;
 			goto out;
@@ -1885,9 +1890,7 @@
 	 * indirection table/rxnfc settings */
 	if (ethtool_get_max_rxnfc_channel(dev, &max_rxnfc_in_use))
 		max_rxnfc_in_use = 0;
-	if (!netif_is_rxfh_configured(dev) ||
-	    ethtool_get_max_rxfh_channel(dev, &max_rxfh_in_use))
-		max_rxfh_in_use = 0;
+	max_rxfh_in_use = ethtool_get_max_rxfh_channel(dev);
 	if (channels.combined_count + channels.rx_count <=
 	    max_t(u64, max_rxnfc_in_use, max_rxfh_in_use))
 		return -EINVAL;
@@ -2182,7 +2185,7 @@
 	const struct ethtool_ops *ops = dev->ethtool_ops;
 	int n_stats, ret;
 
-	if (!ops || !ops->get_sset_count || ops->get_ethtool_phy_stats)
+	if (!ops || !ops->get_sset_count || !ops->get_ethtool_phy_stats)
 		return -EOPNOTSUPP;
 
 	n_stats = ops->get_sset_count(dev, ETH_SS_PHY_STATS);
--- linux-qcom-6.8.0.orig/net/ethtool/linkstate.c
+++ linux-qcom-6.8.0/net/ethtool/linkstate.c
@@ -37,6 +37,8 @@
 	mutex_lock(&phydev->lock);
 	if (!phydev->drv || !phydev->drv->get_sqi)
 		ret = -EOPNOTSUPP;
+	else if (!phydev->link)
+		ret = -ENETDOWN;
 	else
 		ret = phydev->drv->get_sqi(phydev);
 	mutex_unlock(&phydev->lock);
@@ -55,6 +57,8 @@
 	mutex_lock(&phydev->lock);
 	if (!phydev->drv || !phydev->drv->get_sqi_max)
 		ret = -EOPNOTSUPP;
+	else if (!phydev->link)
+		ret = -ENETDOWN;
 	else
 		ret = phydev->drv->get_sqi_max(phydev);
 	mutex_unlock(&phydev->lock);
@@ -62,6 +66,17 @@
 	return ret;
 };
 
+static bool linkstate_sqi_critical_error(int sqi)
+{
+	return sqi < 0 && sqi != -EOPNOTSUPP && sqi != -ENETDOWN;
+}
+
+static bool linkstate_sqi_valid(struct linkstate_reply_data *data)
+{
+	return data->sqi >= 0 && data->sqi_max >= 0 &&
+	       data->sqi <= data->sqi_max;
+}
+
 static int linkstate_get_link_ext_state(struct net_device *dev,
 					struct linkstate_reply_data *data)
 {
@@ -93,12 +108,12 @@
 	data->link = __ethtool_get_link(dev);
 
 	ret = linkstate_get_sqi(dev);
-	if (ret < 0 && ret != -EOPNOTSUPP)
+	if (linkstate_sqi_critical_error(ret))
 		goto out;
 	data->sqi = ret;
 
 	ret = linkstate_get_sqi_max(dev);
-	if (ret < 0 && ret != -EOPNOTSUPP)
+	if (linkstate_sqi_critical_error(ret))
 		goto out;
 	data->sqi_max = ret;
 
@@ -136,11 +151,10 @@
 	len = nla_total_size(sizeof(u8)) /* LINKSTATE_LINK */
 		+ 0;
 
-	if (data->sqi != -EOPNOTSUPP)
-		len += nla_total_size(sizeof(u32));
-
-	if (data->sqi_max != -EOPNOTSUPP)
-		len += nla_total_size(sizeof(u32));
+	if (linkstate_sqi_valid(data)) {
+		len += nla_total_size(sizeof(u32)); /* LINKSTATE_SQI */
+		len += nla_total_size(sizeof(u32)); /* LINKSTATE_SQI_MAX */
+	}
 
 	if (data->link_ext_state_provided)
 		len += nla_total_size(sizeof(u8)); /* LINKSTATE_EXT_STATE */
@@ -164,13 +178,14 @@
 	    nla_put_u8(skb, ETHTOOL_A_LINKSTATE_LINK, !!data->link))
 		return -EMSGSIZE;
 
-	if (data->sqi != -EOPNOTSUPP &&
-	    nla_put_u32(skb, ETHTOOL_A_LINKSTATE_SQI, data->sqi))
-		return -EMSGSIZE;
-
-	if (data->sqi_max != -EOPNOTSUPP &&
-	    nla_put_u32(skb, ETHTOOL_A_LINKSTATE_SQI_MAX, data->sqi_max))
-		return -EMSGSIZE;
+	if (linkstate_sqi_valid(data)) {
+		if (nla_put_u32(skb, ETHTOOL_A_LINKSTATE_SQI, data->sqi))
+			return -EMSGSIZE;
+
+		if (nla_put_u32(skb, ETHTOOL_A_LINKSTATE_SQI_MAX,
+				data->sqi_max))
+			return -EMSGSIZE;
+	}
 
 	if (data->link_ext_state_provided) {
 		if (nla_put_u8(skb, ETHTOOL_A_LINKSTATE_EXT_STATE,
--- linux-qcom-6.8.0.orig/net/ethtool/netlink.c
+++ linux-qcom-6.8.0/net/ethtool/netlink.c
@@ -41,7 +41,7 @@
 		pm_runtime_get_sync(dev->dev.parent);
 
 	if (!netif_device_present(dev) ||
-	    dev->reg_state == NETREG_UNREGISTERING) {
+	    dev->reg_state >= NETREG_UNREGISTERING) {
 		ret = -ENODEV;
 		goto err;
 	}
--- linux-qcom-6.8.0.orig/net/ethtool/rss.c
+++ linux-qcom-6.8.0/net/ethtool/rss.c
@@ -111,7 +111,8 @@
 	const struct rss_reply_data *data = RSS_REPDATA(reply_base);
 	int len;
 
-	len = nla_total_size(sizeof(u32)) +	/* _RSS_HFUNC */
+	len = nla_total_size(sizeof(u32)) +	/* _RSS_CONTEXT */
+	      nla_total_size(sizeof(u32)) +	/* _RSS_HFUNC */
 	      nla_total_size(sizeof(u32)) +	/* _RSS_INPUT_XFRM */
 	      nla_total_size(sizeof(u32) * data->indir_size) + /* _RSS_INDIR */
 	      nla_total_size(data->hkey_size);	/* _RSS_HKEY */
@@ -124,6 +125,11 @@
 	       const struct ethnl_reply_data *reply_base)
 {
 	const struct rss_reply_data *data = RSS_REPDATA(reply_base);
+	struct rss_req_info *request = RSS_REQINFO(req_base);
+
+	if (request->rss_context &&
+	    nla_put_u32(skb, ETHTOOL_A_RSS_CONTEXT, request->rss_context))
+		return -EMSGSIZE;
 
 	if ((data->hfunc &&
 	     nla_put_u32(skb, ETHTOOL_A_RSS_HFUNC, data->hfunc)) ||
--- linux-qcom-6.8.0.orig/net/hsr/hsr_device.c
+++ linux-qcom-6.8.0/net/hsr/hsr_device.c
@@ -31,8 +31,8 @@
 static void __hsr_set_operstate(struct net_device *dev, int transition)
 {
 	write_lock(&dev_base_lock);
-	if (dev->operstate != transition) {
-		dev->operstate = transition;
+	if (READ_ONCE(dev->operstate) != transition) {
+		WRITE_ONCE(dev->operstate, transition);
 		write_unlock(&dev_base_lock);
 		netdev_state_change(dev);
 	} else {
@@ -71,39 +71,36 @@
 	return false;
 }
 
-static void hsr_check_announce(struct net_device *hsr_dev,
-			       unsigned char old_operstate)
+static void hsr_check_announce(struct net_device *hsr_dev)
 {
 	struct hsr_priv *hsr;
 
 	hsr = netdev_priv(hsr_dev);
-
-	if (hsr_dev->operstate == IF_OPER_UP && old_operstate != IF_OPER_UP) {
-		/* Went up */
-		hsr->announce_count = 0;
-		mod_timer(&hsr->announce_timer,
-			  jiffies + msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL));
+	if (netif_running(hsr_dev) && netif_oper_up(hsr_dev)) {
+		/* Enable announce timer and start sending supervisory frames */
+		if (!timer_pending(&hsr->announce_timer)) {
+			hsr->announce_count = 0;
+			mod_timer(&hsr->announce_timer, jiffies +
+				  msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL));
+		}
+	} else {
+		/* Deactivate the announce timer  */
+		timer_delete(&hsr->announce_timer);
 	}
-
-	if (hsr_dev->operstate != IF_OPER_UP && old_operstate == IF_OPER_UP)
-		/* Went down */
-		del_timer(&hsr->announce_timer);
 }
 
 void hsr_check_carrier_and_operstate(struct hsr_priv *hsr)
 {
 	struct hsr_port *master;
-	unsigned char old_operstate;
 	bool has_carrier;
 
 	master = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
 	/* netif_stacked_transfer_operstate() cannot be used here since
 	 * it doesn't set IF_OPER_LOWERLAYERDOWN (?)
 	 */
-	old_operstate = master->dev->operstate;
 	has_carrier = hsr_check_carrier(master);
 	hsr_set_operstate(master, has_carrier);
-	hsr_check_announce(master->dev, old_operstate);
+	hsr_check_announce(master->dev);
 }
 
 int hsr_get_max_mtu(struct hsr_priv *hsr)
@@ -273,6 +270,8 @@
 	skb->dev = master->dev;
 	skb->priority = TC_PRIO_CONTROL;
 
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
 	if (dev_hard_header(skb, skb->dev, ETH_P_PRP,
 			    hsr->sup_multicast_addr,
 			    skb->dev->dev_addr, skb->len) <= 0)
@@ -280,8 +279,6 @@
 
 	skb_reset_mac_header(skb);
 	skb_reset_mac_len(skb);
-	skb_reset_network_header(skb);
-	skb_reset_transport_header(skb);
 
 	return skb;
 out:
--- linux-qcom-6.8.0.orig/net/hsr/hsr_forward.c
+++ linux-qcom-6.8.0/net/hsr/hsr_forward.c
@@ -588,7 +588,12 @@
 		frame->is_vlan = true;
 
 	if (frame->is_vlan) {
-		vlan_hdr = (struct hsr_vlan_ethhdr *)ethhdr;
+		/* Note: skb->mac_len might be wrong here. */
+		if (!pskb_may_pull(skb,
+				   skb_mac_offset(skb) +
+				   offsetofend(struct hsr_vlan_ethhdr, vlanhdr)))
+			return -EINVAL;
+		vlan_hdr = (struct hsr_vlan_ethhdr *)skb_mac_header(skb);
 		proto = vlan_hdr->vlanhdr.h_vlan_encapsulated_proto;
 		/* FIXME: */
 		netdev_warn_once(skb->dev, "VLAN not yet supported");
--- linux-qcom-6.8.0.orig/net/hsr/hsr_framereg.c
+++ linux-qcom-6.8.0/net/hsr/hsr_framereg.c
@@ -228,6 +228,10 @@
 	 */
 	if (ethhdr->h_proto == htons(ETH_P_PRP) ||
 	    ethhdr->h_proto == htons(ETH_P_HSR)) {
+		/* Check if skb contains hsr_ethhdr */
+		if (skb->mac_len < sizeof(struct hsr_ethhdr))
+			return NULL;
+
 		/* Use the existing sequence_nr from the tag as starting point
 		 * for filtering duplicate frames.
 		 */
--- linux-qcom-6.8.0.orig/net/hsr/hsr_main.c
+++ linux-qcom-6.8.0/net/hsr/hsr_main.c
@@ -148,14 +148,21 @@
 
 static int __init hsr_init(void)
 {
-	int res;
+	int err;
 
 	BUILD_BUG_ON(sizeof(struct hsr_tag) != HSR_HLEN);
 
-	register_netdevice_notifier(&hsr_nb);
-	res = hsr_netlink_init();
+	err = register_netdevice_notifier(&hsr_nb);
+	if (err)
+		return err;
 
-	return res;
+	err = hsr_netlink_init();
+	if (err) {
+		unregister_netdevice_notifier(&hsr_nb);
+		return err;
+	}
+
+	return 0;
 }
 
 static void __exit hsr_exit(void)
--- linux-qcom-6.8.0.orig/net/hsr/hsr_slave.c
+++ linux-qcom-6.8.0/net/hsr/hsr_slave.c
@@ -66,7 +66,16 @@
 		skb_set_network_header(skb, ETH_HLEN + HSR_HLEN);
 	skb_reset_mac_len(skb);
 
-	hsr_forward_skb(skb, port);
+	/* Only the frames received over the interlink port will assign a
+	 * sequence number and require synchronisation vs other sender.
+	 */
+	if (port->type == HSR_PT_INTERLINK) {
+		spin_lock_bh(&hsr->seqnr_lock);
+		hsr_forward_skb(skb, port);
+		spin_unlock_bh(&hsr->seqnr_lock);
+	} else {
+		hsr_forward_skb(skb, port);
+	}
 
 finish_consume:
 	return RX_HANDLER_CONSUMED;
@@ -220,7 +229,8 @@
 		netdev_update_features(master->dev);
 		dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
 		netdev_rx_handler_unregister(port->dev);
-		dev_set_promiscuity(port->dev, -1);
+		if (!port->hsr->fwd_offloaded)
+			dev_set_promiscuity(port->dev, -1);
 		netdev_upper_dev_unlink(port->dev, master->dev);
 	}
 
--- linux-qcom-6.8.0.orig/net/ieee802154/6lowpan/reassembly.c
+++ linux-qcom-6.8.0/net/ieee802154/6lowpan/reassembly.c
@@ -130,7 +130,7 @@
 		goto err;
 
 	fq->q.stamp = skb->tstamp;
-	fq->q.mono_delivery_time = skb->mono_delivery_time;
+	fq->q.tstamp_type = skb->tstamp_type;
 	if (frag_type == LOWPAN_DISPATCH_FRAG1)
 		fq->q.flags |= INET_FRAG_FIRST_IN;
 
--- linux-qcom-6.8.0.orig/net/ieee802154/socket.c
+++ linux-qcom-6.8.0/net/ieee802154/socket.c
@@ -1043,19 +1043,21 @@
 
 	if (sk->sk_prot->hash) {
 		rc = sk->sk_prot->hash(sk);
-		if (rc) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (rc)
+			goto out_sk_release;
 	}
 
 	if (sk->sk_prot->init) {
 		rc = sk->sk_prot->init(sk);
 		if (rc)
-			sk_common_release(sk);
+			goto out_sk_release;
 	}
 out:
 	return rc;
+out_sk_release:
+	sk_common_release(sk);
+	sock->sk = NULL;
+	goto out;
 }
 
 static const struct net_proto_family ieee802154_family_ops = {
--- linux-qcom-6.8.0.orig/net/ipv4/af_inet.c
+++ linux-qcom-6.8.0/net/ipv4/af_inet.c
@@ -375,32 +375,30 @@
 		inet->inet_sport = htons(inet->inet_num);
 		/* Add to protocol hash chains. */
 		err = sk->sk_prot->hash(sk);
-		if (err) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (err)
+			goto out_sk_release;
 	}
 
 	if (sk->sk_prot->init) {
 		err = sk->sk_prot->init(sk);
-		if (err) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (err)
+			goto out_sk_release;
 	}
 
 	if (!kern) {
 		err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk);
-		if (err) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (err)
+			goto out_sk_release;
 	}
 out:
 	return err;
 out_rcu_unlock:
 	rcu_read_unlock();
 	goto out;
+out_sk_release:
+	sk_common_release(sk);
+	sock->sk = NULL;
+	goto out;
 }
 
 
@@ -757,7 +755,9 @@
 	sock_rps_record_flow(newsk);
 	WARN_ON(!((1 << newsk->sk_state) &
 		  (TCPF_ESTABLISHED | TCPF_SYN_RECV |
-		  TCPF_CLOSE_WAIT | TCPF_CLOSE)));
+		   TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 |
+		   TCPF_CLOSING | TCPF_CLOSE_WAIT |
+		   TCPF_CLOSE)));
 
 	if (test_bit(SOCK_SUPPORT_ZC, &sock->flags))
 		set_bit(SOCK_SUPPORT_ZC, &newsock->flags);
@@ -1305,8 +1305,8 @@
 
 int inet_sk_rebuild_header(struct sock *sk)
 {
+	struct rtable *rt = dst_rtable(__sk_dst_check(sk, 0));
 	struct inet_sock *inet = inet_sk(sk);
-	struct rtable *rt = (struct rtable *)__sk_dst_check(sk, 0);
 	__be32 daddr;
 	struct ip_options_rcu *inet_opt;
 	struct flowi4 *fl4;
@@ -1571,6 +1571,7 @@
 	/* The above will be needed by the transport layer if there is one
 	 * immediately following this IP hdr.
 	 */
+	NAPI_GRO_CB(skb)->inner_network_offset = off;
 
 	/* Note : No need to call skb_gro_postpull_rcsum() here,
 	 * as we already checked checksum over ipv4 header was 0
--- linux-qcom-6.8.0.orig/net/ipv4/cipso_ipv4.c
+++ linux-qcom-6.8.0/net/ipv4/cipso_ipv4.c
@@ -1955,7 +1955,7 @@
 	buf = NULL;
 
 	req_inet = inet_rsk(req);
-	opt = xchg((__force struct ip_options_rcu **)&req_inet->ireq_opt, opt);
+	opt = unrcu_pointer(xchg(&req_inet->ireq_opt, RCU_INITIALIZER(opt)));
 	if (opt)
 		kfree_rcu(opt, rcu);
 
@@ -2015,12 +2015,16 @@
 		 * from there we can determine the new total option length */
 		iter = 0;
 		optlen_new = 0;
-		while (iter < opt->opt.optlen)
-			if (opt->opt.__data[iter] != IPOPT_NOP) {
+		while (iter < opt->opt.optlen) {
+			if (opt->opt.__data[iter] == IPOPT_END) {
+				break;
+			} else if (opt->opt.__data[iter] == IPOPT_NOP) {
+				iter++;
+			} else {
 				iter += opt->opt.__data[iter + 1];
 				optlen_new = iter;
-			} else
-				iter++;
+			}
+		}
 		hdr_delta = opt->opt.optlen;
 		opt->opt.optlen = (optlen_new + 3) & ~3;
 		hdr_delta -= opt->opt.optlen;
--- linux-qcom-6.8.0.orig/net/ipv4/devinet.c
+++ linux-qcom-6.8.0/net/ipv4/devinet.c
@@ -283,17 +283,19 @@
 	/* Account for reference dev->ip_ptr (below) */
 	refcount_set(&in_dev->refcnt, 1);
 
-	err = devinet_sysctl_register(in_dev);
-	if (err) {
-		in_dev->dead = 1;
-		neigh_parms_release(&arp_tbl, in_dev->arp_parms);
-		in_dev_put(in_dev);
-		in_dev = NULL;
-		goto out;
+	if (dev != blackhole_netdev) {
+		err = devinet_sysctl_register(in_dev);
+		if (err) {
+			in_dev->dead = 1;
+			neigh_parms_release(&arp_tbl, in_dev->arp_parms);
+			in_dev_put(in_dev);
+			in_dev = NULL;
+			goto out;
+		}
+		ip_mc_init_dev(in_dev);
+		if (dev->flags & IFF_UP)
+			ip_mc_up(in_dev);
 	}
-	ip_mc_init_dev(in_dev);
-	if (dev->flags & IFF_UP)
-		ip_mc_up(in_dev);
 
 	/* we can receive as soon as ip_ptr is set -- do this last */
 	rcu_assign_pointer(dev->ip_ptr, in_dev);
@@ -332,6 +334,19 @@
 	in_dev_put(in_dev);
 }
 
+static int __init inet_blackhole_dev_init(void)
+{
+	int err = 0;
+
+	rtnl_lock();
+	if (!inetdev_init(blackhole_netdev))
+		err = -ENOMEM;
+	rtnl_unlock();
+
+	return err;
+}
+late_initcall(inet_blackhole_dev_init);
+
 int inet_addr_onlink(struct in_device *in_dev, __be32 a, __be32 b)
 {
 	const struct in_ifaddr *ifa;
@@ -569,10 +584,6 @@
 
 	ASSERT_RTNL();
 
-	if (!in_dev) {
-		inet_free_ifa(ifa);
-		return -ENOBUFS;
-	}
 	ipv4_devconf_setall(in_dev);
 	neigh_parms_data_state_setall(in_dev->arp_parms);
 	if (ifa->ifa_dev != in_dev) {
@@ -1174,6 +1185,8 @@
 
 		if (!ifa) {
 			ret = -ENOBUFS;
+			if (!in_dev)
+				break;
 			ifa = inet_alloc_ifa();
 			if (!ifa)
 				break;
--- linux-qcom-6.8.0.orig/net/ipv4/esp4.c
+++ linux-qcom-6.8.0/net/ipv4/esp4.c
@@ -95,7 +95,7 @@
 			     __alignof__(struct scatterlist));
 }
 
-static void esp_ssg_unref(struct xfrm_state *x, void *tmp)
+static void esp_ssg_unref(struct xfrm_state *x, void *tmp, struct sk_buff *skb)
 {
 	struct crypto_aead *aead = x->data;
 	int extralen = 0;
@@ -114,7 +114,7 @@
 	 */
 	if (req->src != req->dst)
 		for (sg = sg_next(req->src); sg; sg = sg_next(sg))
-			put_page(sg_page(sg));
+			skb_page_unref(skb, sg_page(sg), false);
 }
 
 #ifdef CONFIG_INET_ESPINTCP
@@ -238,8 +238,7 @@
 #else
 static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)
 {
-	kfree_skb(skb);
-
+	WARN_ON(1);
 	return -EOPNOTSUPP;
 }
 #endif
@@ -260,7 +259,7 @@
 	}
 
 	tmp = ESP_SKB_CB(skb)->tmp;
-	esp_ssg_unref(x, tmp);
+	esp_ssg_unref(x, tmp, skb);
 	kfree(tmp);
 
 	if (xo && (xo->flags & XFRM_DEV_RESUME)) {
@@ -639,7 +638,7 @@
 	}
 
 	if (sg != dsg)
-		esp_ssg_unref(x, tmp);
+		esp_ssg_unref(x, tmp, skb);
 
 	if (!err && x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
 		err = esp_output_tail_tcp(x, skb);
--- linux-qcom-6.8.0.orig/net/ipv4/fib_frontend.c
+++ linux-qcom-6.8.0/net/ipv4/fib_frontend.c
@@ -1343,7 +1343,7 @@
 	struct flowi4           fl4 = {
 		.flowi4_mark = frn->fl_mark,
 		.daddr = frn->fl_addr,
-		.flowi4_tos = frn->fl_tos,
+		.flowi4_tos = frn->fl_tos & IPTOS_RT_MASK,
 		.flowi4_scope = frn->fl_scope,
 	};
 	struct fib_table *tb;
--- linux-qcom-6.8.0.orig/net/ipv4/fib_semantics.c
+++ linux-qcom-6.8.0/net/ipv4/fib_semantics.c
@@ -1030,7 +1030,7 @@
 			bool ecn_ca = false;
 
 			nla_strscpy(tmp, nla, sizeof(tmp));
-			val = tcp_ca_get_key_by_name(fi->fib_net, tmp, &ecn_ca);
+			val = tcp_ca_get_key_by_name(tmp, &ecn_ca);
 		} else {
 			if (nla_len(nla) != sizeof(u32))
 				return false;
@@ -1459,8 +1459,7 @@
 	fi = kzalloc(struct_size(fi, fib_nh, nhs), GFP_KERNEL);
 	if (!fi)
 		goto failure;
-	fi->fib_metrics = ip_fib_metrics_init(fi->fib_net, cfg->fc_mx,
-					      cfg->fc_mx_len, extack);
+	fi->fib_metrics = ip_fib_metrics_init(cfg->fc_mx, cfg->fc_mx_len, extack);
 	if (IS_ERR(fi->fib_metrics)) {
 		err = PTR_ERR(fi->fib_metrics);
 		kfree(fi);
@@ -2270,6 +2269,15 @@
 		fib_select_default(fl4, res);
 
 check_saddr:
-	if (!fl4->saddr)
-		fl4->saddr = fib_result_prefsrc(net, res);
+	if (!fl4->saddr) {
+		struct net_device *l3mdev;
+
+		l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);
+
+		if (!l3mdev ||
+		    l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) == l3mdev)
+			fl4->saddr = fib_result_prefsrc(net, res);
+		else
+			fl4->saddr = inet_select_addr(l3mdev, 0, RT_SCOPE_LINK);
+	}
 }
--- linux-qcom-6.8.0.orig/net/ipv4/fib_trie.c
+++ linux-qcom-6.8.0/net/ipv4/fib_trie.c
@@ -1629,6 +1629,7 @@
 			res->nhc = nhc;
 			res->type = fa->fa_type;
 			res->scope = fi->fib_scope;
+			res->dscp = fa->fa_dscp;
 			res->fi = fi;
 			res->table = tb;
 			res->fa_head = &n->leaf;
--- linux-qcom-6.8.0.orig/net/ipv4/fou_core.c
+++ linux-qcom-6.8.0/net/ipv4/fou_core.c
@@ -50,7 +50,7 @@
 
 static inline struct fou *fou_from_sock(struct sock *sk)
 {
-	return sk->sk_user_data;
+	return rcu_dereference_sk_user_data(sk);
 }
 
 static int fou_recv_pull(struct sk_buff *skb, struct fou *fou, size_t len)
@@ -233,9 +233,15 @@
 				       struct sk_buff *skb)
 {
 	const struct net_offload __rcu **offloads;
-	u8 proto = fou_from_sock(sk)->protocol;
+	struct fou *fou = fou_from_sock(sk);
 	const struct net_offload *ops;
 	struct sk_buff *pp = NULL;
+	u8 proto;
+
+	if (!fou)
+		goto out;
+
+	proto = fou->protocol;
 
 	/* We can clear the encap_mark for FOU as we are essentially doing
 	 * one of two possible things.  We are either adding an L4 tunnel
@@ -263,14 +269,24 @@
 			    int nhoff)
 {
 	const struct net_offload __rcu **offloads;
-	u8 proto = fou_from_sock(sk)->protocol;
+	struct fou *fou = fou_from_sock(sk);
 	const struct net_offload *ops;
-	int err = -ENOSYS;
+	u8 proto;
+	int err;
+
+	if (!fou) {
+		err = -ENOENT;
+		goto out;
+	}
+
+	proto = fou->protocol;
 
 	offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
 	ops = rcu_dereference(offloads[proto]);
-	if (WARN_ON(!ops || !ops->callbacks.gro_complete))
+	if (WARN_ON(!ops || !ops->callbacks.gro_complete)) {
+		err = -ENOSYS;
 		goto out;
+	}
 
 	err = ops->callbacks.gro_complete(skb, nhoff);
 
@@ -322,6 +338,9 @@
 
 	skb_gro_remcsum_init(&grc);
 
+	if (!fou)
+		goto out;
+
 	off = skb_gro_offset(skb);
 	len = off + sizeof(*guehdr);
 
@@ -433,7 +452,7 @@
 
 	offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
 	ops = rcu_dereference(offloads[proto]);
-	if (WARN_ON_ONCE(!ops || !ops->callbacks.gro_receive))
+	if (!ops || !ops->callbacks.gro_receive)
 		goto out;
 
 	pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
--- linux-qcom-6.8.0.orig/net/ipv4/icmp.c
+++ linux-qcom-6.8.0/net/ipv4/icmp.c
@@ -92,6 +92,7 @@
 #include <net/inet_common.h>
 #include <net/ip_fib.h>
 #include <net/l3mdev.h>
+#include <net/addrconf.h>
 
 /*
  *	Build xmit assembly blocks
@@ -221,57 +222,59 @@
 int sysctl_icmp_msgs_burst __read_mostly = 50;
 
 static struct {
-	spinlock_t	lock;
-	u32		credit;
+	atomic_t	credit;
 	u32		stamp;
-} icmp_global = {
-	.lock		= __SPIN_LOCK_UNLOCKED(icmp_global.lock),
-};
+} icmp_global;
 
 /**
  * icmp_global_allow - Are we allowed to send one more ICMP message ?
  *
  * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
  * Returns false if we reached the limit and can not send another packet.
- * Note: called with BH disabled
+ * Works in tandem with icmp_global_consume().
  */
 bool icmp_global_allow(void)
 {
-	u32 credit, delta, incr = 0, now = (u32)jiffies;
-	bool rc = false;
+	u32 delta, now, oldstamp;
+	int incr, new, old;
 
-	/* Check if token bucket is empty and cannot be refilled
-	 * without taking the spinlock. The READ_ONCE() are paired
-	 * with the following WRITE_ONCE() in this same function.
+	/* Note: many cpus could find this condition true.
+	 * Then later icmp_global_consume() could consume more credits,
+	 * this is an acceptable race.
 	 */
-	if (!READ_ONCE(icmp_global.credit)) {
-		delta = min_t(u32, now - READ_ONCE(icmp_global.stamp), HZ);
-		if (delta < HZ / 50)
-			return false;
-	}
+	if (atomic_read(&icmp_global.credit) > 0)
+		return true;
 
-	spin_lock(&icmp_global.lock);
-	delta = min_t(u32, now - icmp_global.stamp, HZ);
-	if (delta >= HZ / 50) {
-		incr = READ_ONCE(sysctl_icmp_msgs_per_sec) * delta / HZ;
-		if (incr)
-			WRITE_ONCE(icmp_global.stamp, now);
-	}
-	credit = min_t(u32, icmp_global.credit + incr,
-		       READ_ONCE(sysctl_icmp_msgs_burst));
-	if (credit) {
-		/* We want to use a credit of one in average, but need to randomize
-		 * it for security reasons.
-		 */
-		credit = max_t(int, credit - get_random_u32_below(3), 0);
-		rc = true;
+	now = jiffies;
+	oldstamp = READ_ONCE(icmp_global.stamp);
+	delta = min_t(u32, now - oldstamp, HZ);
+	if (delta < HZ / 50)
+		return false;
+
+	incr = READ_ONCE(sysctl_icmp_msgs_per_sec) * delta / HZ;
+	if (!incr)
+		return false;
+
+	if (cmpxchg(&icmp_global.stamp, oldstamp, now) == oldstamp) {
+		old = atomic_read(&icmp_global.credit);
+		do {
+			new = min(old + incr, READ_ONCE(sysctl_icmp_msgs_burst));
+		} while (!atomic_try_cmpxchg(&icmp_global.credit, &old, new));
 	}
-	WRITE_ONCE(icmp_global.credit, credit);
-	spin_unlock(&icmp_global.lock);
-	return rc;
+	return true;
 }
 EXPORT_SYMBOL(icmp_global_allow);
 
+void icmp_global_consume(void)
+{
+	int credits = get_random_u32_below(3);
+
+	/* Note: this might make icmp_global.credit negative. */
+	if (credits)
+		atomic_sub(credits, &icmp_global.credit);
+}
+EXPORT_SYMBOL(icmp_global_consume);
+
 static bool icmpv4_mask_allow(struct net *net, int type, int code)
 {
 	if (type > NR_ICMP_TYPES)
@@ -288,14 +291,16 @@
 	return false;
 }
 
-static bool icmpv4_global_allow(struct net *net, int type, int code)
+static bool icmpv4_global_allow(struct net *net, int type, int code,
+				bool *apply_ratelimit)
 {
 	if (icmpv4_mask_allow(net, type, code))
 		return true;
 
-	if (icmp_global_allow())
+	if (icmp_global_allow()) {
+		*apply_ratelimit = true;
 		return true;
-
+	}
 	__ICMP_INC_STATS(net, ICMP_MIB_RATELIMITGLOBAL);
 	return false;
 }
@@ -305,15 +310,16 @@
  */
 
 static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
-			       struct flowi4 *fl4, int type, int code)
+			       struct flowi4 *fl4, int type, int code,
+			       bool apply_ratelimit)
 {
 	struct dst_entry *dst = &rt->dst;
 	struct inet_peer *peer;
 	bool rc = true;
 	int vif;
 
-	if (icmpv4_mask_allow(net, type, code))
-		goto out;
+	if (!apply_ratelimit)
+		return true;
 
 	/* No rate limit on loopback */
 	if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
@@ -328,6 +334,8 @@
 out:
 	if (!rc)
 		__ICMP_INC_STATS(net, ICMP_MIB_RATELIMITHOST);
+	else
+		icmp_global_consume();
 	return rc;
 }
 
@@ -399,6 +407,7 @@
 	struct ipcm_cookie ipc;
 	struct rtable *rt = skb_rtable(skb);
 	struct net *net = dev_net(rt->dst.dev);
+	bool apply_ratelimit = false;
 	struct flowi4 fl4;
 	struct sock *sk;
 	struct inet_sock *inet;
@@ -410,11 +419,11 @@
 	if (ip_options_echo(net, &icmp_param->replyopts.opt.opt, skb))
 		return;
 
-	/* Needed by both icmp_global_allow and icmp_xmit_lock */
+	/* Needed by both icmpv4_global_allow and icmp_xmit_lock */
 	local_bh_disable();
 
-	/* global icmp_msgs_per_sec */
-	if (!icmpv4_global_allow(net, type, code))
+	/* is global icmp_msgs_per_sec exhausted ? */
+	if (!icmpv4_global_allow(net, type, code, &apply_ratelimit))
 		goto out_bh_enable;
 
 	sk = icmp_xmit_lock(net);
@@ -447,7 +456,7 @@
 	rt = ip_route_output_key(net, &fl4);
 	if (IS_ERR(rt))
 		goto out_unlock;
-	if (icmpv4_xrlim_allow(net, rt, &fl4, type, code))
+	if (icmpv4_xrlim_allow(net, rt, &fl4, type, code, apply_ratelimit))
 		icmp_push_reply(sk, icmp_param, &fl4, &ipc, &rt);
 	ip_rt_put(rt);
 out_unlock:
@@ -482,6 +491,7 @@
 					struct icmp_bxm *param)
 {
 	struct net_device *route_lookup_dev;
+	struct dst_entry *dst, *dst2;
 	struct rtable *rt, *rt2;
 	struct flowi4 fl4_dec;
 	int err;
@@ -507,16 +517,20 @@
 	/* No need to clone since we're just using its address. */
 	rt2 = rt;
 
-	rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
-					   flowi4_to_flowi(fl4), NULL, 0);
-	if (!IS_ERR(rt)) {
+	dst = xfrm_lookup(net, &rt->dst,
+			  flowi4_to_flowi(fl4), NULL, 0);
+	rt = dst_rtable(dst);
+	if (!IS_ERR(dst)) {
 		if (rt != rt2)
 			return rt;
-	} else if (PTR_ERR(rt) == -EPERM) {
+		if (inet_addr_type_dev_table(net, route_lookup_dev,
+					     fl4->daddr) == RTN_LOCAL)
+			return rt;
+	} else if (PTR_ERR(dst) == -EPERM) {
 		rt = NULL;
-	} else
+	} else {
 		return rt;
-
+	}
 	err = xfrm_decode_session_reverse(net, skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
 	if (err)
 		goto relookup_failed;
@@ -550,19 +564,19 @@
 	if (err)
 		goto relookup_failed;
 
-	rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
-					    flowi4_to_flowi(&fl4_dec), NULL,
-					    XFRM_LOOKUP_ICMP);
-	if (!IS_ERR(rt2)) {
+	dst2 = xfrm_lookup(net, &rt2->dst, flowi4_to_flowi(&fl4_dec), NULL,
+			   XFRM_LOOKUP_ICMP);
+	rt2 = dst_rtable(dst2);
+	if (!IS_ERR(dst2)) {
 		dst_release(&rt->dst);
 		memcpy(fl4, &fl4_dec, sizeof(*fl4));
 		rt = rt2;
-	} else if (PTR_ERR(rt2) == -EPERM) {
+	} else if (PTR_ERR(dst2) == -EPERM) {
 		if (rt)
 			dst_release(&rt->dst);
 		return rt2;
 	} else {
-		err = PTR_ERR(rt2);
+		err = PTR_ERR(dst2);
 		goto relookup_failed;
 	}
 	return rt;
@@ -591,6 +605,7 @@
 	int room;
 	struct icmp_bxm icmp_param;
 	struct rtable *rt = skb_rtable(skb_in);
+	bool apply_ratelimit = false;
 	struct ipcm_cookie ipc;
 	struct flowi4 fl4;
 	__be32 saddr;
@@ -672,7 +687,7 @@
 		}
 	}
 
-	/* Needed by both icmp_global_allow and icmp_xmit_lock */
+	/* Needed by both icmpv4_global_allow and icmp_xmit_lock */
 	local_bh_disable();
 
 	/* Check global sysctl_icmp_msgs_per_sec ratelimit, unless
@@ -680,7 +695,7 @@
 	 * loopback, then peer ratelimit still work (in icmpv4_xrlim_allow)
 	 */
 	if (!(skb_in->dev && (skb_in->dev->flags&IFF_LOOPBACK)) &&
-	      !icmpv4_global_allow(net, type, code))
+	      !icmpv4_global_allow(net, type, code, &apply_ratelimit))
 		goto out_bh_enable;
 
 	sk = icmp_xmit_lock(net);
@@ -739,7 +754,7 @@
 		goto out_unlock;
 
 	/* peer icmp_ratelimit */
-	if (!icmpv4_xrlim_allow(net, rt, &fl4, type, code))
+	if (!icmpv4_xrlim_allow(net, rt, &fl4, type, code, apply_ratelimit))
 		goto ende;
 
 	/* RFC says return as much as we can without exceeding 576 bytes. */
@@ -1032,6 +1047,8 @@
 	struct icmp_ext_hdr *ext_hdr, _ext_hdr;
 	struct icmp_ext_echo_iio *iio, _iio;
 	struct net *net = dev_net(skb->dev);
+	struct inet6_dev *in6_dev;
+	struct in_device *in_dev;
 	struct net_device *dev;
 	char buff[IFNAMSIZ];
 	u16 ident_len;
@@ -1115,10 +1132,15 @@
 	/* Fill bits in reply message */
 	if (dev->flags & IFF_UP)
 		status |= ICMP_EXT_ECHOREPLY_ACTIVE;
-	if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list)
+
+	in_dev = __in_dev_get_rcu(dev);
+	if (in_dev && rcu_access_pointer(in_dev->ifa_list))
 		status |= ICMP_EXT_ECHOREPLY_IPV4;
-	if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list))
+
+	in6_dev = __in6_dev_get(dev);
+	if (in6_dev && !list_empty(&in6_dev->addr_list))
 		status |= ICMP_EXT_ECHOREPLY_IPV6;
+
 	dev_put(dev);
 	icmphdr->un.echo.sequence |= htons(status);
 	return true;
--- linux-qcom-6.8.0.orig/net/ipv4/inet_connection_sock.c
+++ linux-qcom-6.8.0/net/ipv4/inet_connection_sock.c
@@ -203,8 +203,15 @@
 				   kuid_t sk_uid, bool relax,
 				   bool reuseport_cb_ok, bool reuseport_ok)
 {
-	if (sk->sk_family == AF_INET && ipv6_only_sock(sk2))
-		return false;
+	if (ipv6_only_sock(sk2)) {
+		if (sk->sk_family == AF_INET)
+			return false;
+
+#if IS_ENABLED(CONFIG_IPV6)
+		if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
+			return false;
+#endif
+	}
 
 	return inet_bind_conflict(sk, sk2, sk_uid, relax,
 				  reuseport_cb_ok, reuseport_ok);
@@ -287,6 +294,7 @@
 	struct sock_reuseport *reuseport_cb;
 	struct inet_bind_hashbucket *head2;
 	struct inet_bind2_bucket *tb2;
+	bool conflict = false;
 	bool reuseport_cb_ok;
 
 	rcu_read_lock();
@@ -299,18 +307,20 @@
 
 	spin_lock(&head2->lock);
 
-	inet_bind_bucket_for_each(tb2, &head2->chain)
-		if (inet_bind2_bucket_match_addr_any(tb2, net, port, l3mdev, sk))
-			break;
+	inet_bind_bucket_for_each(tb2, &head2->chain) {
+		if (!inet_bind2_bucket_match_addr_any(tb2, net, port, l3mdev, sk))
+			continue;
 
-	if (tb2 && inet_bhash2_conflict(sk, tb2, uid, relax, reuseport_cb_ok,
-					reuseport_ok)) {
-		spin_unlock(&head2->lock);
-		return true;
+		if (!inet_bhash2_conflict(sk, tb2, uid, relax, reuseport_cb_ok,	reuseport_ok))
+			continue;
+
+		conflict = true;
+		break;
 	}
 
 	spin_unlock(&head2->lock);
-	return false;
+
+	return conflict;
 }
 
 /*
@@ -771,6 +781,20 @@
 }
 EXPORT_SYMBOL(inet_csk_clear_xmit_timers);
 
+void inet_csk_clear_xmit_timers_sync(struct sock *sk)
+{
+	struct inet_connection_sock *icsk = inet_csk(sk);
+
+	/* ongoing timer handlers need to acquire socket lock. */
+	sock_not_owned_by_me(sk);
+
+	icsk->icsk_pending = icsk->icsk_ack.pending = 0;
+
+	sk_stop_timer_sync(sk, &icsk->icsk_retransmit_timer);
+	sk_stop_timer_sync(sk, &icsk->icsk_delack_timer);
+	sk_stop_timer_sync(sk, &sk->sk_timer);
+}
+
 void inet_csk_delete_keepalive_timer(struct sock *sk)
 {
 	sk_stop_timer(sk, &sk->sk_timer);
@@ -960,21 +984,31 @@
 		found = __sk_nulls_del_node_init_rcu(sk);
 		spin_unlock(lock);
 	}
-	if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
-		reqsk_put(req);
+
 	return found;
 }
 
-bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
+static bool __inet_csk_reqsk_queue_drop(struct sock *sk,
+					struct request_sock *req,
+					bool from_timer)
 {
 	bool unlinked = reqsk_queue_unlink(req);
 
+	if (!from_timer && timer_delete_sync(&req->rsk_timer))
+		reqsk_put(req);
+
 	if (unlinked) {
 		reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req);
 		reqsk_put(req);
 	}
+
 	return unlinked;
 }
+
+bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
+{
+	return __inet_csk_reqsk_queue_drop(sk, req, false);
+}
 EXPORT_SYMBOL(inet_csk_reqsk_queue_drop);
 
 void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req)
@@ -1067,7 +1101,7 @@
 
 		if (!inet_ehash_insert(req_to_sk(nreq), req_to_sk(oreq), NULL)) {
 			/* delete timer */
-			inet_csk_reqsk_queue_drop(sk_listener, nreq);
+			__inet_csk_reqsk_queue_drop(sk_listener, nreq, true);
 			goto no_ownership;
 		}
 
@@ -1093,28 +1127,38 @@
 	}
 
 drop:
-	inet_csk_reqsk_queue_drop_and_put(oreq->rsk_listener, oreq);
+	__inet_csk_reqsk_queue_drop(sk_listener, oreq, true);
+	reqsk_put(oreq);
 }
 
-static void reqsk_queue_hash_req(struct request_sock *req,
+static bool reqsk_queue_hash_req(struct request_sock *req,
 				 unsigned long timeout)
 {
+	bool found_dup_sk = false;
+
+	if (!inet_ehash_insert(req_to_sk(req), NULL, &found_dup_sk))
+		return false;
+
+	/* The timer needs to be setup after a successful insertion. */
 	timer_setup(&req->rsk_timer, reqsk_timer_handler, TIMER_PINNED);
 	mod_timer(&req->rsk_timer, jiffies + timeout);
 
-	inet_ehash_insert(req_to_sk(req), NULL, NULL);
 	/* before letting lookups find us, make sure all req fields
 	 * are committed to memory and refcnt initialized.
 	 */
 	smp_wmb();
 	refcount_set(&req->rsk_refcnt, 2 + 1);
+	return true;
 }
 
-void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
+bool inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
 				   unsigned long timeout)
 {
-	reqsk_queue_hash_req(req, timeout);
+	if (!reqsk_queue_hash_req(req, timeout))
+		return false;
+
 	inet_csk_reqsk_queue_added(sk);
+	return true;
 }
 EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add);
 
--- linux-qcom-6.8.0.orig/net/ipv4/inet_diag.c
+++ linux-qcom-6.8.0/net/ipv4/inet_diag.c
@@ -57,7 +57,7 @@
 		return ERR_PTR(-ENOENT);
 	}
 
-	if (!inet_diag_table[proto])
+	if (!READ_ONCE(inet_diag_table[proto]))
 		sock_load_diag_module(AF_INET, proto);
 
 	mutex_lock(&inet_diag_table_mutex);
@@ -1365,6 +1365,7 @@
 	req.sdiag_family = AF_UNSPEC; /* compatibility */
 	req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type);
 	req.idiag_ext = rc->idiag_ext;
+	req.pad = 0;
 	req.idiag_states = rc->idiag_states;
 	req.id = rc->id;
 
@@ -1380,6 +1381,7 @@
 	req.sdiag_family = rc->idiag_family;
 	req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type);
 	req.idiag_ext = rc->idiag_ext;
+	req.pad = 0;
 	req.idiag_states = rc->idiag_states;
 	req.id = rc->id;
 
@@ -1479,6 +1481,7 @@
 }
 
 static const struct sock_diag_handler inet_diag_handler = {
+	.owner = THIS_MODULE,
 	.family = AF_INET,
 	.dump = inet_diag_handler_cmd,
 	.get_info = inet_diag_handler_get_info,
@@ -1486,6 +1489,7 @@
 };
 
 static const struct sock_diag_handler inet6_diag_handler = {
+	.owner = THIS_MODULE,
 	.family = AF_INET6,
 	.dump = inet_diag_handler_cmd,
 	.get_info = inet_diag_handler_get_info,
@@ -1503,7 +1507,7 @@
 	mutex_lock(&inet_diag_table_mutex);
 	err = -EEXIST;
 	if (!inet_diag_table[type]) {
-		inet_diag_table[type] = h;
+		WRITE_ONCE(inet_diag_table[type], h);
 		err = 0;
 	}
 	mutex_unlock(&inet_diag_table_mutex);
@@ -1520,11 +1524,16 @@
 		return;
 
 	mutex_lock(&inet_diag_table_mutex);
-	inet_diag_table[type] = NULL;
+	WRITE_ONCE(inet_diag_table[type], NULL);
 	mutex_unlock(&inet_diag_table_mutex);
 }
 EXPORT_SYMBOL_GPL(inet_diag_unregister);
 
+static const struct sock_diag_inet_compat inet_diag_compat = {
+	.owner	= THIS_MODULE,
+	.fn	= inet_diag_rcv_msg_compat,
+};
+
 static int __init inet_diag_init(void)
 {
 	const int inet_diag_table_size = (IPPROTO_MAX *
@@ -1543,7 +1552,7 @@
 	if (err)
 		goto out_free_inet;
 
-	sock_diag_register_inet_compat(inet_diag_rcv_msg_compat);
+	sock_diag_register_inet_compat(&inet_diag_compat);
 out:
 	return err;
 
@@ -1558,7 +1567,7 @@
 {
 	sock_diag_unregister(&inet6_diag_handler);
 	sock_diag_unregister(&inet_diag_handler);
-	sock_diag_unregister_inet_compat(inet_diag_rcv_msg_compat);
+	sock_diag_unregister_inet_compat(&inet_diag_compat);
 	kfree(inet_diag_table);
 }
 
--- linux-qcom-6.8.0.orig/net/ipv4/inet_fragment.c
+++ linux-qcom-6.8.0/net/ipv4/inet_fragment.c
@@ -24,6 +24,8 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 
+#include "../core/sock_destructor.h"
+
 /* Use skb->cb to track consecutive/adjacent fragments coming at
  * the end of the queue. Nodes in the rb-tree queue will
  * contain "runs" of one or more adjacent fragments.
@@ -39,6 +41,7 @@
 	};
 	struct sk_buff		*next_frag;
 	int			frag_run_len;
+	int			ip_defrag_offset;
 };
 
 #define FRAG_CB(skb)		((struct ipfrag_skb_cb *)((skb)->cb))
@@ -396,12 +399,12 @@
 	 */
 	if (!last)
 		fragrun_create(q, skb);  /* First fragment. */
-	else if (last->ip_defrag_offset + last->len < end) {
+	else if (FRAG_CB(last)->ip_defrag_offset + last->len < end) {
 		/* This is the common case: skb goes to the end. */
 		/* Detect and discard overlaps. */
-		if (offset < last->ip_defrag_offset + last->len)
+		if (offset < FRAG_CB(last)->ip_defrag_offset + last->len)
 			return IPFRAG_OVERLAP;
-		if (offset == last->ip_defrag_offset + last->len)
+		if (offset == FRAG_CB(last)->ip_defrag_offset + last->len)
 			fragrun_append_to_last(q, skb);
 		else
 			fragrun_create(q, skb);
@@ -418,13 +421,13 @@
 
 			parent = *rbn;
 			curr = rb_to_skb(parent);
-			curr_run_end = curr->ip_defrag_offset +
+			curr_run_end = FRAG_CB(curr)->ip_defrag_offset +
 					FRAG_CB(curr)->frag_run_len;
-			if (end <= curr->ip_defrag_offset)
+			if (end <= FRAG_CB(curr)->ip_defrag_offset)
 				rbn = &parent->rb_left;
 			else if (offset >= curr_run_end)
 				rbn = &parent->rb_right;
-			else if (offset >= curr->ip_defrag_offset &&
+			else if (offset >= FRAG_CB(curr)->ip_defrag_offset &&
 				 end <= curr_run_end)
 				return IPFRAG_DUP;
 			else
@@ -438,7 +441,7 @@
 		rb_insert_color(&skb->rbnode, &q->rb_fragments);
 	}
 
-	skb->ip_defrag_offset = offset;
+	FRAG_CB(skb)->ip_defrag_offset = offset;
 
 	return IPFRAG_OK;
 }
@@ -448,13 +451,28 @@
 			      struct sk_buff *parent)
 {
 	struct sk_buff *fp, *head = skb_rb_first(&q->rb_fragments);
-	struct sk_buff **nextp;
+	void (*destructor)(struct sk_buff *);
+	unsigned int orig_truesize = 0;
+	struct sk_buff **nextp = NULL;
+	struct sock *sk = skb->sk;
 	int delta;
 
+	if (sk && is_skb_wmem(skb)) {
+		/* TX: skb->sk might have been passed as argument to
+		 * dst->output and must remain valid until tx completes.
+		 *
+		 * Move sk to reassembled skb and fix up wmem accounting.
+		 */
+		orig_truesize = skb->truesize;
+		destructor = skb->destructor;
+	}
+
 	if (head != skb) {
 		fp = skb_clone(skb, GFP_ATOMIC);
-		if (!fp)
-			return NULL;
+		if (!fp) {
+			head = skb;
+			goto out_restore_sk;
+		}
 		FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag;
 		if (RB_EMPTY_NODE(&skb->rbnode))
 			FRAG_CB(parent)->next_frag = fp;
@@ -463,6 +481,12 @@
 					&q->rb_fragments);
 		if (q->fragments_tail == skb)
 			q->fragments_tail = fp;
+
+		if (orig_truesize) {
+			/* prevent skb_morph from releasing sk */
+			skb->sk = NULL;
+			skb->destructor = NULL;
+		}
 		skb_morph(skb, head);
 		FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag;
 		rb_replace_node(&head->rbnode, &skb->rbnode,
@@ -470,13 +494,13 @@
 		consume_skb(head);
 		head = skb;
 	}
-	WARN_ON(head->ip_defrag_offset != 0);
+	WARN_ON(FRAG_CB(head)->ip_defrag_offset != 0);
 
 	delta = -head->truesize;
 
 	/* Head of list must not be cloned. */
 	if (skb_unclone(head, GFP_ATOMIC))
-		return NULL;
+		goto out_restore_sk;
 
 	delta += head->truesize;
 	if (delta)
@@ -492,7 +516,7 @@
 
 		clone = alloc_skb(0, GFP_ATOMIC);
 		if (!clone)
-			return NULL;
+			goto out_restore_sk;
 		skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
 		skb_frag_list_init(head);
 		for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
@@ -509,6 +533,21 @@
 		nextp = &skb_shinfo(head)->frag_list;
 	}
 
+out_restore_sk:
+	if (orig_truesize) {
+		int ts_delta = head->truesize - orig_truesize;
+
+		/* if this reassembled skb is fragmented later,
+		 * fraglist skbs will get skb->sk assigned from head->sk,
+		 * and each frag skb will be released via sock_wfree.
+		 *
+		 * Update sk_wmem_alloc.
+		 */
+		head->sk = sk;
+		head->destructor = destructor;
+		refcount_add(ts_delta, &sk->sk_wmem_alloc);
+	}
+
 	return nextp;
 }
 EXPORT_SYMBOL(inet_frag_reasm_prepare);
@@ -516,6 +555,8 @@
 void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
 			    void *reasm_data, bool try_coalesce)
 {
+	struct sock *sk = is_skb_wmem(head) ? head->sk : NULL;
+	const unsigned int head_truesize = head->truesize;
 	struct sk_buff **nextp = reasm_data;
 	struct rb_node *rbn;
 	struct sk_buff *fp;
@@ -578,7 +619,10 @@
 	skb_mark_not_on_list(head);
 	head->prev = NULL;
 	head->tstamp = q->stamp;
-	head->mono_delivery_time = q->mono_delivery_time;
+	head->tstamp_type = q->tstamp_type;
+
+	if (sk)
+		refcount_add(sum_truesize - head_truesize, &sk->sk_wmem_alloc);
 }
 EXPORT_SYMBOL(inet_frag_reasm_finish);
 
--- linux-qcom-6.8.0.orig/net/ipv4/inet_hashtables.c
+++ linux-qcom-6.8.0/net/ipv4/inet_hashtables.c
@@ -1136,7 +1136,7 @@
 		sock_prot_inuse_add(net, sk->sk_prot, -1);
 
 		spin_lock(lock);
-		sk_nulls_del_node_init_rcu(sk);
+		__sk_nulls_del_node_init_rcu(sk);
 		spin_unlock(lock);
 
 		sk->sk_hash = 0;
--- linux-qcom-6.8.0.orig/net/ipv4/inet_timewait_sock.c
+++ linux-qcom-6.8.0/net/ipv4/inet_timewait_sock.c
@@ -96,9 +96,13 @@
  * Enter the time wait state. This is called with locally disabled BH.
  * Essentially we whip up a timewait bucket, copy the relevant info into it
  * from the SK, and mess with hash chains and list linkage.
+ *
+ * The caller must not access @tw anymore after this function returns.
  */
-void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
-			   struct inet_hashinfo *hashinfo)
+void inet_twsk_hashdance_schedule(struct inet_timewait_sock *tw,
+				  struct sock *sk,
+				  struct inet_hashinfo *hashinfo,
+				  int timeo)
 {
 	const struct inet_sock *inet = inet_sk(sk);
 	const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -129,26 +133,33 @@
 
 	spin_lock(lock);
 
+	/* Step 2: Hash TW into tcp ehash chain */
 	inet_twsk_add_node_rcu(tw, &ehead->chain);
 
 	/* Step 3: Remove SK from hash chain */
 	if (__sk_nulls_del_node_init_rcu(sk))
 		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
 
-	spin_unlock(lock);
 
+	/* Ensure above writes are committed into memory before updating the
+	 * refcount.
+	 * Provides ordering vs later refcount_inc().
+	 */
+	smp_wmb();
 	/* tw_refcnt is set to 3 because we have :
 	 * - one reference for bhash chain.
 	 * - one reference for ehash chain.
 	 * - one reference for timer.
-	 * We can use atomic_set() because prior spin_lock()/spin_unlock()
-	 * committed into memory all tw fields.
 	 * Also note that after this point, we lost our implicit reference
 	 * so we are not allowed to use tw anymore.
 	 */
 	refcount_set(&tw->tw_refcnt, 3);
+
+	inet_twsk_schedule(tw, timeo);
+
+	spin_unlock(lock);
 }
-EXPORT_SYMBOL_GPL(inet_twsk_hashdance);
+EXPORT_SYMBOL_GPL(inet_twsk_hashdance_schedule);
 
 static void tw_timer_handler(struct timer_list *t)
 {
@@ -217,7 +228,34 @@
  */
 void inet_twsk_deschedule_put(struct inet_timewait_sock *tw)
 {
-	if (del_timer_sync(&tw->tw_timer))
+	struct inet_hashinfo *hashinfo = tw->tw_dr->hashinfo;
+	spinlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash);
+
+	/* inet_twsk_purge() walks over all sockets, including tw ones,
+	 * and removes them via inet_twsk_deschedule_put() after a
+	 * refcount_inc_not_zero().
+	 *
+	 * inet_twsk_hashdance_schedule() must (re)init the refcount before
+	 * arming the timer, i.e. inet_twsk_purge can obtain a reference to
+	 * a twsk that did not yet schedule the timer.
+	 *
+	 * The ehash lock synchronizes these two:
+	 * After acquiring the lock, the timer is always scheduled (else
+	 * timer_shutdown returns false), because hashdance_schedule releases
+	 * the ehash lock only after completing the timer initialization.
+	 *
+	 * Without grabbing the ehash lock, we get:
+	 * 1) cpu x sets twsk refcount to 3
+	 * 2) cpu y bumps refcount to 4
+	 * 3) cpu y calls inet_twsk_deschedule_put() and shuts timer down
+	 * 4) cpu x tries to start timer, but mod_timer is a noop post-shutdown
+	 * -> timer refcount is never decremented.
+	 */
+	spin_lock(lock);
+	/*  Makes sure hashdance_schedule() has completed */
+	spin_unlock(lock);
+
+	if (timer_shutdown_sync(&tw->tw_timer))
 		inet_twsk_kill(tw);
 	inet_twsk_put(tw);
 }
@@ -263,52 +301,51 @@
 }
 EXPORT_SYMBOL_GPL(__inet_twsk_schedule);
 
-void inet_twsk_purge(struct inet_hashinfo *hashinfo, int family)
+/* Remove all non full sockets (TIME_WAIT and NEW_SYN_RECV) for dead netns */
+void inet_twsk_purge(struct inet_hashinfo *hashinfo)
 {
-	struct inet_timewait_sock *tw;
-	struct sock *sk;
+	struct inet_ehash_bucket *head = &hashinfo->ehash[0];
+	unsigned int ehash_mask = hashinfo->ehash_mask;
 	struct hlist_nulls_node *node;
 	unsigned int slot;
+	struct sock *sk;
+
+	for (slot = 0; slot <= ehash_mask; slot++, head++) {
+		if (hlist_nulls_empty(&head->chain))
+			continue;
 
-	for (slot = 0; slot <= hashinfo->ehash_mask; slot++) {
-		struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 restart_rcu:
 		cond_resched();
 		rcu_read_lock();
 restart:
 		sk_nulls_for_each_rcu(sk, node, &head->chain) {
-			if (sk->sk_state != TCP_TIME_WAIT) {
-				/* A kernel listener socket might not hold refcnt for net,
-				 * so reqsk_timer_handler() could be fired after net is
-				 * freed.  Userspace listener and reqsk never exist here.
-				 */
-				if (unlikely(sk->sk_state == TCP_NEW_SYN_RECV &&
-					     hashinfo->pernet)) {
-					struct request_sock *req = inet_reqsk(sk);
-
-					inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, req);
-				}
+			int state = inet_sk_state_load(sk);
 
+			if ((1 << state) & ~(TCPF_TIME_WAIT |
+					     TCPF_NEW_SYN_RECV))
 				continue;
-			}
 
-			tw = inet_twsk(sk);
-			if ((tw->tw_family != family) ||
-				refcount_read(&twsk_net(tw)->ns.count))
+			if (refcount_read(&sock_net(sk)->ns.count))
 				continue;
 
-			if (unlikely(!refcount_inc_not_zero(&tw->tw_refcnt)))
+			if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
 				continue;
 
-			if (unlikely((tw->tw_family != family) ||
-				     refcount_read(&twsk_net(tw)->ns.count))) {
-				inet_twsk_put(tw);
+			if (refcount_read(&sock_net(sk)->ns.count)) {
+				sock_gen_put(sk);
 				goto restart;
 			}
 
 			rcu_read_unlock();
 			local_bh_disable();
-			inet_twsk_deschedule_put(tw);
+			if (state == TCP_TIME_WAIT) {
+				inet_twsk_deschedule_put(inet_twsk(sk));
+			} else {
+				struct request_sock *req = inet_reqsk(sk);
+
+				inet_csk_reqsk_queue_drop_and_put(req->rsk_listener,
+								  req);
+			}
 			local_bh_enable();
 			goto restart_rcu;
 		}
--- linux-qcom-6.8.0.orig/net/ipv4/ip_fragment.c
+++ linux-qcom-6.8.0/net/ipv4/ip_fragment.c
@@ -355,7 +355,7 @@
 		qp->iif = dev->ifindex;
 
 	qp->q.stamp = skb->tstamp;
-	qp->q.mono_delivery_time = skb->mono_delivery_time;
+	qp->q.tstamp_type = skb->tstamp_type;
 	qp->q.meat += skb->len;
 	qp->ecn |= ecn;
 	add_frag_mem_limit(qp->q.fqdir, skb->truesize);
@@ -384,6 +384,7 @@
 	}
 
 	skb_dst_drop(skb);
+	skb_orphan(skb);
 	return -EINPROGRESS;
 
 insert_error:
@@ -487,7 +488,6 @@
 	struct ipq *qp;
 
 	__IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS);
-	skb_orphan(skb);
 
 	/* Lookup (or create) queue header */
 	qp = ip_find(net, ip_hdr(skb), user, vif);
--- linux-qcom-6.8.0.orig/net/ipv4/ip_gre.c
+++ linux-qcom-6.8.0/net/ipv4/ip_gre.c
@@ -280,8 +280,13 @@
 					  tpi->flags | TUNNEL_NO_KEY,
 					  iph->saddr, iph->daddr, 0);
 	} else {
+		if (unlikely(!pskb_may_pull(skb,
+					    gre_hdr_len + sizeof(*ershdr))))
+			return PACKET_REJECT;
+
 		ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
 		ver = ershdr->ver;
+		iph = ip_hdr(skb);
 		tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex,
 					  tpi->flags | TUNNEL_KEY,
 					  iph->saddr, iph->daddr, tpi->key);
@@ -640,11 +645,11 @@
 		if (skb_cow_head(skb, 0))
 			goto free_skb;
 
-		tnl_params = (const struct iphdr *)skb->data;
-
-		if (!pskb_network_may_pull(skb, pull_len))
+		if (!pskb_may_pull(skb, pull_len))
 			goto free_skb;
 
+		tnl_params = (const struct iphdr *)skb->data;
+
 		/* ip_tunnel_xmit() needs skb->data pointing to gre header. */
 		skb_pull(skb, pull_len);
 		skb_reset_mac_header(skb);
--- linux-qcom-6.8.0.orig/net/ipv4/ip_input.c
+++ linux-qcom-6.8.0/net/ipv4/ip_input.c
@@ -616,7 +616,7 @@
 		dst = skb_dst(skb);
 		if (curr_dst != dst) {
 			hint = ip_extract_route_hint(net, skb,
-					       ((struct rtable *)dst)->rt_type);
+						     dst_rtable(dst)->rt_type);
 
 			/* dispatch old sublist */
 			if (!list_empty(&sublist))
--- linux-qcom-6.8.0.orig/net/ipv4/ip_output.c
+++ linux-qcom-6.8.0/net/ipv4/ip_output.c
@@ -198,7 +198,7 @@
 static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
 	struct dst_entry *dst = skb_dst(skb);
-	struct rtable *rt = (struct rtable *)dst;
+	struct rtable *rt = dst_rtable(dst);
 	struct net_device *dev = dst->dev;
 	unsigned int hh_len = LL_RESERVED_SPACE(dev);
 	struct neighbour *neigh;
@@ -475,7 +475,7 @@
 		goto packet_routed;
 
 	/* Make sure we can route this packet. */
-	rt = (struct rtable *)__sk_dst_check(sk, 0);
+	rt = dst_rtable(__sk_dst_check(sk, 0));
 	if (!rt) {
 		__be32 daddr;
 
@@ -764,7 +764,7 @@
 {
 	struct iphdr *iph;
 	struct sk_buff *skb2;
-	bool mono_delivery_time = skb->mono_delivery_time;
+	u8 tstamp_type = skb->tstamp_type;
 	struct rtable *rt = skb_rtable(skb);
 	unsigned int mtu, hlen, ll_rs;
 	struct ip_fraglist_iter iter;
@@ -856,7 +856,7 @@
 				}
 			}
 
-			skb_set_delivery_time(skb, tstamp, mono_delivery_time);
+			skb_set_delivery_time(skb, tstamp, tstamp_type);
 			err = output(net, sk, skb);
 
 			if (!err)
@@ -912,7 +912,7 @@
 		/*
 		 *	Put this fragment into the sending queue.
 		 */
-		skb_set_delivery_time(skb2, tstamp, mono_delivery_time);
+		skb_set_delivery_time(skb2, tstamp, tstamp_type);
 		err = output(net, sk, skb2);
 		if (err)
 			goto fail;
@@ -971,7 +971,7 @@
 	bool zc = false;
 	unsigned int maxfraglen, fragheaderlen, maxnonfragsize;
 	int csummode = CHECKSUM_NONE;
-	struct rtable *rt = (struct rtable *)cork->dst;
+	struct rtable *rt = dst_rtable(cork->dst);
 	bool paged, hold_tskey, extra_uref = false;
 	unsigned int wmem_alloc_delta = 0;
 	u32 tskey = 0;
@@ -1390,7 +1390,7 @@
 	struct inet_sock *inet = inet_sk(sk);
 	struct net *net = sock_net(sk);
 	struct ip_options *opt = NULL;
-	struct rtable *rt = (struct rtable *)cork->dst;
+	struct rtable *rt = dst_rtable(cork->dst);
 	struct iphdr *iph;
 	u8 pmtudisc, ttl;
 	__be16 df = 0;
@@ -1457,7 +1457,10 @@
 
 	skb->priority = (cork->tos != -1) ? cork->priority: READ_ONCE(sk->sk_priority);
 	skb->mark = cork->mark;
-	skb->tstamp = cork->transmit_time;
+	if (sk_is_tcp(sk))
+		skb_set_delivery_time(skb, cork->transmit_time, SKB_CLOCK_MONOTONIC);
+	else
+		skb_set_delivery_type_by_clockid(skb, cork->transmit_time, sk->sk_clockid);
 	/*
 	 * Steal rt from cork.dst to avoid a pair of atomic_inc/atomic_dec
 	 * on dst refcount
@@ -1473,7 +1476,7 @@
 		 * by icmp_hdr(skb)->type.
 		 */
 		if (sk->sk_type == SOCK_RAW &&
-		    !inet_test_bit(HDRINCL, sk))
+		    !(fl4->flowi4_flags & FLOWI_FLAG_KNOWN_NH))
 			icmp_type = fl4->fl4_icmp_type;
 		else
 			icmp_type = icmp_hdr(skb)->type;
@@ -1649,7 +1652,8 @@
 			  arg->csumoffset) = csum_fold(csum_add(nskb->csum,
 								arg->csum));
 		nskb->ip_summed = CHECKSUM_NONE;
-		nskb->mono_delivery_time = !!transmit_time;
+		if (transmit_time)
+			nskb->tstamp_type = SKB_CLOCK_MONOTONIC;
 		if (txhash)
 			skb_set_hash(nskb, txhash, PKT_HASH_TYPE_L4);
 		ip_push_pending_frames(sk, &fl4);
--- linux-qcom-6.8.0.orig/net/ipv4/ip_sockglue.c
+++ linux-qcom-6.8.0/net/ipv4/ip_sockglue.c
@@ -128,20 +128,20 @@
 
 static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
 {
-	char *secdata;
-	u32 seclen, secid;
+	struct lsmcontext ctx;
+	u32 secid;
 	int err;
 
 	err = security_socket_getpeersec_dgram(NULL, skb, &secid);
 	if (err)
 		return;
 
-	err = security_secid_to_secctx(secid, &secdata, &seclen);
-	if (err)
+	err = security_secid_to_secctx(secid, &ctx);
+	if (err < 0)
 		return;
 
-	put_cmsg(msg, SOL_IP, SCM_SECURITY, seclen, secdata);
-	security_release_secctx(secdata, seclen);
+	put_cmsg(msg, SOL_IP, SCM_SECURITY, ctx.len, ctx.context);
+	security_release_secctx(&ctx);
 }
 
 static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
--- linux-qcom-6.8.0.orig/net/ipv4/ip_tunnel.c
+++ linux-qcom-6.8.0/net/ipv4/ip_tunnel.c
@@ -43,6 +43,7 @@
 #include <net/rtnetlink.h>
 #include <net/udp.h>
 #include <net/dst_metadata.h>
+#include <net/inet_dscp.h>
 
 #if IS_ENABLED(CONFIG_IPV6)
 #include <net/ipv6.h>
@@ -102,10 +103,9 @@
 		if (!ip_tunnel_key_match(&t->parms, flags, key))
 			continue;
 
-		if (t->parms.link == link)
+		if (READ_ONCE(t->parms.link) == link)
 			return t;
-		else
-			cand = t;
+		cand = t;
 	}
 
 	hlist_for_each_entry_rcu(t, head, hash_node) {
@@ -117,9 +117,9 @@
 		if (!ip_tunnel_key_match(&t->parms, flags, key))
 			continue;
 
-		if (t->parms.link == link)
+		if (READ_ONCE(t->parms.link) == link)
 			return t;
-		else if (!cand)
+		if (!cand)
 			cand = t;
 	}
 
@@ -137,9 +137,9 @@
 		if (!ip_tunnel_key_match(&t->parms, flags, key))
 			continue;
 
-		if (t->parms.link == link)
+		if (READ_ONCE(t->parms.link) == link)
 			return t;
-		else if (!cand)
+		if (!cand)
 			cand = t;
 	}
 
@@ -150,9 +150,9 @@
 		    !(t->dev->flags & IFF_UP))
 			continue;
 
-		if (t->parms.link == link)
+		if (READ_ONCE(t->parms.link) == link)
 			return t;
-		else if (!cand)
+		if (!cand)
 			cand = t;
 	}
 
@@ -218,10 +218,10 @@
 	struct ip_tunnel *t = NULL;
 	struct hlist_head *head = ip_bucket(itn, parms);
 
-	hlist_for_each_entry_rcu(t, head, hash_node) {
+	hlist_for_each_entry_rcu(t, head, hash_node, lockdep_rtnl_is_held()) {
 		if (local == t->parms.iph.saddr &&
 		    remote == t->parms.iph.daddr &&
-		    link == t->parms.link &&
+		    link == READ_ONCE(t->parms.link) &&
 		    type == t->dev->type &&
 		    ip_tunnel_key_match(&t->parms, flags, key))
 			break;
@@ -294,7 +294,7 @@
 
 		ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr,
 				    iph->saddr, tunnel->parms.o_key,
-				    RT_TOS(iph->tos), dev_net(dev),
+				    iph->tos & INET_DSCP_MASK, tunnel->net,
 				    tunnel->parms.link, tunnel->fwmark, 0, 0);
 		rt = ip_route_output_key(tunnel->net, &fl4);
 
@@ -378,7 +378,7 @@
 		  bool log_ecn_error)
 {
 	const struct iphdr *iph = ip_hdr(skb);
-	int err;
+	int nh, err;
 
 #ifdef CONFIG_NET_IPGRE_BROADCAST
 	if (ipv4_is_multicast(iph->daddr)) {
@@ -404,8 +404,21 @@
 		tunnel->i_seqno = ntohl(tpi->seq) + 1;
 	}
 
+	/* Save offset of outer header relative to skb->head,
+	 * because we are going to reset the network header to the inner header
+	 * and might change skb->head.
+	 */
+	nh = skb_network_header(skb) - skb->head;
+
 	skb_set_network_header(skb, (tunnel->dev->type == ARPHRD_ETHER) ? ETH_HLEN : 0);
 
+	if (!pskb_inet_may_pull(skb)) {
+		DEV_STATS_INC(tunnel->dev, rx_length_errors);
+		DEV_STATS_INC(tunnel->dev, rx_errors);
+		goto drop;
+	}
+	iph = (struct iphdr *)(skb->head + nh);
+
 	err = IP_ECN_decapsulate(iph, skb);
 	if (unlikely(err)) {
 		if (log_ecn_error)
@@ -531,7 +544,7 @@
 		struct rt6_info *rt6;
 		__be32 daddr;
 
-		rt6 = skb_valid_dst(skb) ? (struct rt6_info *)skb_dst(skb) :
+		rt6 = skb_valid_dst(skb) ? dst_rt6_info(skb_dst(skb)) :
 					   NULL;
 		daddr = md ? dst : tunnel->parms.iph.daddr;
 
@@ -597,9 +610,9 @@
 			tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph);
 	}
 	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,
-			    tunnel_id_to_key32(key->tun_id), RT_TOS(tos),
-			    dev_net(dev), 0, skb->mark, skb_get_hash(skb),
-			    key->flow_flags);
+			    tunnel_id_to_key32(key->tun_id),
+			    tos & INET_DSCP_MASK, tunnel->net, 0, skb->mark,
+			    skb_get_hash(skb), key->flow_flags);
 
 	if (!tunnel_hlen)
 		tunnel_hlen = ip_encap_hlen(&tun_info->encap);
@@ -760,8 +773,8 @@
 	}
 
 	ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr,
-			    tunnel->parms.o_key, RT_TOS(tos),
-			    dev_net(dev), tunnel->parms.link,
+			    tunnel->parms.o_key, tos & INET_DSCP_MASK,
+			    tunnel->net, READ_ONCE(tunnel->parms.link),
 			    tunnel->fwmark, skb_get_hash(skb), 0);
 
 	if (ip_tunnel_encap(skb, &tunnel->encap, &protocol, &fl4) < 0)
@@ -881,7 +894,7 @@
 	if (t->parms.link != p->link || t->fwmark != fwmark) {
 		int mtu;
 
-		t->parms.link = p->link;
+		WRITE_ONCE(t->parms.link, p->link);
 		t->fwmark = fwmark;
 		mtu = ip_tunnel_bind_dev(dev);
 		if (set_mtu)
@@ -1071,9 +1084,9 @@
 
 int ip_tunnel_get_iflink(const struct net_device *dev)
 {
-	struct ip_tunnel *tunnel = netdev_priv(dev);
+	const struct ip_tunnel *tunnel = netdev_priv(dev);
 
-	return tunnel->parms.link;
+	return READ_ONCE(tunnel->parms.link);
 }
 EXPORT_SYMBOL(ip_tunnel_get_iflink);
 
@@ -1223,7 +1236,7 @@
 	struct ip_tunnel_net *itn = net_generic(net, tunnel->ip_tnl_net_id);
 
 	if (dev == itn->fb_tunnel_dev)
-		return -EINVAL;
+		return fan_has_map(&tunnel->fan) ? 0 : -EINVAL;
 
 	t = ip_tunnel_find(itn, p, dev->type);
 
@@ -1285,6 +1298,7 @@
 
 	if (tunnel->collect_md)
 		netif_keep_dst(dev);
+	netdev_lockdep_set_classes(dev);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_init);
--- linux-qcom-6.8.0.orig/net/ipv4/ipip.c
+++ linux-qcom-6.8.0/net/ipv4/ipip.c
@@ -101,6 +101,8 @@
 #include <linux/init.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/if_ether.h>
+#include <linux/inetdevice.h>
+#include <linux/rculist.h>
 
 #include <net/sock.h>
 #include <net/ip.h>
@@ -267,6 +269,147 @@
 }
 #endif
 
+static struct ip_fan_map *ipip_fan_find_map(struct ip_tunnel *t, __be32 daddr)
+{
+	struct ip_fan_map *fan_map;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(fan_map, &t->fan.fan_maps, list) {
+		if (fan_map->overlay ==
+		    (daddr & inet_make_mask(fan_map->overlay_prefix))) {
+			rcu_read_unlock();
+			return fan_map;
+		}
+	}
+	rcu_read_unlock();
+
+	return NULL;
+}
+
+/* Determine fan tunnel endpoint to send packet to, based on the inner IP
+ * address.  
+ *
+ * Given a /8 overlay and /16 underlay, for an overlay (inner) address
+ * Y.A.B.C, the transformation is F.G.A.B, where "F" and "G" are the first
+ * two octets of the underlay network (the network portion of a /16), "A"
+ * and "B" are the low order two octets of the underlay network host (the
+ * host portion of a /16), and "Y" is a configured first octet of the
+ * overlay network.
+ *
+ * E.g., underlay host 10.88.3.4/16 with an overlay of 99.0.0.0/8 would
+ * host overlay subnet 99.3.4.0/24.  An overlay network datagram from
+ * 99.3.4.5 to 99.6.7.8, would be directed to underlay host 10.88.6.7,
+ * which hosts overlay network subnet 99.6.7.0/24.  This transformation is
+ * described in detail further below.
+ *
+ * Using netmasks for the overlay and underlay other than /8 and /16, as
+ * shown above, can yield larger (or smaller) overlay subnets, with the
+ * trade-off of allowing fewer (or more) underlay hosts to participate.
+ *
+ * The size of each overlay network subnet is defined by the total of the
+ * network mask of the overlay plus the size of host portion of the
+ * underlay network. In the above example, /8 + /16 = /24.
+ *
+ * E.g., consider underlay host 10.99.238.5/20 and overlay 99.0.0.0/8. In
+ * this case, the network portion of the underlay is 10.99.224.0/20, and
+ * the host portion is 0.0.14.5 (12 bits).  To determine the overlay
+ * network subnet, the 12 bits of host portion are left shifted 12 bits
+ * (/20 - /8) and ORed with the overlay subnet prefix.  This yields an
+ * overlay subnet of 99.224.80/20, composed of 8 bits overlay, followed by
+ * 12 bits underlay.  This yields 12 bits in the overlay network portion,
+ * allowing for 4094 addresses in each overlay network subnet.  The
+ * trade-off is that fewer hosts may participate in the underlay network,
+ * as its host address size has shrunk from 16 bits (65534 addresses) in
+ * the first example to 12 bits (4094 addresses) here.
+ *
+ * For fewer hosts per overlay subnet (permitting a larger number of
+ * underlay hosts to participate), the underlay netmask may be made
+ * smaller.
+ *
+ * E.g., underlay host 10.111.1.2/12 (network 10.96.0.0/12, host portion
+ * is 0.15.1.2, 20 bits) with an overlay of 33.0.0.0/8 would left shift
+ * the 20 bits of host by 4 (so that it's highest order bit is adjacent to
+ * the lowest order bit of the /8 overlay).  This yields an overlay subnet
+ * of 33.240.16.32/28 (8 bits overlay, 20 bits from the host portion of
+ * the underlay).  This provides more addresses for the underlay network
+ * (approximately 2^20), but each host's segment of the overlay provides
+ * only 4 bits of addresses (14 usable).
+ *
+ * It is also possible to adjust the overlay subnet.
+ *
+ * For an overlay of 240.0.0.0/5 and underlay of 10.88.0.0/20, consider
+ * underlay host 10.88.129.2; the 12 bits of host, 0.0.1.2, are left
+ * shifted 15 bits (/20 - /5), yielding an overlay network of
+ * 240.129.0.0/17.  An underlay host of 10.88.244.215 would yield an
+ * overlay network of 242.107.128.0/17.
+ *
+ * For an overlay of 100.64.0.0/10 and underlay of 10.224.220.0/24, for
+ * underlay host 10.224.220.10, the underlay host portion (.10) is left
+ * shifted 14 bits, yielding an overlay network subnet of 100.66.128.0/18.
+ * This would permit 254 addresses on the underlay, with each overlay
+ * segment providing approximately 2^14 - 2 addresses (16382).
+ *
+ * For packets being encapsulated, the overlay network destination IP
+ * address is deconstructed into its overlay and underlay-derived
+ * portions.  The underlay portion (determined by the overlay mask and
+ * overlay subnet mask) is right shifted according to the size of the
+ * underlay network mask.  This value is then ORed with the network
+ * portion of the underlay network to produce the underlay network
+ * destination for the encapsulated datagram.
+ *
+ * For example, using the initial example of underlay 10.88.3.4/16 and
+ * overlay 99.0.0.0/8, with underlay host 10.88.3.4/16 providing overlay
+ * subnet 99.3.4.0/24 with specfic host 99.3.4.5.  A datagram from
+ * 99.3.4.5 to 99.6.7.8 would first have the underlay host derived portion
+ * of the address extracted.  This is a number of bits equal to underlay
+ * network host portion.  In the destination address, the highest order of
+ * these bits is one bit lower than the lowest order bit from the overlay
+ * network mask.
+ *
+ * Using the sample value, 99.6.7.8, the overlay mask is /8, and the
+ * underlay mask is /16 (leaving 16 bits for the host portion).  The bits
+ * to be shifted are the middle two octets, 0.6.7.0, as this is 99.6.7.8
+ * ANDed with the mask 0x00ffff00 (which is 16 bits, the highest order of
+ * which is 1 bit lower than the lowest order overlay address bit).
+ *
+ * These octets, 0.6.7.0, are then right shifted 8 bits, yielding 0.0.6.7.
+ * This value is then ORed with the underlay network portion,
+ * 10.88.0.0/16, providing 10.88.6.7 as the final underlay destination for
+ * the encapuslated datagram.
+ *
+ * Another transform using the final example: overlay 100.64.0.0/10 and
+ * underlay 10.224.220.0/24.  Consider overlay address 100.66.128.1
+ * sending a datagram to 100.66.200.5.  In this case, 8 bits (the host
+ * portion size of 10.224.220.0/24) beginning after the 100.64/10 overlay
+ * prefix are masked off, yielding 0.2.192.0.  This is right shifted 14
+ * (32 - 10 - (32 - 24), i.e., the number of bits between the overlay
+ * network portion and the underlay host portion) bits, yielding 0.0.0.11.
+ * This is ORed with the underlay network portion, 10.224.220.0/24, giving
+ * the underlay destination of 10.224.220.11 for overlay destination
+ * 100.66.200.5.
+ */
+static int ipip_build_fan_iphdr(struct ip_tunnel *tunnel, struct sk_buff *skb, struct iphdr *iph)
+{
+	struct ip_fan_map *f_map;
+	u32 daddr, underlay;
+
+	f_map = ipip_fan_find_map(tunnel, ip_hdr(skb)->daddr);
+	if (!f_map)
+		return -ENOENT;
+
+	daddr = ntohl(ip_hdr(skb)->daddr);
+	underlay = ntohl(f_map->underlay);
+	if (!underlay)
+		return -EINVAL;
+
+	*iph = tunnel->parms.iph;
+	iph->daddr = htonl(underlay |
+			   ((daddr & ~f_map->overlay_mask) >>
+			    (32 - f_map->overlay_prefix -
+			     (32 - f_map->underlay_prefix))));
+	return 0;
+}
+
 /*
  *	This function assumes it is being called from dev_queue_xmit()
  *	and that skb is filled properly by that function.
@@ -277,6 +420,7 @@
 	struct ip_tunnel *tunnel = netdev_priv(dev);
 	const struct iphdr  *tiph = &tunnel->parms.iph;
 	u8 ipproto;
+	struct iphdr fiph;
 
 	if (!pskb_inet_may_pull(skb))
 		goto tx_error;
@@ -300,6 +444,14 @@
 	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP4))
 		goto tx_error;
 
+	if (fan_has_map(&tunnel->fan)) {
+		if (ipip_build_fan_iphdr(tunnel, skb, &fiph))
+			goto tx_error;
+		tiph = &fiph;
+	} else {
+		tiph = &tunnel->parms.iph;
+	}
+
 	skb_set_inner_ipproto(skb, ipproto);
 
 	if (tunnel->collect_md)
@@ -363,6 +515,8 @@
 
 static void ipip_tunnel_setup(struct net_device *dev)
 {
+	struct ip_tunnel *t = netdev_priv(dev);
+
 	dev->netdev_ops		= &ipip_netdev_ops;
 	dev->header_ops		= &ip_tunnel_header_ops;
 
@@ -375,6 +529,7 @@
 	dev->features		|= IPIP_FEATURES;
 	dev->hw_features	|= IPIP_FEATURES;
 	ip_tunnel_setup(dev, ipip_net_id);
+	INIT_LIST_HEAD(&t->fan.fan_maps);
 }
 
 static int ipip_tunnel_init(struct net_device *dev)
@@ -427,6 +582,92 @@
 		*fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
 }
 
+static void ipip_fan_flush_map(struct ip_tunnel *t)
+{
+	struct ip_fan_map *fan_map;
+
+	list_for_each_entry_rcu(fan_map, &t->fan.fan_maps, list) {
+		list_del_rcu(&fan_map->list);
+		kfree_rcu(fan_map, rcu);
+	}
+}
+
+static int ipip_fan_del_map(struct ip_tunnel *t, __be32 overlay)
+{
+	struct ip_fan_map *fan_map;
+
+	fan_map = ipip_fan_find_map(t, overlay);
+	if (!fan_map)
+		return -ENOENT;
+
+	list_del_rcu(&fan_map->list);
+	kfree_rcu(fan_map, rcu);
+
+	return 0;
+}
+
+static int ipip_fan_add_map(struct ip_tunnel *t, struct ifla_fan_map *map)
+{
+	__be32 overlay_mask, underlay_mask;
+	struct ip_fan_map *fan_map;
+
+	overlay_mask = inet_make_mask(map->overlay_prefix);
+	underlay_mask = inet_make_mask(map->underlay_prefix);
+
+	if ((map->overlay & ~overlay_mask) || (map->underlay & ~underlay_mask))
+		return -EINVAL;
+
+	if (!(map->overlay & overlay_mask) && (map->underlay & underlay_mask))
+		return -EINVAL;
+
+	/* Special case: overlay 0 and underlay 0: flush all mappings */
+	if (!map->overlay && !map->underlay) {
+		ipip_fan_flush_map(t);
+		return 0;
+	}
+	
+	/* Special case: overlay set and underlay 0: clear map for overlay */
+	if (!map->underlay)
+		return ipip_fan_del_map(t, map->overlay);
+
+	if (ipip_fan_find_map(t, map->overlay))
+		return -EEXIST;
+
+	fan_map = kmalloc(sizeof(*fan_map), GFP_KERNEL);
+	fan_map->underlay = map->underlay;
+	fan_map->overlay = map->overlay;
+	fan_map->underlay_prefix = map->underlay_prefix;
+	fan_map->overlay_mask = ntohl(overlay_mask);
+	fan_map->overlay_prefix = map->overlay_prefix;
+
+	list_add_tail_rcu(&fan_map->list, &t->fan.fan_maps);
+
+	return 0;
+}
+
+static int ipip_netlink_fan(struct nlattr *data[], struct ip_tunnel *t,
+			    struct ip_tunnel_parm *parms)
+{
+	struct ifla_fan_map *map;
+	struct nlattr *attr;
+	int rem, rv;
+
+	if (data == NULL || !data[IFLA_IPTUN_FAN_MAP])
+		return 0;
+
+	if (parms->iph.daddr)
+		return -EINVAL;
+
+	nla_for_each_nested(attr, data[IFLA_IPTUN_FAN_MAP], rem) {
+		map = nla_data(attr);
+		rv = ipip_fan_add_map(t, map);
+		if (rv)
+			return rv;
+	}
+
+	return 0;
+}
+
 static int ipip_newlink(struct net *src_net, struct net_device *dev,
 			struct nlattr *tb[], struct nlattr *data[],
 			struct netlink_ext_ack *extack)
@@ -435,15 +676,19 @@
 	struct ip_tunnel_parm p;
 	struct ip_tunnel_encap ipencap;
 	__u32 fwmark = 0;
+	int err;
 
 	if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
-		int err = ip_tunnel_encap_setup(t, &ipencap);
+		err = ip_tunnel_encap_setup(t, &ipencap);
 
 		if (err < 0)
 			return err;
 	}
 
 	ipip_netlink_parms(data, &p, &t->collect_md, &fwmark);
+	err = ipip_netlink_fan(data, t, &p);
+	if (err < 0)
+		return err;
 	return ip_tunnel_newlink(dev, tb, &p, fwmark);
 }
 
@@ -456,9 +701,10 @@
 	struct ip_tunnel_encap ipencap;
 	bool collect_md;
 	__u32 fwmark = t->fwmark;
+	int err;
 
 	if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
-		int err = ip_tunnel_encap_setup(t, &ipencap);
+		err = ip_tunnel_encap_setup(t, &ipencap);
 
 		if (err < 0)
 			return err;
@@ -467,6 +713,9 @@
 	ipip_netlink_parms(data, &p, &collect_md, &fwmark);
 	if (collect_md)
 		return -EINVAL;
+	err = ipip_netlink_fan(data, t, &p);
+	if (err < 0)
+		return err;
 
 	if (((dev->flags & IFF_POINTOPOINT) && !p.iph.daddr) ||
 	    (!(dev->flags & IFF_POINTOPOINT) && p.iph.daddr))
@@ -504,6 +753,8 @@
 		nla_total_size(0) +
 		/* IFLA_IPTUN_FWMARK */
 		nla_total_size(4) +
+		/* IFLA_IPTUN_FAN_MAP */
+		nla_total_size(sizeof(struct ifla_fan_map)) * 256 +
 		0;
 }
 
@@ -536,6 +787,26 @@
 	if (tunnel->collect_md)
 		if (nla_put_flag(skb, IFLA_IPTUN_COLLECT_METADATA))
 			goto nla_put_failure;
+	if (fan_has_map(&tunnel->fan)) {
+		struct nlattr *fan_nest;
+		struct ip_fan_map *fan_map;
+
+		fan_nest = nla_nest_start(skb, IFLA_IPTUN_FAN_MAP);
+		if (!fan_nest)
+			goto nla_put_failure;
+		list_for_each_entry_rcu(fan_map, &tunnel->fan.fan_maps, list) {
+			struct ifla_fan_map map;
+
+			map.underlay = fan_map->underlay;
+			map.underlay_prefix = fan_map->underlay_prefix;
+			map.overlay = fan_map->overlay;
+			map.overlay_prefix = fan_map->overlay_prefix;
+			if (nla_put(skb, IFLA_FAN_MAPPING, sizeof(map), &map))
+				goto nla_put_failure;
+		}
+		nla_nest_end(skb, fan_nest);
+	}
+
 	return 0;
 
 nla_put_failure:
@@ -556,6 +827,9 @@
 	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
 	[IFLA_IPTUN_COLLECT_METADATA]	= { .type = NLA_FLAG },
 	[IFLA_IPTUN_FWMARK]		= { .type = NLA_U32 },
+
+	[__IFLA_IPTUN_VENDOR_BREAK ... IFLA_IPTUN_MAX]	= { .type = NLA_BINARY },
+	[IFLA_IPTUN_FAN_MAP]		= { .type = NLA_NESTED },
 };
 
 static struct rtnl_link_ops ipip_link_ops __read_mostly = {
@@ -604,6 +878,23 @@
 	.size = sizeof(struct ip_tunnel_net),
 };
 
+#ifdef CONFIG_SYSCTL
+static struct ctl_table_header *ipip_fan_header;
+static unsigned int ipip_fan_version = 3;
+
+static struct ctl_table ipip_fan_sysctls[] = {
+	{
+		.procname	= "version",
+		.data		= &ipip_fan_version,
+		.maxlen		= sizeof(ipip_fan_version),
+		.mode		= 0444,
+		.proc_handler	= proc_dointvec,
+	},
+	{},
+};
+
+#endif /* CONFIG_SYSCTL */
+
 static int __init ipip_init(void)
 {
 	int err;
@@ -629,9 +920,22 @@
 	if (err < 0)
 		goto rtnl_link_failed;
 
+#ifdef CONFIG_SYSCTL
+	ipip_fan_header = register_net_sysctl(&init_net, "net/fan",
+					      ipip_fan_sysctls);
+	if (!ipip_fan_header) {
+		err = -ENOMEM;
+		goto sysctl_failed;
+	}
+#endif /* CONFIG_SYSCTL */
+
 out:
 	return err;
 
+#ifdef CONFIG_SYSCTL
+sysctl_failed:
+	rtnl_link_unregister(&ipip_link_ops);
+#endif /* CONFIG_SYSCTL */
 rtnl_link_failed:
 #if IS_ENABLED(CONFIG_MPLS)
 	xfrm4_tunnel_deregister(&mplsip_handler, AF_MPLS);
@@ -646,6 +950,9 @@
 
 static void __exit ipip_fini(void)
 {
+#ifdef CONFIG_SYSCTL
+	unregister_net_sysctl_table(ipip_fan_header);
+#endif /* CONFIG_SYSCTL */
 	rtnl_link_unregister(&ipip_link_ops);
 	if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
 		pr_info("%s: can't deregister tunnel\n", __func__);
--- linux-qcom-6.8.0.orig/net/ipv4/ipmr.c
+++ linux-qcom-6.8.0/net/ipv4/ipmr.c
@@ -136,7 +136,7 @@
 	return ret;
 }
 
-static struct mr_table *ipmr_get_table(struct net *net, u32 id)
+static struct mr_table *__ipmr_get_table(struct net *net, u32 id)
 {
 	struct mr_table *mrt;
 
@@ -147,6 +147,16 @@
 	return NULL;
 }
 
+static struct mr_table *ipmr_get_table(struct net *net, u32 id)
+{
+	struct mr_table *mrt;
+
+	rcu_read_lock();
+	mrt = __ipmr_get_table(net, id);
+	rcu_read_unlock();
+	return mrt;
+}
+
 static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
 			   struct mr_table **mrt)
 {
@@ -188,7 +198,7 @@
 
 	arg->table = fib_rule_get_table(rule, arg);
 
-	mrt = ipmr_get_table(rule->fr_net, arg->table);
+	mrt = __ipmr_get_table(rule->fr_net, arg->table);
 	if (!mrt)
 		return -EAGAIN;
 	res->mrt = mrt;
@@ -314,6 +324,8 @@
 	return net->ipv4.mrt;
 }
 
+#define __ipmr_get_table ipmr_get_table
+
 static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
 			   struct mr_table **mrt)
 {
@@ -402,7 +414,7 @@
 	if (id != RT_TABLE_DEFAULT && id >= 1000000000)
 		return ERR_PTR(-EINVAL);
 
-	mrt = ipmr_get_table(net, id);
+	mrt = __ipmr_get_table(net, id);
 	if (mrt)
 		return mrt;
 
@@ -1373,7 +1385,7 @@
 		goto out_unlock;
 	}
 
-	mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
+	mrt = __ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
 	if (!mrt) {
 		ret = -ENOENT;
 		goto out_unlock;
@@ -1603,9 +1615,11 @@
 
 	if (copy_from_sockptr(&olr, optlen, sizeof(int)))
 		return -EFAULT;
-	olr = min_t(unsigned int, olr, sizeof(int));
 	if (olr < 0)
 		return -EINVAL;
+
+	olr = min_t(unsigned int, olr, sizeof(int));
+
 	if (copy_to_sockptr(optlen, &olr, sizeof(int)))
 		return -EFAULT;
 	if (copy_to_sockptr(optval, &val, olr))
@@ -2259,11 +2273,13 @@
 	struct mr_table *mrt;
 	int err;
 
-	mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
-	if (!mrt)
+	rcu_read_lock();
+	mrt = __ipmr_get_table(net, RT_TABLE_DEFAULT);
+	if (!mrt) {
+		rcu_read_unlock();
 		return -ENOENT;
+	}
 
-	rcu_read_lock();
 	cache = ipmr_cache_find(mrt, saddr, daddr);
 	if (!cache && skb->dev) {
 		int vif = ipmr_find_vif(mrt, skb->dev);
@@ -2548,7 +2564,7 @@
 	grp = tb[RTA_DST] ? nla_get_in_addr(tb[RTA_DST]) : 0;
 	tableid = tb[RTA_TABLE] ? nla_get_u32(tb[RTA_TABLE]) : 0;
 
-	mrt = ipmr_get_table(net, tableid ? tableid : RT_TABLE_DEFAULT);
+	mrt = __ipmr_get_table(net, tableid ? tableid : RT_TABLE_DEFAULT);
 	if (!mrt) {
 		err = -ENOENT;
 		goto errout_free;
@@ -2600,7 +2616,7 @@
 	if (filter.table_id) {
 		struct mr_table *mrt;
 
-		mrt = ipmr_get_table(sock_net(skb->sk), filter.table_id);
+		mrt = __ipmr_get_table(sock_net(skb->sk), filter.table_id);
 		if (!mrt) {
 			if (rtnl_msg_family(cb->nlh) != RTNL_FAMILY_IPMR)
 				return skb->len;
@@ -2708,7 +2724,7 @@
 			break;
 		}
 	}
-	mrt = ipmr_get_table(net, tblid);
+	mrt = __ipmr_get_table(net, tblid);
 	if (!mrt) {
 		ret = -ENOENT;
 		goto out;
@@ -2916,13 +2932,15 @@
 	struct net *net = seq_file_net(seq);
 	struct mr_table *mrt;
 
-	mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
-	if (!mrt)
+	rcu_read_lock();
+	mrt = __ipmr_get_table(net, RT_TABLE_DEFAULT);
+	if (!mrt) {
+		rcu_read_unlock();
 		return ERR_PTR(-ENOENT);
+	}
 
 	iter->mrt = mrt;
 
-	rcu_read_lock();
 	return mr_vif_seq_start(seq, pos);
 }
 
--- linux-qcom-6.8.0.orig/net/ipv4/ipmr_base.c
+++ linux-qcom-6.8.0/net/ipv4/ipmr_base.c
@@ -310,7 +310,8 @@
 	if (filter->filter_set)
 		flags |= NLM_F_DUMP_FILTERED;
 
-	list_for_each_entry_rcu(mfc, &mrt->mfc_cache_list, list) {
+	list_for_each_entry_rcu(mfc, &mrt->mfc_cache_list, list,
+				lockdep_rtnl_is_held()) {
 		if (e < s_e)
 			goto next_entry;
 		if (filter->dev &&
--- linux-qcom-6.8.0.orig/net/ipv4/metrics.c
+++ linux-qcom-6.8.0/net/ipv4/metrics.c
@@ -7,7 +7,7 @@
 #include <net/net_namespace.h>
 #include <net/tcp.h>
 
-static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx,
+static int ip_metrics_convert(struct nlattr *fc_mx,
 			      int fc_mx_len, u32 *metrics,
 			      struct netlink_ext_ack *extack)
 {
@@ -31,7 +31,7 @@
 			char tmp[TCP_CA_NAME_MAX];
 
 			nla_strscpy(tmp, nla, sizeof(tmp));
-			val = tcp_ca_get_key_by_name(net, tmp, &ecn_ca);
+			val = tcp_ca_get_key_by_name(tmp, &ecn_ca);
 			if (val == TCP_CA_UNSPEC) {
 				NL_SET_ERR_MSG(extack, "Unknown tcp congestion algorithm");
 				return -EINVAL;
@@ -63,7 +63,7 @@
 	return 0;
 }
 
-struct dst_metrics *ip_fib_metrics_init(struct net *net, struct nlattr *fc_mx,
+struct dst_metrics *ip_fib_metrics_init(struct nlattr *fc_mx,
 					int fc_mx_len,
 					struct netlink_ext_ack *extack)
 {
@@ -77,7 +77,7 @@
 	if (unlikely(!fib_metrics))
 		return ERR_PTR(-ENOMEM);
 
-	err = ip_metrics_convert(net, fc_mx, fc_mx_len, fib_metrics->metrics,
+	err = ip_metrics_convert(fc_mx, fc_mx_len, fib_metrics->metrics,
 				 extack);
 	if (!err) {
 		refcount_set(&fib_metrics->refcnt, 1);
--- linux-qcom-6.8.0.orig/net/ipv4/netfilter/arp_tables.c
+++ linux-qcom-6.8.0/net/ipv4/netfilter/arp_tables.c
@@ -296,6 +296,17 @@
 	       memcmp(&e->arp, &uncond, sizeof(uncond)) == 0;
 }
 
+static bool next_offset_ok(const struct xt_table_info *t, unsigned int newpos)
+{
+	if (newpos > t->size - sizeof(struct arpt_entry))
+		return false;
+
+	if (newpos % __alignof__(struct arpt_entry) != 0)
+		return false;
+
+	return true;
+}
+
 /* Figures out from what hook each rule can be called: returns 0 if
  * there are loops.  Puts hook bitmask in comefrom.
  */
@@ -354,6 +365,8 @@
 
 				/* Move along one */
 				size = e->next_offset;
+				if (!next_offset_ok(newinfo, pos + size))
+					return 0;
 				e = entry0 + pos + size;
 				if (pos + size >= newinfo->size)
 					return 0;
@@ -375,6 +388,10 @@
 					if (newpos >= newinfo->size)
 						return 0;
 				}
+
+				if (!next_offset_ok(newinfo, newpos))
+					return 0;
+
 				e = entry0 + newpos;
 				e->counters.pcnt = pos;
 				pos = newpos;
@@ -956,6 +973,8 @@
 	void *loc_cpu_entry;
 	struct arpt_entry *iter;
 
+	if (len < sizeof(tmp))
+		return -EINVAL;
 	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
 		return -EFAULT;
 
@@ -964,6 +983,8 @@
 		return -ENOMEM;
 	if (tmp.num_counters == 0)
 		return -EINVAL;
+	if ((u64)len < (u64)tmp.size + sizeof(tmp))
+		return -EINVAL;
 
 	tmp.name[sizeof(tmp.name)-1] = 0;
 
@@ -1254,6 +1275,8 @@
 	void *loc_cpu_entry;
 	struct arpt_entry *iter;
 
+	if (len < sizeof(tmp))
+		return -EINVAL;
 	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
 		return -EFAULT;
 
@@ -1262,6 +1285,8 @@
 		return -ENOMEM;
 	if (tmp.num_counters == 0)
 		return -EINVAL;
+	if ((u64)len < (u64)tmp.size + sizeof(tmp))
+		return -EINVAL;
 
 	tmp.name[sizeof(tmp.name)-1] = 0;
 
--- linux-qcom-6.8.0.orig/net/ipv4/netfilter/ip_tables.c
+++ linux-qcom-6.8.0/net/ipv4/netfilter/ip_tables.c
@@ -361,6 +361,17 @@
 	else return verdict;
 }
 
+static bool next_offset_ok(const struct xt_table_info *t, unsigned int newpos)
+{
+	if (newpos > t->size - sizeof(struct ipt_entry))
+		return false;
+
+	if (newpos % __alignof__(struct ipt_entry) != 0)
+		return false;
+
+	return true;
+}
+
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
@@ -416,6 +427,8 @@
 
 				/* Move along one */
 				size = e->next_offset;
+				if (!next_offset_ok(newinfo, pos + size))
+					return 0;
 				e = entry0 + pos + size;
 				if (pos + size >= newinfo->size)
 					return 0;
@@ -437,6 +450,10 @@
 					if (newpos >= newinfo->size)
 						return 0;
 				}
+
+				if (!next_offset_ok(newinfo, newpos))
+					return 0;
+
 				e = entry0 + newpos;
 				e->counters.pcnt = pos;
 				pos = newpos;
@@ -1108,6 +1125,8 @@
 	void *loc_cpu_entry;
 	struct ipt_entry *iter;
 
+	if (len < sizeof(tmp))
+		return -EINVAL;
 	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
 		return -EFAULT;
 
@@ -1116,6 +1135,8 @@
 		return -ENOMEM;
 	if (tmp.num_counters == 0)
 		return -EINVAL;
+	if ((u64)len < (u64)tmp.size + sizeof(tmp))
+		return -EINVAL;
 
 	tmp.name[sizeof(tmp.name)-1] = 0;
 
@@ -1492,6 +1513,8 @@
 	void *loc_cpu_entry;
 	struct ipt_entry *iter;
 
+	if (len < sizeof(tmp))
+		return -EINVAL;
 	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
 		return -EFAULT;
 
@@ -1500,6 +1523,8 @@
 		return -ENOMEM;
 	if (tmp.num_counters == 0)
 		return -EINVAL;
+	if ((u64)len < (u64)tmp.size + sizeof(tmp))
+		return -EINVAL;
 
 	tmp.name[sizeof(tmp.name)-1] = 0;
 
--- linux-qcom-6.8.0.orig/net/ipv4/netfilter/iptable_nat.c
+++ linux-qcom-6.8.0/net/ipv4/netfilter/iptable_nat.c
@@ -145,25 +145,27 @@
 
 static int __init iptable_nat_init(void)
 {
-	int ret = xt_register_template(&nf_nat_ipv4_table,
-				       iptable_nat_table_init);
+	int ret;
 
+	/* net->gen->ptr[iptable_nat_net_id] must be allocated
+	 * before calling iptable_nat_table_init().
+	 */
+	ret = register_pernet_subsys(&iptable_nat_net_ops);
 	if (ret < 0)
 		return ret;
 
-	ret = register_pernet_subsys(&iptable_nat_net_ops);
-	if (ret < 0) {
-		xt_unregister_template(&nf_nat_ipv4_table);
-		return ret;
-	}
+	ret = xt_register_template(&nf_nat_ipv4_table,
+				   iptable_nat_table_init);
+	if (ret < 0)
+		unregister_pernet_subsys(&iptable_nat_net_ops);
 
 	return ret;
 }
 
 static void __exit iptable_nat_exit(void)
 {
-	unregister_pernet_subsys(&iptable_nat_net_ops);
 	xt_unregister_template(&nf_nat_ipv4_table);
+	unregister_pernet_subsys(&iptable_nat_net_ops);
 }
 
 module_init(iptable_nat_init);
--- linux-qcom-6.8.0.orig/net/ipv4/netfilter/nf_dup_ipv4.c
+++ linux-qcom-6.8.0/net/ipv4/netfilter/nf_dup_ipv4.c
@@ -52,8 +52,9 @@
 {
 	struct iphdr *iph;
 
+	local_bh_disable();
 	if (this_cpu_read(nf_skb_duplicated))
-		return;
+		goto out;
 	/*
 	 * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
 	 * the original skb, which should continue on its way as if nothing has
@@ -61,7 +62,7 @@
 	 */
 	skb = pskb_copy(skb, GFP_ATOMIC);
 	if (skb == NULL)
-		return;
+		goto out;
 
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 	/* Avoid counting cloned packets towards the original connection. */
@@ -90,6 +91,8 @@
 	} else {
 		kfree_skb(skb);
 	}
+out:
+	local_bh_enable();
 }
 EXPORT_SYMBOL_GPL(nf_dup_ipv4);
 
--- linux-qcom-6.8.0.orig/net/ipv4/netfilter/nf_reject_ipv4.c
+++ linux-qcom-6.8.0/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -239,9 +239,8 @@
 void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
 		   int hook)
 {
-	struct sk_buff *nskb;
-	struct iphdr *niph;
 	const struct tcphdr *oth;
+	struct sk_buff *nskb;
 	struct tcphdr _oth;
 
 	oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
@@ -266,14 +265,12 @@
 	nskb->mark = IP4_REPLY_MARK(net, oldskb->mark);
 
 	skb_reserve(nskb, LL_MAX_HEADER);
-	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
-				   ip4_dst_hoplimit(skb_dst(nskb)));
+	nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
+			    ip4_dst_hoplimit(skb_dst(nskb)));
 	nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
 	if (ip_route_me_harder(net, sk, nskb, RTN_UNSPEC))
 		goto free_nskb;
 
-	niph = ip_hdr(nskb);
-
 	/* "Never happens" */
 	if (nskb->len > dst_mtu(skb_dst(nskb)))
 		goto free_nskb;
@@ -290,6 +287,7 @@
 	 */
 	if (nf_bridge_info_exists(oldskb)) {
 		struct ethhdr *oeth = eth_hdr(oldskb);
+		struct iphdr *niph = ip_hdr(nskb);
 		struct net_device *br_indev;
 
 		br_indev = nf_bridge_get_physindev(oldskb, net);
--- linux-qcom-6.8.0.orig/net/ipv4/netfilter/nf_tproxy_ipv4.c
+++ linux-qcom-6.8.0/net/ipv4/netfilter/nf_tproxy_ipv4.c
@@ -58,6 +58,8 @@
 
 	laddr = 0;
 	indev = __in_dev_get_rcu(skb->dev);
+	if (!indev)
+		return daddr;
 
 	in_dev_for_each_ifa_rcu(ifa, indev) {
 		if (ifa->ifa_flags & IFA_F_SECONDARY)
--- linux-qcom-6.8.0.orig/net/ipv4/netfilter/nft_fib_ipv4.c
+++ linux-qcom-6.8.0/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -66,6 +66,7 @@
 		.flowi4_scope = RT_SCOPE_UNIVERSE,
 		.flowi4_iif = LOOPBACK_IFINDEX,
 		.flowi4_uid = sock_net_uid(nft_net(pkt), NULL),
+		.flowi4_l3mdev = l3mdev_master_ifindex_rcu(nft_in(pkt)),
 	};
 	const struct net_device *oif;
 	const struct net_device *found;
@@ -84,9 +85,6 @@
 	else
 		oif = NULL;
 
-	if (priv->flags & NFTA_FIB_F_IIF)
-		fl4.flowi4_l3mdev = l3mdev_master_ifindex_rcu(oif);
-
 	if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
 	    nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
 		nft_fib_store_result(dest, priv, nft_in(pkt));
--- linux-qcom-6.8.0.orig/net/ipv4/nexthop.c
+++ linux-qcom-6.8.0/net/ipv4/nexthop.c
@@ -676,9 +676,10 @@
 
 	p = nla_data(nla);
 	for (i = 0; i < nhg->num_nh; ++i) {
-		p->id = nhg->nh_entries[i].nh->id;
-		p->weight = nhg->nh_entries[i].weight - 1;
-		p += 1;
+		*p++ = (struct nexthop_grp) {
+			.id = nhg->nh_entries[i].nh->id,
+			.weight = nhg->nh_entries[i].weight - 1,
+		};
 	}
 
 	if (nhg->resilient && nla_put_nh_group_res(skb, nhg))
--- linux-qcom-6.8.0.orig/net/ipv4/raw.c
+++ linux-qcom-6.8.0/net/ipv4/raw.c
@@ -350,9 +350,10 @@
 		goto error;
 	skb_reserve(skb, hlen);
 
+	skb->protocol = htons(ETH_P_IP);
 	skb->priority = READ_ONCE(sk->sk_priority);
 	skb->mark = sockc->mark;
-	skb->tstamp = sockc->transmit_time;
+	skb_set_delivery_type_by_clockid(skb, sockc->transmit_time, sk->sk_clockid);
 	skb_dst_set(skb, &rt->dst);
 	*rtp = NULL;
 
@@ -604,6 +605,9 @@
 			    (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
 			   daddr, saddr, 0, 0, sk->sk_uid);
 
+	fl4.fl4_icmp_type = 0;
+	fl4.fl4_icmp_code = 0;
+
 	if (!hdrincl) {
 		rfv.msg = msg;
 		rfv.hlen = 0;
--- linux-qcom-6.8.0.orig/net/ipv4/route.c
+++ linux-qcom-6.8.0/net/ipv4/route.c
@@ -132,7 +132,8 @@
 static unsigned int	 ipv4_default_advmss(const struct dst_entry *dst);
 INDIRECT_CALLABLE_SCOPE
 unsigned int		ipv4_mtu(const struct dst_entry *dst);
-static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
+static void		ipv4_negative_advice(struct sock *sk,
+					     struct dst_entry *dst);
 static void		 ipv4_link_failure(struct sk_buff *skb);
 static void		 ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
 					   struct sk_buff *skb, u32 mtu,
@@ -831,28 +832,21 @@
 	u32 mark = skb->mark;
 	__u8 tos = iph->tos;
 
-	rt = (struct rtable *) dst;
+	rt = dst_rtable(dst);
 
 	__build_flow_key(net, &fl4, sk, iph, oif, tos, prot, mark, 0);
 	__ip_do_redirect(rt, skb, &fl4, true);
 }
 
-static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
+static void ipv4_negative_advice(struct sock *sk,
+				 struct dst_entry *dst)
 {
-	struct rtable *rt = (struct rtable *)dst;
-	struct dst_entry *ret = dst;
+	struct rtable *rt = dst_rtable(dst);
 
-	if (rt) {
-		if (dst->obsolete > 0) {
-			ip_rt_put(rt);
-			ret = NULL;
-		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||
-			   rt->dst.expires) {
-			ip_rt_put(rt);
-			ret = NULL;
-		}
-	}
-	return ret;
+	if ((dst->obsolete > 0) ||
+	    (rt->rt_flags & RTCF_REDIRECTED) ||
+	    rt->dst.expires)
+		sk_dst_reset(sk);
 }
 
 /*
@@ -926,13 +920,11 @@
 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
 		peer->rate_last = jiffies;
 		++peer->n_redirects;
-#ifdef CONFIG_IP_ROUTE_VERBOSE
-		if (log_martians &&
+		if (IS_ENABLED(CONFIG_IP_ROUTE_VERBOSE) && log_martians &&
 		    peer->n_redirects == ip_rt_redirect_number)
 			net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
 					     &ip_hdr(skb)->saddr, inet_iif(skb),
 					     &ip_hdr(skb)->daddr, &gw);
-#endif
 	}
 out_put_peer:
 	inet_putpeer(peer);
@@ -1058,7 +1050,7 @@
 			      struct sk_buff *skb, u32 mtu,
 			      bool confirm_neigh)
 {
-	struct rtable *rt = (struct rtable *) dst;
+	struct rtable *rt = dst_rtable(dst);
 	struct flowi4 fl4;
 
 	ip_rt_build_flow_key(&fl4, sk, skb);
@@ -1129,7 +1121,7 @@
 
 	__build_flow_key(net, &fl4, sk, iph, 0, 0, 0, 0, 0);
 
-	rt = (struct rtable *)odst;
+	rt = dst_rtable(odst);
 	if (odst->obsolete && !odst->ops->check(odst, 0)) {
 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
 		if (IS_ERR(rt))
@@ -1138,7 +1130,7 @@
 		new = true;
 	}
 
-	__ip_rt_update_pmtu((struct rtable *)xfrm_dst_path(&rt->dst), &fl4, mtu);
+	__ip_rt_update_pmtu(dst_rtable(xfrm_dst_path(&rt->dst)), &fl4, mtu);
 
 	if (!dst_check(&rt->dst, 0)) {
 		if (new)
@@ -1195,7 +1187,7 @@
 INDIRECT_CALLABLE_SCOPE struct dst_entry *ipv4_dst_check(struct dst_entry *dst,
 							 u32 cookie)
 {
-	struct rtable *rt = (struct rtable *) dst;
+	struct rtable *rt = dst_rtable(dst);
 
 	/* All IPV4 dsts are created with ->obsolete set to the value
 	 * DST_OBSOLETE_FORCE_CHK which forces validation calls down
@@ -1283,7 +1275,7 @@
 		struct flowi4 fl4 = {
 			.daddr = iph->daddr,
 			.saddr = iph->saddr,
-			.flowi4_tos = RT_TOS(iph->tos),
+			.flowi4_tos = iph->tos & IPTOS_RT_MASK,
 			.flowi4_oif = rt->dst.dev->ifindex,
 			.flowi4_iif = skb->dev->ifindex,
 			.flowi4_mark = skb->mark,
@@ -1530,10 +1522,8 @@
 
 static void ipv4_dst_destroy(struct dst_entry *dst)
 {
-	struct rtable *rt = (struct rtable *)dst;
-
 	ip_dst_metrics_put(dst);
-	rt_del_uncached_list(rt);
+	rt_del_uncached_list(dst_rtable(dst));
 }
 
 void rt_flush_dev(struct net_device *dev)
@@ -2168,6 +2158,9 @@
 	int err = -EINVAL;
 	u32 tag = 0;
 
+	if (!in_dev)
+		return -EINVAL;
+
 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr))
 		goto martian_source;
 
@@ -2831,7 +2824,7 @@
 
 struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
 {
-	struct rtable *ort = (struct rtable *) dst_orig;
+	struct rtable *ort = dst_rtable(dst_orig);
 	struct rtable *rt;
 
 	rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, DST_OBSOLETE_DEAD, 0);
@@ -2876,9 +2869,9 @@
 
 	if (flp4->flowi4_proto) {
 		flp4->flowi4_oif = rt->dst.dev->ifindex;
-		rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst,
-							flowi4_to_flowi(flp4),
-							sk, 0);
+		rt = dst_rtable(xfrm_lookup_route(net, &rt->dst,
+						  flowi4_to_flowi(flp4),
+						  sk, 0));
 	}
 
 	return rt;
@@ -2887,9 +2880,9 @@
 
 /* called with rcu_read_lock held */
 static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
-			struct rtable *rt, u32 table_id, struct flowi4 *fl4,
-			struct sk_buff *skb, u32 portid, u32 seq,
-			unsigned int flags)
+			struct rtable *rt, u32 table_id, dscp_t dscp,
+			struct flowi4 *fl4, struct sk_buff *skb, u32 portid,
+			u32 seq, unsigned int flags)
 {
 	struct rtmsg *r;
 	struct nlmsghdr *nlh;
@@ -2905,7 +2898,7 @@
 	r->rtm_family	 = AF_INET;
 	r->rtm_dst_len	= 32;
 	r->rtm_src_len	= 0;
-	r->rtm_tos	= fl4 ? fl4->flowi4_tos : 0;
+	r->rtm_tos	= inet_dscp_to_dsfield(dscp);
 	r->rtm_table	= table_id < 256 ? table_id : RT_TABLE_COMPAT;
 	if (nla_put_u32(skb, RTA_TABLE, table_id))
 		goto nla_put_failure;
@@ -3055,7 +3048,7 @@
 				goto next;
 
 			err = rt_fill_info(net, fnhe->fnhe_daddr, 0, rt,
-					   table_id, NULL, skb,
+					   table_id, 0, NULL, skb,
 					   NETLINK_CB(cb->skb).portid,
 					   cb->nlh->nlmsg_seq, flags);
 			if (err)
@@ -3351,7 +3344,7 @@
 		fri.tb_id = table_id;
 		fri.dst = res.prefix;
 		fri.dst_len = res.prefixlen;
-		fri.dscp = inet_dsfield_to_dscp(fl4.flowi4_tos);
+		fri.dscp = res.dscp;
 		fri.type = rt->rt_type;
 		fri.offload = 0;
 		fri.trap = 0;
@@ -3378,8 +3371,8 @@
 		err = fib_dump_info(skb, NETLINK_CB(in_skb).portid,
 				    nlh->nlmsg_seq, RTM_NEWROUTE, &fri, 0);
 	} else {
-		err = rt_fill_info(net, dst, src, rt, table_id, &fl4, skb,
-				   NETLINK_CB(in_skb).portid,
+		err = rt_fill_info(net, dst, src, rt, table_id, res.dscp, &fl4,
+				   skb, NETLINK_CB(in_skb).portid,
 				   nlh->nlmsg_seq, 0);
 	}
 	if (err < 0)
--- linux-qcom-6.8.0.orig/net/ipv4/syncookies.c
+++ linux-qcom-6.8.0/net/ipv4/syncookies.c
@@ -442,7 +442,8 @@
 		goto out_free;
 
 	/* Try to redo what tcp_v4_send_synack did. */
-	req->rsk_window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
+	req->rsk_window_clamp = READ_ONCE(tp->window_clamp) ? :
+				dst_metric(&rt->dst, RTAX_WINDOW);
 	/* limit the window selection if the user enforce a smaller rx buffer */
 	full_space = tcp_full_space(sk);
 	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
--- linux-qcom-6.8.0.orig/net/ipv4/tcp.c
+++ linux-qcom-6.8.0/net/ipv4/tcp.c
@@ -591,7 +591,7 @@
 		 */
 		mask |= EPOLLOUT | EPOLLWRNORM;
 	}
-	/* This barrier is coupled with smp_wmb() in tcp_reset() */
+	/* This barrier is coupled with smp_wmb() in tcp_done_with_error() */
 	smp_rmb();
 	if (READ_ONCE(sk->sk_err) ||
 	    !skb_queue_empty_lockless(&sk->sk_error_queue))
@@ -1158,6 +1158,9 @@
 
 			process_backlog++;
 
+#ifdef CONFIG_SKB_DECRYPTED
+			skb->decrypted = !!(flags & MSG_SENDPAGE_DECRYPTED);
+#endif
 			tcp_skb_entail(sk, skb);
 			copy = size_goal;
 
@@ -1720,7 +1723,7 @@
 	space = tcp_space_from_win(sk, val);
 	if (space > sk->sk_rcvbuf) {
 		WRITE_ONCE(sk->sk_rcvbuf, space);
-		tcp_sk(sk)->window_clamp = val;
+		WRITE_ONCE(tcp_sk(sk)->window_clamp, val);
 	}
 	return 0;
 }
@@ -2636,6 +2639,10 @@
 		if (oldstate != TCP_ESTABLISHED)
 			TCP_INC_STATS(sock_net(sk), TCP_MIB_CURRESTAB);
 		break;
+	case TCP_CLOSE_WAIT:
+		if (oldstate == TCP_SYN_RECV)
+			TCP_INC_STATS(sock_net(sk), TCP_MIB_CURRESTAB);
+		break;
 
 	case TCP_CLOSE:
 		if (oldstate == TCP_CLOSE_WAIT || oldstate == TCP_ESTABLISHED)
@@ -2647,7 +2654,7 @@
 			inet_put_port(sk);
 		fallthrough;
 	default:
-		if (oldstate == TCP_ESTABLISHED)
+		if (oldstate == TCP_ESTABLISHED || oldstate == TCP_CLOSE_WAIT)
 			TCP_DEC_STATS(sock_net(sk), TCP_MIB_CURRESTAB);
 	}
 
@@ -2709,7 +2716,7 @@
 	/* If we've already sent a FIN, or it's a closed state, skip this. */
 	if ((1 << sk->sk_state) &
 	    (TCPF_ESTABLISHED | TCPF_SYN_SENT |
-	     TCPF_SYN_RECV | TCPF_CLOSE_WAIT)) {
+	     TCPF_CLOSE_WAIT)) {
 		/* Clear out any half completed packets.  FIN if needed. */
 		if (tcp_close_state(sk))
 			tcp_send_fin(sk);
@@ -2818,7 +2825,7 @@
 		 * machine. State transitions:
 		 *
 		 * TCP_ESTABLISHED -> TCP_FIN_WAIT1
-		 * TCP_SYN_RECV	-> TCP_FIN_WAIT1 (forget it, it's impossible)
+		 * TCP_SYN_RECV	-> TCP_FIN_WAIT1 (it is difficult)
 		 * TCP_CLOSE_WAIT -> TCP_LAST_ACK
 		 *
 		 * are legal only when FIN has been sent (i.e. in window),
@@ -2930,6 +2937,8 @@
 	lock_sock(sk);
 	__tcp_close(sk, timeout);
 	release_sock(sk);
+	if (!sk->sk_net_refcnt)
+		inet_csk_clear_xmit_timers_sync(sk);
 	sock_put(sk);
 }
 EXPORT_SYMBOL(tcp_close);
@@ -3055,7 +3064,7 @@
 	icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
 	memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
 	__sk_dst_reset(sk);
-	dst_release(xchg((__force struct dst_entry **)&sk->sk_rx_dst, NULL));
+	dst_release(unrcu_pointer(xchg(&sk->sk_rx_dst, NULL)));
 	tcp_saved_syn_free(tp);
 	tp->compressed_ack = 0;
 	tp->segs_in = 0;
@@ -3376,7 +3385,7 @@
 	if (!val) {
 		if (sk->sk_state != TCP_CLOSE)
 			return -EINVAL;
-		tp->window_clamp = 0;
+		WRITE_ONCE(tp->window_clamp, 0);
 	} else {
 		u32 new_rcv_ssthresh, old_window_clamp = tp->window_clamp;
 		u32 new_window_clamp = val < SOCK_MIN_RCVBUF / 2 ?
@@ -3385,7 +3394,7 @@
 		if (new_window_clamp == old_window_clamp)
 			return 0;
 
-		tp->window_clamp = new_window_clamp;
+		WRITE_ONCE(tp->window_clamp, new_window_clamp);
 		if (new_window_clamp < old_window_clamp) {
 			/* need to apply the reserved mem provisioning only
 			 * when shrinking the window clamp
@@ -4010,11 +4019,11 @@
 	if (copy_from_sockptr(&len, optlen, sizeof(int)))
 		return -EFAULT;
 
-	len = min_t(unsigned int, len, sizeof(int));
-
 	if (len < 0)
 		return -EINVAL;
 
+	len = min_t(unsigned int, len, sizeof(int));
+
 	switch (optname) {
 	case TCP_MAXSEG:
 		val = tp->mss_cache;
@@ -4054,7 +4063,7 @@
 				      TCP_RTO_MAX / HZ);
 		break;
 	case TCP_WINDOW_CLAMP:
-		val = tp->window_clamp;
+		val = READ_ONCE(tp->window_clamp);
 		break;
 	case TCP_INFO: {
 		struct tcp_info info;
@@ -4539,6 +4548,13 @@
 		/* Don't race with userspace socket closes such as tcp_close. */
 		lock_sock(sk);
 
+	/* Avoid closing the same socket twice. */
+	if (sk->sk_state == TCP_CLOSE) {
+		if (!has_current_bpf_ctx())
+			release_sock(sk);
+		return -ENOENT;
+	}
+
 	if (sk->sk_state == TCP_LISTEN) {
 		tcp_set_state(sk, TCP_CLOSE);
 		inet_csk_listen_stop(sk);
@@ -4548,19 +4564,12 @@
 	local_bh_disable();
 	bh_lock_sock(sk);
 
-	if (!sock_flag(sk, SOCK_DEAD)) {
-		WRITE_ONCE(sk->sk_err, err);
-		/* This barrier is coupled with smp_rmb() in tcp_poll() */
-		smp_wmb();
-		sk_error_report(sk);
-		if (tcp_need_reset(sk->sk_state))
-			tcp_send_active_reset(sk, GFP_ATOMIC);
-		tcp_done(sk);
-	}
+	if (tcp_need_reset(sk->sk_state))
+		tcp_send_active_reset(sk, GFP_ATOMIC);
+	tcp_done_with_error(sk, err);
 
 	bh_unlock_sock(sk);
 	local_bh_enable();
-	tcp_write_queue_purge(sk);
 	if (!has_current_bpf_ctx())
 		release_sock(sk);
 	return 0;
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_ao.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_ao.c
@@ -108,12 +108,13 @@
  * it's known that the keys in ao_info are matching peer's
  * family/address/VRF/etc.
  */
-struct tcp_ao_key *tcp_ao_established_key(struct tcp_ao_info *ao,
+struct tcp_ao_key *tcp_ao_established_key(const struct sock *sk,
+					  struct tcp_ao_info *ao,
 					  int sndid, int rcvid)
 {
 	struct tcp_ao_key *key;
 
-	hlist_for_each_entry_rcu(key, &ao->head, node) {
+	hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk)) {
 		if ((sndid >= 0 && key->sndid != sndid) ||
 		    (rcvid >= 0 && key->rcvid != rcvid))
 			continue;
@@ -204,7 +205,7 @@
 	if (!ao)
 		return NULL;
 
-	hlist_for_each_entry_rcu(key, &ao->head, node) {
+	hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk)) {
 		u8 prefixlen = min(prefix, key->prefixlen);
 
 		if (!tcp_ao_key_cmp(key, l3index, addr, prefixlen,
@@ -266,32 +267,49 @@
 	kfree_sensitive(key);
 }
 
-void tcp_ao_destroy_sock(struct sock *sk, bool twsk)
+static void tcp_ao_info_free_rcu(struct rcu_head *head)
 {
-	struct tcp_ao_info *ao;
+	struct tcp_ao_info *ao = container_of(head, struct tcp_ao_info, rcu);
 	struct tcp_ao_key *key;
 	struct hlist_node *n;
 
+	hlist_for_each_entry_safe(key, n, &ao->head, node) {
+		hlist_del(&key->node);
+		tcp_sigpool_release(key->tcp_sigpool_id);
+		kfree_sensitive(key);
+	}
+	kfree(ao);
+	static_branch_slow_dec_deferred(&tcp_ao_needed);
+}
+
+static void tcp_ao_sk_omem_free(struct sock *sk, struct tcp_ao_info *ao)
+{
+	size_t total_ao_sk_mem = 0;
+	struct tcp_ao_key *key;
+
+	hlist_for_each_entry(key,  &ao->head, node)
+		total_ao_sk_mem += tcp_ao_sizeof_key(key);
+	atomic_sub(total_ao_sk_mem, &sk->sk_omem_alloc);
+}
+
+void tcp_ao_destroy_sock(struct sock *sk, bool twsk)
+{
+	struct tcp_ao_info *ao;
+
 	if (twsk) {
 		ao = rcu_dereference_protected(tcp_twsk(sk)->ao_info, 1);
-		tcp_twsk(sk)->ao_info = NULL;
+		rcu_assign_pointer(tcp_twsk(sk)->ao_info, NULL);
 	} else {
 		ao = rcu_dereference_protected(tcp_sk(sk)->ao_info, 1);
-		tcp_sk(sk)->ao_info = NULL;
+		rcu_assign_pointer(tcp_sk(sk)->ao_info, NULL);
 	}
 
 	if (!ao || !refcount_dec_and_test(&ao->refcnt))
 		return;
 
-	hlist_for_each_entry_safe(key, n, &ao->head, node) {
-		hlist_del_rcu(&key->node);
-		if (!twsk)
-			atomic_sub(tcp_ao_sizeof_key(key), &sk->sk_omem_alloc);
-		call_rcu(&key->rcu, tcp_ao_key_free_rcu);
-	}
-
-	kfree_rcu(ao, rcu);
-	static_branch_slow_dec_deferred(&tcp_ao_needed);
+	if (!twsk)
+		tcp_ao_sk_omem_free(sk, ao);
+	call_rcu(&ao->rcu, tcp_ao_info_free_rcu);
 }
 
 void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp)
@@ -775,7 +793,7 @@
 		if (!ao_info)
 			return -ENOENT;
 
-		*key = tcp_ao_established_key(ao_info, aoh->rnext_keyid, -1);
+		*key = tcp_ao_established_key(sk, ao_info, aoh->rnext_keyid, -1);
 		if (!*key)
 			return -ENOENT;
 		*traffic_key = snd_other_key(*key);
@@ -933,6 +951,7 @@
 	struct tcp_ao_key *key;
 	__be32 sisn, disn;
 	u8 *traffic_key;
+	int state;
 	u32 sne = 0;
 
 	info = rcu_dereference(tcp_sk(sk)->ao_info);
@@ -948,8 +967,9 @@
 		disn = 0;
 	}
 
+	state = READ_ONCE(sk->sk_state);
 	/* Fast-path */
-	if (likely((1 << sk->sk_state) & TCP_AO_ESTABLISHED)) {
+	if (likely((1 << state) & TCP_AO_ESTABLISHED)) {
 		enum skb_drop_reason err;
 		struct tcp_ao_key *current_key;
 
@@ -959,7 +979,7 @@
 		 */
 		key = READ_ONCE(info->rnext_key);
 		if (key->rcvid != aoh->keyid) {
-			key = tcp_ao_established_key(info, -1, aoh->keyid);
+			key = tcp_ao_established_key(sk, info, -1, aoh->keyid);
 			if (!key)
 				goto key_not_found;
 		}
@@ -980,7 +1000,7 @@
 		/* Key rotation: the peer asks us to use new key (RNext) */
 		if (unlikely(aoh->rnext_keyid != current_key->sndid)) {
 			/* If the key is not found we do nothing. */
-			key = tcp_ao_established_key(info, aoh->rnext_keyid, -1);
+			key = tcp_ao_established_key(sk, info, aoh->rnext_keyid, -1);
 			if (key)
 				/* pairs with tcp_ao_del_cmd */
 				WRITE_ONCE(info->current_key, key);
@@ -988,6 +1008,9 @@
 		return SKB_NOT_DROPPED_YET;
 	}
 
+	if (unlikely(state == TCP_CLOSE))
+		return SKB_DROP_REASON_TCP_CLOSE;
+
 	/* Lookup key based on peer address and keyid.
 	 * current_key and rnext_key must not be used on tcp listen
 	 * sockets as otherwise:
@@ -1001,7 +1024,7 @@
 	if (th->syn && !th->ack)
 		goto verify_hash;
 
-	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_NEW_SYN_RECV)) {
+	if ((1 << state) & (TCPF_LISTEN | TCPF_NEW_SYN_RECV)) {
 		/* Make the initial syn the likely case here */
 		if (unlikely(req)) {
 			sne = tcp_ao_compute_sne(0, tcp_rsk(req)->rcv_isn,
@@ -1018,14 +1041,14 @@
 			/* no way to figure out initial sisn/disn - drop */
 			return SKB_DROP_REASON_TCP_FLAGS;
 		}
-	} else if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
+	} else if ((1 << state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
 		disn = info->lisn;
 		if (th->syn || th->rst)
 			sisn = th->seq;
 		else
 			sisn = info->risn;
 	} else {
-		WARN_ONCE(1, "TCP-AO: Unexpected sk_state %d", sk->sk_state);
+		WARN_ONCE(1, "TCP-AO: Unexpected sk_state %d", state);
 		return SKB_DROP_REASON_TCP_AOFAILURE;
 	}
 verify_hash:
@@ -1068,6 +1091,7 @@
 {
 	struct tcp_sock *tp = tcp_sk(sk);
 	struct tcp_ao_info *ao_info;
+	struct hlist_node *next;
 	union tcp_ao_addr *addr;
 	struct tcp_ao_key *key;
 	int family, l3index;
@@ -1090,7 +1114,7 @@
 	l3index = l3mdev_master_ifindex_by_index(sock_net(sk),
 						 sk->sk_bound_dev_if);
 
-	hlist_for_each_entry_rcu(key, &ao_info->head, node) {
+	hlist_for_each_entry_safe(key, next, &ao_info->head, node) {
 		if (!tcp_ao_key_cmp(key, l3index, addr, key->prefixlen, family, -1, -1))
 			continue;
 
@@ -1136,7 +1160,7 @@
 	if (!ao)
 		return;
 
-	hlist_for_each_entry_rcu(key, &ao->head, node)
+	hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk))
 		tcp_ao_cache_traffic_keys(sk, ao, key);
 }
 
@@ -1153,7 +1177,7 @@
 	WRITE_ONCE(ao->risn, tcp_hdr(skb)->seq);
 	ao->rcv_sne = 0;
 
-	hlist_for_each_entry_rcu(key, &ao->head, node)
+	hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk))
 		tcp_ao_cache_traffic_keys(sk, ao, key);
 }
 
@@ -1229,14 +1253,14 @@
 	key_head = rcu_dereference(hlist_first_rcu(&new_ao->head));
 	first_key = hlist_entry_safe(key_head, struct tcp_ao_key, node);
 
-	key = tcp_ao_established_key(new_ao, tcp_rsk(req)->ao_keyid, -1);
+	key = tcp_ao_established_key(req_to_sk(req), new_ao, tcp_rsk(req)->ao_keyid, -1);
 	if (key)
 		new_ao->current_key = key;
 	else
 		new_ao->current_key = first_key;
 
 	/* set rnext_key */
-	key = tcp_ao_established_key(new_ao, -1, tcp_rsk(req)->ao_rcv_next);
+	key = tcp_ao_established_key(req_to_sk(req), new_ao, -1, tcp_rsk(req)->ao_rcv_next);
 	if (key)
 		new_ao->rnext_key = key;
 	else
@@ -1830,12 +1854,12 @@
 	 * if there's any.
 	 */
 	if (cmd.set_current) {
-		new_current = tcp_ao_established_key(ao_info, cmd.current_key, -1);
+		new_current = tcp_ao_established_key(sk, ao_info, cmd.current_key, -1);
 		if (!new_current)
 			return -ENOENT;
 	}
 	if (cmd.set_rnext) {
-		new_rnext = tcp_ao_established_key(ao_info, -1, cmd.rnext);
+		new_rnext = tcp_ao_established_key(sk, ao_info, -1, cmd.rnext);
 		if (!new_rnext)
 			return -ENOENT;
 	}
@@ -1875,7 +1899,8 @@
 	 * "It is presumed that an MKT affecting a particular
 	 * connection cannot be destroyed during an active connection"
 	 */
-	hlist_for_each_entry_rcu(key, &ao_info->head, node) {
+	hlist_for_each_entry_rcu(key, &ao_info->head, node,
+				 lockdep_sock_is_held(sk)) {
 		if (cmd.sndid != key->sndid ||
 		    cmd.rcvid != key->rcvid)
 			continue;
@@ -1962,8 +1987,10 @@
 		first = true;
 	}
 
-	if (cmd.ao_required && tcp_ao_required_verify(sk))
-		return -EKEYREJECTED;
+	if (cmd.ao_required && tcp_ao_required_verify(sk)) {
+		err = -EKEYREJECTED;
+		goto out;
+	}
 
 	/* For sockets in TCP_CLOSED it's possible set keys that aren't
 	 * matching the future peer (address/port/VRF/etc),
@@ -1971,14 +1998,14 @@
 	 * if there's any.
 	 */
 	if (cmd.set_current) {
-		new_current = tcp_ao_established_key(ao_info, cmd.current_key, -1);
+		new_current = tcp_ao_established_key(sk, ao_info, cmd.current_key, -1);
 		if (!new_current) {
 			err = -ENOENT;
 			goto out;
 		}
 	}
 	if (cmd.set_rnext) {
-		new_rnext = tcp_ao_established_key(ao_info, -1, cmd.rnext);
+		new_rnext = tcp_ao_established_key(sk, ao_info, -1, cmd.rnext);
 		if (!new_rnext) {
 			err = -ENOENT;
 			goto out;
@@ -2072,7 +2099,8 @@
  * The layout of the fields in the user and kernel structures is expected to
  * be the same (including in the 32bit vs 64bit case).
  */
-static int tcp_ao_copy_mkts_to_user(struct tcp_ao_info *ao_info,
+static int tcp_ao_copy_mkts_to_user(const struct sock *sk,
+				    struct tcp_ao_info *ao_info,
 				    sockptr_t optval, sockptr_t optlen)
 {
 	struct tcp_ao_getsockopt opt_in, opt_out;
@@ -2200,7 +2228,8 @@
 	/* May change in RX, while we're dumping, pre-fetch it */
 	current_key = READ_ONCE(ao_info->current_key);
 
-	hlist_for_each_entry_rcu(key, &ao_info->head, node) {
+	hlist_for_each_entry_rcu(key, &ao_info->head, node,
+				 lockdep_sock_is_held(sk)) {
 		if (opt_in.get_all)
 			goto match;
 
@@ -2280,7 +2309,7 @@
 	if (!ao_info)
 		return -ENOENT;
 
-	return tcp_ao_copy_mkts_to_user(ao_info, optval, optlen);
+	return tcp_ao_copy_mkts_to_user(sk, ao_info, optval, optlen);
 }
 
 int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen)
@@ -2367,7 +2396,7 @@
 	WRITE_ONCE(ao->snd_sne, cmd.snd_sne);
 	WRITE_ONCE(ao->rcv_sne, cmd.rcv_sne);
 
-	hlist_for_each_entry_rcu(key, &ao->head, node)
+	hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk))
 		tcp_ao_cache_traffic_keys(sk, ao, key);
 
 	return 0;
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_bpf.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_bpf.c
@@ -49,13 +49,14 @@
 		sge = sk_msg_elem(msg, i);
 		size = (apply && apply_bytes < sge->length) ?
 			apply_bytes : sge->length;
-		if (!sk_wmem_schedule(sk, size)) {
+		if (!__sk_rmem_schedule(sk, size, false)) {
 			if (!copied)
 				ret = -ENOMEM;
 			break;
 		}
 
 		sk_mem_charge(sk, size);
+		atomic_add(size, &sk->sk_rmem_alloc);
 		sk_msg_xfer(tmp, msg, i, size);
 		copied += size;
 		if (sge->length)
@@ -74,7 +75,8 @@
 
 	if (!ret) {
 		msg->sg.start = i;
-		sk_psock_queue_msg(psock, tmp);
+		if (!sk_psock_queue_msg(psock, tmp))
+			atomic_sub(copied, &sk->sk_rmem_alloc);
 		sk_psock_data_ready(sk, psock);
 	} else {
 		sk_msg_free(sk, tmp);
@@ -221,11 +223,11 @@
 				  int flags,
 				  int *addr_len)
 {
-	struct tcp_sock *tcp = tcp_sk(sk);
 	int peek = flags & MSG_PEEK;
-	u32 seq = tcp->copied_seq;
 	struct sk_psock *psock;
+	struct tcp_sock *tcp;
 	int copied = 0;
+	u32 seq;
 
 	if (unlikely(flags & MSG_ERRQUEUE))
 		return inet_recv_error(sk, msg, len, addr_len);
@@ -238,7 +240,8 @@
 		return tcp_recvmsg(sk, msg, len, flags, addr_len);
 
 	lock_sock(sk);
-
+	tcp = tcp_sk(sk);
+	seq = tcp->copied_seq;
 	/* We may have received data on the sk_receive_queue pre-accept and
 	 * then we can not use read_skb in this context because we haven't
 	 * assigned a sk_socket yet so have no link to the ops. The work-around
@@ -440,7 +443,6 @@
 			cork = true;
 			psock->cork = NULL;
 		}
-		sk_msg_return(sk, msg, tosend);
 		release_sock(sk);
 
 		origsize = msg->sg.size;
@@ -452,8 +454,9 @@
 			sock_put(sk_redir);
 
 		lock_sock(sk);
+		sk_mem_uncharge(sk, sent);
 		if (unlikely(ret < 0)) {
-			int free = sk_msg_free_nocharge(sk, msg);
+			int free = sk_msg_free(sk, msg);
 
 			if (!cork)
 				*copied -= free;
@@ -467,7 +470,7 @@
 		break;
 	case __SK_DROP:
 	default:
-		sk_msg_free_partial(sk, msg, tosend);
+		sk_msg_free(sk, msg);
 		sk_msg_apply_bytes(psock, tosend);
 		*copied -= (tosend + delta);
 		return -EACCES;
@@ -483,11 +486,8 @@
 		}
 		if (msg &&
 		    msg->sg.data[msg->sg.start].page_link &&
-		    msg->sg.data[msg->sg.start].length) {
-			if (eval == __SK_REDIRECT)
-				sk_mem_charge(sk, tosend - sent);
+		    msg->sg.data[msg->sg.start].length)
 			goto more_data;
-		}
 	}
 	return ret;
 }
@@ -577,7 +577,7 @@
 		err = sk_stream_error(sk, msg->msg_flags, err);
 	release_sock(sk);
 	sk_psock_put(sk, psock);
-	return copied ? copied : err;
+	return copied > 0 ? copied : err;
 }
 
 enum {
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_cong.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_cong.c
@@ -46,8 +46,7 @@
 }
 
 /* Must be called with rcu lock held */
-static struct tcp_congestion_ops *tcp_ca_find_autoload(struct net *net,
-						       const char *name)
+static struct tcp_congestion_ops *tcp_ca_find_autoload(const char *name)
 {
 	struct tcp_congestion_ops *ca = tcp_ca_find(name);
 
@@ -182,7 +181,7 @@
 	return ret;
 }
 
-u32 tcp_ca_get_key_by_name(struct net *net, const char *name, bool *ecn_ca)
+u32 tcp_ca_get_key_by_name(const char *name, bool *ecn_ca)
 {
 	const struct tcp_congestion_ops *ca;
 	u32 key = TCP_CA_UNSPEC;
@@ -190,7 +189,7 @@
 	might_sleep();
 
 	rcu_read_lock();
-	ca = tcp_ca_find_autoload(net, name);
+	ca = tcp_ca_find_autoload(name);
 	if (ca) {
 		key = ca->key;
 		*ecn_ca = ca->flags & TCP_CONG_NEEDS_ECN;
@@ -287,7 +286,7 @@
 	int ret;
 
 	rcu_read_lock();
-	ca = tcp_ca_find_autoload(net, name);
+	ca = tcp_ca_find_autoload(name);
 	if (!ca) {
 		ret = -ENOENT;
 	} else if (!bpf_try_module_get(ca, ca->owner)) {
@@ -425,7 +424,7 @@
 	if (!load)
 		ca = tcp_ca_find(name);
 	else
-		ca = tcp_ca_find_autoload(sock_net(sk), name);
+		ca = tcp_ca_find_autoload(name);
 
 	/* No change asking for existing value */
 	if (ca == icsk->icsk_ca_ops) {
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_dctcp.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_dctcp.c
@@ -58,7 +58,18 @@
 };
 
 static unsigned int dctcp_shift_g __read_mostly = 4; /* g = 1/2^4 */
-module_param(dctcp_shift_g, uint, 0644);
+
+static int dctcp_shift_g_set(const char *val, const struct kernel_param *kp)
+{
+	return param_set_uint_minmax(val, kp, 0, 10);
+}
+
+static const struct kernel_param_ops dctcp_shift_g_ops = {
+	.set = dctcp_shift_g_set,
+	.get = param_get_uint,
+};
+
+module_param_cb(dctcp_shift_g, &dctcp_shift_g_ops, &dctcp_shift_g, 0644);
 MODULE_PARM_DESC(dctcp_shift_g, "parameter g for updating dctcp_alpha");
 
 static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA;
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_fastopen.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_fastopen.c
@@ -49,7 +49,7 @@
 {
 	struct tcp_fastopen_context *ctxt;
 
-	ctxt = xchg((__force struct tcp_fastopen_context **)&net->ipv4.tcp_fastopen_ctx, NULL);
+	ctxt = unrcu_pointer(xchg(&net->ipv4.tcp_fastopen_ctx, NULL));
 
 	if (ctxt)
 		call_rcu(&ctxt->rcu, tcp_fastopen_ctx_free);
@@ -80,9 +80,10 @@
 
 	if (sk) {
 		q = &inet_csk(sk)->icsk_accept_queue.fastopenq;
-		octx = xchg((__force struct tcp_fastopen_context **)&q->ctx, ctx);
+		octx = unrcu_pointer(xchg(&q->ctx, RCU_INITIALIZER(ctx)));
 	} else {
-		octx = xchg((__force struct tcp_fastopen_context **)&net->ipv4.tcp_fastopen_ctx, ctx);
+		octx = unrcu_pointer(xchg(&net->ipv4.tcp_fastopen_ctx,
+					  RCU_INITIALIZER(ctx)));
 	}
 
 	if (octx)
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_input.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_input.c
@@ -237,9 +237,14 @@
 		 */
 		if (unlikely(len != icsk->icsk_ack.rcv_mss)) {
 			u64 val = (u64)skb->len << TCP_RMEM_TO_WIN_SCALE;
+			u8 old_ratio = tcp_sk(sk)->scaling_ratio;
 
 			do_div(val, skb->truesize);
 			tcp_sk(sk)->scaling_ratio = val ? val : 1;
+
+			if (old_ratio != tcp_sk(sk)->scaling_ratio)
+				WRITE_ONCE(tcp_sk(sk)->window_clamp,
+					   tcp_win_from_space(sk, sk->sk_rcvbuf));
 		}
 		icsk->icsk_ack.rcv_mss = min_t(unsigned int, len,
 					       tcp_sk(sk)->advmss);
@@ -563,19 +568,20 @@
 	maxwin = tcp_full_space(sk);
 
 	if (tp->window_clamp >= maxwin) {
-		tp->window_clamp = maxwin;
+		WRITE_ONCE(tp->window_clamp, maxwin);
 
 		if (tcp_app_win && maxwin > 4 * tp->advmss)
-			tp->window_clamp = max(maxwin -
-					       (maxwin >> tcp_app_win),
-					       4 * tp->advmss);
+			WRITE_ONCE(tp->window_clamp,
+				   max(maxwin - (maxwin >> tcp_app_win),
+				       4 * tp->advmss));
 	}
 
 	/* Force reservation of one segment. */
 	if (tcp_app_win &&
 	    tp->window_clamp > 2 * tp->advmss &&
 	    tp->window_clamp + tp->advmss > maxwin)
-		tp->window_clamp = max(2 * tp->advmss, maxwin - tp->advmss);
+		WRITE_ONCE(tp->window_clamp,
+			   max(2 * tp->advmss, maxwin - tp->advmss));
 
 	tp->rcv_ssthresh = min(tp->rcv_ssthresh, tp->window_clamp);
 	tp->snd_cwnd_stamp = tcp_jiffies32;
@@ -773,7 +779,8 @@
 			WRITE_ONCE(sk->sk_rcvbuf, rcvbuf);
 
 			/* Make the window clamp follow along.  */
-			tp->window_clamp = tcp_win_from_space(sk, rcvbuf);
+			WRITE_ONCE(tp->window_clamp,
+				   tcp_win_from_space(sk, rcvbuf));
 		}
 	}
 	tp->rcvq_space.space = copied;
@@ -2126,8 +2133,16 @@
 static inline void tcp_init_undo(struct tcp_sock *tp)
 {
 	tp->undo_marker = tp->snd_una;
+
 	/* Retransmission still in flight may cause DSACKs later. */
-	tp->undo_retrans = tp->retrans_out ? : -1;
+	/* First, account for regular retransmits in flight: */
+	tp->undo_retrans = tp->retrans_out;
+	/* Next, account for TLP retransmits in flight: */
+	if (tp->tlp_high_seq && tp->tlp_retrans)
+		tp->undo_retrans++;
+	/* Finally, avoid 0, because undo_retrans==0 means "can undo now": */
+	if (!tp->undo_retrans)
+		tp->undo_retrans = -1;
 }
 
 static bool tcp_is_rack(const struct sock *sk)
@@ -2206,6 +2221,7 @@
 
 	tcp_set_ca_state(sk, TCP_CA_Loss);
 	tp->high_seq = tp->snd_nxt;
+	tp->tlp_high_seq = 0;
 	tcp_ecn_queue_cwr(tp);
 
 	/* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous
@@ -2456,8 +2472,22 @@
  */
 static inline bool tcp_packet_delayed(const struct tcp_sock *tp)
 {
-	return tp->retrans_stamp &&
-	       tcp_tsopt_ecr_before(tp, tp->retrans_stamp);
+	const struct sock *sk = (const struct sock *)tp;
+
+	if (tp->retrans_stamp &&
+	    tcp_tsopt_ecr_before(tp, tp->retrans_stamp))
+		return true;  /* got echoed TS before first retransmission */
+
+	/* Check if nothing was retransmitted (retrans_stamp==0), which may
+	 * happen in fast recovery due to TSQ. But we ignore zero retrans_stamp
+	 * in TCP_SYN_SENT, since when we set FLAG_SYN_ACKED we also clear
+	 * retrans_stamp even if we had retransmitted the SYN.
+	 */
+	if (!tp->retrans_stamp &&	   /* no record of a retransmit/SYN? */
+	    sk->sk_state != TCP_SYN_SENT)  /* not the FLAG_SYN_ACKED case? */
+		return true;  /* nothing was retransmitted */
+
+	return false;
 }
 
 /* Undo procedures. */
@@ -2491,6 +2521,16 @@
 	return false;
 }
 
+/* If loss recovery is finished and there are no retransmits out in the
+ * network, then we clear retrans_stamp so that upon the next loss recovery
+ * retransmits_timed_out() and timestamp-undo are using the correct value.
+ */
+static void tcp_retrans_stamp_cleanup(struct sock *sk)
+{
+	if (!tcp_any_retrans_done(sk))
+		tcp_sk(sk)->retrans_stamp = 0;
+}
+
 static void DBGUNDO(struct sock *sk, const char *msg)
 {
 #if FASTRETRANS_DEBUG > 1
@@ -2779,13 +2819,37 @@
 	NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMTUPSUCCESS);
 }
 
+/* Sometimes we deduce that packets have been dropped due to reasons other than
+ * congestion, like path MTU reductions or failed client TFO attempts. In these
+ * cases we call this function to retransmit as many packets as cwnd allows,
+ * without reducing cwnd. Given that retransmits will set retrans_stamp to a
+ * non-zero value (and may do so in a later calling context due to TSQ), we
+ * also enter CA_Loss so that we track when all retransmitted packets are ACKed
+ * and clear retrans_stamp when that happens (to ensure later recurring RTOs
+ * are using the correct retrans_stamp and don't declare ETIMEDOUT
+ * prematurely).
+ */
+static void tcp_non_congestion_loss_retransmit(struct sock *sk)
+{
+	const struct inet_connection_sock *icsk = inet_csk(sk);
+	struct tcp_sock *tp = tcp_sk(sk);
+
+	if (icsk->icsk_ca_state != TCP_CA_Loss) {
+		tp->high_seq = tp->snd_nxt;
+		tp->snd_ssthresh = tcp_current_ssthresh(sk);
+		tp->prior_ssthresh = 0;
+		tp->undo_marker = 0;
+		tcp_set_ca_state(sk, TCP_CA_Loss);
+	}
+	tcp_xmit_retransmit_queue(sk);
+}
+
 /* Do a simple retransmit without using the backoff mechanisms in
  * tcp_timer. This is used for path mtu discovery.
  * The socket is already locked here.
  */
 void tcp_simple_retransmit(struct sock *sk)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	struct sk_buff *skb;
 	int mss;
@@ -2825,14 +2889,7 @@
 	 * in network, but units changed and effective
 	 * cwnd/ssthresh really reduced now.
 	 */
-	if (icsk->icsk_ca_state != TCP_CA_Loss) {
-		tp->high_seq = tp->snd_nxt;
-		tp->snd_ssthresh = tcp_current_ssthresh(sk);
-		tp->prior_ssthresh = 0;
-		tp->undo_marker = 0;
-		tcp_set_ca_state(sk, TCP_CA_Loss);
-	}
-	tcp_xmit_retransmit_queue(sk);
+	tcp_non_congestion_loss_retransmit(sk);
 }
 EXPORT_SYMBOL(tcp_simple_retransmit);
 
@@ -2841,6 +2898,9 @@
 	struct tcp_sock *tp = tcp_sk(sk);
 	int mib_idx;
 
+	/* Start the clock with our fast retransmit, for undo and ETIMEDOUT. */
+	tcp_retrans_stamp_cleanup(sk);
+
 	if (tcp_is_reno(tp))
 		mib_idx = LINUX_MIB_TCPRENORECOVERY;
 	else
@@ -3057,7 +3117,7 @@
 			return;
 
 		if (tcp_try_undo_dsack(sk))
-			tcp_try_keep_open(sk);
+			tcp_try_to_open(sk, flag);
 
 		tcp_identify_packet_loss(sk, ack_flag);
 		if (icsk->icsk_ca_state != TCP_CA_Recovery) {
@@ -4204,6 +4264,13 @@
 				 */
 				break;
 #endif
+#ifdef CONFIG_TCP_AO
+			case TCPOPT_AO:
+				/* TCP AO has already been checked
+				 * (see tcp_inbound_ao_hash()).
+				 */
+				break;
+#endif
 			case TCPOPT_FASTOPEN:
 				tcp_parse_fastopen_option(
 					opsize - TCPOLEN_FASTOPEN_BASE,
@@ -4433,9 +4500,26 @@
 	return SKB_NOT_DROPPED_YET;
 }
 
+
+void tcp_done_with_error(struct sock *sk, int err)
+{
+	/* This barrier is coupled with smp_rmb() in tcp_poll() */
+	WRITE_ONCE(sk->sk_err, err);
+	smp_wmb();
+
+	tcp_write_queue_purge(sk);
+	tcp_done(sk);
+
+	if (!sock_flag(sk, SOCK_DEAD))
+		sk_error_report(sk);
+}
+EXPORT_SYMBOL(tcp_done_with_error);
+
 /* When we get a reset we do this. */
 void tcp_reset(struct sock *sk, struct sk_buff *skb)
 {
+	int err;
+
 	trace_tcp_receive_reset(sk);
 
 	/* mptcp can't tell us to ignore reset pkts,
@@ -4447,24 +4531,17 @@
 	/* We want the right error as BSD sees it (and indeed as we do). */
 	switch (sk->sk_state) {
 	case TCP_SYN_SENT:
-		WRITE_ONCE(sk->sk_err, ECONNREFUSED);
+		err = ECONNREFUSED;
 		break;
 	case TCP_CLOSE_WAIT:
-		WRITE_ONCE(sk->sk_err, EPIPE);
+		err = EPIPE;
 		break;
 	case TCP_CLOSE:
 		return;
 	default:
-		WRITE_ONCE(sk->sk_err, ECONNRESET);
+		err = ECONNRESET;
 	}
-	/* This barrier is coupled with smp_rmb() in tcp_poll() */
-	smp_wmb();
-
-	tcp_write_queue_purge(sk);
-	tcp_done(sk);
-
-	if (!sock_flag(sk, SOCK_DEAD))
-		sk_error_report(sk);
+	tcp_done_with_error(sk, err);
 }
 
 /*
@@ -5949,6 +6026,11 @@
 	 * RFC 5961 4.2 : Send a challenge ack
 	 */
 	if (th->syn) {
+		if (sk->sk_state == TCP_SYN_RECV && sk->sk_socket && th->ack &&
+		    TCP_SKB_CB(skb)->seq + 1 == TCP_SKB_CB(skb)->end_seq &&
+		    TCP_SKB_CB(skb)->seq + 1 == tp->rcv_nxt &&
+		    TCP_SKB_CB(skb)->ack_seq == tp->snd_nxt)
+			goto pass;
 syn_challenge:
 		if (syn_inerr)
 			TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
@@ -5958,6 +6040,7 @@
 		goto discard;
 	}
 
+pass:
 	bpf_skops_parse_hdr(sk, skb);
 
 	return true;
@@ -6288,7 +6371,7 @@
 			tp->fastopen_client_fail = TFO_DATA_NOT_ACKED;
 		skb_rbtree_walk_from(data)
 			 tcp_mark_skb_lost(sk, data);
-		tcp_xmit_retransmit_queue(sk);
+		tcp_non_congestion_loss_retransmit(sk);
 		NET_INC_STATS(sock_net(sk),
 				LINUX_MIB_TCPFASTOPENACTIVEFAIL);
 		return true;
@@ -6424,7 +6507,8 @@
 
 		if (!tp->rx_opt.wscale_ok) {
 			tp->rx_opt.snd_wscale = tp->rx_opt.rcv_wscale = 0;
-			tp->window_clamp = min(tp->window_clamp, 65535U);
+			WRITE_ONCE(tp->window_clamp,
+				   min(tp->window_clamp, 65535U));
 		}
 
 		if (tp->rx_opt.saw_tstamp) {
@@ -6586,10 +6670,17 @@
 	if (inet_csk(sk)->icsk_ca_state == TCP_CA_Loss && !tp->packets_out)
 		tcp_try_undo_recovery(sk);
 
-	/* Reset rtx states to prevent spurious retransmits_timed_out() */
 	tcp_update_rto_time(tp);
-	tp->retrans_stamp = 0;
 	inet_csk(sk)->icsk_retransmits = 0;
+	/* In tcp_fastopen_synack_timer() on the first SYNACK RTO we set
+	 * retrans_stamp but don't enter CA_Loss, so in case that happened we
+	 * need to zero retrans_stamp here to prevent spurious
+	 * retransmits_timed_out(). However, if the ACK of our SYNACK caused us
+	 * to enter CA_Recovery then we need to leave retrans_stamp as it was
+	 * set entering CA_Recovery, for correct retransmits_timed_out() and
+	 * undo behavior.
+	 */
+	tcp_retrans_stamp_cleanup(sk);
 
 	/* Once we leave TCP_SYN_RECV or TCP_FIN_WAIT_1,
 	 * we no longer need req so release it.
@@ -6752,6 +6843,8 @@
 
 		tcp_initialize_rcv_mss(sk);
 		tcp_fast_path_on(tp);
+		if (sk->sk_shutdown & SEND_SHUTDOWN)
+			tcp_shutdown(sk, SEND_SHUTDOWN);
 		break;
 
 	case TCP_FIN_WAIT1: {
@@ -7231,7 +7324,13 @@
 		tcp_rsk(req)->tfo_listener = false;
 		if (!want_cookie) {
 			req->timeout = tcp_timeout_init((struct sock *)req);
-			inet_csk_reqsk_queue_hash_add(sk, req, req->timeout);
+			if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req,
+								    req->timeout))) {
+				reqsk_free(req);
+				dst_release(dst);
+				return 0;
+			}
+
 		}
 		af_ops->send_synack(sk, dst, &fl, req, &foc,
 				    !want_cookie ? TCP_SYNACK_NORMAL :
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_ipv4.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_ipv4.c
@@ -94,6 +94,8 @@
 
 static DEFINE_PER_CPU(struct sock *, ipv4_tcp_sk);
 
+static DEFINE_MUTEX(tcp_exit_batch_mutex);
+
 static u32 tcp_v4_init_seq(const struct sk_buff *skb)
 {
 	return secure_tcp_seq(ip_hdr(skb)->daddr,
@@ -113,6 +115,10 @@
 	const struct inet_timewait_sock *tw = inet_twsk(sktw);
 	const struct tcp_timewait_sock *tcptw = tcp_twsk(sktw);
 	struct tcp_sock *tp = tcp_sk(sk);
+	int ts_recent_stamp;
+
+	if (tw->tw_substate == TCP_FIN_WAIT2)
+		reuse = 0;
 
 	if (reuse == 2) {
 		/* Still does not detect *everything* that goes through
@@ -151,9 +157,16 @@
 	   If TW bucket has been already destroyed we fall back to VJ's scheme
 	   and use initial timestamp retrieved from peer table.
 	 */
-	if (tcptw->tw_ts_recent_stamp &&
+	ts_recent_stamp = READ_ONCE(tcptw->tw_ts_recent_stamp);
+	if (ts_recent_stamp &&
 	    (!twp || (reuse && time_after32(ktime_get_seconds(),
-					    tcptw->tw_ts_recent_stamp)))) {
+					    ts_recent_stamp)))) {
+		/* inet_twsk_hashdance_schedule() sets sk_refcnt after putting twsk
+		 * and releasing the bucket lock.
+		 */
+		if (unlikely(!refcount_inc_not_zero(&sktw->sk_refcnt)))
+			return 0;
+
 		/* In case of repair and re-using TIME-WAIT sockets we still
 		 * want to be sure that it is safe as above but honor the
 		 * sequence numbers and time stamps set as part of the repair
@@ -171,10 +184,10 @@
 			if (!seq)
 				seq = 1;
 			WRITE_ONCE(tp->write_seq, seq);
-			tp->rx_opt.ts_recent	   = tcptw->tw_ts_recent;
-			tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
+			tp->rx_opt.ts_recent	   = READ_ONCE(tcptw->tw_ts_recent);
+			tp->rx_opt.ts_recent_stamp = ts_recent_stamp;
 		}
-		sock_hold(sktw);
+
 		return 1;
 	}
 
@@ -604,15 +617,10 @@
 
 		ip_icmp_error(sk, skb, err, th->dest, info, (u8 *)th);
 
-		if (!sock_owned_by_user(sk)) {
-			WRITE_ONCE(sk->sk_err, err);
-
-			sk_error_report(sk);
-
-			tcp_done(sk);
-		} else {
+		if (!sock_owned_by_user(sk))
+			tcp_done_with_error(sk, err);
+		else
 			WRITE_ONCE(sk->sk_err_soft, err);
-		}
 		goto out;
 	}
 
@@ -882,7 +890,7 @@
 	sock_net_set(ctl_sk, net);
 	if (sk) {
 		ctl_sk->sk_mark = (sk->sk_state == TCP_TIME_WAIT) ?
-				   inet_twsk(sk)->tw_mark : sk->sk_mark;
+				   inet_twsk(sk)->tw_mark : READ_ONCE(sk->sk_mark);
 		ctl_sk->sk_priority = (sk->sk_state == TCP_TIME_WAIT) ?
 				   inet_twsk(sk)->tw_priority : READ_ONCE(sk->sk_priority);
 		transmit_time = tcp_transmit_time(sk);
@@ -1036,7 +1044,8 @@
 			}
 
 			if (aoh)
-				key.ao_key = tcp_ao_established_key(ao_info, aoh->rnext_keyid, -1);
+				key.ao_key = tcp_ao_established_key(sk, ao_info,
+								    aoh->rnext_keyid, -1);
 		}
 	}
 	if (key.ao_key) {
@@ -1062,7 +1071,7 @@
 			tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 			tcp_tw_tsval(tcptw),
-			tcptw->tw_ts_recent,
+			READ_ONCE(tcptw->tw_ts_recent),
 			tw->tw_bound_dev_if, &key,
 			tw->tw_transparent ? IP_REPLY_ARG_NOSRCCHECK : 0,
 			tw->tw_tos,
@@ -1994,7 +2003,7 @@
 bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb,
 		     enum skb_drop_reason *reason)
 {
-	u32 limit, tail_gso_size, tail_gso_segs;
+	u32 tail_gso_size, tail_gso_segs;
 	struct skb_shared_info *shinfo;
 	const struct tcphdr *th;
 	struct tcphdr *thtail;
@@ -2003,6 +2012,7 @@
 	bool fragstolen;
 	u32 gso_segs;
 	u32 gso_size;
+	u64 limit;
 	int delta;
 
 	/* In case all data was pulled from skb frags (in __pskb_pull_tail()),
@@ -2100,7 +2110,13 @@
 	__skb_push(skb, hdrlen);
 
 no_coalesce:
-	limit = (u32)READ_ONCE(sk->sk_rcvbuf) + (u32)(READ_ONCE(sk->sk_sndbuf) >> 1);
+	/* sk->sk_backlog.len is reset only at the end of __release_sock().
+	 * Both sk->sk_backlog.len and sk->sk_rmem_alloc could reach
+	 * sk_rcvbuf in normal conditions.
+	 */
+	limit = ((u64)READ_ONCE(sk->sk_rcvbuf)) << 1;
+
+	limit += ((u32)READ_ONCE(sk->sk_sndbuf)) >> 1;
 
 	/* Only socket owner can try to collapse/prune rx queues
 	 * to reduce memory overhead, so add a little headroom here.
@@ -2108,6 +2124,8 @@
 	 */
 	limit += 64 * 1024;
 
+	limit = min_t(u64, limit, UINT_MAX);
+
 	if (unlikely(sk_add_backlog(sk, skb, limit))) {
 		bh_unlock_sock(sk);
 		*reason = SKB_DROP_REASON_SOCKET_BACKLOG;
@@ -3498,13 +3516,25 @@
 {
 	struct net *net;
 
-	tcp_twsk_purge(net_exit_list, AF_INET);
+	/* make sure concurrent calls to tcp_sk_exit_batch from net_cleanup_work
+	 * and failed setup_net error unwinding path are serialized.
+	 *
+	 * tcp_twsk_purge() handles twsk in any dead netns, not just those in
+	 * net_exit_list, the thread that dismantles a particular twsk must
+	 * do so without other thread progressing to refcount_dec_and_test() of
+	 * tcp_death_row.tw_refcount.
+	 */
+	mutex_lock(&tcp_exit_batch_mutex);
+
+	tcp_twsk_purge(net_exit_list);
 
 	list_for_each_entry(net, net_exit_list, exit_list) {
 		inet_pernet_hashinfo_free(net->ipv4.tcp_death_row.hashinfo);
 		WARN_ON_ONCE(!refcount_dec_and_test(&net->ipv4.tcp_death_row.tw_refcount));
 		tcp_fastopen_ctx_destroy(net);
 	}
+
+	mutex_unlock(&tcp_exit_batch_mutex);
 }
 
 static struct pernet_operations __net_initdata tcp_sk_ops = {
@@ -3604,6 +3634,8 @@
 		 */
 		inet_sk(sk)->pmtudisc = IP_PMTUDISC_DO;
 
+		sk->sk_clockid = CLOCK_MONOTONIC;
+
 		per_cpu(ipv4_tcp_sk, cpu) = sk;
 	}
 	if (register_pernet_subsys(&tcp_sk_ops))
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_metrics.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_metrics.c
@@ -619,6 +619,7 @@
 	[TCP_METRICS_ATTR_ADDR_IPV4]	= { .type = NLA_U32, },
 	[TCP_METRICS_ATTR_ADDR_IPV6]	= { .type = NLA_BINARY,
 					    .len = sizeof(struct in6_addr), },
+	[TCP_METRICS_ATTR_SADDR_IPV4]	= { .type = NLA_U32, },
 	/* Following attributes are not received for GET/DEL,
 	 * we keep them for reference
 	 */
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_minisocks.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_minisocks.c
@@ -100,16 +100,18 @@
 	struct tcp_options_received tmp_opt;
 	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
 	bool paws_reject = false;
+	int ts_recent_stamp;
 
 	tmp_opt.saw_tstamp = 0;
-	if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
+	ts_recent_stamp = READ_ONCE(tcptw->tw_ts_recent_stamp);
+	if (th->doff > (sizeof(*th) >> 2) && ts_recent_stamp) {
 		tcp_parse_options(twsk_net(tw), skb, &tmp_opt, 0, NULL);
 
 		if (tmp_opt.saw_tstamp) {
 			if (tmp_opt.rcv_tsecr)
 				tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset;
-			tmp_opt.ts_recent	= tcptw->tw_ts_recent;
-			tmp_opt.ts_recent_stamp	= tcptw->tw_ts_recent_stamp;
+			tmp_opt.ts_recent	= READ_ONCE(tcptw->tw_ts_recent);
+			tmp_opt.ts_recent_stamp	= ts_recent_stamp;
 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
 		}
 	}
@@ -151,8 +153,10 @@
 		twsk_rcv_nxt_update(tcptw, TCP_SKB_CB(skb)->end_seq);
 
 		if (tmp_opt.saw_tstamp) {
-			tcptw->tw_ts_recent_stamp = ktime_get_seconds();
-			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
+			WRITE_ONCE(tcptw->tw_ts_recent_stamp,
+				  ktime_get_seconds());
+			WRITE_ONCE(tcptw->tw_ts_recent,
+				   tmp_opt.rcv_tsval);
 		}
 
 		inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
@@ -196,8 +200,10 @@
 		}
 
 		if (tmp_opt.saw_tstamp) {
-			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
-			tcptw->tw_ts_recent_stamp = ktime_get_seconds();
+			WRITE_ONCE(tcptw->tw_ts_recent,
+				   tmp_opt.rcv_tsval);
+			WRITE_ONCE(tcptw->tw_ts_recent_stamp,
+				   ktime_get_seconds());
 		}
 
 		inet_twsk_put(tw);
@@ -224,7 +230,7 @@
 	if (th->syn && !th->rst && !th->ack && !paws_reject &&
 	    (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
 	     (tmp_opt.saw_tstamp &&
-	      (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
+	      (s32)(READ_ONCE(tcptw->tw_ts_recent) - tmp_opt.rcv_tsval) < 0))) {
 		u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
 		if (isn == 0)
 			isn++;
@@ -343,11 +349,10 @@
 		 * we complete the initialization.
 		 */
 		local_bh_disable();
-		inet_twsk_schedule(tw, timeo);
 		/* Linkage updates.
 		 * Note that access to tw after this point is illegal.
 		 */
-		inet_twsk_hashdance(tw, sk, net->ipv4.tcp_death_row.hashinfo);
+		inet_twsk_hashdance_schedule(tw, sk, net->ipv4.tcp_death_row.hashinfo, timeo);
 		local_bh_enable();
 	} else {
 		/* Sorry, if we're out of memory, just CLOSE this
@@ -388,7 +393,7 @@
 }
 EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
 
-void tcp_twsk_purge(struct list_head *net_exit_list, int family)
+void tcp_twsk_purge(struct list_head *net_exit_list)
 {
 	bool purged_once = false;
 	struct net *net;
@@ -396,18 +401,13 @@
 	list_for_each_entry(net, net_exit_list, exit_list) {
 		if (net->ipv4.tcp_death_row.hashinfo->pernet) {
 			/* Even if tw_refcount == 1, we must clean up kernel reqsk */
-			inet_twsk_purge(net->ipv4.tcp_death_row.hashinfo, family);
+			inet_twsk_purge(net->ipv4.tcp_death_row.hashinfo);
 		} else if (!purged_once) {
-			/* The last refcount is decremented in tcp_sk_exit_batch() */
-			if (refcount_read(&net->ipv4.tcp_death_row.tw_refcount) == 1)
-				continue;
-
-			inet_twsk_purge(&tcp_hashinfo, family);
+			inet_twsk_purge(&tcp_hashinfo);
 			purged_once = true;
 		}
 	}
 }
-EXPORT_SYMBOL_GPL(tcp_twsk_purge);
 
 /* Warning : This function is called without sk_listener being locked.
  * Be sure to read socket fields once, as their value could change under us.
@@ -519,9 +519,6 @@
 	const struct tcp_sock *oldtp;
 	struct tcp_sock *newtp;
 	u32 seq;
-#ifdef CONFIG_TCP_AO
-	struct tcp_ao_key *ao_key;
-#endif
 
 	if (!newsk)
 		return NULL;
@@ -612,10 +609,14 @@
 #endif
 #ifdef CONFIG_TCP_AO
 	newtp->ao_info = NULL;
-	ao_key = treq->af_specific->ao_lookup(sk, req,
-				tcp_rsk(req)->ao_keyid, -1);
-	if (ao_key)
-		newtp->tcp_header_len += tcp_ao_len_aligned(ao_key);
+
+	if (tcp_rsk_used_ao(req)) {
+		struct tcp_ao_key *ao_key;
+
+		ao_key = treq->af_specific->ao_lookup(sk, req, tcp_rsk(req)->ao_keyid, -1);
+		if (ao_key)
+			newtp->tcp_header_len += tcp_ao_len_aligned(ao_key);
+	}
  #endif
 	if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
 		newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_offload.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_offload.c
@@ -73,6 +73,9 @@
 	if (thlen < sizeof(*th))
 		goto out;
 
+	if (unlikely(skb_checksum_start(skb) != skb_transport_header(skb)))
+		goto out;
+
 	if (!pskb_may_pull(skb, thlen))
 		goto out;
 
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_output.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_output.c
@@ -203,16 +203,17 @@
  * This MUST be enforced by all callers.
  */
 void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss,
-			       __u32 *rcv_wnd, __u32 *window_clamp,
+			       __u32 *rcv_wnd, __u32 *__window_clamp,
 			       int wscale_ok, __u8 *rcv_wscale,
 			       __u32 init_rcv_wnd)
 {
 	unsigned int space = (__space < 0 ? 0 : __space);
+	u32 window_clamp = READ_ONCE(*__window_clamp);
 
 	/* If no clamp set the clamp to the max possible scaled window */
-	if (*window_clamp == 0)
-		(*window_clamp) = (U16_MAX << TCP_MAX_WSCALE);
-	space = min(*window_clamp, space);
+	if (window_clamp == 0)
+		window_clamp = (U16_MAX << TCP_MAX_WSCALE);
+	space = min(window_clamp, space);
 
 	/* Quantize space offering to a multiple of mss if possible. */
 	if (space > mss)
@@ -239,12 +240,13 @@
 		/* Set window scaling on max possible window */
 		space = max_t(u32, space, READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_rmem[2]));
 		space = max_t(u32, space, READ_ONCE(sysctl_rmem_max));
-		space = min_t(u32, space, *window_clamp);
+		space = min_t(u32, space, window_clamp);
 		*rcv_wscale = clamp_t(int, ilog2(space) - 15,
 				      0, TCP_MAX_WSCALE);
 	}
 	/* Set the clamp no higher than max representable value */
-	(*window_clamp) = min_t(__u32, U16_MAX << (*rcv_wscale), *window_clamp);
+	WRITE_ONCE(*__window_clamp,
+		   min_t(__u32, U16_MAX << (*rcv_wscale), window_clamp));
 }
 EXPORT_SYMBOL(tcp_select_initial_window);
 
@@ -879,8 +881,10 @@
 		unsigned int size;
 
 		if (mptcp_syn_options(sk, skb, &size, &opts->mptcp)) {
-			opts->options |= OPTION_MPTCP;
-			remaining -= size;
+			if (remaining >= size) {
+				opts->options |= OPTION_MPTCP;
+				remaining -= size;
+			}
 		}
 	}
 
@@ -1297,7 +1301,7 @@
 	tp = tcp_sk(sk);
 	prior_wstamp = tp->tcp_wstamp_ns;
 	tp->tcp_wstamp_ns = max(tp->tcp_wstamp_ns, tp->tcp_clock_cache);
-	skb_set_delivery_time(skb, tp->tcp_wstamp_ns, true);
+	skb_set_delivery_time(skb, tp->tcp_wstamp_ns, SKB_CLOCK_MONOTONIC);
 	if (clone_it) {
 		oskb = skb;
 
@@ -1647,7 +1651,7 @@
 
 	skb_split(skb, buff, len);
 
-	skb_set_delivery_time(buff, skb->tstamp, true);
+	skb_set_delivery_time(buff, skb->tstamp, SKB_CLOCK_MONOTONIC);
 	tcp_fragment_tstamp(skb, buff);
 
 	old_factor = tcp_skb_pcount(skb);
@@ -2341,9 +2345,7 @@
 		if (len <= skb->len)
 			break;
 
-		if (unlikely(TCP_SKB_CB(skb)->eor) ||
-		    tcp_has_tx_tstamp(skb) ||
-		    !skb_pure_zcopy_same(skb, next))
+		if (tcp_has_tx_tstamp(skb) || !tcp_skb_can_collapse(skb, next))
 			return false;
 
 		len -= skb->len;
@@ -2728,7 +2730,7 @@
 		if (unlikely(tp->repair) && tp->repair_queue == TCP_SEND_QUEUE) {
 			/* "skb_mstamp_ns" is used as a start point for the retransmit timer */
 			tp->tcp_wstamp_ns = tp->tcp_clock_cache;
-			skb_set_delivery_time(skb, tp->tcp_wstamp_ns, true);
+			skb_set_delivery_time(skb, tp->tcp_wstamp_ns, SKB_CLOCK_MONOTONIC);
 			list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue);
 			tcp_init_tso_segs(skb, mss_now);
 			goto repair; /* Skip network transmission */
@@ -3563,7 +3565,9 @@
 			return;
 		}
 	} else {
-		skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation);
+		skb = alloc_skb_fclone(MAX_TCP_HEADER,
+				       sk_gfp_mask(sk, GFP_ATOMIC |
+						       __GFP_NOWARN));
 		if (unlikely(!skb))
 			return;
 
@@ -3711,11 +3715,11 @@
 #ifdef CONFIG_SYN_COOKIES
 	if (unlikely(synack_type == TCP_SYNACK_COOKIE && ireq->tstamp_ok))
 		skb_set_delivery_time(skb, cookie_init_timestamp(req, now),
-				      true);
+				      SKB_CLOCK_MONOTONIC);
 	else
 #endif
 	{
-		skb_set_delivery_time(skb, now, true);
+		skb_set_delivery_time(skb, now, SKB_CLOCK_MONOTONIC);
 		if (!tcp_rsk(req)->snt_synack) /* Timestamp first SYNACK */
 			tcp_rsk(req)->snt_synack = tcp_skb_timestamp_us(skb);
 	}
@@ -3802,7 +3806,7 @@
 	bpf_skops_write_hdr_opt((struct sock *)sk, skb, req, syn_skb,
 				synack_type, &opts);
 
-	skb_set_delivery_time(skb, now, true);
+	skb_set_delivery_time(skb, now, SKB_CLOCK_MONOTONIC);
 	tcp_add_tx_delay(skb, tp);
 
 	return skb;
@@ -3855,7 +3859,7 @@
 	tcp_ca_dst_init(sk, dst);
 
 	if (!tp->window_clamp)
-		tp->window_clamp = dst_metric(dst, RTAX_WINDOW);
+		WRITE_ONCE(tp->window_clamp, dst_metric(dst, RTAX_WINDOW));
 	tp->advmss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
 
 	tcp_initialize_rcv_mss(sk);
@@ -3863,7 +3867,7 @@
 	/* limit the window selection if the user enforce a smaller rx buffer */
 	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
 	    (tp->window_clamp > tcp_full_space(sk) || tp->window_clamp == 0))
-		tp->window_clamp = tcp_full_space(sk);
+		WRITE_ONCE(tp->window_clamp, tcp_full_space(sk));
 
 	rcv_wnd = tcp_rwnd_init_bpf(sk);
 	if (rcv_wnd == 0)
@@ -3986,7 +3990,7 @@
 
 	err = tcp_transmit_skb(sk, syn_data, 1, sk->sk_allocation);
 
-	skb_set_delivery_time(syn, syn_data->skb_mstamp_ns, true);
+	skb_set_delivery_time(syn, syn_data->skb_mstamp_ns, SKB_CLOCK_MONOTONIC);
 
 	/* Now full SYN+DATA was cloned and sent (or not),
 	 * remove the SYN from the original skb (syn_data)
--- linux-qcom-6.8.0.orig/net/ipv4/tcp_timer.c
+++ linux-qcom-6.8.0/net/ipv4/tcp_timer.c
@@ -73,11 +73,7 @@
 
 static void tcp_write_err(struct sock *sk)
 {
-	WRITE_ONCE(sk->sk_err, READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT);
-	sk_error_report(sk);
-
-	tcp_write_queue_purge(sk);
-	tcp_done(sk);
+	tcp_done_with_error(sk, READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT);
 	__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT);
 }
 
@@ -481,11 +477,26 @@
 				     const struct sk_buff *skb,
 				     u32 rtx_delta)
 {
+	const struct inet_connection_sock *icsk = inet_csk(sk);
+	u32 user_timeout = READ_ONCE(icsk->icsk_user_timeout);
 	const struct tcp_sock *tp = tcp_sk(sk);
-	const int timeout = TCP_RTO_MAX * 2;
-	u32 rcv_delta;
+	int timeout = TCP_RTO_MAX * 2;
+	s32 rcv_delta;
 
-	rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp;
+	if (user_timeout) {
+		/* If user application specified a TCP_USER_TIMEOUT,
+		 * it does not want win 0 packets to 'reset the timer'
+		 * while retransmits are not making progress.
+		 */
+		if (rtx_delta > user_timeout)
+			return true;
+		timeout = min_t(u32, timeout, msecs_to_jiffies(user_timeout));
+	}
+	/* Note: timer interrupt might have been delayed by at least one jiffy,
+	 * and tp->rcv_tstamp might very well have been written recently.
+	 * rcv_delta can thus be negative.
+	 */
+	rcv_delta = icsk->icsk_timeout - tp->rcv_tstamp;
 	if (rcv_delta <= timeout)
 		return false;
 
@@ -530,8 +541,6 @@
 	if (WARN_ON_ONCE(!skb))
 		return;
 
-	tp->tlp_high_seq = 0;
-
 	if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) &&
 	    !((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))) {
 		/* Receiver dastardly shrinks window. Our retransmits
--- linux-qcom-6.8.0.orig/net/ipv4/udp.c
+++ linux-qcom-6.8.0/net/ipv4/udp.c
@@ -326,6 +326,8 @@
 			goto fail_unlock;
 		}
 
+		sock_set_flag(sk, SOCK_RCU_FREE);
+
 		sk_add_node_rcu(sk, &hslot->head);
 		hslot->count++;
 		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
@@ -342,7 +344,7 @@
 		hslot2->count++;
 		spin_unlock(&hslot2->lock);
 	}
-	sock_set_flag(sk, SOCK_RCU_FREE);
+
 	error = 0;
 fail_unlock:
 	spin_unlock_bh(&hslot->lock);
@@ -429,15 +431,21 @@
 {
 	struct sock *sk, *result;
 	int score, badness;
+	bool need_rescore;
 
 	result = NULL;
 	badness = 0;
 	udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
-		score = compute_score(sk, net, saddr, sport,
-				      daddr, hnum, dif, sdif);
+		need_rescore = false;
+rescore:
+		score = compute_score(need_rescore ? result : sk, net, saddr,
+				      sport, daddr, hnum, dif, sdif);
 		if (score > badness) {
 			badness = score;
 
+			if (need_rescore)
+				continue;
+
 			if (sk->sk_state == TCP_ESTABLISHED) {
 				result = sk;
 				continue;
@@ -458,9 +466,14 @@
 			if (IS_ERR(result))
 				continue;
 
-			badness = compute_score(result, net, saddr, sport,
-						daddr, hnum, dif, sdif);
-
+			/* compute_score is too long of a function to be
+			 * inlined, and calling it again here yields
+			 * measureable overhead for some
+			 * workloads. Work around it by jumping
+			 * backwards to rescore 'result'.
+			 */
+			need_rescore = true;
+			goto rescore;
 		}
 	}
 	return result;
@@ -534,7 +547,8 @@
 struct sock *udp4_lib_lookup_skb(const struct sk_buff *skb,
 				 __be16 sport, __be16 dport)
 {
-	const struct iphdr *iph = ip_hdr(skb);
+	const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];
+	const struct iphdr *iph = (struct iphdr *)(skb->data + offset);
 	struct net *net = dev_net(skb->dev);
 	int iif, sdif;
 
@@ -584,6 +598,13 @@
 }
 
 DEFINE_STATIC_KEY_FALSE(udp_encap_needed_key);
+EXPORT_SYMBOL(udp_encap_needed_key);
+
+#if IS_ENABLED(CONFIG_IPV6)
+DEFINE_STATIC_KEY_FALSE(udpv6_encap_needed_key);
+EXPORT_SYMBOL(udpv6_encap_needed_key);
+#endif
+
 void udp_encap_enable(void)
 {
 	static_branch_inc(&udp_encap_needed_key);
@@ -932,8 +953,10 @@
 			skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
 			skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(datalen,
 								 cork->gso_size);
+
+			/* Don't checksum the payload, skb will get segmented */
+			goto csum_partial;
 		}
-		goto csum_partial;
 	}
 
 	if (is_udplite)  				 /*     UDP-Lite      */
@@ -1118,16 +1141,17 @@
 
 	if (msg->msg_controllen) {
 		err = udp_cmsg_send(sk, msg, &ipc.gso_size);
-		if (err > 0)
+		if (err > 0) {
 			err = ip_cmsg_send(sk, msg, &ipc,
 					   sk->sk_family == AF_INET6);
+			connected = 0;
+		}
 		if (unlikely(err < 0)) {
 			kfree(ipc.opt);
 			return err;
 		}
 		if (ipc.opt)
 			free = 1;
-		connected = 0;
 	}
 	if (!ipc.opt) {
 		struct ip_options_rcu *inet_opt;
@@ -1200,7 +1224,7 @@
 	}
 
 	if (connected)
-		rt = (struct rtable *)sk_dst_check(sk, 0);
+		rt = dst_rtable(sk_dst_check(sk, 0));
 
 	if (!rt) {
 		struct net *net = sock_net(sk);
@@ -2207,7 +2231,7 @@
 	struct dst_entry *old;
 
 	if (dst_hold_safe(dst)) {
-		old = xchg((__force struct dst_entry **)&sk->sk_rx_dst, dst);
+		old = unrcu_pointer(xchg(&sk->sk_rx_dst, RCU_INITIALIZER(dst)));
 		dst_release(old);
 		return old != dst;
 	}
@@ -2792,11 +2816,11 @@
 	if (get_user(len, optlen))
 		return -EFAULT;
 
-	len = min_t(unsigned int, len, sizeof(int));
-
 	if (len < 0)
 		return -EINVAL;
 
+	len = min_t(unsigned int, len, sizeof(int));
+
 	switch (optname) {
 	case UDP_CORK:
 		val = udp_test_bit(CORK, sk);
--- linux-qcom-6.8.0.orig/net/ipv4/udp_offload.c
+++ linux-qcom-6.8.0/net/ipv4/udp_offload.c
@@ -278,6 +278,11 @@
 	if (gso_skb->len <= sizeof(*uh) + mss)
 		return ERR_PTR(-EINVAL);
 
+	if (unlikely(skb_checksum_start(gso_skb) !=
+		     skb_transport_header(gso_skb) &&
+		     !(skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)))
+		return ERR_PTR(-EINVAL);
+
 	if (skb_gso_ok(gso_skb, features | NETIF_F_GSO_ROBUST)) {
 		/* Packet is from an untrusted source, reset gso_segs. */
 		skb_shinfo(gso_skb)->gso_segs = DIV_ROUND_UP(gso_skb->len - sizeof(*uh),
@@ -285,8 +290,26 @@
 		return NULL;
 	}
 
-	if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)
-		return __udp_gso_segment_list(gso_skb, features, is_ipv6);
+	if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) {
+		 /* Detect modified geometry and pass those to skb_segment. */
+		if (skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size)
+			return __udp_gso_segment_list(gso_skb, features, is_ipv6);
+
+		 /* Setup csum, as fraglist skips this in udp4_gro_receive. */
+		gso_skb->csum_start = skb_transport_header(gso_skb) - gso_skb->head;
+		gso_skb->csum_offset = offsetof(struct udphdr, check);
+		gso_skb->ip_summed = CHECKSUM_PARTIAL;
+
+		uh = udp_hdr(gso_skb);
+		if (is_ipv6)
+			uh->check = ~udp_v6_check(gso_skb->len,
+						  &ipv6_hdr(gso_skb)->saddr,
+						  &ipv6_hdr(gso_skb)->daddr, 0);
+		else
+			uh->check = ~udp_v4_check(gso_skb->len,
+						  ip_hdr(gso_skb)->saddr,
+						  ip_hdr(gso_skb)->daddr, 0);
+	}
 
 	skb_pull(gso_skb, sizeof(*uh));
 
@@ -449,8 +472,9 @@
 	NAPI_GRO_CB(p)->count++;
 	p->data_len += skb->len;
 
-	/* sk owenrship - if any - completely transferred to the aggregated packet */
+	/* sk ownership - if any - completely transferred to the aggregated packet */
 	skb->destructor = NULL;
+	skb->sk = NULL;
 	p->truesize += skb->truesize;
 	p->len += skb->len;
 
@@ -470,6 +494,7 @@
 	struct sk_buff *p;
 	unsigned int ulen;
 	int ret = 0;
+	int flush;
 
 	/* requires non zero csum, for symmetry with GSO */
 	if (!uh->check) {
@@ -503,13 +528,22 @@
 			return p;
 		}
 
+		flush = NAPI_GRO_CB(p)->flush;
+
+		if (NAPI_GRO_CB(p)->flush_id != 1 ||
+		    NAPI_GRO_CB(p)->count != 1 ||
+		    !NAPI_GRO_CB(p)->is_atomic)
+			flush |= NAPI_GRO_CB(p)->flush_id;
+		else
+			NAPI_GRO_CB(p)->is_atomic = false;
+
 		/* Terminate the flow on len mismatch or if it grow "too much".
 		 * Under small packet flood GRO count could elsewhere grow a lot
 		 * leading to excessive truesize values.
 		 * On len mismatch merge the first packet shorter than gso_size,
 		 * otherwise complete the GRO packet.
 		 */
-		if (ulen > ntohs(uh2->len)) {
+		if (ulen > ntohs(uh2->len) || flush) {
 			pp = p;
 		} else {
 			if (NAPI_GRO_CB(skb)->is_flist) {
@@ -551,11 +585,19 @@
 	unsigned int off = skb_gro_offset(skb);
 	int flush = 1;
 
-	/* we can do L4 aggregation only if the packet can't land in a tunnel
-	 * otherwise we could corrupt the inner stream
+	/* We can do L4 aggregation only if the packet can't land in a tunnel
+	 * otherwise we could corrupt the inner stream. Detecting such packets
+	 * cannot be foolproof and the aggregation might still happen in some
+	 * cases. Such packets should be caught in udp_unexpected_gso later.
 	 */
 	NAPI_GRO_CB(skb)->is_flist = 0;
 	if (!sk || !udp_sk(sk)->gro_receive) {
+		/* If the packet was locally encapsulated in a UDP tunnel that
+		 * wasn't detected above, do not GRO.
+		 */
+		if (skb->encapsulation)
+			goto out;
+
 		if (skb->dev->features & NETIF_F_GRO_FRAGLIST)
 			NAPI_GRO_CB(skb)->is_flist = sk ? !udp_test_bit(GRO_ENABLED, sk) : 1;
 
@@ -709,7 +751,8 @@
 
 INDIRECT_CALLABLE_SCOPE int udp4_gro_complete(struct sk_buff *skb, int nhoff)
 {
-	const struct iphdr *iph = ip_hdr(skb);
+	const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];
+	const struct iphdr *iph = (struct iphdr *)(skb->data + offset);
 	struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
 
 	/* do fraglist only if there is no outer UDP encap (or we already processed it) */
@@ -719,13 +762,7 @@
 		skb_shinfo(skb)->gso_type |= (SKB_GSO_FRAGLIST|SKB_GSO_UDP_L4);
 		skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
 
-		if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
-			if (skb->csum_level < SKB_MAX_CSUM_LEVEL)
-				skb->csum_level++;
-		} else {
-			skb->ip_summed = CHECKSUM_UNNECESSARY;
-			skb->csum_level = 0;
-		}
+		__skb_incr_checksum_unnecessary(skb);
 
 		return 0;
 	}
--- linux-qcom-6.8.0.orig/net/ipv4/xfrm4_input.c
+++ linux-qcom-6.8.0/net/ipv4/xfrm4_input.c
@@ -63,7 +63,11 @@
 	ip_send_check(iph);
 
 	if (xo && (xo->flags & XFRM_GRO)) {
-		skb_mac_header_rebuild(skb);
+		/* The full l2 header needs to be preserved so that re-injecting the packet at l2
+		 * works correctly in the presence of vlan tags.
+		 */
+		skb_mac_header_rebuild_full(skb, xo->orig_mac_len);
+		skb_reset_network_header(skb);
 		skb_reset_transport_header(skb);
 		return 0;
 	}
--- linux-qcom-6.8.0.orig/net/ipv4/xfrm4_policy.c
+++ linux-qcom-6.8.0/net/ipv4/xfrm4_policy.c
@@ -17,47 +17,43 @@
 #include <net/ip.h>
 #include <net/l3mdev.h>
 
-static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
-					    int tos, int oif,
-					    const xfrm_address_t *saddr,
-					    const xfrm_address_t *daddr,
-					    u32 mark)
+static struct dst_entry *__xfrm4_dst_lookup(struct flowi4 *fl4,
+					    const struct xfrm_dst_lookup_params *params)
 {
 	struct rtable *rt;
 
 	memset(fl4, 0, sizeof(*fl4));
-	fl4->daddr = daddr->a4;
-	fl4->flowi4_tos = tos;
-	fl4->flowi4_l3mdev = l3mdev_master_ifindex_by_index(net, oif);
-	fl4->flowi4_mark = mark;
-	if (saddr)
-		fl4->saddr = saddr->a4;
+	fl4->daddr = params->daddr->a4;
+	fl4->flowi4_tos = params->tos;
+	fl4->flowi4_l3mdev = l3mdev_master_ifindex_by_index(params->net,
+							    params->oif);
+	fl4->flowi4_mark = params->mark;
+	if (params->saddr)
+		fl4->saddr = params->saddr->a4;
+	fl4->flowi4_proto = params->ipproto;
+	fl4->uli = params->uli;
 
-	rt = __ip_route_output_key(net, fl4);
+	rt = __ip_route_output_key(params->net, fl4);
 	if (!IS_ERR(rt))
 		return &rt->dst;
 
 	return ERR_CAST(rt);
 }
 
-static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, int oif,
-					  const xfrm_address_t *saddr,
-					  const xfrm_address_t *daddr,
-					  u32 mark)
+static struct dst_entry *xfrm4_dst_lookup(const struct xfrm_dst_lookup_params *params)
 {
 	struct flowi4 fl4;
 
-	return __xfrm4_dst_lookup(net, &fl4, tos, oif, saddr, daddr, mark);
+	return __xfrm4_dst_lookup(&fl4, params);
 }
 
-static int xfrm4_get_saddr(struct net *net, int oif,
-			   xfrm_address_t *saddr, xfrm_address_t *daddr,
-			   u32 mark)
+static int xfrm4_get_saddr(xfrm_address_t *saddr,
+			   const struct xfrm_dst_lookup_params *params)
 {
 	struct dst_entry *dst;
 	struct flowi4 fl4;
 
-	dst = __xfrm4_dst_lookup(net, &fl4, 0, oif, NULL, daddr, mark);
+	dst = __xfrm4_dst_lookup(&fl4, params);
 	if (IS_ERR(dst))
 		return -EHOSTUNREACH;
 
@@ -69,7 +65,7 @@
 static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
 			  const struct flowi *fl)
 {
-	struct rtable *rt = (struct rtable *)xdst->route;
+	struct rtable *rt = dst_rtable(xdst->route);
 	const struct flowi4 *fl4 = &fl->u.ip4;
 
 	xdst->u.rt.rt_iif = fl4->flowi4_iif;
--- linux-qcom-6.8.0.orig/net/ipv6/Kconfig
+++ linux-qcom-6.8.0/net/ipv6/Kconfig
@@ -323,6 +323,7 @@
 	bool "IPv6: RPL Source Routing Header support"
 	depends on IPV6
 	select LWTUNNEL
+	select DST_CACHE
 	help
 	  Support for RFC6554 RPL Source Routing Header using the lightweight
 	  tunnels mechanism.
--- linux-qcom-6.8.0.orig/net/ipv6/addrconf.c
+++ linux-qcom-6.8.0/net/ipv6/addrconf.c
@@ -1842,7 +1842,8 @@
 							    master, &dst,
 							    scores, hiscore_idx);
 
-			if (scores[hiscore_idx].ifa)
+			if (scores[hiscore_idx].ifa &&
+			    scores[hiscore_idx].scopedist >= 0)
 				goto out;
 		}
 
@@ -2061,9 +2062,10 @@
 		if (ipv6_addr_equal(&ifp->addr, addr)) {
 			if (!dev || ifp->idev->dev == dev ||
 			    !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {
-				result = ifp;
-				in6_ifa_hold(ifp);
-				break;
+				if (in6_ifa_hold_safe(ifp)) {
+					result = ifp;
+					break;
+				}
 			}
 		}
 	}
@@ -2536,6 +2538,24 @@
 	return idev;
 }
 
+static void delete_tempaddrs(struct inet6_dev *idev,
+			     struct inet6_ifaddr *ifp)
+{
+	struct inet6_ifaddr *ift, *tmp;
+
+	write_lock_bh(&idev->lock);
+	list_for_each_entry_safe(ift, tmp, &idev->tempaddr_list, tmp_list) {
+		if (ift->ifpub != ifp)
+			continue;
+
+		in6_ifa_hold(ift);
+		write_unlock_bh(&idev->lock);
+		ipv6_del_addr(ift);
+		write_lock_bh(&idev->lock);
+	}
+	write_unlock_bh(&idev->lock);
+}
+
 static void manage_tempaddrs(struct inet6_dev *idev,
 			     struct inet6_ifaddr *ifp,
 			     __u32 valid_lft, __u32 prefered_lft,
@@ -3078,11 +3098,12 @@
 			in6_ifa_hold(ifp);
 			read_unlock_bh(&idev->lock);
 
-			if (!(ifp->flags & IFA_F_TEMPORARY) &&
-			    (ifa_flags & IFA_F_MANAGETEMPADDR))
-				manage_tempaddrs(idev, ifp, 0, 0, false,
-						 jiffies);
 			ipv6_del_addr(ifp);
+
+			if (!(ifp->flags & IFA_F_TEMPORARY) &&
+			    (ifp->flags & IFA_F_MANAGETEMPADDR))
+				delete_tempaddrs(idev, ifp);
+
 			addrconf_verify_rtnl(net);
 			if (ipv6_addr_is_multicast(pfx)) {
 				ipv6_mc_config(net->ipv6.mc_autojoin_sk,
@@ -4163,7 +4184,7 @@
 			if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
 			    ipv6_addr_equal(&ifp->addr, &addr)) {
 				/* DAD failed for link-local based on MAC */
-				idev->cnf.disable_ipv6 = 1;
+				WRITE_ONCE(idev->cnf.disable_ipv6, 1);
 
 				pr_info("%s: IPv6 being disabled!\n",
 					ifp->idev->dev->name);
@@ -4752,7 +4773,7 @@
 			      ifm->ifa_prefixlen, extack);
 }
 
-static int modify_prefix_route(struct inet6_ifaddr *ifp,
+static int modify_prefix_route(struct net *net, struct inet6_ifaddr *ifp,
 			       unsigned long expires, u32 flags,
 			       bool modify_peer)
 {
@@ -4775,14 +4796,15 @@
 				      ifp->prefix_len,
 				      ifp->rt_priority, ifp->idev->dev,
 				      expires, flags, GFP_KERNEL);
-	} else {
+		return 0;
+	}
+	if (f6i != net->ipv6.fib6_null_entry) {
 		if (!expires)
 			fib6_clean_expires(f6i);
 		else
 			fib6_set_expires(f6i, expires);
-
-		fib6_info_release(f6i);
 	}
+	fib6_info_release(f6i);
 
 	return 0;
 }
@@ -4861,7 +4883,7 @@
 		int rc = -ENOENT;
 
 		if (had_prefixroute)
-			rc = modify_prefix_route(ifp, expires, flags, false);
+			rc = modify_prefix_route(net, ifp, expires, flags, false);
 
 		/* prefix route could have been deleted; if so restore it */
 		if (rc == -ENOENT) {
@@ -4871,7 +4893,7 @@
 		}
 
 		if (had_prefixroute && !ipv6_addr_any(&ifp->peer_addr))
-			rc = modify_prefix_route(ifp, expires, flags, true);
+			rc = modify_prefix_route(net, ifp, expires, flags, true);
 
 		if (rc == -ENOENT && !ipv6_addr_any(&ifp->peer_addr)) {
 			addrconf_prefix_route(&ifp->peer_addr, ifp->prefix_len,
@@ -4893,14 +4915,12 @@
 	}
 
 	if (was_managetempaddr || ifp->flags & IFA_F_MANAGETEMPADDR) {
-		if (was_managetempaddr &&
-		    !(ifp->flags & IFA_F_MANAGETEMPADDR)) {
-			cfg->valid_lft = 0;
-			cfg->preferred_lft = 0;
-		}
-		manage_tempaddrs(ifp->idev, ifp, cfg->valid_lft,
-				 cfg->preferred_lft, !was_managetempaddr,
-				 jiffies);
+		if (was_managetempaddr && !(ifp->flags & IFA_F_MANAGETEMPADDR))
+			delete_tempaddrs(ifp->idev, ifp);
+		else
+			manage_tempaddrs(ifp->idev, ifp, cfg->valid_lft,
+					 cfg->preferred_lft, !was_managetempaddr,
+					 jiffies);
 	}
 
 	addrconf_verify_rtnl(net);
@@ -6014,7 +6034,7 @@
 	    (dev->ifindex != dev_get_iflink(dev) &&
 	     nla_put_u32(skb, IFLA_LINK, dev_get_iflink(dev))) ||
 	    nla_put_u8(skb, IFLA_OPERSTATE,
-		       netif_running(dev) ? dev->operstate : IF_OPER_DOWN))
+		       netif_running(dev) ? READ_ONCE(dev->operstate) : IF_OPER_DOWN))
 		goto nla_put_failure;
 	protoinfo = nla_nest_start_noflag(skb, IFLA_PROTINFO);
 	if (!protoinfo)
@@ -6324,7 +6344,8 @@
 		idev = __in6_dev_get(dev);
 		if (idev) {
 			int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
-			idev->cnf.disable_ipv6 = newf;
+
+			WRITE_ONCE(idev->cnf.disable_ipv6, newf);
 			if (changed)
 				dev_disable_change(idev);
 		}
@@ -6341,7 +6362,7 @@
 
 	net = (struct net *)table->extra2;
 	old = *p;
-	*p = newf;
+	WRITE_ONCE(*p, newf);
 
 	if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
 		rtnl_unlock();
@@ -6349,7 +6370,7 @@
 	}
 
 	if (p == &net->ipv6.devconf_all->disable_ipv6) {
-		net->ipv6.devconf_dflt->disable_ipv6 = newf;
+		WRITE_ONCE(net->ipv6.devconf_dflt->disable_ipv6, newf);
 		addrconf_disable_change(net, newf);
 	} else if ((!newf) ^ (!old))
 		dev_disable_change((struct inet6_dev *)table->extra1);
--- linux-qcom-6.8.0.orig/net/ipv6/af_inet6.c
+++ linux-qcom-6.8.0/net/ipv6/af_inet6.c
@@ -251,31 +251,29 @@
 		 */
 		inet->inet_sport = htons(inet->inet_num);
 		err = sk->sk_prot->hash(sk);
-		if (err) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (err)
+			goto out_sk_release;
 	}
 	if (sk->sk_prot->init) {
 		err = sk->sk_prot->init(sk);
-		if (err) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (err)
+			goto out_sk_release;
 	}
 
 	if (!kern) {
 		err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk);
-		if (err) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (err)
+			goto out_sk_release;
 	}
 out:
 	return err;
 out_rcu_unlock:
 	rcu_read_unlock();
 	goto out;
+out_sk_release:
+	sk_common_release(sk);
+	sock->sk = NULL;
+	goto out;
 }
 
 static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
@@ -508,7 +506,7 @@
 
 	/* Free tx options */
 
-	opt = xchg((__force struct ipv6_txoptions **)&np->opt, NULL);
+	opt = unrcu_pointer(xchg(&np->opt, NULL));
 	if (opt) {
 		atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
 		txopt_put(opt);
--- linux-qcom-6.8.0.orig/net/ipv6/esp6.c
+++ linux-qcom-6.8.0/net/ipv6/esp6.c
@@ -112,7 +112,7 @@
 			     __alignof__(struct scatterlist));
 }
 
-static void esp_ssg_unref(struct xfrm_state *x, void *tmp)
+static void esp_ssg_unref(struct xfrm_state *x, void *tmp, struct sk_buff *skb)
 {
 	struct crypto_aead *aead = x->data;
 	int extralen = 0;
@@ -131,7 +131,7 @@
 	 */
 	if (req->src != req->dst)
 		for (sg = sg_next(req->src); sg; sg = sg_next(sg))
-			put_page(sg_page(sg));
+			skb_page_unref(skb, sg_page(sg), false);
 }
 
 #ifdef CONFIG_INET6_ESPINTCP
@@ -255,8 +255,7 @@
 #else
 static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)
 {
-	kfree_skb(skb);
-
+	WARN_ON(1);
 	return -EOPNOTSUPP;
 }
 #endif
@@ -294,7 +293,7 @@
 	}
 
 	tmp = ESP_SKB_CB(skb)->tmp;
-	esp_ssg_unref(x, tmp);
+	esp_ssg_unref(x, tmp, skb);
 	kfree(tmp);
 
 	esp_output_encap_csum(skb);
@@ -677,7 +676,7 @@
 	}
 
 	if (sg != dsg)
-		esp_ssg_unref(x, tmp);
+		esp_ssg_unref(x, tmp, skb);
 
 	if (!err && x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
 		err = esp_output_tail_tcp(x, skb);
--- linux-qcom-6.8.0.orig/net/ipv6/fib6_rules.c
+++ linux-qcom-6.8.0/net/ipv6/fib6_rules.c
@@ -233,8 +233,12 @@
 	rt = pol_lookup_func(lookup,
 			     net, table, flp6, arg->lookup_data, flags);
 	if (rt != net->ipv6.ip6_null_entry) {
+		struct inet6_dev *idev = ip6_dst_idev(&rt->dst);
+
+		if (!idev)
+			goto again;
 		err = fib6_rule_saddr(net, rule, flags, flp6,
-				      ip6_dst_idev(&rt->dst)->dev);
+				      idev->dev);
 
 		if (err == -EAGAIN)
 			goto again;
@@ -449,6 +453,11 @@
 	       + nla_total_size(16); /* src */
 }
 
+static void fib6_rule_flush_cache(struct fib_rules_ops *ops)
+{
+	rt_genid_bump_ipv6(ops->fro_net);
+}
+
 static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
 	.family			= AF_INET6,
 	.rule_size		= sizeof(struct fib6_rule),
@@ -461,6 +470,7 @@
 	.compare		= fib6_rule_compare,
 	.fill			= fib6_rule_fill,
 	.nlmsg_payload		= fib6_rule_nlmsg_payload,
+	.flush_cache		= fib6_rule_flush_cache,
 	.nlgroup		= RTNLGRP_IPV6_RULE,
 	.owner			= THIS_MODULE,
 	.fro_net		= &init_net,
--- linux-qcom-6.8.0.orig/net/ipv6/icmp.c
+++ linux-qcom-6.8.0/net/ipv6/icmp.c
@@ -175,14 +175,16 @@
 	return false;
 }
 
-static bool icmpv6_global_allow(struct net *net, int type)
+static bool icmpv6_global_allow(struct net *net, int type,
+				bool *apply_ratelimit)
 {
 	if (icmpv6_mask_allow(net, type))
 		return true;
 
-	if (icmp_global_allow())
+	if (icmp_global_allow()) {
+		*apply_ratelimit = true;
 		return true;
-
+	}
 	__ICMP_INC_STATS(net, ICMP_MIB_RATELIMITGLOBAL);
 	return false;
 }
@@ -191,13 +193,13 @@
  * Check the ICMP output rate limit
  */
 static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
-			       struct flowi6 *fl6)
+			       struct flowi6 *fl6, bool apply_ratelimit)
 {
 	struct net *net = sock_net(sk);
 	struct dst_entry *dst;
 	bool res = false;
 
-	if (icmpv6_mask_allow(net, type))
+	if (!apply_ratelimit)
 		return true;
 
 	/*
@@ -212,7 +214,7 @@
 	} else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
 		res = true;
 	} else {
-		struct rt6_info *rt = (struct rt6_info *)dst;
+		struct rt6_info *rt = dst_rt6_info(dst);
 		int tmo = net->ipv6.sysctl.icmpv6_time;
 		struct inet_peer *peer;
 
@@ -228,6 +230,8 @@
 	if (!res)
 		__ICMP6_INC_STATS(net, ip6_dst_idev(dst),
 				  ICMP6_MIB_RATELIMITHOST);
+	else
+		icmp_global_consume();
 	dst_release(dst);
 	return res;
 }
@@ -241,7 +245,7 @@
 
 	dst = ip6_route_output(net, sk, fl6);
 	if (!dst->error) {
-		struct rt6_info *rt = (struct rt6_info *)dst;
+		struct rt6_info *rt = dst_rt6_info(dst);
 		struct in6_addr prefsrc;
 
 		rt6_get_prefsrc(rt, &prefsrc);
@@ -452,6 +456,7 @@
 	struct net *net;
 	struct ipv6_pinfo *np;
 	const struct in6_addr *saddr = NULL;
+	bool apply_ratelimit = false;
 	struct dst_entry *dst;
 	struct icmp6hdr tmp_hdr;
 	struct flowi6 fl6;
@@ -533,11 +538,12 @@
 		return;
 	}
 
-	/* Needed by both icmp_global_allow and icmpv6_xmit_lock */
+	/* Needed by both icmpv6_global_allow and icmpv6_xmit_lock */
 	local_bh_disable();
 
 	/* Check global sysctl_icmp_msgs_per_sec ratelimit */
-	if (!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, type))
+	if (!(skb->dev->flags & IFF_LOOPBACK) &&
+	    !icmpv6_global_allow(net, type, &apply_ratelimit))
 		goto out_bh_enable;
 
 	mip6_addr_swap(skb, parm);
@@ -575,7 +581,7 @@
 
 	np = inet6_sk(sk);
 
-	if (!icmpv6_xrlim_allow(sk, type, &fl6))
+	if (!icmpv6_xrlim_allow(sk, type, &fl6, apply_ratelimit))
 		goto out;
 
 	tmp_hdr.icmp6_type = type;
@@ -616,7 +622,7 @@
 	if (ip6_append_data(sk, icmpv6_getfrag, &msg,
 			    len + sizeof(struct icmp6hdr),
 			    sizeof(struct icmp6hdr),
-			    &ipc6, &fl6, (struct rt6_info *)dst,
+			    &ipc6, &fl6, dst_rt6_info(dst),
 			    MSG_DONTWAIT)) {
 		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 		ip6_flush_pending_frames(sk);
@@ -717,6 +723,7 @@
 	struct ipv6_pinfo *np;
 	const struct in6_addr *saddr = NULL;
 	struct icmp6hdr *icmph = icmp6_hdr(skb);
+	bool apply_ratelimit = false;
 	struct icmp6hdr tmp_hdr;
 	struct flowi6 fl6;
 	struct icmpv6_msg msg;
@@ -781,8 +788,9 @@
 		goto out;
 
 	/* Check the ratelimit */
-	if ((!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, ICMPV6_ECHO_REPLY)) ||
-	    !icmpv6_xrlim_allow(sk, ICMPV6_ECHO_REPLY, &fl6))
+	if ((!(skb->dev->flags & IFF_LOOPBACK) &&
+	    !icmpv6_global_allow(net, ICMPV6_ECHO_REPLY, &apply_ratelimit)) ||
+	    !icmpv6_xrlim_allow(sk, ICMPV6_ECHO_REPLY, &fl6, apply_ratelimit))
 		goto out_dst_release;
 
 	idev = __in6_dev_get(skb->dev);
@@ -803,7 +811,7 @@
 	if (ip6_append_data(sk, icmpv6_getfrag, &msg,
 			    skb->len + sizeof(struct icmp6hdr),
 			    sizeof(struct icmp6hdr), &ipc6, &fl6,
-			    (struct rt6_info *)dst, MSG_DONTWAIT)) {
+			    dst_rt6_info(dst), MSG_DONTWAIT)) {
 		__ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 		ip6_flush_pending_frames(sk);
 	} else {
--- linux-qcom-6.8.0.orig/net/ipv6/ila/ila.h
+++ linux-qcom-6.8.0/net/ipv6/ila/ila.h
@@ -108,6 +108,7 @@
 void ila_lwt_fini(void);
 
 int ila_xlat_init_net(struct net *net);
+void ila_xlat_pre_exit_net(struct net *net);
 void ila_xlat_exit_net(struct net *net);
 
 int ila_xlat_nl_cmd_add_mapping(struct sk_buff *skb, struct genl_info *info);
--- linux-qcom-6.8.0.orig/net/ipv6/ila/ila_lwt.c
+++ linux-qcom-6.8.0/net/ipv6/ila/ila_lwt.c
@@ -38,7 +38,7 @@
 static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
 	struct dst_entry *orig_dst = skb_dst(skb);
-	struct rt6_info *rt = (struct rt6_info *)orig_dst;
+	struct rt6_info *rt = dst_rt6_info(orig_dst);
 	struct ila_lwt *ilwt = ila_lwt_lwtunnel(orig_dst->lwtstate);
 	struct dst_entry *dst;
 	int err = -EINVAL;
@@ -58,7 +58,9 @@
 		return orig_dst->lwtstate->orig_output(net, sk, skb);
 	}
 
+	local_bh_disable();
 	dst = dst_cache_get(&ilwt->dst_cache);
+	local_bh_enable();
 	if (unlikely(!dst)) {
 		struct ipv6hdr *ip6h = ipv6_hdr(skb);
 		struct flowi6 fl6;
@@ -70,7 +72,7 @@
 		memset(&fl6, 0, sizeof(fl6));
 		fl6.flowi6_oif = orig_dst->dev->ifindex;
 		fl6.flowi6_iif = LOOPBACK_IFINDEX;
-		fl6.daddr = *rt6_nexthop((struct rt6_info *)orig_dst,
+		fl6.daddr = *rt6_nexthop(dst_rt6_info(orig_dst),
 					 &ip6h->daddr);
 
 		dst = ip6_route_output(net, NULL, &fl6);
@@ -86,8 +88,11 @@
 			goto drop;
 		}
 
-		if (ilwt->connected)
+		if (ilwt->connected) {
+			local_bh_disable();
 			dst_cache_set_ip6(&ilwt->dst_cache, dst, &fl6.saddr);
+			local_bh_enable();
+		}
 	}
 
 	skb_dst_set(skb, dst);
--- linux-qcom-6.8.0.orig/net/ipv6/ila/ila_main.c
+++ linux-qcom-6.8.0/net/ipv6/ila/ila_main.c
@@ -71,6 +71,11 @@
 	return err;
 }
 
+static __net_exit void ila_pre_exit_net(struct net *net)
+{
+	ila_xlat_pre_exit_net(net);
+}
+
 static __net_exit void ila_exit_net(struct net *net)
 {
 	ila_xlat_exit_net(net);
@@ -78,6 +83,7 @@
 
 static struct pernet_operations ila_net_ops = {
 	.init = ila_init_net,
+	.pre_exit = ila_pre_exit_net,
 	.exit = ila_exit_net,
 	.id   = &ila_net_id,
 	.size = sizeof(struct ila_net),
--- linux-qcom-6.8.0.orig/net/ipv6/ila/ila_xlat.c
+++ linux-qcom-6.8.0/net/ipv6/ila/ila_xlat.c
@@ -200,6 +200,8 @@
 	},
 };
 
+static DEFINE_MUTEX(ila_mutex);
+
 static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp)
 {
 	struct ila_net *ilan = net_generic(net, ila_net_id);
@@ -207,16 +209,20 @@
 	spinlock_t *lock = ila_get_lock(ilan, xp->ip.locator_match);
 	int err = 0, order;
 
-	if (!ilan->xlat.hooks_registered) {
+	if (!READ_ONCE(ilan->xlat.hooks_registered)) {
 		/* We defer registering net hooks in the namespace until the
 		 * first mapping is added.
 		 */
-		err = nf_register_net_hooks(net, ila_nf_hook_ops,
-					    ARRAY_SIZE(ila_nf_hook_ops));
+		mutex_lock(&ila_mutex);
+		if (!ilan->xlat.hooks_registered) {
+			err = nf_register_net_hooks(net, ila_nf_hook_ops,
+						ARRAY_SIZE(ila_nf_hook_ops));
+			if (!err)
+				WRITE_ONCE(ilan->xlat.hooks_registered, true);
+		}
+		mutex_unlock(&ila_mutex);
 		if (err)
 			return err;
-
-		ilan->xlat.hooks_registered = true;
 	}
 
 	ila = kzalloc(sizeof(*ila), GFP_KERNEL);
@@ -619,6 +625,15 @@
 	return 0;
 }
 
+void ila_xlat_pre_exit_net(struct net *net)
+{
+	struct ila_net *ilan = net_generic(net, ila_net_id);
+
+	if (ilan->xlat.hooks_registered)
+		nf_unregister_net_hooks(net, ila_nf_hook_ops,
+					ARRAY_SIZE(ila_nf_hook_ops));
+}
+
 void ila_xlat_exit_net(struct net *net)
 {
 	struct ila_net *ilan = net_generic(net, ila_net_id);
@@ -626,10 +641,6 @@
 	rhashtable_free_and_destroy(&ilan->xlat.rhash_table, ila_free_cb, NULL);
 
 	free_bucket_spinlocks(ilan->xlat.locks);
-
-	if (ilan->xlat.hooks_registered)
-		nf_unregister_net_hooks(net, ila_nf_hook_ops,
-					ARRAY_SIZE(ila_nf_hook_ops));
 }
 
 static int ila_xlat_addr(struct sk_buff *skb, bool sir2ila)
--- linux-qcom-6.8.0.orig/net/ipv6/ioam6_iptunnel.c
+++ linux-qcom-6.8.0/net/ipv6/ioam6_iptunnel.c
@@ -351,9 +351,9 @@
 		goto drop;
 
 	if (!ipv6_addr_equal(&orig_daddr, &ipv6_hdr(skb)->daddr)) {
-		preempt_disable();
+		local_bh_disable();
 		dst = dst_cache_get(&ilwt->cache);
-		preempt_enable();
+		local_bh_enable();
 
 		if (unlikely(!dst)) {
 			struct ipv6hdr *hdr = ipv6_hdr(skb);
@@ -373,9 +373,9 @@
 				goto drop;
 			}
 
-			preempt_disable();
+			local_bh_disable();
 			dst_cache_set_ip6(&ilwt->cache, dst, &fl6.saddr);
-			preempt_enable();
+			local_bh_enable();
 		}
 
 		skb_dst_drop(skb);
--- linux-qcom-6.8.0.orig/net/ipv6/ip6_fib.c
+++ linux-qcom-6.8.0/net/ipv6/ip6_fib.c
@@ -645,19 +645,19 @@
 	if (!w) {
 		/* New dump:
 		 *
-		 * 1. hook callback destructor.
-		 */
-		cb->args[3] = (long)cb->done;
-		cb->done = fib6_dump_done;
-
-		/*
-		 * 2. allocate and initialize walker.
+		 * 1. allocate and initialize walker.
 		 */
 		w = kzalloc(sizeof(*w), GFP_ATOMIC);
 		if (!w)
 			return -ENOMEM;
 		w->func = fib6_dump_node;
 		cb->args[2] = (long)w;
+
+		/* 2. hook callback destructor.
+		 */
+		cb->args[3] = (long)cb->done;
+		cb->done = fib6_dump_done;
+
 	}
 
 	arg.skb = skb;
@@ -961,6 +961,7 @@
 	if (!fib6_nh->rt6i_pcpu)
 		return;
 
+	rcu_read_lock();
 	/* release the reference to this fib entry from
 	 * all of its cached pcpu routes
 	 */
@@ -969,7 +970,9 @@
 		struct rt6_info *pcpu_rt;
 
 		ppcpu_rt = per_cpu_ptr(fib6_nh->rt6i_pcpu, cpu);
-		pcpu_rt = *ppcpu_rt;
+
+		/* Paired with xchg() in rt6_get_pcpu_route() */
+		pcpu_rt = READ_ONCE(*ppcpu_rt);
 
 		/* only dropping the 'from' reference if the cached route
 		 * is using 'match'. The cached pcpu_rt->from only changes
@@ -979,10 +982,11 @@
 		if (pcpu_rt && rcu_access_pointer(pcpu_rt->from) == match) {
 			struct fib6_info *from;
 
-			from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
+			from = unrcu_pointer(xchg(&pcpu_rt->from, NULL));
 			fib6_info_release(from);
 		}
 	}
+	rcu_read_unlock();
 }
 
 struct fib6_nh_pcpu_arg {
@@ -1175,8 +1179,8 @@
 		while (sibling) {
 			if (sibling->fib6_metric == rt->fib6_metric &&
 			    rt6_qualify_for_ecmp(sibling)) {
-				list_add_tail(&rt->fib6_siblings,
-					      &sibling->fib6_siblings);
+				list_add_tail_rcu(&rt->fib6_siblings,
+						  &sibling->fib6_siblings);
 				break;
 			}
 			sibling = rcu_dereference_protected(sibling->fib6_next,
@@ -1237,7 +1241,7 @@
 							 fib6_siblings)
 					sibling->fib6_nsiblings--;
 				rt->fib6_nsiblings = 0;
-				list_del_init(&rt->fib6_siblings);
+				list_del_rcu(&rt->fib6_siblings);
 				rt6_multipath_rebalance(next_sibling);
 				return err;
 			}
@@ -1375,7 +1379,10 @@
 	     struct nl_info *info, struct netlink_ext_ack *extack)
 {
 	struct fib6_table *table = rt->fib6_table;
-	struct fib6_node *fn, *pn = NULL;
+	struct fib6_node *fn;
+#ifdef CONFIG_IPV6_SUBTREES
+	struct fib6_node *pn = NULL;
+#endif
 	int err = -ENOMEM;
 	int allow_create = 1;
 	int replace_required = 0;
@@ -1399,9 +1406,9 @@
 		goto out;
 	}
 
+#ifdef CONFIG_IPV6_SUBTREES
 	pn = fn;
 
-#ifdef CONFIG_IPV6_SUBTREES
 	if (rt->fib6_src.plen) {
 		struct fib6_node *sn;
 
@@ -1947,7 +1954,7 @@
 					 &rt->fib6_siblings, fib6_siblings)
 			sibling->fib6_nsiblings--;
 		rt->fib6_nsiblings = 0;
-		list_del_init(&rt->fib6_siblings);
+		list_del_rcu(&rt->fib6_siblings);
 		rt6_multipath_rebalance(next_sibling);
 	}
 
--- linux-qcom-6.8.0.orig/net/ipv6/ip6_gre.c
+++ linux-qcom-6.8.0/net/ipv6/ip6_gre.c
@@ -528,6 +528,9 @@
 	struct ip6_tnl *tunnel;
 	u8 ver;
 
+	if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr))))
+		return PACKET_REJECT;
+
 	ipv6h = ipv6_hdr(skb);
 	ershdr = (struct erspan_base_hdr *)skb->data;
 	ver = ershdr->ver;
@@ -1511,6 +1514,7 @@
 	ip6gre_tnl_init_features(dev);
 
 	netdev_hold(dev, &tunnel->dev_tracker, GFP_KERNEL);
+	netdev_lockdep_set_classes(dev);
 	return 0;
 
 cleanup_dst_cache_init:
@@ -1903,6 +1907,7 @@
 	ip6erspan_tnl_link_config(tunnel, 1);
 
 	netdev_hold(dev, &tunnel->dev_tracker, GFP_KERNEL);
+	netdev_lockdep_set_classes(dev);
 	return 0;
 
 cleanup_dst_cache_init:
--- linux-qcom-6.8.0.orig/net/ipv6/ip6_input.c
+++ linux-qcom-6.8.0/net/ipv6/ip6_input.c
@@ -168,9 +168,9 @@
 
 	SKB_DR_SET(reason, NOT_SPECIFIED);
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
-	    !idev || unlikely(idev->cnf.disable_ipv6)) {
+	    !idev || unlikely(READ_ONCE(idev->cnf.disable_ipv6))) {
 		__IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
-		if (idev && unlikely(idev->cnf.disable_ipv6))
+		if (idev && unlikely(READ_ONCE(idev->cnf.disable_ipv6)))
 			SKB_DR_SET(reason, IPV6DISABLED);
 		goto drop;
 	}
--- linux-qcom-6.8.0.orig/net/ipv6/ip6_offload.c
+++ linux-qcom-6.8.0/net/ipv6/ip6_offload.c
@@ -237,6 +237,7 @@
 		goto out;
 
 	skb_set_network_header(skb, off);
+	NAPI_GRO_CB(skb)->inner_network_offset = off;
 
 	flush += ntohs(iph->payload_len) != skb->len - hlen;
 
--- linux-qcom-6.8.0.orig/net/ipv6/ip6_output.c
+++ linux-qcom-6.8.0/net/ipv6/ip6_output.c
@@ -70,11 +70,15 @@
 
 	/* Be paranoid, rather than too clever. */
 	if (unlikely(hh_len > skb_headroom(skb)) && dev->header_ops) {
+		/* Make sure idev stays alive */
+		rcu_read_lock();
 		skb = skb_expand_head(skb, hh_len);
 		if (!skb) {
 			IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
+			rcu_read_unlock();
 			return -ENOMEM;
 		}
+		rcu_read_unlock();
 	}
 
 	hdr = ipv6_hdr(skb);
@@ -120,7 +124,7 @@
 	IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 
 	rcu_read_lock();
-	nexthop = rt6_nexthop((struct rt6_info *)dst, daddr);
+	nexthop = rt6_nexthop(dst_rt6_info(dst), daddr);
 	neigh = __ipv6_neigh_lookup_noref(dev, nexthop);
 
 	if (unlikely(IS_ERR_OR_NULL(neigh))) {
@@ -234,7 +238,7 @@
 	skb->protocol = htons(ETH_P_IPV6);
 	skb->dev = dev;
 
-	if (unlikely(idev->cnf.disable_ipv6)) {
+	if (unlikely(!idev || READ_ONCE(idev->cnf.disable_ipv6))) {
 		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
 		kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED);
 		return 0;
@@ -283,11 +287,15 @@
 		head_room += opt->opt_nflen + opt->opt_flen;
 
 	if (unlikely(head_room > skb_headroom(skb))) {
+		/* Make sure idev stays alive */
+		rcu_read_lock();
 		skb = skb_expand_head(skb, head_room);
 		if (!skb) {
 			IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
+			rcu_read_unlock();
 			return -ENOBUFS;
 		}
+		rcu_read_unlock();
 	}
 
 	if (opt) {
@@ -501,6 +509,9 @@
 	u32 mtu;
 
 	idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif));
+	if (unlikely(!idev))
+		idev = __in6_dev_get_safely(skb->dev);
+
 	if (net->ipv6.devconf_all->forwarding == 0)
 		goto error;
 
@@ -599,7 +610,7 @@
 		 *	send a redirect.
 		 */
 
-		rt = (struct rt6_info *) dst;
+		rt = dst_rt6_info(dst);
 		if (rt->rt6i_flags & RTF_GATEWAY)
 			target = &rt->rt6i_gateway;
 		else
@@ -856,10 +867,10 @@
 		 int (*output)(struct net *, struct sock *, struct sk_buff *))
 {
 	struct sk_buff *frag;
-	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
+	struct rt6_info *rt = dst_rt6_info(skb_dst(skb));
 	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
 				inet6_sk(skb->sk) : NULL;
-	bool mono_delivery_time = skb->mono_delivery_time;
+	u8 tstamp_type = skb->tstamp_type;
 	struct ip6_frag_state state;
 	unsigned int mtu, hlen, nexthdr_offset;
 	ktime_t tstamp = skb->tstamp;
@@ -955,7 +966,7 @@
 			if (iter.frag)
 				ip6_fraglist_prepare(skb, &iter);
 
-			skb_set_delivery_time(skb, tstamp, mono_delivery_time);
+			skb_set_delivery_time(skb, tstamp, tstamp_type);
 			err = output(net, sk, skb);
 			if (!err)
 				IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
@@ -1016,7 +1027,7 @@
 		/*
 		 *	Put this fragment into the sending queue.
 		 */
-		skb_set_delivery_time(frag, tstamp, mono_delivery_time);
+		skb_set_delivery_time(frag, tstamp, tstamp_type);
 		err = output(net, sk, frag);
 		if (err)
 			goto fail;
@@ -1063,7 +1074,7 @@
 		return NULL;
 	}
 
-	rt = (struct rt6_info *)dst;
+	rt = dst_rt6_info(dst);
 	/* Yes, checking route validity in not connected
 	 * case is not very simple. Take into account,
 	 * that we do not support routing by source, TOS,
@@ -1118,12 +1129,13 @@
 		struct rt6_info *rt;
 
 		*dst = ip6_route_output(net, sk, fl6);
-		rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
+		rt = (*dst)->error ? NULL : dst_rt6_info(*dst);
 
 		rcu_read_lock();
 		from = rt ? rcu_dereference(rt->from) : NULL;
 		err = ip6_route_get_saddr(net, from, &fl6->daddr,
 					  sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0,
+					  fl6->flowi6_l3mdev,
 					  &fl6->saddr);
 		rcu_read_unlock();
 
@@ -1159,7 +1171,7 @@
 	 * dst entry and replace it instead with the
 	 * dst entry of the nexthop router
 	 */
-	rt = (struct rt6_info *) *dst;
+	rt = dst_rt6_info(*dst);
 	rcu_read_lock();
 	n = __ipv6_neigh_lookup_noref(rt->dst.dev,
 				      rt6_nexthop(rt, &fl6->daddr));
@@ -1423,7 +1435,7 @@
 	int offset = 0;
 	bool zc = false;
 	u32 tskey = 0;
-	struct rt6_info *rt = (struct rt6_info *)cork->dst;
+	struct rt6_info *rt = dst_rt6_info(cork->dst);
 	bool paged, hold_tskey, extra_uref = false;
 	struct ipv6_txoptions *opt = v6_cork->opt;
 	int csummode = CHECKSUM_NONE;
@@ -1877,7 +1889,7 @@
 	struct net *net = sock_net(sk);
 	struct ipv6hdr *hdr;
 	struct ipv6_txoptions *opt = v6_cork->opt;
-	struct rt6_info *rt = (struct rt6_info *)cork->base.dst;
+	struct rt6_info *rt = dst_rt6_info(cork->base.dst);
 	struct flowi6 *fl6 = &cork->fl.u.ip6;
 	unsigned char proto = fl6->flowi6_proto;
 
@@ -1924,7 +1936,10 @@
 
 	skb->priority = READ_ONCE(sk->sk_priority);
 	skb->mark = cork->base.mark;
-	skb->tstamp = cork->base.transmit_time;
+	if (sk_is_tcp(sk))
+		skb_set_delivery_time(skb, cork->base.transmit_time, SKB_CLOCK_MONOTONIC);
+	else
+		skb_set_delivery_type_by_clockid(skb, cork->base.transmit_time, sk->sk_clockid);
 
 	ip6_cork_steal_dst(skb, cork);
 	IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
@@ -1933,7 +1948,7 @@
 		u8 icmp6_type;
 
 		if (sk->sk_socket->type == SOCK_RAW &&
-		   !inet_test_bit(HDRINCL, sk))
+		   !(fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH))
 			icmp6_type = fl6->fl6_icmp_type;
 		else
 			icmp6_type = icmp6_hdr(skb)->icmp6_type;
@@ -1949,9 +1964,10 @@
 int ip6_send_skb(struct sk_buff *skb)
 {
 	struct net *net = sock_net(skb->sk);
-	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
+	struct rt6_info *rt = dst_rt6_info(skb_dst(skb));
 	int err;
 
+	rcu_read_lock();
 	err = ip6_local_out(net, skb->sk, skb);
 	if (err) {
 		if (err > 0)
@@ -1961,6 +1977,7 @@
 				      IPSTATS_MIB_OUTDISCARDS);
 	}
 
+	rcu_read_unlock();
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/net/ipv6/ip6_tunnel.c
+++ linux-qcom-6.8.0/net/ipv6/ip6_tunnel.c
@@ -1508,7 +1508,8 @@
 			tdev = __dev_get_by_index(t->net, p->link);
 
 		if (tdev) {
-			dev->hard_header_len = tdev->hard_header_len + t_hlen;
+			dev->needed_headroom = tdev->hard_header_len +
+				tdev->needed_headroom + t_hlen;
 			mtu = min_t(unsigned int, tdev->mtu, IP6_MAX_MTU);
 
 			mtu = mtu - t_hlen;
@@ -1732,7 +1733,9 @@
 int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
 {
 	struct ip6_tnl *tnl = netdev_priv(dev);
+	int t_hlen;
 
+	t_hlen = tnl->hlen + sizeof(struct ipv6hdr);
 	if (tnl->parms.proto == IPPROTO_IPV6) {
 		if (new_mtu < IPV6_MIN_MTU)
 			return -EINVAL;
@@ -1741,10 +1744,10 @@
 			return -EINVAL;
 	}
 	if (tnl->parms.proto == IPPROTO_IPV6 || tnl->parms.proto == 0) {
-		if (new_mtu > IP6_MAX_MTU - dev->hard_header_len)
+		if (new_mtu > IP6_MAX_MTU - dev->hard_header_len - t_hlen)
 			return -EINVAL;
 	} else {
-		if (new_mtu > IP_MAX_MTU - dev->hard_header_len)
+		if (new_mtu > IP_MAX_MTU - dev->hard_header_len - t_hlen)
 			return -EINVAL;
 	}
 	dev->mtu = new_mtu;
@@ -1890,14 +1893,14 @@
 	t_hlen = t->hlen + sizeof(struct ipv6hdr);
 
 	dev->type = ARPHRD_TUNNEL6;
-	dev->hard_header_len = LL_MAX_HEADER + t_hlen;
 	dev->mtu = ETH_DATA_LEN - t_hlen;
 	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
 		dev->mtu -= 8;
 	dev->min_mtu = ETH_MIN_MTU;
-	dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len;
+	dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len - t_hlen;
 
 	netdev_hold(dev, &t->dev_tracker, GFP_KERNEL);
+	netdev_lockdep_set_classes(dev);
 	return 0;
 
 destroy_dst:
--- linux-qcom-6.8.0.orig/net/ipv6/ip6_vti.c
+++ linux-qcom-6.8.0/net/ipv6/ip6_vti.c
@@ -935,6 +935,7 @@
 	if (!dev->tstats)
 		return -ENOMEM;
 	netdev_hold(dev, &t->dev_tracker, GFP_KERNEL);
+	netdev_lockdep_set_classes(dev);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/net/ipv6/ip6mr.c
+++ linux-qcom-6.8.0/net/ipv6/ip6mr.c
@@ -125,7 +125,7 @@
 	return ret;
 }
 
-static struct mr_table *ip6mr_get_table(struct net *net, u32 id)
+static struct mr_table *__ip6mr_get_table(struct net *net, u32 id)
 {
 	struct mr_table *mrt;
 
@@ -136,6 +136,16 @@
 	return NULL;
 }
 
+static struct mr_table *ip6mr_get_table(struct net *net, u32 id)
+{
+	struct mr_table *mrt;
+
+	rcu_read_lock();
+	mrt = __ip6mr_get_table(net, id);
+	rcu_read_unlock();
+	return mrt;
+}
+
 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
 			    struct mr_table **mrt)
 {
@@ -177,7 +187,7 @@
 
 	arg->table = fib_rule_get_table(rule, arg);
 
-	mrt = ip6mr_get_table(rule->fr_net, arg->table);
+	mrt = __ip6mr_get_table(rule->fr_net, arg->table);
 	if (!mrt)
 		return -EAGAIN;
 	res->mrt = mrt;
@@ -304,6 +314,8 @@
 	return net->ipv6.mrt6;
 }
 
+#define __ip6mr_get_table ip6mr_get_table
+
 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
 			    struct mr_table **mrt)
 {
@@ -382,7 +394,7 @@
 {
 	struct mr_table *mrt;
 
-	mrt = ip6mr_get_table(net, id);
+	mrt = __ip6mr_get_table(net, id);
 	if (mrt)
 		return mrt;
 
@@ -411,13 +423,15 @@
 	struct net *net = seq_file_net(seq);
 	struct mr_table *mrt;
 
-	mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
-	if (!mrt)
+	rcu_read_lock();
+	mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT);
+	if (!mrt) {
+		rcu_read_unlock();
 		return ERR_PTR(-ENOENT);
+	}
 
 	iter->mrt = mrt;
 
-	rcu_read_lock();
 	return mr_vif_seq_start(seq, pos);
 }
 
@@ -2276,13 +2290,15 @@
 	int err;
 	struct mr_table *mrt;
 	struct mfc6_cache *cache;
-	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
+	struct rt6_info *rt = dst_rt6_info(skb_dst(skb));
 
-	mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
-	if (!mrt)
+	rcu_read_lock();
+	mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT);
+	if (!mrt) {
+		rcu_read_unlock();
 		return -ENOENT;
+	}
 
-	rcu_read_lock();
 	cache = ip6mr_cache_find(mrt, &rt->rt6i_src.addr, &rt->rt6i_dst.addr);
 	if (!cache && skb->dev) {
 		int vif = ip6mr_find_vif(mrt, skb->dev);
@@ -2563,7 +2579,7 @@
 		grp = nla_get_in6_addr(tb[RTA_DST]);
 	tableid = tb[RTA_TABLE] ? nla_get_u32(tb[RTA_TABLE]) : 0;
 
-	mrt = ip6mr_get_table(net, tableid ?: RT_TABLE_DEFAULT);
+	mrt = __ip6mr_get_table(net, tableid ?: RT_TABLE_DEFAULT);
 	if (!mrt) {
 		NL_SET_ERR_MSG_MOD(extack, "MR table does not exist");
 		return -ENOENT;
@@ -2608,7 +2624,7 @@
 	if (filter.table_id) {
 		struct mr_table *mrt;
 
-		mrt = ip6mr_get_table(sock_net(skb->sk), filter.table_id);
+		mrt = __ip6mr_get_table(sock_net(skb->sk), filter.table_id);
 		if (!mrt) {
 			if (rtnl_msg_family(cb->nlh) != RTNL_FAMILY_IP6MR)
 				return skb->len;
--- linux-qcom-6.8.0.orig/net/ipv6/ipv6_sockglue.c
+++ linux-qcom-6.8.0/net/ipv6/ipv6_sockglue.c
@@ -111,8 +111,7 @@
 			icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
 		}
 	}
-	opt = xchg((__force struct ipv6_txoptions **)&inet6_sk(sk)->opt,
-		   opt);
+	opt = unrcu_pointer(xchg(&inet6_sk(sk)->opt, RCU_INITIALIZER(opt)));
 	sk_dst_reset(sk);
 
 	return opt;
--- linux-qcom-6.8.0.orig/net/ipv6/mcast.c
+++ linux-qcom-6.8.0/net/ipv6/mcast.c
@@ -2719,7 +2719,6 @@
 	/* Should stop work after group drop. or we will
 	 * start work again in mld_ifc_event()
 	 */
-	synchronize_net();
 	mld_query_stop_work(idev);
 	mld_report_stop_work(idev);
 
--- linux-qcom-6.8.0.orig/net/ipv6/ndisc.c
+++ linux-qcom-6.8.0/net/ipv6/ndisc.c
@@ -227,6 +227,7 @@
 		return NULL;
 	memset(ndopts, 0, sizeof(*ndopts));
 	while (opt_len) {
+		bool unknown = false;
 		int l;
 		if (opt_len < sizeof(struct nd_opt_hdr))
 			return NULL;
@@ -262,22 +263,23 @@
 			break;
 #endif
 		default:
-			if (ndisc_is_useropt(dev, nd_opt)) {
-				ndopts->nd_useropts_end = nd_opt;
-				if (!ndopts->nd_useropts)
-					ndopts->nd_useropts = nd_opt;
-			} else {
-				/*
-				 * Unknown options must be silently ignored,
-				 * to accommodate future extension to the
-				 * protocol.
-				 */
-				ND_PRINTK(2, notice,
-					  "%s: ignored unsupported option; type=%d, len=%d\n",
-					  __func__,
-					  nd_opt->nd_opt_type,
-					  nd_opt->nd_opt_len);
-			}
+			unknown = true;
+		}
+		if (ndisc_is_useropt(dev, nd_opt)) {
+			ndopts->nd_useropts_end = nd_opt;
+			if (!ndopts->nd_useropts)
+				ndopts->nd_useropts = nd_opt;
+		} else if (unknown) {
+			/*
+			 * Unknown options must be silently ignored,
+			 * to accommodate future extension to the
+			 * protocol.
+			 */
+			ND_PRINTK(2, notice,
+				  "%s: ignored unsupported option; type=%d, len=%d\n",
+				  __func__,
+				  nd_opt->nd_opt_type,
+				  nd_opt->nd_opt_len);
 		}
 next_opt:
 		opt_len -= l;
@@ -1708,7 +1710,7 @@
 	if (IS_ERR(dst))
 		return;
 
-	rt = (struct rt6_info *) dst;
+	rt = dst_rt6_info(dst);
 
 	if (rt->rt6i_flags & RTF_GATEWAY) {
 		ND_PRINTK(2, warn,
--- linux-qcom-6.8.0.orig/net/ipv6/netfilter.c
+++ linux-qcom-6.8.0/net/ipv6/netfilter.c
@@ -126,7 +126,7 @@
 				  struct sk_buff *))
 {
 	int frag_max_size = BR_INPUT_SKB_CB(skb)->frag_max_size;
-	bool mono_delivery_time = skb->mono_delivery_time;
+	u8 tstamp_type = skb->tstamp_type;
 	ktime_t tstamp = skb->tstamp;
 	struct ip6_frag_state state;
 	u8 *prevhdr, nexthdr = 0;
@@ -192,7 +192,7 @@
 			if (iter.frag)
 				ip6_fraglist_prepare(skb, &iter);
 
-			skb_set_delivery_time(skb, tstamp, mono_delivery_time);
+			skb_set_delivery_time(skb, tstamp, tstamp_type);
 			err = output(net, sk, data, skb);
 			if (err || !iter.frag)
 				break;
@@ -225,7 +225,7 @@
 			goto blackhole;
 		}
 
-		skb_set_delivery_time(skb2, tstamp, mono_delivery_time);
+		skb_set_delivery_time(skb2, tstamp, tstamp_type);
 		err = output(net, sk, data, skb2);
 		if (err)
 			goto blackhole;
--- linux-qcom-6.8.0.orig/net/ipv6/netfilter/ip6_tables.c
+++ linux-qcom-6.8.0/net/ipv6/netfilter/ip6_tables.c
@@ -379,6 +379,17 @@
 	else return verdict;
 }
 
+static bool next_offset_ok(const struct xt_table_info *t, unsigned int newpos)
+{
+	if (newpos > t->size - sizeof(struct ip6t_entry))
+		return false;
+
+	if (newpos % __alignof__(struct ip6t_entry) != 0)
+		return false;
+
+	return true;
+}
+
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
@@ -434,6 +445,8 @@
 
 				/* Move along one */
 				size = e->next_offset;
+				if (!next_offset_ok(newinfo, pos + size))
+					return 0;
 				e = entry0 + pos + size;
 				if (pos + size >= newinfo->size)
 					return 0;
@@ -455,6 +468,10 @@
 					if (newpos >= newinfo->size)
 						return 0;
 				}
+
+				if (!next_offset_ok(newinfo, newpos))
+					return 0;
+
 				e = entry0 + newpos;
 				e->counters.pcnt = pos;
 				pos = newpos;
@@ -1125,6 +1142,8 @@
 	void *loc_cpu_entry;
 	struct ip6t_entry *iter;
 
+	if (len < sizeof(tmp))
+		return -EINVAL;
 	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
 		return -EFAULT;
 
@@ -1133,6 +1152,8 @@
 		return -ENOMEM;
 	if (tmp.num_counters == 0)
 		return -EINVAL;
+	if ((u64)len < (u64)tmp.size + sizeof(tmp))
+		return -EINVAL;
 
 	tmp.name[sizeof(tmp.name)-1] = 0;
 
@@ -1501,6 +1522,8 @@
 	void *loc_cpu_entry;
 	struct ip6t_entry *iter;
 
+	if (len < sizeof(tmp))
+		return -EINVAL;
 	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
 		return -EFAULT;
 
@@ -1509,6 +1532,8 @@
 		return -ENOMEM;
 	if (tmp.num_counters == 0)
 		return -EINVAL;
+	if ((u64)len < (u64)tmp.size + sizeof(tmp))
+		return -EINVAL;
 
 	tmp.name[sizeof(tmp.name)-1] = 0;
 
--- linux-qcom-6.8.0.orig/net/ipv6/netfilter/ip6table_nat.c
+++ linux-qcom-6.8.0/net/ipv6/netfilter/ip6table_nat.c
@@ -147,23 +147,27 @@
 
 static int __init ip6table_nat_init(void)
 {
-	int ret = xt_register_template(&nf_nat_ipv6_table,
-				       ip6table_nat_table_init);
+	int ret;
 
+	/* net->gen->ptr[ip6table_nat_net_id] must be allocated
+	 * before calling ip6t_nat_register_lookups().
+	 */
+	ret = register_pernet_subsys(&ip6table_nat_net_ops);
 	if (ret < 0)
 		return ret;
 
-	ret = register_pernet_subsys(&ip6table_nat_net_ops);
+	ret = xt_register_template(&nf_nat_ipv6_table,
+				   ip6table_nat_table_init);
 	if (ret)
-		xt_unregister_template(&nf_nat_ipv6_table);
+		unregister_pernet_subsys(&ip6table_nat_net_ops);
 
 	return ret;
 }
 
 static void __exit ip6table_nat_exit(void)
 {
-	unregister_pernet_subsys(&ip6table_nat_net_ops);
 	xt_unregister_template(&nf_nat_ipv6_table);
+	unregister_pernet_subsys(&ip6table_nat_net_ops);
 }
 
 module_init(ip6table_nat_init);
--- linux-qcom-6.8.0.orig/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ linux-qcom-6.8.0/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -155,6 +155,10 @@
 	};
 	struct inet_frag_queue *q;
 
+	if (!(ipv6_addr_type(&hdr->daddr) & (IPV6_ADDR_MULTICAST |
+					    IPV6_ADDR_LINKLOCAL)))
+		key.iif = 0;
+
 	q = inet_frag_find(nf_frag->fqdir, &key);
 	if (!q)
 		return NULL;
@@ -264,7 +268,7 @@
 		fq->iif = dev->ifindex;
 
 	fq->q.stamp = skb->tstamp;
-	fq->q.mono_delivery_time = skb->mono_delivery_time;
+	fq->q.tstamp_type = skb->tstamp_type;
 	fq->q.meat += skb->len;
 	fq->ecn |= ecn;
 	if (payload_len > fq->q.max_size)
@@ -294,6 +298,7 @@
 	}
 
 	skb_dst_drop(skb);
+	skb_orphan(skb);
 	return -EINPROGRESS;
 
 insert_error:
@@ -469,7 +474,6 @@
 	hdr = ipv6_hdr(skb);
 	fhdr = (struct frag_hdr *)skb_transport_header(skb);
 
-	skb_orphan(skb);
 	fq = fq_find(net, fhdr->identification, user, hdr,
 		     skb->dev ? skb->dev->ifindex : 0);
 	if (fq == NULL) {
--- linux-qcom-6.8.0.orig/net/ipv6/netfilter/nf_dup_ipv6.c
+++ linux-qcom-6.8.0/net/ipv6/netfilter/nf_dup_ipv6.c
@@ -47,11 +47,12 @@
 void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum,
 		 const struct in6_addr *gw, int oif)
 {
+	local_bh_disable();
 	if (this_cpu_read(nf_skb_duplicated))
-		return;
+		goto out;
 	skb = pskb_copy(skb, GFP_ATOMIC);
 	if (skb == NULL)
-		return;
+		goto out;
 
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 	nf_reset_ct(skb);
@@ -69,6 +70,8 @@
 	} else {
 		kfree_skb(skb);
 	}
+out:
+	local_bh_enable();
 }
 EXPORT_SYMBOL_GPL(nf_dup_ipv6);
 
--- linux-qcom-6.8.0.orig/net/ipv6/netfilter/nf_reject_ipv6.c
+++ linux-qcom-6.8.0/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -223,33 +223,23 @@
 			      const struct tcphdr *oth, unsigned int otcplen)
 {
 	struct tcphdr *tcph;
-	int needs_ack;
 
 	skb_reset_transport_header(nskb);
-	tcph = skb_put(nskb, sizeof(struct tcphdr));
+	tcph = skb_put_zero(nskb, sizeof(struct tcphdr));
 	/* Truncate to length (no data) */
 	tcph->doff = sizeof(struct tcphdr)/4;
 	tcph->source = oth->dest;
 	tcph->dest = oth->source;
 
 	if (oth->ack) {
-		needs_ack = 0;
 		tcph->seq = oth->ack_seq;
-		tcph->ack_seq = 0;
 	} else {
-		needs_ack = 1;
 		tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
 				      otcplen - (oth->doff<<2));
-		tcph->seq = 0;
+		tcph->ack = 1;
 	}
 
-	/* Reset flags */
-	((u_int8_t *)tcph)[13] = 0;
 	tcph->rst = 1;
-	tcph->ack = needs_ack;
-	tcph->window = 0;
-	tcph->urg_ptr = 0;
-	tcph->check = 0;
 
 	/* Adjust TCP checksum */
 	tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr,
@@ -278,13 +268,12 @@
 void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
 		    int hook)
 {
-	struct sk_buff *nskb;
-	struct tcphdr _otcph;
-	const struct tcphdr *otcph;
-	unsigned int otcplen, hh_len;
 	const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
-	struct ipv6hdr *ip6h;
 	struct dst_entry *dst = NULL;
+	const struct tcphdr *otcph;
+	struct sk_buff *nskb;
+	struct tcphdr _otcph;
+	unsigned int otcplen;
 	struct flowi6 fl6;
 
 	if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
@@ -323,9 +312,8 @@
 	if (IS_ERR(dst))
 		return;
 
-	hh_len = (dst->dev->hard_header_len + 15)&~15;
-	nskb = alloc_skb(hh_len + 15 + dst->header_len + sizeof(struct ipv6hdr)
-			 + sizeof(struct tcphdr) + dst->trailer_len,
+	nskb = alloc_skb(LL_MAX_HEADER + sizeof(struct ipv6hdr) +
+			 sizeof(struct tcphdr) + dst->trailer_len,
 			 GFP_ATOMIC);
 
 	if (!nskb) {
@@ -338,9 +326,8 @@
 
 	nskb->mark = fl6.flowi6_mark;
 
-	skb_reserve(nskb, hh_len + dst->header_len);
-	ip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
-				    ip6_dst_hoplimit(dst));
+	skb_reserve(nskb, LL_MAX_HEADER);
+	nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP, ip6_dst_hoplimit(dst));
 	nf_reject_ip6_tcphdr_put(nskb, oldskb, otcph, otcplen);
 
 	nf_ct_attach(nskb, oldskb);
@@ -355,6 +342,7 @@
 	 */
 	if (nf_bridge_info_exists(oldskb)) {
 		struct ethhdr *oeth = eth_hdr(oldskb);
+		struct ipv6hdr *ip6h = ipv6_hdr(nskb);
 		struct net_device *br_indev;
 
 		br_indev = nf_bridge_get_physindev(oldskb, net);
--- linux-qcom-6.8.0.orig/net/ipv6/netfilter/nft_fib_ipv6.c
+++ linux-qcom-6.8.0/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -41,8 +41,6 @@
 	if (ipv6_addr_type(&fl6->daddr) & IPV6_ADDR_LINKLOCAL) {
 		lookup_flags |= RT6_LOOKUP_F_IFACE;
 		fl6->flowi6_oif = get_ifindex(dev ? dev : pkt->skb->dev);
-	} else if (priv->flags & NFTA_FIB_F_IIF) {
-		fl6->flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev);
 	}
 
 	if (ipv6_addr_type(&fl6->saddr) & IPV6_ADDR_UNICAST)
@@ -75,6 +73,8 @@
 	else if (priv->flags & NFTA_FIB_F_OIF)
 		dev = nft_out(pkt);
 
+	fl6.flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev);
+
 	nft_fib6_flowi_init(&fl6, priv, pkt, dev, iph);
 
 	if (dev && nf_ipv6_chk_addr(nft_net(pkt), &fl6.daddr, dev, true))
@@ -165,6 +165,7 @@
 		.flowi6_iif = LOOPBACK_IFINDEX,
 		.flowi6_proto = pkt->tprot,
 		.flowi6_uid = sock_net_uid(nft_net(pkt), NULL),
+		.flowi6_l3mdev = l3mdev_master_ifindex_rcu(nft_in(pkt)),
 	};
 	struct rt6_info *rt;
 	int lookup_flags;
--- linux-qcom-6.8.0.orig/net/ipv6/ping.c
+++ linux-qcom-6.8.0/net/ipv6/ping.c
@@ -154,7 +154,7 @@
 	dst = ip6_sk_dst_lookup_flow(sk, &fl6, daddr, false);
 	if (IS_ERR(dst))
 		return PTR_ERR(dst);
-	rt = (struct rt6_info *) dst;
+	rt = dst_rt6_info(dst);
 
 	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 		fl6.flowi6_oif = READ_ONCE(np->mcast_oif);
--- linux-qcom-6.8.0.orig/net/ipv6/raw.c
+++ linux-qcom-6.8.0/net/ipv6/raw.c
@@ -592,7 +592,7 @@
 	struct ipv6hdr *iph;
 	struct sk_buff *skb;
 	int err;
-	struct rt6_info *rt = (struct rt6_info *)*dstp;
+	struct rt6_info *rt = dst_rt6_info(*dstp);
 	int hlen = LL_RESERVED_SPACE(rt->dst.dev);
 	int tlen = rt->dst.dev->needed_tailroom;
 
@@ -615,7 +615,7 @@
 	skb->protocol = htons(ETH_P_IPV6);
 	skb->priority = READ_ONCE(sk->sk_priority);
 	skb->mark = sockc->mark;
-	skb->tstamp = sockc->transmit_time;
+	skb_set_delivery_type_by_clockid(skb, sockc->transmit_time, sk->sk_clockid);
 
 	skb_put(skb, length);
 	skb_reset_network_header(skb);
@@ -911,7 +911,7 @@
 		ipc6.opt = opt;
 		lock_sock(sk);
 		err = ip6_append_data(sk, raw6_getfrag, &rfv,
-			len, 0, &ipc6, &fl6, (struct rt6_info *)dst,
+			len, 0, &ipc6, &fl6, dst_rt6_info(dst),
 			msg->msg_flags);
 
 		if (err)
--- linux-qcom-6.8.0.orig/net/ipv6/reassembly.c
+++ linux-qcom-6.8.0/net/ipv6/reassembly.c
@@ -198,7 +198,7 @@
 		fq->iif = dev->ifindex;
 
 	fq->q.stamp = skb->tstamp;
-	fq->q.mono_delivery_time = skb->mono_delivery_time;
+	fq->q.tstamp_type = skb->tstamp_type;
 	fq->q.meat += skb->len;
 	fq->ecn |= ecn;
 	add_frag_mem_limit(fq->q.fqdir, skb->truesize);
@@ -369,7 +369,7 @@
 	 * the source of the fragment, with the Pointer field set to zero.
 	 */
 	nexthdr = hdr->nexthdr;
-	if (ipv6frag_thdr_truncated(skb, skb_transport_offset(skb), &nexthdr)) {
+	if (ipv6frag_thdr_truncated(skb, skb_network_offset(skb) + sizeof(struct ipv6hdr), &nexthdr)) {
 		__IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev),
 				IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_INCOMP, 0);
--- linux-qcom-6.8.0.orig/net/ipv6/route.c
+++ linux-qcom-6.8.0/net/ipv6/route.c
@@ -87,7 +87,8 @@
 static unsigned int	 ip6_default_advmss(const struct dst_entry *dst);
 INDIRECT_CALLABLE_SCOPE
 unsigned int		ip6_mtu(const struct dst_entry *dst);
-static struct dst_entry *ip6_negative_advice(struct dst_entry *);
+static void		ip6_negative_advice(struct sock *sk,
+					    struct dst_entry *dst);
 static void		ip6_dst_destroy(struct dst_entry *);
 static void		ip6_dst_ifdown(struct dst_entry *,
 				       struct net_device *dev);
@@ -174,7 +175,7 @@
 			struct net_device *rt_dev = rt->dst.dev;
 			bool handled = false;
 
-			if (rt_idev->dev == dev) {
+			if (rt_idev && rt_idev->dev == dev) {
 				rt->rt6i_idev = in6_dev_get(blackhole_netdev);
 				in6_dev_put(rt_idev);
 				handled = true;
@@ -226,7 +227,7 @@
 					      struct sk_buff *skb,
 					      const void *daddr)
 {
-	const struct rt6_info *rt = container_of(dst, struct rt6_info, dst);
+	const struct rt6_info *rt = dst_rt6_info(dst);
 
 	return ip6_neigh_lookup(rt6_nexthop(rt, &in6addr_any),
 				dst->dev, skb, daddr);
@@ -234,8 +235,8 @@
 
 static void ip6_confirm_neigh(const struct dst_entry *dst, const void *daddr)
 {
+	const struct rt6_info *rt = dst_rt6_info(dst);
 	struct net_device *dev = dst->dev;
-	struct rt6_info *rt = (struct rt6_info *)dst;
 
 	daddr = choose_neigh_daddr(rt6_nexthop(rt, &in6addr_any), NULL, daddr);
 	if (!daddr)
@@ -354,7 +355,7 @@
 
 static void ip6_dst_destroy(struct dst_entry *dst)
 {
-	struct rt6_info *rt = (struct rt6_info *)dst;
+	struct rt6_info *rt = dst_rt6_info(dst);
 	struct fib6_info *from;
 	struct inet6_dev *idev;
 
@@ -367,14 +368,15 @@
 		in6_dev_put(idev);
 	}
 
-	from = xchg((__force struct fib6_info **)&rt->from, NULL);
+	from = unrcu_pointer(xchg(&rt->from, NULL));
 	fib6_info_release(from);
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
 {
-	struct rt6_info *rt = (struct rt6_info *)dst;
+	struct rt6_info *rt = dst_rt6_info(dst);
 	struct inet6_dev *idev = rt->rt6i_idev;
+	struct fib6_info *from;
 
 	if (idev && idev->dev != blackhole_netdev) {
 		struct inet6_dev *blackhole_idev = in6_dev_get(blackhole_netdev);
@@ -384,6 +386,8 @@
 			in6_dev_put(idev);
 		}
 	}
+	from = unrcu_pointer(xchg(&rt->from, NULL));
+	fib6_info_release(from);
 }
 
 static bool __rt6_check_expired(const struct rt6_info *rt)
@@ -414,8 +418,8 @@
 		      struct flowi6 *fl6, int oif, bool have_oif_match,
 		      const struct sk_buff *skb, int strict)
 {
-	struct fib6_info *sibling, *next_sibling;
 	struct fib6_info *match = res->f6i;
+	struct fib6_info *sibling;
 
 	if (!match->nh && (!match->fib6_nsiblings || have_oif_match))
 		goto out;
@@ -441,8 +445,8 @@
 	if (fl6->mp_hash <= atomic_read(&match->fib6_nh->fib_nh_upper_bound))
 		goto out;
 
-	list_for_each_entry_safe(sibling, next_sibling, &match->fib6_siblings,
-				 fib6_siblings) {
+	list_for_each_entry_rcu(sibling, &match->fib6_siblings,
+				fib6_siblings) {
 		const struct fib6_nh *nh = sibling->fib6_nh;
 		int nh_upper_bound;
 
@@ -637,6 +641,8 @@
 	rcu_read_lock();
 	last_probe = READ_ONCE(fib6_nh->last_probe);
 	idev = __in6_dev_get(dev);
+	if (!idev)
+		goto out;
 	neigh = __ipv6_neigh_lookup_noref(dev, nh_gw);
 	if (neigh) {
 		if (READ_ONCE(neigh->nud_state) & NUD_VALID)
@@ -1278,7 +1284,7 @@
 
 	dst = fib6_rule_lookup(net, &fl6, skb, flags, ip6_pol_route_lookup);
 	if (dst->error == 0)
-		return (struct rt6_info *) dst;
+		return dst_rt6_info(dst);
 
 	dst_release(dst);
 
@@ -1398,6 +1404,7 @@
 		struct rt6_info *prev, **p;
 
 		p = this_cpu_ptr(res->nh->rt6i_pcpu);
+		/* Paired with READ_ONCE() in __fib6_drop_pcpu_from() */
 		prev = xchg(p, NULL);
 		if (prev) {
 			dst_dev_put(&prev->dst);
@@ -1426,7 +1433,7 @@
 	if (res->f6i->fib6_destroying) {
 		struct fib6_info *from;
 
-		from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
+		from = unrcu_pointer(xchg(&pcpu_rt->from, NULL));
 		fib6_info_release(from);
 	}
 
@@ -1443,7 +1450,6 @@
 static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
 				 struct rt6_exception *rt6_ex)
 {
-	struct fib6_info *from;
 	struct net *net;
 
 	if (!bucket || !rt6_ex)
@@ -1455,8 +1461,6 @@
 	/* purge completely the exception to allow releasing the held resources:
 	 * some [sk] cache may keep the dst around for unlimited time
 	 */
-	from = xchg((__force struct fib6_info **)&rt6_ex->rt6i->from, NULL);
-	fib6_info_release(from);
 	dst_dev_put(&rt6_ex->rt6i->dst);
 
 	hlist_del_rcu(&rt6_ex->hlist);
@@ -2637,7 +2641,7 @@
 
 	rcu_read_lock();
 	dst = ip6_route_output_flags_noref(net, sk, fl6, flags);
-	rt6 = (struct rt6_info *)dst;
+	rt6 = dst_rt6_info(dst);
 	/* For dst cached in uncached_list, refcnt is already taken. */
 	if (list_empty(&rt6->dst.rt_uncached) && !dst_hold_safe(dst)) {
 		dst = &net->ipv6.ip6_null_entry->dst;
@@ -2651,7 +2655,7 @@
 
 struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
 {
-	struct rt6_info *rt, *ort = (struct rt6_info *) dst_orig;
+	struct rt6_info *rt, *ort = dst_rt6_info(dst_orig);
 	struct net_device *loopback_dev = net->loopback_dev;
 	struct dst_entry *new = NULL;
 
@@ -2734,7 +2738,7 @@
 	struct fib6_info *from;
 	struct rt6_info *rt;
 
-	rt = container_of(dst, struct rt6_info, dst);
+	rt = dst_rt6_info(dst);
 
 	if (rt->sernum)
 		return rt6_is_valid(rt) ? dst : NULL;
@@ -2760,24 +2764,24 @@
 }
 EXPORT_INDIRECT_CALLABLE(ip6_dst_check);
 
-static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
+static void ip6_negative_advice(struct sock *sk,
+				struct dst_entry *dst)
 {
-	struct rt6_info *rt = (struct rt6_info *) dst;
+	struct rt6_info *rt = dst_rt6_info(dst);
 
-	if (rt) {
-		if (rt->rt6i_flags & RTF_CACHE) {
-			rcu_read_lock();
-			if (rt6_check_expired(rt)) {
-				rt6_remove_exception_rt(rt);
-				dst = NULL;
-			}
-			rcu_read_unlock();
-		} else {
-			dst_release(dst);
-			dst = NULL;
+	if (rt->rt6i_flags & RTF_CACHE) {
+		rcu_read_lock();
+		if (rt6_check_expired(rt)) {
+			/* rt/dst can not be destroyed yet,
+			 * because of rcu_read_lock()
+			 */
+			sk_dst_reset(sk);
+			rt6_remove_exception_rt(rt);
 		}
+		rcu_read_unlock();
+		return;
 	}
-	return dst;
+	sk_dst_reset(sk);
 }
 
 static void ip6_link_failure(struct sk_buff *skb)
@@ -2786,7 +2790,7 @@
 
 	icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
 
-	rt = (struct rt6_info *) skb_dst(skb);
+	rt = dst_rt6_info(skb_dst(skb));
 	if (rt) {
 		rcu_read_lock();
 		if (rt->rt6i_flags & RTF_CACHE) {
@@ -2842,7 +2846,7 @@
 				 bool confirm_neigh)
 {
 	const struct in6_addr *daddr, *saddr;
-	struct rt6_info *rt6 = (struct rt6_info *)dst;
+	struct rt6_info *rt6 = dst_rt6_info(dst);
 
 	/* Note: do *NOT* check dst_metric_locked(dst, RTAX_MTU)
 	 * IPv6 pmtu discovery isn't optional, so 'mtu lock' cannot disable it.
@@ -3591,7 +3595,7 @@
 	if (!dev)
 		goto out;
 
-	if (idev->cnf.disable_ipv6) {
+	if (!idev || idev->cnf.disable_ipv6) {
 		NL_SET_ERR_MSG(extack, "IPv6 is disabled on nexthop device");
 		err = -EACCES;
 		goto out;
@@ -3750,7 +3754,7 @@
 	if (!rt)
 		goto out;
 
-	rt->fib6_metrics = ip_fib_metrics_init(net, cfg->fc_mx, cfg->fc_mx_len,
+	rt->fib6_metrics = ip_fib_metrics_init(cfg->fc_mx, cfg->fc_mx_len,
 					       extack);
 	if (IS_ERR(rt->fib6_metrics)) {
 		err = PTR_ERR(rt->fib6_metrics);
@@ -4165,7 +4169,7 @@
 		}
 	}
 
-	rt = (struct rt6_info *) dst;
+	rt = dst_rt6_info(dst);
 	if (rt->rt6i_flags & RTF_REJECT) {
 		net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n");
 		return;
@@ -4434,7 +4438,7 @@
 		.fc_table = l3mdev_fib_table_by_index(net, rtmsg->rtmsg_ifindex) ?
 			 : RT6_TABLE_MAIN,
 		.fc_ifindex = rtmsg->rtmsg_ifindex,
-		.fc_metric = rtmsg->rtmsg_metric ? : IP6_RT_PRIO_USER,
+		.fc_metric = rtmsg->rtmsg_metric,
 		.fc_expires = rtmsg->rtmsg_info,
 		.fc_dst_len = rtmsg->rtmsg_dst_len,
 		.fc_src_len = rtmsg->rtmsg_src_len,
@@ -4464,6 +4468,9 @@
 	rtnl_lock();
 	switch (cmd) {
 	case SIOCADDRT:
+		/* Only do the default setting of fc_metric in route adding */
+		if (cfg.fc_metric == 0)
+			cfg.fc_metric = IP6_RT_PRIO_USER;
 		err = ip6_route_add(&cfg, GFP_KERNEL, NULL);
 		break;
 	case SIOCDELRT:
@@ -5179,14 +5186,18 @@
 	 * nexthop. Since sibling routes are always added at the end of
 	 * the list, find the first sibling of the last route appended
 	 */
+	rcu_read_lock();
+
 	if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->fib6_nsiblings) {
-		rt = list_first_entry(&rt_last->fib6_siblings,
-				      struct fib6_info,
-				      fib6_siblings);
+		rt = list_first_or_null_rcu(&rt_last->fib6_siblings,
+					    struct fib6_info,
+					    fib6_siblings);
 	}
 
 	if (rt)
 		inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags);
+
+	rcu_read_unlock();
 }
 
 static bool ip6_route_mpath_should_notify(const struct fib6_info *rt)
@@ -5531,17 +5542,21 @@
 		nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size,
 					 &nexthop_len);
 	} else {
-		struct fib6_info *sibling, *next_sibling;
 		struct fib6_nh *nh = f6i->fib6_nh;
+		struct fib6_info *sibling;
 
 		nexthop_len = 0;
 		if (f6i->fib6_nsiblings) {
 			rt6_nh_nlmsg_size(nh, &nexthop_len);
 
-			list_for_each_entry_safe(sibling, next_sibling,
-						 &f6i->fib6_siblings, fib6_siblings) {
+			rcu_read_lock();
+
+			list_for_each_entry_rcu(sibling, &f6i->fib6_siblings,
+						fib6_siblings) {
 				rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len);
 			}
+
+			rcu_read_unlock();
 		}
 		nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws);
 	}
@@ -5597,7 +5612,7 @@
 			 int iif, int type, u32 portid, u32 seq,
 			 unsigned int flags)
 {
-	struct rt6_info *rt6 = (struct rt6_info *)dst;
+	struct rt6_info *rt6 = dst_rt6_info(dst);
 	struct rt6key *rt6_dst, *rt6_src;
 	u32 *pmetrics, table, rt6_flags;
 	unsigned char nh_flags = 0;
@@ -5671,7 +5686,7 @@
 				goto nla_put_failure;
 	} else if (dest) {
 		struct in6_addr saddr_buf;
-		if (ip6_route_get_saddr(net, rt, dest, 0, &saddr_buf) == 0 &&
+		if (ip6_route_get_saddr(net, rt, dest, 0, 0, &saddr_buf) == 0 &&
 		    nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
 			goto nla_put_failure;
 	}
@@ -5705,7 +5720,7 @@
 		    lwtunnel_fill_encap(skb, dst->lwtstate, RTA_ENCAP, RTA_ENCAP_TYPE) < 0)
 			goto nla_put_failure;
 	} else if (rt->fib6_nsiblings) {
-		struct fib6_info *sibling, *next_sibling;
+		struct fib6_info *sibling;
 		struct nlattr *mp;
 
 		mp = nla_nest_start_noflag(skb, RTA_MULTIPATH);
@@ -5717,14 +5732,21 @@
 				    0) < 0)
 			goto nla_put_failure;
 
-		list_for_each_entry_safe(sibling, next_sibling,
-					 &rt->fib6_siblings, fib6_siblings) {
+		rcu_read_lock();
+
+		list_for_each_entry_rcu(sibling, &rt->fib6_siblings,
+					fib6_siblings) {
 			if (fib_add_nexthop(skb, &sibling->fib6_nh->nh_common,
 					    sibling->fib6_nh->fib_nh_weight,
-					    AF_INET6, 0) < 0)
+					    AF_INET6, 0) < 0) {
+				rcu_read_unlock();
+
 				goto nla_put_failure;
+			}
 		}
 
+		rcu_read_unlock();
+
 		nla_nest_end(skb, mp);
 	} else if (rt->nh) {
 		if (nla_put_u32(skb, RTA_NH_ID, rt->nh->id))
@@ -6100,7 +6122,7 @@
 	}
 
 
-	rt = container_of(dst, struct rt6_info, dst);
+	rt = dst_rt6_info(dst);
 	if (rt->dst.error) {
 		err = rt->dst.error;
 		ip6_rt_put(rt);
@@ -6161,7 +6183,7 @@
 	err = -ENOBUFS;
 	seq = info->nlh ? info->nlh->nlmsg_seq : 0;
 
-	skb = nlmsg_new(rt6_nlmsg_size(rt), gfp_any());
+	skb = nlmsg_new(rt6_nlmsg_size(rt), GFP_ATOMIC);
 	if (!skb)
 		goto errout;
 
@@ -6174,7 +6196,7 @@
 		goto errout;
 	}
 	rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE,
-		    info->nlh, gfp_any());
+		    info->nlh, GFP_ATOMIC);
 	return;
 errout:
 	if (err < 0)
@@ -6327,12 +6349,12 @@
 	if (!write)
 		return -EINVAL;
 
-	net = (struct net *)ctl->extra1;
-	delay = net->ipv6.sysctl.flush_delay;
 	ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 	if (ret)
 		return ret;
 
+	net = (struct net *)ctl->extra1;
+	delay = net->ipv6.sysctl.flush_delay;
 	fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/net/ipv6/rpl_iptunnel.c
+++ linux-qcom-6.8.0/net/ipv6/rpl_iptunnel.c
@@ -212,9 +212,9 @@
 	if (unlikely(err))
 		goto drop;
 
-	preempt_disable();
+	local_bh_disable();
 	dst = dst_cache_get(&rlwt->cache);
-	preempt_enable();
+	local_bh_enable();
 
 	if (unlikely(!dst)) {
 		struct ipv6hdr *hdr = ipv6_hdr(skb);
@@ -234,9 +234,9 @@
 			goto drop;
 		}
 
-		preempt_disable();
+		local_bh_disable();
 		dst_cache_set_ip6(&rlwt->cache, dst, &fl6.saddr);
-		preempt_enable();
+		local_bh_enable();
 	}
 
 	skb_dst_drop(skb);
@@ -263,34 +263,34 @@
 	rlwt = rpl_lwt_lwtunnel(orig_dst->lwtstate);
 
 	err = rpl_do_srh(skb, rlwt);
-	if (unlikely(err)) {
-		kfree_skb(skb);
-		return err;
-	}
+	if (unlikely(err))
+		goto drop;
 
-	preempt_disable();
+	local_bh_disable();
 	dst = dst_cache_get(&rlwt->cache);
-	preempt_enable();
 
 	if (!dst) {
 		ip6_route_input(skb);
 		dst = skb_dst(skb);
 		if (!dst->error) {
-			preempt_disable();
 			dst_cache_set_ip6(&rlwt->cache, dst,
 					  &ipv6_hdr(skb)->saddr);
-			preempt_enable();
 		}
 	} else {
 		skb_dst_drop(skb);
 		skb_dst_set(skb, dst);
 	}
+	local_bh_enable();
 
 	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
 	if (unlikely(err))
-		return err;
+		goto drop;
 
 	return dst_input(skb);
+
+drop:
+	kfree_skb(skb);
+	return err;
 }
 
 static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,
--- linux-qcom-6.8.0.orig/net/ipv6/seg6.c
+++ linux-qcom-6.8.0/net/ipv6/seg6.c
@@ -551,6 +551,8 @@
 #endif
 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
 out_unregister_genl:
+#endif
+#if IS_ENABLED(CONFIG_IPV6_SEG6_LWTUNNEL) || IS_ENABLED(CONFIG_IPV6_SEG6_HMAC)
 	genl_unregister_family(&seg6_genl_family);
 #endif
 out_unregister_pernet:
@@ -564,8 +566,9 @@
 	seg6_hmac_exit();
 #endif
 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
+	seg6_local_exit();
 	seg6_iptunnel_exit();
 #endif
-	unregister_pernet_subsys(&ip6_segments_ops);
 	genl_unregister_family(&seg6_genl_family);
+	unregister_pernet_subsys(&ip6_segments_ops);
 }
--- linux-qcom-6.8.0.orig/net/ipv6/seg6_hmac.c
+++ linux-qcom-6.8.0/net/ipv6/seg6_hmac.c
@@ -354,6 +354,7 @@
 	struct crypto_shash *tfm;
 	struct shash_desc *shash;
 	int i, alg_count, cpu;
+	int ret = -ENOMEM;
 
 	alg_count = ARRAY_SIZE(hmac_algos);
 
@@ -364,12 +365,14 @@
 		algo = &hmac_algos[i];
 		algo->tfms = alloc_percpu(struct crypto_shash *);
 		if (!algo->tfms)
-			return -ENOMEM;
+			goto error_out;
 
 		for_each_possible_cpu(cpu) {
 			tfm = crypto_alloc_shash(algo->name, 0, 0);
-			if (IS_ERR(tfm))
-				return PTR_ERR(tfm);
+			if (IS_ERR(tfm)) {
+				ret = PTR_ERR(tfm);
+				goto error_out;
+			}
 			p_tfm = per_cpu_ptr(algo->tfms, cpu);
 			*p_tfm = tfm;
 		}
@@ -381,18 +384,22 @@
 
 		algo->shashs = alloc_percpu(struct shash_desc *);
 		if (!algo->shashs)
-			return -ENOMEM;
+			goto error_out;
 
 		for_each_possible_cpu(cpu) {
 			shash = kzalloc_node(shsize, GFP_KERNEL,
 					     cpu_to_node(cpu));
 			if (!shash)
-				return -ENOMEM;
+				goto error_out;
 			*per_cpu_ptr(algo->shashs, cpu) = shash;
 		}
 	}
 
 	return 0;
+
+error_out:
+	seg6_hmac_exit();
+	return ret;
 }
 
 int __init seg6_hmac_init(void)
@@ -410,22 +417,29 @@
 void seg6_hmac_exit(void)
 {
 	struct seg6_hmac_algo *algo = NULL;
+	struct crypto_shash *tfm;
+	struct shash_desc *shash;
 	int i, alg_count, cpu;
 
 	alg_count = ARRAY_SIZE(hmac_algos);
 	for (i = 0; i < alg_count; i++) {
 		algo = &hmac_algos[i];
-		for_each_possible_cpu(cpu) {
-			struct crypto_shash *tfm;
-			struct shash_desc *shash;
 
-			shash = *per_cpu_ptr(algo->shashs, cpu);
-			kfree(shash);
-			tfm = *per_cpu_ptr(algo->tfms, cpu);
-			crypto_free_shash(tfm);
+		if (algo->shashs) {
+			for_each_possible_cpu(cpu) {
+				shash = *per_cpu_ptr(algo->shashs, cpu);
+				kfree(shash);
+			}
+			free_percpu(algo->shashs);
+		}
+
+		if (algo->tfms) {
+			for_each_possible_cpu(cpu) {
+				tfm = *per_cpu_ptr(algo->tfms, cpu);
+				crypto_free_shash(tfm);
+			}
+			free_percpu(algo->tfms);
 		}
-		free_percpu(algo->tfms);
-		free_percpu(algo->shashs);
 	}
 }
 EXPORT_SYMBOL(seg6_hmac_exit);
--- linux-qcom-6.8.0.orig/net/ipv6/seg6_iptunnel.c
+++ linux-qcom-6.8.0/net/ipv6/seg6_iptunnel.c
@@ -459,34 +459,30 @@
 	int err;
 
 	err = seg6_do_srh(skb);
-	if (unlikely(err)) {
-		kfree_skb(skb);
-		return err;
-	}
+	if (unlikely(err))
+		goto drop;
 
 	slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
 
-	preempt_disable();
+	local_bh_disable();
 	dst = dst_cache_get(&slwt->cache);
-	preempt_enable();
 
 	if (!dst) {
 		ip6_route_input(skb);
 		dst = skb_dst(skb);
 		if (!dst->error) {
-			preempt_disable();
 			dst_cache_set_ip6(&slwt->cache, dst,
 					  &ipv6_hdr(skb)->saddr);
-			preempt_enable();
 		}
 	} else {
 		skb_dst_drop(skb);
 		skb_dst_set(skb, dst);
 	}
+	local_bh_enable();
 
 	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
 	if (unlikely(err))
-		return err;
+		goto drop;
 
 	if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled))
 		return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
@@ -494,6 +490,9 @@
 			       skb_dst(skb)->dev, seg6_input_finish);
 
 	return seg6_input_finish(dev_net(skb->dev), NULL, skb);
+drop:
+	kfree_skb(skb);
+	return err;
 }
 
 static int seg6_input_nf(struct sk_buff *skb)
@@ -535,9 +534,9 @@
 
 	slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
 
-	preempt_disable();
+	local_bh_disable();
 	dst = dst_cache_get(&slwt->cache);
-	preempt_enable();
+	local_bh_enable();
 
 	if (unlikely(!dst)) {
 		struct ipv6hdr *hdr = ipv6_hdr(skb);
@@ -557,9 +556,9 @@
 			goto drop;
 		}
 
-		preempt_disable();
+		local_bh_disable();
 		dst_cache_set_ip6(&slwt->cache, dst, &fl6.saddr);
-		preempt_enable();
+		local_bh_enable();
 	}
 
 	skb_dst_drop(skb);
--- linux-qcom-6.8.0.orig/net/ipv6/seg6_local.c
+++ linux-qcom-6.8.0/net/ipv6/seg6_local.c
@@ -941,8 +941,8 @@
 
 	if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled))
 		return NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
-			       dev_net(skb->dev), NULL, skb, NULL,
-			       skb_dst(skb)->dev, input_action_end_dx6_finish);
+			       dev_net(skb->dev), NULL, skb, skb->dev,
+			       NULL, input_action_end_dx6_finish);
 
 	return input_action_end_dx6_finish(dev_net(skb->dev), NULL, skb);
 drop:
@@ -991,8 +991,8 @@
 
 	if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled))
 		return NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,
-			       dev_net(skb->dev), NULL, skb, NULL,
-			       skb_dst(skb)->dev, input_action_end_dx4_finish);
+			       dev_net(skb->dev), NULL, skb, skb->dev,
+			       NULL, input_action_end_dx4_finish);
 
 	return input_action_end_dx4_finish(dev_net(skb->dev), NULL, skb);
 drop:
--- linux-qcom-6.8.0.orig/net/ipv6/sit.c
+++ linux-qcom-6.8.0/net/ipv6/sit.c
@@ -1460,6 +1460,7 @@
 		return err;
 	}
 	netdev_hold(dev, &tunnel->dev_tracker, GFP_KERNEL);
+	netdev_lockdep_set_classes(dev);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/net/ipv6/syncookies.c
+++ linux-qcom-6.8.0/net/ipv6/syncookies.c
@@ -235,7 +235,7 @@
 			goto out_free;
 	}
 
-	req->rsk_window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
+	req->rsk_window_clamp = READ_ONCE(tp->window_clamp) ? :dst_metric(dst, RTAX_WINDOW);
 	/* limit the window selection if the user enforce a smaller rx buffer */
 	full_space = tcp_full_space(sk);
 	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
--- linux-qcom-6.8.0.orig/net/ipv6/tcp_ipv6.c
+++ linux-qcom-6.8.0/net/ipv6/tcp_ipv6.c
@@ -94,11 +94,9 @@
 	struct dst_entry *dst = skb_dst(skb);
 
 	if (dst && dst_hold_safe(dst)) {
-		const struct rt6_info *rt = (const struct rt6_info *)dst;
-
 		rcu_assign_pointer(sk->sk_rx_dst, dst);
 		sk->sk_rx_dst_ifindex = skb->skb_iif;
-		sk->sk_rx_dst_cookie = rt6_get_cookie(rt);
+		sk->sk_rx_dst_cookie = rt6_get_cookie(dst_rt6_info(dst));
 	}
 }
 
@@ -489,14 +487,10 @@
 
 		ipv6_icmp_error(sk, skb, err, th->dest, ntohl(info), (u8 *)th);
 
-		if (!sock_owned_by_user(sk)) {
-			WRITE_ONCE(sk->sk_err, err);
-			sk_error_report(sk);		/* Wake people up to see the error (see connect in sock.c) */
-
-			tcp_done(sk);
-		} else {
+		if (!sock_owned_by_user(sk))
+			tcp_done_with_error(sk, err);
+		else
 			WRITE_ONCE(sk->sk_err_soft, err);
-		}
 		goto out;
 	case TCP_LISTEN:
 		break;
@@ -972,7 +966,7 @@
 			mark = inet_twsk(sk)->tw_mark;
 		else
 			mark = READ_ONCE(sk->sk_mark);
-		skb_set_delivery_time(buff, tcp_transmit_time(sk), true);
+		skb_set_delivery_time(buff, tcp_transmit_time(sk), SKB_CLOCK_MONOTONIC);
 	}
 	if (txhash) {
 		/* autoflowlabel/skb_get_hash_flowi6 rely on buff->hash */
@@ -1168,8 +1162,8 @@
 			if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh))
 				goto out;
 			if (aoh)
-				key.ao_key = tcp_ao_established_key(ao_info,
-						aoh->rnext_keyid, -1);
+				key.ao_key = tcp_ao_established_key(sk, ao_info,
+								    aoh->rnext_keyid, -1);
 		}
 	}
 	if (key.ao_key) {
@@ -1195,9 +1189,9 @@
 	tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 			tcp_tw_tsval(tcptw),
-			tcptw->tw_ts_recent, tw->tw_bound_dev_if, &key,
-			tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel), tw->tw_priority,
-			tw->tw_txhash);
+			READ_ONCE(tcptw->tw_ts_recent), tw->tw_bound_dev_if,
+			&key, tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel),
+			tw->tw_priority, tw->tw_txhash);
 
 #ifdef CONFIG_TCP_AO
 out:
@@ -1439,7 +1433,6 @@
 	 */
 
 	newsk->sk_gso_type = SKB_GSO_TCPV6;
-	ip6_dst_store(newsk, dst, NULL, NULL);
 	inet6_sk_rx_dst_set(newsk, skb);
 
 	inet_sk(newsk)->pinet6 = tcp_inet6_sk(newsk);
@@ -1450,6 +1443,8 @@
 
 	memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 
+	ip6_dst_store(newsk, dst, NULL, NULL);
+
 	newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
 	newnp->saddr = ireq->ir_v6_loc_addr;
 	newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
@@ -1620,7 +1615,7 @@
 	   by tcp. Feel free to propose better solution.
 					       --ANK (980728)
 	 */
-	if (np->rxopt.all)
+	if (np->rxopt.all && sk->sk_state != TCP_LISTEN)
 		opt_skb = skb_clone_and_charge_r(skb, sk);
 
 	reason = SKB_DROP_REASON_NOT_SPECIFIED;
@@ -1659,8 +1654,6 @@
 		if (nsk != sk) {
 			if (tcp_child_process(sk, nsk, skb))
 				goto reset;
-			if (opt_skb)
-				__kfree_skb(opt_skb);
 			return 0;
 		}
 	} else
@@ -2382,8 +2375,14 @@
 
 static int __net_init tcpv6_net_init(struct net *net)
 {
-	return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
-				    SOCK_RAW, IPPROTO_TCP, net);
+	int res;
+
+	res = inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
+				   SOCK_RAW, IPPROTO_TCP, net);
+	if (!res)
+		net->ipv6.tcp_sk->sk_clockid = CLOCK_MONOTONIC;
+
+	return res;
 }
 
 static void __net_exit tcpv6_net_exit(struct net *net)
@@ -2391,15 +2390,9 @@
 	inet_ctl_sock_destroy(net->ipv6.tcp_sk);
 }
 
-static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
-{
-	tcp_twsk_purge(net_exit_list, AF_INET6);
-}
-
 static struct pernet_operations tcpv6_net_ops = {
 	.init	    = tcpv6_net_init,
 	.exit	    = tcpv6_net_exit,
-	.exit_batch = tcpv6_net_exit_batch,
 };
 
 int __init tcpv6_init(void)
--- linux-qcom-6.8.0.orig/net/ipv6/udp.c
+++ linux-qcom-6.8.0/net/ipv6/udp.c
@@ -171,15 +171,21 @@
 {
 	struct sock *sk, *result;
 	int score, badness;
+	bool need_rescore;
 
 	result = NULL;
 	badness = -1;
 	udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
-		score = compute_score(sk, net, saddr, sport,
-				      daddr, hnum, dif, sdif);
+		need_rescore = false;
+rescore:
+		score = compute_score(need_rescore ? result : sk, net, saddr,
+				      sport, daddr, hnum, dif, sdif);
 		if (score > badness) {
 			badness = score;
 
+			if (need_rescore)
+				continue;
+
 			if (sk->sk_state == TCP_ESTABLISHED) {
 				result = sk;
 				continue;
@@ -200,8 +206,14 @@
 			if (IS_ERR(result))
 				continue;
 
-			badness = compute_score(sk, net, saddr, sport,
-						daddr, hnum, dif, sdif);
+			/* compute_score is too long of a function to be
+			 * inlined, and calling it again here yields
+			 * measureable overhead for some
+			 * workloads. Work around it by jumping
+			 * backwards to rescore 'result'.
+			 */
+			need_rescore = true;
+			goto rescore;
 		}
 	}
 	return result;
@@ -275,7 +287,8 @@
 struct sock *udp6_lib_lookup_skb(const struct sk_buff *skb,
 				 __be16 sport, __be16 dport)
 {
-	const struct ipv6hdr *iph = ipv6_hdr(skb);
+	const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];
+	const struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + offset);
 	struct net *net = dev_net(skb->dev);
 	int iif, sdif;
 
@@ -450,7 +463,7 @@
 	goto try_again;
 }
 
-DEFINE_STATIC_KEY_FALSE(udpv6_encap_needed_key);
+DECLARE_STATIC_KEY_FALSE(udpv6_encap_needed_key);
 void udpv6_encap_enable(void)
 {
 	static_branch_inc(&udpv6_encap_needed_key);
@@ -900,11 +913,8 @@
 
 static void udp6_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
 {
-	if (udp_sk_rx_dst_set(sk, dst)) {
-		const struct rt6_info *rt = (const struct rt6_info *)dst;
-
-		sk->sk_rx_dst_cookie = rt6_get_cookie(rt);
-	}
+	if (udp_sk_rx_dst_set(sk, dst))
+		sk->sk_rx_dst_cookie = rt6_get_cookie(dst_rt6_info(dst));
 }
 
 /* wrapper for udp_queue_rcv_skb tacking care of csum conversion and
@@ -1259,8 +1269,10 @@
 			skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
 			skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(datalen,
 								 cork->gso_size);
+
+			/* Don't checksum the payload, skb will get segmented */
+			goto csum_partial;
 		}
-		goto csum_partial;
 	}
 
 	if (is_udplite)
@@ -1476,9 +1488,11 @@
 		ipc6.opt = opt;
 
 		err = udp_cmsg_send(sk, msg, &ipc6.gso_size);
-		if (err > 0)
+		if (err > 0) {
 			err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, fl6,
 						    &ipc6);
+			connected = false;
+		}
 		if (err < 0) {
 			fl6_sock_release(flowlabel);
 			return err;
@@ -1490,7 +1504,6 @@
 		}
 		if (!(opt->opt_nflen|opt->opt_flen))
 			opt = NULL;
-		connected = false;
 	}
 	if (!opt) {
 		opt = txopt_get(np);
@@ -1573,7 +1586,7 @@
 
 		skb = ip6_make_skb(sk, getfrag, msg, ulen,
 				   sizeof(struct udphdr), &ipc6,
-				   (struct rt6_info *)dst,
+				   dst_rt6_info(dst),
 				   msg->msg_flags, &cork);
 		err = PTR_ERR(skb);
 		if (!IS_ERR_OR_NULL(skb))
@@ -1600,7 +1613,7 @@
 		ipc6.dontfrag = inet6_test_bit(DONTFRAG, sk);
 	up->len += ulen;
 	err = ip6_append_data(sk, getfrag, msg, ulen, sizeof(struct udphdr),
-			      &ipc6, fl6, (struct rt6_info *)dst,
+			      &ipc6, fl6, dst_rt6_info(dst),
 			      corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
 	if (err)
 		udp_v6_flush_pending_frames(sk);
--- linux-qcom-6.8.0.orig/net/ipv6/udp_offload.c
+++ linux-qcom-6.8.0/net/ipv6/udp_offload.c
@@ -164,7 +164,8 @@
 
 INDIRECT_CALLABLE_SCOPE int udp6_gro_complete(struct sk_buff *skb, int nhoff)
 {
-	const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+	const u16 offset = NAPI_GRO_CB(skb)->network_offsets[skb->encapsulation];
+	const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + offset);
 	struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
 
 	/* do fraglist only if there is no outer UDP encap (or we already processed it) */
@@ -174,13 +175,7 @@
 		skb_shinfo(skb)->gso_type |= (SKB_GSO_FRAGLIST|SKB_GSO_UDP_L4);
 		skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
 
-		if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
-			if (skb->csum_level < SKB_MAX_CSUM_LEVEL)
-				skb->csum_level++;
-		} else {
-			skb->ip_summed = CHECKSUM_UNNECESSARY;
-			skb->csum_level = 0;
-		}
+		__skb_incr_checksum_unnecessary(skb);
 
 		return 0;
 	}
--- linux-qcom-6.8.0.orig/net/ipv6/xfrm6_input.c
+++ linux-qcom-6.8.0/net/ipv6/xfrm6_input.c
@@ -58,7 +58,11 @@
 	skb_postpush_rcsum(skb, skb_network_header(skb), nhlen);
 
 	if (xo && (xo->flags & XFRM_GRO)) {
-		skb_mac_header_rebuild(skb);
+		/* The full l2 header needs to be preserved so that re-injecting the packet at l2
+		 * works correctly in the presence of vlan tags.
+		 */
+		skb_mac_header_rebuild_full(skb, xo->orig_mac_len);
+		skb_reset_network_header(skb);
 		skb_reset_transport_header(skb);
 		return 0;
 	}
--- linux-qcom-6.8.0.orig/net/ipv6/xfrm6_policy.c
+++ linux-qcom-6.8.0/net/ipv6/xfrm6_policy.c
@@ -23,23 +23,24 @@
 #include <net/ip6_route.h>
 #include <net/l3mdev.h>
 
-static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
-					  const xfrm_address_t *saddr,
-					  const xfrm_address_t *daddr,
-					  u32 mark)
+static struct dst_entry *xfrm6_dst_lookup(const struct xfrm_dst_lookup_params *params)
 {
 	struct flowi6 fl6;
 	struct dst_entry *dst;
 	int err;
 
 	memset(&fl6, 0, sizeof(fl6));
-	fl6.flowi6_l3mdev = l3mdev_master_ifindex_by_index(net, oif);
-	fl6.flowi6_mark = mark;
-	memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
-	if (saddr)
-		memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
+	fl6.flowi6_l3mdev = l3mdev_master_ifindex_by_index(params->net,
+							   params->oif);
+	fl6.flowi6_mark = params->mark;
+	memcpy(&fl6.daddr, params->daddr, sizeof(fl6.daddr));
+	if (params->saddr)
+		memcpy(&fl6.saddr, params->saddr, sizeof(fl6.saddr));
 
-	dst = ip6_route_output(net, NULL, &fl6);
+	fl6.flowi4_proto = params->ipproto;
+	fl6.uli = params->uli;
+
+	dst = ip6_route_output(params->net, NULL, &fl6);
 
 	err = dst->error;
 	if (dst->error) {
@@ -50,19 +51,25 @@
 	return dst;
 }
 
-static int xfrm6_get_saddr(struct net *net, int oif,
-			   xfrm_address_t *saddr, xfrm_address_t *daddr,
-			   u32 mark)
+static int xfrm6_get_saddr(xfrm_address_t *saddr,
+			   const struct xfrm_dst_lookup_params *params)
 {
 	struct dst_entry *dst;
 	struct net_device *dev;
+	struct inet6_dev *idev;
 
-	dst = xfrm6_dst_lookup(net, 0, oif, NULL, daddr, mark);
+	dst = xfrm6_dst_lookup(params);
 	if (IS_ERR(dst))
 		return -EHOSTUNREACH;
 
-	dev = ip6_dst_idev(dst)->dev;
-	ipv6_dev_get_saddr(dev_net(dev), dev, &daddr->in6, 0, &saddr->in6);
+	idev = ip6_dst_idev(dst);
+	if (!idev) {
+		dst_release(dst);
+		return -EHOSTUNREACH;
+	}
+	dev = idev->dev;
+	ipv6_dev_get_saddr(dev_net(dev), dev, &params->daddr->in6, 0,
+			   &saddr->in6);
 	dst_release(dst);
 	return 0;
 }
@@ -70,7 +77,7 @@
 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
 			  const struct flowi *fl)
 {
-	struct rt6_info *rt = (struct rt6_info *)xdst->route;
+	struct rt6_info *rt = dst_rt6_info(xdst->route);
 
 	xdst->u.dst.dev = dev;
 	netdev_hold(dev, &xdst->u.dst.dev_tracker, GFP_ATOMIC);
--- linux-qcom-6.8.0.orig/net/iucv/af_iucv.c
+++ linux-qcom-6.8.0/net/iucv/af_iucv.c
@@ -335,8 +335,8 @@
 	struct iucv_sock *iucv = iucv_sk(sk);
 	struct iucv_path *path = iucv->path;
 
-	if (iucv->path) {
-		iucv->path = NULL;
+	/* Whoever resets the path pointer, must sever and free it. */
+	if (xchg(&iucv->path, NULL)) {
 		if (with_user_data) {
 			low_nmcpy(user_data, iucv->src_name);
 			high_nmcpy(user_data, iucv->dst_name);
@@ -1238,7 +1238,9 @@
 		return -EOPNOTSUPP;
 
 	/* receive/dequeue next skb:
-	 * the function understands MSG_PEEK and, thus, does not dequeue skb */
+	 * the function understands MSG_PEEK and, thus, does not dequeue skb
+	 * only refcount is increased.
+	 */
 	skb = skb_recv_datagram(sk, flags, &err);
 	if (!skb) {
 		if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -1254,9 +1256,8 @@
 
 	cskb = skb;
 	if (skb_copy_datagram_msg(cskb, offset, msg, copied)) {
-		if (!(flags & MSG_PEEK))
-			skb_queue_head(&sk->sk_receive_queue, skb);
-		return -EFAULT;
+		err = -EFAULT;
+		goto err_out;
 	}
 
 	/* SOCK_SEQPACKET: set MSG_TRUNC if recv buf size is too small */
@@ -1273,11 +1274,8 @@
 	err = put_cmsg(msg, SOL_IUCV, SCM_IUCV_TRGCLS,
 		       sizeof(IUCV_SKB_CB(skb)->class),
 		       (void *)&IUCV_SKB_CB(skb)->class);
-	if (err) {
-		if (!(flags & MSG_PEEK))
-			skb_queue_head(&sk->sk_receive_queue, skb);
-		return err;
-	}
+	if (err)
+		goto err_out;
 
 	/* Mark read part of skb as used */
 	if (!(flags & MSG_PEEK)) {
@@ -1333,8 +1331,18 @@
 	/* SOCK_SEQPACKET: return real length if MSG_TRUNC is set */
 	if (sk->sk_type == SOCK_SEQPACKET && (flags & MSG_TRUNC))
 		copied = rlen;
+	if (flags & MSG_PEEK)
+		skb_unref(skb);
 
 	return copied;
+
+err_out:
+	if (!(flags & MSG_PEEK))
+		skb_queue_head(&sk->sk_receive_queue, skb);
+	else
+		skb_unref(skb);
+
+	return err;
 }
 
 static inline __poll_t iucv_accept_poll(struct sock *parent)
--- linux-qcom-6.8.0.orig/net/iucv/iucv.c
+++ linux-qcom-6.8.0/net/iucv/iucv.c
@@ -519,7 +519,7 @@
  */
 static void iucv_setmask_up(void)
 {
-	cpumask_t cpumask;
+	static cpumask_t cpumask;
 	int cpu;
 
 	/* Disable all cpu but the first in cpu_irq_cpumask. */
@@ -627,23 +627,33 @@
 
 static int iucv_cpu_down_prep(unsigned int cpu)
 {
-	cpumask_t cpumask;
+	cpumask_var_t cpumask;
+	int ret = 0;
 
 	if (!iucv_path_table)
 		return 0;
 
-	cpumask_copy(&cpumask, &iucv_buffer_cpumask);
-	cpumask_clear_cpu(cpu, &cpumask);
-	if (cpumask_empty(&cpumask))
+	if (!alloc_cpumask_var(&cpumask, GFP_KERNEL))
+		return -ENOMEM;
+
+	cpumask_copy(cpumask, &iucv_buffer_cpumask);
+	cpumask_clear_cpu(cpu, cpumask);
+	if (cpumask_empty(cpumask)) {
 		/* Can't offline last IUCV enabled cpu. */
-		return -EINVAL;
+		ret = -EINVAL;
+		goto __free_cpumask;
+	}
 
 	iucv_retrieve_cpu(NULL);
 	if (!cpumask_empty(&iucv_irq_cpumask))
-		return 0;
+		goto __free_cpumask;
+
 	smp_call_function_single(cpumask_first(&iucv_buffer_cpumask),
 				 iucv_allow_cpu, NULL, 1);
-	return 0;
+
+__free_cpumask:
+	free_cpumask_var(cpumask);
+	return ret;
 }
 
 /**
@@ -1080,8 +1090,7 @@
 		size = (size < 8) ? size : 8;
 		for (array = buffer; size > 0; array++) {
 			copy = min_t(size_t, size, array->length);
-			memcpy((u8 *)(addr_t) array->address,
-				rmmsg, copy);
+			memcpy(phys_to_virt(array->address), rmmsg, copy);
 			rmmsg += copy;
 			size -= copy;
 		}
--- linux-qcom-6.8.0.orig/net/kcm/kcmsock.c
+++ linux-qcom-6.8.0/net/kcm/kcmsock.c
@@ -754,6 +754,7 @@
 		  !(msg->msg_flags & MSG_MORE) : !!(msg->msg_flags & MSG_EOR);
 	int err = -EPIPE;
 
+	mutex_lock(&kcm->tx_mutex);
 	lock_sock(sk);
 
 	/* Per tcp_sendmsg this should be in poll */
@@ -925,6 +926,7 @@
 	KCM_STATS_ADD(kcm->stats.tx_bytes, copied);
 
 	release_sock(sk);
+	mutex_unlock(&kcm->tx_mutex);
 	return copied;
 
 out_error:
@@ -950,6 +952,7 @@
 		sk->sk_write_space(sk);
 
 	release_sock(sk);
+	mutex_unlock(&kcm->tx_mutex);
 	return err;
 }
 
@@ -1152,10 +1155,11 @@
 	if (get_user(len, optlen))
 		return -EFAULT;
 
-	len = min_t(unsigned int, len, sizeof(int));
 	if (len < 0)
 		return -EINVAL;
 
+	len = min_t(unsigned int, len, sizeof(int));
+
 	switch (optname) {
 	case KCM_RECV_DISABLE:
 		val = kcm->rx_disabled;
@@ -1202,6 +1206,7 @@
 	spin_unlock_bh(&mux->lock);
 
 	INIT_WORK(&kcm->tx_work, kcm_tx_work);
+	mutex_init(&kcm->tx_mutex);
 
 	spin_lock_bh(&mux->rx_lock);
 	kcm_rcv_ready(kcm);
--- linux-qcom-6.8.0.orig/net/l2tp/l2tp_core.c
+++ linux-qcom-6.8.0/net/l2tp/l2tp_core.c
@@ -88,6 +88,11 @@
 /* Default trace flags */
 #define L2TP_DEFAULT_DEBUG_FLAGS	0
 
+#define L2TP_DEPTH_NESTING		2
+#if L2TP_DEPTH_NESTING == SINGLE_DEPTH_NESTING
+#error "L2TP requires its own lockdep subclass"
+#endif
+
 /* Private data stored for received packets in the skb.
  */
 struct l2tp_skb_cb {
@@ -160,7 +165,7 @@
 	trace_free_session(session);
 	if (session->tunnel)
 		l2tp_tunnel_dec_refcount(session->tunnel);
-	kfree(session);
+	kfree_rcu(session, rcu);
 }
 
 struct l2tp_tunnel *l2tp_sk_to_tunnel(struct sock *sk)
@@ -887,22 +892,20 @@
 	return 1;
 }
 
-/* UDP encapsulation receive handler. See net/ipv4/udp.c.
- * Return codes:
- * 0 : success.
- * <0: error
- * >0: skb should be passed up to userspace as UDP.
+/* UDP encapsulation receive and error receive handlers.
+ * See net/ipv4/udp.c for details.
+ *
+ * Note that these functions are called from inside an
+ * RCU-protected region, but without the socket being locked.
+ *
+ * Hence we use rcu_dereference_sk_user_data to access the
+ * tunnel data structure rather the usual l2tp_sk_to_tunnel
+ * accessor function.
  */
 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 {
 	struct l2tp_tunnel *tunnel;
 
-	/* Note that this is called from the encap_rcv hook inside an
-	 * RCU-protected region, but without the socket being locked.
-	 * Hence we use rcu_dereference_sk_user_data to access the
-	 * tunnel data structure rather the usual l2tp_sk_to_tunnel
-	 * accessor function.
-	 */
 	tunnel = rcu_dereference_sk_user_data(sk);
 	if (!tunnel)
 		goto pass_up;
@@ -919,6 +922,29 @@
 }
 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
 
+static void l2tp_udp_encap_err_recv(struct sock *sk, struct sk_buff *skb, int err,
+				    __be16 port, u32 info, u8 *payload)
+{
+	struct l2tp_tunnel *tunnel;
+
+	tunnel = rcu_dereference_sk_user_data(sk);
+	if (!tunnel || tunnel->fd < 0)
+		return;
+
+	sk->sk_err = err;
+	sk_error_report(sk);
+
+	if (ip_hdr(skb)->version == IPVERSION) {
+		if (inet_test_bit(RECVERR, sk))
+			return ip_icmp_error(sk, skb, err, port, info, payload);
+#if IS_ENABLED(CONFIG_IPV6)
+	} else {
+		if (inet6_test_bit(RECVERR6, sk))
+			return ipv6_icmp_error(sk, skb, err, port, info, payload);
+#endif
+	}
+}
+
 /************************************************************************
  * Transmit handling
  ***********************************************************************/
@@ -1041,7 +1067,13 @@
 	IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED | IPSKB_REROUTED);
 	nf_reset_ct(skb);
 
-	bh_lock_sock_nested(sk);
+	/* L2TP uses its own lockdep subclass to avoid lockdep splats caused by
+	 * nested socket calls on the same lockdep socket class. This can
+	 * happen when data from a user socket is routed over l2tp, which uses
+	 * another userspace socket.
+	 */
+	spin_lock_nested(&sk->sk_lock.slock, L2TP_DEPTH_NESTING);
+
 	if (sock_owned_by_user(sk)) {
 		kfree_skb(skb);
 		ret = NET_XMIT_DROP;
@@ -1093,7 +1125,7 @@
 	ret = l2tp_xmit_queue(tunnel, skb, &inet->cork.fl);
 
 out_unlock:
-	bh_unlock_sock(sk);
+	spin_unlock(&sk->sk_lock.slock);
 
 	return ret;
 }
@@ -1182,8 +1214,6 @@
 			hlist_del_init_rcu(&session->global_hlist);
 			spin_unlock_bh(&pn->l2tp_session_hlist_lock);
 		}
-
-		synchronize_rcu();
 	}
 }
 
@@ -1493,6 +1523,7 @@
 			.sk_user_data = tunnel,
 			.encap_type = UDP_ENCAP_L2TPINUDP,
 			.encap_rcv = l2tp_udp_encap_recv,
+			.encap_err_rcv = l2tp_udp_encap_err_recv,
 			.encap_destroy = l2tp_udp_encap_destroy,
 		};
 
--- linux-qcom-6.8.0.orig/net/l2tp/l2tp_core.h
+++ linux-qcom-6.8.0/net/l2tp/l2tp_core.h
@@ -70,6 +70,7 @@
 struct l2tp_session {
 	int			magic;		/* should be L2TP_SESSION_MAGIC */
 	long			dead;
+	struct rcu_head		rcu;
 
 	struct l2tp_tunnel	*tunnel;	/* back pointer to tunnel context */
 	u32			session_id;
--- linux-qcom-6.8.0.orig/net/l2tp/l2tp_eth.c
+++ linux-qcom-6.8.0/net/l2tp/l2tp_eth.c
@@ -127,6 +127,9 @@
 	/* checksums verified by L2TP */
 	skb->ip_summed = CHECKSUM_NONE;
 
+	/* drop outer flow-hash */
+	skb_clear_hash(skb);
+
 	skb_dst_drop(skb);
 	nf_reset_ct(skb);
 
--- linux-qcom-6.8.0.orig/net/l2tp/l2tp_ip.c
+++ linux-qcom-6.8.0/net/l2tp/l2tp_ip.c
@@ -459,7 +459,7 @@
 
 	fl4 = &inet->cork.fl.u.ip4;
 	if (connected)
-		rt = (struct rtable *)__sk_dst_check(sk, 0);
+		rt = dst_rtable(__sk_dst_check(sk, 0));
 
 	rcu_read_lock();
 	if (!rt) {
--- linux-qcom-6.8.0.orig/net/l2tp/l2tp_ip6.c
+++ linux-qcom-6.8.0/net/l2tp/l2tp_ip6.c
@@ -630,7 +630,7 @@
 	ulen = len + (skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0);
 	err = ip6_append_data(sk, ip_generic_getfrag, msg,
 			      ulen, transhdrlen, &ipc6,
-			      &fl6, (struct rt6_info *)dst,
+			      &fl6, dst_rt6_info(dst),
 			      msg->msg_flags);
 	if (err)
 		ip6_flush_pending_frames(sk);
--- linux-qcom-6.8.0.orig/net/l2tp/l2tp_netlink.c
+++ linux-qcom-6.8.0/net/l2tp/l2tp_netlink.c
@@ -115,7 +115,7 @@
 				  NLM_F_ACK, tunnel, cmd);
 
 	if (ret >= 0) {
-		ret = genlmsg_multicast_allns(family, msg, 0, 0, GFP_ATOMIC);
+		ret = genlmsg_multicast_allns(family, msg, 0, 0);
 		/* We don't care if no one is listening */
 		if (ret == -ESRCH)
 			ret = 0;
@@ -143,7 +143,7 @@
 				   NLM_F_ACK, session, cmd);
 
 	if (ret >= 0) {
-		ret = genlmsg_multicast_allns(family, msg, 0, 0, GFP_ATOMIC);
+		ret = genlmsg_multicast_allns(family, msg, 0, 0);
 		/* We don't care if no one is listening */
 		if (ret == -ESRCH)
 			ret = 0;
--- linux-qcom-6.8.0.orig/net/l2tp/l2tp_ppp.c
+++ linux-qcom-6.8.0/net/l2tp/l2tp_ppp.c
@@ -1356,11 +1356,11 @@
 	if (get_user(len, optlen))
 		return -EFAULT;
 
-	len = min_t(unsigned int, len, sizeof(int));
-
 	if (len < 0)
 		return -EINVAL;
 
+	len = min_t(unsigned int, len, sizeof(int));
+
 	err = -ENOTCONN;
 	if (!sk->sk_user_data)
 		goto end;
--- linux-qcom-6.8.0.orig/net/llc/af_llc.c
+++ linux-qcom-6.8.0/net/llc/af_llc.c
@@ -1099,7 +1099,7 @@
 	lock_sock(sk);
 	if (unlikely(level != SOL_LLC || optlen != sizeof(int)))
 		goto out;
-	rc = copy_from_sockptr(&opt, optval, sizeof(opt));
+	rc = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 	if (rc)
 		goto out;
 	rc = -EINVAL;
--- linux-qcom-6.8.0.orig/net/llc/llc_input.c
+++ linux-qcom-6.8.0/net/llc/llc_input.c
@@ -124,8 +124,8 @@
 	if (unlikely(!pskb_may_pull(skb, llc_len)))
 		return 0;
 
-	skb->transport_header += llc_len;
 	skb_pull(skb, llc_len);
+	skb_reset_transport_header(skb);
 	if (skb->protocol == htons(ETH_P_802_2)) {
 		__be16 pdulen;
 		s32 data_size;
--- linux-qcom-6.8.0.orig/net/mac80211/Kconfig
+++ linux-qcom-6.8.0/net/mac80211/Kconfig
@@ -96,7 +96,7 @@
 
 config MAC80211_MESSAGE_TRACING
 	bool "Trace all mac80211 debug messages"
-	depends on MAC80211
+	depends on MAC80211 && TRACING
 	help
 	  Select this option to have mac80211 register the
 	  mac80211_msg trace subsystem with tracepoints to
--- linux-qcom-6.8.0.orig/net/mac80211/agg-tx.c
+++ linux-qcom-6.8.0/net/mac80211/agg-tx.c
@@ -616,7 +616,9 @@
 		return -EINVAL;
 
 	if (!pubsta->deflink.ht_cap.ht_supported &&
-	    sta->sdata->vif.bss_conf.chandef.chan->band != NL80211_BAND_6GHZ)
+	    !pubsta->deflink.vht_cap.vht_supported &&
+	    !pubsta->deflink.he_cap.has_he &&
+	    !pubsta->deflink.eht_cap.has_eht)
 		return -EINVAL;
 
 	if (WARN_ON_ONCE(!local->ops->ampdu_action))
--- linux-qcom-6.8.0.orig/net/mac80211/cfg.c
+++ linux-qcom-6.8.0/net/mac80211/cfg.c
@@ -1063,13 +1063,13 @@
 {
 	int i, offset = 0;
 
+	dst->cnt = src->cnt;
 	for (i = 0; i < src->cnt; i++) {
 		memcpy(pos + offset, src->elem[i].data, src->elem[i].len);
 		dst->elem[i].len = src->elem[i].len;
 		dst->elem[i].data = pos + offset;
 		offset += dst->elem[i].len;
 	}
-	dst->cnt = src->cnt;
 
 	return offset;
 }
@@ -1777,7 +1777,6 @@
 				     struct sta_info *sta, bool new_link,
 				     struct link_station_parameters *params)
 {
-	int ret = 0;
 	struct ieee80211_supported_band *sband;
 	struct ieee80211_sub_if_data *sdata = sta->sdata;
 	u32 link_id = params->link_id < 0 ? 0 : params->link_id;
@@ -1819,6 +1818,8 @@
 	}
 
 	if (params->txpwr_set) {
+		int ret;
+
 		link_sta->pub->txpwr.type = params->txpwr.type;
 		if (params->txpwr.type == NL80211_TX_POWER_LIMITED)
 			link_sta->pub->txpwr.power = params->txpwr.power;
@@ -1860,6 +1861,8 @@
 						    params->eht_capa_len,
 						    link_sta);
 
+	ieee80211_sta_init_nss(link_sta);
+
 	if (params->opmode_notif_used) {
 		/* returned value is only needed for rc update, but the
 		 * rc isn't initialized here yet, so ignore it
@@ -1869,9 +1872,7 @@
 					      sband->band);
 	}
 
-	ieee80211_sta_set_rx_nss(link_sta);
-
-	return ret;
+	return 0;
 }
 
 static int sta_apply_parameters(struct ieee80211_local *local,
@@ -2164,15 +2165,14 @@
 		}
 
 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-		    sta->sdata->u.vlan.sta) {
-			ieee80211_clear_fast_rx(sta);
+		    sta->sdata->u.vlan.sta)
 			RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
-		}
 
 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
 			ieee80211_vif_dec_num_mcast(sta->sdata);
 
 		sta->sdata = vlansdata;
+		ieee80211_check_fast_rx(sta);
 		ieee80211_check_fast_xmit(sta);
 
 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
@@ -2919,8 +2919,9 @@
 	memcpy(sdata->vif.bss_conf.mcast_rate, rate,
 	       sizeof(int) * NUM_NL80211_BANDS);
 
-	ieee80211_link_info_change_notify(sdata, &sdata->deflink,
-					  BSS_CHANGED_MCAST_RATE);
+	if (ieee80211_sdata_running(sdata))
+		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
+						  BSS_CHANGED_MCAST_RATE);
 
 	return 0;
 }
@@ -3080,7 +3081,8 @@
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 
-	if (local->ops->get_txpower)
+	if (local->ops->get_txpower &&
+	    (sdata->flags & IEEE80211_SDATA_IN_DRIVER))
 		return drv_get_txpower(local, sdata, dbm);
 
 	if (!local->use_chanctx)
@@ -4727,12 +4729,12 @@
 	ieee80211_color_change_finalize(sdata);
 }
 
-void ieee80211_color_collision_detection_work(struct work_struct *work)
+void ieee80211_color_collision_detection_work(struct wiphy *wiphy,
+					      struct wiphy_work *work)
 {
-	struct delayed_work *delayed_work = to_delayed_work(work);
 	struct ieee80211_link_data *link =
-		container_of(delayed_work, struct ieee80211_link_data,
-			     color_collision_detect_work);
+		container_of(work, struct ieee80211_link_data,
+			     color_collision_detect_work.work);
 	struct ieee80211_sub_if_data *sdata = link->sdata;
 
 	cfg80211_obss_color_collision_notify(sdata->dev, link->color_bitmap);
@@ -4757,16 +4759,17 @@
 	if (sdata->vif.bss_conf.color_change_active || sdata->vif.bss_conf.csa_active)
 		return;
 
-	if (delayed_work_pending(&link->color_collision_detect_work))
+	if (wiphy_delayed_work_pending(sdata->local->hw.wiphy,
+				       &link->color_collision_detect_work))
 		return;
 
 	link->color_bitmap = color_bitmap;
 	/* queue the color collision detection event every 500 ms in order to
 	 * avoid sending too much netlink messages to userspace.
 	 */
-	ieee80211_queue_delayed_work(&sdata->local->hw,
-				     &link->color_collision_detect_work,
-				     msecs_to_jiffies(500));
+	wiphy_delayed_work_queue(sdata->local->hw.wiphy,
+				 &link->color_collision_detect_work,
+				 msecs_to_jiffies(500));
 }
 EXPORT_SYMBOL_GPL(ieee80211_obss_color_collision_notify);
 
@@ -4843,10 +4846,16 @@
 				    unsigned int link_id)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+	u16 new_links = wdev->valid_links & ~BIT(link_id);
 
 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
 
-	ieee80211_vif_set_links(sdata, wdev->valid_links, 0);
+	/* During the link teardown process, certain functions require the
+	 * link_id to remain in the valid_links bitmap. Therefore, instead
+	 * of removing the link_id from the bitmap, pass a masked value to
+	 * simulate as if link_id does not exist anymore.
+	 */
+	ieee80211_vif_set_links(sdata, new_links, 0);
 }
 
 static int sta_add_link_station(struct ieee80211_local *local,
--- linux-qcom-6.8.0.orig/net/mac80211/he.c
+++ linux-qcom-6.8.0/net/mac80211/he.c
@@ -230,15 +230,21 @@
 
 	if (!he_spr_ie_elem)
 		return;
+
+	he_obss_pd->sr_ctrl = he_spr_ie_elem->he_sr_control;
 	data = he_spr_ie_elem->optional;
 
 	if (he_spr_ie_elem->he_sr_control &
 	    IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
-		data++;
+		he_obss_pd->non_srg_max_offset = *data++;
+
 	if (he_spr_ie_elem->he_sr_control &
 	    IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT) {
-		he_obss_pd->max_offset = *data++;
 		he_obss_pd->min_offset = *data++;
+		he_obss_pd->max_offset = *data++;
+		memcpy(he_obss_pd->bss_color_bitmap, data, 8);
+		data += 8;
+		memcpy(he_obss_pd->partial_bssid_bitmap, data, 8);
 		he_obss_pd->enable = true;
 	}
 }
--- linux-qcom-6.8.0.orig/net/mac80211/ieee80211_i.h
+++ linux-qcom-6.8.0/net/mac80211/ieee80211_i.h
@@ -131,7 +131,7 @@
 };
 
 /**
- * enum ieee80211_corrupt_data_flags - BSS data corruption flags
+ * enum ieee80211_bss_corrupt_data_flags - BSS data corruption flags
  * @IEEE80211_BSS_CORRUPT_BEACON: last beacon frame received was corrupted
  * @IEEE80211_BSS_CORRUPT_PROBE_RESP: last probe response received was corrupted
  *
@@ -144,7 +144,7 @@
 };
 
 /**
- * enum ieee80211_valid_data_flags - BSS valid data flags
+ * enum ieee80211_bss_valid_data_flags - BSS valid data flags
  * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
@@ -1020,7 +1020,7 @@
 	struct cfg80211_chan_def csa_chandef;
 
 	struct wiphy_work color_change_finalize_work;
-	struct delayed_work color_collision_detect_work;
+	struct wiphy_delayed_work color_collision_detect_work;
 	u64 color_bitmap;
 
 	/* context reservation -- protected with wiphy mutex */
@@ -1812,6 +1812,8 @@
 void ieee80211_configure_filter(struct ieee80211_local *local);
 u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
 
+void ieee80211_handle_queued_frames(struct ieee80211_local *local);
+
 u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local *local);
 int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb,
 			     u64 *cookie, gfp_t gfp);
@@ -1955,7 +1957,8 @@
 /* color change handling */
 void ieee80211_color_change_finalize_work(struct wiphy *wiphy,
 					  struct wiphy_work *work);
-void ieee80211_color_collision_detection_work(struct work_struct *work);
+void ieee80211_color_collision_detection_work(struct wiphy *wiphy,
+					      struct wiphy_work *work);
 
 /* interface handling */
 #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
@@ -2023,8 +2026,6 @@
 				  u32 info_flags,
 				  u32 ctrl_flags,
 				  u64 *cookie);
-void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
-			      struct sk_buff_head *skbs);
 struct sk_buff *
 ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
 			      struct sk_buff *skb, u32 info_flags);
@@ -2112,7 +2113,7 @@
 ieee80211_sta_cap_rx_bw(struct link_sta_info *link_sta);
 enum ieee80211_sta_rx_bandwidth
 ieee80211_sta_cur_vht_bw(struct link_sta_info *link_sta);
-void ieee80211_sta_set_rx_nss(struct link_sta_info *link_sta);
+void ieee80211_sta_init_nss(struct link_sta_info *link_sta);
 enum ieee80211_sta_rx_bandwidth
 ieee80211_chan_width_to_rx_bw(enum nl80211_chan_width width);
 enum nl80211_chan_width
--- linux-qcom-6.8.0.orig/net/mac80211/iface.c
+++ linux-qcom-6.8.0/net/mac80211/iface.c
@@ -462,6 +462,7 @@
 {
 	struct ieee80211_local *local = sdata->local;
 	unsigned long flags;
+	struct sk_buff_head freeq;
 	struct sk_buff *skb, *tmp;
 	u32 hw_reconf_flags = 0;
 	int i, flushed;
@@ -641,18 +642,32 @@
 		skb_queue_purge(&sdata->status_queue);
 	}
 
+	/*
+	 * Since ieee80211_free_txskb() may issue __dev_queue_xmit()
+	 * which should be called with interrupts enabled, reclamation
+	 * is done in two phases:
+	 */
+	__skb_queue_head_init(&freeq);
+
+	/* unlink from local queues... */
 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 	for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
 		skb_queue_walk_safe(&local->pending[i], skb, tmp) {
 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 			if (info->control.vif == &sdata->vif) {
 				__skb_unlink(skb, &local->pending[i]);
-				ieee80211_free_txskb(&local->hw, skb);
+				__skb_queue_tail(&freeq, skb);
 			}
 		}
 	}
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
+	/* ... and perform actual reclamation with interrupts enabled. */
+	skb_queue_walk_safe(&freeq, skb, tmp) {
+		__skb_unlink(skb, &freeq);
+		ieee80211_free_txskb(&local->hw, skb);
+	}
+
 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 		ieee80211_txq_remove_vlan(local, sdata);
 
@@ -686,6 +701,7 @@
 			ieee80211_del_virtual_monitor(local);
 
 		ieee80211_recalc_idle(local);
+		ieee80211_recalc_offload(local);
 
 		if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))
 			break;
--- linux-qcom-6.8.0.orig/net/mac80211/key.c
+++ linux-qcom-6.8.0/net/mac80211/key.c
@@ -983,6 +983,26 @@
 	}
 }
 
+static void
+ieee80211_key_iter(struct ieee80211_hw *hw,
+		   struct ieee80211_vif *vif,
+		   struct ieee80211_key *key,
+		   void (*iter)(struct ieee80211_hw *hw,
+				struct ieee80211_vif *vif,
+				struct ieee80211_sta *sta,
+				struct ieee80211_key_conf *key,
+				void *data),
+		   void *iter_data)
+{
+	/* skip keys of station in removal process */
+	if (key->sta && key->sta->removed)
+		return;
+	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
+		return;
+	iter(hw, vif, key->sta ? &key->sta->sta : NULL,
+	     &key->conf, iter_data);
+}
+
 void ieee80211_iter_keys(struct ieee80211_hw *hw,
 			 struct ieee80211_vif *vif,
 			 void (*iter)(struct ieee80211_hw *hw,
@@ -1001,16 +1021,13 @@
 	if (vif) {
 		sdata = vif_to_sdata(vif);
 		list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
-			iter(hw, &sdata->vif,
-			     key->sta ? &key->sta->sta : NULL,
-			     &key->conf, iter_data);
+			ieee80211_key_iter(hw, vif, key, iter, iter_data);
 	} else {
 		list_for_each_entry(sdata, &local->interfaces, list)
 			list_for_each_entry_safe(key, tmp,
 						 &sdata->key_list, list)
-				iter(hw, &sdata->vif,
-				     key->sta ? &key->sta->sta : NULL,
-				     &key->conf, iter_data);
+				ieee80211_key_iter(hw, &sdata->vif, key,
+						   iter, iter_data);
 	}
 }
 EXPORT_SYMBOL(ieee80211_iter_keys);
@@ -1027,17 +1044,8 @@
 {
 	struct ieee80211_key *key;
 
-	list_for_each_entry_rcu(key, &sdata->key_list, list) {
-		/* skip keys of station in removal process */
-		if (key->sta && key->sta->removed)
-			continue;
-		if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
-			continue;
-
-		iter(hw, &sdata->vif,
-		     key->sta ? &key->sta->sta : NULL,
-		     &key->conf, iter_data);
-	}
+	list_for_each_entry_rcu(key, &sdata->key_list, list)
+		ieee80211_key_iter(hw, &sdata->vif, key, iter, iter_data);
 }
 
 void ieee80211_iter_keys_rcu(struct ieee80211_hw *hw,
--- linux-qcom-6.8.0.orig/net/mac80211/link.c
+++ linux-qcom-6.8.0/net/mac80211/link.c
@@ -41,8 +41,8 @@
 			ieee80211_csa_finalize_work);
 	wiphy_work_init(&link->color_change_finalize_work,
 			ieee80211_color_change_finalize_work);
-	INIT_DELAYED_WORK(&link->color_collision_detect_work,
-			  ieee80211_color_collision_detection_work);
+	wiphy_delayed_work_init(&link->color_collision_detect_work,
+				ieee80211_color_collision_detection_work);
 	INIT_LIST_HEAD(&link->assigned_chanctx_list);
 	INIT_LIST_HEAD(&link->reserved_chanctx_list);
 	wiphy_delayed_work_init(&link->dfs_cac_timer_work,
@@ -72,7 +72,8 @@
 	if (link->sdata->vif.type == NL80211_IFTYPE_STATION)
 		ieee80211_mgd_stop_link(link);
 
-	cancel_delayed_work_sync(&link->color_collision_detect_work);
+	wiphy_delayed_work_cancel(link->sdata->local->hw.wiphy,
+				  &link->color_collision_detect_work);
 	ieee80211_link_release_channel(link);
 }
 
--- linux-qcom-6.8.0.orig/net/mac80211/main.c
+++ linux-qcom-6.8.0/net/mac80211/main.c
@@ -146,6 +146,8 @@
 	}
 
 	power = ieee80211_chandef_max_power(&chandef);
+	if (local->user_power_level != IEEE80211_UNSET_POWER_LEVEL)
+		power = min(local->user_power_level, power);
 
 	rcu_read_lock();
 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
@@ -217,6 +219,8 @@
 
 	might_sleep();
 
+	WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif));
+
 	if (!changed || sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 		return;
 
@@ -249,7 +253,6 @@
 	if (changed & ~BSS_CHANGED_VIF_CFG_FLAGS) {
 		u64 ch = changed & ~BSS_CHANGED_VIF_CFG_FLAGS;
 
-		/* FIXME: should be for each link */
 		trace_drv_link_info_changed(local, sdata, &sdata->vif.bss_conf,
 					    changed);
 		if (local->ops->link_info_changed)
@@ -303,9 +306,9 @@
 	       BSS_CHANGED_ERP_SLOT;
 }
 
-static void ieee80211_tasklet_handler(struct tasklet_struct *t)
+/* context: requires softirqs disabled */
+void ieee80211_handle_queued_frames(struct ieee80211_local *local)
 {
-	struct ieee80211_local *local = from_tasklet(local, t, tasklet);
 	struct sk_buff *skb;
 
 	while ((skb = skb_dequeue(&local->skb_queue)) ||
@@ -330,6 +333,13 @@
 	}
 }
 
+static void ieee80211_tasklet_handler(struct tasklet_struct *t)
+{
+	struct ieee80211_local *local = from_tasklet(local, t, tasklet);
+
+	ieee80211_handle_queued_frames(local);
+}
+
 static void ieee80211_restart_work(struct work_struct *work)
 {
 	struct ieee80211_local *local =
--- linux-qcom-6.8.0.orig/net/mac80211/mesh.c
+++ linux-qcom-6.8.0/net/mac80211/mesh.c
@@ -769,6 +769,9 @@
 			      struct sk_buff *skb, u32 ctrl_flags)
 {
 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+	struct ieee80211_mesh_fast_tx_key key = {
+		.type = MESH_FAST_TX_TYPE_LOCAL
+	};
 	struct ieee80211_mesh_fast_tx *entry;
 	struct ieee80211s_hdr *meshhdr;
 	u8 sa[ETH_ALEN] __aligned(2);
@@ -804,7 +807,10 @@
 			return false;
 	}
 
-	entry = mesh_fast_tx_get(sdata, skb->data);
+	ether_addr_copy(key.addr, skb->data);
+	if (!ether_addr_equal(skb->data + ETH_ALEN, sdata->vif.addr))
+		key.type = MESH_FAST_TX_TYPE_PROXIED;
+	entry = mesh_fast_tx_get(sdata, &key);
 	if (!entry)
 		return false;
 
@@ -1171,14 +1177,14 @@
 				       u64 changed)
 {
 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-	unsigned long bits = changed;
+	unsigned long bits[] = { BITMAP_FROM_U64(changed) };
 	u32 bit;
 
-	if (!bits)
+	if (!changed)
 		return;
 
 	/* if we race with running work, worst case this work becomes a noop */
-	for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE)
+	for_each_set_bit(bit, bits, sizeof(changed) * BITS_PER_BYTE)
 		set_bit(bit, ifmsh->mbss_changed);
 	set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags);
 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
@@ -1786,6 +1792,7 @@
 	ifmsh->last_preq = jiffies;
 	ifmsh->next_perr = jiffies;
 	ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
+	ifmsh->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
 	/* Allocate all mesh structures when creating the first mesh interface. */
 	if (!mesh_allocated)
 		ieee80211s_init();
--- linux-qcom-6.8.0.orig/net/mac80211/mesh.h
+++ linux-qcom-6.8.0/net/mac80211/mesh.h
@@ -134,9 +134,38 @@
 #define MESH_FAST_TX_CACHE_TIMEOUT		8000 /* msecs */
 
 /**
+ * enum ieee80211_mesh_fast_tx_type - cached mesh fast tx entry type
+ *
+ * @MESH_FAST_TX_TYPE_LOCAL: tx from the local vif address as SA
+ * @MESH_FAST_TX_TYPE_PROXIED: local tx with a different SA (e.g. bridged)
+ * @MESH_FAST_TX_TYPE_FORWARDED: forwarded from a different mesh point
+ * @NUM_MESH_FAST_TX_TYPE: number of entry types
+ */
+enum ieee80211_mesh_fast_tx_type {
+	MESH_FAST_TX_TYPE_LOCAL,
+	MESH_FAST_TX_TYPE_PROXIED,
+	MESH_FAST_TX_TYPE_FORWARDED,
+
+	/* must be last */
+	NUM_MESH_FAST_TX_TYPE
+};
+
+
+/**
+ * struct ieee80211_mesh_fast_tx_key - cached mesh fast tx entry key
+ *
+ * @addr: The Ethernet DA for this entry
+ * @type: cache entry type
+ */
+struct ieee80211_mesh_fast_tx_key {
+	u8 addr[ETH_ALEN] __aligned(2);
+	u16 type;
+};
+
+/**
  * struct ieee80211_mesh_fast_tx - cached mesh fast tx entry
  * @rhash: rhashtable pointer
- * @addr_key: The Ethernet DA which is the key for this entry
+ * @key: the lookup key for this cache entry
  * @fast_tx: base fast_tx data
  * @hdr: cached mesh and rfc1042 headers
  * @hdrlen: length of mesh + rfc1042
@@ -147,7 +176,7 @@
  */
 struct ieee80211_mesh_fast_tx {
 	struct rhash_head rhash;
-	u8 addr_key[ETH_ALEN] __aligned(2);
+	struct ieee80211_mesh_fast_tx_key key;
 
 	struct ieee80211_fast_tx fast_tx;
 	u8 hdr[sizeof(struct ieee80211s_hdr) + sizeof(rfc1042_header)];
@@ -333,7 +362,8 @@
 
 bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
 struct ieee80211_mesh_fast_tx *
-mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr);
+mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata,
+		 struct ieee80211_mesh_fast_tx_key *key);
 bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
 			      struct sk_buff *skb, u32 ctrl_flags);
 void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata,
--- linux-qcom-6.8.0.orig/net/mac80211/mesh_pathtbl.c
+++ linux-qcom-6.8.0/net/mac80211/mesh_pathtbl.c
@@ -37,8 +37,8 @@
 static const struct rhashtable_params fast_tx_rht_params = {
 	.nelem_hint = 10,
 	.automatic_shrinking = true,
-	.key_len = ETH_ALEN,
-	.key_offset = offsetof(struct ieee80211_mesh_fast_tx, addr_key),
+	.key_len = sizeof_field(struct ieee80211_mesh_fast_tx, key),
+	.key_offset = offsetof(struct ieee80211_mesh_fast_tx, key),
 	.head_offset = offsetof(struct ieee80211_mesh_fast_tx, rhash),
 	.hashfn = mesh_table_hash,
 };
@@ -431,20 +431,21 @@
 }
 
 struct ieee80211_mesh_fast_tx *
-mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr)
+mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata,
+		 struct ieee80211_mesh_fast_tx_key *key)
 {
 	struct ieee80211_mesh_fast_tx *entry;
 	struct mesh_tx_cache *cache;
 
 	cache = &sdata->u.mesh.tx_cache;
-	entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
+	entry = rhashtable_lookup(&cache->rht, key, fast_tx_rht_params);
 	if (!entry)
 		return NULL;
 
 	if (!(entry->mpath->flags & MESH_PATH_ACTIVE) ||
 	    mpath_expired(entry->mpath)) {
 		spin_lock_bh(&cache->walk_lock);
-		entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
+		entry = rhashtable_lookup(&cache->rht, key, fast_tx_rht_params);
 		if (entry)
 		    mesh_fast_tx_entry_free(cache, entry);
 		spin_unlock_bh(&cache->walk_lock);
@@ -489,18 +490,24 @@
 	if (!sta)
 		return;
 
+	build.key.type = MESH_FAST_TX_TYPE_LOCAL;
 	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
 		/* This is required to keep the mppath alive */
 		mppath = mpp_path_lookup(sdata, meshhdr->eaddr1);
 		if (!mppath)
 			return;
 		build.mppath = mppath;
+		if (!ether_addr_equal(meshhdr->eaddr2, sdata->vif.addr))
+			build.key.type = MESH_FAST_TX_TYPE_PROXIED;
 	} else if (ieee80211_has_a4(hdr->frame_control)) {
 		mppath = mpath;
 	} else {
 		return;
 	}
 
+	if (!ether_addr_equal(hdr->addr4, sdata->vif.addr))
+		build.key.type = MESH_FAST_TX_TYPE_FORWARDED;
+
 	/* rate limit, in case fast xmit can't be enabled */
 	if (mppath->fast_tx_check == jiffies)
 		return;
@@ -547,7 +554,7 @@
 		}
 	}
 
-	memcpy(build.addr_key, mppath->dst, ETH_ALEN);
+	memcpy(build.key.addr, mppath->dst, ETH_ALEN);
 	build.timestamp = jiffies;
 	build.fast_tx.band = info->band;
 	build.fast_tx.da_offs = offsetof(struct ieee80211_hdr, addr3);
@@ -600,11 +607,10 @@
 void mesh_fast_tx_gc(struct ieee80211_sub_if_data *sdata)
 {
 	unsigned long timeout = msecs_to_jiffies(MESH_FAST_TX_CACHE_TIMEOUT);
-	struct mesh_tx_cache *cache;
+	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
 	struct ieee80211_mesh_fast_tx *entry;
 	struct hlist_node *n;
 
-	cache = &sdata->u.mesh.tx_cache;
 	if (atomic_read(&cache->rht.nelems) < MESH_FAST_TX_CACHE_THRESHOLD_SIZE)
 		return;
 
@@ -622,7 +628,6 @@
 	struct ieee80211_mesh_fast_tx *entry;
 	struct hlist_node *n;
 
-	cache = &sdata->u.mesh.tx_cache;
 	spin_lock_bh(&cache->walk_lock);
 	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
 		if (entry->mpath == mpath)
@@ -637,7 +642,6 @@
 	struct ieee80211_mesh_fast_tx *entry;
 	struct hlist_node *n;
 
-	cache = &sdata->u.mesh.tx_cache;
 	spin_lock_bh(&cache->walk_lock);
 	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
 		if (rcu_access_pointer(entry->mpath->next_hop) == sta)
@@ -649,13 +653,18 @@
 			     const u8 *addr)
 {
 	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
+	struct ieee80211_mesh_fast_tx_key key = {};
 	struct ieee80211_mesh_fast_tx *entry;
+	int i;
 
-	cache = &sdata->u.mesh.tx_cache;
+	ether_addr_copy(key.addr, addr);
 	spin_lock_bh(&cache->walk_lock);
-	entry = rhashtable_lookup_fast(&cache->rht, addr, fast_tx_rht_params);
-	if (entry)
-		mesh_fast_tx_entry_free(cache, entry);
+	for (i = 0; i < NUM_MESH_FAST_TX_TYPE; i++) {
+		key.type = i;
+		entry = rhashtable_lookup_fast(&cache->rht, &key, fast_tx_rht_params);
+		if (entry)
+			mesh_fast_tx_entry_free(cache, entry);
+	}
 	spin_unlock_bh(&cache->walk_lock);
 }
 
@@ -1008,10 +1017,23 @@
  */
 void mesh_path_flush_pending(struct mesh_path *mpath)
 {
+	struct ieee80211_sub_if_data *sdata = mpath->sdata;
+	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+	struct mesh_preq_queue *preq, *tmp;
 	struct sk_buff *skb;
 
 	while ((skb = skb_dequeue(&mpath->frame_queue)) != NULL)
 		mesh_path_discard_frame(mpath->sdata, skb);
+
+	spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
+	list_for_each_entry_safe(preq, tmp, &ifmsh->preq_queue.list, list) {
+		if (ether_addr_equal(mpath->dst, preq->dst)) {
+			list_del(&preq->list);
+			kfree(preq);
+			--ifmsh->preq_queue_len;
+		}
+	}
+	spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
 }
 
 /**
--- linux-qcom-6.8.0.orig/net/mac80211/mlme.c
+++ linux-qcom-6.8.0/net/mac80211/mlme.c
@@ -3295,6 +3295,10 @@
 
 	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
 
+	sdata->u.mgd.removed_links = 0;
+	wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
+				  &sdata->u.mgd.ml_reconf_work);
+
 	if (already)
 		return;
 
@@ -5848,7 +5852,7 @@
 		 */
 		if (control &
 		    IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT)
-			link_removal_timeout[link_id] = le16_to_cpu(*(__le16 *)pos);
+			link_removal_timeout[link_id] = get_unaligned_le16(pos);
 	}
 
 	removed_links &= sdata->vif.valid_links;
@@ -5873,8 +5877,11 @@
 			continue;
 		}
 
-		link_delay = link_conf->beacon_int *
-			link_removal_timeout[link_id];
+		if (link_removal_timeout[link_id] < 1)
+			link_delay = 0;
+		else
+			link_delay = link_conf->beacon_int *
+				(link_removal_timeout[link_id] - 1);
 
 		if (!delay)
 			delay = link_delay;
@@ -6181,7 +6188,8 @@
 			link->u.mgd.dtim_period = elems->dtim_period;
 		link->u.mgd.have_beacon = true;
 		ifmgd->assoc_data->need_beacon = false;
-		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
+		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
+		    !ieee80211_is_s1g_beacon(hdr->frame_control)) {
 			link->conf->sync_tsf =
 				le64_to_cpu(mgmt->u.beacon.timestamp);
 			link->conf->sync_device_ts =
@@ -6665,6 +6673,7 @@
 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
 
 	assoc_data->tries++;
+	assoc_data->comeback = false;
 	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
 		sdata_info(sdata, "association with %pM timed out\n",
 			   assoc_data->ap_addr);
@@ -7291,7 +7300,7 @@
 			sdata_info(sdata,
 				   "failed to insert STA entry for the AP (error %d)\n",
 				   err);
-			goto out_err;
+			goto out_release_chan;
 		}
 	} else
 		WARN_ON_ONCE(!ether_addr_equal(link->u.mgd.bssid, cbss->bssid));
@@ -7302,8 +7311,9 @@
 
 	return 0;
 
+out_release_chan:
+	ieee80211_link_release_channel(link);
 out_err:
-	ieee80211_link_release_channel(&sdata->deflink);
 	ieee80211_vif_set_links(sdata, 0, 0);
 	return err;
 }
@@ -7523,10 +7533,10 @@
 	if (err)
 		goto err_clear;
 
-	if (req->link_id > 0)
+	if (req->link_id >= 0)
 		link = sdata_dereference(sdata->link[req->link_id], sdata);
 	else
-		link = sdata_dereference(sdata->link[0], sdata);
+		link = &sdata->deflink;
 
 	if (WARN_ON(!link)) {
 		err = -ENOLINK;
@@ -8201,8 +8211,6 @@
 			  &ifmgd->csa_connection_drop_work);
 	wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
 				  &ifmgd->tdls_peer_del_work);
-	wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
-				  &ifmgd->ml_reconf_work);
 	wiphy_delayed_work_cancel(sdata->local->hw.wiphy, &ifmgd->ttlm_work);
 
 	if (ifmgd->assoc_data)
--- linux-qcom-6.8.0.orig/net/mac80211/offchannel.c
+++ linux-qcom-6.8.0/net/mac80211/offchannel.c
@@ -951,6 +951,7 @@
 	}
 
 	IEEE80211_SKB_CB(skb)->flags = flags;
+	IEEE80211_SKB_CB(skb)->control.flags |= IEEE80211_TX_CTRL_DONT_USE_RATE_MASK;
 
 	skb->dev = sdata->dev;
 
--- linux-qcom-6.8.0.orig/net/mac80211/rate.c
+++ linux-qcom-6.8.0/net/mac80211/rate.c
@@ -37,7 +37,7 @@
 	struct ieee80211_supported_band *sband;
 	struct ieee80211_chanctx_conf *chanctx_conf;
 
-	ieee80211_sta_set_rx_nss(&sta->deflink);
+	ieee80211_sta_init_nss(&sta->deflink);
 
 	if (!ref)
 		return;
@@ -877,6 +877,7 @@
 	struct ieee80211_sub_if_data *sdata;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	struct ieee80211_supported_band *sband;
+	u32 mask = ~0;
 
 	rate_control_fill_sta_table(sta, info, dest, max_rates);
 
@@ -889,9 +890,12 @@
 	if (ieee80211_is_tx_data(skb))
 		rate_control_apply_mask(sdata, sta, sband, dest, max_rates);
 
+	if (!(info->control.flags & IEEE80211_TX_CTRL_DONT_USE_RATE_MASK))
+		mask = sdata->rc_rateidx_mask[info->band];
+
 	if (dest[0].idx < 0)
 		__rate_control_send_low(&sdata->local->hw, sband, sta, info,
-					sdata->rc_rateidx_mask[info->band]);
+					mask);
 
 	if (sta)
 		rate_fixup_ratelist(vif, sband, info, dest, max_rates);
--- linux-qcom-6.8.0.orig/net/mac80211/rx.c
+++ linux-qcom-6.8.0/net/mac80211/rx.c
@@ -2746,7 +2746,10 @@
 			       struct sk_buff *skb, int hdrlen)
 {
 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-	struct ieee80211_mesh_fast_tx *entry = NULL;
+	struct ieee80211_mesh_fast_tx_key key = {
+		.type = MESH_FAST_TX_TYPE_FORWARDED
+	};
+	struct ieee80211_mesh_fast_tx *entry;
 	struct ieee80211s_hdr *mesh_hdr;
 	struct tid_ampdu_tx *tid_tx;
 	struct sta_info *sta;
@@ -2755,9 +2758,13 @@
 
 	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
 	if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
-		entry = mesh_fast_tx_get(sdata, mesh_hdr->eaddr1);
+		ether_addr_copy(key.addr, mesh_hdr->eaddr1);
 	else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
-		entry = mesh_fast_tx_get(sdata, skb->data);
+		ether_addr_copy(key.addr, skb->data);
+	else
+		return false;
+
+	entry = mesh_fast_tx_get(sdata, &key);
 	if (!entry)
 		return false;
 
--- linux-qcom-6.8.0.orig/net/mac80211/scan.c
+++ linux-qcom-6.8.0/net/mac80211/scan.c
@@ -350,7 +350,8 @@
 	struct cfg80211_scan_request *req;
 	struct cfg80211_chan_def chandef;
 	u8 bands_used = 0;
-	int i, ielen, n_chans;
+	int i, ielen;
+	u32 *n_chans;
 	u32 flags = 0;
 
 	req = rcu_dereference_protected(local->scan_req,
@@ -360,34 +361,34 @@
 		return false;
 
 	if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) {
+		local->hw_scan_req->req.n_channels = req->n_channels;
+
 		for (i = 0; i < req->n_channels; i++) {
 			local->hw_scan_req->req.channels[i] = req->channels[i];
 			bands_used |= BIT(req->channels[i]->band);
 		}
-
-		n_chans = req->n_channels;
 	} else {
 		do {
 			if (local->hw_scan_band == NUM_NL80211_BANDS)
 				return false;
 
-			n_chans = 0;
+			n_chans = &local->hw_scan_req->req.n_channels;
+			*n_chans = 0;
 
 			for (i = 0; i < req->n_channels; i++) {
 				if (req->channels[i]->band !=
 				    local->hw_scan_band)
 					continue;
-				local->hw_scan_req->req.channels[n_chans] =
+				local->hw_scan_req->req.channels[(*n_chans)++] =
 							req->channels[i];
-				n_chans++;
+
 				bands_used |= BIT(req->channels[i]->band);
 			}
 
 			local->hw_scan_band++;
-		} while (!n_chans);
+		} while (!*n_chans);
 	}
 
-	local->hw_scan_req->req.n_channels = n_chans;
 	ieee80211_prepare_scan_chandef(&chandef);
 
 	if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
@@ -638,6 +639,7 @@
 				cpu_to_le16(IEEE80211_SN_TO_SEQ(sn));
 		}
 		IEEE80211_SKB_CB(skb)->flags |= tx_flags;
+		IEEE80211_SKB_CB(skb)->control.flags |= IEEE80211_TX_CTRL_DONT_USE_RATE_MASK;
 		ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band);
 	}
 }
@@ -694,19 +696,11 @@
 		return -EBUSY;
 
 	/* For an MLO connection, if a link ID was specified, validate that it
-	 * is indeed active. If no link ID was specified, select one of the
-	 * active links.
+	 * is indeed active.
 	 */
-	if (ieee80211_vif_is_mld(&sdata->vif)) {
-		if (req->tsf_report_link_id >= 0) {
-			if (!(sdata->vif.active_links &
-			      BIT(req->tsf_report_link_id)))
-				return -EINVAL;
-		} else {
-			req->tsf_report_link_id =
-				__ffs(sdata->vif.active_links);
-		}
-	}
+	if (ieee80211_vif_is_mld(&sdata->vif) && req->tsf_report_link_id >= 0 &&
+	    !(sdata->vif.active_links & BIT(req->tsf_report_link_id)))
+		return -EINVAL;
 
 	if (!__ieee80211_can_leave_ch(sdata))
 		return -EBUSY;
@@ -738,15 +732,21 @@
 			local->hw_scan_ies_bufsize *= n_bands;
 		}
 
-		local->hw_scan_req = kmalloc(
-				sizeof(*local->hw_scan_req) +
-				req->n_channels * sizeof(req->channels[0]) +
-				local->hw_scan_ies_bufsize, GFP_KERNEL);
+		local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req,
+							 req.channels,
+							 req->n_channels) +
+					     local->hw_scan_ies_bufsize,
+					     GFP_KERNEL);
 		if (!local->hw_scan_req)
 			return -ENOMEM;
 
 		local->hw_scan_req->req.ssids = req->ssids;
 		local->hw_scan_req->req.n_ssids = req->n_ssids;
+		/* None of the channels are actually set
+		 * up but let UBSAN know the boundaries.
+		 */
+		local->hw_scan_req->req.n_channels = req->n_channels;
+
 		ies = (u8 *)local->hw_scan_req +
 			sizeof(*local->hw_scan_req) +
 			req->n_channels * sizeof(req->channels[0]);
--- linux-qcom-6.8.0.orig/net/mac80211/sta_info.c
+++ linux-qcom-6.8.0/net/mac80211/sta_info.c
@@ -1717,7 +1717,7 @@
 	skb_queue_head_init(&pending);
 
 	/* sync with ieee80211_tx_h_unicast_ps_buf */
-	spin_lock(&sta->ps_lock);
+	spin_lock_bh(&sta->ps_lock);
 	/* Send all buffered frames to the station */
 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 		int count = skb_queue_len(&pending), tmp;
@@ -1746,7 +1746,7 @@
 	 */
 	clear_sta_flag(sta, WLAN_STA_PSPOLL);
 	clear_sta_flag(sta, WLAN_STA_UAPSD);
-	spin_unlock(&sta->ps_lock);
+	spin_unlock_bh(&sta->ps_lock);
 
 	atomic_dec(&ps->num_sta_ps);
 
--- linux-qcom-6.8.0.orig/net/mac80211/sta_info.h
+++ linux-qcom-6.8.0/net/mac80211/sta_info.h
@@ -3,7 +3,7 @@
  * Copyright 2002-2005, Devicescape Software, Inc.
  * Copyright 2013-2014  Intel Mobile Communications GmbH
  * Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright(c) 2020-2023 Intel Corporation
+ * Copyright(c) 2020-2024 Intel Corporation
  */
 
 #ifndef STA_INFO_H
@@ -482,6 +482,8 @@
  *	same for non-MLD STA. This is used as key for searching link STA
  * @link_id: Link ID uniquely identifying the link STA. This is 0 for non-MLD
  *	and set to the corresponding vif LinkId for MLD STA
+ * @op_mode_nss: NSS limit as set by operating mode notification, or 0
+ * @capa_nss: NSS limit as determined by local and peer capabilities
  * @link_hash_node: hash node for rhashtable
  * @sta: Points to the STA info
  * @gtk: group keys negotiated with this station, if any
@@ -518,6 +520,8 @@
 	u8 addr[ETH_ALEN];
 	u8 link_id;
 
+	u8 op_mode_nss, capa_nss;
+
 	struct rhlist_head link_hash_node;
 
 	struct sta_info *sta;
@@ -723,6 +727,12 @@
 	struct ieee80211_sta sta;
 };
 
+static inline int ieee80211_tdls_sta_link_id(struct sta_info *sta)
+{
+	/* TDLS STA can only have a single link */
+	return sta->sta.valid_links ? __ffs(sta->sta.valid_links) : 0;
+}
+
 static inline enum nl80211_plink_state sta_plink_state(struct sta_info *sta)
 {
 #ifdef CONFIG_MAC80211_MESH
--- linux-qcom-6.8.0.orig/net/mac80211/status.c
+++ linux-qcom-6.8.0/net/mac80211/status.c
@@ -1281,3 +1281,4 @@
 	while ((skb = __skb_dequeue(skbs)))
 		ieee80211_free_txskb(hw, skb);
 }
+EXPORT_SYMBOL(ieee80211_purge_tx_queue);
--- linux-qcom-6.8.0.orig/net/mac80211/tx.c
+++ linux-qcom-6.8.0/net/mac80211/tx.c
@@ -701,11 +701,16 @@
 	txrc.bss_conf = &tx->sdata->vif.bss_conf;
 	txrc.skb = tx->skb;
 	txrc.reported_rate.idx = -1;
-	txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
 
-	if (tx->sdata->rc_has_mcs_mask[info->band])
-		txrc.rate_idx_mcs_mask =
-			tx->sdata->rc_rateidx_mcs_mask[info->band];
+	if (unlikely(info->control.flags & IEEE80211_TX_CTRL_DONT_USE_RATE_MASK)) {
+		txrc.rate_idx_mask = ~0;
+	} else {
+		txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
+
+		if (tx->sdata->rc_has_mcs_mask[info->band])
+			txrc.rate_idx_mcs_mask =
+				tx->sdata->rc_rateidx_mcs_mask[info->band];
+	}
 
 	txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
 		    tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
@@ -2766,8 +2771,7 @@
 
 		if (tdls_peer) {
 			/* For TDLS only one link can be valid with peer STA */
-			int tdls_link_id = sta->sta.valid_links ?
-					   __ffs(sta->sta.valid_links) : 0;
+			int tdls_link_id = ieee80211_tdls_sta_link_id(sta);
 			struct ieee80211_link_data *link;
 
 			/* DA SA BSSID */
@@ -3093,8 +3097,7 @@
 	case NL80211_IFTYPE_STATION:
 		if (test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
 			/* For TDLS only one link can be valid with peer STA */
-			int tdls_link_id = sta->sta.valid_links ?
-					   __ffs(sta->sta.valid_links) : 0;
+			int tdls_link_id = ieee80211_tdls_sta_link_id(sta);
 			struct ieee80211_link_data *link;
 
 			/* DA SA BSSID */
@@ -5322,8 +5325,10 @@
 	if (beacon->tail)
 		skb_put_data(skb, beacon->tail, beacon->tail_len);
 
-	if (ieee80211_beacon_protect(skb, local, sdata, link) < 0)
+	if (ieee80211_beacon_protect(skb, local, sdata, link) < 0) {
+		dev_kfree_skb(skb);
 		return NULL;
+	}
 
 	ieee80211_beacon_get_finish(hw, vif, link, offs, beacon, skb,
 				    chanctx_conf, csa_off_base);
--- linux-qcom-6.8.0.orig/net/mac80211/util.c
+++ linux-qcom-6.8.0/net/mac80211/util.c
@@ -828,7 +828,8 @@
 {
 	struct sta_info *sta;
 
-	list_for_each_entry_rcu(sta, &local->sta_list, list) {
+	list_for_each_entry_rcu(sta, &local->sta_list, list,
+				lockdep_is_held(&local->hw.wiphy->mtx)) {
 		if (!sta->uploaded)
 			continue;
 
@@ -849,6 +850,19 @@
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_stations_atomic);
 
+void ieee80211_iterate_stations_mtx(struct ieee80211_hw *hw,
+				    void (*iterator)(void *data,
+						     struct ieee80211_sta *sta),
+				    void *data)
+{
+	struct ieee80211_local *local = hw_to_local(hw);
+
+	lockdep_assert_wiphy(local->hw.wiphy);
+
+	__iterate_stations(local, iterator, data);
+}
+EXPORT_SYMBOL_GPL(ieee80211_iterate_stations_mtx);
+
 struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
@@ -2335,6 +2349,10 @@
 
 void ieee80211_stop_device(struct ieee80211_local *local)
 {
+	local_bh_disable();
+	ieee80211_handle_queued_frames(local);
+	local_bh_enable();
+
 	ieee80211_led_radio(local, false);
 	ieee80211_mod_tpt_led_trig(local, 0, IEEE80211_TPT_LEDTRIG_FL_RADIO);
 
@@ -2593,6 +2611,9 @@
 			WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n");
 		else
 			WARN(1, "Hardware became unavailable during restart.\n");
+		ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
+						IEEE80211_QUEUE_STOP_REASON_SUSPEND,
+						false);
 		ieee80211_handle_reconfig_failure(local);
 		return res;
 	}
--- linux-qcom-6.8.0.orig/net/mac80211/vht.c
+++ linux-qcom-6.8.0/net/mac80211/vht.c
@@ -4,7 +4,7 @@
  *
  * Portions of this file
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
- * Copyright (C) 2018 - 2023 Intel Corporation
+ * Copyright (C) 2018 - 2024 Intel Corporation
  */
 
 #include <linux/ieee80211.h>
@@ -541,15 +541,11 @@
 	return bw;
 }
 
-void ieee80211_sta_set_rx_nss(struct link_sta_info *link_sta)
+void ieee80211_sta_init_nss(struct link_sta_info *link_sta)
 {
 	u8 ht_rx_nss = 0, vht_rx_nss = 0, he_rx_nss = 0, eht_rx_nss = 0, rx_nss;
 	bool support_160;
 
-	/* if we received a notification already don't overwrite it */
-	if (link_sta->pub->rx_nss)
-		return;
-
 	if (link_sta->pub->eht_cap.has_eht) {
 		int i;
 		const u8 *rx_nss_mcs = (void *)&link_sta->pub->eht_cap.eht_mcs_nss_supp;
@@ -627,7 +623,15 @@
 	rx_nss = max(vht_rx_nss, ht_rx_nss);
 	rx_nss = max(he_rx_nss, rx_nss);
 	rx_nss = max(eht_rx_nss, rx_nss);
-	link_sta->pub->rx_nss = max_t(u8, 1, rx_nss);
+	rx_nss = max_t(u8, 1, rx_nss);
+	link_sta->capa_nss = rx_nss;
+
+	/* that shouldn't be set yet, but we can handle it anyway */
+	if (link_sta->op_mode_nss)
+		link_sta->pub->rx_nss =
+			min_t(u8, rx_nss, link_sta->op_mode_nss);
+	else
+		link_sta->pub->rx_nss = rx_nss;
 }
 
 u32 __ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
@@ -637,7 +641,7 @@
 	enum ieee80211_sta_rx_bandwidth new_bw;
 	struct sta_opmode_info sta_opmode = {};
 	u32 changed = 0;
-	u8 nss, cur_nss;
+	u8 nss;
 
 	/* ignore - no support for BF yet */
 	if (opmode & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)
@@ -647,23 +651,17 @@
 	nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
 	nss += 1;
 
-	if (link_sta->pub->rx_nss != nss) {
-		cur_nss = link_sta->pub->rx_nss;
-		/* Reset rx_nss and call ieee80211_sta_set_rx_nss() which
-		 * will set the same to max nss value calculated based on capability.
-		 */
-		link_sta->pub->rx_nss = 0;
-		ieee80211_sta_set_rx_nss(link_sta);
-		/* Do not allow an nss change to rx_nss greater than max_nss
-		 * negotiated and capped to APs capability during association.
-		 */
-		if (nss <= link_sta->pub->rx_nss) {
-			link_sta->pub->rx_nss = nss;
-			sta_opmode.rx_nss = nss;
-			changed |= IEEE80211_RC_NSS_CHANGED;
-			sta_opmode.changed |= STA_OPMODE_N_SS_CHANGED;
+	if (link_sta->op_mode_nss != nss) {
+		if (nss <= link_sta->capa_nss) {
+			link_sta->op_mode_nss = nss;
+
+			if (nss != link_sta->pub->rx_nss) {
+				link_sta->pub->rx_nss = nss;
+				changed |= IEEE80211_RC_NSS_CHANGED;
+				sta_opmode.rx_nss = link_sta->pub->rx_nss;
+				sta_opmode.changed |= STA_OPMODE_N_SS_CHANGED;
+			}
 		} else {
-			link_sta->pub->rx_nss = cur_nss;
 			pr_warn_ratelimited("Ignoring NSS change in VHT Operating Mode Notification from %pM with invalid nss %d",
 					    link_sta->pub->addr, nss);
 		}
--- linux-qcom-6.8.0.orig/net/mac802154/iface.c
+++ linux-qcom-6.8.0/net/mac802154/iface.c
@@ -684,6 +684,10 @@
 	ASSERT_RTNL();
 
 	mutex_lock(&sdata->local->iflist_mtx);
+	if (list_empty(&sdata->local->interfaces)) {
+		mutex_unlock(&sdata->local->iflist_mtx);
+		return;
+	}
 	list_del_rcu(&sdata->list);
 	mutex_unlock(&sdata->local->iflist_mtx);
 
--- linux-qcom-6.8.0.orig/net/mac802154/llsec.c
+++ linux-qcom-6.8.0/net/mac802154/llsec.c
@@ -265,19 +265,27 @@
 	return -ENOMEM;
 }
 
+static void mac802154_llsec_key_del_rcu(struct rcu_head *rcu)
+{
+	struct ieee802154_llsec_key_entry *pos;
+	struct mac802154_llsec_key *mkey;
+
+	pos = container_of(rcu, struct ieee802154_llsec_key_entry, rcu);
+	mkey = container_of(pos->key, struct mac802154_llsec_key, key);
+
+	llsec_key_put(mkey);
+	kfree_sensitive(pos);
+}
+
 int mac802154_llsec_key_del(struct mac802154_llsec *sec,
 			    const struct ieee802154_llsec_key_id *key)
 {
 	struct ieee802154_llsec_key_entry *pos;
 
 	list_for_each_entry(pos, &sec->table.keys, list) {
-		struct mac802154_llsec_key *mkey;
-
-		mkey = container_of(pos->key, struct mac802154_llsec_key, key);
-
 		if (llsec_key_id_equal(&pos->id, key)) {
 			list_del_rcu(&pos->list);
-			llsec_key_put(mkey);
+			call_rcu(&pos->rcu, mac802154_llsec_key_del_rcu);
 			return 0;
 		}
 	}
--- linux-qcom-6.8.0.orig/net/mac802154/main.c
+++ linux-qcom-6.8.0/net/mac802154/main.c
@@ -161,8 +161,10 @@
 	}
 
 	phy->symbol_duration = duration;
-	phy->lifs_period = (IEEE802154_LIFS_PERIOD * phy->symbol_duration) / NSEC_PER_SEC;
-	phy->sifs_period = (IEEE802154_SIFS_PERIOD * phy->symbol_duration) / NSEC_PER_SEC;
+	phy->lifs_period =
+		(IEEE802154_LIFS_PERIOD * phy->symbol_duration) / NSEC_PER_USEC;
+	phy->sifs_period =
+		(IEEE802154_SIFS_PERIOD * phy->symbol_duration) / NSEC_PER_USEC;
 }
 EXPORT_SYMBOL(ieee802154_configure_durations);
 
@@ -184,10 +186,10 @@
 	 * Should be done when all drivers sets this value.
 	 */
 
-	wpan_phy->lifs_period =
-		(IEEE802154_LIFS_PERIOD * wpan_phy->symbol_duration) / 1000;
-	wpan_phy->sifs_period =
-		(IEEE802154_SIFS_PERIOD * wpan_phy->symbol_duration) / 1000;
+	wpan_phy->lifs_period =	(IEEE802154_LIFS_PERIOD *
+				 wpan_phy->symbol_duration) / NSEC_PER_USEC;
+	wpan_phy->sifs_period =	(IEEE802154_SIFS_PERIOD *
+				 wpan_phy->symbol_duration) / NSEC_PER_USEC;
 }
 
 int ieee802154_register_hw(struct ieee802154_hw *hw)
--- linux-qcom-6.8.0.orig/net/mac802154/scan.c
+++ linux-qcom-6.8.0/net/mac802154/scan.c
@@ -176,6 +176,7 @@
 	struct ieee802154_local *local =
 		container_of(work, struct ieee802154_local, scan_work.work);
 	struct cfg802154_scan_request *scan_req;
+	enum nl802154_scan_types scan_req_type;
 	struct ieee802154_sub_if_data *sdata;
 	unsigned int scan_duration = 0;
 	struct wpan_phy *wpan_phy;
@@ -209,6 +210,7 @@
 	}
 
 	wpan_phy = scan_req->wpan_phy;
+	scan_req_type = scan_req->type;
 	scan_req_duration = scan_req->duration;
 
 	/* Look for the next valid chan */
@@ -246,7 +248,7 @@
 		goto end_scan;
 	}
 
-	if (scan_req->type == NL802154_SCAN_ACTIVE) {
+	if (scan_req_type == NL802154_SCAN_ACTIVE) {
 		ret = mac802154_transmit_beacon_req(local, sdata);
 		if (ret)
 			dev_err(&sdata->dev->dev,
--- linux-qcom-6.8.0.orig/net/mac802154/tx.c
+++ linux-qcom-6.8.0/net/mac802154/tx.c
@@ -34,8 +34,8 @@
 	if (res)
 		goto err_tx;
 
-	dev->stats.tx_packets++;
-	dev->stats.tx_bytes += skb->len;
+	DEV_STATS_INC(dev, tx_packets);
+	DEV_STATS_ADD(dev, tx_bytes, skb->len);
 
 	ieee802154_xmit_complete(&local->hw, skb, false);
 
@@ -90,8 +90,8 @@
 		if (ret)
 			goto err_wake_netif_queue;
 
-		dev->stats.tx_packets++;
-		dev->stats.tx_bytes += len;
+		DEV_STATS_INC(dev, tx_packets);
+		DEV_STATS_ADD(dev, tx_bytes, len);
 	} else {
 		local->tx_skb = skb;
 		queue_work(local->workqueue, &local->sync_tx_work);
--- linux-qcom-6.8.0.orig/net/mctp/af_mctp.c
+++ linux-qcom-6.8.0/net/mctp/af_mctp.c
@@ -676,10 +676,14 @@
 	if (rc)
 		goto err_unreg_routes;
 
-	mctp_device_init();
+	rc = mctp_device_init();
+	if (rc)
+		goto err_unreg_neigh;
 
 	return 0;
 
+err_unreg_neigh:
+	mctp_neigh_exit();
 err_unreg_routes:
 	mctp_routes_exit();
 err_unreg_proto:
--- linux-qcom-6.8.0.orig/net/mctp/device.c
+++ linux-qcom-6.8.0/net/mctp/device.c
@@ -524,25 +524,31 @@
 	.priority = ADDRCONF_NOTIFY_PRIORITY,
 };
 
-void __init mctp_device_init(void)
+static const struct rtnl_msg_handler mctp_device_rtnl_msg_handlers[] = {
+	{THIS_MODULE, PF_MCTP, RTM_NEWADDR, mctp_rtm_newaddr, NULL, 0},
+	{THIS_MODULE, PF_MCTP, RTM_DELADDR, mctp_rtm_deladdr, NULL, 0},
+	{THIS_MODULE, PF_MCTP, RTM_GETADDR, NULL, mctp_dump_addrinfo, 0},
+};
+
+int __init mctp_device_init(void)
 {
-	register_netdevice_notifier(&mctp_dev_nb);
+	int err;
 
-	rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_GETADDR,
-			     NULL, mctp_dump_addrinfo, 0);
-	rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_NEWADDR,
-			     mctp_rtm_newaddr, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_DELADDR,
-			     mctp_rtm_deladdr, NULL, 0);
+	register_netdevice_notifier(&mctp_dev_nb);
 	rtnl_af_register(&mctp_af_ops);
+
+	err = rtnl_register_many(mctp_device_rtnl_msg_handlers);
+	if (err) {
+		rtnl_af_unregister(&mctp_af_ops);
+		unregister_netdevice_notifier(&mctp_dev_nb);
+	}
+
+	return err;
 }
 
 void __exit mctp_device_exit(void)
 {
+	rtnl_unregister_many(mctp_device_rtnl_msg_handlers);
 	rtnl_af_unregister(&mctp_af_ops);
-	rtnl_unregister(PF_MCTP, RTM_DELADDR);
-	rtnl_unregister(PF_MCTP, RTM_NEWADDR);
-	rtnl_unregister(PF_MCTP, RTM_GETADDR);
-
 	unregister_netdevice_notifier(&mctp_dev_nb);
 }
--- linux-qcom-6.8.0.orig/net/mctp/neigh.c
+++ linux-qcom-6.8.0/net/mctp/neigh.c
@@ -322,22 +322,29 @@
 	.exit = mctp_neigh_net_exit,
 };
 
+static const struct rtnl_msg_handler mctp_neigh_rtnl_msg_handlers[] = {
+	{THIS_MODULE, PF_MCTP, RTM_NEWNEIGH, mctp_rtm_newneigh, NULL, 0},
+	{THIS_MODULE, PF_MCTP, RTM_DELNEIGH, mctp_rtm_delneigh, NULL, 0},
+	{THIS_MODULE, PF_MCTP, RTM_GETNEIGH, NULL, mctp_rtm_getneigh, 0},
+};
+
 int __init mctp_neigh_init(void)
 {
-	rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_NEWNEIGH,
-			     mctp_rtm_newneigh, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_DELNEIGH,
-			     mctp_rtm_delneigh, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_GETNEIGH,
-			     NULL, mctp_rtm_getneigh, 0);
+	int err;
+
+	err = register_pernet_subsys(&mctp_net_ops);
+	if (err)
+		return err;
+
+	err = rtnl_register_many(mctp_neigh_rtnl_msg_handlers);
+	if (err)
+		unregister_pernet_subsys(&mctp_net_ops);
 
-	return register_pernet_subsys(&mctp_net_ops);
+	return err;
 }
 
-void __exit mctp_neigh_exit(void)
+void mctp_neigh_exit(void)
 {
+	rtnl_unregister_many(mctp_neigh_rtnl_msg_handlers);
 	unregister_pernet_subsys(&mctp_net_ops);
-	rtnl_unregister(PF_MCTP, RTM_GETNEIGH);
-	rtnl_unregister(PF_MCTP, RTM_DELNEIGH);
-	rtnl_unregister(PF_MCTP, RTM_NEWNEIGH);
 }
--- linux-qcom-6.8.0.orig/net/mctp/route.c
+++ linux-qcom-6.8.0/net/mctp/route.c
@@ -334,8 +334,13 @@
 	msk = NULL;
 	rc = -EINVAL;
 
-	/* we may be receiving a locally-routed packet; drop source sk
-	 * accounting
+	/* We may be receiving a locally-routed packet; drop source sk
+	 * accounting.
+	 *
+	 * From here, we will either queue the skb - either to a frag_queue, or
+	 * to a receiving socket. When that succeeds, we clear the skb pointer;
+	 * a non-NULL skb on exit will be otherwise unowned, and hence
+	 * kfree_skb()-ed.
 	 */
 	skb_orphan(skb);
 
@@ -389,7 +394,9 @@
 		 * pending key.
 		 */
 		if (flags & MCTP_HDR_FLAG_EOM) {
-			sock_queue_rcv_skb(&msk->sk, skb);
+			rc = sock_queue_rcv_skb(&msk->sk, skb);
+			if (!rc)
+				skb = NULL;
 			if (key) {
 				/* we've hit a pending reassembly; not much we
 				 * can do but drop it
@@ -398,7 +405,6 @@
 						   MCTP_TRACE_KEY_REPLIED);
 				key = NULL;
 			}
-			rc = 0;
 			goto out_unlock;
 		}
 
@@ -425,8 +431,10 @@
 			 * this function.
 			 */
 			rc = mctp_key_add(key, msk);
-			if (!rc)
+			if (!rc) {
 				trace_mctp_key_acquire(key);
+				skb = NULL;
+			}
 
 			/* we don't need to release key->lock on exit, so
 			 * clean up here and suppress the unlock via
@@ -444,6 +452,8 @@
 				key = NULL;
 			} else {
 				rc = mctp_frag_queue(key, skb);
+				if (!rc)
+					skb = NULL;
 			}
 		}
 
@@ -458,12 +468,19 @@
 		else
 			rc = mctp_frag_queue(key, skb);
 
+		if (rc)
+			goto out_unlock;
+
+		/* we've queued; the queue owns the skb now */
+		skb = NULL;
+
 		/* end of message? deliver to socket, and we're done with
 		 * the reassembly/response key
 		 */
-		if (!rc && flags & MCTP_HDR_FLAG_EOM) {
-			sock_queue_rcv_skb(key->sk, key->reasm_head);
-			key->reasm_head = NULL;
+		if (flags & MCTP_HDR_FLAG_EOM) {
+			rc = sock_queue_rcv_skb(key->sk, key->reasm_head);
+			if (!rc)
+				key->reasm_head = NULL;
 			__mctp_key_done_in(key, net, f, MCTP_TRACE_KEY_REPLIED);
 			key = NULL;
 		}
@@ -482,8 +499,7 @@
 	if (any_key)
 		mctp_key_unref(any_key);
 out:
-	if (rc)
-		kfree_skb(skb);
+	kfree_skb(skb);
 	return rc;
 }
 
@@ -843,6 +859,9 @@
 		/* copy message payload */
 		skb_copy_bits(skb, pos, skb_transport_header(skb2), size);
 
+		/* we need to copy the extensions, for MCTP flow data */
+		skb_ext_copy(skb2, skb);
+
 		/* do route */
 		rc = rt->output(rt, skb2);
 		if (rc)
@@ -1407,26 +1426,39 @@
 	.exit = mctp_routes_net_exit,
 };
 
+static const struct rtnl_msg_handler mctp_route_rtnl_msg_handlers[] = {
+	{THIS_MODULE, PF_MCTP, RTM_NEWROUTE, mctp_newroute, NULL, 0},
+	{THIS_MODULE, PF_MCTP, RTM_DELROUTE, mctp_delroute, NULL, 0},
+	{THIS_MODULE, PF_MCTP, RTM_GETROUTE, NULL, mctp_dump_rtinfo, 0},
+};
+
 int __init mctp_routes_init(void)
 {
+	int err;
+
 	dev_add_pack(&mctp_packet_type);
 
-	rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_GETROUTE,
-			     NULL, mctp_dump_rtinfo, 0);
-	rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_NEWROUTE,
-			     mctp_newroute, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_DELROUTE,
-			     mctp_delroute, NULL, 0);
+	err = register_pernet_subsys(&mctp_net_ops);
+	if (err)
+		goto err_pernet;
+
+	err = rtnl_register_many(mctp_route_rtnl_msg_handlers);
+	if (err)
+		goto err_rtnl;
+
+	return 0;
 
-	return register_pernet_subsys(&mctp_net_ops);
+err_rtnl:
+	unregister_pernet_subsys(&mctp_net_ops);
+err_pernet:
+	dev_remove_pack(&mctp_packet_type);
+	return err;
 }
 
 void mctp_routes_exit(void)
 {
+	rtnl_unregister_many(mctp_route_rtnl_msg_handlers);
 	unregister_pernet_subsys(&mctp_net_ops);
-	rtnl_unregister(PF_MCTP, RTM_DELROUTE);
-	rtnl_unregister(PF_MCTP, RTM_NEWROUTE);
-	rtnl_unregister(PF_MCTP, RTM_GETROUTE);
 	dev_remove_pack(&mctp_packet_type);
 }
 
--- linux-qcom-6.8.0.orig/net/mctp/test/route-test.c
+++ linux-qcom-6.8.0/net/mctp/test/route-test.c
@@ -354,7 +354,7 @@
 
 		skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
 		KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2);
-		KUNIT_EXPECT_EQ(test, skb->len, 1);
+		KUNIT_EXPECT_EQ(test, skb2->len, 1);
 
 		skb_free_datagram(sock->sk, skb2);
 
--- linux-qcom-6.8.0.orig/net/mpls/af_mpls.c
+++ linux-qcom-6.8.0/net/mpls/af_mpls.c
@@ -1154,7 +1154,7 @@
 
 	if ((all || type == NETCONFA_INPUT) &&
 	    nla_put_s32(skb, NETCONFA_INPUT,
-			mdev->input_enabled) < 0)
+			READ_ONCE(mdev->input_enabled)) < 0)
 		goto nla_put_failure;
 
 	nlmsg_end(skb, nlh);
@@ -1303,11 +1303,12 @@
 {
 	const struct nlmsghdr *nlh = cb->nlh;
 	struct net *net = sock_net(skb->sk);
-	struct hlist_head *head;
+	struct {
+		unsigned long ifindex;
+	} *ctx = (void *)cb->ctx;
 	struct net_device *dev;
 	struct mpls_dev *mdev;
-	int idx, s_idx;
-	int h, s_h;
+	int err = 0;
 
 	if (cb->strict_check) {
 		struct netlink_ext_ack *extack = cb->extack;
@@ -1324,40 +1325,23 @@
 		}
 	}
 
-	s_h = cb->args[0];
-	s_idx = idx = cb->args[1];
-
-	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
-		idx = 0;
-		head = &net->dev_index_head[h];
-		rcu_read_lock();
-		cb->seq = net->dev_base_seq;
-		hlist_for_each_entry_rcu(dev, head, index_hlist) {
-			if (idx < s_idx)
-				goto cont;
-			mdev = mpls_dev_get(dev);
-			if (!mdev)
-				goto cont;
-			if (mpls_netconf_fill_devconf(skb, mdev,
-						      NETLINK_CB(cb->skb).portid,
-						      nlh->nlmsg_seq,
-						      RTM_NEWNETCONF,
-						      NLM_F_MULTI,
-						      NETCONFA_ALL) < 0) {
-				rcu_read_unlock();
-				goto done;
-			}
-			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-cont:
-			idx++;
-		}
-		rcu_read_unlock();
-	}
-done:
-	cb->args[0] = h;
-	cb->args[1] = idx;
+	rcu_read_lock();
+	for_each_netdev_dump(net, dev, ctx->ifindex) {
+		mdev = mpls_dev_get(dev);
+		if (!mdev)
+			continue;
+		err = mpls_netconf_fill_devconf(skb, mdev,
+						NETLINK_CB(cb->skb).portid,
+						nlh->nlmsg_seq,
+						RTM_NEWNETCONF,
+						NLM_F_MULTI,
+						NETCONFA_ALL);
+		if (err < 0)
+			break;
+	}
+	rcu_read_unlock();
 
-	return skb->len;
+	return err;
 }
 
 #define MPLS_PERDEV_SYSCTL_OFFSET(field)	\
@@ -2745,6 +2729,15 @@
 	.get_stats_af_size = mpls_get_stats_af_size,
 };
 
+static const struct rtnl_msg_handler mpls_rtnl_msg_handlers[] __initdata_or_module = {
+	{THIS_MODULE, PF_MPLS, RTM_NEWROUTE, mpls_rtm_newroute, NULL, 0},
+	{THIS_MODULE, PF_MPLS, RTM_DELROUTE, mpls_rtm_delroute, NULL, 0},
+	{THIS_MODULE, PF_MPLS, RTM_GETROUTE, mpls_getroute, mpls_dump_routes, 0},
+	{THIS_MODULE, PF_MPLS, RTM_GETNETCONF,
+	 mpls_netconf_get_devconf, mpls_netconf_dump_devconf,
+	 RTNL_FLAG_DUMP_UNLOCKED},
+};
+
 static int __init mpls_init(void)
 {
 	int err;
@@ -2763,23 +2756,25 @@
 
 	rtnl_af_register(&mpls_af_ops);
 
-	rtnl_register_module(THIS_MODULE, PF_MPLS, RTM_NEWROUTE,
-			     mpls_rtm_newroute, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_MPLS, RTM_DELROUTE,
-			     mpls_rtm_delroute, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_MPLS, RTM_GETROUTE,
-			     mpls_getroute, mpls_dump_routes, 0);
-	rtnl_register_module(THIS_MODULE, PF_MPLS, RTM_GETNETCONF,
-			     mpls_netconf_get_devconf,
-			     mpls_netconf_dump_devconf, 0);
-	err = ipgre_tunnel_encap_add_mpls_ops();
+	err = rtnl_register_many(mpls_rtnl_msg_handlers);
 	if (err)
+		goto out_unregister_rtnl_af;
+
+	err = ipgre_tunnel_encap_add_mpls_ops();
+	if (err) {
 		pr_err("Can't add mpls over gre tunnel ops\n");
+		goto out_unregister_rtnl;
+	}
 
 	err = 0;
 out:
 	return err;
 
+out_unregister_rtnl:
+	rtnl_unregister_many(mpls_rtnl_msg_handlers);
+out_unregister_rtnl_af:
+	rtnl_af_unregister(&mpls_af_ops);
+	dev_remove_pack(&mpls_packet_type);
 out_unregister_pernet:
 	unregister_pernet_subsys(&mpls_net_ops);
 	goto out;
--- linux-qcom-6.8.0.orig/net/mpls/mpls_gso.c
+++ linux-qcom-6.8.0/net/mpls/mpls_gso.c
@@ -27,6 +27,9 @@
 	__be16 mpls_protocol;
 	unsigned int mpls_hlen;
 
+	if (!skb_inner_network_header_was_set(skb))
+		goto out;
+
 	skb_reset_network_header(skb);
 	mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
 	if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
--- linux-qcom-6.8.0.orig/net/mpls/mpls_iptunnel.c
+++ linux-qcom-6.8.0/net/mpls/mpls_iptunnel.c
@@ -83,7 +83,7 @@
 			ttl = net->mpls.default_ttl;
 		else
 			ttl = ip_hdr(skb)->ttl;
-		rt = (struct rtable *)dst;
+		rt = dst_rtable(dst);
 	} else if (dst->ops->family == AF_INET6) {
 		if (tun_encap_info->ttl_propagate == MPLS_TTL_PROP_DISABLED)
 			ttl = tun_encap_info->default_ttl;
@@ -92,7 +92,7 @@
 			ttl = net->mpls.default_ttl;
 		else
 			ttl = ipv6_hdr(skb)->hop_limit;
-		rt6 = (struct rt6_info *)dst;
+		rt6 = dst_rt6_info(dst);
 	} else {
 		goto drop;
 	}
--- linux-qcom-6.8.0.orig/net/mptcp/ctrl.c
+++ linux-qcom-6.8.0/net/mptcp/ctrl.c
@@ -96,6 +96,42 @@
 }
 
 #ifdef CONFIG_SYSCTL
+static int mptcp_set_scheduler(char *scheduler, const char *name)
+{
+	struct mptcp_sched_ops *sched;
+	int ret = 0;
+
+	rcu_read_lock();
+	sched = mptcp_sched_find(name);
+	if (sched)
+		strscpy(scheduler, name, MPTCP_SCHED_NAME_MAX);
+	else
+		ret = -ENOENT;
+	rcu_read_unlock();
+
+	return ret;
+}
+
+static int proc_scheduler(struct ctl_table *ctl, int write,
+			  void *buffer, size_t *lenp, loff_t *ppos)
+{
+	char (*scheduler)[MPTCP_SCHED_NAME_MAX] = ctl->data;
+	char val[MPTCP_SCHED_NAME_MAX];
+	struct ctl_table tbl = {
+		.data = val,
+		.maxlen = MPTCP_SCHED_NAME_MAX,
+	};
+	int ret;
+
+	strscpy(val, *scheduler, MPTCP_SCHED_NAME_MAX);
+
+	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
+	if (write && ret == 0)
+		ret = mptcp_set_scheduler(*scheduler, val);
+
+	return ret;
+}
+
 static struct ctl_table mptcp_sysctl_table[] = {
 	{
 		.procname = "enabled",
@@ -148,7 +184,7 @@
 		.procname = "scheduler",
 		.maxlen	= MPTCP_SCHED_NAME_MAX,
 		.mode = 0644,
-		.proc_handler = proc_dostring,
+		.proc_handler = proc_scheduler,
 	},
 	{
 		.procname = "close_timeout",
--- linux-qcom-6.8.0.orig/net/mptcp/diag.c
+++ linux-qcom-6.8.0/net/mptcp/diag.c
@@ -48,7 +48,7 @@
 		flags |= MPTCP_SUBFLOW_FLAG_BKUP_REM;
 	if (sf->request_bkup)
 		flags |= MPTCP_SUBFLOW_FLAG_BKUP_LOC;
-	if (sf->fully_established)
+	if (READ_ONCE(sf->fully_established))
 		flags |= MPTCP_SUBFLOW_FLAG_FULLY_ESTABLISHED;
 	if (sf->conn_finished)
 		flags |= MPTCP_SUBFLOW_FLAG_CONNECTED;
@@ -95,7 +95,7 @@
 		nla_total_size(4) +	/* MPTCP_SUBFLOW_ATTR_RELWRITE_SEQ */
 		nla_total_size_64bit(8) +	/* MPTCP_SUBFLOW_ATTR_MAP_SEQ */
 		nla_total_size(4) +	/* MPTCP_SUBFLOW_ATTR_MAP_SFSEQ */
-		nla_total_size(2) +	/* MPTCP_SUBFLOW_ATTR_SSN_OFFSET */
+		nla_total_size(4) +	/* MPTCP_SUBFLOW_ATTR_SSN_OFFSET */
 		nla_total_size(2) +	/* MPTCP_SUBFLOW_ATTR_MAP_DATALEN */
 		nla_total_size(4) +	/* MPTCP_SUBFLOW_ATTR_FLAGS */
 		nla_total_size(1) +	/* MPTCP_SUBFLOW_ATTR_ID_REM */
--- linux-qcom-6.8.0.orig/net/mptcp/fastopen.c
+++ linux-qcom-6.8.0/net/mptcp/fastopen.c
@@ -68,12 +68,12 @@
 	skb = skb_peek_tail(&sk->sk_receive_queue);
 	if (skb) {
 		WARN_ON_ONCE(MPTCP_SKB_CB(skb)->end_seq);
-		pr_debug("msk %p moving seq %llx -> %llx end_seq %llx -> %llx", sk,
+		pr_debug("msk %p moving seq %llx -> %llx end_seq %llx -> %llx\n", sk,
 			 MPTCP_SKB_CB(skb)->map_seq, MPTCP_SKB_CB(skb)->map_seq + msk->ack_seq,
 			 MPTCP_SKB_CB(skb)->end_seq, MPTCP_SKB_CB(skb)->end_seq + msk->ack_seq);
 		MPTCP_SKB_CB(skb)->map_seq += msk->ack_seq;
 		MPTCP_SKB_CB(skb)->end_seq += msk->ack_seq;
 	}
 
-	pr_debug("msk=%p ack_seq=%llx", msk, msk->ack_seq);
+	pr_debug("msk=%p ack_seq=%llx\n", msk, msk->ack_seq);
 }
--- linux-qcom-6.8.0.orig/net/mptcp/mib.c
+++ linux-qcom-6.8.0/net/mptcp/mib.c
@@ -15,15 +15,20 @@
 	SNMP_MIB_ITEM("MPCapableACKRX", MPTCP_MIB_MPCAPABLEPASSIVEACK),
 	SNMP_MIB_ITEM("MPCapableFallbackACK", MPTCP_MIB_MPCAPABLEPASSIVEFALLBACK),
 	SNMP_MIB_ITEM("MPCapableFallbackSYNACK", MPTCP_MIB_MPCAPABLEACTIVEFALLBACK),
+	SNMP_MIB_ITEM("MPCapableEndpAttempt", MPTCP_MIB_MPCAPABLEENDPATTEMPT),
 	SNMP_MIB_ITEM("MPFallbackTokenInit", MPTCP_MIB_TOKENFALLBACKINIT),
 	SNMP_MIB_ITEM("MPTCPRetrans", MPTCP_MIB_RETRANSSEGS),
 	SNMP_MIB_ITEM("MPJoinNoTokenFound", MPTCP_MIB_JOINNOTOKEN),
 	SNMP_MIB_ITEM("MPJoinSynRx", MPTCP_MIB_JOINSYNRX),
+	SNMP_MIB_ITEM("MPJoinSynBackupRx", MPTCP_MIB_JOINSYNBACKUPRX),
 	SNMP_MIB_ITEM("MPJoinSynAckRx", MPTCP_MIB_JOINSYNACKRX),
+	SNMP_MIB_ITEM("MPJoinSynAckBackupRx", MPTCP_MIB_JOINSYNACKBACKUPRX),
 	SNMP_MIB_ITEM("MPJoinSynAckHMacFailure", MPTCP_MIB_JOINSYNACKMAC),
 	SNMP_MIB_ITEM("MPJoinAckRx", MPTCP_MIB_JOINACKRX),
 	SNMP_MIB_ITEM("MPJoinAckHMacFailure", MPTCP_MIB_JOINACKMAC),
 	SNMP_MIB_ITEM("DSSNotMatching", MPTCP_MIB_DSSNOMATCH),
+	SNMP_MIB_ITEM("DSSCorruptionFallback", MPTCP_MIB_DSSCORRUPTIONFALLBACK),
+	SNMP_MIB_ITEM("DSSCorruptionReset", MPTCP_MIB_DSSCORRUPTIONRESET),
 	SNMP_MIB_ITEM("InfiniteMapTx", MPTCP_MIB_INFINITEMAPTX),
 	SNMP_MIB_ITEM("InfiniteMapRx", MPTCP_MIB_INFINITEMAPRX),
 	SNMP_MIB_ITEM("DSSNoMatchTCP", MPTCP_MIB_DSSTCPMISMATCH),
--- linux-qcom-6.8.0.orig/net/mptcp/mib.h
+++ linux-qcom-6.8.0/net/mptcp/mib.h
@@ -8,15 +8,20 @@
 	MPTCP_MIB_MPCAPABLEPASSIVEACK,	/* Received third ACK with MP_CAPABLE */
 	MPTCP_MIB_MPCAPABLEPASSIVEFALLBACK,/* Server-side fallback during 3-way handshake */
 	MPTCP_MIB_MPCAPABLEACTIVEFALLBACK, /* Client-side fallback during 3-way handshake */
+	MPTCP_MIB_MPCAPABLEENDPATTEMPT,	/* Prohibited MPC to port-based endp */
 	MPTCP_MIB_TOKENFALLBACKINIT,	/* Could not init/allocate token */
 	MPTCP_MIB_RETRANSSEGS,		/* Segments retransmitted at the MPTCP-level */
 	MPTCP_MIB_JOINNOTOKEN,		/* Received MP_JOIN but the token was not found */
 	MPTCP_MIB_JOINSYNRX,		/* Received a SYN + MP_JOIN */
+	MPTCP_MIB_JOINSYNBACKUPRX,	/* Received a SYN + MP_JOIN + backup flag */
 	MPTCP_MIB_JOINSYNACKRX,		/* Received a SYN/ACK + MP_JOIN */
+	MPTCP_MIB_JOINSYNACKBACKUPRX,	/* Received a SYN/ACK + MP_JOIN + backup flag */
 	MPTCP_MIB_JOINSYNACKMAC,	/* HMAC was wrong on SYN/ACK + MP_JOIN */
 	MPTCP_MIB_JOINACKRX,		/* Received an ACK + MP_JOIN */
 	MPTCP_MIB_JOINACKMAC,		/* HMAC was wrong on ACK + MP_JOIN */
 	MPTCP_MIB_DSSNOMATCH,		/* Received a new mapping that did not match the previous one */
+	MPTCP_MIB_DSSCORRUPTIONFALLBACK,/* DSS corruption detected, fallback */
+	MPTCP_MIB_DSSCORRUPTIONRESET,	/* DSS corruption detected, MPJ subflow reset */
 	MPTCP_MIB_INFINITEMAPTX,	/* Sent an infinite mapping */
 	MPTCP_MIB_INFINITEMAPRX,	/* Received an infinite mapping */
 	MPTCP_MIB_DSSTCPMISMATCH,	/* DSS-mapping did not map with TCP's sequence numbers */
--- linux-qcom-6.8.0.orig/net/mptcp/mptcp_pm_gen.c
+++ linux-qcom-6.8.0/net/mptcp/mptcp_pm_gen.c
@@ -150,7 +150,6 @@
 		.doit		= mptcp_pm_nl_announce_doit,
 		.policy		= mptcp_pm_announce_nl_policy,
 		.maxattr	= MPTCP_PM_ATTR_TOKEN,
-		.flags		= GENL_UNS_ADMIN_PERM,
 	},
 	{
 		.cmd		= MPTCP_PM_CMD_REMOVE,
--- linux-qcom-6.8.0.orig/net/mptcp/options.c
+++ linux-qcom-6.8.0/net/mptcp/options.c
@@ -117,7 +117,7 @@
 			mp_opt->suboptions |= OPTION_MPTCP_CSUMREQD;
 			ptr += 2;
 		}
-		pr_debug("MP_CAPABLE version=%x, flags=%x, optlen=%d sndr=%llu, rcvr=%llu len=%d csum=%u",
+		pr_debug("MP_CAPABLE version=%x, flags=%x, optlen=%d sndr=%llu, rcvr=%llu len=%d csum=%u\n",
 			 version, flags, opsize, mp_opt->sndr_key,
 			 mp_opt->rcvr_key, mp_opt->data_len, mp_opt->csum);
 		break;
@@ -131,7 +131,7 @@
 			ptr += 4;
 			mp_opt->nonce = get_unaligned_be32(ptr);
 			ptr += 4;
-			pr_debug("MP_JOIN bkup=%u, id=%u, token=%u, nonce=%u",
+			pr_debug("MP_JOIN bkup=%u, id=%u, token=%u, nonce=%u\n",
 				 mp_opt->backup, mp_opt->join_id,
 				 mp_opt->token, mp_opt->nonce);
 		} else if (opsize == TCPOLEN_MPTCP_MPJ_SYNACK) {
@@ -142,19 +142,19 @@
 			ptr += 8;
 			mp_opt->nonce = get_unaligned_be32(ptr);
 			ptr += 4;
-			pr_debug("MP_JOIN bkup=%u, id=%u, thmac=%llu, nonce=%u",
+			pr_debug("MP_JOIN bkup=%u, id=%u, thmac=%llu, nonce=%u\n",
 				 mp_opt->backup, mp_opt->join_id,
 				 mp_opt->thmac, mp_opt->nonce);
 		} else if (opsize == TCPOLEN_MPTCP_MPJ_ACK) {
 			mp_opt->suboptions |= OPTION_MPTCP_MPJ_ACK;
 			ptr += 2;
 			memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN);
-			pr_debug("MP_JOIN hmac");
+			pr_debug("MP_JOIN hmac\n");
 		}
 		break;
 
 	case MPTCPOPT_DSS:
-		pr_debug("DSS");
+		pr_debug("DSS\n");
 		ptr++;
 
 		/* we must clear 'mpc_map' be able to detect MP_CAPABLE
@@ -169,7 +169,7 @@
 		mp_opt->ack64 = (flags & MPTCP_DSS_ACK64) != 0;
 		mp_opt->use_ack = (flags & MPTCP_DSS_HAS_ACK);
 
-		pr_debug("data_fin=%d dsn64=%d use_map=%d ack64=%d use_ack=%d",
+		pr_debug("data_fin=%d dsn64=%d use_map=%d ack64=%d use_ack=%d\n",
 			 mp_opt->data_fin, mp_opt->dsn64,
 			 mp_opt->use_map, mp_opt->ack64,
 			 mp_opt->use_ack);
@@ -207,7 +207,7 @@
 				ptr += 4;
 			}
 
-			pr_debug("data_ack=%llu", mp_opt->data_ack);
+			pr_debug("data_ack=%llu\n", mp_opt->data_ack);
 		}
 
 		if (mp_opt->use_map) {
@@ -231,7 +231,7 @@
 				ptr += 2;
 			}
 
-			pr_debug("data_seq=%llu subflow_seq=%u data_len=%u csum=%d:%u",
+			pr_debug("data_seq=%llu subflow_seq=%u data_len=%u csum=%d:%u\n",
 				 mp_opt->data_seq, mp_opt->subflow_seq,
 				 mp_opt->data_len, !!(mp_opt->suboptions & OPTION_MPTCP_CSUMREQD),
 				 mp_opt->csum);
@@ -293,7 +293,7 @@
 			mp_opt->ahmac = get_unaligned_be64(ptr);
 			ptr += 8;
 		}
-		pr_debug("ADD_ADDR%s: id=%d, ahmac=%llu, echo=%d, port=%d",
+		pr_debug("ADD_ADDR%s: id=%d, ahmac=%llu, echo=%d, port=%d\n",
 			 (mp_opt->addr.family == AF_INET6) ? "6" : "",
 			 mp_opt->addr.id, mp_opt->ahmac, mp_opt->echo, ntohs(mp_opt->addr.port));
 		break;
@@ -309,7 +309,7 @@
 		mp_opt->rm_list.nr = opsize - TCPOLEN_MPTCP_RM_ADDR_BASE;
 		for (i = 0; i < mp_opt->rm_list.nr; i++)
 			mp_opt->rm_list.ids[i] = *ptr++;
-		pr_debug("RM_ADDR: rm_list_nr=%d", mp_opt->rm_list.nr);
+		pr_debug("RM_ADDR: rm_list_nr=%d\n", mp_opt->rm_list.nr);
 		break;
 
 	case MPTCPOPT_MP_PRIO:
@@ -318,7 +318,7 @@
 
 		mp_opt->suboptions |= OPTION_MPTCP_PRIO;
 		mp_opt->backup = *ptr++ & MPTCP_PRIO_BKUP;
-		pr_debug("MP_PRIO: prio=%d", mp_opt->backup);
+		pr_debug("MP_PRIO: prio=%d\n", mp_opt->backup);
 		break;
 
 	case MPTCPOPT_MP_FASTCLOSE:
@@ -329,7 +329,7 @@
 		mp_opt->rcvr_key = get_unaligned_be64(ptr);
 		ptr += 8;
 		mp_opt->suboptions |= OPTION_MPTCP_FASTCLOSE;
-		pr_debug("MP_FASTCLOSE: recv_key=%llu", mp_opt->rcvr_key);
+		pr_debug("MP_FASTCLOSE: recv_key=%llu\n", mp_opt->rcvr_key);
 		break;
 
 	case MPTCPOPT_RST:
@@ -343,7 +343,7 @@
 		flags = *ptr++;
 		mp_opt->reset_transient = flags & MPTCP_RST_TRANSIENT;
 		mp_opt->reset_reason = *ptr;
-		pr_debug("MP_RST: transient=%u reason=%u",
+		pr_debug("MP_RST: transient=%u reason=%u\n",
 			 mp_opt->reset_transient, mp_opt->reset_reason);
 		break;
 
@@ -354,7 +354,7 @@
 		ptr += 2;
 		mp_opt->suboptions |= OPTION_MPTCP_FAIL;
 		mp_opt->fail_seq = get_unaligned_be64(ptr);
-		pr_debug("MP_FAIL: data_seq=%llu", mp_opt->fail_seq);
+		pr_debug("MP_FAIL: data_seq=%llu\n", mp_opt->fail_seq);
 		break;
 
 	default:
@@ -417,7 +417,7 @@
 		*size = TCPOLEN_MPTCP_MPC_SYN;
 		return true;
 	} else if (subflow->request_join) {
-		pr_debug("remote_token=%u, nonce=%u", subflow->remote_token,
+		pr_debug("remote_token=%u, nonce=%u\n", subflow->remote_token,
 			 subflow->local_nonce);
 		opts->suboptions = OPTION_MPTCP_MPJ_SYN;
 		opts->join_id = subflow->local_id;
@@ -461,7 +461,7 @@
 		return false;
 
 	/* MPC/MPJ needed only on 3rd ack packet, DATA_FIN and TCP shutdown take precedence */
-	if (subflow->fully_established || snd_data_fin_enable ||
+	if (READ_ONCE(subflow->fully_established) || snd_data_fin_enable ||
 	    subflow->snd_isn != TCP_SKB_CB(skb)->seq ||
 	    sk->sk_state != TCP_ESTABLISHED)
 		return false;
@@ -500,7 +500,7 @@
 			*size = TCPOLEN_MPTCP_MPC_ACK;
 		}
 
-		pr_debug("subflow=%p, local_key=%llu, remote_key=%llu map_len=%d",
+		pr_debug("subflow=%p, local_key=%llu, remote_key=%llu map_len=%d\n",
 			 subflow, subflow->local_key, subflow->remote_key,
 			 data_len);
 
@@ -509,7 +509,7 @@
 		opts->suboptions = OPTION_MPTCP_MPJ_ACK;
 		memcpy(opts->hmac, subflow->hmac, MPTCPOPT_HMAC_LEN);
 		*size = TCPOLEN_MPTCP_MPJ_ACK;
-		pr_debug("subflow=%p", subflow);
+		pr_debug("subflow=%p\n", subflow);
 
 		/* we can use the full delegate action helper only from BH context
 		 * If we are in process context - sk is flushing the backlog at
@@ -607,7 +607,6 @@
 	}
 	opts->ext_copy.use_ack = 1;
 	opts->suboptions = OPTION_MPTCP_DSS;
-	WRITE_ONCE(msk->old_wspace, __mptcp_space((struct sock *)msk));
 
 	/* Add kind/length/subtype/flag overhead if mapping is not populated */
 	if (dss_size == 0)
@@ -667,15 +666,22 @@
 		    &echo, &drop_other_suboptions))
 		return false;
 
+	/*
+	 * Later on, mptcp_write_options() will enforce mutually exclusion with
+	 * DSS, bail out if such option is set and we can't drop it.
+	 */
 	if (drop_other_suboptions)
 		remaining += opt_size;
+	else if (opts->suboptions & OPTION_MPTCP_DSS)
+		return false;
+
 	len = mptcp_add_addr_len(opts->addr.family, echo, !!opts->addr.port);
 	if (remaining < len)
 		return false;
 
 	*size = len;
 	if (drop_other_suboptions) {
-		pr_debug("drop other suboptions");
+		pr_debug("drop other suboptions\n");
 		opts->suboptions = 0;
 
 		/* note that e.g. DSS could have written into the memory
@@ -695,7 +701,7 @@
 	} else {
 		MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ECHOADDTX);
 	}
-	pr_debug("addr_id=%d, ahmac=%llu, echo=%d, port=%d",
+	pr_debug("addr_id=%d, ahmac=%llu, echo=%d, port=%d\n",
 		 opts->addr.id, opts->ahmac, echo, ntohs(opts->addr.port));
 
 	return true;
@@ -726,7 +732,7 @@
 	opts->rm_list = rm_list;
 
 	for (i = 0; i < opts->rm_list.nr; i++)
-		pr_debug("rm_list_ids[%d]=%d", i, opts->rm_list.ids[i]);
+		pr_debug("rm_list_ids[%d]=%d\n", i, opts->rm_list.ids[i]);
 	MPTCP_ADD_STATS(sock_net(sk), MPTCP_MIB_RMADDRTX, opts->rm_list.nr);
 	return true;
 }
@@ -752,7 +758,7 @@
 	opts->suboptions |= OPTION_MPTCP_PRIO;
 	opts->backup = subflow->request_bkup;
 
-	pr_debug("prio=%d", opts->backup);
+	pr_debug("prio=%d\n", opts->backup);
 
 	return true;
 }
@@ -794,7 +800,7 @@
 	opts->suboptions |= OPTION_MPTCP_FASTCLOSE;
 	opts->rcvr_key = msk->remote_key;
 
-	pr_debug("FASTCLOSE key=%llu", opts->rcvr_key);
+	pr_debug("FASTCLOSE key=%llu\n", opts->rcvr_key);
 	MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPFASTCLOSETX);
 	return true;
 }
@@ -816,7 +822,7 @@
 	opts->suboptions |= OPTION_MPTCP_FAIL;
 	opts->fail_seq = subflow->map_seq;
 
-	pr_debug("MP_FAIL fail_seq=%llu", opts->fail_seq);
+	pr_debug("MP_FAIL fail_seq=%llu\n", opts->fail_seq);
 	MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPFAILTX);
 
 	return true;
@@ -904,16 +910,16 @@
 		opts->csum_reqd = subflow_req->csum_reqd;
 		opts->allow_join_id0 = subflow_req->allow_join_id0;
 		*size = TCPOLEN_MPTCP_MPC_SYNACK;
-		pr_debug("subflow_req=%p, local_key=%llu",
+		pr_debug("subflow_req=%p, local_key=%llu\n",
 			 subflow_req, subflow_req->local_key);
 		return true;
 	} else if (subflow_req->mp_join) {
 		opts->suboptions = OPTION_MPTCP_MPJ_SYNACK;
-		opts->backup = subflow_req->backup;
+		opts->backup = subflow_req->request_bkup;
 		opts->join_id = subflow_req->local_id;
 		opts->thmac = subflow_req->thmac;
 		opts->nonce = subflow_req->local_nonce;
-		pr_debug("req=%p, bkup=%u, id=%u, thmac=%llu, nonce=%u",
+		pr_debug("req=%p, bkup=%u, id=%u, thmac=%llu, nonce=%u\n",
 			 subflow_req, opts->backup, opts->join_id,
 			 opts->thmac, opts->nonce);
 		*size = TCPOLEN_MPTCP_MPJ_SYNACK;
@@ -930,7 +936,7 @@
 	/* here we can process OoO, in-window pkts, only in-sequence 4th ack
 	 * will make the subflow fully established
 	 */
-	if (likely(subflow->fully_established)) {
+	if (likely(READ_ONCE(subflow->fully_established))) {
 		/* on passive sockets, check for 3rd ack retransmission
 		 * note that msk is always set by subflow_syn_recv_sock()
 		 * for mp_join subflows
@@ -958,7 +964,8 @@
 
 	if (subflow->remote_key_valid &&
 	    (((mp_opt->suboptions & OPTION_MPTCP_DSS) && mp_opt->use_ack) ||
-	     ((mp_opt->suboptions & OPTION_MPTCP_ADD_ADDR) && !mp_opt->echo))) {
+	     ((mp_opt->suboptions & OPTION_MPTCP_ADD_ADDR) &&
+	      (!mp_opt->echo || subflow->mp_join)))) {
 		/* subflows are fully established as soon as we get any
 		 * additional ack, including ADD_ADDR.
 		 */
@@ -1279,7 +1286,7 @@
 			}
 			MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_RCVWNDCONFLICT);
 		}
-		return;
+		goto update_wspace;
 	}
 
 	if (rcv_wnd_new != rcv_wnd_old) {
@@ -1304,6 +1311,9 @@
 		th->window = htons(new_win);
 		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_RCVWNDSHARED);
 	}
+
+update_wspace:
+	WRITE_ONCE(msk->old_wspace, tp->rcv_wnd);
 }
 
 __sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum)
--- linux-qcom-6.8.0.orig/net/mptcp/pm.c
+++ linux-qcom-6.8.0/net/mptcp/pm.c
@@ -20,7 +20,7 @@
 {
 	u8 add_addr = READ_ONCE(msk->pm.addr_signal);
 
-	pr_debug("msk=%p, local_id=%d, echo=%d", msk, addr->id, echo);
+	pr_debug("msk=%p, local_id=%d, echo=%d\n", msk, addr->id, echo);
 
 	lockdep_assert_held(&msk->pm.lock);
 
@@ -46,7 +46,7 @@
 {
 	u8 rm_addr = READ_ONCE(msk->pm.addr_signal);
 
-	pr_debug("msk=%p, rm_list_nr=%d", msk, rm_list->nr);
+	pr_debug("msk=%p, rm_list_nr=%d\n", msk, rm_list->nr);
 
 	if (rm_addr) {
 		MPTCP_ADD_STATS(sock_net((struct sock *)msk),
@@ -61,23 +61,13 @@
 	return 0;
 }
 
-int mptcp_pm_remove_subflow(struct mptcp_sock *msk, const struct mptcp_rm_list *rm_list)
-{
-	pr_debug("msk=%p, rm_list_nr=%d", msk, rm_list->nr);
-
-	spin_lock_bh(&msk->pm.lock);
-	mptcp_pm_nl_rm_subflow_received(msk, rm_list);
-	spin_unlock_bh(&msk->pm.lock);
-	return 0;
-}
-
 /* path manager event handlers */
 
 void mptcp_pm_new_connection(struct mptcp_sock *msk, const struct sock *ssk, int server_side)
 {
 	struct mptcp_pm_data *pm = &msk->pm;
 
-	pr_debug("msk=%p, token=%u side=%d", msk, msk->token, server_side);
+	pr_debug("msk=%p, token=%u side=%d\n", msk, msk->token, server_side);
 
 	WRITE_ONCE(pm->server_side, server_side);
 	mptcp_event(MPTCP_EVENT_CREATED, msk, ssk, GFP_ATOMIC);
@@ -101,7 +91,7 @@
 
 	subflows_max = mptcp_pm_get_subflows_max(msk);
 
-	pr_debug("msk=%p subflows=%d max=%d allow=%d", msk, pm->subflows,
+	pr_debug("msk=%p subflows=%d max=%d allow=%d\n", msk, pm->subflows,
 		 subflows_max, READ_ONCE(pm->accept_subflow));
 
 	/* try to avoid acquiring the lock below */
@@ -125,7 +115,7 @@
 static bool mptcp_pm_schedule_work(struct mptcp_sock *msk,
 				   enum mptcp_pm_status new_status)
 {
-	pr_debug("msk=%p status=%x new=%lx", msk, msk->pm.status,
+	pr_debug("msk=%p status=%x new=%lx\n", msk, msk->pm.status,
 		 BIT(new_status));
 	if (msk->pm.status & BIT(new_status))
 		return false;
@@ -140,7 +130,7 @@
 	struct mptcp_pm_data *pm = &msk->pm;
 	bool announce = false;
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	spin_lock_bh(&pm->lock);
 
@@ -164,14 +154,14 @@
 
 void mptcp_pm_connection_closed(struct mptcp_sock *msk)
 {
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 }
 
 void mptcp_pm_subflow_established(struct mptcp_sock *msk)
 {
 	struct mptcp_pm_data *pm = &msk->pm;
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	if (!READ_ONCE(pm->work_pending))
 		return;
@@ -223,7 +213,7 @@
 	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
 	struct mptcp_pm_data *pm = &msk->pm;
 
-	pr_debug("msk=%p remote_id=%d accept=%d", msk, addr->id,
+	pr_debug("msk=%p remote_id=%d accept=%d\n", msk, addr->id,
 		 READ_ONCE(pm->accept_addr));
 
 	mptcp_event_addr_announced(ssk, addr);
@@ -237,7 +227,9 @@
 		} else {
 			__MPTCP_INC_STATS(sock_net((struct sock *)msk), MPTCP_MIB_ADDADDRDROP);
 		}
-	} else if (!READ_ONCE(pm->accept_addr)) {
+	/* id0 should not have a different address */
+	} else if ((addr->id == 0 && !mptcp_pm_nl_is_init_remote_addr(msk, addr)) ||
+		   (addr->id > 0 && !READ_ONCE(pm->accept_addr))) {
 		mptcp_pm_announce_addr(msk, addr, true);
 		mptcp_pm_add_addr_send_ack(msk);
 	} else if (mptcp_pm_schedule_work(msk, MPTCP_PM_ADD_ADDR_RECEIVED)) {
@@ -254,7 +246,7 @@
 {
 	struct mptcp_pm_data *pm = &msk->pm;
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	spin_lock_bh(&pm->lock);
 
@@ -278,7 +270,7 @@
 	struct mptcp_pm_data *pm = &msk->pm;
 	u8 i;
 
-	pr_debug("msk=%p remote_ids_nr=%d", msk, rm_list->nr);
+	pr_debug("msk=%p remote_ids_nr=%d\n", msk, rm_list->nr);
 
 	for (i = 0; i < rm_list->nr; i++)
 		mptcp_event_addr_removed(msk, rm_list->ids[i]);
@@ -310,19 +302,19 @@
 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
 	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
 
-	pr_debug("fail_seq=%llu", fail_seq);
+	pr_debug("fail_seq=%llu\n", fail_seq);
 
 	if (!READ_ONCE(msk->allow_infinite_fallback))
 		return;
 
 	if (!subflow->fail_tout) {
-		pr_debug("send MP_FAIL response and infinite map");
+		pr_debug("send MP_FAIL response and infinite map\n");
 
 		subflow->send_mp_fail = 1;
 		subflow->send_infinite_map = 1;
 		tcp_send_ack(sk);
 	} else {
-		pr_debug("MP_FAIL response received");
+		pr_debug("MP_FAIL response received\n");
 		WRITE_ONCE(subflow->fail_tout, 0);
 	}
 }
@@ -427,15 +419,24 @@
 	return mptcp_pm_nl_get_local_id(msk, &skc_local);
 }
 
+bool mptcp_pm_is_backup(struct mptcp_sock *msk, struct sock_common *skc)
+{
+	struct mptcp_addr_info skc_local;
+
+	mptcp_local_address((struct sock_common *)skc, &skc_local);
+
+	if (mptcp_pm_is_userspace(msk))
+		return mptcp_userspace_pm_is_backup(msk, &skc_local);
+
+	return mptcp_pm_nl_is_backup(msk, &skc_local);
+}
+
 int mptcp_pm_get_flags_and_ifindex_by_id(struct mptcp_sock *msk, unsigned int id,
 					 u8 *flags, int *ifindex)
 {
 	*flags = 0;
 	*ifindex = 0;
 
-	if (!id)
-		return 0;
-
 	if (mptcp_pm_is_userspace(msk))
 		return mptcp_userspace_pm_get_flags_and_ifindex_by_id(msk, id, flags, ifindex);
 	return mptcp_pm_nl_get_flags_and_ifindex_by_id(msk, id, flags, ifindex);
--- linux-qcom-6.8.0.orig/net/mptcp/pm_netlink.c
+++ linux-qcom-6.8.0/net/mptcp/pm_netlink.c
@@ -135,12 +135,15 @@
 {
 	struct mptcp_subflow_context *subflow;
 	struct mptcp_addr_info cur;
-	struct sock_common *skc;
 
 	list_for_each_entry(subflow, list, node) {
-		skc = (struct sock_common *)mptcp_subflow_tcp_sock(subflow);
+		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+
+		if (!((1 << inet_sk_state_load(ssk)) &
+		      (TCPF_ESTABLISHED | TCPF_SYN_SENT | TCPF_SYN_RECV)))
+			continue;
 
-		remote_address(skc, &cur);
+		remote_address((struct sock_common *)ssk, &cur);
 		if (mptcp_addresses_equal(&cur, daddr, daddr->port))
 			return true;
 	}
@@ -148,11 +151,13 @@
 	return false;
 }
 
-static struct mptcp_pm_addr_entry *
+static bool
 select_local_address(const struct pm_nl_pernet *pernet,
-		     const struct mptcp_sock *msk)
+		     const struct mptcp_sock *msk,
+		     struct mptcp_pm_addr_entry *new_entry)
 {
-	struct mptcp_pm_addr_entry *entry, *ret = NULL;
+	struct mptcp_pm_addr_entry *entry;
+	bool found = false;
 
 	msk_owned_by_me(msk);
 
@@ -164,17 +169,21 @@
 		if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap))
 			continue;
 
-		ret = entry;
+		*new_entry = *entry;
+		found = true;
 		break;
 	}
 	rcu_read_unlock();
-	return ret;
+
+	return found;
 }
 
-static struct mptcp_pm_addr_entry *
-select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk)
+static bool
+select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk,
+		      struct mptcp_pm_addr_entry *new_entry)
 {
-	struct mptcp_pm_addr_entry *entry, *ret = NULL;
+	struct mptcp_pm_addr_entry *entry;
+	bool found = false;
 
 	rcu_read_lock();
 	/* do not keep any additional per socket state, just signal
@@ -189,11 +198,13 @@
 		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL))
 			continue;
 
-		ret = entry;
+		*new_entry = *entry;
+		found = true;
 		break;
 	}
 	rcu_read_unlock();
-	return ret;
+
+	return found;
 }
 
 unsigned int mptcp_pm_get_add_addr_signal_max(const struct mptcp_sock *msk)
@@ -284,7 +295,7 @@
 	struct mptcp_sock *msk = entry->sock;
 	struct sock *sk = (struct sock *)msk;
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	if (!msk)
 		return;
@@ -303,7 +314,7 @@
 	spin_lock_bh(&msk->pm.lock);
 
 	if (!mptcp_pm_should_add_signal_addr(msk)) {
-		pr_debug("retransmit ADD_ADDR id=%d", entry->addr.id);
+		pr_debug("retransmit ADD_ADDR id=%d\n", entry->addr.id);
 		mptcp_pm_announce_addr(msk, &entry->addr, false);
 		mptcp_pm_add_addr_send_ack(msk);
 		entry->retrans_times++;
@@ -328,15 +339,21 @@
 {
 	struct mptcp_pm_add_entry *entry;
 	struct sock *sk = (struct sock *)msk;
+	struct timer_list *add_timer = NULL;
 
 	spin_lock_bh(&msk->pm.lock);
 	entry = mptcp_lookup_anno_list_by_saddr(msk, addr);
-	if (entry && (!check_id || entry->addr.id == addr->id))
+	if (entry && (!check_id || entry->addr.id == addr->id)) {
 		entry->retrans_times = ADD_ADDR_RETRANS_MAX;
+		add_timer = &entry->add_timer;
+	}
+	if (!check_id && entry)
+		list_del(&entry->list);
 	spin_unlock_bh(&msk->pm.lock);
 
-	if (entry && (!check_id || entry->addr.id == addr->id))
-		sk_stop_timer_sync(sk, &entry->add_timer);
+	/* no lock, because sk_stop_timer_sync() is calling del_timer_sync() */
+	if (add_timer)
+		sk_stop_timer_sync(sk, add_timer);
 
 	return entry;
 }
@@ -353,7 +370,7 @@
 	add_entry = mptcp_lookup_anno_list_by_saddr(msk, addr);
 
 	if (add_entry) {
-		if (mptcp_pm_is_kernel(msk))
+		if (WARN_ON_ONCE(mptcp_pm_is_kernel(msk)))
 			return false;
 
 		sk_reset_timer(sk, &add_entry->add_timer,
@@ -384,7 +401,7 @@
 	struct sock *sk = (struct sock *)msk;
 	LIST_HEAD(free_list);
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	spin_lock_bh(&msk->pm.lock);
 	list_splice_init(&msk->pm.anno_list, &free_list);
@@ -470,13 +487,12 @@
 	struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
 	bool slow;
 
-	pr_debug("send ack for %s",
+	pr_debug("send ack for %s\n",
 		 prio ? "mp_prio" : (mptcp_pm_should_add_signal(msk) ? "add_addr" : "rm_addr"));
 
 	slow = lock_sock_fast(ssk);
 	if (prio) {
 		subflow->send_mp_prio = 1;
-		subflow->backup = backup;
 		subflow->request_bkup = backup;
 	}
 
@@ -505,15 +521,13 @@
 }
 
 static struct mptcp_pm_addr_entry *
-__lookup_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *info,
-	      bool lookup_by_id)
+__lookup_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *info)
 {
 	struct mptcp_pm_addr_entry *entry;
 
-	list_for_each_entry(entry, &pernet->local_addr_list, list) {
-		if ((!lookup_by_id &&
-		     mptcp_addresses_equal(&entry->addr, info, entry->addr.port)) ||
-		    (lookup_by_id && entry->addr.id == info->id))
+	list_for_each_entry_rcu(entry, &pernet->local_addr_list, list,
+				lockdep_is_held(&pernet->lock)) {
+		if (mptcp_addresses_equal(&entry->addr, info, entry->addr.port))
 			return entry;
 	}
 	return NULL;
@@ -522,8 +536,9 @@
 static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
 {
 	struct sock *sk = (struct sock *)msk;
-	struct mptcp_pm_addr_entry *local;
+	struct mptcp_pm_addr_entry local;
 	unsigned int add_addr_signal_max;
+	bool signal_and_subflow = false;
 	unsigned int local_addr_max;
 	struct pm_nl_pernet *pernet;
 	unsigned int subflows_max;
@@ -543,7 +558,7 @@
 
 		mptcp_local_address((struct sock_common *)msk->first, &mpc_addr);
 		rcu_read_lock();
-		entry = __lookup_addr(pernet, &mpc_addr, false);
+		entry = __lookup_addr(pernet, &mpc_addr);
 		if (entry) {
 			__clear_bit(entry->addr.id, msk->pm.id_avail_bitmap);
 			msk->mpc_endpoint_id = entry->addr.id;
@@ -564,8 +579,6 @@
 
 	/* check first for announce */
 	if (msk->pm.add_addr_signaled < add_addr_signal_max) {
-		local = select_signal_address(pernet, msk);
-
 		/* due to racing events on both ends we can reach here while
 		 * previous add address is still running: if we invoke now
 		 * mptcp_pm_announce_addr(), that will fail and the
@@ -576,16 +589,30 @@
 		if (msk->pm.addr_signal & BIT(MPTCP_ADD_ADDR_SIGNAL))
 			return;
 
-		if (local) {
-			if (mptcp_pm_alloc_anno_list(msk, &local->addr)) {
-				__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
-				msk->pm.add_addr_signaled++;
-				mptcp_pm_announce_addr(msk, &local->addr, false);
-				mptcp_pm_nl_addr_send_ack(msk);
-			}
-		}
+		if (!select_signal_address(pernet, msk, &local))
+			goto subflow;
+
+		/* If the alloc fails, we are on memory pressure, not worth
+		 * continuing, and trying to create subflows.
+		 */
+		if (!mptcp_pm_alloc_anno_list(msk, &local.addr))
+			return;
+
+		__clear_bit(local.addr.id, msk->pm.id_avail_bitmap);
+		msk->pm.add_addr_signaled++;
+
+		/* Special case for ID0: set the correct ID */
+		if (local.addr.id == msk->mpc_endpoint_id)
+			local.addr.id = 0;
+
+		mptcp_pm_announce_addr(msk, &local.addr, false);
+		mptcp_pm_nl_addr_send_ack(msk);
+
+		if (local.flags & MPTCP_PM_ADDR_FLAG_SUBFLOW)
+			signal_and_subflow = true;
 	}
 
+subflow:
 	/* check if should create a new subflow */
 	while (msk->pm.local_addr_used < local_addr_max &&
 	       msk->pm.subflows < subflows_max) {
@@ -593,21 +620,28 @@
 		bool fullmesh;
 		int i, nr;
 
-		local = select_local_address(pernet, msk);
-		if (!local)
+		if (signal_and_subflow)
+			signal_and_subflow = false;
+		else if (!select_local_address(pernet, msk, &local))
 			break;
 
-		fullmesh = !!(local->flags & MPTCP_PM_ADDR_FLAG_FULLMESH);
+		fullmesh = !!(local.flags & MPTCP_PM_ADDR_FLAG_FULLMESH);
 
-		msk->pm.local_addr_used++;
-		__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
-		nr = fill_remote_addresses_vec(msk, &local->addr, fullmesh, addrs);
+		__clear_bit(local.addr.id, msk->pm.id_avail_bitmap);
+
+		/* Special case for ID0: set the correct ID */
+		if (local.addr.id == msk->mpc_endpoint_id)
+			local.addr.id = 0;
+		else /* local_addr_used is not decr for ID 0 */
+			msk->pm.local_addr_used++;
+
+		nr = fill_remote_addresses_vec(msk, &local.addr, fullmesh, addrs);
 		if (nr == 0)
 			continue;
 
 		spin_unlock_bh(&msk->pm.lock);
 		for (i = 0; i < nr; i++)
-			__mptcp_subflow_connect(sk, &local->addr, &addrs[i]);
+			__mptcp_subflow_connect(sk, &local.addr, &addrs[i]);
 		spin_lock_bh(&msk->pm.lock);
 	}
 	mptcp_pm_nl_check_work_pending(msk);
@@ -632,6 +666,7 @@
 {
 	struct sock *sk = (struct sock *)msk;
 	struct mptcp_pm_addr_entry *entry;
+	struct mptcp_addr_info mpc_addr;
 	struct pm_nl_pernet *pernet;
 	unsigned int subflows_max;
 	int i = 0;
@@ -639,6 +674,8 @@
 	pernet = pm_nl_get_pernet_from_msk(msk);
 	subflows_max = mptcp_pm_get_subflows_max(msk);
 
+	mptcp_local_address((struct sock_common *)msk, &mpc_addr);
+
 	rcu_read_lock();
 	list_for_each_entry_rcu(entry, &pernet->local_addr_list, list) {
 		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_FULLMESH))
@@ -649,7 +686,13 @@
 
 		if (msk->pm.subflows < subflows_max) {
 			msk->pm.subflows++;
-			addrs[i++] = entry->addr;
+			addrs[i] = entry->addr;
+
+			/* Special case for ID0: set the correct ID */
+			if (mptcp_addresses_equal(&entry->addr, &mpc_addr, entry->addr.port))
+				addrs[i].id = 0;
+
+			i++;
 		}
 	}
 	rcu_read_unlock();
@@ -685,12 +728,13 @@
 	unsigned int add_addr_accept_max;
 	struct mptcp_addr_info remote;
 	unsigned int subflows_max;
+	bool sf_created = false;
 	int i, nr;
 
 	add_addr_accept_max = mptcp_pm_get_add_addr_accept_max(msk);
 	subflows_max = mptcp_pm_get_subflows_max(msk);
 
-	pr_debug("accepted %d:%d remote family %d",
+	pr_debug("accepted %d:%d remote family %d\n",
 		 msk->pm.add_addr_accepted, add_addr_accept_max,
 		 msk->pm.remote.family);
 
@@ -712,15 +756,29 @@
 	if (nr == 0)
 		return;
 
-	msk->pm.add_addr_accepted++;
-	if (msk->pm.add_addr_accepted >= add_addr_accept_max ||
-	    msk->pm.subflows >= subflows_max)
-		WRITE_ONCE(msk->pm.accept_addr, false);
-
 	spin_unlock_bh(&msk->pm.lock);
 	for (i = 0; i < nr; i++)
-		__mptcp_subflow_connect(sk, &addrs[i], &remote);
+		if (__mptcp_subflow_connect(sk, &addrs[i], &remote) == 0)
+			sf_created = true;
 	spin_lock_bh(&msk->pm.lock);
+
+	if (sf_created) {
+		/* add_addr_accepted is not decr for ID 0 */
+		if (remote.id)
+			msk->pm.add_addr_accepted++;
+		if (msk->pm.add_addr_accepted >= add_addr_accept_max ||
+		    msk->pm.subflows >= subflows_max)
+			WRITE_ONCE(msk->pm.accept_addr, false);
+	}
+}
+
+bool mptcp_pm_nl_is_init_remote_addr(struct mptcp_sock *msk,
+				     const struct mptcp_addr_info *remote)
+{
+	struct mptcp_addr_info mpc_remote;
+
+	remote_address((struct sock_common *)msk, &mpc_remote);
+	return mptcp_addresses_equal(&mpc_remote, remote, remote->port);
 }
 
 void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk)
@@ -734,9 +792,12 @@
 	    !mptcp_pm_should_rm_signal(msk))
 		return;
 
-	subflow = list_first_entry_or_null(&msk->conn_list, typeof(*subflow), node);
-	if (subflow)
-		mptcp_pm_send_ack(msk, subflow, false, false);
+	mptcp_for_each_subflow(msk, subflow) {
+		if (__mptcp_subflow_active(subflow)) {
+			mptcp_pm_send_ack(msk, subflow, false, false);
+			break;
+		}
+	}
 }
 
 int mptcp_pm_nl_mp_prio_send_ack(struct mptcp_sock *msk,
@@ -746,7 +807,7 @@
 {
 	struct mptcp_subflow_context *subflow;
 
-	pr_debug("bkup=%d", bkup);
+	pr_debug("bkup=%d\n", bkup);
 
 	mptcp_for_each_subflow(msk, subflow) {
 		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
@@ -769,11 +830,6 @@
 	return -EINVAL;
 }
 
-static bool mptcp_local_id_match(const struct mptcp_sock *msk, u8 local_id, u8 id)
-{
-	return local_id == id || (!local_id && msk->mpc_endpoint_id == id);
-}
-
 static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk,
 					   const struct mptcp_rm_list *rm_list,
 					   enum linux_mptcp_mib_field rm_type)
@@ -782,7 +838,7 @@
 	struct sock *sk = (struct sock *)msk;
 	u8 i;
 
-	pr_debug("%s rm_list_nr %d",
+	pr_debug("%s rm_list_nr %d\n",
 		 rm_type == MPTCP_MIB_RMADDR ? "address" : "subflow", rm_list->nr);
 
 	msk_owned_by_me(msk);
@@ -806,37 +862,45 @@
 			int how = RCV_SHUTDOWN | SEND_SHUTDOWN;
 			u8 id = subflow_get_local_id(subflow);
 
+			if ((1 << inet_sk_state_load(ssk)) &
+			    (TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | TCPF_CLOSING | TCPF_CLOSE))
+				continue;
 			if (rm_type == MPTCP_MIB_RMADDR && remote_id != rm_id)
 				continue;
-			if (rm_type == MPTCP_MIB_RMSUBFLOW && !mptcp_local_id_match(msk, id, rm_id))
+			if (rm_type == MPTCP_MIB_RMSUBFLOW && id != rm_id)
 				continue;
 
-			pr_debug(" -> %s rm_list_ids[%d]=%u local_id=%u remote_id=%u mpc_id=%u",
+			pr_debug(" -> %s rm_list_ids[%d]=%u local_id=%u remote_id=%u mpc_id=%u\n",
 				 rm_type == MPTCP_MIB_RMADDR ? "address" : "subflow",
 				 i, rm_id, id, remote_id, msk->mpc_endpoint_id);
 			spin_unlock_bh(&msk->pm.lock);
 			mptcp_subflow_shutdown(sk, ssk, how);
+			removed |= subflow->request_join;
 
 			/* the following takes care of updating the subflows counter */
 			mptcp_close_ssk(sk, ssk, subflow);
 			spin_lock_bh(&msk->pm.lock);
 
-			removed = true;
-			__MPTCP_INC_STATS(sock_net(sk), rm_type);
+			if (rm_type == MPTCP_MIB_RMSUBFLOW)
+				__MPTCP_INC_STATS(sock_net(sk), rm_type);
 		}
-		if (rm_type == MPTCP_MIB_RMSUBFLOW)
-			__set_bit(rm_id ? rm_id : msk->mpc_endpoint_id, msk->pm.id_avail_bitmap);
+
+		if (rm_type == MPTCP_MIB_RMADDR)
+			__MPTCP_INC_STATS(sock_net(sk), rm_type);
+
 		if (!removed)
 			continue;
 
 		if (!mptcp_pm_is_kernel(msk))
 			continue;
 
-		if (rm_type == MPTCP_MIB_RMADDR) {
-			msk->pm.add_addr_accepted--;
-			WRITE_ONCE(msk->pm.accept_addr, true);
-		} else if (rm_type == MPTCP_MIB_RMSUBFLOW) {
-			msk->pm.local_addr_used--;
+		if (rm_type == MPTCP_MIB_RMADDR && rm_id &&
+		    !WARN_ON_ONCE(msk->pm.add_addr_accepted == 0)) {
+			/* Note: if the subflow has been closed before, this
+			 * add_addr_accepted counter will not be decremented.
+			 */
+			if (--msk->pm.add_addr_accepted < mptcp_pm_get_add_addr_accept_max(msk))
+				WRITE_ONCE(msk->pm.accept_addr, true);
 		}
 	}
 }
@@ -846,8 +910,8 @@
 	mptcp_pm_nl_rm_addr_or_subflow(msk, &msk->pm.rm_list_rx, MPTCP_MIB_RMADDR);
 }
 
-void mptcp_pm_nl_rm_subflow_received(struct mptcp_sock *msk,
-				     const struct mptcp_rm_list *rm_list)
+static void mptcp_pm_nl_rm_subflow_received(struct mptcp_sock *msk,
+					    const struct mptcp_rm_list *rm_list)
 {
 	mptcp_pm_nl_rm_addr_or_subflow(msk, rm_list, MPTCP_MIB_RMSUBFLOW);
 }
@@ -863,7 +927,7 @@
 
 	spin_lock_bh(&msk->pm.lock);
 
-	pr_debug("msk=%p status=%x", msk, pm->status);
+	pr_debug("msk=%p status=%x\n", msk, pm->status);
 	if (pm->status & BIT(MPTCP_PM_ADD_ADDR_RECEIVED)) {
 		pm->status &= ~BIT(MPTCP_PM_ADD_ADDR_RECEIVED);
 		mptcp_pm_nl_add_addr_received(msk);
@@ -905,7 +969,7 @@
 
 static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
 					     struct mptcp_pm_addr_entry *entry,
-					     bool needs_id)
+					     bool needs_id, bool replace)
 {
 	struct mptcp_pm_addr_entry *cur, *del_entry = NULL;
 	unsigned int addr_max;
@@ -945,6 +1009,17 @@
 			if (entry->addr.id)
 				goto out;
 
+			/* allow callers that only need to look up the local
+			 * addr's id to skip replacement. This allows them to
+			 * avoid calling synchronize_rcu in the packet recv
+			 * path.
+			 */
+			if (!replace) {
+				kfree(entry);
+				ret = cur->addr.id;
+				goto out;
+			}
+
 			pernet->addrs--;
 			entry->addr.id = cur->addr.id;
 			list_del_rcu(&cur->list);
@@ -1059,6 +1134,7 @@
 	 */
 	inet_sk_state_store(newsk, TCP_LISTEN);
 	lock_sock(ssk);
+	WRITE_ONCE(mptcp_subflow_ctx(ssk)->pm_listener, true);
 	err = __inet_listen_sk(ssk, backlog);
 	if (!err)
 		mptcp_event_pm_listener(ssk, MPTCP_EVENT_LISTENER_CREATED);
@@ -1096,13 +1172,31 @@
 	entry->ifindex = 0;
 	entry->flags = MPTCP_PM_ADDR_FLAG_IMPLICIT;
 	entry->lsk = NULL;
-	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true);
+	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true, false);
 	if (ret < 0)
 		kfree(entry);
 
 	return ret;
 }
 
+bool mptcp_pm_nl_is_backup(struct mptcp_sock *msk, struct mptcp_addr_info *skc)
+{
+	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
+	struct mptcp_pm_addr_entry *entry;
+	bool backup = false;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(entry, &pernet->local_addr_list, list) {
+		if (mptcp_addresses_equal(&entry->addr, skc, entry->addr.port)) {
+			backup = !!(entry->flags & MPTCP_PM_ADDR_FLAG_BACKUP);
+			break;
+		}
+	}
+	rcu_read_unlock();
+
+	return backup;
+}
+
 #define MPTCP_PM_CMD_GRP_OFFSET       0
 #define MPTCP_PM_EV_GRP_OFFSET        1
 
@@ -1263,20 +1357,27 @@
 	return pm_nl_get_pernet(genl_info_net(info));
 }
 
-static int mptcp_nl_add_subflow_or_signal_addr(struct net *net)
+static int mptcp_nl_add_subflow_or_signal_addr(struct net *net,
+					       struct mptcp_addr_info *addr)
 {
 	struct mptcp_sock *msk;
 	long s_slot = 0, s_num = 0;
 
 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
 		struct sock *sk = (struct sock *)msk;
+		struct mptcp_addr_info mpc_addr;
 
 		if (!READ_ONCE(msk->fully_established) ||
 		    mptcp_pm_is_userspace(msk))
 			goto next;
 
+		/* if the endp linked to the init sf is re-added with a != ID */
+		mptcp_local_address((struct sock_common *)msk, &mpc_addr);
+
 		lock_sock(sk);
 		spin_lock_bh(&msk->pm.lock);
+		if (mptcp_addresses_equal(addr, &mpc_addr, addr->port))
+			msk->mpc_endpoint_id = addr->id;
 		mptcp_pm_create_subflow_or_signal_addr(msk);
 		spin_unlock_bh(&msk->pm.lock);
 		release_sock(sk);
@@ -1312,8 +1413,8 @@
 	if (ret < 0)
 		return ret;
 
-	if (addr.addr.port && !(addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) {
-		GENL_SET_ERR_MSG(info, "flags must have signal when using port");
+	if (addr.addr.port && !address_use_port(&addr)) {
+		GENL_SET_ERR_MSG(info, "flags must have signal and not subflow when using port");
 		return -EINVAL;
 	}
 
@@ -1343,13 +1444,14 @@
 		}
 	}
 	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry,
-						!mptcp_pm_has_addr_attr_id(attr, info));
+						!mptcp_pm_has_addr_attr_id(attr, info),
+						true);
 	if (ret < 0) {
 		GENL_SET_ERR_MSG_FMT(info, "too many addresses or duplicate one: %d", ret);
 		goto out_free;
 	}
 
-	mptcp_nl_add_subflow_or_signal_addr(sock_net(skb->sk));
+	mptcp_nl_add_subflow_or_signal_addr(sock_net(skb->sk), &entry->addr);
 	return 0;
 
 out_free:
@@ -1364,6 +1466,10 @@
 	struct sock *sk = (struct sock *)msk;
 	struct net *net = sock_net(sk);
 
+	/* No entries with ID 0 */
+	if (id == 0)
+		return 0;
+
 	rcu_read_lock();
 	entry = __lookup_addr_by_id(pm_nl_get_pernet(net), id);
 	if (entry) {
@@ -1382,7 +1488,6 @@
 
 	entry = mptcp_pm_del_add_timer(msk, addr, false);
 	if (entry) {
-		list_del(&entry->list);
 		kfree(entry);
 		return true;
 	}
@@ -1390,6 +1495,12 @@
 	return false;
 }
 
+static u8 mptcp_endp_get_local_id(struct mptcp_sock *msk,
+				  const struct mptcp_addr_info *addr)
+{
+	return msk->mpc_endpoint_id == addr->id ? 0 : addr->id;
+}
+
 static bool mptcp_pm_remove_anno_addr(struct mptcp_sock *msk,
 				      const struct mptcp_addr_info *addr,
 				      bool force)
@@ -1397,28 +1508,38 @@
 	struct mptcp_rm_list list = { .nr = 0 };
 	bool ret;
 
-	list.ids[list.nr++] = addr->id;
+	list.ids[list.nr++] = mptcp_endp_get_local_id(msk, addr);
 
 	ret = remove_anno_list_by_saddr(msk, addr);
 	if (ret || force) {
 		spin_lock_bh(&msk->pm.lock);
+		if (ret) {
+			__set_bit(addr->id, msk->pm.id_avail_bitmap);
+			msk->pm.add_addr_signaled--;
+		}
 		mptcp_pm_remove_addr(msk, &list);
 		spin_unlock_bh(&msk->pm.lock);
 	}
 	return ret;
 }
 
+static void __mark_subflow_endp_available(struct mptcp_sock *msk, u8 id)
+{
+	/* If it was marked as used, and not ID 0, decrement local_addr_used */
+	if (!__test_and_set_bit(id ? : msk->mpc_endpoint_id, msk->pm.id_avail_bitmap) &&
+	    id && !WARN_ON_ONCE(msk->pm.local_addr_used == 0))
+		msk->pm.local_addr_used--;
+}
+
 static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net,
 						   const struct mptcp_pm_addr_entry *entry)
 {
 	const struct mptcp_addr_info *addr = &entry->addr;
-	struct mptcp_rm_list list = { .nr = 0 };
+	struct mptcp_rm_list list = { .nr = 1 };
 	long s_slot = 0, s_num = 0;
 	struct mptcp_sock *msk;
 
-	pr_debug("remove_id=%d", addr->id);
-
-	list.ids[list.nr++] = addr->id;
+	pr_debug("remove_id=%d\n", addr->id);
 
 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
 		struct sock *sk = (struct sock *)msk;
@@ -1436,8 +1557,22 @@
 		remove_subflow = lookup_subflow_by_saddr(&msk->conn_list, addr);
 		mptcp_pm_remove_anno_addr(msk, addr, remove_subflow &&
 					  !(entry->flags & MPTCP_PM_ADDR_FLAG_IMPLICIT));
-		if (remove_subflow)
-			mptcp_pm_remove_subflow(msk, &list);
+
+		list.ids[0] = mptcp_endp_get_local_id(msk, addr);
+		if (remove_subflow) {
+			spin_lock_bh(&msk->pm.lock);
+			mptcp_pm_nl_rm_subflow_received(msk, &list);
+			spin_unlock_bh(&msk->pm.lock);
+		}
+
+		if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
+			spin_lock_bh(&msk->pm.lock);
+			__mark_subflow_endp_available(msk, list.ids[0]);
+			spin_unlock_bh(&msk->pm.lock);
+		}
+
+		if (msk->mpc_endpoint_id == entry->addr.id)
+			msk->mpc_endpoint_id = 0;
 		release_sock(sk);
 
 next:
@@ -1472,6 +1607,7 @@
 		spin_lock_bh(&msk->pm.lock);
 		mptcp_pm_remove_addr(msk, &list);
 		mptcp_pm_nl_rm_subflow_received(msk, &list);
+		__mark_subflow_endp_available(msk, 0);
 		spin_unlock_bh(&msk->pm.lock);
 		release_sock(sk);
 
@@ -1531,48 +1667,63 @@
 	return ret;
 }
 
+/* Called from the userspace PM only */
 void mptcp_pm_remove_addrs(struct mptcp_sock *msk, struct list_head *rm_list)
 {
 	struct mptcp_rm_list alist = { .nr = 0 };
 	struct mptcp_pm_addr_entry *entry;
+	int anno_nr = 0;
 
 	list_for_each_entry(entry, rm_list, list) {
-		if ((remove_anno_list_by_saddr(msk, &entry->addr) ||
-		     lookup_subflow_by_saddr(&msk->conn_list, &entry->addr)) &&
-		    alist.nr < MPTCP_RM_IDS_MAX)
-			alist.ids[alist.nr++] = entry->addr.id;
+		if (alist.nr >= MPTCP_RM_IDS_MAX)
+			break;
+
+		/* only delete if either announced or matching a subflow */
+		if (remove_anno_list_by_saddr(msk, &entry->addr))
+			anno_nr++;
+		else if (!lookup_subflow_by_saddr(&msk->conn_list,
+						  &entry->addr))
+			continue;
+
+		alist.ids[alist.nr++] = entry->addr.id;
 	}
 
 	if (alist.nr) {
 		spin_lock_bh(&msk->pm.lock);
+		msk->pm.add_addr_signaled -= anno_nr;
 		mptcp_pm_remove_addr(msk, &alist);
 		spin_unlock_bh(&msk->pm.lock);
 	}
 }
 
-void mptcp_pm_remove_addrs_and_subflows(struct mptcp_sock *msk,
-					struct list_head *rm_list)
+/* Called from the in-kernel PM only */
+static void mptcp_pm_remove_addrs_and_subflows(struct mptcp_sock *msk,
+					       struct list_head *rm_list)
 {
 	struct mptcp_rm_list alist = { .nr = 0 }, slist = { .nr = 0 };
 	struct mptcp_pm_addr_entry *entry;
 
 	list_for_each_entry(entry, rm_list, list) {
-		if (lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) &&
-		    slist.nr < MPTCP_RM_IDS_MAX)
-			slist.ids[slist.nr++] = entry->addr.id;
-
-		if (remove_anno_list_by_saddr(msk, &entry->addr) &&
-		    alist.nr < MPTCP_RM_IDS_MAX)
-			alist.ids[alist.nr++] = entry->addr.id;
+		if (slist.nr < MPTCP_RM_IDS_MAX &&
+		    lookup_subflow_by_saddr(&msk->conn_list, &entry->addr))
+			slist.ids[slist.nr++] = mptcp_endp_get_local_id(msk, &entry->addr);
+
+		if (alist.nr < MPTCP_RM_IDS_MAX &&
+		    remove_anno_list_by_saddr(msk, &entry->addr))
+			alist.ids[alist.nr++] = mptcp_endp_get_local_id(msk, &entry->addr);
 	}
 
+	spin_lock_bh(&msk->pm.lock);
 	if (alist.nr) {
-		spin_lock_bh(&msk->pm.lock);
+		msk->pm.add_addr_signaled -= alist.nr;
 		mptcp_pm_remove_addr(msk, &alist);
-		spin_unlock_bh(&msk->pm.lock);
 	}
 	if (slist.nr)
-		mptcp_pm_remove_subflow(msk, &slist);
+		mptcp_pm_nl_rm_subflow_received(msk, &slist);
+	/* Reset counters: maybe some subflows have been removed before */
+	bitmap_fill(msk->pm.id_avail_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
+	msk->pm.local_addr_used = 0;
+	spin_unlock_bh(&msk->pm.lock);
 }
 
 static void mptcp_nl_remove_addrs_list(struct net *net,
@@ -1845,10 +1996,11 @@
 {
 	struct mptcp_rm_list list = { .nr = 0 };
 
-	list.ids[list.nr++] = addr->id;
+	list.ids[list.nr++] = mptcp_endp_get_local_id(msk, addr);
 
 	spin_lock_bh(&msk->pm.lock);
 	mptcp_pm_nl_rm_subflow_received(msk, &list);
+	__mark_subflow_endp_available(msk, list.ids[0]);
 	mptcp_pm_create_subflow_or_signal_addr(msk);
 	spin_unlock_bh(&msk->pm.lock);
 }
@@ -1897,7 +2049,8 @@
 	}
 
 	spin_lock_bh(&pernet->lock);
-	entry = __lookup_addr(pernet, &addr->addr, lookup_by_id);
+	entry = lookup_by_id ? __lookup_addr_by_id(pernet, addr->addr.id) :
+			       __lookup_addr(pernet, &addr->addr);
 	if (!entry) {
 		spin_unlock_bh(&pernet->lock);
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/net/mptcp/pm_userspace.c
+++ linux-qcom-6.8.0/net/mptcp/pm_userspace.c
@@ -90,6 +90,7 @@
 						struct mptcp_pm_addr_entry *addr)
 {
 	struct mptcp_pm_addr_entry *entry, *tmp;
+	struct sock *sk = (struct sock *)msk;
 
 	list_for_each_entry_safe(entry, tmp, &msk->pm.userspace_pm_local_addr_list, list) {
 		if (mptcp_addresses_equal(&entry->addr, &addr->addr, false)) {
@@ -97,7 +98,7 @@
 			 * be used multiple times (e.g. fullmesh mode).
 			 */
 			list_del_rcu(&entry->list);
-			kfree(entry);
+			sock_kfree_s(sk, entry, sizeof(*entry));
 			msk->pm.local_addr_used--;
 			return 0;
 		}
@@ -106,19 +107,26 @@
 	return -EINVAL;
 }
 
+static struct mptcp_pm_addr_entry *
+mptcp_userspace_pm_lookup_addr_by_id(struct mptcp_sock *msk, unsigned int id)
+{
+	struct mptcp_pm_addr_entry *entry;
+
+	list_for_each_entry(entry, &msk->pm.userspace_pm_local_addr_list, list) {
+		if (entry->addr.id == id)
+			return entry;
+	}
+	return NULL;
+}
+
 int mptcp_userspace_pm_get_flags_and_ifindex_by_id(struct mptcp_sock *msk,
 						   unsigned int id,
 						   u8 *flags, int *ifindex)
 {
-	struct mptcp_pm_addr_entry *entry, *match = NULL;
+	struct mptcp_pm_addr_entry *match;
 
 	spin_lock_bh(&msk->pm.lock);
-	list_for_each_entry(entry, &msk->pm.userspace_pm_local_addr_list, list) {
-		if (id == entry->addr.id) {
-			match = entry;
-			break;
-		}
-	}
+	match = mptcp_userspace_pm_lookup_addr_by_id(msk, id);
 	spin_unlock_bh(&msk->pm.lock);
 	if (match) {
 		*flags = match->flags;
@@ -157,6 +165,24 @@
 	return mptcp_userspace_pm_append_new_local_addr(msk, &new_entry, true);
 }
 
+bool mptcp_userspace_pm_is_backup(struct mptcp_sock *msk,
+				  struct mptcp_addr_info *skc)
+{
+	struct mptcp_pm_addr_entry *entry;
+	bool backup = false;
+
+	spin_lock_bh(&msk->pm.lock);
+	list_for_each_entry(entry, &msk->pm.userspace_pm_local_addr_list, list) {
+		if (mptcp_addresses_equal(&entry->addr, skc, false)) {
+			backup = !!(entry->flags & MPTCP_PM_ADDR_FLAG_BACKUP);
+			break;
+		}
+	}
+	spin_unlock_bh(&msk->pm.lock);
+
+	return backup;
+}
+
 int mptcp_pm_nl_announce_doit(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nlattr *token = info->attrs[MPTCP_PM_ATTR_TOKEN];
@@ -261,7 +287,7 @@
 {
 	struct nlattr *token = info->attrs[MPTCP_PM_ATTR_TOKEN];
 	struct nlattr *id = info->attrs[MPTCP_PM_ATTR_LOC_ID];
-	struct mptcp_pm_addr_entry *match = NULL;
+	struct mptcp_pm_addr_entry *match;
 	struct mptcp_pm_addr_entry *entry;
 	struct mptcp_sock *msk;
 	LIST_HEAD(free_list);
@@ -298,20 +324,17 @@
 
 	lock_sock(sk);
 
-	list_for_each_entry(entry, &msk->pm.userspace_pm_local_addr_list, list) {
-		if (entry->addr.id == id_val) {
-			match = entry;
-			break;
-		}
-	}
-
+	spin_lock_bh(&msk->pm.lock);
+	match = mptcp_userspace_pm_lookup_addr_by_id(msk, id_val);
 	if (!match) {
 		GENL_SET_ERR_MSG(info, "address with specified id not found");
+		spin_unlock_bh(&msk->pm.lock);
 		release_sock(sk);
 		goto out;
 	}
 
 	list_move(&match->list, &free_list);
+	spin_unlock_bh(&msk->pm.lock);
 
 	mptcp_pm_remove_addrs(msk, &free_list);
 
@@ -544,6 +567,7 @@
 				 struct mptcp_pm_addr_entry *loc,
 				 struct mptcp_pm_addr_entry *rem, u8 bkup)
 {
+	struct mptcp_pm_addr_entry *entry;
 	struct mptcp_sock *msk;
 	int ret = -EINVAL;
 	struct sock *sk;
@@ -564,6 +588,17 @@
 	    rem->addr.family == AF_UNSPEC)
 		goto set_flags_err;
 
+	spin_lock_bh(&msk->pm.lock);
+	list_for_each_entry(entry, &msk->pm.userspace_pm_local_addr_list, list) {
+		if (mptcp_addresses_equal(&entry->addr, &loc->addr, false)) {
+			if (bkup)
+				entry->flags |= MPTCP_PM_ADDR_FLAG_BACKUP;
+			else
+				entry->flags &= ~MPTCP_PM_ADDR_FLAG_BACKUP;
+		}
+	}
+	spin_unlock_bh(&msk->pm.lock);
+
 	lock_sock(sk);
 	ret = mptcp_pm_nl_mp_prio_send_ack(msk, &loc->addr, &rem->addr, bkup);
 	release_sock(sk);
--- linux-qcom-6.8.0.orig/net/mptcp/protocol.c
+++ linux-qcom-6.8.0/net/mptcp/protocol.c
@@ -139,7 +139,7 @@
 	    !skb_try_coalesce(to, from, &fragstolen, &delta))
 		return false;
 
-	pr_debug("colesced seq %llx into %llx new len %d new end seq %llx",
+	pr_debug("colesced seq %llx into %llx new len %d new end seq %llx\n",
 		 MPTCP_SKB_CB(from)->map_seq, MPTCP_SKB_CB(to)->map_seq,
 		 to->len, MPTCP_SKB_CB(from)->end_seq);
 	MPTCP_SKB_CB(to)->end_seq = MPTCP_SKB_CB(from)->end_seq;
@@ -217,7 +217,7 @@
 	end_seq = MPTCP_SKB_CB(skb)->end_seq;
 	max_seq = atomic64_read(&msk->rcv_wnd_sent);
 
-	pr_debug("msk=%p seq=%llx limit=%llx empty=%d", msk, seq, max_seq,
+	pr_debug("msk=%p seq=%llx limit=%llx empty=%d\n", msk, seq, max_seq,
 		 RB_EMPTY_ROOT(&msk->out_of_order_queue));
 	if (after64(end_seq, max_seq)) {
 		/* out of window */
@@ -350,8 +350,10 @@
 	skb_orphan(skb);
 
 	/* try to fetch required memory from subflow */
-	if (!mptcp_rmem_schedule(sk, ssk, skb->truesize))
+	if (!mptcp_rmem_schedule(sk, ssk, skb->truesize)) {
+		MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_RCVPRUNED);
 		goto drop;
+	}
 
 	has_rxtstamp = TCP_SKB_CB(skb)->has_rxtstamp;
 
@@ -524,13 +526,13 @@
 		mptcp_subflow_send_ack(mptcp_subflow_tcp_sock(subflow));
 }
 
-static void mptcp_subflow_cleanup_rbuf(struct sock *ssk)
+static void mptcp_subflow_cleanup_rbuf(struct sock *ssk, int copied)
 {
 	bool slow;
 
 	slow = lock_sock_fast(ssk);
 	if (tcp_can_send_ack(ssk))
-		tcp_cleanup_rbuf(ssk, 1);
+		tcp_cleanup_rbuf(ssk, copied);
 	unlock_sock_fast(ssk, slow);
 }
 
@@ -547,7 +549,7 @@
 			      (ICSK_ACK_PUSHED2 | ICSK_ACK_PUSHED)));
 }
 
-static void mptcp_cleanup_rbuf(struct mptcp_sock *msk)
+static void mptcp_cleanup_rbuf(struct mptcp_sock *msk, int copied)
 {
 	int old_space = READ_ONCE(msk->old_wspace);
 	struct mptcp_subflow_context *subflow;
@@ -555,14 +557,14 @@
 	int space =  __mptcp_space(sk);
 	bool cleanup, rx_empty;
 
-	cleanup = (space > 0) && (space >= (old_space << 1));
-	rx_empty = !__mptcp_rmem(sk);
+	cleanup = (space > 0) && (space >= (old_space << 1)) && copied;
+	rx_empty = !__mptcp_rmem(sk) && copied;
 
 	mptcp_for_each_subflow(msk, subflow) {
 		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
 
 		if (cleanup || mptcp_subflow_could_cleanup(ssk, rx_empty))
-			mptcp_subflow_cleanup_rbuf(ssk);
+			mptcp_subflow_cleanup_rbuf(ssk, copied);
 	}
 }
 
@@ -616,6 +618,18 @@
 	return ret;
 }
 
+static void mptcp_dss_corruption(struct mptcp_sock *msk, struct sock *ssk)
+{
+	if (READ_ONCE(msk->allow_infinite_fallback)) {
+		MPTCP_INC_STATS(sock_net(ssk),
+				MPTCP_MIB_DSSCORRUPTIONFALLBACK);
+		mptcp_do_fallback(ssk);
+	} else {
+		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSCORRUPTIONRESET);
+		mptcp_subflow_reset(ssk);
+	}
+}
+
 static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,
 					   struct sock *ssk,
 					   unsigned int *bytes)
@@ -639,7 +653,7 @@
 		}
 	}
 
-	pr_debug("msk=%p ssk=%p", msk, ssk);
+	pr_debug("msk=%p ssk=%p\n", msk, ssk);
 	tp = tcp_sk(ssk);
 	do {
 		u32 map_remaining, offset;
@@ -688,10 +702,16 @@
 				moved += len;
 			seq += len;
 
-			if (WARN_ON_ONCE(map_remaining < len))
-				break;
+			if (unlikely(map_remaining < len)) {
+				DEBUG_NET_WARN_ON_ONCE(1);
+				mptcp_dss_corruption(msk, ssk);
+			}
 		} else {
-			WARN_ON_ONCE(!fin);
+			if (unlikely(!fin)) {
+				DEBUG_NET_WARN_ON_ONCE(1);
+				mptcp_dss_corruption(msk, ssk);
+			}
+
 			sk_eat_skb(ssk, skb);
 			done = true;
 		}
@@ -718,7 +738,7 @@
 	u64 end_seq;
 
 	p = rb_first(&msk->out_of_order_queue);
-	pr_debug("msk=%p empty=%d", msk, RB_EMPTY_ROOT(&msk->out_of_order_queue));
+	pr_debug("msk=%p empty=%d\n", msk, RB_EMPTY_ROOT(&msk->out_of_order_queue));
 	while (p) {
 		skb = rb_to_skb(p);
 		if (after64(MPTCP_SKB_CB(skb)->map_seq, msk->ack_seq))
@@ -740,7 +760,7 @@
 			int delta = msk->ack_seq - MPTCP_SKB_CB(skb)->map_seq;
 
 			/* skip overlapping data, if any */
-			pr_debug("uncoalesced seq=%llx ack seq=%llx delta=%d",
+			pr_debug("uncoalesced seq=%llx ack seq=%llx delta=%d\n",
 				 MPTCP_SKB_CB(skb)->map_seq, msk->ack_seq,
 				 delta);
 			MPTCP_SKB_CB(skb)->offset += delta;
@@ -840,10 +860,8 @@
 		sk_rbuf = ssk_rbuf;
 
 	/* over limit? can't append more skbs to msk, Also, no need to wake-up*/
-	if (__mptcp_rmem(sk) > sk_rbuf) {
-		MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_RCVPRUNED);
+	if (__mptcp_rmem(sk) > sk_rbuf)
 		return;
-	}
 
 	/* Wake-up the reader only for in-sequence data */
 	mptcp_data_lock(sk);
@@ -1233,7 +1251,7 @@
 	size_t copy;
 	int i;
 
-	pr_debug("msk=%p ssk=%p sending dfrag at seq=%llu len=%u already sent=%u",
+	pr_debug("msk=%p ssk=%p sending dfrag at seq=%llu len=%u already sent=%u\n",
 		 msk, ssk, dfrag->data_seq, dfrag->data_len, info->sent);
 
 	if (WARN_ON_ONCE(info->sent > info->limit ||
@@ -1334,7 +1352,7 @@
 	mpext->use_map = 1;
 	mpext->dsn64 = 1;
 
-	pr_debug("data_seq=%llu subflow_seq=%u data_len=%u dsn64=%d",
+	pr_debug("data_seq=%llu subflow_seq=%u data_len=%u dsn64=%d\n",
 		 mpext->data_seq, mpext->subflow_seq, mpext->data_len,
 		 mpext->dsn64);
 
@@ -1415,13 +1433,15 @@
 	}
 
 	mptcp_for_each_subflow(msk, subflow) {
+		bool backup = subflow->backup || subflow->request_bkup;
+
 		trace_mptcp_subflow_get_send(subflow);
 		ssk =  mptcp_subflow_tcp_sock(subflow);
 		if (!mptcp_subflow_active(subflow))
 			continue;
 
 		tout = max(tout, mptcp_timeout_from_subflow(subflow));
-		nr_active += !subflow->backup;
+		nr_active += !backup;
 		pace = subflow->avg_pacing_rate;
 		if (unlikely(!pace)) {
 			/* init pacing rate from socket */
@@ -1432,9 +1452,9 @@
 		}
 
 		linger_time = div_u64((u64)READ_ONCE(ssk->sk_wmem_queued) << 32, pace);
-		if (linger_time < send_info[subflow->backup].linger_time) {
-			send_info[subflow->backup].ssk = ssk;
-			send_info[subflow->backup].linger_time = linger_time;
+		if (linger_time < send_info[backup].linger_time) {
+			send_info[backup].ssk = ssk;
+			send_info[backup].linger_time = linger_time;
 		}
 	}
 	__mptcp_set_timeout(sk, tout);
@@ -1687,15 +1707,6 @@
 	}
 }
 
-static void mptcp_set_nospace(struct sock *sk)
-{
-	/* enable autotune */
-	set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-
-	/* will be cleared on avail space */
-	set_bit(MPTCP_NOSPACE, &mptcp_sk(sk)->flags);
-}
-
 static int mptcp_disconnect(struct sock *sk, int flags);
 
 static int mptcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
@@ -1766,6 +1777,30 @@
 	return 0;
 }
 
+/* open-code sk_stream_memory_free() plus sent limit computation to
+ * avoid indirect calls in fast-path.
+ * Called under the msk socket lock, so we can avoid a bunch of ONCE
+ * annotations.
+ */
+static u32 mptcp_send_limit(const struct sock *sk)
+{
+	const struct mptcp_sock *msk = mptcp_sk(sk);
+	u32 limit, not_sent;
+
+	if (sk->sk_wmem_queued >= READ_ONCE(sk->sk_sndbuf))
+		return 0;
+
+	limit = mptcp_notsent_lowat(sk);
+	if (limit == UINT_MAX)
+		return UINT_MAX;
+
+	not_sent = msk->write_seq - msk->snd_nxt;
+	if (not_sent >= limit)
+		return 0;
+
+	return limit - not_sent;
+}
+
 static int mptcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 {
 	struct mptcp_sock *msk = mptcp_sk(sk);
@@ -1810,6 +1845,12 @@
 		struct mptcp_data_frag *dfrag;
 		bool dfrag_collapsed;
 		size_t psize, offset;
+		u32 copy_limit;
+
+		/* ensure fitting the notsent_lowat() constraint */
+		copy_limit = mptcp_send_limit(sk);
+		if (!copy_limit)
+			goto wait_for_memory;
 
 		/* reuse tail pfrag, if possible, or carve a new one from the
 		 * page allocator
@@ -1817,9 +1858,6 @@
 		dfrag = mptcp_pending_tail(sk);
 		dfrag_collapsed = mptcp_frag_can_collapse_to(msk, pfrag, dfrag);
 		if (!dfrag_collapsed) {
-			if (!sk_stream_memory_free(sk))
-				goto wait_for_memory;
-
 			if (!mptcp_page_frag_refill(sk, pfrag))
 				goto wait_for_memory;
 
@@ -1834,6 +1872,7 @@
 		offset = dfrag->offset + dfrag->data_len;
 		psize = pfrag->size - offset;
 		psize = min_t(size_t, psize, msg_data_left(msg));
+		psize = min_t(size_t, psize, copy_limit);
 		total_ts = psize + frag_truesize;
 
 		if (!sk_wmem_schedule(sk, total_ts))
@@ -1862,14 +1901,14 @@
 			if (!msk->first_pending)
 				WRITE_ONCE(msk->first_pending, dfrag);
 		}
-		pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d", msk,
+		pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d\n", msk,
 			 dfrag->data_seq, dfrag->data_len, dfrag->already_sent,
 			 !dfrag_collapsed);
 
 		continue;
 
 wait_for_memory:
-		mptcp_set_nospace(sk);
+		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 		__mptcp_push_pending(sk, msg->msg_flags);
 		ret = sk_stream_wait_memory(sk, &timeo);
 		if (ret)
@@ -1891,6 +1930,8 @@
 	goto out;
 }
 
+static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied);
+
 static int __mptcp_recvmsg_mskq(struct mptcp_sock *msk,
 				struct msghdr *msg,
 				size_t len, int flags,
@@ -1944,6 +1985,7 @@
 			break;
 	}
 
+	mptcp_rcv_space_adjust(msk, copied);
 	return copied;
 }
 
@@ -2033,8 +2075,9 @@
 				ssk = mptcp_subflow_tcp_sock(subflow);
 				slow = lock_sock_fast(ssk);
 				WRITE_ONCE(ssk->sk_rcvbuf, rcvbuf);
-				tcp_sk(ssk)->window_clamp = window_clamp;
-				tcp_cleanup_rbuf(ssk, 1);
+				WRITE_ONCE(tcp_sk(ssk)->window_clamp, window_clamp);
+				if (tcp_can_send_ack(ssk))
+					tcp_cleanup_rbuf(ssk, 1);
 				unlock_sock_fast(ssk, slow);
 			}
 		}
@@ -2157,7 +2200,7 @@
 		cmsg_flags = MPTCP_CMSG_INQ;
 
 	while (copied < len) {
-		int bytes_read;
+		int err, bytes_read;
 
 		bytes_read = __mptcp_recvmsg_mskq(msk, msg, len - copied, flags, &tss, &cmsg_flags);
 		if (unlikely(bytes_read < 0)) {
@@ -2168,9 +2211,6 @@
 
 		copied += bytes_read;
 
-		/* be sure to advertise window change */
-		mptcp_cleanup_rbuf(msk);
-
 		if (skb_queue_empty(&msk->receive_queue) && __mptcp_move_skbs(msk))
 			continue;
 
@@ -2218,10 +2258,17 @@
 			}
 		}
 
-		pr_debug("block timeout %ld", timeo);
-		sk_wait_data(sk, &timeo, NULL);
+		pr_debug("block timeout %ld\n", timeo);
+		mptcp_cleanup_rbuf(msk, copied);
+		err = sk_wait_data(sk, &timeo, NULL);
+		if (err < 0) {
+			err = copied ? : err;
+			goto out_err;
+		}
 	}
 
+	mptcp_cleanup_rbuf(msk, copied);
+
 out_err:
 	if (cmsg_flags && copied >= 0) {
 		if (cmsg_flags & MPTCP_CMSG_TS)
@@ -2234,11 +2281,9 @@
 		}
 	}
 
-	pr_debug("msk=%p rx queue empty=%d:%d copied=%d",
+	pr_debug("msk=%p rx queue empty=%d:%d copied=%d\n",
 		 msk, skb_queue_empty_lockless(&sk->sk_receive_queue),
 		 skb_queue_empty(&msk->receive_queue), copied);
-	if (!(flags & MSG_PEEK))
-		mptcp_rcv_space_adjust(msk, copied);
 
 	release_sock(sk);
 	return copied;
@@ -2296,7 +2341,7 @@
 			continue;
 		}
 
-		if (subflow->backup) {
+		if (subflow->backup || subflow->request_bkup) {
 			if (!backup)
 				backup = ssk;
 			continue;
@@ -2478,6 +2523,12 @@
 void mptcp_close_ssk(struct sock *sk, struct sock *ssk,
 		     struct mptcp_subflow_context *subflow)
 {
+	/* The first subflow can already be closed and still in the list */
+	if (subflow->close_event_done)
+		return;
+
+	subflow->close_event_done = true;
+
 	if (sk->sk_state == TCP_ESTABLISHED)
 		mptcp_event(MPTCP_EVENT_SUB_CLOSED, mptcp_sk(sk), ssk, GFP_KERNEL);
 
@@ -2503,8 +2554,11 @@
 
 	mptcp_for_each_subflow_safe(msk, subflow, tmp) {
 		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+		int ssk_state = inet_sk_state_load(ssk);
 
-		if (inet_sk_state_load(ssk) != TCP_CLOSE)
+		if (ssk_state != TCP_CLOSE &&
+		    (ssk_state != TCP_CLOSE_WAIT ||
+		     inet_sk_state_load(sk) != TCP_ESTABLISHED))
 			continue;
 
 		/* 'subflow_data_ready' will re-sched once rx queue is empty */
@@ -2665,8 +2719,8 @@
 	if (!fail_tout && !inet_csk(sk)->icsk_mtup.probe_timestamp)
 		return;
 
-	close_timeout = inet_csk(sk)->icsk_mtup.probe_timestamp - tcp_jiffies32 + jiffies +
-			mptcp_close_timeout(sk);
+	close_timeout = (unsigned long)inet_csk(sk)->icsk_mtup.probe_timestamp -
+			tcp_jiffies32 + jiffies + mptcp_close_timeout(sk);
 
 	/* the close timeout takes precedence on the fail one, and here at least one of
 	 * them is active
@@ -2684,7 +2738,7 @@
 	if (!ssk)
 		return;
 
-	pr_debug("MP_FAIL doesn't respond, reset the subflow");
+	pr_debug("MP_FAIL doesn't respond, reset the subflow\n");
 
 	slow = lock_sock_fast(ssk);
 	mptcp_subflow_reset(ssk);
@@ -2803,8 +2857,10 @@
 	if (unlikely(!net->mib.mptcp_statistics) && !mptcp_mib_alloc(net))
 		return -ENOMEM;
 
+	rcu_read_lock();
 	ret = mptcp_init_sched(mptcp_sk(sk),
 			       mptcp_sched_find(mptcp_get_scheduler(net)));
+	rcu_read_unlock();
 	if (ret)
 		return ret;
 
@@ -2854,7 +2910,7 @@
 		break;
 	default:
 		if (__mptcp_check_fallback(mptcp_sk(sk))) {
-			pr_debug("Fallback");
+			pr_debug("Fallback\n");
 			ssk->sk_shutdown |= how;
 			tcp_shutdown(ssk, how);
 
@@ -2864,7 +2920,7 @@
 			WRITE_ONCE(mptcp_sk(sk)->snd_una, mptcp_sk(sk)->snd_nxt);
 			mptcp_schedule_work(sk);
 		} else {
-			pr_debug("Sending DATA_FIN on subflow %p", ssk);
+			pr_debug("Sending DATA_FIN on subflow %p\n", ssk);
 			tcp_send_ack(ssk);
 			if (!mptcp_rtx_timer_pending(sk))
 				mptcp_reset_rtx_timer(sk);
@@ -2884,9 +2940,14 @@
 		if (oldstate != TCP_ESTABLISHED)
 			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_CURRESTAB);
 		break;
-
+	case TCP_CLOSE_WAIT:
+		/* Unlike TCP, MPTCP sk would not have the TCP_SYN_RECV state:
+		 * MPTCP "accepted" sockets will be created later on. So no
+		 * transition from TCP_SYN_RECV to TCP_CLOSE_WAIT.
+		 */
+		break;
 	default:
-		if (oldstate == TCP_ESTABLISHED)
+		if (oldstate == TCP_ESTABLISHED || oldstate == TCP_CLOSE_WAIT)
 			MPTCP_DEC_STATS(sock_net(sk), MPTCP_MIB_CURRESTAB);
 	}
 
@@ -2925,7 +2986,7 @@
 	struct mptcp_subflow_context *subflow;
 	struct mptcp_sock *msk = mptcp_sk(sk);
 
-	pr_debug("msk=%p snd_data_fin_enable=%d pending=%d snd_nxt=%llu write_seq=%llu",
+	pr_debug("msk=%p snd_data_fin_enable=%d pending=%d snd_nxt=%llu write_seq=%llu\n",
 		 msk, msk->snd_data_fin_enable, !!mptcp_send_head(sk),
 		 msk->snd_nxt, msk->write_seq);
 
@@ -2949,7 +3010,7 @@
 {
 	struct mptcp_sock *msk = mptcp_sk(sk);
 
-	pr_debug("msk=%p snd_data_fin_enable=%d shutdown=%x state=%d pending=%d",
+	pr_debug("msk=%p snd_data_fin_enable=%d shutdown=%x state=%d pending=%d\n",
 		 msk, msk->snd_data_fin_enable, sk->sk_shutdown, sk->sk_state,
 		 !!mptcp_send_head(sk));
 
@@ -2964,7 +3025,7 @@
 {
 	struct mptcp_sock *msk = mptcp_sk(sk);
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	might_sleep();
 
@@ -3072,7 +3133,7 @@
 		mptcp_set_state(sk, TCP_CLOSE);
 
 	sock_hold(sk);
-	pr_debug("msk=%p state=%d", sk, sk->sk_state);
+	pr_debug("msk=%p state=%d\n", sk, sk->sk_state);
 	if (msk->token)
 		mptcp_event(MPTCP_EVENT_CLOSED, msk, NULL, GFP_KERNEL);
 
@@ -3448,7 +3509,7 @@
 	struct tcp_sock *tp = tcp_sk(ssk);
 	unsigned long timeout;
 
-	if (mptcp_subflow_ctx(ssk)->fully_established)
+	if (READ_ONCE(mptcp_subflow_ctx(ssk)->fully_established))
 		return;
 
 	/* reschedule with a timeout above RTT, as we must look only for drop */
@@ -3507,7 +3568,7 @@
 {
 	struct mptcp_sock *msk = mptcp_sk(sk);
 
-	pr_debug("msk=%p, ssk=%p", msk, msk->first);
+	pr_debug("msk=%p, ssk=%p\n", msk, msk->first);
 	if (WARN_ON_ONCE(!msk->first))
 		return -EINVAL;
 
@@ -3524,7 +3585,7 @@
 	sk = subflow->conn;
 	msk = mptcp_sk(sk);
 
-	pr_debug("msk=%p, token=%u", sk, subflow->token);
+	pr_debug("msk=%p, token=%u\n", sk, subflow->token);
 
 	subflow->map_seq = subflow->iasn;
 	subflow->map_subflow_seq = 1;
@@ -3553,7 +3614,7 @@
 	struct sock *parent = (void *)msk;
 	bool ret = true;
 
-	pr_debug("msk=%p, subflow=%p", msk, subflow);
+	pr_debug("msk=%p, subflow=%p\n", msk, subflow);
 
 	/* mptcp socket already closing? */
 	if (!mptcp_is_fully_established(parent)) {
@@ -3599,7 +3660,7 @@
 
 static void mptcp_shutdown(struct sock *sk, int how)
 {
-	pr_debug("sk=%p, how=%d", sk, how);
+	pr_debug("sk=%p, how=%d\n", sk, how);
 
 	if ((how & SEND_SHUTDOWN) && mptcp_close_state(sk))
 		__mptcp_wr_shutdown(sk);
@@ -3703,6 +3764,10 @@
 		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_TOKENFALLBACKINIT);
 		mptcp_subflow_early_fallback(msk, subflow);
 	}
+
+	WRITE_ONCE(msk->write_seq, subflow->idsn);
+	WRITE_ONCE(msk->snd_nxt, subflow->idsn);
+	WRITE_ONCE(msk->snd_una, subflow->idsn);
 	if (likely(!__mptcp_check_fallback(msk)))
 		MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPCAPABLEACTIVE);
 
@@ -3767,6 +3832,7 @@
 	.unhash		= mptcp_unhash,
 	.get_port	= mptcp_get_port,
 	.forward_alloc_get	= mptcp_forward_alloc_get,
+	.stream_memory_free	= mptcp_stream_memory_free,
 	.sockets_allocated	= &mptcp_sockets_allocated,
 
 	.memory_allocated	= &tcp_memory_allocated,
@@ -3815,7 +3881,7 @@
 	struct sock *ssk;
 	int err;
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	lock_sock(sk);
 
@@ -3855,7 +3921,7 @@
 	struct sock *ssk, *newsk;
 	int err;
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	/* Buggy applications can call accept on socket states other then LISTEN
 	 * but no need to allocate the first subflow just to error out.
@@ -3864,12 +3930,12 @@
 	if (!ssk)
 		return -EINVAL;
 
-	pr_debug("ssk=%p, listener=%p", ssk, mptcp_subflow_ctx(ssk));
+	pr_debug("ssk=%p, listener=%p\n", ssk, mptcp_subflow_ctx(ssk));
 	newsk = inet_csk_accept(ssk, flags, &err, kern);
 	if (!newsk)
 		return err;
 
-	pr_debug("newsk=%p, subflow is mptcp=%d", newsk, sk_is_mptcp(newsk));
+	pr_debug("newsk=%p, subflow is mptcp=%d\n", newsk, sk_is_mptcp(newsk));
 	if (sk_is_mptcp(newsk)) {
 		struct mptcp_subflow_context *subflow;
 		struct sock *new_mptcp_sock;
@@ -3916,8 +3982,6 @@
 				mptcp_set_state(newsk, TCP_CLOSE);
 		}
 	} else {
-		MPTCP_INC_STATS(sock_net(ssk),
-				MPTCP_MIB_MPCAPABLEPASSIVEFALLBACK);
 tcpfallback:
 		newsk->sk_kern_sock = kern;
 		lock_sock(newsk);
@@ -3940,12 +4004,12 @@
 {
 	struct sock *sk = (struct sock *)msk;
 
-	if (sk_stream_is_writeable(sk))
+	if (__mptcp_stream_is_writeable(sk, 1))
 		return EPOLLOUT | EPOLLWRNORM;
 
-	mptcp_set_nospace(sk);
-	smp_mb__after_atomic(); /* msk->flags is changed by write_space cb */
-	if (sk_stream_is_writeable(sk))
+	set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+	smp_mb__after_atomic(); /* NOSPACE is changed by mptcp_write_space() */
+	if (__mptcp_stream_is_writeable(sk, 1))
 		return EPOLLOUT | EPOLLWRNORM;
 
 	return 0;
@@ -3964,7 +4028,7 @@
 	sock_poll_wait(file, sock, wait);
 
 	state = inet_sk_state_load(sk);
-	pr_debug("msk=%p state=%d flags=%lx", msk, state, msk->flags);
+	pr_debug("msk=%p state=%d flags=%lx\n", msk, state, msk->flags);
 	if (state == TCP_LISTEN) {
 		struct sock *ssk = READ_ONCE(msk->first);
 
--- linux-qcom-6.8.0.orig/net/mptcp/protocol.h
+++ linux-qcom-6.8.0/net/mptcp/protocol.h
@@ -113,10 +113,9 @@
 #define MPTCP_RST_TRANSIENT	BIT(0)
 
 /* MPTCP socket atomic flags */
-#define MPTCP_NOSPACE		1
-#define MPTCP_WORK_RTX		2
-#define MPTCP_FALLBACK_DONE	4
-#define MPTCP_WORK_CLOSE_SUBFLOW 5
+#define MPTCP_WORK_RTX		1
+#define MPTCP_FALLBACK_DONE	2
+#define MPTCP_WORK_CLOSE_SUBFLOW 3
 
 /* MPTCP socket release cb flags */
 #define MPTCP_PUSH_PENDING	1
@@ -306,6 +305,10 @@
 			in_accept_queue:1,
 			free_first:1,
 			rcvspace_init:1;
+	u32		notsent_lowat;
+	int		keepalive_cnt;
+	int		keepalive_idle;
+	int		keepalive_intvl;
 	struct work_struct work;
 	struct sk_buff  *ooo_last_skb;
 	struct rb_root  out_of_order_queue;
@@ -418,6 +421,7 @@
 	u16	mp_capable : 1,
 		mp_join : 1,
 		backup : 1,
+		request_bkup : 1,
 		csum_reqd : 1,
 		allow_join_id0 : 1;
 	u8	local_id;
@@ -476,7 +480,6 @@
 		request_bkup : 1,
 		mp_capable : 1,	    /* remote is MPTCP capable */
 		mp_join : 1,	    /* remote is JOINing */
-		fully_established : 1,	    /* path validated */
 		pm_notified : 1,    /* PM hook called for established status */
 		conn_finished : 1,
 		map_valid : 1,
@@ -493,9 +496,12 @@
 		stale : 1,	    /* unable to snd/rcv data, do not use for xmit */
 		valid_csum_seen : 1,        /* at least one csum validated */
 		is_mptfo : 1,	    /* subflow is doing TFO */
+		close_event_done : 1,       /* has done the post-closed part */
 		__unused : 10;
 	bool	data_avail;
 	bool	scheduled;
+	bool	pm_listener;	    /* a listener managed by the kernel PM? */
+	bool	fully_established;  /* path validated */
 	u32	remote_nonce;
 	u64	thmac;
 	u32	local_nonce;
@@ -677,10 +683,15 @@
 
 static inline bool mptcp_epollin_ready(const struct sock *sk)
 {
+	u64 data_avail = mptcp_data_avail(mptcp_sk(sk));
+
+	if (!data_avail)
+		return false;
+
 	/* mptcp doesn't have to deal with small skbs in the receive queue,
-	 * at it can always coalesce them
+	 * as it can always coalesce them
 	 */
-	return (mptcp_data_avail(mptcp_sk(sk)) >= sk->sk_rcvlowat) ||
+	return (data_avail >= sk->sk_rcvlowat) ||
 	       (mem_cgroup_sockets_enabled && sk->sk_memcg &&
 		mem_cgroup_under_socket_pressure(sk->sk_memcg)) ||
 	       READ_ONCE(tcp_memory_pressure);
@@ -697,7 +708,7 @@
 static inline bool __mptcp_subflow_active(struct mptcp_subflow_context *subflow)
 {
 	/* can't send if JOIN hasn't completed yet (i.e. is usable for mptcp) */
-	if (subflow->request_join && !subflow->fully_established)
+	if (subflow->request_join && !READ_ONCE(subflow->fully_established))
 		return false;
 
 	return __tcp_can_send(mptcp_subflow_tcp_sock(subflow));
@@ -790,14 +801,36 @@
 	       READ_ONCE(msk->write_seq) == READ_ONCE(msk->snd_nxt);
 }
 
+static inline u32 mptcp_notsent_lowat(const struct sock *sk)
+{
+	struct net *net = sock_net(sk);
+	u32 val;
+
+	val = READ_ONCE(mptcp_sk(sk)->notsent_lowat);
+	return val ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat);
+}
+
+static inline bool mptcp_stream_memory_free(const struct sock *sk, int wake)
+{
+	const struct mptcp_sock *msk = mptcp_sk(sk);
+	u32 notsent_bytes;
+
+	notsent_bytes = READ_ONCE(msk->write_seq) - READ_ONCE(msk->snd_nxt);
+	return (notsent_bytes << wake) < mptcp_notsent_lowat(sk);
+}
+
+static inline bool __mptcp_stream_is_writeable(const struct sock *sk, int wake)
+{
+	return mptcp_stream_memory_free(sk, wake) &&
+	       __sk_stream_is_writeable(sk, wake);
+}
+
 static inline void mptcp_write_space(struct sock *sk)
 {
-	if (sk_stream_is_writeable(sk)) {
-		/* pairs with memory barrier in mptcp_poll */
-		smp_mb();
-		if (test_and_clear_bit(MPTCP_NOSPACE, &mptcp_sk(sk)->flags))
-			sk_stream_write_space(sk);
-	}
+	/* pairs with memory barrier in mptcp_poll */
+	smp_mb();
+	if (mptcp_stream_memory_free(sk, 1))
+		sk_stream_write_space(sk);
 }
 
 static inline void __mptcp_sync_sndbuf(struct sock *sk)
@@ -901,6 +934,8 @@
 void mptcp_pm_add_addr_echoed(struct mptcp_sock *msk,
 			      const struct mptcp_addr_info *addr);
 void mptcp_pm_add_addr_send_ack(struct mptcp_sock *msk);
+bool mptcp_pm_nl_is_init_remote_addr(struct mptcp_sock *msk,
+				     const struct mptcp_addr_info *remote);
 void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk);
 void mptcp_pm_rm_addr_received(struct mptcp_sock *msk,
 			       const struct mptcp_rm_list *rm_list);
@@ -939,10 +974,7 @@
 			   const struct mptcp_addr_info *addr,
 			   bool echo);
 int mptcp_pm_remove_addr(struct mptcp_sock *msk, const struct mptcp_rm_list *rm_list);
-int mptcp_pm_remove_subflow(struct mptcp_sock *msk, const struct mptcp_rm_list *rm_list);
 void mptcp_pm_remove_addrs(struct mptcp_sock *msk, struct list_head *rm_list);
-void mptcp_pm_remove_addrs_and_subflows(struct mptcp_sock *msk,
-					struct list_head *rm_list);
 
 void mptcp_free_local_addr_list(struct mptcp_sock *msk);
 
@@ -1022,6 +1054,9 @@
 int mptcp_pm_get_local_id(struct mptcp_sock *msk, struct sock_common *skc);
 int mptcp_pm_nl_get_local_id(struct mptcp_sock *msk, struct mptcp_addr_info *skc);
 int mptcp_userspace_pm_get_local_id(struct mptcp_sock *msk, struct mptcp_addr_info *skc);
+bool mptcp_pm_is_backup(struct mptcp_sock *msk, struct sock_common *skc);
+bool mptcp_pm_nl_is_backup(struct mptcp_sock *msk, struct mptcp_addr_info *skc);
+bool mptcp_userspace_pm_is_backup(struct mptcp_sock *msk, struct mptcp_addr_info *skc);
 
 static inline u8 subflow_get_local_id(const struct mptcp_subflow_context *subflow)
 {
@@ -1034,8 +1069,6 @@
 
 void __init mptcp_pm_nl_init(void);
 void mptcp_pm_nl_work(struct mptcp_sock *msk);
-void mptcp_pm_nl_rm_subflow_received(struct mptcp_sock *msk,
-				     const struct mptcp_rm_list *rm_list);
 unsigned int mptcp_pm_get_add_addr_signal_max(const struct mptcp_sock *msk);
 unsigned int mptcp_pm_get_add_addr_accept_max(const struct mptcp_sock *msk);
 unsigned int mptcp_pm_get_subflows_max(const struct mptcp_sock *msk);
@@ -1081,7 +1114,7 @@
 static inline void __mptcp_do_fallback(struct mptcp_sock *msk)
 {
 	if (__mptcp_check_fallback(msk)) {
-		pr_debug("TCP fallback already done (msk=%p)", msk);
+		pr_debug("TCP fallback already done (msk=%p)\n", msk);
 		return;
 	}
 	set_bit(MPTCP_FALLBACK_DONE, &msk->flags);
@@ -1117,7 +1150,7 @@
 	}
 }
 
-#define pr_fallback(a) pr_debug("%s:fallback to TCP (msk=%p)", __func__, a)
+#define pr_fallback(a) pr_debug("%s:fallback to TCP (msk=%p)\n", __func__, a)
 
 static inline bool mptcp_check_infinite_map(struct sk_buff *skb)
 {
--- linux-qcom-6.8.0.orig/net/mptcp/sched.c
+++ linux-qcom-6.8.0/net/mptcp/sched.c
@@ -64,7 +64,7 @@
 	list_add_tail_rcu(&sched->list, &mptcp_sched_list);
 	spin_unlock(&mptcp_sched_list_lock);
 
-	pr_debug("%s registered", sched->name);
+	pr_debug("%s registered\n", sched->name);
 	return 0;
 }
 
@@ -96,7 +96,7 @@
 	if (msk->sched->init)
 		msk->sched->init(msk);
 
-	pr_debug("sched=%s", msk->sched->name);
+	pr_debug("sched=%s\n", msk->sched->name);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/net/mptcp/sockopt.c
+++ linux-qcom-6.8.0/net/mptcp/sockopt.c
@@ -181,8 +181,6 @@
 
 	switch (optname) {
 	case SO_KEEPALIVE:
-		mptcp_sol_socket_sync_intval(msk, optname, val);
-		return 0;
 	case SO_DEBUG:
 	case SO_MARK:
 	case SO_PRIORITY:
@@ -624,20 +622,36 @@
 	return ret;
 }
 
-static int mptcp_setsockopt_sol_tcp_cork(struct mptcp_sock *msk, sockptr_t optval,
-					 unsigned int optlen)
+static int __mptcp_setsockopt_set_val(struct mptcp_sock *msk, int max,
+				      int (*set_val)(struct sock *, int),
+				      int *msk_val, int val)
 {
 	struct mptcp_subflow_context *subflow;
-	struct sock *sk = (struct sock *)msk;
-	int val;
+	int err = 0;
 
-	if (optlen < sizeof(int))
-		return -EINVAL;
+	mptcp_for_each_subflow(msk, subflow) {
+		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+		int ret;
 
-	if (copy_from_sockptr(&val, optval, sizeof(val)))
-		return -EFAULT;
+		lock_sock(ssk);
+		ret = set_val(ssk, val);
+		err = err ? : ret;
+		release_sock(ssk);
+	}
+
+	if (!err) {
+		*msk_val = val;
+		sockopt_seq_inc(msk);
+	}
+
+	return err;
+}
+
+static int __mptcp_setsockopt_sol_tcp_cork(struct mptcp_sock *msk, int val)
+{
+	struct mptcp_subflow_context *subflow;
+	struct sock *sk = (struct sock *)msk;
 
-	lock_sock(sk);
 	sockopt_seq_inc(msk);
 	msk->cork = !!val;
 	mptcp_for_each_subflow(msk, subflow) {
@@ -649,25 +663,15 @@
 	}
 	if (!val)
 		mptcp_check_and_set_pending(sk);
-	release_sock(sk);
 
 	return 0;
 }
 
-static int mptcp_setsockopt_sol_tcp_nodelay(struct mptcp_sock *msk, sockptr_t optval,
-					    unsigned int optlen)
+static int __mptcp_setsockopt_sol_tcp_nodelay(struct mptcp_sock *msk, int val)
 {
 	struct mptcp_subflow_context *subflow;
 	struct sock *sk = (struct sock *)msk;
-	int val;
-
-	if (optlen < sizeof(int))
-		return -EINVAL;
-
-	if (copy_from_sockptr(&val, optval, sizeof(val)))
-		return -EFAULT;
 
-	lock_sock(sk);
 	sockopt_seq_inc(msk);
 	msk->nodelay = !!val;
 	mptcp_for_each_subflow(msk, subflow) {
@@ -679,8 +683,6 @@
 	}
 	if (val)
 		mptcp_check_and_set_pending(sk);
-	release_sock(sk);
-
 	return 0;
 }
 
@@ -803,25 +805,10 @@
 	int ret, val;
 
 	switch (optname) {
-	case TCP_INQ:
-		ret = mptcp_get_int_option(msk, optval, optlen, &val);
-		if (ret)
-			return ret;
-		if (val < 0 || val > 1)
-			return -EINVAL;
-
-		lock_sock(sk);
-		msk->recvmsg_inq = !!val;
-		release_sock(sk);
-		return 0;
 	case TCP_ULP:
 		return -EOPNOTSUPP;
 	case TCP_CONGESTION:
 		return mptcp_setsockopt_sol_tcp_congestion(msk, optval, optlen);
-	case TCP_CORK:
-		return mptcp_setsockopt_sol_tcp_cork(msk, optval, optlen);
-	case TCP_NODELAY:
-		return mptcp_setsockopt_sol_tcp_nodelay(msk, optval, optlen);
 	case TCP_DEFER_ACCEPT:
 		/* See tcp.c: TCP_DEFER_ACCEPT does not fail */
 		mptcp_setsockopt_first_sf_only(msk, SOL_TCP, optname, optval, optlen);
@@ -834,7 +821,50 @@
 						      optval, optlen);
 	}
 
-	return -EOPNOTSUPP;
+	ret = mptcp_get_int_option(msk, optval, optlen, &val);
+	if (ret)
+		return ret;
+
+	lock_sock(sk);
+	switch (optname) {
+	case TCP_INQ:
+		if (val < 0 || val > 1)
+			ret = -EINVAL;
+		else
+			msk->recvmsg_inq = !!val;
+		break;
+	case TCP_NOTSENT_LOWAT:
+		WRITE_ONCE(msk->notsent_lowat, val);
+		mptcp_write_space(sk);
+		break;
+	case TCP_CORK:
+		ret = __mptcp_setsockopt_sol_tcp_cork(msk, val);
+		break;
+	case TCP_NODELAY:
+		ret = __mptcp_setsockopt_sol_tcp_nodelay(msk, val);
+		break;
+	case TCP_KEEPIDLE:
+		ret = __mptcp_setsockopt_set_val(msk, MAX_TCP_KEEPIDLE,
+						 &tcp_sock_set_keepidle_locked,
+						 &msk->keepalive_idle, val);
+		break;
+	case TCP_KEEPINTVL:
+		ret = __mptcp_setsockopt_set_val(msk, MAX_TCP_KEEPINTVL,
+						 &tcp_sock_set_keepintvl,
+						 &msk->keepalive_intvl, val);
+		break;
+	case TCP_KEEPCNT:
+		ret = __mptcp_setsockopt_set_val(msk, MAX_TCP_KEEPCNT,
+						 &tcp_sock_set_keepcnt,
+						 &msk->keepalive_cnt,
+						 val);
+		break;
+	default:
+		ret = -ENOPROTOOPT;
+	}
+
+	release_sock(sk);
+	return ret;
 }
 
 int mptcp_setsockopt(struct sock *sk, int level, int optname,
@@ -843,7 +873,7 @@
 	struct mptcp_sock *msk = mptcp_sk(sk);
 	struct sock *ssk;
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	if (level == SOL_SOCKET)
 		return mptcp_setsockopt_sol_socket(msk, optname, optval, optlen);
@@ -1331,6 +1361,8 @@
 static int mptcp_getsockopt_sol_tcp(struct mptcp_sock *msk, int optname,
 				    char __user *optval, int __user *optlen)
 {
+	struct sock *sk = (void *)msk;
+
 	switch (optname) {
 	case TCP_ULP:
 	case TCP_CONGESTION:
@@ -1349,6 +1381,20 @@
 		return mptcp_put_int_option(msk, optval, optlen, msk->cork);
 	case TCP_NODELAY:
 		return mptcp_put_int_option(msk, optval, optlen, msk->nodelay);
+	case TCP_KEEPIDLE:
+		return mptcp_put_int_option(msk, optval, optlen,
+					    msk->keepalive_idle ? :
+					    READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_keepalive_time) / HZ);
+	case TCP_KEEPINTVL:
+		return mptcp_put_int_option(msk, optval, optlen,
+					    msk->keepalive_intvl ? :
+					    READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_keepalive_intvl) / HZ);
+	case TCP_KEEPCNT:
+		return mptcp_put_int_option(msk, optval, optlen,
+					    msk->keepalive_cnt ? :
+					    READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_keepalive_probes));
+	case TCP_NOTSENT_LOWAT:
+		return mptcp_put_int_option(msk, optval, optlen, msk->notsent_lowat);
 	}
 	return -EOPNOTSUPP;
 }
@@ -1395,7 +1441,7 @@
 	struct mptcp_sock *msk = mptcp_sk(sk);
 	struct sock *ssk;
 
-	pr_debug("msk=%p", msk);
+	pr_debug("msk=%p\n", msk);
 
 	/* @@ the meaning of setsockopt() when the socket is connected and
 	 * there are multiple subflows is not yet defined. It is up to the
@@ -1464,6 +1510,9 @@
 		tcp_set_congestion_control(ssk, msk->ca_name, false, true);
 	__tcp_sock_set_cork(ssk, !!msk->cork);
 	__tcp_sock_set_nodelay(ssk, !!msk->nodelay);
+	tcp_sock_set_keepidle_locked(ssk, msk->keepalive_idle);
+	tcp_sock_set_keepintvl(ssk, msk->keepalive_intvl);
+	tcp_sock_set_keepcnt(ssk, msk->keepalive_cnt);
 
 	inet_assign_bit(TRANSPARENT, ssk, inet_test_bit(TRANSPARENT, sk));
 	inet_assign_bit(FREEBIND, ssk, inet_test_bit(FREEBIND, sk));
@@ -1500,6 +1549,10 @@
 	struct mptcp_subflow_context *subflow;
 	int space, cap;
 
+	/* bpf can land here with a wrong sk type */
+	if (sk->sk_protocol == IPPROTO_TCP)
+		return -EINVAL;
+
 	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK)
 		cap = sk->sk_rcvbuf >> 1;
 	else
@@ -1526,7 +1579,7 @@
 
 		slow = lock_sock_fast(ssk);
 		WRITE_ONCE(ssk->sk_rcvbuf, space);
-		tcp_sk(ssk)->window_clamp = val;
+		WRITE_ONCE(tcp_sk(ssk)->window_clamp, val);
 		unlock_sock_fast(ssk, slow);
 	}
 	return 0;
--- linux-qcom-6.8.0.orig/net/mptcp/subflow.c
+++ linux-qcom-6.8.0/net/mptcp/subflow.c
@@ -40,7 +40,7 @@
 {
 	struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
 
-	pr_debug("subflow_req=%p", subflow_req);
+	pr_debug("subflow_req=%p\n", subflow_req);
 
 	if (subflow_req->msk)
 		sock_put((struct sock *)subflow_req->msk);
@@ -100,6 +100,7 @@
 		return NULL;
 	}
 	subflow_req->local_id = local_id;
+	subflow_req->request_bkup = mptcp_pm_is_backup(msk, (struct sock_common *)req);
 
 	return msk;
 }
@@ -131,6 +132,13 @@
 	}
 }
 
+static int subflow_reset_req_endp(struct request_sock *req, struct sk_buff *skb)
+{
+	SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEENDPATTEMPT);
+	subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT);
+	return -EPERM;
+}
+
 /* Init mptcp request socket.
  *
  * Returns an error code if a JOIN has failed and a TCP reset
@@ -145,7 +153,7 @@
 	struct mptcp_options_received mp_opt;
 	bool opt_mp_capable, opt_mp_join;
 
-	pr_debug("subflow_req=%p, listener=%p", subflow_req, listener);
+	pr_debug("subflow_req=%p, listener=%p\n", subflow_req, listener);
 
 #ifdef CONFIG_TCP_MD5SIG
 	/* no MPTCP if MD5SIG is enabled on this socket or we may run out of
@@ -162,10 +170,17 @@
 	if (opt_mp_capable) {
 		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEPASSIVE);
 
+		if (unlikely(listener->pm_listener))
+			return subflow_reset_req_endp(req, skb);
 		if (opt_mp_join)
 			return 0;
 	} else if (opt_mp_join) {
 		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINSYNRX);
+
+		if (mp_opt.backup)
+			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINSYNBACKUPRX);
+	} else if (unlikely(listener->pm_listener)) {
+		return subflow_reset_req_endp(req, skb);
 	}
 
 	if (opt_mp_capable && listener->request_mptcp) {
@@ -215,7 +230,7 @@
 		}
 
 		if (subflow_use_different_sport(subflow_req->msk, sk_listener)) {
-			pr_debug("syn inet_sport=%d %d",
+			pr_debug("syn inet_sport=%d %d\n",
 				 ntohs(inet_sk(sk_listener)->inet_sport),
 				 ntohs(inet_sk((struct sock *)subflow_req->msk)->inet_sport));
 			if (!mptcp_pm_sport_in_anno_list(subflow_req->msk, sk_listener)) {
@@ -234,7 +249,7 @@
 				return -EPERM;
 		}
 
-		pr_debug("token=%u, remote_nonce=%u msk=%p", subflow_req->token,
+		pr_debug("token=%u, remote_nonce=%u msk=%p\n", subflow_req->token,
 			 subflow_req->remote_nonce, subflow_req->msk);
 	}
 
@@ -504,7 +519,7 @@
 	subflow->rel_write_seq = 1;
 	subflow->conn_finished = 1;
 	subflow->ssn_offset = TCP_SKB_CB(skb)->seq;
-	pr_debug("subflow=%p synack seq=%x", subflow, subflow->ssn_offset);
+	pr_debug("subflow=%p synack seq=%x\n", subflow, subflow->ssn_offset);
 
 	mptcp_get_options(skb, &mp_opt);
 	if (subflow->request_mptcp) {
@@ -536,7 +551,7 @@
 		subflow->thmac = mp_opt.thmac;
 		subflow->remote_nonce = mp_opt.nonce;
 		WRITE_ONCE(subflow->remote_id, mp_opt.join_id);
-		pr_debug("subflow=%p, thmac=%llu, remote_nonce=%u backup=%d",
+		pr_debug("subflow=%p, thmac=%llu, remote_nonce=%u backup=%d\n",
 			 subflow, subflow->thmac, subflow->remote_nonce,
 			 subflow->backup);
 
@@ -558,8 +573,11 @@
 		subflow->mp_join = 1;
 		MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINSYNACKRX);
 
+		if (subflow->backup)
+			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINSYNACKBACKUPRX);
+
 		if (subflow_use_different_dport(msk, sk)) {
-			pr_debug("synack inet_dport=%d %d",
+			pr_debug("synack inet_dport=%d %d\n",
 				 ntohs(inet_sk(sk)->inet_dport),
 				 ntohs(inet_sk(parent)->inet_dport));
 			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINPORTSYNACKRX);
@@ -595,6 +613,8 @@
 		return err;
 
 	subflow_set_local_id(subflow, err);
+	subflow->request_bkup = mptcp_pm_is_backup(msk, (struct sock_common *)sk);
+
 	return 0;
 }
 
@@ -627,7 +647,7 @@
 {
 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
 
-	pr_debug("subflow=%p", subflow);
+	pr_debug("subflow=%p\n", subflow);
 
 	/* Never answer to SYNs sent to broadcast or multicast */
 	if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -658,7 +678,7 @@
 {
 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
 
-	pr_debug("subflow=%p", subflow);
+	pr_debug("subflow=%p\n", subflow);
 
 	if (skb->protocol == htons(ETH_P_IP))
 		return subflow_v4_conn_request(sk, skb);
@@ -756,7 +776,7 @@
 				       const struct mptcp_options_received *mp_opt)
 {
 	subflow_set_remote_key(msk, subflow, mp_opt);
-	subflow->fully_established = 1;
+	WRITE_ONCE(subflow->fully_established, true);
 	WRITE_ONCE(msk->fully_established, true);
 
 	if (subflow->is_mptfo)
@@ -777,7 +797,7 @@
 	struct mptcp_sock *owner;
 	struct sock *child;
 
-	pr_debug("listener=%p, req=%p, conn=%p", listener, req, listener->conn);
+	pr_debug("listener=%p, req=%p, conn=%p\n", listener, req, listener->conn);
 
 	/* After child creation we must look for MPC even when options
 	 * are not parsed
@@ -868,7 +888,7 @@
 			ctx->conn = (struct sock *)owner;
 
 			if (subflow_use_different_sport(owner, sk)) {
-				pr_debug("ack inet_sport=%d %d",
+				pr_debug("ack inet_sport=%d %d\n",
 					 ntohs(inet_sk(sk)->inet_sport),
 					 ntohs(inet_sk((struct sock *)owner)->inet_sport));
 				if (!mptcp_pm_sport_in_anno_list(owner, sk)) {
@@ -905,6 +925,8 @@
 	return child;
 
 fallback:
+	if (fallback)
+		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEPASSIVEFALLBACK);
 	mptcp_subflow_drop_ctx(child);
 	return child;
 }
@@ -923,7 +945,7 @@
 
 static void dbg_bad_map(struct mptcp_subflow_context *subflow, u32 ssn)
 {
-	pr_debug("Bad mapping: ssn=%d map_seq=%d map_data_len=%d",
+	pr_debug("Bad mapping: ssn=%d map_seq=%d map_data_len=%d\n",
 		 ssn, subflow->map_subflow_seq, subflow->map_data_len);
 }
 
@@ -933,8 +955,10 @@
 	unsigned int skb_consumed;
 
 	skb_consumed = tcp_sk(ssk)->copied_seq - TCP_SKB_CB(skb)->seq;
-	if (WARN_ON_ONCE(skb_consumed >= skb->len))
+	if (unlikely(skb_consumed >= skb->len)) {
+		DEBUG_NET_WARN_ON_ONCE(1);
 		return true;
+	}
 
 	return skb->len - skb_consumed <= subflow->map_data_len -
 					  mptcp_subflow_get_map_offset(subflow);
@@ -1083,7 +1107,7 @@
 
 	data_len = mpext->data_len;
 	if (data_len == 0) {
-		pr_debug("infinite mapping received");
+		pr_debug("infinite mapping received\n");
 		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_INFINITEMAPRX);
 		subflow->map_data_len = 0;
 		return MAPPING_INVALID;
@@ -1093,7 +1117,7 @@
 		if (data_len == 1) {
 			bool updated = mptcp_update_rcv_data_fin(msk, mpext->data_seq,
 								 mpext->dsn64);
-			pr_debug("DATA_FIN with no payload seq=%llu", mpext->data_seq);
+			pr_debug("DATA_FIN with no payload seq=%llu\n", mpext->data_seq);
 			if (subflow->map_valid) {
 				/* A DATA_FIN might arrive in a DSS
 				 * option before the previous mapping
@@ -1118,7 +1142,7 @@
 				data_fin_seq &= GENMASK_ULL(31, 0);
 
 			mptcp_update_rcv_data_fin(msk, data_fin_seq, mpext->dsn64);
-			pr_debug("DATA_FIN with mapping seq=%llu dsn64=%d",
+			pr_debug("DATA_FIN with mapping seq=%llu dsn64=%d\n",
 				 data_fin_seq, mpext->dsn64);
 		}
 
@@ -1165,7 +1189,7 @@
 	if (unlikely(subflow->map_csum_reqd != csum_reqd))
 		return MAPPING_INVALID;
 
-	pr_debug("new map seq=%llu subflow_seq=%u data_len=%u csum=%d:%u",
+	pr_debug("new map seq=%llu subflow_seq=%u data_len=%u csum=%d:%u\n",
 		 subflow->map_seq, subflow->map_subflow_seq,
 		 subflow->map_data_len, subflow->map_csum_reqd,
 		 subflow->map_data_csum);
@@ -1190,14 +1214,22 @@
 {
 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
 	bool fin = TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN;
-	u32 incr;
+	struct tcp_sock *tp = tcp_sk(ssk);
+	u32 offset, incr, avail_len;
+
+	offset = tp->copied_seq - TCP_SKB_CB(skb)->seq;
+	if (WARN_ON_ONCE(offset > skb->len))
+		goto out;
 
-	incr = limit >= skb->len ? skb->len + fin : limit;
+	avail_len = skb->len - offset;
+	incr = limit >= avail_len ? avail_len + fin : limit;
 
-	pr_debug("discarding=%d len=%d seq=%d", incr, skb->len,
-		 subflow->map_subflow_seq);
+	pr_debug("discarding=%d len=%d offset=%d seq=%d\n", incr, skb->len,
+		 offset, subflow->map_subflow_seq);
 	MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DUPDATA);
 	tcp_sk(ssk)->copied_seq += incr;
+
+out:
 	if (!before(tcp_sk(ssk)->copied_seq, TCP_SKB_CB(skb)->end_seq))
 		sk_eat_skb(ssk, skb);
 	if (mptcp_subflow_get_map_offset(subflow) >= subflow->map_data_len)
@@ -1207,12 +1239,16 @@
 /* sched mptcp worker to remove the subflow if no more data is pending */
 static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct sock *ssk)
 {
-	if (likely(ssk->sk_state != TCP_CLOSE))
+	struct sock *sk = (struct sock *)msk;
+
+	if (likely(ssk->sk_state != TCP_CLOSE &&
+		   (ssk->sk_state != TCP_CLOSE_WAIT ||
+		    inet_sk_state_load(sk) != TCP_ESTABLISHED)))
 		return;
 
 	if (skb_queue_empty(&ssk->sk_receive_queue) &&
 	    !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
-		mptcp_schedule_work((struct sock *)msk);
+		mptcp_schedule_work(sk);
 }
 
 static bool subflow_can_fallback(struct mptcp_subflow_context *subflow)
@@ -1224,7 +1260,7 @@
 	else if (READ_ONCE(msk->csum_enabled))
 		return !subflow->valid_csum_seen;
 	else
-		return !subflow->fully_established;
+		return READ_ONCE(msk->allow_infinite_fallback);
 }
 
 static void mptcp_subflow_fail(struct mptcp_sock *msk, struct sock *ssk)
@@ -1289,7 +1325,7 @@
 
 		old_ack = READ_ONCE(msk->ack_seq);
 		ack_seq = mptcp_subflow_get_mapped_dsn(subflow);
-		pr_debug("msk ack_seq=%llx subflow ack_seq=%llx", old_ack,
+		pr_debug("msk ack_seq=%llx subflow ack_seq=%llx\n", old_ack,
 			 ack_seq);
 		if (unlikely(before64(ack_seq, old_ack))) {
 			mptcp_subflow_discard_data(ssk, skb, old_ack - ack_seq);
@@ -1361,7 +1397,7 @@
 		subflow->map_valid = 0;
 		WRITE_ONCE(subflow->data_avail, false);
 
-		pr_debug("Done with mapping: seq=%u data_len=%u",
+		pr_debug("Done with mapping: seq=%u data_len=%u\n",
 			 subflow->map_subflow_seq,
 			 subflow->map_data_len);
 	}
@@ -1471,7 +1507,7 @@
 
 	target = mapped ? &subflow_v6m_specific : subflow_default_af_ops(sk);
 
-	pr_debug("subflow=%p family=%d ops=%p target=%p mapped=%d",
+	pr_debug("subflow=%p family=%d ops=%p target=%p mapped=%d\n",
 		 subflow, sk->sk_family, icsk->icsk_af_ops, target, mapped);
 
 	if (likely(icsk->icsk_af_ops == target))
@@ -1564,7 +1600,7 @@
 		goto failed;
 
 	mptcp_crypto_key_sha(subflow->remote_key, &remote_token, NULL);
-	pr_debug("msk=%p remote_token=%u local_id=%d remote_id=%d", msk,
+	pr_debug("msk=%p remote_token=%u local_id=%d remote_id=%d\n", msk,
 		 remote_token, local_id, remote_id);
 	subflow->remote_token = remote_token;
 	WRITE_ONCE(subflow->remote_id, remote_id);
@@ -1699,7 +1735,7 @@
 	SOCK_INODE(sf)->i_gid = SOCK_INODE(sk->sk_socket)->i_gid;
 
 	subflow = mptcp_subflow_ctx(sf->sk);
-	pr_debug("subflow=%p", subflow);
+	pr_debug("subflow=%p\n", subflow);
 
 	*new_sock = sf;
 	sock_hold(sk);
@@ -1728,7 +1764,7 @@
 	INIT_LIST_HEAD(&ctx->node);
 	INIT_LIST_HEAD(&ctx->delegated_node);
 
-	pr_debug("subflow=%p", ctx);
+	pr_debug("subflow=%p\n", ctx);
 
 	ctx->tcp_sock = sk;
 	WRITE_ONCE(ctx->local_id, -1);
@@ -1879,7 +1915,7 @@
 		goto out;
 	}
 
-	pr_debug("subflow=%p, family=%d", ctx, sk->sk_family);
+	pr_debug("subflow=%p, family=%d\n", ctx, sk->sk_family);
 
 	tp->is_mptcp = 1;
 	ctx->icsk_af_ops = icsk->icsk_af_ops;
@@ -1971,9 +2007,10 @@
 	} else if (subflow_req->mp_join) {
 		new_ctx->ssn_offset = subflow_req->ssn_offset;
 		new_ctx->mp_join = 1;
-		new_ctx->fully_established = 1;
+		WRITE_ONCE(new_ctx->fully_established, true);
 		new_ctx->remote_key_valid = 1;
 		new_ctx->backup = subflow_req->backup;
+		new_ctx->request_bkup = subflow_req->request_bkup;
 		WRITE_ONCE(new_ctx->remote_id, subflow_req->remote_id);
 		new_ctx->token = subflow_req->token;
 		new_ctx->thmac = subflow_req->thmac;
--- linux-qcom-6.8.0.orig/net/ncsi/internal.h
+++ linux-qcom-6.8.0/net/ncsi/internal.h
@@ -289,6 +289,7 @@
 	ncsi_dev_state_config_sp	= 0x0301,
 	ncsi_dev_state_config_cis,
 	ncsi_dev_state_config_oem_gma,
+	ncsi_dev_state_config_apply_mac,
 	ncsi_dev_state_config_clear_vids,
 	ncsi_dev_state_config_svf,
 	ncsi_dev_state_config_ev,
@@ -322,9 +323,11 @@
 #define NCSI_DEV_RESHUFFLE	4
 #define NCSI_DEV_RESET		8            /* Reset state of NC          */
 	unsigned int        gma_flag;        /* OEM GMA flag               */
+	struct sockaddr     pending_mac;     /* MAC address received from GMA */
 	spinlock_t          lock;            /* Protect the NCSI device    */
 	unsigned int        package_probe_id;/* Current ID during probe    */
 	unsigned int        package_num;     /* Number of packages         */
+	unsigned int        channel_probe_id;/* Current cahnnel ID during probe */
 	struct list_head    packages;        /* List of packages           */
 	struct ncsi_channel *hot_channel;    /* Channel was ever active    */
 	struct ncsi_request requests[256];   /* Request table              */
@@ -343,6 +346,7 @@
 	bool                multi_package;   /* Enable multiple packages   */
 	bool                mlx_multi_host;  /* Enable multi host Mellanox */
 	u32                 package_whitelist; /* Packages to configure    */
+	unsigned char       channel_count;     /* Num of channels to probe   */
 };
 
 struct ncsi_cmd_arg {
--- linux-qcom-6.8.0.orig/net/ncsi/ncsi-manage.c
+++ linux-qcom-6.8.0/net/ncsi/ncsi-manage.c
@@ -510,17 +510,19 @@
 
 		break;
 	case ncsi_dev_state_suspend_gls:
-		ndp->pending_req_num = np->channel_num;
+		ndp->pending_req_num = 1;
 
 		nca.type = NCSI_PKT_CMD_GLS;
 		nca.package = np->id;
+		nca.channel = ndp->channel_probe_id;
+		ret = ncsi_xmit_cmd(&nca);
+		if (ret)
+			goto error;
+		ndp->channel_probe_id++;
 
-		nd->state = ncsi_dev_state_suspend_dcnt;
-		NCSI_FOR_EACH_CHANNEL(np, nc) {
-			nca.channel = nc->id;
-			ret = ncsi_xmit_cmd(&nca);
-			if (ret)
-				goto error;
+		if (ndp->channel_probe_id == ndp->channel_count) {
+			ndp->channel_probe_id = 0;
+			nd->state = ncsi_dev_state_suspend_dcnt;
 		}
 
 		break;
@@ -1036,7 +1038,7 @@
 			  : ncsi_dev_state_config_clear_vids;
 		break;
 	case ncsi_dev_state_config_oem_gma:
-		nd->state = ncsi_dev_state_config_clear_vids;
+		nd->state = ncsi_dev_state_config_apply_mac;
 
 		nca.package = np->id;
 		nca.channel = nc->id;
@@ -1048,10 +1050,22 @@
 			nca.type = NCSI_PKT_CMD_OEM;
 			ret = ncsi_gma_handler(&nca, nc->version.mf_id);
 		}
-		if (ret < 0)
+		if (ret < 0) {
+			nd->state = ncsi_dev_state_config_clear_vids;
 			schedule_work(&ndp->work);
+		}
 
 		break;
+	case ncsi_dev_state_config_apply_mac:
+		rtnl_lock();
+		ret = dev_set_mac_address(dev, &ndp->pending_mac, NULL);
+		rtnl_unlock();
+		if (ret < 0)
+			netdev_warn(dev, "NCSI: 'Writing MAC address to device failed\n");
+
+		nd->state = ncsi_dev_state_config_clear_vids;
+
+		fallthrough;
 	case ncsi_dev_state_config_clear_vids:
 	case ncsi_dev_state_config_svf:
 	case ncsi_dev_state_config_ev:
@@ -1345,7 +1359,6 @@
 {
 	struct ncsi_dev *nd = &ndp->ndev;
 	struct ncsi_package *np;
-	struct ncsi_channel *nc;
 	struct ncsi_cmd_arg nca;
 	unsigned char index;
 	int ret;
@@ -1423,23 +1436,6 @@
 
 		nd->state = ncsi_dev_state_probe_cis;
 		break;
-	case ncsi_dev_state_probe_cis:
-		ndp->pending_req_num = NCSI_RESERVED_CHANNEL;
-
-		/* Clear initial state */
-		nca.type = NCSI_PKT_CMD_CIS;
-		nca.package = ndp->active_package->id;
-		for (index = 0; index < NCSI_RESERVED_CHANNEL; index++) {
-			nca.channel = index;
-			ret = ncsi_xmit_cmd(&nca);
-			if (ret)
-				goto error;
-		}
-
-		nd->state = ncsi_dev_state_probe_gvi;
-		if (IS_ENABLED(CONFIG_NCSI_OEM_CMD_KEEP_PHY))
-			nd->state = ncsi_dev_state_probe_keep_phy;
-		break;
 	case ncsi_dev_state_probe_keep_phy:
 		ndp->pending_req_num = 1;
 
@@ -1452,14 +1448,17 @@
 
 		nd->state = ncsi_dev_state_probe_gvi;
 		break;
+	case ncsi_dev_state_probe_cis:
 	case ncsi_dev_state_probe_gvi:
 	case ncsi_dev_state_probe_gc:
 	case ncsi_dev_state_probe_gls:
 		np = ndp->active_package;
-		ndp->pending_req_num = np->channel_num;
+		ndp->pending_req_num = 1;
 
-		/* Retrieve version, capability or link status */
-		if (nd->state == ncsi_dev_state_probe_gvi)
+		/* Clear initial state Retrieve version, capability or link status */
+		if (nd->state == ncsi_dev_state_probe_cis)
+			nca.type = NCSI_PKT_CMD_CIS;
+		else if (nd->state == ncsi_dev_state_probe_gvi)
 			nca.type = NCSI_PKT_CMD_GVI;
 		else if (nd->state == ncsi_dev_state_probe_gc)
 			nca.type = NCSI_PKT_CMD_GC;
@@ -1467,19 +1466,29 @@
 			nca.type = NCSI_PKT_CMD_GLS;
 
 		nca.package = np->id;
-		NCSI_FOR_EACH_CHANNEL(np, nc) {
-			nca.channel = nc->id;
-			ret = ncsi_xmit_cmd(&nca);
-			if (ret)
-				goto error;
-		}
+		nca.channel = ndp->channel_probe_id;
+
+		ret = ncsi_xmit_cmd(&nca);
+		if (ret)
+			goto error;
 
-		if (nd->state == ncsi_dev_state_probe_gvi)
+		if (nd->state == ncsi_dev_state_probe_cis) {
+			nd->state = ncsi_dev_state_probe_gvi;
+			if (IS_ENABLED(CONFIG_NCSI_OEM_CMD_KEEP_PHY) && ndp->channel_probe_id == 0)
+				nd->state = ncsi_dev_state_probe_keep_phy;
+		} else if (nd->state == ncsi_dev_state_probe_gvi) {
 			nd->state = ncsi_dev_state_probe_gc;
-		else if (nd->state == ncsi_dev_state_probe_gc)
+		} else if (nd->state == ncsi_dev_state_probe_gc) {
 			nd->state = ncsi_dev_state_probe_gls;
-		else
+		} else {
+			nd->state = ncsi_dev_state_probe_cis;
+			ndp->channel_probe_id++;
+		}
+
+		if (ndp->channel_probe_id == ndp->channel_count) {
+			ndp->channel_probe_id = 0;
 			nd->state = ncsi_dev_state_probe_dp;
+		}
 		break;
 	case ncsi_dev_state_probe_dp:
 		ndp->pending_req_num = 1;
@@ -1780,6 +1789,7 @@
 		ndp->requests[i].ndp = ndp;
 		timer_setup(&ndp->requests[i].timer, ncsi_request_timeout, 0);
 	}
+	ndp->channel_count = NCSI_RESERVED_CHANNEL;
 
 	spin_lock_irqsave(&ncsi_dev_lock, flags);
 	list_add_tail_rcu(&ndp->node, &ncsi_dev_list);
@@ -1813,6 +1823,7 @@
 
 	if (!(ndp->flags & NCSI_DEV_PROBED)) {
 		ndp->package_probe_id = 0;
+		ndp->channel_probe_id = 0;
 		nd->state = ncsi_dev_state_probe;
 		schedule_work(&ndp->work);
 		return 0;
@@ -1955,6 +1966,8 @@
 	list_del_rcu(&ndp->node);
 	spin_unlock_irqrestore(&ncsi_dev_lock, flags);
 
+	cancel_work_sync(&ndp->work);
+
 	kfree(ndp);
 }
 EXPORT_SYMBOL_GPL(ncsi_unregister_dev);
--- linux-qcom-6.8.0.orig/net/ncsi/ncsi-rsp.c
+++ linux-qcom-6.8.0/net/ncsi/ncsi-rsp.c
@@ -628,16 +628,14 @@
 static int ncsi_rsp_handler_oem_gma(struct ncsi_request *nr, int mfr_id)
 {
 	struct ncsi_dev_priv *ndp = nr->ndp;
+	struct sockaddr *saddr = &ndp->pending_mac;
 	struct net_device *ndev = ndp->ndev.dev;
 	struct ncsi_rsp_oem_pkt *rsp;
-	struct sockaddr saddr;
 	u32 mac_addr_off = 0;
-	int ret = 0;
 
 	/* Get the response header */
 	rsp = (struct ncsi_rsp_oem_pkt *)skb_network_header(nr->rsp);
 
-	saddr.sa_family = ndev->type;
 	ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 	if (mfr_id == NCSI_OEM_MFR_BCM_ID)
 		mac_addr_off = BCM_MAC_ADDR_OFFSET;
@@ -646,22 +644,17 @@
 	else if (mfr_id == NCSI_OEM_MFR_INTEL_ID)
 		mac_addr_off = INTEL_MAC_ADDR_OFFSET;
 
-	memcpy(saddr.sa_data, &rsp->data[mac_addr_off], ETH_ALEN);
+	saddr->sa_family = ndev->type;
+	memcpy(saddr->sa_data, &rsp->data[mac_addr_off], ETH_ALEN);
 	if (mfr_id == NCSI_OEM_MFR_BCM_ID || mfr_id == NCSI_OEM_MFR_INTEL_ID)
-		eth_addr_inc((u8 *)saddr.sa_data);
-	if (!is_valid_ether_addr((const u8 *)saddr.sa_data))
+		eth_addr_inc((u8 *)saddr->sa_data);
+	if (!is_valid_ether_addr((const u8 *)saddr->sa_data))
 		return -ENXIO;
 
 	/* Set the flag for GMA command which should only be called once */
 	ndp->gma_flag = 1;
 
-	rtnl_lock();
-	ret = dev_set_mac_address(ndev, &saddr, NULL);
-	rtnl_unlock();
-	if (ret < 0)
-		netdev_warn(ndev, "NCSI: 'Writing mac address to device failed\n");
-
-	return ret;
+	return 0;
 }
 
 /* Response handler for Mellanox card */
@@ -795,12 +788,13 @@
 	struct ncsi_rsp_gc_pkt *rsp;
 	struct ncsi_dev_priv *ndp = nr->ndp;
 	struct ncsi_channel *nc;
+	struct ncsi_package *np;
 	size_t size;
 
 	/* Find the channel */
 	rsp = (struct ncsi_rsp_gc_pkt *)skb_network_header(nr->rsp);
 	ncsi_find_package_and_channel(ndp, rsp->rsp.common.channel,
-				      NULL, &nc);
+				      &np, &nc);
 	if (!nc)
 		return -ENODEV;
 
@@ -835,6 +829,7 @@
 	 */
 	nc->vlan_filter.bitmap = U64_MAX;
 	nc->vlan_filter.n_vids = rsp->vlan_cnt;
+	np->ndp->channel_count = rsp->channel_cnt;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/net/netfilter/core.c
+++ linux-qcom-6.8.0/net/netfilter/core.c
@@ -815,12 +815,21 @@
 	if (ret < 0)
 		goto err;
 
+#ifdef CONFIG_LWTUNNEL
+	ret = netfilter_lwtunnel_init();
+	if (ret < 0)
+		goto err_lwtunnel_pernet;
+#endif
 	ret = netfilter_log_init();
 	if (ret < 0)
-		goto err_pernet;
+		goto err_log_pernet;
 
 	return 0;
-err_pernet:
+err_log_pernet:
+#ifdef CONFIG_LWTUNNEL
+	netfilter_lwtunnel_fini();
+err_lwtunnel_pernet:
+#endif
 	unregister_pernet_subsys(&netfilter_net_ops);
 err:
 	return ret;
--- linux-qcom-6.8.0.orig/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ linux-qcom-6.8.0/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -163,11 +163,8 @@
 		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
 		if (ret)
 			return ret;
-		if (ip > ip_to) {
+		if (ip > ip_to)
 			swap(ip, ip_to);
-			if (ip < map->first_ip)
-				return -IPSET_ERR_BITMAP_RANGE;
-		}
 	} else if (tb[IPSET_ATTR_CIDR]) {
 		u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 
@@ -178,7 +175,7 @@
 		ip_to = ip;
 	}
 
-	if (ip_to > map->last_ip)
+	if (ip < map->first_ip || ip_to > map->last_ip)
 		return -IPSET_ERR_BITMAP_RANGE;
 
 	for (; !before(ip_to, ip); ip += map->hosts) {
--- linux-qcom-6.8.0.orig/net/netfilter/ipset/ip_set_core.c
+++ linux-qcom-6.8.0/net/netfilter/ipset/ip_set_core.c
@@ -53,12 +53,13 @@
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
 
 /* When the nfnl mutex or ip_set_ref_lock is held: */
-#define ip_set_dereference(p)		\
-	rcu_dereference_protected(p,	\
+#define ip_set_dereference(inst)	\
+	rcu_dereference_protected((inst)->ip_set_list,	\
 		lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \
-		lockdep_is_held(&ip_set_ref_lock))
+		lockdep_is_held(&ip_set_ref_lock) || \
+		(inst)->is_deleted)
 #define ip_set(inst, id)		\
-	ip_set_dereference((inst)->ip_set_list)[id]
+	ip_set_dereference(inst)[id]
 #define ip_set_ref_netlink(inst,id)	\
 	rcu_dereference_raw((inst)->ip_set_list)[id]
 #define ip_set_dereference_nfnl(p)	\
@@ -103,14 +104,19 @@
 static bool
 load_settype(const char *name)
 {
+	if (!try_module_get(THIS_MODULE))
+		return false;
+
 	nfnl_unlock(NFNL_SUBSYS_IPSET);
 	pr_debug("try to load ip_set_%s\n", name);
 	if (request_module("ip_set_%s", name) < 0) {
 		pr_warn("Can't find ip_set type %s\n", name);
 		nfnl_lock(NFNL_SUBSYS_IPSET);
+		module_put(THIS_MODULE);
 		return false;
 	}
 	nfnl_lock(NFNL_SUBSYS_IPSET);
+	module_put(THIS_MODULE);
 	return true;
 }
 
@@ -1133,7 +1139,7 @@
 		if (!list)
 			goto cleanup;
 		/* nfnl mutex is held, both lists are valid */
-		tmp = ip_set_dereference(inst->ip_set_list);
+		tmp = ip_set_dereference(inst);
 		memcpy(list, tmp, sizeof(struct ip_set *) * inst->ip_set_max);
 		rcu_assign_pointer(inst->ip_set_list, list);
 		/* Make sure all current packets have passed through */
@@ -1172,23 +1178,50 @@
 				    .len = IPSET_MAXNAMELEN - 1 },
 };
 
+/* In order to return quickly when destroying a single set, it is split
+ * into two stages:
+ * - Cancel garbage collector
+ * - Destroy the set itself via call_rcu()
+ */
+
 static void
-ip_set_destroy_set(struct ip_set *set)
+ip_set_destroy_set_rcu(struct rcu_head *head)
 {
-	pr_debug("set: %s\n",  set->name);
+	struct ip_set *set = container_of(head, struct ip_set, rcu);
 
-	/* Must call it without holding any lock */
 	set->variant->destroy(set);
 	module_put(set->type->me);
 	kfree(set);
 }
 
 static void
-ip_set_destroy_set_rcu(struct rcu_head *head)
+_destroy_all_sets(struct ip_set_net *inst)
 {
-	struct ip_set *set = container_of(head, struct ip_set, rcu);
+	struct ip_set *set;
+	ip_set_id_t i;
+	bool need_wait = false;
 
-	ip_set_destroy_set(set);
+	/* First cancel gc's: set:list sets are flushed as well */
+	for (i = 0; i < inst->ip_set_max; i++) {
+		set = ip_set(inst, i);
+		if (set) {
+			set->variant->cancel_gc(set);
+			if (set->type->features & IPSET_TYPE_NAME)
+				need_wait = true;
+		}
+	}
+	/* Must wait for flush to be really finished  */
+	if (need_wait)
+		rcu_barrier();
+	for (i = 0; i < inst->ip_set_max; i++) {
+		set = ip_set(inst, i);
+		if (set) {
+			ip_set(inst, i) = NULL;
+			set->variant->destroy(set);
+			module_put(set->type->me);
+			kfree(set);
+		}
+	}
 }
 
 static int ip_set_destroy(struct sk_buff *skb, const struct nfnl_info *info,
@@ -1202,11 +1235,10 @@
 	if (unlikely(protocol_min_failed(attr)))
 		return -IPSET_ERR_PROTOCOL;
 
-
 	/* Commands are serialized and references are
 	 * protected by the ip_set_ref_lock.
 	 * External systems (i.e. xt_set) must call
-	 * ip_set_put|get_nfnl_* functions, that way we
+	 * ip_set_nfnl_get_* functions, that way we
 	 * can safely check references here.
 	 *
 	 * list:set timer can only decrement the reference
@@ -1214,8 +1246,6 @@
 	 * without holding the lock.
 	 */
 	if (!attr[IPSET_ATTR_SETNAME]) {
-		/* Must wait for flush to be really finished in list:set */
-		rcu_barrier();
 		read_lock_bh(&ip_set_ref_lock);
 		for (i = 0; i < inst->ip_set_max; i++) {
 			s = ip_set(inst, i);
@@ -1226,15 +1256,7 @@
 		}
 		inst->is_destroyed = true;
 		read_unlock_bh(&ip_set_ref_lock);
-		for (i = 0; i < inst->ip_set_max; i++) {
-			s = ip_set(inst, i);
-			if (s) {
-				ip_set(inst, i) = NULL;
-				/* Must cancel garbage collectors */
-				s->variant->cancel_gc(s);
-				ip_set_destroy_set(s);
-			}
-		}
+		_destroy_all_sets(inst);
 		/* Modified by ip_set_destroy() only, which is serialized */
 		inst->is_destroyed = false;
 	} else {
@@ -1255,12 +1277,12 @@
 		features = s->type->features;
 		ip_set(inst, i) = NULL;
 		read_unlock_bh(&ip_set_ref_lock);
+		/* Must cancel garbage collectors */
+		s->variant->cancel_gc(s);
 		if (features & IPSET_TYPE_NAME) {
 			/* Must wait for flush to be really finished  */
 			rcu_barrier();
 		}
-		/* Must cancel garbage collectors */
-		s->variant->cancel_gc(s);
 		call_rcu(&s->rcu, ip_set_destroy_set_rcu);
 	}
 	return 0;
@@ -2365,30 +2387,25 @@
 }
 
 static void __net_exit
-ip_set_net_exit(struct net *net)
+ip_set_net_pre_exit(struct net *net)
 {
 	struct ip_set_net *inst = ip_set_pernet(net);
 
-	struct ip_set *set = NULL;
-	ip_set_id_t i;
-
 	inst->is_deleted = true; /* flag for ip_set_nfnl_put */
+}
 
-	nfnl_lock(NFNL_SUBSYS_IPSET);
-	for (i = 0; i < inst->ip_set_max; i++) {
-		set = ip_set(inst, i);
-		if (set) {
-			ip_set(inst, i) = NULL;
-			set->variant->cancel_gc(set);
-			ip_set_destroy_set(set);
-		}
-	}
-	nfnl_unlock(NFNL_SUBSYS_IPSET);
+static void __net_exit
+ip_set_net_exit(struct net *net)
+{
+	struct ip_set_net *inst = ip_set_pernet(net);
+
+	_destroy_all_sets(inst);
 	kvfree(rcu_dereference_protected(inst->ip_set_list, 1));
 }
 
 static struct pernet_operations ip_set_net_ops = {
 	.init	= ip_set_net_init,
+	.pre_exit = ip_set_net_pre_exit,
 	.exit   = ip_set_net_exit,
 	.id	= &ip_set_net_id,
 	.size	= sizeof(struct ip_set_net),
--- linux-qcom-6.8.0.orig/net/netfilter/ipset/ip_set_list_set.c
+++ linux-qcom-6.8.0/net/netfilter/ipset/ip_set_list_set.c
@@ -79,7 +79,7 @@
 	struct set_elem *e;
 	int ret;
 
-	list_for_each_entry(e, &map->members, list) {
+	list_for_each_entry_rcu(e, &map->members, list) {
 		if (SET_WITH_TIMEOUT(set) &&
 		    ip_set_timeout_expired(ext_timeout(e, set)))
 			continue;
@@ -99,7 +99,7 @@
 	struct set_elem *e;
 	int ret;
 
-	list_for_each_entry(e, &map->members, list) {
+	list_for_each_entry_rcu(e, &map->members, list) {
 		if (SET_WITH_TIMEOUT(set) &&
 		    ip_set_timeout_expired(ext_timeout(e, set)))
 			continue;
@@ -188,9 +188,10 @@
 	struct list_set *map = set->data;
 	struct set_adt_elem *d = value;
 	struct set_elem *e, *next, *prev = NULL;
-	int ret;
+	int ret = 0;
 
-	list_for_each_entry(e, &map->members, list) {
+	rcu_read_lock();
+	list_for_each_entry_rcu(e, &map->members, list) {
 		if (SET_WITH_TIMEOUT(set) &&
 		    ip_set_timeout_expired(ext_timeout(e, set)))
 			continue;
@@ -201,6 +202,7 @@
 
 		if (d->before == 0) {
 			ret = 1;
+			goto out;
 		} else if (d->before > 0) {
 			next = list_next_entry(e, list);
 			ret = !list_is_last(&e->list, &map->members) &&
@@ -208,9 +210,11 @@
 		} else {
 			ret = prev && prev->id == d->refid;
 		}
-		return ret;
+		goto out;
 	}
-	return 0;
+out:
+	rcu_read_unlock();
+	return ret;
 }
 
 static void
@@ -239,7 +243,7 @@
 
 	/* Find where to add the new entry */
 	n = prev = next = NULL;
-	list_for_each_entry(e, &map->members, list) {
+	list_for_each_entry_rcu(e, &map->members, list) {
 		if (SET_WITH_TIMEOUT(set) &&
 		    ip_set_timeout_expired(ext_timeout(e, set)))
 			continue;
@@ -316,9 +320,9 @@
 {
 	struct list_set *map = set->data;
 	struct set_adt_elem *d = value;
-	struct set_elem *e, *next, *prev = NULL;
+	struct set_elem *e, *n, *next, *prev = NULL;
 
-	list_for_each_entry(e, &map->members, list) {
+	list_for_each_entry_safe(e, n, &map->members, list) {
 		if (SET_WITH_TIMEOUT(set) &&
 		    ip_set_timeout_expired(ext_timeout(e, set)))
 			continue;
@@ -424,14 +428,8 @@
 list_set_destroy(struct ip_set *set)
 {
 	struct list_set *map = set->data;
-	struct set_elem *e, *n;
 
-	list_for_each_entry_safe(e, n, &map->members, list) {
-		list_del(&e->list);
-		ip_set_put_byindex(map->net, e->id);
-		ip_set_ext_destroy(set, e);
-		kfree(e);
-	}
+	WARN_ON_ONCE(!list_empty(&map->members));
 	kfree(map);
 
 	set->data = NULL;
@@ -549,6 +547,9 @@
 
 	if (SET_WITH_TIMEOUT(set))
 		timer_shutdown_sync(&map->gc);
+
+	/* Flush list to drop references to other ipsets */
+	list_set_flush(set);
 }
 
 static const struct ip_set_type_variant set_variant = {
@@ -610,6 +611,8 @@
 	return true;
 }
 
+static struct lock_class_key list_set_lockdep_key;
+
 static int
 list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
 		u32 flags)
@@ -626,6 +629,7 @@
 	if (size < IP_SET_LIST_MIN_SIZE)
 		size = IP_SET_LIST_MIN_SIZE;
 
+	lockdep_set_class(&set->lock, &list_set_lockdep_key);
 	set->variant = &set_variant;
 	set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem),
 				     __alignof__(struct set_elem));
--- linux-qcom-6.8.0.orig/net/netfilter/ipvs/ip_vs_conn.c
+++ linux-qcom-6.8.0/net/netfilter/ipvs/ip_vs_conn.c
@@ -1495,8 +1495,8 @@
 	max_avail -= 2;		/* ~4 in hash row */
 	max_avail -= 1;		/* IPVS up to 1/2 of mem */
 	max_avail -= order_base_2(sizeof(struct ip_vs_conn));
-	max = clamp(max, min, max_avail);
-	ip_vs_conn_tab_bits = clamp_val(ip_vs_conn_tab_bits, min, max);
+	max = clamp(max_avail, min, max);
+	ip_vs_conn_tab_bits = clamp(ip_vs_conn_tab_bits, min, max);
 	ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
 	ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;
 
--- linux-qcom-6.8.0.orig/net/netfilter/ipvs/ip_vs_ctl.c
+++ linux-qcom-6.8.0/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1459,18 +1459,18 @@
 	if (ret < 0)
 		goto out_err;
 
-	/* Bind the ct retriever */
-	RCU_INIT_POINTER(svc->pe, pe);
-	pe = NULL;
-
 	/* Update the virtual service counters */
 	if (svc->port == FTPPORT)
 		atomic_inc(&ipvs->ftpsvc_counter);
 	else if (svc->port == 0)
 		atomic_inc(&ipvs->nullsvc_counter);
-	if (svc->pe && svc->pe->conn_out)
+	if (pe && pe->conn_out)
 		atomic_inc(&ipvs->conn_out_counter);
 
+	/* Bind the ct retriever */
+	RCU_INIT_POINTER(svc->pe, pe);
+	pe = NULL;
+
 	/* Count only IPv4 services for old get/setsockopt interface */
 	if (svc->af == AF_INET)
 		ipvs->num_services++;
--- linux-qcom-6.8.0.orig/net/netfilter/ipvs/ip_vs_proto.c
+++ linux-qcom-6.8.0/net/netfilter/ipvs/ip_vs_proto.c
@@ -340,7 +340,7 @@
 
 int __init ip_vs_protocol_init(void)
 {
-	char protocols[64];
+	char protocols[64] = { 0 };
 #define REGISTER_PROTOCOL(p)			\
 	do {					\
 		register_ip_vs_protocol(p);	\
@@ -348,8 +348,6 @@
 		strcat(protocols, (p)->name);	\
 	} while (0)
 
-	protocols[0] = '\0';
-	protocols[2] = '\0';
 #ifdef CONFIG_IP_VS_PROTO_TCP
 	REGISTER_PROTOCOL(&ip_vs_protocol_tcp);
 #endif
--- linux-qcom-6.8.0.orig/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ linux-qcom-6.8.0/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -126,7 +126,8 @@
 	if (sctph->source != cp->vport || payload_csum ||
 	    skb->ip_summed == CHECKSUM_PARTIAL) {
 		sctph->source = cp->vport;
-		sctp_nat_csum(skb, sctph, sctphoff);
+		if (!skb_is_gso(skb))
+			sctp_nat_csum(skb, sctph, sctphoff);
 	} else {
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 	}
@@ -174,7 +175,8 @@
 	    (skb->ip_summed == CHECKSUM_PARTIAL &&
 	     !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) {
 		sctph->dest = cp->dport;
-		sctp_nat_csum(skb, sctph, sctphoff);
+		if (!skb_is_gso(skb))
+			sctp_nat_csum(skb, sctph, sctphoff);
 	} else if (skb->ip_summed != CHECKSUM_PARTIAL) {
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 	}
--- linux-qcom-6.8.0.orig/net/netfilter/ipvs/ip_vs_xmit.c
+++ linux-qcom-6.8.0/net/netfilter/ipvs/ip_vs_xmit.c
@@ -180,7 +180,7 @@
 			(!skb->dev || skb->dev->flags & IFF_LOOPBACK) &&
 			(addr_type & IPV6_ADDR_LOOPBACK);
 		old_rt_is_local = __ip_vs_is_local_route6(
-			(struct rt6_info *)skb_dst(skb));
+			dst_rt6_info(skb_dst(skb)));
 	} else
 #endif
 	{
@@ -318,7 +318,7 @@
 	if (dest) {
 		dest_dst = __ip_vs_dst_check(dest);
 		if (likely(dest_dst))
-			rt = (struct rtable *) dest_dst->dst_cache;
+			rt = dst_rtable(dest_dst->dst_cache);
 		else {
 			dest_dst = ip_vs_dest_dst_alloc();
 			spin_lock_bh(&dest->dst_lock);
@@ -481,7 +481,7 @@
 	if (dest) {
 		dest_dst = __ip_vs_dst_check(dest);
 		if (likely(dest_dst))
-			rt = (struct rt6_info *) dest_dst->dst_cache;
+			rt = dst_rt6_info(dest_dst->dst_cache);
 		else {
 			u32 cookie;
 
@@ -501,7 +501,7 @@
 				ip_vs_dest_dst_free(dest_dst);
 				goto err_unreach;
 			}
-			rt = (struct rt6_info *) dst;
+			rt = dst_rt6_info(dst);
 			cookie = rt6_get_cookie(rt);
 			__ip_vs_dst_set(dest, dest_dst, &rt->dst, cookie);
 			spin_unlock_bh(&dest->dst_lock);
@@ -517,7 +517,7 @@
 					      rt_mode);
 		if (!dst)
 			goto err_unreach;
-		rt = (struct rt6_info *) dst;
+		rt = dst_rt6_info(dst);
 	}
 
 	local = __ip_vs_is_local_route6(rt);
@@ -862,7 +862,7 @@
 				      IP_VS_RT_MODE_RDR);
 	if (local < 0)
 		goto tx_error;
-	rt = (struct rt6_info *) skb_dst(skb);
+	rt = dst_rt6_info(skb_dst(skb));
 	/*
 	 * Avoid duplicate tuple in reply direction for NAT traffic
 	 * to local address when connection is sync-ed
@@ -1288,7 +1288,7 @@
 	if (local)
 		return ip_vs_send_or_cont(NFPROTO_IPV6, skb, cp, 1);
 
-	rt = (struct rt6_info *) skb_dst(skb);
+	rt = dst_rt6_info(skb_dst(skb));
 	tdev = rt->dst.dev;
 
 	/*
@@ -1590,7 +1590,7 @@
 				      &cp->daddr.in6, NULL, ipvsh, 0, rt_mode);
 	if (local < 0)
 		goto tx_error;
-	rt = (struct rt6_info *) skb_dst(skb);
+	rt = dst_rt6_info(skb_dst(skb));
 	/*
 	 * Avoid duplicate tuple in reply direction for NAT traffic
 	 * to local address when connection is sync-ed
--- linux-qcom-6.8.0.orig/net/netfilter/nf_bpf_link.c
+++ linux-qcom-6.8.0/net/netfilter/nf_bpf_link.c
@@ -23,6 +23,7 @@
 struct bpf_nf_link {
 	struct bpf_link link;
 	struct nf_hook_ops hook_ops;
+	netns_tracker ns_tracker;
 	struct net *net;
 	u32 dead;
 	const struct nf_defrag_hook *defrag_hook;
@@ -120,6 +121,7 @@
 	if (!cmpxchg(&nf_link->dead, 0, 1)) {
 		nf_unregister_net_hook(nf_link->net, &nf_link->hook_ops);
 		bpf_nf_disable_defrag(nf_link);
+		put_net_track(nf_link->net, &nf_link->ns_tracker);
 	}
 }
 
@@ -150,11 +152,12 @@
 				      struct bpf_link_info *info)
 {
 	struct bpf_nf_link *nf_link = container_of(link, struct bpf_nf_link, link);
+	const struct nf_defrag_hook *hook = nf_link->defrag_hook;
 
 	info->netfilter.pf = nf_link->hook_ops.pf;
 	info->netfilter.hooknum = nf_link->hook_ops.hooknum;
 	info->netfilter.priority = nf_link->hook_ops.priority;
-	info->netfilter.flags = 0;
+	info->netfilter.flags = hook ? BPF_F_NETFILTER_IP_DEFRAG : 0;
 
 	return 0;
 }
@@ -257,6 +260,8 @@
 		return err;
 	}
 
+	get_net_track(net, &link->ns_tracker, GFP_KERNEL);
+
 	return bpf_link_settle(&link_primer);
 }
 
--- linux-qcom-6.8.0.orig/net/netfilter/nf_conncount.c
+++ linux-qcom-6.8.0/net/netfilter/nf_conncount.c
@@ -321,7 +321,6 @@
 	struct nf_conncount_rb *rbconn;
 	struct nf_conncount_tuple *conn;
 	unsigned int count = 0, gc_count = 0;
-	u8 keylen = data->keylen;
 	bool do_gc = true;
 
 	spin_lock_bh(&nf_conncount_locks[hash]);
@@ -333,7 +332,7 @@
 		rbconn = rb_entry(*rbnode, struct nf_conncount_rb, node);
 
 		parent = *rbnode;
-		diff = key_diff(key, rbconn->key, keylen);
+		diff = key_diff(key, rbconn->key, data->keylen);
 		if (diff < 0) {
 			rbnode = &((*rbnode)->rb_left);
 		} else if (diff > 0) {
@@ -378,7 +377,7 @@
 
 	conn->tuple = *tuple;
 	conn->zone = *zone;
-	memcpy(rbconn->key, key, sizeof(u32) * keylen);
+	memcpy(rbconn->key, key, sizeof(u32) * data->keylen);
 
 	nf_conncount_list_init(&rbconn->list);
 	list_add(&conn->node, &rbconn->list.head);
@@ -403,7 +402,6 @@
 	struct rb_node *parent;
 	struct nf_conncount_rb *rbconn;
 	unsigned int hash;
-	u8 keylen = data->keylen;
 
 	hash = jhash2(key, data->keylen, conncount_rnd) % CONNCOUNT_SLOTS;
 	root = &data->root[hash];
@@ -414,7 +412,7 @@
 
 		rbconn = rb_entry(parent, struct nf_conncount_rb, node);
 
-		diff = key_diff(key, rbconn->key, keylen);
+		diff = key_diff(key, rbconn->key, data->keylen);
 		if (diff < 0) {
 			parent = rcu_dereference_raw(parent->rb_left);
 		} else if (diff > 0) {
--- linux-qcom-6.8.0.orig/net/netfilter/nf_conntrack_core.c
+++ linux-qcom-6.8.0/net/netfilter/nf_conntrack_core.c
@@ -2558,12 +2558,15 @@
 	struct hlist_nulls_head *hash;
 	unsigned int nr_slots, i;
 
-	if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head)))
+	if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head)))
 		return NULL;
 
 	BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head));
 	nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head));
 
+	if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head)))
+		return NULL;
+
 	hash = kvcalloc(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL);
 
 	if (hash && nulls)
--- linux-qcom-6.8.0.orig/net/netfilter/nf_conntrack_netlink.c
+++ linux-qcom-6.8.0/net/netfilter/nf_conntrack_netlink.c
@@ -357,11 +357,11 @@
 static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	struct nlattr *nest_secctx;
-	int len, ret;
-	char *secctx;
+	struct lsmcontext ctx;
+	int ret;
 
-	ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
-	if (ret)
+	ret = security_secid_to_secctx(ct->secmark, &ctx);
+	if (ret < 0)
 		return 0;
 
 	ret = -1;
@@ -369,20 +369,20 @@
 	if (!nest_secctx)
 		goto nla_put_failure;
 
-	if (nla_put_string(skb, CTA_SECCTX_NAME, secctx))
+	if (nla_put_string(skb, CTA_SECCTX_NAME, ctx.context))
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_secctx);
 
 	ret = 0;
 nla_put_failure:
-	security_release_secctx(secctx, len);
+	security_release_secctx(&ctx);
 	return ret;
 }
 #else
 #define ctnetlink_dump_secctx(a, b) (0)
 #endif
 
-#ifdef CONFIG_NF_CONNTRACK_LABELS
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
 static inline int ctnetlink_label_size(const struct nf_conn *ct)
 {
 	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
@@ -391,6 +391,7 @@
 		return 0;
 	return nla_total_size(sizeof(labels->bits));
 }
+#endif
 
 static int
 ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)
@@ -411,10 +412,6 @@
 
 	return 0;
 }
-#else
-#define ctnetlink_dump_labels(a, b) (0)
-#define ctnetlink_label_size(a)	(0)
-#endif
 
 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
 
@@ -669,8 +666,8 @@
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 	int len, ret;
 
-	ret = security_secid_to_secctx(ct->secmark, NULL, &len);
-	if (ret)
+	ret = security_secid_to_secctx(ct->secmark, NULL);
+	if (ret < 0)
 		return 0;
 
 	return nla_total_size(0) /* CTA_SECCTX */
@@ -3420,7 +3417,8 @@
 
 		if (cda[CTA_EXPECT_ID]) {
 			__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
-			if (ntohl(id) != (u32)(unsigned long)exp) {
+
+			if (id != nf_expect_get_id(exp)) {
 				nf_ct_expect_put(exp);
 				return -ENOENT;
 			}
--- linux-qcom-6.8.0.orig/net/netfilter/nf_conntrack_standalone.c
+++ linux-qcom-6.8.0/net/netfilter/nf_conntrack_standalone.c
@@ -22,9 +22,6 @@
 #include <net/netfilter/nf_conntrack_acct.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
-#ifdef CONFIG_LWTUNNEL
-#include <net/netfilter/nf_hooks_lwtunnel.h>
-#endif
 #include <linux/rculist_nulls.h>
 
 static bool enable_hooks __read_mostly;
@@ -175,17 +172,16 @@
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 {
+	struct lsmcontext ctx;
 	int ret;
-	u32 len;
-	char *secctx;
 
-	ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
-	if (ret)
+	ret = security_secid_to_secctx(ct->secmark, &ctx);
+	if (ret < 0)
 		return;
 
-	seq_printf(s, "secctx=%s ", secctx);
+	seq_printf(s, "secctx=%s ", ctx.context);
 
-	security_release_secctx(secctx, len);
+	security_release_secctx(&ctx);
 }
 #else
 static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
@@ -612,9 +608,6 @@
 	NF_SYSCTL_CT_PROTO_TIMEOUT_GRE,
 	NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM,
 #endif
-#ifdef CONFIG_LWTUNNEL
-	NF_SYSCTL_CT_LWTUNNEL,
-#endif
 
 	__NF_SYSCTL_CT_LAST_SYSCTL,
 };
@@ -948,15 +941,6 @@
 		.proc_handler   = proc_dointvec_jiffies,
 	},
 #endif
-#ifdef CONFIG_LWTUNNEL
-	[NF_SYSCTL_CT_LWTUNNEL] = {
-		.procname	= "nf_hooks_lwtunnel",
-		.data		= NULL,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= nf_hooks_lwtunnel_sysctl_handler,
-	},
-#endif
 	{}
 };
 
--- linux-qcom-6.8.0.orig/net/netfilter/nf_flow_table_core.c
+++ linux-qcom-6.8.0/net/netfilter/nf_flow_table_core.c
@@ -77,12 +77,8 @@
 
 static u32 flow_offload_dst_cookie(struct flow_offload_tuple *flow_tuple)
 {
-	const struct rt6_info *rt;
-
-	if (flow_tuple->l3proto == NFPROTO_IPV6) {
-		rt = (const struct rt6_info *)flow_tuple->dst_cache;
-		return rt6_get_cookie(rt);
-	}
+	if (flow_tuple->l3proto == NFPROTO_IPV6)
+		return rt6_get_cookie(dst_rt6_info(flow_tuple->dst_cache));
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/net/netfilter/nf_flow_table_inet.c
+++ linux-qcom-6.8.0/net/netfilter/nf_flow_table_inet.c
@@ -17,11 +17,15 @@
 
 	switch (skb->protocol) {
 	case htons(ETH_P_8021Q):
+		if (!pskb_may_pull(skb, skb_mac_offset(skb) + sizeof(*veth)))
+			return NF_ACCEPT;
+
 		veth = (struct vlan_ethhdr *)skb_mac_header(skb);
 		proto = veth->h_vlan_encapsulated_proto;
 		break;
 	case htons(ETH_P_PPP_SES):
-		proto = nf_flow_pppoe_proto(skb);
+		if (!nf_flow_pppoe_proto(skb, &proto))
+			return NF_ACCEPT;
 		break;
 	default:
 		proto = skb->protocol;
--- linux-qcom-6.8.0.orig/net/netfilter/nf_flow_table_ip.c
+++ linux-qcom-6.8.0/net/netfilter/nf_flow_table_ip.c
@@ -157,7 +157,7 @@
 		tuple->encap[i].proto = skb->protocol;
 		break;
 	case htons(ETH_P_PPP_SES):
-		phdr = (struct pppoe_hdr *)skb_mac_header(skb);
+		phdr = (struct pppoe_hdr *)skb_network_header(skb);
 		tuple->encap[i].id = ntohs(phdr->sid);
 		tuple->encap[i].proto = skb->protocol;
 		break;
@@ -273,13 +273,17 @@
 	return NF_STOLEN;
 }
 
-static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto,
+static bool nf_flow_skb_encap_protocol(struct sk_buff *skb, __be16 proto,
 				       u32 *offset)
 {
 	struct vlan_ethhdr *veth;
+	__be16 inner_proto;
 
 	switch (skb->protocol) {
 	case htons(ETH_P_8021Q):
+		if (!pskb_may_pull(skb, skb_mac_offset(skb) + sizeof(*veth)))
+			return false;
+
 		veth = (struct vlan_ethhdr *)skb_mac_header(skb);
 		if (veth->h_vlan_encapsulated_proto == proto) {
 			*offset += VLAN_HLEN;
@@ -287,7 +291,8 @@
 		}
 		break;
 	case htons(ETH_P_PPP_SES):
-		if (nf_flow_pppoe_proto(skb) == proto) {
+		if (nf_flow_pppoe_proto(skb, &inner_proto) &&
+		    inner_proto == proto) {
 			*offset += PPPOE_SES_HLEN;
 			return true;
 		}
@@ -316,7 +321,7 @@
 			skb_reset_network_header(skb);
 			break;
 		case htons(ETH_P_PPP_SES):
-			skb->protocol = nf_flow_pppoe_proto(skb);
+			skb->protocol = __nf_flow_pppoe_proto(skb);
 			skb_pull(skb, PPPOE_SES_HLEN);
 			skb_reset_network_header(skb);
 			break;
@@ -432,7 +437,7 @@
 		return NF_ACCEPT;
 
 	if (unlikely(tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)) {
-		rt = (struct rtable *)tuplehash->tuple.dst_cache;
+		rt = dst_rtable(tuplehash->tuple.dst_cache);
 		memset(skb->cb, 0, sizeof(struct inet_skb_parm));
 		IPCB(skb)->iif = skb->dev->ifindex;
 		IPCB(skb)->flags = IPSKB_FORWARDED;
@@ -444,7 +449,7 @@
 
 	switch (tuplehash->tuple.xmit_type) {
 	case FLOW_OFFLOAD_XMIT_NEIGH:
-		rt = (struct rtable *)tuplehash->tuple.dst_cache;
+		rt = dst_rtable(tuplehash->tuple.dst_cache);
 		outdev = rt->dst.dev;
 		skb->dev = outdev;
 		nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
@@ -727,7 +732,7 @@
 		return NF_ACCEPT;
 
 	if (unlikely(tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)) {
-		rt = (struct rt6_info *)tuplehash->tuple.dst_cache;
+		rt = dst_rt6_info(tuplehash->tuple.dst_cache);
 		memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
 		IP6CB(skb)->iif = skb->dev->ifindex;
 		IP6CB(skb)->flags = IP6SKB_FORWARDED;
@@ -739,7 +744,7 @@
 
 	switch (tuplehash->tuple.xmit_type) {
 	case FLOW_OFFLOAD_XMIT_NEIGH:
-		rt = (struct rt6_info *)tuplehash->tuple.dst_cache;
+		rt = dst_rt6_info(tuplehash->tuple.dst_cache);
 		outdev = rt->dst.dev;
 		skb->dev = outdev;
 		nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
--- linux-qcom-6.8.0.orig/net/netfilter/nf_flow_table_offload.c
+++ linux-qcom-6.8.0/net/netfilter/nf_flow_table_offload.c
@@ -841,8 +841,8 @@
 				 struct list_head *block_cb_list)
 {
 	struct flow_cls_offload cls_flow = {};
+	struct netlink_ext_ack extack = {};
 	struct flow_block_cb *block_cb;
-	struct netlink_ext_ack extack;
 	__be16 proto = ETH_P_ALL;
 	int err, i = 0;
 
--- linux-qcom-6.8.0.orig/net/netfilter/nf_hooks_lwtunnel.c
+++ linux-qcom-6.8.0/net/netfilter/nf_hooks_lwtunnel.c
@@ -3,6 +3,9 @@
 #include <linux/sysctl.h>
 #include <net/lwtunnel.h>
 #include <net/netfilter/nf_hooks_lwtunnel.h>
+#include <linux/netfilter.h>
+
+#include "nf_internals.h"
 
 static inline int nf_hooks_lwtunnel_get(void)
 {
@@ -50,4 +53,71 @@
 	return ret;
 }
 EXPORT_SYMBOL_GPL(nf_hooks_lwtunnel_sysctl_handler);
+
+static struct ctl_table nf_lwtunnel_sysctl_table[] = {
+	{
+		.procname	= "nf_hooks_lwtunnel",
+		.data		= NULL,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= nf_hooks_lwtunnel_sysctl_handler,
+	},
+};
+
+static int __net_init nf_lwtunnel_net_init(struct net *net)
+{
+	struct ctl_table_header *hdr;
+	struct ctl_table *table;
+
+	table = nf_lwtunnel_sysctl_table;
+	if (!net_eq(net, &init_net)) {
+		table = kmemdup(nf_lwtunnel_sysctl_table,
+				sizeof(nf_lwtunnel_sysctl_table),
+				GFP_KERNEL);
+		if (!table)
+			goto err_alloc;
+	}
+
+	hdr = register_net_sysctl_sz(net, "net/netfilter", table,
+				     ARRAY_SIZE(nf_lwtunnel_sysctl_table));
+	if (!hdr)
+		goto err_reg;
+
+	net->nf.nf_lwtnl_dir_header = hdr;
+
+	return 0;
+err_reg:
+	if (!net_eq(net, &init_net))
+		kfree(table);
+err_alloc:
+	return -ENOMEM;
+}
+
+static void __net_exit nf_lwtunnel_net_exit(struct net *net)
+{
+	const struct ctl_table *table;
+
+	table = net->nf.nf_lwtnl_dir_header->ctl_table_arg;
+	unregister_net_sysctl_table(net->nf.nf_lwtnl_dir_header);
+	if (!net_eq(net, &init_net))
+		kfree(table);
+}
+
+static struct pernet_operations nf_lwtunnel_net_ops = {
+	.init = nf_lwtunnel_net_init,
+	.exit = nf_lwtunnel_net_exit,
+};
+
+int __init netfilter_lwtunnel_init(void)
+{
+	return register_pernet_subsys(&nf_lwtunnel_net_ops);
+}
+
+void netfilter_lwtunnel_fini(void)
+{
+	unregister_pernet_subsys(&nf_lwtunnel_net_ops);
+}
+#else
+int __init netfilter_lwtunnel_init(void) { return 0; }
+void netfilter_lwtunnel_fini(void) {}
 #endif /* CONFIG_SYSCTL */
--- linux-qcom-6.8.0.orig/net/netfilter/nf_internals.h
+++ linux-qcom-6.8.0/net/netfilter/nf_internals.h
@@ -29,6 +29,12 @@
 /* nf_log.c */
 int __init netfilter_log_init(void);
 
+#ifdef CONFIG_LWTUNNEL
+/* nf_hooks_lwtunnel.c */
+int __init netfilter_lwtunnel_init(void);
+void netfilter_lwtunnel_fini(void);
+#endif
+
 /* core.c */
 void nf_hook_entries_delete_raw(struct nf_hook_entries __rcu **pp,
 				const struct nf_hook_ops *reg);
--- linux-qcom-6.8.0.orig/net/netfilter/nf_nat_core.c
+++ linux-qcom-6.8.0/net/netfilter/nf_nat_core.c
@@ -183,7 +183,35 @@
 	return reciprocal_scale(hash, nf_nat_htable_size);
 }
 
-/* Is this tuple already taken? (not by us) */
+/**
+ * nf_nat_used_tuple - check if proposed nat tuple clashes with existing entry
+ * @tuple: proposed NAT binding
+ * @ignored_conntrack: our (unconfirmed) conntrack entry
+ *
+ * A conntrack entry can be inserted to the connection tracking table
+ * if there is no existing entry with an identical tuple in either direction.
+ *
+ * Example:
+ * INITIATOR -> NAT/PAT -> RESPONDER
+ *
+ * INITIATOR passes through NAT/PAT ("us") and SNAT is done (saddr rewrite).
+ * Then, later, NAT/PAT itself also connects to RESPONDER.
+ *
+ * This will not work if the SNAT done earlier has same IP:PORT source pair.
+ *
+ * Conntrack table has:
+ * ORIGINAL: $IP_INITIATOR:$SPORT -> $IP_RESPONDER:$DPORT
+ * REPLY:    $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT
+ *
+ * and new locally originating connection wants:
+ * ORIGINAL: $IP_NAT:$SPORT -> $IP_RESPONDER:$DPORT
+ * REPLY:    $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT
+ *
+ * ... which would mean incoming packets cannot be distinguished between
+ * the existing and the newly added entry (identical IP_CT_DIR_REPLY tuple).
+ *
+ * @return: true if the proposed NAT mapping collides with an existing entry.
+ */
 static int
 nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,
 		  const struct nf_conn *ignored_conntrack)
@@ -200,6 +228,94 @@
 	return nf_conntrack_tuple_taken(&reply, ignored_conntrack);
 }
 
+static bool nf_nat_allow_clash(const struct nf_conn *ct)
+{
+	return nf_ct_l4proto_find(nf_ct_protonum(ct))->allow_clash;
+}
+
+/**
+ * nf_nat_used_tuple_new - check if to-be-inserted conntrack collides with existing entry
+ * @tuple: proposed NAT binding
+ * @ignored_ct: our (unconfirmed) conntrack entry
+ *
+ * Same as nf_nat_used_tuple, but also check for rare clash in reverse
+ * direction. Should be called only when @tuple has not been altered, i.e.
+ * @ignored_conntrack will not be subject to NAT.
+ *
+ * @return: true if the proposed NAT mapping collides with existing entry.
+ */
+static noinline bool
+nf_nat_used_tuple_new(const struct nf_conntrack_tuple *tuple,
+		      const struct nf_conn *ignored_ct)
+{
+	static const unsigned long uses_nat = IPS_NAT_MASK | IPS_SEQ_ADJUST_BIT;
+	const struct nf_conntrack_tuple_hash *thash;
+	const struct nf_conntrack_zone *zone;
+	struct nf_conn *ct;
+	bool taken = true;
+	struct net *net;
+
+	if (!nf_nat_used_tuple(tuple, ignored_ct))
+		return false;
+
+	if (!nf_nat_allow_clash(ignored_ct))
+		return true;
+
+	/* Initial choice clashes with existing conntrack.
+	 * Check for (rare) reverse collision.
+	 *
+	 * This can happen when new packets are received in both directions
+	 * at the exact same time on different CPUs.
+	 *
+	 * Without SMP, first packet creates new conntrack entry and second
+	 * packet is resolved as established reply packet.
+	 *
+	 * With parallel processing, both packets could be picked up as
+	 * new and both get their own ct entry allocated.
+	 *
+	 * If ignored_conntrack and colliding ct are not subject to NAT then
+	 * pretend the tuple is available and let later clash resolution
+	 * handle this at insertion time.
+	 *
+	 * Without it, the 'reply' packet has its source port rewritten
+	 * by nat engine.
+	 */
+	if (READ_ONCE(ignored_ct->status) & uses_nat)
+		return true;
+
+	net = nf_ct_net(ignored_ct);
+	zone = nf_ct_zone(ignored_ct);
+
+	thash = nf_conntrack_find_get(net, zone, tuple);
+	if (unlikely(!thash)) /* clashing entry went away */
+		return false;
+
+	ct = nf_ct_tuplehash_to_ctrack(thash);
+
+	/* NB: IP_CT_DIR_ORIGINAL should be impossible because
+	 * nf_nat_used_tuple() handles origin collisions.
+	 *
+	 * Handle remote chance other CPU confirmed its ct right after.
+	 */
+	if (thash->tuple.dst.dir != IP_CT_DIR_REPLY)
+		goto out;
+
+	/* clashing connection subject to NAT? Retry with new tuple. */
+	if (READ_ONCE(ct->status) & uses_nat)
+		goto out;
+
+	if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+			      &ignored_ct->tuplehash[IP_CT_DIR_REPLY].tuple) &&
+	    nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
+			      &ignored_ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)) {
+		taken = false;
+		goto out;
+	}
+out:
+	nf_ct_put(ct);
+	return taken;
+}
+
 static bool nf_nat_may_kill(struct nf_conn *ct, unsigned long flags)
 {
 	static const unsigned long flags_refuse = IPS_FIXED_TIMEOUT |
@@ -611,7 +727,7 @@
 	    !(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) {
 		/* try the original tuple first */
 		if (nf_in_range(orig_tuple, range)) {
-			if (!nf_nat_used_tuple(orig_tuple, ct)) {
+			if (!nf_nat_used_tuple_new(orig_tuple, ct)) {
 				*tuple = *orig_tuple;
 				return;
 			}
--- linux-qcom-6.8.0.orig/net/netfilter/nf_tables_api.c
+++ linux-qcom-6.8.0/net/netfilter/nf_tables_api.c
@@ -594,6 +594,12 @@
 				  const struct nft_set_iter *iter,
 				  struct nft_elem_priv *elem_priv)
 {
+	struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
+
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
+	nft_set_elem_change_active(ctx->net, set, ext);
 	nft_setelem_data_deactivate(ctx->net, set, elem_priv);
 
 	return 0;
@@ -617,6 +623,7 @@
 		if (!nft_set_elem_active(ext, genmask))
 			continue;
 
+		nft_set_elem_change_active(ctx->net, set, ext);
 		nft_setelem_data_deactivate(ctx->net, set, catchall->elem);
 		break;
 	}
@@ -626,6 +633,7 @@
 {
 	struct nft_set_iter iter = {
 		.genmask	= nft_genmask_next(ctx->net),
+		.type		= NFT_ITER_UPDATE,
 		.fn		= nft_mapelem_deactivate,
 	};
 
@@ -1198,6 +1206,26 @@
 #define __NFT_TABLE_F_UPDATE		(__NFT_TABLE_F_WAS_DORMANT | \
 					 __NFT_TABLE_F_WAS_AWAKEN)
 
+static bool nft_table_pending_update(const struct nft_ctx *ctx)
+{
+	struct nftables_pernet *nft_net = nft_pernet(ctx->net);
+	struct nft_trans *trans;
+
+	if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
+		return true;
+
+	list_for_each_entry(trans, &nft_net->commit_list, list) {
+		if (trans->ctx.table == ctx->table &&
+		    ((trans->msg_type == NFT_MSG_NEWCHAIN &&
+		      nft_trans_chain_update(trans)) ||
+		     (trans->msg_type == NFT_MSG_DELCHAIN &&
+		      nft_is_base_chain(trans->ctx.chain))))
+			return true;
+	}
+
+	return false;
+}
+
 static int nf_tables_updtable(struct nft_ctx *ctx)
 {
 	struct nft_trans *trans;
@@ -1211,7 +1239,7 @@
 	if (flags & ~NFT_TABLE_F_MASK)
 		return -EOPNOTSUPP;
 
-	if (flags == ctx->table->flags)
+	if (flags == (ctx->table->flags & NFT_TABLE_F_MASK))
 		return 0;
 
 	if ((nft_table_has_owner(ctx->table) &&
@@ -1221,7 +1249,7 @@
 		return -EOPNOTSUPP;
 
 	/* No dormant off/on/off/on games in single transaction */
-	if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
+	if (nft_table_pending_update(ctx))
 		return -EINVAL;
 
 	trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
@@ -1755,7 +1783,7 @@
 		if (!hook_list)
 			hook_list = &basechain->hook_list;
 
-		list_for_each_entry(hook, hook_list, list) {
+		list_for_each_entry_rcu(hook, hook_list, list) {
 			if (!first)
 				first = hook;
 
@@ -2038,9 +2066,9 @@
 	kvfree(chain->blob_next);
 }
 
-void nf_tables_chain_destroy(struct nft_ctx *ctx)
+void nf_tables_chain_destroy(struct nft_chain *chain)
 {
-	struct nft_chain *chain = ctx->chain;
+	const struct nft_table *table = chain->table;
 	struct nft_hook *hook, *next;
 
 	if (WARN_ON(chain->use > 0))
@@ -2052,7 +2080,7 @@
 	if (nft_is_base_chain(chain)) {
 		struct nft_base_chain *basechain = nft_base_chain(chain);
 
-		if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) {
+		if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) {
 			list_for_each_entry_safe(hook, next,
 						 &basechain->hook_list, list) {
 				list_del_rcu(&hook->list);
@@ -2418,6 +2446,9 @@
 		struct nft_stats __percpu *stats = NULL;
 		struct nft_chain_hook hook = {};
 
+		if (table->flags & __NFT_TABLE_F_UPDATE)
+			return -EINVAL;
+
 		if (flags & NFT_CHAIN_BINDING)
 			return -EOPNOTSUPP;
 
@@ -2538,7 +2569,7 @@
 err_trans:
 	nft_use_dec_restore(&table->use);
 err_destroy_chain:
-	nf_tables_chain_destroy(ctx);
+	nf_tables_chain_destroy(chain);
 
 	return err;
 }
@@ -2619,17 +2650,11 @@
 		}
 	}
 
-	if (nla[NFTA_CHAIN_COUNTERS]) {
-		if (!nft_is_base_chain(chain)) {
-			err = -EOPNOTSUPP;
-			goto err_hooks;
-		}
-
-		stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
-		if (IS_ERR(stats)) {
-			err = PTR_ERR(stats);
-			goto err_hooks;
-		}
+	if (table->flags & __NFT_TABLE_F_UPDATE &&
+	    !list_empty(&hook.list)) {
+		NL_SET_BAD_ATTR(extack, attr);
+		err = -EOPNOTSUPP;
+		goto err_hooks;
 	}
 
 	if (!(table->flags & NFT_TABLE_F_DORMANT) &&
@@ -2646,6 +2671,20 @@
 	}
 
 	unregister = true;
+
+	if (nla[NFTA_CHAIN_COUNTERS]) {
+		if (!nft_is_base_chain(chain)) {
+			err = -EOPNOTSUPP;
+			goto err_hooks;
+		}
+
+		stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
+		if (IS_ERR(stats)) {
+			err = PTR_ERR(stats);
+			goto err_hooks;
+		}
+	}
+
 	err = -ENOMEM;
 	trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
 				sizeof(struct nft_trans_chain));
@@ -2847,6 +2886,9 @@
 	struct nft_trans *trans;
 	int err;
 
+	if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
+		return -EOPNOTSUPP;
+
 	err = nft_chain_parse_hook(ctx->net, basechain, nla, &chain_hook,
 				   ctx->family, chain->flags, extack);
 	if (err < 0)
@@ -2931,7 +2973,8 @@
 	nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla);
 
 	if (nla[NFTA_CHAIN_HOOK]) {
-		if (chain->flags & NFT_CHAIN_HW_OFFLOAD)
+		if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN ||
+		    chain->flags & NFT_CHAIN_HW_OFFLOAD)
 			return -EOPNOTSUPP;
 
 		if (nft_is_base_chain(chain)) {
@@ -3013,7 +3056,7 @@
 {
 	const struct nft_expr_type *type, *candidate = NULL;
 
-	list_for_each_entry(type, &nf_tables_expressions, list) {
+	list_for_each_entry_rcu(type, &nf_tables_expressions, list) {
 		if (!nla_strcmp(nla, type->name)) {
 			if (!type->family && !candidate)
 				candidate = type;
@@ -3045,9 +3088,13 @@
 	if (nla == NULL)
 		return ERR_PTR(-EINVAL);
 
+	rcu_read_lock();
 	type = __nft_expr_type_get(family, nla);
-	if (type != NULL && try_module_get(type->owner))
+	if (type != NULL && try_module_get(type->owner)) {
+		rcu_read_unlock();
 		return type;
+	}
+	rcu_read_unlock();
 
 	lockdep_nfnl_nft_mutex_not_held();
 #ifdef CONFIG_MODULES
@@ -3184,25 +3231,37 @@
 	if (!tb[NFTA_EXPR_DATA] || !tb[NFTA_EXPR_NAME])
 		return -EINVAL;
 
+	rcu_read_lock();
+
 	type = __nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
-	if (!type)
-		return -ENOENT;
+	if (!type) {
+		err = -ENOENT;
+		goto out_unlock;
+	}
 
-	if (!type->inner_ops)
-		return -EOPNOTSUPP;
+	if (!type->inner_ops) {
+		err = -EOPNOTSUPP;
+		goto out_unlock;
+	}
 
 	err = nla_parse_nested_deprecated(info->tb, type->maxattr,
 					  tb[NFTA_EXPR_DATA],
 					  type->policy, NULL);
 	if (err < 0)
-		goto err_nla_parse;
+		goto out_unlock;
 
 	info->attr = nla;
 	info->ops = type->inner_ops;
 
+	/* No module reference will be taken on type->owner.
+	 * Presence of type->inner_ops implies that the expression
+	 * is builtin, so it cannot go away.
+	 */
+	rcu_read_unlock();
 	return 0;
 
-err_nla_parse:
+out_unlock:
+	rcu_read_unlock();
 	return err;
 }
 
@@ -3301,13 +3360,15 @@
  * Rules
  */
 
-static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
+static struct nft_rule *__nft_rule_lookup(const struct net *net,
+					  const struct nft_chain *chain,
 					  u64 handle)
 {
 	struct nft_rule *rule;
 
 	// FIXME: this sucks
-	list_for_each_entry_rcu(rule, &chain->rules, list) {
+	list_for_each_entry_rcu(rule, &chain->rules, list,
+				lockdep_commit_lock_is_held(net)) {
 		if (handle == rule->handle)
 			return rule;
 	}
@@ -3315,13 +3376,14 @@
 	return ERR_PTR(-ENOENT);
 }
 
-static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
+static struct nft_rule *nft_rule_lookup(const struct net *net,
+					const struct nft_chain *chain,
 					const struct nlattr *nla)
 {
 	if (nla == NULL)
 		return ERR_PTR(-EINVAL);
 
-	return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
+	return __nft_rule_lookup(net, chain, be64_to_cpu(nla_get_be64(nla)));
 }
 
 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
@@ -3622,7 +3684,7 @@
 	return 0;
 }
 
-/* called with rcu_read_lock held */
+/* Caller must hold rcu read lock or transaction mutex */
 static struct sk_buff *
 nf_tables_getrule_single(u32 portid, const struct nfnl_info *info,
 			 const struct nlattr * const nla[], bool reset)
@@ -3649,7 +3711,7 @@
 		return ERR_CAST(chain);
 	}
 
-	rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
+	rule = nft_rule_lookup(net, chain, nla[NFTA_RULE_HANDLE]);
 	if (IS_ERR(rule)) {
 		NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
 		return ERR_CAST(rule);
@@ -3758,12 +3820,24 @@
 	kfree(rule);
 }
 
+/* can only be used if rule is no longer visible to dumps */
 static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule)
 {
+	lockdep_commit_lock_is_held(ctx->net);
+
 	nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
 	nf_tables_rule_destroy(ctx, rule);
 }
 
+/** nft_chain_validate - loop detection and hook validation
+ *
+ * @ctx: context containing call depth and base chain
+ * @chain: chain to validate
+ *
+ * Walk through the rules of the given chain and chase all jumps/gotos
+ * and set lookups until either the jump limit is hit or all reachable
+ * chains have been validated.
+ */
 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
 {
 	struct nft_expr *expr, *last;
@@ -3785,6 +3859,9 @@
 			if (!expr->ops->validate)
 				continue;
 
+			/* This may call nft_chain_validate() recursively,
+			 * callers that do so must increment ctx->level.
+			 */
 			err = expr->ops->validate(ctx, expr, &data);
 			if (err < 0)
 				return err;
@@ -3828,6 +3905,9 @@
 	const struct nft_data *data;
 	int err;
 
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
 	if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
 	    *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
 		return 0;
@@ -3851,17 +3931,20 @@
 
 int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set)
 {
-	u8 genmask = nft_genmask_next(ctx->net);
+	struct nft_set_iter dummy_iter = {
+		.genmask	= nft_genmask_next(ctx->net),
+	};
 	struct nft_set_elem_catchall *catchall;
+
 	struct nft_set_ext *ext;
 	int ret = 0;
 
 	list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
 		ext = nft_set_elem_ext(set, catchall->elem);
-		if (!nft_set_elem_active(ext, genmask))
+		if (!nft_set_elem_active(ext, dummy_iter.genmask))
 			continue;
 
-		ret = nft_setelem_validate(ctx, set, NULL, catchall->elem);
+		ret = nft_setelem_validate(ctx, set, &dummy_iter, catchall->elem);
 		if (ret < 0)
 			return ret;
 	}
@@ -3930,7 +4013,7 @@
 
 	if (nla[NFTA_RULE_HANDLE]) {
 		handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
-		rule = __nft_rule_lookup(chain, handle);
+		rule = __nft_rule_lookup(net, chain, handle);
 		if (IS_ERR(rule)) {
 			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
 			return PTR_ERR(rule);
@@ -3952,7 +4035,7 @@
 
 		if (nla[NFTA_RULE_POSITION]) {
 			pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
-			old_rule = __nft_rule_lookup(chain, pos_handle);
+			old_rule = __nft_rule_lookup(net, chain, pos_handle);
 			if (IS_ERR(old_rule)) {
 				NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
 				return PTR_ERR(old_rule);
@@ -4169,7 +4252,7 @@
 
 	if (chain) {
 		if (nla[NFTA_RULE_HANDLE]) {
-			rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
+			rule = nft_rule_lookup(info->net, chain, nla[NFTA_RULE_HANDLE]);
 			if (IS_ERR(rule)) {
 				if (PTR_ERR(rule) == -ENOENT &&
 				    NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE)
@@ -4472,7 +4555,7 @@
 		return -ERANGE;
 
 	ms *= NSEC_PER_MSEC;
-	*result = nsecs_to_jiffies64(ms);
+	*result = nsecs_to_jiffies64(ms) ? : !!ms;
 	return 0;
 }
 
@@ -5007,6 +5090,9 @@
 		if ((flags & (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) ==
 			     (NFT_SET_CONSTANT | NFT_SET_TIMEOUT))
 			return -EOPNOTSUPP;
+		if ((flags & (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) ==
+			     (NFT_SET_CONSTANT | NFT_SET_TIMEOUT))
+			return -EOPNOTSUPP;
 	}
 
 	desc.dtype = 0;
@@ -5355,6 +5441,11 @@
 					const struct nft_set_iter *iter,
 					struct nft_elem_priv *elem_priv)
 {
+	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
+
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
 	return nft_setelem_data_validate(ctx, set, elem_priv);
 }
 
@@ -5399,6 +5490,7 @@
 		}
 
 		iter.genmask	= nft_genmask_next(ctx->net);
+		iter.type	= NFT_ITER_UPDATE;
 		iter.skip 	= 0;
 		iter.count	= 0;
 		iter.err	= 0;
@@ -5446,6 +5538,13 @@
 				const struct nft_set_iter *iter,
 				struct nft_elem_priv *elem_priv)
 {
+	struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
+
+	/* called from abort path, reverse check to undo changes. */
+	if (nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
+	nft_clear(ctx->net, ext);
 	nft_setelem_data_activate(ctx->net, set, elem_priv);
 
 	return 0;
@@ -5463,6 +5562,7 @@
 		if (!nft_set_elem_active(ext, genmask))
 			continue;
 
+		nft_clear(ctx->net, ext);
 		nft_setelem_data_activate(ctx->net, set, catchall->elem);
 		break;
 	}
@@ -5472,6 +5572,7 @@
 {
 	struct nft_set_iter iter = {
 		.genmask	= nft_genmask_next(ctx->net),
+		.type		= NFT_ITER_UPDATE,
 		.fn		= nft_mapelem_activate,
 	};
 
@@ -5498,6 +5599,8 @@
 			      struct nft_set_binding *binding,
 			      enum nft_trans_phase phase)
 {
+	lockdep_commit_lock_is_held(ctx->net);
+
 	switch (phase) {
 	case NFT_TRANS_PREPARE_ERROR:
 		nft_set_trans_unbind(ctx, set);
@@ -5665,8 +5768,7 @@
 
 	if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
 	    nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
-			  set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
-			  set->dlen) < 0)
+			  nft_set_datatype(set), set->dlen) < 0)
 		goto nla_put_failure;
 
 	if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) &&
@@ -5736,6 +5838,9 @@
 	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
 	struct nft_set_dump_args *args;
 
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
 	if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext))
 		return 0;
 
@@ -5846,6 +5951,7 @@
 	args.skb		= skb;
 	args.reset		= dump_ctx->reset;
 	args.iter.genmask	= nft_genmask_cur(net);
+	args.iter.type		= NFT_ITER_READ;
 	args.iter.skip		= cb->args[0];
 	args.iter.count		= 0;
 	args.iter.err		= 0;
@@ -6541,7 +6647,7 @@
 		}
 	}
 
-	catchall = kmalloc(sizeof(*catchall), GFP_KERNEL);
+	catchall = kmalloc(sizeof(*catchall), GFP_KERNEL_ACCOUNT);
 	if (!catchall)
 		return -ENOMEM;
 
@@ -6585,7 +6691,7 @@
 	struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
 
 	if (nft_setelem_is_catchall(set, elem_priv)) {
-		nft_set_elem_change_active(net, set, ext);
+		nft_clear(net, ext);
 	} else {
 		set->ops->activate(net, set, elem_priv);
 	}
@@ -6777,17 +6883,23 @@
 			return err;
 	} else if (set->flags & NFT_SET_TIMEOUT &&
 		   !(flags & NFT_SET_ELEM_INTERVAL_END)) {
-		timeout = READ_ONCE(set->timeout);
+		timeout = set->timeout;
 	}
 
 	expiration = 0;
 	if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
 		if (!(set->flags & NFT_SET_TIMEOUT))
 			return -EINVAL;
+		if (timeout == 0)
+			return -EOPNOTSUPP;
+
 		err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
 					    &expiration);
 		if (err)
 			return err;
+
+		if (expiration > timeout)
+			return -ERANGE;
 	}
 
 	if (nla[NFTA_SET_ELEM_EXPR]) {
@@ -6878,7 +6990,7 @@
 		if (err < 0)
 			goto err_parse_key_end;
 
-		if (timeout != READ_ONCE(set->timeout)) {
+		if (timeout != set->timeout) {
 			err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
 			if (err < 0)
 				goto err_parse_key_end;
@@ -7144,6 +7256,16 @@
 	}
 }
 
+static int nft_setelem_active_next(const struct net *net,
+				   const struct nft_set *set,
+				   struct nft_elem_priv *elem_priv)
+{
+	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
+	u8 genmask = nft_genmask_next(net);
+
+	return nft_set_elem_active(ext, genmask);
+}
+
 static void nft_setelem_data_activate(const struct net *net,
 				      const struct nft_set *set,
 				      struct nft_elem_priv *elem_priv)
@@ -7267,8 +7389,12 @@
 			     const struct nft_set_iter *iter,
 			     struct nft_elem_priv *elem_priv)
 {
+	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
 	struct nft_trans *trans;
 
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
 	trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
 				    sizeof(struct nft_trans_elem), GFP_ATOMIC);
 	if (!trans)
@@ -7330,6 +7456,7 @@
 {
 	struct nft_set_iter iter = {
 		.genmask	= genmask,
+		.type		= NFT_ITER_UPDATE,
 		.fn		= nft_setelem_flush,
 	};
 
@@ -7565,7 +7692,7 @@
 {
 	const struct nft_object_type *type;
 
-	list_for_each_entry(type, &nf_tables_objects, list) {
+	list_for_each_entry_rcu(type, &nf_tables_objects, list) {
 		if (type->family != NFPROTO_UNSPEC &&
 		    type->family != family)
 			continue;
@@ -7581,9 +7708,13 @@
 {
 	const struct nft_object_type *type;
 
+	rcu_read_lock();
 	type = __nft_obj_type_get(objtype, family);
-	if (type != NULL && try_module_get(type->owner))
+	if (type != NULL && try_module_get(type->owner)) {
+		rcu_read_unlock();
 		return type;
+	}
+	rcu_read_unlock();
 
 	lockdep_nfnl_nft_mutex_not_held();
 #ifdef CONFIG_MODULES
@@ -7604,9 +7735,7 @@
 	struct nft_trans *trans;
 	int err = -ENOMEM;
 
-	if (!try_module_get(type->owner))
-		return -ENOENT;
-
+	/* caller must have obtained type->owner reference. */
 	trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
 				sizeof(struct nft_trans_obj));
 	if (!trans)
@@ -7674,12 +7803,16 @@
 		if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
 			return -EOPNOTSUPP;
 
-		type = __nft_obj_type_get(objtype, family);
-		if (WARN_ON_ONCE(!type))
-			return -ENOENT;
+		if (!obj->ops->update)
+			return 0;
+
+		type = nft_obj_type_get(net, objtype, family);
+		if (WARN_ON_ONCE(IS_ERR(type)))
+			return PTR_ERR(type);
 
 		nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
 
+		/* type->owner reference is put when transaction object is released. */
 		return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
 	}
 
@@ -7865,6 +7998,19 @@
 	return skb->len;
 }
 
+static int nf_tables_dumpreset_obj(struct sk_buff *skb,
+				   struct netlink_callback *cb)
+{
+	struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk));
+	int ret;
+
+	mutex_lock(&nft_net->commit_mutex);
+	ret = nf_tables_dump_obj(skb, cb);
+	mutex_unlock(&nft_net->commit_mutex);
+
+	return ret;
+}
+
 static int nf_tables_dump_obj_start(struct netlink_callback *cb)
 {
 	struct nft_obj_dump_ctx *ctx = (void *)cb->ctx;
@@ -7881,12 +8027,18 @@
 	if (nla[NFTA_OBJ_TYPE])
 		ctx->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
 
-	if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
-		ctx->reset = true;
-
 	return 0;
 }
 
+static int nf_tables_dumpreset_obj_start(struct netlink_callback *cb)
+{
+	struct nft_obj_dump_ctx *ctx = (void *)cb->ctx;
+
+	ctx->reset = true;
+
+	return nf_tables_dump_obj_start(cb);
+}
+
 static int nf_tables_dump_obj_done(struct netlink_callback *cb)
 {
 	struct nft_obj_dump_ctx *ctx = (void *)cb->ctx;
@@ -7896,9 +8048,10 @@
 	return 0;
 }
 
-/* called with rcu_read_lock held */
-static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
-			    const struct nlattr * const nla[])
+/* Caller must hold rcu read lock or transaction mutex */
+static struct sk_buff *
+nf_tables_getobj_single(u32 portid, const struct nfnl_info *info,
+			const struct nlattr * const nla[], bool reset)
 {
 	struct netlink_ext_ack *extack = info->extack;
 	u8 genmask = nft_genmask_cur(info->net);
@@ -7907,72 +8060,109 @@
 	struct net *net = info->net;
 	struct nft_object *obj;
 	struct sk_buff *skb2;
-	bool reset = false;
 	u32 objtype;
 	int err;
 
-	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
-		struct netlink_dump_control c = {
-			.start = nf_tables_dump_obj_start,
-			.dump = nf_tables_dump_obj,
-			.done = nf_tables_dump_obj_done,
-			.module = THIS_MODULE,
-			.data = (void *)nla,
-		};
-
-		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
-	}
-
 	if (!nla[NFTA_OBJ_NAME] ||
 	    !nla[NFTA_OBJ_TYPE])
-		return -EINVAL;
+		return ERR_PTR(-EINVAL);
 
 	table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0);
 	if (IS_ERR(table)) {
 		NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
-		return PTR_ERR(table);
+		return ERR_CAST(table);
 	}
 
 	objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
 	obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
 	if (IS_ERR(obj)) {
 		NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
-		return PTR_ERR(obj);
+		return ERR_CAST(obj);
 	}
 
 	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
 	if (!skb2)
-		return -ENOMEM;
+		return ERR_PTR(-ENOMEM);
+
+	err = nf_tables_fill_obj_info(skb2, net, portid,
+				      info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
+				      family, table, obj, reset);
+	if (err < 0) {
+		kfree_skb(skb2);
+		return ERR_PTR(err);
+	}
 
-	if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
-		reset = true;
+	return skb2;
+}
 
-	if (reset) {
-		const struct nftables_pernet *nft_net;
-		char *buf;
+static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
+			    const struct nlattr * const nla[])
+{
+	u32 portid = NETLINK_CB(skb).portid;
+	struct sk_buff *skb2;
 
-		nft_net = nft_pernet(net);
-		buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, nft_net->base_seq);
+	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
+		struct netlink_dump_control c = {
+			.start = nf_tables_dump_obj_start,
+			.dump = nf_tables_dump_obj,
+			.done = nf_tables_dump_obj_done,
+			.module = THIS_MODULE,
+			.data = (void *)nla,
+		};
 
-		audit_log_nfcfg(buf,
-				family,
-				1,
-				AUDIT_NFT_OP_OBJ_RESET,
-				GFP_ATOMIC);
-		kfree(buf);
+		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
 	}
 
-	err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
-				      info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
-				      family, table, obj, reset);
-	if (err < 0)
-		goto err_fill_obj_info;
+	skb2 = nf_tables_getobj_single(portid, info, nla, false);
+	if (IS_ERR(skb2))
+		return PTR_ERR(skb2);
 
-	return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+	return nfnetlink_unicast(skb2, info->net, portid);
+}
 
-err_fill_obj_info:
-	kfree_skb(skb2);
-	return err;
+static int nf_tables_getobj_reset(struct sk_buff *skb,
+				  const struct nfnl_info *info,
+				  const struct nlattr * const nla[])
+{
+	struct nftables_pernet *nft_net = nft_pernet(info->net);
+	u32 portid = NETLINK_CB(skb).portid;
+	struct net *net = info->net;
+	struct sk_buff *skb2;
+	char *buf;
+
+	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
+		struct netlink_dump_control c = {
+			.start = nf_tables_dumpreset_obj_start,
+			.dump = nf_tables_dumpreset_obj,
+			.done = nf_tables_dump_obj_done,
+			.module = THIS_MODULE,
+			.data = (void *)nla,
+		};
+
+		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
+	}
+
+	if (!try_module_get(THIS_MODULE))
+		return -EINVAL;
+	rcu_read_unlock();
+	mutex_lock(&nft_net->commit_mutex);
+	skb2 = nf_tables_getobj_single(portid, info, nla, true);
+	mutex_unlock(&nft_net->commit_mutex);
+	rcu_read_lock();
+	module_put(THIS_MODULE);
+
+	if (IS_ERR(skb2))
+		return PTR_ERR(skb2);
+
+	buf = kasprintf(GFP_ATOMIC, "%.*s:%u",
+			nla_len(nla[NFTA_OBJ_TABLE]),
+			(char *)nla_data(nla[NFTA_OBJ_TABLE]),
+			nft_net->base_seq);
+	audit_log_nfcfg(buf, info->nfmsg->nfgen_family, 1,
+			AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC);
+	kfree(buf);
+
+	return nfnetlink_unicast(skb2, net, portid);
 }
 
 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
@@ -8255,11 +8445,12 @@
 	return err;
 }
 
+/* call under rcu_read_lock */
 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
 {
 	const struct nf_flowtable_type *type;
 
-	list_for_each_entry(type, &nf_tables_flowtables, list) {
+	list_for_each_entry_rcu(type, &nf_tables_flowtables, list) {
 		if (family == type->family)
 			return type;
 	}
@@ -8271,9 +8462,13 @@
 {
 	const struct nf_flowtable_type *type;
 
+	rcu_read_lock();
 	type = __nft_flowtable_type_get(family);
-	if (type != NULL && try_module_get(type->owner))
+	if (type != NULL && try_module_get(type->owner)) {
+		rcu_read_unlock();
 		return type;
+	}
+	rcu_read_unlock();
 
 	lockdep_nfnl_nft_mutex_not_held();
 #ifdef CONFIG_MODULES
@@ -8296,6 +8491,7 @@
 }
 
 static void __nft_unregister_flowtable_net_hooks(struct net *net,
+						 struct nft_flowtable *flowtable,
 						 struct list_head *hook_list,
 					         bool release_netdev)
 {
@@ -8303,6 +8499,8 @@
 
 	list_for_each_entry_safe(hook, next, hook_list, list) {
 		nf_unregister_net_hook(net, &hook->ops);
+		flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
+					    FLOW_BLOCK_UNBIND);
 		if (release_netdev) {
 			list_del(&hook->list);
 			kfree_rcu(hook, rcu);
@@ -8311,9 +8509,10 @@
 }
 
 static void nft_unregister_flowtable_net_hooks(struct net *net,
+					       struct nft_flowtable *flowtable,
 					       struct list_head *hook_list)
 {
-	__nft_unregister_flowtable_net_hooks(net, hook_list, false);
+	__nft_unregister_flowtable_net_hooks(net, flowtable, hook_list, false);
 }
 
 static int nft_register_flowtable_net_hooks(struct net *net,
@@ -8954,10 +9153,8 @@
 
 	flowtable->data.type->free(&flowtable->data);
 	list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
-		flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
-					    FLOW_BLOCK_UNBIND);
 		list_del_rcu(&hook->list);
-		kfree(hook);
+		kfree_rcu(hook, rcu);
 	}
 	kfree(flowtable->name);
 	module_put(flowtable->data.type->owner);
@@ -9250,7 +9447,7 @@
 		.policy		= nft_obj_policy,
 	},
 	[NFT_MSG_GETOBJ_RESET] = {
-		.call		= nf_tables_getobj,
+		.call		= nf_tables_getobj_reset,
 		.type		= NFNL_CB_RCU,
 		.attr_count	= NFTA_OBJ_MAX,
 		.policy		= nft_obj_policy,
@@ -9364,9 +9561,10 @@
 	obj = nft_trans_obj(trans);
 	newobj = nft_trans_obj_newobj(trans);
 
-	if (obj->ops->update)
-		obj->ops->update(obj, newobj);
+	if (WARN_ON_ONCE(!obj->ops->update))
+		return;
 
+	obj->ops->update(obj, newobj);
 	nft_obj_destroy(&trans->ctx, newobj);
 }
 
@@ -9386,7 +9584,7 @@
 		if (nft_trans_chain_update(trans))
 			nft_hooks_destroy(&nft_trans_chain_hooks(trans));
 		else
-			nf_tables_chain_destroy(&trans->ctx);
+			nf_tables_chain_destroy(nft_trans_chain(trans));
 		break;
 	case NFT_MSG_DELRULE:
 	case NFT_MSG_DESTROYRULE:
@@ -10174,9 +10372,11 @@
 			if (nft_trans_chain_update(trans)) {
 				nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
 						       &nft_trans_chain_hooks(trans));
-				nft_netdev_unregister_hooks(net,
-							    &nft_trans_chain_hooks(trans),
-							    true);
+				if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {
+					nft_netdev_unregister_hooks(net,
+								    &nft_trans_chain_hooks(trans),
+								    true);
+				}
 			} else {
 				nft_chain_del(trans->ctx.chain);
 				nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
@@ -10317,6 +10517,7 @@
 							   &nft_trans_flowtable_hooks(trans),
 							   trans->msg_type);
 				nft_unregister_flowtable_net_hooks(net,
+								   nft_trans_flowtable(trans),
 								   &nft_trans_flowtable_hooks(trans));
 			} else {
 				list_del_rcu(&nft_trans_flowtable(trans)->list);
@@ -10325,6 +10526,7 @@
 							   NULL,
 							   trans->msg_type);
 				nft_unregister_flowtable_net_hooks(net,
+						nft_trans_flowtable(trans),
 						&nft_trans_flowtable(trans)->hook_list);
 			}
 			break;
@@ -10370,7 +10572,7 @@
 		if (nft_trans_chain_update(trans))
 			nft_hooks_destroy(&nft_trans_chain_hooks(trans));
 		else
-			nf_tables_chain_destroy(&trans->ctx);
+			nf_tables_chain_destroy(nft_trans_chain(trans));
 		break;
 	case NFT_MSG_NEWRULE:
 		nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
@@ -10415,10 +10617,11 @@
 	struct nft_trans *trans, *next;
 	LIST_HEAD(set_update_list);
 	struct nft_trans_elem *te;
+	int err = 0;
 
 	if (action == NFNL_ABORT_VALIDATE &&
 	    nf_tables_validate(net) < 0)
-		return -EAGAIN;
+		err = -EAGAIN;
 
 	list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list,
 					 list) {
@@ -10448,9 +10651,11 @@
 			break;
 		case NFT_MSG_NEWCHAIN:
 			if (nft_trans_chain_update(trans)) {
-				nft_netdev_unregister_hooks(net,
-							    &nft_trans_chain_hooks(trans),
-							    true);
+				if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {
+					nft_netdev_unregister_hooks(net,
+								    &nft_trans_chain_hooks(trans),
+								    true);
+				}
 				free_percpu(nft_trans_chain_stats(trans));
 				kfree(nft_trans_chain_name(trans));
 				nft_trans_destroy(trans);
@@ -10542,8 +10747,10 @@
 		case NFT_MSG_DESTROYSETELEM:
 			te = (struct nft_trans_elem *)trans->data;
 
-			nft_setelem_data_activate(net, te->set, te->elem_priv);
-			nft_setelem_activate(net, te->set, te->elem_priv);
+			if (!nft_setelem_active_next(net, te->set, te->elem_priv)) {
+				nft_setelem_data_activate(net, te->set, te->elem_priv);
+				nft_setelem_activate(net, te->set, te->elem_priv);
+			}
 			if (!nft_setelem_is_catchall(te->set, te->elem_priv))
 				te->set->ndeact--;
 
@@ -10572,11 +10779,13 @@
 		case NFT_MSG_NEWFLOWTABLE:
 			if (nft_trans_flowtable_update(trans)) {
 				nft_unregister_flowtable_net_hooks(net,
+						nft_trans_flowtable(trans),
 						&nft_trans_flowtable_hooks(trans));
 			} else {
 				nft_use_dec_restore(&trans->ctx.table->use);
 				list_del_rcu(&nft_trans_flowtable(trans)->list);
 				nft_unregister_flowtable_net_hooks(net,
+						nft_trans_flowtable(trans),
 						&nft_trans_flowtable(trans)->hook_list);
 			}
 			break;
@@ -10604,12 +10813,7 @@
 		nf_tables_abort_release(trans);
 	}
 
-	if (action == NFNL_ABORT_AUTOLOAD)
-		nf_tables_module_autoload(net);
-	else
-		nf_tables_module_autoload_cleanup(net);
-
-	return 0;
+	return err;
 }
 
 static int nf_tables_abort(struct net *net, struct sk_buff *skb,
@@ -10622,6 +10826,17 @@
 	gc_seq = nft_gc_seq_begin(nft_net);
 	ret = __nf_tables_abort(net, action);
 	nft_gc_seq_end(nft_net, gc_seq);
+
+	WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
+
+	/* module autoload needs to happen after GC sequence update because it
+	 * temporarily releases and grabs mutex again.
+	 */
+	if (action == NFNL_ABORT_AUTOLOAD)
+		nf_tables_module_autoload(net);
+	else
+		nf_tables_module_autoload_cleanup(net);
+
 	mutex_unlock(&nft_net->commit_mutex);
 
 	return ret;
@@ -10686,146 +10901,6 @@
 }
 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
 
-/*
- * Loop detection - walk through the ruleset beginning at the destination chain
- * of a new jump until either the source chain is reached (loop) or all
- * reachable chains have been traversed.
- *
- * The loop check is performed whenever a new jump verdict is added to an
- * expression or verdict map or a verdict map is bound to a new chain.
- */
-
-static int nf_tables_check_loops(const struct nft_ctx *ctx,
-				 const struct nft_chain *chain);
-
-static int nft_check_loops(const struct nft_ctx *ctx,
-			   const struct nft_set_ext *ext)
-{
-	const struct nft_data *data;
-	int ret;
-
-	data = nft_set_ext_data(ext);
-	switch (data->verdict.code) {
-	case NFT_JUMP:
-	case NFT_GOTO:
-		ret = nf_tables_check_loops(ctx, data->verdict.chain);
-		break;
-	default:
-		ret = 0;
-		break;
-	}
-
-	return ret;
-}
-
-static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
-					struct nft_set *set,
-					const struct nft_set_iter *iter,
-					struct nft_elem_priv *elem_priv)
-{
-	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
-
-	if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
-	    *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
-		return 0;
-
-	return nft_check_loops(ctx, ext);
-}
-
-static int nft_set_catchall_loops(const struct nft_ctx *ctx,
-				  struct nft_set *set)
-{
-	u8 genmask = nft_genmask_next(ctx->net);
-	struct nft_set_elem_catchall *catchall;
-	struct nft_set_ext *ext;
-	int ret = 0;
-
-	list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
-		ext = nft_set_elem_ext(set, catchall->elem);
-		if (!nft_set_elem_active(ext, genmask))
-			continue;
-
-		ret = nft_check_loops(ctx, ext);
-		if (ret < 0)
-			return ret;
-	}
-
-	return ret;
-}
-
-static int nf_tables_check_loops(const struct nft_ctx *ctx,
-				 const struct nft_chain *chain)
-{
-	const struct nft_rule *rule;
-	const struct nft_expr *expr, *last;
-	struct nft_set *set;
-	struct nft_set_binding *binding;
-	struct nft_set_iter iter;
-
-	if (ctx->chain == chain)
-		return -ELOOP;
-
-	if (fatal_signal_pending(current))
-		return -EINTR;
-
-	list_for_each_entry(rule, &chain->rules, list) {
-		nft_rule_for_each_expr(expr, last, rule) {
-			struct nft_immediate_expr *priv;
-			const struct nft_data *data;
-			int err;
-
-			if (strcmp(expr->ops->type->name, "immediate"))
-				continue;
-
-			priv = nft_expr_priv(expr);
-			if (priv->dreg != NFT_REG_VERDICT)
-				continue;
-
-			data = &priv->data;
-			switch (data->verdict.code) {
-			case NFT_JUMP:
-			case NFT_GOTO:
-				err = nf_tables_check_loops(ctx,
-							data->verdict.chain);
-				if (err < 0)
-					return err;
-				break;
-			default:
-				break;
-			}
-		}
-	}
-
-	list_for_each_entry(set, &ctx->table->sets, list) {
-		if (!nft_is_active_next(ctx->net, set))
-			continue;
-		if (!(set->flags & NFT_SET_MAP) ||
-		    set->dtype != NFT_DATA_VERDICT)
-			continue;
-
-		list_for_each_entry(binding, &set->bindings, list) {
-			if (!(binding->flags & NFT_SET_MAP) ||
-			    binding->chain != chain)
-				continue;
-
-			iter.genmask	= nft_genmask_next(ctx->net);
-			iter.skip 	= 0;
-			iter.count	= 0;
-			iter.err	= 0;
-			iter.fn		= nf_tables_loop_check_setelem;
-
-			set->ops->walk(ctx, set, &iter);
-			if (!iter.err)
-				iter.err = nft_set_catchall_loops(ctx, set);
-
-			if (iter.err < 0)
-				return iter.err;
-		}
-	}
-
-	return 0;
-}
-
 /**
  *	nft_parse_u32_check - fetch u32 attribute and check for maximum value
  *
@@ -10938,13 +11013,16 @@
 		if (data != NULL &&
 		    (data->verdict.code == NFT_GOTO ||
 		     data->verdict.code == NFT_JUMP)) {
-			err = nf_tables_check_loops(ctx, data->verdict.chain);
+			err = nft_chain_validate(ctx, data->verdict.chain);
 			if (err < 0)
 				return err;
 		}
 
 		return 0;
 	default:
+		if (type != NFT_DATA_VALUE)
+			return -EINVAL;
+
 		if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
 			return -EINVAL;
 		if (len == 0)
@@ -10953,8 +11031,6 @@
 		    sizeof_field(struct nft_regs, data))
 			return -ERANGE;
 
-		if (data != NULL && type != NFT_DATA_VALUE)
-			return -EINVAL;
 		return 0;
 	}
 }
@@ -11222,23 +11298,43 @@
 }
 EXPORT_SYMBOL_GPL(nft_data_dump);
 
-int __nft_release_basechain(struct nft_ctx *ctx)
+static void __nft_release_basechain_now(struct nft_ctx *ctx)
 {
 	struct nft_rule *rule, *nr;
 
-	if (WARN_ON(!nft_is_base_chain(ctx->chain)))
-		return 0;
-
-	nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
 	list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
 		list_del(&rule->list);
-		nft_use_dec(&ctx->chain->use);
 		nf_tables_rule_release(ctx, rule);
 	}
+	nf_tables_chain_destroy(ctx->chain);
+}
+
+int __nft_release_basechain(struct nft_ctx *ctx)
+{
+	struct nft_rule *rule;
+
+	if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain)))
+		return 0;
+
+	nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
+	list_for_each_entry(rule, &ctx->chain->rules, list)
+		nft_use_dec(&ctx->chain->use);
+
 	nft_chain_del(ctx->chain);
 	nft_use_dec(&ctx->table->use);
-	nf_tables_chain_destroy(ctx);
 
+	if (!maybe_get_net(ctx->net)) {
+		__nft_release_basechain_now(ctx);
+		return 0;
+	}
+
+	/* wait for ruleset dumps to complete.  Owning chain is no longer in
+	 * lists, so new dumps can't find any of these rules anymore.
+	 */
+	synchronize_rcu();
+
+	__nft_release_basechain_now(ctx);
+	put_net(ctx->net);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(__nft_release_basechain);
@@ -11251,7 +11347,8 @@
 	list_for_each_entry(chain, &table->chains, list)
 		__nf_tables_unregister_hook(net, table, chain, true);
 	list_for_each_entry(flowtable, &table->flowtables, list)
-		__nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list,
+		__nft_unregister_flowtable_net_hooks(net, flowtable,
+						     &flowtable->hook_list,
 						     true);
 }
 
@@ -11312,10 +11409,9 @@
 		nft_obj_destroy(&ctx, obj);
 	}
 	list_for_each_entry_safe(chain, nc, &table->chains, list) {
-		ctx.chain = chain;
 		nft_chain_del(chain);
 		nft_use_dec(&table->use);
-		nf_tables_chain_destroy(&ctx);
+		nf_tables_chain_destroy(chain);
 	}
 	nf_tables_table_destroy(&ctx);
 }
@@ -11355,8 +11451,7 @@
 
 	gc_seq = nft_gc_seq_begin(nft_net);
 
-	if (!list_empty(&nf_tables_destroy_list))
-		nf_tables_trans_destroy_flush_work();
+	nf_tables_trans_destroy_flush_work();
 again:
 	list_for_each_entry(table, &nft_net->tables, list) {
 		if (nft_table_has_owner(table) &&
@@ -11423,9 +11518,10 @@
 
 	gc_seq = nft_gc_seq_begin(nft_net);
 
-	if (!list_empty(&nft_net->commit_list) ||
-	    !list_empty(&nft_net->module_list))
-		__nf_tables_abort(net, NFNL_ABORT_NONE);
+	WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
+
+	if (!list_empty(&nft_net->module_list))
+		nf_tables_module_autoload_cleanup(net);
 
 	__nft_release_tables(net);
 
@@ -11517,6 +11613,7 @@
 	unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
 	nft_chain_filter_fini();
 	nft_chain_route_fini();
+	nf_tables_trans_destroy_flush_work();
 	unregister_pernet_subsys(&nf_tables_net_ops);
 	cancel_work_sync(&trans_gc_work);
 	cancel_work_sync(&trans_destroy_work);
--- linux-qcom-6.8.0.orig/net/netfilter/nfnetlink_queue.c
+++ linux-qcom-6.8.0/net/netfilter/nfnetlink_queue.c
@@ -169,7 +169,9 @@
 	struct nfqnl_instance *inst = container_of(head, struct nfqnl_instance,
 						   rcu);
 
+	rcu_read_lock();
 	nfqnl_flush(inst, NULL, 0);
+	rcu_read_unlock();
 	kfree(inst);
 	module_put(THIS_MODULE);
 }
@@ -326,18 +328,18 @@
 	return 0;
 }
 
-static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
+static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsmcontext *ctx)
 {
 	u32 seclen = 0;
 #if IS_ENABLED(CONFIG_NETWORK_SECMARK)
+
 	if (!skb || !sk_fullsock(skb->sk))
 		return 0;
 
 	read_lock_bh(&skb->sk->sk_callback_lock);
 
 	if (skb->secmark)
-		security_secid_to_secctx(skb->secmark, secdata, &seclen);
-
+		seclen = security_secid_to_secctx(skb->secmark, ctx);
 	read_unlock_bh(&skb->sk->sk_callback_lock);
 #endif
 	return seclen;
@@ -415,7 +417,7 @@
 	enum ip_conntrack_info ctinfo = 0;
 	const struct nfnl_ct_hook *nfnl_ct;
 	bool csum_verify;
-	char *secdata = NULL;
+	struct lsmcontext ctx;
 	u32 seclen = 0;
 	ktime_t tstamp;
 
@@ -490,8 +492,8 @@
 	}
 
 	if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
-		seclen = nfqnl_get_sk_secctx(entskb, &secdata);
-		if (seclen)
+		seclen = nfqnl_get_sk_secctx(entskb, &ctx);
+		if (seclen >= 0)
 			size += nla_total_size(seclen);
 	}
 
@@ -630,7 +632,7 @@
 	if (nfqnl_put_sk_classid(skb, entskb->sk) < 0)
 		goto nla_put_failure;
 
-	if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))
+	if (seclen && nla_put(skb, NFQA_SECCTX, ctx.len, ctx.context))
 		goto nla_put_failure;
 
 	if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0)
@@ -658,8 +660,8 @@
 	}
 
 	nlh->nlmsg_len = skb->len;
-	if (seclen)
-		security_release_secctx(secdata, seclen);
+	if (seclen >= 0)
+		security_release_secctx(&ctx);
 	return skb;
 
 nla_put_failure:
@@ -667,8 +669,8 @@
 	kfree_skb(skb);
 	net_err_ratelimited("nf_queue: error creating packet message\n");
 nlmsg_failure:
-	if (seclen)
-		security_release_secctx(secdata, seclen);
+	if (seclen >= 0)
+		security_release_secctx(&ctx);
 	return NULL;
 }
 
@@ -676,10 +678,41 @@
 {
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 	static const unsigned long flags = IPS_CONFIRMED | IPS_DYING;
-	const struct nf_conn *ct = (void *)skb_nfct(entry->skb);
+	struct nf_conn *ct = (void *)skb_nfct(entry->skb);
+	unsigned long status;
+	unsigned int use;
+
+	if (!ct)
+		return false;
 
-	if (ct && ((ct->status & flags) == IPS_DYING))
+	status = READ_ONCE(ct->status);
+	if ((status & flags) == IPS_DYING)
 		return true;
+
+	if (status & IPS_CONFIRMED)
+		return false;
+
+	/* in some cases skb_clone() can occur after initial conntrack
+	 * pickup, but conntrack assumes exclusive skb->_nfct ownership for
+	 * unconfirmed entries.
+	 *
+	 * This happens for br_netfilter and with ip multicast routing.
+	 * We can't be solved with serialization here because one clone could
+	 * have been queued for local delivery.
+	 */
+	use = refcount_read(&ct->ct_general.use);
+	if (likely(use == 1))
+		return false;
+
+	/* Can't decrement further? Exclusive ownership. */
+	if (!refcount_dec_not_one(&ct->ct_general.use))
+		return false;
+
+	skb_set_nfct(entry->skb, 0);
+	/* No nf_ct_put(): we already decremented .use and it cannot
+	 * drop down to 0.
+	 */
+	return true;
 #endif
 	return false;
 }
--- linux-qcom-6.8.0.orig/net/netfilter/nft_chain_filter.c
+++ linux-qcom-6.8.0/net/netfilter/nft_chain_filter.c
@@ -338,7 +338,9 @@
 		return;
 
 	if (n > 1) {
-		nf_unregister_net_hook(ctx->net, &found->ops);
+		if (!(ctx->chain->table->flags & NFT_TABLE_F_DORMANT))
+			nf_unregister_net_hook(ctx->net, &found->ops);
+
 		list_del_rcu(&found->list);
 		kfree_rcu(found, rcu);
 		return;
--- linux-qcom-6.8.0.orig/net/netfilter/nft_compat.c
+++ linux-qcom-6.8.0/net/netfilter/nft_compat.c
@@ -536,7 +536,7 @@
 	struct xt_match *m = expr->ops->data;
 	int ret;
 
-	priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL);
+	priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL_ACCOUNT);
 	if (!priv->info)
 		return -ENOMEM;
 
@@ -810,7 +810,7 @@
 		goto err;
 	}
 
-	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
+	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);
 	if (!ops) {
 		err = -ENOMEM;
 		goto err;
@@ -900,7 +900,7 @@
 		goto err;
 	}
 
-	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
+	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);
 	if (!ops) {
 		err = -ENOMEM;
 		goto err;
--- linux-qcom-6.8.0.orig/net/netfilter/nft_counter.c
+++ linux-qcom-6.8.0/net/netfilter/nft_counter.c
@@ -107,11 +107,16 @@
 			      struct nft_counter *total)
 {
 	struct nft_counter *this_cpu;
+	seqcount_t *myseq;
 
 	local_bh_disable();
 	this_cpu = this_cpu_ptr(priv->counter);
+	myseq = this_cpu_ptr(&nft_counter_seq);
+
+	write_seqcount_begin(myseq);
 	this_cpu->packets -= total->packets;
 	this_cpu->bytes -= total->bytes;
+	write_seqcount_end(myseq);
 	local_bh_enable();
 }
 
@@ -265,7 +270,7 @@
 	struct nft_counter *this_cpu;
 	seqcount_t *myseq;
 
-	preempt_disable();
+	local_bh_disable();
 	this_cpu = this_cpu_ptr(priv->counter);
 	myseq = this_cpu_ptr(&nft_counter_seq);
 
@@ -273,7 +278,7 @@
 	this_cpu->packets += stats->pkts;
 	this_cpu->bytes += stats->bytes;
 	write_seqcount_end(myseq);
-	preempt_enable();
+	local_bh_enable();
 }
 
 void nft_counter_init_seqcount(void)
--- linux-qcom-6.8.0.orig/net/netfilter/nft_dynset.c
+++ linux-qcom-6.8.0/net/netfilter/nft_dynset.c
@@ -56,7 +56,7 @@
 	if (!atomic_add_unless(&set->nelems, 1, set->size))
 		return NULL;
 
-	timeout = priv->timeout ? : set->timeout;
+	timeout = priv->timeout ? : READ_ONCE(set->timeout);
 	elem_priv = nft_set_elem_init(set, &priv->tmpl,
 				      &regs->data[priv->sreg_key], NULL,
 				      &regs->data[priv->sreg_data],
@@ -95,7 +95,7 @@
 			     expr, regs, &ext)) {
 		if (priv->op == NFT_DYNSET_OP_UPDATE &&
 		    nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
-			timeout = priv->timeout ? : set->timeout;
+			timeout = priv->timeout ? : READ_ONCE(set->timeout);
 			*nft_set_ext_expiration(ext) = get_jiffies_64() + timeout;
 		}
 
@@ -313,7 +313,7 @@
 		nft_dynset_ext_add_expr(priv);
 
 	if (set->flags & NFT_SET_TIMEOUT) {
-		if (timeout || set->timeout) {
+		if (timeout || READ_ONCE(set->timeout)) {
 			nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_TIMEOUT);
 			nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_EXPIRATION);
 		}
--- linux-qcom-6.8.0.orig/net/netfilter/nft_fib.c
+++ linux-qcom-6.8.0/net/netfilter/nft_fib.c
@@ -35,11 +35,9 @@
 	switch (priv->result) {
 	case NFT_FIB_RESULT_OIF:
 	case NFT_FIB_RESULT_OIFNAME:
-		hooks = (1 << NF_INET_PRE_ROUTING);
-		if (priv->flags & NFTA_FIB_F_IIF) {
-			hooks |= (1 << NF_INET_LOCAL_IN) |
-				 (1 << NF_INET_FORWARD);
-		}
+		hooks = (1 << NF_INET_PRE_ROUTING) |
+			(1 << NF_INET_LOCAL_IN) |
+			(1 << NF_INET_FORWARD);
 		break;
 	case NFT_FIB_RESULT_ADDRTYPE:
 		if (priv->flags & NFTA_FIB_F_IIF)
--- linux-qcom-6.8.0.orig/net/netfilter/nft_immediate.c
+++ linux-qcom-6.8.0/net/netfilter/nft_immediate.c
@@ -221,7 +221,7 @@
 			list_del(&rule->list);
 			nf_tables_rule_destroy(&chain_ctx, rule);
 		}
-		nf_tables_chain_destroy(&chain_ctx);
+		nf_tables_chain_destroy(chain);
 		break;
 	default:
 		break;
--- linux-qcom-6.8.0.orig/net/netfilter/nft_inner.c
+++ linux-qcom-6.8.0/net/netfilter/nft_inner.c
@@ -210,35 +210,66 @@
 			   struct nft_pktinfo *pkt,
 			   struct nft_inner_tun_ctx *tun_ctx)
 {
-	struct nft_inner_tun_ctx ctx = {};
 	u32 off = pkt->inneroff;
 
 	if (priv->flags & NFT_INNER_HDRSIZE &&
-	    nft_inner_parse_tunhdr(priv, pkt, &ctx, &off) < 0)
+	    nft_inner_parse_tunhdr(priv, pkt, tun_ctx, &off) < 0)
 		return -1;
 
 	if (priv->flags & (NFT_INNER_LL | NFT_INNER_NH)) {
-		if (nft_inner_parse_l2l3(priv, pkt, &ctx, off) < 0)
+		if (nft_inner_parse_l2l3(priv, pkt, tun_ctx, off) < 0)
 			return -1;
 	} else if (priv->flags & NFT_INNER_TH) {
-		ctx.inner_thoff = off;
-		ctx.flags |= NFT_PAYLOAD_CTX_INNER_TH;
+		tun_ctx->inner_thoff = off;
+		tun_ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH;
 	}
 
-	*tun_ctx = ctx;
 	tun_ctx->type = priv->type;
+	tun_ctx->cookie = (unsigned long)pkt->skb;
 	pkt->flags |= NFT_PKTINFO_INNER_FULL;
 
 	return 0;
 }
 
+static bool nft_inner_restore_tun_ctx(const struct nft_pktinfo *pkt,
+				      struct nft_inner_tun_ctx *tun_ctx)
+{
+	struct nft_inner_tun_ctx *this_cpu_tun_ctx;
+
+	local_bh_disable();
+	this_cpu_tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx);
+	if (this_cpu_tun_ctx->cookie != (unsigned long)pkt->skb) {
+		local_bh_enable();
+		return false;
+	}
+	*tun_ctx = *this_cpu_tun_ctx;
+	local_bh_enable();
+
+	return true;
+}
+
+static void nft_inner_save_tun_ctx(const struct nft_pktinfo *pkt,
+				   const struct nft_inner_tun_ctx *tun_ctx)
+{
+	struct nft_inner_tun_ctx *this_cpu_tun_ctx;
+
+	local_bh_disable();
+	this_cpu_tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx);
+	if (this_cpu_tun_ctx->cookie != tun_ctx->cookie)
+		*this_cpu_tun_ctx = *tun_ctx;
+	local_bh_enable();
+}
+
 static bool nft_inner_parse_needed(const struct nft_inner *priv,
 				   const struct nft_pktinfo *pkt,
-				   const struct nft_inner_tun_ctx *tun_ctx)
+				   struct nft_inner_tun_ctx *tun_ctx)
 {
 	if (!(pkt->flags & NFT_PKTINFO_INNER_FULL))
 		return true;
 
+	if (!nft_inner_restore_tun_ctx(pkt, tun_ctx))
+		return true;
+
 	if (priv->type != tun_ctx->type)
 		return true;
 
@@ -248,27 +279,29 @@
 static void nft_inner_eval(const struct nft_expr *expr, struct nft_regs *regs,
 			   const struct nft_pktinfo *pkt)
 {
-	struct nft_inner_tun_ctx *tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx);
 	const struct nft_inner *priv = nft_expr_priv(expr);
+	struct nft_inner_tun_ctx tun_ctx = {};
 
 	if (nft_payload_inner_offset(pkt) < 0)
 		goto err;
 
-	if (nft_inner_parse_needed(priv, pkt, tun_ctx) &&
-	    nft_inner_parse(priv, (struct nft_pktinfo *)pkt, tun_ctx) < 0)
+	if (nft_inner_parse_needed(priv, pkt, &tun_ctx) &&
+	    nft_inner_parse(priv, (struct nft_pktinfo *)pkt, &tun_ctx) < 0)
 		goto err;
 
 	switch (priv->expr_type) {
 	case NFT_INNER_EXPR_PAYLOAD:
-		nft_payload_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, tun_ctx);
+		nft_payload_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, &tun_ctx);
 		break;
 	case NFT_INNER_EXPR_META:
-		nft_meta_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, tun_ctx);
+		nft_meta_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, &tun_ctx);
 		break;
 	default:
 		WARN_ON_ONCE(1);
 		goto err;
 	}
+	nft_inner_save_tun_ctx(pkt, &tun_ctx);
+
 	return;
 err:
 	regs->verdict.code = NFT_BREAK;
--- linux-qcom-6.8.0.orig/net/netfilter/nft_log.c
+++ linux-qcom-6.8.0/net/netfilter/nft_log.c
@@ -163,7 +163,7 @@
 
 	nla = tb[NFTA_LOG_PREFIX];
 	if (nla != NULL) {
-		priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);
+		priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL_ACCOUNT);
 		if (priv->prefix == NULL)
 			return -ENOMEM;
 		nla_strscpy(priv->prefix, nla, nla_len(nla) + 1);
--- linux-qcom-6.8.0.orig/net/netfilter/nft_lookup.c
+++ linux-qcom-6.8.0/net/netfilter/nft_lookup.c
@@ -132,7 +132,8 @@
 			return -EINVAL;
 
 		err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG],
-					       &priv->dreg, NULL, set->dtype,
+					       &priv->dreg, NULL,
+					       nft_set_datatype(set),
 					       set->dlen);
 		if (err < 0)
 			return err;
@@ -216,6 +217,7 @@
 		return 0;
 
 	iter.genmask	= nft_genmask_next(ctx->net);
+	iter.type	= NFT_ITER_UPDATE;
 	iter.skip	= 0;
 	iter.count	= 0;
 	iter.err	= 0;
--- linux-qcom-6.8.0.orig/net/netfilter/nft_meta.c
+++ linux-qcom-6.8.0/net/netfilter/nft_meta.c
@@ -839,6 +839,9 @@
 	struct nft_meta *priv = nft_expr_priv(expr);
 	unsigned int len;
 
+	if (!tb[NFTA_META_KEY] || !tb[NFTA_META_DREG])
+		return -EINVAL;
+
 	priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
 	switch (priv->key) {
 	case NFT_META_PROTOCOL:
@@ -951,7 +954,7 @@
 	if (tb[NFTA_SECMARK_CTX] == NULL)
 		return -EINVAL;
 
-	priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL);
+	priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL_ACCOUNT);
 	if (!priv->ctx)
 		return -ENOMEM;
 
--- linux-qcom-6.8.0.orig/net/netfilter/nft_numgen.c
+++ linux-qcom-6.8.0/net/netfilter/nft_numgen.c
@@ -66,7 +66,7 @@
 	if (priv->offset + priv->modulus - 1 < priv->offset)
 		return -EOVERFLOW;
 
-	priv->counter = kmalloc(sizeof(*priv->counter), GFP_KERNEL);
+	priv->counter = kmalloc(sizeof(*priv->counter), GFP_KERNEL_ACCOUNT);
 	if (!priv->counter)
 		return -ENOMEM;
 
--- linux-qcom-6.8.0.orig/net/netfilter/nft_payload.c
+++ linux-qcom-6.8.0/net/netfilter/nft_payload.c
@@ -45,36 +45,27 @@
 	int mac_off = skb_mac_header(skb) - skb->data;
 	u8 *vlanh, *dst_u8 = (u8 *) d;
 	struct vlan_ethhdr veth;
-	u8 vlan_hlen = 0;
-
-	if ((skb->protocol == htons(ETH_P_8021AD) ||
-	     skb->protocol == htons(ETH_P_8021Q)) &&
-	    offset >= VLAN_ETH_HLEN && offset < VLAN_ETH_HLEN + VLAN_HLEN)
-		vlan_hlen += VLAN_HLEN;
 
 	vlanh = (u8 *) &veth;
-	if (offset < VLAN_ETH_HLEN + vlan_hlen) {
+	if (offset < VLAN_ETH_HLEN) {
 		u8 ethlen = len;
 
-		if (vlan_hlen &&
-		    skb_copy_bits(skb, mac_off, &veth, VLAN_ETH_HLEN) < 0)
-			return false;
-		else if (!nft_payload_rebuild_vlan_hdr(skb, mac_off, &veth))
+		if (!nft_payload_rebuild_vlan_hdr(skb, mac_off, &veth))
 			return false;
 
-		if (offset + len > VLAN_ETH_HLEN + vlan_hlen)
-			ethlen -= offset + len - VLAN_ETH_HLEN - vlan_hlen;
+		if (offset + len > VLAN_ETH_HLEN)
+			ethlen -= offset + len - VLAN_ETH_HLEN;
 
-		memcpy(dst_u8, vlanh + offset - vlan_hlen, ethlen);
+		memcpy(dst_u8, vlanh + offset, ethlen);
 
 		len -= ethlen;
 		if (len == 0)
 			return true;
 
 		dst_u8 += ethlen;
-		offset = ETH_HLEN + vlan_hlen;
+		offset = ETH_HLEN;
 	} else {
-		offset -= VLAN_HLEN + vlan_hlen;
+		offset -= VLAN_HLEN;
 	}
 
 	return skb_copy_bits(skb, offset + mac_off, dst_u8, len) == 0;
@@ -154,12 +145,12 @@
 	return pkt->inneroff;
 }
 
-static bool nft_payload_need_vlan_copy(const struct nft_payload *priv)
+static bool nft_payload_need_vlan_adjust(u32 offset, u32 len)
 {
-	unsigned int len = priv->offset + priv->len;
+	unsigned int boundary = offset + len;
 
 	/* data past ether src/dst requested, copy needed */
-	if (len > offsetof(struct ethhdr, h_proto))
+	if (boundary > offsetof(struct ethhdr, h_proto))
 		return true;
 
 	return false;
@@ -183,7 +174,7 @@
 			goto err;
 
 		if (skb_vlan_tag_present(skb) &&
-		    nft_payload_need_vlan_copy(priv)) {
+		    nft_payload_need_vlan_adjust(priv->offset, priv->len)) {
 			if (!nft_payload_copy_vlan(dest, skb,
 						   priv->offset, priv->len))
 				goto err;
@@ -659,6 +650,10 @@
 	struct nft_payload *priv = nft_expr_priv(expr);
 	u32 base;
 
+	if (!tb[NFTA_PAYLOAD_BASE] || !tb[NFTA_PAYLOAD_OFFSET] ||
+	    !tb[NFTA_PAYLOAD_LEN] || !tb[NFTA_PAYLOAD_DREG])
+		return -EINVAL;
+
 	base   = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
 	switch (base) {
 	case NFT_PAYLOAD_TUN_HEADER:
@@ -810,21 +805,79 @@
 	u8			csum_flags;
 };
 
+/* This is not struct vlan_hdr. */
+struct nft_payload_vlan_hdr {
+	__be16			h_vlan_proto;
+	__be16			h_vlan_TCI;
+};
+
+static bool
+nft_payload_set_vlan(const u32 *src, struct sk_buff *skb, u8 offset, u8 len,
+		     int *vlan_hlen)
+{
+	struct nft_payload_vlan_hdr *vlanh;
+	__be16 vlan_proto;
+	u16 vlan_tci;
+
+	if (offset >= offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto)) {
+		*vlan_hlen = VLAN_HLEN;
+		return true;
+	}
+
+	switch (offset) {
+	case offsetof(struct vlan_ethhdr, h_vlan_proto):
+		if (len == 2) {
+			vlan_proto = nft_reg_load_be16(src);
+			skb->vlan_proto = vlan_proto;
+		} else if (len == 4) {
+			vlanh = (struct nft_payload_vlan_hdr *)src;
+			__vlan_hwaccel_put_tag(skb, vlanh->h_vlan_proto,
+					       ntohs(vlanh->h_vlan_TCI));
+		} else {
+			return false;
+		}
+		break;
+	case offsetof(struct vlan_ethhdr, h_vlan_TCI):
+		if (len != 2)
+			return false;
+
+		vlan_tci = ntohs(nft_reg_load_be16(src));
+		skb->vlan_tci = vlan_tci;
+		break;
+	default:
+		return false;
+	}
+
+	return true;
+}
+
 static void nft_payload_set_eval(const struct nft_expr *expr,
 				 struct nft_regs *regs,
 				 const struct nft_pktinfo *pkt)
 {
 	const struct nft_payload_set *priv = nft_expr_priv(expr);
-	struct sk_buff *skb = pkt->skb;
 	const u32 *src = &regs->data[priv->sreg];
-	int offset, csum_offset;
+	int offset, csum_offset, vlan_hlen = 0;
+	struct sk_buff *skb = pkt->skb;
 	__wsum fsum, tsum;
 
 	switch (priv->base) {
 	case NFT_PAYLOAD_LL_HEADER:
 		if (!skb_mac_header_was_set(skb))
 			goto err;
-		offset = skb_mac_header(skb) - skb->data;
+
+		if (skb_vlan_tag_present(skb) &&
+		    nft_payload_need_vlan_adjust(priv->offset, priv->len)) {
+			if (!nft_payload_set_vlan(src, skb,
+						  priv->offset, priv->len,
+						  &vlan_hlen))
+				goto err;
+
+			if (!vlan_hlen)
+				return;
+		}
+
+		offset = skb_mac_header(skb) - skb->data - vlan_hlen;
 		break;
 	case NFT_PAYLOAD_NETWORK_HEADER:
 		offset = skb_network_offset(skb);
@@ -851,6 +904,9 @@
 	    ((priv->base != NFT_PAYLOAD_TRANSPORT_HEADER &&
 	      priv->base != NFT_PAYLOAD_INNER_HEADER) ||
 	     skb->ip_summed != CHECKSUM_PARTIAL)) {
+		if (offset + priv->len > skb->len)
+			goto err;
+
 		fsum = skb_checksum(skb, offset, priv->len, 0);
 		tsum = csum_partial(src, priv->len, 0);
 
--- linux-qcom-6.8.0.orig/net/netfilter/nft_rt.c
+++ linux-qcom-6.8.0/net/netfilter/nft_rt.c
@@ -73,14 +73,14 @@
 		if (nft_pf(pkt) != NFPROTO_IPV4)
 			goto err;
 
-		*dest = (__force u32)rt_nexthop((const struct rtable *)dst,
+		*dest = (__force u32)rt_nexthop(dst_rtable(dst),
 						ip_hdr(skb)->daddr);
 		break;
 	case NFT_RT_NEXTHOP6:
 		if (nft_pf(pkt) != NFPROTO_IPV6)
 			goto err;
 
-		memcpy(dest, rt6_nexthop((struct rt6_info *)dst,
+		memcpy(dest, rt6_nexthop(dst_rt6_info(dst),
 					 &ipv6_hdr(skb)->daddr),
 		       sizeof(struct in6_addr));
 		break;
--- linux-qcom-6.8.0.orig/net/netfilter/nft_set_bitmap.c
+++ linux-qcom-6.8.0/net/netfilter/nft_set_bitmap.c
@@ -172,7 +172,7 @@
 	nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
 	/* Enter 11 state. */
 	priv->bitmap[idx] |= (genmask << off);
-	nft_set_elem_change_active(net, set, &be->ext);
+	nft_clear(net, &be->ext);
 }
 
 static void nft_bitmap_flush(const struct net *net,
@@ -222,8 +222,6 @@
 	list_for_each_entry_rcu(be, &priv->list, head) {
 		if (iter->count < iter->skip)
 			goto cont;
-		if (!nft_set_elem_active(&be->ext, iter->genmask))
-			goto cont;
 
 		iter->err = iter->fn(ctx, set, iter, &be->priv);
 
--- linux-qcom-6.8.0.orig/net/netfilter/nft_set_hash.c
+++ linux-qcom-6.8.0/net/netfilter/nft_set_hash.c
@@ -24,11 +24,13 @@
 struct nft_rhash {
 	struct rhashtable		ht;
 	struct delayed_work		gc_work;
+	u32				wq_gc_seq;
 };
 
 struct nft_rhash_elem {
 	struct nft_elem_priv		priv;
 	struct rhash_head		node;
+	u32				wq_gc_seq;
 	struct nft_set_ext		ext;
 };
 
@@ -199,7 +201,7 @@
 {
 	struct nft_rhash_elem *he = nft_elem_priv_cast(elem_priv);
 
-	nft_set_elem_change_active(net, set, &he->ext);
+	nft_clear(net, &he->ext);
 }
 
 static void nft_rhash_flush(const struct net *net,
@@ -286,8 +288,6 @@
 
 		if (iter->count < iter->skip)
 			goto cont;
-		if (!nft_set_elem_active(&he->ext, iter->genmask))
-			goto cont;
 
 		iter->err = iter->fn(ctx, set, iter, &he->priv);
 		if (iter->err < 0)
@@ -340,6 +340,10 @@
 	if (!gc)
 		goto done;
 
+	/* Elements never collected use a zero gc worker sequence number. */
+	if (unlikely(++priv->wq_gc_seq == 0))
+		priv->wq_gc_seq++;
+
 	rhashtable_walk_enter(&priv->ht, &hti);
 	rhashtable_walk_start(&hti);
 
@@ -357,6 +361,14 @@
 			goto try_later;
 		}
 
+		/* rhashtable walk is unstable, already seen in this gc run?
+		 * Then, skip this element. In case of (unlikely) sequence
+		 * wraparound and stale element wq_gc_seq, next gc run will
+		 * just find this expired element.
+		 */
+		if (he->wq_gc_seq == priv->wq_gc_seq)
+			continue;
+
 		if (nft_set_elem_is_dead(&he->ext))
 			goto dead_elem;
 
@@ -373,6 +385,8 @@
 		if (!gc)
 			goto try_later;
 
+		/* annotate gc sequence for this attempt. */
+		he->wq_gc_seq = priv->wq_gc_seq;
 		nft_trans_gc_elem_add(gc, he);
 	}
 
@@ -599,7 +613,7 @@
 {
 	struct nft_hash_elem *he = nft_elem_priv_cast(elem_priv);
 
-	nft_set_elem_change_active(net, set, &he->ext);
+	nft_clear(net, &he->ext);
 }
 
 static void nft_hash_flush(const struct net *net,
@@ -652,8 +666,6 @@
 		hlist_for_each_entry_rcu(he, &priv->table[i], node) {
 			if (iter->count < iter->skip)
 				goto cont;
-			if (!nft_set_elem_active(&he->ext, iter->genmask))
-				goto cont;
 
 			iter->err = iter->fn(ctx, set, iter, &he->priv);
 			if (iter->err < 0)
--- linux-qcom-6.8.0.orig/net/netfilter/nft_set_pipapo.c
+++ linux-qcom-6.8.0/net/netfilter/nft_set_pipapo.c
@@ -360,7 +360,7 @@
  * Return: -1 on no match, bit position on 'match_only', 0 otherwise.
  */
 int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,
-		  union nft_pipapo_map_bucket *mt, bool match_only)
+		  const union nft_pipapo_map_bucket *mt, bool match_only)
 {
 	unsigned long bitset;
 	int k, ret = -1;
@@ -412,9 +412,9 @@
 	struct nft_pipapo_scratch *scratch;
 	unsigned long *res_map, *fill_map;
 	u8 genmask = nft_genmask_cur(net);
+	const struct nft_pipapo_match *m;
+	const struct nft_pipapo_field *f;
 	const u8 *rp = (const u8 *)key;
-	struct nft_pipapo_match *m;
-	struct nft_pipapo_field *f;
 	bool map_index;
 	int i;
 
@@ -432,7 +432,7 @@
 	res_map  = scratch->map + (map_index ? m->bsize_max : 0);
 	fill_map = scratch->map + (map_index ? 0 : m->bsize_max);
 
-	memset(res_map, 0xff, m->bsize_max * sizeof(*res_map));
+	pipapo_resmap_init(m, res_map);
 
 	nft_pipapo_for_each_field(f, i, m) {
 		bool last = i == m->field_count - 1;
@@ -519,11 +519,13 @@
 {
 	struct nft_pipapo_elem *ret = ERR_PTR(-ENOENT);
 	struct nft_pipapo *priv = nft_set_priv(set);
-	struct nft_pipapo_match *m = priv->clone;
 	unsigned long *res_map, *fill_map = NULL;
-	struct nft_pipapo_field *f;
+	const struct nft_pipapo_match *m;
+	const struct nft_pipapo_field *f;
 	int i;
 
+	m = priv->clone;
+
 	res_map = kmalloc_array(m->bsize_max, sizeof(*res_map), GFP_ATOMIC);
 	if (!res_map) {
 		ret = ERR_PTR(-ENOMEM);
@@ -536,7 +538,7 @@
 		goto out;
 	}
 
-	memset(res_map, 0xff, m->bsize_max * sizeof(*res_map));
+	pipapo_resmap_init(m, res_map);
 
 	nft_pipapo_for_each_field(f, i, m) {
 		bool last = i == m->field_count - 1;
@@ -874,7 +876,7 @@
 		return;
 	}
 
-	new_lt = kvzalloc(lt_size + NFT_PIPAPO_ALIGN_HEADROOM, GFP_KERNEL);
+	new_lt = kvzalloc(lt_size + NFT_PIPAPO_ALIGN_HEADROOM, GFP_KERNEL_ACCOUNT);
 	if (!new_lt)
 		return;
 
@@ -1150,7 +1152,7 @@
 		scratch = kzalloc_node(struct_size(scratch, map,
 						   bsize_max * 2) +
 				       NFT_PIPAPO_ALIGN_HEADROOM,
-				       GFP_KERNEL, cpu_to_node(i));
+				       GFP_KERNEL_ACCOUNT, cpu_to_node(i));
 		if (!scratch) {
 			/* On failure, there's no need to undo previous
 			 * allocations: this means that some scratch maps have
@@ -1324,7 +1326,7 @@
 	struct nft_pipapo_match *new;
 	int i;
 
-	new = kmalloc(struct_size(new, f, old->field_count), GFP_KERNEL);
+	new = kmalloc(struct_size(new, f, old->field_count), GFP_KERNEL_ACCOUNT);
 	if (!new)
 		return ERR_PTR(-ENOMEM);
 
@@ -1354,7 +1356,7 @@
 		new_lt = kvzalloc(src->groups * NFT_PIPAPO_BUCKETS(src->bb) *
 				  src->bsize * sizeof(*dst->lt) +
 				  NFT_PIPAPO_ALIGN_HEADROOM,
-				  GFP_KERNEL);
+				  GFP_KERNEL_ACCOUNT);
 		if (!new_lt)
 			goto out_lt;
 
@@ -1597,7 +1599,7 @@
 
 	while ((rules_f0 = pipapo_rules_same_key(m->f, first_rule))) {
 		union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS];
-		struct nft_pipapo_field *f;
+		const struct nft_pipapo_field *f;
 		int i, start, rules_fx;
 
 		start = first_rule;
@@ -1771,7 +1773,7 @@
 {
 	struct nft_pipapo_elem *e = nft_elem_priv_cast(elem_priv);
 
-	nft_set_elem_change_active(net, set, &e->ext);
+	nft_clear(net, &e->ext);
 }
 
 /**
@@ -2000,6 +2002,8 @@
 		rules_fx = rules_f0;
 
 		nft_pipapo_for_each_field(f, i, m) {
+			bool last = i == m->field_count - 1;
+
 			if (!pipapo_match_field(f, start, rules_fx,
 						match_start, match_end))
 				break;
@@ -2012,16 +2016,18 @@
 
 			match_start += NFT_PIPAPO_GROUPS_PADDED_SIZE(f);
 			match_end += NFT_PIPAPO_GROUPS_PADDED_SIZE(f);
-		}
 
-		if (i == m->field_count) {
-			priv->dirty = true;
-			pipapo_drop(m, rulemap);
-			return;
+			if (last && f->mt[rulemap[i].to].e == e) {
+				priv->dirty = true;
+				pipapo_drop(m, rulemap);
+				return;
+			}
 		}
 
 		first_rule += rules_f0;
 	}
+
+	WARN_ON_ONCE(1); /* elem_priv not found */
 }
 
 /**
@@ -2038,13 +2044,15 @@
 			    struct nft_set_iter *iter)
 {
 	struct nft_pipapo *priv = nft_set_priv(set);
-	struct net *net = read_pnet(&set->net);
-	struct nft_pipapo_match *m;
-	struct nft_pipapo_field *f;
+	const struct nft_pipapo_match *m;
+	const struct nft_pipapo_field *f;
 	int i, r;
 
+	WARN_ON_ONCE(iter->type != NFT_ITER_READ &&
+		     iter->type != NFT_ITER_UPDATE);
+
 	rcu_read_lock();
-	if (iter->genmask == nft_genmask_cur(net))
+	if (iter->type == NFT_ITER_READ)
 		m = rcu_dereference(priv->match);
 	else
 		m = priv->clone;
@@ -2066,9 +2074,6 @@
 
 		e = f->mt[r].e;
 
-		if (!nft_set_elem_active(&e->ext, iter->genmask))
-			goto cont;
-
 		iter->err = iter->fn(ctx, set, iter, &e->priv);
 		if (iter->err < 0)
 			goto out;
@@ -2244,8 +2249,6 @@
 	if (m) {
 		rcu_barrier();
 
-		nft_set_pipapo_match_destroy(ctx, set, m);
-
 		for_each_possible_cpu(cpu)
 			pipapo_free_scratch(m, cpu);
 		free_percpu(m->scratch);
@@ -2257,8 +2260,7 @@
 	if (priv->clone) {
 		m = priv->clone;
 
-		if (priv->dirty)
-			nft_set_pipapo_match_destroy(ctx, set, m);
+		nft_set_pipapo_match_destroy(ctx, set, m);
 
 		for_each_possible_cpu(cpu)
 			pipapo_free_scratch(priv->clone, cpu);
--- linux-qcom-6.8.0.orig/net/netfilter/nft_set_pipapo.h
+++ linux-qcom-6.8.0/net/netfilter/nft_set_pipapo.h
@@ -187,7 +187,7 @@
 };
 
 int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,
-		  union nft_pipapo_map_bucket *mt, bool match_only);
+		  const union nft_pipapo_map_bucket *mt, bool match_only);
 
 /**
  * pipapo_and_field_buckets_4bit() - Intersect 4-bit buckets
@@ -195,7 +195,7 @@
  * @dst:	Area to store result
  * @data:	Input data selecting table buckets
  */
-static inline void pipapo_and_field_buckets_4bit(struct nft_pipapo_field *f,
+static inline void pipapo_and_field_buckets_4bit(const struct nft_pipapo_field *f,
 						 unsigned long *dst,
 						 const u8 *data)
 {
@@ -223,7 +223,7 @@
  * @dst:	Area to store result
  * @data:	Input data selecting table buckets
  */
-static inline void pipapo_and_field_buckets_8bit(struct nft_pipapo_field *f,
+static inline void pipapo_and_field_buckets_8bit(const struct nft_pipapo_field *f,
 						 unsigned long *dst,
 						 const u8 *data)
 {
@@ -287,4 +287,25 @@
 	return size;
 }
 
+/**
+ * pipapo_resmap_init() - Initialise result map before first use
+ * @m:		Matching data, including mapping table
+ * @res_map:	Result map
+ *
+ * Initialize all bits covered by the first field to one, so that after
+ * the first step, only the matching bits of the first bit group remain.
+ *
+ * If other fields have a large bitmap, set remainder of res_map to 0.
+ */
+static inline void pipapo_resmap_init(const struct nft_pipapo_match *m, unsigned long *res_map)
+{
+	const struct nft_pipapo_field *f = m->f;
+	int i;
+
+	for (i = 0; i < f->bsize; i++)
+		res_map[i] = ULONG_MAX;
+
+	for (i = f->bsize; i < m->bsize_max; i++)
+		res_map[i] = 0ul;
+}
 #endif /* _NFT_SET_PIPAPO_H */
--- linux-qcom-6.8.0.orig/net/netfilter/nft_set_pipapo_avx2.c
+++ linux-qcom-6.8.0/net/netfilter/nft_set_pipapo_avx2.c
@@ -212,8 +212,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_4b_2(unsigned long *map, unsigned long *fill,
-				       struct nft_pipapo_field *f, int offset,
-				       const u8 *pkt, bool first, bool last)
+				       const struct nft_pipapo_field *f,
+				       int offset, const u8 *pkt,
+				       bool first, bool last)
 {
 	int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
 	u8 pg[2] = { pkt[0] >> 4, pkt[0] & 0xf };
@@ -274,8 +275,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_4b_4(unsigned long *map, unsigned long *fill,
-				       struct nft_pipapo_field *f, int offset,
-				       const u8 *pkt, bool first, bool last)
+				       const struct nft_pipapo_field *f,
+				       int offset, const u8 *pkt,
+				       bool first, bool last)
 {
 	int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
 	u8 pg[4] = { pkt[0] >> 4, pkt[0] & 0xf, pkt[1] >> 4, pkt[1] & 0xf };
@@ -350,8 +352,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_4b_8(unsigned long *map, unsigned long *fill,
-				       struct nft_pipapo_field *f, int offset,
-				       const u8 *pkt, bool first, bool last)
+				       const struct nft_pipapo_field *f,
+				       int offset, const u8 *pkt,
+				       bool first, bool last)
 {
 	u8 pg[8] = {  pkt[0] >> 4,  pkt[0] & 0xf,  pkt[1] >> 4,  pkt[1] & 0xf,
 		      pkt[2] >> 4,  pkt[2] & 0xf,  pkt[3] >> 4,  pkt[3] & 0xf,
@@ -445,8 +448,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_4b_12(unsigned long *map, unsigned long *fill,
-				        struct nft_pipapo_field *f, int offset,
-				        const u8 *pkt, bool first, bool last)
+					const struct nft_pipapo_field *f,
+					int offset, const u8 *pkt,
+					bool first, bool last)
 {
 	u8 pg[12] = {  pkt[0] >> 4,  pkt[0] & 0xf,  pkt[1] >> 4,  pkt[1] & 0xf,
 		       pkt[2] >> 4,  pkt[2] & 0xf,  pkt[3] >> 4,  pkt[3] & 0xf,
@@ -534,8 +538,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_4b_32(unsigned long *map, unsigned long *fill,
-					struct nft_pipapo_field *f, int offset,
-					const u8 *pkt, bool first, bool last)
+					const struct nft_pipapo_field *f,
+					int offset, const u8 *pkt,
+					bool first, bool last)
 {
 	u8 pg[32] = {  pkt[0] >> 4,  pkt[0] & 0xf,  pkt[1] >> 4,  pkt[1] & 0xf,
 		       pkt[2] >> 4,  pkt[2] & 0xf,  pkt[3] >> 4,  pkt[3] & 0xf,
@@ -669,8 +674,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_8b_1(unsigned long *map, unsigned long *fill,
-				       struct nft_pipapo_field *f, int offset,
-				       const u8 *pkt, bool first, bool last)
+				       const struct nft_pipapo_field *f,
+				       int offset, const u8 *pkt,
+				       bool first, bool last)
 {
 	int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
 	unsigned long *lt = f->lt, bsize = f->bsize;
@@ -726,8 +732,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_8b_2(unsigned long *map, unsigned long *fill,
-				       struct nft_pipapo_field *f, int offset,
-				       const u8 *pkt, bool first, bool last)
+				       const struct nft_pipapo_field *f,
+				       int offset, const u8 *pkt,
+				       bool first, bool last)
 {
 	int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
 	unsigned long *lt = f->lt, bsize = f->bsize;
@@ -790,8 +797,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_8b_4(unsigned long *map, unsigned long *fill,
-				       struct nft_pipapo_field *f, int offset,
-				       const u8 *pkt, bool first, bool last)
+				       const struct nft_pipapo_field *f,
+				       int offset, const u8 *pkt,
+				       bool first, bool last)
 {
 	int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
 	unsigned long *lt = f->lt, bsize = f->bsize;
@@ -865,8 +873,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_8b_6(unsigned long *map, unsigned long *fill,
-				       struct nft_pipapo_field *f, int offset,
-				       const u8 *pkt, bool first, bool last)
+				       const struct nft_pipapo_field *f,
+				       int offset, const u8 *pkt,
+				       bool first, bool last)
 {
 	int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
 	unsigned long *lt = f->lt, bsize = f->bsize;
@@ -950,8 +959,9 @@
  * word index to be checked next (i.e. first filled word).
  */
 static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill,
-					struct nft_pipapo_field *f, int offset,
-					const u8 *pkt, bool first, bool last)
+					const struct nft_pipapo_field *f,
+					int offset, const u8 *pkt,
+					bool first, bool last)
 {
 	int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
 	unsigned long *lt = f->lt, bsize = f->bsize;
@@ -1026,6 +1036,7 @@
 
 /**
  * nft_pipapo_avx2_lookup_slow() - Fallback function for uncommon field sizes
+ * @mdata:	Matching data, including mapping table
  * @map:	Previous match result, used as initial bitmap
  * @fill:	Destination bitmap to be filled with current match result
  * @f:		Field, containing lookup and mapping tables
@@ -1041,15 +1052,17 @@
  * Return: -1 on no match, rule index of match if @last, otherwise first long
  * word index to be checked next (i.e. first filled word).
  */
-static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill,
-					struct nft_pipapo_field *f, int offset,
-					const u8 *pkt, bool first, bool last)
+static int nft_pipapo_avx2_lookup_slow(const struct nft_pipapo_match *mdata,
+					unsigned long *map, unsigned long *fill,
+					const struct nft_pipapo_field *f,
+					int offset, const u8 *pkt,
+					bool first, bool last)
 {
 	unsigned long bsize = f->bsize;
 	int i, ret = -1, b;
 
 	if (first)
-		memset(map, 0xff, bsize * sizeof(*map));
+		pipapo_resmap_init(mdata, map);
 
 	for (i = offset; i < bsize; i++) {
 		if (f->bb == 8)
@@ -1119,15 +1132,21 @@
 	struct nft_pipapo *priv = nft_set_priv(set);
 	struct nft_pipapo_scratch *scratch;
 	u8 genmask = nft_genmask_cur(net);
+	const struct nft_pipapo_match *m;
+	const struct nft_pipapo_field *f;
 	const u8 *rp = (const u8 *)key;
-	struct nft_pipapo_match *m;
-	struct nft_pipapo_field *f;
 	unsigned long *res, *fill;
 	bool map_index;
 	int i, ret = 0;
 
-	if (unlikely(!irq_fpu_usable()))
-		return nft_pipapo_lookup(net, set, key, ext);
+	local_bh_disable();
+
+	if (unlikely(!irq_fpu_usable())) {
+		bool fallback_res = nft_pipapo_lookup(net, set, key, ext);
+
+		local_bh_enable();
+		return fallback_res;
+	}
 
 	m = rcu_dereference(priv->match);
 
@@ -1142,6 +1161,7 @@
 	scratch = *raw_cpu_ptr(m->scratch);
 	if (unlikely(!scratch)) {
 		kernel_fpu_end();
+		local_bh_enable();
 		return false;
 	}
 
@@ -1175,7 +1195,7 @@
 			} else if (f->groups == 16) {
 				NFT_SET_PIPAPO_AVX2_LOOKUP(8, 16);
 			} else {
-				ret = nft_pipapo_avx2_lookup_slow(res, fill, f,
+				ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f,
 								  ret, rp,
 								  first, last);
 			}
@@ -1191,7 +1211,7 @@
 			} else if (f->groups == 32) {
 				NFT_SET_PIPAPO_AVX2_LOOKUP(4, 32);
 			} else {
-				ret = nft_pipapo_avx2_lookup_slow(res, fill, f,
+				ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f,
 								  ret, rp,
 								  first, last);
 			}
@@ -1222,6 +1242,7 @@
 	if (i % 2)
 		scratch->map_index = !map_index;
 	kernel_fpu_end();
+	local_bh_enable();
 
 	return ret >= 0;
 }
--- linux-qcom-6.8.0.orig/net/netfilter/nft_set_rbtree.c
+++ linux-qcom-6.8.0/net/netfilter/nft_set_rbtree.c
@@ -532,7 +532,7 @@
 {
 	struct nft_rbtree_elem *rbe = nft_elem_priv_cast(elem_priv);
 
-	nft_set_elem_change_active(net, set, &rbe->ext);
+	nft_clear(net, &rbe->ext);
 }
 
 static void nft_rbtree_flush(const struct net *net,
@@ -600,8 +600,6 @@
 
 		if (iter->count < iter->skip)
 			goto cont;
-		if (!nft_set_elem_active(&rbe->ext, iter->genmask))
-			goto cont;
 
 		iter->err = iter->fn(ctx, set, iter, &rbe->priv);
 		if (iter->err < 0) {
--- linux-qcom-6.8.0.orig/net/netfilter/nft_socket.c
+++ linux-qcom-6.8.0/net/netfilter/nft_socket.c
@@ -9,7 +9,8 @@
 
 struct nft_socket {
 	enum nft_socket_keys		key:8;
-	u8				level;
+	u8				level;		/* cgroupv2 level to extract */
+	u8				level_user;	/* cgroupv2 level provided by userspace */
 	u8				len;
 	union {
 		u8			dreg;
@@ -53,6 +54,28 @@
 	memcpy(dest, &cgid, sizeof(u64));
 	return true;
 }
+
+/* process context only, uses current->nsproxy. */
+static noinline int nft_socket_cgroup_subtree_level(void)
+{
+	struct cgroup *cgrp = cgroup_get_from_path("/");
+	int level;
+
+	if (IS_ERR(cgrp))
+		return PTR_ERR(cgrp);
+
+	level = cgrp->level;
+
+	cgroup_put(cgrp);
+
+	if (level > 255)
+		return -ERANGE;
+
+	if (WARN_ON_ONCE(level < 0))
+		return -EINVAL;
+
+	return level;
+}
 #endif
 
 static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt)
@@ -110,13 +133,13 @@
 			*dest = READ_ONCE(sk->sk_mark);
 		} else {
 			regs->verdict.code = NFT_BREAK;
-			return;
+			goto out_put_sk;
 		}
 		break;
 	case NFT_SOCKET_WILDCARD:
 		if (!sk_fullsock(sk)) {
 			regs->verdict.code = NFT_BREAK;
-			return;
+			goto out_put_sk;
 		}
 		nft_socket_wildcard(pkt, regs, sk, dest);
 		break;
@@ -124,7 +147,7 @@
 	case NFT_SOCKET_CGROUPV2:
 		if (!nft_sock_get_eval_cgroupv2(dest, sk, pkt, priv->level)) {
 			regs->verdict.code = NFT_BREAK;
-			return;
+			goto out_put_sk;
 		}
 		break;
 #endif
@@ -133,6 +156,7 @@
 		regs->verdict.code = NFT_BREAK;
 	}
 
+out_put_sk:
 	if (sk != skb->sk)
 		sock_gen_put(sk);
 }
@@ -173,9 +197,10 @@
 	case NFT_SOCKET_MARK:
 		len = sizeof(u32);
 		break;
-#ifdef CONFIG_CGROUPS
+#ifdef CONFIG_SOCK_CGROUP_DATA
 	case NFT_SOCKET_CGROUPV2: {
 		unsigned int level;
+		int err;
 
 		if (!tb[NFTA_SOCKET_LEVEL])
 			return -EINVAL;
@@ -184,6 +209,17 @@
 		if (level > 255)
 			return -EOPNOTSUPP;
 
+		err = nft_socket_cgroup_subtree_level();
+		if (err < 0)
+			return err;
+
+		priv->level_user = level;
+
+		level += err;
+		/* Implies a giant cgroup tree */
+		if (WARN_ON_ONCE(level > 255))
+			return -EOPNOTSUPP;
+
 		priv->level = level;
 		len = sizeof(u64);
 		break;
@@ -208,7 +244,7 @@
 	if (nft_dump_register(skb, NFTA_SOCKET_DREG, priv->dreg))
 		return -1;
 	if (priv->key == NFT_SOCKET_CGROUPV2 &&
-	    nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level)))
+	    nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level_user)))
 		return -1;
 	return 0;
 }
--- linux-qcom-6.8.0.orig/net/netfilter/nft_tunnel.c
+++ linux-qcom-6.8.0/net/netfilter/nft_tunnel.c
@@ -503,13 +503,14 @@
 			return err;
 	}
 
-	md = metadata_dst_alloc(priv->opts.len, METADATA_IP_TUNNEL, GFP_KERNEL);
+	md = metadata_dst_alloc(priv->opts.len, METADATA_IP_TUNNEL,
+				GFP_KERNEL_ACCOUNT);
 	if (!md)
 		return -ENOMEM;
 
 	memcpy(&md->u.tun_info, &info, sizeof(info));
 #ifdef CONFIG_DST_CACHE
-	err = dst_cache_init(&md->u.tun_info.dst_cache, GFP_KERNEL);
+	err = dst_cache_init(&md->u.tun_info.dst_cache, GFP_KERNEL_ACCOUNT);
 	if (err < 0) {
 		metadata_dst_free(md);
 		return err;
--- linux-qcom-6.8.0.orig/net/netfilter/x_tables.c
+++ linux-qcom-6.8.0/net/netfilter/x_tables.c
@@ -1268,7 +1268,7 @@
 
 	/* and once again: */
 	list_for_each_entry(t, &xt_net->tables[af], list)
-		if (strcmp(t->name, name) == 0)
+		if (strcmp(t->name, name) == 0 && owner == t->me)
 			return t;
 
 	module_put(owner);
--- linux-qcom-6.8.0.orig/net/netfilter/xt_CHECKSUM.c
+++ linux-qcom-6.8.0/net/netfilter/xt_CHECKSUM.c
@@ -63,24 +63,37 @@
 	return 0;
 }
 
-static struct xt_target checksum_tg_reg __read_mostly = {
-	.name		= "CHECKSUM",
-	.family		= NFPROTO_UNSPEC,
-	.target		= checksum_tg,
-	.targetsize	= sizeof(struct xt_CHECKSUM_info),
-	.table		= "mangle",
-	.checkentry	= checksum_tg_check,
-	.me		= THIS_MODULE,
+static struct xt_target checksum_tg_reg[] __read_mostly = {
+	{
+		.name		= "CHECKSUM",
+		.family		= NFPROTO_IPV4,
+		.target		= checksum_tg,
+		.targetsize	= sizeof(struct xt_CHECKSUM_info),
+		.table		= "mangle",
+		.checkentry	= checksum_tg_check,
+		.me		= THIS_MODULE,
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name		= "CHECKSUM",
+		.family		= NFPROTO_IPV6,
+		.target		= checksum_tg,
+		.targetsize	= sizeof(struct xt_CHECKSUM_info),
+		.table		= "mangle",
+		.checkentry	= checksum_tg_check,
+		.me		= THIS_MODULE,
+	},
+#endif
 };
 
 static int __init checksum_tg_init(void)
 {
-	return xt_register_target(&checksum_tg_reg);
+	return xt_register_targets(checksum_tg_reg, ARRAY_SIZE(checksum_tg_reg));
 }
 
 static void __exit checksum_tg_exit(void)
 {
-	xt_unregister_target(&checksum_tg_reg);
+	xt_unregister_targets(checksum_tg_reg, ARRAY_SIZE(checksum_tg_reg));
 }
 
 module_init(checksum_tg_init);
--- linux-qcom-6.8.0.orig/net/netfilter/xt_CLASSIFY.c
+++ linux-qcom-6.8.0/net/netfilter/xt_CLASSIFY.c
@@ -38,9 +38,9 @@
 	{
 		.name       = "CLASSIFY",
 		.revision   = 0,
-		.family     = NFPROTO_UNSPEC,
+		.family     = NFPROTO_IPV4,
 		.hooks      = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
-		              (1 << NF_INET_POST_ROUTING),
+			      (1 << NF_INET_POST_ROUTING),
 		.target     = classify_tg,
 		.targetsize = sizeof(struct xt_classify_target_info),
 		.me         = THIS_MODULE,
@@ -54,6 +54,18 @@
 		.targetsize = sizeof(struct xt_classify_target_info),
 		.me         = THIS_MODULE,
 	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name       = "CLASSIFY",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.hooks      = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
+			      (1 << NF_INET_POST_ROUTING),
+		.target     = classify_tg,
+		.targetsize = sizeof(struct xt_classify_target_info),
+		.me         = THIS_MODULE,
+	},
+#endif
 };
 
 static int __init classify_tg_init(void)
--- linux-qcom-6.8.0.orig/net/netfilter/xt_CONNSECMARK.c
+++ linux-qcom-6.8.0/net/netfilter/xt_CONNSECMARK.c
@@ -114,25 +114,39 @@
 	nf_ct_netns_put(par->net, par->family);
 }
 
-static struct xt_target connsecmark_tg_reg __read_mostly = {
-	.name       = "CONNSECMARK",
-	.revision   = 0,
-	.family     = NFPROTO_UNSPEC,
-	.checkentry = connsecmark_tg_check,
-	.destroy    = connsecmark_tg_destroy,
-	.target     = connsecmark_tg,
-	.targetsize = sizeof(struct xt_connsecmark_target_info),
-	.me         = THIS_MODULE,
+static struct xt_target connsecmark_tg_reg[] __read_mostly = {
+	{
+		.name       = "CONNSECMARK",
+		.revision   = 0,
+		.family     = NFPROTO_IPV4,
+		.checkentry = connsecmark_tg_check,
+		.destroy    = connsecmark_tg_destroy,
+		.target     = connsecmark_tg,
+		.targetsize = sizeof(struct xt_connsecmark_target_info),
+		.me         = THIS_MODULE,
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name       = "CONNSECMARK",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.checkentry = connsecmark_tg_check,
+		.destroy    = connsecmark_tg_destroy,
+		.target     = connsecmark_tg,
+		.targetsize = sizeof(struct xt_connsecmark_target_info),
+		.me         = THIS_MODULE,
+	},
+#endif
 };
 
 static int __init connsecmark_tg_init(void)
 {
-	return xt_register_target(&connsecmark_tg_reg);
+	return xt_register_targets(connsecmark_tg_reg, ARRAY_SIZE(connsecmark_tg_reg));
 }
 
 static void __exit connsecmark_tg_exit(void)
 {
-	xt_unregister_target(&connsecmark_tg_reg);
+	xt_unregister_targets(connsecmark_tg_reg, ARRAY_SIZE(connsecmark_tg_reg));
 }
 
 module_init(connsecmark_tg_init);
--- linux-qcom-6.8.0.orig/net/netfilter/xt_CT.c
+++ linux-qcom-6.8.0/net/netfilter/xt_CT.c
@@ -313,10 +313,30 @@
 	xt_ct_tg_destroy(par, par->targinfo);
 }
 
+static unsigned int
+notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
+{
+	/* Previously seen (loopback)? Ignore. */
+	if (skb->_nfct != 0)
+		return XT_CONTINUE;
+
+	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+
+	return XT_CONTINUE;
+}
+
 static struct xt_target xt_ct_tg_reg[] __read_mostly = {
 	{
+		.name		= "NOTRACK",
+		.revision	= 0,
+		.family		= NFPROTO_IPV4,
+		.target		= notrack_tg,
+		.table		= "raw",
+		.me		= THIS_MODULE,
+	},
+	{
 		.name		= "CT",
-		.family		= NFPROTO_UNSPEC,
+		.family		= NFPROTO_IPV4,
 		.targetsize	= sizeof(struct xt_ct_target_info),
 		.usersize	= offsetof(struct xt_ct_target_info, ct),
 		.checkentry	= xt_ct_tg_check_v0,
@@ -327,7 +347,7 @@
 	},
 	{
 		.name		= "CT",
-		.family		= NFPROTO_UNSPEC,
+		.family		= NFPROTO_IPV4,
 		.revision	= 1,
 		.targetsize	= sizeof(struct xt_ct_target_info_v1),
 		.usersize	= offsetof(struct xt_ct_target_info, ct),
@@ -339,7 +359,7 @@
 	},
 	{
 		.name		= "CT",
-		.family		= NFPROTO_UNSPEC,
+		.family		= NFPROTO_IPV4,
 		.revision	= 2,
 		.targetsize	= sizeof(struct xt_ct_target_info_v1),
 		.usersize	= offsetof(struct xt_ct_target_info, ct),
@@ -349,49 +369,61 @@
 		.table		= "raw",
 		.me		= THIS_MODULE,
 	},
-};
-
-static unsigned int
-notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
-{
-	/* Previously seen (loopback)? Ignore. */
-	if (skb->_nfct != 0)
-		return XT_CONTINUE;
-
-	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
-
-	return XT_CONTINUE;
-}
-
-static struct xt_target notrack_tg_reg __read_mostly = {
-	.name		= "NOTRACK",
-	.revision	= 0,
-	.family		= NFPROTO_UNSPEC,
-	.target		= notrack_tg,
-	.table		= "raw",
-	.me		= THIS_MODULE,
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name		= "NOTRACK",
+		.revision	= 0,
+		.family		= NFPROTO_IPV6,
+		.target		= notrack_tg,
+		.table		= "raw",
+		.me		= THIS_MODULE,
+	},
+	{
+		.name		= "CT",
+		.family		= NFPROTO_IPV6,
+		.targetsize	= sizeof(struct xt_ct_target_info),
+		.usersize	= offsetof(struct xt_ct_target_info, ct),
+		.checkentry	= xt_ct_tg_check_v0,
+		.destroy	= xt_ct_tg_destroy_v0,
+		.target		= xt_ct_target_v0,
+		.table		= "raw",
+		.me		= THIS_MODULE,
+	},
+	{
+		.name		= "CT",
+		.family		= NFPROTO_IPV6,
+		.revision	= 1,
+		.targetsize	= sizeof(struct xt_ct_target_info_v1),
+		.usersize	= offsetof(struct xt_ct_target_info, ct),
+		.checkentry	= xt_ct_tg_check_v1,
+		.destroy	= xt_ct_tg_destroy_v1,
+		.target		= xt_ct_target_v1,
+		.table		= "raw",
+		.me		= THIS_MODULE,
+	},
+	{
+		.name		= "CT",
+		.family		= NFPROTO_IPV6,
+		.revision	= 2,
+		.targetsize	= sizeof(struct xt_ct_target_info_v1),
+		.usersize	= offsetof(struct xt_ct_target_info, ct),
+		.checkentry	= xt_ct_tg_check_v2,
+		.destroy	= xt_ct_tg_destroy_v1,
+		.target		= xt_ct_target_v1,
+		.table		= "raw",
+		.me		= THIS_MODULE,
+	},
+#endif
 };
 
 static int __init xt_ct_tg_init(void)
 {
-	int ret;
-
-	ret = xt_register_target(&notrack_tg_reg);
-	if (ret < 0)
-		return ret;
-
-	ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
-	if (ret < 0) {
-		xt_unregister_target(&notrack_tg_reg);
-		return ret;
-	}
-	return 0;
+	return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
 }
 
 static void __exit xt_ct_tg_exit(void)
 {
 	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
-	xt_unregister_target(&notrack_tg_reg);
 }
 
 module_init(xt_ct_tg_init);
--- linux-qcom-6.8.0.orig/net/netfilter/xt_IDLETIMER.c
+++ linux-qcom-6.8.0/net/netfilter/xt_IDLETIMER.c
@@ -409,21 +409,23 @@
 
 	mutex_lock(&list_mutex);
 
-	if (--info->timer->refcnt == 0) {
-		pr_debug("deleting timer %s\n", info->label);
-
-		list_del(&info->timer->entry);
-		timer_shutdown_sync(&info->timer->timer);
-		cancel_work_sync(&info->timer->work);
-		sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
-		kfree(info->timer->attr.attr.name);
-		kfree(info->timer);
-	} else {
+	if (--info->timer->refcnt > 0) {
 		pr_debug("decreased refcnt of timer %s to %u\n",
 			 info->label, info->timer->refcnt);
+		mutex_unlock(&list_mutex);
+		return;
 	}
 
+	pr_debug("deleting timer %s\n", info->label);
+
+	list_del(&info->timer->entry);
 	mutex_unlock(&list_mutex);
+
+	timer_shutdown_sync(&info->timer->timer);
+	cancel_work_sync(&info->timer->work);
+	sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
+	kfree(info->timer->attr.attr.name);
+	kfree(info->timer);
 }
 
 static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)
@@ -434,52 +436,75 @@
 
 	mutex_lock(&list_mutex);
 
-	if (--info->timer->refcnt == 0) {
-		pr_debug("deleting timer %s\n", info->label);
-
-		list_del(&info->timer->entry);
-		if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
-			alarm_cancel(&info->timer->alarm);
-		} else {
-			timer_shutdown_sync(&info->timer->timer);
-		}
-		cancel_work_sync(&info->timer->work);
-		sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
-		kfree(info->timer->attr.attr.name);
-		kfree(info->timer);
-	} else {
+	if (--info->timer->refcnt > 0) {
 		pr_debug("decreased refcnt of timer %s to %u\n",
 			 info->label, info->timer->refcnt);
+		mutex_unlock(&list_mutex);
+		return;
 	}
 
+	pr_debug("deleting timer %s\n", info->label);
+
+	list_del(&info->timer->entry);
 	mutex_unlock(&list_mutex);
+
+	if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
+		alarm_cancel(&info->timer->alarm);
+	} else {
+		timer_shutdown_sync(&info->timer->timer);
+	}
+	cancel_work_sync(&info->timer->work);
+	sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
+	kfree(info->timer->attr.attr.name);
+	kfree(info->timer);
 }
 
 
 static struct xt_target idletimer_tg[] __read_mostly = {
 	{
-	.name		= "IDLETIMER",
-	.family		= NFPROTO_UNSPEC,
-	.target		= idletimer_tg_target,
-	.targetsize     = sizeof(struct idletimer_tg_info),
-	.usersize	= offsetof(struct idletimer_tg_info, timer),
-	.checkentry	= idletimer_tg_checkentry,
-	.destroy        = idletimer_tg_destroy,
-	.me		= THIS_MODULE,
+		.name		= "IDLETIMER",
+		.family		= NFPROTO_IPV4,
+		.target		= idletimer_tg_target,
+		.targetsize     = sizeof(struct idletimer_tg_info),
+		.usersize	= offsetof(struct idletimer_tg_info, timer),
+		.checkentry	= idletimer_tg_checkentry,
+		.destroy        = idletimer_tg_destroy,
+		.me		= THIS_MODULE,
 	},
 	{
-	.name		= "IDLETIMER",
-	.family		= NFPROTO_UNSPEC,
-	.revision	= 1,
-	.target		= idletimer_tg_target_v1,
-	.targetsize     = sizeof(struct idletimer_tg_info_v1),
-	.usersize	= offsetof(struct idletimer_tg_info_v1, timer),
-	.checkentry	= idletimer_tg_checkentry_v1,
-	.destroy        = idletimer_tg_destroy_v1,
-	.me		= THIS_MODULE,
+		.name		= "IDLETIMER",
+		.family		= NFPROTO_IPV4,
+		.revision	= 1,
+		.target		= idletimer_tg_target_v1,
+		.targetsize     = sizeof(struct idletimer_tg_info_v1),
+		.usersize	= offsetof(struct idletimer_tg_info_v1, timer),
+		.checkentry	= idletimer_tg_checkentry_v1,
+		.destroy        = idletimer_tg_destroy_v1,
+		.me		= THIS_MODULE,
 	},
-
-
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name		= "IDLETIMER",
+		.family		= NFPROTO_IPV6,
+		.target		= idletimer_tg_target,
+		.targetsize     = sizeof(struct idletimer_tg_info),
+		.usersize	= offsetof(struct idletimer_tg_info, timer),
+		.checkentry	= idletimer_tg_checkentry,
+		.destroy        = idletimer_tg_destroy,
+		.me		= THIS_MODULE,
+	},
+	{
+		.name		= "IDLETIMER",
+		.family		= NFPROTO_IPV6,
+		.revision	= 1,
+		.target		= idletimer_tg_target_v1,
+		.targetsize     = sizeof(struct idletimer_tg_info_v1),
+		.usersize	= offsetof(struct idletimer_tg_info_v1, timer),
+		.checkentry	= idletimer_tg_checkentry_v1,
+		.destroy        = idletimer_tg_destroy_v1,
+		.me		= THIS_MODULE,
+	},
+#endif
 };
 
 static struct class *idletimer_tg_class;
--- linux-qcom-6.8.0.orig/net/netfilter/xt_LED.c
+++ linux-qcom-6.8.0/net/netfilter/xt_LED.c
@@ -96,7 +96,9 @@
 	struct xt_led_info_internal *ledinternal;
 	int err;
 
-	if (ledinfo->id[0] == '\0')
+	/* Bail out if empty string or not a string at all. */
+	if (ledinfo->id[0] == '\0' ||
+	    !memchr(ledinfo->id, '\0', sizeof(ledinfo->id)))
 		return -EINVAL;
 
 	mutex_lock(&xt_led_mutex);
@@ -175,26 +177,41 @@
 	kfree(ledinternal);
 }
 
-static struct xt_target led_tg_reg __read_mostly = {
-	.name		= "LED",
-	.revision	= 0,
-	.family		= NFPROTO_UNSPEC,
-	.target		= led_tg,
-	.targetsize	= sizeof(struct xt_led_info),
-	.usersize	= offsetof(struct xt_led_info, internal_data),
-	.checkentry	= led_tg_check,
-	.destroy	= led_tg_destroy,
-	.me		= THIS_MODULE,
+static struct xt_target led_tg_reg[] __read_mostly = {
+	{
+		.name		= "LED",
+		.revision	= 0,
+		.family		= NFPROTO_IPV4,
+		.target		= led_tg,
+		.targetsize	= sizeof(struct xt_led_info),
+		.usersize	= offsetof(struct xt_led_info, internal_data),
+		.checkentry	= led_tg_check,
+		.destroy	= led_tg_destroy,
+		.me		= THIS_MODULE,
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name		= "LED",
+		.revision	= 0,
+		.family		= NFPROTO_IPV6,
+		.target		= led_tg,
+		.targetsize	= sizeof(struct xt_led_info),
+		.usersize	= offsetof(struct xt_led_info, internal_data),
+		.checkentry	= led_tg_check,
+		.destroy	= led_tg_destroy,
+		.me		= THIS_MODULE,
+	},
+#endif
 };
 
 static int __init led_tg_init(void)
 {
-	return xt_register_target(&led_tg_reg);
+	return xt_register_targets(led_tg_reg, ARRAY_SIZE(led_tg_reg));
 }
 
 static void __exit led_tg_exit(void)
 {
-	xt_unregister_target(&led_tg_reg);
+	xt_unregister_targets(led_tg_reg, ARRAY_SIZE(led_tg_reg));
 }
 
 module_init(led_tg_init);
--- linux-qcom-6.8.0.orig/net/netfilter/xt_NFLOG.c
+++ linux-qcom-6.8.0/net/netfilter/xt_NFLOG.c
@@ -64,25 +64,39 @@
 	nf_logger_put(par->family, NF_LOG_TYPE_ULOG);
 }
 
-static struct xt_target nflog_tg_reg __read_mostly = {
-	.name       = "NFLOG",
-	.revision   = 0,
-	.family     = NFPROTO_UNSPEC,
-	.checkentry = nflog_tg_check,
-	.destroy    = nflog_tg_destroy,
-	.target     = nflog_tg,
-	.targetsize = sizeof(struct xt_nflog_info),
-	.me         = THIS_MODULE,
+static struct xt_target nflog_tg_reg[] __read_mostly = {
+	{
+		.name       = "NFLOG",
+		.revision   = 0,
+		.family     = NFPROTO_IPV4,
+		.checkentry = nflog_tg_check,
+		.destroy    = nflog_tg_destroy,
+		.target     = nflog_tg,
+		.targetsize = sizeof(struct xt_nflog_info),
+		.me         = THIS_MODULE,
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name       = "NFLOG",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.checkentry = nflog_tg_check,
+		.destroy    = nflog_tg_destroy,
+		.target     = nflog_tg,
+		.targetsize = sizeof(struct xt_nflog_info),
+		.me         = THIS_MODULE,
+	},
+#endif
 };
 
 static int __init nflog_tg_init(void)
 {
-	return xt_register_target(&nflog_tg_reg);
+	return xt_register_targets(nflog_tg_reg, ARRAY_SIZE(nflog_tg_reg));
 }
 
 static void __exit nflog_tg_exit(void)
 {
-	xt_unregister_target(&nflog_tg_reg);
+	xt_unregister_targets(nflog_tg_reg, ARRAY_SIZE(nflog_tg_reg));
 }
 
 module_init(nflog_tg_init);
--- linux-qcom-6.8.0.orig/net/netfilter/xt_RATEEST.c
+++ linux-qcom-6.8.0/net/netfilter/xt_RATEEST.c
@@ -179,16 +179,31 @@
 	xt_rateest_put(par->net, info->est);
 }
 
-static struct xt_target xt_rateest_tg_reg __read_mostly = {
-	.name       = "RATEEST",
-	.revision   = 0,
-	.family     = NFPROTO_UNSPEC,
-	.target     = xt_rateest_tg,
-	.checkentry = xt_rateest_tg_checkentry,
-	.destroy    = xt_rateest_tg_destroy,
-	.targetsize = sizeof(struct xt_rateest_target_info),
-	.usersize   = offsetof(struct xt_rateest_target_info, est),
-	.me         = THIS_MODULE,
+static struct xt_target xt_rateest_tg_reg[] __read_mostly = {
+	{
+		.name       = "RATEEST",
+		.revision   = 0,
+		.family     = NFPROTO_IPV4,
+		.target     = xt_rateest_tg,
+		.checkentry = xt_rateest_tg_checkentry,
+		.destroy    = xt_rateest_tg_destroy,
+		.targetsize = sizeof(struct xt_rateest_target_info),
+		.usersize   = offsetof(struct xt_rateest_target_info, est),
+		.me         = THIS_MODULE,
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name       = "RATEEST",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.target     = xt_rateest_tg,
+		.checkentry = xt_rateest_tg_checkentry,
+		.destroy    = xt_rateest_tg_destroy,
+		.targetsize = sizeof(struct xt_rateest_target_info),
+		.usersize   = offsetof(struct xt_rateest_target_info, est),
+		.me         = THIS_MODULE,
+	},
+#endif
 };
 
 static __net_init int xt_rateest_net_init(struct net *net)
@@ -214,12 +229,12 @@
 
 	if (err)
 		return err;
-	return xt_register_target(&xt_rateest_tg_reg);
+	return xt_register_targets(xt_rateest_tg_reg, ARRAY_SIZE(xt_rateest_tg_reg));
 }
 
 static void __exit xt_rateest_tg_fini(void)
 {
-	xt_unregister_target(&xt_rateest_tg_reg);
+	xt_unregister_targets(xt_rateest_tg_reg, ARRAY_SIZE(xt_rateest_tg_reg));
 	unregister_pernet_subsys(&xt_rateest_net_ops);
 }
 
--- linux-qcom-6.8.0.orig/net/netfilter/xt_SECMARK.c
+++ linux-qcom-6.8.0/net/netfilter/xt_SECMARK.c
@@ -157,7 +157,7 @@
 	{
 		.name		= "SECMARK",
 		.revision	= 0,
-		.family		= NFPROTO_UNSPEC,
+		.family		= NFPROTO_IPV4,
 		.checkentry	= secmark_tg_check_v0,
 		.destroy	= secmark_tg_destroy,
 		.target		= secmark_tg_v0,
@@ -167,7 +167,7 @@
 	{
 		.name		= "SECMARK",
 		.revision	= 1,
-		.family		= NFPROTO_UNSPEC,
+		.family		= NFPROTO_IPV4,
 		.checkentry	= secmark_tg_check_v1,
 		.destroy	= secmark_tg_destroy,
 		.target		= secmark_tg_v1,
@@ -175,6 +175,29 @@
 		.usersize	= offsetof(struct xt_secmark_target_info_v1, secid),
 		.me		= THIS_MODULE,
 	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name		= "SECMARK",
+		.revision	= 0,
+		.family		= NFPROTO_IPV6,
+		.checkentry	= secmark_tg_check_v0,
+		.destroy	= secmark_tg_destroy,
+		.target		= secmark_tg_v0,
+		.targetsize	= sizeof(struct xt_secmark_target_info),
+		.me		= THIS_MODULE,
+	},
+	{
+		.name		= "SECMARK",
+		.revision	= 1,
+		.family		= NFPROTO_IPV6,
+		.checkentry	= secmark_tg_check_v1,
+		.destroy	= secmark_tg_destroy,
+		.target		= secmark_tg_v1,
+		.targetsize	= sizeof(struct xt_secmark_target_info_v1),
+		.usersize	= offsetof(struct xt_secmark_target_info_v1, secid),
+		.me		= THIS_MODULE,
+	},
+#endif
 };
 
 static int __init secmark_tg_init(void)
--- linux-qcom-6.8.0.orig/net/netfilter/xt_TRACE.c
+++ linux-qcom-6.8.0/net/netfilter/xt_TRACE.c
@@ -29,25 +29,39 @@
 	return XT_CONTINUE;
 }
 
-static struct xt_target trace_tg_reg __read_mostly = {
-	.name		= "TRACE",
-	.revision	= 0,
-	.family		= NFPROTO_UNSPEC,
-	.table		= "raw",
-	.target		= trace_tg,
-	.checkentry	= trace_tg_check,
-	.destroy	= trace_tg_destroy,
-	.me		= THIS_MODULE,
+static struct xt_target trace_tg_reg[] __read_mostly = {
+	{
+		.name		= "TRACE",
+		.revision	= 0,
+		.family		= NFPROTO_IPV4,
+		.table		= "raw",
+		.target		= trace_tg,
+		.checkentry	= trace_tg_check,
+		.destroy	= trace_tg_destroy,
+		.me		= THIS_MODULE,
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name		= "TRACE",
+		.revision	= 0,
+		.family		= NFPROTO_IPV6,
+		.table		= "raw",
+		.target		= trace_tg,
+		.checkentry	= trace_tg_check,
+		.destroy	= trace_tg_destroy,
+		.me		= THIS_MODULE,
+	},
+#endif
 };
 
 static int __init trace_tg_init(void)
 {
-	return xt_register_target(&trace_tg_reg);
+	return xt_register_targets(trace_tg_reg, ARRAY_SIZE(trace_tg_reg));
 }
 
 static void __exit trace_tg_exit(void)
 {
-	xt_unregister_target(&trace_tg_reg);
+	xt_unregister_targets(trace_tg_reg, ARRAY_SIZE(trace_tg_reg));
 }
 
 module_init(trace_tg_init);
--- linux-qcom-6.8.0.orig/net/netfilter/xt_addrtype.c
+++ linux-qcom-6.8.0/net/netfilter/xt_addrtype.c
@@ -208,13 +208,24 @@
 	},
 	{
 		.name		= "addrtype",
-		.family		= NFPROTO_UNSPEC,
+		.family		= NFPROTO_IPV4,
 		.revision	= 1,
 		.match		= addrtype_mt_v1,
 		.checkentry	= addrtype_mt_checkentry_v1,
 		.matchsize	= sizeof(struct xt_addrtype_info_v1),
 		.me		= THIS_MODULE
-	}
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name		= "addrtype",
+		.family		= NFPROTO_IPV6,
+		.revision	= 1,
+		.match		= addrtype_mt_v1,
+		.checkentry	= addrtype_mt_checkentry_v1,
+		.matchsize	= sizeof(struct xt_addrtype_info_v1),
+		.me		= THIS_MODULE
+	},
+#endif
 };
 
 static int __init addrtype_mt_init(void)
--- linux-qcom-6.8.0.orig/net/netfilter/xt_cluster.c
+++ linux-qcom-6.8.0/net/netfilter/xt_cluster.c
@@ -146,24 +146,37 @@
 	nf_ct_netns_put(par->net, par->family);
 }
 
-static struct xt_match xt_cluster_match __read_mostly = {
-	.name		= "cluster",
-	.family		= NFPROTO_UNSPEC,
-	.match		= xt_cluster_mt,
-	.checkentry	= xt_cluster_mt_checkentry,
-	.matchsize	= sizeof(struct xt_cluster_match_info),
-	.destroy	= xt_cluster_mt_destroy,
-	.me		= THIS_MODULE,
+static struct xt_match xt_cluster_match[] __read_mostly = {
+	{
+		.name		= "cluster",
+		.family		= NFPROTO_IPV4,
+		.match		= xt_cluster_mt,
+		.checkentry	= xt_cluster_mt_checkentry,
+		.matchsize	= sizeof(struct xt_cluster_match_info),
+		.destroy	= xt_cluster_mt_destroy,
+		.me		= THIS_MODULE,
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name		= "cluster",
+		.family		= NFPROTO_IPV6,
+		.match		= xt_cluster_mt,
+		.checkentry	= xt_cluster_mt_checkentry,
+		.matchsize	= sizeof(struct xt_cluster_match_info),
+		.destroy	= xt_cluster_mt_destroy,
+		.me		= THIS_MODULE,
+	},
+#endif
 };
 
 static int __init xt_cluster_mt_init(void)
 {
-	return xt_register_match(&xt_cluster_match);
+	return xt_register_matches(xt_cluster_match, ARRAY_SIZE(xt_cluster_match));
 }
 
 static void __exit xt_cluster_mt_fini(void)
 {
-	xt_unregister_match(&xt_cluster_match);
+	xt_unregister_matches(xt_cluster_match, ARRAY_SIZE(xt_cluster_match));
 }
 
 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
--- linux-qcom-6.8.0.orig/net/netfilter/xt_connbytes.c
+++ linux-qcom-6.8.0/net/netfilter/xt_connbytes.c
@@ -111,9 +111,11 @@
 		return -EINVAL;
 
 	ret = nf_ct_netns_get(par->net, par->family);
-	if (ret < 0)
+	if (ret < 0) {
 		pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
 				    par->family);
+		return ret;
+	}
 
 	/*
 	 * This filter cannot function correctly unless connection tracking
--- linux-qcom-6.8.0.orig/net/netfilter/xt_connlimit.c
+++ linux-qcom-6.8.0/net/netfilter/xt_connlimit.c
@@ -106,26 +106,41 @@
 	nf_conncount_destroy(par->net, par->family, info->data);
 }
 
-static struct xt_match connlimit_mt_reg __read_mostly = {
-	.name       = "connlimit",
-	.revision   = 1,
-	.family     = NFPROTO_UNSPEC,
-	.checkentry = connlimit_mt_check,
-	.match      = connlimit_mt,
-	.matchsize  = sizeof(struct xt_connlimit_info),
-	.usersize   = offsetof(struct xt_connlimit_info, data),
-	.destroy    = connlimit_mt_destroy,
-	.me         = THIS_MODULE,
+static struct xt_match connlimit_mt_reg[] __read_mostly = {
+	{
+		.name       = "connlimit",
+		.revision   = 1,
+		.family     = NFPROTO_IPV4,
+		.checkentry = connlimit_mt_check,
+		.match      = connlimit_mt,
+		.matchsize  = sizeof(struct xt_connlimit_info),
+		.usersize   = offsetof(struct xt_connlimit_info, data),
+		.destroy    = connlimit_mt_destroy,
+		.me         = THIS_MODULE,
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name       = "connlimit",
+		.revision   = 1,
+		.family     = NFPROTO_IPV6,
+		.checkentry = connlimit_mt_check,
+		.match      = connlimit_mt,
+		.matchsize  = sizeof(struct xt_connlimit_info),
+		.usersize   = offsetof(struct xt_connlimit_info, data),
+		.destroy    = connlimit_mt_destroy,
+		.me         = THIS_MODULE,
+	},
+#endif
 };
 
 static int __init connlimit_mt_init(void)
 {
-	return xt_register_match(&connlimit_mt_reg);
+	return xt_register_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
 }
 
 static void __exit connlimit_mt_exit(void)
 {
-	xt_unregister_match(&connlimit_mt_reg);
+	xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
 }
 
 module_init(connlimit_mt_init);
--- linux-qcom-6.8.0.orig/net/netfilter/xt_connmark.c
+++ linux-qcom-6.8.0/net/netfilter/xt_connmark.c
@@ -151,7 +151,7 @@
 	{
 		.name           = "CONNMARK",
 		.revision       = 1,
-		.family         = NFPROTO_UNSPEC,
+		.family         = NFPROTO_IPV4,
 		.checkentry     = connmark_tg_check,
 		.target         = connmark_tg,
 		.targetsize     = sizeof(struct xt_connmark_tginfo1),
@@ -161,13 +161,35 @@
 	{
 		.name           = "CONNMARK",
 		.revision       = 2,
-		.family         = NFPROTO_UNSPEC,
+		.family         = NFPROTO_IPV4,
 		.checkentry     = connmark_tg_check,
 		.target         = connmark_tg_v2,
 		.targetsize     = sizeof(struct xt_connmark_tginfo2),
 		.destroy        = connmark_tg_destroy,
 		.me             = THIS_MODULE,
-	}
+	},
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name           = "CONNMARK",
+		.revision       = 1,
+		.family         = NFPROTO_IPV6,
+		.checkentry     = connmark_tg_check,
+		.target         = connmark_tg,
+		.targetsize     = sizeof(struct xt_connmark_tginfo1),
+		.destroy        = connmark_tg_destroy,
+		.me             = THIS_MODULE,
+	},
+	{
+		.name           = "CONNMARK",
+		.revision       = 2,
+		.family         = NFPROTO_IPV6,
+		.checkentry     = connmark_tg_check,
+		.target         = connmark_tg_v2,
+		.targetsize     = sizeof(struct xt_connmark_tginfo2),
+		.destroy        = connmark_tg_destroy,
+		.me             = THIS_MODULE,
+	},
+#endif
 };
 
 static struct xt_match connmark_mt_reg __read_mostly = {
--- linux-qcom-6.8.0.orig/net/netfilter/xt_mark.c
+++ linux-qcom-6.8.0/net/netfilter/xt_mark.c
@@ -39,13 +39,35 @@
 	return ((skb->mark & info->mask) == info->mark) ^ info->invert;
 }
 
-static struct xt_target mark_tg_reg __read_mostly = {
-	.name           = "MARK",
-	.revision       = 2,
-	.family         = NFPROTO_UNSPEC,
-	.target         = mark_tg,
-	.targetsize     = sizeof(struct xt_mark_tginfo2),
-	.me             = THIS_MODULE,
+static struct xt_target mark_tg_reg[] __read_mostly = {
+	{
+		.name           = "MARK",
+		.revision       = 2,
+		.family         = NFPROTO_IPV4,
+		.target         = mark_tg,
+		.targetsize     = sizeof(struct xt_mark_tginfo2),
+		.me             = THIS_MODULE,
+	},
+#if IS_ENABLED(CONFIG_IP_NF_ARPTABLES)
+	{
+		.name           = "MARK",
+		.revision       = 2,
+		.family         = NFPROTO_ARP,
+		.target         = mark_tg,
+		.targetsize     = sizeof(struct xt_mark_tginfo2),
+		.me             = THIS_MODULE,
+	},
+#endif
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	{
+		.name           = "MARK",
+		.revision       = 2,
+		.family         = NFPROTO_IPV6,
+		.target         = mark_tg,
+		.targetsize     = sizeof(struct xt_mark_tginfo2),
+		.me             = THIS_MODULE,
+	},
+#endif
 };
 
 static struct xt_match mark_mt_reg __read_mostly = {
@@ -61,12 +83,12 @@
 {
 	int ret;
 
-	ret = xt_register_target(&mark_tg_reg);
+	ret = xt_register_targets(mark_tg_reg, ARRAY_SIZE(mark_tg_reg));
 	if (ret < 0)
 		return ret;
 	ret = xt_register_match(&mark_mt_reg);
 	if (ret < 0) {
-		xt_unregister_target(&mark_tg_reg);
+		xt_unregister_targets(mark_tg_reg, ARRAY_SIZE(mark_tg_reg));
 		return ret;
 	}
 	return 0;
@@ -75,7 +97,7 @@
 static void __exit mark_mt_exit(void)
 {
 	xt_unregister_match(&mark_mt_reg);
-	xt_unregister_target(&mark_tg_reg);
+	xt_unregister_targets(mark_tg_reg, ARRAY_SIZE(mark_tg_reg));
 }
 
 module_init(mark_mt_init);
--- linux-qcom-6.8.0.orig/net/netlabel/netlabel_unlabeled.c
+++ linux-qcom-6.8.0/net/netlabel/netlabel_unlabeled.c
@@ -374,8 +374,7 @@
 	struct net_device *dev;
 	struct netlbl_unlhsh_iface *iface;
 	struct audit_buffer *audit_buf = NULL;
-	char *secctx = NULL;
-	u32 secctx_len;
+	struct lsmcontext ctx;
 
 	if (addr_len != sizeof(struct in_addr) &&
 	    addr_len != sizeof(struct in6_addr))
@@ -438,11 +437,9 @@
 unlhsh_add_return:
 	rcu_read_unlock();
 	if (audit_buf != NULL) {
-		if (security_secid_to_secctx(secid,
-					     &secctx,
-					     &secctx_len) == 0) {
-			audit_log_format(audit_buf, " sec_obj=%s", secctx);
-			security_release_secctx(secctx, secctx_len);
+		if (security_secid_to_secctx(secid, &ctx) >= 0) {
+			audit_log_format(audit_buf, " sec_obj=%s", ctx.context);
+			security_release_secctx(&ctx);
 		}
 		audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
 		audit_log_end(audit_buf);
@@ -473,8 +470,7 @@
 	struct netlbl_unlhsh_addr4 *entry;
 	struct audit_buffer *audit_buf;
 	struct net_device *dev;
-	char *secctx;
-	u32 secctx_len;
+	struct lsmcontext ctx;
 
 	spin_lock(&netlbl_unlhsh_lock);
 	list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
@@ -494,10 +490,9 @@
 					  addr->s_addr, mask->s_addr);
 		dev_put(dev);
 		if (entry != NULL &&
-		    security_secid_to_secctx(entry->secid,
-					     &secctx, &secctx_len) == 0) {
-			audit_log_format(audit_buf, " sec_obj=%s", secctx);
-			security_release_secctx(secctx, secctx_len);
+		    security_secid_to_secctx(entry->secid, &ctx) >= 0) {
+			audit_log_format(audit_buf, " sec_obj=%s", ctx.context);
+			security_release_secctx(&ctx);
 		}
 		audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
 		audit_log_end(audit_buf);
@@ -534,8 +529,7 @@
 	struct netlbl_unlhsh_addr6 *entry;
 	struct audit_buffer *audit_buf;
 	struct net_device *dev;
-	char *secctx;
-	u32 secctx_len;
+	struct lsmcontext ctx;
 
 	spin_lock(&netlbl_unlhsh_lock);
 	list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
@@ -554,10 +548,9 @@
 					  addr, mask);
 		dev_put(dev);
 		if (entry != NULL &&
-		    security_secid_to_secctx(entry->secid,
-					     &secctx, &secctx_len) == 0) {
-			audit_log_format(audit_buf, " sec_obj=%s", secctx);
-			security_release_secctx(secctx, secctx_len);
+		    security_secid_to_secctx(entry->secid, &ctx) >= 0) {
+			audit_log_format(audit_buf, " sec_obj=%s", ctx.context);
+			security_release_secctx(&ctx);
 		}
 		audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
 		audit_log_end(audit_buf);
@@ -1069,10 +1062,9 @@
 	int ret_val = -ENOMEM;
 	struct netlbl_unlhsh_walk_arg *cb_arg = arg;
 	struct net_device *dev;
+	struct lsmcontext ctx;
 	void *data;
 	u32 secid;
-	char *secctx;
-	u32 secctx_len;
 
 	data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
 			   cb_arg->seq, &netlbl_unlabel_gnl_family,
@@ -1127,14 +1119,14 @@
 		secid = addr6->secid;
 	}
 
-	ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
-	if (ret_val != 0)
+	ret_val = security_secid_to_secctx(secid, &ctx);
+	if (ret_val < 0)
 		goto list_cb_failure;
 	ret_val = nla_put(cb_arg->skb,
 			  NLBL_UNLABEL_A_SECCTX,
-			  secctx_len,
-			  secctx);
-	security_release_secctx(secctx, secctx_len);
+			  ctx.len,
+			  ctx.context);
+	security_release_secctx(&ctx);
 	if (ret_val != 0)
 		goto list_cb_failure;
 
@@ -1538,7 +1530,7 @@
 	/* Only the kernel is allowed to call this function and the only time
 	 * it is called is at bootup before the audit subsystem is reporting
 	 * messages so don't worry to much about these values. */
-	security_current_getsecid_subj(&audit_info.secid);
+	security_current_getlsmblob_subj(&audit_info.blob);
 	audit_info.loginuid = GLOBAL_ROOT_UID;
 	audit_info.sessionid = 0;
 
--- linux-qcom-6.8.0.orig/net/netlabel/netlabel_user.c
+++ linux-qcom-6.8.0/net/netlabel/netlabel_user.c
@@ -84,8 +84,6 @@
 					       struct netlbl_audit *audit_info)
 {
 	struct audit_buffer *audit_buf;
-	char *secctx;
-	u32 secctx_len;
 
 	if (audit_enabled == AUDIT_OFF)
 		return NULL;
@@ -98,13 +96,7 @@
 			 from_kuid(&init_user_ns, audit_info->loginuid),
 			 audit_info->sessionid);
 
-	if (audit_info->secid != 0 &&
-	    security_secid_to_secctx(audit_info->secid,
-				     &secctx,
-				     &secctx_len) == 0) {
-		audit_log_format(audit_buf, " subj=%s", secctx);
-		security_release_secctx(secctx, secctx_len);
-	}
+	audit_log_subject_context(audit_buf, &audit_info->blob);
 
 	return audit_buf;
 }
--- linux-qcom-6.8.0.orig/net/netlabel/netlabel_user.h
+++ linux-qcom-6.8.0/net/netlabel/netlabel_user.h
@@ -32,7 +32,7 @@
  */
 static inline void netlbl_netlink_auditinfo(struct netlbl_audit *audit_info)
 {
-	security_current_getsecid_subj(&audit_info->secid);
+	security_current_getlsmblob_subj(&audit_info->blob);
 	audit_info->loginuid = audit_get_loginuid(current);
 	audit_info->sessionid = audit_get_sessionid(current);
 }
--- linux-qcom-6.8.0.orig/net/netlink/af_netlink.c
+++ linux-qcom-6.8.0/net/netlink/af_netlink.c
@@ -130,7 +130,7 @@
 	"nlk_cb_mutex-MAX_LINKS"
 };
 
-static int netlink_dump(struct sock *sk);
+static int netlink_dump(struct sock *sk, bool lock_taken);
 
 /* nl_table locking explained:
  * Lookup and traversal are protected with an RCU read-side lock. Insertion
@@ -393,15 +393,6 @@
 
 static void netlink_sock_destruct(struct sock *sk)
 {
-	struct netlink_sock *nlk = nlk_sk(sk);
-
-	if (nlk->cb_running) {
-		if (nlk->cb.done)
-			nlk->cb.done(&nlk->cb);
-		module_put(nlk->cb.module);
-		kfree_skb(nlk->cb.skb);
-	}
-
 	skb_queue_purge(&sk->sk_receive_queue);
 
 	if (!sock_flag(sk, SOCK_DEAD)) {
@@ -414,14 +405,6 @@
 	WARN_ON(nlk_sk(sk)->groups);
 }
 
-static void netlink_sock_destruct_work(struct work_struct *work)
-{
-	struct netlink_sock *nlk = container_of(work, struct netlink_sock,
-						work);
-
-	sk_free(&nlk->sk);
-}
-
 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
  * SMP. Look, when several writers sleep and reader wakes them up, all but one
  * immediately hit write lock and grab all the cpus. Exclusive sleep solves
@@ -636,7 +619,7 @@
 };
 
 static int __netlink_create(struct net *net, struct socket *sock,
-			    struct mutex *cb_mutex, int protocol,
+			    struct mutex *dump_cb_mutex, int protocol,
 			    int kern)
 {
 	struct sock *sk;
@@ -651,15 +634,11 @@
 	sock_init_data(sock, sk);
 
 	nlk = nlk_sk(sk);
-	if (cb_mutex) {
-		nlk->cb_mutex = cb_mutex;
-	} else {
-		nlk->cb_mutex = &nlk->cb_def_mutex;
-		mutex_init(nlk->cb_mutex);
-		lockdep_set_class_and_name(nlk->cb_mutex,
+	mutex_init(&nlk->nl_cb_mutex);
+	lockdep_set_class_and_name(&nlk->nl_cb_mutex,
 					   nlk_cb_mutex_keys + protocol,
 					   nlk_cb_mutex_key_strings[protocol]);
-	}
+	nlk->dump_cb_mutex = dump_cb_mutex;
 	init_waitqueue_head(&nlk->wait);
 
 	sk->sk_destruct = netlink_sock_destruct;
@@ -739,12 +718,6 @@
 	if (!refcount_dec_and_test(&sk->sk_refcnt))
 		return;
 
-	if (nlk->cb_running && nlk->cb.done) {
-		INIT_WORK(&nlk->work, netlink_sock_destruct_work);
-		schedule_work(&nlk->work);
-		return;
-	}
-
 	sk_free(sk);
 }
 
@@ -796,6 +769,14 @@
 				NETLINK_URELEASE, &n);
 	}
 
+	/* Terminate any outstanding dump */
+	if (nlk->cb_running) {
+		if (nlk->cb.done)
+			nlk->cb.done(&nlk->cb);
+		module_put(nlk->cb.module);
+		kfree_skb(nlk->cb.skb);
+	}
+
 	module_put(nlk->module);
 
 	if (netlink_is_kernel(sk)) {
@@ -1987,7 +1968,7 @@
 
 	if (READ_ONCE(nlk->cb_running) &&
 	    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
-		ret = netlink_dump(sk);
+		ret = netlink_dump(sk, false);
 		if (ret) {
 			WRITE_ONCE(sk->sk_err, -ret);
 			sk_error_report(sk);
@@ -2145,8 +2126,9 @@
 {
 	struct sock *sk;
 	struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
+	struct hlist_node *tmp;
 
-	sk_for_each_bound(sk, &tbl->mc_list)
+	sk_for_each_bound_safe(sk, tmp, &tbl->mc_list)
 		netlink_update_socket_mc(nlk_sk(sk), group, 0);
 }
 
@@ -2196,7 +2178,7 @@
 	return 0;
 }
 
-static int netlink_dump(struct sock *sk)
+static int netlink_dump(struct sock *sk, bool lock_taken)
 {
 	struct netlink_sock *nlk = nlk_sk(sk);
 	struct netlink_ext_ack extack = {};
@@ -2208,7 +2190,8 @@
 	int alloc_min_size;
 	int alloc_size;
 
-	mutex_lock(nlk->cb_mutex);
+	if (!lock_taken)
+		mutex_lock(&nlk->nl_cb_mutex);
 	if (!nlk->cb_running) {
 		err = -EINVAL;
 		goto errout_skb;
@@ -2260,14 +2243,24 @@
 	netlink_skb_set_owner_r(skb, sk);
 
 	if (nlk->dump_done_errno > 0) {
+		struct mutex *extra_mutex = nlk->dump_cb_mutex;
+
 		cb->extack = &extack;
+
+		if (cb->flags & RTNL_FLAG_DUMP_UNLOCKED)
+			extra_mutex = NULL;
+		if (extra_mutex)
+			mutex_lock(extra_mutex);
 		nlk->dump_done_errno = cb->dump(skb, cb);
+		if (extra_mutex)
+			mutex_unlock(extra_mutex);
+
 		cb->extack = NULL;
 	}
 
 	if (nlk->dump_done_errno > 0 ||
 	    skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) {
-		mutex_unlock(nlk->cb_mutex);
+		mutex_unlock(&nlk->nl_cb_mutex);
 
 		if (sk_filter(sk, skb))
 			kfree_skb(skb);
@@ -2301,13 +2294,13 @@
 	WRITE_ONCE(nlk->cb_running, false);
 	module = cb->module;
 	skb = cb->skb;
-	mutex_unlock(nlk->cb_mutex);
+	mutex_unlock(&nlk->nl_cb_mutex);
 	module_put(module);
 	consume_skb(skb);
 	return 0;
 
 errout_skb:
-	mutex_unlock(nlk->cb_mutex);
+	mutex_unlock(&nlk->nl_cb_mutex);
 	kfree_skb(skb);
 	return err;
 }
@@ -2330,7 +2323,7 @@
 	}
 
 	nlk = nlk_sk(sk);
-	mutex_lock(nlk->cb_mutex);
+	mutex_lock(&nlk->nl_cb_mutex);
 	/* A dump is in progress... */
 	if (nlk->cb_running) {
 		ret = -EBUSY;
@@ -2350,6 +2343,7 @@
 	cb->data = control->data;
 	cb->module = control->module;
 	cb->min_dump_alloc = control->min_dump_alloc;
+	cb->flags = control->flags;
 	cb->skb = skb;
 
 	cb->strict_check = nlk_test_bit(STRICT_CHK, NETLINK_CB(skb).sk);
@@ -2365,9 +2359,7 @@
 	WRITE_ONCE(nlk->cb_running, true);
 	nlk->dump_done_errno = INT_MAX;
 
-	mutex_unlock(nlk->cb_mutex);
-
-	ret = netlink_dump(sk);
+	ret = netlink_dump(sk, true);
 
 	sock_put(sk);
 
@@ -2383,7 +2375,7 @@
 	module_put(control->module);
 error_unlock:
 	sock_put(sk);
-	mutex_unlock(nlk->cb_mutex);
+	mutex_unlock(&nlk->nl_cb_mutex);
 error_free:
 	kfree_skb(skb);
 	return ret;
--- linux-qcom-6.8.0.orig/net/netlink/af_netlink.h
+++ linux-qcom-6.8.0/net/netlink/af_netlink.h
@@ -4,7 +4,6 @@
 
 #include <linux/rhashtable.h>
 #include <linux/atomic.h>
-#include <linux/workqueue.h>
 #include <net/sock.h>
 
 /* flags */
@@ -39,8 +38,9 @@
 	bool			cb_running;
 	int			dump_done_errno;
 	struct netlink_callback	cb;
-	struct mutex		*cb_mutex;
-	struct mutex		cb_def_mutex;
+	struct mutex		nl_cb_mutex;
+
+	struct mutex		*dump_cb_mutex;
 	void			(*netlink_rcv)(struct sk_buff *skb);
 	int			(*netlink_bind)(struct net *net, int group);
 	void			(*netlink_unbind)(struct net *net, int group);
@@ -50,7 +50,6 @@
 
 	struct rhash_head	node;
 	struct rcu_head		rcu;
-	struct work_struct	work;
 };
 
 static inline struct netlink_sock *nlk_sk(struct sock *sk)
--- linux-qcom-6.8.0.orig/net/netlink/diag.c
+++ linux-qcom-6.8.0/net/netlink/diag.c
@@ -241,6 +241,7 @@
 }
 
 static const struct sock_diag_handler netlink_diag_handler = {
+	.owner = THIS_MODULE,
 	.family = AF_NETLINK,
 	.dump = netlink_diag_handler_dump,
 };
--- linux-qcom-6.8.0.orig/net/netlink/genetlink.c
+++ linux-qcom-6.8.0/net/netlink/genetlink.c
@@ -1497,15 +1497,11 @@
 	if (IS_ERR(msg))
 		return PTR_ERR(msg);
 
-	if (!family->netnsok) {
+	if (!family->netnsok)
 		genlmsg_multicast_netns(&genl_ctrl, &init_net, msg, 0,
 					0, GFP_KERNEL);
-	} else {
-		rcu_read_lock();
-		genlmsg_multicast_allns(&genl_ctrl, msg, 0,
-					0, GFP_ATOMIC);
-		rcu_read_unlock();
-	}
+	else
+		genlmsg_multicast_allns(&genl_ctrl, msg, 0, 0);
 
 	return 0;
 }
@@ -1895,23 +1891,23 @@
 
 core_initcall(genl_init);
 
-static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
-			 gfp_t flags)
+static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group)
 {
 	struct sk_buff *tmp;
 	struct net *net, *prev = NULL;
 	bool delivered = false;
 	int err;
 
+	rcu_read_lock();
 	for_each_net_rcu(net) {
 		if (prev) {
-			tmp = skb_clone(skb, flags);
+			tmp = skb_clone(skb, GFP_ATOMIC);
 			if (!tmp) {
 				err = -ENOMEM;
 				goto error;
 			}
 			err = nlmsg_multicast(prev->genl_sock, tmp,
-					      portid, group, flags);
+					      portid, group, GFP_ATOMIC);
 			if (!err)
 				delivered = true;
 			else if (err != -ESRCH)
@@ -1920,27 +1916,31 @@
 
 		prev = net;
 	}
+	err = nlmsg_multicast(prev->genl_sock, skb, portid, group, GFP_ATOMIC);
+
+	rcu_read_unlock();
 
-	err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags);
 	if (!err)
 		delivered = true;
 	else if (err != -ESRCH)
 		return err;
 	return delivered ? 0 : -ESRCH;
  error:
+	rcu_read_unlock();
+
 	kfree_skb(skb);
 	return err;
 }
 
 int genlmsg_multicast_allns(const struct genl_family *family,
 			    struct sk_buff *skb, u32 portid,
-			    unsigned int group, gfp_t flags)
+			    unsigned int group)
 {
 	if (WARN_ON_ONCE(group >= family->n_mcgrps))
 		return -EINVAL;
 
 	group = family->mcgrp_offset + group;
-	return genlmsg_mcast(skb, portid, group, flags);
+	return genlmsg_mcast(skb, portid, group);
 }
 EXPORT_SYMBOL(genlmsg_multicast_allns);
 
--- linux-qcom-6.8.0.orig/net/netrom/nr_route.c
+++ linux-qcom-6.8.0/net/netrom/nr_route.c
@@ -285,22 +285,14 @@
 	return 0;
 }
 
-static inline void __nr_remove_node(struct nr_node *nr_node)
+static void nr_remove_node_locked(struct nr_node *nr_node)
 {
+	lockdep_assert_held(&nr_node_list_lock);
+
 	hlist_del_init(&nr_node->node_node);
 	nr_node_put(nr_node);
 }
 
-#define nr_remove_node_locked(__node) \
-	__nr_remove_node(__node)
-
-static void nr_remove_node(struct nr_node *nr_node)
-{
-	spin_lock_bh(&nr_node_list_lock);
-	__nr_remove_node(nr_node);
-	spin_unlock_bh(&nr_node_list_lock);
-}
-
 static inline void __nr_remove_neigh(struct nr_neigh *nr_neigh)
 {
 	hlist_del_init(&nr_neigh->neigh_node);
@@ -339,6 +331,7 @@
 		return -EINVAL;
 	}
 
+	spin_lock_bh(&nr_node_list_lock);
 	nr_node_lock(nr_node);
 	for (i = 0; i < nr_node->count; i++) {
 		if (nr_node->routes[i].neighbour == nr_neigh) {
@@ -352,7 +345,7 @@
 			nr_node->count--;
 
 			if (nr_node->count == 0) {
-				nr_remove_node(nr_node);
+				nr_remove_node_locked(nr_node);
 			} else {
 				switch (i) {
 				case 0:
@@ -367,12 +360,14 @@
 				nr_node_put(nr_node);
 			}
 			nr_node_unlock(nr_node);
+			spin_unlock_bh(&nr_node_list_lock);
 
 			return 0;
 		}
 	}
 	nr_neigh_put(nr_neigh);
 	nr_node_unlock(nr_node);
+	spin_unlock_bh(&nr_node_list_lock);
 	nr_node_put(nr_node);
 
 	return -EINVAL;
@@ -759,6 +754,12 @@
 	int ret;
 	struct sk_buff *skbn;
 
+	/*
+	 * Reject malformed packets early. Check that it contains at least 2
+	 * addresses and 1 byte more for Time-To-Live
+	 */
+	if (skb->len < 2 * sizeof(ax25_address) + 1)
+		return 0;
 
 	nr_src  = (ax25_address *)(skb->data + 0);
 	nr_dest = (ax25_address *)(skb->data + 7);
--- linux-qcom-6.8.0.orig/net/netrom/nr_timer.c
+++ linux-qcom-6.8.0/net/netrom/nr_timer.c
@@ -121,7 +121,8 @@
 		   is accepted() it isn't 'dead' so doesn't get removed. */
 		if (sock_flag(sk, SOCK_DESTROY) ||
 		    (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) {
-			sock_hold(sk);
+			if (sk->sk_state == TCP_LISTEN)
+				sock_hold(sk);
 			bh_unlock_sock(sk);
 			nr_destroy_socket(sk);
 			goto out;
--- linux-qcom-6.8.0.orig/net/nfc/llcp_sock.c
+++ linux-qcom-6.8.0/net/nfc/llcp_sock.c
@@ -252,10 +252,10 @@
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt),
+					     optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt > LLCP_MAX_RW) {
 			err = -EINVAL;
@@ -274,10 +274,10 @@
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt),
+					     optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt > LLCP_MAX_MIUX) {
 			err = -EINVAL;
--- linux-qcom-6.8.0.orig/net/nfc/nci/core.c
+++ linux-qcom-6.8.0/net/nfc/nci/core.c
@@ -1463,6 +1463,19 @@
 				 ndev->ops->n_core_ops);
 }
 
+static bool nci_valid_size(struct sk_buff *skb)
+{
+	BUILD_BUG_ON(NCI_CTRL_HDR_SIZE != NCI_DATA_HDR_SIZE);
+	unsigned int hdr_size = NCI_CTRL_HDR_SIZE;
+
+	if (skb->len < hdr_size ||
+	    !nci_plen(skb->data) ||
+	    skb->len < hdr_size + nci_plen(skb->data)) {
+		return false;
+	}
+	return true;
+}
+
 /* ---- NCI TX Data worker thread ---- */
 
 static void nci_tx_work(struct work_struct *work)
@@ -1516,6 +1529,11 @@
 		nfc_send_to_raw_sock(ndev->nfc_dev, skb,
 				     RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
 
+		if (!nci_valid_size(skb)) {
+			kfree_skb(skb);
+			continue;
+		}
+
 		/* Process frame */
 		switch (nci_mt(skb->data)) {
 		case NCI_MT_RSP_PKT:
--- linux-qcom-6.8.0.orig/net/nsh/nsh.c
+++ linux-qcom-6.8.0/net/nsh/nsh.c
@@ -77,13 +77,15 @@
 static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
 				       netdev_features_t features)
 {
+	unsigned int outer_hlen, mac_len, nsh_len;
 	struct sk_buff *segs = ERR_PTR(-EINVAL);
 	u16 mac_offset = skb->mac_header;
-	unsigned int nsh_len, mac_len;
-	__be16 proto;
+	__be16 outer_proto, proto;
 
 	skb_reset_network_header(skb);
 
+	outer_proto = skb->protocol;
+	outer_hlen = skb_mac_header_len(skb);
 	mac_len = skb->mac_len;
 
 	if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN)))
@@ -113,10 +115,10 @@
 	}
 
 	for (skb = segs; skb; skb = skb->next) {
-		skb->protocol = htons(ETH_P_NSH);
-		__skb_push(skb, nsh_len);
-		skb->mac_header = mac_offset;
-		skb->network_header = skb->mac_header + mac_len;
+		skb->protocol = outer_proto;
+		__skb_push(skb, nsh_len + outer_hlen);
+		skb_reset_mac_header(skb);
+		skb_set_network_header(skb, outer_hlen);
 		skb->mac_len = mac_len;
 	}
 
--- linux-qcom-6.8.0.orig/net/openvswitch/actions.c
+++ linux-qcom-6.8.0/net/openvswitch/actions.c
@@ -925,7 +925,9 @@
 {
 	struct vport *vport = ovs_vport_rcu(dp, out_port);
 
-	if (likely(vport && netif_carrier_ok(vport->dev))) {
+	if (likely(vport &&
+		   netif_running(vport->dev) &&
+		   netif_carrier_ok(vport->dev))) {
 		u16 mru = OVS_CB(skb)->mru;
 		u32 cutlen = OVS_CB(skb)->cutlen;
 
@@ -936,6 +938,12 @@
 				pskb_trim(skb, ovs_mac_header_len(key));
 		}
 
+		/* Need to set the pkt_type to involve the routing layer.  The
+		 * packet movement through the OVS datapath doesn't generally
+		 * use routing, but this is needed for tunnel cases.
+		 */
+		skb->pkt_type = PACKET_OUTGOING;
+
 		if (likely(!mru ||
 		           (skb->len <= mru + vport->dev->hard_header_len))) {
 			ovs_vport_send(vport, skb, ovs_key_mac_proto(key));
--- linux-qcom-6.8.0.orig/net/openvswitch/conntrack.c
+++ linux-qcom-6.8.0/net/openvswitch/conntrack.c
@@ -168,8 +168,13 @@
 static void ovs_ct_get_labels(const struct nf_conn *ct,
 			      struct ovs_key_ct_labels *labels)
 {
-	struct nf_conn_labels *cl = ct ? nf_ct_labels_find(ct) : NULL;
+	struct nf_conn_labels *cl = NULL;
 
+	if (ct) {
+		if (ct->master && !nf_ct_is_confirmed(ct))
+			ct = ct->master;
+		cl = nf_ct_labels_find(ct);
+	}
 	if (cl)
 		memcpy(labels, cl->bits, OVS_CT_LABELS_LEN);
 	else
@@ -1380,8 +1385,9 @@
 	if (ct_info.timeout[0]) {
 		if (nf_ct_set_timeout(net, ct_info.ct, family, key->ip.proto,
 				      ct_info.timeout))
-			pr_info_ratelimited("Failed to associated timeout "
-					    "policy `%s'\n", ct_info.timeout);
+			OVS_NLERR(log,
+				  "Failed to associated timeout policy '%s'",
+				  ct_info.timeout);
 		else
 			ct_info.nf_ct_timeout = rcu_dereference(
 				nf_ct_timeout_find(ct_info.ct)->timeout);
@@ -1592,9 +1598,9 @@
 	for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
 		struct hlist_head *head = &info->limits[i];
 		struct ovs_ct_limit *ct_limit;
+		struct hlist_node *next;
 
-		hlist_for_each_entry_rcu(ct_limit, head, hlist_node,
-					 lockdep_ovsl_is_held())
+		hlist_for_each_entry_safe(ct_limit, next, head, hlist_node)
 			kfree_rcu(ct_limit, rcu);
 	}
 	kfree(info->limits);
--- linux-qcom-6.8.0.orig/net/openvswitch/datapath.c
+++ linux-qcom-6.8.0/net/openvswitch/datapath.c
@@ -2707,7 +2707,7 @@
 };
 
 static const char * const ovs_drop_reasons[] = {
-#define S(x)	(#x),
+#define S(x) [(x) & ~SKB_DROP_REASON_SUBSYS_MASK] = (#x),
 	OVS_DROP_REASONS(S)
 #undef S
 };
--- linux-qcom-6.8.0.orig/net/openvswitch/flow.c
+++ linux-qcom-6.8.0/net/openvswitch/flow.c
@@ -561,7 +561,6 @@
 	 */
 	key->tp.src = htons(icmp->icmp6_type);
 	key->tp.dst = htons(icmp->icmp6_code);
-	memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd));
 
 	if (icmp->icmp6_code == 0 &&
 	    (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION ||
@@ -570,6 +569,8 @@
 		struct nd_msg *nd;
 		int offset;
 
+		memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd));
+
 		/* In order to process neighbor discovery options, we need the
 		 * entire packet.
 		 */
--- linux-qcom-6.8.0.orig/net/packet/af_packet.c
+++ linux-qcom-6.8.0/net/packet/af_packet.c
@@ -538,6 +538,47 @@
 	return packet_lookup_frame(po, rb, rb->head, status);
 }
 
+static u16 vlan_get_tci(const struct sk_buff *skb, struct net_device *dev)
+{
+	struct vlan_hdr vhdr, *vh;
+	unsigned int header_len;
+
+	if (!dev)
+		return 0;
+
+	/* In the SOCK_DGRAM scenario, skb data starts at the network
+	 * protocol, which is after the VLAN headers. The outer VLAN
+	 * header is at the hard_header_len offset in non-variable
+	 * length link layer headers. If it's a VLAN device, the
+	 * min_header_len should be used to exclude the VLAN header
+	 * size.
+	 */
+	if (dev->min_header_len == dev->hard_header_len)
+		header_len = dev->hard_header_len;
+	else if (is_vlan_dev(dev))
+		header_len = dev->min_header_len;
+	else
+		return 0;
+
+	vh = skb_header_pointer(skb, skb_mac_offset(skb) + header_len,
+				sizeof(vhdr), &vhdr);
+	if (unlikely(!vh))
+		return 0;
+
+	return ntohs(vh->h_vlan_TCI);
+}
+
+static __be16 vlan_get_protocol_dgram(const struct sk_buff *skb)
+{
+	__be16 proto = skb->protocol;
+
+	if (unlikely(eth_type_vlan(proto)))
+		proto = __vlan_get_protocol_offset(skb, proto,
+						   skb_mac_offset(skb), NULL);
+
+	return proto;
+}
+
 static void prb_del_retire_blk_timer(struct tpacket_kbdq_core *pkc)
 {
 	del_timer_sync(&pkc->retire_blk_timer);
@@ -1007,10 +1048,16 @@
 static void prb_fill_vlan_info(struct tpacket_kbdq_core *pkc,
 			struct tpacket3_hdr *ppd)
 {
+	struct packet_sock *po = container_of(pkc, struct packet_sock, rx_ring.prb_bdqc);
+
 	if (skb_vlan_tag_present(pkc->skb)) {
 		ppd->hv1.tp_vlan_tci = skb_vlan_tag_get(pkc->skb);
 		ppd->hv1.tp_vlan_tpid = ntohs(pkc->skb->vlan_proto);
 		ppd->tp_status = TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID;
+	} else if (unlikely(po->sk.sk_type == SOCK_DGRAM && eth_type_vlan(pkc->skb->protocol))) {
+		ppd->hv1.tp_vlan_tci = vlan_get_tci(pkc->skb, pkc->skb->dev);
+		ppd->hv1.tp_vlan_tpid = ntohs(pkc->skb->protocol);
+		ppd->tp_status = TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID;
 	} else {
 		ppd->hv1.tp_vlan_tci = 0;
 		ppd->hv1.tp_vlan_tpid = 0;
@@ -2056,8 +2103,7 @@
 	skb->dev = dev;
 	skb->priority = READ_ONCE(sk->sk_priority);
 	skb->mark = READ_ONCE(sk->sk_mark);
-	skb->tstamp = sockc.transmit_time;
-
+	skb_set_delivery_type_by_clockid(skb, sockc.transmit_time, sk->sk_clockid);
 	skb_setup_tx_timestamp(skb, sockc.tsflags);
 
 	if (unlikely(extra_len == 4))
@@ -2428,6 +2474,10 @@
 			h.h2->tp_vlan_tci = skb_vlan_tag_get(skb);
 			h.h2->tp_vlan_tpid = ntohs(skb->vlan_proto);
 			status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID;
+		} else if (unlikely(sk->sk_type == SOCK_DGRAM && eth_type_vlan(skb->protocol))) {
+			h.h2->tp_vlan_tci = vlan_get_tci(skb, skb->dev);
+			h.h2->tp_vlan_tpid = ntohs(skb->protocol);
+			status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID;
 		} else {
 			h.h2->tp_vlan_tci = 0;
 			h.h2->tp_vlan_tpid = 0;
@@ -2457,7 +2507,8 @@
 	sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
 	sll->sll_family = AF_PACKET;
 	sll->sll_hatype = dev->type;
-	sll->sll_protocol = skb->protocol;
+	sll->sll_protocol = (sk->sk_type == SOCK_DGRAM) ?
+		vlan_get_protocol_dgram(skb) : skb->protocol;
 	sll->sll_pkttype = skb->pkt_type;
 	if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
 		sll->sll_ifindex = orig_dev->ifindex;
@@ -2522,8 +2573,7 @@
 		ts = __packet_set_timestamp(po, ph, skb);
 		__packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts);
 
-		if (!packet_read_pending(&po->tx_ring))
-			complete(&po->skb_completion);
+		complete(&po->skb_completion);
 	}
 
 	sock_wfree(skb);
@@ -2585,7 +2635,7 @@
 	skb->dev = dev;
 	skb->priority = READ_ONCE(po->sk.sk_priority);
 	skb->mark = READ_ONCE(po->sk.sk_mark);
-	skb->tstamp = sockc->transmit_time;
+	skb_set_delivery_type_by_clockid(skb, sockc->transmit_time, po->sk.sk_clockid);
 	skb_setup_tx_timestamp(skb, sockc->tsflags);
 	skb_zcopy_set_nouarg(skb, ph.raw);
 
@@ -3063,7 +3113,7 @@
 	skb->dev = dev;
 	skb->priority = READ_ONCE(sk->sk_priority);
 	skb->mark = sockc.mark;
-	skb->tstamp = sockc.transmit_time;
+	skb_set_delivery_type_by_clockid(skb, sockc.transmit_time, sk->sk_clockid);
 
 	if (unlikely(extra_len == 4))
 		skb->no_fcs = 1;
@@ -3357,17 +3407,17 @@
 	if (sock->type == SOCK_PACKET)
 		sock->ops = &packet_ops_spkt;
 
+	po = pkt_sk(sk);
+	err = packet_alloc_pending(po);
+	if (err)
+		goto out_sk_free;
+
 	sock_init_data(sock, sk);
 
-	po = pkt_sk(sk);
 	init_completion(&po->skb_completion);
 	sk->sk_family = PF_PACKET;
 	po->num = proto;
 
-	err = packet_alloc_pending(po);
-	if (err)
-		goto out2;
-
 	packet_cached_dev_reset(po);
 
 	sk->sk_destruct = packet_sock_destruct;
@@ -3399,7 +3449,7 @@
 	sock_prot_inuse_add(net, &packet_proto, 1);
 
 	return 0;
-out2:
+out_sk_free:
 	sk_free(sk);
 out:
 	return err;
@@ -3483,7 +3533,8 @@
 		/* Original length was stored in sockaddr_ll fields */
 		origlen = PACKET_SKB_CB(skb)->sa.origlen;
 		sll->sll_family = AF_PACKET;
-		sll->sll_protocol = skb->protocol;
+		sll->sll_protocol = (sock->type == SOCK_DGRAM) ?
+			vlan_get_protocol_dgram(skb) : skb->protocol;
 	}
 
 	sock_recv_cmsgs(msg, sk, skb);
@@ -3540,6 +3591,21 @@
 			aux.tp_vlan_tci = skb_vlan_tag_get(skb);
 			aux.tp_vlan_tpid = ntohs(skb->vlan_proto);
 			aux.tp_status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID;
+		} else if (unlikely(sock->type == SOCK_DGRAM && eth_type_vlan(skb->protocol))) {
+			struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+			struct net_device *dev;
+
+			rcu_read_lock();
+			dev = dev_get_by_index_rcu(sock_net(sk), sll->sll_ifindex);
+			if (dev) {
+				aux.tp_vlan_tci = vlan_get_tci(skb, dev);
+				aux.tp_vlan_tpid = ntohs(skb->protocol);
+				aux.tp_status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID;
+			} else {
+				aux.tp_vlan_tci = 0;
+				aux.tp_vlan_tpid = 0;
+			}
+			rcu_read_unlock();
 		} else {
 			aux.tp_vlan_tci = 0;
 			aux.tp_vlan_tpid = 0;
@@ -3800,28 +3866,30 @@
 	case PACKET_TX_RING:
 	{
 		union tpacket_req_u req_u;
-		int len;
 
+		ret = -EINVAL;
 		lock_sock(sk);
 		switch (po->tp_version) {
 		case TPACKET_V1:
 		case TPACKET_V2:
-			len = sizeof(req_u.req);
+			if (optlen < sizeof(req_u.req))
+				break;
+			ret = copy_from_sockptr(&req_u.req, optval,
+						sizeof(req_u.req)) ?
+						-EINVAL : 0;
 			break;
 		case TPACKET_V3:
 		default:
-			len = sizeof(req_u.req3);
+			if (optlen < sizeof(req_u.req3))
+				break;
+			ret = copy_from_sockptr(&req_u.req3, optval,
+						sizeof(req_u.req3)) ?
+						-EINVAL : 0;
 			break;
 		}
-		if (optlen < len) {
-			ret = -EINVAL;
-		} else {
-			if (copy_from_sockptr(&req_u.req, optval, len))
-				ret = -EFAULT;
-			else
-				ret = packet_set_ring(sk, &req_u, 0,
-						    optname == PACKET_TX_RING);
-		}
+		if (!ret)
+			ret = packet_set_ring(sk, &req_u, 0,
+					      optname == PACKET_TX_RING);
 		release_sock(sk);
 		return ret;
 	}
@@ -3998,7 +4066,7 @@
 		if (val < 0 || val > 1)
 			return -EINVAL;
 
-		po->prot_hook.ignore_outgoing = !!val;
+		WRITE_ONCE(po->prot_hook.ignore_outgoing, !!val);
 		return 0;
 	}
 	case PACKET_TX_HAS_OFF:
@@ -4129,7 +4197,7 @@
 		       0);
 		break;
 	case PACKET_IGNORE_OUTGOING:
-		val = po->prot_hook.ignore_outgoing;
+		val = READ_ONCE(po->prot_hook.ignore_outgoing);
 		break;
 	case PACKET_ROLLOVER_STATS:
 		if (!po->rollover)
--- linux-qcom-6.8.0.orig/net/packet/diag.c
+++ linux-qcom-6.8.0/net/packet/diag.c
@@ -245,6 +245,7 @@
 }
 
 static const struct sock_diag_handler packet_diag_handler = {
+	.owner = THIS_MODULE,
 	.family = AF_PACKET,
 	.dump = packet_diag_handler_dump,
 };
--- linux-qcom-6.8.0.orig/net/phonet/pn_netlink.c
+++ linux-qcom-6.8.0/net/phonet/pn_netlink.c
@@ -178,7 +178,7 @@
 	rtm->rtm_type = RTN_UNICAST;
 	rtm->rtm_flags = 0;
 	if (nla_put_u8(skb, RTA_DST, dst) ||
-	    nla_put_u32(skb, RTA_OIF, dev->ifindex))
+	    nla_put_u32(skb, RTA_OIF, READ_ONCE(dev->ifindex)))
 		goto nla_put_failure;
 	nlmsg_end(skb, nlh);
 	return 0;
@@ -193,7 +193,7 @@
 	struct sk_buff *skb;
 	int err = -ENOBUFS;
 
-	skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct ifaddrmsg)) +
+	skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct rtmsg)) +
 			nla_total_size(1) + nla_total_size(4), GFP_KERNEL);
 	if (skb == NULL)
 		goto errout;
@@ -263,6 +263,7 @@
 static int route_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	struct net *net = sock_net(skb->sk);
+	int err = 0;
 	u8 addr;
 
 	rcu_read_lock();
@@ -272,35 +273,29 @@
 		if (!dev)
 			continue;
 
-		if (fill_route(skb, dev, addr << 2, NETLINK_CB(cb->skb).portid,
-			       cb->nlh->nlmsg_seq, RTM_NEWROUTE) < 0)
-			goto out;
+		err = fill_route(skb, dev, addr << 2,
+				 NETLINK_CB(cb->skb).portid,
+				 cb->nlh->nlmsg_seq, RTM_NEWROUTE);
+		if (err < 0)
+			break;
 	}
-
-out:
 	rcu_read_unlock();
 	cb->args[0] = addr;
 
-	return skb->len;
+	return err;
 }
 
+static const struct rtnl_msg_handler phonet_rtnl_msg_handlers[] __initdata_or_module = {
+	{THIS_MODULE, PF_PHONET, RTM_NEWADDR, addr_doit, NULL, 0},
+	{THIS_MODULE, PF_PHONET, RTM_DELADDR, addr_doit, NULL, 0},
+	{THIS_MODULE, PF_PHONET, RTM_GETADDR, NULL, getaddr_dumpit, 0},
+	{THIS_MODULE, PF_PHONET, RTM_NEWROUTE, route_doit, NULL, 0},
+	{THIS_MODULE, PF_PHONET, RTM_DELROUTE, route_doit, NULL, 0},
+	{THIS_MODULE, PF_PHONET, RTM_GETROUTE, NULL, route_dumpit,
+	 RTNL_FLAG_DUMP_UNLOCKED},
+};
+
 int __init phonet_netlink_register(void)
 {
-	int err = rtnl_register_module(THIS_MODULE, PF_PHONET, RTM_NEWADDR,
-				       addr_doit, NULL, 0);
-	if (err)
-		return err;
-
-	/* Further rtnl_register_module() cannot fail */
-	rtnl_register_module(THIS_MODULE, PF_PHONET, RTM_DELADDR,
-			     addr_doit, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_PHONET, RTM_GETADDR,
-			     NULL, getaddr_dumpit, 0);
-	rtnl_register_module(THIS_MODULE, PF_PHONET, RTM_NEWROUTE,
-			     route_doit, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_PHONET, RTM_DELROUTE,
-			     route_doit, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_PHONET, RTM_GETROUTE,
-			     NULL, route_dumpit, 0);
-	return 0;
+	return rtnl_register_many(phonet_rtnl_msg_handlers);
 }
--- linux-qcom-6.8.0.orig/net/qrtr/af_qrtr.c
+++ linux-qcom-6.8.0/net/qrtr/af_qrtr.c
@@ -884,7 +884,7 @@
 
 	mutex_lock(&qrtr_node_lock);
 	list_for_each_entry(node, &qrtr_all_nodes, item) {
-		skbn = skb_clone(skb, GFP_KERNEL);
+		skbn = pskb_copy(skb, GFP_KERNEL);
 		if (!skbn)
 			break;
 		skb_set_owner_w(skbn, skb->sk);
--- linux-qcom-6.8.0.orig/net/qrtr/mhi.c
+++ linux-qcom-6.8.0/net/qrtr/mhi.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/mhi.h>
@@ -15,6 +16,7 @@
 	struct qrtr_endpoint ep;
 	struct mhi_device *mhi_dev;
 	struct device *dev;
+	struct completion prepared;
 };
 
 /* From MHI to QRTR */
@@ -53,6 +55,10 @@
 	if (skb->sk)
 		sock_hold(skb->sk);
 
+	rc = wait_for_completion_interruptible(&qdev->prepared);
+	if (rc)
+		goto free_skb;
+
 	rc = skb_linearize(skb);
 	if (rc)
 		goto free_skb;
@@ -85,6 +91,7 @@
 	qdev->mhi_dev = mhi_dev;
 	qdev->dev = &mhi_dev->dev;
 	qdev->ep.xmit = qcom_mhi_qrtr_send;
+	init_completion(&qdev->prepared);
 
 	dev_set_drvdata(&mhi_dev->dev, qdev);
 	rc = qrtr_endpoint_register(&qdev->ep, QRTR_EP_NID_AUTO);
@@ -97,6 +104,7 @@
 		qrtr_endpoint_unregister(&qdev->ep);
 		return rc;
 	}
+	complete_all(&qdev->prepared);
 
 	dev_dbg(qdev->dev, "Qualcomm MHI QRTR driver probed\n");
 
--- linux-qcom-6.8.0.orig/net/qrtr/ns.c
+++ linux-qcom-6.8.0/net/qrtr/ns.c
@@ -725,6 +725,24 @@
 	if (ret < 0)
 		goto err_wq;
 
+	/* As the qrtr ns socket owner and creator is the same module, we have
+	 * to decrease the qrtr module reference count to guarantee that it
+	 * remains zero after the ns socket is created, otherwise, executing
+	 * "rmmod" command is unable to make the qrtr module deleted after the
+	 *  qrtr module is inserted successfully.
+	 *
+	 * However, the reference count is increased twice in
+	 * sock_create_kern(): one is to increase the reference count of owner
+	 * of qrtr socket's proto_ops struct; another is to increment the
+	 * reference count of owner of qrtr proto struct. Therefore, we must
+	 * decrement the module reference count twice to ensure that it keeps
+	 * zero after server's listening socket is created. Of course, we
+	 * must bump the module reference count twice as well before the socket
+	 * is closed.
+	 */
+	module_put(qrtr_ns.sock->ops->owner);
+	module_put(qrtr_ns.sock->sk->sk_prot_creator->owner);
+
 	return 0;
 
 err_wq:
@@ -739,6 +757,15 @@
 {
 	cancel_work_sync(&qrtr_ns.work);
 	destroy_workqueue(qrtr_ns.workqueue);
+
+	/* sock_release() expects the two references that were put during
+	 * qrtr_ns_init(). This function is only called during module remove,
+	 * so try_stop_module() has already set the refcnt to 0. Use
+	 * __module_get() instead of try_module_get() to successfully take two
+	 * references.
+	 */
+	__module_get(qrtr_ns.sock->ops->owner);
+	__module_get(qrtr_ns.sock->sk->sk_prot_creator->owner);
 	sock_release(qrtr_ns.sock);
 }
 EXPORT_SYMBOL_GPL(qrtr_ns_remove);
--- linux-qcom-6.8.0.orig/net/rds/ib_send.c
+++ linux-qcom-6.8.0/net/rds/ib_send.c
@@ -503,7 +503,7 @@
 	int flow_controlled = 0;
 	int nr_sig = 0;
 
-	BUG_ON(off % RDS_FRAG_SIZE);
+	BUG_ON(!conn->c_loopback && off % RDS_FRAG_SIZE);
 	BUG_ON(hdr_off != 0 && hdr_off != sizeof(struct rds_header));
 
 	/* Do not send cong updates to IB loopback */
--- linux-qcom-6.8.0.orig/net/rds/rdma.c
+++ linux-qcom-6.8.0/net/rds/rdma.c
@@ -302,7 +302,7 @@
 		}
 		ret = PTR_ERR(trans_private);
 		/* Trigger connection so that its ready for the next retry */
-		if (ret == -ENODEV)
+		if (ret == -ENODEV && cp)
 			rds_conn_connect_if_down(cp->cp_conn);
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/net/rds/send.c
+++ linux-qcom-6.8.0/net/rds/send.c
@@ -103,13 +103,12 @@
 
 static int acquire_in_xmit(struct rds_conn_path *cp)
 {
-	return test_and_set_bit(RDS_IN_XMIT, &cp->cp_flags) == 0;
+	return test_and_set_bit_lock(RDS_IN_XMIT, &cp->cp_flags) == 0;
 }
 
 static void release_in_xmit(struct rds_conn_path *cp)
 {
-	clear_bit(RDS_IN_XMIT, &cp->cp_flags);
-	smp_mb__after_atomic();
+	clear_bit_unlock(RDS_IN_XMIT, &cp->cp_flags);
 	/*
 	 * We don't use wait_on_bit()/wake_up_bit() because our waking is in a
 	 * hot path and finding waiters is very rare.  We don't want to walk
--- linux-qcom-6.8.0.orig/net/rds/tcp.c
+++ linux-qcom-6.8.0/net/rds/tcp.c
@@ -61,8 +61,10 @@
 
 static struct kmem_cache *rds_tcp_conn_slab;
 
-static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write,
-				 void *buffer, size_t *lenp, loff_t *fpos);
+static int rds_tcp_sndbuf_handler(struct ctl_table *ctl, int write,
+				  void *buffer, size_t *lenp, loff_t *fpos);
+static int rds_tcp_rcvbuf_handler(struct ctl_table *ctl, int write,
+				  void *buffer, size_t *lenp, loff_t *fpos);
 
 static int rds_tcp_min_sndbuf = SOCK_MIN_SNDBUF;
 static int rds_tcp_min_rcvbuf = SOCK_MIN_RCVBUF;
@@ -74,7 +76,7 @@
 		/* data is per-net pointer */
 		.maxlen         = sizeof(int),
 		.mode           = 0644,
-		.proc_handler   = rds_tcp_skbuf_handler,
+		.proc_handler   = rds_tcp_sndbuf_handler,
 		.extra1		= &rds_tcp_min_sndbuf,
 	},
 #define	RDS_TCP_RCVBUF	1
@@ -83,7 +85,7 @@
 		/* data is per-net pointer */
 		.maxlen         = sizeof(int),
 		.mode           = 0644,
-		.proc_handler   = rds_tcp_skbuf_handler,
+		.proc_handler   = rds_tcp_rcvbuf_handler,
 		.extra1		= &rds_tcp_min_rcvbuf,
 	},
 	{ }
@@ -683,10 +685,10 @@
 	spin_unlock_irq(&rds_tcp_conn_lock);
 }
 
-static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write,
+static int rds_tcp_skbuf_handler(struct rds_tcp_net *rtn,
+				 struct ctl_table *ctl, int write,
 				 void *buffer, size_t *lenp, loff_t *fpos)
 {
-	struct net *net = current->nsproxy->net_ns;
 	int err;
 
 	err = proc_dointvec_minmax(ctl, write, buffer, lenp, fpos);
@@ -695,11 +697,34 @@
 			*(int *)(ctl->extra1));
 		return err;
 	}
-	if (write)
+
+	if (write && rtn->rds_tcp_listen_sock && rtn->rds_tcp_listen_sock->sk) {
+		struct net *net = sock_net(rtn->rds_tcp_listen_sock->sk);
+
 		rds_tcp_sysctl_reset(net);
+	}
+
 	return 0;
 }
 
+static int rds_tcp_sndbuf_handler(struct ctl_table *ctl, int write,
+				  void *buffer, size_t *lenp, loff_t *fpos)
+{
+	struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net,
+					       sndbuf_size);
+
+	return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos);
+}
+
+static int rds_tcp_rcvbuf_handler(struct ctl_table *ctl, int write,
+				  void *buffer, size_t *lenp, loff_t *fpos)
+{
+	struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net,
+					       rcvbuf_size);
+
+	return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos);
+}
+
 static void rds_tcp_exit(void)
 {
 	rds_tcp_set_unloading();
--- linux-qcom-6.8.0.orig/net/rfkill/core.c
+++ linux-qcom-6.8.0/net/rfkill/core.c
@@ -79,7 +79,6 @@
 	struct mutex		mtx;
 	wait_queue_head_t	read_wait;
 	bool			input_handler;
-	u8			max_size;
 };
 
 
@@ -1173,8 +1172,6 @@
 	if (!data)
 		return -ENOMEM;
 
-	data->max_size = RFKILL_EVENT_SIZE_V1;
-
 	INIT_LIST_HEAD(&data->events);
 	mutex_init(&data->mtx);
 	init_waitqueue_head(&data->read_wait);
@@ -1257,7 +1254,6 @@
 				list);
 
 	sz = min_t(unsigned long, sizeof(ev->ev), count);
-	sz = min_t(unsigned long, sz, data->max_size);
 	ret = sz;
 	if (copy_to_user(buf, &ev->ev, sz))
 		ret = -EFAULT;
@@ -1272,7 +1268,6 @@
 static ssize_t rfkill_fop_write(struct file *file, const char __user *buf,
 				size_t count, loff_t *pos)
 {
-	struct rfkill_data *data = file->private_data;
 	struct rfkill *rfkill;
 	struct rfkill_event_ext ev;
 	int ret;
@@ -1287,7 +1282,6 @@
 	 * our API version even in a write() call, if it cares.
 	 */
 	count = min(count, sizeof(ev));
-	count = min_t(size_t, count, data->max_size);
 	if (copy_from_user(&ev, buf, count))
 		return -EFAULT;
 
@@ -1347,47 +1341,31 @@
 	return 0;
 }
 
+#ifdef CONFIG_RFKILL_INPUT
 static long rfkill_fop_ioctl(struct file *file, unsigned int cmd,
 			     unsigned long arg)
 {
 	struct rfkill_data *data = file->private_data;
-	int ret = -ENOTTY;
-	u32 size;
 
 	if (_IOC_TYPE(cmd) != RFKILL_IOC_MAGIC)
 		return -ENOTTY;
 
+	if (_IOC_NR(cmd) != RFKILL_IOC_NOINPUT)
+		return -ENOSYS;
+
 	mutex_lock(&data->mtx);
-	switch (_IOC_NR(cmd)) {
-#ifdef CONFIG_RFKILL_INPUT
-	case RFKILL_IOC_NOINPUT:
-		if (!data->input_handler) {
-			if (atomic_inc_return(&rfkill_input_disabled) == 1)
-				printk(KERN_DEBUG "rfkill: input handler disabled\n");
-			data->input_handler = true;
-		}
-		ret = 0;
-		break;
-#endif
-	case RFKILL_IOC_MAX_SIZE:
-		if (get_user(size, (__u32 __user *)arg)) {
-			ret = -EFAULT;
-			break;
-		}
-		if (size < RFKILL_EVENT_SIZE_V1 || size > U8_MAX) {
-			ret = -EINVAL;
-			break;
-		}
-		data->max_size = size;
-		ret = 0;
-		break;
-	default:
-		break;
+
+	if (!data->input_handler) {
+		if (atomic_inc_return(&rfkill_input_disabled) == 1)
+			printk(KERN_DEBUG "rfkill: input handler disabled\n");
+		data->input_handler = true;
 	}
+
 	mutex_unlock(&data->mtx);
 
-	return ret;
+	return 0;
 }
+#endif
 
 static const struct file_operations rfkill_fops = {
 	.owner		= THIS_MODULE,
@@ -1396,8 +1374,10 @@
 	.write		= rfkill_fop_write,
 	.poll		= rfkill_fop_poll,
 	.release	= rfkill_fop_release,
+#ifdef CONFIG_RFKILL_INPUT
 	.unlocked_ioctl	= rfkill_fop_ioctl,
 	.compat_ioctl	= compat_ptr_ioctl,
+#endif
 	.llseek		= no_llseek,
 };
 
--- linux-qcom-6.8.0.orig/net/rfkill/rfkill-gpio.c
+++ linux-qcom-6.8.0/net/rfkill/rfkill-gpio.c
@@ -31,8 +31,12 @@
 {
 	struct rfkill_gpio_data *rfkill = data;
 
-	if (!blocked && !IS_ERR(rfkill->clk) && !rfkill->clk_enabled)
-		clk_enable(rfkill->clk);
+	if (!blocked && !IS_ERR(rfkill->clk) && !rfkill->clk_enabled) {
+		int ret = clk_enable(rfkill->clk);
+
+		if (ret)
+			return ret;
+	}
 
 	gpiod_set_value_cansleep(rfkill->shutdown_gpio, !blocked);
 	gpiod_set_value_cansleep(rfkill->reset_gpio, !blocked);
--- linux-qcom-6.8.0.orig/net/rxrpc/af_rxrpc.c
+++ linux-qcom-6.8.0/net/rxrpc/af_rxrpc.c
@@ -707,9 +707,10 @@
 			ret = -EISCONN;
 			if (rx->sk.sk_state != RXRPC_UNBOUND)
 				goto error;
-			ret = copy_from_sockptr(&min_sec_level, optval,
-				       sizeof(unsigned int));
-			if (ret < 0)
+			ret = copy_safe_from_sockptr(&min_sec_level,
+						     sizeof(min_sec_level),
+						     optval, optlen);
+			if (ret)
 				goto error;
 			ret = -EINVAL;
 			if (min_sec_level > RXRPC_SECURITY_MAX)
--- linux-qcom-6.8.0.orig/net/rxrpc/ar-internal.h
+++ linux-qcom-6.8.0/net/rxrpc/ar-internal.h
@@ -692,7 +692,7 @@
 	 * packets) rather than bytes.
 	 */
 #define RXRPC_TX_SMSS		RXRPC_JUMBO_DATALEN
-#define RXRPC_MIN_CWND		(RXRPC_TX_SMSS > 2190 ? 2 : RXRPC_TX_SMSS > 1095 ? 3 : 4)
+#define RXRPC_MIN_CWND		4
 	u8			cong_cwnd;	/* Congestion window size */
 	u8			cong_extra;	/* Extra to send for congestion management */
 	u8			cong_ssthresh;	/* Slow-start threshold */
@@ -1069,7 +1069,7 @@
 int rxrpc_io_thread(void *data);
 static inline void rxrpc_wake_up_io_thread(struct rxrpc_local *local)
 {
-	wake_up_process(local->io_thread);
+	wake_up_process(READ_ONCE(local->io_thread));
 }
 
 static inline bool rxrpc_protocol_error(struct sk_buff *skb, enum rxrpc_abort_reason why)
--- linux-qcom-6.8.0.orig/net/rxrpc/call_object.c
+++ linux-qcom-6.8.0/net/rxrpc/call_object.c
@@ -175,12 +175,7 @@
 	call->rx_winsize = rxrpc_rx_window_size;
 	call->tx_winsize = 16;
 
-	if (RXRPC_TX_SMSS > 2190)
-		call->cong_cwnd = 2;
-	else if (RXRPC_TX_SMSS > 1095)
-		call->cong_cwnd = 3;
-	else
-		call->cong_cwnd = 4;
+	call->cong_cwnd = RXRPC_MIN_CWND;
 	call->cong_ssthresh = RXRPC_TX_MAX_WINDOW;
 
 	call->rxnet = rxnet;
--- linux-qcom-6.8.0.orig/net/rxrpc/conn_client.c
+++ linux-qcom-6.8.0/net/rxrpc/conn_client.c
@@ -516,6 +516,7 @@
 
 		spin_lock(&local->client_call_lock);
 		list_move_tail(&call->wait_link, &bundle->waiting_calls);
+		rxrpc_see_call(call, rxrpc_call_see_waiting_call);
 		spin_unlock(&local->client_call_lock);
 
 		if (rxrpc_bundle_has_space(bundle))
@@ -586,7 +587,10 @@
 		_debug("call is waiting");
 		ASSERTCMP(call->call_id, ==, 0);
 		ASSERT(!test_bit(RXRPC_CALL_EXPOSED, &call->flags));
+		/* May still be on ->new_client_calls. */
+		spin_lock(&local->client_call_lock);
 		list_del_init(&call->wait_link);
+		spin_unlock(&local->client_call_lock);
 		return;
 	}
 
--- linux-qcom-6.8.0.orig/net/rxrpc/conn_event.c
+++ linux-qcom-6.8.0/net/rxrpc/conn_event.c
@@ -88,7 +88,7 @@
 			struct rxrpc_ackpacket ack;
 		};
 	} __attribute__((packed)) pkt;
-	struct rxrpc_ackinfo ack_info;
+	struct rxrpc_acktrailer trailer;
 	size_t len;
 	int ret, ioc;
 	u32 serial, mtu, call_id, padding;
@@ -122,8 +122,8 @@
 	iov[0].iov_len	= sizeof(pkt.whdr);
 	iov[1].iov_base	= &padding;
 	iov[1].iov_len	= 3;
-	iov[2].iov_base	= &ack_info;
-	iov[2].iov_len	= sizeof(ack_info);
+	iov[2].iov_base	= &trailer;
+	iov[2].iov_len	= sizeof(trailer);
 
 	serial = rxrpc_get_next_serial(conn);
 
@@ -158,14 +158,14 @@
 		pkt.ack.serial		= htonl(skb ? sp->hdr.serial : 0);
 		pkt.ack.reason		= skb ? RXRPC_ACK_DUPLICATE : RXRPC_ACK_IDLE;
 		pkt.ack.nAcks		= 0;
-		ack_info.rxMTU		= htonl(rxrpc_rx_mtu);
-		ack_info.maxMTU		= htonl(mtu);
-		ack_info.rwind		= htonl(rxrpc_rx_window_size);
-		ack_info.jumbo_max	= htonl(rxrpc_rx_jumbo_max);
+		trailer.maxMTU		= htonl(rxrpc_rx_mtu);
+		trailer.ifMTU		= htonl(mtu);
+		trailer.rwind		= htonl(rxrpc_rx_window_size);
+		trailer.jumbo_max	= htonl(rxrpc_rx_jumbo_max);
 		pkt.whdr.flags		|= RXRPC_SLOW_START_OK;
 		padding			= 0;
 		iov[0].iov_len += sizeof(pkt.ack);
-		len += sizeof(pkt.ack) + 3 + sizeof(ack_info);
+		len += sizeof(pkt.ack) + 3 + sizeof(trailer);
 		ioc = 3;
 
 		trace_rxrpc_tx_ack(chan->call_debug_id, serial,
--- linux-qcom-6.8.0.orig/net/rxrpc/conn_object.c
+++ linux-qcom-6.8.0/net/rxrpc/conn_object.c
@@ -118,18 +118,13 @@
 	switch (srx->transport.family) {
 	case AF_INET:
 		if (peer->srx.transport.sin.sin_port !=
-		    srx->transport.sin.sin_port ||
-		    peer->srx.transport.sin.sin_addr.s_addr !=
-		    srx->transport.sin.sin_addr.s_addr)
+		    srx->transport.sin.sin_port)
 			goto not_found;
 		break;
 #ifdef CONFIG_AF_RXRPC_IPV6
 	case AF_INET6:
 		if (peer->srx.transport.sin6.sin6_port !=
-		    srx->transport.sin6.sin6_port ||
-		    memcmp(&peer->srx.transport.sin6.sin6_addr,
-			   &srx->transport.sin6.sin6_addr,
-			   sizeof(struct in6_addr)) != 0)
+		    srx->transport.sin6.sin6_port)
 			goto not_found;
 		break;
 #endif
--- linux-qcom-6.8.0.orig/net/rxrpc/input.c
+++ linux-qcom-6.8.0/net/rxrpc/input.c
@@ -9,6 +9,17 @@
 
 #include "ar-internal.h"
 
+/* Override priority when generating ACKs for received DATA */
+static const u8 rxrpc_ack_priority[RXRPC_ACK__INVALID] = {
+	[RXRPC_ACK_IDLE]		= 1,
+	[RXRPC_ACK_DELAY]		= 2,
+	[RXRPC_ACK_REQUESTED]		= 3,
+	[RXRPC_ACK_DUPLICATE]		= 4,
+	[RXRPC_ACK_EXCEEDS_WINDOW]	= 5,
+	[RXRPC_ACK_NOSPACE]		= 6,
+	[RXRPC_ACK_OUT_OF_SEQUENCE]	= 7,
+};
+
 static void rxrpc_proto_abort(struct rxrpc_call *call, rxrpc_seq_t seq,
 			      enum rxrpc_abort_reason why)
 {
@@ -366,7 +377,7 @@
  * Process a DATA packet.
  */
 static void rxrpc_input_data_one(struct rxrpc_call *call, struct sk_buff *skb,
-				 bool *_notify)
+				 bool *_notify, rxrpc_serial_t *_ack_serial, int *_ack_reason)
 {
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 	struct sk_buff *oos;
@@ -419,8 +430,6 @@
 		/* Send an immediate ACK if we fill in a hole */
 		else if (!skb_queue_empty(&call->rx_oos_queue))
 			ack_reason = RXRPC_ACK_DELAY;
-		else
-			call->ackr_nr_unacked++;
 
 		window++;
 		if (after(window, wtop)) {
@@ -498,12 +507,16 @@
 	}
 
 send_ack:
-	if (ack_reason >= 0)
-		rxrpc_send_ACK(call, ack_reason, serial,
-			       rxrpc_propose_ack_input_data);
-	else
-		rxrpc_propose_delay_ACK(call, serial,
-					rxrpc_propose_ack_input_data);
+	if (ack_reason >= 0) {
+		if (rxrpc_ack_priority[ack_reason] > rxrpc_ack_priority[*_ack_reason]) {
+			*_ack_serial = serial;
+			*_ack_reason = ack_reason;
+		} else if (rxrpc_ack_priority[ack_reason] == rxrpc_ack_priority[*_ack_reason] &&
+			   ack_reason == RXRPC_ACK_REQUESTED) {
+			*_ack_serial = serial;
+			*_ack_reason = ack_reason;
+		}
+	}
 }
 
 /*
@@ -514,9 +527,11 @@
 	struct rxrpc_jumbo_header jhdr;
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb), *jsp;
 	struct sk_buff *jskb;
+	rxrpc_serial_t ack_serial = 0;
 	unsigned int offset = sizeof(struct rxrpc_wire_header);
 	unsigned int len = skb->len - offset;
 	bool notify = false;
+	int ack_reason = 0;
 
 	while (sp->hdr.flags & RXRPC_JUMBO_PACKET) {
 		if (len < RXRPC_JUMBO_SUBPKTLEN)
@@ -536,7 +551,7 @@
 		jsp = rxrpc_skb(jskb);
 		jsp->offset = offset;
 		jsp->len = RXRPC_JUMBO_DATALEN;
-		rxrpc_input_data_one(call, jskb, &notify);
+		rxrpc_input_data_one(call, jskb, &notify, &ack_serial, &ack_reason);
 		rxrpc_free_skb(jskb, rxrpc_skb_put_jumbo_subpacket);
 
 		sp->hdr.flags = jhdr.flags;
@@ -549,7 +564,16 @@
 
 	sp->offset = offset;
 	sp->len    = len;
-	rxrpc_input_data_one(call, skb, &notify);
+	rxrpc_input_data_one(call, skb, &notify, &ack_serial, &ack_reason);
+
+	if (ack_reason > 0) {
+		rxrpc_send_ACK(call, ack_reason, ack_serial,
+			       rxrpc_propose_ack_input_data);
+	} else {
+		call->ackr_nr_unacked++;
+		rxrpc_propose_delay_ACK(call, sp->hdr.serial,
+					rxrpc_propose_ack_input_data);
+	}
 	if (notify) {
 		trace_rxrpc_notify_socket(call->debug_id, sp->hdr.serial);
 		rxrpc_notify_socket(call);
@@ -670,14 +694,14 @@
 /*
  * Process the extra information that may be appended to an ACK packet
  */
-static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
-				struct rxrpc_ackinfo *ackinfo)
+static void rxrpc_input_ack_trailer(struct rxrpc_call *call, struct sk_buff *skb,
+				    struct rxrpc_acktrailer *trailer)
 {
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 	struct rxrpc_peer *peer;
 	unsigned int mtu;
 	bool wake = false;
-	u32 rwind = ntohl(ackinfo->rwind);
+	u32 rwind = ntohl(trailer->rwind);
 
 	if (rwind > RXRPC_TX_MAX_WINDOW)
 		rwind = RXRPC_TX_MAX_WINDOW;
@@ -688,10 +712,7 @@
 		call->tx_winsize = rwind;
 	}
 
-	if (call->cong_ssthresh > rwind)
-		call->cong_ssthresh = rwind;
-
-	mtu = min(ntohl(ackinfo->rxMTU), ntohl(ackinfo->maxMTU));
+	mtu = min(ntohl(trailer->maxMTU), ntohl(trailer->ifMTU));
 
 	peer = call->peer;
 	if (mtu < peer->maxdata) {
@@ -837,7 +858,7 @@
 	struct rxrpc_ack_summary summary = { 0 };
 	struct rxrpc_ackpacket ack;
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
-	struct rxrpc_ackinfo info;
+	struct rxrpc_acktrailer trailer;
 	rxrpc_serial_t ack_serial, acked_serial;
 	rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt, since;
 	int nr_acks, offset, ioffset;
@@ -917,11 +938,11 @@
 		goto send_response;
 	}
 
-	info.rxMTU = 0;
+	trailer.maxMTU = 0;
 	ioffset = offset + nr_acks + 3;
-	if (skb->len >= ioffset + sizeof(info) &&
-	    skb_copy_bits(skb, ioffset, &info, sizeof(info)) < 0)
-		return rxrpc_proto_abort(call, 0, rxrpc_badmsg_short_ack_info);
+	if (skb->len >= ioffset + sizeof(trailer) &&
+	    skb_copy_bits(skb, ioffset, &trailer, sizeof(trailer)) < 0)
+		return rxrpc_proto_abort(call, 0, rxrpc_badmsg_short_ack_trailer);
 
 	if (nr_acks > 0)
 		skb_condense(skb);
@@ -950,8 +971,8 @@
 	}
 
 	/* Parse rwind and mtu sizes if provided. */
-	if (info.rxMTU)
-		rxrpc_input_ackinfo(call, skb, &info);
+	if (trailer.maxMTU)
+		rxrpc_input_ack_trailer(call, skb, &trailer);
 
 	if (first_soft_ack == 0)
 		return rxrpc_proto_abort(call, 0, rxrpc_eproto_ackr_zero);
--- linux-qcom-6.8.0.orig/net/rxrpc/io_thread.c
+++ linux-qcom-6.8.0/net/rxrpc/io_thread.c
@@ -27,11 +27,17 @@
 {
 	struct sk_buff_head *rx_queue;
 	struct rxrpc_local *local = rcu_dereference_sk_user_data(udp_sk);
+	struct task_struct *io_thread;
 
 	if (unlikely(!local)) {
 		kfree_skb(skb);
 		return 0;
 	}
+	io_thread = READ_ONCE(local->io_thread);
+	if (!io_thread) {
+		kfree_skb(skb);
+		return 0;
+	}
 	if (skb->tstamp == 0)
 		skb->tstamp = ktime_get_real();
 
@@ -47,7 +53,7 @@
 #endif
 
 	skb_queue_tail(rx_queue, skb);
-	rxrpc_wake_up_io_thread(local);
+	wake_up_process(io_thread);
 	return 0;
 }
 
@@ -554,7 +560,7 @@
 	__set_current_state(TASK_RUNNING);
 	rxrpc_see_local(local, rxrpc_local_stop);
 	rxrpc_destroy_local(local);
-	local->io_thread = NULL;
+	WRITE_ONCE(local->io_thread, NULL);
 	rxrpc_see_local(local, rxrpc_local_stopped);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/net/rxrpc/local_object.c
+++ linux-qcom-6.8.0/net/rxrpc/local_object.c
@@ -232,7 +232,7 @@
 	}
 
 	wait_for_completion(&local->io_thread_ready);
-	local->io_thread = io_thread;
+	WRITE_ONCE(local->io_thread, io_thread);
 	_leave(" = 0");
 	return 0;
 
--- linux-qcom-6.8.0.orig/net/rxrpc/output.c
+++ linux-qcom-6.8.0/net/rxrpc/output.c
@@ -83,7 +83,7 @@
 				 struct rxrpc_txbuf *txb,
 				 u16 *_rwind)
 {
-	struct rxrpc_ackinfo ackinfo;
+	struct rxrpc_acktrailer trailer;
 	unsigned int qsize, sack, wrap, to;
 	rxrpc_seq_t window, wtop;
 	int rsize;
@@ -126,16 +126,16 @@
 	qsize = (window - 1) - call->rx_consumed;
 	rsize = max_t(int, call->rx_winsize - qsize, 0);
 	*_rwind = rsize;
-	ackinfo.rxMTU		= htonl(rxrpc_rx_mtu);
-	ackinfo.maxMTU		= htonl(mtu);
-	ackinfo.rwind		= htonl(rsize);
-	ackinfo.jumbo_max	= htonl(jmax);
+	trailer.maxMTU		= htonl(rxrpc_rx_mtu);
+	trailer.ifMTU		= htonl(mtu);
+	trailer.rwind		= htonl(rsize);
+	trailer.jumbo_max	= htonl(jmax);
 
 	*ackp++ = 0;
 	*ackp++ = 0;
 	*ackp++ = 0;
-	memcpy(ackp, &ackinfo, sizeof(ackinfo));
-	return txb->ack.nAcks + 3 + sizeof(ackinfo);
+	memcpy(ackp, &trailer, sizeof(trailer));
+	return txb->ack.nAcks + 3 + sizeof(trailer);
 }
 
 /*
--- linux-qcom-6.8.0.orig/net/rxrpc/protocol.h
+++ linux-qcom-6.8.0/net/rxrpc/protocol.h
@@ -135,9 +135,9 @@
 /*
  * ACK packets can have a further piece of information tagged on the end
  */
-struct rxrpc_ackinfo {
-	__be32		rxMTU;		/* maximum Rx MTU size (bytes) [AFS 3.3] */
-	__be32		maxMTU;		/* maximum interface MTU size (bytes) [AFS 3.3] */
+struct rxrpc_acktrailer {
+	__be32		maxMTU;		/* maximum Rx MTU size (bytes) [AFS 3.3] */
+	__be32		ifMTU;		/* maximum interface MTU size (bytes) [AFS 3.3] */
 	__be32		rwind;		/* Rx window size (packets) [AFS 3.4] */
 	__be32		jumbo_max;	/* max packets to stick into a jumbo packet [AFS 3.5] */
 };
--- linux-qcom-6.8.0.orig/net/rxrpc/rxkad.c
+++ linux-qcom-6.8.0/net/rxrpc/rxkad.c
@@ -259,7 +259,7 @@
 
 	_enter("");
 
-	check = txb->seq ^ ntohl(txb->wire.callNumber);
+	check = txb->seq ^ call->call_id;
 	hdr->data_size = htonl((u32)check << 16 | txb->len);
 
 	txb->len += sizeof(struct rxkad_level1_hdr);
@@ -302,7 +302,7 @@
 
 	_enter("");
 
-	check = txb->seq ^ ntohl(txb->wire.callNumber);
+	check = txb->seq ^ call->call_id;
 
 	rxkhdr->data_size = htonl(txb->len | (u32)check << 16);
 	rxkhdr->checksum = 0;
@@ -362,9 +362,9 @@
 	memcpy(&iv, call->conn->rxkad.csum_iv.x, sizeof(iv));
 
 	/* calculate the security checksum */
-	x = (ntohl(txb->wire.cid) & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
+	x = (call->cid & RXRPC_CHANNELMASK) << (32 - RXRPC_CIDSHIFT);
 	x |= txb->seq & 0x3fffffff;
-	crypto.buf[0] = txb->wire.callNumber;
+	crypto.buf[0] = htonl(call->call_id);
 	crypto.buf[1] = htonl(x);
 
 	sg_init_one(&sg, crypto.buf, 8);
--- linux-qcom-6.8.0.orig/net/rxrpc/sendmsg.c
+++ linux-qcom-6.8.0/net/rxrpc/sendmsg.c
@@ -303,6 +303,11 @@
 	sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 
 reload:
+	txb = call->tx_pending;
+	call->tx_pending = NULL;
+	if (txb)
+		rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);
+
 	ret = -EPIPE;
 	if (sk->sk_shutdown & SEND_SHUTDOWN)
 		goto maybe_error;
@@ -329,11 +334,6 @@
 			goto maybe_error;
 	}
 
-	txb = call->tx_pending;
-	call->tx_pending = NULL;
-	if (txb)
-		rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);
-
 	do {
 		if (!txb) {
 			size_t remain, bufsize, chunk, offset;
--- linux-qcom-6.8.0.orig/net/sched/act_api.c
+++ linux-qcom-6.8.0/net/sched/act_api.c
@@ -62,7 +62,7 @@
 {
 	struct tc_cookie *old;
 
-	old = xchg((__force struct tc_cookie **)old_cookie, new_cookie);
+	old = unrcu_pointer(xchg(old_cookie, RCU_INITIALIZER(new_cookie)));
 	if (old)
 		call_rcu(&old->rcu, tcf_free_cookie_rcu);
 }
@@ -830,7 +830,6 @@
 	u32 max;
 
 	if (*index) {
-again:
 		rcu_read_lock();
 		p = idr_find(&idrinfo->action_idr, *index);
 
@@ -839,7 +838,7 @@
 			 * index but did not assign the pointer yet.
 			 */
 			rcu_read_unlock();
-			goto again;
+			return -EAGAIN;
 		}
 
 		if (!p) {
@@ -1499,8 +1498,29 @@
 			bool skip_sw = tc_skip_sw(fl_flags);
 			bool skip_hw = tc_skip_hw(fl_flags);
 
-			if (tc_act_bind(act->tcfa_flags))
+			if (tc_act_bind(act->tcfa_flags)) {
+				/* Action is created by classifier and is not
+				 * standalone. Check that the user did not set
+				 * any action flags different than the
+				 * classifier flags, and inherit the flags from
+				 * the classifier for the compatibility case
+				 * where no flags were specified at all.
+				 */
+				if ((tc_act_skip_sw(act->tcfa_flags) && !skip_sw) ||
+				    (tc_act_skip_hw(act->tcfa_flags) && !skip_hw)) {
+					NL_SET_ERR_MSG(extack,
+						       "Mismatch between action and filter offload flags");
+					err = -EINVAL;
+					goto err;
+				}
+				if (skip_sw)
+					act->tcfa_flags |= TCA_ACT_FLAGS_SKIP_SW;
+				if (skip_hw)
+					act->tcfa_flags |= TCA_ACT_FLAGS_SKIP_HW;
 				continue;
+			}
+
+			/* Action is standalone */
 			if (skip_sw != tc_act_skip_sw(act->tcfa_flags) ||
 			    skip_hw != tc_act_skip_hw(act->tcfa_flags)) {
 				NL_SET_ERR_MSG(extack,
--- linux-qcom-6.8.0.orig/net/sched/act_bpf.c
+++ linux-qcom-6.8.0/net/sched/act_bpf.c
@@ -54,8 +54,8 @@
 		bpf_compute_data_pointers(skb);
 		filter_res = bpf_prog_run(filter, skb);
 	}
-	if (unlikely(!skb->tstamp && skb->mono_delivery_time))
-		skb->mono_delivery_time = 0;
+	if (unlikely(!skb->tstamp && skb->tstamp_type))
+		skb->tstamp_type = SKB_CLOCK_REALTIME;
 	if (skb_sk_is_prefetched(skb) && filter_res != TC_ACT_OK)
 		skb_orphan(skb);
 
--- linux-qcom-6.8.0.orig/net/sched/act_ct.c
+++ linux-qcom-6.8.0/net/sched/act_ct.c
@@ -41,21 +41,28 @@
 static struct rhashtable zones_ht;
 static DEFINE_MUTEX(zones_mutex);
 
+struct zones_ht_key {
+	struct net *net;
+	u16 zone;
+	/* Note : pad[] must be the last field. */
+	u8  pad[];
+};
+
 struct tcf_ct_flow_table {
 	struct rhash_head node; /* In zones tables */
 
 	struct rcu_work rwork;
 	struct nf_flowtable nf_ft;
 	refcount_t ref;
-	u16 zone;
+	struct zones_ht_key key;
 
 	bool dying;
 };
 
 static const struct rhashtable_params zones_params = {
 	.head_offset = offsetof(struct tcf_ct_flow_table, node),
-	.key_offset = offsetof(struct tcf_ct_flow_table, zone),
-	.key_len = sizeof_field(struct tcf_ct_flow_table, zone),
+	.key_offset = offsetof(struct tcf_ct_flow_table, key),
+	.key_len = offsetof(struct zones_ht_key, pad),
 	.automatic_shrinking = true,
 };
 
@@ -316,11 +323,12 @@
 
 static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)
 {
+	struct zones_ht_key key = { .net = net, .zone = params->zone };
 	struct tcf_ct_flow_table *ct_ft;
 	int err = -ENOMEM;
 
 	mutex_lock(&zones_mutex);
-	ct_ft = rhashtable_lookup_fast(&zones_ht, &params->zone, zones_params);
+	ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params);
 	if (ct_ft && refcount_inc_not_zero(&ct_ft->ref))
 		goto out_unlock;
 
@@ -329,7 +337,7 @@
 		goto err_alloc;
 	refcount_set(&ct_ft->ref, 1);
 
-	ct_ft->zone = params->zone;
+	ct_ft->key = key;
 	err = rhashtable_insert_fast(&zones_ht, &ct_ft->node, zones_params);
 	if (err)
 		goto err_insert;
@@ -1071,6 +1079,14 @@
 		 */
 		if (nf_conntrack_confirm(skb) != NF_ACCEPT)
 			goto drop;
+
+		/* The ct may be dropped if a clash has been resolved,
+		 * so it's necessary to retrieve it from skb again to
+		 * prevent UAF.
+		 */
+		ct = nf_ct_get(skb, &ctinfo);
+		if (!ct)
+			skip_add = true;
 	}
 
 	if (!skip_add)
--- linux-qcom-6.8.0.orig/net/sched/act_skbmod.c
+++ linux-qcom-6.8.0/net/sched/act_skbmod.c
@@ -241,13 +241,13 @@
 	struct tcf_skbmod *d = to_skbmod(a);
 	unsigned char *b = skb_tail_pointer(skb);
 	struct tcf_skbmod_params  *p;
-	struct tc_skbmod opt = {
-		.index   = d->tcf_index,
-		.refcnt  = refcount_read(&d->tcf_refcnt) - ref,
-		.bindcnt = atomic_read(&d->tcf_bindcnt) - bind,
-	};
+	struct tc_skbmod opt;
 	struct tcf_t t;
 
+	memset(&opt, 0, sizeof(opt));
+	opt.index   = d->tcf_index;
+	opt.refcnt  = refcount_read(&d->tcf_refcnt) - ref,
+	opt.bindcnt = atomic_read(&d->tcf_bindcnt) - bind;
 	spin_lock_bh(&d->tcf_lock);
 	opt.action = d->tcf_action;
 	p = rcu_dereference_protected(d->skbmod_p,
--- linux-qcom-6.8.0.orig/net/sched/cls_api.c
+++ linux-qcom-6.8.0/net/sched/cls_api.c
@@ -1482,6 +1482,7 @@
 	return 0;
 
 err_dev_insert:
+	tcf_block_offload_unbind(block, q, ei);
 err_block_offload_bind:
 	tcf_chain0_head_change_cb_del(block, ei);
 err_chain0_head_change_cb_add:
--- linux-qcom-6.8.0.orig/net/sched/cls_bpf.c
+++ linux-qcom-6.8.0/net/sched/cls_bpf.c
@@ -104,8 +104,8 @@
 			bpf_compute_data_pointers(skb);
 			filter_res = bpf_prog_run(prog->filter, skb);
 		}
-		if (unlikely(!skb->tstamp && skb->mono_delivery_time))
-			skb->mono_delivery_time = 0;
+		if (unlikely(!skb->tstamp && skb->tstamp_type))
+			skb->tstamp_type = SKB_CLOCK_REALTIME;
 
 		if (prog->exts_integrated) {
 			res->class   = 0;
--- linux-qcom-6.8.0.orig/net/sched/cls_flow.c
+++ linux-qcom-6.8.0/net/sched/cls_flow.c
@@ -356,7 +356,8 @@
 	[TCA_FLOW_KEYS]		= { .type = NLA_U32 },
 	[TCA_FLOW_MODE]		= { .type = NLA_U32 },
 	[TCA_FLOW_BASECLASS]	= { .type = NLA_U32 },
-	[TCA_FLOW_RSHIFT]	= { .type = NLA_U32 },
+	[TCA_FLOW_RSHIFT]	= NLA_POLICY_MAX(NLA_U32,
+						 31 /* BITS_PER_U32 - 1 */),
 	[TCA_FLOW_ADDEND]	= { .type = NLA_U32 },
 	[TCA_FLOW_MASK]		= { .type = NLA_U32 },
 	[TCA_FLOW_XOR]		= { .type = NLA_U32 },
--- linux-qcom-6.8.0.orig/net/sched/cls_flower.c
+++ linux-qcom-6.8.0/net/sched/cls_flower.c
@@ -1320,7 +1320,6 @@
 	int err;
 
 	md = (struct erspan_metadata *)&key->enc_opts.data[key->enc_opts.len];
-	memset(md, 0xff, sizeof(*md));
 	md->version = 1;
 
 	if (!depth)
@@ -1349,9 +1348,9 @@
 			NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option index");
 			return -EINVAL;
 		}
+		memset(&md->u.index, 0xff, sizeof(md->u.index));
 		if (tb[TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX]) {
 			nla = tb[TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX];
-			memset(&md->u, 0x00, sizeof(md->u));
 			md->u.index = nla_get_be32(nla);
 		}
 	} else if (md->version == 2) {
@@ -1360,10 +1359,12 @@
 			NL_SET_ERR_MSG(extack, "Missing tunnel key erspan option dir or hwid");
 			return -EINVAL;
 		}
+		md->u.md2.dir = 1;
 		if (tb[TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR]) {
 			nla = tb[TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR];
 			md->u.md2.dir = nla_get_u8(nla);
 		}
+		set_hwid(&md->u.md2, 0xff);
 		if (tb[TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID]) {
 			nla = tb[TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID];
 			set_hwid(&md->u.md2, nla_get_u8(nla));
--- linux-qcom-6.8.0.orig/net/sched/cls_u32.c
+++ linux-qcom-6.8.0/net/sched/cls_u32.c
@@ -92,6 +92,16 @@
 	long			knodes;
 };
 
+static u32 handle2id(u32 h)
+{
+	return ((h & 0x80000000) ? ((h >> 20) & 0x7FF) : h);
+}
+
+static u32 id2handle(u32 id)
+{
+	return (id | 0x800U) << 20;
+}
+
 static inline unsigned int u32_hash_fold(__be32 key,
 					 const struct tc_u32_sel *sel,
 					 u8 fshift)
@@ -310,7 +320,7 @@
 	int id = idr_alloc_cyclic(&tp_c->handle_idr, ptr, 1, 0x7FF, GFP_KERNEL);
 	if (id < 0)
 		return 0;
-	return (id | 0x800U) << 20;
+	return id2handle(id);
 }
 
 static struct hlist_head *tc_u_common_hash;
@@ -360,7 +370,7 @@
 		return -ENOBUFS;
 
 	refcount_set(&root_ht->refcnt, 1);
-	root_ht->handle = tp_c ? gen_new_htid(tp_c, root_ht) : 0x80000000;
+	root_ht->handle = tp_c ? gen_new_htid(tp_c, root_ht) : id2handle(0);
 	root_ht->prio = tp->prio;
 	root_ht->is_root = true;
 	idr_init(&root_ht->handle_idr);
@@ -612,7 +622,7 @@
 		if (phn == ht) {
 			u32_clear_hw_hnode(tp, ht, extack);
 			idr_destroy(&ht->handle_idr);
-			idr_remove(&tp_c->handle_idr, ht->handle);
+			idr_remove(&tp_c->handle_idr, handle2id(ht->handle));
 			RCU_INIT_POINTER(*hn, ht->next);
 			kfree_rcu(ht, rcu);
 			return 0;
@@ -989,7 +999,7 @@
 
 		err = u32_replace_hw_hnode(tp, ht, userflags, extack);
 		if (err) {
-			idr_remove(&tp_c->handle_idr, handle);
+			idr_remove(&tp_c->handle_idr, handle2id(handle));
 			kfree(ht);
 			return err;
 		}
--- linux-qcom-6.8.0.orig/net/sched/sch_api.c
+++ linux-qcom-6.8.0/net/sched/sch_api.c
@@ -593,7 +593,6 @@
 		pkt_len = 1;
 	qdisc_skb_cb(skb)->pkt_len = pkt_len;
 }
-EXPORT_SYMBOL(__qdisc_calculate_pkt_len);
 
 void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc)
 {
@@ -792,7 +791,7 @@
 	drops = max_t(int, n, 0);
 	rcu_read_lock();
 	while ((parentid = sch->parent)) {
-		if (TC_H_MAJ(parentid) == TC_H_MAJ(TC_H_INGRESS))
+		if (parentid == TC_H_ROOT)
 			break;
 
 		if (sch->flags & TCQ_F_NOPARENT)
@@ -809,7 +808,7 @@
 		notify = !sch->q.qlen && !WARN_ON_ONCE(!n &&
 						       !qdisc_is_offloaded);
 		/* TODO: perform the search on a per txq basis */
-		sch = qdisc_lookup(qdisc_dev(sch), TC_H_MAJ(parentid));
+		sch = qdisc_lookup_rcu(qdisc_dev(sch), TC_H_MAJ(parentid));
 		if (sch == NULL) {
 			WARN_ON_ONCE(parentid != TC_H_ROOT);
 			break;
@@ -1201,6 +1200,12 @@
 			return -EINVAL;
 		}
 
+		if (new &&
+		    !(parent->flags & TCQ_F_MQROOT) &&
+		    rcu_access_pointer(new->stab)) {
+			NL_SET_ERR_MSG(extack, "STAB not supported on a non root");
+			return -EINVAL;
+		}
 		err = cops->graft(parent, cl, new, &old, extack);
 		if (err)
 			return err;
@@ -1389,6 +1394,7 @@
 		ops->destroy(sch);
 	qdisc_put_stab(rtnl_dereference(sch->stab));
 err_out3:
+	lockdep_unregister_key(&sch->root_lock_key);
 	netdev_put(dev, &sch->dev_tracker);
 	qdisc_free(sch);
 err_out2:
@@ -1658,6 +1664,10 @@
 				q = qdisc_lookup(dev, tcm->tcm_handle);
 				if (!q)
 					goto create_n_graft;
+				if (q->parent != tcm->tcm_parent) {
+					NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent");
+					return -EINVAL;
+				}
 				if (n->nlmsg_flags & NLM_F_EXCL) {
 					NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override");
 					return -EEXIST;
@@ -2244,6 +2254,12 @@
 		return -EOPNOTSUPP;
 	}
 
+	/* Prevent creation of traffic classes with classid TC_H_ROOT */
+	if (clid == TC_H_ROOT) {
+		NL_SET_ERR_MSG(extack, "Cannot create traffic class with classid TC_H_ROOT");
+		return -EINVAL;
+	}
+
 	new_cl = cl;
 	err = -EOPNOTSUPP;
 	if (cops->change)
--- linux-qcom-6.8.0.orig/net/sched/sch_cake.c
+++ linux-qcom-6.8.0/net/sched/sch_cake.c
@@ -644,6 +644,63 @@
 	return (flow_mode & CAKE_FLOW_DUAL_DST) == CAKE_FLOW_DUAL_DST;
 }
 
+static void cake_dec_srchost_bulk_flow_count(struct cake_tin_data *q,
+					     struct cake_flow *flow,
+					     int flow_mode)
+{
+	if (likely(cake_dsrc(flow_mode) &&
+		   q->hosts[flow->srchost].srchost_bulk_flow_count))
+		q->hosts[flow->srchost].srchost_bulk_flow_count--;
+}
+
+static void cake_inc_srchost_bulk_flow_count(struct cake_tin_data *q,
+					     struct cake_flow *flow,
+					     int flow_mode)
+{
+	if (likely(cake_dsrc(flow_mode) &&
+		   q->hosts[flow->srchost].srchost_bulk_flow_count < CAKE_QUEUES))
+		q->hosts[flow->srchost].srchost_bulk_flow_count++;
+}
+
+static void cake_dec_dsthost_bulk_flow_count(struct cake_tin_data *q,
+					     struct cake_flow *flow,
+					     int flow_mode)
+{
+	if (likely(cake_ddst(flow_mode) &&
+		   q->hosts[flow->dsthost].dsthost_bulk_flow_count))
+		q->hosts[flow->dsthost].dsthost_bulk_flow_count--;
+}
+
+static void cake_inc_dsthost_bulk_flow_count(struct cake_tin_data *q,
+					     struct cake_flow *flow,
+					     int flow_mode)
+{
+	if (likely(cake_ddst(flow_mode) &&
+		   q->hosts[flow->dsthost].dsthost_bulk_flow_count < CAKE_QUEUES))
+		q->hosts[flow->dsthost].dsthost_bulk_flow_count++;
+}
+
+static u16 cake_get_flow_quantum(struct cake_tin_data *q,
+				 struct cake_flow *flow,
+				 int flow_mode)
+{
+	u16 host_load = 1;
+
+	if (cake_dsrc(flow_mode))
+		host_load = max(host_load,
+				q->hosts[flow->srchost].srchost_bulk_flow_count);
+
+	if (cake_ddst(flow_mode))
+		host_load = max(host_load,
+				q->hosts[flow->dsthost].dsthost_bulk_flow_count);
+
+	/* The get_random_u16() is a way to apply dithering to avoid
+	 * accumulating roundoff errors
+	 */
+	return (q->flow_quantum * quantum_div[host_load] +
+		get_random_u16()) >> 16;
+}
+
 static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb,
 		     int flow_mode, u16 flow_override, u16 host_override)
 {
@@ -786,12 +843,13 @@
 		 * queue, accept the collision, update the host tags.
 		 */
 		q->way_collisions++;
-		if (q->flows[outer_hash + k].set == CAKE_SET_BULK) {
-			q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--;
-			q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--;
-		}
 		allocate_src = cake_dsrc(flow_mode);
 		allocate_dst = cake_ddst(flow_mode);
+
+		if (q->flows[outer_hash + k].set == CAKE_SET_BULK) {
+			cake_dec_srchost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode);
+			cake_dec_dsthost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode);
+		}
 found:
 		/* reserve queue for future packets in same flow */
 		reduced_hash = outer_hash + k;
@@ -815,9 +873,10 @@
 			q->hosts[outer_hash + k].srchost_tag = srchost_hash;
 found_src:
 			srchost_idx = outer_hash + k;
-			if (q->flows[reduced_hash].set == CAKE_SET_BULK)
-				q->hosts[srchost_idx].srchost_bulk_flow_count++;
 			q->flows[reduced_hash].srchost = srchost_idx;
+
+			if (q->flows[reduced_hash].set == CAKE_SET_BULK)
+				cake_inc_srchost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode);
 		}
 
 		if (allocate_dst) {
@@ -838,9 +897,10 @@
 			q->hosts[outer_hash + k].dsthost_tag = dsthost_hash;
 found_dst:
 			dsthost_idx = outer_hash + k;
-			if (q->flows[reduced_hash].set == CAKE_SET_BULK)
-				q->hosts[dsthost_idx].dsthost_bulk_flow_count++;
 			q->flows[reduced_hash].dsthost = dsthost_idx;
+
+			if (q->flows[reduced_hash].set == CAKE_SET_BULK)
+				cake_inc_dsthost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode);
 		}
 	}
 
@@ -1539,7 +1599,6 @@
 	b->backlogs[idx]    -= len;
 	b->tin_backlog      -= len;
 	sch->qstats.backlog -= len;
-	qdisc_tree_reduce_backlog(sch, 1, len);
 
 	flow->dropped++;
 	b->tin_dropped++;
@@ -1550,6 +1609,7 @@
 
 	__qdisc_drop(skb, to_free);
 	sch->q.qlen--;
+	qdisc_tree_reduce_backlog(sch, 1, len);
 
 	cake_heapify(q, 0);
 
@@ -1853,10 +1913,6 @@
 
 	/* flowchain */
 	if (!flow->set || flow->set == CAKE_SET_DECAYING) {
-		struct cake_host *srchost = &b->hosts[flow->srchost];
-		struct cake_host *dsthost = &b->hosts[flow->dsthost];
-		u16 host_load = 1;
-
 		if (!flow->set) {
 			list_add_tail(&flow->flowchain, &b->new_flows);
 		} else {
@@ -1866,18 +1922,8 @@
 		flow->set = CAKE_SET_SPARSE;
 		b->sparse_flow_count++;
 
-		if (cake_dsrc(q->flow_mode))
-			host_load = max(host_load, srchost->srchost_bulk_flow_count);
-
-		if (cake_ddst(q->flow_mode))
-			host_load = max(host_load, dsthost->dsthost_bulk_flow_count);
-
-		flow->deficit = (b->flow_quantum *
-				 quantum_div[host_load]) >> 16;
+		flow->deficit = cake_get_flow_quantum(b, flow, q->flow_mode);
 	} else if (flow->set == CAKE_SET_SPARSE_WAIT) {
-		struct cake_host *srchost = &b->hosts[flow->srchost];
-		struct cake_host *dsthost = &b->hosts[flow->dsthost];
-
 		/* this flow was empty, accounted as a sparse flow, but actually
 		 * in the bulk rotation.
 		 */
@@ -1885,12 +1931,8 @@
 		b->sparse_flow_count--;
 		b->bulk_flow_count++;
 
-		if (cake_dsrc(q->flow_mode))
-			srchost->srchost_bulk_flow_count++;
-
-		if (cake_ddst(q->flow_mode))
-			dsthost->dsthost_bulk_flow_count++;
-
+		cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode);
+		cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode);
 	}
 
 	if (q->buffer_used > q->buffer_max_used)
@@ -1947,13 +1989,11 @@
 {
 	struct cake_sched_data *q = qdisc_priv(sch);
 	struct cake_tin_data *b = &q->tins[q->cur_tin];
-	struct cake_host *srchost, *dsthost;
 	ktime_t now = ktime_get();
 	struct cake_flow *flow;
 	struct list_head *head;
 	bool first_flow = true;
 	struct sk_buff *skb;
-	u16 host_load;
 	u64 delay;
 	u32 len;
 
@@ -2053,11 +2093,6 @@
 	q->cur_flow = flow - b->flows;
 	first_flow = false;
 
-	/* triple isolation (modified DRR++) */
-	srchost = &b->hosts[flow->srchost];
-	dsthost = &b->hosts[flow->dsthost];
-	host_load = 1;
-
 	/* flow isolation (DRR++) */
 	if (flow->deficit <= 0) {
 		/* Keep all flows with deficits out of the sparse and decaying
@@ -2069,11 +2104,8 @@
 				b->sparse_flow_count--;
 				b->bulk_flow_count++;
 
-				if (cake_dsrc(q->flow_mode))
-					srchost->srchost_bulk_flow_count++;
-
-				if (cake_ddst(q->flow_mode))
-					dsthost->dsthost_bulk_flow_count++;
+				cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode);
+				cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode);
 
 				flow->set = CAKE_SET_BULK;
 			} else {
@@ -2085,19 +2117,7 @@
 			}
 		}
 
-		if (cake_dsrc(q->flow_mode))
-			host_load = max(host_load, srchost->srchost_bulk_flow_count);
-
-		if (cake_ddst(q->flow_mode))
-			host_load = max(host_load, dsthost->dsthost_bulk_flow_count);
-
-		WARN_ON(host_load > CAKE_QUEUES);
-
-		/* The get_random_u16() is a way to apply dithering to avoid
-		 * accumulating roundoff errors
-		 */
-		flow->deficit += (b->flow_quantum * quantum_div[host_load] +
-				  get_random_u16()) >> 16;
+		flow->deficit += cake_get_flow_quantum(b, flow, q->flow_mode);
 		list_move_tail(&flow->flowchain, &b->old_flows);
 
 		goto retry;
@@ -2121,11 +2141,8 @@
 				if (flow->set == CAKE_SET_BULK) {
 					b->bulk_flow_count--;
 
-					if (cake_dsrc(q->flow_mode))
-						srchost->srchost_bulk_flow_count--;
-
-					if (cake_ddst(q->flow_mode))
-						dsthost->dsthost_bulk_flow_count--;
+					cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode);
+					cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode);
 
 					b->decaying_flow_count++;
 				} else if (flow->set == CAKE_SET_SPARSE ||
@@ -2143,12 +2160,8 @@
 				else if (flow->set == CAKE_SET_BULK) {
 					b->bulk_flow_count--;
 
-					if (cake_dsrc(q->flow_mode))
-						srchost->srchost_bulk_flow_count--;
-
-					if (cake_ddst(q->flow_mode))
-						dsthost->dsthost_bulk_flow_count--;
-
+					cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode);
+					cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode);
 				} else
 					b->decaying_flow_count--;
 
--- linux-qcom-6.8.0.orig/net/sched/sch_cbs.c
+++ linux-qcom-6.8.0/net/sched/sch_cbs.c
@@ -310,7 +310,7 @@
 {
 	struct ethtool_link_ksettings ecmd;
 	int speed = SPEED_10;
-	int port_rate;
+	s64 port_rate;
 	int err;
 
 	err = __ethtool_get_link_ksettings(dev, &ecmd);
--- linux-qcom-6.8.0.orig/net/sched/sch_choke.c
+++ linux-qcom-6.8.0/net/sched/sch_choke.c
@@ -123,10 +123,10 @@
 	if (idx == q->tail)
 		choke_zap_tail_holes(q);
 
+	--sch->q.qlen;
 	qdisc_qstats_backlog_dec(sch, skb);
 	qdisc_tree_reduce_backlog(sch, 1, qdisc_pkt_len(skb));
 	qdisc_drop(skb, sch, to_free);
-	--sch->q.qlen;
 }
 
 struct choke_skb_cb {
--- linux-qcom-6.8.0.orig/net/sched/sch_ets.c
+++ linux-qcom-6.8.0/net/sched/sch_ets.c
@@ -91,6 +91,8 @@
 {
 	struct ets_sched *q = qdisc_priv(sch);
 
+	if (arg == 0 || arg > q->nbands)
+		return NULL;
 	return &q->classes[arg - 1];
 }
 
--- linux-qcom-6.8.0.orig/net/sched/sch_fifo.c
+++ linux-qcom-6.8.0/net/sched/sch_fifo.c
@@ -39,6 +39,9 @@
 {
 	unsigned int prev_backlog;
 
+	if (unlikely(READ_ONCE(sch->limit) == 0))
+		return qdisc_drop(skb, sch, to_free);
+
 	if (likely(sch->q.qlen < sch->limit))
 		return qdisc_enqueue_tail(skb, sch);
 
--- linux-qcom-6.8.0.orig/net/sched/sch_fq.c
+++ linux-qcom-6.8.0/net/sched/sch_fq.c
@@ -329,6 +329,12 @@
 		 */
 		if (q->internal.qlen >= 8)
 			return false;
+
+		/* Ordering invariants fall apart if some delayed flows
+		 * are ready but we haven't serviced them, yet.
+		 */
+		if (q->time_next_delayed_flow <= now)
+			return false;
 	}
 
 	sk = skb->sk;
@@ -661,7 +667,9 @@
 			pband = &q->band_flows[q->band_nr];
 			pband->credit = min(pband->credit + pband->quantum,
 					    pband->quantum);
-			goto begin;
+			if (pband->credit > 0)
+				goto begin;
+			retry = 0;
 		}
 		if (q->time_next_delayed_flow != ~0ULL)
 			qdisc_watchdog_schedule_range_ns(&q->watchdog,
--- linux-qcom-6.8.0.orig/net/sched/sch_generic.c
+++ linux-qcom-6.8.0/net/sched/sch_generic.c
@@ -505,19 +505,28 @@
 			unsigned int timedout_ms = 0;
 			unsigned int i;
 			unsigned long trans_start;
+			unsigned long oldest_start = jiffies;
 
 			for (i = 0; i < dev->num_tx_queues; i++) {
 				struct netdev_queue *txq;
 
 				txq = netdev_get_tx_queue(dev, i);
+				if (!netif_xmit_stopped(txq))
+					continue;
+
+				/* Paired with WRITE_ONCE() + smp_mb...() in
+				 * netdev_tx_sent_queue() and netif_tx_stop_queue().
+				 */
+				smp_mb();
 				trans_start = READ_ONCE(txq->trans_start);
-				if (netif_xmit_stopped(txq) &&
-				    time_after(jiffies, (trans_start +
-							 dev->watchdog_timeo))) {
+
+				if (time_after(jiffies, trans_start + dev->watchdog_timeo)) {
 					timedout_ms = jiffies_to_msecs(jiffies - trans_start);
 					atomic_long_inc(&txq->trans_timeout);
 					break;
 				}
+				if (time_after(oldest_start, trans_start))
+					oldest_start = trans_start;
 			}
 
 			if (unlikely(timedout_ms)) {
@@ -530,7 +539,7 @@
 				netif_unfreeze_queues(dev);
 			}
 			if (!mod_timer(&dev->watchdog_timer,
-				       round_jiffies(jiffies +
+				       round_jiffies(oldest_start +
 						     dev->watchdog_timeo)))
 				release = false;
 		}
@@ -672,6 +681,7 @@
 		.qlen = 0,
 		.lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock),
 	},
+	.owner = -1,
 };
 EXPORT_SYMBOL(noop_qdisc);
 
@@ -944,7 +954,9 @@
 	__skb_queue_head_init(&sch->gso_skb);
 	__skb_queue_head_init(&sch->skb_bad_txq);
 	gnet_stats_basic_sync_init(&sch->bstats);
+	lockdep_register_key(&sch->root_lock_key);
 	spin_lock_init(&sch->q.lock);
+	lockdep_set_class(&sch->q.lock, &sch->root_lock_key);
 
 	if (ops->static_flags & TCQ_F_CPUSTATS) {
 		sch->cpu_bstats =
@@ -973,11 +985,13 @@
 	sch->enqueue = ops->enqueue;
 	sch->dequeue = ops->dequeue;
 	sch->dev_queue = dev_queue;
+	sch->owner = -1;
 	netdev_hold(dev, &sch->dev_tracker, GFP_KERNEL);
 	refcount_set(&sch->refcnt, 1);
 
 	return sch;
 errout1:
+	lockdep_unregister_key(&sch->root_lock_key);
 	kfree(sch);
 errout:
 	return ERR_PTR(err);
@@ -1066,6 +1080,7 @@
 	if (ops->destroy)
 		ops->destroy(qdisc);
 
+	lockdep_unregister_key(&qdisc->root_lock_key);
 	module_put(ops->owner);
 	netdev_put(dev, &qdisc->dev_tracker);
 
--- linux-qcom-6.8.0.orig/net/sched/sch_htb.c
+++ linux-qcom-6.8.0/net/sched/sch_htb.c
@@ -1039,13 +1039,6 @@
 	rcu_read_unlock();
 }
 
-static void htb_set_lockdep_class_child(struct Qdisc *q)
-{
-	static struct lock_class_key child_key;
-
-	lockdep_set_class(qdisc_lock(q), &child_key);
-}
-
 static int htb_offload(struct net_device *dev, struct tc_htb_qopt_offload *opt)
 {
 	return dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_QDISC_HTB, opt);
@@ -1132,7 +1125,6 @@
 			return -ENOMEM;
 		}
 
-		htb_set_lockdep_class_child(qdisc);
 		q->direct_qdiscs[ntx] = qdisc;
 		qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
 	}
@@ -1468,7 +1460,6 @@
 	}
 
 	if (q->offload) {
-		htb_set_lockdep_class_child(new);
 		/* One ref for cl->leaf.q, the other for dev_queue->qdisc. */
 		qdisc_refcount_inc(new);
 		old_q = htb_graft_helper(dev_queue, new);
@@ -1733,11 +1724,8 @@
 		new_q = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops,
 					  cl->parent->common.classid,
 					  NULL);
-		if (q->offload) {
-			if (new_q)
-				htb_set_lockdep_class_child(new_q);
+		if (q->offload)
 			htb_parent_to_leaf_offload(sch, dev_queue, new_q);
-		}
 	}
 
 	sch_tree_lock(sch);
@@ -1947,13 +1935,9 @@
 		new_q = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops,
 					  classid, NULL);
 		if (q->offload) {
-			if (new_q) {
-				htb_set_lockdep_class_child(new_q);
-				/* One ref for cl->leaf.q, the other for
-				 * dev_queue->qdisc.
-				 */
+			/* One ref for cl->leaf.q, the other for dev_queue->qdisc. */
+			if (new_q)
 				qdisc_refcount_inc(new_q);
-			}
 			old_q = htb_graft_helper(dev_queue, new_q);
 			/* No qdisc_put needed. */
 			WARN_ON(!(old_q->flags & TCQ_F_BUILTIN));
--- linux-qcom-6.8.0.orig/net/sched/sch_ingress.c
+++ linux-qcom-6.8.0/net/sched/sch_ingress.c
@@ -91,7 +91,7 @@
 	entry = tcx_entry_fetch_or_create(dev, true, &created);
 	if (!entry)
 		return -ENOMEM;
-	tcx_miniq_set_active(entry, true);
+	tcx_miniq_inc(entry);
 	mini_qdisc_pair_init(&q->miniqp, sch, &tcx_entry(entry)->miniq);
 	if (created)
 		tcx_entry_update(dev, entry, true);
@@ -121,7 +121,7 @@
 	tcf_block_put_ext(q->block, sch, &q->block_info);
 
 	if (entry) {
-		tcx_miniq_set_active(entry, false);
+		tcx_miniq_dec(entry);
 		if (!tcx_entry_is_active(entry)) {
 			tcx_entry_update(dev, NULL, true);
 			tcx_entry_free(entry);
@@ -256,7 +256,7 @@
 	entry = tcx_entry_fetch_or_create(dev, true, &created);
 	if (!entry)
 		return -ENOMEM;
-	tcx_miniq_set_active(entry, true);
+	tcx_miniq_inc(entry);
 	mini_qdisc_pair_init(&q->miniqp_ingress, sch, &tcx_entry(entry)->miniq);
 	if (created)
 		tcx_entry_update(dev, entry, true);
@@ -275,7 +275,7 @@
 	entry = tcx_entry_fetch_or_create(dev, false, &created);
 	if (!entry)
 		return -ENOMEM;
-	tcx_miniq_set_active(entry, true);
+	tcx_miniq_inc(entry);
 	mini_qdisc_pair_init(&q->miniqp_egress, sch, &tcx_entry(entry)->miniq);
 	if (created)
 		tcx_entry_update(dev, entry, false);
@@ -301,7 +301,7 @@
 	tcf_block_put_ext(q->egress_block, sch, &q->egress_block_info);
 
 	if (ingress_entry) {
-		tcx_miniq_set_active(ingress_entry, false);
+		tcx_miniq_dec(ingress_entry);
 		if (!tcx_entry_is_active(ingress_entry)) {
 			tcx_entry_update(dev, NULL, true);
 			tcx_entry_free(ingress_entry);
@@ -309,7 +309,7 @@
 	}
 
 	if (egress_entry) {
-		tcx_miniq_set_active(egress_entry, false);
+		tcx_miniq_dec(egress_entry);
 		if (!tcx_entry_is_active(egress_entry)) {
 			tcx_entry_update(dev, NULL, false);
 			tcx_entry_free(egress_entry);
--- linux-qcom-6.8.0.orig/net/sched/sch_multiq.c
+++ linux-qcom-6.8.0/net/sched/sch_multiq.c
@@ -185,7 +185,7 @@
 
 	qopt->bands = qdisc_dev(sch)->real_num_tx_queues;
 
-	removed = kmalloc(sizeof(*removed) * (q->max_bands - q->bands),
+	removed = kmalloc(sizeof(*removed) * (q->max_bands - qopt->bands),
 			  GFP_KERNEL);
 	if (!removed)
 		return -ENOMEM;
--- linux-qcom-6.8.0.orig/net/sched/sch_netem.c
+++ linux-qcom-6.8.0/net/sched/sch_netem.c
@@ -78,6 +78,8 @@
 	struct sk_buff	*t_head;
 	struct sk_buff	*t_tail;
 
+	u32 t_len;
+
 	/* optional qdisc for classful handling (NULL at netem init) */
 	struct Qdisc	*qdisc;
 
@@ -382,6 +384,7 @@
 	rtnl_kfree_skbs(q->t_head, q->t_tail);
 	q->t_head = NULL;
 	q->t_tail = NULL;
+	q->t_len = 0;
 }
 
 static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
@@ -411,6 +414,7 @@
 		rb_link_node(&nskb->rbnode, parent, p);
 		rb_insert_color(&nskb->rbnode, &q->t_root);
 	}
+	q->t_len++;
 	sch->q.qlen++;
 }
 
@@ -446,12 +450,10 @@
 	struct netem_sched_data *q = qdisc_priv(sch);
 	/* We don't fill cb now as skb_unshare() may invalidate it */
 	struct netem_skb_cb *cb;
-	struct sk_buff *skb2;
+	struct sk_buff *skb2 = NULL;
 	struct sk_buff *segs = NULL;
 	unsigned int prev_len = qdisc_pkt_len(skb);
 	int count = 1;
-	int rc = NET_XMIT_SUCCESS;
-	int rc_drop = NET_XMIT_DROP;
 
 	/* Do not fool qdisc_drop_all() */
 	skb->prev = NULL;
@@ -480,19 +482,11 @@
 		skb_orphan_partial(skb);
 
 	/*
-	 * If we need to duplicate packet, then re-insert at top of the
-	 * qdisc tree, since parent queuer expects that only one
-	 * skb will be queued.
+	 * If we need to duplicate packet, then clone it before
+	 * original is modified.
 	 */
-	if (count > 1 && (skb2 = skb_clone(skb, GFP_ATOMIC)) != NULL) {
-		struct Qdisc *rootq = qdisc_root_bh(sch);
-		u32 dupsave = q->duplicate; /* prevent duplicating a dup... */
-
-		q->duplicate = 0;
-		rootq->enqueue(skb2, rootq, to_free);
-		q->duplicate = dupsave;
-		rc_drop = NET_XMIT_SUCCESS;
-	}
+	if (count > 1)
+		skb2 = skb_clone(skb, GFP_ATOMIC);
 
 	/*
 	 * Randomized packet corruption.
@@ -504,7 +498,8 @@
 		if (skb_is_gso(skb)) {
 			skb = netem_segment(skb, sch, to_free);
 			if (!skb)
-				return rc_drop;
+				goto finish_segs;
+
 			segs = skb->next;
 			skb_mark_not_on_list(skb);
 			qdisc_skb_cb(skb)->pkt_len = skb->len;
@@ -526,11 +521,28 @@
 			1<<get_random_u32_below(8);
 	}
 
-	if (unlikely(sch->q.qlen >= sch->limit)) {
+	if (unlikely(q->t_len >= sch->limit)) {
 		/* re-link segs, so that qdisc_drop_all() frees them all */
 		skb->next = segs;
 		qdisc_drop_all(skb, sch, to_free);
-		return rc_drop;
+		if (skb2)
+			__qdisc_drop(skb2, to_free);
+		return NET_XMIT_DROP;
+	}
+
+	/*
+	 * If doing duplication then re-insert at top of the
+	 * qdisc tree, since parent queuer expects that only one
+	 * skb will be queued.
+	 */
+	if (skb2) {
+		struct Qdisc *rootq = qdisc_root_bh(sch);
+		u32 dupsave = q->duplicate; /* prevent duplicating a dup... */
+
+		q->duplicate = 0;
+		rootq->enqueue(skb2, rootq, to_free);
+		q->duplicate = dupsave;
+		skb2 = NULL;
 	}
 
 	qdisc_qstats_backlog_inc(sch, skb);
@@ -601,9 +613,12 @@
 	}
 
 finish_segs:
+	if (skb2)
+		__qdisc_drop(skb2, to_free);
+
 	if (segs) {
 		unsigned int len, last_len;
-		int nb;
+		int rc, nb;
 
 		len = skb ? skb->len : 0;
 		nb = skb ? 1 : 0;
@@ -690,8 +705,8 @@
 tfifo_dequeue:
 	skb = __qdisc_dequeue_head(&sch->q);
 	if (skb) {
-		qdisc_qstats_backlog_dec(sch, skb);
 deliver:
+		qdisc_qstats_backlog_dec(sch, skb);
 		qdisc_bstats_update(sch, skb);
 		return skb;
 	}
@@ -707,8 +722,7 @@
 
 		if (time_to_send <= now && q->slot.slot_next <= now) {
 			netem_erase_head(q, skb);
-			sch->q.qlen--;
-			qdisc_qstats_backlog_dec(sch, skb);
+			q->t_len--;
 			skb->next = NULL;
 			skb->prev = NULL;
 			/* skb->dev shares skb->rbnode area,
@@ -731,21 +745,25 @@
 
 				err = qdisc_enqueue(skb, q->qdisc, &to_free);
 				kfree_skb_list(to_free);
-				if (err != NET_XMIT_SUCCESS &&
-				    net_xmit_drop_count(err)) {
-					qdisc_qstats_drop(sch);
-					qdisc_tree_reduce_backlog(sch, 1,
-								  pkt_len);
+				if (err != NET_XMIT_SUCCESS) {
+					if (net_xmit_drop_count(err))
+						qdisc_qstats_drop(sch);
+					sch->qstats.backlog -= pkt_len;
+					sch->q.qlen--;
+					qdisc_tree_reduce_backlog(sch, 1, pkt_len);
 				}
 				goto tfifo_dequeue;
 			}
+			sch->q.qlen--;
 			goto deliver;
 		}
 
 		if (q->qdisc) {
 			skb = q->qdisc->ops->dequeue(q->qdisc);
-			if (skb)
+			if (skb) {
+				sch->q.qlen--;
 				goto deliver;
+			}
 		}
 
 		qdisc_watchdog_schedule_ns(&q->watchdog,
@@ -755,8 +773,10 @@
 
 	if (q->qdisc) {
 		skb = q->qdisc->ops->dequeue(q->qdisc);
-		if (skb)
+		if (skb) {
+			sch->q.qlen--;
 			goto deliver;
+		}
 	}
 	return NULL;
 }
--- linux-qcom-6.8.0.orig/net/sched/sch_taprio.c
+++ linux-qcom-6.8.0/net/sched/sch_taprio.c
@@ -1008,7 +1008,8 @@
 };
 
 static const struct nla_policy taprio_tc_policy[TCA_TAPRIO_TC_ENTRY_MAX + 1] = {
-	[TCA_TAPRIO_TC_ENTRY_INDEX]	   = { .type = NLA_U32 },
+	[TCA_TAPRIO_TC_ENTRY_INDEX]	   = NLA_POLICY_MAX(NLA_U32,
+							    TC_QOPT_MAX_QUEUE),
 	[TCA_TAPRIO_TC_ENTRY_MAX_SDU]	   = { .type = NLA_U32 },
 	[TCA_TAPRIO_TC_ENTRY_FP]	   = NLA_POLICY_RANGE(NLA_U32,
 							      TC_FP_EXPRESS,
@@ -1160,11 +1161,6 @@
 		list_for_each_entry(entry, &new->entries, list)
 			cycle = ktime_add_ns(cycle, entry->interval);
 
-		if (!cycle) {
-			NL_SET_ERR_MSG(extack, "'cycle_time' can never be 0");
-			return -EINVAL;
-		}
-
 		if (cycle < 0 || cycle > INT_MAX) {
 			NL_SET_ERR_MSG(extack, "'cycle_time' is too big");
 			return -EINVAL;
@@ -1173,6 +1169,11 @@
 		new->cycle_time = cycle;
 	}
 
+	if (new->cycle_time < new->num_entries * length_to_duration(q, ETH_ZLEN)) {
+		NL_SET_ERR_MSG(extack, "'cycle_time' is too small");
+		return -EINVAL;
+	}
+
 	taprio_calculate_gate_durations(q, new);
 
 	return 0;
@@ -1185,16 +1186,13 @@
 {
 	bool allow_overlapping_txqs = TXTIME_ASSIST_IS_ENABLED(taprio_flags);
 
-	if (!qopt && !dev->num_tc) {
-		NL_SET_ERR_MSG(extack, "'mqprio' configuration is necessary");
-		return -EINVAL;
-	}
-
-	/* If num_tc is already set, it means that the user already
-	 * configured the mqprio part
-	 */
-	if (dev->num_tc)
+	if (!qopt) {
+		if (!dev->num_tc) {
+			NL_SET_ERR_MSG(extack, "'mqprio' configuration is necessary");
+			return -EINVAL;
+		}
 		return 0;
+	}
 
 	/* taprio imposes that traffic classes map 1:n to tx queues */
 	if (qopt->num_tc > dev->num_tx_queues) {
@@ -1870,6 +1868,9 @@
 
 	q->flags = err;
 
+	/* Needed for length_to_duration() during netlink attribute parsing */
+	taprio_set_picos_per_byte(dev, q);
+
 	err = taprio_parse_mqprio_opt(dev, mqprio, extack, q->flags);
 	if (err < 0)
 		return err;
@@ -1929,7 +1930,6 @@
 	if (err < 0)
 		goto free_sched;
 
-	taprio_set_picos_per_byte(dev, q);
 	taprio_update_queue_max_sdu(q, new_admin, stab);
 
 	if (FULL_OFFLOAD_IS_ENABLED(q->flags))
@@ -1975,7 +1975,9 @@
 			goto unlock;
 		}
 
-		rcu_assign_pointer(q->admin_sched, new_admin);
+		/* Not going to race against advance_sched(), but still */
+		admin = rcu_replace_pointer(q->admin_sched, new_admin,
+					    lockdep_rtnl_is_held());
 		if (admin)
 			call_rcu(&admin->rcu, taprio_free_sched_cb);
 	} else {
@@ -1986,7 +1988,8 @@
 
 		taprio_start_sched(sch, start, new_admin);
 
-		rcu_assign_pointer(q->admin_sched, new_admin);
+		admin = rcu_replace_pointer(q->admin_sched, new_admin,
+					    lockdep_rtnl_is_held());
 		if (admin)
 			call_rcu(&admin->rcu, taprio_free_sched_cb);
 
@@ -2394,9 +2397,6 @@
 	struct tc_mqprio_qopt opt = { 0 };
 	struct nlattr *nest, *sched_nest;
 
-	oper = rtnl_dereference(q->oper_sched);
-	admin = rtnl_dereference(q->admin_sched);
-
 	mqprio_qopt_reconstruct(dev, &opt);
 
 	nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
@@ -2417,18 +2417,23 @@
 	    nla_put_u32(skb, TCA_TAPRIO_ATTR_TXTIME_DELAY, q->txtime_delay))
 		goto options_error;
 
+	rcu_read_lock();
+
+	oper = rtnl_dereference(q->oper_sched);
+	admin = rtnl_dereference(q->admin_sched);
+
 	if (oper && taprio_dump_tc_entries(skb, q, oper))
-		goto options_error;
+		goto options_error_rcu;
 
 	if (oper && dump_schedule(skb, oper))
-		goto options_error;
+		goto options_error_rcu;
 
 	if (!admin)
 		goto done;
 
 	sched_nest = nla_nest_start_noflag(skb, TCA_TAPRIO_ATTR_ADMIN_SCHED);
 	if (!sched_nest)
-		goto options_error;
+		goto options_error_rcu;
 
 	if (dump_schedule(skb, admin))
 		goto admin_error;
@@ -2436,11 +2441,15 @@
 	nla_nest_end(skb, sched_nest);
 
 done:
+	rcu_read_unlock();
 	return nla_nest_end(skb, nest);
 
 admin_error:
 	nla_nest_cancel(skb, sched_nest);
 
+options_error_rcu:
+	rcu_read_unlock();
+
 options_error:
 	nla_nest_cancel(skb, nest);
 
--- linux-qcom-6.8.0.orig/net/sched/sch_tbf.c
+++ linux-qcom-6.8.0/net/sched/sch_tbf.c
@@ -208,7 +208,7 @@
 	struct tbf_sched_data *q = qdisc_priv(sch);
 	struct sk_buff *segs, *nskb;
 	netdev_features_t features = netif_skb_features(skb);
-	unsigned int len = 0, prev_len = qdisc_pkt_len(skb);
+	unsigned int len = 0, prev_len = qdisc_pkt_len(skb), seg_len;
 	int ret, nb;
 
 	segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
@@ -219,21 +219,27 @@
 	nb = 0;
 	skb_list_walk_safe(segs, segs, nskb) {
 		skb_mark_not_on_list(segs);
-		qdisc_skb_cb(segs)->pkt_len = segs->len;
-		len += segs->len;
+		seg_len = segs->len;
+		qdisc_skb_cb(segs)->pkt_len = seg_len;
 		ret = qdisc_enqueue(segs, q->qdisc, to_free);
 		if (ret != NET_XMIT_SUCCESS) {
 			if (net_xmit_drop_count(ret))
 				qdisc_qstats_drop(sch);
 		} else {
 			nb++;
+			len += seg_len;
 		}
 	}
 	sch->q.qlen += nb;
-	if (nb > 1)
+	sch->qstats.backlog += len;
+	if (nb > 0) {
 		qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
-	consume_skb(skb);
-	return nb > 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP;
+		consume_skb(skb);
+		return NET_XMIT_SUCCESS;
+	}
+
+	kfree_skb(skb);
+	return NET_XMIT_DROP;
 }
 
 static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch,
--- linux-qcom-6.8.0.orig/net/sctp/associola.c
+++ linux-qcom-6.8.0/net/sctp/associola.c
@@ -137,7 +137,8 @@
 		= 5 * asoc->rto_max;
 
 	asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
-	asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = sp->autoclose * HZ;
+	asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
+		(unsigned long)sp->autoclose * HZ;
 
 	/* Initializes the timers */
 	for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
--- linux-qcom-6.8.0.orig/net/sctp/input.c
+++ linux-qcom-6.8.0/net/sctp/input.c
@@ -735,15 +735,19 @@
 	struct sock *sk = ep->base.sk;
 	struct net *net = sock_net(sk);
 	struct sctp_hashbucket *head;
+	int err = 0;
 
 	ep->hashent = sctp_ep_hashfn(net, ep->base.bind_addr.port);
 	head = &sctp_ep_hashtable[ep->hashent];
 
+	write_lock(&head->lock);
 	if (sk->sk_reuseport) {
 		bool any = sctp_is_ep_boundall(sk);
 		struct sctp_endpoint *ep2;
 		struct list_head *list;
-		int cnt = 0, err = 1;
+		int cnt = 0;
+
+		err = 1;
 
 		list_for_each(list, &ep->base.bind_addr.address_list)
 			cnt++;
@@ -761,24 +765,24 @@
 			if (!err) {
 				err = reuseport_add_sock(sk, sk2, any);
 				if (err)
-					return err;
+					goto out;
 				break;
 			} else if (err < 0) {
-				return err;
+				goto out;
 			}
 		}
 
 		if (err) {
 			err = reuseport_alloc(sk, any);
 			if (err)
-				return err;
+				goto out;
 		}
 	}
 
-	write_lock(&head->lock);
 	hlist_add_head(&ep->node, &head->chain);
+out:
 	write_unlock(&head->lock);
-	return 0;
+	return err;
 }
 
 /* Add an endpoint to the hash. Local BH-safe. */
@@ -803,10 +807,9 @@
 
 	head = &sctp_ep_hashtable[ep->hashent];
 
+	write_lock(&head->lock);
 	if (rcu_access_pointer(sk->sk_reuseport_cb))
 		reuseport_detach_sock(sk);
-
-	write_lock(&head->lock);
 	hlist_del_init(&ep->node);
 	write_unlock(&head->lock);
 }
--- linux-qcom-6.8.0.orig/net/sctp/ipv6.c
+++ linux-qcom-6.8.0/net/sctp/ipv6.c
@@ -415,7 +415,7 @@
 	if (!IS_ERR_OR_NULL(dst)) {
 		struct rt6_info *rt;
 
-		rt = (struct rt6_info *)dst;
+		rt = dst_rt6_info(dst);
 		t->dst_cookie = rt6_get_cookie(rt);
 		pr_debug("rt6_dst:%pI6/%d rt6_src:%pI6\n",
 			 &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
@@ -683,7 +683,7 @@
 	struct sock *sk = &sp->inet.sk;
 	struct net *net = sock_net(sk);
 	struct net_device *dev = NULL;
-	int type;
+	int type, res, bound_dev_if;
 
 	type = ipv6_addr_type(in6);
 	if (IPV6_ADDR_ANY == type)
@@ -697,14 +697,21 @@
 	if (!(type & IPV6_ADDR_UNICAST))
 		return 0;
 
-	if (sk->sk_bound_dev_if) {
-		dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
+	rcu_read_lock();
+	bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
+	if (bound_dev_if) {
+		res = 0;
+		dev = dev_get_by_index_rcu(net, bound_dev_if);
 		if (!dev)
-			return 0;
+			goto out;
 	}
 
-	return ipv6_can_nonlocal_bind(net, &sp->inet) ||
-	       ipv6_chk_addr(net, in6, dev, 0);
+	res = ipv6_can_nonlocal_bind(net, &sp->inet) ||
+	      ipv6_chk_addr(net, in6, dev, 0);
+
+out:
+	rcu_read_unlock();
+	return res;
 }
 
 /* This function checks if the address is a valid address to be used for
--- linux-qcom-6.8.0.orig/net/sctp/protocol.c
+++ linux-qcom-6.8.0/net/sctp/protocol.c
@@ -552,7 +552,7 @@
 			      struct flowi *fl)
 {
 	union sctp_addr *saddr = &t->saddr;
-	struct rtable *rt = (struct rtable *)t->dst;
+	struct rtable *rt = dst_rtable(t->dst);
 
 	if (rt) {
 		saddr->v4.sin_family = AF_INET;
@@ -1085,7 +1085,7 @@
 	skb_reset_inner_mac_header(skb);
 	skb_reset_inner_transport_header(skb);
 	skb_set_inner_ipproto(skb, IPPROTO_SCTP);
-	udp_tunnel_xmit_skb((struct rtable *)dst, sk, skb, fl4->saddr,
+	udp_tunnel_xmit_skb(dst_rtable(dst), sk, skb, fl4->saddr,
 			    fl4->daddr, dscp, ip4_dst_hoplimit(dst), df,
 			    sctp_sk(sk)->udp_port, t->encap_port, false, false);
 	return 0;
--- linux-qcom-6.8.0.orig/net/sctp/sm_statefuns.c
+++ linux-qcom-6.8.0/net/sctp/sm_statefuns.c
@@ -2259,12 +2259,6 @@
 		}
 	}
 
-	/* Update socket peer label if first association. */
-	if (security_sctp_assoc_request(new_asoc, chunk->head_skb ?: chunk->skb)) {
-		sctp_association_free(new_asoc);
-		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-	}
-
 	/* Set temp so that it won't be added into hashtable */
 	new_asoc->temp = 1;
 
@@ -2273,6 +2267,22 @@
 	 */
 	action = sctp_tietags_compare(new_asoc, asoc);
 
+	/* In cases C and E the association doesn't enter the ESTABLISHED
+	 * state, so there is no need to call security_sctp_assoc_request().
+	 */
+	switch (action) {
+	case 'A': /* Association restart. */
+	case 'B': /* Collision case B. */
+	case 'D': /* Collision case D. */
+		/* Update socket peer label if first association. */
+		if (security_sctp_assoc_request((struct sctp_association *)asoc,
+						chunk->head_skb ?: chunk->skb)) {
+			sctp_association_free(new_asoc);
+			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+		}
+		break;
+	}
+
 	switch (action) {
 	case 'A': /* Association restart. */
 		retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
@@ -3740,7 +3750,7 @@
 		}
 
 		ch = (struct sctp_chunkhdr *)ch_end;
-	} while (ch_end < skb_tail_pointer(skb));
+	} while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
 
 	if (ootb_shut_ack)
 		return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
--- linux-qcom-6.8.0.orig/net/sctp/socket.c
+++ linux-qcom-6.8.0/net/sctp/socket.c
@@ -7118,6 +7118,7 @@
 	struct sctp_sock *sp = sctp_sk(sk);
 	struct sctp_association *asoc;
 	struct sctp_assoc_ids *ids;
+	size_t ids_size;
 	u32 num = 0;
 
 	if (sctp_style(sk, TCP))
@@ -7130,11 +7131,11 @@
 		num++;
 	}
 
-	if (len < sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num)
+	ids_size = struct_size(ids, gaids_assoc_id, num);
+	if (len < ids_size)
 		return -EINVAL;
 
-	len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num;
-
+	len = ids_size;
 	ids = kmalloc(len, GFP_USER | __GFP_NOWARN);
 	if (unlikely(!ids))
 		return -ENOMEM;
@@ -8524,6 +8525,7 @@
 	struct sctp_endpoint *ep = sp->ep;
 	struct crypto_shash *tfm = NULL;
 	char alg[32];
+	int err;
 
 	/* Allocate HMAC for generating cookie. */
 	if (!sp->hmac && sp->sctp_hmac_alg) {
@@ -8550,17 +8552,26 @@
 	 */
 	inet_sk_set_state(sk, SCTP_SS_LISTENING);
 	if (!ep->base.bind_addr.port) {
-		if (sctp_autobind(sk))
-			return -EAGAIN;
+		if (sctp_autobind(sk)) {
+			err = -EAGAIN;
+			goto err;
+		}
 	} else {
 		if (sctp_get_port(sk, inet_sk(sk)->inet_num)) {
-			inet_sk_set_state(sk, SCTP_SS_CLOSED);
-			return -EADDRINUSE;
+			err = -EADDRINUSE;
+			goto err;
 		}
 	}
 
 	WRITE_ONCE(sk->sk_max_ack_backlog, backlog);
-	return sctp_hash_endpoint(ep);
+	err = sctp_hash_endpoint(ep);
+	if (err)
+		goto err;
+
+	return 0;
+err:
+	inet_sk_set_state(sk, SCTP_SS_CLOSED);
+	return err;
 }
 
 /*
--- linux-qcom-6.8.0.orig/net/sctp/sysctl.c
+++ linux-qcom-6.8.0/net/sctp/sysctl.c
@@ -391,7 +391,8 @@
 static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
 				 void *buffer, size_t *lenp, loff_t *ppos)
 {
-	struct net *net = current->nsproxy->net_ns;
+	struct net *net = container_of(ctl->data, struct net,
+				       sctp.sctp_hmac_alg);
 	struct ctl_table tbl;
 	bool changed = false;
 	char *none = "none";
@@ -436,7 +437,7 @@
 static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
 				void *buffer, size_t *lenp, loff_t *ppos)
 {
-	struct net *net = current->nsproxy->net_ns;
+	struct net *net = container_of(ctl->data, struct net, sctp.rto_min);
 	unsigned int min = *(unsigned int *) ctl->extra1;
 	unsigned int max = *(unsigned int *) ctl->extra2;
 	struct ctl_table tbl;
@@ -464,7 +465,7 @@
 static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
 				void *buffer, size_t *lenp, loff_t *ppos)
 {
-	struct net *net = current->nsproxy->net_ns;
+	struct net *net = container_of(ctl->data, struct net, sctp.rto_max);
 	unsigned int min = *(unsigned int *) ctl->extra1;
 	unsigned int max = *(unsigned int *) ctl->extra2;
 	struct ctl_table tbl;
@@ -502,7 +503,7 @@
 static int proc_sctp_do_auth(struct ctl_table *ctl, int write,
 			     void *buffer, size_t *lenp, loff_t *ppos)
 {
-	struct net *net = current->nsproxy->net_ns;
+	struct net *net = container_of(ctl->data, struct net, sctp.auth_enable);
 	struct ctl_table tbl;
 	int new_value, ret;
 
@@ -531,7 +532,7 @@
 static int proc_sctp_do_udp_port(struct ctl_table *ctl, int write,
 				 void *buffer, size_t *lenp, loff_t *ppos)
 {
-	struct net *net = current->nsproxy->net_ns;
+	struct net *net = container_of(ctl->data, struct net, sctp.udp_port);
 	unsigned int min = *(unsigned int *)ctl->extra1;
 	unsigned int max = *(unsigned int *)ctl->extra2;
 	struct ctl_table tbl;
@@ -572,7 +573,8 @@
 static int proc_sctp_do_probe_interval(struct ctl_table *ctl, int write,
 				       void *buffer, size_t *lenp, loff_t *ppos)
 {
-	struct net *net = current->nsproxy->net_ns;
+	struct net *net = container_of(ctl->data, struct net,
+				       sctp.probe_interval);
 	struct ctl_table tbl;
 	int ret, new_value;
 
--- linux-qcom-6.8.0.orig/net/smc/af_smc.c
+++ linux-qcom-6.8.0/net/smc/af_smc.c
@@ -362,25 +362,15 @@
 		return;
 }
 
-static struct sock *smc_sock_alloc(struct net *net, struct socket *sock,
-				   int protocol)
+void smc_sk_init(struct net *net, struct sock *sk, int protocol)
 {
-	struct smc_sock *smc;
-	struct proto *prot;
-	struct sock *sk;
-
-	prot = (protocol == SMCPROTO_SMC6) ? &smc_proto6 : &smc_proto;
-	sk = sk_alloc(net, PF_SMC, GFP_KERNEL, prot, 0);
-	if (!sk)
-		return NULL;
+	struct smc_sock *smc = smc_sk(sk);
 
-	sock_init_data(sock, sk); /* sets sk_refcnt to 1 */
 	sk->sk_state = SMC_INIT;
 	sk->sk_destruct = smc_destruct;
 	sk->sk_protocol = protocol;
 	WRITE_ONCE(sk->sk_sndbuf, 2 * READ_ONCE(net->smc.sysctl_wmem));
 	WRITE_ONCE(sk->sk_rcvbuf, 2 * READ_ONCE(net->smc.sysctl_rmem));
-	smc = smc_sk(sk);
 	INIT_WORK(&smc->tcp_listen_work, smc_tcp_listen_work);
 	INIT_WORK(&smc->connect_work, smc_connect_work);
 	INIT_DELAYED_WORK(&smc->conn.tx_work, smc_tx_work);
@@ -390,6 +380,25 @@
 	sk->sk_prot->hash(sk);
 	mutex_init(&smc->clcsock_release_lock);
 	smc_init_saved_callbacks(smc);
+	smc->limit_smc_hs = net->smc.limit_smc_hs;
+	smc->use_fallback = false; /* assume rdma capability first */
+	smc->fallback_rsn = 0;
+	smc_close_init(smc);
+}
+
+static struct sock *smc_sock_alloc(struct net *net, struct socket *sock,
+				   int protocol)
+{
+	struct proto *prot;
+	struct sock *sk;
+
+	prot = (protocol == SMCPROTO_SMC6) ? &smc_proto6 : &smc_proto;
+	sk = sk_alloc(net, PF_SMC, GFP_KERNEL, prot, 0);
+	if (!sk)
+		return NULL;
+
+	sock_init_data(sock, sk); /* sets sk_refcnt to 1 */
+	smc_sk_init(net, sk, protocol);
 
 	return sk;
 }
@@ -460,29 +469,11 @@
 static void smc_adjust_sock_bufsizes(struct sock *nsk, struct sock *osk,
 				     unsigned long mask)
 {
-	struct net *nnet = sock_net(nsk);
-
 	nsk->sk_userlocks = osk->sk_userlocks;
-	if (osk->sk_userlocks & SOCK_SNDBUF_LOCK) {
+	if (osk->sk_userlocks & SOCK_SNDBUF_LOCK)
 		nsk->sk_sndbuf = osk->sk_sndbuf;
-	} else {
-		if (mask == SK_FLAGS_SMC_TO_CLC)
-			WRITE_ONCE(nsk->sk_sndbuf,
-				   READ_ONCE(nnet->ipv4.sysctl_tcp_wmem[1]));
-		else
-			WRITE_ONCE(nsk->sk_sndbuf,
-				   2 * READ_ONCE(nnet->smc.sysctl_wmem));
-	}
-	if (osk->sk_userlocks & SOCK_RCVBUF_LOCK) {
+	if (osk->sk_userlocks & SOCK_RCVBUF_LOCK)
 		nsk->sk_rcvbuf = osk->sk_rcvbuf;
-	} else {
-		if (mask == SK_FLAGS_SMC_TO_CLC)
-			WRITE_ONCE(nsk->sk_rcvbuf,
-				   READ_ONCE(nnet->ipv4.sysctl_tcp_rmem[1]));
-		else
-			WRITE_ONCE(nsk->sk_rcvbuf,
-				   2 * READ_ONCE(nnet->smc.sysctl_rmem));
-	}
 }
 
 static void smc_copy_sock_settings(struct sock *nsk, struct sock *osk,
@@ -1309,7 +1300,6 @@
 		goto connect_abort;
 	}
 
-	smc_close_init(smc);
 	smc_rx_init(smc);
 
 	if (ini->first_contact_local) {
@@ -1437,7 +1427,14 @@
 	}
 
 	smc_conn_save_peer_info(smc, aclc);
-	smc_close_init(smc);
+
+	if (smc_ism_support_dmb_nocopy(smc->conn.lgr->smcd)) {
+		rc = smcd_buf_attach(smc);
+		if (rc) {
+			rc = SMC_CLC_DECL_MEM;	/* try to fallback */
+			goto connect_abort;
+		}
+	}
 	smc_rx_init(smc);
 	smc_tx_init(smc);
 
@@ -1911,6 +1908,7 @@
 	if (tcp_sk(new_smc->clcsock->sk)->syn_smc)
 		atomic_dec(&lsmc->queued_smc_hs);
 
+	release_sock(newsmcsk); /* lock in smc_listen_work() */
 	if (lsmc->sk.sk_state == SMC_LISTEN) {
 		lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
 		smc_accept_enqueue(&lsmc->sk, newsmcsk);
@@ -2042,6 +2040,8 @@
 	if (pclc->hdr.typev1 == SMC_TYPE_N)
 		return 0;
 	pclc_prfx = smc_clc_proposal_get_prefix(pclc);
+	if (!pclc_prfx)
+		return -EPROTO;
 	if (smc_clc_prfx_match(newclcsock, pclc_prfx))
 		return SMC_CLC_DECL_DIFFPREFIX;
 
@@ -2155,6 +2155,8 @@
 	pclc_smcd = smc_get_clc_msg_smcd(pclc);
 	smc_v2_ext = smc_get_clc_v2_ext(pclc);
 	smcd_v2_ext = smc_get_clc_smcd_v2_ext(smc_v2_ext);
+	if (!pclc_smcd || !smc_v2_ext || !smcd_v2_ext)
+		goto not_found;
 
 	mutex_lock(&smcd_dev_list.mutex);
 	if (pclc_smcd->ism.chid) {
@@ -2231,7 +2233,9 @@
 	int rc = 0;
 
 	/* check if ISM V1 is available */
-	if (!(ini->smcd_version & SMC_V1) || !smcd_indicated(ini->smc_type_v1))
+	if (!(ini->smcd_version & SMC_V1) ||
+	    !smcd_indicated(ini->smc_type_v1) ||
+	    !pclc_smcd)
 		goto not_found;
 	ini->is_smcd = true; /* prepare ISM check */
 	ini->ism_peer_gid[0].gid = ntohll(pclc_smcd->ism.gid);
@@ -2282,7 +2286,8 @@
 		goto not_found;
 
 	smc_v2_ext = smc_get_clc_v2_ext(pclc);
-	if (!smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL))
+	if (!smc_v2_ext ||
+	    !smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL))
 		goto not_found;
 
 	/* prepare RDMA check */
@@ -2432,6 +2437,7 @@
 	u8 accept_version;
 	int rc = 0;
 
+	lock_sock(&new_smc->sk); /* release in smc_listen_out() */
 	if (new_smc->listen_smc->sk.sk_state != SMC_LISTEN)
 		return smc_listen_out_err(new_smc);
 
@@ -2489,7 +2495,6 @@
 		goto out_decl;
 
 	mutex_lock(&smc_server_lgr_pending);
-	smc_close_init(new_smc);
 	smc_rx_init(new_smc);
 	smc_tx_init(new_smc);
 
@@ -2541,6 +2546,14 @@
 		mutex_unlock(&smc_server_lgr_pending);
 	}
 	smc_conn_save_peer_info(new_smc, cclc);
+
+	if (ini->is_smcd &&
+	    smc_ism_support_dmb_nocopy(new_smc->conn.lgr->smcd)) {
+		rc = smcd_buf_attach(new_smc);
+		if (rc)
+			goto out_decl;
+	}
+
 	smc_listen_out_connected(new_smc);
 	SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk), ini);
 	goto out_free;
@@ -2883,6 +2896,13 @@
 			} else {
 				sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 				set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+
+				if (sk->sk_state != SMC_INIT) {
+					/* Race breaker the same way as tcp_poll(). */
+					smp_mb__after_atomic();
+					if (atomic_read(&smc->conn.sndbuf_space))
+						mask |= EPOLLOUT | EPOLLWRNORM;
+				}
 			}
 			if (atomic_read(&smc->conn.bytes_to_rcv))
 				mask |= EPOLLIN | EPOLLRDNORM;
@@ -3306,6 +3326,31 @@
 	.splice_read	= smc_splice_read,
 };
 
+int smc_create_clcsk(struct net *net, struct sock *sk, int family)
+{
+	struct smc_sock *smc = smc_sk(sk);
+	int rc;
+
+	rc = sock_create_kern(net, family, SOCK_STREAM, IPPROTO_TCP,
+			      &smc->clcsock);
+	if (rc) {
+		sk_common_release(sk);
+		return rc;
+	}
+
+	/* smc_clcsock_release() does not wait smc->clcsock->sk's
+	 * destruction;  its sk_state might not be TCP_CLOSE after
+	 * smc->sk is close()d, and TCP timers can be fired later,
+	 * which need net ref.
+	 */
+	sk = smc->clcsock->sk;
+	__netns_tracker_free(net, &sk->ns_tracker, false);
+	sk->sk_net_refcnt = 1;
+	get_net_track(net, &sk->ns_tracker, GFP_KERNEL);
+	sock_inuse_add(net, 1);
+	return 0;
+}
+
 static int __smc_create(struct net *net, struct socket *sock, int protocol,
 			int kern, struct socket *clcsock)
 {
@@ -3331,35 +3376,12 @@
 
 	/* create internal TCP socket for CLC handshake and fallback */
 	smc = smc_sk(sk);
-	smc->use_fallback = false; /* assume rdma capability first */
-	smc->fallback_rsn = 0;
-
-	/* default behavior from limit_smc_hs in every net namespace */
-	smc->limit_smc_hs = net->smc.limit_smc_hs;
 
 	rc = 0;
-	if (!clcsock) {
-		rc = sock_create_kern(net, family, SOCK_STREAM, IPPROTO_TCP,
-				      &smc->clcsock);
-		if (rc) {
-			sk_common_release(sk);
-			goto out;
-		}
-
-		/* smc_clcsock_release() does not wait smc->clcsock->sk's
-		 * destruction;  its sk_state might not be TCP_CLOSE after
-		 * smc->sk is close()d, and TCP timers can be fired later,
-		 * which need net ref.
-		 */
-		sk = smc->clcsock->sk;
-		__netns_tracker_free(net, &sk->ns_tracker, false);
-		sk->sk_net_refcnt = 1;
-		get_net_track(net, &sk->ns_tracker, GFP_KERNEL);
-		sock_inuse_add(net, 1);
-	} else {
+	if (clcsock)
 		smc->clcsock = clcsock;
-	}
-
+	else
+		rc = smc_create_clcsk(net, sk, family);
 out:
 	return rc;
 }
--- linux-qcom-6.8.0.orig/net/smc/smc.h
+++ linux-qcom-6.8.0/net/smc/smc.h
@@ -34,6 +34,11 @@
 extern struct proto smc_proto;
 extern struct proto smc_proto6;
 
+/* smc sock initialization */
+void smc_sk_init(struct net *net, struct sock *sk, int protocol);
+/* clcsock initialization */
+int smc_create_clcsk(struct net *net, struct sock *sk, int family);
+
 #ifdef ATOMIC64_INIT
 #define KERNEL_HAS_ATOMIC64
 #endif
--- linux-qcom-6.8.0.orig/net/smc/smc_clc.c
+++ linux-qcom-6.8.0/net/smc/smc_clc.c
@@ -352,8 +352,11 @@
 	struct smc_clc_msg_hdr *hdr = &pclc->hdr;
 	struct smc_clc_v2_extension *v2_ext;
 
-	v2_ext = smc_get_clc_v2_ext(pclc);
 	pclc_prfx = smc_clc_proposal_get_prefix(pclc);
+	if (!pclc_prfx ||
+	    pclc_prfx->ipv6_prefixes_cnt > SMC_CLC_MAX_V6_PREFIX)
+		return false;
+
 	if (hdr->version == SMC_V1) {
 		if (hdr->typev1 == SMC_TYPE_N)
 			return false;
@@ -365,6 +368,13 @@
 			sizeof(struct smc_clc_msg_trail))
 			return false;
 	} else {
+		v2_ext = smc_get_clc_v2_ext(pclc);
+		if ((hdr->typev2 != SMC_TYPE_N &&
+		     (!v2_ext || v2_ext->hdr.eid_cnt > SMC_CLC_MAX_UEID)) ||
+		    (smcd_indicated(hdr->typev2) &&
+		     v2_ext->hdr.ism_gid_cnt > SMCD_CLC_MAX_V2_GID_ENTRIES))
+			return false;
+
 		if (ntohs(hdr->length) !=
 			sizeof(*pclc) +
 			sizeof(struct smc_clc_msg_smcd) +
@@ -764,6 +774,11 @@
 						SMC_CLC_RECV_BUF_LEN : datlen;
 		iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, recvlen);
 		len = sock_recvmsg(smc->clcsock, &msg, krflags);
+		if (len < recvlen) {
+			smc->sk.sk_err = EPROTO;
+			reason_code = -EPROTO;
+			goto out;
+		}
 		datlen -= len;
 	}
 	if (clcm->type == SMC_CLC_DECLINE) {
--- linux-qcom-6.8.0.orig/net/smc/smc_clc.h
+++ linux-qcom-6.8.0/net/smc/smc_clc.h
@@ -326,8 +326,12 @@
 static inline struct smc_clc_msg_proposal_prefix *
 smc_clc_proposal_get_prefix(struct smc_clc_msg_proposal *pclc)
 {
+	u16 offset = ntohs(pclc->iparea_offset);
+
+	if (offset > sizeof(struct smc_clc_msg_smcd))
+		return NULL;
 	return (struct smc_clc_msg_proposal_prefix *)
-	       ((u8 *)pclc + sizeof(*pclc) + ntohs(pclc->iparea_offset));
+	       ((u8 *)pclc + sizeof(*pclc) + offset);
 }
 
 static inline bool smcr_indicated(int smc_type)
@@ -366,8 +370,14 @@
 smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop)
 {
 	struct smc_clc_msg_smcd *prop_smcd = smc_get_clc_msg_smcd(prop);
+	u16 max_offset;
 
-	if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset))
+	max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) -
+		     offsetof(struct smc_clc_msg_proposal_area, pclc_smcd) -
+		     offsetofend(struct smc_clc_msg_smcd, v2_ext_offset);
+
+	if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset) ||
+	    ntohs(prop_smcd->v2_ext_offset) > max_offset)
 		return NULL;
 
 	return (struct smc_clc_v2_extension *)
@@ -380,9 +390,15 @@
 static inline struct smc_clc_smcd_v2_extension *
 smc_get_clc_smcd_v2_ext(struct smc_clc_v2_extension *prop_v2ext)
 {
+	u16 max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_smcd_v2_ext) -
+		offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) -
+		offsetof(struct smc_clc_v2_extension, hdr) -
+		offsetofend(struct smc_clnt_opts_area_hdr, smcd_v2_ext_offset);
+
 	if (!prop_v2ext)
 		return NULL;
-	if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset))
+	if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) ||
+	    ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) > max_offset)
 		return NULL;
 
 	return (struct smc_clc_smcd_v2_extension *)
--- linux-qcom-6.8.0.orig/net/smc/smc_core.c
+++ linux-qcom-6.8.0/net/smc/smc_core.c
@@ -1149,6 +1149,20 @@
 	}
 }
 
+static void smcd_buf_detach(struct smc_connection *conn)
+{
+	struct smcd_dev *smcd = conn->lgr->smcd;
+	u64 peer_token = conn->peer_token;
+
+	if (!conn->sndbuf_desc)
+		return;
+
+	smc_ism_detach_dmb(smcd, peer_token);
+
+	kfree(conn->sndbuf_desc);
+	conn->sndbuf_desc = NULL;
+}
+
 static void smc_buf_unuse(struct smc_connection *conn,
 			  struct smc_link_group *lgr)
 {
@@ -1192,6 +1206,8 @@
 	if (lgr->is_smcd) {
 		if (!list_empty(&lgr->list))
 			smc_ism_unset_conn(conn);
+		if (smc_ism_support_dmb_nocopy(lgr->smcd))
+			smcd_buf_detach(conn);
 		tasklet_kill(&conn->rx_tsklet);
 	} else {
 		smc_cdc_wait_pend_tx_wr(conn);
@@ -1445,6 +1461,8 @@
 	smc_sk_wake_ups(smc);
 	if (conn->lgr->is_smcd) {
 		smc_ism_unset_conn(conn);
+		if (smc_ism_support_dmb_nocopy(conn->lgr->smcd))
+			smcd_buf_detach(conn);
 		if (soft)
 			tasklet_kill(&conn->rx_tsklet);
 		else
@@ -1755,7 +1773,9 @@
 {
 	if (smc_link_downing(&lnk->state)) {
 		trace_smcr_link_down(lnk, __builtin_return_address(0));
-		schedule_work(&lnk->link_down_wrk);
+		smcr_link_hold(lnk); /* smcr_link_put in link_down_wrk */
+		if (!schedule_work(&lnk->link_down_wrk))
+			smcr_link_put(lnk);
 	}
 }
 
@@ -1787,11 +1807,14 @@
 	struct smc_link_group *lgr = link->lgr;
 
 	if (list_empty(&lgr->list))
-		return;
+		goto out;
 	wake_up_all(&lgr->llc_msg_waiter);
 	down_write(&lgr->llc_conf_mutex);
 	smcr_link_down(link);
 	up_write(&lgr->llc_conf_mutex);
+
+out:
+	smcr_link_put(link); /* smcr_link_hold by schedulers of link_down_work */
 }
 
 static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev,
@@ -1997,7 +2020,6 @@
  */
 static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb)
 {
-	const unsigned int max_scat = SG_MAX_SINGLE_ALLOC * PAGE_SIZE;
 	u8 compressed;
 
 	if (size <= SMC_BUF_MIN_SIZE)
@@ -2007,9 +2029,11 @@
 	compressed = min_t(u8, ilog2(size) + 1,
 			   is_smcd ? SMCD_DMBE_SIZES : SMCR_RMBE_SIZES);
 
+#ifdef CONFIG_ARCH_NO_SG_CHAIN
 	if (!is_smcd && is_rmb)
 		/* RMBs are backed by & limited to max size of scatterlists */
-		compressed = min_t(u8, compressed, ilog2(max_scat >> 14));
+		compressed = min_t(u8, compressed, ilog2((SG_MAX_SINGLE_ALLOC * PAGE_SIZE) >> 14));
+#endif
 
 	return compressed;
 }
@@ -2464,12 +2488,18 @@
 	int rc;
 
 	/* create send buffer */
+	if (is_smcd &&
+	    smc_ism_support_dmb_nocopy(smc->conn.lgr->smcd))
+		goto create_rmb;
+
 	rc = __smc_buf_create(smc, is_smcd, false);
 	if (rc)
 		return rc;
+
+create_rmb:
 	/* create rmb */
 	rc = __smc_buf_create(smc, is_smcd, true);
-	if (rc) {
+	if (rc && smc->conn.sndbuf_desc) {
 		down_write(&smc->conn.lgr->sndbufs_lock);
 		list_del(&smc->conn.sndbuf_desc->list);
 		up_write(&smc->conn.lgr->sndbufs_lock);
@@ -2479,6 +2509,41 @@
 	return rc;
 }
 
+int smcd_buf_attach(struct smc_sock *smc)
+{
+	struct smc_connection *conn = &smc->conn;
+	struct smcd_dev *smcd = conn->lgr->smcd;
+	u64 peer_token = conn->peer_token;
+	struct smc_buf_desc *buf_desc;
+	int rc;
+
+	buf_desc = kzalloc(sizeof(*buf_desc), GFP_KERNEL);
+	if (!buf_desc)
+		return -ENOMEM;
+
+	/* The ghost sndbuf_desc describes the same memory region as
+	 * peer RMB. Its lifecycle is consistent with the connection's
+	 * and it will be freed with the connections instead of the
+	 * link group.
+	 */
+	rc = smc_ism_attach_dmb(smcd, peer_token, buf_desc);
+	if (rc)
+		goto free;
+
+	smc->sk.sk_sndbuf = buf_desc->len;
+	buf_desc->cpu_addr =
+		(u8 *)buf_desc->cpu_addr + sizeof(struct smcd_cdc_msg);
+	buf_desc->len -= sizeof(struct smcd_cdc_msg);
+	conn->sndbuf_desc = buf_desc;
+	conn->sndbuf_desc->used = 1;
+	atomic_set(&conn->sndbuf_space, conn->sndbuf_desc->len);
+	return 0;
+
+free:
+	kfree(buf_desc);
+	return rc;
+}
+
 static inline int smc_rmb_reserve_rtoken_idx(struct smc_link_group *lgr)
 {
 	int i;
--- linux-qcom-6.8.0.orig/net/smc/smc_core.h
+++ linux-qcom-6.8.0/net/smc/smc_core.h
@@ -557,6 +557,7 @@
 void smc_smcd_terminate_all(struct smcd_dev *dev);
 void smc_smcr_terminate_all(struct smc_ib_device *smcibdev);
 int smc_buf_create(struct smc_sock *smc, bool is_smcd);
+int smcd_buf_attach(struct smc_sock *smc);
 int smc_uncompress_bufsize(u8 compressed);
 int smc_rmb_rtoken_handling(struct smc_connection *conn, struct smc_link *link,
 			    struct smc_clc_msg_accept_confirm *clc);
--- linux-qcom-6.8.0.orig/net/smc/smc_diag.c
+++ linux-qcom-6.8.0/net/smc/smc_diag.c
@@ -255,6 +255,7 @@
 }
 
 static const struct sock_diag_handler smc_diag_handler = {
+	.owner = THIS_MODULE,
 	.family = AF_SMC,
 	.dump = smc_diag_handler_dump,
 };
--- linux-qcom-6.8.0.orig/net/smc/smc_ib.c
+++ linux-qcom-6.8.0/net/smc/smc_ib.c
@@ -209,13 +209,18 @@
 	if (IS_ERR(rt))
 		goto out;
 	if (rt->rt_uses_gateway && rt->rt_gw_family != AF_INET)
-		goto out;
-	neigh = rt->dst.ops->neigh_lookup(&rt->dst, NULL, &fl4.daddr);
-	if (neigh) {
-		memcpy(nexthop_mac, neigh->ha, ETH_ALEN);
-		*uses_gateway = rt->rt_uses_gateway;
-		return 0;
-	}
+		goto out_rt;
+	neigh = dst_neigh_lookup(&rt->dst, &fl4.daddr);
+	if (!neigh)
+		goto out_rt;
+	memcpy(nexthop_mac, neigh->ha, ETH_ALEN);
+	*uses_gateway = rt->rt_uses_gateway;
+	neigh_release(neigh);
+	ip_rt_put(rt);
+	return 0;
+
+out_rt:
+	ip_rt_put(rt);
 out:
 	return -ENOENT;
 }
--- linux-qcom-6.8.0.orig/net/smc/smc_ism.c
+++ linux-qcom-6.8.0/net/smc/smc_ism.c
@@ -126,6 +126,8 @@
 
 	if (!vlanid)			/* No valid vlan id */
 		return -EINVAL;
+	if (!smcd->ops->add_vlan_id)
+		return -EOPNOTSUPP;
 
 	/* create new vlan entry, in case we need it */
 	new_vlan = kzalloc(sizeof(*new_vlan), GFP_KERNEL);
@@ -171,6 +173,8 @@
 
 	if (!vlanid)			/* No valid vlan id */
 		return -EINVAL;
+	if (!smcd->ops->del_vlan_id)
+		return -EOPNOTSUPP;
 
 	spin_lock_irqsave(&smcd->lock, flags);
 	list_for_each_entry(vlan, &smcd->vlan, list) {
@@ -245,6 +249,46 @@
 #endif
 }
 
+bool smc_ism_support_dmb_nocopy(struct smcd_dev *smcd)
+{
+	/* for now only loopback-ism supports
+	 * merging sndbuf with peer DMB to avoid
+	 * data copies between them.
+	 */
+	return (smcd->ops->support_dmb_nocopy &&
+		smcd->ops->support_dmb_nocopy(smcd));
+}
+
+int smc_ism_attach_dmb(struct smcd_dev *dev, u64 token,
+		       struct smc_buf_desc *dmb_desc)
+{
+	struct smcd_dmb dmb;
+	int rc = 0;
+
+	if (!dev->ops->attach_dmb)
+		return -EINVAL;
+
+	memset(&dmb, 0, sizeof(dmb));
+	dmb.dmb_tok = token;
+	rc = dev->ops->attach_dmb(dev, &dmb);
+	if (!rc) {
+		dmb_desc->sba_idx = dmb.sba_idx;
+		dmb_desc->token = dmb.dmb_tok;
+		dmb_desc->cpu_addr = dmb.cpu_addr;
+		dmb_desc->dma_addr = dmb.dma_addr;
+		dmb_desc->len = dmb.dmb_len;
+	}
+	return rc;
+}
+
+int smc_ism_detach_dmb(struct smcd_dev *dev, u64 token)
+{
+	if (!dev->ops->detach_dmb)
+		return -EINVAL;
+
+	return dev->ops->detach_dmb(dev, token);
+}
+
 static int smc_nl_handle_smcd_dev(struct smcd_dev *smcd,
 				  struct sk_buff *skb,
 				  struct netlink_callback *cb)
@@ -372,7 +416,8 @@
 		smc_smcd_terminate(wrk->smcd, &peer_gid, ev_info.vlan_id);
 		break;
 	case ISM_EVENT_CODE_TESTLINK:	/* Activity timer */
-		if (ev_info.code == ISM_EVENT_REQUEST) {
+		if (ev_info.code == ISM_EVENT_REQUEST &&
+		    wrk->smcd->ops->signal_event) {
 			ev_info.code = ISM_EVENT_RESPONSE;
 			wrk->smcd->ops->signal_event(wrk->smcd,
 						     &peer_gid,
@@ -541,6 +586,8 @@
 
 	if (lgr->peer_shutdown)
 		return 0;
+	if (!lgr->smcd->ops->signal_event)
+		return 0;
 
 	memcpy(ev_info.uid, lgr->id, SMC_LGR_ID_SIZE);
 	ev_info.vlan_id = lgr->vlan_id;
--- linux-qcom-6.8.0.orig/net/smc/smc_ism.h
+++ linux-qcom-6.8.0/net/smc/smc_ism.h
@@ -48,6 +48,10 @@
 int smc_ism_register_dmb(struct smc_link_group *lgr, int buf_size,
 			 struct smc_buf_desc *dmb_desc);
 int smc_ism_unregister_dmb(struct smcd_dev *dev, struct smc_buf_desc *dmb_desc);
+bool smc_ism_support_dmb_nocopy(struct smcd_dev *smcd);
+int smc_ism_attach_dmb(struct smcd_dev *dev, u64 token,
+		       struct smc_buf_desc *dmb_desc);
+int smc_ism_detach_dmb(struct smcd_dev *dev, u64 token);
 int smc_ism_signal_shutdown(struct smc_link_group *lgr);
 void smc_ism_get_system_eid(u8 **eid);
 u16 smc_ism_get_chid(struct smcd_dev *dev);
--- linux-qcom-6.8.0.orig/net/smc/smc_pnet.c
+++ linux-qcom-6.8.0/net/smc/smc_pnet.c
@@ -753,7 +753,7 @@
 
 	write_lock(&sn->pnetids_ndev.lock);
 	list_for_each_entry(pi, &sn->pnetids_ndev.list, list) {
-		if (smc_pnet_match(pnetid, pe->pnetid)) {
+		if (smc_pnet_match(pnetid, pi->pnetid)) {
 			refcount_inc(&pi->refcnt);
 			kfree(pe);
 			goto unlock;
@@ -806,6 +806,16 @@
 	u8 ndev_pnetid[SMC_MAX_PNETID_LEN];
 	struct net_device *dev;
 
+	/* Newly created netns do not have devices.
+	 * Do not even acquire rtnl.
+	 */
+	if (list_empty(&net->dev_base_head))
+		return;
+
+	/* Note: This might not be needed, because smc_pnet_netdev_event()
+	 * is also calling smc_pnet_add_base_pnetid() when handling
+	 * NETDEV_UP event.
+	 */
 	rtnl_lock();
 	for_each_netdev(net, dev)
 		smc_pnet_add_base_pnetid(net, dev, ndev_pnetid);
--- linux-qcom-6.8.0.orig/net/smc/smc_stats.h
+++ linux-qcom-6.8.0/net/smc/smc_stats.h
@@ -19,7 +19,7 @@
 
 #include "smc_clc.h"
 
-#define SMC_MAX_FBACK_RSN_CNT 30
+#define SMC_MAX_FBACK_RSN_CNT 36
 
 enum {
 	SMC_BUF_8K,
--- linux-qcom-6.8.0.orig/net/smc/smc_wr.c
+++ linux-qcom-6.8.0/net/smc/smc_wr.c
@@ -648,8 +648,10 @@
 	smc_wr_tx_wait_no_pending_sends(lnk);
 	percpu_ref_kill(&lnk->wr_reg_refs);
 	wait_for_completion(&lnk->reg_ref_comp);
+	percpu_ref_exit(&lnk->wr_reg_refs);
 	percpu_ref_kill(&lnk->wr_tx_refs);
 	wait_for_completion(&lnk->tx_ref_comp);
+	percpu_ref_exit(&lnk->wr_tx_refs);
 
 	if (lnk->wr_rx_dma_addr) {
 		ib_dma_unmap_single(ibdev, lnk->wr_rx_dma_addr,
@@ -912,11 +914,13 @@
 	init_waitqueue_head(&lnk->wr_reg_wait);
 	rc = percpu_ref_init(&lnk->wr_reg_refs, smcr_wr_reg_refs_free, 0, GFP_KERNEL);
 	if (rc)
-		goto dma_unmap;
+		goto cancel_ref;
 	init_completion(&lnk->reg_ref_comp);
 	init_waitqueue_head(&lnk->wr_rx_empty_wait);
 	return rc;
 
+cancel_ref:
+	percpu_ref_exit(&lnk->wr_tx_refs);
 dma_unmap:
 	if (lnk->wr_rx_v2_dma_addr) {
 		ib_dma_unmap_single(ibdev, lnk->wr_rx_v2_dma_addr,
--- linux-qcom-6.8.0.orig/net/socket.c
+++ linux-qcom-6.8.0/net/socket.c
@@ -1569,8 +1569,13 @@
 	rcu_read_unlock();
 
 	err = pf->create(net, sock, protocol, kern);
-	if (err < 0)
+	if (err < 0) {
+		/* ->create should release the allocated sock->sk object on error
+		 * but it may leave the dangling pointer
+		 */
+		sock->sk = NULL;
 		goto out_module_put;
+	}
 
 	/*
 	 * Now to bump the refcnt of the [loadable] module that owns this
@@ -2349,7 +2354,7 @@
 int do_sock_getsockopt(struct socket *sock, bool compat, int level,
 		       int optname, sockptr_t optval, sockptr_t optlen)
 {
-	int max_optlen __maybe_unused;
+	int max_optlen __maybe_unused = 0;
 	const struct proto_ops *ops;
 	int err;
 
@@ -2358,7 +2363,7 @@
 		return err;
 
 	if (!compat)
-		max_optlen = BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen);
+		copy_from_sockptr(&max_optlen, optlen, sizeof(int));
 
 	ops = READ_ONCE(sock->ops);
 	if (level == SOL_SOCKET) {
--- linux-qcom-6.8.0.orig/net/sunrpc/addr.c
+++ linux-qcom-6.8.0/net/sunrpc/addr.c
@@ -284,10 +284,10 @@
 	}
 
 	if (snprintf(portbuf, sizeof(portbuf),
-		     ".%u.%u", port >> 8, port & 0xff) > (int)sizeof(portbuf))
+		     ".%u.%u", port >> 8, port & 0xff) >= (int)sizeof(portbuf))
 		return NULL;
 
-	if (strlcat(addrbuf, portbuf, sizeof(addrbuf)) > sizeof(addrbuf))
+	if (strlcat(addrbuf, portbuf, sizeof(addrbuf)) >= sizeof(addrbuf))
 		return NULL;
 
 	return kstrdup(addrbuf, gfp_flags);
--- linux-qcom-6.8.0.orig/net/sunrpc/auth_gss/auth_gss.c
+++ linux-qcom-6.8.0/net/sunrpc/auth_gss/auth_gss.c
@@ -1875,8 +1875,10 @@
 	offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
 	maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages);
 	/* slack space should prevent this ever happening: */
-	if (unlikely(snd_buf->len > snd_buf->buflen))
+	if (unlikely(snd_buf->len > snd_buf->buflen)) {
+		status = -EIO;
 		goto wrap_failed;
+	}
 	/* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was
 	 * done anyway, so it's safe to put the request on the wire: */
 	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
--- linux-qcom-6.8.0.orig/net/sunrpc/auth_gss/gss_krb5_keys.c
+++ linux-qcom-6.8.0/net/sunrpc/auth_gss/gss_krb5_keys.c
@@ -168,7 +168,7 @@
 		goto err_return;
 	blocksize = crypto_sync_skcipher_blocksize(cipher);
 	if (crypto_sync_skcipher_setkey(cipher, inkey->data, inkey->len))
-		goto err_return;
+		goto err_free_cipher;
 
 	ret = -ENOMEM;
 	inblockdata = kmalloc(blocksize, gfp_mask);
--- linux-qcom-6.8.0.orig/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ linux-qcom-6.8.0/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -398,6 +398,7 @@
 	u64 seq_send64;
 	int keylen;
 	u32 time32;
+	int ret;
 
 	p = simple_get_bytes(p, end, &ctx->flags, sizeof(ctx->flags));
 	if (IS_ERR(p))
@@ -450,8 +451,16 @@
 	}
 	ctx->mech_used.len = gss_kerberos_mech.gm_oid.len;
 
-	return gss_krb5_import_ctx_v2(ctx, gfp_mask);
+	ret = gss_krb5_import_ctx_v2(ctx, gfp_mask);
+	if (ret) {
+		p = ERR_PTR(ret);
+		goto out_free;
+	}
+
+	return 0;
 
+out_free:
+	kfree(ctx->mech_used.data);
 out_err:
 	return PTR_ERR(p);
 }
--- linux-qcom-6.8.0.orig/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ linux-qcom-6.8.0/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -250,8 +250,8 @@
 
 	creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL);
 	if (!creds) {
-		kfree(oa->data);
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto free_oa;
 	}
 
 	oa->data[0].option.data = CREDS_VALUE;
@@ -265,29 +265,40 @@
 
 		/* option buffer */
 		p = xdr_inline_decode(xdr, 4);
-		if (unlikely(p == NULL))
-			return -ENOSPC;
+		if (unlikely(p == NULL)) {
+			err = -ENOSPC;
+			goto free_creds;
+		}
 
 		length = be32_to_cpup(p);
 		p = xdr_inline_decode(xdr, length);
-		if (unlikely(p == NULL))
-			return -ENOSPC;
+		if (unlikely(p == NULL)) {
+			err = -ENOSPC;
+			goto free_creds;
+		}
 
 		if (length == sizeof(CREDS_VALUE) &&
 		    memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {
 			/* We have creds here. parse them */
 			err = gssx_dec_linux_creds(xdr, creds);
 			if (err)
-				return err;
+				goto free_creds;
 			oa->data[0].value.len = 1; /* presence */
 		} else {
 			/* consume uninteresting buffer */
 			err = gssx_dec_buffer(xdr, &dummy);
 			if (err)
-				return err;
+				goto free_creds;
 		}
 	}
 	return 0;
+
+free_creds:
+	kfree(creds);
+free_oa:
+	kfree(oa->data);
+	oa->data = NULL;
+	return err;
 }
 
 static int gssx_dec_status(struct xdr_stream *xdr,
--- linux-qcom-6.8.0.orig/net/sunrpc/auth_gss/svcauth_gss.c
+++ linux-qcom-6.8.0/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1033,17 +1033,11 @@
 
 static void gss_free_in_token_pages(struct gssp_in_token *in_token)
 {
-	u32 inlen;
 	int i;
 
 	i = 0;
-	inlen = in_token->page_len;
-	while (inlen) {
-		if (in_token->pages[i])
-			put_page(in_token->pages[i]);
-		inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen;
-	}
-
+	while (in_token->pages[i])
+		put_page(in_token->pages[i++]);
 	kfree(in_token->pages);
 	in_token->pages = NULL;
 }
@@ -1075,7 +1069,7 @@
 		goto out_denied_free;
 
 	pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
-	in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
+	in_token->pages = kcalloc(pages + 1, sizeof(struct page *), GFP_KERNEL);
 	if (!in_token->pages)
 		goto out_denied_free;
 	in_token->page_base = 0;
--- linux-qcom-6.8.0.orig/net/sunrpc/cache.c
+++ linux-qcom-6.8.0/net/sunrpc/cache.c
@@ -1431,7 +1431,9 @@
 		seq_printf(m, "# expiry=%lld refcnt=%d flags=%lx\n",
 			   convert_to_wallclock(cp->expiry_time),
 			   kref_read(&cp->ref), cp->flags);
-	cache_get(cp);
+	if (!cache_get_rcu(cp))
+		return 0;
+
 	if (cache_check(cd, cp, NULL))
 		/* cache_check does a cache_put on failure */
 		seq_puts(m, "# ");
--- linux-qcom-6.8.0.orig/net/sunrpc/clnt.c
+++ linux-qcom-6.8.0/net/sunrpc/clnt.c
@@ -405,7 +405,7 @@
 	clnt->cl_maxproc  = version->nrprocs;
 	clnt->cl_prog     = args->prognumber ? : program->number;
 	clnt->cl_vers     = version->number;
-	clnt->cl_stats    = program->stats;
+	clnt->cl_stats    = args->stats ? : program->stats;
 	clnt->cl_metrics  = rpc_alloc_iostats(clnt);
 	rpc_init_pipe_dir_head(&clnt->cl_pipedir_objects);
 	err = -ENOMEM;
@@ -691,6 +691,7 @@
 		.version	= clnt->cl_vers,
 		.authflavor	= clnt->cl_auth->au_flavor,
 		.cred		= clnt->cl_cred,
+		.stats		= clnt->cl_stats,
 	};
 	return __rpc_clone_client(&args, clnt);
 }
@@ -713,6 +714,7 @@
 		.version	= clnt->cl_vers,
 		.authflavor	= flavor,
 		.cred		= clnt->cl_cred,
+		.stats		= clnt->cl_stats,
 	};
 	return __rpc_clone_client(&args, clnt);
 }
@@ -1068,6 +1070,8 @@
 		.version	= vers,
 		.authflavor	= old->cl_auth->au_flavor,
 		.cred		= old->cl_cred,
+		.stats		= old->cl_stats,
+		.timeout	= old->cl_timeout,
 	};
 	struct rpc_clnt *clnt;
 	int err;
@@ -2322,12 +2326,13 @@
 		task->tk_action = call_transmit;
 		task->tk_status = 0;
 		break;
-	case -ECONNREFUSED:
 	case -EHOSTDOWN:
 	case -ENETDOWN:
 	case -EHOSTUNREACH:
 	case -ENETUNREACH:
 	case -EPERM:
+		break;
+	case -ECONNREFUSED:
 		if (RPC_IS_SOFTCONN(task)) {
 			if (!task->tk_msg.rpc_proc->p_proc)
 				trace_xprt_ping(task->tk_xprt,
--- linux-qcom-6.8.0.orig/net/sunrpc/sched.c
+++ linux-qcom-6.8.0/net/sunrpc/sched.c
@@ -369,8 +369,10 @@
 	if (RPC_IS_ASYNC(task)) {
 		INIT_WORK(&task->u.tk_work, rpc_async_schedule);
 		queue_work(wq, &task->u.tk_work);
-	} else
+	} else {
+		smp_mb__after_atomic();
 		wake_up_bit(&task->tk_runstate, RPC_TASK_QUEUED);
+	}
 }
 
 /*
--- linux-qcom-6.8.0.orig/net/sunrpc/stats.c
+++ linux-qcom-6.8.0/net/sunrpc/stats.c
@@ -314,7 +314,7 @@
 struct proc_dir_entry *
 svc_proc_register(struct net *net, struct svc_stat *statp, const struct proc_ops *proc_ops)
 {
-	return do_register(net, statp->program->pg_name, statp, proc_ops);
+	return do_register(net, statp->program->pg_name, net, proc_ops);
 }
 EXPORT_SYMBOL_GPL(svc_proc_register);
 
--- linux-qcom-6.8.0.orig/net/sunrpc/svc.c
+++ linux-qcom-6.8.0/net/sunrpc/svc.c
@@ -451,8 +451,8 @@
  * Create an RPC service
  */
 static struct svc_serv *
-__svc_create(struct svc_program *prog, unsigned int bufsize, int npools,
-	     int (*threadfn)(void *data))
+__svc_create(struct svc_program *prog, struct svc_stat *stats,
+	     unsigned int bufsize, int npools, int (*threadfn)(void *data))
 {
 	struct svc_serv	*serv;
 	unsigned int vers;
@@ -463,7 +463,7 @@
 		return NULL;
 	serv->sv_name      = prog->pg_name;
 	serv->sv_program   = prog;
-	serv->sv_stats     = prog->pg_stats;
+	serv->sv_stats     = stats;
 	if (bufsize > RPCSVC_MAXPAYLOAD)
 		bufsize = RPCSVC_MAXPAYLOAD;
 	serv->sv_max_payload = bufsize? bufsize : 4096;
@@ -529,26 +529,28 @@
 struct svc_serv *svc_create(struct svc_program *prog, unsigned int bufsize,
 			    int (*threadfn)(void *data))
 {
-	return __svc_create(prog, bufsize, 1, threadfn);
+	return __svc_create(prog, NULL, bufsize, 1, threadfn);
 }
 EXPORT_SYMBOL_GPL(svc_create);
 
 /**
  * svc_create_pooled - Create an RPC service with pooled threads
  * @prog: the RPC program the new service will handle
+ * @stats: the stats struct if desired
  * @bufsize: maximum message size for @prog
  * @threadfn: a function to service RPC requests for @prog
  *
  * Returns an instantiated struct svc_serv object or NULL.
  */
 struct svc_serv *svc_create_pooled(struct svc_program *prog,
+				   struct svc_stat *stats,
 				   unsigned int bufsize,
 				   int (*threadfn)(void *data))
 {
 	struct svc_serv *serv;
 	unsigned int npools = svc_pool_map_get();
 
-	serv = __svc_create(prog, bufsize, npools, threadfn);
+	serv = __svc_create(prog, stats, bufsize, npools, threadfn);
 	if (!serv)
 		goto out_err;
 	return serv;
@@ -680,7 +682,7 @@
 	serv->sv_nrthreads += 1;
 	spin_unlock_bh(&serv->sv_lock);
 
-	atomic_inc(&pool->sp_nrthreads);
+	pool->sp_nrthreads += 1;
 
 	/* Protected by whatever lock the service uses when calling
 	 * svc_set_num_threads()
@@ -735,31 +737,22 @@
 	struct svc_pool *pool;
 	unsigned int i;
 
-retry:
 	pool = target_pool;
 
-	if (pool != NULL) {
-		if (atomic_inc_not_zero(&pool->sp_nrthreads))
-			goto found_pool;
-		return NULL;
-	} else {
+	if (!pool) {
 		for (i = 0; i < serv->sv_nrpools; i++) {
 			pool = &serv->sv_pools[--(*state) % serv->sv_nrpools];
-			if (atomic_inc_not_zero(&pool->sp_nrthreads))
-				goto found_pool;
+			if (pool->sp_nrthreads)
+				break;
 		}
-		return NULL;
 	}
 
-found_pool:
-	set_bit(SP_VICTIM_REMAINS, &pool->sp_flags);
-	set_bit(SP_NEED_VICTIM, &pool->sp_flags);
-	if (!atomic_dec_and_test(&pool->sp_nrthreads))
+	if (pool && pool->sp_nrthreads) {
+		set_bit(SP_VICTIM_REMAINS, &pool->sp_flags);
+		set_bit(SP_NEED_VICTIM, &pool->sp_flags);
 		return pool;
-	/* Nothing left in this pool any more */
-	clear_bit(SP_NEED_VICTIM, &pool->sp_flags);
-	clear_bit(SP_VICTIM_REMAINS, &pool->sp_flags);
-	goto retry;
+	}
+	return NULL;
 }
 
 static int
@@ -838,7 +831,7 @@
 	if (!pool)
 		nrservs -= serv->sv_nrthreads;
 	else
-		nrservs -= atomic_read(&pool->sp_nrthreads);
+		nrservs -= pool->sp_nrthreads;
 
 	if (nrservs > 0)
 		return svc_start_kthreads(serv, pool, nrservs);
@@ -926,7 +919,7 @@
 
 	list_del_rcu(&rqstp->rq_all);
 
-	atomic_dec(&pool->sp_nrthreads);
+	pool->sp_nrthreads -= 1;
 
 	spin_lock_bh(&serv->sv_lock);
 	serv->sv_nrthreads -= 1;
@@ -1263,8 +1256,6 @@
 	if (rqstp->rq_proc >= versp->vs_nproc)
 		goto err_bad_proc;
 	rqstp->rq_procinfo = procp = &versp->vs_proc[rqstp->rq_proc];
-	if (!procp)
-		goto err_bad_proc;
 
 	/* Initialize storage for argp and resp */
 	memset(rqstp->rq_argp, 0, procp->pc_argzero);
@@ -1375,7 +1366,8 @@
 		goto err_bad_proc;
 
 	/* Syntactic check complete */
-	serv->sv_stats->rpccnt++;
+	if (serv->sv_stats)
+		serv->sv_stats->rpccnt++;
 	trace_svc_process(rqstp, progp->pg_name);
 
 	aoffset = xdr_stream_pos(xdr);
@@ -1427,7 +1419,8 @@
 	goto close_xprt;
 
 err_bad_rpc:
-	serv->sv_stats->rpcbadfmt++;
+	if (serv->sv_stats)
+		serv->sv_stats->rpcbadfmt++;
 	xdr_stream_encode_u32(xdr, RPC_MSG_DENIED);
 	xdr_stream_encode_u32(xdr, RPC_MISMATCH);
 	/* Only RPCv2 supported */
@@ -1438,7 +1431,8 @@
 err_bad_auth:
 	dprintk("svc: authentication failed (%d)\n",
 		be32_to_cpu(rqstp->rq_auth_stat));
-	serv->sv_stats->rpcbadauth++;
+	if (serv->sv_stats)
+		serv->sv_stats->rpcbadauth++;
 	/* Restore write pointer to location of reply status: */
 	xdr_truncate_encode(xdr, XDR_UNIT * 2);
 	xdr_stream_encode_u32(xdr, RPC_MSG_DENIED);
@@ -1448,7 +1442,8 @@
 
 err_bad_prog:
 	dprintk("svc: unknown program %d\n", rqstp->rq_prog);
-	serv->sv_stats->rpcbadfmt++;
+	if (serv->sv_stats)
+		serv->sv_stats->rpcbadfmt++;
 	*rqstp->rq_accept_statp = rpc_prog_unavail;
 	goto sendit;
 
@@ -1456,7 +1451,8 @@
 	svc_printk(rqstp, "unknown version (%d for prog %d, %s)\n",
 		       rqstp->rq_vers, rqstp->rq_prog, progp->pg_name);
 
-	serv->sv_stats->rpcbadfmt++;
+	if (serv->sv_stats)
+		serv->sv_stats->rpcbadfmt++;
 	*rqstp->rq_accept_statp = rpc_prog_mismatch;
 
 	/*
@@ -1470,19 +1466,22 @@
 err_bad_proc:
 	svc_printk(rqstp, "unknown procedure (%d)\n", rqstp->rq_proc);
 
-	serv->sv_stats->rpcbadfmt++;
+	if (serv->sv_stats)
+		serv->sv_stats->rpcbadfmt++;
 	*rqstp->rq_accept_statp = rpc_proc_unavail;
 	goto sendit;
 
 err_garbage_args:
 	svc_printk(rqstp, "failed to decode RPC header\n");
 
-	serv->sv_stats->rpcbadfmt++;
+	if (serv->sv_stats)
+		serv->sv_stats->rpcbadfmt++;
 	*rqstp->rq_accept_statp = rpc_garbage_args;
 	goto sendit;
 
 err_system_err:
-	serv->sv_stats->rpcbadfmt++;
+	if (serv->sv_stats)
+		serv->sv_stats->rpcbadfmt++;
 	*rqstp->rq_accept_statp = rpc_system_err;
 	goto sendit;
 }
@@ -1534,7 +1533,8 @@
 out_baddir:
 	svc_printk(rqstp, "bad direction 0x%08x, dropping request\n",
 		   be32_to_cpu(*p));
-	rqstp->rq_server->sv_stats->rpcbadfmt++;
+	if (rqstp->rq_server->sv_stats)
+		rqstp->rq_server->sv_stats->rpcbadfmt++;
 out_drop:
 	svc_drop(rqstp);
 }
@@ -1548,9 +1548,11 @@
  */
 void svc_process_bc(struct rpc_rqst *req, struct svc_rqst *rqstp)
 {
+	struct rpc_timeout timeout = {
+		.to_increment		= 0,
+	};
 	struct rpc_task *task;
 	int proc_error;
-	struct rpc_timeout timeout;
 
 	/* Build the svc_rqst used by the common processing routine */
 	rqstp->rq_xid = req->rq_xid;
@@ -1603,6 +1605,7 @@
 		timeout.to_initval = req->rq_xprt->timeout->to_initval;
 		timeout.to_retries = req->rq_xprt->timeout->to_retries;
 	}
+	timeout.to_maxval = timeout.to_initval;
 	memcpy(&req->rq_snd_buf, &rqstp->rq_res, sizeof(req->rq_snd_buf));
 	task = rpc_run_bc_task(req, &timeout);
 
--- linux-qcom-6.8.0.orig/net/sunrpc/svcsock.c
+++ linux-qcom-6.8.0/net/sunrpc/svcsock.c
@@ -1206,15 +1206,6 @@
  * MSG_SPLICE_PAGES is used exclusively to reduce the number of
  * copy operations in this path. Therefore the caller must ensure
  * that the pages backing @xdr are unchanging.
- *
- * Note that the send is non-blocking. The caller has incremented
- * the reference count on each page backing the RPC message, and
- * the network layer will "put" these pages when transmission is
- * complete.
- *
- * This is safe for our RPC services because the memory backing
- * the head and tail components is never kmalloc'd. These always
- * come from pages in the svc_rqst::rq_pages array.
  */
 static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp,
 			   rpc_fraghdr marker, unsigned int *sentp)
@@ -1244,6 +1235,7 @@
 	iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, rqstp->rq_bvec,
 		      1 + count, sizeof(marker) + rqstp->rq_res.len);
 	ret = sock_sendmsg(svsk->sk_sock, &msg);
+	page_frag_free(buf);
 	if (ret < 0)
 		return ret;
 	*sentp += ret;
@@ -1560,6 +1552,10 @@
 	newlen = error;
 
 	if (protocol == IPPROTO_TCP) {
+		__netns_tracker_free(net, &sock->sk->ns_tracker, false);
+		sock->sk->sk_net_refcnt = 1;
+		get_net_track(net, &sock->sk->ns_tracker, GFP_KERNEL);
+		sock_inuse_add(net, 1);
 		if ((error = kernel_listen(sock, 64)) < 0)
 			goto bummer;
 	}
--- linux-qcom-6.8.0.orig/net/sunrpc/xprtrdma/frwr_ops.c
+++ linux-qcom-6.8.0/net/sunrpc/xprtrdma/frwr_ops.c
@@ -92,7 +92,8 @@
 	rpcrdma_mr_push(mr, &mr->mr_req->rl_free_mrs);
 }
 
-/* frwr_reset - Place MRs back on the free list
+/**
+ * frwr_reset - Place MRs back on @req's free list
  * @req: request to reset
  *
  * Used after a failed marshal. For FRWR, this means the MRs
--- linux-qcom-6.8.0.orig/net/sunrpc/xprtrdma/svc_rdma.c
+++ linux-qcom-6.8.0/net/sunrpc/xprtrdma/svc_rdma.c
@@ -234,25 +234,34 @@
 
 	rc = percpu_counter_init(&svcrdma_stat_read, 0, GFP_KERNEL);
 	if (rc)
-		goto out_err;
+		goto err;
 	rc = percpu_counter_init(&svcrdma_stat_recv, 0, GFP_KERNEL);
 	if (rc)
-		goto out_err;
+		goto err_read;
 	rc = percpu_counter_init(&svcrdma_stat_sq_starve, 0, GFP_KERNEL);
 	if (rc)
-		goto out_err;
+		goto err_recv;
 	rc = percpu_counter_init(&svcrdma_stat_write, 0, GFP_KERNEL);
 	if (rc)
-		goto out_err;
+		goto err_sq;
 
 	svcrdma_table_header = register_sysctl("sunrpc/svc_rdma",
 					       svcrdma_parm_table);
+	if (!svcrdma_table_header)
+		goto err_write;
+
 	return 0;
 
-out_err:
+err_write:
+	rc = -ENOMEM;
+	percpu_counter_destroy(&svcrdma_stat_write);
+err_sq:
 	percpu_counter_destroy(&svcrdma_stat_sq_starve);
+err_recv:
 	percpu_counter_destroy(&svcrdma_stat_recv);
+err_read:
 	percpu_counter_destroy(&svcrdma_stat_read);
+err:
 	return rc;
 }
 
--- linux-qcom-6.8.0.orig/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ linux-qcom-6.8.0/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -493,7 +493,13 @@
 	if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
 		return false;
 
-	/* A bogus segcount causes this buffer overflow check to fail. */
+	/* Before trusting the segcount value enough to use it in
+	 * a computation, perform a simple range check. This is an
+	 * arbitrary but sensible limit (ie, not architectural).
+	 */
+	if (unlikely(segcount > RPCSVC_MAXPAGES))
+		return false;
+
 	p = xdr_inline_decode(&rctxt->rc_stream,
 			      segcount * rpcrdma_segment_maxsz * sizeof(*p));
 	return p != NULL;
--- linux-qcom-6.8.0.orig/net/sunrpc/xprtrdma/verbs.c
+++ linux-qcom-6.8.0/net/sunrpc/xprtrdma/verbs.c
@@ -244,7 +244,11 @@
 	case RDMA_CM_EVENT_DEVICE_REMOVAL:
 		pr_info("rpcrdma: removing device %s for %pISpc\n",
 			ep->re_id->device->name, sap);
-		fallthrough;
+		switch (xchg(&ep->re_connect_status, -ENODEV)) {
+		case 0: goto wake_connect_worker;
+		case 1: goto disconnected;
+		}
+		return 0;
 	case RDMA_CM_EVENT_ADDR_CHANGE:
 		ep->re_connect_status = -ENODEV;
 		goto disconnected;
@@ -893,6 +897,8 @@
 
 static void rpcrdma_req_reset(struct rpcrdma_req *req)
 {
+	struct rpcrdma_mr *mr;
+
 	/* Credits are valid for only one connection */
 	req->rl_slot.rq_cong = 0;
 
@@ -902,7 +908,19 @@
 	rpcrdma_regbuf_dma_unmap(req->rl_sendbuf);
 	rpcrdma_regbuf_dma_unmap(req->rl_recvbuf);
 
-	frwr_reset(req);
+	/* The verbs consumer can't know the state of an MR on the
+	 * req->rl_registered list unless a successful completion
+	 * has occurred, so they cannot be re-used.
+	 */
+	while ((mr = rpcrdma_mr_pop(&req->rl_registered))) {
+		struct rpcrdma_buffer *buf = &mr->mr_xprt->rx_buf;
+
+		spin_lock(&buf->rb_lock);
+		list_del(&mr->mr_all);
+		spin_unlock(&buf->rb_lock);
+
+		frwr_mr_release(mr);
+	}
 }
 
 /* ASSUMPTION: the rb_allreqs list is stable for the duration,
--- linux-qcom-6.8.0.orig/net/sunrpc/xprtsock.c
+++ linux-qcom-6.8.0/net/sunrpc/xprtsock.c
@@ -1187,6 +1187,7 @@
 	clear_bit(XPRT_SOCK_WAKE_WRITE, &transport->sock_state);
 	clear_bit(XPRT_SOCK_WAKE_DISCONNECT, &transport->sock_state);
 	clear_bit(XPRT_SOCK_NOSPACE, &transport->sock_state);
+	clear_bit(XPRT_SOCK_UPD_TIMEOUT, &transport->sock_state);
 }
 
 static void xs_run_error_worker(struct sock_xprt *transport, unsigned int nr)
@@ -1921,6 +1922,13 @@
 		goto out;
 	}
 
+	if (protocol == IPPROTO_TCP) {
+		__netns_tracker_free(xprt->xprt_net, &sock->sk->ns_tracker, false);
+		sock->sk->sk_net_refcnt = 1;
+		get_net_track(xprt->xprt_net, &sock->sk->ns_tracker, GFP_KERNEL);
+		sock_inuse_add(xprt->xprt_net, 1);
+	}
+
 	filp = sock_alloc_file(sock, O_NONBLOCK, NULL);
 	if (IS_ERR(filp))
 		return ERR_CAST(filp);
@@ -2423,6 +2431,13 @@
 		transport->srcport = 0;
 		status = -EAGAIN;
 		break;
+	case -EPERM:
+		/* Happens, for instance, if a BPF program is preventing
+		 * the connect. Remap the error so upper layers can better
+		 * deal with it.
+		 */
+		status = -ECONNREFUSED;
+		fallthrough;
 	case -EINVAL:
 		/* Happens, for instance, if the user specified a link
 		 * local IPv6 address without a scope-id.
@@ -2434,6 +2449,7 @@
 	case -EHOSTUNREACH:
 	case -EADDRINUSE:
 	case -ENOBUFS:
+	case -ENOTCONN:
 		break;
 	default:
 		printk("%s: connect returned unhandled error %d\n",
@@ -2588,11 +2604,10 @@
 	rc = wait_for_completion_interruptible_timeout(&lower_transport->handshake_done,
 						       XS_TLS_HANDSHAKE_TO);
 	if (rc <= 0) {
-		if (!tls_handshake_cancel(sk)) {
-			if (rc == 0)
-				rc = -ETIMEDOUT;
-			goto out_put_xprt;
-		}
+		tls_handshake_cancel(sk);
+		if (rc == 0)
+			rc = -ETIMEDOUT;
+		goto out_put_xprt;
 	}
 
 	rc = lower_transport->xprt_err;
@@ -2645,6 +2660,7 @@
 		.xprtsec	= {
 			.policy		= RPC_XPRTSEC_NONE,
 		},
+		.stats		= upper_clnt->cl_stats,
 	};
 	unsigned int pflags = current->flags;
 	struct rpc_clnt *lower_clnt;
--- linux-qcom-6.8.0.orig/net/sysctl_net.c
+++ linux-qcom-6.8.0/net/sysctl_net.c
@@ -54,7 +54,6 @@
 }
 
 static void net_ctl_set_ownership(struct ctl_table_header *head,
-				  struct ctl_table *table,
 				  kuid_t *uid, kgid_t *gid)
 {
 	struct net *net = container_of(head->set, struct net, sysctls);
--- linux-qcom-6.8.0.orig/net/tipc/bcast.c
+++ linux-qcom-6.8.0/net/tipc/bcast.c
@@ -320,8 +320,8 @@
 {
 	struct tipc_msg *hdr, *_hdr;
 	struct sk_buff_head tmpq;
+	u16 cong_link_cnt = 0;
 	struct sk_buff *_skb;
-	u16 cong_link_cnt;
 	int rc = 0;
 
 	/* Is a cluster supporting with new capabilities ? */
--- linux-qcom-6.8.0.orig/net/tipc/bearer.c
+++ linux-qcom-6.8.0/net/tipc/bearer.c
@@ -163,8 +163,12 @@
 
 	/* return bearer name components, if necessary */
 	if (name_parts) {
-		strcpy(name_parts->media_name, media_name);
-		strcpy(name_parts->if_name, if_name);
+		if (strscpy(name_parts->media_name, media_name,
+			    TIPC_MAX_MEDIA_NAME) < 0)
+			return 0;
+		if (strscpy(name_parts->if_name, if_name,
+			    TIPC_MAX_IF_NAME) < 0)
+			return 0;
 	}
 	return 1;
 }
--- linux-qcom-6.8.0.orig/net/tipc/diag.c
+++ linux-qcom-6.8.0/net/tipc/diag.c
@@ -95,6 +95,7 @@
 }
 
 static const struct sock_diag_handler tipc_sock_diag_handler = {
+	.owner = THIS_MODULE,
 	.family = AF_TIPC,
 	.dump = tipc_sock_diag_handler_dump,
 };
--- linux-qcom-6.8.0.orig/net/tipc/msg.c
+++ linux-qcom-6.8.0/net/tipc/msg.c
@@ -142,9 +142,9 @@
 	if (fragid == FIRST_FRAGMENT) {
 		if (unlikely(head))
 			goto err;
-		*buf = NULL;
 		if (skb_has_frag_list(frag) && __skb_linearize(frag))
 			goto err;
+		*buf = NULL;
 		frag = skb_unshare(frag, GFP_ATOMIC);
 		if (unlikely(!frag))
 			goto err;
@@ -156,6 +156,11 @@
 	if (!head)
 		goto err;
 
+	/* Either the input skb ownership is transferred to headskb
+	 * or the input skb is freed, clear the reference to avoid
+	 * bad access on error path.
+	 */
+	*buf = NULL;
 	if (skb_try_coalesce(head, frag, &headstolen, &delta)) {
 		kfree_skb_partial(frag, headstolen);
 	} else {
@@ -179,7 +184,6 @@
 		*headbuf = NULL;
 		return 1;
 	}
-	*buf = NULL;
 	return 0;
 err:
 	kfree_skb(*buf);
--- linux-qcom-6.8.0.orig/net/tipc/node.c
+++ linux-qcom-6.8.0/net/tipc/node.c
@@ -2107,6 +2107,7 @@
 	} else {
 		n = tipc_node_find_by_id(net, ehdr->id);
 	}
+	skb_dst_force(skb);
 	tipc_crypto_rcv(net, (n) ? n->crypto_rx : NULL, &skb, b);
 	if (!skb)
 		return;
--- linux-qcom-6.8.0.orig/net/tipc/udp_media.c
+++ linux-qcom-6.8.0/net/tipc/udp_media.c
@@ -135,8 +135,11 @@
 		snprintf(buf, size, "%pI4:%u", &ua->ipv4, ntohs(ua->port));
 	else if (ntohs(ua->proto) == ETH_P_IPV6)
 		snprintf(buf, size, "%pI6:%u", &ua->ipv6, ntohs(ua->port));
-	else
+	else {
 		pr_err("Invalid UDP media address\n");
+		return 1;
+	}
+
 	return 0;
 }
 
@@ -174,7 +177,7 @@
 	local_bh_disable();
 	ndst = dst_cache_get(cache);
 	if (dst->proto == htons(ETH_P_IP)) {
-		struct rtable *rt = (struct rtable *)ndst;
+		struct rtable *rt = dst_rtable(ndst);
 
 		if (!rt) {
 			struct flowi4 fl = {
@@ -804,6 +807,7 @@
 {
 	struct udp_bearer *ub = container_of(work, struct udp_bearer, work);
 	struct udp_replicast *rcast, *tmp;
+	struct tipc_net *tn;
 
 	list_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) {
 		dst_cache_destroy(&rcast->dst_cache);
@@ -811,10 +815,14 @@
 		kfree_rcu(rcast, rcu);
 	}
 
-	atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);
+	tn = tipc_net(sock_net(ub->ubsock->sk));
+
 	dst_cache_destroy(&ub->rcast.dst_cache);
 	udp_tunnel_sock_release(ub->ubsock);
+
+	/* Note: could use a call_rcu() to avoid another synchronize_net() */
 	synchronize_net();
+	atomic_dec(&tn->wq_count);
 	kfree(ub);
 }
 
--- linux-qcom-6.8.0.orig/net/tls/tls.h
+++ linux-qcom-6.8.0/net/tls/tls.h
@@ -215,7 +215,7 @@
 
 static inline bool tls_strp_msg_ready(struct tls_sw_context_rx *ctx)
 {
-	return ctx->strp.msg_ready;
+	return READ_ONCE(ctx->strp.msg_ready);
 }
 
 static inline bool tls_strp_msg_mixed_decrypted(struct tls_sw_context_rx *ctx)
--- linux-qcom-6.8.0.orig/net/tls/tls_main.c
+++ linux-qcom-6.8.0/net/tls/tls_main.c
@@ -816,9 +816,17 @@
 		return NULL;
 
 	mutex_init(&ctx->tx_lock);
-	rcu_assign_pointer(icsk->icsk_ulp_data, ctx);
 	ctx->sk_proto = READ_ONCE(sk->sk_prot);
 	ctx->sk = sk;
+	/* Release semantic of rcu_assign_pointer() ensures that
+	 * ctx->sk_proto is visible before changing sk->sk_prot in
+	 * update_sk_prot(), and prevents reading uninitialized value in
+	 * tls_{getsockopt, setsockopt}. Note that we do not need a
+	 * read barrier in tls_{getsockopt,setsockopt} as there is an
+	 * address dependency between sk->sk_proto->{getsockopt,setsockopt}
+	 * and ctx->sk_proto.
+	 */
+	rcu_assign_pointer(icsk->icsk_ulp_data, ctx);
 	return ctx;
 }
 
--- linux-qcom-6.8.0.orig/net/tls/tls_strp.c
+++ linux-qcom-6.8.0/net/tls/tls_strp.c
@@ -360,7 +360,7 @@
 	if (strp->stm.full_len && strp->stm.full_len == skb->len) {
 		desc->count = 0;
 
-		strp->msg_ready = 1;
+		WRITE_ONCE(strp->msg_ready, 1);
 		tls_rx_msg_ready(strp);
 	}
 
@@ -528,7 +528,7 @@
 	if (!tls_strp_check_queue_ok(strp))
 		return tls_strp_read_copy(strp, false);
 
-	strp->msg_ready = 1;
+	WRITE_ONCE(strp->msg_ready, 1);
 	tls_rx_msg_ready(strp);
 
 	return 0;
@@ -580,7 +580,7 @@
 	else
 		tls_strp_flush_anchor_copy(strp);
 
-	strp->msg_ready = 0;
+	WRITE_ONCE(strp->msg_ready, 0);
 	memset(&strp->stm, 0, sizeof(strp->stm));
 
 	tls_strp_check_rcv(strp);
--- linux-qcom-6.8.0.orig/net/tls/tls_sw.c
+++ linux-qcom-6.8.0/net/tls/tls_sw.c
@@ -458,7 +458,7 @@
 
 tx_err:
 	if (rc < 0 && rc != -EAGAIN)
-		tls_err_abort(sk, -EBADMSG);
+		tls_err_abort(sk, rc);
 
 	return rc;
 }
@@ -1976,10 +1976,10 @@
 	if (unlikely(flags & MSG_ERRQUEUE))
 		return sock_recv_errqueue(sk, msg, len, SOL_IP, IP_RECVERR);
 
-	psock = sk_psock_get(sk);
 	err = tls_rx_reader_lock(sk, ctx, flags & MSG_DONTWAIT);
 	if (err < 0)
 		return err;
+	psock = sk_psock_get(sk);
 	bpf_strp_enabled = sk_psock_strp_enabled(psock);
 
 	/* If crypto failed the connection is broken */
@@ -2152,12 +2152,15 @@
 		}
 
 		/* Drain records from the rx_list & copy if required */
-		if (is_peek || is_kvec)
+		if (is_peek)
 			err = process_rx_list(ctx, msg, &control, copied + peeked,
 					      decrypted - peeked, is_peek, NULL);
 		else
 			err = process_rx_list(ctx, msg, &control, 0,
 					      async_copy_bytes, is_peek, NULL);
+
+		/* we could have copied less than we wanted, and possibly nothing */
+		decrypted += max(err, 0) - async_copy_bytes;
 	}
 
 	copied += decrypted;
--- linux-qcom-6.8.0.orig/net/unix/af_unix.c
+++ linux-qcom-6.8.0/net/unix/af_unix.c
@@ -223,15 +223,9 @@
 	return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
 }
 
-static inline int unix_recvq_full(const struct sock *sk)
-{
-	return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
-}
-
 static inline int unix_recvq_full_lockless(const struct sock *sk)
 {
-	return skb_queue_len_lockless(&sk->sk_receive_queue) >
-		READ_ONCE(sk->sk_max_ack_backlog);
+	return skb_queue_len_lockless(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
 }
 
 struct sock *unix_peer_get(struct sock *s)
@@ -532,10 +526,10 @@
 	return 0;
 }
 
-static int unix_writable(const struct sock *sk)
+static int unix_writable(const struct sock *sk, unsigned char state)
 {
-	return sk->sk_state != TCP_LISTEN &&
-	       (refcount_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
+	return state != TCP_LISTEN &&
+		(refcount_read(&sk->sk_wmem_alloc) << 2) <= READ_ONCE(sk->sk_sndbuf);
 }
 
 static void unix_write_space(struct sock *sk)
@@ -543,7 +537,7 @@
 	struct socket_wq *wq;
 
 	rcu_read_lock();
-	if (unix_writable(sk)) {
+	if (unix_writable(sk, READ_ONCE(sk->sk_state))) {
 		wq = rcu_dereference(sk->sk_wq);
 		if (skwq_has_sleeper(wq))
 			wake_up_interruptible_sync_poll(&wq->wait,
@@ -572,7 +566,6 @@
 			sk_error_report(other);
 		}
 	}
-	other->sk_state = TCP_CLOSE;
 }
 
 static void unix_sock_destructor(struct sock *sk)
@@ -619,7 +612,7 @@
 	u->path.dentry = NULL;
 	u->path.mnt = NULL;
 	state = sk->sk_state;
-	sk->sk_state = TCP_CLOSE;
+	WRITE_ONCE(sk->sk_state, TCP_CLOSE);
 
 	skpair = unix_peer(sk);
 	unix_peer(sk) = NULL;
@@ -627,10 +620,7 @@
 	unix_state_unlock(sk);
 
 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
-	if (u->oob_skb) {
-		kfree_skb(u->oob_skb);
-		u->oob_skb = NULL;
-	}
+	u->oob_skb = NULL;
 #endif
 
 	wake_up_interruptible_all(&u->peer_wait);
@@ -640,7 +630,7 @@
 			unix_state_lock(skpair);
 			/* No more writes */
 			WRITE_ONCE(skpair->sk_shutdown, SHUTDOWN_MASK);
-			if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)
+			if (!skb_queue_empty_lockless(&sk->sk_receive_queue) || embrion)
 				WRITE_ONCE(skpair->sk_err, ECONNRESET);
 			unix_state_unlock(skpair);
 			skpair->sk_state_change(skpair);
@@ -701,9 +691,6 @@
 
 static void copy_peercred(struct sock *sk, struct sock *peersk)
 {
-	const struct cred *old_cred;
-	struct pid *old_pid;
-
 	if (sk < peersk) {
 		spin_lock(&sk->sk_peer_lock);
 		spin_lock_nested(&peersk->sk_peer_lock, SINGLE_DEPTH_NESTING);
@@ -711,16 +698,12 @@
 		spin_lock(&peersk->sk_peer_lock);
 		spin_lock_nested(&sk->sk_peer_lock, SINGLE_DEPTH_NESTING);
 	}
-	old_pid = sk->sk_peer_pid;
-	old_cred = sk->sk_peer_cred;
+
 	sk->sk_peer_pid  = get_pid(peersk->sk_peer_pid);
 	sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);
 
 	spin_unlock(&sk->sk_peer_lock);
 	spin_unlock(&peersk->sk_peer_lock);
-
-	put_pid(old_pid);
-	put_cred(old_cred);
 }
 
 static int unix_listen(struct socket *sock, int backlog)
@@ -733,7 +716,7 @@
 	if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
 		goto out;	/* Only stream/seqpacket sockets accept */
 	err = -EINVAL;
-	if (!u->addr)
+	if (!READ_ONCE(u->addr))
 		goto out;	/* No listens on an unbound socket */
 	unix_state_lock(sk);
 	if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)
@@ -741,7 +724,8 @@
 	if (backlog > sk->sk_max_ack_backlog)
 		wake_up_interruptible_all(&u->peer_wait);
 	sk->sk_max_ack_backlog	= backlog;
-	sk->sk_state		= TCP_LISTEN;
+	WRITE_ONCE(sk->sk_state, TCP_LISTEN);
+
 	/* set credentials so connect can copy them */
 	init_peercred(sk);
 	err = 0;
@@ -978,13 +962,13 @@
 	sk->sk_hash		= unix_unbound_hash(sk);
 	sk->sk_allocation	= GFP_KERNEL_ACCOUNT;
 	sk->sk_write_space	= unix_write_space;
-	sk->sk_max_ack_backlog	= net->unx.sysctl_max_dgram_qlen;
+	sk->sk_max_ack_backlog	= READ_ONCE(net->unx.sysctl_max_dgram_qlen);
 	sk->sk_destruct		= unix_sock_destructor;
-	u	  = unix_sk(sk);
+	u = unix_sk(sk);
+	u->inflight = 0;
 	u->path.dentry = NULL;
 	u->path.mnt = NULL;
 	spin_lock_init(&u->lock);
-	atomic_long_set(&u->inflight, 0);
 	INIT_LIST_HEAD(&u->link);
 	mutex_init(&u->iolock); /* single task reading lock */
 	mutex_init(&u->bindlock); /* single task binding lock */
@@ -1133,8 +1117,8 @@
 
 static int unix_autobind(struct sock *sk)
 {
-	unsigned int new_hash, old_hash = sk->sk_hash;
 	struct unix_sock *u = unix_sk(sk);
+	unsigned int new_hash, old_hash;
 	struct net *net = sock_net(sk);
 	struct unix_address *addr;
 	u32 lastnum, ordernum;
@@ -1157,6 +1141,7 @@
 	addr->name->sun_family = AF_UNIX;
 	refcount_set(&addr->refcnt, 1);
 
+	old_hash = sk->sk_hash;
 	ordernum = get_random_u32();
 	lastnum = ordernum & 0xFFFFF;
 retry:
@@ -1197,8 +1182,8 @@
 {
 	umode_t mode = S_IFSOCK |
 	       (SOCK_INODE(sk->sk_socket)->i_mode & ~current_umask());
-	unsigned int new_hash, old_hash = sk->sk_hash;
 	struct unix_sock *u = unix_sk(sk);
+	unsigned int new_hash, old_hash;
 	struct net *net = sock_net(sk);
 	struct mnt_idmap *idmap;
 	struct unix_address *addr;
@@ -1236,6 +1221,7 @@
 	if (u->addr)
 		goto out_unlock;
 
+	old_hash = sk->sk_hash;
 	new_hash = unix_bsd_hash(d_backing_inode(dentry));
 	unix_table_double_lock(net, old_hash, new_hash);
 	u->path.mnt = mntget(parent.mnt);
@@ -1263,8 +1249,8 @@
 static int unix_bind_abstract(struct sock *sk, struct sockaddr_un *sunaddr,
 			      int addr_len)
 {
-	unsigned int new_hash, old_hash = sk->sk_hash;
 	struct unix_sock *u = unix_sk(sk);
+	unsigned int new_hash, old_hash;
 	struct net *net = sock_net(sk);
 	struct unix_address *addr;
 	int err;
@@ -1282,6 +1268,7 @@
 		goto out_mutex;
 	}
 
+	old_hash = sk->sk_hash;
 	new_hash = unix_abstract_hash(addr->name, addr->len, sk->sk_type);
 	unix_table_double_lock(net, old_hash, new_hash);
 
@@ -1371,7 +1358,7 @@
 
 		if ((test_bit(SOCK_PASSCRED, &sock->flags) ||
 		     test_bit(SOCK_PASSPIDFD, &sock->flags)) &&
-		    !unix_sk(sk)->addr) {
+		    !READ_ONCE(unix_sk(sk)->addr)) {
 			err = unix_autobind(sk);
 			if (err)
 				goto out;
@@ -1401,7 +1388,8 @@
 		if (err)
 			goto out_unlock;
 
-		sk->sk_state = other->sk_state = TCP_ESTABLISHED;
+		WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED);
+		WRITE_ONCE(other->sk_state, TCP_ESTABLISHED);
 	} else {
 		/*
 		 *	1003.1g breaking connected state with AF_UNSPEC
@@ -1418,13 +1406,20 @@
 
 		unix_peer(sk) = other;
 		if (!other)
-			sk->sk_state = TCP_CLOSE;
+			WRITE_ONCE(sk->sk_state, TCP_CLOSE);
 		unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer);
 
 		unix_state_double_unlock(sk, other);
 
-		if (other != old_peer)
+		if (other != old_peer) {
 			unix_dgram_disconnected(sk, old_peer);
+
+			unix_state_lock(old_peer);
+			if (!unix_peer(old_peer))
+				WRITE_ONCE(old_peer->sk_state, TCP_CLOSE);
+			unix_state_unlock(old_peer);
+		}
+
 		sock_put(old_peer);
 	} else {
 		unix_peer(sk) = other;
@@ -1470,9 +1465,9 @@
 	struct unix_sock *u = unix_sk(sk), *newu, *otheru;
 	struct net *net = sock_net(sk);
 	struct sk_buff *skb = NULL;
+	unsigned char state;
 	long timeo;
 	int err;
-	int st;
 
 	err = unix_validate_addr(sunaddr, addr_len);
 	if (err)
@@ -1483,7 +1478,8 @@
 		goto out;
 
 	if ((test_bit(SOCK_PASSCRED, &sock->flags) ||
-	     test_bit(SOCK_PASSPIDFD, &sock->flags)) && !u->addr) {
+	     test_bit(SOCK_PASSPIDFD, &sock->flags)) &&
+	    !READ_ONCE(u->addr)) {
 		err = unix_autobind(sk);
 		if (err)
 			goto out;
@@ -1520,7 +1516,6 @@
 		goto out;
 	}
 
-	/* Latch state of peer */
 	unix_state_lock(other);
 
 	/* Apparently VFS overslept socket death. Retry. */
@@ -1536,7 +1531,7 @@
 	if (other->sk_shutdown & RCV_SHUTDOWN)
 		goto out_unlock;
 
-	if (unix_recvq_full(other)) {
+	if (unix_recvq_full_lockless(other)) {
 		err = -EAGAIN;
 		if (!timeo)
 			goto out_unlock;
@@ -1550,39 +1545,21 @@
 		goto restart;
 	}
 
-	/* Latch our state.
-
-	   It is tricky place. We need to grab our state lock and cannot
-	   drop lock on peer. It is dangerous because deadlock is
-	   possible. Connect to self case and simultaneous
-	   attempt to connect are eliminated by checking socket
-	   state. other is TCP_LISTEN, if sk is TCP_LISTEN we
-	   check this before attempt to grab lock.
-
-	   Well, and we have to recheck the state after socket locked.
+	/* self connect and simultaneous connect are eliminated
+	 * by rejecting TCP_LISTEN socket to avoid deadlock.
 	 */
-	st = sk->sk_state;
-
-	switch (st) {
-	case TCP_CLOSE:
-		/* This is ok... continue with connect */
-		break;
-	case TCP_ESTABLISHED:
-		/* Socket is already connected */
-		err = -EISCONN;
-		goto out_unlock;
-	default:
-		err = -EINVAL;
+	state = READ_ONCE(sk->sk_state);
+	if (unlikely(state != TCP_CLOSE)) {
+		err = state == TCP_ESTABLISHED ? -EISCONN : -EINVAL;
 		goto out_unlock;
 	}
 
 	unix_state_lock_nested(sk, U_LOCK_SECOND);
 
-	if (sk->sk_state != st) {
+	if (unlikely(sk->sk_state != TCP_CLOSE)) {
+		err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EINVAL;
 		unix_state_unlock(sk);
-		unix_state_unlock(other);
-		sock_put(other);
-		goto restart;
+		goto out_unlock;
 	}
 
 	err = security_unix_stream_connect(sk, other, newsk);
@@ -1630,7 +1607,7 @@
 	copy_peercred(sk, other);
 
 	sock->state	= SS_CONNECTED;
-	sk->sk_state	= TCP_ESTABLISHED;
+	WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED);
 	sock_hold(newsk);
 
 	smp_mb__after_atomic();	/* sock_hold() does an atomic_inc() */
@@ -1703,7 +1680,7 @@
 		goto out;
 
 	err = -EINVAL;
-	if (sk->sk_state != TCP_LISTEN)
+	if (READ_ONCE(sk->sk_state) != TCP_LISTEN)
 		goto out;
 
 	/* If socket state is TCP_LISTEN it cannot change (for now...),
@@ -1937,14 +1914,15 @@
 	}
 
 	if ((test_bit(SOCK_PASSCRED, &sock->flags) ||
-	     test_bit(SOCK_PASSPIDFD, &sock->flags)) && !u->addr) {
+	     test_bit(SOCK_PASSPIDFD, &sock->flags)) &&
+	    !READ_ONCE(u->addr)) {
 		err = unix_autobind(sk);
 		if (err)
 			goto out;
 	}
 
 	err = -EMSGSIZE;
-	if (len > sk->sk_sndbuf - 32)
+	if (len > READ_ONCE(sk->sk_sndbuf) - 32)
 		goto out;
 
 	if (len > SKB_MAX_ALLOC) {
@@ -2026,7 +2004,7 @@
 			unix_peer(sk) = NULL;
 			unix_dgram_peer_wake_disconnect_wakeup(sk, other);
 
-			sk->sk_state = TCP_CLOSE;
+			WRITE_ONCE(sk->sk_state, TCP_CLOSE);
 			unix_state_unlock(sk);
 
 			unix_dgram_disconnected(sk, other);
@@ -2155,15 +2133,13 @@
 	}
 
 	maybe_add_creds(skb, sock, other);
-	skb_get(skb);
-
-	if (ousk->oob_skb)
-		consume_skb(ousk->oob_skb);
+	scm_stat_add(other, skb);
 
+	spin_lock(&other->sk_receive_queue.lock);
 	WRITE_ONCE(ousk->oob_skb, skb);
+	__skb_queue_tail(&other->sk_receive_queue, skb);
+	spin_unlock(&other->sk_receive_queue.lock);
 
-	scm_stat_add(other, skb);
-	skb_queue_tail(&other->sk_receive_queue, skb);
 	sk_send_sigurg(other);
 	unix_state_unlock(other);
 	other->sk_data_ready(other);
@@ -2200,7 +2176,7 @@
 	}
 
 	if (msg->msg_namelen) {
-		err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
+		err = READ_ONCE(sk->sk_state) == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
 		goto out_err;
 	} else {
 		err = -ENOTCONN;
@@ -2209,7 +2185,7 @@
 			goto out_err;
 	}
 
-	if (sk->sk_shutdown & SEND_SHUTDOWN)
+	if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
 		goto pipe_err;
 
 	while (sent < len) {
@@ -2221,7 +2197,7 @@
 						   &err, 0);
 		} else {
 			/* Keep two messages in the pipe so it schedules better */
-			size = min_t(int, size, (sk->sk_sndbuf >> 1) - 64);
+			size = min_t(int, size, (READ_ONCE(sk->sk_sndbuf) >> 1) - 64);
 
 			/* allow fallback to order-0 allocations */
 			size = min_t(int, size, SKB_MAX_HEAD(0) + UNIX_SKB_FRAGS_SZ);
@@ -2246,6 +2222,7 @@
 		fds_sent = true;
 
 		if (unlikely(msg->msg_flags & MSG_SPLICE_PAGES)) {
+			skb->ip_summed = CHECKSUM_UNNECESSARY;
 			err = skb_splice_from_iter(skb, &msg->msg_iter, size,
 						   sk->sk_allocation);
 			if (err < 0) {
@@ -2314,7 +2291,7 @@
 	if (err)
 		return err;
 
-	if (sk->sk_state != TCP_ESTABLISHED)
+	if (READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)
 		return -ENOTCONN;
 
 	if (msg->msg_namelen)
@@ -2328,7 +2305,7 @@
 {
 	struct sock *sk = sock->sk;
 
-	if (sk->sk_state != TCP_ESTABLISHED)
+	if (READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)
 		return -ENOTCONN;
 
 	return unix_dgram_recvmsg(sock, msg, size, flags);
@@ -2553,8 +2530,10 @@
 
 	mutex_lock(&u->iolock);
 	unix_state_lock(sk);
+	spin_lock(&sk->sk_receive_queue.lock);
 
 	if (sock_flag(sk, SOCK_URGINLINE) || !u->oob_skb) {
+		spin_unlock(&sk->sk_receive_queue.lock);
 		unix_state_unlock(sk);
 		mutex_unlock(&u->iolock);
 		return -EINVAL;
@@ -2564,8 +2543,8 @@
 
 	if (!(state->flags & MSG_PEEK))
 		WRITE_ONCE(u->oob_skb, NULL);
-	else
-		skb_get(oob_skb);
+
+	spin_unlock(&sk->sk_receive_queue.lock);
 	unix_state_unlock(sk);
 
 	chunk = state->recv_actor(oob_skb, 0, chunk, state);
@@ -2573,8 +2552,6 @@
 	if (!(state->flags & MSG_PEEK))
 		UNIXCB(oob_skb).consumed += 1;
 
-	consume_skb(oob_skb);
-
 	mutex_unlock(&u->iolock);
 
 	if (chunk < 0)
@@ -2587,38 +2564,100 @@
 static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
 				  int flags, int copied)
 {
+	struct sk_buff *read_skb = NULL, *unread_skb = NULL;
 	struct unix_sock *u = unix_sk(sk);
 
-	if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) {
-		skb_unlink(skb, &sk->sk_receive_queue);
-		consume_skb(skb);
+	if (likely(unix_skb_len(skb) && skb != READ_ONCE(u->oob_skb)))
+		return skb;
+
+	spin_lock(&sk->sk_receive_queue.lock);
+
+	if (!unix_skb_len(skb)) {
+		if (copied && (!u->oob_skb || skb == u->oob_skb)) {
+			skb = NULL;
+		} else if (flags & MSG_PEEK) {
+			skb = skb_peek_next(skb, &sk->sk_receive_queue);
+		} else {
+			read_skb = skb;
+			skb = skb_peek_next(skb, &sk->sk_receive_queue);
+			__skb_unlink(read_skb, &sk->sk_receive_queue);
+		}
+
+		if (!skb)
+			goto unlock;
+	}
+
+	if (skb != u->oob_skb)
+		goto unlock;
+
+	if (copied) {
 		skb = NULL;
-	} else {
-		if (skb == u->oob_skb) {
-			if (copied) {
-				skb = NULL;
-			} else if (sock_flag(sk, SOCK_URGINLINE)) {
-				if (!(flags & MSG_PEEK)) {
-					WRITE_ONCE(u->oob_skb, NULL);
-					consume_skb(skb);
-				}
-			} else if (!(flags & MSG_PEEK)) {
-				skb_unlink(skb, &sk->sk_receive_queue);
-				consume_skb(skb);
-				skb = skb_peek(&sk->sk_receive_queue);
-			}
+	} else if (!(flags & MSG_PEEK)) {
+		WRITE_ONCE(u->oob_skb, NULL);
+
+		if (!sock_flag(sk, SOCK_URGINLINE)) {
+			__skb_unlink(skb, &sk->sk_receive_queue);
+			unread_skb = skb;
+			skb = skb_peek(&sk->sk_receive_queue);
 		}
+	} else if (!sock_flag(sk, SOCK_URGINLINE)) {
+		skb = skb_peek_next(skb, &sk->sk_receive_queue);
 	}
+
+unlock:
+	spin_unlock(&sk->sk_receive_queue.lock);
+
+	consume_skb(read_skb);
+	kfree_skb(unread_skb);
+
 	return skb;
 }
 #endif
 
 static int unix_stream_read_skb(struct sock *sk, skb_read_actor_t recv_actor)
 {
-	if (unlikely(sk->sk_state != TCP_ESTABLISHED))
+	struct unix_sock *u = unix_sk(sk);
+	struct sk_buff *skb;
+	int err;
+
+	if (unlikely(READ_ONCE(sk->sk_state) != TCP_ESTABLISHED))
 		return -ENOTCONN;
 
-	return unix_read_skb(sk, recv_actor);
+	mutex_lock(&u->iolock);
+	skb = skb_recv_datagram(sk, MSG_DONTWAIT, &err);
+	mutex_unlock(&u->iolock);
+	if (!skb)
+		return err;
+
+#if IS_ENABLED(CONFIG_AF_UNIX_OOB)
+	if (unlikely(skb == READ_ONCE(u->oob_skb))) {
+		bool drop = false;
+
+		unix_state_lock(sk);
+
+		if (sock_flag(sk, SOCK_DEAD)) {
+			unix_state_unlock(sk);
+			kfree_skb(skb);
+			return -ECONNRESET;
+		}
+
+		spin_lock(&sk->sk_receive_queue.lock);
+		if (likely(skb == u->oob_skb)) {
+			WRITE_ONCE(u->oob_skb, NULL);
+			drop = true;
+		}
+		spin_unlock(&sk->sk_receive_queue.lock);
+
+		unix_state_unlock(sk);
+
+		if (drop) {
+			kfree_skb(skb);
+			return -EAGAIN;
+		}
+	}
+#endif
+
+	return recv_actor(sk, skb);
 }
 
 static int unix_stream_read_generic(struct unix_stream_read_state *state,
@@ -2639,7 +2678,7 @@
 	size_t size = state->size;
 	unsigned int last_len;
 
-	if (unlikely(sk->sk_state != TCP_ESTABLISHED)) {
+	if (unlikely(READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)) {
 		err = -EINVAL;
 		goto out;
 	}
@@ -2678,18 +2717,16 @@
 		last = skb = skb_peek(&sk->sk_receive_queue);
 		last_len = last ? last->len : 0;
 
+again:
 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
 		if (skb) {
 			skb = manage_oob(skb, sk, flags, copied);
-			if (!skb) {
+			if (!skb && copied) {
 				unix_state_unlock(sk);
-				if (copied)
-					break;
-				goto redo;
+				break;
 			}
 		}
 #endif
-again:
 		if (skb == NULL) {
 			if (copied >= target)
 				goto unlock;
@@ -2972,7 +3009,7 @@
 	struct sk_buff *skb;
 	long amount = 0;
 
-	if (sk->sk_state == TCP_LISTEN)
+	if (READ_ONCE(sk->sk_state) == TCP_LISTEN)
 		return -EINVAL;
 
 	spin_lock(&sk->sk_receive_queue.lock);
@@ -3057,12 +3094,27 @@
 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
 	case SIOCATMARK:
 		{
+			struct unix_sock *u = unix_sk(sk);
 			struct sk_buff *skb;
 			int answ = 0;
 
+			mutex_lock(&u->iolock);
+
 			skb = skb_peek(&sk->sk_receive_queue);
-			if (skb && skb == READ_ONCE(unix_sk(sk)->oob_skb))
-				answ = 1;
+			if (skb) {
+				struct sk_buff *oob_skb = READ_ONCE(u->oob_skb);
+				struct sk_buff *next_skb;
+
+				next_skb = skb_peek_next(skb, &sk->sk_receive_queue);
+
+				if (skb == oob_skb ||
+				    (!unix_skb_len(skb) &&
+				     (!oob_skb || next_skb == oob_skb)))
+					answ = 1;
+			}
+
+			mutex_unlock(&u->iolock);
+
 			err = put_user(answ, (int __user *)arg);
 		}
 		break;
@@ -3084,12 +3136,14 @@
 static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
 	struct sock *sk = sock->sk;
+	unsigned char state;
 	__poll_t mask;
 	u8 shutdown;
 
 	sock_poll_wait(file, sock, wait);
 	mask = 0;
 	shutdown = READ_ONCE(sk->sk_shutdown);
+	state = READ_ONCE(sk->sk_state);
 
 	/* exceptional events? */
 	if (READ_ONCE(sk->sk_err))
@@ -3111,14 +3165,14 @@
 
 	/* Connection-based need to check for termination and startup */
 	if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) &&
-	    sk->sk_state == TCP_CLOSE)
+	    state == TCP_CLOSE)
 		mask |= EPOLLHUP;
 
 	/*
 	 * we set writable also when the other side has shut down the
 	 * connection. This prevents stuck sockets.
 	 */
-	if (unix_writable(sk))
+	if (unix_writable(sk, state))
 		mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
 
 	return mask;
@@ -3129,12 +3183,14 @@
 {
 	struct sock *sk = sock->sk, *other;
 	unsigned int writable;
+	unsigned char state;
 	__poll_t mask;
 	u8 shutdown;
 
 	sock_poll_wait(file, sock, wait);
 	mask = 0;
 	shutdown = READ_ONCE(sk->sk_shutdown);
+	state = READ_ONCE(sk->sk_state);
 
 	/* exceptional events? */
 	if (READ_ONCE(sk->sk_err) ||
@@ -3154,19 +3210,14 @@
 		mask |= EPOLLIN | EPOLLRDNORM;
 
 	/* Connection-based need to check for termination and startup */
-	if (sk->sk_type == SOCK_SEQPACKET) {
-		if (sk->sk_state == TCP_CLOSE)
-			mask |= EPOLLHUP;
-		/* connection hasn't started yet? */
-		if (sk->sk_state == TCP_SYN_SENT)
-			return mask;
-	}
+	if (sk->sk_type == SOCK_SEQPACKET && state == TCP_CLOSE)
+		mask |= EPOLLHUP;
 
 	/* No write status requested, avoid expensive OUT tests. */
 	if (!(poll_requested_events(wait) & (EPOLLWRBAND|EPOLLWRNORM|EPOLLOUT)))
 		return mask;
 
-	writable = unix_writable(sk);
+	writable = unix_writable(sk, state);
 	if (writable) {
 		unix_state_lock(sk);
 
--- linux-qcom-6.8.0.orig/net/unix/diag.c
+++ linux-qcom-6.8.0/net/unix/diag.c
@@ -65,7 +65,7 @@
 	u32 *buf;
 	int i;
 
-	if (sk->sk_state == TCP_LISTEN) {
+	if (READ_ONCE(sk->sk_state) == TCP_LISTEN) {
 		spin_lock(&sk->sk_receive_queue.lock);
 
 		attr = nla_reserve(nlskb, UNIX_DIAG_ICONS,
@@ -103,8 +103,8 @@
 {
 	struct unix_diag_rqlen rql;
 
-	if (sk->sk_state == TCP_LISTEN) {
-		rql.udiag_rqueue = sk->sk_receive_queue.qlen;
+	if (READ_ONCE(sk->sk_state) == TCP_LISTEN) {
+		rql.udiag_rqueue = skb_queue_len_lockless(&sk->sk_receive_queue);
 		rql.udiag_wqueue = sk->sk_max_ack_backlog;
 	} else {
 		rql.udiag_rqueue = (u32) unix_inq_len(sk);
@@ -136,7 +136,7 @@
 	rep = nlmsg_data(nlh);
 	rep->udiag_family = AF_UNIX;
 	rep->udiag_type = sk->sk_type;
-	rep->udiag_state = sk->sk_state;
+	rep->udiag_state = READ_ONCE(sk->sk_state);
 	rep->pad = 0;
 	rep->udiag_ino = sk_ino;
 	sock_diag_save_cookie(sk, rep->udiag_cookie);
@@ -165,7 +165,7 @@
 	    sock_diag_put_meminfo(sk, skb, UNIX_DIAG_MEMINFO))
 		goto out_nlmsg_trim;
 
-	if (nla_put_u8(skb, UNIX_DIAG_SHUTDOWN, sk->sk_shutdown))
+	if (nla_put_u8(skb, UNIX_DIAG_SHUTDOWN, READ_ONCE(sk->sk_shutdown)))
 		goto out_nlmsg_trim;
 
 	if ((req->udiag_show & UDIAG_SHOW_UID) &&
@@ -215,7 +215,7 @@
 		sk_for_each(sk, &net->unx.table.buckets[slot]) {
 			if (num < s_num)
 				goto next;
-			if (!(req->udiag_states & (1 << sk->sk_state)))
+			if (!(req->udiag_states & (1 << READ_ONCE(sk->sk_state))))
 				goto next;
 			if (sk_diag_dump(sk, skb, req, sk_user_ns(skb->sk),
 					 NETLINK_CB(cb->skb).portid,
@@ -322,6 +322,7 @@
 }
 
 static const struct sock_diag_handler unix_diag_handler = {
+	.owner = THIS_MODULE,
 	.family = AF_UNIX,
 	.dump = unix_diag_handler_dump,
 };
--- linux-qcom-6.8.0.orig/net/unix/garbage.c
+++ linux-qcom-6.8.0/net/unix/garbage.c
@@ -166,17 +166,18 @@
 
 static void dec_inflight(struct unix_sock *usk)
 {
-	atomic_long_dec(&usk->inflight);
+	usk->inflight--;
 }
 
 static void inc_inflight(struct unix_sock *usk)
 {
-	atomic_long_inc(&usk->inflight);
+	usk->inflight++;
 }
 
 static void inc_inflight_move_tail(struct unix_sock *u)
 {
-	atomic_long_inc(&u->inflight);
+	u->inflight++;
+
 	/* If this still might be part of a cycle, move it to the end
 	 * of the list, so that it's checked even if it was already
 	 * passed over
@@ -198,7 +199,7 @@
 	if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC &&
 	    !READ_ONCE(gc_in_progress))
 		unix_gc();
-	wait_event(unix_gc_wait, gc_in_progress == false);
+	wait_event(unix_gc_wait, !READ_ONCE(gc_in_progress));
 }
 
 /* The external entry point: unix_gc() */
@@ -234,20 +235,34 @@
 	 * receive queues.  Other, non candidate sockets _can_ be
 	 * added to queue, so we must make sure only to touch
 	 * candidates.
+	 *
+	 * Embryos, though never candidates themselves, affect which
+	 * candidates are reachable by the garbage collector.  Before
+	 * being added to a listener's queue, an embryo may already
+	 * receive data carrying SCM_RIGHTS, potentially making the
+	 * passed socket a candidate that is not yet reachable by the
+	 * collector.  It becomes reachable once the embryo is
+	 * enqueued.  Therefore, we must ensure that no SCM-laden
+	 * embryo appears in a (candidate) listener's queue between
+	 * consecutive scan_children() calls.
 	 */
 	list_for_each_entry_safe(u, next, &gc_inflight_list, link) {
+		struct sock *sk = &u->sk;
 		long total_refs;
-		long inflight_refs;
 
-		total_refs = file_count(u->sk.sk_socket->file);
-		inflight_refs = atomic_long_read(&u->inflight);
+		total_refs = file_count(sk->sk_socket->file);
 
-		BUG_ON(inflight_refs < 1);
-		BUG_ON(total_refs < inflight_refs);
-		if (total_refs == inflight_refs) {
+		BUG_ON(!u->inflight);
+		BUG_ON(total_refs < u->inflight);
+		if (total_refs == u->inflight) {
 			list_move_tail(&u->link, &gc_candidates);
 			__set_bit(UNIX_GC_CANDIDATE, &u->gc_flags);
 			__set_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);
+
+			if (sk->sk_state == TCP_LISTEN) {
+				unix_state_lock_nested(sk, U_LOCK_GC_LISTENER);
+				unix_state_unlock(sk);
+			}
 		}
 	}
 
@@ -271,7 +286,7 @@
 		/* Move cursor to after the current position. */
 		list_move(&cursor, &u->link);
 
-		if (atomic_long_read(&u->inflight) > 0) {
+		if (u->inflight) {
 			list_move_tail(&u->link, &not_cycle_list);
 			__clear_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);
 			scan_children(&u->sk, inc_inflight_move_tail, NULL);
--- linux-qcom-6.8.0.orig/net/unix/scm.c
+++ linux-qcom-6.8.0/net/unix/scm.c
@@ -53,12 +53,13 @@
 	if (s) {
 		struct unix_sock *u = unix_sk(s);
 
-		if (atomic_long_inc_return(&u->inflight) == 1) {
+		if (!u->inflight) {
 			BUG_ON(!list_empty(&u->link));
 			list_add_tail(&u->link, &gc_inflight_list);
 		} else {
 			BUG_ON(list_empty(&u->link));
 		}
+		u->inflight++;
 		/* Paired with READ_ONCE() in wait_for_unix_gc() */
 		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1);
 	}
@@ -75,10 +76,11 @@
 	if (s) {
 		struct unix_sock *u = unix_sk(s);
 
-		BUG_ON(!atomic_long_read(&u->inflight));
+		BUG_ON(!u->inflight);
 		BUG_ON(list_empty(&u->link));
 
-		if (atomic_long_dec_and_test(&u->inflight))
+		u->inflight--;
+		if (!u->inflight)
 			list_del_init(&u->link);
 		/* Paired with READ_ONCE() in wait_for_unix_gc() */
 		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1);
--- linux-qcom-6.8.0.orig/net/unix/unix_bpf.c
+++ linux-qcom-6.8.0/net/unix/unix_bpf.c
@@ -54,6 +54,9 @@
 	struct sk_psock *psock;
 	int copied;
 
+	if (flags & MSG_OOB)
+		return -EOPNOTSUPP;
+
 	if (!len)
 		return 0;
 
--- linux-qcom-6.8.0.orig/net/vmw_vsock/af_vsock.c
+++ linux-qcom-6.8.0/net/vmw_vsock/af_vsock.c
@@ -116,12 +116,14 @@
 static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr);
 static void vsock_sk_destruct(struct sock *sk);
 static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
+static void vsock_close(struct sock *sk, long timeout);
 
 /* Protocol family. */
 struct proto vsock_proto = {
 	.name = "AF_VSOCK",
 	.owner = THIS_MODULE,
 	.obj_size = sizeof(struct vsock_sock),
+	.close = vsock_close,
 #ifdef CONFIG_BPF_SYSCALL
 	.psock_update_sk_prot = vsock_bpf_update_proto,
 #endif
@@ -334,7 +336,10 @@
 
 void vsock_remove_sock(struct vsock_sock *vsk)
 {
-	vsock_remove_bound(vsk);
+	/* Transport reassignment must not remove the binding. */
+	if (sock_flag(sk_vsock(vsk), SOCK_DEAD))
+		vsock_remove_bound(vsk);
+
 	vsock_remove_connected(vsk);
 }
 EXPORT_SYMBOL_GPL(vsock_remove_sock);
@@ -488,6 +493,15 @@
 		 */
 		vsk->transport->release(vsk);
 		vsock_deassign_transport(vsk);
+
+		/* transport's release() and destruct() can touch some socket
+		 * state, since we are reassigning the socket to a new transport
+		 * during vsock_connect(), let's reset these fields to have a
+		 * clean state.
+		 */
+		sock_reset_flag(sk, SOCK_DONE);
+		sk->sk_state = TCP_CLOSE;
+		vsk->peer_shutdown = 0;
 	}
 
 	/* We increase the module refcnt to prevent the transport unloading
@@ -796,45 +810,53 @@
 
 static void __vsock_release(struct sock *sk, int level)
 {
-	if (sk) {
-		struct sock *pending;
-		struct vsock_sock *vsk;
+	struct vsock_sock *vsk;
+	struct sock *pending;
 
-		vsk = vsock_sk(sk);
-		pending = NULL;	/* Compiler warning. */
+	vsk = vsock_sk(sk);
+	pending = NULL; /* Compiler warning. */
 
-		/* When "level" is SINGLE_DEPTH_NESTING, use the nested
-		 * version to avoid the warning "possible recursive locking
-		 * detected". When "level" is 0, lock_sock_nested(sk, level)
-		 * is the same as lock_sock(sk).
-		 */
-		lock_sock_nested(sk, level);
-
-		if (vsk->transport)
-			vsk->transport->release(vsk);
-		else if (sock_type_connectible(sk->sk_type))
-			vsock_remove_sock(vsk);
-
-		sock_orphan(sk);
-		sk->sk_shutdown = SHUTDOWN_MASK;
-
-		skb_queue_purge(&sk->sk_receive_queue);
-
-		/* Clean up any sockets that never were accepted. */
-		while ((pending = vsock_dequeue_accept(sk)) != NULL) {
-			__vsock_release(pending, SINGLE_DEPTH_NESTING);
-			sock_put(pending);
-		}
+	/* When "level" is SINGLE_DEPTH_NESTING, use the nested
+	 * version to avoid the warning "possible recursive locking
+	 * detected". When "level" is 0, lock_sock_nested(sk, level)
+	 * is the same as lock_sock(sk).
+	 */
+	lock_sock_nested(sk, level);
 
-		release_sock(sk);
-		sock_put(sk);
+	/* Indicate to vsock_remove_sock() that the socket is being released and
+	 * can be removed from the bound_table. Unlike transport reassignment
+	 * case, where the socket must remain bound despite vsock_remove_sock()
+	 * being called from the transport release() callback.
+	 */
+	sock_set_flag(sk, SOCK_DEAD);
+
+	if (vsk->transport)
+		vsk->transport->release(vsk);
+	else if (sock_type_connectible(sk->sk_type))
+		vsock_remove_sock(vsk);
+
+	sock_orphan(sk);
+	sk->sk_shutdown = SHUTDOWN_MASK;
+
+	skb_queue_purge(&sk->sk_receive_queue);
+
+	/* Clean up any sockets that never were accepted. */
+	while ((pending = vsock_dequeue_accept(sk)) != NULL) {
+		__vsock_release(pending, SINGLE_DEPTH_NESTING);
+		sock_put(pending);
 	}
+
+	release_sock(sk);
+	sock_put(sk);
 }
 
 static void vsock_sk_destruct(struct sock *sk)
 {
 	struct vsock_sock *vsk = vsock_sk(sk);
 
+	/* Flush MSG_ZEROCOPY leftovers. */
+	__skb_queue_purge(&sk->sk_error_queue);
+
 	vsock_deassign_transport(vsk);
 
 	/* When clearing these addresses, there's no need to set the family and
@@ -866,6 +888,9 @@
 
 s64 vsock_stream_has_data(struct vsock_sock *vsk)
 {
+	if (WARN_ON(!vsk->transport))
+		return 0;
+
 	return vsk->transport->stream_has_data(vsk);
 }
 EXPORT_SYMBOL_GPL(vsock_stream_has_data);
@@ -874,6 +899,9 @@
 {
 	struct sock *sk = sk_vsock(vsk);
 
+	if (WARN_ON(!vsk->transport))
+		return 0;
+
 	if (sk->sk_type == SOCK_SEQPACKET)
 		return vsk->transport->seqpacket_has_data(vsk);
 	else
@@ -883,6 +911,9 @@
 
 s64 vsock_stream_has_space(struct vsock_sock *vsk)
 {
+	if (WARN_ON(!vsk->transport))
+		return 0;
+
 	return vsk->transport->stream_has_space(vsk);
 }
 EXPORT_SYMBOL_GPL(vsock_stream_has_space);
@@ -897,9 +928,22 @@
 }
 EXPORT_SYMBOL_GPL(vsock_data_ready);
 
+/* Dummy callback required by sockmap.
+ * See unconditional call of saved_close() in sock_map_close().
+ */
+static void vsock_close(struct sock *sk, long timeout)
+{
+}
+
 static int vsock_release(struct socket *sock)
 {
-	__vsock_release(sock->sk, 0);
+	struct sock *sk = sock->sk;
+
+	if (!sk)
+		return 0;
+
+	sk->sk_prot->close(sk, 0);
+	__vsock_release(sk, 0);
 	sock->sk = NULL;
 	sock->state = SS_FREE;
 
@@ -1050,6 +1094,9 @@
 		mask |= EPOLLRDHUP;
 	}
 
+	if (sk_is_readable(sk))
+		mask |= EPOLLIN | EPOLLRDNORM;
+
 	if (sock->type == SOCK_DGRAM) {
 		/* For datagram sockets we can read if there is something in
 		 * the queue and write as long as the socket isn't shutdown for
@@ -1270,25 +1317,28 @@
 	return err;
 }
 
+int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
+			  size_t len, int flags)
+{
+	struct sock *sk = sock->sk;
+	struct vsock_sock *vsk = vsock_sk(sk);
+
+	return vsk->transport->dgram_dequeue(vsk, msg, len, flags);
+}
+
 int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
 			size_t len, int flags)
 {
 #ifdef CONFIG_BPF_SYSCALL
+	struct sock *sk = sock->sk;
 	const struct proto *prot;
-#endif
-	struct vsock_sock *vsk;
-	struct sock *sk;
-
-	sk = sock->sk;
-	vsk = vsock_sk(sk);
 
-#ifdef CONFIG_BPF_SYSCALL
 	prot = READ_ONCE(sk->sk_prot);
 	if (prot != &vsock_proto)
 		return prot->recvmsg(sk, msg, len, flags, NULL);
 #endif
 
-	return vsk->transport->dgram_dequeue(vsk, msg, len, flags);
+	return __vsock_dgram_recvmsg(sock, msg, len, flags);
 }
 EXPORT_SYMBOL_GPL(vsock_dgram_recvmsg);
 
@@ -2174,15 +2224,12 @@
 }
 
 int
-vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
-			  int flags)
+__vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+			    int flags)
 {
 	struct sock *sk;
 	struct vsock_sock *vsk;
 	const struct vsock_transport *transport;
-#ifdef CONFIG_BPF_SYSCALL
-	const struct proto *prot;
-#endif
 	int err;
 
 	sk = sock->sk;
@@ -2233,14 +2280,6 @@
 		goto out;
 	}
 
-#ifdef CONFIG_BPF_SYSCALL
-	prot = READ_ONCE(sk->sk_prot);
-	if (prot != &vsock_proto) {
-		release_sock(sk);
-		return prot->recvmsg(sk, msg, len, flags, NULL);
-	}
-#endif
-
 	if (sk->sk_type == SOCK_STREAM)
 		err = __vsock_stream_recvmsg(sk, msg, len, flags);
 	else
@@ -2250,6 +2289,22 @@
 	release_sock(sk);
 	return err;
 }
+
+int
+vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+			  int flags)
+{
+#ifdef CONFIG_BPF_SYSCALL
+	struct sock *sk = sock->sk;
+	const struct proto *prot;
+
+	prot = READ_ONCE(sk->sk_prot);
+	if (prot != &vsock_proto)
+		return prot->recvmsg(sk, msg, len, flags, NULL);
+#endif
+
+	return __vsock_connectible_recvmsg(sock, msg, len, flags);
+}
 EXPORT_SYMBOL_GPL(vsock_connectible_recvmsg);
 
 static int vsock_set_rcvlowat(struct sock *sk, int val)
--- linux-qcom-6.8.0.orig/net/vmw_vsock/diag.c
+++ linux-qcom-6.8.0/net/vmw_vsock/diag.c
@@ -157,6 +157,7 @@
 }
 
 static const struct sock_diag_handler vsock_diag_handler = {
+	.owner = THIS_MODULE,
 	.family = AF_VSOCK,
 	.dump = vsock_diag_handler_dump,
 };
--- linux-qcom-6.8.0.orig/net/vmw_vsock/hyperv_transport.c
+++ linux-qcom-6.8.0/net/vmw_vsock/hyperv_transport.c
@@ -549,6 +549,7 @@
 		vmbus_hvsock_device_unregister(chan);
 
 	kfree(hvs);
+	vsk->trans = NULL;
 }
 
 static int hvs_dgram_bind(struct vsock_sock *vsk, struct sockaddr_vm *addr)
--- linux-qcom-6.8.0.orig/net/vmw_vsock/virtio_transport.c
+++ linux-qcom-6.8.0/net/vmw_vsock/virtio_transport.c
@@ -120,7 +120,6 @@
 		if (!skb)
 			break;
 
-		virtio_transport_deliver_tap_pkt(skb);
 		reply = virtio_vsock_skb_reply(skb);
 		sgs = vsock->out_sgs;
 		sg_init_one(sgs[out_sg], virtio_vsock_hdr(skb),
@@ -170,6 +169,8 @@
 			break;
 		}
 
+		virtio_transport_deliver_tap_pkt(skb);
+
 		if (reply) {
 			struct virtqueue *rx_vq = vsock->vqs[VSOCK_VQ_RX];
 			int val;
--- linux-qcom-6.8.0.orig/net/vmw_vsock/virtio_transport_common.c
+++ linux-qcom-6.8.0/net/vmw_vsock/virtio_transport_common.c
@@ -26,6 +26,9 @@
 /* Threshold for detecting small packets to copy */
 #define GOOD_COPY_LEN  128
 
+static void virtio_transport_cancel_close_work(struct vsock_sock *vsk,
+					       bool cancel_timeout);
+
 static const struct virtio_transport *
 virtio_transport_get_ops(struct vsock_sock *vsk)
 {
@@ -400,6 +403,7 @@
 			if (virtio_transport_init_zcopy_skb(vsk, skb,
 							    info->msg,
 							    can_zcopy)) {
+				kfree_skb(skb);
 				ret = -ENOMEM;
 				break;
 			}
@@ -1086,7 +1090,10 @@
 {
 	struct virtio_vsock_sock *vvs = vsk->trans;
 
+	virtio_transport_cancel_close_work(vsk, true);
+
 	kfree(vvs);
+	vsk->trans = NULL;
 }
 EXPORT_SYMBOL_GPL(virtio_transport_destruct);
 
@@ -1167,17 +1174,11 @@
 	}
 }
 
-static void virtio_transport_do_close(struct vsock_sock *vsk,
-				      bool cancel_timeout)
+static void virtio_transport_cancel_close_work(struct vsock_sock *vsk,
+					       bool cancel_timeout)
 {
 	struct sock *sk = sk_vsock(vsk);
 
-	sock_set_flag(sk, SOCK_DONE);
-	vsk->peer_shutdown = SHUTDOWN_MASK;
-	if (vsock_stream_has_data(vsk) <= 0)
-		sk->sk_state = TCP_CLOSING;
-	sk->sk_state_change(sk);
-
 	if (vsk->close_work_scheduled &&
 	    (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) {
 		vsk->close_work_scheduled = false;
@@ -1189,6 +1190,20 @@
 	}
 }
 
+static void virtio_transport_do_close(struct vsock_sock *vsk,
+				      bool cancel_timeout)
+{
+	struct sock *sk = sk_vsock(vsk);
+
+	sock_set_flag(sk, SOCK_DONE);
+	vsk->peer_shutdown = SHUTDOWN_MASK;
+	if (vsock_stream_has_data(vsk) <= 0)
+		sk->sk_state = TCP_CLOSING;
+	sk->sk_state_change(sk);
+
+	virtio_transport_cancel_close_work(vsk, cancel_timeout);
+}
+
 static void virtio_transport_close_timeout(struct work_struct *work)
 {
 	struct vsock_sock *vsk =
@@ -1477,6 +1492,14 @@
 		return -ENOMEM;
 	}
 
+	/* __vsock_release() might have already flushed accept_queue.
+	 * Subsequent enqueues would lead to a memory leak.
+	 */
+	if (sk->sk_shutdown == SHUTDOWN_MASK) {
+		virtio_transport_reset_no_sock(t, skb);
+		return -ESHUTDOWN;
+	}
+
 	child = vsock_create_connected(sk);
 	if (!child) {
 		virtio_transport_reset_no_sock(t, skb);
@@ -1583,8 +1606,11 @@
 
 	lock_sock(sk);
 
-	/* Check if sk has been closed before lock_sock */
-	if (sock_flag(sk, SOCK_DONE)) {
+	/* Check if sk has been closed or assigned to another transport before
+	 * lock_sock (note: listener sockets are not assigned to any transport)
+	 */
+	if (sock_flag(sk, SOCK_DONE) ||
+	    (sk->sk_state != TCP_LISTEN && vsk->transport != &t->transport)) {
 		(void)virtio_transport_reset_no_sock(t, skb);
 		release_sock(sk);
 		sock_put(sk);
@@ -1672,6 +1698,7 @@
 {
 	struct virtio_vsock_sock *vvs = vsk->trans;
 	struct sock *sk = sk_vsock(vsk);
+	struct virtio_vsock_hdr *hdr;
 	struct sk_buff *skb;
 	int off = 0;
 	int err;
@@ -1681,10 +1708,19 @@
 	 * works for types other than dgrams.
 	 */
 	skb = __skb_recv_datagram(sk, &vvs->rx_queue, MSG_DONTWAIT, &off, &err);
+	if (!skb) {
+		spin_unlock_bh(&vvs->rx_lock);
+		return err;
+	}
+
+	hdr = virtio_vsock_hdr(skb);
+	if (le32_to_cpu(hdr->flags) & VIRTIO_VSOCK_SEQ_EOM)
+		vvs->msg_count--;
+
+	virtio_transport_dec_rx_pkt(vvs, le32_to_cpu(hdr->len));
 	spin_unlock_bh(&vvs->rx_lock);
 
-	if (!skb)
-		return err;
+	virtio_transport_send_credit_update(vsk);
 
 	return recv_actor(sk, skb);
 }
--- linux-qcom-6.8.0.orig/net/vmw_vsock/vsock_bpf.c
+++ linux-qcom-6.8.0/net/vmw_vsock/vsock_bpf.c
@@ -64,9 +64,9 @@
 	int err;
 
 	if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)
-		err = vsock_connectible_recvmsg(sock, msg, len, flags);
+		err = __vsock_connectible_recvmsg(sock, msg, len, flags);
 	else if (sk->sk_type == SOCK_DGRAM)
-		err = vsock_dgram_recvmsg(sock, msg, len, flags);
+		err = __vsock_dgram_recvmsg(sock, msg, len, flags);
 	else
 		err = -EPROTOTYPE;
 
@@ -77,6 +77,7 @@
 			     size_t len, int flags, int *addr_len)
 {
 	struct sk_psock *psock;
+	struct vsock_sock *vsk;
 	int copied;
 
 	psock = sk_psock_get(sk);
@@ -84,6 +85,13 @@
 		return __vsock_recvmsg(sk, msg, len, flags);
 
 	lock_sock(sk);
+	vsk = vsock_sk(sk);
+
+	if (!vsk->transport) {
+		copied = -ENODEV;
+		goto out;
+	}
+
 	if (vsock_has_data(sk, psock) && sk_psock_queue_empty(psock)) {
 		release_sock(sk);
 		sk_psock_put(sk, psock);
@@ -108,20 +116,13 @@
 		copied = sk_msg_recvmsg(sk, psock, msg, len, flags);
 	}
 
+out:
 	release_sock(sk);
 	sk_psock_put(sk, psock);
 
 	return copied;
 }
 
-/* Copy of original proto with updated sock_map methods */
-static struct proto vsock_bpf_prot = {
-	.close = sock_map_close,
-	.recvmsg = vsock_bpf_recvmsg,
-	.sock_is_readable = sk_msg_is_readable,
-	.unhash = sock_map_unhash,
-};
-
 static void vsock_bpf_rebuild_protos(struct proto *prot, const struct proto *base)
 {
 	*prot        = *base;
--- linux-qcom-6.8.0.orig/net/wireless/core.c
+++ linux-qcom-6.8.0/net/wireless/core.c
@@ -431,7 +431,7 @@
 	if (wk) {
 		list_del_init(&wk->entry);
 		if (!list_empty(&rdev->wiphy_work_list))
-			schedule_work(work);
+			queue_work(system_unbound_wq, work);
 		spin_unlock_irq(&rdev->wiphy_work_lock);
 
 		wk->func(&rdev->wiphy, wk);
@@ -1231,6 +1231,7 @@
 	/* deleted from the list, so can't be found from nl80211 any more */
 	cqm_config = rcu_access_pointer(wdev->cqm_config);
 	kfree_rcu(cqm_config, rcu_head);
+	RCU_INIT_POINTER(wdev->cqm_config, NULL);
 
 	/*
 	 * Ensure that all events have been processed and
@@ -1691,6 +1692,13 @@
 }
 EXPORT_SYMBOL_GPL(wiphy_delayed_work_flush);
 
+bool wiphy_delayed_work_pending(struct wiphy *wiphy,
+				struct wiphy_delayed_work *dwork)
+{
+	return timer_pending(&dwork->timer);
+}
+EXPORT_SYMBOL_GPL(wiphy_delayed_work_pending);
+
 static int __init cfg80211_init(void)
 {
 	int err;
--- linux-qcom-6.8.0.orig/net/wireless/ibss.c
+++ linux-qcom-6.8.0/net/wireless/ibss.c
@@ -3,7 +3,7 @@
  * Some IBSS support code for cfg80211.
  *
  * Copyright 2009	Johannes Berg <johannes@sipsolutions.net>
- * Copyright (C) 2020-2023 Intel Corporation
+ * Copyright (C) 2020-2024 Intel Corporation
  */
 
 #include <linux/etherdevice.h>
@@ -94,6 +94,9 @@
 
 	lockdep_assert_held(&rdev->wiphy.mtx);
 
+	if (wdev->cac_started)
+		return -EBUSY;
+
 	if (wdev->u.ibss.ssid_len)
 		return -EALREADY;
 
--- linux-qcom-6.8.0.orig/net/wireless/mesh.c
+++ linux-qcom-6.8.0/net/wireless/mesh.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Portions
- * Copyright (C) 2022-2023 Intel Corporation
+ * Copyright (C) 2022-2024 Intel Corporation
  */
 #include <linux/ieee80211.h>
 #include <linux/export.h>
@@ -127,6 +127,9 @@
 	if (!rdev->ops->join_mesh)
 		return -EOPNOTSUPP;
 
+	if (wdev->cac_started)
+		return -EBUSY;
+
 	if (!setup->chandef.chan) {
 		/* if no channel explicitly given, use preset channel */
 		setup->chandef = wdev->u.mesh.preset_chandef;
--- linux-qcom-6.8.0.orig/net/wireless/nl80211.c
+++ linux-qcom-6.8.0/net/wireless/nl80211.c
@@ -468,6 +468,10 @@
 	.max = 0xffff,
 };
 
+static const struct netlink_range_validation q_range = {
+	.max = INT_MAX,
+};
+
 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 	[0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
@@ -750,7 +754,7 @@
 
 	[NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 	[NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
-	[NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
+	[NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
 	[NL80211_ATTR_HE_CAPABILITY] =
 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
 				       NL80211_HE_MAX_CAPABILITY_LEN),
@@ -807,7 +811,7 @@
 	[NL80211_ATTR_MLO_LINKS] =
 		NLA_POLICY_NESTED_ARRAY(nl80211_policy),
 	[NL80211_ATTR_MLO_LINK_ID] =
-		NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
+		NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1),
 	[NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
 	[NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 	[NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
@@ -3414,6 +3418,33 @@
 			if (chandef.chan != cur_chan)
 				return -EBUSY;
 
+			/* only allow this for regular channel widths */
+			switch (wdev->links[link_id].ap.chandef.width) {
+			case NL80211_CHAN_WIDTH_20_NOHT:
+			case NL80211_CHAN_WIDTH_20:
+			case NL80211_CHAN_WIDTH_40:
+			case NL80211_CHAN_WIDTH_80:
+			case NL80211_CHAN_WIDTH_80P80:
+			case NL80211_CHAN_WIDTH_160:
+			case NL80211_CHAN_WIDTH_320:
+				break;
+			default:
+				return -EINVAL;
+			}
+
+			switch (chandef.width) {
+			case NL80211_CHAN_WIDTH_20_NOHT:
+			case NL80211_CHAN_WIDTH_20:
+			case NL80211_CHAN_WIDTH_40:
+			case NL80211_CHAN_WIDTH_80:
+			case NL80211_CHAN_WIDTH_80P80:
+			case NL80211_CHAN_WIDTH_160:
+			case NL80211_CHAN_WIDTH_320:
+				break;
+			default:
+				return -EINVAL;
+			}
+
 			result = rdev_set_ap_chanwidth(rdev, dev, link_id,
 						       &chandef);
 			if (result)
@@ -4450,10 +4481,7 @@
 	struct nlattr *key;
 	struct get_key_cookie *cookie = c;
 
-	if ((params->key &&
-	     nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
-		     params->key_len, params->key)) ||
-	    (params->seq &&
+	if ((params->seq &&
 	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
 		     params->seq_len, params->seq)) ||
 	    (params->cipher &&
@@ -4465,10 +4493,7 @@
 	if (!key)
 		goto nla_put_failure;
 
-	if ((params->key &&
-	     nla_put(cookie->msg, NL80211_KEY_DATA,
-		     params->key_len, params->key)) ||
-	    (params->seq &&
+	if ((params->seq &&
 	     nla_put(cookie->msg, NL80211_KEY_SEQ,
 		     params->seq_len, params->seq)) ||
 	    (params->cipher &&
@@ -5936,6 +5961,9 @@
 	if (!rdev->ops->start_ap)
 		return -EOPNOTSUPP;
 
+	if (wdev->cac_started)
+		return -EBUSY;
+
 	if (wdev->links[link_id].ap.beacon_interval)
 		return -EALREADY;
 
@@ -9148,6 +9176,7 @@
 	struct wiphy *wiphy;
 	int err, tmp, n_ssids = 0, n_channels, i;
 	size_t ie_len, size;
+	size_t ssids_offset, ie_offset;
 
 	wiphy = &rdev->wiphy;
 
@@ -9193,21 +9222,20 @@
 		return -EINVAL;
 
 	size = struct_size(request, channels, n_channels);
+	ssids_offset = size;
 	size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
+	ie_offset = size;
 	size = size_add(size, ie_len);
 	request = kzalloc(size, GFP_KERNEL);
 	if (!request)
 		return -ENOMEM;
+	request->n_channels = n_channels;
 
 	if (n_ssids)
-		request->ssids = (void *)&request->channels[n_channels];
+		request->ssids = (void *)request + ssids_offset;
 	request->n_ssids = n_ssids;
-	if (ie_len) {
-		if (n_ssids)
-			request->ie = (void *)(request->ssids + n_ssids);
-		else
-			request->ie = (void *)(request->channels + n_channels);
-	}
+	if (ie_len)
+		request->ie = (void *)request + ie_offset;
 
 	i = 0;
 	if (scan_freqs) {
@@ -9647,7 +9675,8 @@
 		return ERR_PTR(-ENOMEM);
 
 	if (n_ssids)
-		request->ssids = (void *)&request->channels[n_channels];
+		request->ssids = (void *)request +
+			struct_size(request, channels, n_channels);
 	request->n_ssids = n_ssids;
 	if (ie_len) {
 		if (n_ssids)
@@ -9958,6 +9987,17 @@
 
 	flush_delayed_work(&rdev->dfs_update_channels_wk);
 
+	switch (wdev->iftype) {
+	case NL80211_IFTYPE_AP:
+	case NL80211_IFTYPE_P2P_GO:
+	case NL80211_IFTYPE_MESH_POINT:
+	case NL80211_IFTYPE_ADHOC:
+		break;
+	default:
+		/* caution - see cfg80211_beaconing_iface_active() below */
+		return -EINVAL;
+	}
+
 	wiphy_lock(wiphy);
 
 	dfs_region = reg_get_dfs_region(wiphy);
@@ -9988,12 +10028,7 @@
 		goto unlock;
 	}
 
-	if (netif_carrier_ok(dev)) {
-		err = -EBUSY;
-		goto unlock;
-	}
-
-	if (wdev->cac_started) {
+	if (cfg80211_beaconing_iface_active(wdev) || wdev->cac_started) {
 		err = -EBUSY;
 		goto unlock;
 	}
@@ -10015,7 +10050,20 @@
 
 	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
 	if (!err) {
-		wdev->links[0].ap.chandef = chandef;
+		switch (wdev->iftype) {
+		case NL80211_IFTYPE_AP:
+		case NL80211_IFTYPE_P2P_GO:
+			wdev->links[0].ap.chandef = chandef;
+			break;
+		case NL80211_IFTYPE_ADHOC:
+			wdev->u.ibss.chandef = chandef;
+			break;
+		case NL80211_IFTYPE_MESH_POINT:
+			wdev->u.mesh.chandef = chandef;
+			break;
+		default:
+			break;
+		}
 		wdev->cac_started = true;
 		wdev->cac_start_time = jiffies;
 		wdev->cac_time_ms = cac_time_ms;
@@ -14092,6 +14140,8 @@
 error:
 	for (i = 0; i < new_coalesce.n_rules; i++) {
 		tmp_rule = &new_coalesce.rules[i];
+		if (!tmp_rule)
+			continue;
 		for (j = 0; j < tmp_rule->n_patterns; j++)
 			kfree(tmp_rule->patterns[j].mask);
 		kfree(tmp_rule->patterns);
@@ -17864,10 +17914,8 @@
 
 	genlmsg_end(msg, hdr);
 
-	rcu_read_lock();
 	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
-				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
-	rcu_read_unlock();
+				NL80211_MCGRP_REGULATORY);
 
 	return;
 
@@ -18600,10 +18648,8 @@
 
 	genlmsg_end(msg, hdr);
 
-	rcu_read_lock();
 	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
-				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
-	rcu_read_unlock();
+				NL80211_MCGRP_REGULATORY);
 
 	return;
 
--- linux-qcom-6.8.0.orig/net/wireless/pmsr.c
+++ linux-qcom-6.8.0/net/wireless/pmsr.c
@@ -56,7 +56,7 @@
 	out->ftm.burst_period = 0;
 	if (tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD])
 		out->ftm.burst_period =
-			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD]);
+			nla_get_u16(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD]);
 
 	out->ftm.asap = !!tb[NL80211_PMSR_FTM_REQ_ATTR_ASAP];
 	if (out->ftm.asap && !capa->ftm.asap) {
@@ -75,7 +75,7 @@
 	out->ftm.num_bursts_exp = 0;
 	if (tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP])
 		out->ftm.num_bursts_exp =
-			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP]);
+			nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP]);
 
 	if (capa->ftm.max_bursts_exponent >= 0 &&
 	    out->ftm.num_bursts_exp > capa->ftm.max_bursts_exponent) {
@@ -88,7 +88,7 @@
 	out->ftm.burst_duration = 15;
 	if (tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION])
 		out->ftm.burst_duration =
-			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION]);
+			nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION]);
 
 	out->ftm.ftms_per_burst = 0;
 	if (tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST])
@@ -107,7 +107,7 @@
 	out->ftm.ftmr_retries = 3;
 	if (tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES])
 		out->ftm.ftmr_retries =
-			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES]);
+			nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES]);
 
 	out->ftm.request_lci = !!tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI];
 	if (out->ftm.request_lci && !capa->ftm.request_lci) {
--- linux-qcom-6.8.0.orig/net/wireless/rdev-ops.h
+++ linux-qcom-6.8.0/net/wireless/rdev-ops.h
@@ -2,7 +2,7 @@
 /*
  * Portions of this file
  * Copyright(c) 2016-2017 Intel Deutschland GmbH
- * Copyright (C) 2018, 2021-2023 Intel Corporation
+ * Copyright (C) 2018, 2021-2024 Intel Corporation
  */
 #ifndef __CFG80211_RDEV_OPS
 #define __CFG80211_RDEV_OPS
@@ -458,6 +458,10 @@
 			    struct cfg80211_scan_request *request)
 {
 	int ret;
+
+	if (WARN_ON_ONCE(!request->n_ssids && request->ssids))
+		return -EINVAL;
+
 	trace_rdev_scan(&rdev->wiphy, request);
 	ret = rdev->ops->scan(&rdev->wiphy, request);
 	trace_rdev_return_int(&rdev->wiphy, ret);
--- linux-qcom-6.8.0.orig/net/wireless/scan.c
+++ linux-qcom-6.8.0/net/wireless/scan.c
@@ -813,6 +813,7 @@
 	LIST_HEAD(coloc_ap_list);
 	bool need_scan_psc = true;
 	const struct ieee80211_sband_iftype_data *iftd;
+	size_t size, offs_ssids, offs_6ghz_params, offs_ies;
 
 	rdev_req->scan_6ghz = true;
 
@@ -878,10 +879,15 @@
 		spin_unlock_bh(&rdev->bss_lock);
 	}
 
-	request = kzalloc(struct_size(request, channels, n_channels) +
-			  sizeof(*request->scan_6ghz_params) * count +
-			  sizeof(*request->ssids) * rdev_req->n_ssids,
-			  GFP_KERNEL);
+	size = struct_size(request, channels, n_channels);
+	offs_ssids = size;
+	size += sizeof(*request->ssids) * rdev_req->n_ssids;
+	offs_6ghz_params = size;
+	size += sizeof(*request->scan_6ghz_params) * count;
+	offs_ies = size;
+	size += rdev_req->ie_len;
+
+	request = kzalloc(size, GFP_KERNEL);
 	if (!request) {
 		cfg80211_free_coloc_ap_list(&coloc_ap_list);
 		return -ENOMEM;
@@ -889,8 +895,26 @@
 
 	*request = *rdev_req;
 	request->n_channels = 0;
-	request->scan_6ghz_params =
-		(void *)&request->channels[n_channels];
+	request->n_6ghz_params = 0;
+	if (rdev_req->n_ssids) {
+		/*
+		 * Add the ssids from the parent scan request to the new
+		 * scan request, so the driver would be able to use them
+		 * in its probe requests to discover hidden APs on PSC
+		 * channels.
+		 */
+		request->ssids = (void *)request + offs_ssids;
+		memcpy(request->ssids, rdev_req->ssids,
+		       sizeof(*request->ssids) * request->n_ssids);
+	}
+	request->scan_6ghz_params = (void *)request + offs_6ghz_params;
+
+	if (rdev_req->ie_len) {
+		void *ie = (void *)request + offs_ies;
+
+		memcpy(ie, rdev_req->ie, rdev_req->ie_len);
+		request->ie = ie;
+	}
 
 	/*
 	 * PSC channels should not be scanned in case of direct scan with 1 SSID
@@ -979,17 +1003,8 @@
 
 	if (request->n_channels) {
 		struct cfg80211_scan_request *old = rdev->int_scan_req;
-		rdev->int_scan_req = request;
 
-		/*
-		 * Add the ssids from the parent scan request to the new scan
-		 * request, so the driver would be able to use them in its
-		 * probe requests to discover hidden APs on PSC channels.
-		 */
-		request->ssids = (void *)&request->channels[request->n_channels];
-		request->n_ssids = rdev_req->n_ssids;
-		memcpy(request->ssids, rdev_req->ssids, sizeof(*request->ssids) *
-		       request->n_ssids);
+		rdev->int_scan_req = request;
 
 		/*
 		 * If this scan follows a previous scan, save the scan start
@@ -1590,7 +1605,7 @@
 }
 EXPORT_SYMBOL(__cfg80211_get_bss);
 
-static void rb_insert_bss(struct cfg80211_registered_device *rdev,
+static bool rb_insert_bss(struct cfg80211_registered_device *rdev,
 			  struct cfg80211_internal_bss *bss)
 {
 	struct rb_node **p = &rdev->bss_tree.rb_node;
@@ -1606,7 +1621,7 @@
 
 		if (WARN_ON(!cmp)) {
 			/* will sort of leak this BSS */
-			return;
+			return false;
 		}
 
 		if (cmp < 0)
@@ -1617,6 +1632,7 @@
 
 	rb_link_node(&bss->rbn, parent, p);
 	rb_insert_color(&bss->rbn, &rdev->bss_tree);
+	return true;
 }
 
 static struct cfg80211_internal_bss *
@@ -1643,6 +1659,34 @@
 	return NULL;
 }
 
+static void cfg80211_insert_bss(struct cfg80211_registered_device *rdev,
+				struct cfg80211_internal_bss *bss)
+{
+	lockdep_assert_held(&rdev->bss_lock);
+
+	if (!rb_insert_bss(rdev, bss))
+		return;
+	list_add_tail(&bss->list, &rdev->bss_list);
+	rdev->bss_entries++;
+}
+
+static void cfg80211_rehash_bss(struct cfg80211_registered_device *rdev,
+                                struct cfg80211_internal_bss *bss)
+{
+	lockdep_assert_held(&rdev->bss_lock);
+
+	rb_erase(&bss->rbn, &rdev->bss_tree);
+	if (!rb_insert_bss(rdev, bss)) {
+		list_del(&bss->list);
+		if (!list_empty(&bss->hidden_list))
+			list_del_init(&bss->hidden_list);
+		if (!list_empty(&bss->pub.nontrans_list))
+			list_del_init(&bss->pub.nontrans_list);
+		rdev->bss_entries--;
+	}
+	rdev->bss_generation++;
+}
+
 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
 				   struct cfg80211_internal_bss *new)
 {
@@ -1955,9 +1999,7 @@
 			bss_ref_get(rdev, bss_from_pub(tmp->pub.transmitted_bss));
 		}
 
-		list_add_tail(&new->list, &rdev->bss_list);
-		rdev->bss_entries++;
-		rb_insert_bss(rdev, new);
+		cfg80211_insert_bss(rdev, new);
 		found = new;
 	}
 
@@ -2602,9 +2644,9 @@
 }
 
 static u8
-cfg80211_tbtt_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
-			      const struct ieee80211_neighbor_ap_info **ap_info,
-			      const u8 **tbtt_info)
+cfg80211_rnr_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
+			     const struct ieee80211_neighbor_ap_info **ap_info,
+			     u8 *param_ch_count)
 {
 	const struct ieee80211_neighbor_ap_info *info;
 	const struct element *rnr;
@@ -2661,7 +2703,9 @@
 				if (mld_id == mld_params->mld_id &&
 				    link_id == lid) {
 					*ap_info = info;
-					*tbtt_info = pos;
+					*param_ch_count =
+						le16_get_bits(mld_params->params,
+							      IEEE80211_RNR_MLD_PARAMS_BSS_CHANGE_COUNT);
 
 					return use_for;
 				}
@@ -2674,6 +2718,103 @@
 	return 0;
 }
 
+static struct element *
+cfg80211_gen_reporter_rnr(struct cfg80211_bss *source_bss, bool is_mbssid,
+			  bool same_mld, u8 link_id, u8 bss_change_count,
+			  gfp_t gfp)
+{
+	const struct cfg80211_bss_ies *ies;
+	struct ieee80211_neighbor_ap_info ap_info;
+	struct ieee80211_tbtt_info_ge_11 tbtt_info;
+	u32 short_ssid;
+	const struct element *elem;
+	struct element *res;
+
+	/*
+	 * We only generate the RNR to permit ML lookups. For that we do not
+	 * need an entry for the corresponding transmitting BSS, lets just skip
+	 * it even though it would be easy to add.
+	 */
+	if (!same_mld)
+		return NULL;
+
+	/* We could use tx_data->ies if we change cfg80211_calc_short_ssid */
+	rcu_read_lock();
+	ies = rcu_dereference(source_bss->ies);
+
+	ap_info.tbtt_info_len = offsetofend(typeof(tbtt_info), mld_params);
+	ap_info.tbtt_info_hdr =
+			u8_encode_bits(IEEE80211_TBTT_INFO_TYPE_TBTT,
+				       IEEE80211_AP_INFO_TBTT_HDR_TYPE) |
+			u8_encode_bits(0, IEEE80211_AP_INFO_TBTT_HDR_COUNT);
+
+	ap_info.channel = ieee80211_frequency_to_channel(source_bss->channel->center_freq);
+
+	/* operating class */
+	elem = cfg80211_find_elem(WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+				  ies->data, ies->len);
+	if (elem && elem->datalen >= 1) {
+		ap_info.op_class = elem->data[0];
+	} else {
+		struct cfg80211_chan_def chandef;
+
+		/* The AP is not providing us with anything to work with. So
+		 * make up a somewhat reasonable operating class, but don't
+		 * bother with it too much as no one will ever use the
+		 * information.
+		 */
+		cfg80211_chandef_create(&chandef, source_bss->channel,
+					NL80211_CHAN_NO_HT);
+
+		if (!ieee80211_chandef_to_operating_class(&chandef,
+							  &ap_info.op_class))
+			goto out_unlock;
+	}
+
+	/* Just set TBTT offset and PSD 20 to invalid/unknown */
+	tbtt_info.tbtt_offset = 255;
+	tbtt_info.psd_20 = IEEE80211_RNR_TBTT_PARAMS_PSD_RESERVED;
+
+	memcpy(tbtt_info.bssid, source_bss->bssid, ETH_ALEN);
+	if (cfg80211_calc_short_ssid(ies, &elem, &short_ssid))
+		goto out_unlock;
+
+	rcu_read_unlock();
+
+	tbtt_info.short_ssid = cpu_to_le32(short_ssid);
+
+	tbtt_info.bss_params = IEEE80211_RNR_TBTT_PARAMS_SAME_SSID;
+
+	if (is_mbssid) {
+		tbtt_info.bss_params |= IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID;
+		tbtt_info.bss_params |= IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID;
+	}
+
+	tbtt_info.mld_params.mld_id = 0;
+	tbtt_info.mld_params.params =
+		le16_encode_bits(link_id, IEEE80211_RNR_MLD_PARAMS_LINK_ID) |
+		le16_encode_bits(bss_change_count,
+				 IEEE80211_RNR_MLD_PARAMS_BSS_CHANGE_COUNT);
+
+	res = kzalloc(struct_size(res, data,
+				  sizeof(ap_info) + ap_info.tbtt_info_len),
+		      gfp);
+	if (!res)
+		return NULL;
+
+	/* Copy the data */
+	res->id = WLAN_EID_REDUCED_NEIGHBOR_REPORT;
+	res->datalen = sizeof(ap_info) + ap_info.tbtt_info_len;
+	memcpy(res->data, &ap_info, sizeof(ap_info));
+	memcpy(res->data + sizeof(ap_info), &tbtt_info, ap_info.tbtt_info_len);
+
+	return res;
+
+out_unlock:
+	rcu_read_unlock();
+	return NULL;
+}
+
 static void
 cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
 				struct cfg80211_inform_single_bss_data *tx_data,
@@ -2687,13 +2828,14 @@
 		.source_bss = source_bss,
 		.bss_source = BSS_SOURCE_STA_PROFILE,
 	};
+	struct element *reporter_rnr = NULL;
 	struct ieee80211_multi_link_elem *ml_elem;
 	struct cfg80211_mle *mle;
 	u16 control;
 	u8 ml_common_len;
-	u8 *new_ie;
+	u8 *new_ie = NULL;
 	struct cfg80211_bss *bss;
-	int mld_id;
+	u8 mld_id, reporter_link_id, bss_change_count;
 	u16 seen_links = 0;
 	const u8 *pos;
 	u8 i;
@@ -2715,8 +2857,14 @@
 
 	ml_common_len = ml_elem->variable[0];
 
-	/* length + MLD MAC address + link ID info + BSS Params Change Count */
-	pos = ml_elem->variable + 1 + 6 + 1 + 1;
+	/* length + MLD MAC address */
+	pos = ml_elem->variable + 1 + 6;
+
+	reporter_link_id = pos[0];
+	pos += 1;
+
+	bss_change_count = pos[0];
+	pos += 1;
 
 	if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_MED_SYNC_DELAY))
 		pos += 2;
@@ -2747,17 +2895,28 @@
 	if (!mle)
 		return;
 
+	/* No point in doing anything if there is no per-STA profile */
+	if (!mle->sta_prof[0])
+		goto out;
+
 	new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
 	if (!new_ie)
 		goto out;
 
+	reporter_rnr = cfg80211_gen_reporter_rnr(source_bss,
+						 u16_get_bits(control,
+							      IEEE80211_MLC_BASIC_PRES_MLD_ID),
+						 mld_id == 0, reporter_link_id,
+						 bss_change_count,
+						 gfp);
+
 	for (i = 0; i < ARRAY_SIZE(mle->sta_prof) && mle->sta_prof[i]; i++) {
 		const struct ieee80211_neighbor_ap_info *ap_info;
 		enum nl80211_band band;
 		u32 freq;
 		const u8 *profile;
-		const u8 *tbtt_info;
 		ssize_t profile_len;
+		u8 param_ch_count;
 		u8 link_id, use_for;
 
 		if (!ieee80211_mle_basic_sta_prof_size_ok((u8 *)mle->sta_prof[i],
@@ -2800,10 +2959,11 @@
 		profile_len -= 2;
 
 		/* Find in RNR to look up channel information */
-		use_for = cfg80211_tbtt_info_for_mld_ap(tx_data->ie,
-							tx_data->ielen,
-							mld_id, link_id,
-							&ap_info, &tbtt_info);
+		use_for = cfg80211_rnr_info_for_mld_ap(tx_data->ie,
+						       tx_data->ielen,
+						       mld_id, link_id,
+						       &ap_info,
+						       &param_ch_count);
 		if (!use_for)
 			continue;
 
@@ -2846,7 +3006,8 @@
 			continue;
 
 		/* Copy the Basic Multi-Link element including the common
-		 * information, and then fix up the link ID.
+		 * information, and then fix up the link ID and BSS param
+		 * change count.
 		 * Note that the ML element length has been verified and we
 		 * also checked that it contains the link ID.
 		 */
@@ -2857,10 +3018,21 @@
 		       sizeof(*ml_elem) + ml_common_len);
 
 		new_ie[data.ielen + sizeof(*ml_elem) + 1 + ETH_ALEN] = link_id;
+		new_ie[data.ielen + sizeof(*ml_elem) + 1 + ETH_ALEN + 1] =
+			param_ch_count;
 
 		data.ielen += sizeof(*ml_elem) + ml_common_len;
 
-		/* TODO: Add an RNR containing only the reporting AP */
+		if (reporter_rnr && (use_for & NL80211_BSS_USE_FOR_NORMAL)) {
+			if (data.ielen + sizeof(struct element) +
+			    reporter_rnr->datalen > IEEE80211_MAX_DATA_LEN)
+				continue;
+
+			memcpy(new_ie + data.ielen, reporter_rnr,
+			       sizeof(struct element) + reporter_rnr->datalen);
+			data.ielen += sizeof(struct element) +
+				      reporter_rnr->datalen;
+		}
 
 		bss = cfg80211_inform_single_bss_data(wiphy, &data, gfp);
 		if (!bss)
@@ -2869,6 +3041,7 @@
 	}
 
 out:
+	kfree(reporter_rnr);
 	kfree(new_ie);
 	kfree(mle);
 }
@@ -2937,7 +3110,8 @@
 	struct ieee80211_he_operation *he_oper;
 
 	tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, ielen);
-	if (tmp && tmp->datalen >= sizeof(*he_oper) + 1) {
+	if (tmp && tmp->datalen >= sizeof(*he_oper) + 1 &&
+	    tmp->datalen >= ieee80211_he_oper_size(tmp->data + 1)) {
 		const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
 
 		he_oper = (void *)&tmp->data[1];
@@ -2974,8 +3148,7 @@
 	struct ieee80211_ext *ext = NULL;
 	u8 *bssid, *variable;
 	u16 capability, beacon_int;
-	size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt,
-					     u.probe_resp.variable);
+	size_t ielen, min_hdr_len;
 	int bss_type;
 
 	BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
@@ -2995,10 +3168,16 @@
 
 	if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
 		ext = (void *) mgmt;
-		min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon);
 		if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
 			min_hdr_len = offsetof(struct ieee80211_ext,
 					       u.s1g_short_beacon.variable);
+		else
+			min_hdr_len = offsetof(struct ieee80211_mgmt,
+					       u.probe_resp.variable);
+	} else {
+		/* same for beacons */
+		min_hdr_len = offsetof(struct ieee80211_mgmt,
+				       u.probe_resp.variable);
 	}
 
 	if (WARN_ON(len < min_hdr_len))
@@ -3285,19 +3464,14 @@
 		if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new)))
 			rdev->bss_generation++;
 	}
-
-	rb_erase(&cbss->rbn, &rdev->bss_tree);
-	rb_insert_bss(rdev, cbss);
-	rdev->bss_generation++;
+	cfg80211_rehash_bss(rdev, cbss);
 
 	list_for_each_entry_safe(nontrans_bss, tmp,
 				 &cbss->pub.nontrans_list,
 				 nontrans_list) {
 		bss = bss_from_pub(nontrans_bss);
 		bss->pub.channel = chan;
-		rb_erase(&bss->rbn, &rdev->bss_tree);
-		rb_insert_bss(rdev, bss);
-		rdev->bss_generation++;
+		cfg80211_rehash_bss(rdev, bss);
 	}
 
 done:
@@ -3352,13 +3526,17 @@
 	wiphy = &rdev->wiphy;
 
 	/* Determine number of channels, needed to allocate creq */
-	if (wreq && wreq->num_channels)
+	if (wreq && wreq->num_channels) {
+		/* Passed from userspace so should be checked */
+		if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES))
+			return -EINVAL;
 		n_channels = wreq->num_channels;
-	else
+	} else {
 		n_channels = ieee80211_get_num_supported_channels(wiphy);
+	}
 
-	creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
-		       n_channels * sizeof(void *),
+	creq = kzalloc(struct_size(creq, channels, n_channels) +
+		       sizeof(struct cfg80211_ssid),
 		       GFP_ATOMIC);
 	if (!creq)
 		return -ENOMEM;
@@ -3366,7 +3544,7 @@
 	creq->wiphy = wiphy;
 	creq->wdev = dev->ieee80211_ptr;
 	/* SSIDs come after channels */
-	creq->ssids = (void *)&creq->channels[n_channels];
+	creq->ssids = (void *)creq + struct_size(creq, channels, n_channels);
 	creq->n_channels = n_channels;
 	creq->n_ssids = 1;
 	creq->scan_start = jiffies;
@@ -3429,8 +3607,10 @@
 			memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
 			creq->ssids[0].ssid_len = wreq->essid_len;
 		}
-		if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
+		if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE) {
+			creq->ssids = NULL;
 			creq->n_ssids = 0;
+		}
 	}
 
 	for (i = 0; i < NUM_NL80211_BANDS; i++)
--- linux-qcom-6.8.0.orig/net/wireless/sme.c
+++ linux-qcom-6.8.0/net/wireless/sme.c
@@ -83,6 +83,7 @@
 	if (!request)
 		return -ENOMEM;
 
+	request->n_channels = n_channels;
 	if (wdev->conn->params.channel) {
 		enum nl80211_band band = wdev->conn->params.channel->band;
 		struct ieee80211_supported_band *sband =
@@ -115,7 +116,8 @@
 		n_channels = i;
 	}
 	request->n_channels = n_channels;
-	request->ssids = (void *)&request->channels[n_channels];
+	request->ssids = (void *)request +
+		struct_size(request, channels, n_channels);
 	request->n_ssids = 1;
 
 	memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
@@ -1044,6 +1046,7 @@
 			cfg80211_hold_bss(
 				bss_from_pub(params->links[link].bss));
 		ev->cr.links[link].bss = params->links[link].bss;
+		ev->cr.links[link].status = params->links[link].status;
 
 		if (params->links[link].addr) {
 			ev->cr.links[link].addr = next;
--- linux-qcom-6.8.0.orig/net/wireless/sysfs.c
+++ linux-qcom-6.8.0/net/wireless/sysfs.c
@@ -5,7 +5,7 @@
  *
  * Copyright 2005-2006	Jiri Benc <jbenc@suse.cz>
  * Copyright 2006	Johannes Berg <johannes@sipsolutions.net>
- * Copyright (C) 2020-2021, 2023 Intel Corporation
+ * Copyright (C) 2020-2021, 2023-2024 Intel Corporation
  */
 
 #include <linux/device.h>
@@ -137,7 +137,7 @@
 	if (rdev->wiphy.registered && rdev->ops->resume)
 		ret = rdev_resume(rdev);
 	rdev->suspended = false;
-	schedule_work(&rdev->wiphy_work);
+	queue_work(system_unbound_wq, &rdev->wiphy_work);
 	wiphy_unlock(&rdev->wiphy);
 
 	if (ret)
--- linux-qcom-6.8.0.orig/net/wireless/tests/scan.c
+++ linux-qcom-6.8.0/net/wireless/tests/scan.c
@@ -2,7 +2,7 @@
 /*
  * KUnit tests for inform_bss functions
  *
- * Copyright (C) 2023 Intel Corporation
+ * Copyright (C) 2023-2024 Intel Corporation
  */
 #include <linux/ieee80211.h>
 #include <net/cfg80211.h>
@@ -406,9 +406,27 @@
 	const char *desc;
 	int mld_id;
 	bool sta_prof_vendor_elems;
+	bool include_oper_class;
 } inform_bss_ml_sta_cases[] = {
-	{ .desc = "no_mld_id", .mld_id = 0, .sta_prof_vendor_elems = false },
-	{ .desc = "mld_id_eq_1", .mld_id = 1, .sta_prof_vendor_elems = true },
+	{
+		.desc = "zero_mld_id",
+		.mld_id = 0,
+		.sta_prof_vendor_elems = false,
+	}, {
+		.desc = "zero_mld_id_with_oper_class",
+		.mld_id = 0,
+		.sta_prof_vendor_elems = false,
+		.include_oper_class = true,
+	}, {
+		.desc = "mld_id_eq_1",
+		.mld_id = 1,
+		.sta_prof_vendor_elems = true,
+	}, {
+		.desc = "mld_id_eq_1_with_oper_class",
+		.mld_id = 1,
+		.sta_prof_vendor_elems = true,
+		.include_oper_class = true,
+	},
 };
 KUNIT_ARRAY_PARAM_DESC(inform_bss_ml_sta, inform_bss_ml_sta_cases, desc)
 
@@ -515,6 +533,12 @@
 	skb_put_u8(input, 4);
 	skb_put_data(input, "TEST", 4);
 
+	if (params->include_oper_class) {
+		skb_put_u8(input, WLAN_EID_SUPPORTED_REGULATORY_CLASSES);
+		skb_put_u8(input, 1);
+		skb_put_u8(input, 81);
+	}
+
 	skb_put_u8(input, WLAN_EID_REDUCED_NEIGHBOR_REPORT);
 	skb_put_u8(input, sizeof(rnr));
 	skb_put_data(input, &rnr, sizeof(rnr));
@@ -582,15 +606,21 @@
 	KUNIT_EXPECT_EQ(test, ies->tsf, tsf + le64_to_cpu(sta_prof.tsf_offset));
 	/* Resulting length should be:
 	 * SSID (inherited) + RNR (inherited) + vendor element(s) +
+	 * operating class (if requested) +
+	 * generated RNR (if MLD ID == 0) +
 	 * MLE common info + MLE header and control
 	 */
 	if (params->sta_prof_vendor_elems)
 		KUNIT_EXPECT_EQ(test, ies->len,
 				6 + 2 + sizeof(rnr) + 2 + 160 + 2 + 165 +
+				(params->include_oper_class ? 3 : 0) +
+				(!params->mld_id ? 22 : 0) +
 				mle_basic_common_info.var_len + 5);
 	else
 		KUNIT_EXPECT_EQ(test, ies->len,
 				6 + 2 + sizeof(rnr) + 2 + 155 +
+				(params->include_oper_class ? 3 : 0) +
+				(!params->mld_id ? 22 : 0) +
 				mle_basic_common_info.var_len + 5);
 	rcu_read_unlock();
 
--- linux-qcom-6.8.0.orig/net/wireless/trace.h
+++ linux-qcom-6.8.0/net/wireless/trace.h
@@ -1013,7 +1013,7 @@
 TRACE_EVENT(rdev_dump_mpp,
 	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int _idx,
 		 u8 *dst, u8 *mpp),
-	TP_ARGS(wiphy, netdev, _idx, mpp, dst),
+	TP_ARGS(wiphy, netdev, _idx, dst, mpp),
 	TP_STRUCT__entry(
 		WIPHY_ENTRY
 		NETDEV_ENTRY
@@ -1747,7 +1747,7 @@
 
 DECLARE_EVENT_CLASS(tx_rx_evt,
 	TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
-	TP_ARGS(wiphy, rx, tx),
+	TP_ARGS(wiphy, tx, rx),
 	TP_STRUCT__entry(
 		WIPHY_ENTRY
 		__field(u32, tx)
@@ -1764,7 +1764,7 @@
 
 DEFINE_EVENT(tx_rx_evt, rdev_set_antenna,
 	TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
-	TP_ARGS(wiphy, rx, tx)
+	TP_ARGS(wiphy, tx, rx)
 );
 
 DECLARE_EVENT_CLASS(wiphy_netdev_id_evt,
--- linux-qcom-6.8.0.orig/net/wireless/util.c
+++ linux-qcom-6.8.0/net/wireless/util.c
@@ -791,15 +791,19 @@
 
 bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr)
 {
-	int offset = 0, remaining, subframe_len, padding;
+	int offset = 0, subframe_len, padding;
 
 	for (offset = 0; offset < skb->len; offset += subframe_len + padding) {
+		int remaining = skb->len - offset;
 		struct {
 		    __be16 len;
 		    u8 mesh_flags;
 		} hdr;
 		u16 len;
 
+		if (sizeof(hdr) > remaining)
+			return false;
+
 		if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0)
 			return false;
 
@@ -807,7 +811,6 @@
 						      mesh_hdr);
 		subframe_len = sizeof(struct ethhdr) + len;
 		padding = (4 - subframe_len) & 0x3;
-		remaining = skb->len - offset;
 
 		if (subframe_len > remaining)
 			return false;
@@ -825,7 +828,7 @@
 {
 	unsigned int hlen = ALIGN(extra_headroom, 4);
 	struct sk_buff *frame = NULL;
-	int offset = 0, remaining;
+	int offset = 0;
 	struct {
 		struct ethhdr eth;
 		uint8_t flags;
@@ -839,10 +842,14 @@
 		copy_len = sizeof(hdr);
 
 	while (!last) {
+		int remaining = skb->len - offset;
 		unsigned int subframe_len;
 		int len, mesh_len = 0;
 		u8 padding;
 
+		if (copy_len > remaining)
+			goto purge;
+
 		skb_copy_bits(skb, offset, &hdr, copy_len);
 		if (iftype == NL80211_IFTYPE_MESH_POINT)
 			mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags);
@@ -852,7 +859,6 @@
 		padding = (4 - subframe_len) & 0x3;
 
 		/* the last MSDU has no padding */
-		remaining = skb->len - offset;
 		if (subframe_len > remaining)
 			goto purge;
 		/* mitigate A-MSDU aggregation injection attacks */
@@ -992,10 +998,10 @@
 	 * Diffserv Service Classes no update is needed:
 	 * - Standard: DF
 	 * - Low Priority Data: CS1
-	 * - Multimedia Streaming: AF31, AF32, AF33
 	 * - Multimedia Conferencing: AF41, AF42, AF43
 	 * - Network Control Traffic: CS7
 	 * - Real-Time Interactive: CS4
+	 * - Signaling: CS5
 	 */
 	switch (dscp >> 2) {
 	case 10:
@@ -1020,9 +1026,11 @@
 		/* Broadcasting video: CS3 */
 		ret = 4;
 		break;
-	case 40:
-		/* Signaling: CS5 */
-		ret = 5;
+	case 26:
+	case 28:
+	case 30:
+		/* Multimedia Streaming: AF31, AF32, AF33 */
+		ret = 4;
 		break;
 	case 44:
 		/* Voice Admit: VA */
@@ -1498,7 +1506,7 @@
 		  5120, /*  0.833333... */
 	};
 	u32 rates_160M[3] = { 960777777, 907400000, 816666666 };
-	u32 rates_969[3] =  { 480388888, 453700000, 408333333 };
+	u32 rates_996[3] =  { 480388888, 453700000, 408333333 };
 	u32 rates_484[3] =  { 229411111, 216666666, 195000000 };
 	u32 rates_242[3] =  { 114711111, 108333333,  97500000 };
 	u32 rates_106[3] =  {  40000000,  37777777,  34000000 };
@@ -1518,12 +1526,14 @@
 	if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8))
 		return 0;
 
-	if (rate->bw == RATE_INFO_BW_160)
+	if (rate->bw == RATE_INFO_BW_160 ||
+	    (rate->bw == RATE_INFO_BW_HE_RU &&
+	     rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996))
 		result = rates_160M[rate->he_gi];
 	else if (rate->bw == RATE_INFO_BW_80 ||
 		 (rate->bw == RATE_INFO_BW_HE_RU &&
 		  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_996))
-		result = rates_969[rate->he_gi];
+		result = rates_996[rate->he_gi];
 	else if (rate->bw == RATE_INFO_BW_40 ||
 		 (rate->bw == RATE_INFO_BW_HE_RU &&
 		  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_484))
@@ -2467,6 +2477,7 @@
 {
 	struct cfg80211_registered_device *rdev;
 	struct wireless_dev *wdev;
+	int ret;
 
 	wdev = dev->ieee80211_ptr;
 	if (!wdev)
@@ -2478,7 +2489,11 @@
 
 	memset(sinfo, 0, sizeof(*sinfo));
 
-	return rdev_get_station(rdev, dev, mac_addr, sinfo);
+	wiphy_lock(&rdev->wiphy);
+	ret = rdev_get_station(rdev, dev, mac_addr, sinfo);
+	wiphy_unlock(&rdev->wiphy);
+
+	return ret;
 }
 EXPORT_SYMBOL(cfg80211_get_station);
 
@@ -2733,10 +2748,9 @@
 		break;
 	}
 
-	wdev->valid_links &= ~BIT(link_id);
-
 	rdev_del_intf_link(rdev, wdev, link_id);
 
+	wdev->valid_links &= ~BIT(link_id);
 	eth_zero_addr(wdev->links[link_id].addr);
 }
 
--- linux-qcom-6.8.0.orig/net/wireless/wext-core.c
+++ linux-qcom-6.8.0/net/wireless/wext-core.c
@@ -4,6 +4,7 @@
  * Authors :	Jean Tourrilhes - HPL - <jt@hpl.hp.com>
  * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
  * Copyright	2009 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright (C) 2024 Intel Corporation
  *
  * (As all part of the Linux kernel, this file is GPL)
  */
@@ -662,7 +663,8 @@
 	    dev->ieee80211_ptr->wiphy->wext &&
 	    dev->ieee80211_ptr->wiphy->wext->get_wireless_stats) {
 		wireless_warn_cfg80211_wext();
-		if (dev->ieee80211_ptr->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO)
+		if (dev->ieee80211_ptr->wiphy->flags & (WIPHY_FLAG_SUPPORTS_MLO |
+							WIPHY_FLAG_DISABLE_WEXT))
 			return NULL;
 		return dev->ieee80211_ptr->wiphy->wext->get_wireless_stats(dev);
 	}
@@ -704,7 +706,8 @@
 #ifdef CONFIG_CFG80211_WEXT
 	if (dev->ieee80211_ptr && dev->ieee80211_ptr->wiphy) {
 		wireless_warn_cfg80211_wext();
-		if (dev->ieee80211_ptr->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO)
+		if (dev->ieee80211_ptr->wiphy->flags & (WIPHY_FLAG_SUPPORTS_MLO |
+							WIPHY_FLAG_DISABLE_WEXT))
 			return NULL;
 		handlers = dev->ieee80211_ptr->wiphy->wext;
 	}
--- linux-qcom-6.8.0.orig/net/x25/af_x25.c
+++ linux-qcom-6.8.0/net/x25/af_x25.c
@@ -460,12 +460,12 @@
 	if (get_user(len, optlen))
 		goto out;
 
-	len = min_t(unsigned int, len, sizeof(int));
-
 	rc = -EINVAL;
 	if (len < 0)
 		goto out;
 
+	len = min_t(unsigned int, len, sizeof(int));
+
 	rc = -EFAULT;
 	if (put_user(len, optlen))
 		goto out;
--- linux-qcom-6.8.0.orig/net/xdp/xdp_umem.c
+++ linux-qcom-6.8.0/net/xdp/xdp_umem.c
@@ -151,6 +151,7 @@
 #define XDP_UMEM_FLAGS_VALID ( \
 		XDP_UMEM_UNALIGNED_CHUNK_FLAG | \
 		XDP_UMEM_TX_SW_CSUM | \
+		XDP_UMEM_TX_METADATA_LEN | \
 	0)
 
 static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
@@ -204,8 +205,11 @@
 	if (headroom >= chunk_size - XDP_PACKET_HEADROOM)
 		return -EINVAL;
 
-	if (mr->tx_metadata_len >= 256 || mr->tx_metadata_len % 8)
-		return -EINVAL;
+	if (mr->flags & XDP_UMEM_TX_METADATA_LEN) {
+		if (mr->tx_metadata_len >= 256 || mr->tx_metadata_len % 8)
+			return -EINVAL;
+		umem->tx_metadata_len = mr->tx_metadata_len;
+	}
 
 	umem->size = size;
 	umem->headroom = headroom;
@@ -215,7 +219,6 @@
 	umem->pgs = NULL;
 	umem->user = NULL;
 	umem->flags = mr->flags;
-	umem->tx_metadata_len = mr->tx_metadata_len;
 
 	INIT_LIST_HEAD(&umem->xsk_dma_list);
 	refcount_set(&umem->users, 1);
--- linux-qcom-6.8.0.orig/net/xdp/xsk.c
+++ linux-qcom-6.8.0/net/xdp/xsk.c
@@ -686,6 +686,8 @@
 		len = desc->len;
 
 		if (!skb) {
+			first_frag = true;
+
 			hr = max(NET_SKB_PAD, L1_CACHE_ALIGN(dev->needed_headroom));
 			tr = dev->needed_tailroom;
 			skb = sock_alloc_send_skb(&xs->sk, hr + len + tr, 1, &err);
@@ -696,12 +698,8 @@
 			skb_put(skb, len);
 
 			err = skb_store_bits(skb, 0, buffer, len);
-			if (unlikely(err)) {
-				kfree_skb(skb);
+			if (unlikely(err))
 				goto free_err;
-			}
-
-			first_frag = true;
 		} else {
 			int nr_frags = skb_shinfo(skb)->nr_frags;
 			struct page *page;
@@ -769,6 +767,9 @@
 	return skb;
 
 free_err:
+	if (first_frag && skb)
+		kfree_skb(skb);
+
 	if (err == -EOVERFLOW) {
 		/* Drop the packet */
 		xsk_set_destructor_arg(xs->skb);
@@ -1414,6 +1415,8 @@
 		struct xsk_queue **q;
 		int entries;
 
+		if (optlen < sizeof(entries))
+			return -EINVAL;
 		if (copy_from_sockptr(&entries, optval, sizeof(entries)))
 			return -EFAULT;
 
--- linux-qcom-6.8.0.orig/net/xdp/xsk_buff_pool.c
+++ linux-qcom-6.8.0/net/xdp/xsk_buff_pool.c
@@ -383,10 +383,9 @@
 		return;
 	}
 
-	if (!refcount_dec_and_test(&dma_map->users))
-		return;
+	if (refcount_dec_and_test(&dma_map->users))
+		__xp_dma_unmap(dma_map, attrs);
 
-	__xp_dma_unmap(dma_map, attrs);
 	kvfree(pool->dma_pages);
 	pool->dma_pages = NULL;
 	pool->dma_pages_cnt = 0;
--- linux-qcom-6.8.0.orig/net/xdp/xsk_diag.c
+++ linux-qcom-6.8.0/net/xdp/xsk_diag.c
@@ -194,6 +194,7 @@
 }
 
 static const struct sock_diag_handler xsk_diag_handler = {
+	.owner = THIS_MODULE,
 	.family = AF_XDP,
 	.dump = xsk_diag_handler_dump,
 };
--- linux-qcom-6.8.0.orig/net/xdp/xskmap.c
+++ linux-qcom-6.8.0/net/xdp/xskmap.c
@@ -224,7 +224,7 @@
 	struct xsk_map *m = container_of(map, struct xsk_map, map);
 	struct xdp_sock __rcu **map_entry;
 	struct xdp_sock *old_xs;
-	int k = *(u32 *)key;
+	u32 k = *(u32 *)key;
 
 	if (k >= map->max_entries)
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/net/xfrm/xfrm_device.c
+++ linux-qcom-6.8.0/net/xfrm/xfrm_device.c
@@ -263,6 +263,8 @@
 
 	dev = dev_get_by_index(net, xuo->ifindex);
 	if (!dev) {
+		struct xfrm_dst_lookup_params params;
+
 		if (!(xuo->flags & XFRM_OFFLOAD_INBOUND)) {
 			saddr = &x->props.saddr;
 			daddr = &x->id.daddr;
@@ -271,9 +273,12 @@
 			daddr = &x->props.saddr;
 		}
 
-		dst = __xfrm_dst_lookup(net, 0, 0, saddr, daddr,
-					x->props.family,
-					xfrm_smark_get(0, x));
+		memset(&params, 0, sizeof(params));
+		params.net = net;
+		params.saddr = saddr;
+		params.daddr = daddr;
+		params.mark = xfrm_smark_get(0, x);
+		dst = __xfrm_dst_lookup(x->props.family, &params);
 		if (IS_ERR(dst))
 			return (is_packet_offload) ? -EINVAL : 0;
 
@@ -407,7 +412,8 @@
 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 	struct net_device *dev = x->xso.dev;
 
-	if (!x->type_offload)
+	if (!x->type_offload ||
+	    (x->xso.type == XFRM_DEV_OFFLOAD_UNSPECIFIED && x->encap))
 		return false;
 
 	if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET ||
--- linux-qcom-6.8.0.orig/net/xfrm/xfrm_input.c
+++ linux-qcom-6.8.0/net/xfrm/xfrm_input.c
@@ -388,11 +388,15 @@
  */
 static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb)
 {
+	struct xfrm_offload *xo = xfrm_offload(skb);
 	int ihl = skb->data - skb_transport_header(skb);
 
 	if (skb->transport_header != skb->network_header) {
 		memmove(skb_transport_header(skb),
 			skb_network_header(skb), ihl);
+		if (xo)
+			xo->orig_mac_len =
+				skb_mac_header_was_set(skb) ? skb_mac_header_len(skb) : 0;
 		skb->network_header = skb->transport_header;
 	}
 	ip_hdr(skb)->tot_len = htons(skb->len + ihl);
@@ -403,11 +407,15 @@
 static int xfrm6_transport_input(struct xfrm_state *x, struct sk_buff *skb)
 {
 #if IS_ENABLED(CONFIG_IPV6)
+	struct xfrm_offload *xo = xfrm_offload(skb);
 	int ihl = skb->data - skb_transport_header(skb);
 
 	if (skb->transport_header != skb->network_header) {
 		memmove(skb_transport_header(skb),
 			skb_network_header(skb), ihl);
+		if (xo)
+			xo->orig_mac_len =
+				skb_mac_header_was_set(skb) ? skb_mac_header_len(skb) : 0;
 		skb->network_header = skb->transport_header;
 	}
 	ipv6_hdr(skb)->payload_len = htons(skb->len + ihl -
--- linux-qcom-6.8.0.orig/net/xfrm/xfrm_policy.c
+++ linux-qcom-6.8.0/net/xfrm/xfrm_policy.c
@@ -266,10 +266,8 @@
 	return rcu_dereference(xfrm_if_cb);
 }
 
-struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,
-				    const xfrm_address_t *saddr,
-				    const xfrm_address_t *daddr,
-				    int family, u32 mark)
+struct dst_entry *__xfrm_dst_lookup(int family,
+				    const struct xfrm_dst_lookup_params *params)
 {
 	const struct xfrm_policy_afinfo *afinfo;
 	struct dst_entry *dst;
@@ -278,7 +276,7 @@
 	if (unlikely(afinfo == NULL))
 		return ERR_PTR(-EAFNOSUPPORT);
 
-	dst = afinfo->dst_lookup(net, tos, oif, saddr, daddr, mark);
+	dst = afinfo->dst_lookup(params);
 
 	rcu_read_unlock();
 
@@ -292,6 +290,7 @@
 						xfrm_address_t *prev_daddr,
 						int family, u32 mark)
 {
+	struct xfrm_dst_lookup_params params;
 	struct net *net = xs_net(x);
 	xfrm_address_t *saddr = &x->props.saddr;
 	xfrm_address_t *daddr = &x->id.daddr;
@@ -306,7 +305,29 @@
 		daddr = x->coaddr;
 	}
 
-	dst = __xfrm_dst_lookup(net, tos, oif, saddr, daddr, family, mark);
+	params.net = net;
+	params.saddr = saddr;
+	params.daddr = daddr;
+	params.tos = tos;
+	params.oif = oif;
+	params.mark = mark;
+	params.ipproto = x->id.proto;
+	if (x->encap) {
+		switch (x->encap->encap_type) {
+		case UDP_ENCAP_ESPINUDP:
+			params.ipproto = IPPROTO_UDP;
+			params.uli.ports.sport = x->encap->encap_sport;
+			params.uli.ports.dport = x->encap->encap_dport;
+			break;
+		case TCP_ENCAP_ESPINTCP:
+			params.ipproto = IPPROTO_TCP;
+			params.uli.ports.sport = x->encap->encap_sport;
+			params.uli.ports.dport = x->encap->encap_dport;
+			break;
+		}
+	}
+
+	dst = __xfrm_dst_lookup(family, &params);
 
 	if (!IS_ERR(dst)) {
 		if (prev_saddr != saddr)
@@ -451,6 +472,8 @@
 
 static void xfrm_policy_kill(struct xfrm_policy *policy)
 {
+	xfrm_dev_policy_delete(policy);
+
 	write_lock_bh(&policy->lock);
 	policy->walk.dead = 1;
 	write_unlock_bh(&policy->lock);
@@ -1849,7 +1872,6 @@
 
 		__xfrm_policy_unlink(pol, dir);
 		spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
-		xfrm_dev_policy_delete(pol);
 		cnt++;
 		xfrm_audit_policy_delete(pol, 1, task_valid);
 		xfrm_policy_kill(pol);
@@ -1890,7 +1912,6 @@
 
 		__xfrm_policy_unlink(pol, dir);
 		spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
-		xfrm_dev_policy_delete(pol);
 		cnt++;
 		xfrm_audit_policy_delete(pol, 1, task_valid);
 		xfrm_policy_kill(pol);
@@ -2341,7 +2362,6 @@
 	pol = __xfrm_policy_unlink(pol, dir);
 	spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
 	if (pol) {
-		xfrm_dev_policy_delete(pol);
 		xfrm_policy_kill(pol);
 		return 0;
 	}
@@ -2440,15 +2460,15 @@
 }
 
 static int
-xfrm_get_saddr(struct net *net, int oif, xfrm_address_t *local,
-	       xfrm_address_t *remote, unsigned short family, u32 mark)
+xfrm_get_saddr(unsigned short family, xfrm_address_t *saddr,
+	       const struct xfrm_dst_lookup_params *params)
 {
 	int err;
 	const struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
 
 	if (unlikely(afinfo == NULL))
 		return -EINVAL;
-	err = afinfo->get_saddr(net, oif, local, remote, mark);
+	err = afinfo->get_saddr(saddr, params);
 	rcu_read_unlock();
 	return err;
 }
@@ -2477,9 +2497,14 @@
 			remote = &tmpl->id.daddr;
 			local = &tmpl->saddr;
 			if (xfrm_addr_any(local, tmpl->encap_family)) {
-				error = xfrm_get_saddr(net, fl->flowi_oif,
-						       &tmp, remote,
-						       tmpl->encap_family, 0);
+				struct xfrm_dst_lookup_params params;
+
+				memset(&params, 0, sizeof(params));
+				params.net = net;
+				params.oif = fl->flowi_oif;
+				params.daddr = remote;
+				error = xfrm_get_saddr(tmpl->encap_family, &tmp,
+						       &params);
 				if (error)
 					goto fail;
 				local = &tmp;
@@ -2597,8 +2622,7 @@
 			   int nfheader_len)
 {
 	if (dst->ops->family == AF_INET6) {
-		struct rt6_info *rt = (struct rt6_info *)dst;
-		path->path_cookie = rt6_get_cookie(rt);
+		path->path_cookie = rt6_get_cookie(dst_rt6_info(dst));
 		path->u.rt6.rt6i_nfheader_len = nfheader_len;
 	}
 }
@@ -3765,15 +3789,10 @@
 	/* Impossible. Such dst must be popped before reaches point of failure. */
 }
 
-static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst)
+static void xfrm_negative_advice(struct sock *sk, struct dst_entry *dst)
 {
-	if (dst) {
-		if (dst->obsolete) {
-			dst_release(dst);
-			dst = NULL;
-		}
-	}
-	return dst;
+	if (dst->obsolete)
+		sk_dst_reset(sk);
 }
 
 static void xfrm_init_pmtu(struct xfrm_dst **bundle, int nr)
--- linux-qcom-6.8.0.orig/net/xfrm/xfrm_state.c
+++ linux-qcom-6.8.0/net/xfrm/xfrm_state.c
@@ -49,6 +49,7 @@
 
 static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task);
 static HLIST_HEAD(xfrm_state_gc_list);
+static HLIST_HEAD(xfrm_state_dev_gc_list);
 
 static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x)
 {
@@ -214,6 +215,7 @@
 static struct xfrm_state_afinfo __rcu *xfrm_state_afinfo[NPROTO];
 
 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
+static DEFINE_SPINLOCK(xfrm_state_dev_gc_lock);
 
 int __xfrm_state_delete(struct xfrm_state *x);
 
@@ -683,6 +685,41 @@
 }
 EXPORT_SYMBOL(xfrm_state_alloc);
 
+#ifdef CONFIG_XFRM_OFFLOAD
+void xfrm_dev_state_delete(struct xfrm_state *x)
+{
+	struct xfrm_dev_offload *xso = &x->xso;
+	struct net_device *dev = READ_ONCE(xso->dev);
+
+	if (dev) {
+		dev->xfrmdev_ops->xdo_dev_state_delete(x);
+		spin_lock_bh(&xfrm_state_dev_gc_lock);
+		hlist_add_head(&x->dev_gclist, &xfrm_state_dev_gc_list);
+		spin_unlock_bh(&xfrm_state_dev_gc_lock);
+	}
+}
+EXPORT_SYMBOL_GPL(xfrm_dev_state_delete);
+
+void xfrm_dev_state_free(struct xfrm_state *x)
+{
+	struct xfrm_dev_offload *xso = &x->xso;
+	struct net_device *dev = READ_ONCE(xso->dev);
+
+	if (dev && dev->xfrmdev_ops) {
+		spin_lock_bh(&xfrm_state_dev_gc_lock);
+		if (!hlist_unhashed(&x->dev_gclist))
+			hlist_del(&x->dev_gclist);
+		spin_unlock_bh(&xfrm_state_dev_gc_lock);
+
+		if (dev->xfrmdev_ops->xdo_dev_state_free)
+			dev->xfrmdev_ops->xdo_dev_state_free(x);
+		WRITE_ONCE(xso->dev, NULL);
+		xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED;
+		netdev_put(dev, &xso->dev_tracker);
+	}
+}
+#endif
+
 void __xfrm_state_destroy(struct xfrm_state *x, bool sync)
 {
 	WARN_ON(x->km.state != XFRM_STATE_DEAD);
@@ -848,6 +885,9 @@
 
 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid)
 {
+	struct xfrm_state *x;
+	struct hlist_node *tmp;
+	struct xfrm_dev_offload *xso;
 	int i, err = 0, cnt = 0;
 
 	spin_lock_bh(&net->xfrm.xfrm_state_lock);
@@ -857,8 +897,6 @@
 
 	err = -ESRCH;
 	for (i = 0; i <= net->xfrm.state_hmask; i++) {
-		struct xfrm_state *x;
-		struct xfrm_dev_offload *xso;
 restart:
 		hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
 			xso = &x->xso;
@@ -868,6 +906,8 @@
 				spin_unlock_bh(&net->xfrm.xfrm_state_lock);
 
 				err = xfrm_state_delete(x);
+				xfrm_dev_state_free(x);
+
 				xfrm_audit_state_delete(x, err ? 0 : 1,
 							task_valid);
 				xfrm_state_put(x);
@@ -884,6 +924,24 @@
 
 out:
 	spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
+	spin_lock_bh(&xfrm_state_dev_gc_lock);
+restart_gc:
+	hlist_for_each_entry_safe(x, tmp, &xfrm_state_dev_gc_list, dev_gclist) {
+		xso = &x->xso;
+
+		if (xso->dev == dev) {
+			spin_unlock_bh(&xfrm_state_dev_gc_lock);
+			xfrm_dev_state_free(x);
+			spin_lock_bh(&xfrm_state_dev_gc_lock);
+			goto restart_gc;
+		}
+
+	}
+	spin_unlock_bh(&xfrm_state_dev_gc_lock);
+
+	xfrm_flush_gc();
+
 	return err;
 }
 EXPORT_SYMBOL(xfrm_dev_state_flush);
@@ -1273,8 +1331,7 @@
 			xso->dev = xdo->dev;
 			xso->real_dev = xdo->real_dev;
 			xso->flags = XFRM_DEV_OFFLOAD_FLAG_ACQ;
-			netdev_tracker_alloc(xso->dev, &xso->dev_tracker,
-					     GFP_ATOMIC);
+			netdev_hold(xso->dev, &xso->dev_tracker, GFP_ATOMIC);
 			error = xso->dev->xfrmdev_ops->xdo_dev_state_add(x, NULL);
 			if (error) {
 				xso->dir = 0;
--- linux-qcom-6.8.0.orig/net/xfrm/xfrm_user.c
+++ linux-qcom-6.8.0/net/xfrm/xfrm_user.c
@@ -176,6 +176,7 @@
 			     struct netlink_ext_ack *extack)
 {
 	int err;
+	u16 family = p->sel.family;
 
 	err = -EINVAL;
 	switch (p->family) {
@@ -196,7 +197,10 @@
 		goto out;
 	}
 
-	switch (p->sel.family) {
+	if (!family && !(p->flags & XFRM_STATE_AF_UNSPEC))
+		family = p->family;
+
+	switch (family) {
 	case AF_UNSPEC:
 		break;
 
@@ -995,7 +999,9 @@
 	if (!nla)
 		return -EMSGSIZE;
 	ap = nla_data(nla);
-	memcpy(ap, auth, sizeof(struct xfrm_algo_auth));
+	strscpy_pad(ap->alg_name, auth->alg_name, sizeof(ap->alg_name));
+	ap->alg_key_len = auth->alg_key_len;
+	ap->alg_trunc_len = auth->alg_trunc_len;
 	if (redact_secret && auth->alg_key_len)
 		memset(ap->alg_key, 0, (auth->alg_key_len + 7) / 8);
 	else
@@ -2348,7 +2354,6 @@
 					    NETLINK_CB(skb).portid);
 		}
 	} else {
-		xfrm_dev_policy_delete(xp);
 		xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
 
 		if (err != 0)
--- linux-qcom-6.8.0.orig/rust/Makefile
+++ linux-qcom-6.8.0/rust/Makefile
@@ -175,7 +175,6 @@
 	mkdir -p $(objtree)/$(obj)/test/doctests/kernel; \
 	OBJTREE=$(abspath $(objtree)) \
 	$(RUSTDOC) --test $(rust_flags) \
-		@$(objtree)/include/generated/rustc_cfg \
 		-L$(objtree)/$(obj) --extern alloc --extern kernel \
 		--extern build_error --extern macros \
 		--extern bindings --extern uapi \
@@ -369,7 +368,7 @@
 quiet_cmd_exports = EXPORTS $@
       cmd_exports = \
 	$(NM) -p --defined-only $< \
-		| awk '/ (T|R|D) / {printf "EXPORT_SYMBOL_RUST_GPL(%s);\n",$$3}' > $@
+		| awk '/ (T|R|D|B) / {printf "EXPORT_SYMBOL_RUST_GPL(%s);\n",$$3}' > $@
 
 $(obj)/exports_core_generated.h: $(obj)/core.o FORCE
 	$(call if_changed,exports)
--- linux-qcom-6.8.0.orig/rust/alloc/alloc.rs
+++ linux-qcom-6.8.0/rust/alloc/alloc.rs
@@ -379,13 +379,20 @@
         panic!("allocation failed");
     }
 
+    #[inline]
     fn rt_error(layout: Layout) -> ! {
         unsafe {
             __rust_alloc_error_handler(layout.size(), layout.align());
         }
     }
 
-    unsafe { core::intrinsics::const_eval_select((layout,), ct_error, rt_error) }
+    #[cfg(not(feature = "panic_immediate_abort"))]
+    unsafe {
+        core::intrinsics::const_eval_select((layout,), ct_error, rt_error)
+    }
+
+    #[cfg(feature = "panic_immediate_abort")]
+    ct_error(layout)
 }
 
 // For alloc test `std::alloc::handle_alloc_error` can be used directly.
--- linux-qcom-6.8.0.orig/rust/alloc/boxed.rs
+++ linux-qcom-6.8.0/rust/alloc/boxed.rs
@@ -161,7 +161,7 @@
 use core::marker::Unsize;
 use core::mem::{self, SizedTypeProperties};
 use core::ops::{
-    CoerceUnsized, Deref, DerefMut, DispatchFromDyn, Generator, GeneratorState, Receiver,
+    CoerceUnsized, Coroutine, CoroutineState, Deref, DerefMut, DispatchFromDyn, Receiver,
 };
 use core::pin::Pin;
 use core::ptr::{self, NonNull, Unique};
@@ -211,7 +211,7 @@
     /// ```
     /// let five = Box::new(5);
     /// ```
-    #[cfg(all(not(no_global_oom_handling)))]
+    #[cfg(not(no_global_oom_handling))]
     #[inline(always)]
     #[stable(feature = "rust1", since = "1.0.0")]
     #[must_use]
@@ -2110,28 +2110,28 @@
 #[stable(feature = "pin", since = "1.33.0")]
 impl<T: ?Sized, A: Allocator> Unpin for Box<T, A> where A: 'static {}
 
-#[unstable(feature = "generator_trait", issue = "43122")]
-impl<G: ?Sized + Generator<R> + Unpin, R, A: Allocator> Generator<R> for Box<G, A>
+#[unstable(feature = "coroutine_trait", issue = "43122")]
+impl<G: ?Sized + Coroutine<R> + Unpin, R, A: Allocator> Coroutine<R> for Box<G, A>
 where
     A: 'static,
 {
     type Yield = G::Yield;
     type Return = G::Return;
 
-    fn resume(mut self: Pin<&mut Self>, arg: R) -> GeneratorState<Self::Yield, Self::Return> {
+    fn resume(mut self: Pin<&mut Self>, arg: R) -> CoroutineState<Self::Yield, Self::Return> {
         G::resume(Pin::new(&mut *self), arg)
     }
 }
 
-#[unstable(feature = "generator_trait", issue = "43122")]
-impl<G: ?Sized + Generator<R>, R, A: Allocator> Generator<R> for Pin<Box<G, A>>
+#[unstable(feature = "coroutine_trait", issue = "43122")]
+impl<G: ?Sized + Coroutine<R>, R, A: Allocator> Coroutine<R> for Pin<Box<G, A>>
 where
     A: 'static,
 {
     type Yield = G::Yield;
     type Return = G::Return;
 
-    fn resume(mut self: Pin<&mut Self>, arg: R) -> GeneratorState<Self::Yield, Self::Return> {
+    fn resume(mut self: Pin<&mut Self>, arg: R) -> CoroutineState<Self::Yield, Self::Return> {
         G::resume((*self).as_mut(), arg)
     }
 }
@@ -2448,4 +2448,8 @@
     fn source(&self) -> Option<&(dyn core::error::Error + 'static)> {
         core::error::Error::source(&**self)
     }
+
+    fn provide<'b>(&'b self, request: &mut core::error::Request<'b>) {
+        core::error::Error::provide(&**self, request);
+    }
 }
--- linux-qcom-6.8.0.orig/rust/alloc/lib.rs
+++ linux-qcom-6.8.0/rust/alloc/lib.rs
@@ -80,6 +80,8 @@
     not(no_sync),
     target_has_atomic = "ptr"
 ))]
+#![cfg_attr(not(bootstrap), doc(rust_logo))]
+#![cfg_attr(not(bootstrap), feature(rustdoc_internals))]
 #![no_std]
 #![needs_allocator]
 // Lints:
@@ -115,7 +117,6 @@
 #![feature(const_eval_select)]
 #![feature(const_maybe_uninit_as_mut_ptr)]
 #![feature(const_maybe_uninit_write)]
-#![feature(const_maybe_uninit_zeroed)]
 #![feature(const_pin)]
 #![feature(const_refs_to_cell)]
 #![feature(const_size_of_val)]
@@ -141,7 +142,7 @@
 #![feature(maybe_uninit_uninit_array)]
 #![feature(maybe_uninit_uninit_array_transpose)]
 #![feature(pattern)]
-#![feature(pointer_byte_offsets)]
+#![feature(ptr_addr_eq)]
 #![feature(ptr_internals)]
 #![feature(ptr_metadata)]
 #![feature(ptr_sub_ptr)]
@@ -168,7 +169,7 @@
 //
 // Language features:
 // tidy-alphabetical-start
-#![cfg_attr(not(test), feature(generator_trait))]
+#![cfg_attr(not(test), feature(coroutine_trait))]
 #![cfg_attr(test, feature(panic_update_hook))]
 #![cfg_attr(test, feature(test))]
 #![feature(allocator_internals)]
--- linux-qcom-6.8.0.orig/rust/alloc/raw_vec.rs
+++ linux-qcom-6.8.0/rust/alloc/raw_vec.rs
@@ -338,10 +338,13 @@
     /// The same as `reserve`, but returns on errors instead of panicking or aborting.
     pub fn try_reserve(&mut self, len: usize, additional: usize) -> Result<(), TryReserveError> {
         if self.needs_to_grow(len, additional) {
-            self.grow_amortized(len, additional)
-        } else {
-            Ok(())
+            self.grow_amortized(len, additional)?;
+        }
+        unsafe {
+            // Inform the optimizer that the reservation has succeeded or wasn't needed
+            core::intrinsics::assume(!self.needs_to_grow(len, additional));
         }
+        Ok(())
     }
 
     /// The same as `reserve_for_push`, but returns on errors instead of panicking or aborting.
@@ -378,7 +381,14 @@
         len: usize,
         additional: usize,
     ) -> Result<(), TryReserveError> {
-        if self.needs_to_grow(len, additional) { self.grow_exact(len, additional) } else { Ok(()) }
+        if self.needs_to_grow(len, additional) {
+            self.grow_exact(len, additional)?;
+        }
+        unsafe {
+            // Inform the optimizer that the reservation has succeeded or wasn't needed
+            core::intrinsics::assume(!self.needs_to_grow(len, additional));
+        }
+        Ok(())
     }
 
     /// Shrinks the buffer down to the specified capacity. If the given amount
@@ -569,6 +579,7 @@
 // ensure that the code generation related to these panics is minimal as there's
 // only one location which panics rather than a bunch throughout the module.
 #[cfg(not(no_global_oom_handling))]
+#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never))]
 fn capacity_overflow() -> ! {
     panic!("capacity overflow");
 }
--- linux-qcom-6.8.0.orig/rust/alloc/vec/mod.rs
+++ linux-qcom-6.8.0/rust/alloc/vec/mod.rs
@@ -1376,7 +1376,7 @@
     /// [`as_mut_ptr`]: Vec::as_mut_ptr
     /// [`as_ptr`]: Vec::as_ptr
     #[stable(feature = "vec_as_ptr", since = "1.37.0")]
-    #[cfg_attr(not(bootstrap), rustc_never_returns_null_ptr)]
+    #[rustc_never_returns_null_ptr]
     #[inline]
     pub fn as_ptr(&self) -> *const T {
         // We shadow the slice method of the same name to avoid going through
@@ -1436,7 +1436,7 @@
     /// [`as_mut_ptr`]: Vec::as_mut_ptr
     /// [`as_ptr`]: Vec::as_ptr
     #[stable(feature = "vec_as_ptr", since = "1.37.0")]
-    #[cfg_attr(not(bootstrap), rustc_never_returns_null_ptr)]
+    #[rustc_never_returns_null_ptr]
     #[inline]
     pub fn as_mut_ptr(&mut self) -> *mut T {
         // We shadow the slice method of the same name to avoid going through
@@ -1565,7 +1565,8 @@
     #[stable(feature = "rust1", since = "1.0.0")]
     pub fn swap_remove(&mut self, index: usize) -> T {
         #[cold]
-        #[inline(never)]
+        #[cfg_attr(not(feature = "panic_immediate_abort"), inline(never))]
+        #[track_caller]
         fn assert_failed(index: usize, len: usize) -> ! {
             panic!("swap_remove index (is {index}) should be < len (is {len})");
         }
@@ -1606,7 +1607,8 @@
     #[stable(feature = "rust1", since = "1.0.0")]
     pub fn insert(&mut self, index: usize, element: T) {
         #[cold]
-        #[inline(never)]
+        #[cfg_attr(not(feature = "panic_immediate_abort"), inline(never))]
+        #[track_caller]
         fn assert_failed(index: usize, len: usize) -> ! {
             panic!("insertion index (is {index}) should be <= len (is {len})");
         }
@@ -1667,7 +1669,7 @@
     #[track_caller]
     pub fn remove(&mut self, index: usize) -> T {
         #[cold]
-        #[inline(never)]
+        #[cfg_attr(not(feature = "panic_immediate_abort"), inline(never))]
         #[track_caller]
         fn assert_failed(index: usize, len: usize) -> ! {
             panic!("removal index (is {index}) should be < len (is {len})");
@@ -2097,6 +2099,7 @@
         } else {
             unsafe {
                 self.len -= 1;
+                core::intrinsics::assume(self.len < self.capacity());
                 Some(ptr::read(self.as_ptr().add(self.len())))
             }
         }
@@ -2299,7 +2302,8 @@
         A: Clone,
     {
         #[cold]
-        #[inline(never)]
+        #[cfg_attr(not(feature = "panic_immediate_abort"), inline(never))]
+        #[track_caller]
         fn assert_failed(at: usize, len: usize) -> ! {
             panic!("`at` split index (is {at}) should be <= len (is {len})");
         }
--- linux-qcom-6.8.0.orig/rust/kernel/init.rs
+++ linux-qcom-6.8.0/rust/kernel/init.rs
@@ -1292,8 +1292,15 @@
     i8, i16, i32, i64, i128, isize,
     f32, f64,
 
-    // SAFETY: These are ZSTs, there is nothing to zero.
-    {<T: ?Sized>} PhantomData<T>, core::marker::PhantomPinned, Infallible, (),
+    // Note: do not add uninhabited types (such as `!` or `core::convert::Infallible`) to this list;
+    // creating an instance of an uninhabited type is immediate undefined behavior. For more on
+    // uninhabited/empty types, consult The Rustonomicon:
+    // <https://doc.rust-lang.org/stable/nomicon/exotic-sizes.html#empty-types>. The Rust Reference
+    // also has information on undefined behavior:
+    // <https://doc.rust-lang.org/stable/reference/behavior-considered-undefined.html>.
+    //
+    // SAFETY: These are inhabited ZSTs; there is nothing to zero and a valid value exists.
+    {<T: ?Sized>} PhantomData<T>, core::marker::PhantomPinned, (),
 
     // SAFETY: Type is allowed to take any value, including all zeros.
     {<T>} MaybeUninit<T>,
--- linux-qcom-6.8.0.orig/rust/kernel/lib.rs
+++ linux-qcom-6.8.0/rust/kernel/lib.rs
@@ -14,7 +14,6 @@
 #![no_std]
 #![feature(allocator_api)]
 #![feature(coerce_unsized)]
-#![feature(const_maybe_uninit_zeroed)]
 #![feature(dispatch_from_dyn)]
 #![feature(new_uninit)]
 #![feature(offset_of)]
@@ -66,7 +65,7 @@
 /// The top level entrypoint to implementing a kernel module.
 ///
 /// For any teardown or cleanup operations, your type may implement [`Drop`].
-pub trait Module: Sized + Sync {
+pub trait Module: Sized + Sync + Send {
     /// Called at module initialization time.
     ///
     /// Use this method to perform whatever setup or registration your module
@@ -78,7 +77,7 @@
 
 /// Equivalent to `THIS_MODULE` in the C API.
 ///
-/// C header: `include/linux/export.h`
+/// C header: [`include/linux/init.h`](srctree/include/linux/init.h)
 pub struct ThisModule(*mut bindings::module);
 
 // SAFETY: `THIS_MODULE` may be used from all threads within a module.
--- linux-qcom-6.8.0.orig/rust/kernel/net/phy.rs
+++ linux-qcom-6.8.0/rust/kernel/net/phy.rs
@@ -640,6 +640,10 @@
     drivers: Pin<&'static mut [DriverVTable]>,
 }
 
+// SAFETY: The only action allowed in a `Registration` instance is dropping it, which is safe to do
+// from any thread because `phy_drivers_unregister` can be called from any thread context.
+unsafe impl Send for Registration {}
+
 impl Registration {
     /// Registers a PHY driver.
     pub fn register(
--- linux-qcom-6.8.0.orig/rust/kernel/sync/condvar.rs
+++ linux-qcom-6.8.0/rust/kernel/sync/condvar.rs
@@ -77,6 +77,8 @@
 
     /// A condvar needs to be pinned because it contains a [`struct list_head`] that is
     /// self-referential, so it cannot be safely moved once it is initialised.
+    ///
+    /// [`struct list_head`]: srctree/include/linux/types.h
     #[pin]
     _pin: PhantomPinned,
 }
--- linux-qcom-6.8.0.orig/rust/kernel/sync/locked_by.rs
+++ linux-qcom-6.8.0/rust/kernel/sync/locked_by.rs
@@ -80,8 +80,12 @@
 // SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can.
 unsafe impl<T: ?Sized + Send, U: ?Sized> Send for LockedBy<T, U> {}
 
-// SAFETY: `LockedBy` serialises the interior mutability it provides, so it is `Sync` as long as the
-// data it protects is `Send`.
+// SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use
+// `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is
+// sufficient to allow that.
+//
+// If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain
+// several `&T` from several threads at once. However, this is okay as `T` is `Sync`.
 unsafe impl<T: ?Sized + Send, U: ?Sized> Sync for LockedBy<T, U> {}
 
 impl<T, U> LockedBy<T, U> {
@@ -115,7 +119,10 @@
     ///
     /// Panics if `owner` is different from the data protected by the lock used in
     /// [`new`](LockedBy::new).
-    pub fn access<'a>(&'a self, owner: &'a U) -> &'a T {
+    pub fn access<'a>(&'a self, owner: &'a U) -> &'a T
+    where
+        T: Sync,
+    {
         build_assert!(
             size_of::<U>() > 0,
             "`U` cannot be a ZST because `owner` wouldn't be unique"
@@ -124,7 +131,10 @@
             panic!("mismatched owners");
         }
 
-        // SAFETY: `owner` is evidence that the owner is locked.
+        // SAFETY: `owner` is evidence that there are only shared references to the owner for the
+        // duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable
+        // reference to the inner value that aliases with this shared reference. The type is `Sync`
+        // so there are no other requirements.
         unsafe { &*self.data.get() }
     }
 
--- linux-qcom-6.8.0.orig/rust/kernel/types.rs
+++ linux-qcom-6.8.0/rust/kernel/types.rs
@@ -248,7 +248,7 @@
     }
 
     /// Returns a raw pointer to the opaque data.
-    pub fn get(&self) -> *mut T {
+    pub const fn get(&self) -> *mut T {
         UnsafeCell::get(&self.value).cast::<T>()
     }
 
--- linux-qcom-6.8.0.orig/rust/macros/lib.rs
+++ linux-qcom-6.8.0/rust/macros/lib.rs
@@ -35,18 +35,6 @@
 ///     author: "Rust for Linux Contributors",
 ///     description: "My very own kernel module!",
 ///     license: "GPL",
-///     params: {
-///        my_i32: i32 {
-///            default: 42,
-///            permissions: 0o000,
-///            description: "Example of i32",
-///        },
-///        writeable_i32: i32 {
-///            default: 42,
-///            permissions: 0o644,
-///            description: "Example of i32",
-///        },
-///    },
 /// }
 ///
 /// struct MyModule;
@@ -334,7 +322,7 @@
 /// macro_rules! pub_no_prefix {
 ///     ($prefix:ident, $($newname:ident),+) => {
 ///         kernel::macros::paste! {
-///             $(pub(crate) const fn [<$newname:lower:span>]: u32 = [<$prefix $newname:span>];)+
+///             $(pub(crate) const fn [<$newname:lower:span>]() -> u32 { [<$prefix $newname:span>] })+
 ///         }
 ///     };
 /// }
--- linux-qcom-6.8.0.orig/rust/macros/module.rs
+++ linux-qcom-6.8.0/rust/macros/module.rs
@@ -199,98 +199,147 @@
             /// Used by the printing macros, e.g. [`info!`].
             const __LOG_PREFIX: &[u8] = b\"{name}\\0\";
 
-            /// The \"Rust loadable module\" mark.
-            //
-            // This may be best done another way later on, e.g. as a new modinfo
-            // key or a new section. For the moment, keep it simple.
-            #[cfg(MODULE)]
-            #[doc(hidden)]
-            #[used]
-            static __IS_RUST_MODULE: () = ();
-
-            static mut __MOD: Option<{type_}> = None;
-
             // SAFETY: `__this_module` is constructed by the kernel at load time and will not be
             // freed until the module is unloaded.
             #[cfg(MODULE)]
             static THIS_MODULE: kernel::ThisModule = unsafe {{
-                kernel::ThisModule::from_ptr(&kernel::bindings::__this_module as *const _ as *mut _)
+                extern \"C\" {{
+                    static __this_module: kernel::types::Opaque<kernel::bindings::module>;
+                }}
+
+                kernel::ThisModule::from_ptr(__this_module.get())
             }};
             #[cfg(not(MODULE))]
             static THIS_MODULE: kernel::ThisModule = unsafe {{
                 kernel::ThisModule::from_ptr(core::ptr::null_mut())
             }};
 
-            // Loadable modules need to export the `{{init,cleanup}}_module` identifiers.
-            #[cfg(MODULE)]
-            #[doc(hidden)]
-            #[no_mangle]
-            pub extern \"C\" fn init_module() -> core::ffi::c_int {{
-                __init()
-            }}
-
-            #[cfg(MODULE)]
-            #[doc(hidden)]
-            #[no_mangle]
-            pub extern \"C\" fn cleanup_module() {{
-                __exit()
-            }}
+            // Double nested modules, since then nobody can access the public items inside.
+            mod __module_init {{
+                mod __module_init {{
+                    use super::super::{type_};
+
+                    /// The \"Rust loadable module\" mark.
+                    //
+                    // This may be best done another way later on, e.g. as a new modinfo
+                    // key or a new section. For the moment, keep it simple.
+                    #[cfg(MODULE)]
+                    #[doc(hidden)]
+                    #[used]
+                    static __IS_RUST_MODULE: () = ();
+
+                    static mut __MOD: Option<{type_}> = None;
+
+                    // Loadable modules need to export the `{{init,cleanup}}_module` identifiers.
+                    /// # Safety
+                    ///
+                    /// This function must not be called after module initialization, because it may be
+                    /// freed after that completes.
+                    #[cfg(MODULE)]
+                    #[doc(hidden)]
+                    #[no_mangle]
+                    #[link_section = \".init.text\"]
+                    pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{
+                        // SAFETY: This function is inaccessible to the outside due to the double
+                        // module wrapping it. It is called exactly once by the C side via its
+                        // unique name.
+                        unsafe {{ __init() }}
+                    }}
 
-            // Built-in modules are initialized through an initcall pointer
-            // and the identifiers need to be unique.
-            #[cfg(not(MODULE))]
-            #[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))]
-            #[doc(hidden)]
-            #[link_section = \"{initcall_section}\"]
-            #[used]
-            pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init;
+                    #[cfg(MODULE)]
+                    #[doc(hidden)]
+                    #[no_mangle]
+                    pub extern \"C\" fn cleanup_module() {{
+                        // SAFETY:
+                        // - This function is inaccessible to the outside due to the double
+                        //   module wrapping it. It is called exactly once by the C side via its
+                        //   unique name,
+                        // - furthermore it is only called after `init_module` has returned `0`
+                        //   (which delegates to `__init`).
+                        unsafe {{ __exit() }}
+                    }}
 
-            #[cfg(not(MODULE))]
-            #[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)]
-            core::arch::global_asm!(
-                r#\".section \"{initcall_section}\", \"a\"
-                __{name}_initcall:
-                    .long   __{name}_init - .
-                    .previous
-                \"#
-            );
+                    // Built-in modules are initialized through an initcall pointer
+                    // and the identifiers need to be unique.
+                    #[cfg(not(MODULE))]
+                    #[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))]
+                    #[doc(hidden)]
+                    #[link_section = \"{initcall_section}\"]
+                    #[used]
+                    pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init;
+
+                    #[cfg(not(MODULE))]
+                    #[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)]
+                    core::arch::global_asm!(
+                        r#\".section \"{initcall_section}\", \"a\"
+                        __{name}_initcall:
+                            .long   __{name}_init - .
+                            .previous
+                        \"#
+                    );
+
+                    #[cfg(not(MODULE))]
+                    #[doc(hidden)]
+                    #[no_mangle]
+                    pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{
+                        // SAFETY: This function is inaccessible to the outside due to the double
+                        // module wrapping it. It is called exactly once by the C side via its
+                        // placement above in the initcall section.
+                        unsafe {{ __init() }}
+                    }}
 
-            #[cfg(not(MODULE))]
-            #[doc(hidden)]
-            #[no_mangle]
-            pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{
-                __init()
-            }}
+                    #[cfg(not(MODULE))]
+                    #[doc(hidden)]
+                    #[no_mangle]
+                    pub extern \"C\" fn __{name}_exit() {{
+                        // SAFETY:
+                        // - This function is inaccessible to the outside due to the double
+                        //   module wrapping it. It is called exactly once by the C side via its
+                        //   unique name,
+                        // - furthermore it is only called after `__{name}_init` has returned `0`
+                        //   (which delegates to `__init`).
+                        unsafe {{ __exit() }}
+                    }}
 
-            #[cfg(not(MODULE))]
-            #[doc(hidden)]
-            #[no_mangle]
-            pub extern \"C\" fn __{name}_exit() {{
-                __exit()
-            }}
+                    /// # Safety
+                    ///
+                    /// This function must only be called once.
+                    unsafe fn __init() -> core::ffi::c_int {{
+                        match <{type_} as kernel::Module>::init(&super::super::THIS_MODULE) {{
+                            Ok(m) => {{
+                                // SAFETY: No data race, since `__MOD` can only be accessed by this
+                                // module and there only `__init` and `__exit` access it. These
+                                // functions are only called once and `__exit` cannot be called
+                                // before or during `__init`.
+                                unsafe {{
+                                    __MOD = Some(m);
+                                }}
+                                return 0;
+                            }}
+                            Err(e) => {{
+                                return e.to_errno();
+                            }}
+                        }}
+                    }}
 
-            fn __init() -> core::ffi::c_int {{
-                match <{type_} as kernel::Module>::init(&THIS_MODULE) {{
-                    Ok(m) => {{
+                    /// # Safety
+                    ///
+                    /// This function must
+                    /// - only be called once,
+                    /// - be called after `__init` has been called and returned `0`.
+                    unsafe fn __exit() {{
+                        // SAFETY: No data race, since `__MOD` can only be accessed by this module
+                        // and there only `__init` and `__exit` access it. These functions are only
+                        // called once and `__init` was already called.
                         unsafe {{
-                            __MOD = Some(m);
+                            // Invokes `drop()` on `__MOD`, which should be used for cleanup.
+                            __MOD = None;
                         }}
-                        return 0;
-                    }}
-                    Err(e) => {{
-                        return e.to_errno();
                     }}
-                }}
-            }}
 
-            fn __exit() {{
-                unsafe {{
-                    // Invokes `drop()` on `__MOD`, which should be used for cleanup.
-                    __MOD = None;
+                    {modinfo}
                 }}
             }}
-
-            {modinfo}
         ",
         type_ = info.type_,
         name = info.name,
--- linux-qcom-6.8.0.orig/samples/Kconfig
+++ linux-qcom-6.8.0/samples/Kconfig
@@ -291,6 +291,16 @@
 	help
 	  Build samples that demonstrate the usage of the cgroup API.
 
+config SAMPLE_GUNYAH
+	bool "Build example Gunyah Virtual Machine Manager"
+	depends on CC_CAN_LINK && HEADERS_INSTALL
+	depends on GUNYAH
+	help
+	  Build an example Gunyah VMM userspace program capable of launching
+	  a basic virtual machine under the Gunyah hypervisor.
+	  This demonstrates how to create a virtual machine under the Gunyah
+	  hypervisor.
+
 source "samples/rust/Kconfig"
 
 endif # SAMPLES
--- linux-qcom-6.8.0.orig/samples/Makefile
+++ linux-qcom-6.8.0/samples/Makefile
@@ -39,3 +39,4 @@
 obj-$(CONFIG_SAMPLE_CORESIGHT_SYSCFG)	+= coresight/
 obj-$(CONFIG_SAMPLE_FPROBE)		+= fprobe/
 obj-$(CONFIG_SAMPLES_RUST)		+= rust/
+obj-$(CONFIG_SAMPLE_GUNYAH)		+= gunyah/
--- linux-qcom-6.8.0.orig/samples/bpf/Makefile
+++ linux-qcom-6.8.0/samples/bpf/Makefile
@@ -169,6 +169,10 @@
 endif
 endif
 
+ifeq ($(ARCH), x86)
+BPF_EXTRA_CFLAGS += -fcf-protection
+endif
+
 TPROGS_CFLAGS += -Wall -O2
 TPROGS_CFLAGS += -Wmissing-prototypes
 TPROGS_CFLAGS += -Wstrict-prototypes
@@ -405,7 +409,7 @@
 		-Wno-gnu-variable-sized-type-not-at-end \
 		-Wno-address-of-packed-member -Wno-tautological-compare \
 		-Wno-unknown-warning-option $(CLANG_ARCH_ARGS) \
-		-fno-asynchronous-unwind-tables -fcf-protection \
+		-fno-asynchronous-unwind-tables \
 		-I$(srctree)/samples/bpf/ -include asm_goto_workaround.h \
 		-O2 -emit-llvm -Xclang -disable-llvm-passes -c $< -o - | \
 		$(OPT) -O2 -mtriple=bpf-pc-linux | $(LLVM_DIS) | \
--- linux-qcom-6.8.0.orig/samples/bpf/map_perf_test_user.c
+++ linux-qcom-6.8.0/samples/bpf/map_perf_test_user.c
@@ -370,7 +370,7 @@
 
 static void fill_lpm_trie(void)
 {
-	struct bpf_lpm_trie_key *key;
+	struct bpf_lpm_trie_key_u8 *key;
 	unsigned long value = 0;
 	unsigned int i;
 	int r;
--- linux-qcom-6.8.0.orig/samples/bpf/test_cgrp2_sock.c
+++ linux-qcom-6.8.0/samples/bpf/test_cgrp2_sock.c
@@ -178,8 +178,10 @@
 		return 1;
 	}
 
-	if (get_bind_to_device(sd, name, sizeof(name)) < 0)
+	if (get_bind_to_device(sd, name, sizeof(name)) < 0) {
+		close(sd);
 		return 1;
+	}
 
 	mark = get_somark(sd);
 	prio = get_priority(sd);
--- linux-qcom-6.8.0.orig/samples/bpf/xdp_adjust_tail_kern.c
+++ linux-qcom-6.8.0/samples/bpf/xdp_adjust_tail_kern.c
@@ -57,6 +57,7 @@
 
 static __always_inline __u16 csum_fold_helper(__u32 csum)
 {
+	csum = (csum & 0xffff) + (csum >> 16);
 	return ~((csum & 0xffff) + (csum >> 16));
 }
 
--- linux-qcom-6.8.0.orig/samples/bpf/xdp_router_ipv4_user.c
+++ linux-qcom-6.8.0/samples/bpf/xdp_router_ipv4_user.c
@@ -91,7 +91,7 @@
 static void read_route(struct nlmsghdr *nh, int nll)
 {
 	char dsts[24], gws[24], ifs[16], dsts_len[24], metrics[24];
-	struct bpf_lpm_trie_key *prefix_key;
+	struct bpf_lpm_trie_key_u8 *prefix_key;
 	struct rtattr *rt_attr;
 	struct rtmsg *rt_msg;
 	int rtm_family;
--- linux-qcom-6.8.0.orig/samples/gunyah/Makefile
+++ linux-qcom-6.8.0/samples/gunyah/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+userprogs-always-y += gunyah_vmm
+dtb-y += sample_vm.dtb
+
+userccflags += -I usr/include
--- linux-qcom-6.8.0.orig/samples/gunyah/gunyah_vmm.c
+++ linux-qcom-6.8.0/samples/gunyah/gunyah_vmm.c
@@ -0,0 +1,266 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <getopt.h>
+#include <limits.h>
+#include <stdint.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/sysmacros.h>
+#define __USE_GNU
+#include <sys/mman.h>
+
+#include <linux/gunyah.h>
+
+#define DEFAULT_GUEST_BASE	0x80000000
+#define DEFAULT_GUEST_SIZE	0x6400000 /* 100 MiB */
+#define DEFAULT_DTB_OFFSET	0x45f0000 /* 70MiB - 64 KiB */
+#define DEFAULT_RAMDISK_OFFSET	0x4600000 /* 70MiB */
+
+struct vm_config {
+	int image_fd;
+	int dtb_fd;
+	int ramdisk_fd;
+
+	uint64_t guest_base;
+	uint64_t guest_size;
+
+	off_t image_size;
+	uint64_t dtb_offset;
+	off_t dtb_size;
+	uint64_t ramdisk_offset;
+	off_t ramdisk_size;
+};
+
+static struct option options[] = {
+	{ "help", no_argument, NULL, 'h' },
+	{ "image", required_argument, NULL, 'i' },
+	{ "dtb", required_argument, NULL, 'd' },
+	{ "ramdisk", optional_argument, NULL, 'r' },
+	{ "base", optional_argument, NULL, 'B' },
+	{ "size", optional_argument, NULL, 'S' },
+	{ "dtb_offset", optional_argument, NULL, 'D' },
+	{ "ramdisk_offset", optional_argument, NULL, 'R' },
+	{ }
+};
+
+static void print_help(char *cmd)
+{
+	printf("gunyah_vmm, a sample tool to launch Gunyah VMs\n"
+	       "Usage: %s <options>\n"
+	       "       --help,    -h  this menu\n"
+	       "       --image,   -i <image> VM image file to load (e.g. a kernel Image) [Required]\n"
+	       "       --dtb,     -d <dtb>   Devicetree file to load [Required]\n"
+	       "       --ramdisk, -r <ramdisk>  Ramdisk file to load\n"
+	       "       --base,    -B <address>  Set the base address of guest's memory [Default: 0x%08x]\n"
+	       "       --size,    -S <number>   The number of bytes large to make the guest's memory [Default: 0x%08x]\n"
+	       "        --dtb_offset,  -D <number>  Offset into guest memory to load the DTB [Default: 0x%08x]\n"
+	       "        --ramdisk_offset, -R <number>  Offset into guest memory to load a ramdisk [Default: 0x%08x]\n"
+	       , cmd, DEFAULT_GUEST_BASE, DEFAULT_GUEST_SIZE,
+	       DEFAULT_DTB_OFFSET, DEFAULT_RAMDISK_OFFSET);
+}
+
+int main(int argc, char **argv)
+{
+	int gunyah_fd, vm_fd, guest_fd;
+	struct gh_userspace_memory_region guest_mem_desc = { 0 };
+	struct gh_vm_dtb_config dtb_config = { 0 };
+	char *guest_mem;
+	struct vm_config config = {
+		/* Defaults good enough to boot static kernel and a basic ramdisk */
+		.image_fd = -1,
+		.dtb_fd = -1,
+		.ramdisk_fd = -1,
+		.guest_base = DEFAULT_GUEST_BASE,
+		.guest_size = DEFAULT_GUEST_SIZE,
+		.dtb_offset = DEFAULT_DTB_OFFSET,
+		.ramdisk_offset = DEFAULT_RAMDISK_OFFSET,
+	};
+	struct stat st;
+	int opt, optidx, ret = 0;
+	long l;
+
+	while ((opt = getopt_long(argc, argv, "hi:d:r:B:S:D:R:c:", options, &optidx)) != -1) {
+		switch (opt) {
+		case 'i':
+			config.image_fd = open(optarg, O_RDONLY | O_CLOEXEC);
+			if (config.image_fd < 0) {
+				perror("Failed to open image");
+				return -1;
+			}
+			if (stat(optarg, &st) < 0) {
+				perror("Failed to stat image");
+				return -1;
+			}
+			config.image_size = st.st_size;
+			break;
+		case 'd':
+			config.dtb_fd = open(optarg, O_RDONLY | O_CLOEXEC);
+			if (config.dtb_fd < 0) {
+				perror("Failed to open dtb");
+				return -1;
+			}
+			if (stat(optarg, &st) < 0) {
+				perror("Failed to stat dtb");
+				return -1;
+			}
+			config.dtb_size = st.st_size;
+			break;
+		case 'r':
+			config.ramdisk_fd = open(optarg, O_RDONLY | O_CLOEXEC);
+			if (config.ramdisk_fd < 0) {
+				perror("Failed to open ramdisk");
+				return -1;
+			}
+			if (stat(optarg, &st) < 0) {
+				perror("Failed to stat ramdisk");
+				return -1;
+			}
+			config.ramdisk_size = st.st_size;
+			break;
+		case 'B':
+			l = strtol(optarg, NULL, 0);
+			if (l == LONG_MIN) {
+				perror("Failed to parse base address");
+				return -1;
+			}
+			config.guest_base = l;
+			break;
+		case 'S':
+			l = strtol(optarg, NULL, 0);
+			if (l == LONG_MIN) {
+				perror("Failed to parse memory size");
+				return -1;
+			}
+			config.guest_size = l;
+			break;
+		case 'D':
+			l = strtol(optarg, NULL, 0);
+			if (l == LONG_MIN) {
+				perror("Failed to parse dtb offset");
+				return -1;
+			}
+			config.dtb_offset = l;
+			break;
+		case 'R':
+			l = strtol(optarg, NULL, 0);
+			if (l == LONG_MIN) {
+				perror("Failed to parse ramdisk offset");
+				return -1;
+			}
+			config.ramdisk_offset = l;
+			break;
+		case 'h':
+			print_help(argv[0]);
+			return 0;
+		default:
+			print_help(argv[0]);
+			return -1;
+		}
+	}
+
+	if (config.image_fd == -1 || config.dtb_fd == -1) {
+		print_help(argv[0]);
+		return -1;
+	}
+
+	if (config.image_size > config.guest_size) {
+		fprintf(stderr, "Image size puts it outside guest memory. Make image smaller or increase guest memory size.\n");
+		return -1;
+	}
+
+	if (config.dtb_offset + config.dtb_size > config.guest_size) {
+		fprintf(stderr, "DTB offset and size puts it outside guest memory. Make dtb smaller or increase guest memory size.\n");
+		return -1;
+	}
+
+	if (config.ramdisk_fd == -1 &&
+		config.ramdisk_offset + config.ramdisk_size > config.guest_size) {
+		fprintf(stderr, "Ramdisk offset and size puts it outside guest memory. Make ramdisk smaller or increase guest memory size.\n");
+		return -1;
+	}
+
+	gunyah_fd = open("/dev/gunyah", O_RDWR | O_CLOEXEC);
+	if (gunyah_fd < 0) {
+		perror("Failed to open /dev/gunyah");
+		return -1;
+	}
+
+	vm_fd = ioctl(gunyah_fd, GH_CREATE_VM, 0);
+	if (vm_fd < 0) {
+		perror("Failed to create vm");
+		return -1;
+	}
+
+	guest_fd = memfd_create("guest_memory", MFD_CLOEXEC);
+	if (guest_fd < 0) {
+		perror("Failed to create guest memfd");
+		return -1;
+	}
+
+	if (ftruncate(guest_fd, config.guest_size) < 0) {
+		perror("Failed to grow guest memory");
+		return -1;
+	}
+
+	guest_mem = mmap(NULL, config.guest_size, PROT_READ | PROT_WRITE, MAP_SHARED, guest_fd, 0);
+	if (guest_mem == MAP_FAILED) {
+		perror("Not enough memory");
+		return -1;
+	}
+
+	if (read(config.image_fd, guest_mem, config.image_size) < 0) {
+		perror("Failed to read image into guest memory");
+		return -1;
+	}
+
+	if (read(config.dtb_fd, guest_mem + config.dtb_offset, config.dtb_size) < 0) {
+		perror("Failed to read dtb into guest memory");
+		return -1;
+	}
+
+	if (config.ramdisk_fd > 0 &&
+		read(config.ramdisk_fd, guest_mem + config.ramdisk_offset,
+			config.ramdisk_size) < 0) {
+		perror("Failed to read ramdisk into guest memory");
+		return -1;
+	}
+
+	guest_mem_desc.label = 0;
+	guest_mem_desc.flags = GH_MEM_ALLOW_READ | GH_MEM_ALLOW_WRITE | GH_MEM_ALLOW_EXEC;
+	guest_mem_desc.guest_phys_addr = config.guest_base;
+	guest_mem_desc.memory_size = config.guest_size;
+	guest_mem_desc.userspace_addr = (__u64)guest_mem;
+
+	if (ioctl(vm_fd, GH_VM_SET_USER_MEM_REGION, &guest_mem_desc) < 0) {
+		perror("Failed to register guest memory with VM");
+		return -1;
+	}
+
+	dtb_config.guest_phys_addr = config.guest_base + config.dtb_offset;
+	dtb_config.size = config.dtb_size;
+	if (ioctl(vm_fd, GH_VM_SET_DTB_CONFIG, &dtb_config) < 0) {
+		perror("Failed to set DTB configuration for VM");
+		return -1;
+	}
+
+	ret = ioctl(vm_fd, GH_VM_START);
+	if (ret) {
+		perror("GH_VM_START failed");
+		return -1;
+	}
+
+	while (1)
+		pause();
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/samples/gunyah/sample_vm.dts
+++ linux-qcom-6.8.0/samples/gunyah/sample_vm.dts
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/dts-v1/;
+
+/ {
+	#address-cells = <2>;
+	#size-cells = <2>;
+	interrupt-parent = <&intc>;
+
+	chosen {
+		bootargs = "nokaslr";
+	};
+
+	cpus {
+		#address-cells = <0x2>;
+		#size-cells = <0>;
+
+		cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0 0>;
+		};
+	};
+
+	intc: interrupt-controller@3FFF0000 {
+		compatible = "arm,gic-v3";
+		#interrupt-cells = <3>;
+		#address-cells = <2>;
+		#size-cells = <2>;
+		interrupt-controller;
+		reg = <0 0x3FFF0000 0 0x10000>,
+		      <0 0x3FFD0000 0 0x20000>;
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		always-on;
+		interrupts = <1 13 0x108>,
+			     <1 14 0x108>,
+			     <1 11 0x108>,
+			     <1 10 0x108>;
+		clock-frequency = <19200000>;
+	};
+
+	gunyah-vm-config {
+		image-name = "linux_vm_0";
+
+		memory {
+			#address-cells = <2>;
+			#size-cells = <2>;
+
+			base-address = <0 0x80000000>;
+		};
+
+		interrupts {
+			config = <&intc>;
+		};
+
+		vcpus {
+			affinity-map = < 0 >;
+			sched-priority = < (-1) >;
+			sched-timeslice = < 2000 >;
+		};
+	};
+};
--- linux-qcom-6.8.0.orig/samples/landlock/sandboxer.c
+++ linux-qcom-6.8.0/samples/landlock/sandboxer.c
@@ -57,6 +57,25 @@
 #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"
 #define ENV_DELIMITER ":"
 
+static int str2num(const char *numstr, __u64 *num_dst)
+{
+	char *endptr = NULL;
+	int err = 0;
+	__u64 num;
+
+	errno = 0;
+	num = strtoull(numstr, &endptr, 10);
+	if (errno != 0)
+		err = errno;
+	/* Was the string empty, or not entirely parsed successfully? */
+	else if ((*numstr == '\0') || (*endptr != '\0'))
+		err = EINVAL;
+	else
+		*num_dst = num;
+
+	return err;
+}
+
 static int parse_path(char *env_path, const char ***const path_list)
 {
 	int i, num_paths = 0;
@@ -151,10 +170,9 @@
 				const __u64 allowed_access)
 {
 	int ret = 1;
-	char *env_port_name, *strport;
+	char *env_port_name, *env_port_name_next, *strport;
 	struct landlock_net_port_attr net_port = {
 		.allowed_access = allowed_access,
-		.port = 0,
 	};
 
 	env_port_name = getenv(env_var);
@@ -163,8 +181,19 @@
 	env_port_name = strdup(env_port_name);
 	unsetenv(env_var);
 
-	while ((strport = strsep(&env_port_name, ENV_DELIMITER))) {
-		net_port.port = atoi(strport);
+	env_port_name_next = env_port_name;
+	while ((strport = strsep(&env_port_name_next, ENV_DELIMITER))) {
+		__u64 port;
+
+		if (strcmp(strport, "") == 0)
+			continue;
+
+		if (str2num(strport, &port)) {
+			fprintf(stderr, "Failed to parse port at \"%s\"\n",
+				strport);
+			goto out_free_name;
+		}
+		net_port.port = port;
 		if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
 				      &net_port, 0)) {
 			fprintf(stderr,
--- linux-qcom-6.8.0.orig/samples/pktgen/pktgen_sample01_simple.sh
+++ linux-qcom-6.8.0/samples/pktgen/pktgen_sample01_simple.sh
@@ -76,7 +76,7 @@
     pg_set $DEV "udp_dst_max $UDP_DST_MAX"
 fi
 
-[ ! -z "$UDP_CSUM" ] && pg_set $dev "flag UDPCSUM"
+[ ! -z "$UDP_CSUM" ] && pg_set $DEV "flag UDPCSUM"
 
 # Setup random UDP port src range
 pg_set $DEV "flag UDPSRC_RND"
--- linux-qcom-6.8.0.orig/scripts/Kconfig.include
+++ linux-qcom-6.8.0/scripts/Kconfig.include
@@ -33,7 +33,8 @@
 
 # $(as-instr,<instr>)
 # Return y if the assembler supports <instr>, n otherwise
-as-instr = $(success,printf "%b\n" "$(1)" | $(CC) $(CLANG_FLAGS) -Wa$(comma)--fatal-warnings -c -x assembler-with-cpp -o /dev/null -)
+as-instr = $(success,printf "%b\n" "$(1)" | $(CC) $(CLANG_FLAGS) $(2) -Wa$(comma)--fatal-warnings -c -x assembler-with-cpp -o /dev/null -)
+as-instr64 = $(as-instr,$(1),$(m64-flag))
 
 # check if $(CC) and $(LD) exist
 $(error-if,$(failure,command -v $(CC)),C compiler '$(CC)' not found)
--- linux-qcom-6.8.0.orig/scripts/Makefile.build
+++ linux-qcom-6.8.0/scripts/Makefile.build
@@ -272,7 +272,7 @@
 	-Zallow-features=$(rust_allowed_features) \
 	-Zcrate-attr=no_std \
 	-Zcrate-attr='feature($(rust_allowed_features))' \
-	--extern alloc --extern kernel \
+	-Zunstable-options --extern force:alloc --extern kernel \
 	--crate-type rlib -L $(objtree)/rust/ \
 	--crate-name $(basename $(notdir $@)) \
 	--sysroot=/dev/null \
--- linux-qcom-6.8.0.orig/scripts/Makefile.dtbinst
+++ linux-qcom-6.8.0/scripts/Makefile.dtbinst
@@ -24,7 +24,7 @@
 	@:
 
 quiet_cmd_dtb_install = INSTALL $@
-      cmd_dtb_install = install -D $< $@
+      cmd_dtb_install = install -D -m 0644 $< $@
 
 $(dst)/%.dtb: $(obj)/%.dtb
 	$(call cmd,dtb_install)
--- linux-qcom-6.8.0.orig/scripts/Makefile.extrawarn
+++ linux-qcom-6.8.0/scripts/Makefile.extrawarn
@@ -114,6 +114,8 @@
 KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation)
 KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
 
+KBUILD_CFLAGS += -Wno-override-init # alias for -Wno-initializer-overrides in clang
+
 ifdef CONFIG_CC_IS_CLANG
 # Clang before clang-16 would warn on default argument promotions.
 ifneq ($(call clang-min-version, 160000),y)
@@ -132,6 +134,8 @@
 KBUILD_CFLAGS += -Wno-tautological-constant-out-of-range-compare
 KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access)
 KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict)
+KBUILD_CFLAGS += -Wno-enum-compare-conditional
+KBUILD_CFLAGS += -Wno-enum-enum-conversion
 endif
 
 endif
@@ -149,10 +153,6 @@
 KBUILD_CFLAGS += $(call cc-option, -Wmaybe-uninitialized)
 KBUILD_CFLAGS += $(call cc-option, -Wunused-macros)
 
-ifdef CONFIG_CC_IS_CLANG
-KBUILD_CFLAGS += -Winitializer-overrides
-endif
-
 KBUILD_CPPFLAGS += -DKBUILD_EXTRA_WARN2
 
 else
@@ -162,9 +162,7 @@
 KBUILD_CFLAGS += -Wno-type-limits
 KBUILD_CFLAGS += -Wno-shift-negative-value
 
-ifdef CONFIG_CC_IS_CLANG
-KBUILD_CFLAGS += -Wno-initializer-overrides
-else
+ifdef CONFIG_CC_IS_GCC
 KBUILD_CFLAGS += -Wno-maybe-uninitialized
 endif
 
--- linux-qcom-6.8.0.orig/scripts/Makefile.lib
+++ linux-qcom-6.8.0/scripts/Makefile.lib
@@ -175,7 +175,7 @@
 
 ifeq ($(CONFIG_UBSAN),y)
 _c_flags += $(if $(patsubst n%,, \
-		$(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_SANITIZE)$(CONFIG_UBSAN_SANITIZE_ALL)), \
+		$(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_SANITIZE)y), \
 		$(CFLAGS_UBSAN))
 endif
 
@@ -248,6 +248,10 @@
 		 $(addprefix -I,$(DTC_INCLUDE))                          \
 		 -undef -D__DTS__
 
+ifdef CONFIG_QCOM_KVM_ENABLED
+dtc_cpp_flags += -DQCOM_KVM_ENABLED
+endif
+
 ifdef CONFIG_OBJTOOL
 
 objtool := $(objtree)/tools/objtool/objtool
@@ -395,8 +399,12 @@
 		-d $(depfile).dtc.tmp $(dtc-tmp) ; \
 	cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile)
 
+# NOTE:
+# Do not replace $(filter %.dtb %.dtbo, $^) with $(real-prereqs). When a single
+# DTB is turned into a multi-blob DTB, $^ will contain header file dependencies
+# recorded in the .*.cmd file.
 quiet_cmd_fdtoverlay = DTOVL   $@
-      cmd_fdtoverlay = $(objtree)/scripts/dtc/fdtoverlay -o $@ -i $(real-prereqs)
+      cmd_fdtoverlay = $(objtree)/scripts/dtc/fdtoverlay -o $@ -i $(filter %.dtb %.dtbo, $^)
 
 $(multi-dtb-y): FORCE
 	$(call if_changed,fdtoverlay)
--- linux-qcom-6.8.0.orig/scripts/Makefile.modfinal
+++ linux-qcom-6.8.0/scripts/Makefile.modfinal
@@ -23,7 +23,7 @@
 part-of-module = y
 
 quiet_cmd_cc_o_c = CC [M]  $@
-      cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV), $(c_flags)) -c -o $@ $<
+      cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV) $(CFLAGS_KCSAN), $(c_flags)) -c -o $@ $<
 
 %.mod.o: %.mod.c FORCE
 	$(call if_changed_dep,cc_o_c)
--- linux-qcom-6.8.0.orig/scripts/Makefile.modinst
+++ linux-qcom-6.8.0/scripts/Makefile.modinst
@@ -53,7 +53,9 @@
 suffix-y				:=
 suffix-$(CONFIG_MODULE_COMPRESS_GZIP)	:= .gz
 suffix-$(CONFIG_MODULE_COMPRESS_XZ)	:= .xz
-suffix-$(CONFIG_MODULE_COMPRESS_ZSTD)	:= .zst
+## UBUNTU: Support, but do not require zstd compressed modules
+# Many external dkms and signing rely on uncompressed modules
+# suffix-$(CONFIG_MODULE_COMPRESS_ZSTD)	:= .zst
 
 modules := $(patsubst $(extmod_prefix)%.o, $(dst)/%.ko$(suffix-y), $(modules))
 install-$(CONFIG_MODULES) += $(modules)
@@ -101,8 +103,11 @@
 sig-key := $(CONFIG_MODULE_SIG_KEY)
 endif
 quiet_cmd_sign = SIGN    $@
-      cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \
-                 $(if $(KBUILD_EXTMOD),|| true)
+      cmd_sign = if test -e $(srctree)/debian/scripts/sign-module && \
+                    $(srctree)/debian/scripts/sign-module $@ ; \
+                 then scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(sig-key) certs/signing_key.x509 $@ \
+                      $(if $(KBUILD_EXTMOD),|| true) ; \
+                 fi
 
 ifeq ($(sign-only),)
 
--- linux-qcom-6.8.0.orig/scripts/Makefile.package
+++ linux-qcom-6.8.0/scripts/Makefile.package
@@ -103,7 +103,7 @@
 debian-orig: private orig-name = $(source)_$(version).orig.tar$(debian-orig-suffix)
 debian-orig: mkdebian-opts = --need-source
 debian-orig: linux.tar$(debian-orig-suffix) debian
-	$(Q)if [ "$(df  --output=target .. 2>/dev/null)" = "$(df --output=target $< 2>/dev/null)" ]; then \
+	$(Q)if [ "$$(df  --output=target .. 2>/dev/null)" = "$$(df --output=target $< 2>/dev/null)" ]; then \
 		ln -f $< ../$(orig-name); \
 	else \
 		cp $< ../$(orig-name); \
--- linux-qcom-6.8.0.orig/scripts/Makefile.vdsoinst
+++ linux-qcom-6.8.0/scripts/Makefile.vdsoinst
@@ -21,7 +21,7 @@
 	$$(call cmd,install)
 
 # Some architectures create .build-id symlinks
-ifneq ($(filter arm sparc x86, $(SRCARCH)),)
+ifneq ($(filter arm s390 sparc x86, $(SRCARCH)),)
 link := $(install-dir)/.build-id/$$(shell $(READELF) -n $$(src) | sed -n 's@^.*Build ID: \(..\)\(.*\)@\1/\2@p').debug
 
 __default: $$(link)
--- linux-qcom-6.8.0.orig/scripts/atomic/kerneldoc/sub_and_test
+++ linux-qcom-6.8.0/scripts/atomic/kerneldoc/sub_and_test
@@ -1,7 +1,7 @@
 cat <<EOF
 /**
  * ${class}${atomicname}() - atomic subtract and test if zero with ${desc_order} ordering
- * @i: ${int} value to add
+ * @i: ${int} value to subtract
  * @v: pointer to ${atomic}_t
  *
  * Atomically updates @v to (@v - @i) with ${desc_order} ordering.
--- linux-qcom-6.8.0.orig/scripts/bpf_doc.py
+++ linux-qcom-6.8.0/scripts/bpf_doc.py
@@ -414,8 +414,8 @@
             version = version.stdout.decode().rstrip()
         except:
             try:
-                version = subprocess.run(['make', 'kernelversion'], cwd=linuxRoot,
-                                         capture_output=True, check=True)
+                version = subprocess.run(['make', '-s', '--no-print-directory', 'kernelversion'],
+                                         cwd=linuxRoot, capture_output=True, check=True)
                 version = version.stdout.decode().rstrip()
             except:
                 return 'Linux'
--- linux-qcom-6.8.0.orig/scripts/checkpatch.pl
+++ linux-qcom-6.8.0/scripts/checkpatch.pl
@@ -28,6 +28,7 @@
 my %verbose_emitted = ();
 my $tree = 1;
 my $chk_signoff = 1;
+my $chk_fixes_tag = 1;
 my $chk_patch = 1;
 my $tst_only;
 my $emacs = 0;
@@ -88,6 +89,7 @@
   -v, --verbose              verbose mode
   --no-tree                  run without a kernel tree
   --no-signoff               do not check for 'Signed-off-by' line
+  --no-fixes-tag             do not check for 'Fixes:' tag
   --patch                    treat FILE as patchfile (default)
   --emacs                    emacs compile window format
   --terse                    one line per report
@@ -295,6 +297,7 @@
 	'v|verbose!'	=> \$verbose,
 	'tree!'		=> \$tree,
 	'signoff!'	=> \$chk_signoff,
+	'fixes-tag!'	=> \$chk_fixes_tag,
 	'patch!'	=> \$chk_patch,
 	'emacs!'	=> \$emacs,
 	'terse!'	=> \$terse,
@@ -1257,6 +1260,7 @@
 }
 
 $chk_signoff = 0 if ($file);
+$chk_fixes_tag = 0 if ($file);
 
 my @rawlines = ();
 my @lines = ();
@@ -2636,6 +2640,9 @@
 
 	our $clean = 1;
 	my $signoff = 0;
+	my $fixes_tag = 0;
+	my $is_revert = 0;
+	my $needs_fixes_tag = "";
 	my $author = '';
 	my $authorsignoff = 0;
 	my $author_sob = '';
@@ -3189,38 +3196,44 @@
 			}
 		}
 
+# These indicate a bug fix
+		if (!$in_header_lines && !$is_patch &&
+			$line =~ /^This reverts commit/) {
+			$is_revert = 1;
+		}
+
+		if (!$in_header_lines && !$is_patch &&
+		    $line =~ /((?:(?:BUG: K.|UB)SAN: |Call Trace:|stable\@|syzkaller))/) {
+			$needs_fixes_tag = $1;
+		}
 
 # Check Fixes: styles is correct
 		if (!$in_header_lines &&
-		    $line =~ /^\s*fixes:?\s*(?:commit\s*)?[0-9a-f]{5,}\b/i) {
-			my $orig_commit = "";
-			my $id = "0123456789ab";
-			my $title = "commit title";
-			my $tag_case = 1;
-			my $tag_space = 1;
-			my $id_length = 1;
-			my $id_case = 1;
+		    $line =~ /^\s*(fixes:?)\s*(?:commit\s*)?([0-9a-f]{5,40})(?:\s*($balanced_parens))?/i) {
+			my $tag = $1;
+			my $orig_commit = $2;
+			my $title;
 			my $title_has_quotes = 0;
-
-			if ($line =~ /(\s*fixes:?)\s+([0-9a-f]{5,})\s+($balanced_parens)/i) {
-				my $tag = $1;
-				$orig_commit = $2;
-				$title = $3;
-
-				$tag_case = 0 if $tag eq "Fixes:";
-				$tag_space = 0 if ($line =~ /^fixes:? [0-9a-f]{5,} ($balanced_parens)/i);
-
-				$id_length = 0 if ($orig_commit =~ /^[0-9a-f]{12}$/i);
-				$id_case = 0 if ($orig_commit !~ /[A-F]/);
-
+			$fixes_tag = 1;
+			if (defined $3) {
 				# Always strip leading/trailing parens then double quotes if existing
-				$title = substr($title, 1, -1);
+				$title = substr($3, 1, -1);
 				if ($title =~ /^".*"$/) {
 					$title = substr($title, 1, -1);
 					$title_has_quotes = 1;
 				}
+			} else {
+				$title = "commit title"
 			}
 
+
+			my $tag_case = not ($tag eq "Fixes:");
+			my $tag_space = not ($line =~ /^fixes:? [0-9a-f]{5,40} ($balanced_parens)/i);
+
+			my $id_length = not ($orig_commit =~ /^[0-9a-f]{12}$/i);
+			my $id_case = not ($orig_commit !~ /[A-F]/);
+
+			my $id = "0123456789ab";
 			my ($cid, $ctitle) = git_commit_info($orig_commit, $id,
 							     $title);
 
@@ -7691,6 +7704,12 @@
 		ERROR("NOT_UNIFIED_DIFF",
 		      "Does not appear to be a unified-diff format patch\n");
 	}
+	if ($is_patch && $has_commit_log && $chk_fixes_tag) {
+		if ($needs_fixes_tag ne "" && !$is_revert && !$fixes_tag) {
+			WARN("MISSING_FIXES_TAG",
+				 "The commit message has '$needs_fixes_tag', perhaps it also needs a 'Fixes:' tag?\n");
+		}
+	}
 	if ($is_patch && $has_commit_log && $chk_signoff) {
 		if ($signoff == 0) {
 			ERROR("MISSING_SIGN_OFF",
--- linux-qcom-6.8.0.orig/scripts/coccinelle/api/device_attr_show.cocci
+++ linux-qcom-6.8.0/scripts/coccinelle/api/device_attr_show.cocci
@@ -28,7 +28,7 @@
 
 @rp depends on patch@
 identifier show, dev, attr, buf;
-expression BUF, SZ, FORMAT, STR;
+expression BUF, SZ, FORMAT;
 @@
 
 ssize_t show(struct device *dev, struct device_attribute *attr, char *buf)
--- linux-qcom-6.8.0.orig/scripts/export_report.pl
+++ linux-qcom-6.8.0/scripts/export_report.pl
@@ -116,18 +116,19 @@
 	while ( <$module> ) {
 		chomp;
 		if ($state == 0) {
-			$state = 1 if ($_ =~ /static const struct modversion_info/);
+			$state = 1 if ($_ =~ /static const char ____versions/);
 			next;
 		}
 		if ($state == 1) {
-			$state = 2 if ($_ =~ /__attribute__\(\(section\("__versions"\)\)\)/);
+			$state = 2 if ($_ =~ /__used __section\("__versions"\)/);
 			next;
 		}
 		if ($state == 2) {
-			if ( $_ !~ /0x[0-9a-f]+,/ ) {
+			if ( $_ !~ /\\0"/ ) {
+				last if ($_ =~ /;/);
 				next;
 			}
-			my $sym = (split /([,"])/,)[4];
+			my $sym = (split /(["\\])/,)[2];
 			my ($module, $value, $symbol, $gpl) = @{$SYMBOL{$sym}};
 			$SYMBOL{ $sym } =  [ $module, $value+1, $symbol, $gpl];
 			push(@{$MODULE{$thismod}} , $sym);
--- linux-qcom-6.8.0.orig/scripts/gcc-plugins/stackleak_plugin.c
+++ linux-qcom-6.8.0/scripts/gcc-plugins/stackleak_plugin.c
@@ -467,6 +467,8 @@
 			return false;
 		if (STRING_EQUAL(section, ".entry.text"))
 			return false;
+		if (STRING_EQUAL(section, ".head.text"))
+			return false;
 	}
 
 	return track_frame_size >= 0;
--- linux-qcom-6.8.0.orig/scripts/gcc-x86_32-has-stack-protector.sh
+++ linux-qcom-6.8.0/scripts/gcc-x86_32-has-stack-protector.sh
@@ -5,4 +5,4 @@
 # -mstack-protector-guard-reg, added by
 # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81708
 
-echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -m32 -O0 -fstack-protector -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard - -o - 2> /dev/null | grep -q "%fs"
+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -m32 -O0 -fstack-protector -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard - -o - 2> /dev/null | grep -q "%fs"
--- linux-qcom-6.8.0.orig/scripts/gcc-x86_64-has-stack-protector.sh
+++ linux-qcom-6.8.0/scripts/gcc-x86_64-has-stack-protector.sh
@@ -1,4 +1,4 @@
 #!/bin/sh
 # SPDX-License-Identifier: GPL-2.0
 
-echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -m64 -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -m64 -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
--- linux-qcom-6.8.0.orig/scripts/gdb/linux/proc.py
+++ linux-qcom-6.8.0/scripts/gdb/linux/proc.py
@@ -18,6 +18,7 @@
 from linux import tasks
 from linux import lists
 from linux import vfs
+from linux import rbtree
 from struct import *
 
 
@@ -172,8 +173,7 @@
         gdb.write("{:^18} {:^15} {:>9} {} {} options\n".format(
                   "mount", "super_block", "devname", "pathname", "fstype"))
 
-        for mnt in lists.list_for_each_entry(namespace['list'],
-                                             mount_ptr_type, "mnt_list"):
+        for mnt in rbtree.rb_inorder_for_each_entry(namespace['mounts'], mount_ptr_type, "mnt_node"):
             devname = mnt['mnt_devname'].string()
             devname = devname if devname else "none"
 
--- linux-qcom-6.8.0.orig/scripts/gdb/linux/rbtree.py
+++ linux-qcom-6.8.0/scripts/gdb/linux/rbtree.py
@@ -9,6 +9,18 @@
 rb_root_type = utils.CachedType("struct rb_root")
 rb_node_type = utils.CachedType("struct rb_node")
 
+def rb_inorder_for_each(root):
+    def inorder(node):
+        if node:
+            yield from inorder(node['rb_left'])
+            yield node
+            yield from inorder(node['rb_right'])
+
+    yield from inorder(root['rb_node'])
+
+def rb_inorder_for_each_entry(root, gdbtype, member):
+    for node in rb_inorder_for_each(root):
+        yield utils.container_of(node, gdbtype, member)
 
 def rb_first(root):
     if root.type == rb_root_type.get_type():
--- linux-qcom-6.8.0.orig/scripts/gfp-translate
+++ linux-qcom-6.8.0/scripts/gfp-translate
@@ -62,25 +62,57 @@
 fi
 
 # Extract GFP flags from the kernel source
-TMPFILE=`mktemp -t gfptranslate-XXXXXX` || exit 1
-grep -q ___GFP $SOURCE/include/linux/gfp_types.h
-if [ $? -eq 0 ]; then
-	grep "^#define ___GFP" $SOURCE/include/linux/gfp_types.h | sed -e 's/u$//' | grep -v GFP_BITS > $TMPFILE
-else
-	grep "^#define __GFP" $SOURCE/include/linux/gfp_types.h | sed -e 's/(__force gfp_t)//' | sed -e 's/u)/)/' | grep -v GFP_BITS | sed -e 's/)\//) \//' > $TMPFILE
-fi
+TMPFILE=`mktemp -t gfptranslate-XXXXXX.c` || exit 1
 
-# Parse the flags
-IFS="
-"
 echo Source: $SOURCE
 echo Parsing: $GFPMASK
-for LINE in `cat $TMPFILE`; do
-	MASK=`echo $LINE | awk '{print $3}'`
-	if [ $(($GFPMASK&$MASK)) -ne 0 ]; then
-		echo $LINE
-	fi
-done
 
-rm -f $TMPFILE
+(
+    cat <<EOF
+#include <stdint.h>
+#include <stdio.h>
+
+// Try to fool compiler.h into not including extra stuff
+#define __ASSEMBLY__	1
+
+#include <generated/autoconf.h>
+#include <linux/gfp_types.h>
+
+static const char *masks[] = {
+EOF
+
+    sed -nEe 's/^[[:space:]]+(___GFP_.*)_BIT,.*$/\1/p' $SOURCE/include/linux/gfp_types.h |
+	while read b; do
+	    cat <<EOF
+#if defined($b) && ($b > 0)
+	[${b}_BIT]	= "$b",
+#endif
+EOF
+	done
+
+    cat <<EOF
+};
+
+int main(int argc, char *argv[])
+{
+	unsigned long long mask = $GFPMASK;
+
+	for (int i = 0; i < sizeof(mask) * 8; i++) {
+		unsigned long long bit = 1ULL << i;
+		if (mask & bit)
+			printf("\t%-25s0x%llx\n",
+			       (i < ___GFP_LAST_BIT && masks[i]) ?
+					masks[i] : "*** INVALID ***",
+			       bit);
+	}
+
+	return 0;
+}
+EOF
+) > $TMPFILE
+
+${CC:-gcc} -Wall -o ${TMPFILE}.bin -I $SOURCE/include $TMPFILE && ${TMPFILE}.bin
+
+rm -f $TMPFILE ${TMPFILE}.bin
+
 exit 0
--- linux-qcom-6.8.0.orig/scripts/insert-sys-cert.c
+++ linux-qcom-6.8.0/scripts/insert-sys-cert.c
@@ -7,7 +7,8 @@
  * This software may be used and distributed according to the terms
  * of the GNU General Public License, incorporated herein by reference.
  *
- * Usage: insert-sys-cert [-s <System.map> -b <vmlinux> -c <certfile>
+ * Usage: insert-sys-cert [-s <System.map>] -b <vmlinux> -c <certfile>
+ *                        [-s <System.map>] -z <bzImage> -c <certfile>
  */
 
 #define _GNU_SOURCE
@@ -257,6 +258,169 @@
 	return buf;
 }
 
+static void get_payload_info(char *bzimage, int *offset, int *size)
+{
+	unsigned int system_offset;
+	unsigned char setup_sectors;
+
+	setup_sectors = bzimage[0x1f1] + 1;
+	system_offset = setup_sectors * 512;
+	*offset = system_offset + *((int*)&bzimage[0x248]);
+	*size = *((int*)&bzimage[0x24c]);
+}
+
+static void update_payload_info(char* bzimage, int new_size)
+{
+	int offset, size;
+	get_payload_info(bzimage, &offset, &size);
+	*((int*)&bzimage[0x24c]) = new_size;
+	if (new_size < size)
+		memset(bzimage + offset + new_size, 0, size - new_size);
+}
+
+struct zipper {
+	unsigned char pattern[10];
+	int length;
+	char *command;
+	char *compress;
+};
+
+struct zipper zippers[] = {
+	{{0x7F,'E','L','F'}, 4, "cat", "cat"},
+	{{0x1F,0x8B}, 2, "gunzip", "gzip -n -f -9"},
+	{{0xFD,'7','z','X','Z',0}, 6, "unxz", "xz"},
+	{{'B','Z','h'},3, "bunzip2", "bzip2 -9"},
+	{{0xFF,'L','Z','M','A',0}, 6, "unlzma", "lzma -9"},
+	{{0xD3,'L','Z','O',0,'\r','\n',0x20,'\n'}, 9, "lzop -d", "lzop -9"}
+};
+
+static struct zipper* get_zipper(char *p) {
+	int i;
+	for (i = 0; i < sizeof(zippers)/sizeof(struct zipper); i++) {
+		if (memcmp(p, zippers[i].pattern, zippers[i].length) == 0)
+			return &zippers[i];
+	}
+	return NULL;
+}
+
+/*
+ * This only works for x86 bzImage
+ */
+static void extract_vmlinux(char *bzimage, int bzimage_size,
+			char **file, struct zipper **zipper)
+{
+	int r;
+	char src[15] = "vmlinux-XXXXXX";
+	char dest[15] = "vmlinux-XXXXXX";
+	char cmd[100];
+	int src_fd, dest_fd;
+	int offset, size;
+	struct zipper *z;
+
+	/* TODO: verify that bzImage is supported */
+
+	get_payload_info(bzimage, &offset, &size);
+	z = get_zipper(bzimage + offset);
+	if (z == NULL) {
+		err("Unable to determine the compression of vmlinux\n");
+		return;
+	}
+
+	src_fd = mkstemp(src);
+	if (src_fd == -1) {
+		perror("Could not create temp file");
+		return;
+	}
+
+	r = write(src_fd, bzimage + offset, size);
+	if (r != size) {
+		perror("Could not write vmlinux");
+		return;
+	}
+	dest_fd = mkstemp(dest);
+	if (dest_fd == -1) {
+		perror("Could not create temp file");
+		return;
+	}
+
+	snprintf(cmd, sizeof(cmd), "%s <%s >%s", z->command, src, dest);
+	info("Executing: %s\n", cmd);
+	r = system(cmd);
+	if (r!=0)
+		warn("Possible errors when extracting\n");
+
+	r = remove(src);
+	if (r!=0)
+		perror(src);
+
+	*file = strdup(dest);
+	*zipper = z;
+}
+
+static void repack_image(char *bzimage, int bzimage_size,
+			char* vmlinux_file, struct zipper *z)
+{
+	char tmp[15] = "vmlinux-XXXXXX";
+	char cmd[100];
+	int fd;
+	struct stat st;
+	int new_size;
+	int r;
+	int offset, size;
+
+	get_payload_info(bzimage, &offset, &size);
+
+	fd = mkstemp(tmp);
+	if (fd == -1) {
+		perror("Could not create temp file");
+		return;
+	}
+	snprintf(cmd, sizeof(cmd), "%s <%s >%s",
+			z->compress, vmlinux_file, tmp);
+
+	info("Executing: %s\n", cmd);
+	r = system(cmd);
+	if (r!=0)
+		warn("Possible errors when compressing\n");
+
+	r = remove(vmlinux_file);
+	if (r!=0)
+		perror(vmlinux_file);
+
+	if (fstat(fd, &st)) {
+		perror("Could not determine file size");
+		close(fd);
+
+	}
+	new_size = st.st_size;
+	if (new_size > size) {
+		err("Increase in compressed size is not supported.\n");
+		err("Old size was %d, new size is %d\n", size, new_size);
+		exit(EXIT_FAILURE);
+	}
+
+	r = read(fd, bzimage + offset, new_size);
+	if (r != new_size)
+		perror(tmp);
+
+	r = remove(tmp);
+	if (r!=0)
+		perror(tmp);
+
+	/* x86 specific patching of bzimage */
+	update_payload_info(bzimage, new_size);
+
+	/* TODO: update CRC */
+
+}
+
+static void fill_random(unsigned char *p, int n) {
+	srand(0);
+	int i;
+	for (i = 0; i < n; i++)
+		p[i] = rand();
+}
+
 static void print_sym(Elf_Ehdr *hdr, struct sym *s)
 {
 	info("sym:    %s\n", s->name);
@@ -267,18 +431,23 @@
 
 static void print_usage(char *e)
 {
-	printf("Usage %s [-s <System.map>] -b <vmlinux> -c <certfile>\n", e);
+	printf("Usage: %s [-s <System.map>] -b <vmlinux> -c <certfile>\n", e);
+	printf("       %s [-s <System.map>] -z <bzImage> -c <certfile>\n", e);
 }
 
 int main(int argc, char **argv)
 {
 	char *system_map_file = NULL;
 	char *vmlinux_file = NULL;
+	char *bzimage_file = NULL;
 	char *cert_file = NULL;
 	int vmlinux_size;
+	int bzimage_size;
 	int cert_size;
 	Elf_Ehdr *hdr;
 	char *cert;
+	char *bzimage = NULL;
+	struct zipper *z = NULL;
 	FILE *system_map;
 	unsigned long *lsize;
 	int *used;
@@ -286,7 +455,7 @@
 	Elf_Shdr *symtab = NULL;
 	struct sym cert_sym, lsize_sym, used_sym;
 
-	while ((opt = getopt(argc, argv, "b:c:s:")) != -1) {
+	while ((opt = getopt(argc, argv, "b:z:c:s:")) != -1) {
 		switch (opt) {
 		case 's':
 			system_map_file = optarg;
@@ -294,6 +463,9 @@
 		case 'b':
 			vmlinux_file = optarg;
 			break;
+		case 'z':
+			bzimage_file = optarg;
+			break;
 		case 'c':
 			cert_file = optarg;
 			break;
@@ -302,7 +474,9 @@
 		}
 	}
 
-	if (!vmlinux_file || !cert_file) {
+	if (!cert_file ||
+	(!vmlinux_file && !bzimage_file) ||
+	(vmlinux_file && bzimage_file)) {
 		print_usage(argv[0]);
 		exit(EXIT_FAILURE);
 	}
@@ -311,6 +485,16 @@
 	if (!cert)
 		exit(EXIT_FAILURE);
 
+	if (bzimage_file) {
+		bzimage = map_file(bzimage_file, &bzimage_size);
+		if (!bzimage)
+			exit(EXIT_FAILURE);
+
+		extract_vmlinux(bzimage, bzimage_size, &vmlinux_file, &z);
+		if (!vmlinux_file)
+			exit(EXIT_FAILURE);
+	}
+
 	hdr = map_file(vmlinux_file, &vmlinux_size);
 	if (!hdr)
 		exit(EXIT_FAILURE);
@@ -386,7 +570,7 @@
 	}
 
 	/* If the existing cert is the same, don't overwrite */
-	if (cert_size == *used &&
+	if (cert_size > 0 && cert_size == *used &&
 	    strncmp(cert_sym.content, cert, cert_size) == 0) {
 		warn("Certificate was already inserted.\n");
 		exit(EXIT_SUCCESS);
@@ -396,9 +580,11 @@
 		warn("Replacing previously inserted certificate.\n");
 
 	memcpy(cert_sym.content, cert, cert_size);
+
 	if (cert_size < cert_sym.size)
-		memset(cert_sym.content + cert_size,
-			0, cert_sym.size - cert_size);
+		/* This makes the reserved space incompressable */
+		fill_random(cert_sym.content + cert_size,
+				cert_sym.size - cert_size);
 
 	*lsize = *lsize + cert_size - *used;
 	*used = cert_size;
@@ -406,5 +592,15 @@
 						cert_sym.address);
 	info("Used %d bytes out of %d bytes reserved.\n", *used,
 						 cert_sym.size);
+
+	if (munmap(hdr, vmlinux_size) == -1) {
+		perror(vmlinux_file);
+		exit(EXIT_FAILURE);
+	}
+
+	if (bzimage) {
+		repack_image(bzimage, bzimage_size, vmlinux_file, z);
+	}
+
 	exit(EXIT_SUCCESS);
 }
--- linux-qcom-6.8.0.orig/scripts/kallsyms.c
+++ linux-qcom-6.8.0/scripts/kallsyms.c
@@ -5,8 +5,7 @@
  * This software may be used and distributed according to the terms
  * of the GNU General Public License, incorporated herein by reference.
  *
- * Usage: kallsyms [--all-symbols] [--absolute-percpu]
- *                         [--base-relative] [--lto-clang] in.map > out.S
+ * Usage: kallsyms [--all-symbols] [--absolute-percpu]  in.map > out.S
  *
  *      Table compression uses all the unused char codes on the symbols and
  *  maps these to the most used substrings (tokens). For instance, it might
@@ -63,8 +62,6 @@
 static unsigned int table_size, table_cnt;
 static int all_symbols;
 static int absolute_percpu;
-static int base_relative;
-static int lto_clang;
 
 static int token_profit[0x10000];
 
@@ -75,8 +72,7 @@
 
 static void usage(void)
 {
-	fprintf(stderr, "Usage: kallsyms [--all-symbols] [--absolute-percpu] "
-			"[--base-relative] [--lto-clang] in.map > out.S\n");
+	fprintf(stderr, "Usage: kallsyms [--all-symbols] [--absolute-percpu] in.map > out.S\n");
 	exit(1);
 }
 
@@ -246,12 +242,6 @@
 		}
 	}
 	table_cnt = pos;
-
-	/* When valid symbol is not registered, exit to error */
-	if (!table_cnt) {
-		fprintf(stderr, "No valid symbol.\n");
-		exit(1);
-	}
 }
 
 static void read_map(const char *in)
@@ -339,25 +329,6 @@
 	return s->percpu_absolute;
 }
 
-static void cleanup_symbol_name(char *s)
-{
-	char *p;
-
-	/*
-	 * ASCII[.]   = 2e
-	 * ASCII[0-9] = 30,39
-	 * ASCII[A-Z] = 41,5a
-	 * ASCII[_]   = 5f
-	 * ASCII[a-z] = 61,7a
-	 *
-	 * As above, replacing the first '.' in ".llvm." with '\0' does not
-	 * affect the main sorting, but it helps us with subsorting.
-	 */
-	p = strstr(s, ".llvm.");
-	if (p)
-		*p = '\0';
-}
-
 static int compare_names(const void *a, const void *b)
 {
 	int ret;
@@ -484,58 +455,43 @@
 		printf("\t.short\t%d\n", best_idx[i]);
 	printf("\n");
 
-	if (!base_relative)
-		output_label("kallsyms_addresses");
-	else
-		output_label("kallsyms_offsets");
+	output_label("kallsyms_offsets");
 
 	for (i = 0; i < table_cnt; i++) {
-		if (base_relative) {
-			/*
-			 * Use the offset relative to the lowest value
-			 * encountered of all relative symbols, and emit
-			 * non-relocatable fixed offsets that will be fixed
-			 * up at runtime.
-			 */
+		/*
+		 * Use the offset relative to the lowest value
+		 * encountered of all relative symbols, and emit
+		 * non-relocatable fixed offsets that will be fixed
+		 * up at runtime.
+		 */
 
-			long long offset;
-			int overflow;
+		long long offset;
+		int overflow;
 
-			if (!absolute_percpu) {
-				offset = table[i]->addr - relative_base;
-				overflow = (offset < 0 || offset > UINT_MAX);
-			} else if (symbol_absolute(table[i])) {
-				offset = table[i]->addr;
-				overflow = (offset < 0 || offset > INT_MAX);
-			} else {
-				offset = relative_base - table[i]->addr - 1;
-				overflow = (offset < INT_MIN || offset >= 0);
-			}
-			if (overflow) {
-				fprintf(stderr, "kallsyms failure: "
-					"%s symbol value %#llx out of range in relative mode\n",
-					symbol_absolute(table[i]) ? "absolute" : "relative",
-					table[i]->addr);
-				exit(EXIT_FAILURE);
-			}
-			printf("\t.long\t%#x	/* %s */\n", (int)offset, table[i]->sym);
-		} else if (!symbol_absolute(table[i])) {
-			output_address(table[i]->addr);
+		if (!absolute_percpu) {
+			offset = table[i]->addr - relative_base;
+			overflow = (offset < 0 || offset > UINT_MAX);
+		} else if (symbol_absolute(table[i])) {
+			offset = table[i]->addr;
+			overflow = (offset < 0 || offset > INT_MAX);
 		} else {
-			printf("\tPTR\t%#llx\n", table[i]->addr);
+			offset = relative_base - table[i]->addr - 1;
+			overflow = (offset < INT_MIN || offset >= 0);
 		}
+		if (overflow) {
+			fprintf(stderr, "kallsyms failure: "
+				"%s symbol value %#llx out of range in relative mode\n",
+				symbol_absolute(table[i]) ? "absolute" : "relative",
+				table[i]->addr);
+			exit(EXIT_FAILURE);
+		}
+		printf("\t.long\t%#x	/* %s */\n", (int)offset, table[i]->sym);
 	}
 	printf("\n");
 
-	if (base_relative) {
-		output_label("kallsyms_relative_base");
-		output_address(relative_base);
-		printf("\n");
-	}
-
-	if (lto_clang)
-		for (i = 0; i < table_cnt; i++)
-			cleanup_symbol_name((char *)table[i]->sym);
+	output_label("kallsyms_relative_base");
+	output_address(relative_base);
+	printf("\n");
 
 	sort_symbols_by_name();
 	output_label("kallsyms_seqs_of_names");
@@ -813,8 +769,6 @@
 		static const struct option long_options[] = {
 			{"all-symbols",     no_argument, &all_symbols,     1},
 			{"absolute-percpu", no_argument, &absolute_percpu, 1},
-			{"base-relative",   no_argument, &base_relative,   1},
-			{"lto-clang",       no_argument, &lto_clang,       1},
 			{},
 		};
 
@@ -834,8 +788,7 @@
 	if (absolute_percpu)
 		make_percpus_absolute();
 	sort_symbols();
-	if (base_relative)
-		record_relative_base();
+	record_relative_base();
 	optimize_token_table();
 	write_src();
 
--- linux-qcom-6.8.0.orig/scripts/kconfig/expr.c
+++ linux-qcom-6.8.0/scripts/kconfig/expr.c
@@ -397,35 +397,6 @@
 }
 
 /*
- * bool FOO!=n => FOO
- */
-struct expr *expr_trans_bool(struct expr *e)
-{
-	if (!e)
-		return NULL;
-	switch (e->type) {
-	case E_AND:
-	case E_OR:
-	case E_NOT:
-		e->left.expr = expr_trans_bool(e->left.expr);
-		e->right.expr = expr_trans_bool(e->right.expr);
-		break;
-	case E_UNEQUAL:
-		// FOO!=n -> FOO
-		if (e->left.sym->type == S_TRISTATE) {
-			if (e->right.sym == &symbol_no) {
-				e->type = E_SYMBOL;
-				e->right.sym = NULL;
-			}
-		}
-		break;
-	default:
-		;
-	}
-	return e;
-}
-
-/*
  * e1 || e2 -> ?
  */
 static struct expr *expr_join_or(struct expr *e1, struct expr *e2)
--- linux-qcom-6.8.0.orig/scripts/kconfig/expr.h
+++ linux-qcom-6.8.0/scripts/kconfig/expr.h
@@ -295,7 +295,6 @@
 void expr_eliminate_eq(struct expr **ep1, struct expr **ep2);
 int expr_eq(struct expr *e1, struct expr *e2);
 tristate expr_calc_value(struct expr *e);
-struct expr *expr_trans_bool(struct expr *e);
 struct expr *expr_eliminate_dups(struct expr *e);
 struct expr *expr_transform(struct expr *e);
 int expr_contains_symbol(struct expr *dep, struct symbol *sym);
--- linux-qcom-6.8.0.orig/scripts/kconfig/gconf.c
+++ linux-qcom-6.8.0/scripts/kconfig/gconf.c
@@ -1478,7 +1478,6 @@
 
 	conf_parse(name);
 	fixup_rootmenu(&rootmenu);
-	conf_read(NULL);
 
 	/* Load the interface and connect signals */
 	init_main_window(glade_file);
@@ -1486,6 +1485,8 @@
 	init_left_tree();
 	init_right_tree();
 
+	conf_read(NULL);
+
 	switch (view_mode) {
 	case SINGLE_VIEW:
 		display_tree_part();
--- linux-qcom-6.8.0.orig/scripts/kconfig/lexer.l
+++ linux-qcom-6.8.0/scripts/kconfig/lexer.l
@@ -302,8 +302,11 @@
 	new_string();
 	append_string(in, n);
 
-	/* get the whole line because we do not know the end of token. */
-	while ((c = input()) != EOF) {
+	/*
+	 * get the whole line because we do not know the end of token.
+	 * input() returns 0 (not EOF!) when it reachs the end of file.
+	 */
+	while ((c = input()) != 0) {
 		if (c == '\n') {
 			unput(c);
 			break;
--- linux-qcom-6.8.0.orig/scripts/kconfig/lkc.h
+++ linux-qcom-6.8.0/scripts/kconfig/lkc.h
@@ -46,7 +46,9 @@
 /* confdata.c and expr.c */
 static inline void xfwrite(const void *str, size_t len, size_t count, FILE *out)
 {
-	assert(len != 0);
+	//assert(len != 0);
+	if (len == 0)
+		return;
 
 	if (fwrite(str, len, count, out) != count)
 		fprintf(stderr, "Error in writing or end of file.\n");
--- linux-qcom-6.8.0.orig/scripts/kconfig/menu.c
+++ linux-qcom-6.8.0/scripts/kconfig/menu.c
@@ -380,8 +380,6 @@
 				dep = expr_transform(dep);
 				dep = expr_alloc_and(expr_copy(basedep), dep);
 				dep = expr_eliminate_dups(dep);
-				if (menu->sym && menu->sym->type != S_TRISTATE)
-					dep = expr_trans_bool(dep);
 				prop->visible.expr = dep;
 
 				/*
--- linux-qcom-6.8.0.orig/scripts/kconfig/merge_config.sh
+++ linux-qcom-6.8.0/scripts/kconfig/merge_config.sh
@@ -167,6 +167,8 @@
 			sed -i "/$CFG[ =]/d" $MERGE_FILE
 		fi
 	done
+	# In case the previous file lacks a new line at the end
+	echo >> $TMP_FILE
 	cat $MERGE_FILE >> $TMP_FILE
 done
 
--- linux-qcom-6.8.0.orig/scripts/kconfig/qconf.cc
+++ linux-qcom-6.8.0/scripts/kconfig/qconf.cc
@@ -1174,7 +1174,7 @@
 {
 	QByteArray str = url.toEncoded();
 	const std::size_t count = str.size();
-	char *data = new char[count + 1];
+	char *data = new char[count + 2];  // '$' + '\0'
 	struct symbol **result;
 	struct menu *m = NULL;
 
--- linux-qcom-6.8.0.orig/scripts/kconfig/symbol.c
+++ linux-qcom-6.8.0/scripts/kconfig/symbol.c
@@ -13,18 +13,21 @@
 
 struct symbol symbol_yes = {
 	.name = "y",
+	.type = S_TRISTATE,
 	.curr = { "y", yes },
 	.flags = SYMBOL_CONST|SYMBOL_VALID,
 };
 
 struct symbol symbol_mod = {
 	.name = "m",
+	.type = S_TRISTATE,
 	.curr = { "m", mod },
 	.flags = SYMBOL_CONST|SYMBOL_VALID,
 };
 
 struct symbol symbol_no = {
 	.name = "n",
+	.type = S_TRISTATE,
 	.curr = { "n", no },
 	.flags = SYMBOL_CONST|SYMBOL_VALID,
 };
@@ -786,8 +789,7 @@
 		case no:
 			return "n";
 		case mod:
-			sym_calc_value(modules_sym);
-			return (modules_sym->curr.tri == no) ? "n" : "m";
+			return "m";
 		case yes:
 			return "y";
 		}
--- linux-qcom-6.8.0.orig/scripts/kernel-doc
+++ linux-qcom-6.8.0/scripts/kernel-doc
@@ -1,5 +1,6 @@
 #!/usr/bin/env perl
 # SPDX-License-Identifier: GPL-2.0
+# vim: softtabstop=4
 
 use warnings;
 use strict;
@@ -81,49 +82,51 @@
 
 # these are pretty rough
 my @highlights_man = (
-                      [$type_constant, "\$1"],
-                      [$type_constant2, "\$1"],
-                      [$type_func, "\\\\fB\$1\\\\fP"],
-                      [$type_enum, "\\\\fI\$1\\\\fP"],
-                      [$type_struct, "\\\\fI\$1\\\\fP"],
-                      [$type_typedef, "\\\\fI\$1\\\\fP"],
-                      [$type_union, "\\\\fI\$1\\\\fP"],
-                      [$type_param, "\\\\fI\$1\\\\fP"],
-                      [$type_param_ref, "\\\\fI\$1\$2\\\\fP"],
-                      [$type_member, "\\\\fI\$1\$2\$3\\\\fP"],
-                      [$type_fallback, "\\\\fI\$1\\\\fP"]
-		     );
+    [$type_constant, "\$1"],
+    [$type_constant2, "\$1"],
+    [$type_func, "\\\\fB\$1\\\\fP"],
+    [$type_enum, "\\\\fI\$1\\\\fP"],
+    [$type_struct, "\\\\fI\$1\\\\fP"],
+    [$type_typedef, "\\\\fI\$1\\\\fP"],
+    [$type_union, "\\\\fI\$1\\\\fP"],
+    [$type_param, "\\\\fI\$1\\\\fP"],
+    [$type_param_ref, "\\\\fI\$1\$2\\\\fP"],
+    [$type_member, "\\\\fI\$1\$2\$3\\\\fP"],
+    [$type_fallback, "\\\\fI\$1\\\\fP"]
+  );
 my $blankline_man = "";
 
 # rst-mode
 my @highlights_rst = (
-                       [$type_constant, "``\$1``"],
-                       [$type_constant2, "``\$1``"],
-                       # Note: need to escape () to avoid func matching later
-                       [$type_member_func, "\\:c\\:type\\:`\$1\$2\$3\\\\(\\\\) <\$1>`"],
-                       [$type_member, "\\:c\\:type\\:`\$1\$2\$3 <\$1>`"],
-		       [$type_fp_param, "**\$1\\\\(\\\\)**"],
-		       [$type_fp_param2, "**\$1\\\\(\\\\)**"],
-                       [$type_func, "\$1()"],
-                       [$type_enum, "\\:c\\:type\\:`\$1 <\$2>`"],
-                       [$type_struct, "\\:c\\:type\\:`\$1 <\$2>`"],
-                       [$type_typedef, "\\:c\\:type\\:`\$1 <\$2>`"],
-                       [$type_union, "\\:c\\:type\\:`\$1 <\$2>`"],
-                       # in rst this can refer to any type
-                       [$type_fallback, "\\:c\\:type\\:`\$1`"],
-                       [$type_param_ref, "**\$1\$2**"]
-		      );
+    [$type_constant, "``\$1``"],
+    [$type_constant2, "``\$1``"],
+
+    # Note: need to escape () to avoid func matching later
+    [$type_member_func, "\\:c\\:type\\:`\$1\$2\$3\\\\(\\\\) <\$1>`"],
+    [$type_member, "\\:c\\:type\\:`\$1\$2\$3 <\$1>`"],
+    [$type_fp_param, "**\$1\\\\(\\\\)**"],
+    [$type_fp_param2, "**\$1\\\\(\\\\)**"],
+    [$type_func, "\$1()"],
+    [$type_enum, "\\:c\\:type\\:`\$1 <\$2>`"],
+    [$type_struct, "\\:c\\:type\\:`\$1 <\$2>`"],
+    [$type_typedef, "\\:c\\:type\\:`\$1 <\$2>`"],
+    [$type_union, "\\:c\\:type\\:`\$1 <\$2>`"],
+
+    # in rst this can refer to any type
+    [$type_fallback, "\\:c\\:type\\:`\$1`"],
+    [$type_param_ref, "**\$1\$2**"]
+  );
 my $blankline_rst = "\n";
 
 # read arguments
 if ($#ARGV == -1) {
-	pod2usage(
-		-message => "No arguments!\n",
-		-exitval => 1,
-		-verbose => 99,
-		-sections => 'SYNOPSIS',
-		-output => \*STDERR,
-	);
+    pod2usage(
+        -message => "No arguments!\n",
+        -exitval => 1,
+        -verbose => 99,
+        -sections => 'SYNOPSIS',
+        -output => \*STDERR,
+      );
 }
 
 my $kernelversion;
@@ -164,9 +167,9 @@
 }
 
 my $man_date = ('January', 'February', 'March', 'April', 'May', 'June',
-		'July', 'August', 'September', 'October',
-		'November', 'December')[$build_time[4]] .
-  " " . ($build_time[5]+1900);
+                'July', 'August', 'September', 'October',
+                'November', 'December')[$build_time[4]] .
+    " " . ($build_time[5]+1900);
 
 # Essentially these are globals.
 # They probably want to be tidied up, made more localised or something.
@@ -179,22 +182,22 @@
 my ($newsection, $newcontents, $prototype, $brcount, %source_map);
 
 if (defined($ENV{'KBUILD_VERBOSE'}) && $ENV{'KBUILD_VERBOSE'} =~ '1') {
-	$verbose = 1;
+    $verbose = 1;
 }
 
 if (defined($ENV{'KCFLAGS'})) {
-	my $kcflags = "$ENV{'KCFLAGS'}";
+    my $kcflags = "$ENV{'KCFLAGS'}";
 
-	if ($kcflags =~ /(\s|^)-Werror(\s|$)/) {
-		$Werror = 1;
-	}
+    if ($kcflags =~ /(\s|^)-Werror(\s|$)/) {
+        $Werror = 1;
+    }
 }
 
 # reading this variable is for backwards compat just in case
 # someone was calling it with the variable from outside the
 # kernel's build system
 if (defined($ENV{'KDOC_WERROR'})) {
-	$Werror = "$ENV{'KDOC_WERROR'}";
+    $Werror = "$ENV{'KDOC_WERROR'}";
 }
 # other environment variables are converted to command-line
 # arguments in cmd_checkdoc in the build system
@@ -295,90 +298,90 @@
     my $cmd = $1;
     shift @ARGV;
     if ($cmd eq "man") {
-	$output_mode = "man";
-	@highlights = @highlights_man;
-	$blankline = $blankline_man;
+        $output_mode = "man";
+        @highlights = @highlights_man;
+        $blankline = $blankline_man;
     } elsif ($cmd eq "rst") {
-	$output_mode = "rst";
-	@highlights = @highlights_rst;
-	$blankline = $blankline_rst;
+        $output_mode = "rst";
+        @highlights = @highlights_rst;
+        $blankline = $blankline_rst;
     } elsif ($cmd eq "none") {
-	$output_mode = "none";
+        $output_mode = "none";
     } elsif ($cmd eq "module") { # not needed for XML, inherits from calling document
-	$modulename = shift @ARGV;
+        $modulename = shift @ARGV;
     } elsif ($cmd eq "function") { # to only output specific functions
-	$output_selection = OUTPUT_INCLUDE;
-	$function = shift @ARGV;
-	$function_table{$function} = 1;
+        $output_selection = OUTPUT_INCLUDE;
+        $function = shift @ARGV;
+        $function_table{$function} = 1;
     } elsif ($cmd eq "nosymbol") { # Exclude specific symbols
-	my $symbol = shift @ARGV;
-	$nosymbol_table{$symbol} = 1;
+        my $symbol = shift @ARGV;
+        $nosymbol_table{$symbol} = 1;
     } elsif ($cmd eq "export") { # only exported symbols
-	$output_selection = OUTPUT_EXPORTED;
-	%function_table = ();
+        $output_selection = OUTPUT_EXPORTED;
+        %function_table = ();
     } elsif ($cmd eq "internal") { # only non-exported symbols
-	$output_selection = OUTPUT_INTERNAL;
-	%function_table = ();
+        $output_selection = OUTPUT_INTERNAL;
+        %function_table = ();
     } elsif ($cmd eq "export-file") {
-	my $file = shift @ARGV;
-	push(@export_file_list, $file);
+        my $file = shift @ARGV;
+        push(@export_file_list, $file);
     } elsif ($cmd eq "v") {
-	$verbose = 1;
+        $verbose = 1;
     } elsif ($cmd eq "Werror") {
-	$Werror = 1;
+        $Werror = 1;
     } elsif ($cmd eq "Wreturn") {
-	$Wreturn = 1;
+        $Wreturn = 1;
     } elsif ($cmd eq "Wshort-desc" or $cmd eq "Wshort-description") {
-	$Wshort_desc = 1;
+        $Wshort_desc = 1;
     } elsif ($cmd eq "Wcontents-before-sections") {
-	$Wcontents_before_sections = 1;
+        $Wcontents_before_sections = 1;
     } elsif ($cmd eq "Wall") {
         $Wreturn = 1;
         $Wshort_desc = 1;
         $Wcontents_before_sections = 1;
     } elsif (($cmd eq "h") || ($cmd eq "help")) {
-		pod2usage(-exitval => 0, -verbose => 2);
+        pod2usage(-exitval => 0, -verbose => 2);
     } elsif ($cmd eq 'no-doc-sections') {
-	    $no_doc_sections = 1;
+        $no_doc_sections = 1;
     } elsif ($cmd eq 'enable-lineno') {
-	    $enable_lineno = 1;
+        $enable_lineno = 1;
     } elsif ($cmd eq 'show-not-found') {
-	$show_not_found = 1;  # A no-op but don't fail
+        $show_not_found = 1;  # A no-op but don't fail
     } elsif ($cmd eq "sphinx-version") {
-	my $ver_string = shift @ARGV;
-	if ($ver_string =~ m/^(\d+)(\.\d+)?(\.\d+)?/) {
-	    $sphinx_major = $1;
-	    if (defined($2)) {
-		$sphinx_minor = substr($2,1);
-	    } else {
-		$sphinx_minor = 0;
-	    }
-	    if (defined($3)) {
-		$sphinx_patch = substr($3,1)
-	    } else {
-		$sphinx_patch = 0;
-	    }
-	} else {
-	    die "Sphinx version should either major.minor or major.minor.patch format\n";
-	}
+        my $ver_string = shift @ARGV;
+        if ($ver_string =~ m/^(\d+)(\.\d+)?(\.\d+)?/) {
+            $sphinx_major = $1;
+            if (defined($2)) {
+                $sphinx_minor = substr($2,1);
+            } else {
+                $sphinx_minor = 0;
+            }
+            if (defined($3)) {
+                $sphinx_patch = substr($3,1)
+            } else {
+                $sphinx_patch = 0;
+            }
+        } else {
+            die "Sphinx version should either major.minor or major.minor.patch format\n";
+        }
     } else {
-	# Unknown argument
-	pod2usage(
-	    -message => "Argument unknown!\n",
-	    -exitval => 1,
-	    -verbose => 99,
-	    -sections => 'SYNOPSIS',
-	    -output => \*STDERR,
-	    );
+        # Unknown argument
+        pod2usage(
+            -message => "Argument unknown!\n",
+            -exitval => 1,
+            -verbose => 99,
+            -sections => 'SYNOPSIS',
+            -output => \*STDERR,
+            );
     }
     if ($#ARGV < 0){
-	pod2usage(
-	    -message => "FILE argument missing\n",
-	    -exitval => 1,
-	    -verbose => 99,
-	    -sections => 'SYNOPSIS',
-	    -output => \*STDERR,
-	    );
+        pod2usage(
+            -message => "FILE argument missing\n",
+            -exitval => 1,
+            -verbose => 99,
+            -sections => 'SYNOPSIS',
+            -output => \*STDERR,
+            );
     }
 }
 
@@ -388,45 +391,45 @@
 # version in order to produce the right tags.
 sub findprog($)
 {
-	foreach(split(/:/, $ENV{PATH})) {
-		return "$_/$_[0]" if(-x "$_/$_[0]");
-	}
+    foreach(split(/:/, $ENV{PATH})) {
+        return "$_/$_[0]" if(-x "$_/$_[0]");
+    }
 }
 
 sub get_sphinx_version()
 {
-	my $ver;
+    my $ver;
 
-	my $cmd = "sphinx-build";
-	if (!findprog($cmd)) {
-		my $cmd = "sphinx-build3";
-		if (!findprog($cmd)) {
-			$sphinx_major = 1;
-			$sphinx_minor = 2;
-			$sphinx_patch = 0;
-			printf STDERR "Warning: Sphinx version not found. Using default (Sphinx version %d.%d.%d)\n",
-			       $sphinx_major, $sphinx_minor, $sphinx_patch;
-			return;
-		}
-	}
+    my $cmd = "sphinx-build";
+    if (!findprog($cmd)) {
+        my $cmd = "sphinx-build3";
+        if (!findprog($cmd)) {
+            $sphinx_major = 1;
+            $sphinx_minor = 2;
+            $sphinx_patch = 0;
+            printf STDERR "Warning: Sphinx version not found. Using default (Sphinx version %d.%d.%d)\n",
+                   $sphinx_major, $sphinx_minor, $sphinx_patch;
+            return;
+        }
+    }
 
-	open IN, "$cmd --version 2>&1 |";
-	while (<IN>) {
-		if (m/^\s*sphinx-build\s+([\d]+)\.([\d\.]+)(\+\/[\da-f]+)?$/) {
-			$sphinx_major = $1;
-			$sphinx_minor = $2;
-			$sphinx_patch = $3;
-			last;
-		}
-		# Sphinx 1.2.x uses a different format
-		if (m/^\s*Sphinx.*\s+([\d]+)\.([\d\.]+)$/) {
-			$sphinx_major = $1;
-			$sphinx_minor = $2;
-			$sphinx_patch = $3;
-			last;
-		}
-	}
-	close IN;
+    open IN, "$cmd --version 2>&1 |";
+    while (<IN>) {
+        if (m/^\s*sphinx-build\s+([\d]+)\.([\d\.]+)(\+\/[\da-f]+)?$/) {
+            $sphinx_major = $1;
+            $sphinx_minor = $2;
+            $sphinx_patch = $3;
+            last;
+        }
+        # Sphinx 1.2.x uses a different format
+        if (m/^\s*Sphinx.*\s+([\d]+)\.([\d\.]+)$/) {
+            $sphinx_major = $1;
+            $sphinx_minor = $2;
+            $sphinx_patch = $3;
+            last;
+        }
+    }
+    close IN;
 }
 
 # get kernel version from env
@@ -434,7 +437,7 @@
     my $version = 'unknown kernel version';
 
     if (defined($ENV{'KERNELVERSION'})) {
-	$version = $ENV{'KERNELVERSION'};
+        $version = $ENV{'KERNELVERSION'};
     }
     return $version;
 }
@@ -462,30 +465,30 @@
     my $contents = join "\n", @_;
 
     if ($name =~ m/$type_param/) {
-	$name = $1;
-	$parameterdescs{$name} = $contents;
-	$sectcheck = $sectcheck . $name . " ";
+        $name = $1;
+        $parameterdescs{$name} = $contents;
+        $sectcheck = $sectcheck . $name . " ";
         $parameterdesc_start_lines{$name} = $new_start_line;
         $new_start_line = 0;
     } elsif ($name eq "@\.\.\.") {
-	$name = "...";
-	$parameterdescs{$name} = $contents;
-	$sectcheck = $sectcheck . $name . " ";
+        $name = "...";
+        $parameterdescs{$name} = $contents;
+        $sectcheck = $sectcheck . $name . " ";
         $parameterdesc_start_lines{$name} = $new_start_line;
         $new_start_line = 0;
     } else {
-	if (defined($sections{$name}) && ($sections{$name} ne "")) {
-	    # Only warn on user specified duplicate section names.
-	    if ($name ne $section_default) {
-		emit_warning("${file}:$.", "duplicate section name '$name'\n");
-	    }
-	    $sections{$name} .= $contents;
-	} else {
-	    $sections{$name} = $contents;
-	    push @sectionlist, $name;
+        if (defined($sections{$name}) && ($sections{$name} ne "")) {
+            # Only warn on user specified duplicate section names.
+            if ($name ne $section_default) {
+                emit_warning("${file}:$.", "duplicate section name '$name'\n");
+            }
+            $sections{$name} .= $contents;
+        } else {
+            $sections{$name} = $contents;
+            push @sectionlist, $name;
             $section_start_lines{$name} = $new_start_line;
             $new_start_line = 0;
-	}
+        }
     }
 }
 
@@ -504,14 +507,14 @@
     return if (defined($nosymbol_table{$name}));
 
     if (($output_selection == OUTPUT_ALL) ||
-	(($output_selection == OUTPUT_INCLUDE) &&
-	 defined($function_table{$name})))
+        (($output_selection == OUTPUT_INCLUDE) &&
+         defined($function_table{$name})))
     {
-	dump_section($file, $name, $contents);
-	output_blockhead({'sectionlist' => \@sectionlist,
-			  'sections' => \%sections,
-			  'module' => $modulename,
-			  'content-only' => ($output_selection != OUTPUT_ALL), });
+        dump_section($file, $name, $contents);
+        output_blockhead({'sectionlist' => \@sectionlist,
+                          'sections' => \%sections,
+                          'module' => $modulename,
+                          'content-only' => ($output_selection != OUTPUT_ALL), });
     }
 }
 
@@ -542,21 +545,21 @@
 #   print STDERR "contents af:$contents\n";
 
     foreach $line (split "\n", $contents) {
-	if (! $output_preformatted) {
-	    $line =~ s/^\s*//;
-	}
-	if ($line eq ""){
-	    if (! $output_preformatted) {
-		print $lineprefix, $blankline;
-	    }
-	} else {
-	    if ($output_mode eq "man" && substr($line, 0, 1) eq ".") {
-		print "\\&$line";
-	    } else {
-		print $lineprefix, $line;
-	    }
-	}
-	print "\n";
+        if (! $output_preformatted) {
+            $line =~ s/^\s*//;
+        }
+        if ($line eq ""){
+            if (! $output_preformatted) {
+                print $lineprefix, $blankline;
+            }
+        } else {
+            if ($output_mode eq "man" && substr($line, 0, 1) eq ".") {
+                print "\\&$line";
+            } else {
+                print $lineprefix, $line;
+            }
+        }
+        print "\n";
     }
 }
 
@@ -566,6 +569,8 @@
     my %args = %{$_[0]};
     my ($parameter, $section);
     my $count;
+    my $func_macro = $args{'func_macro'};
+    my $paramcount = $#{$args{'parameterlist'}}; # -1 is empty
 
     print ".TH \"$args{'function'}\" 9 \"$args{'function'}\" \"$man_date\" \"Kernel Hacker's Manual\" LINUX\n";
 
@@ -574,40 +579,43 @@
 
     print ".SH SYNOPSIS\n";
     if ($args{'functiontype'} ne "") {
-	print ".B \"" . $args{'functiontype'} . "\" " . $args{'function'} . "\n";
+        print ".B \"" . $args{'functiontype'} . "\" " . $args{'function'} . "\n";
     } else {
-	print ".B \"" . $args{'function'} . "\n";
+        print ".B \"" . $args{'function'} . "\n";
     }
     $count = 0;
     my $parenth = "(";
     my $post = ",";
     foreach my $parameter (@{$args{'parameterlist'}}) {
-	if ($count == $#{$args{'parameterlist'}}) {
-	    $post = ");";
-	}
-	$type = $args{'parametertypes'}{$parameter};
-	if ($type =~ m/$function_pointer/) {
-	    # pointer-to-function
-	    print ".BI \"" . $parenth . $1 . "\" " . " \") (" . $2 . ")" . $post . "\"\n";
-	} else {
-	    $type =~ s/([^\*])$/$1 /;
-	    print ".BI \"" . $parenth . $type . "\" " . " \"" . $post . "\"\n";
-	}
-	$count++;
-	$parenth = "";
+        if ($count == $#{$args{'parameterlist'}}) {
+            $post = ");";
+        }
+        $type = $args{'parametertypes'}{$parameter};
+        if ($type =~ m/$function_pointer/) {
+            # pointer-to-function
+            print ".BI \"" . $parenth . $1 . "\" " . " \") (" . $2 . ")" . $post . "\"\n";
+        } else {
+            $type =~ s/([^\*])$/$1 /;
+            print ".BI \"" . $parenth . $type . "\" " . " \"" . $post . "\"\n";
+        }
+        $count++;
+        $parenth = "";
     }
 
-    print ".SH ARGUMENTS\n";
+    $paramcount = $#{$args{'parameterlist'}}; # -1 is empty
+    if ($paramcount >= 0) {
+    	print ".SH ARGUMENTS\n";
+	}
     foreach $parameter (@{$args{'parameterlist'}}) {
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
+        my $parameter_name = $parameter;
+        $parameter_name =~ s/\[.*//;
 
-	print ".IP \"" . $parameter . "\" 12\n";
-	output_highlight($args{'parameterdescs'}{$parameter_name});
+        print ".IP \"" . $parameter . "\" 12\n";
+        output_highlight($args{'parameterdescs'}{$parameter_name});
     }
     foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"", uc $section, "\"\n";
-	output_highlight($args{'sections'}{$section});
+        print ".SH \"", uc $section, "\"\n";
+        output_highlight($args{'sections'}{$section});
     }
 }
 
@@ -627,28 +635,27 @@
     print "enum " . $args{'enum'} . " {\n";
     $count = 0;
     foreach my $parameter (@{$args{'parameterlist'}}) {
-	print ".br\n.BI \"    $parameter\"\n";
-	if ($count == $#{$args{'parameterlist'}}) {
-	    print "\n};\n";
-	    last;
-	}
-	else {
-	    print ", \n.br\n";
-	}
-	$count++;
+        print ".br\n.BI \"    $parameter\"\n";
+        if ($count == $#{$args{'parameterlist'}}) {
+            print "\n};\n";
+            last;
+        } else {
+            print ", \n.br\n";
+        }
+        $count++;
     }
 
     print ".SH Constants\n";
     foreach $parameter (@{$args{'parameterlist'}}) {
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
+        my $parameter_name = $parameter;
+        $parameter_name =~ s/\[.*//;
 
-	print ".IP \"" . $parameter . "\" 12\n";
-	output_highlight($args{'parameterdescs'}{$parameter_name});
+        print ".IP \"" . $parameter . "\" 12\n";
+        output_highlight($args{'parameterdescs'}{$parameter_name});
     }
     foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"$section\"\n";
-	output_highlight($args{'sections'}{$section});
+        print ".SH \"$section\"\n";
+        output_highlight($args{'sections'}{$section});
     }
 }
 
@@ -672,18 +679,18 @@
 
     print ".SH Members\n";
     foreach $parameter (@{$args{'parameterlist'}}) {
-	($parameter =~ /^#/) && next;
+        ($parameter =~ /^#/) && next;
 
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
+        my $parameter_name = $parameter;
+        $parameter_name =~ s/\[.*//;
 
-	($args{'parameterdescs'}{$parameter_name} ne $undescribed) || next;
-	print ".IP \"" . $parameter . "\" 12\n";
-	output_highlight($args{'parameterdescs'}{$parameter_name});
+        ($args{'parameterdescs'}{$parameter_name} ne $undescribed) || next;
+        print ".IP \"" . $parameter . "\" 12\n";
+        output_highlight($args{'parameterdescs'}{$parameter_name});
     }
     foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"$section\"\n";
-	output_highlight($args{'sections'}{$section});
+        print ".SH \"$section\"\n";
+        output_highlight($args{'sections'}{$section});
     }
 }
 
@@ -699,8 +706,8 @@
     print "typedef " . $args{'typedef'} . " \\- " . $args{'purpose'} . "\n";
 
     foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"$section\"\n";
-	output_highlight($args{'sections'}{$section});
+        print ".SH \"$section\"\n";
+        output_highlight($args{'sections'}{$section});
     }
 }
 
@@ -712,8 +719,8 @@
     print ".TH \"$args{'module'}\" 9 \"$args{'module'}\" \"$man_date\" \"API Manual\" LINUX\n";
 
     foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"$section\"\n";
-	output_highlight($args{'sections'}{$section});
+        print ".SH \"$section\"\n";
+        output_highlight($args{'sections'}{$section});
     }
 }
 
@@ -731,15 +738,15 @@
     my ($parameter, $section);
 
     foreach $section (@{$args{'sectionlist'}}) {
-	next if (defined($nosymbol_table{$section}));
+        next if (defined($nosymbol_table{$section}));
 
-	if ($output_selection != OUTPUT_INCLUDE) {
-	    print ".. _$section:\n\n";
-	    print "**$section**\n\n";
-	}
+        if ($output_selection != OUTPUT_INCLUDE) {
+            print ".. _$section:\n\n";
+            print "**$section**\n\n";
+        }
         print_lineno($section_start_lines{$section});
-	output_highlight_rst($args{'sections'}{$section});
-	print "\n";
+        output_highlight_rst($args{'sections'}{$section});
+        print "\n";
     }
 }
 
@@ -769,48 +776,48 @@
     my $block = "";
 
     foreach $line (split "\n",$input) {
-	#
-	# If we're in a literal block, see if we should drop out
-	# of it.  Otherwise pass the line straight through unmunged.
-	#
-	if ($in_literal) {
-	    if (! ($line =~ /^\s*$/)) {
-		#
-		# If this is the first non-blank line in a literal
-		# block we need to figure out what the proper indent is.
-		#
-		if ($litprefix eq "") {
-		    $line =~ /^(\s*)/;
-		    $litprefix = '^' . $1;
-		    $output .= $line . "\n";
-		} elsif (! ($line =~ /$litprefix/)) {
-		    $in_literal = 0;
-		} else {
-		    $output .= $line . "\n";
-		}
-	    } else {
-		$output .= $line . "\n";
-	    }
-	}
-	#
-	# Not in a literal block (or just dropped out)
-	#
-	if (! $in_literal) {
-	    $block .= $line . "\n";
-	    if (($line =~ /$sphinx_literal/) || ($line =~ /$sphinx_cblock/)) {
-		$in_literal = 1;
-		$litprefix = "";
-		$output .= highlight_block($block);
-		$block = ""
-	    }
-	}
+        #
+        # If we're in a literal block, see if we should drop out
+        # of it.  Otherwise pass the line straight through unmunged.
+        #
+        if ($in_literal) {
+            if (! ($line =~ /^\s*$/)) {
+                #
+                # If this is the first non-blank line in a literal
+                # block we need to figure out what the proper indent is.
+                #
+                if ($litprefix eq "") {
+                    $line =~ /^(\s*)/;
+                    $litprefix = '^' . $1;
+                    $output .= $line . "\n";
+                } elsif (! ($line =~ /$litprefix/)) {
+                    $in_literal = 0;
+                } else {
+                    $output .= $line . "\n";
+                }
+            } else {
+                $output .= $line . "\n";
+            }
+        }
+        #
+        # Not in a literal block (or just dropped out)
+        #
+        if (! $in_literal) {
+            $block .= $line . "\n";
+            if (($line =~ /$sphinx_literal/) || ($line =~ /$sphinx_cblock/)) {
+                $in_literal = 1;
+                $litprefix = "";
+                $output .= highlight_block($block);
+                $block = ""
+            }
+        }
     }
 
     if ($block) {
-	$output .= highlight_block($block);
+        $output .= highlight_block($block);
     }
     foreach $line (split "\n", $output) {
-	print $lineprefix . $line . "\n";
+        print $lineprefix . $line . "\n";
     }
 }
 
@@ -818,102 +825,109 @@
     my %args = %{$_[0]};
     my ($parameter, $section);
     my $oldprefix = $lineprefix;
-    my $start = "";
-    my $is_macro = 0;
 
-    if ($sphinx_major < 3) {
-	if ($args{'typedef'}) {
-	    print ".. c:type:: ". $args{'function'} . "\n\n";
-	    print_lineno($declaration_start_line);
-	    print "   **Typedef**: ";
-	    $lineprefix = "";
-	    output_highlight_rst($args{'purpose'});
-	    $start = "\n\n**Syntax**\n\n  ``";
-	    $is_macro = 1;
-	} else {
-	    print ".. c:function:: ";
-	}
-    } else {
-	if ($args{'typedef'} || $args{'functiontype'} eq "") {
-	    $is_macro = 1;
-	    print ".. c:macro:: ". $args{'function'} . "\n\n";
-	} else {
-	    print ".. c:function:: ";
-	}
+    my $signature = "";
+    my $func_macro = $args{'func_macro'};
+    my $paramcount = $#{$args{'parameterlist'}}; # -1 is empty
 
-	if ($args{'typedef'}) {
-	    print_lineno($declaration_start_line);
-	    print "   **Typedef**: ";
-	    $lineprefix = "";
-	    output_highlight_rst($args{'purpose'});
-	    $start = "\n\n**Syntax**\n\n  ``";
+	if ($func_macro) {
+        $signature = $args{'function'};
 	} else {
-	    print "``" if ($is_macro);
-	}
-    }
-    if ($args{'functiontype'} ne "") {
-	$start .= $args{'functiontype'} . " " . $args{'function'} . " (";
-    } else {
-	$start .= $args{'function'} . " (";
+		if ($args{'functiontype'}) {
+        	$signature = $args{'functiontype'} . " ";
+		}
+		$signature .= $args{'function'} . " (";
     }
-    print $start;
 
     my $count = 0;
     foreach my $parameter (@{$args{'parameterlist'}}) {
-	if ($count ne 0) {
-	    print ", ";
-	}
-	$count++;
-	$type = $args{'parametertypes'}{$parameter};
+        if ($count ne 0) {
+            $signature .= ", ";
+        }
+        $count++;
+        $type = $args{'parametertypes'}{$parameter};
 
-	if ($type =~ m/$function_pointer/) {
-	    # pointer-to-function
-	    print $1 . $parameter . ") (" . $2 . ")";
-	} else {
-	    print $type;
-	}
+        if ($type =~ m/$function_pointer/) {
+            # pointer-to-function
+            $signature .= $1 . $parameter . ") (" . $2 . ")";
+        } else {
+            $signature .= $type;
+        }
+    }
+
+    if (!$func_macro) {
+    	$signature .= ")";
     }
-    if ($is_macro) {
-	print ")``\n\n";
+
+    if ($sphinx_major < 3) {
+        if ($args{'typedef'}) {
+            print ".. c:type:: ". $args{'function'} . "\n\n";
+            print_lineno($declaration_start_line);
+            print "   **Typedef**: ";
+            $lineprefix = "";
+            output_highlight_rst($args{'purpose'});
+            print "\n\n**Syntax**\n\n";
+            print "  ``$signature``\n\n";
+        } else {
+            print ".. c:function:: $signature\n\n";
+        }
     } else {
-	print ")\n\n";
+        if ($args{'typedef'} || $args{'functiontype'} eq "") {
+            print ".. c:macro:: ". $args{'function'} . "\n\n";
+
+            if ($args{'typedef'}) {
+                print_lineno($declaration_start_line);
+                print "   **Typedef**: ";
+                $lineprefix = "";
+                output_highlight_rst($args{'purpose'});
+                print "\n\n**Syntax**\n\n";
+                print "  ``$signature``\n\n";
+            } else {
+                print "``$signature``\n\n";
+            }
+        } else {
+            print ".. c:function:: $signature\n\n";
+        }
     }
+
     if (!$args{'typedef'}) {
-	print_lineno($declaration_start_line);
-	$lineprefix = "   ";
-	output_highlight_rst($args{'purpose'});
-	print "\n";
+        print_lineno($declaration_start_line);
+        $lineprefix = "   ";
+        output_highlight_rst($args{'purpose'});
+        print "\n";
     }
 
     #
     # Put our descriptive text into a container (thus an HTML <div>) to help
     # set the function prototypes apart.
     #
-    print ".. container:: kernelindent\n\n";
     $lineprefix = "  ";
-    print $lineprefix . "**Parameters**\n\n";
+	if ($paramcount >= 0) {
+    	print ".. container:: kernelindent\n\n";
+   		print $lineprefix . "**Parameters**\n\n";
+    }
     foreach $parameter (@{$args{'parameterlist'}}) {
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
-	$type = $args{'parametertypes'}{$parameter};
-
-	if ($type ne "") {
-	    print $lineprefix . "``$type``\n";
-	} else {
-	    print $lineprefix . "``$parameter``\n";
-	}
+        my $parameter_name = $parameter;
+        $parameter_name =~ s/\[.*//;
+        $type = $args{'parametertypes'}{$parameter};
+
+        if ($type ne "") {
+            print $lineprefix . "``$type``\n";
+        } else {
+            print $lineprefix . "``$parameter``\n";
+        }
 
         print_lineno($parameterdesc_start_lines{$parameter_name});
 
-	$lineprefix = "    ";
-	if (defined($args{'parameterdescs'}{$parameter_name}) &&
-	    $args{'parameterdescs'}{$parameter_name} ne $undescribed) {
-	    output_highlight_rst($args{'parameterdescs'}{$parameter_name});
-	} else {
-	    print $lineprefix . "*undescribed*\n";
-	}
-	$lineprefix = "  ";
-	print "\n";
+        $lineprefix = "    ";
+        if (defined($args{'parameterdescs'}{$parameter_name}) &&
+            $args{'parameterdescs'}{$parameter_name} ne $undescribed) {
+            output_highlight_rst($args{'parameterdescs'}{$parameter_name});
+        } else {
+            print $lineprefix . "*undescribed*\n";
+        }
+        $lineprefix = "  ";
+        print "\n";
     }
 
     output_section_rst(@_);
@@ -926,10 +940,10 @@
     my $oldprefix = $lineprefix;
 
     foreach $section (@{$args{'sectionlist'}}) {
-	print $lineprefix . "**$section**\n\n";
+        print $lineprefix . "**$section**\n\n";
         print_lineno($section_start_lines{$section});
-	output_highlight_rst($args{'sections'}{$section});
-	print "\n";
+        output_highlight_rst($args{'sections'}{$section});
+        print "\n";
     }
     print "\n";
 }
@@ -942,11 +956,11 @@
     my $outer;
 
     if ($sphinx_major < 3) {
-	my $name = "enum " . $args{'enum'};
-	print "\n\n.. c:type:: " . $name . "\n\n";
+        my $name = "enum " . $args{'enum'};
+        print "\n\n.. c:type:: " . $name . "\n\n";
     } else {
-	my $name = $args{'enum'};
-	print "\n\n.. c:enum:: " . $name . "\n\n";
+        my $name = $args{'enum'};
+        print "\n\n.. c:enum:: " . $name . "\n\n";
     }
     print_lineno($declaration_start_line);
     $lineprefix = "  ";
@@ -958,14 +972,14 @@
     $lineprefix = $outer . "  ";
     print $outer . "**Constants**\n\n";
     foreach $parameter (@{$args{'parameterlist'}}) {
-	print $outer . "``$parameter``\n";
+        print $outer . "``$parameter``\n";
 
-	if ($args{'parameterdescs'}{$parameter} ne $undescribed) {
-	    output_highlight_rst($args{'parameterdescs'}{$parameter});
-	} else {
-	    print $lineprefix . "*undescribed*\n";
-	}
-	print "\n";
+        if ($args{'parameterdescs'}{$parameter} ne $undescribed) {
+            output_highlight_rst($args{'parameterdescs'}{$parameter});
+        } else {
+            print $lineprefix . "*undescribed*\n";
+        }
+        print "\n";
     }
     print "\n";
     $lineprefix = $oldprefix;
@@ -979,9 +993,9 @@
     my $name;
 
     if ($sphinx_major < 3) {
-	$name = "typedef " . $args{'typedef'};
+        $name = "typedef " . $args{'typedef'};
     } else {
-	$name = $args{'typedef'};
+        $name = $args{'typedef'};
     }
     print "\n\n.. c:type:: " . $name . "\n\n";
     print_lineno($declaration_start_line);
@@ -999,15 +1013,15 @@
     my $oldprefix = $lineprefix;
 
     if ($sphinx_major < 3) {
-	my $name = $args{'type'} . " " . $args{'struct'};
-	print "\n\n.. c:type:: " . $name . "\n\n";
+        my $name = $args{'type'} . " " . $args{'struct'};
+        print "\n\n.. c:type:: " . $name . "\n\n";
     } else {
-	my $name = $args{'struct'};
-	if ($args{'type'} eq 'union') {
-	    print "\n\n.. c:union:: " . $name . "\n\n";
-	} else {
-	    print "\n\n.. c:struct:: " . $name . "\n\n";
-	}
+        my $name = $args{'struct'};
+        if ($args{'type'} eq 'union') {
+            print "\n\n.. c:union:: " . $name . "\n\n";
+        } else {
+            print "\n\n.. c:struct:: " . $name . "\n\n";
+        }
     }
     print_lineno($declaration_start_line);
     $lineprefix = "  ";
@@ -1024,19 +1038,19 @@
     $lineprefix = "  ";
     print $lineprefix . "**Members**\n\n";
     foreach $parameter (@{$args{'parameterlist'}}) {
-	($parameter =~ /^#/) && next;
+        ($parameter =~ /^#/) && next;
 
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
+        my $parameter_name = $parameter;
+        $parameter_name =~ s/\[.*//;
 
-	($args{'parameterdescs'}{$parameter_name} ne $undescribed) || next;
-	$type = $args{'parametertypes'}{$parameter};
+        ($args{'parameterdescs'}{$parameter_name} ne $undescribed) || next;
+        $type = $args{'parametertypes'}{$parameter};
         print_lineno($parameterdesc_start_lines{$parameter_name});
-	print $lineprefix . "``" . $parameter . "``\n";
-	$lineprefix = "    ";
-	output_highlight_rst($args{'parameterdescs'}{$parameter_name});
-	$lineprefix = "  ";
-	print "\n";
+        print $lineprefix . "``" . $parameter . "``\n";
+        $lineprefix = "    ";
+        output_highlight_rst($args{'parameterdescs'}{$parameter_name});
+        $lineprefix = "  ";
+        print "\n";
     }
     print "\n";
 
@@ -1074,14 +1088,14 @@
     return if (defined($nosymbol_table{$name}));
 
     if (($output_selection == OUTPUT_ALL) ||
-	(($output_selection == OUTPUT_INCLUDE ||
-	  $output_selection == OUTPUT_EXPORTED) &&
-	 defined($function_table{$name})) ||
-	($output_selection == OUTPUT_INTERNAL &&
-	 !($functype eq "function" && defined($function_table{$name}))))
+        (($output_selection == OUTPUT_INCLUDE ||
+          $output_selection == OUTPUT_EXPORTED) &&
+         defined($function_table{$name})) ||
+        ($output_selection == OUTPUT_INTERNAL &&
+         !($functype eq "function" && defined($function_table{$name}))))
     {
-	&$func(@_);
-	$section_counter++;
+        &$func(@_);
+        $section_counter++;
     }
 }
 
@@ -1120,203 +1134,203 @@
     my $struct_members = qr{($type)([^\{\};]+)\{([^\{\}]*)\}([^\{\}\;]*)\;};
 
     if ($x =~ /($type)\s+(\w+)\s*$definition_body/) {
-	$decl_type = $1;
-	$declaration_name = $2;
-	$members = $3;
+        $decl_type = $1;
+        $declaration_name = $2;
+        $members = $3;
     } elsif ($x =~ /typedef\s+($type)\s*$definition_body\s*(\w+)\s*;/) {
-	$decl_type = $1;
-	$declaration_name = $3;
-	$members = $2;
+        $decl_type = $1;
+        $declaration_name = $3;
+        $members = $2;
     }
 
     if ($members) {
-	if ($identifier ne $declaration_name) {
-	    emit_warning("${file}:$.", "expecting prototype for $decl_type $identifier. Prototype was for $decl_type $declaration_name instead\n");
-	    return;
-	}
+        if ($identifier ne $declaration_name) {
+            emit_warning("${file}:$.", "expecting prototype for $decl_type $identifier. Prototype was for $decl_type $declaration_name instead\n");
+            return;
+        }
 
-	# ignore members marked private:
-	$members =~ s/\/\*\s*private:.*?\/\*\s*public:.*?\*\///gosi;
-	$members =~ s/\/\*\s*private:.*//gosi;
-	# strip comments:
-	$members =~ s/\/\*.*?\*\///gos;
-	# strip attributes
-	$members =~ s/\s*$attribute/ /gi;
-	$members =~ s/\s*__aligned\s*\([^;]*\)/ /gos;
-	$members =~ s/\s*__counted_by\s*\([^;]*\)/ /gos;
-	$members =~ s/\s*__packed\s*/ /gos;
-	$members =~ s/\s*CRYPTO_MINALIGN_ATTR/ /gos;
-	$members =~ s/\s*____cacheline_aligned_in_smp/ /gos;
-	$members =~ s/\s*____cacheline_aligned/ /gos;
-	# unwrap struct_group():
-	# - first eat non-declaration parameters and rewrite for final match
-	# - then remove macro, outer parens, and trailing semicolon
-	$members =~ s/\bstruct_group\s*\(([^,]*,)/STRUCT_GROUP(/gos;
-	$members =~ s/\bstruct_group_(attr|tagged)\s*\(([^,]*,){2}/STRUCT_GROUP(/gos;
-	$members =~ s/\b__struct_group\s*\(([^,]*,){3}/STRUCT_GROUP(/gos;
-	$members =~ s/\bSTRUCT_GROUP(\(((?:(?>[^)(]+)|(?1))*)\))[^;]*;/$2/gos;
-
-	my $args = qr{([^,)]+)};
-	# replace DECLARE_BITMAP
-	$members =~ s/__ETHTOOL_DECLARE_LINK_MODE_MASK\s*\(([^\)]+)\)/DECLARE_BITMAP($1, __ETHTOOL_LINK_MODE_MASK_NBITS)/gos;
-	$members =~ s/DECLARE_PHY_INTERFACE_MASK\s*\(([^\)]+)\)/DECLARE_BITMAP($1, PHY_INTERFACE_MODE_MAX)/gos;
-	$members =~ s/DECLARE_BITMAP\s*\($args,\s*$args\)/unsigned long $1\[BITS_TO_LONGS($2)\]/gos;
-	# replace DECLARE_HASHTABLE
-	$members =~ s/DECLARE_HASHTABLE\s*\($args,\s*$args\)/unsigned long $1\[1 << (($2) - 1)\]/gos;
-	# replace DECLARE_KFIFO
-	$members =~ s/DECLARE_KFIFO\s*\($args,\s*$args,\s*$args\)/$2 \*$1/gos;
-	# replace DECLARE_KFIFO_PTR
-	$members =~ s/DECLARE_KFIFO_PTR\s*\($args,\s*$args\)/$2 \*$1/gos;
-	# replace DECLARE_FLEX_ARRAY
-	$members =~ s/(?:__)?DECLARE_FLEX_ARRAY\s*\($args,\s*$args\)/$1 $2\[\]/gos;
-	#replace DEFINE_DMA_UNMAP_ADDR
-	$members =~ s/DEFINE_DMA_UNMAP_ADDR\s*\($args\)/dma_addr_t $1/gos;
-	#replace DEFINE_DMA_UNMAP_LEN
-	$members =~ s/DEFINE_DMA_UNMAP_LEN\s*\($args\)/__u32 $1/gos;
-	my $declaration = $members;
-
-	# Split nested struct/union elements as newer ones
-	while ($members =~ m/$struct_members/) {
-		my $newmember;
-		my $maintype = $1;
-		my $ids = $4;
-		my $content = $3;
-		foreach my $id(split /,/, $ids) {
-			$newmember .= "$maintype $id; ";
-
-			$id =~ s/[:\[].*//;
-			$id =~ s/^\s*\**(\S+)\s*/$1/;
-			foreach my $arg (split /;/, $content) {
-				next if ($arg =~ m/^\s*$/);
-				if ($arg =~ m/^([^\(]+\(\*?\s*)([\w\.]*)(\s*\).*)/) {
-					# pointer-to-function
-					my $type = $1;
-					my $name = $2;
-					my $extra = $3;
-					next if (!$name);
-					if ($id =~ m/^\s*$/) {
-						# anonymous struct/union
-						$newmember .= "$type$name$extra; ";
-					} else {
-						$newmember .= "$type$id.$name$extra; ";
-					}
-				} else {
-					my $type;
-					my $names;
-					$arg =~ s/^\s+//;
-					$arg =~ s/\s+$//;
-					# Handle bitmaps
-					$arg =~ s/:\s*\d+\s*//g;
-					# Handle arrays
-					$arg =~ s/\[.*\]//g;
-					# The type may have multiple words,
-					# and multiple IDs can be defined, like:
-					#	const struct foo, *bar, foobar
-					# So, we remove spaces when parsing the
-					# names, in order to match just names
-					# and commas for the names
-					$arg =~ s/\s*,\s*/,/g;
-					if ($arg =~ m/(.*)\s+([\S+,]+)/) {
-						$type = $1;
-						$names = $2;
-					} else {
-						$newmember .= "$arg; ";
-						next;
-					}
-					foreach my $name (split /,/, $names) {
-						$name =~ s/^\s*\**(\S+)\s*/$1/;
-						next if (($name =~ m/^\s*$/));
-						if ($id =~ m/^\s*$/) {
-							# anonymous struct/union
-							$newmember .= "$type $name; ";
-						} else {
-							$newmember .= "$type $id.$name; ";
-						}
-					}
-				}
-			}
-		}
-		$members =~ s/$struct_members/$newmember/;
-	}
+        # ignore members marked private:
+        $members =~ s/\/\*\s*private:.*?\/\*\s*public:.*?\*\///gosi;
+        $members =~ s/\/\*\s*private:.*//gosi;
+        # strip comments:
+        $members =~ s/\/\*.*?\*\///gos;
+        # strip attributes
+        $members =~ s/\s*$attribute/ /gi;
+        $members =~ s/\s*__aligned\s*\([^;]*\)/ /gos;
+        $members =~ s/\s*__counted_by\s*\([^;]*\)/ /gos;
+        $members =~ s/\s*__counted_by_(le|be)\s*\([^;]*\)/ /gos;
+        $members =~ s/\s*__packed\s*/ /gos;
+        $members =~ s/\s*CRYPTO_MINALIGN_ATTR/ /gos;
+        $members =~ s/\s*____cacheline_aligned_in_smp/ /gos;
+        $members =~ s/\s*____cacheline_aligned/ /gos;
+        # unwrap struct_group():
+        # - first eat non-declaration parameters and rewrite for final match
+        # - then remove macro, outer parens, and trailing semicolon
+        $members =~ s/\bstruct_group\s*\(([^,]*,)/STRUCT_GROUP(/gos;
+        $members =~ s/\bstruct_group_(attr|tagged)\s*\(([^,]*,){2}/STRUCT_GROUP(/gos;
+        $members =~ s/\b__struct_group\s*\(([^,]*,){3}/STRUCT_GROUP(/gos;
+        $members =~ s/\bSTRUCT_GROUP(\(((?:(?>[^)(]+)|(?1))*)\))[^;]*;/$2/gos;
+
+        my $args = qr{([^,)]+)};
+        # replace DECLARE_BITMAP
+        $members =~ s/__ETHTOOL_DECLARE_LINK_MODE_MASK\s*\(([^\)]+)\)/DECLARE_BITMAP($1, __ETHTOOL_LINK_MODE_MASK_NBITS)/gos;
+        $members =~ s/DECLARE_PHY_INTERFACE_MASK\s*\(([^\)]+)\)/DECLARE_BITMAP($1, PHY_INTERFACE_MODE_MAX)/gos;
+        $members =~ s/DECLARE_BITMAP\s*\($args,\s*$args\)/unsigned long $1\[BITS_TO_LONGS($2)\]/gos;
+        # replace DECLARE_HASHTABLE
+        $members =~ s/DECLARE_HASHTABLE\s*\($args,\s*$args\)/unsigned long $1\[1 << (($2) - 1)\]/gos;
+        # replace DECLARE_KFIFO
+        $members =~ s/DECLARE_KFIFO\s*\($args,\s*$args,\s*$args\)/$2 \*$1/gos;
+        # replace DECLARE_KFIFO_PTR
+        $members =~ s/DECLARE_KFIFO_PTR\s*\($args,\s*$args\)/$2 \*$1/gos;
+        # replace DECLARE_FLEX_ARRAY
+        $members =~ s/(?:__)?DECLARE_FLEX_ARRAY\s*\($args,\s*$args\)/$1 $2\[\]/gos;
+        #replace DEFINE_DMA_UNMAP_ADDR
+        $members =~ s/DEFINE_DMA_UNMAP_ADDR\s*\($args\)/dma_addr_t $1/gos;
+        #replace DEFINE_DMA_UNMAP_LEN
+        $members =~ s/DEFINE_DMA_UNMAP_LEN\s*\($args\)/__u32 $1/gos;
+        my $declaration = $members;
+
+        # Split nested struct/union elements as newer ones
+        while ($members =~ m/$struct_members/) {
+            my $newmember;
+            my $maintype = $1;
+            my $ids = $4;
+            my $content = $3;
+            foreach my $id(split /,/, $ids) {
+                $newmember .= "$maintype $id; ";
+
+                $id =~ s/[:\[].*//;
+                $id =~ s/^\s*\**(\S+)\s*/$1/;
+                foreach my $arg (split /;/, $content) {
+                    next if ($arg =~ m/^\s*$/);
+                    if ($arg =~ m/^([^\(]+\(\*?\s*)([\w\.]*)(\s*\).*)/) {
+                        # pointer-to-function
+                        my $type = $1;
+                        my $name = $2;
+                        my $extra = $3;
+                        next if (!$name);
+                        if ($id =~ m/^\s*$/) {
+                            # anonymous struct/union
+                            $newmember .= "$type$name$extra; ";
+                        } else {
+                            $newmember .= "$type$id.$name$extra; ";
+                        }
+                    } else {
+                        my $type;
+                        my $names;
+                        $arg =~ s/^\s+//;
+                        $arg =~ s/\s+$//;
+                        # Handle bitmaps
+                        $arg =~ s/:\s*\d+\s*//g;
+                        # Handle arrays
+                        $arg =~ s/\[.*\]//g;
+                        # The type may have multiple words,
+                        # and multiple IDs can be defined, like:
+                        #    const struct foo, *bar, foobar
+                        # So, we remove spaces when parsing the
+                        # names, in order to match just names
+                        # and commas for the names
+                        $arg =~ s/\s*,\s*/,/g;
+                        if ($arg =~ m/(.*)\s+([\S+,]+)/) {
+                            $type = $1;
+                            $names = $2;
+                        } else {
+                            $newmember .= "$arg; ";
+                            next;
+                        }
+                        foreach my $name (split /,/, $names) {
+                            $name =~ s/^\s*\**(\S+)\s*/$1/;
+                            next if (($name =~ m/^\s*$/));
+                            if ($id =~ m/^\s*$/) {
+                                # anonymous struct/union
+                                $newmember .= "$type $name; ";
+                            } else {
+                                $newmember .= "$type $id.$name; ";
+                            }
+                        }
+                    }
+                }
+            }
+            $members =~ s/$struct_members/$newmember/;
+        }
 
-	# Ignore other nested elements, like enums
-	$members =~ s/(\{[^\{\}]*\})//g;
+        # Ignore other nested elements, like enums
+        $members =~ s/(\{[^\{\}]*\})//g;
 
-	create_parameterlist($members, ';', $file, $declaration_name);
-	check_sections($file, $declaration_name, $decl_type, $sectcheck, $struct_actual);
+        create_parameterlist($members, ';', $file, $declaration_name);
+        check_sections($file, $declaration_name, $decl_type, $sectcheck, $struct_actual);
 
-	# Adjust declaration for better display
-	$declaration =~ s/([\{;])/$1\n/g;
-	$declaration =~ s/\}\s+;/};/g;
-	# Better handle inlined enums
-	do {} while ($declaration =~ s/(enum\s+\{[^\}]+),([^\n])/$1,\n$2/);
-
-	my @def_args = split /\n/, $declaration;
-	my $level = 1;
-	$declaration = "";
-	foreach my $clause (@def_args) {
-		$clause =~ s/^\s+//;
-		$clause =~ s/\s+$//;
-		$clause =~ s/\s+/ /;
-		next if (!$clause);
-		$level-- if ($clause =~ m/(\})/ && $level > 1);
-		if (!($clause =~ m/^\s*#/)) {
-			$declaration .= "\t" x $level;
-		}
-		$declaration .= "\t" . $clause . "\n";
-		$level++ if ($clause =~ m/(\{)/ && !($clause =~m/\}/));
-	}
-	output_declaration($declaration_name,
-			   'struct',
-			   {'struct' => $declaration_name,
-			    'module' => $modulename,
-			    'definition' => $declaration,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'parametertypes' => \%parametertypes,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose,
-			    'type' => $decl_type
-			   });
-    }
-    else {
-	print STDERR "${file}:$.: error: Cannot parse struct or union!\n";
-	++$errors;
+        # Adjust declaration for better display
+        $declaration =~ s/([\{;])/$1\n/g;
+        $declaration =~ s/\}\s+;/};/g;
+        # Better handle inlined enums
+        do {} while ($declaration =~ s/(enum\s+\{[^\}]+),([^\n])/$1,\n$2/);
+
+        my @def_args = split /\n/, $declaration;
+        my $level = 1;
+        $declaration = "";
+        foreach my $clause (@def_args) {
+            $clause =~ s/^\s+//;
+            $clause =~ s/\s+$//;
+            $clause =~ s/\s+/ /;
+            next if (!$clause);
+            $level-- if ($clause =~ m/(\})/ && $level > 1);
+            if (!($clause =~ m/^\s*#/)) {
+                $declaration .= "\t" x $level;
+            }
+            $declaration .= "\t" . $clause . "\n";
+            $level++ if ($clause =~ m/(\{)/ && !($clause =~m/\}/));
+        }
+        output_declaration($declaration_name,
+                   'struct',
+                   {'struct' => $declaration_name,
+                    'module' => $modulename,
+                    'definition' => $declaration,
+                    'parameterlist' => \@parameterlist,
+                    'parameterdescs' => \%parameterdescs,
+                    'parametertypes' => \%parametertypes,
+                    'sectionlist' => \@sectionlist,
+                    'sections' => \%sections,
+                    'purpose' => $declaration_purpose,
+                    'type' => $decl_type
+                   });
+    } else {
+        print STDERR "${file}:$.: error: Cannot parse struct or union!\n";
+        ++$errors;
     }
 }
 
 
 sub show_warnings($$) {
-	my $functype = shift;
-	my $name = shift;
+    my $functype = shift;
+    my $name = shift;
 
-	return 0 if (defined($nosymbol_table{$name}));
+    return 0 if (defined($nosymbol_table{$name}));
 
-	return 1 if ($output_selection == OUTPUT_ALL);
+    return 1 if ($output_selection == OUTPUT_ALL);
 
-	if ($output_selection == OUTPUT_EXPORTED) {
-		if (defined($function_table{$name})) {
-			return 1;
-		} else {
-			return 0;
-		}
-	}
-        if ($output_selection == OUTPUT_INTERNAL) {
-		if (!($functype eq "function" && defined($function_table{$name}))) {
-			return 1;
-		} else {
-			return 0;
-		}
-	}
-	if ($output_selection == OUTPUT_INCLUDE) {
-		if (defined($function_table{$name})) {
-			return 1;
-		} else {
-			return 0;
-		}
-	}
-	die("Please add the new output type at show_warnings()");
+    if ($output_selection == OUTPUT_EXPORTED) {
+        if (defined($function_table{$name})) {
+            return 1;
+        } else {
+            return 0;
+        }
+    }
+    if ($output_selection == OUTPUT_INTERNAL) {
+        if (!($functype eq "function" && defined($function_table{$name}))) {
+            return 1;
+        } else {
+            return 0;
+        }
+    }
+    if ($output_selection == OUTPUT_INCLUDE) {
+        if (defined($function_table{$name})) {
+            return 1;
+        } else {
+            return 0;
+        }
+    }
+    die("Please add the new output type at show_warnings()");
 }
 
 sub dump_enum($$) {
@@ -1333,62 +1347,62 @@
     $x =~ s@#\s*((define|ifdef)\s+|endif)[^;]*;@@gos;
 
     if ($x =~ /typedef\s+enum\s*\{(.*)\}\s*(\w*)\s*;/) {
-	$declaration_name = $2;
-	$members = $1;
+        $declaration_name = $2;
+        $members = $1;
     } elsif ($x =~ /enum\s+(\w*)\s*\{(.*)\}/) {
-	$declaration_name = $1;
-	$members = $2;
+        $declaration_name = $1;
+        $members = $2;
     }
 
     if ($members) {
-	if ($identifier ne $declaration_name) {
-	    if ($identifier eq "") {
-		emit_warning("${file}:$.", "wrong kernel-doc identifier on line:\n");
-	    } else {
-		emit_warning("${file}:$.", "expecting prototype for enum $identifier. Prototype was for enum $declaration_name instead\n");
-	    }
-	    return;
-	}
-	$declaration_name = "(anonymous)" if ($declaration_name eq "");
+        if ($identifier ne $declaration_name) {
+            if ($identifier eq "") {
+                emit_warning("${file}:$.", "wrong kernel-doc identifier on line:\n");
+            } else {
+                emit_warning("${file}:$.", "expecting prototype for enum $identifier. Prototype was for enum $declaration_name instead\n");
+            }
+            return;
+        }
+        $declaration_name = "(anonymous)" if ($declaration_name eq "");
 
-	my %_members;
+        my %_members;
 
-	$members =~ s/\s+$//;
-	$members =~ s/\([^;]*?[\)]//g;
+        $members =~ s/\s+$//;
+        $members =~ s/\([^;]*?[\)]//g;
 
-	foreach my $arg (split ',', $members) {
-	    $arg =~ s/^\s*(\w+).*/$1/;
-	    push @parameterlist, $arg;
-	    if (!$parameterdescs{$arg}) {
-		$parameterdescs{$arg} = $undescribed;
-	        if (show_warnings("enum", $declaration_name)) {
-			emit_warning("${file}:$.", "Enum value '$arg' not described in enum '$declaration_name'\n");
-		}
-	    }
-	    $_members{$arg} = 1;
-	}
+        foreach my $arg (split ',', $members) {
+            $arg =~ s/^\s*(\w+).*/$1/;
+            push @parameterlist, $arg;
+            if (!$parameterdescs{$arg}) {
+                $parameterdescs{$arg} = $undescribed;
+                if (show_warnings("enum", $declaration_name)) {
+                    emit_warning("${file}:$.", "Enum value '$arg' not described in enum '$declaration_name'\n");
+                }
+            }
+            $_members{$arg} = 1;
+        }
 
-	while (my ($k, $v) = each %parameterdescs) {
-	    if (!exists($_members{$k})) {
-	        if (show_warnings("enum", $declaration_name)) {
-		     emit_warning("${file}:$.", "Excess enum value '$k' description in '$declaration_name'\n");
-		}
-	    }
+        while (my ($k, $v) = each %parameterdescs) {
+            if (!exists($_members{$k})) {
+                if (show_warnings("enum", $declaration_name)) {
+                    emit_warning("${file}:$.", "Excess enum value '$k' description in '$declaration_name'\n");
+                }
+            }
         }
 
-	output_declaration($declaration_name,
-			   'enum',
-			   {'enum' => $declaration_name,
-			    'module' => $modulename,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
+        output_declaration($declaration_name,
+                           'enum',
+                           {'enum' => $declaration_name,
+                            'module' => $modulename,
+                            'parameterlist' => \@parameterlist,
+                            'parameterdescs' => \%parameterdescs,
+                            'sectionlist' => \@sectionlist,
+                            'sections' => \%sections,
+                            'purpose' => $declaration_purpose
+                           });
     } else {
-	print STDERR "${file}:$.: error: Cannot parse enum!\n";
-	++$errors;
+        print STDERR "${file}:$.: error: Cannot parse enum!\n";
+        ++$errors;
     }
 }
 
@@ -1407,59 +1421,58 @@
 
     # Parse function typedef prototypes
     if ($x =~ $typedef1 || $x =~ $typedef2) {
-	$return_type = $1;
-	$declaration_name = $2;
-	my $args = $3;
-	$return_type =~ s/^\s+//;
-
-	if ($identifier ne $declaration_name) {
-	    emit_warning("${file}:$.", "expecting prototype for typedef $identifier. Prototype was for typedef $declaration_name instead\n");
-	    return;
-	}
+        $return_type = $1;
+        $declaration_name = $2;
+        my $args = $3;
+        $return_type =~ s/^\s+//;
+
+        if ($identifier ne $declaration_name) {
+            emit_warning("${file}:$.", "expecting prototype for typedef $identifier. Prototype was for typedef $declaration_name instead\n");
+            return;
+        }
 
-	create_parameterlist($args, ',', $file, $declaration_name);
+        create_parameterlist($args, ',', $file, $declaration_name);
 
-	output_declaration($declaration_name,
-			   'function',
-			   {'function' => $declaration_name,
-			    'typedef' => 1,
-			    'module' => $modulename,
-			    'functiontype' => $return_type,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'parametertypes' => \%parametertypes,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
-	return;
+        output_declaration($declaration_name,
+                           'function',
+                           {'function' => $declaration_name,
+                            'typedef' => 1,
+                            'module' => $modulename,
+                            'functiontype' => $return_type,
+                            'parameterlist' => \@parameterlist,
+                            'parameterdescs' => \%parameterdescs,
+                            'parametertypes' => \%parametertypes,
+                            'sectionlist' => \@sectionlist,
+                            'sections' => \%sections,
+                            'purpose' => $declaration_purpose
+                           });
+        return;
     }
 
     while (($x =~ /\(*.\)\s*;$/) || ($x =~ /\[*.\]\s*;$/)) {
-	$x =~ s/\(*.\)\s*;$/;/;
-	$x =~ s/\[*.\]\s*;$/;/;
+        $x =~ s/\(*.\)\s*;$/;/;
+        $x =~ s/\[*.\]\s*;$/;/;
     }
 
     if ($x =~ /typedef.*\s+(\w+)\s*;/) {
-	$declaration_name = $1;
+        $declaration_name = $1;
 
-	if ($identifier ne $declaration_name) {
-	    emit_warning("${file}:$.", "expecting prototype for typedef $identifier. Prototype was for typedef $declaration_name instead\n");
-	    return;
-	}
+        if ($identifier ne $declaration_name) {
+            emit_warning("${file}:$.", "expecting prototype for typedef $identifier. Prototype was for typedef $declaration_name instead\n");
+            return;
+        }
 
-	output_declaration($declaration_name,
-			   'typedef',
-			   {'typedef' => $declaration_name,
-			    'module' => $modulename,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
-    }
-    else {
-	print STDERR "${file}:$.: error: Cannot parse typedef!\n";
-	++$errors;
+        output_declaration($declaration_name,
+                           'typedef',
+                           {'typedef' => $declaration_name,
+                            'module' => $modulename,
+                            'sectionlist' => \@sectionlist,
+                            'sections' => \%sections,
+                            'purpose' => $declaration_purpose
+                           });
+    } else {
+        print STDERR "${file}:$.: error: Cannot parse typedef!\n";
+        ++$errors;
     }
 }
 
@@ -1482,214 +1495,211 @@
     # temporarily replace commas inside function pointer definition
     my $arg_expr = qr{\([^\),]+};
     while ($args =~ /$arg_expr,/) {
-	$args =~ s/($arg_expr),/$1#/g;
+        $args =~ s/($arg_expr),/$1#/g;
     }
 
     foreach my $arg (split($splitter, $args)) {
-	# strip comments
-	$arg =~ s/\/\*.*\*\///;
-	# ignore argument attributes
-	$arg =~ s/\sPOS0?\s/ /;
-	# strip leading/trailing spaces
-	$arg =~ s/^\s*//;
-	$arg =~ s/\s*$//;
-	$arg =~ s/\s+/ /;
-
-	if ($arg =~ /^#/) {
-	    # Treat preprocessor directive as a typeless variable just to fill
-	    # corresponding data structures "correctly". Catch it later in
-	    # output_* subs.
-	    push_parameter($arg, "", "", $file);
-	} elsif ($arg =~ m/\(.+\)\s*\(/) {
-	    # pointer-to-function
-	    $arg =~ tr/#/,/;
-	    $arg =~ m/[^\(]+\(\*?\s*([\w\[\]\.]*)\s*\)/;
-	    $param = $1;
-	    $type = $arg;
-	    $type =~ s/([^\(]+\(\*?)\s*$param/$1/;
-	    save_struct_actual($param);
-	    push_parameter($param, $type, $arg, $file, $declaration_name);
-	} elsif ($arg) {
-	    $arg =~ s/\s*:\s*/:/g;
-	    $arg =~ s/\s*\[/\[/g;
-
-	    my @args = split('\s*,\s*', $arg);
-	    if ($args[0] =~ m/\*/) {
-		$args[0] =~ s/(\*+)\s*/ $1/;
-	    }
-
-	    my @first_arg;
-	    if ($args[0] =~ /^(.*\s+)(.*?\[.*\].*)$/) {
-		    shift @args;
-		    push(@first_arg, split('\s+', $1));
-		    push(@first_arg, $2);
-	    } else {
-		    @first_arg = split('\s+', shift @args);
-	    }
-
-	    unshift(@args, pop @first_arg);
-	    $type = join " ", @first_arg;
-
-	    foreach $param (@args) {
-		if ($param =~ m/^(\*+)\s*(.*)/) {
-		    save_struct_actual($2);
+        # strip comments
+        $arg =~ s/\/\*.*\*\///;
+        # ignore argument attributes
+        $arg =~ s/\sPOS0?\s/ /;
+        # strip leading/trailing spaces
+        $arg =~ s/^\s*//;
+        $arg =~ s/\s*$//;
+        $arg =~ s/\s+/ /;
+
+        if ($arg =~ /^#/) {
+            # Treat preprocessor directive as a typeless variable just to fill
+            # corresponding data structures "correctly". Catch it later in
+            # output_* subs.
+            push_parameter($arg, "", "", $file);
+        } elsif ($arg =~ m/\(.+\)\s*\(/) {
+            # pointer-to-function
+            $arg =~ tr/#/,/;
+            $arg =~ m/[^\(]+\(\*?\s*([\w\[\]\.]*)\s*\)/;
+            $param = $1;
+            $type = $arg;
+            $type =~ s/([^\(]+\(\*?)\s*$param/$1/;
+            save_struct_actual($param);
+            push_parameter($param, $type, $arg, $file, $declaration_name);
+        } elsif ($arg) {
+            $arg =~ s/\s*:\s*/:/g;
+            $arg =~ s/\s*\[/\[/g;
+
+            my @args = split('\s*,\s*', $arg);
+            if ($args[0] =~ m/\*/) {
+                $args[0] =~ s/(\*+)\s*/ $1/;
+            }
 
-		    push_parameter($2, "$type $1", $arg, $file, $declaration_name);
-		}
-		elsif ($param =~ m/(.*?):(\d+)/) {
-		    if ($type ne "") { # skip unnamed bit-fields
-			save_struct_actual($1);
-			push_parameter($1, "$type:$2", $arg, $file, $declaration_name)
-		    }
-		}
-		else {
-		    save_struct_actual($param);
-		    push_parameter($param, $type, $arg, $file, $declaration_name);
-		}
-	    }
-	}
+            my @first_arg;
+            if ($args[0] =~ /^(.*\s+)(.*?\[.*\].*)$/) {
+                shift @args;
+                push(@first_arg, split('\s+', $1));
+                push(@first_arg, $2);
+            } else {
+                @first_arg = split('\s+', shift @args);
+            }
+
+            unshift(@args, pop @first_arg);
+            $type = join " ", @first_arg;
+
+            foreach $param (@args) {
+                if ($param =~ m/^(\*+)\s*(.*)/) {
+                    save_struct_actual($2);
+
+                    push_parameter($2, "$type $1", $arg, $file, $declaration_name);
+                } elsif ($param =~ m/(.*?):(\d+)/) {
+                    if ($type ne "") { # skip unnamed bit-fields
+                        save_struct_actual($1);
+                        push_parameter($1, "$type:$2", $arg, $file, $declaration_name)
+                    }
+                } else {
+                    save_struct_actual($param);
+                    push_parameter($param, $type, $arg, $file, $declaration_name);
+                }
+            }
+        }
     }
 }
 
 sub push_parameter($$$$$) {
-	my $param = shift;
-	my $type = shift;
-	my $org_arg = shift;
-	my $file = shift;
-	my $declaration_name = shift;
-
-	if (($anon_struct_union == 1) && ($type eq "") &&
-	    ($param eq "}")) {
-		return;		# ignore the ending }; from anon. struct/union
-	}
+    my $param = shift;
+    my $type = shift;
+    my $org_arg = shift;
+    my $file = shift;
+    my $declaration_name = shift;
 
-	$anon_struct_union = 0;
-	$param =~ s/[\[\)].*//;
+    if (($anon_struct_union == 1) && ($type eq "") &&
+        ($param eq "}")) {
+        return;        # ignore the ending }; from anon. struct/union
+    }
 
-	if ($type eq "" && $param =~ /\.\.\.$/)
-	{
-	    if (!$param =~ /\w\.\.\.$/) {
-	      # handles unnamed variable parameters
-	      $param = "...";
-	    }
-	    elsif ($param =~ /\w\.\.\.$/) {
-	      # for named variable parameters of the form `x...`, remove the dots
-	      $param =~ s/\.\.\.$//;
-	    }
-	    if (!defined $parameterdescs{$param} || $parameterdescs{$param} eq "") {
-		$parameterdescs{$param} = "variable arguments";
-	    }
-	}
-	elsif ($type eq "" && ($param eq "" or $param eq "void"))
-	{
-	    $param="void";
-	    $parameterdescs{void} = "no arguments";
-	}
-	elsif ($type eq "" && ($param eq "struct" or $param eq "union"))
-	# handle unnamed (anonymous) union or struct:
-	{
-		$type = $param;
-		$param = "{unnamed_" . $param . "}";
-		$parameterdescs{$param} = "anonymous\n";
-		$anon_struct_union = 1;
-	}
-	elsif ($param =~ "__cacheline_group" )
-	# handle cache group enforcing variables: they do not need be described in header files
-	{
-		return; # ignore __cacheline_group_begin and __cacheline_group_end
-	}
+    $anon_struct_union = 0;
+    $param =~ s/[\[\)].*//;
 
-	# warn if parameter has no description
-	# (but ignore ones starting with # as these are not parameters
-	# but inline preprocessor statements);
-	# Note: It will also ignore void params and unnamed structs/unions
-	if (!defined $parameterdescs{$param} && $param !~ /^#/) {
-		$parameterdescs{$param} = $undescribed;
+    if ($type eq "" && $param =~ /\.\.\.$/)
+    {
+        if (!$param =~ /\w\.\.\.$/) {
+            # handles unnamed variable parameters
+            $param = "...";
+        } elsif ($param =~ /\w\.\.\.$/) {
+            # for named variable parameters of the form `x...`, remove the dots
+            $param =~ s/\.\.\.$//;
+        }
+        if (!defined $parameterdescs{$param} || $parameterdescs{$param} eq "") {
+            $parameterdescs{$param} = "variable arguments";
+        }
+    }
+    elsif ($type eq "" && ($param eq "" or $param eq "void"))
+    {
+        $param="void";
+        $parameterdescs{void} = "no arguments";
+    }
+    elsif ($type eq "" && ($param eq "struct" or $param eq "union"))
+    # handle unnamed (anonymous) union or struct:
+    {
+        $type = $param;
+        $param = "{unnamed_" . $param . "}";
+        $parameterdescs{$param} = "anonymous\n";
+        $anon_struct_union = 1;
+    }
+    elsif ($param =~ "__cacheline_group" )
+    # handle cache group enforcing variables: they do not need be described in header files
+    {
+        return; # ignore __cacheline_group_begin and __cacheline_group_end
+    }
 
-	        if (show_warnings($type, $declaration_name) && $param !~ /\./) {
-			emit_warning("${file}:$.", "Function parameter or struct member '$param' not described in '$declaration_name'\n");
-		}
-	}
+    # warn if parameter has no description
+    # (but ignore ones starting with # as these are not parameters
+    # but inline preprocessor statements);
+    # Note: It will also ignore void params and unnamed structs/unions
+    if (!defined $parameterdescs{$param} && $param !~ /^#/) {
+        $parameterdescs{$param} = $undescribed;
 
-	# strip spaces from $param so that it is one continuous string
-	# on @parameterlist;
-	# this fixes a problem where check_sections() cannot find
-	# a parameter like "addr[6 + 2]" because it actually appears
-	# as "addr[6", "+", "2]" on the parameter list;
-	# but it's better to maintain the param string unchanged for output,
-	# so just weaken the string compare in check_sections() to ignore
-	# "[blah" in a parameter string;
-	###$param =~ s/\s*//g;
-	push @parameterlist, $param;
-	$org_arg =~ s/\s\s+/ /g;
-	$parametertypes{$param} = $org_arg;
+        if (show_warnings($type, $declaration_name) && $param !~ /\./) {
+            emit_warning("${file}:$.", "Function parameter or struct member '$param' not described in '$declaration_name'\n");
+        }
+    }
+
+    # strip spaces from $param so that it is one continuous string
+    # on @parameterlist;
+    # this fixes a problem where check_sections() cannot find
+    # a parameter like "addr[6 + 2]" because it actually appears
+    # as "addr[6", "+", "2]" on the parameter list;
+    # but it's better to maintain the param string unchanged for output,
+    # so just weaken the string compare in check_sections() to ignore
+    # "[blah" in a parameter string;
+    ###$param =~ s/\s*//g;
+    push @parameterlist, $param;
+    $org_arg =~ s/\s\s+/ /g;
+    $parametertypes{$param} = $org_arg;
 }
 
 sub check_sections($$$$$) {
-	my ($file, $decl_name, $decl_type, $sectcheck, $prmscheck) = @_;
-	my @sects = split ' ', $sectcheck;
-	my @prms = split ' ', $prmscheck;
-	my $err;
-	my ($px, $sx);
-	my $prm_clean;		# strip trailing "[array size]" and/or beginning "*"
-
-	foreach $sx (0 .. $#sects) {
-		$err = 1;
-		foreach $px (0 .. $#prms) {
-			$prm_clean = $prms[$px];
-			$prm_clean =~ s/\[.*\]//;
-			$prm_clean =~ s/$attribute//i;
-			# ignore array size in a parameter string;
-			# however, the original param string may contain
-			# spaces, e.g.:  addr[6 + 2]
-			# and this appears in @prms as "addr[6" since the
-			# parameter list is split at spaces;
-			# hence just ignore "[..." for the sections check;
-			$prm_clean =~ s/\[.*//;
-
-			##$prm_clean =~ s/^\**//;
-			if ($prm_clean eq $sects[$sx]) {
-				$err = 0;
-				last;
-			}
-		}
-		if ($err) {
-			if ($decl_type eq "function") {
-				emit_warning("${file}:$.",
-					"Excess function parameter " .
-					"'$sects[$sx]' " .
-					"description in '$decl_name'\n");
-			}
-			elsif (($decl_type eq "struct") or
-		       	       ($decl_type eq "union")) {
-				emit_warning("${file}:$.",
-					"Excess $decl_type member " .
-					"'$sects[$sx]' " .
-					"description in '$decl_name'\n");
-			}
-		}
-	}
+    my ($file, $decl_name, $decl_type, $sectcheck, $prmscheck) = @_;
+    my @sects = split ' ', $sectcheck;
+    my @prms = split ' ', $prmscheck;
+    my $err;
+    my ($px, $sx);
+    my $prm_clean;        # strip trailing "[array size]" and/or beginning "*"
+
+    foreach $sx (0 .. $#sects) {
+        $err = 1;
+        foreach $px (0 .. $#prms) {
+            $prm_clean = $prms[$px];
+            $prm_clean =~ s/\[.*\]//;
+            $prm_clean =~ s/$attribute//i;
+            # ignore array size in a parameter string;
+            # however, the original param string may contain
+            # spaces, e.g.:  addr[6 + 2]
+            # and this appears in @prms as "addr[6" since the
+            # parameter list is split at spaces;
+            # hence just ignore "[..." for the sections check;
+            $prm_clean =~ s/\[.*//;
+
+            ##$prm_clean =~ s/^\**//;
+            if ($prm_clean eq $sects[$sx]) {
+                $err = 0;
+                last;
+            }
+        }
+        if ($err) {
+            if ($decl_type eq "function") {
+                emit_warning("${file}:$.",
+                    "Excess function parameter " .
+                    "'$sects[$sx]' " .
+                    "description in '$decl_name'\n");
+            } elsif (($decl_type eq "struct") or
+                          ($decl_type eq "union")) {
+                emit_warning("${file}:$.",
+                    "Excess $decl_type member " .
+                    "'$sects[$sx]' " .
+                    "description in '$decl_name'\n");
+            }
+        }
+    }
 }
 
 ##
 # Checks the section describing the return value of a function.
 sub check_return_section {
-        my $file = shift;
-        my $declaration_name = shift;
-        my $return_type = shift;
-
-        # Ignore an empty return type (It's a macro)
-        # Ignore functions with a "void" return type. (But don't ignore "void *")
-        if (($return_type eq "") || ($return_type =~ /void\s*\w*\s*$/)) {
-                return;
-        }
+    my $file = shift;
+    my $declaration_name = shift;
+    my $return_type = shift;
 
-        if (!defined($sections{$section_return}) ||
-            $sections{$section_return} eq "") {
-                emit_warning("${file}:$.",
-                        "No description found for return value of " .
-                        "'$declaration_name'\n");
-        }
+    # Ignore an empty return type (It's a macro)
+    # Ignore functions with a "void" return type. (But don't ignore "void *")
+    if (($return_type eq "") || ($return_type =~ /void\s*\w*\s*$/)) {
+        return;
+    }
+
+    if (!defined($sections{$section_return}) ||
+        $sections{$section_return} eq "")
+    {
+        emit_warning("${file}:$.",
+                     "No description found for return value of " .
+                     "'$declaration_name'\n");
+    }
 }
 
 ##
@@ -1699,7 +1709,7 @@
 sub dump_function($$) {
     my $prototype = shift;
     my $file = shift;
-    my $noret = 0;
+    my $func_macro = 0;
 
     print_lineno($new_start_line);
 
@@ -1762,23 +1772,23 @@
         # declaration_name and opening parenthesis (notice the \s+).
         $return_type = $1;
         $declaration_name = $2;
-        $noret = 1;
+        $func_macro = 1;
     } elsif ($prototype =~ m/^()($name)\s*$prototype_end/ ||
-	$prototype =~ m/^($type1)\s+($name)\s*$prototype_end/ ||
-	$prototype =~ m/^($type2+)\s*($name)\s*$prototype_end/)  {
-	$return_type = $1;
-	$declaration_name = $2;
-	my $args = $3;
+        $prototype =~ m/^($type1)\s+($name)\s*$prototype_end/ ||
+        $prototype =~ m/^($type2+)\s*($name)\s*$prototype_end/)  {
+        $return_type = $1;
+        $declaration_name = $2;
+        my $args = $3;
 
-	create_parameterlist($args, ',', $file, $declaration_name);
+        create_parameterlist($args, ',', $file, $declaration_name);
     } else {
-	emit_warning("${file}:$.", "cannot understand function prototype: '$prototype'\n");
-	return;
+        emit_warning("${file}:$.", "cannot understand function prototype: '$prototype'\n");
+        return;
     }
 
     if ($identifier ne $declaration_name) {
-	emit_warning("${file}:$.", "expecting prototype for $identifier(). Prototype was for $declaration_name() instead\n");
-	return;
+        emit_warning("${file}:$.", "expecting prototype for $identifier(). Prototype was for $declaration_name() instead\n");
+        return;
     }
 
     my $prms = join " ", @parameterlist;
@@ -1789,39 +1799,41 @@
     # of warnings goes sufficiently down, the check is only performed in
     # -Wreturn mode.
     # TODO: always perform the check.
-    if ($Wreturn && !$noret) {
-	    check_return_section($file, $declaration_name, $return_type);
+    if ($Wreturn && !$func_macro) {
+        check_return_section($file, $declaration_name, $return_type);
     }
 
     # The function parser can be called with a typedef parameter.
     # Handle it.
     if ($return_type =~ /typedef/) {
-	output_declaration($declaration_name,
-			   'function',
-			   {'function' => $declaration_name,
-			    'typedef' => 1,
-			    'module' => $modulename,
-			    'functiontype' => $return_type,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'parametertypes' => \%parametertypes,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
+        output_declaration($declaration_name,
+                           'function',
+                           {'function' => $declaration_name,
+                            'typedef' => 1,
+                            'module' => $modulename,
+                            'functiontype' => $return_type,
+                            'parameterlist' => \@parameterlist,
+                            'parameterdescs' => \%parameterdescs,
+                            'parametertypes' => \%parametertypes,
+                            'sectionlist' => \@sectionlist,
+                            'sections' => \%sections,
+                            'purpose' => $declaration_purpose,
+							'func_macro' => $func_macro
+                           });
     } else {
-	output_declaration($declaration_name,
-			   'function',
-			   {'function' => $declaration_name,
-			    'module' => $modulename,
-			    'functiontype' => $return_type,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'parametertypes' => \%parametertypes,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
+        output_declaration($declaration_name,
+                           'function',
+                           {'function' => $declaration_name,
+                            'module' => $modulename,
+                            'functiontype' => $return_type,
+                            'parameterlist' => \@parameterlist,
+                            'parameterdescs' => \%parameterdescs,
+                            'parametertypes' => \%parametertypes,
+                            'sectionlist' => \@sectionlist,
+                            'sections' => \%sections,
+                            'purpose' => $declaration_purpose,
+							'func_macro' => $func_macro
+                           });
     }
 }
 
@@ -1841,64 +1853,64 @@
 }
 
 sub tracepoint_munge($) {
-	my $file = shift;
-	my $tracepointname = 0;
-	my $tracepointargs = 0;
+    my $file = shift;
+    my $tracepointname = 0;
+    my $tracepointargs = 0;
 
-	if ($prototype =~ m/TRACE_EVENT\((.*?),/) {
-		$tracepointname = $1;
-	}
-	if ($prototype =~ m/DEFINE_SINGLE_EVENT\((.*?),/) {
-		$tracepointname = $1;
-	}
-	if ($prototype =~ m/DEFINE_EVENT\((.*?),(.*?),/) {
-		$tracepointname = $2;
-	}
-	$tracepointname =~ s/^\s+//; #strip leading whitespace
-	if ($prototype =~ m/TP_PROTO\((.*?)\)/) {
-		$tracepointargs = $1;
-	}
-	if (($tracepointname eq 0) || ($tracepointargs eq 0)) {
-		emit_warning("${file}:$.", "Unrecognized tracepoint format: \n".
-			     "$prototype\n");
-	} else {
-		$prototype = "static inline void trace_$tracepointname($tracepointargs)";
-		$identifier = "trace_$identifier";
-	}
+    if ($prototype =~ m/TRACE_EVENT\((.*?),/) {
+        $tracepointname = $1;
+    }
+    if ($prototype =~ m/DEFINE_SINGLE_EVENT\((.*?),/) {
+        $tracepointname = $1;
+    }
+    if ($prototype =~ m/DEFINE_EVENT\((.*?),(.*?),/) {
+        $tracepointname = $2;
+    }
+    $tracepointname =~ s/^\s+//; #strip leading whitespace
+    if ($prototype =~ m/TP_PROTO\((.*?)\)/) {
+        $tracepointargs = $1;
+    }
+    if (($tracepointname eq 0) || ($tracepointargs eq 0)) {
+        emit_warning("${file}:$.", "Unrecognized tracepoint format: \n".
+                 "$prototype\n");
+    } else {
+        $prototype = "static inline void trace_$tracepointname($tracepointargs)";
+        $identifier = "trace_$identifier";
+    }
 }
 
 sub syscall_munge() {
-	my $void = 0;
+    my $void = 0;
 
-	$prototype =~ s@[\r\n]+@ @gos; # strip newlines/CR's
-##	if ($prototype =~ m/SYSCALL_DEFINE0\s*\(\s*(a-zA-Z0-9_)*\s*\)/) {
-	if ($prototype =~ m/SYSCALL_DEFINE0/) {
-		$void = 1;
-##		$prototype = "long sys_$1(void)";
-	}
+    $prototype =~ s@[\r\n]+@ @gos; # strip newlines/CR's
+##    if ($prototype =~ m/SYSCALL_DEFINE0\s*\(\s*(a-zA-Z0-9_)*\s*\)/) {
+    if ($prototype =~ m/SYSCALL_DEFINE0/) {
+        $void = 1;
+##        $prototype = "long sys_$1(void)";
+    }
 
-	$prototype =~ s/SYSCALL_DEFINE.*\(/long sys_/; # fix return type & func name
-	if ($prototype =~ m/long (sys_.*?),/) {
-		$prototype =~ s/,/\(/;
-	} elsif ($void) {
-		$prototype =~ s/\)/\(void\)/;
-	}
+    $prototype =~ s/SYSCALL_DEFINE.*\(/long sys_/; # fix return type & func name
+    if ($prototype =~ m/long (sys_.*?),/) {
+        $prototype =~ s/,/\(/;
+    } elsif ($void) {
+        $prototype =~ s/\)/\(void\)/;
+    }
 
-	# now delete all of the odd-number commas in $prototype
-	# so that arg types & arg names don't have a comma between them
-	my $count = 0;
-	my $len = length($prototype);
-	if ($void) {
-		$len = 0;	# skip the for-loop
-	}
-	for (my $ix = 0; $ix < $len; $ix++) {
-		if (substr($prototype, $ix, 1) eq ',') {
-			$count++;
-			if ($count % 2 == 1) {
-				substr($prototype, $ix, 1) = ' ';
-			}
-		}
-	}
+    # now delete all of the odd-number commas in $prototype
+    # so that arg types & arg names don't have a comma between them
+    my $count = 0;
+    my $len = length($prototype);
+    if ($void) {
+        $len = 0;    # skip the for-loop
+    }
+    for (my $ix = 0; $ix < $len; $ix++) {
+        if (substr($prototype, $ix, 1) eq ',') {
+            $count++;
+            if ($count % 2 == 1) {
+                substr($prototype, $ix, 1) = ' ';
+            }
+        }
+    }
 }
 
 sub process_proto_function($$) {
@@ -1908,31 +1920,30 @@
     $x =~ s@\/\/.*$@@gos; # strip C99-style comments to end of line
 
     if ($x =~ m#\s*/\*\s+MACDOC\s*#io || ($x =~ /^#/ && $x !~ /^#\s*define/)) {
-	# do nothing
-    }
-    elsif ($x =~ /([^\{]*)/) {
-	$prototype .= $1;
+        # do nothing
+    } elsif ($x =~ /([^\{]*)/) {
+        $prototype .= $1;
     }
 
     if (($x =~ /\{/) || ($x =~ /\#\s*define/) || ($x =~ /;/)) {
-	$prototype =~ s@/\*.*?\*/@@gos;	# strip comments.
-	$prototype =~ s@[\r\n]+@ @gos; # strip newlines/cr's.
-	$prototype =~ s@^\s+@@gos; # strip leading spaces
-
-	 # Handle prototypes for function pointers like:
-	 # int (*pcs_config)(struct foo)
-	$prototype =~ s@^(\S+\s+)\(\s*\*(\S+)\)@$1$2@gos;
+        $prototype =~ s@/\*.*?\*/@@gos;        # strip comments.
+        $prototype =~ s@[\r\n]+@ @gos; # strip newlines/cr's.
+        $prototype =~ s@^\s+@@gos; # strip leading spaces
+
+        # Handle prototypes for function pointers like:
+        # int (*pcs_config)(struct foo)
+        $prototype =~ s@^(\S+\s+)\(\s*\*(\S+)\)@$1$2@gos;
 
-	if ($prototype =~ /SYSCALL_DEFINE/) {
-		syscall_munge();
-	}
-	if ($prototype =~ /TRACE_EVENT/ || $prototype =~ /DEFINE_EVENT/ ||
-	    $prototype =~ /DEFINE_SINGLE_EVENT/)
-	{
-		tracepoint_munge($file);
-	}
-	dump_function($prototype, $file);
-	reset_state();
+        if ($prototype =~ /SYSCALL_DEFINE/) {
+            syscall_munge();
+        }
+        if ($prototype =~ /TRACE_EVENT/ || $prototype =~ /DEFINE_EVENT/ ||
+            $prototype =~ /DEFINE_SINGLE_EVENT/)
+        {
+            tracepoint_munge($file);
+        }
+        dump_function($prototype, $file);
+        reset_state();
     }
 }
 
@@ -1946,28 +1957,28 @@
     $x =~ s@\/\/.*$@@gos; # strip C99-style comments to end of line
 
     if ($x =~ /^#/) {
-	# To distinguish preprocessor directive from regular declaration later.
-	$x .= ";";
+        # To distinguish preprocessor directive from regular declaration later.
+        $x .= ";";
     }
 
     while (1) {
-	if ( $x =~ /([^\{\};]*)([\{\};])(.*)/ ) {
+        if ( $x =~ /([^\{\};]*)([\{\};])(.*)/ ) {
             if( length $prototype ) {
                 $prototype .= " "
             }
-	    $prototype .= $1 . $2;
-	    ($2 eq '{') && $brcount++;
-	    ($2 eq '}') && $brcount--;
-	    if (($2 eq ';') && ($brcount == 0)) {
-		dump_declaration($prototype, $file);
-		reset_state();
-		last;
-	    }
-	    $x = $3;
-	} else {
-	    $prototype .= $x;
-	    last;
-	}
+            $prototype .= $1 . $2;
+            ($2 eq '{') && $brcount++;
+            ($2 eq '}') && $brcount--;
+            if (($2 eq ';') && ($brcount == 0)) {
+                dump_declaration($prototype, $file);
+                reset_state();
+                last;
+            }
+            $x = $3;
+        } else {
+            $prototype .= $x;
+            last;
+        }
     }
 }
 
@@ -1977,13 +1988,13 @@
     my ($orig_file) = @_;
 
     if (defined($ENV{'SRCTREE'})) {
-	$file = "$ENV{'SRCTREE'}" . "/" . $orig_file;
+        $file = "$ENV{'SRCTREE'}" . "/" . $orig_file;
     } else {
-	$file = $orig_file;
+        $file = $orig_file;
     }
 
     if (defined($source_map{$file})) {
-	$file = $source_map{$file};
+        $file = $source_map{$file};
     }
 
     return $file;
@@ -1994,20 +2005,20 @@
     my $file = map_filename($orig_file);
 
     if (!open(IN,"<$file")) {
-	print STDERR "Error: Cannot open file $file\n";
-	++$errors;
-	return;
+        print STDERR "Error: Cannot open file $file\n";
+        ++$errors;
+        return;
     }
 
     while (<IN>) {
-	if (/$export_symbol/) {
-	    next if (defined($nosymbol_table{$2}));
-	    $function_table{$2} = 1;
-	}
-	if (/$export_symbol_ns/) {
-	    next if (defined($nosymbol_table{$2}));
-	    $function_table{$2} = 1;
-	}
+        if (/$export_symbol/) {
+            next if (defined($nosymbol_table{$2}));
+            $function_table{$2} = 1;
+        }
+        if (/$export_symbol_ns/) {
+            next if (defined($nosymbol_table{$2}));
+            $function_table{$2} = 1;
+        }
     }
 
     close(IN);
@@ -2020,9 +2031,9 @@
 #
 sub process_normal() {
     if (/$doc_start/o) {
-	$state = STATE_NAME;	# next line is always the function name
-	$in_doc_sect = 0;
-	$declaration_start_line = $. + 1;
+        $state = STATE_NAME;        # next line is always the function name
+        $in_doc_sect = 0;
+        $declaration_start_line = $. + 1;
     }
 }
 
@@ -2034,80 +2045,80 @@
     my $descr;
 
     if (/$doc_block/o) {
-	$state = STATE_DOCBLOCK;
-	$contents = "";
-	$new_start_line = $.;
-
-	if ( $1 eq "" ) {
-	    $section = $section_intro;
-	} else {
-	    $section = $1;
-	}
+        $state = STATE_DOCBLOCK;
+        $contents = "";
+        $new_start_line = $.;
+
+        if ( $1 eq "" ) {
+            $section = $section_intro;
+        } else {
+            $section = $1;
+        }
     } elsif (/$doc_decl/o) {
-	$identifier = $1;
-	my $is_kernel_comment = 0;
-	my $decl_start = qr{$doc_com};
-	# test for pointer declaration type, foo * bar() - desc
-	my $fn_type = qr{\w+\s*\*\s*}; 
-	my $parenthesis = qr{\(\w*\)};
-	my $decl_end = qr{[-:].*};
-	if (/^$decl_start([\w\s]+?)$parenthesis?\s*$decl_end?$/) {
-	    $identifier = $1;
-	}
-	if ($identifier =~ m/^(struct|union|enum|typedef)\b\s*(\S*)/) {
-	    $decl_type = $1;
-	    $identifier = $2;
-	    $is_kernel_comment = 1;
-	}
-	# Look for foo() or static void foo() - description; or misspelt
-	# identifier
-	elsif (/^$decl_start$fn_type?(\w+)\s*$parenthesis?\s*$decl_end?$/ ||
-	    /^$decl_start$fn_type?(\w+.*)$parenthesis?\s*$decl_end$/) {
-	    $identifier = $1;
-	    $decl_type = 'function';
-	    $identifier =~ s/^define\s+//;
-	    $is_kernel_comment = 1;
-	}
-	$identifier =~ s/\s+$//;
+        $identifier = $1;
+        my $is_kernel_comment = 0;
+        my $decl_start = qr{$doc_com};
+        # test for pointer declaration type, foo * bar() - desc
+        my $fn_type = qr{\w+\s*\*\s*};
+        my $parenthesis = qr{\(\w*\)};
+        my $decl_end = qr{[-:].*};
+        if (/^$decl_start([\w\s]+?)$parenthesis?\s*$decl_end?$/) {
+            $identifier = $1;
+        }
+        if ($identifier =~ m/^(struct|union|enum|typedef)\b\s*(\S*)/) {
+            $decl_type = $1;
+            $identifier = $2;
+            $is_kernel_comment = 1;
+        }
+        # Look for foo() or static void foo() - description; or misspelt
+        # identifier
+        elsif (/^$decl_start$fn_type?(\w+)\s*$parenthesis?\s*$decl_end?$/ ||
+            /^$decl_start$fn_type?(\w+.*)$parenthesis?\s*$decl_end$/) {
+            $identifier = $1;
+            $decl_type = 'function';
+            $identifier =~ s/^define\s+//;
+            $is_kernel_comment = 1;
+        }
+        $identifier =~ s/\s+$//;
 
-	$state = STATE_BODY;
-	# if there's no @param blocks need to set up default section
-	# here
-	$contents = "";
-	$section = $section_default;
-	$new_start_line = $. + 1;
-	if (/[-:](.*)/) {
-	    # strip leading/trailing/multiple spaces
-	    $descr= $1;
-	    $descr =~ s/^\s*//;
-	    $descr =~ s/\s*$//;
-	    $descr =~ s/\s+/ /g;
-	    $declaration_purpose = $descr;
-	    $state = STATE_BODY_MAYBE;
-	} else {
-	    $declaration_purpose = "";
-	}
+        $state = STATE_BODY;
+        # if there's no @param blocks need to set up default section
+        # here
+        $contents = "";
+        $section = $section_default;
+        $new_start_line = $. + 1;
+        if (/[-:](.*)/) {
+            # strip leading/trailing/multiple spaces
+            $descr= $1;
+            $descr =~ s/^\s*//;
+            $descr =~ s/\s*$//;
+            $descr =~ s/\s+/ /g;
+            $declaration_purpose = $descr;
+            $state = STATE_BODY_MAYBE;
+        } else {
+            $declaration_purpose = "";
+        }
 
-	if (!$is_kernel_comment) {
-	    emit_warning("${file}:$.", "This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst\n$_");
-	    $state = STATE_NORMAL;
-	}
+        if (!$is_kernel_comment) {
+            emit_warning("${file}:$.", "This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst\n$_");
+            $state = STATE_NORMAL;
+        }
 
-	if (($declaration_purpose eq "") && $Wshort_desc) {
-	    emit_warning("${file}:$.", "missing initial short description on line:\n$_");
-	}
+        if (($declaration_purpose eq "") && $Wshort_desc) {
+            emit_warning("${file}:$.", "missing initial short description on line:\n$_");
+        }
 
-	if ($identifier eq "" && $decl_type ne "enum") {
-	    emit_warning("${file}:$.", "wrong kernel-doc identifier on line:\n$_");
-	    $state = STATE_NORMAL;
-	}
+        if ($identifier eq "" && $decl_type ne "enum") {
+            emit_warning("${file}:$.", "wrong kernel-doc identifier on line:\n$_");
+            $state = STATE_NORMAL;
+        }
 
-	if ($verbose) {
-	    print STDERR "${file}:$.: info: Scanning doc for $decl_type $identifier\n";
-	}
+        if ($verbose) {
+            print STDERR "${file}:$.: info: Scanning doc for $decl_type $identifier\n";
+        }
     } else {
-	emit_warning("${file}:$.", "Cannot understand $_ on line $. - I thought it was a doc line\n");
-	$state = STATE_NORMAL;
+        emit_warning("${file}:$.", "Cannot understand $_ on line $. - I thought it was a doc line\n");
+        $state = STATE_NORMAL;
     }
 }
 
@@ -2119,102 +2130,102 @@
     my $file = shift;
 
     if ($state == STATE_BODY_WITH_BLANK_LINE && /^\s*\*\s?\S/) {
-	dump_section($file, $section, $contents);
-	$section = $section_default;
-	$new_start_line = $.;
-	$contents = "";
+        dump_section($file, $section, $contents);
+        $section = $section_default;
+        $new_start_line = $.;
+        $contents = "";
     }
 
     if (/$doc_sect/i) { # case insensitive for supported section names
-	$in_doc_sect = 1;
-	$newsection = $1;
-	$newcontents = $2;
-
-	# map the supported section names to the canonical names
-	if ($newsection =~ m/^description$/i) {
-	    $newsection = $section_default;
-	} elsif ($newsection =~ m/^context$/i) {
-	    $newsection = $section_context;
-	} elsif ($newsection =~ m/^returns?$/i) {
-	    $newsection = $section_return;
-	} elsif ($newsection =~ m/^\@return$/) {
-	    # special: @return is a section, not a param description
-	    $newsection = $section_return;
-	}
+        $in_doc_sect = 1;
+        $newsection = $1;
+        $newcontents = $2;
+
+        # map the supported section names to the canonical names
+        if ($newsection =~ m/^description$/i) {
+            $newsection = $section_default;
+        } elsif ($newsection =~ m/^context$/i) {
+            $newsection = $section_context;
+        } elsif ($newsection =~ m/^returns?$/i) {
+            $newsection = $section_return;
+        } elsif ($newsection =~ m/^\@return$/) {
+            # special: @return is a section, not a param description
+            $newsection = $section_return;
+        }
 
-	if (($contents ne "") && ($contents ne "\n")) {
-	    if (!$in_doc_sect && $Wcontents_before_sections) {
-		emit_warning("${file}:$.", "contents before sections\n");
-	    }
-	    dump_section($file, $section, $contents);
-	    $section = $section_default;
-	}
+        if (($contents ne "") && ($contents ne "\n")) {
+            if (!$in_doc_sect && $Wcontents_before_sections) {
+                emit_warning("${file}:$.", "contents before sections\n");
+            }
+            dump_section($file, $section, $contents);
+            $section = $section_default;
+        }
 
-	$in_doc_sect = 1;
-	$state = STATE_BODY;
-	$contents = $newcontents;
-	$new_start_line = $.;
-	while (substr($contents, 0, 1) eq " ") {
-	    $contents = substr($contents, 1);
-	}
-	if ($contents ne "") {
-	    $contents .= "\n";
-	}
-	$section = $newsection;
-	$leading_space = undef;
+        $in_doc_sect = 1;
+        $state = STATE_BODY;
+        $contents = $newcontents;
+        $new_start_line = $.;
+        while (substr($contents, 0, 1) eq " ") {
+            $contents = substr($contents, 1);
+        }
+        if ($contents ne "") {
+            $contents .= "\n";
+        }
+        $section = $newsection;
+        $leading_space = undef;
     } elsif (/$doc_end/) {
-	if (($contents ne "") && ($contents ne "\n")) {
-	    dump_section($file, $section, $contents);
-	    $section = $section_default;
-	    $contents = "";
-	}
-	# look for doc_com + <text> + doc_end:
-	if ($_ =~ m'\s*\*\s*[a-zA-Z_0-9:\.]+\*/') {
-	    emit_warning("${file}:$.", "suspicious ending line: $_");
-	}
+        if (($contents ne "") && ($contents ne "\n")) {
+            dump_section($file, $section, $contents);
+            $section = $section_default;
+            $contents = "";
+        }
+        # look for doc_com + <text> + doc_end:
+        if ($_ =~ m'\s*\*\s*[a-zA-Z_0-9:\.]+\*/') {
+            emit_warning("${file}:$.", "suspicious ending line: $_");
+        }
 
-	$prototype = "";
-	$state = STATE_PROTO;
-	$brcount = 0;
+        $prototype = "";
+        $state = STATE_PROTO;
+        $brcount = 0;
         $new_start_line = $. + 1;
     } elsif (/$doc_content/) {
-	if ($1 eq "") {
-	    if ($section eq $section_context) {
-		dump_section($file, $section, $contents);
-		$section = $section_default;
-		$contents = "";
-		$new_start_line = $.;
-		$state = STATE_BODY;
-	    } else {
-		if ($section ne $section_default) {
-		    $state = STATE_BODY_WITH_BLANK_LINE;
-		} else {
-		    $state = STATE_BODY;
-		}
-		$contents .= "\n";
-	    }
-	} elsif ($state == STATE_BODY_MAYBE) {
-	    # Continued declaration purpose
-	    chomp($declaration_purpose);
-	    $declaration_purpose .= " " . $1;
-	    $declaration_purpose =~ s/\s+/ /g;
-	} else {
-	    my $cont = $1;
-	    if ($section =~ m/^@/ || $section eq $section_context) {
-		if (!defined $leading_space) {
-		    if ($cont =~ m/^(\s+)/) {
-			$leading_space = $1;
-		    } else {
-			$leading_space = "";
-		    }
-		}
-		$cont =~ s/^$leading_space//;
-	    }
-	    $contents .= $cont . "\n";
-	}
+        if ($1 eq "") {
+            if ($section eq $section_context) {
+                dump_section($file, $section, $contents);
+                $section = $section_default;
+                $contents = "";
+                $new_start_line = $.;
+                $state = STATE_BODY;
+            } else {
+                if ($section ne $section_default) {
+                    $state = STATE_BODY_WITH_BLANK_LINE;
+                } else {
+                    $state = STATE_BODY;
+                }
+                $contents .= "\n";
+            }
+        } elsif ($state == STATE_BODY_MAYBE) {
+            # Continued declaration purpose
+            chomp($declaration_purpose);
+            $declaration_purpose .= " " . $1;
+            $declaration_purpose =~ s/\s+/ /g;
+        } else {
+            my $cont = $1;
+            if ($section =~ m/^@/ || $section eq $section_context) {
+                if (!defined $leading_space) {
+                    if ($cont =~ m/^(\s+)/) {
+                        $leading_space = $1;
+                    } else {
+                        $leading_space = "";
+                    }
+                }
+                $cont =~ s/^$leading_space//;
+            }
+            $contents .= $cont . "\n";
+        }
     } else {
-	# i dont know - bad line?  ignore.
-	emit_warning("${file}:$.", "bad line: $_");
+        # i dont know - bad line?  ignore.
+        emit_warning("${file}:$.", "bad line: $_");
     }
 }
 
@@ -2226,21 +2237,21 @@
     my $file = shift;
 
     if (/$doc_inline_oneline/) {
-	$section = $1;
-	$contents = $2;
-	if ($contents ne "") {
-	    $contents .= "\n";
-	    dump_section($file, $section, $contents);
-	    $section = $section_default;
-	    $contents = "";
-	}
+        $section = $1;
+        $contents = $2;
+        if ($contents ne "") {
+            $contents .= "\n";
+            dump_section($file, $section, $contents);
+            $section = $section_default;
+            $contents = "";
+        }
     } elsif (/$doc_inline_start/) {
-	$state = STATE_INLINE;
-	$inline_doc_state = STATE_INLINE_NAME;
+        $state = STATE_INLINE;
+        $inline_doc_state = STATE_INLINE_NAME;
     } elsif ($decl_type eq 'function') {
-	process_proto_function($_, $file);
+        process_proto_function($_, $file);
     } else {
-	process_proto_type($_, $file);
+        process_proto_type($_, $file);
     }
 }
 
@@ -2251,23 +2262,23 @@
     my $file = shift;
 
     if (/$doc_end/) {
-	dump_doc_section($file, $section, $contents);
-	$section = $section_default;
-	$contents = "";
-	$function = "";
-	%parameterdescs = ();
-	%parametertypes = ();
-	@parameterlist = ();
-	%sections = ();
-	@sectionlist = ();
-	$prototype = "";
-	$state = STATE_NORMAL;
+        dump_doc_section($file, $section, $contents);
+        $section = $section_default;
+        $contents = "";
+        $function = "";
+        %parameterdescs = ();
+        %parametertypes = ();
+        @parameterlist = ();
+        %sections = ();
+        @sectionlist = ();
+        $prototype = "";
+        $state = STATE_NORMAL;
     } elsif (/$doc_content/) {
-	if ( $1 eq "" )	{
-	    $contents .= $blankline;
-	} else {
-	    $contents .= $1 . "\n";
-	}
+        if ( $1 eq "" )        {
+            $contents .= $blankline;
+        } else {
+            $contents .= $1 . "\n";
+        }
     }
 }
 
@@ -2279,97 +2290,94 @@
 
     # First line (state 1) needs to be a @parameter
     if ($inline_doc_state == STATE_INLINE_NAME && /$doc_inline_sect/o) {
-	$section = $1;
-	$contents = $2;
-	$new_start_line = $.;
-	if ($contents ne "") {
-	    while (substr($contents, 0, 1) eq " ") {
-		$contents = substr($contents, 1);
-	    }
-	    $contents .= "\n";
-	}
-	$inline_doc_state = STATE_INLINE_TEXT;
-	# Documentation block end */
+        $section = $1;
+        $contents = $2;
+        $new_start_line = $.;
+        if ($contents ne "") {
+            while (substr($contents, 0, 1) eq " ") {
+                $contents = substr($contents, 1);
+            }
+            $contents .= "\n";
+        }
+        $inline_doc_state = STATE_INLINE_TEXT;
+        # Documentation block end */
     } elsif (/$doc_inline_end/) {
-	if (($contents ne "") && ($contents ne "\n")) {
-	    dump_section($file, $section, $contents);
-	    $section = $section_default;
-	    $contents = "";
-	}
-	$state = STATE_PROTO;
-	$inline_doc_state = STATE_INLINE_NA;
-	# Regular text
+        if (($contents ne "") && ($contents ne "\n")) {
+            dump_section($file, $section, $contents);
+            $section = $section_default;
+            $contents = "";
+        }
+        $state = STATE_PROTO;
+        $inline_doc_state = STATE_INLINE_NA;
+        # Regular text
     } elsif (/$doc_content/) {
-	if ($inline_doc_state == STATE_INLINE_TEXT) {
-	    $contents .= $1 . "\n";
-	    # nuke leading blank lines
-	    if ($contents =~ /^\s*$/) {
-		$contents = "";
-	    }
-	} elsif ($inline_doc_state == STATE_INLINE_NAME) {
-	    $inline_doc_state = STATE_INLINE_ERROR;
-	    emit_warning("${file}:$.", "Incorrect use of kernel-doc format: $_");
-	}
+        if ($inline_doc_state == STATE_INLINE_TEXT) {
+            $contents .= $1 . "\n";
+            # nuke leading blank lines
+            if ($contents =~ /^\s*$/) {
+                $contents = "";
+            }
+        } elsif ($inline_doc_state == STATE_INLINE_NAME) {
+            $inline_doc_state = STATE_INLINE_ERROR;
+            emit_warning("${file}:$.", "Incorrect use of kernel-doc format: $_");
+        }
     }
 }
 
 
 sub process_file($) {
     my $file;
-    my $initial_section_counter = $section_counter;
     my ($orig_file) = @_;
 
     $file = map_filename($orig_file);
 
     if (!open(IN_FILE,"<$file")) {
-	print STDERR "Error: Cannot open file $file\n";
-	++$errors;
-	return;
+        print STDERR "Error: Cannot open file $file\n";
+        ++$errors;
+        return;
     }
 
     $. = 1;
 
     $section_counter = 0;
     while (<IN_FILE>) {
-	while (s/\\\s*$//) {
-	    $_ .= <IN_FILE>;
-	}
-	# Replace tabs by spaces
+        while (s/\\\s*$//) {
+            $_ .= <IN_FILE>;
+        }
+        # Replace tabs by spaces
         while ($_ =~ s/\t+/' ' x (length($&) * 8 - length($`) % 8)/e) {};
-	# Hand this line to the appropriate state handler
-	if ($state == STATE_NORMAL) {
-	    process_normal();
-	} elsif ($state == STATE_NAME) {
-	    process_name($file, $_);
-	} elsif ($state == STATE_BODY || $state == STATE_BODY_MAYBE ||
-		 $state == STATE_BODY_WITH_BLANK_LINE) {
-	    process_body($file, $_);
-	} elsif ($state == STATE_INLINE) { # scanning for inline parameters
-	    process_inline($file, $_);
-	} elsif ($state == STATE_PROTO) {
-	    process_proto($file, $_);
-	} elsif ($state == STATE_DOCBLOCK) {
-	    process_docblock($file, $_);
-	}
+        # Hand this line to the appropriate state handler
+        if ($state == STATE_NORMAL) {
+            process_normal();
+        } elsif ($state == STATE_NAME) {
+            process_name($file, $_);
+        } elsif ($state == STATE_BODY || $state == STATE_BODY_MAYBE ||
+                 $state == STATE_BODY_WITH_BLANK_LINE) {
+            process_body($file, $_);
+        } elsif ($state == STATE_INLINE) { # scanning for inline parameters
+            process_inline($file, $_);
+        } elsif ($state == STATE_PROTO) {
+            process_proto($file, $_);
+        } elsif ($state == STATE_DOCBLOCK) {
+            process_docblock($file, $_);
+        }
     }
 
     # Make sure we got something interesting.
-    if ($initial_section_counter == $section_counter && $
-	output_mode ne "none") {
-	if ($output_selection == OUTPUT_INCLUDE) {
-	    emit_warning("${file}:1", "'$_' not found\n")
-		for keys %function_table;
-	}
-	else {
-	    emit_warning("${file}:1", "no structured comments found\n");
-	}
+    if (!$section_counter && $output_mode ne "none") {
+        if ($output_selection == OUTPUT_INCLUDE) {
+            emit_warning("${file}:1", "'$_' not found\n")
+                for keys %function_table;
+        } else {
+            emit_warning("${file}:1", "no structured comments found\n");
+        }
     }
     close IN_FILE;
 }
 
 
 if ($output_mode eq "rst") {
-	get_sphinx_version() if (!$sphinx_major);
+    get_sphinx_version() if (!$sphinx_major);
 }
 
 $kernelversion = get_kernel_version();
@@ -2386,14 +2394,14 @@
 # Read the file that maps relative names to absolute names for
 # separate source and object directories and for shadow trees.
 if (open(SOURCE_MAP, "<.tmp_filelist.txt")) {
-	my ($relname, $absname);
-	while(<SOURCE_MAP>) {
-		chop();
-		($relname, $absname) = (split())[0..1];
-		$relname =~ s:^/+::;
-		$source_map{$relname} = $absname;
-	}
-	close(SOURCE_MAP);
+    my ($relname, $absname);
+    while(<SOURCE_MAP>) {
+        chop();
+        ($relname, $absname) = (split())[0..1];
+        $relname =~ s:^/+::;
+        $source_map{$relname} = $absname;
+    }
+    close(SOURCE_MAP);
 }
 
 if ($output_selection == OUTPUT_EXPORTED ||
@@ -2402,8 +2410,8 @@
     push(@export_file_list, @ARGV);
 
     foreach (@export_file_list) {
-	chomp;
-	process_export_file($_);
+        chomp;
+        process_export_file($_);
     }
 }
 
@@ -2412,10 +2420,10 @@
     process_file($_);
 }
 if ($verbose && $errors) {
-  print STDERR "$errors errors\n";
+    print STDERR "$errors errors\n";
 }
 if ($verbose && $warnings) {
-  print STDERR "$warnings warnings\n";
+    print STDERR "$warnings warnings\n";
 }
 
 if ($Werror && $warnings) {
--- linux-qcom-6.8.0.orig/scripts/ld-version.sh
+++ linux-qcom-6.8.0/scripts/ld-version.sh
@@ -57,9 +57,11 @@
 	fi
 fi
 
-# Some distributions append a package release number, as in 2.34-4.fc32
-# Trim the hyphen and any characters that follow.
-version=${version%-*}
+# There may be something after the version, such as a distribution's package
+# release number (like Fedora's "2.34-4.fc32") or punctuation (like LLD briefly
+# added before the "compatible with GNU linkers" string), so remove everything
+# after just numbers and periods.
+version=${version%%[!0-9.]*}
 
 cversion=$(get_canonical_version $version)
 min_cversion=$(get_canonical_version $min_version)
--- linux-qcom-6.8.0.orig/scripts/link-vmlinux.sh
+++ linux-qcom-6.8.0/scripts/link-vmlinux.sh
@@ -45,7 +45,6 @@
 
 # Link of vmlinux
 # ${1} - output file
-# ${2}, ${3}, ... - optional extra .o files
 vmlinux_link()
 {
 	local output=${1}
@@ -90,7 +89,7 @@
 	ldflags="${ldflags} ${wl}--script=${objtree}/${KBUILD_LDS}"
 
 	# The kallsyms linking does not need debug symbols included.
-	if [ "$output" != "${output#.tmp_vmlinux.kallsyms}" ] ; then
+	if [ -n "${strip_debug}" ] ; then
 		ldflags="${ldflags} ${wl}--strip-debug"
 	fi
 
@@ -101,15 +100,15 @@
 	${ld} ${ldflags} -o ${output}					\
 		${wl}--whole-archive ${objs} ${wl}--no-whole-archive	\
 		${wl}--start-group ${libs} ${wl}--end-group		\
-		$@ ${ldlibs}
+		${kallsymso} ${btf_vmlinux_bin_o} ${ldlibs}
 }
 
 # generate .BTF typeinfo from DWARF debuginfo
 # ${1} - vmlinux image
-# ${2} - file to dump raw BTF data into
 gen_btf()
 {
 	local pahole_ver
+	local btf_data=${1}.btf.o
 
 	if ! [ -x "$(command -v ${PAHOLE})" ]; then
 		echo >&2 "BTF: ${1}: pahole (${PAHOLE}) is not available"
@@ -122,18 +121,16 @@
 		return 1
 	fi
 
-	vmlinux_link ${1}
-
-	info "BTF" ${2}
+	info BTF "${btf_data}"
 	LLVM_OBJCOPY="${OBJCOPY}" ${PAHOLE} -J ${PAHOLE_FLAGS} ${1}
 
-	# Create ${2} which contains just .BTF section but no symbols. Add
+	# Create ${btf_data} which contains just .BTF section but no symbols. Add
 	# SHF_ALLOC because .BTF will be part of the vmlinux image. --strip-all
 	# deletes all symbols including __start_BTF and __stop_BTF, which will
 	# be redefined in the linker script. Add 2>/dev/null to suppress GNU
 	# objcopy warnings: "empty loadable segment detected at ..."
 	${OBJCOPY} --only-section=.BTF --set-section-flags .BTF=alloc,readonly \
-		--strip-all ${1} ${2} 2>/dev/null
+		--strip-all ${1} "${btf_data}" 2>/dev/null
 	# Change e_type to ET_REL so that it can be used to link final vmlinux.
 	# GNU ld 2.35+ and lld do not allow an ET_EXEC input.
 	if is_enabled CONFIG_CPU_BIG_ENDIAN; then
@@ -141,10 +138,12 @@
 	else
 		et_rel='\1\0'
 	fi
-	printf "${et_rel}" | dd of=${2} conv=notrunc bs=1 seek=16 status=none
+	printf "${et_rel}" | dd of="${btf_data}" conv=notrunc bs=1 seek=16 status=none
+
+	btf_vmlinux_bin_o=${btf_data}
 }
 
-# Create ${2} .S file with all symbols from the ${1} object file
+# Create ${2}.o file with all symbols from the ${1} object file
 kallsyms()
 {
 	local kallsymopt;
@@ -157,35 +156,23 @@
 		kallsymopt="${kallsymopt} --absolute-percpu"
 	fi
 
-	if is_enabled CONFIG_KALLSYMS_BASE_RELATIVE; then
-		kallsymopt="${kallsymopt} --base-relative"
-	fi
+	info KSYMS "${2}.S"
+	scripts/kallsyms ${kallsymopt} "${1}" > "${2}.S"
 
-	if is_enabled CONFIG_LTO_CLANG; then
-		kallsymopt="${kallsymopt} --lto-clang"
-	fi
+	info AS "${2}.o"
+	${CC} ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS} \
+	      ${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL} -c -o "${2}.o" "${2}.S"
 
-	info KSYMS ${2}
-	scripts/kallsyms ${kallsymopt} ${1} > ${2}
+	kallsymso=${2}.o
 }
 
-# Perform one step in kallsyms generation, including temporary linking of
-# vmlinux.
-kallsyms_step()
+# Perform kallsyms for the given temporary vmlinux.
+sysmap_and_kallsyms()
 {
-	kallsymso_prev=${kallsymso}
-	kallsyms_vmlinux=.tmp_vmlinux.kallsyms${1}
-	kallsymso=${kallsyms_vmlinux}.o
-	kallsyms_S=${kallsyms_vmlinux}.S
-
-	vmlinux_link ${kallsyms_vmlinux} "${kallsymso_prev}" ${btf_vmlinux_bin_o}
-	mksysmap ${kallsyms_vmlinux} ${kallsyms_vmlinux}.syms ${kallsymso_prev}
-	kallsyms ${kallsyms_vmlinux}.syms ${kallsyms_S}
+	mksysmap "${1}" "${1}.syms"
+	kallsyms "${1}.syms" "${1}.kallsyms"
 
-	info AS ${kallsyms_S}
-	${CC} ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS} \
-	      ${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL} \
-	      -c -o ${kallsymso} ${kallsyms_S}
+	kallsyms_sysmap=${1}.syms
 }
 
 # Create map file with all symbols from ${1}
@@ -193,7 +180,7 @@
 mksysmap()
 {
 	info NM ${2}
-	${CONFIG_SHELL} "${srctree}/scripts/mksysmap" ${1} ${2} ${3}
+	${CONFIG_SHELL} "${srctree}/scripts/mksysmap" ${1} ${2}
 }
 
 sorttable()
@@ -224,26 +211,41 @@
 
 ${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init init/version-timestamp.o
 
-btf_vmlinux_bin_o=""
+btf_vmlinux_bin_o=
+kallsymso=
+strip_debug=
+
+if is_enabled CONFIG_KALLSYMS; then
+	truncate -s0 .tmp_vmlinux.kallsyms0.syms
+	kallsyms .tmp_vmlinux.kallsyms0.syms .tmp_vmlinux0.kallsyms
+fi
+
+if is_enabled CONFIG_KALLSYMS || is_enabled CONFIG_DEBUG_INFO_BTF; then
+
+	# The kallsyms linking does not need debug symbols, but the BTF does.
+	if ! is_enabled CONFIG_DEBUG_INFO_BTF; then
+		strip_debug=1
+	fi
+
+	vmlinux_link .tmp_vmlinux1
+fi
+
 if is_enabled CONFIG_DEBUG_INFO_BTF; then
-	btf_vmlinux_bin_o=.btf.vmlinux.bin.o
-	if ! gen_btf .tmp_vmlinux.btf $btf_vmlinux_bin_o ; then
+	if ! gen_btf .tmp_vmlinux1; then
 		echo >&2 "Failed to generate BTF for vmlinux"
 		echo >&2 "Try to disable CONFIG_DEBUG_INFO_BTF"
 		exit 1
 	fi
 fi
 
-kallsymso=""
-kallsymso_prev=""
-kallsyms_vmlinux=""
 if is_enabled CONFIG_KALLSYMS; then
 
 	# kallsyms support
 	# Generate section listing all symbols and add it into vmlinux
-	# It's a three step process:
+	# It's a four step process:
+	# 0)  Generate a dummy __kallsyms with empty symbol list.
 	# 1)  Link .tmp_vmlinux.kallsyms1 so it has all symbols and sections,
-	#     but __kallsyms is empty.
+	#     with a dummy __kallsyms.
 	#     Running kallsyms on that gives us .tmp_kallsyms1.o with
 	#     the right size
 	# 2)  Link .tmp_vmlinux.kallsyms2 so it now has a __kallsyms section of
@@ -262,19 +264,25 @@
 	# a)  Verify that the System.map from vmlinux matches the map from
 	#     ${kallsymso}.
 
-	kallsyms_step 1
-	kallsyms_step 2
+	# The kallsyms linking does not need debug symbols included.
+	strip_debug=1
+
+	sysmap_and_kallsyms .tmp_vmlinux1
+	size1=$(${CONFIG_SHELL} "${srctree}/scripts/file-size.sh" ${kallsymso})
 
-	# step 3
-	size1=$(${CONFIG_SHELL} "${srctree}/scripts/file-size.sh" ${kallsymso_prev})
+	vmlinux_link .tmp_vmlinux2
+	sysmap_and_kallsyms .tmp_vmlinux2
 	size2=$(${CONFIG_SHELL} "${srctree}/scripts/file-size.sh" ${kallsymso})
 
 	if [ $size1 -ne $size2 ] || [ -n "${KALLSYMS_EXTRA_PASS}" ]; then
-		kallsyms_step 3
+		vmlinux_link .tmp_vmlinux3
+		sysmap_and_kallsyms .tmp_vmlinux3
 	fi
 fi
 
-vmlinux_link vmlinux "${kallsymso}" ${btf_vmlinux_bin_o}
+strip_debug=
+
+vmlinux_link vmlinux
 
 # fill in BTF IDs
 if is_enabled CONFIG_DEBUG_INFO_BTF && is_enabled CONFIG_BPF; then
@@ -282,7 +290,7 @@
 	${RESOLVE_BTFIDS} vmlinux
 fi
 
-mksysmap vmlinux System.map ${kallsymso}
+mksysmap vmlinux System.map
 
 if is_enabled CONFIG_BUILDTIME_TABLE_SORT; then
 	info SORTTAB vmlinux
@@ -294,7 +302,7 @@
 
 # step a (see comment above)
 if is_enabled CONFIG_KALLSYMS; then
-	if ! cmp -s System.map ${kallsyms_vmlinux}.syms; then
+	if ! cmp -s System.map "${kallsyms_sysmap}"; then
 		echo >&2 Inconsistent kallsyms data
 		echo >&2 'Try "make KALLSYMS_EXTRA_PASS=1" as a workaround'
 		exit 1
--- linux-qcom-6.8.0.orig/scripts/min-tool-version.sh
+++ linux-qcom-6.8.0/scripts/min-tool-version.sh
@@ -33,7 +33,7 @@
 	fi
 	;;
 rustc)
-	echo 1.74.1
+	echo 1.75.0
 	;;
 bindgen)
 	echo 0.65.1
--- linux-qcom-6.8.0.orig/scripts/mksysmap
+++ linux-qcom-6.8.0/scripts/mksysmap
@@ -4,7 +4,7 @@
 # tools to retrieve the actual addresses of symbols in the kernel.
 #
 # Usage
-# mksysmap vmlinux System.map [exclude]
+# mksysmap vmlinux System.map
 
 
 #####
@@ -92,13 +92,4 @@
 # ppc stub
 /\.long_branch\./d
 /\.plt_branch\./d
-
-# ---------------------------------------------------------------------------
-# Ignored kallsyms symbols
-#
-# If the 3rd parameter exists, symbols from it will be omitted from the output.
-# This makes kallsyms have the identical symbol lists in the step 1 and 2.
-# Without this, the step2 would get new symbols generated by scripts/kallsyms.c
-# when CONFIG_KALLSYMS_ALL is enabled. That might require one more pass.
-$(if [ $# -ge 3 ]; then ${NM} ${3} | sed -n '/ U /!s:.* \([^ ]*\)$:/ \1$/d:p'; fi)
 "
--- linux-qcom-6.8.0.orig/scripts/mod/file2alias.c
+++ linux-qcom-6.8.0/scripts/mod/file2alias.c
@@ -742,8 +742,8 @@
 
 	for (i = min / BITS_PER_LONG; i < max / BITS_PER_LONG + 1; i++)
 		arr[i] = TO_NATIVE(arr[i]);
-	for (i = min; i < max; i++)
-		if (arr[i / BITS_PER_LONG] & (1L << (i%BITS_PER_LONG)))
+	for (i = min; i <= max; i++)
+		if (arr[i / BITS_PER_LONG] & (1ULL << (i%BITS_PER_LONG)))
 			sprintf(alias + strlen(alias), "%X,*", i);
 }
 
@@ -809,10 +809,7 @@
 		char *alias)
 {
 	DEF_FIELD_ADDR(symval, eisa_device_id, sig);
-	if (sig[0])
-		sprintf(alias, EISA_DEVICE_MODALIAS_FMT "*", *sig);
-	else
-		strcat(alias, "*");
+	sprintf(alias, EISA_DEVICE_MODALIAS_FMT "*", *sig);
 	return 1;
 }
 
--- linux-qcom-6.8.0.orig/scripts/mod/modpost.c
+++ linux-qcom-6.8.0/scripts/mod/modpost.c
@@ -364,7 +364,7 @@
 	struct symbol *s = find_symbol(name);
 
 	if (s && (!external_module || s->module->is_vmlinux || s->module == mod)) {
-		error("%s: '%s' exported twice. Previous export was in %s%s\n",
+		warn("%s: '%s' exported twice. Previous export was in %s%s\n",
 		      mod->name, name, s->module->name,
 		      s->module->is_vmlinux ? "" : ".ko");
 	}
@@ -781,17 +781,14 @@
 
 
 #define ALL_INIT_DATA_SECTIONS \
-	".init.setup", ".init.rodata", ".meminit.rodata", \
-	".init.data", ".meminit.data"
+	".init.setup", ".init.rodata", ".init.data"
 
 #define ALL_PCI_INIT_SECTIONS	\
 	".pci_fixup_early", ".pci_fixup_header", ".pci_fixup_final", \
 	".pci_fixup_enable", ".pci_fixup_resume", \
 	".pci_fixup_resume_early", ".pci_fixup_suspend"
 
-#define ALL_XXXINIT_SECTIONS ".meminit.*"
-
-#define ALL_INIT_SECTIONS INIT_SECTIONS, ALL_XXXINIT_SECTIONS
+#define ALL_INIT_SECTIONS ".init.*"
 #define ALL_EXIT_SECTIONS ".exit.*"
 
 #define DATA_SECTIONS ".data", ".data.rel"
@@ -800,11 +797,9 @@
 		".ltext", ".ltext.*"
 #define OTHER_TEXT_SECTIONS ".ref.text", ".head.text", ".spinlock.text", \
 		".fixup", ".entry.text", ".exception.text", \
-		".coldtext", ".softirqentry.text"
-
-#define INIT_SECTIONS      ".init.*"
+		".coldtext", ".softirqentry.text", ".irqentry.text"
 
-#define ALL_TEXT_SECTIONS  ".init.text", ".meminit.text", ".exit.text", \
+#define ALL_TEXT_SECTIONS  ".init.text", ".exit.text", \
 		TEXT_SECTIONS, OTHER_TEXT_SECTIONS
 
 enum mismatch {
@@ -844,12 +839,6 @@
 	.bad_tosec = { ALL_INIT_SECTIONS, ALL_EXIT_SECTIONS, NULL },
 	.mismatch = TEXTDATA_TO_ANY_INIT_EXIT,
 },
-/* Do not reference init code/data from meminit code/data */
-{
-	.fromsec = { ALL_XXXINIT_SECTIONS, NULL },
-	.bad_tosec = { INIT_SECTIONS, NULL },
-	.mismatch = XXXINIT_TO_SOME_INIT,
-},
 /* Do not use exit code/data from init code */
 {
 	.fromsec = { ALL_INIT_SECTIONS, NULL },
@@ -864,7 +853,7 @@
 },
 {
 	.fromsec = { ALL_PCI_INIT_SECTIONS, NULL },
-	.bad_tosec = { INIT_SECTIONS, NULL },
+	.bad_tosec = { ALL_INIT_SECTIONS, NULL },
 	.mismatch = ANY_INIT_TO_ANY_EXIT,
 },
 {
@@ -1007,6 +996,8 @@
 
 static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym)
 {
+	Elf_Sym *new_sym;
+
 	/* If the supplied symbol has a valid name, return it */
 	if (is_valid_name(elf, sym))
 		return sym;
@@ -1015,8 +1006,9 @@
 	 * Strive to find a better symbol name, but the resulting name may not
 	 * match the symbol referenced in the original code.
 	 */
-	return symsearch_find_nearest(elf, addr, get_secindex(elf, sym),
-				      true, 20);
+	new_sym = symsearch_find_nearest(elf, addr, get_secindex(elf, sym),
+					 true, 20);
+	return new_sym ? new_sym : sym;
 }
 
 static bool is_executable_section(struct elf_info *elf, unsigned int secndx)
@@ -1050,7 +1042,9 @@
 	sec_mismatch_count++;
 
 	warn("%s: section mismatch in reference: %s+0x%x (section: %s) -> %s (section: %s)\n",
-	     modname, fromsym, (unsigned int)(faddr - from->st_value), fromsec, tosym, tosec);
+	     modname, fromsym,
+	     (unsigned int)(faddr - (from ? from->st_value : 0)),
+	     fromsec, tosym, tosec);
 
 	if (mismatch->mismatch == EXTABLE_TO_NON_TEXT) {
 		if (match(tosec, mismatch->bad_tosec))
@@ -1647,10 +1641,11 @@
 			namespace = get_next_modinfo(&info, "import_ns",
 						     namespace);
 		}
+
+		if (extra_warn && !get_modinfo(&info, "description"))
+			warn("missing MODULE_DESCRIPTION() in %s\n", modname);
 	}
 
-	if (extra_warn && !get_modinfo(&info, "description"))
-		warn("missing MODULE_DESCRIPTION() in %s\n", modname);
 	for (sym = info.symtab_start; sym < info.symtab_stop; sym++) {
 		symname = remove_dot(info.strtab + sym->st_name);
 
@@ -1900,13 +1895,17 @@
 static void add_versions(struct buffer *b, struct module *mod)
 {
 	struct symbol *s;
+	unsigned int name_len;
+	unsigned int name_len_padded;
+	unsigned int tmp;
+	unsigned char *tmp_view = (unsigned char *)&tmp;
 
 	if (!modversions)
 		return;
 
 	buf_printf(b, "\n");
-	buf_printf(b, "static const struct modversion_info ____versions[]\n");
-	buf_printf(b, "__used __section(\"__versions\") = {\n");
+	buf_printf(b, "static const char ____versions[]\n");
+	buf_printf(b, "__used __section(\"__versions\") =\n");
 
 	list_for_each_entry(s, &mod->unresolved_symbols, list) {
 		if (!s->module)
@@ -1916,16 +1915,27 @@
 				s->name, mod->name);
 			continue;
 		}
-		if (strlen(s->name) >= MODULE_NAME_LEN) {
-			error("too long symbol \"%s\" [%s.ko]\n",
-			      s->name, mod->name);
-			break;
-		}
-		buf_printf(b, "\t{ %#8x, \"%s\" },\n",
-			   s->crc, s->name);
+		name_len = strlen(s->name);
+		name_len_padded = (name_len + 1 + 3) & ~3;
+
+		/* Offset to next entry */
+		tmp = 8 + name_len_padded;
+		tmp = TO_NATIVE(tmp);
+		buf_printf(b, "\t\"\\x%02x\\x%02x\\x%02x\\x%02x",
+			   tmp_view[0], tmp_view[1], tmp_view[2], tmp_view[3]);
+
+		tmp = TO_NATIVE(s->crc);
+		buf_printf(b, "\\x%02x\\x%02x\\x%02x\\x%02x\"\n",
+			   tmp_view[0], tmp_view[1], tmp_view[2], tmp_view[3]);
+
+		buf_printf(b, "\t\"%s", s->name);
+		for (; name_len < name_len_padded; name_len++)
+			buf_printf(b, "\\0");
+		buf_printf(b, "\"\n");
 	}
 
-	buf_printf(b, "};\n");
+	/* Always end with a NULL entry */
+	buf_printf(b, "\t\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\";\n");
 }
 
 static void add_depends(struct buffer *b, struct module *mod)
--- linux-qcom-6.8.0.orig/scripts/module.lds.S
+++ linux-qcom-6.8.0/scripts/module.lds.S
@@ -13,6 +13,7 @@
 	/DISCARD/ : {
 		*(.discard)
 		*(.discard.*)
+		*(.export_symbol)
 	}
 
 	__ksymtab		0 : { *(SORT(___ksymtab+*)) }
--- linux-qcom-6.8.0.orig/scripts/package/builddeb
+++ linux-qcom-6.8.0/scripts/package/builddeb
@@ -113,16 +113,18 @@
 
 	# Parse modules.order directly because 'make modules_install' may sign,
 	# compress modules, and then run unneeded depmod.
-	while read -r mod; do
-		mod="${mod%.o}.ko"
-		dbg="${pdir}/usr/lib/debug/lib/modules/${KERNELRELEASE}/kernel/${mod}"
-		buildid=$("${READELF}" -n "${mod}" | sed -n 's@^.*Build ID: \(..\)\(.*\)@\1/\2@p')
-		link="${pdir}/usr/lib/debug/.build-id/${buildid}.debug"
+	if is_enabled CONFIG_MODULES; then
+		while read -r mod; do
+			mod="${mod%.o}.ko"
+			dbg="${pdir}/usr/lib/debug/lib/modules/${KERNELRELEASE}/kernel/${mod}"
+			buildid=$("${READELF}" -n "${mod}" | sed -n 's@^.*Build ID: \(..\)\(.*\)@\1/\2@p')
+			link="${pdir}/usr/lib/debug/.build-id/${buildid}.debug"
 
-		mkdir -p "${dbg%/*}" "${link%/*}"
-		"${OBJCOPY}" --only-keep-debug "${mod}" "${dbg}"
-		ln -sf --relative "${dbg}" "${link}"
-	done < modules.order
+			mkdir -p "${dbg%/*}" "${link%/*}"
+			"${OBJCOPY}" --only-keep-debug "${mod}" "${dbg}"
+			ln -sf --relative "${dbg}" "${link}"
+		done < modules.order
+	fi
 
 	# Build debug package
 	# Different tools want the image in different locations
--- linux-qcom-6.8.0.orig/scripts/package/mkdebian
+++ linux-qcom-6.8.0/scripts/package/mkdebian
@@ -236,6 +236,7 @@
 Package: linux-image-$version-dbg
 Section: debug
 Architecture: $debarch
+Build-Profiles: <!pkg.${sourcename}.nokerneldbg>
 Description: Linux kernel debugging symbols for $version
  This package will come in handy if you need to debug the kernel. It provides
  all the necessary debug symbols for the kernel and its modules.
--- linux-qcom-6.8.0.orig/scripts/rust_is_available.sh
+++ linux-qcom-6.8.0/scripts/rust_is_available.sh
@@ -129,8 +129,12 @@
 # Check that the Rust bindings generator is suitable.
 #
 # Non-stable and distributions' versions may have a version suffix, e.g. `-dev`.
+#
+# The dummy parameter `workaround-for-0.69.0` is required to support 0.69.0
+# (https://github.com/rust-lang/rust-bindgen/pull/2678). It can be removed when
+# the minimum version is upgraded past that (0.69.1 already fixed the issue).
 rust_bindings_generator_output=$( \
-	LC_ALL=C "$BINDGEN" --version 2>/dev/null
+	LC_ALL=C "$BINDGEN" --version workaround-for-0.69.0 2>/dev/null
 ) || rust_bindings_generator_code=$?
 if [ -n "$rust_bindings_generator_code" ]; then
 	echo >&2 "***"
--- linux-qcom-6.8.0.orig/scripts/setlocalversion
+++ linux-qcom-6.8.0/scripts/setlocalversion
@@ -30,6 +30,27 @@
 	usage
 fi
 
+try_tag() {
+	tag="$1"
+
+	# Is $tag an annotated tag?
+	[ "$(git cat-file -t "$tag" 2> /dev/null)" = tag ] || return 1
+
+	# Is it an ancestor of HEAD, and if so, how many commits are in $tag..HEAD?
+	# shellcheck disable=SC2046 # word splitting is the point here
+	set -- $(git rev-list --count --left-right "$tag"...HEAD 2> /dev/null)
+
+	# $1 is 0 if and only if $tag is an ancestor of HEAD. Use
+	# string comparison, because $1 is empty if the 'git rev-list'
+	# command somehow failed.
+	[ "$1" = 0 ] || return 1
+
+	# $2 is the number of commits in the range $tag..HEAD, possibly 0.
+	count="$2"
+
+	return 0
+}
+
 scm_version()
 {
 	local short=false
@@ -61,33 +82,33 @@
 	# stable kernel:    6.1.7      ->  v6.1.7
 	version_tag=v$(echo "${KERNELVERSION}" | sed -E 's/^([0-9]+\.[0-9]+)\.0(.*)$/\1\2/')
 
+	# try_tag initializes count if the tag is usable.
+	count=
+
 	# If a localversion* file exists, and the corresponding
 	# annotated tag exists and is an ancestor of HEAD, use
 	# it. This is the case in linux-next.
-	tag=${file_localversion#-}
-	desc=
-	if [ -n "${tag}" ]; then
-		desc=$(git describe --match=$tag 2>/dev/null)
+	if [ -n "${file_localversion#-}" ] ; then
+		try_tag "${file_localversion#-}"
 	fi
 
 	# Otherwise, if a localversion* file exists, and the tag
 	# obtained by appending it to the tag derived from
 	# KERNELVERSION exists and is an ancestor of HEAD, use
 	# it. This is e.g. the case in linux-rt.
-	if [ -z "${desc}" ] && [ -n "${file_localversion}" ]; then
-		tag="${version_tag}${file_localversion}"
-		desc=$(git describe --match=$tag 2>/dev/null)
+	if [ -z "${count}" ] && [ -n "${file_localversion}" ]; then
+		try_tag "${version_tag}${file_localversion}"
 	fi
 
 	# Otherwise, default to the annotated tag derived from KERNELVERSION.
-	if [ -z "${desc}" ]; then
-		tag="${version_tag}"
-		desc=$(git describe --match=$tag 2>/dev/null)
+	if [ -z "${count}" ]; then
+		try_tag "${version_tag}"
 	fi
 
-	# If we are at the tagged commit, we ignore it because the version is
-	# well-defined.
-	if [ "${tag}" != "${desc}" ]; then
+	# If we are at the tagged commit, we ignore it because the
+	# version is well-defined. If none of the attempted tags exist
+	# or were usable, $count is still empty.
+	if [ -z "${count}" ] || [ "${count}" -gt 0 ]; then
 
 		# If only the short version is requested, don't bother
 		# running further git commands
@@ -95,14 +116,15 @@
 			echo "+"
 			return
 		fi
+
 		# If we are past the tagged commit, we pretty print it.
 		# (like 6.1.0-14595-g292a089d78d3)
-		if [ -n "${desc}" ]; then
-			echo "${desc}" | awk -F- '{printf("-%05d", $(NF-1))}'
+		if [ -n "${count}" ]; then
+			printf "%s%05d" "-" "${count}"
 		fi
 
 		# Add -g and exactly 12 hex chars.
-		printf '%s%s' -g "$(echo $head | cut -c1-12)"
+		printf '%s%.12s' -g "$head"
 	fi
 
 	if ${no_dirty}; then
--- linux-qcom-6.8.0.orig/scripts/sorttable.h
+++ linux-qcom-6.8.0/scripts/sorttable.h
@@ -110,7 +110,7 @@
 
 static int orc_sort_cmp(const void *_a, const void *_b)
 {
-	struct orc_entry *orc_a;
+	struct orc_entry *orc_a, *orc_b;
 	const int *a = g_orc_ip_table + *(int *)_a;
 	const int *b = g_orc_ip_table + *(int *)_b;
 	unsigned long a_val = orc_ip(a);
@@ -128,6 +128,9 @@
 	 * whitelisted .o files which didn't get objtool generation.
 	 */
 	orc_a = g_orc_table + (a - g_orc_ip_table);
+	orc_b = g_orc_table + (b - g_orc_ip_table);
+	if (orc_a->type == ORC_TYPE_UNDEFINED && orc_b->type == ORC_TYPE_UNDEFINED)
+		return 0;
 	return orc_a->type == ORC_TYPE_UNDEFINED ? -1 : 1;
 }
 
--- linux-qcom-6.8.0.orig/scripts/syscalltbl.sh
+++ linux-qcom-6.8.0/scripts/syscalltbl.sh
@@ -54,7 +54,7 @@
 
 grep -E "^[0-9]+[[:space:]]+$abis" "$infile" | {
 
-	while read nr abi name native compat ; do
+	while read nr abi name native compat noreturn; do
 
 		if [ $nxt -gt $nr ]; then
 			echo "error: $infile: syscall table is not sorted or duplicates the same syscall number" >&2
@@ -66,7 +66,21 @@
 			nxt=$((nxt + 1))
 		done
 
-		if [ -n "$compat" ]; then
+		if [ "$compat" = "-" ]; then
+			unset compat
+		fi
+
+		if [ -n "$noreturn" ]; then
+			if [ "$noreturn" != "noreturn" ]; then
+				echo "error: $infile: invalid string \"$noreturn\" in 'noreturn' column"
+				exit 1
+			fi
+			if [ -n "$compat" ]; then
+				echo "__SYSCALL_COMPAT_NORETURN($nr, $native, $compat)"
+			else
+				echo "__SYSCALL_NORETURN($nr, $native)"
+			fi
+		elif [ -n "$compat" ]; then
 			echo "__SYSCALL_WITH_COMPAT($nr, $native, $compat)"
 		elif [ -n "$native" ]; then
 			echo "__SYSCALL($nr, $native)"
--- linux-qcom-6.8.0.orig/security/Kconfig
+++ linux-qcom-6.8.0/security/Kconfig
@@ -19,6 +19,47 @@
 
 	  If you are unsure how to answer this question, answer N.
 
+config SECURITY_PERF_EVENTS_RESTRICT
+	bool "Restrict unprivileged use of performance events"
+	depends on PERF_EVENTS
+	help
+	  If you say Y here, the kernel.perf_event_paranoid sysctl
+	  will be set to 3 by default, and no unprivileged use of the
+	  perf_event_open syscall will be permitted unless it is
+	  changed.
+
+choice
+	prompt "Allow /proc/pid/mem access override"
+	default PROC_MEM_ALWAYS_FORCE
+	help
+	  Traditionally /proc/pid/mem allows users to override memory
+	  permissions for users like ptrace, assuming they have ptrace
+	  capability.
+
+	  This allows people to limit that - either never override, or
+	  require actual active ptrace attachment.
+
+	  Defaults to the traditional behavior (for now)
+
+config PROC_MEM_ALWAYS_FORCE
+	bool "Traditional /proc/pid/mem behavior"
+	help
+	  This allows /proc/pid/mem accesses to override memory mapping
+	  permissions if you have ptrace access rights.
+
+config PROC_MEM_FORCE_PTRACE
+	bool "Require active ptrace() use for access override"
+	help
+	  This allows /proc/pid/mem accesses to override memory mapping
+	  permissions for active ptracers like gdb.
+
+config PROC_MEM_NO_FORCE
+	bool "Never"
+	help
+	  Never override memory mapping permissions
+
+endchoice
+
 config SECURITY
 	bool "Enable different security models"
 	depends on SYSFS
--- linux-qcom-6.8.0.orig/security/apparmor/Kconfig
+++ linux-qcom-6.8.0/security/apparmor/Kconfig
@@ -105,6 +105,18 @@
 	  includes policy, and has some form of integrity check.
 	  Disabling the check will speed up policy loads.
 
+config SECURITY_APPARMOR_RESTRICT_USERNS
+	bool "Restrict user namespace creation to confined domains"
+	depends on SECURITY_APPARMOR && USER_NS
+	default y
+	help
+	  This options allows controlling whether apparmor restricts
+	  the creation of new user namespaces to confined tasks by
+	  default. If set unconfined tasks without CAP_SYS_ADMIN
+	  will not be allowed to create new user namespaces. Confined
+	  tasks ability to create new user namespaces will be controlled
+	  by their profile.
+
 config SECURITY_APPARMOR_KUNIT_TEST
 	tristate "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS
 	depends on KUNIT && SECURITY_APPARMOR
--- linux-qcom-6.8.0.orig/security/apparmor/Makefile
+++ linux-qcom-6.8.0/security/apparmor/Makefile
@@ -6,7 +6,7 @@
 apparmor-y := apparmorfs.o audit.o capability.o task.o ipc.o lib.o match.o \
               path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \
               resource.o secid.o file.o policy_ns.o label.o mount.o net.o \
-              policy_compat.o
+              policy_compat.o af_unix.o af_inet.o notify.o
 apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o
 
 obj-$(CONFIG_SECURITY_APPARMOR_KUNIT_TEST) += apparmor_policy_unpack_test.o
--- linux-qcom-6.8.0.orig/security/apparmor/af_inet.c
+++ linux-qcom-6.8.0/security/apparmor/af_inet.c
@@ -0,0 +1,856 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor inet fine grained mediation
+ *
+ * Copyright 2024 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <net/tcp_states.h>
+
+#include "include/audit.h"
+#include "include/af_inet.h"
+#include "include/apparmor.h"
+#include "include/file.h"
+#include "include/label.h"
+#include "include/path.h"
+#include "include/policy.h"
+#include "include/cred.h"
+
+
+
+static inline aa_state_t RULE_MEDIATES_SK(struct aa_ruleset *rules,
+					  struct sock *sk)
+{
+	return RULE_MEDIATES_AF(rules, sk->sk_family);
+}
+
+
+enum addr_type {
+	ADDR_LOCAL = 0,
+	ADDR_LOCAL_PRIV	= 1,
+	ADDR_REMOTE = 2,
+};
+
+struct match_addr {
+	const char *addrp;
+	enum addr_type addrtype;
+	int len;
+	__be16 port;
+};
+
+struct stored_match_addr {
+	union {
+		struct sockaddr addr;
+		struct sockaddr_in addr4;
+		struct sockaddr_in6 addr6;
+	};
+	int addrlen;
+	struct match_addr maddr;
+};
+
+static void set_ad_create(struct apparmor_audit_data *ad,
+			 int family, int type, int protocol)
+{
+	ad->common.u.net->family = family;
+	ad->net.type = type;
+	ad->net.protocol = protocol;
+}
+
+static int set_ad_addr(struct apparmor_audit_data *ad,
+		       u16 family, bool source, struct match_addr *maddr)
+{
+	ad->common.u.net->family = family;
+
+	if (source) {
+		ad->common.u.net->sport = maddr->port;
+		if (maddr->addrp) {
+			if (family == AF_INET)
+				//ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
+				ad->common.u.net->v4info.saddr = *(__be32 *)maddr->addrp;
+			else
+				//ad.u.net->v4info.saddr = addr6->sin6_addr.s6_addr;
+				ad->common.u.net->v6info.saddr = *(struct in6_addr *)maddr->addrp;
+		}
+	} else {
+		ad->common.u.net->dport = maddr->port;
+		if (maddr->addrp) {
+			if (family == AF_INET)
+				//ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
+				ad->common.u.net->v4info.daddr = *(__be32 *)maddr->addrp;
+			else
+				//ad.u.net->v4info.saddr = addr6->sin6_addr.s6_addr;
+				ad->common.u.net->v6info.daddr = *(struct in6_addr *)maddr->addrp;
+		}
+	}
+	return 0;
+}
+
+/* returns 0 on success
+* raw_port - if set raw_port (protocol) when SOCK_RAW */
+static int map_addr(struct sockaddr *addr, int addrlen, u16 raw_port,
+		    enum addr_type addrtype, struct match_addr *maddr,
+		    struct apparmor_audit_data *ad)
+{
+	struct sockaddr_in *addr4 = NULL;
+	struct sockaddr_in6 *addr6 = NULL;
+
+	AA_BUG(!maddr);
+
+	maddr->addrtype = addrtype;
+	if (!addr || addrlen < offsetofend(struct sockaddr, sa_family)) {
+		maddr->addrp = NULL;
+		maddr->port = 0;
+		maddr->len = 0;
+		return 0;
+	}
+
+	/*
+	 * its possibly to have sk->sk_family == PF_INET6 and
+	 * addr->sa_family == AF_INET. sk_family is used for socket
+	 * mediation, sa_family for when we have address ...
+	 */
+	switch (addr->sa_family) {
+	case AF_INET:
+		addr4 = (struct sockaddr_in *)addr;
+		if (addrlen < sizeof(struct sockaddr_in))
+			return -EINVAL;
+		maddr->port = addr4->sin_port;
+		maddr->addrp = (char *)&addr4->sin_addr.s_addr;
+		maddr->len = 4;
+		break;
+	case AF_INET6:
+		addr6 = (struct sockaddr_in6 *)addr;
+		if (addrlen < SIN6_LEN_RFC2133)
+			return -EINVAL;
+		maddr->port = addr6->sin6_port;
+		maddr->addrp = (char *)&addr6->sin6_addr.s6_addr;
+		maddr->len = 16;
+		break;
+	default:
+		return -EAFNOSUPPORT;
+	}
+	/* per ip spec, && sk->sk_type == SOCK_RAW*/
+	if (raw_port && addrtype != ADDR_REMOTE)
+		maddr->port = raw_port;
+	if (ad)
+		set_ad_addr(ad, addr->sa_family, addrtype != ADDR_REMOTE, maddr);
+
+	return 0;
+}
+
+/* -ENOTCONN if not connected */
+static int map_sock_addr(struct socket *sock, enum addr_type addrtype,
+			 struct stored_match_addr *maddr,
+			 struct apparmor_audit_data *ad)
+{
+	/* do we need early bailout for !family ... */
+	maddr->addrlen = sock->ops->getname(sock, (struct sockaddr *) &maddr->addr, addrtype != ADDR_REMOTE ? 0 : 1);
+	if (maddr->addrlen == -ENOTCONN) {
+		maddr->addrlen = 0;
+		return map_addr(NULL, 0, 0, addrtype, &maddr->maddr, ad);
+	} else if (maddr->addrlen < 0)
+		return maddr->addrlen;
+	return map_addr(&maddr->addr, maddr->addrlen, 0, addrtype,
+			&maddr->maddr, ad);
+}
+
+/* TODO: combine with connect map addr */
+/* TODO: raw_port */
+static int bind_map_addr(struct sock *sk, struct sockaddr *addr, int addrlen,
+			 struct match_addr *maddr,
+			 struct apparmor_audit_data *ad)
+{
+	struct sockaddr_in *addr4 = NULL;
+	struct sockaddr_in6 *addr6 = NULL;
+	u16 family;
+
+	AA_BUG(!addr);
+	AA_BUG(!maddr);
+
+	if (addrlen < offsetofend(struct sockaddr, sa_family))
+		return -EINVAL;
+
+	maddr->addrtype = ADDR_LOCAL;
+	/*
+	 * its possibly to have sk->sk_family == PF_INET6 and
+	 * addr->sa_family == AF_INET. sk_family is used for socket
+	 * mediation, sa_family for when we have address ...
+	 */
+	family = addr->sa_family;
+	switch (addr->sa_family) {
+	case AF_UNSPEC:
+		if (sk->sk_family == PF_INET6) {
+			/* Length check from inet6_bind_sk() */
+			if (addrlen < SIN6_LEN_RFC2133)
+				return -EINVAL;
+			/* Family check from __inet6_bind() */
+			return -EAFNOSUPPORT;
+		}
+		/* see __inet_bind(), we only want to allow
+		 * AF_UNSPEC if the address is INADDR_ANY
+		 */
+		if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
+			return -EAFNOSUPPORT;
+		family = AF_INET;
+		fallthrough;
+	case AF_INET:
+		addr4 = (struct sockaddr_in *)addr;
+		if (addrlen < sizeof(struct sockaddr_in))
+			return -EINVAL;
+		maddr->port = addr4->sin_port;
+		maddr->addrp = (char *)&addr4->sin_addr.s_addr;
+		maddr->len = 4;
+		break;
+	case AF_INET6:
+		addr6 = (struct sockaddr_in6 *)addr;
+		if (addrlen < SIN6_LEN_RFC2133)
+			return -EINVAL;
+		maddr->port = addr6->sin6_port;
+		maddr->addrp = (char *)&addr6->sin6_addr.s6_addr;
+		maddr->len = 16;
+		break;
+	default:
+		return -EAFNOSUPPORT;
+	}
+
+	if (ad)
+		set_ad_addr(ad, family, true, maddr);
+
+	return 0;
+}
+
+/* only continue match if
+ *   insufficient current perms at current state
+ *   indicates there are more perms in later state
+ * Returns: perms struct if early match
+ */
+static struct aa_perms *early_match(struct aa_policydb *policy,
+				    aa_state_t state, u32 request)
+{
+	struct aa_perms *p;
+
+	p = aa_lookup_perms(policy, state);
+	if (((p->allow & request) != request) && (p->allow & AA_CONT_MATCH))
+		return NULL;
+	return p;
+}
+
+static int do_perms(struct aa_profile *profile, aa_state_t state, u32 request,
+		    struct aa_perms *p, struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_perms perms;
+
+	AA_BUG(!profile);
+
+	if (state || !p)
+		p = aa_lookup_perms(rules->policy, state);
+	perms = *p;
+	aa_apply_modes_to_perms(profile, &perms);
+	return aa_check_perms(profile, &perms, request, ad,
+			      audit_net_cb);
+}
+
+static aa_state_t match_addr(struct aa_dfa *dfa, aa_state_t state,
+			     struct match_addr *maddr)
+{
+	char l = (char) maddr->addrtype;
+
+	state = aa_dfa_match_len(dfa, state, &l, 1);
+	state = aa_dfa_match_len(dfa, state, (char *)&maddr->port, 2);
+	if (maddr->len == 0 && !maddr->addrp) {
+		l = 0;
+	} else if (maddr->len == 4) {
+		l = 1;
+	} else if (maddr->len == 16) {
+		l = 2;
+	} else {
+		AA_BUG("address length unsupported");
+		return 0;
+	}
+	state = aa_dfa_match_len(dfa, state, &l, 1);
+	if (maddr->addrp)
+		state = aa_dfa_match_len(dfa, state, maddr->addrp, maddr->len);
+	/* null transition between addr and label */
+	state = aa_dfa_null_transition(dfa, state);
+
+	return state;
+}
+
+
+static aa_state_t match_addr_info(struct aa_dfa *dfa, aa_state_t state,
+				  struct match_addr *maddr,
+				  const char **info)
+{
+	state = match_addr(dfa, state, maddr);
+	if (!state) {
+		*info = maddr->addrtype == ADDR_REMOTE ?
+			"failed remote addr match" :
+			"failed local addr match";
+	}
+
+	return state;
+}
+
+static aa_state_t match_addr_label(struct aa_policydb *policy, aa_state_t state,
+				   u32 request, struct match_addr *maddr,
+				   struct aa_perms **p, const char **info)
+{
+	state = match_addr_info(policy->dfa, state, maddr, info);
+	*p = early_match(policy, state, request);
+	if (!*p) {
+		/* TODO: actual label match: */
+		if (!state) {
+			*info = maddr->addrtype == ADDR_REMOTE ?
+				"failed remote label match" :
+				"failed local label match";
+		}
+
+		/* null transition after label match */
+		state = aa_dfa_null_transition(policy->dfa, state);
+	}
+
+	return state;
+}
+
+
+/* passing in state returned by PROFILE_MEDIATES_AF */
+static aa_state_t match_to_prot(struct aa_policydb *policy, aa_state_t state,
+				u32 request, int type, int protocol,
+				struct aa_perms **p, const char **info)
+{
+	__be16 buffer;
+	buffer = cpu_to_be16((u16)type);
+	state = aa_dfa_match_len(policy->dfa, state, (char *) &buffer, 2);
+	if (!state)
+		*info = "failed type match";
+	*p = early_match(policy, state, request);
+	if (!*p) {
+		buffer = cpu_to_be16((u16)protocol);
+		state = aa_dfa_match_len(policy->dfa, state, (char *) &buffer,
+					 2);
+		if (!state)
+			*info = "failed protocol match";
+	}
+	return state;
+}
+
+static aa_state_t match_to_sk(struct aa_policydb *policy, aa_state_t state,
+			      u32 request, struct sock *sk,
+			      struct match_addr *maddr,
+			      struct aa_perms **p, const char **info)
+{
+	*p = NULL;
+	state = match_to_prot(policy, state, request, sk->sk_type,
+			      sk->sk_protocol, p, info);
+	if (*p || !state)
+		return state;
+	return match_addr_label(policy, state, request, maddr, p, info);
+}
+
+enum cmd_type {
+	CMD_ADDR = 1,
+	CMD_LISTEN = 2,
+	CMD_OPT = 4,
+};
+
+static inline aa_state_t match_to_cmd(struct aa_policydb *policy,
+				      aa_state_t state, u32 request,
+				      struct sock *sk, enum cmd_type cmd,
+				      struct match_addr *maddr,
+				      struct aa_perms **p, const char **info)
+{
+	state = match_to_sk(policy, state, request, sk, maddr, p, info);
+	if (!*p && state) {
+		char c = (char) cmd;
+		state = aa_dfa_match_len(policy->dfa, state, &c, 1);
+		if (!state)
+			*info = "failed cmd selection match";
+	}
+
+	return state;
+}
+
+/*
+static int match_label(struct aa_profile *profile, struct aa_profile *peer,
+			      aa_state_t state, u32 request,
+			      struct apparmor_audit_data *ad)
+{
+	AA_BUG(!profile);
+	AA_BUG(!peer);
+
+	ad->peer = &peer->label;
+
+	if (state) {
+		state = aa_dfa_match(profile->policy.dfa, state,
+				     peer->base.hname);
+		if (!state)
+			ad->info = "failed peer label match";
+	}
+	return do_perms(profile, state, request, ad);
+}
+*/
+
+/* ---------------------------------------------------------------------- */
+
+
+
+static inline int profile_sk_perm(struct aa_profile *profile, u32 request,
+				    struct sock *sk, struct match_addr *maddr,
+				    struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules),
+						    list);
+	struct aa_perms *p = NULL;
+	aa_state_t state;
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+
+	state = RULE_MEDIATES_AF(rules, sk->sk_family);
+	if (state) {
+		state = match_to_sk(rules->policy, state, request, sk,
+				    maddr, &p, &ad->info);
+		return do_perms(profile, state, request, p, ad);
+	}
+
+	return aa_profile_af_sk_perm(profile, ad, request, sk);
+}
+
+/* no kernel_t bailout */
+static int profile_create_perm(struct aa_profile *profile, int family,
+			       int type, int protocol,
+			       struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_perms *p = NULL;
+	aa_state_t state;
+
+	AA_BUG(!profile);
+
+	state = RULE_MEDIATES_AF(rules, family);
+	if (state) {
+		state = match_to_prot(rules->policy, state, AA_MAY_CREATE,
+				      type, protocol, &p, &ad->info);
+		return do_perms(profile, state, AA_MAY_CREATE, p, ad);
+	}
+
+	return aa_profile_af_perm(profile, ad, AA_MAY_CREATE, family, type);
+}
+
+
+/* sendmsg/rcvmsg/connect */
+static int profile_remote_perm(struct aa_profile *profile, struct sock *sk,
+			       u32 request, struct match_addr *raddr,
+			       struct match_addr *laddr,
+			       struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_perms *p = NULL;
+	aa_state_t state;
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	AA_BUG(!raddr);
+	AA_BUG(!laddr);
+	AA_BUG(sk->sk_family != PF_INET && sk->sk_family != PF_INET6,
+	       "family=%d", sk->sk_family);
+
+	state = RULE_MEDIATES_SK(rules, sk);
+	if (!state)
+		return aa_profile_af_sk_perm(profile, ad, request, sk);
+
+	/* TODO: deal with sa_family vs. sk_family */
+	state = match_to_cmd(rules->policy, state, request, sk, CMD_ADDR,
+			     raddr, &p, &ad->info);
+	if (state && !p)
+		/* check if perm is restricted to a pairing */
+		state = match_addr_label(rules->policy, state, request,
+					 laddr, &p, &ad->info);
+	return do_perms(profile, state, request, p, ad);
+}
+
+static int profile_bind_perm(struct aa_profile *profile, struct sock *sk,
+			     struct match_addr *maddr,
+			     struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_perms *p = NULL;
+	aa_state_t state;
+	unsigned short sport;
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	AA_BUG(!maddr);
+	AA_BUG(sk->sk_family != PF_INET && sk->sk_family != PF_INET6,
+	       "family=%d", sk->sk_family);
+
+	state = RULE_MEDIATES_SK(rules, sk);
+	if (!state)
+		return aa_profile_af_sk_perm(profile, ad, AA_MAY_BIND, sk);
+
+	/*
+	 * its possibly to have sk->sk_family == PF_INET6 and
+	 * addr->sa_family == AF_INET
+	 */
+	sport = ntohs(maddr->port);
+	if (sport) {
+		if (inet_port_requires_bind_service(sock_net(sk), sport)) {
+			/* cap NET_BIND_SERVICE will get raised */
+			maddr->addrtype = ADDR_LOCAL_PRIV;
+		}
+	}
+	state = match_to_sk(rules->policy, state, AA_MAY_BIND, sk,
+			    maddr, &p, &ad->info);
+	return do_perms(profile, state, AA_MAY_BIND, p, ad);
+}
+
+static int profile_listen_perm(struct aa_profile *profile, struct sock *sk,
+			       struct match_addr *maddr, int backlog,
+			       struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_perms *p = NULL;
+	aa_state_t state;
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	AA_BUG(!maddr);
+	AA_BUG(sk->sk_family != PF_INET && sk->sk_family != PF_INET6,
+	       "family=%d", sk->sk_family);
+
+	state = RULE_MEDIATES_SK(rules, sk);
+	if (state) {
+		__be16 b = htons(backlog);
+
+		state = match_to_cmd(rules->policy, state, AA_MAY_LISTEN, sk,
+				     CMD_LISTEN, maddr, &p, &ad->info);
+		if (state && !p) {
+			state = aa_dfa_match_len(rules->policy->dfa, state,
+						 (char *) &b, 2);
+			if (!state)
+				ad->info = "failed listen backlog match";
+		}
+		return do_perms(profile, state, AA_MAY_LISTEN, p, ad);
+	}
+
+	return aa_profile_af_sk_perm(profile, ad, AA_MAY_LISTEN, sk);
+}
+
+static inline int profile_accept_perm(struct aa_profile *profile,
+				      struct sock *sk, struct match_addr *maddr,
+				      struct sock *newsk,
+				      struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_perms *p = NULL;
+	aa_state_t state;
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	/* AA_BUG(!newsk);  newsk can be null here, since not using atm ... */
+	AA_BUG(!maddr);
+	AA_BUG(sk->sk_family != PF_INET && sk->sk_family != PF_INET6,
+	       "family=%d", sk->sk_family);
+
+	state = RULE_MEDIATES_SK(rules, sk);
+	if (state) {
+		state = match_to_sk(rules->policy, state, AA_MAY_ACCEPT, sk,
+				    maddr, &p, &ad->info);
+		return do_perms(profile, state, AA_MAY_ACCEPT, p, ad);
+	}
+
+	return aa_profile_af_sk_perm(profile, ad, AA_MAY_ACCEPT, sk);
+}
+
+/* getopt/setopt */
+static int profile_opt_perm(struct aa_profile *profile, u32 request,
+			    struct sock *sk, struct match_addr *maddr,
+			    int level, int optname,
+			    struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_perms *p = NULL;
+	aa_state_t state;
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	AA_BUG(!maddr);
+	AA_BUG(sk->sk_family != PF_INET && sk->sk_family != PF_INET6,
+	       "family=%d", sk->sk_family);
+
+	state = RULE_MEDIATES_SK(rules, sk);
+	if (state) {
+		__be16 l = htons(l);
+		__be16 n = htons(optname);
+
+		state = match_to_cmd(rules->policy, state, request, sk,
+				     CMD_OPT, maddr, &p, &ad->info);
+		if (state && !p) {
+			state = aa_dfa_match_len(rules->policy->dfa, state,
+						 (char *) &l, 2);
+			state = aa_dfa_match_len(rules->policy->dfa, state,
+						 (char *) &n, 2);
+			if (!state)
+				ad->info = "failed sockopt match";
+		}
+		return do_perms(profile, state, request, p, ad);
+	}
+
+	return aa_profile_af_sk_perm(profile, ad, request, sk);
+}
+
+/* ---------------------------------------------------------------------- */
+
+// TODO: cleanup init to use recursion, so we can have N init fns, in 1 macro
+// TODO: lift DEFINE_AUDIT out of macro into init fn???
+
+/* no kernel_t bailout */
+#define label_sk_has_perm2(CRED, LABEL, SOCKSK, OP, REQUEST, PROFILE, AAD, XXXX, YYYY, CALLBACKFN) \
+({								\
+	int __EERROR = 0;					\
+	if (label_mediates(LABEL, AA_CLASS_NET)) {		\
+		struct aa_profile *PROFILE;			\
+		DEFINE_AUDIT_SK(AAD, OP, SOCKSK);		\
+		(AAD).subj_cred = (CRED);			\
+		__EERROR = (XXXX);				\
+		if (__EERROR == 0) {				\
+			__EERROR = (YYYY);			\
+			if (__EERROR == 0) {			\
+				__EERROR = fn_for_each(label, PROFILE,	\
+						       (CALLBACKFN));	\
+			}						\
+		}							\
+	}							\
+	__EERROR;						\
+})
+
+/* no kernel_t bailout */
+#define label_sk_has_perm(CRED, LABEL, SOCKSK, OP, REQUEST, PROFILE, AAD, CALLBACKFN) \
+	label_sk_has_perm2(CRED, LABEL, SOCKSK, OP, REQUEST, PROFILE, AAD, \
+			   0, 0, CALLBACKFN)
+
+/* no kernel_t bailout */
+#define label_sk_has_perm1(CRED, LABEL, SOCKSK, OP, REQUEST, PROFILE, AAD, XXXX, CALLBACKFN) \
+	label_sk_has_perm2(CRED, LABEL, SOCKSK, OP, REQUEST, PROFILE, AAD, \
+			   XXXX, 0, CALLBACKFN)
+
+
+/* Early bailout for kernel_t - 2 init args before callback */
+#define sk_has_perm2(SOCKSK, OP, REQUEST, PROFILE, AAD, XXXXY, YYYYX, CALLBACKFN) \
+({									\
+	struct aa_label *label;						\
+	struct aa_sk_ctx *ctx= aa_sock(SOCKSK);				\
+	int __ERROR = 0;						\
+	if (ctx->label != kernel_t) {					\
+									\
+		label = begin_current_label_crit_section();		\
+                __ERROR = label_sk_has_perm2(current_cred(), label, SOCKSK, OP, REQUEST, PROFILE, AAD, XXXXY, YYYYX, CALLBACKFN); \
+		end_current_label_crit_section(label);			\
+	}								\
+	__ERROR;							\
+})
+
+/* Early bailout for kernel_t - no init args before callback */
+#define sk_has_perm(SOCKSK, OP, REQUEST, PROFILE, AAD, CALLBACKFN)	\
+	sk_has_perm2(SOCKSK, OP, REQUEST, PROFILE, AAD, 0, 0, CALLBACKFN)
+
+
+/* Early bailout for kernel_t - 1 init arg before callback */
+#define sk_has_perm1(SOCKSK, OP, REQUEST, PROFILE, AAD, XXXXY, CALLBACKFN) \
+	sk_has_perm2(SOCKSK, OP, REQUEST, PROFILE, AAD, XXXXY, 0, CALLBACKFN)
+
+
+
+/* no kernel_t early bailout */
+/* NOTE: already lifted label_mediates into lsm.c */
+int aa_inet_create_perm(struct aa_label *label, int family, int type,
+			int protocol)
+{
+	struct aa_profile *profile;
+	int error = 0;
+	DEFINE_AUDIT_NET(ad, OP_CREATE, NULL, family, type, protocol);
+
+	ad.subj_cred = current_cred();
+	set_ad_create(&ad, family, type, protocol);
+	error = fn_for_each(label, profile,
+			    profile_create_perm(profile, family, type,
+						protocol, &ad));
+
+
+	return error;
+}
+
+int aa_inet_bind_perm(struct socket *sock, struct sockaddr *addr,
+		      int addrlen)
+{
+	struct match_addr maddr;
+
+	return sk_has_perm1(sock->sk, OP_BIND, AA_MAY_BIND, profile, ad,
+			    bind_map_addr(sock->sk, addr, addrlen, &maddr,
+					  &ad),
+			    profile_bind_perm(profile, sock->sk, &maddr, &ad));
+}
+
+
+int aa_inet_connect_perm(struct socket *sock, struct sockaddr *addr,
+			 int addrlen)
+{
+	struct stored_match_addr laddr;
+	struct match_addr raddr;
+
+	/* disconnect socket */
+	if (addr->sa_family == AF_UNSPEC)
+		return 0;
+	if (addrlen < offsetofend(struct sockaddr, sa_family))
+		return -EINVAL;
+
+	/* do we need early bailout for !family ... */
+	return sk_has_perm2(sock->sk, OP_CONNECT, AA_MAY_CONNECT, profile, ad,
+			    map_sock_addr(sock, ADDR_LOCAL, &laddr, &ad),
+			    map_addr(addr, addrlen, 0, ADDR_REMOTE, &raddr,
+				     &ad),
+			    profile_remote_perm(profile, sock->sk,
+						AA_MAY_CONNECT, &raddr,
+						&laddr.maddr, &ad));
+}
+
+int aa_inet_listen_perm(struct socket *sock, int backlog)
+{
+	struct stored_match_addr maddr;
+
+	/* do we need early bailout for !family ... */
+	return sk_has_perm1(sock->sk, OP_LISTEN, AA_MAY_LISTEN, profile, ad,
+			    map_sock_addr(sock, ADDR_LOCAL, &maddr, &ad),
+			    profile_listen_perm(profile, sock->sk, &maddr.maddr,
+						backlog, &ad));
+}
+
+/* ability of sock to connect, not peer address binding */
+int aa_inet_accept_perm(struct socket *sock, struct socket *newsock)
+{
+	struct stored_match_addr maddr;
+	int error;
+
+	error = sk_has_perm1(sock->sk, OP_ACCEPT, AA_MAY_ACCEPT, profile, ad,
+			     map_sock_addr(sock, ADDR_LOCAL, &maddr, &ad),
+			     profile_accept_perm(profile, sock->sk,
+						 &maddr.maddr,
+						 newsock->sk, &ad));
+
+	/* selinux updates inode - need to investigate this more */
+	return error;
+}
+
+/* sendmsg, recvmsg. */
+int aa_inet_msg_perm(const char *op, u32 request, struct socket *sock,
+		     struct msghdr *msg, int size)
+{
+	struct stored_match_addr laddr;
+	struct match_addr raddr;
+
+	/* do we need early bailout for !family ... */
+	return sk_has_perm2(sock->sk, op, request, profile, ad,
+			    map_sock_addr(sock, ADDR_LOCAL, &laddr, &ad),
+			    map_addr(msg->msg_name, msg->msg_namelen, 0,
+				     ADDR_REMOTE, &raddr, &ad),
+			    profile_remote_perm(profile, sock->sk, request,
+						&raddr, &laddr.maddr, &ad));
+}
+
+/* getopt, setopt */
+int aa_inet_opt_perm(const char *op, u32 request, struct socket *sock,
+		     int level, int optname)
+{
+	struct stored_match_addr maddr;
+
+	return sk_has_perm1(sock->sk, op, request, profile, ad,
+			    map_sock_addr(sock, ADDR_LOCAL, &maddr, &ad),
+			    profile_opt_perm(profile, request, sock->sk,
+					    &maddr.maddr, level, optname, &ad));
+}
+
+static int inet_label_sock_perm(const struct cred *cred, struct aa_label *label,
+				const char *op, u32 request,
+				struct socket *sock)
+{
+	struct stored_match_addr maddr;
+
+	return label_sk_has_perm1(cred, label, sock->sk, op, request, profile,
+				  ad,
+			map_sock_addr(sock, ADDR_LOCAL, &maddr, &ad),
+			profile_sk_perm(profile, request, sock->sk,
+					&maddr.maddr, &ad));
+}
+
+/* revaliation, get/set attr/getsockname/peername */
+int aa_inet_sock_perm(const char *op, u32 request, struct socket *sock)
+{
+	struct aa_sk_ctx *ctx= aa_sock(sock->sk);
+	struct aa_label *label;
+	int error;
+
+	if (ctx->label == kernel_t)
+		return 0;
+
+	label = begin_current_label_crit_section();
+	error = inet_label_sock_perm(current_cred(), label, op, request, sock);
+	end_current_label_crit_section(label);
+
+	return error;
+}
+
+int aa_inet_file_perm(const struct cred *subj_cred, struct aa_label *label,
+		      const char *op, u32 request, struct socket *sock)
+{
+	u32 sk_req = request & ~NET_PEER_MASK;
+	struct stored_match_addr laddr;
+	struct sock *sk = sock->sk;
+	int error = 0;
+
+	AA_BUG(!label);
+	AA_BUG(!sock);
+	AA_BUG(!sock->sk);
+	AA_BUG(sk->sk_family != PF_INET && sk->sk_family != PF_INET6,
+	       "family=%d", sk->sk_family);
+
+	/* access to the local sock */
+	error = label_sk_has_perm1(subj_cred, label, sock->sk, op, request,
+				   profile, ad,
+			map_sock_addr(sock, ADDR_LOCAL, &laddr, &ad),
+			profile_sk_perm(profile, sk_req, sock->sk, &laddr.maddr,
+					&ad));
+
+	if (!error) {
+		struct stored_match_addr laddr, raddr;
+
+		/* TODO: have ad here: instead of in CB so we do have to redo */
+		error = map_sock_addr(sock, ADDR_REMOTE, &raddr, NULL);
+		if (!error && raddr.maddr.addrp) {
+			error = label_sk_has_perm1(subj_cred, label, sock->sk,
+						   op, request, profile, ad,
+					set_ad_addr(&ad, raddr.addr.sa_family,
+						    false, &raddr.maddr),
+					profile_remote_perm(profile, sock->sk,
+							    request,
+							    &raddr.maddr,
+							    &laddr.maddr, &ad));
+		}
+	}
+
+	return error;
+}
--- linux-qcom-6.8.0.orig/security/apparmor/af_unix.c
+++ linux-qcom-6.8.0/security/apparmor/af_unix.c
@@ -0,0 +1,702 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor af_unix fine grained mediation
+ *
+ * Copyright 2018 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <net/tcp_states.h>
+
+#include "include/audit.h"
+#include "include/af_unix.h"
+#include "include/apparmor.h"
+#include "include/file.h"
+#include "include/label.h"
+#include "include/path.h"
+#include "include/policy.h"
+#include "include/cred.h"
+
+static inline struct sock *aa_unix_sk(struct unix_sock *u)
+{
+	return &u->sk;
+}
+
+static umode_t sock_i_mode(struct sock *sk)
+{
+	umode_t mode;
+
+	read_lock_bh(&sk->sk_callback_lock);
+	mode = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_mode : 0;
+	read_unlock_bh(&sk->sk_callback_lock);
+	return mode;
+}
+
+static inline int unix_fs_perm(const char *op, u32 mask,
+			       const struct cred *subj_cred,
+			       struct aa_label *label,
+			       struct unix_sock *u, int flags)
+{
+	AA_BUG(!label);
+	AA_BUG(!u);
+	AA_BUG(!UNIX_FS(aa_unix_sk(u)));
+
+	if (unconfined(label) || !label_mediates(label, AA_CLASS_FILE))
+		return 0;
+
+	mask &= NET_FS_PERMS;
+	if (!u->path.dentry) {
+		struct path_cond cond = {
+			.uid = sock_i_uid(&u->sk),
+			.mode = sock_i_mode(&u->sk),
+		};
+		struct aa_perms perms = { };
+		struct aa_profile *profile;
+
+		/* socket path has been cleared because it is being shutdown
+		 * can only fall back to original sun_path request
+		 */
+		struct aa_sk_ctx *ctx = aa_sock(&u->sk);
+
+		if (ctx->path.dentry)
+			return aa_path_perm(op, subj_cred, label, &ctx->path,
+					    flags, mask,
+					    &cond);
+		return fn_for_each_confined(label, profile,
+			((flags | profile->path_flags) & PATH_MEDIATE_DELETED) ?
+				__aa_path_perm(op, subj_cred, profile,
+					       u->addr->name->sun_path, mask,
+					       &cond, flags, &perms, false) :
+				aa_audit_file(subj_cred, profile, &nullperms,
+					      op, mask,
+					      u->addr->name->sun_path, NULL,
+					      NULL, cond.uid,
+					      "Failed name lookup - deleted entry",
+					      -EACCES, false));
+	} else {
+		/* the sunpath may not be valid for this ns so use the path */
+		struct path_cond cond = { u->path.dentry->d_inode->i_uid,
+					  u->path.dentry->d_inode->i_mode
+		};
+
+		return aa_path_perm(op, subj_cred, label, &u->path, flags,
+				    mask, &cond);
+	}
+
+	return 0;
+}
+
+/* passing in state returned by PROFILE_MEDIATES_AF */
+static unsigned int match_to_prot(struct aa_dfa *dfa,
+				  unsigned int state, int type, int protocol,
+				  const char **info)
+{
+	__be16 buffer[2];
+
+	buffer[0] = cpu_to_be16(type);
+	buffer[1] = cpu_to_be16(protocol);
+	state = aa_dfa_match_len(dfa, state, (char *) &buffer, 4);
+	if (!state)
+		*info = "failed type and protocol match";
+	return state;
+}
+
+static unsigned int match_addr(struct aa_dfa *dfa, unsigned int state,
+			       struct sockaddr_un *addr, int addrlen)
+{
+	if (addr)
+		/* include leading \0 */
+		state = aa_dfa_match_len(dfa, state, addr->sun_path,
+					 unix_addr_len(addrlen));
+	else
+		/* anonymous end point */
+		state = aa_dfa_match_len(dfa, state, "\x01", 1);
+	/* todo change to out of band */
+	state = aa_dfa_null_transition(dfa, state);
+	return state;
+}
+
+static unsigned int match_to_local(struct aa_dfa *dfa,
+				   unsigned int state, int type, int protocol,
+				   struct sockaddr_un *addr, int addrlen,
+				   const char **info)
+{
+	state = match_to_prot(dfa, state, type, protocol, info);
+	if (state) {
+		state = match_addr(dfa, state, addr, addrlen);
+		if (state) {
+			/* todo: local label matching */
+			state = aa_dfa_null_transition(dfa, state);
+			if (!state)
+				*info = "failed local label match";
+		} else
+			*info = "failed local address match";
+	}
+
+	return state;
+}
+
+static unsigned int match_to_sk(struct aa_dfa *dfa,
+				unsigned int state, struct unix_sock *u,
+				const char **info)
+{
+	struct sockaddr_un *addr = NULL;
+	int addrlen = 0;
+
+	if (u->addr) {
+		addr = u->addr->name;
+		addrlen = u->addr->len;
+	}
+
+	return match_to_local(dfa, state, u->sk.sk_type, u->sk.sk_protocol,
+			      addr, addrlen, info);
+}
+
+#define CMD_ADDR	1
+#define CMD_LISTEN	2
+#define CMD_OPT		4
+
+static inline unsigned int match_to_cmd(struct aa_dfa *dfa,
+					unsigned int state, struct unix_sock *u,
+					char cmd, const char **info)
+{
+	state = match_to_sk(dfa, state, u, info);
+	if (state) {
+		state = aa_dfa_match_len(dfa, state, &cmd, 1);
+		if (!state)
+			*info = "failed cmd selection match";
+	}
+
+	return state;
+}
+
+static inline unsigned int match_to_peer(struct aa_dfa *dfa,
+					 unsigned int state,
+					 struct unix_sock *u,
+					 struct sockaddr_un *peer_addr,
+					 int peer_addrlen,
+					 const char **info)
+{
+	state = match_to_cmd(dfa, state, u, CMD_ADDR, info);
+	if (state) {
+		state = match_addr(dfa, state, peer_addr, peer_addrlen);
+		if (!state)
+			*info = "failed peer address match";
+	}
+	return state;
+}
+
+static int do_perms(struct aa_profile *profile, struct aa_ruleset *rule,
+		    unsigned int state, u32 request,
+		    struct apparmor_audit_data *ad)
+{
+	struct aa_perms perms;
+
+	AA_BUG(!profile);
+
+	perms = *aa_lookup_perms(rule->policy, state);
+	aa_apply_modes_to_perms(profile, &perms);
+	return aa_check_perms(profile, &perms, request, ad,
+			      audit_net_cb);
+}
+
+static int match_label(struct aa_profile *profile, struct aa_ruleset *rule,
+		       struct aa_profile *peer, unsigned int state, u32 request,
+		       struct apparmor_audit_data *ad)
+{
+	AA_BUG(!profile);
+	AA_BUG(!peer);
+
+	ad->peer = &peer->label;
+
+	if (state) {
+		state = aa_dfa_match(rule->policy->dfa, state,
+				     peer->base.hname);
+		if (!state)
+			ad->info = "failed peer label match";
+	}
+	return do_perms(profile, rule, state, request, ad);
+}
+
+
+/* unix sock creation comes before we know if the socket will be an fs
+ * socket
+ * v6 - semantics are handled by mapping in profile load
+ * v7 - semantics require sock create for tasks creating an fs socket.
+ */
+static int profile_create_perm(struct aa_profile *profile, int family,
+			       int type, int protocol)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	aa_state_t state;
+	DEFINE_AUDIT_NET(ad, OP_CREATE, NULL, family, type, protocol);
+
+	AA_BUG(!profile);
+	AA_BUG(profile_unconfined(profile));
+
+	state = RULE_MEDIATES_AF(rules, AF_UNIX);
+	if (state) {
+		state = match_to_prot(rules->policy->dfa, state, type,
+				      protocol, &ad.info);
+		return do_perms(profile, rules, state, AA_MAY_CREATE, &ad);
+	}
+
+	return aa_profile_af_perm(profile, &ad, AA_MAY_CREATE, family, type);
+}
+
+int aa_unix_create_perm(struct aa_label *label, int family, int type,
+			int protocol)
+{
+	struct aa_profile *profile;
+
+	if (unconfined(label))
+		return 0;
+
+	return fn_for_each_confined(label, profile,
+			profile_create_perm(profile, family, type, protocol));
+}
+
+
+static inline int profile_sk_perm(struct aa_profile *profile,
+				  struct apparmor_audit_data *ad,
+				  u32 request, struct sock *sk)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules),
+						    list);
+	unsigned int state;
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	AA_BUG(UNIX_FS(sk));
+	AA_BUG(profile_unconfined(profile));
+
+	state = RULE_MEDIATES_AF(rules, AF_UNIX);
+	if (state) {
+		state = match_to_sk(rules->policy->dfa, state, unix_sk(sk),
+				    &ad->info);
+		return do_perms(profile, rules, state, request, ad);
+	}
+
+	return aa_profile_af_sk_perm(profile, ad, request, sk);
+}
+
+int aa_unix_label_sk_perm(const struct cred *subj_cred,
+			  struct aa_label *label, const char *op, u32 request,
+			  struct sock *sk)
+{
+	if (!unconfined(label)) {
+		struct aa_profile *profile;
+		DEFINE_AUDIT_SK(ad, op, sk);
+
+		ad.subj_cred = subj_cred;
+		return fn_for_each_confined(label, profile,
+				profile_sk_perm(profile, &ad, request, sk));
+	}
+	return 0;
+}
+
+static int unix_label_sock_perm(const struct cred *subj_cred,
+				struct aa_label *label, const char *op,
+				u32 request, struct socket *sock)
+{
+	if (unconfined(label))
+		return 0;
+	if (UNIX_FS(sock->sk))
+		return unix_fs_perm(op, request, subj_cred, label,
+				    unix_sk(sock->sk), 0);
+
+	return aa_unix_label_sk_perm(subj_cred, label, op, request, sock->sk);
+}
+
+/* revaliation, get/set attr */
+int aa_unix_sock_perm(const char *op, u32 request, struct socket *sock)
+{
+	struct aa_label *label;
+	int error;
+
+	label = begin_current_label_crit_section();
+	error = unix_label_sock_perm(current_cred(), label, op, request, sock);
+	end_current_label_crit_section(label);
+
+	return error;
+}
+
+static int profile_bind_perm(struct aa_profile *profile, struct sock *sk,
+			     struct sockaddr *addr, int addrlen)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	unsigned int state;
+	DEFINE_AUDIT_SK(ad, OP_BIND, sk);
+
+	ad.subj_cred = current_cred();
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	AA_BUG(addr->sa_family != AF_UNIX);
+	AA_BUG(profile_unconfined(profile));
+	AA_BUG(unix_addr_fs(addr, addrlen));
+
+	state = RULE_MEDIATES_AF(rules, AF_UNIX);
+	if (state) {
+		/* bind for abstract socket */
+		ad.net.addr = unix_addr(addr);
+		ad.net.addrlen = addrlen;
+
+		state = match_to_local(rules->policy->dfa, state,
+				       sk->sk_type, sk->sk_protocol,
+				       unix_addr(addr), addrlen,
+				       &ad.info);
+		return do_perms(profile, rules, state, AA_MAY_BIND, &ad);
+	}
+
+	return aa_profile_af_sk_perm(profile, &ad, AA_MAY_BIND, sk);
+}
+
+int aa_unix_bind_perm(struct socket *sock, struct sockaddr *address,
+		      int addrlen)
+{
+	struct aa_profile *profile;
+	struct aa_label *label;
+	int error = 0;
+
+	 label = begin_current_label_crit_section();
+	 /* fs bind is handled by mknod */
+	if (!(unconfined(label) || unix_addr_fs(address, addrlen)))
+		error = fn_for_each_confined(label, profile,
+				profile_bind_perm(profile, sock->sk, address,
+						  addrlen));
+	end_current_label_crit_section(label);
+
+	return error;
+}
+
+int aa_unix_connect_perm(struct socket *sock, struct sockaddr *address,
+			 int addrlen)
+{
+	/* unix connections are covered by the
+	 * - unix_stream_connect (stream) and unix_may_send hooks (dgram)
+	 * - fs connect is handled by open
+	 */
+	return 0;
+}
+
+static int profile_listen_perm(struct aa_profile *profile, struct sock *sk,
+			       int backlog)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	unsigned int state;
+	DEFINE_AUDIT_SK(ad, OP_LISTEN, sk);
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	AA_BUG(UNIX_FS(sk));
+	AA_BUG(profile_unconfined(profile));
+
+	state = RULE_MEDIATES_AF(rules, AF_UNIX);
+	if (state) {
+		__be16 b = cpu_to_be16(backlog);
+
+		state = match_to_cmd(rules->policy->dfa, state, unix_sk(sk),
+				     CMD_LISTEN, &ad.info);
+		if (state) {
+			state = aa_dfa_match_len(rules->policy->dfa, state,
+						 (char *) &b, 2);
+			if (!state)
+				ad.info = "failed listen backlog match";
+		}
+		return do_perms(profile, rules, state, AA_MAY_LISTEN, &ad);
+	}
+
+	return aa_profile_af_sk_perm(profile, &ad, AA_MAY_LISTEN, sk);
+}
+
+int aa_unix_listen_perm(struct socket *sock, int backlog)
+{
+	struct aa_profile *profile;
+	struct aa_label *label;
+	int error = 0;
+
+	label = begin_current_label_crit_section();
+	if (!(unconfined(label) || UNIX_FS(sock->sk)))
+		error = fn_for_each_confined(label, profile,
+				profile_listen_perm(profile, sock->sk,
+						    backlog));
+	end_current_label_crit_section(label);
+
+	return error;
+}
+
+
+static inline int profile_accept_perm(struct aa_profile *profile,
+				      struct sock *sk,
+				      struct sock *newsk)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	unsigned int state;
+	DEFINE_AUDIT_SK(ad, OP_ACCEPT, sk);
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	AA_BUG(UNIX_FS(sk));
+	AA_BUG(profile_unconfined(profile));
+
+	state = RULE_MEDIATES_AF(rules, AF_UNIX);
+	if (state) {
+		state = match_to_sk(rules->policy->dfa, state, unix_sk(sk),
+				    &ad.info);
+		return do_perms(profile, rules, state, AA_MAY_ACCEPT, &ad);
+	}
+
+	return aa_profile_af_sk_perm(profile, &ad, AA_MAY_ACCEPT, sk);
+}
+
+/* ability of sock to connect, not peer address binding */
+int aa_unix_accept_perm(struct socket *sock, struct socket *newsock)
+{
+	struct aa_profile *profile;
+	struct aa_label *label;
+	int error = 0;
+
+	label = begin_current_label_crit_section();
+	if (!(unconfined(label) || UNIX_FS(sock->sk)))
+		error = fn_for_each_confined(label, profile,
+				profile_accept_perm(profile, sock->sk,
+						    newsock->sk));
+	end_current_label_crit_section(label);
+
+	return error;
+}
+
+
+/* dgram handled by unix_may_sendmsg, right to send on stream done at connect
+ * could do per msg unix_stream here
+ */
+/* sendmsg, recvmsg */
+int aa_unix_msg_perm(const char *op, u32 request, struct socket *sock,
+		     struct msghdr *msg, int size)
+{
+	return 0;
+}
+
+
+static int profile_opt_perm(struct aa_profile *profile, const char *op, u32 request,
+			    struct sock *sk, int level, int optname)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	unsigned int state;
+	DEFINE_AUDIT_SK(ad, op, sk);
+
+	AA_BUG(!profile);
+	AA_BUG(!sk);
+	AA_BUG(UNIX_FS(sk));
+	AA_BUG(profile_unconfined(profile));
+
+	state = RULE_MEDIATES_AF(rules, AF_UNIX);
+	if (state) {
+		__be16 b = cpu_to_be16(optname);
+
+		state = match_to_cmd(rules->policy->dfa, state, unix_sk(sk),
+				     CMD_OPT, &ad.info);
+		if (state) {
+			state = aa_dfa_match_len(rules->policy->dfa, state,
+						 (char *) &b, 2);
+			if (!state)
+				ad.info = "failed sockopt match";
+		}
+		return do_perms(profile, rules, state, request, &ad);
+	}
+
+	return aa_profile_af_sk_perm(profile, &ad, request, sk);
+}
+
+int aa_unix_opt_perm(const char *op, u32 request, struct socket *sock, int level,
+		     int optname)
+{
+	struct aa_profile *profile;
+	struct aa_label *label;
+	int error = 0;
+
+	label = begin_current_label_crit_section();
+	if (!(unconfined(label) || UNIX_FS(sock->sk)))
+		error = fn_for_each_confined(label, profile,
+				profile_opt_perm(profile, op, request,
+						 sock->sk, level, optname));
+	end_current_label_crit_section(label);
+
+	return error;
+}
+
+/* null peer_label is allowed, in which case the peer_sk label is used */
+static int profile_peer_perm(struct aa_profile *profile, const char *op, u32 request,
+			     struct sock *sk, struct sock *peer_sk,
+			     struct aa_label *peer_label,
+			     struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	unsigned int state;
+
+	AA_BUG(!profile);
+	AA_BUG(profile_unconfined(profile));
+	AA_BUG(!sk);
+	AA_BUG(!peer_sk);
+	AA_BUG(UNIX_FS(peer_sk));
+
+	state = RULE_MEDIATES_AF(rules, AF_UNIX);
+	if (state) {
+		struct aa_sk_ctx *peer_ctx = aa_sock(peer_sk);
+		struct aa_profile *peerp;
+		struct sockaddr_un *addr = NULL;
+		int len = 0;
+
+		if (unix_sk(peer_sk)->addr) {
+			addr = unix_sk(peer_sk)->addr->name;
+			len = unix_sk(peer_sk)->addr->len;
+		}
+		state = match_to_peer(rules->policy->dfa, state, unix_sk(sk),
+				      addr, len, &ad->info);
+		if (!peer_label)
+			peer_label = peer_ctx->label;
+		return fn_for_each_in_ns(peer_label, peerp,
+				match_label(profile, rules, peerp, state,
+					    request, ad));
+	}
+
+	return aa_profile_af_sk_perm(profile, ad, request, sk);
+}
+
+/**
+ *
+ * Requires: lock held on both @sk and @peer_sk
+ */
+int aa_unix_peer_perm(const struct cred *subj_cred,
+		      struct aa_label *label, const char *op, u32 request,
+		      struct sock *sk, struct sock *peer_sk,
+		      struct aa_label *peer_label)
+{
+	struct unix_sock *peeru = unix_sk(peer_sk);
+	struct unix_sock *u = unix_sk(sk);
+
+	AA_BUG(!label);
+	AA_BUG(!sk);
+	AA_BUG(!peer_sk);
+
+	if (UNIX_FS(aa_unix_sk(peeru))) {
+		return unix_fs_perm(op, request, subj_cred, label, peeru, 0);
+	} else if (UNIX_FS(aa_unix_sk(u))) {
+		return unix_fs_perm(op, request, subj_cred, label, u, 0);
+	} else {
+		struct aa_profile *profile;
+		DEFINE_AUDIT_SK(ad, op, sk);
+
+		ad.net.peer_sk = peer_sk;
+		ad.subj_cred = subj_cred;
+		/* TODO: ns!!! */
+		if (!net_eq(sock_net(sk), sock_net(peer_sk)))
+			;
+
+		if (unconfined(label))
+			return 0;
+
+		return fn_for_each_confined(label, profile,
+				profile_peer_perm(profile, op, request, sk,
+						  peer_sk, peer_label, &ad));
+	}
+}
+
+
+/* from net/unix/af_unix.c */
+static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
+{
+	if (unlikely(sk1 == sk2) || !sk2) {
+		unix_state_lock(sk1);
+		return;
+	}
+	if (sk1 < sk2) {
+		unix_state_lock(sk1);
+		unix_state_lock_nested(sk2, U_LOCK_SECOND);
+	} else {
+		unix_state_lock(sk2);
+		unix_state_lock_nested(sk1, U_LOCK_SECOND);
+	}
+}
+
+static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2)
+{
+	if (unlikely(sk1 == sk2) || !sk2) {
+		unix_state_unlock(sk1);
+		return;
+	}
+	unix_state_unlock(sk1);
+	unix_state_unlock(sk2);
+}
+
+int aa_unix_file_perm(const struct cred *subj_cred, struct aa_label *label,
+		      const char *op, u32 request, struct socket *sock)
+{
+	struct sock *peer_sk = NULL;
+	u32 sk_req = request & ~NET_PEER_MASK;
+	int error = 0;
+
+	AA_BUG(!label);
+	AA_BUG(!sock);
+	AA_BUG(!sock->sk);
+	AA_BUG(sock->sk->sk_family != AF_UNIX);
+
+	/* TODO: update sock label with new task label */
+	unix_state_lock(sock->sk);
+	peer_sk = unix_peer(sock->sk);
+	if (peer_sk)
+		sock_hold(peer_sk);
+	if (!unix_connected(sock) && sk_req) {
+		error = unix_label_sock_perm(subj_cred, label, op, sk_req,
+					     sock);
+		if (!error)
+			; // TODO: update label
+	}
+	unix_state_unlock(sock->sk);
+	if (!peer_sk)
+		return error;
+
+	unix_state_double_lock(sock->sk, peer_sk);
+	if (UNIX_FS(sock->sk)) {
+		error = unix_fs_perm(op, request, subj_cred, label,
+				     unix_sk(sock->sk),
+				     PATH_SOCK_COND);
+	} else if (UNIX_FS(peer_sk)) {
+		error = unix_fs_perm(op, request, subj_cred, label,
+				     unix_sk(peer_sk),
+				     PATH_SOCK_COND);
+	} else {
+		struct aa_sk_ctx *pctx = aa_sock(peer_sk);
+
+		if (sk_req)
+			error = aa_unix_label_sk_perm(subj_cred,
+						      label, op, sk_req,
+						      sock->sk);
+		last_error(error,
+			xcheck(aa_unix_peer_perm(subj_cred, label, op,
+						 MAY_READ | MAY_WRITE,
+						 sock->sk, peer_sk, NULL),
+			       aa_unix_peer_perm(sock->file ? sock->file->f_cred : NULL,
+						 pctx->label, op,
+						 MAY_READ | MAY_WRITE,
+						 peer_sk, sock->sk, label)));
+	}
+
+	unix_state_double_unlock(sock->sk, peer_sk);
+	sock_put(peer_sk);
+
+	return error;
+}
--- linux-qcom-6.8.0.orig/security/apparmor/apparmorfs.c
+++ linux-qcom-6.8.0/security/apparmor/apparmorfs.c
@@ -24,6 +24,7 @@
 #include <linux/zstd.h>
 #include <uapi/linux/major.h>
 #include <uapi/linux/magic.h>
+#include <uapi/linux/apparmor.h>
 
 #include "include/apparmor.h"
 #include "include/apparmorfs.h"
@@ -35,6 +36,7 @@
 #include "include/policy.h"
 #include "include/policy_ns.h"
 #include "include/resource.h"
+#include "include/path.h"
 #include "include/policy_unpack.h"
 #include "include/task.h"
 
@@ -609,6 +611,215 @@
 	.release	= ns_revision_release,
 };
 
+
+/* file hook fn for notificaions of policy actions */
+static int listener_release(struct inode *inode, struct file *file)
+{
+	struct aa_listener *listener = file->private_data;
+
+	if (!aa_current_policy_admin_capable(NULL))
+		return -EPERM;
+	if (listener)
+		aa_put_listener(listener);
+
+	return 0;
+}
+
+static int listener_open(struct inode *inode, struct file *file)
+{
+	struct aa_listener *listener;
+
+	if (!aa_current_policy_admin_capable(NULL))
+		return -EPERM;
+	listener = aa_new_listener(NULL, GFP_KERNEL);
+	if (!listener)
+		return -ENOMEM;
+	file->private_data = listener;
+	return 0;
+}
+
+/* todo: separate register and set filter */
+static long notify_set_filter(struct aa_listener *listener,
+			      unsigned long arg)
+{
+	struct apparmor_notif_filter *unotif;
+	struct aa_ns *ns = NULL;
+	long ret;
+	u16 size;
+	void __user *buf = (void __user *)arg;
+
+	if (copy_from_user(&size, buf, sizeof(size)))
+		return -EFAULT;
+	if (size < sizeof(unotif))
+		return -EINVAL;
+	/* size is capped at U16_MAX by data type */
+	unotif = kzalloc(size, GFP_KERNEL);
+	if (!unotif)
+		return -ENOMEM;
+
+	if (copy_from_user(unotif, buf, size)) {
+		ret = -EFAULT;
+		goto out;
+	}
+	ret = size;
+
+	/* todo validate to known modes */
+	listener->mask = unotif->modeset;
+	AA_DEBUG(DEBUG_UPCALL, "setting filter mask to 0x%x", listener->mask);
+	if (unotif->ns)
+		/* todo */
+		ns = NULL;
+	if (unotif->filter) {
+		struct aa_dfa *dfa;
+		void *pos = (void *) unotif + unotif->filter;
+
+		if (unotif->filter >= size ||
+		    ALIGN((size_t) pos, 8) != (size_t)pos) {
+			ret = -EINVAL;
+			goto out;
+		}
+		dfa = aa_dfa_unpack(pos, size - ((void *) unotif - pos),
+				    DFA_FLAG_VERIFY_STATES |
+				    TO_ACCEPT1_FLAG(YYTD_DATA32));
+		if (IS_ERR(dfa)) {
+			ret = PTR_ERR(dfa);
+			goto out;
+		}
+		listener->filter = dfa;
+	}
+	if (!aa_register_listener_proxy(listener, ns))
+		ret = -ENOMEM;
+
+out:
+	kfree(unotif);
+
+	return ret;
+}
+
+
+static long notify_user_recv(struct aa_listener *listener,
+			     unsigned long arg)
+{
+	u16 max_size;
+	void __user *buf = (void __user *)arg;
+
+	if (copy_from_user(&max_size, buf, sizeof(max_size)))
+		return -EFAULT;
+	/* size check handled by individual message handlers */
+	return aa_listener_unotif_recv(listener, buf, max_size);
+}
+
+static long notify_user_response(struct aa_listener *listener,
+				 unsigned long arg)
+{
+	union apparmor_notif_resp uresp = {};
+	union apparmor_notif_resp *big_resp = NULL;
+	long error;
+	u16 size;
+	void __user *buf = (void __user *)arg;
+
+	if (copy_from_user(&size, buf, sizeof(size)))
+		return -EFAULT;
+	if (size > aa_g_path_max)
+		return -EMSGSIZE;
+	if (size > sizeof(uresp)) {
+		/* TODO: put max size on message */
+		big_resp = (union apparmor_notif_resp *) aa_get_buffer(false);
+		if (big_resp)
+			return -ENOMEM;
+		if (copy_from_user(big_resp, buf, size)) {
+			kfree(big_resp);
+			return -EFAULT;
+		}
+	} else {
+		size = min_t(size_t, size, sizeof(uresp));
+		if (copy_from_user(&uresp, buf, size))
+			return -EFAULT;
+	}
+
+	error = aa_listener_unotif_response(listener, &uresp, size);
+	aa_put_buffer((char *) big_resp);
+
+	return error;
+}
+
+static long notify_is_id_valid(struct aa_listener *listener,
+			       unsigned long arg)
+{
+	void __user *buf = (void __user *)arg;
+	u64 id;
+	long ret = -ENOENT;
+
+	if (copy_from_user(&id, buf, sizeof(id)))
+		return -EFAULT;
+
+	spin_lock(&listener->lock);
+	if (__aa_find_notif(listener, id))
+		ret = 0;
+	spin_unlock(&listener->lock);
+
+	return ret;
+}
+
+static long listener_ioctl(struct file *file, unsigned int cmd,
+			 unsigned long arg)
+{
+	struct aa_listener *listener = file->private_data;
+
+	if (!aa_current_policy_admin_capable(NULL))
+		return -EPERM;
+	if (!listener)
+		return -EINVAL;
+
+	/* todo permission to issue these commands */
+	switch (cmd) {
+	case APPARMOR_NOTIF_SET_FILTER:
+		return notify_set_filter(listener, arg);
+	case APPARMOR_NOTIF_RECV:
+		return notify_user_recv(listener, arg);
+	case APPARMOR_NOTIF_SEND:
+		return notify_user_response(listener, arg);
+	case APPARMOR_NOTIF_IS_ID_VALID:
+		return notify_is_id_valid(listener, arg);
+	default:
+		return -EINVAL;
+
+	}
+
+	return -EINVAL;
+}
+
+static __poll_t listener_poll(struct file *file, poll_table *pt)
+{
+	struct aa_listener *listener = file->private_data;
+	__poll_t mask = 0;
+
+	if (!aa_current_policy_admin_capable(NULL))
+		return -EPERM;
+
+	if (listener) {
+		spin_lock(&listener->lock);
+		poll_wait(file, &listener->wait, pt);
+		if (!list_empty(&listener->notifications))
+			mask |= EPOLLIN | EPOLLRDNORM;
+		if (!list_empty(&listener->pending))
+			mask |= EPOLLOUT | EPOLLWRNORM;
+		spin_unlock(&listener->lock);
+	}
+
+	return mask;
+}
+
+static const struct file_operations aa_sfs_notify_fops = {
+	.owner          = THIS_MODULE,
+	.open           = listener_open,
+	.poll           = listener_poll,
+//	.read           = notification_read,
+	.llseek         = generic_file_llseek,
+	.release        = listener_release,
+	.unlocked_ioctl = listener_ioctl,
+};
+
 static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,
 			     const char *match_str, size_t match_len)
 {
@@ -626,7 +837,8 @@
 		if (state) {
 			struct path_cond cond = { };
 
-			tmp = *(aa_lookup_fperms(rules->file, state, &cond));
+			tmp = *(aa_lookup_condperms(current_fsuid(),
+						    rules->file, state, &cond));
 		}
 	} else if (rules->policy->dfa) {
 		if (!RULE_MEDIATES(rules, *match_str))
@@ -1122,10 +1334,24 @@
 	return 0;
 }
 
+static int seq_profile_learning_count_show(struct seq_file *seq, void *v)
+{
+	struct aa_proxy *proxy = seq->private;
+	struct aa_label *label = aa_get_label_rcu(&proxy->label);
+	struct aa_profile *profile = labels_profile(label);
+	int count = READ_ONCE(profile->learning_cache.size);
+
+	seq_printf(seq, "%d\n", count);
+	aa_put_label(label);
+
+	return 0;
+}
+
 SEQ_PROFILE_FOPS(name);
 SEQ_PROFILE_FOPS(mode);
 SEQ_PROFILE_FOPS(attach);
 SEQ_PROFILE_FOPS(hash);
+SEQ_PROFILE_FOPS(learning_count);
 
 /*
  * namespace based files
@@ -1692,6 +1918,10 @@
 		struct aa_profile *p;
 		p = aa_deref_parent(profile);
 		dent = prof_dir(p);
+		if (!dent) {
+			error = -ENOENT;
+			goto fail2;
+		}
 		/* adding to parent that previously didn't have children */
 		dent = aafs_create_dir("profiles", dent);
 		if (IS_ERR(dent))
@@ -1737,6 +1967,12 @@
 		goto fail;
 	profile->dents[AAFS_PROF_ATTACH] = dent;
 
+	dent = create_profile_file(dir, "learning_count", profile,
+				   &seq_profile_learning_count_fops);
+	if (IS_ERR(dent))
+		goto fail;
+	profile->dents[AAFS_PROF_LEARNING_COUNT] = dent;
+
 	if (profile->hash) {
 		dent = create_profile_file(dir, "sha256", profile,
 					   &seq_profile_hash_fops);
@@ -2311,6 +2547,12 @@
 	{ }
 };
 
+static struct aa_sfs_entry aa_sfs_entry_ipc[] = {
+	AA_SFS_FILE_STRING("posix_mqueue",
+			   "create read write open delete setattr getattr"),
+	{ }
+};
+
 static struct aa_sfs_entry aa_sfs_entry_ptrace[] = {
 	AA_SFS_FILE_STRING("mask", "read trace"),
 	{ }
@@ -2328,6 +2570,7 @@
 static struct aa_sfs_entry aa_sfs_entry_domain[] = {
 	AA_SFS_FILE_BOOLEAN("change_hat",	1),
 	AA_SFS_FILE_BOOLEAN("change_hatv",	1),
+	AA_SFS_FILE_BOOLEAN("unconfined_allowed_children",	1),
 	AA_SFS_FILE_BOOLEAN("change_onexec",	1),
 	AA_SFS_FILE_BOOLEAN("change_profile",	1),
 	AA_SFS_FILE_BOOLEAN("stack",		1),
@@ -2335,13 +2578,17 @@
 	AA_SFS_FILE_BOOLEAN("post_nnp_subset",	1),
 	AA_SFS_FILE_BOOLEAN("computed_longest_left",	1),
 	AA_SFS_DIR("attach_conditions",		aa_sfs_entry_attach),
+	AA_SFS_FILE_BOOLEAN("interruptible",		1),
 	AA_SFS_FILE_BOOLEAN("disconnected.path",            1),
+	AA_SFS_FILE_BOOLEAN("kill.signal",		1),
 	AA_SFS_FILE_STRING("version", "1.2"),
 	{ }
 };
 
 static struct aa_sfs_entry aa_sfs_entry_unconfined[] = {
 	AA_SFS_FILE_BOOLEAN("change_profile", 1),
+	AA_SFS_FILE_BOOLEAN("userns",	1),
+	AA_SFS_FILE_BOOLEAN("io_uring",	1),
 	{ }
 };
 
@@ -2354,13 +2601,17 @@
 	{ }
 };
 
+/* permstable v1: skipped
+              v2: accept1 index, no accept2
+              v3: accept1 index, accept2 flags
+*/
 #define PERMS32STR "allow deny subtree cond kill complain prompt audit quiet hide xindex tag label"
 static struct aa_sfs_entry aa_sfs_entry_policy[] = {
 	AA_SFS_DIR("versions",			aa_sfs_entry_versions),
 	AA_SFS_FILE_BOOLEAN("set_load",		1),
 	/* number of out of band transitions supported */
 	AA_SFS_FILE_U64("outofband",		MAX_OOB_SUPPORTED),
-	AA_SFS_FILE_U64("permstable32_version",	1),
+	AA_SFS_FILE_U64("permstable32_version",	3),
 	AA_SFS_FILE_STRING("permstable32", PERMS32STR),
 	AA_SFS_DIR("unconfined_restrictions",   aa_sfs_entry_unconfined),
 	{ }
@@ -2376,6 +2627,12 @@
 	AA_SFS_FILE_BOOLEAN("profile",		1),
 	AA_SFS_FILE_BOOLEAN("pivot_root",	0),
 	AA_SFS_FILE_STRING("mask", "userns_create"),
+	AA_SFS_FILE_STRING("userns_create", "pciu&"),
+	{ }
+};
+
+static struct aa_sfs_entry aa_sfs_entry_dbus[] = {
+	AA_SFS_FILE_STRING("mask", "acquire send receive"),
 	{ }
 };
 
@@ -2400,7 +2657,9 @@
 	AA_SFS_DIR("policy",			aa_sfs_entry_policy),
 	AA_SFS_DIR("domain",			aa_sfs_entry_domain),
 	AA_SFS_DIR("file",			aa_sfs_entry_file),
+	AA_SFS_DIR("ipc",			aa_sfs_entry_ipc),
 	AA_SFS_DIR("network_v8",		aa_sfs_entry_network),
+	AA_SFS_DIR("network",			aa_sfs_entry_network_compat),
 	AA_SFS_DIR("mount",			aa_sfs_entry_mount),
 	AA_SFS_DIR("namespaces",		aa_sfs_entry_ns),
 	AA_SFS_FILE_U64("capability",		VFS_CAP_FLAGS_MASK),
@@ -2408,6 +2667,7 @@
 	AA_SFS_DIR("caps",			aa_sfs_entry_caps),
 	AA_SFS_DIR("ptrace",			aa_sfs_entry_ptrace),
 	AA_SFS_DIR("signal",			aa_sfs_entry_signal),
+	AA_SFS_DIR("dbus",			aa_sfs_entry_dbus),
 	AA_SFS_DIR("query",			aa_sfs_entry_query),
 	AA_SFS_DIR("io_uring",			aa_sfs_entry_io_uring),
 	{ }
@@ -2415,6 +2675,7 @@
 
 static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {
 	AA_SFS_FILE_FOPS(".access", 0666, &aa_sfs_access),
+	AA_SFS_FILE_FOPS(".notify", 0666, &aa_sfs_notify_fops),
 	AA_SFS_FILE_FOPS(".stacked", 0444, &seq_ns_stacked_fops),
 	AA_SFS_FILE_FOPS(".ns_stacked", 0444, &seq_ns_nsstacked_fops),
 	AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops),
--- linux-qcom-6.8.0.orig/security/apparmor/audit.c
+++ linux-qcom-6.8.0/security/apparmor/audit.c
@@ -192,7 +192,7 @@
 	aa_audit_msg(type, ad, cb);
 
 	if (ad->type == AUDIT_APPARMOR_KILL)
-		(void)send_sig_info(SIGKILL, NULL,
+		(void)send_sig_info(profile->signal, NULL,
 			ad->common.type == LSM_AUDIT_DATA_TASK &&
 			ad->common.u.tsk ? ad->common.u.tsk : current);
 
@@ -206,10 +206,14 @@
 	struct aa_label *label;
 };
 
-void aa_audit_rule_free(void *vrule)
+/****************************** audit rules *******************************/
+
+void aa_audit_rule_free(void *vrule, int lsmid)
 {
 	struct aa_audit_rule *rule = vrule;
 
+	if (lsmid != LSM_ID_UNDEF || lsmid != LSM_ID_APPARMOR)
+		return;
 	if (rule) {
 		if (!IS_ERR(rule->label))
 			aa_put_label(rule->label);
@@ -217,10 +221,13 @@
 	}
 }
 
-int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
+int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule,
+		       int lsmid, gfp_t gfp)
 {
 	struct aa_audit_rule *rule;
 
+	if (lsmid != LSM_ID_UNDEF || lsmid != LSM_ID_APPARMOR)
+		return 0;
 	switch (field) {
 	case AUDIT_SUBJ_ROLE:
 		if (op != Audit_equal && op != Audit_not_equal)
@@ -230,17 +237,17 @@
 		return -EINVAL;
 	}
 
-	rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL);
+	rule = kzalloc(sizeof(struct aa_audit_rule), gfp);
 
 	if (!rule)
 		return -ENOMEM;
 
 	/* Currently rules are treated as coming from the root ns */
 	rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
-				     GFP_KERNEL, true, false);
+				     gfp, true, false);
 	if (IS_ERR(rule->label)) {
 		int err = PTR_ERR(rule->label);
-		aa_audit_rule_free(rule);
+		aa_audit_rule_free(rule, LSM_ID_APPARMOR);
 		return err;
 	}
 
@@ -264,13 +271,17 @@
 	return 0;
 }
 
-int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)
+int aa_audit_rule_match(struct lsmblob *blob, u32 field, u32 op, void *vrule,
+			int lsmid)
 {
 	struct aa_audit_rule *rule = vrule;
 	struct aa_label *label;
 	int found = 0;
 
-	label = aa_secid_to_label(sid);
+	if (lsmid != LSM_ID_UNDEF || lsmid != LSM_ID_APPARMOR)
+		return 0;
+
+	label = blob->apparmor.label;
 
 	if (!label)
 		return -ENOENT;
@@ -289,3 +300,259 @@
 	}
 	return 0;
 }
+
+/****************************** audit cache *******************************/
+
+static int uid_cmp(kuid_t lhs, kuid_t rhs)
+{
+	if (uid_lt(lhs, rhs))
+		return -1;
+	if (uid_gt(lhs, rhs))
+		return 1;
+	return 0;
+}
+
+/* std C cmp.  negative is less than, 0 is equal, positive greater than */
+long aa_audit_data_cmp(struct apparmor_audit_data *lhs,
+		       struct apparmor_audit_data *rhs)
+{
+	long res;
+
+	/* don't compare type */
+	res = lhs->class - rhs->class;
+	if (res)
+		return res;
+	/* don't compare op */
+	if (lhs->flags & AUDIT_TAILGLOB_NAME)
+		/* lhs glob matches strings longer than it */
+		res = strncmp(lhs->name, rhs->name, strlen(lhs->name));
+	else
+		res = strcmp(lhs->name, rhs->name);
+	if (res)
+		return res;
+	res = aa_label_cmp(lhs->subj_label, rhs->subj_label);
+	if (res)
+		return res;
+	switch (lhs->class) {
+	case AA_CLASS_FILE:
+		if (lhs->subj_cred) {
+			if (rhs->subj_cred) {
+				return uid_cmp(lhs->subj_cred->fsuid,
+					       rhs->subj_cred->fsuid);
+			} else {
+				return 1;
+			}
+		} else if (rhs->subj_cred) {
+			return -1;
+		}
+		res = uid_cmp(lhs->fs.ouid, rhs->fs.ouid);
+		if (res)
+			return res;
+		res = lhs->fs.target - rhs->fs.target;
+		if (res)
+			return res;
+	}
+	return 0;
+}
+
+static void audit_node_free(struct aa_audit_node *node)
+{
+	if (!node)
+		return;
+
+	AA_BUG(!list_empty(&node->list));
+
+	/* common data that needs freed */
+	kfree(node->data.name);
+	aa_put_label(node->data.subj_label);
+	if (node->data.subj_cred)
+		put_cred(node->data.subj_cred);
+
+	/* class specific data that needs freed */
+	switch (node->data.class) {
+	case AA_CLASS_FILE:
+		aa_put_label(node->data.peer);
+		kfree(node->data.fs.target);
+	}
+
+	kmem_cache_free(aa_audit_slab, node);
+}
+
+void aa_audit_node_free_kref(struct kref *kref)
+{
+	struct aa_audit_node *node = container_of(kref, struct aa_audit_node,
+						  count);
+	audit_node_free(node);
+}
+
+struct aa_audit_node *aa_dup_audit_data(struct apparmor_audit_data *orig,
+					gfp_t gfp)
+{
+	struct aa_audit_node *copy;
+
+	copy = kmem_cache_zalloc(aa_audit_slab, gfp);
+	if (!copy)
+		return NULL;
+	kref_init(&copy->count);
+
+	copy->knotif.ad = &copy->data;
+	INIT_LIST_HEAD(&copy->list);
+	/* copy class early so aa_free_audit_node can use switch on failure */
+	copy->data.class = orig->class;
+	copy->data.flags = orig->flags;
+
+	/* handle anything with possible failure first */
+	if (orig->name) {
+		copy->data.name = kstrdup(orig->name, gfp);
+		if (!copy->data.name)
+			goto fail;
+	}
+	/* don't dup info */
+	switch (orig->class) {
+	case AA_CLASS_FILE:
+		if (orig->fs.target) {
+			copy->data.fs.target = kstrdup(orig->fs.target, gfp);
+			if (!copy->data.fs.target)
+				goto fail;
+		}
+		break;
+	case AA_CLASS_MOUNT:
+		if (orig->mnt.src_name) {
+			copy->data.mnt.src_name = kstrdup(orig->mnt.src_name, gfp);
+			if (!copy->data.mnt.src_name)
+				goto fail;
+		}
+		if (orig->mnt.type) {
+			copy->data.mnt.type = kstrdup(orig->mnt.type, gfp);
+			if (!copy->data.mnt.type)
+				goto fail;
+		}
+		// copy->mnt.trans; not used atm
+		if (orig->mnt.data) {
+			copy->data.mnt.data = kstrdup(orig->mnt.data, gfp);
+			if (!copy->data.mnt.data)
+				goto fail;
+		}
+		break;
+	}
+
+	/* now inc counts, and copy data that can't fail */
+	copy->data.error = orig->error;
+	copy->data.type = orig->type;
+	copy->data.request = orig->request;
+	copy->data.denied = orig->denied;
+	copy->data.subj_label = aa_get_label(orig->subj_label);
+
+	if (orig->subj_cred)
+		copy->data.subj_cred = get_cred(orig->subj_cred);
+
+	switch (orig->class) {
+	case AA_CLASS_NET:
+		/*
+		 * peer_sk;
+		 * addr;
+		 */
+		fallthrough;
+	case AA_CLASS_FILE:
+		copy->data.fs.ouid = orig->fs.ouid;
+		break;
+	case AA_CLASS_RLIMITS:
+	case AA_CLASS_SIGNAL:
+	case AA_CLASS_POSIX_MQUEUE:
+		copy->data.peer = aa_get_label(orig->peer);
+		break;
+/*
+ *	case AA_CLASS_IFACE:
+ *		copy->data.iface.profile = aa_get_label(orig.iface.profile);
+ *		break;
+ */
+	};
+
+
+	return copy;
+fail:
+	audit_node_free(copy);
+	return NULL;
+}
+
+#define __audit_cache_find(C, AD, COND...)				\
+({									\
+	struct aa_audit_node *__node;					\
+	list_for_each_entry_rcu(__node, &(C)->head, list, COND) {	\
+		if (aa_audit_data_cmp(&__node->data, AD) == 0)		\
+			goto __out_skip;				\
+	}								\
+	__node = NULL;							\
+__out_skip:								\
+	__node;								\
+})
+
+// increments refcount on node
+struct aa_audit_node *aa_audit_cache_find(struct aa_audit_cache *cache,
+					  struct apparmor_audit_data *ad)
+{
+	struct aa_audit_node *node;
+
+	rcu_read_lock();
+	node = __audit_cache_find(cache, ad);
+	aa_get_audit_node(node);
+	rcu_read_unlock();
+
+	return node;
+}
+
+/**
+ * aa_audit_cache_insert - insert an audit node into the cache
+ * @cache: the cache to insert into
+ * @node: the audit node to insert into the cache
+ *
+ * Returns: refcounted matching node in cache OR @node if @node was inserted.
+ *
+ * Increments refcount on node if successfully inserted. Assumes caller
+ *            already has valid ref count.
+ * Increments refcount on existing node if returned
+ */
+struct aa_audit_node *aa_audit_cache_insert(struct aa_audit_cache *cache,
+					    struct aa_audit_node *node)
+
+{
+	struct aa_audit_node *tmp;
+
+	spin_lock(&cache->lock);
+	tmp = __audit_cache_find(cache, &node->data,
+				 spin_is_lock(&cache->lock));
+	if (!tmp) {
+		list_add_rcu(&node->list, &cache->head);
+		tmp = node;
+		cache->size++;
+	}
+
+	aa_get_audit_node(tmp);
+	/* else raced another insert */
+	spin_unlock(&cache->lock);
+
+	return tmp;
+}
+
+void aa_audit_cache_update_ent(struct aa_audit_cache *cache,
+			       struct aa_audit_node *node,
+			       struct apparmor_audit_data *data)
+{
+	spin_lock(&cache->lock);
+	node->data.denied |= data->denied;
+	node->data.request = (node->data.request | data->request) &
+		~node->data.denied;
+	spin_unlock(&cache->lock);
+}
+
+/* assumes rcu callback has already happened and list can not be walked */
+void aa_audit_cache_destroy(struct aa_audit_cache *cache)
+{
+	struct aa_audit_node *node, *tmp;
+
+	list_for_each_entry_safe(node, tmp, &cache->head, list) {
+		list_del_init(&node->list);
+		aa_put_audit_node(node);
+	}
+	cache->size = 0;
+}
--- linux-qcom-6.8.0.orig/security/apparmor/capability.c
+++ linux-qcom-6.8.0/security/apparmor/capability.c
@@ -26,6 +26,7 @@
 
 struct aa_sfs_entry aa_sfs_entry_caps[] = {
 	AA_SFS_FILE_STRING("mask", AA_SFS_CAPS_MASK),
+	AA_SFS_FILE_BOOLEAN("extended", 1),
 	{ }
 };
 
@@ -96,6 +97,8 @@
 		return error;
 	} else {
 		aa_put_profile(ent->profile);
+		if (profile != ent->profile)
+			cap_clear(ent->caps);
 		ent->profile = aa_get_profile(profile);
 		cap_raise(ent->caps, cap);
 	}
@@ -118,8 +121,31 @@
 {
 	struct aa_ruleset *rules = list_first_entry(&profile->rules,
 						    typeof(*rules), list);
+	aa_state_t state;
 	int error;
 
+	state = RULE_MEDIATES(rules, ad->class);
+	if (state) {
+		struct aa_perms perms = { };
+		u32 request;
+
+		/* caps broken into 256 x 32 bit permission chunks */
+		state = aa_dfa_next(rules->policy->dfa, state, cap >> 5);
+		request = 1 << (cap & 0x1f);
+		perms = *aa_lookup_perms(rules->policy, state);
+		aa_apply_modes_to_perms(profile, &perms);
+
+		if (opts & CAP_OPT_NOAUDIT) {
+			if (perms.complain & request)
+				ad->info = "optional: no audit";
+			else
+				ad = NULL;
+		}
+		return aa_check_perms(profile, &perms, request, ad,
+				      audit_cb);
+	}
+
+	/* fallback to old caps mediation that doesn't support conditionals */
 	if (cap_raised(rules->caps.allow, cap) &&
 	    !cap_raised(rules->caps.denied, cap))
 		error = 0;
@@ -163,3 +189,35 @@
 
 	return error;
 }
+
+kernel_cap_t aa_profile_capget(struct aa_profile *profile)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	aa_state_t state;
+
+	state = RULE_MEDIATES(rules, AA_CLASS_CAP);
+	if (state) {
+		kernel_cap_t caps = CAP_EMPTY_SET;
+		int i;
+
+		/* caps broken into up to 256, 32 bit permission chunks */
+		for (i = 0; i < (CAP_LAST_CAP >> 5); i++) {
+			struct aa_perms perms = { };
+			aa_state_t tmp;
+
+			tmp = aa_dfa_next(rules->policy->dfa, state, i);
+			perms = *aa_lookup_perms(rules->policy, tmp);
+			aa_apply_modes_to_perms(profile, &perms);
+			caps.val |= ((u64)(perms.allow)) << (i *5);
+			caps.val |= ((u64)(perms.complain)) << (i *5);
+		}
+		return caps;
+	}
+
+	/* fallback to old caps */
+	if (COMPLAIN_MODE(profile))
+		return CAP_FULL_SET;
+
+	return rules->caps.allow;
+}
--- linux-qcom-6.8.0.orig/security/apparmor/crypto.c
+++ linux-qcom-6.8.0/security/apparmor/crypto.c
@@ -25,6 +25,26 @@
 	return apparmor_hash_size;
 }
 
+void aa_snprint_hashstr(char *out, unsigned char *hash, unsigned int hsize)
+{
+	unsigned int i;
+
+	for (i = 0; i < hsize; i++)
+		sprintf(out + i*2, "%.2x", hash[i]);
+	out[hsize*2] = 0;
+}
+
+char *aa_asprint_hashstr(unsigned char *hash, unsigned int hsize, gfp_t gfp)
+{
+	char *buffer = kmalloc(hsize*2 + 1, gfp);
+
+	if (!buffer)
+		return NULL;
+	aa_snprint_hashstr(buffer, hash, hsize);
+
+	return buffer;
+}
+
 char *aa_calc_hash(void *data, size_t len)
 {
 	SHASH_DESC_ON_STACK(desc, apparmor_tfm);
--- linux-qcom-6.8.0.orig/security/apparmor/domain.c
+++ linux-qcom-6.8.0/security/apparmor/domain.c
@@ -155,7 +155,8 @@
 		if (!state)
 			goto fail;
 	}
-	*perms = *(aa_lookup_fperms(rules->file, state, &cond));
+	*perms = *(aa_lookup_condperms(current_fsuid(), rules->file, state,
+				       &cond));
 	aa_apply_modes_to_perms(profile, perms);
 	if ((perms->allow & request) != request)
 		return -EACCES;
@@ -210,7 +211,8 @@
 	return 0;
 
 next:
-	tmp = *(aa_lookup_fperms(rules->file, state, &cond));
+	tmp = *(aa_lookup_condperms(current_fsuid(), rules->file, state,
+				    &cond));
 	aa_apply_modes_to_perms(profile, &tmp);
 	aa_perms_accum(perms, &tmp);
 	label_for_each_cont(i, label, tp) {
@@ -219,7 +221,8 @@
 		state = match_component(profile, tp, stack, start);
 		if (!state)
 			goto fail;
-		tmp = *(aa_lookup_fperms(rules->file, state, &cond));
+		tmp = *(aa_lookup_condperms(current_fsuid(), rules->file, state,
+					    &cond));
 		aa_apply_modes_to_perms(profile, &tmp);
 		aa_perms_accum(perms, &tmp);
 	}
@@ -324,7 +327,7 @@
 		size = vfs_getxattr_alloc(&nop_mnt_idmap, d, attach->xattrs[i],
 					  &value, value_size, GFP_KERNEL);
 		if (size >= 0) {
-			u32 index, perm;
+			struct aa_perms *perms;
 
 			/*
 			 * Check the xattr presence before value. This ensure
@@ -336,9 +339,8 @@
 			/* Check xattr value */
 			state = aa_dfa_match_len(attach->xmatch->dfa, state,
 						 value, size);
-			index = ACCEPT_TABLE(attach->xmatch->dfa)[state];
-			perm = attach->xmatch->perms[index].allow;
-			if (!(perm & MAY_EXEC)) {
+			perms = aa_lookup_perms(attach->xmatch, state);
+			if (!(perms->allow & MAY_EXEC)) {
 				ret = -EINVAL;
 				goto out;
 			}
@@ -416,15 +418,14 @@
 		if (attach->xmatch->dfa) {
 			unsigned int count;
 			aa_state_t state;
-			u32 index, perm;
+			struct aa_perms *perms;
 
 			state = aa_dfa_leftmatch(attach->xmatch->dfa,
 					attach->xmatch->start[AA_CLASS_XMATCH],
 					name, &count);
-			index = ACCEPT_TABLE(attach->xmatch->dfa)[state];
-			perm = attach->xmatch->perms[index].allow;
+			perms = aa_lookup_perms(attach->xmatch, state);
 			/* any accepting state means a valid match. */
-			if (perm & MAY_EXEC) {
+			if (perms->allow & MAY_EXEC) {
 				int ret = 0;
 
 				if (count < candidate_len)
@@ -509,6 +510,7 @@
  * @name: returns: name tested to find label (NOT NULL)
  *
  * Returns: refcounted label, or NULL on failure (MAYBE NULL)
+ *          @name will always be set with the last name tried
  */
 struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
 				const char **name)
@@ -518,6 +520,7 @@
 	struct aa_label *label = NULL;
 	u32 xtype = xindex & AA_X_TYPE_MASK;
 	int index = xindex & AA_X_INDEX_MASK;
+	const char *next;
 
 	AA_BUG(!name);
 
@@ -525,25 +528,26 @@
 	/* TODO: move lookup parsing to unpack time so this is a straight
 	 *       index into the resultant label
 	 */
-	for (*name = rules->file->trans.table[index]; !label && *name;
-	     *name = next_name(xtype, *name)) {
+	for (next = rules->file->trans.table[index]; next;
+	     next = next_name(xtype, next)) {
+		const char *lookup = (*next == '&') ? next + 1 : next;
+		*name = next;
 		if (xindex & AA_X_CHILD) {
-			struct aa_profile *new_profile;
-			/* release by caller */
-			new_profile = aa_find_child(profile, *name);
-			if (new_profile)
-				label = &new_profile->label;
+			/* TODO: switich to parse to get stack of child */
+			struct aa_profile *new = aa_find_child(profile, lookup);
+			if (new)
+				/* release by caller */
+				return &new->label;
 			continue;
 		}
-		label = aa_label_parse(&profile->label, *name, GFP_KERNEL,
+		label = aa_label_parse(&profile->label, lookup, GFP_KERNEL,
 				       true, false);
-		if (IS_ERR(label))
-			label = NULL;
+		if (!IS_ERR_OR_NULL(label))
+			/* release by caller */
+			return label;
 	}
 
-	/* released by caller */
-
-	return label;
+	return NULL;
 }
 
 /**
@@ -568,9 +572,9 @@
 	struct aa_ruleset *rules = list_first_entry(&profile->rules,
 						    typeof(*rules), list);
 	struct aa_label *new = NULL;
+	struct aa_label *stack = NULL;
 	struct aa_ns *ns = profile->ns;
 	u32 xtype = xindex & AA_X_TYPE_MASK;
-	const char *stack = NULL;
 
 	switch (xtype) {
 	case AA_X_NONE:
@@ -579,13 +583,13 @@
 		break;
 	case AA_X_TABLE:
 		/* TODO: fix when perm mapping done at unload */
-		stack = rules->file->trans.table[xindex & AA_X_INDEX_MASK];
-		if (*stack != '&') {
-			/* released by caller */
-			new = x_table_lookup(profile, xindex, lookupname);
-			stack = NULL;
+		/* released by caller
+		 * if null for both stack and direct want to try fallback*/
+		new = x_table_lookup(profile, xindex, lookupname);
+		if (!new || **lookupname != '&')
 			break;
-		}
+		stack = new;
+		new = NULL;
 		fallthrough;	/* to X_NAME */
 	case AA_X_NAME:
 		if (xindex & AA_X_CHILD)
@@ -600,6 +604,7 @@
 		break;
 	}
 
+	/* fallback transition check */
 	if (!new) {
 		if (xindex & AA_X_INHERIT) {
 			/* (p|c|n)ix - don't change profile but do
@@ -618,12 +623,12 @@
 		/* base the stack on post domain transition */
 		struct aa_label *base = new;
 
-		new = aa_label_parse(base, stack, GFP_KERNEL, true, false);
-		if (IS_ERR(new))
-			new = NULL;
+		new = aa_label_merge(base, stack, GFP_KERNEL);
+		/* null on error */
 		aa_put_label(base);
 	}
 
+	aa_put_label(stack);
 	/* released by caller */
 	return new;
 }
@@ -652,7 +657,7 @@
 	if (error) {
 		if (profile_unconfined(profile) ||
 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {
-			AA_DEBUG("name lookup ix on error");
+			AA_DEBUG(DEBUG_DOMAIN, "name lookup ix on error");
 			error = 0;
 			new = aa_get_newest_label(&profile->label);
 		}
@@ -664,10 +669,10 @@
 		new = find_attach(bprm, profile->ns,
 				  &profile->ns->base.profiles, name, &info);
 		if (new) {
-			AA_DEBUG("unconfined attached to new label");
+			AA_DEBUG(DEBUG_DOMAIN, "unconfined attached to new label");
 			return new;
 		}
-		AA_DEBUG("unconfined exec no attachment");
+		AA_DEBUG(DEBUG_DOMAIN, "unconfined exec no attachment");
 		return aa_get_newest_label(&profile->label);
 	}
 
@@ -681,12 +686,17 @@
 			/* hack ix fallback - improve how this is detected */
 			goto audit;
 		} else if (!new) {
-			error = -EACCES;
 			info = "profile transition not found";
-			/* remove MAY_EXEC to audit as failure */
+			/* remove MAY_EXEC to audit as failure or complaint */
 			perms.allow &= ~MAY_EXEC;
+			if (COMPLAIN_MODE(profile)) {
+				/* create null profile instead of failing */
+				goto create_learning_profile;
+			}
+			error = -EACCES;
 		}
 	} else if (COMPLAIN_MODE(profile)) {
+create_learning_profile:
 		/* no exec permission - learning mode */
 		struct aa_profile *new_profile = NULL;
 
@@ -719,9 +729,8 @@
 	}
 
 audit:
-	aa_audit_file(subj_cred, profile, &perms, OP_EXEC, MAY_EXEC, name,
-		      target, new,
-		      cond->uid, info, error);
+	aa_audit_file(subj_cred, profile, &perms, OP_EXEC, MAY_EXEC, name, target, new,
+		      cond->uid, info, error, true);
 	if (!new || nonewprivs) {
 		aa_put_label(new);
 		return ERR_PTR(error);
@@ -763,7 +772,7 @@
 	if (error) {
 		if (profile_unconfined(profile) ||
 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {
-			AA_DEBUG("name lookup ix on error");
+			AA_DEBUG(DEBUG_DOMAIN, "name lookup ix on error");
 			error = 0;
 		}
 		xname = bprm->filename;
@@ -801,7 +810,7 @@
 audit:
 	return aa_audit_file(subj_cred, profile, &perms, OP_EXEC,
 			     AA_MAY_ONEXEC, xname,
-			     NULL, onexec, cond->uid, info, error);
+			     NULL, onexec, cond->uid, info, error, false);
 }
 
 /* ensure none ns domain transitions are correctly applied with onexec */
@@ -858,7 +867,7 @@
 				      OP_CHANGE_ONEXEC,
 				      AA_MAY_ONEXEC, bprm->filename, NULL,
 				      onexec, GLOBAL_ROOT_UID,
-				      "failed to build target label", -ENOMEM));
+				      "failed to build target label", -ENOMEM, false));
 	return ERR_PTR(error);
 }
 
@@ -994,7 +1003,8 @@
 			aa_audit_file(current_cred(), profile, &nullperms,
 				      OP_EXEC, MAY_EXEC,
 				      bprm->filename, NULL, new,
-				      vfsuid_into_kuid(vfsuid), info, error));
+				      vfsuid_into_kuid(vfsuid), info, error,
+				      false));
 	aa_put_label(new);
 	goto done;
 }
@@ -1045,7 +1055,7 @@
 		      AA_MAY_CHANGEHAT,
 		      name, hat ? hat->base.hname : NULL,
 		      hat ? &hat->label : NULL, GLOBAL_ROOT_UID, info,
-		      error);
+		      error, false);
 	if (!hat || (error && error != -ENOENT))
 		return ERR_PTR(error);
 	/* if hat && error - complain mode, already audited and we adjust for
@@ -1138,7 +1148,7 @@
 			aa_audit_file(subj_cred, profile, &nullperms,
 				      OP_CHANGE_HAT,
 				      AA_MAY_CHANGEHAT, name, NULL, NULL,
-				      GLOBAL_ROOT_UID, info, error);
+				      GLOBAL_ROOT_UID, info, error, false);
 		}
 	}
 	return ERR_PTR(error);
@@ -1199,10 +1209,24 @@
 	if (task_no_new_privs(current) && !unconfined(label) && !ctx->nnp)
 		ctx->nnp = aa_get_label(label);
 
+	/* return -EPERM when unconfined doesn't have children to avoid
+	 * changing the traditional error code for unconfined.
+	 */
 	if (unconfined(label)) {
-		info = "unconfined can not change_hat";
-		error = -EPERM;
-		goto fail;
+		struct label_it i;
+		bool empty = true;
+
+		rcu_read_lock();
+		label_for_each_in_ns(i, labels_ns(label), label, profile) {
+			empty &= list_empty(&profile->base.profiles);
+		}
+		rcu_read_unlock();
+
+		if (empty) {
+			info = "unconfined can not change_hat";
+			error = -EPERM;
+			goto fail;
+		}
 	}
 
 	if (count) {
@@ -1227,7 +1251,8 @@
 		if (task_no_new_privs(current) && !unconfined(label) &&
 		    !aa_label_is_unconfined_subset(new, ctx->nnp)) {
 			/* not an apparmor denial per se, so don't log it */
-			AA_DEBUG("no_new_privs - change_hat denied");
+			AA_DEBUG(DEBUG_DOMAIN,
+				 "no_new_privs - change_hat denied");
 			error = -EPERM;
 			goto out;
 		}
@@ -1248,7 +1273,8 @@
 		if (task_no_new_privs(current) && !unconfined(label) &&
 		    !aa_label_is_unconfined_subset(previous, ctx->nnp)) {
 			/* not an apparmor denial per se, so don't log it */
-			AA_DEBUG("no_new_privs - change_hat denied");
+			AA_DEBUG(DEBUG_DOMAIN,
+				 "no_new_privs - change_hat denied");
 			error = -EPERM;
 			goto out;
 		}
@@ -1281,7 +1307,7 @@
 	fn_for_each_in_ns(label, profile,
 		aa_audit_file(subj_cred, profile, &perms, OP_CHANGE_HAT,
 			      AA_MAY_CHANGEHAT, NULL, NULL, target,
-			      GLOBAL_ROOT_UID, info, error));
+			      GLOBAL_ROOT_UID, info, error, false));
 
 	goto out;
 }
@@ -1306,7 +1332,7 @@
 		error = aa_audit_file(subj_cred, profile, perms, op, request,
 				      name,
 				      NULL, target, GLOBAL_ROOT_UID, info,
-				      error);
+				      error, false);
 
 	return error;
 }
@@ -1354,7 +1380,7 @@
 
 	if (!fqname || !*fqname) {
 		aa_put_label(label);
-		AA_DEBUG("no profile name");
+		AA_DEBUG(DEBUG_DOMAIN, "no profile name");
 		return -EINVAL;
 	}
 
@@ -1390,7 +1416,8 @@
 		(void) fn_for_each_in_ns(label, profile,
 				aa_audit_file(subj_cred, profile, &perms, op,
 					      request, auditname, NULL, target,
-					      GLOBAL_ROOT_UID, stack_msg, 0));
+					      GLOBAL_ROOT_UID, stack_msg, 0,
+					      false));
 		perms.audit = 0;
 	}
 
@@ -1473,7 +1500,8 @@
 		if (task_no_new_privs(current) && !unconfined(label) &&
 		    !aa_label_is_unconfined_subset(new, ctx->nnp)) {
 			/* not an apparmor denial per se, so don't log it */
-			AA_DEBUG("no_new_privs - change_hat denied");
+			AA_DEBUG(DEBUG_DOMAIN,
+				 "no_new_privs - change_hat denied");
 			error = -EPERM;
 			goto out;
 		}
@@ -1509,7 +1537,7 @@
 			aa_audit_file(subj_cred,
 				      profile, &perms, op, request, auditname,
 				      NULL, new ? new : target,
-				      GLOBAL_ROOT_UID, info, error));
+				      GLOBAL_ROOT_UID, info, error, false));
 
 out:
 	aa_put_label(new);
--- linux-qcom-6.8.0.orig/security/apparmor/file.c
+++ linux-qcom-6.8.0/security/apparmor/file.c
@@ -13,13 +13,17 @@
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/mount.h>
+#include <uapi/linux/apparmor.h>
 
+#include "include/af_unix.h"
 #include "include/apparmor.h"
 #include "include/audit.h"
 #include "include/cred.h"
 #include "include/file.h"
+#include "include/ipc.h"
 #include "include/match.h"
 #include "include/net.h"
+#include "include/notify.h"
 #include "include/path.h"
 #include "include/policy.h"
 #include "include/label.h"
@@ -75,6 +79,104 @@
 	}
 }
 
+// ??? differentiate between
+// cached - allow    : no audit == 1
+// cached - deny     : no audit < 0
+// cached - complain : no audit
+// cached - partial  : audit missing part : as miss
+// not cached = 0
+static int check_cache(struct aa_profile *profile,
+		       struct apparmor_audit_data *ad)
+{
+	struct aa_audit_node *hit;
+
+	AA_BUG(!profile);
+	ad->subj_label = &profile->label; // normally set in aa_audit
+
+	/* TODO: need rcu locking around whole check once we allow
+	 * removing node from cache
+	 */
+	AA_DEBUG(DEBUG_UPCALL, "cache check: profile '%s', pid %d name:'%s'",
+		 profile->base.hname, current->pid, ad->name);
+	hit = aa_audit_cache_find(&profile->learning_cache,  ad);
+	if (hit) {
+		AA_DEBUG(DEBUG_UPCALL, "    matched node in audit cache");
+		if (ad->request & hit->data.denied) {
+			/* this request could only partly succeed prompting for
+			 * the part and failing makes no sense
+			 */
+			AA_DEBUG(DEBUG_UPCALL,
+				 "    hit denied, request: 0x%x by cached deny 0x%x\n",
+				 ad->request, hit->data.denied);
+			aa_put_audit_node(hit);
+			return ad->error;
+		} else if (ad->request & ~hit->data.request) {
+			/* asking for more perms than is cached */
+			AA_DEBUG(DEBUG_UPCALL,
+				 "    miss insufficient perms, request: 0x%x cached 0x%x\n",
+				 ad->request, hit->data.request);
+			/* continue to do prompt */
+		} else {
+			AA_DEBUG(DEBUG_UPCALL, "cache hit->error %d. returning 0",
+				 hit->data.error);
+			aa_put_audit_node(hit);
+			/* don't audit: if its in the cache already audited */
+			return 0;
+		}
+		aa_put_audit_node(hit);
+	} else {
+		AA_DEBUG(DEBUG_UPCALL, "cache miss");
+	}
+
+	return 1;
+}
+
+// error - immediate return
+//       - debug message do audit
+// caching is handled on listener task side
+static int check_user(struct aa_profile *profile,
+		      struct apparmor_audit_data *ad,
+		      struct aa_perms *perms)
+{
+	struct aa_audit_node *node = NULL;
+	int err;
+
+	/* assume we are going to dispatch */
+	node = aa_dup_audit_data(ad, GFP_KERNEL);
+	if (!node) {
+		AA_DEBUG(DEBUG_UPCALL,
+			 "notifcation failed to duplicate with error -ENOMEM\n");
+		/* do audit */
+		return -ENOMEM;
+	}
+
+	get_task_struct(current);
+	node->data.subjtsk = current;
+	node->data.type = AUDIT_APPARMOR_USER;
+	node->data.request = ad->request;
+	node->data.denied = ad->request & ~perms->allow;
+	err = aa_do_notification(APPARMOR_NOTIF_OP, node);
+	put_task_struct(node->data.subjtsk);
+
+	if (err) {
+		// do we want to do something special with -ERESTARTSYS
+		AA_DEBUG(DEBUG_UPCALL, "notifcation failed with error %d\n",
+			 err);
+		goto return_to_audit;
+	}
+
+	/* update based on node data for audit */
+	perms->deny = node->data.denied;
+	perms->allow = node->data.request & ~node->data.denied;
+	ad->request |= node->data.request;
+	ad->denied = node->data.denied;
+	ad->error = node->data.error;
+
+return_to_audit:
+	aa_put_audit_node(node);
+	return err;
+}
+
 /**
  * aa_audit_file - handle the auditing of file operations
  * @subj_cred: cred of the subject
@@ -95,9 +197,10 @@
 		  struct aa_profile *profile, struct aa_perms *perms,
 		  const char *op, u32 request, const char *name,
 		  const char *target, struct aa_label *tlabel,
-		  kuid_t ouid, const char *info, int error)
+		  kuid_t ouid, const char *info, int error, bool prompt)
 {
 	int type = AUDIT_APPARMOR_AUTO;
+	int err;
 	DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_TASK, AA_CLASS_FILE, op);
 
 	ad.subj_cred = subj_cred;
@@ -109,6 +212,45 @@
 	ad.info = info;
 	ad.error = error;
 	ad.common.u.tsk = NULL;
+	ad.subjtsk = NULL;
+
+	ad.denied = denied_perms(perms, ad.request);
+
+	if (unlikely(ad.error)) {
+		u32 implicit_deny;
+
+		/* learning cache - not audit dedup yet */
+		err = check_cache(profile, &ad);
+		if (err <= 0) {
+			AA_DEBUG(DEBUG_UPCALL, "cache early bail %d\n", err);
+			/* cached */
+			return err;
+		}
+		implicit_deny = (ad.request & ~perms->allow) & ~perms->deny;
+		if (USER_MODE(profile))
+			perms->prompt = ALL_PERMS_MASK;
+
+		if (ad.request & MAY_EXEC)
+			AA_DEBUG(DEBUG_UPCALL,
+				 "do prompt %d: exec req 0x%x, allow 0x%x, deny 0x%x, ideny 0x%x, prompt 0x%x",
+				 prompt, ad.request, perms->allow, perms->deny,
+				 implicit_deny, perms->prompt);
+
+		/* don't prompt
+		 * - if explicit deny
+		 * - if implicit_deny is not entirely covered by prompt
+		 *   as no point asking user to just deny it anyway.
+		 */
+		if (prompt && !(request & perms->deny) &&
+		    (perms->prompt & implicit_deny) == implicit_deny) {
+			err = check_user(profile, &ad, perms);
+			if (err == -ERESTARTSYS) {
+				AA_DEBUG(DEBUG_UPCALL, "    check user returned -ERESTART_SYS");
+				/* are there other errors we should bail on */
+				return err;
+			}
+		}
+	}
 
 	if (likely(!ad.error)) {
 		u32 mask = perms->audit;
@@ -140,8 +282,8 @@
 			return ad.error;
 	}
 
-	ad.denied = ad.request & ~perms->allow;
-	return aa_audit(type, profile, &ad, file_audit_cb);
+	err = aa_audit(type, profile, &ad, file_audit_cb);
+	return err;
 }
 
 /**
@@ -172,7 +314,7 @@
 		fn_for_each_confined(label, profile,
 			aa_audit_file(subj_cred,
 				      profile, &nullperms, op, request, *name,
-				      NULL, NULL, cond->uid, info, error));
+				      NULL, NULL, cond->uid, info, error, true));
 		return error;
 	}
 
@@ -182,7 +324,8 @@
 struct aa_perms default_perms = {};
 /**
  * aa_lookup_fperms - convert dfa compressed perms to internal perms
- * @file_rules: the aa_policydb to lookup perms for  (NOT NULL)
+ * @subj_uid: uid to use for subject owner test
+ * @rules: the aa_policydb to lookup perms for  (NOT NULL)
  * @state: state in dfa
  * @cond:  conditions to consider  (NOT NULL)
  *
@@ -190,18 +333,21 @@
  *
  * Returns: a pointer to a file permission set
  */
-struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules,
-				 aa_state_t state, struct path_cond *cond)
+struct aa_perms *aa_lookup_condperms(kuid_t subj_uid, struct aa_policydb *rules,
+				     aa_state_t state, struct path_cond *cond)
 {
-	unsigned int index = ACCEPT_TABLE(file_rules->dfa)[state];
+	unsigned int index = ACCEPT_TABLE(rules->dfa)[state];
 
-	if (!(file_rules->perms))
+	if (!(rules->perms))
 		return &default_perms;
 
-	if (uid_eq(current_fsuid(), cond->uid))
-		return &(file_rules->perms[index]);
+	if ((ACCEPT_TABLE2(rules->dfa)[state] & ACCEPT_FLAG_OWNER)) {
+		if (uid_eq(subj_uid, cond->uid))
+			return &(rules->perms[index]);
+		return &(rules->perms[index + 1]);
+	}
 
-	return &(file_rules->perms[index + 1]);
+	return &(rules->perms[index]);
 }
 
 /**
@@ -220,21 +366,23 @@
 {
 	aa_state_t state;
 	state = aa_dfa_match(file_rules->dfa, start, name);
-	*perms = *(aa_lookup_fperms(file_rules, state, cond));
+	*perms = *(aa_lookup_condperms(current_fsuid(), file_rules, state,
+				       cond));
 
 	return state;
 }
 
-static int __aa_path_perm(const char *op, const struct cred *subj_cred,
-			  struct aa_profile *profile, const char *name,
-			  u32 request, struct path_cond *cond, int flags,
-			  struct aa_perms *perms)
+int __aa_path_perm(const char *op,  const struct cred *subj_cred,
+		   struct aa_profile *profile, const char *name,
+		   u32 request, struct path_cond *cond, int flags,
+		   struct aa_perms *perms, bool prompt)
 {
 	struct aa_ruleset *rules = list_first_entry(&profile->rules,
 						    typeof(*rules), list);
 	int e = 0;
 
-	if (profile_unconfined(profile))
+	if (profile_unconfined(profile) ||
+	    ((flags & PATH_SOCK_COND) && !RULE_MEDIATES_AF(rules, AF_UNIX)))
 		return 0;
 	aa_str_perms(rules->file, rules->file->start[AA_CLASS_FILE],
 		     name, cond, perms);
@@ -242,7 +390,7 @@
 		e = -EACCES;
 	return aa_audit_file(subj_cred,
 			     profile, perms, op, request, name, NULL, NULL,
-			     cond->uid, NULL, e);
+			     cond->uid, NULL, e, prompt);
 }
 
 
@@ -250,7 +398,7 @@
 			     struct aa_profile *profile,
 			     const struct path *path, char *buffer, u32 request,
 			     struct path_cond *cond, int flags,
-			     struct aa_perms *perms)
+			     struct aa_perms *perms, bool prompt)
 {
 	const char *name;
 	int error;
@@ -264,7 +412,7 @@
 	if (error)
 		return error;
 	return __aa_path_perm(op, subj_cred, profile, name, request, cond,
-			      flags, perms);
+			      flags, perms, prompt);
 }
 
 /**
@@ -295,8 +443,9 @@
 	if (!buffer)
 		return -ENOMEM;
 	error = fn_for_each_confined(label, profile,
-			profile_path_perm(op, subj_cred, profile, path, buffer,
-					  request, cond, flags, &perms));
+			profile_path_perm(op, subj_cred, profile, path,
+					  buffer, request,
+					  cond, flags, &perms, true));
 
 	aa_put_buffer(buffer);
 
@@ -406,9 +555,9 @@
 	error = 0;
 
 audit:
-	return aa_audit_file(subj_cred,
-			     profile, &lperms, OP_LINK, request, lname, tname,
-			     NULL, cond->uid, info, error);
+	return aa_audit_file(subj_cred, profile, &lperms, OP_LINK, request,
+			     lname, tname,
+			     NULL, cond->uid, info, error, false);
 }
 
 /**
@@ -511,7 +660,7 @@
 	error = fn_for_each_not_in_set(flabel, label, profile,
 			profile_path_perm(op, subj_cred, profile,
 					  &file->f_path, buffer,
-					  request, &cond, flags, &perms));
+					  request, &cond, flags, &perms, false));
 	if (denied && !error) {
 		/*
 		 * check every profile in file label that was not tested
@@ -526,13 +675,13 @@
 				profile_path_perm(op, subj_cred,
 						  profile, &file->f_path,
 						  buffer, request, &cond, flags,
-						  &perms));
+						  &perms, false));
 		else
 			error = fn_for_each_not_in_set(label, flabel, profile,
 				profile_path_perm(op, subj_cred,
 						  profile, &file->f_path,
 						  buffer, request, &cond, flags,
-						  &perms));
+						  &perms, false));
 	}
 	if (!error)
 		update_file_ctx(file_ctx(file), label, request);
@@ -570,6 +719,74 @@
 	return error;
 }
 
+/* TODO: combine with __file_path_perm */
+static int __file_mqueue_perm(const char *op, const struct cred *subj_cred,
+			      struct aa_label *label,
+			      struct aa_label *flabel, struct file *file,
+			      u32 request, u32 denied, bool in_atomic)
+{
+	struct aa_profile *profile;
+	char *buffer;
+	int error;
+	DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_POSIX_MQUEUE, op);
+
+	/* revalidation due to label out of date. No revocation at this time */
+	if (!denied && aa_label_is_subset(flabel, label))
+		/* TODO: check for revocation on stale profiles */
+		return 0;
+
+	buffer = aa_get_buffer(in_atomic);
+	if (!buffer)
+		return -ENOMEM;
+
+	ad.subj_cred = subj_cred;
+	ad.request = request;
+	ad.peer = NULL;
+	ad.mq.ouid = file_inode(file)->i_uid;
+
+	/* check every profile in task label not in current cache */
+	error = fn_for_each_not_in_set(flabel, label, profile,
+			aa_profile_mqueue_perm(profile, &file->f_path,
+					       request, buffer, &ad));
+	if (denied && !error) {
+		/*
+		 * check every profile in file label that was not tested
+		 * in the initial check above.
+		 *
+		 * TODO: cache full perms so this only happens because of
+		 * conditionals
+		 * TODO: don't audit here
+		 */
+		if (label == flabel)
+			error = fn_for_each(label, profile,
+				aa_profile_mqueue_perm(profile, &file->f_path,
+						       request, buffer, &ad));
+		else
+			error = fn_for_each_not_in_set(label, flabel, profile,
+				aa_profile_mqueue_perm(profile, &file->f_path,
+						       request, buffer, &ad));
+	}
+	if (!error)
+		update_file_ctx(file_ctx(file), label, request);
+
+	aa_put_buffer(buffer);
+
+	return error;
+}
+
+/* wrapper fn to indicate semantics of the check */
+bool __subj_label_is_cached(struct aa_label *subj_label,
+			    struct aa_label *obj_label)
+{
+	return aa_label_is_subset(obj_label, subj_label);
+}
+
+/* for now separate fn to indicate semantics of the check */
+bool __file_is_delegated(struct aa_label *obj_label)
+{
+	return unconfined(obj_label);
+}
+
 /**
  * aa_file_perm - do permission revalidation check & audit for @file
  * @op: operation being checked
@@ -607,8 +824,8 @@
 	 *       delegation from unconfined tasks
 	 */
 	denied = request & ~fctx->allow;
-	if (unconfined(label) || unconfined(flabel) ||
-	    (!denied && aa_label_is_subset(flabel, label))) {
+	if (unconfined(label) || __file_is_delegated(flabel) ||
+	    (!denied && __subj_label_is_cached(label, flabel))) {
 		rcu_read_unlock();
 		goto done;
 	}
@@ -617,7 +834,10 @@
 	rcu_read_unlock();
 	/* TODO: label cross check */
 
-	if (file->f_path.mnt && path_mediated_fs(file->f_path.dentry))
+	if (is_mqueue_inode(file_inode(file))) {
+		error = __file_mqueue_perm(op, subj_cred, label, flabel, file,
+					   request, denied, in_atomic);
+	} else if (file->f_path.mnt && path_mediated_fs(file->f_path.dentry))
 		error = __file_path_perm(op, subj_cred, label, flabel, file,
 					 request, denied, in_atomic);
 
--- linux-qcom-6.8.0.orig/security/apparmor/include/af_inet.h
+++ linux-qcom-6.8.0/security/apparmor/include/af_inet.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor af_unix fine grained mediation
+ *
+ * Copyright 2024 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+#ifndef __AA_AF_INET_H
+
+#include "label.h"
+
+int aa_inet_peer_perm(const struct cred *subj_cred,
+		      struct aa_label *label, const char *op, u32 request,
+		      struct sock *sk, struct sock *peer_sk,
+		      struct aa_label *peer_label);
+int aa_inet_label_sk_perm(const struct cred *subj_cred,
+			  struct aa_label *label, const char *op, u32 request,
+			  struct sock *sk);
+int aa_inet_sock_perm(const char *op, u32 request, struct socket *sock);
+int aa_inet_create_perm(struct aa_label *label, int family, int type,
+			int protocol);
+int aa_inet_bind_perm(struct socket *sock, struct sockaddr *address,
+		      int addrlen);
+int aa_inet_connect_perm(struct socket *sock, struct sockaddr *address,
+			 int addrlen);
+int aa_inet_listen_perm(struct socket *sock, int backlog);
+int aa_inet_accept_perm(struct socket *sock, struct socket *newsock);
+int aa_inet_msg_perm(const char *op, u32 request, struct socket *sock,
+		     struct msghdr *msg, int size);
+int aa_inet_opt_perm(const char *op, u32 request, struct socket *sock, int level,
+		     int optname);
+int aa_inet_file_perm(const struct cred *subj_cred,
+		      struct aa_label *label, const char *op, u32 request,
+		      struct socket *sock);
+
+#endif /* __AA_AF_INET_H */
--- linux-qcom-6.8.0.orig/security/apparmor/include/af_unix.h
+++ linux-qcom-6.8.0/security/apparmor/include/af_unix.h
@@ -0,0 +1,122 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor af_unix fine grained mediation
+ *
+ * Copyright 2014 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+#ifndef __AA_AF_UNIX_H
+
+#include <net/af_unix.h>
+
+#include "label.h"
+//#include "include/net.h"
+
+#define unix_addr_len(L) ((L) - sizeof(sa_family_t))
+#define unix_abstract_name_len(L) (unix_addr_len(L) - 1)
+#define unix_abstract_len(U) (unix_abstract_name_len((U)->addr->len))
+#define addr_unix_abstract_name(B) ((B)[0] == 0)
+#define addr_unix_anonymous(U) (addr_unix_len(U) <= 0)
+#define addr_unix_abstract(U) (!addr_unix_anonymous(U) && addr_unix_abstract_name((U)->addr))
+//#define unix_addr_fs(U) (!unix_addr_anonymous(U) && !unix_addr_abstract_name((U)->addr))
+
+#define unix_addr(A) ((struct sockaddr_un *)(A))
+#define unix_addr_anon(A, L) ((A) && unix_addr_len(L) <= 0)
+#define unix_addr_fs(A, L) (!unix_addr_anon(A, L) && \
+			    !addr_unix_abstract_name(unix_addr(A)->sun_path))
+
+#define UNIX_ANONYMOUS(U) (!unix_sk(U)->addr)
+/* from net/unix/af_unix.c */
+#define UNIX_ABSTRACT(U) (!UNIX_ANONYMOUS(U) &&				\
+			  unix_sk(U)->addr->hash < UNIX_HASH_SIZE)
+#define UNIX_FS(U) (!UNIX_ANONYMOUS(U) && unix_sk(U)->addr->name->sun_path[0])
+#define unix_peer(sk) (unix_sk(sk)->peer)
+#define unix_connected(S) ((S)->state == SS_CONNECTED)
+
+static inline void print_unix_addr(struct sockaddr_un *A, int L)
+{
+	char *buf = (A) ? (char *) &(A)->sun_path : NULL;
+	int len = unix_addr_len(L);
+
+	if (!buf || len <= 0)
+		pr_warn(" <anonymous>");
+	else if (buf[0])
+		pr_warn(" %s", buf);
+	else
+		/* abstract name len includes leading \0 */
+		pr_warn(" %d @%.*s", len - 1, len - 1, buf+1);
+};
+
+#define print_unix_sk(SK)						\
+do {									\
+	struct unix_sock *u = unix_sk(SK);				\
+									\
+	pr_warn("%s: f %d, t %d, p %d",	#SK,				\
+	       (SK)->sk_family, (SK)->sk_type, (SK)->sk_protocol);	\
+	if (u->addr)							\
+		print_unix_addr(u->addr->name, u->addr->len);		\
+	else								\
+		print_unix_addr(NULL, sizeof(sa_family_t));		\
+} while (0)
+
+#define print_sk(SK)							\
+do {									\
+	if (!(SK)) {							\
+		pr_warn("%s: %s is null\n", __func__, #SK);		\
+	} else if ((SK)->sk_family == PF_UNIX) {			\
+		print_unix_sk(SK);					\
+		pr_warn("\n");						\
+	} else {							\
+		pr_warn("%s: %s: family %d\n", __func__, #SK,	\
+		       (SK)->sk_family);				\
+	}								\
+} while (0)
+
+#define print_sock_addr(U)						\
+do {									\
+	pr_warn("%s:\n", __func__);					\
+	pr_warn"    sock %s:", sock_ctx && sock_ctx->label ?		\
+		aa_label_printk(sock_ctx->label, GFP_ATOMIC); :		\
+		"<null>"); print_sk(sock);				\
+	pr_warn("    other %s:", other_ctx && other_ctx->label ?	\
+		aa_label_printk(other_ctx->label, GFP_ATOMIC); :	\
+		"<null>"); print_sk(other);				\
+	pr_warn("    new %s", new_ctx && new_ctx->label ?		\
+		aa_label_printk(new_ctx->label, GFP_ATOMIC); :		\
+		"<null>"); print_sk(newsk);				\
+} while (0)
+
+
+
+
+int aa_unix_peer_perm(const struct cred *subj_cred,
+		      struct aa_label *label, const char *op, u32 request,
+		      struct sock *sk, struct sock *peer_sk,
+		      struct aa_label *peer_label);
+int aa_unix_label_sk_perm(const struct cred *subj_cred,
+			  struct aa_label *label, const char *op, u32 request,
+			  struct sock *sk);
+int aa_unix_sock_perm(const char *op, u32 request, struct socket *sock);
+int aa_unix_create_perm(struct aa_label *label, int family, int type,
+			int protocol);
+int aa_unix_bind_perm(struct socket *sock, struct sockaddr *address,
+		      int addrlen);
+int aa_unix_connect_perm(struct socket *sock, struct sockaddr *address,
+			 int addrlen);
+int aa_unix_listen_perm(struct socket *sock, int backlog);
+int aa_unix_accept_perm(struct socket *sock, struct socket *newsock);
+int aa_unix_msg_perm(const char *op, u32 request, struct socket *sock,
+		     struct msghdr *msg, int size);
+int aa_unix_opt_perm(const char *op, u32 request, struct socket *sock, int level,
+		     int optname);
+int aa_unix_file_perm(const struct cred *subj_cred,
+		      struct aa_label *label, const char *op, u32 request,
+		      struct socket *sock);
+
+#endif /* __AA_AF_UNIX_H */
--- linux-qcom-6.8.0.orig/security/apparmor/include/apparmor.h
+++ linux-qcom-6.8.0/security/apparmor/include/apparmor.h
@@ -20,7 +20,7 @@
 #define AA_CLASS_UNKNOWN	1
 #define AA_CLASS_FILE		2
 #define AA_CLASS_CAP		3
-#define AA_CLASS_DEPRECATED	4
+#define AA_CLASS_NET_COMPAT	4
 #define AA_CLASS_RLIMITS	5
 #define AA_CLASS_DOMAIN		6
 #define AA_CLASS_MOUNT		7
@@ -38,12 +38,13 @@
 #define AA_CLASS_X		31
 #define AA_CLASS_DBUS		32
 
+/* NOTE: if AA_CLASS_LAST > 63 need to update label->mediates */
 #define AA_CLASS_LAST		AA_CLASS_DBUS
 
 /* Control parameters settable through module/boot flags */
 extern enum audit_mode aa_g_audit;
 extern bool aa_g_audit_header;
-extern bool aa_g_debug;
+extern int aa_g_debug;
 extern bool aa_g_hash_policy;
 extern bool aa_g_export_binary;
 extern int aa_g_rawdata_compression_level;
--- linux-qcom-6.8.0.orig/security/apparmor/include/apparmorfs.h
+++ linux-qcom-6.8.0/security/apparmor/include/apparmorfs.h
@@ -89,6 +89,7 @@
 	AAFS_PROF_RAW_DATA,
 	AAFS_PROF_RAW_HASH,
 	AAFS_PROF_RAW_ABI,
+	AAFS_PROF_LEARNING_COUNT,
 	AAFS_PROF_SIZEOF,
 };
 
--- linux-qcom-6.8.0.orig/security/apparmor/include/audit.h
+++ linux-qcom-6.8.0/security/apparmor/include/audit.h
@@ -19,6 +19,7 @@
 
 #include "file.h"
 #include "label.h"
+#include "notify.h"
 
 extern const char *const audit_mode_names[];
 #define AUDIT_MAX_INDEX 5
@@ -38,6 +39,7 @@
 	AUDIT_APPARMOR_STATUS,
 	AUDIT_APPARMOR_ERROR,
 	AUDIT_APPARMOR_KILL,
+	AUDIT_APPARMOR_USER,
 	AUDIT_APPARMOR_AUTO
 };
 
@@ -108,7 +110,9 @@
 #define OP_URING_OVERRIDE "uring_override"
 #define OP_URING_SQPOLL "uring_sqpoll"
 
+#define AUDIT_TAILGLOB_NAME 1
 struct apparmor_audit_data {
+	u32 flags;		/* control flags not part of actual data */
 	int error;
 	int type;
 	u16 class;
@@ -119,6 +123,9 @@
 	const char *info;
 	u32 request;
 	u32 denied;
+
+	struct task_struct *subjtsk;
+
 	union {
 		/* these entries require a custom callback fn */
 		struct {
@@ -142,6 +149,13 @@
 					void *addr;
 					int addrlen;
 				} net;
+				struct {
+					kuid_t fsuid;
+					kuid_t ouid;
+				} mq;
+				struct {
+					const char *target;
+				} ns;
 			};
 		};
 		struct {
@@ -164,6 +178,44 @@
 	struct common_audit_data common;
 };
 
+struct aa_audit_node {
+	struct kref count;
+	struct apparmor_audit_data data;
+	struct list_head list;
+	struct aa_knotif knotif;
+};
+extern struct kmem_cache *aa_audit_slab;
+
+static inline struct aa_audit_node *aa_alloc_audit_node(gfp_t gfp)
+{
+	return kmem_cache_zalloc(aa_audit_slab, gfp);
+}
+
+
+struct aa_audit_cache {
+	spinlock_t lock;
+	int size;
+	struct list_head head;
+};
+
+static inline void aa_audit_cache_init(struct aa_audit_cache *cache)
+{
+	cache->size = 0;
+	spin_lock_init(&cache->lock);
+	INIT_LIST_HEAD(&cache->head);
+}
+
+struct aa_audit_node *aa_audit_cache_find(struct aa_audit_cache *cache,
+					  struct apparmor_audit_data *ad);
+struct aa_audit_node *aa_audit_cache_insert(struct aa_audit_cache *cache,
+					    struct aa_audit_node *node);
+void aa_audit_cache_update_ent(struct aa_audit_cache *cache,
+			       struct aa_audit_node *node,
+			       struct apparmor_audit_data *data);
+void aa_audit_cache_destroy(struct aa_audit_cache *cache);
+
+
+
 /* macros for dealing with  apparmor_audit_data structure */
 #define aad(SA) (container_of(SA, struct apparmor_audit_data, common))
 #define aad_of_va(VA) aad((struct common_audit_data *)(VA))
@@ -173,6 +225,7 @@
 	struct apparmor_audit_data NAME = {				\
 		.class = (C),						\
 		.op = (X),                                              \
+		.subjtsk = NULL,                                        \
 		.common.type = (T),					\
 		.common.u.tsk = NULL,					\
 		.common.apparmor_audit_data = &NAME,			\
@@ -199,9 +252,34 @@
 	return error;
 }
 
-void aa_audit_rule_free(void *vrule);
-int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule);
+void aa_audit_rule_free(void *vrule, int lsmid);
+int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule,
+		       int lsmid, gfp_t gfp);
 int aa_audit_rule_known(struct audit_krule *rule);
-int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule);
+int aa_audit_rule_match(struct lsmblob *blob, u32 field, u32 op, void *vrule,
+			int lsmid);
+
+
+void aa_audit_node_free_kref(struct kref *kref);
+struct aa_audit_node *aa_dup_audit_data(struct apparmor_audit_data *orig,
+					gfp_t gfp);
+long aa_audit_data_cmp(struct apparmor_audit_data *lhs,
+		       struct apparmor_audit_data *rhs);
+
+
+static inline struct aa_audit_node *aa_get_audit_node(struct aa_audit_node *node)
+{
+	if (node)
+		kref_get(&(node->count));
+
+	return node;
+}
+
+static inline void aa_put_audit_node(struct aa_audit_node *node)
+{
+	if (node)
+		kref_put(&node->count, aa_audit_node_free_kref);
+}
+
 
 #endif /* __AA_AUDIT_H */
--- linux-qcom-6.8.0.orig/security/apparmor/include/capability.h
+++ linux-qcom-6.8.0/security/apparmor/include/capability.h
@@ -36,6 +36,7 @@
 
 extern struct aa_sfs_entry aa_sfs_entry_caps[];
 
+kernel_cap_t aa_profile_capget(struct aa_profile *profile);
 int aa_capable(const struct cred *subj_cred, struct aa_label *label,
 	       int cap, unsigned int opts);
 
--- linux-qcom-6.8.0.orig/security/apparmor/include/crypto.h
+++ linux-qcom-6.8.0/security/apparmor/include/crypto.h
@@ -14,6 +14,8 @@
 
 #ifdef CONFIG_SECURITY_APPARMOR_HASH
 unsigned int aa_hash_size(void);
+void aa_snprint_hashstr(char *out, unsigned char *hash, unsigned int hsize);
+char *aa_asprint_hashstr(unsigned char *hash, unsigned int hsize, gfp_t gfp);
 char *aa_calc_hash(void *data, size_t len);
 int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
 			 size_t len);
@@ -32,6 +34,15 @@
 {
 	return 0;
 }
+
+void aa_snprint_hashstr(char *out, unsigned char *hash, unsigned int hsize)
+{
+}
+
+char *aa_asprint_hashstr(unsigned char *hash, unsigned int hsize, gfp_t gfp);
+{
+	return NULL;
+}
 #endif
 
 #endif /* __APPARMOR_CRYPTO_H */
--- linux-qcom-6.8.0.orig/security/apparmor/include/file.h
+++ linux-qcom-6.8.0/security/apparmor/include/file.h
@@ -75,14 +75,19 @@
 		  struct aa_profile *profile, struct aa_perms *perms,
 		  const char *op, u32 request, const char *name,
 		  const char *target, struct aa_label *tlabel, kuid_t ouid,
-		  const char *info, int error);
+		  const char *info, int error, bool prompt);
 
-struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules,
-				  aa_state_t state, struct path_cond *cond);
+struct aa_perms *aa_lookup_condperms(kuid_t subj_uid,
+				     struct aa_policydb *file_rules,
+				     aa_state_t state, struct path_cond *cond);
 aa_state_t aa_str_perms(struct aa_policydb *file_rules, aa_state_t start,
 			const char *name, struct path_cond *cond,
 			struct aa_perms *perms);
 
+int __aa_path_perm(const char *op,  const struct cred *subj_cred,
+		   struct aa_profile *profile, const char *name,
+		   u32 request, struct path_cond *cond, int flags,
+		   struct aa_perms *perms, bool prompt);
 int aa_path_perm(const char *op, const struct cred *subj_cred,
 		 struct aa_label *label, const struct path *path,
 		 int flags, u32 request, struct path_cond *cond);
--- linux-qcom-6.8.0.orig/security/apparmor/include/inode.h
+++ linux-qcom-6.8.0/security/apparmor/include/inode.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor file mediation function definitions.
+ *
+ * Copyright 2022 Canonical Ltd.
+ */
+
+#ifndef __AA_INODE_H
+#define __AA_INODE_H
+
+#include <linux/spinlock.h>
+
+#include "lib.h"
+
+struct aa_inode_sec {
+	struct inode *inode;	/* back pointer to inode object */
+	struct aa_label *label;
+	u16 sclass;		/* security class of this object */
+	bool initialized;	/* initialization flag */
+	spinlock_t lock;
+};
+
+struct aa_superblock_sec {
+	struct aa_label *label;
+};
+
+static inline struct aa_inode_sec *apparmor_inode(const struct inode *inode)
+{
+	if (unlikely(!inode->i_security))
+		return NULL;
+	return inode->i_security + apparmor_blob_sizes.lbs_inode;
+}
+
+static inline struct aa_superblock_sec *apparmor_superblock(
+					const struct super_block *sb)
+{
+	return sb->s_security + apparmor_blob_sizes.lbs_superblock;
+}
+
+#endif /* __AA_INODE_H */
--- linux-qcom-6.8.0.orig/security/apparmor/include/ipc.h
+++ linux-qcom-6.8.0/security/apparmor/include/ipc.h
@@ -11,10 +11,71 @@
 #ifndef __AA_IPC_H
 #define __AA_IPC_H
 
+#include <linux/msg.h>
 #include <linux/sched.h>
 
+#include "inode.h"
+#include "perms.h"
+
+#define SIGUNKNOWN 0
+#define MAXMAPPED_SIG 35
+
+struct aa_msg_sec {
+	struct aa_label *label;
+};
+
+struct aa_ipc_sec {
+	struct aa_label *label;
+};
+
+static inline struct aa_ipc_sec *apparmor_ipc(const struct kern_ipc_perm *ipc)
+{
+	return ipc->security + apparmor_blob_sizes.lbs_ipc;
+}
+
+static inline struct aa_msg_sec *apparmor_msg_msg(const struct msg_msg *msg_msg)
+{
+	return msg_msg->security + apparmor_blob_sizes.lbs_msg_msg;
+}
+
+
+static inline bool is_mqueue_sb(struct super_block *sb)
+{
+	if (!sb)
+		pr_warn("mqueue sb == NULL\n");
+	if (!sb && !sb->s_type->name)
+		pr_warn("mqueue sb name == NULL\n");
+	return sb && sb->s_type->name && strcmp(sb->s_type->name, "mqueue") == 0;
+}
+
+static inline bool is_mqueue_inode(struct inode *i)
+{
+	struct aa_inode_sec *isec;
+
+	if (!i)
+		return false;
+
+	isec = apparmor_inode(i);
+	return isec && isec->sclass == AA_CLASS_POSIX_MQUEUE;
+}
+
 int aa_may_signal(const struct cred *subj_cred, struct aa_label *sender,
 		  const struct cred *target_cred, struct aa_label *target,
 		  int sig);
 
+#define AA_AUDIT_POSIX_MQUEUE_MASK (AA_MAY_WRITE | AA_MAY_READ |    \
+				    AA_MAY_CREATE | AA_MAY_DELETE | \
+				    AA_MAY_OPEN | AA_MAY_SETATTR |  \
+				    AA_MAY_GETATTR)
+
+
+int aa_profile_mqueue_perm(struct aa_profile *profile,
+			   const struct path *path,
+			   u32 request, char *buffer,
+			   struct apparmor_audit_data *ad);
+
+int aa_mqueue_perm(const char *op, const struct cred *subj_cred,
+		   struct aa_label *label,
+		   const struct path *path, u32 request);
+
 #endif /* __AA_IPC_H */
--- linux-qcom-6.8.0.orig/security/apparmor/include/label.h
+++ linux-qcom-6.8.0/security/apparmor/include/label.h
@@ -90,7 +90,7 @@
 	FLAG_PROFILE = 0x200,		/* label is a profile */
 	FLAG_EXPLICIT = 0x400,		/* explicit static label */
 	FLAG_STALE = 0x800,		/* replaced/removed */
-	FLAG_RENAMED = 0x1000,		/* label has renaming in it */
+	FLAG_INTERRUPTIBLE = 0x1000,
 	FLAG_REVOKED = 0x2000,		/* label has revocation in it */
 	FLAG_DEBUG1 = 0x4000,
 	FLAG_DEBUG2 = 0x8000,
@@ -129,6 +129,7 @@
 	long flags;
 	u32 secid;
 	int size;
+	u64 mediates;
 	struct aa_profile *vec[];
 };
 
@@ -255,21 +256,19 @@
 #define fn_for_each_not_in_set(L1, L2, P, FN)				\
 	fn_for_each2_XXX((L1), (L2), P, FN, _not_in_set)
 
-#define LABEL_MEDIATES(L, C)						\
-({									\
-	struct aa_profile *profile;					\
-	struct label_it i;						\
-	int ret = 0;							\
-	label_for_each(i, (L), profile) {				\
-		if (RULE_MEDIATES(&profile->rules, (C))) {		\
-			ret = 1;					\
-			break;						\
-		}							\
-	}								\
-	ret;								\
-})
-
+static inline bool label_mediates(struct aa_label *L, unsigned char C)
+{
+	return (L)->mediates & (((u64) 1) << (C));
+}
+
+static inline bool label_mediates_safe(struct aa_label *L, unsigned char C)
+{
+	if (C > AA_CLASS_LAST)
+		return false;
+	return label_mediates(L, C);
+}
 
+int aa_label_cmp(struct aa_label *a, struct aa_label *b);
 void aa_labelset_destroy(struct aa_labelset *ls);
 void aa_labelset_init(struct aa_labelset *ls);
 void __aa_labelset_update_subtree(struct aa_ns *ns);
--- linux-qcom-6.8.0.orig/security/apparmor/include/lib.h
+++ linux-qcom-6.8.0/security/apparmor/include/lib.h
@@ -18,23 +18,42 @@
 
 extern struct aa_dfa *stacksplitdfa;
 
-/*
- * DEBUG remains global (no per profile flag) since it is mostly used in sysctl
- * which is not related to profile accesses.
- */
+#define list_add_entry(ent, list, member) list_add(&(ent)->member, (list))
+#define list_add_tail_entry(ent, list, member) list_add_tail(&(ent)->member, (list))
 
-#define DEBUG_ON (aa_g_debug)
 /*
  * split individual debug cases out in preparation for finer grained
  * debug controls in the future.
  */
-#define AA_DEBUG_LABEL DEBUG_ON
 #define dbg_printk(__fmt, __args...) pr_debug(__fmt, ##__args)
-#define AA_DEBUG(fmt, args...)						\
+
+#define DEBUG_PROMPT 2
+
+#define DEBUG_NONE 0
+#define DEBUG_LABEL_ABS_ROOT 1
+#define DEBUG_LABEL 2
+#define DEBUG_DOMAIN 4
+#define DEBUG_POLICY 8
+#define DEBUG_INTERFACE 0x10
+#define DEBUG_UPCALL 0x20
+
+#define DEBUG_ALL 0x3f		/* update if new DEBUG_X added */
+#define DEBUG_PARSE_ERROR (-1)
+
+#define DEBUG_ON (aa_g_debug != DEBUG_NONE)
+#define DEBUG_ABS_ROOT (aa_g_debug & DEBUG_LABEL_ABS_ROOT)
+
+#define AA_DEBUG(opt, fmt, args...)					\
 	do {								\
-		if (DEBUG_ON)						\
-			pr_debug_ratelimited("AppArmor: " fmt, ##args);	\
+		if (aa_g_debug & opt)					\
+			pr_warn("%s: " fmt, __func__, ##args); \
 	} while (0)
+#define AA_DEBUG_ON(C, args...) do { if (C) AA_DEBUG(args); } while (0)
+#define AA_DEBUG_LABEL(LAB, X, fmt, args)				\
+do {									\
+	if ((LAB)->flags & FLAG_DEBUG1)					\
+		AA_DEBUG(X, fmt, args);					\
+} while (0)
 
 #define AA_WARN(X) WARN((X), "APPARMOR WARN %s: %s\n", __func__, #X)
 
@@ -51,6 +70,9 @@
 #define AA_BUG_FMT(X, fmt, args...) no_printk(fmt, ##args)
 #endif
 
+int aa_parse_debug_params(const char *str);
+int aa_print_debug_params(char *buffer);
+
 #define AA_ERROR(fmt, args...)						\
 	pr_err_ratelimited("AppArmor: " fmt, ##args)
 
@@ -96,6 +118,14 @@
 	return aa_dfa_next(dfa, start, 0);
 }
 
+static inline aa_state_t aa_dfa_match_u16(struct aa_dfa *dfa, aa_state_t state,
+					  u16 data)
+{
+	__be16 buffer = cpu_to_be16(data);
+
+	return aa_dfa_match_len(dfa, state, (char *) &buffer, 2);
+}
+
 static inline bool path_mediated_fs(struct dentry *dentry)
 {
 	return !(dentry->d_sb->s_flags & SB_NOUSER);
@@ -282,7 +312,7 @@
 	}								\
 __done:									\
 	if (!__new_)							\
-		AA_DEBUG("label build failed\n");			\
+		AA_DEBUG(DEBUG_LABEL, "label build failed\n");		\
 	(__new_);							\
 })
 
--- linux-qcom-6.8.0.orig/security/apparmor/include/net.h
+++ linux-qcom-6.8.0/security/apparmor/include/net.h
@@ -49,12 +49,17 @@
 struct aa_sk_ctx {
 	struct aa_label *label;
 	struct aa_label *peer;
+	struct path path;
 };
 
-#define SK_CTX(X) ((X)->sk_security)
+static inline bool aa_secmark(void)
+{
+	return apparmor_blob_sizes.lbs_secmark;
+}
+
 static inline struct aa_sk_ctx *aa_sock(const struct sock *sk)
 {
-	return sk->sk_security;
+	return sk->sk_security + apparmor_blob_sizes.lbs_sock;
 }
 
 #define DEFINE_AUDIT_NET(NAME, OP, SK, F, T, P)				  \
@@ -74,10 +79,29 @@
 			 (SK)->sk_protocol)
 
 
+
+/* struct aa_net - network confinement data
+ * @allow: basic network families permissions
+ * @audit: which network permissions to force audit
+ * @quiet: which network permissions to quiet rejects
+ */
+struct aa_net_compat {
+	u16 allow[AF_MAX];
+	u16 audit[AF_MAX];
+	u16 quiet[AF_MAX];
+};
+
 #define af_select(FAMILY, FN, DEF_FN)		\
 ({						\
 	int __e;				\
 	switch ((FAMILY)) {			\
+	case PF_UNIX:				\
+		__e = aa_unix_ ## FN;		\
+		break;				\
+	case PF_INET:				\
+	case PF_INET6:				\
+		__e = aa_inet_ ## FN;		\
+		break;				\
 	default:				\
 		__e = DEF_FN;			\
 	}					\
@@ -92,6 +116,7 @@
 };
 
 extern struct aa_sfs_entry aa_sfs_entry_network[];
+extern struct aa_sfs_entry aa_sfs_entry_network_compat[];
 
 void audit_net_cb(struct audit_buffer *ab, void *va);
 int aa_profile_af_perm(struct aa_profile *profile,
--- linux-qcom-6.8.0.orig/security/apparmor/include/notify.h
+++ linux-qcom-6.8.0/security/apparmor/include/notify.h
@@ -0,0 +1,98 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor notifications function definitions.
+ *
+ * Copyright 2019 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_NOTIFY_H
+#define __AA_NOTIFY_H
+
+#include <linux/audit.h>
+#include <linux/lsm_audit.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/wait.h>
+
+#include <uapi/linux/apparmor.h>
+
+#include "match.h"
+
+struct aa_ns;
+struct aa_audit_node;
+struct apparmor_audit_data;
+
+struct aa_listener {
+	struct kref count;
+	spinlock_t lock;
+	wait_queue_head_t wait;
+	struct list_head ns_proxies;	/* aa_listener_proxy */
+	struct list_head notifications;	/* aa_audit_proxy */
+	struct list_head pending;	/* aa_audit_proxy */
+	struct aa_ns *ns;		/* counted - ns of listener */
+	struct aa_dfa *filter;
+	u64 last_id;
+	u32 mask;
+	u32 flags;
+};
+
+struct aa_listener_proxy {
+	struct aa_ns *ns;		/* counted - ns listening to */
+	struct aa_listener *listener;
+	struct list_head llist;
+	struct list_head nslist;
+};
+
+#define KNOTIF_ON_LIST 1
+#define KNOTIF_PULSE
+#define KNOTIF_PENDING
+#define KNOTIF_CANCELLED
+/* need to split knofif into audit_proxy
+ * prompt notifications only go to first taker so no need for completion
+ * in the proxy, it increases size of proxy in non-prompt case
+ */
+struct aa_knotif {
+	struct apparmor_audit_data *ad;	/* counted */
+	struct list_head list;
+	struct completion ready;
+	u64 id;
+	u16 ntype;
+	u16 flags;
+};
+
+void aa_free_listener_proxy(struct aa_listener_proxy *proxy);
+bool aa_register_listener_proxy(struct aa_listener *listener, struct aa_ns *ns);
+struct aa_listener *aa_new_listener(struct aa_ns *ns, gfp_t gfp);
+struct aa_knotif *__aa_find_notif(struct aa_listener *listener, u64 id);
+int aa_do_notification(u16 ntype, struct aa_audit_node *node);
+
+long aa_listener_unotif_recv(struct aa_listener *listener, void __user *buf,
+			     u16 max_size);
+long aa_listener_unotif_response(struct aa_listener *listener,
+				 union apparmor_notif_resp *uresp,
+				 u16 size);
+
+void aa_listener_kref(struct kref *kref);
+
+static inline struct aa_listener *aa_get_listener(struct aa_listener *listener)
+{
+	if (listener)
+		kref_get(&(listener->count));
+
+	return listener;
+}
+
+static inline void aa_put_listener(struct aa_listener *listener)
+{
+	if (listener)
+		kref_put(&listener->count, aa_listener_kref);
+}
+
+#endif /* __AA_NOTIFY_H */
--- linux-qcom-6.8.0.orig/security/apparmor/include/path.h
+++ linux-qcom-6.8.0/security/apparmor/include/path.h
@@ -13,6 +13,7 @@
 
 enum path_flags {
 	PATH_IS_DIR = 0x1,		/* path is a directory */
+	PATH_SOCK_COND = 0x2,
 	PATH_CONNECT_PATH = 0x4,	/* connect disconnected paths to / */
 	PATH_CHROOT_REL = 0x8,		/* do path lookup relative to chroot */
 	PATH_CHROOT_NSCONNECT = 0x10,	/* connect paths that are at ns root */
--- linux-qcom-6.8.0.orig/security/apparmor/include/perms.h
+++ linux-qcom-6.8.0/security/apparmor/include/perms.h
@@ -204,6 +204,9 @@
 			 u32 mask);
 void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
 			 u32 mask);
+void aa_audit_perms(struct audit_buffer *ab,  struct apparmor_audit_data *ad,
+		    const char *chrs, u32 chrsmask, const char * const *names,
+		    u32 namesmask);
 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
 			u32 chrsmask, const char * const *names, u32 namesmask);
 void aa_apply_modes_to_perms(struct aa_profile *profile,
@@ -216,6 +219,12 @@
 int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
 			  u32 request, int type, u32 *deny,
 			  struct apparmor_audit_data *ad);
+
+static inline u32 denied_perms(struct aa_perms *perms, u32 request)
+{
+	return request & (~perms->allow | perms->deny);
+}
+
 int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
 		   u32 request, struct apparmor_audit_data *ad,
 		   void (*cb)(struct audit_buffer *, void *));
--- linux-qcom-6.8.0.orig/security/apparmor/include/policy.h
+++ linux-qcom-6.8.0/security/apparmor/include/policy.h
@@ -34,7 +34,11 @@
 struct aa_ns;
 
 extern int unprivileged_userns_apparmor_policy;
+extern int aa_unprivileged_userns_restricted;
+extern int aa_unprivileged_userns_restricted_force;
+extern int aa_unprivileged_userns_restricted_complain;
 extern int aa_unprivileged_unconfined_restricted;
+extern int aa_unprivileged_uring_restricted;
 
 extern const char *const aa_profile_mode_names[];
 #define APPARMOR_MODE_NAMES_MAX_INDEX 4
@@ -59,6 +63,11 @@
 
 #define on_list_rcu(X) (!list_empty(X) && (X)->prev != LIST_POISON2)
 
+/* flags in the dfa accept2 table */
+enum dfa_accept_flags {
+	ACCEPT_FLAG_OWNER = 1,
+};
+
 /*
  * FIXME: currently need a clean way to replace and remove profiles as a
  * set.  It should be done at the namespace level.
@@ -124,6 +133,7 @@
 		kref_put(&pdb->count, aa_pdb_free_kref);
 }
 
+/* lookup perm that doesn't have and object conditional */
 static inline struct aa_perms *aa_lookup_perms(struct aa_policydb *policy,
 					       aa_state_t state)
 {
@@ -135,7 +145,6 @@
 	return &(policy->perms[index]);
 }
 
-
 /* struct aa_data - generic data structure
  * key: name for retrieving this data
  * size: size of data in bytes
@@ -175,6 +184,10 @@
 	struct aa_secmark *secmark;
 };
 
+void aa_free_ruleset(struct aa_ruleset *rules);
+struct aa_ruleset *aa_new_ruleset(gfp_t gfp);
+struct aa_ruleset *aa_clone_ruleset(struct aa_ruleset *rules);
+
 /* struct aa_attachment - data and rules for a profiles attachment
  * @list:
  * @xmatch_str: human readable attachment string
@@ -204,6 +217,7 @@
  * @disconnected: what to prepend if attach_disconnected is specified
  * @attach: attachment rules for the profile
  * @rules: rules to be enforced
+ * @net_compat: v2 compat network controls for the profile
  *
  * @dents: dentries for the profiles file entries in apparmorfs
  * @dirname: name of the profile dir in apparmorfs
@@ -231,10 +245,14 @@
 	enum audit_mode audit;
 	long mode;
 	u32 path_flags;
+	int signal;
 	const char *disconnected;
 
 	struct aa_attachment attach;
 	struct list_head rules;
+	struct aa_net_compat *net_compat;
+
+	struct aa_audit_cache learning_cache;
 
 	struct aa_loaddata *rawdata;
 	unsigned char *hash;
@@ -304,8 +322,11 @@
 	aa_state_t state = RULE_MEDIATES(rules, AA_CLASS_NET);
 	__be16 be_af = cpu_to_be16(AF);
 
-	if (!state)
-		return DFA_NOMATCH;
+	if (!state) {
+		state = RULE_MEDIATES(rules, AA_CLASS_NET_COMPAT);
+		if (!state)
+			return DFA_NOMATCH;
+	}
 	return aa_dfa_match_len(rules->policy->dfa, state, (char *) &be_af, 2);
 }
 
@@ -319,6 +340,19 @@
 	return RULE_MEDIATES(rule, class);
 }
 
+void aa_compute_profile_mediates(struct aa_profile *profile);
+static inline bool profile_mediates(struct aa_profile *profile,
+				    unsigned char class)
+{
+	return label_mediates(&profile->label, class);
+}
+
+static inline bool profile_mediates_safe(struct aa_profile *profile,
+					 unsigned char class)
+{
+	return label_mediates_safe(&profile->label, class);
+}
+
 /**
  * aa_get_profile - increment refcount on profile @p
  * @p: profile  (MAYBE NULL)
--- linux-qcom-6.8.0.orig/security/apparmor/include/policy_ns.h
+++ linux-qcom-6.8.0/security/apparmor/include/policy_ns.h
@@ -12,6 +12,7 @@
 #define __AA_NAMESPACE_H
 
 #include <linux/kref.h>
+#include <linux/spinlock.h>
 
 #include "apparmor.h"
 #include "apparmorfs.h"
@@ -42,6 +43,12 @@
  * @uniq_null: uniq value used for null learning profiles
  * @uniq_id: a unique id count for the profiles in the namespace
  * @level: level of ns within the tree hierarchy
+ * @revision: policy revision for this ns
+ * @wait: waitq for tasks waiting on revision changes
+ * @listener_lock: lock for listeners
+ * @listeners: notification listeners' proxies list
+ * @labels: all the labels associated with this ns
+ * @rawdata_list: raw policy data for policy
  * @dents: dentries for the namespaces file entries in apparmorfs
  *
  * An aa_ns defines the set profiles that are searched to determine which
@@ -65,9 +72,13 @@
 	atomic_t uniq_null;
 	long uniq_id;
 	int level;
+
 	long revision;
 	wait_queue_head_t wait;
 
+	spinlock_t listener_lock;
+	struct list_head listeners;
+
 	struct aa_labelset labels;
 	struct list_head rawdata_list;
 
--- linux-qcom-6.8.0.orig/security/apparmor/include/policy_unpack.h
+++ linux-qcom-6.8.0/security/apparmor/include/policy_unpack.h
@@ -31,6 +31,7 @@
 #define PACKED_FLAG_HAT		1
 #define PACKED_FLAG_DEBUG1	2
 #define PACKED_FLAG_DEBUG2	4
+#define PACKED_FLAG_INTERRUPTIBLE 8
 
 #define PACKED_MODE_ENFORCE	0
 #define PACKED_MODE_COMPLAIN	1
--- linux-qcom-6.8.0.orig/security/apparmor/include/secid.h
+++ linux-qcom-6.8.0/security/apparmor/include/secid.h
@@ -25,9 +25,10 @@
 extern int apparmor_display_secid_mode;
 
 struct aa_label *aa_secid_to_label(u32 secid);
-int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
+int apparmor_secid_to_secctx(u32 secid, struct lsmcontext *cp);
+int apparmor_lsmblob_to_secctx(struct lsmblob *blob, struct lsmcontext *cp);
 int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
-void apparmor_release_secctx(char *secdata, u32 seclen);
+void apparmor_release_secctx(struct lsmcontext *cp);
 
 
 int aa_alloc_secid(struct aa_label *label, gfp_t gfp);
--- linux-qcom-6.8.0.orig/security/apparmor/include/sig_names.h
+++ linux-qcom-6.8.0/security/apparmor/include/sig_names.h
@@ -1,9 +1,5 @@
 #include <linux/signal.h>
-
-#define SIGUNKNOWN 0
-#define MAXMAPPED_SIG 35
-#define MAXMAPPED_SIGNAME (MAXMAPPED_SIG + 1)
-#define SIGRT_BASE 128
+#include "signal.h"
 
 /* provide a mapping of arch signal to internal signal # for mediation
  * those that are always an alias SIGCLD for SIGCLHD and SIGPOLL for SIGIO
--- linux-qcom-6.8.0.orig/security/apparmor/include/signal.h
+++ linux-qcom-6.8.0/security/apparmor/include/signal.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor ipc mediation function definitions.
+ *
+ * Copyright 2023 Canonical Ltd.
+ */
+
+#ifndef __AA_SIGNAL_H
+#define __AA_SIGNAL_H
+
+#define SIGUNKNOWN 0
+#define MAXMAPPED_SIG 35
+
+#define MAXMAPPED_SIGNAME (MAXMAPPED_SIG + 1)
+#define SIGRT_BASE 128
+
+#endif /* __AA_SIGNAL_H */
--- linux-qcom-6.8.0.orig/security/apparmor/include/task.h
+++ linux-qcom-6.8.0/security/apparmor/include/task.h
@@ -99,7 +99,8 @@
 
 #define AA_USERNS_CREATE	8
 
-int aa_profile_ns_perm(struct aa_profile *profile,
-		       struct apparmor_audit_data *ad, u32 request);
+struct aa_label *aa_profile_ns_perm(struct aa_profile *profile,
+				    struct apparmor_audit_data *ad,
+				    u32 request);
 
 #endif /* __AA_TASK_H */
--- linux-qcom-6.8.0.orig/security/apparmor/ipc.c
+++ linux-qcom-6.8.0/security/apparmor/ipc.c
@@ -9,10 +9,13 @@
  */
 
 #include <linux/gfp.h>
+#include <linux/nsproxy.h>
+#include <linux/ipc_namespace.h>
 
 #include "include/audit.h"
 #include "include/capability.h"
 #include "include/cred.h"
+#include "include/path.h"
 #include "include/policy.h"
 #include "include/ipc.h"
 #include "include/sig_names.h"
@@ -85,16 +88,16 @@
 	struct aa_perms perms;
 	aa_state_t state;
 
-	if (profile_unconfined(profile) ||
-	    !ANY_RULE_MEDIATES(&profile->rules, AA_CLASS_SIGNAL))
+	if (profile_unconfined(profile))
 		return 0;
 
 	ad->subj_cred = cred;
 	ad->peer = peer;
 	/* TODO: secondary cache check <profile, profile, perm> */
-	state = aa_dfa_next(rules->policy->dfa,
-			    rules->policy->start[AA_CLASS_SIGNAL],
-			    ad->signal);
+	state = RULE_MEDIATES(rules, AA_CLASS_SIGNAL);
+	if (!state)
+		return 0;
+	state = aa_dfa_next(rules->policy->dfa, state, ad->signal);
 	aa_label_match(profile, rules, peer, state, false, request, &perms);
 	aa_apply_modes_to_perms(profile, &perms);
 	return aa_check_perms(profile, &perms, request, ad, audit_signal_cb);
@@ -115,3 +118,108 @@
 			     profile_signal_perm(target_cred, profile, sender,
 						 MAY_READ, &ad));
 }
+
+
+static void audit_mqueue_cb(struct audit_buffer *ab, void *va)
+{
+	struct apparmor_audit_data *ad = aad_of_va(va);
+
+	aa_audit_perms(ab, ad, NULL, 0, NULL, AA_AUDIT_POSIX_MQUEUE_MASK);
+
+	/* move class into generic audit framse work */
+	audit_log_format(ab, "class=\"posix_mqueue\"");
+	if (ad->request & AA_AUDIT_FILE_MASK) {
+		audit_log_format(ab, " fsuid=%u",
+				 from_kuid(&init_user_ns, ad->subj_cred->fsuid));
+		audit_log_format(ab, " ouid=%u",
+				 from_kuid(&init_user_ns, ad->mq.ouid));
+	}
+	if (ad->peer) {
+		audit_log_format(ab, " olabel=");
+		aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
+				FLAGS_NONE, GFP_ATOMIC);
+	}
+}
+
+int aa_profile_mqueue_perm(struct aa_profile *profile, const struct path *path,
+			   u32 request, char *buffer,
+			   struct apparmor_audit_data *ad)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_perms perms = { };
+	unsigned int state;
+	char *name;
+
+	if (profile_unconfined(profile) ||
+	    !RULE_MEDIATES(rules, AA_CLASS_POSIX_MQUEUE))
+		return 0;
+
+	ad->subj_label = &profile->label;
+
+	name = dentry_path_raw(path->dentry, buffer, aa_g_path_max);
+	if (IS_ERR(name))
+		return PTR_ERR(name);
+	if (path->mnt != current->nsproxy->ipc_ns->mq_mnt) {
+		/* TODO: disconnected path detection */
+		pr_warn("apparmor mqueue disconnected TODO\n");
+	}
+
+	ad->name = name;
+
+	state = aa_dfa_match(rules->policy->dfa,
+			     rules->policy->start[AA_CLASS_POSIX_MQUEUE],
+			     name);
+	perms = *aa_lookup_perms(rules->policy, state);
+	aa_apply_modes_to_perms(profile, &perms);
+	if (!denied_perms(&perms, request)) {
+		/* early bailout sufficient perms no need to do further
+		 * checks
+		 */
+		return aa_check_perms(profile, &perms, request, ad,
+				      audit_mqueue_cb);
+	}
+	/* continue check to see if we have label perms */
+	//aa_label_match(profile, peer??, state false, request, &perms);
+	//aa_apply_modes_to_perms(profile, &perms);
+
+	// this will just cause failure without above label check
+	return aa_check_perms(profile, &perms, request, ad, audit_mqueue_cb);
+}
+
+/* mqueue - no label caching test */
+int aa_mqueue_perm(const char *op, const struct cred *subj_cred,
+		   struct aa_label *label,
+		   const struct path *path, u32 request)
+{
+	struct aa_profile *profile;
+	char *buffer;
+	int error;
+	DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_POSIX_MQUEUE, op);
+
+	// do we need delegate deleted with mqueues? probably
+	//flags |= PATH_DELEGATE_DELETED;
+
+	/* sadly due to rcu walk hairiness, we use dentry_path_raw instead
+	 *  of just accessing the name directly, which means we need to
+	 *  do the whole buffer allocation mess
+	 */
+	buffer = aa_get_buffer(false);
+	if (!buffer)
+		return -ENOMEM;
+
+	/* audit fields that won't change during iteration */
+	ad.subj_cred = subj_cred;
+	ad.request = request;
+	ad.peer = NULL;
+	ad.mq.ouid = d_backing_inode(path->dentry) ?
+				d_backing_inode(path->dentry)->i_uid :
+				subj_cred->fsuid;
+
+	error = fn_for_each_confined(label, profile,
+			aa_profile_mqueue_perm(profile, path, request,
+					       buffer, &ad));
+	aa_put_buffer(buffer);
+
+	return error;
+}
--- linux-qcom-6.8.0.orig/security/apparmor/label.c
+++ linux-qcom-6.8.0/security/apparmor/label.c
@@ -198,21 +198,25 @@
 	return false;
 }
 
-static long accum_vec_flags(struct aa_profile **vec, int n)
+static void accum_label_info(struct aa_label *new)
 {
 	long u = FLAG_UNCONFINED;
 	int i;
 
-	AA_BUG(!vec);
+	AA_BUG(!new->vec);
 
-	for (i = 0; i < n; i++) {
-		u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
-					    FLAG_STALE);
-		if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))
+	/* size == 1 is a profile and flags must be set as part of creation */
+	if (new->size == 1)
+	       return;
+
+       for (i = 0; i < new->size; i++) {
+		u |= new->vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
+						 FLAG_STALE);
+		if (!(u & new->vec[i]->label.flags & FLAG_UNCONFINED))
 			u &= ~FLAG_UNCONFINED;
+		new->mediates |= new->vec[i]->label.mediates;
 	}
-
-	return u;
+	new->flags |= u;
 }
 
 static int sort_cmp(const void *a, const void *b)
@@ -431,7 +435,7 @@
 
 	/*  + 1 for null terminator entry on vec */
 	new = kzalloc(struct_size(new, vec, size + 1), gfp);
-	AA_DEBUG("%s (%p)\n", __func__, new);
+	AA_DEBUG(DEBUG_LABEL, "%s (%p)\n", __func__, new);
 	if (!new)
 		goto fail;
 
@@ -457,7 +461,7 @@
 
 
 /**
- * label_cmp - label comparison for set ordering
+ * aa_label_cmp - label comparison for set ordering
  * @a: label to compare (NOT NULL)
  * @b: label to compare (NOT NULL)
  *
@@ -465,7 +469,7 @@
  *          ==0 if a == b
  *          >0  if a > b
  */
-static int label_cmp(struct aa_label *a, struct aa_label *b)
+int aa_label_cmp(struct aa_label *a, struct aa_label *b)
 {
 	AA_BUG(!b);
 
@@ -645,6 +649,7 @@
 		rb_replace_node(&old->node, &new->node, &ls->root);
 		old->flags &= ~FLAG_IN_TREE;
 		new->flags |= FLAG_IN_TREE;
+		accum_label_info(new);
 		return true;
 	}
 
@@ -679,7 +684,7 @@
 	new = &ls->root.rb_node;
 	while (*new) {
 		struct aa_label *this = rb_entry(*new, struct aa_label, node);
-		int result = label_cmp(label, this);
+		int result = aa_label_cmp(label, this);
 
 		parent = *new;
 		if (result == 0) {
@@ -705,6 +710,7 @@
 	rb_link_node(&label->node, parent, new);
 	rb_insert_color(&label->node, &ls->root);
 	label->flags |= FLAG_IN_TREE;
+	accum_label_info(label);
 
 	return aa_get_label(label);
 }
@@ -1102,7 +1108,6 @@
 		else if (k == b->size)
 			return aa_get_label(b);
 	}
-	new->flags |= accum_vec_flags(new->vec, new->size);
 	ls = labels_set(new);
 	write_lock_irqsave(&ls->lock, flags);
 	label = __label_insert(labels_set(new), new, false);
@@ -1634,7 +1639,7 @@
 	AA_BUG(!str && size != 0);
 	AA_BUG(!label);
 
-	if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) {
+	if (DEBUG_ABS_ROOT && (flags & FLAG_ABS_ROOT)) {
 		ns = root_ns;
 		len = snprintf(str, size, "_");
 		update_for_len(total, len, size, str);
@@ -1748,7 +1753,7 @@
 	    display_mode(ns, label, flags)) {
 		len  = aa_label_asxprint(&name, ns, label, flags, gfp);
 		if (len < 0) {
-			AA_DEBUG("label print error");
+			AA_DEBUG(DEBUG_LABEL, "label print error");
 			return;
 		}
 		str = name;
@@ -1776,7 +1781,7 @@
 
 		len = aa_label_asxprint(&str, ns, label, flags, gfp);
 		if (len < 0) {
-			AA_DEBUG("label print error");
+			AA_DEBUG(DEBUG_LABEL, "label print error");
 			return;
 		}
 		seq_puts(f, str);
@@ -1799,7 +1804,7 @@
 
 		len = aa_label_asxprint(&str, ns, label, flags, gfp);
 		if (len < 0) {
-			AA_DEBUG("label print error");
+			AA_DEBUG(DEBUG_LABEL, "label print error");
 			return;
 		}
 		pr_info("%s", str);
@@ -1898,7 +1903,7 @@
 	AA_BUG(!str);
 
 	str = skipn_spaces(str, n);
-	if (str == NULL || (AA_DEBUG_LABEL && *str == '_' &&
+	if (str == NULL || (DEBUG_ABS_ROOT && *str == '_' &&
 			    base != &root_ns->unconfined->label))
 		return ERR_PTR(-EINVAL);
 
--- linux-qcom-6.8.0.orig/security/apparmor/lib.c
+++ linux-qcom-6.8.0/security/apparmor/lib.c
@@ -25,6 +25,98 @@
 			     .quiet = ALL_PERMS_MASK,
 			     .hide = ALL_PERMS_MASK };
 
+struct val_table_ent {
+	const char *str;
+	int value;
+};
+
+struct val_table_ent debug_values_table[] = {
+	{ "N", DEBUG_NONE },
+	{ "none", DEBUG_NONE },
+	{ "n", DEBUG_NONE },
+	{ "0", DEBUG_NONE },
+	{ "all", DEBUG_ALL },
+	{ "Y", DEBUG_ALL },
+	{ "y", DEBUG_ALL },
+	{ "1", DEBUG_ALL },
+	{ "abs_root", DEBUG_LABEL_ABS_ROOT },
+	{ "label", DEBUG_LABEL },
+	{ "domain", DEBUG_DOMAIN },
+	{ "policy", DEBUG_POLICY },
+	{ "interface", DEBUG_INTERFACE },
+	{ "upcall", DEBUG_UPCALL },
+	{ NULL, 0 }
+};
+
+static struct val_table_ent *val_table_find_ent(struct val_table_ent *table,
+						const char *name, size_t len)
+{
+	struct val_table_ent *entry;
+
+	for (entry = table; entry->str != NULL; entry++) {
+		if (strncmp(entry->str, name, len) == 0 &&
+		    strlen(entry->str) == len)
+			return entry;
+	}
+	return NULL;
+}
+
+int aa_parse_debug_params(const char *str)
+{
+	struct val_table_ent *ent;
+	const char *next;
+	int val = 0;
+
+	do {
+		size_t n = strcspn(str, "\r\n,");
+
+		next = str + n;
+		ent = val_table_find_ent(debug_values_table, str, next - str);
+		if (ent)
+			val |= ent->value;
+		else
+			AA_DEBUG(DEBUG_INTERFACE, "unknown debug type '%.*s'",
+				 (int)(next - str), str);
+		str = next + 1;
+	} while (*next != 0);
+	return val;
+}
+
+/**
+ * aa_mask_to_str - convert a perm mask to its short string
+ * @str: character buffer to store string in (at least 10 characters)
+ * @str_size: size of the @str buffer
+ * @chrs: NUL-terminated character buffer of permission characters
+ * @mask: permission mask to convert
+ */
+static int val_mask_to_str(char *str, size_t size,
+			   const struct val_table_ent *table, u32 mask)
+{
+	const struct val_table_ent *ent;
+	int total = 0;
+
+	for (ent = table; ent->str; ent++) {
+		if (ent->value && (ent->value & mask) == ent->value) {
+			int len = scnprintf(str, size, "%s%s", total ? "," : "",
+					    ent->str);
+			size -= len;
+			str += len;
+			total += len;
+			mask &= ~ent->value;
+		}
+	}
+
+	return total;
+}
+
+int aa_print_debug_params(char *buffer)
+{
+	if (!aa_g_debug)
+		return sprintf(buffer, "N");
+	return val_mask_to_str(buffer, PAGE_SIZE, debug_values_table,
+			       aa_g_debug);
+}
+
 /**
  * aa_free_str_table - free entries str table
  * @t: the string table to free  (MAYBE NULL)
@@ -172,7 +264,7 @@
 
 
 const char aa_file_perm_chrs[] = "xwracd         km l     ";
-const char *aa_file_perm_names[] = {
+const char *aa_base_perm_names[] = {
 	"exec",
 	"write",
 	"read",
@@ -262,6 +354,10 @@
 {
 	char str[33];
 
+	if (!chrs)
+		chrs = aa_file_perm_chrs;
+	if (!names)
+		names = aa_base_perm_names;
 	audit_log_format(ab, "\"");
 	if ((mask & chrsmask) && chrs) {
 		aa_perm_mask_to_str(str, sizeof(str), chrs, mask & chrsmask);
@@ -275,6 +371,22 @@
 	audit_log_format(ab, "\"");
 }
 
+void aa_audit_perms(struct audit_buffer *ab, struct apparmor_audit_data *ad,
+		    const char *chrs, u32 chrsmask, const char * const *names,
+		    u32 namesmask)
+{
+	if (ad->request) {
+		audit_log_format(ab, " requested=");
+		aa_audit_perm_mask(ab, ad->request, chrs, chrsmask,
+				   names, namesmask);
+	}
+	if (ad->denied) {
+		audit_log_format(ab, " denied=");
+		aa_audit_perm_mask(ab, ad->denied, chrs, chrsmask,
+				   names, namesmask);
+	}
+}
+
 /**
  * aa_audit_perms_cb - generic callback fn for auditing perms
  * @ab: audit buffer (NOT NULL)
@@ -282,21 +394,10 @@
  */
 static void aa_audit_perms_cb(struct audit_buffer *ab, void *va)
 {
-	struct common_audit_data *sa = va;
-	struct apparmor_audit_data *ad = aad(sa);
+	struct apparmor_audit_data *ad = aad_of_va(va);
 
-	if (ad->request) {
-		audit_log_format(ab, " requested_mask=");
-		aa_audit_perm_mask(ab, ad->request, aa_file_perm_chrs,
-				   PERMS_CHRS_MASK, aa_file_perm_names,
-				   PERMS_NAMES_MASK);
-	}
-	if (ad->denied) {
-		audit_log_format(ab, "denied_mask=");
-		aa_audit_perm_mask(ab, ad->denied, aa_file_perm_chrs,
-				   PERMS_CHRS_MASK, aa_file_perm_names,
-				   PERMS_NAMES_MASK);
-	}
+	aa_audit_perms(ab, ad, aa_file_perm_chrs, PERMS_CHRS_MASK,
+		       aa_base_perm_names, PERMS_NAMES_MASK);
 	audit_log_format(ab, " peer=");
 	aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
 				      FLAGS_NONE, GFP_ATOMIC);
@@ -390,7 +491,7 @@
 		   void (*cb)(struct audit_buffer *, void *))
 {
 	int type, error;
-	u32 denied = request & (~perms->allow | perms->deny);
+	u32 denied = denied_perms(perms, request);
 
 	if (likely(!denied)) {
 		/* mask off perms that are not being force audited */
@@ -419,6 +520,7 @@
 	}
 
 	if (ad) {
+		// do_notification()
 		ad->subj_label = &profile->label;
 		ad->request = request;
 		ad->denied = denied;
--- linux-qcom-6.8.0.orig/security/apparmor/lsm.c
+++ linux-qcom-6.8.0/security/apparmor/lsm.c
@@ -18,6 +18,8 @@
 #include <linux/ctype.h>
 #include <linux/sysctl.h>
 #include <linux/audit.h>
+#include <linux/nsproxy.h>
+#include <linux/ipc_namespace.h>
 #include <linux/user_namespace.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv6.h>
@@ -26,12 +28,15 @@
 #include <uapi/linux/mount.h>
 #include <uapi/linux/lsm.h>
 
+#include "include/af_unix.h"
+#include "include/af_inet.h"
 #include "include/apparmor.h"
 #include "include/apparmorfs.h"
 #include "include/audit.h"
 #include "include/capability.h"
 #include "include/cred.h"
 #include "include/file.h"
+#include "include/inode.h"
 #include "include/ipc.h"
 #include "include/net.h"
 #include "include/path.h"
@@ -64,6 +69,13 @@
 static DEFINE_SPINLOCK(aa_buffers_lock);
 static DEFINE_PER_CPU(struct aa_local_cache, aa_local_buffers);
 
+struct kmem_cache *aa_audit_slab;
+
+static bool is_mqueue_dentry(struct dentry *dentry)
+{
+	return dentry && is_mqueue_inode(d_backing_inode(dentry));
+}
+
 /*
  * LSM hook functions
  */
@@ -177,14 +189,13 @@
 
 		label_for_each_confined(i, label, profile) {
 			struct aa_ruleset *rules;
-			if (COMPLAIN_MODE(profile))
-				continue;
+			kernel_cap_t allowed;
+
 			rules = list_first_entry(&profile->rules,
 						 typeof(*rules), list);
-			*effective = cap_intersect(*effective,
-						   rules->caps.allow);
-			*permitted = cap_intersect(*permitted,
-						   rules->caps.allow);
+			allowed = aa_profile_capget(profile);
+			*effective = cap_intersect(*effective, allowed);
+			*permitted = cap_intersect(*permitted, allowed);
 		}
 	}
 	rcu_read_unlock();
@@ -451,11 +462,168 @@
 	return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN);
 }
 
+static int common_mqueue_path_perm(const char *op, u32 request,
+				   const struct path *path)
+{
+	struct aa_label *label;
+	int error = 0;
+
+	label = begin_current_label_crit_section();
+	if (!unconfined(label))
+		error = aa_mqueue_perm(OP_UNLINK, current_cred(), label, path,
+				       request);
+
+	end_current_label_crit_section(label);
+
+	return error;
+}
+
 static int apparmor_inode_getattr(const struct path *path)
 {
+	if (is_mqueue_dentry(path->dentry))
+		/* TODO: fn() for d_parent */
+		return common_mqueue_path_perm(OP_UNLINK, AA_MAY_GETATTR, path);
+
 	return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR);
 }
 
+/* inode security operations */
+
+/* alloced by infrastructure */
+static int apparmor_inode_alloc_security(struct inode *inode)
+{
+	struct aa_inode_sec *isec = apparmor_inode(inode);
+
+	spin_lock_init(&isec->lock);
+	isec->inode = inode;
+	isec->label = NULL;
+	isec->sclass = 0;
+	isec->initialized = false;
+
+	return 0;
+}
+
+/* freed by infrastructure */
+static void apparmor_inode_free_security(struct inode *inode)
+{
+	struct aa_inode_sec *isec = apparmor_inode(inode);
+
+	if (!isec)
+		return;
+
+	aa_put_label(isec->label);
+}
+
+
+/* this is broken, in that we must make it work for ALL xattr fs
+ * or it will bail early, so this does not work with LSM stacking
+ */
+static int apparmor_inode_init_security(struct inode *inode, struct inode *dir,
+				       const struct qstr *qstr,
+				       struct xattr *xattrs, int *xattr_count)
+{
+	struct aa_inode_sec *isec = apparmor_inode(inode);
+
+	if (is_mqueue_inode(dir)) {
+		/* only initialize based on implied label atm */
+		isec->label = aa_get_current_label();
+		isec->sclass = AA_CLASS_POSIX_MQUEUE;
+		isec->initialized = true;
+	}
+
+	/* we aren't setting xattrs yet so pretend it isn't supported,
+	 * note bug in LSM means other LSMs won't get to init inode either
+	 */
+	return -EOPNOTSUPP;
+}
+
+static int inode_init_with_dentry(struct inode *inode, struct dentry *dentry)
+{
+	struct aa_inode_sec *isec = apparmor_inode(inode);
+
+	if (isec->initialized)
+		return 0;
+	spin_lock(&isec->lock);
+	/* recheck under lock */
+	if (isec->initialized)
+		goto unlock;
+
+	if (is_mqueue_sb(inode->i_sb)) {
+		/* only initialize based on implied label atm */
+		isec->label = aa_get_current_label();
+		isec->sclass = AA_CLASS_POSIX_MQUEUE;
+		isec->initialized = true;
+	}
+
+unlock:
+	spin_unlock(&isec->lock);
+
+	return 0;
+}
+
+static void apparmor_d_instantiate(struct dentry *dentry, struct inode *inode)
+{
+	if (inode)
+		inode_init_with_dentry(inode, dentry);
+}
+
+static int apparmor_inode_create(struct inode *dir, struct dentry *dentry,
+				 umode_t mode)
+{
+	struct aa_label *label;
+	int error = 0;
+
+	label = begin_current_label_crit_section();
+	if (!unconfined(label)) {
+		struct path path = {
+			.dentry = dentry,
+			.mnt = current->nsproxy->ipc_ns->mq_mnt,
+		};
+		if (is_mqueue_inode(dir))
+			error = aa_mqueue_perm(OP_CREATE, current_cred(),
+					       label, &path, AA_MAY_CREATE);
+	}
+	end_current_label_crit_section(label);
+
+	return error;
+}
+
+static int common_mqueue_perm(const char *op, u32 request, struct inode *dir, struct dentry *dentry)
+{
+	/* can't directly determine ipc ns, but know for mqueues dir is mnt_root */
+	bool isdir = d_inode(current->nsproxy->ipc_ns->mq_mnt->mnt_root) == dir;
+	struct path path = {
+		.dentry = dentry,
+		.mnt = isdir ? current->nsproxy->ipc_ns->mq_mnt : NULL,
+	};
+
+	if (dir != d_inode(current->nsproxy->ipc_ns->mq_mnt->mnt_root))
+		pr_warn("apparmor: unlink dir != mnt_root - disconnected");
+
+	return common_mqueue_path_perm(op, request, &path);
+}
+
+static int apparmor_inode_unlink(struct inode *dir, struct dentry *dentry)
+{
+	int error = 0;
+
+	if (is_mqueue_dentry(dentry))
+		error = common_mqueue_perm(OP_UNLINK, AA_MAY_DELETE, dir, dentry);
+
+	return error;
+}
+
+static int apparmor_inode_setattr(struct dentry *dentry, struct iattr *iattr)
+{
+	/* TODO: extend to support iattr as a parameter */
+	if (is_mqueue_dentry(dentry))
+		/* TODO: fn() for d_parent */
+		return common_mqueue_perm(OP_UNLINK, AA_MAY_SETATTR,
+				  d_backing_inode(dentry->d_parent), dentry);
+
+	return 0;
+}
+
 static int apparmor_file_open(struct file *file)
 {
 	struct aa_file_ctx *fctx = file_ctx(file);
@@ -488,11 +656,17 @@
 		vfsuid = i_uid_into_vfsuid(idmap, inode);
 		cond.uid = vfsuid_into_kuid(vfsuid);
 
-		error = aa_path_perm(OP_OPEN, file->f_cred,
-				     label, &file->f_path, 0,
-				     aa_map_file_to_perms(file), &cond);
+		if (is_mqueue_inode(file_inode(file)))
+			error = aa_mqueue_perm(OP_OPEN, file->f_cred,
+					       label, &file->f_path,
+					       aa_map_file_to_perms(file));
+		else
+			error = aa_path_perm(OP_OPEN, file->f_cred,
+					     label, &file->f_path, 0,
+					     aa_map_file_to_perms(file), &cond);
 		/* todo cache full allowed permissions set and state */
-		fctx->allow = aa_map_file_to_perms(file);
+		if (!error)
+			fctx->allow = aa_map_file_to_perms(file);
 	}
 	aa_put_label(label);
 
@@ -504,6 +678,7 @@
 	struct aa_file_ctx *ctx = file_ctx(file);
 	struct aa_label *label = begin_current_label_crit_section();
 
+	/* no inode available here */
 	spin_lock_init(&ctx->lock);
 	rcu_assign_pointer(ctx->label, aa_get_label(label));
 	end_current_label_crit_section(label);
@@ -628,13 +803,41 @@
 {
 	unsigned int state;
 	struct aa_ruleset *rules;
-	int error = 0;
 
 	AA_BUG(!profile);
 
 	rules = list_first_entry(&profile->rules, typeof(*rules), list);
+
+	/* TODO: rework unconfined profile/dfa to mediate user ns, then
+	 * we can drop the unconfined test
+	 */
 	state = RULE_MEDIATES(rules, AA_CLASS_IO_URING);
-	if (state) {
+	if (!state) {
+		/* TODO: this gets replaced when the default unconfined
+		 * profile dfa gets updated to handle this
+		 */
+		if (profile_unconfined(profile) &&
+		    profile == profiles_ns(profile)->unconfined) {
+			if (!aa_unprivileged_uring_restricted ||
+			    ns_capable_noaudit(current_user_ns(), cap))
+				/* unconfined early bail out */
+				return 0;
+			/* unconfined unprivileged user */
+			/* don't just return: allow complain mode to override */
+		} else {
+			/* Fallback to capability check if profile doesn't
+			 * support io_uring rules. Note: special unconfined
+			 * profiles as well.
+			 */
+			return aa_capable(current_cred(), &profile->label,
+					  cap, CAP_OPT_NONE);
+		}
+		/* continue to mediation - !state means non-accepting
+		 * but can be overidden by complain
+		 */
+	}
+	/* block so perms is not initialized unless mediating */
+	do {
 		struct aa_perms perms = { };
 
 		if (new) {
@@ -644,11 +847,11 @@
 			perms = *aa_lookup_perms(rules->policy, state);
 		}
 		aa_apply_modes_to_perms(profile, &perms);
-		error = aa_check_perms(profile, &perms, request, ad,
+		return aa_check_perms(profile, &perms, request, ad,
 				       audit_uring_cb);
-	}
+	} while (0);
 
-	return error;
+	return 0;
 }
 
 /**
@@ -779,7 +982,7 @@
 }
 
 static int apparmor_getselfattr(unsigned int attr, struct lsm_ctx __user *lx,
-				size_t *size, u32 flags)
+				u32 *size, u32 flags)
 {
 	int error = -ENOENT;
 	struct aa_task_ctx *ctx = task_ctx(current);
@@ -924,7 +1127,7 @@
 }
 
 static int apparmor_setselfattr(unsigned int attr, struct lsm_ctx *ctx,
-				size_t size, u32 flags)
+				u32 size, u32 flags)
 {
 	int rc;
 
@@ -981,17 +1184,20 @@
 	return;
 }
 
-static void apparmor_current_getsecid_subj(u32 *secid)
+static void apparmor_current_getlsmblob_subj(struct lsmblob *blob)
 {
 	struct aa_label *label = __begin_current_label_crit_section();
-	*secid = label->secid;
+
+	blob->apparmor.label = label;
 	__end_current_label_crit_section(label);
 }
 
-static void apparmor_task_getsecid_obj(struct task_struct *p, u32 *secid)
+static void apparmor_task_getlsmblob_obj(struct task_struct *p,
+					  struct lsmblob *blob)
 {
 	struct aa_label *label = aa_get_task_label(p);
-	*secid = label->secid;
+
+	blob->apparmor.label = label;
 	aa_put_label(label);
 }
 
@@ -1036,48 +1242,48 @@
 	return error;
 }
 
-static int apparmor_userns_create(const struct cred *cred)
+static int apparmor_userns_create(const struct cred *new_cred)
 {
 	struct aa_label *label;
 	struct aa_profile *profile;
 	int error = 0;
-	DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_TASK, AA_CLASS_NS,
-			  OP_USERNS_CREATE);
-
-	ad.subj_cred = current_cred();
 
 	label = begin_current_label_crit_section();
-	if (!unconfined(label)) {
-		error = fn_for_each(label, profile,
-				    aa_profile_ns_perm(profile, &ad,
-						       AA_USERNS_CREATE));
+	/* remove unprivileged_userns_restricted check when unconfined is updated */
+	if (aa_unprivileged_userns_restricted ||
+	    label_mediates(label, AA_CLASS_NS)) {
+		struct aa_label *new;
+		DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_TASK, AA_CLASS_NS,
+				  OP_USERNS_CREATE);
+		ad.subj_cred = current_cred();
+
+		new = fn_label_build(label, profile, GFP_KERNEL,
+				aa_profile_ns_perm(profile, &ad,
+						   AA_USERNS_CREATE));
+		if (IS_ERR(new)) {
+			error = PTR_ERR(new);
+		} else if (new && cred_label(new_cred) != new) {
+			aa_put_label(cred_label(new_cred));
+			set_cred_label(new_cred, new);
+		} else {
+			aa_put_label(new);
+		}
 	}
 	end_current_label_crit_section(label);
 
 	return error;
 }
 
-static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags)
-{
-	struct aa_sk_ctx *ctx;
-
-	ctx = kzalloc(sizeof(*ctx), flags);
-	if (!ctx)
-		return -ENOMEM;
-
-	sk->sk_security = ctx;
-
-	return 0;
-}
-
+/**
+ * apparmor_sk_free_security - free the sk_security field
+ */
 static void apparmor_sk_free_security(struct sock *sk)
 {
 	struct aa_sk_ctx *ctx = aa_sock(sk);
 
-	sk->sk_security = NULL;
 	aa_put_label(ctx->label);
 	aa_put_label(ctx->peer);
-	kfree(ctx);
+	path_put(&ctx->path);
 }
 
 /**
@@ -1098,6 +1304,102 @@
 	if (new->peer)
 		aa_put_label(new->peer);
 	new->peer = aa_get_label(ctx->peer);
+	new->path = ctx->path;
+	path_get(&new->path);
+}
+
+static struct path *UNIX_FS_CONN_PATH(struct sock *sk, struct sock *newsk)
+{
+	if (sk->sk_family == PF_UNIX && UNIX_FS(sk))
+		return &unix_sk(sk)->path;
+	else if (newsk->sk_family == PF_UNIX && UNIX_FS(newsk))
+		return &unix_sk(newsk)->path;
+	return NULL;
+}
+
+/**
+ * apparmor_unix_stream_connect - check perms before making unix domain conn
+ *
+ * peer is locked when this hook is called
+ */
+static int apparmor_unix_stream_connect(struct sock *sk, struct sock *peer_sk,
+					struct sock *newsk)
+{
+	struct aa_sk_ctx *sk_ctx = aa_sock(sk);
+	struct aa_sk_ctx *peer_ctx = aa_sock(peer_sk);
+	struct aa_sk_ctx *new_ctx = aa_sock(newsk);
+	struct aa_label *label;
+	struct path *path;
+	int error;
+
+	label = __begin_current_label_crit_section();
+	error = aa_unix_peer_perm(current_cred(), label, OP_CONNECT,
+				(AA_MAY_CONNECT | AA_MAY_SEND | AA_MAY_RECEIVE),
+				  sk, peer_sk, NULL);
+	if (!UNIX_FS(peer_sk)) {
+		last_error(error,
+			   aa_unix_peer_perm(current_cred(),
+				peer_ctx->label, OP_CONNECT,
+				(AA_MAY_ACCEPT | AA_MAY_SEND | AA_MAY_RECEIVE),
+				peer_sk, sk, label));
+	}
+	__end_current_label_crit_section(label);
+
+	if (error)
+		return error;
+
+	/* label newsk if it wasn't labeled in post_create. Normally this
+	 * would be done in sock_graft, but because we are directly looking
+	 * at the peer_sk to obtain peer_labeling for unix socks this
+	 * does not work
+	 */
+	if (!new_ctx->label)
+		new_ctx->label = aa_get_label(peer_ctx->label);
+
+	/* Cross reference the peer labels for SO_PEERSEC */
+	if (new_ctx->peer)
+		aa_put_label(new_ctx->peer);
+
+	if (sk_ctx->peer)
+		aa_put_label(sk_ctx->peer);
+
+	new_ctx->peer = aa_get_label(sk_ctx->label);
+	sk_ctx->peer = aa_get_label(peer_ctx->label);
+
+	path = UNIX_FS_CONN_PATH(sk, peer_sk);
+	if (path) {
+		new_ctx->path = *path;
+		sk_ctx->path = *path;
+		path_get(path);
+		path_get(path);
+	}
+	return 0;
+}
+
+/**
+ * apparmor_unix_may_send - check perms before conn or sending unix dgrams
+ *
+ * other is locked when this hook is called
+ *
+ * dgram connect calls may_send, peer setup but path not copied?????
+ */
+static int apparmor_unix_may_send(struct socket *sock, struct socket *peer)
+{
+	struct aa_sk_ctx *peer_ctx = aa_sock(peer->sk);
+	struct aa_label *label;
+	int error;
+
+	label = __begin_current_label_crit_section();
+	error = xcheck(aa_unix_peer_perm(current_cred(),
+					 label, OP_SENDMSG, AA_MAY_SEND,
+					 sock->sk, peer->sk, NULL),
+		       aa_unix_peer_perm(peer->file ? peer->file->f_cred : NULL,
+					 peer_ctx->label, OP_SENDMSG,
+					 AA_MAY_RECEIVE,
+					 peer->sk, sock->sk, label));
+	__end_current_label_crit_section(label);
+
+	return error;
 }
 
 static int apparmor_socket_create(int family, int type, int protocol, int kern)
@@ -1107,8 +1409,11 @@
 
 	AA_BUG(in_interrupt());
 
+	if (kern)
+		return 0;
+
 	label = begin_current_label_crit_section();
-	if (!(kern || unconfined(label)))
+	if (label_mediates(label, AA_CLASS_NET))
 		error = af_select(family,
 				  create_perm(label, family, type, protocol),
 				  aa_af_perm(current_cred(), label,
@@ -1301,23 +1606,46 @@
 {
 	struct aa_sk_ctx *ctx = aa_sock(sk);
 
-	if (!skb->secmark)
+	if (!aa_secmark() || !skb->secmark)
 		return 0;
 
+	/*
+	 * If reach here before socket_post_create hook is called, in which
+	 * case label is null, drop the packet.
+	 */
+	if (!ctx->label)
+		return -EACCES;
+
 	return apparmor_secmark_check(ctx->label, OP_RECVMSG, AA_MAY_RECEIVE,
 				      skb->secmark, sk);
 }
 #endif
 
 
-static struct aa_label *sk_peer_label(struct sock *sk)
+static struct aa_label *sk_peer_get_label(struct sock *sk)
 {
+	struct sock *peer_sk;
 	struct aa_sk_ctx *ctx = aa_sock(sk);
+	struct aa_label *label = ERR_PTR(-ENOPROTOOPT);
 
 	if (ctx->peer)
-		return ctx->peer;
+		return aa_get_label(ctx->peer);
 
-	return ERR_PTR(-ENOPROTOOPT);
+	if (sk->sk_family != PF_UNIX)
+		return ERR_PTR(-ENOPROTOOPT);
+
+	/* check for sockpair peering which does not go through
+	 * security_unix_stream_connect
+	 */
+	peer_sk = unix_peer_get(sk);
+	if (peer_sk) {
+		ctx = aa_sock(peer_sk);
+		if (ctx->label)
+			label = aa_get_label(ctx->label);
+		sock_put(peer_sk);
+	}
+
+	return label;
 }
 
 /**
@@ -1340,7 +1668,7 @@
 	struct aa_label *peer;
 
 	label = begin_current_label_crit_section();
-	peer = sk_peer_label(sock->sk);
+	peer = sk_peer_get_label(sock->sk);
 	if (IS_ERR(peer)) {
 		error = PTR_ERR(peer);
 		goto done;
@@ -1351,7 +1679,7 @@
 	/* don't include terminating \0 in slen, it breaks some apps */
 	if (slen < 0) {
 		error = -ENOMEM;
-		goto done;
+		goto done_put;
 	}
 	if (slen > len) {
 		error = -ERANGE;
@@ -1363,6 +1691,9 @@
 done_len:
 	if (copy_to_sockptr(optlen, &slen, sizeof(slen)))
 		error = -EFAULT;
+
+done_put:
+	aa_put_label(peer);
 done:
 	end_current_label_crit_section(label);
 	kfree(name);
@@ -1370,22 +1701,6 @@
 }
 
 /**
- * apparmor_socket_getpeersec_dgram - get security label of packet
- * @sock: the peer socket
- * @skb: packet data
- * @secid: pointer to where to put the secid of the packet
- *
- * Sets the netlabel socket state on sk from parent
- */
-static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-					    struct sk_buff *skb, u32 *secid)
-
-{
-	/* TODO: requires secid support */
-	return -ENOPROTOOPT;
-}
-
-/**
  * apparmor_sock_graft - Initialize newly created socket
  * @sk: child sock
  * @parent: parent socket
@@ -1410,7 +1725,7 @@
 {
 	struct aa_sk_ctx *ctx = aa_sock(sk);
 
-	if (!skb->secmark)
+	if (!aa_secmark() || !skb->secmark)
 		return 0;
 
 	return apparmor_secmark_check(ctx->label, OP_CONNECT, AA_MAY_CONNECT,
@@ -1424,12 +1739,19 @@
 struct lsm_blob_sizes apparmor_blob_sizes __ro_after_init = {
 	.lbs_cred = sizeof(struct aa_label *),
 	.lbs_file = sizeof(struct aa_file_ctx),
+	.lbs_inode = sizeof(struct aa_inode_sec),
 	.lbs_task = sizeof(struct aa_task_ctx),
+	.lbs_sock = sizeof(struct aa_sk_ctx),
+	.lbs_secmark = true,
+	.lbs_ipc = sizeof(struct aa_ipc_sec),
+	.lbs_msg_msg = sizeof(struct aa_msg_sec),
+	.lbs_superblock = sizeof(struct aa_superblock_sec),
 };
 
 static const struct lsm_id apparmor_lsmid = {
 	.name = "apparmor",
 	.id = LSM_ID_APPARMOR,
+	.lsmblob = true,
 };
 
 static struct security_hook_list apparmor_hooks[] __ro_after_init = {
@@ -1455,6 +1777,16 @@
 	LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
 	LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
 
+	LSM_HOOK_INIT(inode_alloc_security, apparmor_inode_alloc_security),
+	LSM_HOOK_INIT(inode_free_security, apparmor_inode_free_security),
+	LSM_HOOK_INIT(inode_init_security, apparmor_inode_init_security),
+	LSM_HOOK_INIT(d_instantiate, apparmor_d_instantiate),
+
+	LSM_HOOK_INIT(inode_create, apparmor_inode_create),
+	LSM_HOOK_INIT(inode_unlink, apparmor_inode_unlink),
+	LSM_HOOK_INIT(inode_setattr, apparmor_inode_setattr),
+	LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
+
 	LSM_HOOK_INIT(file_open, apparmor_file_open),
 	LSM_HOOK_INIT(file_receive, apparmor_file_receive),
 	LSM_HOOK_INIT(file_permission, apparmor_file_permission),
@@ -1470,10 +1802,12 @@
 	LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
 	LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
 
-	LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security),
 	LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security),
 	LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security),
 
+	LSM_HOOK_INIT(unix_stream_connect, apparmor_unix_stream_connect),
+	LSM_HOOK_INIT(unix_may_send, apparmor_unix_may_send),
+
 	LSM_HOOK_INIT(socket_create, apparmor_socket_create),
 	LSM_HOOK_INIT(socket_post_create, apparmor_socket_post_create),
 	LSM_HOOK_INIT(socket_bind, apparmor_socket_bind),
@@ -1492,8 +1826,6 @@
 #endif
 	LSM_HOOK_INIT(socket_getpeersec_stream,
 		      apparmor_socket_getpeersec_stream),
-	LSM_HOOK_INIT(socket_getpeersec_dgram,
-		      apparmor_socket_getpeersec_dgram),
 	LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
 #ifdef CONFIG_NETWORK_SECMARK
 	LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
@@ -1510,8 +1842,9 @@
 
 	LSM_HOOK_INIT(task_free, apparmor_task_free),
 	LSM_HOOK_INIT(task_alloc, apparmor_task_alloc),
-	LSM_HOOK_INIT(current_getsecid_subj, apparmor_current_getsecid_subj),
-	LSM_HOOK_INIT(task_getsecid_obj, apparmor_task_getsecid_obj),
+	LSM_HOOK_INIT(current_getlsmblob_subj,
+		      apparmor_current_getlsmblob_subj),
+	LSM_HOOK_INIT(task_getlsmblob_obj, apparmor_task_getlsmblob_obj),
 	LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
 	LSM_HOOK_INIT(task_kill, apparmor_task_kill),
 	LSM_HOOK_INIT(userns_create, apparmor_userns_create),
@@ -1524,6 +1857,7 @@
 #endif
 
 	LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx),
+	LSM_HOOK_INIT(lsmblob_to_secctx, apparmor_lsmblob_to_secctx),
 	LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid),
 	LSM_HOOK_INIT(release_secctx, apparmor_release_secctx),
 
@@ -1573,6 +1907,9 @@
 	.get = param_get_aalockpolicy
 };
 
+static int param_set_debug(const char *val, const struct kernel_param *kp);
+static int param_get_debug(char *buffer, const struct kernel_param *kp);
+
 static int param_set_audit(const char *val, const struct kernel_param *kp);
 static int param_get_audit(char *buffer, const struct kernel_param *kp);
 
@@ -1606,8 +1943,9 @@
 		   aacompressionlevel, 0400);
 
 /* Debug mode */
-bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES);
-module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
+int aa_g_debug;
+module_param_call(debug, param_set_debug, param_get_debug,
+		  &aa_g_debug, S_IRUSR | S_IWUSR);
 
 /* Audit mode */
 enum audit_mode aa_g_audit;
@@ -1800,6 +2138,34 @@
 	return param_get_int(buffer, kp);
 }
 
+static int param_get_debug(char *buffer, const struct kernel_param *kp)
+{
+	if (!apparmor_enabled)
+		return -EINVAL;
+	if (apparmor_initialized && !aa_current_policy_view_capable(NULL))
+		return -EPERM;
+	return aa_print_debug_params(buffer);
+}
+
+static int param_set_debug(const char *val, const struct kernel_param *kp)
+{
+	int i;
+
+	if (!apparmor_enabled)
+		return -EINVAL;
+	if (!val)
+		return -EINVAL;
+	if (apparmor_initialized && !aa_current_policy_admin_capable(NULL))
+		return -EPERM;
+
+	i = aa_parse_debug_params(val);
+	if (i == DEBUG_PARSE_ERROR)
+		return -EINVAL;
+
+	aa_g_debug = i;
+	return 0;
+}
+
 static int param_get_audit(char *buffer, const struct kernel_param *kp)
 {
 	if (!apparmor_enabled)
@@ -2040,6 +2406,17 @@
 	return proc_dointvec(table, write, buffer, lenp, ppos);
 }
 
+static int userns_restrict_dointvec(struct ctl_table *table, int write,
+				    void *buffer, size_t *lenp, loff_t *ppos)
+{
+	if (!apparmor_enabled)
+		return -EINVAL;
+	if (write && !aa_current_policy_admin_capable(NULL))
+		return -EPERM;
+
+	return proc_dointvec(table, write, buffer, lenp, ppos);
+}
+
 static struct ctl_table apparmor_sysctl_table[] = {
 #ifdef CONFIG_USER_NS
 	{
@@ -2057,10 +2434,40 @@
 		.mode           = 0600,
 		.proc_handler   = apparmor_dointvec,
 	},
+#ifdef CONFIG_USER_NS
+	{
+		.procname       = "apparmor_restrict_unprivileged_userns",
+		.data           = &aa_unprivileged_userns_restricted,
+		.maxlen         = sizeof(int),
+		.mode           = 0644,
+		.proc_handler   = userns_restrict_dointvec,
+	},
+	{
+		.procname       = "apparmor_restrict_unprivileged_userns_force",
+		.data           = &aa_unprivileged_userns_restricted_force,
+		.maxlen         = sizeof(int),
+		.mode           = 0600,
+		.proc_handler   = apparmor_dointvec,
+	},
+	{
+		.procname       = "apparmor_restrict_unprivileged_userns_complain",
+		.data           = &aa_unprivileged_userns_restricted_complain,
+		.maxlen         = sizeof(int),
+		.mode           = 0600,
+		.proc_handler   = apparmor_dointvec,
+	},
+#endif /* CONFIG_USER_NS */
 	{
 		.procname       = "apparmor_restrict_unprivileged_unconfined",
 		.data           = &aa_unprivileged_unconfined_restricted,
 		.maxlen         = sizeof(int),
+		.mode           = 0644,
+		.proc_handler   = userns_restrict_dointvec,
+	},
+	{
+		.procname       = "apparmor_restrict_unprivileged_io_uring",
+		.data           = &aa_unprivileged_uring_restricted,
+		.maxlen         = sizeof(int),
 		.mode           = 0600,
 		.proc_handler   = apparmor_dointvec,
 	},
@@ -2086,7 +2493,7 @@
 	struct aa_sk_ctx *ctx;
 	struct sock *sk;
 
-	if (!skb->secmark)
+	if (!aa_secmark() || !skb->secmark)
 		return NF_ACCEPT;
 
 	sk = skb_to_full_sk(skb);
@@ -2217,7 +2624,16 @@
 
 static int __init apparmor_init(void)
 {
-	int error;
+	int error = -ENOMEM;
+
+	/* setup allocation caches */
+	aa_audit_slab = kmem_cache_create("apparmor_auditcache",
+					  sizeof(struct aa_audit_node),
+					  0, SLAB_PANIC, NULL);
+	if (!aa_audit_slab) {
+		AA_ERROR("Unable to setup auditdata slab cache\n");
+		goto alloc_out;
+	}
 
 	error = aa_setup_dfa_engine();
 	if (error) {
@@ -2269,6 +2685,7 @@
 alloc_out:
 	aa_destroy_aafs();
 	aa_teardown_dfa_engine();
+	kmem_cache_destroy(aa_audit_slab);
 
 	apparmor_enabled = false;
 	return error;
@@ -2276,7 +2693,7 @@
 
 DEFINE_LSM(apparmor) = {
 	.name = "apparmor",
-	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
+	.flags = LSM_FLAG_LEGACY_MAJOR,
 	.enabled = &apparmor_enabled,
 	.blobs = &apparmor_blob_sizes,
 	.init = apparmor_init,
--- linux-qcom-6.8.0.orig/security/apparmor/net.c
+++ linux-qcom-6.8.0/security/apparmor/net.c
@@ -8,6 +8,8 @@
  * Copyright 2009-2017 Canonical Ltd.
  */
 
+#include "include/af_unix.h"
+#include "include/af_inet.h"
 #include "include/apparmor.h"
 #include "include/audit.h"
 #include "include/cred.h"
@@ -21,6 +23,13 @@
 
 struct aa_sfs_entry aa_sfs_entry_network[] = {
 	AA_SFS_FILE_STRING("af_mask",	AA_SFS_AF_MASK),
+	AA_SFS_FILE_BOOLEAN("af_inet",	1),
+	{ }
+};
+
+struct aa_sfs_entry aa_sfs_entry_network_compat[] = {
+	AA_SFS_FILE_STRING("af_mask",	AA_SFS_AF_MASK),
+	AA_SFS_FILE_BOOLEAN("af_unix",	1),
 	{ }
 };
 
@@ -66,6 +75,37 @@
 	"unknown",
 };
 
+static void audit_unix_addr(struct audit_buffer *ab, const char *str,
+			    struct sockaddr_un *addr, int addrlen)
+{
+	int len = unix_addr_len(addrlen);
+
+	if (!addr || len <= 0) {
+		audit_log_format(ab, " %s=none", str);
+	} else if (addr->sun_path[0]) {
+		audit_log_format(ab, " %s=", str);
+		audit_log_untrustedstring(ab, addr->sun_path);
+	} else {
+		audit_log_format(ab, " %s=\"@", str);
+		if (audit_string_contains_control(&addr->sun_path[1], len - 1))
+			audit_log_n_hex(ab, &addr->sun_path[1], len - 1);
+		else
+			audit_log_format(ab, "%.*s", len - 1,
+					 &addr->sun_path[1]);
+		audit_log_format(ab, "\"");
+	}
+}
+
+static void audit_unix_sk_addr(struct audit_buffer *ab, const char *str,
+			       const struct sock *sk)
+{
+	const struct unix_sock *u = unix_sk(sk);
+
+	if (u && u->addr)
+		audit_unix_addr(ab, str, u->addr->name, u->addr->len);
+	else
+		audit_unix_addr(ab, str, NULL, 0);
+}
 
 /* audit callback for net specific fields */
 void audit_net_cb(struct audit_buffer *ab, void *va)
@@ -73,12 +113,12 @@
 	struct common_audit_data *sa = va;
 	struct apparmor_audit_data *ad = aad(sa);
 
-	if (address_family_names[sa->u.net->family])
+	if (address_family_names[ad->common.u.net->family])
 		audit_log_format(ab, " family=\"%s\"",
-				 address_family_names[sa->u.net->family]);
+				 address_family_names[ad->common.u.net->family]);
 	else
 		audit_log_format(ab, " family=\"unknown(%d)\"",
-				 sa->u.net->family);
+				 ad->common.u.net->family);
 	if (sock_type_names[ad->net.type])
 		audit_log_format(ab, " sock_type=\"%s\"",
 				 sock_type_names[ad->net.type]);
@@ -88,16 +128,33 @@
 	audit_log_format(ab, " protocol=%d", ad->net.protocol);
 
 	if (ad->request & NET_PERMS_MASK) {
-		audit_log_format(ab, " requested_mask=");
+		audit_log_format(ab, " requested=");
 		aa_audit_perm_mask(ab, ad->request, NULL, 0,
 				   net_mask_names, NET_PERMS_MASK);
 
 		if (ad->denied & NET_PERMS_MASK) {
-			audit_log_format(ab, " denied_mask=");
+			audit_log_format(ab, " denied=");
 			aa_audit_perm_mask(ab, ad->denied, NULL, 0,
 					   net_mask_names, NET_PERMS_MASK);
 		}
 	}
+	if (ad->common.u.net->family == AF_UNIX) {
+		if ((ad->request & ~NET_PEER_MASK) && ad->net.addr)
+			audit_unix_addr(ab, "addr",
+					unix_addr(ad->net.addr),
+					ad->net.addrlen);
+		else
+			audit_unix_sk_addr(ab, "addr", ad->common.u.net->sk);
+		if (ad->request & NET_PEER_MASK) {
+			if (ad->net.addr)
+				audit_unix_addr(ab, "peer_addr",
+						unix_addr(ad->net.addr),
+						ad->net.addrlen);
+			else
+				audit_unix_sk_addr(ab, "peer_addr",
+						   ad->net.peer_sk);
+		}
+	}
 	if (ad->peer) {
 		audit_log_format(ab, " peer=");
 		aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
@@ -118,18 +175,28 @@
 
 	AA_BUG(family >= AF_MAX);
 	AA_BUG(type < 0 || type >= SOCK_MAX);
+	AA_BUG(profile_unconfined(profile));
 
-	if (profile_unconfined(profile))
-		return 0;
 	state = RULE_MEDIATES(rules, AA_CLASS_NET);
-	if (!state)
-		return 0;
+	if (state) {
+		buffer[0] = cpu_to_be16(family);
+		buffer[1] = cpu_to_be16((u16) type);
+		state = aa_dfa_match_len(rules->policy->dfa, state,
+					 (char *) &buffer, 4);
+		perms = *aa_lookup_perms(rules->policy, state);
+	} else if (profile->net_compat) {
+
+	  /* 2.x socket mediation compat */
+		perms.allow = (profile->net_compat->allow[family] & (1 << type)) ?
+			ALL_PERMS_MASK : 0;
+		perms.audit = (profile->net_compat->audit[family] & (1 << type)) ?
+			ALL_PERMS_MASK : 0;
+		perms.quiet = (profile->net_compat->quiet[family] & (1 << type)) ?
+			ALL_PERMS_MASK : 0;
 
-	buffer[0] = cpu_to_be16(family);
-	buffer[1] = cpu_to_be16((u16) type);
-	state = aa_dfa_match_len(rules->policy->dfa, state, (char *) &buffer,
-				 4);
-	perms = *aa_lookup_perms(rules->policy, state);
+	} else {
+		return 0;
+	}
 	aa_apply_modes_to_perms(profile, &perms);
 
 	return aa_check_perms(profile, &perms, request, ad, audit_net_cb);
@@ -151,7 +218,7 @@
 			    const char *op, u32 request,
 			    struct sock *sk)
 {
-	struct aa_sk_ctx *ctx = SK_CTX(sk);
+	struct aa_sk_ctx *ctx = aa_sock(sk);
 	int error = 0;
 
 	AA_BUG(!label);
@@ -193,7 +260,10 @@
 	AA_BUG(!sock);
 	AA_BUG(!sock->sk);
 
-	return aa_label_sk_perm(subj_cred, label, op, request, sock->sk);
+	return af_select(sock->sk->sk_family,
+			 file_perm(subj_cred, label, op, request, sock),
+			 aa_label_sk_perm(subj_cred, label, op, request,
+					  sock->sk));
 }
 
 #ifdef CONFIG_NETWORK_SECMARK
--- linux-qcom-6.8.0.orig/security/apparmor/notify.c
+++ linux-qcom-6.8.0/security/apparmor/notify.c
@@ -0,0 +1,1062 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor notifications function definitions.
+ *
+ * Copyright 2019 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+#include <linux/ctype.h>
+#include <linux/utsname.h>
+#include <linux/poll.h>
+
+#include <uapi/linux/apparmor.h>
+
+#include "include/audit.h"
+#include "include/cred.h"
+#include "include/lib.h"
+#include "include/notify.h"
+#include "include/policy_ns.h"
+
+/* TODO: when adding listener or ns propagate, on recursive add to child ns */
+
+// TODO: currently all knotif will have audit_node but not all in future
+static inline struct aa_knotif *aa_get_knotif(struct aa_knotif *knotif)
+{
+	if (knotif)
+		aa_get_audit_node(container_of(knotif, struct aa_audit_node,
+					       knotif));
+
+	return knotif;
+}
+
+static inline void aa_put_knotif(struct aa_knotif *knotif)
+{
+	if (knotif)
+		aa_put_audit_node(container_of(knotif, struct aa_audit_node,
+					       knotif));
+}
+
+static void put_refs(struct aa_listener *listener, struct aa_knotif *knotif)
+{
+	aa_put_listener(listener);
+	aa_put_knotif(knotif);
+}
+
+static void get_refs(struct aa_listener *listener, struct aa_knotif *knotif)
+{
+	aa_get_listener(listener);
+	aa_get_knotif(knotif);
+}
+
+static void __knotif_del_and_hold(struct aa_knotif *knotif)
+{
+	list_del_init(&knotif->list);
+	knotif->flags &= ~KNOTIF_ON_LIST;
+	/* keep list refcounts */
+}
+
+static void __list_append_held(struct list_head *lh, struct aa_knotif *knotif)
+{
+	AA_BUG(!lh);
+	AA_BUG(!knotif);
+
+	list_add_tail_entry(knotif, lh, list);
+	knotif->flags |= KNOTIF_ON_LIST;
+}
+
+/*
+static void __list_push_held(struct list_head *lh, struct aa_knotif *knotif)
+{
+	AA_BUG(!lh);
+	AA_BUG(!knotif);
+
+	list_add_entry(knotif, lh, list);
+	knotif->flags |= KNOTIF_ON_LIST;
+}
+*/
+
+static void __listener_add_knotif(struct aa_listener *listener,
+				  struct aa_knotif *knotif)
+{
+	AA_BUG(!listener);
+	AA_BUG(!knotif);
+	lockdep_assert_held(&listener->lock);
+
+	get_refs(listener, knotif);
+	__list_append_held(&listener->notifications, knotif);
+}
+
+// drops refs
+static void __listener_del_knotif(struct aa_listener *listener,
+				  struct aa_knotif *knotif)
+{
+	AA_BUG(!listener);
+	AA_BUG(!knotif);
+	lockdep_assert_held(&listener->lock);
+
+	list_del_init(&knotif->list);
+	if (knotif->flags & KNOTIF_ON_LIST) {
+		knotif->flags &= ~KNOTIF_ON_LIST;
+		put_refs(listener, knotif);
+	}
+}
+
+void aa_free_listener_proxy(struct aa_listener_proxy *proxy)
+{
+	if (proxy) {
+		AA_BUG(!list_empty(&proxy->llist));
+		AA_BUG(!list_empty(&proxy->nslist));
+
+		aa_put_ns(proxy->ns);
+		/* listener is owned by file, handled there */
+		kfree_sensitive(proxy);
+	}
+}
+
+static struct aa_listener_proxy *new_listener_proxy(struct aa_listener *listener,
+						   struct aa_ns *ns)
+{
+	struct aa_listener_proxy *proxy;
+
+	AA_BUG(!listener);
+	lockdep_assert_not_held(&listener->lock);
+
+	proxy = kzalloc(sizeof(*proxy), GFP_KERNEL);
+	if (!proxy)
+		return NULL;
+	INIT_LIST_HEAD(&proxy->llist);
+	INIT_LIST_HEAD(&proxy->nslist);
+
+	proxy->listener = listener;
+	if (ns)
+		ns = aa_get_ns(ns);
+	else
+		ns = aa_get_current_ns();
+	proxy->ns = ns;
+
+	spin_lock(&listener->lock);
+	list_add_tail_entry(proxy, &listener->ns_proxies, llist);
+	spin_unlock(&listener->lock);
+
+	spin_lock(&ns->listener_lock);
+	list_add_tail_entry(proxy, &ns->listeners, nslist);
+	spin_unlock(&ns->listener_lock);
+
+	return proxy;
+}
+
+
+bool aa_register_listener_proxy(struct aa_listener *listener, struct aa_ns *ns)
+{
+	struct aa_listener_proxy *proxy;
+
+	AA_BUG(!listener);
+
+	proxy = new_listener_proxy(listener, ns);
+	if (!proxy)
+		return false;
+
+	return true;
+}
+
+static void free_listener(struct aa_listener *listener)
+{
+	struct aa_listener_proxy *proxy;
+	struct aa_knotif *knotif;
+
+	if (!listener)
+		return;
+
+	wake_up_interruptible_poll(&listener->wait, EPOLLIN | EPOLLRDNORM);
+
+	spin_lock(&listener->lock);
+	while (!list_empty(&listener->ns_proxies)) {
+		proxy = list_first_entry(&listener->ns_proxies,
+					 struct aa_listener_proxy,
+					 llist);
+		list_del_init(&proxy->llist);
+		spin_unlock(&listener->lock);
+
+		spin_lock(&proxy->ns->listener_lock);
+		list_del_init(&proxy->nslist);
+		spin_unlock(&proxy->ns->listener_lock);
+
+		aa_put_ns(proxy->ns);
+		kfree_sensitive(proxy);
+
+		spin_lock(&listener->lock);
+	}
+	spin_unlock(&listener->lock);
+
+	spin_lock(&listener->lock);
+	while (!list_empty(&listener->notifications)) {
+		knotif = list_first_entry(&listener->notifications,
+					 struct aa_knotif,
+					 list);
+		__listener_del_knotif(listener, knotif);
+		complete(&knotif->ready);
+		put_refs(listener, knotif);
+	}
+	spin_unlock(&listener->lock);
+
+	spin_lock(&listener->lock);
+	while (!list_empty(&listener->pending)) {
+		knotif = list_first_entry(&listener->pending,
+					  struct aa_knotif,
+					  list);
+		__listener_del_knotif(listener, knotif);
+		complete(&knotif->ready);
+		put_refs(listener, knotif);
+	}
+	spin_unlock(&listener->lock);
+
+	/* todo count on audit_data */
+	aa_put_ns(listener->ns);
+	aa_put_dfa(listener->filter);
+
+	kfree_sensitive(listener);
+}
+
+void aa_listener_kref(struct kref *kref)
+{
+	struct aa_listener *l = container_of(kref, struct aa_listener, count);
+
+	free_listener(l);
+}
+
+struct aa_listener *aa_new_listener(struct aa_ns *ns, gfp_t gfp)
+{
+	struct aa_listener *listener = kzalloc(sizeof(*listener), gfp);
+
+	if (!listener)
+		return NULL;
+
+	kref_init(&listener->count);
+	spin_lock_init(&listener->lock);
+	init_waitqueue_head(&listener->wait);
+	INIT_LIST_HEAD(&listener->ns_proxies);
+	INIT_LIST_HEAD(&listener->notifications);
+	INIT_LIST_HEAD(&listener->pending);
+	kref_init(&listener->count);
+
+	if (ns)
+		ns = aa_get_ns(ns);
+	else
+		ns = aa_get_current_ns();
+	listener->ns = ns;
+	listener->last_id = 1;
+
+	return listener;
+}
+
+static struct aa_knotif *__aa_find_notif_pending(struct aa_listener *listener,
+						 u64 id)
+{
+	struct aa_knotif *knotif;
+
+	AA_BUG(!listener);
+	lockdep_assert_held(&listener->lock);
+
+	list_for_each_entry(knotif, &listener->pending, list) {
+		if (knotif->id == id)
+			return knotif;
+	}
+
+	return NULL;
+}
+
+struct aa_knotif *__aa_find_notif(struct aa_listener *listener, u64 id)
+{
+	struct aa_knotif *knotif;
+
+	AA_BUG(!listener);
+	lockdep_assert_held(&listener->lock);
+
+	list_for_each_entry(knotif, &listener->notifications, list) {
+		if (knotif->id == id)
+			goto out;
+	}
+
+	knotif = __aa_find_notif_pending(listener, id);
+out:
+
+	return knotif;
+}
+
+// don't drop refcounts
+static struct aa_knotif *
+listener_pop_and_hold_knotif(struct aa_listener *listener)
+{
+	struct aa_knotif *knotif = NULL;
+
+	spin_lock(&listener->lock);
+	if (!list_empty(&listener->notifications)) {
+		knotif = list_first_entry(&listener->notifications, typeof(*knotif), list);
+		__knotif_del_and_hold(knotif);
+	}
+	spin_unlock(&listener->lock);
+
+	return knotif;
+}
+
+// require refcounts held
+/*
+static void listener_push_held_knotif(struct aa_listener *listener,
+				      struct aa_knotif *knotif)
+{
+	spin_lock(&listener->lock);
+	// listener ref held from pop and hold
+	__list_push_held(&listener->notifications, knotif);
+	spin_unlock(&listener->lock);
+	wake_up_interruptible_poll(&listener->wait, EPOLLIN | EPOLLRDNORM);
+}
+*/
+
+// require refcounts held
+// list of knotifs waiting for response
+static void listener_append_held_user_pending(struct aa_listener *listener,
+					      struct aa_knotif *knotif)
+{
+	spin_lock(&listener->lock);
+	__list_append_held(&listener->pending, knotif);
+	spin_unlock(&listener->lock);
+	//extraneous wakeup, called after reading notification
+	//wake_up_interruptible_poll(&listener->wait, EPOLLOUT | EPOLLWRNORM);
+}
+
+// don't drop refcounts
+static struct aa_knotif *
+__del_and_hold_user_pending(struct aa_listener *listener, u64 id)
+{
+	struct aa_knotif *knotif;
+
+	AA_BUG(!listener);
+	lockdep_assert_held(&listener->lock);
+
+	list_for_each_entry(knotif, &listener->pending, list) {
+		if (knotif->id == id) {
+			__knotif_del_and_hold(knotif);
+			return knotif;
+		}
+	}
+
+	return NULL;
+}
+
+
+/***************** kernel dispatching notification ********************/
+
+/*
+ * cancelled notification message due to non-timer wake-up vs.
+ * keep alive message
+ * cancel notification because ns removed?
+ * - proxy pins ns
+ * - ns can remove its list of proxies
+ * - and remove queued notifications
+ */
+
+/* TODO: allow registering on multiple namespaces */
+static bool notification_match(struct aa_listener *listener,
+			       struct aa_audit_node *ad)
+{
+	if (!(listener->mask & (1 << ad->data.type)))
+		return false;
+
+	if (listener->filter) {
+		aa_state_t state;
+		unsigned int mask;
+
+		AA_DEBUG(DEBUG_UPCALL, "using filter");
+		if (!aa_ns_visible(listener->ns, labels_ns(ad->data.subj_label),
+				   false))
+			return false;
+		state = aa_dfa_next(listener->filter, DFA_START, ad->data.type);
+		state = aa_dfa_match(listener->filter, state, ad->data.subj_label->hname);
+		if (!state)
+			return false;
+		state = aa_dfa_null_transition(listener->filter, state);
+		state = aa_dfa_match_u16(listener->filter, state, ad->data.class);
+		mask = ACCEPT_TABLE(listener->filter)[state];
+		if (ad->data.request & mask)
+			return true;
+
+		/* allow for enhanced match conditions in the future
+		 * if (mask & AA_MATCH_CONT) {
+		 *	// TODO: match extensions
+		 * }
+		 */
+		return false;
+	}
+	AA_DEBUG(DEBUG_UPCALL, "matched type mask filter");
+	return true;
+}
+
+/* Add a notification to the listener queue and wake up listener??? */
+static void dispatch_notif(struct aa_listener *listener,
+			   u16 ntype,
+			   struct aa_knotif *knotif)
+{
+	AA_BUG(!listener);
+	AA_BUG(!knotif);
+	lockdep_assert_held(&listener->lock);
+
+	AA_DEBUG_ON(knotif->id, DEBUG_UPCALL,
+		    "id %lld: redispatching notification as new id %lld",
+		    knotif->id, listener->last_id);
+	knotif->ntype = ntype;
+	knotif->id = ++listener->last_id;
+	knotif->flags = 0;
+	// only needed if syncrhonous notit
+	init_completion(&knotif->ready);
+	INIT_LIST_HEAD(&knotif->list);
+	__listener_add_knotif(listener, knotif);
+	AA_DEBUG(DEBUG_UPCALL, "id %lld: %s wake_up_interruptible",
+		 knotif->id, __func__);
+	wake_up_interruptible_poll(&listener->wait, EPOLLIN | EPOLLRDNORM);
+}
+
+
+/* handle waiting for a user space reply to a notification
+ * Returns: <0 : error or -ERESTARTSYS if interrupted
+ *           0 : success
+ */
+static int handle_synchronous_notif(struct aa_listener *listener,
+				    struct aa_knotif *knotif)
+{
+	long werr;
+	int err;
+
+	if (knotif->ad->subj_label->flags & FLAG_INTERRUPTIBLE)
+		werr = wait_for_completion_interruptible_timeout(&knotif->ready,
+						 msecs_to_jiffies(60000));
+	else
+		/* do not use close to long jiffies so cast is safe */
+		werr = (long) wait_for_completion_timeout(&knotif->ready,
+						   msecs_to_jiffies(60000));
+	/* time out OR interrupt */
+	if (werr <= 0) {
+		/* ensure knotif is not on list because of early exit */
+		spin_lock(&listener->lock);
+		// puts refs but still have calling refs
+		__listener_del_knotif(listener, knotif);
+		spin_unlock(&listener->lock);
+		if (werr == 0) {
+			AA_DEBUG(DEBUG_UPCALL, "id %lld: prompt timed out",
+				knotif->id);
+			//err = -1; // TODO: ???;
+			err = 0;
+		} else if (werr == -ERESTARTSYS) {
+			// interrupt fired syscall needs to be restarted
+			// instead of mediated
+			AA_DEBUG(DEBUG_UPCALL, "id %lld: prompt interrupted, error %ld",
+				 knotif->id, werr);
+			err = -ERESTARTSYS;
+		} else {
+			AA_DEBUG(DEBUG_UPCALL, "id %lld: prompt errored out error %ld",
+				 knotif->id, werr);
+			err = (int) werr;
+		}
+		/* time out is not considered an error and will fallback
+		 * to regular mediation
+		 */
+	} else {
+		err = 0;
+		spin_lock(&listener->lock);
+		if (!list_empty(&knotif->list)) {
+			// puts refs but still have calling refs
+			__listener_del_knotif(listener, knotif);
+			AA_DEBUG(DEBUG_UPCALL,
+				 "id %lld: bug prompt knotif still on listener list at notif completion",
+				 knotif->id);
+		}
+		spin_unlock(&listener->lock);
+	}
+
+	return err;
+}
+
+// permissions changed in ad
+int aa_do_notification(u16 ntype, struct aa_audit_node *node)
+{
+	struct aa_ns *ns = labels_ns(node->data.subj_label);
+	struct aa_listener_proxy *proxy;
+	struct aa_listener *listener;
+	struct aa_knotif *knotif;
+	int count = 0, err = 0;
+
+	AA_BUG(!node);
+	AA_BUG(!ns);
+
+	knotif = &node->knotif;
+
+	/* TODO: make read side of list walk lockless */
+	spin_lock(&ns->listener_lock);
+	list_for_each_entry(proxy, &ns->listeners, nslist) {
+
+		AA_BUG(!proxy);
+		listener = aa_get_listener(proxy->listener);
+		AA_BUG(!listener);
+		spin_lock(&listener->lock);
+		if (!notification_match(listener, node)) {
+			spin_unlock(&listener->lock);
+			aa_put_listener(listener);
+			continue;
+		}
+		/* delvier notification - dispatch determines if we break */
+		dispatch_notif(listener, ntype, knotif); // count);
+		spin_unlock(&listener->lock);
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: found listener\n",
+			 knotif->id);
+
+		/* break to prompt */
+		if (node->data.type == AUDIT_APPARMOR_USER) {
+			spin_unlock(&ns->listener_lock);
+			err = handle_synchronous_notif(listener, knotif);
+			aa_put_listener(listener);
+			return err;
+		}
+		count++;
+		aa_put_listener(listener);
+	}
+	spin_unlock(&ns->listener_lock);
+	AA_DEBUG(DEBUG_UPCALL, "id %lld: %d listener matches\n",
+		 knotif->id, count);
+
+	/* count == 0 is no match found. No change to audit params
+	 * long term need to fold prompt perms into denied
+	 **/
+	return err;
+}
+
+/******************** task responding to notification **********************/
+
+// drop references
+// complete anything pending on ready
+static void __listener_complete_held_user_pending(struct aa_listener *listener,
+						  struct aa_knotif *knotif)
+{
+	AA_BUG(!listener);
+	lockdep_assert_held(&listener->lock);
+
+	__knotif_del_and_hold(knotif);
+	complete(&knotif->ready);
+	put_refs(listener, knotif);
+}
+
+static void listener_complete_held_user_pending(struct aa_listener *listener,
+						struct aa_knotif *knotif)
+{
+	spin_lock(&listener->lock);
+	__listener_complete_held_user_pending(listener, knotif);
+	spin_unlock(&listener->lock);
+}
+
+static bool response_is_valid_perm(struct apparmor_notif_resp_perm *reply,
+				   struct aa_knotif *knotif, u16 size)
+{
+	if ((knotif->ad->denied) & ~(reply->allow | reply->deny)) {
+		AA_DEBUG(DEBUG_UPCALL,
+			 "id %lld: response does not cover permission bits in the upcall request/reply 0x%x/0x%x deny/reply 0x%x/0x%x",
+			 knotif->id, knotif->ad->request, reply->allow, knotif->ad->denied,
+			 reply->deny);
+		return false;
+	}
+	return true;
+	/* TODO: this was disabled per snapd request, setup flag to do check
+	 * // allow bits that were never requested
+	 * if (reply->allow & ~knotif->ad->request) {
+	 *	AA_DEBUG(DEBUG_UPCALL, "response allows more than requested");
+	 *	return false;
+	 * }
+	 * // denying perms not in either permission set in the original
+	 * // notification
+	 * if (reply->deny & ~(knotif->ad->request | knotif->ad->denied)) {
+	 *	AA_DEBUG(DEBUG_UPCALL, "response denies more than requested");
+	 *	return false;
+	 * }
+	 */
+}
+
+static bool response_is_valid_name(struct apparmor_notif_resp_name *reply,
+				   struct aa_knotif *knotif, u16 size)
+{
+	long i;
+
+	if (size <= sizeof(*reply)) {
+		AA_DEBUG(DEBUG_UPCALL,
+			 "id %lld: reply bad size %u < %ld",
+			 knotif->id, size, sizeof(*reply));
+		return -EMSGSIZE;
+	}
+	if (reply->name < sizeof(*reply)) {
+		/* inside of data declared fields */
+		AA_DEBUG(DEBUG_UPCALL,
+			 "id %lld: reply bad name offset in fields %u < %ld",
+			 knotif->id, reply->name, sizeof(*reply));
+		return -EINVAL;
+	}
+	if (reply->name > size) {
+		AA_DEBUG(DEBUG_UPCALL,
+			 "id %lld: reply name pasted end of data size %u > %ld",
+			 knotif->id, reply->name, sizeof(*reply));
+		return -EINVAL;
+	}
+	/* currently supported flags */
+	if ((reply->perm.base.flags != (URESPONSE_LOOKUP | URESPONSE_PROFILE))) {
+		AA_DEBUG(DEBUG_UPCALL,
+			 "id %lld: reply bad flags 0x%x expected 0x%x",
+			 knotif->id, reply->perm.base.flags,
+			 URESPONSE_LOOKUP | URESPONSE_PROFILE);
+		return -EINVAL;
+	}
+
+	if ((reply->perm.base.flags == URESPONSE_TAILGLOB) &&
+	    !response_is_valid_perm(&reply->perm, knotif, size)) {
+		AA_DEBUG(DEBUG_UPCALL,
+			 "id %lld: reply bad tail glob perms",
+			 knotif->id);
+		return false;
+	}
+
+	/* check name for terminating null */
+	for (i = reply->name - sizeof(*reply); i < size - sizeof(*reply); i++) {
+		if (reply->data[i] == 0)
+			return true;
+	}
+	/* reached end of data without finding null */
+	AA_DEBUG(DEBUG_UPCALL,
+		 "id %lld: reply bad no terminating null on name",
+		 knotif->id);
+
+	return false;
+}
+
+/* base checks userspace respnse to a notification is valid */
+static bool response_is_valid(union apparmor_notif_resp *reply,
+			      struct aa_knotif *knotif, u16 size)
+{
+	if (reply->base.ntype == APPARMOR_NOTIF_RESP_PERM)
+		return response_is_valid_perm(&reply->perm, knotif, size);
+	else if (reply->base.ntype == APPARMOR_NOTIF_RESP_NAME)
+		return response_is_valid_name(&reply->name, knotif, size);
+	else
+		return false;
+	return false;
+}
+
+
+/* copy uresponse into knotif */
+static void knotif_update_from_uresp_perm(struct aa_knotif *knotif,
+				     struct apparmor_notif_resp_perm *uresp)
+{
+	u16 flags;
+
+	if (uresp) {
+		AA_DEBUG(DEBUG_UPCALL,
+			 "notif %lld: response allow/reply 0x%x/0x%x, denied/reply 0x%x/0x%x, error %d/%d",
+			 knotif->id, knotif->ad->request, uresp->allow,
+			 knotif->ad->denied, uresp->deny, knotif->ad->error,
+			 uresp->base.error);
+
+		knotif->ad->denied = uresp->deny;
+		knotif->ad->request = (knotif->ad->request | uresp->allow) &
+			~uresp->deny;
+		flags = uresp->base.flags;
+		if (!knotif->ad->denied) {
+			/* no more denial, clear the error*/
+			knotif->ad->error = 0;
+			AA_DEBUG(DEBUG_UPCALL,
+				 "notif %lld: response allowed, clearing error\n",
+				 knotif->id);
+		} else {
+			AA_DEBUG(DEBUG_UPCALL,
+				 "notif %lld: response denied returning error %d\n",
+				 knotif->id, knotif->ad->error);
+		}
+	} else {
+		AA_DEBUG(DEBUG_UPCALL,
+			 "id %lld: respons bad going with: allow 0x%x, denied 0x%x, error %d",
+			 knotif->id, knotif->ad->request, knotif->ad->denied,
+			 knotif->ad->error);
+	}
+
+	if (!(flags & URESPONSE_NO_CACHE)) {
+		/* cache of response requested */
+		struct aa_audit_node *node = container_of(knotif,
+							  struct aa_audit_node,
+							  knotif);
+		struct aa_audit_node *hit;
+		struct aa_profile *profile = labels_profile(node->data.subj_label);
+
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: inserting cache entry requ 0x%x  denied 0x%x",
+			 knotif->id, node->data.request, node->data.denied);
+		hit = aa_audit_cache_insert(&profile->learning_cache,
+					    node);
+		AA_DEBUG(DEBUG_UPCALL,
+			 "id %lld: (node %p, hit %p) cache insert %s: name %s node %s\n",
+			 knotif->id, node, hit, hit != node ? "entry already exists" : "",
+			 hit->data.name, node->data.name);
+		if (hit != node) {
+			AA_DEBUG(DEBUG_UPCALL,
+				 "id %lld: updating existing cache entry",
+				 knotif->id);
+			aa_audit_cache_update_ent(&profile->learning_cache,
+						  hit, &node->data);
+			aa_put_audit_node(hit);
+		} else {
+
+			AA_DEBUG(DEBUG_UPCALL, "inserted into cache");
+		}
+		/* now to audit */
+	} /* cache_response */
+}
+
+
+void aa_free_ruleset(struct aa_ruleset *rules)
+{
+	if (!rules)
+		return;
+	aa_put_pdb(rules->policy);
+	aa_put_pdb(rules->file);
+	kfree_sensitive(rules);
+}
+
+struct aa_ruleset *aa_new_ruleset(gfp_t gfp)
+{
+	struct aa_ruleset *rules = kzalloc(sizeof(*rules), gfp);
+
+	INIT_LIST_HEAD(&rules->list);
+
+	return rules;
+}
+
+struct aa_ruleset *aa_clone_ruleset(struct aa_ruleset *rules)
+{
+	struct aa_ruleset *clone;
+
+	clone = aa_new_ruleset(GFP_KERNEL);
+	if (!clone)
+		return NULL;
+	clone->size = rules->size;
+	clone->policy = aa_get_pdb(rules->policy);
+	clone->file = aa_get_pdb(rules->file);
+	clone->caps = rules->caps;
+	clone->rlimits = rules->rlimits;
+
+	/* TODO: secmark */
+	return clone;
+}
+
+static long knotif_update_from_uresp_name(struct aa_knotif *knotif,
+				struct apparmor_notif_resp_name *reply,
+				u16 size)
+{
+	struct aa_ruleset *rules;
+	struct aa_profile *profile;
+	struct aa_ns *ns;
+	char *name, *glob;
+	struct aa_audit_node *clone;
+	struct aa_audit_node *node = container_of(knotif,
+						  struct aa_audit_node,
+						  knotif);
+
+	ns = aa_get_current_ns();
+	name = (char *) &reply->data[reply->name - sizeof(*reply)];
+
+	if (reply->perm.base.flags == (URESPONSE_LOOKUP | URESPONSE_PROFILE)) {
+		profile = aa_lookup_profile(ns, name);
+		if (!profile) {
+			aa_put_ns(ns);
+			return -ENOENT;
+		}
+		aa_put_ns(ns);
+
+		rules = aa_clone_ruleset(list_first_entry(&profile->rules,
+							  typeof(*rules), list));
+		if (!rules) {
+			aa_put_profile(profile);
+			return -ENOMEM;
+		}
+		AA_DEBUG(DEBUG_UPCALL,
+			 "id %lld: cloned profile '%s' rule set", knotif->id,
+			 profile->base.hname);
+		aa_put_profile(profile);
+
+		/* add list to profile rules TODO: improve locking*/
+		profile = labels_profile(node->data.subj_label);
+		list_add_tail_entry(rules, &profile->rules, list);
+	} else if (reply->perm.base.flags == URESPONSE_TAILGLOB) {
+		// TODO: dedup with cache update in perm
+		struct aa_audit_node *node = container_of(knotif,
+							  struct aa_audit_node,
+							  knotif);
+		struct aa_audit_node *hit;
+		struct aa_profile *profile = labels_profile(node->data.subj_label);
+
+		clone = aa_dup_audit_data(&node->data, GFP_KERNEL);
+		glob = kstrdup(name, GFP_KERNEL);
+		if (!name)
+			return -ENOMEM;
+		if (!clone) {
+			kfree(name);
+			return -ENOMEM;
+		}
+		kfree(clone->data.name);
+		clone->data.name = glob;
+		clone->data.flags = AUDIT_TAILGLOB_NAME;
+		clone->knotif.id = knotif->id;
+		clone->knotif.ntype = knotif->ntype;
+		node = clone;
+		knotif = &clone->knotif;
+
+		// now add it to the cache
+		AA_DEBUG(DEBUG_UPCALL,
+			 "notif %lld: response allow/reply 0x%x/0x%x, denied/reply 0x%x/0x%x, error %d/%d",
+			 knotif->id, knotif->ad->request, reply->perm.allow,
+			 knotif->ad->denied, reply->perm.deny, knotif->ad->error,
+			 reply->base.error);
+
+		knotif->ad->denied = reply->perm.deny;
+		knotif->ad->request = reply->perm.allow | reply->perm.deny;
+
+		if (!knotif->ad->denied) {
+			/* no more denial, clear the error*/
+			knotif->ad->error = 0;
+			AA_DEBUG(DEBUG_UPCALL,
+				 "notif %lld: response allowed, clearing error\n",
+				 knotif->id);
+		} else {
+			AA_DEBUG(DEBUG_UPCALL,
+				 "notif %lld: response denied returning error %d\n",
+				 knotif->id, knotif->ad->error);
+		}
+
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: inserting cache entry requ 0x%x  denied 0x%x",
+			 knotif->id, node->data.request, node->data.denied);
+		hit = aa_audit_cache_insert(&profile->learning_cache,
+					    node);
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: cache insert %s: name %s node %s\n",
+			 knotif->id, hit != node ? "lost race" : "",
+			 hit->data.name, node->data.name);
+		if (hit != node) {
+			AA_DEBUG(DEBUG_UPCALL,
+				 "id %lld: updating existing cache entry",
+				 knotif->id);
+			aa_audit_cache_update_ent(&profile->learning_cache,
+						  hit, &node->data);
+			aa_put_audit_node(hit);
+		} else {
+
+			AA_DEBUG(DEBUG_UPCALL, "inserted into cache");
+		}
+		aa_put_audit_node(clone);
+	}
+	return size;
+}
+
+/* handle userspace responding to a synchronous notification */
+long aa_listener_unotif_response(struct aa_listener *listener,
+				 union apparmor_notif_resp *uresp,
+				 u16 size)
+{
+	struct aa_knotif *knotif = NULL;
+	long ret;
+
+	spin_lock(&listener->lock);
+	knotif = __del_and_hold_user_pending(listener, uresp->base.id);
+	if (!knotif) {
+		ret = -ENOENT;
+		AA_DEBUG(DEBUG_UPCALL, "could not find id %lld",
+			 uresp->base.id);
+		goto out;
+	}
+	if (!response_is_valid(uresp, knotif, size)) {
+		ret = -EINVAL;
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: response not valid", knotif->id);
+		__listener_complete_held_user_pending(listener, knotif);
+		goto out;
+	}
+
+	if (uresp->perm.base.ntype == APPARMOR_NOTIF_RESP_PERM) {
+		knotif_update_from_uresp_perm(knotif, &uresp->perm);
+	} else if (uresp->perm.base.ntype == APPARMOR_NOTIF_RESP_NAME) {
+		size = knotif_update_from_uresp_name(knotif, &uresp->name, size);
+	} else {
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: unknown response type", knotif->id);
+		size = -EINVAL;
+	}
+	ret = size;
+
+	AA_DEBUG(DEBUG_UPCALL, "id %lld: completing notif", knotif->id);
+	__listener_complete_held_user_pending(listener, knotif);
+out:
+	spin_unlock(&listener->lock);
+
+	return ret;
+}
+
+/******************** task reading notification to userspace ****************/
+
+static long append_str(void __user *pos, long remaining, const char *str)
+{
+	long size;
+
+	if (!str)
+		return 0;
+	size = strlen(str) + 1;
+	if (size > remaining)
+		return -EMSGSIZE;
+	if (copy_to_user(pos, str, size))
+		return -EFAULT;
+
+	return size;
+}
+
+#define build_append_str(__BUF, __POS, __MAX, __STR, __FIELD, __SIZE)	\
+({									\
+	typeof(__SIZE) __tmp_size;					\
+	__FIELD = __POS - __BUF;					\
+	__tmp_size = append_str(__POS, max_size - (__POS - __BUF), __STR); \
+	if (__tmp_size >= 0) {						\
+		__POS += __tmp_size;					\
+		__SIZE += __tmp_size;					\
+	} else {							\
+		__SIZE = __tmp_size;					\
+	}								\
+	(__tmp_size >= 0);						\
+})
+
+/* copy to userspace: notification data */
+static long build_v3_unotif(struct aa_knotif *knotif, void __user *buf,
+			    u16 max_size)
+{
+	union apparmor_notif_all unotif = { };
+	struct user_namespace *user_ns;
+	struct aa_profile *profile;
+	void __user *pos;
+	long size;
+
+	AA_DEBUG(DEBUG_UPCALL, "building notif max size %d", max_size);
+	size = sizeof(unotif);
+	profile = labels_profile(knotif->ad->subj_label);
+	AA_BUG(profile == NULL);
+	if (size > max_size)
+		return -EMSGSIZE;
+
+	user_ns = get_user_ns(current->nsproxy->uts_ns->user_ns);
+
+	/* build response */
+	unotif.common.len = size;
+	unotif.common.version = APPARMOR_NOTIFY_VERSION;
+	unotif.base.ntype = knotif->ntype;
+	unotif.base.id = knotif->id;
+	unotif.base.error = knotif->ad->error;
+	unotif.op.allow = knotif->ad->request & knotif->ad->denied;
+	unotif.op.deny = knotif->ad->denied;
+	AA_DEBUG(DEBUG_UPCALL,
+		 "notif %lld: sent to user read request 0x%x, denied 0x%x, error %d",
+		 knotif->id, knotif->ad->request, knotif->ad->denied, knotif->ad->error);
+
+	if (knotif->ad->subjtsk != NULL) {
+		unotif.op.pid = task_pid_vnr(knotif->ad->subjtsk);
+		unotif.file.subj_uid = from_kuid(user_ns, task_uid(knotif->ad->subjtsk));
+	}
+	unotif.op.class = knotif->ad->class;
+	unotif.file.obj_uid = from_kuid(user_ns, knotif->ad->fs.ouid);
+
+	put_user_ns(user_ns);
+
+	pos = buf + sizeof(unotif);
+	if (!build_append_str(buf, pos, max_size, profile->base.hname,
+			      unotif.op.label, size))
+		return -EMSGSIZE;
+	if (!build_append_str(buf, pos, max_size, knotif->ad->name,
+			      unotif.file.name, size))
+		return -EMSGSIZE;
+
+	/* set size after appending strings */
+	unotif.common.len = size;
+	/* now the struct, at the start of user mem */
+	if (copy_to_user(buf, &unotif, sizeof(unotif)))
+		return -EFAULT;
+
+	return pos - buf;
+}
+
+// return < 0 == error
+//          0 == repeat
+//        > 0 == built notification successfully
+static long build_mediation_unotif(struct aa_listener *listener,
+				   struct aa_knotif *knotif,
+				   void __user *buf, u16 max_size)
+{
+	long ret;
+
+	switch (knotif->ad->class) {
+	case AA_CLASS_FILE:
+		ret = build_v3_unotif(knotif, buf, max_size);
+		if (ret < 0) {
+			AA_DEBUG(DEBUG_UPCALL,
+				 "id %lld: (error=%ld) failed to copy data to user reading size %ld, maxsize %d",
+				 knotif->id, ret,
+				 sizeof(union apparmor_notif_all), max_size);
+			goto out;
+		}
+		break;
+	default:
+		AA_BUG("unknown notification class");
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: unknown notification class", knotif->id);
+		/* skip and move onto the next notification */
+		return 0;
+	}
+out:
+	return ret;
+}
+
+/* Handle the listener reading a notification into userspace */
+// TODO: output multiple messages in one recv
+long aa_listener_unotif_recv(struct aa_listener *listener, void __user *buf,
+			     u16 max_size)
+{
+	struct aa_knotif *knotif;
+	long ret;
+
+	do {
+		knotif = listener_pop_and_hold_knotif(listener);
+		if (!knotif) {
+			return -ENOENT;
+		}
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: removed notif from listener queue",
+			 knotif->id);
+
+		ret = build_mediation_unotif(listener, knotif, buf, max_size);
+		if (ret < 0) {
+			/* failed - drop notif and return error to reader */
+			listener_complete_held_user_pending(listener, knotif);
+			return ret;
+		} else if (ret > 0) {
+			/* else notification copied */
+			break;
+		}
+		/* unknown notification: drop and try next */
+		listener_complete_held_user_pending(listener, knotif);
+	} while (ret == 0);
+
+	/* success */
+	if (knotif->ad->type == AUDIT_APPARMOR_USER) {
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: adding notif to pending", knotif->id);
+		listener_append_held_user_pending(listener, knotif);
+	} else {
+		/* no one waiting on this notification drop it */
+		AA_DEBUG(DEBUG_UPCALL, "id %lld: non-prompt audit notif delivered", knotif->id);
+		listener_complete_held_user_pending(listener, knotif);
+	}
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/security/apparmor/policy.c
+++ linux-qcom-6.8.0/security/apparmor/policy.c
@@ -88,7 +88,11 @@
 #include "include/resource.h"
 
 int unprivileged_userns_apparmor_policy = 1;
+int aa_unprivileged_userns_restricted = IS_ENABLED(CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS);
+int aa_unprivileged_userns_restricted_force;
+int aa_unprivileged_userns_restricted_complain;
 int aa_unprivileged_unconfined_restricted;
+int aa_unprivileged_uring_restricted;
 
 const char *const aa_profile_mode_names[] = {
 	"enforce",
@@ -225,7 +229,7 @@
 {
 	struct aa_data *data = ptr;
 
-	kfree_sensitive(data->data);
+	kvfree_sensitive(data->data, data->size);
 	kfree_sensitive(data->key);
 	kfree_sensitive(data);
 }
@@ -281,7 +285,7 @@
 	struct aa_ruleset *rule, *tmp;
 	struct rhashtable *rht;
 
-	AA_DEBUG("%s(%p)\n", __func__, profile);
+	AA_DEBUG(DEBUG_POLICY, "%s(%p)\n", __func__, profile);
 
 	if (!profile)
 		return;
@@ -295,6 +299,7 @@
 	kfree_sensitive(profile->disconnected);
 
 	free_attachment(&profile->attach);
+	kfree_sensitive(profile->net_compat);
 
 	/*
 	 * at this point there are no tasks that can have a reference
@@ -316,6 +321,7 @@
 	kfree_sensitive(profile->hash);
 	aa_put_loaddata(profile->rawdata);
 	aa_label_destroy(&profile->label);
+	aa_audit_cache_destroy(&profile->learning_cache);
 
 	kfree_sensitive(profile);
 }
@@ -365,6 +371,9 @@
 	profile->label.flags |= FLAG_PROFILE;
 	profile->label.vec[0] = profile;
 
+	profile->signal = SIGKILL;
+	aa_audit_cache_init(&profile->learning_cache);
+
 	/* refcount released by caller */
 	return profile;
 
@@ -374,6 +383,30 @@
 	return NULL;
 }
 
+/* set of rules that are mediated by unconfined */
+static int unconfined_mediates[] = { AA_CLASS_NS, AA_CLASS_IO_URING, 0 };
+
+/* must be called after profile rulesets and start information is setup */
+void aa_compute_profile_mediates(struct aa_profile *profile)
+{
+	int c;
+
+	if (profile_unconfined(profile)) {
+		int *pos;
+
+		for (pos = unconfined_mediates; *pos; pos++) {
+			if (ANY_RULE_MEDIATES(&profile->rules, AA_CLASS_NS) !=
+			    DFA_NOMATCH)
+				profile->label.mediates |= ((u64) 1) << AA_CLASS_NS;
+		}
+		return;
+	}
+	for (c = 0; c <= AA_CLASS_LAST; c++) {
+		if (ANY_RULE_MEDIATES(&profile->rules, c) != DFA_NOMATCH)
+			profile->label.mediates |= ((u64) 1) << c;
+	}
+}
+
 /* TODO: profile accounting - setup in remove */
 
 /**
@@ -626,13 +659,16 @@
 
 	/* TODO: ideally we should inherit abi from parent */
 	profile->label.flags |= FLAG_NULL;
+	profile->attach.xmatch = aa_get_pdb(nullpdb);
 	rules = list_first_entry(&profile->rules, typeof(*rules), list);
 	rules->file = aa_get_pdb(nullpdb);
 	rules->policy = aa_get_pdb(nullpdb);
+	aa_compute_profile_mediates(profile);
 
 	if (parent) {
 		profile->path_flags = parent->path_flags;
-
+		/* override/inherit what is mediated from parent */
+		profile->label.mediates = parent->label.mediates;
 		/* released on free_profile */
 		rcu_assign_pointer(profile->parent, aa_get_profile(parent));
 		profile->ns = aa_get_ns(parent->ns);
@@ -838,8 +874,8 @@
 	bool capable = policy_ns_capable(subj_cred, label, user_ns,
 					 CAP_MAC_ADMIN) == 0;
 
-	AA_DEBUG("cap_mac_admin? %d\n", capable);
-	AA_DEBUG("policy locked? %d\n", aa_g_lock_policy);
+	AA_DEBUG(DEBUG_POLICY, "cap_mac_admin? %d\n", capable);
+	AA_DEBUG(DEBUG_POLICY, "policy locked? %d\n", aa_g_lock_policy);
 
 	return aa_policy_view_capable(subj_cred, label, ns) && capable &&
 		!aa_g_lock_policy;
@@ -1224,7 +1260,8 @@
 		list_del_init(&ent->list);
 		op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL;
 
-		if (ent->old && ent->old->rawdata == ent->new->rawdata &&
+		if (ent->old && ent->old->learning_cache.size == 0 &&
+		    ent->old->rawdata == ent->new->rawdata &&
 		    ent->new->rawdata) {
 			/* dedup actual profile replacement */
 			audit_policy(label, op, ns_name, ent->new->base.hname,
--- linux-qcom-6.8.0.orig/security/apparmor/policy_compat.c
+++ linux-qcom-6.8.0/security/apparmor/policy_compat.c
@@ -107,6 +107,8 @@
 		perms->allow |= AA_MAY_CHANGE_PROFILE;
 	if (ACCEPT_TABLE(dfa)[state] & 0x40000000)
 		perms->allow |= AA_MAY_ONEXEC;
+	if (ACCEPT_TABLE(dfa)[state] & 0x10000000)
+		perms->allow |= AA_CONT_MATCH;
 }
 
 static struct aa_perms compute_fperms_user(struct aa_dfa *dfa,
@@ -216,6 +218,8 @@
 	perms.allow = dfa_user_allow(dfa, state);
 	perms.audit = dfa_user_audit(dfa, state);
 	perms.quiet = dfa_user_quiet(dfa, state);
+	if (ACCEPT_TABLE(dfa)[state] & 0x10000000)
+		perms.allow |= AA_CONT_MATCH;
 
 	/*
 	 * This mapping is convulated due to history.
@@ -286,10 +290,10 @@
 
 	AA_BUG(!dfa);
 
-	for (state = 0; state < state_count; state++)
+	for (state = 0; state < state_count; state++) {
 		ACCEPT_TABLE(dfa)[state] = state * factor;
-	kvfree(dfa->tables[YYTD_ID_ACCEPT2]);
-	dfa->tables[YYTD_ID_ACCEPT2] = NULL;
+		ACCEPT_TABLE2(dfa)[state] = factor > 1 ? ACCEPT_FLAG_OWNER : 0;
+	}
 }
 
 /* TODO: merge different dfa mappings into single map_policy fn */
--- linux-qcom-6.8.0.orig/security/apparmor/policy_ns.c
+++ linux-qcom-6.8.0/security/apparmor/policy_ns.c
@@ -15,6 +15,7 @@
 #include <linux/mutex.h>
 #include <linux/slab.h>
 #include <linux/string.h>
+#include <uapi/linux/apparmor.h>
 
 #include "include/apparmor.h"
 #include "include/cred.h"
@@ -107,7 +108,7 @@
 	struct aa_ns *ns;
 
 	ns = kzalloc(sizeof(*ns), GFP_KERNEL);
-	AA_DEBUG("%s(%p)\n", __func__, ns);
+	AA_DEBUG(DEBUG_POLICY, "%s(%p)\n", __func__, ns);
 	if (!ns)
 		return NULL;
 	if (!aa_policy_init(&ns->base, prefix, name, GFP_KERNEL))
@@ -117,6 +118,8 @@
 	INIT_LIST_HEAD(&ns->rawdata_list);
 	mutex_init(&ns->lock);
 	init_waitqueue_head(&ns->wait);
+	spin_lock_init(&ns->listener_lock);
+	INIT_LIST_HEAD(&ns->listeners);
 
 	/* released by aa_free_ns() */
 	ns->unconfined = alloc_unconfined("unconfined");
--- linux-qcom-6.8.0.orig/security/apparmor/policy_unpack.c
+++ linux-qcom-6.8.0/security/apparmor/policy_unpack.c
@@ -29,6 +29,7 @@
 #include "include/policy.h"
 #include "include/policy_unpack.h"
 #include "include/policy_compat.h"
+#include "include/signal.h"
 
 /* audit callback for unpack fields */
 static void audit_cb(struct audit_buffer *ab, void *va)
@@ -270,6 +271,19 @@
 	return false;
 }
 
+VISIBLE_IF_KUNIT bool unpack_u16(struct aa_ext *e, u16 *data, const char *name)
+{
+	if (aa_unpack_nameX(e, AA_U16, name)) {
+		if (!aa_inbounds(e, sizeof(u16)))
+			return 0;
+		if (data)
+			*data = le16_to_cpu(get_unaligned((__le16 *) e->pos));
+		e->pos += sizeof(u16);
+		return 1;
+	}
+	return 0;
+}
+
 VISIBLE_IF_KUNIT bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name)
 {
 	void *pos = e->pos;
@@ -713,6 +727,7 @@
 	void *pos = e->pos;
 	int i, flags, error = -EPROTO;
 	ssize_t size;
+	u32 version = 0;
 
 	pdb = aa_alloc_pdb(GFP_KERNEL);
 	if (!pdb)
@@ -730,6 +745,9 @@
 	if (pdb->perms) {
 		/* perms table present accept is index */
 		flags = TO_ACCEPT1_FLAG(YYTD_DATA32);
+		if (aa_unpack_u32(e, &version, "permsv") && version > 2)
+			/* accept2 used for dfa flags */
+			flags |= TO_ACCEPT2_FLAG(YYTD_DATA32);
 	} else {
 		/* packed perms in accept1 and accept2 */
 		flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
@@ -747,31 +765,52 @@
 			*info = "missing required dfa";
 			goto fail;
 		}
-		goto out;
+	} else {
+		/*
+		 * only unpack the following if a dfa is present
+		 *
+		 * sadly start was given different names for file and policydb
+		 * but since it is optional we can try both
+		 */
+		if (!aa_unpack_u32(e, &pdb->start[0], "start"))
+			/* default start state */
+			pdb->start[0] = DFA_START;
+		if (!aa_unpack_u32(e, &pdb->start[AA_CLASS_FILE], "dfa_start")) {
+			/* default start state for xmatch and file dfa */
+			pdb->start[AA_CLASS_FILE] = DFA_START;
+		}	/* setup class index */
+		for (i = AA_CLASS_FILE + 1; i <= AA_CLASS_LAST; i++) {
+			pdb->start[i] = aa_dfa_next(pdb->dfa, pdb->start[0],
+						    i);
+		}
 	}
 
+	if (pdb->perms && version <= 2) {
+		/* add dfa flags table missing in v2 */
+		u32 noents = pdb->dfa->tables[YYTD_ID_ACCEPT]->td_lolen;
+		u16 tdflags = pdb->dfa->tables[YYTD_ID_ACCEPT]->td_flags;
+		size_t tsize = table_size(noents, tdflags);
+		pdb->dfa->tables[YYTD_ID_ACCEPT2] = kvzalloc(tsize, GFP_KERNEL);
+		if (!pdb->dfa->tables[YYTD_ID_ACCEPT2]) {
+			*info = "failed to alloc dfa flags table";
+			goto out;
+		}
+		pdb->dfa->tables[YYTD_ID_ACCEPT2]->td_lolen = noents;
+		pdb->dfa->tables[YYTD_ID_ACCEPT2]->td_flags = tdflags;
+	}
 	/*
-	 * only unpack the following if a dfa is present
-	 *
-	 * sadly start was given different names for file and policydb
-	 * but since it is optional we can try both
+	 * Unfortunately due to a bug in earlier userspaces, a
+	 * transition table may be present even when the dfa is
+	 * not. For compatibility reasons unpack and discard.
 	 */
-	if (!aa_unpack_u32(e, &pdb->start[0], "start"))
-		/* default start state */
-		pdb->start[0] = DFA_START;
-	if (!aa_unpack_u32(e, &pdb->start[AA_CLASS_FILE], "dfa_start")) {
-		/* default start state for xmatch and file dfa */
-		pdb->start[AA_CLASS_FILE] = DFA_START;
-	}	/* setup class index */
-	for (i = AA_CLASS_FILE + 1; i <= AA_CLASS_LAST; i++) {
-		pdb->start[i] = aa_dfa_next(pdb->dfa, pdb->start[0],
-					       i);
-	}
 	if (!unpack_trans_table(e, &pdb->trans) && required_trans) {
 		*info = "failed to unpack profile transition table";
 		goto fail;
 	}
 
+	if (!pdb->dfa && pdb->trans.table)
+		aa_free_str_table(&pdb->trans);
+
 	/* TODO: move compat mapping here, requires dfa merging first */
 	/* TODO: move verify here, it has to be done after compat mappings */
 out:
@@ -812,6 +851,7 @@
 	struct aa_profile *profile = NULL;
 	const char *tmpname, *tmpns = NULL, *name = NULL;
 	const char *info = "failed to unpack profile";
+	u16 size = 0;
 	size_t ns_len;
 	struct rhashtable_params params = { 0 };
 	char *key = NULL, *disconnected = NULL;
@@ -887,6 +927,12 @@
 	(void) aa_unpack_strdup(e, &disconnected, "disconnected");
 	profile->disconnected = disconnected;
 
+	/* optional */
+	(void) aa_unpack_u32(e, &profile->signal, "kill");
+	if (profile->signal < 1 && profile->signal > MAXMAPPED_SIG) {
+		info = "profile kill.signal invalid value";
+		goto fail;
+	}
 	/* per profile debug flags (complain, audit) */
 	if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
 		info = "profile missing flags";
@@ -901,6 +947,8 @@
 		profile->label.flags |= FLAG_DEBUG1;
 	if (tmp & PACKED_FLAG_DEBUG2)
 		profile->label.flags |= FLAG_DEBUG2;
+	if (tmp & PACKED_FLAG_INTERRUPTIBLE)
+		profile->label.flags |= FLAG_INTERRUPTIBLE;
 	if (!aa_unpack_u32(e, &tmp, NULL))
 		goto fail;
 	if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
@@ -984,6 +1032,45 @@
 		goto fail;
 	}
 
+	if (aa_unpack_array(e, "net_allowed_af", &size) ||
+	    VERSION_LT(e->version, v8)) {
+		u16 i;
+
+		profile->net_compat = kzalloc(sizeof(struct aa_net_compat),
+					      GFP_KERNEL);
+		if (!profile->net_compat) {
+			info = "out of memory";
+			goto fail;
+		}
+		for (i = 0; i < size; i++) {
+			/* discard extraneous rules that this kernel will
+			 * never request
+			 */
+			if (i >= AF_MAX) {
+				u16 tmp;
+
+				if (!unpack_u16(e, &tmp, NULL) ||
+				    !unpack_u16(e, &tmp, NULL) ||
+				    !unpack_u16(e, &tmp, NULL))
+					goto fail;
+				continue;
+			}
+			if (!unpack_u16(e, &profile->net_compat->allow[i], NULL))
+				goto fail;
+			if (!unpack_u16(e, &profile->net_compat->audit[i], NULL))
+				goto fail;
+			if (!unpack_u16(e, &profile->net_compat->quiet[i], NULL))
+				goto fail;
+		}
+		if (size && !aa_unpack_nameX(e, AA_ARRAYEND, NULL))
+			goto fail;
+		if (VERSION_LT(e->version, v7)) {
+			/* pre v7 policy always allowed these */
+			profile->net_compat->allow[AF_UNIX] = 0xffff;
+			profile->net_compat->allow[AF_NETLINK] = 0xffff;
+		}
+	}
+
 	if (aa_unpack_nameX(e, AA_STRUCT, "policydb")) {
 		/* generic policy dfa - optional and may be NULL */
 		info = "failed to unpack policydb";
@@ -1071,6 +1158,7 @@
 
 			if (rhashtable_insert_fast(profile->data, &data->head,
 						   profile->data->p)) {
+				kvfree_sensitive(data->data, data->size);
 				kfree_sensitive(data->key);
 				kfree_sensitive(data);
 				info = "failed to insert data to table";
@@ -1089,6 +1177,8 @@
 		goto fail;
 	}
 
+	aa_compute_profile_mediates(profile);
+
 	return profile;
 
 fail:
--- linux-qcom-6.8.0.orig/security/apparmor/policy_unpack_test.c
+++ linux-qcom-6.8.0/security/apparmor/policy_unpack_test.c
@@ -80,14 +80,14 @@
 	*(buf + 1) = strlen(TEST_U32_NAME) + 1;
 	strscpy(buf + 3, TEST_U32_NAME, e->end - (void *)(buf + 3));
 	*(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32;
-	*((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA;
+	*((__le32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = cpu_to_le32(TEST_U32_DATA);
 
 	buf = e->start + TEST_NAMED_U64_BUF_OFFSET;
 	*buf = AA_NAME;
 	*(buf + 1) = strlen(TEST_U64_NAME) + 1;
 	strscpy(buf + 3, TEST_U64_NAME, e->end - (void *)(buf + 3));
 	*(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64;
-	*((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA;
+	*((__le64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = cpu_to_le64(TEST_U64_DATA);
 
 	buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET;
 	*buf = AA_NAME;
@@ -103,7 +103,7 @@
 	*(buf + 1) = strlen(TEST_ARRAY_NAME) + 1;
 	strscpy(buf + 3, TEST_ARRAY_NAME, e->end - (void *)(buf + 3));
 	*(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY;
-	*((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE;
+	*((__le16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = cpu_to_le16(TEST_ARRAY_SIZE);
 
 	return e;
 }
@@ -281,6 +281,8 @@
 			   ((uintptr_t)puf->e->start <= (uintptr_t)string)
 			   && ((uintptr_t)string <= (uintptr_t)puf->e->end));
 	KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA);
+
+	kfree(string);
 }
 
 static void policy_unpack_test_unpack_strdup_with_name(struct kunit *test)
@@ -296,6 +298,8 @@
 			   ((uintptr_t)puf->e->start <= (uintptr_t)string)
 			   && ((uintptr_t)string <= (uintptr_t)puf->e->end));
 	KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA);
+
+	kfree(string);
 }
 
 static void policy_unpack_test_unpack_strdup_out_of_bounds(struct kunit *test)
@@ -313,6 +317,8 @@
 	KUNIT_EXPECT_EQ(test, size, 0);
 	KUNIT_EXPECT_NULL(test, string);
 	KUNIT_EXPECT_PTR_EQ(test, puf->e->pos, start);
+
+	kfree(string);
 }
 
 static void policy_unpack_test_unpack_nameX_with_null_name(struct kunit *test)
--- linux-qcom-6.8.0.orig/security/apparmor/procattr.c
+++ linux-qcom-6.8.0/security/apparmor/procattr.c
@@ -125,12 +125,14 @@
 		for (count = 0; (hat < end) && count < 16; ++count) {
 			char *next = hat + strlen(hat) + 1;
 			hats[count] = hat;
-			AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d hat '%s'\n"
+			AA_DEBUG(DEBUG_DOMAIN,
+				 "%s: (pid %d) Magic 0x%llx count %d hat '%s'\n"
 				 , __func__, current->pid, token, count, hat);
 			hat = next;
 		}
 	} else
-		AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d Hat '%s'\n",
+		AA_DEBUG(DEBUG_DOMAIN,
+			 "%s: (pid %d) Magic 0x%llx count %d Hat '%s'\n",
 			 __func__, current->pid, token, count, "<NULL>");
 
 	return aa_change_hat(hats, count, token, flags);
--- linux-qcom-6.8.0.orig/security/apparmor/secid.c
+++ linux-qcom-6.8.0/security/apparmor/secid.c
@@ -61,14 +61,44 @@
 	return xa_load(&aa_secids, secid);
 }
 
-int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+int apparmor_secid_to_secctx(u32 secid, struct lsmcontext *cp)
 {
 	/* TODO: cache secctx and ref count so we don't have to recreate */
 	struct aa_label *label = aa_secid_to_label(secid);
 	int flags = FLAG_VIEW_SUBNS | FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT;
 	int len;
 
-	AA_BUG(!seclen);
+	if (!label)
+		return -EINVAL;
+
+	if (apparmor_display_secid_mode)
+		flags |= FLAG_SHOW_MODE;
+
+	if (cp)
+		len = aa_label_asxprint(&cp->context, root_ns, label,
+					flags, GFP_ATOMIC);
+	else
+		len = aa_label_snxprint(NULL, 0, root_ns, label, flags);
+
+	if (len < 0)
+		return -ENOMEM;
+
+	if (cp) {
+		cp->len = len;
+		cp->id = LSM_ID_APPARMOR;
+	}
+
+	return len;
+}
+
+int apparmor_lsmblob_to_secctx(struct lsmblob *blob, struct lsmcontext *cp)
+{
+	/* TODO: cache secctx and ref count so we don't have to recreate */
+	struct aa_label *label;
+	int flags = FLAG_VIEW_SUBNS | FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT;
+	int len;
+
+	label = blob->apparmor.label;
 
 	if (!label)
 		return -EINVAL;
@@ -76,8 +106,8 @@
 	if (apparmor_display_secid_mode)
 		flags |= FLAG_SHOW_MODE;
 
-	if (secdata)
-		len = aa_label_asxprint(secdata, root_ns, label,
+	if (cp)
+		len = aa_label_asxprint(&cp->context, root_ns, label,
 					flags, GFP_ATOMIC);
 	else
 		len = aa_label_snxprint(NULL, 0, root_ns, label, flags);
@@ -85,9 +115,12 @@
 	if (len < 0)
 		return -ENOMEM;
 
-	*seclen = len;
+	if (cp) {
+		cp->len = len;
+		cp->id = LSM_ID_APPARMOR;
+	}
 
-	return 0;
+	return len;
 }
 
 int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
@@ -103,9 +136,10 @@
 	return 0;
 }
 
-void apparmor_release_secctx(char *secdata, u32 seclen)
+void apparmor_release_secctx(struct lsmcontext *cp)
 {
-	kfree(secdata);
+	if (cp->id == LSM_ID_APPARMOR)
+		kfree(cp->context);
 }
 
 /**
--- linux-qcom-6.8.0.orig/security/apparmor/task.c
+++ linux-qcom-6.8.0/security/apparmor/task.c
@@ -311,33 +311,172 @@
 
 	if (ad->denied & AA_USERNS_CREATE)
 		audit_log_format(ab, " denied=\"userns_create\"");
+
+	if (ad->peer) {
+		audit_log_format(ab, " target=");
+		aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
+				FLAG_VIEW_SUBNS, GFP_KERNEL);
+	} else if (ad->ns.target) {
+		audit_log_format(ab, " target=");
+		audit_log_untrustedstring(ab, ad->ns.target);
+	}
+
 }
 
-int aa_profile_ns_perm(struct aa_profile *profile,
-		       struct apparmor_audit_data *ad,
-		       u32 request)
+/*
+ * Returns: refcounted label to change to, even if no change
+ *          PTR_ERR on failure
+ */
+static struct aa_label *ns_x_to_label(struct aa_profile *profile,
+				      u32 xindex, const char **lookupname,
+				      const char **info)
 {
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_label *new = NULL;
+	u32 xtype = xindex & AA_X_TYPE_MASK;
+	struct aa_label *stack = NULL;
+
+	/* must be none or table */
+	switch (xtype) {
+	case AA_X_NONE:
+		/* default not failure */
+		*lookupname = NULL;
+		return NULL;
+		break;
+	case AA_X_TABLE:
+		/* TODO: fix when perm mapping done at unload */
+		/* released by caller
+		 * if null for both stack and direct want to try fallback
+		 */
+		new = x_table_lookup(profile, xindex, lookupname);
+		if (!new) {
+			*info = "failed to find transition profile";
+			return ERR_PTR(-ENOMEM);
+		}
+		if (**lookupname == '&') {
+			stack = new;
+			new = NULL;
+		}
+		break;
+	default:
+		*info = "invalid profile transition type";
+		return ERR_PTR(-EINVAL);
+		break;
+	}
+
+	/* stack is true if !new */
+	if (!new) {
+		if (xindex & AA_X_UNCONFINED) {
+			new = aa_get_newest_label(ns_unconfined(profile->ns));
+			*info = "ux fallback";
+		} else {
+			if (xindex & AA_X_INHERIT) {
+				/* (p|c|n)ix - don't change profile but do
+				 * use the newest version
+				 */
+				*info = "ix fallback";
+				/* no profile && no error */
+			} /* else, stack is implicitly against current */
+			new = aa_get_newest_label(&profile->label);
+		}
+	}
+
+	if (stack) {
+		/* base the stack on post domain transition */
+		struct aa_label *base = new;
+
+		new = aa_label_merge(base, stack, GFP_KERNEL);
+		/* null on error */
+		aa_put_label(base);
+		aa_put_label(stack);
+		if (!new)
+			return ERR_PTR(-ENOMEM);
+	}
+
+	/* released by caller */
+	return new;
+}
+
+struct aa_label *aa_profile_ns_perm(struct aa_profile *profile,
+				    struct apparmor_audit_data *ad,
+				    u32 request)
+{
+	struct aa_ruleset *rules = list_first_entry(&profile->rules,
+						    typeof(*rules), list);
+	struct aa_label *new;
 	struct aa_perms perms = { };
-	int error = 0;
+	aa_state_t state;
 
 	ad->subj_label = &profile->label;
 	ad->request = request;
+	int error;
 
-	if (!profile_unconfined(profile)) {
-		struct aa_ruleset *rules = list_first_entry(&profile->rules,
-							    typeof(*rules),
-							    list);
-		aa_state_t state;
-
-		state = RULE_MEDIATES(rules, ad->class);
-		if (!state)
-			/* TODO: add flag to complain about unmediated */
-			return 0;
-		perms = *aa_lookup_perms(rules->policy, state);
-		aa_apply_modes_to_perms(profile, &perms);
-		error = aa_check_perms(profile, &perms, request, ad,
-				       audit_ns_cb);
+
+	/* TODO: rework unconfined profile/dfa to mediate user ns, then
+	 * we can drop the unconfined test
+	 */
+	state = RULE_MEDIATES(rules, ad->class);
+	if (!state) {
+		/* TODO: this gets replaced when the default unconfined
+		 * profile dfa gets updated to handle this
+		 */
+		if (profile_unconfined(profile) &&
+		    profile == profiles_ns(profile)->unconfined) {
+			if (!aa_unprivileged_userns_restricted ||
+			    ns_capable_noaudit(current_user_ns(),
+					       CAP_SYS_ADMIN))
+				return aa_get_newest_label(&profile->label);
+			ad->info = "User namespace creation restricted";
+			/* unconfined unprivileged user */
+			/* don't just return: allow complain mode to override */
+// hardcode unconfined transition for now
+			new = aa_label_parse(&profile->label,
+					     "unprivileged_userns", GFP_KERNEL,
+					     true, false);
+			if (IS_ERR(new)) {
+				ad->info = "Userns create restricted - failed to find unprivileged_userns profile";
+				ad->error = PTR_ERR(new);
+				ad->ns.target = "unprivileged_userns";
+				new = NULL;
+				perms.deny |= request;
+				goto hard_coded;
+			}
+			ad->info = "Userns create - transitioning profile";
+			perms.audit = request;
+			perms.allow = request;
+			goto hard_coded;
+// once we have special unconfined profile, jump to ns_x_to_label()
+// end hardcode
+		} else if (!aa_unprivileged_userns_restricted_force) {
+			return aa_get_newest_label(&profile->label);
+		}
+		/* continue to mediation */
 	}
 
-	return error;
+	perms = *aa_lookup_perms(rules->policy, state);
+	new = ns_x_to_label(profile, perms.xindex, &ad->ns.target, &ad->info);
+	if (IS_ERR(new)) {
+		ad->error = PTR_ERR(new);
+		new = NULL;
+		perms.deny |= request;
+	} else if (!new) {
+		/* no transition - not done in x_to_label so we can track */
+		new = aa_get_label(&profile->label);
+	} else {
+hard_coded:
+		ad->peer = new;
+	}
+	if (aa_unprivileged_userns_restricted_complain)
+		perms.complain = ALL_PERMS_MASK;
+	// TODO: nnp
+	// TODO: complain mode support for transitions
+
+	aa_apply_modes_to_perms(profile, &perms);
+	error = aa_check_perms(profile, &perms, request, ad, audit_ns_cb);
+	if (error) {
+		aa_put_label(new);
+		return ERR_PTR(error);
+	}
+	return new;
 }
--- linux-qcom-6.8.0.orig/security/bpf/hooks.c
+++ linux-qcom-6.8.0/security/bpf/hooks.c
@@ -19,6 +19,7 @@
 static const struct lsm_id bpf_lsmid = {
 	.name = "bpf",
 	.id = LSM_ID_BPF,
+	.lsmblob = true,
 };
 
 static int __init bpf_lsm_init(void)
@@ -31,7 +32,6 @@
 
 struct lsm_blob_sizes bpf_lsm_blob_sizes __ro_after_init = {
 	.lbs_inode = sizeof(struct bpf_storage_blob),
-	.lbs_task = sizeof(struct bpf_storage_blob),
 };
 
 DEFINE_LSM(bpf) = {
--- linux-qcom-6.8.0.orig/security/integrity/digsig.c
+++ linux-qcom-6.8.0/security/integrity/digsig.c
@@ -201,7 +201,7 @@
 	rc = kernel_read_file_from_path(path, 0, &data, INT_MAX, NULL,
 					READING_X509_CERTIFICATE);
 	if (rc < 0) {
-		pr_err("Unable to open file: %s (%d)", path, rc);
+		pr_warn("Unable to open file: %s (%d)", path, rc);
 		return rc;
 	}
 	size = rc;
--- linux-qcom-6.8.0.orig/security/integrity/evm/evm.h
+++ linux-qcom-6.8.0/security/integrity/evm/evm.h
@@ -42,7 +42,7 @@
 extern struct list_head evm_config_xattrnames;
 
 struct evm_digest {
-	struct ima_digest_data hdr;
+	struct ima_digest_data_hdr hdr;
 	char digest[IMA_MAX_DIGEST_SIZE];
 } __packed;
 
--- linux-qcom-6.8.0.orig/security/integrity/evm/evm_main.c
+++ linux-qcom-6.8.0/security/integrity/evm/evm_main.c
@@ -192,7 +192,11 @@
 		     iint->evm_status == INTEGRITY_PASS_IMMUTABLE))
 		return iint->evm_status;
 
-	if (is_unsupported_fs(dentry))
+	/*
+	 * On unsupported filesystems without EVM_INIT_X509 enabled, skip
+	 * signature verification.
+	 */
+	if (!(evm_initialized & EVM_INIT_X509) && is_unsupported_fs(dentry))
 		return INTEGRITY_UNKNOWN;
 
 	/* if status is not PASS, try to check again - against -ENOMEM */
@@ -262,7 +266,8 @@
 				evm_status = INTEGRITY_PASS_IMMUTABLE;
 			} else if (!IS_RDONLY(inode) &&
 				   !(inode->i_sb->s_readonly_remount) &&
-				   !IS_IMMUTABLE(inode)) {
+				   !IS_IMMUTABLE(inode) &&
+				   !is_unsupported_fs(dentry)) {
 				evm_update_evmxattr(dentry, xattr_name,
 						    xattr_value,
 						    xattr_value_len);
@@ -422,9 +427,6 @@
 	if (!evm_key_loaded() || !evm_protected_xattr(xattr_name))
 		return INTEGRITY_UNKNOWN;
 
-	if (is_unsupported_fs(dentry))
-		return INTEGRITY_UNKNOWN;
-
 	if (!iint) {
 		iint = integrity_iint_find(d_backing_inode(dentry));
 		if (!iint)
--- linux-qcom-6.8.0.orig/security/integrity/ima/ima.h
+++ linux-qcom-6.8.0/security/integrity/ima/ima.h
@@ -256,7 +256,7 @@
 
 /* LIM API function definitions */
 int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
-		   const struct cred *cred, u32 secid, int mask,
+		   const struct cred *cred, struct lsmblob *blob, int mask,
 		   enum ima_hooks func, int *pcr,
 		   struct ima_template_desc **template_desc,
 		   const char *func_data, unsigned int *allowed_algos);
@@ -287,8 +287,8 @@
 
 /* IMA policy related functions */
 int ima_match_policy(struct mnt_idmap *idmap, struct inode *inode,
-		     const struct cred *cred, u32 secid, enum ima_hooks func,
-		     int mask, int flags, int *pcr,
+		     const struct cred *cred, struct lsmblob *blob,
+		     enum ima_hooks func, int mask, int flags, int *pcr,
 		     struct ima_template_desc **template_desc,
 		     const char *func_data, unsigned int *allowed_algos);
 void ima_init_policy(void);
@@ -420,32 +420,6 @@
 }
 #endif /* CONFIG_IMA_APPRAISE_MODSIG */
 
-/* LSM based policy rules require audit */
-#ifdef CONFIG_IMA_LSM_RULES
-
-#define ima_filter_rule_init security_audit_rule_init
-#define ima_filter_rule_free security_audit_rule_free
-#define ima_filter_rule_match security_audit_rule_match
-
-#else
-
-static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr,
-				       void **lsmrule)
-{
-	return -EINVAL;
-}
-
-static inline void ima_filter_rule_free(void *lsmrule)
-{
-}
-
-static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
-					void *lsmrule)
-{
-	return -EINVAL;
-}
-#endif /* CONFIG_IMA_LSM_RULES */
-
 #ifdef	CONFIG_IMA_READ_POLICY
 #define	POLICY_FILE_FLAGS	(S_IWUSR | S_IRUSR)
 #else
--- linux-qcom-6.8.0.orig/security/integrity/ima/ima_api.c
+++ linux-qcom-6.8.0/security/integrity/ima/ima_api.c
@@ -165,7 +165,7 @@
  * @idmap: idmap of the mount the inode was found from
  * @inode: pointer to the inode associated with the object being validated
  * @cred: pointer to credentials structure to validate
- * @secid: secid of the task being validated
+ * @blob: secid(s) of the task being validated
  * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
  *        MAY_APPEND)
  * @func: caller identifier
@@ -187,7 +187,7 @@
  *
  */
 int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
-		   const struct cred *cred, u32 secid, int mask,
+		   const struct cred *cred, struct lsmblob *blob, int mask,
 		   enum ima_hooks func, int *pcr,
 		   struct ima_template_desc **template_desc,
 		   const char *func_data, unsigned int *allowed_algos)
@@ -196,7 +196,7 @@
 
 	flags &= ima_policy_flag;
 
-	return ima_match_policy(idmap, inode, cred, secid, func, mask,
+	return ima_match_policy(idmap, inode, cred, blob, func, mask,
 				flags, pcr, template_desc, func_data,
 				allowed_algos);
 }
@@ -244,8 +244,10 @@
 	const char *audit_cause = "failed";
 	struct inode *inode = file_inode(file);
 	struct inode *real_inode = d_real_inode(file_dentry(file));
-	const char *filename = file->f_path.dentry->d_name.name;
 	struct ima_max_digest_data hash;
+	struct ima_digest_data *hash_hdr = container_of(&hash.hdr,
+						struct ima_digest_data, hdr);
+	struct name_snapshot filename;
 	struct kstat stat;
 	int result = 0;
 	int length;
@@ -285,9 +287,9 @@
 			result = -ENODATA;
 		}
 	} else if (buf) {
-		result = ima_calc_buffer_hash(buf, size, &hash.hdr);
+		result = ima_calc_buffer_hash(buf, size, hash_hdr);
 	} else {
-		result = ima_calc_file_hash(file, &hash.hdr);
+		result = ima_calc_file_hash(file, hash_hdr);
 	}
 
 	if (result && result != -EBADF && result != -EINVAL)
@@ -316,9 +318,13 @@
 		if (file->f_flags & O_DIRECT)
 			audit_cause = "failed(directio)";
 
+		take_dentry_name_snapshot(&filename, file->f_path.dentry);
+
 		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
-				    filename, "collect_data", audit_cause,
-				    result, 0);
+				    filename.name.name, "collect_data",
+				    audit_cause, result, 0);
+
+		release_dentry_name_snapshot(&filename);
 	}
 	return result;
 }
@@ -431,6 +437,7 @@
  */
 const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
 {
+	struct name_snapshot filename;
 	char *pathname = NULL;
 
 	*pathbuf = __getname();
@@ -444,7 +451,10 @@
 	}
 
 	if (!pathname) {
-		strscpy(namebuf, path->dentry->d_name.name, NAME_MAX);
+		take_dentry_name_snapshot(&filename, path->dentry);
+		strscpy(namebuf, filename.name.name, NAME_MAX);
+		release_dentry_name_snapshot(&filename);
+
 		pathname = namebuf;
 	}
 
--- linux-qcom-6.8.0.orig/security/integrity/ima/ima_appraise.c
+++ linux-qcom-6.8.0/security/integrity/ima/ima_appraise.c
@@ -73,13 +73,13 @@
 int ima_must_appraise(struct mnt_idmap *idmap, struct inode *inode,
 		      int mask, enum ima_hooks func)
 {
-	u32 secid;
+	struct lsmblob blob;
 
 	if (!ima_appraise)
 		return 0;
 
-	security_current_getsecid_subj(&secid);
-	return ima_match_policy(idmap, inode, current_cred(), secid,
+	security_current_getlsmblob_subj(&blob);
+	return ima_match_policy(idmap, inode, current_cred(), &blob,
 				func, mask, IMA_APPRAISE | IMA_HASH, NULL,
 				NULL, NULL, NULL);
 }
@@ -380,7 +380,9 @@
 		}
 
 		rc = calc_file_id_hash(IMA_VERITY_DIGSIG, iint->ima_hash->algo,
-				       iint->ima_hash->digest, &hash.hdr);
+				       iint->ima_hash->digest,
+				       container_of(&hash.hdr,
+					       struct ima_digest_data, hdr));
 		if (rc) {
 			*cause = "sigv3-hashing-error";
 			*status = INTEGRITY_FAIL;
--- linux-qcom-6.8.0.orig/security/integrity/ima/ima_fs.c
+++ linux-qcom-6.8.0/security/integrity/ima/ima_fs.c
@@ -287,7 +287,7 @@
 	rc = kernel_read_file_from_path(path, 0, &data, INT_MAX, NULL,
 					READING_POLICY);
 	if (rc < 0) {
-		pr_err("Unable to open file: %s (%d)", path, rc);
+		pr_warn("Unable to open file: %s (%d)", path, rc);
 		return rc;
 	}
 	size = rc;
--- linux-qcom-6.8.0.orig/security/integrity/ima/ima_init.c
+++ linux-qcom-6.8.0/security/integrity/ima/ima_init.c
@@ -48,12 +48,14 @@
 	struct ima_event_data event_data = { .iint = iint,
 					     .filename = boot_aggregate_name };
 	struct ima_max_digest_data hash;
+	struct ima_digest_data *hash_hdr = container_of(&hash.hdr,
+						struct ima_digest_data, hdr);
 	int result = -ENOMEM;
 	int violation = 0;
 
 	memset(iint, 0, sizeof(*iint));
 	memset(&hash, 0, sizeof(hash));
-	iint->ima_hash = &hash.hdr;
+	iint->ima_hash = hash_hdr;
 	iint->ima_hash->algo = ima_hash_algo;
 	iint->ima_hash->length = hash_digest_size[ima_hash_algo];
 
@@ -70,7 +72,7 @@
 	 * is not found.
 	 */
 	if (ima_tpm_chip) {
-		result = ima_calc_boot_aggregate(&hash.hdr);
+		result = ima_calc_boot_aggregate(hash_hdr);
 		if (result < 0) {
 			audit_cause = "hashing_error";
 			goto err_out;
--- linux-qcom-6.8.0.orig/security/integrity/ima/ima_main.c
+++ linux-qcom-6.8.0/security/integrity/ima/ima_main.c
@@ -205,8 +205,8 @@
 }
 
 static int process_measurement(struct file *file, const struct cred *cred,
-			       u32 secid, char *buf, loff_t size, int mask,
-			       enum ima_hooks func)
+			       struct lsmblob *blob, char *buf, loff_t size,
+			       int mask, enum ima_hooks func)
 {
 	struct inode *backing_inode, *inode = file_inode(file);
 	struct integrity_iint_cache *iint = NULL;
@@ -230,7 +230,7 @@
 	 * bitmask based on the appraise/audit/measurement policy.
 	 * Included is the appraise submask.
 	 */
-	action = ima_get_action(file_mnt_idmap(file), inode, cred, secid,
+	action = ima_get_action(file_mnt_idmap(file), inode, cred, blob,
 				mask, func, &pcr, &template_desc, NULL,
 				&allowed_algos);
 	violation_check = ((func == FILE_CHECK || func == MMAP_CHECK ||
@@ -430,23 +430,23 @@
 int ima_file_mmap(struct file *file, unsigned long reqprot,
 		  unsigned long prot, unsigned long flags)
 {
-	u32 secid;
+	struct lsmblob blob;
 	int ret;
 
 	if (!file)
 		return 0;
 
-	security_current_getsecid_subj(&secid);
+	security_current_getlsmblob_subj(&blob);
 
 	if (reqprot & PROT_EXEC) {
-		ret = process_measurement(file, current_cred(), secid, NULL,
+		ret = process_measurement(file, current_cred(), &blob, NULL,
 					  0, MAY_EXEC, MMAP_CHECK_REQPROT);
 		if (ret)
 			return ret;
 	}
 
 	if (prot & PROT_EXEC)
-		return process_measurement(file, current_cred(), secid, NULL,
+		return process_measurement(file, current_cred(), &blob, NULL,
 					   0, MAY_EXEC, MMAP_CHECK);
 
 	return 0;
@@ -473,9 +473,9 @@
 	char *pathbuf = NULL;
 	const char *pathname = NULL;
 	struct inode *inode;
+	struct lsmblob blob;
 	int result = 0;
 	int action;
-	u32 secid;
 	int pcr;
 
 	/* Is mprotect making an mmap'ed file executable? */
@@ -483,13 +483,13 @@
 	    !(prot & PROT_EXEC) || (vma->vm_flags & VM_EXEC))
 		return 0;
 
-	security_current_getsecid_subj(&secid);
+	security_current_getlsmblob_subj(&blob);
 	inode = file_inode(vma->vm_file);
 	action = ima_get_action(file_mnt_idmap(vma->vm_file), inode,
-				current_cred(), secid, MAY_EXEC, MMAP_CHECK,
+				current_cred(), &blob, MAY_EXEC, MMAP_CHECK,
 				&pcr, &template, NULL, NULL);
 	action |= ima_get_action(file_mnt_idmap(vma->vm_file), inode,
-				 current_cred(), secid, MAY_EXEC,
+				 current_cred(), &blob, MAY_EXEC,
 				 MMAP_CHECK_REQPROT, &pcr, &template, NULL,
 				 NULL);
 
@@ -526,16 +526,16 @@
 int ima_bprm_check(struct linux_binprm *bprm)
 {
 	int ret;
-	u32 secid;
+	struct lsmblob blob;
 
-	security_current_getsecid_subj(&secid);
-	ret = process_measurement(bprm->file, current_cred(), secid, NULL, 0,
-				  MAY_EXEC, BPRM_CHECK);
+	security_current_getlsmblob_subj(&blob);
+	ret = process_measurement(bprm->file, current_cred(),
+				  &blob, NULL, 0, MAY_EXEC, BPRM_CHECK);
 	if (ret)
 		return ret;
 
-	security_cred_getsecid(bprm->cred, &secid);
-	return process_measurement(bprm->file, bprm->cred, secid, NULL, 0,
+	security_cred_getlsmblob(bprm->cred, &blob);
+	return process_measurement(bprm->file, bprm->cred, &blob, NULL, 0,
 				   MAY_EXEC, CREDS_CHECK);
 }
 
@@ -551,10 +551,10 @@
  */
 int ima_file_check(struct file *file, int mask)
 {
-	u32 secid;
+	struct lsmblob blob;
 
-	security_current_getsecid_subj(&secid);
-	return process_measurement(file, current_cred(), secid, NULL, 0,
+	security_current_getlsmblob_subj(&blob);
+	return process_measurement(file, current_cred(), &blob, NULL, 0,
 				   mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
 					   MAY_APPEND), FILE_CHECK);
 }
@@ -755,7 +755,7 @@
 		  bool contents)
 {
 	enum ima_hooks func;
-	u32 secid;
+	struct lsmblob blob;
 
 	/*
 	 * Do devices using pre-allocated memory run the risk of the
@@ -775,9 +775,9 @@
 
 	/* Read entire file for all partial reads. */
 	func = read_idmap[read_id] ?: FILE_CHECK;
-	security_current_getsecid_subj(&secid);
-	return process_measurement(file, current_cred(), secid, NULL,
-				   0, MAY_READ, func);
+	security_current_getlsmblob_subj(&blob);
+	return process_measurement(file, current_cred(), &blob, NULL, 0,
+				   MAY_READ, func);
 }
 
 const int read_idmap[READING_MAX_ID] = {
@@ -805,7 +805,7 @@
 		       enum kernel_read_file_id read_id)
 {
 	enum ima_hooks func;
-	u32 secid;
+	struct lsmblob blob;
 
 	/* permit signed certs */
 	if (!file && read_id == READING_X509_CERTIFICATE)
@@ -818,8 +818,8 @@
 	}
 
 	func = read_idmap[read_id] ?: FILE_CHECK;
-	security_current_getsecid_subj(&secid);
-	return process_measurement(file, current_cred(), secid, buf, size,
+	security_current_getlsmblob_subj(&blob);
+	return process_measurement(file, current_cred(), &blob, buf, size,
 				   MAY_READ, func);
 }
 
@@ -941,11 +941,13 @@
 					    .buf_len = size};
 	struct ima_template_desc *template;
 	struct ima_max_digest_data hash;
+	struct ima_digest_data *hash_hdr = container_of(&hash.hdr,
+						struct ima_digest_data, hdr);
 	char digest_hash[IMA_MAX_DIGEST_SIZE];
 	int digest_hash_len = hash_digest_size[ima_hash_algo];
 	int violation = 0;
 	int action = 0;
-	u32 secid;
+	struct lsmblob blob;
 
 	if (digest && digest_len < digest_hash_len)
 		return -EINVAL;
@@ -968,9 +970,9 @@
 	 * buffer measurements.
 	 */
 	if (func) {
-		security_current_getsecid_subj(&secid);
+		security_current_getlsmblob_subj(&blob);
 		action = ima_get_action(idmap, inode, current_cred(),
-					secid, 0, func, &pcr, &template,
+					&blob, 0, func, &pcr, &template,
 					func_data, NULL);
 		if (!(action & IMA_MEASURE) && !digest)
 			return -ENOENT;
@@ -979,7 +981,7 @@
 	if (!pcr)
 		pcr = CONFIG_IMA_MEASURE_PCR_IDX;
 
-	iint.ima_hash = &hash.hdr;
+	iint.ima_hash = hash_hdr;
 	iint.ima_hash->algo = ima_hash_algo;
 	iint.ima_hash->length = hash_digest_size[ima_hash_algo];
 
@@ -990,7 +992,7 @@
 	}
 
 	if (buf_hash) {
-		memcpy(digest_hash, hash.hdr.digest, digest_hash_len);
+		memcpy(digest_hash, hash_hdr->digest, digest_hash_len);
 
 		ret = ima_calc_buffer_hash(digest_hash, digest_hash_len,
 					   iint.ima_hash);
--- linux-qcom-6.8.0.orig/security/integrity/ima/ima_policy.c
+++ linux-qcom-6.8.0/security/integrity/ima/ima_policy.c
@@ -117,6 +117,8 @@
 		void *rule;	/* LSM file metadata specific */
 		char *args_p;	/* audit value */
 		int type;	/* audit type */
+		int lsm_id;	/* which LSM rule applies to */
+		bool lsm_specific;	/* true if lsm is specified */
 	} lsm[MAX_LSM_RULES];
 	char *fsname;
 	struct ima_rule_opt_list *keyrings; /* Measure keys added to these keyrings */
@@ -309,6 +311,25 @@
 }
 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 
+static int default_rules_lsm __ro_after_init = LSM_ID_UNDEF;
+
+static int __init ima_rules_lsm_init(char *str)
+{
+	int newdrl;
+
+	newdrl = lsm_name_to_id(str);
+	if (newdrl >= 0) {
+		default_rules_lsm = newdrl;
+		return 1;
+	}
+
+	pr_err("default ima rule lsm \"%s\" not registered, value unchanged.",
+		str);
+
+	return 1;
+}
+__setup("ima_rules_lsm=", ima_rules_lsm_init);
+
 static struct ima_rule_opt_list *ima_alloc_rule_opt_list(const substring_t *src)
 {
 	struct ima_rule_opt_list *opt_list;
@@ -380,7 +401,8 @@
 	int i;
 
 	for (i = 0; i < MAX_LSM_RULES; i++) {
-		ima_filter_rule_free(entry->lsm[i].rule);
+		ima_filter_rule_free(entry->lsm[i].rule,
+				     entry->lsm[i].lsm_id);
 		kfree(entry->lsm[i].args_p);
 	}
 }
@@ -401,7 +423,8 @@
 	kfree(entry);
 }
 
-static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry)
+static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry,
+						gfp_t gfp)
 {
 	struct ima_rule_entry *nentry;
 	int i;
@@ -410,7 +433,7 @@
 	 * Immutable elements are copied over as pointers and data; only
 	 * lsm rules can change
 	 */
-	nentry = kmemdup(entry, sizeof(*nentry), GFP_KERNEL);
+	nentry = kmemdup(entry, sizeof(*nentry), gfp);
 	if (!nentry)
 		return NULL;
 
@@ -425,7 +448,9 @@
 
 		ima_filter_rule_init(nentry->lsm[i].type, Audit_equal,
 				     nentry->lsm[i].args_p,
-				     &nentry->lsm[i].rule);
+				     &nentry->lsm[i].rule,
+				     entry->lsm[i].lsm_id,
+				     gfp);
 		if (!nentry->lsm[i].rule)
 			pr_warn("rule for LSM \'%s\' is undefined\n",
 				nentry->lsm[i].args_p);
@@ -438,7 +463,7 @@
 	int i;
 	struct ima_rule_entry *nentry;
 
-	nentry = ima_lsm_copy_rule(entry);
+	nentry = ima_lsm_copy_rule(entry, GFP_KERNEL);
 	if (!nentry)
 		return -ENOMEM;
 
@@ -451,7 +476,8 @@
 	 * be owned by nentry.
 	 */
 	for (i = 0; i < MAX_LSM_RULES; i++)
-		ima_filter_rule_free(entry->lsm[i].rule);
+		ima_filter_rule_free(entry->lsm[i].rule,
+				     entry->lsm[i].lsm_id);
 	kfree(entry);
 
 	return 0;
@@ -555,7 +581,7 @@
  * @idmap: idmap of the mount the inode was found from
  * @inode: a pointer to an inode
  * @cred: a pointer to a credentials structure for user validation
- * @secid: the secid of the task to be validated
+ * @blob: the secid(s) of the task to be validated
  * @func: LIM hook identifier
  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
  * @func_data: func specific data, may be NULL
@@ -565,7 +591,7 @@
 static bool ima_match_rules(struct ima_rule_entry *rule,
 			    struct mnt_idmap *idmap,
 			    struct inode *inode, const struct cred *cred,
-			    u32 secid, enum ima_hooks func, int mask,
+			    struct lsmblob *blob, enum ima_hooks func, int mask,
 			    const char *func_data)
 {
 	int i;
@@ -633,7 +659,7 @@
 		return false;
 	for (i = 0; i < MAX_LSM_RULES; i++) {
 		int rc = 0;
-		u32 osid;
+		struct lsmblob blob = { };
 
 		if (!lsm_rule->lsm[i].rule) {
 			if (!lsm_rule->lsm[i].args_p)
@@ -647,24 +673,26 @@
 		case LSM_OBJ_USER:
 		case LSM_OBJ_ROLE:
 		case LSM_OBJ_TYPE:
-			security_inode_getsecid(inode, &osid);
-			rc = ima_filter_rule_match(osid, lsm_rule->lsm[i].type,
+			security_inode_getlsmblob(inode, &blob);
+			rc = ima_filter_rule_match(&blob, lsm_rule->lsm[i].type,
 						   Audit_equal,
-						   lsm_rule->lsm[i].rule);
+						   lsm_rule->lsm[i].rule,
+						   lsm_rule->lsm[i].lsm_id);
 			break;
 		case LSM_SUBJ_USER:
 		case LSM_SUBJ_ROLE:
 		case LSM_SUBJ_TYPE:
-			rc = ima_filter_rule_match(secid, lsm_rule->lsm[i].type,
+			rc = ima_filter_rule_match(&blob, lsm_rule->lsm[i].type,
 						   Audit_equal,
-						   lsm_rule->lsm[i].rule);
+						   lsm_rule->lsm[i].rule,
+						   lsm_rule->lsm[i].lsm_id);
 			break;
 		default:
 			break;
 		}
 
 		if (rc == -ESTALE && !rule_reinitialized) {
-			lsm_rule = ima_lsm_copy_rule(rule);
+			lsm_rule = ima_lsm_copy_rule(rule, GFP_ATOMIC);
 			if (lsm_rule) {
 				rule_reinitialized = true;
 				goto retry;
@@ -680,7 +708,8 @@
 out:
 	if (rule_reinitialized) {
 		for (i = 0; i < MAX_LSM_RULES; i++)
-			ima_filter_rule_free(lsm_rule->lsm[i].rule);
+			ima_filter_rule_free(lsm_rule->lsm[i].rule,
+					     lsm_rule->lsm[i].lsm_id);
 		kfree(lsm_rule);
 	}
 	return result;
@@ -718,7 +747,7 @@
  * @inode: pointer to an inode for which the policy decision is being made
  * @cred: pointer to a credentials structure for which the policy decision is
  *        being made
- * @secid: LSM secid of the task to be validated
+ * @blob: LSM secid(s) of the task to be validated
  * @func: IMA hook identifier
  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
  * @flags: IMA actions to consider (e.g. IMA_MEASURE | IMA_APPRAISE)
@@ -735,8 +764,8 @@
  * than writes so ima_match_policy() is classical RCU candidate.
  */
 int ima_match_policy(struct mnt_idmap *idmap, struct inode *inode,
-		     const struct cred *cred, u32 secid, enum ima_hooks func,
-		     int mask, int flags, int *pcr,
+		     const struct cred *cred, struct lsmblob *blob,
+		     enum ima_hooks func, int mask, int flags, int *pcr,
 		     struct ima_template_desc **template_desc,
 		     const char *func_data, unsigned int *allowed_algos)
 {
@@ -754,7 +783,7 @@
 		if (!(entry->action & actmask))
 			continue;
 
-		if (!ima_match_rules(entry, idmap, inode, cred, secid,
+		if (!ima_match_rules(entry, idmap, inode, cred, blob,
 				     func, mask, func_data))
 			continue;
 
@@ -1073,7 +1102,7 @@
 	Opt_digest_type,
 	Opt_appraise_type, Opt_appraise_flag, Opt_appraise_algos,
 	Opt_permit_directio, Opt_pcr, Opt_template, Opt_keyrings,
-	Opt_label, Opt_err
+	Opt_lsm, Opt_label, Opt_err
 };
 
 static const match_table_t policy_tokens = {
@@ -1121,6 +1150,7 @@
 	{Opt_pcr, "pcr=%s"},
 	{Opt_template, "template=%s"},
 	{Opt_keyrings, "keyrings=%s"},
+	{Opt_lsm, "lsm=%s"},
 	{Opt_label, "label=%s"},
 	{Opt_err, NULL}
 };
@@ -1140,7 +1170,9 @@
 	entry->lsm[lsm_rule].type = audit_type;
 	result = ima_filter_rule_init(entry->lsm[lsm_rule].type, Audit_equal,
 				      entry->lsm[lsm_rule].args_p,
-				      &entry->lsm[lsm_rule].rule);
+				      &entry->lsm[lsm_rule].rule,
+				      entry->lsm[lsm_rule].lsm_id,
+				      GFP_KERNEL);
 	if (!entry->lsm[lsm_rule].rule) {
 		pr_warn("rule for LSM \'%s\' is undefined\n",
 			entry->lsm[lsm_rule].args_p);
@@ -1878,6 +1910,23 @@
 						 &(template_desc->num_fields));
 			entry->template = template_desc;
 			break;
+		case Opt_lsm: {
+			int i;
+
+			result = lsm_name_to_id(args[0].from);
+			if (result < 0) {
+				for (i = 0; i < MAX_LSM_RULES; i++)
+					entry->lsm[i].args_p = NULL;
+				result = -EINVAL;
+				break;
+			}
+			for (i = 0; i < MAX_LSM_RULES; i++) {
+				entry->lsm[i].lsm_id = result;
+				entry->lsm[i].lsm_specific = true;
+			}
+			result = 0;
+			break;
+			}
 		case Opt_err:
 			ima_log_string(ab, "UNKNOWN", p);
 			result = -EINVAL;
@@ -1923,6 +1972,7 @@
 	struct ima_rule_entry *entry;
 	ssize_t result, len;
 	int audit_info = 0;
+	int i;
 
 	p = strsep(&rule, "\n");
 	len = strlen(p) + 1;
@@ -1940,6 +1990,11 @@
 
 	INIT_LIST_HEAD(&entry->list);
 
+	for (i = 0; i < MAX_LSM_RULES; i++) {
+		entry->lsm[i].lsm_id = default_rules_lsm;
+		entry->lsm[i].lsm_specific = false;
+	}
+
 	result = ima_parse_rule(p, entry);
 	if (result) {
 		ima_free_rule(entry);
@@ -2251,6 +2306,9 @@
 					   entry->lsm[i].args_p);
 				break;
 			}
+			if (entry->lsm[i].lsm_specific)
+				seq_printf(m, pt(Opt_lsm),
+				    lsm_id_to_name(entry->lsm[i].lsm_id));
 			seq_puts(m, " ");
 		}
 	}
--- linux-qcom-6.8.0.orig/security/integrity/ima/ima_template_lib.c
+++ linux-qcom-6.8.0/security/integrity/ima/ima_template_lib.c
@@ -318,15 +318,21 @@
 				      hash_algo_name[hash_algo]);
 	}
 
-	if (digest)
+	if (digest) {
 		memcpy(buffer + offset, digest, digestsize);
-	else
+	} else {
 		/*
 		 * If digest is NULL, the event being recorded is a violation.
 		 * Make room for the digest by increasing the offset by the
-		 * hash algorithm digest size.
+		 * hash algorithm digest size. If the hash algorithm is not
+		 * specified increase the offset by IMA_DIGEST_SIZE which
+		 * fits SHA1 or MD5
 		 */
-		offset += hash_digest_size[hash_algo];
+		if (hash_algo < HASH_ALGO__LAST)
+			offset += hash_digest_size[hash_algo];
+		else
+			offset += IMA_DIGEST_SIZE;
+	}
 
 	return ima_write_template_field_data(buffer, offset + digestsize,
 					     fmt, field_data);
@@ -339,6 +345,8 @@
 			 struct ima_field_data *field_data)
 {
 	struct ima_max_digest_data hash;
+	struct ima_digest_data *hash_hdr = container_of(&hash.hdr,
+						struct ima_digest_data, hdr);
 	u8 *cur_digest = NULL;
 	u32 cur_digestsize = 0;
 	struct inode *inode;
@@ -358,7 +366,7 @@
 	if ((const char *)event_data->filename == boot_aggregate_name) {
 		if (ima_tpm_chip) {
 			hash.hdr.algo = HASH_ALGO_SHA1;
-			result = ima_calc_boot_aggregate(&hash.hdr);
+			result = ima_calc_boot_aggregate(hash_hdr);
 
 			/* algo can change depending on available PCR banks */
 			if (!result && hash.hdr.algo != HASH_ALGO_SHA1)
@@ -368,7 +376,7 @@
 				memset(&hash, 0, sizeof(hash));
 		}
 
-		cur_digest = hash.hdr.digest;
+		cur_digest = hash_hdr->digest;
 		cur_digestsize = hash_digest_size[HASH_ALGO_SHA1];
 		goto out;
 	}
@@ -379,14 +387,14 @@
 	inode = file_inode(event_data->file);
 	hash.hdr.algo = ima_template_hash_algo_allowed(ima_hash_algo) ?
 	    ima_hash_algo : HASH_ALGO_SHA1;
-	result = ima_calc_file_hash(event_data->file, &hash.hdr);
+	result = ima_calc_file_hash(event_data->file, hash_hdr);
 	if (result) {
 		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
 				    event_data->filename, "collect_data",
 				    "failed", result, 0);
 		return result;
 	}
-	cur_digest = hash.hdr.digest;
+	cur_digest = hash_hdr->digest;
 	cur_digestsize = hash.hdr.length;
 out:
 	return ima_eventdigest_init_common(cur_digest, cur_digestsize,
@@ -483,7 +491,10 @@
 				     bool size_limit)
 {
 	const char *cur_filename = NULL;
+	struct name_snapshot filename;
 	u32 cur_filename_len = 0;
+	bool snapshot = false;
+	int ret;
 
 	BUG_ON(event_data->filename == NULL && event_data->file == NULL);
 
@@ -496,7 +507,10 @@
 	}
 
 	if (event_data->file) {
-		cur_filename = event_data->file->f_path.dentry->d_name.name;
+		take_dentry_name_snapshot(&filename,
+					  event_data->file->f_path.dentry);
+		snapshot = true;
+		cur_filename = filename.name.name;
 		cur_filename_len = strlen(cur_filename);
 	} else
 		/*
@@ -505,8 +519,13 @@
 		 */
 		cur_filename_len = IMA_EVENT_NAME_LEN_MAX;
 out:
-	return ima_write_template_field_data(cur_filename, cur_filename_len,
-					     DATA_FMT_STRING, field_data);
+	ret = ima_write_template_field_data(cur_filename, cur_filename_len,
+					    DATA_FMT_STRING, field_data);
+
+	if (snapshot)
+		release_dentry_name_snapshot(&filename);
+
+	return ret;
 }
 
 /*
--- linux-qcom-6.8.0.orig/security/integrity/integrity.h
+++ linux-qcom-6.8.0/security/integrity/integrity.h
@@ -84,19 +84,26 @@
 };
 
 struct evm_ima_xattr_data {
-	u8 type;
+	/* New members must be added within the __struct_group() macro below. */
+	__struct_group(evm_ima_xattr_data_hdr, hdr, __packed,
+		u8 type;
+	);
 	u8 data[];
 } __packed;
+static_assert(offsetof(struct evm_ima_xattr_data, data) == sizeof(struct evm_ima_xattr_data_hdr),
+	      "struct member likely outside of __struct_group()");
 
 /* Only used in the EVM HMAC code. */
 struct evm_xattr {
-	struct evm_ima_xattr_data data;
+	struct evm_ima_xattr_data_hdr data;
 	u8 digest[SHA1_DIGEST_SIZE];
 } __packed;
 
 #define IMA_MAX_DIGEST_SIZE	HASH_MAX_DIGESTSIZE
 
 struct ima_digest_data {
+	/* New members must be added within the __struct_group() macro below. */
+	__struct_group(ima_digest_data_hdr, hdr, __packed,
 	u8 algo;
 	u8 length;
 	union {
@@ -110,15 +117,18 @@
 		} ng;
 		u8 data[2];
 	} xattr;
+	);
 	u8 digest[];
 } __packed;
+static_assert(offsetof(struct ima_digest_data, digest) == sizeof(struct ima_digest_data_hdr),
+	      "struct member likely outside of __struct_group()");
 
 /*
  * Instead of wrapping the ima_digest_data struct inside a local structure
  * with the maximum hash size, define ima_max_digest_data struct.
  */
 struct ima_max_digest_data {
-	struct ima_digest_data hdr;
+	struct ima_digest_data_hdr hdr;
 	u8 digest[HASH_MAX_DIGESTSIZE];
 } __packed;
 
--- linux-qcom-6.8.0.orig/security/integrity/platform_certs/keyring_handler.c
+++ linux-qcom-6.8.0/security/integrity/platform_certs/keyring_handler.c
@@ -40,6 +40,7 @@
 static __init void uefi_revocation_list_x509(const char *source,
 					     const void *data, size_t len)
 {
+	pr_info("Revoking X.509 certificate: %s\n", source);
 	add_key_to_revocation_list(data, len);
 }
 
--- linux-qcom-6.8.0.orig/security/integrity/platform_certs/load_uefi.c
+++ linux-qcom-6.8.0/security/integrity/platform_certs/load_uefi.c
@@ -74,7 +74,8 @@
 		return NULL;
 
 	if (*status != EFI_BUFFER_TOO_SMALL) {
-		pr_err("Couldn't get size: 0x%lx\n", *status);
+		pr_err("Couldn't get size: %s (0x%lx)\n",
+		       efi_status_to_str(*status), *status);
 		return NULL;
 	}
 
@@ -85,7 +86,8 @@
 	*status = efi.get_variable(name, guid, NULL, &lsize, db);
 	if (*status != EFI_SUCCESS) {
 		kfree(db);
-		pr_err("Error reading db var: 0x%lx\n", *status);
+		pr_err("Error reading db var: %s (0x%lx)\n",
+		       efi_status_to_str(*status), *status);
 		return NULL;
 	}
 
@@ -94,17 +96,18 @@
 }
 
 /*
- * load_moklist_certs() - Load MokList certs
+ * load_moklist_certs() - Load Mok(X)List certs
+ * @load_db: Load MokListRT into db when true; MokListXRT into dbx when false
  *
- * Load the certs contained in the UEFI MokListRT database into the
- * platform trusted keyring.
+ * Load the certs contained in the UEFI MokList(X)RT database into the
+ * platform trusted/denied keyring.
  *
  * This routine checks the EFI MOK config table first. If and only if
- * that fails, this routine uses the MokListRT ordinary UEFI variable.
+ * that fails, this routine uses the MokList(X)RT ordinary UEFI variable.
  *
  * Return:	Status
  */
-static int __init load_moklist_certs(void)
+static int __init load_moklist_certs(const bool load_db)
 {
 	struct efi_mokvar_table_entry *mokvar_entry;
 	efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
@@ -112,41 +115,55 @@
 	unsigned long moksize;
 	efi_status_t status;
 	int rc;
+	const char *mokvar_name = "MokListRT";
+	/* Should be const, but get_cert_list() doesn't have it as const yet */
+	efi_char16_t *efivar_name = L"MokListRT";
+	const char *parse_mokvar_name = "UEFI:MokListRT (MOKvar table)";
+	const char *parse_efivar_name = "UEFI:MokListRT";
+	efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *) = get_handler_for_db;
+
+	if (!load_db) {
+		mokvar_name = "MokListXRT";
+		efivar_name = L"MokListXRT";
+		parse_mokvar_name = "UEFI:MokListXRT (MOKvar table)";
+		parse_efivar_name = "UEFI:MokListXRT";
+		get_handler_for_guid = get_handler_for_dbx;
+	}
 
 	/* First try to load certs from the EFI MOKvar config table.
 	 * It's not an error if the MOKvar config table doesn't exist
 	 * or the MokListRT entry is not found in it.
 	 */
-	mokvar_entry = efi_mokvar_entry_find("MokListRT");
+	mokvar_entry = efi_mokvar_entry_find(mokvar_name);
 	if (mokvar_entry) {
-		rc = parse_efi_signature_list("UEFI:MokListRT (MOKvar table)",
+		rc = parse_efi_signature_list(parse_mokvar_name,
 					      mokvar_entry->data,
 					      mokvar_entry->data_size,
-					      get_handler_for_mok);
+					      get_handler_for_guid);
 		/* All done if that worked. */
 		if (!rc)
 			return rc;
 
-		pr_err("Couldn't parse MokListRT signatures from EFI MOKvar config table: %d\n",
-		       rc);
+		pr_err("Couldn't parse %s signatures from EFI MOKvar config table: %d\n",
+		       mokvar_name, rc);
 	}
 
 	/* Get MokListRT. It might not exist, so it isn't an error
 	 * if we can't get it.
 	 */
-	mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status);
+	mok = get_cert_list(efivar_name, &mok_var, &moksize, &status);
 	if (mok) {
-		rc = parse_efi_signature_list("UEFI:MokListRT",
-					      mok, moksize, get_handler_for_mok);
+		rc = parse_efi_signature_list(parse_efivar_name,
+					      mok, moksize, get_handler_for_guid);
 		kfree(mok);
 		if (rc)
-			pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
+			pr_err("Couldn't parse %s signatures: %d\n", mokvar_name, rc);
 		return rc;
 	}
 	if (status == EFI_NOT_FOUND)
-		pr_debug("MokListRT variable wasn't found\n");
+		pr_debug("%s variable wasn't found\n", mokvar_name);
 	else
-		pr_info("Couldn't get UEFI MokListRT\n");
+		pr_info("Couldn't get UEFI %s\n", mokvar_name);
 	return 0;
 }
 
@@ -160,9 +177,8 @@
 static int __init load_uefi_certs(void)
 {
 	efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
-	efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
-	void *db = NULL, *dbx = NULL, *mokx = NULL;
-	unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
+	void *db = NULL, *dbx = NULL;
+	unsigned long dbsize = 0, dbxsize = 0;
 	efi_status_t status;
 	int rc = 0;
 	const struct dmi_system_id *dmi_id;
@@ -215,23 +231,15 @@
 	if (!arch_ima_get_secureboot())
 		return 0;
 
-	mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);
-	if (!mokx) {
-		if (status == EFI_NOT_FOUND)
-			pr_debug("mokx variable wasn't found\n");
-		else
-			pr_info("Couldn't get mokx list\n");
-	} else {
-		rc = parse_efi_signature_list("UEFI:MokListXRT",
-					      mokx, mokxsize,
-					      get_handler_for_dbx);
-		if (rc)
-			pr_err("Couldn't parse mokx signatures %d\n", rc);
-		kfree(mokx);
-	}
+	/* Load the MokListXRT certs */
+	rc = load_moklist_certs(false);
+	if (rc)
+		pr_err("Couldn't parse mokx signatures: %d\n", rc);
 
 	/* Load the MokListRT certs */
-	rc = load_moklist_certs();
+	rc = load_moklist_certs(true);
+	if (rc)
+		pr_err("Couldn't parse mok signatures: %d\n", rc);
 
 	return rc;
 }
--- linux-qcom-6.8.0.orig/security/keys/key.c
+++ linux-qcom-6.8.0/security/keys/key.c
@@ -464,7 +464,8 @@
 			if (authkey)
 				key_invalidate(authkey);
 
-			key_set_expiry(key, prep->expiry);
+			if (prep->expiry != TIME64_MAX)
+				key_set_expiry(key, prep->expiry);
 		}
 	}
 
--- linux-qcom-6.8.0.orig/security/keys/keyctl.c
+++ linux-qcom-6.8.0/security/keys/keyctl.c
@@ -1693,7 +1693,7 @@
 		goto unlock;
 
 	/* cancel an already pending keyring replacement */
-	oldwork = task_work_cancel(parent, key_change_session_keyring);
+	oldwork = task_work_cancel_func(parent, key_change_session_keyring);
 
 	/* the replacement session keyring is applied just prior to userspace
 	 * restarting */
--- linux-qcom-6.8.0.orig/security/keys/keyring.c
+++ linux-qcom-6.8.0/security/keys/keyring.c
@@ -772,8 +772,11 @@
 	for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
 		ptr = READ_ONCE(node->slots[slot]);
 
-		if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)
-			goto descend_to_node;
+		if (assoc_array_ptr_is_meta(ptr)) {
+			if (node->back_pointer ||
+			    assoc_array_ptr_is_shortcut(ptr))
+				goto descend_to_node;
+		}
 
 		if (!keyring_ptr_is_keyring(ptr))
 			continue;
--- linux-qcom-6.8.0.orig/security/keys/trusted-keys/trusted_tpm2.c
+++ linux-qcom-6.8.0/security/keys/trusted-keys/trusted_tpm2.c
@@ -38,6 +38,7 @@
 	u8 *end_work = scratch + SCRATCH_SIZE;
 	u8 *priv, *pub;
 	u16 priv_len, pub_len;
+	int ret;
 
 	priv_len = get_unaligned_be16(src) + 2;
 	priv = src;
@@ -57,8 +58,10 @@
 		unsigned char bool[3], *w = bool;
 		/* tag 0 is emptyAuth */
 		w = asn1_encode_boolean(w, w + sizeof(bool), true);
-		if (WARN(IS_ERR(w), "BUG: Boolean failed to encode"))
-			return PTR_ERR(w);
+		if (WARN(IS_ERR(w), "BUG: Boolean failed to encode")) {
+			ret = PTR_ERR(w);
+			goto err;
+		}
 		work = asn1_encode_tag(work, end_work, 0, bool, w - bool);
 	}
 
@@ -69,8 +72,10 @@
 	 * trigger, so if it does there's something nefarious going on
 	 */
 	if (WARN(work - scratch + pub_len + priv_len + 14 > SCRATCH_SIZE,
-		 "BUG: scratch buffer is too small"))
-		return -EINVAL;
+		 "BUG: scratch buffer is too small")) {
+		ret = -EINVAL;
+		goto err;
+	}
 
 	work = asn1_encode_integer(work, end_work, options->keyhandle);
 	work = asn1_encode_octet_string(work, end_work, pub, pub_len);
@@ -79,10 +84,18 @@
 	work1 = payload->blob;
 	work1 = asn1_encode_sequence(work1, work1 + sizeof(payload->blob),
 				     scratch, work - scratch);
-	if (WARN(IS_ERR(work1), "BUG: ASN.1 encoder failed"))
-		return PTR_ERR(work1);
+	if (IS_ERR(work1)) {
+		ret = PTR_ERR(work1);
+		pr_err("BUG: ASN.1 encoder failed with %d\n", ret);
+		goto err;
+	}
 
+	kfree(scratch);
 	return work1 - payload->blob;
+
+err:
+	kfree(scratch);
+	return ret;
 }
 
 struct tpm2_key_context {
--- linux-qcom-6.8.0.orig/security/landlock/cred.c
+++ linux-qcom-6.8.0/security/landlock/cred.c
@@ -14,8 +14,8 @@
 #include "ruleset.h"
 #include "setup.h"
 
-static int hook_cred_prepare(struct cred *const new,
-			     const struct cred *const old, const gfp_t gfp)
+static void hook_cred_transfer(struct cred *const new,
+			       const struct cred *const old)
 {
 	struct landlock_ruleset *const old_dom = landlock_cred(old)->domain;
 
@@ -23,6 +23,12 @@
 		landlock_get_ruleset(old_dom);
 		landlock_cred(new)->domain = old_dom;
 	}
+}
+
+static int hook_cred_prepare(struct cred *const new,
+			     const struct cred *const old, const gfp_t gfp)
+{
+	hook_cred_transfer(new, old);
 	return 0;
 }
 
@@ -36,6 +42,7 @@
 
 static struct security_hook_list landlock_hooks[] __ro_after_init = {
 	LSM_HOOK_INIT(cred_prepare, hook_cred_prepare),
+	LSM_HOOK_INIT(cred_transfer, hook_cred_transfer),
 	LSM_HOOK_INIT(cred_free, hook_cred_free),
 };
 
--- linux-qcom-6.8.0.orig/security/landlock/fs.c
+++ linux-qcom-6.8.0/security/landlock/fs.c
@@ -737,6 +737,7 @@
 	bool allow_parent1, allow_parent2;
 	access_mask_t access_request_parent1, access_request_parent2;
 	struct path mnt_dir;
+	struct dentry *old_parent;
 	layer_mask_t layer_masks_parent1[LANDLOCK_NUM_ACCESS_FS] = {},
 		     layer_masks_parent2[LANDLOCK_NUM_ACCESS_FS] = {};
 
@@ -784,9 +785,17 @@
 	mnt_dir.mnt = new_dir->mnt;
 	mnt_dir.dentry = new_dir->mnt->mnt_root;
 
+	/*
+	 * old_dentry may be the root of the common mount point and
+	 * !IS_ROOT(old_dentry) at the same time (e.g. with open_tree() and
+	 * OPEN_TREE_CLONE).  We do not need to call dget(old_parent) because
+	 * we keep a reference to old_dentry.
+	 */
+	old_parent = (old_dentry == mnt_dir.dentry) ? old_dentry :
+						      old_dentry->d_parent;
+
 	/* new_dir->dentry is equal to new_dentry->d_parent */
-	allow_parent1 = collect_domain_accesses(dom, mnt_dir.dentry,
-						old_dentry->d_parent,
+	allow_parent1 = collect_domain_accesses(dom, mnt_dir.dentry, old_parent,
 						&layer_masks_parent1);
 	allow_parent2 = collect_domain_accesses(
 		dom, mnt_dir.dentry, new_dir->dentry, &layer_masks_parent2);
--- linux-qcom-6.8.0.orig/security/landlock/syscalls.c
+++ linux-qcom-6.8.0/security/landlock/syscalls.c
@@ -33,6 +33,18 @@
 #include "ruleset.h"
 #include "setup.h"
 
+static bool is_initialized(void)
+{
+	if (likely(landlock_initialized))
+		return true;
+
+	pr_warn_once(
+		"Disabled but requested by user space. "
+		"You should enable Landlock at boot time: "
+		"https://docs.kernel.org/userspace-api/landlock.html#boot-time-configuration\n");
+	return false;
+}
+
 /**
  * copy_min_struct_from_user - Safe future-proof argument copying
  *
@@ -173,7 +185,7 @@
 	/* Build-time checks. */
 	build_check_abi();
 
-	if (!landlock_initialized)
+	if (!is_initialized())
 		return -EOPNOTSUPP;
 
 	if (flags) {
@@ -398,7 +410,7 @@
 	struct landlock_ruleset *ruleset;
 	int err;
 
-	if (!landlock_initialized)
+	if (!is_initialized())
 		return -EOPNOTSUPP;
 
 	/* No flag for now. */
@@ -458,7 +470,7 @@
 	struct landlock_cred_security *new_llcred;
 	int err;
 
-	if (!landlock_initialized)
+	if (!is_initialized())
 		return -EOPNOTSUPP;
 
 	/*
--- linux-qcom-6.8.0.orig/security/lockdown/Kconfig
+++ linux-qcom-6.8.0/security/lockdown/Kconfig
@@ -16,6 +16,19 @@
 	  subsystem is fully initialised. If enabled, lockdown will
 	  unconditionally be called before any other LSMs.
 
+config LOCK_DOWN_IN_SECURE_BOOT
+	bool "Lock down the kernel in Secure Boot mode"
+	default n
+	depends on (EFI || S390 || PPC) && SECURITY_LOCKDOWN_LSM_EARLY
+	help
+	  Secure Boot provides a mechanism for ensuring that the firmware will
+	  only load signed bootloaders and kernels.  Secure boot mode
+	  determination is platform-specific; examples include EFI secure boot
+	  and SIPL on s390.
+
+	  Enabling this option results in kernel lockdown being triggered if
+	  booted under secure boot.
+
 choice
 	prompt "Kernel default lockdown mode"
 	default LOCK_DOWN_KERNEL_FORCE_NONE
--- linux-qcom-6.8.0.orig/security/lockdown/lockdown.c
+++ linux-qcom-6.8.0/security/lockdown/lockdown.c
@@ -74,6 +74,7 @@
 
 static struct security_hook_list lockdown_hooks[] __ro_after_init = {
 	LSM_HOOK_INIT(locked_down, lockdown_is_locked_down),
+	LSM_HOOK_INIT(lock_kernel_down, lock_kernel_down),
 };
 
 const struct lsm_id lockdown_lsmid = {
--- linux-qcom-6.8.0.orig/security/lsm_syscalls.c
+++ linux-qcom-6.8.0/security/lsm_syscalls.c
@@ -53,7 +53,7 @@
  * value indicating the reason for the error is returned.
  */
 SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *,
-		ctx, size_t, size, u32, flags)
+		ctx, u32, size, u32, flags)
 {
 	return security_setselfattr(attr, ctx, size, flags);
 }
@@ -75,7 +75,7 @@
  * a negative value indicating the error is returned.
  */
 SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *,
-		ctx, size_t __user *, size, u32, flags)
+		ctx, u32 __user *, size, u32, flags)
 {
 	return security_getselfattr(attr, ctx, size, flags);
 }
@@ -93,11 +93,11 @@
  * required size. In all other cases a negative value indicating the
  * error is returned.
  */
-SYSCALL_DEFINE3(lsm_list_modules, u64 __user *, ids, size_t __user *, size,
+SYSCALL_DEFINE3(lsm_list_modules, u64 __user *, ids, u32 __user *, size,
 		u32, flags)
 {
-	size_t total_size = lsm_active_cnt * sizeof(*ids);
-	size_t usize;
+	u32 total_size = lsm_active_cnt * sizeof(*ids);
+	u32 usize;
 	int i;
 
 	if (flags)
--- linux-qcom-6.8.0.orig/security/security.c
+++ linux-qcom-6.8.0/security/security.c
@@ -31,6 +31,7 @@
 #include <linux/msg.h>
 #include <linux/overflow.h>
 #include <net/flow.h>
+#include <net/sock.h>
 
 /* How many LSMs were built into the kernel? */
 #define LSM_COUNT (__end_lsm_info - __start_lsm_info)
@@ -226,11 +227,28 @@
 		blob_sizes.lbs_inode = sizeof(struct rcu_head);
 	lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode);
 	lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc);
+#ifdef CONFIG_KEYS
+	lsm_set_blob_size(&needed->lbs_key, &blob_sizes.lbs_key);
+#endif
 	lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
+	lsm_set_blob_size(&needed->lbs_sock, &blob_sizes.lbs_sock);
 	lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
 	lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
 	lsm_set_blob_size(&needed->lbs_xattr_count,
 			  &blob_sizes.lbs_xattr_count);
+	lsm_set_blob_size(&needed->lbs_mnt_opts, &blob_sizes.lbs_mnt_opts);
+	if (needed->lbs_secmark) {
+		if (!blob_sizes.lbs_secmark)
+			blob_sizes.lbs_secmark = true;
+		else
+			needed->lbs_secmark = false;
+	}
+	if (needed->lbs_netlabel) {
+		if (!blob_sizes.lbs_netlabel)
+			blob_sizes.lbs_netlabel = true;
+		else
+			needed->lbs_netlabel = false;
+	}
 }
 
 /* Prepare LSM for initialization. */
@@ -268,8 +286,49 @@
  * Current index to use while initializing the lsm id list.
  */
 u32 lsm_active_cnt __ro_after_init;
+u32 lsm_blob_cnt __ro_after_init;
 const struct lsm_id *lsm_idlist[LSM_CONFIG_COUNT];
 
+/**
+ * lsm_name_to_id - get the LSM ID for a registered LSM
+ * @name: the name of the LSM
+ *
+ * Returns the LSM ID associated with the named LSM or
+ * LSM_ID_UNDEF if the name isn't recongnized.
+ */
+u64 lsm_name_to_id(const char *name)
+{
+	int i;
+
+	for (i = 0; i < LSM_CONFIG_COUNT; i++) {
+		if (!lsm_idlist[i]->name)
+			return LSM_ID_UNDEF;
+		if (!strcmp(name, lsm_idlist[i]->name))
+			return lsm_idlist[i]->id;
+	}
+	return LSM_ID_UNDEF;
+}
+
+/**
+ * lsm_id_to_name - get the LSM name for a registered LSM ID
+ * @id: the ID of the LSM
+ *
+ * Returns the LSM name associated with the LSM ID or
+ * NULL if the ID isn't recongnized.
+ */
+const char *lsm_id_to_name(u64 id)
+{
+	int i;
+
+	for (i = 0; i < LSM_CONFIG_COUNT; i++) {
+		if (!lsm_idlist[i]->name)
+			return NULL;
+		if (id == lsm_idlist[i]->id)
+			return lsm_idlist[i]->name;
+	}
+	return NULL;
+}
+
 /* Populate ordered LSMs list from comma-separated LSM name list. */
 static void __init ordered_lsm_parse(const char *order, const char *origin)
 {
@@ -400,10 +459,15 @@
 	init_debug("file blob size       = %d\n", blob_sizes.lbs_file);
 	init_debug("inode blob size      = %d\n", blob_sizes.lbs_inode);
 	init_debug("ipc blob size        = %d\n", blob_sizes.lbs_ipc);
+#ifdef CONFIG_KEYS
+	init_debug("key blob size        = %d\n", blob_sizes.lbs_key);
+#endif /* CONFIG_KEYS */
 	init_debug("msg_msg blob size    = %d\n", blob_sizes.lbs_msg_msg);
+	init_debug("sock blob size       = %d\n", blob_sizes.lbs_sock);
 	init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
 	init_debug("task blob size       = %d\n", blob_sizes.lbs_task);
 	init_debug("xattr slots          = %d\n", blob_sizes.lbs_xattr_count);
+	init_debug("mnt_opts blob size   = %d\n", blob_sizes.lbs_mnt_opts);
 
 	/*
 	 * Create any kmem_caches needed for blobs
@@ -557,6 +621,8 @@
 		if (lsm_active_cnt >= LSM_CONFIG_COUNT)
 			panic("%s Too many LSMs registered.\n", __func__);
 		lsm_idlist[lsm_active_cnt++] = lsmid;
+		if (lsmid->lsmblob)
+			lsm_blob_cnt++;
 	}
 
 	for (i = 0; i < count; i++) {
@@ -715,6 +781,29 @@
 	return 0;
 }
 
+#ifdef CONFIG_KEYS
+/**
+ * lsm_key_alloc - allocate a composite key blob
+ * @key: the key that needs a blob
+ *
+ * Allocate the key blob for all the modules
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+int lsm_key_alloc(struct key *key)
+{
+	if (blob_sizes.lbs_key == 0) {
+		key->security = NULL;
+		return 0;
+	}
+
+	key->security = kzalloc(blob_sizes.lbs_key, GFP_KERNEL);
+	if (key->security == NULL)
+		return -ENOMEM;
+	return 0;
+}
+#endif /* CONFIG_KEYS */
+
 /**
  * lsm_msg_msg_alloc - allocate a composite msg_msg blob
  * @mp: the msg_msg that needs a blob
@@ -780,12 +869,14 @@
  * @id: LSM id
  * @flags: LSM defined flags
  *
- * Fill all of the fields in a userspace lsm_ctx structure.
+ * Fill all of the fields in a userspace lsm_ctx structure.  If @uctx is NULL
+ * simply calculate the required size to output via @utc_len and return
+ * success.
  *
  * Returns 0 on success, -E2BIG if userspace buffer is not large enough,
  * -EFAULT on a copyout error, -ENOMEM if memory can't be allocated.
  */
-int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, size_t *uctx_len,
+int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
 		      void *val, size_t val_len,
 		      u64 id, u64 flags)
 {
@@ -799,6 +890,10 @@
 		goto out;
 	}
 
+	/* no buffer - return success/0 and set @uctx_len to the req size */
+	if (!uctx)
+		goto out;
+
 	nctx = kzalloc(nctx_len, GFP_KERNEL);
 	if (nctx == NULL) {
 		rc = -ENOMEM;
@@ -884,6 +979,7 @@
 {
 	return call_int_hook(binder_set_context_mgr, 0, mgr);
 }
+EXPORT_SYMBOL(security_binder_set_context_mgr);
 
 /**
  * security_binder_transaction() - Check if a binder transaction is allowed
@@ -899,6 +995,7 @@
 {
 	return call_int_hook(binder_transaction, 0, from, to);
 }
+EXPORT_SYMBOL(security_binder_transaction);
 
 /**
  * security_binder_transfer_binder() - Check if a binder transfer is allowed
@@ -914,6 +1011,7 @@
 {
 	return call_int_hook(binder_transfer_binder, 0, from, to);
 }
+EXPORT_SYMBOL(security_binder_transfer_binder);
 
 /**
  * security_binder_transfer_file() - Check if a binder file xfer is allowed
@@ -930,6 +1028,7 @@
 {
 	return call_int_hook(binder_transfer_file, 0, from, to, file);
 }
+EXPORT_SYMBOL(security_binder_transfer_file);
 
 /**
  * security_ptrace_access_check() - Check if tracing is allowed
@@ -1270,18 +1369,15 @@
 				    struct fs_parameter *param)
 {
 	struct security_hook_list *hp;
-	int trc;
-	int rc = -ENOPARAM;
+	int rc;
 
 	hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param,
 			     list) {
-		trc = hp->hook.fs_context_parse_param(fc, param);
-		if (trc == 0)
-			rc = 0;
-		else if (trc != -ENOPARAM)
-			return trc;
+		rc = hp->hook.fs_context_parse_param(fc, param);
+		if (rc != -ENOPARAM)
+			return rc;
 	}
-	return rc;
+	return -ENOPARAM;
 }
 
 /**
@@ -1333,6 +1429,18 @@
 }
 
 /**
+ * lsm_mnt_opts_alloc - allocate a mnt_opts blob
+ * @priority: memory allocation priority
+ *
+ * Returns a newly allocated mnt_opts blob or NULL if
+ * memory isn't available.
+ */
+void *lsm_mnt_opts_alloc(gfp_t priority)
+{
+	return kzalloc(blob_sizes.lbs_mnt_opts, priority);
+}
+
+/**
  * security_free_mnt_opts() - Free memory associated with mount options
  * @mnt_opts: LSM processed mount options
  *
@@ -1343,6 +1451,7 @@
 	if (!*mnt_opts)
 		return;
 	call_void_hook(sb_free_mnt_opts, *mnt_opts);
+	kfree(*mnt_opts);
 	*mnt_opts = NULL;
 }
 EXPORT_SYMBOL(security_free_mnt_opts);
@@ -1624,8 +1733,7 @@
  * @mode: mode used to determine resource type
  * @name: name of the last path component
  * @xattr_name: name of the security/LSM xattr
- * @ctx: pointer to the resulting LSM context
- * @ctxlen: length of @ctx
+ * @lsmctx: pointer to the resulting LSM context
  *
  * Compute a context for a dentry as the inode is not yet available since NFSv4
  * has no label backed by an EA anyway.  It is important to note that
@@ -1635,8 +1743,8 @@
  */
 int security_dentry_init_security(struct dentry *dentry, int mode,
 				  const struct qstr *name,
-				  const char **xattr_name, void **ctx,
-				  u32 *ctxlen)
+				  const char **xattr_name,
+				  struct lsmcontext *lsmctx)
 {
 	struct security_hook_list *hp;
 	int rc;
@@ -1647,7 +1755,7 @@
 	hlist_for_each_entry(hp, &security_hook_heads.dentry_init_security,
 			     list) {
 		rc = hp->hook.dentry_init_security(dentry, mode, name,
-						   xattr_name, ctx, ctxlen);
+						   xattr_name, lsmctx);
 		if (rc != LSM_RET_DEFAULT(dentry_init_security))
 			return rc;
 	}
@@ -2255,24 +2363,25 @@
 			    struct dentry *dentry, const char *name,
 			    const void *value, size_t size, int flags)
 {
-	int ret;
+	struct security_hook_list *hp;
+	int rc = -ENOSYS;
 
 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
 		return 0;
-	/*
-	 * SELinux and Smack integrate the cap call,
-	 * so assume that all LSMs supplying this call do so.
-	 */
-	ret = call_int_hook(inode_setxattr, 1, idmap, dentry, name, value,
-			    size, flags);
 
-	if (ret == 1)
-		ret = cap_inode_setxattr(dentry, name, value, size, flags);
-	if (ret)
-		return ret;
-	ret = ima_inode_setxattr(dentry, name, value, size);
-	if (ret)
-		return ret;
+	hlist_for_each_entry(hp, &security_hook_heads.inode_setxattr, list) {
+		rc = hp->hook.inode_setxattr(idmap, dentry, name, value, size,
+					     flags);
+		if (rc != -ENOSYS)
+			break;
+	}
+	if (rc == -ENOSYS)
+		rc = cap_inode_setxattr(dentry, name, value, size, flags);
+	if (rc)
+		return rc;
+	rc = ima_inode_setxattr(dentry, name, value, size);
+	if (rc)
+		return rc;
 	return evm_inode_setxattr(idmap, dentry, name, value, size);
 }
 
@@ -2565,16 +2674,15 @@
 EXPORT_SYMBOL(security_inode_listsecurity);
 
 /**
- * security_inode_getsecid() - Get an inode's secid
+ * security_inode_getlsmblob() - Get an inode's LSM data
  * @inode: inode
- * @secid: secid to return
+ * @blob: lsm specific information to return
  *
- * Get the secid associated with the node.  In case of failure, @secid will be
- * set to zero.
+ * Get the lsm specific information associated with the node.
  */
-void security_inode_getsecid(struct inode *inode, u32 *secid)
+void security_inode_getlsmblob(struct inode *inode, struct lsmblob *blob)
 {
-	call_void_hook(inode_getsecid, inode, secid);
+	call_void_hook(inode_getlsmblob, inode, blob);
 }
 
 /**
@@ -3072,17 +3180,39 @@
  * @c: credentials
  * @secid: secid value
  *
- * Retrieve the security identifier of the cred structure @c.  In case of
- * failure, @secid will be set to zero.
+ * Retrieve the first available security identifier of the
+ * cred structure @c.  In case of failure, @secid will be set to zero.
+ * Currently only used by binder.
  */
 void security_cred_getsecid(const struct cred *c, u32 *secid)
 {
+	struct security_hook_list *hp;
+
+	hlist_for_each_entry(hp, &security_hook_heads.cred_getsecid, list) {
+		hp->hook.cred_getsecid(c, secid);
+		return;
+	}
+
 	*secid = 0;
-	call_void_hook(cred_getsecid, c, secid);
 }
 EXPORT_SYMBOL(security_cred_getsecid);
 
 /**
+ * security_cred_getlsmblob() - Get the LSM data from a set of credentials
+ * @c: credentials
+ * @blob: destination for the LSM data
+ *
+ * Retrieve the security data of the cred structure @c.  In case of
+ * failure, @blob will be cleared.
+ */
+void security_cred_getlsmblob(const struct cred *c, struct lsmblob *blob)
+{
+	lsmblob_init(blob);
+	call_void_hook(cred_getlsmblob, c, blob);
+}
+EXPORT_SYMBOL(security_cred_getlsmblob);
+
+/**
  * security_kernel_act_as() - Set the kernel credentials to act as secid
  * @new: credentials
  * @secid: secid
@@ -3327,33 +3457,33 @@
 }
 
 /**
- * security_current_getsecid_subj() - Get the current task's subjective secid
- * @secid: secid value
+ * security_current_getlsmblob_subj() - Current task's subjective LSM data
+ * @blob: lsm specific information
  *
  * Retrieve the subjective security identifier of the current task and return
- * it in @secid.  In case of failure, @secid will be set to zero.
+ * it in @blob.
  */
-void security_current_getsecid_subj(u32 *secid)
+void security_current_getlsmblob_subj(struct lsmblob *blob)
 {
-	*secid = 0;
-	call_void_hook(current_getsecid_subj, secid);
+	lsmblob_init(blob);
+	call_void_hook(current_getlsmblob_subj, blob);
 }
-EXPORT_SYMBOL(security_current_getsecid_subj);
+EXPORT_SYMBOL(security_current_getlsmblob_subj);
 
 /**
- * security_task_getsecid_obj() - Get a task's objective secid
+ * security_task_getlsmblob_obj() - Get a task's objective LSM data
  * @p: target task
- * @secid: secid value
+ * @blob: lsm specific information
  *
  * Retrieve the objective security identifier of the task_struct in @p and
- * return it in @secid. In case of failure, @secid will be set to zero.
+ * return it in @blob.
  */
-void security_task_getsecid_obj(struct task_struct *p, u32 *secid)
+void security_task_getlsmblob_obj(struct task_struct *p, struct lsmblob *blob)
 {
-	*secid = 0;
-	call_void_hook(task_getsecid_obj, p, secid);
+	lsmblob_init(blob);
+	call_void_hook(task_getlsmblob_obj, p, blob);
 }
-EXPORT_SYMBOL(security_task_getsecid_obj);
+EXPORT_SYMBOL(security_task_getlsmblob_obj);
 
 /**
  * security_task_setnice() - Check if setting a task's nice value is allowed
@@ -3565,17 +3695,17 @@
 }
 
 /**
- * security_ipc_getsecid() - Get the sysv ipc object's secid
+ * security_ipc_getlsmblob() - Get the sysv ipc object LSM data
  * @ipcp: ipc permission structure
- * @secid: secid pointer
+ * @blob: pointer to lsm information
  *
- * Get the secid associated with the ipc object.  In case of failure, @secid
- * will be set to zero.
+ * Get the lsm information associated with the ipc object.
  */
-void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
+
+void security_ipc_getlsmblob(struct kern_ipc_perm *ipcp, struct lsmblob *blob)
 {
-	*secid = 0;
-	call_void_hook(ipc_getsecid, ipcp, secid);
+	lsmblob_init(blob);
+	call_void_hook(ipc_getlsmblob, ipcp, blob);
 }
 
 /**
@@ -3918,14 +4048,14 @@
  * If @size is insufficient to contain the data -E2BIG is returned.
  */
 int security_getselfattr(unsigned int attr, struct lsm_ctx __user *uctx,
-			 size_t __user *size, u32 flags)
+			 u32 __user *size, u32 flags)
 {
 	struct security_hook_list *hp;
 	struct lsm_ctx lctx = { .id = LSM_ID_UNDEF, };
 	u8 __user *base = (u8 __user *)uctx;
-	size_t total = 0;
-	size_t entrysize;
-	size_t left;
+	u32 entrysize;
+	u32 total = 0;
+	u32 left;
 	bool toobig = false;
 	bool single = false;
 	int count = 0;
@@ -4011,7 +4141,7 @@
  * LSM specific failure.
  */
 int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx,
-			 size_t size, u32 flags)
+			 u32 size, u32 flags)
 {
 	struct security_hook_list *hp;
 	struct lsm_ctx *lctx;
@@ -4063,11 +4193,10 @@
 {
 	struct security_hook_list *hp;
 
-	hlist_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
-		if (lsmid != 0 && lsmid != hp->lsmid->id)
-			continue;
-		return hp->hook.getprocattr(p, name, value);
-	}
+	hlist_for_each_entry(hp, &security_hook_heads.getprocattr, list)
+		if (lsmid == LSM_ID_UNDEF || lsmid == hp->lsmid->id)
+			return hp->hook.getprocattr(p, name, value);
+
 	return LSM_RET_DEFAULT(getprocattr);
 }
 
@@ -4130,17 +4259,16 @@
 /**
  * security_secid_to_secctx() - Convert a secid to a secctx
  * @secid: secid
- * @secdata: secctx
- * @seclen: secctx length
+ * @cp: the LSM context
  *
- * Convert secid to security context.  If @secdata is NULL the length of the
- * result will be returned in @seclen, but no @secdata will be returned.  This
+ * Convert secid to security context.  If @cp is NULL the length of the
+ * result will be returned, but no data will be returned.  This
  * does mean that the length could change between calls to check the length and
- * the next call which actually allocates and returns the @secdata.
+ * the next call which actually allocates and returns the data.
  *
- * Return: Return 0 on success, error on failure.
+ * Return: Return length of data on success, error on failure.
  */
-int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+int security_secid_to_secctx(u32 secid, struct lsmcontext *cp)
 {
 	struct security_hook_list *hp;
 	int rc;
@@ -4150,7 +4278,7 @@
 	 * LSM hook is not "stackable").
 	 */
 	hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, list) {
-		rc = hp->hook.secid_to_secctx(secid, secdata, seclen);
+		rc = hp->hook.secid_to_secctx(secid, cp);
 		if (rc != LSM_RET_DEFAULT(secid_to_secctx))
 			return rc;
 	}
@@ -4160,6 +4288,35 @@
 EXPORT_SYMBOL(security_secid_to_secctx);
 
 /**
+ * security_lsmblob_to_secctx() - Convert a lsmblob to a secctx
+ * @blob: lsm specific information
+ * @cp: the LSM context
+ * @lsmid: which security module to report
+ *
+ * Convert a @blob entry to security context. If @cp is NULL the
+ * length of the result will be returned, but no data will be returned.
+ * This does mean that the length could change between calls to check
+ * the length and the next call which actually allocates and returns
+ * the data.
+ *
+ * Return: Return length of data on success, error on failure.
+ */
+int security_lsmblob_to_secctx(struct lsmblob *blob, struct lsmcontext *cp,
+			       int lsmid)
+{
+	struct security_hook_list *hp;
+
+	hlist_for_each_entry(hp, &security_hook_heads.lsmblob_to_secctx, list) {
+		if (lsmid != hp->lsmid->id && lsmid != LSM_ID_UNDEF)
+			continue;
+		return hp->hook.lsmblob_to_secctx(blob, cp);
+	}
+
+	return LSM_RET_DEFAULT(lsmblob_to_secctx);
+}
+EXPORT_SYMBOL(security_lsmblob_to_secctx);
+
+/**
  * security_secctx_to_secid() - Convert a secctx to a secid
  * @secdata: secctx
  * @seclen: length of secctx
@@ -4171,21 +4328,26 @@
  */
 int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
 {
+	struct security_hook_list *hp;
+
 	*secid = 0;
-	return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);
+	hlist_for_each_entry(hp, &security_hook_heads.secctx_to_secid, list)
+		return hp->hook.secctx_to_secid(secdata, seclen, secid);
+
+	return LSM_RET_DEFAULT(secctx_to_secid);
 }
 EXPORT_SYMBOL(security_secctx_to_secid);
 
 /**
  * security_release_secctx() - Free a secctx buffer
- * @secdata: secctx
- * @seclen: length of secctx
+ * @cp: the security context
  *
  * Release the security context.
  */
-void security_release_secctx(char *secdata, u32 seclen)
+void security_release_secctx(struct lsmcontext *cp)
 {
-	call_void_hook(release_secctx, secdata, seclen);
+	call_void_hook(release_secctx, cp);
+	memset(cp, 0, sizeof(*cp));
 }
 EXPORT_SYMBOL(security_release_secctx);
 
@@ -4248,24 +4410,24 @@
 /**
  * security_inode_getsecctx() - Get the security label of an inode
  * @inode: inode
- * @ctx: secctx
- * @ctxlen: length of secctx
+ * @cp: security context
  *
- * On success, returns 0 and fills out @ctx and @ctxlen with the security
- * context for the given @inode.
+ * On success, returns 0 and fills out @cp with the security context
+ * for the given @inode.
  *
  * Return: Returns 0 on success, error on failure.
  */
-int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
+int security_inode_getsecctx(struct inode *inode, struct lsmcontext *cp)
 {
 	struct security_hook_list *hp;
 	int rc;
 
+	memset(cp, 0, sizeof(*cp));
 	/*
 	 * Only one module will provide a security context.
 	 */
 	hlist_for_each_entry(hp, &security_hook_heads.inode_getsecctx, list) {
-		rc = hp->hook.inode_getsecctx(inode, ctx, ctxlen);
+		rc = hp->hook.inode_getsecctx(inode, cp);
 		if (rc != LSM_RET_DEFAULT(inode_getsecctx))
 			return rc;
 	}
@@ -4677,6 +4839,28 @@
 EXPORT_SYMBOL(security_socket_getpeersec_dgram);
 
 /**
+ * lsm_sock_alloc - allocate a composite sock blob
+ * @sock: the sock that needs a blob
+ * @priority: allocation mode
+ *
+ * Allocate the sock blob for all the modules
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+static int lsm_sock_alloc(struct sock *sock, gfp_t priority)
+{
+	if (blob_sizes.lbs_sock == 0) {
+		sock->sk_security = NULL;
+		return 0;
+	}
+
+	sock->sk_security = kzalloc(blob_sizes.lbs_sock, priority);
+	if (sock->sk_security == NULL)
+		return -ENOMEM;
+	return 0;
+}
+
+/**
  * security_sk_alloc() - Allocate and initialize a sock's LSM blob
  * @sk: sock
  * @family: protocol family
@@ -4689,7 +4873,14 @@
  */
 int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
 {
-	return call_int_hook(sk_alloc_security, 0, sk, family, priority);
+	int rc = lsm_sock_alloc(sk, priority);
+
+	if (unlikely(rc))
+		return rc;
+	rc = call_int_hook(sk_alloc_security, 0, sk, family, priority);
+	if (unlikely(rc))
+		security_sk_free(sk);
+	return rc;
 }
 
 /**
@@ -4701,6 +4892,8 @@
 void security_sk_free(struct sock *sk)
 {
 	call_void_hook(sk_free_security, sk);
+	kfree(sk->sk_security);
+	sk->sk_security = NULL;
 }
 
 /**
@@ -5287,7 +5480,14 @@
 int security_key_alloc(struct key *key, const struct cred *cred,
 		       unsigned long flags)
 {
-	return call_int_hook(key_alloc, 0, key, cred, flags);
+	int rc = lsm_key_alloc(key);
+
+	if (unlikely(rc))
+		return rc;
+	rc = call_int_hook(key_alloc, 0, key, cred, flags);
+	if (unlikely(rc))
+		security_key_free(key);
+	return rc;
 }
 
 /**
@@ -5298,7 +5498,8 @@
  */
 void security_key_free(struct key *key)
 {
-	call_void_hook(key_free, key);
+	kfree(key->security);
+	key->security = NULL;
 }
 
 /**
@@ -5344,15 +5545,18 @@
  * @op: rule operator
  * @rulestr: rule context
  * @lsmrule: receive buffer for audit rule struct
+ * @gfp: GFP flag used for kmalloc
  *
  * Allocate and initialize an LSM audit rule structure.
  *
  * Return: Return 0 if @lsmrule has been successfully set, -EINVAL in case of
  *         an invalid rule.
  */
-int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
+int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule,
+			     gfp_t gfp)
 {
-	return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
+	return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule,
+			     LSM_ID_UNDEF, gfp);
 }
 
 /**
@@ -5378,12 +5582,12 @@
  */
 void security_audit_rule_free(void *lsmrule)
 {
-	call_void_hook(audit_rule_free, lsmrule);
+	call_void_hook(audit_rule_free, lsmrule, LSM_ID_UNDEF);
 }
 
 /**
  * security_audit_rule_match() - Check if a label matches an audit rule
- * @secid: security label
+ * @lsmblob: security label
  * @field: LSM audit field
  * @op: matching operator
  * @lsmrule: audit rule
@@ -5394,12 +5598,38 @@
  * Return: Returns 1 if secid matches the rule, 0 if it does not, -ERRNO on
  *         failure.
  */
-int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
+int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op, void *lsmrule)
 {
-	return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule);
+	return call_int_hook(audit_rule_match, 0, blob, field, op, lsmrule,
+			     LSM_ID_UNDEF);
 }
 #endif /* CONFIG_AUDIT */
 
+#ifdef CONFIG_IMA_LSM_RULES
+/*
+ * The integrity subsystem uses the same hooks as
+ * the audit subsystem.
+ */
+int ima_filter_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule,
+			 int lsmid, gfp_t gfp)
+{
+	return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule,
+			     lsmid, gfp);
+}
+
+void ima_filter_rule_free(void *lsmrule, int lsmid)
+{
+	call_void_hook(audit_rule_free, lsmrule, lsmid);
+}
+
+int ima_filter_rule_match(struct lsmblob *blob, u32 field, u32 op,
+			  void *lsmrule, int lsmid)
+{
+	return call_int_hook(audit_rule_match, 0, blob, field, op, lsmrule,
+			     lsmid);
+}
+#endif /* CONFIG_IMA_LSM_RULES */
+
 #ifdef CONFIG_BPF_SYSCALL
 /**
  * security_bpf() - Check if the bpf syscall operation is allowed
@@ -5511,6 +5741,12 @@
 }
 EXPORT_SYMBOL(security_locked_down);
 
+int security_lock_kernel_down(const char *where, enum lockdown_reason level)
+{
+	return call_int_hook(lock_kernel_down, 0, where, level);
+}
+EXPORT_SYMBOL(security_lock_kernel_down);
+
 #ifdef CONFIG_PERF_EVENTS
 /**
  * security_perf_event_open() - Check if a perf event open is allowed
--- linux-qcom-6.8.0.orig/security/selinux/avc.c
+++ linux-qcom-6.8.0/security/selinux/avc.c
@@ -330,12 +330,12 @@
 {
 	struct avc_xperms_decision_node *dest_xpd;
 
-	node->ae.xp_node->xp.len++;
 	dest_xpd = avc_xperms_decision_alloc(src->used);
 	if (!dest_xpd)
 		return -ENOMEM;
 	avc_copy_xperms_decision(&dest_xpd->xpd, src);
 	list_add(&dest_xpd->xpd_list, &node->ae.xp_node->xpd_head);
+	node->ae.xp_node->xp.len++;
 	return 0;
 }
 
@@ -907,7 +907,11 @@
 		node->ae.avd.auditdeny &= ~perms;
 		break;
 	case AVC_CALLBACK_ADD_XPERMS:
-		avc_add_xperms_decision(node, xpd);
+		rc = avc_add_xperms_decision(node, xpd);
+		if (rc) {
+			avc_node_kill(node);
+			goto out_unlock;
+		}
 		break;
 	}
 	avc_node_replace(node, orig);
--- linux-qcom-6.8.0.orig/security/selinux/hooks.c
+++ linux-qcom-6.8.0/security/selinux/hooks.c
@@ -165,7 +165,8 @@
  */
 static int selinux_secmark_enabled(void)
 {
-	return (selinux_policycap_alwaysnetwork() ||
+	return selinux_blob_sizes.lbs_secmark &&
+	       (selinux_policycap_alwaysnetwork() ||
 		atomic_read(&selinux_secmark_refcount));
 }
 
@@ -182,7 +183,7 @@
 static int selinux_peerlbl_enabled(void)
 {
 	return (selinux_policycap_alwaysnetwork() ||
-		netlbl_enabled() || selinux_xfrm_enabled());
+		selinux_netlbl_enabled() || selinux_xfrm_enabled());
 }
 
 static int selinux_netcache_avc_callback(u32 event)
@@ -365,15 +366,28 @@
 }
 
 struct selinux_mnt_opts {
+	bool initialized;
 	u32 fscontext_sid;
 	u32 context_sid;
 	u32 rootcontext_sid;
 	u32 defcontext_sid;
 };
 
+static inline struct selinux_mnt_opts *selinux_mnt_opts(void *mnt_opts)
+{
+	if (mnt_opts)
+		return mnt_opts + selinux_blob_sizes.lbs_mnt_opts;
+	return NULL;
+}
+
 static void selinux_free_mnt_opts(void *mnt_opts)
 {
-	kfree(mnt_opts);
+	struct selinux_mnt_opts *opts;
+
+	if (mnt_opts) {
+		opts = selinux_mnt_opts(mnt_opts);
+		opts->initialized = false;
+	}
 }
 
 enum {
@@ -628,7 +642,7 @@
 	const struct cred *cred = current_cred();
 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 	struct dentry *root = sb->s_root;
-	struct selinux_mnt_opts *opts = mnt_opts;
+	struct selinux_mnt_opts *opts = selinux_mnt_opts(mnt_opts);
 	struct inode_security_struct *root_isec;
 	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 	u32 defcontext_sid = 0;
@@ -644,7 +658,7 @@
 	mutex_lock(&sbsec->lock);
 
 	if (!selinux_initialized()) {
-		if (!opts) {
+		if (!opts || !opts->initialized) {
 			/* Defer initialization until selinux_complete_init,
 			   after the initial policy is loaded and the security
 			   server is ready to handle calls. */
@@ -682,7 +696,7 @@
 	 * also check if someone is trying to mount the same sb more
 	 * than once with different security options.
 	 */
-	if (opts) {
+	if (opts && opts->initialized) {
 		if (opts->fscontext_sid) {
 			fscontext_sid = opts->fscontext_sid;
 			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
@@ -991,7 +1005,7 @@
  */
 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 {
-	struct selinux_mnt_opts *opts = *mnt_opts;
+	struct selinux_mnt_opts *opts;
 	u32 *dst_sid;
 	int rc;
 
@@ -1006,12 +1020,12 @@
 		return -EINVAL;
 	}
 
-	if (!opts) {
-		opts = kzalloc(sizeof(*opts), GFP_KERNEL);
-		if (!opts)
+	if (!*mnt_opts) {
+		*mnt_opts = lsm_mnt_opts_alloc(GFP_KERNEL);
+		if (!*mnt_opts)
 			return -ENOMEM;
-		*mnt_opts = opts;
 	}
+	opts = selinux_mnt_opts(*mnt_opts);
 
 	switch (token) {
 	case Opt_context:
@@ -1038,6 +1052,7 @@
 		WARN_ON(1);
 		return -EINVAL;
 	}
+	opts->initialized = true;
 	rc = security_context_str_to_sid(s, dst_sid, GFP_KERNEL);
 	if (rc)
 		pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n",
@@ -2640,10 +2655,7 @@
 	return 0;
 
 free_opt:
-	if (*mnt_opts) {
-		selinux_free_mnt_opts(*mnt_opts);
-		*mnt_opts = NULL;
-	}
+	selinux_free_mnt_opts(*mnt_opts);
 	return rc;
 }
 
@@ -2694,13 +2706,13 @@
 
 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
 {
-	struct selinux_mnt_opts *opts = mnt_opts;
+	struct selinux_mnt_opts *opts = selinux_mnt_opts(mnt_opts);
 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 
 	if (!(sbsec->flags & SE_SBINITIALIZED))
 		return 0;
 
-	if (!opts)
+	if (!opts || !opts->initialized)
 		return 0;
 
 	if (opts->fscontext_sid) {
@@ -2798,9 +2810,13 @@
 	if (!(sbsec->flags & (FSCONTEXT_MNT|CONTEXT_MNT|DEFCONTEXT_MNT)))
 		return 0;
 
-	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
-	if (!opts)
-		return -ENOMEM;
+	if (!fc->security) {
+		fc->security = lsm_mnt_opts_alloc(GFP_KERNEL);
+		if (!fc->security)
+			return -ENOMEM;
+	}
+	opts = selinux_mnt_opts(fc->security);
+	opts->initialized = true;
 
 	if (sbsec->flags & FSCONTEXT_MNT)
 		opts->fscontext_sid = sbsec->sid;
@@ -2808,20 +2824,25 @@
 		opts->context_sid = sbsec->mntpoint_sid;
 	if (sbsec->flags & DEFCONTEXT_MNT)
 		opts->defcontext_sid = sbsec->def_sid;
-	fc->security = opts;
 	return 0;
 }
 
 static int selinux_fs_context_dup(struct fs_context *fc,
 				  struct fs_context *src_fc)
 {
-	const struct selinux_mnt_opts *src = src_fc->security;
+	const struct selinux_mnt_opts *src = selinux_mnt_opts(src_fc->security);
+	struct selinux_mnt_opts *dst;
 
 	if (!src)
 		return 0;
 
-	fc->security = kmemdup(src, sizeof(*src), GFP_KERNEL);
-	return fc->security ? 0 : -ENOMEM;
+	fc->security = lsm_mnt_opts_alloc(GFP_KERNEL);
+	if (!fc->security)
+		return -ENOMEM;
+
+	dst = selinux_mnt_opts(fc->security);
+	memcpy(dst, src, sizeof(*src));
+	return 0;
 }
 
 static const struct fs_parameter_spec selinux_fs_parameters[] = {
@@ -2871,8 +2892,8 @@
 
 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
 					const struct qstr *name,
-					const char **xattr_name, void **ctx,
-					u32 *ctxlen)
+					const char **xattr_name,
+					struct lsmcontext *cp)
 {
 	u32 newsid;
 	int rc;
@@ -2887,8 +2908,9 @@
 	if (xattr_name)
 		*xattr_name = XATTR_NAME_SELINUX;
 
-	return security_sid_to_context(newsid, (char **)ctx,
-				       ctxlen);
+	cp->id = LSM_ID_SELINUX;
+	return security_sid_to_context(newsid, (char **)cp->context,
+				       &cp->len);
 }
 
 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
@@ -3193,13 +3215,10 @@
 	int rc = 0;
 
 	if (strcmp(name, XATTR_NAME_SELINUX)) {
-		rc = cap_inode_setxattr(dentry, name, value, size, flags);
-		if (rc)
-			return rc;
-
 		/* Not an attribute we recognize, so just check the
 		   ordinary setattr permission. */
-		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+		rc = dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+		return rc ? rc : -ENOSYS;
 	}
 
 	if (!selinux_initialized())
@@ -3349,15 +3368,9 @@
 static int selinux_inode_removexattr(struct mnt_idmap *idmap,
 				     struct dentry *dentry, const char *name)
 {
-	if (strcmp(name, XATTR_NAME_SELINUX)) {
-		int rc = cap_inode_removexattr(idmap, dentry, name);
-		if (rc)
-			return rc;
-
-		/* Not an attribute we recognize, so just check the
-		   ordinary setattr permission. */
+	/* if not a selinux xattr, only check the ordinary setattr perm */
+	if (strcmp(name, XATTR_NAME_SELINUX))
 		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
-	}
 
 	if (!selinux_initialized())
 		return 0;
@@ -3504,15 +3517,16 @@
 	return len;
 }
 
-static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
+static void selinux_inode_getlsmblob(struct inode *inode, struct lsmblob *blob)
 {
 	struct inode_security_struct *isec = inode_security_novalidate(inode);
-	*secid = isec->sid;
+
+	blob->selinux.secid = isec->sid;
 }
 
 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
 {
-	u32 sid;
+	struct lsmblob blob;
 	struct task_security_struct *tsec;
 	struct cred *new_creds = *new;
 
@@ -3524,8 +3538,8 @@
 
 	tsec = selinux_cred(new_creds);
 	/* Get label from overlay inode and set it in create_sid */
-	selinux_inode_getsecid(d_inode(src), &sid);
-	tsec->create_sid = sid;
+	selinux_inode_getlsmblob(d_inode(src), &blob);
+	tsec->create_sid = blob.selinux.secid;
 	*new = new_creds;
 	return 0;
 }
@@ -3850,7 +3864,17 @@
 	if (default_noexec &&
 	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
 		int rc = 0;
-		if (vma_is_initial_heap(vma)) {
+		/*
+		 * We don't use the vma_is_initial_heap() helper as it has
+		 * a history of problems and is currently broken on systems
+		 * where there is no heap, e.g. brk == start_brk.  Before
+		 * replacing the conditional below with vma_is_initial_heap(),
+		 * or something similar, please ensure that the logic is the
+		 * same as what we have below or you have tested every possible
+		 * corner case you can think to test.
+		 */
+		if (vma->vm_start >= vma->vm_mm->start_brk &&
+		    vma->vm_end <= vma->vm_mm->brk) {
 			rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
 					  PROCESS__EXECHEAP, NULL);
 		} else if (!vma->vm_file && (vma_is_initial_stack(vma) ||
@@ -4024,6 +4048,11 @@
 	*secid = cred_sid(c);
 }
 
+static void selinux_cred_getlsmblob(const struct cred *c, struct lsmblob *blob)
+{
+	blob->selinux.secid = cred_sid(c);
+}
+
 /*
  * set the security data for a kernel service
  * - all the creation contexts are set to unlabelled
@@ -4159,14 +4188,15 @@
 			    PROCESS__GETSESSION, NULL);
 }
 
-static void selinux_current_getsecid_subj(u32 *secid)
+static void selinux_current_getlsmblob_subj(struct lsmblob *blob)
 {
-	*secid = current_sid();
+	blob->selinux.secid = current_sid();
 }
 
-static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
+static void selinux_task_getlsmblob_obj(struct task_struct *p,
+					struct lsmblob *blob)
 {
-	*secid = task_sid_obj(p);
+	blob->selinux.secid = task_sid_obj(p);
 }
 
 static int selinux_task_setnice(struct task_struct *p, int nice)
@@ -4582,7 +4612,7 @@
 
 static int sock_has_perm(struct sock *sk, u32 perms)
 {
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	struct common_audit_data ad;
 	struct lsm_network_audit net;
 
@@ -4650,7 +4680,7 @@
 	isec->initialized = LABEL_INITIALIZED;
 
 	if (sock->sk) {
-		sksec = sock->sk->sk_security;
+		sksec = selinux_sock(sock->sk);
 		sksec->sclass = sclass;
 		sksec->sid = sid;
 		/* Allows detection of the first association on this socket */
@@ -4666,8 +4696,8 @@
 static int selinux_socket_socketpair(struct socket *socka,
 				     struct socket *sockb)
 {
-	struct sk_security_struct *sksec_a = socka->sk->sk_security;
-	struct sk_security_struct *sksec_b = sockb->sk->sk_security;
+	struct sk_security_struct *sksec_a = selinux_sock(socka->sk);
+	struct sk_security_struct *sksec_b = selinux_sock(sockb->sk);
 
 	sksec_a->peer_sid = sksec_b->sid;
 	sksec_b->peer_sid = sksec_a->sid;
@@ -4682,7 +4712,7 @@
 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
 {
 	struct sock *sk = sock->sk;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	u16 family;
 	int err;
 
@@ -4822,7 +4852,7 @@
 					 struct sockaddr *address, int addrlen)
 {
 	struct sock *sk = sock->sk;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	int err;
 
 	err = sock_has_perm(sk, SOCKET__CONNECT);
@@ -5000,9 +5030,9 @@
 					      struct sock *other,
 					      struct sock *newsk)
 {
-	struct sk_security_struct *sksec_sock = sock->sk_security;
-	struct sk_security_struct *sksec_other = other->sk_security;
-	struct sk_security_struct *sksec_new = newsk->sk_security;
+	struct sk_security_struct *sksec_sock = selinux_sock(sock);
+	struct sk_security_struct *sksec_other = selinux_sock(other);
+	struct sk_security_struct *sksec_new = selinux_sock(newsk);
 	struct common_audit_data ad;
 	struct lsm_network_audit net;
 	int err;
@@ -5031,8 +5061,8 @@
 static int selinux_socket_unix_may_send(struct socket *sock,
 					struct socket *other)
 {
-	struct sk_security_struct *ssec = sock->sk->sk_security;
-	struct sk_security_struct *osec = other->sk->sk_security;
+	struct sk_security_struct *ssec = selinux_sock(sock->sk);
+	struct sk_security_struct *osec = selinux_sock(other->sk);
 	struct common_audit_data ad;
 	struct lsm_network_audit net;
 
@@ -5069,7 +5099,7 @@
 				       u16 family)
 {
 	int err = 0;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	u32 sk_sid = sksec->sid;
 	struct common_audit_data ad;
 	struct lsm_network_audit net;
@@ -5098,7 +5128,7 @@
 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
 	int err, peerlbl_active, secmark_active;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	u16 family = sk->sk_family;
 	u32 sk_sid = sksec->sid;
 	struct common_audit_data ad;
@@ -5166,7 +5196,7 @@
 	int err = 0;
 	char *scontext = NULL;
 	u32 scontext_len;
-	struct sk_security_struct *sksec = sock->sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sock->sk);
 	u32 peer_sid = SECSID_NULL;
 
 	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
@@ -5224,34 +5254,27 @@
 
 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 {
-	struct sk_security_struct *sksec;
-
-	sksec = kzalloc(sizeof(*sksec), priority);
-	if (!sksec)
-		return -ENOMEM;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 
 	sksec->peer_sid = SECINITSID_UNLABELED;
 	sksec->sid = SECINITSID_UNLABELED;
 	sksec->sclass = SECCLASS_SOCKET;
 	selinux_netlbl_sk_security_reset(sksec);
-	sk->sk_security = sksec;
 
 	return 0;
 }
 
 static void selinux_sk_free_security(struct sock *sk)
 {
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 
-	sk->sk_security = NULL;
 	selinux_netlbl_sk_security_free(sksec);
-	kfree(sksec);
 }
 
 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
 {
-	struct sk_security_struct *sksec = sk->sk_security;
-	struct sk_security_struct *newsksec = newsk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
+	struct sk_security_struct *newsksec = selinux_sock(newsk);
 
 	newsksec->sid = sksec->sid;
 	newsksec->peer_sid = sksec->peer_sid;
@@ -5265,7 +5288,7 @@
 	if (!sk)
 		*secid = SECINITSID_ANY_SOCKET;
 	else {
-		const struct sk_security_struct *sksec = sk->sk_security;
+		const struct sk_security_struct *sksec = selinux_sock(sk);
 
 		*secid = sksec->sid;
 	}
@@ -5275,7 +5298,7 @@
 {
 	struct inode_security_struct *isec =
 		inode_security_novalidate(SOCK_INODE(parent));
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 
 	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
 	    sk->sk_family == PF_UNIX)
@@ -5292,7 +5315,7 @@
 {
 	struct sock *sk = asoc->base.sk;
 	u16 family = sk->sk_family;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	struct common_audit_data ad;
 	struct lsm_network_audit net;
 	int err;
@@ -5347,7 +5370,7 @@
 static int selinux_sctp_assoc_request(struct sctp_association *asoc,
 				      struct sk_buff *skb)
 {
-	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(asoc->base.sk);
 	u32 conn_sid;
 	int err;
 
@@ -5380,7 +5403,7 @@
 static int selinux_sctp_assoc_established(struct sctp_association *asoc,
 					  struct sk_buff *skb)
 {
-	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(asoc->base.sk);
 
 	if (!selinux_policycap_extsockclass())
 		return 0;
@@ -5479,8 +5502,8 @@
 static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
 				  struct sock *newsk)
 {
-	struct sk_security_struct *sksec = sk->sk_security;
-	struct sk_security_struct *newsksec = newsk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
+	struct sk_security_struct *newsksec = selinux_sock(newsk);
 
 	/* If policy does not support SECCLASS_SCTP_SOCKET then call
 	 * the non-sctp clone version.
@@ -5512,7 +5535,7 @@
 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
 				     struct request_sock *req)
 {
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	int err;
 	u16 family = req->rsk_ops->family;
 	u32 connsid;
@@ -5533,7 +5556,7 @@
 static void selinux_inet_csk_clone(struct sock *newsk,
 				   const struct request_sock *req)
 {
-	struct sk_security_struct *newsksec = newsk->sk_security;
+	struct sk_security_struct *newsksec = selinux_sock(newsk);
 
 	newsksec->sid = req->secid;
 	newsksec->peer_sid = req->peer_secid;
@@ -5550,7 +5573,7 @@
 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
 {
 	u16 family = sk->sk_family;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 
 	/* handle mapped IPv4 packets arriving via IPv6 sockets */
 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
@@ -5631,7 +5654,7 @@
 static int selinux_tun_dev_attach(struct sock *sk, void *security)
 {
 	struct tun_security_struct *tunsec = security;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 
 	/* we don't currently perform any NetLabel based labeling here and it
 	 * isn't clear that we would want to do so anyway; while we could apply
@@ -5711,7 +5734,7 @@
 				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
 			return NF_DROP;
 
-	if (netlbl_enabled())
+	if (selinux_netlbl_enabled())
 		/* we do this in the FORWARD path and not the POST_ROUTING
 		 * path because we want to make sure we apply the necessary
 		 * labeling before IPsec is applied so we can leverage AH
@@ -5728,7 +5751,7 @@
 	struct sock *sk;
 	u32 sid;
 
-	if (!netlbl_enabled())
+	if (!selinux_netlbl_enabled())
 		return NF_ACCEPT;
 
 	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
@@ -5754,7 +5777,7 @@
 			return NF_ACCEPT;
 
 		/* standard practice, label using the parent socket */
-		sksec = sk->sk_security;
+		sksec = selinux_sock(sk);
 		sid = sksec->sid;
 	} else
 		sid = SECINITSID_KERNEL;
@@ -5777,7 +5800,7 @@
 	sk = skb_to_full_sk(skb);
 	if (sk == NULL)
 		return NF_ACCEPT;
-	sksec = sk->sk_security;
+	sksec = selinux_sock(sk);
 
 	ad_net_init_from_iif(&ad, &net, state->out->ifindex, state->pf);
 	if (selinux_parse_skb(skb, &ad, NULL, 0, &proto))
@@ -5866,7 +5889,7 @@
 		u32 skb_sid;
 		struct sk_security_struct *sksec;
 
-		sksec = sk->sk_security;
+		sksec = selinux_sock(sk);
 		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
 			return NF_DROP;
 		/* At this point, if the returned skb peerlbl is SECSID_NULL
@@ -5895,7 +5918,7 @@
 	} else {
 		/* Locally generated packet, fetch the security label from the
 		 * associated socket. */
-		struct sk_security_struct *sksec = sk->sk_security;
+		struct sk_security_struct *sksec = selinux_sock(sk);
 		peer_sid = sksec->sid;
 		secmark_perm = PACKET__SEND;
 	}
@@ -5938,7 +5961,7 @@
 	unsigned int data_len = skb->len;
 	unsigned char *data = skb->data;
 	struct nlmsghdr *nlh;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	u16 sclass = sksec->sclass;
 	u32 perm;
 
@@ -6330,10 +6353,11 @@
 	return ipc_has_perm(ipcp, av);
 }
 
-static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
+static void selinux_ipc_getlsmblob(struct kern_ipc_perm *ipcp,
+				   struct lsmblob *blob)
 {
 	struct ipc_security_struct *isec = selinux_ipc(ipcp);
-	*secid = isec->sid;
+	blob->selinux.secid = isec->sid;
 }
 
 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
@@ -6556,7 +6580,7 @@
  * There will only ever be one attribute.
  */
 static int selinux_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
-			       size_t *size, u32 flags)
+			       u32 *size, u32 flags)
 {
 	int rc;
 	char *val = NULL;
@@ -6571,7 +6595,7 @@
 }
 
 static int selinux_setselfattr(unsigned int attr, struct lsm_ctx *ctx,
-			       size_t size, u32 flags)
+			       u32 size, u32 flags)
 {
 	int rc;
 
@@ -6610,10 +6634,42 @@
 	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
 }
 
-static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+static int selinux_secid_to_secctx(u32 secid, struct lsmcontext *cp)
+{
+	u32 seclen;
+	u32 ret;
+
+	if (cp) {
+		cp->id = LSM_ID_SELINUX;
+		ret = security_sid_to_context(secid, &cp->context, &cp->len);
+		if (ret < 0)
+			return ret;
+		return cp->len;
+	}
+	ret = security_sid_to_context(secid, NULL, &seclen);
+	if (ret < 0)
+		return ret;
+	return seclen;
+}
+
+static int selinux_lsmblob_to_secctx(struct lsmblob *blob,
+				     struct lsmcontext *cp)
 {
-	return security_sid_to_context(secid,
-				       secdata, seclen);
+	u32 secid = blob->selinux.secid;
+	u32 seclen;
+	u32 ret;
+
+	if (cp) {
+		cp->id = LSM_ID_SELINUX;
+		ret = security_sid_to_context(secid, &cp->context, &cp->len);
+		if (ret < 0)
+			return ret;
+		return cp->len;
+	}
+	ret = security_sid_to_context(secid, NULL, &seclen);
+	if (ret < 0)
+		return ret;
+	return seclen;
 }
 
 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
@@ -6622,9 +6678,10 @@
 				       secid, GFP_KERNEL);
 }
 
-static void selinux_release_secctx(char *secdata, u32 seclen)
+static void selinux_release_secctx(struct lsmcontext *cp)
 {
-	kfree(secdata);
+	if (cp->id == LSM_ID_SELINUX)
+		kfree(cp->context);
 }
 
 static void selinux_inode_invalidate_secctx(struct inode *inode)
@@ -6652,18 +6709,20 @@
  */
 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
 {
-	return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX,
-				     ctx, ctxlen, 0);
+	return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX,
+				     ctx, ctxlen, 0, NULL);
 }
 
-static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
+static int selinux_inode_getsecctx(struct inode *inode, struct lsmcontext *cp)
 {
-	int len = 0;
+	int len;
 	len = selinux_inode_getsecurity(&nop_mnt_idmap, inode,
-					XATTR_SELINUX_SUFFIX, ctx, true);
+					XATTR_SELINUX_SUFFIX,
+					(void **)&cp->context, true);
 	if (len < 0)
 		return len;
-	*ctxlen = len;
+	cp->len = len;
+	cp->id = LSM_ID_SELINUX;
 	return 0;
 }
 #ifdef CONFIG_KEYS
@@ -6672,11 +6731,7 @@
 			     unsigned long flags)
 {
 	const struct task_security_struct *tsec;
-	struct key_security_struct *ksec;
-
-	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
-	if (!ksec)
-		return -ENOMEM;
+	struct key_security_struct *ksec = selinux_key(k);
 
 	tsec = selinux_cred(cred);
 	if (tsec->keycreate_sid)
@@ -6684,18 +6739,9 @@
 	else
 		ksec->sid = tsec->sid;
 
-	k->security = ksec;
 	return 0;
 }
 
-static void selinux_key_free(struct key *k)
-{
-	struct key_security_struct *ksec = k->security;
-
-	k->security = NULL;
-	kfree(ksec);
-}
-
 static int selinux_key_permission(key_ref_t key_ref,
 				  const struct cred *cred,
 				  enum key_need_perm need_perm)
@@ -6736,14 +6782,14 @@
 
 	sid = cred_sid(cred);
 	key = key_ref_to_ptr(key_ref);
-	ksec = key->security;
+	ksec = selinux_key(key);
 
 	return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
 }
 
 static int selinux_key_getsecurity(struct key *key, char **_buffer)
 {
-	struct key_security_struct *ksec = key->security;
+	struct key_security_struct *ksec = selinux_key(key);
 	char *context = NULL;
 	unsigned len;
 	int rc;
@@ -6970,9 +7016,16 @@
 	.lbs_file = sizeof(struct file_security_struct),
 	.lbs_inode = sizeof(struct inode_security_struct),
 	.lbs_ipc = sizeof(struct ipc_security_struct),
+#ifdef CONFIG_KEYS
+	.lbs_key = sizeof(struct key_security_struct),
+#endif /* CONFIG_KEYS */
 	.lbs_msg_msg = sizeof(struct msg_security_struct),
+	.lbs_sock = sizeof(struct sk_security_struct),
 	.lbs_superblock = sizeof(struct superblock_security_struct),
 	.lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
+	.lbs_mnt_opts = sizeof(struct selinux_mnt_opts),
+	.lbs_secmark = true,
+	.lbs_netlabel = true,
 };
 
 #ifdef CONFIG_PERF_EVENTS
@@ -7090,6 +7143,7 @@
 static const struct lsm_id selinux_lsmid = {
 	.name = "selinux",
 	.id = LSM_ID_SELINUX,
+	.lsmblob = true,
 };
 
 /*
@@ -7168,7 +7222,7 @@
 	LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
 	LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
 	LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
-	LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
+	LSM_HOOK_INIT(inode_getlsmblob, selinux_inode_getlsmblob),
 	LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
 	LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
 	LSM_HOOK_INIT(path_notify, selinux_path_notify),
@@ -7194,6 +7248,7 @@
 	LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
 	LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
 	LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
+	LSM_HOOK_INIT(cred_getlsmblob, selinux_cred_getlsmblob),
 	LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
 	LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
 	LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
@@ -7202,8 +7257,8 @@
 	LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
 	LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
 	LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
-	LSM_HOOK_INIT(current_getsecid_subj, selinux_current_getsecid_subj),
-	LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
+	LSM_HOOK_INIT(current_getlsmblob_subj, selinux_current_getlsmblob_subj),
+	LSM_HOOK_INIT(task_getlsmblob_obj, selinux_task_getlsmblob_obj),
 	LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
 	LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
 	LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
@@ -7217,7 +7272,7 @@
 	LSM_HOOK_INIT(userns_create, selinux_userns_create),
 
 	LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
-	LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
+	LSM_HOOK_INIT(ipc_getlsmblob, selinux_ipc_getlsmblob),
 
 	LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
 	LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
@@ -7306,7 +7361,6 @@
 #endif
 
 #ifdef CONFIG_KEYS
-	LSM_HOOK_INIT(key_free, selinux_key_free),
 	LSM_HOOK_INIT(key_permission, selinux_key_permission),
 	LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
 #ifdef CONFIG_KEY_NOTIFICATIONS
@@ -7363,6 +7417,7 @@
 	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
 	LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
 	LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
+	LSM_HOOK_INIT(lsmblob_to_secctx, selinux_lsmblob_to_secctx),
 	LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
 	LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
 	LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
--- linux-qcom-6.8.0.orig/security/selinux/include/audit.h
+++ linux-qcom-6.8.0/security/selinux/include/audit.h
@@ -21,33 +21,39 @@
  *	@op: the operator the rule uses
  *	@rulestr: the text "target" of the rule
  *	@rule: pointer to the new rule structure returned via this
+ *	@lsmid: the relevant LSM
+ *	@gfp: GFP flag used for kmalloc
  *
  *	Returns 0 if successful, -errno if not.  On success, the rule structure
  *	will be allocated internally.  The caller must free this structure with
  *	selinux_audit_rule_free() after use.
  */
-int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **rule);
+int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **rule,
+			    int lsmid, gfp_t gfp);
 
 /**
  *	selinux_audit_rule_free - free an selinux audit rule structure.
  *	@rule: pointer to the audit rule to be freed
+ *	@lsmid: which LSM this rule relates to
  *
  *	This will free all memory associated with the given rule.
  *	If @rule is NULL, no operation is performed.
  */
-void selinux_audit_rule_free(void *rule);
+void selinux_audit_rule_free(void *rule, int lsmid);
 
 /**
  *	selinux_audit_rule_match - determine if a context ID matches a rule.
- *	@sid: the context ID to check
+ *	@blob: includes the context ID to check
  *	@field: the field this rule refers to
  *	@op: the operator the rule uses
  *	@rule: pointer to the audit rule to check against
+ *	@lsmid: the relevant LSM
  *
  *	Returns 1 if the context id matches the rule, 0 if it does not, and
  *	-errno on failure.
  */
-int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *rule);
+int selinux_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
+			     void *rule, int lsmid);
 
 /**
  *	selinux_audit_rule_known - check to see if rule contains selinux fields.
--- linux-qcom-6.8.0.orig/security/selinux/include/netlabel.h
+++ linux-qcom-6.8.0/security/selinux/include/netlabel.h
@@ -134,4 +134,9 @@
 }
 #endif /* CONFIG_NETLABEL */
 
+static inline bool selinux_netlbl_enabled(void)
+{
+	return selinux_blob_sizes.lbs_netlabel && netlbl_enabled();
+}
+
 #endif
--- linux-qcom-6.8.0.orig/security/selinux/include/objsec.h
+++ linux-qcom-6.8.0/security/selinux/include/objsec.h
@@ -195,4 +195,16 @@
 	return superblock->s_security + selinux_blob_sizes.lbs_superblock;
 }
 
+#ifdef CONFIG_KEYS
+static inline struct key_security_struct *selinux_key(const struct key *key)
+{
+	return key->security + selinux_blob_sizes.lbs_key;
+}
+#endif /* CONFIG_KEYS */
+
+static inline struct sk_security_struct *selinux_sock(const struct sock *sock)
+{
+	return sock->sk_security + selinux_blob_sizes.lbs_sock;
+}
+
 #endif /* _SELINUX_OBJSEC_H_ */
--- linux-qcom-6.8.0.orig/security/selinux/netlabel.c
+++ linux-qcom-6.8.0/security/selinux/netlabel.c
@@ -17,6 +17,7 @@
 #include <linux/gfp.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
+#include <linux/lsm_hooks.h>
 #include <net/sock.h>
 #include <net/netlabel.h>
 #include <net/ip.h>
@@ -68,7 +69,7 @@
 static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
 {
 	int rc;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	struct netlbl_lsm_secattr *secattr;
 
 	if (sksec->nlbl_secattr != NULL)
@@ -100,7 +101,7 @@
 							const struct sock *sk,
 							u32 sid)
 {
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;
 
 	if (secattr == NULL)
@@ -197,7 +198,7 @@
 	int rc;
 	struct netlbl_lsm_secattr secattr;
 
-	if (!netlbl_enabled()) {
+	if (!selinux_netlbl_enabled()) {
 		*type = NETLBL_NLTYPE_NONE;
 		*sid = SECSID_NULL;
 		return 0;
@@ -240,7 +241,7 @@
 	 * being labeled by it's parent socket, if it is just exit */
 	sk = skb_to_full_sk(skb);
 	if (sk != NULL) {
-		struct sk_security_struct *sksec = sk->sk_security;
+		struct sk_security_struct *sksec = selinux_sock(sk);
 
 		if (sksec->nlbl_state != NLBL_REQSKB)
 			return 0;
@@ -277,7 +278,7 @@
 {
 	int rc;
 	struct netlbl_lsm_secattr secattr;
-	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(asoc->base.sk);
 	struct sockaddr_in addr4;
 	struct sockaddr_in6 addr6;
 
@@ -356,7 +357,7 @@
  */
 void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
 {
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 
 	if (family == PF_INET)
 		sksec->nlbl_state = NLBL_LABELED;
@@ -374,8 +375,8 @@
  */
 void selinux_netlbl_sctp_sk_clone(struct sock *sk, struct sock *newsk)
 {
-	struct sk_security_struct *sksec = sk->sk_security;
-	struct sk_security_struct *newsksec = newsk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
+	struct sk_security_struct *newsksec = selinux_sock(newsk);
 
 	newsksec->nlbl_state = sksec->nlbl_state;
 }
@@ -393,7 +394,7 @@
 int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
 {
 	int rc;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	struct netlbl_lsm_secattr *secattr;
 
 	if (family != PF_INET && family != PF_INET6)
@@ -439,7 +440,7 @@
 	u32 perm;
 	struct netlbl_lsm_secattr secattr;
 
-	if (!netlbl_enabled())
+	if (!selinux_netlbl_enabled())
 		return 0;
 
 	netlbl_secattr_init(&secattr);
@@ -507,7 +508,7 @@
 {
 	int rc = 0;
 	struct sock *sk = sock->sk;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	struct netlbl_lsm_secattr secattr;
 
 	if (selinux_netlbl_option(level, optname) &&
@@ -545,7 +546,7 @@
 						struct sockaddr *addr)
 {
 	int rc;
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 	struct netlbl_lsm_secattr *secattr;
 
 	/* connected sockets are allowed to disconnect when the address family
@@ -584,7 +585,7 @@
 int selinux_netlbl_socket_connect_locked(struct sock *sk,
 					 struct sockaddr *addr)
 {
-	struct sk_security_struct *sksec = sk->sk_security;
+	struct sk_security_struct *sksec = selinux_sock(sk);
 
 	if (sksec->nlbl_state != NLBL_REQSKB &&
 	    sksec->nlbl_state != NLBL_CONNLABELED)
--- linux-qcom-6.8.0.orig/security/selinux/selinuxfs.c
+++ linux-qcom-6.8.0/security/selinux/selinuxfs.c
@@ -571,11 +571,18 @@
 			      size_t count, loff_t *ppos)
 
 {
-	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
+	struct selinux_fs_info *fsi;
 	struct selinux_load_state load_state;
 	ssize_t length;
 	void *data = NULL;
 
+	/* no partial writes */
+	if (*ppos)
+		return -EINVAL;
+	/* no empty policies */
+	if (!count)
+		return -EINVAL;
+
 	mutex_lock(&selinux_state.policy_mutex);
 
 	length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
@@ -583,26 +590,22 @@
 	if (length)
 		goto out;
 
-	/* No partial writes. */
-	length = -EINVAL;
-	if (*ppos != 0)
-		goto out;
-
-	length = -ENOMEM;
 	data = vmalloc(count);
-	if (!data)
+	if (!data) {
+		length = -ENOMEM;
 		goto out;
-
-	length = -EFAULT;
-	if (copy_from_user(data, buf, count) != 0)
+	}
+	if (copy_from_user(data, buf, count) != 0) {
+		length = -EFAULT;
 		goto out;
+	}
 
 	length = security_load_policy(data, count, &load_state);
 	if (length) {
 		pr_warn_ratelimited("SELinux: failed to load policy\n");
 		goto out;
 	}
-
+	fsi = file_inode(file)->i_sb->s_fs_info;
 	length = sel_make_policy_nodes(fsi, load_state.policy);
 	if (length) {
 		pr_warn_ratelimited("SELinux: failed to initialize selinuxfs\n");
@@ -611,13 +614,12 @@
 	}
 
 	selinux_policy_commit(&load_state);
-
 	length = count;
-
 	audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
 		"auid=%u ses=%u lsm=selinux res=1",
 		from_kuid(&init_user_ns, audit_get_loginuid(current)),
 		audit_get_sessionid(current));
+
 out:
 	mutex_unlock(&selinux_state.policy_mutex);
 	vfree(data);
@@ -2123,7 +2125,6 @@
 	.kill_sb	= sel_kill_sb,
 };
 
-static struct vfsmount *selinuxfs_mount __ro_after_init;
 struct path selinux_null __ro_after_init;
 
 static int __init init_sel_fs(void)
@@ -2145,18 +2146,21 @@
 		return err;
 	}
 
-	selinux_null.mnt = selinuxfs_mount = kern_mount(&sel_fs_type);
-	if (IS_ERR(selinuxfs_mount)) {
+	selinux_null.mnt = kern_mount(&sel_fs_type);
+	if (IS_ERR(selinux_null.mnt)) {
 		pr_err("selinuxfs:  could not mount!\n");
-		err = PTR_ERR(selinuxfs_mount);
-		selinuxfs_mount = NULL;
+		err = PTR_ERR(selinux_null.mnt);
+		selinux_null.mnt = NULL;
+		return err;
 	}
+
 	selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root,
 						&null_name);
 	if (IS_ERR(selinux_null.dentry)) {
 		pr_err("selinuxfs:  could not lookup null!\n");
 		err = PTR_ERR(selinux_null.dentry);
 		selinux_null.dentry = NULL;
+		return err;
 	}
 
 	return err;
--- linux-qcom-6.8.0.orig/security/selinux/ss/services.c
+++ linux-qcom-6.8.0/security/selinux/ss/services.c
@@ -956,7 +956,10 @@
 					xpermd->driver))
 			return;
 	} else {
-		BUG();
+		pr_warn_once(
+			"SELinux: unknown extended permission (%u) will be ignored\n",
+			node->datum.u.xperms->specified);
+		return;
 	}
 
 	if (node->key.specified == AVTAB_XPERMS_ALLOWED) {
@@ -993,7 +996,8 @@
 					node->datum.u.xperms->perms.p[i];
 		}
 	} else {
-		BUG();
+		pr_warn_once("SELinux: unknown specified key (%u)\n",
+			     node->key.specified);
 	}
 }
 
@@ -3498,17 +3502,20 @@
 	struct context au_ctxt;
 };
 
-void selinux_audit_rule_free(void *vrule)
+void selinux_audit_rule_free(void *vrule, int lsmid)
 {
 	struct selinux_audit_rule *rule = vrule;
 
+	if (lsmid != LSM_ID_UNDEF || lsmid != LSM_ID_SELINUX)
+		return;
 	if (rule) {
 		context_destroy(&rule->au_ctxt);
 		kfree(rule);
 	}
 }
 
-int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
+int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule,
+			    int lsmid, gfp_t gfp)
 {
 	struct selinux_state *state = &selinux_state;
 	struct selinux_policy *policy;
@@ -3522,6 +3529,8 @@
 
 	*rule = NULL;
 
+	if (lsmid != LSM_ID_UNDEF || lsmid != LSM_ID_SELINUX)
+		return 0;
 	if (!selinux_initialized())
 		return -EOPNOTSUPP;
 
@@ -3549,7 +3558,7 @@
 		return -EINVAL;
 	}
 
-	tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL);
+	tmprule = kzalloc(sizeof(struct selinux_audit_rule), gfp);
 	if (!tmprule)
 		return -ENOMEM;
 	context_init(&tmprule->au_ctxt);
@@ -3603,7 +3612,7 @@
 
 err:
 	rcu_read_unlock();
-	selinux_audit_rule_free(tmprule);
+	selinux_audit_rule_free(tmprule, LSM_ID_SELINUX);
 	*rule = NULL;
 	return rc;
 }
@@ -3633,7 +3642,8 @@
 	return 0;
 }
 
-int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)
+int selinux_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
+			     void *vrule, int lsmid)
 {
 	struct selinux_state *state = &selinux_state;
 	struct selinux_policy *policy;
@@ -3642,6 +3652,8 @@
 	struct selinux_audit_rule *rule = vrule;
 	int match = 0;
 
+	if (lsmid != LSM_ID_UNDEF || lsmid != LSM_ID_SELINUX)
+		return 0;
 	if (unlikely(!rule)) {
 		WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n");
 		return -ENOENT;
@@ -3659,10 +3671,10 @@
 		goto out;
 	}
 
-	ctxt = sidtab_search(policy->sidtab, sid);
+	ctxt = sidtab_search(policy->sidtab, blob->selinux.secid);
 	if (unlikely(!ctxt)) {
 		WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n",
-			  sid);
+			  blob->selinux.secid);
 		match = -ENOENT;
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/security/smack/smack.h
+++ linux-qcom-6.8.0/security/smack/smack.h
@@ -355,6 +355,23 @@
 	return superblock->s_security + smack_blob_sizes.lbs_superblock;
 }
 
+static inline struct socket_smack *smack_sock(const struct sock *sock)
+{
+	return sock->sk_security + smack_blob_sizes.lbs_sock;
+}
+
+#ifdef CONFIG_KEYS
+static inline struct smack_known **smack_key(const struct key *key)
+{
+	return key->security + smack_blob_sizes.lbs_key;
+}
+#endif /* CONFIG_KEYS */
+
+static inline bool smack_netlabel(void)
+{
+	return smack_blob_sizes.lbs_netlabel;
+}
+
 /*
  * Is the directory transmuting?
  */
@@ -364,6 +381,11 @@
 	return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
 }
 
+static inline bool smack_secmark(void)
+{
+	return smack_blob_sizes.lbs_secmark;
+}
+
 /*
  * Present a pointer to the smack label entry in an inode blob.
  */
--- linux-qcom-6.8.0.orig/security/smack/smack_lsm.c
+++ linux-qcom-6.8.0/security/smack/smack_lsm.c
@@ -561,6 +561,7 @@
 }
 
 struct smack_mnt_opts {
+	bool initialized;
 	const char *fsdefault;
 	const char *fsfloor;
 	const char *fshat;
@@ -568,24 +569,37 @@
 	const char *fstransmute;
 };
 
+static inline struct smack_mnt_opts *smack_mnt_opts(void *mnt_opts)
+{
+	if (mnt_opts)
+		return mnt_opts + smack_blob_sizes.lbs_mnt_opts;
+	return NULL;
+}
+
 static void smack_free_mnt_opts(void *mnt_opts)
 {
-	kfree(mnt_opts);
+	struct smack_mnt_opts *opts;
+
+	if (mnt_opts) {
+		opts = smack_mnt_opts(mnt_opts);
+		opts->initialized = false;
+	}
 }
 
 static int smack_add_opt(int token, const char *s, void **mnt_opts)
 {
-	struct smack_mnt_opts *opts = *mnt_opts;
+	struct smack_mnt_opts *opts;
 	struct smack_known *skp;
 
-	if (!opts) {
-		opts = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL);
-		if (!opts)
+	if (!s)
+		return -EINVAL;
+
+	if (!*mnt_opts) {
+		*mnt_opts = lsm_mnt_opts_alloc(GFP_KERNEL);
+		if (!*mnt_opts)
 			return -ENOMEM;
-		*mnt_opts = opts;
 	}
-	if (!s)
-		return -ENOMEM;
+	opts = smack_mnt_opts(*mnt_opts);
 
 	skp = smk_import_entry(s, 0);
 	if (IS_ERR(skp))
@@ -618,6 +632,7 @@
 		opts->fstransmute = skp->smk_known;
 		break;
 	}
+	opts->initialized = true;
 	return 0;
 
 out_opt_err:
@@ -639,10 +654,12 @@
 	struct smack_mnt_opts *ctx;
 	struct inode_smack *isp;
 
-	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
-	if (!ctx)
-		return -ENOMEM;
-	fc->security = ctx;
+	if (!fc->security) {
+		fc->security = lsm_mnt_opts_alloc(GFP_KERNEL);
+		if (!fc->security)
+			return -ENOMEM;
+	}
+	ctx = smack_mnt_opts(fc->security);
 
 	sbsp = smack_superblock(reference);
 	isp = smack_inode(reference->s_root->d_inode);
@@ -672,6 +689,7 @@
 				return -ENOMEM;
 		}
 	}
+	ctx->initialized = true;
 	return 0;
 }
 
@@ -685,16 +703,21 @@
 static int smack_fs_context_dup(struct fs_context *fc,
 				struct fs_context *src_fc)
 {
-	struct smack_mnt_opts *dst, *src = src_fc->security;
+	struct smack_mnt_opts *src;
+	struct smack_mnt_opts *dst;
 
+	src = smack_mnt_opts(src_fc->security);
 	if (!src)
 		return 0;
 
-	fc->security = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL);
-	if (!fc->security)
-		return -ENOMEM;
+	if (!fc->security) {
+		fc->security = lsm_mnt_opts_alloc(GFP_KERNEL);
+		if (!fc->security)
+			return -ENOMEM;
+	}
 
-	dst = fc->security;
+	dst = smack_mnt_opts(fc->security);
+	dst->initialized = src->initialized;
 	dst->fsdefault = src->fsdefault;
 	dst->fsfloor = src->fsfloor;
 	dst->fshat = src->fshat;
@@ -804,7 +827,7 @@
 	struct superblock_smack *sp = smack_superblock(sb);
 	struct inode_smack *isp;
 	struct smack_known *skp;
-	struct smack_mnt_opts *opts = mnt_opts;
+	struct smack_mnt_opts *opts = smack_mnt_opts(mnt_opts);
 	bool transmute = false;
 
 	if (sp->smk_flags & SMK_SB_INITIALIZED)
@@ -837,7 +860,7 @@
 
 	sp->smk_flags |= SMK_SB_INITIALIZED;
 
-	if (opts) {
+	if (opts && opts->initialized) {
 		if (opts->fsdefault) {
 			skp = smk_import_entry(opts->fsdefault, 0);
 			if (IS_ERR(skp))
@@ -1314,11 +1337,12 @@
 		check_star = 1;
 	} else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
 		check_priv = 1;
-		if (size != TRANS_TRUE_SIZE ||
+		if (!S_ISDIR(d_backing_inode(dentry)->i_mode) ||
+		    size != TRANS_TRUE_SIZE ||
 		    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
 			rc = -EINVAL;
 	} else
-		rc = cap_inode_setxattr(dentry, name, value, size, flags);
+		rc = -ENOSYS;
 
 	if (check_priv && !smack_privileged(CAP_MAC_ADMIN))
 		rc = -EPERM;
@@ -1332,11 +1356,11 @@
 			rc = -EINVAL;
 	}
 
-	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
-	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
-
 	if (rc == 0) {
-		rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
+		smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
+		smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
+		rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)),
+				MAY_WRITE, &ad);
 		rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
 	}
 
@@ -1427,8 +1451,7 @@
 	    strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
 		if (!smack_privileged(CAP_MAC_ADMIN))
 			rc = -EPERM;
-	} else
-		rc = cap_inode_removexattr(idmap, dentry, name);
+	}
 
 	if (rc != 0)
 		return rc;
@@ -1573,7 +1596,7 @@
 		if (sock == NULL || sock->sk == NULL)
 			return -EOPNOTSUPP;
 
-		ssp = sock->sk->sk_security;
+		ssp = smack_sock(sock->sk);
 
 		if (strcmp(name, XATTR_SMACK_IPIN) == 0)
 			isp = ssp->smk_in;
@@ -1616,15 +1639,13 @@
 }
 
 /**
- * smack_inode_getsecid - Extract inode's security id
+ * smack_inode_getlsmblob - Extract inode's security id
  * @inode: inode to extract the info from
- * @secid: where result will be saved
+ * @blob: where result will be saved
  */
-static void smack_inode_getsecid(struct inode *inode, u32 *secid)
+static void smack_inode_getlsmblob(struct inode *inode, struct lsmblob *blob)
 {
-	struct smack_known *skp = smk_of_inode(inode);
-
-	*secid = skp->smk_secid;
+	blob->smack.skp = smk_of_inode(inode);
 }
 
 /*
@@ -1961,7 +1982,7 @@
 
 	if (inode->i_sb->s_magic == SOCKFS_MAGIC) {
 		sock = SOCKET_I(inode);
-		ssp = sock->sk->sk_security;
+		ssp = smack_sock(sock->sk);
 		tsp = smack_cred(current_cred());
 		/*
 		 * If the receiving process can't write to the
@@ -2121,6 +2142,21 @@
 }
 
 /**
+ * smack_cred_getlsmblob - get the Smack label for a creds structure
+ * @cred: the object creds
+ * @blob: where to put the data
+ *
+ * Sets the Smack part of the blob
+ */
+static void smack_cred_getlsmblob(const struct cred *cred,
+				  struct lsmblob *blob)
+{
+	rcu_read_lock();
+	blob->smack.skp = smk_of_task(smack_cred(cred));
+	rcu_read_unlock();
+}
+
+/**
  * smack_kernel_act_as - Set the subjective context in a set of credentials
  * @new: points to the set of credentials to be modified.
  * @secid: specifies the security ID to be set
@@ -2211,30 +2247,27 @@
 }
 
 /**
- * smack_current_getsecid_subj - get the subjective secid of the current task
- * @secid: where to put the result
+ * smack_current_getlsmblob_subj - get the subjective secid of the current task
+ * @blob: where to put the result
  *
  * Sets the secid to contain a u32 version of the task's subjective smack label.
  */
-static void smack_current_getsecid_subj(u32 *secid)
+static void smack_current_getlsmblob_subj(struct lsmblob *blob)
 {
-	struct smack_known *skp = smk_of_current();
-
-	*secid = skp->smk_secid;
+	blob->smack.skp = smk_of_current();
 }
 
 /**
- * smack_task_getsecid_obj - get the objective secid of the task
+ * smack_task_getlsmblob_obj - get the objective data of the task
  * @p: the task
  * @secid: where to put the result
  *
  * Sets the secid to contain a u32 version of the task's objective smack label.
  */
-static void smack_task_getsecid_obj(struct task_struct *p, u32 *secid)
+static void smack_task_getlsmblob_obj(struct task_struct *p,
+				      struct lsmblob *blob)
 {
-	struct smack_known *skp = smk_of_task_struct_obj(p);
-
-	*secid = skp->smk_secid;
+	blob->smack.skp = smk_of_task_struct_obj(p);
 }
 
 /**
@@ -2381,11 +2414,7 @@
 static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
 {
 	struct smack_known *skp = smk_of_current();
-	struct socket_smack *ssp;
-
-	ssp = kzalloc(sizeof(struct socket_smack), gfp_flags);
-	if (ssp == NULL)
-		return -ENOMEM;
+	struct socket_smack *ssp = smack_sock(sk);
 
 	/*
 	 * Sockets created by kernel threads receive web label.
@@ -2399,11 +2428,10 @@
 	}
 	ssp->smk_packet = NULL;
 
-	sk->sk_security = ssp;
-
 	return 0;
 }
 
+#ifdef SMACK_IPV6_PORT_LABELING
 /**
  * smack_sk_free_security - Free a socket blob
  * @sk: the socket
@@ -2412,7 +2440,6 @@
  */
 static void smack_sk_free_security(struct sock *sk)
 {
-#ifdef SMACK_IPV6_PORT_LABELING
 	struct smk_port_label *spp;
 
 	if (sk->sk_family == PF_INET6) {
@@ -2425,9 +2452,8 @@
 		}
 		rcu_read_unlock();
 	}
-#endif
-	kfree(sk->sk_security);
 }
+#endif
 
 /**
  * smack_sk_clone_security - Copy security context
@@ -2438,8 +2464,8 @@
  */
 static void smack_sk_clone_security(const struct sock *sk, struct sock *newsk)
 {
-	struct socket_smack *ssp_old = sk->sk_security;
-	struct socket_smack *ssp_new = newsk->sk_security;
+	struct socket_smack *ssp_old = smack_sock(sk);
+	struct socket_smack *ssp_new = smack_sock(newsk);
 
 	*ssp_new = *ssp_old;
 }
@@ -2555,10 +2581,13 @@
  */
 static int smack_netlbl_add(struct sock *sk)
 {
-	struct socket_smack *ssp = sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sk);
 	struct smack_known *skp = ssp->smk_out;
 	int rc;
 
+	if (!smack_netlabel())
+		return 0;
+
 	local_bh_disable();
 	bh_lock_sock_nested(sk);
 
@@ -2587,7 +2616,10 @@
  */
 static void smack_netlbl_delete(struct sock *sk)
 {
-	struct socket_smack *ssp = sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sk);
+
+	if (!smack_netlabel())
+		return;
 
 	/*
 	 * Take the label off the socket if one is set.
@@ -2619,7 +2651,7 @@
 	struct smack_known *skp;
 	int rc = 0;
 	struct smack_known *hkp;
-	struct socket_smack *ssp = sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sk);
 	struct smk_audit_info ad;
 
 	rcu_read_lock();
@@ -2639,7 +2671,7 @@
 		/*
 		 * Clear the socket netlabel if it's set.
 		 */
-		if (!rc)
+		if (!rc && smack_netlabel())
 			smack_netlbl_delete(sk);
 	}
 	rcu_read_unlock();
@@ -2692,7 +2724,7 @@
 {
 	struct sock *sk = sock->sk;
 	struct sockaddr_in6 *addr6;
-	struct socket_smack *ssp = sock->sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sock->sk);
 	struct smk_port_label *spp;
 	unsigned short port = 0;
 
@@ -2780,7 +2812,7 @@
 				int act)
 {
 	struct smk_port_label *spp;
-	struct socket_smack *ssp = sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sk);
 	struct smack_known *skp = NULL;
 	unsigned short port;
 	struct smack_known *object;
@@ -2855,6 +2887,15 @@
 	if (value == NULL || size > SMK_LONGLABEL || size == 0)
 		return -EINVAL;
 
+	if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) {
+		if (!S_ISDIR(inode->i_mode) || size != TRANS_TRUE_SIZE ||
+		    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
+			return -EINVAL;
+
+		nsp->smk_flags |= SMK_INODE_TRANSMUTE;
+		return 0;
+	}
+
 	skp = smk_import_entry(value, size);
 	if (IS_ERR(skp))
 		return PTR_ERR(skp);
@@ -2874,7 +2915,7 @@
 	if (sock == NULL || sock->sk == NULL)
 		return -EOPNOTSUPP;
 
-	ssp = sock->sk->sk_security;
+	ssp = smack_sock(sock->sk);
 
 	if (strcmp(name, XATTR_SMACK_IPIN) == 0)
 		ssp->smk_in = skp;
@@ -2922,7 +2963,7 @@
 	 * Sockets created by kernel threads receive web label.
 	 */
 	if (unlikely(current->flags & PF_KTHREAD)) {
-		ssp = sock->sk->sk_security;
+		ssp = smack_sock(sock->sk);
 		ssp->smk_in = &smack_known_web;
 		ssp->smk_out = &smack_known_web;
 	}
@@ -2947,8 +2988,8 @@
 static int smack_socket_socketpair(struct socket *socka,
 		                   struct socket *sockb)
 {
-	struct socket_smack *asp = socka->sk->sk_security;
-	struct socket_smack *bsp = sockb->sk->sk_security;
+	struct socket_smack *asp = smack_sock(socka->sk);
+	struct socket_smack *bsp = smack_sock(sockb->sk);
 
 	asp->smk_packet = bsp->smk_out;
 	bsp->smk_packet = asp->smk_out;
@@ -3011,7 +3052,7 @@
 		if (__is_defined(SMACK_IPV6_SECMARK_LABELING))
 			rsp = smack_ipv6host_label(sip);
 		if (rsp != NULL) {
-			struct socket_smack *ssp = sock->sk->sk_security;
+			struct socket_smack *ssp = smack_sock(sock->sk);
 
 			rc = smk_ipv6_check(ssp->smk_out, rsp, sip,
 					    SMK_CONNECTING);
@@ -3404,16 +3445,16 @@
 }
 
 /**
- * smack_ipc_getsecid - Extract smack security id
+ * smack_ipc_getlsmblob - Extract smack security data
  * @ipp: the object permissions
- * @secid: where result will be saved
+ * @blob: where result will be saved
  */
-static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)
+static void smack_ipc_getlsmblob(struct kern_ipc_perm *ipp,
+				 struct lsmblob *blob)
 {
-	struct smack_known **blob = smack_ipc(ipp);
-	struct smack_known *iskp = *blob;
+	struct smack_known **iskpp = smack_ipc(ipp);
 
-	*secid = iskp->smk_secid;
+	blob->smack.skp = *iskpp;
 }
 
 /**
@@ -3641,7 +3682,7 @@
  * There will only ever be one attribute.
  */
 static int smack_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
-			     size_t *size, u32 flags)
+			     u32 *size, u32 flags)
 {
 	int rc;
 	struct smack_known *skp;
@@ -3762,7 +3803,7 @@
  * Returns 0 on success, an error code otherwise.
  */
 static int smack_setselfattr(unsigned int attr, struct lsm_ctx *ctx,
-			     size_t size, u32 flags)
+			     u32 size, u32 flags)
 {
 	int rc;
 
@@ -3806,9 +3847,9 @@
 {
 	struct smack_known *skp;
 	struct smack_known *okp;
-	struct socket_smack *ssp = sock->sk_security;
-	struct socket_smack *osp = other->sk_security;
-	struct socket_smack *nsp = newsk->sk_security;
+	struct socket_smack *ssp = smack_sock(sock);
+	struct socket_smack *osp = smack_sock(other);
+	struct socket_smack *nsp = smack_sock(newsk);
 	struct smk_audit_info ad;
 	int rc = 0;
 #ifdef CONFIG_AUDIT
@@ -3833,12 +3874,18 @@
 		}
 	}
 
-	/*
-	 * Cross reference the peer labels for SO_PEERSEC.
-	 */
 	if (rc == 0) {
+		/*
+		 * Cross reference the peer labels for SO_PEERSEC.
+		 */
 		nsp->smk_packet = ssp->smk_out;
 		ssp->smk_packet = osp->smk_out;
+
+		/*
+		 * new/child/established socket must inherit listening socket labels
+		 */
+		nsp->smk_out = osp->smk_out;
+		nsp->smk_in  = osp->smk_in;
 	}
 
 	return rc;
@@ -3854,8 +3901,8 @@
  */
 static int smack_unix_may_send(struct socket *sock, struct socket *other)
 {
-	struct socket_smack *ssp = sock->sk->sk_security;
-	struct socket_smack *osp = other->sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sock->sk);
+	struct socket_smack *osp = smack_sock(other->sk);
 	struct smk_audit_info ad;
 	int rc;
 
@@ -3892,7 +3939,7 @@
 	struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name;
 #endif
 #ifdef SMACK_IPV6_SECMARK_LABELING
-	struct socket_smack *ssp = sock->sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sock->sk);
 	struct smack_known *rsp;
 #endif
 	int rc = 0;
@@ -3945,6 +3992,8 @@
 	int acat;
 	int kcat;
 
+	if (!smack_netlabel())
+		return smack_net_ambient;
 	/*
 	 * Netlabel found it in the cache.
 	 */
@@ -4071,7 +4120,7 @@
 #ifdef CONFIG_NETWORK_SECMARK
 static struct smack_known *smack_from_skb(struct sk_buff *skb)
 {
-	if (skb == NULL || skb->secmark == 0)
+	if (!smack_secmark() || skb == NULL || skb->secmark == 0)
 		return NULL;
 
 	return smack_from_secid(skb->secmark);
@@ -4101,10 +4150,13 @@
 	struct socket_smack *ssp = NULL;
 	struct smack_known *skp = NULL;
 
+	if (!smack_netlabel())
+		return NULL;
+
 	netlbl_secattr_init(&secattr);
 
 	if (sk)
-		ssp = sk->sk_security;
+		ssp = smack_sock(sk);
 
 	if (netlbl_skbuff_getattr(skb, family, &secattr) == 0) {
 		skp = smack_from_secattr(&secattr, ssp);
@@ -4126,7 +4178,7 @@
  */
 static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
-	struct socket_smack *ssp = sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sk);
 	struct smack_known *skp = NULL;
 	int rc = 0;
 	struct smk_audit_info ad;
@@ -4171,7 +4223,7 @@
 		rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
 		rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
 					MAY_WRITE, rc);
-		if (rc != 0)
+		if (rc != 0 && smack_netlabel())
 			netlbl_skbuff_err(skb, family, rc, 0);
 		break;
 #if IS_ENABLED(CONFIG_IPV6)
@@ -4230,7 +4282,7 @@
 	u32 slen = 1;
 	int rc = 0;
 
-	ssp = sock->sk->sk_security;
+	ssp = smack_sock(sock->sk);
 	if (ssp->smk_packet != NULL) {
 		rcp = ssp->smk_packet->smk_known;
 		slen = strlen(rcp) + 1;
@@ -4280,7 +4332,7 @@
 
 	switch (family) {
 	case PF_UNIX:
-		ssp = sock->sk->sk_security;
+		ssp = smack_sock(sock->sk);
 		s = ssp->smk_out->smk_secid;
 		break;
 	case PF_INET:
@@ -4329,7 +4381,7 @@
 	    (sk->sk_family != PF_INET && sk->sk_family != PF_INET6))
 		return;
 
-	ssp = sk->sk_security;
+	ssp = smack_sock(sk);
 	ssp->smk_in = skp;
 	ssp->smk_out = skp;
 	/* cssp->smk_packet is already set in smack_inet_csk_clone() */
@@ -4349,7 +4401,7 @@
 {
 	u16 family = sk->sk_family;
 	struct smack_known *skp;
-	struct socket_smack *ssp = sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sk);
 	struct sockaddr_in addr;
 	struct iphdr *hdr;
 	struct smack_known *hskp;
@@ -4382,7 +4434,7 @@
 	if (skp == NULL) {
 		skp = smack_from_netlbl(sk, family, skb);
 		if (skp == NULL)
-			skp = &smack_known_huh;
+			skp = smack_net_ambient;
 	}
 
 #ifdef CONFIG_AUDIT
@@ -4403,8 +4455,11 @@
 	/*
 	 * Save the peer's label in the request_sock so we can later setup
 	 * smk_packet in the child socket so that SO_PEERCRED can report it.
+	 *
+	 * Only do this if Smack is using netlabel.
 	 */
-	req->peer_secid = skp->smk_secid;
+	if (smack_netlabel())
+		req->peer_secid = skp->smk_secid;
 
 	/*
 	 * We need to decide if we want to label the incoming connection here
@@ -4417,10 +4472,12 @@
 	hskp = smack_ipv4host_label(&addr);
 	rcu_read_unlock();
 
-	if (hskp == NULL)
-		rc = netlbl_req_setattr(req, &skp->smk_netlabel);
-	else
-		netlbl_req_delattr(req);
+	if (smack_netlabel()) {
+		if (hskp == NULL)
+			rc = netlbl_req_setattr(req, &ssp->smk_out->smk_netlabel);
+		else
+			netlbl_req_delattr(req);
+	}
 
 	return rc;
 }
@@ -4435,10 +4492,10 @@
 static void smack_inet_csk_clone(struct sock *sk,
 				 const struct request_sock *req)
 {
-	struct socket_smack *ssp = sk->sk_security;
+	struct socket_smack *ssp = smack_sock(sk);
 	struct smack_known *skp;
 
-	if (req->peer_secid != 0) {
+	if (smack_netlabel() && req->peer_secid != 0) {
 		skp = smack_from_secid(req->peer_secid);
 		ssp->smk_packet = skp;
 	} else
@@ -4467,24 +4524,14 @@
 static int smack_key_alloc(struct key *key, const struct cred *cred,
 			   unsigned long flags)
 {
+	struct smack_known **blob = smack_key(key);
 	struct smack_known *skp = smk_of_task(smack_cred(cred));
 
-	key->security = skp;
+	*blob = skp;
 	return 0;
 }
 
 /**
- * smack_key_free - Clear the key security blob
- * @key: the object
- *
- * Clear the blob pointer
- */
-static void smack_key_free(struct key *key)
-{
-	key->security = NULL;
-}
-
-/**
  * smack_key_permission - Smack access on a key
  * @key_ref: gets to the object
  * @cred: the credentials to use
@@ -4497,6 +4544,8 @@
 				const struct cred *cred,
 				enum key_need_perm need_perm)
 {
+	struct smack_known **blob;
+	struct smack_known *skp;
 	struct key *keyp;
 	struct smk_audit_info ad;
 	struct smack_known *tkp = smk_of_task(smack_cred(cred));
@@ -4534,7 +4583,9 @@
 	 * If the key hasn't been initialized give it access so that
 	 * it may do so.
 	 */
-	if (keyp->security == NULL)
+	blob = smack_key(keyp);
+	skp = *blob;
+	if (skp == NULL)
 		return 0;
 	/*
 	 * This should not occur
@@ -4550,8 +4601,8 @@
 	ad.a.u.key_struct.key = keyp->serial;
 	ad.a.u.key_struct.key_desc = keyp->description;
 #endif
-	rc = smk_access(tkp, keyp->security, request, &ad);
-	rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
+	rc = smk_access(tkp, skp, request, &ad);
+	rc = smk_bu_note("key access", tkp, skp, request, rc);
 	return rc;
 }
 
@@ -4566,11 +4617,12 @@
  */
 static int smack_key_getsecurity(struct key *key, char **_buffer)
 {
-	struct smack_known *skp = key->security;
+	struct smack_known **blob = smack_key(key);
+	struct smack_known *skp = *blob;
 	size_t length;
 	char *copy;
 
-	if (key->security == NULL) {
+	if (skp == NULL) {
 		*_buffer = NULL;
 		return 0;
 	}
@@ -4680,16 +4732,21 @@
  * @op: required testing operator (=, !=, >, <, ...)
  * @rulestr: smack label to be audited
  * @vrule: pointer to save our own audit rule representation
+ * @lsmid: the relevant LSM
+ * @gfp: type of the memory for the allocation
  *
  * Prepare to audit cases where (@field @op @rulestr) is true.
  * The label to be audited is created if necessay.
  */
-static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
+static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule,
+				 int lsmid, gfp_t gfp)
 {
 	struct smack_known *skp;
 	char **rule = (char **)vrule;
 	*rule = NULL;
 
+	if (lsmid != LSM_ID_UNDEF || lsmid != LSM_ID_SMACK)
+		return 0;
 	if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
 		return -EINVAL;
 
@@ -4730,19 +4787,23 @@
 
 /**
  * smack_audit_rule_match - Audit given object ?
- * @secid: security id for identifying the object to test
+ * @blob: security id for identifying the object to test
  * @field: audit rule flags given from user-space
  * @op: required testing operator
  * @vrule: smack internal rule presentation
+ * @lsmid: the relevant LSM
  *
  * The core Audit hook. It's used to take the decision of
  * whether to audit or not to audit a given object.
  */
-static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule)
+static int smack_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
+				  void *vrule, int lsmid)
 {
-	struct smack_known *skp;
+	struct smack_known *skp = blob->smack.skp;
 	char *rule = vrule;
 
+	if (lsmid != LSM_ID_UNDEF || lsmid != LSM_ID_SMACK)
+		return 0;
 	if (unlikely(!rule)) {
 		WARN_ONCE(1, "Smack: missing rule\n");
 		return -ENOENT;
@@ -4751,8 +4812,6 @@
 	if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
 		return 0;
 
-	skp = smack_from_secid(secid);
-
 	/*
 	 * No need to do string comparisons. If a match occurs,
 	 * both pointers will point to the same smack_known
@@ -4782,23 +4841,47 @@
 	return (strcmp(name, XATTR_SMACK_SUFFIX) == 0);
 }
 
-
 /**
  * smack_secid_to_secctx - return the smack label for a secid
  * @secid: incoming integer
- * @secdata: destination
- * @seclen: how long it is
+ * @cp: destination
  *
  * Exists for networking code.
  */
-static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+static int smack_secid_to_secctx(u32 secid, struct lsmcontext *cp)
 {
 	struct smack_known *skp = smack_from_secid(secid);
+	int len = strlen(skp->smk_known);
 
-	if (secdata)
-		*secdata = skp->smk_known;
-	*seclen = strlen(skp->smk_known);
-	return 0;
+	if (cp) {
+		cp->context = skp->smk_known;
+		cp->len = len;
+		cp->id = LSM_ID_SMACK;
+	}
+	return len;
+}
+
+/**
+ * smack_lsmblob_to_secctx - return the smack label
+ * @blob: includes incoming Smack data
+ * @secdata: destination
+ * @seclen: how long it is
+ *
+ * Exists for audit code.
+ */
+static int smack_lsmblob_to_secctx(struct lsmblob *blob, struct lsmcontext *cp)
+{
+	struct smack_known *skp = blob->smack.skp;
+	int len;
+
+	len = strlen(skp->smk_known);
+
+	if (cp) {
+		cp->context = skp->smk_known;
+		cp->len = len;
+		cp->id = LSM_ID_SMACK;
+	}
+	return len;
 }
 
 /**
@@ -4834,16 +4917,17 @@
 
 static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
 {
-	return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK,
-				     ctx, ctxlen, 0);
+	return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK,
+				     ctx, ctxlen, 0, NULL);
 }
 
-static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
+static int smack_inode_getsecctx(struct inode *inode, struct lsmcontext *cp)
 {
 	struct smack_known *skp = smk_of_inode(inode);
 
-	*ctx = skp->smk_known;
-	*ctxlen = strlen(skp->smk_known);
+	cp->context = skp->smk_known;
+	cp->len = strlen(skp->smk_known);
+	cp->id = LSM_ID_SMACK;
 	return 0;
 }
 
@@ -5002,14 +5086,22 @@
 	.lbs_file = sizeof(struct smack_known *),
 	.lbs_inode = sizeof(struct inode_smack),
 	.lbs_ipc = sizeof(struct smack_known *),
+#ifdef CONFIG_KEYS
+	.lbs_key = sizeof(struct smack_known *),
+#endif /* CONFIG_KEYS */
 	.lbs_msg_msg = sizeof(struct smack_known *),
+	.lbs_sock = sizeof(struct socket_smack),
 	.lbs_superblock = sizeof(struct superblock_smack),
 	.lbs_xattr_count = SMACK_INODE_INIT_XATTRS,
+	.lbs_mnt_opts = sizeof(struct smack_mnt_opts),
+	.lbs_secmark = true,
+	.lbs_netlabel = true,
 };
 
 static const struct lsm_id smack_lsmid = {
 	.name = "smack",
 	.id = LSM_ID_SMACK,
+	.lsmblob = true,
 };
 
 static struct security_hook_list smack_hooks[] __ro_after_init = {
@@ -5048,7 +5140,7 @@
 	LSM_HOOK_INIT(inode_getsecurity, smack_inode_getsecurity),
 	LSM_HOOK_INIT(inode_setsecurity, smack_inode_setsecurity),
 	LSM_HOOK_INIT(inode_listsecurity, smack_inode_listsecurity),
-	LSM_HOOK_INIT(inode_getsecid, smack_inode_getsecid),
+	LSM_HOOK_INIT(inode_getlsmblob, smack_inode_getlsmblob),
 
 	LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security),
 	LSM_HOOK_INIT(file_ioctl, smack_file_ioctl),
@@ -5068,13 +5160,14 @@
 	LSM_HOOK_INIT(cred_prepare, smack_cred_prepare),
 	LSM_HOOK_INIT(cred_transfer, smack_cred_transfer),
 	LSM_HOOK_INIT(cred_getsecid, smack_cred_getsecid),
+	LSM_HOOK_INIT(cred_getlsmblob, smack_cred_getlsmblob),
 	LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as),
 	LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as),
 	LSM_HOOK_INIT(task_setpgid, smack_task_setpgid),
 	LSM_HOOK_INIT(task_getpgid, smack_task_getpgid),
 	LSM_HOOK_INIT(task_getsid, smack_task_getsid),
-	LSM_HOOK_INIT(current_getsecid_subj, smack_current_getsecid_subj),
-	LSM_HOOK_INIT(task_getsecid_obj, smack_task_getsecid_obj),
+	LSM_HOOK_INIT(current_getlsmblob_subj, smack_current_getlsmblob_subj),
+	LSM_HOOK_INIT(task_getlsmblob_obj, smack_task_getlsmblob_obj),
 	LSM_HOOK_INIT(task_setnice, smack_task_setnice),
 	LSM_HOOK_INIT(task_setioprio, smack_task_setioprio),
 	LSM_HOOK_INIT(task_getioprio, smack_task_getioprio),
@@ -5085,7 +5178,7 @@
 	LSM_HOOK_INIT(task_to_inode, smack_task_to_inode),
 
 	LSM_HOOK_INIT(ipc_permission, smack_ipc_permission),
-	LSM_HOOK_INIT(ipc_getsecid, smack_ipc_getsecid),
+	LSM_HOOK_INIT(ipc_getlsmblob, smack_ipc_getlsmblob),
 
 	LSM_HOOK_INIT(msg_msg_alloc_security, smack_msg_msg_alloc_security),
 
@@ -5126,7 +5219,9 @@
 	LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream),
 	LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram),
 	LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security),
+#ifdef SMACK_IPV6_PORT_LABELING
 	LSM_HOOK_INIT(sk_free_security, smack_sk_free_security),
+#endif
 	LSM_HOOK_INIT(sk_clone_security, smack_sk_clone_security),
 	LSM_HOOK_INIT(sock_graft, smack_sock_graft),
 	LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request),
@@ -5135,7 +5230,6 @@
  /* key management security hooks */
 #ifdef CONFIG_KEYS
 	LSM_HOOK_INIT(key_alloc, smack_key_alloc),
-	LSM_HOOK_INIT(key_free, smack_key_free),
 	LSM_HOOK_INIT(key_permission, smack_key_permission),
 	LSM_HOOK_INIT(key_getsecurity, smack_key_getsecurity),
 #ifdef CONFIG_KEY_NOTIFICATIONS
@@ -5156,6 +5250,7 @@
 
 	LSM_HOOK_INIT(ismaclabel, smack_ismaclabel),
 	LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx),
+	LSM_HOOK_INIT(lsmblob_to_secctx, smack_lsmblob_to_secctx),
 	LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid),
 	LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx),
 	LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx),
@@ -5248,7 +5343,7 @@
  */
 DEFINE_LSM(smack) = {
 	.name = "smack",
-	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
+	.flags = LSM_FLAG_LEGACY_MAJOR,
 	.blobs = &smack_blob_sizes,
 	.init = smack_init,
 };
--- linux-qcom-6.8.0.orig/security/smack/smack_netfilter.c
+++ linux-qcom-6.8.0/security/smack/smack_netfilter.c
@@ -26,8 +26,8 @@
 	struct socket_smack *ssp;
 	struct smack_known *skp;
 
-	if (sk && sk->sk_security) {
-		ssp = sk->sk_security;
+	if (smack_secmark() && sk) {
+		ssp = smack_sock(sk);
 		skp = ssp->smk_out;
 		skb->secmark = skp->smk_secid;
 	}
@@ -54,12 +54,18 @@
 
 static int __net_init smack_nf_register(struct net *net)
 {
+	if (!smack_secmark())
+		return 0;
+
 	return nf_register_net_hooks(net, smack_nf_ops,
 				     ARRAY_SIZE(smack_nf_ops));
 }
 
 static void __net_exit smack_nf_unregister(struct net *net)
 {
+	if (!smack_secmark())
+		return;
+
 	nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
 }
 
@@ -70,7 +76,7 @@
 
 static int __init smack_nf_ip_init(void)
 {
-	if (smack_enabled == 0)
+	if (smack_enabled == 0 || !smack_secmark())
 		return 0;
 
 	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
--- linux-qcom-6.8.0.orig/security/smack/smackfs.c
+++ linux-qcom-6.8.0/security/smack/smackfs.c
@@ -77,7 +77,7 @@
  * If it isn't somehow marked, use this.
  * It can be reset via smackfs/ambient
  */
-struct smack_known *smack_net_ambient;
+struct smack_known *smack_net_ambient = &smack_known_floor;
 
 /*
  * This is the level in a CIPSO header that indicates a
@@ -182,11 +182,9 @@
  */
 static void smk_netlabel_audit_set(struct netlbl_audit *nap)
 {
-	struct smack_known *skp = smk_of_current();
-
 	nap->loginuid = audit_get_loginuid(current);
 	nap->sessionid = audit_get_sessionid(current);
-	nap->secid = skp->smk_secid;
+	nap->blob.smack.skp = smk_of_current();
 }
 
 /*
@@ -687,6 +685,9 @@
 	struct cipso_v4_doi *doip;
 	struct netlbl_audit nai;
 
+	if (!smack_netlabel())
+		return;
+
 	smk_netlabel_audit_set(&nai);
 
 	rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
@@ -727,6 +728,9 @@
 	int rc;
 	struct netlbl_audit nai;
 
+	if (!smack_netlabel())
+		return;
+
 	smk_netlabel_audit_set(&nai);
 
 	if (oldambient != NULL) {
@@ -850,6 +854,8 @@
 	 */
 	if (!smack_privileged(CAP_MAC_ADMIN))
 		return -EPERM;
+	if (!smack_netlabel())
+		return -EINVAL;
 	if (*ppos != 0)
 		return -EINVAL;
 	if (format == SMK_FIXED24_FMT &&
@@ -932,7 +938,7 @@
 	}
 	if (rc >= 0) {
 		old_cat = skp->smk_netlabel.attr.mls.cat;
-		skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
+		rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat);
 		skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
 		synchronize_rcu();
 		netlbl_catmap_free(old_cat);
@@ -1180,6 +1186,8 @@
 	 */
 	if (!smack_privileged(CAP_MAC_ADMIN))
 		return -EPERM;
+	if (!smack_netlabel())
+		return -EINVAL;
 	if (*ppos != 0)
 		return -EINVAL;
 	if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1)
@@ -1439,6 +1447,8 @@
 	 */
 	if (!smack_privileged(CAP_MAC_ADMIN))
 		return -EPERM;
+	if (!smack_netlabel())
+		return -EINVAL;
 	if (*ppos != 0)
 		return -EINVAL;
 	if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1)
@@ -1610,6 +1620,8 @@
 
 	if (!smack_privileged(CAP_MAC_ADMIN))
 		return -EPERM;
+	if (!smack_netlabel())
+		return -EINVAL;
 
 	if (count >= sizeof(temp) || count == 0)
 		return -EINVAL;
@@ -1677,6 +1689,8 @@
 
 	if (!smack_privileged(CAP_MAC_ADMIN))
 		return -EPERM;
+	if (!smack_netlabel())
+		return -EINVAL;
 
 	if (count >= sizeof(temp) || count == 0)
 		return -EINVAL;
@@ -1755,6 +1769,8 @@
 
 	if (!smack_privileged(CAP_MAC_ADMIN))
 		return -EPERM;
+	if (!smack_netlabel())
+		return -EINVAL;
 
 	if (count >= sizeof(temp) || count == 0)
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/security/tomoyo/domain.c
+++ linux-qcom-6.8.0/security/tomoyo/domain.c
@@ -723,10 +723,13 @@
 	ee->r.obj = &ee->obj;
 	ee->obj.path1 = bprm->file->f_path;
 	/* Get symlink's pathname of program. */
-	retval = -ENOENT;
 	exename.name = tomoyo_realpath_nofollow(original_name);
-	if (!exename.name)
-		goto out;
+	if (!exename.name) {
+		/* Fallback to realpath if symlink's pathname does not exist. */
+		exename.name = tomoyo_realpath_from_path(&bprm->file->f_path);
+		if (!exename.name)
+			goto out;
+	}
 	tomoyo_fill_path_info(&exename);
 retry:
 	/* Check 'aggregator' directive. */
--- linux-qcom-6.8.0.orig/sound/Kconfig
+++ linux-qcom-6.8.0/sound/Kconfig
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 menuconfig SOUND
 	tristate "Sound card support"
-	depends on HAS_IOMEM || UML
+	depends on HAS_IOMEM || INDIRECT_IOMEM
 	help
 	  If you have a sound card in your computer, i.e. if it can say more
 	  than an occasional beep, say Y.
--- linux-qcom-6.8.0.orig/sound/core/control.c
+++ linux-qcom-6.8.0/sound/core/control.c
@@ -44,7 +44,6 @@
 
 static int snd_ctl_open(struct inode *inode, struct file *file)
 {
-	unsigned long flags;
 	struct snd_card *card;
 	struct snd_ctl_file *ctl;
 	int i, err;
@@ -80,9 +79,8 @@
 		ctl->preferred_subdevice[i] = -1;
 	ctl->pid = get_pid(task_pid(current));
 	file->private_data = ctl;
-	write_lock_irqsave(&card->ctl_files_rwlock, flags);
-	list_add_tail(&ctl->list, &card->ctl_files);
-	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
+	scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock)
+		list_add_tail(&ctl->list, &card->ctl_files);
 	snd_card_unref(card);
 	return 0;
 
@@ -98,21 +96,18 @@
 
 static void snd_ctl_empty_read_queue(struct snd_ctl_file * ctl)
 {
-	unsigned long flags;
 	struct snd_kctl_event *cread;
 
-	spin_lock_irqsave(&ctl->read_lock, flags);
+	guard(spinlock_irqsave)(&ctl->read_lock);
 	while (!list_empty(&ctl->events)) {
 		cread = snd_kctl_event(ctl->events.next);
 		list_del(&cread->list);
 		kfree(cread);
 	}
-	spin_unlock_irqrestore(&ctl->read_lock, flags);
 }
 
 static int snd_ctl_release(struct inode *inode, struct file *file)
 {
-	unsigned long flags;
 	struct snd_card *card;
 	struct snd_ctl_file *ctl;
 	struct snd_kcontrol *control;
@@ -121,15 +116,17 @@
 	ctl = file->private_data;
 	file->private_data = NULL;
 	card = ctl->card;
-	write_lock_irqsave(&card->ctl_files_rwlock, flags);
-	list_del(&ctl->list);
-	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
-	down_write(&card->controls_rwsem);
-	list_for_each_entry(control, &card->controls, list)
-		for (idx = 0; idx < control->count; idx++)
-			if (control->vd[idx].owner == ctl)
-				control->vd[idx].owner = NULL;
-	up_write(&card->controls_rwsem);
+
+	scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock)
+		list_del(&ctl->list);
+
+	scoped_guard(rwsem_write, &card->controls_rwsem) {
+		list_for_each_entry(control, &card->controls, list)
+			for (idx = 0; idx < control->count; idx++)
+				if (control->vd[idx].owner == ctl)
+					control->vd[idx].owner = NULL;
+	}
+
 	snd_fasync_free(ctl->fasync);
 	snd_ctl_empty_read_queue(ctl);
 	put_pid(ctl->pid);
@@ -152,7 +149,6 @@
 void snd_ctl_notify(struct snd_card *card, unsigned int mask,
 		    struct snd_ctl_elem_id *id)
 {
-	unsigned long flags;
 	struct snd_ctl_file *ctl;
 	struct snd_kctl_event *ev;
 
@@ -160,34 +156,34 @@
 		return;
 	if (card->shutdown)
 		return;
-	read_lock_irqsave(&card->ctl_files_rwlock, flags);
+
+	guard(read_lock_irqsave)(&card->ctl_files_rwlock);
 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
 	card->mixer_oss_change_count++;
 #endif
 	list_for_each_entry(ctl, &card->ctl_files, list) {
 		if (!ctl->subscribed)
 			continue;
-		spin_lock(&ctl->read_lock);
-		list_for_each_entry(ev, &ctl->events, list) {
-			if (ev->id.numid == id->numid) {
-				ev->mask |= mask;
-				goto _found;
+		scoped_guard(spinlock, &ctl->read_lock) {
+			list_for_each_entry(ev, &ctl->events, list) {
+				if (ev->id.numid == id->numid) {
+					ev->mask |= mask;
+					goto _found;
+				}
 			}
+			ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
+			if (ev) {
+				ev->id = *id;
+				ev->mask = mask;
+				list_add_tail(&ev->list, &ctl->events);
+			} else {
+				dev_err(card->dev, "No memory available to allocate event\n");
+			}
+_found:
+			wake_up(&ctl->change_sleep);
 		}
-		ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
-		if (ev) {
-			ev->id = *id;
-			ev->mask = mask;
-			list_add_tail(&ev->list, &ctl->events);
-		} else {
-			dev_err(card->dev, "No memory available to allocate event\n");
-		}
-	_found:
-		wake_up(&ctl->change_sleep);
-		spin_unlock(&ctl->read_lock);
 		snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN);
 	}
-	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
 }
 EXPORT_SYMBOL(snd_ctl_notify);
 
@@ -210,10 +206,9 @@
 	id.index += ioff;
 	id.numid += ioff;
 	snd_ctl_notify(card, mask, &id);
-	down_read(&snd_ctl_layer_rwsem);
+	guard(rwsem_read)(&snd_ctl_layer_rwsem);
 	for (lops = snd_ctl_layer; lops; lops = lops->next)
 		lops->lnotify(card, mask, kctl, ioff);
-	up_read(&snd_ctl_layer_rwsem);
 }
 EXPORT_SYMBOL(snd_ctl_notify_one);
 
@@ -520,9 +515,9 @@
 	if (snd_BUG_ON(!card || !kcontrol->info))
 		goto error;
 
-	down_write(&card->controls_rwsem);
-	err = __snd_ctl_add_replace(card, kcontrol, mode);
-	up_write(&card->controls_rwsem);
+	scoped_guard(rwsem_write, &card->controls_rwsem)
+		err = __snd_ctl_add_replace(card, kcontrol, mode);
+
 	if (err < 0)
 		goto error;
 	return 0;
@@ -616,12 +611,8 @@
  */
 int snd_ctl_remove(struct snd_card *card, struct snd_kcontrol *kcontrol)
 {
-	int ret;
-
-	down_write(&card->controls_rwsem);
-	ret = snd_ctl_remove_locked(card, kcontrol);
-	up_write(&card->controls_rwsem);
-	return ret;
+	guard(rwsem_write)(&card->controls_rwsem);
+	return snd_ctl_remove_locked(card, kcontrol);
 }
 EXPORT_SYMBOL(snd_ctl_remove);
 
@@ -638,17 +629,12 @@
 int snd_ctl_remove_id(struct snd_card *card, struct snd_ctl_elem_id *id)
 {
 	struct snd_kcontrol *kctl;
-	int ret;
 
-	down_write(&card->controls_rwsem);
+	guard(rwsem_write)(&card->controls_rwsem);
 	kctl = snd_ctl_find_id_locked(card, id);
-	if (kctl == NULL) {
-		up_write(&card->controls_rwsem);
+	if (kctl == NULL)
 		return -ENOENT;
-	}
-	ret = snd_ctl_remove_locked(card, kctl);
-	up_write(&card->controls_rwsem);
-	return ret;
+	return snd_ctl_remove_locked(card, kctl);
 }
 EXPORT_SYMBOL(snd_ctl_remove_id);
 
@@ -667,27 +653,18 @@
 {
 	struct snd_card *card = file->card;
 	struct snd_kcontrol *kctl;
-	int idx, ret;
+	int idx;
 
-	down_write(&card->controls_rwsem);
+	guard(rwsem_write)(&card->controls_rwsem);
 	kctl = snd_ctl_find_id_locked(card, id);
-	if (kctl == NULL) {
-		ret = -ENOENT;
-		goto error;
-	}
-	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
-		ret = -EINVAL;
-		goto error;
-	}
+	if (kctl == NULL)
+		return -ENOENT;
+	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER))
+		return -EINVAL;
 	for (idx = 0; idx < kctl->count; idx++)
-		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
-			ret = -EBUSY;
-			goto error;
-		}
-	ret = snd_ctl_remove_locked(card, kctl);
-error:
-	up_write(&card->controls_rwsem);
-	return ret;
+		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file)
+			return -EBUSY;
+	return snd_ctl_remove_locked(card, kctl);
 }
 
 /**
@@ -764,18 +741,15 @@
 	struct snd_kcontrol *kctl;
 	int saved_numid;
 
-	down_write(&card->controls_rwsem);
+	guard(rwsem_write)(&card->controls_rwsem);
 	kctl = snd_ctl_find_id_locked(card, src_id);
-	if (kctl == NULL) {
-		up_write(&card->controls_rwsem);
+	if (kctl == NULL)
 		return -ENOENT;
-	}
 	saved_numid = kctl->id.numid;
 	remove_hash_entries(card, kctl);
 	kctl->id = *dst_id;
 	kctl->id.numid = saved_numid;
 	add_hash_entries(card, kctl);
-	up_write(&card->controls_rwsem);
 	return 0;
 }
 EXPORT_SYMBOL(snd_ctl_rename_id);
@@ -793,7 +767,7 @@
 void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
 		    const char *name)
 {
-	down_write(&card->controls_rwsem);
+	guard(rwsem_write)(&card->controls_rwsem);
 	remove_hash_entries(card, kctl);
 
 	if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0)
@@ -801,7 +775,6 @@
 			name, kctl->id.name);
 
 	add_hash_entries(card, kctl);
-	up_write(&card->controls_rwsem);
 }
 EXPORT_SYMBOL(snd_ctl_rename);
 
@@ -859,12 +832,8 @@
 struct snd_kcontrol *snd_ctl_find_numid(struct snd_card *card,
 					unsigned int numid)
 {
-	struct snd_kcontrol *kctl;
-
-	down_read(&card->controls_rwsem);
-	kctl = snd_ctl_find_numid_locked(card, numid);
-	up_read(&card->controls_rwsem);
-	return kctl;
+	guard(rwsem_read)(&card->controls_rwsem);
+	return snd_ctl_find_numid_locked(card, numid);
 }
 EXPORT_SYMBOL(snd_ctl_find_numid);
 
@@ -920,37 +889,30 @@
 struct snd_kcontrol *snd_ctl_find_id(struct snd_card *card,
 				     const struct snd_ctl_elem_id *id)
 {
-	struct snd_kcontrol *kctl;
-
-	down_read(&card->controls_rwsem);
-	kctl = snd_ctl_find_id_locked(card, id);
-	up_read(&card->controls_rwsem);
-	return kctl;
+	guard(rwsem_read)(&card->controls_rwsem);
+	return snd_ctl_find_id_locked(card, id);
 }
 EXPORT_SYMBOL(snd_ctl_find_id);
 
 static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,
 			     unsigned int cmd, void __user *arg)
 {
-	struct snd_ctl_card_info *info;
+	struct snd_ctl_card_info *info __free(kfree) = NULL;
 
 	info = kzalloc(sizeof(*info), GFP_KERNEL);
 	if (! info)
 		return -ENOMEM;
-	down_read(&snd_ioctl_rwsem);
-	info->card = card->number;
-	strscpy(info->id, card->id, sizeof(info->id));
-	strscpy(info->driver, card->driver, sizeof(info->driver));
-	strscpy(info->name, card->shortname, sizeof(info->name));
-	strscpy(info->longname, card->longname, sizeof(info->longname));
-	strscpy(info->mixername, card->mixername, sizeof(info->mixername));
-	strscpy(info->components, card->components, sizeof(info->components));
-	up_read(&snd_ioctl_rwsem);
-	if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info))) {
-		kfree(info);
-		return -EFAULT;
+	scoped_guard(rwsem_read, &snd_ioctl_rwsem) {
+		info->card = card->number;
+		strscpy(info->id, card->id, sizeof(info->id));
+		strscpy(info->driver, card->driver, sizeof(info->driver));
+		strscpy(info->name, card->shortname, sizeof(info->name));
+		strscpy(info->longname, card->longname, sizeof(info->longname));
+		strscpy(info->mixername, card->mixername, sizeof(info->mixername));
+		strscpy(info->components, card->components, sizeof(info->components));
 	}
-	kfree(info);
+	if (copy_to_user(arg, info, sizeof(struct snd_ctl_card_info)))
+		return -EFAULT;
 	return 0;
 }
 
@@ -960,37 +922,31 @@
 	struct snd_kcontrol *kctl;
 	struct snd_ctl_elem_id id;
 	unsigned int offset, space, jidx;
-	int err = 0;
 
 	offset = list->offset;
 	space = list->space;
 
-	down_read(&card->controls_rwsem);
+	guard(rwsem_read)(&card->controls_rwsem);
 	list->count = card->controls_count;
 	list->used = 0;
-	if (space > 0) {
-		list_for_each_entry(kctl, &card->controls, list) {
-			if (offset >= kctl->count) {
-				offset -= kctl->count;
-				continue;
-			}
-			for (jidx = offset; jidx < kctl->count; jidx++) {
-				snd_ctl_build_ioff(&id, kctl, jidx);
-				if (copy_to_user(list->pids + list->used, &id,
-						 sizeof(id))) {
-					err = -EFAULT;
-					goto out;
-				}
-				list->used++;
-				if (!--space)
-					goto out;
-			}
-			offset = 0;
+	if (!space)
+		return 0;
+	list_for_each_entry(kctl, &card->controls, list) {
+		if (offset >= kctl->count) {
+			offset -= kctl->count;
+			continue;
+		}
+		for (jidx = offset; jidx < kctl->count; jidx++) {
+			snd_ctl_build_ioff(&id, kctl, jidx);
+			if (copy_to_user(list->pids + list->used, &id, sizeof(id)))
+				return -EFAULT;
+			list->used++;
+			if (!--space)
+				return 0;
 		}
+		offset = 0;
 	}
- out:
-	up_read(&card->controls_rwsem);
-	return err;
+	return 0;
 }
 
 static int snd_ctl_elem_list_user(struct snd_card *card,
@@ -1208,10 +1164,7 @@
 #ifdef CONFIG_SND_DEBUG
 	info->access = 0;
 #endif
-	result = snd_power_ref_and_wait(card);
-	if (!result)
-		result = kctl->info(kctl, info);
-	snd_power_unref(card);
+	result = kctl->info(kctl, info);
 	if (result >= 0) {
 		snd_BUG_ON(info->access);
 		index_offset = snd_ctl_get_ioff(kctl, &info->id);
@@ -1238,27 +1191,28 @@
 {
 	struct snd_card *card = ctl->card;
 	struct snd_kcontrol *kctl;
-	int result;
 
-	down_read(&card->controls_rwsem);
+	guard(rwsem_read)(&card->controls_rwsem);
 	kctl = snd_ctl_find_id_locked(card, &info->id);
-	if (kctl == NULL)
-		result = -ENOENT;
-	else
-		result = __snd_ctl_elem_info(card, kctl, info, ctl);
-	up_read(&card->controls_rwsem);
-	return result;
+	if (!kctl)
+		return -ENOENT;
+	return __snd_ctl_elem_info(card, kctl, info, ctl);
 }
 
 static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
 				  struct snd_ctl_elem_info __user *_info)
 {
+	struct snd_card *card = ctl->card;
 	struct snd_ctl_elem_info info;
 	int result;
 
 	if (copy_from_user(&info, _info, sizeof(info)))
 		return -EFAULT;
+	result = snd_power_ref_and_wait(card);
+	if (result)
+		return result;
 	result = snd_ctl_elem_info(ctl, &info);
+	snd_power_unref(card);
 	if (result < 0)
 		return result;
 	/* drop internal access flags */
@@ -1279,19 +1233,15 @@
 	const u32 pattern = 0xdeadbeef;
 	int ret;
 
-	down_read(&card->controls_rwsem);
+	guard(rwsem_read)(&card->controls_rwsem);
 	kctl = snd_ctl_find_id_locked(card, &control->id);
-	if (kctl == NULL) {
-		ret = -ENOENT;
-		goto unlock;
-	}
+	if (!kctl)
+		return -ENOENT;
 
 	index_offset = snd_ctl_get_ioff(kctl, &control->id);
 	vd = &kctl->vd[index_offset];
-	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) {
-		ret = -EPERM;
-		goto unlock;
-	}
+	if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || !kctl->get)
+		return -EPERM;
 
 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
 
@@ -1301,17 +1251,14 @@
 	info.id = control->id;
 	ret = __snd_ctl_elem_info(card, kctl, &info, NULL);
 	if (ret < 0)
-		goto unlock;
+		return ret;
 #endif
 
 	if (!snd_ctl_skip_validation(&info))
 		fill_remaining_elem_value(control, &info, pattern);
-	ret = snd_power_ref_and_wait(card);
-	if (!ret)
-		ret = kctl->get(kctl, control);
-	snd_power_unref(card);
+	ret = kctl->get(kctl, control);
 	if (ret < 0)
-		goto unlock;
+		return ret;
 	if (!snd_ctl_skip_validation(&info) &&
 	    sanity_check_elem_value(card, control, &info, pattern) < 0) {
 		dev_err(card->dev,
@@ -1319,32 +1266,31 @@
 			control->id.iface, control->id.device,
 			control->id.subdevice, control->id.name,
 			control->id.index);
-		ret = -EINVAL;
-		goto unlock;
+		return -EINVAL;
 	}
-unlock:
-	up_read(&card->controls_rwsem);
-	return ret;
+	return 0;
 }
 
 static int snd_ctl_elem_read_user(struct snd_card *card,
 				  struct snd_ctl_elem_value __user *_control)
 {
-	struct snd_ctl_elem_value *control;
+	struct snd_ctl_elem_value *control __free(kfree) = NULL;
 	int result;
 
 	control = memdup_user(_control, sizeof(*control));
 	if (IS_ERR(control))
-		return PTR_ERR(control);
+		return PTR_ERR(no_free_ptr(control));
 
+	result = snd_power_ref_and_wait(card);
+	if (result)
+		return result;
 	result = snd_ctl_elem_read(card, control);
+	snd_power_unref(card);
 	if (result < 0)
-		goto error;
+		return result;
 
 	if (copy_to_user(_control, control, sizeof(*control)))
-		result = -EFAULT;
- error:
-	kfree(control);
+		return -EFAULT;
 	return result;
 }
 
@@ -1354,7 +1300,7 @@
 	struct snd_kcontrol *kctl;
 	struct snd_kcontrol_volatile *vd;
 	unsigned int index_offset;
-	int result;
+	int result = 0;
 
 	down_write(&card->controls_rwsem);
 	kctl = snd_ctl_find_id_locked(card, &control->id);
@@ -1372,9 +1318,8 @@
 	}
 
 	snd_ctl_build_ioff(&control->id, kctl, index_offset);
-	result = snd_power_ref_and_wait(card);
 	/* validate input values */
-	if (IS_ENABLED(CONFIG_SND_CTL_INPUT_VALIDATION) && !result) {
+	if (IS_ENABLED(CONFIG_SND_CTL_INPUT_VALIDATION)) {
 		struct snd_ctl_elem_info info;
 
 		memset(&info, 0, sizeof(info));
@@ -1386,7 +1331,6 @@
 	}
 	if (!result)
 		result = kctl->put(kctl, control);
-	snd_power_unref(card);
 	if (result < 0) {
 		up_write(&card->controls_rwsem);
 		return result;
@@ -1406,23 +1350,25 @@
 static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
 				   struct snd_ctl_elem_value __user *_control)
 {
-	struct snd_ctl_elem_value *control;
+	struct snd_ctl_elem_value *control __free(kfree) = NULL;
 	struct snd_card *card;
 	int result;
 
 	control = memdup_user(_control, sizeof(*control));
 	if (IS_ERR(control))
-		return PTR_ERR(control);
+		return PTR_ERR(no_free_ptr(control));
 
 	card = file->card;
+	result = snd_power_ref_and_wait(card);
+	if (result < 0)
+		return result;
 	result = snd_ctl_elem_write(card, file, control);
+	snd_power_unref(card);
 	if (result < 0)
-		goto error;
+		return result;
 
 	if (copy_to_user(_control, control, sizeof(*control)))
-		result = -EFAULT;
- error:
-	kfree(control);
+		return -EFAULT;
 	return result;
 }
 
@@ -1433,25 +1379,18 @@
 	struct snd_ctl_elem_id id;
 	struct snd_kcontrol *kctl;
 	struct snd_kcontrol_volatile *vd;
-	int result;
 
 	if (copy_from_user(&id, _id, sizeof(id)))
 		return -EFAULT;
-	down_write(&card->controls_rwsem);
+	guard(rwsem_write)(&card->controls_rwsem);
 	kctl = snd_ctl_find_id_locked(card, &id);
-	if (kctl == NULL) {
-		result = -ENOENT;
-	} else {
-		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
-		if (vd->owner != NULL)
-			result = -EBUSY;
-		else {
-			vd->owner = file;
-			result = 0;
-		}
-	}
-	up_write(&card->controls_rwsem);
-	return result;
+	if (!kctl)
+		return -ENOENT;
+	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
+	if (vd->owner)
+		return -EBUSY;
+	vd->owner = file;
+	return 0;
 }
 
 static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
@@ -1461,27 +1400,20 @@
 	struct snd_ctl_elem_id id;
 	struct snd_kcontrol *kctl;
 	struct snd_kcontrol_volatile *vd;
-	int result;
 
 	if (copy_from_user(&id, _id, sizeof(id)))
 		return -EFAULT;
-	down_write(&card->controls_rwsem);
+	guard(rwsem_write)(&card->controls_rwsem);
 	kctl = snd_ctl_find_id_locked(card, &id);
-	if (kctl == NULL) {
-		result = -ENOENT;
-	} else {
-		vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
-		if (vd->owner == NULL)
-			result = -EINVAL;
-		else if (vd->owner != file)
-			result = -EPERM;
-		else {
-			vd->owner = NULL;
-			result = 0;
-		}
-	}
-	up_write(&card->controls_rwsem);
-	return result;
+	if (!kctl)
+		return -ENOENT;
+	vd = &kctl->vd[snd_ctl_get_ioff(kctl, &id)];
+	if (!vd->owner)
+		return -EINVAL;
+	if (vd->owner != file)
+		return -EPERM;
+	vd->owner = NULL;
+	return 0;
 }
 
 struct user_element {
@@ -1553,12 +1485,16 @@
 static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
 				 struct snd_ctl_elem_value *ucontrol)
 {
-	int change;
+	int err, change;
 	struct user_element *ue = kcontrol->private_data;
 	unsigned int size = ue->elem_data_size;
 	char *dst = ue->elem_data +
 			snd_ctl_get_ioff(kcontrol, &ucontrol->id) * size;
 
+	err = sanity_check_input_values(ue->card, ucontrol, &ue->info, false);
+	if (err < 0)
+		return err;
+
 	change = memcmp(&ucontrol->value, dst, size) != 0;
 	if (change)
 		memcpy(dst, &ucontrol->value, size);
@@ -1763,11 +1699,9 @@
 	private_size = value_sizes[info->type] * info->count;
 	alloc_size = compute_user_elem_size(private_size, count);
 
-	down_write(&card->controls_rwsem);
-	if (check_user_elem_overflow(card, alloc_size)) {
-		err = -ENOMEM;
-		goto unlock;
-	}
+	guard(rwsem_write)(&card->controls_rwsem);
+	if (check_user_elem_overflow(card, alloc_size))
+		return -ENOMEM;
 
 	/*
 	 * Keep memory object for this userspace control. After passing this
@@ -1777,13 +1711,12 @@
 	 */
 	err = snd_ctl_new(&kctl, count, access, file);
 	if (err < 0)
-		goto unlock;
+		return err;
 	memcpy(&kctl->id, &info->id, sizeof(kctl->id));
 	ue = kzalloc(alloc_size, GFP_KERNEL);
 	if (!ue) {
 		kfree(kctl);
-		err = -ENOMEM;
-		goto unlock;
+		return -ENOMEM;
 	}
 	kctl->private_data = ue;
 	kctl->private_free = snd_ctl_elem_user_free;
@@ -1801,7 +1734,7 @@
 		err = snd_ctl_elem_init_enum_names(ue);
 		if (err < 0) {
 			snd_ctl_free_one(kctl);
-			goto unlock;
+			return err;
 		}
 	}
 
@@ -1821,7 +1754,7 @@
 	err = __snd_ctl_add_replace(card, kctl, CTL_ADD_EXCLUSIVE);
 	if (err < 0) {
 		snd_ctl_free_one(kctl);
-		goto unlock;
+		return err;
 	}
 	offset = snd_ctl_get_ioff(kctl, &info->id);
 	snd_ctl_build_ioff(&info->id, kctl, offset);
@@ -1832,9 +1765,7 @@
 	 * applications because the field originally means PID of a process
 	 * which locks the element.
 	 */
- unlock:
-	up_write(&card->controls_rwsem);
-	return err;
+	return 0;
 }
 
 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
@@ -1901,7 +1832,7 @@
 		{SNDRV_CTL_TLV_OP_CMD,   SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND},
 	};
 	struct snd_kcontrol_volatile *vd = &kctl->vd[snd_ctl_get_ioff(kctl, id)];
-	int i, ret;
+	int i;
 
 	/* Check support of the request for this element. */
 	for (i = 0; i < ARRAY_SIZE(pairs); ++i) {
@@ -1919,11 +1850,7 @@
 	    vd->owner != NULL && vd->owner != file)
 		return -EPERM;
 
-	ret = snd_power_ref_and_wait(file->card);
-	if (!ret)
-		ret = kctl->tlv.c(kctl, op_flag, size, buf);
-	snd_power_unref(file->card);
-	return ret;
+	return kctl->tlv.c(kctl, op_flag, size, buf);
 }
 
 static int read_tlv_buf(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id,
@@ -2036,34 +1963,41 @@
 	case SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS:
 		return snd_ctl_subscribe_events(ctl, ip);
 	case SNDRV_CTL_IOCTL_TLV_READ:
-		down_read(&ctl->card->controls_rwsem);
-		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
-		up_read(&ctl->card->controls_rwsem);
+		err = snd_power_ref_and_wait(card);
+		if (err < 0)
+			return err;
+		scoped_guard(rwsem_read, &card->controls_rwsem)
+			err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);
+		snd_power_unref(card);
 		return err;
 	case SNDRV_CTL_IOCTL_TLV_WRITE:
-		down_write(&ctl->card->controls_rwsem);
-		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
-		up_write(&ctl->card->controls_rwsem);
+		err = snd_power_ref_and_wait(card);
+		if (err < 0)
+			return err;
+		scoped_guard(rwsem_write, &card->controls_rwsem)
+			err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);
+		snd_power_unref(card);
 		return err;
 	case SNDRV_CTL_IOCTL_TLV_COMMAND:
-		down_write(&ctl->card->controls_rwsem);
-		err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
-		up_write(&ctl->card->controls_rwsem);
+		err = snd_power_ref_and_wait(card);
+		if (err < 0)
+			return err;
+		scoped_guard(rwsem_write, &card->controls_rwsem)
+			err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);
+		snd_power_unref(card);
 		return err;
 	case SNDRV_CTL_IOCTL_POWER:
 		return -ENOPROTOOPT;
 	case SNDRV_CTL_IOCTL_POWER_STATE:
 		return put_user(SNDRV_CTL_POWER_D0, ip) ? -EFAULT : 0;
 	}
-	down_read(&snd_ioctl_rwsem);
+
+	guard(rwsem_read)(&snd_ioctl_rwsem);
 	list_for_each_entry(p, &snd_control_ioctls, list) {
 		err = p->fioctl(card, ctl, cmd, arg);
-		if (err != -ENOIOCTLCMD) {
-			up_read(&snd_ioctl_rwsem);
+		if (err != -ENOIOCTLCMD)
 			return err;
-		}
 	}
-	up_read(&snd_ioctl_rwsem);
 	dev_dbg(card->dev, "unknown ioctl = 0x%x\n", cmd);
 	return -ENOTTY;
 }
@@ -2155,9 +2089,8 @@
 	if (pn == NULL)
 		return -ENOMEM;
 	pn->fioctl = fcn;
-	down_write(&snd_ioctl_rwsem);
+	guard(rwsem_write)(&snd_ioctl_rwsem);
 	list_add_tail(&pn->list, lists);
-	up_write(&snd_ioctl_rwsem);
 	return 0;
 }
 
@@ -2200,16 +2133,14 @@
 
 	if (snd_BUG_ON(!fcn))
 		return -EINVAL;
-	down_write(&snd_ioctl_rwsem);
+	guard(rwsem_write)(&snd_ioctl_rwsem);
 	list_for_each_entry(p, lists, list) {
 		if (p->fioctl == fcn) {
 			list_del(&p->list);
-			up_write(&snd_ioctl_rwsem);
 			kfree(p);
 			return 0;
 		}
 	}
-	up_write(&snd_ioctl_rwsem);
 	snd_BUG();
 	return -EINVAL;
 }
@@ -2256,9 +2187,8 @@
 {
 	struct snd_ctl_file *kctl;
 	int subdevice = -1;
-	unsigned long flags;
 
-	read_lock_irqsave(&card->ctl_files_rwlock, flags);
+	guard(read_lock_irqsave)(&card->ctl_files_rwlock);
 	list_for_each_entry(kctl, &card->ctl_files, list) {
 		if (kctl->pid == task_pid(current)) {
 			subdevice = kctl->preferred_subdevice[type];
@@ -2266,7 +2196,6 @@
 				break;
 		}
 	}
-	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
 	return subdevice;
 }
 EXPORT_SYMBOL_GPL(snd_ctl_get_preferred_subdevice);
@@ -2296,13 +2225,11 @@
 
 	if (module_name == NULL)
 		return 0;
-	down_read(&snd_ctl_layer_rwsem);
-	for (lops = snd_ctl_layer; lops; lops = lops->next)
-		if (strcmp(lops->module_name, module_name) == 0)
-			break;
-	up_read(&snd_ctl_layer_rwsem);
-	if (lops)
-		return 0;
+	scoped_guard(rwsem_read, &snd_ctl_layer_rwsem) {
+		for (lops = snd_ctl_layer; lops; lops = lops->next)
+			if (strcmp(lops->module_name, module_name) == 0)
+				return 0;
+	}
 	return request_module(module_name);
 }
 EXPORT_SYMBOL_GPL(snd_ctl_request_layer);
@@ -2319,16 +2246,15 @@
 	struct snd_card *card;
 	int card_number;
 
-	down_write(&snd_ctl_layer_rwsem);
-	lops->next = snd_ctl_layer;
-	snd_ctl_layer = lops;
-	up_write(&snd_ctl_layer_rwsem);
+	scoped_guard(rwsem_write, &snd_ctl_layer_rwsem) {
+		lops->next = snd_ctl_layer;
+		snd_ctl_layer = lops;
+	}
 	for (card_number = 0; card_number < SNDRV_CARDS; card_number++) {
 		card = snd_card_ref(card_number);
 		if (card) {
-			down_read(&card->controls_rwsem);
-			lops->lregister(card);
-			up_read(&card->controls_rwsem);
+			scoped_guard(rwsem_read, &card->controls_rwsem)
+				lops->lregister(card);
 			snd_card_unref(card);
 		}
 	}
@@ -2347,7 +2273,7 @@
 {
 	struct snd_ctl_layer_ops *lops2, *prev_lops2;
 
-	down_write(&snd_ctl_layer_rwsem);
+	guard(rwsem_write)(&snd_ctl_layer_rwsem);
 	for (lops2 = snd_ctl_layer, prev_lops2 = NULL; lops2; lops2 = lops2->next) {
 		if (lops2 == lops) {
 			if (!prev_lops2)
@@ -2358,7 +2284,6 @@
 		}
 		prev_lops2 = lops2;
 	}
-	up_write(&snd_ctl_layer_rwsem);
 }
 EXPORT_SYMBOL_GPL(snd_ctl_disconnect_layer);
 
@@ -2379,25 +2304,29 @@
 	.fasync =	snd_ctl_fasync,
 };
 
+/* call lops under rwsems; called from snd_ctl_dev_*() below() */
+#define call_snd_ctl_lops(_card, _op)				    \
+	do {							    \
+		struct snd_ctl_layer_ops *lops;			    \
+		guard(rwsem_read)(&(_card)->controls_rwsem);	    \
+		guard(rwsem_read)(&snd_ctl_layer_rwsem);	    \
+		for (lops = snd_ctl_layer; lops; lops = lops->next) \
+			lops->_op(_card);			    \
+	} while (0)
+
 /*
  * registration of the control device
  */
 static int snd_ctl_dev_register(struct snd_device *device)
 {
 	struct snd_card *card = device->device_data;
-	struct snd_ctl_layer_ops *lops;
 	int err;
 
 	err = snd_register_device(SNDRV_DEVICE_TYPE_CONTROL, card, -1,
 				  &snd_ctl_f_ops, card, card->ctl_dev);
 	if (err < 0)
 		return err;
-	down_read(&card->controls_rwsem);
-	down_read(&snd_ctl_layer_rwsem);
-	for (lops = snd_ctl_layer; lops; lops = lops->next)
-		lops->lregister(card);
-	up_read(&snd_ctl_layer_rwsem);
-	up_read(&card->controls_rwsem);
+	call_snd_ctl_lops(card, lregister);
 	return 0;
 }
 
@@ -2408,23 +2337,15 @@
 {
 	struct snd_card *card = device->device_data;
 	struct snd_ctl_file *ctl;
-	struct snd_ctl_layer_ops *lops;
-	unsigned long flags;
 
-	read_lock_irqsave(&card->ctl_files_rwlock, flags);
-	list_for_each_entry(ctl, &card->ctl_files, list) {
-		wake_up(&ctl->change_sleep);
-		snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR);
+	scoped_guard(read_lock_irqsave, &card->ctl_files_rwlock) {
+		list_for_each_entry(ctl, &card->ctl_files, list) {
+			wake_up(&ctl->change_sleep);
+			snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR);
+		}
 	}
-	read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
-
-	down_read(&card->controls_rwsem);
-	down_read(&snd_ctl_layer_rwsem);
-	for (lops = snd_ctl_layer; lops; lops = lops->next)
-		lops->ldisconnect(card);
-	up_read(&snd_ctl_layer_rwsem);
-	up_read(&card->controls_rwsem);
 
+	call_snd_ctl_lops(card, ldisconnect);
 	return snd_unregister_device(card->ctl_dev);
 }
 
@@ -2436,17 +2357,17 @@
 	struct snd_card *card = device->device_data;
 	struct snd_kcontrol *control;
 
-	down_write(&card->controls_rwsem);
-	while (!list_empty(&card->controls)) {
-		control = snd_kcontrol(card->controls.next);
-		__snd_ctl_remove(card, control, false);
-	}
+	scoped_guard(rwsem_write, &card->controls_rwsem) {
+		while (!list_empty(&card->controls)) {
+			control = snd_kcontrol(card->controls.next);
+			__snd_ctl_remove(card, control, false);
+		}
 
 #ifdef CONFIG_SND_CTL_FAST_LOOKUP
-	xa_destroy(&card->ctl_numids);
-	xa_destroy(&card->ctl_hash);
+		xa_destroy(&card->ctl_numids);
+		xa_destroy(&card->ctl_hash);
 #endif
-	up_write(&card->controls_rwsem);
+	}
 	put_device(card->ctl_dev);
 	return 0;
 }
--- linux-qcom-6.8.0.orig/sound/core/control_compat.c
+++ linux-qcom-6.8.0/sound/core/control_compat.c
@@ -79,61 +79,61 @@
 static int snd_ctl_elem_info_compat(struct snd_ctl_file *ctl,
 				    struct snd_ctl_elem_info32 __user *data32)
 {
-	struct snd_ctl_elem_info *data;
+	struct snd_card *card = ctl->card;
+	struct snd_ctl_elem_info *data __free(kfree) = NULL;
 	int err;
 
 	data = kzalloc(sizeof(*data), GFP_KERNEL);
 	if (! data)
 		return -ENOMEM;
 
-	err = -EFAULT;
 	/* copy id */
 	if (copy_from_user(&data->id, &data32->id, sizeof(data->id)))
-		goto error;
+		return -EFAULT;
 	/* we need to copy the item index.
 	 * hope this doesn't break anything..
 	 */
 	if (get_user(data->value.enumerated.item, &data32->value.enumerated.item))
-		goto error;
+		return -EFAULT;
 
+	err = snd_power_ref_and_wait(card);
+	if (err < 0)
+		return err;
 	err = snd_ctl_elem_info(ctl, data);
+	snd_power_unref(card);
 	if (err < 0)
-		goto error;
+		return err;
 	/* restore info to 32bit */
-	err = -EFAULT;
 	/* id, type, access, count */
 	if (copy_to_user(&data32->id, &data->id, sizeof(data->id)) ||
 	    copy_to_user(&data32->type, &data->type, 3 * sizeof(u32)))
-		goto error;
+		return -EFAULT;
 	if (put_user(data->owner, &data32->owner))
-		goto error;
+		return -EFAULT;
 	switch (data->type) {
 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
 		if (put_user(data->value.integer.min, &data32->value.integer.min) ||
 		    put_user(data->value.integer.max, &data32->value.integer.max) ||
 		    put_user(data->value.integer.step, &data32->value.integer.step))
-			goto error;
+			return -EFAULT;
 		break;
 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
 		if (copy_to_user(&data32->value.integer64,
 				 &data->value.integer64,
 				 sizeof(data->value.integer64)))
-			goto error;
+			return -EFAULT;
 		break;
 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
 		if (copy_to_user(&data32->value.enumerated,
 				 &data->value.enumerated,
 				 sizeof(data->value.enumerated)))
-			goto error;
+			return -EFAULT;
 		break;
 	default:
 		break;
 	}
-	err = 0;
- error:
-	kfree(data);
-	return err;
+	return 0;
 }
 
 /* read / write */
@@ -169,31 +169,22 @@
 			int *countp)
 {
 	struct snd_kcontrol *kctl;
-	struct snd_ctl_elem_info *info;
+	struct snd_ctl_elem_info *info __free(kfree) = NULL;
 	int err;
 
-	down_read(&card->controls_rwsem);
+	guard(rwsem_read)(&card->controls_rwsem);
 	kctl = snd_ctl_find_id_locked(card, id);
-	if (! kctl) {
-		up_read(&card->controls_rwsem);
+	if (!kctl)
 		return -ENOENT;
-	}
 	info = kzalloc(sizeof(*info), GFP_KERNEL);
-	if (info == NULL) {
-		up_read(&card->controls_rwsem);
+	if (info == NULL)
 		return -ENOMEM;
-	}
 	info->id = *id;
-	err = snd_power_ref_and_wait(card);
-	if (!err)
-		err = kctl->info(kctl, info);
-	snd_power_unref(card);
-	up_read(&card->controls_rwsem);
+	err = kctl->info(kctl, info);
 	if (err >= 0) {
 		err = info->type;
 		*countp = info->count;
 	}
-	kfree(info);
 	return err;
 }
 
@@ -286,10 +277,10 @@
 	return 0;
 }
 
-static int ctl_elem_read_user(struct snd_card *card,
-			      void __user *userdata, void __user *valuep)
+static int __ctl_elem_read_user(struct snd_card *card,
+				void __user *userdata, void __user *valuep)
 {
-	struct snd_ctl_elem_value *data;
+	struct snd_ctl_elem_value *data __free(kfree) = NULL;
 	int err, type, count;
 
 	data = kzalloc(sizeof(*data), GFP_KERNEL);
@@ -299,21 +290,31 @@
 	err = copy_ctl_value_from_user(card, data, userdata, valuep,
 				       &type, &count);
 	if (err < 0)
-		goto error;
+		return err;
 
 	err = snd_ctl_elem_read(card, data);
 	if (err < 0)
-		goto error;
-	err = copy_ctl_value_to_user(userdata, valuep, data, type, count);
- error:
-	kfree(data);
+		return err;
+	return copy_ctl_value_to_user(userdata, valuep, data, type, count);
+}
+
+static int ctl_elem_read_user(struct snd_card *card,
+			      void __user *userdata, void __user *valuep)
+{
+	int err;
+
+	err = snd_power_ref_and_wait(card);
+	if (err < 0)
+		return err;
+	err = __ctl_elem_read_user(card, userdata, valuep);
+	snd_power_unref(card);
 	return err;
 }
 
-static int ctl_elem_write_user(struct snd_ctl_file *file,
-			       void __user *userdata, void __user *valuep)
+static int __ctl_elem_write_user(struct snd_ctl_file *file,
+				 void __user *userdata, void __user *valuep)
 {
-	struct snd_ctl_elem_value *data;
+	struct snd_ctl_elem_value *data __free(kfree) = NULL;
 	struct snd_card *card = file->card;
 	int err, type, count;
 
@@ -324,14 +325,25 @@
 	err = copy_ctl_value_from_user(card, data, userdata, valuep,
 				       &type, &count);
 	if (err < 0)
-		goto error;
+		return err;
 
 	err = snd_ctl_elem_write(card, file, data);
 	if (err < 0)
-		goto error;
-	err = copy_ctl_value_to_user(userdata, valuep, data, type, count);
- error:
-	kfree(data);
+		return err;
+	return copy_ctl_value_to_user(userdata, valuep, data, type, count);
+}
+
+static int ctl_elem_write_user(struct snd_ctl_file *file,
+			       void __user *userdata, void __user *valuep)
+{
+	struct snd_card *card = file->card;
+	int err;
+
+	err = snd_power_ref_and_wait(card);
+	if (err < 0)
+		return err;
+	err = __ctl_elem_write_user(file, userdata, valuep);
+	snd_power_unref(card);
 	return err;
 }
 
@@ -366,49 +378,44 @@
 				   struct snd_ctl_elem_info32 __user *data32,
 				   int replace)
 {
-	struct snd_ctl_elem_info *data;
-	int err;
+	struct snd_ctl_elem_info *data __free(kfree) = NULL;
 
 	data = kzalloc(sizeof(*data), GFP_KERNEL);
 	if (! data)
 		return -ENOMEM;
 
-	err = -EFAULT;
 	/* id, type, access, count */ \
 	if (copy_from_user(&data->id, &data32->id, sizeof(data->id)) ||
 	    copy_from_user(&data->type, &data32->type, 3 * sizeof(u32)))
-		goto error;
+		return -EFAULT;
 	if (get_user(data->owner, &data32->owner))
-		goto error;
+		return -EFAULT;
 	switch (data->type) {
 	case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
 	case SNDRV_CTL_ELEM_TYPE_INTEGER:
 		if (get_user(data->value.integer.min, &data32->value.integer.min) ||
 		    get_user(data->value.integer.max, &data32->value.integer.max) ||
 		    get_user(data->value.integer.step, &data32->value.integer.step))
-			goto error;
+			return -EFAULT;
 		break;
 	case SNDRV_CTL_ELEM_TYPE_INTEGER64:
 		if (copy_from_user(&data->value.integer64,
 				   &data32->value.integer64,
 				   sizeof(data->value.integer64)))
-			goto error;
+			return -EFAULT;
 		break;
 	case SNDRV_CTL_ELEM_TYPE_ENUMERATED:
 		if (copy_from_user(&data->value.enumerated,
 				   &data32->value.enumerated,
 				   sizeof(data->value.enumerated)))
-			goto error;
+			return -EFAULT;
 		data->value.enumerated.names_ptr =
 			(uintptr_t)compat_ptr(data->value.enumerated.names_ptr);
 		break;
 	default:
 		break;
 	}
-	err = snd_ctl_elem_add(file, data, replace);
- error:
-	kfree(data);
-	return err;
+	return snd_ctl_elem_add(file, data, replace);
 }  
 
 enum {
@@ -468,16 +475,13 @@
 #endif /* CONFIG_X86_X32_ABI */
 	}
 
-	down_read(&snd_ioctl_rwsem);
+	guard(rwsem_read)(&snd_ioctl_rwsem);
 	list_for_each_entry(p, &snd_control_compat_ioctls, list) {
 		if (p->fioctl) {
 			err = p->fioctl(ctl->card, ctl, cmd, arg);
-			if (err != -ENOIOCTLCMD) {
-				up_read(&snd_ioctl_rwsem);
+			if (err != -ENOIOCTLCMD)
 				return err;
-			}
 		}
 	}
-	up_read(&snd_ioctl_rwsem);
 	return -ENOIOCTLCMD;
 }
--- linux-qcom-6.8.0.orig/sound/core/control_led.c
+++ linux-qcom-6.8.0/sound/core/control_led.c
@@ -688,10 +688,16 @@
 			goto cerr;
 		led->cards[card->number] = led_card;
 		snprintf(link_name, sizeof(link_name), "led-%s", led->name);
-		WARN(sysfs_create_link(&card->ctl_dev->kobj, &led_card->dev.kobj, link_name),
-			"can't create symlink to controlC%i device\n", card->number);
-		WARN(sysfs_create_link(&led_card->dev.kobj, &card->card_dev.kobj, "card"),
-			"can't create symlink to card%i\n", card->number);
+		if (sysfs_create_link(&card->ctl_dev->kobj, &led_card->dev.kobj,
+				      link_name))
+			dev_err(card->dev,
+				"%s: can't create symlink to controlC%i device\n",
+				 __func__, card->number);
+		if (sysfs_create_link(&led_card->dev.kobj, &card->card_dev.kobj,
+				      "card"))
+			dev_err(card->dev,
+				"%s: can't create symlink to card%i\n",
+				__func__, card->number);
 
 		continue;
 cerr:
--- linux-qcom-6.8.0.orig/sound/core/init.c
+++ linux-qcom-6.8.0/sound/core/init.c
@@ -312,8 +312,8 @@
 	card->number = idx;
 #ifdef MODULE
 	WARN_ON(!module);
-	card->module = module;
 #endif
+	card->module = module;
 	INIT_LIST_HEAD(&card->devices);
 	init_rwsem(&card->controls_rwsem);
 	rwlock_init(&card->ctl_files_rwlock);
@@ -523,6 +523,14 @@
 	}
 	spin_unlock(&card->files_lock);	
 
+#ifdef CONFIG_PM
+	/* wake up sleepers here before other callbacks for avoiding potential
+	 * deadlocks with other locks (e.g. in kctls);
+	 * then this notifies the shutdown and sleepers would abort immediately
+	 */
+	wake_up_all(&card->power_sleep);
+#endif
+
 	/* notify all connected devices about disconnection */
 	/* at this point, they cannot respond to any calls except release() */
 
@@ -538,6 +546,11 @@
 		synchronize_irq(card->sync_irq);
 
 	snd_info_card_disconnect(card);
+#ifdef CONFIG_SND_DEBUG
+	debugfs_remove(card->debugfs_root);
+	card->debugfs_root = NULL;
+#endif
+
 	if (card->registered) {
 		device_del(&card->card_dev);
 		card->registered = false;
@@ -550,7 +563,6 @@
 	mutex_unlock(&snd_card_mutex);
 
 #ifdef CONFIG_PM
-	wake_up(&card->power_sleep);
 	snd_power_sync_ref(card);
 #endif
 }
@@ -591,10 +603,6 @@
 		dev_warn(card->dev, "unable to free card info\n");
 		/* Not fatal error */
 	}
-#ifdef CONFIG_SND_DEBUG
-	debugfs_remove(card->debugfs_root);
-	card->debugfs_root = NULL;
-#endif
 	if (card->release_completion)
 		complete(card->release_completion);
 	if (!card->managed)
@@ -658,13 +666,19 @@
 }
 EXPORT_SYMBOL(snd_card_free);
 
+/* check, if the character is in the valid ASCII range */
+static inline bool safe_ascii_char(char c)
+{
+	return isascii(c) && isalnum(c);
+}
+
 /* retrieve the last word of shortname or longname */
 static const char *retrieve_id_from_card_name(const char *name)
 {
 	const char *spos = name;
 
 	while (*name) {
-		if (isspace(*name) && isalnum(name[1]))
+		if (isspace(*name) && safe_ascii_char(name[1]))
 			spos = name + 1;
 		name++;
 	}
@@ -691,12 +705,12 @@
 {
 	char *id = card->id;
 
-	while (*nid && !isalnum(*nid))
+	while (*nid && !safe_ascii_char(*nid))
 		nid++;
 	if (isdigit(*nid))
 		*id++ = isalpha(*src) ? *src : 'D';
 	while (*nid && (size_t)(id - card->id) < sizeof(card->id) - 1) {
-		if (isalnum(*nid))
+		if (safe_ascii_char(*nid))
 			*id++ = *nid;
 		nid++;
 	}
@@ -792,7 +806,7 @@
 
 	for (idx = 0; idx < copy; idx++) {
 		c = buf[idx];
-		if (!isalnum(c) && c != '_' && c != '-')
+		if (!safe_ascii_char(c) && c != '_' && c != '-')
 			return -EINVAL;
 	}
 	memcpy(buf1, buf, copy);
--- linux-qcom-6.8.0.orig/sound/core/jack.c
+++ linux-qcom-6.8.0/sound/core/jack.c
@@ -37,16 +37,18 @@
 };
 #endif /* CONFIG_SND_JACK_INPUT_DEV */
 
+static void snd_jack_remove_debugfs(struct snd_jack *jack);
+
 static int snd_jack_dev_disconnect(struct snd_device *device)
 {
-#ifdef CONFIG_SND_JACK_INPUT_DEV
 	struct snd_jack *jack = device->device_data;
 
-	mutex_lock(&jack->input_dev_lock);
-	if (!jack->input_dev) {
-		mutex_unlock(&jack->input_dev_lock);
+	snd_jack_remove_debugfs(jack);
+
+#ifdef CONFIG_SND_JACK_INPUT_DEV
+	guard(mutex)(&jack->input_dev_lock);
+	if (!jack->input_dev)
 		return 0;
-	}
 
 	/* If the input device is registered with the input subsystem
 	 * then we need to use a different deallocator. */
@@ -55,7 +57,6 @@
 	else
 		input_free_device(jack->input_dev);
 	jack->input_dev = NULL;
-	mutex_unlock(&jack->input_dev_lock);
 #endif /* CONFIG_SND_JACK_INPUT_DEV */
 	return 0;
 }
@@ -92,11 +93,9 @@
 	snprintf(jack->name, sizeof(jack->name), "%s %s",
 		 card->shortname, jack->id);
 
-	mutex_lock(&jack->input_dev_lock);
-	if (!jack->input_dev) {
-		mutex_unlock(&jack->input_dev_lock);
+	guard(mutex)(&jack->input_dev_lock);
+	if (!jack->input_dev)
 		return 0;
-	}
 
 	jack->input_dev->name = jack->name;
 
@@ -121,7 +120,6 @@
 	if (err == 0)
 		jack->registered = 1;
 
-	mutex_unlock(&jack->input_dev_lock);
 	return err;
 }
 #endif /* CONFIG_SND_JACK_INPUT_DEV */
@@ -387,10 +385,14 @@
 	return 0;
 }
 
-static void snd_jack_debugfs_clear_inject_node(struct snd_jack_kctl *jack_kctl)
+static void snd_jack_remove_debugfs(struct snd_jack *jack)
 {
-	debugfs_remove(jack_kctl->jack_debugfs_root);
-	jack_kctl->jack_debugfs_root = NULL;
+	struct snd_jack_kctl *jack_kctl;
+
+	list_for_each_entry(jack_kctl, &jack->kctl_list, list) {
+		debugfs_remove(jack_kctl->jack_debugfs_root);
+		jack_kctl->jack_debugfs_root = NULL;
+	}
 }
 #else /* CONFIG_SND_JACK_INJECTION_DEBUG */
 static int snd_jack_debugfs_add_inject_node(struct snd_jack *jack,
@@ -399,7 +401,7 @@
 	return 0;
 }
 
-static void snd_jack_debugfs_clear_inject_node(struct snd_jack_kctl *jack_kctl)
+static void snd_jack_remove_debugfs(struct snd_jack *jack)
 {
 }
 #endif /* CONFIG_SND_JACK_INJECTION_DEBUG */
@@ -410,7 +412,6 @@
 
 	jack_kctl = kctl->private_data;
 	if (jack_kctl) {
-		snd_jack_debugfs_clear_inject_node(jack_kctl);
 		list_del(&jack_kctl->list);
 		kfree(jack_kctl);
 	}
@@ -503,8 +504,8 @@
 		.dev_free = snd_jack_dev_free,
 #ifdef CONFIG_SND_JACK_INPUT_DEV
 		.dev_register = snd_jack_dev_register,
-		.dev_disconnect = snd_jack_dev_disconnect,
 #endif /* CONFIG_SND_JACK_INPUT_DEV */
+		.dev_disconnect = snd_jack_dev_disconnect,
 	};
 
 	if (initial_kctl) {
@@ -586,14 +587,9 @@
 void snd_jack_set_parent(struct snd_jack *jack, struct device *parent)
 {
 	WARN_ON(jack->registered);
-	mutex_lock(&jack->input_dev_lock);
-	if (!jack->input_dev) {
-		mutex_unlock(&jack->input_dev_lock);
-		return;
-	}
-
-	jack->input_dev->dev.parent = parent;
-	mutex_unlock(&jack->input_dev_lock);
+	guard(mutex)(&jack->input_dev_lock);
+	if (jack->input_dev)
+		jack->input_dev->dev.parent = parent;
 }
 EXPORT_SYMBOL(snd_jack_set_parent);
 
--- linux-qcom-6.8.0.orig/sound/core/oss/mixer_oss.c
+++ linux-qcom-6.8.0/sound/core/oss/mixer_oss.c
@@ -967,8 +967,8 @@
 	struct slot *p = chn->private_data;
 	if (p) {
 		if (p->allocated && p->assigned) {
-			kfree_const(p->assigned->name);
-			kfree_const(p->assigned);
+			kfree(p->assigned->name);
+			kfree(p->assigned);
 		}
 		kfree(p);
 	}
--- linux-qcom-6.8.0.orig/sound/core/pcm_dmaengine.c
+++ linux-qcom-6.8.0/sound/core/pcm_dmaengine.c
@@ -349,6 +349,20 @@
 }
 EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_open_request_chan);
 
+int snd_dmaengine_pcm_sync_stop(struct snd_pcm_substream *substream)
+{
+	struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	struct dma_tx_state state;
+	enum dma_status status;
+
+	status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state);
+	if (status != DMA_PAUSED)
+		dmaengine_synchronize(prtd->dma_chan);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_sync_stop);
+
 /**
  * snd_dmaengine_pcm_close - Close a dmaengine based PCM substream
  * @substream: PCM substream
@@ -358,6 +372,12 @@
 int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream)
 {
 	struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	struct dma_tx_state state;
+	enum dma_status status;
+
+	status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state);
+	if (status == DMA_PAUSED)
+		dmaengine_terminate_async(prtd->dma_chan);
 
 	dmaengine_synchronize(prtd->dma_chan);
 	kfree(prtd);
@@ -378,6 +398,12 @@
 int snd_dmaengine_pcm_close_release_chan(struct snd_pcm_substream *substream)
 {
 	struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	struct dma_tx_state state;
+	enum dma_status status;
+
+	status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state);
+	if (status == DMA_PAUSED)
+		dmaengine_terminate_async(prtd->dma_chan);
 
 	dmaengine_synchronize(prtd->dma_chan);
 	dma_release_channel(prtd->dma_chan);
--- linux-qcom-6.8.0.orig/sound/core/pcm_native.c
+++ linux-qcom-6.8.0/sound/core/pcm_native.c
@@ -1805,6 +1805,8 @@
 			      snd_pcm_state_t state)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
+	if (runtime->state != SNDRV_PCM_STATE_SUSPENDED)
+		return -EBADFD;
 	if (!(runtime->info & SNDRV_PCM_INFO_RESUME))
 		return -ENOSYS;
 	runtime->trigger_master = substream;
@@ -3848,9 +3850,11 @@
 		return VM_FAULT_SIGBUS;
 	if (substream->ops->page)
 		page = substream->ops->page(substream, offset);
-	else if (!snd_pcm_get_dma_buf(substream))
+	else if (!snd_pcm_get_dma_buf(substream)) {
+		if (WARN_ON_ONCE(!runtime->dma_area))
+			return VM_FAULT_SIGBUS;
 		page = virt_to_page(runtime->dma_area + offset);
-	else
+	} else
 		page = snd_sgbuf_get_page(snd_pcm_get_dma_buf(substream), offset);
 	if (!page)
 		return VM_FAULT_SIGBUS;
--- linux-qcom-6.8.0.orig/sound/core/seq/oss/seq_oss_synth.c
+++ linux-qcom-6.8.0/sound/core/seq/oss/seq_oss_synth.c
@@ -66,6 +66,7 @@
 };
 
 static DEFINE_SPINLOCK(register_lock);
+static DEFINE_MUTEX(sysex_mutex);
 
 /*
  * prototypes
@@ -497,6 +498,7 @@
 	if (!info)
 		return -ENXIO;
 
+	guard(mutex)(&sysex_mutex);
 	sysex = info->sysex;
 	if (sysex == NULL) {
 		sysex = kzalloc(sizeof(*sysex), GFP_KERNEL);
--- linux-qcom-6.8.0.orig/sound/core/seq/seq_clientmgr.c
+++ linux-qcom-6.8.0/sound/core/seq/seq_clientmgr.c
@@ -537,6 +537,9 @@
 		return NULL;
 	if (! dest->accept_input)
 		goto __not_avail;
+	if (snd_seq_ev_is_ump(event))
+		return dest; /* ok - no filter checks */
+
 	if ((dest->filter & SNDRV_SEQ_FILTER_USE_EVENT) &&
 	    ! test_bit(event->type, dest->event_filter))
 		goto __not_avail;
@@ -1277,10 +1280,16 @@
 	if (client->type != client_info->type)
 		return -EINVAL;
 
-	/* check validity of midi_version field */
-	if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3) &&
-	    client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0)
-		return -EINVAL;
+	if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3)) {
+		/* check validity of midi_version field */
+		if (client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0)
+			return -EINVAL;
+
+		/* check if UMP is supported in kernel */
+		if (!IS_ENABLED(CONFIG_SND_SEQ_UMP) &&
+		    client_info->midi_version > 0)
+			return -EINVAL;
+	}
 
 	/* fill the info fields */
 	if (client_info->name[0])
--- linux-qcom-6.8.0.orig/sound/core/seq/seq_midi.c
+++ linux-qcom-6.8.0/sound/core/seq/seq_midi.c
@@ -113,6 +113,12 @@
 	return 0;
 }
 
+/* callback for snd_seq_dump_var_event(), bridging to dump_midi() */
+static int __dump_midi(void *ptr, void *buf, int count)
+{
+	return dump_midi(ptr, buf, count);
+}
+
 static int event_process_midi(struct snd_seq_event *ev, int direct,
 			      void *private_data, int atomic, int hop)
 {
@@ -132,7 +138,7 @@
 			pr_debug("ALSA: seq_midi: invalid sysex event flags = 0x%x\n", ev->flags);
 			return 0;
 		}
-		snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)dump_midi, substream);
+		snd_seq_dump_var_event(ev, __dump_midi, substream);
 		snd_midi_event_reset_decode(msynth->parser);
 	} else {
 		if (msynth->parser == NULL)
--- linux-qcom-6.8.0.orig/sound/core/seq/seq_ports.h
+++ linux-qcom-6.8.0/sound/core/seq/seq_ports.h
@@ -7,6 +7,7 @@
 #define __SND_SEQ_PORTS_H
 
 #include <sound/seq_kernel.h>
+#include <sound/ump_convert.h>
 #include "seq_lock.h"
 
 /* list of 'exported' ports */
@@ -42,17 +43,6 @@
 	int (*close)(void *private_data, struct snd_seq_port_subscribe *info);
 };
 
-/* context for converting from legacy control event to UMP packet */
-struct snd_seq_ump_midi2_bank {
-	bool rpn_set;
-	bool nrpn_set;
-	bool bank_set;
-	unsigned char cc_rpn_msb, cc_rpn_lsb;
-	unsigned char cc_nrpn_msb, cc_nrpn_lsb;
-	unsigned char cc_data_msb, cc_data_lsb;
-	unsigned char cc_bank_msb, cc_bank_lsb;
-};
-
 struct snd_seq_client_port {
 
 	struct snd_seq_addr addr;	/* client/port number */
@@ -88,7 +78,7 @@
 	unsigned char ump_group;
 
 #if IS_ENABLED(CONFIG_SND_SEQ_UMP)
-	struct snd_seq_ump_midi2_bank midi2_bank[16]; /* per channel */
+	struct ump_cvt_to_ump_bank midi2_bank[16]; /* per channel */
 #endif
 };
 
--- linux-qcom-6.8.0.orig/sound/core/seq/seq_ump_client.c
+++ linux-qcom-6.8.0/sound/core/seq/seq_ump_client.c
@@ -23,14 +23,6 @@
 	STR_OUT = SNDRV_RAWMIDI_STREAM_OUTPUT
 };
 
-/* object per UMP group; corresponding to a sequencer port */
-struct seq_ump_group {
-	int group;			/* group index (0-based) */
-	unsigned int dir_bits;		/* directions */
-	bool active;			/* activeness */
-	char name[64];			/* seq port name */
-};
-
 /* context for UMP input parsing, per EP */
 struct seq_ump_input_buffer {
 	unsigned char len;		/* total length in words */
@@ -47,7 +39,6 @@
 	int opened[2];			/* current opens for each direction */
 	struct snd_rawmidi_file out_rfile; /* rawmidi for output */
 	struct seq_ump_input_buffer input; /* input parser context */
-	struct seq_ump_group groups[SNDRV_UMP_MAX_GROUPS]; /* table of groups */
 	void *ump_info[SNDRV_UMP_MAX_BLOCKS + 1]; /* shadow of seq client ump_info */
 	struct work_struct group_notify_work; /* FB change notification */
 };
@@ -177,7 +168,7 @@
 /* fill port_info from the given UMP EP and group info */
 static void fill_port_info(struct snd_seq_port_info *port,
 			   struct seq_ump_client *client,
-			   struct seq_ump_group *group)
+			   struct snd_ump_group *group)
 {
 	unsigned int rawmidi_info = client->ump->core.info_flags;
 
@@ -213,19 +204,26 @@
 		sprintf(port->name, "Group %d", group->group + 1);
 }
 
+/* skip non-existing group for static blocks */
+static bool skip_group(struct seq_ump_client *client, struct snd_ump_group *group)
+{
+	return !group->valid &&
+		(client->ump->info.flags & SNDRV_UMP_EP_INFO_STATIC_BLOCKS);
+}
+
 /* create a new sequencer port per UMP group */
 static int seq_ump_group_init(struct seq_ump_client *client, int group_index)
 {
-	struct seq_ump_group *group = &client->groups[group_index];
-	struct snd_seq_port_info *port;
+	struct snd_ump_group *group = &client->ump->groups[group_index];
+	struct snd_seq_port_info *port __free(kfree) = NULL;
 	struct snd_seq_port_callback pcallbacks;
-	int err;
+
+	if (skip_group(client, group))
+		return 0;
 
 	port = kzalloc(sizeof(*port), GFP_KERNEL);
-	if (!port) {
-		err = -ENOMEM;
-		goto error;
-	}
+	if (!port)
+		return -ENOMEM;
 
 	fill_port_info(port, client, group);
 	port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
@@ -238,34 +236,35 @@
 	pcallbacks.unuse = seq_ump_unuse;
 	pcallbacks.event_input = seq_ump_process_event;
 	port->kernel = &pcallbacks;
-	err = snd_seq_kernel_client_ctl(client->seq_client,
-					SNDRV_SEQ_IOCTL_CREATE_PORT,
-					port);
- error:
-	kfree(port);
-	return err;
+	return snd_seq_kernel_client_ctl(client->seq_client,
+					 SNDRV_SEQ_IOCTL_CREATE_PORT,
+					 port);
 }
 
 /* update the sequencer ports; called from notify_fb_change callback */
 static void update_port_infos(struct seq_ump_client *client)
 {
-	struct snd_seq_port_info *old, *new;
+	struct snd_seq_port_info *old __free(kfree) = NULL;
+	struct snd_seq_port_info *new __free(kfree) = NULL;
 	int i, err;
 
 	old = kzalloc(sizeof(*old), GFP_KERNEL);
 	new = kzalloc(sizeof(*new), GFP_KERNEL);
 	if (!old || !new)
-		goto error;
+		return;
 
 	for (i = 0; i < SNDRV_UMP_MAX_GROUPS; i++) {
+		if (skip_group(client, &client->ump->groups[i]))
+			continue;
+
 		old->addr.client = client->seq_client;
-		old->addr.port = i;
+		old->addr.port = ump_group_to_seq_port(i);
 		err = snd_seq_kernel_client_ctl(client->seq_client,
 						SNDRV_SEQ_IOCTL_GET_PORT_INFO,
 						old);
 		if (err < 0)
-			goto error;
-		fill_port_info(new, client, &client->groups[i]);
+			continue;
+		fill_port_info(new, client, &client->ump->groups[i]);
 		if (old->capability == new->capability &&
 		    !strcmp(old->name, new->name))
 			continue;
@@ -273,68 +272,16 @@
 						SNDRV_SEQ_IOCTL_SET_PORT_INFO,
 						new);
 		if (err < 0)
-			goto error;
+			continue;
 		/* notify to system port */
 		snd_seq_system_client_ev_port_change(client->seq_client, i);
 	}
- error:
-	kfree(new);
-	kfree(old);
-}
-
-/* update dir_bits and active flag for all groups in the client */
-static void update_group_attrs(struct seq_ump_client *client)
-{
-	struct snd_ump_block *fb;
-	struct seq_ump_group *group;
-	int i;
-
-	for (i = 0; i < SNDRV_UMP_MAX_GROUPS; i++) {
-		group = &client->groups[i];
-		*group->name = 0;
-		group->dir_bits = 0;
-		group->active = 0;
-		group->group = i;
-	}
-
-	list_for_each_entry(fb, &client->ump->block_list, list) {
-		if (fb->info.first_group + fb->info.num_groups > SNDRV_UMP_MAX_GROUPS)
-			break;
-		group = &client->groups[fb->info.first_group];
-		for (i = 0; i < fb->info.num_groups; i++, group++) {
-			if (fb->info.active)
-				group->active = 1;
-			switch (fb->info.direction) {
-			case SNDRV_UMP_DIR_INPUT:
-				group->dir_bits |= (1 << STR_IN);
-				break;
-			case SNDRV_UMP_DIR_OUTPUT:
-				group->dir_bits |= (1 << STR_OUT);
-				break;
-			case SNDRV_UMP_DIR_BIDIRECTION:
-				group->dir_bits |= (1 << STR_OUT) | (1 << STR_IN);
-				break;
-			}
-			if (!*fb->info.name)
-				continue;
-			if (!*group->name) {
-				/* store the first matching name */
-				strscpy(group->name, fb->info.name,
-					sizeof(group->name));
-			} else {
-				/* when overlapping, concat names */
-				strlcat(group->name, ", ", sizeof(group->name));
-				strlcat(group->name, fb->info.name,
-					sizeof(group->name));
-			}
-		}
-	}
 }
 
 /* create a UMP Endpoint port */
 static int create_ump_endpoint_port(struct seq_ump_client *client)
 {
-	struct snd_seq_port_info *port;
+	struct snd_seq_port_info *port __free(kfree) = NULL;
 	struct snd_seq_port_callback pcallbacks;
 	unsigned int rawmidi_info = client->ump->core.info_flags;
 	int err;
@@ -383,7 +330,6 @@
 	err = snd_seq_kernel_client_ctl(client->seq_client,
 					SNDRV_SEQ_IOCTL_CREATE_PORT,
 					port);
-	kfree(port);
 	return err;
 }
 
@@ -428,7 +374,7 @@
 		return;
 	filter = ~(1U << 0); /* always allow groupless messages */
 	for (p = 0; p < SNDRV_UMP_MAX_GROUPS; p++) {
-		if (client->groups[p].active)
+		if (client->ump->groups[p].active)
 			filter &= ~(1U << (p + 1));
 	}
 	cptr->group_filter = filter;
@@ -441,7 +387,6 @@
 	struct seq_ump_client *client =
 		container_of(work, struct seq_ump_client, group_notify_work);
 
-	update_group_attrs(client);
 	update_port_infos(client);
 	setup_client_group_filter(client);
 }
@@ -504,7 +449,6 @@
 		client->ump_info[fb->info.block_id + 1] = &fb->info;
 
 	setup_client_midi_version(client);
-	update_group_attrs(client);
 
 	for (p = 0; p < SNDRV_UMP_MAX_GROUPS; p++) {
 		err = seq_ump_group_init(client, p);
--- linux-qcom-6.8.0.orig/sound/core/seq/seq_ump_convert.c
+++ linux-qcom-6.8.0/sound/core/seq/seq_ump_convert.c
@@ -157,7 +157,7 @@
 static void ump_system_to_songpos_ev(const union snd_ump_midi1_msg *val,
 				     struct snd_seq_event *ev)
 {
-	ev->data.control.value = (val->system.parm1 << 7) | val->system.parm2;
+	ev->data.control.value = (val->system.parm2 << 7) | val->system.parm1;
 }
 
 /* Encoders for 0xf0 - 0xff */
@@ -368,6 +368,7 @@
 	struct snd_seq_ump_event ev_cvt;
 	const union snd_ump_midi1_msg *midi1 = (const union snd_ump_midi1_msg *)event->ump;
 	union snd_ump_midi2_msg *midi2 = (union snd_ump_midi2_msg *)ev_cvt.ump;
+	struct ump_cvt_to_ump_bank *cc;
 
 	ev_cvt = *event;
 	memset(&ev_cvt.ump, 0, sizeof(ev_cvt.ump));
@@ -387,11 +388,29 @@
 		midi2->paf.data = upscale_7_to_32bit(midi1->paf.data);
 		break;
 	case UMP_MSG_STATUS_CC:
+		cc = &dest_port->midi2_bank[midi1->note.channel];
+		switch (midi1->cc.index) {
+		case UMP_CC_BANK_SELECT:
+			cc->bank_set = 1;
+			cc->cc_bank_msb = midi1->cc.data;
+			return 0; // skip
+		case UMP_CC_BANK_SELECT_LSB:
+			cc->bank_set = 1;
+			cc->cc_bank_lsb = midi1->cc.data;
+			return 0; // skip
+		}
 		midi2->cc.index = midi1->cc.index;
 		midi2->cc.data = upscale_7_to_32bit(midi1->cc.data);
 		break;
 	case UMP_MSG_STATUS_PROGRAM:
 		midi2->pg.program = midi1->pg.program;
+		cc = &dest_port->midi2_bank[midi1->note.channel];
+		if (cc->bank_set) {
+			midi2->pg.bank_valid = 1;
+			midi2->pg.bank_msb = cc->cc_bank_msb;
+			midi2->pg.bank_lsb = cc->cc_bank_lsb;
+			cc->bank_set = 0;
+		}
 		break;
 	case UMP_MSG_STATUS_CHANNEL_PRESSURE:
 		midi2->caf.data = upscale_7_to_32bit(midi1->caf.data);
@@ -419,6 +438,7 @@
 	struct snd_seq_ump_event ev_cvt;
 	union snd_ump_midi1_msg *midi1 = (union snd_ump_midi1_msg *)ev_cvt.ump;
 	const union snd_ump_midi2_msg *midi2 = (const union snd_ump_midi2_msg *)event->ump;
+	int err;
 	u16 v;
 
 	ev_cvt = *event;
@@ -428,7 +448,7 @@
 	midi1->note.group = midi2->note.group;
 	midi1->note.status = midi2->note.status;
 	midi1->note.channel = midi2->note.channel;
-	switch (midi2->note.status << 4) {
+	switch (midi2->note.status) {
 	case UMP_MSG_STATUS_NOTE_ON:
 	case UMP_MSG_STATUS_NOTE_OFF:
 		midi1->note.note = midi2->note.note;
@@ -443,6 +463,24 @@
 		midi1->cc.data = downscale_32_to_7bit(midi2->cc.data);
 		break;
 	case UMP_MSG_STATUS_PROGRAM:
+		if (midi2->pg.bank_valid) {
+			midi1->cc.status = UMP_MSG_STATUS_CC;
+			midi1->cc.index = UMP_CC_BANK_SELECT;
+			midi1->cc.data = midi2->pg.bank_msb;
+			err = __snd_seq_deliver_single_event(dest, dest_port,
+							     (struct snd_seq_event *)&ev_cvt,
+							     atomic, hop);
+			if (err < 0)
+				return err;
+			midi1->cc.index = UMP_CC_BANK_SELECT_LSB;
+			midi1->cc.data = midi2->pg.bank_lsb;
+			err = __snd_seq_deliver_single_event(dest, dest_port,
+							     (struct snd_seq_event *)&ev_cvt,
+							     atomic, hop);
+			if (err < 0)
+				return err;
+			midi1->note.status = midi2->note.status;
+		}
 		midi1->pg.program = midi2->pg.program;
 		break;
 	case UMP_MSG_STATUS_CHANNEL_PRESSURE:
@@ -691,6 +729,7 @@
 				  union snd_ump_midi1_msg *data,
 				  unsigned char status)
 {
+	data->system.type = UMP_MSG_TYPE_SYSTEM; // override
 	data->system.status = status;
 	return 1;
 }
@@ -701,6 +740,7 @@
 				     union snd_ump_midi1_msg *data,
 				     unsigned char status)
 {
+	data->system.type = UMP_MSG_TYPE_SYSTEM; // override
 	data->system.status = status;
 	data->system.parm1 = event->data.control.value & 0x7f;
 	return 1;
@@ -712,9 +752,10 @@
 				     union snd_ump_midi1_msg *data,
 				     unsigned char status)
 {
+	data->system.type = UMP_MSG_TYPE_SYSTEM; // override
 	data->system.status = status;
-	data->system.parm1 = (event->data.control.value >> 7) & 0x7f;
-	data->system.parm2 = event->data.control.value & 0x7f;
+	data->system.parm1 = event->data.control.value & 0x7f;
+	data->system.parm2 = (event->data.control.value >> 7) & 0x7f;
 	return 1;
 }
 
@@ -748,26 +789,45 @@
 	return 1;
 }
 
+static void reset_rpn(struct ump_cvt_to_ump_bank *cc)
+{
+	cc->rpn_set = 0;
+	cc->nrpn_set = 0;
+	cc->cc_rpn_msb = cc->cc_rpn_lsb = 0;
+	cc->cc_data_msb = cc->cc_data_lsb = 0;
+	cc->cc_data_msb_set = cc->cc_data_lsb_set = 0;
+}
+
 /* set up the MIDI2 RPN/NRPN packet data from the parsed info */
-static void fill_rpn(struct snd_seq_ump_midi2_bank *cc,
-		     union snd_ump_midi2_msg *data)
+static int fill_rpn(struct ump_cvt_to_ump_bank *cc,
+		    union snd_ump_midi2_msg *data,
+		    unsigned char channel,
+		    bool flush)
 {
+	if (!(cc->cc_data_lsb_set || cc->cc_data_msb_set))
+		return 0; // skip
+	/* when not flushing, wait for complete data set */
+	if (!flush && (!cc->cc_data_lsb_set || !cc->cc_data_msb_set))
+		return 0; // skip
+
 	if (cc->rpn_set) {
 		data->rpn.status = UMP_MSG_STATUS_RPN;
 		data->rpn.bank = cc->cc_rpn_msb;
 		data->rpn.index = cc->cc_rpn_lsb;
-		cc->rpn_set = 0;
-		cc->cc_rpn_msb = cc->cc_rpn_lsb = 0;
-	} else {
+	} else if (cc->nrpn_set) {
 		data->rpn.status = UMP_MSG_STATUS_NRPN;
 		data->rpn.bank = cc->cc_nrpn_msb;
 		data->rpn.index = cc->cc_nrpn_lsb;
-		cc->nrpn_set = 0;
-		cc->cc_nrpn_msb = cc->cc_nrpn_lsb = 0;
+	} else {
+		return 0; // skip
 	}
+
 	data->rpn.data = upscale_14_to_32bit((cc->cc_data_msb << 7) |
 					     cc->cc_data_lsb);
-	cc->cc_data_msb = cc->cc_data_lsb = 0;
+	data->rpn.channel = channel;
+
+	reset_rpn(cc);
+	return 1;
 }
 
 /* convert CC event to MIDI 2.0 UMP */
@@ -779,29 +839,39 @@
 	unsigned char channel = event->data.control.channel & 0x0f;
 	unsigned char index = event->data.control.param & 0x7f;
 	unsigned char val = event->data.control.value & 0x7f;
-	struct snd_seq_ump_midi2_bank *cc = &dest_port->midi2_bank[channel];
+	struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel];
+	int ret;
 
 	/* process special CC's (bank/rpn/nrpn) */
 	switch (index) {
 	case UMP_CC_RPN_MSB:
+		ret = fill_rpn(cc, data, channel, true);
 		cc->rpn_set = 1;
 		cc->cc_rpn_msb = val;
-		return 0; // skip
+		if (cc->cc_rpn_msb == 0x7f && cc->cc_rpn_lsb == 0x7f)
+			reset_rpn(cc);
+		return ret;
 	case UMP_CC_RPN_LSB:
+		ret = fill_rpn(cc, data, channel, true);
 		cc->rpn_set = 1;
 		cc->cc_rpn_lsb = val;
-		return 0; // skip
+		if (cc->cc_rpn_msb == 0x7f && cc->cc_rpn_lsb == 0x7f)
+			reset_rpn(cc);
+		return ret;
 	case UMP_CC_NRPN_MSB:
+		ret = fill_rpn(cc, data, channel, true);
 		cc->nrpn_set = 1;
 		cc->cc_nrpn_msb = val;
-		return 0; // skip
+		return ret;
 	case UMP_CC_NRPN_LSB:
+		ret = fill_rpn(cc, data, channel, true);
 		cc->nrpn_set = 1;
 		cc->cc_nrpn_lsb = val;
-		return 0; // skip
+		return ret;
 	case UMP_CC_DATA:
+		cc->cc_data_msb_set = 1;
 		cc->cc_data_msb = val;
-		return 0; // skip
+		return fill_rpn(cc, data, channel, false);
 	case UMP_CC_BANK_SELECT:
 		cc->bank_set = 1;
 		cc->cc_bank_msb = val;
@@ -811,11 +881,9 @@
 		cc->cc_bank_lsb = val;
 		return 0; // skip
 	case UMP_CC_DATA_LSB:
+		cc->cc_data_lsb_set = 1;
 		cc->cc_data_lsb = val;
-		if (!(cc->rpn_set || cc->nrpn_set))
-			return 0; // skip
-		fill_rpn(cc, data);
-		return 1;
+		return fill_rpn(cc, data, channel, false);
 	}
 
 	data->cc.status = status;
@@ -844,7 +912,7 @@
 			       unsigned char status)
 {
 	unsigned char channel = event->data.control.channel & 0x0f;
-	struct snd_seq_ump_midi2_bank *cc = &dest_port->midi2_bank[channel];
+	struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel];
 
 	data->pg.status = status;
 	data->pg.channel = channel;
@@ -854,7 +922,6 @@
 		data->pg.bank_msb = cc->cc_bank_msb;
 		data->pg.bank_lsb = cc->cc_bank_lsb;
 		cc->bank_set = 0;
-		cc->cc_bank_msb = cc->cc_bank_lsb = 0;
 	}
 	return 1;
 }
@@ -882,8 +949,9 @@
 {
 	unsigned char channel = event->data.control.channel & 0x0f;
 	unsigned char index = event->data.control.param & 0x7f;
-	struct snd_seq_ump_midi2_bank *cc = &dest_port->midi2_bank[channel];
+	struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel];
 	unsigned char msb, lsb;
+	int ret;
 
 	msb = (event->data.control.value >> 7) & 0x7f;
 	lsb = event->data.control.value & 0x7f;
@@ -897,28 +965,27 @@
 		cc->cc_bank_lsb = lsb;
 		return 0; // skip
 	case UMP_CC_RPN_MSB:
-		cc->cc_rpn_msb = msb;
-		fallthrough;
 	case UMP_CC_RPN_LSB:
-		cc->rpn_set = 1;
+		ret = fill_rpn(cc, data, channel, true);
+		cc->cc_rpn_msb = msb;
 		cc->cc_rpn_lsb = lsb;
-		return 0; // skip
+		cc->rpn_set = 1;
+		if (cc->cc_rpn_msb == 0x7f && cc->cc_rpn_lsb == 0x7f)
+			reset_rpn(cc);
+		return ret;
 	case UMP_CC_NRPN_MSB:
-		cc->cc_nrpn_msb = msb;
-		fallthrough;
 	case UMP_CC_NRPN_LSB:
+		ret = fill_rpn(cc, data, channel, true);
+		cc->cc_nrpn_msb = msb;
 		cc->nrpn_set = 1;
 		cc->cc_nrpn_lsb = lsb;
-		return 0; // skip
+		return ret;
 	case UMP_CC_DATA:
-		cc->cc_data_msb = msb;
-		fallthrough;
 	case UMP_CC_DATA_LSB:
+		cc->cc_data_msb_set = cc->cc_data_lsb_set = 1;
+		cc->cc_data_msb = msb;
 		cc->cc_data_lsb = lsb;
-		if (!(cc->rpn_set || cc->nrpn_set))
-			return 0; // skip
-		fill_rpn(cc, data);
-		return 1;
+		return fill_rpn(cc, data, channel, false);
 	}
 
 	data->cc.status = UMP_MSG_STATUS_CC;
@@ -978,7 +1045,7 @@
 				     union snd_ump_midi2_msg *data,
 				     unsigned char status)
 {
-	return system_1p_ev_to_ump_midi1(event, dest_port,
+	return system_2p_ev_to_ump_midi1(event, dest_port,
 					 (union snd_ump_midi1_msg *)data,
 					 status);
 }
@@ -1035,6 +1102,8 @@
 	  system_ev_to_ump_midi1, system_ev_to_ump_midi2 },
 	{ SNDRV_SEQ_EVENT_SENSING, UMP_SYSTEM_STATUS_ACTIVE_SENSING,
 	  system_ev_to_ump_midi1, system_ev_to_ump_midi2 },
+	{ SNDRV_SEQ_EVENT_RESET, UMP_SYSTEM_STATUS_RESET,
+	  system_ev_to_ump_midi1, system_ev_to_ump_midi2 },
 };
 
 static const struct seq_ev_to_ump *find_ump_encoder(int type)
@@ -1148,44 +1217,53 @@
 {
 	struct snd_seq_ump_event ev_cvt;
 	unsigned char status;
-	u8 buf[6], *xbuf;
+	u8 buf[8], *xbuf;
 	int offset = 0;
 	int len, err;
+	bool finished = false;
 
 	if (!snd_seq_ev_is_variable(event))
 		return 0;
 
 	setup_ump_event(&ev_cvt, event);
-	for (;;) {
+	while (!finished) {
 		len = snd_seq_expand_var_event_at(event, sizeof(buf), buf, offset);
 		if (len <= 0)
 			break;
-		if (WARN_ON(len > 6))
+		if (WARN_ON(len > sizeof(buf)))
 			break;
-		offset += len;
+
 		xbuf = buf;
+		status = UMP_SYSEX_STATUS_CONTINUE;
+		/* truncate the sysex start-marker */
 		if (*xbuf == UMP_MIDI1_MSG_SYSEX_START) {
 			status = UMP_SYSEX_STATUS_START;
-			xbuf++;
 			len--;
-			if (len > 0 && xbuf[len - 1] == UMP_MIDI1_MSG_SYSEX_END) {
+			offset++;
+			xbuf++;
+		}
+
+		/* if the last of this packet or the 1st byte of the next packet
+		 * is the end-marker, finish the transfer with this packet
+		 */
+		if (len > 0 && len < 8 &&
+		    xbuf[len - 1] == UMP_MIDI1_MSG_SYSEX_END) {
+			if (status == UMP_SYSEX_STATUS_START)
 				status = UMP_SYSEX_STATUS_SINGLE;
-				len--;
-			}
-		} else {
-			if (xbuf[len - 1] == UMP_MIDI1_MSG_SYSEX_END) {
+			else
 				status = UMP_SYSEX_STATUS_END;
-				len--;
-			} else {
-				status = UMP_SYSEX_STATUS_CONTINUE;
-			}
+			len--;
+			finished = true;
 		}
+
+		len = min(len, 6);
 		fill_sysex7_ump(dest_port, ev_cvt.ump, status, xbuf, len);
 		err = __snd_seq_deliver_single_event(dest, dest_port,
 						     (struct snd_seq_event *)&ev_cvt,
 						     atomic, hop);
 		if (err < 0)
 			return err;
+		offset += len;
 	}
 	return 0;
 }
--- linux-qcom-6.8.0.orig/sound/core/seq/seq_virmidi.c
+++ linux-qcom-6.8.0/sound/core/seq/seq_virmidi.c
@@ -62,6 +62,13 @@
 /*
  * decode input event and put to read buffer of each opened file
  */
+
+/* callback for snd_seq_dump_var_event(), bridging to snd_rawmidi_receive() */
+static int dump_to_rawmidi(void *ptr, void *buf, int count)
+{
+	return snd_rawmidi_receive(ptr, buf, count);
+}
+
 static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
 					 struct snd_seq_event *ev,
 					 bool atomic)
@@ -80,7 +87,7 @@
 		if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
 			if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
 				continue;
-			snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream);
+			snd_seq_dump_var_event(ev, dump_to_rawmidi, vmidi->substream);
 			snd_midi_event_reset_decode(vmidi->parser);
 		} else {
 			len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev);
--- linux-qcom-6.8.0.orig/sound/core/timer.c
+++ linux-qcom-6.8.0/sound/core/timer.c
@@ -553,6 +553,16 @@
 		goto unlock;
 	}
 
+	/* check the actual time for the start tick;
+	 * bail out as error if it's way too low (< 100us)
+	 */
+	if (start && !(timer->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
+		if ((u64)snd_timer_hw_resolution(timer) * ticks < 100000) {
+			result = -EINVAL;
+			goto unlock;
+		}
+	}
+
 	if (start)
 		timeri->ticks = timeri->cticks = ticks;
 	else if (!timeri->cticks)
--- linux-qcom-6.8.0.orig/sound/core/ump.c
+++ linux-qcom-6.8.0/sound/core/ump.c
@@ -37,6 +37,7 @@
 				 u32 *buffer, int count);
 static void process_legacy_input(struct snd_ump_endpoint *ump, const u32 *src,
 				 int words);
+static void update_legacy_names(struct snd_ump_endpoint *ump);
 #else
 static inline int process_legacy_output(struct snd_ump_endpoint *ump,
 					u32 *buffer, int count)
@@ -47,6 +48,9 @@
 					const u32 *src, int words)
 {
 }
+static inline void update_legacy_names(struct snd_ump_endpoint *ump)
+{
+}
 #endif
 
 static const struct snd_rawmidi_global_ops snd_ump_rawmidi_ops = {
@@ -524,6 +528,59 @@
 	}
 }
 
+/* update dir_bits and active flag for all groups in the client */
+void snd_ump_update_group_attrs(struct snd_ump_endpoint *ump)
+{
+	struct snd_ump_block *fb;
+	struct snd_ump_group *group;
+	int i;
+
+	for (i = 0; i < SNDRV_UMP_MAX_GROUPS; i++) {
+		group = &ump->groups[i];
+		*group->name = 0;
+		group->dir_bits = 0;
+		group->active = 0;
+		group->group = i;
+		group->valid = false;
+	}
+
+	list_for_each_entry(fb, &ump->block_list, list) {
+		if (fb->info.first_group + fb->info.num_groups > SNDRV_UMP_MAX_GROUPS)
+			break;
+		group = &ump->groups[fb->info.first_group];
+		for (i = 0; i < fb->info.num_groups; i++, group++) {
+			group->valid = true;
+			if (fb->info.active)
+				group->active = 1;
+			switch (fb->info.direction) {
+			case SNDRV_UMP_DIR_INPUT:
+				group->dir_bits |= (1 << SNDRV_RAWMIDI_STREAM_INPUT);
+				break;
+			case SNDRV_UMP_DIR_OUTPUT:
+				group->dir_bits |= (1 << SNDRV_RAWMIDI_STREAM_OUTPUT);
+				break;
+			case SNDRV_UMP_DIR_BIDIRECTION:
+				group->dir_bits |= (1 << SNDRV_RAWMIDI_STREAM_INPUT) |
+					(1 << SNDRV_RAWMIDI_STREAM_OUTPUT);
+				break;
+			}
+			if (!*fb->info.name)
+				continue;
+			if (!*group->name) {
+				/* store the first matching name */
+				strscpy(group->name, fb->info.name,
+					sizeof(group->name));
+			} else {
+				/* when overlapping, concat names */
+				strlcat(group->name, ", ", sizeof(group->name));
+				strlcat(group->name, fb->info.name,
+					sizeof(group->name));
+			}
+		}
+	}
+}
+EXPORT_SYMBOL_GPL(snd_ump_update_group_attrs);
+
 /*
  * UMP endpoint and function block handling
  */
@@ -685,10 +742,17 @@
  */
 int snd_ump_switch_protocol(struct snd_ump_endpoint *ump, unsigned int protocol)
 {
+	unsigned int type;
+
 	protocol &= ump->info.protocol_caps;
 	if (protocol == ump->info.protocol)
 		return 0;
 
+	type = protocol & SNDRV_UMP_EP_INFO_PROTO_MIDI_MASK;
+	if (type != SNDRV_UMP_EP_INFO_PROTO_MIDI1 &&
+	    type != SNDRV_UMP_EP_INFO_PROTO_MIDI2)
+		return 0;
+
 	ump->info.protocol = protocol;
 	ump_dbg(ump, "New protocol = %x (caps = %x)\n",
 		protocol, ump->info.protocol_caps);
@@ -717,7 +781,10 @@
 	info->ui_hint = buf->fb_info.ui_hint;
 	info->first_group = buf->fb_info.first_group;
 	info->num_groups = buf->fb_info.num_groups;
-	info->flags = buf->fb_info.midi_10;
+	if (buf->fb_info.midi_10 < 2)
+		info->flags = buf->fb_info.midi_10;
+	else
+		info->flags = SNDRV_UMP_BLOCK_IS_MIDI1 | SNDRV_UMP_BLOCK_IS_LOWSPEED;
 	info->active = buf->fb_info.active;
 	info->midi_ci_version = buf->fb_info.midi_ci_version;
 	info->sysex8_streams = buf->fb_info.sysex8_streams;
@@ -726,6 +793,12 @@
 		info->block_id, info->direction, info->active,
 		info->first_group, info->num_groups, info->midi_ci_version,
 		info->sysex8_streams, info->flags);
+
+	if ((info->flags & SNDRV_UMP_BLOCK_IS_MIDI1) && info->num_groups != 1) {
+		info->num_groups = 1;
+		ump_dbg(ump, "FB %d: corrected groups to 1 for MIDI1\n",
+			info->block_id);
+	}
 }
 
 /* check whether the FB info gets updated by the current message */
@@ -779,8 +852,11 @@
 
 	if (fb) {
 		fill_fb_info(ump, &fb->info, buf);
-		if (ump->parsed)
+		if (ump->parsed) {
+			snd_ump_update_group_attrs(ump);
+			update_legacy_names(ump);
 			seq_notify_fb_change(ump, fb);
+		}
 	}
 
 	return 1; /* finished */
@@ -799,11 +875,21 @@
 	if (!fb)
 		return -ENODEV;
 
+	if (ump->parsed &&
+	    (ump->info.flags & SNDRV_UMP_EP_INFO_STATIC_BLOCKS)) {
+		ump_dbg(ump, "Skipping static FB name update (blk#%d)\n",
+			fb->info.block_id);
+		return 0;
+	}
+
 	ret = ump_append_string(ump, fb->info.name, sizeof(fb->info.name),
 				buf->raw, 3);
 	/* notify the FB name update to sequencer, too */
-	if (ret > 0 && ump->parsed)
+	if (ret > 0 && ump->parsed) {
+		snd_ump_update_group_attrs(ump);
+		update_legacy_names(ump);
 		seq_notify_fb_change(ump, fb);
+	}
 	return ret;
 }
 
@@ -960,6 +1046,14 @@
 	if (err < 0)
 		ump_dbg(ump, "Unable to get UMP EP stream config\n");
 
+	/* If no protocol is set by some reason, assume the valid one */
+	if (!(ump->info.protocol & SNDRV_UMP_EP_INFO_PROTO_MIDI_MASK)) {
+		if (ump->info.protocol_caps & SNDRV_UMP_EP_INFO_PROTO_MIDI2)
+			ump->info.protocol |= SNDRV_UMP_EP_INFO_PROTO_MIDI2;
+		else if (ump->info.protocol_caps & SNDRV_UMP_EP_INFO_PROTO_MIDI1)
+			ump->info.protocol |= SNDRV_UMP_EP_INFO_PROTO_MIDI1;
+	}
+
 	/* Query and create blocks from Function Blocks */
 	for (blk = 0; blk < ump->info.num_blocks; blk++) {
 		err = create_block_from_fb_info(ump, blk);
@@ -967,6 +1061,9 @@
 			continue;
 	}
 
+	/* initialize group attributions */
+	snd_ump_update_group_attrs(ump);
+
  error:
 	ump->parsed = true;
 	ump_request_close(ump);
@@ -985,13 +1082,13 @@
 	struct snd_ump_endpoint *ump = substream->rmidi->private_data;
 	int dir = substream->stream;
 	int group = ump->legacy_mapping[substream->number];
-	int err = 0;
+	int err;
 
-	mutex_lock(&ump->open_mutex);
-	if (ump->legacy_substreams[dir][group]) {
-		err = -EBUSY;
-		goto unlock;
-	}
+	guard(mutex)(&ump->open_mutex);
+	if (ump->legacy_substreams[dir][group])
+		return -EBUSY;
+	if (!ump->groups[group].active)
+		return -ENODEV;
 	if (dir == SNDRV_RAWMIDI_STREAM_OUTPUT) {
 		if (!ump->legacy_out_opens) {
 			err = snd_rawmidi_kernel_open(&ump->core, 0,
@@ -999,17 +1096,14 @@
 						      SNDRV_RAWMIDI_LFLG_APPEND,
 						      &ump->legacy_out_rfile);
 			if (err < 0)
-				goto unlock;
+				return err;
 		}
 		ump->legacy_out_opens++;
 		snd_ump_convert_reset(&ump->out_cvts[group]);
 	}
-	spin_lock_irq(&ump->legacy_locks[dir]);
+	guard(spinlock_irq)(&ump->legacy_locks[dir]);
 	ump->legacy_substreams[dir][group] = substream;
-	spin_unlock_irq(&ump->legacy_locks[dir]);
- unlock:
-	mutex_unlock(&ump->open_mutex);
-	return err;
+	return 0;
 }
 
 static int snd_ump_legacy_close(struct snd_rawmidi_substream *substream)
@@ -1018,15 +1112,13 @@
 	int dir = substream->stream;
 	int group = ump->legacy_mapping[substream->number];
 
-	mutex_lock(&ump->open_mutex);
-	spin_lock_irq(&ump->legacy_locks[dir]);
-	ump->legacy_substreams[dir][group] = NULL;
-	spin_unlock_irq(&ump->legacy_locks[dir]);
+	guard(mutex)(&ump->open_mutex);
+	scoped_guard(spinlock_irq, &ump->legacy_locks[dir])
+		ump->legacy_substreams[dir][group] = NULL;
 	if (dir == SNDRV_RAWMIDI_STREAM_OUTPUT) {
 		if (!--ump->legacy_out_opens)
 			snd_rawmidi_kernel_release(&ump->legacy_out_rfile);
 	}
-	mutex_unlock(&ump->open_mutex);
 	return 0;
 }
 
@@ -1078,12 +1170,11 @@
 	const int dir = SNDRV_RAWMIDI_STREAM_OUTPUT;
 	unsigned char c;
 	int group, size = 0;
-	unsigned long flags;
 
 	if (!ump->out_cvts || !ump->legacy_out_opens)
 		return 0;
 
-	spin_lock_irqsave(&ump->legacy_locks[dir], flags);
+	guard(spinlock_irqsave)(&ump->legacy_locks[dir]);
 	for (group = 0; group < SNDRV_UMP_MAX_GROUPS; group++) {
 		substream = ump->legacy_substreams[dir][group];
 		if (!substream)
@@ -1099,7 +1190,6 @@
 			break;
 		}
 	}
-	spin_unlock_irqrestore(&ump->legacy_locks[dir], flags);
 	return size;
 }
 
@@ -1109,18 +1199,16 @@
 	struct snd_rawmidi_substream *substream;
 	unsigned char buf[16];
 	unsigned char group;
-	unsigned long flags;
 	const int dir = SNDRV_RAWMIDI_STREAM_INPUT;
 	int size;
 
 	size = snd_ump_convert_from_ump(src, buf, &group);
 	if (size <= 0)
 		return;
-	spin_lock_irqsave(&ump->legacy_locks[dir], flags);
+	guard(spinlock_irqsave)(&ump->legacy_locks[dir]);
 	substream = ump->legacy_substreams[dir][group];
 	if (substream)
 		snd_rawmidi_receive(substream, buf, size);
-	spin_unlock_irqrestore(&ump->legacy_locks[dir], flags);
 }
 
 /* Fill ump->legacy_mapping[] for groups to be used for legacy rawmidi */
@@ -1155,10 +1243,26 @@
 				 struct snd_rawmidi *rmidi, int dir)
 {
 	struct snd_rawmidi_substream *s;
+	const char *name;
+	int idx;
 
-	list_for_each_entry(s, &rmidi->streams[dir].substreams, list)
-		snprintf(s->name, sizeof(s->name), "Group %d (%.16s)",
-			 ump->legacy_mapping[s->number] + 1, ump->info.name);
+	list_for_each_entry(s, &rmidi->streams[dir].substreams, list) {
+		idx = ump->legacy_mapping[s->number];
+		name = ump->groups[idx].name;
+		if (!*name)
+			name = ump->info.name;
+		scnprintf(s->name, sizeof(s->name), "Group %d (%.16s)%s",
+			  idx + 1, name,
+			  ump->groups[idx].active ? "" : " [Inactive]");
+	}
+}
+
+static void update_legacy_names(struct snd_ump_endpoint *ump)
+{
+	struct snd_rawmidi *rmidi = ump->legacy_rmidi;
+
+	fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_INPUT);
+	fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT);
 }
 
 int snd_ump_attach_legacy_rawmidi(struct snd_ump_endpoint *ump,
@@ -1197,10 +1301,7 @@
 	rmidi->ops = &snd_ump_legacy_ops;
 	rmidi->private_data = ump;
 	ump->legacy_rmidi = rmidi;
-	if (input)
-		fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_INPUT);
-	if (output)
-		fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT);
+	update_legacy_names(ump);
 
 	ump_dbg(ump, "Created a legacy rawmidi #%d (%s)\n", device, id);
 	return 0;
--- linux-qcom-6.8.0.orig/sound/core/ump_convert.c
+++ linux-qcom-6.8.0/sound/core/ump_convert.c
@@ -287,25 +287,42 @@
 	return 4;
 }
 
-static void fill_rpn(struct ump_cvt_to_ump_bank *cc,
-		     union snd_ump_midi2_msg *midi2)
+static void reset_rpn(struct ump_cvt_to_ump_bank *cc)
 {
+	cc->rpn_set = 0;
+	cc->nrpn_set = 0;
+	cc->cc_rpn_msb = cc->cc_rpn_lsb = 0;
+	cc->cc_data_msb = cc->cc_data_lsb = 0;
+	cc->cc_data_msb_set = cc->cc_data_lsb_set = 0;
+}
+
+static int fill_rpn(struct ump_cvt_to_ump_bank *cc,
+		    union snd_ump_midi2_msg *midi2,
+		    bool flush)
+{
+	if (!(cc->cc_data_lsb_set || cc->cc_data_msb_set))
+		return 0; // skip
+	/* when not flushing, wait for complete data set */
+	if (!flush && (!cc->cc_data_lsb_set || !cc->cc_data_msb_set))
+		return 0; // skip
+
 	if (cc->rpn_set) {
 		midi2->rpn.status = UMP_MSG_STATUS_RPN;
 		midi2->rpn.bank = cc->cc_rpn_msb;
 		midi2->rpn.index = cc->cc_rpn_lsb;
-		cc->rpn_set = 0;
-		cc->cc_rpn_msb = cc->cc_rpn_lsb = 0;
-	} else {
+	} else if (cc->nrpn_set) {
 		midi2->rpn.status = UMP_MSG_STATUS_NRPN;
 		midi2->rpn.bank = cc->cc_nrpn_msb;
 		midi2->rpn.index = cc->cc_nrpn_lsb;
-		cc->nrpn_set = 0;
-		cc->cc_nrpn_msb = cc->cc_nrpn_lsb = 0;
+	} else {
+		return 0; // skip
 	}
+
 	midi2->rpn.data = upscale_14_to_32bit((cc->cc_data_msb << 7) |
 					      cc->cc_data_lsb);
-	cc->cc_data_msb = cc->cc_data_lsb = 0;
+
+	reset_rpn(cc);
+	return 1;
 }
 
 /* convert to a MIDI 1.0 Channel Voice message */
@@ -318,6 +335,7 @@
 	struct ump_cvt_to_ump_bank *cc;
 	union snd_ump_midi2_msg *midi2 = (union snd_ump_midi2_msg *)data;
 	unsigned char status, channel;
+	int ret;
 
 	BUILD_BUG_ON(sizeof(union snd_ump_midi1_msg) != 4);
 	BUILD_BUG_ON(sizeof(union snd_ump_midi2_msg) != 8);
@@ -358,24 +376,33 @@
 	case UMP_MSG_STATUS_CC:
 		switch (buf[1]) {
 		case UMP_CC_RPN_MSB:
+			ret = fill_rpn(cc, midi2, true);
 			cc->rpn_set = 1;
 			cc->cc_rpn_msb = buf[2];
-			return 0; // skip
+			if (cc->cc_rpn_msb == 0x7f && cc->cc_rpn_lsb == 0x7f)
+				reset_rpn(cc);
+			return ret;
 		case UMP_CC_RPN_LSB:
+			ret = fill_rpn(cc, midi2, true);
 			cc->rpn_set = 1;
 			cc->cc_rpn_lsb = buf[2];
-			return 0; // skip
+			if (cc->cc_rpn_msb == 0x7f && cc->cc_rpn_lsb == 0x7f)
+				reset_rpn(cc);
+			return ret;
 		case UMP_CC_NRPN_MSB:
+			ret = fill_rpn(cc, midi2, true);
 			cc->nrpn_set = 1;
 			cc->cc_nrpn_msb = buf[2];
-			return 0; // skip
+			return ret;
 		case UMP_CC_NRPN_LSB:
+			ret = fill_rpn(cc, midi2, true);
 			cc->nrpn_set = 1;
 			cc->cc_nrpn_lsb = buf[2];
-			return 0; // skip
+			return ret;
 		case UMP_CC_DATA:
+			cc->cc_data_msb_set = 1;
 			cc->cc_data_msb = buf[2];
-			return 0; // skip
+			return fill_rpn(cc, midi2, false);
 		case UMP_CC_BANK_SELECT:
 			cc->bank_set = 1;
 			cc->cc_bank_msb = buf[2];
@@ -385,12 +412,9 @@
 			cc->cc_bank_lsb = buf[2];
 			return 0; // skip
 		case UMP_CC_DATA_LSB:
+			cc->cc_data_lsb_set = 1;
 			cc->cc_data_lsb = buf[2];
-			if (cc->rpn_set || cc->nrpn_set)
-				fill_rpn(cc, midi2);
-			else
-				return 0; // skip
-			break;
+			return fill_rpn(cc, midi2, false);
 		default:
 			midi2->cc.index = buf[1];
 			midi2->cc.data = upscale_7_to_32bit(buf[2]);
@@ -404,7 +428,6 @@
 			midi2->pg.bank_msb = cc->cc_bank_msb;
 			midi2->pg.bank_lsb = cc->cc_bank_lsb;
 			cc->bank_set = 0;
-			cc->cc_bank_msb = cc->cc_bank_lsb = 0;
 		}
 		break;
 	case UMP_MSG_STATUS_CHANNEL_PRESSURE:
--- linux-qcom-6.8.0.orig/sound/firewire/amdtp-stream.c
+++ linux-qcom-6.8.0/sound/firewire/amdtp-stream.c
@@ -77,6 +77,8 @@
 // overrun. Actual device can skip more, then this module stops the packet streaming.
 #define IR_JUMBO_PAYLOAD_MAX_SKIP_CYCLES	5
 
+static void pcm_period_work(struct work_struct *work);
+
 /**
  * amdtp_stream_init - initialize an AMDTP stream structure
  * @s: the AMDTP stream to initialize
@@ -105,6 +107,7 @@
 	s->flags = flags;
 	s->context = ERR_PTR(-1);
 	mutex_init(&s->mutex);
+	INIT_WORK(&s->period_work, pcm_period_work);
 	s->packet_index = 0;
 
 	init_waitqueue_head(&s->ready_wait);
@@ -169,6 +172,9 @@
 			step = max(step, amdtp_syt_intervals[i]);
 	}
 
+	if (step == 0)
+		return -EINVAL;
+
 	t.min = roundup(s->min, step);
 	t.max = rounddown(s->max, step);
 	t.integer = 1;
@@ -347,6 +353,7 @@
  */
 void amdtp_stream_pcm_prepare(struct amdtp_stream *s)
 {
+	cancel_work_sync(&s->period_work);
 	s->pcm_buffer_pointer = 0;
 	s->pcm_period_pointer = 0;
 }
@@ -611,19 +618,21 @@
 		// The program in user process should periodically check the status of intermediate
 		// buffer associated to PCM substream to process PCM frames in the buffer, instead
 		// of receiving notification of period elapsed by poll wait.
-		if (!pcm->runtime->no_period_wakeup) {
-			if (in_softirq()) {
-				// In software IRQ context for 1394 OHCI.
-				snd_pcm_period_elapsed(pcm);
-			} else {
-				// In process context of ALSA PCM application under acquired lock of
-				// PCM substream.
-				snd_pcm_period_elapsed_under_stream_lock(pcm);
-			}
-		}
+		if (!pcm->runtime->no_period_wakeup)
+			queue_work(system_highpri_wq, &s->period_work);
 	}
 }
 
+static void pcm_period_work(struct work_struct *work)
+{
+	struct amdtp_stream *s = container_of(work, struct amdtp_stream,
+					      period_work);
+	struct snd_pcm_substream *pcm = READ_ONCE(s->pcm);
+
+	if (pcm)
+		snd_pcm_period_elapsed(pcm);
+}
+
 static int queue_packet(struct amdtp_stream *s, struct fw_iso_packet *params,
 			bool sched_irq)
 {
@@ -773,10 +782,14 @@
 	} else {
 		unsigned int dbc_interval;
 
-		if (*data_blocks > 0 && s->ctx_data.tx.dbc_interval > 0)
-			dbc_interval = s->ctx_data.tx.dbc_interval;
-		else
-			dbc_interval = *data_blocks;
+		if (!(s->flags & CIP_DBC_IS_PAYLOAD_QUADLETS)) {
+			if (*data_blocks > 0 && s->ctx_data.tx.dbc_interval > 0)
+				dbc_interval = s->ctx_data.tx.dbc_interval;
+			else
+				dbc_interval = *data_blocks;
+		} else {
+			dbc_interval = payload_length / sizeof(__be32);
+		}
 
 		lost = dbc != ((*data_block_counter + dbc_interval) & 0xff);
 	}
@@ -1848,11 +1861,14 @@
 {
 	struct amdtp_stream *irq_target = d->irq_target;
 
-	// Process isochronous packets queued till recent isochronous cycle to handle PCM frames.
 	if (irq_target && amdtp_stream_running(irq_target)) {
-		// In software IRQ context, the call causes dead-lock to disable the tasklet
-		// synchronously.
-		if (!in_softirq())
+		// use wq to prevent AB/BA deadlock competition for
+		// substream lock:
+		// fw_iso_context_flush_completions() acquires
+		// lock by ohci_flush_iso_completions(),
+		// amdtp-stream process_rx_packets() attempts to
+		// acquire same lock by snd_pcm_elapsed()
+		if (current_work() != &s->period_work)
 			fw_iso_context_flush_completions(irq_target->context);
 	}
 
@@ -1908,6 +1924,7 @@
 		return;
 	}
 
+	cancel_work_sync(&s->period_work);
 	fw_iso_context_stop(s->context);
 	fw_iso_context_destroy(s->context);
 	s->context = ERR_PTR(-1);
--- linux-qcom-6.8.0.orig/sound/firewire/amdtp-stream.h
+++ linux-qcom-6.8.0/sound/firewire/amdtp-stream.h
@@ -37,6 +37,9 @@
  *	the value of current SYT_INTERVAL; e.g. initial value is not zero.
  * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff.
  *	For incoming packet, the value in SYT field of CIP is not handled.
+ * @CIP_DBC_IS_PAYLOAD_QUADLETS: Available for incoming packet, and only effective with
+ *	CIP_DBC_IS_END_EVENT flag. The value of dbc field is the number of accumulated quadlets
+ *	in CIP payload, instead of the number of accumulated data blocks.
  */
 enum cip_flags {
 	CIP_NONBLOCKING		= 0x00,
@@ -51,6 +54,7 @@
 	CIP_NO_HEADER		= 0x100,
 	CIP_UNALIGHED_DBC	= 0x200,
 	CIP_UNAWARE_SYT		= 0x400,
+	CIP_DBC_IS_PAYLOAD_QUADLETS = 0x800,
 };
 
 /**
@@ -187,6 +191,7 @@
 
 	/* For a PCM substream processing. */
 	struct snd_pcm_substream *pcm;
+	struct work_struct period_work;
 	snd_pcm_uframes_t pcm_buffer_pointer;
 	unsigned int pcm_period_pointer;
 	unsigned int pcm_frame_multiplier;
--- linux-qcom-6.8.0.orig/sound/firewire/tascam/amdtp-tascam.c
+++ linux-qcom-6.8.0/sound/firewire/tascam/amdtp-tascam.c
@@ -238,7 +238,7 @@
 	err = amdtp_stream_init(s, unit, dir, flags, fmt,
 			process_ctx_payloads, sizeof(struct amdtp_tscm));
 	if (err < 0)
-		return 0;
+		return err;
 
 	if (dir == AMDTP_OUT_STREAM) {
 		// Use fixed value for FDF field.
--- linux-qcom-6.8.0.orig/sound/hda/hdac_device.c
+++ linux-qcom-6.8.0/sound/hda/hdac_device.c
@@ -612,7 +612,7 @@
 int snd_hdac_keep_power_up(struct hdac_device *codec)
 {
 	if (!atomic_inc_not_zero(&codec->in_pm)) {
-		int ret = pm_runtime_get_if_active(&codec->dev, true);
+		int ret = pm_runtime_get_if_active(&codec->dev);
 		if (!ret)
 			return -1;
 		if (ret < 0)
--- linux-qcom-6.8.0.orig/sound/hda/hdmi_chmap.c
+++ linux-qcom-6.8.0/sound/hda/hdmi_chmap.c
@@ -753,6 +753,20 @@
 	return 0;
 }
 
+/* a simple sanity check for input values to chmap kcontrol */
+static int chmap_value_check(struct hdac_chmap *hchmap,
+			     const struct snd_ctl_elem_value *ucontrol)
+{
+	int i;
+
+	for (i = 0; i < hchmap->channels_max; i++) {
+		if (ucontrol->value.integer.value[i] < 0 ||
+		    ucontrol->value.integer.value[i] > SNDRV_CHMAP_LAST)
+			return -EINVAL;
+	}
+	return 0;
+}
+
 static int hdmi_chmap_ctl_put(struct snd_kcontrol *kcontrol,
 			      struct snd_ctl_elem_value *ucontrol)
 {
@@ -764,6 +778,10 @@
 	unsigned char chmap[8], per_pin_chmap[8];
 	int i, err, ca, prepared = 0;
 
+	err = chmap_value_check(hchmap, ucontrol);
+	if (err < 0)
+		return err;
+
 	/* No monitor is connected in dyn_pcm_assign.
 	 * It's invalid to setup the chmap
 	 */
--- linux-qcom-6.8.0.orig/sound/hda/intel-dsp-config.c
+++ linux-qcom-6.8.0/sound/hda/intel-dsp-config.c
@@ -16,7 +16,7 @@
 static int dsp_driver;
 
 module_param(dsp_driver, int, 0444);
-MODULE_PARM_DESC(dsp_driver, "Force the DSP driver for Intel DSP (0=auto, 1=legacy, 2=SST, 3=SOF)");
+MODULE_PARM_DESC(dsp_driver, "Force the DSP driver for Intel DSP (0=auto, 1=legacy, 2=SST, 3=SOF, 4=AVS)");
 
 #define FLAG_SST			BIT(0)
 #define FLAG_SOF			BIT(1)
@@ -557,9 +557,32 @@
 		if (table->codec_hid) {
 			int i;
 
-			for (i = 0; i < table->codec_hid->num_codecs; i++)
-				if (acpi_dev_present(table->codec_hid->codecs[i], NULL, -1))
+			for (i = 0; i < table->codec_hid->num_codecs; i++) {
+				struct nhlt_acpi_table *nhlt;
+				bool ssp_found = false;
+
+				if (!acpi_dev_present(table->codec_hid->codecs[i], NULL, -1))
+					continue;
+
+				nhlt = intel_nhlt_init(&pci->dev);
+				if (!nhlt) {
+					dev_warn(&pci->dev, "%s: NHLT table not found, skipped HID %s\n",
+						 __func__, table->codec_hid->codecs[i]);
+					continue;
+				}
+
+				if (intel_nhlt_has_endpoint_type(nhlt, NHLT_LINK_SSP) &&
+				    intel_nhlt_ssp_endpoint_mask(nhlt, NHLT_DEVICE_I2S))
+					ssp_found = true;
+
+				intel_nhlt_free(nhlt);
+
+				if (ssp_found)
 					break;
+
+				dev_warn(&pci->dev, "%s: no valid SSP found for HID %s, skipped\n",
+					 __func__, table->codec_hid->codecs[i]);
+			}
 			if (i == table->codec_hid->num_codecs)
 				continue;
 		}
@@ -700,6 +723,10 @@
 /* BayTrail */
 	{
 		.flags = FLAG_SST_OR_SOF_BYT,
+		.acpi_hid = "LPE0F28",
+	},
+	{
+		.flags = FLAG_SST_OR_SOF_BYT,
 		.acpi_hid = "80860F28",
 	},
 /* CherryTrail */
--- linux-qcom-6.8.0.orig/sound/hda/intel-sdw-acpi.c
+++ linux-qcom-6.8.0/sound/hda/intel-sdw-acpi.c
@@ -41,6 +41,8 @@
 				 "intel-quirk-mask",
 				 &quirk_mask);
 
+	fwnode_handle_put(link);
+
 	if (quirk_mask & SDW_INTEL_QUIRK_MASK_BUS_DISABLE)
 		return false;
 
--- linux-qcom-6.8.0.orig/sound/isa/gus/gus_pcm.c
+++ linux-qcom-6.8.0/sound/isa/gus/gus_pcm.c
@@ -378,7 +378,7 @@
 
 	bpos = get_bpos(pcmp, voice, pos, len);
 	if (bpos < 0)
-		return pos;
+		return bpos;
 	if (copy_from_iter(runtime->dma_area + bpos, len, src) != len)
 		return -EFAULT;
 	return playback_copy_ack(substream, bpos, len);
@@ -395,7 +395,7 @@
 	
 	bpos = get_bpos(pcmp, voice, pos, len);
 	if (bpos < 0)
-		return pos;
+		return bpos;
 	snd_pcm_format_set_silence(runtime->format, runtime->dma_area + bpos,
 				   bytes_to_samples(runtime, count));
 	return playback_copy_ack(substream, bpos, len);
--- linux-qcom-6.8.0.orig/sound/oss/dmasound/dmasound_paula.c
+++ linux-qcom-6.8.0/sound/oss/dmasound/dmasound_paula.c
@@ -725,7 +725,13 @@
 	dmasound_deinit();
 }
 
-static struct platform_driver amiga_audio_driver = {
+/*
+ * amiga_audio_remove() lives in .exit.text. For drivers registered via
+ * module_platform_driver_probe() this is ok because they cannot get unbound at
+ * runtime. So mark the driver struct with __refdata to prevent modpost
+ * triggering a section mismatch warning.
+ */
+static struct platform_driver amiga_audio_driver __refdata = {
 	.remove_new = __exit_p(amiga_audio_remove),
 	.driver = {
 		.name	= "amiga-audio",
--- linux-qcom-6.8.0.orig/sound/pci/asihpi/hpimsgx.c
+++ linux-qcom-6.8.0/sound/pci/asihpi/hpimsgx.c
@@ -708,7 +708,7 @@
 		phr->error = HPI_ERROR_PROCESSING_MESSAGE;
 		return phr->error;
 	}
-	if (hr.error == 0) {
+	if (hr.error == 0 && hr.u.s.adapter_index < HPI_MAX_ADAPTERS) {
 		/* the adapter was created successfully
 		   save the mapping for future use */
 		hpi_entry_points[hr.u.s.adapter_index] = entry_point_func;
--- linux-qcom-6.8.0.orig/sound/pci/emu10k1/emu10k1.c
+++ linux-qcom-6.8.0/sound/pci/emu10k1/emu10k1.c
@@ -189,8 +189,7 @@
 
 	emu->suspend = 1;
 
-	cancel_work_sync(&emu->emu1010.firmware_work);
-	cancel_work_sync(&emu->emu1010.clock_work);
+	cancel_work_sync(&emu->emu1010.work);
 
 	snd_ac97_suspend(emu->ac97);
 
--- linux-qcom-6.8.0.orig/sound/pci/emu10k1/emu10k1_callback.c
+++ linux-qcom-6.8.0/sound/pci/emu10k1/emu10k1_callback.c
@@ -255,7 +255,7 @@
 		/* check if sample is finished playing (non-looping only) */
 		if (bp != best + V_OFF && bp != best + V_FREE &&
 		    (vp->reg.sample_mode & SNDRV_SFNT_SAMPLE_SINGLESHOT)) {
-			val = snd_emu10k1_ptr_read(hw, CCCA_CURRADDR, vp->ch) - 64;
+			val = snd_emu10k1_ptr_read(hw, CCCA_CURRADDR, vp->ch);
 			if (val >= vp->reg.loopstart)
 				bp = best + V_OFF;
 		}
@@ -362,7 +362,7 @@
 
 	map = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
 
-	addr = vp->reg.start + 64;
+	addr = vp->reg.start;
 	temp = vp->reg.parm.filterQ;
 	ccca = (temp << 28) | addr;
 	if (vp->apitch < 0xe400)
@@ -430,9 +430,6 @@
 		/* Q & current address (Q 4bit value, MSB) */
 		CCCA, ccca,
 
-		/* cache */
-		CCR, REG_VAL_PUT(CCR_CACHEINVALIDSIZE, 64),
-
 		/* reset volume */
 		VTFT, vtarget | vp->ftarget,
 		CVCF, vtarget | CVCF_CURRENTFILTER_MASK,
--- linux-qcom-6.8.0.orig/sound/pci/emu10k1/emu10k1_main.c
+++ linux-qcom-6.8.0/sound/pci/emu10k1/emu10k1_main.c
@@ -732,69 +732,67 @@
 	return snd_emu1010_load_firmware_entry(emu, *fw);
 }
 
-static void emu1010_firmware_work(struct work_struct *work)
+static void snd_emu1010_load_dock_firmware(struct snd_emu10k1 *emu)
 {
-	struct snd_emu10k1 *emu;
-	u32 tmp, tmp2, reg;
+	u32 tmp, tmp2;
 	int err;
 
-	emu = container_of(work, struct snd_emu10k1,
-			   emu1010.firmware_work);
-	if (emu->card->shutdown)
+	// The docking events clearly arrive prematurely - while the
+	// Dock's FPGA seems to be successfully programmed, the Dock
+	// fails to initialize subsequently if we don't give it some
+	// time to "warm up" here.
+	msleep(200);
+
+	dev_info(emu->card->dev, "emu1010: Loading Audio Dock Firmware\n");
+	/* Return to Audio Dock programming mode */
+	snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG,
+			       EMU_HANA_FPGA_CONFIG_AUDIODOCK);
+	err = snd_emu1010_load_firmware(emu, 1, &emu->dock_fw);
+	if (err < 0)
 		return;
-#ifdef CONFIG_PM_SLEEP
-	if (emu->suspend)
+	snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, 0);
+
+	snd_emu1010_fpga_read(emu, EMU_HANA_ID, &tmp);
+	dev_dbg(emu->card->dev, "emu1010: EMU_HANA+DOCK_ID = 0x%x\n", tmp);
+	if ((tmp & 0x1f) != 0x15) {
+		/* FPGA failed to be programmed */
+		dev_err(emu->card->dev,
+			"emu1010: Loading Audio Dock Firmware failed, reg = 0x%x\n",
+			tmp);
 		return;
-#endif
+	}
+	dev_info(emu->card->dev, "emu1010: Audio Dock Firmware loaded\n");
+
+	snd_emu1010_fpga_read(emu, EMU_DOCK_MAJOR_REV, &tmp);
+	snd_emu1010_fpga_read(emu, EMU_DOCK_MINOR_REV, &tmp2);
+	dev_info(emu->card->dev, "Audio Dock ver: %u.%u\n", tmp, tmp2);
+
+	/* Allow DLL to settle, to sync clocking between 1010 and Dock */
+	msleep(10);
+}
+
+static void emu1010_dock_event(struct snd_emu10k1 *emu)
+{
+	u32 reg;
+
 	snd_emu1010_fpga_read(emu, EMU_HANA_OPTION_CARDS, &reg); /* OPTIONS: Which cards are attached to the EMU */
 	if (reg & EMU_HANA_OPTION_DOCK_OFFLINE) {
 		/* Audio Dock attached */
-		/* Return to Audio Dock programming mode */
-		dev_info(emu->card->dev,
-			 "emu1010: Loading Audio Dock Firmware\n");
-		snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG,
-				       EMU_HANA_FPGA_CONFIG_AUDIODOCK);
-		err = snd_emu1010_load_firmware(emu, 1, &emu->dock_fw);
-		if (err < 0)
-			return;
-		snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, 0);
-		snd_emu1010_fpga_read(emu, EMU_HANA_ID, &tmp);
-		dev_info(emu->card->dev,
-			 "emu1010: EMU_HANA+DOCK_ID = 0x%x\n", tmp);
-		if ((tmp & 0x1f) != 0x15) {
-			/* FPGA failed to be programmed */
-			dev_info(emu->card->dev,
-				 "emu1010: Loading Audio Dock Firmware file failed, reg = 0x%x\n",
-				 tmp);
-			return;
-		}
-		dev_info(emu->card->dev,
-			 "emu1010: Audio Dock Firmware loaded\n");
-		snd_emu1010_fpga_read(emu, EMU_DOCK_MAJOR_REV, &tmp);
-		snd_emu1010_fpga_read(emu, EMU_DOCK_MINOR_REV, &tmp2);
-		dev_info(emu->card->dev, "Audio Dock ver: %u.%u\n", tmp, tmp2);
-		/* Sync clocking between 1010 and Dock */
-		/* Allow DLL to settle */
-		msleep(10);
+		snd_emu1010_load_dock_firmware(emu);
 		/* Unmute all. Default is muted after a firmware load */
 		snd_emu1010_fpga_write(emu, EMU_HANA_UNMUTE, EMU_UNMUTE);
+	} else if (!(reg & EMU_HANA_OPTION_DOCK_ONLINE)) {
+		/* Audio Dock removed */
+		dev_info(emu->card->dev, "emu1010: Audio Dock detached\n");
+		/* The hardware auto-mutes all, so we unmute again */
+		snd_emu1010_fpga_write(emu, EMU_HANA_UNMUTE, EMU_UNMUTE);
 	}
 }
 
-static void emu1010_clock_work(struct work_struct *work)
+static void emu1010_clock_event(struct snd_emu10k1 *emu)
 {
-	struct snd_emu10k1 *emu;
 	struct snd_ctl_elem_id id;
 
-	emu = container_of(work, struct snd_emu10k1,
-			   emu1010.clock_work);
-	if (emu->card->shutdown)
-		return;
-#ifdef CONFIG_PM_SLEEP
-	if (emu->suspend)
-		return;
-#endif
-
 	spin_lock_irq(&emu->reg_lock);
 	// This is the only thing that can actually happen.
 	emu->emu1010.clock_source = emu->emu1010.clock_fallback;
@@ -805,21 +803,40 @@
 	snd_ctl_notify(emu->card, SNDRV_CTL_EVENT_MASK_VALUE, &id);
 }
 
-static void emu1010_interrupt(struct snd_emu10k1 *emu)
+static void emu1010_work(struct work_struct *work)
 {
+	struct snd_emu10k1 *emu;
 	u32 sts;
 
+	emu = container_of(work, struct snd_emu10k1, emu1010.work);
+	if (emu->card->shutdown)
+		return;
+#ifdef CONFIG_PM_SLEEP
+	if (emu->suspend)
+		return;
+#endif
+
 	snd_emu1010_fpga_read(emu, EMU_HANA_IRQ_STATUS, &sts);
-	if (sts & EMU_HANA_IRQ_DOCK_LOST) {
-		/* Audio Dock removed */
-		dev_info(emu->card->dev, "emu1010: Audio Dock detached\n");
-		/* The hardware auto-mutes all, so we unmute again */
-		snd_emu1010_fpga_write(emu, EMU_HANA_UNMUTE, EMU_UNMUTE);
-	} else if (sts & EMU_HANA_IRQ_DOCK) {
-		schedule_work(&emu->emu1010.firmware_work);
-	}
+
+	// The distinction of the IRQ status bits is unreliable,
+	// so we dispatch later based on option card status.
+	if (sts & (EMU_HANA_IRQ_DOCK | EMU_HANA_IRQ_DOCK_LOST))
+		emu1010_dock_event(emu);
+
 	if (sts & EMU_HANA_IRQ_WCLK_CHANGED)
-		schedule_work(&emu->emu1010.clock_work);
+		emu1010_clock_event(emu);
+}
+
+static void emu1010_interrupt(struct snd_emu10k1 *emu)
+{
+	// We get an interrupt on each GPIO input pin change, but we
+	// care only about the ones triggered by the dedicated pin.
+	u16 sts = inw(emu->port + A_GPIO);
+	u16 bit = emu->card_capabilities->ca0108_chip ? 0x2000 : 0x8000;
+	if (!(sts & bit))
+		return;
+
+	schedule_work(&emu->emu1010.work);
 }
 
 /*
@@ -889,7 +906,7 @@
 	snd_emu1010_fpga_read(emu, EMU_HANA_OPTION_CARDS, &reg);
 	dev_info(emu->card->dev, "emu1010: Card options = 0x%x\n", reg);
 	if (reg & EMU_HANA_OPTION_DOCK_OFFLINE)
-		schedule_work(&emu->emu1010.firmware_work);
+		snd_emu1010_load_dock_firmware(emu);
 	if (emu->card_capabilities->no_adat) {
 		emu->emu1010.optical_in = 0; /* IN_SPDIF */
 		emu->emu1010.optical_out = 0; /* OUT_SPDIF */
@@ -960,8 +977,7 @@
 		/* Disable 48Volt power to Audio Dock */
 		snd_emu1010_fpga_write(emu, EMU_HANA_DOCK_PWR, 0);
 	}
-	cancel_work_sync(&emu->emu1010.firmware_work);
-	cancel_work_sync(&emu->emu1010.clock_work);
+	cancel_work_sync(&emu->emu1010.work);
 	release_firmware(emu->firmware);
 	release_firmware(emu->dock_fw);
 	snd_util_memhdr_free(emu->memhdr);
@@ -1540,8 +1556,7 @@
 	emu->irq = -1;
 	emu->synth = NULL;
 	emu->get_synth_voice = NULL;
-	INIT_WORK(&emu->emu1010.firmware_work, emu1010_firmware_work);
-	INIT_WORK(&emu->emu1010.clock_work, emu1010_clock_work);
+	INIT_WORK(&emu->emu1010.work, emu1010_work);
 	/* read revision & serial */
 	emu->revision = pci->revision;
 	pci_read_config_dword(pci, PCI_SUBSYSTEM_VENDOR_ID, &emu->serial);
--- linux-qcom-6.8.0.orig/sound/pci/emu10k1/io.c
+++ linux-qcom-6.8.0/sound/pci/emu10k1/io.c
@@ -285,6 +285,7 @@
 	outw(value, emu->port + A_GPIO);
 	udelay(10);
 	outw(value | 0x80 , emu->port + A_GPIO);  /* High bit clocks the value into the fpga. */
+	udelay(10);
 }
 
 void snd_emu1010_fpga_write(struct snd_emu10k1 *emu, u32 reg, u32 value)
--- linux-qcom-6.8.0.orig/sound/pci/hda/Kconfig
+++ linux-qcom-6.8.0/sound/pci/hda/Kconfig
@@ -157,6 +157,7 @@
 	depends on ACPI || COMPILE_TEST
 	depends on SND_SOC
 	select FW_CS_DSP
+	imply SERIAL_MULTI_INSTANTIATE
 	select SND_HDA_GENERIC
 	select SND_SOC_CS35L56_SHARED
 	select SND_HDA_SCODEC_CS35L56
@@ -172,6 +173,7 @@
 	depends on ACPI || COMPILE_TEST
 	depends on SND_SOC
 	select FW_CS_DSP
+	imply SERIAL_MULTI_INSTANTIATE
 	select SND_HDA_GENERIC
 	select SND_SOC_CS35L56_SHARED
 	select SND_HDA_SCODEC_CS35L56
@@ -189,7 +191,7 @@
 	depends on SND_SOC
 	select SND_SOC_TAS2781_COMLIB
 	select SND_SOC_TAS2781_FMWLIB
-	select CRC32_SARWATE
+	select CRC32
 	help
 	  Say Y or M here to include TAS2781 I2C HD-audio side codec support
 	  in snd-hda-intel driver, such as ALC287.
@@ -199,6 +201,7 @@
 
 config SND_HDA_CODEC_REALTEK
 	tristate "Build Realtek HD-audio codec support"
+	depends on INPUT
 	select SND_HDA_GENERIC
 	select SND_HDA_GENERIC_LEDS
 	help
--- linux-qcom-6.8.0.orig/sound/pci/hda/cs35l41_hda.c
+++ linux-qcom-6.8.0/sound/pci/hda/cs35l41_hda.c
@@ -1362,7 +1362,7 @@
 	if (comps[cs35l41->index].dev == dev) {
 		memset(&comps[cs35l41->index], 0, sizeof(*comps));
 		sleep_flags = lock_system_sleep();
-		device_link_remove(&comps->codec->core.dev, cs35l41->dev);
+		device_link_remove(&cs35l41->codec->core.dev, cs35l41->dev);
 		unlock_system_sleep(sleep_flags);
 	}
 }
@@ -1857,6 +1857,8 @@
 {
 	struct cs35l41_hda *cs35l41 = dev_get_drvdata(dev);
 
+	component_del(cs35l41->dev, &cs35l41_hda_comp_ops);
+
 	pm_runtime_get_sync(cs35l41->dev);
 	pm_runtime_dont_use_autosuspend(cs35l41->dev);
 	pm_runtime_disable(cs35l41->dev);
@@ -1864,8 +1866,6 @@
 	if (cs35l41->halo_initialized)
 		cs35l41_remove_dsp(cs35l41);
 
-	component_del(cs35l41->dev, &cs35l41_hda_comp_ops);
-
 	acpi_dev_put(cs35l41->dacpi);
 
 	pm_runtime_put_noidle(cs35l41->dev);
--- linux-qcom-6.8.0.orig/sound/pci/hda/cs35l41_hda_property.c
+++ linux-qcom-6.8.0/sound/pci/hda/cs35l41_hda_property.c
@@ -97,13 +97,20 @@
 	{ "10431F12", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 },
 	{ "10431F1F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 },
 	{ "10431F62", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 },
+	{ "10433A60", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 },
 	{ "17AA386F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 },
+	{ "17AA3877", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 },
+	{ "17AA3878", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 },
 	{ "17AA38A9", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 2, -1, 0, 0, 0 },
 	{ "17AA38AB", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 2, -1, 0, 0, 0 },
 	{ "17AA38B4", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 },
 	{ "17AA38B5", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 },
 	{ "17AA38B6", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 },
 	{ "17AA38B7", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 },
+	{ "17AA38C7", 4, INTERNAL, { CS35L41_RIGHT, CS35L41_LEFT, CS35L41_RIGHT, CS35L41_LEFT }, 0, 2, -1, 1000, 4500, 24 },
+	{ "17AA38C8", 4, INTERNAL, { CS35L41_RIGHT, CS35L41_LEFT, CS35L41_RIGHT, CS35L41_LEFT }, 0, 2, -1, 1000, 4500, 24 },
+	{ "17AA38F9", 2, EXTERNAL, { CS35L41_RIGHT, CS35L41_LEFT, 0, 0 }, 0, 2, -1, 0, 0, 0 },
+	{ "17AA38FA", 2, EXTERNAL, { CS35L41_RIGHT, CS35L41_LEFT, 0, 0 }, 0, 2, -1, 0, 0, 0 },
 	{}
 };
 
@@ -210,6 +217,7 @@
 	struct spi_device *spi;
 	bool dsd_found;
 	int ret;
+	int i;
 
 	for (cfg = cs35l41_config_table; cfg->ssid; cfg++) {
 		if (!strcasecmp(cfg->ssid, cs35l41->acpi_subsystem_id))
@@ -295,16 +303,6 @@
 			cs35l41->index = id == 0x40 ? 0 : 1;
 	}
 
-	if (cfg->num_amps == 3)
-		/* 3 amps means a center channel, so no duplicate channels */
-		cs35l41->channel_index = 0;
-	else
-		/*
-		 * if 4 amps, there are duplicate channels, so they need different indexes
-		 * if 2 amps, no duplicate channels, channel_index would be 0
-		 */
-		cs35l41->channel_index = cs35l41->index / 2;
-
 	cs35l41->reset_gpio = fwnode_gpiod_get_index(acpi_fwnode_handle(cs35l41->dacpi), "reset",
 						     cs35l41->index, GPIOD_OUT_LOW,
 						     "cs35l41-reset");
@@ -312,6 +310,11 @@
 
 	hw_cfg->spk_pos = cfg->channel[cs35l41->index];
 
+	cs35l41->channel_index = 0;
+	for (i = 0; i < cs35l41->index; i++)
+		if (cfg->channel[i] == hw_cfg->spk_pos)
+			cs35l41->channel_index++;
+
 	if (cfg->boost_type == INTERNAL) {
 		hw_cfg->bst_type = CS35L41_INT_BOOST;
 		hw_cfg->bst_ind = cfg->boost_ind_nanohenry;
@@ -438,13 +441,20 @@
 	{ "CSC3551", "10431F12", generic_dsd_config },
 	{ "CSC3551", "10431F1F", generic_dsd_config },
 	{ "CSC3551", "10431F62", generic_dsd_config },
+	{ "CSC3551", "10433A60", generic_dsd_config },
 	{ "CSC3551", "17AA386F", generic_dsd_config },
+	{ "CSC3551", "17AA3877", generic_dsd_config },
+	{ "CSC3551", "17AA3878", generic_dsd_config },
 	{ "CSC3551", "17AA38A9", generic_dsd_config },
 	{ "CSC3551", "17AA38AB", generic_dsd_config },
 	{ "CSC3551", "17AA38B4", generic_dsd_config },
 	{ "CSC3551", "17AA38B5", generic_dsd_config },
 	{ "CSC3551", "17AA38B6", generic_dsd_config },
 	{ "CSC3551", "17AA38B7", generic_dsd_config },
+	{ "CSC3551", "17AA38C7", generic_dsd_config },
+	{ "CSC3551", "17AA38C8", generic_dsd_config },
+	{ "CSC3551", "17AA38F9", generic_dsd_config },
+	{ "CSC3551", "17AA38FA", generic_dsd_config },
 	{}
 };
 
--- linux-qcom-6.8.0.orig/sound/pci/hda/cs35l41_hda_spi.c
+++ linux-qcom-6.8.0/sound/pci/hda/cs35l41_hda_spi.c
@@ -38,6 +38,7 @@
 	{ "cs35l41-hda", 0 },
 	{}
 };
+MODULE_DEVICE_TABLE(spi, cs35l41_hda_spi_id);
 
 static const struct acpi_device_id cs35l41_acpi_hda_match[] = {
 	{ "CSC3551", 0 },
--- linux-qcom-6.8.0.orig/sound/pci/hda/cs35l56_hda.c
+++ linux-qcom-6.8.0/sound/pci/hda/cs35l56_hda.c
@@ -142,10 +142,6 @@
 		}
 	}
 
-	ret = cs35l56_force_sync_asp1_registers_from_cache(&cs35l56->base);
-	if (ret)
-		goto err;
-
 	return 0;
 
 err:
@@ -629,6 +625,8 @@
 		ret = cs35l56_wait_for_firmware_boot(&cs35l56->base);
 		if (ret)
 			goto err_powered_up;
+
+		regcache_cache_only(cs35l56->base.regmap, false);
 	}
 
 	/* Disable auto-hibernate so that runtime_pm has control */
@@ -710,11 +708,11 @@
 	if (cs35l56->base.fw_patched)
 		cs_dsp_power_down(&cs35l56->cs_dsp);
 
-	cs_dsp_remove(&cs35l56->cs_dsp);
-
 	if (comps[cs35l56->index].dev == dev)
 		memset(&comps[cs35l56->index], 0, sizeof(*comps));
 
+	cs35l56->codec = NULL;
+
 	dev_dbg(cs35l56->base.dev, "Unbound\n");
 }
 
@@ -820,6 +818,9 @@
 
 	cs35l56->suspended = false;
 
+	if (!cs35l56->codec)
+		return 0;
+
 	ret = cs35l56_is_fw_reload_needed(&cs35l56->base);
 	dev_dbg(cs35l56->base.dev, "fw_reload_needed: %d\n", ret);
 	if (ret > 0) {
@@ -978,6 +979,8 @@
 	if (ret)
 		goto err;
 
+	regcache_cache_only(cs35l56->base.regmap, false);
+
 	ret = cs35l56_set_patch(&cs35l56->base);
 	if (ret)
 		goto err;
@@ -1001,9 +1004,6 @@
 
 	regmap_multi_reg_write(cs35l56->base.regmap, cs35l56_hda_dai_config,
 			       ARRAY_SIZE(cs35l56_hda_dai_config));
-	ret = cs35l56_force_sync_asp1_registers_from_cache(&cs35l56->base);
-	if (ret)
-		goto err;
 
 	/*
 	 * By default only enable one ASP1TXn, where n=amplifier index,
@@ -1017,18 +1017,19 @@
 	pm_runtime_mark_last_busy(cs35l56->base.dev);
 	pm_runtime_enable(cs35l56->base.dev);
 
+	cs35l56->base.init_done = true;
+
 	ret = component_add(cs35l56->base.dev, &cs35l56_hda_comp_ops);
 	if (ret) {
 		dev_err(cs35l56->base.dev, "Register component failed: %d\n", ret);
 		goto pm_err;
 	}
 
-	cs35l56->base.init_done = true;
-
 	return 0;
 
 pm_err:
 	pm_runtime_disable(cs35l56->base.dev);
+	cs_dsp_remove(&cs35l56->cs_dsp);
 err:
 	gpiod_set_value_cansleep(cs35l56->base.reset_gpio, 0);
 
@@ -1040,11 +1041,13 @@
 {
 	struct cs35l56_hda *cs35l56 = dev_get_drvdata(dev);
 
+	component_del(cs35l56->base.dev, &cs35l56_hda_comp_ops);
+
 	pm_runtime_dont_use_autosuspend(cs35l56->base.dev);
 	pm_runtime_get_sync(cs35l56->base.dev);
 	pm_runtime_disable(cs35l56->base.dev);
 
-	component_del(cs35l56->base.dev, &cs35l56_hda_comp_ops);
+	cs_dsp_remove(&cs35l56->cs_dsp);
 
 	kfree(cs35l56->system_name);
 	pm_runtime_put_noidle(cs35l56->base.dev);
--- linux-qcom-6.8.0.orig/sound/pci/hda/cs35l56_hda_i2c.c
+++ linux-qcom-6.8.0/sound/pci/hda/cs35l56_hda_i2c.c
@@ -53,10 +53,19 @@
 	{}
 };
 
+static const struct acpi_device_id cs35l56_acpi_hda_match[] = {
+	{ "CSC3554", 0 },
+	{ "CSC3556", 0 },
+	{ "CSC3557", 0 },
+	{}
+};
+MODULE_DEVICE_TABLE(acpi, cs35l56_acpi_hda_match);
+
 static struct i2c_driver cs35l56_hda_i2c_driver = {
 	.driver = {
-		.name		= "cs35l56-hda",
-		.pm		= &cs35l56_hda_pm_ops,
+		.name		  = "cs35l56-hda",
+		.acpi_match_table = cs35l56_acpi_hda_match,
+		.pm		  = &cs35l56_hda_pm_ops,
 	},
 	.id_table	= cs35l56_hda_i2c_id,
 	.probe		= cs35l56_hda_i2c_probe,
--- linux-qcom-6.8.0.orig/sound/pci/hda/cs35l56_hda_spi.c
+++ linux-qcom-6.8.0/sound/pci/hda/cs35l56_hda_spi.c
@@ -53,10 +53,19 @@
 	{}
 };
 
+static const struct acpi_device_id cs35l56_acpi_hda_match[] = {
+	{ "CSC3554", 0 },
+	{ "CSC3556", 0 },
+	{ "CSC3557", 0 },
+	{}
+};
+MODULE_DEVICE_TABLE(acpi, cs35l56_acpi_hda_match);
+
 static struct spi_driver cs35l56_hda_spi_driver = {
 	.driver = {
-		.name		= "cs35l56-hda",
-		.pm		= &cs35l56_hda_pm_ops,
+		.name		  = "cs35l56-hda",
+		.acpi_match_table = cs35l56_acpi_hda_match,
+		.pm		  = &cs35l56_hda_pm_ops,
 	},
 	.id_table	= cs35l56_hda_spi_id,
 	.probe		= cs35l56_hda_spi_probe,
--- linux-qcom-6.8.0.orig/sound/pci/hda/hda_auto_parser.c
+++ linux-qcom-6.8.0/sound/pci/hda/hda_auto_parser.c
@@ -956,6 +956,28 @@
 }
 EXPORT_SYMBOL_GPL(snd_hda_pick_pin_fixup);
 
+/* check whether the given quirk entry matches with vendor/device pair */
+static bool hda_quirk_match(u16 vendor, u16 device, const struct hda_quirk *q)
+{
+	if (q->subvendor != vendor)
+		return false;
+	return !q->subdevice ||
+		(device & q->subdevice_mask) == q->subdevice;
+}
+
+/* look through the quirk list and return the matching entry */
+static const struct hda_quirk *
+hda_quirk_lookup_id(u16 vendor, u16 device, const struct hda_quirk *list)
+{
+	const struct hda_quirk *q;
+
+	for (q = list; q->subvendor || q->subdevice; q++) {
+		if (hda_quirk_match(vendor, device, q))
+			return q;
+	}
+	return NULL;
+}
+
 /**
  * snd_hda_pick_fixup - Pick up a fixup matching with PCI/codec SSID or model string
  * @codec: the HDA codec
@@ -975,14 +997,16 @@
  */
 void snd_hda_pick_fixup(struct hda_codec *codec,
 			const struct hda_model_fixup *models,
-			const struct snd_pci_quirk *quirk,
+			const struct hda_quirk *quirk,
 			const struct hda_fixup *fixlist)
 {
-	const struct snd_pci_quirk *q;
+	const struct hda_quirk *q;
 	int id = HDA_FIXUP_ID_NOT_SET;
 	const char *name = NULL;
 	const char *type = NULL;
 	unsigned int vendor, device;
+	u16 pci_vendor, pci_device;
+	u16 codec_vendor, codec_device;
 
 	if (codec->fixup_id != HDA_FIXUP_ID_NOT_SET)
 		return;
@@ -1013,27 +1037,42 @@
 	if (!quirk)
 		return;
 
+	if (codec->bus->pci) {
+		pci_vendor = codec->bus->pci->subsystem_vendor;
+		pci_device = codec->bus->pci->subsystem_device;
+	}
+
+	codec_vendor = codec->core.subsystem_id >> 16;
+	codec_device = codec->core.subsystem_id & 0xffff;
+
 	/* match with the SSID alias given by the model string "XXXX:YYYY" */
 	if (codec->modelname &&
 	    sscanf(codec->modelname, "%04x:%04x", &vendor, &device) == 2) {
-		q = snd_pci_quirk_lookup_id(vendor, device, quirk);
+		q = hda_quirk_lookup_id(vendor, device, quirk);
 		if (q) {
 			type = "alias SSID";
 			goto found_device;
 		}
 	}
 
-	/* match with the PCI SSID */
-	q = snd_pci_quirk_lookup(codec->bus->pci, quirk);
-	if (q) {
-		type = "PCI SSID";
-		goto found_device;
+	/* match primarily with the PCI SSID */
+	for (q = quirk; q->subvendor || q->subdevice; q++) {
+		/* if the entry is specific to codec SSID, check with it */
+		if (!codec->bus->pci || q->match_codec_ssid) {
+			if (hda_quirk_match(codec_vendor, codec_device, q)) {
+				type = "codec SSID";
+				goto found_device;
+			}
+		} else {
+			if (hda_quirk_match(pci_vendor, pci_device, q)) {
+				type = "PCI SSID";
+				goto found_device;
+			}
+		}
 	}
 
 	/* match with the codec SSID */
-	q = snd_pci_quirk_lookup_id(codec->core.subsystem_id >> 16,
-				    codec->core.subsystem_id & 0xffff,
-				    quirk);
+	q = hda_quirk_lookup_id(codec_vendor, codec_device, quirk);
 	if (q) {
 		type = "codec SSID";
 		goto found_device;
--- linux-qcom-6.8.0.orig/sound/pci/hda/hda_cs_dsp_ctl.c
+++ linux-qcom-6.8.0/sound/pci/hda/hda_cs_dsp_ctl.c
@@ -8,6 +8,7 @@
 
 #include <linux/module.h>
 #include <sound/soc.h>
+#include <linux/cleanup.h>
 #include <linux/firmware/cirrus/cs_dsp.h>
 #include <linux/firmware/cirrus/wmfw.h>
 #include "hda_cs_dsp_ctl.h"
@@ -97,11 +98,23 @@
 	return out;
 }
 
-static void hda_cs_dsp_add_kcontrol(struct hda_cs_dsp_coeff_ctl *ctl, const char *name)
+static void hda_cs_dsp_free_kcontrol(struct snd_kcontrol *kctl)
 {
+	struct hda_cs_dsp_coeff_ctl *ctl = (struct hda_cs_dsp_coeff_ctl *)snd_kcontrol_chip(kctl);
 	struct cs_dsp_coeff_ctl *cs_ctl = ctl->cs_ctl;
+
+	/* NULL priv to prevent a double-free in hda_cs_dsp_control_remove() */
+	cs_ctl->priv = NULL;
+	kfree(ctl);
+}
+
+static void hda_cs_dsp_add_kcontrol(struct cs_dsp_coeff_ctl *cs_ctl,
+				    const struct hda_cs_dsp_ctl_info *info,
+				    const char *name)
+{
 	struct snd_kcontrol_new kcontrol = {0};
 	struct snd_kcontrol *kctl;
+	struct hda_cs_dsp_coeff_ctl *ctl __free(kfree) = NULL;
 	int ret = 0;
 
 	if (cs_ctl->len > ADSP_MAX_STD_CTRL_SIZE) {
@@ -110,6 +123,13 @@
 		return;
 	}
 
+	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
+	if (!ctl)
+		return;
+
+	ctl->cs_ctl = cs_ctl;
+	ctl->card = info->card;
+
 	kcontrol.name = name;
 	kcontrol.info = hda_cs_dsp_coeff_info;
 	kcontrol.iface = SNDRV_CTL_ELEM_IFACE_MIXER;
@@ -117,20 +137,22 @@
 	kcontrol.get = hda_cs_dsp_coeff_get;
 	kcontrol.put = hda_cs_dsp_coeff_put;
 
-	/* Save ctl inside private_data, ctl is owned by cs_dsp,
-	 * and will be freed when cs_dsp removes the control */
 	kctl = snd_ctl_new1(&kcontrol, (void *)ctl);
 	if (!kctl)
 		return;
 
-	ret = snd_ctl_add(ctl->card, kctl);
+	kctl->private_free = hda_cs_dsp_free_kcontrol;
+	ctl->kctl = kctl;
+
+	/* snd_ctl_add() calls our private_free on error, which will kfree(ctl) */
+	cs_ctl->priv = no_free_ptr(ctl);
+	ret = snd_ctl_add(info->card, kctl);
 	if (ret) {
 		dev_err(cs_ctl->dsp->dev, "Failed to add KControl %s = %d\n", kcontrol.name, ret);
 		return;
 	}
 
 	dev_dbg(cs_ctl->dsp->dev, "Added KControl: %s\n", kcontrol.name);
-	ctl->kctl = kctl;
 }
 
 static void hda_cs_dsp_control_add(struct cs_dsp_coeff_ctl *cs_ctl,
@@ -138,7 +160,6 @@
 {
 	struct cs_dsp *cs_dsp = cs_ctl->dsp;
 	char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
-	struct hda_cs_dsp_coeff_ctl *ctl;
 	const char *region_name;
 	int ret;
 
@@ -163,15 +184,7 @@
 			 " %.*s", cs_ctl->subname_len - skip, cs_ctl->subname + skip);
 	}
 
-	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
-	if (!ctl)
-		return;
-
-	ctl->cs_ctl = cs_ctl;
-	ctl->card = info->card;
-	cs_ctl->priv = ctl;
-
-	hda_cs_dsp_add_kcontrol(ctl, name);
+	hda_cs_dsp_add_kcontrol(cs_ctl, info, name);
 }
 
 void hda_cs_dsp_add_controls(struct cs_dsp *dsp, const struct hda_cs_dsp_ctl_info *info)
@@ -203,7 +216,9 @@
 {
 	struct hda_cs_dsp_coeff_ctl *ctl = cs_ctl->priv;
 
-	kfree(ctl);
+	/* ctl and kctl may already have been removed by ALSA private_free */
+	if (ctl && ctl->kctl)
+		snd_ctl_remove(ctl->card, ctl->kctl);
 }
 EXPORT_SYMBOL_NS_GPL(hda_cs_dsp_control_remove, SND_HDA_CS_DSP_CONTROLS);
 
--- linux-qcom-6.8.0.orig/sound/pci/hda/hda_generic.c
+++ linux-qcom-6.8.0/sound/pci/hda/hda_generic.c
@@ -1383,7 +1383,7 @@
 		struct nid_path *path;
 		hda_nid_t pin = pins[i];
 
-		if (!spec->obey_preferred_dacs) {
+		if (!spec->preferred_dacs) {
 			path = snd_hda_get_path_from_idx(codec, path_idx[i]);
 			if (path) {
 				badness += assign_out_path_ctls(codec, path);
@@ -1395,7 +1395,7 @@
 		if (dacs[i]) {
 			if (is_dac_already_used(codec, dacs[i]))
 				badness += bad->shared_primary;
-		} else if (spec->obey_preferred_dacs) {
+		} else if (spec->preferred_dacs) {
 			badness += BAD_NO_PRIMARY_DAC;
 		}
 
@@ -4955,6 +4955,69 @@
 }
 EXPORT_SYMBOL_GPL(snd_hda_gen_stream_pm);
 
+/* forcibly mute the speaker output without caching; return true if updated */
+static bool force_mute_output_path(struct hda_codec *codec, hda_nid_t nid)
+{
+	if (!nid)
+		return false;
+	if (!nid_has_mute(codec, nid, HDA_OUTPUT))
+		return false; /* no mute, skip */
+	if (snd_hda_codec_amp_read(codec, nid, 0, HDA_OUTPUT, 0) &
+	    snd_hda_codec_amp_read(codec, nid, 1, HDA_OUTPUT, 0) &
+	    HDA_AMP_MUTE)
+		return false; /* both channels already muted, skip */
+
+	/* direct amp update without caching */
+	snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE,
+			    AC_AMP_SET_OUTPUT | AC_AMP_SET_LEFT |
+			    AC_AMP_SET_RIGHT | HDA_AMP_MUTE);
+	return true;
+}
+
+/**
+ * snd_hda_gen_shutup_speakers - Forcibly mute the speaker outputs
+ * @codec: the HDA codec
+ *
+ * Forcibly mute the speaker outputs, to be called at suspend or shutdown.
+ *
+ * The mute state done by this function isn't cached, hence the original state
+ * will be restored at resume.
+ *
+ * Return true if the mute state has been changed.
+ */
+bool snd_hda_gen_shutup_speakers(struct hda_codec *codec)
+{
+	struct hda_gen_spec *spec = codec->spec;
+	const int *paths;
+	const struct nid_path *path;
+	int i, p, num_paths;
+	bool updated = false;
+
+	/* if already powered off, do nothing */
+	if (!snd_hdac_is_power_on(&codec->core))
+		return false;
+
+	if (spec->autocfg.line_out_type == AUTO_PIN_SPEAKER_OUT) {
+		paths = spec->out_paths;
+		num_paths = spec->autocfg.line_outs;
+	} else {
+		paths = spec->speaker_paths;
+		num_paths = spec->autocfg.speaker_outs;
+	}
+
+	for (i = 0; i < num_paths; i++) {
+		path = snd_hda_get_path_from_idx(codec, paths[i]);
+		if (!path)
+			continue;
+		for (p = 0; p < path->depth; p++)
+			if (force_mute_output_path(codec, path->path[p]))
+				updated = true;
+	}
+
+	return updated;
+}
+EXPORT_SYMBOL_GPL(snd_hda_gen_shutup_speakers);
+
 /**
  * snd_hda_gen_parse_auto_config - Parse the given BIOS configuration and
  * set up the hda_gen_spec
--- linux-qcom-6.8.0.orig/sound/pci/hda/hda_generic.h
+++ linux-qcom-6.8.0/sound/pci/hda/hda_generic.h
@@ -355,5 +355,6 @@
 int snd_hda_gen_add_micmute_led_cdev(struct hda_codec *codec,
 				     int (*callback)(struct led_classdev *,
 						     enum led_brightness));
+bool snd_hda_gen_shutup_speakers(struct hda_codec *codec);
 
 #endif /* __SOUND_HDA_GENERIC_H */
--- linux-qcom-6.8.0.orig/sound/pci/hda/hda_intel.c
+++ linux-qcom-6.8.0/sound/pci/hda/hda_intel.c
@@ -2682,7 +2682,7 @@
 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS |
 	  AZX_DCAPS_PM_RUNTIME },
 	/* GLENFLY */
-	{ PCI_DEVICE(0x6766, PCI_ANY_ID),
+	{ PCI_DEVICE(PCI_VENDOR_ID_GLENFLY, PCI_ANY_ID),
 	  .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8,
 	  .class_mask = 0xffffff,
 	  .driver_data = AZX_DRIVER_GFHDMI | AZX_DCAPS_POSFIX_LPIB |
--- linux-qcom-6.8.0.orig/sound/pci/hda/hda_local.h
+++ linux-qcom-6.8.0/sound/pci/hda/hda_local.h
@@ -292,6 +292,32 @@
 	} v;
 };
 
+/*
+ * extended form of snd_pci_quirk:
+ * for PCI SSID matching, use SND_PCI_QUIRK() like before;
+ * for codec SSID matching, use the new HDA_CODEC_QUIRK() instead
+ */
+struct hda_quirk {
+	unsigned short subvendor;	/* PCI subvendor ID */
+	unsigned short subdevice;	/* PCI subdevice ID */
+	unsigned short subdevice_mask;	/* bitmask to match */
+	bool match_codec_ssid;		/* match only with codec SSID */
+	int value;			/* value */
+#ifdef CONFIG_SND_DEBUG_VERBOSE
+	const char *name;		/* name of the device (optional) */
+#endif
+};
+
+#ifdef CONFIG_SND_DEBUG_VERBOSE
+#define HDA_CODEC_QUIRK(vend, dev, xname, val) \
+	{ _SND_PCI_QUIRK_ID(vend, dev), .value = (val), .name = (xname),\
+			.match_codec_ssid = true }
+#else
+#define HDA_CODEC_QUIRK(vend, dev, xname, val) \
+	{ _SND_PCI_QUIRK_ID(vend, dev), .value = (val), \
+			.match_codec_ssid = true }
+#endif
+
 struct snd_hda_pin_quirk {
 	unsigned int codec;             /* Codec vendor/device ID */
 	unsigned short subvendor;	/* PCI subvendor ID */
@@ -351,7 +377,7 @@
 void __snd_hda_apply_fixup(struct hda_codec *codec, int id, int action, int depth);
 void snd_hda_pick_fixup(struct hda_codec *codec,
 			const struct hda_model_fixup *models,
-			const struct snd_pci_quirk *quirk,
+			const struct hda_quirk *quirk,
 			const struct hda_fixup *fixlist);
 void snd_hda_pick_pin_fixup(struct hda_codec *codec,
 			    const struct snd_hda_pin_quirk *pin_quirk,
--- linux-qcom-6.8.0.orig/sound/pci/hda/ideapad_hotkey_led_helper.c
+++ linux-qcom-6.8.0/sound/pci/hda/ideapad_hotkey_led_helper.c
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Ideapad helper functions for Lenovo Ideapad LED control,
+ * It should be included from codec driver.
+ */
+
+#if IS_ENABLED(CONFIG_IDEAPAD_LAPTOP)
+
+#include <linux/acpi.h>
+#include <linux/leds.h>
+
+static bool is_ideapad(struct hda_codec *codec)
+{
+	return (codec->core.subsystem_id >> 16 == 0x17aa) &&
+	       (acpi_dev_found("LHK2019") || acpi_dev_found("VPC2004"));
+}
+
+static void hda_fixup_ideapad_acpi(struct hda_codec *codec,
+				   const struct hda_fixup *fix, int action)
+{
+	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+		if (!is_ideapad(codec))
+			return;
+		snd_hda_gen_add_mute_led_cdev(codec, NULL);
+		snd_hda_gen_add_micmute_led_cdev(codec, NULL);
+	}
+}
+
+#else /* CONFIG_IDEAPAD_LAPTOP */
+
+static void hda_fixup_ideapad_acpi(struct hda_codec *codec,
+				   const struct hda_fixup *fix, int action)
+{
+}
+
+#endif /* CONFIG_IDEAPAD_LAPTOP */
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_analog.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_analog.c
@@ -349,7 +349,7 @@
 	},
 };
 
-static const struct snd_pci_quirk ad1986a_fixup_tbl[] = {
+static const struct hda_quirk ad1986a_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x30af, "HP B2800", AD1986A_FIXUP_LAPTOP_IMIC),
 	SND_PCI_QUIRK(0x1043, 0x1153, "ASUS M9V", AD1986A_FIXUP_LAPTOP_IMIC),
 	SND_PCI_QUIRK(0x1043, 0x1443, "ASUS Z99He", AD1986A_FIXUP_EAPD),
@@ -592,7 +592,7 @@
 	},
 };
 
-static const struct snd_pci_quirk ad1981_fixup_tbl[] = {
+static const struct hda_quirk ad1981_fixup_tbl[] = {
 	SND_PCI_QUIRK_VENDOR(0x1014, "Lenovo", AD1981_FIXUP_AMP_OVERRIDE),
 	SND_PCI_QUIRK_VENDOR(0x103c, "HP", AD1981_FIXUP_HP_EAPD),
 	SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", AD1981_FIXUP_AMP_OVERRIDE),
@@ -1065,7 +1065,7 @@
 	},
 };
 
-static const struct snd_pci_quirk ad1884_fixup_tbl[] = {
+static const struct hda_quirk ad1884_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x2a82, "HP Touchsmart", AD1884_FIXUP_HP_TOUCHSMART),
 	SND_PCI_QUIRK_VENDOR(0x103c, "HP", AD1884_FIXUP_HP_EAPD),
 	SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo Thinkpad", AD1884_FIXUP_THINKPAD),
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_ca0132.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_ca0132.c
@@ -1134,7 +1134,6 @@
 
 	struct hda_codec *codec;
 	struct delayed_work unsol_hp_work;
-	int quirk;
 
 #ifdef ENABLE_TUNING_CONTROLS
 	long cur_ctl_vals[TUNING_CTLS_COUNT];
@@ -1166,7 +1165,6 @@
  * CA0132 quirks table
  */
 enum {
-	QUIRK_NONE,
 	QUIRK_ALIENWARE,
 	QUIRK_ALIENWARE_M17XR4,
 	QUIRK_SBZ,
@@ -1176,10 +1174,11 @@
 	QUIRK_R3D,
 	QUIRK_AE5,
 	QUIRK_AE7,
+	QUIRK_NONE = HDA_FIXUP_ID_NOT_SET,
 };
 
 #ifdef CONFIG_PCI
-#define ca0132_quirk(spec)		((spec)->quirk)
+#define ca0132_quirk(spec)		((spec)->codec->fixup_id)
 #define ca0132_use_pci_mmio(spec)	((spec)->use_pci_mmio)
 #define ca0132_use_alt_functions(spec)	((spec)->use_alt_functions)
 #define ca0132_use_alt_controls(spec)	((spec)->use_alt_controls)
@@ -1293,7 +1292,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk ca0132_quirks[] = {
+static const struct hda_quirk ca0132_quirks[] = {
 	SND_PCI_QUIRK(0x1028, 0x057b, "Alienware M17x R4", QUIRK_ALIENWARE_M17XR4),
 	SND_PCI_QUIRK(0x1028, 0x0685, "Alienware 15 2015", QUIRK_ALIENWARE),
 	SND_PCI_QUIRK(0x1028, 0x0688, "Alienware 17 2015", QUIRK_ALIENWARE),
@@ -1316,6 +1315,19 @@
 	{}
 };
 
+static const struct hda_model_fixup ca0132_quirk_models[] = {
+	{ .id = QUIRK_ALIENWARE, .name = "alienware" },
+	{ .id = QUIRK_ALIENWARE_M17XR4, .name = "alienware-m17xr4" },
+	{ .id = QUIRK_SBZ, .name = "sbz" },
+	{ .id = QUIRK_ZXR, .name = "zxr" },
+	{ .id = QUIRK_ZXR_DBPRO, .name = "zxr-dbpro" },
+	{ .id = QUIRK_R3DI, .name = "r3di" },
+	{ .id = QUIRK_R3D, .name = "r3d" },
+	{ .id = QUIRK_AE5, .name = "ae5" },
+	{ .id = QUIRK_AE7, .name = "ae7" },
+	{}
+};
+
 /* Output selection quirk info structures. */
 #define MAX_QUIRK_MMIO_GPIO_SET_VALS 3
 #define MAX_QUIRK_SCP_SET_VALS 2
@@ -9961,17 +9973,15 @@
  */
 static void sbz_detect_quirk(struct hda_codec *codec)
 {
-	struct ca0132_spec *spec = codec->spec;
-
 	switch (codec->core.subsystem_id) {
 	case 0x11020033:
-		spec->quirk = QUIRK_ZXR;
+		codec->fixup_id = QUIRK_ZXR;
 		break;
 	case 0x1102003f:
-		spec->quirk = QUIRK_ZXR_DBPRO;
+		codec->fixup_id = QUIRK_ZXR_DBPRO;
 		break;
 	default:
-		spec->quirk = QUIRK_SBZ;
+		codec->fixup_id = QUIRK_SBZ;
 		break;
 	}
 }
@@ -9980,7 +9990,6 @@
 {
 	struct ca0132_spec *spec;
 	int err;
-	const struct snd_pci_quirk *quirk;
 
 	codec_dbg(codec, "patch_ca0132\n");
 
@@ -9991,11 +10000,7 @@
 	spec->codec = codec;
 
 	/* Detect codec quirk */
-	quirk = snd_pci_quirk_lookup(codec->bus->pci, ca0132_quirks);
-	if (quirk)
-		spec->quirk = quirk->value;
-	else
-		spec->quirk = QUIRK_NONE;
+	snd_hda_pick_fixup(codec, ca0132_quirk_models, ca0132_quirks, NULL);
 	if (ca0132_quirk(spec) == QUIRK_SBZ)
 		sbz_detect_quirk(codec);
 
@@ -10072,7 +10077,7 @@
 		spec->mem_base = pci_iomap(codec->bus->pci, 2, 0xC20);
 		if (spec->mem_base == NULL) {
 			codec_warn(codec, "pci_iomap failed! Setting quirk to QUIRK_NONE.");
-			spec->quirk = QUIRK_NONE;
+			codec->fixup_id = QUIRK_NONE;
 		}
 	}
 #endif
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_cirrus.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_cirrus.c
@@ -385,7 +385,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
+static const struct hda_quirk cs420x_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53),
 	SND_PCI_QUIRK(0x10de, 0x0d94, "MacBookAir 3,1(2)", CS420X_MBP55),
 	SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55),
@@ -634,13 +634,13 @@
 	{}
 };
 
-static const struct snd_pci_quirk cs4208_fixup_tbl[] = {
+static const struct hda_quirk cs4208_fixup_tbl[] = {
 	SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS4208_MAC_AUTO),
 	{} /* terminator */
 };
 
 /* codec SSID matching */
-static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {
+static const struct hda_quirk cs4208_mac_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
 	SND_PCI_QUIRK(0x106b, 0x6c00, "MacMini 7,1", CS4208_MACMINI),
 	SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
@@ -818,7 +818,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk cs421x_fixup_tbl[] = {
+static const struct hda_quirk cs421x_fixup_tbl[] = {
 	/* Test Intel board + CDB2410  */
 	SND_PCI_QUIRK(0x8086, 0x5001, "DP45SG/CDB4210", CS421X_CDB4210),
 	{} /* terminator */
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_conexant.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_conexant.c
@@ -21,12 +21,6 @@
 #include "hda_jack.h"
 #include "hda_generic.h"
 
-enum {
-	CX_HEADSET_NOPRESENT = 0,
-	CX_HEADSET_PARTPRESENT,
-	CX_HEADSET_ALLPRESENT,
-};
-
 struct conexant_spec {
 	struct hda_gen_spec gen;
 
@@ -48,7 +42,6 @@
 	unsigned int gpio_led;
 	unsigned int gpio_mute_led_mask;
 	unsigned int gpio_mic_led_mask;
-	unsigned int headset_present_flag;
 	bool is_cx8070_sn6140;
 };
 
@@ -250,48 +243,19 @@
 	}
 }
 
-static void cx_update_headset_mic_vref(struct hda_codec *codec, unsigned int res)
+static void cx_update_headset_mic_vref(struct hda_codec *codec, struct hda_jack_callback *event)
 {
-	unsigned int phone_present, mic_persent, phone_tag, mic_tag;
-	struct conexant_spec *spec = codec->spec;
+	unsigned int mic_present;
 
 	/* In cx8070 and sn6140, the node 16 can only be config to headphone or disabled,
 	 * the node 19 can only be config to microphone or disabled.
 	 * Check hp&mic tag to process headset pulgin&plugout.
 	 */
-	phone_tag = snd_hda_codec_read(codec, 0x16, 0, AC_VERB_GET_UNSOLICITED_RESPONSE, 0x0);
-	mic_tag = snd_hda_codec_read(codec, 0x19, 0, AC_VERB_GET_UNSOLICITED_RESPONSE, 0x0);
-	if ((phone_tag & (res >> AC_UNSOL_RES_TAG_SHIFT)) ||
-	    (mic_tag & (res >> AC_UNSOL_RES_TAG_SHIFT))) {
-		phone_present = snd_hda_codec_read(codec, 0x16, 0, AC_VERB_GET_PIN_SENSE, 0x0);
-		if (!(phone_present & AC_PINSENSE_PRESENCE)) {/* headphone plugout */
-			spec->headset_present_flag = CX_HEADSET_NOPRESENT;
-			snd_hda_codec_write(codec, 0x19, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x20);
-			return;
-		}
-		if (spec->headset_present_flag == CX_HEADSET_NOPRESENT) {
-			spec->headset_present_flag = CX_HEADSET_PARTPRESENT;
-		} else if (spec->headset_present_flag == CX_HEADSET_PARTPRESENT) {
-			mic_persent = snd_hda_codec_read(codec, 0x19, 0,
-							 AC_VERB_GET_PIN_SENSE, 0x0);
-			/* headset is present */
-			if ((phone_present & AC_PINSENSE_PRESENCE) &&
-			    (mic_persent & AC_PINSENSE_PRESENCE)) {
-				cx_process_headset_plugin(codec);
-				spec->headset_present_flag = CX_HEADSET_ALLPRESENT;
-			}
-		}
-	}
-}
-
-static void cx_jack_unsol_event(struct hda_codec *codec, unsigned int res)
-{
-	struct conexant_spec *spec = codec->spec;
-
-	if (spec->is_cx8070_sn6140)
-		cx_update_headset_mic_vref(codec, res);
-
-	snd_hda_jack_unsol_event(codec, res);
+	mic_present = snd_hda_codec_read(codec, 0x19, 0, AC_VERB_GET_PIN_SENSE, 0x0);
+	if (!(mic_present & AC_PINSENSE_PRESENCE)) /* mic plugout */
+		snd_hda_codec_write(codec, 0x19, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x20);
+	else
+		cx_process_headset_plugin(codec);
 }
 
 #ifdef CONFIG_PM
@@ -307,7 +271,7 @@
 	.build_pcms = snd_hda_gen_build_pcms,
 	.init = cx_auto_init,
 	.free = cx_auto_free,
-	.unsol_event = cx_jack_unsol_event,
+	.unsol_event = snd_hda_jack_unsol_event,
 #ifdef CONFIG_PM
 	.suspend = cx_auto_suspend,
 	.check_power_status = snd_hda_gen_check_power_status,
@@ -331,6 +295,7 @@
 	CXT_FIXUP_GPIO1,
 	CXT_FIXUP_ASPIRE_DMIC,
 	CXT_FIXUP_THINKPAD_ACPI,
+	CXT_FIXUP_LENOVO_XPAD_ACPI,
 	CXT_FIXUP_OLPC_XO,
 	CXT_FIXUP_CAP_MIX_AMP,
 	CXT_FIXUP_TOSHIBA_P105,
@@ -341,15 +306,21 @@
 	CXT_FIXUP_HP_SPECTRE,
 	CXT_FIXUP_HP_GATE_MIC,
 	CXT_FIXUP_MUTE_LED_GPIO,
+	CXT_FIXUP_HP_ELITEONE_OUT_DIS,
 	CXT_FIXUP_HP_ZBOOK_MUTE_LED,
 	CXT_FIXUP_HEADSET_MIC,
 	CXT_FIXUP_HP_MIC_NO_PRESENCE,
 	CXT_PINCFG_SWS_JS201D,
+	CXT_PINCFG_TOP_SPEAKER,
+	CXT_FIXUP_HP_A_U,
 };
 
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
 
+/* for hda_fixup_ideapad_acpi() */
+#include "ideapad_hotkey_led_helper.c"
+
 static void cxt_fixup_stereo_dmic(struct hda_codec *codec,
 				  const struct hda_fixup *fix, int action)
 {
@@ -357,6 +328,19 @@
 	spec->gen.inv_dmic_split = 1;
 }
 
+/* fix widget control pin settings */
+static void cxt_fixup_update_pinctl(struct hda_codec *codec,
+				   const struct hda_fixup *fix, int action)
+{
+	if (action == HDA_FIXUP_ACT_PROBE) {
+		/* Unset OUT_EN for this Node pin, leaving only HP_EN.
+		 * This is the value stored in the codec register after
+		 * the correct initialization of the previous windows boot.
+		 */
+		snd_hda_set_pin_ctl_cache(codec, 0x1d, AC_PINCTL_HP_EN);
+	}
+}
+
 static void cxt5066_increase_mic_boost(struct hda_codec *codec,
 				   const struct hda_fixup *fix, int action)
 {
@@ -799,6 +783,18 @@
 	}
 }
 
+static void cxt_setup_gpio_unmute(struct hda_codec *codec,
+				  unsigned int gpio_mute_mask)
+{
+	if (gpio_mute_mask) {
+		// set gpio data to 0.
+		snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, 0);
+		snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK, gpio_mute_mask);
+		snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION, gpio_mute_mask);
+		snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_STICKY_MASK, 0);
+	}
+}
+
 static void cxt_fixup_mute_led_gpio(struct hda_codec *codec,
 				const struct hda_fixup *fix, int action)
 {
@@ -813,6 +809,15 @@
 		cxt_setup_mute_led(codec, 0x10, 0x20);
 }
 
+static void cxt_fixup_hp_a_u(struct hda_codec *codec,
+			     const struct hda_fixup *fix, int action)
+{
+	// Init vers in BIOS mute the spk/hp by set gpio high to avoid pop noise,
+	// so need to unmute once by clearing the gpio data when runs into the system.
+	if (action == HDA_FIXUP_ACT_INIT)
+		cxt_setup_gpio_unmute(codec, 0x2);
+}
+
 /* ThinkPad X200 & co with cxt5051 */
 static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = {
 	{ 0x16, 0x042140ff }, /* HP (seq# overridden) */
@@ -931,6 +936,12 @@
 		.type = HDA_FIXUP_FUNC,
 		.v.func = hda_fixup_thinkpad_acpi,
 	},
+	[CXT_FIXUP_LENOVO_XPAD_ACPI] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = hda_fixup_ideapad_acpi,
+		.chained = true,
+		.chain_id = CXT_FIXUP_THINKPAD_ACPI,
+	},
 	[CXT_FIXUP_OLPC_XO] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = cxt_fixup_olpc_xo,
@@ -991,6 +1002,10 @@
 		.type = HDA_FIXUP_FUNC,
 		.v.func = cxt_fixup_mute_led_gpio,
 	},
+	[CXT_FIXUP_HP_ELITEONE_OUT_DIS] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = cxt_fixup_update_pinctl,
+	},
 	[CXT_FIXUP_HP_ZBOOK_MUTE_LED] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = cxt_fixup_hp_zbook_mute_led,
@@ -1012,9 +1027,20 @@
 		.type = HDA_FIXUP_PINS,
 		.v.pins = cxt_pincfg_sws_js201d,
 	},
+	[CXT_PINCFG_TOP_SPEAKER] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x1d, 0x82170111 },
+			{ }
+		},
+	},
+	[CXT_FIXUP_HP_A_U] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = cxt_fixup_hp_a_u,
+	},
 };
 
-static const struct snd_pci_quirk cxt5045_fixups[] = {
+static const struct hda_quirk cxt5045_fixups[] = {
 	SND_PCI_QUIRK(0x103c, 0x30d5, "HP 530", CXT_FIXUP_HP_530),
 	SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba P105", CXT_FIXUP_TOSHIBA_P105),
 	/* HP, Packard Bell, Fujitsu-Siemens & Lenovo laptops have
@@ -1034,7 +1060,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk cxt5047_fixups[] = {
+static const struct hda_quirk cxt5047_fixups[] = {
 	/* HP laptops have really bad sound over 0 dB on NID 0x10.
 	 */
 	SND_PCI_QUIRK_VENDOR(0x103c, "HP", CXT_FIXUP_CAP_MIX_AMP_5047),
@@ -1046,7 +1072,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk cxt5051_fixups[] = {
+static const struct hda_quirk cxt5051_fixups[] = {
 	SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
 	{}
@@ -1057,7 +1083,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk cxt5066_fixups[] = {
+static const struct hda_quirk cxt5066_fixups[] = {
 	SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
@@ -1077,6 +1103,7 @@
 	SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
 	SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
 	SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
+	SND_PCI_QUIRK(0x103c, 0x83e5, "HP EliteOne 1000 G2", CXT_FIXUP_HP_ELITEONE_OUT_DIS),
 	SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO),
 	SND_PCI_QUIRK(0x103c, 0x8427, "HP ZBook Studio G5", CXT_FIXUP_HP_ZBOOK_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x844f, "HP ZBook Studio G5", CXT_FIXUP_HP_ZBOOK_MUTE_LED),
@@ -1085,6 +1112,7 @@
 	SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
+	SND_PCI_QUIRK(0x14f1, 0x0252, "MBX-Z60MR100", CXT_FIXUP_HP_A_U),
 	SND_PCI_QUIRK(0x14f1, 0x0265, "SWS JS201D", CXT_PINCFG_SWS_JS201D),
 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
@@ -1105,9 +1133,11 @@
 	SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
-	SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
+	SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad/Ideapad", CXT_FIXUP_LENOVO_XPAD_ACPI),
 	SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
 	SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
+	HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER),
+	HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER),
 	{}
 };
 
@@ -1117,6 +1147,7 @@
 	{ .id = CXT_FIXUP_HEADPHONE_MIC_PIN, .name = "headphone-mic-pin" },
 	{ .id = CXT_PINCFG_LENOVO_TP410, .name = "tp410" },
 	{ .id = CXT_FIXUP_THINKPAD_ACPI, .name = "thinkpad" },
+	{ .id = CXT_FIXUP_LENOVO_XPAD_ACPI, .name = "thinkpad-ideapad" },
 	{ .id = CXT_PINCFG_LEMOTE_A1004, .name = "lemote-a1004" },
 	{ .id = CXT_PINCFG_LEMOTE_A1205, .name = "lemote-a1205" },
 	{ .id = CXT_FIXUP_OLPC_XO, .name = "olpc-xo" },
@@ -1127,6 +1158,8 @@
 	{ .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" },
 	{ .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" },
 	{ .id = CXT_PINCFG_SWS_JS201D, .name = "sws-js201d" },
+	{ .id = CXT_PINCFG_TOP_SPEAKER, .name = "sirius-top-speaker" },
+	{ .id = CXT_FIXUP_HP_A_U, .name = "HP-U-support" },
 	{}
 };
 
@@ -1167,7 +1200,7 @@
 	case 0x14f11f86:
 	case 0x14f11f87:
 		spec->is_cx8070_sn6140 = true;
-		spec->headset_present_flag = CX_HEADSET_NOPRESENT;
+		snd_hda_jack_detect_enable_callback(codec, 0x19, cx_update_headset_mic_vref);
 		break;
 	}
 
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_cs8409-tables.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_cs8409-tables.c
@@ -121,7 +121,7 @@
 	{ CS42L42_MIXER_CHA_VOL, 0x3F },
 	{ CS42L42_MIXER_CHB_VOL, 0x3F },
 	{ CS42L42_MIXER_ADC_VOL, 0x3f },
-	{ CS42L42_HP_CTL, 0x03 },
+	{ CS42L42_HP_CTL, 0x0D },
 	{ CS42L42_MIC_DET_CTL1, 0xB6 },
 	{ CS42L42_TIPSENSE_CTL, 0xC2 },
 	{ CS42L42_HS_CLAMP_DISABLE, 0x01 },
@@ -315,7 +315,7 @@
 	{ CS42L42_ASP_TX_SZ_EN, 0x01 },
 	{ CS42L42_PWR_CTL1, 0x0A },
 	{ CS42L42_PWR_CTL2, 0x84 },
-	{ CS42L42_HP_CTL, 0x03 },
+	{ CS42L42_HP_CTL, 0x0D },
 	{ CS42L42_MIXER_CHA_VOL, 0x3F },
 	{ CS42L42_MIXER_CHB_VOL, 0x3F },
 	{ CS42L42_MIXER_ADC_VOL, 0x3f },
@@ -371,7 +371,7 @@
 	{ CS42L42_ASP_TX_SZ_EN, 0x00 },
 	{ CS42L42_PWR_CTL1, 0x0E },
 	{ CS42L42_PWR_CTL2, 0x84 },
-	{ CS42L42_HP_CTL, 0x01 },
+	{ CS42L42_HP_CTL, 0x0D },
 	{ CS42L42_MIXER_CHA_VOL, 0x3F },
 	{ CS42L42_MIXER_CHB_VOL, 0x3F },
 	{ CS42L42_MIXER_ADC_VOL, 0x3f },
@@ -473,7 +473,7 @@
  *                    Arrays Used for all projects using CS8409
  ******************************************************************************/
 
-const struct snd_pci_quirk cs8409_fixup_tbl[] = {
+const struct hda_quirk cs8409_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1028, 0x0A11, "Bullseye", CS8409_BULLSEYE),
 	SND_PCI_QUIRK(0x1028, 0x0A12, "Bullseye", CS8409_BULLSEYE),
 	SND_PCI_QUIRK(0x1028, 0x0A23, "Bullseye", CS8409_BULLSEYE),
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_cs8409.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_cs8409.c
@@ -876,7 +876,7 @@
 		{ CS42L42_DET_INT_STATUS2, 0x00 },
 		{ CS42L42_TSRS_PLUG_STATUS, 0x00 },
 	};
-	int fsv_old, fsv_new;
+	unsigned int fsv;
 
 	/* Bring CS42L42 out of Reset */
 	spec->gpio_data = snd_hda_codec_read(codec, CS8409_PIN_AFG, 0, AC_VERB_GET_GPIO_DATA, 0);
@@ -893,13 +893,15 @@
 	/* Clear interrupts, by reading interrupt status registers */
 	cs8409_i2c_bulk_read(cs42l42, irq_regs, ARRAY_SIZE(irq_regs));
 
-	fsv_old = cs8409_i2c_read(cs42l42, CS42L42_HP_CTL);
-	if (cs42l42->full_scale_vol == CS42L42_FULL_SCALE_VOL_0DB)
-		fsv_new = fsv_old & ~CS42L42_FULL_SCALE_VOL_MASK;
-	else
-		fsv_new = fsv_old & CS42L42_FULL_SCALE_VOL_MASK;
-	if (fsv_new != fsv_old)
-		cs8409_i2c_write(cs42l42, CS42L42_HP_CTL, fsv_new);
+	fsv = cs8409_i2c_read(cs42l42, CS42L42_HP_CTL);
+	if (cs42l42->full_scale_vol) {
+		// Set the full scale volume bit
+		fsv |= CS42L42_FULL_SCALE_VOL_MASK;
+		cs8409_i2c_write(cs42l42, CS42L42_HP_CTL, fsv);
+	}
+	// Unmute analog channels A and B
+	fsv = (fsv & ~CS42L42_ANA_MUTE_AB);
+	cs8409_i2c_write(cs42l42, CS42L42_HP_CTL, fsv);
 
 	/* we have to explicitly allow unsol event handling even during the
 	 * resume phase so that the jack event is processed properly
@@ -921,7 +923,7 @@
 		{ CS42L42_MIXER_CHA_VOL, 0x3F },
 		{ CS42L42_MIXER_ADC_VOL, 0x3F },
 		{ CS42L42_MIXER_CHB_VOL, 0x3F },
-		{ CS42L42_HP_CTL, 0x0F },
+		{ CS42L42_HP_CTL, 0x0D },
 		{ CS42L42_ASP_RX_DAI0_EN, 0x00 },
 		{ CS42L42_ASP_CLK_CFG, 0x00 },
 		{ CS42L42_PWR_CTL1, 0xFE },
@@ -1411,8 +1413,9 @@
 		kctrl = snd_hda_gen_add_kctl(&spec->gen, "Line Out Playback Volume",
 					     &cs42l42_dac_volume_mixer);
 		/* Update Line Out kcontrol template */
-		kctrl->private_value = HDA_COMPOSE_AMP_VAL_OFS(DOLPHIN_HP_PIN_NID, 3, CS8409_CODEC1,
-				       HDA_OUTPUT, CS42L42_VOL_DAC) | HDA_AMP_VAL_MIN_MUTE;
+		if (kctrl)
+			kctrl->private_value = HDA_COMPOSE_AMP_VAL_OFS(DOLPHIN_HP_PIN_NID, 3, CS8409_CODEC1,
+					       HDA_OUTPUT, CS42L42_VOL_DAC) | HDA_AMP_VAL_MIN_MUTE;
 		cs8409_enable_ur(codec, 0);
 		snd_hda_codec_set_name(codec, "CS8409/CS42L42");
 		break;
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_cs8409.h
+++ linux-qcom-6.8.0/sound/pci/hda/patch_cs8409.h
@@ -230,9 +230,10 @@
 #define CS42L42_PDN_TIMEOUT_US			(250000)
 #define CS42L42_PDN_SLEEP_US			(2000)
 #define CS42L42_INIT_TIMEOUT_MS			(45)
+#define CS42L42_ANA_MUTE_AB			(0x0C)
 #define CS42L42_FULL_SCALE_VOL_MASK		(2)
-#define CS42L42_FULL_SCALE_VOL_0DB		(1)
-#define CS42L42_FULL_SCALE_VOL_MINUS6DB		(0)
+#define CS42L42_FULL_SCALE_VOL_0DB		(0)
+#define CS42L42_FULL_SCALE_VOL_MINUS6DB		(1)
 
 /* Dell BULLSEYE / WARLOCK / CYBORG Specific Definitions */
 
@@ -355,7 +356,7 @@
 
 extern const struct hda_pcm_stream cs42l42_48k_pcm_analog_playback;
 extern const struct hda_pcm_stream cs42l42_48k_pcm_analog_capture;
-extern const struct snd_pci_quirk cs8409_fixup_tbl[];
+extern const struct hda_quirk cs8409_fixup_tbl[];
 extern const struct hda_model_fixup cs8409_models[];
 extern const struct hda_fixup cs8409_fixups[];
 extern const struct hda_verb cs8409_cs42l42_init_verbs[];
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_hdmi.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_hdmi.c
@@ -1989,6 +1989,8 @@
 }
 
 static const struct snd_pci_quirk force_connect_list[] = {
+	SND_PCI_QUIRK(0x103c, 0x83e2, "HP EliteDesk 800 G4", 1),
+	SND_PCI_QUIRK(0x103c, 0x83ef, "HP MP9 G4 Retail System AMS", 1),
 	SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1),
 	SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1),
 	SND_PCI_QUIRK(0x103c, 0x8711, "HP", 1),
@@ -4644,6 +4646,7 @@
 HDA_CODEC_ENTRY(0x8086281d, "Meteor Lake HDMI",	patch_i915_adlp_hdmi),
 HDA_CODEC_ENTRY(0x8086281f, "Raptor Lake P HDMI",	patch_i915_adlp_hdmi),
 HDA_CODEC_ENTRY(0x80862820, "Lunar Lake HDMI",	patch_i915_adlp_hdmi),
+HDA_CODEC_ENTRY(0x80862822, "Panther Lake HDMI",	patch_i915_adlp_hdmi),
 HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI",	patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI",	patch_i915_byt_hdmi),
 HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI",	patch_i915_byt_hdmi),
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_realtek.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_realtek.c
@@ -472,6 +472,8 @@
 		break;
 	case 0x10ec0234:
 	case 0x10ec0274:
+		alc_write_coef_idx(codec, 0x6e, 0x0c25);
+		fallthrough;
 	case 0x10ec0294:
 	case 0x10ec0700:
 	case 0x10ec0701:
@@ -586,10 +588,14 @@
 	switch (codec->core.vendor_id) {
 	case 0x10ec0236:
 	case 0x10ec0256:
+	case 0x10ec0257:
 	case 0x19e58326:
 	case 0x10ec0283:
+	case 0x10ec0285:
 	case 0x10ec0286:
+	case 0x10ec0287:
 	case 0x10ec0288:
+	case 0x10ec0295:
 	case 0x10ec0298:
 		alc_headset_mic_no_shutup(codec);
 		break;
@@ -1551,7 +1557,7 @@
 	},
 };
 
-static const struct snd_pci_quirk alc880_fixup_tbl[] = {
+static const struct hda_quirk alc880_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1019, 0x0f69, "Coeus G610P", ALC880_FIXUP_W810),
 	SND_PCI_QUIRK(0x1043, 0x10c3, "ASUS W5A", ALC880_FIXUP_ASUS_W5A),
 	SND_PCI_QUIRK(0x1043, 0x1964, "ASUS Z71V", ALC880_FIXUP_Z71V),
@@ -1860,7 +1866,7 @@
 	},
 };
 
-static const struct snd_pci_quirk alc260_fixup_tbl[] = {
+static const struct hda_quirk alc260_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x007b, "Acer C20x", ALC260_FIXUP_GPIO1),
 	SND_PCI_QUIRK(0x1025, 0x007f, "Acer Aspire 9500", ALC260_FIXUP_COEF),
 	SND_PCI_QUIRK(0x1025, 0x008f, "Acer", ALC260_FIXUP_GPIO1),
@@ -2552,7 +2558,7 @@
 	},
 };
 
-static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+static const struct hda_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD),
 	SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
 	SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
@@ -2646,6 +2652,7 @@
 	SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x66a2, "Clevo PE60RNE", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x66a6, "Clevo PE60SN[CDE]-[GS]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
@@ -2895,7 +2902,7 @@
 	},
 };
 
-static const struct snd_pci_quirk alc262_fixup_tbl[] = {
+static const struct hda_quirk alc262_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x170b, "HP Z200", ALC262_FIXUP_HP_Z200),
 	SND_PCI_QUIRK(0x10cf, 0x1397, "Fujitsu Lifebook S7110", ALC262_FIXUP_FSC_S7110),
 	SND_PCI_QUIRK(0x10cf, 0x142d, "Fujitsu Lifebook E8410", ALC262_FIXUP_BENQ),
@@ -3056,7 +3063,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk alc268_fixup_tbl[] = {
+static const struct hda_quirk alc268_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x0139, "Acer TravelMate 6293", ALC268_FIXUP_SPDIF),
 	SND_PCI_QUIRK(0x1025, 0x015b, "Acer AOA 150 (ZG5)", ALC268_FIXUP_INV_DMIC),
 	/* below is codec SSID since multiple Toshiba laptops have the
@@ -3598,25 +3605,22 @@
 
 	hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
 
-	if (hp_pin_sense)
+	if (hp_pin_sense) {
 		msleep(2);
+		alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
 
-	alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
-
-	snd_hda_codec_write(codec, hp_pin, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-
-	if (hp_pin_sense || spec->ultra_low_power)
-		msleep(85);
-
-	snd_hda_codec_write(codec, hp_pin, 0,
+		snd_hda_codec_write(codec, hp_pin, 0,
 			    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
 
-	if (hp_pin_sense || spec->ultra_low_power)
-		msleep(100);
+		msleep(75);
+
+		snd_hda_codec_write(codec, hp_pin, 0,
+			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
 
+		msleep(75);
+		alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+	}
 	alc_update_coef_idx(codec, 0x46, 3 << 12, 0);
-	alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
 	alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */
 	alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15);
 	/*
@@ -3640,29 +3644,28 @@
 	alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
 	hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
 
-	if (hp_pin_sense)
+	if (hp_pin_sense) {
 		msleep(2);
 
-	snd_hda_codec_write(codec, hp_pin, 0,
+		snd_hda_codec_write(codec, hp_pin, 0,
 			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
 
-	if (hp_pin_sense || spec->ultra_low_power)
-		msleep(85);
+		msleep(75);
 
 	/* 3k pull low control for Headset jack. */
 	/* NOTE: call this before clearing the pin, otherwise codec stalls */
 	/* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
 	 * when booting with headset plugged. So skip setting it for the codec alc257
 	 */
-	if (spec->en_3kpull_low)
-		alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+		if (spec->en_3kpull_low)
+			alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
 
-	if (!spec->no_shutup_pins)
-		snd_hda_codec_write(codec, hp_pin, 0,
+		if (!spec->no_shutup_pins)
+			snd_hda_codec_write(codec, hp_pin, 0,
 				    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
 
-	if (hp_pin_sense || spec->ultra_low_power)
-		msleep(100);
+		msleep(75);
+	}
 
 	alc_auto_setup_eapd(codec, false);
 	alc_shutup_pins(codec);
@@ -3757,33 +3760,29 @@
 	hp1_pin_sense = snd_hda_jack_detect(codec, hp_pin);
 	hp2_pin_sense = snd_hda_jack_detect(codec, 0x16);
 
-	if (hp1_pin_sense || hp2_pin_sense)
+	if (hp1_pin_sense || hp2_pin_sense) {
 		msleep(2);
+		alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
 
-	alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
-
-	if (hp1_pin_sense || spec->ultra_low_power)
-		snd_hda_codec_write(codec, hp_pin, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-	if (hp2_pin_sense)
-		snd_hda_codec_write(codec, 0x16, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-
-	if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power)
-		msleep(85);
-
-	if (hp1_pin_sense || spec->ultra_low_power)
-		snd_hda_codec_write(codec, hp_pin, 0,
-			    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
-	if (hp2_pin_sense)
-		snd_hda_codec_write(codec, 0x16, 0,
-			    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+		if (hp1_pin_sense)
+			snd_hda_codec_write(codec, hp_pin, 0,
+				    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+		if (hp2_pin_sense)
+			snd_hda_codec_write(codec, 0x16, 0,
+				    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+		msleep(75);
 
-	if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power)
-		msleep(100);
+		if (hp1_pin_sense)
+			snd_hda_codec_write(codec, hp_pin, 0,
+				    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
+		if (hp2_pin_sense)
+			snd_hda_codec_write(codec, 0x16, 0,
+				    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
 
-	alc_update_coef_idx(codec, 0x4a, 3 << 10, 0);
-	alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+		msleep(75);
+		alc_update_coef_idx(codec, 0x4a, 3 << 10, 0);
+		alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+	}
 }
 
 static void alc225_shutup(struct hda_codec *codec)
@@ -3795,36 +3794,35 @@
 	if (!hp_pin)
 		hp_pin = 0x21;
 
-	alc_disable_headset_jack_key(codec);
-	/* 3k pull low control for Headset jack. */
-	alc_update_coef_idx(codec, 0x4a, 0, 3 << 10);
-
 	hp1_pin_sense = snd_hda_jack_detect(codec, hp_pin);
 	hp2_pin_sense = snd_hda_jack_detect(codec, 0x16);
 
-	if (hp1_pin_sense || hp2_pin_sense)
+	if (hp1_pin_sense || hp2_pin_sense) {
+		alc_disable_headset_jack_key(codec);
+		/* 3k pull low control for Headset jack. */
+		alc_update_coef_idx(codec, 0x4a, 0, 3 << 10);
 		msleep(2);
 
-	if (hp1_pin_sense || spec->ultra_low_power)
-		snd_hda_codec_write(codec, hp_pin, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-	if (hp2_pin_sense)
-		snd_hda_codec_write(codec, 0x16, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+		if (hp1_pin_sense)
+			snd_hda_codec_write(codec, hp_pin, 0,
+				    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+		if (hp2_pin_sense)
+			snd_hda_codec_write(codec, 0x16, 0,
+				    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
 
-	if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power)
-		msleep(85);
-
-	if (hp1_pin_sense || spec->ultra_low_power)
-		snd_hda_codec_write(codec, hp_pin, 0,
-			    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
-	if (hp2_pin_sense)
-		snd_hda_codec_write(codec, 0x16, 0,
-			    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+		msleep(75);
 
-	if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power)
-		msleep(100);
+		if (hp1_pin_sense)
+			snd_hda_codec_write(codec, hp_pin, 0,
+				    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+		if (hp2_pin_sense)
+			snd_hda_codec_write(codec, 0x16, 0,
+				    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
 
+		msleep(75);
+		alc_update_coef_idx(codec, 0x4a, 3 << 10, 0);
+		alc_enable_headset_jack_key(codec);
+	}
 	alc_auto_setup_eapd(codec, false);
 	alc_shutup_pins(codec);
 	if (spec->ultra_low_power) {
@@ -3835,9 +3833,6 @@
 		alc_update_coef_idx(codec, 0x4a, 3<<4, 2<<4);
 		msleep(30);
 	}
-
-	alc_update_coef_idx(codec, 0x4a, 3 << 10, 0);
-	alc_enable_headset_jack_key(codec);
 }
 
 static void alc_default_init(struct hda_codec *codec)
@@ -3853,20 +3848,18 @@
 
 	hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
 
-	if (hp_pin_sense)
+	if (hp_pin_sense) {
 		msleep(2);
 
-	snd_hda_codec_write(codec, hp_pin, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-
-	if (hp_pin_sense)
-		msleep(85);
+		snd_hda_codec_write(codec, hp_pin, 0,
+				    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
 
-	snd_hda_codec_write(codec, hp_pin, 0,
-			    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+		msleep(75);
 
-	if (hp_pin_sense)
-		msleep(100);
+		snd_hda_codec_write(codec, hp_pin, 0,
+				    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
+		msleep(75);
+	}
 }
 
 static void alc_default_shutup(struct hda_codec *codec)
@@ -3882,22 +3875,20 @@
 
 	hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
 
-	if (hp_pin_sense)
+	if (hp_pin_sense) {
 		msleep(2);
 
-	snd_hda_codec_write(codec, hp_pin, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-
-	if (hp_pin_sense)
-		msleep(85);
-
-	if (!spec->no_shutup_pins)
 		snd_hda_codec_write(codec, hp_pin, 0,
-				    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+				    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
 
-	if (hp_pin_sense)
-		msleep(100);
+		msleep(75);
+
+		if (!spec->no_shutup_pins)
+			snd_hda_codec_write(codec, hp_pin, 0,
+					    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
 
+		msleep(75);
+	}
 	alc_auto_setup_eapd(codec, false);
 	alc_shutup_pins(codec);
 }
@@ -4802,7 +4793,6 @@
 	}
 }
 
-#if IS_REACHABLE(CONFIG_INPUT)
 static void gpio2_mic_hotkey_event(struct hda_codec *codec,
 				   struct hda_jack_callback *event)
 {
@@ -4911,10 +4901,6 @@
 		spec->kb_dev = NULL;
 	}
 }
-#else /* INPUT */
-#define alc280_fixup_hp_gpio2_mic_hotkey	NULL
-#define alc233_fixup_lenovo_line2_mic_hotkey	NULL
-#endif /* INPUT */
 
 static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec,
 				const struct hda_fixup *fix, int action)
@@ -4928,6 +4914,40 @@
 	}
 }
 
+static void alc233_fixup_lenovo_low_en_micmute_led(struct hda_codec *codec,
+				const struct hda_fixup *fix, int action)
+{
+	struct alc_spec *spec = codec->spec;
+
+	if (action == HDA_FIXUP_ACT_PRE_PROBE)
+		spec->micmute_led_polarity = 1;
+	alc233_fixup_lenovo_line2_mic_hotkey(codec, fix, action);
+}
+
+static void alc_hp_mute_disable(struct hda_codec *codec, unsigned int delay)
+{
+	if (delay <= 0)
+		delay = 75;
+	snd_hda_codec_write(codec, 0x21, 0,
+		    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+	msleep(delay);
+	snd_hda_codec_write(codec, 0x21, 0,
+		    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+	msleep(delay);
+}
+
+static void alc_hp_enable_unmute(struct hda_codec *codec, unsigned int delay)
+{
+	if (delay <= 0)
+		delay = 75;
+	snd_hda_codec_write(codec, 0x21, 0,
+		    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+	msleep(delay);
+	snd_hda_codec_write(codec, 0x21, 0,
+		    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
+	msleep(delay);
+}
+
 static const struct coef_fw alc225_pre_hsmode[] = {
 	UPDATE_COEF(0x4a, 1<<8, 0),
 	UPDATE_COEFEX(0x57, 0x05, 1<<14, 0),
@@ -5029,6 +5049,7 @@
 	case 0x10ec0236:
 	case 0x10ec0256:
 	case 0x19e58326:
+		alc_hp_mute_disable(codec, 75);
 		alc_process_coef_fw(codec, coef0256);
 		break;
 	case 0x10ec0234:
@@ -5063,6 +5084,7 @@
 	case 0x10ec0295:
 	case 0x10ec0289:
 	case 0x10ec0299:
+		alc_hp_mute_disable(codec, 75);
 		alc_process_coef_fw(codec, alc225_pre_hsmode);
 		alc_process_coef_fw(codec, coef0225);
 		break;
@@ -5288,6 +5310,7 @@
 	case 0x10ec0299:
 		alc_process_coef_fw(codec, alc225_pre_hsmode);
 		alc_process_coef_fw(codec, coef0225);
+		alc_hp_enable_unmute(codec, 75);
 		break;
 	case 0x10ec0255:
 		alc_process_coef_fw(codec, coef0255);
@@ -5300,6 +5323,7 @@
 		alc_write_coef_idx(codec, 0x45, 0xc089);
 		msleep(50);
 		alc_process_coef_fw(codec, coef0256);
+		alc_hp_enable_unmute(codec, 75);
 		break;
 	case 0x10ec0234:
 	case 0x10ec0274:
@@ -5397,6 +5421,7 @@
 	case 0x10ec0256:
 	case 0x19e58326:
 		alc_process_coef_fw(codec, coef0256);
+		alc_hp_enable_unmute(codec, 75);
 		break;
 	case 0x10ec0234:
 	case 0x10ec0274:
@@ -5445,6 +5470,7 @@
 			alc_process_coef_fw(codec, coef0225_2);
 		else
 			alc_process_coef_fw(codec, coef0225_1);
+		alc_hp_enable_unmute(codec, 75);
 		break;
 	case 0x10ec0867:
 		alc_update_coefex_idx(codec, 0x57, 0x5, 1<<14, 0);
@@ -5512,6 +5538,7 @@
 	case 0x10ec0256:
 	case 0x19e58326:
 		alc_process_coef_fw(codec, coef0256);
+		alc_hp_enable_unmute(codec, 75);
 		break;
 	case 0x10ec0234:
 	case 0x10ec0274:
@@ -5549,6 +5576,7 @@
 	case 0x10ec0289:
 	case 0x10ec0299:
 		alc_process_coef_fw(codec, coef0225);
+		alc_hp_enable_unmute(codec, 75);
 		break;
 	}
 	codec_dbg(codec, "Headset jack set to Nokia-style headset mode.\n");
@@ -5617,25 +5645,21 @@
 		alc_write_coef_idx(codec, 0x06, 0x6104);
 		alc_write_coefex_idx(codec, 0x57, 0x3, 0x09a3);
 
-		snd_hda_codec_write(codec, 0x21, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-		msleep(80);
-		snd_hda_codec_write(codec, 0x21, 0,
-			    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
-
 		alc_process_coef_fw(codec, coef0255);
 		msleep(300);
 		val = alc_read_coef_idx(codec, 0x46);
 		is_ctia = (val & 0x0070) == 0x0070;
-
+		if (!is_ctia) {
+			alc_write_coef_idx(codec, 0x45, 0xe089);
+			msleep(100);
+			val = alc_read_coef_idx(codec, 0x46);
+			if ((val & 0x0070) == 0x0070)
+				is_ctia = false;
+			else
+				is_ctia = true;
+		}
 		alc_write_coefex_idx(codec, 0x57, 0x3, 0x0da3);
 		alc_update_coefex_idx(codec, 0x57, 0x5, 1<<14, 0);
-
-		snd_hda_codec_write(codec, 0x21, 0,
-			    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
-		msleep(80);
-		snd_hda_codec_write(codec, 0x21, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
 		break;
 	case 0x10ec0234:
 	case 0x10ec0274:
@@ -5712,12 +5736,6 @@
 	case 0x10ec0295:
 	case 0x10ec0289:
 	case 0x10ec0299:
-		snd_hda_codec_write(codec, 0x21, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-		msleep(80);
-		snd_hda_codec_write(codec, 0x21, 0,
-			    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
-
 		alc_process_coef_fw(codec, alc225_pre_hsmode);
 		alc_update_coef_idx(codec, 0x67, 0xf000, 0x1000);
 		val = alc_read_coef_idx(codec, 0x45);
@@ -5734,15 +5752,19 @@
 			val = alc_read_coef_idx(codec, 0x46);
 			is_ctia = (val & 0x00f0) == 0x00f0;
 		}
+		if (!is_ctia) {
+			alc_update_coef_idx(codec, 0x45, 0x3f<<10, 0x38<<10);
+			alc_update_coef_idx(codec, 0x49, 3<<8, 1<<8);
+			msleep(100);
+			val = alc_read_coef_idx(codec, 0x46);
+			if ((val & 0x00f0) == 0x00f0)
+				is_ctia = false;
+			else
+				is_ctia = true;
+		}
 		alc_update_coef_idx(codec, 0x4a, 7<<6, 7<<6);
 		alc_update_coef_idx(codec, 0x4a, 3<<4, 3<<4);
 		alc_update_coef_idx(codec, 0x67, 0xf000, 0x3000);
-
-		snd_hda_codec_write(codec, 0x21, 0,
-			    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
-		msleep(80);
-		snd_hda_codec_write(codec, 0x21, 0,
-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
 		break;
 	case 0x10ec0867:
 		is_ctia = true;
@@ -6696,6 +6718,60 @@
 	}
 }
 
+static void alc285_fixup_hp_envy_x360(struct hda_codec *codec,
+				      const struct hda_fixup *fix,
+				      int action)
+{
+	static const struct coef_fw coefs[] = {
+		WRITE_COEF(0x08, 0x6a0c), WRITE_COEF(0x0d, 0xa023),
+		WRITE_COEF(0x10, 0x0320), WRITE_COEF(0x1a, 0x8c03),
+		WRITE_COEF(0x25, 0x1800), WRITE_COEF(0x26, 0x003a),
+		WRITE_COEF(0x28, 0x1dfe), WRITE_COEF(0x29, 0xb014),
+		WRITE_COEF(0x2b, 0x1dfe), WRITE_COEF(0x37, 0xfe15),
+		WRITE_COEF(0x38, 0x7909), WRITE_COEF(0x45, 0xd489),
+		WRITE_COEF(0x46, 0x00f4), WRITE_COEF(0x4a, 0x21e0),
+		WRITE_COEF(0x66, 0x03f0), WRITE_COEF(0x67, 0x1000),
+		WRITE_COEF(0x6e, 0x1005), { }
+	};
+
+	static const struct hda_pintbl pincfgs[] = {
+		{ 0x12, 0xb7a60130 },  /* Internal microphone*/
+		{ 0x14, 0x90170150 },  /* B&O soundbar speakers */
+		{ 0x17, 0x90170153 },  /* Side speakers */
+		{ 0x19, 0x03a11040 },  /* Headset microphone */
+		{ }
+	};
+
+	switch (action) {
+	case HDA_FIXUP_ACT_PRE_PROBE:
+		snd_hda_apply_pincfgs(codec, pincfgs);
+
+		/* Fixes volume control problem for side speakers */
+		alc295_fixup_disable_dac3(codec, fix, action);
+
+		/* Fixes no sound from headset speaker */
+		snd_hda_codec_amp_stereo(codec, 0x21, HDA_OUTPUT, 0, -1, 0);
+
+		/* Auto-enable headset mic when plugged */
+		snd_hda_jack_set_gating_jack(codec, 0x19, 0x21);
+
+		/* Headset mic volume enhancement */
+		snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREF50);
+		break;
+	case HDA_FIXUP_ACT_INIT:
+		alc_process_coef_fw(codec, coefs);
+		break;
+	case HDA_FIXUP_ACT_BUILD:
+		rename_ctl(codec, "Bass Speaker Playback Volume",
+			   "B&O-Tuned Playback Volume");
+		rename_ctl(codec, "Front Playback Switch",
+			   "B&O Soundbar Playback Switch");
+		rename_ctl(codec, "Bass Speaker Playback Switch",
+			   "Side Speaker Playback Switch");
+		break;
+	}
+}
+
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
 
@@ -6706,6 +6782,15 @@
 	hda_fixup_thinkpad_acpi(codec, fix, action);
 }
 
+/* for hda_fixup_ideapad_acpi() */
+#include "ideapad_hotkey_led_helper.c"
+
+static void alc_fixup_ideapad_acpi(struct hda_codec *codec,
+				   const struct hda_fixup *fix, int action)
+{
+	hda_fixup_ideapad_acpi(codec, fix, action);
+}
+
 /* Fixup for Lenovo Legion 15IMHg05 speaker output on headset removal. */
 static void alc287_fixup_legion_15imhg05_speakers(struct hda_codec *codec,
 						  const struct hda_fixup *fix,
@@ -6844,11 +6929,12 @@
 struct scodec_dev_name {
 	const char *bus;
 	const char *hid;
+	const char *match_str;
 	int index;
 };
 
 /* match the device name in a slightly relaxed manner */
-static int comp_match_cs35l41_dev_name(struct device *dev, void *data)
+static int comp_match_dev_name(struct device *dev, void *data)
 {
 	struct scodec_dev_name *p = data;
 	const char *d = dev_name(dev);
@@ -6862,32 +6948,12 @@
 	if (isdigit(d[n]))
 		n++;
 	/* the rest must be exact matching */
-	snprintf(tmp, sizeof(tmp), "-%s:00-cs35l41-hda.%d", p->hid, p->index);
+	snprintf(tmp, sizeof(tmp), p->match_str, p->hid, p->index);
 	return !strcmp(d + n, tmp);
 }
 
-static int comp_match_tas2781_dev_name(struct device *dev,
-	void *data)
-{
-	struct scodec_dev_name *p = data;
-	const char *d = dev_name(dev);
-	int n = strlen(p->bus);
-	char tmp[32];
-
-	/* check the bus name */
-	if (strncmp(d, p->bus, n))
-		return 0;
-	/* skip the bus number */
-	if (isdigit(d[n]))
-		n++;
-	/* the rest must be exact matching */
-	snprintf(tmp, sizeof(tmp), "-%s:00", p->hid);
-
-	return !strcmp(d + n, tmp);
-}
-
-static void cs35l41_generic_fixup(struct hda_codec *cdc, int action, const char *bus,
-				  const char *hid, int count)
+static void comp_generic_fixup(struct hda_codec *cdc, int action, const char *bus,
+			       const char *hid, const char *match_str, int count)
 {
 	struct device *dev = hda_codec_dev(cdc);
 	struct alc_spec *spec = cdc->spec;
@@ -6902,10 +6968,11 @@
 				return;
 			rec->bus = bus;
 			rec->hid = hid;
+			rec->match_str = match_str;
 			rec->index = i;
 			spec->comps[i].codec = cdc;
 			component_match_add(dev, &spec->match,
-					    comp_match_cs35l41_dev_name, rec);
+					    comp_match_dev_name, rec);
 		}
 		ret = component_master_add_with_match(dev, &comp_master_ops, spec->match);
 		if (ret)
@@ -6919,83 +6986,53 @@
 	}
 }
 
-static void tas2781_generic_fixup(struct hda_codec *cdc, int action,
-	const char *bus, const char *hid)
-{
-	struct device *dev = hda_codec_dev(cdc);
-	struct alc_spec *spec = cdc->spec;
-	struct scodec_dev_name *rec;
-	int ret;
-
-	switch (action) {
-	case HDA_FIXUP_ACT_PRE_PROBE:
-		rec = devm_kmalloc(dev, sizeof(*rec), GFP_KERNEL);
-		if (!rec)
-			return;
-		rec->bus = bus;
-		rec->hid = hid;
-		rec->index = 0;
-		spec->comps[0].codec = cdc;
-		component_match_add(dev, &spec->match,
-			comp_match_tas2781_dev_name, rec);
-		ret = component_master_add_with_match(dev, &comp_master_ops,
-			spec->match);
-		if (ret)
-			codec_err(cdc,
-				"Fail to register component aggregator %d\n",
-				ret);
-		else
-			spec->gen.pcm_playback_hook =
-				comp_generic_playback_hook;
-		break;
-	case HDA_FIXUP_ACT_FREE:
-		component_master_del(dev, &comp_master_ops);
-		break;
-	}
-}
-
 static void cs35l41_fixup_i2c_two(struct hda_codec *cdc, const struct hda_fixup *fix, int action)
 {
-	cs35l41_generic_fixup(cdc, action, "i2c", "CSC3551", 2);
+	comp_generic_fixup(cdc, action, "i2c", "CSC3551", "-%s:00-cs35l41-hda.%d", 2);
 }
 
 static void cs35l41_fixup_i2c_four(struct hda_codec *cdc, const struct hda_fixup *fix, int action)
 {
-	cs35l41_generic_fixup(cdc, action, "i2c", "CSC3551", 4);
+	comp_generic_fixup(cdc, action, "i2c", "CSC3551", "-%s:00-cs35l41-hda.%d", 4);
 }
 
 static void cs35l41_fixup_spi_two(struct hda_codec *codec, const struct hda_fixup *fix, int action)
 {
-	cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 2);
+	comp_generic_fixup(codec, action, "spi", "CSC3551", "-%s:00-cs35l41-hda.%d", 2);
 }
 
 static void cs35l41_fixup_spi_four(struct hda_codec *codec, const struct hda_fixup *fix, int action)
 {
-	cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 4);
+	comp_generic_fixup(codec, action, "spi", "CSC3551", "-%s:00-cs35l41-hda.%d", 4);
 }
 
 static void alc287_fixup_legion_16achg6_speakers(struct hda_codec *cdc, const struct hda_fixup *fix,
 						 int action)
 {
-	cs35l41_generic_fixup(cdc, action, "i2c", "CLSA0100", 2);
+	comp_generic_fixup(cdc, action, "i2c", "CLSA0100", "-%s:00-cs35l41-hda.%d", 2);
 }
 
 static void alc287_fixup_legion_16ithg6_speakers(struct hda_codec *cdc, const struct hda_fixup *fix,
 						 int action)
 {
-	cs35l41_generic_fixup(cdc, action, "i2c", "CLSA0101", 2);
+	comp_generic_fixup(cdc, action, "i2c", "CLSA0101", "-%s:00-cs35l41-hda.%d", 2);
+}
+
+static void cs35l56_fixup_spi_four(struct hda_codec *cdc, const struct hda_fixup *fix, int action)
+{
+	comp_generic_fixup(cdc, action, "spi", "CSC3556", "-%s:00-cs35l56-hda.%d", 4);
 }
 
 static void tas2781_fixup_i2c(struct hda_codec *cdc,
 	const struct hda_fixup *fix, int action)
 {
-	 tas2781_generic_fixup(cdc, action, "i2c", "TIAS2781");
+	comp_generic_fixup(cdc, action, "i2c", "TIAS2781", "-%s:00", 1);
 }
 
 static void yoga7_14arb7_fixup_i2c(struct hda_codec *cdc,
 	const struct hda_fixup *fix, int action)
 {
-	 tas2781_generic_fixup(cdc, action, "i2c", "INT8866");
+	comp_generic_fixup(cdc, action, "i2c", "INT8866", "-%s:00", 1);
 }
 
 /* for alc295_fixup_hp_top_speakers */
@@ -7064,6 +7101,25 @@
 	}
 }
 
+static void alc256_decrease_headphone_amp_val(struct hda_codec *codec,
+					      const struct hda_fixup *fix, int action)
+{
+	u32 caps;
+	u8 nsteps, offs;
+
+	if (action != HDA_FIXUP_ACT_PRE_PROBE)
+		return;
+
+	caps = query_amp_caps(codec, 0x3, HDA_OUTPUT);
+	nsteps = ((caps & AC_AMPCAP_NUM_STEPS) >> AC_AMPCAP_NUM_STEPS_SHIFT) - 10;
+	offs = ((caps & AC_AMPCAP_OFFSET) >> AC_AMPCAP_OFFSET_SHIFT) - 10;
+	caps &= ~AC_AMPCAP_NUM_STEPS & ~AC_AMPCAP_OFFSET;
+	caps |= (nsteps << AC_AMPCAP_NUM_STEPS_SHIFT) | (offs << AC_AMPCAP_OFFSET_SHIFT);
+
+	if (snd_hda_override_amp_caps(codec, 0x3, HDA_OUTPUT, caps))
+		codec_warn(codec, "failed to override amp caps for NID 0x3\n");
+}
+
 static void alc_fixup_dell4_mic_no_presence_quiet(struct hda_codec *codec,
 						  const struct hda_fixup *fix,
 						  int action)
@@ -7245,6 +7301,7 @@
 	ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
 	ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
 	ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+	ALC269_FIXUP_DELL1_LIMIT_INT_MIC_BOOST,
 	ALC269_FIXUP_DELL2_MIC_NO_PRESENCE,
 	ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
 	ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
@@ -7274,11 +7331,15 @@
 	ALC290_FIXUP_SUBWOOFER,
 	ALC290_FIXUP_SUBWOOFER_HSJACK,
 	ALC269_FIXUP_THINKPAD_ACPI,
+	ALC269_FIXUP_LENOVO_XPAD_ACPI,
 	ALC269_FIXUP_DMIC_THINKPAD_ACPI,
+	ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13,
+	ALC269VC_FIXUP_INFINIX_Y4_MAX,
 	ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO,
 	ALC255_FIXUP_ACER_MIC_NO_PRESENCE,
 	ALC255_FIXUP_ASUS_MIC_NO_PRESENCE,
 	ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+	ALC255_FIXUP_DELL1_LIMIT_INT_MIC_BOOST,
 	ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
 	ALC255_FIXUP_HEADSET_MODE,
 	ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC,
@@ -7297,6 +7358,7 @@
 	ALC280_FIXUP_HP_9480M,
 	ALC245_FIXUP_HP_X360_AMP,
 	ALC285_FIXUP_HP_SPECTRE_X360_EB1,
+	ALC285_FIXUP_HP_ENVY_X360,
 	ALC288_FIXUP_DELL_HEADSET_MODE,
 	ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
 	ALC288_FIXUP_DELL_XPS_13,
@@ -7311,6 +7373,7 @@
 	ALC275_FIXUP_DELL_XPS,
 	ALC293_FIXUP_LENOVO_SPK_NOISE,
 	ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+	ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED,
 	ALC255_FIXUP_DELL_SPK_NOISE,
 	ALC225_FIXUP_DISABLE_MIC_VREF,
 	ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -7368,6 +7431,7 @@
 	ALC286_FIXUP_ACER_AIO_HEADSET_MIC,
 	ALC256_FIXUP_ASUS_HEADSET_MIC,
 	ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+	ALC255_FIXUP_PREDATOR_SUBWOOFER,
 	ALC299_FIXUP_PREDATOR_SPK,
 	ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE,
 	ALC289_FIXUP_DELL_SPK1,
@@ -7399,6 +7463,7 @@
 	ALC236_FIXUP_HP_GPIO_LED,
 	ALC236_FIXUP_HP_MUTE_LED,
 	ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF,
+	ALC236_FIXUP_LENOVO_INV_DMIC,
 	ALC298_FIXUP_SAMSUNG_AMP,
 	ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
 	ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
@@ -7423,6 +7488,7 @@
 	ALC274_FIXUP_HP_MIC,
 	ALC274_FIXUP_HP_HEADSET_MIC,
 	ALC274_FIXUP_HP_ENVY_GPIO,
+	ALC274_FIXUP_ASUS_ZEN_AIO_27,
 	ALC256_FIXUP_ASUS_HPE,
 	ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK,
 	ALC287_FIXUP_HP_GPIO_LED,
@@ -7446,6 +7512,7 @@
 	ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
 	ALC298_FIXUP_LENOVO_C940_DUET7,
 	ALC287_FIXUP_LENOVO_14IRP8_DUETITL,
+	ALC287_FIXUP_LENOVO_LEGION_7,
 	ALC287_FIXUP_13S_GEN2_SPEAKERS,
 	ALC256_FIXUP_SET_COEF_DEFAULTS,
 	ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
@@ -7466,6 +7533,7 @@
 	ALC287_FIXUP_LEGION_16ITHG6,
 	ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK,
 	ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN,
+	ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN,
 	ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS,
 	ALC236_FIXUP_DELL_DUAL_CODECS,
 	ALC287_FIXUP_CS35L41_I2C_2_THINKPAD_ACPI,
@@ -7478,6 +7546,11 @@
 	ALC2XX_FIXUP_HEADSET_MIC,
 	ALC289_FIXUP_DELL_CS35L41_SPI_2,
 	ALC294_FIXUP_CS35L41_I2C_2,
+	ALC256_FIXUP_HEADPHONE_AMP_VOL,
+	ALC245_FIXUP_CS35L56_SPI_4_HP_GPIO_LED,
+	ALC245_FIXUP_CLEVO_NOISY_MIC,
+	ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE,
+	ALC233_FIXUP_MEDION_MTL_SPK,
 };
 
 /* A special fixup for Lenovo C940 and Yoga Duet 7;
@@ -7517,6 +7590,23 @@
 	__snd_hda_apply_fixup(codec, id, action, 0);
 }
 
+/* Another hilarious PCI SSID conflict with Lenovo Legion Pro 7 16ARX8H (with
+ * TAS2781 codec) and Legion 7i 16IAX7 (with CS35L41 codec);
+ * we apply a corresponding fixup depending on the codec SSID instead
+ */
+static void alc287_fixup_lenovo_legion_7(struct hda_codec *codec,
+					 const struct hda_fixup *fix,
+					 int action)
+{
+	int id;
+
+	if (codec->core.subsystem_id == 0x17aa38a8)
+		id = ALC287_FIXUP_TAS2781_I2C; /* Legion Pro 7 16ARX8H */
+	else
+		id = ALC287_FIXUP_CS35L41_I2C_2; /* Legion 7i 16IAX7 */
+	__snd_hda_apply_fixup(codec, id, action, 0);
+}
+
 static const struct hda_fixup alc269_fixups[] = {
 	[ALC269_FIXUP_GPIO2] = {
 		.type = HDA_FIXUP_FUNC,
@@ -7651,6 +7741,25 @@
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc269_fixup_pincfg_U7x7_headset_mic,
 	},
+	[ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x14, 0x90170151 }, /* use as internal speaker (LFE) */
+			{ 0x1b, 0x90170152 }, /* use as internal speaker (back) */
+			{ }
+		},
+		.chained = true,
+		.chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
+	},
+	[ALC269VC_FIXUP_INFINIX_Y4_MAX] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x1b, 0x90170150 }, /* use as internal speaker */
+			{ }
+		},
+		.chained = true,
+		.chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
+	},
 	[ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = {
 		.type = HDA_FIXUP_PINS,
 		.v.pins = (const struct hda_pintbl[]) {
@@ -7769,6 +7878,12 @@
 		.chained = true,
 		.chain_id = ALC269_FIXUP_HEADSET_MODE
 	},
+	[ALC269_FIXUP_DELL1_LIMIT_INT_MIC_BOOST] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc269_fixup_limit_int_mic_boost,
+		.chained = true,
+		.chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
+	},
 	[ALC269_FIXUP_DELL2_MIC_NO_PRESENCE] = {
 		.type = HDA_FIXUP_PINS,
 		.v.pins = (const struct hda_pintbl[]) {
@@ -8015,6 +8130,12 @@
 		.chained = true,
 		.chain_id = ALC269_FIXUP_SKU_IGNORE,
 	},
+	[ALC269_FIXUP_LENOVO_XPAD_ACPI] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc_fixup_ideapad_acpi,
+		.chained = true,
+		.chain_id = ALC269_FIXUP_THINKPAD_ACPI,
+	},
 	[ALC269_FIXUP_DMIC_THINKPAD_ACPI] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc_fixup_inv_dmic,
@@ -8049,6 +8170,12 @@
 		.chained = true,
 		.chain_id = ALC255_FIXUP_HEADSET_MODE
 	},
+	[ALC255_FIXUP_DELL1_LIMIT_INT_MIC_BOOST] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc269_fixup_limit_int_mic_boost,
+		.chained = true,
+		.chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+	},
 	[ALC255_FIXUP_DELL2_MIC_NO_PRESENCE] = {
 		.type = HDA_FIXUP_PINS,
 		.v.pins = (const struct hda_pintbl[]) {
@@ -8266,6 +8393,10 @@
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc233_fixup_lenovo_line2_mic_hotkey,
 	},
+	[ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc233_fixup_lenovo_low_en_micmute_led,
+	},
 	[ALC233_FIXUP_INTEL_NUC8_DMIC] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc_fixup_inv_dmic,
@@ -8715,6 +8846,13 @@
 		.chained = true,
 		.chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
 	},
+	[ALC255_FIXUP_PREDATOR_SUBWOOFER] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x17, 0x90170151 }, /* use as internal speaker (LFE) */
+			{ 0x1b, 0x90170152 } /* use as internal speaker (back) */
+		}
+	},
 	[ALC299_FIXUP_PREDATOR_SPK] = {
 		.type = HDA_FIXUP_PINS,
 		.v.pins = (const struct hda_pintbl[]) {
@@ -8956,6 +9094,12 @@
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc236_fixup_hp_mute_led_micmute_vref,
 	},
+	[ALC236_FIXUP_LENOVO_INV_DMIC] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc_fixup_inv_dmic,
+		.chained = true,
+		.chain_id = ALC283_FIXUP_INT_MIC,
+	},
 	[ALC298_FIXUP_SAMSUNG_AMP] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc298_fixup_samsung_amp,
@@ -9172,6 +9316,26 @@
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc274_fixup_hp_envy_gpio,
 	},
+	[ALC274_FIXUP_ASUS_ZEN_AIO_27] = {
+		.type = HDA_FIXUP_VERBS,
+		.v.verbs = (const struct hda_verb[]) {
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x10 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0xc420 },
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x40 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x8800 },
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x49 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x0249 },
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x4a },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x202b },
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x62 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0xa007 },
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x6b },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x5060 },
+			{}
+		},
+		.chained = true,
+		.chain_id = ALC2XX_FIXUP_HEADSET_MIC,
+	},
 	[ALC256_FIXUP_ASUS_HPE] = {
 		.type = HDA_FIXUP_VERBS,
 		.v.verbs = (const struct hda_verb[]) {
@@ -9273,6 +9437,12 @@
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc285_fixup_hp_spectre_x360_eb1
 	},
+	[ALC285_FIXUP_HP_ENVY_X360] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc285_fixup_hp_envy_x360,
+		.chained = true,
+		.chain_id = ALC285_FIXUP_HP_GPIO_AMP_INIT,
+	},
 	[ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc285_fixup_ideapad_s740_coef,
@@ -9405,6 +9575,10 @@
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc287_fixup_lenovo_14irp8_duetitl,
 	},
+	[ALC287_FIXUP_LENOVO_LEGION_7] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc287_fixup_lenovo_legion_7,
+	},
 	[ALC287_FIXUP_13S_GEN2_SPEAKERS] = {
 		.type = HDA_FIXUP_VERBS,
 		.v.verbs = (const struct hda_verb[]) {
@@ -9589,6 +9763,12 @@
 		.chained = true,
 		.chain_id = ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK,
 	},
+	[ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc287_fixup_yoga9_14iap7_bass_spk_pin,
+		.chained = true,
+		.chain_id = ALC287_FIXUP_CS35L41_I2C_2,
+	},
 	[ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc295_fixup_dell_inspiron_top_speakers,
@@ -9655,9 +9835,42 @@
 		.type = HDA_FIXUP_FUNC,
 		.v.func = cs35l41_fixup_i2c_two,
 	},
+	[ALC256_FIXUP_HEADPHONE_AMP_VOL] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc256_decrease_headphone_amp_val,
+	},
+	[ALC245_FIXUP_CS35L56_SPI_4_HP_GPIO_LED] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = cs35l56_fixup_spi_four,
+		.chained = true,
+		.chain_id = ALC285_FIXUP_HP_GPIO_LED,
+	},
+	[ALC245_FIXUP_CLEVO_NOISY_MIC] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc269_fixup_limit_int_mic_boost,
+		.chained = true,
+		.chain_id = ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+	},
+	[ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x19, 0x03a1113c }, /* use as headset mic, without its own jack detect */
+			{ 0x1b, 0x20a11040 }, /* dock mic */
+			{ }
+		},
+		.chained = true,
+		.chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
+	},
+	[ALC233_FIXUP_MEDION_MTL_SPK] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x1b, 0x90170110 },
+			{ }
+		},
+	},
 };
 
-static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x0283, "Acer TravelMate 8371", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
@@ -9670,6 +9883,7 @@
 	SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
 	SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x0840, "Acer Aspire E1", ALC269VB_FIXUP_ASPIRE_E1_COEF),
+	SND_PCI_QUIRK(0x1025, 0x100c, "Acer Aspire E5-574G", ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1025, 0x101c, "Acer Veriton N2510G", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1065, "Acer Aspire C20-820", ALC269VC_FIXUP_ACER_HEADSET_MIC),
@@ -9679,6 +9893,8 @@
 	SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1166, "Acer Veriton N4640G", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x1025, 0x1167, "Acer Veriton N6640G", ALC269_FIXUP_LIFEBOOK),
+	SND_PCI_QUIRK(0x1025, 0x1177, "Acer Predator G9-593", ALC255_FIXUP_PREDATOR_SUBWOOFER),
+	SND_PCI_QUIRK(0x1025, 0x1178, "Acer Predator G9-593", ALC255_FIXUP_PREDATOR_SUBWOOFER),
 	SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK),
 	SND_PCI_QUIRK(0x1025, 0x1247, "Acer vCopperbox", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS),
 	SND_PCI_QUIRK(0x1025, 0x1248, "Acer Veriton N4660G", ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE),
@@ -9698,6 +9914,7 @@
 	SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC),
 	SND_PCI_QUIRK(0x1025, 0x1534, "Acer Predator PH315-54", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1025, 0x159c, "Acer Nitro 5 AN515-58", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
 	SND_PCI_QUIRK(0x1028, 0x053c, "Dell Latitude E5430", ALC292_FIXUP_DELL_E7X),
 	SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
@@ -9774,6 +9991,8 @@
 	SND_PCI_QUIRK(0x1028, 0x0c1e, "Dell Precision 3540", ALC236_FIXUP_DELL_DUAL_CODECS),
 	SND_PCI_QUIRK(0x1028, 0x0c28, "Dell Inspiron 16 Plus 7630", ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS),
 	SND_PCI_QUIRK(0x1028, 0x0c4d, "Dell", ALC287_FIXUP_CS35L41_I2C_4),
+	SND_PCI_QUIRK(0x1028, 0x0c94, "Dell Polaris 3 metal", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x1028, 0x0c96, "Dell Polaris 2in1", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1028, 0x0cbd, "Dell Oasis 13 CS MTL-U", ALC289_FIXUP_DELL_CS35L41_SPI_2),
 	SND_PCI_QUIRK(0x1028, 0x0cbe, "Dell Oasis 13 2-IN-1 MTL-U", ALC289_FIXUP_DELL_CS35L41_SPI_2),
 	SND_PCI_QUIRK(0x1028, 0x0cbf, "Dell Oasis 13 Low Weight MTU-L", ALC289_FIXUP_DELL_CS35L41_SPI_2),
@@ -9856,14 +10075,17 @@
 	SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x103c, 0x841c, "HP Pavilion 15-CK0xx", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+	SND_PCI_QUIRK(0x103c, 0x84a6, "HP 250 G7 Notebook PC", ALC269_FIXUP_HP_LINE1_MIC1_LED),
 	SND_PCI_QUIRK(0x103c, 0x84ae, "HP 15-db0403ng", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN),
 	SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360),
 	SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+	SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360),
 	SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+	SND_PCI_QUIRK(0x103c, 0x86c1, "HP Laptop 15-da3001TU", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO),
 	SND_PCI_QUIRK(0x103c, 0x86e7, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
 	SND_PCI_QUIRK(0x103c, 0x86e8, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
@@ -9889,6 +10111,8 @@
 	SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x87b7, "HP Laptop 14-fq0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x87d3, "HP Laptop 15-gw0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+	SND_PCI_QUIRK(0x103c, 0x87df, "HP ProBook 430 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87e7, "HP ProBook 450 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87f1, "HP ProBook 630 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
@@ -9897,6 +10121,7 @@
 	SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87f6, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
 	SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
+	SND_PCI_QUIRK(0x103c, 0x87fd, "HP Laptop 14-dq2xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x87fe, "HP Laptop 15s-fq2xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x8805, "HP ProBook 650 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
@@ -9919,6 +10144,7 @@
 	SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),
@@ -9971,6 +10197,7 @@
 	SND_PCI_QUIRK(0x103c, 0x8b59, "HP Elite mt645 G7 Mobile Thin Client U89", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8b5d, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8b5e, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+	SND_PCI_QUIRK(0x103c, 0x8b5f, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8b63, "HP Elite Dragonfly 13.5 inch G4", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8b65, "HP ProBook 455 15.6 inch G10 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8b66, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
@@ -9988,16 +10215,33 @@
 	SND_PCI_QUIRK(0x103c, 0x8b92, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8b96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8b97, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+	SND_PCI_QUIRK(0x103c, 0x8bb3, "HP Slim OMEN", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x103c, 0x8bb4, "HP Slim OMEN", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x103c, 0x8bf0, "HP", ALC236_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8c30, "HP Victus 15-fb1xxx", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x103c, 0x8c46, "HP EliteBook 830 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c47, "HP EliteBook 840 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c48, "HP EliteBook 860 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c49, "HP Elite x360 830 2-in-1 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8c4d, "HP Omen", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x103c, 0x8c4e, "HP Omen", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x103c, 0x8c52, "HP EliteBook 1040 G11", ALC245_FIXUP_CS35L56_SPI_4_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8c53, "HP Elite x360 1040 2-in-1 G11", ALC245_FIXUP_CS35L56_SPI_4_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c70, "HP EliteBook 835 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c71, "HP EliteBook 845 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c72, "HP EliteBook 865 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8c7b, "HP ProBook 445 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+	SND_PCI_QUIRK(0x103c, 0x8c7c, "HP ProBook 445 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+	SND_PCI_QUIRK(0x103c, 0x8c7d, "HP ProBook 465 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+	SND_PCI_QUIRK(0x103c, 0x8c7e, "HP ProBook 465 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+       SND_PCI_QUIRK(0x103c, 0x8c7f, "HP EliteBook 645 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+       SND_PCI_QUIRK(0x103c, 0x8c80, "HP EliteBook 645 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+       SND_PCI_QUIRK(0x103c, 0x8c81, "HP EliteBook 665 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+	SND_PCI_QUIRK(0x103c, 0x8c89, "HP ProBook 460 G11", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c8a, "HP EliteBook 630", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c8c, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8c8d, "HP ProBook 440 G11", ALC236_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8c8e, "HP ProBook 460 G11", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c90, "HP EliteBook 640", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c91, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
@@ -10006,16 +10250,28 @@
 	SND_PCI_QUIRK(0x103c, 0x8ca2, "HP ZBook Power", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8ca4, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8ca7, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8caf, "HP Elite mt645 G8 Mobile Thin Client", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8cf5, "HP ZBook Studio 16", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8d01, "HP ZBook Power 14 G12", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8d84, "HP EliteBook X G1i", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8d91, "HP ZBook Firefly 14 G12", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8d92, "HP ZBook Firefly 16 G12", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8e18, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8e19, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8e1a, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
 	SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
+	SND_PCI_QUIRK(0x1043, 0x10a4, "ASUS TP3407SA", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x10d3, "ASUS K6500ZC", ALC294_FIXUP_ASUS_SPK),
+	SND_PCI_QUIRK(0x1043, 0x1154, "ASUS TP3607SH", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1043, 0x1204, "ASUS Strix G615JHR_JMR_JPR", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x1043, 0x1214, "ASUS Strix G615LH_LM_LP", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
@@ -10087,9 +10343,11 @@
 	SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2),
 	SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
 	SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x1043, 0x1e1f, "ASUS Vivobook 15 X1504VAP", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
 	SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS),
 	SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401),
+	SND_PCI_QUIRK(0x1043, 0x1eb3, "ASUS Ally RCLA72", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x1ee2, "ASUS UM6702RA/RC", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401),
 	SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
@@ -10098,11 +10356,19 @@
 	SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2),
 	SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401),
 	SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
-	SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC245_FIXUP_CS35L41_SPI_2),
-	SND_PCI_QUIRK(0x1043, 0x3a30, "ASUS G814JVR/JIR", ALC245_FIXUP_CS35L41_SPI_2),
-	SND_PCI_QUIRK(0x1043, 0x3a40, "ASUS G814JZR", ALC245_FIXUP_CS35L41_SPI_2),
-	SND_PCI_QUIRK(0x1043, 0x3a50, "ASUS G834JYR/JZR", ALC245_FIXUP_CS35L41_SPI_2),
-	SND_PCI_QUIRK(0x1043, 0x3a60, "ASUS G634JYR/JZR", ALC245_FIXUP_CS35L41_SPI_2),
+	SND_PCI_QUIRK(0x1043, 0x31d0, "ASUS Zen AIO 27 Z272SD_A272SD", ALC274_FIXUP_ASUS_ZEN_AIO_27),
+	SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+	SND_PCI_QUIRK(0x1043, 0x3a30, "ASUS G814JVR/JIR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+	SND_PCI_QUIRK(0x1043, 0x3a40, "ASUS G814JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+	SND_PCI_QUIRK(0x1043, 0x3a50, "ASUS G834JYR/JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+	SND_PCI_QUIRK(0x1043, 0x3a60, "ASUS G634JYR/JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+	SND_PCI_QUIRK(0x1043, 0x3e30, "ASUS TP3607SA", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x1043, 0x3ee0, "ASUS Strix G815_JHR_JMR_JPR", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x1043, 0x3ef0, "ASUS Strix G635LR_LW_LX", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x1043, 0x3f00, "ASUS Strix G815LH_LM_LP", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x1043, 0x3f10, "ASUS Strix G835LR_LW_LX", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x1043, 0x3f20, "ASUS Strix G615LR_LW", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x1043, 0x3f30, "ASUS Strix G815LR_LW", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
@@ -10122,35 +10388,43 @@
 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
 	SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
 	SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE),
+	SND_PCI_QUIRK(0x10ec, 0x119e, "Positivo SU C1400", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
+	SND_PCI_QUIRK(0x10ec, 0x11bc, "VAIO VJFE-IL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x10ec, 0x124c, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x10ec, 0x1252, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x10ec, 0x1254, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x10ec, 0x12cc, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
-	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
+	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
 	SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc1a3, "Samsung Galaxy Book Pro (NP935XDB-KC1SE)", ALC298_FIXUP_SAMSUNG_AMP),
+	SND_PCI_QUIRK(0x144d, 0xc1a4, "Samsung Galaxy Book Pro 360 (NT935QBD)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc1a6, "Samsung Galaxy Book Pro 360 (NP930QBD)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
 	SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
 	SND_PCI_QUIRK(0x144d, 0xca03, "Samsung Galaxy Book2 Pro 360 (NP930QED)", ALC298_FIXUP_SAMSUNG_AMP),
+	SND_PCI_QUIRK(0x144d, 0xca06, "Samsung Galaxy Book3 360 (NP730QFG)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
 	SND_PCI_QUIRK(0x144d, 0xc868, "Samsung Galaxy Book2 Pro (NP930XED)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x152d, 0x1082, "Quanta NL3", ALC269_FIXUP_LIFEBOOK),
+	SND_PCI_QUIRK(0x152d, 0x1262, "Huawei NBLB-WAX9N", ALC2XX_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1558, 0x0353, "Clevo V35[05]SN[CDE]Q", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1323, "Clevo N130ZU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1325, "Clevo N15[01][CW]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1401, "Clevo L140[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1403, "Clevo N140CU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1404, "Clevo N150CU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x14a1, "Clevo L141MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x2624, "Clevo L240TU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x28c1, "Clevo V370VND", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1558, 0x4018, "Clevo NV40M[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x4019, "Clevo NV40MZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x4020, "Clevo NV40MB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
@@ -10212,9 +10486,12 @@
 	SND_PCI_QUIRK(0x1558, 0x961d, "Clevo N960S[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL5[03]RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0xa554, "VAIO VJFH52", ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL50NU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0xa650, "Clevo NP[567]0SN[CD]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0xa671, "Clevo NP70SN[CDE]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0xa741, "Clevo V54x_6x_TNE", ALC245_FIXUP_CLEVO_NOISY_MIC),
+	SND_PCI_QUIRK(0x1558, 0xa763, "Clevo V54x_6x_TU", ALC245_FIXUP_CLEVO_NOISY_MIC),
 	SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
@@ -10248,6 +10525,7 @@
 	SND_PCI_QUIRK(0x17aa, 0x222e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2231, "Thinkpad T560", ALC292_FIXUP_TPT460),
 	SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
+	SND_PCI_QUIRK(0x17aa, 0x2234, "Thinkpad ICE-1", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
@@ -10268,6 +10546,7 @@
 	SND_PCI_QUIRK(0x17aa, 0x2318, "Thinkpad Z13 Gen2", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
 	SND_PCI_QUIRK(0x17aa, 0x2319, "Thinkpad Z16 Gen2", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
 	SND_PCI_QUIRK(0x17aa, 0x231a, "Thinkpad Z16 Gen2", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
+	SND_PCI_QUIRK(0x17aa, 0x2326, "Hera2", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
 	SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
 	SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
@@ -10280,12 +10559,15 @@
 	SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x31af, "ThinkCentre Station", ALC623_FIXUP_LENOVO_THINKSTATION_P340),
 	SND_PCI_QUIRK(0x17aa, 0x334b, "Lenovo ThinkCentre M70 Gen5", ALC283_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x17aa, 0x3384, "ThinkCentre M90a PRO", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED),
+	SND_PCI_QUIRK(0x17aa, 0x3386, "ThinkCentre M90a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED),
+	SND_PCI_QUIRK(0x17aa, 0x3387, "ThinkCentre M70a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED),
 	SND_PCI_QUIRK(0x17aa, 0x3801, "Lenovo Yoga9 14IAP7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
 	SND_PCI_QUIRK(0x17aa, 0x3802, "Lenovo Yoga Pro 9 14IRP8 / DuetITL 2021", ALC287_FIXUP_LENOVO_14IRP8_DUETITL),
 	SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
 	SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940 / Yoga Duet 7", ALC298_FIXUP_LENOVO_C940_DUET7),
 	SND_PCI_QUIRK(0x17aa, 0x3819, "Lenovo 13s Gen2 ITL", ALC287_FIXUP_13S_GEN2_SPEAKERS),
-	SND_PCI_QUIRK(0x17aa, 0x3820, "Yoga Duet 7 13ITL6", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
+	SND_PCI_QUIRK(0x17aa, 0x3820, "IdeaPad 330-17IKB 81DM", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x3824, "Legion Y9000X 2020", ALC285_FIXUP_LEGION_Y9000X_SPEAKERS),
 	SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),
 	SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
@@ -10296,31 +10578,59 @@
 	SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
 	SND_PCI_QUIRK(0x17aa, 0x3853, "Lenovo Yoga 7 15ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
 	SND_PCI_QUIRK(0x17aa, 0x3855, "Legion 7 16ITHG6", ALC287_FIXUP_LEGION_16ITHG6),
+	SND_PCI_QUIRK(0x17aa, 0x3865, "Lenovo 13X", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x17aa, 0x3866, "Lenovo 13X", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x3869, "Lenovo Yoga7 14IAL7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
-	SND_PCI_QUIRK(0x17aa, 0x386f, "Legion 7i 16IAX7", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x17aa, 0x386f, "Legion Pro 7/7i", ALC287_FIXUP_LENOVO_LEGION_7),
 	SND_PCI_QUIRK(0x17aa, 0x3870, "Lenovo Yoga 7 14ARB7", ALC287_FIXUP_YOGA7_14ARB7_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x3877, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x17aa, 0x3878, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x387d, "Yoga S780-16 pro Quad AAC", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x387e, "Yoga S780-16 pro Quad YC", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x387f, "Yoga S780-16 pro dual LX", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x3880, "Yoga S780-16 pro dual YC", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x3881, "YB9 dual power mode2 YC", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x3882, "Lenovo Yoga Pro 7 14APH8", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
 	SND_PCI_QUIRK(0x17aa, 0x3884, "Y780 YG DUAL", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x3886, "Y780 VECO DUAL", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x3891, "Lenovo Yoga Pro 7 14AHP9", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
+	SND_PCI_QUIRK(0x17aa, 0x38a5, "Y580P AMD dual", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38a7, "Y780P AMD YG dual", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38a8, "Y780P AMD VECO dual", ALC287_FIXUP_TAS2781_I2C),
-	SND_PCI_QUIRK(0x17aa, 0x38a9, "Thinkbook 16P", ALC287_FIXUP_CS35L41_I2C_2),
-	SND_PCI_QUIRK(0x17aa, 0x38ab, "Thinkbook 16P", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x17aa, 0x38a9, "Thinkbook 16P", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
+	SND_PCI_QUIRK(0x17aa, 0x38ab, "Thinkbook 16P", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
 	SND_PCI_QUIRK(0x17aa, 0x38b4, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x38b5, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x38b6, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x38b7, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x17aa, 0x38b8, "Yoga S780-14.5 proX AMD YC Dual", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38b9, "Yoga S780-14.5 proX AMD LX Dual", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38ba, "Yoga S780-14.5 Air AMD quad YC", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38bb, "Yoga S780-14.5 Air AMD quad AAC", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38be, "Yoga S980-14.5 proX YC Dual", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38bf, "Yoga S980-14.5 proX LX Dual", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38c3, "Y980 DUAL", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38c7, "Thinkbook 13x Gen 4", ALC287_FIXUP_CS35L41_I2C_4),
+	SND_PCI_QUIRK(0x17aa, 0x38c8, "Thinkbook 13x Gen 4", ALC287_FIXUP_CS35L41_I2C_4),
 	SND_PCI_QUIRK(0x17aa, 0x38cb, "Y790 YG DUAL", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38cd, "Y790 VECO DUAL", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38d2, "Lenovo Yoga 9 14IMH9", ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN),
+	SND_PCI_QUIRK(0x17aa, 0x38d3, "Yoga S990-16 Pro IMH YC Dual", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38d4, "Yoga S990-16 Pro IMH VECO Dual", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38d5, "Yoga S990-16 Pro IMH YC Quad", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38d6, "Yoga S990-16 Pro IMH VECO Quad", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38d7, "Lenovo Yoga 9 14IMH9", ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN),
+	SND_PCI_QUIRK(0x17aa, 0x38df, "Yoga Y990 Intel YC Dual", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38e0, "Yoga Y990 Intel VECO Dual", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38f8, "Yoga Book 9i", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38df, "Y990 YG DUAL", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x38f9, "Thinkbook 16P Gen5", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
+	SND_PCI_QUIRK(0x17aa, 0x38fa, "Thinkbook 16P Gen5", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
+	SND_PCI_QUIRK(0x17aa, 0x38fd, "ThinkBook plus Gen5 Hybrid", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+	SND_PCI_QUIRK(0x17aa, 0x3913, "Lenovo 145", ALC236_FIXUP_LENOVO_INV_DMIC),
+	SND_PCI_QUIRK(0x17aa, 0x391f, "Yoga S990-16 pro Quad YC Quad", ALC287_FIXUP_TAS2781_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x3920, "Yoga S990-16 pro Quad VECO Quad", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
 	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
@@ -10347,14 +10657,18 @@
 	SND_PCI_QUIRK(0x17aa, 0x9e56, "Lenovo ZhaoYang CF4620Z", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1849, 0x1233, "ASRock NUC Box 1100", ALC233_FIXUP_NO_AUDIO_JACK),
 	SND_PCI_QUIRK(0x1849, 0xa233, "Positivo Master C6300", ALC269_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1854, 0x0440, "LG CQ6", ALC256_FIXUP_HEADPHONE_AMP_VOL),
+	SND_PCI_QUIRK(0x1854, 0x0441, "LG CQ6 AIO", ALC256_FIXUP_HEADPHONE_AMP_VOL),
 	SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
 	SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x19e5, 0x3212, "Huawei KLV-WX9 ", ALC256_FIXUP_ACER_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1b35, 0x1235, "CZC B20", ALC269_FIXUP_CZC_B20),
 	SND_PCI_QUIRK(0x1b35, 0x1236, "CZC TMI", ALC269_FIXUP_CZC_TMI),
 	SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101),
 	SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
 	SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
 	SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
+	SND_PCI_QUIRK(0x1c6c, 0x122a, "Positivo N14AP7", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1c6c, 0x1251, "Positivo N14KP6-TG", ALC288_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1d05, 0x1132, "TongFang PHxTxX1", ALC256_FIXUP_SET_COEF_DEFAULTS),
 	SND_PCI_QUIRK(0x1d05, 0x1096, "TongFang GMxMRxx", ALC269_FIXUP_NO_SHUTUP),
@@ -10365,20 +10679,30 @@
 	SND_PCI_QUIRK(0x1d05, 0x1147, "TongFang GMxTGxx", ALC269_FIXUP_NO_SHUTUP),
 	SND_PCI_QUIRK(0x1d05, 0x115c, "TongFang GMxTGxx", ALC269_FIXUP_NO_SHUTUP),
 	SND_PCI_QUIRK(0x1d05, 0x121b, "TongFang GMxAGxx", ALC269_FIXUP_NO_SHUTUP),
+	SND_PCI_QUIRK(0x1d05, 0x1387, "TongFang GMxIXxx", ALC2XX_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1d05, 0x1409, "TongFang GMxIXxx", ALC2XX_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1d17, 0x3288, "Haier Boyue G42", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS),
 	SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+	SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13),
 	SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO),
+	SND_PCI_QUIRK(0x2782, 0x1701, "Infinix Y4 Max", ALC269VC_FIXUP_INFINIX_Y4_MAX),
+	SND_PCI_QUIRK(0x2782, 0x1705, "MEDION E15433", ALC269VC_FIXUP_INFINIX_Y4_MAX),
 	SND_PCI_QUIRK(0x2782, 0x1707, "Vaio VJFE-ADL", ALC298_FIXUP_SPK_VOLUME),
+	SND_PCI_QUIRK(0x2782, 0x4900, "MEDION E15443", ALC233_FIXUP_MEDION_MTL_SPK),
 	SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC),
 	SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED),
 	SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),
 	SND_PCI_QUIRK(0x8086, 0x3038, "Intel NUC 13", ALC295_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0xf111, 0x0001, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
-	SND_PCI_QUIRK(0xf111, 0x0005, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0xf111, 0x0006, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0xf111, 0x0009, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0xf111, 0x000c, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
 
 #if 0
 	/* Below is a quirk table taken from the old code.
@@ -10431,11 +10755,11 @@
 	{}
 };
 
-static const struct snd_pci_quirk alc269_fixup_vendor_tbl[] = {
+static const struct hda_quirk alc269_fixup_vendor_tbl[] = {
 	SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
 	SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
-	SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", ALC269_FIXUP_THINKPAD_ACPI),
+	SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo XPAD", ALC269_FIXUP_LENOVO_XPAD_ACPI),
 	SND_PCI_QUIRK_VENDOR(0x19e5, "Huawei Matebook", ALC255_FIXUP_MIC_MUTE_LED),
 	{}
 };
@@ -10457,6 +10781,7 @@
 	{.id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, .name = "dell-headset-dock"},
 	{.id = ALC269_FIXUP_DELL3_MIC_NO_PRESENCE, .name = "dell-headset3"},
 	{.id = ALC269_FIXUP_DELL4_MIC_NO_PRESENCE, .name = "dell-headset4"},
+	{.id = ALC269_FIXUP_DELL4_MIC_NO_PRESENCE_QUIET, .name = "dell-headset4-quiet"},
 	{.id = ALC283_FIXUP_CHROME_BOOK, .name = "alc283-dac-wcaps"},
 	{.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"},
 	{.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
@@ -10499,6 +10824,7 @@
 	{.id = ALC290_FIXUP_MONO_SPEAKERS_HSJACK, .name = "mono-speakers"},
 	{.id = ALC290_FIXUP_SUBWOOFER_HSJACK, .name = "alc290-subwoofer"},
 	{.id = ALC269_FIXUP_THINKPAD_ACPI, .name = "thinkpad"},
+	{.id = ALC269_FIXUP_LENOVO_XPAD_ACPI, .name = "lenovo-xpad-led"},
 	{.id = ALC269_FIXUP_DMIC_THINKPAD_ACPI, .name = "dmic-thinkpad"},
 	{.id = ALC255_FIXUP_ACER_MIC_NO_PRESENCE, .name = "alc255-acer"},
 	{.id = ALC255_FIXUP_ASUS_MIC_NO_PRESENCE, .name = "alc255-asus"},
@@ -10559,11 +10885,14 @@
 	{.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"},
 	{.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"},
 	{.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"},
+	{.id = ALC285_FIXUP_HP_ENVY_X360, .name = "alc285-hp-envy-x360"},
 	{.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"},
 	{.id = ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN, .name = "alc287-yoga9-bass-spk-pin"},
 	{.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"},
 	{.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"},
 	{.id = ALC285_FIXUP_HP_GPIO_AMP_INIT, .name = "alc285-hp-amp-init"},
+	{.id = ALC236_FIXUP_LENOVO_INV_DMIC, .name = "alc236-fixup-lenovo-inv-mic"},
+	{.id = ALC2XX_FIXUP_HEADSET_MIC, .name = "alc2xx-fixup-headset-mic"},
 	{}
 };
 #define ALC225_STANDARD_PINS \
@@ -11006,20 +11335,22 @@
 	SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
 		{0x19, 0x40000000},
 		{0x1b, 0x40000000}),
-	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE_QUIET,
 		{0x19, 0x40000000},
 		{0x1b, 0x40000000}),
 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
 		{0x19, 0x40000000},
 		{0x1a, 0x40000000}),
-	SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+	SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_LIMIT_INT_MIC_BOOST,
 		{0x19, 0x40000000},
 		{0x1a, 0x40000000}),
-	SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+	SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC269_FIXUP_DELL1_LIMIT_INT_MIC_BOOST,
 		{0x19, 0x40000000},
 		{0x1a, 0x40000000}),
 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC2XX_FIXUP_HEADSET_MIC,
 		{0x19, 0x40000000}),
+	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1558, "Clevo", ALC2XX_FIXUP_HEADSET_MIC,
+		{0x19, 0x40000000}),
 	{}
 };
 
@@ -11354,7 +11685,7 @@
 	}
 };
 
-static const struct snd_pci_quirk alc861_fixup_tbl[] = {
+static const struct hda_quirk alc861_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x1253, "ASUS W7J", ALC660_FIXUP_ASUS_W7J),
 	SND_PCI_QUIRK(0x1043, 0x1263, "ASUS Z35HL", ALC660_FIXUP_ASUS_W7J),
 	SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP),
@@ -11460,7 +11791,7 @@
 	},
 };
 
-static const struct snd_pci_quirk alc861vd_fixup_tbl[] = {
+static const struct hda_quirk alc861vd_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x30bf, "HP TX1000", ALC861VD_FIX_DALLAS),
 	SND_PCI_QUIRK(0x1043, 0x1339, "ASUS A7-K", ALC660VD_FIX_ASUS_GPIO1),
 	SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba L30-149", ALC861VD_FIX_DALLAS),
@@ -11805,6 +12136,7 @@
 	ALC897_FIXUP_LENOVO_HEADSET_MODE,
 	ALC897_FIXUP_HEADSET_MIC_PIN2,
 	ALC897_FIXUP_UNIS_H3C_X500S,
+	ALC897_FIXUP_HEADSET_MIC_PIN3,
 };
 
 static const struct hda_fixup alc662_fixups[] = {
@@ -12251,10 +12583,18 @@
 			{}
 		},
 	},
+	[ALC897_FIXUP_HEADSET_MIC_PIN3] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x19, 0x03a11050 }, /* use as headset mic */
+			{ }
+		},
+	},
 };
 
-static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+static const struct hda_quirk alc662_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2),
+	SND_PCI_QUIRK(0x1019, 0x9859, "JP-IK LEAP W502", ALC897_FIXUP_HEADSET_MIC_PIN3),
 	SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x0241, "Packard Bell DOTS", ALC662_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_sigmatel.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_sigmatel.c
@@ -1462,7 +1462,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk stac9200_fixup_tbl[] = {
+static const struct hda_quirk stac9200_fixup_tbl[] = {
 	/* SigmaTel reference board */
 	SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
 		      "DFI LanParty", STAC_REF),
@@ -1683,7 +1683,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk stac925x_fixup_tbl[] = {
+static const struct hda_quirk stac925x_fixup_tbl[] = {
 	/* SigmaTel reference board */
 	SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668, "DFI LanParty", STAC_REF),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DFI, 0x3101, "DFI LanParty", STAC_REF),
@@ -1957,7 +1957,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
+static const struct hda_quirk stac92hd73xx_fixup_tbl[] = {
 	/* SigmaTel reference board */
 	SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
 				"DFI LanParty", STAC_92HD73XX_REF),
@@ -2755,7 +2755,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = {
+static const struct hda_quirk stac92hd83xxx_fixup_tbl[] = {
 	/* SigmaTel reference board */
 	SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
 		      "DFI LanParty", STAC_92HD83XXX_REF),
@@ -3238,7 +3238,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk stac92hd71bxx_fixup_tbl[] = {
+static const struct hda_quirk stac92hd71bxx_fixup_tbl[] = {
 	/* SigmaTel reference board */
 	SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
 		      "DFI LanParty", STAC_92HD71BXX_REF),
@@ -3498,7 +3498,7 @@
 };
 
 /* codec SSIDs for Intel Mac sharing the same PCI SSID 8384:7680 */
-static const struct snd_pci_quirk stac922x_intel_mac_fixup_tbl[] = {
+static const struct hda_quirk stac922x_intel_mac_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x0000, 0x0100, "Mac Mini", STAC_INTEL_MAC_V3),
 	SND_PCI_QUIRK(0x106b, 0x0800, "Mac", STAC_INTEL_MAC_V1),
 	SND_PCI_QUIRK(0x106b, 0x0600, "Mac", STAC_INTEL_MAC_V2),
@@ -3642,7 +3642,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk stac922x_fixup_tbl[] = {
+static const struct hda_quirk stac922x_fixup_tbl[] = {
 	/* SigmaTel reference board */
 	SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
 		      "DFI LanParty", STAC_D945_REF),
@@ -3970,7 +3970,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk stac927x_fixup_tbl[] = {
+static const struct hda_quirk stac927x_fixup_tbl[] = {
 	/* SigmaTel reference board */
 	SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
 		      "DFI LanParty", STAC_D965_REF),
@@ -4180,7 +4180,7 @@
 	{}
 };
 
-static const struct snd_pci_quirk stac9205_fixup_tbl[] = {
+static const struct hda_quirk stac9205_fixup_tbl[] = {
 	/* SigmaTel reference board */
 	SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
 		      "DFI LanParty", STAC_9205_REF),
@@ -4257,7 +4257,7 @@
 	},
 };
 
-static const struct snd_pci_quirk stac92hd95_fixup_tbl[] = {
+static const struct hda_quirk stac92hd95_fixup_tbl[] = {
 	SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1911, "HP Spectre 13", STAC_92HD95_HP_BASS),
 	{} /* terminator */
 };
@@ -5010,7 +5010,7 @@
 	},
 };
 
-static const struct snd_pci_quirk stac9872_fixup_tbl[] = {
+static const struct hda_quirk stac9872_fixup_tbl[] = {
 	SND_PCI_QUIRK_MASK(0x104d, 0xfff0, 0x81e0,
 			   "Sony VAIO F/S", STAC_9872_VAIO),
 	{} /* terminator */
--- linux-qcom-6.8.0.orig/sound/pci/hda/patch_via.c
+++ linux-qcom-6.8.0/sound/pci/hda/patch_via.c
@@ -1041,7 +1041,7 @@
 	},
 };
 
-static const struct snd_pci_quirk vt2002p_fixups[] = {
+static const struct hda_quirk vt2002p_fixups[] = {
 	SND_PCI_QUIRK(0x1043, 0x13f7, "Asus B23E", VIA_FIXUP_POWER_SAVE),
 	SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
 	SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
--- linux-qcom-6.8.0.orig/sound/pci/hda/tas2781_hda_i2c.c
+++ linux-qcom-6.8.0/sound/pci/hda/tas2781_hda_i2c.c
@@ -2,10 +2,12 @@
 //
 // TAS2781 HDA I2C driver
 //
-// Copyright 2023 Texas Instruments, Inc.
+// Copyright 2023 - 2024 Texas Instruments, Inc.
 //
 // Author: Shenghao Ding <shenghao-ding@ti.com>
+// Current maintainer: Baojun Xu <baojun.xu@ti.com>
 
+#include <asm/unaligned.h>
 #include <linux/acpi.h>
 #include <linux/crc8.h>
 #include <linux/crc32.h>
@@ -89,7 +91,7 @@
 	struct snd_kcontrol *dsp_prog_ctl;
 	struct snd_kcontrol *dsp_conf_ctl;
 	struct snd_kcontrol *prof_ctl;
-	struct snd_kcontrol *snd_ctls[3];
+	struct snd_kcontrol *snd_ctls[2];
 };
 
 static int tas2781_get_i2c_res(struct acpi_resource *ares, void *data)
@@ -111,9 +113,7 @@
 static int tas2781_read_acpi(struct tasdevice_priv *p, const char *hid)
 {
 	struct acpi_device *adev;
-	struct device *physdev;
 	LIST_HEAD(resources);
-	const char *sub;
 	int ret;
 
 	adev = acpi_dev_get_first_match_dev(hid, NULL, -1);
@@ -129,18 +129,8 @@
 
 	acpi_dev_free_resource_list(&resources);
 	strscpy(p->dev_name, hid, sizeof(p->dev_name));
-	physdev = get_device(acpi_get_first_physical_node(adev));
 	acpi_dev_put(adev);
 
-	/* No side-effect to the playback even if subsystem_id is NULL*/
-	sub = acpi_get_subsystem_id(ACPI_HANDLE(physdev));
-	if (IS_ERR(sub))
-		sub = NULL;
-
-	p->acpi_subsystem_id = sub;
-
-	put_device(physdev);
-
 	return 0;
 
 err:
@@ -160,11 +150,13 @@
 		pm_runtime_get_sync(dev);
 		mutex_lock(&tas_hda->priv->codec_lock);
 		tasdevice_tuning_switch(tas_hda->priv, 0);
+		tas_hda->priv->playback_started = true;
 		mutex_unlock(&tas_hda->priv->codec_lock);
 		break;
 	case HDA_GEN_PCM_ACT_CLOSE:
 		mutex_lock(&tas_hda->priv->codec_lock);
 		tasdevice_tuning_switch(tas_hda->priv, 1);
+		tas_hda->priv->playback_started = false;
 		mutex_unlock(&tas_hda->priv->codec_lock);
 
 		pm_runtime_mark_last_busy(dev);
@@ -195,8 +187,12 @@
 {
 	struct tasdevice_priv *tas_priv = snd_kcontrol_chip(kcontrol);
 
+	mutex_lock(&tas_priv->codec_lock);
+
 	ucontrol->value.integer.value[0] = tas_priv->rcabin.profile_cfg_id;
 
+	mutex_unlock(&tas_priv->codec_lock);
+
 	return 0;
 }
 
@@ -210,11 +206,15 @@
 
 	val = clamp(nr_profile, 0, max);
 
+	mutex_lock(&tas_priv->codec_lock);
+
 	if (tas_priv->rcabin.profile_cfg_id != val) {
 		tas_priv->rcabin.profile_cfg_id = val;
 		ret = 1;
 	}
 
+	mutex_unlock(&tas_priv->codec_lock);
+
 	return ret;
 }
 
@@ -251,8 +251,12 @@
 {
 	struct tasdevice_priv *tas_priv = snd_kcontrol_chip(kcontrol);
 
+	mutex_lock(&tas_priv->codec_lock);
+
 	ucontrol->value.integer.value[0] = tas_priv->cur_prog;
 
+	mutex_unlock(&tas_priv->codec_lock);
+
 	return 0;
 }
 
@@ -267,11 +271,15 @@
 
 	val = clamp(nr_program, 0, max);
 
+	mutex_lock(&tas_priv->codec_lock);
+
 	if (tas_priv->cur_prog != val) {
 		tas_priv->cur_prog = val;
 		ret = 1;
 	}
 
+	mutex_unlock(&tas_priv->codec_lock);
+
 	return ret;
 }
 
@@ -280,8 +288,12 @@
 {
 	struct tasdevice_priv *tas_priv = snd_kcontrol_chip(kcontrol);
 
+	mutex_lock(&tas_priv->codec_lock);
+
 	ucontrol->value.integer.value[0] = tas_priv->cur_conf;
 
+	mutex_unlock(&tas_priv->codec_lock);
+
 	return 0;
 }
 
@@ -296,33 +308,16 @@
 
 	val = clamp(nr_config, 0, max);
 
+	mutex_lock(&tas_priv->codec_lock);
+
 	if (tas_priv->cur_conf != val) {
 		tas_priv->cur_conf = val;
 		ret = 1;
 	}
 
-	return ret;
-}
-
-/*
- * tas2781_digital_getvol - get the volum control
- * @kcontrol: control pointer
- * @ucontrol: User data
- * Customer Kcontrol for tas2781 is primarily for regmap booking, paging
- * depends on internal regmap mechanism.
- * tas2781 contains book and page two-level register map, especially
- * book switching will set the register BXXP00R7F, after switching to the
- * correct book, then leverage the mechanism for paging to access the
- * register.
- */
-static int tas2781_digital_getvol(struct snd_kcontrol *kcontrol,
-	struct snd_ctl_elem_value *ucontrol)
-{
-	struct tasdevice_priv *tas_priv = snd_kcontrol_chip(kcontrol);
-	struct soc_mixer_control *mc =
-		(struct soc_mixer_control *)kcontrol->private_value;
+	mutex_unlock(&tas_priv->codec_lock);
 
-	return tasdevice_digital_getvol(tas_priv, ucontrol, mc);
+	return ret;
 }
 
 static int tas2781_amp_getvol(struct snd_kcontrol *kcontrol,
@@ -331,19 +326,15 @@
 	struct tasdevice_priv *tas_priv = snd_kcontrol_chip(kcontrol);
 	struct soc_mixer_control *mc =
 		(struct soc_mixer_control *)kcontrol->private_value;
+	int ret;
 
-	return tasdevice_amp_getvol(tas_priv, ucontrol, mc);
-}
+	mutex_lock(&tas_priv->codec_lock);
 
-static int tas2781_digital_putvol(struct snd_kcontrol *kcontrol,
-	struct snd_ctl_elem_value *ucontrol)
-{
-	struct tasdevice_priv *tas_priv = snd_kcontrol_chip(kcontrol);
-	struct soc_mixer_control *mc =
-		(struct soc_mixer_control *)kcontrol->private_value;
+	ret = tasdevice_amp_getvol(tas_priv, ucontrol, mc);
 
-	/* The check of the given value is in tasdevice_digital_putvol. */
-	return tasdevice_digital_putvol(tas_priv, ucontrol, mc);
+	mutex_unlock(&tas_priv->codec_lock);
+
+	return ret;
 }
 
 static int tas2781_amp_putvol(struct snd_kcontrol *kcontrol,
@@ -352,9 +343,16 @@
 	struct tasdevice_priv *tas_priv = snd_kcontrol_chip(kcontrol);
 	struct soc_mixer_control *mc =
 		(struct soc_mixer_control *)kcontrol->private_value;
+	int ret;
+
+	mutex_lock(&tas_priv->codec_lock);
 
 	/* The check of the given value is in tasdevice_amp_putvol. */
-	return tasdevice_amp_putvol(tas_priv, ucontrol, mc);
+	ret = tasdevice_amp_putvol(tas_priv, ucontrol, mc);
+
+	mutex_unlock(&tas_priv->codec_lock);
+
+	return ret;
 }
 
 static int tas2781_force_fwload_get(struct snd_kcontrol *kcontrol,
@@ -362,10 +360,14 @@
 {
 	struct tasdevice_priv *tas_priv = snd_kcontrol_chip(kcontrol);
 
+	mutex_lock(&tas_priv->codec_lock);
+
 	ucontrol->value.integer.value[0] = (int)tas_priv->force_fwload_status;
 	dev_dbg(tas_priv->dev, "%s : Force FWload %s\n", __func__,
 			tas_priv->force_fwload_status ? "ON" : "OFF");
 
+	mutex_unlock(&tas_priv->codec_lock);
+
 	return 0;
 }
 
@@ -375,6 +377,8 @@
 	struct tasdevice_priv *tas_priv = snd_kcontrol_chip(kcontrol);
 	bool change, val = (bool)ucontrol->value.integer.value[0];
 
+	mutex_lock(&tas_priv->codec_lock);
+
 	if (tas_priv->force_fwload_status == val)
 		change = false;
 	else {
@@ -384,6 +388,8 @@
 	dev_dbg(tas_priv->dev, "%s : Force FWload %s\n", __func__,
 		tas_priv->force_fwload_status ? "ON" : "OFF");
 
+	mutex_unlock(&tas_priv->codec_lock);
+
 	return change;
 }
 
@@ -391,9 +397,6 @@
 	ACARD_SINGLE_RANGE_EXT_TLV("Speaker Analog Gain", TAS2781_AMP_LEVEL,
 		1, 0, 20, 0, tas2781_amp_getvol,
 		tas2781_amp_putvol, amp_vol_tlv),
-	ACARD_SINGLE_RANGE_EXT_TLV("Speaker Digital Gain", TAS2781_DVC_LVL,
-		0, 0, 200, 1, tas2781_digital_getvol,
-		tas2781_digital_putvol, dvc_tlv),
 	ACARD_SINGLE_BOOL_EXT("Speaker Force Firmware Load", 0,
 		tas2781_force_fwload_get, tas2781_force_fwload_put),
 };
@@ -488,25 +491,27 @@
 static void tas2781_apply_calib(struct tasdevice_priv *tas_priv)
 {
 	static const unsigned char page_array[CALIB_MAX] = {
-		0x17, 0x18, 0x18, 0x0d, 0x18
+		0x17, 0x18, 0x18, 0x13, 0x18,
 	};
 	static const unsigned char rgno_array[CALIB_MAX] = {
-		0x74, 0x0c, 0x14, 0x3c, 0x7c
+		0x74, 0x0c, 0x14, 0x70, 0x7c,
 	};
-	unsigned char *data;
+	int offset = 0;
 	int i, j, rc;
+	__be32 data;
 
 	for (i = 0; i < tas_priv->ndev; i++) {
-		data = tas_priv->cali_data.data +
-			i * TASDEVICE_SPEAKER_CALIBRATION_SIZE;
 		for (j = 0; j < CALIB_MAX; j++) {
+			data = cpu_to_be32(
+				*(uint32_t *)&tas_priv->cali_data.data[offset]);
 			rc = tasdevice_dev_bulk_write(tas_priv, i,
 				TASDEVICE_REG(0, page_array[j], rgno_array[j]),
-				&(data[4 * j]), 4);
+				(unsigned char *)&data, 4);
 			if (rc < 0)
 				dev_err(tas_priv->dev,
 					"chn %d calib %d bulk_wr err = %d\n",
 					i, j, rc);
+			offset += 4;
 		}
 	}
 }
@@ -666,6 +671,7 @@
 	tasdevice_save_calibration(tas_priv);
 
 	tasdevice_tuning_switch(tas_hda->priv, 0);
+	tas_hda->priv->playback_started = true;
 
 out:
 	mutex_unlock(&tas_hda->priv->codec_lock);
@@ -750,11 +756,11 @@
 {
 	struct tas2781_hda *tas_hda = dev_get_drvdata(dev);
 
+	component_del(tas_hda->dev, &tas2781_hda_comp_ops);
+
 	pm_runtime_get_sync(tas_hda->dev);
 	pm_runtime_disable(tas_hda->dev);
 
-	component_del(tas_hda->dev, &tas2781_hda_comp_ops);
-
 	pm_runtime_put_noidle(tas_hda->dev);
 
 	tasdevice_remove(tas_hda->priv);
@@ -791,7 +797,7 @@
 	} else
 		return -ENODEV;
 
-	tas_hda->priv->irq_info.irq = clt->irq;
+	tas_hda->priv->irq = clt->irq;
 	ret = tas2781_read_acpi(tas_hda->priv, device_name);
 	if (ret)
 		return dev_err_probe(tas_hda->dev, ret,
@@ -832,23 +838,19 @@
 static int tas2781_runtime_suspend(struct device *dev)
 {
 	struct tas2781_hda *tas_hda = dev_get_drvdata(dev);
-	int i;
 
 	dev_dbg(tas_hda->dev, "Runtime Suspend\n");
 
 	mutex_lock(&tas_hda->priv->codec_lock);
 
+	/* The driver powers up the amplifiers at module load time.
+	 * Stop the playback if it's unused.
+	 */
 	if (tas_hda->priv->playback_started) {
 		tasdevice_tuning_switch(tas_hda->priv, 1);
 		tas_hda->priv->playback_started = false;
 	}
 
-	for (i = 0; i < tas_hda->priv->ndev; i++) {
-		tas_hda->priv->tasdevice[i].cur_book = -1;
-		tas_hda->priv->tasdevice[i].cur_prog = -1;
-		tas_hda->priv->tasdevice[i].cur_conf = -1;
-	}
-
 	mutex_unlock(&tas_hda->priv->codec_lock);
 
 	return 0;
@@ -877,16 +879,16 @@
 static int tas2781_system_suspend(struct device *dev)
 {
 	struct tas2781_hda *tas_hda = dev_get_drvdata(dev);
-	int ret;
 
 	dev_dbg(tas_hda->priv->dev, "System Suspend\n");
 
-	ret = pm_runtime_force_suspend(dev);
-	if (ret)
-		return ret;
+	mutex_lock(&tas_hda->priv->codec_lock);
 
 	/* Shutdown chip before system suspend */
-	tasdevice_tuning_switch(tas_hda->priv, 1);
+	if (tas_hda->priv->playback_started)
+		tasdevice_tuning_switch(tas_hda->priv, 1);
+
+	mutex_unlock(&tas_hda->priv->codec_lock);
 
 	/*
 	 * Reset GPIO may be shared, so cannot reset here.
@@ -898,13 +900,9 @@
 static int tas2781_system_resume(struct device *dev)
 {
 	struct tas2781_hda *tas_hda = dev_get_drvdata(dev);
-	int i, ret;
-
-	dev_info(tas_hda->priv->dev, "System Resume\n");
+	int i;
 
-	ret = pm_runtime_force_resume(dev);
-	if (ret)
-		return ret;
+	dev_dbg(tas_hda->priv->dev, "System Resume\n");
 
 	mutex_lock(&tas_hda->priv->codec_lock);
 
@@ -920,6 +918,10 @@
 	 * calibrated data inside algo.
 	 */
 	tasdevice_apply_calibration(tas_hda->priv);
+
+	if (tas_hda->priv->playback_started)
+		tasdevice_tuning_switch(tas_hda->priv, 0);
+
 	mutex_unlock(&tas_hda->priv->codec_lock);
 
 	return 0;
--- linux-qcom-6.8.0.orig/sound/pci/rme9652/hdsp.c
+++ linux-qcom-6.8.0/sound/pci/rme9652/hdsp.c
@@ -1298,8 +1298,10 @@
 
 static void snd_hdsp_flush_midi_input (struct hdsp *hdsp, int id)
 {
-	while (snd_hdsp_midi_input_available (hdsp, id))
-		snd_hdsp_midi_read_byte (hdsp, id);
+	int count = 256;
+
+	while (snd_hdsp_midi_input_available(hdsp, id) && --count)
+		snd_hdsp_midi_read_byte(hdsp, id);
 }
 
 static int snd_hdsp_midi_output_write (struct hdsp_midi *hmidi)
--- linux-qcom-6.8.0.orig/sound/pci/rme9652/hdspm.c
+++ linux-qcom-6.8.0/sound/pci/rme9652/hdspm.c
@@ -1838,8 +1838,10 @@
 
 static void snd_hdspm_flush_midi_input(struct hdspm *hdspm, int id)
 {
-	while (snd_hdspm_midi_input_available (hdspm, id))
-		snd_hdspm_midi_read_byte (hdspm, id);
+	int count = 256;
+
+	while (snd_hdspm_midi_input_available(hdspm, id) && --count)
+		snd_hdspm_midi_read_byte(hdspm, id);
 }
 
 static int snd_hdspm_midi_output_write (struct hdspm_midi *hmidi)
--- linux-qcom-6.8.0.orig/sound/sh/aica.c
+++ linux-qcom-6.8.0/sound/sh/aica.c
@@ -278,7 +278,8 @@
 		dreamcastcard->clicks++;
 		if (unlikely(dreamcastcard->clicks >= AICA_PERIOD_NUMBER))
 			dreamcastcard->clicks %= AICA_PERIOD_NUMBER;
-		mod_timer(&dreamcastcard->timer, jiffies + 1);
+		if (snd_pcm_running(dreamcastcard->substream))
+			mod_timer(&dreamcastcard->timer, jiffies + 1);
 	}
 }
 
@@ -290,6 +291,8 @@
 	/*timer function - so cannot sleep */
 	int play_period;
 	struct snd_pcm_runtime *runtime;
+	if (!snd_pcm_running(substream))
+		return;
 	runtime = substream->runtime;
 	dreamcastcard = substream->pcm->private_data;
 	/* Have we played out an additional period? */
@@ -350,12 +353,19 @@
 	return 0;
 }
 
+static int snd_aicapcm_pcm_sync_stop(struct snd_pcm_substream *substream)
+{
+	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
+
+	del_timer_sync(&dreamcastcard->timer);
+	cancel_work_sync(&dreamcastcard->spu_dma_work);
+	return 0;
+}
+
 static int snd_aicapcm_pcm_close(struct snd_pcm_substream
 				 *substream)
 {
 	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
-	flush_work(&(dreamcastcard->spu_dma_work));
-	del_timer(&dreamcastcard->timer);
 	dreamcastcard->substream = NULL;
 	kfree(dreamcastcard->channel);
 	spu_disable();
@@ -401,6 +411,7 @@
 	.prepare = snd_aicapcm_pcm_prepare,
 	.trigger = snd_aicapcm_pcm_trigger,
 	.pointer = snd_aicapcm_pcm_pointer,
+	.sync_stop = snd_aicapcm_pcm_sync_stop,
 };
 
 /* TO DO: set up to handle more than one pcm instance */
--- linux-qcom-6.8.0.orig/sound/sh/sh_dac_audio.c
+++ linux-qcom-6.8.0/sound/sh/sh_dac_audio.c
@@ -163,7 +163,7 @@
 	/* channel is not used (interleaved data) */
 	struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
 
-	if (copy_from_iter_toio(chip->data_buffer + pos, src, count))
+	if (copy_from_iter(chip->data_buffer + pos, count, src) != count)
 		return -EFAULT;
 	chip->buffer_end = chip->data_buffer + pos + count;
 
@@ -182,7 +182,7 @@
 	/* channel is not used (interleaved data) */
 	struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
 
-	memset_io(chip->data_buffer + pos, 0, count);
+	memset(chip->data_buffer + pos, 0, count);
 	chip->buffer_end = chip->data_buffer + pos + count;
 
 	if (chip->empty) {
@@ -211,7 +211,6 @@
 	.pointer	= snd_sh_dac_pcm_pointer,
 	.copy		= snd_sh_dac_pcm_copy,
 	.fill_silence	= snd_sh_dac_pcm_silence,
-	.mmap		= snd_pcm_lib_mmap_iomem,
 };
 
 static int snd_sh_dac_pcm(struct snd_sh_dac *chip, int device)
--- linux-qcom-6.8.0.orig/sound/soc/amd/acp-es8336.c
+++ linux-qcom-6.8.0/sound/soc/amd/acp-es8336.c
@@ -203,8 +203,10 @@
 
 	codec_dev = acpi_get_first_physical_node(adev);
 	acpi_dev_put(adev);
-	if (!codec_dev)
+	if (!codec_dev) {
 		dev_err(card->dev, "can not find codec dev\n");
+		return -ENODEV;
+	}
 
 	ret = devm_acpi_dev_add_driver_gpios(codec_dev, acpi_es8336_gpios);
 	if (ret)
--- linux-qcom-6.8.0.orig/sound/soc/amd/acp/acp-i2s.c
+++ linux-qcom-6.8.0/sound/soc/amd/acp/acp-i2s.c
@@ -588,20 +588,12 @@
 {
 	struct device *dev = dai->component->dev;
 	struct acp_dev_data *adata = dev_get_drvdata(dev);
-	struct acp_resource *rsrc = adata->rsrc;
-	unsigned int val;
 
 	if (!adata->acp_base) {
 		dev_err(dev, "I2S base is NULL\n");
 		return -EINVAL;
 	}
 
-	val = readl(adata->acp_base + rsrc->i2s_pin_cfg_offset);
-	if (val != rsrc->i2s_mode) {
-		dev_err(dev, "I2S Mode not supported val %x\n", val);
-		return -EINVAL;
-	}
-
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/sound/soc/amd/acp/acp-legacy-common.c
+++ linux-qcom-6.8.0/sound/soc/amd/acp/acp-legacy-common.c
@@ -321,6 +321,8 @@
 		pr_err("ACP reset failed\n");
 		return ret;
 	}
+	if (chip->acp_rev >= ACP70_DEV)
+		writel(0, chip->base + ACP_ZSC_DSP_CTRL);
 	return 0;
 }
 EXPORT_SYMBOL_NS_GPL(acp_init, SND_SOC_ACP_COMMON);
@@ -336,6 +338,9 @@
 
 	if (chip->acp_rev != ACP70_DEV)
 		writel(0, chip->base + ACP_CONTROL);
+
+	if (chip->acp_rev >= ACP70_DEV)
+		writel(0x01, chip->base + ACP_ZSC_DSP_CTRL);
 	return 0;
 }
 EXPORT_SYMBOL_NS_GPL(acp_deinit, SND_SOC_ACP_COMMON);
@@ -358,11 +363,25 @@
 }
 EXPORT_SYMBOL_NS_GPL(smn_read, SND_SOC_ACP_COMMON);
 
-int check_acp_pdm(struct pci_dev *pci, struct acp_chip_info *chip)
+static void check_acp3x_config(struct acp_chip_info *chip)
 {
-	struct acpi_device *pdm_dev;
-	const union acpi_object *obj;
-	u32 pdm_addr, val;
+	u32 val;
+
+	val = readl(chip->base + ACP3X_PIN_CONFIG);
+	switch (val) {
+	case ACP_CONFIG_4:
+		chip->is_i2s_config = true;
+		chip->is_pdm_config = true;
+		break;
+	default:
+		chip->is_pdm_config = true;
+		break;
+	}
+}
+
+static void check_acp6x_config(struct acp_chip_info *chip)
+{
+	u32 val;
 
 	val = readl(chip->base + ACP_PIN_CONFIG);
 	switch (val) {
@@ -371,42 +390,94 @@
 	case ACP_CONFIG_6:
 	case ACP_CONFIG_7:
 	case ACP_CONFIG_8:
-	case ACP_CONFIG_10:
 	case ACP_CONFIG_11:
+	case ACP_CONFIG_14:
+		chip->is_pdm_config = true;
+		break;
+	case ACP_CONFIG_9:
+		chip->is_i2s_config = true;
+		break;
+	case ACP_CONFIG_10:
 	case ACP_CONFIG_12:
 	case ACP_CONFIG_13:
+		chip->is_i2s_config = true;
+		chip->is_pdm_config = true;
+		break;
+	default:
+		break;
+	}
+}
+
+static void check_acp70_config(struct acp_chip_info *chip)
+{
+	u32 val;
+
+	val = readl(chip->base + ACP_PIN_CONFIG);
+	switch (val) {
+	case ACP_CONFIG_4:
+	case ACP_CONFIG_5:
+	case ACP_CONFIG_6:
+	case ACP_CONFIG_7:
+	case ACP_CONFIG_8:
+	case ACP_CONFIG_11:
 	case ACP_CONFIG_14:
+	case ACP_CONFIG_17:
+	case ACP_CONFIG_18:
+		chip->is_pdm_config = true;
+		break;
+	case ACP_CONFIG_9:
+		chip->is_i2s_config = true;
+		break;
+	case ACP_CONFIG_10:
+	case ACP_CONFIG_12:
+	case ACP_CONFIG_13:
+	case ACP_CONFIG_19:
+	case ACP_CONFIG_20:
+		chip->is_i2s_config = true;
+		chip->is_pdm_config = true;
 		break;
 	default:
-		return -EINVAL;
+		break;
 	}
+}
+
+void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip)
+{
+	struct acpi_device *pdm_dev;
+	const union acpi_object *obj;
+	u32 pdm_addr;
 
 	switch (chip->acp_rev) {
 	case ACP3X_DEV:
 		pdm_addr = ACP_RENOIR_PDM_ADDR;
+		check_acp3x_config(chip);
 		break;
 	case ACP6X_DEV:
 		pdm_addr = ACP_REMBRANDT_PDM_ADDR;
+		check_acp6x_config(chip);
 		break;
 	case ACP63_DEV:
 		pdm_addr = ACP63_PDM_ADDR;
+		check_acp6x_config(chip);
 		break;
 	case ACP70_DEV:
 		pdm_addr = ACP70_PDM_ADDR;
+		check_acp70_config(chip);
 		break;
 	default:
-		return -EINVAL;
+		break;
 	}
 
-	pdm_dev = acpi_find_child_device(ACPI_COMPANION(&pci->dev), pdm_addr, 0);
-	if (pdm_dev) {
-		if (!acpi_dev_get_property(pdm_dev, "acp-audio-device-type",
-					   ACPI_TYPE_INTEGER, &obj) &&
-					   obj->integer.value == pdm_addr)
-			return 0;
+	if (chip->is_pdm_config) {
+		pdm_dev = acpi_find_child_device(ACPI_COMPANION(&pci->dev), pdm_addr, 0);
+		if (pdm_dev) {
+			if (!acpi_dev_get_property(pdm_dev, "acp-audio-device-type",
+						   ACPI_TYPE_INTEGER, &obj) &&
+						   obj->integer.value == pdm_addr)
+				chip->is_pdm_dev = true;
+		}
 	}
-	return -ENODEV;
 }
-EXPORT_SYMBOL_NS_GPL(check_acp_pdm, SND_SOC_ACP_COMMON);
+EXPORT_SYMBOL_NS_GPL(check_acp_config, SND_SOC_ACP_COMMON);
 
 MODULE_LICENSE("Dual BSD/GPL");
--- linux-qcom-6.8.0.orig/sound/soc/amd/acp/acp-legacy-mach.c
+++ linux-qcom-6.8.0/sound/soc/amd/acp/acp-legacy-mach.c
@@ -227,6 +227,8 @@
 	},
 	{ }
 };
+MODULE_DEVICE_TABLE(platform, board_ids);
+
 static struct platform_driver acp_asoc_audio = {
 	.driver = {
 		.pm = &snd_soc_pm_ops,
--- linux-qcom-6.8.0.orig/sound/soc/amd/acp/acp-pci.c
+++ linux-qcom-6.8.0/sound/soc/amd/acp/acp-pci.c
@@ -100,7 +100,7 @@
 		ret = -EINVAL;
 		goto release_regions;
 	}
-
+	chip->flag = flag;
 	dmic_dev = platform_device_register_data(dev, "dmic-codec", PLATFORM_DEVID_NONE, NULL, 0);
 	if (IS_ERR(dmic_dev)) {
 		dev_err(dev, "failed to create DMIC device\n");
@@ -115,7 +115,14 @@
 		goto unregister_dmic_dev;
 	}
 
-	acp_init(chip);
+	ret = acp_init(chip);
+	if (ret)
+		goto unregister_dmic_dev;
+
+	check_acp_config(pci, chip);
+	if (!chip->is_pdm_dev && !chip->is_i2s_config)
+		goto skip_pdev_creation;
+
 	res = devm_kcalloc(&pci->dev, num_res, sizeof(struct resource), GFP_KERNEL);
 	if (!res) {
 		ret = -ENOMEM;
@@ -133,13 +140,6 @@
 		}
 	}
 
-	if (flag == FLAG_AMD_LEGACY_ONLY_DMIC) {
-		ret = check_acp_pdm(pci, chip);
-		if (ret < 0)
-			goto skip_pdev_creation;
-	}
-
-	chip->flag = flag;
 	memset(&pdevinfo, 0, sizeof(pdevinfo));
 
 	pdevinfo.name = chip->name;
@@ -199,10 +199,12 @@
 	ret = acp_init(chip);
 	if (ret)
 		dev_err(dev, "ACP init failed\n");
-	child = chip->chip_pdev->dev;
-	adata = dev_get_drvdata(&child);
-	if (adata)
-		acp_enable_interrupts(adata);
+	if (chip->chip_pdev) {
+		child = chip->chip_pdev->dev;
+		adata = dev_get_drvdata(&child);
+		if (adata)
+			acp_enable_interrupts(adata);
+	}
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/sound/soc/amd/acp/acp-sof-mach.c
+++ linux-qcom-6.8.0/sound/soc/amd/acp/acp-sof-mach.c
@@ -126,16 +126,14 @@
 	if (dmi_id && dmi_id->driver_data)
 		acp_card_drvdata->tdm_mode = dmi_id->driver_data;
 
-	acp_sofdsp_dai_links_create(card);
+	ret = acp_sofdsp_dai_links_create(card);
+	if (ret)
+		return dev_err_probe(&pdev->dev, ret, "Failed to create DAI links\n");
 
 	ret = devm_snd_soc_register_card(&pdev->dev, card);
-	if (ret) {
-		dev_err(&pdev->dev,
-				"devm_snd_soc_register_card(%s) failed: %d\n",
-				card->name, ret);
-		return ret;
-	}
-
+	if (ret)
+		return dev_err_probe(&pdev->dev, ret,
+				     "Failed to register card(%s)\n", card->name);
 	return 0;
 }
 
@@ -170,6 +168,8 @@
 	},
 	{ }
 };
+MODULE_DEVICE_TABLE(platform, board_ids);
+
 static struct platform_driver acp_asoc_audio = {
 	.driver = {
 		.name = "sof_mach",
--- linux-qcom-6.8.0.orig/sound/soc/amd/acp/amd.h
+++ linux-qcom-6.8.0/sound/soc/amd/acp/amd.h
@@ -103,6 +103,8 @@
 #define ACP70_PGFSM_CONTROL			ACP6X_PGFSM_CONTROL
 #define ACP70_PGFSM_STATUS			ACP6X_PGFSM_STATUS
 
+#define ACP_ZSC_DSP_CTRL			0x0001014
+#define ACP_ZSC_STS				0x0001018
 #define ACP_SOFT_RST_DONE_MASK	0x00010001
 
 #define ACP_PGFSM_CNTL_POWER_ON_MASK            0xffffffff
@@ -138,6 +140,9 @@
 	void __iomem *base;	/* ACP memory PCI base */
 	struct platform_device *chip_pdev;
 	unsigned int flag;	/* Distinguish b/w Legacy or Only PDM */
+	bool is_pdm_dev;	/* flag set to true when ACP PDM controller exists */
+	bool is_pdm_config;	/* flag set to true when PDM configuration is selected from BIOS */
+	bool is_i2s_config;	/* flag set to true when I2S configuration is selected from BIOS */
 };
 
 struct acp_stream {
@@ -212,6 +217,11 @@
 	ACP_CONFIG_13,
 	ACP_CONFIG_14,
 	ACP_CONFIG_15,
+	ACP_CONFIG_16,
+	ACP_CONFIG_17,
+	ACP_CONFIG_18,
+	ACP_CONFIG_19,
+	ACP_CONFIG_20,
 };
 
 extern const struct snd_soc_dai_ops asoc_acp_cpu_dai_ops;
@@ -240,7 +250,7 @@
 int restore_acp_i2s_params(struct snd_pcm_substream *substream,
 			   struct acp_dev_data *adata, struct acp_stream *stream);
 
-int check_acp_pdm(struct pci_dev *pci, struct acp_chip_info *chip);
+void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip);
 
 static inline u64 acp_get_byte_count(struct acp_dev_data *adata, int dai_id, int direction)
 {
--- linux-qcom-6.8.0.orig/sound/soc/amd/acp/chip_offset_byte.h
+++ linux-qcom-6.8.0/sound/soc/amd/acp/chip_offset_byte.h
@@ -20,6 +20,7 @@
 #define ACP_SOFT_RESET                          0x1000
 #define ACP_CONTROL                             0x1004
 #define ACP_PIN_CONFIG				0x1440
+#define ACP3X_PIN_CONFIG			0x1400
 
 #define ACP_EXTERNAL_INTR_REG_ADDR(adata, offset, ctrl) \
 	(adata->acp_base + adata->rsrc->irq_reg_offset + offset + (ctrl * 0x04))
--- linux-qcom-6.8.0.orig/sound/soc/amd/yc/acp6x-mach.c
+++ linux-qcom-6.8.0/sound/soc/amd/yc/acp6x-mach.c
@@ -203,28 +203,56 @@
 		.driver_data = &acp6x_card,
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "21J2"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21J0"),
 		}
 	},
 	{
 		.driver_data = &acp6x_card,
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "21J0"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21J5"),
 		}
 	},
 	{
 		.driver_data = &acp6x_card,
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "21J5"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21J6"),
 		}
 	},
 	{
 		.driver_data = &acp6x_card,
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "21J6"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21M1"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21M3"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21M4"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21M5"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21ME"),
 		}
 	},
 	{
@@ -290,6 +318,13 @@
 			DMI_MATCH(DMI_PRODUCT_NAME, "M5402RA"),
 		}
 	},
+        {
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "M5602RA"),
+		}
+	},
 	{
 		.driver_data = &acp6x_card,
 		.matches = {
@@ -315,12 +350,33 @@
 		.driver_data = &acp6x_card,
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "E1404FA"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "E1504FA"),
 		}
 	},
 	{
 		.driver_data = &acp6x_card,
 		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "M7600RE"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "M3502RA"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 15 B7ED"),
 		}
@@ -335,6 +391,13 @@
 	{
 		.driver_data = &acp6x_card,
 		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 17 D7VEK"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "Alienware"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m17 R5 AMD"),
 		}
@@ -356,6 +419,20 @@
 	{
 		.driver_data = &acp6x_card,
 		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "TIMI"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Xiaomi Book Pro 14 2022"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "TIMI"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Redmi G 2022"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "Razer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Blade 14 (2022) - RZ09-0427"),
 		}
@@ -399,6 +476,13 @@
 		.driver_data = &acp6x_card,
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
+			DMI_MATCH(DMI_BOARD_NAME, "8A44"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
 			DMI_MATCH(DMI_BOARD_NAME, "8A22"),
 		}
 	},
@@ -413,6 +497,20 @@
 		.driver_data = &acp6x_card,
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
+			DMI_MATCH(DMI_BOARD_NAME, "8A7F"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
+			DMI_MATCH(DMI_BOARD_NAME, "8B27"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
 			DMI_MATCH(DMI_BOARD_NAME, "8B2F"),
 		}
 	},
@@ -433,6 +531,13 @@
 	{
 		.driver_data = &acp6x_card,
 		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "MDC"),
+			DMI_MATCH(DMI_BOARD_NAME, "Herbag_MDU"),
+		}
+	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "System76"),
 			DMI_MATCH(DMI_PRODUCT_VERSION, "pang12"),
 		}
@@ -453,8 +558,14 @@
 	struct acp6x_pdm *machine = NULL;
 	struct snd_soc_card *card;
 	struct acpi_device *adev;
+	acpi_handle handle;
+	acpi_integer dmic_status;
 	int ret;
+	bool is_dmic_enable, wov_en;
 
+	/* IF WOV entry not found, enable dmic based on AcpDmicConnected entry*/
+	is_dmic_enable = false;
+	wov_en = true;
 	/* check the parent device's firmware node has _DSD or not */
 	adev = ACPI_COMPANION(pdev->dev.parent);
 	if (adev) {
@@ -462,9 +573,24 @@
 
 		if (!acpi_dev_get_property(adev, "AcpDmicConnected", ACPI_TYPE_INTEGER, &obj) &&
 		    obj->integer.value == 1)
-			platform_set_drvdata(pdev, &acp6x_card);
+			is_dmic_enable = true;
 	}
 
+	handle = ACPI_HANDLE(pdev->dev.parent);
+	ret = acpi_evaluate_integer(handle, "_WOV", NULL, &dmic_status);
+	if (!ACPI_FAILURE(ret)) {
+		wov_en = dmic_status;
+		if (!wov_en)
+			return -ENODEV;
+	} else {
+		/* Incase of ACPI method read failure then jump to check_dmi_entry */
+		goto check_dmi_entry;
+	}
+
+	if (is_dmic_enable)
+		platform_set_drvdata(pdev, &acp6x_card);
+
+check_dmi_entry:
 	/* check for any DMI overrides */
 	dmi_id = dmi_first_match(yc_acp_quirk_table);
 	if (dmi_id)
--- linux-qcom-6.8.0.orig/sound/soc/amd/yc/pci-acp6x.c
+++ linux-qcom-6.8.0/sound/soc/amd/yc/pci-acp6x.c
@@ -162,7 +162,6 @@
 	/* Yellow Carp device check */
 	switch (pci->revision) {
 	case 0x60:
-	case 0x63:
 	case 0x6f:
 		break;
 	default:
--- linux-qcom-6.8.0.orig/sound/soc/atmel/atmel-classd.c
+++ linux-qcom-6.8.0/sound/soc/atmel/atmel-classd.c
@@ -473,19 +473,22 @@
 	if (!dai_link)
 		return -ENOMEM;
 
-	comp = devm_kzalloc(dev, sizeof(*comp), GFP_KERNEL);
+	comp = devm_kzalloc(dev, 2 * sizeof(*comp), GFP_KERNEL);
 	if (!comp)
 		return -ENOMEM;
 
-	dai_link->cpus		= comp;
+	dai_link->cpus		= &comp[0];
 	dai_link->codecs	= &snd_soc_dummy_dlc;
+	dai_link->platforms	= &comp[1];
 
 	dai_link->num_cpus	= 1;
 	dai_link->num_codecs	= 1;
+	dai_link->num_platforms = 1;
 
 	dai_link->name			= "CLASSD";
 	dai_link->stream_name		= "CLASSD PCM";
 	dai_link->cpus->dai_name	= dev_name(dev);
+	dai_link->platforms->name	= dev_name(dev);
 
 	card->dai_link	= dai_link;
 	card->num_links	= 1;
--- linux-qcom-6.8.0.orig/sound/soc/atmel/mchp-pdmc.c
+++ linux-qcom-6.8.0/sound/soc/atmel/mchp-pdmc.c
@@ -285,6 +285,9 @@
 	if (!substream)
 		return -ENODEV;
 
+	if (!substream->runtime)
+		return 0; /* just for avoiding error from alsactl restore */
+
 	map = mchp_pdmc_chmap_get(substream, info);
 	if (!map)
 		return -EINVAL;
--- linux-qcom-6.8.0.orig/sound/soc/au1x/db1200.c
+++ linux-qcom-6.8.0/sound/soc/au1x/db1200.c
@@ -44,6 +44,7 @@
 	},
 	{},
 };
+MODULE_DEVICE_TABLE(platform, db1200_pids);
 
 /*-------------------------  AC97 PART  ---------------------------*/
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/Kconfig
+++ linux-qcom-6.8.0/sound/soc/codecs/Kconfig
@@ -152,6 +152,7 @@
 	imply SND_SOC_MAX9877
 	imply SND_SOC_MC13783
 	imply SND_SOC_ML26124
+	imply SND_SOC_MSM_STUB
 	imply SND_SOC_MT6351
 	imply SND_SOC_MT6358
 	imply SND_SOC_MT6359
@@ -275,6 +276,7 @@
 	imply SND_SOC_UDA1380
 	imply SND_SOC_WCD9335
 	imply SND_SOC_WCD934X
+	imply SND_SOC_WCD937X_SDW
 	imply SND_SOC_WCD938X_SDW
 	imply SND_SOC_LPASS_MACRO_COMMON
 	imply SND_SOC_LPASS_RX_MACRO
@@ -1281,6 +1283,14 @@
 	depends on I2C
 	select REGMAP_I2C
 
+config SND_SOC_MSM_STUB
+        tristate "Qualcomm Technologies, Inc. MSM Stub audio codec"
+	help
+	  Enable support for MSM_STUB Audio codec.
+	  This codec driver provides the PCM interface for
+	  I2S and TDM interface audio data communication.
+	  To compile this codec driver say Y or m.
+
 config SND_SOC_MSM8916_WCD_ANALOG
 	tristate "Qualcomm MSM8916 WCD Analog Codec"
 	depends on SPMI || COMPILE_TEST
@@ -2042,6 +2052,25 @@
 	  The WCD9340/9341 is a audio codec IC Integrated in
 	  Qualcomm SoCs like SDM845.
 
+config SND_SOC_WCD937X
+	depends on SND_SOC_WCD937X_SDW
+	tristate
+	depends on SOUNDWIRE || !SOUNDWIRE
+	select SND_SOC_WCD_CLASSH
+
+config SND_SOC_WCD937X_SDW
+	tristate "WCD9370/WCD9375 Codec - SDW"
+	select SND_SOC_WCD937X
+	select SND_SOC_WCD_MBHC
+	select REGMAP_IRQ
+	depends on SOUNDWIRE
+	select REGMAP_SOUNDWIRE
+	help
+	  The WCD9370/9375 is an audio codec IC used with SoCs
+	  like SC7280 or QCM6490 chipsets, and it connected
+	  via soundwire.
+	  To compile this codec driver say Y or m.
+
 config SND_SOC_WCD938X
 	depends on SND_SOC_WCD938X_SDW
 	tristate
@@ -2253,6 +2282,7 @@
 
 config SND_SOC_WM8994
 	tristate
+	depends on MFD_WM8994
 
 config SND_SOC_WM8995
 	tristate
--- linux-qcom-6.8.0.orig/sound/soc/codecs/Makefile
+++ linux-qcom-6.8.0/sound/soc/codecs/Makefile
@@ -168,6 +168,7 @@
 snd-soc-ml26124-objs := ml26124.o
 snd-soc-msm8916-analog-objs := msm8916-wcd-analog.o
 snd-soc-msm8916-digital-objs := msm8916-wcd-digital.o
+snd-soc-msm-stub-objs := msm-stub.o
 snd-soc-mt6351-objs := mt6351.o
 snd-soc-mt6358-objs := mt6358.o
 snd-soc-mt6359-objs := mt6359.o
@@ -311,6 +312,8 @@
 snd-soc-wcd-mbhc-objs := wcd-mbhc-v2.o
 snd-soc-wcd9335-objs := wcd9335.o
 snd-soc-wcd934x-objs := wcd934x.o
+snd-soc-wcd937x-objs := wcd937x.o
+snd-soc-wcd937x-sdw-objs := wcd937x-sdw.o
 snd-soc-wcd938x-objs := wcd938x.o
 snd-soc-wcd938x-sdw-objs := wcd938x-sdw.o
 snd-soc-wl1273-objs := wl1273.o
@@ -553,6 +556,7 @@
 obj-$(CONFIG_SND_SOC_ML26124)	+= snd-soc-ml26124.o
 obj-$(CONFIG_SND_SOC_MSM8916_WCD_ANALOG) +=snd-soc-msm8916-analog.o
 obj-$(CONFIG_SND_SOC_MSM8916_WCD_DIGITAL) +=snd-soc-msm8916-digital.o
+obj-$(CONFIG_SND_SOC_MSM_STUB)    += snd-soc-msm-stub.o
 obj-$(CONFIG_SND_SOC_MT6351)	+= snd-soc-mt6351.o
 obj-$(CONFIG_SND_SOC_MT6358)	+= snd-soc-mt6358.o
 obj-$(CONFIG_SND_SOC_MT6359)	+= snd-soc-mt6359.o
@@ -698,6 +702,11 @@
 obj-$(CONFIG_SND_SOC_WCD_MBHC)	+= snd-soc-wcd-mbhc.o
 obj-$(CONFIG_SND_SOC_WCD9335)	+= snd-soc-wcd9335.o
 obj-$(CONFIG_SND_SOC_WCD934X)	+= snd-soc-wcd934x.o
+obj-$(CONFIG_SND_SOC_WCD937X)	+= snd-soc-wcd937x.o
+ifdef CONFIG_SND_SOC_WCD937X_SDW
+# avoid link failure by forcing sdw code built-in when needed
+obj-$(CONFIG_SND_SOC_WCD937X) += snd-soc-wcd937x-sdw.o
+endif
 obj-$(CONFIG_SND_SOC_WCD938X)	+= snd-soc-wcd938x.o
 ifdef CONFIG_SND_SOC_WCD938X_SDW
 # avoid link failure by forcing sdw code built-in when needed
--- linux-qcom-6.8.0.orig/sound/soc/codecs/aw88399.c
+++ linux-qcom-6.8.0/sound/soc/codecs/aw88399.c
@@ -656,7 +656,7 @@
 	if (ret)
 		return ret;
 	if (!(reg_val & (~AW88399_WDT_CNT_MASK)))
-		ret = -EPERM;
+		return -EPERM;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/sound/soc/codecs/chv3-codec.c
+++ linux-qcom-6.8.0/sound/soc/codecs/chv3-codec.c
@@ -26,6 +26,7 @@
 	{ .compatible = "google,chv3-codec", },
 	{ }
 };
+MODULE_DEVICE_TABLE(of, chv3_codec_of_match);
 
 static struct platform_driver chv3_codec_platform_driver = {
 	.driver = {
--- linux-qcom-6.8.0.orig/sound/soc/codecs/cs35l41.c
+++ linux-qcom-6.8.0/sound/soc/codecs/cs35l41.c
@@ -1094,6 +1094,7 @@
 static int cs35l41_dsp_init(struct cs35l41_private *cs35l41)
 {
 	struct wm_adsp *dsp;
+	uint32_t dsp1rx5_src;
 	int ret;
 
 	dsp = &cs35l41->dsp;
@@ -1113,16 +1114,29 @@
 		return ret;
 	}
 
-	ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX5_SRC,
-			   CS35L41_INPUT_SRC_VPMON);
+	switch (cs35l41->hw_cfg.bst_type) {
+	case CS35L41_INT_BOOST:
+	case CS35L41_SHD_BOOST_ACTV:
+		dsp1rx5_src = CS35L41_INPUT_SRC_VPMON;
+		break;
+	case CS35L41_EXT_BOOST:
+	case CS35L41_SHD_BOOST_PASS:
+		dsp1rx5_src = CS35L41_INPUT_SRC_VBSTMON;
+		break;
+	default:
+		dev_err(cs35l41->dev, "wm_halo_init failed - Invalid Boost Type: %d\n",
+			cs35l41->hw_cfg.bst_type);
+		goto err_dsp;
+	}
+
+	ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX5_SRC, dsp1rx5_src);
 	if (ret < 0) {
-		dev_err(cs35l41->dev, "Write INPUT_SRC_VPMON failed: %d\n", ret);
+		dev_err(cs35l41->dev, "Write DSP1RX5_SRC: %d failed: %d\n", dsp1rx5_src, ret);
 		goto err_dsp;
 	}
-	ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX6_SRC,
-			   CS35L41_INPUT_SRC_CLASSH);
+	ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX6_SRC, CS35L41_INPUT_SRC_VBSTMON);
 	if (ret < 0) {
-		dev_err(cs35l41->dev, "Write INPUT_SRC_CLASSH failed: %d\n", ret);
+		dev_err(cs35l41->dev, "Write CS35L41_INPUT_SRC_VBSTMON failed: %d\n", ret);
 		goto err_dsp;
 	}
 	ret = regmap_write(cs35l41->regmap, CS35L41_DSP1_RX7_SRC,
--- linux-qcom-6.8.0.orig/sound/soc/codecs/cs35l56-shared.c
+++ linux-qcom-6.8.0/sound/soc/codecs/cs35l56-shared.c
@@ -17,10 +17,23 @@
 	 * Firmware can change these to non-defaults to satisfy SDCA.
 	 * Ensure that they are at known defaults.
 	 */
+	{ CS35L56_ASP1_ENABLES1,		0x00000000 },
+	{ CS35L56_ASP1_CONTROL1,		0x00000028 },
+	{ CS35L56_ASP1_CONTROL2,		0x18180200 },
+	{ CS35L56_ASP1_CONTROL3,		0x00000002 },
+	{ CS35L56_ASP1_FRAME_CONTROL1,		0x03020100 },
+	{ CS35L56_ASP1_FRAME_CONTROL5,		0x00020100 },
+	{ CS35L56_ASP1_DATA_CONTROL1,		0x00000018 },
+	{ CS35L56_ASP1_DATA_CONTROL5,		0x00000018 },
+	{ CS35L56_ASP1TX1_INPUT,		0x00000000 },
+	{ CS35L56_ASP1TX2_INPUT,		0x00000000 },
+	{ CS35L56_ASP1TX3_INPUT,		0x00000000 },
+	{ CS35L56_ASP1TX4_INPUT,		0x00000000 },
 	{ CS35L56_SWIRE_DP3_CH1_INPUT,		0x00000018 },
 	{ CS35L56_SWIRE_DP3_CH2_INPUT,		0x00000019 },
 	{ CS35L56_SWIRE_DP3_CH3_INPUT,		0x00000029 },
 	{ CS35L56_SWIRE_DP3_CH4_INPUT,		0x00000028 },
+	{ CS35L56_IRQ1_MASK_18,			0x1f7df0ff },
 
 	/* These are not reset by a soft-reset, so patch to defaults. */
 	{ CS35L56_MAIN_RENDER_USER_MUTE,	0x00000000 },
@@ -44,9 +57,10 @@
 	{ CS35L56_ASP1_FRAME_CONTROL5,		0x00020100 },
 	{ CS35L56_ASP1_DATA_CONTROL1,		0x00000018 },
 	{ CS35L56_ASP1_DATA_CONTROL5,		0x00000018 },
-
-	/* no defaults for ASP1TX mixer */
-
+	{ CS35L56_ASP1TX1_INPUT,		0x00000000 },
+	{ CS35L56_ASP1TX2_INPUT,		0x00000000 },
+	{ CS35L56_ASP1TX3_INPUT,		0x00000000 },
+	{ CS35L56_ASP1TX4_INPUT,		0x00000000 },
 	{ CS35L56_SWIRE_DP3_CH1_INPUT,		0x00000018 },
 	{ CS35L56_SWIRE_DP3_CH2_INPUT,		0x00000019 },
 	{ CS35L56_SWIRE_DP3_CH3_INPUT,		0x00000029 },
@@ -203,47 +217,6 @@
 	}
 }
 
-/*
- * The firmware boot sequence can overwrite the ASP1 config registers so that
- * they don't match regmap's view of their values. Rewrite the values from the
- * regmap cache into the hardware registers.
- */
-int cs35l56_force_sync_asp1_registers_from_cache(struct cs35l56_base *cs35l56_base)
-{
-	struct reg_sequence asp1_regs[] = {
-		{ .reg = CS35L56_ASP1_ENABLES1 },
-		{ .reg = CS35L56_ASP1_CONTROL1 },
-		{ .reg = CS35L56_ASP1_CONTROL2 },
-		{ .reg = CS35L56_ASP1_CONTROL3 },
-		{ .reg = CS35L56_ASP1_FRAME_CONTROL1 },
-		{ .reg = CS35L56_ASP1_FRAME_CONTROL5 },
-		{ .reg = CS35L56_ASP1_DATA_CONTROL1 },
-		{ .reg = CS35L56_ASP1_DATA_CONTROL5 },
-	};
-	int i, ret;
-
-	/* Read values from regmap cache into a write sequence */
-	for (i = 0; i < ARRAY_SIZE(asp1_regs); ++i) {
-		ret = regmap_read(cs35l56_base->regmap, asp1_regs[i].reg, &asp1_regs[i].def);
-		if (ret)
-			goto err;
-	}
-
-	/* Write the values cache-bypassed so that they will be written to silicon */
-	ret = regmap_multi_reg_write_bypassed(cs35l56_base->regmap, asp1_regs,
-					      ARRAY_SIZE(asp1_regs));
-	if (ret)
-		goto err;
-
-	return 0;
-
-err:
-	dev_err(cs35l56_base->dev, "Failed to sync ASP1 registers: %d\n", ret);
-
-	return ret;
-}
-EXPORT_SYMBOL_NS_GPL(cs35l56_force_sync_asp1_registers_from_cache, SND_SOC_CS35L56_SHARED);
-
 int cs35l56_mbox_send(struct cs35l56_base *cs35l56_base, unsigned int command)
 {
 	unsigned int val;
@@ -363,7 +336,7 @@
 {
 	int ret;
 
-	if (!irq)
+	if (irq < 1)
 		return 0;
 
 	ret = devm_request_threaded_irq(cs35l56_base->dev, irq, NULL, cs35l56_irq,
--- linux-qcom-6.8.0.orig/sound/soc/codecs/cs35l56.c
+++ linux-qcom-6.8.0/sound/soc/codecs/cs35l56.c
@@ -61,131 +61,6 @@
 	return snd_soc_put_volsw(kcontrol, ucontrol);
 }
 
-static const unsigned short cs35l56_asp1_mixer_regs[] = {
-	CS35L56_ASP1TX1_INPUT, CS35L56_ASP1TX2_INPUT,
-	CS35L56_ASP1TX3_INPUT, CS35L56_ASP1TX4_INPUT,
-};
-
-static const char * const cs35l56_asp1_mux_control_names[] = {
-	"ASP1 TX1 Source", "ASP1 TX2 Source", "ASP1 TX3 Source", "ASP1 TX4 Source"
-};
-
-static int cs35l56_sync_asp1_mixer_widgets_with_firmware(struct cs35l56_private *cs35l56)
-{
-	struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(cs35l56->component);
-	const char *prefix = cs35l56->component->name_prefix;
-	char full_name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
-	const char *name;
-	struct snd_kcontrol *kcontrol;
-	struct soc_enum *e;
-	unsigned int val[4];
-	int i, item, ret;
-
-	if (cs35l56->asp1_mixer_widgets_initialized)
-		return 0;
-
-	/*
-	 * Resume so we can read the registers from silicon if the regmap
-	 * cache has not yet been populated.
-	 */
-	ret = pm_runtime_resume_and_get(cs35l56->base.dev);
-	if (ret < 0)
-		return ret;
-
-	/* Wait for firmware download and reboot */
-	cs35l56_wait_dsp_ready(cs35l56);
-
-	ret = regmap_bulk_read(cs35l56->base.regmap, CS35L56_ASP1TX1_INPUT,
-			       val, ARRAY_SIZE(val));
-
-	pm_runtime_mark_last_busy(cs35l56->base.dev);
-	pm_runtime_put_autosuspend(cs35l56->base.dev);
-
-	if (ret) {
-		dev_err(cs35l56->base.dev, "Failed to read ASP1 mixer regs: %d\n", ret);
-		return ret;
-	}
-
-	for (i = 0; i < ARRAY_SIZE(cs35l56_asp1_mux_control_names); ++i) {
-		name = cs35l56_asp1_mux_control_names[i];
-
-		if (prefix) {
-			snprintf(full_name, sizeof(full_name), "%s %s", prefix, name);
-			name = full_name;
-		}
-
-		kcontrol = snd_soc_card_get_kcontrol_locked(dapm->card, name);
-		if (!kcontrol) {
-			dev_warn(cs35l56->base.dev, "Could not find control %s\n", name);
-			continue;
-		}
-
-		e = (struct soc_enum *)kcontrol->private_value;
-		item = snd_soc_enum_val_to_item(e, val[i] & CS35L56_ASP_TXn_SRC_MASK);
-		snd_soc_dapm_mux_update_power(dapm, kcontrol, item, e, NULL);
-	}
-
-	cs35l56->asp1_mixer_widgets_initialized = true;
-
-	return 0;
-}
-
-static int cs35l56_dspwait_asp1tx_get(struct snd_kcontrol *kcontrol,
-				      struct snd_ctl_elem_value *ucontrol)
-{
-	struct snd_soc_component *component = snd_soc_dapm_kcontrol_component(kcontrol);
-	struct cs35l56_private *cs35l56 = snd_soc_component_get_drvdata(component);
-	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
-	int index = e->shift_l;
-	unsigned int addr, val;
-	int ret;
-
-	ret = cs35l56_sync_asp1_mixer_widgets_with_firmware(cs35l56);
-	if (ret)
-		return ret;
-
-	addr = cs35l56_asp1_mixer_regs[index];
-	ret = regmap_read(cs35l56->base.regmap, addr, &val);
-	if (ret)
-		return ret;
-
-	val &= CS35L56_ASP_TXn_SRC_MASK;
-	ucontrol->value.enumerated.item[0] = snd_soc_enum_val_to_item(e, val);
-
-	return 0;
-}
-
-static int cs35l56_dspwait_asp1tx_put(struct snd_kcontrol *kcontrol,
-				      struct snd_ctl_elem_value *ucontrol)
-{
-	struct snd_soc_component *component = snd_soc_dapm_kcontrol_component(kcontrol);
-	struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
-	struct cs35l56_private *cs35l56 = snd_soc_component_get_drvdata(component);
-	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
-	int item = ucontrol->value.enumerated.item[0];
-	int index = e->shift_l;
-	unsigned int addr, val;
-	bool changed;
-	int ret;
-
-	ret = cs35l56_sync_asp1_mixer_widgets_with_firmware(cs35l56);
-	if (ret)
-		return ret;
-
-	addr = cs35l56_asp1_mixer_regs[index];
-	val = snd_soc_enum_item_to_val(e, item);
-
-	ret = regmap_update_bits_check(cs35l56->base.regmap, addr,
-				       CS35L56_ASP_TXn_SRC_MASK, val, &changed);
-	if (ret)
-		return ret;
-
-	if (changed)
-		snd_soc_dapm_mux_update_power(dapm, kcontrol, item, e, NULL);
-
-	return changed;
-}
-
 static DECLARE_TLV_DB_SCALE(vol_tlv, -10000, 25, 0);
 
 static const struct snd_kcontrol_new cs35l56_controls[] = {
@@ -204,44 +79,40 @@
 };
 
 static SOC_VALUE_ENUM_SINGLE_DECL(cs35l56_asp1tx1_enum,
-				  SND_SOC_NOPM,
-				  0, 0,
+				  CS35L56_ASP1TX1_INPUT,
+				  0, CS35L56_ASP_TXn_SRC_MASK,
 				  cs35l56_tx_input_texts,
 				  cs35l56_tx_input_values);
 
 static const struct snd_kcontrol_new asp1_tx1_mux =
-	SOC_DAPM_ENUM_EXT("ASP1TX1 SRC", cs35l56_asp1tx1_enum,
-			  cs35l56_dspwait_asp1tx_get, cs35l56_dspwait_asp1tx_put);
+	SOC_DAPM_ENUM("ASP1TX1 SRC", cs35l56_asp1tx1_enum);
 
 static SOC_VALUE_ENUM_SINGLE_DECL(cs35l56_asp1tx2_enum,
-				  SND_SOC_NOPM,
-				  1, 0,
+				  CS35L56_ASP1TX2_INPUT,
+				  0, CS35L56_ASP_TXn_SRC_MASK,
 				  cs35l56_tx_input_texts,
 				  cs35l56_tx_input_values);
 
 static const struct snd_kcontrol_new asp1_tx2_mux =
-	SOC_DAPM_ENUM_EXT("ASP1TX2 SRC", cs35l56_asp1tx2_enum,
-			  cs35l56_dspwait_asp1tx_get, cs35l56_dspwait_asp1tx_put);
+	SOC_DAPM_ENUM("ASP1TX2 SRC", cs35l56_asp1tx2_enum);
 
 static SOC_VALUE_ENUM_SINGLE_DECL(cs35l56_asp1tx3_enum,
-				  SND_SOC_NOPM,
-				  2, 0,
+				  CS35L56_ASP1TX3_INPUT,
+				  0, CS35L56_ASP_TXn_SRC_MASK,
 				  cs35l56_tx_input_texts,
 				  cs35l56_tx_input_values);
 
 static const struct snd_kcontrol_new asp1_tx3_mux =
-	SOC_DAPM_ENUM_EXT("ASP1TX3 SRC", cs35l56_asp1tx3_enum,
-			  cs35l56_dspwait_asp1tx_get, cs35l56_dspwait_asp1tx_put);
+	SOC_DAPM_ENUM("ASP1TX3 SRC", cs35l56_asp1tx3_enum);
 
 static SOC_VALUE_ENUM_SINGLE_DECL(cs35l56_asp1tx4_enum,
-				  SND_SOC_NOPM,
-				  3, 0,
+				  CS35L56_ASP1TX4_INPUT,
+				  0, CS35L56_ASP_TXn_SRC_MASK,
 				  cs35l56_tx_input_texts,
 				  cs35l56_tx_input_values);
 
 static const struct snd_kcontrol_new asp1_tx4_mux =
-	SOC_DAPM_ENUM_EXT("ASP1TX4 SRC", cs35l56_asp1tx4_enum,
-			  cs35l56_dspwait_asp1tx_get, cs35l56_dspwait_asp1tx_put);
+	SOC_DAPM_ENUM("ASP1TX4 SRC", cs35l56_asp1tx4_enum);
 
 static SOC_VALUE_ENUM_SINGLE_DECL(cs35l56_sdw1tx1_enum,
 				CS35L56_SWIRE_DP3_CH1_INPUT,
@@ -279,21 +150,6 @@
 static const struct snd_kcontrol_new sdw1_tx4_mux =
 	SOC_DAPM_ENUM("SDW1TX4 SRC", cs35l56_sdw1tx4_enum);
 
-static int cs35l56_asp1_cfg_event(struct snd_soc_dapm_widget *w,
-				  struct snd_kcontrol *kcontrol, int event)
-{
-	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
-	struct cs35l56_private *cs35l56 = snd_soc_component_get_drvdata(component);
-
-	switch (event) {
-	case SND_SOC_DAPM_PRE_PMU:
-		/* Override register values set by firmware boot */
-		return cs35l56_force_sync_asp1_registers_from_cache(&cs35l56->base);
-	default:
-		return 0;
-	}
-}
-
 static int cs35l56_play_event(struct snd_soc_dapm_widget *w,
 			      struct snd_kcontrol *kcontrol, int event)
 {
@@ -330,9 +186,6 @@
 	SND_SOC_DAPM_REGULATOR_SUPPLY("VDD_B", 0, 0),
 	SND_SOC_DAPM_REGULATOR_SUPPLY("VDD_AMP", 0, 0),
 
-	SND_SOC_DAPM_SUPPLY("ASP1 CFG", SND_SOC_NOPM, 0, 0, cs35l56_asp1_cfg_event,
-			    SND_SOC_DAPM_PRE_PMU),
-
 	SND_SOC_DAPM_SUPPLY("PLAY", SND_SOC_NOPM, 0, 0, cs35l56_play_event,
 			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
 
@@ -400,9 +253,6 @@
 	{ "AMP", NULL, "VDD_B" },
 	{ "AMP", NULL, "VDD_AMP" },
 
-	{ "ASP1 Playback", NULL, "ASP1 CFG" },
-	{ "ASP1 Capture", NULL, "ASP1 CFG" },
-
 	{ "ASP1 Playback", NULL, "PLAY" },
 	{ "SDW1 Playback", NULL, "PLAY" },
 
@@ -979,13 +829,6 @@
 	debugfs_create_bool("can_hibernate", 0444, debugfs_root, &cs35l56->base.can_hibernate);
 	debugfs_create_bool("fw_patched", 0444, debugfs_root, &cs35l56->base.fw_patched);
 
-	/*
-	 * The widgets for the ASP1TX mixer can't be initialized
-	 * until the firmware has been downloaded and rebooted.
-	 */
-	regcache_drop_region(cs35l56->base.regmap, CS35L56_ASP1TX1_INPUT, CS35L56_ASP1TX4_INPUT);
-	cs35l56->asp1_mixer_widgets_initialized = false;
-
 	queue_work(cs35l56->dsp_wq, &cs35l56->dsp_work);
 
 	return 0;
@@ -1297,6 +1140,7 @@
 				    "spk-id-gpios", ACPI_TYPE_PACKAGE, &obj);
 	if (ret) {
 		dev_dbg(cs35l56->base.dev, "Could not get spk-id-gpios package: %d\n", ret);
+		fwnode_handle_put(af01_fwnode);
 		return -ENOENT;
 	}
 
@@ -1304,6 +1148,7 @@
 	if (obj->package.count != 4) {
 		dev_warn(cs35l56->base.dev, "Unexpected spk-id element count %d\n",
 			 obj->package.count);
+		fwnode_handle_put(af01_fwnode);
 		return -ENOENT;
 	}
 
@@ -1318,6 +1163,7 @@
 		 */
 		ret = acpi_dev_add_driver_gpios(adev, cs35l56_af01_spkid_gpios_mapping);
 		if (ret) {
+			fwnode_handle_put(af01_fwnode);
 			return dev_err_probe(cs35l56->base.dev, ret,
 					     "Failed to add gpio mapping to AF01\n");
 		}
@@ -1325,14 +1171,17 @@
 		ret = devm_add_action_or_reset(cs35l56->base.dev,
 					       cs35l56_acpi_dev_release_driver_gpios,
 					       adev);
-		if (ret)
+		if (ret) {
+			fwnode_handle_put(af01_fwnode);
 			return ret;
+		}
 
 		dev_dbg(cs35l56->base.dev, "Added spk-id-gpios mapping to AF01\n");
 	}
 
 	desc = fwnode_gpiod_get_index(af01_fwnode, "spk-id", 0, GPIOD_IN, NULL);
 	if (IS_ERR(desc)) {
+		fwnode_handle_put(af01_fwnode);
 		ret = PTR_ERR(desc);
 		return dev_err_probe(cs35l56->base.dev, ret, "Get GPIO from AF01 failed\n");
 	}
@@ -1341,9 +1190,12 @@
 	gpiod_put(desc);
 
 	if (ret < 0) {
+		fwnode_handle_put(af01_fwnode);
 		dev_err_probe(cs35l56->base.dev, ret, "Error reading spk-id GPIO\n");
 		return ret;
-		}
+	}
+
+	fwnode_handle_put(af01_fwnode);
 
 	dev_info(cs35l56->base.dev, "Got spk-id from AF01\n");
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/cs35l56.h
+++ linux-qcom-6.8.0/sound/soc/codecs/cs35l56.h
@@ -51,7 +51,6 @@
 	u8 asp_slot_count;
 	bool tdm_mode;
 	bool sysclk_set;
-	bool asp1_mixer_widgets_initialized;
 	u8 old_sdw_clock_scale;
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/cs42l43-jack.c
+++ linux-qcom-6.8.0/sound/soc/codecs/cs42l43-jack.c
@@ -110,7 +110,7 @@
 		priv->buttons[3] = 735;
 	}
 
-	ret = cs42l43_find_index(priv, "cirrus,detect-us", 1000, &priv->detect_us,
+	ret = cs42l43_find_index(priv, "cirrus,detect-us", 50000, &priv->detect_us,
 				 cs42l43_accdet_us, ARRAY_SIZE(cs42l43_accdet_us));
 	if (ret < 0)
 		goto error;
@@ -422,7 +422,7 @@
 
 	// Wait for 2 full cycles of comb filter to ensure good reading
 	queue_delayed_work(system_wq, &priv->button_press_work,
-			   msecs_to_jiffies(10));
+			   msecs_to_jiffies(20));
 
 	return IRQ_HANDLED;
 }
--- linux-qcom-6.8.0.orig/sound/soc/codecs/cs42l43.c
+++ linux-qcom-6.8.0/sound/soc/codecs/cs42l43.c
@@ -300,8 +300,9 @@
 	struct snd_soc_component *component = dai->component;
 	struct cs42l43_codec *priv = snd_soc_component_get_drvdata(component);
 	struct cs42l43 *cs42l43 = priv->core;
-	int provider = !!regmap_test_bits(cs42l43->regmap, CS42L43_ASP_CLK_CONFIG2,
-					  CS42L43_ASP_MASTER_MODE_MASK);
+	int provider = !dai->id || !!regmap_test_bits(cs42l43->regmap,
+						      CS42L43_ASP_CLK_CONFIG2,
+						      CS42L43_ASP_MASTER_MODE_MASK);
 
 	if (provider)
 		priv->constraint.mask = CS42L43_PROVIDER_RATE_MASK;
@@ -2338,7 +2339,8 @@
 
 static int cs42l43_codec_suspend(struct device *dev)
 {
-	struct cs42l43 *cs42l43 = dev_get_drvdata(dev);
+	struct cs42l43_codec *priv = dev_get_drvdata(dev);
+	struct cs42l43 *cs42l43 = priv->core;
 
 	disable_irq(cs42l43->irq);
 
@@ -2347,7 +2349,8 @@
 
 static int cs42l43_codec_suspend_noirq(struct device *dev)
 {
-	struct cs42l43 *cs42l43 = dev_get_drvdata(dev);
+	struct cs42l43_codec *priv = dev_get_drvdata(dev);
+	struct cs42l43 *cs42l43 = priv->core;
 
 	enable_irq(cs42l43->irq);
 
@@ -2356,7 +2359,8 @@
 
 static int cs42l43_codec_resume(struct device *dev)
 {
-	struct cs42l43 *cs42l43 = dev_get_drvdata(dev);
+	struct cs42l43_codec *priv = dev_get_drvdata(dev);
+	struct cs42l43 *cs42l43 = priv->core;
 
 	enable_irq(cs42l43->irq);
 
@@ -2365,7 +2369,8 @@
 
 static int cs42l43_codec_resume_noirq(struct device *dev)
 {
-	struct cs42l43 *cs42l43 = dev_get_drvdata(dev);
+	struct cs42l43_codec *priv = dev_get_drvdata(dev);
+	struct cs42l43 *cs42l43 = priv->core;
 
 	disable_irq(cs42l43->irq);
 
@@ -2376,6 +2381,7 @@
 	SYSTEM_SLEEP_PM_OPS(cs42l43_codec_suspend, cs42l43_codec_resume)
 	NOIRQ_SYSTEM_SLEEP_PM_OPS(cs42l43_codec_suspend_noirq, cs42l43_codec_resume_noirq)
 	RUNTIME_PM_OPS(NULL, cs42l43_codec_runtime_resume, NULL)
+	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
 };
 
 static const struct platform_device_id cs42l43_codec_id_table[] = {
--- linux-qcom-6.8.0.orig/sound/soc/codecs/cs42l51.c
+++ linux-qcom-6.8.0/sound/soc/codecs/cs42l51.c
@@ -747,8 +747,10 @@
 
 	cs42l51->reset_gpio = devm_gpiod_get_optional(dev, "reset",
 						      GPIOD_OUT_LOW);
-	if (IS_ERR(cs42l51->reset_gpio))
-		return PTR_ERR(cs42l51->reset_gpio);
+	if (IS_ERR(cs42l51->reset_gpio)) {
+		ret = PTR_ERR(cs42l51->reset_gpio);
+		goto error;
+	}
 
 	if (cs42l51->reset_gpio) {
 		dev_dbg(dev, "Release reset gpio\n");
@@ -780,6 +782,7 @@
 	return 0;
 
 error:
+	gpiod_set_value_cansleep(cs42l51->reset_gpio, 1);
 	regulator_bulk_disable(ARRAY_SIZE(cs42l51->supplies),
 			       cs42l51->supplies);
 	return ret;
--- linux-qcom-6.8.0.orig/sound/soc/codecs/da7213.c
+++ linux-qcom-6.8.0/sound/soc/codecs/da7213.c
@@ -2140,6 +2140,7 @@
 	.reg_bits = 8,
 	.val_bits = 8,
 
+	.max_register = DA7213_TONE_GEN_OFF_PER,
 	.reg_defaults = da7213_reg_defaults,
 	.num_reg_defaults = ARRAY_SIZE(da7213_reg_defaults),
 	.volatile_reg = da7213_volatile_register,
--- linux-qcom-6.8.0.orig/sound/soc/codecs/da7219-aad.c
+++ linux-qcom-6.8.0/sound/soc/codecs/da7219-aad.c
@@ -671,8 +671,10 @@
 		return NULL;
 
 	aad_pdata = devm_kzalloc(dev, sizeof(*aad_pdata), GFP_KERNEL);
-	if (!aad_pdata)
+	if (!aad_pdata) {
+		fwnode_handle_put(aad_np);
 		return NULL;
+	}
 
 	aad_pdata->irq = i2c->irq;
 
@@ -753,6 +755,8 @@
 	else
 		aad_pdata->adc_1bit_rpt = DA7219_AAD_ADC_1BIT_RPT_1;
 
+	fwnode_handle_put(aad_np);
+
 	return aad_pdata;
 }
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/da7219.c
+++ linux-qcom-6.8.0/sound/soc/codecs/da7219.c
@@ -1167,17 +1167,20 @@
 	struct da7219_priv *da7219 = snd_soc_component_get_drvdata(component);
 	int ret = 0;
 
-	if ((da7219->clk_src == clk_id) && (da7219->mclk_rate == freq))
+	mutex_lock(&da7219->pll_lock);
+
+	if ((da7219->clk_src == clk_id) && (da7219->mclk_rate == freq)) {
+		mutex_unlock(&da7219->pll_lock);
 		return 0;
+	}
 
 	if ((freq < 2000000) || (freq > 54000000)) {
+		mutex_unlock(&da7219->pll_lock);
 		dev_err(codec_dai->dev, "Unsupported MCLK value %d\n",
 			freq);
 		return -EINVAL;
 	}
 
-	mutex_lock(&da7219->pll_lock);
-
 	switch (clk_id) {
 	case DA7219_CLKSRC_MCLK_SQR:
 		snd_soc_component_update_bits(component, DA7219_PLL_CTRL,
--- linux-qcom-6.8.0.orig/sound/soc/codecs/es8316.c
+++ linux-qcom-6.8.0/sound/soc/codecs/es8316.c
@@ -39,7 +39,9 @@
 	struct snd_soc_jack *jack;
 	int irq;
 	unsigned int sysclk;
-	unsigned int allowed_rates[ARRAY_SIZE(supported_mclk_lrck_ratios)];
+	/* ES83xx supports halving the MCLK so it supports twice as many rates
+	 */
+	unsigned int allowed_rates[ARRAY_SIZE(supported_mclk_lrck_ratios) * 2];
 	struct snd_pcm_hw_constraint_list sysclk_constraints;
 	bool jd_inverted;
 };
@@ -386,6 +388,12 @@
 
 		if (freq % ratio == 0)
 			es8316->allowed_rates[count++] = freq / ratio;
+
+		/* We also check if the halved MCLK produces a valid rate
+		 * since the codec supports halving the MCLK.
+		 */
+		if ((freq / ratio) % 2 == 0)
+			es8316->allowed_rates[count++] = freq / ratio / 2;
 	}
 
 	if (count) {
--- linux-qcom-6.8.0.orig/sound/soc/codecs/es8326.c
+++ linux-qcom-6.8.0/sound/soc/codecs/es8326.c
@@ -326,9 +326,9 @@
 	{125, 48000, 6000000, 0x04, 0x04, 0x1F, 0x2D, 0x8A, 0x0A, 0x27, 0x27},
 
 	{128, 8000, 1024000, 0x60, 0x00, 0x05, 0x75, 0x8A, 0x1B, 0x1F, 0x7F},
-	{128, 16000, 2048000, 0x20, 0x00, 0x31, 0x35, 0x8A, 0x1B, 0x1F, 0x3F},
-	{128, 44100, 5644800, 0xE0, 0x00, 0x01, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F},
-	{128, 48000, 6144000, 0xE0, 0x00, 0x01, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F},
+	{128, 16000, 2048000, 0x20, 0x00, 0x31, 0x35, 0x08, 0x19, 0x1F, 0x3F},
+	{128, 44100, 5644800, 0xE0, 0x00, 0x01, 0x2D, 0x48, 0x08, 0x1F, 0x1F},
+	{128, 48000, 6144000, 0xE0, 0x00, 0x01, 0x2D, 0x48, 0x08, 0x1F, 0x1F},
 	{144, 8000, 1152000, 0x20, 0x00, 0x03, 0x35, 0x8A, 0x1B, 0x23, 0x47},
 	{144, 16000, 2304000, 0x20, 0x00, 0x11, 0x35, 0x8A, 0x1B, 0x23, 0x47},
 	{192, 8000, 1536000, 0x60, 0x02, 0x0D, 0x75, 0x8A, 0x1B, 0x1F, 0x7F},
@@ -337,10 +337,10 @@
 
 	{200, 48000, 9600000, 0x04, 0x04, 0x0F, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F},
 	{250, 48000, 12000000, 0x04, 0x04, 0x0F, 0x2D, 0xCA, 0x0A, 0x27, 0x27},
-	{256, 8000, 2048000, 0x60, 0x00, 0x31, 0x35, 0x8A, 0x1B, 0x1F, 0x7F},
-	{256, 16000, 4096000, 0x20, 0x00, 0x01, 0x35, 0x8A, 0x1B, 0x1F, 0x3F},
-	{256, 44100, 11289600, 0xE0, 0x00, 0x30, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F},
-	{256, 48000, 12288000, 0xE0, 0x00, 0x30, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F},
+	{256, 8000, 2048000, 0x60, 0x00, 0x31, 0x35, 0x08, 0x19, 0x1F, 0x7F},
+	{256, 16000, 4096000, 0x20, 0x00, 0x01, 0x35, 0x08, 0x19, 0x1F, 0x3F},
+	{256, 44100, 11289600, 0xE0, 0x01, 0x01, 0x2D, 0x48, 0x08, 0x1F, 0x1F},
+	{256, 48000, 12288000, 0xE0, 0x01, 0x01, 0x2D, 0x48, 0x08, 0x1F, 0x1F},
 	{288, 8000, 2304000, 0x20, 0x00, 0x01, 0x35, 0x8A, 0x1B, 0x23, 0x47},
 	{384, 8000, 3072000, 0x60, 0x02, 0x05, 0x75, 0x8A, 0x1B, 0x1F, 0x7F},
 	{384, 16000, 6144000, 0x20, 0x02, 0x03, 0x35, 0x8A, 0x1B, 0x1F, 0x3F},
@@ -349,10 +349,10 @@
 
 	{400, 48000, 19200000, 0xE4, 0x04, 0x35, 0x6d, 0xCA, 0x0A, 0x1F, 0x1F},
 	{500, 48000, 24000000, 0xF8, 0x04, 0x3F, 0x6D, 0xCA, 0x0A, 0x1F, 0x1F},
-	{512, 8000, 4096000, 0x60, 0x00, 0x01, 0x35, 0x8A, 0x1B, 0x1F, 0x7F},
-	{512, 16000, 8192000, 0x20, 0x00, 0x30, 0x35, 0x8A, 0x1B, 0x1F, 0x3F},
-	{512, 44100, 22579200, 0xE0, 0x00, 0x00, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F},
-	{512, 48000, 24576000, 0xE0, 0x00, 0x00, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F},
+	{512, 8000, 4096000, 0x60, 0x00, 0x01, 0x08, 0x19, 0x1B, 0x1F, 0x7F},
+	{512, 16000, 8192000, 0x20, 0x00, 0x30, 0x35, 0x08, 0x19, 0x1F, 0x3F},
+	{512, 44100, 22579200, 0xE0, 0x00, 0x00, 0x2D, 0x48, 0x08, 0x1F, 0x1F},
+	{512, 48000, 24576000, 0xE0, 0x00, 0x00, 0x2D, 0x48, 0x08, 0x1F, 0x1F},
 	{768, 8000, 6144000, 0x60, 0x02, 0x11, 0x35, 0x8A, 0x1B, 0x1F, 0x7F},
 	{768, 16000, 12288000, 0x20, 0x02, 0x01, 0x35, 0x8A, 0x1B, 0x1F, 0x3F},
 	{768, 32000, 24576000, 0xE0, 0x02, 0x30, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F},
@@ -747,6 +747,8 @@
 		es8326_disable_micbias(es8326->component);
 		if (es8326->jack->status & SND_JACK_HEADPHONE) {
 			dev_dbg(comp->dev, "Report hp remove event\n");
+			snd_soc_jack_report(es8326->jack, 0,
+				    SND_JACK_BTN_0 | SND_JACK_BTN_1 | SND_JACK_BTN_2);
 			snd_soc_jack_report(es8326->jack, 0, SND_JACK_HEADSET);
 			/* mute adc when mic path switch */
 			regmap_write(es8326->regmap, ES8326_ADC_SCALE, 0x33);
@@ -757,6 +759,7 @@
 		regmap_update_bits(es8326->regmap, ES8326_HPDET_TYPE, 0x03, 0x01);
 		regmap_write(es8326->regmap, ES8326_SYS_BIAS, 0x0a);
 		regmap_update_bits(es8326->regmap, ES8326_HP_DRIVER_REF, 0x0f, 0x03);
+		regmap_write(es8326->regmap, ES8326_INT_SOURCE, ES8326_INT_SRC_PIN9);
 		/*
 		 * Inverted HPJACK_POL bit to trigger one IRQ to double check HP Removal event
 		 */
@@ -779,10 +782,16 @@
 			 * set auto-check mode, then restart jack_detect_work after 400ms.
 			 * Don't report jack status.
 			 */
+			regmap_write(es8326->regmap, ES8326_INT_SOURCE, 0x00);
 			regmap_update_bits(es8326->regmap, ES8326_HPDET_TYPE, 0x03, 0x01);
+			regmap_update_bits(es8326->regmap, ES8326_HPDET_TYPE, 0x10, 0x00);
 			es8326_enable_micbias(es8326->component);
 			usleep_range(50000, 70000);
 			regmap_update_bits(es8326->regmap, ES8326_HPDET_TYPE, 0x03, 0x00);
+			regmap_update_bits(es8326->regmap, ES8326_HPDET_TYPE, 0x10, 0x10);
+			usleep_range(50000, 70000);
+			regmap_write(es8326->regmap, ES8326_INT_SOURCE,
+					(ES8326_INT_SRC_PIN9 | ES8326_INT_SRC_BUTTON));
 			regmap_write(es8326->regmap, ES8326_SYS_BIAS, 0x1f);
 			regmap_update_bits(es8326->regmap, ES8326_HP_DRIVER_REF, 0x0f, 0x08);
 			queue_delayed_work(system_wq, &es8326->jack_detect_work,
@@ -901,7 +910,7 @@
 	regmap_write(es8326->regmap, ES8326_VMIDSEL, 0x0E);
 	regmap_write(es8326->regmap, ES8326_ANA_LP, 0xf0);
 	usleep_range(10000, 15000);
-	regmap_write(es8326->regmap, ES8326_HPJACK_TIMER, 0xe9);
+	regmap_write(es8326->regmap, ES8326_HPJACK_TIMER, 0xd9);
 	regmap_write(es8326->regmap, ES8326_ANA_MICBIAS, 0xcb);
 	/* set headphone default type and detect pin */
 	regmap_write(es8326->regmap, ES8326_HPDET_TYPE, 0x83);
@@ -952,8 +961,7 @@
 	es8326_enable_micbias(es8326->component);
 	usleep_range(50000, 70000);
 	regmap_update_bits(es8326->regmap, ES8326_HPDET_TYPE, 0x03, 0x00);
-	regmap_write(es8326->regmap, ES8326_INT_SOURCE,
-		    (ES8326_INT_SRC_PIN9 | ES8326_INT_SRC_BUTTON));
+	regmap_write(es8326->regmap, ES8326_INT_SOURCE, ES8326_INT_SRC_PIN9);
 	regmap_write(es8326->regmap, ES8326_INTOUT_IO,
 		     es8326->interrupt_clk);
 	regmap_write(es8326->regmap, ES8326_SDINOUT1_IO,
--- linux-qcom-6.8.0.orig/sound/soc/codecs/es8326.h
+++ linux-qcom-6.8.0/sound/soc/codecs/es8326.h
@@ -101,7 +101,7 @@
 #define ES8326_MUTE (3 << 0)
 
 /* ES8326_CLK_CTL */
-#define ES8326_CLK_ON (0x7e << 0)
+#define ES8326_CLK_ON (0x7f << 0)
 #define ES8326_CLK_OFF (0 << 0)
 
 /* ES8326_CLK_INV */
--- linux-qcom-6.8.0.orig/sound/soc/codecs/hdmi-codec.c
+++ linux-qcom-6.8.0/sound/soc/codecs/hdmi-codec.c
@@ -185,84 +185,97 @@
 /*
  * hdmi_codec_channel_alloc: speaker configuration available for CEA
  *
- * This is an ordered list that must match with hdmi_codec_8ch_chmaps struct
+ * This is an ordered list where ca_id must exist in hdmi_codec_8ch_chmaps
  * The preceding ones have better chances to be selected by
  * hdmi_codec_get_ch_alloc_table_idx().
  */
 static const struct hdmi_codec_cea_spk_alloc hdmi_codec_channel_alloc[] = {
 	{ .ca_id = 0x00, .n_ch = 2,
-	  .mask = FL | FR},
-	/* 2.1 */
-	{ .ca_id = 0x01, .n_ch = 4,
-	  .mask = FL | FR | LFE},
-	/* Dolby Surround */
+	  .mask = FL | FR },
+	{ .ca_id = 0x03, .n_ch = 4,
+	  .mask = FL | FR | LFE | FC },
 	{ .ca_id = 0x02, .n_ch = 4,
 	  .mask = FL | FR | FC },
-	/* surround51 */
+	{ .ca_id = 0x01, .n_ch = 4,
+	  .mask = FL | FR | LFE },
 	{ .ca_id = 0x0b, .n_ch = 6,
-	  .mask = FL | FR | LFE | FC | RL | RR},
-	/* surround40 */
-	{ .ca_id = 0x08, .n_ch = 6,
-	  .mask = FL | FR | RL | RR },
-	/* surround41 */
-	{ .ca_id = 0x09, .n_ch = 6,
-	  .mask = FL | FR | LFE | RL | RR },
-	/* surround50 */
+	  .mask = FL | FR | LFE | FC | RL | RR },
 	{ .ca_id = 0x0a, .n_ch = 6,
 	  .mask = FL | FR | FC | RL | RR },
-	/* 6.1 */
-	{ .ca_id = 0x0f, .n_ch = 8,
-	  .mask = FL | FR | LFE | FC | RL | RR | RC },
-	/* surround71 */
+	{ .ca_id = 0x09, .n_ch = 6,
+	  .mask = FL | FR | LFE | RL | RR },
+	{ .ca_id = 0x08, .n_ch = 6,
+	  .mask = FL | FR | RL | RR },
+	{ .ca_id = 0x07, .n_ch = 6,
+	  .mask = FL | FR | LFE | FC | RC },
+	{ .ca_id = 0x06, .n_ch = 6,
+	  .mask = FL | FR | FC | RC },
+	{ .ca_id = 0x05, .n_ch = 6,
+	  .mask = FL | FR | LFE | RC },
+	{ .ca_id = 0x04, .n_ch = 6,
+	  .mask = FL | FR | RC },
 	{ .ca_id = 0x13, .n_ch = 8,
 	  .mask = FL | FR | LFE | FC | RL | RR | RLC | RRC },
-	/* others */
-	{ .ca_id = 0x03, .n_ch = 8,
-	  .mask = FL | FR | LFE | FC },
-	{ .ca_id = 0x04, .n_ch = 8,
-	  .mask = FL | FR | RC},
-	{ .ca_id = 0x05, .n_ch = 8,
-	  .mask = FL | FR | LFE | RC },
-	{ .ca_id = 0x06, .n_ch = 8,
-	  .mask = FL | FR | FC | RC },
-	{ .ca_id = 0x07, .n_ch = 8,
-	  .mask = FL | FR | LFE | FC | RC },
-	{ .ca_id = 0x0c, .n_ch = 8,
-	  .mask = FL | FR | RC | RL | RR },
-	{ .ca_id = 0x0d, .n_ch = 8,
-	  .mask = FL | FR | LFE | RL | RR | RC },
-	{ .ca_id = 0x0e, .n_ch = 8,
-	  .mask = FL | FR | FC | RL | RR | RC },
-	{ .ca_id = 0x10, .n_ch = 8,
-	  .mask = FL | FR | RL | RR | RLC | RRC },
-	{ .ca_id = 0x11, .n_ch = 8,
-	  .mask = FL | FR | LFE | RL | RR | RLC | RRC },
+	{ .ca_id = 0x1f, .n_ch = 8,
+	  .mask = FL | FR | LFE | FC | RL | RR | FLC | FRC },
 	{ .ca_id = 0x12, .n_ch = 8,
 	  .mask = FL | FR | FC | RL | RR | RLC | RRC },
-	{ .ca_id = 0x14, .n_ch = 8,
-	  .mask = FL | FR | FLC | FRC },
-	{ .ca_id = 0x15, .n_ch = 8,
-	  .mask = FL | FR | LFE | FLC | FRC },
-	{ .ca_id = 0x16, .n_ch = 8,
-	  .mask = FL | FR | FC | FLC | FRC },
-	{ .ca_id = 0x17, .n_ch = 8,
-	  .mask = FL | FR | LFE | FC | FLC | FRC },
-	{ .ca_id = 0x18, .n_ch = 8,
-	  .mask = FL | FR | RC | FLC | FRC },
-	{ .ca_id = 0x19, .n_ch = 8,
-	  .mask = FL | FR | LFE | RC | FLC | FRC },
-	{ .ca_id = 0x1a, .n_ch = 8,
-	  .mask = FL | FR | RC | FC | FLC | FRC },
-	{ .ca_id = 0x1b, .n_ch = 8,
-	  .mask = FL | FR | LFE | RC | FC | FLC | FRC },
-	{ .ca_id = 0x1c, .n_ch = 8,
-	  .mask = FL | FR | RL | RR | FLC | FRC },
-	{ .ca_id = 0x1d, .n_ch = 8,
-	  .mask = FL | FR | LFE | RL | RR | FLC | FRC },
 	{ .ca_id = 0x1e, .n_ch = 8,
 	  .mask = FL | FR | FC | RL | RR | FLC | FRC },
-	{ .ca_id = 0x1f, .n_ch = 8,
-	  .mask = FL | FR | LFE | FC | RL | RR | FLC | FRC },
+	{ .ca_id = 0x11, .n_ch = 8,
+	  .mask = FL | FR | LFE | RL | RR | RLC | RRC },
+	{ .ca_id = 0x1d, .n_ch = 8,
+	  .mask = FL | FR | LFE | RL | RR | FLC | FRC },
+	{ .ca_id = 0x10, .n_ch = 8,
+	  .mask = FL | FR | RL | RR | RLC | RRC },
+	{ .ca_id = 0x1c, .n_ch = 8,
+	  .mask = FL | FR | RL | RR | FLC | FRC },
+	{ .ca_id = 0x0f, .n_ch = 8,
+	  .mask = FL | FR | LFE | FC | RL | RR | RC },
+	{ .ca_id = 0x1b, .n_ch = 8,
+	  .mask = FL | FR | LFE | RC | FC | FLC | FRC },
+	{ .ca_id = 0x0e, .n_ch = 8,
+	  .mask = FL | FR | FC | RL | RR | RC },
+	{ .ca_id = 0x1a, .n_ch = 8,
+	  .mask = FL | FR | RC | FC | FLC | FRC },
+	{ .ca_id = 0x0d, .n_ch = 8,
+	  .mask = FL | FR | LFE | RL | RR | RC },
+	{ .ca_id = 0x19, .n_ch = 8,
+	  .mask = FL | FR | LFE | RC | FLC | FRC },
+	{ .ca_id = 0x0c, .n_ch = 8,
+	  .mask = FL | FR | RC | RL | RR },
+	{ .ca_id = 0x18, .n_ch = 8,
+	  .mask = FL | FR | RC | FLC | FRC },
+	{ .ca_id = 0x17, .n_ch = 8,
+	  .mask = FL | FR | LFE | FC | FLC | FRC },
+	{ .ca_id = 0x16, .n_ch = 8,
+	  .mask = FL | FR | FC | FLC | FRC },
+	{ .ca_id = 0x15, .n_ch = 8,
+	  .mask = FL | FR | LFE | FLC | FRC },
+	{ .ca_id = 0x14, .n_ch = 8,
+	  .mask = FL | FR | FLC | FRC },
+	{ .ca_id = 0x0b, .n_ch = 8,
+	  .mask = FL | FR | LFE | FC | RL | RR },
+	{ .ca_id = 0x0a, .n_ch = 8,
+	  .mask = FL | FR | FC | RL | RR },
+	{ .ca_id = 0x09, .n_ch = 8,
+	  .mask = FL | FR | LFE | RL | RR },
+	{ .ca_id = 0x08, .n_ch = 8,
+	  .mask = FL | FR | RL | RR },
+	{ .ca_id = 0x07, .n_ch = 8,
+	  .mask = FL | FR | LFE | FC | RC },
+	{ .ca_id = 0x06, .n_ch = 8,
+	  .mask = FL | FR | FC | RC },
+	{ .ca_id = 0x05, .n_ch = 8,
+	  .mask = FL | FR | LFE | RC },
+	{ .ca_id = 0x04, .n_ch = 8,
+	  .mask = FL | FR | RC },
+	{ .ca_id = 0x03, .n_ch = 8,
+	  .mask = FL | FR | LFE | FC },
+	{ .ca_id = 0x02, .n_ch = 8,
+	  .mask = FL | FR | FC },
+	{ .ca_id = 0x01, .n_ch = 8,
+	  .mask = FL | FR | LFE },
 };
 
 struct hdmi_codec_priv {
@@ -371,7 +384,8 @@
 	struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
 	struct hdmi_codec_priv *hcp = info->private_data;
 
-	map = info->chmap[hcp->chmap_idx].map;
+	if (hcp->chmap_idx != HDMI_CODEC_CHMAP_IDX_UNKNOWN)
+		map = info->chmap[hcp->chmap_idx].map;
 
 	for (i = 0; i < info->max_channels; i++) {
 		if (hcp->chmap_idx == HDMI_CODEC_CHMAP_IDX_UNKNOWN)
--- linux-qcom-6.8.0.orig/sound/soc/codecs/lpass-macro-common.c
+++ linux-qcom-6.8.0/sound/soc/codecs/lpass-macro-common.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 // Copyright (c) 2022, The Linux Foundation. All rights reserved.
+// Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/export.h>
 #include <linux/module.h>
@@ -8,9 +9,83 @@
 #include <linux/platform_device.h>
 #include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
+#include <sound/control.h>
+#include <sound/pcm.h>
+#include <sound/soc.h>
+#include <sound/core.h>
+#include <sound/tlv.h>
 
 #include "lpass-macro-common.h"
 
+static bool lpi_state;
+
+bool lpass_macro_get_lpi_state(void)
+{
+	return lpi_state;
+}
+EXPORT_SYMBOL_GPL(lpass_macro_get_lpi_state);
+
+void lpass_macro_set_lpi_state(int status)
+{
+	if (status)
+		lpi_state = true;
+	else
+		lpi_state = false;
+}
+EXPORT_SYMBOL_GPL(lpass_macro_set_lpi_state);
+
+static int lpass_macro_chmap_ctl_get(struct snd_kcontrol *kcontrol,
+				     struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_dai *dai = info->private_data;
+	uint32_t *chmap_data = NULL;
+	uint32_t rx_ch_cnt = 0;
+	uint32_t tx_ch_cnt = 0;
+	uint32_t rx_ch, tx_ch;
+
+	chmap_data = kzalloc(sizeof(uint32_t) * 2, GFP_KERNEL);
+	if (!chmap_data)
+		return -ENOMEM;
+
+	snd_soc_dai_get_channel_map(dai, &tx_ch_cnt, &tx_ch, &rx_ch_cnt, &rx_ch);
+	if (rx_ch_cnt) {
+		chmap_data[0] = rx_ch_cnt;
+		chmap_data[1] = rx_ch;
+	} else if (tx_ch_cnt) {
+		chmap_data[0] = tx_ch_cnt;
+		chmap_data[1] = tx_ch;
+	}
+	memcpy(ucontrol->value.bytes.data, chmap_data, sizeof(uint32_t) * 2);
+
+	kfree(chmap_data);
+	return 0;
+}
+
+int lpass_macro_add_chmap_ctls(struct snd_soc_pcm_runtime *rtd,
+			       struct snd_soc_dai *dai, int dir)
+{
+	struct snd_pcm_chmap *info;
+	int ret;
+
+	info = kzalloc(sizeof(*info), GFP_KERNEL);
+	if (!info)
+		return -ENOMEM;
+
+	ret =  snd_pcm_add_chmap_ctls(rtd->pcm, dir, NULL,
+				      2 * sizeof(uint32_t), 0, &info);
+	if (ret < 0) {
+		kfree(info);
+		return ret;
+	}
+
+	/* override handlers */
+	info->private_data = dai;
+	info->kctl->get = lpass_macro_chmap_ctl_get;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(lpass_macro_add_chmap_ctls);
+
 struct lpass_macro *lpass_macro_pds_init(struct device *dev)
 {
 	struct lpass_macro *l_pds;
--- linux-qcom-6.8.0.orig/sound/soc/codecs/lpass-macro-common.h
+++ linux-qcom-6.8.0/sound/soc/codecs/lpass-macro-common.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
  * Copyright (c) 2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef __LPASS_MACRO_COMMON_H__
@@ -18,5 +19,8 @@
 
 struct lpass_macro *lpass_macro_pds_init(struct device *dev);
 void lpass_macro_pds_exit(struct lpass_macro *pds);
-
+int lpass_macro_add_chmap_ctls(struct snd_soc_pcm_runtime *rtd,
+				struct snd_soc_dai *dai, int dir);
+bool lpass_macro_get_lpi_state(void);
+void lpass_macro_set_lpi_state(int status);
 #endif /* __LPASS_MACRO_COMMON_H__ */
--- linux-qcom-6.8.0.orig/sound/soc/codecs/lpass-rx-macro.c
+++ linux-qcom-6.8.0/sound/soc/codecs/lpass-rx-macro.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 // Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+// Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/module.h>
 #include <linux/init.h>
@@ -14,6 +15,7 @@
 #include <sound/tlv.h>
 #include <linux/of_clk.h>
 #include <linux/clk-provider.h>
+#include <linux/soundwire/sdw.h>
 
 #include "lpass-macro-common.h"
 
@@ -367,6 +369,7 @@
 #define RX_MAX_OFFSET				(0x0F8C)
 
 #define MCLK_FREQ		19200000
+#define MCLK_NATIVE_FREQ		11289600
 
 #define RX_MACRO_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\
 			SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\
@@ -395,6 +398,11 @@
 #define COMP_MAX_COEFF 25
 #define RX_NUM_CLKS_MAX	5
 
+#define SAMPLING_RATE_44P1KHZ   44100
+#define SAMPLING_RATE_88P2KHZ   88200
+#define SAMPLING_RATE_176P4KHZ  176400
+#define SAMPLING_RATE_352P8KHZ  352800
+
 struct comp_coeff_val {
 	u8 lsb;
 	u8 msb;
@@ -599,6 +607,7 @@
 	int clsh_users;
 	int rx_mclk_cnt;
 	bool is_ear_mode_on;
+	bool is_native_on;
 	bool hph_pwr_mode;
 	bool hph_hd2_mode;
 	struct snd_soc_component *component;
@@ -610,11 +619,14 @@
 	int softclip_clk_users;
 	struct lpass_macro *pds;
 	struct regmap *regmap;
+	char __iomem *rx_clk_muxsel;
 	struct clk *mclk;
 	struct clk *npl;
 	struct clk *macro;
 	struct clk *dcodec;
 	struct clk *fsgen;
+	struct clk *rx_mclk;
+	struct clk *rx_npl;
 	struct clk_hw hw;
 };
 #define to_rx_macro(_hw) container_of(_hw, struct rx_macro, hw)
@@ -909,7 +921,7 @@
 	{ CDC_RX_BCL_VBAT_PK_EST2, 0x01 },
 	{ CDC_RX_BCL_VBAT_PK_EST3, 0x40 },
 	{ CDC_RX_BCL_VBAT_RF_PROC1, 0x2A },
-	{ CDC_RX_BCL_VBAT_RF_PROC1, 0x00 },
+	{ CDC_RX_BCL_VBAT_RF_PROC2, 0x00 },
 	{ CDC_RX_BCL_VBAT_TAC1, 0x00 },
 	{ CDC_RX_BCL_VBAT_TAC2, 0x18 },
 	{ CDC_RX_BCL_VBAT_TAC3, 0x18 },
@@ -1611,15 +1623,40 @@
 	return 0;
 }
 
+static bool rx_macro_is_fractional_sample_rate(u32 sample_rate)
+{
+	switch (sample_rate) {
+	case SAMPLING_RATE_44P1KHZ:
+	case SAMPLING_RATE_88P2KHZ:
+	case SAMPLING_RATE_176P4KHZ:
+	case SAMPLING_RATE_352P8KHZ:
+		return true;
+	default:
+		return false;
+	}
+	return false;
+}
+
 static int rx_macro_set_interpolator_rate(struct snd_soc_dai *dai,
 					  u32 sample_rate)
 {
 	int rate_val = 0;
 	int i, ret;
+	struct snd_soc_component *component = dai->component;
+	struct rx_macro *rx = snd_soc_component_get_drvdata(component);
 
-	for (i = 0; i < ARRAY_SIZE(sr_val_tbl); i++)
-		if (sample_rate == sr_val_tbl[i].sample_rate)
+	for (i = 0; i < ARRAY_SIZE(sr_val_tbl); i++) {
+		if (sample_rate == sr_val_tbl[i].sample_rate) {
 			rate_val = sr_val_tbl[i].rate_val;
+			if (rx_macro_is_fractional_sample_rate(sample_rate))
+				rx->is_native_on = true;
+			else
+				rx->is_native_on = false;
+			break;
+		}
+	}
+
+	sdw_native_notify(rx->is_native_on);
 
 	ret = rx_macro_set_prim_interpolator_rate(dai, rate_val, sample_rate);
 	if (ret)
@@ -1630,6 +1667,29 @@
 	return ret;
 }
 
+static int rx_macro_mclk_mode_mux_sel(struct rx_macro *rx, bool state)
+{
+	int muxsel = 0;
+
+	if (state) {
+		if (rx->is_native_on) {
+			clk_prepare_enable(rx->rx_mclk);
+			clk_prepare_enable(rx->rx_npl);
+			iowrite32(0x1, rx->rx_clk_muxsel);
+			muxsel = ioread32(rx->rx_clk_muxsel);
+		}
+	} else {
+		if (rx->is_native_on) {
+			iowrite32(0x0, rx->rx_clk_muxsel);
+			muxsel = ioread32(rx->rx_clk_muxsel);
+			clk_disable_unprepare(rx->rx_npl);
+			clk_disable_unprepare(rx->rx_mclk);
+			rx->is_native_on = false;
+		}
+	}
+	return 0;
+}
+
 static int rx_macro_hw_params(struct snd_pcm_substream *substream,
 			      struct snd_pcm_hw_params *params,
 			      struct snd_soc_dai *dai)
@@ -1772,10 +1832,22 @@
 	return 0;
 }
 
+static int rx_macro_pcm_new(struct snd_soc_pcm_runtime *rtd,
+			    struct snd_soc_dai *dai)
+{
+	int dir = SNDRV_PCM_STREAM_PLAYBACK;
+
+	if (dai->id == RX_MACRO_AIF_ECHO)
+		dir = SNDRV_PCM_STREAM_CAPTURE;
+
+	return lpass_macro_add_chmap_ctls(rtd, dai, dir);
+}
+
 static const struct snd_soc_dai_ops rx_macro_dai_ops = {
 	.hw_params = rx_macro_hw_params,
 	.get_channel_map = rx_macro_get_channel_map,
 	.mute_stream = rx_macro_digital_mute,
+	.pcm_new = rx_macro_pcm_new,
 };
 
 static struct snd_soc_dai_driver rx_macro_dai[] = {
@@ -1900,10 +1972,12 @@
 
 	switch (event) {
 	case SND_SOC_DAPM_PRE_PMU:
+		rx_macro_mclk_mode_mux_sel(rx, true);
 		rx_macro_mclk_enable(rx, true);
 		break;
 	case SND_SOC_DAPM_POST_PMD:
 		rx_macro_mclk_enable(rx, false);
+		rx_macro_mclk_mode_mux_sel(rx, false);
 		break;
 	default:
 		dev_err(component->dev, "%s: invalid DAPM event %d\n", __func__, event);
@@ -3527,6 +3601,7 @@
 	kernel_ulong_t flags;
 	struct rx_macro *rx;
 	void __iomem *base;
+	int muxsel = 0;
 	int ret;
 
 	flags = (kernel_ulong_t)device_get_match_data(dev);
@@ -3553,10 +3628,27 @@
 			return dev_err_probe(dev, PTR_ERR(rx->npl), "unable to get npl clock\n");
 	}
 
+	rx->rx_mclk = devm_clk_get(dev, "rx-mclk");
+	if (IS_ERR(rx->rx_mclk))
+		dev_info(dev, "unable to get rx mclk\n");
+
+	rx->rx_npl = devm_clk_get(dev, "rx-npl");
+	if (IS_ERR(rx->rx_npl))
+		dev_info(dev, "unable to get rx npl\n");
+
 	rx->fsgen = devm_clk_get(dev, "fsgen");
 	if (IS_ERR(rx->fsgen))
 		return dev_err_probe(dev, PTR_ERR(rx->fsgen), "unable to get fsgen clock\n");
 
+	ret = of_property_read_u32(dev->of_node, "qcom,rx_mclk_mode_muxsel", &muxsel);
+	if (ret) {
+		dev_info(dev, "Could not find qcom,rx_mclk_mode_muxsel entry\n");
+	} else {
+		rx->rx_clk_muxsel = devm_ioremap(dev, muxsel, 0x4);
+		if (!rx->rx_clk_muxsel)
+			dev_err(dev, "rx mux io remap failed\n");
+	}
+
 	rx->pds = lpass_macro_pds_init(dev);
 	if (IS_ERR(rx->pds))
 		return PTR_ERR(rx->pds);
@@ -3581,6 +3673,9 @@
 	clk_set_rate(rx->mclk, MCLK_FREQ);
 	clk_set_rate(rx->npl, MCLK_FREQ);
 
+	clk_set_rate(rx->rx_mclk, 2 * MCLK_NATIVE_FREQ);
+	clk_set_rate(rx->rx_npl, 2 * MCLK_NATIVE_FREQ);
+
 	ret = clk_prepare_enable(rx->macro);
 	if (ret)
 		goto err;
@@ -3688,6 +3783,8 @@
 	regcache_cache_only(rx->regmap, true);
 	regcache_mark_dirty(rx->regmap);
 
+	clk_disable_unprepare(rx->macro);
+	clk_disable_unprepare(rx->dcodec);
 	clk_disable_unprepare(rx->fsgen);
 	clk_disable_unprepare(rx->npl);
 	clk_disable_unprepare(rx->mclk);
@@ -3700,6 +3797,18 @@
 	struct rx_macro *rx = dev_get_drvdata(dev);
 	int ret;
 
+	ret = clk_prepare_enable(rx->macro);
+	if (ret) {
+		dev_err(dev, "unable to prepare macro\n");
+		return ret;
+	}
+
+	ret = clk_prepare_enable(rx->dcodec);
+	if (ret) {
+		dev_err(dev, "unable to prepare dcodec\n");
+		return ret;
+	}
+
 	ret = clk_prepare_enable(rx->mclk);
 	if (ret) {
 		dev_err(dev, "unable to prepare mclk\n");
--- linux-qcom-6.8.0.orig/sound/soc/codecs/lpass-tx-macro.c
+++ linux-qcom-6.8.0/sound/soc/codecs/lpass-tx-macro.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 // Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+// Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/module.h>
 #include <linux/init.h>
@@ -1154,10 +1155,19 @@
 	return 0;
 }
 
+static int tx_macro_pcm_new(struct snd_soc_pcm_runtime *rtd,
+			    struct snd_soc_dai *dai)
+{
+	int dir = SNDRV_PCM_STREAM_CAPTURE;
+
+	return lpass_macro_add_chmap_ctls(rtd, dai, dir);
+}
+
 static const struct snd_soc_dai_ops tx_macro_dai_ops = {
 	.hw_params = tx_macro_hw_params,
 	.get_channel_map = tx_macro_get_channel_map,
 	.mute_stream = tx_macro_digital_mute,
+	.pcm_new = tx_macro_pcm_new,
 };
 
 static struct snd_soc_dai_driver tx_macro_dai[] = {
@@ -1843,6 +1853,10 @@
 		INIT_DELAYED_WORK(&tx->tx_mute_dwork[i].dwork,
 			  tx_macro_mute_update_callback);
 	}
+
+	for (i = 0; i < TX_MACRO_MAX_DAIS; i++)
+		tx->active_decimator[i] = -1;
+
 	tx->component = comp;
 
 	snd_soc_component_update_bits(comp, CDC_TX0_TX_PATH_SEC7, 0x3F,
@@ -2118,6 +2132,8 @@
 	regcache_cache_only(tx->regmap, true);
 	regcache_mark_dirty(tx->regmap);
 
+	clk_disable_unprepare(tx->macro);
+	clk_disable_unprepare(tx->dcodec);
 	clk_disable_unprepare(tx->fsgen);
 	clk_disable_unprepare(tx->npl);
 	clk_disable_unprepare(tx->mclk);
@@ -2130,6 +2146,18 @@
 	struct tx_macro *tx = dev_get_drvdata(dev);
 	int ret;
 
+	ret = clk_prepare_enable(tx->macro);
+	if (ret) {
+		dev_err(dev, "unable to prepare macro\n");
+		return ret;
+	}
+
+	ret = clk_prepare_enable(tx->dcodec);
+	if (ret) {
+		dev_err(dev, "unable to prepare dcodec\n");
+		return ret;
+	}
+
 	ret = clk_prepare_enable(tx->mclk);
 	if (ret) {
 		dev_err(dev, "unable to prepare mclk\n");
--- linux-qcom-6.8.0.orig/sound/soc/codecs/lpass-va-macro.c
+++ linux-qcom-6.8.0/sound/soc/codecs/lpass-va-macro.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 // Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+// Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/clk.h>
 #include <linux/clk-provider.h>
@@ -162,6 +163,8 @@
 #define VA_MACRO_SWR_MIC_MUX_SEL_MASK 0xF
 #define VA_MACRO_ADC_MUX_CFG_OFFSET 0x8
 
+#define VA_MACRO_VA_DMIC_UNMUTE_DELAY_MS	40
+
 static const DECLARE_TLV_DB_SCALE(digital_gain, -8400, 100, -8400);
 
 enum {
@@ -195,13 +198,21 @@
 
 #define VA_NUM_CLKS_MAX		3
 
+struct va_mute_work {
+	struct va_macro *va;
+	u8 decimator;
+	struct delayed_work dwork;
+};
+
 struct va_macro {
 	struct device *dev;
+	struct snd_soc_component *component;
 	unsigned long active_ch_mask[VA_MACRO_MAX_DAIS];
 	unsigned long active_ch_cnt[VA_MACRO_MAX_DAIS];
 	u16 dmic_clk_div;
 	bool has_swr_master;
 
+	struct va_mute_work va_mute_dwork[VA_MACRO_NUM_DECIMATORS];
 	int dec_mode[VA_MACRO_NUM_DECIMATORS];
 	struct regmap *regmap;
 	struct clk *mclk;
@@ -219,6 +230,8 @@
 	u8 dmic_2_3_clk_div;
 	u8 dmic_4_5_clk_div;
 	u8 dmic_6_7_clk_div;
+	bool is_lpi_on;
+	int lpi_clk_en;
 };
 
 #define to_va_macro(_hw) container_of(_hw, struct va_macro, hw)
@@ -591,6 +604,32 @@
 	return 0;
 }
 
+static void va_macro_mute_update_callback(struct work_struct *work)
+{
+	struct va_mute_work *va_mute_dwork;
+	struct snd_soc_component *component;
+	struct va_macro *va;
+	struct delayed_work *delayed_work;
+	u8 decimator;
+	u16 tx_vol_ctl_reg;
+
+	delayed_work = to_delayed_work(work);
+	va_mute_dwork = container_of(delayed_work, struct va_mute_work, dwork);
+	va = va_mute_dwork->va;
+	component = va->component;
+	decimator = va_mute_dwork->decimator;
+
+	dev_info(va->dev, "%s: unmute VA DMIC\n", __func__);
+
+	tx_vol_ctl_reg = CDC_VA_TX0_TX_PATH_CTL +
+					VA_MACRO_TX_PATH_OFFSET * decimator;
+
+	snd_soc_component_update_bits(component, tx_vol_ctl_reg,
+				      CDC_VA_TX_PATH_PGA_MUTE_EN_MASK,
+				      CDC_VA_TX_PATH_PGA_MUTE_DISABLE);
+	usleep_range(2000, 2010);
+}
+
 static int va_dmic_clk_enable(struct snd_soc_component *component,
 			      u32 dmic, bool enable)
 {
@@ -706,11 +745,23 @@
 				struct snd_kcontrol *kcontrol, int event)
 {
 	struct snd_soc_component *comp = snd_soc_dapm_to_component(w->dapm);
+	struct va_macro *va = snd_soc_component_get_drvdata(comp);
 	unsigned int dmic = w->shift;
 
 	switch (event) {
 	case SND_SOC_DAPM_PRE_PMU:
 		va_dmic_clk_enable(comp, dmic, true);
+
+		va->is_lpi_on = lpass_macro_get_lpi_state();
+		/*
+		 * Unvote the HW dcodec and macro clks to set
+		 * the device in LPI mode.
+		 */
+		if ((va->is_lpi_on) && (!va->lpi_clk_en)) {
+			clk_disable_unprepare(va->dcodec);
+			clk_disable_unprepare(va->macro);
+			va->lpi_clk_en++;
+		}
 		break;
 	case SND_SOC_DAPM_POST_PMD:
 		va_dmic_clk_enable(comp, dmic, false);
@@ -794,8 +845,14 @@
 		/* apply gain after decimator is enabled */
 		snd_soc_component_write(comp, tx_gain_ctl_reg,
 			snd_soc_component_read(comp, tx_gain_ctl_reg));
+
+		/* schedule work queue to Remove Mute */
+		queue_delayed_work(system_freezable_wq,
+				   &va->va_mute_dwork[decimator].dwork,
+				   msecs_to_jiffies(VA_MACRO_VA_DMIC_UNMUTE_DELAY_MS));
 		break;
 	case SND_SOC_DAPM_POST_PMD:
+		cancel_delayed_work_sync(&va->va_mute_dwork[decimator].dwork);
 		/* Disable TX CLK */
 		snd_soc_component_update_bits(comp, tx_vol_ctl_reg,
 						CDC_VA_TX_PATH_CLK_EN_MASK,
@@ -832,6 +889,25 @@
 	return 0;
 }
 
+static int va_macro_get_lpi_state(struct snd_kcontrol *kcontrol,
+				  struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+
+	ucontrol->value.integer.value[0] = lpass_macro_get_lpi_state();
+	return 0;
+}
+
+static int va_macro_set_lpi_state(struct snd_kcontrol *kcontrol,
+				  struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+	int value = ucontrol->value.integer.value[0];
+
+	lpass_macro_set_lpi_state(value);
+	return 0;
+}
+
 static int va_macro_hw_params(struct snd_pcm_substream *substream,
 			      struct snd_pcm_hw_params *params,
 			      struct snd_soc_dai *dai)
@@ -914,23 +990,29 @@
 			 VA_MACRO_DEC_MAX) {
 		tx_vol_ctl_reg = CDC_VA_TX0_TX_PATH_CTL +
 					VA_MACRO_TX_PATH_OFFSET * decimator;
-		if (mute)
+		if (mute) {
 			snd_soc_component_update_bits(component, tx_vol_ctl_reg,
 					CDC_VA_TX_PATH_PGA_MUTE_EN_MASK,
 					CDC_VA_TX_PATH_PGA_MUTE_EN);
-		else
-			snd_soc_component_update_bits(component, tx_vol_ctl_reg,
-					CDC_VA_TX_PATH_PGA_MUTE_EN_MASK,
-					CDC_VA_TX_PATH_PGA_MUTE_DISABLE);
+		}
 	}
 
 	return 0;
 }
 
+static int va_macro_pcm_new(struct snd_soc_pcm_runtime *rtd,
+			    struct snd_soc_dai *dai)
+{
+	int dir = SNDRV_PCM_STREAM_CAPTURE;
+
+	return lpass_macro_add_chmap_ctls(rtd, dai, dir);
+}
+
 static const struct snd_soc_dai_ops va_macro_dai_ops = {
 	.hw_params = va_macro_hw_params,
 	.get_channel_map = va_macro_get_channel_map,
 	.mute_stream = va_macro_digital_mute,
+	.pcm_new = va_macro_pcm_new,
 };
 
 static struct snd_soc_dai_driver va_macro_dais[] = {
@@ -1304,14 +1386,26 @@
 		     va_macro_dec_mode_get, va_macro_dec_mode_put),
 	SOC_ENUM_EXT("VA_DEC3 MODE", dec_mode_mux_enum[3],
 		     va_macro_dec_mode_get, va_macro_dec_mode_put),
+
+	SOC_SINGLE_EXT("LPI Enable", SND_SOC_NOPM, 0, 1, 0,
+		       va_macro_get_lpi_state, va_macro_set_lpi_state),
 };
 
 static int va_macro_component_probe(struct snd_soc_component *component)
 {
 	struct va_macro *va = snd_soc_component_get_drvdata(component);
+	int i;
 
 	snd_soc_component_init_regmap(component, va->regmap);
 
+	for (i = 0; i < VA_MACRO_NUM_DECIMATORS; i++) {
+		va->va_mute_dwork[i].va = va;
+		va->va_mute_dwork[i].decimator = i;
+		INIT_DELAYED_WORK(&va->va_mute_dwork[i].dwork,
+				  va_macro_mute_update_callback);
+	}
+
+	va->component = component;
 	return 0;
 }
 
@@ -1474,7 +1568,7 @@
 	ret = of_property_read_u32(dev->of_node, "qcom,dmic-sample-rate",
 				   &sample_rate);
 	if (ret) {
-		dev_err(dev, "qcom,dmic-sample-rate dt entry missing\n");
+		dev_info(dev, "qcom,dmic-sample-rate dt entry missing\n");
 		va->dmic_clk_div = VA_MACRO_CLK_DIV_2;
 	} else {
 		ret = va_macro_validate_dmic_sample_rate(sample_rate, va);
@@ -1595,6 +1689,17 @@
 
 	clk_disable_unprepare(va->mclk);
 
+	/*
+	 * Skip the unvoting of HW dcodec and macro
+	 * if it's already disabled during LPI mode.
+	 */
+	if (!va->lpi_clk_en) {
+		clk_disable_unprepare(va->dcodec);
+		clk_disable_unprepare(va->macro);
+	} else {
+		va->lpi_clk_en = 0;
+	}
+
 	return 0;
 }
 
@@ -1603,6 +1708,18 @@
 	struct va_macro *va = dev_get_drvdata(dev);
 	int ret;
 
+	ret = clk_prepare_enable(va->dcodec);
+	if (ret) {
+		dev_err(dev, "unable to prepare dcodec\n");
+		return ret;
+	}
+
+	ret = clk_prepare_enable(va->macro);
+	if (ret) {
+		dev_err(dev, "unable to prepare macro\n");
+		return ret;
+	}
+
 	ret = clk_prepare_enable(va->mclk);
 	if (ret) {
 		dev_err(va->dev, "unable to prepare mclk\n");
--- linux-qcom-6.8.0.orig/sound/soc/codecs/lpass-wsa-macro.c
+++ linux-qcom-6.8.0/sound/soc/codecs/lpass-wsa-macro.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 // Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+// Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/module.h>
 #include <linux/init.h>
@@ -19,6 +20,9 @@
 #include "lpass-wsa-macro.h"
 
 #define CDC_WSA_CLK_RST_CTRL_MCLK_CONTROL	(0x0000)
+#define LPASS_WSA_WSA_TOP_FS_UNGATE		(0x00AC)
+#define LPASS_WSA_WSA_TOP_FS_UNGATE2		(0x00DC)
+#define LPASS_CDC_WSA_TOP_GRP_SEL		(0x00B0)
 #define CDC_WSA_MCLK_EN_MASK			BIT(0)
 #define CDC_WSA_MCLK_ENABLE			BIT(0)
 #define CDC_WSA_MCLK_DISABLE			0
@@ -347,6 +351,7 @@
 	int ear_spkr_gain;
 	int spkr_gain_offset;
 	int spkr_mode;
+	u32 pcm_rate_vi;
 	int is_softclip_on[WSA_MACRO_SOFTCLIP_MAX];
 	int softclip_clk_users[WSA_MACRO_SOFTCLIP_MAX];
 	struct regmap *regmap;
@@ -472,8 +477,11 @@
 	{ CDC_WSA_CLK_RST_CTRL_MCLK_CONTROL, 0x00},
 	{ CDC_WSA_CLK_RST_CTRL_FS_CNT_CONTROL, 0x00},
 	{ CDC_WSA_CLK_RST_CTRL_SWR_CONTROL, 0x00},
+	{ LPASS_WSA_WSA_TOP_FS_UNGATE, 0xff},
+	{ LPASS_WSA_WSA_TOP_FS_UNGATE2, 0x1f},
+	{ LPASS_CDC_WSA_TOP_GRP_SEL, 0x08},
 	{ CDC_WSA_TOP_TOP_CFG0, 0x00},
-	{ CDC_WSA_TOP_TOP_CFG1, 0x00},
+	{ CDC_WSA_TOP_TOP_CFG1, 0x03},
 	{ CDC_WSA_TOP_FREQ_MCLK, 0x00},
 	{ CDC_WSA_TOP_DEBUG_BUS_SEL, 0x00},
 	{ CDC_WSA_TOP_DEBUG_EN0, 0x00},
@@ -491,13 +499,13 @@
 	{ CDC_WSA_RX_INP_MUX_RX_EC_CFG0, 0x00},
 	{ CDC_WSA_RX_INP_MUX_SOFTCLIP_CFG0, 0x00},
 	{ CDC_WSA_TX0_SPKR_PROT_PATH_CTL, 0x02},
-	{ CDC_WSA_TX0_SPKR_PROT_PATH_CFG0, 0x00},
+	{ CDC_WSA_TX0_SPKR_PROT_PATH_CFG0, 0x01},
 	{ CDC_WSA_TX1_SPKR_PROT_PATH_CTL, 0x02},
-	{ CDC_WSA_TX1_SPKR_PROT_PATH_CFG0, 0x00},
+	{ CDC_WSA_TX1_SPKR_PROT_PATH_CFG0, 0x01},
 	{ CDC_WSA_TX2_SPKR_PROT_PATH_CTL, 0x02},
-	{ CDC_WSA_TX2_SPKR_PROT_PATH_CFG0, 0x00},
+	{ CDC_WSA_TX2_SPKR_PROT_PATH_CFG0, 0x01},
 	{ CDC_WSA_TX3_SPKR_PROT_PATH_CTL, 0x02},
-	{ CDC_WSA_TX3_SPKR_PROT_PATH_CFG0, 0x00},
+	{ CDC_WSA_TX3_SPKR_PROT_PATH_CFG0, 0x01},
 	{ CDC_WSA_INTR_CTRL_CFG, 0x00},
 	{ CDC_WSA_INTR_CTRL_CLR_COMMIT, 0x00},
 	{ CDC_WSA_INTR_CTRL_PIN1_MASK0, 0xFF},
@@ -842,6 +850,32 @@
 }
 EXPORT_SYMBOL(wsa_macro_set_spkr_mode);
 
+void wsa_init_reg(struct snd_soc_component *comp)
+{
+	snd_soc_component_update_bits(comp, CDC_WSA_BOOST0_BOOST_CFG1, 0x3F, 0x12);
+	snd_soc_component_update_bits(comp, CDC_WSA_BOOST0_BOOST_CFG2, 0x1C, 0x08);
+	snd_soc_component_update_bits(comp, CDC_WSA_COMPANDER0_CTL7, 0x1E, 0x18);
+	snd_soc_component_update_bits(comp, CDC_WSA_BOOST1_BOOST_CFG1, 0x3F, 0x12);
+	snd_soc_component_update_bits(comp, CDC_WSA_BOOST1_BOOST_CFG2, 0x1C, 0x08);
+	snd_soc_component_update_bits(comp, CDC_WSA_COMPANDER1_CTL7, 0x1E, 0x18);
+	snd_soc_component_update_bits(comp, CDC_WSA_BOOST0_BOOST_CTL, 0x70, 0x58);
+	snd_soc_component_update_bits(comp, CDC_WSA_BOOST1_BOOST_CTL, 0x70, 0x58);
+	snd_soc_component_update_bits(comp, CDC_WSA_RX0_RX_PATH_CFG1, 0x08, 0x08);
+	snd_soc_component_update_bits(comp, CDC_WSA_RX1_RX_PATH_CFG1, 0x08, 0x08);
+	snd_soc_component_update_bits(comp, CDC_WSA_TOP_TOP_CFG1, 0x02, 0x02);
+	snd_soc_component_update_bits(comp, CDC_WSA_TOP_TOP_CFG1, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_TX0_SPKR_PROT_PATH_CFG0, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_TX1_SPKR_PROT_PATH_CFG0, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_TX2_SPKR_PROT_PATH_CFG0, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_TX3_SPKR_PROT_PATH_CFG0, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_COMPANDER0_CTL7, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_COMPANDER1_CTL7, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_RX0_RX_PATH_CFG0, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_RX1_RX_PATH_CFG0, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_RX0_RX_PATH_MIX_CFG, 0x01, 0x01);
+	snd_soc_component_update_bits(comp, CDC_WSA_RX1_RX_PATH_MIX_CFG, 0x01, 0x01);
+}
+
 static int wsa_macro_set_prim_interpolator_rate(struct snd_soc_dai *dai,
 						u8 int_prim_fs_rate_reg_val,
 						u32 sample_rate)
@@ -974,6 +1008,7 @@
 			       struct snd_soc_dai *dai)
 {
 	struct snd_soc_component *component = dai->component;
+	struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
 	int ret;
 
 	switch (substream->stream) {
@@ -986,6 +1021,10 @@
 			return ret;
 		}
 		break;
+	case SNDRV_PCM_STREAM_CAPTURE:
+		if (dai->id == WSA_MACRO_AIF_VI)
+			wsa->pcm_rate_vi = params_rate(params);
+
 	default:
 		break;
 	}
@@ -1038,9 +1077,21 @@
 	return 0;
 }
 
+static int wsa_macro_pcm_new(struct snd_soc_pcm_runtime *rtd,
+			     struct snd_soc_dai *dai)
+{
+	int dir = SNDRV_PCM_STREAM_PLAYBACK;
+
+	if (dai->id == WSA_MACRO_AIF_VI || dai->id == WSA_MACRO_AIF_ECHO)
+		dir = SNDRV_PCM_STREAM_CAPTURE;
+
+	return lpass_macro_add_chmap_ctls(rtd, dai, dir);
+}
+
 static const struct snd_soc_dai_ops wsa_macro_dai_ops = {
 	.hw_params = wsa_macro_hw_params,
 	.get_channel_map = wsa_macro_get_channel_map,
+	.pcm_new = wsa_macro_pcm_new,
 };
 
 static struct snd_soc_dai_driver wsa_macro_dai[] = {
@@ -1152,25 +1203,11 @@
 	return 0;
 }
 
-static int wsa_macro_enable_vi_feedback(struct snd_soc_dapm_widget *w,
-					struct snd_kcontrol *kcontrol,
-					int event)
+static void wsa_macro_enable_disable_vi_sense(struct snd_soc_component *component, bool enable,
+						u32 tx_reg0, u32 tx_reg1, u32 val)
 {
-	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
-	struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
-	u32 tx_reg0, tx_reg1;
-
-	if (test_bit(WSA_MACRO_TX0, &wsa->active_ch_mask[WSA_MACRO_AIF_VI])) {
-		tx_reg0 = CDC_WSA_TX0_SPKR_PROT_PATH_CTL;
-		tx_reg1 = CDC_WSA_TX1_SPKR_PROT_PATH_CTL;
-	} else if (test_bit(WSA_MACRO_TX1, &wsa->active_ch_mask[WSA_MACRO_AIF_VI])) {
-		tx_reg0 = CDC_WSA_TX2_SPKR_PROT_PATH_CTL;
-		tx_reg1 = CDC_WSA_TX3_SPKR_PROT_PATH_CTL;
-	}
-
-	switch (event) {
-	case SND_SOC_DAPM_POST_PMU:
-			/* Enable V&I sensing */
+	if (enable) {
+		/* Enable V&I sensing */
 		snd_soc_component_update_bits(component, tx_reg0,
 					      CDC_WSA_TX_SPKR_PROT_RESET_MASK,
 					      CDC_WSA_TX_SPKR_PROT_RESET);
@@ -1179,10 +1216,10 @@
 					      CDC_WSA_TX_SPKR_PROT_RESET);
 		snd_soc_component_update_bits(component, tx_reg0,
 					      CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK,
-					      CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K);
+					      val);
 		snd_soc_component_update_bits(component, tx_reg1,
 					      CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK,
-					      CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K);
+					      val);
 		snd_soc_component_update_bits(component, tx_reg0,
 					      CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK,
 					      CDC_WSA_TX_SPKR_PROT_CLK_ENABLE);
@@ -1195,9 +1232,7 @@
 		snd_soc_component_update_bits(component, tx_reg1,
 					      CDC_WSA_TX_SPKR_PROT_RESET_MASK,
 					      CDC_WSA_TX_SPKR_PROT_NO_RESET);
-		break;
-	case SND_SOC_DAPM_POST_PMD:
-		/* Disable V&I sensing */
+	} else {
 		snd_soc_component_update_bits(component, tx_reg0,
 					      CDC_WSA_TX_SPKR_PROT_RESET_MASK,
 					      CDC_WSA_TX_SPKR_PROT_RESET);
@@ -1210,6 +1245,61 @@
 		snd_soc_component_update_bits(component, tx_reg1,
 					      CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK,
 					      CDC_WSA_TX_SPKR_PROT_CLK_DISABLE);
+	}
+}
+
+static void wsa_macro_enable_disable_vi_feedback(struct snd_soc_component *component,
+						 bool enable, u32 rate)
+{
+	struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
+	u32 tx_reg0, tx_reg1;
+
+	if (test_bit(WSA_MACRO_TX0, &wsa->active_ch_mask[WSA_MACRO_AIF_VI])) {
+		tx_reg0 = CDC_WSA_TX0_SPKR_PROT_PATH_CTL;
+		tx_reg1 = CDC_WSA_TX1_SPKR_PROT_PATH_CTL;
+		wsa_macro_enable_disable_vi_sense(component, enable, tx_reg0, tx_reg1, rate);
+	}
+
+	if (test_bit(WSA_MACRO_TX1, &wsa->active_ch_mask[WSA_MACRO_AIF_VI])) {
+		tx_reg0 = CDC_WSA_TX2_SPKR_PROT_PATH_CTL;
+		tx_reg1 = CDC_WSA_TX3_SPKR_PROT_PATH_CTL;
+		wsa_macro_enable_disable_vi_sense(component, enable, tx_reg0, tx_reg1, rate);
+
+	}
+
+}
+
+static int wsa_macro_enable_vi_feedback(struct snd_soc_dapm_widget *w,
+					struct snd_kcontrol *kcontrol,
+					int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
+	u32 rate_val;
+
+	switch (wsa->pcm_rate_vi) {
+	case 48000:
+		rate_val = 0x04;
+		break;
+	case 24000:
+		rate_val = 0x02;
+		break;
+	case 8000:
+		rate_val = 0x00;
+		break;
+	default:
+		rate_val = 0x00;
+		break;
+	}
+
+	switch (event) {
+	case SND_SOC_DAPM_POST_PMU:
+		/* Enable V&I sensing */
+		wsa_macro_enable_disable_vi_feedback(component, true, rate_val);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		/* Disable V&I sensing */
+		wsa_macro_enable_disable_vi_feedback(component, false, rate_val);
 		break;
 	}
 
@@ -2297,6 +2387,7 @@
 				CDC_WSA_RX_PATH_SPKR_RATE_MASK,
 				CDC_WSA_RX_PATH_SPKR_RATE_FS_2P4_3P072);
 
+	wsa_init_reg(comp);
 	wsa_macro_set_spkr_mode(comp, WSA_MACRO_SPKR_MODE_1);
 
 	return 0;
@@ -2510,6 +2601,8 @@
 	regcache_cache_only(wsa->regmap, true);
 	regcache_mark_dirty(wsa->regmap);
 
+	clk_disable_unprepare(wsa->macro);
+	clk_disable_unprepare(wsa->dcodec);
 	clk_disable_unprepare(wsa->fsgen);
 	clk_disable_unprepare(wsa->npl);
 	clk_disable_unprepare(wsa->mclk);
@@ -2522,6 +2615,18 @@
 	struct wsa_macro *wsa = dev_get_drvdata(dev);
 	int ret;
 
+	ret = clk_prepare_enable(wsa->macro);
+	if (ret) {
+		dev_err(dev, "unable to prepare macro\n");
+		return ret;
+	}
+
+	ret = clk_prepare_enable(wsa->dcodec);
+	if (ret) {
+		dev_err(dev, "unable to prepare dcodec\n");
+		return ret;
+	}
+
 	ret = clk_prepare_enable(wsa->mclk);
 	if (ret) {
 		dev_err(dev, "unable to prepare mclk\n");
--- linux-qcom-6.8.0.orig/sound/soc/codecs/max9768.c
+++ linux-qcom-6.8.0/sound/soc/codecs/max9768.c
@@ -54,10 +54,17 @@
 {
 	struct snd_soc_component *c = snd_soc_kcontrol_component(kcontrol);
 	struct max9768 *max9768 = snd_soc_component_get_drvdata(c);
+	bool val = !ucontrol->value.integer.value[0];
+	int ret;
 
-	gpiod_set_value_cansleep(max9768->mute, !ucontrol->value.integer.value[0]);
+	if (val != gpiod_get_value_cansleep(max9768->mute))
+		ret = 1;
+	else
+		ret = 0;
 
-	return 0;
+	gpiod_set_value_cansleep(max9768->mute, val);
+
+	return ret;
 }
 
 static const DECLARE_TLV_DB_RANGE(volume_tlv,
--- linux-qcom-6.8.0.orig/sound/soc/codecs/max98088.c
+++ linux-qcom-6.8.0/sound/soc/codecs/max98088.c
@@ -1318,6 +1318,7 @@
                                   enum snd_soc_bias_level level)
 {
 	struct max98088_priv *max98088 = snd_soc_component_get_drvdata(component);
+	int ret;
 
 	switch (level) {
 	case SND_SOC_BIAS_ON:
@@ -1333,10 +1334,13 @@
 		 */
 		if (!IS_ERR(max98088->mclk)) {
 			if (snd_soc_component_get_bias_level(component) ==
-			    SND_SOC_BIAS_ON)
+			    SND_SOC_BIAS_ON) {
 				clk_disable_unprepare(max98088->mclk);
-			else
-				clk_prepare_enable(max98088->mclk);
+			} else {
+				ret = clk_prepare_enable(max98088->mclk);
+				if (ret)
+					return ret;
+			}
 		}
 		break;
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/max98388.c
+++ linux-qcom-6.8.0/sound/soc/codecs/max98388.c
@@ -763,6 +763,7 @@
 			addr = MAX98388_R2044_PCM_TX_CTRL1 + (cnt / 8);
 			bits = cnt % 8;
 			regmap_update_bits(max98388->regmap, addr, bits, bits);
+			slot_found++;
 			if (slot_found >= MAX_NUM_CH)
 				break;
 		}
--- linux-qcom-6.8.0.orig/sound/soc/codecs/msm-stub.c
+++ linux-qcom-6.8.0/sound/soc/codecs/msm-stub.c
@@ -0,0 +1,189 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <sound/pcm.h>
+#include <sound/soc.h>
+
+#define DRV_NAME "msm-stub-codec"
+
+static const struct snd_soc_dapm_widget msm_stub_dapm_widgets[] = {
+	SND_SOC_DAPM_OUTPUT("STUB_AIF0_RX"),
+	SND_SOC_DAPM_INPUT("STUB_AIF0_TX"),
+	SND_SOC_DAPM_OUTPUT("STUB_AIF1_RX"),
+	SND_SOC_DAPM_INPUT("STUB_AIF1_TX"),
+	SND_SOC_DAPM_OUTPUT("STUB_AIF2_RX"),
+	SND_SOC_DAPM_INPUT("STUB_AIF2_TX"),
+	SND_SOC_DAPM_OUTPUT("STUB_AIF3_RX"),
+	SND_SOC_DAPM_INPUT("STUB_AIF3_TX"),
+};
+
+static const struct snd_soc_dapm_route msm_stub_dapm_routes[] = {
+	{"STUB_AIF0_RX", NULL, "STUB_AIF0_RX Playback"},
+	{"STUB_AIF0_TX Capture", NULL, "STUB_AIF0_TX"},
+	{"STUB_AIF1_RX", NULL, "STUB_AIF1_RX Playback"},
+	{"STUB_AIF1_TX Capture", NULL, "STUB_AIF1_TX"},
+	{"STUB_AIF2_RX", NULL, "STUB_AIF2_RX Playback"},
+	{"STUB_AIF2_TX Capture", NULL, "STUB_AIF2_TX"},
+	{"STUB_AIF3_RX", NULL, "STUB_AIF3_RX Playback"},
+	{"STUB_AIF3_TX Capture", NULL, "STUB_AIF3_TX"},
+};
+
+static struct snd_soc_dai_driver msm_stub_dais[] = {
+	{
+		.name = "msm-stub-aif0-rx",
+		.playback = {
+			.stream_name = "STUB_AIF0_RX Playback",
+			.channels_min = 1,
+			.channels_max = 16,
+			.rates = SNDRV_PCM_RATE_8000_384000,
+			.formats = (SNDRV_PCM_FMTBIT_S16_LE |
+				    SNDRV_PCM_FMTBIT_S24_LE |
+				    SNDRV_PCM_FMTBIT_S24_3LE |
+				    SNDRV_PCM_FMTBIT_S32_LE),
+			.rate_min = 8000,
+			.rate_max = 384000,
+		},
+	},
+	{
+		.name = "msm-stub-aif0-tx",
+		.capture = {
+			.stream_name = "STUB_AIF0_TX Capture",
+			.channels_min = 1,
+			.channels_max = 16,
+			.rates = SNDRV_PCM_RATE_8000_384000,
+			.formats = (SNDRV_PCM_FMTBIT_S16_LE |
+				    SNDRV_PCM_FMTBIT_S24_LE |
+				    SNDRV_PCM_FMTBIT_S24_3LE |
+				    SNDRV_PCM_FMTBIT_S32_LE),
+			.rate_min = 8000,
+			.rate_max = 384000,
+		},
+	},
+	{
+		.name = "msm-stub-aif1-rx",
+		.playback = {
+			.stream_name = "STUB_AIF1_RX Playback",
+			.channels_min = 1,
+			.channels_max = 16,
+			.rates = SNDRV_PCM_RATE_8000_384000,
+			.formats = (SNDRV_PCM_FMTBIT_S16_LE |
+				    SNDRV_PCM_FMTBIT_S24_LE |
+				    SNDRV_PCM_FMTBIT_S24_3LE |
+				    SNDRV_PCM_FMTBIT_S32_LE),
+			.rate_min = 8000,
+			.rate_max = 384000,
+		},
+	},
+	{
+		.name = "msm-stub-aif1-tx",
+		.capture = {
+			.stream_name = "STUB_AIF1_TX Capture",
+			.channels_min = 1,
+			.channels_max = 16,
+			.rates = SNDRV_PCM_RATE_8000_384000,
+			.formats = (SNDRV_PCM_FMTBIT_S16_LE |
+				    SNDRV_PCM_FMTBIT_S24_LE |
+				    SNDRV_PCM_FMTBIT_S24_3LE |
+				    SNDRV_PCM_FMTBIT_S32_LE),
+			.rate_min = 8000,
+			.rate_max = 384000,
+		},
+	},
+	{
+		.name = "msm-stub-aif2-rx",
+		.playback = {
+			.stream_name = "STUB_AIF2_RX Playback",
+			.channels_min = 1,
+			.channels_max = 16,
+			.rates = SNDRV_PCM_RATE_8000_384000,
+			.formats = (SNDRV_PCM_FMTBIT_S16_LE |
+				    SNDRV_PCM_FMTBIT_S24_LE |
+				    SNDRV_PCM_FMTBIT_S24_3LE |
+				    SNDRV_PCM_FMTBIT_S32_LE),
+			.rate_min = 8000,
+			.rate_max = 384000,
+		},
+	},
+	{
+		.name = "msm-stub-aif2-tx",
+		.capture = {
+			.stream_name = "STUB_AIF2_TX Capture",
+			.channels_min = 1,
+			.channels_max = 16,
+			.rates = SNDRV_PCM_RATE_8000_384000,
+			.formats = (SNDRV_PCM_FMTBIT_S16_LE |
+					SNDRV_PCM_FMTBIT_S24_LE |
+					SNDRV_PCM_FMTBIT_S24_3LE |
+					SNDRV_PCM_FMTBIT_S32_LE),
+			.rate_min = 8000,
+			.rate_max = 384000,
+		},
+	},
+	{
+		.name = "msm-stub-aif3-rx",
+		.playback = {
+			.stream_name = "STUB_AIF3_RX Playback",
+			.channels_min = 1,
+			.channels_max = 16,
+			.rates = SNDRV_PCM_RATE_8000_384000,
+			.formats = (SNDRV_PCM_FMTBIT_S16_LE |
+				    SNDRV_PCM_FMTBIT_S24_LE |
+				    SNDRV_PCM_FMTBIT_S24_3LE |
+				    SNDRV_PCM_FMTBIT_S32_LE),
+			.rate_min = 8000,
+			.rate_max = 384000,
+		},
+	},
+	{
+		.name = "msm-stub-aif3-tx",
+		.capture = {
+			.stream_name = "STUB_AIF3_TX Capture",
+			.channels_min = 1,
+			.channels_max = 16,
+			.rates = SNDRV_PCM_RATE_8000_384000,
+			.formats = (SNDRV_PCM_FMTBIT_S16_LE |
+					SNDRV_PCM_FMTBIT_S24_LE |
+					SNDRV_PCM_FMTBIT_S24_3LE |
+					SNDRV_PCM_FMTBIT_S32_LE),
+			.rate_min = 8000,
+			.rate_max = 384000,
+		},
+	},
+};
+
+static const struct snd_soc_component_driver soc_msm_stub = {
+	.name = DRV_NAME,
+	.dapm_widgets = msm_stub_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(msm_stub_dapm_widgets),
+	.dapm_routes = msm_stub_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(msm_stub_dapm_routes),
+};
+
+static int msm_stub_dev_probe(struct platform_device *pdev)
+{
+	return devm_snd_soc_register_component(&pdev->dev, &soc_msm_stub, msm_stub_dais,
+			ARRAY_SIZE(msm_stub_dais));
+}
+
+static const struct of_device_id msm_stub_codec_dt_match[] = {
+	{.compatible = "qcom,msm-stub-codec", },
+	{}
+};
+MODULE_DEVICE_TABLE(of, msm_stub_codec_dt_match);
+
+static struct platform_driver msm_stub_driver = {
+	.driver = {
+		.name = "msm-stub-codec",
+		.of_match_table = of_match_ptr(msm_stub_codec_dt_match),
+	},
+	.probe = msm_stub_dev_probe,
+};
+
+module_platform_driver(msm_stub_driver);
+
+MODULE_DESCRIPTION("MSM STUB CODEC driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/sound/soc/codecs/peb2466.c
+++ linux-qcom-6.8.0/sound/soc/codecs/peb2466.c
@@ -229,7 +229,8 @@
 	case PEB2466_CMD_XOP:
 	case PEB2466_CMD_SOP:
 		ret = peb2466_read_byte(peb2466, reg, &tmp);
-		*val = tmp;
+		if (!ret)
+			*val = tmp;
 		break;
 	default:
 		dev_err(&peb2466->spi->dev, "Not a XOP or SOP command\n");
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt5640.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt5640.c
@@ -2422,10 +2422,20 @@
 	return IRQ_HANDLED;
 }
 
-static void rt5640_cancel_work(void *data)
+static void rt5640_disable_irq_and_cancel_work(void *data)
 {
 	struct rt5640_priv *rt5640 = data;
 
+	if (rt5640->jd_gpio_irq_requested) {
+		free_irq(rt5640->jd_gpio_irq, rt5640);
+		rt5640->jd_gpio_irq_requested = false;
+	}
+
+	if (rt5640->irq_requested) {
+		free_irq(rt5640->irq, rt5640);
+		rt5640->irq_requested = false;
+	}
+
 	cancel_delayed_work_sync(&rt5640->jack_work);
 	cancel_delayed_work_sync(&rt5640->bp_work);
 }
@@ -2466,13 +2476,7 @@
 	if (!rt5640->jack)
 		return;
 
-	if (rt5640->jd_gpio_irq_requested)
-		free_irq(rt5640->jd_gpio_irq, rt5640);
-
-	if (rt5640->irq_requested)
-		free_irq(rt5640->irq, rt5640);
-
-	rt5640_cancel_work(rt5640);
+	rt5640_disable_irq_and_cancel_work(rt5640);
 
 	if (rt5640->jack->status & SND_JACK_MICROPHONE) {
 		rt5640_disable_micbias1_ovcd_irq(component);
@@ -2480,8 +2484,6 @@
 		snd_soc_jack_report(rt5640->jack, 0, SND_JACK_BTN_0);
 	}
 
-	rt5640->jd_gpio_irq_requested = false;
-	rt5640->irq_requested = false;
 	rt5640->jd_gpio = NULL;
 	rt5640->jack = NULL;
 }
@@ -2801,7 +2803,8 @@
 	if (rt5640->jack) {
 		/* disable jack interrupts during system suspend */
 		disable_irq(rt5640->irq);
-		rt5640_cancel_work(rt5640);
+		cancel_delayed_work_sync(&rt5640->jack_work);
+		cancel_delayed_work_sync(&rt5640->bp_work);
 	}
 
 	snd_soc_component_force_bias_level(component, SND_SOC_BIAS_OFF);
@@ -3035,7 +3038,7 @@
 	INIT_DELAYED_WORK(&rt5640->jack_work, rt5640_jack_work);
 
 	/* Make sure work is stopped on probe-error / remove */
-	ret = devm_add_action_or_reset(&i2c->dev, rt5640_cancel_work, rt5640);
+	ret = devm_add_action_or_reset(&i2c->dev, rt5640_disable_irq_and_cancel_work, rt5640);
 	if (ret)
 		return ret;
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt5645.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt5645.c
@@ -444,6 +444,7 @@
 	struct regmap *regmap;
 	struct i2c_client *i2c;
 	struct gpio_desc *gpiod_hp_det;
+	struct gpio_desc *gpiod_cbj_sleeve;
 	struct snd_soc_jack *hp_jack;
 	struct snd_soc_jack *mic_jack;
 	struct snd_soc_jack *btn_jack;
@@ -3186,6 +3187,9 @@
 		regmap_update_bits(rt5645->regmap, RT5645_IN1_CTRL2,
 			RT5645_CBJ_MN_JD, 0);
 
+		if (rt5645->gpiod_cbj_sleeve)
+			gpiod_set_value(rt5645->gpiod_cbj_sleeve, 1);
+
 		msleep(600);
 		regmap_read(rt5645->regmap, RT5645_IN1_CTRL3, &val);
 		val &= 0x7;
@@ -3202,6 +3206,8 @@
 			snd_soc_dapm_disable_pin(dapm, "Mic Det Power");
 			snd_soc_dapm_sync(dapm);
 			rt5645->jack_type = SND_JACK_HEADPHONE;
+			if (rt5645->gpiod_cbj_sleeve)
+				gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0);
 		}
 		if (rt5645->pdata.level_trigger_irq)
 			regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
@@ -3229,6 +3235,9 @@
 		if (rt5645->pdata.level_trigger_irq)
 			regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
 				RT5645_JD_1_1_MASK, RT5645_JD_1_1_INV);
+
+		if (rt5645->gpiod_cbj_sleeve)
+			gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0);
 	}
 
 	return rt5645->jack_type;
@@ -4012,6 +4021,16 @@
 			return ret;
 	}
 
+	rt5645->gpiod_cbj_sleeve = devm_gpiod_get_optional(&i2c->dev, "cbj-sleeve",
+							   GPIOD_OUT_LOW);
+
+	if (IS_ERR(rt5645->gpiod_cbj_sleeve)) {
+		ret = PTR_ERR(rt5645->gpiod_cbj_sleeve);
+		dev_info(&i2c->dev, "failed to initialize gpiod, ret=%d\n", ret);
+		if (ret != -ENOENT)
+			return ret;
+	}
+
 	for (i = 0; i < ARRAY_SIZE(rt5645->supplies); i++)
 		rt5645->supplies[i].supply = rt5645_supply_names[i];
 
@@ -4259,6 +4278,9 @@
 	cancel_delayed_work_sync(&rt5645->jack_detect_work);
 	cancel_delayed_work_sync(&rt5645->rcclock_work);
 
+	if (rt5645->gpiod_cbj_sleeve)
+		gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0);
+
 	regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies);
 }
 
@@ -4274,6 +4296,9 @@
 		0);
 	msleep(20);
 	regmap_write(rt5645->regmap, RT5645_RESET, 0);
+
+	if (rt5645->gpiod_cbj_sleeve)
+		gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0);
 }
 
 static int __maybe_unused rt5645_sys_suspend(struct device *dev)
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt5682-sdw.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt5682-sdw.c
@@ -763,12 +763,12 @@
 		return 0;
 
 	if (!slave->unattach_request) {
+		mutex_lock(&rt5682->disable_irq_lock);
 		if (rt5682->disable_irq == true) {
-			mutex_lock(&rt5682->disable_irq_lock);
 			sdw_write_no_pm(slave, SDW_SCP_INTMASK1, SDW_SCP_INT1_IMPL_DEF);
 			rt5682->disable_irq = false;
-			mutex_unlock(&rt5682->disable_irq_lock);
 		}
+		mutex_unlock(&rt5682->disable_irq_lock);
 		goto regmap_sync;
 	}
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt5682.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt5682.c
@@ -2903,8 +2903,10 @@
 		}
 
 		if (dev->of_node) {
-			devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get,
+			ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get,
 						    dai_clk_hw);
+			if (ret)
+				return ret;
 		} else {
 			ret = devm_clk_hw_register_clkdev(dev, dai_clk_hw,
 							  init.name,
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt5682s.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt5682s.c
@@ -2828,7 +2828,9 @@
 		}
 
 		if (dev->of_node) {
-			devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, dai_clk_hw);
+			ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, dai_clk_hw);
+			if (ret)
+				return ret;
 		} else {
 			ret = devm_clk_hw_register_clkdev(dev, dai_clk_hw,
 							  init.name, dev_name(dev));
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt711-sdca-sdw.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt711-sdca-sdw.c
@@ -438,13 +438,13 @@
 		return 0;
 
 	if (!slave->unattach_request) {
+		mutex_lock(&rt711->disable_irq_lock);
 		if (rt711->disable_irq == true) {
-			mutex_lock(&rt711->disable_irq_lock);
 			sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK1, SDW_SCP_SDCA_INTMASK_SDCA_0);
 			sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK2, SDW_SCP_SDCA_INTMASK_SDCA_8);
 			rt711->disable_irq = false;
-			mutex_unlock(&rt711->disable_irq_lock);
 		}
+		mutex_unlock(&rt711->disable_irq_lock);
 		goto regmap_sync;
 	}
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt711-sdw.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt711-sdw.c
@@ -536,12 +536,12 @@
 		return 0;
 
 	if (!slave->unattach_request) {
+		mutex_lock(&rt711->disable_irq_lock);
 		if (rt711->disable_irq == true) {
-			mutex_lock(&rt711->disable_irq_lock);
 			sdw_write_no_pm(slave, SDW_SCP_INTMASK1, SDW_SCP_INT1_IMPL_DEF);
 			rt711->disable_irq = false;
-			mutex_unlock(&rt711->disable_irq_lock);
 		}
+		mutex_unlock(&rt711->disable_irq_lock);
 		goto regmap_sync;
 	}
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt712-sdca-sdw.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt712-sdca-sdw.c
@@ -438,13 +438,14 @@
 		return 0;
 
 	if (!slave->unattach_request) {
+		mutex_lock(&rt712->disable_irq_lock);
 		if (rt712->disable_irq == true) {
-			mutex_lock(&rt712->disable_irq_lock);
+
 			sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK1, SDW_SCP_SDCA_INTMASK_SDCA_0);
 			sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK2, SDW_SCP_SDCA_INTMASK_SDCA_8);
 			rt712->disable_irq = false;
-			mutex_unlock(&rt712->disable_irq_lock);
 		}
+		mutex_unlock(&rt712->disable_irq_lock);
 		goto regmap_sync;
 	}
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt715-sdca.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt715-sdca.c
@@ -316,7 +316,7 @@
 	return 0;
 }
 
-static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -17625, 375, 0);
+static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -1725, 75, 0);
 static const DECLARE_TLV_DB_SCALE(mic_vol_tlv, 0, 1000, 0);
 
 static int rt715_sdca_get_volsw(struct snd_kcontrol *kcontrol,
@@ -477,7 +477,7 @@
 			RT715_SDCA_FU_VOL_CTRL, CH_01),
 		SDW_SDCA_CTL(FUN_MIC_ARRAY, RT715_SDCA_FU_ADC7_27_VOL,
 			RT715_SDCA_FU_VOL_CTRL, CH_02),
-			0x2f, 0x7f, 0,
+			0x2f, 0x3f, 0,
 		rt715_sdca_set_amp_gain_get, rt715_sdca_set_amp_gain_put,
 		in_vol_tlv),
 	RT715_SDCA_EXT_TLV("FU02 Capture Volume",
@@ -485,13 +485,13 @@
 			RT715_SDCA_FU_VOL_CTRL, CH_01),
 		rt715_sdca_set_amp_gain_4ch_get,
 		rt715_sdca_set_amp_gain_4ch_put,
-		in_vol_tlv, 4, 0x7f),
+		in_vol_tlv, 4, 0x3f),
 	RT715_SDCA_EXT_TLV("FU06 Capture Volume",
 		SDW_SDCA_CTL(FUN_MIC_ARRAY, RT715_SDCA_FU_ADC10_11_VOL,
 			RT715_SDCA_FU_VOL_CTRL, CH_01),
 		rt715_sdca_set_amp_gain_4ch_get,
 		rt715_sdca_set_amp_gain_4ch_put,
-		in_vol_tlv, 4, 0x7f),
+		in_vol_tlv, 4, 0x3f),
 	/* MIC Boost Control */
 	RT715_SDCA_BOOST_EXT_TLV("FU0E Boost",
 		SDW_SDCA_CTL(FUN_MIC_ARRAY, RT715_SDCA_FU_DMIC_GAIN_EN,
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt715-sdw.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt715-sdw.c
@@ -111,6 +111,7 @@
 	case 0x839d:
 	case 0x83a7:
 	case 0x83a9:
+	case 0x752001:
 	case 0x752039:
 		return true;
 	default:
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt722-sdca-sdw.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt722-sdca-sdw.c
@@ -68,6 +68,7 @@
 	case 0x200007f:
 	case 0x2000082 ... 0x200008e:
 	case 0x2000090 ... 0x2000094:
+	case 0x3110000:
 	case 0x5300000 ... 0x5300002:
 	case 0x5400002:
 	case 0x5600000 ... 0x5600007:
@@ -125,6 +126,7 @@
 	case 0x2000067:
 	case 0x2000084:
 	case 0x2000086:
+	case 0x3110000:
 		return true;
 	default:
 		return false;
@@ -251,7 +253,7 @@
 	}
 
 	/* set the timeout values */
-	prop->clk_stop_timeout = 200;
+	prop->clk_stop_timeout = 900;
 
 	/* wake-up event */
 	prop->wake_capable = 1;
@@ -350,7 +352,7 @@
 
 	if (status->sdca_cascade && !rt722->disable_irq)
 		mod_delayed_work(system_power_efficient_wq,
-			&rt722->jack_detect_work, msecs_to_jiffies(30));
+			&rt722->jack_detect_work, msecs_to_jiffies(280));
 
 	mutex_unlock(&rt722->disable_irq_lock);
 
@@ -467,13 +469,13 @@
 		return 0;
 
 	if (!slave->unattach_request) {
+		mutex_lock(&rt722->disable_irq_lock);
 		if (rt722->disable_irq == true) {
-			mutex_lock(&rt722->disable_irq_lock);
 			sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK1, SDW_SCP_SDCA_INTMASK_SDCA_6);
 			sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK2, SDW_SCP_SDCA_INTMASK_SDCA_8);
 			rt722->disable_irq = false;
-			mutex_unlock(&rt722->disable_irq_lock);
 		}
+		mutex_unlock(&rt722->disable_irq_lock);
 		goto regmap_sync;
 	}
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt722-sdca.c
+++ linux-qcom-6.8.0/sound/soc/codecs/rt722-sdca.c
@@ -607,12 +607,8 @@
 
 		if (!adc_vol_flag) /* boost gain */
 			ctl = regvalue / boost_step;
-		else { /* ADC gain */
-			if (adc_vol_flag)
-				ctl = p->max - (((vol_max - regvalue) & 0xffff) / interval_offset);
-			else
-				ctl = p->max - (((0 - regvalue) & 0xffff) / interval_offset);
-		}
+		else /* ADC gain */
+			ctl = p->max - (((vol_max - regvalue) & 0xffff) / interval_offset);
 
 		ucontrol->value.integer.value[i] = ctl;
 	}
@@ -1329,7 +1325,7 @@
 		.capture = {
 			.stream_name = "DP6 DMic Capture",
 			.channels_min = 1,
-			.channels_max = 2,
+			.channels_max = 4,
 			.rates = RT722_STEREO_RATES,
 			.formats = RT722_FORMATS,
 		},
@@ -1438,9 +1434,12 @@
 	int loop_check, chk_cnt = 100, ret;
 	unsigned int calib_status = 0;
 
-	/* Read eFuse */
-	rt722_sdca_index_write(rt722, RT722_VENDOR_SPK_EFUSE, RT722_DC_CALIB_CTRL,
-		0x4808);
+	/* Config analog bias */
+	rt722_sdca_index_write(rt722, RT722_VENDOR_REG, RT722_ANALOG_BIAS_CTL3,
+		0xa081);
+	/* GE related settings */
+	rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_GE_RELATED_CTL2,
+		0xa009);
 	/* Button A, B, C, D bypass mode */
 	rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_UMP_HID_CTL4,
 		0xcf00);
@@ -1467,16 +1466,18 @@
 		0x008d);
 	/* check HP calibration FSM status */
 	for (loop_check = 0; loop_check < chk_cnt; loop_check++) {
+		usleep_range(10000, 11000);
 		ret = rt722_sdca_index_read(rt722, RT722_VENDOR_CALI,
 			RT722_DAC_DC_CALI_CTL3, &calib_status);
-		if (ret < 0 || loop_check == chk_cnt)
+		if (ret < 0)
 			dev_dbg(&rt722->slave->dev, "calibration failed!, ret=%d\n", ret);
 		if ((calib_status & 0x0040) == 0x0)
 			break;
 	}
-	/* Release HP-JD, EN_CBJ_TIE_GL/R open, en_osw gating auto done bit */
-	rt722_sdca_index_write(rt722, RT722_VENDOR_REG, RT722_DIGITAL_MISC_CTRL4,
-		0x0010);
+
+	if (loop_check == chk_cnt)
+		dev_dbg(&rt722->slave->dev, "%s, calibration time-out!\n", __func__);
+
 	/* Set ADC09 power entity floating control */
 	rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_ADC0A_08_PDE_FLOAT_CTL,
 		0x2a12);
@@ -1489,8 +1490,21 @@
 	/* Set DAC03 and HP power entity floating control */
 	rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_DAC03_HP_PDE_FLOAT_CTL,
 		0x4040);
+	rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_ENT_FLOAT_CTRL_1,
+		0x4141);
+	rt722_sdca_index_write(rt722, RT722_VENDOR_HDA_CTL, RT722_FLOAT_CTRL_1,
+		0x0101);
 	/* Fine tune PDE40 latency */
 	regmap_write(rt722->regmap, 0x2f58, 0x07);
+	regmap_write(rt722->regmap, 0x2f03, 0x06);
+	/* MIC VRefo */
+	rt722_sdca_index_update_bits(rt722, RT722_VENDOR_REG,
+		RT722_COMBO_JACK_AUTO_CTL1, 0x0200, 0x0200);
+	rt722_sdca_index_update_bits(rt722, RT722_VENDOR_REG,
+		RT722_VREFO_GAT, 0x4000, 0x4000);
+	/* Release HP-JD, EN_CBJ_TIE_GL/R open, en_osw gating auto done bit */
+	rt722_sdca_index_write(rt722, RT722_VENDOR_REG, RT722_DIGITAL_MISC_CTRL4,
+		0x0010);
 }
 
 int rt722_sdca_io_init(struct device *dev, struct sdw_slave *slave)
--- linux-qcom-6.8.0.orig/sound/soc/codecs/rt722-sdca.h
+++ linux-qcom-6.8.0/sound/soc/codecs/rt722-sdca.h
@@ -69,6 +69,7 @@
 #define RT722_COMBO_JACK_AUTO_CTL2		0x46
 #define RT722_COMBO_JACK_AUTO_CTL3		0x47
 #define RT722_DIGITAL_MISC_CTRL4		0x4a
+#define RT722_VREFO_GAT				0x63
 #define RT722_FSM_CTL				0x67
 #define RT722_SDCA_INTR_REC			0x82
 #define RT722_SW_CONFIG1			0x8a
@@ -127,6 +128,8 @@
 #define RT722_UMP_HID_CTL6			0x66
 #define RT722_UMP_HID_CTL7			0x67
 #define RT722_UMP_HID_CTL8			0x68
+#define RT722_FLOAT_CTRL_1			0x70
+#define RT722_ENT_FLOAT_CTRL_1		0x76
 
 /* Parameter & Verb control 01 (0x1a)(NID:20h) */
 #define RT722_HIDDEN_REG_SW_RESET (0x1 << 14)
--- linux-qcom-6.8.0.orig/sound/soc/codecs/tas2552.c
+++ linux-qcom-6.8.0/sound/soc/codecs/tas2552.c
@@ -2,7 +2,8 @@
 /*
  * tas2552.c - ALSA SoC Texas Instruments TAS2552 Mono Audio Amplifier
  *
- * Copyright (C) 2014 Texas Instruments Incorporated -  https://www.ti.com
+ * Copyright (C) 2014 - 2024 Texas Instruments Incorporated -
+ *	https://www.ti.com
  *
  * Author: Dan Murphy <dmurphy@ti.com>
  */
@@ -119,12 +120,14 @@
 			 &tas2552_input_mux_control),
 
 	SND_SOC_DAPM_AIF_IN("DAC IN", "DAC Playback", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_OUT("ASI OUT", "DAC Capture", 0, SND_SOC_NOPM, 0, 0),
 	SND_SOC_DAPM_DAC("DAC", NULL, SND_SOC_NOPM, 0, 0),
 	SND_SOC_DAPM_OUT_DRV("ClassD", TAS2552_CFG_2, 7, 0, NULL, 0),
 	SND_SOC_DAPM_SUPPLY("PLL", TAS2552_CFG_2, 3, 0, NULL, 0),
 	SND_SOC_DAPM_POST("Post Event", tas2552_post_event),
 
-	SND_SOC_DAPM_OUTPUT("OUT")
+	SND_SOC_DAPM_OUTPUT("OUT"),
+	SND_SOC_DAPM_INPUT("DMIC")
 };
 
 static const struct snd_soc_dapm_route tas2552_audio_map[] = {
@@ -134,6 +137,7 @@
 	{"ClassD", NULL, "Input selection"},
 	{"OUT", NULL, "ClassD"},
 	{"ClassD", NULL, "PLL"},
+	{"ASI OUT", NULL, "DMIC"}
 };
 
 #ifdef CONFIG_PM
@@ -536,6 +540,13 @@
 			.channels_min = 2,
 			.channels_max = 2,
 			.rates = SNDRV_PCM_RATE_8000_192000,
+			.formats = TAS2552_FORMATS,
+		},
+		.capture = {
+			.stream_name = "Capture",
+			.channels_min = 2,
+			.channels_max = 2,
+			.rates = SNDRV_PCM_RATE_8000_192000,
 			.formats = TAS2552_FORMATS,
 		},
 		.ops = &tas2552_speaker_dai_ops,
--- linux-qcom-6.8.0.orig/sound/soc/codecs/tas2781-comlib.c
+++ linux-qcom-6.8.0/sound/soc/codecs/tas2781-comlib.c
@@ -14,7 +14,6 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/of.h>
-#include <linux/of_gpio.h>
 #include <linux/of_irq.h>
 #include <linux/regmap.h>
 #include <linux/slab.h>
@@ -406,9 +405,6 @@
 
 void tasdevice_remove(struct tasdevice_priv *tas_priv)
 {
-	if (gpio_is_valid(tas_priv->irq_info.irq_gpio))
-		gpio_free(tas_priv->irq_info.irq_gpio);
-	kfree(tas_priv->acpi_subsystem_id);
 	mutex_destroy(&tas_priv->codec_lock);
 }
 EXPORT_SYMBOL_GPL(tasdevice_remove);
--- linux-qcom-6.8.0.orig/sound/soc/codecs/tas2781-fmwlib.c
+++ linux-qcom-6.8.0/sound/soc/codecs/tas2781-fmwlib.c
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
 //
-// tasdevice-fmw.c -- TASDEVICE firmware support
+// tas2781-fmwlib.c -- TASDEVICE firmware support
 //
-// Copyright 2023 Texas Instruments, Inc.
+// Copyright 2023 - 2024 Texas Instruments, Inc.
 //
 // Author: Shenghao Ding <shenghao-ding@ti.com>
 
@@ -13,7 +13,6 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/of.h>
-#include <linux/of_gpio.h>
 #include <linux/of_irq.h>
 #include <linux/regmap.h>
 #include <linux/slab.h>
@@ -21,7 +20,7 @@
 #include <sound/soc.h>
 #include <sound/tlv.h>
 #include <sound/tas2781.h>
-
+#include <asm/unaligned.h>
 
 #define ERROR_PRAM_CRCCHK			0x0000000
 #define ERROR_YRAM_CRCCHK			0x0000001
@@ -187,8 +186,7 @@
 	/* convert data[offset], data[offset + 1], data[offset + 2] and
 	 * data[offset + 3] into host
 	 */
-	cfg_info->nblocks =
-		be32_to_cpup((__be32 *)&config_data[config_offset]);
+	cfg_info->nblocks = get_unaligned_be32(&config_data[config_offset]);
 	config_offset += 4;
 
 	/* Several kinds of dsp/algorithm firmwares can run on tas2781,
@@ -232,14 +230,14 @@
 
 		}
 		bk_da[i]->yram_checksum =
-			be16_to_cpup((__be16 *)&config_data[config_offset]);
+			get_unaligned_be16(&config_data[config_offset]);
 		config_offset += 2;
 		bk_da[i]->block_size =
-			be32_to_cpup((__be32 *)&config_data[config_offset]);
+			get_unaligned_be32(&config_data[config_offset]);
 		config_offset += 4;
 
 		bk_da[i]->n_subblks =
-			be32_to_cpup((__be32 *)&config_data[config_offset]);
+			get_unaligned_be32(&config_data[config_offset]);
 
 		config_offset += 4;
 
@@ -289,7 +287,7 @@
 	}
 	buf = (unsigned char *)fmw->data;
 
-	fw_hdr->img_sz = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_hdr->img_sz = get_unaligned_be32(&buf[offset]);
 	offset += 4;
 	if (fw_hdr->img_sz != fmw->size) {
 		dev_err(tas_priv->dev,
@@ -300,9 +298,9 @@
 		goto out;
 	}
 
-	fw_hdr->checksum = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_hdr->checksum = get_unaligned_be32(&buf[offset]);
 	offset += 4;
-	fw_hdr->binary_version_num = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_hdr->binary_version_num = get_unaligned_be32(&buf[offset]);
 	if (fw_hdr->binary_version_num < 0x103) {
 		dev_err(tas_priv->dev, "File version 0x%04x is too low",
 			fw_hdr->binary_version_num);
@@ -311,7 +309,7 @@
 		goto out;
 	}
 	offset += 4;
-	fw_hdr->drv_fw_version = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_hdr->drv_fw_version = get_unaligned_be32(&buf[offset]);
 	offset += 8;
 	fw_hdr->plat_type = buf[offset];
 	offset += 1;
@@ -339,11 +337,11 @@
 	for (i = 0; i < TASDEVICE_DEVICE_SUM; i++, offset++)
 		fw_hdr->devs[i] = buf[offset];
 
-	fw_hdr->nconfig = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_hdr->nconfig = get_unaligned_be32(&buf[offset]);
 	offset += 4;
 
 	for (i = 0; i < TASDEVICE_CONFIG_SUM; i++) {
-		fw_hdr->config_size[i] = be32_to_cpup((__be32 *)&buf[offset]);
+		fw_hdr->config_size[i] = get_unaligned_be32(&buf[offset]);
 		offset += 4;
 		total_config_sz += fw_hdr->config_size[i];
 	}
@@ -423,7 +421,7 @@
 	/* convert data[offset], data[offset + 1], data[offset + 2] and
 	 * data[offset + 3] into host
 	 */
-	block->type = be32_to_cpup((__be32 *)&data[offset]);
+	block->type = get_unaligned_be32(&data[offset]);
 	offset += 4;
 
 	block->is_pchksum_present = data[offset];
@@ -438,10 +436,10 @@
 	block->ychksum = data[offset];
 	offset++;
 
-	block->blk_size = be32_to_cpup((__be32 *)&data[offset]);
+	block->blk_size = get_unaligned_be32(&data[offset]);
 	offset += 4;
 
-	block->nr_subblocks = be32_to_cpup((__be32 *)&data[offset]);
+	block->nr_subblocks = get_unaligned_be32(&data[offset]);
 	offset += 4;
 
 	/* fixed m68k compiling issue:
@@ -482,7 +480,7 @@
 		offset = -EINVAL;
 		goto out;
 	}
-	img_data->nr_blk = be32_to_cpup((__be32 *)&data[offset]);
+	img_data->nr_blk = get_unaligned_be32(&data[offset]);
 	offset += 4;
 
 	img_data->dev_blks = kcalloc(img_data->nr_blk,
@@ -578,14 +576,14 @@
 		offset = -EINVAL;
 		goto out;
 	}
-	fw_hdr->device_family = be16_to_cpup((__be16 *)&buf[offset]);
+	fw_hdr->device_family = get_unaligned_be16(&buf[offset]);
 	if (fw_hdr->device_family != 0) {
 		dev_err(tas_priv->dev, "%s:not TAS device\n", __func__);
 		offset = -EINVAL;
 		goto out;
 	}
 	offset += 2;
-	fw_hdr->device = be16_to_cpup((__be16 *)&buf[offset]);
+	fw_hdr->device = get_unaligned_be16(&buf[offset]);
 	if (fw_hdr->device >= TASDEVICE_DSP_TAS_MAX_DEVICE ||
 		fw_hdr->device == 6) {
 		dev_err(tas_priv->dev, "Unsupported dev %d\n", fw_hdr->device);
@@ -603,7 +601,7 @@
 		goto out;
 	}
 
-	tas_fmw->nr_programs = be32_to_cpup((__be32 *)&buf[offset]);
+	tas_fmw->nr_programs = get_unaligned_be32(&buf[offset]);
 	offset += 4;
 
 	if (tas_fmw->nr_programs == 0 || tas_fmw->nr_programs >
@@ -622,14 +620,14 @@
 
 	for (i = 0; i < tas_fmw->nr_programs; i++) {
 		program = &(tas_fmw->programs[i]);
-		program->prog_size = be32_to_cpup((__be32 *)&buf[offset]);
+		program->prog_size = get_unaligned_be32(&buf[offset]);
 		offset += 4;
 	}
 
 	/* Skip the unused prog_size */
 	offset += 4 * (TASDEVICE_MAXPROGRAM_NUM_KERNEL - tas_fmw->nr_programs);
 
-	tas_fmw->nr_configurations = be32_to_cpup((__be32 *)&buf[offset]);
+	tas_fmw->nr_configurations = get_unaligned_be32(&buf[offset]);
 	offset += 4;
 
 	/* The max number of config in firmware greater than 4 pieces of
@@ -661,7 +659,7 @@
 
 	for (i = 0; i < tas_fmw->nr_programs; i++) {
 		config = &(tas_fmw->configs[i]);
-		config->cfg_size = be32_to_cpup((__be32 *)&buf[offset]);
+		config->cfg_size = get_unaligned_be32(&buf[offset]);
 		offset += 4;
 	}
 
@@ -699,7 +697,7 @@
 		switch (subblk_typ) {
 		case TASDEVICE_CMD_SING_W: {
 			int i;
-			unsigned short len = be16_to_cpup((__be16 *)&data[2]);
+			unsigned short len = get_unaligned_be16(&data[2]);
 
 			subblk_offset += 2;
 			if (subblk_offset + 4 * len > sublocksize) {
@@ -725,7 +723,7 @@
 		}
 			break;
 		case TASDEVICE_CMD_BURST: {
-			unsigned short len = be16_to_cpup((__be16 *)&data[2]);
+			unsigned short len = get_unaligned_be16(&data[2]);
 
 			subblk_offset += 2;
 			if (subblk_offset + 4 + len > sublocksize) {
@@ -766,7 +764,7 @@
 				is_err = true;
 				break;
 			}
-			sleep_time = be16_to_cpup((__be16 *)&data[2]) * 1000;
+			sleep_time = get_unaligned_be16(&data[2]) * 1000;
 			usleep_range(sleep_time, sleep_time + 50);
 			subblk_offset += 2;
 		}
@@ -910,7 +908,7 @@
 
 	offset += len;
 
-	fw_hdr->device_family = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_hdr->device_family = get_unaligned_be32(&buf[offset]);
 	if (fw_hdr->device_family != 0) {
 		dev_err(tas_priv->dev, "%s: not TAS device\n", __func__);
 		offset = -EINVAL;
@@ -918,7 +916,7 @@
 	}
 	offset += 4;
 
-	fw_hdr->device = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_hdr->device = get_unaligned_be32(&buf[offset]);
 	if (fw_hdr->device >= TASDEVICE_DSP_TAS_MAX_DEVICE ||
 		fw_hdr->device == 6) {
 		dev_err(tas_priv->dev, "Unsupported dev %d\n", fw_hdr->device);
@@ -963,7 +961,7 @@
 		offset = -EINVAL;
 		goto out;
 	}
-	block->type = be32_to_cpup((__be32 *)&data[offset]);
+	block->type = get_unaligned_be32(&data[offset]);
 	offset += 4;
 
 	if (tas_fmw->fw_hdr.fixed_hdr.drv_ver >= PPC_DRIVER_CRCCHK) {
@@ -988,7 +986,7 @@
 		block->is_ychksum_present = 0;
 	}
 
-	block->nr_cmds = be32_to_cpup((__be32 *)&data[offset]);
+	block->nr_cmds = get_unaligned_be32(&data[offset]);
 	offset += 4;
 
 	n = block->nr_cmds * 4;
@@ -1039,7 +1037,7 @@
 		goto out;
 	}
 	offset += n;
-	img_data->nr_blk = be16_to_cpup((__be16 *)&data[offset]);
+	img_data->nr_blk = get_unaligned_be16(&data[offset]);
 	offset += 2;
 
 	img_data->dev_blks = kcalloc(img_data->nr_blk,
@@ -1076,7 +1074,7 @@
 		offset = -EINVAL;
 		goto out;
 	}
-	tas_fmw->nr_programs = be16_to_cpup((__be16 *)&buf[offset]);
+	tas_fmw->nr_programs = get_unaligned_be16(&buf[offset]);
 	offset += 2;
 
 	if (tas_fmw->nr_programs == 0) {
@@ -1143,7 +1141,7 @@
 		offset = -EINVAL;
 		goto out;
 	}
-	tas_fmw->nr_configurations = be16_to_cpup((__be16 *)&data[offset]);
+	tas_fmw->nr_configurations = get_unaligned_be16(&data[offset]);
 	offset += 2;
 
 	if (tas_fmw->nr_configurations == 0) {
@@ -1775,7 +1773,7 @@
 	/* Convert data[offset], data[offset + 1], data[offset + 2] and
 	 * data[offset + 3] into host
 	 */
-	fw_fixed_hdr->fwsize = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_fixed_hdr->fwsize = get_unaligned_be32(&buf[offset]);
 	offset += 4;
 	if (fw_fixed_hdr->fwsize != fmw->size) {
 		dev_err(tas_priv->dev, "File size not match, %lu %u",
@@ -1784,9 +1782,9 @@
 		goto out;
 	}
 	offset += 4;
-	fw_fixed_hdr->ppcver = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_fixed_hdr->ppcver = get_unaligned_be32(&buf[offset]);
 	offset += 8;
-	fw_fixed_hdr->drv_ver = be32_to_cpup((__be32 *)&buf[offset]);
+	fw_fixed_hdr->drv_ver = get_unaligned_be32(&buf[offset]);
 	offset += 72;
 
  out:
@@ -1828,7 +1826,7 @@
 		offset = -EINVAL;
 		goto out;
 	}
-	tas_fmw->nr_calibrations = be16_to_cpup((__be16 *)&data[offset]);
+	tas_fmw->nr_calibrations = get_unaligned_be16(&data[offset]);
 	offset += 2;
 
 	if (tas_fmw->nr_calibrations != 1) {
@@ -1878,7 +1876,7 @@
 {
 	struct tasdevice_priv *tas_priv = (struct tasdevice_priv *)context;
 	struct tasdevice *tasdev = &(tas_priv->tasdevice[i]);
-	const struct firmware *fw_entry;
+	const struct firmware *fw_entry = NULL;
 	struct tasdevice_fw *tas_fmw;
 	struct firmware fmw;
 	int offset = 0;
@@ -1994,6 +1992,7 @@
 		break;
 	case 0x202:
 	case 0x400:
+	case 0x401:
 		tas_priv->fw_parse_variable_header =
 			fw_parse_variable_header_git;
 		tas_priv->fw_parse_program_data =
@@ -2151,6 +2150,24 @@
 	return ret;
 }
 
+static void tasdev_load_calibrated_data(struct tasdevice_priv *priv, int i)
+{
+	struct tasdevice_calibration *cal;
+	struct tasdevice_fw *cal_fmw;
+
+	cal_fmw = priv->tasdevice[i].cali_data_fmw;
+
+	/* No calibrated data for current devices, playback will go ahead. */
+	if (!cal_fmw)
+		return;
+
+	cal = cal_fmw->calibrations;
+	if (!cal)
+		return;
+
+	load_calib_data(priv, &cal->dev_data);
+}
+
 int tasdevice_select_tuningprm_cfg(void *context, int prm_no,
 	int cfg_no, int rca_conf_no)
 {
@@ -2210,21 +2227,9 @@
 		for (i = 0; i < tas_priv->ndev; i++) {
 			if (tas_priv->tasdevice[i].is_loaderr == true)
 				continue;
-			else if (tas_priv->tasdevice[i].is_loaderr == false
-				&& tas_priv->tasdevice[i].is_loading == true) {
-				struct tasdevice_fw *cal_fmw =
-					tas_priv->tasdevice[i].cali_data_fmw;
-
-				if (cal_fmw) {
-					struct tasdevice_calibration
-						*cal = cal_fmw->calibrations;
-
-					if (cal)
-						load_calib_data(tas_priv,
-							&(cal->dev_data));
-				}
+			if (tas_priv->tasdevice[i].is_loaderr == false &&
+				tas_priv->tasdevice[i].is_loading == true)
 				tas_priv->tasdevice[i].cur_prog = prm_no;
-			}
 		}
 	}
 
@@ -2245,11 +2250,15 @@
 		tasdevice_load_data(tas_priv, &(conf->dev_data));
 		for (i = 0; i < tas_priv->ndev; i++) {
 			if (tas_priv->tasdevice[i].is_loaderr == true) {
-				status |= 1 << (i + 4);
+				status |= BIT(i + 4);
 				continue;
-			} else if (tas_priv->tasdevice[i].is_loaderr == false
-				&& tas_priv->tasdevice[i].is_loading == true)
+			}
+
+			if (tas_priv->tasdevice[i].is_loaderr == false &&
+				tas_priv->tasdevice[i].is_loading == true) {
+				tasdev_load_calibrated_data(tas_priv, i);
 				tas_priv->tasdevice[i].cur_conf = cfg_no;
+			}
 		}
 	} else
 		dev_dbg(tas_priv->dev, "%s: Unneeded loading dsp conf %d\n",
@@ -2308,79 +2317,27 @@
 }
 EXPORT_SYMBOL_NS_GPL(tasdevice_prmg_load, SND_SOC_TAS2781_FMWLIB);
 
-int tasdevice_prmg_calibdata_load(void *context, int prm_no)
-{
-	struct tasdevice_priv *tas_priv = (struct tasdevice_priv *) context;
-	struct tasdevice_fw *tas_fmw = tas_priv->fmw;
-	struct tasdevice_prog *program;
-	int prog_status = 0;
-	int i;
-
-	if (!tas_fmw) {
-		dev_err(tas_priv->dev, "%s: Firmware is NULL\n", __func__);
-		goto out;
-	}
-
-	if (prm_no >= tas_fmw->nr_programs) {
-		dev_err(tas_priv->dev,
-			"%s: prm(%d) is not in range of Programs %u\n",
-			__func__, prm_no, tas_fmw->nr_programs);
-		goto out;
-	}
-
-	for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) {
-		if (prm_no >= 0 && tas_priv->tasdevice[i].cur_prog != prm_no) {
-			tas_priv->tasdevice[i].cur_conf = -1;
-			tas_priv->tasdevice[i].is_loading = true;
-			prog_status++;
-		}
-		tas_priv->tasdevice[i].is_loaderr = false;
-	}
-
-	if (prog_status) {
-		program = &(tas_fmw->programs[prm_no]);
-		tasdevice_load_data(tas_priv, &(program->dev_data));
-		for (i = 0; i < tas_priv->ndev; i++) {
-			if (tas_priv->tasdevice[i].is_loaderr == true)
-				continue;
-			else if (tas_priv->tasdevice[i].is_loaderr == false
-				&& tas_priv->tasdevice[i].is_loading == true) {
-				struct tasdevice_fw *cal_fmw =
-					tas_priv->tasdevice[i].cali_data_fmw;
-
-				if (cal_fmw) {
-					struct tasdevice_calibration *cal =
-						cal_fmw->calibrations;
-
-					if (cal)
-						load_calib_data(tas_priv,
-							&(cal->dev_data));
-				}
-				tas_priv->tasdevice[i].cur_prog = prm_no;
-			}
-		}
-	}
-
-out:
-	return prog_status;
-}
-EXPORT_SYMBOL_NS_GPL(tasdevice_prmg_calibdata_load,
-	SND_SOC_TAS2781_FMWLIB);
-
 void tasdevice_tuning_switch(void *context, int state)
 {
 	struct tasdevice_priv *tas_priv = (struct tasdevice_priv *) context;
 	struct tasdevice_fw *tas_fmw = tas_priv->fmw;
 	int profile_cfg_id = tas_priv->rcabin.profile_cfg_id;
 
-	if (tas_priv->fw_state == TASDEVICE_DSP_FW_FAIL) {
-		dev_err(tas_priv->dev, "DSP bin file not loaded\n");
+	/*
+	 * Only RCA-based Playback can still work with no dsp program running
+	 * inside the chip.
+	 */
+	switch (tas_priv->fw_state) {
+	case TASDEVICE_RCA_FW_OK:
+	case TASDEVICE_DSP_FW_ALL_OK:
+		break;
+	default:
 		return;
 	}
 
 	if (state == 0) {
-		if (tas_priv->cur_prog < tas_fmw->nr_programs) {
-			/*dsp mode or tuning mode*/
+		if (tas_fmw && tas_priv->cur_prog < tas_fmw->nr_programs) {
+			/* dsp mode or tuning mode */
 			profile_cfg_id = tas_priv->rcabin.profile_cfg_id;
 			tasdevice_select_tuningprm_cfg(tas_priv,
 				tas_priv->cur_prog, tas_priv->cur_conf,
@@ -2389,9 +2346,10 @@
 
 		tasdevice_select_cfg_blk(tas_priv, profile_cfg_id,
 			TASDEVICE_BIN_BLK_PRE_POWER_UP);
-	} else
+	} else {
 		tasdevice_select_cfg_blk(tas_priv, profile_cfg_id,
 			TASDEVICE_BIN_BLK_PRE_SHUTDOWN);
+	}
 }
 EXPORT_SYMBOL_NS_GPL(tasdevice_tuning_switch,
 	SND_SOC_TAS2781_FMWLIB);
--- linux-qcom-6.8.0.orig/sound/soc/codecs/tas2781-i2c.c
+++ linux-qcom-6.8.0/sound/soc/codecs/tas2781-i2c.c
@@ -2,7 +2,7 @@
 //
 // ALSA SoC Texas Instruments TAS2563/TAS2781 Audio Smart Amplifier
 //
-// Copyright (C) 2022 - 2023 Texas Instruments Incorporated
+// Copyright (C) 2022 - 2024 Texas Instruments Incorporated
 // https://www.ti.com
 //
 // The TAS2563/TAS2781 driver implements a flexible and configurable
@@ -21,7 +21,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/of.h>
-#include <linux/of_gpio.h>
+#include <linux/of_address.h>
 #include <linux/of_irq.h>
 #include <linux/regmap.h>
 #include <linux/slab.h>
@@ -380,23 +380,37 @@
 	mutex_lock(&tas_priv->codec_lock);
 
 	ret = tasdevice_rca_parser(tas_priv, fmw);
-	if (ret)
+	if (ret) {
+		tasdevice_config_info_remove(tas_priv);
 		goto out;
+	}
 	tasdevice_create_control(tas_priv);
 
 	tasdevice_dsp_remove(tas_priv);
 	tasdevice_calbin_remove(tas_priv);
-	tas_priv->fw_state = TASDEVICE_DSP_FW_PENDING;
+	/*
+	 * The baseline is the RCA-only case, and then the code attempts to
+	 * load DSP firmware but in case of failures just keep going, i.e.
+	 * failing to load DSP firmware is NOT an error.
+	 */
+	tas_priv->fw_state = TASDEVICE_RCA_FW_OK;
 	scnprintf(tas_priv->coef_binaryname, 64, "%s_coef.bin",
 		tas_priv->dev_name);
 	ret = tasdevice_dsp_parser(tas_priv);
 	if (ret) {
 		dev_err(tas_priv->dev, "dspfw load %s error\n",
 			tas_priv->coef_binaryname);
-		tas_priv->fw_state = TASDEVICE_DSP_FW_FAIL;
 		goto out;
 	}
-	tasdevice_dsp_create_ctrls(tas_priv);
+
+	/*
+	 * If no dsp-related kcontrol created, the dsp resource will be freed.
+	 */
+	ret = tasdevice_dsp_create_ctrls(tas_priv);
+	if (ret) {
+		dev_err(tas_priv->dev, "dsp controls error\n");
+		goto out;
+	}
 
 	tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
 
@@ -414,12 +428,11 @@
 				__func__, tas_priv->cal_binaryname[i]);
 	}
 
-	tasdevice_prmg_calibdata_load(tas_priv, 0);
+	tasdevice_prmg_load(tas_priv, 0);
 	tas_priv->cur_prog = 0;
 out:
-	if (tas_priv->fw_state == TASDEVICE_DSP_FW_FAIL) {
-		/*If DSP FW fail, kcontrol won't be created */
-		tasdevice_config_info_remove(tas_priv);
+	if (tas_priv->fw_state == TASDEVICE_RCA_FW_OK) {
+		/* If DSP FW fail, DSP kcontrol won't be created. */
 		tasdevice_dsp_remove(tas_priv);
 	}
 	mutex_unlock(&tas_priv->codec_lock);
@@ -466,14 +479,14 @@
 {
 	struct snd_soc_component *codec = dai->component;
 	struct tasdevice_priv *tas_priv = snd_soc_component_get_drvdata(codec);
-	int ret = 0;
 
-	if (tas_priv->fw_state != TASDEVICE_DSP_FW_ALL_OK) {
-		dev_err(tas_priv->dev, "DSP bin file not loaded\n");
-		ret = -EINVAL;
+	switch (tas_priv->fw_state) {
+	case TASDEVICE_RCA_FW_OK:
+	case TASDEVICE_DSP_FW_ALL_OK:
+		return 0;
+	default:
+		return -EINVAL;
 	}
-
-	return ret;
 }
 
 static int tasdevice_hw_params(struct snd_pcm_substream *substream,
@@ -605,7 +618,7 @@
 {
 	struct i2c_client *client = (struct i2c_client *)tas_priv->client;
 	unsigned int dev_addrs[TASDEVICE_MAX_CHANNELS];
-	int rc, i, ndev = 0;
+	int i, ndev = 0;
 
 	if (tas_priv->isacpi) {
 		ndev = device_property_read_u32_array(&client->dev,
@@ -620,64 +633,34 @@
 				"ti,audio-slots", dev_addrs, ndev);
 		}
 
-		tas_priv->irq_info.irq_gpio =
+		tas_priv->irq =
 			acpi_dev_gpio_irq_get(ACPI_COMPANION(&client->dev), 0);
-	} else {
+	} else if (IS_ENABLED(CONFIG_OF)) {
 		struct device_node *np = tas_priv->dev->of_node;
-#ifdef CONFIG_OF
-		const __be32 *reg, *reg_end;
-		int len, sw, aw;
+		u64 addr;
 
-		aw = of_n_addr_cells(np);
-		sw = of_n_size_cells(np);
-		if (sw == 0) {
-			reg = (const __be32 *)of_get_property(np,
-				"reg", &len);
-			reg_end = reg + len/sizeof(*reg);
-			ndev = 0;
-			do {
-				dev_addrs[ndev] = of_read_number(reg, aw);
-				reg += aw;
-				ndev++;
-			} while (reg < reg_end);
-		} else {
-			ndev = 1;
-			dev_addrs[0] = client->addr;
+		for (i = 0; i < TASDEVICE_MAX_CHANNELS; i++) {
+			if (of_property_read_reg(np, i, &addr, NULL))
+				break;
+			dev_addrs[ndev++] = addr;
 		}
-#else
+
+		tas_priv->irq = of_irq_get(np, 0);
+	} else {
 		ndev = 1;
 		dev_addrs[0] = client->addr;
-#endif
-		tas_priv->irq_info.irq_gpio = of_irq_get(np, 0);
 	}
 	tas_priv->ndev = ndev;
 	for (i = 0; i < ndev; i++)
 		tas_priv->tasdevice[i].dev_addr = dev_addrs[i];
 
 	tas_priv->reset = devm_gpiod_get_optional(&client->dev,
-			"reset-gpios", GPIOD_OUT_HIGH);
+			"reset", GPIOD_OUT_HIGH);
 	if (IS_ERR(tas_priv->reset))
 		dev_err(tas_priv->dev, "%s Can't get reset GPIO\n",
 			__func__);
 
 	strcpy(tas_priv->dev_name, tasdevice_id[tas_priv->chip_id].name);
-
-	if (gpio_is_valid(tas_priv->irq_info.irq_gpio)) {
-		rc = gpio_request(tas_priv->irq_info.irq_gpio,
-				"AUDEV-IRQ");
-		if (!rc) {
-			gpio_direction_input(
-				tas_priv->irq_info.irq_gpio);
-
-			tas_priv->irq_info.irq =
-				gpio_to_irq(tas_priv->irq_info.irq_gpio);
-		} else
-			dev_err(tas_priv->dev, "%s: GPIO %d request error\n",
-				__func__, tas_priv->irq_info.irq_gpio);
-	} else
-		dev_err(tas_priv->dev,
-			"Looking up irq-gpio property failed %d\n",
-			tas_priv->irq_info.irq_gpio);
 }
 
 static int tasdevice_i2c_probe(struct i2c_client *i2c)
--- linux-qcom-6.8.0.orig/sound/soc/codecs/tda7419.c
+++ linux-qcom-6.8.0/sound/soc/codecs/tda7419.c
@@ -623,6 +623,7 @@
 	{ .compatible = "st,tda7419" },
 	{ },
 };
+MODULE_DEVICE_TABLE(of, tda7419_of_match);
 
 static struct i2c_driver tda7419_driver = {
 	.driver = {
--- linux-qcom-6.8.0.orig/sound/soc/codecs/tlv320adc3xxx.c
+++ linux-qcom-6.8.0/sound/soc/codecs/tlv320adc3xxx.c
@@ -1429,7 +1429,7 @@
 	return ret;
 }
 
-static void __exit adc3xxx_i2c_remove(struct i2c_client *client)
+static void adc3xxx_i2c_remove(struct i2c_client *client)
 {
 	struct adc3xxx *adc3xxx = i2c_get_clientdata(client);
 
@@ -1452,7 +1452,7 @@
 		   .of_match_table = tlv320adc3xxx_of_match,
 		  },
 	.probe = adc3xxx_i2c_probe,
-	.remove = __exit_p(adc3xxx_i2c_remove),
+	.remove = adc3xxx_i2c_remove,
 	.id_table = adc3xxx_i2c_id,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/wcd937x-sdw.c
+++ linux-qcom-6.8.0/sound/soc/codecs/wcd937x-sdw.c
@@ -0,0 +1,1149 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <linux/component.h>
+#include <linux/device.h>
+#include <linux/irq.h>
+#include <linux/irqdomain.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+#include <linux/soundwire/sdw.h>
+#include <linux/soundwire/sdw_registers.h>
+#include <linux/soundwire/sdw_type.h>
+#include <sound/soc-dapm.h>
+#include <sound/soc.h>
+#include "wcd937x.h"
+
+static struct wcd937x_sdw_ch_info wcd937x_sdw_rx_ch_info[] = {
+	WCD_SDW_CH(WCD937X_HPH_L, WCD937X_HPH_PORT, BIT(0)),
+	WCD_SDW_CH(WCD937X_HPH_R, WCD937X_HPH_PORT, BIT(1)),
+	WCD_SDW_CH(WCD937X_CLSH, WCD937X_CLSH_PORT, BIT(0)),
+	WCD_SDW_CH(WCD937X_COMP_L, WCD937X_COMP_PORT, BIT(0)),
+	WCD_SDW_CH(WCD937X_COMP_R, WCD937X_COMP_PORT, BIT(1)),
+	WCD_SDW_CH(WCD937X_LO, WCD937X_LO_PORT, BIT(0)),
+	WCD_SDW_CH(WCD937X_DSD_L, WCD937X_DSD_PORT, BIT(0)),
+	WCD_SDW_CH(WCD937X_DSD_R, WCD937X_DSD_PORT, BIT(1)),
+};
+
+static struct wcd937x_sdw_ch_info wcd937x_sdw_tx_ch_info[] = {
+	WCD_SDW_CH(WCD937X_ADC1, WCD937X_SDW_PORT0, BIT(0)),
+	WCD_SDW_CH(WCD937X_ADC2, WCD937X_SDW_PORT1, BIT(0)),
+	WCD_SDW_CH(WCD937X_ADC3, WCD937X_SDW_PORT1, BIT(0)),
+	WCD_SDW_CH(WCD937X_DMIC0, WCD937X_SDW_PORT2, BIT(0)),
+	WCD_SDW_CH(WCD937X_DMIC1, WCD937X_SDW_PORT2, BIT(1)),
+	/* MBHC and DMIC2 share the same channel */
+	WCD_SDW_CH(WCD937X_MBHC, WCD937X_SDW_PORT2, BIT(2)),
+	WCD_SDW_CH(WCD937X_DMIC2, WCD937X_SDW_PORT2, BIT(2)),
+	WCD_SDW_CH(WCD937X_DMIC3, WCD937X_SDW_PORT2, BIT(3)),
+	WCD_SDW_CH(WCD937X_DMIC4, WCD937X_SDW_PORT3, BIT(0)),
+	WCD_SDW_CH(WCD937X_DMIC5, WCD937X_SDW_PORT3, BIT(1)),
+	WCD_SDW_CH(WCD937X_DMIC6, WCD937X_SDW_PORT3, BIT(2)),
+	WCD_SDW_CH(WCD937X_DMIC7, WCD937X_SDW_PORT3, BIT(3)),
+};
+
+static struct sdw_dpn_prop wcd937x_dpn_prop[WCD937X_MAX_SWR_PORTS] = {
+	{
+		.num = 1,
+		.type = SDW_DPN_SIMPLE,
+		.min_ch = 1,
+		.max_ch = 4, /* 4? 8? */
+		.simple_ch_prep_sm = true,
+	}, {
+		.num = 2,
+		.type = SDW_DPN_SIMPLE,
+		.min_ch = 1,
+		.max_ch = 4,
+		.simple_ch_prep_sm = true,
+	}, {
+		.num = 3,
+		.type = SDW_DPN_SIMPLE,
+		.min_ch = 1,
+		.max_ch = 4,
+		.simple_ch_prep_sm = true,
+	}, {
+		.num = 4,
+		.type = SDW_DPN_SIMPLE,
+		.min_ch = 1,
+		.max_ch = 4,
+		.simple_ch_prep_sm = true,
+	}, {
+		.num = 5,
+		.type = SDW_DPN_SIMPLE,
+		.min_ch = 1,
+		.max_ch = 4,
+		.simple_ch_prep_sm = true,
+	}
+};
+
+struct device *wcd937x_sdw_device_get(struct device_node *np)
+{
+	return bus_find_device_by_of_node(&sdw_bus_type, np);
+
+}
+EXPORT_SYMBOL_GPL(wcd937x_sdw_device_get);
+
+int wcd937x_sdw_hw_params(struct wcd937x_sdw_priv *wcd,
+			  struct snd_pcm_substream *substream,
+			  struct snd_pcm_hw_params *params,
+			  struct snd_soc_dai *dai)
+{
+	struct sdw_port_config port_config[WCD937X_MAX_SWR_PORTS];
+	unsigned long ch_mask;
+	int i, j;
+
+	wcd->sconfig.ch_count = 1;
+	wcd->active_ports = 0;
+	for (i = 0; i < WCD937X_MAX_SWR_PORTS; i++) {
+		ch_mask = wcd->port_config[i].ch_mask;
+		if (!ch_mask)
+			continue;
+
+		for_each_set_bit(j, &ch_mask, 4)
+			wcd->sconfig.ch_count++;
+
+		port_config[wcd->active_ports] = wcd->port_config[i];
+		wcd->active_ports++;
+	}
+
+	wcd->sconfig.bps = 1;
+	wcd->sconfig.frame_rate = params_rate(params);
+	wcd->sconfig.direction = wcd->is_tx ? SDW_DATA_DIR_TX : SDW_DATA_DIR_RX;
+	wcd->sconfig.type = SDW_STREAM_PCM;
+
+	return sdw_stream_add_slave(wcd->sdev, &wcd->sconfig,
+				    &port_config[0], wcd->active_ports,
+				    wcd->sruntime);
+}
+EXPORT_SYMBOL_GPL(wcd937x_sdw_hw_params);
+
+static int wcd937x_update_status(struct sdw_slave *slave, enum sdw_slave_status status)
+{
+	struct wcd937x_sdw_priv *wcd = dev_get_drvdata(&slave->dev);
+
+	if (wcd->regmap && (status == SDW_SLAVE_ATTACHED)) {
+		/* Write out any cached changes that happened between probe and attach */
+		regcache_cache_only(wcd->regmap, false);
+		return regcache_sync(wcd->regmap);
+	}
+
+	return 0;
+}
+
+static int wcd937x_interrupt_callback(struct sdw_slave *slave,
+				      struct sdw_slave_intr_status *status)
+{
+	struct wcd937x_sdw_priv *wcd = dev_get_drvdata(&slave->dev);
+	struct irq_domain *slave_irq = wcd->slave_irq;
+	u32 sts1, sts2, sts3;
+
+	do {
+		handle_nested_irq(irq_find_mapping(slave_irq, 0));
+		regmap_read(wcd->regmap, WCD937X_DIGITAL_INTR_STATUS_0, &sts1);
+		regmap_read(wcd->regmap, WCD937X_DIGITAL_INTR_STATUS_1, &sts2);
+		regmap_read(wcd->regmap, WCD937X_DIGITAL_INTR_STATUS_2, &sts3);
+
+	} while (sts1 || sts2 || sts3);
+
+	return IRQ_HANDLED;
+}
+
+static const struct reg_default wcd937x_defaults[] = {
+	{ WCD937X_ANA_BIAS,					0x00 },
+	{ WCD937X_ANA_RX_SUPPLIES,				0x00 },
+	{ WCD937X_ANA_HPH,					0x0c },
+	{ WCD937X_ANA_EAR,					0x00 },
+	{ WCD937X_ANA_EAR_COMPANDER_CTL,			0x02 },
+	{ WCD937X_ANA_TX_CH1,					0x20 },
+	{ WCD937X_ANA_TX_CH2,					0x00 },
+	{ WCD937X_ANA_TX_CH3,					0x20 },
+	{ WCD937X_ANA_TX_CH3_HPF,				0x00 },
+	{ WCD937X_ANA_MICB1_MICB2_DSP_EN_LOGIC,			0x00 },
+	{ WCD937X_ANA_MICB3_DSP_EN_LOGIC,			0x00 },
+	{ WCD937X_ANA_MBHC_MECH,				0x39 },
+	{ WCD937X_ANA_MBHC_ELECT,				0x08 },
+	{ WCD937X_ANA_MBHC_ZDET,				0x00 },
+	{ WCD937X_ANA_MBHC_RESULT_1,				0x00 },
+	{ WCD937X_ANA_MBHC_RESULT_2,				0x00 },
+	{ WCD937X_ANA_MBHC_RESULT_3,				0x00 },
+	{ WCD937X_ANA_MBHC_BTN0,				0x00 },
+	{ WCD937X_ANA_MBHC_BTN1,				0x10 },
+	{ WCD937X_ANA_MBHC_BTN2,				0x20 },
+	{ WCD937X_ANA_MBHC_BTN3,				0x30 },
+	{ WCD937X_ANA_MBHC_BTN4,				0x40 },
+	{ WCD937X_ANA_MBHC_BTN5,				0x50 },
+	{ WCD937X_ANA_MBHC_BTN6,				0x60 },
+	{ WCD937X_ANA_MBHC_BTN7,				0x70 },
+	{ WCD937X_ANA_MICB1,					0x10 },
+	{ WCD937X_ANA_MICB2,					0x10 },
+	{ WCD937X_ANA_MICB2_RAMP,				0x00 },
+	{ WCD937X_ANA_MICB3,					0x10 },
+	{ WCD937X_BIAS_CTL,					0x2a },
+	{ WCD937X_BIAS_VBG_FINE_ADJ,				0x55 },
+	{ WCD937X_LDOL_VDDCX_ADJUST,				0x01 },
+	{ WCD937X_LDOL_DISABLE_LDOL,				0x00 },
+	{ WCD937X_MBHC_CTL_CLK,					0x00 },
+	{ WCD937X_MBHC_CTL_ANA,					0x00 },
+	{ WCD937X_MBHC_CTL_SPARE_1,				0x00 },
+	{ WCD937X_MBHC_CTL_SPARE_2,				0x00 },
+	{ WCD937X_MBHC_CTL_BCS,					0x00 },
+	{ WCD937X_MBHC_MOISTURE_DET_FSM_STATUS,			0x00 },
+	{ WCD937X_MBHC_TEST_CTL,				0x00 },
+	{ WCD937X_LDOH_MODE,					0x2b },
+	{ WCD937X_LDOH_BIAS,					0x68 },
+	{ WCD937X_LDOH_STB_LOADS,				0x00 },
+	{ WCD937X_LDOH_SLOWRAMP,				0x50 },
+	{ WCD937X_MICB1_TEST_CTL_1,				0x1a },
+	{ WCD937X_MICB1_TEST_CTL_2,				0x18 },
+	{ WCD937X_MICB1_TEST_CTL_3,				0xa4 },
+	{ WCD937X_MICB2_TEST_CTL_1,				0x1a },
+	{ WCD937X_MICB2_TEST_CTL_2,				0x18 },
+	{ WCD937X_MICB2_TEST_CTL_3,				0xa4 },
+	{ WCD937X_MICB3_TEST_CTL_1,				0x1a },
+	{ WCD937X_MICB3_TEST_CTL_2,				0x18 },
+	{ WCD937X_MICB3_TEST_CTL_3,				0xa4 },
+	{ WCD937X_TX_COM_ADC_VCM,				0x39 },
+	{ WCD937X_TX_COM_BIAS_ATEST,				0xc0 },
+	{ WCD937X_TX_COM_ADC_INT1_IB,				0x6f },
+	{ WCD937X_TX_COM_ADC_INT2_IB,				0x4f },
+	{ WCD937X_TX_COM_TXFE_DIV_CTL,				0x2e },
+	{ WCD937X_TX_COM_TXFE_DIV_START,			0x00 },
+	{ WCD937X_TX_COM_TXFE_DIV_STOP_9P6M,			0xc7 },
+	{ WCD937X_TX_COM_TXFE_DIV_STOP_12P288M,			0xff },
+	{ WCD937X_TX_1_2_TEST_EN,				0xcc },
+	{ WCD937X_TX_1_2_ADC_IB,				0x09 },
+	{ WCD937X_TX_1_2_ATEST_REFCTL,				0x0a },
+	{ WCD937X_TX_1_2_TEST_CTL,				0x38 },
+	{ WCD937X_TX_1_2_TEST_BLK_EN,				0xff },
+	{ WCD937X_TX_1_2_TXFE_CLKDIV,				0x00 },
+	{ WCD937X_TX_1_2_SAR2_ERR,				0x00 },
+	{ WCD937X_TX_1_2_SAR1_ERR,				0x00 },
+	{ WCD937X_TX_3_TEST_EN,					0xcc },
+	{ WCD937X_TX_3_ADC_IB,					0x09 },
+	{ WCD937X_TX_3_ATEST_REFCTL,				0x0a },
+	{ WCD937X_TX_3_TEST_CTL,				0x38 },
+	{ WCD937X_TX_3_TEST_BLK_EN,				0xff },
+	{ WCD937X_TX_3_TXFE_CLKDIV,				0x00 },
+	{ WCD937X_TX_3_SPARE_MONO,				0x00 },
+	{ WCD937X_TX_3_SAR1_ERR,				0x00 },
+	{ WCD937X_CLASSH_MODE_1,				0x40 },
+	{ WCD937X_CLASSH_MODE_2,				0x3a },
+	{ WCD937X_CLASSH_MODE_3,				0x00 },
+	{ WCD937X_CLASSH_CTRL_VCL_1,				0x70 },
+	{ WCD937X_CLASSH_CTRL_VCL_2,				0x82 },
+	{ WCD937X_CLASSH_CTRL_CCL_1,				0x31 },
+	{ WCD937X_CLASSH_CTRL_CCL_2,				0x80 },
+	{ WCD937X_CLASSH_CTRL_CCL_3,				0x80 },
+	{ WCD937X_CLASSH_CTRL_CCL_4,				0x51 },
+	{ WCD937X_CLASSH_CTRL_CCL_5,				0x00 },
+	{ WCD937X_CLASSH_BUCK_TMUX_A_D,				0x00 },
+	{ WCD937X_CLASSH_BUCK_SW_DRV_CNTL,			0x77 },
+	{ WCD937X_CLASSH_SPARE,					0x00 },
+	{ WCD937X_FLYBACK_EN,					0x4e },
+	{ WCD937X_FLYBACK_VNEG_CTRL_1,				0x0b },
+	{ WCD937X_FLYBACK_VNEG_CTRL_2,				0x45 },
+	{ WCD937X_FLYBACK_VNEG_CTRL_3,				0x74 },
+	{ WCD937X_FLYBACK_VNEG_CTRL_4,				0x7f },
+	{ WCD937X_FLYBACK_VNEG_CTRL_5,				0x83 },
+	{ WCD937X_FLYBACK_VNEG_CTRL_6,				0x98 },
+	{ WCD937X_FLYBACK_VNEG_CTRL_7,				0xa9 },
+	{ WCD937X_FLYBACK_VNEG_CTRL_8,				0x68 },
+	{ WCD937X_FLYBACK_VNEG_CTRL_9,				0x64 },
+	{ WCD937X_FLYBACK_VNEGDAC_CTRL_1,			0xed },
+	{ WCD937X_FLYBACK_VNEGDAC_CTRL_2,			0xf0 },
+	{ WCD937X_FLYBACK_VNEGDAC_CTRL_3,			0xa6 },
+	{ WCD937X_FLYBACK_CTRL_1,				0x65 },
+	{ WCD937X_FLYBACK_TEST_CTL,				0x00 },
+	{ WCD937X_RX_AUX_SW_CTL,				0x00 },
+	{ WCD937X_RX_PA_AUX_IN_CONN,				0x00 },
+	{ WCD937X_RX_TIMER_DIV,					0x32 },
+	{ WCD937X_RX_OCP_CTL,					0x1f },
+	{ WCD937X_RX_OCP_COUNT,					0x77 },
+	{ WCD937X_RX_BIAS_EAR_DAC,				0xa0 },
+	{ WCD937X_RX_BIAS_EAR_AMP,				0xaa },
+	{ WCD937X_RX_BIAS_HPH_LDO,				0xa9 },
+	{ WCD937X_RX_BIAS_HPH_PA,				0xaa },
+	{ WCD937X_RX_BIAS_HPH_RDACBUFF_CNP2,			0x8a },
+	{ WCD937X_RX_BIAS_HPH_RDAC_LDO,				0x88 },
+	{ WCD937X_RX_BIAS_HPH_CNP1,				0x82 },
+	{ WCD937X_RX_BIAS_HPH_LOWPOWER,				0x82 },
+	{ WCD937X_RX_BIAS_AUX_DAC,				0xa0 },
+	{ WCD937X_RX_BIAS_AUX_AMP,				0xaa },
+	{ WCD937X_RX_BIAS_VNEGDAC_BLEEDER,			0x50 },
+	{ WCD937X_RX_BIAS_MISC,					0x00 },
+	{ WCD937X_RX_BIAS_BUCK_RST,				0x08 },
+	{ WCD937X_RX_BIAS_BUCK_VREF_ERRAMP,			0x44 },
+	{ WCD937X_RX_BIAS_FLYB_ERRAMP,				0x40 },
+	{ WCD937X_RX_BIAS_FLYB_BUFF,				0xaa },
+	{ WCD937X_RX_BIAS_FLYB_MID_RST,				0x14 },
+	{ WCD937X_HPH_L_STATUS,					0x04 },
+	{ WCD937X_HPH_R_STATUS,					0x04 },
+	{ WCD937X_HPH_CNP_EN,					0x80 },
+	{ WCD937X_HPH_CNP_WG_CTL,				0x9a },
+	{ WCD937X_HPH_CNP_WG_TIME,				0x14 },
+	{ WCD937X_HPH_OCP_CTL,					0x28 },
+	{ WCD937X_HPH_AUTO_CHOP,				0x16 },
+	{ WCD937X_HPH_CHOP_CTL,					0x83 },
+	{ WCD937X_HPH_PA_CTL1,					0x46 },
+	{ WCD937X_HPH_PA_CTL2,					0x50 },
+	{ WCD937X_HPH_L_EN,					0x80 },
+	{ WCD937X_HPH_L_TEST,					0xe0 },
+	{ WCD937X_HPH_L_ATEST,					0x50 },
+	{ WCD937X_HPH_R_EN,					0x80 },
+	{ WCD937X_HPH_R_TEST,					0xe0 },
+	{ WCD937X_HPH_R_ATEST,					0x54 },
+	{ WCD937X_HPH_RDAC_CLK_CTL1,				0x99 },
+	{ WCD937X_HPH_RDAC_CLK_CTL2,				0x9b },
+	{ WCD937X_HPH_RDAC_LDO_CTL,				0x33 },
+	{ WCD937X_HPH_RDAC_CHOP_CLK_LP_CTL,			0x00 },
+	{ WCD937X_HPH_REFBUFF_UHQA_CTL,				0xa8 },
+	{ WCD937X_HPH_REFBUFF_LP_CTL,				0x0e },
+	{ WCD937X_HPH_L_DAC_CTL,				0x20 },
+	{ WCD937X_HPH_R_DAC_CTL,				0x20 },
+	{ WCD937X_HPH_SURGE_HPHLR_SURGE_COMP_SEL,		0x55 },
+	{ WCD937X_HPH_SURGE_HPHLR_SURGE_EN,			0x19 },
+	{ WCD937X_HPH_SURGE_HPHLR_SURGE_MISC1,			0xa0 },
+	{ WCD937X_HPH_SURGE_HPHLR_SURGE_STATUS,			0x00 },
+	{ WCD937X_EAR_EAR_EN_REG,				0x22 },
+	{ WCD937X_EAR_EAR_PA_CON,				0x44 },
+	{ WCD937X_EAR_EAR_SP_CON,				0xdb },
+	{ WCD937X_EAR_EAR_DAC_CON,				0x80 },
+	{ WCD937X_EAR_EAR_CNP_FSM_CON,				0xb2 },
+	{ WCD937X_EAR_TEST_CTL,					0x00 },
+	{ WCD937X_EAR_STATUS_REG_1,				0x00 },
+	{ WCD937X_EAR_STATUS_REG_2,				0x00 },
+	{ WCD937X_ANA_NEW_PAGE_REGISTER,			0x00 },
+	{ WCD937X_HPH_NEW_ANA_HPH2,				0x00 },
+	{ WCD937X_HPH_NEW_ANA_HPH3,				0x00 },
+	{ WCD937X_SLEEP_CTL,					0x16 },
+	{ WCD937X_SLEEP_WATCHDOG_CTL,				0x00 },
+	{ WCD937X_MBHC_NEW_ELECT_REM_CLAMP_CTL,			0x00 },
+	{ WCD937X_MBHC_NEW_CTL_1,				0x02 },
+	{ WCD937X_MBHC_NEW_CTL_2,				0x05 },
+	{ WCD937X_MBHC_NEW_PLUG_DETECT_CTL,			0xe9 },
+	{ WCD937X_MBHC_NEW_ZDET_ANA_CTL,			0x0f },
+	{ WCD937X_MBHC_NEW_ZDET_RAMP_CTL,			0x00 },
+	{ WCD937X_MBHC_NEW_FSM_STATUS,				0x00 },
+	{ WCD937X_MBHC_NEW_ADC_RESULT,				0x00 },
+	{ WCD937X_TX_NEW_TX_CH2_SEL,				0x00 },
+	{ WCD937X_AUX_AUXPA,					0x00 },
+	{ WCD937X_LDORXTX_MODE,					0x0c },
+	{ WCD937X_LDORXTX_CONFIG,				0x10 },
+	{ WCD937X_DIE_CRACK_DIE_CRK_DET_EN,			0x00 },
+	{ WCD937X_DIE_CRACK_DIE_CRK_DET_OUT,			0x00 },
+	{ WCD937X_HPH_NEW_INT_RDAC_GAIN_CTL,			0x40 },
+	{ WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L,			0x81 },
+	{ WCD937X_HPH_NEW_INT_RDAC_VREF_CTL,			0x10 },
+	{ WCD937X_HPH_NEW_INT_RDAC_OVERRIDE_CTL,		0x00 },
+	{ WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_R,			0x81 },
+	{ WCD937X_HPH_NEW_INT_PA_MISC1,				0x22 },
+	{ WCD937X_HPH_NEW_INT_PA_MISC2,				0x00 },
+	{ WCD937X_HPH_NEW_INT_PA_RDAC_MISC,			0x00 },
+	{ WCD937X_HPH_NEW_INT_HPH_TIMER1,			0xfe },
+	{ WCD937X_HPH_NEW_INT_HPH_TIMER2,			0x02 },
+	{ WCD937X_HPH_NEW_INT_HPH_TIMER3,			0x4e },
+	{ WCD937X_HPH_NEW_INT_HPH_TIMER4,			0x54 },
+	{ WCD937X_HPH_NEW_INT_PA_RDAC_MISC2,			0x00 },
+	{ WCD937X_HPH_NEW_INT_PA_RDAC_MISC3,			0x00 },
+	{ WCD937X_RX_NEW_INT_HPH_RDAC_BIAS_LOHIFI,		0x62 },
+	{ WCD937X_RX_NEW_INT_HPH_RDAC_BIAS_ULP,			0x01 },
+	{ WCD937X_RX_NEW_INT_HPH_RDAC_LDO_LP,			0x11 },
+	{ WCD937X_MBHC_NEW_INT_MOISTURE_DET_DC_CTRL,		0x57 },
+	{ WCD937X_MBHC_NEW_INT_MOISTURE_DET_POLLING_CTRL,	0x01 },
+	{ WCD937X_MBHC_NEW_INT_MECH_DET_CURRENT,		0x00 },
+	{ WCD937X_MBHC_NEW_INT_SPARE_2,				0x00 },
+	{ WCD937X_EAR_INT_NEW_EAR_CHOPPER_CON,			0xa8 },
+	{ WCD937X_EAR_INT_NEW_CNP_VCM_CON1,			0x42 },
+	{ WCD937X_EAR_INT_NEW_CNP_VCM_CON2,			0x22 },
+	{ WCD937X_EAR_INT_NEW_EAR_DYNAMIC_BIAS,			0x00 },
+	{ WCD937X_AUX_INT_EN_REG,				0x00 },
+	{ WCD937X_AUX_INT_PA_CTRL,				0x06 },
+	{ WCD937X_AUX_INT_SP_CTRL,				0xd2 },
+	{ WCD937X_AUX_INT_DAC_CTRL,				0x80 },
+	{ WCD937X_AUX_INT_CLK_CTRL,				0x50 },
+	{ WCD937X_AUX_INT_TEST_CTRL,				0x00 },
+	{ WCD937X_AUX_INT_STATUS_REG,				0x00 },
+	{ WCD937X_AUX_INT_MISC,					0x00 },
+	{ WCD937X_LDORXTX_INT_BIAS,				0x6e },
+	{ WCD937X_LDORXTX_INT_STB_LOADS_DTEST,			0x50 },
+	{ WCD937X_LDORXTX_INT_TEST0,				0x1c },
+	{ WCD937X_LDORXTX_INT_STARTUP_TIMER,			0xff },
+	{ WCD937X_LDORXTX_INT_TEST1,				0x1f },
+	{ WCD937X_LDORXTX_INT_STATUS,				0x00 },
+	{ WCD937X_SLEEP_INT_WATCHDOG_CTL_1,			0x0a },
+	{ WCD937X_SLEEP_INT_WATCHDOG_CTL_2,			0x0a },
+	{ WCD937X_DIE_CRACK_INT_DIE_CRK_DET_INT1,		0x02 },
+	{ WCD937X_DIE_CRACK_INT_DIE_CRK_DET_INT2,		0x60 },
+	{ WCD937X_DIGITAL_PAGE_REGISTER,			0x00 },
+	{ WCD937X_DIGITAL_CHIP_ID0,				0x01 },
+	{ WCD937X_DIGITAL_CHIP_ID1,				0x00 },
+	{ WCD937X_DIGITAL_CHIP_ID2,				0x0a },
+	{ WCD937X_DIGITAL_CHIP_ID3,				0x01 },
+	{ WCD937X_DIGITAL_CDC_RST_CTL,				0x03 },
+	{ WCD937X_DIGITAL_TOP_CLK_CFG,				0x00 },
+	{ WCD937X_DIGITAL_CDC_ANA_CLK_CTL,			0x00 },
+	{ WCD937X_DIGITAL_CDC_DIG_CLK_CTL,			0x00 },
+	{ WCD937X_DIGITAL_SWR_RST_EN,				0x00 },
+	{ WCD937X_DIGITAL_CDC_PATH_MODE,			0x55 },
+	{ WCD937X_DIGITAL_CDC_RX_RST,				0x00 },
+	{ WCD937X_DIGITAL_CDC_RX0_CTL,				0xfc },
+	{ WCD937X_DIGITAL_CDC_RX1_CTL,				0xfc },
+	{ WCD937X_DIGITAL_CDC_RX2_CTL,				0xfc },
+	{ WCD937X_DIGITAL_DEM_BYPASS_DATA0,			0x55 },
+	{ WCD937X_DIGITAL_DEM_BYPASS_DATA1,			0x55 },
+	{ WCD937X_DIGITAL_DEM_BYPASS_DATA2,			0x55 },
+	{ WCD937X_DIGITAL_DEM_BYPASS_DATA3,			0x01 },
+	{ WCD937X_DIGITAL_CDC_COMP_CTL_0,			0x00 },
+	{ WCD937X_DIGITAL_CDC_RX_DELAY_CTL,			0x66 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A1_0,			0x00 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A1_1,			0x01 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A2_0,			0x63 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A2_1,			0x04 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A3_0,			0xac },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A3_1,			0x04 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A4_0,			0x1a },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A4_1,			0x03 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A5_0,			0xbc },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A5_1,			0x02 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A6_0,			0xc7 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_A7_0,			0xf8 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_C_0,			0x47 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_C_1,			0x43 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_C_2,			0xb1 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_C_3,			0x17 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_R1,			0x4b },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_R2,			0x26 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_R3,			0x32 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_R4,			0x57 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_R5,			0x63 },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_R6,			0x7c },
+	{ WCD937X_DIGITAL_CDC_HPH_DSM_R7,			0x57 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A1_0,			0x00 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A1_1,			0x01 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A2_0,			0x96 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A2_1,			0x09 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A3_0,			0xab },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A3_1,			0x05 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A4_0,			0x1c },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A4_1,			0x02 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A5_0,			0x17 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A5_1,			0x02 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A6_0,			0xaa },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_A7_0,			0xe3 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_C_0,			0x69 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_C_1,			0x54 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_C_2,			0x02 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_C_3,			0x15 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_R1,			0xa4 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_R2,			0xb5 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_R3,			0x86 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_R4,			0x85 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_R5,			0xaa },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_R6,			0xe2 },
+	{ WCD937X_DIGITAL_CDC_AUX_DSM_R7,			0x62 },
+	{ WCD937X_DIGITAL_CDC_HPH_GAIN_RX_0,			0x55 },
+	{ WCD937X_DIGITAL_CDC_HPH_GAIN_RX_1,			0xa9 },
+	{ WCD937X_DIGITAL_CDC_HPH_GAIN_DSD_0,			0x3d },
+	{ WCD937X_DIGITAL_CDC_HPH_GAIN_DSD_1,			0x2e },
+	{ WCD937X_DIGITAL_CDC_HPH_GAIN_DSD_2,			0x01 },
+	{ WCD937X_DIGITAL_CDC_AUX_GAIN_DSD_0,			0x00 },
+	{ WCD937X_DIGITAL_CDC_AUX_GAIN_DSD_1,			0xfc },
+	{ WCD937X_DIGITAL_CDC_AUX_GAIN_DSD_2,			0x01 },
+	{ WCD937X_DIGITAL_CDC_HPH_GAIN_CTL,			0x00 },
+	{ WCD937X_DIGITAL_CDC_AUX_GAIN_CTL,			0x00 },
+	{ WCD937X_DIGITAL_CDC_EAR_PATH_CTL,			0x00 },
+	{ WCD937X_DIGITAL_CDC_SWR_CLH,				0x00 },
+	{ WCD937X_DIGITAL_SWR_CLH_BYP,				0x00 },
+	{ WCD937X_DIGITAL_CDC_TX0_CTL,				0x68 },
+	{ WCD937X_DIGITAL_CDC_TX1_CTL,				0x68 },
+	{ WCD937X_DIGITAL_CDC_TX2_CTL,				0x68 },
+	{ WCD937X_DIGITAL_CDC_TX_RST,				0x00 },
+	{ WCD937X_DIGITAL_CDC_REQ_CTL,				0x01 },
+	{ WCD937X_DIGITAL_CDC_AMIC_CTL,				0x07 },
+	{ WCD937X_DIGITAL_CDC_DMIC_CTL,				0x00 },
+	{ WCD937X_DIGITAL_CDC_DMIC1_CTL,			0x01 },
+	{ WCD937X_DIGITAL_CDC_DMIC2_CTL,			0x01 },
+	{ WCD937X_DIGITAL_CDC_DMIC3_CTL,			0x01 },
+	{ WCD937X_DIGITAL_EFUSE_CTL,				0x2b },
+	{ WCD937X_DIGITAL_EFUSE_PRG_CTL,			0x00 },
+	{ WCD937X_DIGITAL_EFUSE_TEST_CTL_0,			0x00 },
+	{ WCD937X_DIGITAL_EFUSE_TEST_CTL_1,			0x00 },
+	{ WCD937X_DIGITAL_EFUSE_T_DATA_0,			0x00 },
+	{ WCD937X_DIGITAL_EFUSE_T_DATA_1,			0x00 },
+	{ WCD937X_DIGITAL_PDM_WD_CTL0,				0x00 },
+	{ WCD937X_DIGITAL_PDM_WD_CTL1,				0x00 },
+	{ WCD937X_DIGITAL_PDM_WD_CTL2,				0x00 },
+	{ WCD937X_DIGITAL_INTR_MODE,				0x00 },
+	{ WCD937X_DIGITAL_INTR_MASK_0,				0xff },
+	{ WCD937X_DIGITAL_INTR_MASK_1,				0xff },
+	{ WCD937X_DIGITAL_INTR_MASK_2,				0x0f },
+	{ WCD937X_DIGITAL_INTR_STATUS_0,			0x00 },
+	{ WCD937X_DIGITAL_INTR_STATUS_1,			0x00 },
+	{ WCD937X_DIGITAL_INTR_STATUS_2,			0x00 },
+	{ WCD937X_DIGITAL_INTR_CLEAR_0,				0x00 },
+	{ WCD937X_DIGITAL_INTR_CLEAR_1,				0x00 },
+	{ WCD937X_DIGITAL_INTR_CLEAR_2,				0x00 },
+	{ WCD937X_DIGITAL_INTR_LEVEL_0,				0x00 },
+	{ WCD937X_DIGITAL_INTR_LEVEL_1,				0x00 },
+	{ WCD937X_DIGITAL_INTR_LEVEL_2,				0x00 },
+	{ WCD937X_DIGITAL_INTR_SET_0,				0x00 },
+	{ WCD937X_DIGITAL_INTR_SET_1,				0x00 },
+	{ WCD937X_DIGITAL_INTR_SET_2,				0x00 },
+	{ WCD937X_DIGITAL_INTR_TEST_0,				0x00 },
+	{ WCD937X_DIGITAL_INTR_TEST_1,				0x00 },
+	{ WCD937X_DIGITAL_INTR_TEST_2,				0x00 },
+	{ WCD937X_DIGITAL_CDC_CONN_RX0_CTL,			0x00 },
+	{ WCD937X_DIGITAL_CDC_CONN_RX1_CTL,			0x00 },
+	{ WCD937X_DIGITAL_CDC_CONN_RX2_CTL,			0x00 },
+	{ WCD937X_DIGITAL_CDC_CONN_TX_CTL,			0x00 },
+	{ WCD937X_DIGITAL_LOOP_BACK_MODE,			0x00 },
+	{ WCD937X_DIGITAL_SWR_DAC_TEST,				0x00 },
+	{ WCD937X_DIGITAL_SWR_HM_TEST_RX_0,			0x40 },
+	{ WCD937X_DIGITAL_SWR_HM_TEST_TX_0,			0x40 },
+	{ WCD937X_DIGITAL_SWR_HM_TEST_RX_1,			0x00 },
+	{ WCD937X_DIGITAL_SWR_HM_TEST_TX_1,			0x00 },
+	{ WCD937X_DIGITAL_SWR_HM_TEST,				0x00 },
+	{ WCD937X_DIGITAL_PAD_CTL_PDM_RX0,			0xf1 },
+	{ WCD937X_DIGITAL_PAD_CTL_PDM_RX1,			0xf1 },
+	{ WCD937X_DIGITAL_PAD_CTL_PDM_TX0,			0xf1 },
+	{ WCD937X_DIGITAL_PAD_CTL_PDM_TX1,			0xf1 },
+	{ WCD937X_DIGITAL_PAD_INP_DIS_0,			0x00 },
+	{ WCD937X_DIGITAL_PAD_INP_DIS_1,			0x00 },
+	{ WCD937X_DIGITAL_DRIVE_STRENGTH_0,			0x00 },
+	{ WCD937X_DIGITAL_DRIVE_STRENGTH_1,			0x00 },
+	{ WCD937X_DIGITAL_DRIVE_STRENGTH_2,			0x00 },
+	{ WCD937X_DIGITAL_RX_DATA_EDGE_CTL,			0x1f },
+	{ WCD937X_DIGITAL_TX_DATA_EDGE_CTL,			0x10 },
+	{ WCD937X_DIGITAL_GPIO_MODE,				0x00 },
+	{ WCD937X_DIGITAL_PIN_CTL_OE,				0x00 },
+	{ WCD937X_DIGITAL_PIN_CTL_DATA_0,			0x00 },
+	{ WCD937X_DIGITAL_PIN_CTL_DATA_1,			0x00 },
+	{ WCD937X_DIGITAL_PIN_STATUS_0,				0x00 },
+	{ WCD937X_DIGITAL_PIN_STATUS_1,				0x00 },
+	{ WCD937X_DIGITAL_DIG_DEBUG_CTL,			0x00 },
+	{ WCD937X_DIGITAL_DIG_DEBUG_EN,				0x00 },
+	{ WCD937X_DIGITAL_ANA_CSR_DBG_ADD,			0x00 },
+	{ WCD937X_DIGITAL_ANA_CSR_DBG_CTL,			0x48 },
+	{ WCD937X_DIGITAL_SSP_DBG,				0x00 },
+	{ WCD937X_DIGITAL_MODE_STATUS_0,			0x00 },
+	{ WCD937X_DIGITAL_MODE_STATUS_1,			0x00 },
+	{ WCD937X_DIGITAL_SPARE_0,				0x00 },
+	{ WCD937X_DIGITAL_SPARE_1,				0x00 },
+	{ WCD937X_DIGITAL_SPARE_2,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_0,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_1,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_2,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_3,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_4,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_5,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_6,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_7,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_8,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_9,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_10,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_11,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_12,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_13,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_14,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_15,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_16,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_17,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_18,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_19,				0xff },
+	{ WCD937X_DIGITAL_EFUSE_REG_20,				0x0e },
+	{ WCD937X_DIGITAL_EFUSE_REG_21,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_22,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_23,				0xf8 },
+	{ WCD937X_DIGITAL_EFUSE_REG_24,				0x16 },
+	{ WCD937X_DIGITAL_EFUSE_REG_25,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_26,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_27,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_28,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_29,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_30,				0x00 },
+	{ WCD937X_DIGITAL_EFUSE_REG_31,				0x00 },
+};
+
+static bool wcd937x_rdwr_register(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case WCD937X_ANA_BIAS:
+	case WCD937X_ANA_RX_SUPPLIES:
+	case WCD937X_ANA_HPH:
+	case WCD937X_ANA_EAR:
+	case WCD937X_ANA_EAR_COMPANDER_CTL:
+	case WCD937X_ANA_TX_CH1:
+	case WCD937X_ANA_TX_CH2:
+	case WCD937X_ANA_TX_CH3:
+	case WCD937X_ANA_TX_CH3_HPF:
+	case WCD937X_ANA_MICB1_MICB2_DSP_EN_LOGIC:
+	case WCD937X_ANA_MICB3_DSP_EN_LOGIC:
+	case WCD937X_ANA_MBHC_MECH:
+	case WCD937X_ANA_MBHC_ELECT:
+	case WCD937X_ANA_MBHC_ZDET:
+	case WCD937X_ANA_MBHC_BTN0:
+	case WCD937X_ANA_MBHC_BTN1:
+	case WCD937X_ANA_MBHC_BTN2:
+	case WCD937X_ANA_MBHC_BTN3:
+	case WCD937X_ANA_MBHC_BTN4:
+	case WCD937X_ANA_MBHC_BTN5:
+	case WCD937X_ANA_MBHC_BTN6:
+	case WCD937X_ANA_MBHC_BTN7:
+	case WCD937X_ANA_MICB1:
+	case WCD937X_ANA_MICB2:
+	case WCD937X_ANA_MICB2_RAMP:
+	case WCD937X_ANA_MICB3:
+	case WCD937X_BIAS_CTL:
+	case WCD937X_BIAS_VBG_FINE_ADJ:
+	case WCD937X_LDOL_VDDCX_ADJUST:
+	case WCD937X_LDOL_DISABLE_LDOL:
+	case WCD937X_MBHC_CTL_CLK:
+	case WCD937X_MBHC_CTL_ANA:
+	case WCD937X_MBHC_CTL_SPARE_1:
+	case WCD937X_MBHC_CTL_SPARE_2:
+	case WCD937X_MBHC_CTL_BCS:
+	case WCD937X_MBHC_TEST_CTL:
+	case WCD937X_LDOH_MODE:
+	case WCD937X_LDOH_BIAS:
+	case WCD937X_LDOH_STB_LOADS:
+	case WCD937X_LDOH_SLOWRAMP:
+	case WCD937X_MICB1_TEST_CTL_1:
+	case WCD937X_MICB1_TEST_CTL_2:
+	case WCD937X_MICB1_TEST_CTL_3:
+	case WCD937X_MICB2_TEST_CTL_1:
+	case WCD937X_MICB2_TEST_CTL_2:
+	case WCD937X_MICB2_TEST_CTL_3:
+	case WCD937X_MICB3_TEST_CTL_1:
+	case WCD937X_MICB3_TEST_CTL_2:
+	case WCD937X_MICB3_TEST_CTL_3:
+	case WCD937X_TX_COM_ADC_VCM:
+	case WCD937X_TX_COM_BIAS_ATEST:
+	case WCD937X_TX_COM_ADC_INT1_IB:
+	case WCD937X_TX_COM_ADC_INT2_IB:
+	case WCD937X_TX_COM_TXFE_DIV_CTL:
+	case WCD937X_TX_COM_TXFE_DIV_START:
+	case WCD937X_TX_COM_TXFE_DIV_STOP_9P6M:
+	case WCD937X_TX_COM_TXFE_DIV_STOP_12P288M:
+	case WCD937X_TX_1_2_TEST_EN:
+	case WCD937X_TX_1_2_ADC_IB:
+	case WCD937X_TX_1_2_ATEST_REFCTL:
+	case WCD937X_TX_1_2_TEST_CTL:
+	case WCD937X_TX_1_2_TEST_BLK_EN:
+	case WCD937X_TX_1_2_TXFE_CLKDIV:
+	case WCD937X_TX_3_TEST_EN:
+	case WCD937X_TX_3_ADC_IB:
+	case WCD937X_TX_3_ATEST_REFCTL:
+	case WCD937X_TX_3_TEST_CTL:
+	case WCD937X_TX_3_TEST_BLK_EN:
+	case WCD937X_TX_3_TXFE_CLKDIV:
+	case WCD937X_CLASSH_MODE_1:
+	case WCD937X_CLASSH_MODE_2:
+	case WCD937X_CLASSH_MODE_3:
+	case WCD937X_CLASSH_CTRL_VCL_1:
+	case WCD937X_CLASSH_CTRL_VCL_2:
+	case WCD937X_CLASSH_CTRL_CCL_1:
+	case WCD937X_CLASSH_CTRL_CCL_2:
+	case WCD937X_CLASSH_CTRL_CCL_3:
+	case WCD937X_CLASSH_CTRL_CCL_4:
+	case WCD937X_CLASSH_CTRL_CCL_5:
+	case WCD937X_CLASSH_BUCK_TMUX_A_D:
+	case WCD937X_CLASSH_BUCK_SW_DRV_CNTL:
+	case WCD937X_CLASSH_SPARE:
+	case WCD937X_FLYBACK_EN:
+	case WCD937X_FLYBACK_VNEG_CTRL_1:
+	case WCD937X_FLYBACK_VNEG_CTRL_2:
+	case WCD937X_FLYBACK_VNEG_CTRL_3:
+	case WCD937X_FLYBACK_VNEG_CTRL_4:
+	case WCD937X_FLYBACK_VNEG_CTRL_5:
+	case WCD937X_FLYBACK_VNEG_CTRL_6:
+	case WCD937X_FLYBACK_VNEG_CTRL_7:
+	case WCD937X_FLYBACK_VNEG_CTRL_8:
+	case WCD937X_FLYBACK_VNEG_CTRL_9:
+	case WCD937X_FLYBACK_VNEGDAC_CTRL_1:
+	case WCD937X_FLYBACK_VNEGDAC_CTRL_2:
+	case WCD937X_FLYBACK_VNEGDAC_CTRL_3:
+	case WCD937X_FLYBACK_CTRL_1:
+	case WCD937X_FLYBACK_TEST_CTL:
+	case WCD937X_RX_AUX_SW_CTL:
+	case WCD937X_RX_PA_AUX_IN_CONN:
+	case WCD937X_RX_TIMER_DIV:
+	case WCD937X_RX_OCP_CTL:
+	case WCD937X_RX_OCP_COUNT:
+	case WCD937X_RX_BIAS_EAR_DAC:
+	case WCD937X_RX_BIAS_EAR_AMP:
+	case WCD937X_RX_BIAS_HPH_LDO:
+	case WCD937X_RX_BIAS_HPH_PA:
+	case WCD937X_RX_BIAS_HPH_RDACBUFF_CNP2:
+	case WCD937X_RX_BIAS_HPH_RDAC_LDO:
+	case WCD937X_RX_BIAS_HPH_CNP1:
+	case WCD937X_RX_BIAS_HPH_LOWPOWER:
+	case WCD937X_RX_BIAS_AUX_DAC:
+	case WCD937X_RX_BIAS_AUX_AMP:
+	case WCD937X_RX_BIAS_VNEGDAC_BLEEDER:
+	case WCD937X_RX_BIAS_MISC:
+	case WCD937X_RX_BIAS_BUCK_RST:
+	case WCD937X_RX_BIAS_BUCK_VREF_ERRAMP:
+	case WCD937X_RX_BIAS_FLYB_ERRAMP:
+	case WCD937X_RX_BIAS_FLYB_BUFF:
+	case WCD937X_RX_BIAS_FLYB_MID_RST:
+	case WCD937X_HPH_CNP_EN:
+	case WCD937X_HPH_CNP_WG_CTL:
+	case WCD937X_HPH_CNP_WG_TIME:
+	case WCD937X_HPH_OCP_CTL:
+	case WCD937X_HPH_AUTO_CHOP:
+	case WCD937X_HPH_CHOP_CTL:
+	case WCD937X_HPH_PA_CTL1:
+	case WCD937X_HPH_PA_CTL2:
+	case WCD937X_HPH_L_EN:
+	case WCD937X_HPH_L_TEST:
+	case WCD937X_HPH_L_ATEST:
+	case WCD937X_HPH_R_EN:
+	case WCD937X_HPH_R_TEST:
+	case WCD937X_HPH_R_ATEST:
+	case WCD937X_HPH_RDAC_CLK_CTL1:
+	case WCD937X_HPH_RDAC_CLK_CTL2:
+	case WCD937X_HPH_RDAC_LDO_CTL:
+	case WCD937X_HPH_RDAC_CHOP_CLK_LP_CTL:
+	case WCD937X_HPH_REFBUFF_UHQA_CTL:
+	case WCD937X_HPH_REFBUFF_LP_CTL:
+	case WCD937X_HPH_L_DAC_CTL:
+	case WCD937X_HPH_R_DAC_CTL:
+	case WCD937X_HPH_SURGE_HPHLR_SURGE_COMP_SEL:
+	case WCD937X_HPH_SURGE_HPHLR_SURGE_EN:
+	case WCD937X_HPH_SURGE_HPHLR_SURGE_MISC1:
+	case WCD937X_EAR_EAR_EN_REG:
+	case WCD937X_EAR_EAR_PA_CON:
+	case WCD937X_EAR_EAR_SP_CON:
+	case WCD937X_EAR_EAR_DAC_CON:
+	case WCD937X_EAR_EAR_CNP_FSM_CON:
+	case WCD937X_EAR_TEST_CTL:
+	case WCD937X_HPH_NEW_ANA_HPH2:
+	case WCD937X_HPH_NEW_ANA_HPH3:
+	case WCD937X_SLEEP_CTL:
+	case WCD937X_SLEEP_WATCHDOG_CTL:
+	case WCD937X_MBHC_NEW_ELECT_REM_CLAMP_CTL:
+	case WCD937X_MBHC_NEW_CTL_1:
+	case WCD937X_MBHC_NEW_CTL_2:
+	case WCD937X_MBHC_NEW_PLUG_DETECT_CTL:
+	case WCD937X_MBHC_NEW_ZDET_ANA_CTL:
+	case WCD937X_MBHC_NEW_ZDET_RAMP_CTL:
+	case WCD937X_TX_NEW_TX_CH2_SEL:
+	case WCD937X_AUX_AUXPA:
+	case WCD937X_LDORXTX_MODE:
+	case WCD937X_LDORXTX_CONFIG:
+	case WCD937X_DIE_CRACK_DIE_CRK_DET_EN:
+	case WCD937X_HPH_NEW_INT_RDAC_GAIN_CTL:
+	case WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L:
+	case WCD937X_HPH_NEW_INT_RDAC_VREF_CTL:
+	case WCD937X_HPH_NEW_INT_RDAC_OVERRIDE_CTL:
+	case WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_R:
+	case WCD937X_HPH_NEW_INT_PA_MISC1:
+	case WCD937X_HPH_NEW_INT_PA_MISC2:
+	case WCD937X_HPH_NEW_INT_PA_RDAC_MISC:
+	case WCD937X_HPH_NEW_INT_HPH_TIMER1:
+	case WCD937X_HPH_NEW_INT_HPH_TIMER2:
+	case WCD937X_HPH_NEW_INT_HPH_TIMER3:
+	case WCD937X_HPH_NEW_INT_HPH_TIMER4:
+	case WCD937X_HPH_NEW_INT_PA_RDAC_MISC2:
+	case WCD937X_HPH_NEW_INT_PA_RDAC_MISC3:
+	case WCD937X_RX_NEW_INT_HPH_RDAC_BIAS_LOHIFI:
+	case WCD937X_RX_NEW_INT_HPH_RDAC_BIAS_ULP:
+	case WCD937X_RX_NEW_INT_HPH_RDAC_LDO_LP:
+	case WCD937X_MBHC_NEW_INT_MOISTURE_DET_DC_CTRL:
+	case WCD937X_MBHC_NEW_INT_MOISTURE_DET_POLLING_CTRL:
+	case WCD937X_MBHC_NEW_INT_MECH_DET_CURRENT:
+	case WCD937X_MBHC_NEW_INT_SPARE_2:
+	case WCD937X_EAR_INT_NEW_EAR_CHOPPER_CON:
+	case WCD937X_EAR_INT_NEW_CNP_VCM_CON1:
+	case WCD937X_EAR_INT_NEW_CNP_VCM_CON2:
+	case WCD937X_EAR_INT_NEW_EAR_DYNAMIC_BIAS:
+	case WCD937X_AUX_INT_EN_REG:
+	case WCD937X_AUX_INT_PA_CTRL:
+	case WCD937X_AUX_INT_SP_CTRL:
+	case WCD937X_AUX_INT_DAC_CTRL:
+	case WCD937X_AUX_INT_CLK_CTRL:
+	case WCD937X_AUX_INT_TEST_CTRL:
+	case WCD937X_AUX_INT_MISC:
+	case WCD937X_LDORXTX_INT_BIAS:
+	case WCD937X_LDORXTX_INT_STB_LOADS_DTEST:
+	case WCD937X_LDORXTX_INT_TEST0:
+	case WCD937X_LDORXTX_INT_STARTUP_TIMER:
+	case WCD937X_LDORXTX_INT_TEST1:
+	case WCD937X_SLEEP_INT_WATCHDOG_CTL_1:
+	case WCD937X_SLEEP_INT_WATCHDOG_CTL_2:
+	case WCD937X_DIE_CRACK_INT_DIE_CRK_DET_INT1:
+	case WCD937X_DIE_CRACK_INT_DIE_CRK_DET_INT2:
+	case WCD937X_DIGITAL_CDC_RST_CTL:
+	case WCD937X_DIGITAL_TOP_CLK_CFG:
+	case WCD937X_DIGITAL_CDC_ANA_CLK_CTL:
+	case WCD937X_DIGITAL_CDC_DIG_CLK_CTL:
+	case WCD937X_DIGITAL_SWR_RST_EN:
+	case WCD937X_DIGITAL_CDC_PATH_MODE:
+	case WCD937X_DIGITAL_CDC_RX_RST:
+	case WCD937X_DIGITAL_CDC_RX0_CTL:
+	case WCD937X_DIGITAL_CDC_RX1_CTL:
+	case WCD937X_DIGITAL_CDC_RX2_CTL:
+	case WCD937X_DIGITAL_DEM_BYPASS_DATA0:
+	case WCD937X_DIGITAL_DEM_BYPASS_DATA1:
+	case WCD937X_DIGITAL_DEM_BYPASS_DATA2:
+	case WCD937X_DIGITAL_DEM_BYPASS_DATA3:
+	case WCD937X_DIGITAL_CDC_COMP_CTL_0:
+	case WCD937X_DIGITAL_CDC_RX_DELAY_CTL:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A1_0:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A1_1:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A2_0:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A2_1:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A3_0:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A3_1:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A4_0:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A4_1:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A5_0:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A5_1:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A6_0:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_A7_0:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_C_0:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_C_1:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_C_2:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_C_3:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_R1:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_R2:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_R3:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_R4:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_R5:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_R6:
+	case WCD937X_DIGITAL_CDC_HPH_DSM_R7:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A1_0:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A1_1:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A2_0:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A2_1:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A3_0:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A3_1:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A4_0:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A4_1:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A5_0:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A5_1:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A6_0:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_A7_0:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_C_0:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_C_1:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_C_2:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_C_3:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_R1:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_R2:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_R3:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_R4:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_R5:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_R6:
+	case WCD937X_DIGITAL_CDC_AUX_DSM_R7:
+	case WCD937X_DIGITAL_CDC_HPH_GAIN_RX_0:
+	case WCD937X_DIGITAL_CDC_HPH_GAIN_RX_1:
+	case WCD937X_DIGITAL_CDC_HPH_GAIN_DSD_0:
+	case WCD937X_DIGITAL_CDC_HPH_GAIN_DSD_1:
+	case WCD937X_DIGITAL_CDC_HPH_GAIN_DSD_2:
+	case WCD937X_DIGITAL_CDC_AUX_GAIN_DSD_0:
+	case WCD937X_DIGITAL_CDC_AUX_GAIN_DSD_1:
+	case WCD937X_DIGITAL_CDC_AUX_GAIN_DSD_2:
+	case WCD937X_DIGITAL_CDC_HPH_GAIN_CTL:
+	case WCD937X_DIGITAL_CDC_AUX_GAIN_CTL:
+	case WCD937X_DIGITAL_CDC_EAR_PATH_CTL:
+	case WCD937X_DIGITAL_CDC_SWR_CLH:
+	case WCD937X_DIGITAL_SWR_CLH_BYP:
+	case WCD937X_DIGITAL_CDC_TX0_CTL:
+	case WCD937X_DIGITAL_CDC_TX1_CTL:
+	case WCD937X_DIGITAL_CDC_TX2_CTL:
+	case WCD937X_DIGITAL_CDC_TX_RST:
+	case WCD937X_DIGITAL_CDC_REQ_CTL:
+	case WCD937X_DIGITAL_CDC_AMIC_CTL:
+	case WCD937X_DIGITAL_CDC_DMIC_CTL:
+	case WCD937X_DIGITAL_CDC_DMIC1_CTL:
+	case WCD937X_DIGITAL_CDC_DMIC2_CTL:
+	case WCD937X_DIGITAL_CDC_DMIC3_CTL:
+	case WCD937X_DIGITAL_EFUSE_CTL:
+	case WCD937X_DIGITAL_EFUSE_PRG_CTL:
+	case WCD937X_DIGITAL_EFUSE_TEST_CTL_0:
+	case WCD937X_DIGITAL_EFUSE_TEST_CTL_1:
+	case WCD937X_DIGITAL_PDM_WD_CTL0:
+	case WCD937X_DIGITAL_PDM_WD_CTL1:
+	case WCD937X_DIGITAL_PDM_WD_CTL2:
+	case WCD937X_DIGITAL_INTR_MODE:
+	case WCD937X_DIGITAL_INTR_MASK_0:
+	case WCD937X_DIGITAL_INTR_MASK_1:
+	case WCD937X_DIGITAL_INTR_MASK_2:
+	case WCD937X_DIGITAL_INTR_CLEAR_0:
+	case WCD937X_DIGITAL_INTR_CLEAR_1:
+	case WCD937X_DIGITAL_INTR_CLEAR_2:
+	case WCD937X_DIGITAL_INTR_LEVEL_0:
+	case WCD937X_DIGITAL_INTR_LEVEL_1:
+	case WCD937X_DIGITAL_INTR_LEVEL_2:
+	case WCD937X_DIGITAL_INTR_SET_0:
+	case WCD937X_DIGITAL_INTR_SET_1:
+	case WCD937X_DIGITAL_INTR_SET_2:
+	case WCD937X_DIGITAL_INTR_TEST_0:
+	case WCD937X_DIGITAL_INTR_TEST_1:
+	case WCD937X_DIGITAL_INTR_TEST_2:
+	case WCD937X_DIGITAL_CDC_CONN_RX0_CTL:
+	case WCD937X_DIGITAL_CDC_CONN_RX1_CTL:
+	case WCD937X_DIGITAL_CDC_CONN_RX2_CTL:
+	case WCD937X_DIGITAL_CDC_CONN_TX_CTL:
+	case WCD937X_DIGITAL_LOOP_BACK_MODE:
+	case WCD937X_DIGITAL_SWR_DAC_TEST:
+	case WCD937X_DIGITAL_SWR_HM_TEST_RX_0:
+	case WCD937X_DIGITAL_SWR_HM_TEST_TX_0:
+	case WCD937X_DIGITAL_SWR_HM_TEST_RX_1:
+	case WCD937X_DIGITAL_SWR_HM_TEST_TX_1:
+	case WCD937X_DIGITAL_SWR_HM_TEST:
+	case WCD937X_DIGITAL_PAD_CTL_PDM_RX0:
+	case WCD937X_DIGITAL_PAD_CTL_PDM_RX1:
+	case WCD937X_DIGITAL_PAD_CTL_PDM_TX0:
+	case WCD937X_DIGITAL_PAD_CTL_PDM_TX1:
+	case WCD937X_DIGITAL_PAD_INP_DIS_0:
+	case WCD937X_DIGITAL_PAD_INP_DIS_1:
+	case WCD937X_DIGITAL_DRIVE_STRENGTH_0:
+	case WCD937X_DIGITAL_DRIVE_STRENGTH_1:
+	case WCD937X_DIGITAL_DRIVE_STRENGTH_2:
+	case WCD937X_DIGITAL_RX_DATA_EDGE_CTL:
+	case WCD937X_DIGITAL_TX_DATA_EDGE_CTL:
+	case WCD937X_DIGITAL_GPIO_MODE:
+	case WCD937X_DIGITAL_PIN_CTL_OE:
+	case WCD937X_DIGITAL_PIN_CTL_DATA_0:
+	case WCD937X_DIGITAL_PIN_CTL_DATA_1:
+	case WCD937X_DIGITAL_PIN_STATUS_0:
+	case WCD937X_DIGITAL_PIN_STATUS_1:
+	case WCD937X_DIGITAL_DIG_DEBUG_CTL:
+	case WCD937X_DIGITAL_DIG_DEBUG_EN:
+	case WCD937X_DIGITAL_ANA_CSR_DBG_ADD:
+	case WCD937X_DIGITAL_ANA_CSR_DBG_CTL:
+	case WCD937X_DIGITAL_SSP_DBG:
+	case WCD937X_DIGITAL_MODE_STATUS_0:
+	case WCD937X_DIGITAL_MODE_STATUS_1:
+	case WCD937X_DIGITAL_SPARE_0:
+	case WCD937X_DIGITAL_SPARE_1:
+	case WCD937X_DIGITAL_SPARE_2:
+		return true;
+	}
+
+	return false;
+}
+
+static bool wcd937x_readonly_register(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case WCD937X_ANA_MBHC_RESULT_1:
+	case WCD937X_ANA_MBHC_RESULT_2:
+	case WCD937X_ANA_MBHC_RESULT_3:
+	case WCD937X_MBHC_MOISTURE_DET_FSM_STATUS:
+	case WCD937X_TX_1_2_SAR2_ERR:
+	case WCD937X_TX_1_2_SAR1_ERR:
+	case WCD937X_TX_3_SPARE_MONO:
+	case WCD937X_TX_3_SAR1_ERR:
+	case WCD937X_HPH_L_STATUS:
+	case WCD937X_HPH_R_STATUS:
+	case WCD937X_HPH_SURGE_HPHLR_SURGE_STATUS:
+	case WCD937X_EAR_STATUS_REG_1:
+	case WCD937X_EAR_STATUS_REG_2:
+	case WCD937X_MBHC_NEW_FSM_STATUS:
+	case WCD937X_MBHC_NEW_ADC_RESULT:
+	case WCD937X_DIE_CRACK_DIE_CRK_DET_OUT:
+	case WCD937X_AUX_INT_STATUS_REG:
+	case WCD937X_LDORXTX_INT_STATUS:
+	case WCD937X_DIGITAL_CHIP_ID0:
+	case WCD937X_DIGITAL_CHIP_ID1:
+	case WCD937X_DIGITAL_CHIP_ID2:
+	case WCD937X_DIGITAL_CHIP_ID3:
+	case WCD937X_DIGITAL_EFUSE_T_DATA_0:
+	case WCD937X_DIGITAL_EFUSE_T_DATA_1:
+	case WCD937X_DIGITAL_INTR_STATUS_0:
+	case WCD937X_DIGITAL_INTR_STATUS_1:
+	case WCD937X_DIGITAL_INTR_STATUS_2:
+	case WCD937X_DIGITAL_EFUSE_REG_0:
+	case WCD937X_DIGITAL_EFUSE_REG_1:
+	case WCD937X_DIGITAL_EFUSE_REG_2:
+	case WCD937X_DIGITAL_EFUSE_REG_3:
+	case WCD937X_DIGITAL_EFUSE_REG_4:
+	case WCD937X_DIGITAL_EFUSE_REG_5:
+	case WCD937X_DIGITAL_EFUSE_REG_6:
+	case WCD937X_DIGITAL_EFUSE_REG_7:
+	case WCD937X_DIGITAL_EFUSE_REG_8:
+	case WCD937X_DIGITAL_EFUSE_REG_9:
+	case WCD937X_DIGITAL_EFUSE_REG_10:
+	case WCD937X_DIGITAL_EFUSE_REG_11:
+	case WCD937X_DIGITAL_EFUSE_REG_12:
+	case WCD937X_DIGITAL_EFUSE_REG_13:
+	case WCD937X_DIGITAL_EFUSE_REG_14:
+	case WCD937X_DIGITAL_EFUSE_REG_15:
+	case WCD937X_DIGITAL_EFUSE_REG_16:
+	case WCD937X_DIGITAL_EFUSE_REG_17:
+	case WCD937X_DIGITAL_EFUSE_REG_18:
+	case WCD937X_DIGITAL_EFUSE_REG_19:
+	case WCD937X_DIGITAL_EFUSE_REG_20:
+	case WCD937X_DIGITAL_EFUSE_REG_21:
+	case WCD937X_DIGITAL_EFUSE_REG_22:
+	case WCD937X_DIGITAL_EFUSE_REG_23:
+	case WCD937X_DIGITAL_EFUSE_REG_24:
+	case WCD937X_DIGITAL_EFUSE_REG_25:
+	case WCD937X_DIGITAL_EFUSE_REG_26:
+	case WCD937X_DIGITAL_EFUSE_REG_27:
+	case WCD937X_DIGITAL_EFUSE_REG_28:
+	case WCD937X_DIGITAL_EFUSE_REG_29:
+	case WCD937X_DIGITAL_EFUSE_REG_30:
+	case WCD937X_DIGITAL_EFUSE_REG_31:
+		return true;
+	}
+
+	return false;
+}
+
+static bool wcd937x_readable_register(struct device *dev, unsigned int reg)
+{
+	return wcd937x_readonly_register(dev, reg) || wcd937x_rdwr_register(dev, reg);
+}
+
+static const struct regmap_config wcd937x_regmap_config = {
+	.name = "wcd937x_csr",
+	.reg_bits = 32,
+	.val_bits = 8,
+	.cache_type = REGCACHE_MAPLE,
+	.reg_defaults = wcd937x_defaults,
+	.num_reg_defaults = ARRAY_SIZE(wcd937x_defaults),
+	.max_register = WCD937X_MAX_REGISTER,
+	.readable_reg = wcd937x_readable_register,
+	.writeable_reg = wcd937x_rdwr_register,
+	.volatile_reg = wcd937x_readonly_register,
+};
+
+static const struct sdw_slave_ops wcd937x_slave_ops = {
+	.update_status = wcd937x_update_status,
+	.interrupt_callback = wcd937x_interrupt_callback,
+};
+
+static int wcd937x_sdw_component_bind(struct device *dev,
+				      struct device *master, void *data)
+{
+	return 0;
+}
+
+static void wcd937x_sdw_component_unbind(struct device *dev,
+					 struct device *master, void *data)
+{
+}
+
+static const struct component_ops wcd937x_sdw_component_ops = {
+	.bind   = wcd937x_sdw_component_bind,
+	.unbind = wcd937x_sdw_component_unbind,
+};
+
+static int wcd937x_probe(struct sdw_slave *pdev,
+			 const struct sdw_device_id *id)
+{
+	struct device *dev = &pdev->dev;
+	struct wcd937x_sdw_priv *wcd;
+	int ret;
+
+	wcd = devm_kzalloc(dev, sizeof(*wcd), GFP_KERNEL);
+	if (!wcd)
+		return -ENOMEM;
+
+	/* Port map index starts at 0, however the data port for this codec start at index 1 */
+	if (of_property_read_bool(dev->of_node, "qcom,tx-port-mapping")) {
+		wcd->is_tx = true;
+		ret = of_property_read_u32_array(dev->of_node, "qcom,tx-port-mapping",
+						 &pdev->m_port_map[1],
+						 WCD937X_MAX_TX_SWR_PORTS);
+	} else {
+		ret = of_property_read_u32_array(dev->of_node, "qcom,rx-port-mapping",
+						 &pdev->m_port_map[1],
+						 WCD937X_MAX_SWR_PORTS);
+	}
+	if (ret < 0)
+		dev_info(dev, "Error getting static port mapping for %s (%d)\n",
+			 wcd->is_tx ? "TX" : "RX", ret);
+
+	wcd->sdev = pdev;
+	dev_set_drvdata(dev, wcd);
+
+	pdev->prop.scp_int1_mask = SDW_SCP_INT1_IMPL_DEF |
+				   SDW_SCP_INT1_BUS_CLASH |
+				   SDW_SCP_INT1_PARITY;
+	pdev->prop.lane_control_support = true;
+	pdev->prop.simple_clk_stop_capable = true;
+	if (wcd->is_tx) {
+		pdev->prop.source_ports = GENMASK(WCD937X_MAX_TX_SWR_PORTS, 0);
+		pdev->prop.src_dpn_prop = wcd937x_dpn_prop;
+		wcd->ch_info = &wcd937x_sdw_tx_ch_info[0];
+		pdev->prop.wake_capable = true;
+
+		wcd->regmap = devm_regmap_init_sdw(pdev, &wcd937x_regmap_config);
+		if (IS_ERR(wcd->regmap))
+			return dev_err_probe(dev, PTR_ERR(wcd->regmap),
+					     "Regmap init failed\n");
+
+		/* Start in cache-only until device is enumerated */
+		regcache_cache_only(wcd->regmap, true);
+	} else {
+		pdev->prop.sink_ports = GENMASK(WCD937X_MAX_SWR_PORTS, 0);
+		pdev->prop.sink_dpn_prop = wcd937x_dpn_prop;
+		wcd->ch_info = &wcd937x_sdw_rx_ch_info[0];
+	}
+
+	pm_runtime_set_autosuspend_delay(dev, 3000);
+	pm_runtime_use_autosuspend(dev);
+	pm_runtime_mark_last_busy(dev);
+	pm_runtime_set_active(dev);
+	pm_runtime_enable(dev);
+
+	return component_add(dev, &wcd937x_sdw_component_ops);
+}
+
+static const struct sdw_device_id wcd937x_slave_id[] = {
+	SDW_SLAVE_ENTRY(0x0217, 0x10a, 0), /* WCD9370 */
+	{ },
+};
+MODULE_DEVICE_TABLE(sdw, wcd937x_slave_id);
+
+static int wcd937x_sdw_runtime_suspend(struct device *dev)
+{
+	struct wcd937x_sdw_priv *wcd = dev_get_drvdata(dev);
+
+	if (wcd->regmap) {
+		regcache_cache_only(wcd->regmap, true);
+		regcache_mark_dirty(wcd->regmap);
+	}
+
+	return 0;
+}
+
+static int wcd937x_sdw_runtime_resume(struct device *dev)
+{
+	struct wcd937x_sdw_priv *wcd = dev_get_drvdata(dev);
+
+	if (wcd->regmap) {
+		regcache_cache_only(wcd->regmap, false);
+		regcache_sync(wcd->regmap);
+	}
+
+	pm_runtime_mark_last_busy(dev);
+
+	return 0;
+}
+
+static const struct dev_pm_ops wcd937x_sdw_pm_ops = {
+	SET_RUNTIME_PM_OPS(wcd937x_sdw_runtime_suspend, wcd937x_sdw_runtime_resume, NULL)
+};
+
+static struct sdw_driver wcd937x_codec_driver = {
+	.probe = wcd937x_probe,
+	.ops = &wcd937x_slave_ops,
+	.id_table = wcd937x_slave_id,
+	.driver = {
+		.name = "wcd937x-codec",
+		.pm = &wcd937x_sdw_pm_ops,
+	}
+};
+module_sdw_driver(wcd937x_codec_driver);
+
+MODULE_DESCRIPTION("WCD937X SDW codec driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/sound/soc/codecs/wcd937x.c
+++ linux-qcom-6.8.0/sound/soc/codecs/wcd937x.c
@@ -0,0 +1,3068 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <linux/component.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/gpio/consumer.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of_gpio.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+#include <linux/slab.h>
+#include <sound/jack.h>
+#include <sound/pcm_params.h>
+#include <sound/pcm.h>
+#include <sound/soc-dapm.h>
+#include <sound/soc.h>
+#include <sound/tlv.h>
+
+#include "wcd-clsh-v2.h"
+#include "wcd-mbhc-v2.h"
+#include "wcd937x.h"
+
+enum {
+	CHIPID_WCD9370 = 0,
+	CHIPID_WCD9375 = 5,
+};
+
+/* Z value defined in milliohm */
+#define WCD937X_ZDET_VAL_32             (32000)
+#define WCD937X_ZDET_VAL_400            (400000)
+#define WCD937X_ZDET_VAL_1200           (1200000)
+#define WCD937X_ZDET_VAL_100K           (100000000)
+/* Z floating defined in ohms */
+#define WCD937X_ZDET_FLOATING_IMPEDANCE	(0x0FFFFFFE)
+#define WCD937X_ZDET_NUM_MEASUREMENTS   (900)
+#define WCD937X_MBHC_GET_C1(c)          ((c & 0xC000) >> 14)
+#define WCD937X_MBHC_GET_X1(x)          (x & 0x3FFF)
+/* Z value compared in milliOhm */
+#define WCD937X_MBHC_IS_SECOND_RAMP_REQUIRED(z) ((z > 400000) || (z < 32000))
+#define WCD937X_MBHC_ZDET_CONST         (86 * 16384)
+#define WCD937X_MBHC_MOISTURE_RREF      R_24_KOHM
+#define WCD_MBHC_HS_V_MAX           1600
+#define EAR_RX_PATH_AUX		1
+#define WCD937X_MBHC_MAX_BUTTONS	8
+
+#define WCD937X_RATES (SNDRV_PCM_RATE_8000  | SNDRV_PCM_RATE_16000 |\
+		       SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\
+		       SNDRV_PCM_RATE_96000 | SNDRV_PCM_RATE_192000 |\
+		       SNDRV_PCM_RATE_384000)
+
+/* Fractional Rates */
+#define WCD937X_FRAC_RATES (SNDRV_PCM_RATE_44100  | SNDRV_PCM_RATE_88200 |\
+			    SNDRV_PCM_RATE_176400 | SNDRV_PCM_RATE_352800)
+
+#define WCD937X_FORMATS (SNDRV_PCM_FMTBIT_S16_LE  | SNDRV_PCM_FMTBIT_S24_LE |\
+			 SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+enum {
+	ALLOW_BUCK_DISABLE,
+	HPH_COMP_DELAY,
+	HPH_PA_DELAY,
+	AMIC2_BCS_ENABLE,
+};
+
+enum {
+	AIF1_PB = 0,
+	AIF1_CAP,
+	NUM_CODEC_DAIS,
+};
+
+struct wcd937x_priv {
+	struct sdw_slave *tx_sdw_dev;
+	struct sdw_slave *rx_sdw_dev;
+	struct wcd937x_sdw_priv *sdw_priv[NUM_CODEC_DAIS];
+	struct device *txdev;
+	struct device *rxdev;
+	struct device_node *rxnode;
+	struct device_node *txnode;
+	struct regmap *regmap;
+	struct mutex micb_lock;
+	/* mbhc module */
+	struct wcd_mbhc *wcd_mbhc;
+	struct wcd_mbhc_config mbhc_cfg;
+	struct wcd_mbhc_intr intr_ids;
+	struct wcd_clsh_ctrl *clsh_info;
+	struct irq_domain *virq;
+	struct regmap_irq_chip *wcd_regmap_irq_chip;
+	struct regmap_irq_chip_data *irq_chip;
+	struct regulator_bulk_data supplies[WCD937X_MAX_BULK_SUPPLY];
+	struct regulator *buck_supply;
+	struct snd_soc_jack *jack;
+	unsigned long status_mask;
+	s32 micb_ref[WCD937X_MAX_MICBIAS];
+	s32 pullup_ref[WCD937X_MAX_MICBIAS];
+	u32 hph_mode;
+	int ear_rx_path;
+	u32 chipid;
+	int reset_gpio;
+	u32 micb1_mv;
+	u32 micb2_mv;
+	u32 micb3_mv;
+	u32 micb4_mv; /* 9375 only */
+	int hphr_pdm_wd_int;
+	int hphl_pdm_wd_int;
+	int aux_pdm_wd_int;
+	bool comp1_enable;
+	bool comp2_enable;
+
+	struct gpio_desc *us_euro_gpio;
+
+	int dmic_0_1_clk_cnt;
+	int dmic_2_3_clk_cnt;
+	int dmic_4_5_clk_cnt;
+	atomic_t rx_clk_cnt;
+	atomic_t ana_clk_count;
+	bool has_always_on_supplies;
+};
+
+static const DECLARE_TLV_DB_SCALE(line_gain, 0, 7, 1);
+static const DECLARE_TLV_DB_SCALE(analog_gain, 0, 25, 1);
+
+struct wcd937x_mbhc_zdet_param {
+	u16 ldo_ctl;
+	u16 noff;
+	u16 nshift;
+	u16 btn5;
+	u16 btn6;
+	u16 btn7;
+};
+
+static struct wcd_mbhc_field wcd_mbhc_fields[WCD_MBHC_REG_FUNC_MAX] = {
+	WCD_MBHC_FIELD(WCD_MBHC_L_DET_EN, WCD937X_ANA_MBHC_MECH, 0x80),
+	WCD_MBHC_FIELD(WCD_MBHC_GND_DET_EN, WCD937X_ANA_MBHC_MECH, 0x40),
+	WCD_MBHC_FIELD(WCD_MBHC_MECH_DETECTION_TYPE, WCD937X_ANA_MBHC_MECH, 0x20),
+	WCD_MBHC_FIELD(WCD_MBHC_MIC_CLAMP_CTL, WCD937X_MBHC_NEW_PLUG_DETECT_CTL, 0x30),
+	WCD_MBHC_FIELD(WCD_MBHC_ELECT_DETECTION_TYPE, WCD937X_ANA_MBHC_ELECT, 0x08),
+	WCD_MBHC_FIELD(WCD_MBHC_HS_L_DET_PULL_UP_CTRL, WCD937X_MBHC_NEW_INT_MECH_DET_CURRENT, 0x1F),
+	WCD_MBHC_FIELD(WCD_MBHC_HS_L_DET_PULL_UP_COMP_CTRL, WCD937X_ANA_MBHC_MECH, 0x04),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHL_PLUG_TYPE, WCD937X_ANA_MBHC_MECH, 0x10),
+	WCD_MBHC_FIELD(WCD_MBHC_GND_PLUG_TYPE, WCD937X_ANA_MBHC_MECH, 0x08),
+	WCD_MBHC_FIELD(WCD_MBHC_SW_HPH_LP_100K_TO_GND, WCD937X_ANA_MBHC_MECH, 0x01),
+	WCD_MBHC_FIELD(WCD_MBHC_ELECT_SCHMT_ISRC, WCD937X_ANA_MBHC_ELECT, 0x06),
+	WCD_MBHC_FIELD(WCD_MBHC_FSM_EN, WCD937X_ANA_MBHC_ELECT, 0x80),
+	WCD_MBHC_FIELD(WCD_MBHC_INSREM_DBNC, WCD937X_MBHC_NEW_PLUG_DETECT_CTL, 0x0F),
+	WCD_MBHC_FIELD(WCD_MBHC_BTN_DBNC, WCD937X_MBHC_NEW_CTL_1, 0x03),
+	WCD_MBHC_FIELD(WCD_MBHC_HS_VREF, WCD937X_MBHC_NEW_CTL_2, 0x03),
+	WCD_MBHC_FIELD(WCD_MBHC_HS_COMP_RESULT, WCD937X_ANA_MBHC_RESULT_3, 0x08),
+	WCD_MBHC_FIELD(WCD_MBHC_IN2P_CLAMP_STATE, WCD937X_ANA_MBHC_RESULT_3, 0x10),
+	WCD_MBHC_FIELD(WCD_MBHC_MIC_SCHMT_RESULT, WCD937X_ANA_MBHC_RESULT_3, 0x20),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHL_SCHMT_RESULT, WCD937X_ANA_MBHC_RESULT_3, 0x80),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHR_SCHMT_RESULT, WCD937X_ANA_MBHC_RESULT_3, 0x40),
+	WCD_MBHC_FIELD(WCD_MBHC_OCP_FSM_EN, WCD937X_HPH_OCP_CTL, 0x10),
+	WCD_MBHC_FIELD(WCD_MBHC_BTN_RESULT, WCD937X_ANA_MBHC_RESULT_3, 0x07),
+	WCD_MBHC_FIELD(WCD_MBHC_BTN_ISRC_CTL, WCD937X_ANA_MBHC_ELECT, 0x70),
+	WCD_MBHC_FIELD(WCD_MBHC_ELECT_RESULT, WCD937X_ANA_MBHC_RESULT_3, 0xFF),
+	WCD_MBHC_FIELD(WCD_MBHC_MICB_CTRL, WCD937X_ANA_MICB2, 0xC0),
+	WCD_MBHC_FIELD(WCD_MBHC_HPH_CNP_WG_TIME, WCD937X_HPH_CNP_WG_TIME, 0xFF),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHR_PA_EN, WCD937X_ANA_HPH, 0x40),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHL_PA_EN, WCD937X_ANA_HPH, 0x80),
+	WCD_MBHC_FIELD(WCD_MBHC_HPH_PA_EN, WCD937X_ANA_HPH, 0xC0),
+	WCD_MBHC_FIELD(WCD_MBHC_SWCH_LEVEL_REMOVE, WCD937X_ANA_MBHC_RESULT_3, 0x10),
+	WCD_MBHC_FIELD(WCD_MBHC_ANC_DET_EN, WCD937X_MBHC_CTL_BCS, 0x02),
+	WCD_MBHC_FIELD(WCD_MBHC_FSM_STATUS, WCD937X_MBHC_NEW_FSM_STATUS, 0x01),
+	WCD_MBHC_FIELD(WCD_MBHC_MUX_CTL, WCD937X_MBHC_NEW_CTL_2, 0x70),
+	WCD_MBHC_FIELD(WCD_MBHC_MOISTURE_STATUS, WCD937X_MBHC_NEW_FSM_STATUS, 0x20),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHR_GND, WCD937X_HPH_PA_CTL2, 0x40),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHL_GND, WCD937X_HPH_PA_CTL2, 0x10),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHL_OCP_DET_EN, WCD937X_HPH_L_TEST, 0x01),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHR_OCP_DET_EN, WCD937X_HPH_R_TEST, 0x01),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHL_OCP_STATUS, WCD937X_DIGITAL_INTR_STATUS_0, 0x80),
+	WCD_MBHC_FIELD(WCD_MBHC_HPHR_OCP_STATUS, WCD937X_DIGITAL_INTR_STATUS_0, 0x20),
+	WCD_MBHC_FIELD(WCD_MBHC_ADC_EN, WCD937X_MBHC_NEW_CTL_1, 0x08),
+	WCD_MBHC_FIELD(WCD_MBHC_ADC_COMPLETE, WCD937X_MBHC_NEW_FSM_STATUS, 0x40),
+	WCD_MBHC_FIELD(WCD_MBHC_ADC_TIMEOUT, WCD937X_MBHC_NEW_FSM_STATUS, 0x80),
+	WCD_MBHC_FIELD(WCD_MBHC_ADC_RESULT, WCD937X_MBHC_NEW_ADC_RESULT, 0xFF),
+	WCD_MBHC_FIELD(WCD_MBHC_MICB2_VOUT, WCD937X_ANA_MICB2, 0x3F),
+	WCD_MBHC_FIELD(WCD_MBHC_ADC_MODE, WCD937X_MBHC_NEW_CTL_1, 0x10),
+	WCD_MBHC_FIELD(WCD_MBHC_DETECTION_DONE, WCD937X_MBHC_NEW_CTL_1, 0x04),
+	WCD_MBHC_FIELD(WCD_MBHC_ELECT_ISRC_EN, WCD937X_ANA_MBHC_ZDET, 0x02),
+};
+
+static const struct regmap_irq wcd937x_irqs[WCD937X_NUM_IRQS] = {
+	REGMAP_IRQ_REG(WCD937X_IRQ_MBHC_BUTTON_PRESS_DET, 0, BIT(0)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_MBHC_BUTTON_RELEASE_DET, 0, BIT(1)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_MBHC_ELECT_INS_REM_DET, 0, BIT(2)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_MBHC_ELECT_INS_REM_LEG_DET, 0, BIT(3)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_MBHC_SW_DET, 0, BIT(4)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_HPHR_OCP_INT, 0, BIT(5)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_HPHR_CNP_INT, 0, BIT(6)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_HPHL_OCP_INT, 0, BIT(7)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_HPHL_CNP_INT, 1, BIT(0)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_EAR_CNP_INT, 1, BIT(1)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_EAR_SCD_INT, 1, BIT(2)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_AUX_CNP_INT, 1, BIT(3)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_AUX_SCD_INT, 1, BIT(4)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_HPHL_PDM_WD_INT, 1, BIT(5)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_HPHR_PDM_WD_INT, 1, BIT(6)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_AUX_PDM_WD_INT, 1, BIT(7)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_LDORT_SCD_INT, 2, BIT(0)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_MBHC_MOISTURE_INT, 2, BIT(1)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_HPHL_SURGE_DET_INT, 2, BIT(2)),
+	REGMAP_IRQ_REG(WCD937X_IRQ_HPHR_SURGE_DET_INT, 2, BIT(3)),
+};
+
+static int wcd937x_handle_post_irq(void *data)
+{
+	struct wcd937x_priv *wcd937x;
+
+	if (data != NULL)
+		wcd937x = (struct wcd937x_priv *)data;
+	else
+		return IRQ_HANDLED;
+
+	regmap_write(wcd937x->regmap, WCD937X_DIGITAL_INTR_CLEAR_0, 0);
+	regmap_write(wcd937x->regmap, WCD937X_DIGITAL_INTR_CLEAR_1, 0);
+	regmap_write(wcd937x->regmap, WCD937X_DIGITAL_INTR_CLEAR_2, 0);
+
+	return IRQ_HANDLED;
+}
+
+static const u32 wcd937x_config_regs[] = {
+	WCD937X_DIGITAL_INTR_LEVEL_0,
+};
+
+static struct regmap_irq_chip wcd937x_regmap_irq_chip = {
+	.name = "wcd937x",
+	.irqs = wcd937x_irqs,
+	.num_irqs = ARRAY_SIZE(wcd937x_irqs),
+	.num_regs = 3,
+	.status_base = WCD937X_DIGITAL_INTR_STATUS_0,
+	.mask_base = WCD937X_DIGITAL_INTR_MASK_0,
+	.ack_base = WCD937X_DIGITAL_INTR_CLEAR_0,
+	.use_ack = 1,
+	.clear_ack = 1,
+	.config_base = wcd937x_config_regs,
+	.num_config_bases = ARRAY_SIZE(wcd937x_config_regs),
+	.num_config_regs = 1,
+	.runtime_pm = true,
+	.handle_post_irq = wcd937x_handle_post_irq,
+	.irq_drv_data = NULL,
+};
+
+static void wcd937x_reset(struct wcd937x_priv *wcd937x)
+{
+	gpio_direction_output(wcd937x->reset_gpio, 0);
+	usleep_range(20, 30);
+
+	gpio_set_value(wcd937x->reset_gpio, 1);
+	usleep_range(20, 30);
+}
+
+static void wcd937x_io_init(struct regmap *regmap)
+{
+	u32 val = 0, temp = 0, temp1 = 0;
+
+	regmap_read(regmap, WCD937X_DIGITAL_EFUSE_REG_29, &val);
+
+	val = val & 0x0F;
+
+	regmap_read(regmap, WCD937X_DIGITAL_EFUSE_REG_16, &temp);
+	regmap_read(regmap, WCD937X_DIGITAL_EFUSE_REG_17, &temp1);
+
+	if ((temp == 0x02) || temp1 > 0x09)
+		regmap_update_bits(regmap, WCD937X_SLEEP_CTL, 0x0E, val);
+	else
+		regmap_update_bits(regmap, WCD937X_SLEEP_CTL, 0x0e, 0x0e);
+
+
+	regmap_update_bits(regmap, WCD937X_SLEEP_CTL, 0x80, 0x80);
+	usleep_range(1000, 1010);
+
+	regmap_update_bits(regmap, WCD937X_SLEEP_CTL, 0x40, 0x40);
+	usleep_range(1000, 1010);
+
+	regmap_update_bits(regmap, WCD937X_LDORXTX_CONFIG, BIT(4), 0x00);
+	regmap_update_bits(regmap, WCD937X_BIAS_VBG_FINE_ADJ, 0xf0, BIT(7));
+	regmap_update_bits(regmap, WCD937X_ANA_BIAS, BIT(7), BIT(7));
+	regmap_update_bits(regmap, WCD937X_ANA_BIAS, BIT(6), BIT(6));
+	usleep_range(10000, 10010);
+
+	regmap_update_bits(regmap, WCD937X_ANA_BIAS, BIT(6), 0x00);
+	regmap_update_bits(regmap, WCD937X_HPH_SURGE_HPHLR_SURGE_EN, 0xff, 0xd9);
+	regmap_update_bits(regmap, WCD937X_MICB1_TEST_CTL_1, 0xff, 0xfa);
+	regmap_update_bits(regmap, WCD937X_MICB2_TEST_CTL_1, 0xff, 0xfa);
+	regmap_update_bits(regmap, WCD937X_MICB3_TEST_CTL_1, 0xff, 0xfa);
+
+	regmap_update_bits(regmap, WCD937X_MICB1_TEST_CTL_2, 0x38, 0x00);
+	regmap_update_bits(regmap, WCD937X_MICB2_TEST_CTL_2, 0x38, 0x00);
+	regmap_update_bits(regmap, WCD937X_MICB3_TEST_CTL_2, 0x38, 0x00);
+
+	/* Set Bandgap Fine Adjustment to +5mV for Tanggu SMIC part */
+	regmap_read(regmap, WCD937X_DIGITAL_EFUSE_REG_16, &val);
+	if (val == 0x01) {
+		regmap_update_bits(regmap, WCD937X_BIAS_VBG_FINE_ADJ, 0xF0, 0xB0);
+	} else if (val == 0x02) {
+		regmap_update_bits(regmap, WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L, 0x1F, 0x04);
+		regmap_update_bits(regmap, WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_R, 0x1F, 0x04);
+		regmap_update_bits(regmap, WCD937X_BIAS_VBG_FINE_ADJ, 0xF0, 0xB0);
+		regmap_update_bits(regmap, WCD937X_HPH_NEW_INT_RDAC_GAIN_CTL, 0xF0, 0x50);
+	}
+}
+
+static int wcd937x_rx_clk_enable(struct snd_soc_component *component)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	if (atomic_read(&wcd937x->rx_clk_cnt))
+		return 0;
+
+	snd_soc_component_update_bits(component, WCD937X_DIGITAL_CDC_DIG_CLK_CTL, BIT(3), BIT(3));
+	snd_soc_component_update_bits(component, WCD937X_DIGITAL_CDC_ANA_CLK_CTL, BIT(0), BIT(0));
+	snd_soc_component_update_bits(component, WCD937X_ANA_RX_SUPPLIES, BIT(0), BIT(0));
+	snd_soc_component_update_bits(component, WCD937X_DIGITAL_CDC_RX0_CTL, BIT(6), 0x00);
+	snd_soc_component_update_bits(component, WCD937X_DIGITAL_CDC_RX1_CTL, BIT(6), 0x00);
+	snd_soc_component_update_bits(component, WCD937X_DIGITAL_CDC_RX2_CTL, BIT(6), 0x00);
+	snd_soc_component_update_bits(component, WCD937X_DIGITAL_CDC_ANA_CLK_CTL, BIT(1), BIT(1));
+
+	atomic_inc(&wcd937x->rx_clk_cnt);
+
+	return 0;
+}
+
+static int wcd937x_rx_clk_disable(struct snd_soc_component *component)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	if (!atomic_read(&wcd937x->rx_clk_cnt)) {
+		dev_err(component->dev, "clk already disabled\n");
+		return 0;
+	}
+
+	atomic_dec(&wcd937x->rx_clk_cnt);
+
+	snd_soc_component_update_bits(component, WCD937X_ANA_RX_SUPPLIES, BIT(0), 0x00);
+	snd_soc_component_update_bits(component, WCD937X_DIGITAL_CDC_ANA_CLK_CTL, BIT(1), 0x00);
+	snd_soc_component_update_bits(component, WCD937X_DIGITAL_CDC_ANA_CLK_CTL, BIT(0), 0x00);
+
+	return 0;
+}
+
+static int wcd937x_codec_hphl_dac_event(struct snd_soc_dapm_widget *w,
+					struct snd_kcontrol *kcontrol,
+					int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int hph_mode = wcd937x->hph_mode;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		wcd937x_rx_clk_enable(component);
+		snd_soc_component_update_bits(component,
+					      WCD937X_DIGITAL_CDC_DIG_CLK_CTL,
+					      BIT(0), BIT(0));
+		snd_soc_component_update_bits(component,
+					      WCD937X_DIGITAL_CDC_HPH_GAIN_CTL,
+					      BIT(2), BIT(2));
+		snd_soc_component_update_bits(component,
+					      WCD937X_HPH_RDAC_CLK_CTL1,
+					      BIT(7), 0x00);
+		set_bit(HPH_COMP_DELAY, &wcd937x->status_mask);
+		break;
+	case SND_SOC_DAPM_POST_PMU:
+		if (hph_mode == CLS_AB_HIFI || hph_mode == CLS_H_HIFI)
+			snd_soc_component_update_bits(component,
+						      WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L,
+						      0x0f, BIT(1));
+		else if (hph_mode == CLS_H_LOHIFI)
+			snd_soc_component_update_bits(component,
+						      WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L,
+						      0x0f, 0x06);
+
+		if (wcd937x->comp1_enable) {
+			snd_soc_component_update_bits(component,
+						      WCD937X_DIGITAL_CDC_COMP_CTL_0,
+						      BIT(1), BIT(1));
+			snd_soc_component_update_bits(component,
+						      WCD937X_HPH_L_EN,
+						      BIT(5), 0x00);
+
+			if (wcd937x->comp2_enable) {
+				snd_soc_component_update_bits(component,
+					WCD937X_DIGITAL_CDC_COMP_CTL_0,
+					BIT(0), BIT(0));
+				snd_soc_component_update_bits(component,
+					WCD937X_HPH_R_EN, BIT(5), 0x00);
+			}
+
+			if (test_bit(HPH_COMP_DELAY, &wcd937x->status_mask)) {
+				usleep_range(5000, 5110);
+				clear_bit(HPH_COMP_DELAY, &wcd937x->status_mask);
+			}
+		} else {
+			snd_soc_component_update_bits(component,
+						      WCD937X_DIGITAL_CDC_COMP_CTL_0,
+						      BIT(1), 0x00);
+			snd_soc_component_update_bits(component,
+						      WCD937X_HPH_L_EN,
+						      BIT(5), BIT(5));
+		}
+
+		snd_soc_component_update_bits(component,
+					      WCD937X_HPH_NEW_INT_HPH_TIMER1,
+					      BIT(1), 0x00);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		snd_soc_component_update_bits(component,
+			WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L,
+			0x0f, BIT(0));
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_codec_hphr_dac_event(struct snd_soc_dapm_widget *w,
+					struct snd_kcontrol *kcontrol,
+					int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int hph_mode = wcd937x->hph_mode;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		wcd937x_rx_clk_enable(component);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL, BIT(1), BIT(1));
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_HPH_GAIN_CTL, BIT(3), BIT(3));
+		snd_soc_component_update_bits(component,
+				WCD937X_HPH_RDAC_CLK_CTL1, BIT(7), 0x00);
+		set_bit(HPH_COMP_DELAY, &wcd937x->status_mask);
+		break;
+	case SND_SOC_DAPM_POST_PMU:
+		if (hph_mode == CLS_AB_HIFI || hph_mode == CLS_H_HIFI)
+			snd_soc_component_update_bits(component,
+				WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_R,
+				0x0f, BIT(1));
+		else if (hph_mode == CLS_H_LOHIFI)
+			snd_soc_component_update_bits(component,
+				WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_R,
+				0x0f, 0x06);
+		if (wcd937x->comp2_enable) {
+			snd_soc_component_update_bits(component,
+					WCD937X_DIGITAL_CDC_COMP_CTL_0,
+					BIT(0), BIT(0));
+			snd_soc_component_update_bits(component,
+					WCD937X_HPH_R_EN, BIT(5), 0x00);
+			if (wcd937x->comp1_enable) {
+				snd_soc_component_update_bits(component,
+					WCD937X_DIGITAL_CDC_COMP_CTL_0,
+					BIT(1), BIT(1));
+				snd_soc_component_update_bits(component,
+					WCD937X_HPH_L_EN, BIT(5), 0x00);
+			}
+
+			if (test_bit(HPH_COMP_DELAY, &wcd937x->status_mask)) {
+				usleep_range(5000, 5110);
+				clear_bit(HPH_COMP_DELAY, &wcd937x->status_mask);
+			}
+		} else {
+			snd_soc_component_update_bits(component,
+					WCD937X_DIGITAL_CDC_COMP_CTL_0,
+					BIT(0), 0x00);
+			snd_soc_component_update_bits(component,
+					WCD937X_HPH_R_EN, BIT(5), BIT(5));
+		}
+		snd_soc_component_update_bits(component,
+				WCD937X_HPH_NEW_INT_HPH_TIMER1, BIT(1), 0x00);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		snd_soc_component_update_bits(component,
+			WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_R,
+			0x0f, BIT(0));
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_codec_ear_dac_event(struct snd_soc_dapm_widget *w,
+				       struct snd_kcontrol *kcontrol,
+				       int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int hph_mode = wcd937x->hph_mode;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		wcd937x_rx_clk_enable(component);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_HPH_GAIN_CTL,
+				BIT(2), BIT(2));
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL,
+				BIT(0), BIT(0));
+
+		if (hph_mode == CLS_AB_HIFI || hph_mode == CLS_H_HIFI)
+			snd_soc_component_update_bits(component,
+				WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L,
+				0x0f, BIT(1));
+		else if (hph_mode == CLS_H_LOHIFI)
+			snd_soc_component_update_bits(component,
+				WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L,
+				0x0f, 0x06);
+
+		if (wcd937x->comp1_enable)
+			snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_COMP_CTL_0,
+				BIT(1), BIT(1));
+
+		usleep_range(5000, 5010);
+
+		snd_soc_component_update_bits(component, WCD937X_FLYBACK_EN, BIT(2), 0x00);
+		wcd_clsh_ctrl_set_state(wcd937x->clsh_info,
+					WCD_CLSH_EVENT_PRE_DAC,
+					WCD_CLSH_STATE_EAR,
+					hph_mode);
+
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		if (hph_mode == CLS_AB_HIFI || hph_mode == CLS_H_LOHIFI ||
+		    hph_mode == CLS_H_HIFI)
+			snd_soc_component_update_bits(component,
+				WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L,
+				0x0f, BIT(0));
+		if (wcd937x->comp1_enable)
+			snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_COMP_CTL_0,
+				BIT(1), 0x00);
+		break;
+	}
+	return 0;
+
+}
+
+static int wcd937x_codec_aux_dac_event(struct snd_soc_dapm_widget *w,
+				       struct snd_kcontrol *kcontrol,
+				       int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int hph_mode = wcd937x->hph_mode;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		wcd937x_rx_clk_enable(component);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_ANA_CLK_CTL,
+				BIT(2), BIT(2));
+		snd_soc_component_update_bits(component,
+				WCD937X_AUX_AUXPA, BIT(4), BIT(4));
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL,
+				BIT(2), BIT(2));
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_AUX_GAIN_CTL,
+				BIT(0), BIT(0));
+		wcd_clsh_ctrl_set_state(wcd937x->clsh_info,
+					WCD_CLSH_EVENT_PRE_DAC,
+					WCD_CLSH_STATE_AUX,
+					hph_mode);
+
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_ANA_CLK_CTL,
+				BIT(2), 0x00);
+		snd_soc_component_update_bits(component,
+				WCD937X_AUX_AUXPA, BIT(4), 0x00);
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_codec_enable_hphr_pa(struct snd_soc_dapm_widget *w,
+					struct snd_kcontrol *kcontrol,
+					int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int hph_mode = wcd937x->hph_mode;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		wcd_clsh_ctrl_set_state(wcd937x->clsh_info,
+					WCD_CLSH_EVENT_PRE_DAC,
+					WCD_CLSH_STATE_HPHR,
+					hph_mode);
+		snd_soc_component_update_bits(component, WCD937X_ANA_HPH,
+					BIT(4), BIT(4));
+		usleep_range(100, 110);
+		set_bit(HPH_PA_DELAY, &wcd937x->status_mask);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_PDM_WD_CTL1, 0x07, 0x03);
+		break;
+	case SND_SOC_DAPM_POST_PMU:
+		if (test_bit(HPH_PA_DELAY, &wcd937x->status_mask)) {
+			if (wcd937x->comp2_enable)
+				usleep_range(7000, 7100);
+			else
+				usleep_range(20000, 20100);
+			clear_bit(HPH_PA_DELAY, &wcd937x->status_mask);
+		}
+
+		snd_soc_component_update_bits(component,
+				WCD937X_HPH_NEW_INT_HPH_TIMER1,
+				BIT(1), BIT(1));
+		if (hph_mode == CLS_AB || hph_mode == CLS_AB_HIFI)
+			snd_soc_component_update_bits(component,
+				WCD937X_ANA_RX_SUPPLIES,
+				BIT(1), BIT(1));
+		enable_irq(wcd937x->hphr_pdm_wd_int);
+		break;
+	case SND_SOC_DAPM_PRE_PMD:
+		disable_irq_nosync(wcd937x->hphr_pdm_wd_int);
+		set_bit(HPH_PA_DELAY, &wcd937x->status_mask);
+		wcd_mbhc_event_notify(wcd937x->wcd_mbhc, WCD_EVENT_PRE_HPHR_PA_OFF);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		if (test_bit(HPH_PA_DELAY, &wcd937x->status_mask)) {
+			if (wcd937x->comp2_enable)
+				usleep_range(7000, 7100);
+			else
+				usleep_range(20000, 20100);
+			clear_bit(HPH_PA_DELAY, &wcd937x->status_mask);
+		}
+
+		wcd_mbhc_event_notify(wcd937x->wcd_mbhc, WCD_EVENT_POST_HPHR_PA_OFF);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_PDM_WD_CTL1, 0x07, 0x00);
+		snd_soc_component_update_bits(component, WCD937X_ANA_HPH,
+				BIT(4), 0x00);
+		wcd_clsh_ctrl_set_state(wcd937x->clsh_info,
+					WCD_CLSH_EVENT_POST_PA,
+					WCD_CLSH_STATE_HPHR,
+					hph_mode);
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_codec_enable_hphl_pa(struct snd_soc_dapm_widget *w,
+					struct snd_kcontrol *kcontrol,
+					int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int hph_mode = wcd937x->hph_mode;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		wcd_clsh_ctrl_set_state(wcd937x->clsh_info,
+					WCD_CLSH_EVENT_PRE_DAC,
+					WCD_CLSH_STATE_HPHL,
+					hph_mode);
+		snd_soc_component_update_bits(component, WCD937X_ANA_HPH,
+				BIT(5), BIT(5));
+		usleep_range(100, 110);
+		set_bit(HPH_PA_DELAY, &wcd937x->status_mask);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_PDM_WD_CTL0, 0x07, 0x03);
+		break;
+	case SND_SOC_DAPM_POST_PMU:
+		if (test_bit(HPH_PA_DELAY, &wcd937x->status_mask)) {
+			if (!wcd937x->comp1_enable)
+				usleep_range(20000, 20100);
+			else
+				usleep_range(7000, 7100);
+			clear_bit(HPH_PA_DELAY, &wcd937x->status_mask);
+		}
+
+		snd_soc_component_update_bits(component,
+				WCD937X_HPH_NEW_INT_HPH_TIMER1,
+				BIT(1), BIT(1));
+		if (hph_mode == CLS_AB || hph_mode == CLS_AB_HIFI)
+			snd_soc_component_update_bits(component,
+				WCD937X_ANA_RX_SUPPLIES,
+				BIT(1), BIT(1));
+		enable_irq(wcd937x->hphl_pdm_wd_int);
+		break;
+	case SND_SOC_DAPM_PRE_PMD:
+		disable_irq_nosync(wcd937x->hphl_pdm_wd_int);
+		set_bit(HPH_PA_DELAY, &wcd937x->status_mask);
+		wcd_mbhc_event_notify(wcd937x->wcd_mbhc, WCD_EVENT_PRE_HPHL_PA_OFF);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		if (test_bit(HPH_PA_DELAY, &wcd937x->status_mask)) {
+			if (!wcd937x->comp1_enable)
+				usleep_range(20000, 20100);
+			else
+				usleep_range(7000, 7100);
+			clear_bit(HPH_PA_DELAY, &wcd937x->status_mask);
+		}
+
+		wcd_mbhc_event_notify(wcd937x->wcd_mbhc, WCD_EVENT_POST_HPHL_PA_OFF);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_PDM_WD_CTL0, 0x07, 0x00);
+		snd_soc_component_update_bits(component, WCD937X_ANA_HPH,
+				BIT(5), 0x00);
+		wcd_clsh_ctrl_set_state(wcd937x->clsh_info,
+					WCD_CLSH_EVENT_POST_PA,
+					WCD_CLSH_STATE_HPHL,
+					hph_mode);
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_codec_enable_aux_pa(struct snd_soc_dapm_widget *w,
+				       struct snd_kcontrol *kcontrol,
+				       int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int hph_mode = wcd937x->hph_mode;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_PDM_WD_CTL2, BIT(0), BIT(0));
+		break;
+	case SND_SOC_DAPM_POST_PMU:
+		usleep_range(1000, 1010);
+		if (hph_mode == CLS_AB || hph_mode == CLS_AB_HIFI)
+			snd_soc_component_update_bits(component,
+					WCD937X_ANA_RX_SUPPLIES,
+					BIT(1), BIT(1));
+			snd_soc_component_update_bits(component,
+					WCD937X_ANA_RX_SUPPLIES,
+					BIT(6), BIT(6));
+			snd_soc_component_update_bits(component,
+					WCD937X_ANA_RX_SUPPLIES,
+					BIT(7), BIT(7));
+		enable_irq(wcd937x->aux_pdm_wd_int);
+		break;
+	case SND_SOC_DAPM_PRE_PMD:
+		disable_irq_nosync(wcd937x->aux_pdm_wd_int);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		usleep_range(2000, 2010);
+		wcd_clsh_ctrl_set_state(wcd937x->clsh_info,
+					WCD_CLSH_EVENT_POST_PA,
+					WCD_CLSH_STATE_AUX,
+					hph_mode);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_PDM_WD_CTL2, BIT(0), 0x00);
+		snd_soc_component_update_bits(component,
+					WCD937X_ANA_RX_SUPPLIES, BIT(6), 0x00);
+		snd_soc_component_update_bits(component,
+					WCD937X_ANA_RX_SUPPLIES, BIT(7), 0x00);
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_codec_enable_ear_pa(struct snd_soc_dapm_widget *w,
+				       struct snd_kcontrol *kcontrol,
+				       int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int hph_mode = wcd937x->hph_mode;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		/* Enable watchdog interrupt for HPHL or AUX depending on mux value */
+		wcd937x->ear_rx_path = snd_soc_component_read(component,
+					WCD937X_DIGITAL_CDC_EAR_PATH_CTL);
+
+		if (wcd937x->ear_rx_path & EAR_RX_PATH_AUX)
+			snd_soc_component_update_bits(component,
+					WCD937X_DIGITAL_PDM_WD_CTL2,
+					BIT(0), BIT(0));
+		else
+			snd_soc_component_update_bits(component,
+					WCD937X_DIGITAL_PDM_WD_CTL0,
+					0x07, 0x03);
+
+		if (!wcd937x->comp1_enable)
+			snd_soc_component_update_bits(component,
+				WCD937X_ANA_EAR_COMPANDER_CTL, BIT(7), BIT(7));
+		break;
+	case SND_SOC_DAPM_POST_PMU:
+		usleep_range(6000, 6010);
+		if (hph_mode == CLS_AB || hph_mode == CLS_AB_HIFI)
+			snd_soc_component_update_bits(component,
+					WCD937X_ANA_RX_SUPPLIES,
+					BIT(1), BIT(1));
+
+		if (wcd937x->ear_rx_path & EAR_RX_PATH_AUX)
+			enable_irq(wcd937x->aux_pdm_wd_int);
+		else
+			enable_irq(wcd937x->hphl_pdm_wd_int);
+		break;
+	case SND_SOC_DAPM_PRE_PMD:
+		if (wcd937x->ear_rx_path & EAR_RX_PATH_AUX)
+			disable_irq_nosync(wcd937x->aux_pdm_wd_int);
+		else
+			disable_irq_nosync(wcd937x->hphl_pdm_wd_int);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		if (!wcd937x->comp1_enable)
+			snd_soc_component_update_bits(component,
+				WCD937X_ANA_EAR_COMPANDER_CTL, BIT(7), 0x00);
+
+		usleep_range(7000, 7010);
+		wcd_clsh_ctrl_set_state(wcd937x->clsh_info,
+					WCD_CLSH_EVENT_POST_PA,
+					WCD_CLSH_STATE_EAR,
+					hph_mode);
+		snd_soc_component_update_bits(component, WCD937X_FLYBACK_EN,
+				BIT(2), BIT(2));
+
+		if (wcd937x->ear_rx_path & EAR_RX_PATH_AUX)
+			snd_soc_component_update_bits(component,
+					WCD937X_DIGITAL_PDM_WD_CTL2,
+					BIT(0), 0x00);
+		else
+			snd_soc_component_update_bits(component,
+					WCD937X_DIGITAL_PDM_WD_CTL0,
+					0x07, 0x00);
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_enable_rx1(struct snd_soc_dapm_widget *w,
+			      struct snd_kcontrol *kcontrol,
+			      int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+
+	if (event == SND_SOC_DAPM_POST_PMD) {
+		wcd937x_rx_clk_disable(component);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL,
+				BIT(0), 0x00);
+	}
+
+	return 0;
+}
+
+static int wcd937x_enable_rx2(struct snd_soc_dapm_widget *w,
+			      struct snd_kcontrol *kcontrol, int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+
+	if (event == SND_SOC_DAPM_POST_PMD) {
+		wcd937x_rx_clk_disable(component);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL,
+				BIT(1), 0x00);
+	}
+
+	return 0;
+}
+
+static int wcd937x_enable_rx3(struct snd_soc_dapm_widget *w,
+			      struct snd_kcontrol *kcontrol,
+			      int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+
+	if (event == SND_SOC_DAPM_POST_PMD) {
+		usleep_range(6000, 6010);
+		wcd937x_rx_clk_disable(component);
+		snd_soc_component_update_bits(component,
+			WCD937X_DIGITAL_CDC_DIG_CLK_CTL, BIT(2), 0x00);
+	}
+
+	return 0;
+}
+
+static int wcd937x_codec_enable_dmic(struct snd_soc_dapm_widget *w,
+				     struct snd_kcontrol *kcontrol,
+				     int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	u16 dmic_clk_reg;
+
+	switch (w->shift) {
+	case 0:
+	case 1:
+		dmic_clk_reg = WCD937X_DIGITAL_CDC_DMIC1_CTL;
+		break;
+	case 2:
+	case 3:
+		dmic_clk_reg = WCD937X_DIGITAL_CDC_DMIC2_CTL;
+		break;
+	case 4:
+	case 5:
+		dmic_clk_reg = WCD937X_DIGITAL_CDC_DMIC3_CTL;
+		break;
+	default:
+		dev_err(component->dev, "Invalid DMIC Selection\n");
+		return -EINVAL;
+	}
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		snd_soc_component_update_bits(component,
+			WCD937X_DIGITAL_CDC_DIG_CLK_CTL, BIT(7), BIT(7));
+		snd_soc_component_update_bits(component,
+			dmic_clk_reg, 0x07, BIT(1));
+		snd_soc_component_update_bits(component,
+			dmic_clk_reg, BIT(3), BIT(3));
+		snd_soc_component_update_bits(component,
+			dmic_clk_reg, 0x70, BIT(5));
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_get_micb_vout_ctl_val(u32 micb_mv)
+{
+	if (micb_mv < 1000 || micb_mv > 2850) {
+		pr_err("Unsupported micbias voltage (%u mV)\n", micb_mv);
+		return -EINVAL;
+	}
+
+	return (micb_mv - 1000) / 50;
+}
+
+static int wcd937x_tx_swr_ctrl(struct snd_soc_dapm_widget *w,
+			       struct snd_kcontrol *kcontrol, int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	bool use_amic3 = snd_soc_component_read(component, WCD937X_TX_NEW_TX_CH2_SEL) & BIT(7);
+
+	/* Enable BCS for Headset mic */
+	if (event == SND_SOC_DAPM_PRE_PMU && strnstr(w->name, "ADC", sizeof("ADC")))
+		if (w->shift == 1 && !use_amic3)
+			set_bit(AMIC2_BCS_ENABLE, &wcd937x->status_mask);
+
+	return 0;
+}
+
+static int wcd937x_codec_enable_adc(struct snd_soc_dapm_widget *w,
+				    struct snd_kcontrol *kcontrol, int event)
+{
+
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		atomic_inc(&wcd937x->ana_clk_count);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL, BIT(7), BIT(7));
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_ANA_CLK_CTL, BIT(3), BIT(3));
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_ANA_CLK_CTL, BIT(4), BIT(4));
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		if (w->shift == 1 && test_bit(AMIC2_BCS_ENABLE, &wcd937x->status_mask))
+			clear_bit(AMIC2_BCS_ENABLE, &wcd937x->status_mask);
+
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_ANA_CLK_CTL, BIT(3), 0x00);
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_enable_req(struct snd_soc_dapm_widget *w,
+			      struct snd_kcontrol *kcontrol, int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_REQ_CTL, BIT(1), BIT(1));
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_REQ_CTL, BIT(0), 0x00);
+		snd_soc_component_update_bits(component,
+				WCD937X_ANA_TX_CH2, BIT(6), BIT(6));
+		snd_soc_component_update_bits(component,
+				WCD937X_ANA_TX_CH3_HPF, BIT(6), BIT(6));
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL, 0x70, 0x70);
+		snd_soc_component_update_bits(component,
+				WCD937X_ANA_TX_CH1, BIT(7), BIT(7));
+		snd_soc_component_update_bits(component,
+				WCD937X_ANA_TX_CH2, BIT(6), 0x00);
+		snd_soc_component_update_bits(component,
+				WCD937X_ANA_TX_CH2, BIT(7), BIT(7));
+		snd_soc_component_update_bits(component,
+				WCD937X_ANA_TX_CH3, BIT(7), BIT(7));
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		snd_soc_component_update_bits(component,
+				WCD937X_ANA_TX_CH1, BIT(7), 0x00);
+		snd_soc_component_update_bits(component,
+				WCD937X_ANA_TX_CH2, BIT(7), 0x00);
+		snd_soc_component_update_bits(component,
+				WCD937X_ANA_TX_CH3, BIT(7), 0x00);
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL, BIT(4), 0x00);
+
+		atomic_dec(&wcd937x->ana_clk_count);
+		if (atomic_read(&wcd937x->ana_clk_count) <= 0) {
+			snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_ANA_CLK_CTL, BIT(4), 0x00);
+			atomic_set(&wcd937x->ana_clk_count, 0);
+		}
+
+		snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL, BIT(7), 0x00);
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_micbias_control(struct snd_soc_component *component,
+				int micb_num, int req, bool is_dapm)
+{
+
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int pre_off_event = 0, post_off_event = 0;
+	int post_on_event = 0, post_dapm_off = 0;
+	int micb_index = micb_num - 1;
+	int post_dapm_on = 0;
+	u16 micb_reg;
+
+	if ((micb_index < 0) || (micb_index > WCD937X_MAX_MICBIAS - 1)) {
+		dev_err(component->dev, "Invalid micbias index, micb_ind:%d\n", micb_index);
+		return -EINVAL;
+	}
+	switch (micb_num) {
+	case MIC_BIAS_1:
+		micb_reg = WCD937X_ANA_MICB1;
+		break;
+	case MIC_BIAS_2:
+		micb_reg = WCD937X_ANA_MICB2;
+		pre_off_event = WCD_EVENT_PRE_MICBIAS_2_OFF;
+		post_off_event = WCD_EVENT_POST_MICBIAS_2_OFF;
+		post_on_event = WCD_EVENT_POST_MICBIAS_2_ON;
+		post_dapm_on = WCD_EVENT_POST_DAPM_MICBIAS_2_ON;
+		post_dapm_off = WCD_EVENT_POST_DAPM_MICBIAS_2_OFF;
+		break;
+	case MIC_BIAS_3:
+		micb_reg = WCD937X_ANA_MICB3;
+		break;
+	default:
+		dev_err(component->dev, "Invalid micbias number: %d\n", micb_num);
+		return -EINVAL;
+	}
+
+	mutex_lock(&wcd937x->micb_lock);
+	switch (req) {
+	case MICB_PULLUP_ENABLE:
+		wcd937x->pullup_ref[micb_index]++;
+		if ((wcd937x->pullup_ref[micb_index] == 1) &&
+		    (wcd937x->micb_ref[micb_index] == 0))
+			snd_soc_component_update_bits(component, micb_reg,
+				0xc0, BIT(7));
+		break;
+	case MICB_PULLUP_DISABLE:
+		if (wcd937x->pullup_ref[micb_index] > 0)
+			wcd937x->pullup_ref[micb_index]++;
+		if ((wcd937x->pullup_ref[micb_index] == 0) &&
+		    (wcd937x->micb_ref[micb_index] == 0))
+			snd_soc_component_update_bits(component, micb_reg,
+				0xc0, 0x00);
+		break;
+	case MICB_ENABLE:
+		wcd937x->micb_ref[micb_index]++;
+		atomic_inc(&wcd937x->ana_clk_count);
+		if (wcd937x->micb_ref[micb_index] == 1) {
+			snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_DIG_CLK_CTL, 0xf0, 0xf0);
+			snd_soc_component_update_bits(component,
+				WCD937X_DIGITAL_CDC_ANA_CLK_CTL, BIT(4), BIT(4));
+			snd_soc_component_update_bits(component,
+				WCD937X_MICB1_TEST_CTL_2, BIT(0), BIT(0));
+			snd_soc_component_update_bits(component,
+				WCD937X_MICB2_TEST_CTL_2, BIT(0), BIT(0));
+			snd_soc_component_update_bits(component,
+				WCD937X_MICB3_TEST_CTL_2, BIT(0), BIT(0));
+			snd_soc_component_update_bits(component,
+				micb_reg, 0xc0, BIT(6));
+
+			if (micb_num  == MIC_BIAS_2)
+				wcd_mbhc_event_notify(wcd937x->wcd_mbhc,
+						WCD_EVENT_POST_MICBIAS_2_ON);
+
+			if (micb_num  == MIC_BIAS_2 && is_dapm)
+				wcd_mbhc_event_notify(wcd937x->wcd_mbhc,
+						WCD_EVENT_POST_DAPM_MICBIAS_2_ON);
+		}
+		break;
+	case MICB_DISABLE:
+		atomic_dec(&wcd937x->ana_clk_count);
+		if (wcd937x->micb_ref[micb_index] > 0)
+			wcd937x->micb_ref[micb_index]--;
+		if ((wcd937x->micb_ref[micb_index] == 0) &&
+		    (wcd937x->pullup_ref[micb_index] > 0))
+			snd_soc_component_update_bits(component, micb_reg,
+				0xc0, BIT(7));
+		else if ((wcd937x->micb_ref[micb_index] == 0) &&
+			 (wcd937x->pullup_ref[micb_index] == 0)) {
+			if (micb_num  == MIC_BIAS_2)
+				wcd_mbhc_event_notify(wcd937x->wcd_mbhc,
+						WCD_EVENT_PRE_MICBIAS_2_OFF);
+
+			snd_soc_component_update_bits(component, micb_reg,
+				0xc0, 0x00);
+			if (micb_num  == MIC_BIAS_2)
+				wcd_mbhc_event_notify(wcd937x->wcd_mbhc,
+						WCD_EVENT_POST_MICBIAS_2_OFF);
+		}
+
+		if (is_dapm && micb_num  == MIC_BIAS_2)
+			wcd_mbhc_event_notify(wcd937x->wcd_mbhc,
+					WCD_EVENT_POST_DAPM_MICBIAS_2_OFF);
+		if (atomic_read(&wcd937x->ana_clk_count) <= 0) {
+			snd_soc_component_update_bits(component,
+					    WCD937X_DIGITAL_CDC_ANA_CLK_CTL,
+					    BIT(4), 0x00);
+			atomic_set(&wcd937x->ana_clk_count, 0);
+		}
+		break;
+	}
+	mutex_unlock(&wcd937x->micb_lock);
+
+	return 0;
+}
+
+static int __wcd937x_codec_enable_micbias(struct snd_soc_dapm_widget *w,
+					  int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	int micb_num;
+
+	if (strnstr(w->name, "MIC BIAS1", sizeof("MIC BIAS1")))
+		micb_num = MIC_BIAS_1;
+	else if (strnstr(w->name, "MIC BIAS2", sizeof("MIC BIAS2")))
+		micb_num = MIC_BIAS_2;
+	else if (strnstr(w->name, "MIC BIAS3", sizeof("MIC BIAS3")))
+		micb_num = MIC_BIAS_3;
+	else
+		return -EINVAL;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		wcd937x_micbias_control(component, micb_num,
+				MICB_ENABLE, true);
+		break;
+	case SND_SOC_DAPM_POST_PMU:
+		usleep_range(1000, 1100);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		wcd937x_micbias_control(component, micb_num,
+				MICB_DISABLE, true);
+		break;
+	}
+
+	return 0;
+
+}
+
+static int wcd937x_codec_enable_micbias(struct snd_soc_dapm_widget *w,
+					struct snd_kcontrol *kcontrol,
+					int event)
+{
+	return __wcd937x_codec_enable_micbias(w, event);
+}
+
+static int __wcd937x_codec_enable_micbias_pullup(struct snd_soc_dapm_widget *w,
+						 int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	int micb_num;
+
+	if (strnstr(w->name, "VA MIC BIAS1", sizeof("VA MIC BIAS1")))
+		micb_num = MIC_BIAS_1;
+	else if (strnstr(w->name, "VA MIC BIAS2", sizeof("VA MIC BIAS2")))
+		micb_num = MIC_BIAS_2;
+	else if (strnstr(w->name, "VA MIC BIAS3", sizeof("VA MIC BIAS3")))
+		micb_num = MIC_BIAS_3;
+	else
+		return -EINVAL;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		wcd937x_micbias_control(component, micb_num, MICB_PULLUP_ENABLE, true);
+		break;
+	case SND_SOC_DAPM_POST_PMU:
+		usleep_range(1000, 1100);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		wcd937x_micbias_control(component, micb_num, MICB_PULLUP_DISABLE, true);
+		break;
+	}
+
+	return 0;
+
+}
+
+static int wcd937x_codec_enable_micbias_pullup(struct snd_soc_dapm_widget *w,
+					       struct snd_kcontrol *kcontrol,
+					       int event)
+{
+	return __wcd937x_codec_enable_micbias_pullup(w, event);
+}
+
+static int wcd937x_rx_hph_mode_get(struct snd_kcontrol *kcontrol,
+				 struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	ucontrol->value.integer.value[0] = wcd937x->hph_mode;
+	return 0;
+}
+
+static int wcd937x_rx_hph_mode_put(struct snd_kcontrol *kcontrol,
+				 struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component =
+				snd_soc_kcontrol_component(kcontrol);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	u32 mode_val;
+
+	mode_val = ucontrol->value.enumerated.item[0];
+	if (!mode_val) {
+		dev_warn(component->dev, "Invalid HPH Mode, default to class_AB\n");
+		mode_val = CLS_AB;
+	}
+
+	wcd937x->hph_mode = mode_val;
+
+	return 0;
+}
+
+static int wcd937x_ear_pa_gain_get(struct snd_kcontrol *kcontrol,
+				   struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+	u8 ear_pa_gain;
+
+	ear_pa_gain = snd_soc_component_read(component, WCD937X_ANA_EAR_COMPANDER_CTL);
+
+	ucontrol->value.integer.value[0] = FIELD_GET(WCD937X_EAR_GAIN_MASK, ear_pa_gain);
+
+	return 0;
+}
+
+static int wcd937x_ear_pa_gain_put(struct snd_kcontrol *kcontrol,
+				struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	u8 ear_pa_gain = 0;
+
+	ear_pa_gain = ucontrol->value.integer.value[0] << 2;
+
+	if (!wcd937x->comp1_enable) {
+		snd_soc_component_update_bits(component,
+					      WCD937X_ANA_EAR_COMPANDER_CTL,
+					      0x7c, ear_pa_gain);
+	}
+
+	return 0;
+}
+
+static int wcd937x_connect_port(struct wcd937x_sdw_priv *wcd, u8 port_idx, u8 ch_id, bool enable)
+{
+	struct sdw_port_config *port_config = &wcd->port_config[port_idx - 1];
+	struct wcd937x_sdw_ch_info *ch_info = &wcd->ch_info[ch_id];
+	u8 port_num = ch_info->port_num;
+	u8 ch_mask = ch_info->ch_mask;
+
+	port_config->num = port_num;
+
+	if (enable)
+		port_config->ch_mask |= ch_mask;
+	else
+		port_config->ch_mask &= ~ch_mask;
+
+	return 0;
+}
+
+static int wcd937x_get_compander(struct snd_kcontrol *kcontrol,
+				 struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	struct soc_mixer_control *mc;
+	bool hphr;
+
+	mc = (struct soc_mixer_control *)(kcontrol->private_value);
+	hphr = mc->shift;
+
+	ucontrol->value.integer.value[0] = hphr ? wcd937x->comp2_enable :
+						  wcd937x->comp1_enable;
+	return 0;
+}
+
+static int wcd937x_set_compander(struct snd_kcontrol *kcontrol,
+				 struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	struct wcd937x_sdw_priv *wcd = wcd937x->sdw_priv[AIF1_PB];
+	int value = ucontrol->value.integer.value[0];
+	struct soc_mixer_control *mc;
+	int portidx;
+	bool hphr;
+
+	mc = (struct soc_mixer_control *)(kcontrol->private_value);
+	hphr = mc->shift;
+
+	if (hphr)
+		wcd937x->comp2_enable = value;
+	else
+		wcd937x->comp1_enable = value;
+
+	portidx = wcd->ch_info[mc->reg].port_num;
+
+	wcd937x_connect_port(wcd, portidx, mc->reg, !!value);
+
+	return 1;
+}
+
+static int wcd937x_codec_enable_vdd_buck(struct snd_soc_dapm_widget *w,
+					 struct snd_kcontrol *kcontrol,
+					 int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int ret = 0;
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		if (test_bit(ALLOW_BUCK_DISABLE, &wcd937x->status_mask)) {
+			dev_err(component->dev, "buck already in enabled state\n");
+			clear_bit(ALLOW_BUCK_DISABLE, &wcd937x->status_mask);
+			return 0;
+		}
+
+		if (!wcd937x->has_always_on_supplies) {
+			ret = regulator_enable(wcd937x->buck_supply);
+			if (ret) {
+				dev_err(component->dev, "VDD_BUCK is not enabled\n");
+				return ret;
+			}
+		}
+
+		clear_bit(ALLOW_BUCK_DISABLE, &wcd937x->status_mask);
+		usleep_range(200, 250);
+		break;
+	case SND_SOC_DAPM_POST_PMD:
+		set_bit(ALLOW_BUCK_DISABLE, &wcd937x->status_mask);
+		break;
+	}
+
+	return 0;
+}
+
+static int wcd937x_get_swr_port(struct snd_kcontrol *kcontrol,
+			    struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mixer = (struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_component *comp = snd_soc_kcontrol_component(kcontrol);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(comp);
+	struct wcd937x_sdw_priv *wcd;
+	int dai_id = mixer->shift;
+	int ch_idx = mixer->reg;
+	int portidx;
+
+	wcd = wcd937x->sdw_priv[dai_id];
+	portidx = wcd->ch_info[ch_idx].port_num;
+
+	ucontrol->value.integer.value[0] = wcd->port_enable[portidx];
+
+	return 0;
+}
+
+static int wcd937x_set_swr_port(struct snd_kcontrol *kcontrol,
+				struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mixer = (struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_component *comp = snd_soc_kcontrol_component(kcontrol);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(comp);
+	struct wcd937x_sdw_priv *wcd;
+	int dai_id = mixer->shift;
+	int ch_idx = mixer->reg;
+	int portidx;
+	bool enable;
+
+	wcd = wcd937x->sdw_priv[dai_id];
+
+	portidx = wcd->ch_info[ch_idx].port_num;
+
+	enable = !!ucontrol->value.integer.value[0];
+
+	wcd->port_enable[portidx] = enable;
+	wcd937x_connect_port(wcd, portidx, ch_idx, enable);
+
+	return 1;
+}
+
+static const char * const rx_hph_mode_mux_text[] = {
+	"CLS_H_INVALID", "CLS_H_HIFI", "CLS_H_LP", "CLS_AB", "CLS_H_LOHIFI",
+	"CLS_H_ULP", "CLS_AB_HIFI",
+};
+
+const char * const tx_master_ch_text[] = {
+	"ZERO", "SWRM_TX1_CH1", "SWRM_TX1_CH2", "SWRM_TX1_CH3", "SWRM_TX1_CH4",
+	"SWRM_TX2_CH1", "SWRM_TX2_CH2", "SWRM_TX2_CH3", "SWRM_TX2_CH4",
+	"SWRM_TX3_CH1", "SWRM_TX3_CH2", "SWRM_TX3_CH3", "SWRM_TX3_CH4",
+	"SWRM_PCM_IN",
+};
+
+const struct soc_enum tx_master_ch_enum =
+	SOC_ENUM_SINGLE_EXT(ARRAY_SIZE(tx_master_ch_text), tx_master_ch_text);
+
+static const char * const wcd937x_ear_pa_gain_text[] = {
+	"G_6_DB", "G_4P5_DB", "G_3_DB", "G_1P5_DB", "G_0_DB",
+	"G_M1P5_DB", "G_M3_DB", "G_M4P5_DB",
+	"G_M6_DB", "G_7P5_DB", "G_M9_DB",
+	"G_M10P5_DB", "G_M12_DB", "G_M13P5_DB",
+	"G_M15_DB", "G_M16P5_DB", "G_M18_DB",
+};
+
+static const struct soc_enum rx_hph_mode_mux_enum =
+	SOC_ENUM_SINGLE_EXT(ARRAY_SIZE(rx_hph_mode_mux_text), rx_hph_mode_mux_text);
+
+static SOC_ENUM_SINGLE_EXT_DECL(wcd937x_ear_pa_gain_enum,
+				wcd937x_ear_pa_gain_text);
+
+
+/* MBHC related */
+
+
+static void wcd937x_mbhc_clk_setup(struct snd_soc_component *component,
+				   bool enable)
+{
+	snd_soc_component_write_field(component, WCD937X_MBHC_NEW_CTL_1,
+				      WCD937X_MBHC_CTL_RCO_EN_MASK, enable);
+}
+
+static void wcd937x_mbhc_mbhc_bias_control(struct snd_soc_component *component,
+					   bool enable)
+{
+	snd_soc_component_write_field(component, WCD937X_ANA_MBHC_ELECT,
+				      WCD937X_ANA_MBHC_BIAS_EN, enable);
+}
+
+static void wcd937x_mbhc_program_btn_thr(struct snd_soc_component *component,
+					 int *btn_low, int *btn_high,
+					 int num_btn, bool is_micbias)
+{
+	int i, vth;
+
+	if (num_btn > WCD_MBHC_DEF_BUTTONS) {
+		dev_err(component->dev, "%s: invalid number of buttons: %d\n",
+			__func__, num_btn);
+		return;
+	}
+
+	for (i = 0; i < num_btn; i++) {
+		vth = ((btn_high[i] * 2) / 25) & 0x3F;
+		snd_soc_component_write_field(component, WCD937X_ANA_MBHC_BTN0 + i,
+					   WCD937X_MBHC_BTN_VTH_MASK, vth);
+	}
+}
+
+static bool wcd937x_mbhc_micb_en_status(struct snd_soc_component *component, int micb_num)
+{
+	u8 val;
+
+	if (micb_num == MIC_BIAS_2) {
+		val = snd_soc_component_read_field(component,
+						   WCD937X_ANA_MICB2,
+						   WCD937X_ANA_MICB2_ENABLE_MASK);
+		if (val == WCD937X_MICB_ENABLE)
+			return true;
+	}
+	return false;
+}
+
+static void wcd937x_mbhc_hph_l_pull_up_control(struct snd_soc_component *component,
+							int pull_up_cur)
+{
+	/* Default pull up current to 2uA */
+	if (pull_up_cur > HS_PULLUP_I_OFF || pull_up_cur < HS_PULLUP_I_3P0_UA)
+		pull_up_cur = HS_PULLUP_I_2P0_UA;
+
+	snd_soc_component_write_field(component,
+				      WCD937X_MBHC_NEW_INT_MECH_DET_CURRENT,
+				      WCD937X_HSDET_PULLUP_C_MASK, pull_up_cur);
+}
+
+static int wcd937x_mbhc_request_micbias(struct snd_soc_component *component,
+					int micb_num, int req)
+{
+	return wcd937x_micbias_control(component, micb_num, req, false);
+}
+
+static void wcd937x_mbhc_micb_ramp_control(struct snd_soc_component *component,
+					   bool enable)
+{
+	if (enable) {
+		snd_soc_component_write_field(component, WCD937X_ANA_MICB2_RAMP,
+				    WCD937X_RAMP_SHIFT_CTRL_MASK, 0x0C);
+		snd_soc_component_write_field(component, WCD937X_ANA_MICB2_RAMP,
+				    WCD937X_RAMP_EN_MASK, 1);
+	} else {
+		snd_soc_component_write_field(component, WCD937X_ANA_MICB2_RAMP,
+				    WCD937X_RAMP_EN_MASK, 0);
+		snd_soc_component_write_field(component, WCD937X_ANA_MICB2_RAMP,
+				    WCD937X_RAMP_SHIFT_CTRL_MASK, 0);
+	}
+}
+
+static int wcd937x_mbhc_micb_adjust_voltage(struct snd_soc_component *component,
+					    int req_volt, int micb_num)
+{
+	struct wcd937x_priv *wcd937x =  snd_soc_component_get_drvdata(component);
+	int cur_vout_ctl, req_vout_ctl, micb_reg, micb_en, ret = 0;
+
+	switch (micb_num) {
+	case MIC_BIAS_1:
+		micb_reg = WCD937X_ANA_MICB1;
+		break;
+	case MIC_BIAS_2:
+		micb_reg = WCD937X_ANA_MICB2;
+		break;
+	case MIC_BIAS_3:
+		micb_reg = WCD937X_ANA_MICB3;
+		break;
+	default:
+		return -EINVAL;
+	}
+	mutex_lock(&wcd937x->micb_lock);
+	/*
+	 * If requested micbias voltage is same as current micbias
+	 * voltage, then just return. Otherwise, adjust voltage as
+	 * per requested value. If micbias is already enabled, then
+	 * to avoid slow micbias ramp-up or down enable pull-up
+	 * momentarily, change the micbias value and then re-enable
+	 * micbias.
+	 */
+	micb_en = snd_soc_component_read_field(component, micb_reg,
+						WCD937X_MICB_EN_MASK);
+	cur_vout_ctl = snd_soc_component_read_field(component, micb_reg,
+						    WCD937X_MICB_VOUT_MASK);
+
+	req_vout_ctl = wcd937x_get_micb_vout_ctl_val(req_volt);
+	if (req_vout_ctl < 0) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	if (cur_vout_ctl == req_vout_ctl) {
+		ret = 0;
+		goto exit;
+	}
+
+	if (micb_en == WCD937X_MICB_ENABLE)
+		snd_soc_component_write_field(component, micb_reg,
+					      WCD937X_MICB_EN_MASK,
+					      WCD937X_MICB_PULL_UP);
+
+	snd_soc_component_write_field(component, micb_reg,
+				      WCD937X_MICB_VOUT_MASK,
+				      req_vout_ctl);
+
+	if (micb_en == WCD937X_MICB_ENABLE) {
+		snd_soc_component_write_field(component, micb_reg,
+					      WCD937X_MICB_EN_MASK,
+					      WCD937X_MICB_ENABLE);
+		/*
+		 * Add 2ms delay as per HW requirement after enabling
+		 * micbias
+		 */
+		usleep_range(2000, 2100);
+	}
+exit:
+	mutex_unlock(&wcd937x->micb_lock);
+	return ret;
+}
+
+static int wcd937x_mbhc_micb_ctrl_threshold_mic(struct snd_soc_component *component,
+						int micb_num, bool req_en)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int micb_mv;
+
+	if (micb_num != MIC_BIAS_2)
+		return -EINVAL;
+	/*
+	 * If device tree micbias level is already above the minimum
+	 * voltage needed to detect threshold microphone, then do
+	 * not change the micbias, just return.
+	 */
+	if (wcd937x->micb2_mv >= WCD_MBHC_THR_HS_MICB_MV)
+		return 0;
+
+	micb_mv = req_en ? WCD_MBHC_THR_HS_MICB_MV : wcd937x->micb2_mv;
+
+	return wcd937x_mbhc_micb_adjust_voltage(component, micb_mv, MIC_BIAS_2);
+}
+
+static void wcd937x_mbhc_get_result_params(struct snd_soc_component *component,
+						s16 *d1_a, u16 noff,
+						int32_t *zdet)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int i;
+	int val, val1;
+	s16 c1;
+	s32 x1, d1;
+	int32_t denom;
+	static const int minCode_param[] = {
+		3277, 1639, 820, 410, 205, 103, 52, 26
+	};
+
+	regmap_update_bits(wcd937x->regmap, WCD937X_ANA_MBHC_ZDET, 0x20, 0x20);
+	for (i = 0; i < WCD937X_ZDET_NUM_MEASUREMENTS; i++) {
+		regmap_read(wcd937x->regmap, WCD937X_ANA_MBHC_RESULT_2, &val);
+		if (val & 0x80)
+			break;
+	}
+	val = val << 0x8;
+	regmap_read(wcd937x->regmap, WCD937X_ANA_MBHC_RESULT_1, &val1);
+	val |= val1;
+	regmap_update_bits(wcd937x->regmap, WCD937X_ANA_MBHC_ZDET, 0x20, 0x00);
+	x1 = WCD937X_MBHC_GET_X1(val);
+	c1 = WCD937X_MBHC_GET_C1(val);
+	/* If ramp is not complete, give additional 5ms */
+	if ((c1 < 2) && x1)
+		usleep_range(5000, 5050);
+
+	if (!c1 || !x1) {
+		dev_err(component->dev, "Impedance detect ramp error, c1=%d, x1=0x%x\n",
+			c1, x1);
+		goto ramp_down;
+	}
+	d1 = d1_a[c1];
+	denom = (x1 * d1) - (1 << (14 - noff));
+	if (denom > 0)
+		*zdet = (WCD937X_MBHC_ZDET_CONST * 1000) / denom;
+	else if (x1 < minCode_param[noff])
+		*zdet = WCD937X_ZDET_FLOATING_IMPEDANCE;
+
+	dev_err(component->dev, "%s: d1=%d, c1=%d, x1=0x%x, z_val=%d (milliohm)\n",
+		__func__, d1, c1, x1, *zdet);
+ramp_down:
+	i = 0;
+	while (x1) {
+		regmap_read(wcd937x->regmap,
+				 WCD937X_ANA_MBHC_RESULT_1, &val);
+		regmap_read(wcd937x->regmap,
+				 WCD937X_ANA_MBHC_RESULT_2, &val1);
+		val = val << 0x08;
+		val |= val1;
+		x1 = WCD937X_MBHC_GET_X1(val);
+		i++;
+		if (i == WCD937X_ZDET_NUM_MEASUREMENTS)
+			break;
+	}
+}
+
+static void wcd937x_mbhc_zdet_ramp(struct snd_soc_component *component,
+				 struct wcd937x_mbhc_zdet_param *zdet_param,
+				 int32_t *zl, int32_t *zr, s16 *d1_a)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	int32_t zdet = 0;
+
+	snd_soc_component_write_field(component, WCD937X_MBHC_NEW_ZDET_ANA_CTL,
+				WCD937X_ZDET_MAXV_CTL_MASK, zdet_param->ldo_ctl);
+	snd_soc_component_update_bits(component, WCD937X_ANA_MBHC_BTN5,
+				    WCD937X_VTH_MASK, zdet_param->btn5);
+	snd_soc_component_update_bits(component, WCD937X_ANA_MBHC_BTN6,
+				      WCD937X_VTH_MASK, zdet_param->btn6);
+	snd_soc_component_update_bits(component, WCD937X_ANA_MBHC_BTN7,
+				     WCD937X_VTH_MASK, zdet_param->btn7);
+	snd_soc_component_write_field(component, WCD937X_MBHC_NEW_ZDET_ANA_CTL,
+				WCD937X_ZDET_RANGE_CTL_MASK, zdet_param->noff);
+	snd_soc_component_update_bits(component, WCD937X_MBHC_NEW_ZDET_RAMP_CTL,
+				0x0F, zdet_param->nshift);
+
+	if (!zl)
+		goto z_right;
+	/* Start impedance measurement for HPH_L */
+	regmap_update_bits(wcd937x->regmap,
+			   WCD937X_ANA_MBHC_ZDET, 0x80, 0x80);
+	wcd937x_mbhc_get_result_params(component, d1_a, zdet_param->noff, &zdet);
+	regmap_update_bits(wcd937x->regmap,
+			   WCD937X_ANA_MBHC_ZDET, 0x80, 0x00);
+
+	*zl = zdet;
+
+z_right:
+	if (!zr)
+		return;
+	/* Start impedance measurement for HPH_R */
+	regmap_update_bits(wcd937x->regmap,
+			   WCD937X_ANA_MBHC_ZDET, 0x40, 0x40);
+	wcd937x_mbhc_get_result_params(component, d1_a, zdet_param->noff, &zdet);
+	regmap_update_bits(wcd937x->regmap,
+			   WCD937X_ANA_MBHC_ZDET, 0x40, 0x00);
+
+	*zr = zdet;
+}
+
+static void wcd937x_wcd_mbhc_qfuse_cal(struct snd_soc_component *component,
+					int32_t *z_val, int flag_l_r)
+{
+	s16 q1;
+	int q1_cal;
+
+	if (*z_val < (WCD937X_ZDET_VAL_400/1000))
+		q1 = snd_soc_component_read(component,
+			WCD937X_DIGITAL_EFUSE_REG_23 + (2 * flag_l_r));
+	else
+		q1 = snd_soc_component_read(component,
+			WCD937X_DIGITAL_EFUSE_REG_24 + (2 * flag_l_r));
+	if (q1 & 0x80)
+		q1_cal = (10000 - ((q1 & 0x7F) * 25));
+	else
+		q1_cal = (10000 + (q1 * 25));
+	if (q1_cal > 0)
+		*z_val = ((*z_val) * 10000) / q1_cal;
+}
+
+static void wcd937x_wcd_mbhc_calc_impedance(struct snd_soc_component *component,
+					    uint32_t *zl, uint32_t *zr)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	s16 reg0, reg1, reg2, reg3, reg4;
+	int32_t z1L, z1R, z1Ls;
+	int zMono, z_diff1, z_diff2;
+	bool is_fsm_disable = false;
+	struct wcd937x_mbhc_zdet_param zdet_param[] = {
+		{4, 0, 4, 0x08, 0x14, 0x18}, /* < 32ohm */
+		{2, 0, 3, 0x18, 0x7C, 0x90}, /* 32ohm < Z < 400ohm */
+		{1, 4, 5, 0x18, 0x7C, 0x90}, /* 400ohm < Z < 1200ohm */
+		{1, 6, 7, 0x18, 0x7C, 0x90}, /* >1200ohm */
+	};
+	struct wcd937x_mbhc_zdet_param *zdet_param_ptr = NULL;
+	s16 d1_a[][4] = {
+		{0, 30, 90, 30},
+		{0, 30, 30, 5},
+		{0, 30, 30, 5},
+		{0, 30, 30, 5},
+	};
+	s16 *d1 = NULL;
+
+	reg0 = snd_soc_component_read(component, WCD937X_ANA_MBHC_BTN5);
+	reg1 = snd_soc_component_read(component, WCD937X_ANA_MBHC_BTN6);
+	reg2 = snd_soc_component_read(component, WCD937X_ANA_MBHC_BTN7);
+	reg3 = snd_soc_component_read(component, WCD937X_MBHC_CTL_CLK);
+	reg4 = snd_soc_component_read(component, WCD937X_MBHC_NEW_ZDET_ANA_CTL);
+
+	if (snd_soc_component_read(component, WCD937X_ANA_MBHC_ELECT) & 0x80) {
+		is_fsm_disable = true;
+		regmap_update_bits(wcd937x->regmap,
+				   WCD937X_ANA_MBHC_ELECT, 0x80, 0x00);
+	}
+
+	/* For NO-jack, disable L_DET_EN before Z-det measurements */
+	if (wcd937x->mbhc_cfg.hphl_swh)
+		regmap_update_bits(wcd937x->regmap,
+				   WCD937X_ANA_MBHC_MECH, 0x80, 0x00);
+
+	/* Turn off 100k pull down on HPHL */
+	regmap_update_bits(wcd937x->regmap,
+			   WCD937X_ANA_MBHC_MECH, 0x01, 0x00);
+
+	/* Disable surge protection before impedance detection.
+	 * This is done to give correct value for high impedance.
+	 */
+	regmap_update_bits(wcd937x->regmap,
+			   WCD937X_HPH_SURGE_HPHLR_SURGE_EN, 0xC0, 0x00);
+	/* 1ms delay needed after disable surge protection */
+	usleep_range(1000, 1010);
+
+	/* First get impedance on Left */
+	d1 = d1_a[1];
+	zdet_param_ptr = &zdet_param[1];
+	wcd937x_mbhc_zdet_ramp(component, zdet_param_ptr, &z1L, NULL, d1);
+
+	if (!WCD937X_MBHC_IS_SECOND_RAMP_REQUIRED(z1L))
+		goto left_ch_impedance;
+
+	/* Second ramp for left ch */
+	if (z1L < WCD937X_ZDET_VAL_32) {
+		zdet_param_ptr = &zdet_param[0];
+		d1 = d1_a[0];
+	} else if ((z1L > WCD937X_ZDET_VAL_400) &&
+		  (z1L <= WCD937X_ZDET_VAL_1200)) {
+		zdet_param_ptr = &zdet_param[2];
+		d1 = d1_a[2];
+	} else if (z1L > WCD937X_ZDET_VAL_1200) {
+		zdet_param_ptr = &zdet_param[3];
+		d1 = d1_a[3];
+	}
+	wcd937x_mbhc_zdet_ramp(component, zdet_param_ptr, &z1L, NULL, d1);
+
+left_ch_impedance:
+	if ((z1L == WCD937X_ZDET_FLOATING_IMPEDANCE) ||
+		(z1L > WCD937X_ZDET_VAL_100K)) {
+		*zl = WCD937X_ZDET_FLOATING_IMPEDANCE;
+		zdet_param_ptr = &zdet_param[1];
+		d1 = d1_a[1];
+	} else {
+		*zl = z1L/1000;
+		wcd937x_wcd_mbhc_qfuse_cal(component, zl, 0);
+	}
+
+	/* Start of right impedance ramp and calculation */
+	wcd937x_mbhc_zdet_ramp(component, zdet_param_ptr, NULL, &z1R, d1);
+	if (WCD937X_MBHC_IS_SECOND_RAMP_REQUIRED(z1R)) {
+		if (((z1R > WCD937X_ZDET_VAL_1200) &&
+			(zdet_param_ptr->noff == 0x6)) ||
+			((*zl) != WCD937X_ZDET_FLOATING_IMPEDANCE))
+			goto right_ch_impedance;
+		/* Second ramp for right ch */
+		if (z1R < WCD937X_ZDET_VAL_32) {
+			zdet_param_ptr = &zdet_param[0];
+			d1 = d1_a[0];
+		} else if ((z1R > WCD937X_ZDET_VAL_400) &&
+			(z1R <= WCD937X_ZDET_VAL_1200)) {
+			zdet_param_ptr = &zdet_param[2];
+			d1 = d1_a[2];
+		} else if (z1R > WCD937X_ZDET_VAL_1200) {
+			zdet_param_ptr = &zdet_param[3];
+			d1 = d1_a[3];
+		}
+		wcd937x_mbhc_zdet_ramp(component, zdet_param_ptr, NULL, &z1R, d1);
+	}
+right_ch_impedance:
+	if ((z1R == WCD937X_ZDET_FLOATING_IMPEDANCE) ||
+		(z1R > WCD937X_ZDET_VAL_100K)) {
+		*zr = WCD937X_ZDET_FLOATING_IMPEDANCE;
+	} else {
+		*zr = z1R/1000;
+		wcd937x_wcd_mbhc_qfuse_cal(component, zr, 1);
+	}
+
+	/* Mono/stereo detection */
+	if ((*zl == WCD937X_ZDET_FLOATING_IMPEDANCE) &&
+		(*zr == WCD937X_ZDET_FLOATING_IMPEDANCE)) {
+		dev_err(component->dev,
+			"%s: plug type is invalid or extension cable\n",
+			__func__);
+		goto zdet_complete;
+	}
+	if ((*zl == WCD937X_ZDET_FLOATING_IMPEDANCE) ||
+	    (*zr == WCD937X_ZDET_FLOATING_IMPEDANCE) ||
+	    ((*zl < WCD_MONO_HS_MIN_THR) && (*zr > WCD_MONO_HS_MIN_THR)) ||
+	    ((*zl > WCD_MONO_HS_MIN_THR) && (*zr < WCD_MONO_HS_MIN_THR))) {
+		wcd_mbhc_set_hph_type(wcd937x->wcd_mbhc, WCD_MBHC_HPH_MONO);
+		goto zdet_complete;
+	}
+	snd_soc_component_write_field(component, WCD937X_HPH_R_ATEST,
+				      WCD937X_HPHPA_GND_OVR_MASK, 1);
+	snd_soc_component_write_field(component, WCD937X_HPH_PA_CTL2,
+				      WCD937X_HPHPA_GND_R_MASK, 1);
+	if (*zl < (WCD937X_ZDET_VAL_32/1000))
+		wcd937x_mbhc_zdet_ramp(component, &zdet_param[0], &z1Ls, NULL, d1);
+	else
+		wcd937x_mbhc_zdet_ramp(component, &zdet_param[1], &z1Ls, NULL, d1);
+	snd_soc_component_write_field(component, WCD937X_HPH_PA_CTL2,
+				      WCD937X_HPHPA_GND_R_MASK, 0);
+	snd_soc_component_write_field(component, WCD937X_HPH_R_ATEST,
+				      WCD937X_HPHPA_GND_OVR_MASK, 0);
+	z1Ls /= 1000;
+	wcd937x_wcd_mbhc_qfuse_cal(component, &z1Ls, 0);
+	/* Parallel of left Z and 9 ohm pull down resistor */
+	zMono = ((*zl) * 9) / ((*zl) + 9);
+	z_diff1 = (z1Ls > zMono) ? (z1Ls - zMono) : (zMono - z1Ls);
+	z_diff2 = ((*zl) > z1Ls) ? ((*zl) - z1Ls) : (z1Ls - (*zl));
+	if ((z_diff1 * (*zl + z1Ls)) > (z_diff2 * (z1Ls + zMono)))
+		wcd_mbhc_set_hph_type(wcd937x->wcd_mbhc, WCD_MBHC_HPH_STEREO);
+	else
+		wcd_mbhc_set_hph_type(wcd937x->wcd_mbhc, WCD_MBHC_HPH_MONO);
+
+	/* Enable surge protection again after impedance detection */
+	regmap_update_bits(wcd937x->regmap,
+			   WCD937X_HPH_SURGE_HPHLR_SURGE_EN, 0xC0, 0xC0);
+zdet_complete:
+	snd_soc_component_write(component, WCD937X_ANA_MBHC_BTN5, reg0);
+	snd_soc_component_write(component, WCD937X_ANA_MBHC_BTN6, reg1);
+	snd_soc_component_write(component, WCD937X_ANA_MBHC_BTN7, reg2);
+	/* Turn on 100k pull down on HPHL */
+	regmap_update_bits(wcd937x->regmap,
+			   WCD937X_ANA_MBHC_MECH, 0x01, 0x01);
+
+	/* For NO-jack, re-enable L_DET_EN after Z-det measurements */
+	if (wcd937x->mbhc_cfg.hphl_swh)
+		regmap_update_bits(wcd937x->regmap,
+				   WCD937X_ANA_MBHC_MECH, 0x80, 0x80);
+
+	snd_soc_component_write(component, WCD937X_MBHC_NEW_ZDET_ANA_CTL, reg4);
+	snd_soc_component_write(component, WCD937X_MBHC_CTL_CLK, reg3);
+	if (is_fsm_disable)
+		regmap_update_bits(wcd937x->regmap,
+				   WCD937X_ANA_MBHC_ELECT, 0x80, 0x80);
+}
+
+static void wcd937x_mbhc_gnd_det_ctrl(struct snd_soc_component *component,
+			bool enable)
+{
+	if (enable) {
+		snd_soc_component_write_field(component, WCD937X_ANA_MBHC_MECH,
+					      WCD937X_MBHC_HSG_PULLUP_COMP_EN, 1);
+		snd_soc_component_write_field(component, WCD937X_ANA_MBHC_MECH,
+					      WCD937X_MBHC_GND_DET_EN_MASK, 1);
+	} else {
+		snd_soc_component_write_field(component, WCD937X_ANA_MBHC_MECH,
+					      WCD937X_MBHC_GND_DET_EN_MASK, 0);
+		snd_soc_component_write_field(component, WCD937X_ANA_MBHC_MECH,
+					      WCD937X_MBHC_HSG_PULLUP_COMP_EN, 0);
+	}
+}
+
+static void wcd937x_mbhc_hph_pull_down_ctrl(struct snd_soc_component *component,
+					  bool enable)
+{
+	snd_soc_component_write_field(component, WCD937X_HPH_PA_CTL2,
+				      WCD937X_HPHPA_GND_R_MASK, enable);
+	snd_soc_component_write_field(component, WCD937X_HPH_PA_CTL2,
+				      WCD937X_HPHPA_GND_L_MASK, enable);
+}
+
+static void wcd937x_mbhc_moisture_config(struct snd_soc_component *component)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	if (wcd937x->mbhc_cfg.moist_rref == R_OFF) {
+		snd_soc_component_write_field(component, WCD937X_MBHC_NEW_CTL_2,
+				    WCD937X_M_RTH_CTL_MASK, R_OFF);
+		return;
+	}
+
+	/* Do not enable moisture detection if jack type is NC */
+	if (!wcd937x->mbhc_cfg.hphl_swh) {
+		dev_err(component->dev, "%s: disable moisture detection for NC\n",
+			__func__);
+		snd_soc_component_write_field(component, WCD937X_MBHC_NEW_CTL_2,
+				    WCD937X_M_RTH_CTL_MASK, R_OFF);
+		return;
+	}
+
+	snd_soc_component_write_field(component, WCD937X_MBHC_NEW_CTL_2,
+			    WCD937X_M_RTH_CTL_MASK, wcd937x->mbhc_cfg.moist_rref);
+}
+
+static void wcd937x_mbhc_moisture_detect_en(struct snd_soc_component *component, bool enable)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	if (enable)
+		snd_soc_component_write_field(component, WCD937X_MBHC_NEW_CTL_2,
+					WCD937X_M_RTH_CTL_MASK, wcd937x->mbhc_cfg.moist_rref);
+	else
+		snd_soc_component_write_field(component, WCD937X_MBHC_NEW_CTL_2,
+				    WCD937X_M_RTH_CTL_MASK, R_OFF);
+}
+
+static bool wcd937x_mbhc_get_moisture_status(struct snd_soc_component *component)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	bool ret = false;
+
+	if (wcd937x->mbhc_cfg.moist_rref == R_OFF) {
+		snd_soc_component_write_field(component, WCD937X_MBHC_NEW_CTL_2,
+				    WCD937X_M_RTH_CTL_MASK, R_OFF);
+		goto done;
+	}
+
+	/* Do not enable moisture detection if jack type is NC */
+	if (!wcd937x->mbhc_cfg.hphl_swh) {
+		dev_err(component->dev, "%s: disable moisture detection for NC\n",
+			__func__);
+		snd_soc_component_write_field(component, WCD937X_MBHC_NEW_CTL_2,
+				    WCD937X_M_RTH_CTL_MASK, R_OFF);
+		goto done;
+	}
+
+	/*
+	 * If moisture_en is already enabled, then skip to plug type
+	 * detection.
+	 */
+	if (snd_soc_component_read_field(component, WCD937X_MBHC_NEW_CTL_2, WCD937X_M_RTH_CTL_MASK))
+		goto done;
+
+	wcd937x_mbhc_moisture_detect_en(component, true);
+	/* Read moisture comparator status */
+	ret = ((snd_soc_component_read(component, WCD937X_MBHC_NEW_FSM_STATUS)
+				& 0x20) ? 0 : 1);
+
+done:
+	return ret;
+
+}
+
+static void wcd937x_mbhc_moisture_polling_ctrl(struct snd_soc_component *component,
+						bool enable)
+{
+	snd_soc_component_write_field(component,
+			      WCD937X_MBHC_NEW_INT_MOISTURE_DET_POLLING_CTRL,
+			      WCD937X_MOISTURE_EN_POLLING_MASK, enable);
+}
+
+static const struct wcd_mbhc_cb mbhc_cb = {
+	.clk_setup = wcd937x_mbhc_clk_setup,
+	.mbhc_bias = wcd937x_mbhc_mbhc_bias_control,
+	.set_btn_thr = wcd937x_mbhc_program_btn_thr,
+	.micbias_enable_status = wcd937x_mbhc_micb_en_status,
+	.hph_pull_up_control_v2 = wcd937x_mbhc_hph_l_pull_up_control,
+	.mbhc_micbias_control = wcd937x_mbhc_request_micbias,
+	.mbhc_micb_ramp_control = wcd937x_mbhc_micb_ramp_control,
+	.mbhc_micb_ctrl_thr_mic = wcd937x_mbhc_micb_ctrl_threshold_mic,
+	.compute_impedance = wcd937x_wcd_mbhc_calc_impedance,
+	.mbhc_gnd_det_ctrl = wcd937x_mbhc_gnd_det_ctrl,
+	.hph_pull_down_ctrl = wcd937x_mbhc_hph_pull_down_ctrl,
+	.mbhc_moisture_config = wcd937x_mbhc_moisture_config,
+	.mbhc_get_moisture_status = wcd937x_mbhc_get_moisture_status,
+	.mbhc_moisture_polling_ctrl = wcd937x_mbhc_moisture_polling_ctrl,
+	.mbhc_moisture_detect_en = wcd937x_mbhc_moisture_detect_en,
+};
+
+static int wcd937x_get_hph_type(struct snd_kcontrol *kcontrol,
+			      struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	ucontrol->value.integer.value[0] = wcd_mbhc_get_hph_type(wcd937x->wcd_mbhc);
+
+	return 0;
+}
+
+static int wcd937x_hph_impedance_get(struct snd_kcontrol *kcontrol,
+				   struct snd_ctl_elem_value *ucontrol)
+{
+	uint32_t zl, zr;
+	bool hphr;
+	struct soc_mixer_control *mc;
+	struct snd_soc_component *component =
+					snd_soc_kcontrol_component(kcontrol);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	mc = (struct soc_mixer_control *)(kcontrol->private_value);
+	hphr = mc->shift;
+	wcd_mbhc_get_impedance(wcd937x->wcd_mbhc, &zl, &zr);
+	ucontrol->value.integer.value[0] = hphr ? zr : zl;
+
+	return 0;
+}
+
+static const struct snd_kcontrol_new hph_type_detect_controls[] = {
+	SOC_SINGLE_EXT("HPH Type", 0, 0, WCD_MBHC_HPH_STEREO, 0,
+		       wcd937x_get_hph_type, NULL),
+};
+
+static const struct snd_kcontrol_new impedance_detect_controls[] = {
+	SOC_SINGLE_EXT("HPHL Impedance", 0, 0, INT_MAX, 0,
+		       wcd937x_hph_impedance_get, NULL),
+	SOC_SINGLE_EXT("HPHR Impedance", 0, 1, INT_MAX, 0,
+		       wcd937x_hph_impedance_get, NULL),
+};
+
+static int wcd937x_mbhc_init(struct snd_soc_component *component)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	struct wcd_mbhc_intr *intr_ids = &wcd937x->intr_ids;
+
+	intr_ids->mbhc_sw_intr = regmap_irq_get_virq(wcd937x->irq_chip,
+						    WCD937X_IRQ_MBHC_SW_DET);
+	intr_ids->mbhc_btn_press_intr = regmap_irq_get_virq(wcd937x->irq_chip,
+							   WCD937X_IRQ_MBHC_BUTTON_PRESS_DET);
+	intr_ids->mbhc_btn_release_intr = regmap_irq_get_virq(wcd937x->irq_chip,
+							     WCD937X_IRQ_MBHC_BUTTON_RELEASE_DET);
+	intr_ids->mbhc_hs_ins_intr = regmap_irq_get_virq(wcd937x->irq_chip,
+							WCD937X_IRQ_MBHC_ELECT_INS_REM_LEG_DET);
+	intr_ids->mbhc_hs_rem_intr = regmap_irq_get_virq(wcd937x->irq_chip,
+							WCD937X_IRQ_MBHC_ELECT_INS_REM_DET);
+	intr_ids->hph_left_ocp = regmap_irq_get_virq(wcd937x->irq_chip,
+						    WCD937X_IRQ_HPHL_OCP_INT);
+	intr_ids->hph_right_ocp = regmap_irq_get_virq(wcd937x->irq_chip,
+						     WCD937X_IRQ_HPHR_OCP_INT);
+
+	wcd937x->wcd_mbhc = wcd_mbhc_init(component, &mbhc_cb, intr_ids, wcd_mbhc_fields, true);
+	if (IS_ERR(wcd937x->wcd_mbhc))
+		return PTR_ERR(wcd937x->wcd_mbhc);
+
+	snd_soc_add_component_controls(component, impedance_detect_controls,
+				       ARRAY_SIZE(impedance_detect_controls));
+	snd_soc_add_component_controls(component, hph_type_detect_controls,
+				       ARRAY_SIZE(hph_type_detect_controls));
+
+	return 0;
+}
+
+static void wcd937x_mbhc_deinit(struct snd_soc_component *component)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	wcd_mbhc_deinit(wcd937x->wcd_mbhc);
+}
+
+/* END MBHC */
+
+static const struct snd_kcontrol_new wcd937x_snd_controls[] = {
+	SOC_ENUM_EXT("EAR PA GAIN", wcd937x_ear_pa_gain_enum,
+		wcd937x_ear_pa_gain_get, wcd937x_ear_pa_gain_put),
+	SOC_ENUM_EXT("RX HPH Mode", rx_hph_mode_mux_enum,
+		wcd937x_rx_hph_mode_get, wcd937x_rx_hph_mode_put),
+
+	SOC_SINGLE_EXT("HPHL_COMP Switch", SND_SOC_NOPM, 0, 1, 0,
+		wcd937x_get_compander, wcd937x_set_compander),
+	SOC_SINGLE_EXT("HPHR_COMP Switch", SND_SOC_NOPM, 1, 1, 0,
+		wcd937x_get_compander, wcd937x_set_compander),
+
+	SOC_SINGLE_TLV("HPHL Volume", WCD937X_HPH_L_EN, 0, 20, 1, line_gain),
+	SOC_SINGLE_TLV("HPHR Volume", WCD937X_HPH_R_EN, 0, 20, 1, line_gain),
+	SOC_SINGLE_TLV("ADC1 Volume", WCD937X_ANA_TX_CH1, 0, 20, 0, analog_gain),
+	SOC_SINGLE_TLV("ADC2 Volume", WCD937X_ANA_TX_CH2, 0, 20, 0, analog_gain),
+	SOC_SINGLE_TLV("ADC3 Volume", WCD937X_ANA_TX_CH3, 0, 20, 0, analog_gain),
+
+	SOC_SINGLE_EXT("HPHL Switch", WCD937X_HPH_L, 0, 1, 0,
+		wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("HPHR Switch", WCD937X_HPH_R, 0, 1, 0,
+		wcd937x_get_swr_port, wcd937x_set_swr_port),
+
+	SOC_SINGLE_EXT("ADC1 Switch", WCD937X_ADC1, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("ADC2 Switch", WCD937X_ADC2, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("ADC3 Switch", WCD937X_ADC3, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("DMIC0 Switch", WCD937X_DMIC0, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("DMIC1 Switch", WCD937X_DMIC1, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("MBHC Switch", WCD937X_MBHC, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("DMIC2 Switch", WCD937X_DMIC2, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("DMIC3 Switch", WCD937X_DMIC3, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("DMIC4 Switch", WCD937X_DMIC4, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+	SOC_SINGLE_EXT("DMIC5 Switch", WCD937X_DMIC5, 1, 1, 0,
+		       wcd937x_get_swr_port, wcd937x_set_swr_port),
+};
+
+static const struct snd_kcontrol_new adc1_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new adc2_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new adc3_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new dmic1_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new dmic2_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new dmic3_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new dmic4_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new dmic5_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new dmic6_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new ear_rdac_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new aux_rdac_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new hphl_rdac_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const struct snd_kcontrol_new hphr_rdac_switch[] = {
+	SOC_DAPM_SINGLE("Switch", SND_SOC_NOPM, 0, 1, 0)
+};
+
+static const char * const adc2_mux_text[] = {
+	"INP2", "INP3"
+};
+
+static const char * const rdac3_mux_text[] = {
+	"RX1", "RX3"
+};
+
+static const struct soc_enum adc2_enum =
+	SOC_ENUM_SINGLE(WCD937X_TX_NEW_TX_CH2_SEL, 7,
+			ARRAY_SIZE(adc2_mux_text), adc2_mux_text);
+
+
+static const struct soc_enum rdac3_enum =
+	SOC_ENUM_SINGLE(WCD937X_DIGITAL_CDC_EAR_PATH_CTL, 0,
+			ARRAY_SIZE(rdac3_mux_text), rdac3_mux_text);
+
+static const struct snd_kcontrol_new tx_adc2_mux = SOC_DAPM_ENUM("ADC2 MUX Mux", adc2_enum);
+
+static const struct snd_kcontrol_new rx_rdac3_mux = SOC_DAPM_ENUM("RDAC3_MUX Mux", rdac3_enum);
+
+static const struct snd_soc_dapm_widget wcd937x_dapm_widgets[] = {
+
+	/* Input widgets */
+	SND_SOC_DAPM_INPUT("AMIC1"),
+	SND_SOC_DAPM_INPUT("AMIC2"),
+	SND_SOC_DAPM_INPUT("AMIC3"),
+	SND_SOC_DAPM_INPUT("IN1_HPHL"),
+	SND_SOC_DAPM_INPUT("IN2_HPHR"),
+	SND_SOC_DAPM_INPUT("IN3_AUX"),
+
+	/* TX widgets */
+	SND_SOC_DAPM_ADC_E("ADC1", NULL, SND_SOC_NOPM, 0, 0,
+			   wcd937x_codec_enable_adc,
+			   SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_ADC_E("ADC2", NULL, SND_SOC_NOPM, 1, 0,
+			   wcd937x_codec_enable_adc,
+			   SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+	SND_SOC_DAPM_MIXER_E("ADC1 REQ", SND_SOC_NOPM, 0, 0,
+			     NULL, 0, wcd937x_enable_req,
+			     SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("ADC2 REQ", SND_SOC_NOPM, 0, 0,
+			     NULL, 0, wcd937x_enable_req,
+			     SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+	SND_SOC_DAPM_MUX("ADC2 MUX", SND_SOC_NOPM, 0, 0, &tx_adc2_mux),
+
+	/* TX mixers */
+	SND_SOC_DAPM_MIXER_E("ADC1_MIXER", SND_SOC_NOPM, 0, 0,
+			     adc1_switch, ARRAY_SIZE(adc1_switch),
+			     wcd937x_tx_swr_ctrl, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("ADC2_MIXER", SND_SOC_NOPM, 1, 0,
+			     adc2_switch, ARRAY_SIZE(adc2_switch),
+			     wcd937x_tx_swr_ctrl, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+
+	/* MIC_BIAS widgets */
+	SND_SOC_DAPM_SUPPLY("MIC BIAS1", SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_enable_micbias,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_SUPPLY("MIC BIAS2", SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_enable_micbias,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_SUPPLY("MIC BIAS3", SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_enable_micbias,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_POST_PMD),
+
+	SND_SOC_DAPM_SUPPLY("VDD_BUCK", SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_enable_vdd_buck,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+	SND_SOC_DAPM_SUPPLY_S("CLS_H_PORT", 1, SND_SOC_NOPM, 0, 0, NULL, 0),
+
+	/* RX widgets */
+	SND_SOC_DAPM_PGA_E("EAR PGA", WCD937X_ANA_EAR, 7, 0, NULL, 0,
+			    wcd937x_codec_enable_ear_pa,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_PGA_E("AUX PGA", WCD937X_AUX_AUXPA, 7, 0, NULL, 0,
+			    wcd937x_codec_enable_aux_pa,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+				SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_PGA_E("HPHL PGA", WCD937X_ANA_HPH, 7, 0, NULL, 0,
+			    wcd937x_codec_enable_hphl_pa,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_PGA_E("HPHR PGA", WCD937X_ANA_HPH, 6, 0, NULL, 0,
+			    wcd937x_codec_enable_hphr_pa,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD),
+
+	SND_SOC_DAPM_DAC_E("RDAC1", NULL, SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_hphl_dac_event,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_DAC_E("RDAC2", NULL, SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_hphr_dac_event,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_DAC_E("RDAC3", NULL, SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_ear_dac_event,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_DAC_E("RDAC4", NULL, SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_aux_dac_event,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD),
+
+	SND_SOC_DAPM_MUX("RDAC3_MUX", SND_SOC_NOPM, 0, 0, &rx_rdac3_mux),
+
+	SND_SOC_DAPM_MIXER_E("RX1", SND_SOC_NOPM, 0, 0, NULL, 0,
+			     wcd937x_enable_rx1, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("RX2", SND_SOC_NOPM, 0, 0, NULL, 0,
+			     wcd937x_enable_rx2, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("RX3", SND_SOC_NOPM, 0, 0, NULL, 0,
+			     wcd937x_enable_rx3, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+
+	/* RX mixer widgets*/
+	SND_SOC_DAPM_MIXER("EAR_RDAC", SND_SOC_NOPM, 0, 0,
+			   ear_rdac_switch, ARRAY_SIZE(ear_rdac_switch)),
+	SND_SOC_DAPM_MIXER("AUX_RDAC", SND_SOC_NOPM, 0, 0,
+			   aux_rdac_switch, ARRAY_SIZE(aux_rdac_switch)),
+	SND_SOC_DAPM_MIXER("HPHL_RDAC", SND_SOC_NOPM, 0, 0,
+			   hphl_rdac_switch, ARRAY_SIZE(hphl_rdac_switch)),
+	SND_SOC_DAPM_MIXER("HPHR_RDAC", SND_SOC_NOPM, 0, 0,
+			   hphr_rdac_switch, ARRAY_SIZE(hphr_rdac_switch)),
+
+	/* TX output widgets */
+	SND_SOC_DAPM_OUTPUT("ADC1_OUTPUT"),
+	SND_SOC_DAPM_OUTPUT("ADC2_OUTPUT"),
+	SND_SOC_DAPM_OUTPUT("ADC3_OUTPUT"),
+	SND_SOC_DAPM_OUTPUT("WCD_TX_OUTPUT"),
+
+	/* RX output widgets */
+	SND_SOC_DAPM_OUTPUT("EAR"),
+	SND_SOC_DAPM_OUTPUT("AUX"),
+	SND_SOC_DAPM_OUTPUT("HPHL"),
+	SND_SOC_DAPM_OUTPUT("HPHR"),
+
+	/* MIC_BIAS pull up widgets */
+	SND_SOC_DAPM_SUPPLY("VA MIC BIAS1", SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_enable_micbias_pullup,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_SUPPLY("VA MIC BIAS2", SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_enable_micbias_pullup,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_SUPPLY("VA MIC BIAS3", SND_SOC_NOPM, 0, 0,
+			    wcd937x_codec_enable_micbias_pullup,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+			    SND_SOC_DAPM_POST_PMD),
+
+};
+
+static const struct snd_soc_dapm_widget wcd9375_dapm_widgets[] = {
+
+	/* Input widgets */
+	SND_SOC_DAPM_INPUT("AMIC4"),
+
+	/* TX widgets */
+	SND_SOC_DAPM_ADC_E("ADC3", NULL, SND_SOC_NOPM, 2, 0,
+			   wcd937x_codec_enable_adc,
+			   SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+	SND_SOC_DAPM_MIXER_E("ADC3 REQ", SND_SOC_NOPM, 0, 0,
+			     NULL, 0, wcd937x_enable_req,
+			     SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+	SND_SOC_DAPM_ADC_E("DMIC1", NULL, SND_SOC_NOPM, 0, 0,
+			   wcd937x_codec_enable_dmic,
+			   SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_ADC_E("DMIC2", NULL, SND_SOC_NOPM, 1, 0,
+			   wcd937x_codec_enable_dmic,
+			   SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_ADC_E("DMIC3", NULL, SND_SOC_NOPM, 2, 0,
+			   wcd937x_codec_enable_dmic,
+			   SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_ADC_E("DMIC4", NULL, SND_SOC_NOPM, 3, 0,
+			   wcd937x_codec_enable_dmic,
+			   SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_ADC_E("DMIC5", NULL, SND_SOC_NOPM, 4, 0,
+			   wcd937x_codec_enable_dmic,
+			   SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_ADC_E("DMIC6", NULL, SND_SOC_NOPM, 5, 0,
+			   wcd937x_codec_enable_dmic,
+			   SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+	/* TX mixer widgets */
+	SND_SOC_DAPM_MIXER_E("DMIC1_MIXER", SND_SOC_NOPM, 0,
+			     0, dmic1_switch, ARRAY_SIZE(dmic1_switch),
+			     wcd937x_tx_swr_ctrl, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("DMIC2_MIXER", SND_SOC_NOPM, 1,
+			     0, dmic2_switch, ARRAY_SIZE(dmic2_switch),
+			     wcd937x_tx_swr_ctrl, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("DMIC3_MIXER", SND_SOC_NOPM, 2,
+			     0, dmic3_switch, ARRAY_SIZE(dmic3_switch),
+			     wcd937x_tx_swr_ctrl, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("DMIC4_MIXER", SND_SOC_NOPM, 3,
+			     0, dmic4_switch, ARRAY_SIZE(dmic4_switch),
+			     wcd937x_tx_swr_ctrl, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("DMIC5_MIXER", SND_SOC_NOPM, 4,
+			     0, dmic5_switch, ARRAY_SIZE(dmic5_switch),
+			     wcd937x_tx_swr_ctrl, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("DMIC6_MIXER", SND_SOC_NOPM, 5,
+			     0, dmic6_switch, ARRAY_SIZE(dmic6_switch),
+			     wcd937x_tx_swr_ctrl, SND_SOC_DAPM_PRE_PMU |
+			     SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_MIXER_E("ADC3_MIXER", SND_SOC_NOPM, 2, 0, adc3_switch,
+			     ARRAY_SIZE(adc3_switch), wcd937x_tx_swr_ctrl,
+			     SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+	/* Output widgets */
+	SND_SOC_DAPM_OUTPUT("DMIC1_OUTPUT"),
+	SND_SOC_DAPM_OUTPUT("DMIC2_OUTPUT"),
+	SND_SOC_DAPM_OUTPUT("DMIC3_OUTPUT"),
+	SND_SOC_DAPM_OUTPUT("DMIC4_OUTPUT"),
+	SND_SOC_DAPM_OUTPUT("DMIC5_OUTPUT"),
+	SND_SOC_DAPM_OUTPUT("DMIC6_OUTPUT"),
+};
+
+static const struct snd_soc_dapm_route wcd937x_audio_map[] = {
+	{ "ADC1_OUTPUT", NULL, "ADC1_MIXER" },
+	{ "ADC1_MIXER", "Switch", "ADC1 REQ" },
+	{ "ADC1 REQ", NULL, "ADC1" },
+	{ "ADC1", NULL, "AMIC1" },
+
+	{ "ADC2_OUTPUT", NULL, "ADC2_MIXER" },
+	{ "ADC2_MIXER", "Switch", "ADC2 REQ" },
+	{ "ADC2 REQ", NULL, "ADC2" },
+	{ "ADC2", NULL, "ADC2 MUX" },
+	{ "ADC2 MUX", "INP3", "AMIC3" },
+	{ "ADC2 MUX", "INP2", "AMIC2" },
+
+	{ "IN1_HPHL", NULL, "VDD_BUCK" },
+	{ "IN1_HPHL", NULL, "CLS_H_PORT" },
+	{ "RX1", NULL, "IN1_HPHL" },
+	{ "RDAC1", NULL, "RX1" },
+	{ "HPHL_RDAC", "Switch", "RDAC1" },
+	{ "HPHL PGA", NULL, "HPHL_RDAC" },
+	{ "HPHL", NULL, "HPHL PGA" },
+
+	{ "IN2_HPHR", NULL, "VDD_BUCK" },
+	{ "IN2_HPHR", NULL, "CLS_H_PORT" },
+	{ "RX2", NULL, "IN2_HPHR" },
+	{ "RDAC2", NULL, "RX2" },
+	{ "HPHR_RDAC", "Switch", "RDAC2" },
+	{ "HPHR PGA", NULL, "HPHR_RDAC" },
+	{ "HPHR", NULL, "HPHR PGA" },
+
+	{ "IN3_AUX", NULL, "VDD_BUCK" },
+	{ "IN3_AUX", NULL, "CLS_H_PORT" },
+	{ "RX3", NULL, "IN3_AUX" },
+	{ "RDAC4", NULL, "RX3" },
+	{ "AUX_RDAC", "Switch", "RDAC4" },
+	{ "AUX PGA", NULL, "AUX_RDAC" },
+	{ "AUX", NULL, "AUX PGA" },
+
+	{ "RDAC3_MUX", "RX3", "RX3" },
+	{ "RDAC3_MUX", "RX1", "RX1" },
+	{ "RDAC3", NULL, "RDAC3_MUX" },
+	{ "EAR_RDAC", "Switch", "RDAC3" },
+	{ "EAR PGA", NULL, "EAR_RDAC" },
+	{ "EAR", NULL, "EAR PGA" },
+};
+
+static const struct snd_soc_dapm_route wcd9375_audio_map[] = {
+	{ "ADC3_OUTPUT", NULL, "ADC3_MIXER" },
+	{ "ADC3_OUTPUT", NULL, "ADC3_MIXER" },
+	{ "ADC3_MIXER", "Switch", "ADC3 REQ" },
+	{ "ADC3 REQ", NULL, "ADC3" },
+	{ "ADC3", NULL, "AMIC4" },
+
+	{ "DMIC1_OUTPUT", NULL, "DMIC1_MIXER" },
+	{ "DMIC1_MIXER", "Switch", "DMIC1" },
+
+	{ "DMIC2_OUTPUT", NULL, "DMIC2_MIXER" },
+	{ "DMIC2_MIXER", "Switch", "DMIC2" },
+
+	{ "DMIC3_OUTPUT", NULL, "DMIC3_MIXER" },
+	{ "DMIC3_MIXER", "Switch", "DMIC3" },
+
+	{ "DMIC4_OUTPUT", NULL, "DMIC4_MIXER" },
+	{ "DMIC4_MIXER", "Switch", "DMIC4" },
+
+	{ "DMIC5_OUTPUT", NULL, "DMIC5_MIXER" },
+	{ "DMIC5_MIXER", "Switch", "DMIC5" },
+
+	{ "DMIC6_OUTPUT", NULL, "DMIC6_MIXER" },
+	{ "DMIC6_MIXER", "Switch", "DMIC6" },
+};
+
+static int wcd937x_set_micbias_data(struct wcd937x_priv *wcd937x)
+{
+	int vout_ctl[3];
+
+	/* Set micbias voltage */
+	vout_ctl[0] = wcd937x_get_micb_vout_ctl_val(wcd937x->micb1_mv);
+	vout_ctl[1] = wcd937x_get_micb_vout_ctl_val(wcd937x->micb2_mv);
+	vout_ctl[2] = wcd937x_get_micb_vout_ctl_val(wcd937x->micb3_mv);
+	if ((vout_ctl[0] | vout_ctl[1] | vout_ctl[2]) < 0)
+		return -EINVAL;
+
+	regmap_update_bits(wcd937x->regmap, WCD937X_ANA_MICB1, WCD937X_ANA_MICB_VOUT, vout_ctl[0]);
+	regmap_update_bits(wcd937x->regmap, WCD937X_ANA_MICB2, WCD937X_ANA_MICB_VOUT, vout_ctl[1]);
+	regmap_update_bits(wcd937x->regmap, WCD937X_ANA_MICB3, WCD937X_ANA_MICB_VOUT, vout_ctl[2]);
+
+	return 0;
+}
+
+static irqreturn_t wcd937x_wd_handle_irq(int irq, void *data)
+{
+	return IRQ_HANDLED;
+}
+
+static struct irq_chip wcd_irq_chip = {
+	.name = "WCD937x",
+};
+
+static int wcd_irq_chip_map(struct irq_domain *irqd, unsigned int virq,
+			irq_hw_number_t hw)
+{
+	irq_set_chip_and_handler(virq, &wcd_irq_chip, handle_simple_irq);
+	irq_set_nested_thread(virq, 1);
+	irq_set_noprobe(virq);
+
+	return 0;
+}
+
+static const struct irq_domain_ops wcd_domain_ops = {
+	.map = wcd_irq_chip_map,
+};
+
+static int wcd937x_irq_init(struct wcd937x_priv *wcd, struct device *dev)
+{
+	wcd->virq = irq_domain_add_linear(NULL, 1, &wcd_domain_ops, NULL);
+	if (!(wcd->virq)) {
+		dev_err(dev, "%s: Failed to add IRQ domain\n", __func__);
+		return -EINVAL;
+	}
+
+	return devm_regmap_add_irq_chip(dev, wcd->regmap,
+					irq_create_mapping(wcd->virq, 0),
+					IRQF_ONESHOT, 0, &wcd937x_regmap_irq_chip,
+					&wcd->irq_chip);
+}
+
+static int wcd937x_soc_codec_probe(struct snd_soc_component *component)
+{
+	struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component);
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+	struct sdw_slave *tx_sdw_dev = wcd937x->tx_sdw_dev;
+	struct device *dev = component->dev;
+	unsigned long time_left;
+	int i, ret;
+
+	time_left = wait_for_completion_timeout(&tx_sdw_dev->initialization_complete,
+						msecs_to_jiffies(5000));
+	if (!time_left) {
+		dev_err(dev, "soundwire device init timeout\n");
+		return -ETIMEDOUT;
+	}
+
+	snd_soc_component_init_regmap(component, wcd937x->regmap);
+	ret = pm_runtime_resume_and_get(dev);
+	if (ret < 0)
+		return ret;
+
+	wcd937x->chipid = (snd_soc_component_read(component,
+				WCD937X_DIGITAL_EFUSE_REG_0) & 0x1e) >> 1;
+	if (wcd937x->chipid != CHIPID_WCD9370 &&
+	    wcd937x->chipid != CHIPID_WCD9375) {
+		dev_err(dev, "Got unknown chip id: 0x%x\n", wcd937x->chipid);
+		pm_runtime_put(dev);
+		return -EINVAL;
+	}
+
+	wcd937x->clsh_info = wcd_clsh_ctrl_alloc(component, WCD937X);
+	if (IS_ERR(wcd937x->clsh_info)) {
+		pm_runtime_put(dev);
+		return PTR_ERR(wcd937x->clsh_info);
+	}
+
+	wcd937x_io_init(wcd937x->regmap);
+	/* Set all interrupts as edge triggered */
+	for (i = 0; i < wcd937x_regmap_irq_chip.num_regs; i++)
+		regmap_write(wcd937x->regmap, (WCD937X_DIGITAL_INTR_LEVEL_0 + i), 0);
+
+	pm_runtime_put(dev);
+
+	wcd937x->hphr_pdm_wd_int = regmap_irq_get_virq(wcd937x->irq_chip,
+						       WCD937X_IRQ_HPHR_PDM_WD_INT);
+	wcd937x->hphl_pdm_wd_int = regmap_irq_get_virq(wcd937x->irq_chip,
+						       WCD937X_IRQ_HPHL_PDM_WD_INT);
+	wcd937x->aux_pdm_wd_int = regmap_irq_get_virq(wcd937x->irq_chip,
+						       WCD937X_IRQ_AUX_PDM_WD_INT);
+
+	/* Request for watchdog interrupt */
+	ret = devm_request_threaded_irq(dev, wcd937x->hphr_pdm_wd_int, NULL, wcd937x_wd_handle_irq,
+					IRQF_ONESHOT | IRQF_TRIGGER_RISING,
+					"HPHR PDM WDOG INT", wcd937x);
+	if (ret)
+		dev_err(dev, "Failed to request HPHR watchdog interrupt (%d)\n", ret);
+
+	ret = devm_request_threaded_irq(dev, wcd937x->hphl_pdm_wd_int, NULL, wcd937x_wd_handle_irq,
+					IRQF_ONESHOT | IRQF_TRIGGER_RISING,
+					"HPHL PDM WDOG INT", wcd937x);
+	if (ret)
+		dev_err(dev, "Failed to request HPHL watchdog interrupt (%d)\n", ret);
+
+	ret = devm_request_threaded_irq(dev, wcd937x->aux_pdm_wd_int, NULL, wcd937x_wd_handle_irq,
+					IRQF_ONESHOT | IRQF_TRIGGER_RISING,
+					"AUX PDM WDOG INT", wcd937x);
+	if (ret)
+		dev_err(dev, "Failed to request Aux watchdog interrupt (%d)\n", ret);
+
+	/* Disable watchdog interrupt for HPH and AUX */
+	disable_irq_nosync(wcd937x->hphr_pdm_wd_int);
+	disable_irq_nosync(wcd937x->hphl_pdm_wd_int);
+	disable_irq_nosync(wcd937x->aux_pdm_wd_int);
+
+	if (wcd937x->chipid == CHIPID_WCD9375) {
+		ret = snd_soc_dapm_new_controls(dapm, wcd9375_dapm_widgets,
+					ARRAY_SIZE(wcd9375_dapm_widgets));
+		if (ret < 0) {
+			dev_err(component->dev, "Failed to add snd_ctls\n");
+			return ret;
+		}
+
+		ret = snd_soc_dapm_add_routes(dapm, wcd9375_audio_map,
+					ARRAY_SIZE(wcd9375_audio_map));
+		if (ret < 0) {
+			dev_err(component->dev, "Failed to add routes\n");
+			return ret;
+		}
+	}
+
+	ret = wcd937x_mbhc_init(component);
+	if (ret)
+		dev_err(component->dev,  "mbhc initialization failed\n");
+
+	return ret;
+}
+
+static void wcd937x_soc_codec_remove(struct snd_soc_component *component)
+{
+	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);
+
+	wcd937x_mbhc_deinit(component);
+	free_irq(wcd937x->aux_pdm_wd_int, wcd937x);
+	free_irq(wcd937x->hphl_pdm_wd_int, wcd937x);
+	free_irq(wcd937x->hphr_pdm_wd_int, wcd937x);
+
+	wcd_clsh_ctrl_free(wcd937x->clsh_info);
+}
+
+static int wcd937x_codec_set_jack(struct snd_soc_component *comp,
+		struct snd_soc_jack *jack, void *data)
+{
+	struct wcd937x_priv *wcd = dev_get_drvdata(comp->dev);
+	int ret = 0;
+
+	if (jack)
+		ret = wcd_mbhc_start(wcd->wcd_mbhc, &wcd->mbhc_cfg, jack);
+	else
+		wcd_mbhc_stop(wcd->wcd_mbhc);
+
+	return ret;
+}
+
+static const struct snd_soc_component_driver soc_codec_dev_wcd937x = {
+	.name = "wcd937x_codec",
+	.probe = wcd937x_soc_codec_probe,
+	.remove = wcd937x_soc_codec_remove,
+	.controls = wcd937x_snd_controls,
+	.num_controls = ARRAY_SIZE(wcd937x_snd_controls),
+	.dapm_widgets = wcd937x_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(wcd937x_dapm_widgets),
+	.dapm_routes = wcd937x_audio_map,
+	.num_dapm_routes = ARRAY_SIZE(wcd937x_audio_map),
+	.set_jack = wcd937x_codec_set_jack,
+	.endianness = 1,
+};
+
+static void wcd937x_dt_parse_micbias_info(struct device *dev, struct wcd937x_priv *wcd)
+{
+	struct device_node *np = dev->of_node;
+	u32 prop_val = 0;
+	int ret = 0;
+
+	ret = of_property_read_u32(np, "qcom,micbias1-microvolt", &prop_val);
+	if (!ret)
+		wcd->micb1_mv = prop_val/1000;
+	else
+		dev_warn(dev, "Micbias1 DT property not found\n");
+
+	ret = of_property_read_u32(np, "qcom,micbias2-microvolt", &prop_val);
+	if (!ret)
+		wcd->micb2_mv = prop_val/1000;
+	else
+		dev_warn(dev, "Micbias2 DT property not found\n");
+
+	ret = of_property_read_u32(np, "qcom,micbias3-microvolt", &prop_val);
+	if (!ret)
+		wcd->micb3_mv = prop_val/1000;
+	else
+		dev_warn(dev, "Micbias3 DT property not found\n");
+}
+
+static bool wcd937x_swap_gnd_mic(struct snd_soc_component *component, bool active)
+{
+	int value;
+	struct wcd937x_priv *wcd937x;
+
+	wcd937x = snd_soc_component_get_drvdata(component);
+
+	value = gpiod_get_value(wcd937x->us_euro_gpio);
+	gpiod_set_value(wcd937x->us_euro_gpio, !value);
+
+	return true;
+}
+
+static int wcd937x_codec_hw_params(struct snd_pcm_substream *substream,
+				   struct snd_pcm_hw_params *params,
+				   struct snd_soc_dai *dai)
+{
+	struct wcd937x_priv *wcd937x = dev_get_drvdata(dai->dev);
+	struct wcd937x_sdw_priv *wcd = wcd937x->sdw_priv[dai->id];
+
+	return wcd937x_sdw_hw_params(wcd, substream, params, dai);
+}
+
+static int wcd937x_codec_free(struct snd_pcm_substream *substream,
+			      struct snd_soc_dai *dai)
+{
+	struct wcd937x_priv *wcd937x = dev_get_drvdata(dai->dev);
+	struct wcd937x_sdw_priv *wcd = wcd937x->sdw_priv[dai->id];
+
+	return sdw_stream_remove_slave(wcd->sdev, wcd->sruntime);
+}
+
+static int wcd937x_codec_set_sdw_stream(struct snd_soc_dai *dai,
+					void *stream, int direction)
+{
+	struct wcd937x_priv *wcd937x = dev_get_drvdata(dai->dev);
+	struct wcd937x_sdw_priv *wcd = wcd937x->sdw_priv[dai->id];
+
+	wcd->sruntime = stream;
+
+	return 0;
+}
+
+static const struct snd_soc_dai_ops wcd937x_sdw_dai_ops = {
+	.hw_params = wcd937x_codec_hw_params,
+	.hw_free = wcd937x_codec_free,
+	.set_stream = wcd937x_codec_set_sdw_stream,
+};
+
+static struct snd_soc_dai_driver wcd937x_dais[] = {
+	[0] = {
+		.name = "wcd937x-sdw-rx",
+		.playback = {
+			.stream_name = "WCD AIF Playback",
+			.rates = WCD937X_RATES | WCD937X_FRAC_RATES,
+			.formats = WCD937X_FORMATS,
+			.rate_min = 8000,
+			.rate_max = 384000,
+			.channels_min = 1,
+			.channels_max = 4,
+		},
+		.ops = &wcd937x_sdw_dai_ops,
+	},
+	[1] = {
+		.name = "wcd937x-sdw-tx",
+		.capture = {
+			.stream_name = "WCD AIF Capture",
+			.rates = WCD937X_RATES,
+			.formats = WCD937X_FORMATS,
+			.rate_min = 8000,
+			.rate_max = 192000,
+			.channels_min = 1,
+			.channels_max = 4,
+		},
+		.ops = &wcd937x_sdw_dai_ops,
+	},
+};
+
+static int wcd937x_bind(struct device *dev)
+{
+	struct wcd937x_priv *wcd937x = dev_get_drvdata(dev);
+	int ret;
+
+	/* Give the SDW subdevices some more time to settle */
+	usleep_range(5000, 5010);
+
+	ret = component_bind_all(dev, wcd937x);
+	if (ret) {
+		dev_err(dev, "Slave bind failed, ret = %d\n", ret);
+		return ret;
+	}
+
+	wcd937x->rxdev = wcd937x_sdw_device_get(wcd937x->rxnode);
+	if (!wcd937x->rxdev) {
+		dev_err(dev, "could not find slave with matching of node\n");
+		return -EINVAL;
+	}
+
+	wcd937x->sdw_priv[AIF1_PB] = dev_get_drvdata(wcd937x->rxdev);
+	wcd937x->sdw_priv[AIF1_PB]->wcd937x = wcd937x;
+
+	wcd937x->txdev = wcd937x_sdw_device_get(wcd937x->txnode);
+	if (!wcd937x->txdev) {
+		dev_err(dev, "could not find txslave with matching of node\n");
+		return -EINVAL;
+	}
+
+	wcd937x->sdw_priv[AIF1_CAP] = dev_get_drvdata(wcd937x->txdev);
+	wcd937x->sdw_priv[AIF1_CAP]->wcd937x = wcd937x;
+	wcd937x->tx_sdw_dev = dev_to_sdw_dev(wcd937x->txdev);
+	if (!wcd937x->tx_sdw_dev) {
+		dev_err(dev, "could not get txslave with matching of dev\n");
+		return -EINVAL;
+	}
+
+	/*
+	 * As TX is the main CSR reg interface, which should not be suspended first.
+	 * expicilty add the dependency link
+	 */
+	if (!device_link_add(wcd937x->rxdev, wcd937x->txdev,
+			     DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME)) {
+		dev_err(dev, "Could not devlink TX and RX\n");
+		return -EINVAL;
+	}
+
+	if (!device_link_add(dev, wcd937x->txdev,
+			     DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME)) {
+		dev_err(dev, "Could not devlink WCD and TX\n");
+		return -EINVAL;
+	}
+
+	if (!device_link_add(dev, wcd937x->rxdev,
+			     DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME)) {
+		dev_err(dev, "Could not devlink WCD and RX\n");
+		return -EINVAL;
+	}
+
+	wcd937x->regmap = dev_get_regmap(&wcd937x->tx_sdw_dev->dev, NULL);
+	if (!wcd937x->regmap) {
+		dev_err(dev, "could not get TX device regmap\n");
+		return -EINVAL;
+	}
+
+	ret = wcd937x_irq_init(wcd937x, dev);
+	if (ret) {
+		dev_err(dev, "IRQ init failed: %d\n", ret);
+		return ret;
+	}
+
+	wcd937x->sdw_priv[AIF1_PB]->slave_irq = wcd937x->virq;
+	wcd937x->sdw_priv[AIF1_CAP]->slave_irq = wcd937x->virq;
+
+	ret = wcd937x_set_micbias_data(wcd937x);
+	if (ret < 0) {
+		dev_err(dev, "Bad micbias pdata\n");
+		return ret;
+	}
+
+	ret = snd_soc_register_component(dev, &soc_codec_dev_wcd937x,
+					 wcd937x_dais, ARRAY_SIZE(wcd937x_dais));
+	if (ret)
+		dev_err(dev, "Codec registration failed\n");
+
+	return ret;
+}
+
+static void wcd937x_unbind(struct device *dev)
+{
+	struct wcd937x_priv *wcd937x = dev_get_drvdata(dev);
+
+	device_link_remove(dev, wcd937x->txdev);
+	device_link_remove(dev, wcd937x->rxdev);
+	device_link_remove(wcd937x->rxdev, wcd937x->txdev);
+	snd_soc_unregister_component(dev);
+	component_unbind_all(dev, wcd937x);
+	mutex_destroy(&wcd937x->micb_lock);
+}
+
+static const struct of_device_id wcd937x_of_match[] = {
+	{ .compatible = "qcom,wcd9370-codec" },
+	{ }
+};
+
+static const struct component_master_ops wcd937x_comp_ops = {
+	.bind   = wcd937x_bind,
+	.unbind = wcd937x_unbind,
+};
+
+static int wcd937x_add_slave_components(struct wcd937x_priv *wcd937x,
+					struct device *dev,
+					struct component_match **matchptr)
+{
+	struct device_node *np = dev->of_node;
+
+	wcd937x->rxnode = of_parse_phandle(np, "qcom,rx-device", 0);
+	if (!wcd937x->rxnode) {
+		dev_err(dev, "Couldn't parse phandle to qcom,rx-device!\n");
+		return -ENODEV;
+	}
+	of_node_get(wcd937x->rxnode);
+	component_match_add_release(dev, matchptr, component_release_of,
+				    component_compare_of, wcd937x->rxnode);
+
+	wcd937x->txnode = of_parse_phandle(np, "qcom,tx-device", 0);
+	if (!wcd937x->txnode) {
+		dev_err(dev, "Couldn't parse phandle to qcom,tx-device\n");
+			return -ENODEV;
+	}
+	of_node_get(wcd937x->txnode);
+	component_match_add_release(dev, matchptr, component_release_of,
+				    component_compare_of, wcd937x->txnode);
+
+	return 0;
+}
+
+static int wcd937x_probe(struct platform_device *pdev)
+{
+	struct component_match *match = NULL;
+	struct device *dev = &pdev->dev;
+	struct wcd937x_priv *wcd937x;
+	struct wcd_mbhc_config *cfg;
+	int ret;
+
+	wcd937x = devm_kzalloc(dev, sizeof(*wcd937x), GFP_KERNEL);
+	if (!wcd937x)
+		return -ENOMEM;
+
+	dev_set_drvdata(dev, wcd937x);
+	mutex_init(&wcd937x->micb_lock);
+
+	wcd937x->reset_gpio = of_get_named_gpio(dev->of_node, "reset-gpios", 0);
+	if (wcd937x->reset_gpio < 0)
+		return dev_err_probe(dev, wcd937x->reset_gpio,
+				     "Failed to get reset gpio\n");
+
+	wcd937x->us_euro_gpio = devm_gpiod_get_optional(dev, "us-euro", GPIOD_OUT_LOW);
+	if (IS_ERR(wcd937x->us_euro_gpio))
+		return dev_err_probe(dev, PTR_ERR(wcd937x->us_euro_gpio),
+				"us-euro swap Control GPIO not found\n");
+
+	cfg = &wcd937x->mbhc_cfg;
+	cfg->swap_gnd_mic = wcd937x_swap_gnd_mic;
+
+	wcd937x->has_always_on_supplies = of_property_read_bool(dev->of_node,
+				"qcom,always-on-supply");
+	if (!wcd937x->has_always_on_supplies) {
+		wcd937x->supplies[0].supply = "vdd-rxtx";
+		wcd937x->supplies[1].supply = "vdd-px";
+		wcd937x->supplies[2].supply = "vdd-mic-bias";
+		ret = devm_regulator_bulk_get(dev, WCD937X_MAX_BULK_SUPPLY, wcd937x->supplies);
+		if (ret)
+			return dev_err_probe(dev, ret, "Failed to get supplies\n");
+
+		ret = regulator_bulk_enable(WCD937X_MAX_BULK_SUPPLY, wcd937x->supplies);
+		if (ret)
+			return dev_err_probe(dev, ret, "Failed to enable supplies\n");
+
+		/* Get the buck separately, as it needs special handling */
+		wcd937x->buck_supply = devm_regulator_get(dev, "vdd-buck");
+		if (IS_ERR(wcd937x->buck_supply))
+			return dev_err_probe(dev, PTR_ERR(wcd937x->buck_supply),
+					"Failed to get buck supply\n");
+		ret = regulator_enable(wcd937x->buck_supply);
+		if (ret)
+			return dev_err_probe(dev, ret, "Failed to enable buck supply\n");
+	}
+
+	wcd937x_dt_parse_micbias_info(dev, wcd937x);
+
+	cfg->mbhc_micbias = MIC_BIAS_2;
+	cfg->anc_micbias = MIC_BIAS_2;
+	cfg->v_hs_max = WCD_MBHC_HS_V_MAX;
+	cfg->num_btn = WCD937X_MBHC_MAX_BUTTONS;
+	cfg->micb_mv = wcd937x->micb2_mv;
+	cfg->linein_th = 5000;
+	cfg->hs_thr = 1700;
+	cfg->hph_thr = 50;
+
+	wcd_dt_parse_mbhc_data(dev, &wcd937x->mbhc_cfg);
+
+	ret = wcd937x_add_slave_components(wcd937x, dev, &match);
+	if (ret)
+		return ret;
+
+	wcd937x_reset(wcd937x);
+
+	ret = component_master_add_with_match(dev, &wcd937x_comp_ops, match);
+	if (ret)
+		return ret;
+
+	pm_runtime_set_autosuspend_delay(dev, 1000);
+	pm_runtime_use_autosuspend(dev);
+	pm_runtime_mark_last_busy(dev);
+	pm_runtime_set_active(dev);
+	pm_runtime_enable(dev);
+	pm_runtime_idle(dev);
+
+	return ret;
+}
+
+static void wcd937x_remove(struct platform_device *pdev)
+{
+	component_master_del(&pdev->dev, &wcd937x_comp_ops);
+	dev_set_drvdata(&pdev->dev, NULL);
+}
+
+static struct platform_driver wcd937x_codec_driver = {
+	.probe = wcd937x_probe,
+	.remove_new = wcd937x_remove,
+	.driver = {
+		.name = "wcd937x_codec",
+		.of_match_table = of_match_ptr(wcd937x_of_match),
+		.suppress_bind_attrs = true,
+	},
+};
+
+module_platform_driver(wcd937x_codec_driver);
+MODULE_DESCRIPTION("WCD937X Codec driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/sound/soc/codecs/wcd937x.h
+++ linux-qcom-6.8.0/sound/soc/codecs/wcd937x.h
@@ -0,0 +1,654 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _WCD937X_REGISTERS_H
+#define _WCD937X_REGISTERS_H
+
+#include <linux/soundwire/sdw.h>
+#include <linux/soundwire/sdw_type.h>
+
+#define WCD937X_BASE_ADDRESS			0x3000
+#define WCD937X_ANA_BIAS			0x3001
+#define WCD937X_ANA_RX_SUPPLIES			0x3008
+#define WCD937X_ANA_HPH				0x3009
+#define WCD937X_ANA_EAR				0x300A
+#define WCD937X_ANA_EAR_COMPANDER_CTL		0x300B
+ #define WCD937X_EAR_GAIN_MASK			GENMASK(6, 2)
+#define WCD937X_ANA_TX_CH1			0x300E
+#define WCD937X_ANA_TX_CH2			0x300F
+#define WCD937X_ANA_TX_CH3			0x3010
+#define WCD937X_ANA_TX_CH3_HPF			0x3011
+#define WCD937X_ANA_MICB1_MICB2_DSP_EN_LOGIC	0x3012
+#define WCD937X_ANA_MICB3_DSP_EN_LOGIC		0x3013
+#define WCD937X_ANA_MBHC_MECH			0x3014
+#define WCD937X_MBHC_L_DET_EN_MASK		BIT(7)
+#define WCD937X_MBHC_L_DET_EN			BIT(7)
+#define WCD937X_MBHC_GND_DET_EN_MASK		BIT(6)
+#define WCD937X_MBHC_MECH_DETECT_TYPE_MASK	BIT(5)
+#define WCD937X_MBHC_MECH_DETECT_TYPE_INS	1
+#define WCD937X_MBHC_HPHL_PLUG_TYPE_MASK	BIT(4)
+#define WCD937X_MBHC_HPHL_PLUG_TYPE_NO		1
+#define WCD937X_MBHC_GND_PLUG_TYPE_MASK		BIT(3)
+#define WCD937X_MBHC_GND_PLUG_TYPE_NO		1
+#define WCD937X_MBHC_HSL_PULLUP_COMP_EN		BIT(2)
+#define WCD937X_MBHC_HSG_PULLUP_COMP_EN		BIT(1)
+#define WCD937X_MBHC_HPHL_100K_TO_GND_EN	BIT(0)
+#define WCD937X_ANA_MBHC_ELECT			0x3015
+#define WCD937X_ANA_MBHC_BD_ISRC_CTL_MASK	GENMASK(6, 4)
+#define WCD937X_ANA_MBHC_BD_ISRC_100UA		GENMASK(5, 4)
+#define WCD937X_ANA_MBHC_BD_ISRC_OFF		0
+#define WCD937X_ANA_MBHC_BIAS_EN_MASK		BIT(0)
+#define WCD937X_ANA_MBHC_BIAS_EN		BIT(0)
+#define WCD937X_ANA_MBHC_ZDET			0x3016
+#define WCD937X_ANA_MBHC_RESULT_1		0x3017
+#define WCD937X_ANA_MBHC_RESULT_2		0x3018
+#define WCD937X_ANA_MBHC_RESULT_3		0x3019
+#define WCD937X_MBHC_BTN_RESULT_MASK		GENMASK(2, 0)
+#define WCD937X_ANA_MBHC_BTN0			0x301A
+#define WCD937X_MBHC_BTN_VTH_MASK		GENMASK(7, 2)
+#define WCD937X_ANA_MBHC_BTN1			0x301B
+#define WCD937X_ANA_MBHC_BTN2			0x301C
+#define WCD937X_ANA_MBHC_BTN3			0x301D
+#define WCD937X_ANA_MBHC_BTN4			0x301E
+#define WCD937X_ANA_MBHC_BTN5			0x301F
+#define WCD937X_VTH_MASK			GENMASK(7, 2)
+#define WCD937X_ANA_MBHC_BTN6			0x3020
+#define WCD937X_ANA_MBHC_BTN7			0x3021
+#define WCD937X_ANA_MICB1			0x3022
+#define WCD937X_MICB_VOUT_MASK			GENMASK(5, 0)
+#define WCD937X_MICB_EN_MASK			GENMASK(7, 6)
+#define WCD937X_MICB_DISABLE			0
+#define WCD937X_MICB_ENABLE			1
+#define WCD937X_MICB_PULL_UP			2
+#define WCD937X_MICB_PULL_DOWN			3
+#define WCD937X_ANA_MICB2			0x3023
+#define WCD937X_ANA_MICB2_ENABLE		BIT(6)
+#define WCD937X_ANA_MICB2_ENABLE_MASK		GENMASK(7, 6)
+#define WCD937X_ANA_MICB2_VOUT_MASK		GENMASK(5, 0)
+#define WCD937X_ANA_MICB2_RAMP			0x3024
+#define WCD937X_RAMP_EN_MASK			BIT(7)
+#define WCD937X_RAMP_SHIFT_CTRL_MASK		GENMASK(4, 2)
+#define WCD937X_ANA_MICB3			0x3025
+#define WCD937X_ANA_MICB_EN			GENMASK(7, 6)
+#define WCD937X_MICB_DISABLE			0
+#define WCD937X_MICB_ENABLE			1
+#define WCD937X_MICB_PULL_UP			2
+#define WCD937X_ANA_MICB_VOUT			GENMASK(5, 0)
+#define WCD937X_BIAS_CTL			0x3028
+#define WCD937X_BIAS_VBG_FINE_ADJ		0x3029
+#define WCD937X_LDOL_VDDCX_ADJUST		0x3040
+#define WCD937X_LDOL_DISABLE_LDOL		0x3041
+#define WCD937X_MBHC_CTL_CLK			0x3056
+#define WCD937X_MBHC_CTL_ANA			0x3057
+#define WCD937X_MBHC_CTL_SPARE_1		0x3058
+#define WCD937X_MBHC_CTL_SPARE_2		0x3059
+#define WCD937X_MBHC_CTL_BCS			0x305A
+#define WCD937X_MBHC_MOISTURE_DET_FSM_STATUS	0x305B
+#define WCD937X_MBHC_TEST_CTL			0x305C
+#define WCD937X_LDOH_MODE			0x3067
+#define WCD937X_LDOH_BIAS			0x3068
+#define WCD937X_LDOH_STB_LOADS			0x3069
+#define WCD937X_LDOH_SLOWRAMP			0x306A
+#define WCD937X_MICB1_TEST_CTL_1		0x306B
+#define WCD937X_MICB1_TEST_CTL_2		0x306C
+#define WCD937X_MICB1_TEST_CTL_3		0x306D
+#define WCD937X_MICB2_TEST_CTL_1		0x306E
+#define WCD937X_MICB2_TEST_CTL_2		0x306F
+#define WCD937X_MICB2_TEST_CTL_3		0x3070
+#define WCD937X_MICB3_TEST_CTL_1		0x3071
+#define WCD937X_MICB3_TEST_CTL_2		0x3072
+#define WCD937X_MICB3_TEST_CTL_3		0x3073
+#define WCD937X_TX_COM_ADC_VCM			0x3077
+#define WCD937X_TX_COM_BIAS_ATEST		0x3078
+#define WCD937X_TX_COM_ADC_INT1_IB		0x3079
+#define WCD937X_TX_COM_ADC_INT2_IB		0x307A
+#define WCD937X_TX_COM_TXFE_DIV_CTL		0x307B
+#define WCD937X_TX_COM_TXFE_DIV_START		0x307C
+#define WCD937X_TX_COM_TXFE_DIV_STOP_9P6M	0x307D
+#define WCD937X_TX_COM_TXFE_DIV_STOP_12P288M	0x307E
+#define WCD937X_TX_1_2_TEST_EN			0x307F
+#define WCD937X_TX_1_2_ADC_IB			0x3080
+#define WCD937X_TX_1_2_ATEST_REFCTL		0x3081
+#define WCD937X_TX_1_2_TEST_CTL			0x3082
+#define WCD937X_TX_1_2_TEST_BLK_EN		0x3083
+#define WCD937X_TX_1_2_TXFE_CLKDIV		0x3084
+#define WCD937X_TX_1_2_SAR2_ERR			0x3085
+#define WCD937X_TX_1_2_SAR1_ERR			0x3086
+#define WCD937X_TX_3_TEST_EN			0x3087
+#define WCD937X_TX_3_ADC_IB			0x3088
+#define WCD937X_TX_3_ATEST_REFCTL		0x3089
+#define WCD937X_TX_3_TEST_CTL			0x308A
+#define WCD937X_TX_3_TEST_BLK_EN		0x308B
+#define WCD937X_TX_3_TXFE_CLKDIV		0x308C
+#define WCD937X_TX_3_SPARE_MONO			0x308D
+#define WCD937X_TX_3_SAR1_ERR			0x308E
+#define WCD937X_CLASSH_MODE_1			0x3097
+#define WCD937X_CLASSH_MODE_2			0x3098
+#define WCD937X_CLASSH_MODE_3			0x3099
+#define WCD937X_CLASSH_CTRL_VCL_1		0x309A
+#define WCD937X_CLASSH_CTRL_VCL_2		0x309B
+#define WCD937X_CLASSH_CTRL_CCL_1		0x309C
+#define WCD937X_CLASSH_CTRL_CCL_2		0x309D
+#define WCD937X_CLASSH_CTRL_CCL_3		0x309E
+#define WCD937X_CLASSH_CTRL_CCL_4		0x309F
+#define WCD937X_CLASSH_CTRL_CCL_5		0x30A0
+#define WCD937X_CLASSH_BUCK_TMUX_A_D		0x30A1
+#define WCD937X_CLASSH_BUCK_SW_DRV_CNTL		0x30A2
+#define WCD937X_CLASSH_SPARE			0x30A3
+#define WCD937X_FLYBACK_EN			0x30A4
+#define WCD937X_FLYBACK_VNEG_CTRL_1		0x30A5
+#define WCD937X_FLYBACK_VNEG_CTRL_2		0x30A6
+#define WCD937X_FLYBACK_VNEG_CTRL_3		0x30A7
+#define WCD937X_FLYBACK_VNEG_CTRL_4		0x30A8
+#define WCD937X_FLYBACK_VNEG_CTRL_5		0x30A9
+#define WCD937X_FLYBACK_VNEG_CTRL_6		0x30AA
+#define WCD937X_FLYBACK_VNEG_CTRL_7		0x30AB
+#define WCD937X_FLYBACK_VNEG_CTRL_8		0x30AC
+#define WCD937X_FLYBACK_VNEG_CTRL_9		0x30AD
+#define WCD937X_FLYBACK_VNEGDAC_CTRL_1		0x30AE
+#define WCD937X_FLYBACK_VNEGDAC_CTRL_2		0x30AF
+#define WCD937X_FLYBACK_VNEGDAC_CTRL_3		0x30B0
+#define WCD937X_FLYBACK_CTRL_1			0x30B1
+#define WCD937X_FLYBACK_TEST_CTL		0x30B2
+#define WCD937X_RX_AUX_SW_CTL			0x30B3
+#define WCD937X_RX_PA_AUX_IN_CONN		0x30B4
+#define WCD937X_RX_TIMER_DIV			0x30B5
+#define WCD937X_RX_OCP_CTL			0x30B6
+#define WCD937X_RX_OCP_COUNT			0x30B7
+#define WCD937X_RX_BIAS_EAR_DAC			0x30B8
+#define WCD937X_RX_BIAS_EAR_AMP			0x30B9
+#define WCD937X_RX_BIAS_HPH_LDO			0x30BA
+#define WCD937X_RX_BIAS_HPH_PA			0x30BB
+#define WCD937X_RX_BIAS_HPH_RDACBUFF_CNP2	0x30BC
+#define WCD937X_RX_BIAS_HPH_RDAC_LDO		0x30BD
+#define WCD937X_RX_BIAS_HPH_CNP1		0x30BE
+#define WCD937X_RX_BIAS_HPH_LOWPOWER		0x30BF
+#define WCD937X_RX_BIAS_AUX_DAC			0x30C0
+#define WCD937X_RX_BIAS_AUX_AMP			0x30C1
+#define WCD937X_RX_BIAS_VNEGDAC_BLEEDER		0x30C2
+#define WCD937X_RX_BIAS_MISC			0x30C3
+#define WCD937X_RX_BIAS_BUCK_RST		0x30C4
+#define WCD937X_RX_BIAS_BUCK_VREF_ERRAMP	0x30C5
+#define WCD937X_RX_BIAS_FLYB_ERRAMP		0x30C6
+#define WCD937X_RX_BIAS_FLYB_BUFF		0x30C7
+#define WCD937X_RX_BIAS_FLYB_MID_RST		0x30C8
+#define WCD937X_HPH_L_STATUS			0x30C9
+#define WCD937X_HPH_R_STATUS			0x30CA
+#define WCD937X_HPH_CNP_EN			0x30CB
+#define WCD937X_HPH_CNP_WG_CTL			0x30CC
+#define WCD937X_HPH_CNP_WG_TIME			0x30CD
+#define WCD937X_HPH_OCP_CTL			0x30CE
+#define WCD937X_HPH_AUTO_CHOP			0x30CF
+#define WCD937X_HPH_CHOP_CTL			0x30D0
+#define WCD937X_HPH_PA_CTL1			0x30D1
+#define WCD937X_HPH_PA_CTL2			0x30D2
+#define WCD937X_HPHPA_GND_R_MASK		BIT(6)
+#define WCD937X_HPHPA_GND_L_MASK		BIT(4)
+#define WCD937X_HPH_L_EN			0x30D3
+#define WCD937X_HPH_L_TEST			0x30D4
+#define WCD937X_HPH_L_ATEST			0x30D5
+#define WCD937X_HPH_R_EN			0x30D6
+#define WCD937X_GAIN_SRC_SEL_MASK		BIT(5)
+#define WCD937X_GAIN_SRC_SEL_REGISTER		1
+#define WCD937X_HPH_R_TEST			0x30D7
+#define WCD937X_HPH_R_ATEST			0x30D8
+#define WCD937X_HPH_RDAC_CLK_CTL1		0x30D9
+#define WCD937X_HPHPA_GND_OVR_MASK		BIT(1)
+#define WCD937X_CHOP_CLK_EN_MASK		BIT(7)
+#define WCD937X_HPH_RDAC_CLK_CTL2		0x30DA
+#define WCD937X_HPH_RDAC_LDO_CTL		0x30DB
+#define WCD937X_HPH_RDAC_CHOP_CLK_LP_CTL	0x30DC
+#define WCD937X_HPH_REFBUFF_UHQA_CTL		0x30DD
+#define WCD937X_HPH_REFBUFF_LP_CTL		0x30DE
+#define WCD937X_PREREF_FLIT_BYPASS_MASK		BIT(0)
+#define WCD937X_HPH_L_DAC_CTL			0x30DF
+#define WCD937X_HPH_R_DAC_CTL			0x30E0
+#define WCD937X_HPH_SURGE_HPHLR_SURGE_COMP_SEL	0x30E1
+#define WCD937X_HPH_SURGE_HPHLR_SURGE_EN	0x30E2
+#define WCD937X_HPH_SURGE_HPHLR_SURGE_MISC1	0x30E3
+#define WCD937X_HPH_SURGE_HPHLR_SURGE_STATUS	0x30E4
+#define WCD937X_EAR_EAR_EN_REG			0x30E9
+#define WCD937X_EAR_EAR_PA_CON			0x30EA
+#define WCD937X_EAR_EAR_SP_CON			0x30EB
+#define WCD937X_EAR_EAR_DAC_CON			0x30EC
+#define WCD937X_EAR_EAR_CNP_FSM_CON		0x30ED
+#define WCD937X_EAR_TEST_CTL			0x30EE
+#define WCD937X_EAR_STATUS_REG_1		0x30EF
+#define WCD937X_EAR_STATUS_REG_2		0x30F0
+#define WCD937X_ANA_NEW_PAGE_REGISTER		0x3100
+#define WCD937X_HPH_NEW_ANA_HPH2		0x3101
+#define WCD937X_HPH_NEW_ANA_HPH3		0x3102
+#define WCD937X_SLEEP_CTL			0x3103
+#define WCD937X_SLEEP_WATCHDOG_CTL		0x3104
+#define WCD937X_MBHC_NEW_ELECT_REM_CLAMP_CTL	0x311F
+#define WCD937X_MBHC_NEW_CTL_1			0x3120
+#define WCD937X_MBHC_CTL_RCO_EN_MASK		BIT(7)
+#define WCD937X_MBHC_CTL_RCO_EN			BIT(7)
+#define WCD937X_MBHC_BTN_DBNC_MASK		GENMASK(1, 0)
+#define WCD937X_MBHC_BTN_DBNC_T_16_MS		0x2
+#define WCD937X_MBHC_NEW_CTL_2			0x3121
+#define WCD937X_MBHC_NEW_PLUG_DETECT_CTL	0x3122
+#define WCD937X_MBHC_NEW_ZDET_ANA_CTL		0x3123
+#define WCD937X_M_RTH_CTL_MASK			GENMASK(3, 2)
+#define WCD937X_MBHC_HS_VREF_CTL_MASK		GENMASK(1, 0)
+#define WCD937X_MBHC_HS_VREF_1P5_V		0x1
+#define WCD937X_MBHC_DBNC_TIMER_INSREM_DBNC_T_96_MS	0x6
+#define WCD937X_ZDET_RANGE_CTL_MASK		GENMASK(3, 0)
+#define WCD937X_ZDET_MAXV_CTL_MASK		GENMASK(6, 4)
+#define WCD937X_MBHC_NEW_ZDET_RAMP_CTL		0x3124
+#define WCD937X_MBHC_NEW_FSM_STATUS		0x3125
+#define WCD937X_MBHC_NEW_ADC_RESULT		0x3126
+#define WCD937X_TX_NEW_TX_CH2_SEL		0x3127
+#define WCD937X_AUX_AUXPA			0x3128
+#define WCD937X_AUXPA_CLK_EN_MASK		BIT(4)
+#define WCD937X_AUXPA_CLK_EN_MASK		BIT(4)
+#define WCD937X_LDORXTX_MODE			0x3129
+#define WCD937X_LDORXTX_CONFIG			0x312A
+#define WCD937X_DIE_CRACK_DIE_CRK_DET_EN	0x312C
+#define WCD937X_DIE_CRACK_DIE_CRK_DET_OUT	0x312D
+#define WCD937X_HPH_NEW_INT_RDAC_GAIN_CTL	0x3132
+#define WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_L	0x3133
+#define WCD937X_HPH_NEW_INT_RDAC_VREF_CTL	0x3134
+#define WCD937X_HPH_NEW_INT_RDAC_OVERRIDE_CTL	0x3135
+#define WCD937X_HPH_NEW_INT_RDAC_HD2_CTL_R	0x3136
+#define WCD937X_HPH_NEW_INT_PA_MISC1		0x3137
+#define WCD937X_HPH_NEW_INT_PA_MISC2		0x3138
+#define WCD937X_HPH_NEW_INT_PA_RDAC_MISC	0x3139
+#define WCD937X_HPH_NEW_INT_HPH_TIMER1		0x313A
+#define WCD937X_HPH_NEW_INT_HPH_TIMER2		0x313B
+#define WCD937X_HPH_NEW_INT_HPH_TIMER3		0x313C
+#define WCD937X_HPH_NEW_INT_HPH_TIMER4		0x313D
+#define WCD937X_HPH_NEW_INT_PA_RDAC_MISC2	0x313E
+#define WCD937X_HPH_NEW_INT_PA_RDAC_MISC3	0x313F
+#define WCD937X_RX_NEW_INT_HPH_RDAC_BIAS_LOHIFI	0x3145
+#define WCD937X_RX_NEW_INT_HPH_RDAC_BIAS_ULP	0x3146
+#define WCD937X_RX_NEW_INT_HPH_RDAC_LDO_LP	0x3147
+#define WCD937X_MBHC_NEW_INT_MOISTURE_DET_DC_CTRL			0x31AF
+#define WCD937X_MBHC_NEW_INT_MOISTURE_DET_POLLING_CTRL			0x31B0
+#define WCD937X_MOISTURE_EN_POLLING_MASK	BIT(2)
+#define WCD937X_HSDET_PULLUP_C_MASK		GENMASK(4, 0)
+#define WCD937X_MBHC_NEW_INT_MECH_DET_CURRENT	0x31B1
+#define WCD937X_MBHC_NEW_INT_SPARE_2		0x31B2
+#define WCD937X_EAR_INT_NEW_EAR_CHOPPER_CON	0x31B7
+#define WCD937X_EAR_INT_NEW_CNP_VCM_CON1	0x31B8
+#define WCD937X_EAR_INT_NEW_CNP_VCM_CON2	0x31B9
+#define WCD937X_EAR_INT_NEW_EAR_DYNAMIC_BIAS	0x31BA
+#define WCD937X_AUX_INT_EN_REG			0x31BD
+#define WCD937X_AUX_INT_PA_CTRL			0x31BE
+#define WCD937X_AUX_INT_SP_CTRL			0x31BF
+#define WCD937X_AUX_INT_DAC_CTRL		0x31C0
+#define WCD937X_AUX_INT_CLK_CTRL		0x31C1
+#define WCD937X_AUX_INT_TEST_CTRL		0x31C2
+#define WCD937X_AUX_INT_STATUS_REG		0x31C3
+#define WCD937X_AUX_INT_MISC			0x31C4
+#define WCD937X_LDORXTX_INT_BIAS		0x31C5
+#define WCD937X_LDORXTX_INT_STB_LOADS_DTEST	0x31C6
+#define WCD937X_LDORXTX_INT_TEST0		0x31C7
+#define WCD937X_LDORXTX_INT_STARTUP_TIMER	0x31C8
+#define WCD937X_LDORXTX_INT_TEST1		0x31C9
+#define WCD937X_LDORXTX_INT_STATUS		0x31CA
+#define WCD937X_SLEEP_INT_WATCHDOG_CTL_1	0x31D0
+#define WCD937X_SLEEP_INT_WATCHDOG_CTL_2	0x31D1
+#define WCD937X_DIE_CRACK_INT_DIE_CRK_DET_INT1	0x31D3
+#define WCD937X_DIE_CRACK_INT_DIE_CRK_DET_INT2	0x31D4
+#define WCD937X_DIGITAL_PAGE_REGISTER		0x3400
+#define WCD937X_DIGITAL_CHIP_ID0		0x3401
+#define WCD937X_DIGITAL_CHIP_ID1		0x3402
+#define WCD937X_DIGITAL_CHIP_ID2		0x3403
+#define WCD937X_DIGITAL_CHIP_ID3		0x3404
+#define WCD937X_DIGITAL_CDC_RST_CTL		0x3406
+#define WCD937X_DIGITAL_TOP_CLK_CFG		0x3407
+#define WCD937X_DIGITAL_CDC_ANA_CLK_CTL		0x3408
+#define WCD937X_DIGITAL_CDC_DIG_CLK_CTL		0x3409
+#define WCD937X_DIGITAL_SWR_RST_EN		0x340A
+#define WCD937X_DIGITAL_CDC_PATH_MODE		0x340B
+#define WCD937X_DIGITAL_CDC_RX_RST		0x340C
+#define WCD937X_DIGITAL_CDC_RX0_CTL		0x340D
+#define WCD937X_DIGITAL_CDC_RX1_CTL		0x340E
+#define WCD937X_DIGITAL_CDC_RX2_CTL		0x340F
+#define WCD937X_DIGITAL_DEM_BYPASS_DATA0	0x3410
+#define WCD937X_DIGITAL_DEM_BYPASS_DATA1	0x3411
+#define WCD937X_DIGITAL_DEM_BYPASS_DATA2	0x3412
+#define WCD937X_DIGITAL_DEM_BYPASS_DATA3	0x3413
+#define WCD937X_DIGITAL_CDC_COMP_CTL_0		0x3414
+#define WCD937X_DIGITAL_CDC_RX_DELAY_CTL	0x3417
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A1_0	0x3418
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A1_1	0x3419
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A2_0	0x341A
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A2_1	0x341B
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A3_0	0x341C
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A3_1	0x341D
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A4_0	0x341E
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A4_1	0x341F
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A5_0	0x3420
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A5_1	0x3421
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A6_0	0x3422
+#define WCD937X_DIGITAL_CDC_HPH_DSM_A7_0	0x3423
+#define WCD937X_DIGITAL_CDC_HPH_DSM_C_0		0x3424
+#define WCD937X_DIGITAL_CDC_HPH_DSM_C_1		0x3425
+#define WCD937X_DIGITAL_CDC_HPH_DSM_C_2		0x3426
+#define WCD937X_DIGITAL_CDC_HPH_DSM_C_3		0x3427
+#define WCD937X_DIGITAL_CDC_HPH_DSM_R1		0x3428
+#define WCD937X_DIGITAL_CDC_HPH_DSM_R2		0x3429
+#define WCD937X_DIGITAL_CDC_HPH_DSM_R3		0x342A
+#define WCD937X_DIGITAL_CDC_HPH_DSM_R4		0x342B
+#define WCD937X_DIGITAL_CDC_HPH_DSM_R5		0x342C
+#define WCD937X_DIGITAL_CDC_HPH_DSM_R6		0x342D
+#define WCD937X_DIGITAL_CDC_HPH_DSM_R7		0x342E
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A1_0	0x342F
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A1_1	0x3430
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A2_0	0x3431
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A2_1	0x3432
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A3_0	0x3433
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A3_1	0x3434
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A4_0	0x3435
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A4_1	0x3436
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A5_0	0x3437
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A5_1	0x3438
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A6_0	0x3439
+#define WCD937X_DIGITAL_CDC_AUX_DSM_A7_0	0x343A
+#define WCD937X_DIGITAL_CDC_AUX_DSM_C_0		0x343B
+#define WCD937X_DIGITAL_CDC_AUX_DSM_C_1		0x343C
+#define WCD937X_DIGITAL_CDC_AUX_DSM_C_2		0x343D
+#define WCD937X_DIGITAL_CDC_AUX_DSM_C_3		0x343E
+#define WCD937X_DIGITAL_CDC_AUX_DSM_R1		0x343F
+#define WCD937X_DIGITAL_CDC_AUX_DSM_R2		0x3440
+#define WCD937X_DIGITAL_CDC_AUX_DSM_R3		0x3441
+#define WCD937X_DIGITAL_CDC_AUX_DSM_R4		0x3442
+#define WCD937X_DIGITAL_CDC_AUX_DSM_R5		0x3443
+#define WCD937X_DIGITAL_CDC_AUX_DSM_R6		0x3444
+#define WCD937X_DIGITAL_CDC_AUX_DSM_R7		0x3445
+#define WCD937X_DIGITAL_CDC_HPH_GAIN_RX_0	0x3446
+#define WCD937X_DIGITAL_CDC_HPH_GAIN_RX_1	0x3447
+#define WCD937X_DIGITAL_CDC_HPH_GAIN_DSD_0	0x3448
+#define WCD937X_DIGITAL_CDC_HPH_GAIN_DSD_1	0x3449
+#define WCD937X_DIGITAL_CDC_HPH_GAIN_DSD_2	0x344A
+#define WCD937X_DIGITAL_CDC_AUX_GAIN_DSD_0	0x344B
+#define WCD937X_DIGITAL_CDC_AUX_GAIN_DSD_1	0x344C
+#define WCD937X_DIGITAL_CDC_AUX_GAIN_DSD_2	0x344D
+#define WCD937X_DIGITAL_CDC_HPH_GAIN_CTL	0x344E
+#define WCD937X_DIGITAL_CDC_AUX_GAIN_CTL	0x344F
+#define WCD937X_DIGITAL_CDC_EAR_PATH_CTL	0x3450
+#define WCD937X_DIGITAL_CDC_SWR_CLH		0x3451
+#define WCD937X_DIGITAL_SWR_CLH_BYP		0x3452
+#define WCD937X_DIGITAL_CDC_TX0_CTL		0x3453
+#define WCD937X_DIGITAL_CDC_TX1_CTL		0x3454
+#define WCD937X_DIGITAL_CDC_TX2_CTL		0x3455
+#define WCD937X_DIGITAL_CDC_TX_RST		0x3456
+#define WCD937X_DIGITAL_CDC_REQ_CTL		0x3457
+#define WCD937X_DIGITAL_CDC_AMIC_CTL		0x345A
+#define WCD937X_DIGITAL_CDC_DMIC_CTL		0x345B
+#define WCD937X_DIGITAL_CDC_DMIC1_CTL		0x345C
+#define WCD937X_DIGITAL_CDC_DMIC2_CTL		0x345D
+#define WCD937X_DIGITAL_CDC_DMIC3_CTL		0x345E
+#define WCD937X_DIGITAL_EFUSE_CTL		0x345F
+#define WCD937X_DIGITAL_EFUSE_PRG_CTL		0x3460
+#define WCD937X_DIGITAL_EFUSE_TEST_CTL_0	0x3461
+#define WCD937X_DIGITAL_EFUSE_TEST_CTL_1	0x3462
+#define WCD937X_DIGITAL_EFUSE_T_DATA_0		0x3463
+#define WCD937X_DIGITAL_EFUSE_T_DATA_1		0x3464
+#define WCD937X_DIGITAL_PDM_WD_CTL0		0x3465
+#define WCD937X_DIGITAL_PDM_WD_CTL1		0x3466
+#define WCD937X_DIGITAL_PDM_WD_CTL2		0x3467
+#define WCD937X_DIGITAL_INTR_MODE		0x346A
+#define WCD937X_DIGITAL_INTR_MASK_0		0x346B
+#define WCD937X_DIGITAL_INTR_MASK_1		0x346C
+#define WCD937X_DIGITAL_INTR_MASK_2		0x346D
+#define WCD937X_DIGITAL_INTR_STATUS_0		0x346E
+#define WCD937X_DIGITAL_INTR_STATUS_1		0x346F
+#define WCD937X_DIGITAL_INTR_STATUS_2		0x3470
+#define WCD937X_DIGITAL_INTR_CLEAR_0		0x3471
+#define WCD937X_DIGITAL_INTR_CLEAR_1		0x3472
+#define WCD937X_DIGITAL_INTR_CLEAR_2		0x3473
+#define WCD937X_DIGITAL_INTR_LEVEL_0		0x3474
+#define WCD937X_DIGITAL_INTR_LEVEL_1		0x3475
+#define WCD937X_DIGITAL_INTR_LEVEL_2		0x3476
+#define WCD937X_DIGITAL_INTR_SET_0		0x3477
+#define WCD937X_DIGITAL_INTR_SET_1		0x3478
+#define WCD937X_DIGITAL_INTR_SET_2		0x3479
+#define WCD937X_DIGITAL_INTR_TEST_0		0x347A
+#define WCD937X_DIGITAL_INTR_TEST_1		0x347B
+#define WCD937X_DIGITAL_INTR_TEST_2		0x347C
+#define WCD937X_DIGITAL_CDC_CONN_RX0_CTL	0x347F
+#define WCD937X_DIGITAL_CDC_CONN_RX1_CTL	0x3480
+#define WCD937X_DIGITAL_CDC_CONN_RX2_CTL	0x3481
+#define WCD937X_DIGITAL_CDC_CONN_TX_CTL		0x3482
+#define WCD937X_DIGITAL_LOOP_BACK_MODE		0x3483
+#define WCD937X_DIGITAL_SWR_DAC_TEST		0x3484
+#define WCD937X_DIGITAL_SWR_HM_TEST_RX_0	0x3485
+#define WCD937X_DIGITAL_SWR_HM_TEST_TX_0	0x3491
+#define WCD937X_DIGITAL_SWR_HM_TEST_RX_1	0x3492
+#define WCD937X_DIGITAL_SWR_HM_TEST_TX_1	0x3493
+#define WCD937X_DIGITAL_SWR_HM_TEST		0x3494
+#define WCD937X_DIGITAL_PAD_CTL_PDM_RX0		0x3495
+#define WCD937X_DIGITAL_PAD_CTL_PDM_RX1		0x3496
+#define WCD937X_DIGITAL_PAD_CTL_PDM_TX0		0x3497
+#define WCD937X_DIGITAL_PAD_CTL_PDM_TX1		0x3498
+#define WCD937X_DIGITAL_PAD_INP_DIS_0		0x3499
+#define WCD937X_DIGITAL_PAD_INP_DIS_1		0x349A
+#define WCD937X_DIGITAL_DRIVE_STRENGTH_0	0x349B
+#define WCD937X_DIGITAL_DRIVE_STRENGTH_1	0x349C
+#define WCD937X_DIGITAL_DRIVE_STRENGTH_2	0x349D
+#define WCD937X_DIGITAL_RX_DATA_EDGE_CTL	0x349E
+#define WCD937X_DIGITAL_TX_DATA_EDGE_CTL	0x349F
+#define WCD937X_DIGITAL_GPIO_MODE		0x34A0
+#define WCD937X_DIGITAL_PIN_CTL_OE		0x34A1
+#define WCD937X_DIGITAL_PIN_CTL_DATA_0		0x34A2
+#define WCD937X_DIGITAL_PIN_CTL_DATA_1		0x34A3
+#define WCD937X_DIGITAL_PIN_STATUS_0		0x34A4
+#define WCD937X_DIGITAL_PIN_STATUS_1		0x34A5
+#define WCD937X_DIGITAL_DIG_DEBUG_CTL		0x34A6
+#define WCD937X_DIGITAL_DIG_DEBUG_EN		0x34A7
+#define WCD937X_DIGITAL_ANA_CSR_DBG_ADD		0x34A8
+#define WCD937X_DIGITAL_ANA_CSR_DBG_CTL		0x34A9
+#define WCD937X_DIGITAL_SSP_DBG			0x34AA
+#define WCD937X_DIGITAL_MODE_STATUS_0		0x34AB
+#define WCD937X_DIGITAL_MODE_STATUS_1		0x34AC
+#define WCD937X_DIGITAL_SPARE_0			0x34AD
+#define WCD937X_DIGITAL_SPARE_1			0x34AE
+#define WCD937X_DIGITAL_SPARE_2			0x34AF
+#define WCD937X_DIGITAL_EFUSE_REG_0		0x34B0
+#define WCD937X_DIGITAL_EFUSE_REG_1		0x34B1
+#define WCD937X_DIGITAL_EFUSE_REG_2		0x34B2
+#define WCD937X_DIGITAL_EFUSE_REG_3		0x34B3
+#define WCD937X_DIGITAL_EFUSE_REG_4		0x34B4
+#define WCD937X_DIGITAL_EFUSE_REG_5		0x34B5
+#define WCD937X_DIGITAL_EFUSE_REG_6		0x34B6
+#define WCD937X_DIGITAL_EFUSE_REG_7		0x34B7
+#define WCD937X_DIGITAL_EFUSE_REG_8		0x34B8
+#define WCD937X_DIGITAL_EFUSE_REG_9		0x34B9
+#define WCD937X_DIGITAL_EFUSE_REG_10		0x34BA
+#define WCD937X_DIGITAL_EFUSE_REG_11		0x34BB
+#define WCD937X_DIGITAL_EFUSE_REG_12		0x34BC
+#define WCD937X_DIGITAL_EFUSE_REG_13		0x34BD
+#define WCD937X_DIGITAL_EFUSE_REG_14		0x34BE
+#define WCD937X_DIGITAL_EFUSE_REG_15		0x34BF
+#define WCD937X_DIGITAL_EFUSE_REG_16		0x34C0
+#define WCD937X_DIGITAL_EFUSE_REG_17		0x34C1
+#define WCD937X_DIGITAL_EFUSE_REG_18		0x34C2
+#define WCD937X_DIGITAL_EFUSE_REG_19		0x34C3
+#define WCD937X_DIGITAL_EFUSE_REG_20		0x34C4
+#define WCD937X_DIGITAL_EFUSE_REG_21		0x34C5
+#define WCD937X_DIGITAL_EFUSE_REG_22		0x34C6
+#define WCD937X_DIGITAL_EFUSE_REG_23		0x34C7
+#define WCD937X_DIGITAL_EFUSE_REG_24		0x34C8
+#define WCD937X_DIGITAL_EFUSE_REG_25		0x34C9
+#define WCD937X_DIGITAL_EFUSE_REG_26		0x34CA
+#define WCD937X_DIGITAL_EFUSE_REG_27		0x34CB
+#define WCD937X_DIGITAL_EFUSE_REG_28		0x34CC
+#define WCD937X_DIGITAL_EFUSE_REG_29		0x34CD
+#define WCD937X_DIGITAL_EFUSE_REG_30		0x34CE
+#define WCD937X_DIGITAL_EFUSE_REG_31		0x34CF
+#define WCD937X_MAX_REGISTER			(WCD937X_DIGITAL_EFUSE_REG_31)
+
+#define WCD937X_MAX_MICBIAS			3
+#define WCD937X_MAX_BULK_SUPPLY			3
+#define WCD937X_MAX_TX_SWR_PORTS		4
+#define WCD937X_MAX_SWR_PORTS			5
+#define WCD937X_MAX_SWR_CH_IDS			15
+
+/* Convert from vout ctl to micbias voltage in mV */
+#define WCD_VOUT_CTL_TO_MICB(v)  (1000 + v * 50)
+#define MAX_PORT 8
+#define MAX_CH_PER_PORT 8
+#define MAX_TX_PWR_CH 2
+#define SWR_NUM_PORTS 4
+
+#define WCD937X_MAX_SLAVE_PORT_TYPES 10
+
+struct codec_port_info {
+	u32 slave_port_type;
+	u32 master_port_type;
+	u32 ch_mask;
+	u32 num_ch;
+	u32 ch_rate;
+};
+
+struct wcd937x_sdw_ch_info {
+	int port_num;
+	unsigned int ch_mask;
+};
+
+#define WCD_SDW_CH(id, pn, cmask)	\
+	[id] = {			\
+		.port_num = pn,		\
+		.ch_mask = cmask,	\
+	}
+
+struct wcd937x_priv;
+struct wcd937x_sdw_priv {
+	struct sdw_slave *sdev;
+	struct sdw_stream_config sconfig;
+	struct sdw_stream_runtime *sruntime;
+	struct sdw_port_config port_config[WCD937X_MAX_SWR_PORTS];
+	struct wcd937x_sdw_ch_info *ch_info;
+	bool port_enable[WCD937X_MAX_SWR_CH_IDS];
+	int active_ports;
+	int num_ports;
+	bool is_tx;
+	struct wcd937x_priv *wcd937x;
+	struct irq_domain *slave_irq;
+	struct regmap *regmap;
+};
+
+#if IS_ENABLED(CONFIG_SND_SOC_WCD937X_SDW)
+int wcd937x_sdw_free(struct wcd937x_sdw_priv *wcd,
+		     struct snd_pcm_substream *substream,
+		     struct snd_soc_dai *dai);
+int wcd937x_sdw_set_sdw_stream(struct wcd937x_sdw_priv *wcd,
+			       struct snd_soc_dai *dai,
+			       void *stream, int direction);
+int wcd937x_sdw_hw_params(struct wcd937x_sdw_priv *wcd,
+			  struct snd_pcm_substream *substream,
+			  struct snd_pcm_hw_params *params,
+			  struct snd_soc_dai *dai);
+
+struct device *wcd937x_sdw_device_get(struct device_node *np);
+
+#else
+int wcd937x_sdw_free(struct wcd937x_sdw_priv *wcd,
+		     struct snd_pcm_substream *substream,
+		     struct snd_soc_dai *dai)
+{
+	return -EOPNOTSUPP;
+}
+
+int wcd937x_sdw_set_sdw_stream(struct wcd937x_sdw_priv *wcd,
+			       struct snd_soc_dai *dai,
+			       void *stream, int direction)
+{
+	return -EOPNOTSUPP;
+}
+
+int wcd937x_sdw_hw_params(struct wcd937x_sdw_priv *wcd,
+			  struct snd_pcm_substream *substream,
+			  struct snd_pcm_hw_params *params,
+			  struct snd_soc_dai *dai)
+{
+	return -EOPNOTSUPP;
+}
+#endif
+enum {
+	WCD_RX1,
+	WCD_RX2,
+	WCD_RX3
+};
+
+enum {
+	/* INTR_CTRL_INT_MASK_0 */
+	WCD937X_IRQ_MBHC_BUTTON_PRESS_DET = 0,
+	WCD937X_IRQ_MBHC_BUTTON_RELEASE_DET,
+	WCD937X_IRQ_MBHC_ELECT_INS_REM_DET,
+	WCD937X_IRQ_MBHC_ELECT_INS_REM_LEG_DET,
+	WCD937X_IRQ_MBHC_SW_DET,
+	WCD937X_IRQ_HPHR_OCP_INT,
+	WCD937X_IRQ_HPHR_CNP_INT,
+	WCD937X_IRQ_HPHL_OCP_INT,
+
+	/* INTR_CTRL_INT_MASK_1 */
+	WCD937X_IRQ_HPHL_CNP_INT,
+	WCD937X_IRQ_EAR_CNP_INT,
+	WCD937X_IRQ_EAR_SCD_INT,
+	WCD937X_IRQ_AUX_CNP_INT,
+	WCD937X_IRQ_AUX_SCD_INT,
+	WCD937X_IRQ_HPHL_PDM_WD_INT,
+	WCD937X_IRQ_HPHR_PDM_WD_INT,
+	WCD937X_IRQ_AUX_PDM_WD_INT,
+
+	/* INTR_CTRL_INT_MASK_2 */
+	WCD937X_IRQ_LDORT_SCD_INT,
+	WCD937X_IRQ_MBHC_MOISTURE_INT,
+	WCD937X_IRQ_HPHL_SURGE_DET_INT,
+	WCD937X_IRQ_HPHR_SURGE_DET_INT,
+	WCD937X_NUM_IRQS,
+};
+
+enum wcd937x_tx_sdw_ports {
+	WCD937X_SDW_PORT0 = 1,
+	WCD937X_SDW_PORT1,
+	WCD937X_SDW_PORT2,
+	WCD937X_SDW_PORT3,
+};
+
+enum wcd937x_tx_sdw_channels {
+	WCD937X_ADC1,
+	WCD937X_ADC2,
+	WCD937X_ADC3,
+	WCD937X_ADC4,
+	WCD937X_DMIC0,
+	WCD937X_DMIC1,
+	WCD937X_MBHC,
+	WCD937X_DMIC2,
+	WCD937X_DMIC3,
+	WCD937X_DMIC4,
+	WCD937X_DMIC5,
+	WCD937X_DMIC6,
+	WCD937X_DMIC7,
+};
+
+enum wcd937x_rx_sdw_ports {
+	WCD937X_HPH_PORT = 1,
+	WCD937X_CLSH_PORT,
+	WCD937X_COMP_PORT,
+	WCD937X_LO_PORT,
+	WCD937X_DSD_PORT,
+};
+
+enum wcd937x_rx_sdw_channels {
+	WCD937X_HPH_L,
+	WCD937X_HPH_R,
+	WCD937X_CLSH,
+	WCD937X_COMP_L,
+	WCD937X_COMP_R,
+	WCD937X_LO,
+	WCD937X_DSD_R,
+	WCD937X_DSD_L,
+};
+
+enum {
+	WCD937X_SDW_DIR_RX,
+	WCD937X_SDW_DIR_TX,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/sound/soc/codecs/wcd938x-sdw.c
+++ linux-qcom-6.8.0/sound/soc/codecs/wcd938x-sdw.c
@@ -1252,12 +1252,12 @@
 	pdev->prop.lane_control_support = true;
 	pdev->prop.simple_clk_stop_capable = true;
 	if (wcd->is_tx) {
-		pdev->prop.source_ports = GENMASK(WCD938X_MAX_SWR_PORTS, 0);
+		pdev->prop.source_ports = GENMASK(WCD938X_MAX_SWR_PORTS - 1, 0);
 		pdev->prop.src_dpn_prop = wcd938x_dpn_prop;
 		wcd->ch_info = &wcd938x_sdw_tx_ch_info[0];
 		pdev->prop.wake_capable = true;
 	} else {
-		pdev->prop.sink_ports = GENMASK(WCD938X_MAX_SWR_PORTS, 0);
+		pdev->prop.sink_ports = GENMASK(WCD938X_MAX_SWR_PORTS - 1, 0);
 		pdev->prop.sink_dpn_prop = wcd938x_dpn_prop;
 		wcd->ch_info = &wcd938x_sdw_rx_ch_info[0];
 	}
--- linux-qcom-6.8.0.orig/sound/soc/codecs/wm_adsp.c
+++ linux-qcom-6.8.0/sound/soc/codecs/wm_adsp.c
@@ -683,11 +683,12 @@
 int wm_adsp_write_ctl(struct wm_adsp *dsp, const char *name, int type,
 		      unsigned int alg, void *buf, size_t len)
 {
-	struct cs_dsp_coeff_ctl *cs_ctl = cs_dsp_get_ctl(&dsp->cs_dsp, name, type, alg);
+	struct cs_dsp_coeff_ctl *cs_ctl;
 	struct wm_coeff_ctl *ctl;
 	int ret;
 
 	mutex_lock(&dsp->cs_dsp.pwr_lock);
+	cs_ctl = cs_dsp_get_ctl(&dsp->cs_dsp, name, type, alg);
 	ret = cs_dsp_coeff_write_ctrl(cs_ctl, 0, buf, len);
 	mutex_unlock(&dsp->cs_dsp.pwr_lock);
 
--- linux-qcom-6.8.0.orig/sound/soc/codecs/wsa881x.c
+++ linux-qcom-6.8.0/sound/soc/codecs/wsa881x.c
@@ -1152,9 +1152,10 @@
 	wsa881x->sconfig.frame_rate = 48000;
 	wsa881x->sconfig.direction = SDW_DATA_DIR_RX;
 	wsa881x->sconfig.type = SDW_STREAM_PDM;
-	pdev->prop.sink_ports = GENMASK(WSA881X_MAX_SWR_PORTS, 0);
+	pdev->prop.sink_ports = GENMASK(WSA881X_MAX_SWR_PORTS - 1, 0);
 	pdev->prop.sink_dpn_prop = wsa_sink_dpn_prop;
 	pdev->prop.scp_int1_mask = SDW_SCP_INT1_BUS_CLASH | SDW_SCP_INT1_PARITY;
+	pdev->prop.clk_stop_mode1 = true;
 	gpiod_direction_output(wsa881x->sd_n, !wsa881x->sd_n_val);
 
 	wsa881x->regmap = devm_regmap_init_sdw(pdev, &wsa881x_regmap_config);
--- linux-qcom-6.8.0.orig/sound/soc/codecs/wsa883x.c
+++ linux-qcom-6.8.0/sound/soc/codecs/wsa883x.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/bitops.h>
@@ -412,9 +413,17 @@
 #define WSA883X_NUM_REGISTERS           (WSA883X_EMEM_63 + 1)
 #define WSA883X_MAX_REGISTER            (WSA883X_NUM_REGISTERS - 1)
 
+#define T1_TEMP -10
+#define T2_TEMP 150
+#define LOW_TEMP_THRESHOLD 5
+#define HIGH_TEMP_THRESHOLD 45
+#define TEMP_INVALID	0xFFFF
+#define WSA883X_TEMP_RETRY 3
+
 #define WSA883X_VERSION_1_0 0
 #define WSA883X_VERSION_1_1 1
 
+#define SWRS_SCP_HOST_CLK_DIV2_CTL_BANK(m)	(0xE0 + 0x10 * (m))
 #define WSA883X_MAX_SWR_PORTS   4
 #define WSA883X_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\
 			SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\
@@ -434,16 +443,29 @@
 	struct regulator *vdd;
 	struct sdw_slave *slave;
 	struct sdw_stream_config sconfig;
+	struct sdw_stream_config vi_sconfig;
 	struct sdw_stream_runtime *sruntime;
 	struct sdw_port_config port_config[WSA883X_MAX_SWR_PORTS];
+	struct mutex res_lock;
 	struct gpio_desc *sd_n;
 	bool port_prepared[WSA883X_MAX_SWR_PORTS];
 	bool port_enable[WSA883X_MAX_SWR_PORTS];
+	int curr_temp;
 	int version;
 	int variant;
 	int active_ports;
 	int dev_mode;
 	int comp_offset;
+	unsigned long status_mask;
+};
+
+struct wsa_temp_register {
+	u8 d1_msb;
+	u8 d1_lsb;
+	u8 d2_msb;
+	u8 d2_lsb;
+	u8 dmeas_msb;
+	u8 dmeas_lsb;
 };
 
 enum {
@@ -454,6 +476,12 @@
 };
 
 enum {
+	SPKR_STATUS = 0,
+	WSA_SUPPLIES_LPM_MODE,
+	SPKR_ADIE_LB,
+};
+
+enum {
 	COMP_OFFSET0,
 	COMP_OFFSET1,
 	COMP_OFFSET2,
@@ -512,7 +540,7 @@
 		.num = 4,
 		.type = SDW_DPN_SIMPLE,
 		.min_ch = 1,
-		.max_ch = 1,
+		.max_ch = 2,
 		.simple_ch_prep_sm = true,
 		.read_only_wordlength = true,
 	}
@@ -886,6 +914,163 @@
 	{ WSA883X_EMEM_63, 0x00 },
 };
 
+static int32_t wsa883x_temp_reg_read(struct snd_soc_component *component,
+				     struct wsa_temp_register *wsa_temp_reg)
+{
+	struct wsa883x_priv *wsa883x = snd_soc_component_get_drvdata(component);
+	int ret = 0;
+	unsigned int val = 0;
+
+	if (!wsa883x) {
+		dev_err(component->dev, "%s: wsa883x is NULL\n", __func__);
+		return -EINVAL;
+	}
+
+	pm_runtime_get_sync(wsa883x->dev);
+	mutex_lock(&wsa883x->res_lock);
+
+	regmap_update_bits(component->regmap, WSA883X_PA_FSM_BYP, 0x01, 0x01);
+	regmap_update_bits(component->regmap, WSA883X_PA_FSM_BYP, 0x04, 0x04);
+	regmap_update_bits(component->regmap, WSA883X_PA_FSM_BYP, 0x02, 0x02);
+	regmap_update_bits(component->regmap, WSA883X_PA_FSM_BYP, 0x80, 0x80);
+	regmap_update_bits(component->regmap, WSA883X_PA_FSM_BYP, 0x20, 0x20);
+	regmap_update_bits(component->regmap, WSA883X_PA_FSM_BYP, 0x40, 0x40);
+
+	regmap_update_bits(component->regmap, WSA883X_TADC_VALUE_CTL, 0x01, 0x00);
+
+	regmap_read(component->regmap, WSA883X_TEMP_MSB, &val);
+	wsa_temp_reg->dmeas_msb = val;
+
+	regmap_read(component->regmap, WSA883X_TEMP_LSB, &val);
+	wsa_temp_reg->dmeas_lsb = val;
+
+	regmap_update_bits(component->regmap, WSA883X_TADC_VALUE_CTL, 0x01, 0x01);
+
+	regmap_read(component->regmap, WSA883X_OTP_REG_1, &val);
+	wsa_temp_reg->d1_msb = val;
+
+	regmap_read(component->regmap, WSA883X_OTP_REG_2, &val);
+	wsa_temp_reg->d1_lsb = val;
+
+	regmap_read(component->regmap, WSA883X_OTP_REG_3, &val);
+	wsa_temp_reg->d2_msb = val;
+
+	regmap_read(component->regmap, WSA883X_OTP_REG_4, &val);
+	wsa_temp_reg->d2_lsb = val;
+
+	regmap_update_bits(component->regmap, WSA883X_PA_FSM_BYP, 0xE7, 0x00);
+
+	mutex_unlock(&wsa883x->res_lock);
+	pm_runtime_mark_last_busy(wsa883x->dev);
+	pm_runtime_put_autosuspend(wsa883x->dev);
+
+	return 0;
+}
+
+
+static int wsa883x_get_temperature(struct snd_soc_component *component, int *temp)
+{
+
+	struct wsa_temp_register reg;
+	int dmeas, d1, d2;
+	int ret = 0;
+	int temp_val = 0;
+	int t1 = T1_TEMP;
+	int t2 = T2_TEMP;
+	u8 retry = WSA883X_TEMP_RETRY;
+	struct wsa883x_priv *wsa883x = snd_soc_component_get_drvdata(component);
+
+	if (!wsa883x)
+		return -EINVAL;
+
+	do {
+		ret = wsa883x_temp_reg_read(component, &reg);
+		if (ret) {
+			pr_err("%s: temp read failed: %d, current temp: %d\n",
+				__func__, ret, wsa883x->curr_temp);
+			if (temp)
+				*temp = wsa883x->curr_temp;
+			return 0;
+		}
+		/*
+		 * Temperature register values are expected to be in the
+		 * following range.
+		 * d1_msb  = 68 - 92 and d1_lsb  = 0, 64, 128, 192
+		 * d2_msb  = 185 -218 and  d2_lsb  = 0, 64, 128, 192
+		 */
+		if ((reg.d1_msb < 68 || reg.d1_msb > 92) ||
+		    (!(reg.d1_lsb == 0 || reg.d1_lsb == 64 || reg.d1_lsb == 128 ||
+			reg.d1_lsb == 192)) ||
+		    (reg.d2_msb < 185 || reg.d2_msb > 218) ||
+		    (!(reg.d2_lsb == 0 || reg.d2_lsb == 64 || reg.d2_lsb == 128 ||
+			reg.d2_lsb == 192))) {
+			printk_ratelimited("%s: Temperature registers[%d %d %d %d] are out of range\n",
+					   __func__, reg.d1_msb, reg.d1_lsb, reg.d2_msb,
+					   reg.d2_lsb);
+		}
+		dmeas = ((reg.dmeas_msb << 0x8) | reg.dmeas_lsb) >> 0x6;
+		d1 = ((reg.d1_msb << 0x8) | reg.d1_lsb) >> 0x6;
+		d2 = ((reg.d2_msb << 0x8) | reg.d2_lsb) >> 0x6;
+
+		if (d1 == d2)
+			temp_val = TEMP_INVALID;
+		else
+			temp_val = t1 + (((dmeas - d1) * (t2 - t1))/(d2 - d1));
+
+		//pr_err("%s: Calculated temperature value = %d\n", __func__, temp_val);
+		/* temp_val = 25; */
+
+		if (temp_val <= LOW_TEMP_THRESHOLD ||
+			temp_val >= HIGH_TEMP_THRESHOLD) {
+			pr_debug("%s: T0: %d is out of range[%d, %d]\n", __func__,
+				 temp_val, LOW_TEMP_THRESHOLD, HIGH_TEMP_THRESHOLD);
+			if (retry--)
+				usleep_range(10000, 15000);
+		} else {
+			break;
+		}
+	} while (retry);
+
+	wsa883x->curr_temp = temp_val;
+	if (temp)
+		*temp = temp_val;
+	pr_debug("%s: t0 measured: %d dmeas = %d, d1 = %d, d2 = %d\n",
+		  __func__, temp_val, dmeas, d1, d2);
+
+	return ret;
+}
+
+static int wsa_get_temp(struct snd_kcontrol *kcontrol,
+			       struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component =
+			snd_soc_kcontrol_component(kcontrol);
+	struct wsa883x_priv *wsa883x = snd_soc_component_get_drvdata(component);
+	int temp = 0;
+
+	if (test_bit(SPKR_STATUS, &wsa883x->status_mask))
+		temp = wsa883x->curr_temp;
+	else
+		wsa883x_get_temperature(component, &temp);
+
+	ucontrol->value.integer.value[0] = temp;
+
+	return 0;
+}
+
+static int wsa883x_get_dev_num(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component =
+			snd_soc_kcontrol_component(kcontrol);
+
+	struct wsa883x_priv *wsa883x = snd_soc_component_get_drvdata(component);
+
+	ucontrol->value.integer.value[0] = wsa883x->slave->dev_num;
+	return 0;
+
+}
+
 static bool wsa883x_readonly_register(struct device *dev, unsigned int reg)
 {
 	switch (reg) {
@@ -949,64 +1134,82 @@
 	.use_single_read = true,
 };
 
-static const struct reg_sequence reg_init[] = {
-	{WSA883X_PA_FSM_BYP, 0x00},
-	{WSA883X_ADC_6, 0x02},
-	{WSA883X_CDC_SPK_DSM_A2_0, 0x0A},
-	{WSA883X_CDC_SPK_DSM_A2_1, 0x08},
-	{WSA883X_CDC_SPK_DSM_A3_0, 0xF3},
-	{WSA883X_CDC_SPK_DSM_A3_1, 0x07},
-	{WSA883X_CDC_SPK_DSM_A4_0, 0x79},
-	{WSA883X_CDC_SPK_DSM_A4_1, 0x02},
-	{WSA883X_CDC_SPK_DSM_A5_0, 0x0B},
-	{WSA883X_CDC_SPK_DSM_A5_1, 0x02},
-	{WSA883X_CDC_SPK_DSM_A6_0, 0x8A},
-	{WSA883X_CDC_SPK_DSM_A7_0, 0x9B},
-	{WSA883X_CDC_SPK_DSM_C_0, 0x68},
-	{WSA883X_CDC_SPK_DSM_C_1, 0x54},
-	{WSA883X_CDC_SPK_DSM_C_2, 0xF2},
-	{WSA883X_CDC_SPK_DSM_C_3, 0x20},
-	{WSA883X_CDC_SPK_DSM_R1, 0x83},
-	{WSA883X_CDC_SPK_DSM_R2, 0x7F},
-	{WSA883X_CDC_SPK_DSM_R3, 0x9D},
-	{WSA883X_CDC_SPK_DSM_R4, 0x82},
-	{WSA883X_CDC_SPK_DSM_R5, 0x8B},
-	{WSA883X_CDC_SPK_DSM_R6, 0x9B},
-	{WSA883X_CDC_SPK_DSM_R7, 0x3F},
-	{WSA883X_VBAT_SNS, 0x20},
-	{WSA883X_DRE_CTL_0, 0x92},
-	{WSA883X_DRE_IDLE_DET_CTL, 0x0F},
-	{WSA883X_CURRENT_LIMIT, 0xC4},
-	{WSA883X_VAGC_TIME, 0x0F},
-	{WSA883X_VAGC_ATTN_LVL_1_2, 0x00},
-	{WSA883X_VAGC_ATTN_LVL_3, 0x01},
-	{WSA883X_VAGC_CTL, 0x01},
-	{WSA883X_TAGC_CTL, 0x1A},
-	{WSA883X_TAGC_TIME, 0x2C},
-	{WSA883X_TEMP_CONFIG0, 0x02},
-	{WSA883X_TEMP_CONFIG1, 0x02},
-	{WSA883X_OTP_REG_1, 0x49},
-	{WSA883X_OTP_REG_2, 0x80},
-	{WSA883X_OTP_REG_3, 0xC9},
-	{WSA883X_OTP_REG_4, 0x40},
-	{WSA883X_TAGC_CTL, 0x1B},
-	{WSA883X_ADC_2, 0x00},
-	{WSA883X_ADC_7, 0x85},
-	{WSA883X_ADC_7, 0x87},
-	{WSA883X_CKWD_CTL_0, 0x14},
-	{WSA883X_CKWD_CTL_1, 0x1B},
-	{WSA883X_GMAMP_SUP1, 0xE2},
+struct wsa_reg_mask_val {
+	u16 reg;
+	u8 mask;
+	u8 val;
+};
+
+static const struct wsa_reg_mask_val reg_init[] = {
+
+	{WSA883X_PA_FSM_BYP, 0x01, 0x00},
+	{WSA883X_ISENSE2, 0xE0, 0x40},
+	{WSA883X_ADC_6, 0x02, 0x02},
+	{WSA883X_CDC_SPK_DSM_A2_0, 0xFF, 0x0A},
+	{WSA883X_CDC_SPK_DSM_A2_1, 0x0F, 0x08},
+	{WSA883X_CDC_SPK_DSM_A3_0, 0xFF, 0xF3},
+	{WSA883X_CDC_SPK_DSM_A3_1, 0x07, 0x07},
+	{WSA883X_CDC_SPK_DSM_A4_0, 0xFF, 0x79},
+	{WSA883X_CDC_SPK_DSM_A4_1, 0x03, 0x02},
+	{WSA883X_CDC_SPK_DSM_A5_0, 0xFF, 0x0B},
+	{WSA883X_CDC_SPK_DSM_A5_1, 0x03, 0x02},
+	{WSA883X_CDC_SPK_DSM_A6_0, 0xFF, 0x8A},
+	{WSA883X_CDC_SPK_DSM_A7_0, 0xFF, 0x9B},
+	{WSA883X_CDC_SPK_DSM_C_0, 0xFF, 0x68},
+	{WSA883X_CDC_SPK_DSM_C_1, 0xFF, 0x54},
+	{WSA883X_CDC_SPK_DSM_C_2, 0xFF, 0xF2},
+	{WSA883X_CDC_SPK_DSM_C_3, 0x3F, 0x20},
+	{WSA883X_CDC_SPK_DSM_R1, 0xFF, 0x83},
+	{WSA883X_CDC_SPK_DSM_R2, 0xFF, 0x7F},
+	{WSA883X_CDC_SPK_DSM_R3, 0xFF, 0x9D},
+	{WSA883X_CDC_SPK_DSM_R4, 0xFF, 0x82},
+	{WSA883X_CDC_SPK_DSM_R5, 0xFF, 0x8B},
+	{WSA883X_CDC_SPK_DSM_R6, 0xFF, 0x9B},
+	{WSA883X_CDC_SPK_DSM_R7, 0xFF, 0x3F},
+	{WSA883X_VBAT_SNS, 0x60, 0x20},
+	{WSA883X_DRE_CTL_0, 0xF0, 0x90},
+	{WSA883X_DRE_IDLE_DET_CTL, 0x10, 0x00},
+	{WSA883X_CURRENT_LIMIT, 0x78, 0x40},
+	{WSA883X_DRE_CTL_0, 0x07, 0x02},
+	{WSA883X_VAGC_TIME, 0x0F, 0x0F},
+	{WSA883X_VAGC_ATTN_LVL_1_2, 0xFF, 0x00},
+	{WSA883X_VAGC_ATTN_LVL_3, 0xFF, 0x00},
+	{WSA883X_VAGC_CTL, 0x01, 0x01},
+	{WSA883X_TAGC_CTL, 0x0E, 0x0A},
+	{WSA883X_TAGC_TIME, 0x0C, 0x0C},
+	{WSA883X_TAGC_E2E_GAIN, 0x1F, 0x02},
+	{WSA883X_TEMP_CONFIG0, 0x07, 0x02},
+	{WSA883X_TEMP_CONFIG1, 0x07, 0x02},
+	{WSA883X_OTP_REG_1, 0xFF, 0x49},
+	{WSA883X_OTP_REG_2, 0xC0, 0x80},
+	{WSA883X_OTP_REG_3, 0xFF, 0xC9},
+	{WSA883X_OTP_REG_4, 0xC0, 0x40},
+	{WSA883X_TAGC_CTL, 0x01, 0x01},
+	{WSA883X_ADC_2, 0x40, 0x00},
+	{WSA883X_ADC_7, 0x04, 0x04},
+	{WSA883X_ADC_7, 0x02, 0x02},
+	{WSA883X_CKWD_CTL_0, 0x60, 0x00},
+	{WSA883X_DRE_CTL_1, 0x3E, 0x20},
+	{WSA883X_CKWD_CTL_1, 0x1F, 0x1B},
+	{WSA883X_GMAMP_SUP1, 0x60, 0x60},
 };
 
-static void wsa883x_init(struct wsa883x_priv *wsa883x)
+static int wsa883x_get_temperature(struct snd_soc_component *component,
+	int *temp);
+
+static int wsa883x_init(struct wsa883x_priv *wsa883x)
 {
 	struct regmap *regmap = wsa883x->regmap;
-	int variant, version;
+	int variant, version, ret, i;
 
-	regmap_read(regmap, WSA883X_OTP_REG_0, &variant);
+	ret = regmap_read(regmap, WSA883X_OTP_REG_0, &variant);
+	if (ret)
+		return ret;
 	wsa883x->variant = variant & WSA883X_ID_MASK;
 
-	regmap_read(regmap, WSA883X_CHIP_ID0, &version);
+	ret = regmap_read(regmap, WSA883X_CHIP_ID0, &version);
+	if (ret)
+		return ret;
 	wsa883x->version = version;
 
 	switch (wsa883x->variant) {
@@ -1033,7 +1236,9 @@
 	wsa883x->comp_offset = COMP_OFFSET2;
 
 	/* Initial settings */
-	regmap_multi_reg_write(regmap, reg_init, ARRAY_SIZE(reg_init));
+	for (i = 0; i < ARRAY_SIZE(reg_init); i++)
+		regmap_update_bits(regmap, reg_init[i].reg,
+				reg_init[i].mask, reg_init[i].val);
 
 	if (wsa883x->variant == WSA8830 || wsa883x->variant == WSA8832) {
 		wsa883x->comp_offset = COMP_OFFSET3;
@@ -1041,6 +1246,8 @@
 				   WSA883X_DRE_OFFSET_MASK,
 				   wsa883x->comp_offset);
 	}
+
+	return 0;
 }
 
 static int wsa883x_update_status(struct sdw_slave *slave,
@@ -1049,7 +1256,7 @@
 	struct wsa883x_priv *wsa883x = dev_get_drvdata(&slave->dev);
 
 	if (status == SDW_SLAVE_ATTACHED && slave->dev_num > 0)
-		wsa883x_init(wsa883x);
+		return wsa883x_init(wsa883x);
 
 	return 0;
 }
@@ -1068,8 +1275,18 @@
 	return 0;
 }
 
+static int wsa883x_bus_config(struct sdw_slave *slave,
+			      struct sdw_bus_params *params)
+{
+	sdw_write(slave, SWRS_SCP_HOST_CLK_DIV2_CTL_BANK(params->next_bank),
+		  0x01);
+
+	return 0;
+}
+
 static const struct sdw_slave_ops wsa883x_slave_ops = {
 	.update_status = wsa883x_update_status,
+	.bus_config = wsa883x_bus_config,
 	.port_prep = wsa883x_port_prep,
 };
 
@@ -1207,10 +1424,18 @@
 			break;
 		}
 
+		snd_soc_component_write_field(component, WSA883X_DRE_CTL_1,
+					      WSA883X_DRE_GAIN_EN_MASK,
+					      WSA883X_DRE_GAIN_FROM_CSR);
 		if (wsa883x->port_enable[WSA883X_PORT_COMP])
 			snd_soc_component_write_field(component, WSA883X_DRE_CTL_0,
 						      WSA883X_DRE_OFFSET_MASK,
 						      wsa883x->comp_offset);
+		usleep_range(250, 300);
+		snd_soc_component_write_field(component, WSA883X_DRE_CTL_1,
+					      WSA883X_DRE_GAIN_EN_MASK,
+					      WSA883X_DRE_GAIN_FROM_CSR);
+		usleep_range(250, 300);
 		snd_soc_component_write_field(component, WSA883X_VBAT_ADC_FLT_CTL,
 					      WSA883X_VBAT_ADC_COEF_SEL_MASK,
 					      WSA883X_VBAT_ADC_COEF_F_1DIV16);
@@ -1219,6 +1444,14 @@
 		snd_soc_component_write_field(component, WSA883X_PDM_WD_CTL,
 					      WSA883X_PDM_EN_MASK,
 					      WSA883X_PDM_ENABLE);
+		snd_soc_component_write_field(component, WSA883X_PA_FSM_CTL,
+					      WSA883X_GLOBAL_PA_EN_MASK,
+					      WSA883X_GLOBAL_PA_ENABLE);
+		usleep_range(3000, 3100);
+		snd_soc_component_write_field(component,
+						WSA883X_DRE_CTL_1,
+						WSA883X_DRE_GAIN_EN_MASK, 0x00);
+		usleep_range(5000, 5050);
 
 		break;
 	case SND_SOC_DAPM_PRE_PMD:
@@ -1228,6 +1461,12 @@
 					      WSA883X_VBAT_ADC_COEF_SEL_MASK,
 					      WSA883X_VBAT_ADC_COEF_F_1DIV2);
 		snd_soc_component_write_field(component, WSA883X_PA_FSM_CTL,
+					      0x01, 0x00);
+		snd_soc_component_write_field(component, WSA883X_PA_FSM_CTL,
+					      0x10, 0x00);
+		snd_soc_component_write_field(component, WSA883X_PA_FSM_CTL,
+					      0x0f, 0x10);
+		snd_soc_component_write_field(component, WSA883X_PA_FSM_CTL,
 					      WSA883X_GLOBAL_PA_EN_MASK, 0);
 		snd_soc_component_write_field(component, WSA883X_PDM_WD_CTL,
 					      WSA883X_PDM_EN_MASK, 0);
@@ -1244,6 +1483,10 @@
 static const struct snd_kcontrol_new wsa883x_snd_controls[] = {
 	SOC_SINGLE_RANGE_TLV("PA Volume", WSA883X_DRE_CTL_1, 1,
 			     0x0, 0x1f, 1, pa_gain),
+	SOC_SINGLE_EXT("WSA Temp", SND_SOC_NOPM, 0, UINT_MAX, 0,
+		       wsa_get_temp, NULL),
+	SOC_SINGLE_EXT("WSA Get DevNum", SND_SOC_NOPM, 0, UINT_MAX, 0,
+			wsa883x_get_dev_num, NULL),
 	SOC_ENUM_EXT("WSA MODE", wsa_dev_mode_enum,
 		     wsa_dev_mode_get, wsa_dev_mode_put),
 	SOC_SINGLE_EXT("COMP Offset", SND_SOC_NOPM, 0, 4, 0,
@@ -1344,7 +1587,6 @@
 	.hw_free = wsa883x_hw_free,
 	.mute_stream = wsa883x_digital_mute,
 	.set_stream = wsa883x_set_sdw_stream,
-	.mute_unmute_on_trigger = true,
 };
 
 static struct snd_soc_dai_driver wsa883x_dais[] = {
@@ -1361,6 +1603,19 @@
 		},
 		.ops = &wsa883x_dai_ops,
 	},
+	{
+		.name = "VI",
+		.capture = {
+			.stream_name = "VI Capture",
+			.rates = WSA883X_RATES | WSA883X_FRAC_RATES,
+			.formats = WSA883X_FORMATS,
+			.rate_min = 8000,
+			.rate_max = 352800,
+			.channels_min = 1,
+			.channels_max = 2,
+		},
+		.ops = &wsa883x_dai_ops,
+	},
 };
 
 static int wsa883x_probe(struct sdw_slave *pdev,
@@ -1379,6 +1634,16 @@
 		return dev_err_probe(dev, PTR_ERR(wsa883x->vdd),
 				     "No vdd regulator found\n");
 
+	ret = regulator_set_voltage(wsa883x->vdd, 1800000, 1800000);
+	if (ret)
+		dev_err_probe(dev, PTR_ERR(wsa883x->vdd),
+			      "failed to set the vdd vol 1.8v\n");
+
+	ret = regulator_set_load(wsa883x->vdd, 20000);
+	if (ret)
+		dev_err_probe(dev, PTR_ERR(wsa883x->vdd),
+			      "failed to set the load 20mA\n");
+
 	ret = regulator_enable(wsa883x->vdd);
 	if (ret)
 		return dev_err_probe(dev, ret, "Failed to enable vdd regulator\n");
@@ -1399,7 +1664,14 @@
 	wsa883x->sconfig.direction = SDW_DATA_DIR_RX;
 	wsa883x->sconfig.type = SDW_STREAM_PDM;
 
-	pdev->prop.sink_ports = GENMASK(WSA883X_MAX_SWR_PORTS, 0);
+	if (of_property_read_u32_array(dev->of_node, "qcom,port-mapping",
+			       &pdev->m_port_map[1],
+			       WSA883X_MAX_SWR_PORTS))
+		dev_err(dev, "Static Port mapping not specified\n");
+	else
+		dev_dbg(dev, "static port mapping read from DT for wsa883x.c\n");
+
+	pdev->prop.sink_ports = GENMASK(WSA883X_MAX_SWR_PORTS - 1, 0);
 	pdev->prop.simple_clk_stop_capable = true;
 	pdev->prop.sink_dpn_prop = wsa_sink_dpn_prop;
 	pdev->prop.scp_int1_mask = SDW_SCP_INT1_BUS_CLASH | SDW_SCP_INT1_PARITY;
--- linux-qcom-6.8.0.orig/sound/soc/codecs/wsa884x.c
+++ linux-qcom-6.8.0/sound/soc/codecs/wsa884x.c
@@ -1853,7 +1853,15 @@
 	wsa884x->sconfig.direction = SDW_DATA_DIR_RX;
 	wsa884x->sconfig.type = SDW_STREAM_PDM;
 
-	pdev->prop.sink_ports = GENMASK(WSA884X_MAX_SWR_PORTS, 0);
+	/**
+	 * Port map index starts with 0, however the data port for this codec
+	 * are from index 1
+	 */
+	if (of_property_read_u32_array(dev->of_node, "qcom,port-mapping", &pdev->m_port_map[1],
+					WSA884X_MAX_SWR_PORTS))
+		dev_dbg(dev, "Static Port mapping not specified\n");
+
+	pdev->prop.sink_ports = GENMASK(WSA884X_MAX_SWR_PORTS - 1, 0);
 	pdev->prop.simple_clk_stop_capable = true;
 	pdev->prop.sink_dpn_prop = wsa884x_sink_dpn_prop;
 	pdev->prop.scp_int1_mask = SDW_SCP_INT1_BUS_CLASH | SDW_SCP_INT1_PARITY;
--- linux-qcom-6.8.0.orig/sound/soc/fsl/fsl-asoc-card.c
+++ linux-qcom-6.8.0/sound/soc/fsl/fsl-asoc-card.c
@@ -558,6 +558,8 @@
 	if (!priv)
 		return -ENOMEM;
 
+	priv->pdev = pdev;
+
 	cpu_np = of_parse_phandle(np, "audio-cpu", 0);
 	/* Give a chance to old DT binding */
 	if (!cpu_np)
@@ -780,7 +782,6 @@
 	}
 
 	/* Initialize sound card */
-	priv->pdev = pdev;
 	priv->card.dev = &pdev->dev;
 	priv->card.owner = THIS_MODULE;
 	ret = snd_soc_of_parse_card_name(&priv->card, "model");
@@ -886,14 +887,15 @@
 	}
 
 	/*
-	 * Properties "hp-det-gpio" and "mic-det-gpio" are optional, and
+	 * Properties "hp-det-gpios" and "mic-det-gpios" are optional, and
 	 * simple_util_init_jack() uses these properties for creating
 	 * Headphone Jack and Microphone Jack.
 	 *
 	 * The notifier is initialized in snd_soc_card_jack_new(), then
 	 * snd_soc_jack_notifier_register can be called.
 	 */
-	if (of_property_read_bool(np, "hp-det-gpio")) {
+	if (of_property_read_bool(np, "hp-det-gpios") ||
+	    of_property_read_bool(np, "hp-det-gpio") /* deprecated */) {
 		ret = simple_util_init_jack(&priv->card, &priv->hp_jack,
 					    1, NULL, "Headphone Jack");
 		if (ret)
@@ -902,7 +904,8 @@
 		snd_soc_jack_notifier_register(&priv->hp_jack.jack, &hp_jack_nb);
 	}
 
-	if (of_property_read_bool(np, "mic-det-gpio")) {
+	if (of_property_read_bool(np, "mic-det-gpios") ||
+	    of_property_read_bool(np, "mic-det-gpio") /* deprecated */) {
 		ret = simple_util_init_jack(&priv->card, &priv->mic_jack,
 					    0, NULL, "Mic Jack");
 		if (ret)
--- linux-qcom-6.8.0.orig/sound/soc/fsl/fsl_micfil.c
+++ linux-qcom-6.8.0/sound/soc/fsl/fsl_micfil.c
@@ -28,6 +28,13 @@
 
 #define MICFIL_OSR_DEFAULT	16
 
+#define MICFIL_NUM_RATES	7
+#define MICFIL_CLK_SRC_NUM	3
+/* clock source ids */
+#define MICFIL_AUDIO_PLL1	0
+#define MICFIL_AUDIO_PLL2	1
+#define MICFIL_CLK_EXT3		2
+
 enum quality {
 	QUALITY_HIGH,
 	QUALITY_MEDIUM,
@@ -45,9 +52,12 @@
 	struct clk *mclk;
 	struct clk *pll8k_clk;
 	struct clk *pll11k_clk;
+	struct clk *clk_src[MICFIL_CLK_SRC_NUM];
 	struct snd_dmaengine_dai_dma_data dma_params_rx;
 	struct sdma_peripheral_config sdmacfg;
 	struct snd_soc_card *card;
+	struct snd_pcm_hw_constraint_list constraint_rates;
+	unsigned int constraint_rates_list[MICFIL_NUM_RATES];
 	unsigned int dataline;
 	char name[32];
 	int irq[MICFIL_IRQ_LINES];
@@ -67,6 +77,7 @@
 	bool imx;
 	bool use_edma;
 	bool use_verid;
+	bool volume_sx;
 	u64  formats;
 };
 
@@ -76,6 +87,7 @@
 	.fifo_depth = 8,
 	.dataline =  0xf,
 	.formats = SNDRV_PCM_FMTBIT_S16_LE,
+	.volume_sx = true,
 };
 
 static struct fsl_micfil_soc_data fsl_micfil_imx8mp = {
@@ -84,6 +96,7 @@
 	.fifo_depth = 32,
 	.dataline =  0xf,
 	.formats = SNDRV_PCM_FMTBIT_S32_LE,
+	.volume_sx = false,
 };
 
 static struct fsl_micfil_soc_data fsl_micfil_imx93 = {
@@ -94,6 +107,7 @@
 	.formats = SNDRV_PCM_FMTBIT_S32_LE,
 	.use_edma = true,
 	.use_verid = true,
+	.volume_sx = false,
 };
 
 static const struct of_device_id fsl_micfil_dt_ids[] = {
@@ -317,7 +331,26 @@
 	return 0;
 }
 
-static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = {
+static const struct snd_kcontrol_new fsl_micfil_volume_controls[] = {
+	SOC_SINGLE_TLV("CH0 Volume", REG_MICFIL_OUT_CTRL,
+		       MICFIL_OUTGAIN_CHX_SHIFT(0), 0xF, 0, gain_tlv),
+	SOC_SINGLE_TLV("CH1 Volume", REG_MICFIL_OUT_CTRL,
+		       MICFIL_OUTGAIN_CHX_SHIFT(1), 0xF, 0, gain_tlv),
+	SOC_SINGLE_TLV("CH2 Volume", REG_MICFIL_OUT_CTRL,
+		       MICFIL_OUTGAIN_CHX_SHIFT(2), 0xF, 0, gain_tlv),
+	SOC_SINGLE_TLV("CH3 Volume", REG_MICFIL_OUT_CTRL,
+		       MICFIL_OUTGAIN_CHX_SHIFT(3), 0xF, 0, gain_tlv),
+	SOC_SINGLE_TLV("CH4 Volume", REG_MICFIL_OUT_CTRL,
+		       MICFIL_OUTGAIN_CHX_SHIFT(4), 0xF, 0, gain_tlv),
+	SOC_SINGLE_TLV("CH5 Volume", REG_MICFIL_OUT_CTRL,
+		       MICFIL_OUTGAIN_CHX_SHIFT(5), 0xF, 0, gain_tlv),
+	SOC_SINGLE_TLV("CH6 Volume", REG_MICFIL_OUT_CTRL,
+		       MICFIL_OUTGAIN_CHX_SHIFT(6), 0xF, 0, gain_tlv),
+	SOC_SINGLE_TLV("CH7 Volume", REG_MICFIL_OUT_CTRL,
+		       MICFIL_OUTGAIN_CHX_SHIFT(7), 0xF, 0, gain_tlv),
+};
+
+static const struct snd_kcontrol_new fsl_micfil_volume_sx_controls[] = {
 	SOC_SINGLE_SX_TLV("CH0 Volume", REG_MICFIL_OUT_CTRL,
 			  MICFIL_OUTGAIN_CHX_SHIFT(0), 0x8, 0xF, gain_tlv),
 	SOC_SINGLE_SX_TLV("CH1 Volume", REG_MICFIL_OUT_CTRL,
@@ -334,6 +367,9 @@
 			  MICFIL_OUTGAIN_CHX_SHIFT(6), 0x8, 0xF, gain_tlv),
 	SOC_SINGLE_SX_TLV("CH7 Volume", REG_MICFIL_OUT_CTRL,
 			  MICFIL_OUTGAIN_CHX_SHIFT(7), 0x8, 0xF, gain_tlv),
+};
+
+static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = {
 	SOC_ENUM_EXT("MICFIL Quality Select",
 		     fsl_micfil_quality_enum,
 		     micfil_quality_get, micfil_quality_set),
@@ -449,12 +485,34 @@
 			      struct snd_soc_dai *dai)
 {
 	struct fsl_micfil *micfil = snd_soc_dai_get_drvdata(dai);
+	unsigned int rates[MICFIL_NUM_RATES] = {8000, 11025, 16000, 22050, 32000, 44100, 48000};
+	int i, j, k = 0;
+	u64 clk_rate;
 
 	if (!micfil) {
 		dev_err(dai->dev, "micfil dai priv_data not set\n");
 		return -EINVAL;
 	}
 
+	micfil->constraint_rates.list = micfil->constraint_rates_list;
+	micfil->constraint_rates.count = 0;
+
+	for (j = 0; j < MICFIL_NUM_RATES; j++) {
+		for (i = 0; i < MICFIL_CLK_SRC_NUM; i++) {
+			clk_rate = clk_get_rate(micfil->clk_src[i]);
+			if (clk_rate != 0 && do_div(clk_rate, rates[j]) == 0) {
+				micfil->constraint_rates_list[k++] = rates[j];
+				micfil->constraint_rates.count++;
+				break;
+			}
+		}
+	}
+
+	if (micfil->constraint_rates.count > 0)
+		snd_pcm_hw_constraint_list(substream->runtime, 0,
+					   SNDRV_PCM_HW_PARAM_RATE,
+					   &micfil->constraint_rates);
+
 	return 0;
 }
 
@@ -801,6 +859,20 @@
 	return 0;
 }
 
+static int fsl_micfil_component_probe(struct snd_soc_component *component)
+{
+	struct fsl_micfil *micfil = snd_soc_component_get_drvdata(component);
+
+	if (micfil->soc->volume_sx)
+		snd_soc_add_component_controls(component, fsl_micfil_volume_sx_controls,
+					       ARRAY_SIZE(fsl_micfil_volume_sx_controls));
+	else
+		snd_soc_add_component_controls(component, fsl_micfil_volume_controls,
+					       ARRAY_SIZE(fsl_micfil_volume_controls));
+
+	return 0;
+}
+
 static const struct snd_soc_dai_ops fsl_micfil_dai_ops = {
 	.probe		= fsl_micfil_dai_probe,
 	.startup	= fsl_micfil_startup,
@@ -821,6 +893,7 @@
 
 static const struct snd_soc_component_driver fsl_micfil_component = {
 	.name		= "fsl-micfil-dai",
+	.probe		= fsl_micfil_component_probe,
 	.controls       = fsl_micfil_snd_controls,
 	.num_controls   = ARRAY_SIZE(fsl_micfil_snd_controls),
 	.legacy_dai_naming      = 1,
@@ -978,7 +1051,7 @@
 			regmap_write_bits(micfil->regmap,
 					  REG_MICFIL_STAT,
 					  MICFIL_STAT_CHXF(i),
-					  1);
+					  MICFIL_STAT_CHXF(i));
 	}
 
 	for (i = 0; i < MICFIL_FIFO_NUM; i++) {
@@ -1013,7 +1086,7 @@
 	if (stat_reg & MICFIL_STAT_LOWFREQF) {
 		dev_dbg(&pdev->dev, "isr: ipg_clk_app is too low\n");
 		regmap_write_bits(micfil->regmap, REG_MICFIL_STAT,
-				  MICFIL_STAT_LOWFREQF, 1);
+				  MICFIL_STAT_LOWFREQF, MICFIL_STAT_LOWFREQF);
 	}
 
 	return IRQ_HANDLED;
@@ -1124,6 +1197,12 @@
 	fsl_asoc_get_pll_clocks(&pdev->dev, &micfil->pll8k_clk,
 				&micfil->pll11k_clk);
 
+	micfil->clk_src[MICFIL_AUDIO_PLL1] = micfil->pll8k_clk;
+	micfil->clk_src[MICFIL_AUDIO_PLL2] = micfil->pll11k_clk;
+	micfil->clk_src[MICFIL_CLK_EXT3] = devm_clk_get(&pdev->dev, "clkext3");
+	if (IS_ERR(micfil->clk_src[MICFIL_CLK_EXT3]))
+		micfil->clk_src[MICFIL_CLK_EXT3] = NULL;
+
 	/* init regmap */
 	regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
 	if (IS_ERR(regs))
--- linux-qcom-6.8.0.orig/sound/soc/fsl/fsl_qmc_audio.c
+++ linux-qcom-6.8.0/sound/soc/fsl/fsl_qmc_audio.c
@@ -604,6 +604,8 @@
 
 	qmc_dai->name = devm_kasprintf(qmc_audio->dev, GFP_KERNEL, "%s.%d",
 				       np->parent->name, qmc_dai->id);
+	if (!qmc_dai->name)
+		return -ENOMEM;
 
 	qmc_dai->qmc_chan = devm_qmc_chan_get_byphandle(qmc_audio->dev, np,
 							"fsl,qmc-chan");
--- linux-qcom-6.8.0.orig/sound/soc/fsl/fsl_sai.c
+++ linux-qcom-6.8.0/sound/soc/fsl/fsl_sai.c
@@ -603,6 +603,9 @@
 
 	val_cr4 |= FSL_SAI_CR4_FRSZ(slots);
 
+	/* Set to avoid channel swap */
+	val_cr4 |= FSL_SAI_CR4_FCONT;
+
 	/* Set to output mode to avoid tri-stated data pins */
 	if (tx)
 		val_cr4 |= FSL_SAI_CR4_CHMOD;
@@ -689,7 +692,7 @@
 
 	regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs),
 			   FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK |
-			   FSL_SAI_CR4_CHMOD_MASK,
+			   FSL_SAI_CR4_CHMOD_MASK | FSL_SAI_CR4_FCONT_MASK,
 			   val_cr4);
 	regmap_update_bits(sai->regmap, FSL_SAI_xCR5(tx, ofs),
 			   FSL_SAI_CR5_WNW_MASK | FSL_SAI_CR5_W0W_MASK |
--- linux-qcom-6.8.0.orig/sound/soc/fsl/fsl_sai.h
+++ linux-qcom-6.8.0/sound/soc/fsl/fsl_sai.h
@@ -137,6 +137,7 @@
 
 /* SAI Transmit and Receive Configuration 4 Register */
 
+#define FSL_SAI_CR4_FCONT_MASK	BIT(28)
 #define FSL_SAI_CR4_FCONT	BIT(28)
 #define FSL_SAI_CR4_FCOMB_SHIFT BIT(26)
 #define FSL_SAI_CR4_FCOMB_SOFT  BIT(27)
--- linux-qcom-6.8.0.orig/sound/soc/fsl/imx-card.c
+++ linux-qcom-6.8.0/sound/soc/fsl/imx-card.c
@@ -713,6 +713,7 @@
 
 	data->plat_data = plat_data;
 	data->card.dev = &pdev->dev;
+	data->card.owner = THIS_MODULE;
 
 	dev_set_drvdata(&pdev->dev, &data->card);
 	snd_soc_card_set_drvdata(&data->card, data);
--- linux-qcom-6.8.0.orig/sound/soc/generic/audio-graph-card2.c
+++ linux-qcom-6.8.0/sound/soc/generic/audio-graph-card2.c
@@ -258,16 +258,19 @@
 
 	if (of_node_name_eq(np, GRAPH_NODENAME_MULTI)) {
 		ret = GRAPH_MULTI;
+		fw_devlink_purge_absent_suppliers(&np->fwnode);
 		goto out_put;
 	}
 
 	if (of_node_name_eq(np, GRAPH_NODENAME_DPCM)) {
 		ret = GRAPH_DPCM;
+		fw_devlink_purge_absent_suppliers(&np->fwnode);
 		goto out_put;
 	}
 
 	if (of_node_name_eq(np, GRAPH_NODENAME_C2C)) {
 		ret = GRAPH_C2C;
+		fw_devlink_purge_absent_suppliers(&np->fwnode);
 		goto out_put;
 	}
 
--- linux-qcom-6.8.0.orig/sound/soc/google/chv3-i2s.c
+++ linux-qcom-6.8.0/sound/soc/google/chv3-i2s.c
@@ -322,6 +322,7 @@
 	{ .compatible = "google,chv3-i2s" },
 	{},
 };
+MODULE_DEVICE_TABLE(of, chv3_i2s_of_match);
 
 static struct platform_driver chv3_i2s_driver = {
 	.probe = chv3_i2s_probe,
--- linux-qcom-6.8.0.orig/sound/soc/intel/atom/sst/sst_acpi.c
+++ linux-qcom-6.8.0/sound/soc/intel/atom/sst/sst_acpi.c
@@ -125,6 +125,28 @@
 	.acpi_ipc_irq_index = 0
 };
 
+/* For "LPE0F28" ACPI device found on some Android factory OS models */
+static const struct sst_res_info lpe8086_res_info = {
+	.shim_offset = 0x140000,
+	.shim_size = 0x000100,
+	.shim_phy_addr = SST_BYT_SHIM_PHY_ADDR,
+	.ssp0_offset = 0xa0000,
+	.ssp0_size = 0x1000,
+	.dma0_offset = 0x98000,
+	.dma0_size = 0x4000,
+	.dma1_offset = 0x9c000,
+	.dma1_size = 0x4000,
+	.iram_offset = 0x0c0000,
+	.iram_size = 0x14000,
+	.dram_offset = 0x100000,
+	.dram_size = 0x28000,
+	.mbox_offset = 0x144000,
+	.mbox_size = 0x1000,
+	.acpi_lpe_res_index = 1,
+	.acpi_ddr_index = 0,
+	.acpi_ipc_irq_index = 0
+};
+
 static struct sst_platform_info byt_rvp_platform_data = {
 	.probe_data = &byt_fwparse_info,
 	.ipc_info = &byt_ipc_info,
@@ -268,10 +290,38 @@
 		mach->pdata = &chv_platform_data;
 	pdata = mach->pdata;
 
-	ret = kstrtouint(id->id, 16, &dev_id);
-	if (ret < 0) {
-		dev_err(dev, "Unique device id conversion error: %d\n", ret);
-		return ret;
+	if (!strcmp(id->id, "LPE0F28")) {
+		struct resource *rsrc;
+
+		/* Use regular BYT SST PCI VID:PID */
+		dev_id = 0x80860F28;
+		byt_rvp_platform_data.res_info = &lpe8086_res_info;
+
+		/*
+		 * The "LPE0F28" ACPI device has separate IO-mem resources for:
+		 * DDR, SHIM, MBOX, IRAM, DRAM, CFG
+		 * None of which covers the entire LPE base address range.
+		 * lpe8086_res_info.acpi_lpe_res_index points to the SHIM.
+		 * Patch this to cover the entire base address range as expected
+		 * by sst_platform_get_resources().
+		 */
+		rsrc = platform_get_resource(pdev, IORESOURCE_MEM,
+					     pdata->res_info->acpi_lpe_res_index);
+		if (!rsrc) {
+			dev_err(dev, "Invalid SHIM base\n");
+			return -EIO;
+		}
+		rsrc->start -= pdata->res_info->shim_offset;
+		rsrc->end = rsrc->start + 0x200000 - 1;
+	} else {
+		ret = kstrtouint(id->id, 16, &dev_id);
+		if (ret < 0) {
+			dev_err(dev, "Unique device id conversion error: %d\n", ret);
+			return ret;
+		}
+
+		if (soc_intel_is_byt_cr(pdev))
+			byt_rvp_platform_data.res_info = &bytcr_res_info;
 	}
 
 	dev_dbg(dev, "ACPI device id: %x\n", dev_id);
@@ -280,11 +330,6 @@
 	if (ret < 0)
 		return ret;
 
-	if (soc_intel_is_byt_cr(pdev)) {
-		/* override resource info */
-		byt_rvp_platform_data.res_info = &bytcr_res_info;
-	}
-
 	/* update machine parameters */
 	mach->mach_params.acpi_ipc_irq_index =
 		pdata->res_info->acpi_ipc_irq_index;
@@ -344,6 +389,7 @@
 }
 
 static const struct acpi_device_id sst_acpi_ids[] = {
+	{ "LPE0F28", (unsigned long)&snd_soc_acpi_intel_baytrail_machines},
 	{ "80860F28", (unsigned long)&snd_soc_acpi_intel_baytrail_machines},
 	{ "808622A8", (unsigned long)&snd_soc_acpi_intel_cherrytrail_machines},
 	{ },
--- linux-qcom-6.8.0.orig/sound/soc/intel/avs/board_selection.c
+++ linux-qcom-6.8.0/sound/soc/intel/avs/board_selection.c
@@ -236,6 +236,82 @@
 	{},
 };
 
+static struct snd_soc_acpi_mach avs_cnl_i2s_machines[] = {
+	{
+		.id = "INT34C2",
+		.drv_name = "avs_rt274",
+		.mach_params = {
+			.i2s_link_mask = AVS_SSP(0),
+		},
+		.tplg_filename = "rt274-tplg.bin",
+	},
+	{
+		.id = "10EC5682",
+		.drv_name = "avs_rt5682",
+		.mach_params = {
+			.i2s_link_mask = AVS_SSP(1),
+		},
+		.tplg_filename = "rt5682-tplg.bin",
+	},
+	{},
+};
+
+static struct snd_soc_acpi_mach avs_icl_i2s_machines[] = {
+	{
+		.id = "INT343A",
+		.drv_name = "avs_rt298",
+		.mach_params = {
+			.i2s_link_mask = AVS_SSP(0),
+		},
+		.tplg_filename = "rt298-tplg.bin",
+	},
+	{
+		.id = "INT34C2",
+		.drv_name = "avs_rt274",
+		.mach_params = {
+			.i2s_link_mask = AVS_SSP(0),
+		},
+		.tplg_filename = "rt274-tplg.bin",
+	},
+	{},
+};
+
+static struct snd_soc_acpi_mach avs_tgl_i2s_machines[] = {
+	{
+		.id = "INT34C2",
+		.drv_name = "avs_rt274",
+		.mach_params = {
+			.i2s_link_mask = AVS_SSP(0),
+		},
+		.tplg_filename = "rt274-tplg.bin",
+	},
+	{
+		.id = "10EC0298",
+		.drv_name = "avs_rt298",
+		.mach_params = {
+			.i2s_link_mask = AVS_SSP(0),
+		},
+		.tplg_filename = "rt298-tplg.bin",
+	},
+	{
+		.id = "10EC1308",
+		.drv_name = "avs_rt1308",
+		.mach_params = {
+			.i2s_link_mask = AVS_SSP(1),
+		},
+		.tplg_filename = "rt1308-tplg.bin",
+	},
+	{
+		.id = "ESSX8336",
+		.drv_name = "avs_es8336",
+		.mach_params = {
+			.i2s_link_mask = AVS_SSP(0),
+		},
+		.tplg_filename = "es8336-tplg.bin",
+	},
+	{},
+};
+
 static struct snd_soc_acpi_mach avs_test_i2s_machines[] = {
 	{
 		.drv_name = "avs_i2s_test",
@@ -296,6 +372,15 @@
 	AVS_MACH_ENTRY(HDA_KBL_LP, avs_kbl_i2s_machines),
 	AVS_MACH_ENTRY(HDA_APL, avs_apl_i2s_machines),
 	AVS_MACH_ENTRY(HDA_GML, avs_gml_i2s_machines),
+	AVS_MACH_ENTRY(HDA_CNL_LP,	avs_cnl_i2s_machines),
+	AVS_MACH_ENTRY(HDA_CNL_H,	avs_cnl_i2s_machines),
+	AVS_MACH_ENTRY(HDA_CML_LP,	avs_cnl_i2s_machines),
+	AVS_MACH_ENTRY(HDA_ICL_LP,	avs_icl_i2s_machines),
+	AVS_MACH_ENTRY(HDA_TGL_LP,	avs_tgl_i2s_machines),
+	AVS_MACH_ENTRY(HDA_EHL_0,	avs_tgl_i2s_machines),
+	AVS_MACH_ENTRY(HDA_ADL_P,	avs_tgl_i2s_machines),
+	AVS_MACH_ENTRY(HDA_RPL_P_0,	avs_tgl_i2s_machines),
+	AVS_MACH_ENTRY(HDA_RPL_M,	avs_tgl_i2s_machines),
 	{},
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/avs/boards/ssm4567.c
+++ linux-qcom-6.8.0/sound/soc/intel/avs/boards/ssm4567.c
@@ -172,7 +172,6 @@
 	card->dapm_routes = card_base_routes;
 	card->num_dapm_routes = ARRAY_SIZE(card_base_routes);
 	card->fully_routed = true;
-	card->disable_route_checks = true;
 
 	ret = snd_soc_fixup_dai_links_platform_name(card, pname);
 	if (ret)
--- linux-qcom-6.8.0.orig/sound/soc/intel/avs/cldma.c
+++ linux-qcom-6.8.0/sound/soc/intel/avs/cldma.c
@@ -35,7 +35,7 @@
 
 	unsigned int buffer_size;
 	unsigned int num_periods;
-	unsigned int stream_tag;
+	unsigned char stream_tag;
 	void __iomem *sd_addr;
 
 	struct snd_dma_buffer dmab_data;
--- linux-qcom-6.8.0.orig/sound/soc/intel/avs/core.c
+++ linux-qcom-6.8.0/sound/soc/intel/avs/core.c
@@ -27,6 +27,7 @@
 #include "avs.h"
 #include "cldma.h"
 #include "messages.h"
+#include "pcm.h"
 
 static u32 pgctl_mask = AZX_PGCTL_LSRMD_MASK;
 module_param(pgctl_mask, uint, 0444);
@@ -242,7 +243,7 @@
 static void hdac_update_stream(struct hdac_bus *bus, struct hdac_stream *stream)
 {
 	if (stream->substream) {
-		snd_pcm_period_elapsed(stream->substream);
+		avs_period_elapsed(stream->substream);
 	} else if (stream->cstream) {
 		u64 buffer_size = stream->cstream->runtime->buffer_size;
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/avs/path.c
+++ linux-qcom-6.8.0/sound/soc/intel/avs/path.c
@@ -367,6 +367,7 @@
 	struct avs_tplg_module *t = mod->template;
 	struct avs_asrc_cfg cfg;
 
+	memset(&cfg, 0, sizeof(cfg));
 	cfg.base.cpc = t->cfg_base->cpc;
 	cfg.base.ibs = t->cfg_base->ibs;
 	cfg.base.obs = t->cfg_base->obs;
--- linux-qcom-6.8.0.orig/sound/soc/intel/avs/pcm.c
+++ linux-qcom-6.8.0/sound/soc/intel/avs/pcm.c
@@ -16,6 +16,7 @@
 #include <sound/soc-component.h>
 #include "avs.h"
 #include "path.h"
+#include "pcm.h"
 #include "topology.h"
 #include "../../codecs/hda.h"
 
@@ -30,6 +31,7 @@
 	 */
 	struct hdac_ext_stream *host_stream;
 
+	struct work_struct period_elapsed_work;
 	struct snd_pcm_substream *substream;
 };
 
@@ -56,6 +58,22 @@
 	return dw->priv;
 }
 
+static void avs_period_elapsed_work(struct work_struct *work)
+{
+	struct avs_dma_data *data = container_of(work, struct avs_dma_data, period_elapsed_work);
+
+	snd_pcm_period_elapsed(data->substream);
+}
+
+void avs_period_elapsed(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
+	struct snd_soc_dai *dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct avs_dma_data *data = snd_soc_dai_get_dma_data(dai, substream);
+
+	schedule_work(&data->period_elapsed_work);
+}
+
 static int avs_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_dai *dai, bool is_fe,
 			   const struct snd_soc_dai_ops *ops)
 {
@@ -77,6 +95,7 @@
 
 	data->substream = substream;
 	data->template = template;
+	INIT_WORK(&data->period_elapsed_work, avs_period_elapsed_work);
 	snd_soc_dai_set_dma_data(dai, substream, data);
 
 	if (rtd->dai_link->ignore_suspend)
@@ -356,6 +375,7 @@
 					   stream_info->sig_bits);
 	format_val = snd_hdac_stream_format(runtime->channels, bits, runtime->rate);
 
+	snd_hdac_ext_stream_decouple(bus, link_stream, true);
 	snd_hdac_ext_stream_reset(link_stream);
 	snd_hdac_ext_stream_setup(link_stream, format_val);
 
@@ -611,6 +631,7 @@
 	struct avs_dev *adev = to_avs_dev(dai->dev);
 	struct hdac_ext_stream *host_stream;
 	unsigned int format_val;
+	struct hdac_bus *bus;
 	unsigned int bits;
 	int ret;
 
@@ -620,6 +641,8 @@
 	if (hdac_stream(host_stream)->prepared)
 		return 0;
 
+	bus = hdac_stream(host_stream)->bus;
+	snd_hdac_ext_stream_decouple(bus, data->host_stream, true);
 	snd_hdac_stream_reset(hdac_stream(host_stream));
 
 	stream_info = snd_soc_dai_get_pcm_stream(dai, substream->stream);
--- linux-qcom-6.8.0.orig/sound/soc/intel/avs/pcm.h
+++ linux-qcom-6.8.0/sound/soc/intel/avs/pcm.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright(c) 2024 Intel Corporation
+ *
+ * Authors: Cezary Rojewski <cezary.rojewski@intel.com>
+ *          Amadeusz Slawinski <amadeuszx.slawinski@linux.intel.com>
+ */
+
+#ifndef __SOUND_SOC_INTEL_AVS_PCM_H
+#define __SOUND_SOC_INTEL_AVS_PCM_H
+
+#include <sound/pcm.h>
+
+void avs_period_elapsed(struct snd_pcm_substream *substream);
+
+#endif
--- linux-qcom-6.8.0.orig/sound/soc/intel/avs/probes.c
+++ linux-qcom-6.8.0/sound/soc/intel/avs/probes.c
@@ -19,8 +19,11 @@
 	struct avs_probe_cfg cfg = {{0}};
 	struct avs_module_entry mentry;
 	u8 dummy;
+	int ret;
 
-	avs_get_module_entry(adev, &AVS_PROBE_MOD_UUID, &mentry);
+	ret = avs_get_module_entry(adev, &AVS_PROBE_MOD_UUID, &mentry);
+	if (ret)
+		return ret;
 
 	/*
 	 * Probe module uses no cycles, audio data format and input and output
@@ -39,11 +42,12 @@
 static void avs_dsp_delete_probe(struct avs_dev *adev)
 {
 	struct avs_module_entry mentry;
+	int ret;
 
-	avs_get_module_entry(adev, &AVS_PROBE_MOD_UUID, &mentry);
-
-	/* There is only ever one probe module instance. */
-	avs_dsp_delete_module(adev, mentry.module_id, 0, INVALID_PIPELINE_ID, 0);
+	ret = avs_get_module_entry(adev, &AVS_PROBE_MOD_UUID, &mentry);
+	if (!ret)
+		/* There is only ever one probe module instance. */
+		avs_dsp_delete_module(adev, mentry.module_id, 0, INVALID_PIPELINE_ID, 0);
 }
 
 static inline struct hdac_ext_stream *avs_compr_get_host_stream(struct snd_compr_stream *cstream)
--- linux-qcom-6.8.0.orig/sound/soc/intel/avs/topology.c
+++ linux-qcom-6.8.0/sound/soc/intel/avs/topology.c
@@ -1421,8 +1421,8 @@
 {
 	struct snd_soc_acpi_mach *mach = dev_get_platdata(comp->card->dev);
 	size_t len = SNDRV_CTL_ELEM_ID_NAME_MAXLEN;
-	char buf[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
 	int ssp_port, tdm_slot;
+	char *buf;
 
 	/* See parse_link_formatted_string() for dynamic naming when(s). */
 	if (!avs_mach_singular_ssp(mach))
@@ -1433,13 +1433,24 @@
 		return 0;
 	tdm_slot = avs_mach_ssp_tdm(mach, ssp_port);
 
+	buf = devm_kzalloc(comp->card->dev, len, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
 	avs_ssp_sprint(buf, len, route->source, ssp_port, tdm_slot);
-	strscpy((char *)route->source, buf, len);
+	route->source = buf;
+
+	buf = devm_kzalloc(comp->card->dev, len, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
 	avs_ssp_sprint(buf, len, route->sink, ssp_port, tdm_slot);
-	strscpy((char *)route->sink, buf, len);
+	route->sink = buf;
+
 	if (route->control) {
+		buf = devm_kzalloc(comp->card->dev, len, GFP_KERNEL);
+		if (!buf)
+			return -ENOMEM;
 		avs_ssp_sprint(buf, len, route->control, ssp_port, tdm_slot);
-		strscpy((char *)route->control, buf, len);
+		route->control = buf;
 	}
 
 	return 0;
@@ -1458,6 +1469,8 @@
 	if (!le32_to_cpu(dw->priv.size))
 		return 0;
 
+	w->no_wname_in_kcontrol_name = true;
+
 	if (w->ignore_suspend && !AVS_S0IX_SUPPORTED) {
 		dev_info_once(comp->dev, "Device does not support S0IX, check BIOS settings\n");
 		w->ignore_suspend = false;
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/bxt_da7219_max98357a.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/bxt_da7219_max98357a.c
@@ -768,6 +768,7 @@
 	.dapm_routes = audio_map,
 	.num_dapm_routes = ARRAY_SIZE(audio_map),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = bxt_card_late_probe,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/bxt_rt298.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/bxt_rt298.c
@@ -574,6 +574,7 @@
 	.dapm_routes = broxton_rt298_map,
 	.num_dapm_routes = ARRAY_SIZE(broxton_rt298_map),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = bxt_card_late_probe,
 
 };
@@ -604,7 +605,7 @@
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(broxton_rt298_dais); i++) {
-		if (card->dai_link[i].codecs->name &&
+		if (card->dai_link[i].num_codecs &&
 		    !strncmp(card->dai_link[i].codecs->name, "i2c-INT343A:00",
 			     I2C_NAME_SIZE)) {
 			if (!strncmp(card->name, "broxton-rt298",
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/bytcht_cx2072x.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/bytcht_cx2072x.c
@@ -241,7 +241,7 @@
 
 	/* fix index of codec dai */
 	for (i = 0; i < ARRAY_SIZE(byt_cht_cx2072x_dais); i++) {
-		if (byt_cht_cx2072x_dais[i].codecs->name &&
+		if (byt_cht_cx2072x_dais[i].num_codecs &&
 		    !strcmp(byt_cht_cx2072x_dais[i].codecs->name,
 			    "i2c-14F10720:00")) {
 			dai_index = i;
@@ -255,7 +255,11 @@
 		snprintf(codec_name, sizeof(codec_name), "i2c-%s",
 			 acpi_dev_name(adev));
 		byt_cht_cx2072x_dais[dai_index].codecs->name = codec_name;
+	} else {
+		dev_err(&pdev->dev, "Error cannot find '%s' dev\n", mach->id);
+		return -ENOENT;
 	}
+
 	acpi_dev_put(adev);
 
 	/* override platform name, if required */
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/bytcht_da7213.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/bytcht_da7213.c
@@ -245,7 +245,7 @@
 
 	/* fix index of codec dai */
 	for (i = 0; i < ARRAY_SIZE(dailink); i++) {
-		if (dailink[i].codecs->name &&
+		if (dailink[i].num_codecs &&
 		    !strcmp(dailink[i].codecs->name, "i2c-DLGS7213:00")) {
 			dai_index = i;
 			break;
@@ -258,7 +258,11 @@
 		snprintf(codec_name, sizeof(codec_name),
 			 "i2c-%s", acpi_dev_name(adev));
 		dailink[dai_index].codecs->name = codec_name;
+	} else {
+		dev_err(&pdev->dev, "Error cannot find '%s' dev\n", mach->id);
+		return -ENOENT;
 	}
+
 	acpi_dev_put(adev);
 
 	/* override platform name, if required */
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/bytcht_es8316.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/bytcht_es8316.c
@@ -546,7 +546,7 @@
 
 	/* fix index of codec dai */
 	for (i = 0; i < ARRAY_SIZE(byt_cht_es8316_dais); i++) {
-		if (byt_cht_es8316_dais[i].codecs->name &&
+		if (byt_cht_es8316_dais[i].num_codecs &&
 		    !strcmp(byt_cht_es8316_dais[i].codecs->name,
 			    "i2c-ESSX8316:00")) {
 			dai_index = i;
@@ -562,7 +562,7 @@
 		byt_cht_es8316_dais[dai_index].codecs->name = codec_name;
 	} else {
 		dev_err(dev, "Error cannot find '%s' dev\n", mach->id);
-		return -ENXIO;
+		return -ENOENT;
 	}
 
 	codec_dev = acpi_get_first_physical_node(adev);
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/bytcr_rt5640.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/bytcr_rt5640.c
@@ -17,6 +17,7 @@
 #include <linux/acpi.h>
 #include <linux/clk.h>
 #include <linux/device.h>
+#include <linux/device/bus.h>
 #include <linux/dmi.h>
 #include <linux/gpio/consumer.h>
 #include <linux/gpio/machine.h>
@@ -32,6 +33,8 @@
 #include "../atom/sst-atom-controls.h"
 #include "../common/soc-intel-quirks.h"
 
+#define BYT_RT5640_FALLBACK_CODEC_DEV_NAME	"i2c-rt5640"
+
 enum {
 	BYT_RT5640_DMIC1_MAP,
 	BYT_RT5640_DMIC2_MAP,
@@ -613,6 +616,17 @@
 	{
 		.matches = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ARCHOS 101 CESIUM"),
+		},
+		.driver_data = (void *)(BYTCR_INPUT_DEFAULTS |
+					BYT_RT5640_JD_NOT_INV |
+					BYT_RT5640_DIFF_MIC |
+					BYT_RT5640_SSP0_AIF1 |
+					BYT_RT5640_MCLK_EN),
+	},
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ARCHOS 140 CESIUM"),
 		},
 		.driver_data = (void *)(BYT_RT5640_IN1_MAP |
@@ -636,28 +650,30 @@
 					BYT_RT5640_USE_AMCR0F28),
 	},
 	{
+		/* Asus T100TAF, unlike other T100TA* models this one has a mono speaker */
 		.matches = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TAF"),
 		},
 		.driver_data = (void *)(BYT_RT5640_IN1_MAP |
 					BYT_RT5640_JD_SRC_JD2_IN4N |
 					BYT_RT5640_OVCD_TH_2000UA |
 					BYT_RT5640_OVCD_SF_0P75 |
+					BYT_RT5640_MONO_SPEAKER |
+					BYT_RT5640_DIFF_MIC |
+					BYT_RT5640_SSP0_AIF2 |
 					BYT_RT5640_MCLK_EN),
 	},
 	{
+		/* Asus T100TA and T100TAM, must come after T100TAF (mono spk) match */
 		.matches = {
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TAF"),
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "T100TA"),
 		},
 		.driver_data = (void *)(BYT_RT5640_IN1_MAP |
 					BYT_RT5640_JD_SRC_JD2_IN4N |
 					BYT_RT5640_OVCD_TH_2000UA |
 					BYT_RT5640_OVCD_SF_0P75 |
-					BYT_RT5640_MONO_SPEAKER |
-					BYT_RT5640_DIFF_MIC |
-					BYT_RT5640_SSP0_AIF2 |
 					BYT_RT5640_MCLK_EN),
 	},
 	{
@@ -1116,6 +1132,21 @@
 					BYT_RT5640_SSP0_AIF2 |
 					BYT_RT5640_MCLK_EN),
 	},
+	{	/* Vexia Edu Atla 10 tablet */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
+			DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
+			/* Above strings are too generic, also match on BIOS date */
+			DMI_MATCH(DMI_BIOS_DATE, "08/25/2014"),
+		},
+		.driver_data = (void *)(BYT_RT5640_IN1_MAP |
+					BYT_RT5640_JD_SRC_JD2_IN4N |
+					BYT_RT5640_OVCD_TH_2000UA |
+					BYT_RT5640_OVCD_SF_0P75 |
+					BYT_RT5640_DIFF_MIC |
+					BYT_RT5640_SSP0_AIF2 |
+					BYT_RT5640_MCLK_EN),
+	},
 	{	/* Voyo Winpad A15 */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
@@ -1664,7 +1695,7 @@
 
 	/* fix index of codec dai */
 	for (i = 0; i < ARRAY_SIZE(byt_rt5640_dais); i++) {
-		if (byt_rt5640_dais[i].codecs->name &&
+		if (byt_rt5640_dais[i].num_codecs &&
 		    !strcmp(byt_rt5640_dais[i].codecs->name,
 			    "i2c-10EC5640:00")) {
 			dai_index = i;
@@ -1680,14 +1711,38 @@
 		byt_rt5640_dais[dai_index].codecs->name = byt_rt5640_codec_name;
 	} else {
 		dev_err(dev, "Error cannot find '%s' dev\n", mach->id);
-		return -ENXIO;
+		return -ENOENT;
 	}
 
 	codec_dev = acpi_get_first_physical_node(adev);
 	acpi_dev_put(adev);
-	if (!codec_dev)
-		return -EPROBE_DEFER;
-	priv->codec_dev = get_device(codec_dev);
+
+	if (codec_dev) {
+		priv->codec_dev = get_device(codec_dev);
+	} else {
+		/*
+		 * Special case for Android tablets where the codec i2c_client
+		 * has been manually instantiated by x86_android_tablets.ko due
+		 * to a broken DSDT.
+		 */
+		codec_dev = bus_find_device_by_name(&i2c_bus_type, NULL,
+					BYT_RT5640_FALLBACK_CODEC_DEV_NAME);
+		if (!codec_dev)
+			return -EPROBE_DEFER;
+
+		if (!i2c_verify_client(codec_dev)) {
+			dev_err(dev, "Error '%s' is not an i2c_client\n",
+				BYT_RT5640_FALLBACK_CODEC_DEV_NAME);
+			put_device(codec_dev);
+		}
+
+		/* fixup codec name */
+		strscpy(byt_rt5640_codec_name, BYT_RT5640_FALLBACK_CODEC_DEV_NAME,
+			sizeof(byt_rt5640_codec_name));
+
+		/* bus_find_device() returns a reference no need to get() */
+		priv->codec_dev = codec_dev;
+	}
 
 	/*
 	 * swap SSP0 if bytcr is detected
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/bytcr_rt5651.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/bytcr_rt5651.c
@@ -910,7 +910,7 @@
 
 	/* fix index of codec dai */
 	for (i = 0; i < ARRAY_SIZE(byt_rt5651_dais); i++) {
-		if (byt_rt5651_dais[i].codecs->name &&
+		if (byt_rt5651_dais[i].num_codecs &&
 		    !strcmp(byt_rt5651_dais[i].codecs->name,
 			    "i2c-10EC5651:00")) {
 			dai_index = i;
@@ -926,7 +926,7 @@
 		byt_rt5651_dais[dai_index].codecs->name = byt_rt5651_codec_name;
 	} else {
 		dev_err(dev, "Error cannot find '%s' dev\n", mach->id);
-		return -ENXIO;
+		return -ENOENT;
 	}
 
 	codec_dev = acpi_get_first_physical_node(adev);
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/bytcr_wm5102.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/bytcr_wm5102.c
@@ -605,7 +605,7 @@
 
 	/* find index of codec dai */
 	for (i = 0; i < ARRAY_SIZE(byt_wm5102_dais); i++) {
-		if (byt_wm5102_dais[i].codecs->name &&
+		if (byt_wm5102_dais[i].num_codecs &&
 		    !strcmp(byt_wm5102_dais[i].codecs->name,
 			    "wm5102-codec")) {
 			dai_index = i;
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/cht_bsw_rt5645.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/cht_bsw_rt5645.c
@@ -569,7 +569,7 @@
 
 	/* set correct codec name */
 	for (i = 0; i < ARRAY_SIZE(cht_dailink); i++)
-		if (cht_dailink[i].codecs->name &&
+		if (cht_dailink[i].num_codecs &&
 		    !strcmp(cht_dailink[i].codecs->name,
 			    "i2c-10EC5645:00")) {
 			dai_index = i;
@@ -582,7 +582,11 @@
 		snprintf(cht_rt5645_codec_name, sizeof(cht_rt5645_codec_name),
 			 "i2c-%s", acpi_dev_name(adev));
 		cht_dailink[dai_index].codecs->name = cht_rt5645_codec_name;
+	} else {
+		dev_err(&pdev->dev, "Error cannot find '%s' dev\n", mach->id);
+		return -ENOENT;
 	}
+
 	/* acpi_get_first_physical_node() returns a borrowed ref, no need to deref */
 	codec_dev = acpi_get_first_physical_node(adev);
 	acpi_dev_put(adev);
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/cht_bsw_rt5672.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/cht_bsw_rt5672.c
@@ -466,7 +466,7 @@
 
 	/* find index of codec dai */
 	for (i = 0; i < ARRAY_SIZE(cht_dailink); i++) {
-		if (cht_dailink[i].codecs->name &&
+		if (cht_dailink[i].num_codecs &&
 		    !strcmp(cht_dailink[i].codecs->name, RT5672_I2C_DEFAULT)) {
 			dai_index = i;
 			break;
@@ -479,7 +479,11 @@
 		snprintf(drv->codec_name, sizeof(drv->codec_name),
 			 "i2c-%s", acpi_dev_name(adev));
 		cht_dailink[dai_index].codecs->name = drv->codec_name;
+	}  else {
+		dev_err(&pdev->dev, "Error cannot find '%s' dev\n", mach->id);
+		return -ENOENT;
 	}
+
 	acpi_dev_put(adev);
 
 	/* Use SSP0 on Bay Trail CR devices */
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/glk_rt5682_max98357a.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/glk_rt5682_max98357a.c
@@ -649,6 +649,8 @@
 	card = &glk_audio_card_rt5682_m98357a;
 	card->dev = &pdev->dev;
 	snd_soc_card_set_drvdata(card, ctx);
+	if (!snd_soc_acpi_sof_parent(&pdev->dev))
+		card->disable_route_checks = true;
 
 	/* override platform name, if required */
 	mach = pdev->dev.platform_data;
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/kbl_da7219_max98357a.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/kbl_da7219_max98357a.c
@@ -639,6 +639,7 @@
 	.dapm_routes = kabylake_map,
 	.num_dapm_routes = ARRAY_SIZE(kabylake_map),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = kabylake_card_late_probe,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/kbl_da7219_max98927.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/kbl_da7219_max98927.c
@@ -1036,6 +1036,7 @@
 	.codec_conf = max98927_codec_conf,
 	.num_configs = ARRAY_SIZE(max98927_codec_conf),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = kabylake_card_late_probe,
 };
 
@@ -1054,6 +1055,7 @@
 	.codec_conf = max98927_codec_conf,
 	.num_configs = ARRAY_SIZE(max98927_codec_conf),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = kabylake_card_late_probe,
 };
 
@@ -1071,6 +1073,7 @@
 	.codec_conf = max98373_codec_conf,
 	.num_configs = ARRAY_SIZE(max98373_codec_conf),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = kabylake_card_late_probe,
 };
 
@@ -1088,6 +1091,7 @@
 	.codec_conf = max98373_codec_conf,
 	.num_configs = ARRAY_SIZE(max98373_codec_conf),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = kabylake_card_late_probe,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/kbl_rt5660.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/kbl_rt5660.c
@@ -518,6 +518,7 @@
 	.dapm_routes = kabylake_rt5660_map,
 	.num_dapm_routes = ARRAY_SIZE(kabylake_rt5660_map),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = kabylake_card_late_probe,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/kbl_rt5663_max98927.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/kbl_rt5663_max98927.c
@@ -966,6 +966,7 @@
 	.codec_conf = max98927_codec_conf,
 	.num_configs = ARRAY_SIZE(max98927_codec_conf),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = kabylake_card_late_probe,
 };
 
@@ -982,6 +983,7 @@
 	.dapm_routes = kabylake_5663_map,
 	.num_dapm_routes = ARRAY_SIZE(kabylake_5663_map),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = kabylake_card_late_probe,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
@@ -791,6 +791,7 @@
 	.codec_conf = max98927_codec_conf,
 	.num_configs = ARRAY_SIZE(max98927_codec_conf),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = kabylake_card_late_probe,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/skl_hda_dsp_generic.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/skl_hda_dsp_generic.c
@@ -227,6 +227,8 @@
 	ctx->common_hdmi_codec_drv = mach->mach_params.common_hdmi_codec_drv;
 
 	hda_soc_card.dev = &pdev->dev;
+	if (!snd_soc_acpi_sof_parent(&pdev->dev))
+		hda_soc_card.disable_route_checks = true;
 
 	if (mach->mach_params.dmic_num > 0) {
 		snprintf(hda_soc_components, sizeof(hda_soc_components),
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/skl_nau88l25_max98357a.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/skl_nau88l25_max98357a.c
@@ -654,6 +654,7 @@
 	.dapm_routes = skylake_map,
 	.num_dapm_routes = ARRAY_SIZE(skylake_map),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = skylake_card_late_probe,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/skl_rt286.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/skl_rt286.c
@@ -523,6 +523,7 @@
 	.dapm_routes = skylake_rt286_map,
 	.num_dapm_routes = ARRAY_SIZE(skylake_rt286_map),
 	.fully_routed = true,
+	.disable_route_checks = true,
 	.late_probe = skylake_card_late_probe,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/sof_es8336.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/sof_es8336.c
@@ -681,7 +681,7 @@
 			dai_links[0].codecs->dai_name = "ES8326 HiFi";
 	} else {
 		dev_err(dev, "Error cannot find '%s' dev\n", mach->id);
-		return -ENXIO;
+		return -ENOENT;
 	}
 
 	codec_dev = acpi_get_first_physical_node(adev);
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/sof_rt5682.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/sof_rt5682.c
@@ -158,46 +158,6 @@
 		.callback = sof_rt5682_quirk_cb,
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Rex"),
-			DMI_MATCH(DMI_OEM_STRING, "AUDIO-MAX98360_ALC5682I_I2S"),
-		},
-		.driver_data = (void *)(SOF_RT5682_MCLK_EN |
-					SOF_RT5682_SSP_CODEC(2) |
-					SOF_RT5682_SSP_AMP(0) |
-					SOF_RT5682_NUM_HDMIDEV(3) |
-					SOF_BT_OFFLOAD_SSP(1) |
-					SOF_SSP_BT_OFFLOAD_PRESENT
-					),
-	},
-	{
-		.callback = sof_rt5682_quirk_cb,
-		.matches = {
-			DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Rex"),
-			DMI_MATCH(DMI_OEM_STRING, "AUDIO-MAX98360_ALC5682I_DISCRETE_I2S_BT"),
-		},
-		.driver_data = (void *)(SOF_RT5682_MCLK_EN |
-					SOF_RT5682_SSP_CODEC(2) |
-					SOF_RT5682_SSP_AMP(0) |
-					SOF_RT5682_NUM_HDMIDEV(3) |
-					SOF_BT_OFFLOAD_SSP(1) |
-					SOF_SSP_BT_OFFLOAD_PRESENT
-					),
-	},
-	{
-		.callback = sof_rt5682_quirk_cb,
-		.matches = {
-			DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Rex"),
-			DMI_MATCH(DMI_OEM_STRING, "AUDIO-ALC1019_ALC5682I_I2S"),
-		},
-		.driver_data = (void *)(SOF_RT5682_MCLK_EN |
-					SOF_RT5682_SSP_CODEC(2) |
-					SOF_RT5682_SSP_AMP(0) |
-					SOF_RT5682_NUM_HDMIDEV(3)
-					),
-	},
-	{
-		.callback = sof_rt5682_quirk_cb,
-		.matches = {
-			DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Rex"),
 		},
 		.driver_data = (void *)(SOF_RT5682_MCLK_EN |
 					SOF_RT5682_SSP_CODEC(2) |
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/sof_sdw.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/sof_sdw.c
@@ -236,6 +236,17 @@
 					SOF_SDW_PCH_DMIC |
 					RT711_JD2_100K),
 	},
+	{
+		/* NUC15 LAPRC710 skews */
+		.callback = sof_sdw_quirk_cb,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
+			DMI_MATCH(DMI_BOARD_NAME, "LAPRC710"),
+		},
+		.driver_data = (void *)(SOF_SDW_TGL_HDMI |
+					SOF_SDW_PCH_DMIC |
+					RT711_JD2_100K),
+	},
 	/* TigerLake-SDCA devices */
 	{
 		.callback = sof_sdw_quirk_cb,
@@ -271,6 +282,15 @@
 	{
 		.callback = sof_sdw_quirk_cb,
 		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
+			DMI_MATCH(DMI_PRODUCT_SKU, "0000000000070000"),
+		},
+		.driver_data = (void *)(SOF_SDW_TGL_HDMI |
+					RT711_JD2_100K),
+	},
+	{
+		.callback = sof_sdw_quirk_cb,
+		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Google"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Brya"),
 		},
@@ -401,6 +421,15 @@
 	{
 		.callback = sof_sdw_quirk_cb,
 		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0B8C"),
+		},
+		.driver_data = (void *)(SOF_SDW_TGL_HDMI |
+					RT711_JD2),
+	},
+	{
+		.callback = sof_sdw_quirk_cb,
+		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "HP"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16"),
 		},
@@ -422,6 +451,15 @@
 		.callback = sof_sdw_quirk_cb,
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0C0F")
+		},
+		.driver_data = (void *)(SOF_SDW_TGL_HDMI |
+					RT711_JD2),
+	},
+	{
+		.callback = sof_sdw_quirk_cb,
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0C10"),
 		},
 		/* No Jack */
@@ -484,6 +522,15 @@
 					SOF_BT_OFFLOAD_SSP(1) |
 					SOF_SSP_BT_OFFLOAD_PRESENT),
 	},
+	{
+		.callback = sof_sdw_quirk_cb,
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "OMEN Transcend Gaming Laptop"),
+		},
+		.driver_data = (void *)(RT711_JD2),
+	},
+
 	/* LunarLake devices */
 	{
 		.callback = sof_sdw_quirk_cb,
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/sof_ssp_common.h
+++ linux-qcom-6.8.0/sound/soc/intel/boards/sof_ssp_common.h
@@ -67,6 +67,14 @@
 
 enum sof_ssp_codec sof_ssp_detect_codec_type(struct device *dev);
 enum sof_ssp_codec sof_ssp_detect_amp_type(struct device *dev);
+
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SOF_SSP_COMMON)
 const char *sof_ssp_get_codec_name(enum sof_ssp_codec codec_type);
+#else
+static inline const char *sof_ssp_get_codec_name(enum sof_ssp_codec codec_type)
+{
+	return NULL;
+}
+#endif
 
 #endif /* __SOF_SSP_COMMON_H */
--- linux-qcom-6.8.0.orig/sound/soc/intel/boards/sof_wm8804.c
+++ linux-qcom-6.8.0/sound/soc/intel/boards/sof_wm8804.c
@@ -270,7 +270,11 @@
 		snprintf(codec_name, sizeof(codec_name),
 			 "%s%s", "i2c-", acpi_dev_name(adev));
 		dailink[dai_index].codecs->name = codec_name;
+	} else {
+		dev_err(&pdev->dev, "Error cannot find '%s' dev\n", mach->id);
+		return -ENOENT;
 	}
+
 	acpi_dev_put(adev);
 
 	snd_soc_card_set_drvdata(card, ctx);
--- linux-qcom-6.8.0.orig/sound/soc/intel/common/soc-acpi-intel-cht-match.c
+++ linux-qcom-6.8.0/sound/soc/intel/common/soc-acpi-intel-cht-match.c
@@ -84,7 +84,6 @@
 		/* Lenovo Yoga Tab 3 Pro YT3-X90, codec missing from DSDT */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
 			DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"),
 		},
 	},
--- linux-qcom-6.8.0.orig/sound/soc/intel/common/soc-intel-quirks.h
+++ linux-qcom-6.8.0/sound/soc/intel/common/soc-intel-quirks.h
@@ -11,7 +11,7 @@
 
 #include <linux/platform_data/x86/soc.h>
 
-#if IS_ENABLED(CONFIG_X86)
+#if IS_REACHABLE(CONFIG_IOSF_MBI)
 
 #include <linux/dmi.h>
 #include <asm/iosf_mbi.h>
--- linux-qcom-6.8.0.orig/sound/soc/intel/keembay/kmb_platform.c
+++ linux-qcom-6.8.0/sound/soc/intel/keembay/kmb_platform.c
@@ -814,6 +814,7 @@
 	{ .compatible = "intel,keembay-tdm", .data = &intel_kmb_tdm_dai},
 	{}
 };
+MODULE_DEVICE_TABLE(of, kmb_plat_of_match);
 
 static int kmb_plat_dai_probe(struct platform_device *pdev)
 {
--- linux-qcom-6.8.0.orig/sound/soc/kirkwood/kirkwood-dma.c
+++ linux-qcom-6.8.0/sound/soc/kirkwood/kirkwood-dma.c
@@ -182,6 +182,9 @@
 	const struct mbus_dram_target_info *dram = mv_mbus_dram_info();
 	unsigned long addr = substream->runtime->dma_addr;
 
+	if (!dram)
+		return 0;
+
 	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
 		kirkwood_dma_conf_mbus_windows(priv->io,
 			KIRKWOOD_PLAYBACK_WIN, addr, dram);
--- linux-qcom-6.8.0.orig/sound/soc/loongson/loongson_card.c
+++ linux-qcom-6.8.0/sound/soc/loongson/loongson_card.c
@@ -127,8 +127,8 @@
 	codec = of_get_child_by_name(dev->of_node, "codec");
 	if (!codec) {
 		dev_err(dev, "audio-codec property missing or invalid\n");
-		ret = -EINVAL;
-		goto err;
+		of_node_put(cpu);
+		return -EINVAL;
 	}
 
 	for (i = 0; i < card->num_links; i++) {
@@ -137,6 +137,7 @@
 			dev_err(dev, "getting cpu dlc error (%d)\n", ret);
 			goto err;
 		}
+		loongson_dai_links[i].platforms->of_node = loongson_dai_links[i].cpus->of_node;
 
 		ret = snd_soc_of_get_dlc(codec, NULL, loongson_dai_links[i].codecs, 0);
 		if (ret < 0) {
--- linux-qcom-6.8.0.orig/sound/soc/mediatek/common/mtk-afe-platform-driver.c
+++ linux-qcom-6.8.0/sound/soc/mediatek/common/mtk-afe-platform-driver.c
@@ -120,8 +120,8 @@
 	struct mtk_base_afe *afe = snd_soc_component_get_drvdata(component);
 
 	size = afe->mtk_afe_hardware->buffer_bytes_max;
-	snd_pcm_set_managed_buffer_all(pcm, SNDRV_DMA_TYPE_DEV,
-				       afe->dev, size, size);
+	snd_pcm_set_managed_buffer_all(pcm, SNDRV_DMA_TYPE_DEV, afe->dev, 0, size);
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(mtk_afe_pcm_new);
--- linux-qcom-6.8.0.orig/sound/soc/mediatek/common/mtk-soundcard-driver.c
+++ linux-qcom-6.8.0/sound/soc/mediatek/common/mtk-soundcard-driver.c
@@ -22,7 +22,11 @@
 
 	codec_node = of_get_child_by_name(sub_node, "codec");
 	if (!codec_node) {
-		dev_dbg(dev, "%s no specified codec\n", dai_link->name);
+		dev_dbg(dev, "%s no specified codec: setting dummy.\n", dai_link->name);
+
+		dai_link->codecs = &snd_soc_dummy_dlc;
+		dai_link->num_codecs = 1;
+		dai_link->dynamic = 1;
 		return 0;
 	}
 
--- linux-qcom-6.8.0.orig/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
+++ linux-qcom-6.8.0/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
@@ -31,7 +31,7 @@
 
 static struct snd_soc_jack_pin mt8183_da7219_max98357_jack_pins[] = {
 	{
-		.pin	= "Headphone",
+		.pin	= "Headphones",
 		.mask	= SND_JACK_HEADPHONE,
 	},
 	{
@@ -626,7 +626,7 @@
 };
 
 static const struct snd_kcontrol_new mt8183_da7219_max98357_snd_controls[] = {
-	SOC_DAPM_PIN_SWITCH("Headphone"),
+	SOC_DAPM_PIN_SWITCH("Headphones"),
 	SOC_DAPM_PIN_SWITCH("Headset Mic"),
 	SOC_DAPM_PIN_SWITCH("Speakers"),
 	SOC_DAPM_PIN_SWITCH("Line Out"),
@@ -634,7 +634,7 @@
 
 static const
 struct snd_soc_dapm_widget mt8183_da7219_max98357_dapm_widgets[] = {
-	SND_SOC_DAPM_HP("Headphone", NULL),
+	SND_SOC_DAPM_HP("Headphones", NULL),
 	SND_SOC_DAPM_MIC("Headset Mic", NULL),
 	SND_SOC_DAPM_SPK("Speakers", NULL),
 	SND_SOC_DAPM_SPK("Line Out", NULL),
@@ -680,7 +680,7 @@
 };
 
 static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = {
-	SOC_DAPM_PIN_SWITCH("Headphone"),
+	SOC_DAPM_PIN_SWITCH("Headphones"),
 	SOC_DAPM_PIN_SWITCH("Headset Mic"),
 	SOC_DAPM_PIN_SWITCH("Left Spk"),
 	SOC_DAPM_PIN_SWITCH("Right Spk"),
@@ -689,7 +689,7 @@
 
 static const
 struct snd_soc_dapm_widget mt8183_da7219_rt1015_dapm_widgets[] = {
-	SND_SOC_DAPM_HP("Headphone", NULL),
+	SND_SOC_DAPM_HP("Headphones", NULL),
 	SND_SOC_DAPM_MIC("Headset Mic", NULL),
 	SND_SOC_DAPM_SPK("Left Spk", NULL),
 	SND_SOC_DAPM_SPK("Right Spk", NULL),
--- linux-qcom-6.8.0.orig/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c
+++ linux-qcom-6.8.0/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c
@@ -2748,6 +2748,7 @@
 	case AFE_ASRC12_NEW_CON9:
 	case AFE_LRCK_CNT:
 	case AFE_DAC_MON0:
+	case AFE_DAC_CON0:
 	case AFE_DL2_CUR:
 	case AFE_DL3_CUR:
 	case AFE_DL6_CUR:
--- linux-qcom-6.8.0.orig/sound/soc/mediatek/mt8188/mt8188-mt6359.c
+++ linux-qcom-6.8.0/sound/soc/mediatek/mt8188/mt8188-mt6359.c
@@ -188,9 +188,7 @@
 SND_SOC_DAILINK_DEFS(ul_src,
 		     DAILINK_COMP_ARRAY(COMP_CPU("UL_SRC")),
 		     DAILINK_COMP_ARRAY(COMP_CODEC("mt6359-sound",
-						   "mt6359-snd-codec-aif1"),
-					COMP_CODEC("dmic-codec",
-						   "dmic-hifi")),
+						   "mt6359-snd-codec-aif1")),
 		     DAILINK_COMP_ARRAY(COMP_EMPTY()));
 
 SND_SOC_DAILINK_DEFS(AFE_SOF_DL2,
@@ -740,6 +738,7 @@
 	struct mt8188_mt6359_priv *priv = soc_card_data->mach_priv;
 	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
 	struct snd_soc_jack *jack = &priv->headset_jack;
+	struct mt8188_card_data *card_data = (struct mt8188_card_data *)priv->private_data;
 	int ret;
 
 	ret = snd_soc_dapm_new_controls(&card->dapm, mt8188_nau8825_widgets,
@@ -768,10 +767,18 @@
 		return ret;
 	}
 
-	snd_jack_set_key(jack->jack, SND_JACK_BTN_0, KEY_PLAYPAUSE);
-	snd_jack_set_key(jack->jack, SND_JACK_BTN_1, KEY_VOICECOMMAND);
-	snd_jack_set_key(jack->jack, SND_JACK_BTN_2, KEY_VOLUMEUP);
-	snd_jack_set_key(jack->jack, SND_JACK_BTN_3, KEY_VOLUMEDOWN);
+	if (card_data->quirk & ES8326_HS_PRESENT) {
+		snd_jack_set_key(jack->jack, SND_JACK_BTN_0, KEY_PLAYPAUSE);
+		snd_jack_set_key(jack->jack, SND_JACK_BTN_1, KEY_VOLUMEUP);
+		snd_jack_set_key(jack->jack, SND_JACK_BTN_2, KEY_VOLUMEDOWN);
+		snd_jack_set_key(jack->jack, SND_JACK_BTN_3, KEY_VOICECOMMAND);			
+	} else {
+		snd_jack_set_key(jack->jack, SND_JACK_BTN_0, KEY_PLAYPAUSE);
+		snd_jack_set_key(jack->jack, SND_JACK_BTN_1, KEY_VOICECOMMAND);
+		snd_jack_set_key(jack->jack, SND_JACK_BTN_2, KEY_VOLUMEUP);
+		snd_jack_set_key(jack->jack, SND_JACK_BTN_3, KEY_VOLUMEDOWN);	
+	}
+	
 	ret = snd_soc_component_set_jack(component, jack, NULL);
 
 	if (ret) {
@@ -1360,10 +1367,12 @@
 		}
 
 		if (strcmp(dai_link->name, "DPTX_BE") == 0) {
-			if (strcmp(dai_link->codecs->dai_name, "snd-soc-dummy-dai"))
+			if (dai_link->num_codecs &&
+			    strcmp(dai_link->codecs->dai_name, "snd-soc-dummy-dai"))
 				dai_link->init = mt8188_dptx_codec_init;
 		} else if (strcmp(dai_link->name, "ETDM3_OUT_BE") == 0) {
-			if (strcmp(dai_link->codecs->dai_name, "snd-soc-dummy-dai"))
+			if (dai_link->num_codecs &&
+			    strcmp(dai_link->codecs->dai_name, "snd-soc-dummy-dai"))
 				dai_link->init = mt8188_hdmi_codec_init;
 		} else if (strcmp(dai_link->name, "DL_SRC_BE") == 0 ||
 			   strcmp(dai_link->name, "UL_SRC_BE") == 0) {
@@ -1375,6 +1384,9 @@
 			   strcmp(dai_link->name, "ETDM2_OUT_BE") == 0 ||
 			   strcmp(dai_link->name, "ETDM1_IN_BE") == 0 ||
 			   strcmp(dai_link->name, "ETDM2_IN_BE") == 0) {
+			if (!dai_link->num_codecs)
+				continue;
+
 			if (!strcmp(dai_link->codecs->dai_name, MAX98390_CODEC_DAI)) {
 				/*
 				 * The TDM protocol settings with fixed 4 slots are defined in
--- linux-qcom-6.8.0.orig/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c
+++ linux-qcom-6.8.0/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c
@@ -566,10 +566,10 @@
 		tdm_con |= 1 << DELAY_DATA_SFT;
 		tdm_con |= get_tdm_lrck_width(format) << LRCK_TDM_WIDTH_SFT;
 	} else if (tdm_priv->tdm_out_mode == TDM_OUT_DSP_A) {
-		tdm_con |= 0 << DELAY_DATA_SFT;
+		tdm_con |= 1 << DELAY_DATA_SFT;
 		tdm_con |= 0 << LRCK_TDM_WIDTH_SFT;
 	} else if (tdm_priv->tdm_out_mode == TDM_OUT_DSP_B) {
-		tdm_con |= 1 << DELAY_DATA_SFT;
+		tdm_con |= 0 << DELAY_DATA_SFT;
 		tdm_con |= 0 << LRCK_TDM_WIDTH_SFT;
 	}
 
--- linux-qcom-6.8.0.orig/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+++ linux-qcom-6.8.0/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
@@ -1208,7 +1208,7 @@
 			dai_link->ignore = 0;
 		}
 
-		if (dai_link->num_codecs && dai_link->codecs[0].dai_name &&
+		if (dai_link->num_codecs &&
 		    strcmp(dai_link->codecs[0].dai_name, RT1015_CODEC_DAI) == 0)
 			dai_link->ops = &mt8192_rt1015_i2s_ops;
 
--- linux-qcom-6.8.0.orig/sound/soc/mediatek/mt8195/mt8195-mt6359.c
+++ linux-qcom-6.8.0/sound/soc/mediatek/mt8195/mt8195-mt6359.c
@@ -939,6 +939,7 @@
 
 SND_SOC_DAILINK_DEFS(ETDM1_OUT_BE,
 		     DAILINK_COMP_ARRAY(COMP_CPU("ETDM1_OUT")),
+		     DAILINK_COMP_ARRAY(COMP_EMPTY()),
 		     DAILINK_COMP_ARRAY(COMP_EMPTY()));
 
 SND_SOC_DAILINK_DEFS(ETDM2_OUT_BE,
--- linux-qcom-6.8.0.orig/sound/soc/meson/Kconfig
+++ linux-qcom-6.8.0/sound/soc/meson/Kconfig
@@ -99,6 +99,7 @@
 
 config SND_MESON_CARD_UTILS
 	tristate
+	select SND_DYNAMIC_MINORS
 
 config SND_MESON_CODEC_GLUE
 	tristate
--- linux-qcom-6.8.0.orig/sound/soc/meson/aiu.c
+++ linux-qcom-6.8.0/sound/soc/meson/aiu.c
@@ -212,11 +212,12 @@
 static int aiu_clk_get(struct device *dev)
 {
 	struct aiu *aiu = dev_get_drvdata(dev);
+	struct clk *pclk;
 	int ret;
 
-	aiu->pclk = devm_clk_get(dev, "pclk");
-	if (IS_ERR(aiu->pclk))
-		return dev_err_probe(dev, PTR_ERR(aiu->pclk), "Can't get the aiu pclk\n");
+	pclk = devm_clk_get_enabled(dev, "pclk");
+	if (IS_ERR(pclk))
+		return dev_err_probe(dev, PTR_ERR(pclk), "Can't get the aiu pclk\n");
 
 	aiu->spdif_mclk = devm_clk_get(dev, "spdif_mclk");
 	if (IS_ERR(aiu->spdif_mclk))
@@ -233,18 +234,6 @@
 	if (ret)
 		return dev_err_probe(dev, ret, "Can't get the spdif clocks\n");
 
-	ret = clk_prepare_enable(aiu->pclk);
-	if (ret) {
-		dev_err(dev, "peripheral clock enable failed\n");
-		return ret;
-	}
-
-	ret = devm_add_action_or_reset(dev,
-				       (void(*)(void *))clk_disable_unprepare,
-				       aiu->pclk);
-	if (ret)
-		dev_err(dev, "failed to add reset action on pclk");
-
 	return ret;
 }
 
--- linux-qcom-6.8.0.orig/sound/soc/meson/aiu.h
+++ linux-qcom-6.8.0/sound/soc/meson/aiu.h
@@ -33,7 +33,6 @@
 };
 
 struct aiu {
-	struct clk *pclk;
 	struct clk *spdif_mclk;
 	struct aiu_interface i2s;
 	struct aiu_interface spdif;
--- linux-qcom-6.8.0.orig/sound/soc/meson/axg-card.c
+++ linux-qcom-6.8.0/sound/soc/meson/axg-card.c
@@ -104,7 +104,7 @@
 				     int *index)
 {
 	struct meson_card *priv = snd_soc_card_get_drvdata(card);
-	struct snd_soc_dai_link *pad = &card->dai_link[*index];
+	struct snd_soc_dai_link *pad;
 	struct snd_soc_dai_link *lb;
 	struct snd_soc_dai_link_component *dlc;
 	int ret;
@@ -114,6 +114,7 @@
 	if (ret)
 		return ret;
 
+	pad = &card->dai_link[*index];
 	lb = &card->dai_link[*index + 1];
 
 	lb->name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-lb", pad->name);
@@ -318,6 +319,7 @@
 
 	dai_link->cpus = cpu;
 	dai_link->num_cpus = 1;
+	dai_link->nonatomic = true;
 
 	ret = meson_card_parse_dai(card, np, dai_link->cpus);
 	if (ret)
--- linux-qcom-6.8.0.orig/sound/soc/meson/axg-fifo.c
+++ linux-qcom-6.8.0/sound/soc/meson/axg-fifo.c
@@ -3,6 +3,7 @@
 // Copyright (c) 2018 BayLibre, SAS.
 // Author: Jerome Brunet <jbrunet@baylibre.com>
 
+#include <linux/bitfield.h>
 #include <linux/clk.h>
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
@@ -145,8 +146,8 @@
 	/* Enable irq if necessary  */
 	irq_en = runtime->no_period_wakeup ? 0 : FIFO_INT_COUNT_REPEAT;
 	regmap_update_bits(fifo->map, FIFO_CTRL0,
-			   CTRL0_INT_EN(FIFO_INT_COUNT_REPEAT),
-			   CTRL0_INT_EN(irq_en));
+			   CTRL0_INT_EN,
+			   FIELD_PREP(CTRL0_INT_EN, irq_en));
 
 	return 0;
 }
@@ -176,9 +177,9 @@
 {
 	struct axg_fifo *fifo = axg_fifo_data(ss);
 
-	/* Disable the block count irq */
+	/* Disable irqs */
 	regmap_update_bits(fifo->map, FIFO_CTRL0,
-			   CTRL0_INT_EN(FIFO_INT_COUNT_REPEAT), 0);
+			   CTRL0_INT_EN, 0);
 
 	return 0;
 }
@@ -187,13 +188,13 @@
 static void axg_fifo_ack_irq(struct axg_fifo *fifo, u8 mask)
 {
 	regmap_update_bits(fifo->map, FIFO_CTRL1,
-			   CTRL1_INT_CLR(FIFO_INT_MASK),
-			   CTRL1_INT_CLR(mask));
+			   CTRL1_INT_CLR,
+			   FIELD_PREP(CTRL1_INT_CLR, mask));
 
 	/* Clear must also be cleared */
 	regmap_update_bits(fifo->map, FIFO_CTRL1,
-			   CTRL1_INT_CLR(FIFO_INT_MASK),
-			   0);
+			   CTRL1_INT_CLR,
+			   FIELD_PREP(CTRL1_INT_CLR, 0));
 }
 
 static irqreturn_t axg_fifo_pcm_irq_block(int irq, void *dev_id)
@@ -203,18 +204,19 @@
 	unsigned int status;
 
 	regmap_read(fifo->map, FIFO_STATUS1, &status);
+	status = FIELD_GET(STATUS1_INT_STS, status);
+	axg_fifo_ack_irq(fifo, status);
 
-	status = STATUS1_INT_STS(status) & FIFO_INT_MASK;
-	if (status & FIFO_INT_COUNT_REPEAT)
-		snd_pcm_period_elapsed(ss);
-	else
+	if (status & ~FIFO_INT_COUNT_REPEAT)
 		dev_dbg(axg_fifo_dev(ss), "unexpected irq - STS 0x%02x\n",
 			status);
 
-	/* Ack irqs */
-	axg_fifo_ack_irq(fifo, status);
+	if (status & FIFO_INT_COUNT_REPEAT) {
+		snd_pcm_period_elapsed(ss);
+		return IRQ_HANDLED;
+	}
 
-	return IRQ_RETVAL(status);
+	return IRQ_NONE;
 }
 
 int axg_fifo_pcm_open(struct snd_soc_component *component,
@@ -242,8 +244,10 @@
 	if (ret)
 		return ret;
 
-	ret = request_irq(fifo->irq, axg_fifo_pcm_irq_block, 0,
-			  dev_name(dev), ss);
+	/* Use the threaded irq handler only with non-atomic links */
+	ret = request_threaded_irq(fifo->irq, NULL,
+				   axg_fifo_pcm_irq_block,
+				   IRQF_ONESHOT, dev_name(dev), ss);
 	if (ret)
 		return ret;
 
@@ -254,15 +258,15 @@
 
 	/* Setup status2 so it reports the memory pointer */
 	regmap_update_bits(fifo->map, FIFO_CTRL1,
-			   CTRL1_STATUS2_SEL_MASK,
-			   CTRL1_STATUS2_SEL(STATUS2_SEL_DDR_READ));
+			   CTRL1_STATUS2_SEL,
+			   FIELD_PREP(CTRL1_STATUS2_SEL, STATUS2_SEL_DDR_READ));
 
 	/* Make sure the dma is initially disabled */
 	__dma_enable(fifo, false);
 
 	/* Disable irqs until params are ready */
 	regmap_update_bits(fifo->map, FIFO_CTRL0,
-			   CTRL0_INT_EN(FIFO_INT_MASK), 0);
+			   CTRL0_INT_EN, 0);
 
 	/* Clear any pending interrupt */
 	axg_fifo_ack_irq(fifo, FIFO_INT_MASK);
--- linux-qcom-6.8.0.orig/sound/soc/meson/axg-fifo.h
+++ linux-qcom-6.8.0/sound/soc/meson/axg-fifo.h
@@ -42,21 +42,19 @@
 
 #define FIFO_CTRL0			0x00
 #define  CTRL0_DMA_EN			BIT(31)
-#define  CTRL0_INT_EN(x)		((x) << 16)
+#define  CTRL0_INT_EN			GENMASK(23, 16)
 #define  CTRL0_SEL_MASK			GENMASK(2, 0)
 #define  CTRL0_SEL_SHIFT		0
 #define FIFO_CTRL1			0x04
-#define  CTRL1_INT_CLR(x)		((x) << 0)
-#define  CTRL1_STATUS2_SEL_MASK		GENMASK(11, 8)
-#define  CTRL1_STATUS2_SEL(x)		((x) << 8)
+#define  CTRL1_INT_CLR			GENMASK(7, 0)
+#define  CTRL1_STATUS2_SEL		GENMASK(11, 8)
 #define   STATUS2_SEL_DDR_READ		0
-#define  CTRL1_FRDDR_DEPTH_MASK		GENMASK(31, 24)
-#define  CTRL1_FRDDR_DEPTH(x)		((x) << 24)
+#define  CTRL1_FRDDR_DEPTH		GENMASK(31, 24)
 #define FIFO_START_ADDR			0x08
 #define FIFO_FINISH_ADDR		0x0c
 #define FIFO_INT_ADDR			0x10
 #define FIFO_STATUS1			0x14
-#define  STATUS1_INT_STS(x)		((x) << 0)
+#define  STATUS1_INT_STS		GENMASK(7, 0)
 #define FIFO_STATUS2			0x18
 #define FIFO_INIT_ADDR			0x24
 #define FIFO_CTRL2			0x28
--- linux-qcom-6.8.0.orig/sound/soc/meson/axg-frddr.c
+++ linux-qcom-6.8.0/sound/soc/meson/axg-frddr.c
@@ -7,6 +7,7 @@
  * This driver implements the frontend playback DAI of AXG and G12A based SoCs
  */
 
+#include <linux/bitfield.h>
 #include <linux/clk.h>
 #include <linux/regmap.h>
 #include <linux/module.h>
@@ -59,8 +60,8 @@
 	/* Trim the FIFO depth if the period is small to improve latency */
 	depth = min(period, fifo->depth);
 	val = (depth / AXG_FIFO_BURST) - 1;
-	regmap_update_bits(fifo->map, FIFO_CTRL1, CTRL1_FRDDR_DEPTH_MASK,
-			   CTRL1_FRDDR_DEPTH(val));
+	regmap_update_bits(fifo->map, FIFO_CTRL1, CTRL1_FRDDR_DEPTH,
+			   FIELD_PREP(CTRL1_FRDDR_DEPTH, val));
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/sound/soc/meson/axg-tdm-interface.c
+++ linux-qcom-6.8.0/sound/soc/meson/axg-tdm-interface.c
@@ -12,6 +12,9 @@
 
 #include "axg-tdm.h"
 
+/* Maximum bit clock frequency according the datasheets */
+#define MAX_SCLK 100000000 /* Hz */
+
 enum {
 	TDM_IFACE_PAD,
 	TDM_IFACE_LOOPBACK,
@@ -153,19 +156,27 @@
 		return -EINVAL;
 	}
 
-	/* Apply component wide rate symmetry */
 	if (snd_soc_component_active(dai->component)) {
+		/* Apply component wide rate symmetry */
 		ret = snd_pcm_hw_constraint_single(substream->runtime,
 						   SNDRV_PCM_HW_PARAM_RATE,
 						   iface->rate);
-		if (ret < 0) {
-			dev_err(dai->dev,
-				"can't set iface rate constraint\n");
-			return ret;
-		}
+
+	} else {
+		/* Limit rate according to the slot number and width */
+		unsigned int max_rate =
+			MAX_SCLK / (iface->slots * iface->slot_width);
+		ret = snd_pcm_hw_constraint_minmax(substream->runtime,
+						   SNDRV_PCM_HW_PARAM_RATE,
+						   0, max_rate);
 	}
 
-	return 0;
+	if (ret < 0)
+		dev_err(dai->dev, "can't set iface rate constraint\n");
+	else
+		ret = 0;
+
+	return ret;
 }
 
 static int axg_tdm_iface_set_stream(struct snd_pcm_substream *substream,
@@ -264,8 +275,8 @@
 	srate = iface->slots * iface->slot_width * params_rate(params);
 
 	if (!iface->mclk_rate) {
-		/* If no specific mclk is requested, default to bit clock * 4 */
-		clk_set_rate(iface->mclk, 4 * srate);
+		/* If no specific mclk is requested, default to bit clock * 2 */
+		clk_set_rate(iface->mclk, 2 * srate);
 	} else {
 		/* Check if we can actually get the bit clock from mclk */
 		if (iface->mclk_rate % srate) {
@@ -338,26 +349,31 @@
 	return 0;
 }
 
-static int axg_tdm_iface_hw_free(struct snd_pcm_substream *substream,
+static int axg_tdm_iface_trigger(struct snd_pcm_substream *substream,
+				 int cmd,
 				 struct snd_soc_dai *dai)
 {
-	struct axg_tdm_stream *ts = snd_soc_dai_get_dma_data(dai, substream);
+	struct axg_tdm_stream *ts =
+		snd_soc_dai_get_dma_data(dai, substream);
 
-	/* Stop all attached formatters */
-	axg_tdm_stream_stop(ts);
+	switch (cmd) {
+	case SNDRV_PCM_TRIGGER_START:
+	case SNDRV_PCM_TRIGGER_RESUME:
+	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		axg_tdm_stream_start(ts);
+		break;
+	case SNDRV_PCM_TRIGGER_SUSPEND:
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+	case SNDRV_PCM_TRIGGER_STOP:
+		axg_tdm_stream_stop(ts);
+		break;
+	default:
+		return -EINVAL;
+	}
 
 	return 0;
 }
 
-static int axg_tdm_iface_prepare(struct snd_pcm_substream *substream,
-				 struct snd_soc_dai *dai)
-{
-	struct axg_tdm_stream *ts = snd_soc_dai_get_dma_data(dai, substream);
-
-	/* Force all attached formatters to update */
-	return axg_tdm_stream_reset(ts);
-}
-
 static int axg_tdm_iface_remove_dai(struct snd_soc_dai *dai)
 {
 	int stream;
@@ -401,8 +417,7 @@
 	.set_fmt	= axg_tdm_iface_set_fmt,
 	.startup	= axg_tdm_iface_startup,
 	.hw_params	= axg_tdm_iface_hw_params,
-	.prepare	= axg_tdm_iface_prepare,
-	.hw_free	= axg_tdm_iface_hw_free,
+	.trigger	= axg_tdm_iface_trigger,
 };
 
 /* TDM Backend DAIs */
--- linux-qcom-6.8.0.orig/sound/soc/meson/axg-toddr.c
+++ linux-qcom-6.8.0/sound/soc/meson/axg-toddr.c
@@ -5,6 +5,7 @@
 
 /* This driver implements the frontend capture DAI of AXG based SoCs */
 
+#include <linux/bitfield.h>
 #include <linux/clk.h>
 #include <linux/regmap.h>
 #include <linux/module.h>
@@ -19,12 +20,9 @@
 #define CTRL0_TODDR_EXT_SIGNED		BIT(29)
 #define CTRL0_TODDR_PP_MODE		BIT(28)
 #define CTRL0_TODDR_SYNC_CH		BIT(27)
-#define CTRL0_TODDR_TYPE_MASK		GENMASK(15, 13)
-#define CTRL0_TODDR_TYPE(x)		((x) << 13)
-#define CTRL0_TODDR_MSB_POS_MASK	GENMASK(12, 8)
-#define CTRL0_TODDR_MSB_POS(x)		((x) << 8)
-#define CTRL0_TODDR_LSB_POS_MASK	GENMASK(7, 3)
-#define CTRL0_TODDR_LSB_POS(x)		((x) << 3)
+#define CTRL0_TODDR_TYPE		GENMASK(15, 13)
+#define CTRL0_TODDR_MSB_POS		GENMASK(12, 8)
+#define CTRL0_TODDR_LSB_POS		GENMASK(7, 3)
 #define CTRL1_TODDR_FORCE_FINISH	BIT(25)
 #define CTRL1_SEL_SHIFT			28
 
@@ -76,12 +74,12 @@
 	width = params_width(params);
 
 	regmap_update_bits(fifo->map, FIFO_CTRL0,
-			   CTRL0_TODDR_TYPE_MASK |
-			   CTRL0_TODDR_MSB_POS_MASK |
-			   CTRL0_TODDR_LSB_POS_MASK,
-			   CTRL0_TODDR_TYPE(type) |
-			   CTRL0_TODDR_MSB_POS(TODDR_MSB_POS) |
-			   CTRL0_TODDR_LSB_POS(TODDR_MSB_POS - (width - 1)));
+			   CTRL0_TODDR_TYPE |
+			   CTRL0_TODDR_MSB_POS |
+			   CTRL0_TODDR_LSB_POS,
+			   FIELD_PREP(CTRL0_TODDR_TYPE, type) |
+			   FIELD_PREP(CTRL0_TODDR_MSB_POS, TODDR_MSB_POS) |
+			   FIELD_PREP(CTRL0_TODDR_LSB_POS, TODDR_MSB_POS - (width - 1)));
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/sound/soc/meson/t9015.c
+++ linux-qcom-6.8.0/sound/soc/meson/t9015.c
@@ -48,7 +48,6 @@
 #define POWER_CFG	0x10
 
 struct t9015 {
-	struct clk *pclk;
 	struct regulator *avdd;
 };
 
@@ -249,6 +248,7 @@
 	struct t9015 *priv;
 	void __iomem *regs;
 	struct regmap *regmap;
+	struct clk *pclk;
 	int ret;
 
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -256,26 +256,14 @@
 		return -ENOMEM;
 	platform_set_drvdata(pdev, priv);
 
-	priv->pclk = devm_clk_get(dev, "pclk");
-	if (IS_ERR(priv->pclk))
-		return dev_err_probe(dev, PTR_ERR(priv->pclk), "failed to get core clock\n");
+	pclk = devm_clk_get_enabled(dev, "pclk");
+	if (IS_ERR(pclk))
+		return dev_err_probe(dev, PTR_ERR(pclk), "failed to get core clock\n");
 
 	priv->avdd = devm_regulator_get(dev, "AVDD");
 	if (IS_ERR(priv->avdd))
 		return dev_err_probe(dev, PTR_ERR(priv->avdd), "failed to AVDD\n");
 
-	ret = clk_prepare_enable(priv->pclk);
-	if (ret) {
-		dev_err(dev, "core clock enable failed\n");
-		return ret;
-	}
-
-	ret = devm_add_action_or_reset(dev,
-			(void(*)(void *))clk_disable_unprepare,
-			priv->pclk);
-	if (ret)
-		return ret;
-
 	ret = device_reset(dev);
 	if (ret) {
 		dev_err(dev, "reset failed\n");
--- linux-qcom-6.8.0.orig/sound/soc/qcom/Kconfig
+++ linux-qcom-6.8.0/sound/soc/qcom/Kconfig
@@ -118,6 +118,15 @@
 	tristate
 	select SND_SOC_QDSP6_PRM_LPASS_CLOCKS
 
+config SND_SOC_SPF_CORE
+	tristate
+
+config SND_SOC_AUDIO_PKT
+	tristate
+
+config SND_SOC_MSM_AUDIO_MEM
+	tristate
+
 config SND_SOC_QDSP6
 	tristate "SoC ALSA audio driver for QDSP6"
 	depends on QCOM_APR
@@ -134,6 +143,9 @@
 	select SND_SOC_TOPOLOGY
 	select SND_SOC_QDSP6_APM
 	select SND_SOC_QDSP6_PRM
+	select SND_SOC_SPF_CORE
+	select SND_SOC_AUDIO_PKT
+	select SND_SOC_MSM_AUDIO_MEM
 	help
 	 To add support for MSM QDSP6 Soc Audio.
 	 This will enable sound soc platform specific
@@ -151,12 +163,27 @@
 	  APQ8096 SoC-based systems.
 	  Say Y if you want to use audio device on this SoCs
 
+config SND_SOC_QCS9100
+        tristate "SoC Machine driver for QCS9100 boards"
+        depends on QCOM_APR
+        select SND_SOC_MAX98357A
+        select SND_SOC_QCOM_COMMON
+        select SND_SOC_QDSP6
+        select SND_SOC_QCOM_COMMON
+        select SND_SOC_QCOM_SDW
+        help
+          Add support for audio on Qualcomm Technologies Inc.
+          QCS9100 SoC-based systems.
+          To compile this driver say Y or M if you want to
+          use audio device on this SoCs.
+
 config SND_SOC_SDM845
 	tristate "SoC Machine driver for SDM845 boards"
 	depends on QCOM_APR && I2C && SOUNDWIRE
 	depends on COMMON_CLK
 	select SND_SOC_QDSP6
 	select SND_SOC_QCOM_COMMON
+	select SND_SOC_QCOM_SDW
 	select SND_SOC_RT5663
 	select SND_SOC_MAX98927
 	imply SND_SOC_CROS_EC_CODEC
@@ -208,6 +235,7 @@
 	tristate "SoC Machine driver for SC7280 boards"
 	depends on I2C && SOUNDWIRE
 	select SND_SOC_QCOM_COMMON
+	select SND_SOC_QCOM_SDW
 	select SND_SOC_LPASS_SC7280
 	select SND_SOC_MAX98357A
 	select SND_SOC_WCD938X_SDW
@@ -233,4 +261,20 @@
 	  X1E80100 SoC-based systems.
 	  Say Y or M if you want to use audio device on this SoCs.
 
+config SND_SOC_QCM6490
+	tristate "SoC Machine driver for QCM6490 boards"
+	depends on I2C && SOUNDWIRE
+	select SND_SOC_MAX98357A
+	select SND_SOC_DMIC
+	select SND_SOC_QCOM_COMMON
+	select SND_SOC_LPASS_MACRO_COMMON
+	imply SND_SOC_LPASS_RX_MACRO
+	imply SND_SOC_LPASS_TX_MACRO
+	imply SND_SOC_LPASS_WSA_MACRO
+	help
+	  Add support for audio on Qualcomm Technologies Inc.
+	  QCM6490 SoC-based systems.
+	  To compile this driver say Y or M if you want to
+	  use audio device on this SoCs.
+
 endif #SND_SOC_QCOM
--- linux-qcom-6.8.0.orig/sound/soc/qcom/Makefile
+++ linux-qcom-6.8.0/sound/soc/qcom/Makefile
@@ -24,6 +24,8 @@
 snd-soc-apq8096-objs := apq8096.o
 snd-soc-sc7180-objs := sc7180.o
 snd-soc-sc7280-objs := sc7280.o
+snd-soc-qcm6490-objs := qcm6490.o
+snd-soc-qcs9100-objs := qcs9100.o
 snd-soc-sdm845-objs := sdm845.o
 snd-soc-sm8250-objs := sm8250.o
 snd-soc-sc8280xp-objs := sc8280xp.o
@@ -34,8 +36,10 @@
 obj-$(CONFIG_SND_SOC_STORM) += snd-soc-storm.o
 obj-$(CONFIG_SND_SOC_APQ8016_SBC) += snd-soc-apq8016-sbc.o
 obj-$(CONFIG_SND_SOC_MSM8996) += snd-soc-apq8096.o
+obj-$(CONFIG_SND_SOC_QCS9100) += snd-soc-qcs9100.o
 obj-$(CONFIG_SND_SOC_SC7180) += snd-soc-sc7180.o
 obj-$(CONFIG_SND_SOC_SC7280) += snd-soc-sc7280.o
+obj-$(CONFIG_SND_SOC_QCM6490) += snd-soc-qcm6490.o
 obj-$(CONFIG_SND_SOC_SC8280XP) += snd-soc-sc8280xp.o
 obj-$(CONFIG_SND_SOC_SDM845) += snd-soc-sdm845.o
 obj-$(CONFIG_SND_SOC_SM8250) += snd-soc-sm8250.o
--- linux-qcom-6.8.0.orig/sound/soc/qcom/common.c
+++ linux-qcom-6.8.0/sound/soc/qcom/common.c
@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2018, Linaro Limited.
 // Copyright (c) 2018, The Linux Foundation. All rights reserved.
+// Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <dt-bindings/sound/qcom,q6afe.h>
 #include <linux/module.h>
 #include <sound/jack.h>
+#include <sound/simple_card_utils.h>
 #include <linux/input-event-codes.h>
 #include "common.h"
 
@@ -174,6 +176,184 @@
 }
 EXPORT_SYMBOL_GPL(qcom_snd_parse_of);
 
+int qcom_snd_parse_of_v2(struct snd_soc_card *card, struct qcom_snd_common_data *priv)
+{
+	struct device_node *np;
+	struct device_node *codec = NULL;
+	struct device_node *platform = NULL;
+	struct device_node *cpu = NULL;
+	struct device *dev = card->dev;
+	struct snd_soc_dai_link *link;
+	struct of_phandle_args args;
+	struct snd_soc_dai_link_component *dlc;
+	int ret, num_links;
+	const char *dai_format;
+	struct qcom_snd_dailink_data *link_priv;
+
+	ret = snd_soc_of_parse_card_name(card, "model");
+	if (ret == 0 && !card->name)
+		/* Deprecated, only for compatibility with old device trees */
+		ret = snd_soc_of_parse_card_name(card, "qcom,model");
+	if (ret) {
+		dev_err(dev, "Error parsing card name: %d\n", ret);
+		return ret;
+	}
+
+	if (of_property_read_bool(dev->of_node, "widgets")) {
+		ret = snd_soc_of_parse_audio_simple_widgets(card, "widgets");
+		if (ret)
+			return ret;
+	}
+
+	/* DAPM routes */
+	if (of_property_read_bool(dev->of_node, "audio-routing")) {
+		ret = snd_soc_of_parse_audio_routing(card, "audio-routing");
+		if (ret)
+			return ret;
+	}
+	/* Deprecated, only for compatibility with old device trees */
+	if (of_property_read_bool(dev->of_node, "qcom,audio-routing")) {
+		ret = snd_soc_of_parse_audio_routing(card, "qcom,audio-routing");
+		if (ret)
+			return ret;
+	}
+
+	ret = snd_soc_of_parse_pin_switches(card, "pin-switches");
+	if (ret)
+		return ret;
+
+	ret = snd_soc_of_parse_aux_devs(card, "aux-devs");
+	if (ret)
+		return ret;
+
+	/* Populate links */
+	num_links = of_get_available_child_count(dev->of_node);
+
+	/* Allocate the DAI link array */
+	card->dai_link = devm_kcalloc(dev, num_links, sizeof(*link), GFP_KERNEL);
+	if (!card->dai_link)
+		return -ENOMEM;
+
+	priv->link_data = devm_kcalloc(dev, num_links,
+				       sizeof(struct qcom_snd_dailink_data), GFP_KERNEL);
+	if (!priv->link_data)
+		return -ENOMEM;
+
+	card->num_links = num_links;
+	link = card->dai_link;
+	link_priv = priv->link_data;
+
+	for_each_available_child_of_node(dev->of_node, np) {
+		dlc = devm_kzalloc(dev, 2 * sizeof(*dlc), GFP_KERNEL);
+		if (!dlc) {
+			ret = -ENOMEM;
+			goto err_put_np;
+		}
+
+		link->cpus	= &dlc[0];
+		link->platforms	= &dlc[1];
+
+		link->num_cpus		= 1;
+		link->num_platforms	= 1;
+
+		ret = of_property_read_string(np, "link-name", &link->name);
+		if (ret) {
+			dev_err(card->dev, "error getting codec dai_link name\n");
+			goto err_put_np;
+		}
+
+		cpu = of_get_child_by_name(np, "cpu");
+		platform = of_get_child_by_name(np, "platform");
+		codec = of_get_child_by_name(np, "codec");
+
+		if (!cpu) {
+			dev_err(dev, "%s: Can't find cpu DT node\n", link->name);
+			ret = -EINVAL;
+			goto err;
+		}
+
+		ret = snd_soc_of_get_dlc(cpu, &args, link->cpus, 0);
+		if (ret) {
+			dev_err_probe(card->dev, ret,
+				      "%s: error getting cpu dai name\n", link->name);
+			goto err;
+		}
+
+		link->id = args.args[0];
+
+		if (platform) {
+			link->platforms->of_node = of_parse_phandle(platform,
+								    "sound-dai", 0);
+			if (!link->platforms->of_node) {
+				dev_err(card->dev, "%s: platform dai not found\n", link->name);
+				ret = -EINVAL;
+				goto err;
+			}
+		} else {
+			link->platforms->of_node = link->cpus->of_node;
+		}
+
+		if (codec) {
+			ret = snd_soc_of_get_dai_link_codecs(dev, codec, link);
+			if (ret < 0) {
+				dev_err_probe(card->dev, ret,
+					      "%s: codec dai not found\n", link->name);
+				goto err;
+			}
+
+			if (platform) {
+				/* DPCM backend */
+				link->no_pcm = 1;
+				link->ignore_pmdown_time = 1;
+			}
+		} else {
+			/* DPCM frontend */
+			link->codecs	 = &snd_soc_dummy_dlc;
+			link->num_codecs = 1;
+			link->dynamic = 1;
+		}
+
+		if (platform || !codec) {
+			/* DPCM */
+			snd_soc_dai_link_set_capabilities(link);
+			link->ignore_suspend = 1;
+			link->nonatomic = 1;
+		}
+
+		if (!of_property_read_string(np, "dai-format", &dai_format))
+			simple_util_parse_daifmt(dev, np, codec, NULL, &link->dai_fmt);
+
+		of_property_read_u32(np, "mclk-fs", &link_priv->mclk_fs);
+		of_property_read_u32(np, "mclk-id", &link_priv->mclk_id);
+
+		if (of_property_read_bool(np, "mclk-direction-out"))
+			link_priv->clk_direction = SND_SOC_CLOCK_OUT;
+
+		link->stream_name = link->name;
+		link++;
+		link_priv++;
+
+		of_node_put(cpu);
+		of_node_put(codec);
+		of_node_put(platform);
+	}
+
+	if (!card->dapm_widgets) {
+		card->dapm_widgets = qcom_jack_snd_widgets;
+		card->num_dapm_widgets = ARRAY_SIZE(qcom_jack_snd_widgets);
+	}
+
+	return 0;
+err:
+	of_node_put(cpu);
+	of_node_put(codec);
+	of_node_put(platform);
+err_put_np:
+	of_node_put(np);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(qcom_snd_parse_of_v2);
+
 static struct snd_soc_jack_pin qcom_headset_jack_pins[] = {
 	/* Headset */
 	{
--- linux-qcom-6.8.0.orig/sound/soc/qcom/common.h
+++ linux-qcom-6.8.0/sound/soc/qcom/common.h
@@ -1,12 +1,24 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 // Copyright (c) 2018, The Linux Foundation. All rights reserved.
+// Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #ifndef __QCOM_SND_COMMON_H__
 #define __QCOM_SND_COMMON_H__
 
 #include <sound/soc.h>
 
+struct qcom_snd_dailink_data {
+	u32 mclk_fs;
+	u32 mclk_id;
+	u32 clk_direction;
+};
+
+struct qcom_snd_common_data {
+	struct qcom_snd_dailink_data *link_data;
+};
+
 int qcom_snd_parse_of(struct snd_soc_card *card);
+int qcom_snd_parse_of_v2(struct snd_soc_card *card, struct qcom_snd_common_data *priv);
 int qcom_snd_wcd_jack_setup(struct snd_soc_pcm_runtime *rtd,
 			    struct snd_soc_jack *jack, bool *jack_setup);
 
--- linux-qcom-6.8.0.orig/sound/soc/qcom/lpass-cpu.c
+++ linux-qcom-6.8.0/sound/soc/qcom/lpass-cpu.c
@@ -1166,9 +1166,13 @@
 		}
 
 		res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "lpass-rxtx-cdc-dma-lpm");
+		if (!res)
+			return -EINVAL;
 		drvdata->rxtx_cdc_dma_lpm_buf = res->start;
 
 		res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "lpass-va-cdc-dma-lpm");
+		if (!res)
+			return -EINVAL;
 		drvdata->va_cdc_dma_lpm_buf = res->start;
 	}
 
@@ -1238,6 +1242,8 @@
 	/* Allocation for i2sctl regmap fields */
 	drvdata->i2sctl = devm_kzalloc(&pdev->dev, sizeof(struct lpaif_i2sctl),
 					GFP_KERNEL);
+	if (!drvdata->i2sctl)
+		return -ENOMEM;
 
 	/* Initialize bitfields for dai I2SCTL register */
 	ret = lpass_cpu_init_i2sctl_bitfields(dev, drvdata->i2sctl,
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qcm6490.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qcm6490.c
@@ -0,0 +1,374 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+// Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <dt-bindings/sound/qcom,q6dsp-lpass-ports.h>
+#include <linux/input.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/of_device.h>
+#include <sound/core.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
+#include <sound/pcm.h>
+#include <linux/soundwire/sdw.h>
+#include <sound/jack.h>
+#include <sound/pcm_params.h>
+#include "lpass.h"
+#include "qdsp6/q6afe.h"
+#include "qdsp6/q6prm.h"
+#include "common.h"
+#include "sdw.h"
+
+#define DRIVER_NAME		"qcm6490"
+#define WCN_CDC_SLIM_RX_CH_MAX	2
+#define WCN_CDC_SLIM_TX_CH_MAX	2
+#define NAME_SIZE	32
+
+struct qcm6490_snd_data {
+	struct qcom_snd_common_data common_priv;
+	bool stream_prepared[AFE_PORT_MAX];
+	struct snd_soc_card *card;
+	struct sdw_stream_runtime *sruntime[AFE_PORT_MAX];
+	struct snd_soc_jack jack;
+	bool jack_setup;
+	struct snd_soc_jack hdmi_jack[8];
+};
+
+static int qcm6490_slim_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+	int ret = 0;
+	unsigned int rx_ch[WCN_CDC_SLIM_RX_CH_MAX] = {157, 158};
+	unsigned int tx_ch[WCN_CDC_SLIM_TX_CH_MAX]  = {159, 162};
+	struct snd_soc_dai *codec_dai = snd_soc_rtd_to_codec(rtd, 0);
+
+	ret = snd_soc_dai_set_channel_map(codec_dai, ARRAY_SIZE(tx_ch),
+		tx_ch, ARRAY_SIZE(rx_ch), rx_ch);
+
+	return ret;
+}
+
+static int qcm6490_snd_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct qcm6490_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
+	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	int ret = 0;
+	char jack_name[NAME_SIZE];
+	struct snd_soc_jack *hdmi_jack  = NULL;
+	int hdmi_pcm_id = 0;
+	struct snd_soc_dai *codec_dai;
+	int rval, i;
+
+
+	switch (cpu_dai->id) {
+	case TX_CODEC_DMA_TX_3:
+	case RX_CODEC_DMA_RX_0:
+		ret = qcom_snd_wcd_jack_setup(rtd, &data->jack, &data->jack_setup);
+		break;
+	case VA_CODEC_DMA_TX_0:
+	case WSA_CODEC_DMA_RX_0:
+	case WSA_CODEC_DMA_TX_0:
+	case PRIMARY_MI2S_RX:
+	case PRIMARY_MI2S_TX:
+	case PRIMARY_TDM_RX_0:
+	case PRIMARY_TDM_TX_0:
+		break;
+	case SLIMBUS_0_RX:
+	case SLIMBUS_0_TX:
+		ret = qcm6490_slim_dai_init(rtd);
+		break;
+	case DISPLAY_PORT_RX_0:
+		hdmi_pcm_id = 0;
+		hdmi_jack = &data->hdmi_jack[0];
+		break;
+	case DISPLAY_PORT_RX_1:
+		hdmi_pcm_id = 1;
+		hdmi_jack = &data->hdmi_jack[1];
+		break;
+
+	default:
+		break;
+	}
+	if (hdmi_jack) {
+		snprintf(jack_name, sizeof(jack_name), "HDMI/DP%d Jack", hdmi_pcm_id);
+		rval = snd_soc_card_jack_new(rtd->card, jack_name, SND_JACK_AVOUT, hdmi_jack);
+
+		if (rval)
+			return rval;
+
+		for_each_rtd_codec_dais(rtd, i, codec_dai) {
+			rval = snd_soc_component_set_jack(codec_dai->component, hdmi_jack, NULL);
+			if (rval != 0 && rval != -EOPNOTSUPP) {
+				dev_warn(rtd->card->dev, "Failed to set HDMI jack: %d\n", rval);
+				return rval;
+			}
+		}
+		return qcom_snd_wcd_jack_setup(rtd, &data->jack, &data->jack_setup);
+	}
+
+	return ret;
+}
+
+static int qcm6490_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
+				      struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct snd_interval *rate = hw_param_interval(params,
+					SNDRV_PCM_HW_PARAM_RATE);
+	struct snd_interval *channels = hw_param_interval(params,
+					SNDRV_PCM_HW_PARAM_CHANNELS);
+
+	rate->min = rate->max = 48000;
+	channels->min = 2;
+	channels->max = 2;
+	switch (cpu_dai->id) {
+	case TX_CODEC_DMA_TX_0:
+	case TX_CODEC_DMA_TX_1:
+	case TX_CODEC_DMA_TX_2:
+	case TX_CODEC_DMA_TX_3:
+		channels->min = 1;
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int qcm6490_snd_hw_params(struct snd_pcm_substream *substream,
+				 struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct qcm6490_snd_data *pdata = snd_soc_card_get_drvdata(rtd->card);
+	struct snd_soc_dai *codec_dai = NULL;
+	struct qcom_snd_dailink_data *link_priv = &pdata->common_priv.link_data[rtd->num];
+	unsigned int daifmt = 0;
+	u32 mclk_fs, mclk_rate, clk_dir;
+	int ret = 0;
+	int i;
+
+	daifmt = rtd->dai_link->dai_fmt;
+	for_each_rtd_codec_dais(rtd, i, codec_dai) {
+		if (daifmt)
+			snd_soc_dai_set_fmt(codec_dai, daifmt);
+
+		mclk_fs = link_priv->mclk_fs;
+		clk_dir = link_priv->clk_direction;
+		if (mclk_fs) {
+			mclk_rate = params_rate(params) * mclk_fs;
+			ret = snd_soc_dai_set_sysclk(codec_dai, link_priv->mclk_id,
+						     mclk_rate, clk_dir);
+			if (ret < 0) {
+				dev_err(rtd->dev, "snd_soc_dai_set_sysclk err = %d\n",
+					ret);
+				return ret;
+			}
+		}
+	}
+
+	return qcom_snd_sdw_hw_params(substream, params, &pdata->sruntime[cpu_dai->id]);
+}
+
+static int qcm6490_snd_prepare(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct qcm6490_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
+	struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
+
+	return qcom_snd_sdw_prepare(substream, sruntime,
+				    &data->stream_prepared[cpu_dai->id]);
+}
+
+static int qcm6490_snd_hw_free(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct qcm6490_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
+	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
+
+	return qcom_snd_sdw_hw_free(substream, sruntime,
+				    &data->stream_prepared[cpu_dai->id]);
+}
+
+static const struct snd_soc_dapm_widget qcm6490_dapm_widgets[] = {
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	SND_SOC_DAPM_MIC("Mic Jack", NULL),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF1_PINCTRL", "stub_aif1_active", "stub_aif1_sleep"),
+};
+
+static const struct snd_soc_dapm_route qcm6490_dapm_routes[] = {
+	{"STUB_AIF1_RX", NULL, "STUB_AIF1_PINCTRL"},
+	{"STUB_AIF1_TX", NULL, "STUB_AIF1_PINCTRL"},
+};
+
+static const struct snd_soc_dapm_widget qcs6490_rb3gen2_dapm_widgets[] = {
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	SND_SOC_DAPM_MIC("Mic Jack", NULL),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF1_PINCTRL", "stub_aif1_active", "stub_aif1_sleep"),
+};
+
+static const struct snd_soc_dapm_route qcs6490_rb3gen2_dapm_routes[] = {
+	{"STUB_AIF1_RX", NULL, "STUB_AIF1_PINCTRL"},
+	{"STUB_AIF1_TX", NULL, "STUB_AIF1_PINCTRL"},
+};
+
+static const struct snd_soc_dapm_widget qcs6490_rb3gen2_ia_dapm_widgets[] = {
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	SND_SOC_DAPM_MIC("Mic Jack", NULL),
+};
+
+static const struct snd_soc_dapm_widget qcs6490_rb3gen2_ptz_dapm_widgets[] = {
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	SND_SOC_DAPM_MIC("Mic Jack", NULL),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF1_PINCTRL", "stub_aif1_active", "stub_aif1_sleep"),
+};
+
+static const struct snd_soc_dapm_route qcs6490_rb3gen2_ptz_dapm_routes[] = {
+	{"STUB_AIF1_RX", NULL, "STUB_AIF1_PINCTRL"},
+	{"STUB_AIF1_TX", NULL, "STUB_AIF1_PINCTRL"},
+};
+
+static const struct snd_soc_dapm_widget qcs6490_rb3gen2_video_dapm_widgets[] = {
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	SND_SOC_DAPM_MIC("Mic Jack", NULL),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF1_PINCTRL", "stub_aif1_active", "stub_aif1_sleep"),
+};
+
+static const struct snd_soc_dapm_route qcs6490_rb3gen2_video_dapm_routes[] = {
+	{"STUB_AIF1_RX", NULL, "STUB_AIF1_PINCTRL"},
+	{"STUB_AIF1_TX", NULL, "STUB_AIF1_PINCTRL"},
+};
+
+static const struct snd_soc_dapm_widget qcs6490_rb3gen2_vision_dapm_widgets[] = {
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	SND_SOC_DAPM_MIC("Mic Jack", NULL),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF1_PINCTRL", "stub_aif1_active", "stub_aif1_sleep"),
+};
+
+static const struct snd_soc_dapm_route qcs6490_rb3gen2_vision_dapm_routes[] = {
+	{"STUB_AIF1_RX", NULL, "STUB_AIF1_PINCTRL"},
+	{"STUB_AIF1_TX", NULL, "STUB_AIF1_PINCTRL"},
+};
+
+static const struct snd_soc_ops qcm6490_be_ops = {
+	.hw_params = qcm6490_snd_hw_params,
+	.hw_free = qcm6490_snd_hw_free,
+	.prepare = qcm6490_snd_prepare,
+};
+
+static struct snd_soc_card qcm6490_data = {
+	.name = "qcm6490",
+	.dapm_widgets = qcm6490_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(qcm6490_dapm_widgets),
+	.dapm_routes = qcm6490_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(qcm6490_dapm_routes),
+};
+
+static struct snd_soc_card qcs6490_rb3gen2_data = {
+	.name = "qcs6490-rb3gen2",
+	.dapm_widgets = qcs6490_rb3gen2_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(qcs6490_rb3gen2_dapm_widgets),
+	.dapm_routes = qcs6490_rb3gen2_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(qcs6490_rb3gen2_dapm_routes),
+};
+
+static struct snd_soc_card qcs6490_rb3gen2_ia_data = {
+	.name = "qcs6490-rb3gen2-ia-mezz",
+	.dapm_widgets = qcs6490_rb3gen2_ia_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(qcs6490_rb3gen2_ia_dapm_widgets),
+};
+
+static struct snd_soc_card qcs6490_rb3gen2_ptz_data = {
+	.name = "qcs6490-rb3gen2-ptz-mezz",
+	.dapm_widgets = qcs6490_rb3gen2_ptz_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(qcs6490_rb3gen2_ptz_dapm_widgets),
+	.dapm_routes = qcs6490_rb3gen2_ptz_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(qcs6490_rb3gen2_ptz_dapm_routes),
+};
+
+static struct snd_soc_card qcs6490_rb3gen2_video_data = {
+	.name = "qcs6490-rb3gen2-video-mezz",
+	.dapm_widgets = qcs6490_rb3gen2_video_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(qcs6490_rb3gen2_video_dapm_widgets),
+	.dapm_routes = qcs6490_rb3gen2_video_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(qcs6490_rb3gen2_video_dapm_routes),
+};
+
+static struct snd_soc_card qcs6490_rb3gen2_vision_data = {
+	.name = "qcs6490-rb3gen2-vision-mezz",
+	.dapm_widgets = qcs6490_rb3gen2_vision_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(qcs6490_rb3gen2_vision_dapm_widgets),
+	.dapm_routes = qcs6490_rb3gen2_vision_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(qcs6490_rb3gen2_vision_dapm_routes),
+};
+
+static void qcm6490_add_be_ops(struct snd_soc_card *card)
+{
+	struct snd_soc_dai_link *link;
+	int i;
+
+	for_each_card_prelinks(card, i, link) {
+		if ((link->num_codecs != 1) || (link->codecs->dai_name
+					&& strcmp(link->codecs->dai_name, "snd-soc-dummy-dai"))) {
+			link->init = qcm6490_snd_init;
+			link->be_hw_params_fixup = qcm6490_be_hw_params_fixup;
+			link->ops = &qcm6490_be_ops;
+		}
+	}
+}
+
+static int qcm6490_platform_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card;
+	struct qcm6490_snd_data *data;
+	struct device *dev = &pdev->dev;
+	int ret;
+
+	card = (struct snd_soc_card *)of_device_get_match_data(&pdev->dev);
+	if (!card)
+		return -EINVAL;
+
+	card->owner = THIS_MODULE;
+	/* Allocate the private data */
+	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	card->dev = dev;
+
+	dev_set_drvdata(dev, card);
+	snd_soc_card_set_drvdata(card, data);
+	ret = qcom_snd_parse_of_v2(card, &data->common_priv);
+	if (ret)
+		return ret;
+
+	card->driver_name = DRIVER_NAME;
+	qcm6490_add_be_ops(card);
+
+	return devm_snd_soc_register_card(dev, card);
+}
+
+static const struct of_device_id snd_qcm6490_dt_match[] = {
+	{.compatible = "qcom,qcm6490-sndcard", .data = &qcm6490_data},
+	{.compatible = "qcom,qcs6490-rb3gen2-sndcard", .data = &qcs6490_rb3gen2_data},
+	{.compatible = "qcom,qcs6490-rb3gen2-ia-sndcard", .data = &qcs6490_rb3gen2_ia_data},
+	{.compatible = "qcom,qcs6490-rb3gen2-ptz-sndcard", .data = &qcs6490_rb3gen2_ptz_data},
+	{.compatible = "qcom,qcs6490-rb3gen2-video-sndcard", .data = &qcs6490_rb3gen2_video_data},
+	{.compatible = "qcom,qcs6490-rb3gen2-vision-sndcard", .data = &qcs6490_rb3gen2_vision_data},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, snd_qcm6490_dt_match);
+
+static struct platform_driver snd_qcm6490_driver = {
+	.probe  = qcm6490_platform_probe,
+	.driver = {
+		.name = "snd-qcm6490",
+		.of_match_table = snd_qcm6490_dt_match,
+	},
+};
+module_platform_driver(snd_qcm6490_driver);
+MODULE_DESCRIPTION("qcm6490 ASoC Machine Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qcs9100.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qcs9100.c
@@ -0,0 +1,336 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <dt-bindings/sound/qcom,q6afe.h>
+#include <linux/input.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/of_device.h>
+#include <sound/core.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
+#include <sound/pcm.h>
+#include <linux/soundwire/sdw.h>
+#include <sound/jack.h>
+#include <sound/pcm_params.h>
+#include "lpass.h"
+#include "qdsp6/q6afe.h"
+#include "qdsp6/q6prm.h"
+#include "common.h"
+#include "sdw.h"
+
+#define DRIVER_NAME		"qcs9100"
+#define WCN_CDC_SLIM_RX_CH_MAX	2
+#define WCN_CDC_SLIM_TX_CH_MAX	2
+#define NAME_SIZE	32
+
+struct qcs9100_snd_data {
+	bool stream_prepared[AFE_PORT_MAX];
+	struct snd_soc_card *card;
+	struct sdw_stream_runtime *sruntime[AFE_PORT_MAX];
+	struct snd_soc_jack jack;
+	bool jack_setup;
+	struct clk *macro;
+	struct clk *dcodec;
+	struct snd_soc_jack hdmi_jack[8];
+};
+
+static int qcs9100_snd_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct qcs9100_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
+	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	int ret = 0;
+	char jack_name[NAME_SIZE];
+	struct snd_soc_jack *hdmi_jack  = NULL;
+	int hdmi_pcm_id = 0;
+	struct snd_soc_dai *codec_dai;
+	int rval, i;
+
+	switch (cpu_dai->id) {
+	case PRIMARY_MI2S_RX:
+	case PRIMARY_MI2S_TX:
+	case PRIMARY_TDM_RX_0:
+	case PRIMARY_TDM_TX_0:
+		break;
+	case DISPLAY_PORT_RX_0:
+		hdmi_pcm_id = 0;
+		hdmi_jack = &data->hdmi_jack[0];
+		break;
+	case DISPLAY_PORT_RX_1:
+		hdmi_pcm_id = 1;
+		hdmi_jack = &data->hdmi_jack[1];
+		break;
+
+	default:
+		break;
+	}
+	if (hdmi_jack) {
+		snprintf(jack_name, sizeof(jack_name), "HDMI/DP%d Jack", hdmi_pcm_id);
+		rval = snd_soc_card_jack_new(rtd->card, jack_name, SND_JACK_AVOUT, hdmi_jack);
+
+		if (rval)
+			return rval;
+
+		for_each_rtd_codec_dais(rtd, i, codec_dai) {
+			rval = snd_soc_component_set_jack(codec_dai->component, hdmi_jack, NULL);
+			if (rval != 0 && rval != -EOPNOTSUPP) {
+				dev_warn(rtd->card->dev, "Failed to set HDMI jack: %d\n", rval);
+				return rval;
+			}
+		}
+		return qcom_snd_wcd_jack_setup(rtd, &data->jack, &data->jack_setup);
+	}
+
+	return ret;
+}
+
+static int qcs9100_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
+				      struct snd_pcm_hw_params *params)
+{
+	struct snd_interval *rate = hw_param_interval(params,
+					SNDRV_PCM_HW_PARAM_RATE);
+	struct snd_interval *channels = hw_param_interval(params,
+					SNDRV_PCM_HW_PARAM_CHANNELS);
+
+	rate->min = 48000;
+	rate->max = 48000;
+	channels->min = 2;
+	channels->max = 2;
+
+	return 0;
+}
+
+static int qcs9100_snd_hw_params(struct snd_pcm_substream *substream,
+				 struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct qcs9100_snd_data *pdata = snd_soc_card_get_drvdata(rtd->card);
+	int ret = 0;
+
+	switch (cpu_dai->id) {
+	case TERTIARY_MI2S_RX:
+	case TERTIARY_MI2S_TX:
+	case TERTIARY_TDM_RX_0:
+	case TERTIARY_TDM_TX_0:
+	case PRIMARY_SDR_MI2S_RX ... QUINARY_SDR_TDM_TX_0:
+		/* clock setting is done for qcs9100 target to support high
+		 * speed i2s interface
+		 */
+		if (pdata->macro) {
+			ret = clk_prepare_enable(pdata->macro);
+			if (ret) {
+				dev_err(pdata->card->dev, "unable to prepare macro\n");
+				return ret;
+			}
+		}
+		if (pdata->dcodec) {
+			ret = clk_prepare_enable(pdata->dcodec);
+			if (ret) {
+				dev_err(pdata->card->dev, "unable to prepare decode\n");
+				return ret;
+			}
+		}
+		break;
+	default:
+		break;
+	}
+
+	return qcom_snd_sdw_hw_params(substream, params, &pdata->sruntime[cpu_dai->id]);
+}
+
+static int qcs9100_snd_prepare(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct qcs9100_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
+	struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
+
+	return qcom_snd_sdw_prepare(substream, sruntime,
+				    &data->stream_prepared[cpu_dai->id]);
+}
+
+static int qcs9100_snd_hw_free(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct qcs9100_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
+	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
+
+	switch (cpu_dai->id) {
+	case TERTIARY_MI2S_RX:
+	case TERTIARY_MI2S_TX:
+	case TERTIARY_TDM_RX_0:
+	case TERTIARY_TDM_TX_0:
+	case PRIMARY_SDR_MI2S_RX ... QUINARY_SDR_TDM_TX_0:
+		/* clock disable is done for qcs9100 target to support high
+		 * speed i2s interface
+		 */
+		if (data->dcodec)
+			clk_disable_unprepare(data->dcodec);
+
+		if (data->macro)
+			clk_disable_unprepare(data->macro);
+
+		break;
+	default:
+		break;
+	}
+
+	return qcom_snd_sdw_hw_free(substream, sruntime,
+				    &data->stream_prepared[cpu_dai->id]);
+}
+
+static const struct snd_soc_dapm_widget qcs8300_dapm_widgets[] = {
+	SND_SOC_DAPM_PINCTRL("STUB_AIF1_PINCTRL", "stub_aif1_active", "stub_aif1_sleep"),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF2_PINCTRL", "stub_aif2_active", "stub_aif2_sleep"),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF3_PINCTRL", "stub_aif3_active", "stub_aif3_sleep"),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF4_PINCTRL", "stub_aif4_active", "stub_aif4_sleep"),
+};
+
+static const struct snd_soc_dapm_route qcs8300_dapm_routes[] = {
+	{"STUB_AIF0_RX", NULL, "STUB_AIF1_PINCTRL"},
+	{"STUB_AIF0_TX", NULL, "STUB_AIF1_PINCTRL"},
+	{"STUB_AIF1_RX", NULL, "STUB_AIF2_PINCTRL"},
+	{"STUB_AIF1_TX", NULL, "STUB_AIF2_PINCTRL"},
+	{"STUB_AIF2_RX", NULL, "STUB_AIF3_PINCTRL"},
+	{"STUB_AIF2_TX", NULL, "STUB_AIF3_PINCTRL"},
+	{"STUB_AIF3_RX", NULL, "STUB_AIF4_PINCTRL"},
+	{"STUB_AIF3_TX", NULL, "STUB_AIF4_PINCTRL"},
+};
+
+static const struct snd_soc_dapm_widget qcs9100_dapm_widgets[] = {
+	SND_SOC_DAPM_PINCTRL("STUB_AIF0_PINCTRL", "stub_aif0_active", "stub_aif0_sleep"),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF1_PINCTRL", "stub_aif1_active", "stub_aif1_sleep"),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF2_PINCTRL", "stub_aif2_active", "stub_aif2_sleep"),
+	SND_SOC_DAPM_PINCTRL("STUB_AIF3_PINCTRL", "stub_aif3_active", "stub_aif3_sleep"),
+};
+
+static const struct snd_soc_dapm_route qcs9100_dapm_routes[] = {
+	{"STUB_AIF0_RX", NULL, "STUB_AIF0_PINCTRL"},
+	{"STUB_AIF0_TX", NULL, "STUB_AIF0_PINCTRL"},
+	{"STUB_AIF1_RX", NULL, "STUB_AIF1_PINCTRL"},
+	{"STUB_AIF1_TX", NULL, "STUB_AIF1_PINCTRL"},
+	{"STUB_AIF2_RX", NULL, "STUB_AIF2_PINCTRL"},
+	{"STUB_AIF2_TX", NULL, "STUB_AIF2_PINCTRL"},
+	{"STUB_AIF3_RX", NULL, "STUB_AIF3_PINCTRL"},
+	{"STUB_AIF3_TX", NULL, "STUB_AIF3_PINCTRL"},
+};
+
+static const struct snd_soc_dapm_widget qcs9075_dapm_widgets[] = {
+	SND_SOC_DAPM_PINCTRL("MI2S_OUT_PINCTRL", "mi2s_aud_out_active", "mi2s_aud_out_sleep"),
+};
+
+static const struct snd_soc_dapm_route qcs9075_dapm_routes[] = {
+	{"Speaker", NULL, "MI2S_OUT_PINCTRL"},
+	{"DMic", NULL, "MI2S_OUT_PINCTRL"},
+};
+
+static const struct snd_soc_ops qcs9100_be_ops = {
+	.hw_params = qcs9100_snd_hw_params,
+	.hw_free = qcs9100_snd_hw_free,
+	.prepare = qcs9100_snd_prepare,
+};
+
+static struct snd_soc_card snd_soc_qcs8300_data = {
+	.name = "qcs8300",
+	.dapm_widgets = qcs8300_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(qcs8300_dapm_widgets),
+	.dapm_routes = qcs8300_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(qcs8300_dapm_routes),
+};
+
+static struct snd_soc_card snd_soc_qcs9100_data = {
+	.name = "qcs9100",
+	.dapm_widgets = qcs9100_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(qcs9100_dapm_widgets),
+	.dapm_routes = qcs9100_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(qcs9100_dapm_routes),
+};
+
+static struct snd_soc_card snd_soc_qcs9075_rb8_data = {
+	.name = "qcs9075-rb8",
+	.dapm_widgets = qcs9075_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(qcs9075_dapm_widgets),
+	.dapm_routes = qcs9075_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(qcs9075_dapm_routes),
+};
+
+static void qcs9100_add_be_ops(struct snd_soc_card *card)
+{
+	struct snd_soc_dai_link *link;
+	int i;
+
+	for_each_card_prelinks(card, i, link) {
+		if (link->no_pcm == 1) {
+			link->init = qcs9100_snd_init;
+			link->be_hw_params_fixup = qcs9100_be_hw_params_fixup;
+			link->ops = &qcs9100_be_ops;
+		}
+	}
+}
+
+static int qcs9100_platform_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card;
+	struct qcs9100_snd_data *data;
+	struct device *dev = &pdev->dev;
+	int ret;
+
+	card = (struct snd_soc_card *)of_device_get_match_data(&pdev->dev);
+	if (!card)
+		return -EINVAL;
+
+	card->owner = THIS_MODULE;
+	/* Allocate the private data */
+	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	card->dev = dev;
+
+	dev_set_drvdata(dev, card);
+	snd_soc_card_set_drvdata(card, data);
+	ret = qcom_snd_parse_of(card);
+	if (ret)
+		return ret;
+
+	card->driver_name = DRIVER_NAME;
+	qcs9100_add_be_ops(card);
+
+	/* get clock info to set clock for qcs9100 target to support high
+	 * speed i2s interface
+	 */
+	data->macro = devm_clk_get_optional(dev, "macro");
+	if (IS_ERR(data->macro)) {
+		dev_info(dev, "getting macro clock info FAILED, ret %d\n", PTR_ERR(data->macro));
+		return PTR_ERR(data->macro);
+	}
+	data->dcodec = devm_clk_get_optional(dev, "dcodec");
+	if (IS_ERR(data->dcodec)) {
+		dev_info(dev, "getting decode clock info FAILED, ret %d\n", PTR_ERR(data->dcodec));
+		return PTR_ERR(data->dcodec);
+	}
+
+	return devm_snd_soc_register_card(dev, card);
+}
+
+static const struct of_device_id snd_qcs9100_dt_match[] = {
+	{.compatible = "qcom,qcs8300-sndcard", .data = &snd_soc_qcs8300_data},
+	{.compatible = "qcom,qcs9100-sndcard", .data = &snd_soc_qcs9100_data},
+	{.compatible = "qcom,qcs9075-rb8-sndcard", .data = &snd_soc_qcs9075_rb8_data},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, snd_qcs9100_dt_match);
+
+static struct platform_driver snd_qcs9100_driver = {
+	.probe  = qcs9100_platform_probe,
+	.driver = {
+		.name = "snd-qcs9100",
+		.of_match_table = snd_qcs9100_dt_match,
+	},
+};
+module_platform_driver(snd_qcs9100_driver);
+MODULE_DESCRIPTION("qcs9100 ASoC Machine Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/Makefile
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/Makefile
@@ -17,3 +17,7 @@
 obj-$(CONFIG_SND_SOC_QDSP6_APM_LPASS_DAI) += q6apm-lpass-dais.o
 obj-$(CONFIG_SND_SOC_QDSP6_PRM) += q6prm.o
 obj-$(CONFIG_SND_SOC_QDSP6_PRM_LPASS_CLOCKS) += q6prm-clocks.o
+
+obj-$(CONFIG_SND_SOC_SPF_CORE) += spf-core.o
+obj-$(CONFIG_SND_SOC_AUDIO_PKT) += audio-pkt.o
+obj-$(CONFIG_SND_SOC_MSM_AUDIO_MEM) += msm_audio_mem.o
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/audio-pkt.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/audio-pkt.c
@@ -0,0 +1,524 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <linux/platform_device.h>
+#include <linux/of_platform.h>
+#include <linux/refcount.h>
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/cdev.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/idr.h>
+#include <linux/of.h>
+#include <linux/fs.h>
+#include <linux/uaccess.h>
+#include <linux/termios.h>
+#include <linux/soc/qcom/apr.h>
+#include <dt-bindings/soc/qcom,gpr.h>
+#include "msm_audio_mem.h"
+#include "q6apm.h"
+
+#include "msm_audio_mem.h"
+
+#define APM_CMD_SHARED_MEM_MAP_REGIONS          0x0100100C
+#define APM_MEMORY_MAP_BIT_MASK_IS_OFFSET_MODE  0x00000004UL
+
+static bool audio_pkt_probed;
+/* Define Logging Macros */
+static int audio_pkt_debug_mask;
+enum {
+		AUDIO_PKT_INFO = 1U << 0,
+};
+
+#define AUDIO_PKT_INFO(x, ...)							\
+do {										\
+	if (audio_pkt_debug_mask & AUDIO_PKT_INFO) {				\
+		pr_info_ratelimited("[%s]: "x, __func__, ##__VA_ARGS__);	\
+	}									\
+} while (0)
+
+#define AUDIO_PKT_ERR(x, ...)							\
+{										\
+	pr_err_ratelimited("[%s]: "x, __func__, ##__VA_ARGS__);			\
+}
+
+#define MODULE_NAME "audio-pkt"
+#define MINOR_NUMBER_COUNT 1
+#define AUDPKT_DRIVER_NAME "aud_pasthru_adsp"
+#define CHANNEL_NAME "to_apps"
+
+/**
+ * struct audio_pkt - driver context, relates rpdev to cdev
+ * @adev:	gpr device node
+ * @dev:	audio pkt device
+ * @cdev:	cdev for the audio pkt device
+ * @lock:	synchronization of @rpdev
+ * @queue_lock:	synchronization of @queue operations
+ * @queue:	incoming message queue
+ * @readq:	wait object for incoming queue
+ * @dev_name:	/dev/@dev_name for audio_pkt device
+ * @ch_name:	audio channel to match to
+ * @audio_pkt_major: Major number of audio pkt driver
+ * @audio_pkt_class: audio pkt class pointer
+ */
+struct audio_pkt_device {
+	gpr_device_t *adev;
+	struct device *dev;
+	struct cdev cdev;
+
+	struct mutex lock;
+
+	spinlock_t queue_lock;
+	struct sk_buff_head queue;
+	wait_queue_head_t readq;
+
+	char dev_name[20];
+	char ch_name[20];
+
+	dev_t audio_pkt_major;
+	struct class *audio_pkt_class;
+};
+
+struct audio_pkt_apm_cmd_shared_mem_map_regions_t {
+	uint16_t mem_pool_id;
+	uint16_t num_regions;
+	uint32_t property_flag;
+
+};
+
+struct audio_pkt_apm_shared_map_region_payload_t {
+	uint32_t shm_addr_lsw;
+	uint32_t shm_addr_msw;
+	uint32_t mem_size_bytes;
+};
+
+struct audio_pkt_apm_mem_map {
+	struct audio_pkt_apm_cmd_shared_mem_map_regions_t mmap_header;
+	struct audio_pkt_apm_shared_map_region_payload_t mmap_payload;
+};
+
+struct audio_gpr_pkt {
+	struct gpr_hdr audpkt_hdr;
+	struct audio_pkt_apm_mem_map audpkt_mem_map;
+};
+
+typedef void (*audio_pkt_clnt_cb_fn)(void *buf, int len, void *priv);
+
+struct audio_pkt_clnt_ch {
+	int client_id;
+	audio_pkt_clnt_cb_fn func;
+};
+
+#define dev_to_audpkt_dev(_dev) container_of(_dev, struct audio_pkt_device, dev)
+#define cdev_to_audpkt_dev(_cdev) container_of(_cdev, struct audio_pkt_device, cdev)
+
+/**
+ * audio_pkt_open() - open() syscall for the audio_pkt device
+ * inode:	Pointer to the inode structure.
+ * file:	Pointer to the file structure.
+ *
+ * This function is used to open the audio pkt device when
+ * userspace client do a open() system call. All input arguments are
+ * validated by the virtual file system before calling this function.
+ */
+int audio_pkt_open(struct inode *inode, struct file *file)
+{
+	struct audio_pkt_device *audpkt_dev = cdev_to_audpkt_dev(inode->i_cdev);
+	struct device *dev = audpkt_dev->dev;
+
+	AUDIO_PKT_ERR("for %s\n", audpkt_dev->ch_name);
+
+	get_device(dev);
+	file->private_data = audpkt_dev;
+
+	return 0;
+}
+
+/**
+ * audio_pkt_release() - release operation on audio_pkt device
+ * inode:	Pointer to the inode structure.
+ * file:	Pointer to the file structure.
+ *
+ * This function is used to release the audio pkt device when
+ * userspace client do a close() system call. All input arguments are
+ * validated by the virtual file system before calling this function.
+ */
+int audio_pkt_release(struct inode *inode, struct file *file)
+{
+	struct audio_pkt_device *audpkt_dev = cdev_to_audpkt_dev(inode->i_cdev);
+	struct device *dev = audpkt_dev->dev;
+	struct sk_buff *skb;
+	unsigned long flags;
+
+	spin_lock_irqsave(&audpkt_dev->queue_lock, flags);
+
+	/* Discard all SKBs */
+	while (!skb_queue_empty(&audpkt_dev->queue)) {
+		skb = skb_dequeue(&audpkt_dev->queue);
+		kfree_skb(skb);
+	}
+	wake_up_interruptible(&audpkt_dev->readq);
+	spin_unlock_irqrestore(&audpkt_dev->queue_lock, flags);
+
+	put_device(dev);
+	file->private_data = NULL;
+	q6apm_close_all();
+	msm_audio_mem_crash_handler();
+
+	return 0;
+}
+
+/**
+ * audio_pkt_read() - read() syscall for the audio_pkt device
+ * file:	Pointer to the file structure.
+ * buf:		Pointer to the userspace buffer.
+ * count:	Number bytes to read from the file.
+ * ppos:	Pointer to the position into the file.
+ *
+ * This function is used to Read the data from audio pkt device when
+ * userspace client do a read() system call. All input arguments are
+ * validated by the virtual file system before calling this function.
+ */
+ssize_t audio_pkt_read(struct file *file, char __user *buf,
+		       size_t count, loff_t *ppos)
+{
+	struct audio_pkt_device *audpkt_dev = file->private_data;
+	unsigned long flags;
+	struct sk_buff *skb;
+	int use;
+	uint32_t *temp;
+
+	if (!audpkt_dev) {
+		AUDIO_PKT_ERR("invalid device handle\n");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&audpkt_dev->queue_lock, flags);
+	/* Wait for data in the queue */
+	if (skb_queue_empty(&audpkt_dev->queue)) {
+		spin_unlock_irqrestore(&audpkt_dev->queue_lock, flags);
+
+		if (file->f_flags & O_NONBLOCK)
+			return -EAGAIN;
+
+		/* Wait until we get data or the endpoint goes away */
+		if (wait_event_interruptible(audpkt_dev->readq,
+					!skb_queue_empty(&audpkt_dev->queue)))
+			return -ERESTARTSYS;
+
+		spin_lock_irqsave(&audpkt_dev->queue_lock, flags);
+	}
+
+	skb = skb_dequeue(&audpkt_dev->queue);
+	spin_unlock_irqrestore(&audpkt_dev->queue_lock, flags);
+	if (!skb)
+		return -EFAULT;
+
+	use = min_t(size_t, count, skb->len);
+	if (copy_to_user(buf, skb->data, use))
+		use = -EFAULT;
+	temp = (uint32_t *) skb->data;
+	kfree_skb(skb);
+
+	return use;
+}
+
+/**
+ * audpkt_update_physical_addr - Update physical address
+ * audpkt_hdr:	Pointer to the file structure.
+ */
+int audpkt_chk_and_update_physical_addr(struct audio_gpr_pkt *gpr_pkt)
+{
+	size_t pa_len = 0;
+	dma_addr_t paddr = 0;
+	int ret = 0;
+
+	if (gpr_pkt->audpkt_mem_map.mmap_header.property_flag &
+				APM_MEMORY_MAP_BIT_MASK_IS_OFFSET_MODE) {
+
+		/* TODO: move physical address mapping to use DMA-BUF heaps */
+		ret = msm_audio_get_phy_addr(
+				(int) gpr_pkt->audpkt_mem_map.mmap_payload.shm_addr_lsw,
+				&paddr, &pa_len);
+		if (ret < 0) {
+			AUDIO_PKT_ERR("%s Get phy. address failed, ret %d\n",
+					__func__, ret);
+			return ret;
+		}
+
+		AUDIO_PKT_INFO("%s physical address %pK", __func__,
+				(void *) paddr);
+		gpr_pkt->audpkt_mem_map.mmap_payload.shm_addr_lsw = (uint32_t) paddr;
+		gpr_pkt->audpkt_mem_map.mmap_payload.shm_addr_msw = (uint64_t) paddr >> 32;
+	}
+	return ret;
+}
+
+/**
+ * audio_pkt_write() - write() syscall for the audio_pkt device
+ * file:	Pointer to the file structure.
+ * buf:		Pointer to the userspace buffer.
+ * count:	Number bytes to read from the file.
+ * ppos:	Pointer to the position into the file.
+ *
+ * This function is used to write the data to audio pkt device when
+ * userspace client do a write() system call. All input arguments are
+ * validated by the virtual file system before calling this function.
+ */
+ssize_t audio_pkt_write(struct file *file, const char __user *buf,
+			size_t count, loff_t *ppos)
+{
+	struct audio_pkt_device *audpkt_dev = file->private_data;
+	struct gpr_hdr *audpkt_hdr = NULL;
+	void *kbuf;
+	int ret;
+
+	if (!audpkt_dev)  {
+		AUDIO_PKT_ERR("invalid device handle\n");
+		return -EINVAL;
+	}
+
+	kbuf = memdup_user(buf, count);
+	if (IS_ERR(kbuf))
+		return PTR_ERR(kbuf);
+
+	audpkt_hdr = (struct gpr_hdr *) kbuf;
+	if (audpkt_hdr->opcode == APM_CMD_SHARED_MEM_MAP_REGIONS) {
+		ret = audpkt_chk_and_update_physical_addr((struct audio_gpr_pkt *) audpkt_hdr);
+		if (ret < 0) {
+			AUDIO_PKT_ERR("Update Physical Address Failed -%d\n", ret);
+			return ret;
+		}
+	}
+
+	if (mutex_lock_interruptible(&audpkt_dev->lock)) {
+		ret = -ERESTARTSYS;
+		goto free_kbuf;
+	}
+	ret = gpr_send_pkt(audpkt_dev->adev, (struct gpr_pkt *) kbuf);
+	if (ret < 0) {
+		AUDIO_PKT_ERR("APR Send Packet Failed ret -%d\n", ret);
+		return ret;
+	}
+	mutex_unlock(&audpkt_dev->lock);
+
+free_kbuf:
+	kfree(kbuf);
+	return ret < 0 ? ret : count;
+}
+
+/**
+ * audio_pkt_poll() - poll() syscall for the audio_pkt device
+ * file:	Pointer to the file structure.
+ * wait:	pointer to Poll table.
+ *
+ * This function is used to poll on the audio pkt device when
+ * userspace client do a poll() system call. All input arguments are
+ * validated by the virtual file system before calling this function.
+ */
+static unsigned int audio_pkt_poll(struct file *file, poll_table *wait)
+{
+	struct audio_pkt_device *audpkt_dev = file->private_data;
+	unsigned int mask = 0;
+	unsigned long flags;
+
+	audpkt_dev = file->private_data;
+	if (!audpkt_dev) {
+		AUDIO_PKT_ERR("invalid device handle\n");
+		return POLLERR;
+	}
+
+	poll_wait(file, &audpkt_dev->readq, wait);
+
+	mutex_lock(&audpkt_dev->lock);
+
+	spin_lock_irqsave(&audpkt_dev->queue_lock, flags);
+	if (!skb_queue_empty(&audpkt_dev->queue))
+		mask |= POLLIN | POLLRDNORM;
+
+	spin_unlock_irqrestore(&audpkt_dev->queue_lock, flags);
+
+	mutex_unlock(&audpkt_dev->lock);
+
+	return mask;
+}
+
+static const struct file_operations audio_pkt_fops = {
+	.owner = THIS_MODULE,
+	.open = audio_pkt_open,
+	.release = audio_pkt_release,
+	.read = audio_pkt_read,
+	.write = audio_pkt_write,
+	.poll = audio_pkt_poll,
+};
+
+/**
+ * audio_pkt_srvc_callback() - Callback from gpr driver
+ * adev:	pointer to the gpr device of this audio packet device
+ * data:	APR response data packet
+ *
+ * return:	0 for success, Standard Linux errors
+ */
+static int audio_pkt_srvc_callback(struct gpr_resp_pkt *data, void *priv, int op)
+{
+	gpr_device_t *gdev = priv;
+	struct audio_pkt_device *audpkt_dev = dev_get_drvdata(&gdev->dev);
+	unsigned long flags;
+	struct sk_buff *skb;
+	struct gpr_hdr *hdr = &data->hdr;
+	uint8_t *pkt = NULL;
+	uint16_t hdr_size, pkt_size;
+
+	hdr_size = hdr->hdr_size * 4;
+	pkt_size = hdr->pkt_size;
+
+	pkt = kmalloc(pkt_size, GFP_KERNEL);
+	if (!pkt)
+		return -ENOMEM;
+
+	memcpy(pkt, (uint8_t *)data, hdr_size);
+	memcpy(pkt + hdr_size, (uint8_t *)data->payload, pkt_size - hdr_size);
+
+	skb = alloc_skb(pkt_size, GFP_ATOMIC);
+	if (!skb)
+		return -ENOMEM;
+
+	skb_put_data(skb, (void *)pkt, pkt_size);
+
+	kfree(pkt);
+	spin_lock_irqsave(&audpkt_dev->queue_lock, flags);
+	skb_queue_tail(&audpkt_dev->queue, skb);
+	spin_unlock_irqrestore(&audpkt_dev->queue_lock, flags);
+
+	/* wake up any blocking processes, waiting for new data */
+	wake_up_interruptible(&audpkt_dev->readq);
+	return 0;
+}
+
+/**
+ * audio_pkt_probe() - Probe a AUDIO packet device
+ *
+ * adev:	Pointer to gpr device.
+ *
+ * return:	0 on success, standard Linux error codes on error.
+ *
+ * This function is called when the underlying device tree driver registers
+ * a gpr device, mapped to a Audio packet device.
+ */
+static int audio_pkt_probe(gpr_device_t *adev)
+{
+	struct audio_pkt_device *audpkt_dev;
+	struct device *dev = &adev->dev;
+	int ret;
+
+	if (audio_pkt_probed) {
+		AUDIO_PKT_ERR("audio packet probe already done, ssr unsupported\n");
+		return -EINVAL;
+	}
+
+	audpkt_dev = devm_kzalloc(dev, sizeof(*audpkt_dev), GFP_KERNEL);
+	if (!audpkt_dev)
+		return -ENOMEM;
+
+	ret = alloc_chrdev_region(&audpkt_dev->audio_pkt_major, 0,
+				  MINOR_NUMBER_COUNT, AUDPKT_DRIVER_NAME);
+	if (ret < 0) {
+		AUDIO_PKT_ERR("alloc_chrdev_region failed ret:%d\n", ret);
+		goto err_chrdev;
+	}
+
+	audpkt_dev->audio_pkt_class = class_create(AUDPKT_DRIVER_NAME);
+	if (IS_ERR(audpkt_dev->audio_pkt_class)) {
+		ret = PTR_ERR(audpkt_dev->audio_pkt_class);
+		AUDIO_PKT_ERR("class_create failed ret:%ld\n",
+			      PTR_ERR(audpkt_dev->audio_pkt_class));
+		goto err_class;
+	}
+
+	audpkt_dev->dev = device_create(audpkt_dev->audio_pkt_class, NULL,
+					audpkt_dev->audio_pkt_major, NULL,
+					AUDPKT_DRIVER_NAME);
+	if (IS_ERR(audpkt_dev->dev)) {
+		ret = PTR_ERR(audpkt_dev->dev);
+		AUDIO_PKT_ERR("device_create failed ret:%ld\n",
+			      PTR_ERR(audpkt_dev->dev));
+		goto err_device;
+	}
+	strscpy(audpkt_dev->dev_name, CHANNEL_NAME, 20);
+	strscpy(audpkt_dev->ch_name, CHANNEL_NAME, 20);
+	dev_set_name(audpkt_dev->dev, audpkt_dev->dev_name);
+
+	mutex_init(&audpkt_dev->lock);
+
+	spin_lock_init(&audpkt_dev->queue_lock);
+	skb_queue_head_init(&audpkt_dev->queue);
+	init_waitqueue_head(&audpkt_dev->readq);
+
+	audpkt_dev->adev = adev;
+	dev_set_drvdata(dev, audpkt_dev);
+
+	cdev_init(&audpkt_dev->cdev, &audio_pkt_fops);
+	audpkt_dev->cdev.owner = THIS_MODULE;
+
+	ret = cdev_add(&audpkt_dev->cdev, audpkt_dev->audio_pkt_major,
+		       MINOR_NUMBER_COUNT);
+	if (ret) {
+		AUDIO_PKT_ERR("cdev_add failed for %s ret:%d\n",
+			      audpkt_dev->dev_name, ret);
+		goto free_dev;
+	}
+
+	AUDIO_PKT_INFO("Audio Packet Port Driver Initialized\n");
+	audio_pkt_probed = true;
+	return of_platform_populate(dev->of_node, NULL, NULL, dev);
+
+free_dev:
+	put_device(dev);
+	device_destroy(audpkt_dev->audio_pkt_class, audpkt_dev->audio_pkt_major);
+err_device:
+	class_destroy(audpkt_dev->audio_pkt_class);
+err_class:
+	unregister_chrdev_region(MAJOR(audpkt_dev->audio_pkt_major),
+				 MINOR_NUMBER_COUNT);
+err_chrdev:
+	return ret;
+
+}
+
+/**
+ * audio_pkt_remove() - Remove a AUDIO packet device
+ *
+ * adev:	Pointer to gpr device.
+ *
+ * return:	0 on success, standard Linux error codes on error.
+ *
+ * This function is called when the underlying device tree driver
+ * removeds a gpr device, mapped to a Audio packet device.
+ */
+static void audio_pkt_remove(gpr_device_t *adev)
+{
+	of_platform_depopulate(&adev->dev);
+	AUDIO_PKT_INFO("Audio Packet Port Driver Removed\n");
+}
+
+static const struct of_device_id audio_pkt_match_table[] = {
+	{ .compatible = "qcom,audio-pkt" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, audio_pkt_match_table);
+
+static gpr_driver_t audio_pkt_driver = {
+	.probe = audio_pkt_probe,
+	.remove = audio_pkt_remove,
+	.gpr_callback = audio_pkt_srvc_callback,
+	.driver = {
+		.name = MODULE_NAME,
+		.of_match_table = of_match_ptr(audio_pkt_match_table),
+	 },
+};
+
+module_gpr_driver(audio_pkt_driver);
+MODULE_DESCRIPTION("MSM Audio Packet Driver");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/audioreach.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/audioreach.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2020, Linaro Limited
+// Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
@@ -555,11 +556,13 @@
 {
 
 	struct gpr_hdr *hdr = &pkt->hdr;
-	int rc;
+	int rc, wait_time = 2;
 
 	mutex_lock(cmd_lock);
 	result->opcode = 0;
 	result->status = 0;
+	if (hdr->opcode == APM_CMD_CLOSE_ALL)
+		wait_time = 20;
 
 	if (port)
 		rc = gpr_send_port_pkt(port, pkt);
@@ -573,9 +576,9 @@
 
 	if (rsp_opcode)
 		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode) ||
-					(result->opcode == rsp_opcode),	5 * HZ);
+					(result->opcode == rsp_opcode), wait_time * HZ);
 	else
-		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode), 5 * HZ);
+		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode), wait_time * HZ);
 
 	if (!rc) {
 		dev_err(dev, "CMD timeout for [%x] opcode\n", hdr->opcode);
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/msm_audio_mem.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/msm_audio_mem.c
@@ -0,0 +1,923 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-buf.h>
+#include <linux/dma-heap.h>
+#include <linux/export.h>
+#include <linux/fs.h>
+#include <linux/device.h>
+
+#include "msm_audio_mem.h"
+
+#include <linux/iosys-map.h>
+#include <linux/of_device.h>
+#include <linux/of_reserved_mem.h>
+#include <linux/ioctl.h>
+#include <linux/platform_device.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <soc/qcom/secure_buffer.h>
+#include "msm_audio_mem.h"
+
+MODULE_IMPORT_NS(DMA_BUF);
+
+#define MSM_AUDIO_MEM_PROBED (1 << 0)
+
+#define MSM_AUDIO_MEM_PHYS_ADDR(alloc_data) \
+	alloc_data->table->sgl->dma_address
+
+#define MSM_AUDIO_SMMU_SID_OFFSET 32
+#define MSM_AUDIO_MEM_DRIVER_NAME "msm_audio_mem"
+#define MINOR_NUMBER_COUNT 1
+struct msm_audio_mem_private {
+	bool smmu_enabled;
+	struct device *cb_dev;
+	u8 device_status;
+	struct list_head alloc_list;
+	struct mutex list_mutex;
+	u64 smmu_sid_bits;
+	char *driver_name;
+	/*char dev related data */
+	dev_t mem_major;
+	struct class *mem_class;
+	struct device *chardev;
+	struct cdev cdev;
+};
+
+struct msm_audio_alloc_data {
+	size_t len;
+	struct iosys_map *vmap;
+	struct dma_buf *dma_buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *table;
+	struct list_head list;
+};
+
+struct msm_audio_mem_fd_list_private {
+	struct mutex list_mutex;
+	/*list to store fd, phy. addr and handle data */
+	struct list_head fd_list;
+};
+
+static struct msm_audio_mem_fd_list_private msm_audio_mem_fd_list = {0,};
+static bool msm_audio_mem_fd_list_init;
+
+struct msm_audio_fd_data {
+	int fd;
+	size_t plen;
+	void *handle;
+	dma_addr_t paddr;
+	struct device *dev;
+	struct list_head list;
+	bool hyp_assign;
+};
+
+static void msm_audio_mem_add_allocation(
+	struct msm_audio_mem_private *msm_audio_mem_data,
+	struct msm_audio_alloc_data *alloc_data)
+{
+	/*
+	 * Since these APIs can be invoked by multiple
+	 * clients, there is need to make sure the list
+	 * of allocations is always protected
+	 */
+	mutex_lock(&(msm_audio_mem_data->list_mutex));
+	list_add_tail(&(alloc_data->list),
+		      &(msm_audio_mem_data->alloc_list));
+	mutex_unlock(&(msm_audio_mem_data->list_mutex));
+}
+
+static int msm_audio_mem_map_kernel(struct dma_buf *dma_buf,
+	struct msm_audio_mem_private *mem_data, struct iosys_map *iosys_vmap)
+{
+	int rc = 0;
+	struct msm_audio_alloc_data *alloc_data = NULL;
+
+	rc = dma_buf_begin_cpu_access(dma_buf, DMA_BIDIRECTIONAL);
+	if (rc) {
+		pr_err("%s: kmap dma_buf_begin_cpu_access fail\n", __func__);
+		goto exit;
+	}
+
+	rc = dma_buf_vmap(dma_buf, iosys_vmap);
+	if (rc) {
+		pr_err("%s: kernel mapping of dma_buf failed\n",
+		       __func__);
+		goto exit;
+	}
+
+	/*
+	 * TBD: remove the below section once new API
+	 * for mapping kernel virtual address is available.
+	 */
+	mutex_lock(&(mem_data->list_mutex));
+	list_for_each_entry(alloc_data, &(mem_data->alloc_list),
+			    list) {
+		if (alloc_data->dma_buf == dma_buf) {
+			alloc_data->vmap = iosys_vmap;
+			break;
+		}
+	}
+	mutex_unlock(&(mem_data->list_mutex));
+
+exit:
+	return rc;
+}
+
+static int msm_audio_dma_buf_map(struct dma_buf *dma_buf,
+				 dma_addr_t *addr, size_t *len, bool is_iova,
+				 struct msm_audio_mem_private *mem_data)
+{
+
+	struct msm_audio_alloc_data *alloc_data = NULL;
+	int rc = 0;
+	struct iosys_map *iosys_vmap = NULL;
+	struct device *cb_dev = mem_data->cb_dev;
+
+	iosys_vmap = kzalloc(sizeof(*iosys_vmap), GFP_KERNEL);
+	if (!iosys_vmap)
+		return -ENOMEM;
+	/* Data required per buffer mapping */
+	alloc_data = kzalloc(sizeof(*alloc_data), GFP_KERNEL);
+	if (!alloc_data) {
+		kfree(iosys_vmap);
+		return -ENOMEM;
+	}
+	alloc_data->dma_buf = dma_buf;
+	alloc_data->len = dma_buf->size;
+	*len = dma_buf->size;
+
+	/* Attach the dma_buf to context bank device */
+	alloc_data->attach = dma_buf_attach(alloc_data->dma_buf,
+					    cb_dev);
+	if (IS_ERR(alloc_data->attach)) {
+		rc = PTR_ERR(alloc_data->attach);
+		dev_err(cb_dev,
+			"%s: Fail to attach dma_buf to CB, rc = %d\n",
+			__func__, rc);
+		goto free_alloc_data;
+	}
+
+	/*
+	 * Get the scatter-gather list.
+	 * There is no info as this is a write buffer or
+	 * read buffer, hence the request is bi-directional
+	 * to accommodate both read and write mappings.
+	 */
+	alloc_data->table = dma_buf_map_attachment(alloc_data->attach,
+				DMA_BIDIRECTIONAL);
+	if (IS_ERR(alloc_data->table)) {
+		rc = PTR_ERR(alloc_data->table);
+		dev_err(cb_dev,
+			"%s: Fail to map attachment, rc = %d\n",
+			__func__, rc);
+		goto detach_dma_buf;
+	}
+
+	/* physical address from mapping */
+	if (!is_iova) {
+		*addr = sg_phys(alloc_data->table->sgl);
+		rc = msm_audio_mem_map_kernel((void *)dma_buf, mem_data, iosys_vmap);
+		if (rc) {
+			pr_err("%s: MEM memory mapping for AUDIO failed, err:%d\n",
+				__func__, rc);
+			rc = -ENOMEM;
+			goto detach_dma_buf;
+		}
+		alloc_data->vmap = iosys_vmap;
+	} else {
+		*addr = MSM_AUDIO_MEM_PHYS_ADDR(alloc_data);
+	}
+
+	msm_audio_mem_add_allocation(mem_data, alloc_data);
+	return rc;
+
+detach_dma_buf:
+	dma_buf_detach(alloc_data->dma_buf,
+		       alloc_data->attach);
+free_alloc_data:
+	kfree(iosys_vmap);
+	kfree(alloc_data);
+	alloc_data = NULL;
+
+	return rc;
+}
+
+static int msm_audio_dma_buf_unmap(struct dma_buf *dma_buf, struct msm_audio_mem_private *mem_data)
+{
+	int rc = 0;
+	struct msm_audio_alloc_data *alloc_data = NULL;
+	struct list_head *ptr, *next;
+	bool found = false;
+	struct device *cb_dev = mem_data->cb_dev;
+
+	/*
+	 * Though list_for_each_safe is delete safe, lock
+	 * should be explicitly acquired to avoid race condition
+	 * on adding elements to the list.
+	 */
+	mutex_lock(&(mem_data->list_mutex));
+	list_for_each_safe(ptr, next,
+			    &(mem_data->alloc_list)) {
+
+		alloc_data = list_entry(ptr, struct msm_audio_alloc_data,
+					list);
+
+		if (alloc_data->dma_buf == dma_buf) {
+			found = true;
+			dma_buf_unmap_attachment(alloc_data->attach,
+						 alloc_data->table,
+						 DMA_BIDIRECTIONAL);
+
+			dma_buf_detach(alloc_data->dma_buf,
+				       alloc_data->attach);
+
+			dma_buf_put(alloc_data->dma_buf);
+
+			list_del(&(alloc_data->list));
+			kfree(alloc_data->vmap);
+			kfree(alloc_data);
+			alloc_data = NULL;
+			break;
+		}
+	}
+	mutex_unlock(&(mem_data->list_mutex));
+
+	if (!found) {
+		dev_err(cb_dev,
+			"%s: cannot find allocation, dma_buf %pK\n",
+			__func__, dma_buf);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int msm_audio_mem_get_phys(struct dma_buf *dma_buf,
+				  dma_addr_t *addr, size_t *len, bool is_iova,
+				  struct msm_audio_mem_private *mem_data)
+{
+	int rc = 0;
+
+	rc = msm_audio_dma_buf_map(dma_buf, addr, len, is_iova, mem_data);
+	if (rc) {
+		pr_err("%s: failed to map DMA buf, err = %d\n",
+			__func__, rc);
+		goto err;
+	}
+	if (mem_data->smmu_enabled && is_iova) {
+		/* Append the SMMU SID information to the IOVA address */
+		*addr |= mem_data->smmu_sid_bits;
+	}
+
+	pr_debug("phys=%pK, len=%zd, rc=%d\n", &(*addr), *len, rc);
+err:
+	return rc;
+}
+
+static int msm_audio_mem_unmap_kernel(struct dma_buf *dma_buf,
+		struct msm_audio_mem_private *mem_data)
+{
+	int rc = 0;
+	struct iosys_map *iosys_vmap = NULL;
+	struct msm_audio_alloc_data *alloc_data = NULL;
+	struct device *cb_dev = mem_data->cb_dev;
+
+	/*
+	 * TBD: remove the below section once new API
+	 * for unmapping kernel virtual address is available.
+	 */
+	mutex_lock(&(mem_data->list_mutex));
+	list_for_each_entry(alloc_data, &(mem_data->alloc_list),
+			    list) {
+		if (alloc_data->dma_buf == dma_buf) {
+			iosys_vmap = alloc_data->vmap;
+			break;
+		}
+	}
+	mutex_unlock(&(mem_data->list_mutex));
+
+	if (!iosys_vmap) {
+		dev_err(cb_dev,
+			"%s: cannot find allocation for dma_buf %pK\n",
+			__func__, dma_buf);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	dma_buf_vunmap(dma_buf, iosys_vmap);
+
+	rc = dma_buf_end_cpu_access(dma_buf, DMA_BIDIRECTIONAL);
+	if (rc) {
+		dev_err(cb_dev, "%s: kmap dma_buf_end_cpu_access fail\n",
+			__func__);
+		goto err;
+	}
+
+err:
+	return rc;
+}
+
+static int msm_audio_mem_map_buf(struct dma_buf *dma_buf, dma_addr_t *paddr,
+				 size_t *plen, struct iosys_map *iosys_vmap,
+				 struct msm_audio_mem_private *mem_data)
+{
+	int rc = 0;
+	bool is_iova = true;
+
+	if (!dma_buf || !paddr || !plen) {
+		pr_err("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	rc = msm_audio_mem_get_phys(dma_buf, paddr, plen, is_iova, mem_data);
+	if (rc) {
+		pr_err("%s: MEM Get Physical for AUDIO failed, rc = %d\n",
+				__func__, rc);
+		dma_buf_put(dma_buf);
+		goto err;
+	}
+
+	rc = msm_audio_mem_map_kernel(dma_buf, mem_data, iosys_vmap);
+	if (rc) {
+		pr_err("%s: MEM memory mapping for AUDIO failed, err:%d\n",
+			__func__, rc);
+		rc = -ENOMEM;
+		msm_audio_dma_buf_unmap(dma_buf, mem_data);
+		goto err;
+	}
+
+err:
+	return rc;
+}
+
+void msm_audio_fd_list_debug(void)
+{
+	struct msm_audio_fd_data *msm_audio_fd_data = NULL;
+
+	list_for_each_entry(msm_audio_fd_data,
+			&msm_audio_mem_fd_list.fd_list, list) {
+		pr_debug("%s fd %d handle %pK phy. addr %pK\n", __func__,
+			msm_audio_fd_data->fd, msm_audio_fd_data->handle,
+			(void *)msm_audio_fd_data->paddr);
+	}
+}
+
+void msm_audio_update_fd_list(struct msm_audio_fd_data *msm_audio_fd_data)
+{
+	struct msm_audio_fd_data *msm_audio_fd_data1 = NULL;
+
+	mutex_lock(&(msm_audio_mem_fd_list.list_mutex));
+	list_for_each_entry(msm_audio_fd_data1,
+			&msm_audio_mem_fd_list.fd_list, list) {
+		if (msm_audio_fd_data1->fd == msm_audio_fd_data->fd) {
+			pr_err("%s fd already present, not updating the list\n",
+				__func__);
+			mutex_unlock(&(msm_audio_mem_fd_list.list_mutex));
+			return;
+		}
+	}
+	list_add_tail(&msm_audio_fd_data->list, &msm_audio_mem_fd_list.fd_list);
+	mutex_unlock(&(msm_audio_mem_fd_list.list_mutex));
+}
+
+void msm_audio_delete_fd_entry(void *handle)
+{
+	struct msm_audio_fd_data *msm_audio_fd_data = NULL;
+	struct list_head *ptr, *next;
+
+	mutex_lock(&(msm_audio_mem_fd_list.list_mutex));
+	list_for_each_safe(ptr, next,
+			&msm_audio_mem_fd_list.fd_list) {
+		msm_audio_fd_data = list_entry(ptr, struct msm_audio_fd_data,
+					list);
+		if (msm_audio_fd_data->handle == handle) {
+			pr_debug("%s deleting handle %pK entry from list\n",
+				__func__, handle);
+			list_del(&(msm_audio_fd_data->list));
+			kfree(msm_audio_fd_data);
+			break;
+		}
+	}
+	mutex_unlock(&(msm_audio_mem_fd_list.list_mutex));
+}
+
+int msm_audio_get_phy_addr(int fd, dma_addr_t *paddr, size_t *pa_len)
+{
+	struct msm_audio_fd_data *msm_audio_fd_data = NULL;
+	int status = -EINVAL;
+
+	if (!paddr) {
+		pr_err("%s Invalid paddr param status %d\n", __func__, status);
+		return status;
+	}
+	pr_debug("%s, fd %d\n", __func__, fd);
+	mutex_lock(&(msm_audio_mem_fd_list.list_mutex));
+	list_for_each_entry(msm_audio_fd_data,
+			&msm_audio_mem_fd_list.fd_list, list) {
+		if (msm_audio_fd_data->fd == fd) {
+			*paddr = msm_audio_fd_data->paddr;
+			*pa_len = msm_audio_fd_data->plen;
+			status = 0;
+			pr_debug("%s Found fd %d paddr %pK\n",
+				__func__, fd, paddr);
+			mutex_unlock(&(msm_audio_mem_fd_list.list_mutex));
+			return status;
+		}
+	}
+	mutex_unlock(&(msm_audio_mem_fd_list.list_mutex));
+	return status;
+}
+EXPORT_SYMBOL_GPL(msm_audio_get_phy_addr);
+
+int msm_audio_set_hyp_assign(int fd, bool assign)
+{
+	struct msm_audio_fd_data *msm_audio_fd_data = NULL;
+	int status = -EINVAL;
+
+	mutex_lock(&(msm_audio_mem_fd_list.list_mutex));
+	list_for_each_entry(msm_audio_fd_data,
+			&msm_audio_mem_fd_list.fd_list, list) {
+		if (msm_audio_fd_data->fd == fd) {
+			status = 0;
+			pr_debug("%s Found fd %d\n", __func__, fd);
+			msm_audio_fd_data->hyp_assign = assign;
+			mutex_unlock(&(msm_audio_mem_fd_list.list_mutex));
+			return status;
+		}
+	}
+	mutex_unlock(&(msm_audio_mem_fd_list.list_mutex));
+	return status;
+}
+
+void msm_audio_get_handle(int fd, void **handle)
+{
+	struct msm_audio_fd_data *msm_audio_fd_data = NULL;
+
+	pr_debug("%s fd %d\n", __func__, fd);
+	mutex_lock(&(msm_audio_mem_fd_list.list_mutex));
+	list_for_each_entry(msm_audio_fd_data,
+			&msm_audio_mem_fd_list.fd_list, list) {
+		if (msm_audio_fd_data->fd == fd) {
+			*handle = (struct dma_buf *)msm_audio_fd_data->handle;
+			pr_debug("%s handle %pK\n", __func__, *handle);
+			break;
+		}
+	}
+	mutex_unlock(&(msm_audio_mem_fd_list.list_mutex));
+}
+
+/**
+ * msm_audio_mem_import-
+ *        Import MEM buffer with given file descriptor
+ *
+ * @dma_buf: dma_buf for the MEM memory
+ * @fd: file descriptor for the MEM memory
+ * @bufsz: buffer size
+ * @paddr: Physical address to be assigned with allocated region
+ * @plen: length of allocated region to be assigned
+ * @iosys_vmap: Virtual mapping vmap pointer to be assigned
+ *
+ * Returns 0 on success or error on failure
+ */
+static int msm_audio_mem_import(struct dma_buf **dma_buf, int fd,
+			size_t bufsz, dma_addr_t *paddr,
+			size_t *plen, struct iosys_map *iosys_vmap,
+			struct msm_audio_mem_private *mem_data)
+{
+	int rc = 0;
+
+	if (!(mem_data->device_status & MSM_AUDIO_MEM_PROBED)) {
+		pr_debug("%s: probe is not done, deferred\n", __func__);
+		return -EPROBE_DEFER;
+	}
+
+	if (!dma_buf || !paddr || !plen) {
+		pr_err("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	/* bufsz should be 0 and fd shouldn't be 0 as of now */
+	*dma_buf = dma_buf_get(fd);
+	pr_debug("%s: dma_buf =%pK, fd=%d\n", __func__, *dma_buf, fd);
+	if (IS_ERR_OR_NULL((void *)(*dma_buf))) {
+		pr_err("%s: dma_buf_get failed\n", __func__);
+		return -EINVAL;
+	}
+
+	if (mem_data->smmu_enabled) {
+		rc = msm_audio_mem_map_buf(*dma_buf, paddr, plen, iosys_vmap, mem_data);
+		if (rc) {
+			pr_err("%s: failed to map MEM buf, rc = %d\n", __func__, rc);
+			goto err;
+		}
+		pr_debug("%s: mapped address = %pK, size=%zd\n", __func__,
+				iosys_vmap->vaddr, bufsz);
+	} else {
+		msm_audio_dma_buf_map(*dma_buf, paddr, plen, true, mem_data);
+	}
+	return 0;
+err:
+	dma_buf_put(*dma_buf);
+	*dma_buf = NULL;
+	return rc;
+}
+
+/**
+ * msm_audio_mem_free -
+ *        fress MEM memory for given client and handle
+ *
+ * @dma_buf: dma_buf for the MEM memory
+ *
+ * Returns 0 on success or error on failure
+ */
+static int msm_audio_mem_free(struct dma_buf *dma_buf, struct msm_audio_mem_private *mem_data)
+{
+	int ret = 0;
+
+	if (!dma_buf) {
+		pr_err("%s: dma_buf invalid\n", __func__);
+		return -EINVAL;
+	}
+
+	if (mem_data->smmu_enabled) {
+		ret = msm_audio_mem_unmap_kernel(dma_buf, mem_data);
+		if (ret)
+			return ret;
+	}
+
+	msm_audio_dma_buf_unmap(dma_buf, mem_data);
+
+	return 0;
+}
+
+static int msm_audio_hyp_unassign(struct msm_audio_fd_data *msm_audio_fd_data)
+{
+	int ret = 0;
+	u64 src_vmid_unmap_list = BIT(VMID_LPASS) | BIT(VMID_ADSP_HEAP);
+	struct qcom_scm_vmperm dst_vmids_unmap[] = {{QCOM_SCM_VMID_HLOS,
+		PERM_READ | PERM_WRITE | PERM_EXEC}};
+
+	if (msm_audio_fd_data->hyp_assign) {
+		ret = qcom_scm_assign_mem(msm_audio_fd_data->paddr, msm_audio_fd_data->plen,
+				&src_vmid_unmap_list, dst_vmids_unmap, ARRAY_SIZE(dst_vmids_unmap));
+		if (ret < 0) {
+			pr_err("%s: qcom assign unmap failed result = %d addr = 0x%llx size = %zu\n",
+				__func__, ret, msm_audio_fd_data->paddr, msm_audio_fd_data->plen);
+		}
+		msm_audio_fd_data->hyp_assign = false;
+		pr_debug("%s: qcom scm unmap success\n", __func__);
+	}
+	return ret;
+}
+
+/**
+ * msm_audio_mem_crash_handler -
+ *        handles cleanup after userspace crashes.
+ *
+ * To be called from machine driver.
+ */
+void msm_audio_mem_crash_handler(void)
+{
+	struct msm_audio_fd_data *msm_audio_fd_data = NULL;
+	struct list_head *ptr, *next;
+	void *handle = NULL;
+	struct msm_audio_mem_private *mem_data = NULL;
+
+	mutex_lock(&(msm_audio_mem_fd_list.list_mutex));
+	list_for_each_entry(msm_audio_fd_data,
+		&msm_audio_mem_fd_list.fd_list, list) {
+		handle = msm_audio_fd_data->handle;
+		mem_data = dev_get_drvdata(msm_audio_fd_data->dev);
+		/*  clean if CMA was used*/
+		if (msm_audio_fd_data->hyp_assign)
+			msm_audio_hyp_unassign(msm_audio_fd_data);
+		if (handle)
+			msm_audio_mem_free(handle, mem_data);
+	}
+	list_for_each_safe(ptr, next,
+		&msm_audio_mem_fd_list.fd_list) {
+		msm_audio_fd_data = list_entry(ptr, struct msm_audio_fd_data,
+						list);
+		list_del(&(msm_audio_fd_data->list));
+		kfree(msm_audio_fd_data);
+	}
+	mutex_unlock(&(msm_audio_mem_fd_list.list_mutex));
+}
+EXPORT_SYMBOL_GPL(msm_audio_mem_crash_handler);
+
+static int msm_audio_mem_open(struct inode *inode, struct file *file)
+{
+	struct msm_audio_mem_private *mem_data = container_of(inode->i_cdev,
+						struct msm_audio_mem_private,
+						cdev);
+	struct device *dev = mem_data->chardev;
+
+	get_device(dev);
+	return 0;
+}
+
+static int msm_audio_mem_release(struct inode *inode, struct file *file)
+{
+	struct msm_audio_mem_private *mem_data = container_of(inode->i_cdev,
+						struct msm_audio_mem_private,
+						cdev);
+	struct device *dev = mem_data->chardev;
+
+	put_device(dev);
+	return 0;
+}
+
+static long msm_audio_mem_ioctl(struct file *file, unsigned int ioctl_num,
+				unsigned long __user ioctl_param)
+{
+	void *mem_handle;
+	dma_addr_t paddr;
+	size_t pa_len = 0;
+	struct iosys_map *iosys_vmap = NULL;
+	int ret = 0;
+	struct msm_audio_fd_data *msm_audio_fd_data = NULL;
+	struct msm_audio_mem_private *mem_data =
+			container_of(file->f_inode->i_cdev, struct msm_audio_mem_private, cdev);
+	u64 src_vmid_map_list = BIT(QCOM_SCM_VMID_HLOS);
+	struct qcom_scm_vmperm dst_vmids_map[] = {{VMID_LPASS, PERM_READ | PERM_WRITE},
+						{VMID_ADSP_HEAP, PERM_READ | PERM_WRITE}};
+	u64 src_vmid_unmap_list = BIT(VMID_LPASS) | BIT(VMID_ADSP_HEAP);
+	struct qcom_scm_vmperm dst_vmids_unmap[] = {{QCOM_SCM_VMID_HLOS,
+					PERM_READ | PERM_WRITE | PERM_EXEC}};
+
+	switch (ioctl_num) {
+	case IOCTL_MAP_PHYS_ADDR:
+		iosys_vmap = kzalloc(sizeof(struct msm_audio_fd_data), GFP_KERNEL);
+		if (!iosys_vmap)
+			return -ENOMEM;
+		msm_audio_fd_data = kzalloc((sizeof(struct msm_audio_fd_data)),
+					GFP_KERNEL);
+		if (!msm_audio_fd_data) {
+			kfree(iosys_vmap);
+			return -ENOMEM;
+		}
+		ret = msm_audio_mem_import((struct dma_buf **)&mem_handle, (int)ioctl_param,
+					0, &paddr, &pa_len, iosys_vmap, mem_data);
+		if (ret < 0) {
+			pr_err("%s Memory map Failed %d\n", __func__, ret);
+			kfree(iosys_vmap);
+			kfree(msm_audio_fd_data);
+			return ret;
+		}
+		msm_audio_fd_data->fd = (int)ioctl_param;
+		msm_audio_fd_data->handle = mem_handle;
+		msm_audio_fd_data->paddr = paddr;
+		msm_audio_fd_data->plen = pa_len;
+		msm_audio_fd_data->dev = mem_data->cb_dev;
+		msm_audio_update_fd_list(msm_audio_fd_data);
+		break;
+	case IOCTL_UNMAP_PHYS_ADDR:
+		msm_audio_get_handle((int)ioctl_param, &mem_handle);
+		ret = msm_audio_mem_free(mem_handle, mem_data);
+		if (ret < 0) {
+			pr_err("%s Ion free failed %d\n", __func__, ret);
+			return ret;
+		}
+		msm_audio_delete_fd_entry(mem_handle);
+		break;
+	case IOCTL_MAP_HYP_ASSIGN:
+		ret = msm_audio_get_phy_addr((int)ioctl_param, &paddr, &pa_len);
+		if (ret < 0) {
+			pr_err("%s get phys addr failed %d\n", __func__, ret);
+			return ret;
+		}
+		ret = qcom_scm_assign_mem(paddr, pa_len, &src_vmid_map_list,
+			dst_vmids_map, ARRAY_SIZE(dst_vmids_map));
+		if (ret < 0) {
+			pr_err("%s: qcom_assign failed result = %d addr = 0x%llx size = %lu\n",
+					__func__, ret, paddr, pa_len);
+			return ret;
+		}
+		pr_debug("%s: qcom scm assign success\n", __func__);
+		msm_audio_set_hyp_assign((int)ioctl_param, true);
+		break;
+	case IOCTL_UNMAP_HYP_ASSIGN:
+		ret = msm_audio_get_phy_addr((int)ioctl_param, &paddr, &pa_len);
+		if (ret < 0) {
+			pr_err("%s get phys addr failed %d\n", __func__, ret);
+			return ret;
+		}
+		ret = qcom_scm_assign_mem(paddr, pa_len, &src_vmid_unmap_list,
+			dst_vmids_unmap, ARRAY_SIZE(dst_vmids_unmap));
+		if (ret < 0) {
+			pr_err("%s: qcom scm unassign failed result = %d addr = 0x%llx size = %lu\n",
+					__func__, ret, paddr, pa_len);
+			return ret;
+		}
+		pr_debug("%s: qcom scm unassign success\n", __func__);
+		msm_audio_set_hyp_assign((int)ioctl_param, false);
+		break;
+	default:
+		pr_err_ratelimited("%s Entered default. Invalid ioctl num %u\n",
+				   __func__, ioctl_num);
+		ret = -EINVAL;
+		break;
+	}
+	return ret;
+}
+
+static const struct of_device_id msm_audio_mem_dt_match[] = {
+	{ .compatible = "qcom,msm-audio-mem" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, msm_audio_mem_dt_match);
+
+static const struct file_operations msm_audio_mem_fops = {
+	.owner = THIS_MODULE,
+	.open = msm_audio_mem_open,
+	.release = msm_audio_mem_release,
+	.unlocked_ioctl = msm_audio_mem_ioctl,
+};
+
+static int msm_audio_mem_reg_chrdev(struct msm_audio_mem_private *mem_data)
+{
+	int ret = 0;
+
+	ret = alloc_chrdev_region(&mem_data->mem_major, 0,
+				MINOR_NUMBER_COUNT, mem_data->driver_name);
+	if (ret < 0) {
+		pr_err("%s alloc_chr_dev_region failed ret : %d\n",
+			__func__, ret);
+		return ret;
+	}
+	pr_debug("%s major number %d\n", __func__, MAJOR(mem_data->mem_major));
+	mem_data->mem_class = class_create(mem_data->driver_name);
+	if (IS_ERR(mem_data->mem_class)) {
+		ret = PTR_ERR(mem_data->mem_class);
+		pr_err("%s class create failed. ret : %d\n", __func__, ret);
+		goto err_class;
+	}
+	mem_data->chardev = device_create(mem_data->mem_class, NULL,
+				mem_data->mem_major, NULL,
+				mem_data->driver_name);
+	if (IS_ERR(mem_data->chardev)) {
+		ret = PTR_ERR(mem_data->chardev);
+		pr_err("%s device create failed ret : %d\n", __func__, ret);
+		goto err_device;
+	}
+	cdev_init(&mem_data->cdev, &msm_audio_mem_fops);
+	ret = cdev_add(&mem_data->cdev, mem_data->mem_major, 1);
+	if (ret) {
+		pr_err("%s cdev add failed, ret : %d\n", __func__, ret);
+		goto err_cdev;
+	}
+	return ret;
+
+err_cdev:
+	device_destroy(mem_data->mem_class, mem_data->mem_major);
+err_device:
+	class_destroy(mem_data->mem_class);
+err_class:
+	unregister_chrdev_region(0, MINOR_NUMBER_COUNT);
+	return ret;
+}
+
+static int msm_audio_mem_unreg_chrdev(struct msm_audio_mem_private *mem_data)
+{
+	cdev_del(&mem_data->cdev);
+	device_destroy(mem_data->mem_class, mem_data->mem_major);
+	class_destroy(mem_data->mem_class);
+	unregister_chrdev_region(0, MINOR_NUMBER_COUNT);
+	return 0;
+}
+static int msm_audio_mem_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+	u64 smmu_sid = 0;
+	u64 smmu_sid_mask = 0;
+	const char *msm_audio_mem_dt = "qcom,smmu-enabled";
+	const char *msm_audio_mem_smmu_sid_mask = "qcom,smmu-sid-mask";
+	bool smmu_enabled;
+	struct device *dev = &pdev->dev;
+	struct of_phandle_args iommuspec;
+	struct msm_audio_mem_private *msm_audio_mem_data = NULL;
+
+	if (dev->of_node == NULL) {
+		dev_err(dev,
+			"%s: device tree is not found\n",
+			__func__);
+		return 0;
+	}
+
+	msm_audio_mem_data = devm_kzalloc(&pdev->dev, (sizeof(struct msm_audio_mem_private)),
+			GFP_KERNEL);
+	if (!msm_audio_mem_data)
+		return -ENOMEM;
+
+	smmu_enabled = of_property_read_bool(dev->of_node,
+					     msm_audio_mem_dt);
+	msm_audio_mem_data->smmu_enabled = smmu_enabled;
+
+	dev_dbg(dev, "%s: SMMU is %s\n", __func__, (!smmu_enabled) ? "Disabled" : "Enabled");
+
+	if (smmu_enabled) {
+		msm_audio_mem_data->driver_name = "msm_audio_mem";
+		/* Get SMMU SID information from Devicetree */
+		rc = of_property_read_u64(dev->of_node,
+					msm_audio_mem_smmu_sid_mask,
+					&smmu_sid_mask);
+		if (rc) {
+			dev_err(dev,
+				"%s: qcom,smmu-sid-mask missing in DT node, using default\n",
+				__func__);
+			smmu_sid_mask = 0xFFFFFFFFFFFFFFFF;
+		}
+
+		rc = of_parse_phandle_with_args(dev->of_node, "iommus",
+						"#iommu-cells", 0, &iommuspec);
+		if (rc)
+			dev_err(dev, "%s: could not get smmu SID, ret = %d\n",
+				__func__, rc);
+		else
+			smmu_sid = (iommuspec.args[0] & smmu_sid_mask);
+
+		msm_audio_mem_data->smmu_sid_bits =
+			smmu_sid << MSM_AUDIO_SMMU_SID_OFFSET;
+	} else {
+		msm_audio_mem_data->driver_name = "msm_audio_mem_cma";
+
+		rc = of_reserved_mem_device_init(dev);
+		if (rc) {
+			pr_err("%s: No reserved DMA memory, ret=%d\n", __func__, rc);
+			return -EINVAL;
+		}
+
+		rc = cma_heap_add(dev->cma_area, NULL);
+		if (rc) {
+			pr_err("%s: cma_heap_add failed, ret=%d\n", __func__, rc);
+			return -EINVAL;
+		}
+	}
+
+	if (!rc)
+		msm_audio_mem_data->device_status |= MSM_AUDIO_MEM_PROBED;
+
+	msm_audio_mem_data->cb_dev = dev;
+	dev_set_drvdata(dev, msm_audio_mem_data);
+	if (!msm_audio_mem_fd_list_init) {
+		INIT_LIST_HEAD(&msm_audio_mem_fd_list.fd_list);
+		mutex_init(&(msm_audio_mem_fd_list.list_mutex));
+		msm_audio_mem_fd_list_init = true;
+	}
+	INIT_LIST_HEAD(&msm_audio_mem_data->alloc_list);
+	mutex_init(&(msm_audio_mem_data->list_mutex));
+	rc = msm_audio_mem_reg_chrdev(msm_audio_mem_data);
+	if (rc) {
+		pr_err("%s register char dev failed, rc : %d\n", __func__, rc);
+		return rc;
+	}
+	return rc;
+}
+
+static int msm_audio_mem_remove(struct platform_device *pdev)
+{
+	struct msm_audio_mem_private *mem_data = dev_get_drvdata(&pdev->dev);
+
+	mem_data->smmu_enabled = false;
+	mem_data->device_status = 0;
+	msm_audio_mem_unreg_chrdev(mem_data);
+	return 0;
+}
+
+static struct platform_driver msm_audio_mem_driver = {
+	.driver = {
+		.name = "msm-audio-mem",
+		.of_match_table = msm_audio_mem_dt_match,
+		.suppress_bind_attrs = true,
+	},
+	.probe = msm_audio_mem_probe,
+	.remove = msm_audio_mem_remove,
+};
+
+int __init msm_audio_mem_init(void)
+{
+	return platform_driver_register(&msm_audio_mem_driver);
+}
+
+void msm_audio_mem_exit(void)
+{
+	platform_driver_unregister(&msm_audio_mem_driver);
+}
+
+module_init(msm_audio_mem_init);
+module_exit(msm_audio_mem_exit);
+MODULE_DESCRIPTION("MSM Audio MEM module");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/msm_audio_mem.h
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/msm_audio_mem.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_AUDIO_MEM_H
+#define _MSM_AUDIO_MEM_H
+
+#include <linux/dma-mapping.h>
+#include <uapi/sound/qcom/msm_audio.h>
+
+int msm_audio_get_phy_addr(int fd, dma_addr_t *paddr, size_t *pa_len);
+void msm_audio_mem_crash_handler(void);
+#endif /* _LINUX_MSM_AUDIO_MEM_H */
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2021, Linaro Limited
+// Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <dt-bindings/sound/qcom,q6dsp-lpass-ports.h>
 #include <linux/err.h>
@@ -11,10 +12,13 @@
 #include <sound/pcm.h>
 #include <sound/soc.h>
 #include <sound/pcm_params.h>
+#include <linux/clk.h>
 #include "q6dsp-lpass-ports.h"
 #include "q6dsp-common.h"
 #include "audioreach.h"
 #include "q6apm.h"
+#include "q6prm.h"
+#include "q6dsp-lpass-clocks.h"
 
 #define AUDIOREACH_BE_PCM_BASE	16
 
@@ -22,6 +26,7 @@
 	struct q6apm_graph *graph[APM_PORT_MAX];
 	bool is_port_started[APM_PORT_MAX];
 	struct audioreach_module_config module_config[APM_PORT_MAX];
+	struct q6dsp_cc *cc;
 };
 
 static int q6dma_set_channel_map(struct snd_soc_dai *dai,
@@ -141,14 +146,17 @@
 	struct q6apm_lpass_dai_data *dai_data = dev_get_drvdata(dai->dev);
 	int rc;
 
-	if (!dai_data->is_port_started[dai->id])
-		return;
-	rc = q6apm_graph_stop(dai_data->graph[dai->id]);
-	if (rc < 0)
-		dev_err(dai->dev, "fail to close APM port (%d)\n", rc);
+	if (dai_data->is_port_started[dai->id]) {
+		rc = q6apm_graph_stop(dai_data->graph[dai->id]);
+		dai_data->is_port_started[dai->id] = false;
+		if (rc < 0)
+			dev_err(dai->dev, "fail to close APM port (%d)\n", rc);
+	}
 
-	q6apm_graph_close(dai_data->graph[dai->id]);
-	dai_data->is_port_started[dai->id] = false;
+	if (dai_data->graph[dai->id]) {
+		q6apm_graph_close(dai_data->graph[dai->id]);
+		dai_data->graph[dai->id] = NULL;
+	}
 }
 
 static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
@@ -163,8 +171,10 @@
 		q6apm_graph_stop(dai_data->graph[dai->id]);
 		dai_data->is_port_started[dai->id] = false;
 
-		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
 			q6apm_graph_close(dai_data->graph[dai->id]);
+			dai_data->graph[dai->id] = NULL;
+		}
 	}
 
 	/**
@@ -183,26 +193,29 @@
 
 	cfg->direction = substream->stream;
 	rc = q6apm_graph_media_format_pcm(dai_data->graph[dai->id], cfg);
-
 	if (rc) {
 		dev_err(dai->dev, "Failed to set media format %d\n", rc);
-		return rc;
+		goto err;
 	}
 
 	rc = q6apm_graph_prepare(dai_data->graph[dai->id]);
 	if (rc) {
 		dev_err(dai->dev, "Failed to prepare Graph %d\n", rc);
-		return rc;
+		goto err;
 	}
 
 	rc = q6apm_graph_start(dai_data->graph[dai->id]);
 	if (rc < 0) {
 		dev_err(dai->dev, "fail to start APM port %x\n", dai->id);
-		return rc;
+		goto err;
 	}
 	dai_data->is_port_started[dai->id] = true;
 
 	return 0;
+err:
+	q6apm_graph_close(dai_data->graph[dai->id]);
+	dai_data->graph[dai->id] = NULL;
+	return rc;
 }
 
 static int q6apm_lpass_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
@@ -233,6 +246,37 @@
 	return 0;
 }
 
+static const struct snd_pcm_hardware q6apm_dummy_dma_hardware = {
+	.info               = SNDRV_PCM_INFO_INTERLEAVED |
+				SNDRV_PCM_INFO_BLOCK_TRANSFER,
+	.buffer_bytes_max   = 128 * 1024,
+	.period_bytes_min   = PAGE_SIZE,
+	.period_bytes_max   = PAGE_SIZE * 2,
+	.periods_min        = 2,
+	.periods_max        = 128,
+};
+
+static int q6apm_lpass_dai_dummy_startup(struct snd_pcm_substream *substream,
+					 struct snd_soc_dai *dai)
+{
+	snd_soc_set_runtime_hwparams(substream, &q6apm_dummy_dma_hardware);
+	return 0;
+}
+
+static int q6apm_set_sysclk(struct snd_soc_dai *dai, int clk_id,
+							unsigned int freq, int dir)
+{
+	struct q6apm_lpass_dai_data *dai_data = dev_get_drvdata(dai->dev);
+
+	q6prm_set_lpass_clock(dai_data->cc->dev, clk_id,
+			1, Q6DSP_LPASS_CLK_ROOT_DEFAULT, freq);
+	return 0;
+}
+
+static const struct snd_soc_dai_ops q6dummy_ops = {
+	.startup	= q6apm_lpass_dai_dummy_startup,
+};
+
 static const struct snd_soc_dai_ops q6dma_ops = {
 	.prepare	= q6apm_lpass_dai_prepare,
 	.startup	= q6apm_lpass_dai_startup,
@@ -257,6 +301,16 @@
 	.set_fmt	= q6i2s_set_fmt,
 };
 
+static const struct snd_soc_dai_ops q6i2sdummy_ops = {
+	.startup	= q6apm_lpass_dai_dummy_startup,
+	.set_sysclk	= q6apm_set_sysclk,
+};
+
+static const struct snd_soc_dai_ops q6tdmdummy_ops = {
+	.startup	= q6apm_lpass_dai_dummy_startup,
+	.set_sysclk	= q6apm_set_sysclk,
+};
+
 static const struct snd_soc_component_driver q6apm_lpass_dai_component = {
 	.name = "q6apm-be-dai-component",
 	.of_xlate_dai_name = q6dsp_audio_ports_of_xlate_dai_name,
@@ -264,27 +318,66 @@
 	.use_dai_pcm_id = true,
 };
 
+static const struct snd_soc_component_driver q6apm_lpass_dummy_dai_component = {
+	.name = "q6apm-be-dai-component",
+	.of_xlate_dai_name = q6dsp_audio_ports_of_xlate_dai_name,
+	.be_pcm_base = AUDIOREACH_BE_PCM_BASE,
+	.use_dai_pcm_id = false,
+};
+
 static int q6apm_lpass_dai_dev_probe(struct platform_device *pdev)
 {
+	const struct snd_soc_component_driver *q6apm_lpass_component = NULL;
 	struct q6dsp_audio_port_dai_driver_config cfg;
+	bool q6apm_lpass_dai_uses_dummy_ops  = false;
 	struct q6apm_lpass_dai_data *dai_data;
+	struct platform_device *prmcc_pdev;
 	struct snd_soc_dai_driver *dais;
 	struct device *dev = &pdev->dev;
+	struct device_node *prmcc_node;
 	int num_dais;
 
 	dai_data = devm_kzalloc(dev, sizeof(*dai_data), GFP_KERNEL);
 	if (!dai_data)
 		return -ENOMEM;
 
+	prmcc_node = of_parse_phandle(dev->of_node, "qcom,prmcc_clk", 0);
+	if (prmcc_node) {
+		prmcc_pdev = of_find_device_by_node(prmcc_node);
+		of_node_put(prmcc_node);
+
+		if (prmcc_pdev) {
+			dai_data->cc = platform_get_drvdata(prmcc_pdev);
+		} else {
+			dev_err(dev, "Failed to find prmcc clock\n");
+			return -EPROBE_DEFER;
+		}
+	}
+
 	dev_set_drvdata(dev, dai_data);
 
 	memset(&cfg, 0, sizeof(cfg));
-	cfg.q6i2s_ops = &q6i2s_ops;
-	cfg.q6dma_ops = &q6dma_ops;
-	cfg.q6hdmi_ops = &q6hdmi_ops;
+
+	q6apm_lpass_dai_uses_dummy_ops = of_property_read_bool(dev->of_node,
+							       "q6apm-dai-uses-dummy-ops");
+	if (q6apm_lpass_dai_uses_dummy_ops) {
+		dev_info(dev, "Q6 APM DAI uses dummy ops\n");
+		cfg.q6i2s_ops = &q6i2sdummy_ops;
+		cfg.q6dma_ops = &q6dummy_ops;
+		cfg.q6hdmi_ops = &q6dummy_ops;
+		cfg.q6tdm_ops = &q6tdmdummy_ops;
+		cfg.q6slim_ops = &q6dummy_ops;
+		q6apm_lpass_component = &q6apm_lpass_dummy_dai_component;
+	} else {
+		cfg.q6i2s_ops = &q6i2s_ops;
+		cfg.q6dma_ops = &q6dma_ops;
+		cfg.q6hdmi_ops = &q6hdmi_ops;
+		q6apm_lpass_component = &q6apm_lpass_dai_component;
+	}
+
 	dais = q6dsp_audio_ports_set_config(dev, &cfg, &num_dais);
 
-	return devm_snd_soc_register_component(dev, &q6apm_lpass_dai_component, dais, num_dais);
+	return devm_snd_soc_register_component(dev, q6apm_lpass_component, dais, num_dais);
 }
 
 #ifdef CONFIG_OF
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/q6apm.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/q6apm.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2020, Linaro Limited
+// Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <dt-bindings/soc/qcom,gpr.h>
 #include <linux/delay.h>
@@ -26,6 +27,7 @@
 } __packed;
 
 #define APM_GRAPH_MGMT_PSIZE(p, n) ALIGN(struct_size(p, sub_graph_id_list, n), 8)
+#define APM_CMD_CLOSE_ALL 0x01001013
 
 static struct q6apm *g_apm;
 
@@ -170,6 +172,20 @@
 }
 EXPORT_SYMBOL_GPL(q6apm_is_adsp_ready);
 
+void q6apm_close_all(void)
+{
+	struct gpr_pkt *pkt;
+
+	pkt = audioreach_alloc_apm_cmd_pkt(0, APM_CMD_CLOSE_ALL, 0);
+	if (IS_ERR(pkt))
+		return;
+
+	q6apm_send_cmd_sync(g_apm, pkt, GPR_BASIC_RSP_RESULT);
+
+	kfree(pkt);
+}
+EXPORT_SYMBOL_GPL(q6apm_close_all);
+
 static struct audioreach_module *__q6apm_find_module_by_mid(struct q6apm *apm,
 						    struct audioreach_graph_info *info,
 						    uint32_t mid)
@@ -792,6 +808,7 @@
 		case APM_CMD_GRAPH_FLUSH:
 		case APM_CMD_GRAPH_STOP:
 		case APM_CMD_SET_CFG:
+		case APM_CMD_CLOSE_ALL:
 			apm->result.opcode = result->opcode;
 			apm->result.status = result->status;
 			if (result->status)
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/q6apm.h
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/q6apm.h
@@ -146,6 +146,8 @@
 
 bool q6apm_is_adsp_ready(void);
 
+void q6apm_close_all(void);
+
 int q6apm_enable_compress_module(struct device *dev, struct q6apm_graph *graph, bool en);
 int q6apm_remove_initial_silence(struct device *dev, struct q6apm_graph *graph, uint32_t samples);
 int q6apm_remove_trailing_silence(struct device *dev, struct q6apm_graph *graph, uint32_t samples);
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/q6dsp-lpass-clocks.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/q6dsp-lpass-clocks.c
@@ -12,10 +12,6 @@
 #include <dt-bindings/sound/qcom,q6dsp-lpass-ports.h>
 #include "q6dsp-lpass-clocks.h"
 
-#define Q6DSP_MAX_CLK_ID			104
-#define Q6DSP_LPASS_CLK_ROOT_DEFAULT		0
-
-
 struct q6dsp_clk {
 	struct device *dev;
 	int q6dsp_clk_id;
@@ -27,12 +23,6 @@
 
 #define to_q6dsp_clk(_hw) container_of(_hw, struct q6dsp_clk, hw)
 
-struct q6dsp_cc {
-	struct device *dev;
-	struct q6dsp_clk *clks[Q6DSP_MAX_CLK_ID];
-	const struct q6dsp_clk_desc *desc;
-};
-
 static int clk_q6dsp_prepare(struct clk_hw *hw)
 {
 	struct q6dsp_clk *clk = to_q6dsp_clk(hw);
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/q6dsp-lpass-clocks.h
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/q6dsp-lpass-clocks.h
@@ -3,6 +3,9 @@
 #ifndef __Q6DSP_AUDIO_CLOCKS_H__
 #define __Q6DSP_AUDIO_CLOCKS_H__
 
+#define Q6DSP_MAX_CLK_ID			104
+#define Q6DSP_LPASS_CLK_ROOT_DEFAULT		0
+
 struct q6dsp_clk_init {
 	int clk_id;
 	int q6dsp_clk_id;
@@ -25,6 +28,12 @@
 	int (*lpass_unvote_clk)(struct device *dev, uint32_t hid, uint32_t h);
 };
 
+struct q6dsp_cc {
+	struct device *dev;
+	struct q6dsp_clk *clks[Q6DSP_MAX_CLK_ID];
+	const struct q6dsp_clk_desc *desc;
+};
+
 int q6dsp_clock_dev_probe(struct platform_device *pdev);
 
 #endif  /* __Q6DSP_AUDIO_CLOCKS_H__ */
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/q6dsp-lpass-ports.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/q6dsp-lpass-ports.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2020, Linaro Limited
+// Copyright (c) 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <sound/pcm.h>
 #include <sound/soc.h>
@@ -10,16 +11,14 @@
 #define Q6AFE_TDM_PB_DAI(pre, num, did) {				\
 		.playback = {						\
 			.stream_name = pre" TDM"#num" Playback",	\
-			.rates = SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\
-				SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\
-				SNDRV_PCM_RATE_176400,			\
+			.rates = SNDRV_PCM_RATE_8000_384000,		\
 			.formats = SNDRV_PCM_FMTBIT_S16_LE |		\
 				   SNDRV_PCM_FMTBIT_S24_LE |		\
 				   SNDRV_PCM_FMTBIT_S32_LE,		\
 			.channels_min = 1,				\
-			.channels_max = 8,				\
+			.channels_max = 16,				\
 			.rate_min = 8000,				\
-			.rate_max = 176400,				\
+			.rate_max = 384000,				\
 		},							\
 		.name = #did,						\
 		.id = did,						\
@@ -28,16 +27,14 @@
 #define Q6AFE_TDM_CAP_DAI(pre, num, did) {				\
 		.capture = {						\
 			.stream_name = pre" TDM"#num" Capture",		\
-			.rates = SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\
-				SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\
-				SNDRV_PCM_RATE_176400,			\
+			.rates = SNDRV_PCM_RATE_8000_384000,		\
 			.formats = SNDRV_PCM_FMTBIT_S16_LE |		\
 				   SNDRV_PCM_FMTBIT_S24_LE |		\
 				   SNDRV_PCM_FMTBIT_S32_LE,		\
 			.channels_min = 1,				\
-			.channels_max = 8,				\
+			.channels_max = 16,				\
 			.rate_min = 8000,				\
-			.rate_max = 176400,				\
+			.rate_max = 384000,				\
 		},							\
 		.name = #did,						\
 		.id = did,						\
@@ -46,16 +43,14 @@
 #define Q6AFE_CDC_DMA_RX_DAI(did) {				\
 		.playback = {						\
 			.stream_name = #did" Playback",	\
-			.rates = SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\
-				SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\
-				SNDRV_PCM_RATE_176400,			\
+			.rates = SNDRV_PCM_RATE_8000_384000,		\
 			.formats = SNDRV_PCM_FMTBIT_S16_LE |		\
 				   SNDRV_PCM_FMTBIT_S24_LE |		\
 				   SNDRV_PCM_FMTBIT_S32_LE,		\
 			.channels_min = 1,				\
 			.channels_max = 8,				\
 			.rate_min = 8000,				\
-			.rate_max = 176400,				\
+			.rate_max = 384000,				\
 		},							\
 		.name = #did,						\
 		.id = did,						\
@@ -117,30 +112,26 @@
 		.id = SLIMBUS_0_RX,
 		.playback = {
 			.stream_name = "Slimbus Playback",
-			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
-				 SNDRV_PCM_RATE_16000 | SNDRV_PCM_RATE_96000 |
-				 SNDRV_PCM_RATE_192000,
+			.rates = SNDRV_PCM_RATE_8000_384000,
 			.formats = SNDRV_PCM_FMTBIT_S16_LE |
 				   SNDRV_PCM_FMTBIT_S24_LE,
 			.channels_min = 1,
 			.channels_max = 8,
 			.rate_min = 8000,
-			.rate_max = 192000,
+			.rate_max = 384000,
 		},
 	}, {
 		.name = "SLIMBUS_0_TX",
 		.id = SLIMBUS_0_TX,
 		.capture = {
 			.stream_name = "Slimbus Capture",
-			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
-				 SNDRV_PCM_RATE_16000 | SNDRV_PCM_RATE_96000 |
-				 SNDRV_PCM_RATE_192000,
+			.rates = SNDRV_PCM_RATE_8000_384000,
 			.formats = SNDRV_PCM_FMTBIT_S16_LE |
 				   SNDRV_PCM_FMTBIT_S24_LE,
 			.channels_min = 1,
 			.channels_max = 8,
 			.rate_min = 8000,
-			.rate_max = 192000,
+			.rate_max = 384000,
 		},
 	}, {
 		.playback = {
@@ -331,13 +322,15 @@
 		.playback = {
 			.stream_name = "Primary MI2S Playback",
 			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
-				 SNDRV_PCM_RATE_16000,
+				 SNDRV_PCM_RATE_16000 | SNDRV_PCM_RATE_96000 |
+				 SNDRV_PCM_RATE_192000,
 			.formats = SNDRV_PCM_FMTBIT_S16_LE |
-				   SNDRV_PCM_FMTBIT_S24_LE,
+				   SNDRV_PCM_FMTBIT_S24_LE |
+				   SNDRV_PCM_FMTBIT_S32_LE,
 			.channels_min = 1,
 			.channels_max = 8,
 			.rate_min =     8000,
-			.rate_max =     48000,
+			.rate_max =     192000,
 		},
 		.id = PRIMARY_MI2S_RX,
 		.name = "PRI_MI2S_RX",
@@ -347,11 +340,12 @@
 			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
 				 SNDRV_PCM_RATE_16000,
 			.formats = SNDRV_PCM_FMTBIT_S16_LE |
-				   SNDRV_PCM_FMTBIT_S24_LE,
+				   SNDRV_PCM_FMTBIT_S24_LE |
+				   SNDRV_PCM_FMTBIT_S32_LE,
 			.channels_min = 1,
 			.channels_max = 8,
 			.rate_min =     8000,
-			.rate_max =     48000,
+			.rate_max =     96000,
 		},
 		.id = PRIMARY_MI2S_TX,
 		.name = "PRI_MI2S_TX",
@@ -360,7 +354,8 @@
 			.stream_name = "Secondary MI2S Playback",
 			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
 				 SNDRV_PCM_RATE_16000,
-			.formats = SNDRV_PCM_FMTBIT_S16_LE,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
 			.channels_min = 1,
 			.channels_max = 8,
 			.rate_min =     8000,
@@ -387,7 +382,8 @@
 			.stream_name = "Tertiary MI2S Playback",
 			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
 				 SNDRV_PCM_RATE_16000,
-			.formats = SNDRV_PCM_FMTBIT_S16_LE,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
 			.channels_min = 1,
 			.channels_max = 8,
 			.rate_min =     8000,
@@ -414,7 +410,8 @@
 			.stream_name = "Quaternary MI2S Playback",
 			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
 				 SNDRV_PCM_RATE_16000,
-			.formats = SNDRV_PCM_FMTBIT_S16_LE,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
 			.channels_min = 1,
 			.channels_max = 8,
 			.rate_min =     8000,
@@ -442,7 +439,8 @@
 			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
 			SNDRV_PCM_RATE_16000 | SNDRV_PCM_RATE_96000 |
 			SNDRV_PCM_RATE_192000,
-			.formats = SNDRV_PCM_FMTBIT_S16_LE,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
 			.channels_min = 1,
 			.channels_max = 8,
 			.rate_min =     8000,
@@ -463,6 +461,146 @@
 		},
 		.id = QUINARY_MI2S_TX,
 		.name = "QUIN_MI2S_TX",
+	}, {
+		.playback = {
+			.stream_name = "Primary SDR MI2S Playback",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     48000,
+		},
+		.id = PRIMARY_SDR_MI2S_RX,
+		.name = "PRI_SDR_MI2S_RX",
+	}, {
+		.capture = {
+			.stream_name = "Primary SDR MI2S Capture",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     48000,
+		},
+		.id = PRIMARY_SDR_MI2S_TX,
+		.name = "PRI_SDR_MI2S_TX",
+	}, {
+		.playback = {
+			.stream_name = "Secondary SDR MI2S Playback",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     48000,
+		},
+		.name = "SEC_SDR_MI2S_RX",
+		.id = SECONDARY_SDR_MI2S_RX,
+	}, {
+		.capture = {
+			.stream_name = "Secondary SDR MI2S Capture",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     48000,
+		},
+		.id = SECONDARY_SDR_MI2S_TX,
+		.name = "SEC_SDR_MI2S_TX",
+	}, {
+		.playback = {
+			.stream_name = "Tertiary SDR MI2S Playback",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     48000,
+		},
+		.name = "TERT_SDR_MI2S_RX",
+		.id = TERTIARY_SDR_MI2S_RX,
+	}, {
+		.capture = {
+			.stream_name = "Tertiary SDR MI2S Capture",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     48000,
+		},
+		.id = TERTIARY_SDR_MI2S_TX,
+		.name = "TERT_SDR_MI2S_TX",
+	}, {
+		.playback = {
+			.stream_name = "Quaternary SDR MI2S Playback",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     48000,
+		},
+		.name = "QUAT_SDR_MI2S_RX",
+		.id = QUATERNARY_SDR_MI2S_RX,
+	}, {
+		.capture = {
+			.stream_name = "Quaternary SDR MI2S Capture",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     48000,
+		},
+		.id = QUATERNARY_SDR_MI2S_TX,
+		.name = "QUAT_SDR_MI2S_TX",
+	}, {
+		.playback = {
+			.stream_name = "Quinary SDR MI2S Playback",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     192000,
+		},
+		.id = QUINARY_SDR_MI2S_RX,
+		.name = "QUIN_SDR_MI2S_RX",
+	}, {
+		.capture = {
+			.stream_name = "Quinary SDR MI2S Capture",
+			.rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+				 SNDRV_PCM_RATE_16000,
+			.formats = SNDRV_PCM_FMTBIT_S16_LE |
+				   SNDRV_PCM_FMTBIT_S24_LE,
+			.channels_min = 1,
+			.channels_max = 8,
+			.rate_min =     8000,
+			.rate_max =     48000,
+		},
+		.id = QUINARY_SDR_MI2S_TX,
+		.name = "QUIN_SDR_MI2S_TX",
 	},
 	Q6AFE_TDM_PB_DAI("Primary", 0, PRIMARY_TDM_RX_0),
 	Q6AFE_TDM_PB_DAI("Primary", 1, PRIMARY_TDM_RX_1),
@@ -544,6 +682,16 @@
 	Q6AFE_TDM_CAP_DAI("Quinary", 5, QUINARY_TDM_TX_5),
 	Q6AFE_TDM_CAP_DAI("Quinary", 6, QUINARY_TDM_TX_6),
 	Q6AFE_TDM_CAP_DAI("Quinary", 7, QUINARY_TDM_TX_7),
+	Q6AFE_TDM_PB_DAI("Primary SDR", 0, PRIMARY_SDR_TDM_RX_0),
+	Q6AFE_TDM_CAP_DAI("Primary SDR", 0, PRIMARY_SDR_TDM_TX_0),
+	Q6AFE_TDM_PB_DAI("Secondary SDR", 0, SECONDARY_SDR_TDM_RX_0),
+	Q6AFE_TDM_CAP_DAI("Secondary SDR", 0, SECONDARY_SDR_TDM_TX_0),
+	Q6AFE_TDM_PB_DAI("Tertiary SDR", 0, TERTIARY_SDR_TDM_RX_0),
+	Q6AFE_TDM_CAP_DAI("Tertiary SDR", 0, TERTIARY_SDR_TDM_TX_0),
+	Q6AFE_TDM_PB_DAI("Quaternary SDR", 0, QUATERNARY_SDR_TDM_RX_0),
+	Q6AFE_TDM_CAP_DAI("Quaternary SDR", 0, QUATERNARY_SDR_TDM_TX_0),
+	Q6AFE_TDM_PB_DAI("Quinary SDR", 0, QUINARY_SDR_TDM_RX_0),
+	Q6AFE_TDM_CAP_DAI("Quinary SDR", 0, QUINARY_SDR_TDM_TX_0),
 	Q6AFE_DP_RX_DAI(DISPLAY_PORT_RX_0),
 	Q6AFE_DP_RX_DAI(DISPLAY_PORT_RX_1),
 	Q6AFE_DP_RX_DAI(DISPLAY_PORT_RX_2),
@@ -616,9 +764,11 @@
 			break;
 		case QUINARY_MI2S_RX ... QUINARY_MI2S_TX:
 		case PRIMARY_MI2S_RX ... QUATERNARY_MI2S_TX:
+		case PRIMARY_SDR_MI2S_RX ... QUINARY_SDR_MI2S_TX:
 			q6dsp_audio_fe_dais[i].ops = cfg->q6i2s_ops;
 			break;
 		case PRIMARY_TDM_RX_0 ... QUINARY_TDM_TX_7:
+		case PRIMARY_SDR_TDM_RX_0 ... QUINARY_SDR_TDM_TX_0:
 			q6dsp_audio_fe_dais[i].ops = cfg->q6tdm_ops;
 			break;
 		case WSA_CODEC_DMA_RX_0 ... RX_CODEC_DMA_RX_7:
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/q6prm.h
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/q6prm.h
@@ -52,6 +52,27 @@
 /* Clock ID for QUINARY MI2S OSR CLK  */
 #define Q6PRM_LPASS_CLK_ID_QUI_MI2S_OSR                         0x116
 
+/* Clock ID for Primary TDM IBIT */
+#define Q6PRM_LPASS_CLK_ID_PRI_TDM_IBIT				0x200
+/* Clock ID for Primary TDM EBIT */
+#define Q6PRM_LPASS_CLK_ID_PRI_TDM_EBIT				0x201
+/* Clock ID for Secondary TDM IBIT */
+#define Q6PRM_LPASS_CLK_ID_SEC_TDM_IBIT				0x202
+/* Clock ID for Secondary TDM EBIT */
+#define Q6PRM_LPASS_CLK_ID_SEC_TDM_EBIT				0x203
+/* Clock ID for Tertiary TDM IBIT */
+#define Q6PRM_LPASS_CLK_ID_TER_TDM_IBIT				0x204
+/* Clock ID for Tertiary TDM EBIT */
+#define Q6PRM_LPASS_CLK_ID_TER_TDM_EBIT				0x205
+/* Clock ID for Quartnery TDM IBIT */
+#define Q6PRM_LPASS_CLK_ID_QUAD_TDM_IBIT			0x206
+/* Clock ID for Quartnery TDM EBIT */
+#define Q6PRM_LPASS_CLK_ID_QUAD_TDM_EBIT			0x207
+/* Clock ID for QUINARY TDM IBIT */
+#define Q6PRM_LPASS_CLK_ID_QUIN_TDM_IBIT			0x208
+/* Clock ID for QUINARY TDM EBIT */
+#define Q6PRM_LPASS_CLK_ID_QUIN_TDM_EBIT			0x209
+
 #define Q6PRM_LPASS_CLK_ID_WSA_CORE_MCLK			0x305
 #define Q6PRM_LPASS_CLK_ID_WSA_CORE_NPL_MCLK			0x306
 
--- linux-qcom-6.8.0.orig/sound/soc/qcom/qdsp6/spf-core.c
+++ linux-qcom-6.8.0/sound/soc/qcom/qdsp6/spf-core.c
@@ -0,0 +1,286 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <linux/slab.h>
+#include <linux/wait.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/sched.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/jiffies.h>
+#include <linux/soc/qcom/apr.h>
+#include <dt-bindings/soc/qcom,gpr.h>
+
+#define APM_STATE_READY_TIMEOUT_MS    10000
+#define Q6_READY_TIMEOUT_MS 1000
+#define APM_CMD_GET_SPF_STATE 0x01001021
+#define APM_CMD_RSP_GET_SPF_STATE 0x02001007
+#define APM_MODULE_INSTANCE_ID   0x00000001
+#define GPR_SVC_ADSP_CORE 0x3
+
+struct spf_core {
+	gpr_device_t *adev;
+	wait_queue_head_t wait;
+	struct mutex lock;
+	bool resp_received;
+	bool is_ready;
+};
+
+struct spf_core_private {
+	struct device *dev;
+	struct mutex lock;
+	struct spf_core *spf_core_drv;
+	bool is_initial_boot;
+	struct work_struct add_chld_dev_work;
+};
+
+static struct spf_core_private *spf_core_priv;
+struct apm_cmd_rsp_get_spf_status_t
+
+{
+	/* Spf status
+	 * @values
+	 * 0 -> Not ready
+	 * 1 -> Ready
+	 */
+	uint32_t status;
+
+};
+
+static int spf_core_callback(struct gpr_resp_pkt *data, void *priv, int op)
+{
+	gpr_device_t *gdev = priv;
+	struct spf_core *core = dev_get_drvdata(&gdev->dev);
+	struct gpr_ibasic_rsp_result_t *result;
+	struct gpr_hdr *hdr = &data->hdr;
+
+	result = data->payload;
+
+	switch (hdr->opcode) {
+	case GPR_BASIC_RSP_RESULT:
+		dev_err(&gdev->dev, "%s: Failed response received\n", __func__);
+		core->resp_received = true;
+		break;
+	case APM_CMD_RSP_GET_SPF_STATE:
+		core->is_ready = result->opcode;
+		dev_info(&gdev->dev, "%s: success response received, core->is_ready=%d\n",
+				__func__, core->is_ready);
+		core->resp_received = true;
+		break;
+	default:
+		dev_err(&gdev->dev, "Message ID from apm: 0x%x\n",
+			hdr->opcode);
+		break;
+	}
+	if (core->resp_received)
+		wake_up(&core->wait);
+
+	return 0;
+}
+
+static bool __spf_core_is_apm_ready(struct spf_core *core)
+{
+	gpr_device_t *adev = core->adev;
+	struct gpr_pkt pkt;
+	int rc;
+
+	pkt.hdr.version = GPR_PKT_VER;
+	pkt.hdr.hdr_size = GPR_PKT_HEADER_WORD_SIZE;
+	pkt.hdr.pkt_size = GPR_HDR_SIZE;
+
+	pkt.hdr.opcode = APM_CMD_GET_SPF_STATE;
+	pkt.hdr.dest_port = APM_MODULE_INSTANCE_ID;
+	pkt.hdr.src_port = adev->svc_id; //1
+	pkt.hdr.dest_domain = GPR_DOMAIN_ID_ADSP;
+	pkt.hdr.src_domain = GPR_DOMAIN_ID_APPS;
+	pkt.hdr.opcode = APM_CMD_GET_SPF_STATE;
+
+	rc = gpr_send_pkt(adev, &pkt);
+	if (rc < 0)
+		return false;
+
+	rc = wait_event_timeout(core->wait,
+			(core->resp_received), msecs_to_jiffies(Q6_READY_TIMEOUT_MS));
+
+	if (rc > 0 && core->resp_received) {
+		core->resp_received = false;
+
+		if (core->is_ready)
+			return true;
+	} else {
+		dev_err(spf_core_priv->dev, "%s: command timedout, ret\n",
+			__func__);
+	}
+
+	return false;
+}
+
+/**
+ * spf_core_is_apm_ready() - Get status of adsp
+ *
+ * Return: Will be an true if apm is ready and false if not.
+ */
+bool spf_core_is_apm_ready(void)
+{
+	unsigned long  timeout;
+	bool ret = false;
+	struct spf_core *core;
+
+	if (!spf_core_priv)
+		return ret;
+
+	core = spf_core_priv->spf_core_drv;
+	if (!core)
+		return ret;
+
+	mutex_lock(&core->lock);
+	timeout = jiffies + msecs_to_jiffies(APM_STATE_READY_TIMEOUT_MS);
+	for (;;) {
+		if (__spf_core_is_apm_ready(core)) {
+			ret = true;
+			break;
+		}
+		usleep_range(300000, 300050);
+		if (!time_after(timeout, jiffies)) {
+			ret = false;
+			break;
+		}
+	}
+
+	mutex_unlock(&core->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(spf_core_is_apm_ready);
+
+static int spf_core_probe(gpr_device_t *adev)
+{
+	struct spf_core *core;
+
+	if (!spf_core_priv) {
+		pr_err("%s: spf_core platform probe not yet done\n", __func__);
+		return -EPROBE_DEFER;
+	}
+	mutex_lock(&spf_core_priv->lock);
+	core = kzalloc(sizeof(*core), GFP_KERNEL);
+	if (!core) {
+		mutex_unlock(&spf_core_priv->lock);
+		return -ENOMEM;
+	}
+	dev_set_drvdata(&adev->dev, core);
+
+	mutex_init(&core->lock);
+	core->adev = adev;
+	init_waitqueue_head(&core->wait);
+	spf_core_priv->spf_core_drv = core;
+	if (spf_core_priv->is_initial_boot)
+		schedule_work(&spf_core_priv->add_chld_dev_work);
+	mutex_unlock(&spf_core_priv->lock);
+
+	return 0;
+}
+
+static void spf_core_exit(gpr_device_t *adev)
+{
+	struct spf_core *core = dev_get_drvdata(&adev->dev);
+
+	if (!spf_core_priv) {
+		pr_err("%s: spf_core platform probe not yet done\n", __func__);
+		return;
+	}
+	mutex_lock(&spf_core_priv->lock);
+	spf_core_priv->spf_core_drv = NULL;
+	kfree(core);
+	mutex_unlock(&spf_core_priv->lock);
+}
+
+static const struct of_device_id spf_core_device_id[]  = {
+	{ .compatible = "qcom,spf_core" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, spf_core_device_id);
+
+static gpr_driver_t ar_spf_core_driver = {
+	.probe = spf_core_probe,
+	.remove = spf_core_exit,
+	.gpr_callback = spf_core_callback,
+	.driver = {
+		.name = "qcom-spf_core",
+		.of_match_table = of_match_ptr(spf_core_device_id),
+	},
+};
+
+static void spf_core_add_child_devices(struct work_struct *work)
+{
+	int ret;
+
+	if (spf_core_is_apm_ready()) {
+		dev_info(spf_core_priv->dev, "%s: apm is up\n",
+			__func__);
+	} else {
+		dev_err(spf_core_priv->dev, "%s: apm is not up\n",
+			__func__);
+		return;
+	}
+
+	ret = of_platform_populate(spf_core_priv->dev->of_node,
+			NULL, NULL, spf_core_priv->dev);
+	if (ret)
+		dev_err(spf_core_priv->dev, "%s: failed to add child nodes, ret=%d\n",
+			__func__, ret);
+
+	spf_core_priv->is_initial_boot = false;
+}
+
+static int spf_core_platform_driver_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	spf_core_priv = devm_kzalloc(&pdev->dev, sizeof(struct spf_core_private), GFP_KERNEL);
+	if (!spf_core_priv)
+		return -ENOMEM;
+
+	spf_core_priv->dev = &pdev->dev;
+
+	mutex_init(&spf_core_priv->lock);
+
+	INIT_WORK(&spf_core_priv->add_chld_dev_work, spf_core_add_child_devices);
+
+	spf_core_priv->is_initial_boot = true;
+	ret = apr_driver_register(&ar_spf_core_driver);
+	if (ret) {
+		pr_err("%s: gpr driver register failed = %d\n",
+			__func__, ret);
+		ret = 0;
+	}
+
+	return ret;
+}
+
+static int spf_core_platform_driver_remove(struct platform_device *pdev)
+{
+	apr_driver_unregister(&ar_spf_core_driver);
+	spf_core_priv = NULL;
+	return 0;
+}
+
+static const struct of_device_id spf_core_of_match[]  = {
+	{ .compatible = "qcom,spf-core-platform", },
+	{},
+};
+
+static struct platform_driver spf_core_driver = {
+	.probe = spf_core_platform_driver_probe,
+	.remove = spf_core_platform_driver_remove,
+	.driver = {
+		.name = "spf-core-platform",
+		.of_match_table = spf_core_of_match,
+	}
+};
+
+module_platform_driver(spf_core_driver);
+
+MODULE_DESCRIPTION("qcom spf core");
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/sound/soc/qcom/sc7280.c
+++ linux-qcom-6.8.0/sound/soc/qcom/sc7280.c
@@ -23,6 +23,7 @@
 #include "common.h"
 #include "lpass.h"
 #include "qdsp6/q6afe.h"
+#include "sdw.h"
 
 #define DEFAULT_MCLK_RATE              19200000
 #define RT5682_PLL_FREQ (48000 * 512)
@@ -316,6 +317,7 @@
 	struct snd_soc_card *card = rtd->card;
 	struct sc7280_snd_data *data = snd_soc_card_get_drvdata(card);
 	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
 
 	switch (cpu_dai->id) {
 	case MI2S_PRIMARY:
@@ -333,6 +335,9 @@
 	default:
 		break;
 	}
+
+	data->sruntime[cpu_dai->id] = NULL;
+	sdw_release_stream(sruntime);
 }
 
 static int sc7280_snd_startup(struct snd_pcm_substream *substream)
@@ -347,6 +352,8 @@
 	switch (cpu_dai->id) {
 	case MI2S_PRIMARY:
 		ret = sc7280_rt5682_init(rtd);
+		if (ret)
+			return ret;
 		break;
 	case SECONDARY_MI2S_RX:
 		codec_dai_fmt |= SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_I2S;
@@ -360,7 +367,8 @@
 	default:
 		break;
 	}
-	return ret;
+
+	return qcom_snd_sdw_startup(substream);
 }
 
 static const struct snd_soc_ops sc7280_ops = {
--- linux-qcom-6.8.0.orig/sound/soc/qcom/sc8280xp.c
+++ linux-qcom-6.8.0/sound/soc/qcom/sc8280xp.c
@@ -48,17 +48,6 @@
 	return qcom_snd_wcd_jack_setup(rtd, &data->jack, &data->jack_setup);
 }
 
-static void sc8280xp_snd_shutdown(struct snd_pcm_substream *substream)
-{
-	struct snd_soc_pcm_runtime *rtd = substream->private_data;
-	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
-	struct sc8280xp_snd_data *pdata = snd_soc_card_get_drvdata(rtd->card);
-	struct sdw_stream_runtime *sruntime = pdata->sruntime[cpu_dai->id];
-
-	pdata->sruntime[cpu_dai->id] = NULL;
-	sdw_release_stream(sruntime);
-}
-
 static int sc8280xp_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
 				     struct snd_pcm_hw_params *params)
 {
@@ -119,8 +108,6 @@
 }
 
 static const struct snd_soc_ops sc8280xp_be_ops = {
-	.startup = qcom_snd_sdw_startup,
-	.shutdown = sc8280xp_snd_shutdown,
 	.hw_params = sc8280xp_snd_hw_params,
 	.hw_free = sc8280xp_snd_hw_free,
 	.prepare = sc8280xp_snd_prepare,
--- linux-qcom-6.8.0.orig/sound/soc/qcom/sdm845.c
+++ linux-qcom-6.8.0/sound/soc/qcom/sdm845.c
@@ -15,6 +15,7 @@
 #include <uapi/linux/input-event-codes.h>
 #include "common.h"
 #include "qdsp6/q6afe.h"
+#include "sdw.h"
 #include "../codecs/rt5663.h"
 
 #define DRIVER_NAME	"sdm845"
@@ -416,7 +417,7 @@
 		pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
 		break;
 	}
-	return 0;
+	return qcom_snd_sdw_startup(substream);
 }
 
 static void  sdm845_snd_shutdown(struct snd_pcm_substream *substream)
@@ -425,6 +426,7 @@
 	struct snd_soc_card *card = rtd->card;
 	struct sdm845_snd_data *data = snd_soc_card_get_drvdata(card);
 	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+	struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
 
 	switch (cpu_dai->id) {
 	case PRIMARY_MI2S_RX:
@@ -463,6 +465,9 @@
 		pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
 		break;
 	}
+
+	data->sruntime[cpu_dai->id] = NULL;
+	sdw_release_stream(sruntime);
 }
 
 static int sdm845_snd_prepare(struct snd_pcm_substream *substream)
--- linux-qcom-6.8.0.orig/sound/soc/qcom/sdw.c
+++ linux-qcom-6.8.0/sound/soc/qcom/sdw.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2018-2023, Linaro Limited.
 // Copyright (c) 2018, The Linux Foundation. All rights reserved.
+// Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 
 #include <dt-bindings/sound/qcom,q6afe.h>
 #include <linux/module.h>
@@ -64,6 +65,7 @@
 	switch (cpu_dai->id) {
 	case WSA_CODEC_DMA_RX_0:
 	case WSA_CODEC_DMA_RX_1:
+	case WSA_CODEC_DMA_TX_0:
 	case RX_CODEC_DMA_RX_0:
 	case RX_CODEC_DMA_RX_1:
 	case TX_CODEC_DMA_TX_0:
@@ -113,6 +115,7 @@
 
 	switch (cpu_dai->id) {
 	case WSA_CODEC_DMA_RX_0:
+	case WSA_CODEC_DMA_TX_0:
 	case RX_CODEC_DMA_RX_0:
 	case RX_CODEC_DMA_RX_1:
 	case TX_CODEC_DMA_TX_0:
@@ -141,6 +144,7 @@
 	switch (cpu_dai->id) {
 	case WSA_CODEC_DMA_RX_0:
 	case WSA_CODEC_DMA_RX_1:
+	case WSA_CODEC_DMA_TX_0:
 	case RX_CODEC_DMA_RX_0:
 	case RX_CODEC_DMA_RX_1:
 	case TX_CODEC_DMA_TX_0:
--- linux-qcom-6.8.0.orig/sound/soc/qcom/sm8250.c
+++ linux-qcom-6.8.0/sound/soc/qcom/sm8250.c
@@ -66,19 +66,7 @@
 	default:
 		break;
 	}
-
-	return qcom_snd_sdw_startup(substream);
-}
-
-static void sm2450_snd_shutdown(struct snd_pcm_substream *substream)
-{
-	struct snd_soc_pcm_runtime *rtd = substream->private_data;
-	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
-	struct sm8250_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
-	struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
-
-	data->sruntime[cpu_dai->id] = NULL;
-	sdw_release_stream(sruntime);
+	return 0;
 }
 
 static int sm8250_snd_hw_params(struct snd_pcm_substream *substream,
@@ -115,7 +103,6 @@
 
 static const struct snd_soc_ops sm8250_be_ops = {
 	.startup = sm8250_snd_startup,
-	.shutdown = sm2450_snd_shutdown,
 	.hw_params = sm8250_snd_hw_params,
 	.hw_free = sm8250_snd_hw_free,
 	.prepare = sm8250_snd_prepare,
@@ -166,6 +153,7 @@
 
 static const struct of_device_id snd_sm8250_dt_match[] = {
 	{.compatible = "qcom,sm8250-sndcard"},
+	{.compatible = "qcom,qrb4210-rb2-sndcard"},
 	{.compatible = "qcom,qrb5165-rb5-sndcard"},
 	{}
 };
--- linux-qcom-6.8.0.orig/sound/soc/rockchip/rockchip_i2s_tdm.c
+++ linux-qcom-6.8.0/sound/soc/rockchip/rockchip_i2s_tdm.c
@@ -25,8 +25,6 @@
 #define DEFAULT_MCLK_FS				256
 #define CH_GRP_MAX				4  /* The max channel 8 / 2 */
 #define MULTIPLEX_CH_MAX			10
-#define CLK_PPM_MIN				-1000
-#define CLK_PPM_MAX				1000
 
 #define TRCM_TXRX 0
 #define TRCM_TX 1
@@ -53,20 +51,6 @@
 	struct clk *hclk;
 	struct clk *mclk_tx;
 	struct clk *mclk_rx;
-	/* The mclk_tx_src is parent of mclk_tx */
-	struct clk *mclk_tx_src;
-	/* The mclk_rx_src is parent of mclk_rx */
-	struct clk *mclk_rx_src;
-	/*
-	 * The mclk_root0 and mclk_root1 are root parent and supplies for
-	 * the different FS.
-	 *
-	 * e.g:
-	 * mclk_root0 is VPLL0, used for FS=48000Hz
-	 * mclk_root1 is VPLL1, used for FS=44100Hz
-	 */
-	struct clk *mclk_root0;
-	struct clk *mclk_root1;
 	struct regmap *regmap;
 	struct regmap *grf;
 	struct snd_dmaengine_dai_dma_data capture_dma_data;
@@ -76,19 +60,11 @@
 	const struct rk_i2s_soc_data *soc_data;
 	bool is_master_mode;
 	bool io_multiplex;
-	bool mclk_calibrate;
 	bool tdm_mode;
-	unsigned int mclk_rx_freq;
-	unsigned int mclk_tx_freq;
-	unsigned int mclk_root0_freq;
-	unsigned int mclk_root1_freq;
-	unsigned int mclk_root0_initial_freq;
-	unsigned int mclk_root1_initial_freq;
 	unsigned int frame_width;
 	unsigned int clk_trcm;
 	unsigned int i2s_sdis[CH_GRP_MAX];
 	unsigned int i2s_sdos[CH_GRP_MAX];
-	int clk_ppm;
 	int refcount;
 	spinlock_t lock; /* xfer lock */
 	bool has_playback;
@@ -114,12 +90,6 @@
 {
 	clk_disable_unprepare(i2s_tdm->mclk_tx);
 	clk_disable_unprepare(i2s_tdm->mclk_rx);
-	if (i2s_tdm->mclk_calibrate) {
-		clk_disable_unprepare(i2s_tdm->mclk_tx_src);
-		clk_disable_unprepare(i2s_tdm->mclk_rx_src);
-		clk_disable_unprepare(i2s_tdm->mclk_root0);
-		clk_disable_unprepare(i2s_tdm->mclk_root1);
-	}
 }
 
 /**
@@ -142,29 +112,9 @@
 	ret = clk_prepare_enable(i2s_tdm->mclk_rx);
 	if (ret)
 		goto err_mclk_rx;
-	if (i2s_tdm->mclk_calibrate) {
-		ret = clk_prepare_enable(i2s_tdm->mclk_tx_src);
-		if (ret)
-			goto err_mclk_rx;
-		ret = clk_prepare_enable(i2s_tdm->mclk_rx_src);
-		if (ret)
-			goto err_mclk_rx_src;
-		ret = clk_prepare_enable(i2s_tdm->mclk_root0);
-		if (ret)
-			goto err_mclk_root0;
-		ret = clk_prepare_enable(i2s_tdm->mclk_root1);
-		if (ret)
-			goto err_mclk_root1;
-	}
 
 	return 0;
 
-err_mclk_root1:
-	clk_disable_unprepare(i2s_tdm->mclk_root0);
-err_mclk_root0:
-	clk_disable_unprepare(i2s_tdm->mclk_rx_src);
-err_mclk_rx_src:
-	clk_disable_unprepare(i2s_tdm->mclk_tx_src);
 err_mclk_rx:
 	clk_disable_unprepare(i2s_tdm->mclk_tx);
 err_mclk_tx:
@@ -564,159 +514,6 @@
 			   I2S_XFER_RXS_START);
 }
 
-static int rockchip_i2s_tdm_clk_set_rate(struct rk_i2s_tdm_dev *i2s_tdm,
-					 struct clk *clk, unsigned long rate,
-					 int ppm)
-{
-	unsigned long rate_target;
-	int delta, ret;
-
-	if (ppm == i2s_tdm->clk_ppm)
-		return 0;
-
-	if (ppm < 0)
-		delta = -1;
-	else
-		delta = 1;
-
-	delta *= (int)div64_u64((u64)rate * (u64)abs(ppm) + 500000,
-				1000000);
-
-	rate_target = rate + delta;
-
-	if (!rate_target)
-		return -EINVAL;
-
-	ret = clk_set_rate(clk, rate_target);
-	if (ret)
-		return ret;
-
-	i2s_tdm->clk_ppm = ppm;
-
-	return 0;
-}
-
-static int rockchip_i2s_tdm_calibrate_mclk(struct rk_i2s_tdm_dev *i2s_tdm,
-					   struct snd_pcm_substream *substream,
-					   unsigned int lrck_freq)
-{
-	struct clk *mclk_root;
-	struct clk *mclk_parent;
-	unsigned int mclk_root_freq;
-	unsigned int mclk_root_initial_freq;
-	unsigned int mclk_parent_freq;
-	unsigned int div, delta;
-	u64 ppm;
-	int ret;
-
-	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-		mclk_parent = i2s_tdm->mclk_tx_src;
-	else
-		mclk_parent = i2s_tdm->mclk_rx_src;
-
-	switch (lrck_freq) {
-	case 8000:
-	case 16000:
-	case 24000:
-	case 32000:
-	case 48000:
-	case 64000:
-	case 96000:
-	case 192000:
-		mclk_root = i2s_tdm->mclk_root0;
-		mclk_root_freq = i2s_tdm->mclk_root0_freq;
-		mclk_root_initial_freq = i2s_tdm->mclk_root0_initial_freq;
-		mclk_parent_freq = DEFAULT_MCLK_FS * 192000;
-		break;
-	case 11025:
-	case 22050:
-	case 44100:
-	case 88200:
-	case 176400:
-		mclk_root = i2s_tdm->mclk_root1;
-		mclk_root_freq = i2s_tdm->mclk_root1_freq;
-		mclk_root_initial_freq = i2s_tdm->mclk_root1_initial_freq;
-		mclk_parent_freq = DEFAULT_MCLK_FS * 176400;
-		break;
-	default:
-		dev_err(i2s_tdm->dev, "Invalid LRCK frequency: %u Hz\n",
-			lrck_freq);
-		return -EINVAL;
-	}
-
-	ret = clk_set_parent(mclk_parent, mclk_root);
-	if (ret)
-		return ret;
-
-	ret = rockchip_i2s_tdm_clk_set_rate(i2s_tdm, mclk_root,
-					    mclk_root_freq, 0);
-	if (ret)
-		return ret;
-
-	delta = abs(mclk_root_freq % mclk_parent_freq - mclk_parent_freq);
-	ppm = div64_u64((uint64_t)delta * 1000000, (uint64_t)mclk_root_freq);
-
-	if (ppm) {
-		div = DIV_ROUND_CLOSEST(mclk_root_initial_freq, mclk_parent_freq);
-		if (!div)
-			return -EINVAL;
-
-		mclk_root_freq = mclk_parent_freq * round_up(div, 2);
-
-		ret = clk_set_rate(mclk_root, mclk_root_freq);
-		if (ret)
-			return ret;
-
-		i2s_tdm->mclk_root0_freq = clk_get_rate(i2s_tdm->mclk_root0);
-		i2s_tdm->mclk_root1_freq = clk_get_rate(i2s_tdm->mclk_root1);
-	}
-
-	return clk_set_rate(mclk_parent, mclk_parent_freq);
-}
-
-static int rockchip_i2s_tdm_set_mclk(struct rk_i2s_tdm_dev *i2s_tdm,
-				     struct snd_pcm_substream *substream,
-				     struct clk **mclk)
-{
-	unsigned int mclk_freq;
-	int ret;
-
-	if (i2s_tdm->clk_trcm) {
-		if (i2s_tdm->mclk_tx_freq != i2s_tdm->mclk_rx_freq) {
-			dev_err(i2s_tdm->dev,
-				"clk_trcm, tx: %d and rx: %d should be the same\n",
-				i2s_tdm->mclk_tx_freq,
-				i2s_tdm->mclk_rx_freq);
-			return -EINVAL;
-		}
-
-		ret = clk_set_rate(i2s_tdm->mclk_tx, i2s_tdm->mclk_tx_freq);
-		if (ret)
-			return ret;
-
-		ret = clk_set_rate(i2s_tdm->mclk_rx, i2s_tdm->mclk_rx_freq);
-		if (ret)
-			return ret;
-
-		/* mclk_rx is also ok. */
-		*mclk = i2s_tdm->mclk_tx;
-	} else {
-		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-			*mclk = i2s_tdm->mclk_tx;
-			mclk_freq = i2s_tdm->mclk_tx_freq;
-		} else {
-			*mclk = i2s_tdm->mclk_rx;
-			mclk_freq = i2s_tdm->mclk_rx_freq;
-		}
-
-		ret = clk_set_rate(*mclk, mclk_freq);
-		if (ret)
-			return ret;
-	}
-
-	return 0;
-}
-
 static int rockchip_i2s_ch_to_io(unsigned int ch, bool substream_capture)
 {
 	if (substream_capture) {
@@ -853,19 +650,26 @@
 				      struct snd_soc_dai *dai)
 {
 	struct rk_i2s_tdm_dev *i2s_tdm = to_info(dai);
-	struct clk *mclk;
-	int ret = 0;
 	unsigned int val = 0;
 	unsigned int mclk_rate, bclk_rate, div_bclk = 4, div_lrck = 64;
+	int err;
 
 	if (i2s_tdm->is_master_mode) {
-		if (i2s_tdm->mclk_calibrate)
-			rockchip_i2s_tdm_calibrate_mclk(i2s_tdm, substream,
-							params_rate(params));
-
-		ret = rockchip_i2s_tdm_set_mclk(i2s_tdm, substream, &mclk);
-		if (ret)
-			return ret;
+		struct clk *mclk;
+
+		if (i2s_tdm->clk_trcm == TRCM_TX) {
+			mclk = i2s_tdm->mclk_tx;
+		} else if (i2s_tdm->clk_trcm == TRCM_RX) {
+			mclk = i2s_tdm->mclk_rx;
+		} else if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+			mclk = i2s_tdm->mclk_tx;
+		} else {
+			mclk = i2s_tdm->mclk_rx;
+		}
+
+		err = clk_set_rate(mclk, DEFAULT_MCLK_FS * params_rate(params));
+		if (err)
+			return err;
 
 		mclk_rate = clk_get_rate(mclk);
 		bclk_rate = i2s_tdm->frame_width * params_rate(params);
@@ -973,96 +777,6 @@
 	return 0;
 }
 
-static int rockchip_i2s_tdm_set_sysclk(struct snd_soc_dai *cpu_dai, int stream,
-				       unsigned int freq, int dir)
-{
-	struct rk_i2s_tdm_dev *i2s_tdm = to_info(cpu_dai);
-
-	/* Put set mclk rate into rockchip_i2s_tdm_set_mclk() */
-	if (i2s_tdm->clk_trcm) {
-		i2s_tdm->mclk_tx_freq = freq;
-		i2s_tdm->mclk_rx_freq = freq;
-	} else {
-		if (stream == SNDRV_PCM_STREAM_PLAYBACK)
-			i2s_tdm->mclk_tx_freq = freq;
-		else
-			i2s_tdm->mclk_rx_freq = freq;
-	}
-
-	dev_dbg(i2s_tdm->dev, "The target mclk_%s freq is: %d\n",
-		stream ? "rx" : "tx", freq);
-
-	return 0;
-}
-
-static int rockchip_i2s_tdm_clk_compensation_info(struct snd_kcontrol *kcontrol,
-						  struct snd_ctl_elem_info *uinfo)
-{
-	uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
-	uinfo->count = 1;
-	uinfo->value.integer.min = CLK_PPM_MIN;
-	uinfo->value.integer.max = CLK_PPM_MAX;
-	uinfo->value.integer.step = 1;
-
-	return 0;
-}
-
-static int rockchip_i2s_tdm_clk_compensation_get(struct snd_kcontrol *kcontrol,
-						 struct snd_ctl_elem_value *ucontrol)
-{
-	struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol);
-	struct rk_i2s_tdm_dev *i2s_tdm = snd_soc_dai_get_drvdata(dai);
-
-	ucontrol->value.integer.value[0] = i2s_tdm->clk_ppm;
-
-	return 0;
-}
-
-static int rockchip_i2s_tdm_clk_compensation_put(struct snd_kcontrol *kcontrol,
-						 struct snd_ctl_elem_value *ucontrol)
-{
-	struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol);
-	struct rk_i2s_tdm_dev *i2s_tdm = snd_soc_dai_get_drvdata(dai);
-	int ret = 0, ppm = 0;
-	int changed = 0;
-	unsigned long old_rate;
-
-	if (ucontrol->value.integer.value[0] < CLK_PPM_MIN ||
-	    ucontrol->value.integer.value[0] > CLK_PPM_MAX)
-		return -EINVAL;
-
-	ppm = ucontrol->value.integer.value[0];
-
-	old_rate = clk_get_rate(i2s_tdm->mclk_root0);
-	ret = rockchip_i2s_tdm_clk_set_rate(i2s_tdm, i2s_tdm->mclk_root0,
-					    i2s_tdm->mclk_root0_freq, ppm);
-	if (ret)
-		return ret;
-	if (old_rate != clk_get_rate(i2s_tdm->mclk_root0))
-		changed = 1;
-
-	if (clk_is_match(i2s_tdm->mclk_root0, i2s_tdm->mclk_root1))
-		return changed;
-
-	old_rate = clk_get_rate(i2s_tdm->mclk_root1);
-	ret = rockchip_i2s_tdm_clk_set_rate(i2s_tdm, i2s_tdm->mclk_root1,
-					    i2s_tdm->mclk_root1_freq, ppm);
-	if (ret)
-		return ret;
-	if (old_rate != clk_get_rate(i2s_tdm->mclk_root1))
-		changed = 1;
-
-	return changed;
-}
-
-static struct snd_kcontrol_new rockchip_i2s_tdm_compensation_control = {
-	.iface = SNDRV_CTL_ELEM_IFACE_PCM,
-	.name = "PCM Clock Compensation in PPM",
-	.info = rockchip_i2s_tdm_clk_compensation_info,
-	.get = rockchip_i2s_tdm_clk_compensation_get,
-	.put = rockchip_i2s_tdm_clk_compensation_put,
-};
-
 static int rockchip_i2s_tdm_dai_probe(struct snd_soc_dai *dai)
 {
 	struct rk_i2s_tdm_dev *i2s_tdm = snd_soc_dai_get_drvdata(dai);
@@ -1072,9 +786,6 @@
 	if (i2s_tdm->has_playback)
 		snd_soc_dai_dma_data_set_playback(dai, &i2s_tdm->playback_dma_data);
 
-	if (i2s_tdm->mclk_calibrate)
-		snd_soc_add_dai_controls(dai, &rockchip_i2s_tdm_compensation_control, 1);
-
 	return 0;
 }
 
@@ -1115,7 +826,6 @@
 	.probe = rockchip_i2s_tdm_dai_probe,
 	.hw_params = rockchip_i2s_tdm_hw_params,
 	.set_bclk_ratio	= rockchip_i2s_tdm_set_bclk_ratio,
-	.set_sysclk = rockchip_i2s_tdm_set_sysclk,
 	.set_fmt = rockchip_i2s_tdm_set_fmt,
 	.set_tdm_slot = rockchip_dai_tdm_slot,
 	.trigger = rockchip_i2s_tdm_trigger,
@@ -1444,35 +1154,6 @@
 		rockchip_i2s_tdm_tx_path_config(i2s_tdm, num);
 }
 
-static int rockchip_i2s_tdm_get_calibrate_mclks(struct rk_i2s_tdm_dev *i2s_tdm)
-{
-	int num_mclks = 0;
-
-	i2s_tdm->mclk_tx_src = devm_clk_get(i2s_tdm->dev, "mclk_tx_src");
-	if (!IS_ERR(i2s_tdm->mclk_tx_src))
-		num_mclks++;
-
-	i2s_tdm->mclk_rx_src = devm_clk_get(i2s_tdm->dev, "mclk_rx_src");
-	if (!IS_ERR(i2s_tdm->mclk_rx_src))
-		num_mclks++;
-
-	i2s_tdm->mclk_root0 = devm_clk_get(i2s_tdm->dev, "mclk_root0");
-	if (!IS_ERR(i2s_tdm->mclk_root0))
-		num_mclks++;
-
-	i2s_tdm->mclk_root1 = devm_clk_get(i2s_tdm->dev, "mclk_root1");
-	if (!IS_ERR(i2s_tdm->mclk_root1))
-		num_mclks++;
-
-	if (num_mclks < 4 && num_mclks != 0)
-		return -ENOENT;
-
-	if (num_mclks == 4)
-		i2s_tdm->mclk_calibrate = 1;
-
-	return 0;
-}
-
 static int rockchip_i2s_tdm_path_prepare(struct rk_i2s_tdm_dev *i2s_tdm,
 					 struct device_node *np,
 					 bool is_rx_path)
@@ -1610,11 +1291,6 @@
 	i2s_tdm->io_multiplex =
 		of_property_read_bool(node, "rockchip,io-multiplex");
 
-	ret = rockchip_i2s_tdm_get_calibrate_mclks(i2s_tdm);
-	if (ret)
-		return dev_err_probe(i2s_tdm->dev, ret,
-				     "mclk-calibrate clocks missing");
-
 	regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
 	if (IS_ERR(regs)) {
 		return dev_err_probe(i2s_tdm->dev, PTR_ERR(regs),
@@ -1667,13 +1343,6 @@
 		goto err_disable_hclk;
 	}
 
-	if (i2s_tdm->mclk_calibrate) {
-		i2s_tdm->mclk_root0_initial_freq = clk_get_rate(i2s_tdm->mclk_root0);
-		i2s_tdm->mclk_root1_initial_freq = clk_get_rate(i2s_tdm->mclk_root1);
-		i2s_tdm->mclk_root0_freq = i2s_tdm->mclk_root0_initial_freq;
-		i2s_tdm->mclk_root1_freq = i2s_tdm->mclk_root1_initial_freq;
-	}
-
 	pm_runtime_enable(&pdev->dev);
 
 	regmap_update_bits(i2s_tdm->regmap, I2S_DMACR, I2S_DMACR_TDL_MASK,
--- linux-qcom-6.8.0.orig/sound/soc/samsung/Kconfig
+++ linux-qcom-6.8.0/sound/soc/samsung/Kconfig
@@ -127,8 +127,9 @@
 
 config SND_SOC_SAMSUNG_ARIES_WM8994
 	tristate "SoC I2S Audio support for WM8994 on Aries"
-	depends on SND_SOC_SAMSUNG && MFD_WM8994 && IIO && EXTCON
+	depends on SND_SOC_SAMSUNG && I2C && IIO && EXTCON
 	select SND_SOC_BT_SCO
+	select MFD_WM8994
 	select SND_SOC_WM8994
 	select SND_SAMSUNG_I2S
 	help
@@ -140,8 +141,9 @@
 
 config SND_SOC_SAMSUNG_MIDAS_WM1811
 	tristate "SoC I2S Audio support for Midas boards"
-	depends on SND_SOC_SAMSUNG
+	depends on SND_SOC_SAMSUNG && I2C
 	select SND_SAMSUNG_I2S
+	select MFD_WM8994
 	select SND_SOC_WM8994
 	help
 	  Say Y if you want to add support for SoC audio on the Midas boards.
--- linux-qcom-6.8.0.orig/sound/soc/sh/rcar/core.c
+++ linux-qcom-6.8.0/sound/soc/sh/rcar/core.c
@@ -1298,7 +1298,9 @@
 		if (!of_node_name_eq(ports, "ports") &&
 		    !of_node_name_eq(ports, "port"))
 			continue;
-		priv->component_dais[i] = of_graph_get_endpoint_count(ports);
+		priv->component_dais[i] =
+			of_graph_get_endpoint_count(of_node_name_eq(ports, "ports") ?
+						    ports : np);
 		nr += priv->component_dais[i];
 		i++;
 		if (i >= RSND_MAX_COMPONENT) {
@@ -1510,7 +1512,8 @@
 			if (!of_node_name_eq(ports, "ports") &&
 			    !of_node_name_eq(ports, "port"))
 				continue;
-			for_each_endpoint_of_node(ports, dai_np) {
+			for_each_endpoint_of_node(of_node_name_eq(ports, "ports") ?
+						  ports : np, dai_np) {
 				__rsnd_dai_probe(priv, dai_np, dai_np, 0, dai_i);
 				if (rsnd_is_gen3(priv) || rsnd_is_gen4(priv)) {
 					rdai = rsnd_rdai_get(priv, dai_i);
--- linux-qcom-6.8.0.orig/sound/soc/sh/rz-ssi.c
+++ linux-qcom-6.8.0/sound/soc/sh/rz-ssi.c
@@ -1015,7 +1015,7 @@
 					       dev_name(&pdev->dev), ssi);
 			if (ret < 0)
 				return dev_err_probe(&pdev->dev, ret,
-						"irq request error (dma_tx)\n");
+						     "irq request error (dma_rt)\n");
 		} else {
 			if (ssi->irq_tx < 0)
 				return ssi->irq_tx;
--- linux-qcom-6.8.0.orig/sound/soc/soc-core.c
+++ linux-qcom-6.8.0/sound/soc/soc-core.c
@@ -1218,6 +1218,9 @@
 			if (!snd_soc_is_matching_component(platform, component))
 				continue;
 
+			if (snd_soc_component_is_dummy(component) && component->num_dai)
+				continue;
+
 			snd_soc_rtd_add_component(rtd, component);
 		}
 	}
--- linux-qcom-6.8.0.orig/sound/soc/soc-dapm.c
+++ linux-qcom-6.8.0/sound/soc/soc-dapm.c
@@ -1148,6 +1148,8 @@
 	if (*list == NULL)
 		return -ENOMEM;
 
+	(*list)->num_widgets = size;
+
 	list_for_each_entry(w, widgets, work_list)
 		(*list)->widgets[i++] = w;
 
@@ -2737,10 +2739,10 @@
 
 int snd_soc_dapm_widget_name_cmp(struct snd_soc_dapm_widget *widget, const char *s)
 {
-	struct snd_soc_component *component = snd_soc_dapm_to_component(widget->dapm);
+	struct snd_soc_component *component = widget->dapm->component;
 	const char *wname = widget->name;
 
-	if (component->name_prefix)
+	if (component && component->name_prefix)
 		wname += strlen(component->name_prefix) + 1; /* plus space */
 
 	return strcmp(wname, s);
@@ -4016,6 +4018,7 @@
 
 	case SND_SOC_DAPM_POST_PMD:
 		kfree(substream->runtime);
+		substream->runtime = NULL;
 		break;
 
 	default:
--- linux-qcom-6.8.0.orig/sound/soc/soc-generic-dmaengine-pcm.c
+++ linux-qcom-6.8.0/sound/soc/soc-generic-dmaengine-pcm.c
@@ -318,6 +318,12 @@
 	return 0;
 }
 
+static int dmaengine_pcm_sync_stop(struct snd_soc_component *component,
+				   struct snd_pcm_substream *substream)
+{
+	return snd_dmaengine_pcm_sync_stop(substream);
+}
+
 static const struct snd_soc_component_driver dmaengine_pcm_component = {
 	.name		= SND_DMAENGINE_PCM_DRV_NAME,
 	.probe_order	= SND_SOC_COMP_ORDER_LATE,
@@ -327,6 +333,7 @@
 	.trigger	= dmaengine_pcm_trigger,
 	.pointer	= dmaengine_pcm_pointer,
 	.pcm_construct	= dmaengine_pcm_new,
+	.sync_stop	= dmaengine_pcm_sync_stop,
 };
 
 static const struct snd_soc_component_driver dmaengine_pcm_component_process = {
@@ -339,6 +346,7 @@
 	.pointer	= dmaengine_pcm_pointer,
 	.copy		= dmaengine_copy,
 	.pcm_construct	= dmaengine_pcm_new,
+	.sync_stop	= dmaengine_pcm_sync_stop,
 };
 
 static const char * const dmaengine_pcm_dma_channel_names[] = {
--- linux-qcom-6.8.0.orig/sound/soc/soc-ops.c
+++ linux-qcom-6.8.0/sound/soc/soc-ops.c
@@ -263,7 +263,7 @@
 	int max = mc->max;
 	int min = mc->min;
 	int sign_bit = mc->sign_bit;
-	unsigned int mask = (1 << fls(max)) - 1;
+	unsigned int mask = (1ULL << fls(max)) - 1;
 	unsigned int invert = mc->invert;
 	int val;
 	int ret;
--- linux-qcom-6.8.0.orig/sound/soc/soc-topology.c
+++ linux-qcom-6.8.0/sound/soc/soc-topology.c
@@ -851,6 +851,8 @@
 		se->dobj.control.dvalues[i] = le32_to_cpu(ec->values[i]);
 	}
 
+	se->items = le32_to_cpu(ec->items);
+	se->values = (const unsigned int *)se->dobj.control.dvalues;
 	return 0;
 }
 
@@ -1021,6 +1023,7 @@
 	struct snd_soc_tplg_hdr *hdr)
 {
 	struct snd_soc_dapm_context *dapm = &tplg->comp->dapm;
+	const size_t maxlen = SNDRV_CTL_ELEM_ID_NAME_MAXLEN;
 	struct snd_soc_tplg_dapm_graph_elem *elem;
 	struct snd_soc_dapm_route *route;
 	int count, i;
@@ -1044,31 +1047,27 @@
 		tplg->pos += sizeof(struct snd_soc_tplg_dapm_graph_elem);
 
 		/* validate routes */
-		if (strnlen(elem->source, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) ==
-			    SNDRV_CTL_ELEM_ID_NAME_MAXLEN) {
+		if ((strnlen(elem->source, maxlen) == maxlen) ||
+		    (strnlen(elem->sink, maxlen) == maxlen) ||
+		    (strnlen(elem->control, maxlen) == maxlen)) {
 			ret = -EINVAL;
 			break;
 		}
-		if (strnlen(elem->sink, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) ==
-			    SNDRV_CTL_ELEM_ID_NAME_MAXLEN) {
-			ret = -EINVAL;
-			break;
-		}
-		if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) ==
-			    SNDRV_CTL_ELEM_ID_NAME_MAXLEN) {
-			ret = -EINVAL;
+
+		route->source = devm_kstrdup(tplg->dev, elem->source, GFP_KERNEL);
+		route->sink = devm_kstrdup(tplg->dev, elem->sink, GFP_KERNEL);
+		if (!route->source || !route->sink) {
+			ret = -ENOMEM;
 			break;
 		}
 
-		route->source = elem->source;
-		route->sink = elem->sink;
-
-		/* set to NULL atm for tplg users */
-		route->connected = NULL;
-		if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0)
-			route->control = NULL;
-		else
-			route->control = elem->control;
+		if (strnlen(elem->control, maxlen) != 0) {
+			route->control = devm_kstrdup(tplg->dev, elem->control, GFP_KERNEL);
+			if (!route->control) {
+				ret = -ENOMEM;
+				break;
+			}
+		}
 
 		/* add route dobj to dobj_list */
 		route->dobj.type = SND_SOC_DOBJ_GRAPH;
--- linux-qcom-6.8.0.orig/sound/soc/sof/amd/acp-loader.c
+++ linux-qcom-6.8.0/sound/soc/sof/amd/acp-loader.c
@@ -173,7 +173,7 @@
 
 	adata = sdev->pdata->hw_pdata;
 
-	if (adata->signed_fw_image)
+	if (adata->quirks && adata->quirks->signed_fw_image)
 		size_fw = adata->fw_bin_size - ACP_FIRMWARE_SIGNATURE;
 	else
 		size_fw = adata->fw_bin_size;
@@ -267,29 +267,49 @@
 {
 	struct snd_sof_pdata *plat_data = sdev->pdata;
 	struct acp_dev_data *adata = plat_data->hw_pdata;
+	const char *fw_filename;
 	int ret;
 
-	ret = request_firmware(&sdev->basefw.fw, adata->fw_code_bin, sdev->dev);
+	fw_filename = kasprintf(GFP_KERNEL, "%s/%s",
+				plat_data->fw_filename_prefix,
+				adata->fw_code_bin);
+	if (!fw_filename)
+		return -ENOMEM;
+
+	ret = request_firmware(&sdev->basefw.fw, fw_filename, sdev->dev);
 	if (ret < 0) {
+		kfree(fw_filename);
 		dev_err(sdev->dev, "sof signed firmware code bin is missing\n");
 		return ret;
 	} else {
-		dev_dbg(sdev->dev, "request_firmware %s successful\n", adata->fw_code_bin);
+		dev_dbg(sdev->dev, "request_firmware %s successful\n", fw_filename);
 	}
+	kfree(fw_filename);
+
 	ret = snd_sof_dsp_block_write(sdev, SOF_FW_BLK_TYPE_IRAM, 0,
-				      (void *)sdev->basefw.fw->data, sdev->basefw.fw->size);
+				      (void *)sdev->basefw.fw->data,
+				      sdev->basefw.fw->size);
+
+	fw_filename = kasprintf(GFP_KERNEL, "%s/%s",
+				plat_data->fw_filename_prefix,
+				adata->fw_data_bin);
+	if (!fw_filename)
+		return -ENOMEM;
 
-	ret = request_firmware(&adata->fw_dbin, adata->fw_data_bin, sdev->dev);
+	ret = request_firmware(&adata->fw_dbin, fw_filename, sdev->dev);
 	if (ret < 0) {
+		kfree(fw_filename);
 		dev_err(sdev->dev, "sof signed firmware data bin is missing\n");
 		return ret;
 
 	} else {
-		dev_dbg(sdev->dev, "request_firmware %s successful\n", adata->fw_data_bin);
+		dev_dbg(sdev->dev, "request_firmware %s successful\n", fw_filename);
 	}
+	kfree(fw_filename);
 
 	ret = snd_sof_dsp_block_write(sdev, SOF_FW_BLK_TYPE_DRAM, 0,
-				      (void *)adata->fw_dbin->data, adata->fw_dbin->size);
+				      (void *)adata->fw_dbin->data,
+				      adata->fw_dbin->size);
 	return ret;
 }
 EXPORT_SYMBOL_NS(acp_sof_load_signed_firmware, SND_SOC_SOF_AMD_COMMON);
--- linux-qcom-6.8.0.orig/sound/soc/sof/amd/acp.c
+++ linux-qcom-6.8.0/sound/soc/sof/amd/acp.c
@@ -20,21 +20,23 @@
 #include "acp.h"
 #include "acp-dsp-offset.h"
 
-#define SECURED_FIRMWARE 1
-
 static bool enable_fw_debug;
 module_param(enable_fw_debug, bool, 0444);
 MODULE_PARM_DESC(enable_fw_debug, "Enable Firmware debug");
 
+static struct acp_quirk_entry quirk_valve_galileo = {
+	.signed_fw_image = true,
+	.skip_iram_dram_size_mod = true,
+};
+
 const struct dmi_system_id acp_sof_quirk_table[] = {
 	{
-		/* Valve Jupiter device */
+		/* Steam Deck OLED device */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"),
-			DMI_MATCH(DMI_PRODUCT_FAMILY, "Sephiroth"),
 		},
-		.driver_data = (void *)SECURED_FIRMWARE,
+		.driver_data = &quirk_valve_galileo,
 	},
 	{}
 };
@@ -255,12 +257,23 @@
 		}
 	}
 
-	if (adata->signed_fw_image)
+	if (adata->quirks && adata->quirks->signed_fw_image)
 		snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SHA_DMA_INCLUDE_HDR, ACP_SHA_HEADER);
 
 	snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SHA_DMA_STRT_ADDR, start_addr);
 	snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SHA_DMA_DESTINATION_ADDR, dest_addr);
 	snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SHA_MSG_LENGTH, image_length);
+
+	/* psp_send_cmd only required for vangogh platform (rev - 5) */
+	if (desc->rev == 5 && !(adata->quirks && adata->quirks->skip_iram_dram_size_mod)) {
+		/* Modify IRAM and DRAM size */
+		ret = psp_send_cmd(adata, MBOX_ACP_IRAM_DRAM_FENCE_COMMAND | IRAM_DRAM_FENCE_2);
+		if (ret)
+			return ret;
+		ret = psp_send_cmd(adata, MBOX_ACP_IRAM_DRAM_FENCE_COMMAND | MBOX_ISREADY_FLAG);
+		if (ret)
+			return ret;
+	}
 	snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SHA_DMA_CMD, ACP_SHA_RUN);
 
 	ret = snd_sof_dsp_read_poll_timeout(sdev, ACP_DSP_BAR, ACP_SHA_TRANSFER_BYTE_CNT,
@@ -278,17 +291,6 @@
 			return ret;
 	}
 
-	/* psp_send_cmd only required for vangogh platform (rev - 5) */
-	if (desc->rev == 5) {
-		/* Modify IRAM and DRAM size */
-		ret = psp_send_cmd(adata, MBOX_ACP_IRAM_DRAM_FENCE_COMMAND | IRAM_DRAM_FENCE_2);
-		if (ret)
-			return ret;
-		ret = psp_send_cmd(adata, MBOX_ACP_IRAM_DRAM_FENCE_COMMAND | MBOX_ISREADY_FLAG);
-		if (ret)
-			return ret;
-	}
-
 	ret = snd_sof_dsp_read_poll_timeout(sdev, ACP_DSP_BAR, ACP_SHA_DSP_FW_QUALIFIER,
 					    fw_qualifier, fw_qualifier & DSP_FW_RUN_ENABLE,
 					    ACP_REG_POLL_INTERVAL, ACP_DMA_COMPLETE_TIMEOUT_US);
@@ -394,6 +396,7 @@
 	const struct sof_amd_acp_desc *desc = get_chip_info(sdev->pdata);
 	unsigned int base = desc->pgfsm_base;
 	unsigned int val;
+	unsigned int acp_pgfsm_status_mask, acp_pgfsm_cntl_mask;
 	int ret;
 
 	val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, base + PGFSM_STATUS_OFFSET);
@@ -401,9 +404,23 @@
 	if (val == ACP_POWERED_ON)
 		return 0;
 
-	if (val & ACP_PGFSM_STATUS_MASK)
+	switch (desc->rev) {
+	case 3:
+	case 5:
+		acp_pgfsm_status_mask = ACP3X_PGFSM_STATUS_MASK;
+		acp_pgfsm_cntl_mask = ACP3X_PGFSM_CNTL_POWER_ON_MASK;
+		break;
+	case 6:
+		acp_pgfsm_status_mask = ACP6X_PGFSM_STATUS_MASK;
+		acp_pgfsm_cntl_mask = ACP6X_PGFSM_CNTL_POWER_ON_MASK;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (val & acp_pgfsm_status_mask)
 		snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + PGFSM_CONTROL_OFFSET,
-				  ACP_PGFSM_CNTL_POWER_ON_MASK);
+				  acp_pgfsm_cntl_mask);
 
 	ret = snd_sof_dsp_read_poll_timeout(sdev, ACP_DSP_BAR, base + PGFSM_STATUS_OFFSET, val,
 					    !val, ACP_REG_POLL_INTERVAL, ACP_REG_POLL_TIMEOUT_US);
@@ -493,7 +510,6 @@
 int amd_sof_acp_probe(struct snd_sof_dev *sdev)
 {
 	struct pci_dev *pci = to_pci_dev(sdev->dev);
-	struct snd_sof_pdata *plat_data = sdev->pdata;
 	struct acp_dev_data *adata;
 	const struct sof_amd_acp_desc *chip;
 	const struct dmi_system_id *dmi_id;
@@ -535,6 +551,10 @@
 		goto unregister_dev;
 	}
 
+	ret = acp_init(sdev);
+	if (ret < 0)
+		goto free_smn_dev;
+
 	sdev->ipc_irq = pci->irq;
 	ret = request_threaded_irq(sdev->ipc_irq, acp_irq_handler, acp_irq_thread,
 				   IRQF_SHARED, "AudioDSP", sdev);
@@ -544,10 +564,6 @@
 		goto free_smn_dev;
 	}
 
-	ret = acp_init(sdev);
-	if (ret < 0)
-		goto free_ipc_irq;
-
 	sdev->dsp_box.offset = 0;
 	sdev->dsp_box.size = BOX_SIZE_512;
 
@@ -557,20 +573,29 @@
 	sdev->debug_box.offset = sdev->host_box.offset + sdev->host_box.size;
 	sdev->debug_box.size = BOX_SIZE_1024;
 
-	adata->signed_fw_image = false;
 	dmi_id = dmi_first_match(acp_sof_quirk_table);
-	if (dmi_id && dmi_id->driver_data) {
-		adata->fw_code_bin = kasprintf(GFP_KERNEL, "%s/sof-%s-code.bin",
-					       plat_data->fw_filename_prefix,
-					       chip->name);
-		adata->fw_data_bin = kasprintf(GFP_KERNEL, "%s/sof-%s-data.bin",
-					       plat_data->fw_filename_prefix,
-					       chip->name);
-		adata->signed_fw_image = dmi_id->driver_data;
+	if (dmi_id) {
+		adata->quirks = dmi_id->driver_data;
 
-		dev_dbg(sdev->dev, "fw_code_bin:%s, fw_data_bin:%s\n", adata->fw_code_bin,
-			adata->fw_data_bin);
+		if (adata->quirks->signed_fw_image) {
+			adata->fw_code_bin = devm_kasprintf(sdev->dev, GFP_KERNEL,
+							    "sof-%s-code.bin",
+							    chip->name);
+			if (!adata->fw_code_bin) {
+				ret = -ENOMEM;
+				goto free_ipc_irq;
+			}
+
+			adata->fw_data_bin = devm_kasprintf(sdev->dev, GFP_KERNEL,
+							    "sof-%s-data.bin",
+							    chip->name);
+			if (!adata->fw_data_bin) {
+				ret = -ENOMEM;
+				goto free_ipc_irq;
+			}
+		}
 	}
+
 	adata->enable_fw_debug = enable_fw_debug;
 	acp_memory_init(sdev);
 
--- linux-qcom-6.8.0.orig/sound/soc/sof/amd/acp.h
+++ linux-qcom-6.8.0/sound/soc/sof/amd/acp.h
@@ -25,8 +25,11 @@
 #define ACP_REG_POLL_TIMEOUT_US                 2000
 #define ACP_DMA_COMPLETE_TIMEOUT_US		5000
 
-#define ACP_PGFSM_CNTL_POWER_ON_MASK		0x01
-#define ACP_PGFSM_STATUS_MASK			0x03
+#define ACP3X_PGFSM_CNTL_POWER_ON_MASK		0x01
+#define ACP3X_PGFSM_STATUS_MASK			0x03
+#define ACP6X_PGFSM_CNTL_POWER_ON_MASK		0x07
+#define ACP6X_PGFSM_STATUS_MASK			0x0F
+
 #define ACP_POWERED_ON				0x00
 #define ACP_ASSERT_RESET			0x01
 #define ACP_RELEASE_RESET			0x00
@@ -193,6 +196,11 @@
 	u32 probe_reg_offset;
 };
 
+struct acp_quirk_entry {
+	bool signed_fw_image;
+	bool skip_iram_dram_size_mod;
+};
+
 /* Common device data struct for ACP devices */
 struct acp_dev_data {
 	struct snd_sof_dev  *dev;
@@ -213,7 +221,7 @@
 	u8 *data_buf;
 	dma_addr_t sram_dma_addr;
 	u8 *sram_data_buf;
-	bool signed_fw_image;
+	struct acp_quirk_entry *quirks;
 	struct dma_descriptor dscr_info[ACP_MAX_DESC];
 	struct acp_dsp_stream stream_buf[ACP_MAX_STREAM];
 	struct acp_dsp_stream *dtrace_stream;
--- linux-qcom-6.8.0.orig/sound/soc/sof/amd/pci-vangogh.c
+++ linux-qcom-6.8.0/sound/soc/sof/amd/pci-vangogh.c
@@ -34,7 +34,6 @@
 	.dsp_intr_base	= ACP5X_DSP_SW_INTR_BASE,
 	.sram_pte_offset = ACP5X_SRAM_PTE_OFFSET,
 	.hw_semaphore_offset = ACP5X_AXI2DAGB_SEM_0,
-	.acp_clkmux_sel = ACP5X_CLKMUX_SEL,
 	.probe_reg_offset = ACP5X_FUTURE_REG_ACLK_0,
 };
 
--- linux-qcom-6.8.0.orig/sound/soc/sof/amd/vangogh.c
+++ linux-qcom-6.8.0/sound/soc/sof/amd/vangogh.c
@@ -143,6 +143,7 @@
 int sof_vangogh_ops_init(struct snd_sof_dev *sdev)
 {
 	const struct dmi_system_id *dmi_id;
+	struct acp_quirk_entry *quirks;
 
 	/* common defaults */
 	memcpy(&sof_vangogh_ops, &sof_acp_common_ops, sizeof(struct snd_sof_dsp_ops));
@@ -151,8 +152,12 @@
 	sof_vangogh_ops.num_drv = ARRAY_SIZE(vangogh_sof_dai);
 
 	dmi_id = dmi_first_match(acp_sof_quirk_table);
-	if (dmi_id && dmi_id->driver_data)
-		sof_vangogh_ops.load_firmware = acp_sof_load_signed_firmware;
+	if (dmi_id) {
+		quirks = dmi_id->driver_data;
+
+		if (quirks->signed_fw_image)
+			sof_vangogh_ops.load_firmware = acp_sof_load_signed_firmware;
+	}
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/sound/soc/sof/fw-file-profile.c
+++ linux-qcom-6.8.0/sound/soc/sof/fw-file-profile.c
@@ -89,6 +89,12 @@
 	return ret;
 }
 
+static bool sof_platform_uses_generic_loader(struct snd_sof_dev *sdev)
+{
+	return (sdev->pdata->desc->ops->load_firmware == snd_sof_load_firmware_raw ||
+		sdev->pdata->desc->ops->load_firmware == snd_sof_load_firmware_memcpy);
+}
+
 static int
 sof_file_profile_for_ipc_type(struct snd_sof_dev *sdev,
 			      enum sof_ipc_type ipc_type,
@@ -130,7 +136,8 @@
 	 * For default path and firmware name do a verification before
 	 * continuing further.
 	 */
-	if (base_profile->fw_path || base_profile->fw_name) {
+	if ((base_profile->fw_path || base_profile->fw_name) &&
+	    sof_platform_uses_generic_loader(sdev)) {
 		ret = sof_test_firmware_file(dev, out_profile, &ipc_type);
 		if (ret)
 			return ret;
@@ -181,7 +188,8 @@
 	out_profile->ipc_type = ipc_type;
 
 	/* Test only default firmware file */
-	if (!base_profile->fw_path && !base_profile->fw_name)
+	if ((!base_profile->fw_path && !base_profile->fw_name) &&
+	    sof_platform_uses_generic_loader(sdev))
 		ret = sof_test_firmware_file(dev, out_profile, NULL);
 
 	if (!ret)
@@ -267,7 +275,11 @@
 
 	dev_info(dev, "Firmware paths/files for ipc type %d:\n", profile->ipc_type);
 
-	dev_info(dev, " Firmware file:     %s/%s\n", profile->fw_path, profile->fw_name);
+	/* The firmware path is only valid when generic loader is used */
+	if (sof_platform_uses_generic_loader(sdev))
+		dev_info(dev, " Firmware file:     %s/%s\n",
+			 profile->fw_path, profile->fw_name);
+
 	if (profile->fw_lib_path)
 		dev_info(dev, " Firmware lib path: %s\n", profile->fw_lib_path);
 	dev_info(dev, " Topology file:     %s/%s\n", profile->tplg_path, profile->tplg_name);
--- linux-qcom-6.8.0.orig/sound/soc/sof/imx/imx8m.c
+++ linux-qcom-6.8.0/sound/soc/sof/imx/imx8m.c
@@ -243,7 +243,7 @@
 	/* set default mailbox offset for FW ready message */
 	sdev->dsp_box.offset = MBOX_OFFSET;
 
-	priv->regmap = syscon_regmap_lookup_by_compatible("fsl,dsp-ctrl");
+	priv->regmap = syscon_regmap_lookup_by_phandle(np, "fsl,dsp-ctrl");
 	if (IS_ERR(priv->regmap)) {
 		dev_err(sdev->dev, "cannot find dsp-ctrl registers");
 		ret = PTR_ERR(priv->regmap);
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/hda-common-ops.c
+++ linux-qcom-6.8.0/sound/soc/sof/intel/hda-common-ops.c
@@ -57,6 +57,9 @@
 	.pcm_pointer	= hda_dsp_pcm_pointer,
 	.pcm_ack	= hda_dsp_pcm_ack,
 
+	.get_dai_frame_counter = hda_dsp_get_stream_llp,
+	.get_host_byte_counter = hda_dsp_get_stream_ldp,
+
 	/* firmware loading */
 	.load_firmware = snd_sof_load_firmware_raw,
 
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/hda-dai-ops.c
+++ linux-qcom-6.8.0/sound/soc/sof/intel/hda-dai-ops.c
@@ -7,6 +7,7 @@
 
 #include <sound/pcm_params.h>
 #include <sound/hdaudio_ext.h>
+#include <sound/hda_register.h>
 #include <sound/hda-mlink.h>
 #include <sound/sof/ipc4/header.h>
 #include <uapi/sound/sof/header.h>
@@ -358,9 +359,20 @@
 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
 		snd_hdac_ext_stream_start(hext_stream);
 		break;
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+		/*
+		 * Save the LLP registers since in case of PAUSE the LLP
+		 * register are not reset to 0, the delay calculation will use
+		 * the saved offsets for compensating the delay calculation.
+		 */
+		hext_stream->pplcllpl = readl(hext_stream->pplc_addr + AZX_REG_PPLCLLPL);
+		hext_stream->pplcllpu = readl(hext_stream->pplc_addr + AZX_REG_PPLCLLPU);
+		snd_hdac_ext_stream_clear(hext_stream);
+		break;
 	case SNDRV_PCM_TRIGGER_SUSPEND:
 	case SNDRV_PCM_TRIGGER_STOP:
-	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+		hext_stream->pplcllpl = 0;
+		hext_stream->pplcllpu = 0;
 		snd_hdac_ext_stream_clear(hext_stream);
 		break;
 	default:
@@ -525,7 +537,6 @@
 static int hda_ipc3_post_trigger(struct snd_sof_dev *sdev, struct snd_soc_dai *cpu_dai,
 				 struct snd_pcm_substream *substream, int cmd)
 {
-	struct hdac_ext_stream *hext_stream = hda_get_hext_stream(sdev, cpu_dai, substream);
 	struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream);
 
 	switch (cmd) {
@@ -540,9 +551,6 @@
 		if (ret < 0)
 			return ret;
 
-		if (cmd == SNDRV_PCM_TRIGGER_STOP)
-			return hda_link_dma_cleanup(substream, hext_stream, cpu_dai);
-
 		break;
 	}
 	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/hda-dai.c
+++ linux-qcom-6.8.0/sound/soc/sof/intel/hda-dai.c
@@ -109,8 +109,10 @@
 	return sdai->platform_private;
 }
 
-int hda_link_dma_cleanup(struct snd_pcm_substream *substream, struct hdac_ext_stream *hext_stream,
-			 struct snd_soc_dai *cpu_dai)
+static int
+hda_link_dma_cleanup(struct snd_pcm_substream *substream,
+		     struct hdac_ext_stream *hext_stream,
+		     struct snd_soc_dai *cpu_dai, bool release)
 {
 	const struct hda_dai_widget_dma_ops *ops = hda_dai_get_ops(substream, cpu_dai);
 	struct sof_intel_hda_stream *hda_stream;
@@ -134,6 +136,17 @@
 		snd_hdac_ext_bus_link_clear_stream_id(hlink, stream_tag);
 	}
 
+	if (!release) {
+		/*
+		 * Force stream reconfiguration without releasing the channel on
+		 * subsequent stream restart (without free), including LinkDMA
+		 * reset.
+		 * The stream is released via hda_dai_hw_free()
+		 */
+		hext_stream->link_prepared = 0;
+		return 0;
+	}
+
 	if (ops->release_hext_stream)
 		ops->release_hext_stream(sdev, cpu_dai, substream);
 
@@ -217,7 +230,7 @@
 	if (!hext_stream)
 		return 0;
 
-	return hda_link_dma_cleanup(substream, hext_stream, cpu_dai);
+	return hda_link_dma_cleanup(substream, hext_stream, cpu_dai, true);
 }
 
 static int __maybe_unused hda_dai_hw_params(struct snd_pcm_substream *substream,
@@ -298,8 +311,10 @@
 	}
 
 	switch (cmd) {
+	case SNDRV_PCM_TRIGGER_STOP:
 	case SNDRV_PCM_TRIGGER_SUSPEND:
-		ret = hda_link_dma_cleanup(substream, hext_stream, dai);
+		ret = hda_link_dma_cleanup(substream, hext_stream, dai,
+					   cmd == SNDRV_PCM_TRIGGER_STOP ? false : true);
 		if (ret < 0) {
 			dev_err(sdev->dev, "%s: failed to clean up link DMA\n", __func__);
 			return ret;
@@ -434,10 +449,17 @@
 			  int link_id)
 {
 	struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream);
+	struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
 	const struct hda_dai_widget_dma_ops *ops;
+	struct snd_soc_dai_link_ch_map *ch_maps;
 	struct hdac_ext_stream *hext_stream;
+	struct snd_soc_dai *dai;
 	struct snd_sof_dev *sdev;
+	bool cpu_dai_found = false;
+	int cpu_dai_id;
+	int ch_mask;
 	int ret;
+	int j;
 
 	ret = non_hda_dai_hw_params(substream, params, cpu_dai);
 	if (ret < 0) {
@@ -452,9 +474,29 @@
 	if (!hext_stream)
 		return -ENODEV;
 
-	/* in the case of SoundWire we need to program the PCMSyCM registers */
+	/*
+	 * in the case of SoundWire we need to program the PCMSyCM registers. In case
+	 * of aggregated devices, we need to define the channel mask for each sublink
+	 * by reconstructing the split done in soc-pcm.c
+	 */
+	for_each_rtd_cpu_dais(rtd, cpu_dai_id, dai) {
+		if (dai == cpu_dai) {
+			cpu_dai_found = true;
+			break;
+		}
+	}
+
+	if (!cpu_dai_found)
+		return -ENODEV;
+
+	ch_mask = 0;
+	for_each_link_ch_maps(rtd->dai_link, j, ch_maps) {
+		if (ch_maps->cpu == cpu_dai_id)
+			ch_mask |= ch_maps->ch_mask;
+	}
+
 	ret = hdac_bus_eml_sdw_map_stream_ch(sof_to_bus(sdev), link_id, cpu_dai->id,
-					     GENMASK(params_channels(params) - 1, 0),
+					     ch_mask,
 					     hdac_stream(hext_stream)->stream_tag,
 					     substream->stream);
 	if (ret < 0) {
@@ -534,12 +576,6 @@
 			sdai = swidget->private;
 			ops = sdai->platform_private;
 
-			ret = hda_link_dma_cleanup(hext_stream->link_substream,
-						   hext_stream,
-						   cpu_dai);
-			if (ret < 0)
-				return ret;
-
 			/* for consistency with TRIGGER_SUSPEND  */
 			if (ops->post_trigger) {
 				ret = ops->post_trigger(sdev, cpu_dai,
@@ -548,6 +584,11 @@
 				if (ret < 0)
 					return ret;
 			}
+
+			ret = hda_link_dma_cleanup(hext_stream->link_substream,
+						   hext_stream, cpu_dai, true);
+			if (ret < 0)
+				return ret;
 		}
 	}
 
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/hda-dsp.c
+++ linux-qcom-6.8.0/sound/soc/sof/intel/hda-dsp.c
@@ -681,17 +681,27 @@
 	struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata;
 	const struct sof_intel_dsp_desc *chip = hda->desc;
 	struct hdac_bus *bus = sof_to_bus(sdev);
+	bool imr_lost = false;
 	int ret, j;
 
 	/*
-	 * The memory used for IMR boot loses its content in deeper than S3 state
-	 * We must not try IMR boot on next power up (as it will fail).
-	 *
+	 * The memory used for IMR boot loses its content in deeper than S3
+	 * state on CAVS platforms.
+	 * On ACE platforms due to the system architecture the IMR content is
+	 * lost at S3 state already, they are tailored for s2idle use.
+	 * We must not try IMR boot on next power up in these cases as it will
+	 * fail.
+	 */
+	if (sdev->system_suspend_target > SOF_SUSPEND_S3 ||
+	    (chip->hw_ip_version >= SOF_INTEL_ACE_1_0 &&
+	     sdev->system_suspend_target == SOF_SUSPEND_S3))
+		imr_lost = true;
+
+	/*
 	 * In case of firmware crash or boot failure set the skip_imr_boot to true
 	 * as well in order to try to re-load the firmware to do a 'cold' boot.
 	 */
-	if (sdev->system_suspend_target > SOF_SUSPEND_S3 ||
-	    sdev->fw_state == SOF_FW_CRASHED ||
+	if (imr_lost || sdev->fw_state == SOF_FW_CRASHED ||
 	    sdev->fw_state == SOF_FW_BOOT_FAILED)
 		hda->skip_imr_boot = true;
 
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/hda-pcm.c
+++ linux-qcom-6.8.0/sound/soc/sof/intel/hda-pcm.c
@@ -254,13 +254,48 @@
 	snd_pcm_hw_constraint_integer(substream->runtime,
 				      SNDRV_PCM_HW_PARAM_PERIODS);
 
+	/* Limit the maximum number of periods to not exceed the BDL entries count */
+	if (runtime->hw.periods_max > HDA_DSP_MAX_BDL_ENTRIES)
+		snd_pcm_hw_constraint_minmax(runtime, SNDRV_PCM_HW_PARAM_PERIODS,
+					     runtime->hw.periods_min,
+					     HDA_DSP_MAX_BDL_ENTRIES);
+
 	/* Only S16 and S32 supported by HDA hardware when used without DSP */
 	if (sdev->dspless_mode_selected)
 		snd_pcm_hw_constraint_mask64(substream->runtime, SNDRV_PCM_HW_PARAM_FORMAT,
 					     SNDRV_PCM_FMTBIT_S16 | SNDRV_PCM_FMTBIT_S32);
 
+	/*
+	 * The dsp_max_burst_size_in_ms is the length of the maximum burst size
+	 * of the host DMA in the ALSA buffer.
+	 *
+	 * On playback start the DMA will transfer dsp_max_burst_size_in_ms
+	 * amount of data in one initial burst to fill up the host DMA buffer.
+	 * Consequent DMA burst sizes are shorter and their length can vary.
+	 * To make sure that userspace allocate large enough ALSA buffer we need
+	 * to place a constraint on the buffer time.
+	 *
+	 * On capture the DMA will transfer 1ms chunks.
+	 *
+	 * Exact dsp_max_burst_size_in_ms constraint is racy, so set the
+	 * constraint to a minimum of 2x dsp_max_burst_size_in_ms.
+	 */
+	if (spcm->stream[direction].dsp_max_burst_size_in_ms)
+		snd_pcm_hw_constraint_minmax(substream->runtime,
+			SNDRV_PCM_HW_PARAM_BUFFER_TIME,
+			spcm->stream[direction].dsp_max_burst_size_in_ms * USEC_PER_MSEC * 2,
+			UINT_MAX);
+
 	/* binding pcm substream to hda stream */
 	substream->runtime->private_data = &dsp_stream->hstream;
+
+	/*
+	 * Reset the llp cache values (they are used for LLP compensation in
+	 * case the counter is not reset)
+	 */
+	dsp_stream->pplcllpl = 0;
+	dsp_stream->pplcllpu = 0;
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/hda-stream.c
+++ linux-qcom-6.8.0/sound/soc/sof/intel/hda-stream.c
@@ -1054,3 +1054,73 @@
 
 	return pos;
 }
+
+#define merge_u64(u32_u, u32_l) (((u64)(u32_u) << 32) | (u32_l))
+
+/**
+ * hda_dsp_get_stream_llp - Retrieve the LLP (Linear Link Position) of the stream
+ * @sdev: SOF device
+ * @component: ASoC component
+ * @substream: PCM substream
+ *
+ * Returns the raw Linear Link Position value
+ */
+u64 hda_dsp_get_stream_llp(struct snd_sof_dev *sdev,
+			   struct snd_soc_component *component,
+			   struct snd_pcm_substream *substream)
+{
+	struct hdac_stream *hstream = substream->runtime->private_data;
+	struct hdac_ext_stream *hext_stream = stream_to_hdac_ext_stream(hstream);
+	u32 llp_l, llp_u;
+
+	/*
+	 * The pplc_addr have been calculated during probe in
+	 * hda_dsp_stream_init():
+	 * pplc_addr = sdev->bar[HDA_DSP_PP_BAR] +
+	 *	       SOF_HDA_PPLC_BASE +
+	 *	       SOF_HDA_PPLC_MULTI * total_stream +
+	 *	       SOF_HDA_PPLC_INTERVAL * stream_index
+	 *
+	 * Use this pre-calculated address to avoid repeated re-calculation.
+	 */
+	llp_l = readl(hext_stream->pplc_addr + AZX_REG_PPLCLLPL);
+	llp_u = readl(hext_stream->pplc_addr + AZX_REG_PPLCLLPU);
+
+	/* Compensate the LLP counter with the saved offset */
+	if (hext_stream->pplcllpl || hext_stream->pplcllpu)
+		return merge_u64(llp_u, llp_l) -
+		       merge_u64(hext_stream->pplcllpu, hext_stream->pplcllpl);
+
+	return merge_u64(llp_u, llp_l);
+}
+
+/**
+ * hda_dsp_get_stream_ldp - Retrieve the LDP (Linear DMA Position) of the stream
+ * @sdev: SOF device
+ * @component: ASoC component
+ * @substream: PCM substream
+ *
+ * Returns the raw Linear Link Position value
+ */
+u64 hda_dsp_get_stream_ldp(struct snd_sof_dev *sdev,
+			   struct snd_soc_component *component,
+			   struct snd_pcm_substream *substream)
+{
+	struct hdac_stream *hstream = substream->runtime->private_data;
+	struct hdac_ext_stream *hext_stream = stream_to_hdac_ext_stream(hstream);
+	u32 ldp_l, ldp_u;
+
+	/*
+	 * The pphc_addr have been calculated during probe in
+	 * hda_dsp_stream_init():
+	 * pphc_addr = sdev->bar[HDA_DSP_PP_BAR] +
+	 *	       SOF_HDA_PPHC_BASE +
+	 *	       SOF_HDA_PPHC_INTERVAL * stream_index
+	 *
+	 * Use this pre-calculated address to avoid repeated re-calculation.
+	 */
+	ldp_l = readl(hext_stream->pphc_addr + AZX_REG_PPHCLDPL);
+	ldp_u = readl(hext_stream->pphc_addr + AZX_REG_PPHCLDPU);
+
+	return ((u64)ldp_u << 32) | ldp_l;
+}
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/hda.h
+++ linux-qcom-6.8.0/sound/soc/sof/intel/hda.h
@@ -657,6 +657,12 @@
 
 snd_pcm_uframes_t hda_dsp_stream_get_position(struct hdac_stream *hstream,
 					      int direction, bool can_sleep);
+u64 hda_dsp_get_stream_llp(struct snd_sof_dev *sdev,
+			   struct snd_soc_component *component,
+			   struct snd_pcm_substream *substream);
+u64 hda_dsp_get_stream_ldp(struct snd_sof_dev *sdev,
+			   struct snd_soc_component *component,
+			   struct snd_pcm_substream *substream);
 
 struct hdac_ext_stream *
 	hda_dsp_stream_get(struct snd_sof_dev *sdev, int direction, u32 flags);
@@ -991,7 +997,5 @@
 hda_select_dai_widget_ops(struct snd_sof_dev *sdev, struct snd_sof_widget *swidget);
 int hda_dai_config(struct snd_soc_dapm_widget *w, unsigned int flags,
 		   struct snd_sof_dai_config_data *data);
-int hda_link_dma_cleanup(struct snd_pcm_substream *substream, struct hdac_ext_stream *hext_stream,
-			 struct snd_soc_dai *cpu_dai);
 
 #endif
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/lnl.c
+++ linux-qcom-6.8.0/sound/soc/sof/intel/lnl.c
@@ -16,6 +16,7 @@
 #include "hda-ipc.h"
 #include "../sof-audio.h"
 #include "mtl.h"
+#include "lnl.h"
 #include <sound/hda-mlink.h>
 
 /* LunarLake ops */
@@ -118,8 +119,6 @@
 	sof_lnl_ops.resume			= lnl_hda_dsp_resume;
 	sof_lnl_ops.runtime_resume		= lnl_hda_dsp_runtime_resume;
 
-	sof_lnl_ops.get_stream_position = mtl_dsp_get_stream_hda_link_position;
-
 	/* dsp core get/put */
 	sof_lnl_ops.core_get = mtl_dsp_core_get;
 	sof_lnl_ops.core_put = mtl_dsp_core_put;
@@ -178,7 +177,7 @@
 	.ipc_ack = MTL_DSP_REG_HFIPCXIDA,
 	.ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE,
 	.ipc_ctl = MTL_DSP_REG_HFIPCXCTL,
-	.rom_status_reg = MTL_DSP_ROM_STS,
+	.rom_status_reg = LNL_DSP_REG_HFDSC,
 	.rom_init_timeout = 300,
 	.ssp_count = MTL_SSP_COUNT,
 	.d0i3_offset = MTL_HDA_VS_D0I3C,
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/lnl.h
+++ linux-qcom-6.8.0/sound/soc/sof/intel/lnl.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause) */
+/*
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * Copyright(c) 2024 Intel Corporation. All rights reserved.
+ */
+
+#ifndef __SOF_INTEL_LNL_H
+#define __SOF_INTEL_LNL_H
+
+#define LNL_DSP_REG_HFDSC		0x160200 /* DSP core0 status */
+#define LNL_DSP_REG_HFDEC		0x160204 /* DSP core0 error */
+
+#endif /* __SOF_INTEL_LNL_H */
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/mtl.c
+++ linux-qcom-6.8.0/sound/soc/sof/intel/mtl.c
@@ -439,7 +439,7 @@
 {
 	struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata;
 	const struct sof_intel_dsp_desc *chip = hda->desc;
-	unsigned int status;
+	unsigned int status, target_status;
 	u32 ipc_hdr, flags;
 	char *dump_msg;
 	int ret;
@@ -485,13 +485,40 @@
 
 	mtl_enable_ipc_interrupts(sdev);
 
+	if (chip->rom_status_reg == MTL_DSP_ROM_STS) {
+		/*
+		 * Workaround: when the ROM status register is pointing to
+		 * the SRAM window (MTL_DSP_ROM_STS) the platform cannot catch
+		 * ROM_INIT_DONE because of a very short timing window.
+		 * Follow the recommendations and skip target state waiting.
+		 */
+		return 0;
+	}
+
 	/*
-	 * ACE workaround: don't wait for ROM INIT.
-	 * The platform cannot catch ROM_INIT_DONE because of a very short
-	 * timing window. Follow the recommendations and skip this part.
+	 * step 7:
+	 * - Cold/Full boot: wait for ROM init to proceed to download the firmware
+	 * - IMR boot: wait for ROM firmware entered (firmware booted up from IMR)
 	 */
+	if (imr_boot)
+		target_status = FSR_STATE_FW_ENTERED;
+	else
+		target_status = FSR_STATE_INIT_DONE;
+
+	ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR,
+					chip->rom_status_reg, status,
+					(FSR_TO_STATE_CODE(status) == target_status),
+					HDA_DSP_REG_POLL_INTERVAL_US,
+					chip->rom_init_timeout *
+					USEC_PER_MSEC);
 
-	return 0;
+	if (!ret)
+		return 0;
+
+	if (hda->boot_iteration == HDA_FW_BOOT_ATTEMPTS)
+		dev_err(sdev->dev,
+			"%s: timeout with rom_status_reg (%#x) read\n",
+			__func__, chip->rom_status_reg);
 
 err:
 	flags = SOF_DBG_DUMP_PCI | SOF_DBG_DUMP_MBOX | SOF_DBG_DUMP_OPTIONAL;
@@ -503,6 +530,7 @@
 	dump_msg = kasprintf(GFP_KERNEL, "Boot iteration failed: %d/%d",
 			     hda->boot_iteration, HDA_FW_BOOT_ATTEMPTS);
 	snd_sof_dsp_dbg_dump(sdev, dump_msg, flags);
+	mtl_enable_interrupts(sdev, false);
 	mtl_dsp_core_power_down(sdev, SOF_DSP_PRIMARY_CORE);
 
 	kfree(dump_msg);
@@ -626,18 +654,6 @@
 	return mtl_enable_interrupts(sdev, false);
 }
 
-u64 mtl_dsp_get_stream_hda_link_position(struct snd_sof_dev *sdev,
-					 struct snd_soc_component *component,
-					 struct snd_pcm_substream *substream)
-{
-	struct hdac_stream *hstream = substream->runtime->private_data;
-	u32 llp_l, llp_u;
-
-	llp_l = snd_sof_dsp_read(sdev, HDA_DSP_HDA_BAR, MTL_PPLCLLPL(hstream->index));
-	llp_u = snd_sof_dsp_read(sdev, HDA_DSP_HDA_BAR, MTL_PPLCLLPU(hstream->index));
-	return ((u64)llp_u << 32) | llp_l;
-}
-
 int mtl_dsp_core_get(struct snd_sof_dev *sdev, int core)
 {
 	const struct sof_ipc_pm_ops *pm_ops = sdev->ipc->ops->pm;
@@ -707,8 +723,6 @@
 	sof_mtl_ops.core_get = mtl_dsp_core_get;
 	sof_mtl_ops.core_put = mtl_dsp_core_put;
 
-	sof_mtl_ops.get_stream_position = mtl_dsp_get_stream_hda_link_position;
-
 	sdev->private = kzalloc(sizeof(struct sof_ipc4_fw_data), GFP_KERNEL);
 	if (!sdev->private)
 		return -ENOMEM;
@@ -741,7 +755,7 @@
 	.ipc_ack = MTL_DSP_REG_HFIPCXIDA,
 	.ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE,
 	.ipc_ctl = MTL_DSP_REG_HFIPCXCTL,
-	.rom_status_reg = MTL_DSP_ROM_STS,
+	.rom_status_reg = MTL_DSP_REG_HFFLGPXQWY,
 	.rom_init_timeout	= 300,
 	.ssp_count = MTL_SSP_COUNT,
 	.ssp_base_offset = CNL_SSP_BASE_OFFSET,
@@ -769,7 +783,7 @@
 	.ipc_ack = MTL_DSP_REG_HFIPCXIDA,
 	.ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE,
 	.ipc_ctl = MTL_DSP_REG_HFIPCXCTL,
-	.rom_status_reg = MTL_DSP_ROM_STS,
+	.rom_status_reg = MTL_DSP_REG_HFFLGPXQWY,
 	.rom_init_timeout	= 300,
 	.ssp_count = MTL_SSP_COUNT,
 	.ssp_base_offset = CNL_SSP_BASE_OFFSET,
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/mtl.h
+++ linux-qcom-6.8.0/sound/soc/sof/intel/mtl.h
@@ -6,12 +6,6 @@
  * Copyright(c) 2020-2022 Intel Corporation. All rights reserved.
  */
 
-/* HDA Registers */
-#define MTL_PPLCLLPL_BASE		0x948
-#define MTL_PPLCLLPU_STRIDE		0x10
-#define MTL_PPLCLLPL(x)			(MTL_PPLCLLPL_BASE + (x) * MTL_PPLCLLPU_STRIDE)
-#define MTL_PPLCLLPU(x)			(MTL_PPLCLLPL_BASE + 0x4 + (x) * MTL_PPLCLLPU_STRIDE)
-
 /* DSP Registers */
 #define MTL_HFDSSCS			0x1000
 #define MTL_HFDSSCS_SPA_MASK		BIT(16)
@@ -76,8 +70,8 @@
 #define MTL_DSP_ROM_STS			MTL_SRAM_WINDOW_OFFSET(0) /* ROM status */
 #define MTL_DSP_ROM_ERROR		(MTL_SRAM_WINDOW_OFFSET(0) + 0x4) /* ROM error code */
 
-#define MTL_DSP_REG_HFFLGPXQWY		0x163200 /* ROM debug status */
-#define MTL_DSP_REG_HFFLGPXQWY_ERROR	0x163204 /* ROM debug error code */
+#define MTL_DSP_REG_HFFLGPXQWY		0x163200 /* DSP core0 status */
+#define MTL_DSP_REG_HFFLGPXQWY_ERROR	0x163204 /* DSP core0 error */
 #define MTL_DSP_REG_HfIMRIS1		0x162088
 #define MTL_DSP_REG_HfIMRIS1_IU_MASK	BIT(0)
 
@@ -103,9 +97,5 @@
 
 void mtl_ipc_dump(struct snd_sof_dev *sdev);
 
-u64 mtl_dsp_get_stream_hda_link_position(struct snd_sof_dev *sdev,
-					 struct snd_soc_component *component,
-					 struct snd_pcm_substream *substream);
-
 int mtl_dsp_core_get(struct snd_sof_dev *sdev, int core);
 int mtl_dsp_core_put(struct snd_sof_dev *sdev, int core);
--- linux-qcom-6.8.0.orig/sound/soc/sof/intel/pci-lnl.c
+++ linux-qcom-6.8.0/sound/soc/sof/intel/pci-lnl.c
@@ -35,6 +35,9 @@
 	.default_fw_path = {
 		[SOF_IPC_TYPE_4] = "intel/sof-ipc4/lnl",
 	},
+	.default_lib_path = {
+		[SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/lnl",
+	},
 	.default_tplg_path = {
 		[SOF_IPC_TYPE_4] = "intel/sof-ipc4-tplg",
 	},
--- linux-qcom-6.8.0.orig/sound/soc/sof/ipc3-loader.c
+++ linux-qcom-6.8.0/sound/soc/sof/ipc3-loader.c
@@ -148,6 +148,8 @@
 
 	head = (struct sof_ext_man_header *)fw->data;
 	remaining = head->full_size - head->header_size;
+	if (remaining < 0 || remaining > sdev->basefw.fw->size)
+		return -EINVAL;
 	ext_man_size = ipc3_fw_ext_man_size(sdev, fw);
 
 	/* Assert firmware starts with extended manifest */
--- linux-qcom-6.8.0.orig/sound/soc/sof/ipc3-pcm.c
+++ linux-qcom-6.8.0/sound/soc/sof/ipc3-pcm.c
@@ -409,4 +409,5 @@
 	.trigger = sof_ipc3_pcm_trigger,
 	.dai_link_fixup = sof_ipc3_pcm_dai_link_fixup,
 	.reset_hw_params_during_stop = true,
+	.d0i3_supported_in_s0ix = true,
 };
--- linux-qcom-6.8.0.orig/sound/soc/sof/ipc3-topology.c
+++ linux-qcom-6.8.0/sound/soc/sof/ipc3-topology.c
@@ -20,6 +20,9 @@
 /* size of tplg ABI in bytes */
 #define SOF_IPC3_TPLG_ABI_SIZE 3
 
+/* Base of SOF_DAI_INTEL_ALH, this should be aligned with SOC_SDW_INTEL_BIDIR_PDI_BASE */
+#define INTEL_ALH_DAI_INDEX_BASE 2
+
 struct sof_widget_data {
 	int ctrl_type;
 	int ipc_cmd;
@@ -1548,14 +1551,26 @@
 	ret = sof_update_ipc_object(scomp, comp_dai, SOF_DAI_TOKENS, swidget->tuples,
 				    swidget->num_tuples, sizeof(*comp_dai), 1);
 	if (ret < 0)
-		goto free;
+		goto free_comp;
 
 	/* update comp_tokens */
 	ret = sof_update_ipc_object(scomp, &comp_dai->config, SOF_COMP_TOKENS,
 				    swidget->tuples, swidget->num_tuples,
 				    sizeof(comp_dai->config), 1);
 	if (ret < 0)
-		goto free;
+		goto free_comp;
+
+	/* Subtract the base to match the FW dai index. */
+	if (comp_dai->type == SOF_DAI_INTEL_ALH) {
+		if (comp_dai->dai_index < INTEL_ALH_DAI_INDEX_BASE) {
+			dev_err(sdev->dev,
+				"Invalid ALH dai index %d, only Pin numbers >= %d can be used\n",
+				comp_dai->dai_index, INTEL_ALH_DAI_INDEX_BASE);
+			ret = -EINVAL;
+			goto free_comp;
+		}
+		comp_dai->dai_index -= INTEL_ALH_DAI_INDEX_BASE;
+	}
 
 	dev_dbg(scomp->dev, "dai %s: type %d index %d\n",
 		swidget->widget->name, comp_dai->type, comp_dai->dai_index);
@@ -2127,8 +2142,16 @@
 	case SOF_DAI_INTEL_ALH:
 		if (data) {
 			/* save the dai_index during hw_params and reuse it for hw_free */
-			if (flags & SOF_DAI_CONFIG_FLAGS_HW_PARAMS)
-				config->dai_index = data->dai_index;
+			if (flags & SOF_DAI_CONFIG_FLAGS_HW_PARAMS) {
+				/* Subtract the base to match the FW dai index. */
+				if (data->dai_index < INTEL_ALH_DAI_INDEX_BASE) {
+					dev_err(sdev->dev,
+						"Invalid ALH dai index %d, only Pin numbers >= %d can be used\n",
+						config->dai_index, INTEL_ALH_DAI_INDEX_BASE);
+					return -EINVAL;
+				}
+				config->dai_index = data->dai_index - INTEL_ALH_DAI_INDEX_BASE;
+			}
 			config->alh.stream_id = data->dai_data;
 		}
 		break;
--- linux-qcom-6.8.0.orig/sound/soc/sof/ipc4-pcm.c
+++ linux-qcom-6.8.0/sound/soc/sof/ipc4-pcm.c
@@ -15,6 +15,44 @@
 #include "ipc4-topology.h"
 #include "ipc4-fw-reg.h"
 
+/**
+ * struct sof_ipc4_timestamp_info - IPC4 timestamp info
+ * @host_copier: the host copier of the pcm stream
+ * @dai_copier: the dai copier of the pcm stream
+ * @stream_start_offset: reported by fw in memory window (converted to frames)
+ * @stream_end_offset: reported by fw in memory window (converted to frames)
+ * @llp_offset: llp offset in memory window
+ * @boundary: wrap boundary should be used for the LLP frame counter
+ * @delay: Calculated and stored in pointer callback. The stored value is
+ *	   returned in the delay callback.
+ */
+struct sof_ipc4_timestamp_info {
+	struct sof_ipc4_copier *host_copier;
+	struct sof_ipc4_copier *dai_copier;
+	u64 stream_start_offset;
+	u64 stream_end_offset;
+	u32 llp_offset;
+
+	u64 boundary;
+	snd_pcm_sframes_t delay;
+};
+
+/**
+ * struct sof_ipc4_pcm_stream_priv - IPC4 specific private data
+ * @time_info: pointer to time info struct if it is supported, otherwise NULL
+ */
+struct sof_ipc4_pcm_stream_priv {
+	struct sof_ipc4_timestamp_info *time_info;
+};
+
+static inline struct sof_ipc4_timestamp_info *
+sof_ipc4_sps_to_time_info(struct snd_sof_pcm_stream *sps)
+{
+	struct sof_ipc4_pcm_stream_priv *stream_priv = sps->private;
+
+	return stream_priv->time_info;
+}
+
 static int sof_ipc4_set_multi_pipeline_state(struct snd_sof_dev *sdev, u32 state,
 					     struct ipc4_pipeline_set_state_data *trigger_list)
 {
@@ -406,8 +444,19 @@
 	}
 
 	/* return if this is the final state */
-	if (state == SOF_IPC4_PIPE_PAUSED)
+	if (state == SOF_IPC4_PIPE_PAUSED) {
+		struct sof_ipc4_timestamp_info *time_info;
+
+		/*
+		 * Invalidate the stream_start_offset to make sure that it is
+		 * going to be updated if the stream resumes
+		 */
+		time_info = sof_ipc4_sps_to_time_info(&spcm->stream[substream->stream]);
+		if (time_info)
+			time_info->stream_start_offset = SOF_IPC4_INVALID_STREAM_POSITION;
+
 		goto free;
+	}
 skip_pause_transition:
 	/* else set the RUNNING/RESET state in the DSP */
 	ret = sof_ipc4_set_multi_pipeline_state(sdev, state, trigger_list);
@@ -447,14 +496,12 @@
 
 	/* determine the pipeline state */
 	switch (cmd) {
-	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-		state = SOF_IPC4_PIPE_PAUSED;
-		break;
 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
 	case SNDRV_PCM_TRIGGER_RESUME:
 	case SNDRV_PCM_TRIGGER_START:
 		state = SOF_IPC4_PIPE_RUNNING;
 		break;
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
 	case SNDRV_PCM_TRIGGER_SUSPEND:
 	case SNDRV_PCM_TRIGGER_STOP:
 		state = SOF_IPC4_PIPE_PAUSED;
@@ -658,12 +705,16 @@
 static void sof_ipc4_pcm_free(struct snd_sof_dev *sdev, struct snd_sof_pcm *spcm)
 {
 	struct snd_sof_pcm_stream_pipeline_list *pipeline_list;
+	struct sof_ipc4_pcm_stream_priv *stream_priv;
 	int stream;
 
 	for_each_pcm_streams(stream) {
 		pipeline_list = &spcm->stream[stream].pipeline_list;
 		kfree(pipeline_list->pipelines);
 		pipeline_list->pipelines = NULL;
+
+		stream_priv = spcm->stream[stream].private;
+		kfree(stream_priv->time_info);
 		kfree(spcm->stream[stream].private);
 		spcm->stream[stream].private = NULL;
 	}
@@ -673,7 +724,8 @@
 {
 	struct snd_sof_pcm_stream_pipeline_list *pipeline_list;
 	struct sof_ipc4_fw_data *ipc4_data = sdev->private;
-	struct sof_ipc4_timestamp_info *stream_info;
+	struct sof_ipc4_pcm_stream_priv *stream_priv;
+	struct sof_ipc4_timestamp_info *time_info;
 	bool support_info = true;
 	u32 abi_version;
 	u32 abi_offset;
@@ -686,6 +738,10 @@
 	if (abi_version < SOF_IPC4_FW_REGS_ABI_VER)
 		support_info = false;
 
+	/* For delay reporting the get_host_byte_counter callback is needed */
+	if (!sof_ops(sdev) || !sof_ops(sdev)->get_host_byte_counter)
+		support_info = false;
+
 	for_each_pcm_streams(stream) {
 		pipeline_list = &spcm->stream[stream].pipeline_list;
 
@@ -697,33 +753,41 @@
 			return -ENOMEM;
 		}
 
+		stream_priv = kzalloc(sizeof(*stream_priv), GFP_KERNEL);
+		if (!stream_priv) {
+			sof_ipc4_pcm_free(sdev, spcm);
+			return -ENOMEM;
+		}
+
+		spcm->stream[stream].private = stream_priv;
+
 		if (!support_info)
 			continue;
 
-		stream_info = kzalloc(sizeof(*stream_info), GFP_KERNEL);
-		if (!stream_info) {
+		time_info = kzalloc(sizeof(*time_info), GFP_KERNEL);
+		if (!time_info) {
 			sof_ipc4_pcm_free(sdev, spcm);
 			return -ENOMEM;
 		}
 
-		spcm->stream[stream].private = stream_info;
+		stream_priv->time_info = time_info;
 	}
 
 	return 0;
 }
 
-static void sof_ipc4_build_time_info(struct snd_sof_dev *sdev, struct snd_sof_pcm_stream *spcm)
+static void sof_ipc4_build_time_info(struct snd_sof_dev *sdev, struct snd_sof_pcm_stream *sps)
 {
 	struct sof_ipc4_copier *host_copier = NULL;
 	struct sof_ipc4_copier *dai_copier = NULL;
 	struct sof_ipc4_llp_reading_slot llp_slot;
-	struct sof_ipc4_timestamp_info *info;
+	struct sof_ipc4_timestamp_info *time_info;
 	struct snd_soc_dapm_widget *widget;
 	struct snd_sof_dai *dai;
 	int i;
 
 	/* find host & dai to locate info in memory window */
-	for_each_dapm_widgets(spcm->list, i, widget) {
+	for_each_dapm_widgets(sps->list, i, widget) {
 		struct snd_sof_widget *swidget = widget->dobj.private;
 
 		if (!swidget)
@@ -743,44 +807,44 @@
 		return;
 	}
 
-	info = spcm->private;
-	info->host_copier = host_copier;
-	info->dai_copier = dai_copier;
-	info->llp_offset = offsetof(struct sof_ipc4_fw_registers, llp_gpdma_reading_slots) +
-				    sdev->fw_info_box.offset;
+	time_info = sof_ipc4_sps_to_time_info(sps);
+	time_info->host_copier = host_copier;
+	time_info->dai_copier = dai_copier;
+	time_info->llp_offset = offsetof(struct sof_ipc4_fw_registers,
+					 llp_gpdma_reading_slots) + sdev->fw_info_box.offset;
 
 	/* find llp slot used by current dai */
 	for (i = 0; i < SOF_IPC4_MAX_LLP_GPDMA_READING_SLOTS; i++) {
-		sof_mailbox_read(sdev, info->llp_offset, &llp_slot, sizeof(llp_slot));
+		sof_mailbox_read(sdev, time_info->llp_offset, &llp_slot, sizeof(llp_slot));
 		if (llp_slot.node_id == dai_copier->data.gtw_cfg.node_id)
 			break;
 
-		info->llp_offset += sizeof(llp_slot);
+		time_info->llp_offset += sizeof(llp_slot);
 	}
 
 	if (i < SOF_IPC4_MAX_LLP_GPDMA_READING_SLOTS)
 		return;
 
 	/* if no llp gpdma slot is used, check aggregated sdw slot */
-	info->llp_offset = offsetof(struct sof_ipc4_fw_registers, llp_sndw_reading_slots) +
-					sdev->fw_info_box.offset;
+	time_info->llp_offset = offsetof(struct sof_ipc4_fw_registers,
+					 llp_sndw_reading_slots) + sdev->fw_info_box.offset;
 	for (i = 0; i < SOF_IPC4_MAX_LLP_SNDW_READING_SLOTS; i++) {
-		sof_mailbox_read(sdev, info->llp_offset, &llp_slot, sizeof(llp_slot));
+		sof_mailbox_read(sdev, time_info->llp_offset, &llp_slot, sizeof(llp_slot));
 		if (llp_slot.node_id == dai_copier->data.gtw_cfg.node_id)
 			break;
 
-		info->llp_offset += sizeof(llp_slot);
+		time_info->llp_offset += sizeof(llp_slot);
 	}
 
 	if (i < SOF_IPC4_MAX_LLP_SNDW_READING_SLOTS)
 		return;
 
 	/* check EVAD slot */
-	info->llp_offset = offsetof(struct sof_ipc4_fw_registers, llp_evad_reading_slot) +
-					sdev->fw_info_box.offset;
-	sof_mailbox_read(sdev, info->llp_offset, &llp_slot, sizeof(llp_slot));
+	time_info->llp_offset = offsetof(struct sof_ipc4_fw_registers,
+					 llp_evad_reading_slot) + sdev->fw_info_box.offset;
+	sof_mailbox_read(sdev, time_info->llp_offset, &llp_slot, sizeof(llp_slot));
 	if (llp_slot.node_id != dai_copier->data.gtw_cfg.node_id)
-		info->llp_offset = 0;
+		time_info->llp_offset = 0;
 }
 
 static int sof_ipc4_pcm_hw_params(struct snd_soc_component *component,
@@ -797,7 +861,7 @@
 	if (!spcm)
 		return -EINVAL;
 
-	time_info = spcm->stream[substream->stream].private;
+	time_info = sof_ipc4_sps_to_time_info(&spcm->stream[substream->stream]);
 	/* delay calculation is not supported by current fw_reg ABI */
 	if (!time_info)
 		return 0;
@@ -812,13 +876,12 @@
 
 static int sof_ipc4_get_stream_start_offset(struct snd_sof_dev *sdev,
 					    struct snd_pcm_substream *substream,
-					    struct snd_sof_pcm_stream *stream,
+					    struct snd_sof_pcm_stream *sps,
 					    struct sof_ipc4_timestamp_info *time_info)
 {
 	struct sof_ipc4_copier *host_copier = time_info->host_copier;
 	struct sof_ipc4_copier *dai_copier = time_info->dai_copier;
 	struct sof_ipc4_pipeline_registers ppl_reg;
-	u64 stream_start_position;
 	u32 dai_sample_size;
 	u32 ch, node_index;
 	u32 offset;
@@ -835,38 +898,51 @@
 	if (ppl_reg.stream_start_offset == SOF_IPC4_INVALID_STREAM_POSITION)
 		return -EINVAL;
 
-	stream_start_position = ppl_reg.stream_start_offset;
 	ch = dai_copier->data.out_format.fmt_cfg;
 	ch = SOF_IPC4_AUDIO_FORMAT_CFG_CHANNELS_COUNT(ch);
 	dai_sample_size = (dai_copier->data.out_format.bit_depth >> 3) * ch;
-	/* convert offset to sample count */
-	do_div(stream_start_position, dai_sample_size);
-	time_info->stream_start_offset = stream_start_position;
+
+	/* convert offsets to frame count */
+	time_info->stream_start_offset = ppl_reg.stream_start_offset;
+	do_div(time_info->stream_start_offset, dai_sample_size);
+	time_info->stream_end_offset = ppl_reg.stream_end_offset;
+	do_div(time_info->stream_end_offset, dai_sample_size);
+
+	/*
+	 * Calculate the wrap boundary need to be used for delay calculation
+	 * The host counter is in bytes, it will wrap earlier than the frames
+	 * based link counter.
+	 */
+	time_info->boundary = div64_u64(~((u64)0),
+					frames_to_bytes(substream->runtime, 1));
+	/* Initialize the delay value to 0 (no delay) */
+	time_info->delay = 0;
 
 	return 0;
 }
 
-static snd_pcm_sframes_t sof_ipc4_pcm_delay(struct snd_soc_component *component,
-					    struct snd_pcm_substream *substream)
+static int sof_ipc4_pcm_pointer(struct snd_soc_component *component,
+				struct snd_pcm_substream *substream,
+				snd_pcm_uframes_t *pointer)
 {
 	struct snd_sof_dev *sdev = snd_soc_component_get_drvdata(component);
 	struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
 	struct sof_ipc4_timestamp_info *time_info;
 	struct sof_ipc4_llp_reading_slot llp;
-	snd_pcm_uframes_t head_ptr, tail_ptr;
-	struct snd_sof_pcm_stream *stream;
+	snd_pcm_uframes_t head_cnt, tail_cnt;
+	struct snd_sof_pcm_stream *sps;
+	u64 dai_cnt, host_cnt, host_ptr;
 	struct snd_sof_pcm *spcm;
-	u64 tmp_ptr;
 	int ret;
 
 	spcm = snd_sof_find_spcm_dai(component, rtd);
 	if (!spcm)
-		return 0;
+		return -EOPNOTSUPP;
 
-	stream = &spcm->stream[substream->stream];
-	time_info = stream->private;
+	sps = &spcm->stream[substream->stream];
+	time_info = sof_ipc4_sps_to_time_info(sps);
 	if (!time_info)
-		return 0;
+		return -EOPNOTSUPP;
 
 	/*
 	 * stream_start_offset is updated to memory window by FW based on
@@ -874,47 +950,116 @@
 	 * the statistics is complete. And it will not change after the first initiailization.
 	 */
 	if (time_info->stream_start_offset == SOF_IPC4_INVALID_STREAM_POSITION) {
-		ret = sof_ipc4_get_stream_start_offset(sdev, substream, stream, time_info);
+		ret = sof_ipc4_get_stream_start_offset(sdev, substream, sps, time_info);
 		if (ret < 0)
-			return 0;
+			return -EOPNOTSUPP;
 	}
 
+	/* For delay calculation we need the host counter */
+	host_cnt = snd_sof_pcm_get_host_byte_counter(sdev, component, substream);
+	host_ptr = host_cnt;
+
+	/* convert the host_cnt to frames */
+	host_cnt = div64_u64(host_cnt, frames_to_bytes(substream->runtime, 1));
+
 	/*
-	 * HDaudio links don't support the LLP counter reported by firmware
-	 * the link position is read directly from hardware registers.
+	 * If the LLP counter is not reported by firmware in the SRAM window
+	 * then read the dai (link) counter via host accessible means if
+	 * available.
 	 */
 	if (!time_info->llp_offset) {
-		tmp_ptr = snd_sof_pcm_get_stream_position(sdev, component, substream);
-		if (!tmp_ptr)
-			return 0;
+		dai_cnt = snd_sof_pcm_get_dai_frame_counter(sdev, component, substream);
+		if (!dai_cnt)
+			return -EOPNOTSUPP;
 	} else {
 		sof_mailbox_read(sdev, time_info->llp_offset, &llp, sizeof(llp));
-		tmp_ptr = ((u64)llp.reading.llp_u << 32) | llp.reading.llp_l;
+		dai_cnt = ((u64)llp.reading.llp_u << 32) | llp.reading.llp_l;
 	}
+	dai_cnt += time_info->stream_end_offset;
 
-	/* In two cases dai dma position is not accurate
+	/* In two cases dai dma counter is not accurate
 	 * (1) dai pipeline is started before host pipeline
-	 * (2) multiple streams mixed into one. Each stream has the same dai dma position
+	 * (2) multiple streams mixed into one. Each stream has the same dai dma
+	 *     counter
 	 *
-	 * Firmware calculates correct stream_start_offset for all cases including above two.
-	 * Driver subtracts stream_start_offset from dai dma position to get accurate one
+	 * Firmware calculates correct stream_start_offset for all cases
+	 * including above two.
+	 * Driver subtracts stream_start_offset from dai dma counter to get
+	 * accurate one
 	 */
-	tmp_ptr -= time_info->stream_start_offset;
 
-	/* Calculate the delay taking into account that both pointer can wrap */
-	div64_u64_rem(tmp_ptr, substream->runtime->boundary, &tmp_ptr);
+	/*
+	 * On stream start the dai counter might not yet have reached the
+	 * stream_start_offset value which means that no frames have left the
+	 * DSP yet from the audio stream (on playback, capture streams have
+	 * offset of 0 as we start capturing right away).
+	 * In this case we need to adjust the distance between the counters by
+	 * increasing the host counter by (offset - dai_counter).
+	 * Otherwise the dai_counter needs to be adjusted to reflect the number
+	 * of valid frames passed on the DAI side.
+	 *
+	 * The delay is the difference between the counters on the two
+	 * sides of the DSP.
+	 */
+	if (dai_cnt < time_info->stream_start_offset) {
+		host_cnt += time_info->stream_start_offset - dai_cnt;
+		dai_cnt = 0;
+	} else {
+		dai_cnt -= time_info->stream_start_offset;
+	}
+
+	/* Wrap the dai counter at the boundary where the host counter wraps */
+	div64_u64_rem(dai_cnt, time_info->boundary, &dai_cnt);
+
 	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-		head_ptr = substream->runtime->status->hw_ptr;
-		tail_ptr = tmp_ptr;
+		head_cnt = host_cnt;
+		tail_cnt = dai_cnt;
 	} else {
-		head_ptr = tmp_ptr;
-		tail_ptr = substream->runtime->status->hw_ptr;
+		head_cnt = dai_cnt;
+		tail_cnt = host_cnt;
+	}
+
+	if (head_cnt < tail_cnt) {
+		time_info->delay = time_info->boundary - tail_cnt + head_cnt;
+		goto out;
 	}
 
-	if (head_ptr < tail_ptr)
-		return substream->runtime->boundary - tail_ptr + head_ptr;
+	time_info->delay =  head_cnt - tail_cnt;
+
+out:
+	/*
+	 * Convert the host byte counter to PCM pointer which wraps in buffer
+	 * and it is in frames
+	 */
+	div64_u64_rem(host_ptr, snd_pcm_lib_buffer_bytes(substream), &host_ptr);
+	*pointer = bytes_to_frames(substream->runtime, host_ptr);
+
+	return 0;
+}
+
+static snd_pcm_sframes_t sof_ipc4_pcm_delay(struct snd_soc_component *component,
+					    struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
+	struct sof_ipc4_timestamp_info *time_info;
+	struct snd_sof_pcm *spcm;
+
+	spcm = snd_sof_find_spcm_dai(component, rtd);
+	if (!spcm)
+		return 0;
+
+	time_info = sof_ipc4_sps_to_time_info(&spcm->stream[substream->stream]);
+	/*
+	 * Report the stored delay value calculated in the pointer callback.
+	 * In the unlikely event that the calculation was skipped/aborted, the
+	 * default 0 delay returned.
+	 */
+	if (time_info)
+		return time_info->delay;
+
+	/* No delay information available, report 0 as delay */
+	return 0;
 
-	return head_ptr - tail_ptr;
 }
 
 const struct sof_ipc_pcm_ops ipc4_pcm_ops = {
@@ -924,6 +1069,7 @@
 	.dai_link_fixup = sof_ipc4_pcm_dai_link_fixup,
 	.pcm_setup = sof_ipc4_pcm_setup,
 	.pcm_free = sof_ipc4_pcm_free,
+	.pointer = sof_ipc4_pcm_pointer,
 	.delay = sof_ipc4_pcm_delay,
 	.ipc_first_on_start = true,
 	.platform_stop_during_hw_free = true,
--- linux-qcom-6.8.0.orig/sound/soc/sof/ipc4-priv.h
+++ linux-qcom-6.8.0/sound/soc/sof/ipc4-priv.h
@@ -88,20 +88,6 @@
 	struct mutex pipeline_state_mutex; /* protect pipeline triggers, ref counts and states */
 };
 
-/**
- * struct sof_ipc4_timestamp_info - IPC4 timestamp info
- * @host_copier: the host copier of the pcm stream
- * @dai_copier: the dai copier of the pcm stream
- * @stream_start_offset: reported by fw in memory window
- * @llp_offset: llp offset in memory window
- */
-struct sof_ipc4_timestamp_info {
-	struct sof_ipc4_copier *host_copier;
-	struct sof_ipc4_copier *dai_copier;
-	u64 stream_start_offset;
-	u32 llp_offset;
-};
-
 extern const struct sof_ipc_fw_loader_ops ipc4_loader_ops;
 extern const struct sof_ipc_tplg_ops ipc4_tplg_ops;
 extern const struct sof_ipc_tplg_control_ops tplg_ipc4_control_ops;
--- linux-qcom-6.8.0.orig/sound/soc/sof/ipc4-topology.c
+++ linux-qcom-6.8.0/sound/soc/sof/ipc4-topology.c
@@ -217,6 +217,14 @@
 	}
 
 	process = swidget->private;
+
+	/*
+	 * For process modules without base config extension, base module config
+	 * format is used for all input pins
+	 */
+	if (process->init_config != SOF_IPC4_MODULE_INIT_CONFIG_TYPE_BASE_CFG_WITH_EXT)
+		return &process->base_config.audio_fmt;
+
 	base_cfg_ext = process->base_config_ext;
 
 	/*
@@ -412,8 +420,9 @@
 	struct sof_ipc4_available_audio_format *available_fmt;
 	struct snd_soc_component *scomp = swidget->scomp;
 	struct sof_ipc4_copier *ipc4_copier;
+	struct snd_sof_pcm *spcm;
 	int node_type = 0;
-	int ret;
+	int ret, dir;
 
 	ipc4_copier = kzalloc(sizeof(*ipc4_copier), GFP_KERNEL);
 	if (!ipc4_copier)
@@ -447,6 +456,25 @@
 	}
 	dev_dbg(scomp->dev, "host copier '%s' node_type %u\n", swidget->widget->name, node_type);
 
+	spcm = snd_sof_find_spcm_comp(scomp, swidget->comp_id, &dir);
+	if (!spcm)
+		goto skip_gtw_cfg;
+
+	if (dir == SNDRV_PCM_STREAM_PLAYBACK) {
+		struct snd_sof_pcm_stream *sps = &spcm->stream[dir];
+
+		sof_update_ipc_object(scomp, &sps->dsp_max_burst_size_in_ms,
+				      SOF_COPIER_DEEP_BUFFER_TOKENS,
+				      swidget->tuples,
+				      swidget->num_tuples, sizeof(u32), 1);
+		/* Set default DMA buffer size if it is not specified in topology */
+		if (!sps->dsp_max_burst_size_in_ms)
+			sps->dsp_max_burst_size_in_ms = SOF_IPC4_MIN_DMA_BUFFER_SIZE;
+	} else {
+		/* Capture data is copied from DSP to host in 1ms bursts */
+		spcm->stream[dir].dsp_max_burst_size_in_ms = 1;
+	}
+
 skip_gtw_cfg:
 	ipc4_copier->gtw_attr = kzalloc(sizeof(*ipc4_copier->gtw_attr), GFP_KERNEL);
 	if (!ipc4_copier->gtw_attr) {
@@ -1265,7 +1293,13 @@
 		ipc4_copier = dai->private;
 
 		if (pipeline->use_chain_dma) {
-			pipeline->msg.primary = 0;
+			/*
+			 * Preserve the DMA Link ID and clear other bits since
+			 * the DMA Link ID is only configured once during
+			 * dai_config, other fields are expected to be 0 for
+			 * re-configuration
+			 */
+			pipeline->msg.primary &= SOF_IPC4_GLB_CHAIN_DMA_LINK_ID_MASK;
 			pipeline->msg.extension = 0;
 		}
 
@@ -2573,7 +2607,7 @@
 static int sof_ipc4_set_copier_sink_format(struct snd_sof_dev *sdev,
 					   struct snd_sof_widget *src_widget,
 					   struct snd_sof_widget *sink_widget,
-					   int sink_id)
+					   struct snd_sof_route *sroute)
 {
 	struct sof_ipc4_copier_config_set_sink_format format;
 	const struct sof_ipc_ops *iops = sdev->ipc->ops;
@@ -2582,9 +2616,6 @@
 	struct sof_ipc4_fw_module *fw_module;
 	struct sof_ipc4_msg msg = {{ 0 }};
 
-	dev_dbg(sdev->dev, "%s set copier sink %d format\n",
-		src_widget->widget->name, sink_id);
-
 	if (WIDGET_IS_DAI(src_widget->id)) {
 		struct snd_sof_dai *dai = src_widget->private;
 
@@ -2595,13 +2626,15 @@
 
 	fw_module = src_widget->module_info;
 
-	format.sink_id = sink_id;
+	format.sink_id = sroute->src_queue_id;
 	memcpy(&format.source_fmt, &src_config->audio_fmt, sizeof(format.source_fmt));
 
-	pin_fmt = sof_ipc4_get_input_pin_audio_fmt(sink_widget, sink_id);
+	pin_fmt = sof_ipc4_get_input_pin_audio_fmt(sink_widget, sroute->dst_queue_id);
 	if (!pin_fmt) {
-		dev_err(sdev->dev, "Unable to get pin %d format for %s",
-			sink_id, sink_widget->widget->name);
+		dev_err(sdev->dev,
+			"Failed to get input audio format of %s:%d for output of %s:%d\n",
+			sink_widget->widget->name, sroute->dst_queue_id,
+			src_widget->widget->name, sroute->src_queue_id);
 		return -EINVAL;
 	}
 
@@ -2659,7 +2692,8 @@
 	sroute->src_queue_id = sof_ipc4_get_queue_id(src_widget, sink_widget,
 						     SOF_PIN_TYPE_OUTPUT);
 	if (sroute->src_queue_id < 0) {
-		dev_err(sdev->dev, "failed to get queue ID for source widget: %s\n",
+		dev_err(sdev->dev,
+			"failed to get src_queue_id ID from source widget %s\n",
 			src_widget->widget->name);
 		return sroute->src_queue_id;
 	}
@@ -2667,7 +2701,8 @@
 	sroute->dst_queue_id = sof_ipc4_get_queue_id(src_widget, sink_widget,
 						     SOF_PIN_TYPE_INPUT);
 	if (sroute->dst_queue_id < 0) {
-		dev_err(sdev->dev, "failed to get queue ID for sink widget: %s\n",
+		dev_err(sdev->dev,
+			"failed to get dst_queue_id ID from sink widget %s\n",
 			sink_widget->widget->name);
 		sof_ipc4_put_queue_id(src_widget, sroute->src_queue_id,
 				      SOF_PIN_TYPE_OUTPUT);
@@ -2676,10 +2711,11 @@
 
 	/* Pin 0 format is already set during copier module init */
 	if (sroute->src_queue_id > 0 && WIDGET_IS_COPIER(src_widget->id)) {
-		ret = sof_ipc4_set_copier_sink_format(sdev, src_widget, sink_widget,
-						      sroute->src_queue_id);
+		ret = sof_ipc4_set_copier_sink_format(sdev, src_widget,
+						      sink_widget, sroute);
 		if (ret < 0) {
-			dev_err(sdev->dev, "failed to set sink format for %s source queue ID %d\n",
+			dev_err(sdev->dev,
+				"failed to set sink format for source %s:%d\n",
 				src_widget->widget->name, sroute->src_queue_id);
 			goto out;
 		}
--- linux-qcom-6.8.0.orig/sound/soc/sof/mediatek/mt8195/mt8195.c
+++ linux-qcom-6.8.0/sound/soc/sof/mediatek/mt8195/mt8195.c
@@ -573,7 +573,10 @@
 static struct snd_sof_of_mach sof_mt8195_machs[] = {
 	{
 		.compatible = "google,tomato",
-		.sof_tplg_filename = "sof-mt8195-mt6359-rt1019-rt5682-dts.tplg"
+		.sof_tplg_filename = "sof-mt8195-mt6359-rt1019-rt5682.tplg"
+	}, {
+		.compatible = "google,dojo",
+		.sof_tplg_filename = "sof-mt8195-mt6359-max98390-rt5682.tplg"
 	}, {
 		.compatible = "mediatek,mt8195",
 		.sof_tplg_filename = "sof-mt8195.tplg"
--- linux-qcom-6.8.0.orig/sound/soc/sof/ops.h
+++ linux-qcom-6.8.0/sound/soc/sof/ops.h
@@ -523,12 +523,26 @@
 	return 0;
 }
 
-static inline u64 snd_sof_pcm_get_stream_position(struct snd_sof_dev *sdev,
-						  struct snd_soc_component *component,
-						  struct snd_pcm_substream *substream)
+static inline u64
+snd_sof_pcm_get_dai_frame_counter(struct snd_sof_dev *sdev,
+				  struct snd_soc_component *component,
+				  struct snd_pcm_substream *substream)
 {
-	if (sof_ops(sdev) && sof_ops(sdev)->get_stream_position)
-		return sof_ops(sdev)->get_stream_position(sdev, component, substream);
+	if (sof_ops(sdev) && sof_ops(sdev)->get_dai_frame_counter)
+		return sof_ops(sdev)->get_dai_frame_counter(sdev, component,
+							    substream);
+
+	return 0;
+}
+
+static inline u64
+snd_sof_pcm_get_host_byte_counter(struct snd_sof_dev *sdev,
+				  struct snd_soc_component *component,
+				  struct snd_pcm_substream *substream)
+{
+	if (sof_ops(sdev) && sof_ops(sdev)->get_host_byte_counter)
+		return sof_ops(sdev)->get_host_byte_counter(sdev, component,
+							    substream);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/sound/soc/sof/pcm.c
+++ linux-qcom-6.8.0/sound/soc/sof/pcm.c
@@ -325,14 +325,13 @@
 			ipc_first = true;
 		break;
 	case SNDRV_PCM_TRIGGER_SUSPEND:
-		if (sdev->system_suspend_target == SOF_SUSPEND_S0IX &&
+		/*
+		 * If DSP D0I3 is allowed during S0iX, set the suspend_ignored flag for
+		 * D0I3-compatible streams to keep the firmware pipeline running
+		 */
+		if (pcm_ops && pcm_ops->d0i3_supported_in_s0ix &&
+		    sdev->system_suspend_target == SOF_SUSPEND_S0IX &&
 		    spcm->stream[substream->stream].d0i3_compatible) {
-			/*
-			 * trap the event, not sending trigger stop to
-			 * prevent the FW pipelines from being stopped,
-			 * and mark the flag to ignore the upcoming DAPM
-			 * PM events.
-			 */
 			spcm->stream[substream->stream].suspend_ignored = true;
 			return 0;
 		}
@@ -388,13 +387,21 @@
 {
 	struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
 	struct snd_sof_dev *sdev = snd_soc_component_get_drvdata(component);
+	const struct sof_ipc_pcm_ops *pcm_ops = sof_ipc_get_ops(sdev, pcm);
 	struct snd_sof_pcm *spcm;
 	snd_pcm_uframes_t host, dai;
+	int ret = -EOPNOTSUPP;
 
 	/* nothing to do for BE */
 	if (rtd->dai_link->no_pcm)
 		return 0;
 
+	if (pcm_ops && pcm_ops->pointer)
+		ret = pcm_ops->pointer(component, substream, &host);
+
+	if (ret != -EOPNOTSUPP)
+		return ret ? ret : host;
+
 	/* use dsp ops pointer callback directly if set */
 	if (sof_ops(sdev)->pcm_pointer)
 		return sof_ops(sdev)->pcm_pointer(sdev, substream);
--- linux-qcom-6.8.0.orig/sound/soc/sof/sof-audio.c
+++ linux-qcom-6.8.0/sound/soc/sof/sof-audio.c
@@ -487,7 +487,7 @@
 			if (ret < 0) {
 				/* unprepare the source widget */
 				if (widget_ops[widget->id].ipc_unprepare &&
-				    swidget && swidget->prepared) {
+				    swidget && swidget->prepared && swidget->use_count == 0) {
 					widget_ops[widget->id].ipc_unprepare(swidget);
 					swidget->prepared = false;
 				}
--- linux-qcom-6.8.0.orig/sound/soc/sof/sof-audio.h
+++ linux-qcom-6.8.0/sound/soc/sof/sof-audio.h
@@ -103,7 +103,10 @@
  *	       additional memory in the SOF PCM stream structure
  * @pcm_free: Function pointer for PCM free that can be used for freeing any
  *	       additional memory in the SOF PCM stream structure
- * @delay: Function pointer for pcm delay calculation
+ * @pointer: Function pointer for pcm pointer
+ *	     Note: the @pointer callback may return -EOPNOTSUPP which should be
+ *		   handled in a same way as if the callback is not provided
+ * @delay: Function pointer for pcm delay reporting
  * @reset_hw_params_during_stop: Flag indicating whether the hw_params should be reset during the
  *				 STOP pcm trigger
  * @ipc_first_on_start: Send IPC before invoking platform trigger during
@@ -113,6 +116,7 @@
  *				  triggers. The FW keeps the host DMA running in this case and
  *				  therefore the host must do the same and should stop the DMA during
  *				  hw_free.
+ * @d0i3_supported_in_s0ix: Allow DSP D0I3 during S0iX
  */
 struct sof_ipc_pcm_ops {
 	int (*hw_params)(struct snd_soc_component *component, struct snd_pcm_substream *substream,
@@ -124,11 +128,15 @@
 	int (*dai_link_fixup)(struct snd_soc_pcm_runtime *rtd, struct snd_pcm_hw_params *params);
 	int (*pcm_setup)(struct snd_sof_dev *sdev, struct snd_sof_pcm *spcm);
 	void (*pcm_free)(struct snd_sof_dev *sdev, struct snd_sof_pcm *spcm);
+	int (*pointer)(struct snd_soc_component *component,
+		       struct snd_pcm_substream *substream,
+		       snd_pcm_uframes_t *pointer);
 	snd_pcm_sframes_t (*delay)(struct snd_soc_component *component,
 				   struct snd_pcm_substream *substream);
 	bool reset_hw_params_during_stop;
 	bool ipc_first_on_start;
 	bool platform_stop_during_hw_free;
+	bool d0i3_supported_in_s0ix;
 };
 
 /**
@@ -321,6 +329,7 @@
 	struct work_struct period_elapsed_work;
 	struct snd_soc_dapm_widget_list *list; /* list of connected DAPM widgets */
 	bool d0i3_compatible; /* DSP can be in D0I3 when this pcm is opened */
+	unsigned int dsp_max_burst_size_in_ms; /* The maximum size of the host DMA burst in ms */
 	/*
 	 * flag to indicate that the DSP pipelines should be kept
 	 * active or not while suspending the stream
--- linux-qcom-6.8.0.orig/sound/soc/sof/sof-client-probes-ipc4.c
+++ linux-qcom-6.8.0/sound/soc/sof/sof-client-probes-ipc4.c
@@ -125,6 +125,7 @@
 	msg.primary |= SOF_IPC4_MSG_TARGET(SOF_IPC4_MODULE_MSG);
 	msg.extension = SOF_IPC4_MOD_EXT_DST_MOD_INSTANCE(INVALID_PIPELINE_ID);
 	msg.extension |= SOF_IPC4_MOD_EXT_CORE_ID(0);
+	msg.extension |= SOF_IPC4_MOD_EXT_PARAM_SIZE(sizeof(cfg) / sizeof(uint32_t));
 
 	msg.data_size = sizeof(cfg);
 	msg.data_ptr = &cfg;
--- linux-qcom-6.8.0.orig/sound/soc/sof/sof-priv.h
+++ linux-qcom-6.8.0/sound/soc/sof/sof-priv.h
@@ -255,13 +255,25 @@
 	int (*pcm_ack)(struct snd_sof_dev *sdev, struct snd_pcm_substream *substream); /* optional */
 
 	/*
-	 * optional callback to retrieve the link DMA position for the substream
-	 * when the position is not reported in the shared SRAM windows but
-	 * instead from a host-accessible hardware counter.
+	 * optional callback to retrieve the number of frames left/arrived from/to
+	 * the DSP on the DAI side (link/codec/DMIC/etc).
+	 *
+	 * The callback is used when the firmware does not provide this information
+	 * via the shared SRAM window and it can be retrieved by host.
 	 */
-	u64 (*get_stream_position)(struct snd_sof_dev *sdev,
-				   struct snd_soc_component *component,
-				   struct snd_pcm_substream *substream); /* optional */
+	u64 (*get_dai_frame_counter)(struct snd_sof_dev *sdev,
+				     struct snd_soc_component *component,
+				     struct snd_pcm_substream *substream); /* optional */
+
+	/*
+	 * Optional callback to retrieve the number of bytes left/arrived from/to
+	 * the DSP on the host side (bytes between host ALSA buffer and DSP).
+	 *
+	 * The callback is needed for ALSA delay reporting.
+	 */
+	u64 (*get_host_byte_counter)(struct snd_sof_dev *sdev,
+				     struct snd_soc_component *component,
+				     struct snd_pcm_substream *substream); /* optional */
 
 	/* host read DSP stream data */
 	int (*ipc_msg_data)(struct snd_sof_dev *sdev,
--- linux-qcom-6.8.0.orig/sound/soc/sof/topology.c
+++ linux-qcom-6.8.0/sound/soc/sof/topology.c
@@ -2046,6 +2046,8 @@
 	if (!slink)
 		return 0;
 
+	slink->link->platforms->name = NULL;
+
 	kfree(slink->tuples);
 	list_del(&slink->list);
 	kfree(slink->hw_configs);
--- linux-qcom-6.8.0.orig/sound/soc/sti/sti_uniperif.c
+++ linux-qcom-6.8.0/sound/soc/sti/sti_uniperif.c
@@ -352,7 +352,7 @@
 	return ret;
 }
 
-static int sti_uniperiph_dai_probe(struct snd_soc_dai *dai)
+int sti_uniperiph_dai_probe(struct snd_soc_dai *dai)
 {
 	struct sti_uniperiph_data *priv = snd_soc_dai_get_drvdata(dai);
 	struct sti_uniperiph_dai *dai_data = &priv->dai_data;
--- linux-qcom-6.8.0.orig/sound/soc/sti/uniperif.h
+++ linux-qcom-6.8.0/sound/soc/sti/uniperif.h
@@ -1380,6 +1380,7 @@
 		    struct uniperif *reader);
 
 /* common */
+int sti_uniperiph_dai_probe(struct snd_soc_dai *dai);
 int sti_uniperiph_dai_set_fmt(struct snd_soc_dai *dai,
 			      unsigned int fmt);
 
--- linux-qcom-6.8.0.orig/sound/soc/sti/uniperif_player.c
+++ linux-qcom-6.8.0/sound/soc/sti/uniperif_player.c
@@ -1038,6 +1038,7 @@
 		.startup = uni_player_startup,
 		.shutdown = uni_player_shutdown,
 		.prepare = uni_player_prepare,
+		.probe = sti_uniperiph_dai_probe,
 		.trigger = uni_player_trigger,
 		.hw_params = sti_uniperiph_dai_hw_params,
 		.set_fmt = sti_uniperiph_dai_set_fmt,
--- linux-qcom-6.8.0.orig/sound/soc/sti/uniperif_reader.c
+++ linux-qcom-6.8.0/sound/soc/sti/uniperif_reader.c
@@ -401,6 +401,7 @@
 		.startup = uni_reader_startup,
 		.shutdown = uni_reader_shutdown,
 		.prepare = uni_reader_prepare,
+		.probe = sti_uniperiph_dai_probe,
 		.trigger = uni_reader_trigger,
 		.hw_params = sti_uniperiph_dai_hw_params,
 		.set_fmt = sti_uniperiph_dai_set_fmt,
--- linux-qcom-6.8.0.orig/sound/soc/stm/stm32_sai_sub.c
+++ linux-qcom-6.8.0/sound/soc/stm/stm32_sai_sub.c
@@ -317,7 +317,7 @@
 	int div;
 
 	div = DIV_ROUND_CLOSEST(input_rate, output_rate);
-	if (div > SAI_XCR1_MCKDIV_MAX(version)) {
+	if (div > SAI_XCR1_MCKDIV_MAX(version) || div <= 0) {
 		dev_err(&sai->pdev->dev, "Divider %d out of range\n", div);
 		return -EINVAL;
 	}
@@ -378,8 +378,8 @@
 	int div;
 
 	div = stm32_sai_get_clk_div(sai, *prate, rate);
-	if (div < 0)
-		return div;
+	if (div <= 0)
+		return -EINVAL;
 
 	mclk->freq = *prate / div;
 
--- linux-qcom-6.8.0.orig/sound/soc/stm/stm32_spdifrx.c
+++ linux-qcom-6.8.0/sound/soc/stm/stm32_spdifrx.c
@@ -939,7 +939,7 @@
 {
 	struct stm32_spdifrx_data *spdifrx = platform_get_drvdata(pdev);
 
-	if (spdifrx->ctrl_chan)
+	if (!IS_ERR(spdifrx->ctrl_chan))
 		dma_release_channel(spdifrx->ctrl_chan);
 
 	if (spdifrx->dmab)
--- linux-qcom-6.8.0.orig/sound/soc/sunxi/sun4i-i2s.c
+++ linux-qcom-6.8.0/sound/soc/sunxi/sun4i-i2s.c
@@ -100,8 +100,8 @@
 #define SUN8I_I2S_CTRL_MODE_PCM			(0 << 4)
 
 #define SUN8I_I2S_FMT0_LRCLK_POLARITY_MASK	BIT(19)
-#define SUN8I_I2S_FMT0_LRCLK_POLARITY_INVERTED		(1 << 19)
-#define SUN8I_I2S_FMT0_LRCLK_POLARITY_NORMAL		(0 << 19)
+#define SUN8I_I2S_FMT0_LRCLK_POLARITY_START_HIGH	(1 << 19)
+#define SUN8I_I2S_FMT0_LRCLK_POLARITY_START_LOW		(0 << 19)
 #define SUN8I_I2S_FMT0_LRCK_PERIOD_MASK		GENMASK(17, 8)
 #define SUN8I_I2S_FMT0_LRCK_PERIOD(period)	((period - 1) << 8)
 #define SUN8I_I2S_FMT0_BCLK_POLARITY_MASK	BIT(7)
@@ -727,65 +727,37 @@
 static int sun8i_i2s_set_soc_fmt(const struct sun4i_i2s *i2s,
 				 unsigned int fmt)
 {
-	u32 mode, val;
+	u32 mode, lrclk_pol, bclk_pol, val;
 	u8 offset;
 
-	/*
-	 * DAI clock polarity
-	 *
-	 * The setup for LRCK contradicts the datasheet, but under a
-	 * scope it's clear that the LRCK polarity is reversed
-	 * compared to the expected polarity on the bus.
-	 */
-	switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
-	case SND_SOC_DAIFMT_IB_IF:
-		/* Invert both clocks */
-		val = SUN8I_I2S_FMT0_BCLK_POLARITY_INVERTED;
-		break;
-	case SND_SOC_DAIFMT_IB_NF:
-		/* Invert bit clock */
-		val = SUN8I_I2S_FMT0_BCLK_POLARITY_INVERTED |
-		      SUN8I_I2S_FMT0_LRCLK_POLARITY_INVERTED;
-		break;
-	case SND_SOC_DAIFMT_NB_IF:
-		/* Invert frame clock */
-		val = 0;
-		break;
-	case SND_SOC_DAIFMT_NB_NF:
-		val = SUN8I_I2S_FMT0_LRCLK_POLARITY_INVERTED;
-		break;
-	default:
-		return -EINVAL;
-	}
-
-	regmap_update_bits(i2s->regmap, SUN4I_I2S_FMT0_REG,
-			   SUN8I_I2S_FMT0_LRCLK_POLARITY_MASK |
-			   SUN8I_I2S_FMT0_BCLK_POLARITY_MASK,
-			   val);
-
 	/* DAI Mode */
 	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
 	case SND_SOC_DAIFMT_DSP_A:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_HIGH;
 		mode = SUN8I_I2S_CTRL_MODE_PCM;
 		offset = 1;
 		break;
 
 	case SND_SOC_DAIFMT_DSP_B:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_HIGH;
 		mode = SUN8I_I2S_CTRL_MODE_PCM;
 		offset = 0;
 		break;
 
 	case SND_SOC_DAIFMT_I2S:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_LOW;
 		mode = SUN8I_I2S_CTRL_MODE_LEFT;
 		offset = 1;
 		break;
 
 	case SND_SOC_DAIFMT_LEFT_J:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_HIGH;
 		mode = SUN8I_I2S_CTRL_MODE_LEFT;
 		offset = 0;
 		break;
 
 	case SND_SOC_DAIFMT_RIGHT_J:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_HIGH;
 		mode = SUN8I_I2S_CTRL_MODE_RIGHT;
 		offset = 0;
 		break;
@@ -803,6 +775,35 @@
 			   SUN8I_I2S_TX_CHAN_OFFSET_MASK,
 			   SUN8I_I2S_TX_CHAN_OFFSET(offset));
 
+	/* DAI clock polarity */
+	bclk_pol = SUN8I_I2S_FMT0_BCLK_POLARITY_NORMAL;
+
+	switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+	case SND_SOC_DAIFMT_IB_IF:
+		/* Invert both clocks */
+		lrclk_pol ^= SUN8I_I2S_FMT0_LRCLK_POLARITY_MASK;
+		bclk_pol = SUN8I_I2S_FMT0_BCLK_POLARITY_INVERTED;
+		break;
+	case SND_SOC_DAIFMT_IB_NF:
+		/* Invert bit clock */
+		bclk_pol = SUN8I_I2S_FMT0_BCLK_POLARITY_INVERTED;
+		break;
+	case SND_SOC_DAIFMT_NB_IF:
+		/* Invert frame clock */
+		lrclk_pol ^= SUN8I_I2S_FMT0_LRCLK_POLARITY_MASK;
+		break;
+	case SND_SOC_DAIFMT_NB_NF:
+		/* No inversion */
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	regmap_update_bits(i2s->regmap, SUN4I_I2S_FMT0_REG,
+			   SUN8I_I2S_FMT0_LRCLK_POLARITY_MASK |
+			   SUN8I_I2S_FMT0_BCLK_POLARITY_MASK,
+			   lrclk_pol | bclk_pol);
+
 	/* DAI clock master masks */
 	switch (fmt & SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK) {
 	case SND_SOC_DAIFMT_BP_FP:
@@ -834,65 +835,37 @@
 static int sun50i_h6_i2s_set_soc_fmt(const struct sun4i_i2s *i2s,
 				     unsigned int fmt)
 {
-	u32 mode, val;
+	u32 mode, lrclk_pol, bclk_pol, val;
 	u8 offset;
 
-	/*
-	 * DAI clock polarity
-	 *
-	 * The setup for LRCK contradicts the datasheet, but under a
-	 * scope it's clear that the LRCK polarity is reversed
-	 * compared to the expected polarity on the bus.
-	 */
-	switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
-	case SND_SOC_DAIFMT_IB_IF:
-		/* Invert both clocks */
-		val = SUN8I_I2S_FMT0_BCLK_POLARITY_INVERTED;
-		break;
-	case SND_SOC_DAIFMT_IB_NF:
-		/* Invert bit clock */
-		val = SUN8I_I2S_FMT0_BCLK_POLARITY_INVERTED |
-		      SUN8I_I2S_FMT0_LRCLK_POLARITY_INVERTED;
-		break;
-	case SND_SOC_DAIFMT_NB_IF:
-		/* Invert frame clock */
-		val = 0;
-		break;
-	case SND_SOC_DAIFMT_NB_NF:
-		val = SUN8I_I2S_FMT0_LRCLK_POLARITY_INVERTED;
-		break;
-	default:
-		return -EINVAL;
-	}
-
-	regmap_update_bits(i2s->regmap, SUN4I_I2S_FMT0_REG,
-			   SUN8I_I2S_FMT0_LRCLK_POLARITY_MASK |
-			   SUN8I_I2S_FMT0_BCLK_POLARITY_MASK,
-			   val);
-
 	/* DAI Mode */
 	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
 	case SND_SOC_DAIFMT_DSP_A:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_HIGH;
 		mode = SUN8I_I2S_CTRL_MODE_PCM;
 		offset = 1;
 		break;
 
 	case SND_SOC_DAIFMT_DSP_B:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_HIGH;
 		mode = SUN8I_I2S_CTRL_MODE_PCM;
 		offset = 0;
 		break;
 
 	case SND_SOC_DAIFMT_I2S:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_LOW;
 		mode = SUN8I_I2S_CTRL_MODE_LEFT;
 		offset = 1;
 		break;
 
 	case SND_SOC_DAIFMT_LEFT_J:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_HIGH;
 		mode = SUN8I_I2S_CTRL_MODE_LEFT;
 		offset = 0;
 		break;
 
 	case SND_SOC_DAIFMT_RIGHT_J:
+		lrclk_pol = SUN8I_I2S_FMT0_LRCLK_POLARITY_START_HIGH;
 		mode = SUN8I_I2S_CTRL_MODE_RIGHT;
 		offset = 0;
 		break;
@@ -910,6 +883,36 @@
 			   SUN50I_H6_I2S_TX_CHAN_SEL_OFFSET_MASK,
 			   SUN50I_H6_I2S_TX_CHAN_SEL_OFFSET(offset));
 
+	/* DAI clock polarity */
+	bclk_pol = SUN8I_I2S_FMT0_BCLK_POLARITY_NORMAL;
+
+	switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+	case SND_SOC_DAIFMT_IB_IF:
+		/* Invert both clocks */
+		lrclk_pol ^= SUN8I_I2S_FMT0_LRCLK_POLARITY_MASK;
+		bclk_pol = SUN8I_I2S_FMT0_BCLK_POLARITY_INVERTED;
+		break;
+	case SND_SOC_DAIFMT_IB_NF:
+		/* Invert bit clock */
+		bclk_pol = SUN8I_I2S_FMT0_BCLK_POLARITY_INVERTED;
+		break;
+	case SND_SOC_DAIFMT_NB_IF:
+		/* Invert frame clock */
+		lrclk_pol ^= SUN8I_I2S_FMT0_LRCLK_POLARITY_MASK;
+		break;
+	case SND_SOC_DAIFMT_NB_NF:
+		/* No inversion */
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	regmap_update_bits(i2s->regmap, SUN4I_I2S_FMT0_REG,
+			   SUN8I_I2S_FMT0_LRCLK_POLARITY_MASK |
+			   SUN8I_I2S_FMT0_BCLK_POLARITY_MASK,
+			   lrclk_pol | bclk_pol);
+
+
 	/* DAI clock master masks */
 	switch (fmt & SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK) {
 	case SND_SOC_DAIFMT_BP_FP:
--- linux-qcom-6.8.0.orig/sound/soc/tegra/tegra186_dspk.c
+++ linux-qcom-6.8.0/sound/soc/tegra/tegra186_dspk.c
@@ -1,8 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
+// SPDX-FileCopyrightText: Copyright (c) 2020-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 //
 // tegra186_dspk.c - Tegra186 DSPK driver
-//
-// Copyright (c) 2020 NVIDIA CORPORATION. All rights reserved.
 
 #include <linux/clk.h>
 #include <linux/device.h>
@@ -241,14 +240,14 @@
 		return -EINVAL;
 	}
 
-	cif_conf.client_bits = TEGRA_ACIF_BITS_24;
-
 	switch (params_format(params)) {
 	case SNDRV_PCM_FORMAT_S16_LE:
 		cif_conf.audio_bits = TEGRA_ACIF_BITS_16;
+		cif_conf.client_bits = TEGRA_ACIF_BITS_16;
 		break;
 	case SNDRV_PCM_FORMAT_S32_LE:
 		cif_conf.audio_bits = TEGRA_ACIF_BITS_32;
+		cif_conf.client_bits = TEGRA_ACIF_BITS_24;
 		break;
 	default:
 		dev_err(dev, "unsupported format!\n");
--- linux-qcom-6.8.0.orig/sound/soc/tegra/tegra210_ahub.c
+++ linux-qcom-6.8.0/sound/soc/tegra/tegra210_ahub.c
@@ -2,7 +2,7 @@
 //
 // tegra210_ahub.c - Tegra210 AHUB driver
 //
-// Copyright (c) 2020-2022, NVIDIA CORPORATION.  All rights reserved.
+// Copyright (c) 2020-2024, NVIDIA CORPORATION.  All rights reserved.
 
 #include <linux/clk.h>
 #include <linux/device.h>
@@ -1391,11 +1391,13 @@
 		return err;
 	}
 
+	pm_runtime_enable(&pdev->dev);
+
 	err = of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
-	if (err)
+	if (err) {
+		pm_runtime_disable(&pdev->dev);
 		return err;
-
-	pm_runtime_enable(&pdev->dev);
+	}
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/sound/soc/ti/davinci-mcasp.c
+++ linux-qcom-6.8.0/sound/soc/ti/davinci-mcasp.c
@@ -1472,10 +1472,11 @@
 {
 	struct snd_interval *period_size = hw_param_interval(params,
 						SNDRV_PCM_HW_PARAM_PERIOD_SIZE);
+	u8 numevt = *((u8 *)rule->private);
 	struct snd_interval frames;
 
 	snd_interval_any(&frames);
-	frames.min = 64;
+	frames.min = numevt;
 	frames.integer = 1;
 
 	return snd_interval_refine(period_size, &frames);
@@ -1490,6 +1491,7 @@
 	u32 max_channels = 0;
 	int i, dir, ret;
 	int tdm_slots = mcasp->tdm_slots;
+	u8 *numevt;
 
 	/* Do not allow more then one stream per direction */
 	if (mcasp->substreams[substream->stream])
@@ -1589,9 +1591,12 @@
 			return ret;
 	}
 
+	numevt = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ?
+			 &mcasp->txnumevt :
+			 &mcasp->rxnumevt;
 	snd_pcm_hw_rule_add(substream->runtime, 0,
 			    SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
-			    davinci_mcasp_hw_rule_min_periodsize, NULL,
+			    davinci_mcasp_hw_rule_min_periodsize, numevt,
 			    SNDRV_PCM_HW_PARAM_PERIOD_SIZE, -1);
 
 	return 0;
@@ -2417,12 +2422,6 @@
 
 	mcasp_reparent_fck(pdev);
 
-	ret = devm_snd_soc_register_component(&pdev->dev, &davinci_mcasp_component,
-					      &davinci_mcasp_dai[mcasp->op_mode], 1);
-
-	if (ret != 0)
-		goto err;
-
 	ret = davinci_mcasp_get_dma_type(mcasp);
 	switch (ret) {
 	case PCM_EDMA:
@@ -2449,6 +2448,12 @@
 		goto err;
 	}
 
+	ret = devm_snd_soc_register_component(&pdev->dev, &davinci_mcasp_component,
+					      &davinci_mcasp_dai[mcasp->op_mode], 1);
+
+	if (ret != 0)
+		goto err;
+
 no_audio:
 	ret = davinci_mcasp_init_gpiochip(mcasp);
 	if (ret) {
--- linux-qcom-6.8.0.orig/sound/soc/ti/omap-hdmi.c
+++ linux-qcom-6.8.0/sound/soc/ti/omap-hdmi.c
@@ -354,11 +354,7 @@
 	if (!card)
 		return -ENOMEM;
 
-	card->name = devm_kasprintf(dev, GFP_KERNEL,
-				    "HDMI %s", dev_name(ad->dssdev));
-	if (!card->name)
-		return -ENOMEM;
-
+	card->name = "HDMI";
 	card->owner = THIS_MODULE;
 	card->dai_link =
 		devm_kzalloc(dev, sizeof(*(card->dai_link)), GFP_KERNEL);
--- linux-qcom-6.8.0.orig/sound/synth/emux/soundfont.c
+++ linux-qcom-6.8.0/sound/synth/emux/soundfont.c
@@ -701,7 +701,6 @@
 	struct snd_soundfont *sf;
 	struct soundfont_sample_info sample_info;
 	struct snd_sf_sample *sp;
-	long off;
 
 	/* patch must be opened */
 	sf = sflist->currsf;
@@ -711,12 +710,16 @@
 	if (is_special_type(sf->type))
 		return -EINVAL;
 
+	if (count < (long)sizeof(sample_info)) {
+		return -EINVAL;
+	}
 	if (copy_from_user(&sample_info, data, sizeof(sample_info)))
 		return -EFAULT;
+	data += sizeof(sample_info);
+	count -= sizeof(sample_info);
 
-	off = sizeof(sample_info);
-
-	if (sample_info.size != (count-off)/2)
+	// SoundFont uses S16LE samples.
+	if (sample_info.size * 2 != count)
 		return -EINVAL;
 
 	/* Check for dup */
@@ -744,7 +747,7 @@
 		int  rc;
 		rc = sflist->callback.sample_new
 			(sflist->callback.private_data, sp, sflist->memhdr,
-			 data + off, count - off);
+			 data, count);
 		if (rc < 0) {
 			sf_sample_delete(sflist, sf, sp);
 			return rc;
@@ -957,10 +960,12 @@
 	}
 	if (copy_from_user(&patch, data, sizeof(patch)))
 		return -EFAULT;
-	
 	count -= sizeof(patch);
 	data += sizeof(patch);
 
+	if ((patch.len << (patch.mode & WAVE_16_BITS ? 1 : 0)) != count)
+		return -EINVAL;
+
 	sf = newsf(sflist, SNDRV_SFNT_PAT_TYPE_GUS|SNDRV_SFNT_PAT_SHARED, NULL);
 	if (sf == NULL)
 		return -ENOMEM;
--- linux-qcom-6.8.0.orig/sound/usb/6fire/chip.c
+++ linux-qcom-6.8.0/sound/usb/6fire/chip.c
@@ -61,8 +61,10 @@
 	}
 }
 
-static void usb6fire_chip_destroy(struct sfire_chip *chip)
+static void usb6fire_card_free(struct snd_card *card)
 {
+	struct sfire_chip *chip = card->private_data;
+
 	if (chip) {
 		if (chip->pcm)
 			usb6fire_pcm_destroy(chip);
@@ -72,8 +74,6 @@
 			usb6fire_comm_destroy(chip);
 		if (chip->control)
 			usb6fire_control_destroy(chip);
-		if (chip->card)
-			snd_card_free(chip->card);
 	}
 }
 
@@ -136,6 +136,7 @@
 	chip->regidx = regidx;
 	chip->intf_count = 1;
 	chip->card = card;
+	card->private_free = usb6fire_card_free;
 
 	ret = usb6fire_comm_init(chip);
 	if (ret < 0)
@@ -162,7 +163,7 @@
 	return 0;
 
 destroy_chip:
-	usb6fire_chip_destroy(chip);
+	snd_card_free(card);
 	return ret;
 }
 
@@ -181,7 +182,6 @@
 
 			chip->shutdown = true;
 			usb6fire_chip_abort(chip);
-			usb6fire_chip_destroy(chip);
 		}
 	}
 }
--- linux-qcom-6.8.0.orig/sound/usb/caiaq/audio.c
+++ linux-qcom-6.8.0/sound/usb/caiaq/audio.c
@@ -869,14 +869,20 @@
 	return 0;
 }
 
-void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev)
+void snd_usb_caiaq_audio_disconnect(struct snd_usb_caiaqdev *cdev)
 {
 	struct device *dev = caiaqdev_to_dev(cdev);
 
 	dev_dbg(dev, "%s(%p)\n", __func__, cdev);
 	stream_stop(cdev);
+}
+
+void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev)
+{
+	struct device *dev = caiaqdev_to_dev(cdev);
+
+	dev_dbg(dev, "%s(%p)\n", __func__, cdev);
 	free_urbs(cdev->data_urbs_in);
 	free_urbs(cdev->data_urbs_out);
 	kfree(cdev->data_cb_info);
 }
-
--- linux-qcom-6.8.0.orig/sound/usb/caiaq/audio.h
+++ linux-qcom-6.8.0/sound/usb/caiaq/audio.h
@@ -3,6 +3,7 @@
 #define CAIAQ_AUDIO_H
 
 int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev);
+void snd_usb_caiaq_audio_disconnect(struct snd_usb_caiaqdev *cdev);
 void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev);
 
 #endif /* CAIAQ_AUDIO_H */
--- linux-qcom-6.8.0.orig/sound/usb/caiaq/device.c
+++ linux-qcom-6.8.0/sound/usb/caiaq/device.c
@@ -376,6 +376,17 @@
 		dev_err(dev, "Unable to set up control system (ret=%d)\n", ret);
 }
 
+static void card_free(struct snd_card *card)
+{
+	struct snd_usb_caiaqdev *cdev = caiaqdev(card);
+
+#ifdef CONFIG_SND_USB_CAIAQ_INPUT
+	snd_usb_caiaq_input_free(cdev);
+#endif
+	snd_usb_caiaq_audio_free(cdev);
+	usb_reset_device(cdev->chip.dev);
+}
+
 static int create_card(struct usb_device *usb_dev,
 		       struct usb_interface *intf,
 		       struct snd_card **cardp)
@@ -489,6 +500,7 @@
 		       cdev->vendor_name, cdev->product_name, usbpath);
 
 	setup_card(cdev);
+	card->private_free = card_free;
 	return 0;
 
  err_kill_urb:
@@ -534,15 +546,14 @@
 	snd_card_disconnect(card);
 
 #ifdef CONFIG_SND_USB_CAIAQ_INPUT
-	snd_usb_caiaq_input_free(cdev);
+	snd_usb_caiaq_input_disconnect(cdev);
 #endif
-	snd_usb_caiaq_audio_free(cdev);
+	snd_usb_caiaq_audio_disconnect(cdev);
 
 	usb_kill_urb(&cdev->ep1_in_urb);
 	usb_kill_urb(&cdev->midi_out_urb);
 
-	snd_card_free(card);
-	usb_reset_device(interface_to_usbdev(intf));
+	snd_card_free_when_closed(card);
 }
 
 
--- linux-qcom-6.8.0.orig/sound/usb/caiaq/input.c
+++ linux-qcom-6.8.0/sound/usb/caiaq/input.c
@@ -829,15 +829,21 @@
 	return ret;
 }
 
-void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev)
+void snd_usb_caiaq_input_disconnect(struct snd_usb_caiaqdev *cdev)
 {
 	if (!cdev || !cdev->input_dev)
 		return;
 
 	usb_kill_urb(cdev->ep4_in_urb);
+	input_unregister_device(cdev->input_dev);
+}
+
+void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev)
+{
+	if (!cdev || !cdev->input_dev)
+		return;
+
 	usb_free_urb(cdev->ep4_in_urb);
 	cdev->ep4_in_urb = NULL;
-
-	input_unregister_device(cdev->input_dev);
 	cdev->input_dev = NULL;
 }
--- linux-qcom-6.8.0.orig/sound/usb/caiaq/input.h
+++ linux-qcom-6.8.0/sound/usb/caiaq/input.h
@@ -4,6 +4,7 @@
 
 void snd_usb_caiaq_input_dispatch(struct snd_usb_caiaqdev *cdev, char *buf, unsigned int len);
 int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev);
+void snd_usb_caiaq_input_disconnect(struct snd_usb_caiaqdev *cdev);
 void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev);
 
 #endif
--- linux-qcom-6.8.0.orig/sound/usb/card.c
+++ linux-qcom-6.8.0/sound/usb/card.c
@@ -382,6 +382,12 @@
 	/* Creative/Toshiba Multimedia Center SB-0500 */
 	DEVICE_NAME(0x041e, 0x3048, "Toshiba", "SB-0500"),
 
+	/* Logitech Audio Devices */
+	DEVICE_NAME(0x046d, 0x0867, "Logitech, Inc.", "Logi-MeetUp"),
+	DEVICE_NAME(0x046d, 0x0874, "Logitech, Inc.", "Logi-Tap-Audio"),
+	DEVICE_NAME(0x046d, 0x087c, "Logitech, Inc.", "Logi-Huddle"),
+	DEVICE_NAME(0x046d, 0x0898, "Logitech, Inc.", "Logi-RB-Audio"),
+	DEVICE_NAME(0x046d, 0x08d2, "Logitech, Inc.", "Logi-RBM-Audio"),
 	DEVICE_NAME(0x046d, 0x0990, "Logitech, Inc.", "QuickCam Pro 9000"),
 
 	DEVICE_NAME(0x05e1, 0x0408, "Syntek", "STK1160"),
--- linux-qcom-6.8.0.orig/sound/usb/clock.c
+++ linux-qcom-6.8.0/sound/usb/clock.c
@@ -36,6 +36,12 @@
 	struct uac_clock_multiplier_descriptor v3;
 };
 
+/* check whether the descriptor bLength has the minimal length */
+#define DESC_LENGTH_CHECK(p, proto) \
+	((proto) == UAC_VERSION_3 ? \
+	 ((p)->v3.bLength >= sizeof((p)->v3)) :	\
+	 ((p)->v2.bLength >= sizeof((p)->v2)))
+
 #define GET_VAL(p, proto, field) \
 	((proto) == UAC_VERSION_3 ? (p)->v3.field : (p)->v2.field)
 
@@ -58,6 +64,8 @@
 {
 	union uac23_clock_source_desc *cs = p;
 
+	if (!DESC_LENGTH_CHECK(cs, proto))
+		return false;
 	return GET_VAL(cs, proto, bClockID) == id;
 }
 
@@ -65,13 +73,27 @@
 {
 	union uac23_clock_selector_desc *cs = p;
 
-	return GET_VAL(cs, proto, bClockID) == id;
+	if (!DESC_LENGTH_CHECK(cs, proto))
+		return false;
+	if (GET_VAL(cs, proto, bClockID) != id)
+		return false;
+	/* additional length check for baCSourceID array (in bNrInPins size)
+	 * and two more fields (which sizes depend on the protocol)
+	 */
+	if (proto == UAC_VERSION_3)
+		return cs->v3.bLength >= sizeof(cs->v3) + cs->v3.bNrInPins +
+			4 /* bmControls */ + 2 /* wCSelectorDescrStr */;
+	else
+		return cs->v2.bLength >= sizeof(cs->v2) + cs->v2.bNrInPins +
+			1 /* bmControls */ + 1 /* iClockSelector */;
 }
 
 static bool validate_clock_multiplier(void *p, int id, int proto)
 {
 	union uac23_clock_multiplier_desc *cs = p;
 
+	if (!DESC_LENGTH_CHECK(cs, proto))
+		return false;
 	return GET_VAL(cs, proto, bClockID) == id;
 }
 
--- linux-qcom-6.8.0.orig/sound/usb/endpoint.c
+++ linux-qcom-6.8.0/sound/usb/endpoint.c
@@ -403,10 +403,15 @@
 static void notify_xrun(struct snd_usb_endpoint *ep)
 {
 	struct snd_usb_substream *data_subs;
+	struct snd_pcm_substream *psubs;
 
 	data_subs = READ_ONCE(ep->data_subs);
-	if (data_subs && data_subs->pcm_substream)
-		snd_pcm_stop_xrun(data_subs->pcm_substream);
+	if (!data_subs)
+		return;
+	psubs = data_subs->pcm_substream;
+	if (psubs && psubs->runtime &&
+	    psubs->runtime->state == SNDRV_PCM_STATE_RUNNING)
+		snd_pcm_stop_xrun(psubs);
 }
 
 static struct snd_usb_packet_info *
@@ -562,7 +567,10 @@
 			push_back_to_ready_list(ep, ctx);
 			clear_bit(ctx->index, &ep->active_mask);
 			snd_usb_queue_pending_output_urbs(ep, false);
-			atomic_dec(&ep->submitted_urbs); /* decrement at last */
+			/* decrement at last, and check xrun */
+			if (atomic_dec_and_test(&ep->submitted_urbs) &&
+			    !snd_usb_endpoint_implicit_feedback_sink(ep))
+				notify_xrun(ep);
 			return;
 		}
 
--- linux-qcom-6.8.0.orig/sound/usb/format.c
+++ linux-qcom-6.8.0/sound/usb/format.c
@@ -60,6 +60,8 @@
 			pcm_formats |= SNDRV_PCM_FMTBIT_SPECIAL;
 			/* flag potentially raw DSD capable altsettings */
 			fp->dsd_raw = true;
+			/* clear special format bit to avoid "unsupported format" msg below */
+			format &= ~UAC2_FORMAT_TYPE_I_RAW_DATA;
 		}
 
 		format <<= 1;
@@ -71,8 +73,11 @@
 		sample_width = as->bBitResolution;
 		sample_bytes = as->bSubslotSize;
 
-		if (format & UAC3_FORMAT_TYPE_I_RAW_DATA)
+		if (format & UAC3_FORMAT_TYPE_I_RAW_DATA) {
 			pcm_formats |= SNDRV_PCM_FMTBIT_SPECIAL;
+			/* clear special format bit to avoid "unsupported format" msg below */
+			format &= ~UAC3_FORMAT_TYPE_I_RAW_DATA;
+		}
 
 		format <<= 1;
 		break;
--- linux-qcom-6.8.0.orig/sound/usb/line6/driver.c
+++ linux-qcom-6.8.0/sound/usb/line6/driver.c
@@ -202,7 +202,7 @@
 	struct urb *urb;
 
 	/* create message: */
-	msg = kmalloc(sizeof(struct message), GFP_ATOMIC);
+	msg = kzalloc(sizeof(struct message), GFP_ATOMIC);
 	if (msg == NULL)
 		return -ENOMEM;
 
@@ -286,12 +286,14 @@
 {
 	struct usb_line6 *line6 = (struct usb_line6 *)urb->context;
 	struct midi_buffer *mb = &line6->line6midi->midibuf_in;
+	unsigned long flags;
 	int done;
 
 	if (urb->status == -ESHUTDOWN)
 		return;
 
 	if (line6->properties->capabilities & LINE6_CAP_CONTROL_MIDI) {
+		spin_lock_irqsave(&line6->line6midi->lock, flags);
 		done =
 			line6_midibuf_write(mb, urb->transfer_buffer, urb->actual_length);
 
@@ -300,12 +302,15 @@
 			dev_dbg(line6->ifcdev, "%d %d buffer overflow - message skipped\n",
 				done, urb->actual_length);
 		}
+		spin_unlock_irqrestore(&line6->line6midi->lock, flags);
 
 		for (;;) {
+			spin_lock_irqsave(&line6->line6midi->lock, flags);
 			done =
 				line6_midibuf_read(mb, line6->buffer_message,
 						   LINE6_MIDI_MESSAGE_MAXLEN,
 						   LINE6_MIDIBUF_READ_RX);
+			spin_unlock_irqrestore(&line6->line6midi->lock, flags);
 
 			if (done <= 0)
 				break;
@@ -688,7 +693,7 @@
 	int ret;
 
 	/* initialize USB buffers: */
-	line6->buffer_listen = kmalloc(LINE6_BUFSIZE_LISTEN, GFP_KERNEL);
+	line6->buffer_listen = kzalloc(LINE6_BUFSIZE_LISTEN, GFP_KERNEL);
 	if (!line6->buffer_listen)
 		return -ENOMEM;
 
@@ -697,7 +702,7 @@
 		return -ENOMEM;
 
 	if (line6->properties->capabilities & LINE6_CAP_CONTROL_MIDI) {
-		line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL);
+		line6->buffer_message = kzalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL);
 		if (!line6->buffer_message)
 			return -ENOMEM;
 
--- linux-qcom-6.8.0.orig/sound/usb/line6/podhd.c
+++ linux-qcom-6.8.0/sound/usb/line6/podhd.c
@@ -507,7 +507,7 @@
 	[LINE6_PODHD500X] = {
 		.id = "PODHD500X",
 		.name = "POD HD500X",
-		.capabilities	= LINE6_CAP_CONTROL
+		.capabilities	= LINE6_CAP_CONTROL | LINE6_CAP_HWMON_CTL
 				| LINE6_CAP_PCM | LINE6_CAP_HWMON,
 		.altsetting = 1,
 		.ep_ctrl_r = 0x81,
--- linux-qcom-6.8.0.orig/sound/usb/midi2.c
+++ linux-qcom-6.8.0/sound/usb/midi2.c
@@ -873,6 +873,8 @@
 		fb->info.flags |= SNDRV_UMP_BLOCK_IS_MIDI1 |
 			SNDRV_UMP_BLOCK_IS_LOWSPEED;
 
+	snd_ump_update_group_attrs(rmidi->ump);
+
 	usb_audio_dbg(umidi->chip,
 		      "Created a UMP block %d from GTB, name=%s\n",
 		      blk, fb->info.name);
--- linux-qcom-6.8.0.orig/sound/usb/mixer.c
+++ linux-qcom-6.8.0/sound/usb/mixer.c
@@ -1084,6 +1084,21 @@
 				  struct snd_kcontrol *kctl)
 {
 	struct snd_usb_audio *chip = cval->head.mixer->chip;
+
+	if (chip->quirk_flags & QUIRK_FLAG_MIC_RES_384) {
+		if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+			usb_audio_info(chip,
+				"set resolution quirk: cval->res = 384\n");
+			cval->res = 384;
+		}
+	} else if (chip->quirk_flags & QUIRK_FLAG_MIC_RES_16) {
+		if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+			usb_audio_info(chip,
+				"set resolution quirk: cval->res = 16\n");
+			cval->res = 16;
+		}
+	}
+
 	switch (chip->usb_id) {
 	case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */
 	case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */
@@ -1168,27 +1183,6 @@
 		}
 		break;
 
-	case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
-	case USB_ID(0x046d, 0x0808):
-	case USB_ID(0x046d, 0x0809):
-	case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */
-	case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
-	case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
-	case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
-	case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
-	case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */
-	case USB_ID(0x046d, 0x0991):
-	case USB_ID(0x046d, 0x09a2): /* QuickCam Communicate Deluxe/S7500 */
-	/* Most audio usb devices lie about volume resolution.
-	 * Most Logitech webcams have res = 384.
-	 * Probably there is some logitech magic behind this number --fishor
-	 */
-		if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
-			usb_audio_info(chip,
-				"set resolution quirk: cval->res = 384\n");
-			cval->res = 384;
-		}
-		break;
 	case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */
 		if ((strstr(kctl->id.name, "Playback Volume") != NULL) ||
 			strstr(kctl->id.name, "Capture Volume") != NULL) {
@@ -1197,20 +1191,6 @@
 			cval->res = 1;
 		}
 		break;
-	case USB_ID(0x1224, 0x2a25): /* Jieli Technology USB PHY 2.0 */
-		if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
-			usb_audio_info(chip,
-				"set resolution quirk: cval->res = 16\n");
-			cval->res = 16;
-		}
-		break;
-	case USB_ID(0x1bcf, 0x2283): /* NexiGo N930AF FHD Webcam */
-		if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
-			usb_audio_info(chip,
-				"set resolution quirk: cval->res = 16\n");
-			cval->res = 16;
-		}
-		break;
 	}
 }
 
@@ -1370,6 +1350,19 @@
 
 #define get_min_max(cval, def)	get_min_max_with_quirks(cval, def, NULL)
 
+/* get the max value advertised via control API */
+static int get_max_exposed(struct usb_mixer_elem_info *cval)
+{
+	if (!cval->max_exposed) {
+		if (cval->res)
+			cval->max_exposed =
+				DIV_ROUND_UP(cval->max - cval->min, cval->res);
+		else
+			cval->max_exposed = cval->max - cval->min;
+	}
+	return cval->max_exposed;
+}
+
 /* get a feature/mixer unit info */
 static int mixer_ctl_feature_info(struct snd_kcontrol *kcontrol,
 				  struct snd_ctl_elem_info *uinfo)
@@ -1382,11 +1375,8 @@
 	else
 		uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
 	uinfo->count = cval->channels;
-	if (cval->val_type == USB_MIXER_BOOLEAN ||
-	    cval->val_type == USB_MIXER_INV_BOOLEAN) {
-		uinfo->value.integer.min = 0;
-		uinfo->value.integer.max = 1;
-	} else {
+	if (cval->val_type != USB_MIXER_BOOLEAN &&
+	    cval->val_type != USB_MIXER_INV_BOOLEAN) {
 		if (!cval->initialized) {
 			get_min_max_with_quirks(cval, 0, kcontrol);
 			if (cval->initialized && cval->dBmin >= cval->dBmax) {
@@ -1398,10 +1388,10 @@
 					       &kcontrol->id);
 			}
 		}
-		uinfo->value.integer.min = 0;
-		uinfo->value.integer.max =
-			DIV_ROUND_UP(cval->max - cval->min, cval->res);
 	}
+
+	uinfo->value.integer.min = 0;
+	uinfo->value.integer.max = get_max_exposed(cval);
 	return 0;
 }
 
@@ -1442,6 +1432,7 @@
 				 struct snd_ctl_elem_value *ucontrol)
 {
 	struct usb_mixer_elem_info *cval = kcontrol->private_data;
+	int max_val = get_max_exposed(cval);
 	int c, cnt, val, oval, err;
 	int changed = 0;
 
@@ -1454,6 +1445,8 @@
 			if (err < 0)
 				return filter_error(cval, err);
 			val = ucontrol->value.integer.value[cnt];
+			if (val < 0 || val > max_val)
+				return -EINVAL;
 			val = get_abs_value(cval, val);
 			if (oval != val) {
 				snd_usb_set_cur_mix_value(cval, c + 1, cnt, val);
@@ -1467,6 +1460,8 @@
 		if (err < 0)
 			return filter_error(cval, err);
 		val = ucontrol->value.integer.value[0];
+		if (val < 0 || val > max_val)
+			return -EINVAL;
 		val = get_abs_value(cval, val);
 		if (val != oval) {
 			snd_usb_set_cur_mix_value(cval, 0, 0, val);
@@ -2014,6 +2009,13 @@
 		bmaControls = ftr->bmaControls;
 	}
 
+	if (channels > 32) {
+		usb_audio_info(state->chip,
+			       "usbmixer: too many channels (%d) in unit %d\n",
+			       channels, unitid);
+		return -EINVAL;
+	}
+
 	/* parse the source unit */
 	err = parse_audio_unit(state, hdr->bSourceID);
 	if (err < 0)
@@ -2323,6 +2325,8 @@
 	if (err < 0)
 		return filter_error(cval, err);
 	val = ucontrol->value.integer.value[0];
+	if (val < 0 || val > get_max_exposed(cval))
+		return -EINVAL;
 	val = get_abs_value(cval, val);
 	if (val != oval) {
 		set_cur_ctl_value(cval, cval->control << 8, val);
@@ -2685,6 +2689,8 @@
 	if (err < 0)
 		return filter_error(cval, err);
 	val = ucontrol->value.enumerated.item[0];
+	if (val < 0 || val >= cval->max) /* here cval->max = # elements */
+		return -EINVAL;
 	val = get_abs_value(cval, val);
 	if (val != oval) {
 		set_cur_ctl_value(cval, cval->control << 8, val);
--- linux-qcom-6.8.0.orig/sound/usb/mixer.h
+++ linux-qcom-6.8.0/sound/usb/mixer.h
@@ -88,6 +88,7 @@
 	int channels;
 	int val_type;
 	int min, max, res;
+	int max_exposed; /* control API exposes the value in 0..max_exposed */
 	int dBmin, dBmax;
 	int cached;
 	int cache_val[MAX_CHANNELS];
--- linux-qcom-6.8.0.orig/sound/usb/mixer_maps.c
+++ linux-qcom-6.8.0/sound/usb/mixer_maps.c
@@ -621,6 +621,16 @@
 		.id = USB_ID(0x1b1c, 0x0a42),
 		.map = corsair_virtuoso_map,
 	},
+	{
+		/* Corsair HS80 RGB Wireless (wired mode) */
+		.id = USB_ID(0x1b1c, 0x0a6a),
+		.map = corsair_virtuoso_map,
+	},
+	{
+		/* Corsair HS80 RGB Wireless (wireless mode) */
+		.id = USB_ID(0x1b1c, 0x0a6b),
+		.map = corsair_virtuoso_map,
+	},
 	{	/* Gigabyte TRX40 Aorus Master (rear panel + front mic) */
 		.id = USB_ID(0x0414, 0xa001),
 		.map = aorus_master_alc1220vb_map,
--- linux-qcom-6.8.0.orig/sound/usb/mixer_quirks.c
+++ linux-qcom-6.8.0/sound/usb/mixer_quirks.c
@@ -14,6 +14,7 @@
  *	    Przemek Rudy (prudy1@o2.pl)
  */
 
+#include <linux/bitfield.h>
 #include <linux/hid.h>
 #include <linux/init.h>
 #include <linux/math64.h>
@@ -2926,6 +2927,415 @@
 }
 
 /*
+ * RME Digiface USB
+ */
+
+#define RME_DIGIFACE_READ_STATUS 17
+#define RME_DIGIFACE_STATUS_REG0L 0
+#define RME_DIGIFACE_STATUS_REG0H 1
+#define RME_DIGIFACE_STATUS_REG1L 2
+#define RME_DIGIFACE_STATUS_REG1H 3
+#define RME_DIGIFACE_STATUS_REG2L 4
+#define RME_DIGIFACE_STATUS_REG2H 5
+#define RME_DIGIFACE_STATUS_REG3L 6
+#define RME_DIGIFACE_STATUS_REG3H 7
+
+#define RME_DIGIFACE_CTL_REG1 16
+#define RME_DIGIFACE_CTL_REG2 18
+
+/* Reg is overloaded, 0-7 for status halfwords or 16 or 18 for control registers */
+#define RME_DIGIFACE_REGISTER(reg, mask) (((reg) << 16) | (mask))
+#define RME_DIGIFACE_INVERT BIT(31)
+
+/* Nonconst helpers */
+#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
+#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
+
+static int snd_rme_digiface_write_reg(struct snd_kcontrol *kcontrol, int item, u16 mask, u16 val)
+{
+	struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
+	struct snd_usb_audio *chip = list->mixer->chip;
+	struct usb_device *dev = chip->dev;
+	int err;
+
+	err = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
+			      item,
+			      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			      val, mask, NULL, 0);
+	if (err < 0)
+		dev_err(&dev->dev,
+			"unable to issue control set request %d (ret = %d)",
+			item, err);
+	return err;
+}
+
+static int snd_rme_digiface_read_status(struct snd_kcontrol *kcontrol, u32 status[4])
+{
+	struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
+	struct snd_usb_audio *chip = list->mixer->chip;
+	struct usb_device *dev = chip->dev;
+	__le32 buf[4];
+	int err;
+
+	err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0),
+			      RME_DIGIFACE_READ_STATUS,
+			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			      0, 0,
+			      buf, sizeof(buf));
+	if (err < 0) {
+		dev_err(&dev->dev,
+			"unable to issue status read request (ret = %d)",
+			err);
+	} else {
+		for (int i = 0; i < ARRAY_SIZE(buf); i++)
+			status[i] = le32_to_cpu(buf[i]);
+	}
+	return err;
+}
+
+static int snd_rme_digiface_get_status_val(struct snd_kcontrol *kcontrol)
+{
+	int err;
+	u32 status[4];
+	bool invert = kcontrol->private_value & RME_DIGIFACE_INVERT;
+	u8 reg = (kcontrol->private_value >> 16) & 0xff;
+	u16 mask = kcontrol->private_value & 0xffff;
+	u16 val;
+
+	err = snd_rme_digiface_read_status(kcontrol, status);
+	if (err < 0)
+		return err;
+
+	switch (reg) {
+	/* Status register halfwords */
+	case RME_DIGIFACE_STATUS_REG0L ... RME_DIGIFACE_STATUS_REG3H:
+		break;
+	case RME_DIGIFACE_CTL_REG1: /* Control register 1, present in halfword 3L */
+		reg = RME_DIGIFACE_STATUS_REG3L;
+		break;
+	case RME_DIGIFACE_CTL_REG2: /* Control register 2, present in halfword 3H */
+		reg = RME_DIGIFACE_STATUS_REG3H;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (reg & 1)
+		val = status[reg >> 1] >> 16;
+	else
+		val = status[reg >> 1] & 0xffff;
+
+	if (invert)
+		val ^= mask;
+
+	return field_get(mask, val);
+}
+
+static int snd_rme_digiface_rate_get(struct snd_kcontrol *kcontrol,
+				     struct snd_ctl_elem_value *ucontrol)
+{
+	int freq = snd_rme_digiface_get_status_val(kcontrol);
+
+	if (freq < 0)
+		return freq;
+	if (freq >= ARRAY_SIZE(snd_rme_rate_table))
+		return -EIO;
+
+	ucontrol->value.integer.value[0] = snd_rme_rate_table[freq];
+	return 0;
+}
+
+static int snd_rme_digiface_enum_get(struct snd_kcontrol *kcontrol,
+				     struct snd_ctl_elem_value *ucontrol)
+{
+	int val = snd_rme_digiface_get_status_val(kcontrol);
+
+	if (val < 0)
+		return val;
+
+	ucontrol->value.enumerated.item[0] = val;
+	return 0;
+}
+
+static int snd_rme_digiface_enum_put(struct snd_kcontrol *kcontrol,
+				     struct snd_ctl_elem_value *ucontrol)
+{
+	bool invert = kcontrol->private_value & RME_DIGIFACE_INVERT;
+	u8 reg = (kcontrol->private_value >> 16) & 0xff;
+	u16 mask = kcontrol->private_value & 0xffff;
+	u16 val = field_prep(mask, ucontrol->value.enumerated.item[0]);
+
+	if (invert)
+		val ^= mask;
+
+	return snd_rme_digiface_write_reg(kcontrol, reg, mask, val);
+}
+
+static int snd_rme_digiface_current_sync_get(struct snd_kcontrol *kcontrol,
+				     struct snd_ctl_elem_value *ucontrol)
+{
+	int ret = snd_rme_digiface_enum_get(kcontrol, ucontrol);
+
+	/* 7 means internal for current sync */
+	if (ucontrol->value.enumerated.item[0] == 7)
+		ucontrol->value.enumerated.item[0] = 0;
+
+	return ret;
+}
+
+static int snd_rme_digiface_sync_state_get(struct snd_kcontrol *kcontrol,
+					   struct snd_ctl_elem_value *ucontrol)
+{
+	u32 status[4];
+	int err;
+	bool valid, sync;
+
+	err = snd_rme_digiface_read_status(kcontrol, status);
+	if (err < 0)
+		return err;
+
+	valid = status[0] & BIT(kcontrol->private_value);
+	sync = status[0] & BIT(5 + kcontrol->private_value);
+
+	if (!valid)
+		ucontrol->value.enumerated.item[0] = SND_RME_CLOCK_NOLOCK;
+	else if (!sync)
+		ucontrol->value.enumerated.item[0] = SND_RME_CLOCK_LOCK;
+	else
+		ucontrol->value.enumerated.item[0] = SND_RME_CLOCK_SYNC;
+	return 0;
+}
+
+
+static int snd_rme_digiface_format_info(struct snd_kcontrol *kcontrol,
+					struct snd_ctl_elem_info *uinfo)
+{
+	static const char *const format[] = {
+		"ADAT", "S/PDIF"
+	};
+
+	return snd_ctl_enum_info(uinfo, 1,
+				 ARRAY_SIZE(format), format);
+}
+
+
+static int snd_rme_digiface_sync_source_info(struct snd_kcontrol *kcontrol,
+					     struct snd_ctl_elem_info *uinfo)
+{
+	static const char *const sync_sources[] = {
+		"Internal", "Input 1", "Input 2", "Input 3", "Input 4"
+	};
+
+	return snd_ctl_enum_info(uinfo, 1,
+				 ARRAY_SIZE(sync_sources), sync_sources);
+}
+
+static int snd_rme_digiface_rate_info(struct snd_kcontrol *kcontrol,
+				      struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+	uinfo->count = 1;
+	uinfo->value.integer.min = 0;
+	uinfo->value.integer.max = 200000;
+	uinfo->value.integer.step = 0;
+	return 0;
+}
+
+static const struct snd_kcontrol_new snd_rme_digiface_controls[] = {
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 1 Sync",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_sync_state_info,
+		.get = snd_rme_digiface_sync_state_get,
+		.private_value = 0,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 1 Format",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_digiface_format_info,
+		.get = snd_rme_digiface_enum_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG0H, BIT(0)) |
+			RME_DIGIFACE_INVERT,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 1 Rate",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_digiface_rate_info,
+		.get = snd_rme_digiface_rate_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG1L, GENMASK(3, 0)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 2 Sync",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_sync_state_info,
+		.get = snd_rme_digiface_sync_state_get,
+		.private_value = 1,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 2 Format",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_digiface_format_info,
+		.get = snd_rme_digiface_enum_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG0L, BIT(13)) |
+			RME_DIGIFACE_INVERT,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 2 Rate",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_digiface_rate_info,
+		.get = snd_rme_digiface_rate_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG1L, GENMASK(7, 4)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 3 Sync",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_sync_state_info,
+		.get = snd_rme_digiface_sync_state_get,
+		.private_value = 2,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 3 Format",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_digiface_format_info,
+		.get = snd_rme_digiface_enum_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG0L, BIT(14)) |
+			RME_DIGIFACE_INVERT,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 3 Rate",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_digiface_rate_info,
+		.get = snd_rme_digiface_rate_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG1L, GENMASK(11, 8)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 4 Sync",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_sync_state_info,
+		.get = snd_rme_digiface_sync_state_get,
+		.private_value = 3,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 4 Format",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_digiface_format_info,
+		.get = snd_rme_digiface_enum_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG0L, GENMASK(15, 12)) |
+			RME_DIGIFACE_INVERT,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Input 4 Rate",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_digiface_rate_info,
+		.get = snd_rme_digiface_rate_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG1L, GENMASK(3, 0)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Output 1 Format",
+		.access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
+		.info = snd_rme_digiface_format_info,
+		.get = snd_rme_digiface_enum_get,
+		.put = snd_rme_digiface_enum_put,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_CTL_REG2, BIT(0)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Output 2 Format",
+		.access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
+		.info = snd_rme_digiface_format_info,
+		.get = snd_rme_digiface_enum_get,
+		.put = snd_rme_digiface_enum_put,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_CTL_REG2, BIT(1)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Output 3 Format",
+		.access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
+		.info = snd_rme_digiface_format_info,
+		.get = snd_rme_digiface_enum_get,
+		.put = snd_rme_digiface_enum_put,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_CTL_REG2, BIT(3)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Output 4 Format",
+		.access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
+		.info = snd_rme_digiface_format_info,
+		.get = snd_rme_digiface_enum_get,
+		.put = snd_rme_digiface_enum_put,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_CTL_REG2, BIT(4)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Sync Source",
+		.access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
+		.info = snd_rme_digiface_sync_source_info,
+		.get = snd_rme_digiface_enum_get,
+		.put = snd_rme_digiface_enum_put,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_CTL_REG1, GENMASK(2, 0)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Current Sync Source",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_digiface_sync_source_info,
+		.get = snd_rme_digiface_current_sync_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG0L, GENMASK(12, 10)),
+	},
+	{
+		/*
+		 * This is writeable, but it is only set by the PCM rate.
+		 * Mixer apps currently need to drive the mixer using raw USB requests,
+		 * so they can also change this that way to configure the rate for
+		 * stand-alone operation when the PCM is closed.
+		 */
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "System Rate",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_rate_info,
+		.get = snd_rme_digiface_rate_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_CTL_REG1, GENMASK(6, 3)),
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "Current Rate",
+		.access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.info = snd_rme_rate_info,
+		.get = snd_rme_digiface_rate_get,
+		.private_value = RME_DIGIFACE_REGISTER(RME_DIGIFACE_STATUS_REG1H, GENMASK(7, 4)),
+	}
+};
+
+static int snd_rme_digiface_controls_create(struct usb_mixer_interface *mixer)
+{
+	int err, i;
+
+	for (i = 0; i < ARRAY_SIZE(snd_rme_digiface_controls); ++i) {
+		err = add_single_ctl_with_resume(mixer, 0,
+						 NULL,
+						 &snd_rme_digiface_controls[i],
+						 NULL);
+		if (err < 0)
+			return err;
+	}
+
+	return 0;
+}
+
+/*
  * Pioneer DJ DJM Mixers
  *
  * These devices generally have options for soft-switching the playback and
@@ -3468,6 +3878,9 @@
 			break;
 		err = dell_dock_mixer_init(mixer);
 		break;
+	case USB_ID(0x0bda, 0x402e): /* Dell WD19 dock */
+		err = dell_dock_mixer_create(mixer);
+		break;
 
 	case USB_ID(0x2a39, 0x3fd2): /* RME ADI-2 Pro */
 	case USB_ID(0x2a39, 0x3fd3): /* RME ADI-2 DAC */
@@ -3481,6 +3894,10 @@
 	case USB_ID(0x2a39, 0x3fb0): /* RME Babyface Pro FS */
 		err = snd_bbfpro_controls_create(mixer);
 		break;
+	case USB_ID(0x2a39, 0x3f8c): /* RME Digiface USB */
+	case USB_ID(0x2a39, 0x3fa0): /* RME Digiface USB (alternate) */
+		err = snd_rme_digiface_controls_create(mixer);
+		break;
 	case USB_ID(0x2b73, 0x0017): /* Pioneer DJ DJM-250MK2 */
 		err = snd_djm_controls_create(mixer, SND_DJM_250MK2_IDX);
 		break;
--- linux-qcom-6.8.0.orig/sound/usb/mixer_scarlett2.c
+++ linux-qcom-6.8.0/sound/usb/mixer_scarlett2.c
@@ -173,7 +173,12 @@
 
 /* some gui mixers can't handle negative ctl values */
 #define SCARLETT2_VOLUME_BIAS 127
-#define SCARLETT2_GAIN_BIAS 70
+
+/* maximum preamp input gain and value
+ * values are from 0 to 70, preamp gain is from 0 to 69 dB
+ */
+#define SCARLETT2_MAX_GAIN_VALUE 70
+#define SCARLETT2_MAX_GAIN_DB 69
 
 /* mixer range from -80dB to +6dB in 0.5dB steps */
 #define SCARLETT2_MIXER_MIN_DB -80
@@ -284,14 +289,22 @@
 	"Mute Playback Switch", "Dim Playback Switch"
 };
 
-/* Autogain Status Values */
-enum {
-	SCARLETT2_AUTOGAIN_STATUS_STOPPED,
-	SCARLETT2_AUTOGAIN_STATUS_RUNNING,
-	SCARLETT2_AUTOGAIN_STATUS_FAILED,
-	SCARLETT2_AUTOGAIN_STATUS_CANCELLED,
-	SCARLETT2_AUTOGAIN_STATUS_UNKNOWN,
-	SCARLETT2_AUTOGAIN_STATUS_COUNT
+/* The autogain_status is set based on the autogain_switch and
+ * raw_autogain_status values.
+ *
+ * If autogain_switch is set, autogain_status is set to 0 (Running).
+ * The other status values are from the raw_autogain_status value + 1.
+ */
+static const char *const scarlett2_autogain_status_texts[] = {
+	"Running",
+	"Success",
+	"SuccessDRover",
+	"WarnMinGainLimit",
+	"FailDRunder",
+	"FailMaxGainLimit",
+	"FailClipped",
+	"Cancelled",
+	"Invalid"
 };
 
 /* Power Status Values */
@@ -308,6 +321,7 @@
 	void (*func)(struct usb_mixer_interface *mixer);
 };
 
+static void scarlett2_notify_ack(struct usb_mixer_interface *mixer);
 static void scarlett2_notify_sync(struct usb_mixer_interface *mixer);
 static void scarlett2_notify_dim_mute(struct usb_mixer_interface *mixer);
 static void scarlett2_notify_monitor(struct usb_mixer_interface *mixer);
@@ -330,7 +344,7 @@
 /* Arrays of notification callback functions */
 
 static const struct scarlett2_notification scarlett2_notifications[] = {
-	{ 0x00000001, NULL }, /* ack, gets ignored */
+	{ 0x00000001, scarlett2_notify_ack },
 	{ 0x00000008, scarlett2_notify_sync },
 	{ 0x00200000, scarlett2_notify_dim_mute },
 	{ 0x00400000, scarlett2_notify_monitor },
@@ -340,14 +354,14 @@
 };
 
 static const struct scarlett2_notification scarlett3a_notifications[] = {
-	{ 0x00000001, NULL }, /* ack, gets ignored */
+	{ 0x00000001, scarlett2_notify_ack },
 	{ 0x00800000, scarlett2_notify_input_other },
 	{ 0x01000000, scarlett2_notify_direct_monitor },
 	{ 0, NULL }
 };
 
 static const struct scarlett2_notification scarlett4_solo_notifications[] = {
-	{ 0x00000001, NULL }, /* ack, gets ignored */
+	{ 0x00000001, scarlett2_notify_ack },
 	{ 0x00000008, scarlett2_notify_sync },
 	{ 0x00400000, scarlett2_notify_input_air },
 	{ 0x00800000, scarlett2_notify_direct_monitor },
@@ -358,7 +372,7 @@
 };
 
 static const struct scarlett2_notification scarlett4_2i2_notifications[] = {
-	{ 0x00000001, NULL }, /* ack, gets ignored */
+	{ 0x00000001, scarlett2_notify_ack },
 	{ 0x00000008, scarlett2_notify_sync },
 	{ 0x00200000, scarlett2_notify_input_safe },
 	{ 0x00400000, scarlett2_notify_autogain },
@@ -374,7 +388,7 @@
 };
 
 static const struct scarlett2_notification scarlett4_4i4_notifications[] = {
-	{ 0x00000001, NULL }, /* ack, gets ignored */
+	{ 0x00000001, scarlett2_notify_ack },
 	{ 0x00000008, scarlett2_notify_sync },
 	{ 0x00200000, scarlett2_notify_input_safe },
 	{ 0x00400000, scarlett2_notify_autogain },
@@ -415,7 +429,7 @@
 	SCARLETT2_CONFIG_INPUT_SELECT_SWITCH,
 	SCARLETT2_CONFIG_INPUT_LINK_SWITCH,
 	SCARLETT2_CONFIG_POWER_EXT,
-	SCARLETT2_CONFIG_POWER_STATUS,
+	SCARLETT2_CONFIG_POWER_LOW,
 	SCARLETT2_CONFIG_PCM_INPUT_SWITCH,
 	SCARLETT2_CONFIG_DIRECT_MONITOR_GAIN,
 	SCARLETT2_CONFIG_COUNT
@@ -723,8 +737,8 @@
 		[SCARLETT2_CONFIG_POWER_EXT] = {
 			.offset = 0x168 },
 
-		[SCARLETT2_CONFIG_POWER_STATUS] = {
-			.offset = 0x66 }
+		[SCARLETT2_CONFIG_POWER_LOW] = {
+			.offset = 0x16d }
 	}
 };
 
@@ -929,7 +943,9 @@
 struct scarlett2_data {
 	struct usb_mixer_interface *mixer;
 	struct mutex usb_mutex; /* prevent sending concurrent USB requests */
+	struct completion cmd_done;
 	struct mutex data_mutex; /* lock access to this data */
+	u8 running;
 	u8 hwdep_in_use;
 	u8 selected_flash_segment_id;
 	u8 flash_write_state;
@@ -1947,6 +1963,17 @@
 		goto unlock;
 	}
 
+	if (!wait_for_completion_timeout(&private->cmd_done,
+					 msecs_to_jiffies(1000))) {
+		usb_audio_err(
+			mixer->chip,
+			"%s USB request timed out, cmd %x\n",
+			private->series_name, cmd);
+
+		err = -ETIMEDOUT;
+		goto unlock;
+	}
+
 	/* send a second message to get the response */
 
 	err = scarlett2_usb_rx(dev, private->bInterfaceNumber,
@@ -2835,9 +2862,9 @@
 {
 	int i;
 
+	/* autogain_status[] is 0 if autogain is running */
 	for (i = 0; i < private->info->gain_input_count; i++)
-		if (private->autogain_status[i] ==
-		    SCARLETT2_AUTOGAIN_STATUS_RUNNING)
+		if (!private->autogain_status[i])
 			return 1;
 
 	return 0;
@@ -2867,25 +2894,25 @@
 		return err;
 
 	/* Translate autogain_switch and raw_autogain_status into
-	 * autogain_status
+	 * autogain_status.
+	 *
+	 * When autogain_switch[] is set, the status is the first
+	 * element in scarlett2_autogain_status_texts[] (Running). The
+	 * subsequent elements correspond to the status value from the
+	 * device (raw_autogain_status[]) + 1. The last element is
+	 * "Invalid", in case the device reports a status outside the
+	 * range of scarlett2_autogain_status_texts[].
 	 */
 	for (i = 0; i < info->gain_input_count; i++)
 		if (private->autogain_switch[i])
+			private->autogain_status[i] = 0;
+		else if (raw_autogain_status[i] <
+				ARRAY_SIZE(scarlett2_autogain_status_texts) - 1)
 			private->autogain_status[i] =
-				SCARLETT2_AUTOGAIN_STATUS_RUNNING;
-		else if (raw_autogain_status[i] == 0)
-			private->autogain_status[i] =
-				SCARLETT2_AUTOGAIN_STATUS_STOPPED;
-		else if (raw_autogain_status[i] >= 2 &&
-			 raw_autogain_status[i] <= 5)
-			private->autogain_status[i] =
-				SCARLETT2_AUTOGAIN_STATUS_FAILED;
-		else if (raw_autogain_status[i] == 6)
-			private->autogain_status[i] =
-				SCARLETT2_AUTOGAIN_STATUS_CANCELLED;
+				raw_autogain_status[i] + 1;
 		else
 			private->autogain_status[i] =
-				SCARLETT2_AUTOGAIN_STATUS_UNKNOWN;
+				ARRAY_SIZE(scarlett2_autogain_status_texts) - 1;
 
 	return 0;
 }
@@ -3111,12 +3138,10 @@
 static int scarlett2_autogain_status_ctl_info(
 	struct snd_kcontrol *kctl, struct snd_ctl_elem_info *uinfo)
 {
-	static const char *const values[SCARLETT2_AUTOGAIN_STATUS_COUNT] = {
-		"Stopped", "Running", "Failed", "Cancelled", "Unknown"
-	};
-
 	return snd_ctl_enum_info(
-		uinfo, 1, SCARLETT2_AUTOGAIN_STATUS_COUNT, values);
+		uinfo, 1,
+		ARRAY_SIZE(scarlett2_autogain_status_texts),
+		scarlett2_autogain_status_texts);
 }
 
 static const struct snd_kcontrol_new scarlett2_autogain_switch_ctl = {
@@ -3458,7 +3483,7 @@
 	uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
 	uinfo->count = elem->channels;
 	uinfo->value.integer.min = 0;
-	uinfo->value.integer.max = SCARLETT2_GAIN_BIAS;
+	uinfo->value.integer.max = SCARLETT2_MAX_GAIN_VALUE;
 	uinfo->value.integer.step = 1;
 
 unlock:
@@ -3535,7 +3560,7 @@
 }
 
 static const DECLARE_TLV_DB_MINMAX(
-	db_scale_scarlett2_gain, -SCARLETT2_GAIN_BIAS * 100, 0
+	db_scale_scarlett2_gain, 0, SCARLETT2_MAX_GAIN_DB * 100
 );
 
 static const struct snd_kcontrol_new scarlett2_input_gain_ctl = {
@@ -6294,8 +6319,7 @@
 {
 	struct scarlett2_data *private = mixer->private_data;
 	int err;
-	u8 power_ext;
-	u8 power_status;
+	u8 power_ext, power_low;
 
 	private->power_status_updated = 0;
 
@@ -6304,12 +6328,12 @@
 	if (err < 0)
 		return err;
 
-	err = scarlett2_usb_get_config(mixer, SCARLETT2_CONFIG_POWER_STATUS,
-				       1, &power_status);
+	err = scarlett2_usb_get_config(mixer, SCARLETT2_CONFIG_POWER_LOW,
+				       1, &power_low);
 	if (err < 0)
 		return err;
 
-	if (power_status > 1)
+	if (power_low)
 		private->power_status = SCARLETT2_POWER_STATUS_FAIL;
 	else if (power_ext)
 		private->power_status = SCARLETT2_POWER_STATUS_EXT;
@@ -6373,6 +6397,384 @@
 				     &private->power_status_ctl);
 }
 
+/*** Notification Handlers ***/
+
+/* Notify on sync change */
+static void scarlett2_notify_sync(struct usb_mixer_interface *mixer)
+{
+	struct scarlett2_data *private = mixer->private_data;
+
+	private->sync_updated = 1;
+
+	snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+		       &private->sync_ctl->id);
+}
+
+/* Notify on monitor change (Gen 2/3) */
+static void scarlett2_notify_monitor(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	int i;
+
+	if (!scarlett2_has_config_item(private, SCARLETT2_CONFIG_SW_HW_SWITCH))
+		return;
+
+	private->vol_updated = 1;
+
+	snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+		       &private->master_vol_ctl->id);
+
+	for (i = 0; i < private->num_line_out; i++)
+		if (private->vol_sw_hw_switch[line_out_remap(private, i)])
+			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+				       &private->vol_ctls[i]->id);
+}
+
+/* Notify on volume change (Gen 4) */
+static void scarlett2_notify_volume(struct usb_mixer_interface *mixer)
+{
+	struct scarlett2_data *private = mixer->private_data;
+
+	private->vol_updated = 1;
+
+	snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+		       &private->master_vol_ctl->id);
+	snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+		       &private->headphone_vol_ctl->id);
+}
+
+/* Notify on dim/mute change */
+static void scarlett2_notify_dim_mute(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	int i;
+
+	if (!scarlett2_has_config_item(private, SCARLETT2_CONFIG_SW_HW_SWITCH))
+		return;
+
+	private->dim_mute_updated = 1;
+
+	for (i = 0; i < SCARLETT2_DIM_MUTE_COUNT; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->dim_mute_ctls[i]->id);
+
+	for (i = 0; i < private->num_line_out; i++)
+		if (private->vol_sw_hw_switch[line_out_remap(private, i)])
+			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+				       &private->mute_ctls[i]->id);
+}
+
+/* Notify on input level switch change */
+static void scarlett2_notify_input_level(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_device_info *info = private->info;
+	int i;
+
+	private->input_level_updated = 1;
+
+	for (i = 0; i < info->level_input_count; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->level_ctls[i]->id);
+}
+
+/* Notify on input pad switch change */
+static void scarlett2_notify_input_pad(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_device_info *info = private->info;
+	int i;
+
+	private->input_pad_updated = 1;
+
+	for (i = 0; i < info->pad_input_count; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->pad_ctls[i]->id);
+}
+
+/* Notify on input air switch change */
+static void scarlett2_notify_input_air(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_device_info *info = private->info;
+	int i;
+
+	private->input_air_updated = 1;
+
+	for (i = 0; i < info->air_input_count; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->air_ctls[i]->id);
+}
+
+/* Notify on input phantom switch change */
+static void scarlett2_notify_input_phantom(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_device_info *info = private->info;
+	int i;
+
+	private->input_phantom_updated = 1;
+
+	for (i = 0; i < info->phantom_count; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->phantom_ctls[i]->id);
+
+	scarlett2_phantom_notify_access(mixer);
+}
+
+/* Notify on "input other" change (level/pad/air/phantom) */
+static void scarlett2_notify_input_other(struct usb_mixer_interface *mixer)
+{
+	scarlett2_notify_input_level(mixer);
+	scarlett2_notify_input_pad(mixer);
+	scarlett2_notify_input_air(mixer);
+	scarlett2_notify_input_phantom(mixer);
+}
+
+/* Notify on input select change */
+static void scarlett2_notify_input_select(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_device_info *info = private->info;
+	int i;
+
+	if (!info->gain_input_count)
+		return;
+
+	private->input_select_updated = 1;
+
+	snd_ctl_notify(card,
+		       SNDRV_CTL_EVENT_MASK_VALUE | SNDRV_CTL_EVENT_MASK_INFO,
+		       &private->input_select_ctl->id);
+
+	for (i = 0; i < info->gain_input_count / 2; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->input_link_ctls[i]->id);
+}
+
+/* Notify on input gain change */
+static void scarlett2_notify_input_gain(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_device_info *info = private->info;
+	int i;
+
+	if (!info->gain_input_count)
+		return;
+
+	private->input_gain_updated = 1;
+
+	for (i = 0; i < info->gain_input_count; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->input_gain_ctls[i]->id);
+}
+
+/* Notify on autogain change */
+static void scarlett2_notify_autogain(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_device_info *info = private->info;
+	int i;
+
+	if (!info->gain_input_count)
+		return;
+
+	private->autogain_updated = 1;
+
+	for (i = 0; i < info->gain_input_count; i++) {
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->autogain_ctls[i]->id);
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->autogain_status_ctls[i]->id);
+	}
+
+	scarlett2_autogain_notify_access(mixer);
+}
+
+/* Notify on input safe switch change */
+static void scarlett2_notify_input_safe(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_device_info *info = private->info;
+	int i;
+
+	if (!info->gain_input_count)
+		return;
+
+	private->input_safe_updated = 1;
+
+	for (i = 0; i < info->gain_input_count; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->safe_ctls[i]->id);
+}
+
+/* Notify on "monitor other" change (speaker switching, talkback) */
+static void scarlett2_notify_monitor_other(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_device_info *info = private->info;
+
+	private->monitor_other_updated = 1;
+
+	if (info->has_speaker_switching)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->speaker_switching_ctl->id);
+
+	if (info->has_talkback)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->talkback_ctl->id);
+
+	/* if speaker switching was recently enabled or disabled,
+	 * invalidate the dim/mute and mux enum controls
+	 */
+	if (private->speaker_switching_switched) {
+		int i;
+
+		scarlett2_notify_dim_mute(mixer);
+
+		private->speaker_switching_switched = 0;
+		private->mux_updated = 1;
+
+		for (i = 0; i < private->num_mux_dsts; i++)
+			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+				       &private->mux_ctls[i]->id);
+	}
+}
+
+/* Notify on direct monitor switch change */
+static void scarlett2_notify_direct_monitor(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	int count = private->num_mix_in * private->num_mix_out;
+	int i;
+
+	private->direct_monitor_updated = 1;
+
+	snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+		       &private->direct_monitor_ctl->id);
+
+	if (!scarlett2_has_mixer(private))
+		return;
+
+	private->mix_updated = 1;
+
+	/* Notify of change to the mix controls */
+	for (i = 0; i < count; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->mix_ctls[i]->id);
+}
+
+/* Notify on power change */
+static void scarlett2_notify_power_status(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+
+	private->power_status_updated = 1;
+
+	snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+		       &private->power_status_ctl->id);
+}
+
+/* Notify on mux change */
+static void scarlett2_notify_mux(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+	int i;
+
+	private->mux_updated = 1;
+
+	for (i = 0; i < private->num_mux_dsts; i++)
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &private->mux_ctls[i]->id);
+}
+
+/* Notify on PCM input switch change */
+static void scarlett2_notify_pcm_input_switch(struct usb_mixer_interface *mixer)
+{
+	struct snd_card *card = mixer->chip->card;
+	struct scarlett2_data *private = mixer->private_data;
+
+	private->pcm_input_switch_updated = 1;
+
+	snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+		       &private->pcm_input_switch_ctl->id);
+
+	scarlett2_notify_mux(mixer);
+}
+
+/* Handle acknowledgement that a command was received; let
+ * scarlett2_usb() know that it can proceed
+ */
+static void scarlett2_notify_ack(struct usb_mixer_interface *mixer)
+{
+	struct scarlett2_data *private = mixer->private_data;
+
+	/* if running == 0, ignore ACKs */
+	if (private->running)
+		complete(&private->cmd_done);
+}
+
+/* Interrupt callback */
+static void scarlett2_notify(struct urb *urb)
+{
+	struct usb_mixer_interface *mixer = urb->context;
+	int len = urb->actual_length;
+	int ustatus = urb->status;
+	u32 data;
+	struct scarlett2_data *private = mixer->private_data;
+	const struct scarlett2_notification *notifications =
+		private->config_set->notifications;
+
+	if (ustatus != 0 || len != 8)
+		goto requeue;
+
+	data = le32_to_cpu(*(__le32 *)urb->transfer_buffer);
+
+	/* Ignore notifications except ACK during initialisation.
+	 * ACK is 0x00000001 on every device.
+	 */
+	if (private->running < 2)
+		data &= 1;
+
+	while (data && notifications->mask) {
+		if (data & notifications->mask) {
+			data &= ~notifications->mask;
+			if (notifications->func)
+				notifications->func(mixer);
+		}
+		notifications++;
+	}
+
+	if (data)
+		usb_audio_warn(mixer->chip,
+			       "%s: Unhandled notification: 0x%08x\n",
+			       __func__, data);
+
+requeue:
+	if (ustatus != -ENOENT &&
+	    ustatus != -ECONNRESET &&
+	    ustatus != -ESHUTDOWN) {
+		urb->dev = mixer->chip->dev;
+		usb_submit_urb(urb, GFP_ATOMIC);
+	} else {
+		complete(&private->cmd_done);
+	}
+}
+
 /*** Cleanup/Suspend Callbacks ***/
 
 static void scarlett2_private_free(struct usb_mixer_interface *mixer)
@@ -6492,6 +6894,40 @@
 	return scarlett2_find_fc_interface(mixer->chip->dev, private);
 }
 
+/* Submit a URB to receive notifications from the device */
+static int scarlett2_init_notify(struct usb_mixer_interface *mixer)
+{
+	struct usb_device *dev = mixer->chip->dev;
+	struct scarlett2_data *private = mixer->private_data;
+	unsigned int pipe = usb_rcvintpipe(dev, private->bEndpointAddress);
+	void *transfer_buffer;
+
+	if (mixer->urb) {
+		usb_audio_err(mixer->chip,
+			      "%s: mixer urb already in use!\n", __func__);
+		return 0;
+	}
+
+	if (usb_pipe_type_check(dev, pipe))
+		return -EINVAL;
+
+	mixer->urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!mixer->urb)
+		return -ENOMEM;
+
+	transfer_buffer = kmalloc(private->wMaxPacketSize, GFP_KERNEL);
+	if (!transfer_buffer)
+		return -ENOMEM;
+
+	usb_fill_int_urb(mixer->urb, dev, pipe,
+			 transfer_buffer, private->wMaxPacketSize,
+			 scarlett2_notify, mixer, private->bInterval);
+
+	init_completion(&private->cmd_done);
+
+	return usb_submit_urb(mixer->urb, GFP_KERNEL);
+}
+
 /* Cargo cult proprietary initialisation sequence */
 static int scarlett2_usb_init(struct usb_mixer_interface *mixer)
 {
@@ -6511,6 +6947,24 @@
 	if (err < 0)
 		return err;
 
+	/* Set up the interrupt polling for notifications.
+	 * When running is:
+	 * 0: all notifications are ignored
+	 * 1: only ACKs are handled
+	 * 2: all notifications are handled
+	 */
+	err = scarlett2_init_notify(mixer);
+	if (err < 0)
+		return err;
+
+	/* sleep for a moment in case of an outstanding ACK */
+	msleep(20);
+
+	/* start handling ACKs, but no other notifications until the
+	 * ALSA controls have been created
+	 */
+	private->running = 1;
+
 	/* step 1 */
 	private->scarlett2_seq = 1;
 	err = scarlett2_usb(mixer, SCARLETT2_USB_INIT_1, NULL, 0, NULL, 0);
@@ -6780,393 +7234,6 @@
 	return scarlett2_usb_get_mux(mixer);
 }
 
-/* Notify on sync change */
-static void scarlett2_notify_sync(struct usb_mixer_interface *mixer)
-{
-	struct scarlett2_data *private = mixer->private_data;
-
-	private->sync_updated = 1;
-
-	snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
-		       &private->sync_ctl->id);
-}
-
-/* Notify on monitor change (Gen 2/3) */
-static void scarlett2_notify_monitor(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	int i;
-
-	if (!scarlett2_has_config_item(private, SCARLETT2_CONFIG_SW_HW_SWITCH))
-		return;
-
-	private->vol_updated = 1;
-
-	snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
-		       &private->master_vol_ctl->id);
-
-	for (i = 0; i < private->num_line_out; i++)
-		if (private->vol_sw_hw_switch[line_out_remap(private, i)])
-			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-				       &private->vol_ctls[i]->id);
-}
-
-/* Notify on volume change (Gen 4) */
-static void scarlett2_notify_volume(struct usb_mixer_interface *mixer)
-{
-	struct scarlett2_data *private = mixer->private_data;
-
-	private->vol_updated = 1;
-
-	snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
-		       &private->master_vol_ctl->id);
-	snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
-		       &private->headphone_vol_ctl->id);
-}
-
-/* Notify on dim/mute change */
-static void scarlett2_notify_dim_mute(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	int i;
-
-	if (!scarlett2_has_config_item(private, SCARLETT2_CONFIG_SW_HW_SWITCH))
-		return;
-
-	private->dim_mute_updated = 1;
-
-	for (i = 0; i < SCARLETT2_DIM_MUTE_COUNT; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->dim_mute_ctls[i]->id);
-
-	for (i = 0; i < private->num_line_out; i++)
-		if (private->vol_sw_hw_switch[line_out_remap(private, i)])
-			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-				       &private->mute_ctls[i]->id);
-}
-
-/* Notify on input level switch change */
-static void scarlett2_notify_input_level(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_device_info *info = private->info;
-	int i;
-
-	private->input_level_updated = 1;
-
-	for (i = 0; i < info->level_input_count; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->level_ctls[i]->id);
-}
-
-/* Notify on input pad switch change */
-static void scarlett2_notify_input_pad(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_device_info *info = private->info;
-	int i;
-
-	private->input_pad_updated = 1;
-
-	for (i = 0; i < info->pad_input_count; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->pad_ctls[i]->id);
-}
-
-/* Notify on input air switch change */
-static void scarlett2_notify_input_air(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_device_info *info = private->info;
-	int i;
-
-	private->input_air_updated = 1;
-
-	for (i = 0; i < info->air_input_count; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->air_ctls[i]->id);
-}
-
-/* Notify on input phantom switch change */
-static void scarlett2_notify_input_phantom(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_device_info *info = private->info;
-	int i;
-
-	private->input_phantom_updated = 1;
-
-	for (i = 0; i < info->phantom_count; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->phantom_ctls[i]->id);
-
-	scarlett2_phantom_notify_access(mixer);
-}
-
-/* Notify on "input other" change (level/pad/air/phantom) */
-static void scarlett2_notify_input_other(struct usb_mixer_interface *mixer)
-{
-	scarlett2_notify_input_level(mixer);
-	scarlett2_notify_input_pad(mixer);
-	scarlett2_notify_input_air(mixer);
-	scarlett2_notify_input_phantom(mixer);
-}
-
-/* Notify on input select change */
-static void scarlett2_notify_input_select(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_device_info *info = private->info;
-	int i;
-
-	if (!info->gain_input_count)
-		return;
-
-	private->input_select_updated = 1;
-
-	snd_ctl_notify(card,
-		       SNDRV_CTL_EVENT_MASK_VALUE | SNDRV_CTL_EVENT_MASK_INFO,
-		       &private->input_select_ctl->id);
-
-	for (i = 0; i < info->gain_input_count / 2; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->input_link_ctls[i]->id);
-}
-
-/* Notify on input gain change */
-static void scarlett2_notify_input_gain(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_device_info *info = private->info;
-	int i;
-
-	if (!info->gain_input_count)
-		return;
-
-	private->input_gain_updated = 1;
-
-	for (i = 0; i < info->gain_input_count; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->input_gain_ctls[i]->id);
-}
-
-/* Notify on autogain change */
-static void scarlett2_notify_autogain(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_device_info *info = private->info;
-	int i;
-
-	if (!info->gain_input_count)
-		return;
-
-	private->autogain_updated = 1;
-
-	for (i = 0; i < info->gain_input_count; i++) {
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->autogain_ctls[i]->id);
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->autogain_status_ctls[i]->id);
-	}
-
-	scarlett2_autogain_notify_access(mixer);
-}
-
-/* Notify on input safe switch change */
-static void scarlett2_notify_input_safe(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_device_info *info = private->info;
-	int i;
-
-	if (!info->gain_input_count)
-		return;
-
-	private->input_safe_updated = 1;
-
-	for (i = 0; i < info->gain_input_count; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->safe_ctls[i]->id);
-}
-
-/* Notify on "monitor other" change (speaker switching, talkback) */
-static void scarlett2_notify_monitor_other(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_device_info *info = private->info;
-
-	private->monitor_other_updated = 1;
-
-	if (info->has_speaker_switching)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->speaker_switching_ctl->id);
-
-	if (info->has_talkback)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->talkback_ctl->id);
-
-	/* if speaker switching was recently enabled or disabled,
-	 * invalidate the dim/mute and mux enum controls
-	 */
-	if (private->speaker_switching_switched) {
-		int i;
-
-		scarlett2_notify_dim_mute(mixer);
-
-		private->speaker_switching_switched = 0;
-		private->mux_updated = 1;
-
-		for (i = 0; i < private->num_mux_dsts; i++)
-			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-				       &private->mux_ctls[i]->id);
-	}
-}
-
-/* Notify on direct monitor switch change */
-static void scarlett2_notify_direct_monitor(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	int count = private->num_mix_in * private->num_mix_out;
-	int i;
-
-	private->direct_monitor_updated = 1;
-
-	snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-		       &private->direct_monitor_ctl->id);
-
-	if (!scarlett2_has_mixer(private))
-		return;
-
-	private->mix_updated = 1;
-
-	/* Notify of change to the mix controls */
-	for (i = 0; i < count; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->mix_ctls[i]->id);
-}
-
-/* Notify on power change */
-static void scarlett2_notify_power_status(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-
-	private->power_status_updated = 1;
-
-	snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-		       &private->power_status_ctl->id);
-}
-
-/* Notify on mux change */
-static void scarlett2_notify_mux(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-	int i;
-
-	private->mux_updated = 1;
-
-	for (i = 0; i < private->num_mux_dsts; i++)
-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-			       &private->mux_ctls[i]->id);
-}
-
-/* Notify on PCM input switch change */
-static void scarlett2_notify_pcm_input_switch(struct usb_mixer_interface *mixer)
-{
-	struct snd_card *card = mixer->chip->card;
-	struct scarlett2_data *private = mixer->private_data;
-
-	private->pcm_input_switch_updated = 1;
-
-	snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-		       &private->pcm_input_switch_ctl->id);
-
-	scarlett2_notify_mux(mixer);
-}
-
-/* Interrupt callback */
-static void scarlett2_notify(struct urb *urb)
-{
-	struct usb_mixer_interface *mixer = urb->context;
-	int len = urb->actual_length;
-	int ustatus = urb->status;
-	u32 data;
-	struct scarlett2_data *private = mixer->private_data;
-	const struct scarlett2_notification *notifications =
-		private->config_set->notifications;
-
-	if (ustatus != 0 || len != 8)
-		goto requeue;
-
-	data = le32_to_cpu(*(__le32 *)urb->transfer_buffer);
-
-	while (data && notifications->mask) {
-		if (data & notifications->mask) {
-			data &= ~notifications->mask;
-			if (notifications->func)
-				notifications->func(mixer);
-		}
-		notifications++;
-	}
-
-	if (data)
-		usb_audio_warn(mixer->chip,
-			       "%s: Unhandled notification: 0x%08x\n",
-			       __func__, data);
-
-requeue:
-	if (ustatus != -ENOENT &&
-	    ustatus != -ECONNRESET &&
-	    ustatus != -ESHUTDOWN) {
-		urb->dev = mixer->chip->dev;
-		usb_submit_urb(urb, GFP_ATOMIC);
-	}
-}
-
-static int scarlett2_init_notify(struct usb_mixer_interface *mixer)
-{
-	struct usb_device *dev = mixer->chip->dev;
-	struct scarlett2_data *private = mixer->private_data;
-	unsigned int pipe = usb_rcvintpipe(dev, private->bEndpointAddress);
-	void *transfer_buffer;
-
-	if (mixer->urb) {
-		usb_audio_err(mixer->chip,
-			      "%s: mixer urb already in use!\n", __func__);
-		return 0;
-	}
-
-	if (usb_pipe_type_check(dev, pipe))
-		return -EINVAL;
-
-	mixer->urb = usb_alloc_urb(0, GFP_KERNEL);
-	if (!mixer->urb)
-		return -ENOMEM;
-
-	transfer_buffer = kmalloc(private->wMaxPacketSize, GFP_KERNEL);
-	if (!transfer_buffer)
-		return -ENOMEM;
-
-	usb_fill_int_urb(mixer->urb, dev, pipe,
-			 transfer_buffer, private->wMaxPacketSize,
-			 scarlett2_notify, mixer, private->bInterval);
-
-	return usb_submit_urb(mixer->urb, GFP_KERNEL);
-}
-
 static const struct scarlett2_device_entry *get_scarlett2_device_entry(
 	struct usb_mixer_interface *mixer)
 {
@@ -7295,10 +7362,8 @@
 		scarlett2_phantom_update_access(mixer);
 	}
 
-	/* Set up the interrupt polling */
-	err = scarlett2_init_notify(mixer);
-	if (err < 0)
-		return err;
+	/* Start handling all notifications */
+	private->running = 2;
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/sound/usb/mixer_us16x08.c
+++ linux-qcom-6.8.0/sound/usb/mixer_us16x08.c
@@ -687,7 +687,7 @@
 	struct usb_mixer_elem_info *elem = kcontrol->private_data;
 	struct snd_usb_audio *chip = elem->head.mixer->chip;
 	struct snd_us16x08_meter_store *store = elem->private_data;
-	u8 meter_urb[64];
+	u8 meter_urb[64] = {0};
 
 	switch (kcontrol->private_value) {
 	case 0: {
--- linux-qcom-6.8.0.orig/sound/usb/quirks-table.h
+++ linux-qcom-6.8.0/sound/usb/quirks-table.h
@@ -35,10 +35,87 @@
 	.bInterfaceClass = USB_CLASS_AUDIO, \
 	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL
 
+/* Quirk .driver_info, followed by the definition of the quirk entry;
+ * put like QUIRK_DRIVER_INFO { ... } in each entry of the quirk table
+ */
+#define QUIRK_DRIVER_INFO \
+	.driver_info = (unsigned long)&(const struct snd_usb_audio_quirk)
+
+/*
+ * Macros for quirk data entries
+ */
+
+/* Quirk data entry for ignoring the interface */
+#define QUIRK_DATA_IGNORE(_ifno) \
+	.ifnum = (_ifno), .type = QUIRK_IGNORE_INTERFACE
+/* Quirk data entry for a standard audio interface */
+#define QUIRK_DATA_STANDARD_AUDIO(_ifno) \
+	.ifnum = (_ifno), .type = QUIRK_AUDIO_STANDARD_INTERFACE
+/* Quirk data entry for a standard MIDI interface */
+#define QUIRK_DATA_STANDARD_MIDI(_ifno) \
+	.ifnum = (_ifno), .type = QUIRK_MIDI_STANDARD_INTERFACE
+/* Quirk data entry for a standard mixer interface */
+#define QUIRK_DATA_STANDARD_MIXER(_ifno) \
+	.ifnum = (_ifno), .type = QUIRK_AUDIO_STANDARD_MIXER
+
+/* Quirk data entry for Yamaha MIDI */
+#define QUIRK_DATA_MIDI_YAMAHA(_ifno) \
+	.ifnum = (_ifno), .type = QUIRK_MIDI_YAMAHA
+/* Quirk data entry for Edirol UAxx */
+#define QUIRK_DATA_EDIROL_UAXX(_ifno) \
+	.ifnum = (_ifno), .type = QUIRK_AUDIO_EDIROL_UAXX
+/* Quirk data entry for raw bytes interface */
+#define QUIRK_DATA_RAW_BYTES(_ifno) \
+	.ifnum = (_ifno), .type = QUIRK_MIDI_RAW_BYTES
+
+/* Quirk composite array terminator */
+#define QUIRK_COMPOSITE_END	{ .ifnum = -1 }
+
+/* Quirk data entry for composite quirks;
+ * followed by the quirk array that is terminated with QUIRK_COMPOSITE_END
+ * e.g. QUIRK_DATA_COMPOSITE { { quirk1 }, { quirk2 },..., QUIRK_COMPOSITE_END }
+ */
+#define QUIRK_DATA_COMPOSITE \
+	.ifnum = QUIRK_ANY_INTERFACE, \
+	.type = QUIRK_COMPOSITE, \
+	.data = &(const struct snd_usb_audio_quirk[])
+
+/* Quirk data entry for a fixed audio endpoint;
+ * followed by audioformat definition
+ * e.g. QUIRK_DATA_AUDIOFORMAT(n) { .formats = xxx, ... }
+ */
+#define QUIRK_DATA_AUDIOFORMAT(_ifno)	    \
+	.ifnum = (_ifno),		    \
+	.type = QUIRK_AUDIO_FIXED_ENDPOINT, \
+	.data = &(const struct audioformat)
+
+/* Quirk data entry for a fixed MIDI endpoint;
+ * followed by snd_usb_midi_endpoint_info definition
+ * e.g. QUIRK_DATA_MIDI_FIXED_ENDPOINT(n) { .out_cables = x, .in_cables = y }
+ */
+#define QUIRK_DATA_MIDI_FIXED_ENDPOINT(_ifno) \
+	.ifnum = (_ifno),		      \
+	.type = QUIRK_MIDI_FIXED_ENDPOINT,    \
+	.data = &(const struct snd_usb_midi_endpoint_info)
+/* Quirk data entry for a MIDIMAN MIDI endpoint */
+#define QUIRK_DATA_MIDI_MIDIMAN(_ifno) \
+	.ifnum = (_ifno),	       \
+	.type = QUIRK_MIDI_MIDIMAN,    \
+	.data = &(const struct snd_usb_midi_endpoint_info)
+/* Quirk data entry for a EMAGIC MIDI endpoint */
+#define QUIRK_DATA_MIDI_EMAGIC(_ifno) \
+	.ifnum = (_ifno),	      \
+	.type = QUIRK_MIDI_EMAGIC,    \
+	.data = &(const struct snd_usb_midi_endpoint_info)
+
+/*
+ * Here we go... the quirk table definition begins:
+ */
+
 /* FTDI devices */
 {
 	USB_DEVICE(0x0403, 0xb8d8),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "STARR LABS", */
 		/* .product_name = "Starr Labs MIDI USB device", */
 		.ifnum = 0,
@@ -49,10 +126,8 @@
 {
 	/* Creative BT-D1 */
 	USB_DEVICE(0x041e, 0x0005),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = 1,
-		.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-		.data = &(const struct audioformat) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_AUDIOFORMAT(1) {
 			.formats = SNDRV_PCM_FMTBIT_S16_LE,
 			.channels = 2,
 			.iface = 1,
@@ -87,18 +162,11 @@
  */
 {
 	USB_AUDIO_DEVICE(0x041e, 0x4095),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(2) },
 			{
-				.ifnum = 3,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(3) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 2,
 					.fmt_bits = 16,
@@ -114,9 +182,7 @@
 					.rate_table = (unsigned int[]) { 48000 },
 				},
 			},
-			{
-				.ifnum = -1
-			},
+			QUIRK_COMPOSITE_END
 		},
 	},
 },
@@ -128,31 +194,18 @@
  */
 {
 	USB_DEVICE(0x0424, 0xb832),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Standard Microsystems Corp.",
 		.product_name = "HP Wireless Audio",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
 			/* Mixer */
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE,
-			},
+			{ QUIRK_DATA_IGNORE(0) },
 			/* Playback */
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE,
-			},
+			{ QUIRK_DATA_IGNORE(1) },
 			/* Capture */
-			{
-				.ifnum = 2,
-				.type = QUIRK_IGNORE_INTERFACE,
-			},
+			{ QUIRK_DATA_IGNORE(2) },
 			/* HID Device, .ifnum = 3 */
-			{
-				.ifnum = -1,
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -175,20 +228,18 @@
 
 #define YAMAHA_DEVICE(id, name) { \
 	USB_DEVICE(0x0499, id), \
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { \
+	QUIRK_DRIVER_INFO { \
 		.vendor_name = "Yamaha", \
 		.product_name = name, \
-		.ifnum = QUIRK_ANY_INTERFACE, \
-		.type = QUIRK_MIDI_YAMAHA \
+		QUIRK_DATA_MIDI_YAMAHA(QUIRK_ANY_INTERFACE) \
 	} \
 }
 #define YAMAHA_INTERFACE(id, intf, name) { \
 	USB_DEVICE_VENDOR_SPEC(0x0499, id), \
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { \
+	QUIRK_DRIVER_INFO { \
 		.vendor_name = "Yamaha", \
 		.product_name = name, \
-		.ifnum = intf, \
-		.type = QUIRK_MIDI_YAMAHA \
+		QUIRK_DATA_MIDI_YAMAHA(intf) \
 	} \
 }
 YAMAHA_DEVICE(0x1000, "UX256"),
@@ -275,135 +326,80 @@
 YAMAHA_DEVICE(0x105d, NULL),
 {
 	USB_DEVICE(0x0499, 0x1503),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Yamaha", */
 		/* .product_name = "MOX6/MOX8", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_YAMAHA
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			{ QUIRK_DATA_MIDI_YAMAHA(3) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0499, 0x1507),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Yamaha", */
 		/* .product_name = "THR10", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_YAMAHA
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			{ QUIRK_DATA_MIDI_YAMAHA(3) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0499, 0x1509),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Yamaha", */
 		/* .product_name = "Steinberg UR22", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_YAMAHA
-			},
-			{
-				.ifnum = 4,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			{ QUIRK_DATA_MIDI_YAMAHA(3) },
+			{ QUIRK_DATA_IGNORE(4) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0499, 0x150a),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Yamaha", */
 		/* .product_name = "THR5A", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_YAMAHA
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			{ QUIRK_DATA_MIDI_YAMAHA(3) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0499, 0x150c),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Yamaha", */
 		/* .product_name = "THR10C", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_YAMAHA
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			{ QUIRK_DATA_MIDI_YAMAHA(3) },
+			QUIRK_COMPOSITE_END
+		}
+	}
+},
+{
+	USB_DEVICE(0x0499, 0x1718),
+	QUIRK_DRIVER_INFO {
+		/* .vendor_name = "Yamaha", */
+		/* .product_name = "P-125", */
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			{ QUIRK_DATA_MIDI_YAMAHA(3) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -437,7 +433,7 @@
 	               USB_DEVICE_ID_MATCH_INT_CLASS,
 	.idVendor = 0x0499,
 	.bInterfaceClass = USB_CLASS_VENDOR_SPEC,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.ifnum = QUIRK_ANY_INTERFACE,
 		.type = QUIRK_AUTODETECT
 	}
@@ -448,16 +444,12 @@
  */
 {
 	USB_DEVICE(0x0582, 0x0000),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "UA-100",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 4,
 					.iface = 0,
@@ -472,9 +464,7 @@
 				}
 			},
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 2,
 					.iface = 1,
@@ -489,106 +479,66 @@
 				}
 			},
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0007,
 					.in_cables  = 0x0007
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0582, 0x0002),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UM-4",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x000f,
 					.in_cables  = 0x000f
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0582, 0x0003),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "SC-8850",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x003f,
 					.in_cables  = 0x003f
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0582, 0x0004),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "U-8",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0005,
 					.in_cables  = 0x0005
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -596,152 +546,92 @@
 	/* Has ID 0x0099 when not in "Advanced Driver" mode.
 	 * The UM-2EX has only one input, but we cannot detect this. */
 	USB_DEVICE(0x0582, 0x0005),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UM-2",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0003,
 					.in_cables  = 0x0003
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0582, 0x0007),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "SC-8820",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0013,
 					.in_cables  = 0x0013
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0582, 0x0008),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "PC-300",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x009d when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0009),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UM-1",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0582, 0x000b),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "SK-500",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0013,
 					.in_cables  = 0x0013
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -749,31 +639,19 @@
 	/* thanks to Emiliano Grilli <emillo@libero.it>
 	 * for helping researching this data */
 	USB_DEVICE(0x0582, 0x000c),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "SC-D70",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0007,
 					.in_cables  = 0x0007
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -787,35 +665,23 @@
 	 * the 96kHz sample rate.
 	 */
 	USB_DEVICE(0x0582, 0x0010),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UA-5",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x0013 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0012),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "XV-5050",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -824,12 +690,10 @@
 {
 	/* has ID 0x0015 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0014),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UM-880",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x01ff,
 			.in_cables  = 0x01ff
 		}
@@ -838,74 +702,48 @@
 {
 	/* has ID 0x0017 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0016),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "SD-90",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x000f,
 					.in_cables  = 0x000f
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x001c when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x001b),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "MMP-2",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x001e when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x001d),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "V-SYNTH",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -914,12 +752,10 @@
 {
 	/* has ID 0x0024 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0023),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UM-550",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x003f,
 			.in_cables  = 0x003f
 		}
@@ -932,20 +768,13 @@
 	 * and no MIDI.
 	 */
 	USB_DEVICE(0x0582, 0x0025),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UA-20",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 2,
 					.iface = 1,
@@ -960,9 +789,7 @@
 				}
 			},
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 2,
 					.iface = 2,
@@ -977,28 +804,22 @@
 				}
 			},
 			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x0028 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0027),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "SD-20",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0003,
 			.in_cables  = 0x0007
 		}
@@ -1007,12 +828,10 @@
 {
 	/* has ID 0x002a when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0029),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "SD-80",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x000f,
 			.in_cables  = 0x000f
 		}
@@ -1025,39 +844,24 @@
 	 * but offers only 16-bit PCM and no MIDI.
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x0582, 0x002b),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UA-700",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_EDIROL_UAXX(1) },
+			{ QUIRK_DATA_EDIROL_UAXX(2) },
+			{ QUIRK_DATA_EDIROL_UAXX(3) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x002e when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x002d),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "XV-2020",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1066,12 +870,10 @@
 {
 	/* has ID 0x0030 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x002f),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "VariOS",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0007,
 			.in_cables  = 0x0007
 		}
@@ -1080,12 +882,10 @@
 {
 	/* has ID 0x0034 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0033),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "PCR",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0003,
 			.in_cables  = 0x0007
 		}
@@ -1097,12 +897,10 @@
 	 * later revisions use IDs 0x0054 and 0x00a2.
 	 */
 	USB_DEVICE(0x0582, 0x0037),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "Digital Piano",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1115,39 +913,24 @@
 	 * and no MIDI.
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x0582, 0x003b),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "BOSS",
 		.product_name = "GS-10",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			{ QUIRK_DATA_STANDARD_MIDI(3) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x0041 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0040),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "GI-20",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1156,12 +939,10 @@
 {
 	/* has ID 0x0043 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0042),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "RS-70",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1170,36 +951,24 @@
 {
 	/* has ID 0x0049 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0047),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "EDIROL", */
 		/* .product_name = "UR-80", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
 			/* in the 96 kHz modes, only interface 1 is there */
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x004a when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0048),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "EDIROL", */
 		/* .product_name = "UR-80", */
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0003,
 			.in_cables  = 0x0007
 		}
@@ -1208,35 +977,23 @@
 {
 	/* has ID 0x004e when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x004c),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "PCR-A",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x004f when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x004d),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "PCR-A",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0003,
 			.in_cables  = 0x0007
 		}
@@ -1248,76 +1005,52 @@
 	 * is standard compliant, but has only 16-bit PCM.
 	 */
 	USB_DEVICE(0x0582, 0x0050),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UA-3FX",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0582, 0x0052),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UM-1SX",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_STANDARD_INTERFACE
+		QUIRK_DATA_STANDARD_MIDI(0)
 	}
 },
 {
 	USB_DEVICE(0x0582, 0x0060),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "EXR Series",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_STANDARD_INTERFACE
+		QUIRK_DATA_STANDARD_MIDI(0)
 	}
 },
 {
 	/* has ID 0x0066 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0064),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "EDIROL", */
 		/* .product_name = "PCR-1", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x0067 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0065),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "EDIROL", */
 		/* .product_name = "PCR-1", */
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0003
 		}
@@ -1326,12 +1059,10 @@
 {
 	/* has ID 0x006e when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x006d),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "FANTOM-X",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1344,39 +1075,24 @@
 	 * offers only 16-bit PCM at 44.1 kHz and no MIDI.
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x0582, 0x0074),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UA-25",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_EDIROL_UAXX(0) },
+			{ QUIRK_DATA_EDIROL_UAXX(1) },
+			{ QUIRK_DATA_EDIROL_UAXX(2) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* has ID 0x0076 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0075),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "BOSS",
 		.product_name = "DR-880",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1385,12 +1101,10 @@
 {
 	/* has ID 0x007b when not in "Advanced Driver" mode */
 	USB_DEVICE_VENDOR_SPEC(0x0582, 0x007a),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		/* "RD" or "RD-700SX"? */
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0003,
 			.in_cables  = 0x0003
 		}
@@ -1399,12 +1113,10 @@
 {
 	/* has ID 0x0081 when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x0080),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Roland",
 		.product_name = "G-70",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1413,12 +1125,10 @@
 {
 	/* has ID 0x008c when not in "Advanced Driver" mode */
 	USB_DEVICE(0x0582, 0x008b),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "PC-50",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1430,56 +1140,31 @@
 	 * is standard compliant, but has only 16-bit PCM and no MIDI.
 	 */
 	USB_DEVICE(0x0582, 0x00a3),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UA-4FX",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_EDIROL_UAXX(0) },
+			{ QUIRK_DATA_EDIROL_UAXX(1) },
+			{ QUIRK_DATA_EDIROL_UAXX(2) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* Edirol M-16DX */
 	USB_DEVICE(0x0582, 0x00c4),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -1489,37 +1174,22 @@
 	 * offers only 16-bit PCM at 44.1 kHz and no MIDI.
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x0582, 0x00e6),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "EDIROL",
 		.product_name = "UA-25EX",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_EDIROL_UAXX
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_EDIROL_UAXX(0) },
+			{ QUIRK_DATA_EDIROL_UAXX(1) },
+			{ QUIRK_DATA_EDIROL_UAXX(2) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* Edirol UM-3G */
 	USB_DEVICE_VENDOR_SPEC(0x0582, 0x0108),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-		.ifnum = 0,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) {
 			.out_cables = 0x0007,
 			.in_cables  = 0x0007
 		}
@@ -1528,45 +1198,29 @@
 {
 	/* BOSS ME-25 */
 	USB_DEVICE(0x0582, 0x0113),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* only 44.1 kHz works at the moment */
 	USB_DEVICE(0x0582, 0x0120),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Roland", */
 		/* .product_name = "OCTO-CAPTURE", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 10,
 					.iface = 0,
@@ -1582,9 +1236,7 @@
 				}
 			},
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 12,
 					.iface = 1,
@@ -1600,40 +1252,26 @@
 				}
 			},
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 4,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+			{ QUIRK_DATA_IGNORE(3) },
+			{ QUIRK_DATA_IGNORE(4) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* only 44.1 kHz works at the moment */
 	USB_DEVICE(0x0582, 0x012f),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Roland", */
 		/* .product_name = "QUAD-CAPTURE", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 4,
 					.iface = 0,
@@ -1649,9 +1287,7 @@
 				}
 			},
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 6,
 					.iface = 1,
@@ -1667,54 +1303,32 @@
 				}
 			},
 			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 4,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+			{ QUIRK_DATA_IGNORE(3) },
+			{ QUIRK_DATA_IGNORE(4) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0582, 0x0159),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Roland", */
 		/* .product_name = "UA-22", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) {
 					.out_cables = 0x0001,
 					.in_cables = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -1722,19 +1336,19 @@
 /* UA101 and co are supported by another driver */
 {
 	USB_DEVICE(0x0582, 0x0044), /* UA-1000 high speed */
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.ifnum = QUIRK_NODEV_INTERFACE
 	},
 },
 {
 	USB_DEVICE(0x0582, 0x007d), /* UA-101 high speed */
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.ifnum = QUIRK_NODEV_INTERFACE
 	},
 },
 {
 	USB_DEVICE(0x0582, 0x008d), /* UA-101 full speed */
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.ifnum = QUIRK_NODEV_INTERFACE
 	},
 },
@@ -1745,7 +1359,7 @@
 	               USB_DEVICE_ID_MATCH_INT_CLASS,
 	.idVendor = 0x0582,
 	.bInterfaceClass = USB_CLASS_VENDOR_SPEC,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.ifnum = QUIRK_ANY_INTERFACE,
 		.type = QUIRK_AUTODETECT
 	}
@@ -1760,12 +1374,10 @@
 	 * compliant USB MIDI ports for external MIDI and controls.
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x06f8, 0xb000),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Hercules",
 		.product_name = "DJ Console (WE)",
-		.ifnum = 4,
-		.type = QUIRK_MIDI_FIXED_ENDPOINT,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_FIXED_ENDPOINT(4) {
 			.out_cables = 0x0001,
 			.in_cables = 0x0001
 		}
@@ -1775,12 +1387,10 @@
 /* Midiman/M-Audio devices */
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x1002),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "MidiSport 2x2",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_MIDI_MIDIMAN,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) {
 			.out_cables = 0x0003,
 			.in_cables  = 0x0003
 		}
@@ -1788,12 +1398,10 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x1011),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "MidiSport 1x1",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_MIDI_MIDIMAN,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1801,12 +1409,10 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x1015),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "Keystation",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_MIDI_MIDIMAN,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1814,12 +1420,10 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x1021),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "MidiSport 4x4",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_MIDI_MIDIMAN,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) {
 			.out_cables = 0x000f,
 			.in_cables  = 0x000f
 		}
@@ -1832,12 +1436,10 @@
 	 * Thanks to Olaf Giesbrecht <Olaf_Giesbrecht@yahoo.de>
 	 */
 	USB_DEVICE_VER(0x0763, 0x1031, 0x0100, 0x0109),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "MidiSport 8x8",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_MIDI_MIDIMAN,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) {
 			.out_cables = 0x01ff,
 			.in_cables  = 0x01ff
 		}
@@ -1845,12 +1447,10 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x1033),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "MidiSport 8x8",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_MIDI_MIDIMAN,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) {
 			.out_cables = 0x01ff,
 			.in_cables  = 0x01ff
 		}
@@ -1858,12 +1458,10 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x1041),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "MidiSport 2x4",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_MIDI_MIDIMAN,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) {
 			.out_cables = 0x000f,
 			.in_cables  = 0x0003
 		}
@@ -1871,76 +1469,41 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x2001),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "Quattro",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
 			/*
 			 * Interfaces 0-2 are "Windows-compatible", 16-bit only,
 			 * and share endpoints with the other interfaces.
 			 * Ignore them.  The other interfaces can do 24 bits,
 			 * but captured samples are big-endian (see usbaudio.c).
 			 */
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
+			{ QUIRK_DATA_IGNORE(2) },
+			{ QUIRK_DATA_IGNORE(3) },
+			{ QUIRK_DATA_STANDARD_AUDIO(4) },
+			{ QUIRK_DATA_STANDARD_AUDIO(5) },
+			{ QUIRK_DATA_IGNORE(6) },
+			{ QUIRK_DATA_STANDARD_AUDIO(7) },
+			{ QUIRK_DATA_STANDARD_AUDIO(8) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 4,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 5,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 6,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 7,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 8,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 9,
-				.type = QUIRK_MIDI_MIDIMAN,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_MIDIMAN(9) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x2003),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "AudioPhile",
-		.ifnum = 6,
-		.type = QUIRK_MIDI_MIDIMAN,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_MIDIMAN(6) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1948,12 +1511,10 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x2008),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "Ozone",
-		.ifnum = 3,
-		.type = QUIRK_MIDI_MIDIMAN,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_MIDIMAN(3) {
 			.out_cables = 0x0001,
 			.in_cables  = 0x0001
 		}
@@ -1961,93 +1522,45 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x200d),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "M-Audio",
 		.product_name = "OmniStudio",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 4,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 5,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
+			{ QUIRK_DATA_IGNORE(2) },
+			{ QUIRK_DATA_IGNORE(3) },
+			{ QUIRK_DATA_STANDARD_AUDIO(4) },
+			{ QUIRK_DATA_STANDARD_AUDIO(5) },
+			{ QUIRK_DATA_IGNORE(6) },
+			{ QUIRK_DATA_STANDARD_AUDIO(7) },
+			{ QUIRK_DATA_STANDARD_AUDIO(8) },
 			{
-				.ifnum = 6,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 7,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 8,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 9,
-				.type = QUIRK_MIDI_MIDIMAN,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_MIDIMAN(9) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x0763, 0x2019),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "M-Audio", */
 		/* .product_name = "Ozone Academic", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_MIDIMAN,
-				.data = & (const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_MIDIMAN(3) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -2057,21 +1570,14 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x2030),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "M-Audio", */
 		/* .product_name = "Fast Track C400", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(1) },
 			/* Playback */
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 6,
 					.iface = 2,
@@ -2095,9 +1601,7 @@
 			},
 			/* Capture */
 			{
-				.ifnum = 3,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(3) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 4,
 					.iface = 3,
@@ -2119,30 +1623,21 @@
 					.clock = 0x80,
 				}
 			},
-			/* MIDI */
-			{
-				.ifnum = -1 /* Interface = 4 */
-			}
+			/* MIDI: Interface = 4*/
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x2031),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "M-Audio", */
 		/* .product_name = "Fast Track C600", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(1) },
 			/* Playback */
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 2,
@@ -2166,9 +1661,7 @@
 			},
 			/* Capture */
 			{
-				.ifnum = 3,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(3) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 6,
 					.iface = 3,
@@ -2190,29 +1683,20 @@
 					.clock = 0x80,
 				}
 			},
-			/* MIDI */
-			{
-				.ifnum = -1 /* Interface = 4 */
-			}
+			/* MIDI: Interface = 4 */
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x2080),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "M-Audio", */
 		/* .product_name = "Fast Track Ultra", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(0) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 1,
@@ -2234,9 +1718,7 @@
 				}
 			},
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 2,
@@ -2258,28 +1740,19 @@
 				}
 			},
 			/* interface 3 (MIDI) is standard compliant */
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0763, 0x2081),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "M-Audio", */
 		/* .product_name = "Fast Track Ultra 8R", */
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(0) },
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 1,
@@ -2301,9 +1774,7 @@
 				}
 			},
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 2,
@@ -2325,9 +1796,7 @@
 				}
 			},
 			/* interface 3 (MIDI) is standard compliant */
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -2335,21 +1804,19 @@
 /* Casio devices */
 {
 	USB_DEVICE(0x07cf, 0x6801),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Casio",
 		.product_name = "PL-40R",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_YAMAHA
+		QUIRK_DATA_MIDI_YAMAHA(0)
 	}
 },
 {
 	/* this ID is used by several devices without a product ID */
 	USB_DEVICE(0x07cf, 0x6802),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Casio",
 		.product_name = "Keyboard",
-		.ifnum = 0,
-		.type = QUIRK_MIDI_YAMAHA
+		QUIRK_DATA_MIDI_YAMAHA(0)
 	}
 },
 
@@ -2362,23 +1829,13 @@
 	.idVendor = 0x07fd,
 	.idProduct = 0x0001,
 	.bDeviceSubClass = 2,
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "MOTU",
 		.product_name = "Fastlane",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_MIDI_RAW_BYTES
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_RAW_BYTES(0) },
+			{ QUIRK_DATA_IGNORE(1) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -2386,12 +1843,10 @@
 /* Emagic devices */
 {
 	USB_DEVICE(0x086a, 0x0001),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Emagic",
 		.product_name = "Unitor8",
-		.ifnum = 2,
-		.type = QUIRK_MIDI_EMAGIC,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_EMAGIC(2) {
 			.out_cables = 0x80ff,
 			.in_cables  = 0x80ff
 		}
@@ -2399,12 +1854,10 @@
 },
 {
 	USB_DEVICE(0x086a, 0x0002),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Emagic",
 		/* .product_name = "AMT8", */
-		.ifnum = 2,
-		.type = QUIRK_MIDI_EMAGIC,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_EMAGIC(2) {
 			.out_cables = 0x80ff,
 			.in_cables  = 0x80ff
 		}
@@ -2412,12 +1865,10 @@
 },
 {
 	USB_DEVICE(0x086a, 0x0003),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Emagic",
 		/* .product_name = "MT4", */
-		.ifnum = 2,
-		.type = QUIRK_MIDI_EMAGIC,
-		.data = & (const struct snd_usb_midi_endpoint_info) {
+		QUIRK_DATA_MIDI_EMAGIC(2) {
 			.out_cables = 0x800f,
 			.in_cables  = 0x8003
 		}
@@ -2427,38 +1878,35 @@
 /* KORG devices */
 {
 	USB_DEVICE_VENDOR_SPEC(0x0944, 0x0200),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "KORG, Inc.",
 		/* .product_name = "PANDORA PX5D", */
-		.ifnum = 3,
-		.type = QUIRK_MIDI_STANDARD_INTERFACE,
+		QUIRK_DATA_STANDARD_MIDI(3)
 	}
 },
 
 {
 	USB_DEVICE_VENDOR_SPEC(0x0944, 0x0201),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "KORG, Inc.",
 		/* .product_name = "ToneLab ST", */
-		.ifnum = 3,
-		.type = QUIRK_MIDI_STANDARD_INTERFACE,
+		QUIRK_DATA_STANDARD_MIDI(3)
 	}
 },
 
 {
 	USB_DEVICE_VENDOR_SPEC(0x0944, 0x0204),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "KORG, Inc.",
 		/* .product_name = "ToneLab EX", */
-		.ifnum = 3,
-		.type = QUIRK_MIDI_STANDARD_INTERFACE,
+		QUIRK_DATA_STANDARD_MIDI(3)
 	}
 },
 
 /* AKAI devices */
 {
 	USB_DEVICE(0x09e8, 0x0062),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "AKAI",
 		.product_name = "MPD16",
 		.ifnum = 0,
@@ -2469,21 +1917,11 @@
 {
 	/* Akai MPC Element */
 	USB_DEVICE(0x09e8, 0x0021),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_MIDI_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_STANDARD_MIDI(1) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -2492,66 +1930,36 @@
 {
 	/* Steinberg MI2 */
 	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = &(const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* Steinberg MI4 */
 	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = & (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = &(const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -2559,34 +1967,31 @@
 /* TerraTec devices */
 {
 	USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "TerraTec",
 		.product_name = "PHASE 26",
-		.ifnum = 3,
-		.type = QUIRK_MIDI_STANDARD_INTERFACE
+		QUIRK_DATA_STANDARD_MIDI(3)
 	}
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0013),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "TerraTec",
 		.product_name = "PHASE 26",
-		.ifnum = 3,
-		.type = QUIRK_MIDI_STANDARD_INTERFACE
+		QUIRK_DATA_STANDARD_MIDI(3)
 	}
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0014),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "TerraTec",
 		.product_name = "PHASE 26",
-		.ifnum = 3,
-		.type = QUIRK_MIDI_STANDARD_INTERFACE
+		QUIRK_DATA_STANDARD_MIDI(3)
 	}
 },
 {
 	USB_DEVICE(0x0ccd, 0x0035),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Miditech",
 		.product_name = "Play'n Roll",
 		.ifnum = 0,
@@ -2594,10 +1999,14 @@
 	}
 },
 
+/* Stanton ScratchAmp */
+{ USB_DEVICE(0x103d, 0x0100) },
+{ USB_DEVICE(0x103d, 0x0101) },
+
 /* Novation EMS devices */
 {
 	USB_DEVICE_VENDOR_SPEC(0x1235, 0x0001),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Novation",
 		.product_name = "ReMOTE Audio/XStation",
 		.ifnum = 4,
@@ -2606,7 +2015,7 @@
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x1235, 0x0002),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Novation",
 		.product_name = "Speedio",
 		.ifnum = 3,
@@ -2615,38 +2024,29 @@
 },
 {
 	USB_DEVICE(0x1235, 0x000a),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Novation", */
 		/* .product_name = "Nocturn", */
-		.ifnum = 0,
-		.type = QUIRK_MIDI_RAW_BYTES
+		QUIRK_DATA_RAW_BYTES(0)
 	}
 },
 {
 	USB_DEVICE(0x1235, 0x000e),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		/* .vendor_name = "Novation", */
 		/* .product_name = "Launchpad", */
-		.ifnum = 0,
-		.type = QUIRK_MIDI_RAW_BYTES
+		QUIRK_DATA_RAW_BYTES(0)
 	}
 },
 {
 	USB_DEVICE(0x1235, 0x0010),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Focusrite",
 		.product_name = "Saffire 6 USB",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(0) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 4,
 					.iface = 0,
@@ -2673,9 +2073,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 2,
 					.iface = 0,
@@ -2697,28 +2095,19 @@
 					}
 				}
 			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_MIDI_RAW_BYTES
-			},
-			{
-				.ifnum = -1
-			}
+			{ QUIRK_DATA_RAW_BYTES(1) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE(0x1235, 0x0018),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Novation",
 		.product_name = "Twitch",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = & (const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 4,
 					.iface = 0,
@@ -2737,19 +2126,14 @@
 					}
 				}
 			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_MIDI_RAW_BYTES
-			},
-			{
-				.ifnum = -1
-			}
+			{ QUIRK_DATA_RAW_BYTES(1) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	USB_DEVICE_VENDOR_SPEC(0x1235, 0x4661),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Novation",
 		.product_name = "ReMOTE25",
 		.ifnum = 0,
@@ -2761,25 +2145,16 @@
 {
 	/* VirusTI Desktop */
 	USB_DEVICE_VENDOR_SPEC(0x133e, 0x0815),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 3,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = &(const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) {
 					.out_cables = 0x0003,
 					.in_cables  = 0x0003
 				}
 			},
-			{
-				.ifnum = 4,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+			{ QUIRK_DATA_IGNORE(4) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -2807,7 +2182,7 @@
 /* QinHeng devices */
 {
 	USB_DEVICE(0x1a86, 0x752d),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "QinHeng",
 		.product_name = "CH345",
 		.ifnum = 1,
@@ -2821,7 +2196,7 @@
 /* Miditech devices */
 {
 	USB_DEVICE(0x4752, 0x0011),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Miditech",
 		.product_name = "Midistart-2",
 		.ifnum = 0,
@@ -2833,7 +2208,7 @@
 {
 	/* this ID used by both Miditech MidiStudio-2 and CME UF-x */
 	USB_DEVICE(0x7104, 0x2202),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.ifnum = 0,
 		.type = QUIRK_MIDI_CME
 	}
@@ -2843,20 +2218,13 @@
 {
 	/* Thanks to Clemens Ladisch <clemens@ladisch.de> */
 	USB_DEVICE(0x0dba, 0x1000),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Digidesign",
 		.product_name = "MBox",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]){
+		QUIRK_DATA_COMPOSITE{
+			{ QUIRK_DATA_STANDARD_MIXER(0) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3BE,
 					.channels = 2,
 					.iface = 1,
@@ -2877,9 +2245,7 @@
 				}
 			},
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3BE,
 					.channels = 2,
 					.iface = 1,
@@ -2900,9 +2266,7 @@
 					}
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -2910,24 +2274,14 @@
 /* DIGIDESIGN MBOX 2 */
 {
 	USB_DEVICE(0x0dba, 0x3000),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Digidesign",
 		.product_name = "Mbox 2",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3BE,
 					.channels = 2,
 					.iface = 2,
@@ -2945,15 +2299,10 @@
 					}
 				}
 			},
+			{ QUIRK_DATA_IGNORE(3) },
 			{
-				.ifnum = 3,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 4,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
-				.formats = SNDRV_PCM_FMTBIT_S24_3BE,
+				QUIRK_DATA_AUDIOFORMAT(4) {
+					.formats = SNDRV_PCM_FMTBIT_S24_3BE,
 					.channels = 2,
 					.iface = 4,
 					.altsetting = 2,
@@ -2970,14 +2319,9 @@
 					}
 				}
 			},
+			{ QUIRK_DATA_IGNORE(5) },
 			{
-				.ifnum = 5,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 6,
-				.type = QUIRK_MIDI_MIDIMAN,
-				.data = &(const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_MIDIMAN(6) {
 					.out_ep =  0x02,
 					.out_cables = 0x0001,
 					.in_ep = 0x81,
@@ -2985,33 +2329,21 @@
 					.in_cables = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 /* DIGIDESIGN MBOX 3 */
 {
 	USB_DEVICE(0x0dba, 0x5000),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Digidesign",
 		.product_name = "Mbox 3",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_IGNORE(1) },
 			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 4,
 					.iface = 2,
@@ -3031,9 +2363,7 @@
 				}
 			},
 			{
-				.ifnum = 3,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(3) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 4,
 					.iface = 3,
@@ -3054,36 +2384,25 @@
 				}
 			},
 			{
-				.ifnum = 4,
-				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-				.data = &(const struct snd_usb_midi_endpoint_info) {
+				QUIRK_DATA_MIDI_FIXED_ENDPOINT(4) {
 					.out_cables = 0x0001,
 					.in_cables  = 0x0001
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 {
 	/* Tascam US122 MKII - playback-only support */
 	USB_DEVICE_VENDOR_SPEC(0x0644, 0x8021),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "TASCAM",
 		.product_name = "US122 MKII",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 2,
 					.iface = 1,
@@ -3104,9 +2423,7 @@
 					}
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3114,20 +2431,13 @@
 /* Denon DN-X1600 */
 {
 	USB_AUDIO_DEVICE(0x154e, 0x500e),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Denon",
 		.product_name = "DN-X1600",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]){
+		QUIRK_DATA_COMPOSITE{
+			{ QUIRK_DATA_IGNORE(0) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE,
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 1,
@@ -3148,9 +2458,7 @@
 				}
 			},
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 2,
@@ -3170,13 +2478,8 @@
 					}
 				}
 			},
-			{
-				.ifnum = 4,
-				.type = QUIRK_MIDI_STANDARD_INTERFACE,
-			},
-			{
-				.ifnum = -1
-			}
+			{ QUIRK_DATA_STANDARD_MIDI(4) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3185,17 +2488,13 @@
 {
 	USB_DEVICE(0x045e, 0x0283),
 	.bInterfaceClass = USB_CLASS_PER_INTERFACE,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Microsoft",
 		.product_name = "XboxLive Headset/Xbox Communicator",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
 			{
 				/* playback */
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 1,
 					.iface = 0,
@@ -3211,9 +2510,7 @@
 			},
 			{
 				/* capture */
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 1,
 					.iface = 1,
@@ -3227,9 +2524,7 @@
 					.rate_max = 16000
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3238,18 +2533,11 @@
 {
 	USB_DEVICE(0x200c, 0x100b),
 	.bInterfaceClass = USB_CLASS_PER_INTERFACE,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(0) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 4,
 					.iface = 1,
@@ -3268,9 +2556,7 @@
 					}
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3283,28 +2569,12 @@
 	 * enabled in create_standard_audio_quirk().
 	 */
 	USB_DEVICE(0x1686, 0x00dd),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				/* Playback  */
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE,
-			},
-			{
-				/* Capture */
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE,
-			},
-			{
-				/* Midi */
-				.ifnum = 3,
-				.type = QUIRK_MIDI_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = -1
-			},
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(1) }, /* Playback  */
+			{ QUIRK_DATA_STANDARD_AUDIO(2) }, /* Capture */
+			{ QUIRK_DATA_STANDARD_MIDI(3) }, /* Midi */
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3318,18 +2588,16 @@
 		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
 	.bInterfaceClass = USB_CLASS_AUDIO,
 	.bInterfaceSubClass = USB_SUBCLASS_MIDISTREAMING,
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_MIDI_STANDARD_INTERFACE
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_STANDARD_MIDI(QUIRK_ANY_INTERFACE)
 	}
 },
 
 /* Rane SL-1 */
 {
 	USB_DEVICE(0x13e5, 0x0001),
-	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_STANDARD_INTERFACE
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_STANDARD_AUDIO(QUIRK_ANY_INTERFACE)
         }
 },
 
@@ -3345,24 +2613,13 @@
 	 * and only the 48 kHz sample rate works for the playback interface.
 	 */
 	USB_DEVICE(0x0a12, 0x1243),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
-			/* Capture */
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE,
-			},
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(0) },
+			{ QUIRK_DATA_IGNORE(1) }, /* Capture */
 			/* Playback */
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 2,
 					.iface = 2,
@@ -3381,9 +2638,7 @@
 					}
 				}
 			},
-			{
-				.ifnum = -1
-			},
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3396,19 +2651,12 @@
 	 * even on windows.
 	 */
 	USB_DEVICE(0x19b5, 0x0021),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(0) },
 			/* Playback */
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 2,
 					.iface = 1,
@@ -3427,29 +2675,20 @@
 					}
 				}
 			},
-			{
-				.ifnum = -1
-			},
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
 /* MOTU Microbook II */
 {
 	USB_DEVICE_VENDOR_SPEC(0x07fd, 0x0004),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "MOTU",
 		.product_name = "MicroBookII",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(0) },
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3BE,
 					.channels = 6,
 					.iface = 0,
@@ -3470,9 +2709,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3BE,
 					.channels = 8,
 					.iface = 0,
@@ -3493,9 +2730,7 @@
 					}
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3507,14 +2742,10 @@
 	 * The feedback for the output is the input.
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x0023),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 12,
 					.iface = 0,
@@ -3531,9 +2762,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 10,
 					.iface = 0,
@@ -3551,9 +2780,7 @@
 					.rate_table = (unsigned int[]) { 44100 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3596,14 +2823,10 @@
 	 * but not for DVS (Digital Vinyl Systems) like in Mixxx.
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x0017),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8, // outputs
 					.iface = 0,
@@ -3620,9 +2843,7 @@
 					}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8, // inputs
 					.iface = 0,
@@ -3640,9 +2861,7 @@
 					.rate_table = (unsigned int[]) { 48000 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3653,14 +2872,10 @@
 	 * The feedback for the output is the dummy input.
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x000e),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 4,
 					.iface = 0,
@@ -3677,9 +2892,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 2,
 					.iface = 0,
@@ -3697,9 +2910,7 @@
 					.rate_table = (unsigned int[]) { 44100 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3710,14 +2921,10 @@
 	 * PCM is 6 channels out & 4 channels in @ 44.1 fixed
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x000d),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 6, //Master, Headphones & Booth
 					.iface = 0,
@@ -3734,9 +2941,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 4, //2x RCA inputs (CH1 & CH2)
 					.iface = 0,
@@ -3754,9 +2959,7 @@
 					.rate_table = (unsigned int[]) { 44100 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3768,14 +2971,10 @@
 	 * The Feedback for the output is the input
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x001e),
-		.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 4,
 					.iface = 0,
@@ -3792,9 +2991,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 6,
 					.iface = 0,
@@ -3812,9 +3009,7 @@
 					.rate_table = (unsigned int[]) { 44100 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3825,14 +3020,10 @@
 	 * 10 channels playback & 12 channels capture @ 44.1/48/96kHz S24LE
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x000a),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 10,
 					.iface = 0,
@@ -3853,9 +3044,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 12,
 					.iface = 0,
@@ -3877,9 +3066,7 @@
 					}
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3891,14 +3078,10 @@
 	 * The Feedback for the output is the input
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x0029),
-		.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 6,
 					.iface = 0,
@@ -3915,9 +3098,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 6,
 					.iface = 0,
@@ -3935,9 +3116,7 @@
 					.rate_table = (unsigned int[]) { 44100 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -3955,20 +3134,13 @@
  */
 {
 	USB_AUDIO_DEVICE(0x534d, 0x0021),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "MacroSilicon",
 		.product_name = "MS210x",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(2) },
 			{
-				.ifnum = 3,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(3) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 2,
 					.iface = 3,
@@ -3983,9 +3155,7 @@
 					.rate_max = 48000,
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4003,20 +3173,13 @@
  */
 {
 	USB_AUDIO_DEVICE(0x534d, 0x2109),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "MacroSilicon",
 		.product_name = "MS2109",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_MIXER,
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_MIXER(2) },
 			{
-				.ifnum = 3,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(3) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 2,
 					.iface = 3,
@@ -4031,9 +3194,7 @@
 					.rate_max = 48000,
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4043,14 +3204,10 @@
 	 * 8 channels playback & 8 channels capture @ 44.1/48/96kHz S24LE
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x08e4, 0x017f),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 0,
@@ -4069,9 +3226,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 0,
@@ -4091,9 +3246,7 @@
 					.rate_table = (unsigned int[]) { 44100, 48000, 96000 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4103,14 +3256,10 @@
 	 * 10 channels playback & 12 channels capture @ 48kHz S24LE
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x001b),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 10,
 					.iface = 0,
@@ -4129,9 +3278,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 12,
 					.iface = 0,
@@ -4149,9 +3296,7 @@
 					.rate_table = (unsigned int[]) { 48000 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4163,14 +3308,10 @@
 	 * Capture on EP 0x86
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x08e4, 0x0163),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 0,
@@ -4190,9 +3331,7 @@
 				}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8,
 					.iface = 0,
@@ -4212,9 +3351,7 @@
 					.rate_table = (unsigned int[]) { 44100, 48000, 96000 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4225,14 +3362,10 @@
 	 * and 8 channels in @ 48 fixed (endpoint 0x82).
 	 */
 	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x0013),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8, // outputs
 					.iface = 0,
@@ -4249,9 +3382,7 @@
 					}
 			},
 			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(0) {
 					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
 					.channels = 8, // inputs
 					.iface = 0,
@@ -4269,9 +3400,7 @@
 					.rate_table = (unsigned int[]) { 48000 }
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4282,28 +3411,15 @@
 	 */
 	USB_DEVICE(0x1395, 0x0300),
 	.bInterfaceClass = USB_CLASS_PER_INTERFACE,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
+	QUIRK_DRIVER_INFO {
+		QUIRK_DATA_COMPOSITE {
 			// Communication
-			{
-				.ifnum = 3,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
+			{ QUIRK_DATA_STANDARD_AUDIO(3) },
 			// Recording
-			{
-				.ifnum = 4,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
+			{ QUIRK_DATA_STANDARD_AUDIO(4) },
 			// Main
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
-			{
-				.ifnum = -1
-			}
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4312,21 +3428,14 @@
 	 * Fiero SC-01 (firmware v1.0.0 @ 48 kHz)
 	 */
 	USB_DEVICE(0x2b53, 0x0023),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Fiero",
 		.product_name = "SC-01",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
 			/* Playback */
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 2,
 					.fmt_bits = 24,
@@ -4346,9 +3455,7 @@
 			},
 			/* Capture */
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 2,
 					.fmt_bits = 24,
@@ -4367,9 +3474,7 @@
 					.clock = 0x29
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4378,21 +3483,14 @@
 	 * Fiero SC-01 (firmware v1.0.0 @ 96 kHz)
 	 */
 	USB_DEVICE(0x2b53, 0x0024),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Fiero",
 		.product_name = "SC-01",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
 			/* Playback */
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 2,
 					.fmt_bits = 24,
@@ -4412,9 +3510,7 @@
 			},
 			/* Capture */
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 2,
 					.fmt_bits = 24,
@@ -4433,9 +3529,7 @@
 					.clock = 0x29
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4444,21 +3538,14 @@
 	 * Fiero SC-01 (firmware v1.1.0)
 	 */
 	USB_DEVICE(0x2b53, 0x0031),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Fiero",
 		.product_name = "SC-01",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = &(const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-			},
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_STANDARD_AUDIO(0) },
 			/* Playback */
 			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(1) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 2,
 					.fmt_bits = 24,
@@ -4479,9 +3566,7 @@
 			},
 			/* Capture */
 			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
-				.data = &(const struct audioformat) {
+				QUIRK_DATA_AUDIOFORMAT(2) {
 					.formats = SNDRV_PCM_FMTBIT_S32_LE,
 					.channels = 2,
 					.fmt_bits = 24,
@@ -4501,9 +3586,7 @@
 					.clock = 0x29
 				}
 			},
-			{
-				.ifnum = -1
-			}
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
@@ -4512,30 +3595,192 @@
 	 * For the standard mode, Mythware XA001AU has ID ffad:a001
 	 */
 	USB_DEVICE_VENDOR_SPEC(0xffad, 0xa001),
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+	QUIRK_DRIVER_INFO {
 		.vendor_name = "Mythware",
 		.product_name = "XA001AU",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_COMPOSITE,
-		.data = (const struct snd_usb_audio_quirk[]) {
-			{
-				.ifnum = 0,
-				.type = QUIRK_IGNORE_INTERFACE,
-			},
-			{
-				.ifnum = 1,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE,
-			},
-			{
-				.ifnum = 2,
-				.type = QUIRK_AUDIO_STANDARD_INTERFACE,
-			},
-			{
-				.ifnum = -1
-			}
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			QUIRK_COMPOSITE_END
 		}
 	}
 },
+#define QUIRK_RME_DIGIFACE(pid) \
+{ \
+	/* Only claim interface 0 */ \
+	.match_flags = USB_DEVICE_ID_MATCH_VENDOR | \
+		       USB_DEVICE_ID_MATCH_PRODUCT | \
+		       USB_DEVICE_ID_MATCH_INT_CLASS | \
+		       USB_DEVICE_ID_MATCH_INT_NUMBER, \
+	.idVendor = 0x2a39, \
+	.idProduct = pid, \
+	.bInterfaceClass = USB_CLASS_VENDOR_SPEC, \
+	.bInterfaceNumber = 0, \
+	QUIRK_DRIVER_INFO { \
+		QUIRK_DATA_COMPOSITE { \
+			/*
+			 * Three modes depending on sample rate band,
+			 * with different channel counts for in/out
+			 */ \
+			{ QUIRK_DATA_STANDARD_MIXER(0) }, \
+			{ \
+				QUIRK_DATA_AUDIOFORMAT(0) { \
+					.formats = SNDRV_PCM_FMTBIT_S32_LE, \
+					.channels = 34, /* outputs */ \
+					.fmt_bits = 24, \
+					.iface = 0, \
+					.altsetting = 1, \
+					.altset_idx = 1, \
+					.endpoint = 0x02, \
+					.ep_idx = 1, \
+					.ep_attr = USB_ENDPOINT_XFER_ISOC | \
+						USB_ENDPOINT_SYNC_ASYNC, \
+					.rates = SNDRV_PCM_RATE_32000 | \
+						SNDRV_PCM_RATE_44100 | \
+						SNDRV_PCM_RATE_48000, \
+					.rate_min = 32000, \
+					.rate_max = 48000, \
+					.nr_rates = 3, \
+					.rate_table = (unsigned int[]) { \
+						32000, 44100, 48000, \
+					}, \
+					.sync_ep = 0x81, \
+					.sync_iface = 0, \
+					.sync_altsetting = 1, \
+					.sync_ep_idx = 0, \
+					.implicit_fb = 1, \
+				}, \
+			}, \
+			{ \
+				QUIRK_DATA_AUDIOFORMAT(0) { \
+					.formats = SNDRV_PCM_FMTBIT_S32_LE, \
+					.channels = 18, /* outputs */ \
+					.fmt_bits = 24, \
+					.iface = 0, \
+					.altsetting = 1, \
+					.altset_idx = 1, \
+					.endpoint = 0x02, \
+					.ep_idx = 1, \
+					.ep_attr = USB_ENDPOINT_XFER_ISOC | \
+						USB_ENDPOINT_SYNC_ASYNC, \
+					.rates = SNDRV_PCM_RATE_64000 | \
+						SNDRV_PCM_RATE_88200 | \
+						SNDRV_PCM_RATE_96000, \
+					.rate_min = 64000, \
+					.rate_max = 96000, \
+					.nr_rates = 3, \
+					.rate_table = (unsigned int[]) { \
+						64000, 88200, 96000, \
+					}, \
+					.sync_ep = 0x81, \
+					.sync_iface = 0, \
+					.sync_altsetting = 1, \
+					.sync_ep_idx = 0, \
+					.implicit_fb = 1, \
+				}, \
+			}, \
+			{ \
+				QUIRK_DATA_AUDIOFORMAT(0) { \
+					.formats = SNDRV_PCM_FMTBIT_S32_LE, \
+					.channels = 10, /* outputs */ \
+					.fmt_bits = 24, \
+					.iface = 0, \
+					.altsetting = 1, \
+					.altset_idx = 1, \
+					.endpoint = 0x02, \
+					.ep_idx = 1, \
+					.ep_attr = USB_ENDPOINT_XFER_ISOC | \
+						USB_ENDPOINT_SYNC_ASYNC, \
+					.rates = SNDRV_PCM_RATE_KNOT | \
+						SNDRV_PCM_RATE_176400 | \
+						SNDRV_PCM_RATE_192000, \
+					.rate_min = 128000, \
+					.rate_max = 192000, \
+					.nr_rates = 3, \
+					.rate_table = (unsigned int[]) { \
+						128000, 176400, 192000, \
+					}, \
+					.sync_ep = 0x81, \
+					.sync_iface = 0, \
+					.sync_altsetting = 1, \
+					.sync_ep_idx = 0, \
+					.implicit_fb = 1, \
+				}, \
+			}, \
+			{ \
+				QUIRK_DATA_AUDIOFORMAT(0) { \
+					.formats = SNDRV_PCM_FMTBIT_S32_LE, \
+					.channels = 32, /* inputs */ \
+					.fmt_bits = 24, \
+					.iface = 0, \
+					.altsetting = 1, \
+					.altset_idx = 1, \
+					.endpoint = 0x81, \
+					.ep_attr = USB_ENDPOINT_XFER_ISOC | \
+						USB_ENDPOINT_SYNC_ASYNC, \
+					.rates = SNDRV_PCM_RATE_32000 | \
+						SNDRV_PCM_RATE_44100 | \
+						SNDRV_PCM_RATE_48000, \
+					.rate_min = 32000, \
+					.rate_max = 48000, \
+					.nr_rates = 3, \
+					.rate_table = (unsigned int[]) { \
+						32000, 44100, 48000, \
+					} \
+				} \
+			}, \
+			{ \
+				QUIRK_DATA_AUDIOFORMAT(0) { \
+					.formats = SNDRV_PCM_FMTBIT_S32_LE, \
+					.channels = 16, /* inputs */ \
+					.fmt_bits = 24, \
+					.iface = 0, \
+					.altsetting = 1, \
+					.altset_idx = 1, \
+					.endpoint = 0x81, \
+					.ep_attr = USB_ENDPOINT_XFER_ISOC | \
+						USB_ENDPOINT_SYNC_ASYNC, \
+					.rates = SNDRV_PCM_RATE_64000 | \
+						SNDRV_PCM_RATE_88200 | \
+						SNDRV_PCM_RATE_96000, \
+					.rate_min = 64000, \
+					.rate_max = 96000, \
+					.nr_rates = 3, \
+					.rate_table = (unsigned int[]) { \
+						64000, 88200, 96000, \
+					} \
+				} \
+			}, \
+			{ \
+				QUIRK_DATA_AUDIOFORMAT(0) { \
+					.formats = SNDRV_PCM_FMTBIT_S32_LE, \
+					.channels = 8, /* inputs */ \
+					.fmt_bits = 24, \
+					.iface = 0, \
+					.altsetting = 1, \
+					.altset_idx = 1, \
+					.endpoint = 0x81, \
+					.ep_attr = USB_ENDPOINT_XFER_ISOC | \
+						USB_ENDPOINT_SYNC_ASYNC, \
+					.rates = SNDRV_PCM_RATE_KNOT | \
+						SNDRV_PCM_RATE_176400 | \
+						SNDRV_PCM_RATE_192000, \
+					.rate_min = 128000, \
+					.rate_max = 192000, \
+					.nr_rates = 3, \
+					.rate_table = (unsigned int[]) { \
+						128000, 176400, 192000, \
+					} \
+				} \
+			}, \
+			QUIRK_COMPOSITE_END \
+		} \
+	} \
+}
+
+QUIRK_RME_DIGIFACE(0x3f8c),
+QUIRK_RME_DIGIFACE(0x3fa0),
 
 #undef USB_DEVICE_VENDOR_SPEC
 #undef USB_AUDIO_DEVICE
--- linux-qcom-6.8.0.orig/sound/usb/quirks.c
+++ linux-qcom-6.8.0/sound/usb/quirks.c
@@ -555,6 +555,7 @@
 static int snd_usb_extigy_boot_quirk(struct usb_device *dev, struct usb_interface *intf)
 {
 	struct usb_host_config *config = dev->actconfig;
+	struct usb_device_descriptor *new_device_descriptor __free(kfree) = NULL;
 	int err;
 
 	if (le16_to_cpu(get_cfg_desc(config)->wTotalLength) == EXTIGY_FIRMWARE_SIZE_OLD ||
@@ -565,11 +566,19 @@
 				      0x10, 0x43, 0x0001, 0x000a, NULL, 0);
 		if (err < 0)
 			dev_dbg(&dev->dev, "error sending boot message: %d\n", err);
+
+		new_device_descriptor = kmalloc(sizeof(*new_device_descriptor), GFP_KERNEL);
+		if (!new_device_descriptor)
+			return -ENOMEM;
 		err = usb_get_descriptor(dev, USB_DT_DEVICE, 0,
-				&dev->descriptor, sizeof(dev->descriptor));
-		config = dev->actconfig;
+				new_device_descriptor, sizeof(*new_device_descriptor));
 		if (err < 0)
 			dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err);
+		if (new_device_descriptor->bNumConfigurations > dev->descriptor.bNumConfigurations)
+			dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n",
+				new_device_descriptor->bNumConfigurations);
+		else
+			memcpy(&dev->descriptor, new_device_descriptor, sizeof(dev->descriptor));
 		err = usb_reset_configuration(dev);
 		if (err < 0)
 			dev_dbg(&dev->dev, "error usb_reset_configuration: %d\n", err);
@@ -901,6 +910,7 @@
 static int snd_usb_mbox2_boot_quirk(struct usb_device *dev)
 {
 	struct usb_host_config *config = dev->actconfig;
+	struct usb_device_descriptor *new_device_descriptor __free(kfree) = NULL;
 	int err;
 	u8 bootresponse[0x12];
 	int fwsize;
@@ -935,11 +945,19 @@
 
 	dev_dbg(&dev->dev, "device initialised!\n");
 
+	new_device_descriptor = kmalloc(sizeof(*new_device_descriptor), GFP_KERNEL);
+	if (!new_device_descriptor)
+		return -ENOMEM;
+
 	err = usb_get_descriptor(dev, USB_DT_DEVICE, 0,
-		&dev->descriptor, sizeof(dev->descriptor));
-	config = dev->actconfig;
+		new_device_descriptor, sizeof(*new_device_descriptor));
 	if (err < 0)
 		dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err);
+	if (new_device_descriptor->bNumConfigurations > dev->descriptor.bNumConfigurations)
+		dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n",
+			new_device_descriptor->bNumConfigurations);
+	else
+		memcpy(&dev->descriptor, new_device_descriptor, sizeof(dev->descriptor));
 
 	err = usb_reset_configuration(dev);
 	if (err < 0)
@@ -1253,6 +1271,7 @@
 static int snd_usb_mbox3_boot_quirk(struct usb_device *dev)
 {
 	struct usb_host_config *config = dev->actconfig;
+	struct usb_device_descriptor *new_device_descriptor __free(kfree) = NULL;
 	int err;
 	int descriptor_size;
 
@@ -1265,11 +1284,19 @@
 
 	dev_dbg(&dev->dev, "device initialised!\n");
 
+	new_device_descriptor = kmalloc(sizeof(*new_device_descriptor), GFP_KERNEL);
+	if (!new_device_descriptor)
+		return -ENOMEM;
+
 	err = usb_get_descriptor(dev, USB_DT_DEVICE, 0,
-		&dev->descriptor, sizeof(dev->descriptor));
-	config = dev->actconfig;
+		new_device_descriptor, sizeof(*new_device_descriptor));
 	if (err < 0)
 		dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err);
+	if (new_device_descriptor->bNumConfigurations > dev->descriptor.bNumConfigurations)
+		dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n",
+			new_device_descriptor->bNumConfigurations);
+	else
+		memcpy(&dev->descriptor, new_device_descriptor, sizeof(dev->descriptor));
 
 	err = usb_reset_configuration(dev);
 	if (err < 0)
@@ -1392,6 +1419,27 @@
 	return 0;
 }
 
+static int snd_usb_rme_digiface_boot_quirk(struct usb_device *dev)
+{
+	/* Disable mixer, internal clock, all outputs ADAT, 48kHz, TMS off */
+	snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
+			16, 0x40, 0x2410, 0x7fff, NULL, 0);
+	snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
+			18, 0x40, 0x0104, 0xffff, NULL, 0);
+
+	/* Disable loopback for all inputs */
+	for (int ch = 0; ch < 32; ch++)
+		snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
+				22, 0x40, 0x400, ch, NULL, 0);
+
+	/* Unity gain for all outputs */
+	for (int ch = 0; ch < 34; ch++)
+		snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
+				21, 0x40, 0x9000, 0x100 + ch, NULL, 0);
+
+	return 0;
+}
+
 /*
  * Setup quirks
  */
@@ -1619,6 +1667,9 @@
 		    get_iface_desc(intf->altsetting)->bInterfaceNumber < 3)
 			return snd_usb_motu_microbookii_boot_quirk(dev);
 		break;
+	case USB_ID(0x2a39, 0x3f8c): /* RME Digiface USB */
+	case USB_ID(0x2a39, 0x3fa0): /* RME Digiface USB (alternate) */
+		return snd_usb_rme_digiface_boot_quirk(dev);
 	}
 
 	return 0;
@@ -1734,6 +1785,38 @@
 	return 0;
 }
 
+static const int rme_digiface_rate_table[] = {
+	32000, 44100, 48000, 0,
+	64000, 88200, 96000, 0,
+	128000, 176400, 192000, 0,
+};
+
+static int rme_digiface_set_format_quirk(struct snd_usb_substream *subs)
+{
+	unsigned int cur_rate = subs->data_endpoint->cur_rate;
+	u16 val;
+	int speed_mode;
+	int id;
+
+	for (id = 0; id < ARRAY_SIZE(rme_digiface_rate_table); id++) {
+		if (rme_digiface_rate_table[id] == cur_rate)
+			break;
+	}
+
+	if (id >= ARRAY_SIZE(rme_digiface_rate_table))
+		return -EINVAL;
+
+	/* 2, 3, 4 for 1x, 2x, 4x */
+	speed_mode = (id >> 2) + 2;
+	val = (id << 3) | (speed_mode << 12);
+
+	/* Set the sample rate */
+	snd_usb_ctl_msg(subs->stream->chip->dev,
+		usb_sndctrlpipe(subs->stream->chip->dev, 0),
+		16, 0x40, val, 0x7078, NULL, 0);
+	return 0;
+}
+
 void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
 			      const struct audioformat *fmt)
 {
@@ -1755,6 +1838,10 @@
 	case USB_ID(0x08e4, 0x0163): /* Pioneer DJM-850 */
 		pioneer_djm_set_format_quirk(subs, 0x0086);
 		break;
+	case USB_ID(0x2a39, 0x3f8c): /* RME Digiface USB */
+	case USB_ID(0x2a39, 0x3fa0): /* RME Digiface USB (alternate) */
+		rme_digiface_set_format_quirk(subs);
+		break;
 	}
 }
 
@@ -2016,6 +2103,8 @@
 
 static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
 	/* Device matches */
+	DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
+		   QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
 	DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
 		   QUIRK_FLAG_IGNORE_CTL_ERROR),
 	DEVICE_FLG(0x041e, 0x4080, /* Creative Live Cam VF0610 */
@@ -2023,12 +2112,35 @@
 	DEVICE_FLG(0x045e, 0x083c, /* MS USB Link headset */
 		   QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY |
 		   QUIRK_FLAG_DISABLE_AUTOSUSPEND),
+	DEVICE_FLG(0x046d, 0x0807, /* Logitech Webcam C500 */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+	DEVICE_FLG(0x046d, 0x0808, /* Logitech Webcam C600 */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+	DEVICE_FLG(0x046d, 0x0809,
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+	DEVICE_FLG(0x046d, 0x0819, /* Logitech Webcam C210 */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+	DEVICE_FLG(0x046d, 0x081b, /* HD Webcam c310 */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+	DEVICE_FLG(0x046d, 0x081d, /* HD Webcam c510 */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+	DEVICE_FLG(0x046d, 0x0825, /* HD Webcam c270 */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+	DEVICE_FLG(0x046d, 0x0826, /* HD Webcam c525 */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
 	DEVICE_FLG(0x046d, 0x084c, /* Logitech ConferenceCam Connect */
 		   QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY_1M),
+	DEVICE_FLG(0x046d, 0x08ca, /* Logitech Quickcam Fusion */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
 	DEVICE_FLG(0x046d, 0x0991, /* Logitech QuickCam Pro */
-		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR),
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR |
+		   QUIRK_FLAG_MIC_RES_384),
+	DEVICE_FLG(0x046d, 0x09a2, /* QuickCam Communicate Deluxe/S7500 */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
 	DEVICE_FLG(0x046d, 0x09a4, /* Logitech QuickCam E 3500 */
 		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR),
+	DEVICE_FLG(0x0499, 0x1506, /* Yamaha THR5 */
+		   QUIRK_FLAG_GENERIC_IMPLICIT_FB),
 	DEVICE_FLG(0x0499, 0x1509, /* Steinberg UR22 */
 		   QUIRK_FLAG_GENERIC_IMPLICIT_FB),
 	DEVICE_FLG(0x0499, 0x3108, /* Yamaha YIT-W12TX */
@@ -2085,6 +2197,10 @@
 		   QUIRK_FLAG_CTL_MSG_DELAY_1M),
 	DEVICE_FLG(0x0b0e, 0x0349, /* Jabra 550a */
 		   QUIRK_FLAG_CTL_MSG_DELAY_1M),
+	DEVICE_FLG(0x0c45, 0x6340, /* Sonix HD USB Camera */
+		   QUIRK_FLAG_GET_SAMPLE_RATE),
+	DEVICE_FLG(0x0d8c, 0x0014, /* USB Audio Device */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M),
 	DEVICE_FLG(0x0ecb, 0x205c, /* JBL Quantum610 Wireless */
 		   QUIRK_FLAG_FIXED_RATE),
 	DEVICE_FLG(0x0ecb, 0x2069, /* JBL Quantum810 Wireless */
@@ -2092,7 +2208,7 @@
 	DEVICE_FLG(0x0fd9, 0x0008, /* Hauppauge HVR-950Q */
 		   QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),
 	DEVICE_FLG(0x1224, 0x2a25, /* Jieli Technology USB PHY 2.0 */
-		   QUIRK_FLAG_GET_SAMPLE_RATE),
+		   QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
 	DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */
 		   QUIRK_FLAG_GET_SAMPLE_RATE),
 	DEVICE_FLG(0x1397, 0x0507, /* Behringer UMC202HD */
@@ -2121,14 +2237,18 @@
 		   QUIRK_FLAG_DISABLE_AUTOSUSPEND),
 	DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */
 		   QUIRK_FLAG_DISABLE_AUTOSUSPEND),
+	DEVICE_FLG(0x1852, 0x5062, /* Luxman D-08u */
+		   QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY),
 	DEVICE_FLG(0x1852, 0x5065, /* Luxman DA-06 */
 		   QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY),
 	DEVICE_FLG(0x1901, 0x0191, /* GE B850V3 CP2114 audio interface */
 		   QUIRK_FLAG_GET_SAMPLE_RATE),
 	DEVICE_FLG(0x19f7, 0x0035, /* RODE NT-USB+ */
 		   QUIRK_FLAG_GET_SAMPLE_RATE),
+	DEVICE_FLG(0x1bcf, 0x2281, /* HD Webcam */
+		   QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
 	DEVICE_FLG(0x1bcf, 0x2283, /* NexiGo N930AF FHD Webcam */
-		   QUIRK_FLAG_GET_SAMPLE_RATE),
+		   QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
 	DEVICE_FLG(0x2040, 0x7200, /* Hauppauge HVR-950Q */
 		   QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),
 	DEVICE_FLG(0x2040, 0x7201, /* Hauppauge HVR-950Q-MXL */
@@ -2167,6 +2287,8 @@
 		   QUIRK_FLAG_DSD_RAW),
 	DEVICE_FLG(0x2522, 0x0007, /* LH Labs Geek Out HD Audio 1V5 */
 		   QUIRK_FLAG_SET_IFACE_FIRST),
+	DEVICE_FLG(0x262a, 0x9302, /* ddHiFi TC44C */
+		   QUIRK_FLAG_DSD_RAW),
 	DEVICE_FLG(0x2708, 0x0002, /* Audient iD14 */
 		   QUIRK_FLAG_IGNORE_CTL_ERROR),
 	DEVICE_FLG(0x2912, 0x30c8, /* Audioengine D1 */
@@ -2177,6 +2299,10 @@
 		   QUIRK_FLAG_GENERIC_IMPLICIT_FB),
 	DEVICE_FLG(0x2b53, 0x0031, /* Fiero SC-01 (firmware v1.1.0) */
 		   QUIRK_FLAG_GENERIC_IMPLICIT_FB),
+	DEVICE_FLG(0x2d95, 0x8011, /* VIVO USB-C HEADSET */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M),
+	DEVICE_FLG(0x2d95, 0x8021, /* VIVO USB-C-XE710 HEADSET */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M),
 	DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */
 		   QUIRK_FLAG_IGNORE_CTL_ERROR),
 	DEVICE_FLG(0x413c, 0xa506, /* Dell AE515 sound bar */
--- linux-qcom-6.8.0.orig/sound/usb/stream.c
+++ linux-qcom-6.8.0/sound/usb/stream.c
@@ -244,8 +244,8 @@
 		SNDRV_CHMAP_FR,		/* right front */
 		SNDRV_CHMAP_FC,		/* center front */
 		SNDRV_CHMAP_LFE,	/* LFE */
-		SNDRV_CHMAP_SL,		/* left surround */
-		SNDRV_CHMAP_SR,		/* right surround */
+		SNDRV_CHMAP_RL,		/* left surround */
+		SNDRV_CHMAP_RR,		/* right surround */
 		SNDRV_CHMAP_FLC,	/* left of center */
 		SNDRV_CHMAP_FRC,	/* right of center */
 		SNDRV_CHMAP_RC,		/* surround */
@@ -300,9 +300,12 @@
 	c = 0;
 
 	if (bits) {
-		for (; bits && *maps; maps++, bits >>= 1)
+		for (; bits && *maps; maps++, bits >>= 1) {
 			if (bits & 1)
 				chmap->map[c++] = *maps;
+			if (c == chmap->channels)
+				break;
+		}
 	} else {
 		/* If we're missing wChannelConfig, then guess something
 		    to make sure the channel map is not skipped entirely */
--- linux-qcom-6.8.0.orig/sound/usb/usbaudio.h
+++ linux-qcom-6.8.0/sound/usb/usbaudio.h
@@ -182,6 +182,8 @@
  * QUIRK_FLAG_FIXED_RATE
  *  Do not set PCM rate (frequency) when only one rate is available
  *  for the given endpoint.
+ * QUIRK_FLAG_MIC_RES_16 and QUIRK_FLAG_MIC_RES_384
+ *  Set the fixed resolution for Mic Capture Volume (mostly for webcams)
  */
 
 #define QUIRK_FLAG_GET_SAMPLE_RATE	(1U << 0)
@@ -206,5 +208,7 @@
 #define QUIRK_FLAG_IFACE_SKIP_CLOSE	(1U << 19)
 #define QUIRK_FLAG_FORCE_IFACE_RESET	(1U << 20)
 #define QUIRK_FLAG_FIXED_RATE		(1U << 21)
+#define QUIRK_FLAG_MIC_RES_16		(1U << 22)
+#define QUIRK_FLAG_MIC_RES_384		(1U << 23)
 
 #endif /* __USBAUDIO_H */
--- linux-qcom-6.8.0.orig/sound/usb/usx2y/us122l.c
+++ linux-qcom-6.8.0/sound/usb/usx2y/us122l.c
@@ -617,10 +617,7 @@
 	usb_put_intf(usb_ifnum_to_if(us122l->dev, 1));
 	usb_put_dev(us122l->dev);
 
-	while (atomic_read(&us122l->mmap_count))
-		msleep(500);
-
-	snd_card_free(card);
+	snd_card_free_when_closed(card);
 }
 
 static int snd_us122l_suspend(struct usb_interface *intf, pm_message_t message)
--- linux-qcom-6.8.0.orig/sound/usb/usx2y/usbusx2y.c
+++ linux-qcom-6.8.0/sound/usb/usx2y/usbusx2y.c
@@ -423,7 +423,7 @@
 	}
 	if (usx2y->us428ctls_sharedmem)
 		wake_up(&usx2y->us428ctls_wait_queue_head);
-	snd_card_free(card);
+	snd_card_free_when_closed(card);
 }
 
 static int snd_usx2y_probe(struct usb_interface *intf,
--- linux-qcom-6.8.0.orig/tools/arch/arm64/include/asm/cputype.h
+++ linux-qcom-6.8.0/tools/arch/arm64/include/asm/cputype.h
@@ -85,6 +85,9 @@
 #define ARM_CPU_PART_CORTEX_X2		0xD48
 #define ARM_CPU_PART_NEOVERSE_N2	0xD49
 #define ARM_CPU_PART_CORTEX_A78C	0xD4B
+#define ARM_CPU_PART_NEOVERSE_V2	0xD4F
+#define ARM_CPU_PART_CORTEX_X4		0xD82
+#define ARM_CPU_PART_NEOVERSE_V3	0xD84
 
 #define APM_CPU_PART_XGENE		0x000
 #define APM_CPU_VAR_POTENZA		0x00
@@ -156,6 +159,9 @@
 #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2)
 #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2)
 #define MIDR_CORTEX_A78C	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C)
+#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2)
+#define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4)
+#define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3)
 #define MIDR_THUNDERX	MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
 #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
 #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
--- linux-qcom-6.8.0.orig/tools/arch/arm64/include/asm/sysreg.h
+++ linux-qcom-6.8.0/tools/arch/arm64/include/asm/sysreg.h
@@ -701,18 +701,18 @@
  * Permission Indirection Extension (PIE) permission encodings.
  * Encodings with the _O suffix, have overlays applied (Permission Overlay Extension).
  */
-#define PIE_NONE_O	0x0
-#define PIE_R_O		0x1
-#define PIE_X_O		0x2
-#define PIE_RX_O	0x3
-#define PIE_RW_O	0x5
-#define PIE_RWnX_O	0x6
-#define PIE_RWX_O	0x7
-#define PIE_R		0x8
-#define PIE_GCS		0x9
-#define PIE_RX		0xa
-#define PIE_RW		0xc
-#define PIE_RWX		0xe
+#define PIE_NONE_O	UL(0x0)
+#define PIE_R_O		UL(0x1)
+#define PIE_X_O		UL(0x2)
+#define PIE_RX_O	UL(0x3)
+#define PIE_RW_O	UL(0x5)
+#define PIE_RWnX_O	UL(0x6)
+#define PIE_RWX_O	UL(0x7)
+#define PIE_R		UL(0x8)
+#define PIE_GCS		UL(0x9)
+#define PIE_RX		UL(0xa)
+#define PIE_RW		UL(0xc)
+#define PIE_RWX		UL(0xe)
 
 #define PIRx_ELx_PERM(idx, perm)	((perm) << ((idx) * 4))
 
--- linux-qcom-6.8.0.orig/tools/arch/x86/intel_sdsi/intel_sdsi.c
+++ linux-qcom-6.8.0/tools/arch/x86/intel_sdsi/intel_sdsi.c
@@ -43,7 +43,6 @@
 #define METER_CERT_MAX_SIZE	4096
 #define STATE_MAX_NUM_LICENSES	16
 #define STATE_MAX_NUM_IN_BUNDLE	(uint32_t)8
-#define METER_MAX_NUM_BUNDLES	8
 
 #define __round_mask(x, y) ((__typeof__(x))((y) - 1))
 #define round_up(x, y) ((((x) - 1) | __round_mask(x, y)) + 1)
@@ -154,11 +153,12 @@
 };
 
 struct meter_certificate {
-	uint32_t block_signature;
-	uint32_t counter_unit;
+	uint32_t signature;
+	uint32_t version;
 	uint64_t ppin;
+	uint32_t counter_unit;
 	uint32_t bundle_length;
-	uint32_t reserved;
+	uint64_t reserved;
 	uint32_t mmrc_encoding;
 	uint32_t mmrc_counter;
 };
@@ -167,6 +167,11 @@
 	uint32_t encoding;
 	uint32_t counter;
 };
+#define METER_BUNDLE_SIZE sizeof(struct bundle_encoding_counter)
+#define BUNDLE_COUNT(length) ((length) / METER_BUNDLE_SIZE)
+#define METER_MAX_NUM_BUNDLES							\
+		((METER_CERT_MAX_SIZE - sizeof(struct meter_certificate)) /	\
+		 sizeof(struct bundle_encoding_counter))
 
 struct sdsi_dev {
 	struct sdsi_regs regs;
@@ -334,6 +339,7 @@
 	uint32_t count = 0;
 	FILE *cert_ptr;
 	int ret, size;
+	char name[4];
 
 	ret = sdsi_update_registers(s);
 	if (ret)
@@ -375,32 +381,40 @@
 	printf("\n");
 	printf("Meter certificate for device %s\n", s->dev_name);
 	printf("\n");
-	printf("Block Signature:       0x%x\n", mc->block_signature);
-	printf("Count Unit:            %dms\n", mc->counter_unit);
-	printf("PPIN:                  0x%lx\n", mc->ppin);
-	printf("Feature Bundle Length: %d\n", mc->bundle_length);
-	printf("MMRC encoding:         %d\n", mc->mmrc_encoding);
-	printf("MMRC counter:          %d\n", mc->mmrc_counter);
-	if (mc->bundle_length % 8) {
+
+	get_feature(mc->signature, name);
+	printf("Signature:                    %.4s\n", name);
+
+	printf("Version:                      %d\n", mc->version);
+	printf("Count Unit:                   %dms\n", mc->counter_unit);
+	printf("PPIN:                         0x%lx\n", mc->ppin);
+	printf("Feature Bundle Length:        %d\n", mc->bundle_length);
+
+	get_feature(mc->mmrc_encoding, name);
+	printf("MMRC encoding:                %.4s\n", name);
+
+	printf("MMRC counter:                 %d\n", mc->mmrc_counter);
+	if (mc->bundle_length % METER_BUNDLE_SIZE) {
 		fprintf(stderr, "Invalid bundle length\n");
 		return -1;
 	}
 
-	if (mc->bundle_length > METER_MAX_NUM_BUNDLES * 8)  {
-		fprintf(stderr, "More than %d bundles: %d\n",
-			METER_MAX_NUM_BUNDLES, mc->bundle_length / 8);
+	if (mc->bundle_length > METER_MAX_NUM_BUNDLES * METER_BUNDLE_SIZE)  {
+		fprintf(stderr, "More than %ld bundles: actual %ld\n",
+			METER_MAX_NUM_BUNDLES, BUNDLE_COUNT(mc->bundle_length));
 		return -1;
 	}
 
-	bec = (void *)(mc) + sizeof(mc);
+	bec = (struct bundle_encoding_counter *)(mc + 1);
 
-	printf("Number of Feature Counters:          %d\n", mc->bundle_length / 8);
-	while (count++ < mc->bundle_length / 8) {
+	printf("Number of Feature Counters:   %ld\n", BUNDLE_COUNT(mc->bundle_length));
+	while (count < BUNDLE_COUNT(mc->bundle_length)) {
 		char feature[5];
 
 		feature[4] = '\0';
 		get_feature(bec[count].encoding, feature);
 		printf("    %s:          %d\n", feature, bec[count].counter);
+		++count;
 	}
 
 	return 0;
--- linux-qcom-6.8.0.orig/tools/arch/x86/kcpuid/kcpuid.c
+++ linux-qcom-6.8.0/tools/arch/x86/kcpuid/kcpuid.c
@@ -7,7 +7,8 @@
 #include <string.h>
 #include <getopt.h>
 
-#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#define ARRAY_SIZE(x)	(sizeof(x) / sizeof((x)[0]))
+#define min(a, b)	(((a) < (b)) ? (a) : (b))
 
 typedef unsigned int u32;
 typedef unsigned long long u64;
@@ -207,12 +208,9 @@
 #define MAX_SUBLEAF_NUM		32
 struct cpuid_range *setup_cpuid_range(u32 input_eax)
 {
-	u32 max_func, idx_func;
-	int subleaf;
+	u32 max_func, idx_func, subleaf, max_subleaf;
+	u32 eax, ebx, ecx, edx, f = input_eax;
 	struct cpuid_range *range;
-	u32 eax, ebx, ecx, edx;
-	u32 f = input_eax;
-	int max_subleaf;
 	bool allzero;
 
 	eax = input_eax;
@@ -258,7 +256,7 @@
 		 * others have to be tried (0xf)
 		 */
 		if (f == 0x7 || f == 0x14 || f == 0x17 || f == 0x18)
-			max_subleaf = (eax & 0xff) + 1;
+			max_subleaf = min((eax & 0xff) + 1, max_subleaf);
 
 		if (f == 0xb)
 			max_subleaf = 2;
--- linux-qcom-6.8.0.orig/tools/arch/x86/lib/x86-opcode-map.txt
+++ linux-qcom-6.8.0/tools/arch/x86/lib/x86-opcode-map.txt
@@ -148,7 +148,7 @@
 65: SEG=GS (Prefix)
 66: Operand-Size (Prefix)
 67: Address-Size (Prefix)
-68: PUSH Iz (d64)
+68: PUSH Iz
 69: IMUL Gv,Ev,Iz
 6a: PUSH Ib (d64)
 6b: IMUL Gv,Ev,Ib
@@ -698,10 +698,10 @@
 4d: vrcp14ss/d Vsd,Hpd,Wsd (66),(ev)
 4e: vrsqrt14ps/d Vpd,Wpd (66),(ev)
 4f: vrsqrt14ss/d Vsd,Hsd,Wsd (66),(ev)
-50: vpdpbusd Vx,Hx,Wx (66),(ev)
-51: vpdpbusds Vx,Hx,Wx (66),(ev)
-52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66),(ev) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev)
-53: vpdpwssds Vx,Hx,Wx (66),(ev) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev)
+50: vpdpbusd Vx,Hx,Wx (66)
+51: vpdpbusds Vx,Hx,Wx (66)
+52: vdpbf16ps Vx,Hx,Wx (F3),(ev) | vpdpwssd Vx,Hx,Wx (66) | vp4dpwssd Vdqq,Hdqq,Wdq (F2),(ev)
+53: vpdpwssds Vx,Hx,Wx (66) | vp4dpwssds Vdqq,Hdqq,Wdq (F2),(ev)
 54: vpopcntb/w Vx,Wx (66),(ev)
 55: vpopcntd/q Vx,Wx (66),(ev)
 58: vpbroadcastd Vx,Wx (66),(v)
--- linux-qcom-6.8.0.orig/tools/bpf/bpftool/common.c
+++ linux-qcom-6.8.0/tools/bpf/bpftool/common.c
@@ -244,29 +244,101 @@
 	return fd;
 }
 
-int mount_bpffs_for_pin(const char *name, bool is_dir)
+int create_and_mount_bpffs_dir(const char *dir_name)
 {
 	char err_str[ERR_MAX_LEN];
-	char *file;
-	char *dir;
+	bool dir_exists;
 	int err = 0;
 
-	if (is_dir && is_bpffs(name))
+	if (is_bpffs(dir_name))
 		return err;
 
-	file = malloc(strlen(name) + 1);
-	if (!file) {
+	dir_exists = access(dir_name, F_OK) == 0;
+
+	if (!dir_exists) {
+		char *temp_name;
+		char *parent_name;
+
+		temp_name = strdup(dir_name);
+		if (!temp_name) {
+			p_err("mem alloc failed");
+			return -1;
+		}
+
+		parent_name = dirname(temp_name);
+
+		if (is_bpffs(parent_name)) {
+			/* nothing to do if already mounted */
+			free(temp_name);
+			return err;
+		}
+
+		if (access(parent_name, F_OK) == -1) {
+			p_err("can't create dir '%s' to pin BPF object: parent dir '%s' doesn't exist",
+			      dir_name, parent_name);
+			free(temp_name);
+			return -1;
+		}
+
+		free(temp_name);
+	}
+
+	if (block_mount) {
+		p_err("no BPF file system found, not mounting it due to --nomount option");
+		return -1;
+	}
+
+	if (!dir_exists) {
+		err = mkdir(dir_name, S_IRWXU);
+		if (err) {
+			p_err("failed to create dir '%s': %s", dir_name, strerror(errno));
+			return err;
+		}
+	}
+
+	err = mnt_fs(dir_name, "bpf", err_str, ERR_MAX_LEN);
+	if (err) {
+		err_str[ERR_MAX_LEN - 1] = '\0';
+		p_err("can't mount BPF file system on given dir '%s': %s",
+		      dir_name, err_str);
+
+		if (!dir_exists)
+			rmdir(dir_name);
+	}
+
+	return err;
+}
+
+int mount_bpffs_for_file(const char *file_name)
+{
+	char err_str[ERR_MAX_LEN];
+	char *temp_name;
+	char *dir;
+	int err = 0;
+
+	if (access(file_name, F_OK) != -1) {
+		p_err("can't pin BPF object: path '%s' already exists", file_name);
+		return -1;
+	}
+
+	temp_name = strdup(file_name);
+	if (!temp_name) {
 		p_err("mem alloc failed");
 		return -1;
 	}
 
-	strcpy(file, name);
-	dir = dirname(file);
+	dir = dirname(temp_name);
 
 	if (is_bpffs(dir))
 		/* nothing to do if already mounted */
 		goto out_free;
 
+	if (access(dir, F_OK) == -1) {
+		p_err("can't pin BPF object: dir '%s' doesn't exist", dir);
+		err = -1;
+		goto out_free;
+	}
+
 	if (block_mount) {
 		p_err("no BPF file system found, not mounting it due to --nomount option");
 		err = -1;
@@ -276,12 +348,12 @@
 	err = mnt_fs(dir, "bpf", err_str, ERR_MAX_LEN);
 	if (err) {
 		err_str[ERR_MAX_LEN - 1] = '\0';
-		p_err("can't mount BPF file system to pin the object (%s): %s",
-		      name, err_str);
+		p_err("can't mount BPF file system to pin the object '%s': %s",
+		      file_name, err_str);
 	}
 
 out_free:
-	free(file);
+	free(temp_name);
 	return err;
 }
 
@@ -289,7 +361,7 @@
 {
 	int err;
 
-	err = mount_bpffs_for_pin(name, false);
+	err = mount_bpffs_for_file(name);
 	if (err)
 		return err;
 
@@ -338,7 +410,7 @@
 {
 	const char *prog_name = prog_info->name;
 	const struct btf_type *func_type;
-	const struct bpf_func_info finfo = {};
+	struct bpf_func_info finfo = {};
 	struct bpf_prog_info info = {};
 	__u32 info_len = sizeof(info);
 	struct btf *prog_btf = NULL;
--- linux-qcom-6.8.0.orig/tools/bpf/bpftool/iter.c
+++ linux-qcom-6.8.0/tools/bpf/bpftool/iter.c
@@ -76,7 +76,7 @@
 		goto close_obj;
 	}
 
-	err = mount_bpffs_for_pin(path, false);
+	err = mount_bpffs_for_file(path);
 	if (err)
 		goto close_link;
 
--- linux-qcom-6.8.0.orig/tools/bpf/bpftool/jit_disasm.c
+++ linux-qcom-6.8.0/tools/bpf/bpftool/jit_disasm.c
@@ -80,7 +80,8 @@
 static int
 init_context(disasm_ctx_t *ctx, const char *arch,
 	     __maybe_unused const char *disassembler_options,
-	     __maybe_unused unsigned char *image, __maybe_unused ssize_t len)
+	     __maybe_unused unsigned char *image, __maybe_unused ssize_t len,
+	     __maybe_unused __u64 func_ksym)
 {
 	char *triple;
 
@@ -109,12 +110,13 @@
 }
 
 static int
-disassemble_insn(disasm_ctx_t *ctx, unsigned char *image, ssize_t len, int pc)
+disassemble_insn(disasm_ctx_t *ctx, unsigned char *image, ssize_t len, int pc,
+		 __u64 func_ksym)
 {
 	char buf[256];
 	int count;
 
-	count = LLVMDisasmInstruction(*ctx, image + pc, len - pc, pc,
+	count = LLVMDisasmInstruction(*ctx, image + pc, len - pc, func_ksym + pc,
 				      buf, sizeof(buf));
 	if (json_output)
 		printf_json(buf);
@@ -136,8 +138,21 @@
 #ifdef HAVE_LIBBFD_SUPPORT
 #define DISASM_SPACER "\t"
 
+struct disasm_info {
+	struct disassemble_info info;
+	__u64 func_ksym;
+};
+
+static void disasm_print_addr(bfd_vma addr, struct disassemble_info *info)
+{
+	struct disasm_info *dinfo = container_of(info, struct disasm_info, info);
+
+	addr += dinfo->func_ksym;
+	generic_print_address(addr, info);
+}
+
 typedef struct {
-	struct disassemble_info *info;
+	struct disasm_info *info;
 	disassembler_ftype disassemble;
 	bfd *bfdf;
 } disasm_ctx_t;
@@ -215,7 +230,7 @@
 
 static int init_context(disasm_ctx_t *ctx, const char *arch,
 			const char *disassembler_options,
-			unsigned char *image, ssize_t len)
+			unsigned char *image, ssize_t len, __u64 func_ksym)
 {
 	struct disassemble_info *info;
 	char tpath[PATH_MAX];
@@ -238,12 +253,13 @@
 	}
 	bfdf = ctx->bfdf;
 
-	ctx->info = malloc(sizeof(struct disassemble_info));
+	ctx->info = malloc(sizeof(struct disasm_info));
 	if (!ctx->info) {
 		p_err("mem alloc failed");
 		goto err_close;
 	}
-	info = ctx->info;
+	ctx->info->func_ksym = func_ksym;
+	info = &ctx->info->info;
 
 	if (json_output)
 		init_disassemble_info_compat(info, stdout,
@@ -272,6 +288,7 @@
 		info->disassembler_options = disassembler_options;
 	info->buffer = image;
 	info->buffer_length = len;
+	info->print_address_func = disasm_print_addr;
 
 	disassemble_init_for_target(info);
 
@@ -304,9 +321,10 @@
 
 static int
 disassemble_insn(disasm_ctx_t *ctx, __maybe_unused unsigned char *image,
-		 __maybe_unused ssize_t len, int pc)
+		 __maybe_unused ssize_t len, int pc,
+		 __maybe_unused __u64 func_ksym)
 {
-	return ctx->disassemble(pc, ctx->info);
+	return ctx->disassemble(pc, &ctx->info->info);
 }
 
 int disasm_init(void)
@@ -331,7 +349,7 @@
 	if (!len)
 		return -1;
 
-	if (init_context(&ctx, arch, disassembler_options, image, len))
+	if (init_context(&ctx, arch, disassembler_options, image, len, func_ksym))
 		return -1;
 
 	if (json_output)
@@ -360,7 +378,7 @@
 			printf("%4x:" DISASM_SPACER, pc);
 		}
 
-		count = disassemble_insn(&ctx, image, len, pc);
+		count = disassemble_insn(&ctx, image, len, pc, func_ksym);
 
 		if (json_output) {
 			/* Operand array, was started in fprintf_json. Before
--- linux-qcom-6.8.0.orig/tools/bpf/bpftool/link.c
+++ linux-qcom-6.8.0/tools/bpf/bpftool/link.c
@@ -977,7 +977,7 @@
 			cookies = calloc(count, sizeof(__u64));
 			if (!cookies) {
 				p_err("mem alloc failed");
-				free(cookies);
+				free(ref_ctr_offsets);
 				free(offsets);
 				close(fd);
 				return -ENOMEM;
--- linux-qcom-6.8.0.orig/tools/bpf/bpftool/main.h
+++ linux-qcom-6.8.0/tools/bpf/bpftool/main.h
@@ -142,7 +142,8 @@
 char *get_fdinfo(int fd, const char *key);
 int open_obj_pinned(const char *path, bool quiet);
 int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type);
-int mount_bpffs_for_pin(const char *name, bool is_dir);
+int mount_bpffs_for_file(const char *file_name);
+int create_and_mount_bpffs_dir(const char *dir_name);
 int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(int *, char ***));
 int do_pin_fd(int fd, const char *name);
 
--- linux-qcom-6.8.0.orig/tools/bpf/bpftool/net.c
+++ linux-qcom-6.8.0/tools/bpf/bpftool/net.c
@@ -482,9 +482,9 @@
 		if (prog_flags[i] || json_output) {
 			NET_START_ARRAY("prog_flags", "%s ");
 			for (j = 0; prog_flags[i] && j < 32; j++) {
-				if (!(prog_flags[i] & (1 << j)))
+				if (!(prog_flags[i] & (1U << j)))
 					continue;
-				NET_DUMP_UINT_ONLY(1 << j);
+				NET_DUMP_UINT_ONLY(1U << j);
 			}
 			NET_END_ARRAY("");
 		}
@@ -493,9 +493,9 @@
 			if (link_flags[i] || json_output) {
 				NET_START_ARRAY("link_flags", "%s ");
 				for (j = 0; link_flags[i] && j < 32; j++) {
-					if (!(link_flags[i] & (1 << j)))
+					if (!(link_flags[i] & (1U << j)))
 						continue;
-					NET_DUMP_UINT_ONLY(1 << j);
+					NET_DUMP_UINT_ONLY(1U << j);
 				}
 				NET_END_ARRAY("");
 			}
@@ -824,6 +824,9 @@
 		nf_link_count++;
 	}
 
+	if (!nf_link_info)
+		return;
+
 	qsort(nf_link_info, nf_link_count, sizeof(*nf_link_info), netfilter_link_compar);
 
 	for (id = 0; id < nf_link_count; id++) {
--- linux-qcom-6.8.0.orig/tools/bpf/bpftool/prog.c
+++ linux-qcom-6.8.0/tools/bpf/bpftool/prog.c
@@ -822,11 +822,18 @@
 					printf("%s:\n", sym_name);
 				}
 
-				if (disasm_print_insn(img, lens[i], opcodes,
-						      name, disasm_opt, btf,
-						      prog_linfo, ksyms[i], i,
-						      linum))
-					goto exit_free;
+				if (ksyms) {
+					if (disasm_print_insn(img, lens[i], opcodes,
+							      name, disasm_opt, btf,
+							      prog_linfo, ksyms[i], i,
+							      linum))
+						goto exit_free;
+				} else {
+					if (disasm_print_insn(img, lens[i], opcodes,
+							      name, disasm_opt, btf,
+							      NULL, 0, 0, false))
+						goto exit_free;
+				}
 
 				img += lens[i];
 
@@ -1778,7 +1785,10 @@
 		goto err_close_obj;
 	}
 
-	err = mount_bpffs_for_pin(pinfile, !first_prog_only);
+	if (first_prog_only)
+		err = mount_bpffs_for_file(pinfile);
+	else
+		err = create_and_mount_bpffs_dir(pinfile);
 	if (err)
 		goto err_close_obj;
 
@@ -1810,6 +1820,10 @@
 	}
 
 	if (pinmaps) {
+		err = create_and_mount_bpffs_dir(pinmaps);
+		if (err)
+			goto err_unpin;
+
 		err = bpf_object__pin_maps(obj, pinmaps);
 		if (err) {
 			p_err("failed to pin all maps");
@@ -2298,7 +2312,7 @@
 	int map_fd;
 
 	profile_perf_events = calloc(
-		sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric);
+		obj->rodata->num_cpu * obj->rodata->num_metric, sizeof(int));
 	if (!profile_perf_events) {
 		p_err("failed to allocate memory for perf_event array: %s",
 		      strerror(errno));
--- linux-qcom-6.8.0.orig/tools/bpf/bpftool/skeleton/pid_iter.bpf.c
+++ linux-qcom-6.8.0/tools/bpf/bpftool/skeleton/pid_iter.bpf.c
@@ -102,8 +102,8 @@
 				       BPF_LINK_TYPE_PERF_EVENT___local)) {
 		struct bpf_link *link = (struct bpf_link *) file->private_data;
 
-		if (link->type == bpf_core_enum_value(enum bpf_link_type___local,
-						      BPF_LINK_TYPE_PERF_EVENT___local)) {
+		if (BPF_CORE_READ(link, type) == bpf_core_enum_value(enum bpf_link_type___local,
+								     BPF_LINK_TYPE_PERF_EVENT___local)) {
 			e.has_bpf_cookie = true;
 			e.bpf_cookie = get_bpf_cookie(link);
 		}
--- linux-qcom-6.8.0.orig/tools/bpf/bpftool/struct_ops.c
+++ linux-qcom-6.8.0/tools/bpf/bpftool/struct_ops.c
@@ -515,7 +515,7 @@
 	if (argc == 1)
 		linkdir = GET_ARG();
 
-	if (linkdir && mount_bpffs_for_pin(linkdir, true)) {
+	if (linkdir && create_and_mount_bpffs_dir(linkdir)) {
 		p_err("can't mount bpffs for pinning");
 		return -1;
 	}
--- linux-qcom-6.8.0.orig/tools/bpf/resolve_btfids/main.c
+++ linux-qcom-6.8.0/tools/bpf/resolve_btfids/main.c
@@ -70,6 +70,7 @@
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <errno.h>
+#include <linux/btf_ids.h>
 #include <linux/rbtree.h>
 #include <linux/zalloc.h>
 #include <linux/err.h>
@@ -78,7 +79,7 @@
 #include <subcmd/parse-options.h>
 
 #define BTF_IDS_SECTION	".BTF_ids"
-#define BTF_ID		"__BTF_ID__"
+#define BTF_ID_PREFIX	"__BTF_ID__"
 
 #define BTF_STRUCT	"struct"
 #define BTF_UNION	"union"
@@ -89,6 +90,14 @@
 
 #define ADDR_CNT	100
 
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+# define ELFDATANATIVE	ELFDATA2LSB
+#elif __BYTE_ORDER == __BIG_ENDIAN
+# define ELFDATANATIVE	ELFDATA2MSB
+#else
+# error "Unknown machine endianness!"
+#endif
+
 struct btf_id {
 	struct rb_node	 rb_node;
 	char		*name;
@@ -116,6 +125,7 @@
 		int		 idlist_shndx;
 		size_t		 strtabidx;
 		unsigned long	 idlist_addr;
+		int		 encoding;
 	} efile;
 
 	struct rb_root	sets;
@@ -161,7 +171,7 @@
 
 static bool is_btf_id(const char *name)
 {
-	return name && !strncmp(name, BTF_ID, sizeof(BTF_ID) - 1);
+	return name && !strncmp(name, BTF_ID_PREFIX, sizeof(BTF_ID_PREFIX) - 1);
 }
 
 static struct btf_id *btf_id__find(struct rb_root *root, const char *name)
@@ -319,6 +329,7 @@
 {
 	Elf_Scn *scn = NULL;
 	size_t shdrstrndx;
+	GElf_Ehdr ehdr;
 	int idx = 0;
 	Elf *elf;
 	int fd;
@@ -350,6 +361,13 @@
 		return -1;
 	}
 
+	if (gelf_getehdr(obj->efile.elf, &ehdr) == NULL) {
+		pr_err("FAILED cannot get ELF header: %s\n",
+			elf_errmsg(-1));
+		return -1;
+	}
+	obj->efile.encoding = ehdr.e_ident[EI_DATA];
+
 	/*
 	 * Scan all the elf sections and look for save data
 	 * from .BTF_ids section and symbols.
@@ -441,7 +459,7 @@
 		 * __BTF_ID__TYPE__vfs_truncate__0
 		 * prefix =  ^
 		 */
-		prefix = name + sizeof(BTF_ID) - 1;
+		prefix = name + sizeof(BTF_ID_PREFIX) - 1;
 
 		/* struct */
 		if (!strncmp(prefix, BTF_STRUCT, sizeof(BTF_STRUCT) - 1)) {
@@ -649,19 +667,18 @@
 static int sets_patch(struct object *obj)
 {
 	Elf_Data *data = obj->efile.idlist;
-	int *ptr = data->d_buf;
 	struct rb_node *next;
 
 	next = rb_first(&obj->sets);
 	while (next) {
-		unsigned long addr, idx;
+		struct btf_id_set8 *set8;
+		struct btf_id_set *set;
+		unsigned long addr, off;
 		struct btf_id *id;
-		int *base;
-		int cnt;
 
 		id   = rb_entry(next, struct btf_id, rb_node);
 		addr = id->addr[0];
-		idx  = addr - obj->efile.idlist_addr;
+		off = addr - obj->efile.idlist_addr;
 
 		/* sets are unique */
 		if (id->addr_cnt != 1) {
@@ -670,14 +687,39 @@
 			return -1;
 		}
 
-		idx = idx / sizeof(int);
-		base = &ptr[idx] + (id->is_set8 ? 2 : 1);
-		cnt = ptr[idx];
+		if (id->is_set) {
+			set = data->d_buf + off;
+			qsort(set->ids, set->cnt, sizeof(set->ids[0]), cmp_id);
+		} else {
+			set8 = data->d_buf + off;
+			/*
+			 * Make sure id is at the beginning of the pairs
+			 * struct, otherwise the below qsort would not work.
+			 */
+			BUILD_BUG_ON((u32 *)set8->pairs != &set8->pairs[0].id);
+			qsort(set8->pairs, set8->cnt, sizeof(set8->pairs[0]), cmp_id);
 
-		pr_debug("sorting  addr %5lu: cnt %6d [%s]\n",
-			 (idx + 1) * sizeof(int), cnt, id->name);
+			/*
+			 * When ELF endianness does not match endianness of the
+			 * host, libelf will do the translation when updating
+			 * the ELF. This, however, corrupts SET8 flags which are
+			 * already in the target endianness. So, let's bswap
+			 * them to the host endianness and libelf will then
+			 * correctly translate everything.
+			 */
+			if (obj->efile.encoding != ELFDATANATIVE) {
+				int i;
 
-		qsort(base, cnt, id->is_set8 ? sizeof(uint64_t) : sizeof(int), cmp_id);
+				set8->flags = bswap_32(set8->flags);
+				for (i = 0; i < set8->cnt; i++) {
+					set8->pairs[i].flags =
+						bswap_32(set8->pairs[i].flags);
+				}
+			}
+		}
+
+		pr_debug("sorting  addr %5lu: cnt %6d [%s]\n",
+			 off, id->is_set ? set->cnt : set8->cnt, id->name);
 
 		next = rb_next(next);
 	}
@@ -686,7 +728,7 @@
 
 static int symbols_patch(struct object *obj)
 {
-	int err;
+	off_t err;
 
 	if (__symbols_patch(obj, &obj->structs)  ||
 	    __symbols_patch(obj, &obj->unions)   ||
--- linux-qcom-6.8.0.orig/tools/bpf/runqslower/Makefile
+++ linux-qcom-6.8.0/tools/bpf/runqslower/Makefile
@@ -15,6 +15,7 @@
 CFLAGS := -g -Wall $(CLANG_CROSS_FLAGS)
 CFLAGS += $(EXTRA_CFLAGS)
 LDFLAGS += $(EXTRA_LDFLAGS)
+LDLIBS += -lelf -lz
 
 # Try to detect best kernel BTF source
 KERNEL_REL := $(shell uname -r)
@@ -51,7 +52,7 @@
 libbpf_hdrs: $(BPFOBJ)
 
 $(OUTPUT)/runqslower: $(OUTPUT)/runqslower.o $(BPFOBJ)
-	$(QUIET_LINK)$(CC) $(CFLAGS) $^ -lelf -lz -o $@
+	$(QUIET_LINK)$(CC) $(CFLAGS) $(LDFLAGS) $^ $(LDLIBS) -o $@
 
 $(OUTPUT)/runqslower.o: runqslower.h $(OUTPUT)/runqslower.skel.h	      \
 			$(OUTPUT)/runqslower.bpf.o | libbpf_hdrs
--- linux-qcom-6.8.0.orig/tools/hv/Makefile
+++ linux-qcom-6.8.0/tools/hv/Makefile
@@ -47,7 +47,7 @@
 
 clean:
 	rm -f $(ALL_PROGRAMS)
-	find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete
+	find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete
 
 install: $(ALL_PROGRAMS)
 	install -d -m 755 $(DESTDIR)$(sbindir); \
--- linux-qcom-6.8.0.orig/tools/hv/hv_kvp_daemon.8
+++ linux-qcom-6.8.0/tools/hv/hv_kvp_daemon.8
@@ -0,0 +1,26 @@
+.\"  This page Copyright (C) 2012 Andy Whitcroft <apw@canonical.com>
+.\"  Distributed under the GPL v2 or later.
+.TH HV_KVP_DAEMON 8
+.SH NAME
+hv_kvp_daemon \- Hyper-V Key Value Pair daemon
+.SH SYNOPSIS
+.ft B
+.B hv_kvp_daemon
+.br
+.SH DESCRIPTION
+\fBhv_kvp_daemon\fP
+is the userspace component of the Hyper-V key value pair functionality,
+communicating via a netlink socket with the kernel HV-KVP driver.
+This pairing allows the Hyper-V host to pass configuration information
+(such as IP addresses) to the guest and allows the host to obtain guest
+version information.
+
+.SH FILES
+.ta
+.nf
+/var/opt/hyperv/.kvp_pool_*
+.fi
+
+.SH AUTHORS
+.nf
+Written by K. Y. Srinivasan <ksrinivasan@novell.com>
--- linux-qcom-6.8.0.orig/tools/hv/hv_set_ifconfig.sh
+++ linux-qcom-6.8.0/tools/hv/hv_set_ifconfig.sh
@@ -81,7 +81,7 @@
 
 cp $1 /etc/sysconfig/network-scripts/
 
-chmod 600 $2
+umask 0177
 interface=$(echo $2 | awk -F - '{ print $2 }')
 filename="${2##*/}"
 
--- linux-qcom-6.8.0.orig/tools/hv/lsvmbus
+++ linux-qcom-6.8.0/tools/hv/lsvmbus
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # SPDX-License-Identifier: GPL-2.0
 
 import os
--- linux-qcom-6.8.0.orig/tools/hv/lsvmbus.8
+++ linux-qcom-6.8.0/tools/hv/lsvmbus.8
@@ -0,0 +1,23 @@
+.\"  This page Copyright (C) 2016 Andy Whitcroft <apw@canonical.com>
+.\"  Distributed under the GPL v2 or later.
+.TH LSVMBUS 8
+.SH NAME
+lsvmbus \- List Hyper-V VMBus devices
+.SH SYNOPSIS
+.ft B
+.B lsvmbus [-vv]
+.br
+.SH DESCRIPTION
+\fBlsvmbus\fP
+displays devices attached to the Hyper-V VMBus.
+.SH OPTIONS
+.\"
+.TP
+.B -v
+With -v more information is printed including the VMBus Rel_ID, class ID,
+Rel_ID, and which channel is bound to which virtual processor.  Use -vv
+for additional detail including the Device_ID and the sysfs path.
+.\"
+.SH AUTHORS
+.nf
+Written by Dexuan Cui <decui@microsoft.com>
--- linux-qcom-6.8.0.orig/tools/iio/iio_generic_buffer.c
+++ linux-qcom-6.8.0/tools/iio/iio_generic_buffer.c
@@ -498,6 +498,10 @@
 			return -ENOMEM;
 		}
 		trigger_name = malloc(IIO_MAX_NAME_LENGTH);
+		if (!trigger_name) {
+			ret = -ENOMEM;
+			goto error;
+		}
 		ret = read_sysfs_string("name", trig_dev_name, trigger_name);
 		free(trig_dev_name);
 		if (ret < 0) {
--- linux-qcom-6.8.0.orig/tools/iio/iio_utils.c
+++ linux-qcom-6.8.0/tools/iio/iio_utils.c
@@ -376,7 +376,7 @@
 		goto error_close_dir;
 	}
 
-	seekdir(dp, 0);
+	rewinddir(dp);
 	while (ent = readdir(dp), ent) {
 		if (strcmp(ent->d_name + strlen(ent->d_name) - strlen("_en"),
 			   "_en") == 0) {
--- linux-qcom-6.8.0.orig/tools/include/linux/align.h
+++ linux-qcom-6.8.0/tools/include/linux/align.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef _TOOLS_LINUX_ALIGN_H
+#define _TOOLS_LINUX_ALIGN_H
+
+#include <uapi/linux/const.h>
+
+#define ALIGN(x, a)		__ALIGN_KERNEL((x), (a))
+#define ALIGN_DOWN(x, a)	__ALIGN_KERNEL((x) - ((a) - 1), (a))
+#define IS_ALIGNED(x, a)	(((x) & ((typeof(x))(a) - 1)) == 0)
+
+#endif /* _TOOLS_LINUX_ALIGN_H */
--- linux-qcom-6.8.0.orig/tools/include/linux/bitmap.h
+++ linux-qcom-6.8.0/tools/include/linux/bitmap.h
@@ -3,6 +3,7 @@
 #define _TOOLS_LINUX_BITMAP_H
 
 #include <string.h>
+#include <linux/align.h>
 #include <linux/bitops.h>
 #include <linux/find.h>
 #include <stdlib.h>
@@ -25,13 +26,14 @@
 #define BITMAP_FIRST_WORD_MASK(start) (~0UL << ((start) & (BITS_PER_LONG - 1)))
 #define BITMAP_LAST_WORD_MASK(nbits) (~0UL >> (-(nbits) & (BITS_PER_LONG - 1)))
 
+#define bitmap_size(nbits)	(ALIGN(nbits, BITS_PER_LONG) / BITS_PER_BYTE)
+
 static inline void bitmap_zero(unsigned long *dst, unsigned int nbits)
 {
 	if (small_const_nbits(nbits))
 		*dst = 0UL;
 	else {
-		int len = BITS_TO_LONGS(nbits) * sizeof(unsigned long);
-		memset(dst, 0, len);
+		memset(dst, 0, bitmap_size(nbits));
 	}
 }
 
@@ -83,7 +85,7 @@
  */
 static inline unsigned long *bitmap_zalloc(int nbits)
 {
-	return calloc(1, BITS_TO_LONGS(nbits) * sizeof(unsigned long));
+	return calloc(1, bitmap_size(nbits));
 }
 
 /*
@@ -126,7 +128,6 @@
 #define BITMAP_MEM_ALIGNMENT (8 * sizeof(unsigned long))
 #endif
 #define BITMAP_MEM_MASK (BITMAP_MEM_ALIGNMENT - 1)
-#define IS_ALIGNED(x, a) (((x) & ((typeof(x))(a) - 1)) == 0)
 
 static inline bool bitmap_equal(const unsigned long *src1,
 				const unsigned long *src2, unsigned int nbits)
--- linux-qcom-6.8.0.orig/tools/include/linux/btf_ids.h
+++ linux-qcom-6.8.0/tools/include/linux/btf_ids.h
@@ -3,11 +3,22 @@
 #ifndef _LINUX_BTF_IDS_H
 #define _LINUX_BTF_IDS_H
 
+#include <linux/types.h> /* for u32 */
+
 struct btf_id_set {
 	u32 cnt;
 	u32 ids[];
 };
 
+struct btf_id_set8 {
+	u32 cnt;
+	u32 flags;
+	struct {
+		u32 id;
+		u32 flags;
+	} pairs[];
+};
+
 #ifdef CONFIG_DEBUG_INFO_BTF
 
 #include <linux/compiler.h> /* for __PASTE */
--- linux-qcom-6.8.0.orig/tools/include/linux/kernel.h
+++ linux-qcom-6.8.0/tools/include/linux/kernel.h
@@ -8,6 +8,7 @@
 #include <linux/build_bug.h>
 #include <linux/compiler.h>
 #include <linux/math.h>
+#include <linux/panic.h>
 #include <endian.h>
 #include <byteswap.h>
 
--- linux-qcom-6.8.0.orig/tools/include/linux/mm.h
+++ linux-qcom-6.8.0/tools/include/linux/mm.h
@@ -2,8 +2,8 @@
 #ifndef _TOOLS_LINUX_MM_H
 #define _TOOLS_LINUX_MM_H
 
+#include <linux/align.h>
 #include <linux/mmzone.h>
-#include <uapi/linux/const.h>
 
 #define PAGE_SHIFT		12
 #define PAGE_SIZE		(_AC(1, UL) << PAGE_SHIFT)
@@ -11,9 +11,6 @@
 
 #define PHYS_ADDR_MAX	(~(phys_addr_t)0)
 
-#define ALIGN(x, a)			__ALIGN_KERNEL((x), (a))
-#define ALIGN_DOWN(x, a)		__ALIGN_KERNEL((x) - ((a) - 1), (a))
-
 #define PAGE_ALIGN(addr) ALIGN(addr, PAGE_SIZE)
 
 #define __va(x) ((void *)((unsigned long)(x)))
@@ -37,4 +34,9 @@
 {
 }
 
+static inline int early_pfn_to_nid(unsigned long pfn)
+{
+	return 0;
+}
+
 #endif
--- linux-qcom-6.8.0.orig/tools/include/linux/numa.h
+++ linux-qcom-6.8.0/tools/include/linux/numa.h
@@ -13,4 +13,9 @@
 
 #define	NUMA_NO_NODE	(-1)
 
+static inline bool numa_valid_node(int nid)
+{
+	return nid >= 0 && nid < MAX_NUMNODES;
+}
+
 #endif /* _LINUX_NUMA_H */
--- linux-qcom-6.8.0.orig/tools/include/linux/panic.h
+++ linux-qcom-6.8.0/tools/include/linux/panic.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _TOOLS_LINUX_PANIC_H
+#define _TOOLS_LINUX_PANIC_H
+
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static inline void panic(const char *fmt, ...)
+{
+	va_list argp;
+
+	va_start(argp, fmt);
+	vfprintf(stderr, fmt, argp);
+	va_end(argp);
+	exit(-1);
+}
+
+#endif
--- linux-qcom-6.8.0.orig/tools/include/nolibc/arch-powerpc.h
+++ linux-qcom-6.8.0/tools/include/nolibc/arch-powerpc.h
@@ -172,7 +172,7 @@
 	_ret;                                                                \
 })
 
-#ifndef __powerpc64__
+#if !defined(__powerpc64__) && !defined(__clang__)
 /* FIXME: For 32-bit PowerPC, with newer gcc compilers (e.g. gcc 13.1.0),
  * "omit-frame-pointer" fails with __attribute__((no_stack_protector)) but
  * works with __attribute__((__optimize__("-fno-stack-protector")))
--- linux-qcom-6.8.0.orig/tools/include/nolibc/arch-s390.h
+++ linux-qcom-6.8.0/tools/include/nolibc/arch-s390.h
@@ -10,6 +10,7 @@
 
 #include "compiler.h"
 #include "crt.h"
+#include "std.h"
 
 /* Syscalls for s390:
  *   - registers are 64-bit
--- linux-qcom-6.8.0.orig/tools/include/nolibc/stdlib.h
+++ linux-qcom-6.8.0/tools/include/nolibc/stdlib.h
@@ -185,7 +185,7 @@
 	if (__builtin_expect(!ret, 0))
 		return NULL;
 
-	memcpy(ret, heap->user_p, heap->len);
+	memcpy(ret, heap->user_p, user_p_len);
 	munmap(heap, heap->len);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/tools/include/nolibc/string.h
+++ linux-qcom-6.8.0/tools/include/nolibc/string.h
@@ -7,6 +7,7 @@
 #ifndef _NOLIBC_STRING_H
 #define _NOLIBC_STRING_H
 
+#include "arch.h"
 #include "std.h"
 
 static void *malloc(size_t len);
--- linux-qcom-6.8.0.orig/tools/include/uapi/linux/bpf.h
+++ linux-qcom-6.8.0/tools/include/uapi/linux/bpf.h
@@ -77,12 +77,29 @@
 	__s32	imm;		/* signed immediate constant */
 };
 
-/* Key of an a BPF_MAP_TYPE_LPM_TRIE entry */
+/* Deprecated: use struct bpf_lpm_trie_key_u8 (when the "data" member is needed for
+ * byte access) or struct bpf_lpm_trie_key_hdr (when using an alternative type for
+ * the trailing flexible array member) instead.
+ */
 struct bpf_lpm_trie_key {
 	__u32	prefixlen;	/* up to 32 for AF_INET, 128 for AF_INET6 */
 	__u8	data[0];	/* Arbitrary size */
 };
 
+/* Header for bpf_lpm_trie_key structs */
+struct bpf_lpm_trie_key_hdr {
+	__u32	prefixlen;
+};
+
+/* Key of an a BPF_MAP_TYPE_LPM_TRIE entry, with trailing byte array. */
+struct bpf_lpm_trie_key_u8 {
+	union {
+		struct bpf_lpm_trie_key_hdr	hdr;
+		__u32				prefixlen;
+	};
+	__u8	data[];		/* Arbitrary size */
+};
+
 struct bpf_cgroup_storage_key {
 	__u64	cgroup_inode_id;	/* cgroup inode id */
 	__u32	attach_type;		/* program attach type (enum bpf_attach_type) */
@@ -6096,12 +6113,17 @@
 	__u64 :64;			\
 } __attribute__((aligned(8)))
 
+/* The enum used in skb->tstamp_type. It specifies the clock type
+ * of the time stored in the skb->tstamp.
+ */
 enum {
-	BPF_SKB_TSTAMP_UNSPEC,
-	BPF_SKB_TSTAMP_DELIVERY_MONO,	/* tstamp has mono delivery time */
-	/* For any BPF_SKB_TSTAMP_* that the bpf prog cannot handle,
-	 * the bpf prog should handle it like BPF_SKB_TSTAMP_UNSPEC
-	 * and try to deduce it by ingress, egress or skb->sk->sk_clockid.
+	BPF_SKB_TSTAMP_UNSPEC = 0,		/* DEPRECATED */
+	BPF_SKB_TSTAMP_DELIVERY_MONO = 1,	/* DEPRECATED */
+	BPF_SKB_CLOCK_REALTIME = 0,
+	BPF_SKB_CLOCK_MONOTONIC = 1,
+	BPF_SKB_CLOCK_TAI = 2,
+	/* For any future BPF_SKB_CLOCK_* that the bpf prog cannot handle,
+	 * the bpf prog can try to deduce it by ingress/egress/skb->sk->sk_clockid.
 	 */
 };
 
@@ -6582,6 +6604,7 @@
 					__aligned_u64 file_name; /* in/out */
 					__u32 name_len;
 					__u32 offset; /* offset from file_name */
+					__u64 cookie;
 				} uprobe; /* BPF_PERF_EVENT_UPROBE, BPF_PERF_EVENT_URETPROBE */
 				struct {
 					__aligned_u64 func_name; /* in/out */
@@ -6589,14 +6612,19 @@
 					__u32 offset; /* offset from func_name */
 					__u64 addr;
 					__u64 missed;
+					__u64 cookie;
 				} kprobe; /* BPF_PERF_EVENT_KPROBE, BPF_PERF_EVENT_KRETPROBE */
 				struct {
 					__aligned_u64 tp_name;   /* in/out */
 					__u32 name_len;
+					__u32 :32;
+					__u64 cookie;
 				} tracepoint; /* BPF_PERF_EVENT_TRACEPOINT */
 				struct {
 					__u64 config;
 					__u32 type;
+					__u32 :32;
+					__u64 cookie;
 				} event; /* BPF_PERF_EVENT_EVENT */
 			};
 		} perf_event;
@@ -7039,7 +7067,7 @@
 
 		/* output: MTU value */
 		__u16	mtu_result;
-	};
+	} __attribute__((packed, aligned(2)));
 	/* input: L3 device index for lookup
 	 * output: device index from FIB lookup
 	 */
--- linux-qcom-6.8.0.orig/tools/include/uapi/linux/stddef.h
+++ linux-qcom-6.8.0/tools/include/uapi/linux/stddef.h
@@ -8,6 +8,13 @@
 #define __always_inline __inline__
 #endif
 
+/* Not all C++ standards support type declarations inside an anonymous union */
+#ifndef __cplusplus
+#define __struct_group_tag(TAG)		TAG
+#else
+#define __struct_group_tag(TAG)
+#endif
+
 /**
  * __struct_group() - Create a mirrored named and anonyomous struct
  *
@@ -20,14 +27,14 @@
  * and size: one anonymous and one named. The former's members can be used
  * normally without sub-struct naming, and the latter can be used to
  * reason about the start, end, and size of the group of struct members.
- * The named struct can also be explicitly tagged for layer reuse, as well
- * as both having struct attributes appended.
+ * The named struct can also be explicitly tagged for layer reuse (C only),
+ * as well as both having struct attributes appended.
  */
 #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
 	union { \
 		struct { MEMBERS } ATTRS; \
-		struct TAG { MEMBERS } ATTRS NAME; \
-	}
+		struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \
+	} ATTRS
 
 /**
  * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
--- linux-qcom-6.8.0.orig/tools/lib/bpf/bpf.h
+++ linux-qcom-6.8.0/tools/lib/bpf/bpf.h
@@ -35,7 +35,7 @@
 extern "C" {
 #endif
 
-int libbpf_set_memlock_rlim(size_t memlock_bytes);
+LIBBPF_API int libbpf_set_memlock_rlim(size_t memlock_bytes);
 
 struct bpf_map_create_opts {
 	size_t sz; /* size of this struct for forward/backward compatibility */
--- linux-qcom-6.8.0.orig/tools/lib/bpf/bpf_core_read.h
+++ linux-qcom-6.8.0/tools/lib/bpf/bpf_core_read.h
@@ -102,6 +102,7 @@
 	case 2: val = *(const unsigned short *)p; break;		      \
 	case 4: val = *(const unsigned int *)p; break;			      \
 	case 8: val = *(const unsigned long long *)p; break;		      \
+	default: val = 0; break;					      \
 	}								      \
 	val <<= __CORE_RELO(s, field, LSHIFT_U64);			      \
 	if (__CORE_RELO(s, field, SIGNED))				      \
--- linux-qcom-6.8.0.orig/tools/lib/bpf/btf.c
+++ linux-qcom-6.8.0/tools/lib/bpf/btf.c
@@ -598,7 +598,7 @@
 	__u32 i, n = btf__type_cnt(btf);
 	int err;
 
-	for (i = 1; i < n; i++) {
+	for (i = btf->start_id; i < n; i++) {
 		t = btf_type_by_id(btf, i);
 		err = btf_validate_type(btf, t, i);
 		if (err)
@@ -991,6 +991,7 @@
 		btf->base_btf = base_btf;
 		btf->start_id = btf__type_cnt(base_btf);
 		btf->start_str_off = base_btf->hdr->str_len;
+		btf->swapped_endian = base_btf->swapped_endian;
 	}
 
 	/* +1 for empty string at offset 0 */
--- linux-qcom-6.8.0.orig/tools/lib/bpf/btf_dump.c
+++ linux-qcom-6.8.0/tools/lib/bpf/btf_dump.c
@@ -1559,10 +1559,12 @@
 			 * Clang for BPF target generates func_proto with no
 			 * args as a func_proto with a single void arg (e.g.,
 			 * `int (*f)(void)` vs just `int (*f)()`). We are
-			 * going to pretend there are no args for such case.
+			 * going to emit valid empty args (void) syntax for
+			 * such case. Similarly and conveniently, valid
+			 * no args case can be special-cased here as well.
 			 */
-			if (vlen == 1 && p->type == 0) {
-				btf_dump_printf(d, ")");
+			if (vlen == 0 || (vlen == 1 && p->type == 0)) {
+				btf_dump_printf(d, "void)");
 				return;
 			}
 
--- linux-qcom-6.8.0.orig/tools/lib/bpf/libbpf.c
+++ linux-qcom-6.8.0/tools/lib/bpf/libbpf.c
@@ -33,6 +33,7 @@
 #include <linux/filter.h>
 #include <linux/limits.h>
 #include <linux/perf_event.h>
+#include <linux/bpf_perf_event.h>
 #include <linux/ring_buffer.h>
 #include <sys/epoll.h>
 #include <sys/ioctl.h>
@@ -70,6 +71,7 @@
 
 static struct bpf_map *bpf_object__add_map(struct bpf_object *obj);
 static bool prog_is_subprog(const struct bpf_object *obj, const struct bpf_program *prog);
+static int map_set_def_max_entries(struct bpf_map *map);
 
 static const char * const attach_type_name[] = {
 	[BPF_CGROUP_INET_INGRESS]	= "cgroup_inet_ingress",
@@ -466,8 +468,6 @@
 };
 
 struct bpf_struct_ops {
-	const char *tname;
-	const struct btf_type *type;
 	struct bpf_program **progs;
 	__u32 *kern_func_off;
 	/* e.g. struct tcp_congestion_ops in bpf_prog's btf format */
@@ -1012,8 +1012,8 @@
 	int err;
 
 	st_ops = map->st_ops;
-	type = st_ops->type;
-	tname = st_ops->tname;
+	type = btf__type_by_id(btf, st_ops->type_id);
+	tname = btf__name_by_offset(btf, type->name_off);
 	err = find_struct_ops_kern_types(kern_btf, tname,
 					 &kern_type, &kern_type_id,
 					 &kern_vtype, &kern_vtype_id,
@@ -1234,8 +1234,6 @@
 		memcpy(st_ops->data,
 		       data->d_buf + vsi->offset,
 		       type->size);
-		st_ops->tname = tname;
-		st_ops->type = type;
 		st_ops->type_id = type_id;
 
 		pr_debug("struct_ops init: struct %s(type_id=%u) %s found at offset %u\n",
@@ -3635,7 +3633,7 @@
 		return true;
 
 	/* global function */
-	return bind == STB_GLOBAL && type == STT_FUNC;
+	return (bind == STB_GLOBAL || bind == STB_WEAK) && type == STT_FUNC;
 }
 
 static int find_extern_btf_id(const struct btf *btf, const char *ext_name)
@@ -4039,7 +4037,7 @@
 
 static bool prog_is_subprog(const struct bpf_object *obj, const struct bpf_program *prog)
 {
-	return prog->sec_idx == obj->efile.text_shndx && obj->nr_programs > 1;
+	return prog->sec_idx == obj->efile.text_shndx;
 }
 
 struct bpf_program *
@@ -5172,6 +5170,9 @@
 
 	if (bpf_map_type__is_map_in_map(def->type)) {
 		if (map->inner_map) {
+			err = map_set_def_max_entries(map->inner_map);
+			if (err)
+				return err;
 			err = bpf_object__create_map(obj, map->inner_map, true);
 			if (err) {
 				pr_warn("map '%s': failed to create inner map: %d\n",
@@ -6695,6 +6696,14 @@
 	/* all other program types don't have "named" context structs */
 };
 
+/* forward declarations for arch-specific underlying types of bpf_user_pt_regs_t typedef,
+ * for below __builtin_types_compatible_p() checks;
+ * with this approach we don't need any extra arch-specific #ifdef guards
+ */
+struct pt_regs;
+struct user_pt_regs;
+struct user_regs_struct;
+
 static bool need_func_arg_type_fixup(const struct btf *btf, const struct bpf_program *prog,
 				     const char *subprog_name, int arg_idx,
 				     int arg_type_id, const char *ctx_name)
@@ -6735,11 +6744,21 @@
 	/* special cases */
 	switch (prog->type) {
 	case BPF_PROG_TYPE_KPROBE:
-	case BPF_PROG_TYPE_PERF_EVENT:
 		/* `struct pt_regs *` is expected, but we need to fix up */
 		if (btf_is_struct(t) && strcmp(tname, "pt_regs") == 0)
 			return true;
 		break;
+	case BPF_PROG_TYPE_PERF_EVENT:
+		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct pt_regs) &&
+		    btf_is_struct(t) && strcmp(tname, "pt_regs") == 0)
+			return true;
+		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct user_pt_regs) &&
+		    btf_is_struct(t) && strcmp(tname, "user_pt_regs") == 0)
+			return true;
+		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct user_regs_struct) &&
+		    btf_is_struct(t) && strcmp(tname, "user_regs_struct") == 0)
+			return true;
+		break;
 	case BPF_PROG_TYPE_RAW_TRACEPOINT:
 	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
 		/* allow u64* as ctx */
@@ -7379,8 +7398,14 @@
 		opts->prog_flags |= BPF_F_XDP_HAS_FRAGS;
 
 	/* special check for usdt to use uprobe_multi link */
-	if ((def & SEC_USDT) && kernel_supports(prog->obj, FEAT_UPROBE_MULTI_LINK))
+	if ((def & SEC_USDT) && kernel_supports(prog->obj, FEAT_UPROBE_MULTI_LINK)) {
+		/* for BPF_TRACE_UPROBE_MULTI, user might want to query expected_attach_type
+		 * in prog, and expected_attach_type we set in kernel is from opts, so we
+		 * update both.
+		 */
 		prog->expected_attach_type = BPF_TRACE_UPROBE_MULTI;
+		opts->expected_attach_type = BPF_TRACE_UPROBE_MULTI;
+	}
 
 	if ((def & SEC_ATTACH_BTF) && !prog->attach_btf_id) {
 		int btf_obj_fd = 0, btf_type_id = 0, err;
@@ -7433,9 +7458,9 @@
 	char *cp, errmsg[STRERR_BUFSIZE];
 	size_t log_buf_size = 0;
 	char *log_buf = NULL, *tmp;
-	int btf_fd, ret, err;
 	bool own_log_buf = true;
 	__u32 log_level = prog->log_level;
+	int ret, err;
 
 	if (prog->type == BPF_PROG_TYPE_UNSPEC) {
 		/*
@@ -7457,11 +7482,11 @@
 	load_attr.attach_btf_id = prog->attach_btf_id;
 	load_attr.kern_version = kern_version;
 	load_attr.prog_ifindex = prog->prog_ifindex;
+	load_attr.expected_attach_type = prog->expected_attach_type;
 
 	/* specify func_info/line_info only if kernel supports them */
-	btf_fd = btf__fd(obj->btf);
-	if (btf_fd >= 0 && kernel_supports(obj, FEAT_BTF_FUNC)) {
-		load_attr.prog_btf_fd = btf_fd;
+	if (obj->btf && btf__fd(obj->btf) >= 0 && kernel_supports(obj, FEAT_BTF_FUNC)) {
+		load_attr.prog_btf_fd = btf__fd(obj->btf);
 		load_attr.func_info = prog->func_info;
 		load_attr.func_info_rec_size = prog->func_info_rec_size;
 		load_attr.func_info_cnt = prog->func_info_cnt;
@@ -7485,9 +7510,6 @@
 		insns_cnt = prog->insns_cnt;
 	}
 
-	/* allow prog_prepare_load_fn to change expected_attach_type */
-	load_attr.expected_attach_type = prog->expected_attach_type;
-
 	if (obj->gen_loader) {
 		bpf_gen__prog_load(obj->gen_loader, prog->type, prog->name,
 				   license, insns, insns_cnt, &load_attr,
@@ -7916,16 +7938,19 @@
 }
 
 static struct bpf_object *bpf_object_open(const char *path, const void *obj_buf, size_t obj_buf_sz,
+					  const char *obj_name,
 					  const struct bpf_object_open_opts *opts)
 {
-	const char *obj_name, *kconfig, *btf_tmp_path;
+	const char *kconfig, *btf_tmp_path;
 	struct bpf_object *obj;
-	char tmp_name[64];
 	int err;
 	char *log_buf;
 	size_t log_size;
 	__u32 log_level;
 
+	if (obj_buf && !obj_name)
+		return ERR_PTR(-EINVAL);
+
 	if (elf_version(EV_CURRENT) == EV_NONE) {
 		pr_warn("failed to init libelf for %s\n",
 			path ? : "(mem buf)");
@@ -7935,16 +7960,12 @@
 	if (!OPTS_VALID(opts, bpf_object_open_opts))
 		return ERR_PTR(-EINVAL);
 
-	obj_name = OPTS_GET(opts, object_name, NULL);
+	obj_name = OPTS_GET(opts, object_name, NULL) ?: obj_name;
 	if (obj_buf) {
-		if (!obj_name) {
-			snprintf(tmp_name, sizeof(tmp_name), "%lx-%lx",
-				 (unsigned long)obj_buf,
-				 (unsigned long)obj_buf_sz);
-			obj_name = tmp_name;
-		}
 		path = obj_name;
 		pr_debug("loading object '%s' from buffer\n", obj_name);
+	} else {
+		pr_debug("loading object from %s\n", path);
 	}
 
 	log_buf = OPTS_GET(opts, kernel_log_buf, NULL);
@@ -8010,9 +8031,7 @@
 	if (!path)
 		return libbpf_err_ptr(-EINVAL);
 
-	pr_debug("loading %s\n", path);
-
-	return libbpf_ptr(bpf_object_open(path, NULL, 0, opts));
+	return libbpf_ptr(bpf_object_open(path, NULL, 0, NULL, opts));
 }
 
 struct bpf_object *bpf_object__open(const char *path)
@@ -8024,10 +8043,15 @@
 bpf_object__open_mem(const void *obj_buf, size_t obj_buf_sz,
 		     const struct bpf_object_open_opts *opts)
 {
+	char tmp_name[64];
+
 	if (!obj_buf || obj_buf_sz == 0)
 		return libbpf_err_ptr(-EINVAL);
 
-	return libbpf_ptr(bpf_object_open(NULL, obj_buf, obj_buf_sz, opts));
+	/* create a (quite useless) default "name" for this memory buffer object */
+	snprintf(tmp_name, sizeof(tmp_name), "%lx-%zx", (unsigned long)obj_buf, obj_buf_sz);
+
+	return libbpf_ptr(bpf_object_open(NULL, obj_buf, obj_buf_sz, tmp_name, opts));
 }
 
 static int bpf_object_unload(struct bpf_object *obj)
@@ -8429,11 +8453,13 @@
 
 static void bpf_map_prepare_vdata(const struct bpf_map *map)
 {
+	const struct btf_type *type;
 	struct bpf_struct_ops *st_ops;
 	__u32 i;
 
 	st_ops = map->st_ops;
-	for (i = 0; i < btf_vlen(st_ops->type); i++) {
+	type = btf__type_by_id(map->obj->btf, st_ops->type_id);
+	for (i = 0; i < btf_vlen(type); i++) {
 		struct bpf_program *prog = st_ops->progs[i];
 		void *kern_data;
 		int prog_fd;
@@ -9672,6 +9698,7 @@
 static int bpf_object__collect_st_ops_relos(struct bpf_object *obj,
 					    Elf64_Shdr *shdr, Elf_Data *data)
 {
+	const struct btf_type *type;
 	const struct btf_member *member;
 	struct bpf_struct_ops *st_ops;
 	struct bpf_program *prog;
@@ -9731,13 +9758,14 @@
 		}
 		insn_idx = sym->st_value / BPF_INSN_SZ;
 
-		member = find_member_by_offset(st_ops->type, moff * 8);
+		type = btf__type_by_id(btf, st_ops->type_id);
+		member = find_member_by_offset(type, moff * 8);
 		if (!member) {
 			pr_warn("struct_ops reloc %s: cannot find member at moff %u\n",
 				map->name, moff);
 			return -EINVAL;
 		}
-		member_idx = member - btf_members(st_ops->type);
+		member_idx = member - btf_members(type);
 		name = btf__name_by_offset(btf, member->name_off);
 
 		if (!resolve_func_ptr(btf, member->type, NULL)) {
@@ -10307,7 +10335,7 @@
 struct bpf_map *
 bpf_object__next_map(const struct bpf_object *obj, const struct bpf_map *prev)
 {
-	if (prev == NULL)
+	if (prev == NULL && obj != NULL)
 		return obj->maps;
 
 	return __bpf_map__iter(prev, obj, 1);
@@ -10316,7 +10344,7 @@
 struct bpf_map *
 bpf_object__prev_map(const struct bpf_object *obj, const struct bpf_map *next)
 {
-	if (next == NULL) {
+	if (next == NULL && obj != NULL) {
 		if (!obj->nr_maps)
 			return NULL;
 		return obj->maps + obj->nr_maps - 1;
@@ -11539,7 +11567,7 @@
 
 	n = sscanf(spec, "%m[a-zA-Z0-9_.*?]", &pattern);
 	if (n < 1) {
-		pr_warn("kprobe multi pattern is invalid: %s\n", pattern);
+		pr_warn("kprobe multi pattern is invalid: %s\n", spec);
 		return -EINVAL;
 	}
 
@@ -13593,29 +13621,13 @@
 int bpf_object__open_skeleton(struct bpf_object_skeleton *s,
 			      const struct bpf_object_open_opts *opts)
 {
-	DECLARE_LIBBPF_OPTS(bpf_object_open_opts, skel_opts,
-		.object_name = s->name,
-	);
 	struct bpf_object *obj;
 	int err;
 
-	/* Attempt to preserve opts->object_name, unless overriden by user
-	 * explicitly. Overwriting object name for skeletons is discouraged,
-	 * as it breaks global data maps, because they contain object name
-	 * prefix as their own map name prefix. When skeleton is generated,
-	 * bpftool is making an assumption that this name will stay the same.
-	 */
-	if (opts) {
-		memcpy(&skel_opts, opts, sizeof(*opts));
-		if (!opts->object_name)
-			skel_opts.object_name = s->name;
-	}
-
-	obj = bpf_object__open_mem(s->data, s->data_sz, &skel_opts);
-	err = libbpf_get_error(obj);
-	if (err) {
-		pr_warn("failed to initialize skeleton BPF object '%s': %d\n",
-			s->name, err);
+	obj = bpf_object_open(NULL, s->data, s->data_sz, s->name, opts);
+	if (IS_ERR(obj)) {
+		err = PTR_ERR(obj);
+		pr_warn("failed to initialize skeleton BPF object '%s': %d\n", s->name, err);
 		return libbpf_err(err);
 	}
 
--- linux-qcom-6.8.0.orig/tools/lib/bpf/libbpf_internal.h
+++ linux-qcom-6.8.0/tools/lib/bpf/libbpf_internal.h
@@ -18,6 +18,20 @@
 #include <libelf.h>
 #include "relo_core.h"
 
+/* Android's libc doesn't support AT_EACCESS in faccessat() implementation
+ * ([0]), and just returns -EINVAL even if file exists and is accessible.
+ * See [1] for issues caused by this.
+ *
+ * So just redefine it to 0 on Android.
+ *
+ * [0] https://android.googlesource.com/platform/bionic/+/refs/heads/android13-release/libc/bionic/faccessat.cpp#50
+ * [1] https://github.com/libbpf/libbpf-bootstrap/issues/250#issuecomment-1911324250
+ */
+#ifdef __ANDROID__
+#undef AT_EACCESS
+#define AT_EACCESS 0
+#endif
+
 /* make sure libbpf doesn't use kernel-only integer typedefs */
 #pragma GCC poison u8 u16 u32 u64 s8 s16 s32 s64
 
--- linux-qcom-6.8.0.orig/tools/lib/bpf/linker.c
+++ linux-qcom-6.8.0/tools/lib/bpf/linker.c
@@ -396,6 +396,8 @@
 		pr_warn_elf("failed to create SYMTAB data");
 		return -EINVAL;
 	}
+	/* Ensure libelf translates byte-order of symbol records */
+	sec->data->d_type = ELF_T_SYM;
 
 	str_off = strset__add_str(linker->strtab_strs, sec->sec_name);
 	if (str_off < 0)
@@ -2213,10 +2215,17 @@
 		vi = btf_var_secinfos(t);
 		for (j = 0, m = btf_vlen(t); j < m; j++, vi++) {
 			const struct btf_type *vt = btf__type_by_id(obj->btf, vi->type);
-			const char *var_name = btf__str_by_offset(obj->btf, vt->name_off);
-			int var_linkage = btf_var(vt)->linkage;
+			const char *var_name;
+			int var_linkage;
 			Elf64_Sym *sym;
 
+			/* could be a variable or function */
+			if (!btf_is_var(vt))
+				continue;
+
+			var_name = btf__str_by_offset(obj->btf, vt->name_off);
+			var_linkage = btf_var(vt)->linkage;
+
 			/* no need to patch up static or extern vars */
 			if (var_linkage != BTF_VAR_GLOBAL_ALLOCATED)
 				continue;
--- linux-qcom-6.8.0.orig/tools/lib/bpf/netlink.c
+++ linux-qcom-6.8.0/tools/lib/bpf/netlink.c
@@ -496,8 +496,8 @@
 	if (err)
 		return libbpf_err(err);
 
-	opts->feature_flags = md.flags;
-	opts->xdp_zc_max_segs = md.xdp_zc_max_segs;
+	OPTS_SET(opts, feature_flags, md.flags);
+	OPTS_SET(opts, xdp_zc_max_segs, md.xdp_zc_max_segs);
 
 skip_feature_flags:
 	return 0;
--- linux-qcom-6.8.0.orig/tools/lib/perf/cpumap.c
+++ linux-qcom-6.8.0/tools/lib/perf/cpumap.c
@@ -18,9 +18,13 @@
 
 struct perf_cpu_map *perf_cpu_map__alloc(int nr_cpus)
 {
-	RC_STRUCT(perf_cpu_map) *cpus = malloc(sizeof(*cpus) + sizeof(struct perf_cpu) * nr_cpus);
+	RC_STRUCT(perf_cpu_map) *cpus;
 	struct perf_cpu_map *result;
 
+	if (nr_cpus == 0)
+		return NULL;
+
+	cpus = malloc(sizeof(*cpus) + sizeof(struct perf_cpu) * nr_cpus);
 	if (ADD_RC_CHK(result, cpus)) {
 		cpus->nr = nr_cpus;
 		refcount_set(&cpus->refcnt, 1);
@@ -316,6 +320,19 @@
 	return map ? __perf_cpu_map__cpu(map, 0).cpu == -1 : true;
 }
 
+bool perf_cpu_map__is_any_cpu_or_is_empty(const struct perf_cpu_map *map)
+{
+	if (!map)
+		return true;
+
+	return __perf_cpu_map__nr(map) == 1 && __perf_cpu_map__cpu(map, 0).cpu == -1;
+}
+
+bool perf_cpu_map__is_empty(const struct perf_cpu_map *map)
+{
+	return map == NULL;
+}
+
 int perf_cpu_map__idx(const struct perf_cpu_map *cpus, struct perf_cpu cpu)
 {
 	int low, high;
@@ -372,6 +389,20 @@
 	return map && __perf_cpu_map__cpu(map, 0).cpu == -1;
 }
 
+struct perf_cpu perf_cpu_map__min(const struct perf_cpu_map *map)
+{
+	struct perf_cpu cpu, result = {
+		.cpu = -1
+	};
+	int idx;
+
+	perf_cpu_map__for_each_cpu_skip_any(cpu, idx, map) {
+		result = cpu;
+		break;
+	}
+	return result;
+}
+
 struct perf_cpu perf_cpu_map__max(const struct perf_cpu_map *map)
 {
 	struct perf_cpu result = {
--- linux-qcom-6.8.0.orig/tools/lib/perf/evlist.c
+++ linux-qcom-6.8.0/tools/lib/perf/evlist.c
@@ -47,6 +47,20 @@
 		 */
 		perf_cpu_map__put(evsel->cpus);
 		evsel->cpus = perf_cpu_map__intersect(evlist->user_requested_cpus, evsel->own_cpus);
+
+		/*
+		 * Empty cpu lists would eventually get opened as "any" so remove
+		 * genuinely empty ones before they're opened in the wrong place.
+		 */
+		if (perf_cpu_map__is_empty(evsel->cpus)) {
+			struct perf_evsel *next = perf_evlist__next(evlist, evsel);
+
+			perf_evlist__remove(evlist, evsel);
+			/* Keep idx contiguous */
+			if (next)
+				list_for_each_entry_from(next, &evlist->entries, node)
+					next->idx--;
+		}
 	} else if (!evsel->own_cpus || evlist->has_user_cpus ||
 		(!evsel->requires_cpu && perf_cpu_map__has_any_cpu(evlist->user_requested_cpus))) {
 		/*
@@ -80,11 +94,11 @@
 
 static void perf_evlist__propagate_maps(struct perf_evlist *evlist)
 {
-	struct perf_evsel *evsel;
+	struct perf_evsel *evsel, *n;
 
 	evlist->needs_map_propagation = true;
 
-	perf_evlist__for_each_evsel(evlist, evsel)
+	list_for_each_entry_safe(evsel, n, &evlist->entries, node)
 		__perf_evlist__propagate_maps(evlist, evsel);
 }
 
@@ -248,10 +262,10 @@
 
 static void perf_evlist__id_hash(struct perf_evlist *evlist,
 				 struct perf_evsel *evsel,
-				 int cpu, int thread, u64 id)
+				 int cpu_map_idx, int thread, u64 id)
 {
 	int hash;
-	struct perf_sample_id *sid = SID(evsel, cpu, thread);
+	struct perf_sample_id *sid = SID(evsel, cpu_map_idx, thread);
 
 	sid->id = id;
 	sid->evsel = evsel;
@@ -269,21 +283,27 @@
 
 void perf_evlist__id_add(struct perf_evlist *evlist,
 			 struct perf_evsel *evsel,
-			 int cpu, int thread, u64 id)
+			 int cpu_map_idx, int thread, u64 id)
 {
-	perf_evlist__id_hash(evlist, evsel, cpu, thread, id);
+	if (!SID(evsel, cpu_map_idx, thread))
+		return;
+
+	perf_evlist__id_hash(evlist, evsel, cpu_map_idx, thread, id);
 	evsel->id[evsel->ids++] = id;
 }
 
 int perf_evlist__id_add_fd(struct perf_evlist *evlist,
 			   struct perf_evsel *evsel,
-			   int cpu, int thread, int fd)
+			   int cpu_map_idx, int thread, int fd)
 {
 	u64 read_data[4] = { 0, };
 	int id_idx = 1; /* The first entry is the counter value */
 	u64 id;
 	int ret;
 
+	if (!SID(evsel, cpu_map_idx, thread))
+		return -1;
+
 	ret = ioctl(fd, PERF_EVENT_IOC_ID, &id);
 	if (!ret)
 		goto add;
@@ -312,7 +332,7 @@
 	id = read_data[id_idx];
 
 add:
-	perf_evlist__id_add(evlist, evsel, cpu, thread, id);
+	perf_evlist__id_add(evlist, evsel, cpu_map_idx, thread, id);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/tools/lib/perf/include/internal/evlist.h
+++ linux-qcom-6.8.0/tools/lib/perf/include/internal/evlist.h
@@ -126,11 +126,11 @@
 
 void perf_evlist__id_add(struct perf_evlist *evlist,
 			 struct perf_evsel *evsel,
-			 int cpu, int thread, u64 id);
+			 int cpu_map_idx, int thread, u64 id);
 
 int perf_evlist__id_add_fd(struct perf_evlist *evlist,
 			   struct perf_evsel *evsel,
-			   int cpu, int thread, int fd);
+			   int cpu_map_idx, int thread, int fd);
 
 void perf_evlist__reset_id_hash(struct perf_evlist *evlist);
 
--- linux-qcom-6.8.0.orig/tools/lib/perf/include/perf/cpumap.h
+++ linux-qcom-6.8.0/tools/lib/perf/include/perf/cpumap.h
@@ -61,6 +61,22 @@
  * perf_cpu_map__has_any_cpu_or_is_empty - is map either empty or has the "any CPU"/dummy value.
  */
 LIBPERF_API bool perf_cpu_map__has_any_cpu_or_is_empty(const struct perf_cpu_map *map);
+/**
+ * perf_cpu_map__is_any_cpu_or_is_empty - is map either empty or the "any CPU"/dummy value.
+ */
+LIBPERF_API bool perf_cpu_map__is_any_cpu_or_is_empty(const struct perf_cpu_map *map);
+/**
+ * perf_cpu_map__is_empty - does the map contain no values and it doesn't
+ *                          contain the special "any CPU"/dummy value.
+ */
+LIBPERF_API bool perf_cpu_map__is_empty(const struct perf_cpu_map *map);
+/**
+ * perf_cpu_map__min - the minimum CPU value or -1 if empty or just the "any CPU"/dummy value.
+ */
+LIBPERF_API struct perf_cpu perf_cpu_map__min(const struct perf_cpu_map *map);
+/**
+ * perf_cpu_map__max - the maximum CPU value or -1 if empty or just the "any CPU"/dummy value.
+ */
 LIBPERF_API struct perf_cpu perf_cpu_map__max(const struct perf_cpu_map *map);
 LIBPERF_API bool perf_cpu_map__has(const struct perf_cpu_map *map, struct perf_cpu cpu);
 LIBPERF_API bool perf_cpu_map__equal(const struct perf_cpu_map *lhs,
--- linux-qcom-6.8.0.orig/tools/lib/perf/libperf.map
+++ linux-qcom-6.8.0/tools/lib/perf/libperf.map
@@ -10,6 +10,10 @@
 		perf_cpu_map__nr;
 		perf_cpu_map__cpu;
 		perf_cpu_map__has_any_cpu_or_is_empty;
+		perf_cpu_map__is_any_cpu_or_is_empty;
+		perf_cpu_map__is_empty;
+		perf_cpu_map__has_any_cpu;
+		perf_cpu_map__min;
 		perf_cpu_map__max;
 		perf_cpu_map__has;
 		perf_thread_map__new_array;
--- linux-qcom-6.8.0.orig/tools/lib/thermal/Makefile
+++ linux-qcom-6.8.0/tools/lib/thermal/Makefile
@@ -121,7 +121,9 @@
 
 clean:
 	$(call QUIET_CLEAN, libthermal) $(RM) $(LIBTHERMAL_A) \
-                *.o *~ *.a *.so *.so.$(VERSION) *.so.$(LIBTHERMAL_VERSION) .*.d .*.cmd LIBTHERMAL-CFLAGS $(LIBTHERMAL_PC)
+                *.o *~ *.a *.so *.so.$(VERSION) *.so.$(LIBTHERMAL_VERSION) \
+                .*.d .*.cmd LIBTHERMAL-CFLAGS $(LIBTHERMAL_PC) \
+                $(srctree)/tools/$(THERMAL_UAPI)
 
 $(LIBTHERMAL_PC):
 	$(QUIET_GEN)sed -e "s|@PREFIX@|$(prefix)|" \
--- linux-qcom-6.8.0.orig/tools/lib/thermal/commands.c
+++ linux-qcom-6.8.0/tools/lib/thermal/commands.c
@@ -261,9 +261,25 @@
 	.o_ncmds	= ARRAY_SIZE(thermal_cmds),
 };
 
-static thermal_error_t thermal_genl_auto(struct thermal_handler *th, int id, int cmd,
-					 int flags, void *arg)
+struct cmd_param {
+	int tz_id;
+};
+
+typedef int (*cmd_cb_t)(struct nl_msg *, struct cmd_param *);
+
+static int thermal_genl_tz_id_encode(struct nl_msg *msg, struct cmd_param *p)
+{
+	if (p->tz_id >= 0 && nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_ID, p->tz_id))
+		return -1;
+
+	return 0;
+}
+
+static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cmd_cb,
+					 struct cmd_param *param,
+					 int cmd, int flags, void *arg)
 {
+	thermal_error_t ret = THERMAL_ERROR;
 	struct nl_msg *msg;
 	void *hdr;
 
@@ -274,45 +290,55 @@
 	hdr = genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, thermal_cmd_ops.o_id,
 			  0, flags, cmd, THERMAL_GENL_VERSION);
 	if (!hdr)
-		return THERMAL_ERROR;
+		goto out;
 
-	if (id >= 0 && nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_ID, id))
-		return THERMAL_ERROR;
+	if (cmd_cb && cmd_cb(msg, param))
+		goto out;
 
 	if (nl_send_msg(th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg))
-		return THERMAL_ERROR;
+		goto out;
 
+	ret = THERMAL_SUCCESS;
+out:
 	nlmsg_free(msg);
 
-	return THERMAL_SUCCESS;
+	return ret;
 }
 
 thermal_error_t thermal_cmd_get_tz(struct thermal_handler *th, struct thermal_zone **tz)
 {
-	return thermal_genl_auto(th, -1, THERMAL_GENL_CMD_TZ_GET_ID,
+	return thermal_genl_auto(th, NULL, NULL, THERMAL_GENL_CMD_TZ_GET_ID,
 				 NLM_F_DUMP | NLM_F_ACK, tz);
 }
 
 thermal_error_t thermal_cmd_get_cdev(struct thermal_handler *th, struct thermal_cdev **tc)
 {
-	return thermal_genl_auto(th, -1, THERMAL_GENL_CMD_CDEV_GET,
+	return thermal_genl_auto(th, NULL, NULL, THERMAL_GENL_CMD_CDEV_GET,
 				 NLM_F_DUMP | NLM_F_ACK, tc);
 }
 
 thermal_error_t thermal_cmd_get_trip(struct thermal_handler *th, struct thermal_zone *tz)
 {
-	return thermal_genl_auto(th, tz->id, THERMAL_GENL_CMD_TZ_GET_TRIP,
-				 0, tz);
+	struct cmd_param p = { .tz_id = tz->id };
+
+	return thermal_genl_auto(th, thermal_genl_tz_id_encode, &p,
+				 THERMAL_GENL_CMD_TZ_GET_TRIP, 0, tz);
 }
 
 thermal_error_t thermal_cmd_get_governor(struct thermal_handler *th, struct thermal_zone *tz)
 {
-	return thermal_genl_auto(th, tz->id, THERMAL_GENL_CMD_TZ_GET_GOV, 0, tz);
+	struct cmd_param p = { .tz_id = tz->id };
+
+	return thermal_genl_auto(th, thermal_genl_tz_id_encode, &p,
+				 THERMAL_GENL_CMD_TZ_GET_GOV, 0, tz);
 }
 
 thermal_error_t thermal_cmd_get_temp(struct thermal_handler *th, struct thermal_zone *tz)
 {
-	return thermal_genl_auto(th, tz->id, THERMAL_GENL_CMD_TZ_GET_TEMP, 0, tz);
+	struct cmd_param p = { .tz_id = tz->id };
+
+	return thermal_genl_auto(th, thermal_genl_tz_id_encode, &p,
+				 THERMAL_GENL_CMD_TZ_GET_TEMP, 0, tz);
 }
 
 thermal_error_t thermal_cmd_exit(struct thermal_handler *th)
--- linux-qcom-6.8.0.orig/tools/lib/thermal/sampling.c
+++ linux-qcom-6.8.0/tools/lib/thermal/sampling.c
@@ -16,6 +16,8 @@
 	struct thermal_handler_param *thp = arg;
 	struct thermal_handler *th = thp->th;
 
+	arg = thp->arg;
+
 	genlmsg_parse(nlh, 0, attrs, THERMAL_GENL_ATTR_MAX, NULL);
 
 	switch (genlhdr->cmd) {
--- linux-qcom-6.8.0.orig/tools/memory-model/lock.cat
+++ linux-qcom-6.8.0/tools/memory-model/lock.cat
@@ -102,19 +102,19 @@
  * within one of the lock's critical sections returns False.
  *)
 
-(* rfi for RU events: an RU may read from the last po-previous UL *)
-let rfi-ru = ([UL] ; po-loc ; [RU]) \ ([UL] ; po-loc ; [LKW] ; po-loc)
-
-(* rfe for RU events: an RU may read from an external UL or the initial write *)
-let all-possible-rfe-ru =
-	let possible-rfe-ru r =
+(*
+ * rf for RU events: an RU may read from an external UL or the initial write,
+ * or from the last po-previous UL
+ *)
+let all-possible-rf-ru =
+	let possible-rf-ru r =
 		let pair-to-relation p = p ++ 0
-		in map pair-to-relation (((UL | IW) * {r}) & loc & ext)
-	in map possible-rfe-ru RU
+		in map pair-to-relation ((((UL | IW) * {r}) & loc & ext) |
+			(((UL * {r}) & po-loc) \ ([UL] ; po-loc ; [LKW] ; po-loc)))
+	in map possible-rf-ru RU
 
 (* Generate all rf relations for RU events *)
-with rfe-ru from cross(all-possible-rfe-ru)
-let rf-ru = rfe-ru | rfi-ru
+with rf-ru from cross(all-possible-rf-ru)
 
 (* Final rf relation *)
 let rf = rf | rf-lf | rf-ru
--- linux-qcom-6.8.0.orig/tools/mm/page-types.c
+++ linux-qcom-6.8.0/tools/mm/page-types.c
@@ -22,6 +22,7 @@
 #include <time.h>
 #include <setjmp.h>
 #include <signal.h>
+#include <inttypes.h>
 #include <sys/types.h>
 #include <sys/errno.h>
 #include <sys/fcntl.h>
@@ -392,9 +393,9 @@
 		if (opt_file)
 			printf("%lx\t", voff);
 		if (opt_list_cgroup)
-			printf("@%llu\t", (unsigned long long)cgroup0);
+			printf("@%" PRIu64 "\t", cgroup0);
 		if (opt_list_mapcnt)
-			printf("%lu\t", mapcnt0);
+			printf("%" PRIu64 "\t", mapcnt0);
 		printf("%lx\t%lx\t%s\n",
 				index, count, page_flag_name(flags0));
 	}
@@ -420,9 +421,9 @@
 	if (opt_file)
 		printf("%lx\t", voffset);
 	if (opt_list_cgroup)
-		printf("@%llu\t", (unsigned long long)cgroup);
+		printf("@%" PRIu64 "\t", cgroup);
 	if (opt_list_mapcnt)
-		printf("%lu\t", mapcnt);
+		printf("%" PRIu64 "\t", mapcnt);
 
 	printf("%lx\t%s\n", offset, page_flag_name(flags));
 }
--- linux-qcom-6.8.0.orig/tools/mm/slabinfo.c
+++ linux-qcom-6.8.0/tools/mm/slabinfo.c
@@ -1297,7 +1297,9 @@
 			slab->cpu_partial_free = get_obj("cpu_partial_free");
 			slab->alloc_node_mismatch = get_obj("alloc_node_mismatch");
 			slab->deactivate_bypass = get_obj("deactivate_bypass");
-			chdir("..");
+			if (chdir(".."))
+				fatal("Unable to chdir from slab ../%s\n",
+				      slab->name);
 			if (slab->name[0] == ':')
 				alias_targets++;
 			slab++;
--- linux-qcom-6.8.0.orig/tools/net/ynl/lib/ynl.py
+++ linux-qcom-6.8.0/tools/net/ynl/lib/ynl.py
@@ -208,6 +208,7 @@
             self.done = 1
             extack_off = 20
         elif self.nl_type == Netlink.NLMSG_DONE:
+            self.error = struct.unpack("i", self.raw[0:4])[0]
             self.done = 1
             extack_off = 4
 
--- linux-qcom-6.8.0.orig/tools/net/ynl/ynl-gen-c.py
+++ linux-qcom-6.8.0/tools/net/ynl/ynl-gen-c.py
@@ -243,8 +243,11 @@
         presence = ''
         for i in range(0, len(ref)):
             presence = f"{var}->{'.'.join(ref[:i] + [''])}_present.{ref[i]}"
-            if self.presence_type() == 'bit':
-                code.append(presence + ' = 1;')
+            # Every layer below last is a nest, so we know it uses bit presence
+            # last layer is "self" and may be a complex type
+            if i == len(ref) - 1 and self.presence_type() != 'bit':
+                continue
+            code.append(presence + ' = 1;')
         code += self._setter_lines(ri, member, presence)
 
         func_name = f"{op_prefix(ri, direction, deref=deref)}_set_{'_'.join(ref)}"
--- linux-qcom-6.8.0.orig/tools/objtool/check.c
+++ linux-qcom-6.8.0/tools/objtool/check.c
@@ -3620,6 +3620,18 @@
 				}
 
 				if (!save_insn->visited) {
+					/*
+					 * If the restore hint insn is at the
+					 * beginning of a basic block and was
+					 * branched to from elsewhere, and the
+					 * save insn hasn't been visited yet,
+					 * defer following this branch for now.
+					 * It will be seen later via the
+					 * straight-line path.
+					 */
+					if (!prev_insn)
+						return 0;
+
 					WARN_INSN(insn, "objtool isn't smart enough to handle this CFI save/restore combo");
 					return 1;
 				}
@@ -3723,9 +3735,12 @@
 			break;
 
 		case INSN_CONTEXT_SWITCH:
-			if (func && (!next_insn || !next_insn->hint)) {
-				WARN_INSN(insn, "unsupported instruction in callable function");
-				return 1;
+			if (func) {
+				if (!next_insn || !next_insn->hint) {
+					WARN_INSN(insn, "unsupported instruction in callable function");
+					return 1;
+				}
+				break;
 			}
 			return 0;
 
@@ -3991,7 +4006,10 @@
 		warnings++;
 	}
 
-	return warnings;
+	/* RETPOLINE is an optional security safety feature, make it
+	 * fatal to ensure no new code is introduced that fails
+	 * RETPOLINE */
+	return -warnings;
 }
 
 static bool is_kasan_insn(struct instruction *insn)
@@ -4500,7 +4518,9 @@
 		}
 	}
 
-	return warnings;
+	/* SLS is an optional security safety feature, make it fatal
+	 * to ensure no new code is introduced that fails SLS */
+	return -warnings;
 }
 
 static bool ignore_noreturn_call(struct instruction *insn)
@@ -4677,8 +4697,10 @@
 	init_cfi_state(&force_undefined_cfi);
 	force_undefined_cfi.force_undefined = true;
 
-	if (!cfi_hash_alloc(1UL << (file->elf->symbol_bits - 3)))
+	if (!cfi_hash_alloc(1UL << (file->elf->symbol_bits - 3))) {
+		ret = -1;
 		goto out;
+	}
 
 	cfi_hash_add(&init_cfi);
 	cfi_hash_add(&func_cfi);
@@ -4695,7 +4717,7 @@
 	if (opts.retpoline) {
 		ret = validate_retpoline(file);
 		if (ret < 0)
-			return ret;
+			goto out;
 		warnings += ret;
 	}
 
@@ -4731,7 +4753,7 @@
 		 */
 		ret = validate_unrets(file);
 		if (ret < 0)
-			return ret;
+			goto out;
 		warnings += ret;
 	}
 
@@ -4794,7 +4816,7 @@
 	if (opts.prefix) {
 		ret = add_prefix_symbols(file);
 		if (ret < 0)
-			return ret;
+			goto out;
 		warnings += ret;
 	}
 
@@ -4825,10 +4847,5 @@
 	}
 
 out:
-	/*
-	 *  For now, don't fail the kernel build on fatal warnings.  These
-	 *  errors are still fairly common due to the growing matrix of
-	 *  supported toolchains and their recent pace of change.
-	 */
-	return 0;
+	return ret < 0 ? ret : 0;
 }
--- linux-qcom-6.8.0.orig/tools/objtool/noreturns.h
+++ linux-qcom-6.8.0/tools/objtool/noreturns.h
@@ -6,6 +6,8 @@
  *
  * Yes, this is unfortunate.  A better solution is in the works.
  */
+NORETURN(__ia32_sys_exit)
+NORETURN(__ia32_sys_exit_group)
 NORETURN(__kunit_abort)
 NORETURN(__module_put_and_kthread_exit)
 NORETURN(__reiserfs_panic)
@@ -13,9 +15,12 @@
 NORETURN(__tdx_hypercall_failed)
 NORETURN(__ubsan_handle_builtin_unreachable)
 NORETURN(arch_call_rest_init)
+NORETURN(__x64_sys_exit)
+NORETURN(__x64_sys_exit_group)
 NORETURN(arch_cpu_idle_dead)
 NORETURN(bch2_trans_in_restart_error)
 NORETURN(bch2_trans_restart_error)
+NORETURN(bch2_trans_unlocked_error)
 NORETURN(cpu_bringup_and_idle)
 NORETURN(cpu_startup_entry)
 NORETURN(do_exit)
--- linux-qcom-6.8.0.orig/tools/perf/Documentation/perf-list.txt
+++ linux-qcom-6.8.0/tools/perf/Documentation/perf-list.txt
@@ -71,6 +71,7 @@
  D - pin the event to the PMU
  W - group is weak and will fallback to non-group if not schedulable,
  e - group or event are exclusive and do not share the PMU
+ b - use BPF aggregration (see perf stat --bpf-counters)
 
 The 'p' modifier can be used for specifying how precise the instruction
 address should be. The 'p' modifier can be specified multiple times:
--- linux-qcom-6.8.0.orig/tools/perf/Documentation/perf-script.txt
+++ linux-qcom-6.8.0/tools/perf/Documentation/perf-script.txt
@@ -441,9 +441,10 @@
 	will be printed. Each entry has function name and file/line. Enabled by
 	default, disable with --no-inline.
 
---insn-trace::
-	Show instruction stream for intel_pt traces. Combine with --xed to
-	show disassembly.
+--insn-trace[=<raw|disasm>]::
+	Show instruction stream in bytes (raw) or disassembled (disasm)
+	for intel_pt traces. The default is 'raw'. To use xed, combine
+	'raw' with --xed to show disassembly done by xed.
 
 --xed::
 	Run xed disassembler on output. Requires installing the xed disassembler.
--- linux-qcom-6.8.0.orig/tools/perf/Makefile.config
+++ linux-qcom-6.8.0/tools/perf/Makefile.config
@@ -930,6 +930,11 @@
   endif
 endif
 
+ifdef HAVE_NO_LIBBFD
+  feature-libbfd := 0
+  $(info libbfd overidden OFF)
+else
+
 ifdef BUILD_NONDISTRO
   ifeq ($(feature-libbfd), 1)
     EXTLIBS += -lbfd -lopcodes
@@ -966,6 +971,8 @@
   endif
 endif
 
+endif
+
 ifndef NO_DEMANGLE
   $(call feature_check,cxa-demangle)
   ifeq ($(feature-cxa-demangle), 1)
--- linux-qcom-6.8.0.orig/tools/perf/Makefile.perf
+++ linux-qcom-6.8.0/tools/perf/Makefile.perf
@@ -455,18 +455,19 @@
 
 arm64_gen_sysreg_dir := $(srctree)/tools/arch/arm64/tools
 ifneq ($(OUTPUT),)
-  arm64_gen_sysreg_outdir := $(OUTPUT)
+  arm64_gen_sysreg_outdir := $(abspath $(OUTPUT))
 else
   arm64_gen_sysreg_outdir := $(CURDIR)
 endif
 
 arm64-sysreg-defs: FORCE
-	$(Q)$(MAKE) -C $(arm64_gen_sysreg_dir) O=$(arm64_gen_sysreg_outdir)
+	$(Q)$(MAKE) -C $(arm64_gen_sysreg_dir) O=$(arm64_gen_sysreg_outdir) \
+		prefix= subdir=
 
 arm64-sysreg-defs-clean:
 	$(call QUIET_CLEAN,arm64-sysreg-defs)
 	$(Q)$(MAKE) -C $(arm64_gen_sysreg_dir) O=$(arm64_gen_sysreg_outdir) \
-		clean > /dev/null
+		prefix= subdir= clean > /dev/null
 
 beauty_linux_dir := $(srctree)/tools/perf/trace/beauty/include/linux/
 linux_uapi_dir := $(srctree)/tools/include/uapi/linux
@@ -1167,7 +1168,7 @@
 endif # CONFIG_PERF_BPF_SKEL
 
 bpf-skel-clean:
-	$(call QUIET_CLEAN, bpf-skel) $(RM) -r $(SKEL_TMP_OUT) $(SKELETONS)
+	$(call QUIET_CLEAN, bpf-skel) $(RM) -r $(SKEL_TMP_OUT) $(SKELETONS) $(SKEL_OUT)/vmlinux.h
 
 clean:: $(LIBAPI)-clean $(LIBBPF)-clean $(LIBSUBCMD)-clean $(LIBSYMBOL)-clean $(LIBPERF)-clean arm64-sysreg-defs-clean fixdep-clean python-clean bpf-skel-clean tests-coresight-targets-clean
 	$(call QUIET_CLEAN, core-objs)  $(RM) $(LIBPERF_A) $(OUTPUT)perf-archive $(OUTPUT)perf-iostat $(LANG_BINDINGS)
--- linux-qcom-6.8.0.orig/tools/perf/arch/x86/util/intel-pt.c
+++ linux-qcom-6.8.0/tools/perf/arch/x86/util/intel-pt.c
@@ -32,6 +32,7 @@
 #include "../../../util/tsc.h"
 #include <internal/lib.h> // page_size
 #include "../../../util/intel-pt.h"
+#include <api/fs/fs.h>
 
 #define KiB(x) ((x) * 1024)
 #define MiB(x) ((x) * 1024 * 1024)
@@ -428,6 +429,16 @@
 }
 #endif
 
+static bool intel_pt_exclude_guest(void)
+{
+	int pt_mode;
+
+	if (sysfs__read_int("module/kvm_intel/parameters/pt_mode", &pt_mode))
+		pt_mode = 0;
+
+	return pt_mode == 1;
+}
+
 static void intel_pt_valid_str(char *str, size_t len, u64 valid)
 {
 	unsigned int val, last = 0, state = 1;
@@ -620,6 +631,7 @@
 			}
 			evsel->core.attr.freq = 0;
 			evsel->core.attr.sample_period = 1;
+			evsel->core.attr.exclude_guest = intel_pt_exclude_guest();
 			evsel->no_aux_samples = true;
 			evsel->needs_auxtrace_mmap = true;
 			intel_pt_evsel = evsel;
@@ -758,7 +770,8 @@
 	}
 
 	if (!opts->auxtrace_snapshot_mode && !opts->auxtrace_sample_mode) {
-		u32 aux_watermark = opts->auxtrace_mmap_pages * page_size / 4;
+		size_t aw = opts->auxtrace_mmap_pages * (size_t)page_size / 4;
+		u32 aux_watermark = aw > UINT_MAX ? UINT_MAX : aw;
 
 		intel_pt_evsel->core.attr.aux_watermark = aux_watermark;
 	}
--- linux-qcom-6.8.0.orig/tools/perf/bench/inject-buildid.c
+++ linux-qcom-6.8.0/tools/perf/bench/inject-buildid.c
@@ -362,7 +362,7 @@
 		return -1;
 
 	for (i = 0; i < nr_mmaps; i++) {
-		int idx = rand() % (nr_dsos - 1);
+		int idx = rand() % nr_dsos;
 		struct bench_dso *dso = &dsos[idx];
 		u64 timestamp = rand() % 1000000;
 
--- linux-qcom-6.8.0.orig/tools/perf/bench/uprobe.c
+++ linux-qcom-6.8.0/tools/perf/bench/uprobe.c
@@ -47,7 +47,7 @@
 #define bench_uprobe__attach_uprobe(prog) \
 	skel->links.prog = bpf_program__attach_uprobe_opts(/*prog=*/skel->progs.prog, \
 							   /*pid=*/-1, \
-							   /*binary_path=*/"/lib64/libc.so.6", \
+							   /*binary_path=*/"libc.so.6", \
 							   /*func_offset=*/0, \
 							   /*opts=*/&uprobe_opts); \
 	if (!skel->links.prog) { \
--- linux-qcom-6.8.0.orig/tools/perf/builtin-annotate.c
+++ linux-qcom-6.8.0/tools/perf/builtin-annotate.c
@@ -809,8 +809,6 @@
 		    "Enable symbol demangling"),
 	OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel,
 		    "Enable kernel symbol demangling"),
-	OPT_BOOLEAN(0, "group", &symbol_conf.event_group,
-		    "Show event group information together"),
 	OPT_BOOLEAN(0, "show-total-period", &symbol_conf.show_total_period,
 		    "Show a column with the sum of periods"),
 	OPT_BOOLEAN('n', "show-nr-samples", &symbol_conf.show_nr_samples,
--- linux-qcom-6.8.0.orig/tools/perf/builtin-daemon.c
+++ linux-qcom-6.8.0/tools/perf/builtin-daemon.c
@@ -523,7 +523,7 @@
 		  session->base, SESSION_CONTROL);
 
 	control = open(control_path, O_WRONLY|O_NONBLOCK);
-	if (!control)
+	if (control < 0)
 		return -1;
 
 	if (do_ack) {
@@ -532,7 +532,7 @@
 			  session->base, SESSION_ACK);
 
 		ack = open(ack_path, O_RDONLY, O_NONBLOCK);
-		if (!ack) {
+		if (ack < 0) {
 			close(control);
 			return -1;
 		}
--- linux-qcom-6.8.0.orig/tools/perf/builtin-ftrace.c
+++ linux-qcom-6.8.0/tools/perf/builtin-ftrace.c
@@ -771,7 +771,7 @@
 
 	bar_len = buckets[0] * bar_total / total;
 	printf("  %4d - %-4d %s | %10d | %.*s%*s |\n",
-	       0, 1, "us", buckets[0], bar_len, bar, bar_total - bar_len, "");
+	       0, 1, use_nsec ? "ns" : "us", buckets[0], bar_len, bar, bar_total - bar_len, "");
 
 	for (i = 1; i < NUM_BUCKET - 1; i++) {
 		int start = (1 << (i - 1));
--- linux-qcom-6.8.0.orig/tools/perf/builtin-inject.c
+++ linux-qcom-6.8.0/tools/perf/builtin-inject.c
@@ -2200,6 +2200,7 @@
 			.finished_init	= perf_event__repipe_op2_synth,
 			.compressed	= perf_event__repipe_op4_synth,
 			.auxtrace	= perf_event__repipe_auxtrace,
+			.dont_split_sample_group = true,
 		},
 		.input_name  = "-",
 		.samples = LIST_HEAD_INIT(inject.samples),
--- linux-qcom-6.8.0.orig/tools/perf/builtin-kmem.c
+++ linux-qcom-6.8.0/tools/perf/builtin-kmem.c
@@ -2058,6 +2058,8 @@
 
 out_delete:
 	perf_session__delete(session);
+	/* free usage string allocated by parse_options_subcommand */
+	free((void *)kmem_usage[0]);
 
 	return ret;
 }
--- linux-qcom-6.8.0.orig/tools/perf/builtin-kvm.c
+++ linux-qcom-6.8.0/tools/perf/builtin-kvm.c
@@ -2187,5 +2187,8 @@
 	else
 		usage_with_options(kvm_usage, kvm_options);
 
+	/* free usage string allocated by parse_options_subcommand */
+	free((void *)kvm_usage[0]);
+
 	return 0;
 }
--- linux-qcom-6.8.0.orig/tools/perf/builtin-kwork.c
+++ linux-qcom-6.8.0/tools/perf/builtin-kwork.c
@@ -2520,5 +2520,8 @@
 	} else
 		usage_with_options(kwork_usage, kwork_options);
 
+	/* free usage string allocated by parse_options_subcommand */
+	free((void *)kwork_usage[0]);
+
 	return 0;
 }
--- linux-qcom-6.8.0.orig/tools/perf/builtin-list.c
+++ linux-qcom-6.8.0/tools/perf/builtin-list.c
@@ -99,7 +99,7 @@
 	}
 }
 
-static void default_print_event(void *ps, const char *pmu_name, const char *topic,
+static void default_print_event(void *ps, const char *topic, const char *pmu_name,
 				const char *event_name, const char *event_alias,
 				const char *scale_unit __maybe_unused,
 				bool deprecated, const char *event_type_desc,
@@ -333,7 +333,7 @@
 	fputs(buf->buf, fp);
 }
 
-static void json_print_event(void *ps, const char *pmu_name, const char *topic,
+static void json_print_event(void *ps, const char *topic, const char *pmu_name,
 			     const char *event_name, const char *event_alias,
 			     const char *scale_unit,
 			     bool deprecated, const char *event_type_desc,
--- linux-qcom-6.8.0.orig/tools/perf/builtin-lock.c
+++ linux-qcom-6.8.0/tools/perf/builtin-lock.c
@@ -2720,6 +2720,9 @@
 		usage_with_options(lock_usage, lock_options);
 	}
 
+	/* free usage string allocated by parse_options_subcommand */
+	free((void *)lock_usage[0]);
+
 	zfree(&lockhash_table);
 	return rc;
 }
--- linux-qcom-6.8.0.orig/tools/perf/builtin-mem.c
+++ linux-qcom-6.8.0/tools/perf/builtin-mem.c
@@ -372,6 +372,7 @@
 		rep_argv[i] = argv[j];
 
 	ret = cmd_report(i, rep_argv);
+	free(new_sort_order);
 	free(rep_argv);
 	return ret;
 }
@@ -517,5 +518,8 @@
 	else
 		usage_with_options(mem_usage, mem_options);
 
+	/* free usage string allocated by parse_options_subcommand */
+	free((void *)mem_usage[0]);
+
 	return 0;
 }
--- linux-qcom-6.8.0.orig/tools/perf/builtin-record.c
+++ linux-qcom-6.8.0/tools/perf/builtin-record.c
@@ -1355,8 +1355,6 @@
 	struct record_opts *opts = &rec->opts;
 	int rc = 0;
 
-	evlist__config(evlist, opts, &callchain_param);
-
 	evlist__for_each_entry(evlist, pos) {
 try_again:
 		if (evsel__open(pos, pos->core.cpus, pos->core.threads) < 0) {
@@ -1830,8 +1828,8 @@
 record__switch_output(struct record *rec, bool at_exit)
 {
 	struct perf_data *data = &rec->data;
+	char *new_filename = NULL;
 	int fd, err;
-	char *new_filename;
 
 	/* Same Size:      "2015122520103046"*/
 	char timestamp[] = "InvalidTimestamp";
@@ -1954,8 +1952,7 @@
 
 				if (count.lost) {
 					if (!lost) {
-						lost = zalloc(sizeof(*lost) +
-							      session->machines.host.id_hdr_size);
+						lost = zalloc(PERF_SAMPLE_MAX_SIZE);
 						if (!lost) {
 							pr_debug("Memory allocation failed\n");
 							return;
@@ -1971,8 +1968,7 @@
 		lost_count = perf_bpf_filter__lost_count(evsel);
 		if (lost_count) {
 			if (!lost) {
-				lost = zalloc(sizeof(*lost) +
-					      session->machines.host.id_hdr_size);
+				lost = zalloc(PERF_SAMPLE_MAX_SIZE);
 				if (!lost) {
 					pr_debug("Memory allocation failed\n");
 					return;
@@ -2472,8 +2468,15 @@
 	if (data->is_pipe && rec->evlist->core.nr_entries == 1)
 		rec->opts.sample_id = true;
 
+	if (rec->timestamp_filename && perf_data__is_pipe(data)) {
+		rec->timestamp_filename = false;
+		pr_warning("WARNING: --timestamp-filename option is not available in pipe mode.\n");
+	}
+
 	evlist__uniquify_name(rec->evlist);
 
+	evlist__config(rec->evlist, opts, &callchain_param);
+
 	/* Debug message used by test scripts */
 	pr_debug3("perf record opening and mmapping events\n");
 	if (record__open(rec) != 0) {
@@ -2872,10 +2875,10 @@
 	}
 #endif
 	zstd_fini(&session->zstd_data);
-	perf_session__delete(session);
-
 	if (!opts->no_bpf_event)
 		evlist__stop_sb_thread(rec->sb_evlist);
+
+	perf_session__delete(session);
 	return status;
 }
 
--- linux-qcom-6.8.0.orig/tools/perf/builtin-report.c
+++ linux-qcom-6.8.0/tools/perf/builtin-report.c
@@ -427,7 +427,7 @@
 		 * compatibility, set the bit if it's an old perf data file.
 		 */
 		evlist__for_each_entry(session->evlist, evsel) {
-			if (strstr(evsel->name, "arm_spe") &&
+			if (strstr(evsel__name(evsel), "arm_spe") &&
 				!(sample_type & PERF_SAMPLE_DATA_SRC)) {
 				evsel->core.attr.sample_type |= PERF_SAMPLE_DATA_SRC;
 				sample_type |= PERF_SAMPLE_DATA_SRC;
@@ -563,6 +563,7 @@
 		struct hists *hists = evsel__hists(pos);
 		const char *evname = evsel__name(pos);
 
+		i++;
 		if (symbol_conf.event_group && !evsel__is_group_leader(pos))
 			continue;
 
@@ -572,7 +573,7 @@
 		hists__fprintf_nr_sample_events(hists, rep, evname, stdout);
 
 		if (rep->total_cycles_mode) {
-			report__browse_block_hists(&rep->block_reports[i++].hist,
+			report__browse_block_hists(&rep->block_reports[i - 1].hist,
 						   rep->min_percent, pos, NULL);
 			continue;
 		}
--- linux-qcom-6.8.0.orig/tools/perf/builtin-sched.c
+++ linux-qcom-6.8.0/tools/perf/builtin-sched.c
@@ -2633,9 +2633,12 @@
 	 * - previous sched event is out of window - we are done
 	 * - sample time is beyond window user cares about - reset it
 	 *   to close out stats for time window interest
+	 * - If tprev is 0, that is, sched_in event for current task is
+	 *   not recorded, cannot determine whether sched_in event is
+	 *   within time window interest - ignore it
 	 */
 	if (ptime->end) {
-		if (tprev > ptime->end)
+		if (!tprev || tprev > ptime->end)
 			goto out;
 
 		if (t > ptime->end)
@@ -3000,8 +3003,11 @@
 			return -1;
 		}
 
-		if (sched->show_callchain && !evsel__has_callchain(evsel)) {
-			pr_info("Samples do not have callchains.\n");
+		/* only need to save callchain related to sched_switch event */
+		if (sched->show_callchain &&
+		    evsel__name_is(evsel, "sched:sched_switch") &&
+		    !evsel__has_callchain(evsel)) {
+			pr_info("Samples of sched_switch event do not have callchains.\n");
 			sched->show_callchain = 0;
 			symbol_conf.use_callchain = 0;
 		}
@@ -3065,7 +3071,8 @@
 
 	if (perf_time__parse_str(&sched->ptime, sched->time_str) != 0) {
 		pr_err("Invalid time string\n");
-		return -EINVAL;
+		err = -EINVAL;
+		goto out;
 	}
 
 	if (timehist_check_attr(sched, evlist) != 0)
@@ -3204,14 +3211,44 @@
 	}
 }
 
+static int setup_cpus_switch_event(struct perf_sched *sched)
+{
+	unsigned int i;
+
+	sched->cpu_last_switched = calloc(MAX_CPUS, sizeof(*(sched->cpu_last_switched)));
+	if (!sched->cpu_last_switched)
+		return -1;
+
+	sched->curr_pid = malloc(MAX_CPUS * sizeof(*(sched->curr_pid)));
+	if (!sched->curr_pid) {
+		zfree(&sched->cpu_last_switched);
+		return -1;
+	}
+
+	for (i = 0; i < MAX_CPUS; i++)
+		sched->curr_pid[i] = -1;
+
+	return 0;
+}
+
+static void free_cpus_switch_event(struct perf_sched *sched)
+{
+	zfree(&sched->curr_pid);
+	zfree(&sched->cpu_last_switched);
+}
+
 static int perf_sched__lat(struct perf_sched *sched)
 {
+	int rc = -1;
 	struct rb_node *next;
 
 	setup_pager();
 
+	if (setup_cpus_switch_event(sched))
+		return rc;
+
 	if (perf_sched__read_events(sched))
-		return -1;
+		goto out_free_cpus_switch_event;
 
 	perf_sched__merge_lat(sched);
 	perf_sched__sort_lat(sched);
@@ -3240,13 +3277,15 @@
 	print_bad_events(sched);
 	printf("\n");
 
-	return 0;
+	rc = 0;
+
+out_free_cpus_switch_event:
+	free_cpus_switch_event(sched);
+	return rc;
 }
 
 static int setup_map_cpus(struct perf_sched *sched)
 {
-	struct perf_cpu_map *map;
-
 	sched->max_cpu.cpu  = sysconf(_SC_NPROCESSORS_CONF);
 
 	if (sched->map.comp) {
@@ -3255,16 +3294,15 @@
 			return -1;
 	}
 
-	if (!sched->map.cpus_str)
-		return 0;
-
-	map = perf_cpu_map__new(sched->map.cpus_str);
-	if (!map) {
-		pr_err("failed to get cpus map from %s\n", sched->map.cpus_str);
-		return -1;
+	if (sched->map.cpus_str) {
+		sched->map.cpus = perf_cpu_map__new(sched->map.cpus_str);
+		if (!sched->map.cpus) {
+			pr_err("failed to get cpus map from %s\n", sched->map.cpus_str);
+			zfree(&sched->map.comp_cpus);
+			return -1;
+		}
 	}
 
-	sched->map.cpus = map;
 	return 0;
 }
 
@@ -3304,33 +3342,69 @@
 
 static int perf_sched__map(struct perf_sched *sched)
 {
+	int rc = -1;
+
+	sched->curr_thread = calloc(MAX_CPUS, sizeof(*(sched->curr_thread)));
+	if (!sched->curr_thread)
+		return rc;
+
+	if (setup_cpus_switch_event(sched))
+		goto out_free_curr_thread;
+
 	if (setup_map_cpus(sched))
-		return -1;
+		goto out_free_cpus_switch_event;
 
 	if (setup_color_pids(sched))
-		return -1;
+		goto out_put_map_cpus;
 
 	if (setup_color_cpus(sched))
-		return -1;
+		goto out_put_color_pids;
 
 	setup_pager();
 	if (perf_sched__read_events(sched))
-		return -1;
+		goto out_put_color_cpus;
+
+	rc = 0;
 	print_bad_events(sched);
-	return 0;
+
+out_put_color_cpus:
+	perf_cpu_map__put(sched->map.color_cpus);
+
+out_put_color_pids:
+	perf_thread_map__put(sched->map.color_pids);
+
+out_put_map_cpus:
+	zfree(&sched->map.comp_cpus);
+	perf_cpu_map__put(sched->map.cpus);
+
+out_free_cpus_switch_event:
+	free_cpus_switch_event(sched);
+
+out_free_curr_thread:
+	zfree(&sched->curr_thread);
+	return rc;
 }
 
 static int perf_sched__replay(struct perf_sched *sched)
 {
+	int ret;
 	unsigned long i;
 
+	mutex_init(&sched->start_work_mutex);
+	mutex_init(&sched->work_done_wait_mutex);
+
+	ret = setup_cpus_switch_event(sched);
+	if (ret)
+		goto out_mutex_destroy;
+
 	calibrate_run_measurement_overhead(sched);
 	calibrate_sleep_measurement_overhead(sched);
 
 	test_calibrations(sched);
 
-	if (perf_sched__read_events(sched))
-		return -1;
+	ret = perf_sched__read_events(sched);
+	if (ret)
+		goto out_free_cpus_switch_event;
 
 	printf("nr_run_events:        %ld\n", sched->nr_run_events);
 	printf("nr_sleep_events:      %ld\n", sched->nr_sleep_events);
@@ -3355,7 +3429,14 @@
 
 	sched->thread_funcs_exit = true;
 	destroy_tasks(sched);
-	return 0;
+
+out_free_cpus_switch_event:
+	free_cpus_switch_event(sched);
+
+out_mutex_destroy:
+	mutex_destroy(&sched->start_work_mutex);
+	mutex_destroy(&sched->work_done_wait_mutex);
+	return ret;
 }
 
 static void setup_sorting(struct perf_sched *sched, const struct option *options,
@@ -3590,28 +3671,7 @@
 		.switch_event	    = replay_switch_event,
 		.fork_event	    = replay_fork_event,
 	};
-	unsigned int i;
-	int ret = 0;
-
-	mutex_init(&sched.start_work_mutex);
-	mutex_init(&sched.work_done_wait_mutex);
-	sched.curr_thread = calloc(MAX_CPUS, sizeof(*sched.curr_thread));
-	if (!sched.curr_thread) {
-		ret = -ENOMEM;
-		goto out;
-	}
-	sched.cpu_last_switched = calloc(MAX_CPUS, sizeof(*sched.cpu_last_switched));
-	if (!sched.cpu_last_switched) {
-		ret = -ENOMEM;
-		goto out;
-	}
-	sched.curr_pid = malloc(MAX_CPUS * sizeof(*sched.curr_pid));
-	if (!sched.curr_pid) {
-		ret = -ENOMEM;
-		goto out;
-	}
-	for (i = 0; i < MAX_CPUS; i++)
-		sched.curr_pid[i] = -1;
+	int ret;
 
 	argc = parse_options_subcommand(argc, argv, sched_options, sched_subcommands,
 					sched_usage, PARSE_OPT_STOP_AT_NON_OPTION);
@@ -3622,9 +3682,9 @@
 	 * Aliased to 'perf script' for now:
 	 */
 	if (!strcmp(argv[0], "script")) {
-		ret = cmd_script(argc, argv);
+		return cmd_script(argc, argv);
 	} else if (strlen(argv[0]) > 2 && strstarts("record", argv[0])) {
-		ret = __cmd_record(argc, argv);
+		return __cmd_record(argc, argv);
 	} else if (strlen(argv[0]) > 2 && strstarts("latency", argv[0])) {
 		sched.tp_handler = &lat_ops;
 		if (argc > 1) {
@@ -3633,7 +3693,7 @@
 				usage_with_options(latency_usage, latency_options);
 		}
 		setup_sorting(&sched, latency_options, latency_usage);
-		ret = perf_sched__lat(&sched);
+		return perf_sched__lat(&sched);
 	} else if (!strcmp(argv[0], "map")) {
 		if (argc) {
 			argc = parse_options(argc, argv, map_options, map_usage, 0);
@@ -3642,7 +3702,7 @@
 		}
 		sched.tp_handler = &map_ops;
 		setup_sorting(&sched, latency_options, latency_usage);
-		ret = perf_sched__map(&sched);
+		return perf_sched__map(&sched);
 	} else if (strlen(argv[0]) > 2 && strstarts("replay", argv[0])) {
 		sched.tp_handler = &replay_ops;
 		if (argc) {
@@ -3650,7 +3710,7 @@
 			if (argc)
 				usage_with_options(replay_usage, replay_options);
 		}
-		ret = perf_sched__replay(&sched);
+		return perf_sched__replay(&sched);
 	} else if (!strcmp(argv[0], "timehist")) {
 		if (argc) {
 			argc = parse_options(argc, argv, timehist_options,
@@ -3666,24 +3726,19 @@
 				parse_options_usage(NULL, timehist_options, "w", true);
 			if (sched.show_next)
 				parse_options_usage(NULL, timehist_options, "n", true);
-			ret = -EINVAL;
-			goto out;
+			return -EINVAL;
 		}
 		ret = symbol__validate_sym_arguments();
 		if (ret)
-			goto out;
+			return ret;
 
-		ret = perf_sched__timehist(&sched);
+		return perf_sched__timehist(&sched);
 	} else {
 		usage_with_options(sched_usage, sched_options);
 	}
 
-out:
-	free(sched.curr_pid);
-	free(sched.cpu_last_switched);
-	free(sched.curr_thread);
-	mutex_destroy(&sched.start_work_mutex);
-	mutex_destroy(&sched.work_done_wait_mutex);
+	/* free usage string allocated by parse_options_subcommand */
+	free((void *)sched_usage[0]);
 
-	return ret;
+	return 0;
 }
--- linux-qcom-6.8.0.orig/tools/perf/builtin-script.c
+++ linux-qcom-6.8.0/tools/perf/builtin-script.c
@@ -3765,11 +3765,25 @@
 #endif
 
 static int parse_insn_trace(const struct option *opt __maybe_unused,
-			    const char *str __maybe_unused,
-			    int unset __maybe_unused)
+			    const char *str, int unset __maybe_unused)
 {
-	parse_output_fields(NULL, "+insn,-event,-period", 0);
-	itrace_parse_synth_opts(opt, "i0ns", 0);
+	const char *fields = "+insn,-event,-period";
+	int ret;
+
+	if (str) {
+		if (strcmp(str, "disasm") == 0)
+			fields = "+disasm,-event,-period";
+		else if (strlen(str) != 0 && strcmp(str, "raw") != 0) {
+			fprintf(stderr, "Only accept raw|disasm\n");
+			return -EINVAL;
+		}
+	}
+
+	ret = parse_output_fields(NULL, fields, 0);
+	if (ret < 0)
+		return ret;
+
+	itrace_parse_synth_opts(opt, "i0nse", 0);
 	symbol_conf.nanosecs = true;
 	return 0;
 }
@@ -3914,7 +3928,7 @@
 		   "only consider these symbols"),
 	OPT_INTEGER(0, "addr-range", &symbol_conf.addr_range,
 		    "Use with -S to list traced records within address range"),
-	OPT_CALLBACK_OPTARG(0, "insn-trace", &itrace_synth_opts, NULL, NULL,
+	OPT_CALLBACK_OPTARG(0, "insn-trace", &itrace_synth_opts, NULL, "raw|disasm",
 			"Decode instructions from itrace", parse_insn_trace),
 	OPT_CALLBACK_OPTARG(0, "xed", NULL, NULL, NULL,
 			"Run xed disassembler on output", parse_xed),
--- linux-qcom-6.8.0.orig/tools/perf/builtin-stat.c
+++ linux-qcom-6.8.0/tools/perf/builtin-stat.c
@@ -712,15 +712,19 @@
 	}
 
 	if (!cpu_map__is_dummy(evsel_list->core.user_requested_cpus)) {
-		if (affinity__setup(&saved_affinity) < 0)
-			return -1;
+		if (affinity__setup(&saved_affinity) < 0) {
+			err = -1;
+			goto err_out;
+		}
 		affinity = &saved_affinity;
 	}
 
 	evlist__for_each_entry(evsel_list, counter) {
 		counter->reset_group = false;
-		if (bpf_counter__load(counter, &target))
-			return -1;
+		if (bpf_counter__load(counter, &target)) {
+			err = -1;
+			goto err_out;
+		}
 		if (!(evsel__is_bperf(counter)))
 			all_counters_use_bpf = false;
 	}
@@ -763,7 +767,8 @@
 
 			switch (stat_handle_error(counter)) {
 			case COUNTER_FATAL:
-				return -1;
+				err = -1;
+				goto err_out;
 			case COUNTER_RETRY:
 				goto try_again;
 			case COUNTER_SKIP:
@@ -804,7 +809,8 @@
 
 				switch (stat_handle_error(counter)) {
 				case COUNTER_FATAL:
-					return -1;
+					err = -1;
+					goto err_out;
 				case COUNTER_RETRY:
 					goto try_again_reset;
 				case COUNTER_SKIP:
@@ -817,6 +823,7 @@
 		}
 	}
 	affinity__cleanup(affinity);
+	affinity = NULL;
 
 	evlist__for_each_entry(evsel_list, counter) {
 		if (!counter->supported) {
@@ -829,8 +836,10 @@
 			stat_config.unit_width = l;
 
 		if (evsel__should_store_id(counter) &&
-		    evsel__store_ids(counter, evsel_list))
-			return -1;
+		    evsel__store_ids(counter, evsel_list)) {
+			err = -1;
+			goto err_out;
+		}
 	}
 
 	if (evlist__apply_filters(evsel_list, &counter)) {
@@ -851,20 +860,23 @@
 		}
 
 		if (err < 0)
-			return err;
+			goto err_out;
 
 		err = perf_event__synthesize_stat_events(&stat_config, NULL, evsel_list,
 							 process_synthesized_event, is_pipe);
 		if (err < 0)
-			return err;
+			goto err_out;
+
 	}
 
 	if (target.initial_delay) {
 		pr_info(EVLIST_DISABLED_MSG);
 	} else {
 		err = enable_counters();
-		if (err)
-			return -1;
+		if (err) {
+			err = -1;
+			goto err_out;
+		}
 	}
 
 	/* Exec the command, if any */
@@ -874,8 +886,10 @@
 	if (target.initial_delay > 0) {
 		usleep(target.initial_delay * USEC_PER_MSEC);
 		err = enable_counters();
-		if (err)
-			return -1;
+		if (err) {
+			err = -1;
+			goto err_out;
+		}
 
 		pr_info(EVLIST_ENABLED_MSG);
 	}
@@ -895,7 +909,8 @@
 		if (workload_exec_errno) {
 			const char *emsg = str_error_r(workload_exec_errno, msg, sizeof(msg));
 			pr_err("Workload failed: %s\n", emsg);
-			return -1;
+			err = -1;
+			goto err_out;
 		}
 
 		if (WIFSIGNALED(status))
@@ -942,6 +957,13 @@
 		evlist__close(evsel_list);
 
 	return WEXITSTATUS(status);
+
+err_out:
+	if (forks)
+		evlist__cancel_workload(evsel_list);
+
+	affinity__cleanup(affinity);
+	return err;
 }
 
 static int run_perf_stat(int argc, const char **argv, int run_idx)
--- linux-qcom-6.8.0.orig/tools/perf/builtin-trace.c
+++ linux-qcom-6.8.0/tools/perf/builtin-trace.c
@@ -2414,6 +2414,7 @@
 	char msg[1024];
 	void *args, *augmented_args = NULL;
 	int augmented_args_size;
+	size_t printed = 0;
 
 	if (sc == NULL)
 		return -1;
@@ -2429,8 +2430,8 @@
 
 	args = perf_evsel__sc_tp_ptr(evsel, args, sample);
 	augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
-	syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread);
-	fprintf(trace->output, "%s", msg);
+	printed += syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread);
+	fprintf(trace->output, "%.*s", (int)printed, msg);
 	err = 0;
 out_put:
 	thread__put(thread);
@@ -2802,7 +2803,7 @@
 		printed += syscall_arg_fmt__scnprintf_val(arg, bf + printed, size - printed, &syscall_arg, val);
 	}
 
-	return printed + fprintf(trace->output, "%s", bf);
+	return printed + fprintf(trace->output, "%.*s", (int)printed, bf);
 }
 
 static int trace__event_handler(struct trace *trace, struct evsel *evsel,
@@ -2811,13 +2812,8 @@
 {
 	struct thread *thread;
 	int callchain_ret = 0;
-	/*
-	 * Check if we called perf_evsel__disable(evsel) due to, for instance,
-	 * this event's max_events having been hit and this is an entry coming
-	 * from the ring buffer that we should discard, since the max events
-	 * have already been considered/printed.
-	 */
-	if (evsel->disabled)
+
+	if (evsel->nr_events_printed >= evsel->max_events)
 		return 0;
 
 	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
@@ -3922,6 +3918,9 @@
 					sizeof(__u32), BPF_ANY);
 		}
 	}
+
+	if (trace->skel)
+		trace->filter_pids.map = trace->skel->maps.pids_filtered;
 #endif
 	err = trace__set_filter_pids(trace);
 	if (err < 0)
@@ -5029,6 +5028,10 @@
 	if (trace.summary_only)
 		trace.summary = trace.summary_only;
 
+	/* Keep exited threads, otherwise information might be lost for summary */
+	if (trace.summary)
+		symbol_conf.keep_exited_threads = true;
+
 	if (output_name != NULL) {
 		err = trace__open_output(&trace, output_name);
 		if (err < 0) {
--- linux-qcom-6.8.0.orig/tools/perf/pmu-events/arch/riscv/riscv-sbi-firmware.json
+++ linux-qcom-6.8.0/tools/perf/pmu-events/arch/riscv/riscv-sbi-firmware.json
@@ -74,7 +74,7 @@
   {
     "PublicDescription": "Sent SFENCE.VMA with ASID request to other HART event",
     "ConfigCode": "0x800000000000000c",
-    "EventName": "FW_SFENCE_VMA_RECEIVED",
+    "EventName": "FW_SFENCE_VMA_ASID_SENT",
     "BriefDescription": "Sent SFENCE.VMA with ASID request to other HART event"
   },
   {
--- linux-qcom-6.8.0.orig/tools/perf/pmu-events/arch/riscv/sifive/u74/firmware.json
+++ linux-qcom-6.8.0/tools/perf/pmu-events/arch/riscv/sifive/u74/firmware.json
@@ -36,7 +36,7 @@
     "ArchStdEvent": "FW_SFENCE_VMA_RECEIVED"
   },
   {
-    "ArchStdEvent": "FW_SFENCE_VMA_RECEIVED"
+    "ArchStdEvent": "FW_SFENCE_VMA_ASID_SENT"
   },
   {
     "ArchStdEvent": "FW_SFENCE_VMA_ASID_RECEIVED"
--- linux-qcom-6.8.0.orig/tools/perf/pmu-events/arch/riscv/starfive/dubhe-80/firmware.json
+++ linux-qcom-6.8.0/tools/perf/pmu-events/arch/riscv/starfive/dubhe-80/firmware.json
@@ -36,7 +36,7 @@
     "ArchStdEvent": "FW_SFENCE_VMA_RECEIVED"
   },
   {
-    "ArchStdEvent": "FW_SFENCE_VMA_RECEIVED"
+    "ArchStdEvent": "FW_SFENCE_VMA_ASID_SENT"
   },
   {
     "ArchStdEvent": "FW_SFENCE_VMA_ASID_RECEIVED"
--- linux-qcom-6.8.0.orig/tools/perf/pmu-events/arch/riscv/thead/c900-legacy/firmware.json
+++ linux-qcom-6.8.0/tools/perf/pmu-events/arch/riscv/thead/c900-legacy/firmware.json
@@ -36,7 +36,7 @@
     "ArchStdEvent": "FW_SFENCE_VMA_RECEIVED"
   },
   {
-    "ArchStdEvent": "FW_SFENCE_VMA_RECEIVED"
+    "ArchStdEvent": "FW_SFENCE_VMA_ASID_SENT"
   },
   {
     "ArchStdEvent": "FW_SFENCE_VMA_ASID_RECEIVED"
--- linux-qcom-6.8.0.orig/tools/perf/pmu-events/arch/s390/cf_z16/transaction.json
+++ linux-qcom-6.8.0/tools/perf/pmu-events/arch/s390/cf_z16/transaction.json
@@ -2,71 +2,71 @@
   {
     "BriefDescription": "Transaction count",
     "MetricName": "transaction",
-    "MetricExpr": "TX_C_TEND + TX_NC_TEND + TX_NC_TABORT + TX_C_TABORT_SPECIAL + TX_C_TABORT_NO_SPECIAL"
+    "MetricExpr": "TX_C_TEND + TX_NC_TEND + TX_NC_TABORT + TX_C_TABORT_SPECIAL + TX_C_TABORT_NO_SPECIAL if has_event(TX_C_TEND) else 0"
   },
   {
     "BriefDescription": "Cycles per Instruction",
     "MetricName": "cpi",
-    "MetricExpr": "CPU_CYCLES / INSTRUCTIONS"
+    "MetricExpr": "CPU_CYCLES / INSTRUCTIONS if has_event(INSTRUCTIONS) else 0"
   },
   {
     "BriefDescription": "Problem State Instruction Ratio",
     "MetricName": "prbstate",
-    "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100"
+    "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0"
   },
   {
     "BriefDescription": "Level One Miss per 100 Instructions",
     "MetricName": "l1mp",
-    "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100"
+    "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0"
   },
   {
     "BriefDescription": "Percentage sourced from Level 2 cache",
     "MetricName": "l2p",
-    "MetricExpr": "((DCW_REQ + DCW_REQ_IV + ICW_REQ + ICW_REQ_IV) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100"
+    "MetricExpr": "((DCW_REQ + DCW_REQ_IV + ICW_REQ + ICW_REQ_IV) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100 if has_event(DCW_REQ) else 0"
   },
   {
     "BriefDescription": "Percentage sourced from Level 3 on same chip cache",
     "MetricName": "l3p",
-    "MetricExpr": "((DCW_REQ_CHIP_HIT + DCW_ON_CHIP + DCW_ON_CHIP_IV + DCW_ON_CHIP_CHIP_HIT + ICW_REQ_CHIP_HIT + ICW_ON_CHIP + ICW_ON_CHIP_IV + ICW_ON_CHIP_CHIP_HIT) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100"
+    "MetricExpr": "((DCW_REQ_CHIP_HIT + DCW_ON_CHIP + DCW_ON_CHIP_IV + DCW_ON_CHIP_CHIP_HIT + ICW_REQ_CHIP_HIT + ICW_ON_CHIP + ICW_ON_CHIP_IV + ICW_ON_CHIP_CHIP_HIT) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100 if has_event(DCW_REQ_CHIP_HIT) else 0"
   },
   {
     "BriefDescription": "Percentage sourced from Level 4 Local cache on same book",
     "MetricName": "l4lp",
-    "MetricExpr": "((DCW_REQ_DRAWER_HIT + DCW_ON_CHIP_DRAWER_HIT + DCW_ON_MODULE + DCW_ON_DRAWER + IDCW_ON_MODULE_IV + IDCW_ON_MODULE_CHIP_HIT + IDCW_ON_MODULE_DRAWER_HIT + IDCW_ON_DRAWER_IV + IDCW_ON_DRAWER_CHIP_HIT + IDCW_ON_DRAWER_DRAWER_HIT + ICW_REQ_DRAWER_HIT + ICW_ON_CHIP_DRAWER_HIT + ICW_ON_MODULE + ICW_ON_DRAWER) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100"
+    "MetricExpr": "((DCW_REQ_DRAWER_HIT + DCW_ON_CHIP_DRAWER_HIT + DCW_ON_MODULE + DCW_ON_DRAWER + IDCW_ON_MODULE_IV + IDCW_ON_MODULE_CHIP_HIT + IDCW_ON_MODULE_DRAWER_HIT + IDCW_ON_DRAWER_IV + IDCW_ON_DRAWER_CHIP_HIT + IDCW_ON_DRAWER_DRAWER_HIT + ICW_REQ_DRAWER_HIT + ICW_ON_CHIP_DRAWER_HIT + ICW_ON_MODULE + ICW_ON_DRAWER) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100 if has_event(DCW_REQ_DRAWER_HIT) else 0"
   },
   {
     "BriefDescription": "Percentage sourced from Level 4 Remote cache on different book",
     "MetricName": "l4rp",
-    "MetricExpr": "((DCW_OFF_DRAWER + IDCW_OFF_DRAWER_IV + IDCW_OFF_DRAWER_CHIP_HIT + IDCW_OFF_DRAWER_DRAWER_HIT + ICW_OFF_DRAWER) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100"
+    "MetricExpr": "((DCW_OFF_DRAWER + IDCW_OFF_DRAWER_IV + IDCW_OFF_DRAWER_CHIP_HIT + IDCW_OFF_DRAWER_DRAWER_HIT + ICW_OFF_DRAWER) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100 if has_event(DCW_OFF_DRAWER) else 0"
   },
   {
     "BriefDescription": "Percentage sourced from memory",
     "MetricName": "memp",
-    "MetricExpr": "((DCW_ON_CHIP_MEMORY + DCW_ON_MODULE_MEMORY + DCW_ON_DRAWER_MEMORY + DCW_OFF_DRAWER_MEMORY + ICW_ON_CHIP_MEMORY + ICW_ON_MODULE_MEMORY + ICW_ON_DRAWER_MEMORY + ICW_OFF_DRAWER_MEMORY) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100"
+    "MetricExpr": "((DCW_ON_CHIP_MEMORY + DCW_ON_MODULE_MEMORY + DCW_ON_DRAWER_MEMORY + DCW_OFF_DRAWER_MEMORY + ICW_ON_CHIP_MEMORY + ICW_ON_MODULE_MEMORY + ICW_ON_DRAWER_MEMORY + ICW_OFF_DRAWER_MEMORY) / (L1I_DIR_WRITES + L1D_DIR_WRITES)) * 100 if has_event(DCW_ON_CHIP_MEMORY) else 0"
   },
   {
     "BriefDescription": "Cycles per Instructions from Finite cache/memory",
     "MetricName": "finite_cpi",
-    "MetricExpr": "L1C_TLB2_MISSES / INSTRUCTIONS"
+    "MetricExpr": "L1C_TLB2_MISSES / INSTRUCTIONS if has_event(L1C_TLB2_MISSES) else 0"
   },
   {
     "BriefDescription": "Estimated Instruction Complexity CPI infinite Level 1",
     "MetricName": "est_cpi",
-    "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS)"
+    "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS) if has_event(INSTRUCTIONS) else 0"
   },
   {
     "BriefDescription": "Estimated Sourcing Cycles per Level 1 Miss",
     "MetricName": "scpl1m",
-    "MetricExpr": "L1C_TLB2_MISSES / (L1I_DIR_WRITES + L1D_DIR_WRITES)"
+    "MetricExpr": "L1C_TLB2_MISSES / (L1I_DIR_WRITES + L1D_DIR_WRITES) if has_event(L1C_TLB2_MISSES) else 0"
   },
   {
     "BriefDescription": "Estimated TLB CPU percentage of Total CPU",
     "MetricName": "tlb_percent",
-    "MetricExpr": "((DTLB2_MISSES + ITLB2_MISSES) / CPU_CYCLES) * (L1C_TLB2_MISSES / (L1I_PENALTY_CYCLES + L1D_PENALTY_CYCLES)) * 100"
+    "MetricExpr": "((DTLB2_MISSES + ITLB2_MISSES) / CPU_CYCLES) * (L1C_TLB2_MISSES / (L1I_PENALTY_CYCLES + L1D_PENALTY_CYCLES)) * 100 if has_event(CPU_CYCLES) else 0"
   },
   {
     "BriefDescription": "Estimated Cycles per TLB Miss",
     "MetricName": "tlb_miss",
-    "MetricExpr": "((DTLB2_MISSES + ITLB2_MISSES) / (DTLB2_WRITES + ITLB2_WRITES)) * (L1C_TLB2_MISSES / (L1I_PENALTY_CYCLES + L1D_PENALTY_CYCLES))"
+    "MetricExpr": "((DTLB2_MISSES + ITLB2_MISSES) / (DTLB2_WRITES + ITLB2_WRITES)) * (L1C_TLB2_MISSES / (L1I_PENALTY_CYCLES + L1D_PENALTY_CYCLES)) if has_event(DTLB2_MISSES) else 0"
   }
 ]
--- linux-qcom-6.8.0.orig/tools/perf/pmu-events/arch/s390/mapfile.csv
+++ linux-qcom-6.8.0/tools/perf/pmu-events/arch/s390/mapfile.csv
@@ -5,4 +5,4 @@
 ^IBM.296[45].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z13,core
 ^IBM.390[67].*[13]\.[1-5].[[:xdigit:]]+$,3,cf_z14,core
 ^IBM.856[12].*3\.6.[[:xdigit:]]+$,3,cf_z15,core
-^IBM.393[12].*3\.7.[[:xdigit:]]+$,3,cf_z16,core
+^IBM.393[12].*$,3,cf_z16,core
--- linux-qcom-6.8.0.orig/tools/perf/pmu-events/arch/x86/amdzen4/cache.json
+++ linux-qcom-6.8.0/tools/perf/pmu-events/arch/x86/amdzen4/cache.json
@@ -676,6 +676,10 @@
     "EventCode": "0xac",
     "BriefDescription": "Average sampled latency when data is sourced from DRAM in the same NUMA node.",
     "UMask": "0x01",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -683,6 +687,10 @@
     "EventCode": "0xac",
     "BriefDescription": "Average sampled latency when data is sourced from DRAM in a different NUMA node.",
     "UMask": "0x02",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -690,6 +698,10 @@
     "EventCode": "0xac",
     "BriefDescription": "Average sampled latency when data is sourced from another CCX's cache when the address was in the same NUMA node.",
     "UMask": "0x04",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -697,6 +709,10 @@
     "EventCode": "0xac",
     "BriefDescription": "Average sampled latency when data is sourced from another CCX's cache when the address was in a different NUMA node.",
     "UMask": "0x08",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -704,6 +720,10 @@
     "EventCode": "0xac",
     "BriefDescription": "Average sampled latency when data is sourced from extension memory (CXL) in the same NUMA node.",
     "UMask": "0x10",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -711,6 +731,10 @@
     "EventCode": "0xac",
     "BriefDescription": "Average sampled latency when data is sourced from extension memory (CXL) in a different NUMA node.",
     "UMask": "0x20",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -718,6 +742,10 @@
     "EventCode": "0xac",
     "BriefDescription": "Average sampled latency from all data sources.",
     "UMask": "0x3f",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -725,6 +753,10 @@
     "EventCode": "0xad",
     "BriefDescription": "L3 cache fill requests sourced from DRAM in the same NUMA node.",
     "UMask": "0x01",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -732,6 +764,10 @@
     "EventCode": "0xad",
     "BriefDescription": "L3 cache fill requests sourced from DRAM in a different NUMA node.",
     "UMask": "0x02",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -739,6 +775,10 @@
     "EventCode": "0xad",
     "BriefDescription": "L3 cache fill requests sourced from another CCX's cache when the address was in the same NUMA node.",
     "UMask": "0x04",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -746,6 +786,10 @@
     "EventCode": "0xad",
     "BriefDescription": "L3 cache fill requests sourced from another CCX's cache when the address was in a different NUMA node.",
     "UMask": "0x08",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -753,6 +797,10 @@
     "EventCode": "0xad",
     "BriefDescription": "L3 cache fill requests sourced from extension memory (CXL) in the same NUMA node.",
     "UMask": "0x10",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -760,6 +808,10 @@
     "EventCode": "0xad",
     "BriefDescription": "L3 cache fill requests sourced from extension memory (CXL) in a different NUMA node.",
     "UMask": "0x20",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   },
   {
@@ -767,6 +819,10 @@
     "EventCode": "0xad",
     "BriefDescription": "L3 cache fill requests sourced from all data sources.",
     "UMask": "0x3f",
+    "EnAllCores": "0x1",
+    "EnAllSlices": "0x1",
+    "SliceId": "0x3",
+    "ThreadMask": "0x3",
     "Unit": "L3PMC"
   }
 ]
--- linux-qcom-6.8.0.orig/tools/perf/pmu-events/jevents.py
+++ linux-qcom-6.8.0/tools/perf/pmu-events/jevents.py
@@ -356,6 +356,10 @@
         ('UMask', 'umask='),
         ('NodeType', 'type='),
         ('RdWrMask', 'rdwrmask='),
+        ('EnAllCores', 'enallcores='),
+        ('EnAllSlices', 'enallslices='),
+        ('SliceId', 'sliceid='),
+        ('ThreadMask', 'threadmask='),
     ]
     for key, value in event_fields:
       if key in jd and jd[key] != '0':
@@ -901,7 +905,7 @@
                         continue;
 
                 ret = pmu_events_table__for_each_event_pmu(table, table_pmu, fn, data);
-                if (pmu || ret)
+                if (ret)
                         return ret;
         }
         return 0;
--- linux-qcom-6.8.0.orig/tools/perf/scripts/python/arm-cs-trace-disasm.py
+++ linux-qcom-6.8.0/tools/perf/scripts/python/arm-cs-trace-disasm.py
@@ -192,17 +192,16 @@
 	ip = sample["ip"]
 	addr = sample["addr"]
 
+	if (options.verbose == True):
+		print("Event type: %s" % name)
+		print_sample(sample)
+
 	# Initialize CPU data if it's empty, and directly return back
 	# if this is the first tracing event for this CPU.
 	if (cpu_data.get(str(cpu) + 'addr') == None):
 		cpu_data[str(cpu) + 'addr'] = addr
 		return
 
-
-	if (options.verbose == True):
-		print("Event type: %s" % name)
-		print_sample(sample)
-
 	# If cannot find dso so cannot dump assembler, bail out
 	if (dso == '[unknown]'):
 		return
--- linux-qcom-6.8.0.orig/tools/perf/tests/attr/test-stat-default
+++ linux-qcom-6.8.0/tools/perf/tests/attr/test-stat-default
@@ -88,98 +88,142 @@
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
+# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
 [event13:base-stat]
 fd=13
 group_fd=11
 type=4
-config=33280
+config=33024
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-be-bound (0x8300)
+# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
 [event14:base-stat]
 fd=14
 group_fd=11
 type=4
-config=33536
+config=33280
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
+# PERF_TYPE_RAW / topdown-be-bound (0x8300)
 [event15:base-stat]
 fd=15
 group_fd=11
 type=4
-config=33024
+config=33536
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
+# PERF_TYPE_RAW / topdown-heavy-ops (0x8400)
 [event16:base-stat]
 fd=16
+group_fd=11
 type=4
-config=4109
+config=33792
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
+# PERF_TYPE_RAW / topdown-br-mispredict (0x8500)
 [event17:base-stat]
 fd=17
+group_fd=11
 type=4
-config=17039629
+config=34048
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
+# PERF_TYPE_RAW / topdown-fetch-lat (0x8600)
 [event18:base-stat]
 fd=18
+group_fd=11
 type=4
-config=60
+config=34304
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
+# PERF_TYPE_RAW / topdown-mem-bound (0x8700)
 [event19:base-stat]
 fd=19
+group_fd=11
 type=4
-config=2097421
+config=34560
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
+# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
 [event20:base-stat]
 fd=20
 type=4
-config=316
+config=4109
 optional=1
 
-# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
+# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
 [event21:base-stat]
 fd=21
 type=4
-config=412
+config=17039629
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
 [event22:base-stat]
 fd=22
 type=4
-config=572
+config=60
 optional=1
 
-# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
+# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
 [event23:base-stat]
 fd=23
 type=4
-config=706
+config=2097421
 optional=1
 
-# PERF_TYPE_RAW / UOPS_ISSUED.ANY
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
 [event24:base-stat]
 fd=24
 type=4
+config=316
+optional=1
+
+# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
+[event25:base-stat]
+fd=25
+type=4
+config=412
+optional=1
+
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
+[event26:base-stat]
+fd=26
+type=4
+config=572
+optional=1
+
+# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
+[event27:base-stat]
+fd=27
+type=4
+config=706
+optional=1
+
+# PERF_TYPE_RAW / UOPS_ISSUED.ANY
+[event28:base-stat]
+fd=28
+type=4
 config=270
 optional=1
--- linux-qcom-6.8.0.orig/tools/perf/tests/attr/test-stat-detailed-1
+++ linux-qcom-6.8.0/tools/perf/tests/attr/test-stat-detailed-1
@@ -90,99 +90,143 @@
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
+# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
 [event13:base-stat]
 fd=13
 group_fd=11
 type=4
-config=33280
+config=33024
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-be-bound (0x8300)
+# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
 [event14:base-stat]
 fd=14
 group_fd=11
 type=4
-config=33536
+config=33280
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
+# PERF_TYPE_RAW / topdown-be-bound (0x8300)
 [event15:base-stat]
 fd=15
 group_fd=11
 type=4
-config=33024
+config=33536
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
+# PERF_TYPE_RAW / topdown-heavy-ops (0x8400)
 [event16:base-stat]
 fd=16
+group_fd=11
 type=4
-config=4109
+config=33792
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
+# PERF_TYPE_RAW / topdown-br-mispredict (0x8500)
 [event17:base-stat]
 fd=17
+group_fd=11
 type=4
-config=17039629
+config=34048
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
+# PERF_TYPE_RAW / topdown-fetch-lat (0x8600)
 [event18:base-stat]
 fd=18
+group_fd=11
 type=4
-config=60
+config=34304
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
+# PERF_TYPE_RAW / topdown-mem-bound (0x8700)
 [event19:base-stat]
 fd=19
+group_fd=11
 type=4
-config=2097421
+config=34560
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
+# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
 [event20:base-stat]
 fd=20
 type=4
-config=316
+config=4109
 optional=1
 
-# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
+# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
 [event21:base-stat]
 fd=21
 type=4
-config=412
+config=17039629
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
 [event22:base-stat]
 fd=22
 type=4
-config=572
+config=60
 optional=1
 
-# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
+# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
 [event23:base-stat]
 fd=23
 type=4
-config=706
+config=2097421
 optional=1
 
-# PERF_TYPE_RAW / UOPS_ISSUED.ANY
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
 [event24:base-stat]
 fd=24
 type=4
+config=316
+optional=1
+
+# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
+[event25:base-stat]
+fd=25
+type=4
+config=412
+optional=1
+
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
+[event26:base-stat]
+fd=26
+type=4
+config=572
+optional=1
+
+# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
+[event27:base-stat]
+fd=27
+type=4
+config=706
+optional=1
+
+# PERF_TYPE_RAW / UOPS_ISSUED.ANY
+[event28:base-stat]
+fd=28
+type=4
 config=270
 optional=1
 
@@ -190,8 +234,8 @@
 #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event25:base-stat]
-fd=25
+[event29:base-stat]
+fd=29
 type=3
 config=0
 optional=1
@@ -200,8 +244,8 @@
 #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event26:base-stat]
-fd=26
+[event30:base-stat]
+fd=30
 type=3
 config=65536
 optional=1
@@ -210,8 +254,8 @@
 #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event27:base-stat]
-fd=27
+[event31:base-stat]
+fd=31
 type=3
 config=2
 optional=1
@@ -220,8 +264,8 @@
 #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event28:base-stat]
-fd=28
+[event32:base-stat]
+fd=32
 type=3
 config=65538
 optional=1
--- linux-qcom-6.8.0.orig/tools/perf/tests/attr/test-stat-detailed-2
+++ linux-qcom-6.8.0/tools/perf/tests/attr/test-stat-detailed-2
@@ -90,99 +90,143 @@
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
+# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
 [event13:base-stat]
 fd=13
 group_fd=11
 type=4
-config=33280
+config=33024
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-be-bound (0x8300)
+# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
 [event14:base-stat]
 fd=14
 group_fd=11
 type=4
-config=33536
+config=33280
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
+# PERF_TYPE_RAW / topdown-be-bound (0x8300)
 [event15:base-stat]
 fd=15
 group_fd=11
 type=4
-config=33024
+config=33536
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
+# PERF_TYPE_RAW / topdown-heavy-ops (0x8400)
 [event16:base-stat]
 fd=16
+group_fd=11
 type=4
-config=4109
+config=33792
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
+# PERF_TYPE_RAW / topdown-br-mispredict (0x8500)
 [event17:base-stat]
 fd=17
+group_fd=11
 type=4
-config=17039629
+config=34048
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
+# PERF_TYPE_RAW / topdown-fetch-lat (0x8600)
 [event18:base-stat]
 fd=18
+group_fd=11
 type=4
-config=60
+config=34304
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
+# PERF_TYPE_RAW / topdown-mem-bound (0x8700)
 [event19:base-stat]
 fd=19
+group_fd=11
 type=4
-config=2097421
+config=34560
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
+# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
 [event20:base-stat]
 fd=20
 type=4
-config=316
+config=4109
 optional=1
 
-# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
+# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
 [event21:base-stat]
 fd=21
 type=4
-config=412
+config=17039629
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
 [event22:base-stat]
 fd=22
 type=4
-config=572
+config=60
 optional=1
 
-# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
+# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
 [event23:base-stat]
 fd=23
 type=4
-config=706
+config=2097421
 optional=1
 
-# PERF_TYPE_RAW / UOPS_ISSUED.ANY
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
 [event24:base-stat]
 fd=24
 type=4
+config=316
+optional=1
+
+# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
+[event25:base-stat]
+fd=25
+type=4
+config=412
+optional=1
+
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
+[event26:base-stat]
+fd=26
+type=4
+config=572
+optional=1
+
+# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
+[event27:base-stat]
+fd=27
+type=4
+config=706
+optional=1
+
+# PERF_TYPE_RAW / UOPS_ISSUED.ANY
+[event28:base-stat]
+fd=28
+type=4
 config=270
 optional=1
 
@@ -190,8 +234,8 @@
 #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event25:base-stat]
-fd=25
+[event29:base-stat]
+fd=29
 type=3
 config=0
 optional=1
@@ -200,8 +244,8 @@
 #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event26:base-stat]
-fd=26
+[event30:base-stat]
+fd=30
 type=3
 config=65536
 optional=1
@@ -210,8 +254,8 @@
 #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event27:base-stat]
-fd=27
+[event31:base-stat]
+fd=31
 type=3
 config=2
 optional=1
@@ -220,8 +264,8 @@
 #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event28:base-stat]
-fd=28
+[event32:base-stat]
+fd=32
 type=3
 config=65538
 optional=1
@@ -230,8 +274,8 @@
 #  PERF_COUNT_HW_CACHE_L1I                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event29:base-stat]
-fd=29
+[event33:base-stat]
+fd=33
 type=3
 config=1
 optional=1
@@ -240,8 +284,8 @@
 #  PERF_COUNT_HW_CACHE_L1I                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event30:base-stat]
-fd=30
+[event34:base-stat]
+fd=34
 type=3
 config=65537
 optional=1
@@ -250,8 +294,8 @@
 #  PERF_COUNT_HW_CACHE_DTLB               <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event31:base-stat]
-fd=31
+[event35:base-stat]
+fd=35
 type=3
 config=3
 optional=1
@@ -260,8 +304,8 @@
 #  PERF_COUNT_HW_CACHE_DTLB               <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event32:base-stat]
-fd=32
+[event36:base-stat]
+fd=36
 type=3
 config=65539
 optional=1
@@ -270,8 +314,8 @@
 #  PERF_COUNT_HW_CACHE_ITLB               <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event33:base-stat]
-fd=33
+[event37:base-stat]
+fd=37
 type=3
 config=4
 optional=1
@@ -280,8 +324,8 @@
 #  PERF_COUNT_HW_CACHE_ITLB               <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event34:base-stat]
-fd=34
+[event38:base-stat]
+fd=38
 type=3
 config=65540
 optional=1
--- linux-qcom-6.8.0.orig/tools/perf/tests/attr/test-stat-detailed-3
+++ linux-qcom-6.8.0/tools/perf/tests/attr/test-stat-detailed-3
@@ -90,99 +90,143 @@
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
+# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
 [event13:base-stat]
 fd=13
 group_fd=11
 type=4
-config=33280
+config=33024
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-be-bound (0x8300)
+# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
 [event14:base-stat]
 fd=14
 group_fd=11
 type=4
-config=33536
+config=33280
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
+# PERF_TYPE_RAW / topdown-be-bound (0x8300)
 [event15:base-stat]
 fd=15
 group_fd=11
 type=4
-config=33024
+config=33536
 disabled=0
 enable_on_exec=0
 read_format=15
 optional=1
 
-# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
+# PERF_TYPE_RAW / topdown-heavy-ops (0x8400)
 [event16:base-stat]
 fd=16
+group_fd=11
 type=4
-config=4109
+config=33792
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
+# PERF_TYPE_RAW / topdown-br-mispredict (0x8500)
 [event17:base-stat]
 fd=17
+group_fd=11
 type=4
-config=17039629
+config=34048
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
+# PERF_TYPE_RAW / topdown-fetch-lat (0x8600)
 [event18:base-stat]
 fd=18
+group_fd=11
 type=4
-config=60
+config=34304
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
+# PERF_TYPE_RAW / topdown-mem-bound (0x8700)
 [event19:base-stat]
 fd=19
+group_fd=11
 type=4
-config=2097421
+config=34560
+disabled=0
+enable_on_exec=0
+read_format=15
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
+# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
 [event20:base-stat]
 fd=20
 type=4
-config=316
+config=4109
 optional=1
 
-# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
+# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
 [event21:base-stat]
 fd=21
 type=4
-config=412
+config=17039629
 optional=1
 
-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
 [event22:base-stat]
 fd=22
 type=4
-config=572
+config=60
 optional=1
 
-# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
+# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
 [event23:base-stat]
 fd=23
 type=4
-config=706
+config=2097421
 optional=1
 
-# PERF_TYPE_RAW / UOPS_ISSUED.ANY
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
 [event24:base-stat]
 fd=24
 type=4
+config=316
+optional=1
+
+# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
+[event25:base-stat]
+fd=25
+type=4
+config=412
+optional=1
+
+# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
+[event26:base-stat]
+fd=26
+type=4
+config=572
+optional=1
+
+# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
+[event27:base-stat]
+fd=27
+type=4
+config=706
+optional=1
+
+# PERF_TYPE_RAW / UOPS_ISSUED.ANY
+[event28:base-stat]
+fd=28
+type=4
 config=270
 optional=1
 
@@ -190,8 +234,8 @@
 #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event25:base-stat]
-fd=25
+[event29:base-stat]
+fd=29
 type=3
 config=0
 optional=1
@@ -200,8 +244,8 @@
 #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event26:base-stat]
-fd=26
+[event30:base-stat]
+fd=30
 type=3
 config=65536
 optional=1
@@ -210,8 +254,8 @@
 #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event27:base-stat]
-fd=27
+[event31:base-stat]
+fd=31
 type=3
 config=2
 optional=1
@@ -220,8 +264,8 @@
 #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event28:base-stat]
-fd=28
+[event32:base-stat]
+fd=32
 type=3
 config=65538
 optional=1
@@ -230,8 +274,8 @@
 #  PERF_COUNT_HW_CACHE_L1I                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event29:base-stat]
-fd=29
+[event33:base-stat]
+fd=33
 type=3
 config=1
 optional=1
@@ -240,8 +284,8 @@
 #  PERF_COUNT_HW_CACHE_L1I                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event30:base-stat]
-fd=30
+[event34:base-stat]
+fd=34
 type=3
 config=65537
 optional=1
@@ -250,8 +294,8 @@
 #  PERF_COUNT_HW_CACHE_DTLB               <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event31:base-stat]
-fd=31
+[event35:base-stat]
+fd=35
 type=3
 config=3
 optional=1
@@ -260,8 +304,8 @@
 #  PERF_COUNT_HW_CACHE_DTLB               <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event32:base-stat]
-fd=32
+[event36:base-stat]
+fd=36
 type=3
 config=65539
 optional=1
@@ -270,8 +314,8 @@
 #  PERF_COUNT_HW_CACHE_ITLB               <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event33:base-stat]
-fd=33
+[event37:base-stat]
+fd=37
 type=3
 config=4
 optional=1
@@ -280,8 +324,8 @@
 #  PERF_COUNT_HW_CACHE_ITLB               <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event34:base-stat]
-fd=34
+[event38:base-stat]
+fd=38
 type=3
 config=65540
 optional=1
@@ -290,8 +334,8 @@
 #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_PREFETCH        <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
-[event35:base-stat]
-fd=35
+[event39:base-stat]
+fd=39
 type=3
 config=512
 optional=1
@@ -300,8 +344,8 @@
 #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
 # (PERF_COUNT_HW_CACHE_OP_PREFETCH        <<  8) |
 # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
-[event36:base-stat]
-fd=36
+[event40:base-stat]
+fd=40
 type=3
 config=66048
 optional=1
--- linux-qcom-6.8.0.orig/tools/perf/tests/code-reading.c
+++ linux-qcom-6.8.0/tools/perf/tests/code-reading.c
@@ -637,11 +637,11 @@
 
 		evlist__config(evlist, &opts, NULL);
 
-		evsel = evlist__first(evlist);
-
-		evsel->core.attr.comm = 1;
-		evsel->core.attr.disabled = 1;
-		evsel->core.attr.enable_on_exec = 0;
+		evlist__for_each_entry(evlist, evsel) {
+			evsel->core.attr.comm = 1;
+			evsel->core.attr.disabled = 1;
+			evsel->core.attr.enable_on_exec = 0;
+		}
 
 		ret = evlist__open(evlist);
 		if (ret < 0) {
--- linux-qcom-6.8.0.orig/tools/perf/tests/maps.c
+++ linux-qcom-6.8.0/tools/perf/tests/maps.c
@@ -156,6 +156,9 @@
 	TEST_ASSERT_VAL("merge check failed", !ret);
 
 	maps__zput(maps);
+	map__zput(map_kcore1);
+	map__zput(map_kcore2);
+	map__zput(map_kcore3);
 	return TEST_OK;
 }
 
--- linux-qcom-6.8.0.orig/tools/perf/tests/shell/test_arm_callgraph_fp.sh
+++ linux-qcom-6.8.0/tools/perf/tests/shell/test_arm_callgraph_fp.sh
@@ -20,28 +20,21 @@
 
 trap cleanup_files EXIT TERM INT
 
-# Add a 1 second delay to skip samples that are not in the leaf() function
 # shellcheck disable=SC2086
-perf record -o "$PERF_DATA" --call-graph fp -e cycles//u -D 1000 --user-callchains -- $TEST_PROGRAM 2> /dev/null &
-PID=$!
+perf record -o "$PERF_DATA" --call-graph fp -e cycles//u --user-callchains -- $TEST_PROGRAM
 
-echo " + Recording (PID=$PID)..."
-sleep 2
-echo " + Stopping perf-record..."
-
-kill $PID
-wait $PID
+# Try opening the file so any immediate errors are visible in the log
+perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4
 
-# expected perf-script output:
+# expected perf-script output if 'leaf' has been inserted correctly:
 #
-# program
+# perf
 # 	728 leaf
 # 	753 parent
 # 	76c leafloop
-# ...
+# ... remaining stack to main() ...
 
-perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4
-perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4 | \
-	awk '{ if ($2 != "") sym[i++] = $2 } END { if (sym[0] != "leaf" ||
-						       sym[1] != "parent" ||
-						       sym[2] != "leafloop") exit 1 }'
+# Each frame is separated by a tab, some spaces and an address
+SEP="[[:space:]]+ [[:xdigit:]]+"
+perf script -i "$PERF_DATA" -F comm,ip,sym | tr '\n' ' ' | \
+	grep -E -q "perf $SEP leaf $SEP parent $SEP leafloop"
--- linux-qcom-6.8.0.orig/tools/perf/tests/shell/test_arm_coresight.sh
+++ linux-qcom-6.8.0/tools/perf/tests/shell/test_arm_coresight.sh
@@ -188,7 +188,7 @@
 
 arm_cs_etm_basic_test() {
 	echo "Recording trace with '$*'"
-	perf record -o ${perfdata} "$@" -- ls > /dev/null 2>&1
+	perf record -o ${perfdata} "$@" -m,8M -- ls > /dev/null 2>&1
 
 	perf_script_branch_samples ls &&
 	perf_report_branch_samples ls &&
--- linux-qcom-6.8.0.orig/tools/perf/tests/vmlinux-kallsyms.c
+++ linux-qcom-6.8.0/tools/perf/tests/vmlinux-kallsyms.c
@@ -26,7 +26,6 @@
 		 * when --all-symbols is specified so exclude them to get a
 		 * stable symbol list.
 		 */
-		"kallsyms_addresses",
 		"kallsyms_offsets",
 		"kallsyms_relative_base",
 		"kallsyms_num_syms",
--- linux-qcom-6.8.0.orig/tools/perf/tests/workloads/datasym.c
+++ linux-qcom-6.8.0/tools/perf/tests/workloads/datasym.c
@@ -16,6 +16,22 @@
 {
 	for (;;) {
 		buf1.data1++;
+		if (buf1.data1 == 123) {
+			/*
+			 * Add some 'noise' in the loop to work around errata
+			 * 1694299 on Arm N1.
+			 *
+			 * Bias exists in SPE sampling which can cause the load
+			 * and store instructions to be skipped entirely. This
+			 * comes and goes randomly depending on the offset the
+			 * linker places the datasym loop at in the Perf binary.
+			 * With an extra branch in the middle of the loop that
+			 * isn't always taken, the instruction stream is no
+			 * longer a continuous repeating pattern that interacts
+			 * badly with the bias.
+			 */
+			buf1.data1++;
+		}
 		buf1.data2 += buf1.data1;
 	}
 	return 0;
--- linux-qcom-6.8.0.orig/tools/perf/tests/workloads/leafloop.c
+++ linux-qcom-6.8.0/tools/perf/tests/workloads/leafloop.c
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: GPL-2.0 */
+#include <signal.h>
 #include <stdlib.h>
 #include <linux/compiler.h>
+#include <unistd.h>
 #include "../tests.h"
 
 /* We want to check these symbols in perf script */
@@ -8,10 +10,16 @@
 noinline void parent(volatile int b);
 
 static volatile int a;
+static volatile sig_atomic_t done;
+
+static void sighandler(int sig __maybe_unused)
+{
+	done = 1;
+}
 
 noinline void leaf(volatile int b)
 {
-	for (;;)
+	while (!done)
 		a += b;
 }
 
@@ -22,12 +30,16 @@
 
 static int leafloop(int argc, const char **argv)
 {
-	int c = 1;
+	int sec = 1;
 
 	if (argc > 0)
-		c = atoi(argv[0]);
+		sec = atoi(argv[0]);
+
+	signal(SIGINT, sighandler);
+	signal(SIGALRM, sighandler);
+	alarm(sec);
 
-	parent(c);
+	parent(sec);
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/tools/perf/ui/browser.c
+++ linux-qcom-6.8.0/tools/perf/ui/browser.c
@@ -203,7 +203,7 @@
 void ui_browser__handle_resize(struct ui_browser *browser)
 {
 	ui__refresh_dimensions(false);
-	ui_browser__show(browser, browser->title, ui_helpline__current);
+	ui_browser__show(browser, browser->title ?: "", ui_helpline__current);
 	ui_browser__refresh(browser);
 }
 
@@ -287,7 +287,8 @@
 	mutex_lock(&ui__lock);
 	__ui_browser__show_title(browser, title);
 
-	browser->title = title;
+	free(browser->title);
+	browser->title = strdup(title);
 	zfree(&browser->helpline);
 
 	va_start(ap, helpline);
@@ -304,6 +305,7 @@
 	mutex_lock(&ui__lock);
 	ui_helpline__pop();
 	zfree(&browser->helpline);
+	zfree(&browser->title);
 	mutex_unlock(&ui__lock);
 }
 
--- linux-qcom-6.8.0.orig/tools/perf/ui/browser.h
+++ linux-qcom-6.8.0/tools/perf/ui/browser.h
@@ -21,7 +21,7 @@
 	u8	      extra_title_lines;
 	int	      current_color;
 	void	      *priv;
-	const char    *title;
+	char	      *title;
 	char	      *helpline;
 	const char    *no_samples_msg;
 	void 	      (*refresh_dimensions)(struct ui_browser *browser);
--- linux-qcom-6.8.0.orig/tools/perf/ui/browsers/annotate.c
+++ linux-qcom-6.8.0/tools/perf/ui/browsers/annotate.c
@@ -970,7 +970,7 @@
 	if (dso->annotate_warned)
 		return -1;
 
-	if (not_annotated) {
+	if (not_annotated || !sym->annotate2) {
 		err = symbol__annotate2(ms, evsel, &browser.arch);
 		if (err) {
 			char msg[BUFSIZ];
--- linux-qcom-6.8.0.orig/tools/perf/util/annotate.c
+++ linux-qcom-6.8.0/tools/perf/util/annotate.c
@@ -2435,6 +2435,9 @@
 	if (parch)
 		*parch = arch;
 
+	if (!list_empty(&notes->src->source))
+		return 0;
+
 	args.arch = arch;
 	args.ms = *ms;
 	if (annotate_opts.full_addr)
@@ -2985,7 +2988,7 @@
 	annotation__update_column_widths(notes);
 }
 
-static void annotation__calc_lines(struct annotation *notes, struct map *map,
+static void annotation__calc_lines(struct annotation *notes, struct map_symbol *ms,
 				   struct rb_root *root)
 {
 	struct annotation_line *al;
@@ -2993,6 +2996,7 @@
 
 	list_for_each_entry(al, &notes->src->source, node) {
 		double percent_max = 0.0;
+		u64 addr;
 		int i;
 
 		for (i = 0; i < al->data_nr; i++) {
@@ -3008,8 +3012,9 @@
 		if (percent_max <= 0.5)
 			continue;
 
-		al->path = get_srcline(map__dso(map), notes->start + al->offset, NULL,
-				       false, true, notes->start + al->offset);
+		addr = map__rip_2objdump(ms->map, ms->sym->start);
+		al->path = get_srcline(map__dso(ms->map), addr + al->offset, NULL,
+				       false, true, ms->sym->start + al->offset);
 		insert_source_line(&tmp_root, al);
 	}
 
@@ -3020,7 +3025,7 @@
 {
 	struct annotation *notes = symbol__annotation(ms->sym);
 
-	annotation__calc_lines(notes, ms->map, root);
+	annotation__calc_lines(notes, ms, root);
 }
 
 int symbol__tty_annotate2(struct map_symbol *ms, struct evsel *evsel)
--- linux-qcom-6.8.0.orig/tools/perf/util/auxtrace.c
+++ linux-qcom-6.8.0/tools/perf/util/auxtrace.c
@@ -1466,6 +1466,7 @@
 	char *endptr;
 	bool period_type_set = false;
 	bool period_set = false;
+	bool iy = false;
 
 	synth_opts->set = true;
 
@@ -1484,6 +1485,7 @@
 		switch (*p++) {
 		case 'i':
 		case 'y':
+			iy = true;
 			if (p[-1] == 'y')
 				synth_opts->cycles = true;
 			else
@@ -1649,7 +1651,7 @@
 		}
 	}
 out:
-	if (synth_opts->instructions || synth_opts->cycles) {
+	if (iy) {
 		if (!period_type_set)
 			synth_opts->period_type =
 					PERF_ITRACE_DEFAULT_PERIOD_TYPE;
--- linux-qcom-6.8.0.orig/tools/perf/util/bpf_skel/lock_contention.bpf.c
+++ linux-qcom-6.8.0/tools/perf/util/bpf_skel/lock_contention.bpf.c
@@ -289,6 +289,7 @@
 	struct task_struct *curr;
 	struct mm_struct___old *mm_old;
 	struct mm_struct___new *mm_new;
+	struct sighand_struct *sighand;
 
 	switch (flags) {
 	case LCB_F_READ:  /* rwsem */
@@ -310,7 +311,9 @@
 		break;
 	case LCB_F_SPIN:  /* spinlock */
 		curr = bpf_get_current_task_btf();
-		if (&curr->sighand->siglock == (void *)lock)
+		sighand = curr->sighand;
+
+		if (sighand && &sighand->siglock == (void *)lock)
 			return LCD_F_SIGHAND_LOCK;
 		break;
 	default:
--- linux-qcom-6.8.0.orig/tools/perf/util/bpf_skel/lock_data.h
+++ linux-qcom-6.8.0/tools/perf/util/bpf_skel/lock_data.h
@@ -4,7 +4,7 @@
 #define UTIL_BPF_SKEL_LOCK_DATA_H
 
 struct contention_key {
-	u32 stack_id;
+	s32 stack_id;
 	u32 pid;
 	u64 lock_addr_or_cgroup;
 };
--- linux-qcom-6.8.0.orig/tools/perf/util/bpf_skel/vmlinux/vmlinux.h
+++ linux-qcom-6.8.0/tools/perf/util/bpf_skel/vmlinux/vmlinux.h
@@ -15,6 +15,7 @@
 
 typedef __u8 u8;
 typedef __u32 u32;
+typedef __s32 s32;
 typedef __u64 u64;
 typedef __s64 s64;
 
--- linux-qcom-6.8.0.orig/tools/perf/util/callchain.c
+++ linux-qcom-6.8.0/tools/perf/util/callchain.c
@@ -1141,7 +1141,7 @@
 int fill_callchain_info(struct addr_location *al, struct callchain_cursor_node *node,
 			bool hide_unresolved)
 {
-	struct machine *machine = maps__machine(node->ms.maps);
+	struct machine *machine = node->ms.maps ? maps__machine(node->ms.maps) : NULL;
 
 	maps__put(al->maps);
 	al->maps = maps__get(node->ms.maps);
--- linux-qcom-6.8.0.orig/tools/perf/util/cs-etm.c
+++ linux-qcom-6.8.0/tools/perf/util/cs-etm.c
@@ -2436,12 +2436,6 @@
 
 		/* Ignore return value */
 		cs_etm__process_traceid_queue(etmq, tidq);
-
-		/*
-		 * Generate an instruction sample with the remaining
-		 * branchstack entries.
-		 */
-		cs_etm__flush(etmq, tidq);
 	}
 }
 
@@ -2584,7 +2578,7 @@
 
 	while (1) {
 		if (!etm->heap.heap_cnt)
-			goto out;
+			break;
 
 		/* Take the entry at the top of the min heap */
 		cs_queue_nr = etm->heap.heap_array[0].queue_nr;
@@ -2667,6 +2661,23 @@
 		ret = auxtrace_heap__add(&etm->heap, cs_queue_nr, cs_timestamp);
 	}
 
+	for (i = 0; i < etm->queues.nr_queues; i++) {
+		struct int_node *inode;
+
+		etmq = etm->queues.queue_array[i].priv;
+		if (!etmq)
+			continue;
+
+		intlist__for_each_entry(inode, etmq->traceid_queues_list) {
+			int idx = (int)(intptr_t)inode->priv;
+
+			/* Flush any remaining branch stack entries */
+			tidq = etmq->traceid_queues[idx];
+			ret = cs_etm__end_block(etmq, tidq);
+			if (ret)
+				return ret;
+		}
+	}
 out:
 	return ret;
 }
--- linux-qcom-6.8.0.orig/tools/perf/util/data.c
+++ linux-qcom-6.8.0/tools/perf/util/data.c
@@ -430,8 +430,6 @@
 {
 	int ret;
 
-	if (check_pipe(data))
-		return -EINVAL;
 	if (perf_data__is_read(data))
 		return -EINVAL;
 
--- linux-qcom-6.8.0.orig/tools/perf/util/dso.c
+++ linux-qcom-6.8.0/tools/perf/util/dso.c
@@ -1532,3 +1532,15 @@
 	scnprintf(buf, buflen, "%s", dso_load__error_str[idx]);
 	return 0;
 }
+
+bool perf_pid_map_tid(const char *dso_name, int *tid)
+{
+	return sscanf(dso_name, "/tmp/perf-%d.map", tid) == 1;
+}
+
+bool is_perf_pid_map_name(const char *dso_name)
+{
+	int tid;
+
+	return perf_pid_map_tid(dso_name, &tid);
+}
--- linux-qcom-6.8.0.orig/tools/perf/util/dso.h
+++ linux-qcom-6.8.0/tools/perf/util/dso.h
@@ -411,4 +411,8 @@
 
 void reset_fd_limit(void);
 
+/* Check if dso name is of format "/tmp/perf-%d.map" */
+bool perf_pid_map_tid(const char *dso_name, int *tid);
+bool is_perf_pid_map_name(const char *dso_name);
+
 #endif /* __PERF_DSO */
--- linux-qcom-6.8.0.orig/tools/perf/util/evlist.c
+++ linux-qcom-6.8.0/tools/perf/util/evlist.c
@@ -46,6 +46,7 @@
 #include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/timerfd.h>
+#include <sys/wait.h>
 
 #include <linux/bitops.h>
 #include <linux/hash.h>
@@ -1412,6 +1413,8 @@
 	int child_ready_pipe[2], go_pipe[2];
 	char bf;
 
+	evlist->workload.cork_fd = -1;
+
 	if (pipe(child_ready_pipe) < 0) {
 		perror("failed to create 'ready' pipe");
 		return -1;
@@ -1464,7 +1467,7 @@
 		 * For cancelling the workload without actually running it,
 		 * the parent will just close workload.cork_fd, without writing
 		 * anything, i.e. read will return zero and we just exit()
-		 * here.
+		 * here (See evlist__cancel_workload()).
 		 */
 		if (ret != 1) {
 			if (ret == -1)
@@ -1528,7 +1531,7 @@
 
 int evlist__start_workload(struct evlist *evlist)
 {
-	if (evlist->workload.cork_fd > 0) {
+	if (evlist->workload.cork_fd >= 0) {
 		char bf = 0;
 		int ret;
 		/*
@@ -1539,12 +1542,24 @@
 			perror("unable to write to pipe");
 
 		close(evlist->workload.cork_fd);
+		evlist->workload.cork_fd = -1;
 		return ret;
 	}
 
 	return 0;
 }
 
+void evlist__cancel_workload(struct evlist *evlist)
+{
+	int status;
+
+	if (evlist->workload.cork_fd >= 0) {
+		close(evlist->workload.cork_fd);
+		evlist->workload.cork_fd = -1;
+		waitpid(evlist->workload.pid, &status, WNOHANG);
+	}
+}
+
 int evlist__parse_sample(struct evlist *evlist, union perf_event *event, struct perf_sample *sample)
 {
 	struct evsel *evsel = evlist__event2evsel(evlist, event);
--- linux-qcom-6.8.0.orig/tools/perf/util/evlist.h
+++ linux-qcom-6.8.0/tools/perf/util/evlist.h
@@ -184,6 +184,7 @@
 			     const char *argv[], bool pipe_output,
 			     void (*exec_error)(int signo, siginfo_t *info, void *ucontext));
 int evlist__start_workload(struct evlist *evlist);
+void evlist__cancel_workload(struct evlist *evlist);
 
 struct option;
 
--- linux-qcom-6.8.0.orig/tools/perf/util/evsel.c
+++ linux-qcom-6.8.0/tools/perf/util/evsel.c
@@ -2363,7 +2363,6 @@
 	data->period = evsel->core.attr.sample_period;
 	data->cpumode = event->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
 	data->misc    = event->header.misc;
-	data->id = -1ULL;
 	data->data_src = PERF_MEM_DATA_SRC_NONE;
 	data->vcpu = -1;
 
--- linux-qcom-6.8.0.orig/tools/perf/util/expr.c
+++ linux-qcom-6.8.0/tools/perf/util/expr.c
@@ -500,7 +500,25 @@
 	tmp = evlist__new();
 	if (!tmp)
 		return NAN;
-	ret = parse_event(tmp, id) ? 0 : 1;
+
+	if (strchr(id, '@')) {
+		char *tmp_id, *p;
+
+		tmp_id = strdup(id);
+		if (!tmp_id) {
+			ret = NAN;
+			goto out;
+		}
+		p = strchr(tmp_id, '@');
+		*p = '/';
+		p = strrchr(tmp_id, '@');
+		*p = '/';
+		ret = parse_event(tmp, tmp_id) ? 0 : 1;
+		free(tmp_id);
+	} else {
+		ret = parse_event(tmp, id) ? 0 : 1;
+	}
+out:
 	evlist__delete(tmp);
 	return ret;
 }
--- linux-qcom-6.8.0.orig/tools/perf/util/hist.c
+++ linux-qcom-6.8.0/tools/perf/util/hist.c
@@ -636,7 +636,12 @@
 			 * mis-adjust symbol addresses when computing
 			 * the history counter to increment.
 			 */
-			if (he->ms.map != entry->ms.map) {
+			if (hists__has(hists, sym) && he->ms.map != entry->ms.map) {
+				if (he->ms.sym) {
+					u64 addr = he->ms.sym->start;
+					he->ms.sym = map__find_symbol(entry->ms.map, addr);
+				}
+
 				map__put(he->ms.map);
 				he->ms.map = map__get(entry->ms.map);
 			}
--- linux-qcom-6.8.0.orig/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ linux-qcom-6.8.0/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -1319,6 +1319,8 @@
 	bool ret = false;
 
 	decoder->state.type &= ~INTEL_PT_BRANCH;
+	decoder->state.insn_op = INTEL_PT_OP_OTHER;
+	decoder->state.insn_len = 0;
 
 	if (decoder->set_fup_cfe_ip || decoder->set_fup_cfe) {
 		bool ip = decoder->set_fup_cfe_ip;
--- linux-qcom-6.8.0.orig/tools/perf/util/intel-pt.c
+++ linux-qcom-6.8.0/tools/perf/util/intel-pt.c
@@ -764,6 +764,7 @@
 
 	addr_location__init(&al);
 	intel_pt_insn->length = 0;
+	intel_pt_insn->op = INTEL_PT_OP_OTHER;
 
 	if (to_ip && *ip == to_ip)
 		goto out_no_cache;
@@ -898,6 +899,7 @@
 
 			if (to_ip && *ip == to_ip) {
 				intel_pt_insn->length = 0;
+				intel_pt_insn->op = INTEL_PT_OP_OTHER;
 				goto out_no_cache;
 			}
 
--- linux-qcom-6.8.0.orig/tools/perf/util/machine.c
+++ linux-qcom-6.8.0/tools/perf/util/machine.c
@@ -172,6 +172,8 @@
 
 		if (machine__create_kernel_maps(machine) < 0)
 			goto out_delete;
+
+		machine->env = &perf_env;
 	}
 
 	return machine;
@@ -1709,8 +1711,8 @@
 	updated = map__get(orig);
 
 	machine->vmlinux_map = updated;
-	machine__set_kernel_mmap(machine, start, end);
 	maps__remove(machine__kernel_maps(machine), orig);
+	machine__set_kernel_mmap(machine, start, end);
 	err = maps__insert(machine__kernel_maps(machine), updated);
 	map__put(orig);
 
--- linux-qcom-6.8.0.orig/tools/perf/util/map.c
+++ linux-qcom-6.8.0/tools/perf/util/map.c
@@ -168,6 +168,7 @@
 		if (dso == NULL)
 			goto out_delete;
 
+		assert(!dso->kernel);
 		map__init(result, start, start + len, pgoff, dso);
 
 		if (anon || no_dso) {
--- linux-qcom-6.8.0.orig/tools/perf/util/maps.c
+++ linux-qcom-6.8.0/tools/perf/util/maps.c
@@ -10,286 +10,496 @@
 #include "ui/ui.h"
 #include "unwind.h"
 
-struct map_rb_node {
-	struct rb_node rb_node;
-	struct map *map;
-};
-
-#define maps__for_each_entry(maps, map) \
-	for (map = maps__first(maps); map; map = map_rb_node__next(map))
+static void check_invariants(const struct maps *maps __maybe_unused)
+{
+#ifndef NDEBUG
+	assert(RC_CHK_ACCESS(maps)->nr_maps <= RC_CHK_ACCESS(maps)->nr_maps_allocated);
+	for (unsigned int i = 0; i < RC_CHK_ACCESS(maps)->nr_maps; i++) {
+		struct map *map = RC_CHK_ACCESS(maps)->maps_by_address[i];
+
+		/* Check map is well-formed. */
+		assert(map__end(map) == 0 || map__start(map) <= map__end(map));
+		/* Expect at least 1 reference count. */
+		assert(refcount_read(map__refcnt(map)) > 0);
+
+		if (map__dso(map) && map__dso(map)->kernel)
+			assert(RC_CHK_EQUAL(map__kmap(map)->kmaps, maps));
+
+		if (i > 0) {
+			struct map *prev = RC_CHK_ACCESS(maps)->maps_by_address[i - 1];
+
+			/* If addresses are sorted... */
+			if (RC_CHK_ACCESS(maps)->maps_by_address_sorted) {
+				/* Maps should be in start address order. */
+				assert(map__start(prev) <= map__start(map));
+				/*
+				 * If the ends of maps aren't broken (during
+				 * construction) then they should be ordered
+				 * too.
+				 */
+				if (!RC_CHK_ACCESS(maps)->ends_broken) {
+					assert(map__end(prev) <= map__end(map));
+					assert(map__end(prev) <= map__start(map) ||
+					       map__start(prev) == map__start(map));
+				}
+			}
+		}
+	}
+	if (RC_CHK_ACCESS(maps)->maps_by_name) {
+		for (unsigned int i = 0; i < RC_CHK_ACCESS(maps)->nr_maps; i++) {
+			struct map *map = RC_CHK_ACCESS(maps)->maps_by_name[i];
 
-#define maps__for_each_entry_safe(maps, map, next) \
-	for (map = maps__first(maps), next = map_rb_node__next(map); map; \
-	     map = next, next = map_rb_node__next(map))
+			/*
+			 * Maps by name maps should be in maps_by_address, so
+			 * the reference count should be higher.
+			 */
+			assert(refcount_read(map__refcnt(map)) > 1);
+		}
+	}
+#endif
+}
 
-static struct rb_root *maps__entries(struct maps *maps)
+static struct map **maps__maps_by_address(const struct maps *maps)
 {
-	return &RC_CHK_ACCESS(maps)->entries;
+	return RC_CHK_ACCESS(maps)->maps_by_address;
 }
 
-static struct rw_semaphore *maps__lock(struct maps *maps)
+static void maps__set_maps_by_address(struct maps *maps, struct map **new)
 {
-	return &RC_CHK_ACCESS(maps)->lock;
+	RC_CHK_ACCESS(maps)->maps_by_address = new;
+
 }
 
-static struct map **maps__maps_by_name(struct maps *maps)
+static struct map ***maps__maps_by_name_addr(struct maps *maps)
 {
-	return RC_CHK_ACCESS(maps)->maps_by_name;
+	return &RC_CHK_ACCESS(maps)->maps_by_name;
 }
 
-static struct map_rb_node *maps__first(struct maps *maps)
+static void maps__set_nr_maps_allocated(struct maps *maps, unsigned int nr_maps_allocated)
 {
-	struct rb_node *first = rb_first(maps__entries(maps));
+	RC_CHK_ACCESS(maps)->nr_maps_allocated = nr_maps_allocated;
+}
 
-	if (first)
-		return rb_entry(first, struct map_rb_node, rb_node);
-	return NULL;
+static void maps__set_nr_maps(struct maps *maps, unsigned int nr_maps)
+{
+	RC_CHK_ACCESS(maps)->nr_maps = nr_maps;
 }
 
-static struct map_rb_node *map_rb_node__next(struct map_rb_node *node)
+/* Not in the header, to aid reference counting. */
+static struct map **maps__maps_by_name(const struct maps *maps)
 {
-	struct rb_node *next;
+	return RC_CHK_ACCESS(maps)->maps_by_name;
 
-	if (!node)
-		return NULL;
+}
 
-	next = rb_next(&node->rb_node);
+static void maps__set_maps_by_name(struct maps *maps, struct map **new)
+{
+	RC_CHK_ACCESS(maps)->maps_by_name = new;
 
-	if (!next)
-		return NULL;
+}
 
-	return rb_entry(next, struct map_rb_node, rb_node);
+static bool maps__maps_by_address_sorted(const struct maps *maps)
+{
+	return RC_CHK_ACCESS(maps)->maps_by_address_sorted;
 }
 
-static struct map_rb_node *maps__find_node(struct maps *maps, struct map *map)
+static void maps__set_maps_by_address_sorted(struct maps *maps, bool value)
 {
-	struct map_rb_node *rb_node;
+	RC_CHK_ACCESS(maps)->maps_by_address_sorted = value;
+}
 
-	maps__for_each_entry(maps, rb_node) {
-		if (rb_node->RC_CHK_ACCESS(map) == RC_CHK_ACCESS(map))
-			return rb_node;
-	}
-	return NULL;
+static bool maps__maps_by_name_sorted(const struct maps *maps)
+{
+	return RC_CHK_ACCESS(maps)->maps_by_name_sorted;
 }
 
-static void maps__init(struct maps *maps, struct machine *machine)
+static void maps__set_maps_by_name_sorted(struct maps *maps, bool value)
 {
-	refcount_set(maps__refcnt(maps), 1);
-	init_rwsem(maps__lock(maps));
-	RC_CHK_ACCESS(maps)->entries = RB_ROOT;
-	RC_CHK_ACCESS(maps)->machine = machine;
-	RC_CHK_ACCESS(maps)->last_search_by_name = NULL;
-	RC_CHK_ACCESS(maps)->nr_maps = 0;
-	RC_CHK_ACCESS(maps)->maps_by_name = NULL;
+	RC_CHK_ACCESS(maps)->maps_by_name_sorted = value;
 }
 
-static void __maps__free_maps_by_name(struct maps *maps)
+static struct rw_semaphore *maps__lock(struct maps *maps)
 {
 	/*
-	 * Free everything to try to do it from the rbtree in the next search
+	 * When the lock is acquired or released the maps invariants should
+	 * hold.
 	 */
-	for (unsigned int i = 0; i < maps__nr_maps(maps); i++)
-		map__put(maps__maps_by_name(maps)[i]);
+	check_invariants(maps);
+	return &RC_CHK_ACCESS(maps)->lock;
+}
 
-	zfree(&RC_CHK_ACCESS(maps)->maps_by_name);
+static void maps__init(struct maps *maps, struct machine *machine)
+{
+	init_rwsem(maps__lock(maps));
+	RC_CHK_ACCESS(maps)->maps_by_address = NULL;
+	RC_CHK_ACCESS(maps)->maps_by_name = NULL;
+	RC_CHK_ACCESS(maps)->machine = machine;
+#ifdef HAVE_LIBUNWIND_SUPPORT
+	RC_CHK_ACCESS(maps)->addr_space = NULL;
+	RC_CHK_ACCESS(maps)->unwind_libunwind_ops = NULL;
+#endif
+	refcount_set(maps__refcnt(maps), 1);
+	RC_CHK_ACCESS(maps)->nr_maps = 0;
 	RC_CHK_ACCESS(maps)->nr_maps_allocated = 0;
+	RC_CHK_ACCESS(maps)->last_search_by_name_idx = 0;
+	RC_CHK_ACCESS(maps)->maps_by_address_sorted = true;
+	RC_CHK_ACCESS(maps)->maps_by_name_sorted = false;
 }
 
-static int __maps__insert(struct maps *maps, struct map *map)
+static void maps__exit(struct maps *maps)
 {
-	struct rb_node **p = &maps__entries(maps)->rb_node;
-	struct rb_node *parent = NULL;
-	const u64 ip = map__start(map);
-	struct map_rb_node *m, *new_rb_node;
+	struct map **maps_by_address = maps__maps_by_address(maps);
+	struct map **maps_by_name = maps__maps_by_name(maps);
 
-	new_rb_node = malloc(sizeof(*new_rb_node));
-	if (!new_rb_node)
-		return -ENOMEM;
+	for (unsigned int i = 0; i < maps__nr_maps(maps); i++) {
+		map__zput(maps_by_address[i]);
+		if (maps_by_name)
+			map__zput(maps_by_name[i]);
+	}
+	zfree(&maps_by_address);
+	zfree(&maps_by_name);
+	unwind__finish_access(maps);
+}
 
-	RB_CLEAR_NODE(&new_rb_node->rb_node);
-	new_rb_node->map = map__get(map);
+struct maps *maps__new(struct machine *machine)
+{
+	struct maps *result;
+	RC_STRUCT(maps) *maps = zalloc(sizeof(*maps));
 
-	while (*p != NULL) {
-		parent = *p;
-		m = rb_entry(parent, struct map_rb_node, rb_node);
-		if (ip < map__start(m->map))
-			p = &(*p)->rb_left;
-		else
-			p = &(*p)->rb_right;
-	}
+	if (ADD_RC_CHK(result, maps))
+		maps__init(result, machine);
 
-	rb_link_node(&new_rb_node->rb_node, parent, p);
-	rb_insert_color(&new_rb_node->rb_node, maps__entries(maps));
-	return 0;
+	return result;
 }
 
-int maps__insert(struct maps *maps, struct map *map)
+static void maps__delete(struct maps *maps)
 {
-	int err;
-	const struct dso *dso = map__dso(map);
-
-	down_write(maps__lock(maps));
-	err = __maps__insert(maps, map);
-	if (err)
-		goto out;
+	maps__exit(maps);
+	RC_CHK_FREE(maps);
+}
 
-	++RC_CHK_ACCESS(maps)->nr_maps;
+struct maps *maps__get(struct maps *maps)
+{
+	struct maps *result;
 
-	if (dso && dso->kernel) {
-		struct kmap *kmap = map__kmap(map);
+	if (RC_CHK_GET(result, maps))
+		refcount_inc(maps__refcnt(maps));
 
-		if (kmap)
-			kmap->kmaps = maps;
-		else
-			pr_err("Internal error: kernel dso with non kernel map\n");
-	}
+	return result;
+}
 
+void maps__put(struct maps *maps)
+{
+	if (maps && refcount_dec_and_test(maps__refcnt(maps)))
+		maps__delete(maps);
+	else
+		RC_CHK_PUT(maps);
+}
 
+static void __maps__free_maps_by_name(struct maps *maps)
+{
 	/*
-	 * If we already performed some search by name, then we need to add the just
-	 * inserted map and resort.
+	 * Free everything to try to do it from the rbtree in the next search
 	 */
-	if (maps__maps_by_name(maps)) {
-		if (maps__nr_maps(maps) > RC_CHK_ACCESS(maps)->nr_maps_allocated) {
-			int nr_allocate = maps__nr_maps(maps) * 2;
-			struct map **maps_by_name = realloc(maps__maps_by_name(maps),
-							    nr_allocate * sizeof(map));
+	for (unsigned int i = 0; i < maps__nr_maps(maps); i++)
+		map__put(maps__maps_by_name(maps)[i]);
 
-			if (maps_by_name == NULL) {
-				__maps__free_maps_by_name(maps);
-				err = -ENOMEM;
-				goto out;
-			}
+	zfree(&RC_CHK_ACCESS(maps)->maps_by_name);
+}
 
-			RC_CHK_ACCESS(maps)->maps_by_name = maps_by_name;
-			RC_CHK_ACCESS(maps)->nr_maps_allocated = nr_allocate;
+static int map__start_cmp(const void *a, const void *b)
+{
+	const struct map *map_a = *(const struct map * const *)a;
+	const struct map *map_b = *(const struct map * const *)b;
+	u64 map_a_start = map__start(map_a);
+	u64 map_b_start = map__start(map_b);
+
+	if (map_a_start == map_b_start) {
+		u64 map_a_end = map__end(map_a);
+		u64 map_b_end = map__end(map_b);
+
+		if  (map_a_end == map_b_end) {
+			/* Ensure maps with the same addresses have a fixed order. */
+			if (RC_CHK_ACCESS(map_a) == RC_CHK_ACCESS(map_b))
+				return 0;
+			return (intptr_t)RC_CHK_ACCESS(map_a) > (intptr_t)RC_CHK_ACCESS(map_b)
+				? 1 : -1;
 		}
-		maps__maps_by_name(maps)[maps__nr_maps(maps) - 1] = map__get(map);
-		__maps__sort_by_name(maps);
+		return map_a_end > map_b_end ? 1 : -1;
 	}
- out:
-	up_write(maps__lock(maps));
-	return err;
+	return map_a_start > map_b_start ? 1 : -1;
 }
 
-static void __maps__remove(struct maps *maps, struct map_rb_node *rb_node)
+static void __maps__sort_by_address(struct maps *maps)
 {
-	rb_erase_init(&rb_node->rb_node, maps__entries(maps));
-	map__put(rb_node->map);
-	free(rb_node);
+	if (maps__maps_by_address_sorted(maps))
+		return;
+
+	qsort(maps__maps_by_address(maps),
+		maps__nr_maps(maps),
+		sizeof(struct map *),
+		map__start_cmp);
+	maps__set_maps_by_address_sorted(maps, true);
 }
 
-void maps__remove(struct maps *maps, struct map *map)
+static void maps__sort_by_address(struct maps *maps)
 {
-	struct map_rb_node *rb_node;
-
 	down_write(maps__lock(maps));
-	if (RC_CHK_ACCESS(maps)->last_search_by_name == map)
-		RC_CHK_ACCESS(maps)->last_search_by_name = NULL;
-
-	rb_node = maps__find_node(maps, map);
-	assert(rb_node->RC_CHK_ACCESS(map) == RC_CHK_ACCESS(map));
-	__maps__remove(maps, rb_node);
-	if (maps__maps_by_name(maps))
-		__maps__free_maps_by_name(maps);
-	--RC_CHK_ACCESS(maps)->nr_maps;
+	__maps__sort_by_address(maps);
 	up_write(maps__lock(maps));
 }
 
-static void __maps__purge(struct maps *maps)
+static int map__strcmp(const void *a, const void *b)
 {
-	struct map_rb_node *pos, *next;
-
-	if (maps__maps_by_name(maps))
-		__maps__free_maps_by_name(maps);
+	const struct map *map_a = *(const struct map * const *)a;
+	const struct map *map_b = *(const struct map * const *)b;
+	const struct dso *dso_a = map__dso(map_a);
+	const struct dso *dso_b = map__dso(map_b);
+	int ret = strcmp(dso_a->short_name, dso_b->short_name);
 
-	maps__for_each_entry_safe(maps, pos, next) {
-		rb_erase_init(&pos->rb_node,  maps__entries(maps));
-		map__put(pos->map);
-		free(pos);
+	if (ret == 0 && RC_CHK_ACCESS(map_a) != RC_CHK_ACCESS(map_b)) {
+		/* Ensure distinct but name equal maps have an order. */
+		return map__start_cmp(a, b);
 	}
+	return ret;
 }
 
-static void maps__exit(struct maps *maps)
+static int maps__sort_by_name(struct maps *maps)
 {
+	int err = 0;
 	down_write(maps__lock(maps));
-	__maps__purge(maps);
+	if (!maps__maps_by_name_sorted(maps)) {
+		struct map **maps_by_name = maps__maps_by_name(maps);
+
+		if (!maps_by_name) {
+			maps_by_name = malloc(RC_CHK_ACCESS(maps)->nr_maps_allocated *
+					sizeof(*maps_by_name));
+			if (!maps_by_name)
+				err = -ENOMEM;
+			else {
+				struct map **maps_by_address = maps__maps_by_address(maps);
+				unsigned int n = maps__nr_maps(maps);
+
+				maps__set_maps_by_name(maps, maps_by_name);
+				for (unsigned int i = 0; i < n; i++)
+					maps_by_name[i] = map__get(maps_by_address[i]);
+			}
+		}
+		if (!err) {
+			qsort(maps_by_name,
+				maps__nr_maps(maps),
+				sizeof(struct map *),
+				map__strcmp);
+			maps__set_maps_by_name_sorted(maps, true);
+		}
+	}
 	up_write(maps__lock(maps));
+	return err;
 }
 
-bool maps__empty(struct maps *maps)
+static unsigned int maps__by_address_index(const struct maps *maps, const struct map *map)
 {
-	return !maps__first(maps);
+	struct map **maps_by_address = maps__maps_by_address(maps);
+
+	if (maps__maps_by_address_sorted(maps)) {
+		struct map **mapp =
+			bsearch(&map, maps__maps_by_address(maps), maps__nr_maps(maps),
+				sizeof(*mapp), map__start_cmp);
+
+		if (mapp)
+			return mapp - maps_by_address;
+	} else {
+		for (unsigned int i = 0; i < maps__nr_maps(maps); i++) {
+			if (RC_CHK_ACCESS(maps_by_address[i]) == RC_CHK_ACCESS(map))
+				return i;
+		}
+	}
+	pr_err("Map missing from maps");
+	return -1;
 }
 
-struct maps *maps__new(struct machine *machine)
+static unsigned int maps__by_name_index(const struct maps *maps, const struct map *map)
 {
-	struct maps *result;
-	RC_STRUCT(maps) *maps = zalloc(sizeof(*maps));
+	struct map **maps_by_name = maps__maps_by_name(maps);
 
-	if (ADD_RC_CHK(result, maps))
-		maps__init(result, machine);
+	if (maps__maps_by_name_sorted(maps)) {
+		struct map **mapp =
+			bsearch(&map, maps_by_name, maps__nr_maps(maps),
+				sizeof(*mapp), map__strcmp);
 
-	return result;
+		if (mapp)
+			return mapp - maps_by_name;
+	} else {
+		for (unsigned int i = 0; i < maps__nr_maps(maps); i++) {
+			if (RC_CHK_ACCESS(maps_by_name[i]) == RC_CHK_ACCESS(map))
+				return i;
+		}
+	}
+	pr_err("Map missing from maps");
+	return -1;
 }
 
-static void maps__delete(struct maps *maps)
+static int __maps__insert(struct maps *maps, struct map *new)
 {
-	maps__exit(maps);
-	unwind__finish_access(maps);
-	RC_CHK_FREE(maps);
+	struct map **maps_by_address = maps__maps_by_address(maps);
+	struct map **maps_by_name = maps__maps_by_name(maps);
+	const struct dso *dso = map__dso(new);
+	unsigned int nr_maps = maps__nr_maps(maps);
+	unsigned int nr_allocate = RC_CHK_ACCESS(maps)->nr_maps_allocated;
+
+	if (nr_maps + 1 > nr_allocate) {
+		nr_allocate = !nr_allocate ? 32 : nr_allocate * 2;
+
+		maps_by_address = realloc(maps_by_address, nr_allocate * sizeof(new));
+		if (!maps_by_address)
+			return -ENOMEM;
+
+		maps__set_maps_by_address(maps, maps_by_address);
+		if (maps_by_name) {
+			maps_by_name = realloc(maps_by_name, nr_allocate * sizeof(new));
+			if (!maps_by_name) {
+				/*
+				 * If by name fails, just disable by name and it will
+				 * recompute next time it is required.
+				 */
+				__maps__free_maps_by_name(maps);
+			}
+			maps__set_maps_by_name(maps, maps_by_name);
+		}
+		RC_CHK_ACCESS(maps)->nr_maps_allocated = nr_allocate;
+	}
+	/* Insert the value at the end. */
+	maps_by_address[nr_maps] = map__get(new);
+	if (maps_by_name)
+		maps_by_name[nr_maps] = map__get(new);
+
+	nr_maps++;
+	RC_CHK_ACCESS(maps)->nr_maps = nr_maps;
+
+	/*
+	 * Recompute if things are sorted. If things are inserted in a sorted
+	 * manner, for example by processing /proc/pid/maps, then no
+	 * sorting/resorting will be necessary.
+	 */
+	if (nr_maps == 1) {
+		/* If there's just 1 entry then maps are sorted. */
+		maps__set_maps_by_address_sorted(maps, true);
+		maps__set_maps_by_name_sorted(maps, maps_by_name != NULL);
+	} else {
+		/* Sorted if maps were already sorted and this map starts after the last one. */
+		maps__set_maps_by_address_sorted(maps,
+			maps__maps_by_address_sorted(maps) &&
+			map__end(maps_by_address[nr_maps - 2]) <= map__start(new));
+		maps__set_maps_by_name_sorted(maps, false);
+	}
+	if (map__end(new) < map__start(new))
+		RC_CHK_ACCESS(maps)->ends_broken = true;
+	if (dso && dso->kernel) {
+		struct kmap *kmap = map__kmap(new);
+
+		if (kmap)
+			kmap->kmaps = maps;
+		else
+			pr_err("Internal error: kernel dso with non kernel map\n");
+	}
+	return 0;
 }
 
-struct maps *maps__get(struct maps *maps)
+int maps__insert(struct maps *maps, struct map *map)
 {
-	struct maps *result;
+	int ret;
 
-	if (RC_CHK_GET(result, maps))
-		refcount_inc(maps__refcnt(maps));
+	down_write(maps__lock(maps));
+	ret = __maps__insert(maps, map);
+	up_write(maps__lock(maps));
+	return ret;
+}
 
-	return result;
+static void __maps__remove(struct maps *maps, struct map *map)
+{
+	struct map **maps_by_address = maps__maps_by_address(maps);
+	struct map **maps_by_name = maps__maps_by_name(maps);
+	unsigned int nr_maps = maps__nr_maps(maps);
+	unsigned int address_idx;
+
+	/* Slide later mappings over the one to remove */
+	address_idx = maps__by_address_index(maps, map);
+	map__put(maps_by_address[address_idx]);
+	memmove(&maps_by_address[address_idx],
+		&maps_by_address[address_idx + 1],
+		(nr_maps - address_idx - 1) * sizeof(*maps_by_address));
+
+	if (maps_by_name) {
+		unsigned int name_idx = maps__by_name_index(maps, map);
+
+		map__put(maps_by_name[name_idx]);
+		memmove(&maps_by_name[name_idx],
+			&maps_by_name[name_idx + 1],
+			(nr_maps - name_idx - 1) *  sizeof(*maps_by_name));
+	}
+
+	--RC_CHK_ACCESS(maps)->nr_maps;
 }
 
-void maps__put(struct maps *maps)
+void maps__remove(struct maps *maps, struct map *map)
 {
-	if (maps && refcount_dec_and_test(maps__refcnt(maps)))
-		maps__delete(maps);
-	else
-		RC_CHK_PUT(maps);
+	down_write(maps__lock(maps));
+	__maps__remove(maps, map);
+	up_write(maps__lock(maps));
+}
+
+bool maps__empty(struct maps *maps)
+{
+	return maps__nr_maps(maps) == 0;
 }
 
 int maps__for_each_map(struct maps *maps, int (*cb)(struct map *map, void *data), void *data)
 {
-	struct map_rb_node *pos;
+	bool done = false;
 	int ret = 0;
 
-	down_read(maps__lock(maps));
-	maps__for_each_entry(maps, pos)	{
-		ret = cb(pos->map, data);
-		if (ret)
-			break;
+	/* See locking/sorting note. */
+	while (!done) {
+		down_read(maps__lock(maps));
+		if (maps__maps_by_address_sorted(maps)) {
+			/*
+			 * maps__for_each_map callbacks may buggily/unsafely
+			 * insert into maps_by_address. Deliberately reload
+			 * maps__nr_maps and maps_by_address on each iteration
+			 * to avoid using memory freed by maps__insert growing
+			 * the array - this may cause maps to be skipped or
+			 * repeated.
+			 */
+			for (unsigned int i = 0; i < maps__nr_maps(maps); i++) {
+				struct map **maps_by_address = maps__maps_by_address(maps);
+				struct map *map = maps_by_address[i];
+
+				ret = cb(map, data);
+				if (ret)
+					break;
+			}
+			done = true;
+		}
+		up_read(maps__lock(maps));
+		if (!done)
+			maps__sort_by_address(maps);
 	}
-	up_read(maps__lock(maps));
 	return ret;
 }
 
 void maps__remove_maps(struct maps *maps, bool (*cb)(struct map *map, void *data), void *data)
 {
-	struct map_rb_node *pos, *next;
-	unsigned int start_nr_maps;
+	struct map **maps_by_address;
 
 	down_write(maps__lock(maps));
 
-	start_nr_maps = maps__nr_maps(maps);
-	maps__for_each_entry_safe(maps, pos, next)	{
-		if (cb(pos->map, data)) {
-			__maps__remove(maps, pos);
-			--RC_CHK_ACCESS(maps)->nr_maps;
-		}
+	maps_by_address = maps__maps_by_address(maps);
+	for (unsigned int i = 0; i < maps__nr_maps(maps);) {
+		if (cb(maps_by_address[i], data))
+			__maps__remove(maps, maps_by_address[i]);
+		else
+			i++;
 	}
-	if (maps__maps_by_name(maps) && start_nr_maps != maps__nr_maps(maps))
-		__maps__free_maps_by_name(maps);
-
 	up_write(maps__lock(maps));
 }
 
@@ -300,7 +510,7 @@
 	/* Ensure map is loaded before using map->map_ip */
 	if (map != NULL && map__load(map) >= 0) {
 		if (mapp != NULL)
-			*mapp = map;
+			*mapp = map; // TODO: map_put on else path when find returns a get.
 		return map__find_symbol(map, map__map_ip(map, addr));
 	}
 
@@ -348,7 +558,7 @@
 	if (ams->addr < map__start(ams->ms.map) || ams->addr >= map__end(ams->ms.map)) {
 		if (maps == NULL)
 			return -1;
-		ams->ms.map = maps__find(maps, ams->addr);
+		ams->ms.map = maps__find(maps, ams->addr);  // TODO: map_get
 		if (ams->ms.map == NULL)
 			return -1;
 	}
@@ -393,24 +603,28 @@
  * Find first map where end > map->start.
  * Same as find_vma() in kernel.
  */
-static struct rb_node *first_ending_after(struct maps *maps, const struct map *map)
+static unsigned int first_ending_after(struct maps *maps, const struct map *map)
 {
-	struct rb_root *root;
-	struct rb_node *next, *first;
+	struct map **maps_by_address = maps__maps_by_address(maps);
+	int low = 0, high = (int)maps__nr_maps(maps) - 1, first = high + 1;
 
-	root = maps__entries(maps);
-	next = root->rb_node;
-	first = NULL;
-	while (next) {
-		struct map_rb_node *pos = rb_entry(next, struct map_rb_node, rb_node);
-
-		if (map__end(pos->map) > map__start(map)) {
-			first = next;
-			if (map__start(pos->map) <= map__start(map))
+	assert(maps__maps_by_address_sorted(maps));
+	if (low <= high && map__end(maps_by_address[0]) > map__start(map))
+		return 0;
+
+	while (low <= high) {
+		int mid = (low + high) / 2;
+		struct map *pos = maps_by_address[mid];
+
+		if (map__end(pos) > map__start(map)) {
+			first = mid;
+			if (map__start(pos) <= map__start(map)) {
+				/* Entry overlaps map. */
 				break;
-			next = next->rb_left;
+			}
+			high = mid - 1;
 		} else
-			next = next->rb_right;
+			low = mid + 1;
 	}
 	return first;
 }
@@ -419,171 +633,250 @@
  * Adds new to maps, if new overlaps existing entries then the existing maps are
  * adjusted or removed so that new fits without overlapping any entries.
  */
-int maps__fixup_overlap_and_insert(struct maps *maps, struct map *new)
+static int __maps__fixup_overlap_and_insert(struct maps *maps, struct map *new)
 {
-
-	struct rb_node *next;
 	int err = 0;
 	FILE *fp = debug_file();
 
-	down_write(maps__lock(maps));
+sort_again:
+	if (!maps__maps_by_address_sorted(maps))
+		__maps__sort_by_address(maps);
 
-	next = first_ending_after(maps, new);
-	while (next && !err) {
-		struct map_rb_node *pos = rb_entry(next, struct map_rb_node, rb_node);
-		next = rb_next(&pos->rb_node);
+	/*
+	 * Iterate through entries where the end of the existing entry is
+	 * greater-than the new map's start.
+	 */
+	for (unsigned int i = first_ending_after(maps, new); i < maps__nr_maps(maps); ) {
+		struct map **maps_by_address = maps__maps_by_address(maps);
+		struct map *pos = maps_by_address[i];
+		struct map *before = NULL, *after = NULL;
 
 		/*
 		 * Stop if current map starts after map->end.
 		 * Maps are ordered by start: next will not overlap for sure.
 		 */
-		if (map__start(pos->map) >= map__end(new))
+		if (map__start(pos) >= map__end(new))
 			break;
 
-		if (verbose >= 2) {
-
-			if (use_browser) {
-				pr_debug("overlapping maps in %s (disable tui for more info)\n",
-					 map__dso(new)->name);
-			} else {
-				pr_debug("overlapping maps:\n");
-				map__fprintf(new, fp);
-				map__fprintf(pos->map, fp);
-			}
+		if (use_browser) {
+			pr_debug("overlapping maps in %s (disable tui for more info)\n",
+				map__dso(new)->name);
+		} else if (verbose >= 2) {
+			pr_debug("overlapping maps:\n");
+			map__fprintf(new, fp);
+			map__fprintf(pos, fp);
 		}
 
-		rb_erase_init(&pos->rb_node, maps__entries(maps));
 		/*
 		 * Now check if we need to create new maps for areas not
 		 * overlapped by the new map:
 		 */
-		if (map__start(new) > map__start(pos->map)) {
-			struct map *before = map__clone(pos->map);
+		if (map__start(new) > map__start(pos)) {
+			/* Map starts within existing map. Need to shorten the existing map. */
+			before = map__clone(pos);
 
 			if (before == NULL) {
 				err = -ENOMEM;
-				goto put_map;
+				goto out_err;
 			}
-
 			map__set_end(before, map__start(new));
-			err = __maps__insert(maps, before);
-			if (err) {
-				map__put(before);
-				goto put_map;
-			}
 
 			if (verbose >= 2 && !use_browser)
 				map__fprintf(before, fp);
-			map__put(before);
 		}
-
-		if (map__end(new) < map__end(pos->map)) {
-			struct map *after = map__clone(pos->map);
+		if (map__end(new) < map__end(pos)) {
+			/* The new map isn't as long as the existing map. */
+			after = map__clone(pos);
 
 			if (after == NULL) {
+				map__zput(before);
 				err = -ENOMEM;
-				goto put_map;
+				goto out_err;
 			}
 
 			map__set_start(after, map__end(new));
-			map__add_pgoff(after, map__end(new) - map__start(pos->map));
-			assert(map__map_ip(pos->map, map__end(new)) ==
-				map__map_ip(after, map__end(new)));
-			err = __maps__insert(maps, after);
-			if (err) {
-				map__put(after);
-				goto put_map;
-			}
+			map__add_pgoff(after, map__end(new) - map__start(pos));
+			assert(map__map_ip(pos, map__end(new)) ==
+			       map__map_ip(after, map__end(new)));
+
 			if (verbose >= 2 && !use_browser)
 				map__fprintf(after, fp);
-			map__put(after);
 		}
-put_map:
-		map__put(pos->map);
-		free(pos);
+		/*
+		 * If adding one entry, for `before` or `after`, we can replace
+		 * the existing entry. If both `before` and `after` are
+		 * necessary than an insert is needed. If the existing entry
+		 * entirely overlaps the existing entry it can just be removed.
+		 */
+		if (before) {
+			map__put(maps_by_address[i]);
+			maps_by_address[i] = before;
+			/* Maps are still ordered, go to next one. */
+			i++;
+			if (after) {
+				err = __maps__insert(maps, after);
+				map__put(after);
+				if (err)
+					goto out_err;
+				if (!maps__maps_by_address_sorted(maps)) {
+					/*
+					 * Sorting broken so invariants don't
+					 * hold, sort and go again.
+					 */
+					goto sort_again;
+				}
+				/*
+				 * Maps are still ordered, skip after and go to
+				 * next one (terminate loop).
+				 */
+				i++;
+			}
+		} else if (after) {
+			map__put(maps_by_address[i]);
+			maps_by_address[i] = after;
+			/* Maps are ordered, go to next one. */
+			i++;
+		} else {
+			__maps__remove(maps, pos);
+			/*
+			 * Maps are ordered but no need to increase `i` as the
+			 * later maps were moved down.
+			 */
+		}
+		check_invariants(maps);
 	}
 	/* Add the map. */
 	err = __maps__insert(maps, new);
-	up_write(maps__lock(maps));
+out_err:
 	return err;
 }
 
-int maps__copy_from(struct maps *maps, struct maps *parent)
+int maps__fixup_overlap_and_insert(struct maps *maps, struct map *new)
 {
 	int err;
-	struct map_rb_node *rb_node;
 
+	down_write(maps__lock(maps));
+	err =  __maps__fixup_overlap_and_insert(maps, new);
+	up_write(maps__lock(maps));
+	return err;
+}
+
+int maps__copy_from(struct maps *dest, struct maps *parent)
+{
+	/* Note, if struct map were immutable then cloning could use ref counts. */
+	struct map **parent_maps_by_address;
+	int err = 0;
+	unsigned int n;
+
+	down_write(maps__lock(dest));
 	down_read(maps__lock(parent));
 
-	maps__for_each_entry(parent, rb_node) {
-		struct map *new = map__clone(rb_node->map);
+	parent_maps_by_address = maps__maps_by_address(parent);
+	n = maps__nr_maps(parent);
+	if (maps__empty(dest)) {
+		/* No existing mappings so just copy from parent to avoid reallocs in insert. */
+		unsigned int nr_maps_allocated = RC_CHK_ACCESS(parent)->nr_maps_allocated;
+		struct map **dest_maps_by_address =
+			malloc(nr_maps_allocated * sizeof(struct map *));
+		struct map **dest_maps_by_name = NULL;
 
-		if (new == NULL) {
+		if (!dest_maps_by_address)
 			err = -ENOMEM;
-			goto out_unlock;
+		else {
+			if (maps__maps_by_name(parent)) {
+				dest_maps_by_name =
+					malloc(nr_maps_allocated * sizeof(struct map *));
+			}
+
+			RC_CHK_ACCESS(dest)->maps_by_address = dest_maps_by_address;
+			RC_CHK_ACCESS(dest)->maps_by_name = dest_maps_by_name;
+			RC_CHK_ACCESS(dest)->nr_maps_allocated = nr_maps_allocated;
 		}
 
-		err = unwind__prepare_access(maps, new, NULL);
-		if (err)
-			goto out_unlock;
+		for (unsigned int i = 0; !err && i < n; i++) {
+			struct map *pos = parent_maps_by_address[i];
+			struct map *new = map__clone(pos);
 
-		err = maps__insert(maps, new);
-		if (err)
-			goto out_unlock;
+			if (!new)
+				err = -ENOMEM;
+			else {
+				err = unwind__prepare_access(dest, new, NULL);
+				if (!err) {
+					dest_maps_by_address[i] = new;
+					if (dest_maps_by_name)
+						dest_maps_by_name[i] = map__get(new);
+					RC_CHK_ACCESS(dest)->nr_maps = i + 1;
+				}
+			}
+			if (err)
+				map__put(new);
+		}
+		maps__set_maps_by_address_sorted(dest, maps__maps_by_address_sorted(parent));
+		if (!err) {
+			RC_CHK_ACCESS(dest)->last_search_by_name_idx =
+				RC_CHK_ACCESS(parent)->last_search_by_name_idx;
+			maps__set_maps_by_name_sorted(dest,
+						dest_maps_by_name &&
+						maps__maps_by_name_sorted(parent));
+		} else {
+			RC_CHK_ACCESS(dest)->last_search_by_name_idx = 0;
+			maps__set_maps_by_name_sorted(dest, false);
+		}
+	} else {
+		/* Unexpected copying to a maps containing entries. */
+		for (unsigned int i = 0; !err && i < n; i++) {
+			struct map *pos = parent_maps_by_address[i];
+			struct map *new = map__clone(pos);
 
-		map__put(new);
+			if (!new)
+				err = -ENOMEM;
+			else {
+				err = unwind__prepare_access(dest, new, NULL);
+				if (!err)
+					err = __maps__insert(dest, new);
+			}
+			map__put(new);
+		}
 	}
-
-	err = 0;
-out_unlock:
 	up_read(maps__lock(parent));
+	up_write(maps__lock(dest));
 	return err;
 }
 
-struct map *maps__find(struct maps *maps, u64 ip)
+static int map__addr_cmp(const void *key, const void *entry)
 {
-	struct rb_node *p;
-	struct map_rb_node *m;
-
-
-	down_read(maps__lock(maps));
-
-	p = maps__entries(maps)->rb_node;
-	while (p != NULL) {
-		m = rb_entry(p, struct map_rb_node, rb_node);
-		if (ip < map__start(m->map))
-			p = p->rb_left;
-		else if (ip >= map__end(m->map))
-			p = p->rb_right;
-		else
-			goto out;
-	}
+	const u64 ip = *(const u64 *)key;
+	const struct map *map = *(const struct map * const *)entry;
 
-	m = NULL;
-out:
-	up_read(maps__lock(maps));
-	return m ? m->map : NULL;
+	if (ip < map__start(map))
+		return -1;
+	if (ip >= map__end(map))
+		return 1;
+	return 0;
 }
 
-static int map__strcmp(const void *a, const void *b)
+struct map *maps__find(struct maps *maps, u64 ip)
 {
-	const struct map *map_a = *(const struct map **)a;
-	const struct map *map_b = *(const struct map **)b;
-	const struct dso *dso_a = map__dso(map_a);
-	const struct dso *dso_b = map__dso(map_b);
-	int ret = strcmp(dso_a->short_name, dso_b->short_name);
+	struct map *result = NULL;
+	bool done = false;
 
-	if (ret == 0 && map_a != map_b) {
-		/*
-		 * Ensure distinct but name equal maps have an order in part to
-		 * aid reference counting.
-		 */
-		ret = (int)map__start(map_a) - (int)map__start(map_b);
-		if (ret == 0)
-			ret = (int)((intptr_t)map_a - (intptr_t)map_b);
+	/* See locking/sorting note. */
+	while (!done) {
+		down_read(maps__lock(maps));
+		if (maps__maps_by_address_sorted(maps)) {
+			struct map **mapp =
+				bsearch(&ip, maps__maps_by_address(maps), maps__nr_maps(maps),
+					sizeof(*mapp), map__addr_cmp);
+
+			if (mapp)
+				result = *mapp; // map__get(*mapp);
+			done = true;
+		}
+		up_read(maps__lock(maps));
+		if (!done)
+			maps__sort_by_address(maps);
 	}
-
-	return ret;
+	return result;
 }
 
 static int map__strcmp_name(const void *name, const void *b)
@@ -593,126 +886,113 @@
 	return strcmp(name, dso->short_name);
 }
 
-void __maps__sort_by_name(struct maps *maps)
-{
-	qsort(maps__maps_by_name(maps), maps__nr_maps(maps), sizeof(struct map *), map__strcmp);
-}
-
-static int map__groups__sort_by_name_from_rbtree(struct maps *maps)
-{
-	struct map_rb_node *rb_node;
-	struct map **maps_by_name = realloc(maps__maps_by_name(maps),
-					    maps__nr_maps(maps) * sizeof(struct map *));
-	int i = 0;
-
-	if (maps_by_name == NULL)
-		return -1;
-
-	up_read(maps__lock(maps));
-	down_write(maps__lock(maps));
-
-	RC_CHK_ACCESS(maps)->maps_by_name = maps_by_name;
-	RC_CHK_ACCESS(maps)->nr_maps_allocated = maps__nr_maps(maps);
-
-	maps__for_each_entry(maps, rb_node)
-		maps_by_name[i++] = map__get(rb_node->map);
-
-	__maps__sort_by_name(maps);
-
-	up_write(maps__lock(maps));
-	down_read(maps__lock(maps));
-
-	return 0;
-}
-
-static struct map *__maps__find_by_name(struct maps *maps, const char *name)
-{
-	struct map **mapp;
-
-	if (maps__maps_by_name(maps) == NULL &&
-	    map__groups__sort_by_name_from_rbtree(maps))
-		return NULL;
-
-	mapp = bsearch(name, maps__maps_by_name(maps), maps__nr_maps(maps),
-		       sizeof(*mapp), map__strcmp_name);
-	if (mapp)
-		return *mapp;
-	return NULL;
-}
-
 struct map *maps__find_by_name(struct maps *maps, const char *name)
 {
-	struct map_rb_node *rb_node;
-	struct map *map;
-
-	down_read(maps__lock(maps));
-
-
-	if (RC_CHK_ACCESS(maps)->last_search_by_name) {
-		const struct dso *dso = map__dso(RC_CHK_ACCESS(maps)->last_search_by_name);
+	struct map *result = NULL;
+	bool done = false;
 
-		if (strcmp(dso->short_name, name) == 0) {
-			map = RC_CHK_ACCESS(maps)->last_search_by_name;
-			goto out_unlock;
+	/* See locking/sorting note. */
+	while (!done) {
+		unsigned int i;
+
+		down_read(maps__lock(maps));
+
+		/* First check last found entry. */
+		i = RC_CHK_ACCESS(maps)->last_search_by_name_idx;
+		if (i < maps__nr_maps(maps) && maps__maps_by_name(maps)) {
+			struct dso *dso = map__dso(maps__maps_by_name(maps)[i]);
+
+			if (dso && strcmp(dso->short_name, name) == 0) {
+				result = maps__maps_by_name(maps)[i]; // TODO: map__get
+				done = true;
+			}
 		}
-	}
-	/*
-	 * If we have maps->maps_by_name, then the name isn't in the rbtree,
-	 * as maps->maps_by_name mirrors the rbtree when lookups by name are
-	 * made.
-	 */
-	map = __maps__find_by_name(maps, name);
-	if (map || maps__maps_by_name(maps) != NULL)
-		goto out_unlock;
 
-	/* Fallback to traversing the rbtree... */
-	maps__for_each_entry(maps, rb_node) {
-		struct dso *dso;
+		/* Second search sorted array. */
+		if (!done && maps__maps_by_name_sorted(maps)) {
+			struct map **mapp =
+				bsearch(name, maps__maps_by_name(maps), maps__nr_maps(maps),
+					sizeof(*mapp), map__strcmp_name);
+
+			if (mapp) {
+				result = *mapp; // TODO: map__get
+				i = mapp - maps__maps_by_name(maps);
+				RC_CHK_ACCESS(maps)->last_search_by_name_idx = i;
+			}
+			done = true;
+		}
+		up_read(maps__lock(maps));
+		if (!done) {
+			/* Sort and retry binary search. */
+			if (maps__sort_by_name(maps)) {
+				/*
+				 * Memory allocation failed do linear search
+				 * through address sorted maps.
+				 */
+				struct map **maps_by_address;
+				unsigned int n;
 
-		map = rb_node->map;
-		dso = map__dso(map);
-		if (strcmp(dso->short_name, name) == 0) {
-			RC_CHK_ACCESS(maps)->last_search_by_name = map;
-			goto out_unlock;
+				down_read(maps__lock(maps));
+				maps_by_address =  maps__maps_by_address(maps);
+				n = maps__nr_maps(maps);
+				for (i = 0; i < n; i++) {
+					struct map *pos = maps_by_address[i];
+					struct dso *dso = map__dso(pos);
+
+					if (dso && strcmp(dso->short_name, name) == 0) {
+						result = pos; // TODO: map__get
+						break;
+					}
+				}
+				up_read(maps__lock(maps));
+				done = true;
+			}
 		}
 	}
-	map = NULL;
-
-out_unlock:
-	up_read(maps__lock(maps));
-	return map;
+	return result;
 }
 
 struct map *maps__find_next_entry(struct maps *maps, struct map *map)
 {
-	struct map_rb_node *rb_node = maps__find_node(maps, map);
-	struct map_rb_node *next = map_rb_node__next(rb_node);
+	unsigned int i;
+	struct map *result = NULL;
 
-	if (next)
-		return next->map;
+	down_read(maps__lock(maps));
+	i = maps__by_address_index(maps, map);
+	if (i < maps__nr_maps(maps))
+		result = maps__maps_by_address(maps)[i]; // TODO: map__get
 
-	return NULL;
+	up_read(maps__lock(maps));
+	return result;
 }
 
 void maps__fixup_end(struct maps *maps)
 {
-	struct map_rb_node *prev = NULL, *curr;
+	struct map **maps_by_address;
+	unsigned int n;
 
 	down_write(maps__lock(maps));
+	if (!maps__maps_by_address_sorted(maps))
+		__maps__sort_by_address(maps);
 
-	maps__for_each_entry(maps, curr) {
-		if (prev && (!map__end(prev->map) || map__end(prev->map) > map__start(curr->map)))
-			map__set_end(prev->map, map__start(curr->map));
+	maps_by_address = maps__maps_by_address(maps);
+	n = maps__nr_maps(maps);
+	for (unsigned int i = 1; i < n; i++) {
+		struct map *prev = maps_by_address[i - 1];
+		struct map *curr = maps_by_address[i];
 
-		prev = curr;
+		if (!map__end(prev) || map__end(prev) > map__start(curr))
+			map__set_end(prev, map__start(curr));
 	}
 
 	/*
 	 * We still haven't the actual symbols, so guess the
 	 * last map final address.
 	 */
-	if (curr && !map__end(curr->map))
-		map__set_end(curr->map, ~0ULL);
+	if (n > 0 && !map__end(maps_by_address[n - 1]))
+		map__set_end(maps_by_address[n - 1], ~0ULL);
+
+	RC_CHK_ACCESS(maps)->ends_broken = false;
 
 	up_write(maps__lock(maps));
 }
@@ -723,117 +1003,93 @@
  */
 int maps__merge_in(struct maps *kmaps, struct map *new_map)
 {
-	struct map_rb_node *rb_node;
-	struct rb_node *first;
-	bool overlaps;
-	LIST_HEAD(merged);
-	int err = 0;
-
-	down_read(maps__lock(kmaps));
-	first = first_ending_after(kmaps, new_map);
-	rb_node = first ? rb_entry(first, struct map_rb_node, rb_node) : NULL;
-	overlaps = rb_node && map__start(rb_node->map) < map__end(new_map);
-	up_read(maps__lock(kmaps));
-
-	if (!overlaps)
-		return maps__insert(kmaps, new_map);
-
-	maps__for_each_entry(kmaps, rb_node) {
-		struct map *old_map = rb_node->map;
-
-		/* no overload with this one */
-		if (map__end(new_map) < map__start(old_map) ||
-		    map__start(new_map) >= map__end(old_map))
-			continue;
-
-		if (map__start(new_map) < map__start(old_map)) {
-			/*
-			 * |new......
-			 *       |old....
-			 */
-			if (map__end(new_map) < map__end(old_map)) {
-				/*
-				 * |new......|     -> |new..|
-				 *       |old....| ->       |old....|
-				 */
-				map__set_end(new_map, map__start(old_map));
-			} else {
-				/*
-				 * |new.............| -> |new..|       |new..|
-				 *       |old....|    ->       |old....|
-				 */
-				struct map_list_node *m = map_list_node__new();
-
-				if (!m) {
-					err = -ENOMEM;
-					goto out;
-				}
+	unsigned int first_after_, kmaps__nr_maps;
+	struct map **kmaps_maps_by_address;
+	struct map **merged_maps_by_address;
+	unsigned int merged_nr_maps_allocated;
+
+	/* First try under a read lock. */
+	while (true) {
+		down_read(maps__lock(kmaps));
+		if (maps__maps_by_address_sorted(kmaps))
+			break;
 
-				m->map = map__clone(new_map);
-				if (!m->map) {
-					free(m);
-					err = -ENOMEM;
-					goto out;
-				}
+		up_read(maps__lock(kmaps));
 
-				map__set_end(m->map, map__start(old_map));
-				list_add_tail(&m->node, &merged);
-				map__add_pgoff(new_map, map__end(old_map) - map__start(new_map));
-				map__set_start(new_map, map__end(old_map));
-			}
-		} else {
-			/*
-			 *      |new......
-			 * |old....
-			 */
-			if (map__end(new_map) < map__end(old_map)) {
-				/*
-				 *      |new..|   -> x
-				 * |old.........| -> |old.........|
-				 */
-				map__put(new_map);
-				new_map = NULL;
-				break;
-			} else {
-				/*
-				 *      |new......| ->         |new...|
-				 * |old....|        -> |old....|
-				 */
-				map__add_pgoff(new_map, map__end(old_map) - map__start(new_map));
-				map__set_start(new_map, map__end(old_map));
-			}
-		}
+		/* First after binary search requires sorted maps. Sort and try again. */
+		maps__sort_by_address(kmaps);
 	}
+	first_after_ = first_ending_after(kmaps, new_map);
+	kmaps_maps_by_address = maps__maps_by_address(kmaps);
 
-out:
-	while (!list_empty(&merged)) {
-		struct map_list_node *old_node;
-
-		old_node = list_entry(merged.next, struct map_list_node, node);
-		list_del_init(&old_node->node);
-		if (!err)
-			err = maps__insert(kmaps, old_node->map);
-		map__put(old_node->map);
-		free(old_node);
+	if (first_after_ >= maps__nr_maps(kmaps) ||
+	    map__start(kmaps_maps_by_address[first_after_]) >= map__end(new_map)) {
+		/* No overlap so regular insert suffices. */
+		up_read(maps__lock(kmaps));
+		return maps__insert(kmaps, new_map);
 	}
+	up_read(maps__lock(kmaps));
 
-	if (new_map) {
-		if (!err)
-			err = maps__insert(kmaps, new_map);
-		map__put(new_map);
+	/* Plain insert with a read-lock failed, try again now with the write lock. */
+	down_write(maps__lock(kmaps));
+	if (!maps__maps_by_address_sorted(kmaps))
+		__maps__sort_by_address(kmaps);
+
+	first_after_ = first_ending_after(kmaps, new_map);
+	kmaps_maps_by_address = maps__maps_by_address(kmaps);
+	kmaps__nr_maps = maps__nr_maps(kmaps);
+
+	if (first_after_ >= kmaps__nr_maps ||
+	    map__start(kmaps_maps_by_address[first_after_]) >= map__end(new_map)) {
+		/* No overlap so regular insert suffices. */
+		int ret = __maps__insert(kmaps, new_map);
+		up_write(maps__lock(kmaps));
+		return ret;
+	}
+	/* Array to merge into, possibly 1 more for the sake of new_map. */
+	merged_nr_maps_allocated = RC_CHK_ACCESS(kmaps)->nr_maps_allocated;
+	if (kmaps__nr_maps + 1 == merged_nr_maps_allocated)
+		merged_nr_maps_allocated++;
+
+	merged_maps_by_address = malloc(merged_nr_maps_allocated * sizeof(*merged_maps_by_address));
+	if (!merged_maps_by_address) {
+		up_write(maps__lock(kmaps));
+		return -ENOMEM;
 	}
-	return err;
+	maps__set_maps_by_address(kmaps, merged_maps_by_address);
+	maps__set_maps_by_address_sorted(kmaps, true);
+	zfree(maps__maps_by_name_addr(kmaps));
+	maps__set_maps_by_name_sorted(kmaps, true);
+	maps__set_nr_maps_allocated(kmaps, merged_nr_maps_allocated);
+
+	/* Copy entries before the new_map that can't overlap. */
+	for (unsigned int i = 0; i < first_after_; i++)
+		merged_maps_by_address[i] = map__get(kmaps_maps_by_address[i]);
+
+	maps__set_nr_maps(kmaps, first_after_);
+
+	/* Add the new map, it will be split when the later overlapping mappings are added. */
+	__maps__insert(kmaps, new_map);
+
+	/* Insert mappings after new_map, splitting new_map in the process. */
+	for (unsigned int i = first_after_; i < kmaps__nr_maps; i++)
+		__maps__fixup_overlap_and_insert(kmaps, kmaps_maps_by_address[i]);
+
+	/* Copy the maps from merged into kmaps. */
+	for (unsigned int i = 0; i < kmaps__nr_maps; i++)
+		map__zput(kmaps_maps_by_address[i]);
+
+	free(kmaps_maps_by_address);
+	up_write(maps__lock(kmaps));
+	return 0;
 }
 
 void maps__load_first(struct maps *maps)
 {
-	struct map_rb_node *first;
-
 	down_read(maps__lock(maps));
 
-	first = maps__first(maps);
-	if (first)
-		map__load(first->map);
+	if (maps__nr_maps(maps) > 0)
+		map__load(maps__maps_by_address(maps)[0]);
 
 	up_read(maps__lock(maps));
 }
--- linux-qcom-6.8.0.orig/tools/perf/util/maps.h
+++ linux-qcom-6.8.0/tools/perf/util/maps.h
@@ -25,21 +25,56 @@
 	return malloc(sizeof(struct map_list_node));
 }
 
-struct map *maps__find(struct maps *maps, u64 addr);
+/*
+ * Locking/sorting note:
+ *
+ * Sorting is done with the write lock, iteration and binary searching happens
+ * under the read lock requiring being sorted. There is a race between sorting
+ * releasing the write lock and acquiring the read lock for iteration/searching
+ * where another thread could insert and break the sorting of the maps. In
+ * practice inserting maps should be rare meaning that the race shouldn't lead
+ * to live lock. Removal of maps doesn't break being sorted.
+ */
 
 DECLARE_RC_STRUCT(maps) {
-	struct rb_root      entries;
 	struct rw_semaphore lock;
-	struct machine	 *machine;
-	struct map	 *last_search_by_name;
+	/**
+	 * @maps_by_address: array of maps sorted by their starting address if
+	 * maps_by_address_sorted is true.
+	 */
+	struct map	 **maps_by_address;
+	/**
+	 * @maps_by_name: optional array of maps sorted by their dso name if
+	 * maps_by_name_sorted is true.
+	 */
 	struct map	 **maps_by_name;
-	refcount_t	 refcnt;
-	unsigned int	 nr_maps;
-	unsigned int	 nr_maps_allocated;
+	struct machine	 *machine;
 #ifdef HAVE_LIBUNWIND_SUPPORT
-	void				*addr_space;
+	void		*addr_space;
 	const struct unwind_libunwind_ops *unwind_libunwind_ops;
 #endif
+	refcount_t	 refcnt;
+	/**
+	 * @nr_maps: number of maps_by_address, and possibly maps_by_name,
+	 * entries that contain maps.
+	 */
+	unsigned int	 nr_maps;
+	/**
+	 * @nr_maps_allocated: number of entries in maps_by_address and possibly
+	 * maps_by_name.
+	 */
+	unsigned int	 nr_maps_allocated;
+	/**
+	 * @last_search_by_name_idx: cache of last found by name entry's index
+	 * as frequent searches for the same dso name are common.
+	 */
+	unsigned int	 last_search_by_name_idx;
+	/** @maps_by_address_sorted: is maps_by_address sorted. */
+	bool		 maps_by_address_sorted;
+	/** @maps_by_name_sorted: is maps_by_name sorted. */
+	bool		 maps_by_name_sorted;
+	/** @ends_broken: does the map contain a map where end values are unset/unsorted? */
+	bool		 ends_broken;
 };
 
 #define KMAP_NAME_LEN 256
@@ -102,6 +137,7 @@
 int maps__insert(struct maps *maps, struct map *map);
 void maps__remove(struct maps *maps, struct map *map);
 
+struct map *maps__find(struct maps *maps, u64 addr);
 struct symbol *maps__find_symbol(struct maps *maps, u64 addr, struct map **mapp);
 struct symbol *maps__find_symbol_by_name(struct maps *maps, const char *name, struct map **mapp);
 
@@ -117,8 +153,6 @@
 
 int maps__merge_in(struct maps *kmaps, struct map *new_map);
 
-void __maps__sort_by_name(struct maps *maps);
-
 void maps__fixup_end(struct maps *maps);
 
 void maps__load_first(struct maps *maps);
--- linux-qcom-6.8.0.orig/tools/perf/util/perf_event_attr_fprintf.c
+++ linux-qcom-6.8.0/tools/perf/util/perf_event_attr_fprintf.c
@@ -7,6 +7,8 @@
 #include <linux/types.h>
 #include <linux/perf_event.h>
 #include "util/evsel_fprintf.h"
+#include "util/pmu.h"
+#include "util/pmus.h"
 #include "trace-event.h"
 
 struct bit_names {
@@ -75,9 +77,12 @@
 }
 
 #define ENUM_ID_TO_STR_CASE(x) case x: return (#x);
-static const char *stringify_perf_type_id(u64 value)
+static const char *stringify_perf_type_id(struct perf_pmu *pmu, u32 type)
 {
-	switch (value) {
+	if (pmu)
+		return pmu->name;
+
+	switch (type) {
 	ENUM_ID_TO_STR_CASE(PERF_TYPE_HARDWARE)
 	ENUM_ID_TO_STR_CASE(PERF_TYPE_SOFTWARE)
 	ENUM_ID_TO_STR_CASE(PERF_TYPE_TRACEPOINT)
@@ -175,9 +180,9 @@
 #define print_id_unsigned(_s)	PRINT_ID(_s, "%"PRIu64)
 #define print_id_hex(_s)	PRINT_ID(_s, "%#"PRIx64)
 
-static void __p_type_id(char *buf, size_t size, u64 value)
+static void __p_type_id(struct perf_pmu *pmu, char *buf, size_t size, u64 value)
 {
-	print_id_unsigned(stringify_perf_type_id(value));
+	print_id_unsigned(stringify_perf_type_id(pmu, value));
 }
 
 static void __p_config_hw_id(char *buf, size_t size, u64 value)
@@ -217,8 +222,14 @@
 }
 #endif
 
-static void __p_config_id(char *buf, size_t size, u32 type, u64 value)
+static void __p_config_id(struct perf_pmu *pmu, char *buf, size_t size, u32 type, u64 value)
 {
+	const char *name = perf_pmu__name_from_config(pmu, value);
+
+	if (name) {
+		print_id_hex(name);
+		return;
+	}
 	switch (type) {
 	case PERF_TYPE_HARDWARE:
 		return __p_config_hw_id(buf, size, value);
@@ -246,8 +257,8 @@
 #define p_sample_type(val)	__p_sample_type(buf, BUF_SIZE, val)
 #define p_branch_sample_type(val) __p_branch_sample_type(buf, BUF_SIZE, val)
 #define p_read_format(val)	__p_read_format(buf, BUF_SIZE, val)
-#define p_type_id(val)		__p_type_id(buf, BUF_SIZE, val)
-#define p_config_id(val)	__p_config_id(buf, BUF_SIZE, attr->type, val)
+#define p_type_id(val)		__p_type_id(pmu, buf, BUF_SIZE, val)
+#define p_config_id(val)	__p_config_id(pmu, buf, BUF_SIZE, attr->type, val)
 
 #define PRINT_ATTRn(_n, _f, _p, _a)			\
 do {							\
@@ -262,6 +273,7 @@
 int perf_event_attr__fprintf(FILE *fp, struct perf_event_attr *attr,
 			     attr__fprintf_f attr__fprintf, void *priv)
 {
+	struct perf_pmu *pmu = perf_pmus__find_by_type(attr->type);
 	char buf[BUF_SIZE];
 	int ret = 0;
 
--- linux-qcom-6.8.0.orig/tools/perf/util/pfm.c
+++ linux-qcom-6.8.0/tools/perf/util/pfm.c
@@ -233,7 +233,7 @@
 	}
 
 	if (is_libpfm_event_supported(name, cpus, threads)) {
-		print_cb->print_event(print_state, pinfo->name, topic,
+		print_cb->print_event(print_state, topic, pinfo->name,
 				      name, info->equiv,
 				      /*scale_unit=*/NULL,
 				      /*deprecated=*/NULL, "PFM event",
@@ -267,8 +267,8 @@
 				continue;
 
 			print_cb->print_event(print_state,
-					pinfo->name,
 					topic,
+					pinfo->name,
 					name, /*alias=*/NULL,
 					/*scale_unit=*/NULL,
 					/*deprecated=*/NULL, "PFM event",
--- linux-qcom-6.8.0.orig/tools/perf/util/pmu.c
+++ linux-qcom-6.8.0/tools/perf/util/pmu.c
@@ -36,6 +36,18 @@
 
 #define UNIT_MAX_LEN	31 /* max length for event unit name */
 
+enum event_source {
+	/* An event loaded from /sys/devices/<pmu>/events. */
+	EVENT_SRC_SYSFS,
+	/* An event loaded from a CPUID matched json file. */
+	EVENT_SRC_CPU_JSON,
+	/*
+	 * An event loaded from a /sys/devices/<pmu>/identifier matched json
+	 * file.
+	 */
+	EVENT_SRC_SYS_JSON,
+};
+
 /**
  * struct perf_pmu_alias - An event either read from sysfs or builtin in
  * pmu-events.c, created by parsing the pmu-events json files.
@@ -425,9 +437,30 @@
 {
 	struct perf_pmu_alias *alias;
 
-	if (load && !pmu->sysfs_aliases_loaded)
-		pmu_aliases_parse(pmu);
+	if (load && !pmu->sysfs_aliases_loaded) {
+		bool has_sysfs_event;
+		char event_file_name[FILENAME_MAX + 8];
+
+		/*
+		 * Test if alias/event 'name' exists in the PMU's sysfs/events
+		 * directory. If not skip parsing the sysfs aliases. Sysfs event
+		 * name must be all lower or all upper case.
+		 */
+		scnprintf(event_file_name, sizeof(event_file_name), "events/%s", name);
+		for (size_t i = 7, n = 7 + strlen(name); i < n; i++)
+			event_file_name[i] = tolower(event_file_name[i]);
+
+		has_sysfs_event = perf_pmu__file_exists(pmu, event_file_name);
+		if (!has_sysfs_event) {
+			for (size_t i = 7, n = 7 + strlen(name); i < n; i++)
+				event_file_name[i] = toupper(event_file_name[i]);
+
+			has_sysfs_event = perf_pmu__file_exists(pmu, event_file_name);
+		}
+		if (has_sysfs_event)
+			pmu_aliases_parse(pmu);
 
+	}
 	list_for_each_entry(alias, &pmu->aliases, list) {
 		if (!strcasecmp(alias->name, name))
 			return alias;
@@ -500,7 +533,7 @@
 
 static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name,
 				const char *desc, const char *val, FILE *val_fd,
-				const struct pmu_event *pe)
+			        const struct pmu_event *pe, enum event_source src)
 {
 	struct perf_pmu_alias *alias;
 	int ret;
@@ -552,25 +585,30 @@
 		}
 		snprintf(alias->unit, sizeof(alias->unit), "%s", unit);
 	}
-	if (!pe) {
-		/* Update an event from sysfs with json data. */
-		struct update_alias_data data = {
-			.pmu = pmu,
-			.alias = alias,
-		};
-
+	switch (src) {
+	default:
+	case EVENT_SRC_SYSFS:
 		alias->from_sysfs = true;
 		if (pmu->events_table) {
+			/* Update an event from sysfs with json data. */
+			struct update_alias_data data = {
+				.pmu = pmu,
+				.alias = alias,
+			};
 			if (pmu_events_table__find_event(pmu->events_table, pmu, name,
 							 update_alias, &data) == 0)
-				pmu->loaded_json_aliases++;
+				pmu->cpu_json_aliases++;
 		}
-	}
-
-	if (!pe)
 		pmu->sysfs_aliases++;
-	else
-		pmu->loaded_json_aliases++;
+		break;
+	case  EVENT_SRC_CPU_JSON:
+		pmu->cpu_json_aliases++;
+		break;
+	case  EVENT_SRC_SYS_JSON:
+		pmu->sys_json_aliases++;
+		break;
+
+	}
 	list_add_tail(&alias->list, &pmu->aliases);
 	return 0;
 }
@@ -646,7 +684,8 @@
 		}
 
 		if (perf_pmu__new_alias(pmu, name, /*desc=*/ NULL,
-					/*val=*/ NULL, file, /*pe=*/ NULL) < 0)
+					/*val=*/ NULL, file, /*pe=*/ NULL,
+					EVENT_SRC_SYSFS) < 0)
 			pr_debug("Cannot set up %s\n", name);
 		fclose(file);
 	}
@@ -899,7 +938,8 @@
 {
 	struct perf_pmu *pmu = vdata;
 
-	perf_pmu__new_alias(pmu, pe->name, pe->desc, pe->event, /*val_fd=*/ NULL, pe);
+	perf_pmu__new_alias(pmu, pe->name, pe->desc, pe->event, /*val_fd=*/ NULL,
+			    pe, EVENT_SRC_CPU_JSON);
 	return 0;
 }
 
@@ -934,13 +974,14 @@
 		return 0;
 
 	if (pmu_uncore_alias_match(pe->pmu, pmu->name) &&
-			pmu_uncore_identifier_match(pe->compat, pmu->id)) {
+	    pmu_uncore_identifier_match(pe->compat, pmu->id)) {
 		perf_pmu__new_alias(pmu,
 				pe->name,
 				pe->desc,
 				pe->event,
 				/*val_fd=*/ NULL,
-				pe);
+				pe,
+				EVENT_SRC_SYS_JSON);
 	}
 
 	return 0;
@@ -1019,10 +1060,9 @@
 	 * type value and format definitions. Load both right
 	 * now.
 	 */
-	if (pmu_format(pmu, dirfd, name)) {
-		free(pmu);
-		return NULL;
-	}
+	if (pmu_format(pmu, dirfd, name))
+		goto err;
+
 	pmu->is_core = is_pmu_core(name);
 	pmu->cpus = pmu_cpumask(dirfd, name, pmu->is_core);
 
@@ -1033,6 +1073,12 @@
 	pmu->max_precise = pmu_max_precise(dirfd, pmu);
 	pmu->alias_name = pmu_find_alias_name(pmu, dirfd);
 	pmu->events_table = perf_pmu__find_events_table(pmu);
+	/*
+	 * Load the sys json events/aliases when loading the PMU as each event
+	 * may have a different compat regular expression. We therefore can't
+	 * know the number of sys json events/aliases without computing the
+	 * regular expressions for them all.
+	 */
 	pmu_add_sys_aliases(pmu);
 	list_add_tail(&pmu->list, pmus);
 
@@ -1630,15 +1676,15 @@
 {
 	size_t nr;
 
-	if (!pmu->sysfs_aliases_loaded)
-		pmu_aliases_parse(pmu);
-
-	nr = pmu->sysfs_aliases;
+	pmu_aliases_parse(pmu);
+	nr = pmu->sysfs_aliases + pmu->sys_json_aliases;;
 
 	if (pmu->cpu_aliases_added)
-		 nr += pmu->loaded_json_aliases;
+		 nr += pmu->cpu_json_aliases;
 	else if (pmu->events_table)
-		nr += pmu_events_table__num_events(pmu->events_table, pmu) - pmu->loaded_json_aliases;
+		nr += pmu_events_table__num_events(pmu->events_table, pmu) - pmu->cpu_json_aliases;
+	else
+		assert(pmu->cpu_json_aliases == 0);
 
 	return pmu->selectable ? nr + 1 : nr;
 }
@@ -1691,6 +1737,7 @@
 	struct strbuf sb;
 
 	strbuf_init(&sb, /*hint=*/ 0);
+	pmu_aliases_parse(pmu);
 	pmu_add_cpu_aliases(pmu);
 	list_for_each_entry(event, &pmu->aliases, list) {
 		size_t buf_used;
@@ -1760,6 +1807,12 @@
 
 bool perf_pmu__is_software(const struct perf_pmu *pmu)
 {
+	const char *known_sw_pmus[] = {
+		"kprobe",
+		"msr",
+		"uprobe",
+	};
+
 	if (pmu->is_core || pmu->is_uncore || pmu->auxtrace)
 		return false;
 	switch (pmu->type) {
@@ -1771,7 +1824,11 @@
 	case PERF_TYPE_BREAKPOINT:	return true;
 	default: break;
 	}
-	return !strcmp(pmu->name, "kprobe") || !strcmp(pmu->name, "uprobe");
+	for (size_t i = 0; i < ARRAY_SIZE(known_sw_pmus); i++) {
+		if (!strcmp(pmu->name, known_sw_pmus[i]))
+			return true;
+	}
+	return false;
 }
 
 FILE *perf_pmu__open_file(const struct perf_pmu *pmu, const char *name)
@@ -2073,3 +2130,22 @@
 	zfree(&pmu->id);
 	free(pmu);
 }
+
+const char *perf_pmu__name_from_config(struct perf_pmu *pmu, u64 config)
+{
+	struct perf_pmu_alias *event;
+
+	if (!pmu)
+		return NULL;
+
+	pmu_aliases_parse(pmu);
+	pmu_add_cpu_aliases(pmu);
+	list_for_each_entry(event, &pmu->aliases, list) {
+		struct perf_event_attr attr = {.config = 0,};
+		int ret = perf_pmu__config(pmu, &attr, &event->terms, NULL);
+
+		if (ret == 0 && config == attr.config)
+			return event->name;
+	}
+	return NULL;
+}
--- linux-qcom-6.8.0.orig/tools/perf/util/pmu.h
+++ linux-qcom-6.8.0/tools/perf/util/pmu.h
@@ -121,8 +121,10 @@
 	const struct pmu_events_table *events_table;
 	/** @sysfs_aliases: Number of sysfs aliases loaded. */
 	uint32_t sysfs_aliases;
-	/** @sysfs_aliases: Number of json event aliases loaded. */
-	uint32_t loaded_json_aliases;
+	/** @cpu_json_aliases: Number of json event aliases loaded specific to the CPUID. */
+	uint32_t cpu_json_aliases;
+	/** @sys_json_aliases: Number of json event aliases loaded matching the PMU's identifier. */
+	uint32_t sys_json_aliases;
 	/** @sysfs_aliases_loaded: Are sysfs aliases loaded from disk? */
 	bool sysfs_aliases_loaded;
 	/**
@@ -266,5 +268,6 @@
 struct perf_pmu *perf_pmu__create_placeholder_core_pmu(struct list_head *core_pmus);
 void perf_pmu__delete(struct perf_pmu *pmu);
 struct perf_pmu *perf_pmus__find_core_pmu(void);
+const char *perf_pmu__name_from_config(struct perf_pmu *pmu, u64 config);
 
 #endif /* __PMU_H */
--- linux-qcom-6.8.0.orig/tools/perf/util/pmus.c
+++ linux-qcom-6.8.0/tools/perf/util/pmus.c
@@ -480,12 +480,12 @@
 	qsort(aliases, len, sizeof(struct sevent), cmp_sevent);
 	for (int j = 0; j < len; j++) {
 		/* Skip duplicates */
-		if (j > 0 && pmu_alias_is_duplicate(&aliases[j], &aliases[j - 1]))
-			continue;
+		if (j < len - 1 && pmu_alias_is_duplicate(&aliases[j], &aliases[j + 1]))
+			goto free;
 
 		print_cb->print_event(print_state,
-				aliases[j].pmu_name,
 				aliases[j].topic,
+				aliases[j].pmu_name,
 				aliases[j].name,
 				aliases[j].alias,
 				aliases[j].scale_unit,
@@ -494,6 +494,7 @@
 				aliases[j].desc,
 				aliases[j].long_desc,
 				aliases[j].encoding_desc);
+free:
 		zfree(&aliases[j].name);
 		zfree(&aliases[j].alias);
 		zfree(&aliases[j].scale_unit);
--- linux-qcom-6.8.0.orig/tools/perf/util/print-events.c
+++ linux-qcom-6.8.0/tools/perf/util/print-events.c
@@ -232,7 +232,6 @@
 bool is_event_supported(u8 type, u64 config)
 {
 	bool ret = true;
-	int open_return;
 	struct evsel *evsel;
 	struct perf_event_attr attr = {
 		.type = type,
@@ -246,20 +245,32 @@
 
 	evsel = evsel__new(&attr);
 	if (evsel) {
-		open_return = evsel__open(evsel, NULL, tmap);
-		ret = open_return >= 0;
+		ret = evsel__open(evsel, NULL, tmap) >= 0;
 
-		if (open_return == -EACCES) {
+		if (!ret) {
 			/*
-			 * This happens if the paranoid value
+			 * The event may fail to open if the paranoid value
 			 * /proc/sys/kernel/perf_event_paranoid is set to 2
-			 * Re-run with exclude_kernel set; we don't do that
-			 * by default as some ARM machines do not support it.
-			 *
+			 * Re-run with exclude_kernel set; we don't do that by
+			 * default as some ARM machines do not support it.
 			 */
 			evsel->core.attr.exclude_kernel = 1;
 			ret = evsel__open(evsel, NULL, tmap) >= 0;
 		}
+
+		if (!ret) {
+			/*
+			 * The event may fail to open if the PMU requires
+			 * exclude_guest to be set (e.g. as the Apple M1 PMU
+			 * requires).
+			 * Re-run with exclude_guest set; we don't do that by
+			 * default as it's equally legitimate for another PMU
+			 * driver to require that exclude_guest is clear.
+			 */
+			evsel->core.attr.exclude_guest = 1;
+			ret = evsel__open(evsel, NULL, tmap) >= 0;
+		}
+
 		evsel__delete(evsel);
 	}
 
--- linux-qcom-6.8.0.orig/tools/perf/util/probe-event.c
+++ linux-qcom-6.8.0/tools/perf/util/probe-event.c
@@ -11,6 +11,7 @@
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <errno.h>
+#include <libgen.h>
 #include <stdio.h>
 #include <unistd.h>
 #include <stdlib.h>
--- linux-qcom-6.8.0.orig/tools/perf/util/probe-finder.c
+++ linux-qcom-6.8.0/tools/perf/util/probe-finder.c
@@ -1381,6 +1381,10 @@
 	if (ret >= 0 && tf.pf.skip_empty_arg)
 		ret = fill_empty_trace_arg(pev, tf.tevs, tf.ntevs);
 
+#if _ELFUTILS_PREREQ(0, 142)
+	dwarf_cfi_end(tf.pf.cfi_eh);
+#endif
+
 	if (ret < 0 || tf.ntevs == 0) {
 		for (i = 0; i < tf.ntevs; i++)
 			clear_probe_trace_event(&tf.tevs[i]);
@@ -1585,8 +1589,21 @@
 
 	/* Find a corresponding function (name, baseline and baseaddr) */
 	if (die_find_realfunc(&cudie, (Dwarf_Addr)addr, &spdie)) {
-		/* Get function entry information */
-		func = basefunc = dwarf_diename(&spdie);
+		/*
+		 * Get function entry information.
+		 *
+		 * As described in the document DWARF Debugging Information
+		 * Format Version 5, section 2.22 Linkage Names, "mangled names,
+		 * are used in various ways, ... to distinguish multiple
+		 * entities that have the same name".
+		 *
+		 * Firstly try to get distinct linkage name, if fail then
+		 * rollback to get associated name in DIE.
+		 */
+		func = basefunc = die_get_linkage_name(&spdie);
+		if (!func)
+			func = basefunc = dwarf_diename(&spdie);
+
 		if (!func ||
 		    die_entrypc(&spdie, &baseaddr) != 0 ||
 		    dwarf_decl_line(&spdie, &baseline) != 0) {
--- linux-qcom-6.8.0.orig/tools/perf/util/probe-finder.h
+++ linux-qcom-6.8.0/tools/perf/util/probe-finder.h
@@ -64,9 +64,9 @@
 
 	/* For variable searching */
 #if _ELFUTILS_PREREQ(0, 142)
-	/* Call Frame Information from .eh_frame */
+	/* Call Frame Information from .eh_frame. Owned by this struct. */
 	Dwarf_CFI		*cfi_eh;
-	/* Call Frame Information from .debug_frame */
+	/* Call Frame Information from .debug_frame. Not owned. */
 	Dwarf_CFI		*cfi_dbg;
 #endif
 	Dwarf_Op		*fb_ops;	/* Frame base attribute */
--- linux-qcom-6.8.0.orig/tools/perf/util/python.c
+++ linux-qcom-6.8.0/tools/perf/util/python.c
@@ -103,6 +103,16 @@
 	return EOF;
 }
 
+const char *perf_pmu__name_from_config(struct perf_pmu *pmu __maybe_unused, u64 config __maybe_unused)
+{
+	return NULL;
+}
+
+struct perf_pmu *perf_pmus__find_by_type(unsigned int type __maybe_unused)
+{
+	return NULL;
+}
+
 int perf_pmus__num_core_pmus(void)
 {
 	return 1;
--- linux-qcom-6.8.0.orig/tools/perf/util/session.c
+++ linux-qcom-6.8.0/tools/perf/util/session.c
@@ -1511,6 +1511,9 @@
 	int ret = -EINVAL;
 	struct sample_read_value *v = sample->read.group.values;
 
+	if (tool->dont_split_sample_group)
+		return deliver_sample_value(evlist, tool, event, sample, v, machine);
+
 	sample_read_group__for_each(v, sample->read.group.nr, read_format) {
 		ret = deliver_sample_value(evlist, tool, event, sample, v,
 					   machine);
--- linux-qcom-6.8.0.orig/tools/perf/util/setup.py
+++ linux-qcom-6.8.0/tools/perf/util/setup.py
@@ -17,7 +17,7 @@
 
 def clang_has_option(option):
     cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines()
-    return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o))] == [ ]
+    return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ]
 
 if cc_is_clang:
     from sysconfig import get_config_vars
@@ -63,6 +63,8 @@
 cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter', '-Wno-redundant-decls', '-DPYTHON_PERF' ]
 if cc_is_clang:
     cflags += ["-Wno-unused-command-line-argument" ]
+    if clang_has_option("-Wno-cast-function-type-mismatch"):
+        cflags += ["-Wno-cast-function-type-mismatch" ]
 else:
     cflags += ['-Wno-cast-function-type' ]
 
--- linux-qcom-6.8.0.orig/tools/perf/util/sort.c
+++ linux-qcom-6.8.0/tools/perf/util/sort.c
@@ -333,7 +333,7 @@
 	 * comparing symbol address alone is not enough since it's a
 	 * relative address within a dso.
 	 */
-	if (!hists__has(left->hists, dso) || hists__has(right->hists, dso)) {
+	if (!hists__has(left->hists, dso)) {
 		ret = sort__dso_cmp(left, right);
 		if (ret != 0)
 			return ret;
--- linux-qcom-6.8.0.orig/tools/perf/util/srcline.c
+++ linux-qcom-6.8.0/tools/perf/util/srcline.c
@@ -399,6 +399,8 @@
 		kill(a2l->pid, SIGKILL);
 		finish_command(a2l); /* ignore result, we don't care */
 		a2l->pid = -1;
+		close(a2l->in);
+		close(a2l->out);
 	}
 
 	free(a2l);
--- linux-qcom-6.8.0.orig/tools/perf/util/stat-display.c
+++ linux-qcom-6.8.0/tools/perf/util/stat-display.c
@@ -560,7 +560,7 @@
 	if (color)
 		mlen += strlen(color) + sizeof(PERF_COLOR_RESET) - 1;
 
-	color_snprintf(str, sizeof(str), color ?: "", fmt, val);
+	color_snprintf(str, sizeof(str), color ?: "", fmt ?: "", val);
 	fprintf(out, "%*s ", mlen, str);
 	os->first = false;
 }
@@ -1207,6 +1207,10 @@
 
 	/* Print metrics headers only */
 	evlist__for_each_entry(evlist, counter) {
+		if (!config->iostat_run &&
+		    config->aggr_mode != AGGR_NONE && counter->metric_leader != counter)
+			continue;
+
 		os.evsel = counter;
 
 		perf_stat__print_shadow_stats(config, counter, 0,
--- linux-qcom-6.8.0.orig/tools/perf/util/stat-shadow.c
+++ linux-qcom-6.8.0/tools/perf/util/stat-shadow.c
@@ -176,6 +176,13 @@
 		if (type != evsel__stat_type(cur))
 			continue;
 
+		/*
+		 * Except the SW CLOCK events,
+		 * ignore if not the PMU we're looking for.
+		 */
+		if ((type != STAT_NSECS) && (evsel->pmu != cur->pmu))
+			continue;
+
 		aggr = &cur->stats->aggr[aggr_idx];
 		if (type == STAT_NSECS)
 			return aggr->counts.val;
@@ -414,12 +421,7 @@
 				val = NAN;
 				source_count = 0;
 			} else {
-				/*
-				 * If an event was scaled during stat gathering,
-				 * reverse the scale before computing the
-				 * metric.
-				 */
-				val = aggr->counts.val * (1.0 / metric_events[i]->scale);
+				val = aggr->counts.val;
 				source_count = evsel__source_count(metric_events[i]);
 			}
 		}
--- linux-qcom-6.8.0.orig/tools/perf/util/symbol.c
+++ linux-qcom-6.8.0/tools/perf/util/symbol.c
@@ -1255,7 +1255,7 @@
 {
 	struct maps *kmaps = map__kmaps(map);
 	struct kcore_mapfn_data md;
-	struct map *replacement_map = NULL;
+	struct map *map_ref, *replacement_map = NULL;
 	struct machine *machine;
 	bool is_64_bit;
 	int err, fd;
@@ -1333,6 +1333,24 @@
 	if (!replacement_map)
 		replacement_map = list_entry(md.maps.next, struct map_list_node, node)->map;
 
+	/*
+	 * Update addresses of vmlinux map. Re-insert it to ensure maps are
+	 * correctly ordered. Do this before using maps__merge_in() for the
+	 * remaining maps so vmlinux gets split if necessary.
+	 */
+	map_ref = map__get(map);
+	maps__remove(kmaps, map_ref);
+
+	map__set_start(map_ref, map__start(replacement_map));
+	map__set_end(map_ref, map__end(replacement_map));
+	map__set_pgoff(map_ref, map__pgoff(replacement_map));
+	map__set_mapping_type(map_ref, map__mapping_type(replacement_map));
+
+	err = maps__insert(kmaps, map_ref);
+	map__put(map_ref);
+	if (err)
+		goto out_err;
+
 	/* Add new maps */
 	while (!list_empty(&md.maps)) {
 		struct map_list_node *new_node = list_entry(md.maps.next, struct map_list_node, node);
@@ -1340,22 +1358,8 @@
 
 		list_del_init(&new_node->node);
 
-		if (RC_CHK_EQUAL(new_map, replacement_map)) {
-			struct map *map_ref;
-
-			map__set_start(map, map__start(new_map));
-			map__set_end(map, map__end(new_map));
-			map__set_pgoff(map, map__pgoff(new_map));
-			map__set_mapping_type(map, map__mapping_type(new_map));
-			/* Ensure maps are correctly ordered */
-			map_ref = map__get(map);
-			maps__remove(kmaps, map_ref);
-			err = maps__insert(kmaps, map_ref);
-			map__put(map_ref);
-			map__put(new_map);
-			if (err)
-				goto out_err;
-		} else {
+		/* skip if replacement_map, already inserted above */
+		if (!RC_CHK_EQUAL(new_map, replacement_map)) {
 			/*
 			 * Merge kcore map into existing maps,
 			 * and ensure that current maps (eBPF)
@@ -1760,7 +1764,7 @@
 	const char *map_path = dso->long_name;
 
 	mutex_lock(&dso->lock);
-	perfmap = strncmp(dso->name, "/tmp/perf-", 10) == 0;
+	perfmap = is_perf_pid_map_name(map_path);
 	if (perfmap) {
 		if (dso->nsinfo && (dso__find_perf_map(newmapname,
 		    sizeof(newmapname), &dso->nsinfo) == 0)) {
@@ -1937,6 +1941,10 @@
 	return ret;
 }
 
+/*
+ * Always takes ownership of vmlinux when vmlinux_allocated == true, even if
+ * it returns an error.
+ */
 int dso__load_vmlinux(struct dso *dso, struct map *map,
 		      const char *vmlinux, bool vmlinux_allocated)
 {
@@ -1955,8 +1963,11 @@
 	else
 		symtab_type = DSO_BINARY_TYPE__VMLINUX;
 
-	if (symsrc__init(&ss, dso, symfs_vmlinux, symtab_type))
+	if (symsrc__init(&ss, dso, symfs_vmlinux, symtab_type)) {
+		if (vmlinux_allocated)
+			free((char *) vmlinux);
 		return -1;
+	}
 
 	/*
 	 * dso__load_sym() may copy 'dso' which will result in the copies having
@@ -1999,7 +2010,6 @@
 		err = dso__load_vmlinux(dso, map, filename, true);
 		if (err > 0)
 			goto out;
-		free(filename);
 	}
 out:
 	return err;
@@ -2151,7 +2161,6 @@
 		err = dso__load_vmlinux(dso, map, filename, true);
 		if (err > 0)
 			return err;
-		free(filename);
 	}
 
 	if (!symbol_conf.ignore_vmlinux && vmlinux_path != NULL) {
--- linux-qcom-6.8.0.orig/tools/perf/util/syscalltbl.c
+++ linux-qcom-6.8.0/tools/perf/util/syscalltbl.c
@@ -42,6 +42,11 @@
 #include <asm/syscalls.c>
 const int syscalltbl_native_max_id = SYSCALLTBL_LOONGARCH_MAX_ID;
 static const char *const *syscalltbl_native = syscalltbl_loongarch;
+#else
+const int syscalltbl_native_max_id = 0;
+static const char *const syscalltbl_native[] = {
+	[0] = "unknown",
+};
 #endif
 
 struct syscall {
@@ -171,6 +176,11 @@
 	return audit_name_to_syscall(name, tbl->audit_machine);
 }
 
+int syscalltbl__id_at_idx(struct syscalltbl *tbl __maybe_unused, int idx)
+{
+	return idx;
+}
+
 int syscalltbl__strglobmatch_next(struct syscalltbl *tbl __maybe_unused,
 				  const char *syscall_glob __maybe_unused, int *idx __maybe_unused)
 {
--- linux-qcom-6.8.0.orig/tools/perf/util/thread.c
+++ linux-qcom-6.8.0/tools/perf/util/thread.c
@@ -39,12 +39,13 @@
 
 struct thread *thread__new(pid_t pid, pid_t tid)
 {
-	char *comm_str;
-	struct comm *comm;
 	RC_STRUCT(thread) *_thread = zalloc(sizeof(*_thread));
 	struct thread *thread;
 
 	if (ADD_RC_CHK(thread, _thread) != NULL) {
+		struct comm *comm;
+		char comm_str[32];
+
 		thread__set_pid(thread, pid);
 		thread__set_tid(thread, tid);
 		thread__set_ppid(thread, -1);
@@ -56,13 +57,8 @@
 		init_rwsem(thread__namespaces_lock(thread));
 		init_rwsem(thread__comm_lock(thread));
 
-		comm_str = malloc(32);
-		if (!comm_str)
-			goto err_thread;
-
-		snprintf(comm_str, 32, ":%d", tid);
+		snprintf(comm_str, sizeof(comm_str), ":%d", tid);
 		comm = comm__new(comm_str, 0, false);
-		free(comm_str);
 		if (!comm)
 			goto err_thread;
 
@@ -76,7 +72,7 @@
 	return thread;
 
 err_thread:
-	free(thread);
+	thread__delete(thread);
 	return NULL;
 }
 
--- linux-qcom-6.8.0.orig/tools/perf/util/thread_map.c
+++ linux-qcom-6.8.0/tools/perf/util/thread_map.c
@@ -280,13 +280,13 @@
 		threads->nr = ntasks;
 	}
 out:
+	strlist__delete(slist);
 	if (threads)
 		refcount_set(&threads->refcnt, 1);
 	return threads;
 
 out_free_threads:
 	zfree(&threads);
-	strlist__delete(slist);
 	goto out;
 }
 
--- linux-qcom-6.8.0.orig/tools/perf/util/time-utils.c
+++ linux-qcom-6.8.0/tools/perf/util/time-utils.c
@@ -20,7 +20,7 @@
 	u64 time_sec, time_nsec;
 	char *end;
 
-	time_sec = strtoul(str, &end, 10);
+	time_sec = strtoull(str, &end, 10);
 	if (*end != '.' && *end != '\0')
 		return -1;
 
@@ -38,7 +38,7 @@
 		for (i = strlen(nsec_buf); i < 9; i++)
 			nsec_buf[i] = '0';
 
-		time_nsec = strtoul(nsec_buf, &end, 10);
+		time_nsec = strtoull(nsec_buf, &end, 10);
 		if (*end != '\0')
 			return -1;
 	} else
--- linux-qcom-6.8.0.orig/tools/perf/util/tool.h
+++ linux-qcom-6.8.0/tools/perf/util/tool.h
@@ -85,6 +85,7 @@
 	bool		namespace_events;
 	bool		cgroup_events;
 	bool		no_warn;
+	bool		dont_split_sample_group;
 	enum show_feature_header show_feat_hdr;
 };
 
--- linux-qcom-6.8.0.orig/tools/power/acpi/Makefile.rules
+++ linux-qcom-6.8.0/tools/power/acpi/Makefile.rules
@@ -9,7 +9,7 @@
 toolobjs := $(addprefix $(objdir),$(TOOL_OBJS))
 $(OUTPUT)$(TOOL): $(toolobjs) FORCE
 	$(ECHO) "  LD      " $(subst $(OUTPUT),,$@)
-	$(QUIET) $(LD) $(CFLAGS) $(toolobjs) $(LDFLAGS) -L$(OUTPUT) -o $@
+	$(QUIET_LINK)$(CC) $(CFLAGS) $(toolobjs) $(LDFLAGS) -L$(OUTPUT) -o $@
 	$(ECHO) "  STRIP   " $(subst $(OUTPUT),,$@)
 	$(QUIET) $(STRIPCMD) $@
 
--- linux-qcom-6.8.0.orig/tools/power/cpupower/lib/powercap.c
+++ linux-qcom-6.8.0/tools/power/cpupower/lib/powercap.c
@@ -78,6 +78,14 @@
 }
 
 /*
+ * TODO: implement function. Returns dummy 0 for now.
+ */
+int powercap_set_enabled(int mode)
+{
+	return 0;
+}
+
+/*
  * Hardcoded, because rapl is the only powercap implementation
 - * this needs to get more generic if more powercap implementations
  * should show up
--- linux-qcom-6.8.0.orig/tools/power/cpupower/utils/helpers/amd.c
+++ linux-qcom-6.8.0/tools/power/cpupower/utils/helpers/amd.c
@@ -41,6 +41,16 @@
 		unsigned res1:31;
 		unsigned en:1;
 	} pstatedef;
+	/* since fam 1Ah: */
+	struct {
+		unsigned fid:12;
+		unsigned res1:2;
+		unsigned vid:8;
+		unsigned iddval:8;
+		unsigned idddiv:2;
+		unsigned res2:31;
+		unsigned en:1;
+	} pstatedef2;
 	unsigned long long val;
 };
 
@@ -48,6 +58,10 @@
 {
 	int t;
 
+	/* Fam 1Ah onward do not use did */
+	if (cpupower_cpu_info.family >= 0x1A)
+		return 0;
+
 	if (cpupower_cpu_info.caps & CPUPOWER_CAP_AMD_PSTATEDEF)
 		t = pstate.pstatedef.did;
 	else if (cpupower_cpu_info.family == 0x12)
@@ -61,12 +75,18 @@
 static int get_cof(union core_pstate pstate)
 {
 	int t;
-	int fid, did, cof;
+	int fid, did, cof = 0;
 
 	did = get_did(pstate);
 	if (cpupower_cpu_info.caps & CPUPOWER_CAP_AMD_PSTATEDEF) {
-		fid = pstate.pstatedef.fid;
-		cof = 200 * fid / did;
+		if (cpupower_cpu_info.family >= 0x1A) {
+			fid = pstate.pstatedef2.fid;
+			if (fid > 0x0f)
+				cof = (fid * 5);
+		} else {
+			fid = pstate.pstatedef.fid;
+			cof = 200 * fid / did;
+		}
 	} else {
 		t = 0x10;
 		fid = pstate.pstate.fid;
--- linux-qcom-6.8.0.orig/tools/power/x86/turbostat/turbostat.8
+++ linux-qcom-6.8.0/tools/power/x86/turbostat/turbostat.8
@@ -370,7 +370,7 @@
 
 Busy% = MPERF_delta/TSC_delta
 
-Bzy_MHz = TSC_delta/APERF_delta/MPERF_delta/measurement_interval
+Bzy_MHz = TSC_delta*APERF_delta/MPERF_delta/measurement_interval
 
 Note that these calculations depend on TSC_delta, so they
 are not reliable during intervals when TSC_MHz is not running at the base frequency.
--- linux-qcom-6.8.0.orig/tools/power/x86/turbostat/turbostat.c
+++ linux-qcom-6.8.0/tools/power/x86/turbostat/turbostat.c
@@ -53,6 +53,8 @@
 #define	NAME_BYTES 20
 #define PATH_BYTES 128
 
+#define MAX_NOFILE 0x8000
+
 enum counter_scope { SCOPE_CPU, SCOPE_CORE, SCOPE_PACKAGE };
 enum counter_type { COUNTER_ITEMS, COUNTER_CYCLES, COUNTER_SECONDS, COUNTER_USEC };
 enum counter_format { FORMAT_RAW, FORMAT_DELTA, FORMAT_PERCENT };
@@ -629,6 +631,23 @@
 	.enable_tsc_tweak = 1,
 };
 
+static const struct platform_features arl_features = {
+	.has_msr_misc_feature_control = 1,
+	.has_msr_misc_pwr_mgmt = 1,
+	.has_nhm_msrs = 1,
+	.has_config_tdp = 1,
+	.bclk_freq = BCLK_100MHZ,
+	.supported_cstates = CC1 | CC6 | CC7 | PC2 | PC3 | PC6 | PC10,
+	.cst_limit = CST_LIMIT_HSW,
+	.has_irtl_msrs = 1,
+	.has_msr_core_c1_res = 1,
+	.has_ext_cst_msrs = 1,
+	.trl_msrs = TRL_BASE,
+	.tcc_offset_bits = 6,
+	.rapl_msrs = RAPL_PKG_ALL | RAPL_CORE_ALL | RAPL_DRAM | RAPL_DRAM_PERF_STATUS | RAPL_GFX,
+	.enable_tsc_tweak = 1,
+};
+
 static const struct platform_features skx_features = {
 	.has_msr_misc_feature_control = 1,
 	.has_msr_misc_pwr_mgmt = 1,
@@ -870,8 +889,10 @@
 	{ INTEL_FAM6_RAPTORLAKE_S, &adl_features },
 	{ INTEL_FAM6_METEORLAKE, &cnl_features },
 	{ INTEL_FAM6_METEORLAKE_L, &cnl_features },
-	{ INTEL_FAM6_ARROWLAKE, &cnl_features },
-	{ INTEL_FAM6_LUNARLAKE_M, &cnl_features },
+	{ INTEL_FAM6_ARROWLAKE_H, &arl_features },
+	{ INTEL_FAM6_ARROWLAKE_U, &arl_features },
+	{ INTEL_FAM6_ARROWLAKE, &arl_features },
+	{ INTEL_FAM6_LUNARLAKE_M, &arl_features },
 	{ INTEL_FAM6_ATOM_SILVERMONT, &slv_features },
 	{ INTEL_FAM6_ATOM_SILVERMONT_D, &slvd_features },
 	{ INTEL_FAM6_ATOM_AIRMONT, &amt_features },
@@ -989,8 +1010,8 @@
 	unsigned long long pc8;
 	unsigned long long pc9;
 	unsigned long long pc10;
-	unsigned long long cpu_lpi;
-	unsigned long long sys_lpi;
+	long long cpu_lpi;
+	long long sys_lpi;
 	unsigned long long pkg_wtd_core_c0;
 	unsigned long long pkg_any_core_c0;
 	unsigned long long pkg_any_gfxe_c0;
@@ -1176,6 +1197,7 @@
 	int allowed_cpus;
 	int allowed_cores;
 	int max_cpu_num;
+	int max_die_id;
 	int max_node_num;
 	int nodes_per_pkg;
 	int cores_per_node;
@@ -1976,12 +1998,22 @@
 	if (DO_BIC(BIC_Pkgpc10))
 		outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * p->pc10 / tsc);
 
-	if (DO_BIC(BIC_CPU_LPI))
-		outp +=
-		    sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * p->cpu_lpi / 1000000.0 / interval_float);
-	if (DO_BIC(BIC_SYS_LPI))
-		outp +=
-		    sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * p->sys_lpi / 1000000.0 / interval_float);
+	if (DO_BIC(BIC_CPU_LPI)) {
+		if (p->cpu_lpi >= 0)
+			outp +=
+			    sprintf(outp, "%s%.2f", (printed++ ? delim : ""),
+				    100.0 * p->cpu_lpi / 1000000.0 / interval_float);
+		else
+			outp += sprintf(outp, "%s(neg)", (printed++ ? delim : ""));
+	}
+	if (DO_BIC(BIC_SYS_LPI)) {
+		if (p->sys_lpi >= 0)
+			outp +=
+			    sprintf(outp, "%s%.2f", (printed++ ? delim : ""),
+				    100.0 * p->sys_lpi / 1000000.0 / interval_float);
+		else
+			outp += sprintf(outp, "%s(neg)", (printed++ ? delim : ""));
+	}
 
 	if (DO_BIC(BIC_PkgWatt))
 		outp +=
@@ -2444,9 +2476,10 @@
 	average.packages.rapl_dram_perf_status += p->rapl_dram_perf_status;
 
 	for (i = 0, mp = sys.pp; mp; i++, mp = mp->next) {
-		if (mp->format == FORMAT_RAW)
-			continue;
-		average.packages.counter[i] += p->counter[i];
+		if ((mp->format == FORMAT_RAW) && (topo.num_packages == 0))
+			average.packages.counter[i] = p->counter[i];
+		else
+			average.packages.counter[i] += p->counter[i];
 	}
 	return 0;
 }
@@ -2599,7 +2632,7 @@
 {
 	char path[128];
 
-	sprintf(path, "/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/current_freq_khz", package,
+	sprintf(path, "/sys/devices/system/cpu/intel_uncore_frequency/package_%02d_die_%02d/current_freq_khz", package,
 		die);
 
 	return (snapshot_sysfs_counter(path) / 1000);
@@ -3619,6 +3652,9 @@
 		if (*next == '-')	/* no negative cpu numbers */
 			return 1;
 
+		if (*next == '\0' || *next == '\n')
+			break;
+
 		start = strtoul(next, &next, 10);
 
 		if (start >= CPU_SUBSET_MAXCPUS)
@@ -3829,7 +3865,8 @@
 {
 	free_all_buffers();
 	setup_all_buffers(false);
-	fprintf(outf, "turbostat: re-initialized with num_cpus %d, allowed_cpus %d\n", topo.num_cpus, topo.allowed_cpus);
+	fprintf(outf, "turbostat: re-initialized with num_cpus %d, allowed_cpus %d\n", topo.num_cpus,
+		topo.allowed_cpus);
 }
 
 void set_max_cpu_num(void)
@@ -4567,20 +4604,15 @@
 static void probe_intel_uncore_frequency(void)
 {
 	int i, j;
-	char path[128];
+	char path[256];
 
 	if (!genuine_intel)
 		return;
 
-	if (access("/sys/devices/system/cpu/intel_uncore_frequency/package_00_die_00", R_OK))
-		return;
-
-	/* Cluster level sysfs not supported yet. */
-	if (!access("/sys/devices/system/cpu/intel_uncore_frequency/uncore00", R_OK))
-		return;
+	if (access("/sys/devices/system/cpu/intel_uncore_frequency/package_00_die_00/current_freq_khz", R_OK))
+		goto probe_cluster;
 
-	if (!access("/sys/devices/system/cpu/intel_uncore_frequency/package_00_die_00/current_freq_khz", R_OK))
-		BIC_PRESENT(BIC_UNCORE_MHZ);
+	BIC_PRESENT(BIC_UNCORE_MHZ);
 
 	if (quiet)
 		return;
@@ -4588,26 +4620,73 @@
 	for (i = 0; i < topo.num_packages; ++i) {
 		for (j = 0; j < topo.num_die; ++j) {
 			int k, l;
+			char path_base[128];
+
+			sprintf(path_base, "/sys/devices/system/cpu/intel_uncore_frequency/package_%02d_die_%02d", i,
+				j);
 
-			sprintf(path, "/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/min_freq_khz",
-				i, j);
+			sprintf(path, "%s/min_freq_khz", path_base);
 			k = read_sysfs_int(path);
-			sprintf(path, "/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/max_freq_khz",
-				i, j);
+			sprintf(path, "%s/max_freq_khz", path_base);
 			l = read_sysfs_int(path);
-			fprintf(outf, "Uncore Frequency pkg%d die%d: %d - %d MHz ", i, j, k / 1000, l / 1000);
+			fprintf(outf, "Uncore Frequency package%d die%d: %d - %d MHz ", i, j, k / 1000, l / 1000);
 
-			sprintf(path,
-				"/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/initial_min_freq_khz",
-				i, j);
+			sprintf(path, "%s/initial_min_freq_khz", path_base);
 			k = read_sysfs_int(path);
-			sprintf(path,
-				"/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/initial_max_freq_khz",
-				i, j);
+			sprintf(path, "%s/initial_max_freq_khz", path_base);
 			l = read_sysfs_int(path);
-			fprintf(outf, "(%d - %d MHz)\n", k / 1000, l / 1000);
+			fprintf(outf, "(%d - %d MHz)", k / 1000, l / 1000);
+
+			sprintf(path, "%s/current_freq_khz", path_base);
+			k = read_sysfs_int(path);
+			fprintf(outf, " %d MHz\n", k / 1000);
 		}
 	}
+	return;
+
+probe_cluster:
+	if (access("/sys/devices/system/cpu/intel_uncore_frequency/uncore00/current_freq_khz", R_OK))
+		return;
+
+	if (quiet)
+		return;
+
+	for (i = 0;; ++i) {
+		int k, l;
+		char path_base[128];
+		int package_id, domain_id, cluster_id;
+
+		sprintf(path_base, "/sys/devices/system/cpu/intel_uncore_frequency/uncore%02d", i);
+
+		if (access(path_base, R_OK))
+			break;
+
+		sprintf(path, "%s/package_id", path_base);
+		package_id = read_sysfs_int(path);
+
+		sprintf(path, "%s/domain_id", path_base);
+		domain_id = read_sysfs_int(path);
+
+		sprintf(path, "%s/fabric_cluster_id", path_base);
+		cluster_id = read_sysfs_int(path);
+
+		sprintf(path, "%s/min_freq_khz", path_base);
+		k = read_sysfs_int(path);
+		sprintf(path, "%s/max_freq_khz", path_base);
+		l = read_sysfs_int(path);
+		fprintf(outf, "Uncore Frequency package%d domain%d cluster%d: %d - %d MHz ", package_id, domain_id,
+			cluster_id, k / 1000, l / 1000);
+
+		sprintf(path, "%s/initial_min_freq_khz", path_base);
+		k = read_sysfs_int(path);
+		sprintf(path, "%s/initial_max_freq_khz", path_base);
+		l = read_sysfs_int(path);
+		fprintf(outf, "(%d - %d MHz)", k / 1000, l / 1000);
+
+		sprintf(path, "%s/current_freq_khz", path_base);
+		k = read_sysfs_int(path);
+		fprintf(outf, " %d MHz\n", k / 1000);
+	}
 }
 
 static void probe_graphics(void)
@@ -5489,7 +5568,8 @@
 
 	fd = open(path, O_RDONLY);
 	if (fd < 0) {
-		warnx("capget(CAP_SYS_ADMIN) failed, try \"# setcap cap_sys_admin=ep %s\"", progname);
+		if (debug)
+			warnx("Read %s failed", path);
 		return;
 	}
 
@@ -5623,6 +5703,7 @@
 	unsigned int eax, ebx, ecx, edx;
 	unsigned int fms, family, model, stepping, ecx_flags, edx_flags;
 	unsigned long long ucode_patch = 0;
+	bool ucode_patch_valid = false;
 
 	eax = ebx = ecx = edx = 0;
 
@@ -5652,6 +5733,8 @@
 
 	if (get_msr(sched_getcpu(), MSR_IA32_UCODE_REV, &ucode_patch))
 		warnx("get_msr(UCODE)");
+	else
+		ucode_patch_valid = true;
 
 	/*
 	 * check max extended function levels of CPUID.
@@ -5662,9 +5745,12 @@
 	__cpuid(0x80000000, max_extended_level, ebx, ecx, edx);
 
 	if (!quiet) {
-		fprintf(outf, "CPUID(1): family:model:stepping 0x%x:%x:%x (%d:%d:%d) microcode 0x%x\n",
-			family, model, stepping, family, model, stepping,
-			(unsigned int)((ucode_patch >> 32) & 0xFFFFFFFF));
+		fprintf(outf, "CPUID(1): family:model:stepping 0x%x:%x:%x (%d:%d:%d)",
+			family, model, stepping, family, model, stepping);
+		if (ucode_patch_valid)
+			fprintf(outf, " microcode 0x%x", (unsigned int)((ucode_patch >> 32) & 0xFFFFFFFF));
+		fputc('\n', outf);
+
 		fprintf(outf, "CPUID(0x80000000): max_extended_levels: 0x%x\n", max_extended_level);
 		fprintf(outf, "CPUID(1): %s %s %s %s %s %s %s %s %s %s\n",
 			ecx_flags & (1 << 0) ? "SSE3" : "-",
@@ -5838,7 +5924,6 @@
 	int i;
 	int max_core_id = 0;
 	int max_package_id = 0;
-	int max_die_id = 0;
 	int max_siblings = 0;
 
 	/* Initialize num_cpus, max_cpu_num */
@@ -5955,8 +6040,8 @@
 
 		/* get die information */
 		cpus[i].die_id = get_die_id(i);
-		if (cpus[i].die_id > max_die_id)
-			max_die_id = cpus[i].die_id;
+		if (cpus[i].die_id > topo.max_die_id)
+			topo.max_die_id = cpus[i].die_id;
 
 		/* get numa node information */
 		cpus[i].physical_node_id = get_physical_node_id(&cpus[i]);
@@ -5982,9 +6067,9 @@
 	if (!summary_only && topo.cores_per_node > 1)
 		BIC_PRESENT(BIC_Core);
 
-	topo.num_die = max_die_id + 1;
+	topo.num_die = topo.max_die_id + 1;
 	if (debug > 1)
-		fprintf(outf, "max_die_id %d, sizing for %d die\n", max_die_id, topo.num_die);
+		fprintf(outf, "max_die_id %d, sizing for %d die\n", topo.max_die_id, topo.num_die);
 	if (!summary_only && topo.num_die > 1)
 		BIC_PRESENT(BIC_Die);
 
@@ -6142,6 +6227,7 @@
 	topo.allowed_packages = 0;
 	for_all_cpus(update_topo, ODD_COUNTERS);
 }
+
 void setup_all_buffers(bool startup)
 {
 	topology_probe(startup);
@@ -6704,6 +6790,22 @@
 	}
 }
 
+void set_rlimit(void)
+{
+	struct rlimit limit;
+
+	if (getrlimit(RLIMIT_NOFILE, &limit) < 0)
+		err(1, "Failed to get rlimit");
+
+	if (limit.rlim_max < MAX_NOFILE)
+		limit.rlim_max = MAX_NOFILE;
+	if (limit.rlim_cur < MAX_NOFILE)
+		limit.rlim_cur = MAX_NOFILE;
+
+	if (setrlimit(RLIMIT_NOFILE, &limit) < 0)
+		err(1, "Failed to set rlimit");
+}
+
 int main(int argc, char **argv)
 {
 	int fd, ret;
@@ -6729,6 +6831,9 @@
 
 	probe_sysfs();
 
+	if (!getuid())
+		set_rlimit();
+
 	turbostat_init();
 
 	msr_sum_record();
--- linux-qcom-6.8.0.orig/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ linux-qcom-6.8.0/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -1241,6 +1241,7 @@
 	retval = fscanf(fp, "%d\n", &pkg);
 	if (retval != 1)
 		errx(1, "%s: failed to parse", pathname);
+	fclose(fp);
 	return pkg;
 }
 
--- linux-qcom-6.8.0.orig/tools/scripts/Makefile.arch
+++ linux-qcom-6.8.0/tools/scripts/Makefile.arch
@@ -7,8 +7,8 @@
                                   -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ \
                                   -e s/riscv.*/riscv/ -e s/loongarch.*/loongarch/)
 
-ifndef ARCH
-ARCH := $(HOSTARCH)
+ifeq ($(strip $(ARCH)),)
+override ARCH := $(HOSTARCH)
 endif
 
 SRCARCH := $(ARCH)
--- linux-qcom-6.8.0.orig/tools/testing/cxl/test/cxl.c
+++ linux-qcom-6.8.0/tools/testing/cxl/test/cxl.c
@@ -630,11 +630,15 @@
 					  struct cxl_endpoint_dvsec_info *info)
 {
 	struct cxl_hdm *cxlhdm = devm_kzalloc(&port->dev, sizeof(*cxlhdm), GFP_KERNEL);
+	struct device *dev = &port->dev;
 
 	if (!cxlhdm)
 		return ERR_PTR(-ENOMEM);
 
 	cxlhdm->port = port;
+	cxlhdm->interleave_mask = ~0U;
+	cxlhdm->iw_cap_mask = ~0UL;
+	dev_set_drvdata(dev, cxlhdm);
 	return cxlhdm;
 }
 
@@ -689,26 +693,22 @@
 	return 0;
 }
 
-static int mock_decoder_reset(struct cxl_decoder *cxld)
+static void mock_decoder_reset(struct cxl_decoder *cxld)
 {
 	struct cxl_port *port = to_cxl_port(cxld->dev.parent);
 	int id = cxld->id;
 
 	if ((cxld->flags & CXL_DECODER_F_ENABLE) == 0)
-		return 0;
+		return;
 
 	dev_dbg(&port->dev, "%s reset\n", dev_name(&cxld->dev));
-	if (port->commit_end != id) {
+	if (port->commit_end == id)
+		cxl_port_commit_reap(cxld);
+	else
 		dev_dbg(&port->dev,
 			"%s: out of order reset, expected decoder%d.%d\n",
 			dev_name(&cxld->dev), port->id, port->commit_end);
-		return -EBUSY;
-	}
-
-	port->commit_end--;
 	cxld->flags &= ~CXL_DECODER_F_ENABLE;
-
-	return 0;
 }
 
 static void default_mock_decoder(struct cxl_decoder *cxld)
--- linux-qcom-6.8.0.orig/tools/testing/cxl/test/mem.c
+++ linux-qcom-6.8.0/tools/testing/cxl/test/mem.c
@@ -3,6 +3,7 @@
 
 #include <linux/platform_device.h>
 #include <linux/mod_devicetable.h>
+#include <linux/vmalloc.h>
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/sizes.h>
--- linux-qcom-6.8.0.orig/tools/testing/ktest/ktest.pl
+++ linux-qcom-6.8.0/tools/testing/ktest/ktest.pl
@@ -843,6 +843,7 @@
     if ($lvalue =~ /^(TEST|BISECT|CONFIG_BISECT)_TYPE(\[.*\])?$/ &&
 	$prvalue !~ /^(config_|)bisect$/ &&
 	$prvalue !~ /^build$/ &&
+	$prvalue !~ /^make_warnings_file$/ &&
 	$buildonly) {
 
 	# Note if a test is something other than build, then we
@@ -2042,7 +2043,7 @@
     } elsif ($reboot_type eq "grub2") {
 	$command = "cat $grub_file";
 	$target = '^\s*menuentry.*' . $grub_menu_qt;
-	$skip = '^\s*menuentry';
+	$skip = '^\s*menuentry\s';
 	$submenu = '^\s*submenu\s';
     } elsif ($reboot_type eq "grub2bls") {
 	$command = $grub_bls_get;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/Makefile
@@ -191,6 +191,8 @@
 	@for TARGET in $(TARGETS); do \
 		BUILD_TARGET=$$BUILD/$$TARGET;	\
 		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests \
+				SRC_PATH=$(shell readlink -e $$(pwd)) \
+				OBJ_PATH=$(BUILD)                   \
 				O=$(abs_objtree);		    \
 	done;
 
@@ -241,7 +243,10 @@
 	@ret=1;	\
 	for TARGET in $(TARGETS); do \
 		BUILD_TARGET=$$BUILD/$$TARGET;	\
-		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET INSTALL_PATH=$(INSTALL_PATH)/$$TARGET install \
+		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET install \
+				INSTALL_PATH=$(INSTALL_PATH)/$$TARGET \
+				SRC_PATH=$(shell readlink -e $$(pwd)) \
+				OBJ_PATH=$(INSTALL_PATH) \
 				O=$(abs_objtree)		\
 				$(if $(FORCE_TARGETS),|| exit);	\
 		ret=$$((ret * $$?));		\
--- linux-qcom-6.8.0.orig/tools/testing/selftests/alsa/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/alsa/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 #
 
-CFLAGS += $(shell pkg-config --cflags alsa)
+CFLAGS += $(shell pkg-config --cflags alsa) $(KHDR_INCLUDES)
 LDLIBS += $(shell pkg-config --libs alsa)
 ifeq ($(LDLIBS),)
 LDLIBS += -lasound
@@ -23,5 +23,5 @@
 $(OUTPUT)/libatest.so: conf.c alsa-local.h
 	$(CC) $(CFLAGS) -shared -fPIC $< $(LDLIBS) -o $@
 
-$(OUTPUT)/%: %.c $(TEST_GEN_PROGS_EXTENDED) alsa-local.h
+$(OUTPUT)/%: %.c $(OUTPUT)/libatest.so alsa-local.h
 	$(CC) $(CFLAGS) $< $(LDLIBS) -latest -o $@
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/abi/syscall-abi-asm.S
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/abi/syscall-abi-asm.S
@@ -81,32 +81,31 @@
 	stp	x27, x28, [sp, #96]
 
 	// Set SVCR if we're doing SME
-	cbz	x1, 1f
+	cbz	x1, load_gpr
 	adrp	x2, svcr_in
 	ldr	x2, [x2, :lo12:svcr_in]
 	msr	S3_3_C4_C2_2, x2
-1:
 
 	// Load ZA and ZT0 if enabled - uses x12 as scratch due to SME LDR
-	tbz	x2, #SVCR_ZA_SHIFT, 1f
+	tbz	x2, #SVCR_ZA_SHIFT, load_gpr
 	mov	w12, #0
 	ldr	x2, =za_in
-2:	_ldr_za 12, 2
+1:	_ldr_za 12, 2
 	add	x2, x2, x1
 	add	x12, x12, #1
 	cmp	x1, x12
-	bne	2b
+	bne	1b
 
 	// ZT0
 	mrs	x2, S3_0_C0_C4_5	// ID_AA64SMFR0_EL1
 	ubfx	x2, x2, #ID_AA64SMFR0_EL1_SMEver_SHIFT, \
 			 #ID_AA64SMFR0_EL1_SMEver_WIDTH
-	cbz	x2, 1f
+	cbz	x2, load_gpr
 	adrp	x2, zt_in
 	add	x2, x2, :lo12:zt_in
 	_ldr_zt 2
-1:
 
+load_gpr:
 	// Load GPRs x8-x28, and save our SP/FP for later comparison
 	ldr	x2, =gpr_in
 	add	x2, x2, #64
@@ -125,9 +124,9 @@
 	str	x30, [x2], #8		// LR
 
 	// Load FPRs if we're not doing neither SVE nor streaming SVE
-	cbnz	x0, 1f
+	cbnz	x0, check_sve_in
 	ldr	x2, =svcr_in
-	tbnz	x2, #SVCR_SM_SHIFT, 1f
+	tbnz	x2, #SVCR_SM_SHIFT, check_sve_in
 
 	ldr	x2, =fpr_in
 	ldp	q0, q1, [x2]
@@ -148,8 +147,8 @@
 	ldp	q30, q31, [x2, #16 * 30]
 
 	b	2f
-1:
 
+check_sve_in:
 	// Load the SVE registers if we're doing SVE/SME
 
 	ldr	x2, =z_in
@@ -256,32 +255,31 @@
 	stp	q30, q31, [x2, #16 * 30]
 
 	// Save SVCR if we're doing SME
-	cbz	x1, 1f
+	cbz	x1, check_sve_out
 	mrs	x2, S3_3_C4_C2_2
 	adrp	x3, svcr_out
 	str	x2, [x3, :lo12:svcr_out]
-1:
 
 	// Save ZA if it's enabled - uses x12 as scratch due to SME STR
-	tbz	x2, #SVCR_ZA_SHIFT, 1f
+	tbz	x2, #SVCR_ZA_SHIFT, check_sve_out
 	mov	w12, #0
 	ldr	x2, =za_out
-2:	_str_za 12, 2
+1:	_str_za 12, 2
 	add	x2, x2, x1
 	add	x12, x12, #1
 	cmp	x1, x12
-	bne	2b
+	bne	1b
 
 	// ZT0
 	mrs	x2, S3_0_C0_C4_5	// ID_AA64SMFR0_EL1
 	ubfx	x2, x2, #ID_AA64SMFR0_EL1_SMEver_SHIFT, \
 			#ID_AA64SMFR0_EL1_SMEver_WIDTH
-	cbz	x2, 1f
+	cbz	x2, check_sve_out
 	adrp	x2, zt_out
 	add	x2, x2, :lo12:zt_out
 	_str_zt 2
-1:
 
+check_sve_out:
 	// Save the SVE state if we have some
 	cbz	x0, 1f
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/fp/fp-stress.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/fp/fp-stress.c
@@ -79,7 +79,7 @@
 		 */
 		ret = dup2(pipefd[1], 1);
 		if (ret == -1) {
-			fprintf(stderr, "dup2() %d\n", errno);
+			printf("dup2() %d\n", errno);
 			exit(EXIT_FAILURE);
 		}
 
@@ -89,7 +89,7 @@
 		 */
 		ret = dup2(startup_pipe[0], 3);
 		if (ret == -1) {
-			fprintf(stderr, "dup2() %d\n", errno);
+			printf("dup2() %d\n", errno);
 			exit(EXIT_FAILURE);
 		}
 
@@ -107,16 +107,15 @@
 		 */
 		ret = read(3, &i, sizeof(i));
 		if (ret < 0)
-			fprintf(stderr, "read(startp pipe) failed: %s (%d)\n",
-				strerror(errno), errno);
+			printf("read(startp pipe) failed: %s (%d)\n",
+			       strerror(errno), errno);
 		if (ret > 0)
-			fprintf(stderr, "%d bytes of data on startup pipe\n",
-				ret);
+			printf("%d bytes of data on startup pipe\n", ret);
 		close(3);
 
 		ret = execl(program, program, NULL);
-		fprintf(stderr, "execl(%s) failed: %d (%s)\n",
-			program, errno, strerror(errno));
+		printf("execl(%s) failed: %d (%s)\n",
+		       program, errno, strerror(errno));
 
 		exit(EXIT_FAILURE);
 	} else {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/mte/check_tags_inclusion.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/mte/check_tags_inclusion.c
@@ -65,7 +65,7 @@
 			ptr = mte_insert_tags(ptr, BUFFER_SIZE);
 			/* Check tag value */
 			if (MT_FETCH_TAG((uintptr_t)ptr) == tag) {
-				ksft_print_msg("FAIL: wrong tag = 0x%x with include mask=0x%x\n",
+				ksft_print_msg("FAIL: wrong tag = 0x%lx with include mask=0x%x\n",
 					       MT_FETCH_TAG((uintptr_t)ptr),
 					       MT_INCLUDE_VALID_TAG(tag));
 				result = KSFT_FAIL;
@@ -97,7 +97,7 @@
 			ptr = mte_insert_tags(ptr, BUFFER_SIZE);
 			/* Check tag value */
 			if (MT_FETCH_TAG((uintptr_t)ptr) < tag) {
-				ksft_print_msg("FAIL: wrong tag = 0x%x with include mask=0x%x\n",
+				ksft_print_msg("FAIL: wrong tag = 0x%lx with include mask=0x%lx\n",
 					       MT_FETCH_TAG((uintptr_t)ptr),
 					       MT_INCLUDE_VALID_TAGS(excl_mask));
 				result = KSFT_FAIL;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/mte/mte_common_util.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/mte/mte_common_util.c
@@ -38,7 +38,7 @@
 			if (cur_mte_cxt.trig_si_code == si->si_code)
 				cur_mte_cxt.fault_valid = true;
 			else
-				ksft_print_msg("Got unexpected SEGV_MTEAERR at pc=$lx, fault addr=%lx\n",
+				ksft_print_msg("Got unexpected SEGV_MTEAERR at pc=%llx, fault addr=%lx\n",
 					       ((ucontext_t *)uc)->uc_mcontext.pc,
 					       addr);
 			return;
@@ -64,7 +64,7 @@
 			exit(1);
 		}
 	} else if (signum == SIGBUS) {
-		ksft_print_msg("INFO: SIGBUS signal at pc=%lx, fault addr=%lx, si_code=%lx\n",
+		ksft_print_msg("INFO: SIGBUS signal at pc=%llx, fault addr=%lx, si_code=%x\n",
 				((ucontext_t *)uc)->uc_mcontext.pc, addr, si->si_code);
 		if ((cur_mte_cxt.trig_range >= 0 &&
 		     addr >= MT_CLEAR_TAG(cur_mte_cxt.trig_addr) &&
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/pauth/pac.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/pauth/pac.c
@@ -182,6 +182,9 @@
 		return -1;
 	}
 
+	close(new_stdin[1]);
+	close(new_stdout[0]);
+
 	return 0;
 }
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/Makefile
@@ -23,7 +23,7 @@
 # Common test-unit targets to build common-layout test-cases executables
 # Needs secondary expansion to properly include the testcase c-file in pre-reqs
 COMMON_SOURCES := test_signals.c test_signals_utils.c testcases/testcases.c \
-	signals.S
+	signals.S sve_helpers.c
 COMMON_HEADERS := test_signals.h test_signals_utils.h testcases/testcases.h
 
 .SECONDEXPANSION:
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/sve_helpers.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/sve_helpers.c
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2024 ARM Limited
+ *
+ * Common helper functions for SVE and SME functionality.
+ */
+
+#include <stdbool.h>
+#include <kselftest.h>
+#include <asm/sigcontext.h>
+#include <sys/prctl.h>
+
+unsigned int vls[SVE_VQ_MAX];
+unsigned int nvls;
+
+int sve_fill_vls(bool use_sme, int min_vls)
+{
+	int vq, vl;
+	int pr_set_vl = use_sme ? PR_SME_SET_VL : PR_SVE_SET_VL;
+	int len_mask = use_sme ? PR_SME_VL_LEN_MASK : PR_SVE_VL_LEN_MASK;
+
+	/*
+	 * Enumerate up to SVE_VQ_MAX vector lengths
+	 */
+	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
+		vl = prctl(pr_set_vl, vq * 16);
+		if (vl == -1)
+			return KSFT_FAIL;
+
+		vl &= len_mask;
+
+		/*
+		 * Unlike SVE, SME does not require the minimum vector length
+		 * to be implemented, or the VLs to be consecutive, so any call
+		 * to the prctl might return the single implemented VL, which
+		 * might be larger than 16. So to avoid this loop never
+		 * terminating,  bail out here when we find a higher VL than
+		 * we asked for.
+		 * See the ARM ARM, DDI 0487K.a, B1.4.2: I_QQRNR and I_NWYBP.
+		 */
+		if (vq < sve_vq_from_vl(vl))
+			break;
+
+		/* Skip missing VLs */
+		vq = sve_vq_from_vl(vl);
+
+		vls[nvls++] = vl;
+	}
+
+	if (nvls < min_vls) {
+		fprintf(stderr, "Only %d VL supported\n", nvls);
+		return KSFT_SKIP;
+	}
+
+	return KSFT_PASS;
+}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/sve_helpers.h
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/sve_helpers.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2024 ARM Limited
+ *
+ * Common helper functions for SVE and SME functionality.
+ */
+
+#ifndef __SVE_HELPERS_H__
+#define __SVE_HELPERS_H__
+
+#include <stdbool.h>
+
+#define VLS_USE_SVE	false
+#define VLS_USE_SME	true
+
+extern unsigned int vls[];
+extern unsigned int nvls;
+
+int sve_fill_vls(bool use_sme, int min_vls);
+
+#endif
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c
@@ -6,44 +6,28 @@
  * handler, this is not supported and is expected to segfault.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 struct fake_sigframe sf;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 2);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SVE_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
+	if (!res)
+		return true;
 
-		vl &= PR_SME_VL_LEN_MASK;
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
 
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least two VLs */
-	if (nvls < 2) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
-
-	return true;
+	return false;
 }
 
 static int fake_sigreturn_ssve_change_vl(struct tdescr *td,
@@ -51,30 +35,30 @@
 {
 	size_t resv_sz, offset;
 	struct _aarch64_ctx *head = GET_SF_RESV_HEAD(sf);
-	struct sve_context *sve;
+	struct za_context *za;
 
 	/* Get a signal context with a SME ZA frame in it */
 	if (!get_current_context(td, &sf.uc, sizeof(sf.uc)))
 		return 1;
 
 	resv_sz = GET_SF_RESV_SIZE(sf);
-	head = get_header(head, SVE_MAGIC, resv_sz, &offset);
+	head = get_header(head, ZA_MAGIC, resv_sz, &offset);
 	if (!head) {
-		fprintf(stderr, "No SVE context\n");
+		fprintf(stderr, "No ZA context\n");
 		return 1;
 	}
 
-	if (head->size != sizeof(struct sve_context)) {
+	if (head->size != sizeof(struct za_context)) {
 		fprintf(stderr, "Register data present, aborting\n");
 		return 1;
 	}
 
-	sve = (struct sve_context *)head;
+	za = (struct za_context *)head;
 
 	/* No changes are supported; init left us at minimum VL so go to max */
 	fprintf(stderr, "Attempting to change VL from %d to %d\n",
-		sve->vl, vls[0]);
-	sve->vl = vls[0];
+		za->vl, vls[0]);
+	za->vl = vls[0];
 
 	fake_sigreturn(&sf, sizeof(sf), 0);
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sve_change_vl.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sve_change_vl.c
@@ -12,40 +12,22 @@
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 struct fake_sigframe sf;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sve_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SVE, 2);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SVE_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SVE_VL_LEN_MASK;
-
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least two VLs */
-	if (nvls < 2) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
+	if (!res)
+		return true;
+
+	if (res == KSFT_SKIP)
 		td->result = KSFT_SKIP;
-		return false;
-	}
 
-	return true;
+	return false;
 }
 
 static int fake_sigreturn_sve_change_vl(struct tdescr *td,
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c
@@ -6,51 +6,31 @@
  * set up as expected.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 64];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 1);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SME_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SME_VL_LEN_MASK;
-
-		/* Did we find the lowest supported VL? */
-		if (vq < sve_vq_from_vl(vl))
-			break;
-
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (!res)
+		return true;
 
-	return true;
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
+
+	return false;
 }
 
 static void setup_ssve_regs(void)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
@@ -6,51 +6,31 @@
  * signal frames is set up as expected when enabled simultaneously.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 128];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 1);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SME_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SME_VL_LEN_MASK;
-
-		/* Did we find the lowest supported VL? */
-		if (vq < sve_vq_from_vl(vl))
-			break;
-
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (!res)
+		return true;
 
-	return true;
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
+
+	return false;
 }
 
 static void setup_regs(void)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/testcases/sve_regs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/testcases/sve_regs.c
@@ -6,47 +6,31 @@
  * expected.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 64];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sve_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SVE, 1);
 
-	/*
-	 * Enumerate up to SVE_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SVE_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SVE_VL_LEN_MASK;
-
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (!res)
+		return true;
 
-	return true;
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
+
+	return false;
 }
 
 static void setup_sve_regs(void)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/testcases/za_no_regs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/testcases/za_no_regs.c
@@ -6,47 +6,31 @@
  * expected.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 128];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 1);
 
-	/*
-	 * Enumerate up to SME_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SME_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SME_VL_LEN_MASK;
-
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (!res)
+		return true;
 
-	return true;
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
+
+	return false;
 }
 
 static int do_one_sme_vl(struct tdescr *td, siginfo_t *si, ucontext_t *uc,
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/signal/testcases/za_regs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/signal/testcases/za_regs.c
@@ -6,51 +6,31 @@
  * expected.
  */
 
+#include <kselftest.h>
 #include <signal.h>
 #include <ucontext.h>
 #include <sys/prctl.h>
 
 #include "test_signals_utils.h"
+#include "sve_helpers.h"
 #include "testcases.h"
 
 static union {
 	ucontext_t uc;
 	char buf[1024 * 128];
 } context;
-static unsigned int vls[SVE_VQ_MAX];
-unsigned int nvls = 0;
 
 static bool sme_get_vls(struct tdescr *td)
 {
-	int vq, vl;
+	int res = sve_fill_vls(VLS_USE_SME, 1);
 
-	/*
-	 * Enumerate up to SME_VQ_MAX vector lengths
-	 */
-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
-		vl = prctl(PR_SME_SET_VL, vq * 16);
-		if (vl == -1)
-			return false;
-
-		vl &= PR_SME_VL_LEN_MASK;
-
-		/* Did we find the lowest supported VL? */
-		if (vq < sve_vq_from_vl(vl))
-			break;
-
-		/* Skip missing VLs */
-		vq = sve_vq_from_vl(vl);
-
-		vls[nvls++] = vl;
-	}
-
-	/* We need at least one VL */
-	if (nvls < 1) {
-		fprintf(stderr, "Only %d VL supported\n", nvls);
-		return false;
-	}
+	if (!res)
+		return true;
 
-	return true;
+	if (res == KSFT_SKIP)
+		td->result = KSFT_SKIP;
+
+	return false;
 }
 
 static void setup_za_regs(void)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/arm64/tags/tags_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/arm64/tags/tags_test.c
@@ -6,6 +6,7 @@
 #include <stdint.h>
 #include <sys/prctl.h>
 #include <sys/utsname.h>
+#include "../../kselftest.h"
 
 #define SHIFT_TAG(tag)		((uint64_t)(tag) << 56)
 #define SET_TAG(ptr, tag)	(((uint64_t)(ptr) & ~SHIFT_TAG(0xff)) | \
@@ -21,6 +22,9 @@
 	if (prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0) == 0)
 		tbi_enabled = 1;
 	ptr = (struct utsname *)malloc(sizeof(*ptr));
+	if (!ptr)
+		ksft_exit_fail_msg("Failed to allocate utsname buffer\n");
+
 	if (tbi_enabled)
 		tag = 0x42;
 	ptr = (struct utsname *)SET_TAG(ptr, tag);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/Makefile
@@ -64,6 +64,15 @@
 ifneq ($(BPF_GCC),)
 TEST_GEN_PROGS += test_progs-bpf_gcc
 TEST_INST_SUBDIRS += bpf_gcc
+
+# The following tests contain C code that, although technically legal,
+# triggers GCC warnings that cannot be disabled: declaration of
+# anonymous struct types in function parameter lists.
+progs/btf_dump_test_case_bitfields.c-bpf_gcc-CFLAGS := -Wno-error
+progs/btf_dump_test_case_namespacing.c-bpf_gcc-CFLAGS := -Wno-error
+progs/btf_dump_test_case_packing.c-bpf_gcc-CFLAGS := -Wno-error
+progs/btf_dump_test_case_padding.c-bpf_gcc-CFLAGS := -Wno-error
+progs/btf_dump_test_case_syntax.c-bpf_gcc-CFLAGS := -Wno-error
 endif
 
 ifneq ($(CLANG_CPUV4),)
@@ -199,7 +208,7 @@
 ifeq ($(SRCARCH),$(filter $(SRCARCH),x86 riscv))
 LLD := lld
 else
-LLD := ld
+LLD := $(shell command -v $(LD))
 endif
 
 # Filter out -static for liburandom_read.so and its dependent targets so that static builds
@@ -386,7 +395,8 @@
 # TODO: enable me -Wsign-compare
 
 CLANG_CFLAGS = $(CLANG_SYS_INCLUDES) \
-	       -Wno-compare-distinct-pointer-types
+	       -Wno-compare-distinct-pointer-types \
+	       -Wno-incompatible-pointer-types
 
 $(OUTPUT)/test_l4lb_noinline.o: BPF_CFLAGS += -fno-inline
 $(OUTPUT)/test_xdp_noinline.o: BPF_CFLAGS += -fno-inline
@@ -398,24 +408,25 @@
 # $1 - input .c file
 # $2 - output .o file
 # $3 - CFLAGS
+# $4 - binary name
 define CLANG_BPF_BUILD_RULE
-	$(call msg,CLNG-BPF,$(TRUNNER_BINARY),$2)
+	$(call msg,CLNG-BPF,$4,$2)
 	$(Q)$(CLANG) $3 -O2 --target=bpf -c $1 -mcpu=v3 -o $2
 endef
 # Similar to CLANG_BPF_BUILD_RULE, but with disabled alu32
 define CLANG_NOALU32_BPF_BUILD_RULE
-	$(call msg,CLNG-BPF,$(TRUNNER_BINARY),$2)
+	$(call msg,CLNG-BPF,$4,$2)
 	$(Q)$(CLANG) $3 -O2 --target=bpf -c $1 -mcpu=v2 -o $2
 endef
 # Similar to CLANG_BPF_BUILD_RULE, but with cpu-v4
 define CLANG_CPUV4_BPF_BUILD_RULE
-	$(call msg,CLNG-BPF,$(TRUNNER_BINARY),$2)
+	$(call msg,CLNG-BPF,$4,$2)
 	$(Q)$(CLANG) $3 -O2 --target=bpf -c $1 -mcpu=v4 -o $2
 endef
 # Build BPF object using GCC
 define GCC_BPF_BUILD_RULE
-	$(call msg,GCC-BPF,$(TRUNNER_BINARY),$2)
-	$(Q)$(BPF_GCC) $3 -O2 -c $1 -o $2
+	$(call msg,GCC-BPF,$4,$2)
+	$(Q)$(BPF_GCC) $3 -DBPF_NO_PRESERVE_ACCESS_INDEX -Wno-attributes -O2 -c $1 -o $2
 endef
 
 SKEL_BLACKLIST := btf__% test_pinning_invalid.c test_sk_assign.c
@@ -454,7 +465,7 @@
 # $eval()) and pass control to DEFINE_TEST_RUNNER_RULES.
 # Parameters:
 # $1 - test runner base binary name (e.g., test_progs)
-# $2 - test runner extra "flavor" (e.g., no_alu32, cpuv4, gcc-bpf, etc)
+# $2 - test runner extra "flavor" (e.g., no_alu32, cpuv4, bpf_gcc, etc)
 define DEFINE_TEST_RUNNER
 
 TRUNNER_OUTPUT := $(OUTPUT)$(if $2,/)$2
@@ -482,7 +493,7 @@
 # Using TRUNNER_XXX variables, provided by callers of DEFINE_TEST_RUNNER and
 # set up by DEFINE_TEST_RUNNER itself, create test runner build rules with:
 # $1 - test runner base binary name (e.g., test_progs)
-# $2 - test runner extra "flavor" (e.g., no_alu32, cpuv4, gcc-bpf, etc)
+# $2 - test runner extra "flavor" (e.g., no_alu32, cpuv4, bpf_gcc, etc)
 define DEFINE_TEST_RUNNER_RULES
 
 ifeq ($($(TRUNNER_OUTPUT)-dir),)
@@ -504,7 +515,9 @@
 		     $(wildcard $(BPFDIR)/*.bpf.h)			\
 		     | $(TRUNNER_OUTPUT) $$(BPFOBJ)
 	$$(call $(TRUNNER_BPF_BUILD_RULE),$$<,$$@,			\
-					  $(TRUNNER_BPF_CFLAGS))
+					  $(TRUNNER_BPF_CFLAGS)         \
+					  $$($$<-CFLAGS)		\
+					  $$($$<-$2-CFLAGS),$(TRUNNER_BINARY))
 
 $(TRUNNER_BPF_SKELS): %.skel.h: %.bpf.o $(BPFTOOL) | $(TRUNNER_OUTPUT)
 	$$(call msg,GEN-SKEL,$(TRUNNER_BINARY),$$@)
@@ -725,6 +738,8 @@
 	$(call msg,BINARY,,$@)
 	$(Q)$(CC) $(CFLAGS) $(LDFLAGS) $(filter %.a %.o,$^) $(LDLIBS) -o $@
 
+# Linking uprobe_multi can fail due to relocation overflows on mips.
+$(OUTPUT)/uprobe_multi: CFLAGS += $(if $(filter mips, $(ARCH)),-mxgot)
 $(OUTPUT)/uprobe_multi: uprobe_multi.c
 	$(call msg,BINARY,,$@)
 	$(Q)$(CC) $(CFLAGS) $(LDFLAGS) $^ $(LDLIBS) -o $@
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/bench.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/bench.c
@@ -10,6 +10,7 @@
 #include <sys/sysinfo.h>
 #include <signal.h>
 #include "bench.h"
+#include "bpf_util.h"
 #include "testing_helpers.h"
 
 struct env env = {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/bench.h
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/bench.h
@@ -10,6 +10,7 @@
 #include <math.h>
 #include <time.h>
 #include <sys/syscall.h>
+#include <limits.h>
 
 struct cpu_set {
 	bool *cpus;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c
@@ -2,6 +2,7 @@
 /* Copyright (c) 2020 Facebook */
 #include <linux/btf.h>
 #include <linux/btf_ids.h>
+#include <linux/delay.h>
 #include <linux/error-injection.h>
 #include <linux/init.h>
 #include <linux/module.h>
@@ -544,6 +545,14 @@
 
 static void bpf_testmod_exit(void)
 {
+        /* Need to wait for all references to be dropped because
+         * bpf_kfunc_call_test_release() which currently resides in kernel can
+         * be called after bpf_testmod is unloaded. Once release function is
+         * moved into the module this wait can be removed.
+         */
+	while (refcount_read(&prog_test_struct.cnt) > 1)
+		msleep(20);
+
 	return sysfs_remove_bin_file(kernel_kobj, &bin_attr_bpf_testmod_file);
 }
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/cgroup_helpers.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/cgroup_helpers.c
@@ -508,6 +508,9 @@
 /**
  * setup_classid_environment() - Setup the cgroupv1 net_cls environment
  *
+ * This function should only be called in a custom mount namespace, e.g.
+ * created by running setup_cgroup_environment.
+ *
  * After calling this function, cleanup_classid_environment should be called
  * once testing is complete.
  *
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/config
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/config
@@ -53,9 +53,12 @@
 CONFIG_MPLS_IPTUNNEL=y
 CONFIG_MPLS_ROUTING=y
 CONFIG_MPTCP=y
+CONFIG_NET_ACT_SKBMOD=y
+CONFIG_NET_CLS=y
 CONFIG_NET_CLS_ACT=y
 CONFIG_NET_CLS_BPF=y
 CONFIG_NET_CLS_FLOWER=y
+CONFIG_NET_CLS_MATCHALL=y
 CONFIG_NET_FOU=y
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_NET_IPGRE=y
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/map_tests/sk_storage_map.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/map_tests/sk_storage_map.c
@@ -412,7 +412,7 @@
 		rlim_new.rlim_max = rlim_new.rlim_cur + 128;
 		err = setrlimit(RLIMIT_NOFILE, &rlim_new);
 		CHECK(err, "setrlimit(RLIMIT_NOFILE)", "rlim_new:%lu errno:%d",
-		      rlim_new.rlim_cur, errno);
+		      (unsigned long) rlim_new.rlim_cur, errno);
 	}
 
 	err = do_sk_storage_map_stress_free();
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/network_helpers.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/network_helpers.c
@@ -430,6 +430,52 @@
 	return "ping";
 }
 
+int remove_netns(const char *name)
+{
+	char *cmd;
+	int r;
+
+	r = asprintf(&cmd, "ip netns del %s >/dev/null 2>&1", name);
+	if (r < 0) {
+		log_err("Failed to malloc cmd");
+		return -1;
+	}
+
+	r = system(cmd);
+	free(cmd);
+	return r;
+}
+
+int make_netns(const char *name)
+{
+	char *cmd;
+	int r;
+
+	r = asprintf(&cmd, "ip netns add %s", name);
+	if (r < 0) {
+		log_err("Failed to malloc cmd");
+		return -1;
+	}
+
+	r = system(cmd);
+	free(cmd);
+
+	if (r)
+		return r;
+
+	r = asprintf(&cmd, "ip -n %s link set lo up", name);
+	if (r < 0) {
+		log_err("Failed to malloc cmd for setting up lo");
+		remove_netns(name);
+		return -1;
+	}
+
+	r = system(cmd);
+	free(cmd);
+
+	return r;
+}
+
 struct nstoken {
 	int orig_netns_fd;
 };
@@ -461,6 +507,8 @@
 
 	return token;
 fail:
+	if (token->orig_netns_fd != -1)
+		close(token->orig_netns_fd);
 	free(token);
 	return NULL;
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/network_helpers.h
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/network_helpers.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 #ifndef __NETWORK_HELPERS_H
 #define __NETWORK_HELPERS_H
+#include <arpa/inet.h>
 #include <sys/socket.h>
 #include <sys/types.h>
 #include <linux/types.h>
@@ -71,6 +72,8 @@
  */
 struct nstoken *open_netns(const char *name);
 void close_netns(struct nstoken *token);
+int make_netns(const char *name);
+int remove_netns(const char *name);
 
 static __u16 csum_fold(__u32 csum)
 {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c
@@ -2,6 +2,7 @@
 /* Copyright (c) 2021 Facebook */
 
 #include <sys/syscall.h>
+#include <limits.h>
 #include <test_progs.h>
 #include "bloom_filter_map.skel.h"
 
@@ -21,6 +22,11 @@
 	if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid value size 0"))
 		close(fd);
 
+	/* Invalid value size: too big */
+	fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, INT32_MAX, 100, NULL);
+	if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid value too large"))
+		close(fd);
+
 	/* Invalid max entries size */
 	fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, sizeof(value), 0, NULL);
 	if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid max entries size"))
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/bpf_iter_setsockopt.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/bpf_iter_setsockopt.c
@@ -95,7 +95,7 @@
 	struct sockaddr_in6 addr;
 	socklen_t addrlen = sizeof(addr);
 
-	if (!getsockname(fd, &addr, &addrlen))
+	if (!getsockname(fd, (struct sockaddr *)&addr, &addrlen))
 		return ntohs(addr.sin6_port);
 
 	return 0;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
@@ -392,7 +392,8 @@
 		return;
 
 	link = bpf_map__attach_struct_ops(skel->maps.ca_update_1);
-	ASSERT_OK_PTR(link, "attach_struct_ops");
+	if (!ASSERT_OK_PTR(link, "attach_struct_ops"))
+		goto out;
 
 	do_test("tcp_ca_update", NULL);
 	saved_ca1_cnt = skel->bss->ca1_cnt;
@@ -406,6 +407,7 @@
 	ASSERT_GT(skel->bss->ca2_cnt, 0, "ca2_ca2_cnt");
 
 	bpf_link__destroy(link);
+out:
 	tcp_ca_update__destroy(skel);
 }
 
@@ -421,7 +423,8 @@
 		return;
 
 	link = bpf_map__attach_struct_ops(skel->maps.ca_update_1);
-	ASSERT_OK_PTR(link, "attach_struct_ops");
+	if (!ASSERT_OK_PTR(link, "attach_struct_ops"))
+		goto out;
 
 	do_test("tcp_ca_update", NULL);
 	saved_ca1_cnt = skel->bss->ca1_cnt;
@@ -434,6 +437,7 @@
 	ASSERT_GT(skel->bss->ca1_cnt, saved_ca1_cnt, "ca2_ca1_cnt");
 
 	bpf_link__destroy(link);
+out:
 	tcp_ca_update__destroy(skel);
 }
 
@@ -448,7 +452,8 @@
 		return;
 
 	link_nl = bpf_map__attach_struct_ops(skel->maps.ca_no_link);
-	ASSERT_OK_PTR(link_nl, "attach_struct_ops_nl");
+	if (!ASSERT_OK_PTR(link_nl, "attach_struct_ops_nl"))
+		goto out;
 
 	link = bpf_map__attach_struct_ops(skel->maps.ca_update_1);
 	ASSERT_OK_PTR(link, "attach_struct_ops");
@@ -461,6 +466,7 @@
 
 	bpf_link__destroy(link);
 	bpf_link__destroy(link_nl);
+out:
 	tcp_ca_update__destroy(skel);
 }
 
@@ -503,7 +509,8 @@
 	bpf_link__destroy(link);
 
 	link = bpf_map__attach_struct_ops(skel->maps.ca_update_2);
-	ASSERT_OK_PTR(link, "attach_struct_ops_2nd");
+	if (!ASSERT_OK_PTR(link, "attach_struct_ops_2nd"))
+		goto out;
 
 	/* BPF_F_REPLACE with a wrong old map Fd. It should fail!
 	 *
@@ -526,6 +533,7 @@
 
 	bpf_link__destroy(link);
 
+out:
 	tcp_ca_update__destroy(skel);
 }
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
@@ -25,7 +25,7 @@
 	int map1_fd, map2_fd, map3_fd, map4_fd, map5_fd, map1_id, map2_id;
 	int outer_arr_fd, outer_hash_fd, outer_arr_dyn_fd;
 	struct test_btf_map_in_map *skel;
-	int err, key = 0, val, i, fd;
+	int err, key = 0, val, i;
 
 	skel = test_btf_map_in_map__open_and_load();
 	if (CHECK(!skel, "skel_open", "failed to open&load skeleton\n"))
@@ -102,30 +102,6 @@
 	CHECK(map1_id == 0, "map1_id", "failed to get ID 1\n");
 	CHECK(map2_id == 0, "map2_id", "failed to get ID 2\n");
 
-	test_btf_map_in_map__destroy(skel);
-	skel = NULL;
-
-	/* we need to either wait for or force synchronize_rcu(), before
-	 * checking for "still exists" condition, otherwise map could still be
-	 * resolvable by ID, causing false positives.
-	 *
-	 * Older kernels (5.8 and earlier) freed map only after two
-	 * synchronize_rcu()s, so trigger two, to be entirely sure.
-	 */
-	CHECK(kern_sync_rcu(), "sync_rcu", "failed\n");
-	CHECK(kern_sync_rcu(), "sync_rcu", "failed\n");
-
-	fd = bpf_map_get_fd_by_id(map1_id);
-	if (CHECK(fd >= 0, "map1_leak", "inner_map1 leaked!\n")) {
-		close(fd);
-		goto cleanup;
-	}
-	fd = bpf_map_get_fd_by_id(map2_id);
-	if (CHECK(fd >= 0, "map2_leak", "inner_map2 leaked!\n")) {
-		close(fd);
-		goto cleanup;
-	}
-
 cleanup:
 	test_btf_map_in_map__destroy(skel);
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/cgroup1_hierarchy.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/cgroup1_hierarchy.c
@@ -87,9 +87,12 @@
 		goto destroy;
 
 	/* Setup cgroup1 hierarchy */
+	err = setup_cgroup_environment();
+	if (!ASSERT_OK(err, "setup_cgroup_environment"))
+		goto destroy;
 	err = setup_classid_environment();
 	if (!ASSERT_OK(err, "setup_classid_environment"))
-		goto destroy;
+		goto cleanup_cgroup;
 
 	err = join_classid();
 	if (!ASSERT_OK(err, "join_cgroup1"))
@@ -153,6 +156,8 @@
 
 cleanup:
 	cleanup_classid_environment();
+cleanup_cgroup:
+	cleanup_cgroup_environment();
 destroy:
 	test_cgroup1_hierarchy__destroy(skel);
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/core_reloc.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/core_reloc.c
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
 #include <test_progs.h>
 #include "progs/core_reloc_types.h"
 #include "bpf_testmod/bpf_testmod.h"
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/ctx_rewrite.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/ctx_rewrite.c
@@ -69,15 +69,17 @@
 	{
 		N(SCHED_CLS, struct __sk_buff, tstamp),
 		.read  = "r11 = *(u8 *)($ctx + sk_buff::__mono_tc_offset);"
-			 "w11 &= 3;"
-			 "if w11 != 0x3 goto pc+2;"
+			 "if w11 & 0x4 goto pc+1;"
+			 "goto pc+4;"
+			 "if w11 & 0x3 goto pc+1;"
+			 "goto pc+2;"
 			 "$dst = 0;"
 			 "goto pc+1;"
 			 "$dst = *(u64 *)($ctx + sk_buff::tstamp);",
 		.write = "r11 = *(u8 *)($ctx + sk_buff::__mono_tc_offset);"
-			 "if w11 & 0x2 goto pc+1;"
+			 "if w11 & 0x4 goto pc+1;"
 			 "goto pc+2;"
-			 "w11 &= -2;"
+			 "w11 &= -4;"
 			 "*(u8 *)($ctx + sk_buff::__mono_tc_offset) = r11;"
 			 "*(u64 *)($ctx + sk_buff::tstamp) = $src;",
 	},
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/decap_sanity.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/decap_sanity.c
@@ -4,7 +4,6 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <net/if.h>
-#include <linux/in6.h>
 
 #include "test_progs.h"
 #include "network_helpers.h"
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c
@@ -98,7 +98,8 @@
 
 static void test_dummy_multiple_args(void)
 {
-	__u64 args[5] = {0, -100, 0x8a5f, 'c', 0x1234567887654321ULL};
+	struct bpf_dummy_ops_state st = { 7 };
+	__u64 args[5] = {(__u64)&st, -100, 0x8a5f, 'c', 0x1234567887654321ULL};
 	LIBBPF_OPTS(bpf_test_run_opts, attr,
 		.ctx_in = args,
 		.ctx_size_in = sizeof(args),
@@ -115,6 +116,7 @@
 	fd = bpf_program__fd(skel->progs.test_2);
 	err = bpf_prog_test_run_opts(fd, &attr);
 	ASSERT_OK(err, "test_run");
+	args[0] = 7;
 	for (i = 0; i < ARRAY_SIZE(args); i++) {
 		snprintf(name, sizeof(name), "arg %zu", i);
 		ASSERT_EQ(skel->bss->test_2_args[i], args[i], name);
@@ -125,7 +127,8 @@
 
 static void test_dummy_sleepable(void)
 {
-	__u64 args[1] = {0};
+	struct bpf_dummy_ops_state st;
+	__u64 args[1] = {(__u64)&st};
 	LIBBPF_OPTS(bpf_test_run_opts, attr,
 		.ctx_in = args,
 		.ctx_size_in = sizeof(args),
@@ -144,6 +147,31 @@
 	dummy_st_ops_success__destroy(skel);
 }
 
+/* dummy_st_ops.test_sleepable() parameter is not marked as nullable,
+ * thus bpf_prog_test_run_opts() below should be rejected as it tries
+ * to pass NULL for this parameter.
+ */
+static void test_dummy_sleepable_reject_null(void)
+{
+	__u64 args[1] = {0};
+	LIBBPF_OPTS(bpf_test_run_opts, attr,
+		.ctx_in = args,
+		.ctx_size_in = sizeof(args),
+	);
+	struct dummy_st_ops_success *skel;
+	int fd, err;
+
+	skel = dummy_st_ops_success__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "dummy_st_ops_load"))
+		return;
+
+	fd = bpf_program__fd(skel->progs.test_sleepable);
+	err = bpf_prog_test_run_opts(fd, &attr);
+	ASSERT_EQ(err, -EINVAL, "test_run");
+
+	dummy_st_ops_success__destroy(skel);
+}
+
 void test_dummy_st_ops(void)
 {
 	if (test__start_subtest("dummy_st_ops_attach"))
@@ -156,6 +184,8 @@
 		test_dummy_multiple_args();
 	if (test__start_subtest("dummy_sleepable"))
 		test_dummy_sleepable();
+	if (test__start_subtest("dummy_sleepable_reject_null"))
+		test_dummy_sleepable_reject_null();
 
 	RUN_TESTS(dummy_st_ops_fail);
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/fexit_sleep.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/fexit_sleep.c
@@ -21,13 +21,13 @@
 }
 
 #define STACK_SIZE (1024 * 1024)
-static char child_stack[STACK_SIZE];
 
 void test_fexit_sleep(void)
 {
 	struct fexit_sleep_lskel *fexit_skel = NULL;
 	int wstatus, duration = 0;
 	pid_t cpid;
+	char *child_stack = NULL;
 	int err, fexit_cnt;
 
 	fexit_skel = fexit_sleep_lskel__open_and_load();
@@ -38,6 +38,11 @@
 	if (CHECK(err, "fexit_attach", "fexit attach failed: %d\n", err))
 		goto cleanup;
 
+	child_stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE |
+			   MAP_ANONYMOUS | MAP_STACK, -1, 0);
+	if (!ASSERT_NEQ(child_stack, MAP_FAILED, "mmap"))
+		goto cleanup;
+
 	cpid = clone(do_sleep, child_stack + STACK_SIZE, CLONE_FILES | SIGCHLD, fexit_skel);
 	if (CHECK(cpid == -1, "clone", "%s\n", strerror(errno)))
 		goto cleanup;
@@ -78,5 +83,6 @@
 		goto cleanup;
 
 cleanup:
+	munmap(child_stack, STACK_SIZE);
 	fexit_sleep_lskel__destroy(fexit_skel);
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
@@ -31,6 +31,8 @@
 	asm volatile ("");
 }
 
+#define PERF_EVENT_COOKIE 0xdeadbeef
+
 static int verify_perf_link_info(int fd, enum bpf_perf_event_type type, long addr,
 				 ssize_t offset, ssize_t entry_offset)
 {
@@ -62,8 +64,11 @@
 			ASSERT_EQ(info.perf_event.kprobe.addr, addr + entry_offset,
 				  "kprobe_addr");
 
+		ASSERT_EQ(info.perf_event.kprobe.cookie, PERF_EVENT_COOKIE, "kprobe_cookie");
+
+		ASSERT_EQ(info.perf_event.kprobe.name_len, strlen(KPROBE_FUNC) + 1,
+				  "name_len");
 		if (!info.perf_event.kprobe.func_name) {
-			ASSERT_EQ(info.perf_event.kprobe.name_len, 0, "name_len");
 			info.perf_event.kprobe.func_name = ptr_to_u64(&buf);
 			info.perf_event.kprobe.name_len = sizeof(buf);
 			goto again;
@@ -74,13 +79,16 @@
 		ASSERT_EQ(err, 0, "cmp_kprobe_func_name");
 		break;
 	case BPF_PERF_EVENT_TRACEPOINT:
+		ASSERT_EQ(info.perf_event.tracepoint.name_len, strlen(TP_NAME) + 1,
+				  "name_len");
 		if (!info.perf_event.tracepoint.tp_name) {
-			ASSERT_EQ(info.perf_event.tracepoint.name_len, 0, "name_len");
 			info.perf_event.tracepoint.tp_name = ptr_to_u64(&buf);
 			info.perf_event.tracepoint.name_len = sizeof(buf);
 			goto again;
 		}
 
+		ASSERT_EQ(info.perf_event.tracepoint.cookie, PERF_EVENT_COOKIE, "tracepoint_cookie");
+
 		err = strncmp(u64_to_ptr(info.perf_event.tracepoint.tp_name), TP_NAME,
 			      strlen(TP_NAME));
 		ASSERT_EQ(err, 0, "cmp_tp_name");
@@ -89,13 +97,16 @@
 	case BPF_PERF_EVENT_URETPROBE:
 		ASSERT_EQ(info.perf_event.uprobe.offset, offset, "uprobe_offset");
 
+		ASSERT_EQ(info.perf_event.uprobe.name_len, strlen(UPROBE_FILE) + 1,
+				  "name_len");
 		if (!info.perf_event.uprobe.file_name) {
-			ASSERT_EQ(info.perf_event.uprobe.name_len, 0, "name_len");
 			info.perf_event.uprobe.file_name = ptr_to_u64(&buf);
 			info.perf_event.uprobe.name_len = sizeof(buf);
 			goto again;
 		}
 
+		ASSERT_EQ(info.perf_event.uprobe.cookie, PERF_EVENT_COOKIE, "uprobe_cookie");
+
 		err = strncmp(u64_to_ptr(info.perf_event.uprobe.file_name), UPROBE_FILE,
 			      strlen(UPROBE_FILE));
 			ASSERT_EQ(err, 0, "cmp_file_name");
@@ -139,6 +150,7 @@
 	DECLARE_LIBBPF_OPTS(bpf_kprobe_opts, opts,
 		.attach_mode = PROBE_ATTACH_MODE_LINK,
 		.retprobe = type == BPF_PERF_EVENT_KRETPROBE,
+		.bpf_cookie = PERF_EVENT_COOKIE,
 	);
 	ssize_t entry_offset = 0;
 	struct bpf_link *link;
@@ -163,10 +175,13 @@
 
 static void test_tp_fill_link_info(struct test_fill_link_info *skel)
 {
+	DECLARE_LIBBPF_OPTS(bpf_tracepoint_opts, opts,
+		.bpf_cookie = PERF_EVENT_COOKIE,
+	);
 	struct bpf_link *link;
 	int link_fd, err;
 
-	link = bpf_program__attach_tracepoint(skel->progs.tp_run, TP_CAT, TP_NAME);
+	link = bpf_program__attach_tracepoint_opts(skel->progs.tp_run, TP_CAT, TP_NAME, &opts);
 	if (!ASSERT_OK_PTR(link, "attach_tp"))
 		return;
 
@@ -179,13 +194,17 @@
 static void test_uprobe_fill_link_info(struct test_fill_link_info *skel,
 				       enum bpf_perf_event_type type)
 {
+	DECLARE_LIBBPF_OPTS(bpf_uprobe_opts, opts,
+		.retprobe = type == BPF_PERF_EVENT_URETPROBE,
+		.bpf_cookie = PERF_EVENT_COOKIE,
+	);
 	struct bpf_link *link;
 	int link_fd, err;
 
-	link = bpf_program__attach_uprobe(skel->progs.uprobe_run,
-					  type == BPF_PERF_EVENT_URETPROBE,
-					  0, /* self pid */
-					  UPROBE_FILE, uprobe_offset);
+	link = bpf_program__attach_uprobe_opts(skel->progs.uprobe_run,
+					       0, /* self pid */
+					       UPROBE_FILE, uprobe_offset,
+					       &opts);
 	if (!ASSERT_OK_PTR(link, "attach_uprobe"))
 		return;
 
@@ -343,6 +362,15 @@
 	if (!ASSERT_NEQ(err, -1, "readlink"))
 		return -1;
 
+	memset(&info, 0, sizeof(info));
+	err = bpf_link_get_info_by_fd(fd, &info, &len);
+	if (!ASSERT_OK(err, "bpf_link_get_info_by_fd"))
+		return -1;
+
+	ASSERT_EQ(info.uprobe_multi.count, 3, "info.uprobe_multi.count");
+	ASSERT_EQ(info.uprobe_multi.path_size, strlen(path) + 1,
+		  "info.uprobe_multi.path_size");
+
 	for (bit = 0; bit < 8; bit++) {
 		memset(&info, 0, sizeof(info));
 		info.uprobe_multi.path = ptr_to_u64(path_buf);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
 #include <test_progs.h>
 #include <network_helpers.h>
-#include <error.h>
 #include <linux/if.h>
 #include <linux/if_tun.h>
 #include <sys/uio.h>
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/kfree_skb.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/kfree_skb.c
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
 #include <test_progs.h>
 #include <network_helpers.h>
 #include "kfree_skb.skel.h"
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/lwt_helpers.h
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/lwt_helpers.h
@@ -27,8 +27,6 @@
 			}                                                     \
 	})
 
-#define NETNS "ns_lwt"
-
 static inline int netns_create(void)
 {
 	return system("ip netns add " NETNS);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/lwt_redirect.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/lwt_redirect.c
@@ -47,13 +47,13 @@
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
 #include <linux/if_tun.h>
-#include <linux/icmp.h>
 #include <arpa/inet.h>
 #include <unistd.h>
 #include <errno.h>
 #include <stdbool.h>
 #include <stdlib.h>
 
+#define NETNS "ns_lwt_redirect"
 #include "lwt_helpers.h"
 #include "test_progs.h"
 #include "network_helpers.h"
@@ -203,6 +203,7 @@
 	if (!ASSERT_GE(target_index, 0, "if_nametoindex"))
 		goto fail;
 
+	SYS(fail, "sysctl -w net.ipv6.conf.all.disable_ipv6=1");
 	SYS(fail, "ip link add link_err type dummy");
 	SYS(fail, "ip link set lo up");
 	SYS(fail, "ip addr add dev lo " LOCAL_SRC "/32");
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/lwt_reroute.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/lwt_reroute.c
@@ -48,6 +48,8 @@
  *  For case 2, force UDP packets to overflow fq limit. As long as kernel
  *  is not crashed, it is considered successful.
  */
+#define NETNS "ns_lwt_reroute"
+#include <netinet/in.h>
 #include "lwt_helpers.h"
 #include "network_helpers.h"
 #include <linux/net_tstamp.h>
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
@@ -11,78 +11,168 @@
 #include <sched.h>
 #include <sys/wait.h>
 #include <sys/mount.h>
-#include <sys/fcntl.h>
+#include <fcntl.h>
+#include "network_helpers.h"
 
 #define STACK_SIZE (1024 * 1024)
 static char child_stack[STACK_SIZE];
 
-static int test_current_pid_tgid(void *args)
+static int get_pid_tgid(pid_t *pid, pid_t *tgid,
+			struct test_ns_current_pid_tgid__bss *bss)
 {
-	struct test_ns_current_pid_tgid__bss  *bss;
-	struct test_ns_current_pid_tgid *skel;
-	int err = -1, duration = 0;
-	pid_t tgid, pid;
 	struct stat st;
+	int err;
 
-	skel = test_ns_current_pid_tgid__open_and_load();
-	if (CHECK(!skel, "skel_open_load", "failed to load skeleton\n"))
-		goto cleanup;
-
-	pid = syscall(SYS_gettid);
-	tgid = getpid();
+	*pid = syscall(SYS_gettid);
+	*tgid = getpid();
 
 	err = stat("/proc/self/ns/pid", &st);
-	if (CHECK(err, "stat", "failed /proc/self/ns/pid: %d\n", err))
-		goto cleanup;
+	if (!ASSERT_OK(err, "stat /proc/self/ns/pid"))
+		return err;
 
-	bss = skel->bss;
 	bss->dev = st.st_dev;
 	bss->ino = st.st_ino;
 	bss->user_pid = 0;
 	bss->user_tgid = 0;
+	return 0;
+}
+
+static int test_current_pid_tgid_tp(void *args)
+{
+	struct test_ns_current_pid_tgid__bss  *bss;
+	struct test_ns_current_pid_tgid *skel;
+	int ret = -1, err;
+	pid_t tgid, pid;
+
+	skel = test_ns_current_pid_tgid__open();
+	if (!ASSERT_OK_PTR(skel, "test_ns_current_pid_tgid__open"))
+		return ret;
+
+	bpf_program__set_autoload(skel->progs.tp_handler, true);
+
+	err = test_ns_current_pid_tgid__load(skel);
+	if (!ASSERT_OK(err, "test_ns_current_pid_tgid__load"))
+		goto cleanup;
+
+	bss = skel->bss;
+	if (get_pid_tgid(&pid, &tgid, bss))
+		goto cleanup;
 
 	err = test_ns_current_pid_tgid__attach(skel);
-	if (CHECK(err, "skel_attach", "skeleton attach failed: %d\n", err))
+	if (!ASSERT_OK(err, "test_ns_current_pid_tgid__attach"))
 		goto cleanup;
 
 	/* trigger tracepoint */
 	usleep(1);
-	ASSERT_EQ(bss->user_pid, pid, "pid");
-	ASSERT_EQ(bss->user_tgid, tgid, "tgid");
-	err = 0;
+	if (!ASSERT_EQ(bss->user_pid, pid, "pid"))
+		goto cleanup;
+	if (!ASSERT_EQ(bss->user_tgid, tgid, "tgid"))
+		goto cleanup;
+	ret = 0;
 
 cleanup:
-	 test_ns_current_pid_tgid__destroy(skel);
+	test_ns_current_pid_tgid__destroy(skel);
+	return ret;
+}
 
-	return err;
+static int test_current_pid_tgid_cgrp(void *args)
+{
+	struct test_ns_current_pid_tgid__bss *bss;
+	struct test_ns_current_pid_tgid *skel;
+	int server_fd = -1, ret = -1, err;
+	int cgroup_fd = *(int *)args;
+	pid_t tgid, pid;
+
+	skel = test_ns_current_pid_tgid__open();
+	if (!ASSERT_OK_PTR(skel, "test_ns_current_pid_tgid__open"))
+		return ret;
+
+	bpf_program__set_autoload(skel->progs.cgroup_bind4, true);
+
+	err = test_ns_current_pid_tgid__load(skel);
+	if (!ASSERT_OK(err, "test_ns_current_pid_tgid__load"))
+		goto cleanup;
+
+	bss = skel->bss;
+	if (get_pid_tgid(&pid, &tgid, bss))
+		goto cleanup;
+
+	skel->links.cgroup_bind4 = bpf_program__attach_cgroup(
+		skel->progs.cgroup_bind4, cgroup_fd);
+	if (!ASSERT_OK_PTR(skel->links.cgroup_bind4, "bpf_program__attach_cgroup"))
+		goto cleanup;
+
+	server_fd = start_server(AF_INET, SOCK_STREAM, NULL, 0, 0);
+	if (!ASSERT_GE(server_fd, 0, "start_server"))
+		goto cleanup;
+
+	if (!ASSERT_EQ(bss->user_pid, pid, "pid"))
+		goto cleanup;
+	if (!ASSERT_EQ(bss->user_tgid, tgid, "tgid"))
+		goto cleanup;
+	ret = 0;
+
+cleanup:
+	if (server_fd >= 0)
+		close(server_fd);
+	test_ns_current_pid_tgid__destroy(skel);
+	return ret;
 }
 
-static void test_ns_current_pid_tgid_new_ns(void)
+static void test_ns_current_pid_tgid_new_ns(int (*fn)(void *), void *arg)
 {
-	int wstatus, duration = 0;
+	int wstatus;
 	pid_t cpid;
 
 	/* Create a process in a new namespace, this process
 	 * will be the init process of this new namespace hence will be pid 1.
 	 */
-	cpid = clone(test_current_pid_tgid, child_stack + STACK_SIZE,
-		     CLONE_NEWPID | SIGCHLD, NULL);
+	cpid = clone(fn, child_stack + STACK_SIZE,
+		     CLONE_NEWPID | SIGCHLD, arg);
 
-	if (CHECK(cpid == -1, "clone", "%s\n", strerror(errno)))
+	if (!ASSERT_NEQ(cpid, -1, "clone"))
 		return;
 
-	if (CHECK(waitpid(cpid, &wstatus, 0) == -1, "waitpid", "%s\n", strerror(errno)))
+	if (!ASSERT_NEQ(waitpid(cpid, &wstatus, 0), -1, "waitpid"))
 		return;
 
-	if (CHECK(WEXITSTATUS(wstatus) != 0, "newns_pidtgid", "failed"))
+	if (!ASSERT_OK(WEXITSTATUS(wstatus), "newns_pidtgid"))
 		return;
 }
 
+static void test_in_netns(int (*fn)(void *), void *arg)
+{
+	struct nstoken *nstoken = NULL;
+
+	SYS(cleanup, "ip netns add ns_current_pid_tgid");
+	SYS(cleanup, "ip -net ns_current_pid_tgid link set dev lo up");
+
+	nstoken = open_netns("ns_current_pid_tgid");
+	if (!ASSERT_OK_PTR(nstoken, "open_netns"))
+		goto cleanup;
+
+	test_ns_current_pid_tgid_new_ns(fn, arg);
+
+cleanup:
+	if (nstoken)
+		close_netns(nstoken);
+	SYS_NOFAIL("ip netns del ns_current_pid_tgid");
+}
+
 /* TODO: use a different tracepoint */
 void serial_test_ns_current_pid_tgid(void)
 {
-	if (test__start_subtest("ns_current_pid_tgid_root_ns"))
-		test_current_pid_tgid(NULL);
-	if (test__start_subtest("ns_current_pid_tgid_new_ns"))
-		test_ns_current_pid_tgid_new_ns();
+	if (test__start_subtest("root_ns_tp"))
+		test_current_pid_tgid_tp(NULL);
+	if (test__start_subtest("new_ns_tp"))
+		test_ns_current_pid_tgid_new_ns(test_current_pid_tgid_tp, NULL);
+	if (test__start_subtest("new_ns_cgrp")) {
+		int cgroup_fd = -1;
+
+		cgroup_fd = test__join_cgroup("/sock_addr");
+		if (ASSERT_GE(cgroup_fd, 0, "join_cgroup")) {
+			test_in_netns(test_current_pid_tgid_cgrp, &cgroup_fd);
+			close(cgroup_fd);
+		}
+	}
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/parse_tcp_hdr_opt.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/parse_tcp_hdr_opt.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 
+#define _GNU_SOURCE
 #include <test_progs.h>
 #include <network_helpers.h>
 #include "test_parse_tcp_hdr_opt.skel.h"
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/send_signal.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/send_signal.c
@@ -156,7 +156,8 @@
 static void test_send_signal_perf(bool signal_thread)
 {
 	struct perf_event_attr attr = {
-		.sample_period = 1,
+		.freq = 1,
+		.sample_freq = 1000,
 		.type = PERF_TYPE_SOFTWARE,
 		.config = PERF_COUNT_SW_CPU_CLOCK,
 	};
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/sk_lookup.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/sk_lookup.c
@@ -18,7 +18,6 @@
 #include <arpa/inet.h>
 #include <assert.h>
 #include <errno.h>
-#include <error.h>
 #include <fcntl.h>
 #include <sched.h>
 #include <stdio.h>
@@ -994,7 +993,7 @@
 
 	err = update_lookup_map(t->sock_map, SERVER_A, server1);
 	if (err)
-		goto detach;
+		goto close_srv1;
 
 	/* second server on destination address we should never reach */
 	server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port,
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c
@@ -1790,7 +1790,7 @@
 	if (err)
 		return;
 
-	if (socketpair(AF_UNIX, SOCK_DGRAM | SOCK_NONBLOCK, 0, sfd))
+	if (socketpair(AF_UNIX, type | SOCK_NONBLOCK, 0, sfd))
 		goto close_cli0;
 	c1 = sfd[0], p1 = sfd[1];
 
@@ -1802,7 +1802,6 @@
 close_cli0:
 	xclose(c0);
 	xclose(p0);
-
 }
 
 static void unix_inet_skb_redir_to_connected(struct test_sockmap_listen *skel,
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/tc_links.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/tc_links.c
@@ -9,6 +9,8 @@
 #define ping_cmd "ping -q -c1 -w1 127.0.0.1 > /dev/null"
 
 #include "test_tc_link.skel.h"
+
+#include "netlink_helpers.h"
 #include "tc_helpers.h"
 
 void serial_test_tc_links_basic(void)
@@ -1787,6 +1789,65 @@
 	test_tc_links_ingress(BPF_TCX_INGRESS, false, false);
 }
 
+struct qdisc_req {
+	struct nlmsghdr  n;
+	struct tcmsg     t;
+	char             buf[1024];
+};
+
+static int qdisc_replace(int ifindex, const char *kind, bool block)
+{
+	struct rtnl_handle rth = { .fd = -1 };
+	struct qdisc_req req;
+	int err;
+
+	err = rtnl_open(&rth, 0);
+	if (!ASSERT_OK(err, "open_rtnetlink"))
+		return err;
+
+	memset(&req, 0, sizeof(req));
+	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct tcmsg));
+	req.n.nlmsg_flags = NLM_F_CREATE | NLM_F_REPLACE | NLM_F_REQUEST;
+	req.n.nlmsg_type = RTM_NEWQDISC;
+	req.t.tcm_family = AF_UNSPEC;
+	req.t.tcm_ifindex = ifindex;
+	req.t.tcm_parent = 0xfffffff1;
+
+	addattr_l(&req.n, sizeof(req), TCA_KIND, kind, strlen(kind) + 1);
+	if (block)
+		addattr32(&req.n, sizeof(req), TCA_INGRESS_BLOCK, 1);
+
+	err = rtnl_talk(&rth, &req.n, NULL);
+	ASSERT_OK(err, "talk_rtnetlink");
+	rtnl_close(&rth);
+	return err;
+}
+
+void serial_test_tc_links_dev_chain0(void)
+{
+	int err, ifindex;
+
+	ASSERT_OK(system("ip link add dev foo type veth peer name bar"), "add veth");
+	ifindex = if_nametoindex("foo");
+	ASSERT_NEQ(ifindex, 0, "non_zero_ifindex");
+	err = qdisc_replace(ifindex, "ingress", true);
+	if (!ASSERT_OK(err, "attaching ingress"))
+		goto cleanup;
+	ASSERT_OK(system("tc filter add block 1 matchall action skbmod swap mac"), "add block");
+	err = qdisc_replace(ifindex, "clsact", false);
+	if (!ASSERT_OK(err, "attaching clsact"))
+		goto cleanup;
+	/* Heuristic: kern_sync_rcu() alone does not work; a wait-time of ~5s
+	 * triggered the issue without the fix reliably 100% of the time.
+	 */
+	sleep(5);
+	ASSERT_OK(system("tc filter add dev foo ingress matchall action skbmod swap mac"), "add filter");
+cleanup:
+	ASSERT_OK(system("ip link del dev foo"), "del veth");
+	ASSERT_EQ(if_nametoindex("foo"), 0, "foo removed");
+	ASSERT_EQ(if_nametoindex("bar"), 0, "bar removed");
+}
+
 static void test_tc_links_dev_mixed(int target)
 {
 	LIBBPF_OPTS(bpf_tc_opts, tc_opts, .handle = 1, .priority = 1);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
@@ -188,6 +188,7 @@
 {
 	struct nstoken *nstoken = NULL;
 	char src_fwd_addr[IFADDR_STR_LEN+1] = {};
+	char src_addr[IFADDR_STR_LEN + 1] = {};
 	int err;
 
 	if (result->dev_mode == MODE_VETH) {
@@ -208,6 +209,9 @@
 	if (get_ifaddr("src_fwd", src_fwd_addr))
 		goto fail;
 
+	if (get_ifaddr("src", src_addr))
+		goto fail;
+
 	result->ifindex_src = if_nametoindex("src");
 	if (!ASSERT_GT(result->ifindex_src, 0, "ifindex_src"))
 		goto fail;
@@ -270,6 +274,13 @@
 	SYS(fail, "ip route add " IP4_DST "/32 dev dst_fwd scope global");
 	SYS(fail, "ip route add " IP6_DST "/128 dev dst_fwd scope global");
 
+	if (result->dev_mode == MODE_VETH) {
+		SYS(fail, "ip neigh add " IP4_SRC " dev src_fwd lladdr %s", src_addr);
+		SYS(fail, "ip neigh add " IP6_SRC " dev src_fwd lladdr %s", src_addr);
+		SYS(fail, "ip neigh add " IP4_DST " dev dst_fwd lladdr %s", MAC_DST);
+		SYS(fail, "ip neigh add " IP6_DST " dev dst_fwd lladdr %s", MAC_DST);
+	}
+
 	close_netns(nstoken);
 
 	/** setup in 'dst' namespace */
@@ -280,6 +291,7 @@
 	SYS(fail, "ip addr add " IP4_DST "/32 dev dst");
 	SYS(fail, "ip addr add " IP6_DST "/128 dev dst nodad");
 	SYS(fail, "ip link set dev dst up");
+	SYS(fail, "ip link set dev lo up");
 
 	SYS(fail, "ip route add " IP4_SRC "/32 dev dst scope global");
 	SYS(fail, "ip route add " IP4_NET "/16 dev dst scope global");
@@ -457,9 +469,9 @@
 	return 0;
 }
 
-static void rcv_tstamp(int fd, const char *expected, size_t s)
+static int __rcv_tstamp(int fd, const char *expected, size_t s, __u64 *tstamp)
 {
-	struct __kernel_timespec pkt_ts = {};
+	struct timespec pkt_ts = {};
 	char ctl[CMSG_SPACE(sizeof(pkt_ts))];
 	struct timespec now_ts;
 	struct msghdr msg = {};
@@ -478,15 +490,21 @@
 
 	ret = recvmsg(fd, &msg, 0);
 	if (!ASSERT_EQ(ret, s, "recvmsg"))
-		return;
+		return -1;
 	ASSERT_STRNEQ(data, expected, s, "expected rcv data");
 
 	cmsg = CMSG_FIRSTHDR(&msg);
 	if (cmsg && cmsg->cmsg_level == SOL_SOCKET &&
-	    cmsg->cmsg_type == SO_TIMESTAMPNS_NEW)
+	    cmsg->cmsg_type == SO_TIMESTAMPNS)
 		memcpy(&pkt_ts, CMSG_DATA(cmsg), sizeof(pkt_ts));
 
 	pkt_ns = pkt_ts.tv_sec * NSEC_PER_SEC + pkt_ts.tv_nsec;
+	if (tstamp) {
+		/* caller will check the tstamp itself */
+		*tstamp = pkt_ns;
+		return 0;
+	}
+
 	ASSERT_NEQ(pkt_ns, 0, "pkt rcv tstamp");
 
 	ret = clock_gettime(CLOCK_REALTIME, &now_ts);
@@ -496,6 +514,60 @@
 	if (ASSERT_GE(now_ns, pkt_ns, "check rcv tstamp"))
 		ASSERT_LT(now_ns - pkt_ns, 5 * NSEC_PER_SEC,
 			  "check rcv tstamp");
+	return 0;
+}
+
+static void rcv_tstamp(int fd, const char *expected, size_t s)
+{
+	__rcv_tstamp(fd, expected, s, NULL);
+}
+
+static int wait_netstamp_needed_key(void)
+{
+	int opt = 1, srv_fd = -1, cli_fd = -1, nretries = 0, err, n;
+	char buf[] = "testing testing";
+	struct nstoken *nstoken;
+	__u64 tstamp = 0;
+
+	nstoken = open_netns(NS_DST);
+	if (!nstoken)
+		return -1;
+
+	srv_fd = start_server(AF_INET6, SOCK_DGRAM, "::1", 0, 0);
+	if (!ASSERT_GE(srv_fd, 0, "start_server"))
+		goto done;
+
+	err = setsockopt(srv_fd, SOL_SOCKET, SO_TIMESTAMPNS,
+			 &opt, sizeof(opt));
+	if (!ASSERT_OK(err, "setsockopt(SO_TIMESTAMPNS)"))
+		goto done;
+
+	cli_fd = connect_to_fd(srv_fd, TIMEOUT_MILLIS);
+	if (!ASSERT_GE(cli_fd, 0, "connect_to_fd"))
+		goto done;
+
+again:
+	n = write(cli_fd, buf, sizeof(buf));
+	if (!ASSERT_EQ(n, sizeof(buf), "send to server"))
+		goto done;
+	err = __rcv_tstamp(srv_fd, buf, sizeof(buf), &tstamp);
+	if (!ASSERT_OK(err, "__rcv_tstamp"))
+		goto done;
+	if (!tstamp && nretries++ < 5) {
+		sleep(1);
+		printf("netstamp_needed_key retry#%d\n", nretries);
+		goto again;
+	}
+
+done:
+	if (!tstamp && srv_fd != -1) {
+		close(srv_fd);
+		srv_fd = -1;
+	}
+	if (cli_fd != -1)
+		close(cli_fd);
+	close_netns(nstoken);
+	return srv_fd;
 }
 
 static void snd_tstamp(int fd, char *b, size_t s)
@@ -549,9 +621,9 @@
 		return;
 
 	/* Ensure the kernel puts the (rcv) timestamp for all skb */
-	err = setsockopt(listen_fd, SOL_SOCKET, SO_TIMESTAMPNS_NEW,
+	err = setsockopt(listen_fd, SOL_SOCKET, SO_TIMESTAMPNS,
 			 &opt, sizeof(opt));
-	if (!ASSERT_OK(err, "setsockopt(SO_TIMESTAMPNS_NEW)"))
+	if (!ASSERT_OK(err, "setsockopt(SO_TIMESTAMPNS)"))
 		goto done;
 
 	if (type == SOCK_STREAM) {
@@ -818,9 +890,6 @@
 
 	ASSERT_EQ(dtimes[INGRESS_FWDNS_P100], 0,
 		  dtime_cnt_str(t, INGRESS_FWDNS_P100));
-	/* non mono delivery time is not forwarded */
-	ASSERT_EQ(dtimes[INGRESS_FWDNS_P101], 0,
-		  dtime_cnt_str(t, INGRESS_FWDNS_P101));
 	for (i = EGRESS_FWDNS_P100; i < SET_DTIME; i++)
 		ASSERT_GT(dtimes[i], 0, dtime_cnt_str(t, i));
 
@@ -832,11 +901,20 @@
 {
 	struct test_tc_dtime *skel;
 	struct nstoken *nstoken;
-	int err;
+	int hold_tstamp_fd, err;
+
+	/* Hold a sk with the SOCK_TIMESTAMP set to ensure there
+	 * is no delay in the kernel net_enable_timestamp().
+	 * This ensures the following tests must have
+	 * non zero rcv tstamp in the recvmsg().
+	 */
+	hold_tstamp_fd = wait_netstamp_needed_key();
+	if (!ASSERT_GE(hold_tstamp_fd, 0, "wait_netstamp_needed_key"))
+		return;
 
 	skel = test_tc_dtime__open();
 	if (!ASSERT_OK_PTR(skel, "test_tc_dtime__open"))
-		return;
+		goto done;
 
 	skel->rodata->IFINDEX_SRC = setup_result->ifindex_src_fwd;
 	skel->rodata->IFINDEX_DST = setup_result->ifindex_dst_fwd;
@@ -881,6 +959,7 @@
 
 done:
 	test_tc_dtime__destroy(skel);
+	close(hold_tstamp_fd);
 }
 
 static void test_tc_redirect_neigh_fib(struct netns_setup_result *setup_result)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/tcp_rtt.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/tcp_rtt.c
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
 #include <test_progs.h>
 #include "cgroup_helpers.h"
 #include "network_helpers.h"
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
@@ -397,7 +397,7 @@
 	link_fd = bpf_link_create(prog_fd, 0, BPF_TRACE_UPROBE_MULTI, &opts);
 	if (!ASSERT_ERR(link_fd, "link_fd"))
 		goto cleanup;
-	ASSERT_EQ(link_fd, -ESRCH, "pid_is_wrong");
+	ASSERT_EQ(link_fd, -EINVAL, "pid_is_wrong");
 
 cleanup:
 	if (link_fd >= 0)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
@@ -4,6 +4,7 @@
 #define _GNU_SOURCE
 #include <linux/compiler.h>
 #include <linux/ring_buffer.h>
+#include <linux/build_bug.h>
 #include <pthread.h>
 #include <stdio.h>
 #include <stdlib.h>
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c
@@ -222,7 +222,7 @@
 
 	prog = bpf_object__next_program(obj, NULL);
 	if (bpf_object__load(obj))
-		return;
+		goto out;
 
 	prog_fd = bpf_program__fd(prog);
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
@@ -107,8 +107,8 @@
 			    .attach_point = BPF_TC_INGRESS);
 
 	memcpy(&data[sizeof(__u64)], &pkt_udp, sizeof(pkt_udp));
-	*((__u32 *)data) = 0x42; /* metadata test value */
-	*((__u32 *)data + 4) = 0;
+	((__u32 *)data)[0] = 0x42; /* metadata test value */
+	((__u32 *)data)[1] = 0;
 
 	skel = test_xdp_do_redirect__open();
 	if (!ASSERT_OK_PTR(skel, "skel"))
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/bench_local_storage_create.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/bench_local_storage_create.c
@@ -61,14 +61,15 @@
 int BPF_PROG(socket_post_create, struct socket *sock, int family, int type,
 	     int protocol, int kern)
 {
+	struct sock *sk = sock->sk;
 	struct storage *stg;
 	__u32 pid;
 
 	pid = bpf_get_current_pid_tgid() >> 32;
-	if (pid != bench_pid)
+	if (pid != bench_pid || !sk)
 		return 0;
 
-	stg = bpf_sk_storage_get(&sk_storage_map, sock->sk, NULL,
+	stg = bpf_sk_storage_get(&sk_storage_map, sk, NULL,
 				 BPF_LOCAL_STORAGE_GET_F_CREATE);
 
 	if (stg)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/bpf_misc.h
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/bpf_misc.h
@@ -2,14 +2,17 @@
 #ifndef __BPF_MISC_H__
 #define __BPF_MISC_H__
 
+#define XSTR(s) STR(s)
+#define STR(s) #s
+
 /* This set of attributes controls behavior of the
  * test_loader.c:test_loader__run_subtests().
  *
  * The test_loader sequentially loads each program in a skeleton.
  * Programs could be loaded in privileged and unprivileged modes.
- * - __success, __failure, __msg imply privileged mode;
- * - __success_unpriv, __failure_unpriv, __msg_unpriv imply
- *   unprivileged mode.
+ * - __success, __failure, __msg, __regex imply privileged mode;
+ * - __success_unpriv, __failure_unpriv, __msg_unpriv, __regex_unpriv
+ *   imply unprivileged mode.
  * If combination of privileged and unprivileged attributes is present
  * both modes are used. If none are present privileged mode is implied.
  *
@@ -24,6 +27,12 @@
  *                   Multiple __msg attributes could be specified.
  * __msg_unpriv      Same as __msg but for unprivileged mode.
  *
+ * __regex           Same as __msg, but using a regular expression.
+ * __regex_unpriv    Same as __msg_unpriv but using a regular expression.
+ * __xlated          Expect a line in a disassembly log after verifier applies rewrites.
+ *                   Multiple __xlated attributes could be specified.
+ * __xlated_unpriv   Same as __xlated but for unprivileged mode.
+ *
  * __success         Expect program load success in privileged mode.
  * __success_unpriv  Expect program load success in unprivileged mode.
  *
@@ -57,12 +66,20 @@
  * __auxiliary         Annotated program is not a separate test, but used as auxiliary
  *                     for some other test cases and should always be loaded.
  * __auxiliary_unpriv  Same, but load program in unprivileged mode.
+ *
+ * __arch_*          Specify on which architecture the test case should be tested.
+ *                   Several __arch_* annotations could be specified at once.
+ *                   When test case is not run on current arch it is marked as skipped.
  */
-#define __msg(msg)		__attribute__((btf_decl_tag("comment:test_expect_msg=" msg)))
+#define __msg(msg)		__attribute__((btf_decl_tag("comment:test_expect_msg=" XSTR(__COUNTER__) "=" msg)))
+#define __regex(regex)		__attribute__((btf_decl_tag("comment:test_expect_regex=" XSTR(__COUNTER__) "=" regex)))
+#define __xlated(msg)		__attribute__((btf_decl_tag("comment:test_expect_xlated=" XSTR(__COUNTER__) "=" msg)))
 #define __failure		__attribute__((btf_decl_tag("comment:test_expect_failure")))
 #define __success		__attribute__((btf_decl_tag("comment:test_expect_success")))
 #define __description(desc)	__attribute__((btf_decl_tag("comment:test_description=" desc)))
-#define __msg_unpriv(msg)	__attribute__((btf_decl_tag("comment:test_expect_msg_unpriv=" msg)))
+#define __msg_unpriv(msg)	__attribute__((btf_decl_tag("comment:test_expect_msg_unpriv=" XSTR(__COUNTER__) "=" msg)))
+#define __regex_unpriv(regex)	__attribute__((btf_decl_tag("comment:test_expect_regex_unpriv=" XSTR(__COUNTER__) "=" regex)))
+#define __xlated_unpriv(msg)	__attribute__((btf_decl_tag("comment:test_expect_xlated_unpriv=" XSTR(__COUNTER__) "=" msg)))
 #define __failure_unpriv	__attribute__((btf_decl_tag("comment:test_expect_failure_unpriv")))
 #define __success_unpriv	__attribute__((btf_decl_tag("comment:test_expect_success_unpriv")))
 #define __log_level(lvl)	__attribute__((btf_decl_tag("comment:test_log_level="#lvl)))
@@ -72,6 +89,10 @@
 #define __auxiliary		__attribute__((btf_decl_tag("comment:test_auxiliary")))
 #define __auxiliary_unpriv	__attribute__((btf_decl_tag("comment:test_auxiliary_unpriv")))
 #define __btf_path(path)	__attribute__((btf_decl_tag("comment:test_btf_path=" path)))
+#define __arch(arch)		__attribute__((btf_decl_tag("comment:test_arch=" arch)))
+#define __arch_x86_64		__arch("X86_64")
+#define __arch_arm64		__arch("ARM64")
+#define __arch_riscv64		__arch("RISCV64")
 
 /* Convenience macro for use with 'asm volatile' blocks */
 #define __naked __attribute__((naked))
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/btf_dump_test_case_multidim.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/btf_dump_test_case_multidim.c
@@ -14,9 +14,9 @@
 
 typedef int *ptr_multiarr_t[7][8][9][10];
 
-typedef int * (*fn_ptr_arr_t[11])();
+typedef int * (*fn_ptr_arr_t[11])(void);
 
-typedef int * (*fn_ptr_multiarr_t[12][13])();
+typedef int * (*fn_ptr_multiarr_t[12][13])(void);
 
 struct root_struct {
 	arr_t _1;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/btf_dump_test_case_syntax.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/btf_dump_test_case_syntax.c
@@ -100,7 +100,7 @@
  *   `int -> char *` function and returns pointer to a char. Equivalent:
  *   typedef char * (*fn_input_t)(int);
  *   typedef char * (*fn_output_outer_t)(fn_input_t);
- *   typedef const fn_output_outer_t (* fn_output_inner_t)();
+ *   typedef const fn_output_outer_t (* fn_output_inner_t)(void);
  *   typedef const fn_output_inner_t fn_ptr_arr2_t[5];
  */
 /* ----- START-EXPECTED-OUTPUT ----- */
@@ -127,7 +127,7 @@
 
 typedef char * (*fn_ptr_arr1_t[10])(int **);
 
-typedef char * (* (* const fn_ptr_arr2_t[5])())(char * (*)(int));
+typedef char * (* (* const fn_ptr_arr2_t[5])(void))(char * (*)(int));
 
 struct struct_w_typedefs {
 	int_t a;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/cg_storage_multi.h
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/cg_storage_multi.h
@@ -3,8 +3,6 @@
 #ifndef __PROGS_CG_STORAGE_MULTI_H
 #define __PROGS_CG_STORAGE_MULTI_H
 
-#include <asm/types.h>
-
 struct cgroup_value {
 	__u32 egress_pkts;
 	__u32 ingress_pkts;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/cpumask_failure.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/cpumask_failure.c
@@ -61,11 +61,8 @@
 __failure __msg("bpf_cpumask_set_cpu args#1 expected pointer to STRUCT bpf_cpumask")
 int BPF_PROG(test_mutate_cpumask, struct task_struct *task, u64 clone_flags)
 {
-	struct bpf_cpumask *cpumask;
-
 	/* Can't set the CPU of a non-struct bpf_cpumask. */
 	bpf_cpumask_set_cpu(0, (struct bpf_cpumask *)task->cpus_ptr);
-	__sink(cpumask);
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c
@@ -11,8 +11,17 @@
 {
 	int ret;
 
-	if (!state)
-		return 0xf2f3f4f5;
+	/* Check that 'state' nullable status is detected correctly.
+	 * If 'state' argument would be assumed non-null by verifier
+	 * the code below would be deleted as dead (which it shouldn't).
+	 * Hide it from the compiler behind 'asm' block to avoid
+	 * unnecessary optimizations.
+	 */
+	asm volatile (
+		"if %[state] != 0 goto +2;"
+		"r0 = 0xf2f3f4f5;"
+		"exit;"
+	::[state]"p"(state));
 
 	ret = state->val;
 	state->val = 0x5a;
@@ -25,7 +34,7 @@
 int BPF_PROG(test_2, struct bpf_dummy_ops_state *state, int a1, unsigned short a2,
 	     char a3, unsigned long a4)
 {
-	test_2_args[0] = (unsigned long)state;
+	test_2_args[0] = state->val;
 	test_2_args[1] = a1;
 	test_2_args[2] = a2;
 	test_2_args[3] = a3;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/dynptr_fail.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/dynptr_fail.c
@@ -80,7 +80,7 @@
 __failure __msg("Unreleased reference id=2")
 int ringbuf_missing_release1(void *ctx)
 {
-	struct bpf_dynptr ptr;
+	struct bpf_dynptr ptr = {};
 
 	bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
 
@@ -1385,7 +1385,7 @@
 __failure __msg("Expected an initialized dynptr as arg #1")
 int dynptr_adjust_invalid(void *ctx)
 {
-	struct bpf_dynptr ptr;
+	struct bpf_dynptr ptr = {};
 
 	/* this should fail */
 	bpf_dynptr_adjust(&ptr, 1, 2);
@@ -1398,7 +1398,7 @@
 __failure __msg("Expected an initialized dynptr as arg #1")
 int dynptr_is_null_invalid(void *ctx)
 {
-	struct bpf_dynptr ptr;
+	struct bpf_dynptr ptr = {};
 
 	/* this should fail */
 	bpf_dynptr_is_null(&ptr);
@@ -1411,7 +1411,7 @@
 __failure __msg("Expected an initialized dynptr as arg #1")
 int dynptr_is_rdonly_invalid(void *ctx)
 {
-	struct bpf_dynptr ptr;
+	struct bpf_dynptr ptr = {};
 
 	/* this should fail */
 	bpf_dynptr_is_rdonly(&ptr);
@@ -1424,7 +1424,7 @@
 __failure __msg("Expected an initialized dynptr as arg #1")
 int dynptr_size_invalid(void *ctx)
 {
-	struct bpf_dynptr ptr;
+	struct bpf_dynptr ptr = {};
 
 	/* this should fail */
 	bpf_dynptr_size(&ptr);
@@ -1437,7 +1437,7 @@
 __failure __msg("Expected an initialized dynptr as arg #1")
 int clone_invalid1(void *ctx)
 {
-	struct bpf_dynptr ptr1;
+	struct bpf_dynptr ptr1 = {};
 	struct bpf_dynptr ptr2;
 
 	/* this should fail */
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/iters.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/iters.c
@@ -1433,4 +1433,58 @@
 	return sum;
 }
 
+__u32 upper, select_n, result;
+__u64 global;
+
+static __noinline bool nest_2(char *str)
+{
+	/* some insns (including branch insns) to ensure stacksafe() is triggered
+	 * in nest_2(). This way, stacksafe() can compare frame associated with nest_1().
+	 */
+	if (str[0] == 't')
+		return true;
+	if (str[1] == 'e')
+		return true;
+	if (str[2] == 's')
+		return true;
+	if (str[3] == 't')
+		return true;
+	return false;
+}
+
+static __noinline bool nest_1(int n)
+{
+	/* case 0: allocate stack, case 1: no allocate stack */
+	switch (n) {
+	case 0: {
+		char comm[16];
+
+		if (bpf_get_current_comm(comm, 16))
+			return false;
+		return nest_2(comm);
+	}
+	case 1:
+		return nest_2((char *)&global);
+	default:
+		return false;
+	}
+}
+
+SEC("raw_tp")
+__success
+int iter_subprog_check_stacksafe(const void *ctx)
+{
+	long i;
+
+	bpf_for(i, 0, upper) {
+		if (!nest_1(select_n)) {
+			result = 1;
+			return 0;
+		}
+	}
+
+	result = 2;
+	return 0;
+}
+
 char _license[] SEC("license") = "GPL";
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
@@ -4,6 +4,10 @@
 #include <bpf/bpf_helpers.h>
 #include "bpf_misc.h"
 
+#ifndef __clang__
+#pragma GCC diagnostic ignored "-Warray-bounds"
+#endif
+
 char _license[] SEC("license") = "GPL";
 
 struct {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/local_storage.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/local_storage.c
@@ -140,11 +140,12 @@
 {
 	__u32 pid = bpf_get_current_pid_tgid() >> 32;
 	struct local_storage *storage;
+	struct sock *sk = sock->sk;
 
-	if (pid != monitored_pid)
+	if (pid != monitored_pid || !sk)
 		return 0;
 
-	storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0, 0);
+	storage = bpf_sk_storage_get(&sk_storage_map, sk, 0, 0);
 	if (!storage)
 		return 0;
 
@@ -155,24 +156,24 @@
 	/* This tests that we can associate multiple elements
 	 * with the local storage.
 	 */
-	storage = bpf_sk_storage_get(&sk_storage_map2, sock->sk, 0,
+	storage = bpf_sk_storage_get(&sk_storage_map2, sk, 0,
 				     BPF_LOCAL_STORAGE_GET_F_CREATE);
 	if (!storage)
 		return 0;
 
-	if (bpf_sk_storage_delete(&sk_storage_map2, sock->sk))
+	if (bpf_sk_storage_delete(&sk_storage_map2, sk))
 		return 0;
 
-	storage = bpf_sk_storage_get(&sk_storage_map2, sock->sk, 0,
+	storage = bpf_sk_storage_get(&sk_storage_map2, sk, 0,
 				     BPF_LOCAL_STORAGE_GET_F_CREATE);
 	if (!storage)
 		return 0;
 
-	if (bpf_sk_storage_delete(&sk_storage_map, sock->sk))
+	if (bpf_sk_storage_delete(&sk_storage_map, sk))
 		return 0;
 
 	/* Ensure that the sk_storage_map is disconnected from the storage. */
-	if (!sock->sk->sk_bpf_storage || sock->sk->sk_bpf_storage->smap)
+	if (!sk->sk_bpf_storage || sk->sk_bpf_storage->smap)
 		return 0;
 
 	sk_storage_result = 0;
@@ -185,11 +186,12 @@
 {
 	__u32 pid = bpf_get_current_pid_tgid() >> 32;
 	struct local_storage *storage;
+	struct sock *sk = sock->sk;
 
-	if (pid != monitored_pid)
+	if (pid != monitored_pid || !sk)
 		return 0;
 
-	storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0,
+	storage = bpf_sk_storage_get(&sk_storage_map, sk, 0,
 				     BPF_LOCAL_STORAGE_GET_F_CREATE);
 	if (!storage)
 		return 0;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/lsm_cgroup.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/lsm_cgroup.c
@@ -103,11 +103,15 @@
 				     int addrlen)
 {
 	struct sockaddr_ll sa = {};
+	struct sock *sk = sock->sk;
 
-	if (sock->sk->__sk_common.skc_family != AF_PACKET)
+	if (!sk)
 		return 1;
 
-	if (sock->sk->sk_kern_sock)
+	if (sk->__sk_common.skc_family != AF_PACKET)
+		return 1;
+
+	if (sk->sk_kern_sock)
 		return 1;
 
 	bpf_probe_read_kernel(&sa, sizeof(sa), address);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/map_ptr_kern.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/map_ptr_kern.c
@@ -316,7 +316,7 @@
 } __attribute__((preserve_access_index));
 
 struct lpm_key {
-	struct bpf_lpm_trie_key trie_key;
+	struct bpf_lpm_trie_key_hdr trie_key;
 	__u32 data;
 };
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/profiler.inc.h
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/profiler.inc.h
@@ -63,11 +63,11 @@
 #define READ_ENVIRON_FROM_EXEC (bpf_config.read_environ_from_exec)
 #define ENABLE_CGROUP_V1_RESOLVER (bpf_config.enable_cgroup_v1_resolver)
 
-struct kernfs_iattrs___52 {
+struct _kernfs_iattrs___52 {
 	struct iattr ia_iattr;
 };
 
-struct kernfs_node___52 {
+struct _kernfs_node___52 {
 	union /* kernfs_node_id */ {
 		struct {
 			u32 ino;
@@ -232,7 +232,7 @@
 
 static ino_t get_inode_from_kernfs(struct kernfs_node* node)
 {
-	struct kernfs_node___52* node52 = (void*)node;
+	struct _kernfs_node___52* node52 = (void*)node;
 
 	if (bpf_core_field_exists(node52->id.ino)) {
 		barrier_var(node52);
@@ -287,13 +287,13 @@
 		cgroup_data->cgroup_proc_mtime =
 			BPF_CORE_READ(proc_kernfs, iattr, ia_mtime.tv_nsec);
 	} else {
-		struct kernfs_iattrs___52* root_iattr =
-			(struct kernfs_iattrs___52*)BPF_CORE_READ(root_kernfs, iattr);
+		struct _kernfs_iattrs___52* root_iattr =
+			(struct _kernfs_iattrs___52*)BPF_CORE_READ(root_kernfs, iattr);
 		cgroup_data->cgroup_root_mtime =
 			BPF_CORE_READ(root_iattr, ia_iattr.ia_mtime.tv_nsec);
 
-		struct kernfs_iattrs___52* proc_iattr =
-			(struct kernfs_iattrs___52*)BPF_CORE_READ(proc_kernfs, iattr);
+		struct _kernfs_iattrs___52* proc_iattr =
+			(struct _kernfs_iattrs___52*)BPF_CORE_READ(proc_kernfs, iattr);
 		cgroup_data->cgroup_proc_mtime =
 			BPF_CORE_READ(proc_iattr, ia_iattr.ia_mtime.tv_nsec);
 	}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c
@@ -31,6 +31,7 @@
 
 	if (fmode & FMODE_WRITE)
 		return -EACCES;
+	barrier();
 
 	return 0;
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/test_map_in_map.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/test_map_in_map.c
@@ -21,6 +21,32 @@
 	__type(value, __u32);
 } mim_hash SEC(".maps");
 
+/* The following three maps are used to test
+ * perf_event_array map can be an inner
+ * map of hash/array_of_maps.
+ */
+struct perf_event_array {
+	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+	__type(key, __u32);
+	__type(value, __u32);
+} inner_map0 SEC(".maps");
+
+struct {
+	__uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
+	__uint(max_entries, 1);
+	__type(key, __u32);
+	__array(values, struct perf_event_array);
+} mim_array_pe SEC(".maps") = {
+	.values = {&inner_map0}};
+
+struct {
+	__uint(type, BPF_MAP_TYPE_HASH_OF_MAPS);
+	__uint(max_entries, 1);
+	__type(key, __u32);
+	__array(values, struct perf_event_array);
+} mim_hash_pe SEC(".maps") = {
+	.values = {&inner_map0}};
+
 SEC("xdp")
 int xdp_mimtest0(struct xdp_md *ctx)
 {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
@@ -10,18 +10,29 @@
 __u64 dev = 0;
 __u64 ino = 0;
 
-SEC("tracepoint/syscalls/sys_enter_nanosleep")
-int handler(const void *ctx)
+static void get_pid_tgid(void)
 {
 	struct bpf_pidns_info nsdata;
 
 	if (bpf_get_ns_current_pid_tgid(dev, ino, &nsdata, sizeof(struct bpf_pidns_info)))
-		return 0;
+		return;
 
 	user_pid = nsdata.pid;
 	user_tgid = nsdata.tgid;
+}
 
+SEC("?tracepoint/syscalls/sys_enter_nanosleep")
+int tp_handler(const void *ctx)
+{
+	get_pid_tgid();
 	return 0;
 }
 
+SEC("?cgroup/bind4")
+int cgroup_bind4(struct bpf_sock_addr *ctx)
+{
+	get_pid_tgid();
+	return 1;
+}
+
 char _license[] SEC("license") = "GPL";
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/test_spin_lock_fail.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/test_spin_lock_fail.c
@@ -28,8 +28,8 @@
 	},
 };
 
-SEC(".data.A") struct bpf_spin_lock lockA;
-SEC(".data.B") struct bpf_spin_lock lockB;
+static struct bpf_spin_lock lockA SEC(".data.A");
+static struct bpf_spin_lock lockB SEC(".data.B");
 
 SEC("?tc")
 int lock_id_kptr_preserve(void *ctx)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/test_tc_dtime.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/test_tc_dtime.c
@@ -222,17 +222,21 @@
 		return TC_ACT_OK;
 
 	if (skb_proto(skb_type) == IPPROTO_TCP) {
-		if (skb->tstamp_type == BPF_SKB_TSTAMP_DELIVERY_MONO &&
+		if (skb->tstamp_type == BPF_SKB_CLOCK_MONOTONIC &&
 		    skb->tstamp)
 			inc_dtimes(EGRESS_ENDHOST);
 		else
 			inc_errs(EGRESS_ENDHOST);
-	} else {
-		if (skb->tstamp_type == BPF_SKB_TSTAMP_UNSPEC &&
+	} else if (skb_proto(skb_type) == IPPROTO_UDP) {
+		if (skb->tstamp_type == BPF_SKB_CLOCK_TAI &&
 		    skb->tstamp)
 			inc_dtimes(EGRESS_ENDHOST);
 		else
 			inc_errs(EGRESS_ENDHOST);
+	} else {
+		if (skb->tstamp_type == BPF_SKB_CLOCK_REALTIME &&
+		    skb->tstamp)
+			inc_errs(EGRESS_ENDHOST);
 	}
 
 	skb->tstamp = EGRESS_ENDHOST_MAGIC;
@@ -252,7 +256,7 @@
 	if (!skb_type)
 		return TC_ACT_OK;
 
-	if (skb->tstamp_type == BPF_SKB_TSTAMP_DELIVERY_MONO &&
+	if (skb->tstamp_type == BPF_SKB_CLOCK_MONOTONIC &&
 	    skb->tstamp == EGRESS_FWDNS_MAGIC)
 		inc_dtimes(INGRESS_ENDHOST);
 	else
@@ -315,7 +319,6 @@
 SEC("tc")
 int ingress_fwdns_prio101(struct __sk_buff *skb)
 {
-	__u64 expected_dtime = EGRESS_ENDHOST_MAGIC;
 	int skb_type;
 
 	skb_type = skb_get_type(skb);
@@ -323,29 +326,24 @@
 		/* Should have handled in prio100 */
 		return TC_ACT_SHOT;
 
-	if (skb_proto(skb_type) == IPPROTO_UDP)
-		expected_dtime = 0;
-
 	if (skb->tstamp_type) {
 		if (fwdns_clear_dtime() ||
-		    skb->tstamp_type != BPF_SKB_TSTAMP_DELIVERY_MONO ||
-		    skb->tstamp != expected_dtime)
+		    (skb->tstamp_type != BPF_SKB_CLOCK_MONOTONIC &&
+		    skb->tstamp_type != BPF_SKB_CLOCK_TAI) ||
+		    skb->tstamp != EGRESS_ENDHOST_MAGIC)
 			inc_errs(INGRESS_FWDNS_P101);
 		else
 			inc_dtimes(INGRESS_FWDNS_P101);
 	} else {
-		if (!fwdns_clear_dtime() && expected_dtime)
+		if (!fwdns_clear_dtime())
 			inc_errs(INGRESS_FWDNS_P101);
 	}
 
-	if (skb->tstamp_type == BPF_SKB_TSTAMP_DELIVERY_MONO) {
+	if (skb->tstamp_type == BPF_SKB_CLOCK_MONOTONIC) {
 		skb->tstamp = INGRESS_FWDNS_MAGIC;
 	} else {
 		if (bpf_skb_set_tstamp(skb, INGRESS_FWDNS_MAGIC,
-				       BPF_SKB_TSTAMP_DELIVERY_MONO))
-			inc_errs(SET_DTIME);
-		if (!bpf_skb_set_tstamp(skb, INGRESS_FWDNS_MAGIC,
-					BPF_SKB_TSTAMP_UNSPEC))
+				       BPF_SKB_CLOCK_MONOTONIC))
 			inc_errs(SET_DTIME);
 	}
 
@@ -370,7 +368,7 @@
 
 	if (skb->tstamp_type) {
 		if (fwdns_clear_dtime() ||
-		    skb->tstamp_type != BPF_SKB_TSTAMP_DELIVERY_MONO ||
+		    skb->tstamp_type != BPF_SKB_CLOCK_MONOTONIC ||
 		    skb->tstamp != INGRESS_FWDNS_MAGIC)
 			inc_errs(EGRESS_FWDNS_P101);
 		else
@@ -380,14 +378,11 @@
 			inc_errs(EGRESS_FWDNS_P101);
 	}
 
-	if (skb->tstamp_type == BPF_SKB_TSTAMP_DELIVERY_MONO) {
+	if (skb->tstamp_type == BPF_SKB_CLOCK_MONOTONIC) {
 		skb->tstamp = EGRESS_FWDNS_MAGIC;
 	} else {
 		if (bpf_skb_set_tstamp(skb, EGRESS_FWDNS_MAGIC,
-				       BPF_SKB_TSTAMP_DELIVERY_MONO))
-			inc_errs(SET_DTIME);
-		if (!bpf_skb_set_tstamp(skb, INGRESS_FWDNS_MAGIC,
-					BPF_SKB_TSTAMP_UNSPEC))
+				       BPF_SKB_CLOCK_MONOTONIC))
 			inc_errs(SET_DTIME);
 	}
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
@@ -26,6 +26,18 @@
  */
 #define ASSIGNED_ADDR_VETH1 0xac1001c8
 
+struct bpf_fou_encap___local {
+	__be16 sport;
+	__be16 dport;
+} __attribute__((preserve_access_index));
+
+enum bpf_fou_encap_type___local {
+	FOU_BPF_ENCAP_FOU___local,
+	FOU_BPF_ENCAP_GUE___local,
+};
+
+struct bpf_fou_encap;
+
 int bpf_skb_set_fou_encap(struct __sk_buff *skb_ctx,
 			  struct bpf_fou_encap *encap, int type) __ksym;
 int bpf_skb_get_fou_encap(struct __sk_buff *skb_ctx,
@@ -567,12 +579,18 @@
 	return TC_ACT_OK;
 }
 
+struct local_geneve_opt {
+	struct geneve_opt gopt;
+	int data;
+};
+
 SEC("tc")
 int geneve_set_tunnel(struct __sk_buff *skb)
 {
 	int ret;
 	struct bpf_tunnel_key key;
-	struct geneve_opt gopt;
+	struct local_geneve_opt local_gopt;
+	struct geneve_opt *gopt = (struct geneve_opt *) &local_gopt;
 
 	__builtin_memset(&key, 0x0, sizeof(key));
 	key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
@@ -580,14 +598,14 @@
 	key.tunnel_tos = 0;
 	key.tunnel_ttl = 64;
 
-	__builtin_memset(&gopt, 0x0, sizeof(gopt));
-	gopt.opt_class = bpf_htons(0x102); /* Open Virtual Networking (OVN) */
-	gopt.type = 0x08;
-	gopt.r1 = 0;
-	gopt.r2 = 0;
-	gopt.r3 = 0;
-	gopt.length = 2; /* 4-byte multiple */
-	*(int *) &gopt.opt_data = bpf_htonl(0xdeadbeef);
+	__builtin_memset(gopt, 0x0, sizeof(local_gopt));
+	gopt->opt_class = bpf_htons(0x102); /* Open Virtual Networking (OVN) */
+	gopt->type = 0x08;
+	gopt->r1 = 0;
+	gopt->r2 = 0;
+	gopt->r3 = 0;
+	gopt->length = 2; /* 4-byte multiple */
+	*(int *) &gopt->opt_data = bpf_htonl(0xdeadbeef);
 
 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
 				     BPF_F_ZERO_CSUM_TX);
@@ -596,7 +614,7 @@
 		return TC_ACT_SHOT;
 	}
 
-	ret = bpf_skb_set_tunnel_opt(skb, &gopt, sizeof(gopt));
+	ret = bpf_skb_set_tunnel_opt(skb, gopt, sizeof(local_gopt));
 	if (ret < 0) {
 		log_err(ret);
 		return TC_ACT_SHOT;
@@ -631,7 +649,8 @@
 int ip6geneve_set_tunnel(struct __sk_buff *skb)
 {
 	struct bpf_tunnel_key key;
-	struct geneve_opt gopt;
+	struct local_geneve_opt local_gopt;
+	struct geneve_opt *gopt = (struct geneve_opt *) &local_gopt;
 	int ret;
 
 	__builtin_memset(&key, 0x0, sizeof(key));
@@ -647,16 +666,16 @@
 		return TC_ACT_SHOT;
 	}
 
-	__builtin_memset(&gopt, 0x0, sizeof(gopt));
-	gopt.opt_class = bpf_htons(0x102); /* Open Virtual Networking (OVN) */
-	gopt.type = 0x08;
-	gopt.r1 = 0;
-	gopt.r2 = 0;
-	gopt.r3 = 0;
-	gopt.length = 2; /* 4-byte multiple */
-	*(int *) &gopt.opt_data = bpf_htonl(0xfeedbeef);
+	__builtin_memset(gopt, 0x0, sizeof(local_gopt));
+	gopt->opt_class = bpf_htons(0x102); /* Open Virtual Networking (OVN) */
+	gopt->type = 0x08;
+	gopt->r1 = 0;
+	gopt->r2 = 0;
+	gopt->r3 = 0;
+	gopt->length = 2; /* 4-byte multiple */
+	*(int *) &gopt->opt_data = bpf_htonl(0xfeedbeef);
 
-	ret = bpf_skb_set_tunnel_opt(skb, &gopt, sizeof(gopt));
+	ret = bpf_skb_set_tunnel_opt(skb, gopt, sizeof(gopt));
 	if (ret < 0) {
 		log_err(ret);
 		return TC_ACT_SHOT;
@@ -738,7 +757,7 @@
 int ipip_gue_set_tunnel(struct __sk_buff *skb)
 {
 	struct bpf_tunnel_key key = {};
-	struct bpf_fou_encap encap = {};
+	struct bpf_fou_encap___local encap = {};
 	void *data = (void *)(long)skb->data;
 	struct iphdr *iph = data;
 	void *data_end = (void *)(long)skb->data_end;
@@ -762,7 +781,9 @@
 	encap.sport = 0;
 	encap.dport = bpf_htons(5555);
 
-	ret = bpf_skb_set_fou_encap(skb, &encap, FOU_BPF_ENCAP_GUE);
+	ret = bpf_skb_set_fou_encap(skb, (struct bpf_fou_encap *)&encap,
+				    bpf_core_enum_value(enum bpf_fou_encap_type___local,
+							FOU_BPF_ENCAP_GUE___local));
 	if (ret < 0) {
 		log_err(ret);
 		return TC_ACT_SHOT;
@@ -775,7 +796,7 @@
 int ipip_fou_set_tunnel(struct __sk_buff *skb)
 {
 	struct bpf_tunnel_key key = {};
-	struct bpf_fou_encap encap = {};
+	struct bpf_fou_encap___local encap = {};
 	void *data = (void *)(long)skb->data;
 	struct iphdr *iph = data;
 	void *data_end = (void *)(long)skb->data_end;
@@ -799,7 +820,8 @@
 	encap.sport = 0;
 	encap.dport = bpf_htons(5555);
 
-	ret = bpf_skb_set_fou_encap(skb, &encap, FOU_BPF_ENCAP_FOU);
+	ret = bpf_skb_set_fou_encap(skb, (struct bpf_fou_encap *)&encap,
+				    FOU_BPF_ENCAP_FOU___local);
 	if (ret < 0) {
 		log_err(ret);
 		return TC_ACT_SHOT;
@@ -813,7 +835,7 @@
 {
 	int ret;
 	struct bpf_tunnel_key key = {};
-	struct bpf_fou_encap encap = {};
+	struct bpf_fou_encap___local encap = {};
 
 	ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), 0);
 	if (ret < 0) {
@@ -821,7 +843,7 @@
 		return TC_ACT_SHOT;
 	}
 
-	ret = bpf_skb_get_fou_encap(skb, &encap);
+	ret = bpf_skb_get_fou_encap(skb, (struct bpf_fou_encap *)&encap);
 	if (ret < 0) {
 		log_err(ret);
 		return TC_ACT_SHOT;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c
@@ -11,7 +11,7 @@
 __naked void btf_ctx_access_accept(void)
 {
 	asm volatile ("					\
-	r2 = *(u32*)(r1 + 8);		/* load 2nd argument value (int pointer) */\
+	r2 = *(u64 *)(r1 + 8);		/* load 2nd argument value (int pointer) */\
 	r0 = 0;						\
 	exit;						\
 "	::: __clobber_all);
@@ -23,7 +23,7 @@
 __naked void ctx_access_u32_pointer_accept(void)
 {
 	asm volatile ("					\
-	r2 = *(u32*)(r1 + 0);		/* load 1nd argument value (u32 pointer) */\
+	r2 = *(u64 *)(r1 + 0);		/* load 1nd argument value (u32 pointer) */\
 	r0 = 0;						\
 	exit;						\
 "	::: __clobber_all);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/verifier_d_path.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/verifier_d_path.c
@@ -11,7 +11,7 @@
 __naked void d_path_accept(void)
 {
 	asm volatile ("					\
-	r1 = *(u32*)(r1 + 0);				\
+	r1 = *(u64 *)(r1 + 0);				\
 	r2 = r10;					\
 	r2 += -8;					\
 	r6 = 0;						\
@@ -31,7 +31,7 @@
 __naked void d_path_reject(void)
 {
 	asm volatile ("					\
-	r1 = *(u32*)(r1 + 0);				\
+	r1 = *(u64 *)(r1 + 0);				\
 	r2 = r10;					\
 	r2 += -8;					\
 	r6 = 0;						\
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
@@ -8,6 +8,13 @@
 #include "xdp_metadata.h"
 #include "bpf_kfuncs.h"
 
+/* The compiler may be able to detect the access to uninitialized
+   memory in the routines performing out of bound memory accesses and
+   emit warnings about it.  This is the case of GCC. */
+#if !defined(__clang__)
+#pragma GCC diagnostic ignored "-Wmaybe-uninitialized"
+#endif
+
 int arr[1];
 int unkn_idx;
 const volatile bool call_dead_subprog = false;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/verifier_int_ptr.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/verifier_int_ptr.c
@@ -8,7 +8,6 @@
 SEC("socket")
 __description("ARG_PTR_TO_LONG uninitialized")
 __success
-__failure_unpriv __msg_unpriv("invalid indirect read from stack R4 off -16+0 size 8")
 __naked void arg_ptr_to_long_uninitialized(void)
 {
 	asm volatile ("					\
@@ -36,9 +35,7 @@
 
 SEC("socket")
 __description("ARG_PTR_TO_LONG half-uninitialized")
-/* in privileged mode reads from uninitialized stack locations are permitted */
-__success __failure_unpriv
-__msg_unpriv("invalid indirect read from stack R4 off -16+4 size 8")
+__success
 __retval(0)
 __naked void ptr_to_long_half_uninitialized(void)
 {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
@@ -656,4 +656,55 @@
 	: __clobber_all);
 }
 
+SEC("socket")
+/* Note the flag, see verifier.c:opt_subreg_zext_lo32_rnd_hi32() */
+__flag(BPF_F_TEST_RND_HI32)
+__success
+/* This test was added because of a bug in verifier.c:sync_linked_regs(),
+ * upon range propagation it destroyed subreg_def marks for registers.
+ * The subreg_def mark is used to decide whether zero extension instructions
+ * are needed when register is read. When BPF_F_TEST_RND_HI32 is set it
+ * also causes generation of statements to randomize upper halves of
+ * read registers.
+ *
+ * The test is written in a way to return an upper half of a register
+ * that is affected by range propagation and must have it's subreg_def
+ * preserved. This gives a return value of 0 and leads to undefined
+ * return value if subreg_def mark is not preserved.
+ */
+__retval(0)
+/* Check that verifier believes r1/r0 are zero at exit */
+__log_level(2)
+__msg("4: (77) r1 >>= 32                     ; R1_w=0")
+__msg("5: (bf) r0 = r1                       ; R0_w=0 R1_w=0")
+__msg("6: (95) exit")
+__msg("from 3 to 4")
+__msg("4: (77) r1 >>= 32                     ; R1_w=0")
+__msg("5: (bf) r0 = r1                       ; R0_w=0 R1_w=0")
+__msg("6: (95) exit")
+__naked void linked_regs_and_subreg_def(void)
+{
+	asm volatile (
+	"call %[bpf_ktime_get_ns];"
+	/* make sure r0 is in 32-bit range, otherwise w1 = w0 won't
+	 * assign same IDs to registers.
+	 */
+	"r0 &= 0x7fffffff;"
+	/* link w1 and w0 via ID */
+	"w1 = w0;"
+	/* 'if' statement propagates range info from w0 to w1,
+	 * but should not affect w1->subreg_def property.
+	 */
+	"if w0 < 10 goto +0;"
+	/* r1 is read here, on archs that require subreg zero
+	 * extension this would cause zext patch generation.
+	 */
+	"r1 >>= 32;"
+	"r0 = r1;"
+	"exit;"
+	:
+	: __imm(bpf_ktime_get_ns)
+	: __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/sdt.h
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/sdt.h
@@ -102,6 +102,8 @@
 # define STAP_SDT_ARG_CONSTRAINT        nZr
 # elif defined __arm__
 # define STAP_SDT_ARG_CONSTRAINT        g
+# elif defined __loongarch__
+# define STAP_SDT_ARG_CONSTRAINT        nmr
 # else
 # define STAP_SDT_ARG_CONSTRAINT        nor
 # endif
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/test_cpp.cpp
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/test_cpp.cpp
@@ -6,6 +6,10 @@
 #include <bpf/libbpf.h>
 #include <bpf/bpf.h>
 #include <bpf/btf.h>
+
+#ifndef _Bool
+#define _Bool bool
+#endif
 #include "test_core_extern.skel.h"
 
 template <typename T>
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/test_loader.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/test_loader.c
@@ -2,10 +2,12 @@
 /* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */
 #include <linux/capability.h>
 #include <stdlib.h>
+#include <regex.h>
 #include <test_progs.h>
 #include <bpf/btf.h>
 
 #include "autoconf_helper.h"
+#include "disasm_helpers.h"
 #include "unpriv_helpers.h"
 #include "cap_helpers.h"
 
@@ -17,9 +19,13 @@
 #define TEST_TAG_EXPECT_FAILURE "comment:test_expect_failure"
 #define TEST_TAG_EXPECT_SUCCESS "comment:test_expect_success"
 #define TEST_TAG_EXPECT_MSG_PFX "comment:test_expect_msg="
+#define TEST_TAG_EXPECT_REGEX_PFX "comment:test_expect_regex="
+#define TEST_TAG_EXPECT_XLATED_PFX "comment:test_expect_xlated="
 #define TEST_TAG_EXPECT_FAILURE_UNPRIV "comment:test_expect_failure_unpriv"
 #define TEST_TAG_EXPECT_SUCCESS_UNPRIV "comment:test_expect_success_unpriv"
 #define TEST_TAG_EXPECT_MSG_PFX_UNPRIV "comment:test_expect_msg_unpriv="
+#define TEST_TAG_EXPECT_REGEX_PFX_UNPRIV "comment:test_expect_regex_unpriv="
+#define TEST_TAG_EXPECT_XLATED_PFX_UNPRIV "comment:test_expect_xlated_unpriv="
 #define TEST_TAG_LOG_LEVEL_PFX "comment:test_log_level="
 #define TEST_TAG_PROG_FLAGS_PFX "comment:test_prog_flags="
 #define TEST_TAG_DESCRIPTION_PFX "comment:test_description="
@@ -28,6 +34,7 @@
 #define TEST_TAG_AUXILIARY "comment:test_auxiliary"
 #define TEST_TAG_AUXILIARY_UNPRIV "comment:test_auxiliary_unpriv"
 #define TEST_BTF_PATH "comment:test_btf_path="
+#define TEST_TAG_ARCH "comment:test_arch="
 
 /* Warning: duplicated in bpf_misc.h */
 #define POINTER_VALUE	0xcafe4all
@@ -46,11 +53,22 @@
 	UNPRIV = 2
 };
 
+struct expect_msg {
+	const char *substr; /* substring match */
+	const char *regex_str; /* regex-based match */
+	regex_t regex;
+};
+
+struct expected_msgs {
+	struct expect_msg *patterns;
+	size_t cnt;
+};
+
 struct test_subspec {
 	char *name;
 	bool expect_failure;
-	const char **expect_msgs;
-	size_t expect_msg_cnt;
+	struct expected_msgs expect_msgs;
+	struct expected_msgs expect_xlated;
 	int retval;
 	bool execute;
 };
@@ -63,6 +81,7 @@
 	int log_level;
 	int prog_flags;
 	int mode_mask;
+	int arch_mask;
 	bool auxiliary;
 	bool valid;
 };
@@ -87,31 +106,64 @@
 	free(tester->log_buf);
 }
 
+static void free_msgs(struct expected_msgs *msgs)
+{
+	int i;
+
+	for (i = 0; i < msgs->cnt; i++)
+		if (msgs->patterns[i].regex_str)
+			regfree(&msgs->patterns[i].regex);
+	free(msgs->patterns);
+	msgs->patterns = NULL;
+	msgs->cnt = 0;
+}
+
 static void free_test_spec(struct test_spec *spec)
 {
+	/* Deallocate expect_msgs arrays. */
+	free_msgs(&spec->priv.expect_msgs);
+	free_msgs(&spec->unpriv.expect_msgs);
+	free_msgs(&spec->priv.expect_xlated);
+	free_msgs(&spec->unpriv.expect_xlated);
+
 	free(spec->priv.name);
 	free(spec->unpriv.name);
-	free(spec->priv.expect_msgs);
-	free(spec->unpriv.expect_msgs);
-
 	spec->priv.name = NULL;
 	spec->unpriv.name = NULL;
-	spec->priv.expect_msgs = NULL;
-	spec->unpriv.expect_msgs = NULL;
 }
 
-static int push_msg(const char *msg, struct test_subspec *subspec)
+static int push_msg(const char *substr, const char *regex_str, struct expected_msgs *msgs)
 {
 	void *tmp;
+	int regcomp_res;
+	char error_msg[100];
+	struct expect_msg *msg;
 
-	tmp = realloc(subspec->expect_msgs, (1 + subspec->expect_msg_cnt) * sizeof(void *));
+	tmp = realloc(msgs->patterns,
+		      (1 + msgs->cnt) * sizeof(struct expect_msg));
 	if (!tmp) {
 		ASSERT_FAIL("failed to realloc memory for messages\n");
 		return -ENOMEM;
 	}
-	subspec->expect_msgs = tmp;
-	subspec->expect_msgs[subspec->expect_msg_cnt++] = msg;
+	msgs->patterns = tmp;
+	msg = &msgs->patterns[msgs->cnt];
 
+	if (substr) {
+		msg->substr = substr;
+		msg->regex_str = NULL;
+	} else {
+		msg->regex_str = regex_str;
+		msg->substr = NULL;
+		regcomp_res = regcomp(&msg->regex, regex_str, REG_EXTENDED|REG_NEWLINE);
+		if (regcomp_res != 0) {
+			regerror(regcomp_res, &msg->regex, error_msg, sizeof(error_msg));
+			PRINT_FAIL("Regexp compilation error in '%s': '%s'\n",
+				   regex_str, error_msg);
+			return -EINVAL;
+		}
+	}
+
+	msgs->cnt += 1;
 	return 0;
 }
 
@@ -163,6 +215,41 @@
 		*flags |= flag;
 }
 
+/* Matches a string of form '<pfx>[^=]=.*' and returns it's suffix.
+ * Used to parse btf_decl_tag values.
+ * Such values require unique prefix because compiler does not add
+ * same __attribute__((btf_decl_tag(...))) twice.
+ * Test suite uses two-component tags for such cases:
+ *
+ *   <pfx> __COUNTER__ '='
+ *
+ * For example, two consecutive __msg tags '__msg("foo") __msg("foo")'
+ * would be encoded as:
+ *
+ *   [18] DECL_TAG 'comment:test_expect_msg=0=foo' type_id=15 component_idx=-1
+ *   [19] DECL_TAG 'comment:test_expect_msg=1=foo' type_id=15 component_idx=-1
+ *
+ * And the purpose of this function is to extract 'foo' from the above.
+ */
+static const char *skip_dynamic_pfx(const char *s, const char *pfx)
+{
+	const char *msg;
+
+	if (strncmp(s, pfx, strlen(pfx)) != 0)
+		return NULL;
+	msg = s + strlen(pfx);
+	msg = strchr(msg, '=');
+	if (!msg)
+		return NULL;
+	return msg + 1;
+}
+
+enum arch {
+	ARCH_X86_64	= 0x1,
+	ARCH_ARM64	= 0x2,
+	ARCH_RISCV64	= 0x4,
+};
+
 /* Uses btf_decl_tag attributes to describe the expected test
  * behavior, see bpf_misc.h for detailed description of each attribute
  * and attribute combinations.
@@ -176,6 +263,7 @@
 	bool has_unpriv_result = false;
 	bool has_unpriv_retval = false;
 	int func_id, i, err = 0;
+	u32 arch_mask = 0;
 	struct btf *btf;
 
 	memset(spec, 0, sizeof(*spec));
@@ -231,15 +319,33 @@
 		} else if (strcmp(s, TEST_TAG_AUXILIARY_UNPRIV) == 0) {
 			spec->auxiliary = true;
 			spec->mode_mask |= UNPRIV;
-		} else if (str_has_pfx(s, TEST_TAG_EXPECT_MSG_PFX)) {
-			msg = s + sizeof(TEST_TAG_EXPECT_MSG_PFX) - 1;
-			err = push_msg(msg, &spec->priv);
+		} else if ((msg = skip_dynamic_pfx(s, TEST_TAG_EXPECT_MSG_PFX))) {
+			err = push_msg(msg, NULL, &spec->priv.expect_msgs);
 			if (err)
 				goto cleanup;
 			spec->mode_mask |= PRIV;
-		} else if (str_has_pfx(s, TEST_TAG_EXPECT_MSG_PFX_UNPRIV)) {
-			msg = s + sizeof(TEST_TAG_EXPECT_MSG_PFX_UNPRIV) - 1;
-			err = push_msg(msg, &spec->unpriv);
+		} else if ((msg = skip_dynamic_pfx(s, TEST_TAG_EXPECT_MSG_PFX_UNPRIV))) {
+			err = push_msg(msg, NULL, &spec->unpriv.expect_msgs);
+			if (err)
+				goto cleanup;
+			spec->mode_mask |= UNPRIV;
+		} else if ((msg = skip_dynamic_pfx(s, TEST_TAG_EXPECT_REGEX_PFX))) {
+			err = push_msg(NULL, msg, &spec->priv.expect_msgs);
+			if (err)
+				goto cleanup;
+			spec->mode_mask |= PRIV;
+		} else if ((msg = skip_dynamic_pfx(s, TEST_TAG_EXPECT_REGEX_PFX_UNPRIV))) {
+			err = push_msg(NULL, msg, &spec->unpriv.expect_msgs);
+			if (err)
+				goto cleanup;
+			spec->mode_mask |= UNPRIV;
+		} else if ((msg = skip_dynamic_pfx(s, TEST_TAG_EXPECT_XLATED_PFX))) {
+			err = push_msg(msg, NULL, &spec->priv.expect_xlated);
+			if (err)
+				goto cleanup;
+			spec->mode_mask |= PRIV;
+		} else if ((msg = skip_dynamic_pfx(s, TEST_TAG_EXPECT_XLATED_PFX_UNPRIV))) {
+			err = push_msg(msg, NULL, &spec->unpriv.expect_xlated);
 			if (err)
 				goto cleanup;
 			spec->mode_mask |= UNPRIV;
@@ -290,11 +396,26 @@
 					goto cleanup;
 				update_flags(&spec->prog_flags, flags, clear);
 			}
+		} else if (str_has_pfx(s, TEST_TAG_ARCH)) {
+			val = s + sizeof(TEST_TAG_ARCH) - 1;
+			if (strcmp(val, "X86_64") == 0) {
+				arch_mask |= ARCH_X86_64;
+			} else if (strcmp(val, "ARM64") == 0) {
+				arch_mask |= ARCH_ARM64;
+			} else if (strcmp(val, "RISCV64") == 0) {
+				arch_mask |= ARCH_RISCV64;
+			} else {
+				PRINT_FAIL("bad arch spec: '%s'", val);
+				err = -EINVAL;
+				goto cleanup;
+			}
 		} else if (str_has_pfx(s, TEST_BTF_PATH)) {
 			spec->btf_custom_path = s + sizeof(TEST_BTF_PATH) - 1;
 		}
 	}
 
+	spec->arch_mask = arch_mask;
+
 	if (spec->mode_mask == 0)
 		spec->mode_mask = PRIV;
 
@@ -336,17 +457,25 @@
 			spec->unpriv.execute = spec->priv.execute;
 		}
 
-		if (!spec->unpriv.expect_msgs) {
-			size_t sz = spec->priv.expect_msg_cnt * sizeof(void *);
+		if (spec->unpriv.expect_msgs.cnt == 0) {
+			for (i = 0; i < spec->priv.expect_msgs.cnt; i++) {
+				struct expect_msg *msg = &spec->priv.expect_msgs.patterns[i];
 
-			spec->unpriv.expect_msgs = malloc(sz);
-			if (!spec->unpriv.expect_msgs) {
-				PRINT_FAIL("failed to allocate memory for unpriv.expect_msgs\n");
-				err = -ENOMEM;
-				goto cleanup;
+				err = push_msg(msg->substr, msg->regex_str,
+					       &spec->unpriv.expect_msgs);
+				if (err)
+					goto cleanup;
+			}
+		}
+		if (spec->unpriv.expect_xlated.cnt == 0) {
+			for (i = 0; i < spec->priv.expect_xlated.cnt; i++) {
+				struct expect_msg *msg = &spec->priv.expect_xlated.patterns[i];
+
+				err = push_msg(msg->substr, msg->regex_str,
+					       &spec->unpriv.expect_xlated);
+				if (err)
+					goto cleanup;
 			}
-			memcpy(spec->unpriv.expect_msgs, spec->priv.expect_msgs, sz);
-			spec->unpriv.expect_msg_cnt = spec->priv.expect_msg_cnt;
 		}
 	}
 
@@ -386,7 +515,6 @@
 	bpf_program__set_flags(prog, prog_flags | spec->prog_flags);
 
 	tester->log_buf[0] = '\0';
-	tester->next_match_pos = 0;
 }
 
 static void emit_verifier_log(const char *log_buf, bool force)
@@ -396,33 +524,48 @@
 	fprintf(stdout, "VERIFIER LOG:\n=============\n%s=============\n", log_buf);
 }
 
-static void validate_case(struct test_loader *tester,
-			  struct test_subspec *subspec,
-			  struct bpf_object *obj,
-			  struct bpf_program *prog,
-			  int load_err)
+static void emit_xlated(const char *xlated, bool force)
 {
-	int i, j;
-
-	for (i = 0; i < subspec->expect_msg_cnt; i++) {
-		char *match;
-		const char *expect_msg;
+	if (!force && env.verbosity == VERBOSE_NONE)
+		return;
+	fprintf(stdout, "XLATED:\n=============\n%s=============\n", xlated);
+}
 
-		expect_msg = subspec->expect_msgs[i];
+static void validate_msgs(char *log_buf, struct expected_msgs *msgs,
+			  void (*emit_fn)(const char *buf, bool force))
+{
+	regmatch_t reg_match[1];
+	const char *log = log_buf;
+	int i, j, err;
+
+	for (i = 0; i < msgs->cnt; i++) {
+		struct expect_msg *msg = &msgs->patterns[i];
+		const char *match = NULL;
+
+		if (msg->substr) {
+			match = strstr(log, msg->substr);
+			if (match)
+				log = match + strlen(msg->substr);
+		} else {
+			err = regexec(&msg->regex, log, 1, reg_match, 0);
+			if (err == 0) {
+				match = log + reg_match[0].rm_so;
+				log += reg_match[0].rm_eo;
+			}
+		}
 
-		match = strstr(tester->log_buf + tester->next_match_pos, expect_msg);
 		if (!ASSERT_OK_PTR(match, "expect_msg")) {
-			/* if we are in verbose mode, we've already emitted log */
 			if (env.verbosity == VERBOSE_NONE)
-				emit_verifier_log(tester->log_buf, true /*force*/);
-			for (j = 0; j < i; j++)
-				fprintf(stderr,
-					"MATCHED  MSG: '%s'\n", subspec->expect_msgs[j]);
-			fprintf(stderr, "EXPECTED MSG: '%s'\n", expect_msg);
+				emit_fn(log_buf, true /*force*/);
+			for (j = 0; j <= i; j++) {
+				msg = &msgs->patterns[j];
+				fprintf(stderr, "%s %s: '%s'\n",
+					j < i ? "MATCHED " : "EXPECTED",
+					msg->substr ? "SUBSTR" : " REGEX",
+					msg->substr ?: msg->regex_str);
+			}
 			return;
 		}
-
-		tester->next_match_pos = match - tester->log_buf + strlen(expect_msg);
 	}
 }
 
@@ -546,6 +689,51 @@
 	return true;
 }
 
+/* Get a disassembly of BPF program after verifier applies all rewrites */
+static int get_xlated_program_text(int prog_fd, char *text, size_t text_sz)
+{
+	struct bpf_insn *insn_start = NULL, *insn, *insn_end;
+	__u32 insns_cnt = 0, i;
+	char buf[64];
+	FILE *out = NULL;
+	int err;
+
+	err = get_xlated_program(prog_fd, &insn_start, &insns_cnt);
+	if (!ASSERT_OK(err, "get_xlated_program"))
+		goto out;
+	out = fmemopen(text, text_sz, "w");
+	if (!ASSERT_OK_PTR(out, "open_memstream"))
+		goto out;
+	insn_end = insn_start + insns_cnt;
+	insn = insn_start;
+	while (insn < insn_end) {
+		i = insn - insn_start;
+		insn = disasm_insn(insn, buf, sizeof(buf));
+		fprintf(out, "%d: %s\n", i, buf);
+	}
+	fflush(out);
+
+out:
+	free(insn_start);
+	if (out)
+		fclose(out);
+	return err;
+}
+
+static bool run_on_current_arch(int arch_mask)
+{
+	if (arch_mask == 0)
+		return true;
+#if defined(__x86_64__)
+	return arch_mask & ARCH_X86_64;
+#elif defined(__aarch64__)
+	return arch_mask & ARCH_ARM64;
+#elif defined(__riscv) && __riscv_xlen == 64
+	return arch_mask & ARCH_RISCV64;
+#endif
+	return false;
+}
+
 /* this function is forced noinline and has short generic name to look better
  * in test_progs output (in case of a failure)
  */
@@ -570,6 +758,11 @@
 	if (!test__start_subtest(subspec->name))
 		return;
 
+	if (!run_on_current_arch(spec->arch_mask)) {
+		test__skip();
+		return;
+	}
+
 	if (unpriv) {
 		if (!can_execute_unpriv(tester, spec)) {
 			test__skip();
@@ -630,9 +823,17 @@
 			goto tobj_cleanup;
 		}
 	}
-
 	emit_verifier_log(tester->log_buf, false /*force*/);
-	validate_case(tester, subspec, tobj, tprog, err);
+	validate_msgs(tester->log_buf, &subspec->expect_msgs, emit_verifier_log);
+
+	if (subspec->expect_xlated.cnt) {
+		err = get_xlated_program_text(bpf_program__fd(tprog),
+					      tester->log_buf, tester->log_buf_sz);
+		if (err)
+			goto tobj_cleanup;
+		emit_xlated(tester->log_buf, false /*force*/);
+		validate_msgs(tester->log_buf, &subspec->expect_xlated, emit_xlated);
+	}
 
 	if (should_do_test_run(spec, subspec)) {
 		/* For some reason test_verifier executes programs
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/test_lpm_map.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/test_lpm_map.c
@@ -211,7 +211,7 @@
 	volatile size_t n_matches, n_matches_after_delete;
 	size_t i, j, n_nodes, n_lookups;
 	struct tlpm_node *t, *list = NULL;
-	struct bpf_lpm_trie_key *key;
+	struct bpf_lpm_trie_key_u8 *key;
 	uint8_t *data, *value;
 	int r, map;
 
@@ -331,8 +331,8 @@
 static void test_lpm_ipaddr(void)
 {
 	LIBBPF_OPTS(bpf_map_create_opts, opts, .map_flags = BPF_F_NO_PREALLOC);
-	struct bpf_lpm_trie_key *key_ipv4;
-	struct bpf_lpm_trie_key *key_ipv6;
+	struct bpf_lpm_trie_key_u8 *key_ipv4;
+	struct bpf_lpm_trie_key_u8 *key_ipv6;
 	size_t key_size_ipv4;
 	size_t key_size_ipv6;
 	int map_fd_ipv4;
@@ -423,7 +423,7 @@
 static void test_lpm_delete(void)
 {
 	LIBBPF_OPTS(bpf_map_create_opts, opts, .map_flags = BPF_F_NO_PREALLOC);
-	struct bpf_lpm_trie_key *key;
+	struct bpf_lpm_trie_key_u8 *key;
 	size_t key_size;
 	int map_fd;
 	__u64 value;
@@ -532,7 +532,7 @@
 static void test_lpm_get_next_key(void)
 {
 	LIBBPF_OPTS(bpf_map_create_opts, opts, .map_flags = BPF_F_NO_PREALLOC);
-	struct bpf_lpm_trie_key *key_p, *next_key_p;
+	struct bpf_lpm_trie_key_u8 *key_p, *next_key_p;
 	size_t key_size;
 	__u32 value = 0;
 	int map_fd;
@@ -693,9 +693,9 @@
 {
 	int i, j, ret, iter, key_size;
 	struct lpm_mt_test_info *info = arg;
-	struct bpf_lpm_trie_key *key_p;
+	struct bpf_lpm_trie_key_u8 *key_p;
 
-	key_size = sizeof(struct bpf_lpm_trie_key) + sizeof(__u32);
+	key_size = sizeof(*key_p) + sizeof(__u32);
 	key_p = alloca(key_size);
 	for (iter = 0; iter < info->iter; iter++)
 		for (i = 0; i < MAX_TEST_KEYS; i++) {
@@ -717,7 +717,7 @@
 				ret = bpf_map_lookup_elem(info->map_fd, key_p, &value);
 				assert(ret == 0 || errno == ENOENT);
 			} else {
-				struct bpf_lpm_trie_key *next_key_p = alloca(key_size);
+				struct bpf_lpm_trie_key_u8 *next_key_p = alloca(key_size);
 				ret = bpf_map_get_next_key(info->map_fd, key_p, next_key_p);
 				assert(ret == 0 || errno == ENOENT || errno == ENOMEM);
 			}
@@ -752,7 +752,7 @@
 
 	/* create a trie */
 	value_size = sizeof(__u32);
-	key_size = sizeof(struct bpf_lpm_trie_key) + value_size;
+	key_size = sizeof(struct bpf_lpm_trie_key_hdr) + value_size;
 	map_fd = bpf_map_create(BPF_MAP_TYPE_LPM_TRIE, NULL, key_size, value_size, 100, &opts);
 
 	/* create 4 threads to test update, delete, lookup and get_next_key */
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/test_lru_map.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/test_lru_map.c
@@ -126,7 +126,8 @@
 
 	while (next < nr_cpus) {
 		CPU_ZERO(&cpuset);
-		CPU_SET(next++, &cpuset);
+		CPU_SET(next, &cpuset);
+		next++;
 		if (!sched_setaffinity(pid, sizeof(cpuset), &cpuset)) {
 			ret = 0;
 			break;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/test_maps.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/test_maps.c
@@ -1190,7 +1190,11 @@
 		goto out_map_in_map;
 	}
 
-	bpf_object__load(obj);
+	err = bpf_object__load(obj);
+	if (err) {
+		printf("Failed to load test prog\n");
+		goto out_map_in_map;
+	}
 
 	map = bpf_object__find_map_by_name(obj, "mim_array");
 	if (!map) {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/test_progs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/test_progs.c
@@ -10,7 +10,6 @@
 #include <sched.h>
 #include <signal.h>
 #include <string.h>
-#include <execinfo.h> /* backtrace */
 #include <sys/sysinfo.h> /* get_nprocs */
 #include <netinet/in.h>
 #include <sys/select.h>
@@ -19,6 +18,26 @@
 #include <bpf/btf.h>
 #include "json_writer.h"
 
+#include "network_helpers.h"
+
+/* backtrace() and backtrace_symbols_fd() are glibc specific,
+ * use header file when glibc is available and provide stub
+ * implementations when another libc implementation is used.
+ */
+#ifdef __GLIBC__
+#include <execinfo.h> /* backtrace */
+#else
+__weak int backtrace(void **buffer, int size)
+{
+	return 0;
+}
+
+__weak void backtrace_symbols_fd(void *const *buffer, int size, int fd)
+{
+	dprintf(fd, "<backtrace not supported>\n");
+}
+#endif /*__GLIBC__ */
+
 static bool verbose(void)
 {
 	return env.verbosity > VERBOSE_NONE;
@@ -628,6 +647,92 @@
 	return err;
 }
 
+struct netns_obj {
+	char *nsname;
+	struct tmonitor_ctx *tmon;
+	struct nstoken *nstoken;
+};
+
+/* Create a new network namespace with the given name.
+ *
+ * Create a new network namespace and set the network namespace of the
+ * current process to the new network namespace if the argument "open" is
+ * true. This function should be paired with netns_free() to release the
+ * resource and delete the network namespace.
+ *
+ * It also implements the functionality of the option "-m" by starting
+ * traffic monitor on the background to capture the packets in this network
+ * namespace if the current test or subtest matching the pattern.
+ *
+ * nsname: the name of the network namespace to create.
+ * open: open the network namespace if true.
+ *
+ * Return: the network namespace object on success, NULL on failure.
+ */
+struct netns_obj *netns_new(const char *nsname, bool open)
+{
+	struct netns_obj *netns_obj = malloc(sizeof(*netns_obj));
+	const char *test_name, *subtest_name;
+	int r;
+
+	if (!netns_obj)
+		return NULL;
+	memset(netns_obj, 0, sizeof(*netns_obj));
+
+	netns_obj->nsname = strdup(nsname);
+	if (!netns_obj->nsname)
+		goto fail;
+
+	/* Create the network namespace */
+	r = make_netns(nsname);
+	if (r)
+		goto fail;
+
+	/* Start traffic monitor */
+	if (env.test->should_tmon ||
+	    (env.subtest_state && env.subtest_state->should_tmon)) {
+		test_name = env.test->test_name;
+		subtest_name = env.subtest_state ? env.subtest_state->name : NULL;
+		netns_obj->tmon = traffic_monitor_start(nsname, test_name, subtest_name);
+		if (!netns_obj->tmon) {
+			fprintf(stderr, "Failed to start traffic monitor for %s\n", nsname);
+			goto fail;
+		}
+	} else {
+		netns_obj->tmon = NULL;
+	}
+
+	if (open) {
+		netns_obj->nstoken = open_netns(nsname);
+		if (!netns_obj->nstoken)
+			goto fail;
+	}
+
+	return netns_obj;
+fail:
+	traffic_monitor_stop(netns_obj->tmon);
+	remove_netns(nsname);
+	free(netns_obj->nsname);
+	free(netns_obj);
+	return NULL;
+}
+
+/* Delete the network namespace.
+ *
+ * This function should be paired with netns_new() to delete the namespace
+ * created by netns_new().
+ */
+void netns_free(struct netns_obj *netns_obj)
+{
+	if (!netns_obj)
+		return;
+	traffic_monitor_stop(netns_obj->tmon);
+	close_netns(netns_obj->nstoken);
+	remove_netns(netns_obj->nsname);
+	free(netns_obj->nsname);
+	free(netns_obj);
+}
+
 /* extern declarations for test funcs */
 #define DEFINE_TEST(name)				\
 	extern void test_##name(void) __weak;		\
@@ -1690,7 +1795,7 @@
 	/* launch workers if requested */
 	env.worker_id = -1; /* main process */
 	if (env.workers) {
-		env.worker_pids = calloc(sizeof(__pid_t), env.workers);
+		env.worker_pids = calloc(sizeof(pid_t), env.workers);
 		env.worker_socks = calloc(sizeof(int), env.workers);
 		if (env.debug)
 			fprintf(stdout, "Launching %d workers.\n", env.workers);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/test_progs.h
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/test_progs.h
@@ -411,6 +411,10 @@
 int get_bpf_max_tramp_links_from(struct btf *btf);
 int get_bpf_max_tramp_links(void);
 
+struct netns_obj;
+struct netns_obj *netns_new(const char *name, bool open);
+void netns_free(struct netns_obj *netns);
+
 #ifdef __x86_64__
 #define SYS_NANOSLEEP_KPROBE_NAME "__x64_sys_nanosleep"
 #elif defined(__s390x__)
@@ -430,7 +434,6 @@
 struct test_loader {
 	char *log_buf;
 	size_t log_buf_sz;
-	size_t next_match_pos;
 	pre_execution_cb pre_execution_cb;
 
 	struct bpf_object *obj;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/test_sockmap.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/test_sockmap.c
@@ -56,6 +56,8 @@
 #define BPF_SOCKHASH_FILENAME "test_sockhash_kern.bpf.o"
 #define CG_PATH "/sockmap"
 
+#define EDATAINTEGRITY 2001
+
 /* global sockets */
 int s1, s2, c1, c2, p1, p2;
 int test_cnt;
@@ -63,7 +65,7 @@
 int failed;
 int map_fd[9];
 struct bpf_map *maps[9];
-int prog_fd[11];
+int prog_fd[9];
 
 int txmsg_pass;
 int txmsg_redir;
@@ -85,6 +87,10 @@
 int peek_flag;
 int skb_use_parser;
 int txmsg_omit_skb_parser;
+int verify_push_start;
+int verify_push_len;
+int verify_pop_start;
+int verify_pop_len;
 
 static const struct option long_options[] = {
 	{"help",	no_argument,		NULL, 'h' },
@@ -417,16 +423,18 @@
 {
 	bool drop = opt->drop_expected;
 	unsigned char k = 0;
+	int i, j, fp;
 	FILE *file;
-	int i, fp;
 
 	file = tmpfile();
 	if (!file) {
 		perror("create file for sendpage");
 		return 1;
 	}
-	for (i = 0; i < iov_length * cnt; i++, k++)
-		fwrite(&k, sizeof(char), 1, file);
+	for (i = 0; i < cnt; i++, k = 0) {
+		for (j = 0; j < iov_length; j++, k++)
+			fwrite(&k, sizeof(char), 1, file);
+	}
 	fflush(file);
 	fseek(file, 0, SEEK_SET);
 
@@ -509,42 +517,111 @@
 	return -ENOMEM;
 }
 
-static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz)
+/* In push or pop test, we need to do some calculations for msg_verify_data */
+static void msg_verify_date_prep(void)
 {
-	int i, j = 0, bytes_cnt = 0;
-	unsigned char k = 0;
+	int push_range_end = txmsg_start_push + txmsg_end_push - 1;
+	int pop_range_end = txmsg_start_pop + txmsg_pop - 1;
+
+	if (txmsg_end_push && txmsg_pop &&
+	    txmsg_start_push <= pop_range_end && txmsg_start_pop <= push_range_end) {
+		/* The push range and the pop range overlap */
+		int overlap_len;
+
+		verify_push_start = txmsg_start_push;
+		verify_pop_start = txmsg_start_pop;
+		if (txmsg_start_push < txmsg_start_pop)
+			overlap_len = min(push_range_end - txmsg_start_pop + 1, txmsg_pop);
+		else
+			overlap_len = min(pop_range_end - txmsg_start_push + 1, txmsg_end_push);
+		verify_push_len = max(txmsg_end_push - overlap_len, 0);
+		verify_pop_len = max(txmsg_pop - overlap_len, 0);
+	} else {
+		/* Otherwise */
+		verify_push_start = txmsg_start_push;
+		verify_pop_start = txmsg_start_pop;
+		verify_push_len = txmsg_end_push;
+		verify_pop_len = txmsg_pop;
+	}
+}
+
+static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz,
+			   unsigned char *k_p, int *bytes_cnt_p,
+			   int *check_cnt_p, int *push_p)
+{
+	int bytes_cnt = *bytes_cnt_p, check_cnt = *check_cnt_p, push = *push_p;
+	unsigned char k = *k_p;
+	int i, j;
 
-	for (i = 0; i < msg->msg_iovlen; i++) {
+	for (i = 0, j = 0; i < msg->msg_iovlen && size; i++, j = 0) {
 		unsigned char *d = msg->msg_iov[i].iov_base;
 
 		/* Special case test for skb ingress + ktls */
 		if (i == 0 && txmsg_ktls_skb) {
 			if (msg->msg_iov[i].iov_len < 4)
-				return -EIO;
+				return -EDATAINTEGRITY;
 			if (memcmp(d, "PASS", 4) != 0) {
 				fprintf(stderr,
 					"detected skb data error with skb ingress update @iov[%i]:%i \"%02x %02x %02x %02x\" != \"PASS\"\n",
 					i, 0, d[0], d[1], d[2], d[3]);
-				return -EIO;
+				return -EDATAINTEGRITY;
 			}
 			j = 4; /* advance index past PASS header */
 		}
 
 		for (; j < msg->msg_iov[i].iov_len && size; j++) {
+			if (push > 0 &&
+			    check_cnt == verify_push_start + verify_push_len - push) {
+				int skipped;
+revisit_push:
+				skipped = push;
+				if (j + push >= msg->msg_iov[i].iov_len)
+					skipped = msg->msg_iov[i].iov_len - j;
+				push -= skipped;
+				size -= skipped;
+				j += skipped - 1;
+				check_cnt += skipped;
+				continue;
+			}
+
+			if (verify_pop_len > 0 && check_cnt == verify_pop_start) {
+				bytes_cnt += verify_pop_len;
+				check_cnt += verify_pop_len;
+				k += verify_pop_len;
+
+				if (bytes_cnt == chunk_sz) {
+					k = 0;
+					bytes_cnt = 0;
+					check_cnt = 0;
+					push = verify_push_len;
+				}
+
+				if (push > 0 &&
+				    check_cnt == verify_push_start + verify_push_len - push)
+					goto revisit_push;
+			}
+
 			if (d[j] != k++) {
 				fprintf(stderr,
 					"detected data corruption @iov[%i]:%i %02x != %02x, %02x ?= %02x\n",
 					i, j, d[j], k - 1, d[j+1], k);
-				return -EIO;
+				return -EDATAINTEGRITY;
 			}
 			bytes_cnt++;
+			check_cnt++;
 			if (bytes_cnt == chunk_sz) {
 				k = 0;
 				bytes_cnt = 0;
+				check_cnt = 0;
+				push = verify_push_len;
 			}
 			size--;
 		}
 	}
+	*k_p = k;
+	*bytes_cnt_p = bytes_cnt;
+	*check_cnt_p = check_cnt;
+	*push_p = push;
 	return 0;
 }
 
@@ -597,10 +674,14 @@
 		}
 		clock_gettime(CLOCK_MONOTONIC, &s->end);
 	} else {
+		float total_bytes, txmsg_pop_total, txmsg_push_total;
 		int slct, recvp = 0, recv, max_fd = fd;
-		float total_bytes, txmsg_pop_total;
 		int fd_flags = O_NONBLOCK;
 		struct timeval timeout;
+		unsigned char k = 0;
+		int bytes_cnt = 0;
+		int check_cnt = 0;
+		int push = 0;
 		fd_set w;
 
 		fcntl(fd, fd_flags);
@@ -614,12 +695,22 @@
 		 * This is really only useful for testing edge cases in code
 		 * paths.
 		 */
-		total_bytes = (float)iov_count * (float)iov_length * (float)cnt;
-		if (txmsg_apply)
+		total_bytes = (float)iov_length * (float)cnt;
+		if (!opt->sendpage)
+			total_bytes *= (float)iov_count;
+		if (txmsg_apply) {
+			txmsg_push_total = txmsg_end_push * (total_bytes / txmsg_apply);
 			txmsg_pop_total = txmsg_pop * (total_bytes / txmsg_apply);
-		else
+		} else {
+			txmsg_push_total = txmsg_end_push * cnt;
 			txmsg_pop_total = txmsg_pop * cnt;
+		}
+		total_bytes += txmsg_push_total;
 		total_bytes -= txmsg_pop_total;
+		if (data) {
+			msg_verify_date_prep();
+			push = verify_push_len;
+		}
 		err = clock_gettime(CLOCK_MONOTONIC, &s->start);
 		if (err < 0)
 			perror("recv start time");
@@ -680,7 +771,8 @@
 				}
 			}
 
-			s->bytes_recvd += recv;
+			if (recv > 0)
+				s->bytes_recvd += recv;
 
 			if (opt->check_recved_len && s->bytes_recvd > total_bytes) {
 				errno = EMSGSIZE;
@@ -691,10 +783,11 @@
 
 			if (data) {
 				int chunk_sz = opt->sendpage ?
-						iov_length * cnt :
+						iov_length :
 						iov_length * iov_count;
 
-				errno = msg_verify_data(&msg, recv, chunk_sz);
+				errno = msg_verify_data(&msg, recv, chunk_sz, &k, &bytes_cnt,
+							&check_cnt, &push);
 				if (errno) {
 					perror("data verify msg failed");
 					goto out_errno;
@@ -702,7 +795,11 @@
 				if (recvp) {
 					errno = msg_verify_data(&msg_peek,
 								recvp,
-								chunk_sz);
+								chunk_sz,
+								&k,
+								&bytes_cnt,
+								&check_cnt,
+								&push);
 					if (errno) {
 						perror("data verify msg_peek failed");
 						goto out_errno;
@@ -784,8 +881,6 @@
 
 	rxpid = fork();
 	if (rxpid == 0) {
-		if (txmsg_pop || txmsg_start_pop)
-			iov_buf -= (txmsg_pop - txmsg_start_pop + 1);
 		if (opt->drop_expected || txmsg_ktls_skb_drop)
 			_exit(0);
 
@@ -810,7 +905,7 @@
 				s.bytes_sent, sent_Bps, sent_Bps/giga,
 				s.bytes_recvd, recvd_Bps, recvd_Bps/giga,
 				peek_flag ? "(peek_msg)" : "");
-		if (err && txmsg_cork)
+		if (err && err != -EDATAINTEGRITY && txmsg_cork)
 			err = 0;
 		exit(err ? 1 : 0);
 	} else if (rxpid == -1) {
@@ -1458,8 +1553,8 @@
 
 static void test_send_large(struct sockmap_options *opt, int cgrp)
 {
-	opt->iov_length = 256;
-	opt->iov_count = 1024;
+	opt->iov_length = 8192;
+	opt->iov_count = 32;
 	opt->rate = 2;
 	test_exec(cgrp, opt);
 }
@@ -1588,17 +1683,19 @@
 static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)
 {
 	/* Test basic start/end */
+	txmsg_pass = 1;
 	txmsg_start = 1;
 	txmsg_end = 2;
 	test_send(opt, cgrp);
 
 	/* Test >4k pull */
+	txmsg_pass = 1;
 	txmsg_start = 4096;
 	txmsg_end = 9182;
 	test_send_large(opt, cgrp);
 
 	/* Test pull + redirect */
-	txmsg_redir = 0;
+	txmsg_redir = 1;
 	txmsg_start = 1;
 	txmsg_end = 2;
 	test_send(opt, cgrp);
@@ -1620,12 +1717,16 @@
 
 static void test_txmsg_pop(int cgrp, struct sockmap_options *opt)
 {
+	bool data = opt->data_test;
+
 	/* Test basic pop */
+	txmsg_pass = 1;
 	txmsg_start_pop = 1;
 	txmsg_pop = 2;
 	test_send_many(opt, cgrp);
 
 	/* Test pop with >4k */
+	txmsg_pass = 1;
 	txmsg_start_pop = 4096;
 	txmsg_pop = 4096;
 	test_send_large(opt, cgrp);
@@ -1636,6 +1737,12 @@
 	txmsg_pop = 2;
 	test_send_many(opt, cgrp);
 
+	/* TODO: Test for pop + cork should be different,
+	 * - It makes the layout of the received data difficult
+	 * - It makes it hard to calculate the total_bytes in the recvmsg
+	 * Temporarily skip the data integrity test for this case now.
+	 */
+	opt->data_test = false;
 	/* Test pop + cork */
 	txmsg_redir = 0;
 	txmsg_cork = 512;
@@ -1649,16 +1756,21 @@
 	txmsg_start_pop = 1;
 	txmsg_pop = 2;
 	test_send_many(opt, cgrp);
+	opt->data_test = data;
 }
 
 static void test_txmsg_push(int cgrp, struct sockmap_options *opt)
 {
+	bool data = opt->data_test;
+
 	/* Test basic push */
+	txmsg_pass = 1;
 	txmsg_start_push = 1;
 	txmsg_end_push = 1;
 	test_send(opt, cgrp);
 
 	/* Test push 4kB >4k */
+	txmsg_pass = 1;
 	txmsg_start_push = 4096;
 	txmsg_end_push = 4096;
 	test_send_large(opt, cgrp);
@@ -1669,16 +1781,24 @@
 	txmsg_end_push = 2;
 	test_send_many(opt, cgrp);
 
+	/* TODO: Test for push + cork should be different,
+	 * - It makes the layout of the received data difficult
+	 * - It makes it hard to calculate the total_bytes in the recvmsg
+	 * Temporarily skip the data integrity test for this case now.
+	 */
+	opt->data_test = false;
 	/* Test push + cork */
 	txmsg_redir = 0;
 	txmsg_cork = 512;
 	txmsg_start_push = 1;
 	txmsg_end_push = 2;
 	test_send_many(opt, cgrp);
+	opt->data_test = data;
 }
 
 static void test_txmsg_push_pop(int cgrp, struct sockmap_options *opt)
 {
+	txmsg_pass = 1;
 	txmsg_start_push = 1;
 	txmsg_end_push = 10;
 	txmsg_start_pop = 5;
@@ -1793,8 +1913,6 @@
 	BPF_SK_MSG_VERDICT,
 	BPF_SK_MSG_VERDICT,
 	BPF_SK_MSG_VERDICT,
-	BPF_SK_MSG_VERDICT,
-	BPF_SK_MSG_VERDICT,
 };
 
 int prog_type[] = {
@@ -1807,8 +1925,6 @@
 	BPF_PROG_TYPE_SK_MSG,
 	BPF_PROG_TYPE_SK_MSG,
 	BPF_PROG_TYPE_SK_MSG,
-	BPF_PROG_TYPE_SK_MSG,
-	BPF_PROG_TYPE_SK_MSG,
 };
 
 static int populate_progs(char *bpf_file)
@@ -2104,9 +2220,9 @@
 		free(options.whitelist);
 	if (options.blacklist)
 		free(options.blacklist);
+	close(cg_fd);
 	if (cg_created)
 		cleanup_cgroup_environment();
-	close(cg_fd);
 	return err;
 }
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/test_tc_tunnel.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/test_tc_tunnel.sh
@@ -72,7 +72,6 @@
 server_listen() {
 	ip netns exec "${ns2}" nc "${netcat_opt}" -l "${port}" > "${outfile}" &
 	server_pid=$!
-	sleep 0.2
 }
 
 client_connect() {
@@ -93,6 +92,16 @@
 	fi
 }
 
+wait_for_port() {
+	for i in $(seq 20); do
+		if ip netns exec "${ns2}" ss ${2:--4}OHntl | grep -q "$1"; then
+			return 0
+		fi
+		sleep 0.1
+	done
+	return 1
+}
+
 set -e
 
 # no arguments: automated test, run all
@@ -193,6 +202,7 @@
 # basic communication works
 echo "test basic connectivity"
 server_listen
+wait_for_port ${port} ${netcat_opt}
 client_connect
 verify_data
 
@@ -204,6 +214,7 @@
 	section "encap_${tuntype}_${mac}"
 echo "test bpf encap without decap (expect failure)"
 server_listen
+wait_for_port ${port} ${netcat_opt}
 ! client_connect
 
 if [[ "$tuntype" =~ "udp" ]]; then
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/testing_helpers.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/testing_helpers.c
@@ -220,13 +220,13 @@
 		    bool is_glob_pattern)
 {
 	char *input, *state = NULL, *test_spec;
-	int err = 0;
+	int err = 0, cnt = 0;
 
 	input = strdup(s);
 	if (!input)
 		return -ENOMEM;
 
-	while ((test_spec = strtok_r(state ? NULL : input, ",", &state))) {
+	while ((test_spec = strtok_r(cnt++ ? NULL : input, ",", &state))) {
 		err = insert_test(set, test_spec, is_glob_pattern);
 		if (err)
 			break;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/trace_helpers.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/trace_helpers.c
@@ -271,7 +271,7 @@
 	 * addi  r2,r2,XXXX
 	 */
 	{
-		const u32 *insn = (const u32 *)(uintptr_t)addr;
+		const __u32 *insn = (const __u32 *)(uintptr_t)addr;
 
 		if ((((*insn & OP_RT_RA_MASK) == ADDIS_R2_R12) ||
 		     ((*insn & OP_RT_RA_MASK) == LIS_R2)) &&
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/unpriv_helpers.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/unpriv_helpers.c
@@ -2,7 +2,6 @@
 
 #include <stdbool.h>
 #include <stdlib.h>
-#include <error.h>
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
--- linux-qcom-6.8.0.orig/tools/testing/selftests/bpf/veristat.c
+++ linux-qcom-6.8.0/tools/testing/selftests/bpf/veristat.c
@@ -784,13 +784,13 @@
 static int parse_stats(const char *stats_str, struct stat_specs *specs)
 {
 	char *input, *state = NULL, *next;
-	int err;
+	int err, cnt = 0;
 
 	input = strdup(stats_str);
 	if (!input)
 		return -ENOMEM;
 
-	while ((next = strtok_r(state ? NULL : input, ",", &state))) {
+	while ((next = strtok_r(cnt++ ? NULL : input, ",", &state))) {
 		err = parse_stat(next, specs);
 		if (err)
 			return err;
@@ -1490,7 +1490,7 @@
 	while (fgets(line, sizeof(line), f)) {
 		char *input = line, *state = NULL, *next;
 		struct verif_stats *st = NULL;
-		int col = 0;
+		int col = 0, cnt = 0;
 
 		if (!header) {
 			void *tmp;
@@ -1508,7 +1508,7 @@
 			*stat_cntp += 1;
 		}
 
-		while ((next = strtok_r(state ? NULL : input, ",\n", &state))) {
+		while ((next = strtok_r(cnt++ ? NULL : input, ",\n", &state))) {
 			if (header) {
 				/* for the first line, set up spec stats */
 				err = parse_stat(next, specs);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/breakpoints/step_after_suspend_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/breakpoints/step_after_suspend_test.c
@@ -153,7 +153,10 @@
 	if (err < 0)
 		ksft_exit_fail_msg("timerfd_settime() failed\n");
 
-	if (write(power_state_fd, "mem", strlen("mem")) != strlen("mem"))
+	system("(echo mem > /sys/power/state) 2> /dev/null");
+
+	timerfd_gettime(timerfd, &spec);
+	if (spec.it_value.tv_sec != 0 || spec.it_value.tv_nsec != 0)
 		ksft_exit_fail_msg("Failed to enter Suspend state\n");
 
 	close(timerfd);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cachestat/test_cachestat.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cachestat/test_cachestat.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #define _GNU_SOURCE
+#define __SANE_USERSPACE_TYPES__ // Use ll64
 
 #include <stdio.h>
 #include <stdbool.h>
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/cgroup_util.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/cgroup_util.c
@@ -195,10 +195,10 @@
 	return cg_write(cgroup, control, buf);
 }
 
-int cg_find_unified_root(char *root, size_t len)
+int cg_find_unified_root(char *root, size_t len, bool *nsdelegate)
 {
 	char buf[10 * PAGE_SIZE];
-	char *fs, *mount, *type;
+	char *fs, *mount, *type, *options;
 	const char delim[] = "\n\t ";
 
 	if (read_text("/proc/self/mounts", buf, sizeof(buf)) <= 0)
@@ -211,12 +211,14 @@
 	for (fs = strtok(buf, delim); fs; fs = strtok(NULL, delim)) {
 		mount = strtok(NULL, delim);
 		type = strtok(NULL, delim);
-		strtok(NULL, delim);
+		options = strtok(NULL, delim);
 		strtok(NULL, delim);
 		strtok(NULL, delim);
 
 		if (strcmp(type, "cgroup2") == 0) {
 			strncpy(root, mount, len);
+			if (nsdelegate)
+				*nsdelegate = !!strstr(options, "nsdelegate");
 			return 0;
 		}
 	}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/cgroup_util.h
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/cgroup_util.h
@@ -21,7 +21,7 @@
 	return abs(a - b) <= (a + b) / 100 * err;
 }
 
-extern int cg_find_unified_root(char *root, size_t len);
+extern int cg_find_unified_root(char *root, size_t len, bool *nsdelegate);
 extern char *cg_name(const char *root, const char *name);
 extern char *cg_name_indexed(const char *root, const char *name, int index);
 extern char *cg_control(const char *cgroup, const char *control);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/test_core.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/test_core.c
@@ -18,6 +18,8 @@
 #include "../kselftest.h"
 #include "cgroup_util.h"
 
+static bool nsdelegate;
+
 static int touch_anon(char *buf, size_t size)
 {
 	int fd;
@@ -775,6 +777,9 @@
 	pid_t pid;
 	int status;
 
+	if (!nsdelegate)
+		return KSFT_SKIP;
+
 	cg_test_a = cg_name(root, "cg_test_a");
 	cg_test_b = cg_name(root, "cg_test_b");
 
@@ -862,7 +867,7 @@
 	char root[PATH_MAX];
 	int i, ret = EXIT_SUCCESS;
 
-	if (cg_find_unified_root(root, sizeof(root)))
+	if (cg_find_unified_root(root, sizeof(root), &nsdelegate))
 		ksft_exit_skip("cgroup v2 isn't mounted\n");
 
 	if (cg_read_strstr(root, "cgroup.subtree_control", "memory"))
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/test_cpu.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/test_cpu.c
@@ -700,7 +700,7 @@
 	char root[PATH_MAX];
 	int i, ret = EXIT_SUCCESS;
 
-	if (cg_find_unified_root(root, sizeof(root)))
+	if (cg_find_unified_root(root, sizeof(root), NULL))
 		ksft_exit_skip("cgroup v2 isn't mounted\n");
 
 	if (cg_read_strstr(root, "cgroup.subtree_control", "cpu"))
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/test_cpuset.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/test_cpuset.c
@@ -249,7 +249,7 @@
 	char root[PATH_MAX];
 	int i, ret = EXIT_SUCCESS;
 
-	if (cg_find_unified_root(root, sizeof(root)))
+	if (cg_find_unified_root(root, sizeof(root), NULL))
 		ksft_exit_skip("cgroup v2 isn't mounted\n");
 
 	if (cg_read_strstr(root, "cgroup.subtree_control", "cpuset"))
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/test_freezer.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/test_freezer.c
@@ -827,7 +827,7 @@
 	char root[PATH_MAX];
 	int i, ret = EXIT_SUCCESS;
 
-	if (cg_find_unified_root(root, sizeof(root)))
+	if (cg_find_unified_root(root, sizeof(root), NULL))
 		ksft_exit_skip("cgroup v2 isn't mounted\n");
 	for (i = 0; i < ARRAY_SIZE(tests); i++) {
 		switch (tests[i].fn(root)) {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/test_hugetlb_memcg.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/test_hugetlb_memcg.c
@@ -214,7 +214,7 @@
 		return ret;
 	}
 
-	if (cg_find_unified_root(root, sizeof(root)))
+	if (cg_find_unified_root(root, sizeof(root), NULL))
 		ksft_exit_skip("cgroup v2 isn't mounted\n");
 
 	switch (test_hugetlb_memcg(root)) {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/test_kill.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/test_kill.c
@@ -276,7 +276,7 @@
 	char root[PATH_MAX];
 	int i, ret = EXIT_SUCCESS;
 
-	if (cg_find_unified_root(root, sizeof(root)))
+	if (cg_find_unified_root(root, sizeof(root), NULL))
 		ksft_exit_skip("cgroup v2 isn't mounted\n");
 	for (i = 0; i < ARRAY_SIZE(tests); i++) {
 		switch (tests[i].fn(root)) {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/test_kmem.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/test_kmem.c
@@ -420,7 +420,7 @@
 	char root[PATH_MAX];
 	int i, ret = EXIT_SUCCESS;
 
-	if (cg_find_unified_root(root, sizeof(root)))
+	if (cg_find_unified_root(root, sizeof(root), NULL))
 		ksft_exit_skip("cgroup v2 isn't mounted\n");
 
 	/*
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/test_memcontrol.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/test_memcontrol.c
@@ -1314,7 +1314,7 @@
 	char root[PATH_MAX];
 	int i, proc_status, ret = EXIT_SUCCESS;
 
-	if (cg_find_unified_root(root, sizeof(root)))
+	if (cg_find_unified_root(root, sizeof(root), NULL))
 		ksft_exit_skip("cgroup v2 isn't mounted\n");
 
 	/*
--- linux-qcom-6.8.0.orig/tools/testing/selftests/cgroup/test_zswap.c
+++ linux-qcom-6.8.0/tools/testing/selftests/cgroup/test_zswap.c
@@ -324,7 +324,7 @@
 	char root[PATH_MAX];
 	int i, ret = EXIT_SUCCESS;
 
-	if (cg_find_unified_root(root, sizeof(root)))
+	if (cg_find_unified_root(root, sizeof(root), NULL))
 		ksft_exit_skip("cgroup v2 isn't mounted\n");
 
 	if (!zswap_configured())
--- linux-qcom-6.8.0.orig/tools/testing/selftests/core/close_range_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/core/close_range_test.c
@@ -536,4 +536,39 @@
 	EXPECT_EQ(close(fd3), 0);
 }
 
+TEST(close_range_bitmap_corruption)
+{
+	pid_t pid;
+	int status;
+	struct __clone_args args = {
+		.flags = CLONE_FILES,
+		.exit_signal = SIGCHLD,
+	};
+
+	/* get the first 128 descriptors open */
+	for (int i = 2; i < 128; i++)
+		EXPECT_GE(dup2(0, i), 0);
+
+	/* get descriptor table shared */
+	pid = sys_clone3(&args, sizeof(args));
+	ASSERT_GE(pid, 0);
+
+	if (pid == 0) {
+		/* unshare and truncate descriptor table down to 64 */
+		if (sys_close_range(64, ~0U, CLOSE_RANGE_UNSHARE))
+			exit(EXIT_FAILURE);
+
+		ASSERT_EQ(fcntl(64, F_GETFD), -1);
+		/* ... and verify that the range 64..127 is not
+		   stuck "fully used" according to secondary bitmap */
+		EXPECT_EQ(dup(0), 64)
+			exit(EXIT_FAILURE);
+		exit(EXIT_SUCCESS);
+	}
+
+	EXPECT_EQ(waitpid(pid, &status, 0), pid);
+	EXPECT_EQ(true, WIFEXITED(status));
+	EXPECT_EQ(0, WEXITSTATUS(status));
+}
+
 TEST_HARNESS_MAIN
--- linux-qcom-6.8.0.orig/tools/testing/selftests/damon/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/damon/Makefile
@@ -4,7 +4,7 @@
 TEST_GEN_FILES += huge_count_read_write
 TEST_GEN_FILES += access_memory
 
-TEST_FILES = _chk_dependency.sh _debugfs_common.sh
+TEST_FILES = _chk_dependency.sh _debugfs_common.sh _damon_sysfs.py
 TEST_PROGS = debugfs_attrs.sh debugfs_schemes.sh debugfs_target_ids.sh
 TEST_PROGS += debugfs_empty_targets.sh debugfs_huge_count_read_write.sh
 TEST_PROGS += debugfs_duplicate_context_creation.sh
--- linux-qcom-6.8.0.orig/tools/testing/selftests/damon/_damon_sysfs.py
+++ linux-qcom-6.8.0/tools/testing/selftests/damon/_damon_sysfs.py
@@ -241,6 +241,8 @@
         nr_schemes_file = os.path.join(
                 self.sysfs_dir(), 'schemes', 'nr_schemes')
         content, err = read_file(nr_schemes_file)
+        if err is not None:
+            return err
         if int(content) != len(self.schemes):
             err = write_file(nr_schemes_file, '%d' % len(self.schemes))
             if err != None:
--- linux-qcom-6.8.0.orig/tools/testing/selftests/damon/access_memory.c
+++ linux-qcom-6.8.0/tools/testing/selftests/damon/access_memory.c
@@ -35,7 +35,7 @@
 		start_clock = clock();
 		while ((clock() - start_clock) * 1000 / CLOCKS_PER_SEC <
 				access_time_ms)
-			memset(regions[i], i, 1024 * 1024 * 10);
+			memset(regions[i], i, sz_region);
 	}
 	return 0;
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c
+++ linux-qcom-6.8.0/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c
@@ -28,9 +28,11 @@
 	version.name = name;
 
 	ret = ioctl(fd, DRM_IOCTL_VERSION, &version);
-	if (ret)
+	if (ret || version.name_len != 4)
 		return 0;
 
+	name[4] = '\0';
+
 	return !strcmp(name, "vgem");
 }
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/drivers/net/mlxsw/sharedbuffer.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/drivers/net/mlxsw/sharedbuffer.sh
@@ -22,20 +22,34 @@
 h1_create()
 {
 	simple_if_init $h1 192.0.1.1/24
+	tc qdisc add dev $h1 clsact
+
+	# Add egress filter on $h1 that will guarantee that the packet sent,
+	# will be the only packet being passed to the device.
+	tc filter add dev $h1 egress pref 2 handle 102 matchall action drop
 }
 
 h1_destroy()
 {
+	tc filter del dev $h1 egress pref 2 handle 102 matchall action drop
+	tc qdisc del dev $h1 clsact
 	simple_if_fini $h1 192.0.1.1/24
 }
 
 h2_create()
 {
 	simple_if_init $h2 192.0.1.2/24
+	tc qdisc add dev $h2 clsact
+
+	# Add egress filter on $h2 that will guarantee that the packet sent,
+	# will be the only packet being passed to the device.
+	tc filter add dev $h2 egress pref 1 handle 101 matchall action drop
 }
 
 h2_destroy()
 {
+	tc filter del dev $h2 egress pref 1 handle 101 matchall action drop
+	tc qdisc del dev $h2 clsact
 	simple_if_fini $h2 192.0.1.2/24
 }
 
@@ -101,6 +115,11 @@
 	local exp_max_occ=$(devlink_cell_size_get)
 	local max_occ
 
+	tc filter add dev $h1 egress protocol ip pref 1 handle 101 flower \
+		src_mac $h1mac dst_mac $h2mac \
+		src_ip 192.0.1.1 dst_ip 192.0.1.2 \
+		action pass
+
 	devlink sb occupancy clearmax $DEVLINK_DEV
 
 	$MZ $h1 -c 1 -p 10 -a $h1mac -b $h2mac -A 192.0.1.1 -B 192.0.1.2 \
@@ -109,11 +128,6 @@
 	devlink sb occupancy snapshot $DEVLINK_DEV
 
 	RET=0
-	max_occ=$(sb_occ_pool_check $dl_port1 $SB_POOL_ING $exp_max_occ)
-	check_err $? "Expected iPool($SB_POOL_ING) max occupancy to be $exp_max_occ, but got $max_occ"
-	log_test "physical port's($h1) ingress pool"
-
-	RET=0
 	max_occ=$(sb_occ_pool_check $dl_port2 $SB_POOL_ING $exp_max_occ)
 	check_err $? "Expected iPool($SB_POOL_ING) max occupancy to be $exp_max_occ, but got $max_occ"
 	log_test "physical port's($h2) ingress pool"
@@ -122,6 +136,11 @@
 	max_occ=$(sb_occ_pool_check $cpu_dl_port $SB_POOL_EGR_CPU $exp_max_occ)
 	check_err $? "Expected ePool($SB_POOL_EGR_CPU) max occupancy to be $exp_max_occ, but got $max_occ"
 	log_test "CPU port's egress pool"
+
+	tc filter del dev $h1 egress protocol ip pref 1 handle 101 flower \
+		src_mac $h1mac dst_mac $h2mac \
+		src_ip 192.0.1.1 dst_ip 192.0.1.2 \
+		action pass
 }
 
 port_tc_ip_test()
@@ -129,6 +148,11 @@
 	local exp_max_occ=$(devlink_cell_size_get)
 	local max_occ
 
+	tc filter add dev $h1 egress protocol ip pref 1 handle 101 flower \
+		src_mac $h1mac dst_mac $h2mac \
+		src_ip 192.0.1.1 dst_ip 192.0.1.2 \
+		action pass
+
 	devlink sb occupancy clearmax $DEVLINK_DEV
 
 	$MZ $h1 -c 1 -p 10 -a $h1mac -b $h2mac -A 192.0.1.1 -B 192.0.1.2 \
@@ -139,17 +163,17 @@
 	RET=0
 	max_occ=$(sb_occ_itc_check $dl_port2 $SB_ITC $exp_max_occ)
 	check_err $? "Expected ingress TC($SB_ITC) max occupancy to be $exp_max_occ, but got $max_occ"
-	log_test "physical port's($h1) ingress TC - IP packet"
-
-	RET=0
-	max_occ=$(sb_occ_itc_check $dl_port2 $SB_ITC $exp_max_occ)
-	check_err $? "Expected ingress TC($SB_ITC) max occupancy to be $exp_max_occ, but got $max_occ"
 	log_test "physical port's($h2) ingress TC - IP packet"
 
 	RET=0
 	max_occ=$(sb_occ_etc_check $cpu_dl_port $SB_ITC_CPU_IP $exp_max_occ)
 	check_err $? "Expected egress TC($SB_ITC_CPU_IP) max occupancy to be $exp_max_occ, but got $max_occ"
 	log_test "CPU port's egress TC - IP packet"
+
+	tc filter del dev $h1 egress protocol ip pref 1 handle 101 flower \
+		src_mac $h1mac dst_mac $h2mac \
+		src_ip 192.0.1.1 dst_ip 192.0.1.2 \
+		action pass
 }
 
 port_tc_arp_test()
@@ -157,6 +181,9 @@
 	local exp_max_occ=$(devlink_cell_size_get)
 	local max_occ
 
+	tc filter add dev $h1 egress protocol arp pref 1 handle 101 flower \
+		src_mac $h1mac action pass
+
 	devlink sb occupancy clearmax $DEVLINK_DEV
 
 	$MZ $h1 -c 1 -p 10 -a $h1mac -A 192.0.1.1 -t arp -q
@@ -166,17 +193,15 @@
 	RET=0
 	max_occ=$(sb_occ_itc_check $dl_port2 $SB_ITC $exp_max_occ)
 	check_err $? "Expected ingress TC($SB_ITC) max occupancy to be $exp_max_occ, but got $max_occ"
-	log_test "physical port's($h1) ingress TC - ARP packet"
-
-	RET=0
-	max_occ=$(sb_occ_itc_check $dl_port2 $SB_ITC $exp_max_occ)
-	check_err $? "Expected ingress TC($SB_ITC) max occupancy to be $exp_max_occ, but got $max_occ"
 	log_test "physical port's($h2) ingress TC - ARP packet"
 
 	RET=0
 	max_occ=$(sb_occ_etc_check $cpu_dl_port $SB_ITC_CPU_ARP $exp_max_occ)
 	check_err $? "Expected egress TC($SB_ITC_IP2ME) max occupancy to be $exp_max_occ, but got $max_occ"
 	log_test "CPU port's egress TC - ARP packet"
+
+	tc filter del dev $h1 egress protocol arp pref 1 handle 101 flower \
+		src_mac $h1mac action pass
 }
 
 setup_prepare()
--- linux-qcom-6.8.0.orig/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh
@@ -11,7 +11,7 @@
 	multiple_masks_test ctcam_edge_cases_test delta_simple_test \
 	delta_two_masks_one_key_test delta_simple_rehash_test \
 	bloom_simple_test bloom_complex_test bloom_delta_test \
-	max_erp_entries_test max_group_size_test"
+	max_erp_entries_test max_group_size_test collision_test"
 NUM_NETIFS=2
 source $lib_dir/lib.sh
 source $lib_dir/tc_common.sh
@@ -457,7 +457,7 @@
 {
 	# If 2 keys are the same and only differ in mask in a way that
 	# they belong under the same ERP (second is delta of the first),
-	# there should be no C-TCAM spill.
+	# there should be C-TCAM spill.
 
 	RET=0
 
@@ -474,8 +474,8 @@
 	tp_record "mlxsw:*" "tc filter add dev $h2 ingress protocol ip \
 		   pref 2 handle 102 flower $tcflags dst_ip 192.0.2.2 \
 		   action drop"
-	tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" 0
-	check_err $? "incorrect C-TCAM spill while inserting the second rule"
+	tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" 1
+	check_err $? "C-TCAM spill did not happen while inserting the second rule"
 
 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
 		-t ip -q
@@ -1087,6 +1087,53 @@
 	log_test "max ACL group size test ($tcflags). max size $max_size"
 }
 
+collision_test()
+{
+	# Filters cannot share an eRP if in the common unmasked part (i.e.,
+	# without the delta bits) they have the same values. If the driver does
+	# not prevent such configuration (by spilling into the C-TCAM), then
+	# multiple entries will be present in the device with the same key,
+	# leading to collisions and a reduced scale.
+	#
+	# Create such a scenario and make sure all the filters are successfully
+	# added.
+
+	RET=0
+
+	local ret
+
+	if [[ "$tcflags" != "skip_sw" ]]; then
+		return 0;
+	fi
+
+	# Add a single dst_ip/24 filter and multiple dst_ip/32 filters that all
+	# have the same values in the common unmasked part (dst_ip/24).
+
+	tc filter add dev $h2 ingress pref 1 proto ipv4 handle 101 \
+		flower $tcflags dst_ip 198.51.100.0/24 \
+		action drop
+
+	for i in {0..255}; do
+		tc filter add dev $h2 ingress pref 2 proto ipv4 \
+			handle $((102 + i)) \
+			flower $tcflags dst_ip 198.51.100.${i}/32 \
+			action drop
+		ret=$?
+		[[ $ret -ne 0 ]] && break
+	done
+
+	check_err $ret "failed to add all the filters"
+
+	for i in {255..0}; do
+		tc filter del dev $h2 ingress pref 2 proto ipv4 \
+			handle $((102 + i)) flower
+	done
+
+	tc filter del dev $h2 ingress pref 1 proto ipv4 handle 101 flower
+
+	log_test "collision test ($tcflags)"
+}
+
 setup_prepare()
 {
 	h1=${NETIFS[p1]}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/dt/test_unprobed_devices.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/dt/test_unprobed_devices.sh
@@ -38,8 +38,21 @@
 		# Check if node is available
 		if [[ -e "${node}"/status ]]; then
 			status=$(tr -d '\000' < "${node}"/status)
-			[[ "${status}" != "okay" && "${status}" != "ok" ]] && continue
+			if [[ "${status}" != "okay" && "${status}" != "ok" ]]; then
+				if [ -n "${disabled_nodes_regex}" ]; then
+					disabled_nodes_regex="${disabled_nodes_regex}|${node}"
+				else
+					disabled_nodes_regex="${node}"
+				fi
+				continue
+			fi
 		fi
+
+		# Ignore this node if one of its ancestors was disabled
+		if [ -n "${disabled_nodes_regex}" ]; then
+			echo "${node}" | grep -q -E "${disabled_nodes_regex}" && continue
+		fi
+
 		echo "${node}" | sed -e 's|\/proc\/device-tree||'
 	done | sort
 	)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/filesystems/binderfs/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/filesystems/binderfs/Makefile
@@ -3,6 +3,4 @@
 CFLAGS += $(KHDR_INCLUDES) -pthread
 TEST_GEN_PROGS := binderfs_test
 
-binderfs_test: binderfs_test.c ../../kselftest.h ../../kselftest_harness.h
-
 include ../../lib.mk
--- linux-qcom-6.8.0.orig/tools/testing/selftests/filesystems/overlayfs/dev_in_maps.c
+++ linux-qcom-6.8.0/tools/testing/selftests/filesystems/overlayfs/dev_in_maps.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #define _GNU_SOURCE
+#define __SANE_USERSPACE_TYPES__ // Use ll64
 
 #include <inttypes.h>
 #include <unistd.h>
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc
@@ -6,6 +6,18 @@
 original_owner=`stat -c "%u" .`
 
 mount_point=`stat -c '%m' .`
+
+# If stat -c '%m' does not work (e.g. busybox) or failed, try to use the
+# current working directory (which should be a tracefs) as the mount point.
+if [ ! -d "$mount_point" ]; then
+	if mount | grep -qw $PWD ; then
+		mount_point=$PWD
+	else
+		# If PWD doesn't work, that is an environmental problem.
+		exit_unresolved
+	fi
+fi
+
 mount_options=`mount | grep "$mount_point" | sed -e 's/.*(\(.*\)).*/\1/'`
 
 # find another owner and group that is not the original
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/dynevent/add_remove_btfarg.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/dynevent/add_remove_btfarg.tc
@@ -53,7 +53,7 @@
 
 echo > dynamic_events
 
-if [ "$FIELDS" ] ; then
+if [ "$FIELDS" -a "$FPROBES" ] ; then
 echo "t:tpevent ${TP2} obj_size=s->object_size" >> dynamic_events
 echo "f:fpevent ${TP3}%return path=\$retval->name:string" >> dynamic_events
 echo "t:tpevent2 ${TP4} p->se.group_node.next->prev" >> dynamic_events
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/dynevent/fprobe_syntax_errors.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/dynevent/fprobe_syntax_errors.tc
@@ -34,7 +34,9 @@
 
 check_error 'f vfs_read ^$arg10000'	# BAD_ARG_NUM
 
+if !grep -q 'kernel return probes support:' README; then
 check_error 'f vfs_read $retval ^$arg1' # BAD_VAR
+fi
 check_error 'f vfs_read ^$none_var'	# BAD_VAR
 check_error 'f vfs_read ^'$REG		# BAD_VAR
 
@@ -99,7 +101,9 @@
 check_error 'f vfs_read args=^$arg*'		# BAD_VAR_ARGS
 check_error 'f vfs_read +0(^$arg*)'		# BAD_VAR_ARGS
 check_error 'f vfs_read $arg* ^$arg*'		# DOUBLE_ARGS
+if !grep -q 'kernel return probes support:' README; then
 check_error 'f vfs_read%return ^$arg*'		# NOFENTRY_ARGS
+fi
 check_error 'f vfs_read ^hoge'			# NO_BTFARG
 check_error 'f kfree ^$arg10'			# NO_BTFARG (exceed the number of parameters)
 check_error 'f kfree%return ^$retval'		# NO_RETVAL
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/dynevent/test_duplicates.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/dynevent/test_duplicates.tc
@@ -1,7 +1,7 @@
 #!/bin/sh
 # SPDX-License-Identifier: GPL-2.0
 # description: Generic dynamic event - check if duplicate events are caught
-# requires: dynamic_events "e[:[<group>/][<event>]] <attached-group>.<attached-event> [<args>]":README
+# requires: dynamic_events "e[:[<group>/][<event>]] <attached-group>.<attached-event> [<args>]":README events/syscalls/sys_enter_openat
 
 echo 0 > events/enable
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc
@@ -18,7 +18,7 @@
 
 yield
 
-count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
+count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
 if [ $count -lt 3 ]; then
     fail "at least fork, exec and exit events should be recorded"
 fi
@@ -29,7 +29,7 @@
 
 yield
 
-count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
+count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
 if [ $count -lt 3 ]; then
     fail "at least fork, exec and exit events should be recorded"
 fi
@@ -40,7 +40,7 @@
 
 yield
 
-count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
+count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
 if [ $count -ne 0 ]; then
     fail "any of scheduler events should not be recorded"
 fi
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc
@@ -10,7 +10,6 @@
 }
 
 sample_events() {
-    echo > trace
     echo 1 > events/kmem/kmem_cache_free/enable
     echo 1 > tracing_on
     ls > /dev/null
@@ -22,9 +21,10 @@
 echo 0 > events/enable
 
 echo "Get the most frequently calling function"
+echo > trace
 sample_events
 
-target_func=`cut -d: -f3 trace | sed 's/call_site=\([^+]*\)+0x.*/\1/' | sort | uniq -c | sort | tail -n 1 | sed 's/^[ 0-9]*//'`
+target_func=`cat trace | grep -o 'call_site=\([^+]*\)' | sed 's/call_site=//' | sort | uniq -c | sort | tail -n 1 | sed 's/^[ 0-9]*//'`
 if [ -z "$target_func" ]; then
     exit_fail
 fi
@@ -32,7 +32,16 @@
 
 echo "Test event filter function name"
 echo "call_site.function == $target_func" > events/kmem/kmem_cache_free/filter
+
+sample_events
+max_retry=10
+while [ `grep kmem_cache_free trace| wc -l` -eq 0 ]; do
 sample_events
+max_retry=$((max_retry - 1))
+if [ $max_retry -eq 0 ]; then
+	exit_fail
+fi
+done
 
 hitcnt=`grep kmem_cache_free trace| grep $target_func | wc -l`
 misscnt=`grep kmem_cache_free trace| grep -v $target_func | wc -l`
@@ -49,7 +58,16 @@
 
 echo "Test event filter function address"
 echo "call_site.function == 0x$address" > events/kmem/kmem_cache_free/filter
+echo > trace
+sample_events
+max_retry=10
+while [ `grep kmem_cache_free trace| wc -l` -eq 0 ]; do
 sample_events
+max_retry=$((max_retry - 1))
+if [ $max_retry -eq 0 ]; then
+	exit_fail
+fi
+done
 
 hitcnt=`grep kmem_cache_free trace| grep $target_func | wc -l`
 misscnt=`grep kmem_cache_free trace| grep -v $target_func | wc -l`
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_char.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_char.tc
@@ -1,7 +1,7 @@
 #!/bin/sh
 # SPDX-License-Identifier: GPL-2.0
 # description: Kprobe event char type argument
-# requires: kprobe_events
+# requires: kprobe_events available_filter_functions
 
 case `uname -m` in
 x86_64)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc
@@ -1,7 +1,7 @@
 #!/bin/sh
 # SPDX-License-Identifier: GPL-2.0
 # description: Kprobe event string type argument
-# requires: kprobe_events
+# requires: kprobe_events available_filter_functions
 
 case `uname -m` in
 x86_64)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_eventname.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_eventname.tc
@@ -30,7 +30,8 @@
 	fi
 
 	grep " [tT] .*\.isra\..*" /proc/kallsyms | cut -f 3 -d " " | while read f; do
-		if grep -s $f available_filter_functions; then
+		cnt=`grep -s $f available_filter_functions | wc -l`;
+		if [ $cnt -eq 1 ]; then
 			echo $f
 			break
 		fi
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc
@@ -108,8 +108,10 @@
 check_error 'p vfs_read args=^$arg*'		# BAD_VAR_ARGS
 check_error 'p vfs_read +0(^$arg*)'		# BAD_VAR_ARGS
 check_error 'p vfs_read $arg* ^$arg*'		# DOUBLE_ARGS
+if !grep -q 'kernel return probes support:' README; then
 check_error 'r vfs_read ^$arg*'			# NOFENTRY_ARGS
-check_error 'p vfs_read+8 ^$arg*'		# NOFENTRY_ARGS
+fi
+check_error 'p vfs_read+20 ^$arg*'		# NOFENTRY_ARGS
 check_error 'p vfs_read ^hoge'			# NO_BTFARG
 check_error 'p kfree ^$arg10'			# NO_BTFARG (exceed the number of parameters)
 check_error 'r kfree ^$retval'			# NO_RETVAL
--- linux-qcom-6.8.0.orig/tools/testing/selftests/ftrace/test.d/trigger/trigger-trace-marker-snapshot.tc
+++ linux-qcom-6.8.0/tools/testing/selftests/ftrace/test.d/trigger/trigger-trace-marker-snapshot.tc
@@ -14,12 +14,12 @@
     x=$2
 
     cat $file | while read line; do
-	comment=`echo $line | sed -e 's/^#//'`
+	comment=`echo "$line" | sed -e 's/^#//'`
 	if [ "$line" != "$comment" ]; then
 	    continue
 	fi
 	echo "testing $line for >$x<"
-	match=`echo $line | sed -e "s/>$x<//"`
+	match=`echo "$line" | sed -e "s/>$x<//"`
 	if [ "$line" = "$match" ]; then
 	    fail "$line does not have >$x< in it"
 	fi
--- linux-qcom-6.8.0.orig/tools/testing/selftests/futex/functional/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/futex/functional/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 INCLUDES := -I../include -I../../ $(KHDR_INCLUDES)
-CFLAGS := $(CFLAGS) -g -O2 -Wall -D_GNU_SOURCE -pthread $(INCLUDES) $(KHDR_INCLUDES)
+CFLAGS := $(CFLAGS) -g -O2 -Wall -D_GNU_SOURCE= -pthread $(INCLUDES) $(KHDR_INCLUDES)
 LDLIBS := -lpthread -lrt
 
 LOCAL_HDRS := \
--- linux-qcom-6.8.0.orig/tools/testing/selftests/gpio/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/gpio/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 
-TEST_PROGS := gpio-mockup.sh gpio-sim.sh
+TEST_PROGS := gpio-mockup.sh gpio-sim.sh gpio-aggregator.sh
 TEST_FILES := gpio-mockup-sysfs.sh
 TEST_GEN_PROGS_EXTENDED := gpio-mockup-cdev gpio-chip-info gpio-line-name
 CFLAGS += -O2 -g -Wall $(KHDR_INCLUDES)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/gpio/config
+++ linux-qcom-6.8.0/tools/testing/selftests/gpio/config
@@ -2,3 +2,4 @@
 CONFIG_GPIO_CDEV=y
 CONFIG_GPIO_MOCKUP=m
 CONFIG_GPIO_SIM=m
+CONFIG_GPIO_AGGREGATOR=m
--- linux-qcom-6.8.0.orig/tools/testing/selftests/gpio/gpio-aggregator.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/gpio/gpio-aggregator.sh
@@ -0,0 +1,727 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (C) 2025 Bartosz Golaszewski<brgl@bgdev.pl>
+# Copyright (C) 2025 Koichiro Den<koichiro.den@canonical.com>
+
+BASE_DIR=$(dirname "$0")
+CONFIGFS_SIM_DIR="/sys/kernel/config/gpio-sim"
+CONFIGFS_AGG_DIR="/sys/kernel/config/gpio-aggregator"
+SYSFS_AGG_DIR="/sys/bus/platform/drivers/gpio-aggregator"
+MODULE="gpio-aggregator"
+
+fail() {
+	echo "$*" >&2
+	echo "GPIO $MODULE test FAIL"
+	exit 1
+}
+
+skip() {
+	echo "$*" >&2
+	echo "GPIO $MODULE test SKIP"
+	exit 4
+}
+
+# gpio-sim
+sim_enable_chip() {
+	local CHIP=$1
+
+	echo 1 > "$CONFIGFS_SIM_DIR/$CHIP/live" || fail "Unable to enable the chip"
+}
+
+sim_disable_chip() {
+	local CHIP=$1
+
+	echo 0 > "$CONFIGFS_SIM_DIR/$CHIP/live" || fail "Unable to disable the chip"
+}
+
+sim_configfs_cleanup() {
+	local NOCHECK=${1:-0}
+
+	for CHIP_DIR in "$CONFIGFS_SIM_DIR"/*; do
+		[ -d "$CHIP_DIR" ] || continue
+		echo 0 > "$CHIP_DIR/live"
+		find "$CHIP_DIR" -depth -type d -exec rmdir {} \;
+	done
+	[ "$NOCHECK" -eq 1 ] && return;
+	remaining=$(find "$CONFIGFS_SIM_DIR" -mindepth 1 -type d 2> /dev/null)
+	if [ -n "$remaining" ]; then
+		fail "Directories remain in $CONFIGFS_SIM_DIR: $remaining"
+	fi
+}
+
+sim_get_chip_label() {
+	local CHIP=$1
+	local BANK=$2
+	local CHIP_NAME=$(cat "$CONFIGFS_SIM_DIR/$CHIP/$BANK/chip_name" 2> /dev/null) || \
+		fail "Unable to read the chip name from configfs"
+
+	$BASE_DIR/gpio-chip-info "/dev/$CHIP_NAME" label || \
+		fail "Unable to read the chip label from the character device"
+}
+
+# gpio-aggregator
+agg_create_chip() {
+	local CHIP=$1
+
+	mkdir "$CONFIGFS_AGG_DIR/$CHIP"
+}
+
+agg_remove_chip() {
+	local CHIP=$1
+
+	find "$CONFIGFS_AGG_DIR/$CHIP/" -depth -type d -exec rmdir {} \; || \
+		fail "Unable to remove $CONFIGFS_AGG_DIR/$CHIP"
+}
+
+agg_create_line() {
+	local CHIP=$1
+	local LINE=$2
+
+	mkdir "$CONFIGFS_AGG_DIR/$CHIP/$LINE"
+}
+
+agg_remove_line() {
+	local CHIP=$1
+	local LINE=$2
+
+	rmdir "$CONFIGFS_AGG_DIR/$CHIP/$LINE"
+}
+
+agg_set_key() {
+	local CHIP=$1
+	local LINE=$2
+	local KEY=$3
+
+	echo "$KEY" > "$CONFIGFS_AGG_DIR/$CHIP/$LINE/key" || fail "Unable to set the lookup key"
+}
+
+agg_set_offset() {
+	local CHIP=$1
+	local LINE=$2
+	local OFFSET=$3
+
+	echo "$OFFSET" > "$CONFIGFS_AGG_DIR/$CHIP/$LINE/offset" || \
+		fail "Unable to set the lookup offset"
+}
+
+agg_set_line_name() {
+	local CHIP=$1
+	local LINE=$2
+	local NAME=$3
+
+	echo "$NAME" > "$CONFIGFS_AGG_DIR/$CHIP/$LINE/name" || fail "Unable to set the line name"
+}
+
+agg_enable_chip() {
+	local CHIP=$1
+
+	echo 1 > "$CONFIGFS_AGG_DIR/$CHIP/live" || fail "Unable to enable the chip"
+}
+
+agg_disable_chip() {
+	local CHIP=$1
+
+	echo 0 > "$CONFIGFS_AGG_DIR/$CHIP/live" || fail "Unable to disable the chip"
+}
+
+agg_configfs_cleanup() {
+	local NOCHECK=${1:-0}
+
+	for CHIP_DIR in "$CONFIGFS_AGG_DIR"/*; do
+		[ -d "$CHIP_DIR" ] || continue
+		echo 0 > "$CHIP_DIR/live" 2> /dev/null
+		find "$CHIP_DIR" -depth -type d -exec rmdir {} \;
+	done
+	[ "$NOCHECK" -eq 1 ] && return;
+	remaining=$(find "$CONFIGFS_AGG_DIR" -mindepth 1 -type d 2> /dev/null)
+	if [ -n "$remaining" ]; then
+		fail "Directories remain in $CONFIGFS_AGG_DIR: $remaining"
+	fi
+}
+
+agg_configfs_dev_name() {
+	local CHIP=$1
+
+	cat "$CONFIGFS_AGG_DIR/$CHIP/dev_name" 2> /dev/null || \
+		fail "Unable to read the device name from configfs"
+}
+
+agg_configfs_chip_name() {
+	local CHIP=$1
+	local DEV_NAME=$(agg_configfs_dev_name "$CHIP")
+	local CHIP_LIST=$(find "/sys/devices/platform/$DEV_NAME" \
+		-maxdepth 1 -type d -name "gpiochip[0-9]*" 2> /dev/null)
+	local CHIP_COUNT=$(echo "$CHIP_LIST" | wc -l)
+
+	if [ -z "$CHIP_LIST" ]; then
+		fail "No gpiochip in/sys/devices/platform/$DEV_NAME/"
+	elif [ "$CHIP_COUNT" -ne 1 ]; then
+		fail "Multiple gpiochips unexpectedly found: $CHIP_LIST"
+	fi
+	basename "$CHIP_LIST"
+}
+
+agg_get_chip_num_lines() {
+	local CHIP=$1
+	local N_DIR=$(ls -d $CONFIGFS_AGG_DIR/$CHIP/line[0-9]* 2> /dev/null | wc -l)
+	local N_LINES
+
+	if [ "$(cat $CONFIGFS_AGG_DIR/$CHIP/live)" = 0 ]; then
+		echo "$N_DIR"
+	else
+		N_LINES=$(
+			$BASE_DIR/gpio-chip-info \
+				"/dev/$(agg_configfs_chip_name "$CHIP")" num-lines
+		) || fail "Unable to read the number of lines from the character device"
+		if [ $N_DIR != $N_LINES ]; then
+			fail "Discrepancy between two sources for the number of lines"
+		fi
+		echo "$N_LINES"
+	fi
+}
+
+agg_get_chip_label() {
+	local CHIP=$1
+
+	$BASE_DIR/gpio-chip-info "/dev/$(agg_configfs_chip_name "$CHIP")" label || \
+		fail "Unable to read the chip label from the character device"
+}
+
+agg_get_line_name() {
+	local CHIP=$1
+	local OFFSET=$2
+	local NAME_CONFIGFS=$(cat "$CONFIGFS_AGG_DIR/$CHIP/line${OFFSET}/name")
+	local NAME_CDEV
+
+	if [ "$(cat "$CONFIGFS_AGG_DIR/$CHIP/live")" = 0 ]; then
+		echo "$NAME_CONFIGFS"
+	else
+		NAME_CDEV=$(
+			$BASE_DIR/gpio-line-name \
+				"/dev/$(agg_configfs_chip_name "$CHIP")" "$OFFSET"
+		) || fail "Unable to read the line name from the character device"
+		if [ "$NAME_CONFIGFS" != "$NAME_CDEV" ]; then
+			fail "Discrepancy between two sources for the name of line"
+		fi
+		echo "$NAME_CDEV"
+	fi
+}
+
+
+# Load the modules. This will pull in configfs if needed too.
+modprobe gpio-sim || skip "unable to load the gpio-sim module"
+modprobe gpio-aggregator || skip "unable to load the gpio-aggregator module"
+
+# Make sure configfs is mounted at /sys/kernel/config. Wait a bit if needed.
+for IDX in $(seq 5); do
+	if [ "$IDX" -eq "5" ]; then
+		skip "configfs not mounted at /sys/kernel/config"
+	fi
+
+	mountpoint -q /sys/kernel/config && break
+	sleep 0.1
+done
+
+# If the module was already loaded: remove all previous chips
+agg_configfs_cleanup
+sim_configfs_cleanup
+
+trap "exit 1" SIGTERM SIGINT
+trap "agg_configfs_cleanup 1; sim_configfs_cleanup 1" EXIT
+
+# Use gpio-sim chips as the test backend
+for CHIP in $(seq -f "chip%g" 0 1); do
+	mkdir $CONFIGFS_SIM_DIR/$CHIP
+	for BANK in $(seq -f "bank%g" 0 1); do
+		mkdir -p "$CONFIGFS_SIM_DIR/$CHIP/$BANK"
+		echo "${CHIP}_${BANK}" > "$CONFIGFS_SIM_DIR/$CHIP/$BANK/label" || \
+			fail "unable to set the chip label"
+		echo 16 > "$CONFIGFS_SIM_DIR/$CHIP/$BANK/num_lines" || \
+			fail "unable to set the number of lines"
+		for IDX in $(seq 0 15); do
+			LINE_NAME="${CHIP}${BANK}_${IDX}"
+			LINE_DIR="$CONFIGFS_SIM_DIR/$CHIP/$BANK/line$IDX"
+			mkdir -p $LINE_DIR
+			echo "$LINE_NAME" > "$LINE_DIR/name" || fail "unable to set the line name"
+		done
+	done
+	sim_enable_chip "$CHIP"
+done
+
+echo "1. GPIO aggregator creation/deletion"
+
+echo "1.1. Creation/deletion via configfs"
+
+echo "1.1.1. Minimum creation/deletion"
+agg_create_chip   agg0
+agg_create_line   agg0 line0
+agg_set_key       agg0 line0 "$(sim_get_chip_label chip0 bank0)"
+agg_set_offset    agg0 line0 5
+agg_set_line_name agg0 line0 test0
+agg_enable_chip   agg0
+test "$(cat "$CONFIGFS_AGG_DIR/agg0/live")" = 1 || fail "chip unexpectedly dead"
+test "$(agg_get_chip_label agg0)" = "$(agg_configfs_dev_name agg0)" || \
+	fail "label is inconsistent"
+test "$(agg_get_chip_num_lines agg0)" = "1" || fail "number of lines is not 1"
+test "$(agg_get_line_name agg0 0)" = "test0" || fail "line name is unset"
+agg_disable_chip  agg0
+agg_remove_line   agg0 line0
+agg_remove_chip   agg0
+
+echo "1.1.2. Complex creation/deletion"
+agg_create_chip   agg0
+agg_create_line   agg0 line0
+agg_create_line   agg0 line1
+agg_create_line   agg0 line2
+agg_create_line   agg0 line3
+agg_set_key       agg0 line0 "$(sim_get_chip_label chip0 bank0)"
+agg_set_key       agg0 line1 "$(sim_get_chip_label chip0 bank1)"
+agg_set_key       agg0 line2 "$(sim_get_chip_label chip1 bank0)"
+agg_set_key       agg0 line3 "$(sim_get_chip_label chip1 bank1)"
+agg_set_offset    agg0 line0 1
+agg_set_offset    agg0 line1 3
+agg_set_offset    agg0 line2 5
+agg_set_offset    agg0 line3 7
+agg_set_line_name agg0 line0 test0
+agg_set_line_name agg0 line1 test1
+agg_set_line_name agg0 line2 test2
+agg_set_line_name agg0 line3 test3
+agg_enable_chip   agg0
+test "$(cat "$CONFIGFS_AGG_DIR/agg0/live")" = 1 || fail "chip unexpectedly dead"
+test "$(agg_get_chip_label agg0)" = "$(agg_configfs_dev_name agg0)" || \
+	fail "label is inconsistent"
+test "$(agg_get_chip_num_lines agg0)" = "4" || fail "number of lines is not 1"
+test "$(agg_get_line_name agg0 0)" = "test0" || fail "line name is unset"
+test "$(agg_get_line_name agg0 1)" = "test1" || fail "line name is unset"
+test "$(agg_get_line_name agg0 2)" = "test2" || fail "line name is unset"
+test "$(agg_get_line_name agg0 3)" = "test3" || fail "line name is unset"
+agg_disable_chip  agg0
+agg_remove_line   agg0 line0
+agg_remove_line   agg0 line1
+agg_remove_line   agg0 line2
+agg_remove_line   agg0 line3
+agg_remove_chip   agg0
+
+echo "1.1.3. Can't instantiate a chip without any line"
+agg_create_chip   agg0
+echo 1 > "$CONFIGFS_AGG_DIR/agg0/live" 2> /dev/null && fail "chip unexpectedly enabled"
+test "$(cat "$CONFIGFS_AGG_DIR/agg0/live")" = 0 || fail "chip unexpectedly alive"
+agg_remove_chip   agg0
+
+echo "1.1.4. Can't instantiate a chip with invalid configuration"
+agg_create_chip   agg0
+agg_create_line   agg0 line0
+agg_set_key       agg0 line0 "chipX_bankX"
+agg_set_offset    agg0 line0 99
+agg_set_line_name agg0 line0 test0
+echo 1 > "$CONFIGFS_AGG_DIR/agg0/live" 2> /dev/null && fail "chip unexpectedly enabled"
+test "$(cat "$CONFIGFS_AGG_DIR/agg0/live")" = 0 || fail "chip unexpectedly alive"
+agg_remove_line   agg0 line0
+agg_remove_chip   agg0
+
+echo "1.1.5. Can't instantiate a chip asynchronously via deferred probe"
+agg_create_chip   agg0
+agg_create_line   agg0 line0
+agg_set_key       agg0 line0 "chip0_bank0"
+agg_set_offset    agg0 line0 5
+agg_set_line_name agg0 line0 test0
+sim_disable_chip  chip0
+echo 1 > "$CONFIGFS_AGG_DIR/agg0/live" 2> /dev/null && fail "chip unexpectedly enabled"
+test "$(cat "$CONFIGFS_AGG_DIR/agg0/live")" = 0 || fail "chip unexpectedly alive"
+sim_enable_chip   chip0
+sleep 1
+test "$(cat "$CONFIGFS_AGG_DIR/agg0/live")" = 0 || \
+	fail "chip unexpectedly transitioned to 'live' state"
+agg_remove_line   agg0 line0
+agg_remove_chip   agg0
+
+echo "1.1.6. Can't instantiate a chip with _sysfs prefix"
+mkdir "$CONFIGFS_AGG_DIR/_sysfs" 2> /dev/null && fail "chip _sysfs unexpectedly created"
+mkdir "$CONFIGFS_AGG_DIR/_sysfs.foo" 2> /dev/null && fail "chip _sysfs.foo unexpectedly created"
+
+echo "1.2. Creation/deletion via sysfs"
+
+echo "1.2.1. Minimum creation/deletion"
+echo "chip0_bank0 0" > "$SYSFS_AGG_DIR/new_device"
+CHIPNAME=$(agg_configfs_chip_name _sysfs.0)
+test "$(cat "$CONFIGFS_AGG_DIR/_sysfs.0/live")" = 1 || fail "chip unexpectedly dead"
+test "$(agg_get_chip_label _sysfs.0)" = "$(agg_configfs_dev_name _sysfs.0)" || \
+	fail "label is inconsistent"
+test "$(agg_get_chip_num_lines _sysfs.0)" = "1" || fail "number of lines is not 1"
+test "$(agg_get_line_name _sysfs.0 0)" = "" || fail "line name is unset"
+echo "$(agg_configfs_dev_name _sysfs.0)" > "$SYSFS_AGG_DIR/delete_device"
+test -d $CONFIGFS_AGG_DIR/_sysfs.0 && fail "_sysfs.0 unexpectedly remains"
+test -d/dev/${CHIPNAME} && fail "/dev/${CHIPNAME} unexpectedly remains"
+
+echo "1.2.2. Complex creation/deletion"
+echo "chip0bank0_0 chip1_bank1 10-11" > "$SYSFS_AGG_DIR/new_device"
+CHIPNAME=$(agg_configfs_chip_name _sysfs.0)
+test "$(cat "$CONFIGFS_AGG_DIR/_sysfs.0/live")" = 1 || fail "chip unexpectedly dead"
+test "$(agg_get_chip_label _sysfs.0)" = "$(agg_configfs_dev_name _sysfs.0)" || \
+	fail "label is inconsistent"
+test "$(agg_get_chip_num_lines _sysfs.0)" = "3" || fail "number of lines is not 3"
+test "$(agg_get_line_name _sysfs.0 0)" = "" || fail "line name is unset"
+test "$(agg_get_line_name _sysfs.0 1)" = "" || fail "line name is unset"
+test "$(agg_get_line_name _sysfs.0 2)" = "" || fail "line name is unset"
+echo "$(agg_configfs_dev_name _sysfs.0)" > "$SYSFS_AGG_DIR/delete_device"
+test -d $CONFIGFS_AGG_DIR/_sysfs.0 && fail "_sysfs.0 unexpectedly remains"
+test -d/dev/${CHIPNAME} && fail "/dev/${CHIPNAME} unexpectedly remains"
+
+echo "1.2.3. Asynchronous creation with deferred probe"
+sim_disable_chip  chip0
+echo 'chip0_bank0 0' > $SYSFS_AGG_DIR/new_device
+sleep 1
+test "$(cat "$CONFIGFS_AGG_DIR/_sysfs.0/live")" = 0 || fail "chip unexpectedly alive"
+sim_enable_chip  chip0
+sleep 1
+CHIPNAME=$(agg_configfs_chip_name _sysfs.0)
+test "$(cat "$CONFIGFS_AGG_DIR/_sysfs.0/live")" = 1 || fail "chip unexpectedly remains dead"
+test "$(agg_get_chip_label _sysfs.0)" = "$(agg_configfs_dev_name _sysfs.0)" || \
+	fail "label is inconsistent"
+test "$(agg_get_chip_num_lines _sysfs.0)" = "1" || fail "number of lines is not 1"
+test "$(agg_get_line_name _sysfs.0 0)" = "" || fail "line name unexpectedly set"
+echo "$(agg_configfs_dev_name _sysfs.0)" > "$SYSFS_AGG_DIR/delete_device"
+test -d $CONFIGFS_AGG_DIR/_sysfs.0 && fail "_sysfs.0 unexpectedly remains"
+test -d/dev/${CHIPNAME} && fail "/dev/${CHIPNAME} unexpectedly remains"
+
+echo "1.2.4. Can't instantiate a chip with invalid configuration"
+echo "xyz 0" > "$SYSFS_AGG_DIR/new_device"
+test "$(cat $CONFIGFS_AGG_DIR/_sysfs.0/live)" = 0 || fail "chip unexpectedly alive"
+echo "$(agg_configfs_dev_name _sysfs.0)" > "$SYSFS_AGG_DIR/delete_device"
+
+echo "2. GPIO aggregator configuration"
+
+echo "2.1. Configuring aggregators instantiated via configfs"
+setup_2_1() {
+	agg_create_chip   agg0
+	agg_create_line   agg0 line0
+	agg_create_line   agg0 line1
+	agg_set_key       agg0 line0 "$(sim_get_chip_label chip0 bank0)"
+	agg_set_key       agg0 line1 "$(sim_get_chip_label chip1 bank0)"
+	agg_set_offset    agg0 line0 1
+	agg_set_offset    agg0 line1 3
+	agg_set_line_name agg0 line0 test0
+	agg_set_line_name agg0 line1 test1
+	agg_enable_chip   agg0
+}
+teardown_2_1() {
+	agg_configfs_cleanup
+}
+
+echo "2.1.1. While offline"
+
+echo "2.1.1.1. Line can be added/removed"
+setup_2_1
+agg_disable_chip  agg0
+agg_create_line   agg0 line2
+agg_set_key       agg0 line2 "$(sim_get_chip_label chip0 bank1)"
+agg_set_offset    agg0 line2 5
+agg_enable_chip   agg0
+test "$(agg_get_chip_num_lines agg0)" = "3" || fail "number of lines is not 1"
+teardown_2_1
+
+echo "2.1.1.2. Line key can be modified"
+setup_2_1
+agg_disable_chip  agg0
+agg_set_key       agg0 line0 "$(sim_get_chip_label chip0 bank1)"
+agg_set_key       agg0 line1 "$(sim_get_chip_label chip1 bank1)"
+agg_enable_chip   agg0
+teardown_2_1
+
+echo "2.1.1.3. Line name can be modified"
+setup_2_1
+agg_disable_chip  agg0
+agg_set_line_name agg0 line0 new0
+agg_set_line_name agg0 line1 new1
+agg_enable_chip   agg0
+test "$(agg_get_line_name agg0 0)" = "new0" || fail "line name is unset"
+test "$(agg_get_line_name agg0 1)" = "new1" || fail "line name is unset"
+teardown_2_1
+
+echo "2.1.1.4. Line offset can be modified"
+setup_2_1
+agg_disable_chip  agg0
+agg_set_offset    agg0 line0 5
+agg_set_offset    agg0 line1 7
+agg_enable_chip   agg0
+teardown_2_1
+
+echo "2.1.1.5. Can re-enable a chip after valid reconfiguration"
+setup_2_1
+agg_disable_chip  agg0
+agg_set_key       agg0 line0 "$(sim_get_chip_label chip1 bank1)"
+agg_set_offset    agg0 line0 15
+agg_set_key       agg0 line1 "$(sim_get_chip_label chip0 bank1)"
+agg_set_offset    agg0 line0 14
+agg_create_line   agg0 line2
+agg_set_key       agg0 line2 "$(sim_get_chip_label chip0 bank1)"
+agg_set_offset    agg0 line2 13
+agg_enable_chip   agg0
+test "$(agg_get_chip_num_lines agg0)" = "3" || fail "number of lines is not 1"
+teardown_2_1
+
+echo "2.1.1.7. Can't re-enable a chip with invalid reconfiguration"
+setup_2_1
+agg_disable_chip  agg0
+agg_set_key       agg0 line0 invalidkey
+echo 1 > "$CONFIGFS_AGG_DIR/agg0/live" 2> /dev/null && fail "chip unexpectedly enabled"
+teardown_2_1
+setup_2_1
+agg_disable_chip  agg0
+agg_set_offset    agg0 line0 99
+echo 1 > "$CONFIGFS_AGG_DIR/agg0/live" 2> /dev/null && fail "chip unexpectedly enabled"
+teardown_2_1
+
+echo "2.1.2. While online"
+
+echo "2.1.2.1. Can't add/remove line"
+setup_2_1
+mkdir "$CONFIGFS_AGG_DIR/agg0/line2" 2> /dev/null && fail "line unexpectedly added"
+rmdir "$CONFIGFS_AGG_DIR/agg0/line1" 2> /dev/null && fail "line unexpectedly removed"
+teardown_2_1
+
+echo "2.1.2.2. Can't modify line key"
+setup_2_1
+echo "chip1_bank1" > "$CONFIGFS_AGG_DIR/agg0/line0/key" 2> /dev/null && \
+	fail "lookup key unexpectedly updated"
+teardown_2_1
+
+echo "2.1.2.3. Can't modify line name"
+setup_2_1
+echo "new0" > "$CONFIGFS_AGG_DIR/agg0/line0/name" 2> /dev/null && \
+	fail "name unexpectedly updated"
+teardown_2_1
+
+echo "2.1.2.4. Can't modify line offset"
+setup_2_1
+echo "5" > "$CONFIGFS_AGG_DIR/agg0/line0/offset" 2> /dev/null && \
+	fail "offset unexpectedly updated"
+teardown_2_1
+
+echo "2.2. Configuring aggregators instantiated via sysfs"
+setup_2_2() {
+	echo "chip0_bank0 1 chip1_bank0 3" > "$SYSFS_AGG_DIR/new_device"
+}
+teardown_2_2() {
+	echo "$(agg_configfs_dev_name _sysfs.0)" > "$SYSFS_AGG_DIR/delete_device"
+}
+
+echo "2.2.1. While online"
+
+echo "2.2.1.1. Can toggle live"
+setup_2_2
+agg_disable_chip  _sysfs.0
+agg_enable_chip   _sysfs.0
+teardown_2_2
+
+echo "2.2.1.2. Can't add/remove line"
+setup_2_2
+mkdir "$CONFIGFS_AGG_DIR/_sysfs.0/line2" 2> /dev/null && fail "line unexpectedly added"
+rmdir "$CONFIGFS_AGG_DIR/_sysfs.0/line1" 2> /dev/null && fail "line unexpectedly removed"
+teardown_2_2
+
+echo "2.2.1.3. Can't modify line key"
+setup_2_2
+echo "chip1_bank1" > "$CONFIGFS_AGG_DIR/_sysfs.0/line0/key" 2> /dev/null && \
+	fail "lookup key unexpectedly updated"
+teardown_2_2
+
+echo "2.2.1.4. Can't modify line name"
+setup_2_2
+echo "new0" > "$CONFIGFS_AGG_DIR/_sysfs.0/line0/name" 2> /dev/null && \
+	fail "name unexpectedly updated"
+teardown_2_2
+
+echo "2.2.1.5. Can't modify line offset"
+setup_2_2
+echo "5" > "$CONFIGFS_AGG_DIR/_sysfs.0/line0/offset" 2> /dev/null && \
+	fail "offset unexpectedly updated"
+teardown_2_2
+
+echo "2.2.2. While waiting for deferred probe"
+
+echo "2.2.2.1. Can't add/remove line despite live = 0"
+sim_disable_chip chip0
+setup_2_2
+mkdir "$CONFIGFS_AGG_DIR/_sysfs.0/line2" 2> /dev/null && fail "line unexpectedly added"
+rmdir "$CONFIGFS_AGG_DIR/_sysfs.0/line1" 2> /dev/null && fail "line unexpectedly removed"
+teardown_2_2
+sim_enable_chip chip0
+
+echo "2.2.2.2. Can't modify line key"
+sim_disable_chip chip0
+setup_2_2
+echo "chip1_bank1" > "$CONFIGFS_AGG_DIR/_sysfs.0/line0/key" 2> /dev/null && \
+	fail "lookup key unexpectedly updated"
+teardown_2_2
+sim_enable_chip chip0
+
+echo "2.2.2.3. Can't modify line name"
+sim_disable_chip chip0
+setup_2_2
+echo "new0" > "$CONFIGFS_AGG_DIR/_sysfs.0/line0/name" 2> /dev/null && \
+	fail "name unexpectedly updated"
+teardown_2_2
+sim_enable_chip chip0
+
+echo "2.2.2.4. Can't modify line offset"
+sim_disable_chip chip0
+setup_2_2
+echo 5 > "$CONFIGFS_AGG_DIR/_sysfs.0/line0/offset" 2> /dev/null && \
+	fail "offset unexpectedly updated"
+teardown_2_2
+sim_enable_chip chip0
+
+echo "2.2.2.5. Can't toggle live"
+sim_disable_chip chip0
+setup_2_2
+test "$(cat "$CONFIGFS_AGG_DIR/_sysfs.0/live")" = 0 || fail "chip unexpectedly alive"
+echo 1 > "$CONFIGFS_AGG_DIR/_sysfs.0/live" 2> /dev/null && fail "chip unexpectedly enabled"
+teardown_2_2
+sim_enable_chip chip0
+
+echo "2.2.3. While offline"
+
+echo "2.2.3.1. Can't add/remove line despite live = 0"
+setup_2_2
+agg_disable_chip _sysfs.0
+mkdir "$CONFIGFS_AGG_DIR/_sysfs.0/line2" 2> /dev/null && fail "line unexpectedly added"
+rmdir "$CONFIGFS_AGG_DIR/_sysfs.0/line1" 2> /dev/null && fail "line unexpectedly removed"
+teardown_2_2
+
+echo "2.2.3.2. Line key can be modified"
+setup_2_2
+agg_disable_chip  _sysfs.0
+agg_set_key       _sysfs.0 line0 "$(sim_get_chip_label chip0 bank1)"
+agg_set_key       _sysfs.0 line1 "$(sim_get_chip_label chip1 bank1)"
+agg_enable_chip   _sysfs.0
+teardown_2_2
+
+echo "2.2.3.3. Line name can be modified"
+setup_2_2
+agg_disable_chip  _sysfs.0
+agg_set_line_name _sysfs.0 line0 new0
+agg_set_line_name _sysfs.0 line1 new1
+agg_enable_chip   _sysfs.0
+test "$(agg_get_line_name _sysfs.0 0)" = "new0" || fail "line name is unset"
+test "$(agg_get_line_name _sysfs.0 1)" = "new1" || fail "line name is unset"
+teardown_2_2
+
+echo "2.2.3.4. Line offset can be modified"
+setup_2_2
+agg_disable_chip  _sysfs.0
+agg_set_offset    _sysfs.0 line0 5
+agg_set_offset    _sysfs.0 line1 7
+agg_enable_chip   _sysfs.0
+teardown_2_2
+
+echo "2.2.3.5. Can re-enable a chip with valid reconfiguration"
+setup_2_2
+agg_disable_chip  _sysfs.0
+agg_set_key       _sysfs.0 line0 "$(sim_get_chip_label chip1 bank1)"
+agg_set_offset    _sysfs.0 line0 15
+agg_set_key       _sysfs.0 line1 "$(sim_get_chip_label chip0 bank1)"
+agg_set_offset    _sysfs.0 line0 14
+agg_enable_chip   _sysfs.0
+teardown_2_2
+
+echo "2.2.3.6. Can't re-enable a chip with invalid reconfiguration"
+setup_2_2
+agg_disable_chip  _sysfs.0
+agg_set_key       _sysfs.0 line0 invalidkey
+echo 1 > "$CONFIGFS_AGG_DIR/_sysfs.0/live" 2> /dev/null && fail "chip unexpectedly enabled"
+teardown_2_2
+setup_2_2
+agg_disable_chip  _sysfs.0
+agg_set_offset    _sysfs.0 line0 99
+echo 1 > "$CONFIGFS_AGG_DIR/_sysfs.0/live" 2> /dev/null && fail "chip unexpectedly enabled"
+teardown_2_2
+
+echo "3. Module unload"
+
+echo "3.1. Can't unload module if there is at least one device created via configfs"
+agg_create_chip agg0
+modprobe -r gpio-aggregator 2> /dev/null
+test -d /sys/module/gpio_aggregator || fail "module unexpectedly unloaded"
+agg_remove_chip agg0
+
+echo "3.2. Can unload module if there is no device created via configfs"
+echo "chip0_bank0 1 chip1_bank0 3" > "$SYSFS_AGG_DIR/new_device"
+modprobe -r gpio-aggregator 2> /dev/null
+test -d /sys/module/gpio_aggregator && fail "module unexpectedly remains to be loaded"
+modprobe gpio-aggregator 2> /dev/null
+
+echo "4. GPIO forwarder functional"
+SETTINGS="chip0:bank0:2 chip0:bank1:4 chip1:bank0:6 chip1:bank1:8"
+setup_4() {
+	local OFFSET=0
+	agg_create_chip agg0
+	for SETTING in $SETTINGS; do
+		CHIP=$(echo "$SETTING" | cut -d: -f1)
+		BANK=$(echo "$SETTING" | cut -d: -f2)
+		LINE=$(echo "$SETTING" | cut -d: -f3)
+		agg_create_line agg0 "line${OFFSET}"
+		agg_set_key     agg0 "line${OFFSET}" "$(sim_get_chip_label "$CHIP" "$BANK")"
+		agg_set_offset  agg0 "line${OFFSET}" "$LINE"
+		OFFSET=$(expr $OFFSET + 1)
+	done
+	agg_enable_chip agg0
+}
+teardown_4() {
+	agg_configfs_cleanup
+}
+
+echo "4.1. Forwarding set values"
+setup_4
+OFFSET=0
+for SETTING in $SETTINGS; do
+	CHIP=$(echo "$SETTING" | cut -d: -f1)
+	BANK=$(echo "$SETTING" | cut -d: -f2)
+	LINE=$(echo "$SETTING" | cut -d: -f3)
+	DEVNAME=$(cat "$CONFIGFS_SIM_DIR/$CHIP/dev_name")
+	CHIPNAME=$(cat "$CONFIGFS_SIM_DIR/$CHIP/$BANK/chip_name")
+	VAL_PATH="/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio${LINE}/value"
+	test $(cat $VAL_PATH) = "0" || fail "incorrect value read from sysfs"
+	$BASE_DIR/gpio-mockup-cdev -s 1 "/dev/$(agg_configfs_chip_name agg0)" "$OFFSET" &
+	mock_pid=$!
+	sleep 0.1 # FIXME Any better way?
+	test "$(cat $VAL_PATH)" = "1" || fail "incorrect value read from sysfs"
+	kill "$mock_pid"
+	OFFSET=$(expr $OFFSET + 1)
+done
+teardown_4
+
+echo "4.2. Forwarding set config"
+setup_4
+OFFSET=0
+for SETTING in $SETTINGS; do
+	CHIP=$(echo "$SETTING" | cut -d: -f1)
+	BANK=$(echo "$SETTING" | cut -d: -f2)
+	LINE=$(echo "$SETTING" | cut -d: -f3)
+	DEVNAME=$(cat "$CONFIGFS_SIM_DIR/$CHIP/dev_name")
+	CHIPNAME=$(cat "$CONFIGFS_SIM_DIR/$CHIP/$BANK/chip_name")
+	VAL_PATH="/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio${LINE}/value"
+	$BASE_DIR/gpio-mockup-cdev -b pull-up "/dev/$(agg_configfs_chip_name agg0)" "$OFFSET"
+	test $(cat "$VAL_PATH") = "1" || fail "incorrect value read from sysfs"
+	OFFSET=$(expr $OFFSET + 1)
+done
+teardown_4
+
+echo "5. Race condition verification"
+
+echo "5.1. Stress test of new_device/delete_device and module load/unload"
+for _ in $(seq 1000); do
+	{
+		echo "dummy 0" > "$SYSFS_AGG_DIR/new_device"
+		cat "$CONFIGFS_AGG_DIR/_sysfs.0/dev_name" > "$SYSFS_AGG_DIR/delete_device"
+	} 2> /dev/null
+done &
+writer_pid=$!
+while kill -0 "$writer_pid" 2> /dev/null; do
+	{
+		modprobe gpio-aggregator
+		modprobe -r gpio-aggregator
+	} 2> /dev/null
+done
+
+echo "GPIO $MODULE test PASS"
--- linux-qcom-6.8.0.orig/tools/testing/selftests/hid/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/hid/Makefile
@@ -17,6 +17,9 @@
 TEST_PROGS += hid-usb_crash.sh
 TEST_PROGS += hid-wacom.sh
 
+TEST_FILES := run-hid-tools-tests.sh
+TEST_FILES += tests
+
 CXX ?= $(CROSS_COMPILE)g++
 
 HOSTPKG_CONFIG := pkg-config
--- linux-qcom-6.8.0.orig/tools/testing/selftests/hid/run-hid-tools-tests.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/hid/run-hid-tools-tests.sh
@@ -2,24 +2,26 @@
 # SPDX-License-Identifier: GPL-2.0
 # Runs tests for the HID subsystem
 
+KSELFTEST_SKIP_TEST=4
+
 if ! command -v python3 > /dev/null 2>&1; then
 	echo "hid-tools: [SKIP] python3 not installed"
-	exit 77
+	exit $KSELFTEST_SKIP_TEST
 fi
 
 if ! python3 -c "import pytest" > /dev/null 2>&1; then
-	echo "hid: [SKIP/ pytest module not installed"
-	exit 77
+	echo "hid: [SKIP] pytest module not installed"
+	exit $KSELFTEST_SKIP_TEST
 fi
 
 if ! python3 -c "import pytest_tap" > /dev/null 2>&1; then
-	echo "hid: [SKIP/ pytest_tap module not installed"
-	exit 77
+	echo "hid: [SKIP] pytest_tap module not installed"
+	exit $KSELFTEST_SKIP_TEST
 fi
 
 if ! python3 -c "import hidtools" > /dev/null 2>&1; then
-	echo "hid: [SKIP/ hid-tools module not installed"
-	exit 77
+	echo "hid: [SKIP] hid-tools module not installed"
+	exit $KSELFTEST_SKIP_TEST
 fi
 
 TARGET=${TARGET:=.}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/iommu/config
+++ linux-qcom-6.8.0/tools/testing/selftests/iommu/config
@@ -1,3 +1,5 @@
 CONFIG_IOMMUFD=y
+CONFIG_FAULT_INJECTION_DEBUG_FS=y
 CONFIG_FAULT_INJECTION=y
 CONFIG_IOMMUFD_TEST=y
+CONFIG_FAILSLAB=y
--- linux-qcom-6.8.0.orig/tools/testing/selftests/iommu/iommufd.c
+++ linux-qcom-6.8.0/tools/testing/selftests/iommu/iommufd.c
@@ -803,7 +803,7 @@
 {
 	struct iommu_ioas_copy copy_cmd = {
 		.size = sizeof(copy_cmd),
-		.flags = IOMMU_IOAS_MAP_FIXED_IOVA,
+		.flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE,
 		.dst_ioas_id = self->ioas_id,
 		.src_ioas_id = self->ioas_id,
 		.length = PAGE_SIZE,
@@ -1296,7 +1296,7 @@
 {
 	struct iommu_ioas_copy copy_cmd = {
 		.size = sizeof(copy_cmd),
-		.flags = IOMMU_IOAS_MAP_FIXED_IOVA,
+		.flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE,
 		.src_ioas_id = self->ioas_id,
 		.dst_iova = MOCK_APERTURE_START,
 		.length = MOCK_PAGE_SIZE,
@@ -1586,7 +1586,7 @@
 	};
 	struct iommu_ioas_copy copy_cmd = {
 		.size = sizeof(copy_cmd),
-		.flags = IOMMU_IOAS_MAP_FIXED_IOVA,
+		.flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE,
 		.dst_ioas_id = self->ioas_id,
 		.dst_iova = MOCK_APERTURE_START,
 		.length = BUFFER_SIZE,
@@ -1722,10 +1722,17 @@
 
 FIXTURE_SETUP(iommufd_dirty_tracking)
 {
+	unsigned long size;
 	int mmap_flags;
 	void *vrc;
 	int rc;
 
+	if (variant->buffer_size < MOCK_PAGE_SIZE) {
+		SKIP(return,
+		     "Skipping buffer_size=%lu, less than MOCK_PAGE_SIZE=%lu",
+		     variant->buffer_size, MOCK_PAGE_SIZE);
+	}
+
 	self->fd = open("/dev/iommu", O_RDWR);
 	ASSERT_NE(-1, self->fd);
 
@@ -1749,12 +1756,11 @@
 	assert(vrc == self->buffer);
 
 	self->page_size = MOCK_PAGE_SIZE;
-	self->bitmap_size =
-		variant->buffer_size / self->page_size / BITS_PER_BYTE;
+	self->bitmap_size = variant->buffer_size / self->page_size;
 
 	/* Provision with an extra (PAGE_SIZE) for the unaligned case */
-	rc = posix_memalign(&self->bitmap, PAGE_SIZE,
-			    self->bitmap_size + PAGE_SIZE);
+	size = DIV_ROUND_UP(self->bitmap_size, BITS_PER_BYTE);
+	rc = posix_memalign(&self->bitmap, PAGE_SIZE, size + PAGE_SIZE);
 	assert(!rc);
 	assert(self->bitmap);
 	assert((uintptr_t)self->bitmap % PAGE_SIZE == 0);
@@ -1775,51 +1781,63 @@
 FIXTURE_TEARDOWN(iommufd_dirty_tracking)
 {
 	munmap(self->buffer, variant->buffer_size);
-	munmap(self->bitmap, self->bitmap_size);
+	munmap(self->bitmap, DIV_ROUND_UP(self->bitmap_size, BITS_PER_BYTE));
 	teardown_iommufd(self->fd, _metadata);
 }
 
-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128k)
+FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty8k)
+{
+	/* half of an u8 index bitmap */
+	.buffer_size = 8UL * 1024UL,
+};
+
+FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty16k)
+{
+	/* one u8 index bitmap */
+	.buffer_size = 16UL * 1024UL,
+};
+
+FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty64k)
 {
 	/* one u32 index bitmap */
-	.buffer_size = 128UL * 1024UL,
+	.buffer_size = 64UL * 1024UL,
 };
 
-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty256k)
+FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128k)
 {
 	/* one u64 index bitmap */
-	.buffer_size = 256UL * 1024UL,
+	.buffer_size = 128UL * 1024UL,
 };
 
-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty640k)
+FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty320k)
 {
 	/* two u64 index and trailing end bitmap */
-	.buffer_size = 640UL * 1024UL,
+	.buffer_size = 320UL * 1024UL,
 };
 
-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128M)
+FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty64M)
 {
-	/* 4K bitmap (128M IOVA range) */
-	.buffer_size = 128UL * 1024UL * 1024UL,
+	/* 4K bitmap (64M IOVA range) */
+	.buffer_size = 64UL * 1024UL * 1024UL,
 };
 
-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128M_huge)
+FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty64M_huge)
 {
-	/* 4K bitmap (128M IOVA range) */
-	.buffer_size = 128UL * 1024UL * 1024UL,
+	/* 4K bitmap (64M IOVA range) */
+	.buffer_size = 64UL * 1024UL * 1024UL,
 	.hugepages = true,
 };
 
-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty256M)
+FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128M)
 {
-	/* 8K bitmap (256M IOVA range) */
-	.buffer_size = 256UL * 1024UL * 1024UL,
+	/* 8K bitmap (128M IOVA range) */
+	.buffer_size = 128UL * 1024UL * 1024UL,
 };
 
-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty256M_huge)
+FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128M_huge)
 {
-	/* 8K bitmap (256M IOVA range) */
-	.buffer_size = 256UL * 1024UL * 1024UL,
+	/* 8K bitmap (128M IOVA range) */
+	.buffer_size = 128UL * 1024UL * 1024UL,
 	.hugepages = true,
 };
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/iommu/iommufd_utils.h
+++ linux-qcom-6.8.0/tools/testing/selftests/iommu/iommufd_utils.h
@@ -22,6 +22,8 @@
 #define BIT_MASK(nr) (1UL << ((nr) % __BITS_PER_LONG))
 #define BIT_WORD(nr) ((nr) / __BITS_PER_LONG)
 
+#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
+
 static inline void set_bit(unsigned int nr, unsigned long *addr)
 {
 	unsigned long mask = BIT_MASK(nr);
@@ -346,12 +348,12 @@
 static int _test_mock_dirty_bitmaps(int fd, __u32 hwpt_id, size_t length,
 				    __u64 iova, size_t page_size,
 				    size_t pte_page_size, __u64 *bitmap,
-				    __u64 bitmap_size, __u32 flags,
+				    __u64 nbits, __u32 flags,
 				    struct __test_metadata *_metadata)
 {
 	unsigned long npte = pte_page_size / page_size, pteset = 2 * npte;
-	unsigned long nbits = bitmap_size * BITS_PER_BYTE;
 	unsigned long j, i, nr = nbits / pteset ?: 1;
+	unsigned long bitmap_size = DIV_ROUND_UP(nbits, BITS_PER_BYTE);
 	__u64 out_dirty = 0;
 
 	/* Mark all even bits as dirty in the mock domain */
--- linux-qcom-6.8.0.orig/tools/testing/selftests/kcmp/kcmp_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/kcmp/kcmp_test.c
@@ -91,7 +91,7 @@
 		ksft_print_header();
 		ksft_set_plan(3);
 
-		fd2 = open(kpath, O_RDWR, 0644);
+		fd2 = open(kpath, O_RDWR);
 		if (fd2 < 0) {
 			perror("Can't open file");
 			ksft_exit_fail();
--- linux-qcom-6.8.0.orig/tools/testing/selftests/kselftest.h
+++ linux-qcom-6.8.0/tools/testing/selftests/kselftest.h
@@ -50,6 +50,7 @@
 #include <stdarg.h>
 #include <string.h>
 #include <stdio.h>
+#include <sys/utsname.h>
 #endif
 
 #ifndef ARRAY_SIZE
@@ -78,6 +79,9 @@
 #define KSFT_XPASS 3
 #define KSFT_SKIP  4
 
+#ifndef __noreturn
+#define __noreturn       __attribute__((__noreturn__))
+#endif
 #define __printf(a, b)   __attribute__((format(printf, a, b)))
 
 /* counters */
@@ -254,13 +258,13 @@
 	va_end(args);
 }
 
-static inline int ksft_exit_pass(void)
+static inline __noreturn int ksft_exit_pass(void)
 {
 	ksft_print_cnts();
 	exit(KSFT_PASS);
 }
 
-static inline int ksft_exit_fail(void)
+static inline __noreturn int ksft_exit_fail(void)
 {
 	ksft_print_cnts();
 	exit(KSFT_FAIL);
@@ -287,7 +291,7 @@
 		  ksft_cnt.ksft_xfail +	\
 		  ksft_cnt.ksft_xskip)
 
-static inline __printf(1, 2) int ksft_exit_fail_msg(const char *msg, ...)
+static inline __noreturn __printf(1, 2) int ksft_exit_fail_msg(const char *msg, ...)
 {
 	int saved_errno = errno;
 	va_list args;
@@ -302,19 +306,19 @@
 	exit(KSFT_FAIL);
 }
 
-static inline int ksft_exit_xfail(void)
+static inline __noreturn int ksft_exit_xfail(void)
 {
 	ksft_print_cnts();
 	exit(KSFT_XFAIL);
 }
 
-static inline int ksft_exit_xpass(void)
+static inline __noreturn int ksft_exit_xpass(void)
 {
 	ksft_print_cnts();
 	exit(KSFT_XPASS);
 }
 
-static inline __printf(1, 2) int ksft_exit_skip(const char *msg, ...)
+static inline __noreturn __printf(1, 2) int ksft_exit_skip(const char *msg, ...)
 {
 	int saved_errno = errno;
 	va_list args;
@@ -343,4 +347,21 @@
 	exit(KSFT_SKIP);
 }
 
+static inline int ksft_min_kernel_version(unsigned int min_major,
+					  unsigned int min_minor)
+{
+#ifdef NOLIBC
+	ksft_print_msg("NOLIBC: Can't check kernel version: Function not implemented\n");
+	return 0;
+#else
+	unsigned int major, minor;
+	struct utsname info;
+
+	if (uname(&info) || sscanf(info.release, "%u.%u.", &major, &minor) != 2)
+		ksft_exit_fail_msg("Can't parse kernel version\n");
+
+	return major > min_major || (major == min_major && minor >= min_minor);
+#endif
+}
+
 #endif /* __KSELFTEST_H */
--- linux-qcom-6.8.0.orig/tools/testing/selftests/kselftest/runner.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/kselftest/runner.sh
@@ -36,7 +36,7 @@
 tap_timeout()
 {
 	# Make sure tests will time out if utility is available.
-	if [ -x /usr/bin/timeout ] ; then
+	if [ -x /usr/bin/timeout ] && [ $kselftest_timeout -gt 0 ] ; then
 		/usr/bin/timeout --foreground "$kselftest_timeout" \
 			/usr/bin/timeout "$kselftest_timeout" $1
 	else
--- linux-qcom-6.8.0.orig/tools/testing/selftests/kvm/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/kvm/Makefile
@@ -220,10 +220,10 @@
 	-Wno-gnu-variable-sized-type-not-at-end -MD -MP \
 	-fno-builtin-memcmp -fno-builtin-memcpy -fno-builtin-memset \
 	-fno-builtin-strnlen \
-	-fno-stack-protector -fno-PIE -I$(LINUX_TOOL_INCLUDE) \
-	-I$(LINUX_TOOL_ARCH_INCLUDE) -I$(LINUX_HDR_PATH) -Iinclude \
-	-I$(<D) -Iinclude/$(ARCH_DIR) -I ../rseq -I.. $(EXTRA_CFLAGS) \
-	$(KHDR_INCLUDES)
+	-fno-stack-protector -fno-PIE -fno-strict-aliasing \
+	-I$(LINUX_TOOL_INCLUDE) -I$(LINUX_TOOL_ARCH_INCLUDE) \
+	-I$(LINUX_HDR_PATH) -Iinclude -I$(<D) -Iinclude/$(ARCH_DIR) \
+	-I ../rseq -I.. $(EXTRA_CFLAGS) $(KHDR_INCLUDES)
 ifeq ($(ARCH),s390)
 	CFLAGS += -march=z10
 endif
--- linux-qcom-6.8.0.orig/tools/testing/selftests/kvm/aarch64/set_id_regs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/kvm/aarch64/set_id_regs.c
@@ -138,7 +138,6 @@
 	REG_FTR_BITS(FTR_LOWER_SAFE, ID_AA64MMFR0_EL1, BIGENDEL0, 0),
 	REG_FTR_BITS(FTR_LOWER_SAFE, ID_AA64MMFR0_EL1, SNSMEM, 0),
 	REG_FTR_BITS(FTR_LOWER_SAFE, ID_AA64MMFR0_EL1, BIGEND, 0),
-	REG_FTR_BITS(FTR_LOWER_SAFE, ID_AA64MMFR0_EL1, ASIDBITS, 0),
 	REG_FTR_BITS(FTR_LOWER_SAFE, ID_AA64MMFR0_EL1, PARANGE, 0),
 	REG_FTR_END,
 };
--- linux-qcom-6.8.0.orig/tools/testing/selftests/kvm/aarch64/vgic_init.c
+++ linux-qcom-6.8.0/tools/testing/selftests/kvm/aarch64/vgic_init.c
@@ -84,6 +84,18 @@
 	return v;
 }
 
+static struct vm_gic vm_gic_create_barebones(uint32_t gic_dev_type)
+{
+	struct vm_gic v;
+
+	v.gic_dev_type = gic_dev_type;
+	v.vm = vm_create_barebones();
+	v.gic_fd = kvm_create_device(v.vm, gic_dev_type);
+
+	return v;
+}
+
+
 static void vm_gic_destroy(struct vm_gic *v)
 {
 	close(v->gic_fd);
@@ -357,6 +369,40 @@
 	vm_gic_destroy(&v);
 }
 
+#define KVM_VGIC_V2_ATTR(offset, cpu) \
+	(FIELD_PREP(KVM_DEV_ARM_VGIC_OFFSET_MASK, offset) | \
+	 FIELD_PREP(KVM_DEV_ARM_VGIC_CPUID_MASK, cpu))
+
+#define GIC_CPU_CTRL	0x00
+
+static void test_v2_uaccess_cpuif_no_vcpus(void)
+{
+	struct vm_gic v;
+	u64 val = 0;
+	int ret;
+
+	v = vm_gic_create_barebones(KVM_DEV_TYPE_ARM_VGIC_V2);
+	subtest_dist_rdist(&v);
+
+	ret = __kvm_has_device_attr(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
+				    KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0));
+	TEST_ASSERT(ret && errno == EINVAL,
+		    "accessed non-existent CPU interface, want errno: %i",
+		    EINVAL);
+	ret = __kvm_device_attr_get(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
+				    KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0), &val);
+	TEST_ASSERT(ret && errno == EINVAL,
+		    "accessed non-existent CPU interface, want errno: %i",
+		    EINVAL);
+	ret = __kvm_device_attr_set(v.gic_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
+				    KVM_VGIC_V2_ATTR(GIC_CPU_CTRL, 0), &val);
+	TEST_ASSERT(ret && errno == EINVAL,
+		    "accessed non-existent CPU interface, want errno: %i",
+		    EINVAL);
+
+	vm_gic_destroy(&v);
+}
+
 static void test_v3_new_redist_regions(void)
 {
 	struct kvm_vcpu *vcpus[NR_VCPUS];
@@ -675,6 +721,9 @@
 	test_vcpus_then_vgic(gic_dev_type);
 	test_vgic_then_vcpus(gic_dev_type);
 
+	if (VGIC_DEV_IS_V2(gic_dev_type))
+		test_v2_uaccess_cpuif_no_vcpus();
+
 	if (VGIC_DEV_IS_V3(gic_dev_type)) {
 		test_v3_new_redist_regions();
 		test_v3_typer_accesses();
--- linux-qcom-6.8.0.orig/tools/testing/selftests/landlock/base_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/landlock/base_test.c
@@ -9,6 +9,7 @@
 #define _GNU_SOURCE
 #include <errno.h>
 #include <fcntl.h>
+#include <linux/keyctl.h>
 #include <linux/landlock.h>
 #include <string.h>
 #include <sys/prctl.h>
@@ -326,4 +327,77 @@
 	ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
 }
 
+TEST(cred_transfer)
+{
+	struct landlock_ruleset_attr ruleset_attr = {
+		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,
+	};
+	int ruleset_fd, dir_fd;
+	pid_t child;
+	int status;
+
+	drop_caps(_metadata);
+
+	dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+	EXPECT_LE(0, dir_fd);
+	EXPECT_EQ(0, close(dir_fd));
+
+	/* Denies opening directories. */
+	ruleset_fd =
+		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+	ASSERT_LE(0, ruleset_fd);
+	EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
+	ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0));
+	EXPECT_EQ(0, close(ruleset_fd));
+
+	/* Checks ruleset enforcement. */
+	EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+	EXPECT_EQ(EACCES, errno);
+
+	/* Needed for KEYCTL_SESSION_TO_PARENT permission checks */
+	EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING, NULL, 0,
+			      0, 0))
+	{
+		TH_LOG("Failed to join session keyring: %s", strerror(errno));
+	}
+
+	child = fork();
+	ASSERT_LE(0, child);
+	if (child == 0) {
+		/* Checks ruleset enforcement. */
+		EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+		EXPECT_EQ(EACCES, errno);
+
+		/*
+		 * KEYCTL_SESSION_TO_PARENT is a no-op unless we have a
+		 * different session keyring in the child, so make that happen.
+		 */
+		EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING,
+				      NULL, 0, 0, 0));
+
+		/*
+		 * KEYCTL_SESSION_TO_PARENT installs credentials on the parent
+		 * that never go through the cred_prepare hook, this path uses
+		 * cred_transfer instead.
+		 */
+		EXPECT_EQ(0, syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT, 0,
+				     0, 0, 0));
+
+		/* Re-checks ruleset enforcement. */
+		EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+		EXPECT_EQ(EACCES, errno);
+
+		_exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
+		return;
+	}
+
+	EXPECT_EQ(child, waitpid(child, &status, 0));
+	EXPECT_EQ(1, WIFEXITED(status));
+	EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
+
+	/* Re-checks ruleset enforcement. */
+	EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+	EXPECT_EQ(EACCES, errno);
+}
+
 TEST_HARNESS_MAIN
--- linux-qcom-6.8.0.orig/tools/testing/selftests/landlock/config
+++ linux-qcom-6.8.0/tools/testing/selftests/landlock/config
@@ -1,5 +1,6 @@
 CONFIG_CGROUPS=y
 CONFIG_CGROUP_SCHED=y
+CONFIG_KEYS=y
 CONFIG_INET=y
 CONFIG_IPV6=y
 CONFIG_NET=y
--- linux-qcom-6.8.0.orig/tools/testing/selftests/lib.mk
+++ linux-qcom-6.8.0/tools/testing/selftests/lib.mk
@@ -7,6 +7,8 @@
 LLVM_SUFFIX := $(LLVM)
 endif
 
+CLANG := $(LLVM_PREFIX)clang$(LLVM_SUFFIX)
+
 CLANG_TARGET_FLAGS_arm          := arm-linux-gnueabi
 CLANG_TARGET_FLAGS_arm64        := aarch64-linux-gnu
 CLANG_TARGET_FLAGS_hexagon      := hexagon-linux-musl
@@ -18,7 +20,13 @@
 CLANG_TARGET_FLAGS_s390         := s390x-linux-gnu
 CLANG_TARGET_FLAGS_x86          := x86_64-linux-gnu
 CLANG_TARGET_FLAGS_x86_64       := x86_64-linux-gnu
-CLANG_TARGET_FLAGS              := $(CLANG_TARGET_FLAGS_$(ARCH))
+
+# Default to host architecture if ARCH is not explicitly given.
+ifeq ($(ARCH),)
+CLANG_TARGET_FLAGS := $(shell $(CLANG) -print-target-triple)
+else
+CLANG_TARGET_FLAGS := $(CLANG_TARGET_FLAGS_$(ARCH))
+endif
 
 ifeq ($(CROSS_COMPILE),)
 ifeq ($(CLANG_TARGET_FLAGS),)
@@ -30,7 +38,7 @@
 CLANG_FLAGS     += --target=$(notdir $(CROSS_COMPILE:%-=%))
 endif # CROSS_COMPILE
 
-CC := $(LLVM_PREFIX)clang$(LLVM_SUFFIX) $(CLANG_FLAGS) -fintegrated-as
+CC := $(CLANG) $(CLANG_FLAGS) -fintegrated-as
 else
 CC := $(CROSS_COMPILE)gcc
 endif # LLVM
@@ -69,11 +77,29 @@
 	run_many $(1)
 endef
 
+define INSTALL_INCLUDES
+	$(if $(TEST_INCLUDES), \
+		relative_files=""; \
+		for entry in $(TEST_INCLUDES); do \
+			entry_dir=$$(readlink -e "$$(dirname "$$entry")"); \
+			entry_name=$$(basename "$$entry"); \
+			relative_dir=$${entry_dir#"$$SRC_PATH"/}; \
+			if [ "$$relative_dir" = "$$entry_dir" ]; then \
+				echo "Error: TEST_INCLUDES entry \"$$entry\" not located inside selftests directory ($$SRC_PATH)" >&2; \
+				exit 1; \
+			fi; \
+			relative_files="$$relative_files $$relative_dir/$$entry_name"; \
+		done; \
+		cd $(SRC_PATH) && rsync -aR $$relative_files $(OBJ_PATH)/ \
+	)
+endef
+
 run_tests: all
 ifdef building_out_of_srctree
 	@if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then \
 		rsync -aq --copy-unsafe-links $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(OUTPUT); \
 	fi
+	@$(INSTALL_INCLUDES)
 	@if [ "X$(TEST_PROGS)" != "X" ]; then \
 		$(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) \
 				  $(addprefix $(OUTPUT)/,$(TEST_PROGS))) ; \
@@ -103,6 +129,7 @@
 install: all
 ifdef INSTALL_PATH
 	$(INSTALL_RULE)
+	$(INSTALL_INCLUDES)
 else
 	$(error Error: set INSTALL_PATH to use install)
 endif
--- linux-qcom-6.8.0.orig/tools/testing/selftests/lsm/common.h
+++ linux-qcom-6.8.0/tools/testing/selftests/lsm/common.h
@@ -7,7 +7,7 @@
 
 #ifndef lsm_get_self_attr
 static inline int lsm_get_self_attr(unsigned int attr, struct lsm_ctx *ctx,
-				    size_t *size, __u32 flags)
+				    __u32 *size, __u32 flags)
 {
 	return syscall(__NR_lsm_get_self_attr, attr, ctx, size, flags);
 }
@@ -15,14 +15,14 @@
 
 #ifndef lsm_set_self_attr
 static inline int lsm_set_self_attr(unsigned int attr, struct lsm_ctx *ctx,
-				    size_t size, __u32 flags)
+				    __u32 size, __u32 flags)
 {
 	return syscall(__NR_lsm_set_self_attr, attr, ctx, size, flags);
 }
 #endif
 
 #ifndef lsm_list_modules
-static inline int lsm_list_modules(__u64 *ids, size_t *size, __u32 flags)
+static inline int lsm_list_modules(__u64 *ids, __u32 *size, __u32 flags)
 {
 	return syscall(__NR_lsm_list_modules, ids, size, flags);
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/lsm/lsm_get_self_attr_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/lsm/lsm_get_self_attr_test.c
@@ -40,7 +40,7 @@
 TEST(ctx_null_lsm_get_self_attr)
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
-	size_t size = page_size;
+	__u32 size = page_size;
 	int rc;
 
 	rc = lsm_get_self_attr(LSM_ATTR_CURRENT, NULL, &size, 0);
@@ -57,7 +57,7 @@
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
 	struct lsm_ctx *ctx = calloc(page_size, 1);
-	size_t size = 1;
+	__u32 size = 1;
 
 	ASSERT_NE(NULL, ctx);
 	errno = 0;
@@ -77,7 +77,7 @@
 	const long page_size = sysconf(_SC_PAGESIZE);
 	struct lsm_ctx *ctx = calloc(page_size, 1);
 	__u64 *syscall_lsms = calloc(page_size, 1);
-	size_t size;
+	__u32 size;
 	int lsmcount;
 	int i;
 
@@ -117,7 +117,7 @@
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
 	struct lsm_ctx *ctx = calloc(page_size, 1);
-	size_t size;
+	__u32 size;
 
 	ASSERT_NE(NULL, ctx);
 
@@ -140,7 +140,7 @@
 TEST(basic_lsm_get_self_attr)
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
-	size_t size = page_size;
+	__u32 size = page_size;
 	struct lsm_ctx *ctx = calloc(page_size, 1);
 	struct lsm_ctx *tctx = NULL;
 	__u64 *syscall_lsms = calloc(page_size, 1);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/lsm/lsm_list_modules_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/lsm/lsm_list_modules_test.c
@@ -31,7 +31,7 @@
 TEST(ids_null_lsm_list_modules)
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
-	size_t size = page_size;
+	__u32 size = page_size;
 
 	errno = 0;
 	ASSERT_EQ(-1, lsm_list_modules(NULL, &size, 0));
@@ -43,7 +43,7 @@
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
 	__u64 *syscall_lsms = calloc(page_size, 1);
-	size_t size = 1;
+	__u32 size = 1;
 
 	ASSERT_NE(NULL, syscall_lsms);
 	errno = 0;
@@ -58,7 +58,7 @@
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
 	__u64 *syscall_lsms = calloc(page_size, 1);
-	size_t size = page_size;
+	__u32 size = page_size;
 
 	ASSERT_NE(NULL, syscall_lsms);
 	errno = 0;
@@ -72,7 +72,7 @@
 TEST(correct_lsm_list_modules)
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
-	size_t size = page_size;
+	__u32 size = page_size;
 	__u64 *syscall_lsms = calloc(page_size, 1);
 	char *sysfs_lsms = calloc(page_size, 1);
 	char *name;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/lsm/lsm_set_self_attr_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/lsm/lsm_set_self_attr_test.c
@@ -25,7 +25,7 @@
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
 	struct lsm_ctx *ctx = calloc(page_size, 1);
-	size_t size = page_size;
+	__u32 size = page_size;
 
 	ASSERT_NE(NULL, ctx);
 	if (attr_lsm_count()) {
@@ -41,7 +41,7 @@
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
 	struct lsm_ctx *ctx = calloc(page_size, 1);
-	size_t size = page_size;
+	__u32 size = page_size;
 
 	ASSERT_NE(NULL, ctx);
 	if (attr_lsm_count()) {
@@ -57,7 +57,7 @@
 {
 	const long page_size = sysconf(_SC_PAGESIZE);
 	char *ctx = calloc(page_size, 1);
-	size_t size = page_size;
+	__u32 size = page_size;
 	struct lsm_ctx *tctx = (struct lsm_ctx *)ctx;
 
 	ASSERT_NE(NULL, ctx);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/memfd/memfd_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/memfd/memfd_test.c
@@ -9,6 +9,7 @@
 #include <fcntl.h>
 #include <linux/memfd.h>
 #include <sched.h>
+#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <signal.h>
@@ -1567,6 +1568,11 @@
 	close(fd);
 }
 
+static bool pid_ns_supported(void)
+{
+	return access("/proc/self/ns/pid", F_OK) == 0;
+}
+
 int main(int argc, char **argv)
 {
 	pid_t pid;
@@ -1601,8 +1607,12 @@
 	test_seal_grow();
 	test_seal_resize();
 
-	test_sysctl_simple();
-	test_sysctl_nested();
+	if (pid_ns_supported()) {
+		test_sysctl_simple();
+		test_sysctl_nested();
+	} else {
+		printf("PID namespaces are not supported; skipping sysctl tests\n");
+	}
 
 	test_share_dup("SHARE-DUP", "");
 	test_share_mmap("SHARE-MMAP", "");
--- linux-qcom-6.8.0.orig/tools/testing/selftests/memory-hotplug/settings
+++ linux-qcom-6.8.0/tools/testing/selftests/memory-hotplug/settings
@@ -0,0 +1 @@
+timeout=600
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/Makefile
@@ -12,7 +12,7 @@
 else
 uname_M := $(shell echo $(CROSS_COMPILE) | grep -o '^[a-z0-9]\+')
 endif
-ARCH ?= $(shell echo $(uname_M) | sed -e 's/aarch64.*/arm64/' -e 's/ppc64.*/ppc64/')
+ARCH ?= $(shell echo $(uname_M) | sed -e 's/aarch64.*/arm64/' -e 's/ppc64.*/powerpc/')
 endif
 
 # Without this, failed build products remain, with up-to-date timestamps,
@@ -51,7 +51,9 @@
 TEST_GEN_FILES += map_fixed_noreplace
 TEST_GEN_FILES += map_hugetlb
 TEST_GEN_FILES += map_populate
+ifneq (,$(filter $(ARCH),arm64 riscv riscv64 x86 x86_64))
 TEST_GEN_FILES += memfd_secret
+endif
 TEST_GEN_FILES += migration
 TEST_GEN_FILES += mkdirty
 TEST_GEN_FILES += mlock-random-test
@@ -97,13 +99,13 @@
 endif
 else
 
-ifneq (,$(findstring $(ARCH),ppc64))
+ifneq (,$(findstring $(ARCH),powerpc))
 TEST_GEN_FILES += protection_keys
 endif
 
 endif
 
-ifneq (,$(filter $(ARCH),arm64 ia64 mips64 parisc64 ppc64 riscv64 s390x sparc64 x86_64))
+ifneq (,$(filter $(ARCH),arm64 ia64 mips64 parisc64 powerpc riscv64 s390x sparc64 x86_64 s390))
 TEST_GEN_FILES += va_high_addr_switch
 TEST_GEN_FILES += virtual_address_range
 TEST_GEN_FILES += write_to_hugetlbfs
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/charge_reserved_hugetlb.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/charge_reserved_hugetlb.sh
@@ -252,7 +252,7 @@
   local cgroup="$1"
   if [[ "$(pgrep -f write_to_hugetlbfs)" != "" ]]; then
     echo killing write_to_hugetlbfs
-    killall -2 write_to_hugetlbfs
+    killall -2 --wait write_to_hugetlbfs
     wait_for_hugetlb_memory_to_get_depleted $cgroup
   fi
   set -e
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/compaction_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/compaction_test.c
@@ -82,12 +82,16 @@
 	return -1;
 }
 
-int check_compaction(unsigned long mem_free, unsigned int hugepage_size)
+int check_compaction(unsigned long mem_free, unsigned long hugepage_size,
+		     unsigned long initial_nr_hugepages)
 {
+	unsigned long nr_hugepages_ul;
 	int fd, ret = -1;
 	int compaction_index = 0;
-	char initial_nr_hugepages[10] = {0};
-	char nr_hugepages[10] = {0};
+	char nr_hugepages[20] = {0};
+	char init_nr_hugepages[20] = {0};
+
+	sprintf(init_nr_hugepages, "%lu", initial_nr_hugepages);
 
 	/* We want to test with 80% of available memory. Else, OOM killer comes
 	   in to play */
@@ -95,71 +99,99 @@
 
 	fd = open("/proc/sys/vm/nr_hugepages", O_RDWR | O_NONBLOCK);
 	if (fd < 0) {
-		ksft_test_result_fail("Failed to open /proc/sys/vm/nr_hugepages: %s\n",
-				      strerror(errno));
-		return -1;
-	}
-
-	if (read(fd, initial_nr_hugepages, sizeof(initial_nr_hugepages)) <= 0) {
-		ksft_test_result_fail("Failed to read from /proc/sys/vm/nr_hugepages: %s\n",
-				      strerror(errno));
-		goto close_fd;
-	}
-
-	/* Start with the initial condition of 0 huge pages*/
-	if (write(fd, "0", sizeof(char)) != sizeof(char)) {
-		ksft_test_result_fail("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n",
-				      strerror(errno));
-		goto close_fd;
+		ksft_print_msg("Failed to open /proc/sys/vm/nr_hugepages: %s\n",
+			       strerror(errno));
+		ret = -1;
+		goto out;
 	}
 
-	lseek(fd, 0, SEEK_SET);
-
 	/* Request a large number of huge pages. The Kernel will allocate
 	   as much as it can */
 	if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) {
-		ksft_test_result_fail("Failed to write 100000 to /proc/sys/vm/nr_hugepages: %s\n",
-				      strerror(errno));
+		ksft_print_msg("Failed to write 100000 to /proc/sys/vm/nr_hugepages: %s\n",
+			       strerror(errno));
 		goto close_fd;
 	}
 
 	lseek(fd, 0, SEEK_SET);
 
 	if (read(fd, nr_hugepages, sizeof(nr_hugepages)) <= 0) {
-		ksft_test_result_fail("Failed to re-read from /proc/sys/vm/nr_hugepages: %s\n",
-				      strerror(errno));
+		ksft_print_msg("Failed to re-read from /proc/sys/vm/nr_hugepages: %s\n",
+			       strerror(errno));
 		goto close_fd;
 	}
 
 	/* We should have been able to request at least 1/3 rd of the memory in
 	   huge pages */
-	compaction_index = mem_free/(atoi(nr_hugepages) * hugepage_size);
+	nr_hugepages_ul = strtoul(nr_hugepages, NULL, 10);
+	if (!nr_hugepages_ul) {
+		ksft_print_msg("ERROR: No memory is available as huge pages\n");
+		goto close_fd;
+	}
+	compaction_index = mem_free/(nr_hugepages_ul * hugepage_size);
 
 	lseek(fd, 0, SEEK_SET);
 
-	if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages))
-	    != strlen(initial_nr_hugepages)) {
-		ksft_test_result_fail("Failed to write value to /proc/sys/vm/nr_hugepages: %s\n",
-				      strerror(errno));
+	if (write(fd, init_nr_hugepages, strlen(init_nr_hugepages))
+	    != strlen(init_nr_hugepages)) {
+		ksft_print_msg("Failed to write value to /proc/sys/vm/nr_hugepages: %s\n",
+			       strerror(errno));
 		goto close_fd;
 	}
 
+	ksft_print_msg("Number of huge pages allocated = %d\n",
+		       atoi(nr_hugepages));
+
 	if (compaction_index > 3) {
-		ksft_print_msg("ERROR: Less that 1/%d of memory is available\n"
+		ksft_print_msg("ERROR: Less than 1/%d of memory is available\n"
 			       "as huge pages\n", compaction_index);
-		ksft_test_result_fail("No of huge pages allocated = %d\n", (atoi(nr_hugepages)));
 		goto close_fd;
 	}
 
-	ksft_test_result_pass("Memory compaction succeeded. No of huge pages allocated = %d\n",
-			      (atoi(nr_hugepages)));
 	ret = 0;
 
  close_fd:
 	close(fd);
+ out:
+	ksft_test_result(ret == 0, "check_compaction\n");
 	return ret;
 }
 
+int set_zero_hugepages(unsigned long *initial_nr_hugepages)
+{
+	int fd, ret = -1;
+	char nr_hugepages[20] = {0};
+
+	fd = open("/proc/sys/vm/nr_hugepages", O_RDWR | O_NONBLOCK);
+	if (fd < 0) {
+		ksft_print_msg("Failed to open /proc/sys/vm/nr_hugepages: %s\n",
+			       strerror(errno));
+		goto out;
+	}
+	if (read(fd, nr_hugepages, sizeof(nr_hugepages)) <= 0) {
+		ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n",
+			       strerror(errno));
+		goto close_fd;
+	}
+
+	lseek(fd, 0, SEEK_SET);
+
+	/* Start with the initial condition of 0 huge pages */
+	if (write(fd, "0", sizeof(char)) != sizeof(char)) {
+		ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n",
+			       strerror(errno));
+		goto close_fd;
+	}
+
+	*initial_nr_hugepages = strtoul(nr_hugepages, NULL, 10);
+	ret = 0;
+
+ close_fd:
+	close(fd);
+
+ out:
+	return ret;
+}
 
 int main(int argc, char **argv)
 {
@@ -170,14 +202,19 @@
 	unsigned long mem_free = 0;
 	unsigned long hugepage_size = 0;
 	long mem_fragmentable_MB = 0;
+	unsigned long initial_nr_hugepages;
 
 	ksft_print_header();
 
 	if (prereq() || geteuid())
-		return ksft_exit_pass();
+		ksft_exit_skip("Prerequisites unsatisfied\n");
 
 	ksft_set_plan(1);
 
+	/* Start the test without hugepages reducing mem_free */
+	if (set_zero_hugepages(&initial_nr_hugepages))
+		ksft_exit_fail();
+
 	lim.rlim_cur = RLIM_INFINITY;
 	lim.rlim_max = RLIM_INFINITY;
 	if (setrlimit(RLIMIT_MEMLOCK, &lim))
@@ -221,8 +258,9 @@
 		entry = entry->next;
 	}
 
-	if (check_compaction(mem_free, hugepage_size) == 0)
-		return ksft_exit_pass();
+	if (check_compaction(mem_free, hugepage_size,
+			     initial_nr_hugepages) == 0)
+		ksft_exit_pass();
 
-	return ksft_exit_fail();
+	ksft_exit_fail();
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/cow.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/cow.c
@@ -1779,5 +1779,5 @@
 	if (err)
 		ksft_exit_fail_msg("%d out of %d tests failed\n",
 				   err, ksft_test_num());
-	return ksft_exit_pass();
+	ksft_exit_pass();
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/gup_longterm.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/gup_longterm.c
@@ -456,5 +456,5 @@
 	if (err)
 		ksft_exit_fail_msg("%d out of %d tests failed\n",
 				   err, ksft_test_num());
-	return ksft_exit_pass();
+	ksft_exit_pass();
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/gup_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/gup_test.c
@@ -1,3 +1,4 @@
+#define __SANE_USERSPACE_TYPES__ // Use ll64
 #include <fcntl.h>
 #include <errno.h>
 #include <stdio.h>
@@ -203,7 +204,7 @@
 	ksft_print_header();
 	ksft_set_plan(nthreads);
 
-	filed = open(file, O_RDWR|O_CREAT);
+	filed = open(file, O_RDWR|O_CREAT, 0664);
 	if (filed < 0)
 		ksft_exit_fail_msg("Unable to open %s: %s\n", file, strerror(errno));
 
@@ -228,7 +229,7 @@
 			break;
 		}
 		ksft_test_result_skip("Please run this test as root\n");
-		return ksft_exit_pass();
+		ksft_exit_pass();
 	}
 
 	p = mmap(NULL, size, PROT_READ | PROT_WRITE, flags, filed, 0);
@@ -267,5 +268,5 @@
 
 	free(tid);
 
-	return ksft_exit_pass();
+	ksft_exit_pass();
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/hmm-tests.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/hmm-tests.c
@@ -1657,7 +1657,7 @@
 
 	buffer->fd = -1;
 	buffer->size = size;
-	buffer->mirror = malloc(npages);
+	buffer->mirror = malloc(size);
 	ASSERT_NE(buffer->mirror, NULL);
 
 	/* Reserve a range of addresses. */
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/ksm_functional_tests.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/ksm_functional_tests.c
@@ -646,5 +646,5 @@
 	if (err)
 		ksft_exit_fail_msg("%d out of %d tests failed\n",
 				   err, ksft_test_num());
-	return ksft_exit_pass();
+	ksft_exit_pass();
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/madv_populate.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/madv_populate.c
@@ -307,5 +307,5 @@
 	if (err)
 		ksft_exit_fail_msg("%d out of %d tests failed\n",
 				   err, ksft_test_num());
-	return ksft_exit_pass();
+	ksft_exit_pass();
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/mkdirty.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/mkdirty.c
@@ -375,5 +375,5 @@
 	if (err)
 		ksft_exit_fail_msg("%d out of %d tests failed\n",
 				   err, ksft_test_num());
-	return ksft_exit_pass();
+	ksft_exit_pass();
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/pagemap_ioctl.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/pagemap_ioctl.c
@@ -1484,7 +1484,7 @@
 	ksft_print_header();
 
 	if (init_uffd())
-		return ksft_exit_pass();
+		ksft_exit_pass();
 
 	ksft_set_plan(115);
 
@@ -1660,5 +1660,5 @@
 	userfaultfd_tests();
 
 	close(pagemap_fd);
-	return ksft_exit_pass();
+	ksft_exit_pass();
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/run_vmtests.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/run_vmtests.sh
@@ -338,8 +338,11 @@
 # MADV_POPULATE_READ and MADV_POPULATE_WRITE tests
 CATEGORY="madv_populate" run_test ./madv_populate
 
+if [ -x ./memfd_secret ]
+then
 (echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope 2>&1) | tap_prefix
 CATEGORY="memfd_secret" run_test ./memfd_secret
+fi
 
 # KSM KSM_MERGE_TIME_HUGE_PAGES test with size of 100
 CATEGORY="ksm" run_test ./ksm_tests -H -s 100
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/soft-dirty.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/soft-dirty.c
@@ -137,7 +137,7 @@
 		if (!map)
 			ksft_exit_fail_msg("anon mmap failed\n");
 	} else {
-		test_fd = open(fname, O_RDWR | O_CREAT);
+		test_fd = open(fname, O_RDWR | O_CREAT, 0664);
 		if (test_fd < 0) {
 			ksft_test_result_skip("Test %s open() file failed\n", __func__);
 			return;
@@ -209,5 +209,5 @@
 
 	close(pagemap_fd);
 
-	return ksft_exit_pass();
+	ksft_exit_pass();
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/split_huge_page_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/split_huge_page_test.c
@@ -253,7 +253,7 @@
 		goto cleanup;
 	}
 
-	fd = open(testfile, O_CREAT|O_WRONLY);
+	fd = open(testfile, O_CREAT|O_WRONLY, 0664);
 	if (fd == -1) {
 		perror("Cannot open testing file\n");
 		goto cleanup;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/uffd-common.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/uffd-common.c
@@ -18,6 +18,7 @@
 unsigned long long *count_verify;
 uffd_test_ops_t *uffd_test_ops;
 uffd_test_case_ops_t *uffd_test_case_ops;
+atomic_bool ready_for_fork;
 
 static int uffd_mem_fd_create(off_t mem_size, bool hugetlb)
 {
@@ -518,6 +519,8 @@
 	pollfd[1].fd = pipefd[cpu*2];
 	pollfd[1].events = POLLIN;
 
+	ready_for_fork = true;
+
 	for (;;) {
 		ret = poll(pollfd, 2, -1);
 		if (ret <= 0) {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/uffd-common.h
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/uffd-common.h
@@ -8,6 +8,7 @@
 #define __UFFD_COMMON_H__
 
 #define _GNU_SOURCE
+#define __SANE_USERSPACE_TYPES__ // Use ll64
 #include <stdio.h>
 #include <errno.h>
 #include <unistd.h>
@@ -32,6 +33,7 @@
 #include <inttypes.h>
 #include <stdint.h>
 #include <sys/random.h>
+#include <stdatomic.h>
 
 #include "../kselftest.h"
 #include "vm_util.h"
@@ -103,6 +105,7 @@
 extern bool test_uffdio_wp;
 extern unsigned long long *count_verify;
 extern volatile bool test_uffdio_copy_eexist;
+extern atomic_bool ready_for_fork;
 
 extern uffd_test_ops_t anon_uffd_test_ops;
 extern uffd_test_ops_t shmem_uffd_test_ops;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/uffd-unit-tests.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/uffd-unit-tests.c
@@ -775,6 +775,8 @@
 	char c;
 	struct uffd_args args = { 0 };
 
+	ready_for_fork = false;
+
 	fcntl(uffd, F_SETFL, uffd_flags | O_NONBLOCK);
 
 	if (uffd_register(uffd, area_dst, nr_pages * page_size,
@@ -790,6 +792,9 @@
 	if (pthread_create(&uffd_mon, NULL, uffd_poll_thread, &args))
 		err("uffd_poll_thread create");
 
+	while (!ready_for_fork)
+		; /* Wait for the poll_thread to start executing before forking */
+
 	pid = fork();
 	if (pid < 0)
 		err("fork");
@@ -829,6 +834,8 @@
 	char c;
 	struct uffd_args args = { 0 };
 
+	ready_for_fork = false;
+
 	fcntl(uffd, F_SETFL, uffd_flags | O_NONBLOCK);
 	if (uffd_register(uffd, area_dst, nr_pages * page_size,
 			  true, wp, false))
@@ -838,6 +845,9 @@
 	if (pthread_create(&uffd_mon, NULL, uffd_poll_thread, &args))
 		err("uffd_poll_thread create");
 
+	while (!ready_for_fork)
+		; /* Wait for the poll_thread to start executing before forking */
+
 	pid = fork();
 	if (pid < 0)
 		err("fork");
@@ -1427,7 +1437,8 @@
 		.uffd_fn = uffd_sigbus_wp_test,
 		.mem_targets = MEM_ALL,
 		.uffd_feature_required = UFFD_FEATURE_SIGBUS |
-		UFFD_FEATURE_EVENT_FORK | UFFD_FEATURE_PAGEFAULT_FLAG_WP,
+		UFFD_FEATURE_EVENT_FORK | UFFD_FEATURE_PAGEFAULT_FLAG_WP |
+		UFFD_FEATURE_WP_HUGETLBFS_SHMEM,
 	},
 	{
 		.name = "events",
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/vm_util.h
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/vm_util.h
@@ -3,7 +3,7 @@
 #include <stdbool.h>
 #include <sys/mman.h>
 #include <err.h>
-#include <string.h> /* ffsl() */
+#include <strings.h> /* ffsl() */
 #include <unistd.h> /* _SC_PAGESIZE */
 
 #define BIT_ULL(nr)                   (1ULL << (nr))
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mm/write_to_hugetlbfs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mm/write_to_hugetlbfs.c
@@ -28,7 +28,7 @@
 
 /* Global variables. */
 static const char *self;
-static char *shmaddr;
+static int *shmaddr;
 static int shmid;
 
 /*
@@ -47,15 +47,17 @@
 {
 	printf("Received %d.\n", signo);
 	if (signo == SIGINT) {
-		printf("Deleting the memory\n");
-		if (shmdt((const void *)shmaddr) != 0) {
-			perror("Detach failure");
+		if (shmaddr) {
+			printf("Deleting the memory\n");
+			if (shmdt((const void *)shmaddr) != 0) {
+				perror("Detach failure");
+				shmctl(shmid, IPC_RMID, NULL);
+				exit(4);
+			}
+
 			shmctl(shmid, IPC_RMID, NULL);
-			exit(4);
+			printf("Done deleting the memory\n");
 		}
-
-		shmctl(shmid, IPC_RMID, NULL);
-		printf("Done deleting the memory\n");
 	}
 	exit(2);
 }
@@ -211,7 +213,8 @@
 			shmctl(shmid, IPC_RMID, NULL);
 			exit(2);
 		}
-		printf("shmaddr: %p\n", ptr);
+		shmaddr = ptr;
+		printf("shmaddr: %p\n", shmaddr);
 
 		break;
 	default:
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mount_setattr/mount_setattr_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/mount_setattr/mount_setattr_test.c
@@ -1026,7 +1026,7 @@
 			"size=100000,mode=700"), 0);
 
 	ASSERT_EQ(mount("testing", "/mnt", "tmpfs", MS_NOATIME | MS_NODEV,
-			"size=100000,mode=700"), 0);
+			"size=2m,mode=700"), 0);
 
 	ASSERT_EQ(mkdir("/mnt/A", 0777), 0);
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/mqueue/setting
+++ linux-qcom-6.8.0/tools/testing/selftests/mqueue/setting
@@ -0,0 +1 @@
+timeout=180
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/net/Makefile
@@ -85,7 +85,8 @@
 TEST_GEN_FILES += nat6to4.o
 TEST_GEN_FILES += xdp_dummy.o
 TEST_GEN_FILES += ip_local_port_range
-TEST_GEN_FILES += bind_wildcard
+TEST_GEN_PROGS += bind_wildcard
+TEST_GEN_PROGS += bind_timewait
 TEST_PROGS += test_vxlan_mdb.sh
 TEST_PROGS += test_bridge_neigh_suppress.sh
 TEST_PROGS += test_vxlan_nolocalbypass.sh
@@ -93,6 +94,7 @@
 TEST_PROGS += fdb_flush.sh
 TEST_PROGS += fq_band_pktlimit.sh
 TEST_PROGS += vlan_hw_filter.sh
+TEST_PROGS += ipv6_route_update_soft_lockup.sh
 
 TEST_FILES := settings
 TEST_FILES += in_netns.sh lib.sh net_helper.sh setup_loopback.sh setup_veth.sh
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/amt.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/amt.sh
@@ -77,6 +77,7 @@
 readonly GATEWAY=$(mktemp -u gateway-XXXXXXXX)
 readonly RELAY=$(mktemp -u relay-XXXXXXXX)
 readonly SOURCE=$(mktemp -u source-XXXXXXXX)
+readonly SMCROUTEDIR="$(mktemp -d)"
 ERR=4
 err=0
 
@@ -85,6 +86,11 @@
 	for ns in "$@"; do
 		ip netns delete "${ns}" 2>/dev/null || true
 	done
+	if [ -f "$SMCROUTEDIR/amt.pid" ]; then
+		smcpid=$(< $SMCROUTEDIR/amt.pid)
+		kill $smcpid
+	fi
+	rm -rf $SMCROUTEDIR
 
 	exit $ERR
 }
@@ -167,7 +173,7 @@
 
 setup_mcast_routing()
 {
-	ip netns exec "${RELAY}" smcrouted
+	ip netns exec "${RELAY}" smcrouted -P $SMCROUTEDIR/amt.pid
 	ip netns exec "${RELAY}" smcroutectl a relay_src \
 		172.17.0.2 239.0.0.1 amtr
 	ip netns exec "${RELAY}" smcroutectl a relay_src \
@@ -210,8 +216,8 @@
 
 test_ipv4_forward()
 {
-	RESULT4=$(ip netns exec "${LISTENER}" nc -w 1 -l -u 239.0.0.1 4000)
-	if [ "$RESULT4" == "172.17.0.2" ]; then
+	RESULT4=$(ip netns exec "${LISTENER}" timeout 15 socat - UDP4-LISTEN:4000,readbytes=128 || true)
+	if echo "$RESULT4" | grep -q "172.17.0.2"; then
 		printf "TEST: %-60s  [ OK ]\n" "IPv4 amt multicast forwarding"
 		exit 0
 	else
@@ -222,8 +228,8 @@
 
 test_ipv6_forward()
 {
-	RESULT6=$(ip netns exec "${LISTENER}" nc -w 1 -l -u ff0e::5:6 6000)
-	if [ "$RESULT6" == "2001:db8:3::2" ]; then
+	RESULT6=$(ip netns exec "${LISTENER}" timeout 15 socat - UDP6-LISTEN:6000,readbytes=128 || true)
+	if echo "$RESULT6" | grep -q "2001:db8:3::2"; then
 		printf "TEST: %-60s  [ OK ]\n" "IPv6 amt multicast forwarding"
 		exit 0
 	else
@@ -236,14 +242,14 @@
 {
 	sleep 2
 	ip netns exec "${SOURCE}" bash -c \
-		'echo 172.17.0.2 | nc -w 1 -u 239.0.0.1 4000' &
+		'printf "%s %128s" 172.17.0.2 | nc -w 1 -u 239.0.0.1 4000' &
 }
 
 send_mcast6()
 {
 	sleep 2
 	ip netns exec "${SOURCE}" bash -c \
-		'echo 2001:db8:3::2 | nc -w 1 -u ff0e::5:6 6000' &
+		'printf "%s %128s" 2001:db8:3::2 | nc -w 1 -u ff0e::5:6 6000' &
 }
 
 check_features
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
@@ -73,25 +73,19 @@
 	# namespaces. veth0 is veth-router, veth1 is veth-host.
 	# first, set up the inteface's link to the namespace
 	# then, set the interface "up"
-	ip -6 -netns ${ROUTER_NS_V6} link add name ${ROUTER_INTF} \
-		type veth peer name ${HOST_INTF}
+	ip -n ${ROUTER_NS_V6} link add name ${ROUTER_INTF} \
+		type veth peer name ${HOST_INTF} netns ${HOST_NS_V6}
 
-	ip -6 -netns ${ROUTER_NS_V6} link set dev ${ROUTER_INTF} up
-	ip -6 -netns ${ROUTER_NS_V6} link set dev ${HOST_INTF} netns \
-		${HOST_NS_V6}
-
-	ip -6 -netns ${HOST_NS_V6} link set dev ${HOST_INTF} up
-	ip -6 -netns ${ROUTER_NS_V6} addr add \
-		${ROUTER_ADDR_V6}/${PREFIX_WIDTH_V6} dev ${ROUTER_INTF} nodad
+	# Add tc rule to filter out host na message
+	tc -n ${ROUTER_NS_V6} qdisc add dev ${ROUTER_INTF} clsact
+	tc -n ${ROUTER_NS_V6} filter add dev ${ROUTER_INTF} \
+		ingress protocol ipv6 pref 1 handle 101 \
+		flower src_ip ${HOST_ADDR_V6} ip_proto icmpv6 type 136 skip_hw action pass
 
 	HOST_CONF=net.ipv6.conf.${HOST_INTF}
 	ip netns exec ${HOST_NS_V6} sysctl -qw ${HOST_CONF}.ndisc_notify=1
 	ip netns exec ${HOST_NS_V6} sysctl -qw ${HOST_CONF}.disable_ipv6=0
-	ip -6 -netns ${HOST_NS_V6} addr add ${HOST_ADDR_V6}/${PREFIX_WIDTH_V6} \
-		dev ${HOST_INTF}
-
 	ROUTER_CONF=net.ipv6.conf.${ROUTER_INTF}
-
 	ip netns exec ${ROUTER_NS_V6} sysctl -w \
 		${ROUTER_CONF}.forwarding=1 >/dev/null 2>&1
 	ip netns exec ${ROUTER_NS_V6} sysctl -w \
@@ -99,6 +93,13 @@
 	ip netns exec ${ROUTER_NS_V6} sysctl -w \
 		${ROUTER_CONF}.accept_untracked_na=${accept_untracked_na} \
 		>/dev/null 2>&1
+
+	ip -n ${ROUTER_NS_V6} link set dev ${ROUTER_INTF} up
+	ip -n ${HOST_NS_V6} link set dev ${HOST_INTF} up
+	ip -n ${ROUTER_NS_V6} addr add ${ROUTER_ADDR_V6}/${PREFIX_WIDTH_V6} \
+		dev ${ROUTER_INTF} nodad
+	ip -n ${HOST_NS_V6} addr add ${HOST_ADDR_V6}/${PREFIX_WIDTH_V6} \
+		dev ${HOST_INTF}
 	set +e
 }
 
@@ -162,26 +163,6 @@
 	arp_test_gratuitous 2 1
 }
 
-cleanup_tcpdump() {
-	set -e
-	[[ ! -z  ${tcpdump_stdout} ]] && rm -f ${tcpdump_stdout}
-	[[ ! -z  ${tcpdump_stderr} ]] && rm -f ${tcpdump_stderr}
-	tcpdump_stdout=
-	tcpdump_stderr=
-	set +e
-}
-
-start_tcpdump() {
-	set -e
-	tcpdump_stdout=`mktemp`
-	tcpdump_stderr=`mktemp`
-	ip netns exec ${ROUTER_NS_V6} timeout 15s \
-		tcpdump --immediate-mode -tpni ${ROUTER_INTF} -c 1 \
-		"icmp6 && icmp6[0] == 136 && src ${HOST_ADDR_V6}" \
-		> ${tcpdump_stdout} 2> /dev/null
-	set +e
-}
-
 verify_ndisc() {
 	local accept_untracked_na=$1
 	local same_subnet=$2
@@ -222,8 +203,9 @@
 			HOST_ADDR_V6=2001:db8:abcd:0012::3
 		fi
 	fi
-	setup_v6 $1 $2
-	start_tcpdump
+	setup_v6 $1
+	slowwait_for_counter 15 1 \
+		tc_rule_handle_stats_get "dev ${ROUTER_INTF} ingress" 101 ".packets" "-n ${ROUTER_NS_V6}"
 
 	if verify_ndisc $1 $2; then
 		printf "    TEST: %-60s  [ OK ]\n" "${test_msg[*]}"
@@ -231,7 +213,6 @@
 		printf "    TEST: %-60s  [FAIL]\n" "${test_msg[*]}"
 	fi
 
-	cleanup_tcpdump
 	cleanup_v6
 	set +e
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/cmsg_sender.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/cmsg_sender.c
@@ -333,16 +333,17 @@
 	return "unknown";
 }
 
-static void
+static unsigned long
 cs_read_cmsg(int fd, struct msghdr *msg, char *cbuf, size_t cbuf_sz)
 {
 	struct sock_extended_err *see;
 	struct scm_timestamping *ts;
+	unsigned long ts_seen = 0;
 	struct cmsghdr *cmsg;
 	int i, err;
 
 	if (!opt.ts.ena)
-		return;
+		return 0;
 	msg->msg_control = cbuf;
 	msg->msg_controllen = cbuf_sz;
 
@@ -396,8 +397,11 @@
 			printf(" %5s ts%d %lluus\n",
 			       cs_ts_info2str(see->ee_info),
 			       i, rel_time);
+			ts_seen |= 1 << see->ee_info;
 		}
 	}
+
+	return ts_seen;
 }
 
 static void ca_set_sockopts(int fd)
@@ -509,10 +513,16 @@
 	err = ERN_SUCCESS;
 
 	if (opt.ts.ena) {
-		/* Make sure all timestamps have time to loop back */
-		usleep(opt.txtime.delay);
+		unsigned long seen;
+		int i;
 
-		cs_read_cmsg(fd, &msg, cbuf, sizeof(cbuf));
+		/* Make sure all timestamps have time to loop back */
+		for (i = 0; i < 40; i++) {
+			seen = cs_read_cmsg(fd, &msg, cbuf, sizeof(cbuf));
+			if (seen & (1 << SCM_TSTAMP_SND))
+				break;
+			usleep(opt.txtime.delay / 20);
+		}
 	}
 
 err_out:
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/config
+++ linux-qcom-6.8.0/tools/testing/selftests/net/config
@@ -30,6 +30,7 @@
 CONFIG_NETFILTER=y
 CONFIG_NETFILTER_ADVANCED=y
 CONFIG_NF_CONNTRACK=m
+CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_SIT=y
 CONFIG_IP_DCCP=m
 CONFIG_NF_NAT=m
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/csum.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/csum.c
@@ -654,10 +654,16 @@
 {
 	struct iphdr *iph = nh;
 	uint16_t proto = cfg_encap ? IPPROTO_UDP : cfg_proto;
+	uint16_t ip_len;
 
 	if (len < sizeof(*iph) || iph->protocol != proto)
 		return -1;
 
+	ip_len = ntohs(iph->tot_len);
+	if (ip_len > len || ip_len < sizeof(*iph))
+		return -1;
+
+	len = ip_len;
 	iph_addr_p = &iph->saddr;
 	if (proto == IPPROTO_TCP)
 		return recv_verify_packet_tcp(iph + 1, len - sizeof(*iph));
@@ -669,16 +675,22 @@
 {
 	struct ipv6hdr *ip6h = nh;
 	uint16_t proto = cfg_encap ? IPPROTO_UDP : cfg_proto;
+	uint16_t ip_len;
 
 	if (len < sizeof(*ip6h) || ip6h->nexthdr != proto)
 		return -1;
 
+	ip_len = ntohs(ip6h->payload_len);
+	if (ip_len > len - sizeof(*ip6h))
+		return -1;
+
+	len = ip_len;
 	iph_addr_p = &ip6h->saddr;
 
 	if (proto == IPPROTO_TCP)
-		return recv_verify_packet_tcp(ip6h + 1, len - sizeof(*ip6h));
+		return recv_verify_packet_tcp(ip6h + 1, len);
 	else
-		return recv_verify_packet_udp(ip6h + 1, len - sizeof(*ip6h));
+		return recv_verify_packet_udp(ip6h + 1, len);
 }
 
 /* return whether auxdata includes TP_STATUS_CSUM_VALID */
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/fib_tests.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/fib_tests.sh
@@ -1633,53 +1633,53 @@
 
 	# DSCP 0x10 should match the specific route, no matter the ECN bits
 	$IP route get fibmatch 172.16.102.1 dsfield 0x10 | \
-		grep -q "via 172.16.103.2"
+		grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2"
 	log_test $? 0 "IPv4 route with DSCP and ECN:Not-ECT"
 
 	$IP route get fibmatch 172.16.102.1 dsfield 0x11 | \
-		grep -q "via 172.16.103.2"
+		grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2"
 	log_test $? 0 "IPv4 route with DSCP and ECN:ECT(1)"
 
 	$IP route get fibmatch 172.16.102.1 dsfield 0x12 | \
-		grep -q "via 172.16.103.2"
+		grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2"
 	log_test $? 0 "IPv4 route with DSCP and ECN:ECT(0)"
 
 	$IP route get fibmatch 172.16.102.1 dsfield 0x13 | \
-		grep -q "via 172.16.103.2"
+		grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2"
 	log_test $? 0 "IPv4 route with DSCP and ECN:CE"
 
 	# Unknown DSCP should match the generic route, no matter the ECN bits
 	$IP route get fibmatch 172.16.102.1 dsfield 0x14 | \
-		grep -q "via 172.16.101.2"
+		grep -q "172.16.102.0/24 via 172.16.101.2"
 	log_test $? 0 "IPv4 route with unknown DSCP and ECN:Not-ECT"
 
 	$IP route get fibmatch 172.16.102.1 dsfield 0x15 | \
-		grep -q "via 172.16.101.2"
+		grep -q "172.16.102.0/24 via 172.16.101.2"
 	log_test $? 0 "IPv4 route with unknown DSCP and ECN:ECT(1)"
 
 	$IP route get fibmatch 172.16.102.1 dsfield 0x16 | \
-		grep -q "via 172.16.101.2"
+		grep -q "172.16.102.0/24 via 172.16.101.2"
 	log_test $? 0 "IPv4 route with unknown DSCP and ECN:ECT(0)"
 
 	$IP route get fibmatch 172.16.102.1 dsfield 0x17 | \
-		grep -q "via 172.16.101.2"
+		grep -q "172.16.102.0/24 via 172.16.101.2"
 	log_test $? 0 "IPv4 route with unknown DSCP and ECN:CE"
 
 	# Null DSCP should match the generic route, no matter the ECN bits
 	$IP route get fibmatch 172.16.102.1 dsfield 0x00 | \
-		grep -q "via 172.16.101.2"
+		grep -q "172.16.102.0/24 via 172.16.101.2"
 	log_test $? 0 "IPv4 route with no DSCP and ECN:Not-ECT"
 
 	$IP route get fibmatch 172.16.102.1 dsfield 0x01 | \
-		grep -q "via 172.16.101.2"
+		grep -q "172.16.102.0/24 via 172.16.101.2"
 	log_test $? 0 "IPv4 route with no DSCP and ECN:ECT(1)"
 
 	$IP route get fibmatch 172.16.102.1 dsfield 0x02 | \
-		grep -q "via 172.16.101.2"
+		grep -q "172.16.102.0/24 via 172.16.101.2"
 	log_test $? 0 "IPv4 route with no DSCP and ECN:ECT(0)"
 
 	$IP route get fibmatch 172.16.102.1 dsfield 0x03 | \
-		grep -q "via 172.16.101.2"
+		grep -q "172.16.102.0/24 via 172.16.101.2"
 	log_test $? 0 "IPv4 route with no DSCP and ECN:CE"
 }
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/bridge_fdb_learning_limit.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/bridge_fdb_learning_limit.sh
@@ -178,6 +178,22 @@
 	check_err $? "Failed to remove a FDB entry of type ${type}"
 }
 
+check_fdb_n_learned_support()
+{
+	if ! ip link help bridge 2>&1 | grep -q "fdb_max_learned"; then
+		echo "SKIP: iproute2 too old, missing bridge max learned support"
+		exit $ksft_skip
+	fi
+
+	ip link add dev br0 type bridge
+	local learned=$(fdb_get_n_learned)
+	ip link del dev br0
+	if [ "$learned" == "null" ]; then
+		echo "SKIP: kernel too old; bridge fdb_n_learned feature not supported."
+		exit $ksft_skip
+	fi
+}
+
 check_accounting_one_type()
 {
 	local type=$1 is_counted=$2 overrides_learned=$3
@@ -274,6 +290,8 @@
 	done
 }
 
+check_fdb_n_learned_support
+
 trap cleanup EXIT
 
 setup_prepare
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/bridge_igmp.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/bridge_igmp.sh
@@ -478,10 +478,10 @@
 	RET=0
 	local X=("192.0.2.20" "192.0.2.30")
 
-	# GMI should be 3 seconds
+	# GMI should be 5 seconds
 	ip link set dev br0 type bridge mcast_query_interval 100 \
 					mcast_query_response_interval 100 \
-					mcast_membership_interval 300
+					mcast_membership_interval 500
 
 	v3exclude_prepare $h1 $ALL_MAC $ALL_GROUP
 	ip link set dev br0 type bridge mcast_query_interval 500 \
@@ -489,7 +489,7 @@
 					mcast_membership_interval 1500
 
 	$MZ $h1 -c 1 -b $ALL_MAC -B $ALL_GROUP -t ip "proto=2,p=$MZPKT_ALLOW2" -q
-	sleep 3
+	sleep 5
 	bridge -j -d -s mdb show dev br0 \
 		| jq -e ".[].mdb[] | \
 			 select(.grp == \"$TEST_GROUP\" and \
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/bridge_mld.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/bridge_mld.sh
@@ -478,10 +478,10 @@
 	RET=0
 	local X=("2001:db8:1::20" "2001:db8:1::30")
 
-	# GMI should be 3 seconds
+	# GMI should be 5 seconds
 	ip link set dev br0 type bridge mcast_query_interval 100 \
 					mcast_query_response_interval 100 \
-					mcast_membership_interval 300
+					mcast_membership_interval 500
 
 	mldv2exclude_prepare $h1
 	ip link set dev br0 type bridge mcast_query_interval 500 \
@@ -489,7 +489,7 @@
 					mcast_membership_interval 1500
 
 	$MZ $h1 -c 1 $MZPKT_ALLOW2 -q
-	sleep 3
+	sleep 5
 	bridge -j -d -s mdb show dev br0 \
 		| jq -e ".[].mdb[] | \
 			 select(.grp == \"$TEST_GROUP\" and \
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/config
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/config
@@ -6,14 +6,49 @@
 CONFIG_NET_VRF=m
 CONFIG_BPF_SYSCALL=y
 CONFIG_CGROUP_BPF=y
+CONFIG_DUMMY=m
+CONFIG_IPV6=y
+CONFIG_IPV6_GRE=m
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_MACVLAN=m
 CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_SAMPLE=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_TUNNEL_KEY=m
 CONFIG_NET_ACT_VLAN=m
 CONFIG_NET_CLS_FLOWER=m
 CONFIG_NET_CLS_MATCHALL=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPIP=m
+CONFIG_NET_SCH_ETS=m
 CONFIG_NET_SCH_INGRESS=m
 CONFIG_NET_ACT_GACT=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_TC_SKB_EXT=y
+CONFIG_NET_TEAM=y
+CONFIG_NET_TEAM_MODE_LOADBALANCE=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_FLOW_TABLE=m
+CONFIG_NF_TABLES=m
 CONFIG_VETH=m
 CONFIG_NAMESPACES=y
 CONFIG_NET_NS=y
+CONFIG_VXLAN=m
+CONFIG_XFRM_USER=m
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/devlink_lib.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/devlink_lib.sh
@@ -122,6 +122,8 @@
 	still_pending=$(devlink resource show "$DEVLINK_DEV" | \
 			grep -c "size_new")
 	check_err $still_pending "Failed reload - There are still unset sizes"
+
+	udevadm settle
 }
 
 declare -A DEVLINK_ORIG
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/lib.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/lib.sh
@@ -41,28 +41,6 @@
 # Kselftest framework requirement - SKIP code is 4.
 ksft_skip=4
 
-busywait()
-{
-	local timeout=$1; shift
-
-	local start_time="$(date -u +%s%3N)"
-	while true
-	do
-		local out
-		out=$("$@")
-		local ret=$?
-		if ((!ret)); then
-			echo -n "$out"
-			return 0
-		fi
-
-		local current_time="$(date -u +%s%3N)"
-		if ((current_time - start_time > timeout)); then
-			echo -n "$out"
-			return 1
-		fi
-	done
-}
 
 ##############################################################################
 # Sanity checks
@@ -358,14 +336,24 @@
 # Per-test return value. Clear at the beginning of each test.
 RET=0
 
+ret_set_ksft_status()
+{
+	local ksft_status=$1; shift
+	local msg=$1; shift
+
+	RET=$(ksft_status_merge $RET $ksft_status)
+	if (( $? )); then
+		retmsg=$msg
+	fi
+}
+
 check_err()
 {
 	local err=$1
 	local msg=$2
 
-	if [[ $RET -eq 0 && $err -ne 0 ]]; then
-		RET=$err
-		retmsg=$msg
+	if ((err)); then
+		ret_set_ksft_status $ksft_fail "$msg"
 	fi
 }
 
@@ -374,10 +362,7 @@
 	local err=$1
 	local msg=$2
 
-	if [[ $RET -eq 0 && $err -eq 0 ]]; then
-		RET=1
-		retmsg=$msg
-	fi
+	check_err $((!err)) "$msg"
 }
 
 check_err_fail()
@@ -393,6 +378,62 @@
 	fi
 }
 
+log_test_result()
+{
+	local test_name=$1; shift
+	local opt_str=$1; shift
+	local result=$1; shift
+	local retmsg=$1; shift
+
+	printf "TEST: %-60s  [%s]\n" "$test_name $opt_str" "$result"
+	if [[ $retmsg ]]; then
+		printf "\t%s\n" "$retmsg"
+	fi
+}
+
+pause_on_fail()
+{
+	if [[ $PAUSE_ON_FAIL == yes ]]; then
+		echo "Hit enter to continue, 'q' to quit"
+		read a
+		[[ $a == q ]] && exit 1
+	fi
+}
+
+handle_test_result_pass()
+{
+	local test_name=$1; shift
+	local opt_str=$1; shift
+
+	log_test_result "$test_name" "$opt_str" " OK "
+}
+
+handle_test_result_fail()
+{
+	local test_name=$1; shift
+	local opt_str=$1; shift
+
+	log_test_result "$test_name" "$opt_str" FAIL "$retmsg"
+	pause_on_fail
+}
+
+handle_test_result_xfail()
+{
+	local test_name=$1; shift
+	local opt_str=$1; shift
+
+	log_test_result "$test_name" "$opt_str" XFAIL "$retmsg"
+	pause_on_fail
+}
+
+handle_test_result_skip()
+{
+	local test_name=$1; shift
+	local opt_str=$1; shift
+
+	log_test_result "$test_name" "$opt_str" SKIP "$retmsg"
+}
+
 log_test()
 {
 	local test_name=$1
@@ -402,31 +443,23 @@
 		opt_str="($opt_str)"
 	fi
 
-	if [[ $RET -ne 0 ]]; then
-		EXIT_STATUS=1
-		printf "TEST: %-60s  [FAIL]\n" "$test_name $opt_str"
-		if [[ ! -z "$retmsg" ]]; then
-			printf "\t%s\n" "$retmsg"
-		fi
-		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
-			echo "Hit enter to continue, 'q' to quit"
-			read a
-			[ "$a" = "q" ] && exit 1
-		fi
-		return 1
+	if ((RET == ksft_pass)); then
+		handle_test_result_pass "$test_name" "$opt_str"
+	elif ((RET == ksft_xfail)); then
+		handle_test_result_xfail "$test_name" "$opt_str"
+	elif ((RET == ksft_skip)); then
+		handle_test_result_skip "$test_name" "$opt_str"
+	else
+		handle_test_result_fail "$test_name" "$opt_str"
 	fi
 
-	printf "TEST: %-60s  [ OK ]\n" "$test_name $opt_str"
-	return 0
+	EXIT_STATUS=$(ksft_exit_status_merge $EXIT_STATUS $RET)
+	return $RET
 }
 
 log_test_skip()
 {
-	local test_name=$1
-	local opt_str=$2
-
-	printf "TEST: %-60s  [SKIP]\n" "$test_name $opt_str"
-	return 0
+	RET=$ksft_skip retmsg= log_test "$@"
 }
 
 log_info()
@@ -810,29 +843,6 @@
 	link_stats_get $1 rx errors
 }
 
-tc_rule_stats_get()
-{
-	local dev=$1; shift
-	local pref=$1; shift
-	local dir=$1; shift
-	local selector=${1:-.packets}; shift
-
-	tc -j -s filter show dev $dev ${dir:-ingress} pref $pref \
-	    | jq ".[1].options.actions[].stats$selector"
-}
-
-tc_rule_handle_stats_get()
-{
-	local id=$1; shift
-	local handle=$1; shift
-	local selector=${1:-.packets}; shift
-	local netns=${1:-""}; shift
-
-	tc $netns -j -s filter show $id \
-	    | jq ".[] | select(.options.handle == $handle) | \
-		  .options.actions[0].stats$selector"
-}
-
 ethtool_stats_get()
 {
 	local dev=$1; shift
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/local_termination.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/local_termination.sh
@@ -278,6 +278,10 @@
 cleanup()
 {
 	pre_cleanup
+
+	ip link set $h2 down
+	ip link set $h1 down
+
 	vrf_cleanup
 }
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/no_forwarding.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/no_forwarding.sh
@@ -202,7 +202,7 @@
 	ip link set $swp2 master br0
 
 	bridge vlan add dev $swp1 vid 1 pvid untagged
-	bridge vlan add dev $swp1 vid 2 pvid untagged
+	bridge vlan add dev $swp2 vid 2 pvid untagged
 
 	run_test "Switch ports in VLAN-aware bridge with different PVIDs"
 
@@ -233,6 +233,9 @@
 {
 	pre_cleanup
 
+	ip link set dev $swp2 down
+	ip link set dev $swp1 down
+
 	h2_destroy
 	h1_destroy
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh
@@ -354,7 +354,7 @@
 
 	# Send 100 packets and verify that at least 100 packets hit the rule,
 	# to overcome ARP noise.
-	PING_COUNT=100 PING_TIMEOUT=11 ping_do $dev $dst_ip
+	PING_COUNT=100 PING_TIMEOUT=20 ping_do $dev $dst_ip
 	check_err $? "Ping failed"
 
 	tc_check_at_least_x_packets "dev $rp1 egress" 101 10 100
@@ -410,7 +410,7 @@
 
 	# Send 100 packets and verify that at least 100 packets hit the rule,
 	# to overcome neighbor discovery noise.
-	PING_COUNT=100 PING_TIMEOUT=11 ping6_do $dev $dst_ip
+	PING_COUNT=100 PING_TIMEOUT=20 ping6_do $dev $dst_ip
 	check_err $? "Ping failed"
 
 	tc_check_at_least_x_packets "dev $rp1 egress" 101 100
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/forwarding/vxlan_bridge_1q_ipv6.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/forwarding/vxlan_bridge_1q_ipv6.sh
@@ -457,7 +457,7 @@
 
 	# Send 100 packets and verify that at least 100 packets hit the rule,
 	# to overcome ARP noise.
-	PING_COUNT=100 PING_TIMEOUT=11 ping_do $dev $dst_ip
+	PING_COUNT=100 PING_TIMEOUT=20 ping_do $dev $dst_ip
 	check_err $? "Ping failed"
 
 	tc_check_at_least_x_packets "dev $rp1 egress" 101 10 100
@@ -522,7 +522,7 @@
 
 	# Send 100 packets and verify that at least 100 packets hit the rule,
 	# to overcome neighbor discovery noise.
-	PING_COUNT=100 PING_TIMEOUT=11 ping6_do $dev $dst_ip
+	PING_COUNT=100 PING_TIMEOUT=20 ping6_do $dev $dst_ip
 	check_err $? "Ping failed"
 
 	tc_check_at_least_x_packets "dev $rp1 egress" 101 100
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/ip_local_port_range.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/ip_local_port_range.c
@@ -359,7 +359,7 @@
 		struct sockaddr_in v4;
 		struct sockaddr_in6 v6;
 	} addr;
-	socklen_t addr_len;
+	socklen_t addr_len = 0;
 	const int one = 1;
 	int fd, err;
 	__u32 range;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh
@@ -0,0 +1,262 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Testing for potential kernel soft lockup during IPv6 routing table
+# refresh under heavy outgoing IPv6 traffic. If a kernel soft lockup
+# occurs, a kernel panic will be triggered to prevent associated issues.
+#
+#
+#                            Test Environment Layout
+#
+# ┌----------------┐                                         ┌----------------┐
+# |     SOURCE_NS  |                                         |     SINK_NS    |
+# |    NAMESPACE   |                                         |    NAMESPACE   |
+# |(iperf3 clients)|                                         |(iperf3 servers)|
+# |                |                                         |                |
+# |                |                                         |                |
+# |    ┌-----------|                             nexthops    |---------┐      |
+# |    |veth_source|<--------------------------------------->|veth_sink|<┐    |
+# |    └-----------|2001:0DB8:1::0:1/96  2001:0DB8:1::1:1/96 |---------┘ |    |
+# |                |         ^           2001:0DB8:1::1:2/96 |           |    |
+# |                |         .                   .           |       fwd |    |
+# |  ┌---------┐   |         .                   .           |           |    |
+# |  |   IPv6  |   |         .                   .           |           V    |
+# |  | routing |   |         .           2001:0DB8:1::1:80/96|        ┌-----┐ |
+# |  |  table  |   |         .                               |        | lo  | |
+# |  | nexthop |   |         .                               └--------┴-----┴-┘
+# |  | update  |   |         ............................> 2001:0DB8:2::1:1/128
+# |  └-------- ┘   |
+# └----------------┘
+#
+# The test script sets up two network namespaces, source_ns and sink_ns,
+# connected via a veth link. Within source_ns, it continuously updates the
+# IPv6 routing table by flushing and inserting IPV6_NEXTHOP_ADDR_COUNT nexthop
+# IPs destined for SINK_LOOPBACK_IP_ADDR in sink_ns. This refresh occurs at a
+# rate of 1/ROUTING_TABLE_REFRESH_PERIOD per second for TEST_DURATION seconds.
+#
+# Simultaneously, multiple iperf3 clients within source_ns generate heavy
+# outgoing IPv6 traffic. Each client is assigned a unique port number starting
+# at 5000 and incrementing sequentially. Each client targets a unique iperf3
+# server running in sink_ns, connected to the SINK_LOOPBACK_IFACE interface
+# using the same port number.
+#
+# The number of iperf3 servers and clients is set to half of the total
+# available cores on each machine.
+#
+# NOTE: We have tested this script on machines with various CPU specifications,
+# ranging from lower to higher performance as listed below. The test script
+# effectively triggered a kernel soft lockup on machines running an unpatched
+# kernel in under a minute:
+#
+# - 1x Intel Xeon E-2278G 8-Core Processor @ 3.40GHz
+# - 1x Intel Xeon E-2378G Processor 8-Core @ 2.80GHz
+# - 1x AMD EPYC 7401P 24-Core Processor @ 2.00GHz
+# - 1x AMD EPYC 7402P 24-Core Processor @ 2.80GHz
+# - 2x Intel Xeon Gold 5120 14-Core Processor @ 2.20GHz
+# - 1x Ampere Altra Q80-30 80-Core Processor @ 3.00GHz
+# - 2x Intel Xeon Gold 5120 14-Core Processor @ 2.20GHz
+# - 2x Intel Xeon Silver 4214 24-Core Processor @ 2.20GHz
+# - 1x AMD EPYC 7502P 32-Core @ 2.50GHz
+# - 1x Intel Xeon Gold 6314U 32-Core Processor @ 2.30GHz
+# - 2x Intel Xeon Gold 6338 32-Core Processor @ 2.00GHz
+#
+# On less performant machines, you may need to increase the TEST_DURATION
+# parameter to enhance the likelihood of encountering a race condition leading
+# to a kernel soft lockup and avoid a false negative result.
+#
+# NOTE: The test may not produce the expected result in virtualized
+# environments (e.g., qemu) due to differences in timing and CPU handling,
+# which can affect the conditions needed to trigger a soft lockup.
+
+source lib.sh
+source net_helper.sh
+
+TEST_DURATION=300
+ROUTING_TABLE_REFRESH_PERIOD=0.01
+
+IPERF3_BITRATE="300m"
+
+
+IPV6_NEXTHOP_ADDR_COUNT="128"
+IPV6_NEXTHOP_ADDR_MASK="96"
+IPV6_NEXTHOP_PREFIX="2001:0DB8:1"
+
+
+SOURCE_TEST_IFACE="veth_source"
+SOURCE_TEST_IP_ADDR="2001:0DB8:1::0:1/96"
+
+SINK_TEST_IFACE="veth_sink"
+# ${SINK_TEST_IFACE} is populated with the following range of IPv6 addresses:
+# 2001:0DB8:1::1:1  to 2001:0DB8:1::1:${IPV6_NEXTHOP_ADDR_COUNT}
+SINK_LOOPBACK_IFACE="lo"
+SINK_LOOPBACK_IP_MASK="128"
+SINK_LOOPBACK_IP_ADDR="2001:0DB8:2::1:1"
+
+nexthop_ip_list=""
+termination_signal=""
+kernel_softlokup_panic_prev_val=""
+
+terminate_ns_processes_by_pattern() {
+	local ns=$1
+	local pattern=$2
+
+	for pid in $(ip netns pids ${ns}); do
+		[ -e /proc/$pid/cmdline ] && grep -qe "${pattern}" /proc/$pid/cmdline && kill -9 $pid
+	done
+}
+
+cleanup() {
+	echo "info: cleaning up namespaces and terminating all processes within them..."
+
+
+	# Terminate iperf3 instances running in the source_ns. To avoid race
+	# conditions, first iterate over the PIDs and terminate those
+	# associated with the bash shells running the
+	# `while true; do iperf3 -c ...; done` loops. In a second iteration,
+	# terminate the individual `iperf3 -c ...` instances.
+	terminate_ns_processes_by_pattern ${source_ns} while
+	terminate_ns_processes_by_pattern ${source_ns} iperf3
+
+	# Repeat the same process for sink_ns
+	terminate_ns_processes_by_pattern ${sink_ns} while
+	terminate_ns_processes_by_pattern ${sink_ns} iperf3
+
+	# Check if any iperf3 instances are still running. This could happen
+	# if a core has entered an infinite loop and the timeout for detecting
+	# the soft lockup has not expired, but either the test interval has
+	# already elapsed or the test was terminated manually (e.g., with ^C)
+	for pid in $(ip netns pids ${source_ns}); do
+		if [ -e /proc/$pid/cmdline ] && grep -qe 'iperf3' /proc/$pid/cmdline; then
+			echo "FAIL: unable to terminate some iperf3 instances. Soft lockup is underway. A kernel panic is on the way!"
+			exit ${ksft_fail}
+		fi
+	done
+
+	if [ "$termination_signal" == "SIGINT" ]; then
+		echo "SKIP: Termination due to ^C (SIGINT)"
+	elif [ "$termination_signal" == "SIGALRM" ]; then
+		echo "PASS: No kernel soft lockup occurred during this ${TEST_DURATION} second test"
+	fi
+
+	cleanup_ns ${source_ns} ${sink_ns}
+
+	sysctl -qw kernel.softlockup_panic=${kernel_softlokup_panic_prev_val}
+}
+
+setup_prepare() {
+	setup_ns source_ns sink_ns
+
+	ip -n ${source_ns} link add name ${SOURCE_TEST_IFACE} type veth peer name ${SINK_TEST_IFACE} netns ${sink_ns}
+
+	# Setting up the Source namespace
+	ip -n ${source_ns} addr add ${SOURCE_TEST_IP_ADDR} dev ${SOURCE_TEST_IFACE}
+	ip -n ${source_ns} link set dev ${SOURCE_TEST_IFACE} qlen 10000
+	ip -n ${source_ns} link set dev ${SOURCE_TEST_IFACE} up
+	ip netns exec ${source_ns} sysctl -qw net.ipv6.fib_multipath_hash_policy=1
+
+	# Setting up the Sink namespace
+	ip -n ${sink_ns} addr add ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK} dev ${SINK_LOOPBACK_IFACE}
+	ip -n ${sink_ns} link set dev ${SINK_LOOPBACK_IFACE} up
+	ip netns exec ${sink_ns} sysctl -qw net.ipv6.conf.${SINK_LOOPBACK_IFACE}.forwarding=1
+
+	ip -n ${sink_ns} link set ${SINK_TEST_IFACE} up
+	ip netns exec ${sink_ns} sysctl -qw net.ipv6.conf.${SINK_TEST_IFACE}.forwarding=1
+
+
+	# Populate nexthop IPv6 addresses on the test interface in the sink_ns
+	echo "info: populating ${IPV6_NEXTHOP_ADDR_COUNT} IPv6 addresses on the ${SINK_TEST_IFACE} interface ..."
+	for IP in $(seq 1 ${IPV6_NEXTHOP_ADDR_COUNT}); do
+		ip -n ${sink_ns} addr add ${IPV6_NEXTHOP_PREFIX}::$(printf "1:%x" "${IP}")/${IPV6_NEXTHOP_ADDR_MASK} dev ${SINK_TEST_IFACE};
+	done
+
+	# Preparing list of nexthops
+	for IP in $(seq 1 ${IPV6_NEXTHOP_ADDR_COUNT}); do
+		nexthop_ip_list=$nexthop_ip_list" nexthop via ${IPV6_NEXTHOP_PREFIX}::$(printf "1:%x" $IP) dev ${SOURCE_TEST_IFACE} weight 1"
+	done
+}
+
+
+test_soft_lockup_during_routing_table_refresh() {
+	# Start num_of_iperf_servers iperf3 servers in the sink_ns namespace,
+	# each listening on ports starting at 5001 and incrementing
+	# sequentially. Since iperf3 instances may terminate unexpectedly, a
+	# while loop is used to automatically restart them in such cases.
+	echo "info: starting ${num_of_iperf_servers} iperf3 servers in the sink_ns namespace ..."
+	for i in $(seq 1 ${num_of_iperf_servers}); do
+		cmd="iperf3 --bind ${SINK_LOOPBACK_IP_ADDR} -s -p $(printf '5%03d' ${i}) --rcv-timeout 200 &>/dev/null"
+		ip netns exec ${sink_ns} bash -c "while true; do ${cmd}; done &" &>/dev/null
+	done
+
+	# Wait for the iperf3 servers to be ready
+	for i in $(seq ${num_of_iperf_servers}); do
+		port=$(printf '5%03d' ${i});
+		wait_local_port_listen ${sink_ns} ${port} tcp
+	done
+
+	# Continuously refresh the routing table in the background within
+	# the source_ns namespace
+	ip netns exec ${source_ns} bash -c "
+		while \$(ip netns list | grep -q ${source_ns}); do
+			ip -6 route add ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK} ${nexthop_ip_list};
+			sleep ${ROUTING_TABLE_REFRESH_PERIOD};
+			ip -6 route delete ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK};
+		done &"
+
+	# Start num_of_iperf_servers iperf3 clients in the source_ns namespace,
+	# each sending TCP traffic on sequential ports starting at 5001.
+	# Since iperf3 instances may terminate unexpectedly (e.g., if the route
+	# to the server is deleted in the background during a route refresh), a
+	# while loop is used to automatically restart them in such cases.
+	echo "info: starting ${num_of_iperf_servers} iperf3 clients in the source_ns namespace ..."
+	for i in $(seq 1 ${num_of_iperf_servers}); do
+		cmd="iperf3 -c ${SINK_LOOPBACK_IP_ADDR} -p $(printf '5%03d' ${i}) --length 64 --bitrate ${IPERF3_BITRATE} -t 0 --connect-timeout 150 &>/dev/null"
+		ip netns exec ${source_ns} bash -c "while true; do ${cmd}; done &" &>/dev/null
+	done
+
+	echo "info: IPv6 routing table is being updated at the rate of $(echo "1/${ROUTING_TABLE_REFRESH_PERIOD}" | bc)/s for ${TEST_DURATION} seconds ..."
+	echo "info: A kernel soft lockup, if detected, results in a kernel panic!"
+
+	wait
+}
+
+# Make sure 'iperf3' is installed, skip the test otherwise
+if [ ! -x "$(command -v "iperf3")" ]; then
+	echo "SKIP: 'iperf3' is not installed. Skipping the test."
+	exit ${ksft_skip}
+fi
+
+# Determine the number of cores on the machine
+num_of_iperf_servers=$(( $(nproc)/2 ))
+
+# Check if we are running on a multi-core machine, skip the test otherwise
+if [ "${num_of_iperf_servers}" -eq 0 ]; then
+	echo "SKIP: This test is not valid on a single core machine!"
+	exit ${ksft_skip}
+fi
+
+# Since the kernel soft lockup we're testing causes at least one core to enter
+# an infinite loop, destabilizing the host and likely affecting subsequent
+# tests, we trigger a kernel panic instead of reporting a failure and
+# continuing
+kernel_softlokup_panic_prev_val=$(sysctl -n kernel.softlockup_panic)
+sysctl -qw kernel.softlockup_panic=1
+
+handle_sigint() {
+	termination_signal="SIGINT"
+	cleanup
+	exit ${ksft_skip}
+}
+
+handle_sigalrm() {
+	termination_signal="SIGALRM"
+	cleanup
+	exit ${ksft_pass}
+}
+
+trap handle_sigint SIGINT
+trap handle_sigalrm SIGALRM
+
+(sleep ${TEST_DURATION} && kill -s SIGALRM $$)&
+
+setup_prepare
+test_soft_lockup_during_routing_table_refresh
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/lib.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/lib.sh
@@ -10,60 +10,137 @@
 # Kselftest framework requirement - SKIP code is 4.
 ksft_skip=4
 # namespace list created by setup_ns
-NS_LIST=""
+NS_LIST=()
 
 ##############################################################################
 # Helpers
-busywait()
+
+__ksft_status_merge()
 {
-	local timeout=$1; shift
+	local a=$1; shift
+	local b=$1; shift
+	local -A weights
+	local weight=0
+
+	local i
+	for i in "$@"; do
+		weights[$i]=$((weight++))
+	done
+
+	if [[ ${weights[$a]} > ${weights[$b]} ]]; then
+		echo "$a"
+		return 0
+	else
+		echo "$b"
+		return 1
+	fi
+}
+
+ksft_status_merge()
+{
+	local a=$1; shift
+	local b=$1; shift
+
+	__ksft_status_merge "$a" "$b" \
+		$ksft_pass $ksft_xfail $ksft_skip $ksft_fail
+}
+
+ksft_exit_status_merge()
+{
+	local a=$1; shift
+	local b=$1; shift
+
+	__ksft_status_merge "$a" "$b" \
+		$ksft_xfail $ksft_pass $ksft_skip $ksft_fail
+}
+
+loopy_wait()
+{
+	local sleep_cmd=$1; shift
+	local timeout_ms=$1; shift
 
 	local start_time="$(date -u +%s%3N)"
 	while true
 	do
 		local out
-		out=$("$@")
-		local ret=$?
-		if ((!ret)); then
+		if out=$("$@"); then
 			echo -n "$out"
 			return 0
 		fi
 
 		local current_time="$(date -u +%s%3N)"
-		if ((current_time - start_time > timeout)); then
+		if ((current_time - start_time > timeout_ms)); then
 			echo -n "$out"
 			return 1
 		fi
+
+		$sleep_cmd
 	done
 }
 
+busywait()
+{
+	local timeout_ms=$1; shift
+
+	loopy_wait : "$timeout_ms" "$@"
+}
+
+# timeout in seconds
+slowwait()
+{
+	local timeout_sec=$1; shift
+
+	loopy_wait "sleep 0.1" "$((timeout_sec * 1000))" "$@"
+}
+
+until_counter_is()
+{
+	local expr=$1; shift
+	local current=$("$@")
+
+	echo $((current))
+	((current $expr))
+}
+
+busywait_for_counter()
+{
+	local timeout=$1; shift
+	local delta=$1; shift
+
+	local base=$("$@")
+	busywait "$timeout" until_counter_is ">= $((base + delta))" "$@"
+}
+
+slowwait_for_counter()
+{
+	local timeout=$1; shift
+	local delta=$1; shift
+
+	local base=$("$@")
+	slowwait "$timeout" until_counter_is ">= $((base + delta))" "$@"
+}
+
 cleanup_ns()
 {
 	local ns=""
-	local errexit=0
 	local ret=0
 
-	# disable errexit temporary
-	if [[ $- =~ "e" ]]; then
-		errexit=1
-		set +e
-	fi
-
 	for ns in "$@"; do
-		ip netns delete "${ns}" &> /dev/null
+		[ -z "${ns}" ] && continue
+		ip netns pids "${ns}" 2> /dev/null | xargs -r kill || true
+		ip netns delete "${ns}" &> /dev/null || true
 		if ! busywait $BUSYWAIT_TIMEOUT ip netns list \| grep -vq "^$ns$" &> /dev/null; then
 			echo "Warn: Failed to remove namespace $ns"
 			ret=1
 		fi
 	done
 
-	[ $errexit -eq 1 ] && set -e
 	return $ret
 }
 
 cleanup_all_ns()
 {
-	cleanup_ns $NS_LIST
+	cleanup_ns "${NS_LIST[@]}"
 }
 
 # setup netns with given names as prefix. e.g
@@ -72,25 +149,50 @@
 {
 	local ns=""
 	local ns_name=""
-	local ns_list=""
+	local ns_list=()
+	local ns_exist=
 	for ns_name in "$@"; do
 		# Some test may setup/remove same netns multi times
 		if unset ${ns_name} 2> /dev/null; then
 			ns="${ns_name,,}-$(mktemp -u XXXXXX)"
 			eval readonly ${ns_name}="$ns"
+			ns_exist=false
 		else
 			eval ns='$'${ns_name}
 			cleanup_ns "$ns"
-
+			ns_exist=true
 		fi
 
 		if ! ip netns add "$ns"; then
 			echo "Failed to create namespace $ns_name"
-			cleanup_ns "$ns_list"
+			cleanup_ns "${ns_list[@]}"
 			return $ksft_skip
 		fi
 		ip -n "$ns" link set lo up
-		ns_list="$ns_list $ns"
+		! $ns_exist && ns_list+=("$ns")
 	done
-	NS_LIST="$NS_LIST $ns_list"
+	NS_LIST+=("${ns_list[@]}")
+}
+
+tc_rule_stats_get()
+{
+	local dev=$1; shift
+	local pref=$1; shift
+	local dir=$1; shift
+	local selector=${1:-.packets}; shift
+
+	tc -j -s filter show dev $dev ${dir:-ingress} pref $pref \
+	    | jq ".[1].options.actions[].stats$selector"
+}
+
+tc_rule_handle_stats_get()
+{
+	local id=$1; shift
+	local handle=$1; shift
+	local selector=${1:-.packets}; shift
+	local netns=${1:-""}; shift
+
+	tc $netns -j -s filter show $id \
+	    | jq ".[] | select(.options.handle == $handle) | \
+		  .options.actions[0].stats$selector"
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/mptcp/mptcp_connect.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/mptcp/mptcp_connect.c
@@ -25,6 +25,8 @@
 #include <sys/types.h>
 #include <sys/mman.h>
 
+#include <arpa/inet.h>
+
 #include <netdb.h>
 #include <netinet/in.h>
 
@@ -1115,11 +1117,11 @@
 		return 1;
 	}
 
-	if (--cfg_repeat > 0) {
-		if (cfg_input)
-			close(fd);
+	if (cfg_input)
+		close(fd);
+
+	if (--cfg_repeat > 0)
 		goto again;
-	}
 
 	return 0;
 }
@@ -1211,23 +1213,42 @@
 	exit(1);
 }
 
-void xdisconnect(int fd, int addrlen)
+void xdisconnect(int fd)
 {
-	struct sockaddr_storage empty;
+	socklen_t addrlen = sizeof(struct sockaddr_storage);
+	struct sockaddr_storage addr, empty;
 	int msec_sleep = 10;
-	int queued = 1;
-	int i;
+	void *raw_addr;
+	int i, cmdlen;
+	char cmd[128];
+
+	/* get the local address and convert it to string */
+	if (getsockname(fd, (struct sockaddr *)&addr, &addrlen) < 0)
+		xerror("getsockname");
+
+	if (addr.ss_family == AF_INET)
+		raw_addr = &(((struct sockaddr_in *)&addr)->sin_addr);
+	else if (addr.ss_family == AF_INET6)
+		raw_addr = &(((struct sockaddr_in6 *)&addr)->sin6_addr);
+	else
+		xerror("bad family");
+
+	strcpy(cmd, "ss -M | grep -q ");
+	cmdlen = strlen(cmd);
+	if (!inet_ntop(addr.ss_family, raw_addr, &cmd[cmdlen],
+		       sizeof(cmd) - cmdlen))
+		xerror("inet_ntop");
 
 	shutdown(fd, SHUT_WR);
 
-	/* while until the pending data is completely flushed, the later
+	/*
+	 * wait until the pending data is completely flushed and all
+	 * the MPTCP sockets reached the closed status.
 	 * disconnect will bypass/ignore/drop any pending data.
 	 */
 	for (i = 0; ; i += msec_sleep) {
-		if (ioctl(fd, SIOCOUTQ, &queued) < 0)
-			xerror("can't query out socket queue: %d", errno);
-
-		if (!queued)
+		/* closed socket are not listed by 'ss' */
+		if (system(cmd) != 0)
 			break;
 
 		if (i > poll_timeout)
@@ -1281,9 +1302,9 @@
 		return ret;
 
 	if (cfg_truncate > 0) {
-		xdisconnect(fd, peer->ai_addrlen);
+		xdisconnect(fd);
 	} else if (--cfg_repeat > 0) {
-		xdisconnect(fd, peer->ai_addrlen);
+		xdisconnect(fd);
 
 		/* the socket could be unblocking at this point, we need the
 		 * connect to be blocking
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/mptcp/mptcp_connect.sh
@@ -1,6 +1,11 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+# Double quotes to prevent globbing and word splitting is recommended in new
+# code but we accept it, especially because there were too many before having
+# address all other issues detected by shellcheck.
+#shellcheck disable=SC2086
+
 . "$(dirname "${0}")/mptcp_lib.sh"
 
 time_start=$(date +%s)
@@ -13,7 +18,6 @@
 cin_disconnect=""
 cin=""
 cout=""
-ksft_skip=4
 capture=false
 timeout_poll=30
 timeout_test=$((timeout_poll * 2 + 1))
@@ -131,6 +135,8 @@
 TEST_COUNT=0
 TEST_GROUP=""
 
+# This function is used in the cleanup trap
+#shellcheck disable=SC2317
 cleanup()
 {
 	rm -f "$cin_disconnect" "$cout_disconnect"
@@ -225,8 +231,9 @@
 	local dev="$2"
 	local flags="$3"
 
-	ip netns exec $ns ethtool -K $dev $flags 2>/dev/null
-	[ $? -eq 0 ] && echo "INFO: set $ns dev $dev: ethtool -K $flags"
+	if ip netns exec $ns ethtool -K $dev $flags 2>/dev/null; then
+		echo "INFO: set $ns dev $dev: ethtool -K $flags"
+	fi
 }
 
 set_random_ethtool_flags() {
@@ -321,19 +328,19 @@
 	local extra_args="$7"
 
 	local port
-	port=$((10000+$TEST_COUNT))
+	port=$((10000+TEST_COUNT))
 	TEST_COUNT=$((TEST_COUNT+1))
 
 	if [ "$rcvbuf" -gt 0 ]; then
-		extra_args="$extra_args -R $rcvbuf"
+		extra_args+=" -R $rcvbuf"
 	fi
 
 	if [ "$sndbuf" -gt 0 ]; then
-		extra_args="$extra_args -S $sndbuf"
+		extra_args+=" -S $sndbuf"
 	fi
 
 	if [ -n "$testmode" ]; then
-		extra_args="$extra_args -m $testmode"
+		extra_args+=" -m $testmode"
 	fi
 
 	if [ -n "$extra_args" ] && $options_log; then
@@ -378,12 +385,20 @@
 			nstat -n
 	fi
 
-	local stat_synrx_last_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableSYNRX")
-	local stat_ackrx_last_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableACKRX")
-	local stat_cookietx_last=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtSyncookiesSent")
-	local stat_cookierx_last=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtSyncookiesRecv")
-	local stat_csum_err_s=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtDataCsumErr")
-	local stat_csum_err_c=$(mptcp_lib_get_counter "${connector_ns}" "MPTcpExtDataCsumErr")
+	local stat_synrx_last_l
+	local stat_ackrx_last_l
+	local stat_cookietx_last
+	local stat_cookierx_last
+	local stat_csum_err_s
+	local stat_csum_err_c
+	local stat_tcpfb_last_l
+	stat_synrx_last_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableSYNRX")
+	stat_ackrx_last_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableACKRX")
+	stat_cookietx_last=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtSyncookiesSent")
+	stat_cookierx_last=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtSyncookiesRecv")
+	stat_csum_err_s=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtDataCsumErr")
+	stat_csum_err_c=$(mptcp_lib_get_counter "${connector_ns}" "MPTcpExtDataCsumErr")
+	stat_tcpfb_last_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableFallbackACK")
 
 	timeout ${timeout_test} \
 		ip netns exec ${listener_ns} \
@@ -446,11 +461,19 @@
 	mptcp_lib_check_transfer $cin $sout "file received by server"
 	rets=$?
 
-	local stat_synrx_now_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableSYNRX")
-	local stat_ackrx_now_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableACKRX")
-	local stat_cookietx_now=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtSyncookiesSent")
-	local stat_cookierx_now=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtSyncookiesRecv")
-	local stat_ooo_now=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtTCPOFOQueue")
+	local extra=""
+	local stat_synrx_now_l
+	local stat_ackrx_now_l
+	local stat_cookietx_now
+	local stat_cookierx_now
+	local stat_ooo_now
+	local stat_tcpfb_now_l
+	stat_synrx_now_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableSYNRX")
+	stat_ackrx_now_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableACKRX")
+	stat_cookietx_now=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtSyncookiesSent")
+	stat_cookierx_now=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtSyncookiesRecv")
+	stat_ooo_now=$(mptcp_lib_get_counter "${listener_ns}" "TcpExtTCPOFOQueue")
+	stat_tcpfb_now_l=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtMPCapableFallbackACK")
 
 	expect_synrx=$((stat_synrx_last_l))
 	expect_ackrx=$((stat_ackrx_last_l))
@@ -459,8 +482,8 @@
 	cookies=${cookies##*=}
 
 	if [ ${cl_proto} = "MPTCP" ] && [ ${srv_proto} = "MPTCP" ]; then
-		expect_synrx=$((stat_synrx_last_l+$connect_per_transfer))
-		expect_ackrx=$((stat_ackrx_last_l+$connect_per_transfer))
+		expect_synrx=$((stat_synrx_last_l+connect_per_transfer))
+		expect_ackrx=$((stat_ackrx_last_l+connect_per_transfer))
 	fi
 
 	if [ ${stat_synrx_now_l} -lt ${expect_synrx} ]; then
@@ -468,66 +491,75 @@
 			"${stat_synrx_now_l}" "${expect_synrx}" 1>&2
 		retc=1
 	fi
-	if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} -a ${stat_ooo_now} -eq 0 ]; then
+	if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} ] && [ ${stat_ooo_now} -eq 0 ]; then
 		if [ ${stat_ooo_now} -eq 0 ]; then
 			printf "[ FAIL ] lower MPC ACK rx (%d) than expected (%d)\n" \
 				"${stat_ackrx_now_l}" "${expect_ackrx}" 1>&2
 			rets=1
 		else
-			printf "[ Note ] fallback due to TCP OoO"
+			extra+=" [ Note ] fallback due to TCP OoO"
 		fi
 	fi
 
 	if $checksum; then
-		local csum_err_s=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtDataCsumErr")
-		local csum_err_c=$(mptcp_lib_get_counter "${connector_ns}" "MPTcpExtDataCsumErr")
+		local csum_err_s
+		local csum_err_c
+		csum_err_s=$(mptcp_lib_get_counter "${listener_ns}" "MPTcpExtDataCsumErr")
+		csum_err_c=$(mptcp_lib_get_counter "${connector_ns}" "MPTcpExtDataCsumErr")
 
 		local csum_err_s_nr=$((csum_err_s - stat_csum_err_s))
 		if [ $csum_err_s_nr -gt 0 ]; then
-			printf "[ FAIL ]\nserver got $csum_err_s_nr data checksum error[s]"
+			printf "[ FAIL ]\nserver got %d data checksum error[s]" ${csum_err_s_nr}
 			rets=1
 		fi
 
 		local csum_err_c_nr=$((csum_err_c - stat_csum_err_c))
 		if [ $csum_err_c_nr -gt 0 ]; then
-			printf "[ FAIL ]\nclient got $csum_err_c_nr data checksum error[s]"
+			printf "[ FAIL ]\nclient got %d data checksum error[s]" ${csum_err_c_nr}
 			retc=1
 		fi
 	fi
 
-	if [ $retc -eq 0 ] && [ $rets -eq 0 ]; then
-		printf "[ OK ]"
-		mptcp_lib_result_pass "${TEST_GROUP}: ${result_msg}"
-	else
-		mptcp_lib_result_fail "${TEST_GROUP}: ${result_msg}"
+	if [ ${stat_ooo_now} -eq 0 ] && [ ${stat_tcpfb_last_l} -ne ${stat_tcpfb_now_l} ]; then
+		mptcp_lib_pr_fail "unexpected fallback to TCP"
+		rets=1
 	fi
 
 	if [ $cookies -eq 2 ];then
 		if [ $stat_cookietx_last -ge $stat_cookietx_now ] ;then
-			printf " WARN: CookieSent: did not advance"
+			extra+=" WARN: CookieSent: did not advance"
 		fi
 		if [ $stat_cookierx_last -ge $stat_cookierx_now ] ;then
-			printf " WARN: CookieRecv: did not advance"
+			extra+=" WARN: CookieRecv: did not advance"
 		fi
 	else
 		if [ $stat_cookietx_last -ne $stat_cookietx_now ] ;then
-			printf " WARN: CookieSent: changed"
+			extra+=" WARN: CookieSent: changed"
 		fi
 		if [ $stat_cookierx_last -ne $stat_cookierx_now ] ;then
-			printf " WARN: CookieRecv: changed"
+			extra+=" WARN: CookieRecv: changed"
 		fi
 	fi
 
 	if [ ${stat_synrx_now_l} -gt ${expect_synrx} ]; then
-		printf " WARN: SYNRX: expect %d, got %d (probably retransmissions)" \
-			"${expect_synrx}" "${stat_synrx_now_l}"
+		extra+=" WARN: SYNRX: expect ${expect_synrx},"
+		extra+=" got ${stat_synrx_now_l} (probably retransmissions)"
 	fi
 	if [ ${stat_ackrx_now_l} -gt ${expect_ackrx} ]; then
-		printf " WARN: ACKRX: expect %d, got %d (probably retransmissions)" \
-			"${expect_ackrx}" "${stat_ackrx_now_l}"
+		extra+=" WARN: ACKRX: expect ${expect_ackrx},"
+		extra+=" got ${stat_ackrx_now_l} (probably retransmissions)"
+	fi
+
+	if [ $retc -eq 0 ] && [ $rets -eq 0 ]; then
+		printf "[ OK ]%s\n" "${extra:1}"
+		mptcp_lib_result_pass "${TEST_GROUP}: ${result_msg}"
+	else
+		if [ -n "${extra}" ]; then
+			printf "%s\n" "${extra:1}"
+		fi
+		mptcp_lib_result_fail "${TEST_GROUP}: ${result_msg}"
 	fi
 
-	echo
 	cat "$capout"
 	[ $retc -eq 0 ] && [ $rets -eq 0 ]
 }
@@ -658,7 +690,7 @@
 		return
 	fi
 
-ip netns exec "$listener_ns" nft -f /dev/stdin <<"EOF"
+	if ! ip netns exec "$listener_ns" nft -f /dev/stdin <<"EOF"
 flush ruleset
 table inet mangle {
 	chain divert {
@@ -669,7 +701,7 @@
 	}
 }
 EOF
-	if [ $? -ne 0 ]; then
+	then
 		echo "SKIP: $msg, could not load nft ruleset"
 		mptcp_lib_fail_if_expected_feature "nft rules"
 		mptcp_lib_result_skip "${TEST_GROUP}"
@@ -684,8 +716,7 @@
 		local_addr="0.0.0.0"
 	fi
 
-	ip -net "$listener_ns" $r6flag rule add fwmark 1 lookup 100
-	if [ $? -ne 0 ]; then
+	if ! ip -net "$listener_ns" $r6flag rule add fwmark 1 lookup 100; then
 		ip netns exec "$listener_ns" nft flush ruleset
 		echo "SKIP: $msg, ip $r6flag rule failed"
 		mptcp_lib_fail_if_expected_feature "ip rule"
@@ -693,8 +724,7 @@
 		return
 	fi
 
-	ip -net "$listener_ns" route add local $local_addr/0 dev lo table 100
-	if [ $? -ne 0 ]; then
+	if ! ip -net "$listener_ns" route add local $local_addr/0 dev lo table 100; then
 		ip netns exec "$listener_ns" nft flush ruleset
 		ip -net "$listener_ns" $r6flag rule del fwmark 1 lookup 100
 		echo "SKIP: $msg, ip route add local $local_addr failed"
@@ -854,10 +884,10 @@
 stop_if_error "Could not even run ping tests"
 
 [ -n "$tc_loss" ] && tc -net "$ns2" qdisc add dev ns2eth3 root netem loss random $tc_loss delay ${tc_delay}ms
-echo -n "INFO: Using loss of $tc_loss "
-test "$tc_delay" -gt 0 && echo -n "delay $tc_delay ms "
+tc_info="loss of $tc_loss "
+test "$tc_delay" -gt 0 && tc_info+="delay $tc_delay ms "
 
-reorder_delay=$(($tc_delay / 4))
+reorder_delay=$((tc_delay / 4))
 
 if [ -z "${tc_reorder}" ]; then
 	reorder1=$((RANDOM%10))
@@ -866,17 +896,17 @@
 
 	if [ $reorder_delay -gt 0 ] && [ $reorder1 -lt 100 ] && [ $reorder2 -gt 0 ]; then
 		tc_reorder="reorder ${reorder1}% ${reorder2}%"
-		echo -n "$tc_reorder with delay ${reorder_delay}ms "
+		tc_info+="$tc_reorder with delay ${reorder_delay}ms "
 	fi
 elif [ "$tc_reorder" = "0" ];then
 	tc_reorder=""
 elif [ "$reorder_delay" -gt 0 ];then
 	# reordering requires some delay
 	tc_reorder="reorder $tc_reorder"
-	echo -n "$tc_reorder with delay ${reorder_delay}ms "
+	tc_info+="$tc_reorder with delay ${reorder_delay}ms "
 fi
 
-echo "on ns3eth4"
+echo "INFO: Using ${tc_info}on ns3eth4"
 
 tc -net "$ns3" qdisc add dev ns3eth4 root netem delay ${reorder_delay}ms $tc_reorder
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -21,7 +21,9 @@
 cinsent=""
 tmpfile=""
 cout=""
+err=""
 capout=""
+cappid=""
 ns1=""
 ns2=""
 ksft_skip=4
@@ -29,11 +31,11 @@
 ip6tables="ip6tables"
 timeout_poll=30
 timeout_test=$((timeout_poll * 2 + 1))
-capture=0
-checksum=0
+capture=false
+checksum=false
 ip_mptcp=0
 check_invert=0
-validate_checksum=0
+validate_checksum=false
 init=0
 evts_ns1=""
 evts_ns2=""
@@ -100,7 +102,7 @@
 		ip netns exec $netns sysctl -q net.mptcp.pm_type=0 2>/dev/null || true
 		ip netns exec $netns sysctl -q net.ipv4.conf.all.rp_filter=0
 		ip netns exec $netns sysctl -q net.ipv4.conf.default.rp_filter=0
-		if [ $checksum -eq 1 ]; then
+		if $checksum; then
 			ip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1
 		fi
 	done
@@ -135,8 +137,8 @@
 {
 	local i
 	for i in $(seq 1 4); do
-		tc -n $ns1 qdisc add dev ns1eth$i root netem rate 20mbit delay 1
-		tc -n $ns2 qdisc add dev ns2eth$i root netem rate 20mbit delay 1
+		tc -n $ns1 qdisc add dev ns1eth$i root netem rate 20mbit delay 1ms
+		tc -n $ns2 qdisc add dev ns2eth$i root netem rate 20mbit delay 1ms
 	done
 }
 
@@ -189,6 +191,7 @@
 	cin=$(mktemp)
 	cinsent=$(mktemp)
 	cout=$(mktemp)
+	err=$(mktemp)
 	evts_ns1=$(mktemp)
 	evts_ns2=$(mktemp)
 
@@ -204,6 +207,7 @@
 	rm -f "$sin" "$sout" "$cinsent" "$cinfail"
 	rm -f "$tmpfile"
 	rm -rf $evts_ns1 $evts_ns2
+	rm -f "$err"
 	cleanup_partial
 }
 
@@ -307,6 +311,8 @@
 
 	TEST_COUNT=$((TEST_COUNT+1))
 
+	MPTCP_LIB_SUBTEST_FLAKY=0 # reset if modified
+
 	if skip_test; then
 		last_test_ignored=1
 		return 1
@@ -385,7 +391,7 @@
 	ip netns exec $ns1 sysctl -q net.mptcp.checksum_enabled=$ns1_enable
 	ip netns exec $ns2 sysctl -q net.mptcp.checksum_enabled=$ns2_enable
 
-	validate_checksum=1
+	validate_checksum=true
 }
 
 reset_with_allow_join_id0()
@@ -418,7 +424,7 @@
 setup_fail_rules()
 {
 	check_invert=1
-	validate_checksum=1
+	validate_checksum=true
 	local i="$1"
 	local ip="${2:-4}"
 	local tables
@@ -463,16 +469,17 @@
 	fi
 }
 
+start_events()
+{
+	mptcp_lib_events "${ns1}" "${evts_ns1}" evts_ns1_pid
+	mptcp_lib_events "${ns2}" "${evts_ns2}" evts_ns2_pid
+}
+
 reset_with_events()
 {
 	reset "${1}" || return 1
 
-	:> "$evts_ns1"
-	:> "$evts_ns2"
-	ip netns exec $ns1 ./pm_nl_ctl events >> "$evts_ns1" 2>&1 &
-	evts_ns1_pid=$!
-	ip netns exec $ns2 ./pm_nl_ctl events >> "$evts_ns2" 2>&1 &
-	evts_ns2_pid=$!
+	start_events
 }
 
 reset_with_tcp_filter()
@@ -483,9 +490,10 @@
 	local ns="${!1}"
 	local src="${2}"
 	local target="${3}"
+	local chain="${4:-INPUT}"
 
 	if ! ip netns exec "${ns}" ${iptables} \
-			-A INPUT \
+			-A "${chain}" \
 			-s "${src}" \
 			-p tcp \
 			-j "${target}"; then
@@ -499,6 +507,10 @@
 {
 	ret=1
 
+	if ! mptcp_lib_subtest_is_flaky; then
+		ret=${KSFT_FAIL}
+	fi
+
 	print_fail "${@}"
 
 	# just in case a test is marked twice as failed
@@ -645,7 +657,9 @@
 kill_events_pids()
 {
 	mptcp_lib_kill_wait $evts_ns1_pid
+	evts_ns1_pid=0
 	mptcp_lib_kill_wait $evts_ns2_pid
+	evts_ns2_pid=0
 }
 
 pm_nl_set_limits()
@@ -773,7 +787,7 @@
 			[ -n "$_flags" ]; flags="flags $_flags"
 			shift
 		elif [ $1 = "dev" ]; then
-			[ -n "$2" ]; dev="dev $1"
+			[ -n "$2" ]; dev="dev $2"
 			shift
 		elif [ $1 = "id" ]; then
 			_id=$2
@@ -789,7 +803,7 @@
 	done
 
 	if [ -z "$id" ]; then
-		test_fail "bad test - missing endpoint id"
+		fail_test "bad test - missing endpoint id"
 		return
 	fi
 
@@ -799,18 +813,18 @@
 		line="${line% }"
 		# the dump order is: address id flags port dev
 		[ -n "$addr" ] && expected_line="$addr"
-		expected_line="$expected_line $id"
-		[ -n "$_flags" ] && expected_line="$expected_line ${_flags//","/" "}"
-		[ -n "$dev" ] && expected_line="$expected_line $dev"
-		[ -n "$port" ] && expected_line="$expected_line $port"
+		expected_line+=" $id"
+		[ -n "$_flags" ] && expected_line+=" ${_flags//","/" "}"
+		[ -n "$dev" ] && expected_line+=" $dev"
+		[ -n "$port" ] && expected_line+=" $port"
 	else
 		line=$(ip netns exec $ns ./pm_nl_ctl get $_id)
 		# the dump order is: id flags dev address port
 		expected_line="$id"
-		[ -n "$flags" ] && expected_line="$expected_line $flags"
-		[ -n "$dev" ] && expected_line="$expected_line $dev"
-		[ -n "$addr" ] && expected_line="$expected_line $addr"
-		[ -n "$_port" ] && expected_line="$expected_line $_port"
+		[ -n "$flags" ] && expected_line+=" $flags"
+		[ -n "$dev" ] && expected_line+=" $dev"
+		[ -n "$addr" ] && expected_line+=" $addr"
+		[ -n "$_port" ] && expected_line+=" $_port"
 	fi
 	if [ "$line" = "$expected_line" ]; then
 		print_ok
@@ -1004,40 +1018,62 @@
 	fi
 }
 
-do_transfer()
+cond_start_capture()
 {
-	local listener_ns="$1"
-	local connector_ns="$2"
-	local cl_proto="$3"
-	local srv_proto="$4"
-	local connect_addr="$5"
-
-	local port=$((10000 + TEST_COUNT - 1))
-	local cappid
-	local FAILING_LINKS=${FAILING_LINKS:-""}
-	local fastclose=${fastclose:-""}
-	local speed=${speed:-"fast"}
+	local ns="$1"
 
-	:> "$cout"
-	:> "$sout"
 	:> "$capout"
 
-	if [ $capture -eq 1 ]; then
-		local capuser
-		if [ -z $SUDO_USER ] ; then
+	if $capture; then
+		local capuser capfile
+		if [ -z $SUDO_USER ]; then
 			capuser=""
 		else
 			capuser="-Z $SUDO_USER"
 		fi
 
-		capfile=$(printf "mp_join-%02u-%s.pcap" "$TEST_COUNT" "${listener_ns}")
+		capfile=$(printf "mp_join-%02u-%s.pcap" "$TEST_COUNT" "$ns")
 
 		echo "Capturing traffic for test $TEST_COUNT into $capfile"
-		ip netns exec ${listener_ns} tcpdump -i any -s 65535 -B 32768 $capuser -w $capfile > "$capout" 2>&1 &
+		ip netns exec "$ns" tcpdump -i any -s 65535 -B 32768 $capuser -w "$capfile" > "$capout" 2>&1 &
 		cappid=$!
 
 		sleep 1
 	fi
+}
+
+cond_stop_capture()
+{
+	if $capture; then
+		sleep 1
+		kill $cappid
+		cat "$capout"
+	fi
+}
+
+get_port()
+{
+	echo "$((10000 + TEST_COUNT - 1))"
+}
+
+do_transfer()
+{
+	local listener_ns="$1"
+	local connector_ns="$2"
+	local cl_proto="$3"
+	local srv_proto="$4"
+	local connect_addr="$5"
+	local port
+
+	local FAILING_LINKS=${FAILING_LINKS:-""}
+	local fastclose=${fastclose:-""}
+	local speed=${speed:-"fast"}
+	port=$(get_port)
+
+	:> "$cout"
+	:> "$sout"
+
+	cond_start_capture ${listener_ns}
 
 	NSTAT_HISTORY=/tmp/${listener_ns}.nstat ip netns exec ${listener_ns} \
 		nstat -n
@@ -1124,10 +1160,7 @@
 	wait $spid
 	local rets=$?
 
-	if [ $capture -eq 1 ]; then
-	    sleep 1
-	    kill $cappid
-	fi
+	cond_stop_capture
 
 	NSTAT_HISTORY=/tmp/${listener_ns}.nstat ip netns exec ${listener_ns} \
 		nstat | grep Tcp > /tmp/${listener_ns}.out
@@ -1143,7 +1176,6 @@
 		ip netns exec ${connector_ns} ss -Menita 1>&2 -o "dport = :$port"
 		cat /tmp/${connector_ns}.out
 
-		cat "$capout"
 		return 1
 	fi
 
@@ -1160,13 +1192,7 @@
 	fi
 	rets=$?
 
-	if [ $retc -eq 0 ] && [ $rets -eq 0 ];then
-		cat "$capout"
-		return 0
-	fi
-
-	cat "$capout"
-	return 1
+	[ $retc -eq 0 ] && [ $rets -eq 0 ]
 }
 
 make_file()
@@ -1260,26 +1286,26 @@
 
 	print_check "sum"
 	count=$(mptcp_lib_get_counter ${ns1} "MPTcpExtDataCsumErr")
-	if [ "$count" != "$csum_ns1" ]; then
-		extra_msg="$extra_msg ns1=$count"
+	if [ -n "$count" ] && [ "$count" != "$csum_ns1" ]; then
+		extra_msg+=" ns1=$count"
 	fi
 	if [ -z "$count" ]; then
 		print_skip
 	elif { [ "$count" != $csum_ns1 ] && [ $allow_multi_errors_ns1 -eq 0 ]; } ||
-	   { [ "$count" -lt $csum_ns1 ] && [ $allow_multi_errors_ns1 -eq 1 ]; }; then
+	     { [ "$count" -lt $csum_ns1 ] && [ $allow_multi_errors_ns1 -eq 1 ]; }; then
 		fail_test "got $count data checksum error[s] expected $csum_ns1"
 	else
 		print_ok
 	fi
 	print_check "csum"
 	count=$(mptcp_lib_get_counter ${ns2} "MPTcpExtDataCsumErr")
-	if [ "$count" != "$csum_ns2" ]; then
-		extra_msg="$extra_msg ns2=$count"
+	if [ -n "$count" ] && [ "$count" != "$csum_ns2" ]; then
+		extra_msg+=" ns2=$count"
 	fi
 	if [ -z "$count" ]; then
 		print_skip
 	elif { [ "$count" != $csum_ns2 ] && [ $allow_multi_errors_ns2 -eq 0 ]; } ||
-	   { [ "$count" -lt $csum_ns2 ] && [ $allow_multi_errors_ns2 -eq 1 ]; }; then
+	     { [ "$count" -lt $csum_ns2 ] && [ $allow_multi_errors_ns2 -eq 1 ]; }; then
 		fail_test "got $count data checksum error[s] expected $csum_ns2"
 	else
 		print_ok
@@ -1317,13 +1343,13 @@
 
 	print_check "ftx"
 	count=$(mptcp_lib_get_counter ${ns_tx} "MPTcpExtMPFailTx")
-	if [ "$count" != "$fail_tx" ]; then
-		extra_msg="$extra_msg,tx=$count"
+	if [ -n "$count" ] && [ "$count" != "$fail_tx" ]; then
+		extra_msg+=",tx=$count"
 	fi
 	if [ -z "$count" ]; then
 		print_skip
 	elif { [ "$count" != "$fail_tx" ] && [ $allow_tx_lost -eq 0 ]; } ||
-	   { [ "$count" -gt "$fail_tx" ] && [ $allow_tx_lost -eq 1 ]; }; then
+	     { [ "$count" -gt "$fail_tx" ] && [ $allow_tx_lost -eq 1 ]; }; then
 		fail_test "got $count MP_FAIL[s] TX expected $fail_tx"
 	else
 		print_ok
@@ -1331,13 +1357,13 @@
 
 	print_check "failrx"
 	count=$(mptcp_lib_get_counter ${ns_rx} "MPTcpExtMPFailRx")
-	if [ "$count" != "$fail_rx" ]; then
-		extra_msg="$extra_msg,rx=$count"
+	if [ -n "$count" ] && [ "$count" != "$fail_rx" ]; then
+		extra_msg+=",rx=$count"
 	fi
 	if [ -z "$count" ]; then
 		print_skip
 	elif { [ "$count" != "$fail_rx" ] && [ $allow_rx_lost -eq 0 ]; } ||
-	   { [ "$count" -gt "$fail_rx" ] && [ $allow_rx_lost -eq 1 ]; }; then
+	     { [ "$count" -gt "$fail_rx" ] && [ $allow_rx_lost -eq 1 ]; }; then
 		fail_test "got $count MP_FAIL[s] RX expected $fail_rx"
 	else
 		print_ok
@@ -1367,7 +1393,7 @@
 	if [ -z "$count" ]; then
 		print_skip
 	elif [ "$count" != "$fclose_tx" ]; then
-		extra_msg="$extra_msg,tx=$count"
+		extra_msg+=",tx=$count"
 		fail_test "got $count MP_FASTCLOSE[s] TX expected $fclose_tx"
 	else
 		print_ok
@@ -1378,7 +1404,7 @@
 	if [ -z "$count" ]; then
 		print_skip
 	elif [ "$count" != "$fclose_rx" ]; then
-		extra_msg="$extra_msg,rx=$count"
+		extra_msg+=",rx=$count"
 		fail_test "got $count MP_FASTCLOSE[s] RX expected $fclose_rx"
 	else
 		print_ok
@@ -1512,7 +1538,7 @@
 	else
 		print_ok
 	fi
-	if [ $validate_checksum -eq 1 ]; then
+	if $validate_checksum; then
 		chk_csum_nr $csum_ns1 $csum_ns2
 		chk_fail_nr $fail_nr $fail_nr
 		chk_rst_nr $rst_nr $rst_nr
@@ -1564,18 +1590,28 @@
 	local add_nr=$1
 	local echo_nr=$2
 	local port_nr=${3:-0}
-	local syn_nr=${4:-$port_nr}
-	local syn_ack_nr=${5:-$port_nr}
-	local ack_nr=${6:-$port_nr}
-	local mis_syn_nr=${7:-0}
-	local mis_ack_nr=${8:-0}
+	local ns_invert=${4:-""}
+	local syn_nr=$port_nr
+	local syn_ack_nr=$port_nr
+	local ack_nr=$port_nr
+	local mis_syn_nr=0
+	local mis_ack_nr=0
+	local ns_tx=$ns1
+	local ns_rx=$ns2
+	local extra_msg=""
 	local count
 	local timeout
 
-	timeout=$(ip netns exec $ns1 sysctl -n net.mptcp.add_addr_timeout)
+	if [[ $ns_invert = "invert" ]]; then
+		ns_tx=$ns2
+		ns_rx=$ns1
+		extra_msg="invert"
+	fi
+
+	timeout=$(ip netns exec ${ns_tx} sysctl -n net.mptcp.add_addr_timeout)
 
 	print_check "add"
-	count=$(mptcp_lib_get_counter ${ns2} "MPTcpExtAddAddr")
+	count=$(mptcp_lib_get_counter ${ns_rx} "MPTcpExtAddAddr")
 	if [ -z "$count" ]; then
 		print_skip
 	# if the test configured a short timeout tolerate greater then expected
@@ -1587,7 +1623,7 @@
 	fi
 
 	print_check "echo"
-	count=$(mptcp_lib_get_counter ${ns1} "MPTcpExtEchoAdd")
+	count=$(mptcp_lib_get_counter ${ns_tx} "MPTcpExtEchoAdd")
 	if [ -z "$count" ]; then
 		print_skip
 	elif [ "$count" != "$echo_nr" ]; then
@@ -1598,7 +1634,7 @@
 
 	if [ $port_nr -gt 0 ]; then
 		print_check "pt"
-		count=$(mptcp_lib_get_counter ${ns2} "MPTcpExtPortAdd")
+		count=$(mptcp_lib_get_counter ${ns_rx} "MPTcpExtPortAdd")
 		if [ -z "$count" ]; then
 			print_skip
 		elif [ "$count" != "$port_nr" ]; then
@@ -1608,7 +1644,7 @@
 		fi
 
 		print_check "syn"
-		count=$(mptcp_lib_get_counter ${ns1} "MPTcpExtMPJoinPortSynRx")
+		count=$(mptcp_lib_get_counter ${ns_tx} "MPTcpExtMPJoinPortSynRx")
 		if [ -z "$count" ]; then
 			print_skip
 		elif [ "$count" != "$syn_nr" ]; then
@@ -1619,7 +1655,7 @@
 		fi
 
 		print_check "synack"
-		count=$(mptcp_lib_get_counter ${ns2} "MPTcpExtMPJoinPortSynAckRx")
+		count=$(mptcp_lib_get_counter ${ns_rx} "MPTcpExtMPJoinPortSynAckRx")
 		if [ -z "$count" ]; then
 			print_skip
 		elif [ "$count" != "$syn_ack_nr" ]; then
@@ -1630,7 +1666,7 @@
 		fi
 
 		print_check "ack"
-		count=$(mptcp_lib_get_counter ${ns1} "MPTcpExtMPJoinPortAckRx")
+		count=$(mptcp_lib_get_counter ${ns_tx} "MPTcpExtMPJoinPortAckRx")
 		if [ -z "$count" ]; then
 			print_skip
 		elif [ "$count" != "$ack_nr" ]; then
@@ -1641,7 +1677,7 @@
 		fi
 
 		print_check "syn"
-		count=$(mptcp_lib_get_counter ${ns1} "MPTcpExtMismatchPortSynRx")
+		count=$(mptcp_lib_get_counter ${ns_tx} "MPTcpExtMismatchPortSynRx")
 		if [ -z "$count" ]; then
 			print_skip
 		elif [ "$count" != "$mis_syn_nr" ]; then
@@ -1652,7 +1688,7 @@
 		fi
 
 		print_check "ack"
-		count=$(mptcp_lib_get_counter ${ns1} "MPTcpExtMismatchPortAckRx")
+		count=$(mptcp_lib_get_counter ${ns_tx} "MPTcpExtMismatchPortAckRx")
 		if [ -z "$count" ]; then
 			print_skip
 		elif [ "$count" != "$mis_ack_nr" ]; then
@@ -1662,6 +1698,8 @@
 			print_ok
 		fi
 	fi
+
+	print_info "$extra_msg"
 }
 
 chk_add_tx_nr()
@@ -1747,7 +1785,7 @@
 		count=$((count + cnt))
 		if [ "$count" != "$rm_subflow_nr" ]; then
 			suffix="$count in [$rm_subflow_nr:$((rm_subflow_nr*2))]"
-			extra_msg="$extra_msg simult"
+			extra_msg+=" simult"
 		fi
 		if [ $count -ge "$rm_subflow_nr" ] && \
 		   [ "$count" -le "$((rm_subflow_nr *2 ))" ]; then
@@ -1783,6 +1821,8 @@
 {
 	local mp_prio_nr_tx=$1
 	local mp_prio_nr_rx=$2
+	local mpj_syn=$3
+	local mpj_syn_ack=$4
 	local count
 
 	print_check "ptx"
@@ -1804,6 +1844,26 @@
 	else
 		print_ok
 	fi
+
+	print_check "syn backup"
+	count=$(mptcp_lib_get_counter ${ns1} "MPTcpExtMPJoinSynBackupRx")
+	if [ -z "$count" ]; then
+		print_skip
+	elif [ "$count" != "$mpj_syn" ]; then
+		fail_test "got $count JOIN[s] syn with Backup expected $mpj_syn"
+	else
+		print_ok
+	fi
+
+	print_check "synack backup"
+	count=$(mptcp_lib_get_counter ${ns2} "MPTcpExtMPJoinSynAckBackupRx")
+	if [ -z "$count" ]; then
+		print_skip
+	elif [ "$count" != "$mpj_syn_ack" ]; then
+		fail_test "got $count JOIN[s] synack with Backup expected $mpj_syn_ack"
+	else
+		print_ok
+	fi
 }
 
 chk_subflow_nr()
@@ -2104,6 +2164,21 @@
 		chk_add_nr 1 1
 	fi
 
+	# uncommon: subflow and signal flags on the same endpoint
+	# or because the user wrongly picked both, but still expects the client
+	# to create additional subflows
+	if reset "subflow and signal together"; then
+		pm_nl_set_limits $ns1 0 2
+		pm_nl_set_limits $ns2 0 2
+		pm_nl_add_endpoint $ns2 10.0.3.2 flags signal,subflow
+		run_tests $ns1 $ns2 10.0.1.1
+		chk_join_nr 1 1 1
+		chk_add_nr 1 1 0 invert  # only initiated by ns2
+		chk_add_nr 0 0 0         # none initiated by ns1
+		chk_rst_nr 0 0 invert    # no RST sent by the client
+		chk_rst_nr 0 0           # no RST sent by the server
+	fi
+
 	# accept and use add_addr with additional subflows
 	if reset "multiple subflows and signal"; then
 		pm_nl_set_limits $ns1 0 3
@@ -2398,9 +2473,10 @@
 	if reset "remove invalid addresses"; then
 		pm_nl_set_limits $ns1 3 3
 		pm_nl_add_endpoint $ns1 10.0.12.1 flags signal
+		# broadcast IP: no packet for this address will be received on ns1
+		pm_nl_add_endpoint $ns1 224.0.0.1 flags signal
 		pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
-		pm_nl_add_endpoint $ns1 10.0.14.1 flags signal
-		pm_nl_set_limits $ns2 3 3
+		pm_nl_set_limits $ns2 2 2
 		addr_nr_ns1=-3 speed=10 \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 1 1 1
@@ -2760,33 +2836,46 @@
 		sflags=nobackup speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 1 1 1
-		chk_prio_nr 0 1
+		chk_prio_nr 0 1 1 0
 	fi
 
 	# single address, backup
 	if reset "single address, backup" &&
 	   continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
 		pm_nl_set_limits $ns1 0 1
+		pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup
+		pm_nl_set_limits $ns2 1 1
+		sflags=nobackup speed=slow \
+			run_tests $ns1 $ns2 10.0.1.1
+		chk_join_nr 1 1 1
+		chk_add_nr 1 1
+		chk_prio_nr 1 0 0 1
+	fi
+
+	# single address, switch to backup
+	if reset "single address, switch to backup" &&
+	   continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
+		pm_nl_set_limits $ns1 0 1
 		pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
 		pm_nl_set_limits $ns2 1 1
 		sflags=backup speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 1 1 1
 		chk_add_nr 1 1
-		chk_prio_nr 1 1
+		chk_prio_nr 1 1 0 0
 	fi
 
 	# single address with port, backup
 	if reset "single address with port, backup" &&
 	   continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
 		pm_nl_set_limits $ns1 0 1
-		pm_nl_add_endpoint $ns1 10.0.2.1 flags signal port 10100
+		pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup port 10100
 		pm_nl_set_limits $ns2 1 1
-		sflags=backup speed=slow \
+		sflags=nobackup speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 1 1 1
 		chk_add_nr 1 1
-		chk_prio_nr 1 1
+		chk_prio_nr 1 0 0 1
 	fi
 
 	if reset "mpc backup" &&
@@ -2795,17 +2884,26 @@
 		speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 0 0 0
-		chk_prio_nr 0 1
+		chk_prio_nr 0 1 0 0
 	fi
 
 	if reset "mpc backup both sides" &&
 	   continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then
-		pm_nl_add_endpoint $ns1 10.0.1.1 flags subflow,backup
+		pm_nl_set_limits $ns1 0 2
+		pm_nl_set_limits $ns2 1 2
+		pm_nl_add_endpoint $ns1 10.0.1.1 flags signal,backup
 		pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,backup
+
+		# 10.0.2.2 (non-backup) -> 10.0.1.1 (backup)
+		pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow
+		# 10.0.1.2 (backup) -> 10.0.2.1 (non-backup)
+		pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
+		ip -net "$ns2" route add 10.0.2.1 via 10.0.1.1 dev ns2eth1 # force this path
+
 		speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
-		chk_join_nr 0 0 0
-		chk_prio_nr 1 1
+		chk_join_nr 2 2 2
+		chk_prio_nr 1 1 1 1
 	fi
 
 	if reset "mpc switch to backup" &&
@@ -2814,7 +2912,7 @@
 		sflags=backup speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 0 0 0
-		chk_prio_nr 0 1
+		chk_prio_nr 0 1 0 0
 	fi
 
 	if reset "mpc switch to backup both sides" &&
@@ -2824,17 +2922,10 @@
 		sflags=backup speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 0 0 0
-		chk_prio_nr 1 1
+		chk_prio_nr 1 1 0 0
 	fi
 }
 
-SUB_ESTABLISHED=10 # MPTCP_EVENT_SUB_ESTABLISHED
-LISTENER_CREATED=15 #MPTCP_EVENT_LISTENER_CREATED
-LISTENER_CLOSED=16  #MPTCP_EVENT_LISTENER_CLOSED
-
-AF_INET=2
-AF_INET6=10
-
 verify_listener_events()
 {
 	local evt=$1
@@ -2848,9 +2939,9 @@
 	local sport
 	local name
 
-	if [ $e_type = $LISTENER_CREATED ]; then
+	if [ $e_type = $MPTCP_LIB_EVENT_LISTENER_CREATED ]; then
 		name="LISTENER_CREATED"
-	elif [ $e_type = $LISTENER_CLOSED ]; then
+	elif [ $e_type = $MPTCP_LIB_EVENT_LISTENER_CLOSED ]; then
 		name="LISTENER_CLOSED "
 	else
 		name="$e_type"
@@ -2882,6 +2973,32 @@
 	fail_test "$e_type:$type $e_family:$family $e_saddr:$saddr $e_sport:$sport"
 }
 
+chk_mpc_endp_attempt()
+{
+	local retl=$1
+	local attempts=$2
+
+	print_check "Connect"
+
+	if [ ${retl} = 124 ]; then
+		fail_test "timeout on connect"
+	elif [ ${retl} = 0 ]; then
+		fail_test "unexpected successful connect"
+	else
+		print_ok
+
+		print_check "Attempts"
+		count=$(mptcp_lib_get_counter ${ns1} "MPTcpExtMPCapableEndpAttempt")
+		if [ -z "$count" ]; then
+			print_skip
+		elif [ "$count" != "$attempts" ]; then
+			fail_test "got ${count} MPC attempt[s] on port-based endpoint, expected ${attempts}"
+		else
+			print_ok
+		fi
+	fi
+}
+
 add_addr_ports_tests()
 {
 	# signal address with port
@@ -2917,8 +3034,10 @@
 		chk_add_nr 1 1 1
 		chk_rm_nr 1 1 invert
 
-		verify_listener_events $evts_ns1 $LISTENER_CREATED $AF_INET 10.0.2.1 10100
-		verify_listener_events $evts_ns1 $LISTENER_CLOSED $AF_INET 10.0.2.1 10100
+		verify_listener_events $evts_ns1 $MPTCP_LIB_EVENT_LISTENER_CREATED \
+				       $MPTCP_LIB_AF_INET 10.0.2.1 10100
+		verify_listener_events $evts_ns1 $MPTCP_LIB_EVENT_LISTENER_CLOSED \
+				       $MPTCP_LIB_AF_INET 10.0.2.1 10100
 		kill_events_pids
 	fi
 
@@ -2970,6 +3089,22 @@
 		chk_join_nr 2 2 2
 		chk_add_nr 2 2 2
 	fi
+
+	if reset "port-based signal endpoint must not accept mpc"; then
+		local port retl count
+		port=$(get_port)
+
+		cond_start_capture ${ns1}
+		pm_nl_add_endpoint ${ns1} 10.0.2.1 flags signal port ${port}
+		mptcp_lib_wait_local_port_listen ${ns1} ${port}
+
+		timeout 1 ip netns exec ${ns2} \
+			./mptcp_connect -t ${timeout_poll} -p $port -s MPTCP 10.0.2.1 >/dev/null 2>&1
+		retl=$?
+		cond_stop_capture
+
+		chk_mpc_endp_attempt ${retl} 1
+	fi
 }
 
 syncookies_tests()
@@ -3158,6 +3293,9 @@
 		pm_nl_set_limits $ns1 1 3
 		pm_nl_set_limits $ns2 1 3
 		pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
+		if mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then
+			pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,fullmesh
+		fi
 		fullmesh=1 speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 3 3 3
@@ -3224,7 +3362,7 @@
 		addr_nr_ns2=1 sflags=backup,fullmesh speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 2 2 2
-		chk_prio_nr 0 1
+		chk_prio_nr 0 1 1 0
 		chk_rm_nr 0 1
 	fi
 
@@ -3237,7 +3375,7 @@
 		sflags=nobackup,nofullmesh speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 2 2 2
-		chk_prio_nr 0 1
+		chk_prio_nr 0 1 1 0
 		chk_rm_nr 0 1
 	fi
 }
@@ -3245,6 +3383,7 @@
 fastclose_tests()
 {
 	if reset_check_counter "fastclose test" "MPTcpExtMPFastcloseTx"; then
+		MPTCP_LIB_SUBTEST_FLAKY=1
 		test_linkfail=1024 fastclose=client \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 0 0 0
@@ -3253,6 +3392,7 @@
 	fi
 
 	if reset_check_counter "fastclose server test" "MPTcpExtMPFastcloseRx"; then
+		MPTCP_LIB_SUBTEST_FLAKY=1
 		test_linkfail=1024 fastclose=server \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 0 0 0 0 0 0 1
@@ -3271,6 +3411,7 @@
 {
 	# single subflow
 	if reset_with_fail "Infinite map" 1; then
+		MPTCP_LIB_SUBTEST_FLAKY=1
 		test_linkfail=128 \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 0 0 0 +1 +0 1 0 1 "$(pedit_action_pkts)"
@@ -3279,7 +3420,8 @@
 
 	# multiple subflows
 	if reset_with_fail "MP_FAIL MP_RST" 2; then
-		tc -n $ns2 qdisc add dev ns2eth1 root netem rate 1mbit delay 5
+		MPTCP_LIB_SUBTEST_FLAKY=1
+		tc -n $ns2 qdisc add dev ns2eth1 root netem rate 1mbit delay 5ms
 		pm_nl_set_limits $ns1 0 1
 		pm_nl_set_limits $ns2 0 1
 		pm_nl_add_endpoint $ns2 10.0.2.2 dev ns2eth2 flags subflow
@@ -3356,6 +3498,107 @@
 	wait_rm_sf $1 "${cnt}"
 }
 
+check_output()
+{
+	local cmd="$1"
+	local expected="$2"
+	local msg="$3"
+	local rc=0
+
+	mptcp_lib_check_output "${err}" "${cmd}" "${expected}" || rc=${?}
+	if [ ${rc} -eq 2 ]; then
+		fail_test "fail to check output # error ${rc}"
+	elif [ ${rc} -eq 0 ]; then
+		print_ok
+	elif [ ${rc} -eq 1 ]; then
+		fail_test "fail to check output # different output"
+	fi
+}
+
+# $1: ns
+userspace_pm_dump()
+{
+	local evts=$evts_ns1
+	local tk
+
+	[ "$1" == "$ns2" ] && evts=$evts_ns2
+	tk=$(mptcp_lib_evts_get_info token "$evts")
+
+	ip netns exec $1 ./pm_nl_ctl dump token $tk
+}
+
+# $1: ns ; $2: id
+userspace_pm_get_addr()
+{
+	local evts=$evts_ns1
+	local tk
+
+	[ "$1" == "$ns2" ] && evts=$evts_ns2
+	tk=$(mptcp_lib_evts_get_info token "$evts")
+
+	ip netns exec $1 ./pm_nl_ctl get $2 token $tk
+}
+
+userspace_pm_chk_dump_addr()
+{
+	local ns="${1}"
+	local exp="${2}"
+	local check="${3}"
+
+	print_check "dump addrs ${check}"
+
+	if false && mptcp_lib_kallsyms_has "mptcp_userspace_pm_dump_addr$"; then
+		check_output "userspace_pm_dump ${ns}" "${exp}"
+	else
+		print_skip
+	fi
+}
+
+userspace_pm_chk_get_addr()
+{
+	local ns="${1}"
+	local id="${2}"
+	local exp="${3}"
+
+	print_check "get id ${id} addr"
+
+	if false && mptcp_lib_kallsyms_has "mptcp_userspace_pm_get_addr$"; then
+		check_output "userspace_pm_get_addr ${ns} ${id}" "${exp}"
+	else
+		print_skip
+	fi
+}
+
+# $1: ns ; $2: event type ; $3: count
+chk_evt_nr()
+{
+	local ns=${1}
+	local evt_name="${2}"
+	local exp="${3}"
+
+	local evts="${evts_ns1}"
+	local evt="${!evt_name}"
+	local count
+
+	evt_name="${evt_name:16}" # without MPTCP_LIB_EVENT_
+	[ "${ns}" == "ns2" ] && evts="${evts_ns2}"
+
+	print_check "event ${ns} ${evt_name} (${exp})"
+
+	if [[ "${evt_name}" = "LISTENER_"* ]] &&
+	   ! mptcp_lib_kallsyms_has "mptcp_event_pm_listener$"; then
+		print_skip "event not supported"
+		return
+	fi
+
+	count=$(grep -cw "type:${evt}" "${evts}")
+	if [ "${count}" != "${exp}" ]; then
+		fail_test "got ${count} events, expected ${exp}"
+	else
+		print_ok
+	fi
+}
+
 userspace_tests()
 {
 	# userspace pm type prevents add_addr
@@ -3414,7 +3657,7 @@
 		sflags=backup speed=slow \
 			run_tests $ns1 $ns2 10.0.1.1
 		chk_join_nr 1 1 0
-		chk_prio_nr 0 0
+		chk_prio_nr 0 0 0 0
 	fi
 
 	# userspace pm type prevents rm_addr
@@ -3447,11 +3690,17 @@
 		chk_mptcp_info subflows 2 subflows 2
 		chk_subflows_total 3 3
 		chk_mptcp_info add_addr_signal 2 add_addr_accepted 2
-		userspace_pm_rm_addr $ns1 10
-		userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED
+		userspace_pm_chk_dump_addr "${ns1}" \
+			$'id 10 flags signal 10.0.2.1\nid 20 flags signal 10.0.3.1' \
+			"signal"
+		userspace_pm_chk_get_addr "${ns1}" "10" "id 10 flags signal 10.0.2.1"
+		userspace_pm_chk_get_addr "${ns1}" "20" "id 20 flags signal 10.0.3.1"
+		userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $MPTCP_LIB_EVENT_SUB_ESTABLISHED
+		userspace_pm_chk_dump_addr "${ns1}" \
+			"id 20 flags signal 10.0.3.1" "after rm_sf 10"
 		userspace_pm_rm_addr $ns1 20
-		userspace_pm_rm_sf $ns1 10.0.3.1 $SUB_ESTABLISHED
-		chk_rm_nr 2 2 invert
+		userspace_pm_chk_dump_addr "${ns1}" "" "after rm_addr 20"
+		chk_rm_nr 1 1 invert
 		chk_mptcp_info subflows 0 subflows 0
 		chk_subflows_total 1 1
 		kill_events_pids
@@ -3471,9 +3720,15 @@
 		chk_join_nr 1 1 1
 		chk_mptcp_info subflows 1 subflows 1
 		chk_subflows_total 2 2
-		userspace_pm_rm_addr $ns2 20
-		userspace_pm_rm_sf $ns2 10.0.3.2 $SUB_ESTABLISHED
-		chk_rm_nr 1 1
+		userspace_pm_chk_dump_addr "${ns2}" \
+			"id 20 flags subflow 10.0.3.2" \
+			"subflow"
+		userspace_pm_chk_get_addr "${ns2}" "20" "id 20 flags subflow 10.0.3.2"
+		userspace_pm_rm_sf $ns2 10.0.3.2 $MPTCP_LIB_EVENT_SUB_ESTABLISHED
+		userspace_pm_chk_dump_addr "${ns2}" \
+			"" \
+			"after rm_sf 20"
+		chk_rm_nr 0 1
 		chk_mptcp_info subflows 0 subflows 0
 		chk_subflows_total 1 1
 		kill_events_pids
@@ -3492,6 +3747,8 @@
 		chk_mptcp_info subflows 0 subflows 0
 		chk_subflows_total 1 1
 		userspace_pm_add_sf $ns2 10.0.3.2 0
+		userspace_pm_chk_dump_addr "${ns2}" \
+			"id 0 flags subflow 10.0.3.2" "id 0 subflow"
 		chk_join_nr 1 1 1
 		chk_mptcp_info subflows 1 subflows 1
 		chk_subflows_total 2 2
@@ -3548,6 +3805,25 @@
 		kill_events_pids
 		mptcp_lib_kill_wait $tests_pid
 	fi
+
+	# userspace pm create id 0 subflow
+	if reset_with_events "userspace pm create id 0 subflow" &&
+	   continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then
+		set_userspace_pm $ns2
+		pm_nl_set_limits $ns1 0 1
+		speed=5 \
+			run_tests $ns1 $ns2 10.0.1.1 &
+		local tests_pid=$!
+		wait_mpj $ns2
+		chk_mptcp_info subflows 0 subflows 0
+		chk_subflows_total 1 1
+		userspace_pm_add_sf $ns2 10.0.3.2 0
+		chk_join_nr 1 1 1
+		chk_mptcp_info subflows 1 subflows 1
+		chk_subflows_total 2 2
+		kill_events_pids
+		mptcp_lib_kill_wait $tests_pid
+	fi
 }
 
 endpoint_tests()
@@ -3579,29 +3855,182 @@
 		mptcp_lib_kill_wait $tests_pid
 	fi
 
-	if reset "delete and re-add" &&
+	if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT &&
 	   mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
-		pm_nl_set_limits $ns1 1 1
-		pm_nl_set_limits $ns2 1 1
+		start_events
+		pm_nl_set_limits $ns1 0 3
+		pm_nl_set_limits $ns2 0 3
+		pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow
 		pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow
-		test_linkfail=4 speed=20 \
+		test_linkfail=4 speed=5 \
 			run_tests $ns1 $ns2 10.0.1.1 &
 		local tests_pid=$!
 
 		wait_mpj $ns2
-		chk_subflow_nr "before delete" 2
+		pm_nl_check_endpoint "creation" \
+			$ns2 10.0.2.2 id 2 flags subflow dev ns2eth2
+		chk_subflow_nr "before delete id 2" 2
 		chk_mptcp_info subflows 1 subflows 1
 
 		pm_nl_del_endpoint $ns2 2 10.0.2.2
 		sleep 0.5
-		chk_subflow_nr "after delete" 1
+		chk_subflow_nr "after delete id 2" 1
 		chk_mptcp_info subflows 0 subflows 0
 
-		pm_nl_add_endpoint $ns2 10.0.2.2 dev ns2eth2 flags subflow
+		pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow
 		wait_mpj $ns2
-		chk_subflow_nr "after re-add" 2
+		chk_subflow_nr "after re-add id 2" 2
 		chk_mptcp_info subflows 1 subflows 1
+
+		pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
+		wait_attempt_fail $ns2
+		chk_subflow_nr "after new reject" 2
+		chk_mptcp_info subflows 1 subflows 1
+
+		ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT
+		pm_nl_del_endpoint $ns2 3 10.0.3.2
+		pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
+		wait_mpj $ns2
+		chk_subflow_nr "after no reject" 3
+		chk_mptcp_info subflows 2 subflows 2
+
+		local i
+		for i in $(seq 3); do
+			pm_nl_del_endpoint $ns2 1 10.0.1.2
+			sleep 0.5
+			chk_subflow_nr "after delete id 0 ($i)" 2
+			chk_mptcp_info subflows 2 subflows 2 # only decr for additional sf
+
+			pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow
+			wait_mpj $ns2
+			chk_subflow_nr "after re-add id 0 ($i)" 3
+			chk_mptcp_info subflows 3 subflows 3
+		done
+
+		mptcp_lib_kill_wait $tests_pid
+
+		kill_events_pids
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_CREATED 1
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_ESTABLISHED 1
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_ANNOUNCED 0
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_REMOVED 4
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 6
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 4
+
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_CREATED 1
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_ESTABLISHED 1
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 0
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 0
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 6
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 5 # one has been closed before estab
+
+		chk_join_nr 6 6 6
+		chk_rm_nr 4 4
+	fi
+
+	# remove and re-add
+	if reset_with_events "delete re-add signal" &&
+	   mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
+		pm_nl_set_limits $ns1 0 3
+		pm_nl_set_limits $ns2 3 3
+		pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal
+		# broadcast IP: no packet for this address will be received on ns1
+		pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal
+		pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal
+		test_linkfail=4 speed=5 \
+			run_tests $ns1 $ns2 10.0.1.1 &
+		local tests_pid=$!
+
+		wait_mpj $ns2
+		pm_nl_check_endpoint "creation" \
+			$ns1 10.0.2.1 id 1 flags signal
+		chk_subflow_nr "before delete" 2
+		chk_mptcp_info subflows 1 subflows 1
+
+		pm_nl_del_endpoint $ns1 1 10.0.2.1
+		pm_nl_del_endpoint $ns1 2 224.0.0.1
+		sleep 0.5
+		chk_subflow_nr "after delete" 1
+		chk_mptcp_info subflows 0 subflows 0
+
+		pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal
+		pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal
+		wait_mpj $ns2
+		chk_subflow_nr "after re-add" 3
+		chk_mptcp_info subflows 2 subflows 2
+
+		pm_nl_del_endpoint $ns1 42 10.0.1.1
+		sleep 0.5
+		chk_subflow_nr "after delete ID 0" 2
+		chk_mptcp_info subflows 2 subflows 2
+
+		pm_nl_add_endpoint $ns1 10.0.1.1 id 99 flags signal
+		wait_mpj $ns2
+		chk_subflow_nr "after re-add ID 0" 3
+		chk_mptcp_info subflows 3 subflows 3
+
+		pm_nl_del_endpoint $ns1 99 10.0.1.1
+		sleep 0.5
+		chk_subflow_nr "after re-delete ID 0" 2
+		chk_mptcp_info subflows 2 subflows 2
+
+		pm_nl_add_endpoint $ns1 10.0.1.1 id 88 flags signal
+		wait_mpj $ns2
+		chk_subflow_nr "after re-re-add ID 0" 3
+		chk_mptcp_info subflows 3 subflows 3
 		mptcp_lib_kill_wait $tests_pid
+
+		kill_events_pids
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_CREATED 1
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_ESTABLISHED 1
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_ANNOUNCED 0
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_REMOVED 0
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 5
+		chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 3
+
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_CREATED 1
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_ESTABLISHED 1
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 6
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 4
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 5
+		chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 3
+
+		chk_join_nr 5 5 5
+		chk_add_nr 6 6
+		chk_rm_nr 4 3 invert
+	fi
+
+	# flush and re-add
+	if reset_with_tcp_filter "flush re-add" ns2 10.0.3.2 REJECT OUTPUT &&
+	   mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then
+		pm_nl_set_limits $ns1 0 2
+		pm_nl_set_limits $ns2 1 2
+		# broadcast IP: no packet for this address will be received on ns1
+		pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal
+		pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
+		test_linkfail=4 speed=20 \
+			run_tests $ns1 $ns2 10.0.1.1 &
+		local tests_pid=$!
+
+		wait_attempt_fail $ns2
+		chk_subflow_nr "before flush" 1
+		chk_mptcp_info subflows 0 subflows 0
+
+		pm_nl_flush_endpoint $ns2
+		pm_nl_flush_endpoint $ns1
+		wait_rm_addr $ns2 0
+		ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT
+		pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
+		wait_mpj $ns2
+		pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal
+		wait_mpj $ns2
+		mptcp_lib_kill_wait $tests_pid
+
+		chk_join_nr 2 2 2
+		chk_add_nr 2 2
+		chk_rm_nr 1 0 invert
 	fi
 }
 
@@ -3673,10 +4102,10 @@
 			tests+=("${all_tests[${opt}]}")
 			;;
 		c)
-			capture=1
+			capture=true
 			;;
 		C)
-			checksum=1
+			checksum=true
 			;;
 		i)
 			ip_mptcp=1
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/mptcp/mptcp_lib.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/mptcp/mptcp_lib.sh
@@ -8,6 +8,21 @@
 # shellcheck disable=SC2155 # declare and assign separately
 readonly KSFT_TEST="${MPTCP_LIB_KSFT_TEST:-$(basename "${0}" .sh)}"
 
+# These variables are used in some selftests, read-only
+declare -rx MPTCP_LIB_EVENT_CREATED=1           # MPTCP_EVENT_CREATED
+declare -rx MPTCP_LIB_EVENT_ESTABLISHED=2       # MPTCP_EVENT_ESTABLISHED
+declare -rx MPTCP_LIB_EVENT_CLOSED=3            # MPTCP_EVENT_CLOSED
+declare -rx MPTCP_LIB_EVENT_ANNOUNCED=6         # MPTCP_EVENT_ANNOUNCED
+declare -rx MPTCP_LIB_EVENT_REMOVED=7           # MPTCP_EVENT_REMOVED
+declare -rx MPTCP_LIB_EVENT_SUB_ESTABLISHED=10  # MPTCP_EVENT_SUB_ESTABLISHED
+declare -rx MPTCP_LIB_EVENT_SUB_CLOSED=11       # MPTCP_EVENT_SUB_CLOSED
+declare -rx MPTCP_LIB_EVENT_SUB_PRIORITY=13     # MPTCP_EVENT_SUB_PRIORITY
+declare -rx MPTCP_LIB_EVENT_LISTENER_CREATED=15 # MPTCP_EVENT_LISTENER_CREATED
+declare -rx MPTCP_LIB_EVENT_LISTENER_CLOSED=16  # MPTCP_EVENT_LISTENER_CLOSED
+
+declare -rx MPTCP_LIB_AF_INET=2
+declare -rx MPTCP_LIB_AF_INET6=10
+
 MPTCP_LIB_SUBTESTS=()
 
 # only if supported (or forced) and not disabled, see no-color.org
@@ -298,3 +313,15 @@
 		sleep 0.1
 	done
 }
+
+mptcp_lib_events() {
+	local ns="${1}"
+	local evts="${2}"
+	declare -n pid="${3}"
+
+	:>"${evts}"
+
+	mptcp_lib_kill_wait "${pid:-0}"
+	ip netns exec "${ns}" ./pm_nl_ctl events >> "${evts}" 2>&1 &
+	pid=$!
+}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/mptcp/pm_nl_ctl.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/mptcp/pm_nl_ctl.c
@@ -1239,7 +1239,7 @@
 	struct sockaddr_storage addr;
 	struct sockaddr_in6 *a6;
 	struct sockaddr_in *a4;
-	u_int16_t family;
+	u_int16_t family = AF_UNSPEC;
 	int enable = 1;
 	int sock;
 	int err;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/mptcp/simult_flows.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/mptcp/simult_flows.sh
@@ -218,8 +218,8 @@
 	shift 4
 	local msg=$*
 
-	[ $delay1 -gt 0 ] && delay1="delay $delay1" || delay1=""
-	[ $delay2 -gt 0 ] && delay2="delay $delay2" || delay2=""
+	[ $delay1 -gt 0 ] && delay1="delay ${delay1}ms" || delay1=""
+	[ $delay2 -gt 0 ] && delay2="delay ${delay2}ms" || delay2=""
 
 	for dev in ns1eth1 ns1eth2; do
 		tc -n $ns1 qdisc del dev $dev root >/dev/null 2>&1
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/mptcp/userspace_pm.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/mptcp/userspace_pm.sh
@@ -23,15 +23,15 @@
 	exit ${KSFT_SKIP}
 fi
 
-ANNOUNCED=6        # MPTCP_EVENT_ANNOUNCED
-REMOVED=7          # MPTCP_EVENT_REMOVED
-SUB_ESTABLISHED=10 # MPTCP_EVENT_SUB_ESTABLISHED
-SUB_CLOSED=11      # MPTCP_EVENT_SUB_CLOSED
-LISTENER_CREATED=15 #MPTCP_EVENT_LISTENER_CREATED
-LISTENER_CLOSED=16  #MPTCP_EVENT_LISTENER_CLOSED
+ANNOUNCED=${MPTCP_LIB_EVENT_ANNOUNCED}
+REMOVED=${MPTCP_LIB_EVENT_REMOVED}
+SUB_ESTABLISHED=${MPTCP_LIB_EVENT_SUB_ESTABLISHED}
+SUB_CLOSED=${MPTCP_LIB_EVENT_SUB_CLOSED}
+LISTENER_CREATED=${MPTCP_LIB_EVENT_LISTENER_CREATED}
+LISTENER_CLOSED=${MPTCP_LIB_EVENT_LISTENER_CLOSED}
 
-AF_INET=2
-AF_INET6=10
+AF_INET=${MPTCP_LIB_AF_INET}
+AF_INET6=${MPTCP_LIB_AF_INET6}
 
 file=""
 server_evts=""
@@ -174,10 +174,12 @@
 	local is_v6=$1
 	local app_port=$app4_port
 	local connect_addr="10.0.1.1"
+	local client_addr="10.0.1.2"
 	local listen_addr="0.0.0.0"
 	if [ "$is_v6" = "v6" ]
 	then
 		connect_addr="dead:beef:1::1"
+		client_addr="dead:beef:1::2"
 		listen_addr="::"
 		app_port=$app6_port
 	else
@@ -189,21 +191,11 @@
 	if [ -z "$client_evts" ]; then
 		client_evts=$(mktemp)
 	fi
-	:>"$client_evts"
-	if [ $client_evts_pid -ne 0 ]; then
-		mptcp_lib_kill_wait $client_evts_pid
-	fi
-	ip netns exec "$ns2" ./pm_nl_ctl events >> "$client_evts" 2>&1 &
-	client_evts_pid=$!
+	mptcp_lib_events "${ns2}" "${client_evts}" client_evts_pid
 	if [ -z "$server_evts" ]; then
 		server_evts=$(mktemp)
 	fi
-	:>"$server_evts"
-	if [ $server_evts_pid -ne 0 ]; then
-		mptcp_lib_kill_wait $server_evts_pid
-	fi
-	ip netns exec "$ns1" ./pm_nl_ctl events >> "$server_evts" 2>&1 &
-	server_evts_pid=$!
+	mptcp_lib_events "${ns1}" "${server_evts}" server_evts_pid
 	sleep 0.5
 
 	# Run the server
@@ -239,6 +231,7 @@
 		   [ "$server_serverside" = 1 ]
 	then
 		test_pass
+		print_title "Connection info: ${client_addr}:${client_port} -> ${connect_addr}:${app_port}"
 	else
 		test_fail "Expected tokens (c:${client_token} - s:${server_token}) and server (c:${client_serverside} - s:${server_serverside})"
 		mptcp_lib_result_print_all_tap
@@ -359,7 +352,7 @@
 	ip netns exec "$ns2"\
 	   ./pm_nl_ctl ann 10.0.2.2 token "$client4_token" id $client_addr_id dev\
 	   ns2eth1
-	print_test "ADD_ADDR id:${client_addr_id} 10.0.2.2 (ns2) => ns1, reuse port"
+	print_test "ADD_ADDR id:client 10.0.2.2 (ns2) => ns1, reuse port"
 	sleep 0.5
 	verify_announce_event $server_evts $ANNOUNCED $server4_token "10.0.2.2" $client_addr_id \
 			      "$client4_port"
@@ -368,7 +361,7 @@
 	:>"$server_evts"
 	ip netns exec "$ns2" ./pm_nl_ctl ann\
 	   dead:beef:2::2 token "$client6_token" id $client_addr_id dev ns2eth1
-	print_test "ADD_ADDR6 id:${client_addr_id} dead:beef:2::2 (ns2) => ns1, reuse port"
+	print_test "ADD_ADDR6 id:client dead:beef:2::2 (ns2) => ns1, reuse port"
 	sleep 0.5
 	verify_announce_event "$server_evts" "$ANNOUNCED" "$server6_token" "dead:beef:2::2"\
 			      "$client_addr_id" "$client6_port" "v6"
@@ -378,7 +371,7 @@
 	client_addr_id=$((client_addr_id+1))
 	ip netns exec "$ns2" ./pm_nl_ctl ann 10.0.2.2 token "$client4_token" id\
 	   $client_addr_id dev ns2eth1 port $new4_port
-	print_test "ADD_ADDR id:${client_addr_id} 10.0.2.2 (ns2) => ns1, new port"
+	print_test "ADD_ADDR id:client+1 10.0.2.2 (ns2) => ns1, new port"
 	sleep 0.5
 	verify_announce_event "$server_evts" "$ANNOUNCED" "$server4_token" "10.0.2.2"\
 			      "$client_addr_id" "$new4_port"
@@ -389,7 +382,7 @@
 	# ADD_ADDR from the server to client machine reusing the subflow port
 	ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server4_token" id\
 	   $server_addr_id dev ns1eth2
-	print_test "ADD_ADDR id:${server_addr_id} 10.0.2.1 (ns1) => ns2, reuse port"
+	print_test "ADD_ADDR id:server 10.0.2.1 (ns1) => ns2, reuse port"
 	sleep 0.5
 	verify_announce_event "$client_evts" "$ANNOUNCED" "$client4_token" "10.0.2.1"\
 			      "$server_addr_id" "$app4_port"
@@ -398,7 +391,7 @@
 	:>"$client_evts"
 	ip netns exec "$ns1" ./pm_nl_ctl ann dead:beef:2::1 token "$server6_token" id\
 	   $server_addr_id dev ns1eth2
-	print_test "ADD_ADDR6 id:${server_addr_id} dead:beef:2::1 (ns1) => ns2, reuse port"
+	print_test "ADD_ADDR6 id:server dead:beef:2::1 (ns1) => ns2, reuse port"
 	sleep 0.5
 	verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "dead:beef:2::1"\
 			      "$server_addr_id" "$app6_port" "v6"
@@ -408,7 +401,7 @@
 	server_addr_id=$((server_addr_id+1))
 	ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server4_token" id\
 	   $server_addr_id dev ns1eth2 port $new4_port
-	print_test "ADD_ADDR id:${server_addr_id} 10.0.2.1 (ns1) => ns2, new port"
+	print_test "ADD_ADDR id:server+1 10.0.2.1 (ns1) => ns2, new port"
 	sleep 0.5
 	verify_announce_event "$client_evts" "$ANNOUNCED" "$client4_token" "10.0.2.1"\
 			      "$server_addr_id" "$new4_port"
@@ -442,7 +435,7 @@
 	local invalid_token=$(( client4_token - 1 ))
 	ip netns exec "$ns2" ./pm_nl_ctl rem token $invalid_token id\
 	   $client_addr_id > /dev/null 2>&1
-	print_test "RM_ADDR id:${client_addr_id} ns2 => ns1, invalid token"
+	print_test "RM_ADDR id:client ns2 => ns1, invalid token"
 	local type
 	type=$(mptcp_lib_evts_get_info type "$server_evts")
 	if [ "$type" = "" ]
@@ -456,7 +449,7 @@
 	local invalid_id=$(( client_addr_id + 1 ))
 	ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\
 	   $invalid_id > /dev/null 2>&1
-	print_test "RM_ADDR id:${invalid_id} ns2 => ns1, invalid id"
+	print_test "RM_ADDR id:client+1 ns2 => ns1, invalid id"
 	type=$(mptcp_lib_evts_get_info type "$server_evts")
 	if [ "$type" = "" ]
 	then
@@ -469,7 +462,7 @@
 	:>"$server_evts"
 	ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\
 	   $client_addr_id
-	print_test "RM_ADDR id:${client_addr_id} ns2 => ns1"
+	print_test "RM_ADDR id:client ns2 => ns1"
 	sleep 0.5
 	verify_remove_event "$server_evts" "$REMOVED" "$server4_token" "$client_addr_id"
 
@@ -478,7 +471,7 @@
 	client_addr_id=$(( client_addr_id - 1 ))
 	ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\
 	   $client_addr_id
-	print_test "RM_ADDR id:${client_addr_id} ns2 => ns1"
+	print_test "RM_ADDR id:client-1 ns2 => ns1"
 	sleep 0.5
 	verify_remove_event "$server_evts" "$REMOVED" "$server4_token" "$client_addr_id"
 
@@ -486,7 +479,7 @@
 	:>"$server_evts"
 	ip netns exec "$ns2" ./pm_nl_ctl rem token "$client6_token" id\
 	   $client_addr_id
-	print_test "RM_ADDR6 id:${client_addr_id} ns2 => ns1"
+	print_test "RM_ADDR6 id:client-1 ns2 => ns1"
 	sleep 0.5
 	verify_remove_event "$server_evts" "$REMOVED" "$server6_token" "$client_addr_id"
 
@@ -496,7 +489,7 @@
 	# RM_ADDR from the server to client machine
 	ip netns exec "$ns1" ./pm_nl_ctl rem token "$server4_token" id\
 	   $server_addr_id
-	print_test "RM_ADDR id:${server_addr_id} ns1 => ns2"
+	print_test "RM_ADDR id:server ns1 => ns2"
 	sleep 0.5
 	verify_remove_event "$client_evts" "$REMOVED" "$client4_token" "$server_addr_id"
 
@@ -505,7 +498,7 @@
 	server_addr_id=$(( server_addr_id - 1 ))
 	ip netns exec "$ns1" ./pm_nl_ctl rem token "$server4_token" id\
 	   $server_addr_id
-	print_test "RM_ADDR id:${server_addr_id} ns1 => ns2"
+	print_test "RM_ADDR id:server-1 ns1 => ns2"
 	sleep 0.5
 	verify_remove_event "$client_evts" "$REMOVED" "$client4_token" "$server_addr_id"
 
@@ -513,7 +506,7 @@
 	:>"$client_evts"
 	ip netns exec "$ns1" ./pm_nl_ctl rem token "$server6_token" id\
 	   $server_addr_id
-	print_test "RM_ADDR6 id:${server_addr_id} ns1 => ns2"
+	print_test "RM_ADDR6 id:server-1 ns1 => ns2"
 	sleep 0.5
 	verify_remove_event "$client_evts" "$REMOVED" "$client6_token" "$server_addr_id"
 }
@@ -541,8 +534,14 @@
 	local locid
 	local remid
 	local info
+	local e_dport_txt
 
-	info="${e_saddr} (${e_from}) => ${e_daddr}:${e_dport} (${e_to})"
+	# only display the fixed ports
+	if [ "${e_dport}" -ge "${app4_port}" ] && [ "${e_dport}" -le "${app6_port}" ]; then
+		e_dport_txt=":${e_dport}"
+	fi
+
+	info="${e_saddr} (${e_from}) => ${e_daddr}${e_dport_txt} (${e_to})"
 
 	if [ "$e_type" = "$SUB_ESTABLISHED" ]
 	then
@@ -828,7 +827,7 @@
 	:>"$client_evts"
 	ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server6_token" id\
 	   $server_addr_id dev ns1eth2
-	print_test "ADD_ADDR4 id:${server_addr_id} 10.0.2.1 (ns1) => ns2, reuse port"
+	print_test "ADD_ADDR4 id:server 10.0.2.1 (ns1) => ns2, reuse port"
 	sleep 0.5
 	verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "10.0.2.1"\
 			      "$server_addr_id" "$app6_port"
@@ -907,12 +906,6 @@
 	local saddr
 	local sport
 
-	if [ $e_type = $LISTENER_CREATED ]; then
-		print_test "CREATE_LISTENER $e_saddr:$e_sport"
-	elif [ $e_type = $LISTENER_CLOSED ]; then
-		print_test "CLOSE_LISTENER $e_saddr:$e_sport"
-	fi
-
 	type=$(mptcp_lib_evts_get_info type $evt $e_type)
 	family=$(mptcp_lib_evts_get_info family $evt $e_type)
 	sport=$(mptcp_lib_evts_get_info sport $evt $e_type)
@@ -944,6 +937,7 @@
 	local listener_pid=$!
 
 	sleep 0.5
+	print_test "CREATE_LISTENER 10.0.2.2 (client port)"
 	verify_listener_events $client_evts $LISTENER_CREATED $AF_INET 10.0.2.2 $client4_port
 
 	# ADD_ADDR from client to server machine reusing the subflow port
@@ -960,12 +954,14 @@
 	mptcp_lib_kill_wait $listener_pid
 
 	sleep 0.5
+	print_test "CLOSE_LISTENER 10.0.2.2 (client port)"
 	verify_listener_events $client_evts $LISTENER_CLOSED $AF_INET 10.0.2.2 $client4_port
 }
 
 print_title "Make connections"
 make_connection
 make_connection "v6"
+print_title "Will be using address IDs ${client_addr_id} (client) and ${server_addr_id} (server)"
 
 test_announce
 test_remove
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/msg_zerocopy.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/msg_zerocopy.c
@@ -85,6 +85,7 @@
 static int  cfg_runtime_ms	= 4200;
 static int  cfg_verbose;
 static int  cfg_waittime_ms	= 500;
+static int  cfg_notification_limit = 32;
 static bool cfg_zerocopy;
 
 static socklen_t cfg_alen;
@@ -95,6 +96,7 @@
 static long packets, bytes, completions, expected_completions;
 static int  zerocopied = -1;
 static uint32_t next_completion;
+static uint32_t sends_since_notify;
 
 static unsigned long gettimeofday_ms(void)
 {
@@ -208,6 +210,7 @@
 		error(1, errno, "send");
 	if (cfg_verbose && ret != len)
 		fprintf(stderr, "send: ret=%u != %u\n", ret, len);
+	sends_since_notify++;
 
 	if (len) {
 		packets++;
@@ -435,7 +438,7 @@
 	/* Detect notification gaps. These should not happen often, if at all.
 	 * Gaps can occur due to drops, reordering and retransmissions.
 	 */
-	if (lo != next_completion)
+	if (cfg_verbose && lo != next_completion)
 		fprintf(stderr, "gap: %u..%u does not append to %u\n",
 			lo, hi, next_completion);
 	next_completion = hi + 1;
@@ -460,6 +463,7 @@
 static void do_recv_completions(int fd, int domain)
 {
 	while (do_recv_completion(fd, domain)) {}
+	sends_since_notify = 0;
 }
 
 /* Wait for all remaining completions on the errqueue */
@@ -549,6 +553,9 @@
 		else
 			do_sendmsg(fd, &msg, cfg_zerocopy, domain);
 
+		if (cfg_zerocopy && sends_since_notify >= cfg_notification_limit)
+			do_recv_completions(fd, domain);
+
 		while (!do_poll(fd, POLLOUT)) {
 			if (cfg_zerocopy)
 				do_recv_completions(fd, domain);
@@ -708,7 +715,7 @@
 
 	cfg_payload_len = max_payload_len;
 
-	while ((c = getopt(argc, argv, "46c:C:D:i:mp:rs:S:t:vz")) != -1) {
+	while ((c = getopt(argc, argv, "46c:C:D:i:l:mp:rs:S:t:vz")) != -1) {
 		switch (c) {
 		case '4':
 			if (cfg_family != PF_UNSPEC)
@@ -736,6 +743,9 @@
 			if (cfg_ifindex == 0)
 				error(1, errno, "invalid iface: %s", optarg);
 			break;
+		case 'l':
+			cfg_notification_limit = strtoul(optarg, NULL, 0);
+			break;
 		case 'm':
 			cfg_cork_mixed = true;
 			break;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/openvswitch/openvswitch.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/openvswitch/openvswitch.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 #
 # OVS kernel module self tests
@@ -128,8 +128,10 @@
 		ovs_add_if "$1" "$2" "$4" -u || return 1
 	fi
 
-	[ $TRACING -eq 1 ] && ovs_netns_spawn_daemon "$1" "$ns" \
-			tcpdump -i any -s 65535
+	if [ $TRACING -eq 1 ]; then
+		ovs_netns_spawn_daemon "$1" "$3" tcpdump -l -i any -s 6553
+		ovs_wait grep -q "listening on any" ${ovs_dir}/stderr
+	fi
 
 	return 0
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
+++ linux-qcom-6.8.0/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
@@ -531,7 +531,7 @@
             for flat_act in parse_flat_map:
                 if parse_starts_block(actstr, flat_act[0], False):
                     actstr = actstr[len(flat_act[0]):]
-                    self["attrs"].append([flat_act[1]])
+                    self["attrs"].append([flat_act[1], True])
                     actstr = actstr[strspn(actstr, ", ") :]
                     parsed = True
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/pmtu.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/pmtu.sh
@@ -1961,7 +1961,7 @@
 	pid=${1}
 	cmd=${2}
 
-	[ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "{cmd}" ]
+	[ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "${cmd}" ]
 }
 
 test_cleanup_vxlanX_exception() {
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/reuseaddr_conflict.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/reuseaddr_conflict.c
@@ -109,6 +109,6 @@
 	fd1 = open_port(0, 1);
 	if (fd1 >= 0)
 		error(1, 0, "Was allowed to create an ipv4 reuseport on an already bound non-reuseport socket with no ipv6");
-	fprintf(stderr, "Success");
+	fprintf(stderr, "Success\n");
 	return 0;
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/settings
+++ linux-qcom-6.8.0/tools/testing/selftests/net/settings
@@ -1 +1 @@
-timeout=3600
+timeout=0
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/socket.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/socket.c
@@ -6,6 +6,7 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
+#include <limits.h>
 
 #include "../kselftest.h"
 
@@ -26,7 +27,10 @@
 };
 
 static struct socket_testcase tests[] = {
-	{ AF_MAX,  0,           0,           -EAFNOSUPPORT,    0 },
+	/* libc might have a smaller value of AF_MAX than the kernel
+	 * actually supports, so use INT_MAX instead.
+	 */
+	{ INT_MAX, 0,           0,           -EAFNOSUPPORT,    0  },
 	{ AF_INET, SOCK_STREAM, IPPROTO_TCP, 0,                1  },
 	{ AF_INET, SOCK_DGRAM,  IPPROTO_TCP, -EPROTONOSUPPORT, 1  },
 	{ AF_INET, SOCK_DGRAM,  IPPROTO_UDP, 0,                1  },
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/tcp_ao/lib/proc.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/tcp_ao/lib/proc.c
@@ -86,7 +86,7 @@
 
 	pos = strchr(line, ' ') + 1;
 
-	if (fscanf(fnetstat, type->header_name) == EOF)
+	if (fscanf(fnetstat, "%[^ :]", type->header_name) == EOF)
 		test_error("fscanf(%s)", type->header_name);
 	if (fread(&tmp, 1, 1, fnetstat) != 1 || tmp != ':')
 		test_error("Unexpected netstat format (%c)", tmp);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/tcp_ao/lib/setup.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/tcp_ao/lib/setup.c
@@ -17,37 +17,37 @@
 void __test_msg(const char *buf)
 {
 	pthread_mutex_lock(&ksft_print_lock);
-	ksft_print_msg(buf);
+	ksft_print_msg("%s", buf);
 	pthread_mutex_unlock(&ksft_print_lock);
 }
 void __test_ok(const char *buf)
 {
 	pthread_mutex_lock(&ksft_print_lock);
-	ksft_test_result_pass(buf);
+	ksft_test_result_pass("%s", buf);
 	pthread_mutex_unlock(&ksft_print_lock);
 }
 void __test_fail(const char *buf)
 {
 	pthread_mutex_lock(&ksft_print_lock);
-	ksft_test_result_fail(buf);
+	ksft_test_result_fail("%s", buf);
 	pthread_mutex_unlock(&ksft_print_lock);
 }
 void __test_xfail(const char *buf)
 {
 	pthread_mutex_lock(&ksft_print_lock);
-	ksft_test_result_xfail(buf);
+	ksft_test_result_xfail("%s", buf);
 	pthread_mutex_unlock(&ksft_print_lock);
 }
 void __test_error(const char *buf)
 {
 	pthread_mutex_lock(&ksft_print_lock);
-	ksft_test_result_error(buf);
+	ksft_test_result_error("%s", buf);
 	pthread_mutex_unlock(&ksft_print_lock);
 }
 void __test_skip(const char *buf)
 {
 	pthread_mutex_lock(&ksft_print_lock);
-	ksft_test_result_skip(buf);
+	ksft_test_result_skip("%s", buf);
 	pthread_mutex_unlock(&ksft_print_lock);
 }
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/tcp_ao/rst.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/tcp_ao/rst.c
@@ -256,8 +256,6 @@
 
 static void test_client_active_rst(unsigned int port)
 {
-	/* one in queue, another accept()ed */
-	unsigned int wait_for = backlog + 2;
 	int i, sk[3], err;
 	bool is_writable[ARRAY_SIZE(sk)] = {false};
 	unsigned int last = ARRAY_SIZE(sk) - 1;
@@ -275,16 +273,20 @@
 	for (i = 0; i < last; i++) {
 		err = _test_connect_socket(sk[i], this_ip_dest, port,
 					       (i == 0) ? TEST_TIMEOUT_SEC : -1);
-
 		if (err < 0)
 			test_error("failed to connect()");
 	}
 
-	synchronize_threads(); /* 2: connection accept()ed, another queued */
-	err = test_wait_fds(sk, last, is_writable, wait_for, TEST_TIMEOUT_SEC);
+	synchronize_threads(); /* 2: two connections: one accept()ed, another queued */
+	err = test_wait_fds(sk, last, is_writable, last, TEST_TIMEOUT_SEC);
 	if (err < 0)
 		test_error("test_wait_fds(): %d", err);
 
+	/* async connect() with third sk to get into request_sock_queue */
+	err = _test_connect_socket(sk[last], this_ip_dest, port, -1);
+	if (err < 0)
+		test_error("failed to connect()");
+
 	synchronize_threads(); /* 3: close listen socket */
 	if (test_client_verify(sk[0], packet_sz, quota / packet_sz, TEST_TIMEOUT_SEC))
 		test_fail("Failed to send data on connected socket");
@@ -292,13 +294,14 @@
 		test_ok("Verified established tcp connection");
 
 	synchronize_threads(); /* 4: finishing up */
-	err = _test_connect_socket(sk[last], this_ip_dest, port, -1);
-	if (err < 0)
-		test_error("failed to connect()");
 
 	synchronize_threads(); /* 5: closed active sk */
-	err = test_wait_fds(sk, ARRAY_SIZE(sk), NULL,
-			    wait_for, TEST_TIMEOUT_SEC);
+	/*
+	 * Wait for 2 connections: one accepted, another in the accept queue,
+	 * the one in request_sock_queue won't get fully established, so
+	 * doesn't receive an active RST, see inet_csk_listen_stop().
+	 */
+	err = test_wait_fds(sk, last, NULL, last, TEST_TIMEOUT_SEC);
 	if (err < 0)
 		test_error("select(): %d", err);
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/tcp_ao/setsockopt-closed.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/tcp_ao/setsockopt-closed.c
@@ -21,7 +21,7 @@
 static void test_vefify_ao_info(int sk, struct tcp_ao_info_opt *info,
 				const char *tst)
 {
-	struct tcp_ao_info_opt tmp;
+	struct tcp_ao_info_opt tmp = {};
 	socklen_t len = sizeof(tmp);
 
 	if (getsockopt(sk, IPPROTO_TCP, TCP_AO_INFO, &tmp, &len))
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/test_bridge_neigh_suppress.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/test_bridge_neigh_suppress.sh
@@ -154,17 +154,9 @@
 		setup_topo_ns $ns
 	done
 
-	ip link add name veth0 type veth peer name veth1
-	ip link set dev veth0 netns $h1 name eth0
-	ip link set dev veth1 netns $sw1 name swp1
-
-	ip link add name veth0 type veth peer name veth1
-	ip link set dev veth0 netns $sw1 name veth0
-	ip link set dev veth1 netns $sw2 name veth0
-
-	ip link add name veth0 type veth peer name veth1
-	ip link set dev veth0 netns $h2 name eth0
-	ip link set dev veth1 netns $sw2 name swp1
+	ip -n $h1 link add name eth0 type veth peer name swp1 netns $sw1
+	ip -n $sw1 link add name veth0 type veth peer name veth0 netns $sw2
+	ip -n $h2 link add name eth0 type veth peer name swp1 netns $sw2
 }
 
 setup_host_common()
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/test_vxlan_mdb.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/test_vxlan_mdb.sh
@@ -1177,6 +1177,7 @@
 	local plen=$1; shift
 	local enc_ethtype=$1; shift
 	local grp=$1; shift
+	local grp_dmac=$1; shift
 	local src=$1; shift
 	local mz=$1; shift
 
@@ -1195,11 +1196,11 @@
 	run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep2_ip src_vni 10020"
 
 	run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_dst_ip $vtep1_ip action pass"
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Destination IP - match"
 
-	run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Destination IP - no match"
 
@@ -1212,20 +1213,20 @@
 	run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip dst_port 1111 src_vni 10020"
 
 	run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 4789 action pass"
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev veth0 ingress" 101 1
 	log_test $? 0 "Default destination port - match"
 
-	run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev veth0 ingress" 101 1
 	log_test $? 0 "Default destination port - no match"
 
 	run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 1111 action pass"
-	run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev veth0 ingress" 101 1
 	log_test $? 0 "Non-default destination port - match"
 
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev veth0 ingress" 101 1
 	log_test $? 0 "Non-default destination port - no match"
 
@@ -1238,11 +1239,11 @@
 	run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip src_vni 10020"
 
 	run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10010 action pass"
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Default destination VNI - match"
 
-	run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Default destination VNI - no match"
 
@@ -1250,11 +1251,11 @@
 	run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip vni 10010 src_vni 10020"
 
 	run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10020 action pass"
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Non-default destination VNI - match"
 
-	run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Non-default destination VNI - no match"
 
@@ -1272,6 +1273,7 @@
 	local plen=32
 	local enc_ethtype="ip"
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local src=192.0.2.129
 
 	echo
@@ -1279,7 +1281,7 @@
 	echo "------------------------------------------------------------------"
 
 	encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \
-		$grp $src "mausezahn"
+		$grp $grp_dmac $src "mausezahn"
 }
 
 encap_params_ipv6_ipv4()
@@ -1291,6 +1293,7 @@
 	local plen=32
 	local enc_ethtype="ip"
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local src=2001:db8:100::1
 
 	echo
@@ -1298,7 +1301,7 @@
 	echo "------------------------------------------------------------------"
 
 	encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \
-		$grp $src "mausezahn -6"
+		$grp $grp_dmac $src "mausezahn -6"
 }
 
 encap_params_ipv4_ipv6()
@@ -1310,6 +1313,7 @@
 	local plen=128
 	local enc_ethtype="ipv6"
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local src=192.0.2.129
 
 	echo
@@ -1317,7 +1321,7 @@
 	echo "------------------------------------------------------------------"
 
 	encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \
-		$grp $src "mausezahn"
+		$grp $grp_dmac $src "mausezahn"
 }
 
 encap_params_ipv6_ipv6()
@@ -1329,6 +1333,7 @@
 	local plen=128
 	local enc_ethtype="ipv6"
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local src=2001:db8:100::1
 
 	echo
@@ -1336,7 +1341,7 @@
 	echo "------------------------------------------------------------------"
 
 	encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \
-		$grp $src "mausezahn -6"
+		$grp $grp_dmac $src "mausezahn -6"
 }
 
 starg_exclude_ir_common()
@@ -1347,6 +1352,7 @@
 	local vtep2_ip=$1; shift
 	local plen=$1; shift
 	local grp=$1; shift
+	local grp_dmac=$1; shift
 	local valid_src=$1; shift
 	local invalid_src=$1; shift
 	local mz=$1; shift
@@ -1368,14 +1374,14 @@
 	run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $vtep2_ip src_vni 10010"
 
 	# Check that invalid source is not forwarded to any VTEP.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 0
 	log_test $? 0 "Block excluded source - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 0
 	log_test $? 0 "Block excluded source - second VTEP"
 
 	# Check that valid source is forwarded to both VTEPs.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Forward valid source - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1385,14 +1391,14 @@
 	run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010"
 
 	# Check that invalid source is not forwarded to any VTEP.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Block excluded source after removal - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 1
 	log_test $? 0 "Block excluded source after removal - second VTEP"
 
 	# Check that valid source is forwarded to the remaining VTEP.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 2
 	log_test $? 0 "Forward valid source after removal - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1407,6 +1413,7 @@
 	local vtep2_ip=198.51.100.200
 	local plen=32
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local valid_src=192.0.2.129
 	local invalid_src=192.0.2.145
 
@@ -1415,7 +1422,7 @@
 	echo "-------------------------------------------------------------"
 
 	starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
-		$valid_src $invalid_src "mausezahn"
+		$grp_dmac $valid_src $invalid_src "mausezahn"
 }
 
 starg_exclude_ir_ipv6_ipv4()
@@ -1426,6 +1433,7 @@
 	local vtep2_ip=198.51.100.200
 	local plen=32
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local valid_src=2001:db8:100::1
 	local invalid_src=2001:db8:200::1
 
@@ -1434,7 +1442,7 @@
 	echo "-------------------------------------------------------------"
 
 	starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
-		$valid_src $invalid_src "mausezahn -6"
+		$grp_dmac $valid_src $invalid_src "mausezahn -6"
 }
 
 starg_exclude_ir_ipv4_ipv6()
@@ -1445,6 +1453,7 @@
 	local vtep2_ip=2001:db8:2000::1
 	local plen=128
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local valid_src=192.0.2.129
 	local invalid_src=192.0.2.145
 
@@ -1453,7 +1462,7 @@
 	echo "-------------------------------------------------------------"
 
 	starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
-		$valid_src $invalid_src "mausezahn"
+		$grp_dmac $valid_src $invalid_src "mausezahn"
 }
 
 starg_exclude_ir_ipv6_ipv6()
@@ -1464,6 +1473,7 @@
 	local vtep2_ip=2001:db8:2000::1
 	local plen=128
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local valid_src=2001:db8:100::1
 	local invalid_src=2001:db8:200::1
 
@@ -1472,7 +1482,7 @@
 	echo "-------------------------------------------------------------"
 
 	starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
-		$valid_src $invalid_src "mausezahn -6"
+		$grp_dmac $valid_src $invalid_src "mausezahn -6"
 }
 
 starg_include_ir_common()
@@ -1483,6 +1493,7 @@
 	local vtep2_ip=$1; shift
 	local plen=$1; shift
 	local grp=$1; shift
+	local grp_dmac=$1; shift
 	local valid_src=$1; shift
 	local invalid_src=$1; shift
 	local mz=$1; shift
@@ -1504,14 +1515,14 @@
 	run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $vtep2_ip src_vni 10010"
 
 	# Check that invalid source is not forwarded to any VTEP.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 0
 	log_test $? 0 "Block excluded source - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 0
 	log_test $? 0 "Block excluded source - second VTEP"
 
 	# Check that valid source is forwarded to both VTEPs.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Forward valid source - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1521,14 +1532,14 @@
 	run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010"
 
 	# Check that invalid source is not forwarded to any VTEP.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Block excluded source after removal - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 1
 	log_test $? 0 "Block excluded source after removal - second VTEP"
 
 	# Check that valid source is forwarded to the remaining VTEP.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 2
 	log_test $? 0 "Forward valid source after removal - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1543,6 +1554,7 @@
 	local vtep2_ip=198.51.100.200
 	local plen=32
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local valid_src=192.0.2.129
 	local invalid_src=192.0.2.145
 
@@ -1551,7 +1563,7 @@
 	echo "-------------------------------------------------------------"
 
 	starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
-		$valid_src $invalid_src "mausezahn"
+		$grp_dmac $valid_src $invalid_src "mausezahn"
 }
 
 starg_include_ir_ipv6_ipv4()
@@ -1562,6 +1574,7 @@
 	local vtep2_ip=198.51.100.200
 	local plen=32
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local valid_src=2001:db8:100::1
 	local invalid_src=2001:db8:200::1
 
@@ -1570,7 +1583,7 @@
 	echo "-------------------------------------------------------------"
 
 	starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
-		$valid_src $invalid_src "mausezahn -6"
+		$grp_dmac $valid_src $invalid_src "mausezahn -6"
 }
 
 starg_include_ir_ipv4_ipv6()
@@ -1581,6 +1594,7 @@
 	local vtep2_ip=2001:db8:2000::1
 	local plen=128
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local valid_src=192.0.2.129
 	local invalid_src=192.0.2.145
 
@@ -1589,7 +1603,7 @@
 	echo "-------------------------------------------------------------"
 
 	starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
-		$valid_src $invalid_src "mausezahn"
+		$grp_dmac $valid_src $invalid_src "mausezahn"
 }
 
 starg_include_ir_ipv6_ipv6()
@@ -1600,6 +1614,7 @@
 	local vtep2_ip=2001:db8:2000::1
 	local plen=128
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local valid_src=2001:db8:100::1
 	local invalid_src=2001:db8:200::1
 
@@ -1608,7 +1623,7 @@
 	echo "-------------------------------------------------------------"
 
 	starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
-		$valid_src $invalid_src "mausezahn -6"
+		$grp_dmac $valid_src $invalid_src "mausezahn -6"
 }
 
 starg_exclude_p2mp_common()
@@ -1618,6 +1633,7 @@
 	local mcast_grp=$1; shift
 	local plen=$1; shift
 	local grp=$1; shift
+	local grp_dmac=$1; shift
 	local valid_src=$1; shift
 	local invalid_src=$1; shift
 	local mz=$1; shift
@@ -1635,12 +1651,12 @@
 	run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $mcast_grp src_vni 10010 via veth0"
 
 	# Check that invalid source is not forwarded.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 0
 	log_test $? 0 "Block excluded source"
 
 	# Check that valid source is forwarded.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Forward valid source"
 
@@ -1648,7 +1664,7 @@
 	run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0"
 
 	# Check that valid source is not received anymore.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Receive of valid source after removal from group"
 }
@@ -1660,6 +1676,7 @@
 	local mcast_grp=238.1.1.1
 	local plen=32
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local valid_src=192.0.2.129
 	local invalid_src=192.0.2.145
 
@@ -1667,7 +1684,7 @@
 	echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv4 underlay"
 	echo "---------------------------------------------------------------"
 
-	starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
+	starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
 		$valid_src $invalid_src "mausezahn"
 }
 
@@ -1678,6 +1695,7 @@
 	local mcast_grp=238.1.1.1
 	local plen=32
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local valid_src=2001:db8:100::1
 	local invalid_src=2001:db8:200::1
 
@@ -1685,7 +1703,7 @@
 	echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv4 underlay"
 	echo "---------------------------------------------------------------"
 
-	starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
+	starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
 		$valid_src $invalid_src "mausezahn -6"
 }
 
@@ -1696,6 +1714,7 @@
 	local mcast_grp=ff0e::2
 	local plen=128
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local valid_src=192.0.2.129
 	local invalid_src=192.0.2.145
 
@@ -1703,7 +1722,7 @@
 	echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv6 underlay"
 	echo "---------------------------------------------------------------"
 
-	starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
+	starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
 		$valid_src $invalid_src "mausezahn"
 }
 
@@ -1714,6 +1733,7 @@
 	local mcast_grp=ff0e::2
 	local plen=128
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local valid_src=2001:db8:100::1
 	local invalid_src=2001:db8:200::1
 
@@ -1721,7 +1741,7 @@
 	echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv6 underlay"
 	echo "---------------------------------------------------------------"
 
-	starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
+	starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
 		$valid_src $invalid_src "mausezahn -6"
 }
 
@@ -1732,6 +1752,7 @@
 	local mcast_grp=$1; shift
 	local plen=$1; shift
 	local grp=$1; shift
+	local grp_dmac=$1; shift
 	local valid_src=$1; shift
 	local invalid_src=$1; shift
 	local mz=$1; shift
@@ -1749,12 +1770,12 @@
 	run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $mcast_grp src_vni 10010 via veth0"
 
 	# Check that invalid source is not forwarded.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 0
 	log_test $? 0 "Block excluded source"
 
 	# Check that valid source is forwarded.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Forward valid source"
 
@@ -1762,7 +1783,7 @@
 	run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0"
 
 	# Check that valid source is not received anymore.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Receive of valid source after removal from group"
 }
@@ -1774,6 +1795,7 @@
 	local mcast_grp=238.1.1.1
 	local plen=32
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local valid_src=192.0.2.129
 	local invalid_src=192.0.2.145
 
@@ -1781,7 +1803,7 @@
 	echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv4 underlay"
 	echo "---------------------------------------------------------------"
 
-	starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
+	starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
 		$valid_src $invalid_src "mausezahn"
 }
 
@@ -1792,6 +1814,7 @@
 	local mcast_grp=238.1.1.1
 	local plen=32
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local valid_src=2001:db8:100::1
 	local invalid_src=2001:db8:200::1
 
@@ -1799,7 +1822,7 @@
 	echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv4 underlay"
 	echo "---------------------------------------------------------------"
 
-	starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
+	starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
 		$valid_src $invalid_src "mausezahn -6"
 }
 
@@ -1810,6 +1833,7 @@
 	local mcast_grp=ff0e::2
 	local plen=128
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local valid_src=192.0.2.129
 	local invalid_src=192.0.2.145
 
@@ -1817,7 +1841,7 @@
 	echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv6 underlay"
 	echo "---------------------------------------------------------------"
 
-	starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
+	starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
 		$valid_src $invalid_src "mausezahn"
 }
 
@@ -1828,6 +1852,7 @@
 	local mcast_grp=ff0e::2
 	local plen=128
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local valid_src=2001:db8:100::1
 	local invalid_src=2001:db8:200::1
 
@@ -1835,7 +1860,7 @@
 	echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv6 underlay"
 	echo "---------------------------------------------------------------"
 
-	starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
+	starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
 		$valid_src $invalid_src "mausezahn -6"
 }
 
@@ -1847,6 +1872,7 @@
 	local plen=$1; shift
 	local proto=$1; shift
 	local grp=$1; shift
+	local grp_dmac=$1; shift
 	local src=$1; shift
 	local mz=$1; shift
 
@@ -1882,20 +1908,20 @@
 	# Make sure that packets sent from the first VTEP over VLAN 10 are
 	# received by the SVI corresponding to the L3VNI (14000 / VLAN 4000) on
 	# the second VTEP, since it is configured as PVID.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1
 	log_test $? 0 "Egress VNI translation - PVID configured"
 
 	# Remove PVID flag from VLAN 4000 on the second VTEP and make sure
 	# packets are no longer received by the SVI interface.
 	run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0"
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1
 	log_test $? 0 "Egress VNI translation - no PVID configured"
 
 	# Reconfigure the PVID and make sure packets are received again.
 	run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0 pvid"
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev br0.4000 ingress" 101 2
 	log_test $? 0 "Egress VNI translation - PVID reconfigured"
 }
@@ -1908,6 +1934,7 @@
 	local plen=32
 	local proto="ipv4"
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local src=192.0.2.129
 
 	echo
@@ -1915,7 +1942,7 @@
 	echo "----------------------------------------------------------------"
 
 	egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \
-		$src "mausezahn"
+		$grp_dmac $src "mausezahn"
 }
 
 egress_vni_translation_ipv6_ipv4()
@@ -1926,6 +1953,7 @@
 	local plen=32
 	local proto="ipv6"
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local src=2001:db8:100::1
 
 	echo
@@ -1933,7 +1961,7 @@
 	echo "----------------------------------------------------------------"
 
 	egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \
-		$src "mausezahn -6"
+		$grp_dmac $src "mausezahn -6"
 }
 
 egress_vni_translation_ipv4_ipv6()
@@ -1944,6 +1972,7 @@
 	local plen=128
 	local proto="ipv4"
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local src=192.0.2.129
 
 	echo
@@ -1951,7 +1980,7 @@
 	echo "----------------------------------------------------------------"
 
 	egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \
-		$src "mausezahn"
+		$grp_dmac $src "mausezahn"
 }
 
 egress_vni_translation_ipv6_ipv6()
@@ -1962,6 +1991,7 @@
 	local plen=128
 	local proto="ipv6"
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local src=2001:db8:100::1
 
 	echo
@@ -1969,7 +1999,7 @@
 	echo "----------------------------------------------------------------"
 
 	egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \
-		$src "mausezahn -6"
+		$grp_dmac $src "mausezahn -6"
 }
 
 all_zeros_mdb_common()
@@ -1982,12 +2012,18 @@
 	local vtep4_ip=$1; shift
 	local plen=$1; shift
 	local ipv4_grp=239.1.1.1
+	local ipv4_grp_dmac=01:00:5e:01:01:01
 	local ipv4_unreg_grp=239.2.2.2
+	local ipv4_unreg_grp_dmac=01:00:5e:02:02:02
 	local ipv4_ll_grp=224.0.0.100
+	local ipv4_ll_grp_dmac=01:00:5e:00:00:64
 	local ipv4_src=192.0.2.129
 	local ipv6_grp=ff0e::1
+	local ipv6_grp_dmac=33:33:00:00:00:01
 	local ipv6_unreg_grp=ff0e::2
+	local ipv6_unreg_grp_dmac=33:33:00:00:00:02
 	local ipv6_ll_grp=ff02::1
+	local ipv6_ll_grp_dmac=33:33:00:00:00:01
 	local ipv6_src=2001:db8:100::1
 
 	# Install all-zeros (catchall) MDB entries for IPv4 and IPv6 traffic
@@ -2023,7 +2059,7 @@
 
 	# Send registered IPv4 multicast and make sure it only arrives to the
 	# first VTEP.
-	run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_grp_dmac -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "Registered IPv4 multicast - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 0
@@ -2031,7 +2067,7 @@
 
 	# Send unregistered IPv4 multicast that is not link-local and make sure
 	# it arrives to the first and second VTEPs.
-	run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_unreg_grp_dmac -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 2
 	log_test $? 0 "Unregistered IPv4 multicast - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -2039,7 +2075,7 @@
 
 	# Send IPv4 link-local multicast traffic and make sure it does not
 	# arrive to any VTEP.
-	run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_ll_grp_dmac -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 2
 	log_test $? 0 "Link-local IPv4 multicast - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -2074,7 +2110,7 @@
 
 	# Send registered IPv6 multicast and make sure it only arrives to the
 	# third VTEP.
-	run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_grp_dmac -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 103 1
 	log_test $? 0 "Registered IPv6 multicast - third VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 104 0
@@ -2082,7 +2118,7 @@
 
 	# Send unregistered IPv6 multicast that is not link-local and make sure
 	# it arrives to the third and fourth VTEPs.
-	run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_unreg_grp_dmac -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 103 2
 	log_test $? 0 "Unregistered IPv6 multicast - third VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 104 1
@@ -2090,7 +2126,7 @@
 
 	# Send IPv6 link-local multicast traffic and make sure it does not
 	# arrive to any VTEP.
-	run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_ll_grp_dmac -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 103 2
 	log_test $? 0 "Link-local IPv6 multicast - third VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 104 1
@@ -2165,6 +2201,7 @@
 	local plen=$1; shift
 	local proto=$1; shift
 	local grp=$1; shift
+	local grp_dmac=$1; shift
 	local src=$1; shift
 	local mz=$1; shift
 
@@ -2188,7 +2225,7 @@
 
 	# Send IP multicast traffic and make sure it is forwarded by the MDB
 	# and only arrives to the first VTEP.
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "IP multicast - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 0
@@ -2205,7 +2242,7 @@
 	# Remove the MDB entry and make sure that IP multicast is now forwarded
 	# by the FDB to the second VTEP.
 	run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep1_ip src_vni 10010"
-	run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+	run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
 	tc_check_packets "$ns2" "dev vx0 ingress" 101 1
 	log_test $? 0 "IP multicast after removal - first VTEP"
 	tc_check_packets "$ns2" "dev vx0 ingress" 102 2
@@ -2221,14 +2258,15 @@
 	local plen=32
 	local proto="ipv4"
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local src=192.0.2.129
 
 	echo
 	echo "Data path: MDB with FDB - IPv4 overlay / IPv4 underlay"
 	echo "------------------------------------------------------"
 
-	mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \
-		"mausezahn"
+	mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \
+		$grp_dmac $src "mausezahn"
 }
 
 mdb_fdb_ipv6_ipv4()
@@ -2240,14 +2278,15 @@
 	local plen=32
 	local proto="ipv6"
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local src=2001:db8:100::1
 
 	echo
 	echo "Data path: MDB with FDB - IPv6 overlay / IPv4 underlay"
 	echo "------------------------------------------------------"
 
-	mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \
-		"mausezahn -6"
+	mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \
+		$grp_dmac $src "mausezahn -6"
 }
 
 mdb_fdb_ipv4_ipv6()
@@ -2259,14 +2298,15 @@
 	local plen=128
 	local proto="ipv4"
 	local grp=239.1.1.1
+	local grp_dmac=01:00:5e:01:01:01
 	local src=192.0.2.129
 
 	echo
 	echo "Data path: MDB with FDB - IPv4 overlay / IPv6 underlay"
 	echo "------------------------------------------------------"
 
-	mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \
-		"mausezahn"
+	mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \
+		$grp_dmac $src "mausezahn"
 }
 
 mdb_fdb_ipv6_ipv6()
@@ -2278,14 +2318,15 @@
 	local plen=128
 	local proto="ipv6"
 	local grp=ff0e::1
+	local grp_dmac=33:33:00:00:00:01
 	local src=2001:db8:100::1
 
 	echo
 	echo "Data path: MDB with FDB - IPv6 overlay / IPv6 underlay"
 	echo "------------------------------------------------------"
 
-	mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \
-		"mausezahn -6"
+	mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \
+		$grp_dmac $src "mausezahn -6"
 }
 
 mdb_grp1_loop()
@@ -2320,7 +2361,9 @@
 	local vtep1_ip=$1; shift
 	local vtep2_ip=$1; shift
 	local grp1=$1; shift
+	local grp1_dmac=$1; shift
 	local grp2=$1; shift
+	local grp2_dmac=$1; shift
 	local src=$1; shift
 	local mz=$1; shift
 	local pid1
@@ -2345,9 +2388,9 @@
 	pid1=$!
 	mdb_grp2_loop $ns1 $vtep1_ip $vtep2_ip $grp2 &
 	pid2=$!
-	ip netns exec $ns1 $mz br0.10 -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q &
+	ip netns exec $ns1 $mz br0.10 -a own -b $grp1_dmac -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q &
 	pid3=$!
-	ip netns exec $ns1 $mz br0.10 -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q &
+	ip netns exec $ns1 $mz br0.10 -a own -b $grp2_dmac -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q &
 	pid4=$!
 
 	sleep 30
@@ -2363,15 +2406,17 @@
 	local vtep1_ip=198.51.100.100
 	local vtep2_ip=198.51.100.200
 	local grp1=239.1.1.1
+	local grp1_dmac=01:00:5e:01:01:01
 	local grp2=239.2.2.2
+	local grp2_dmac=01:00:5e:02:02:02
 	local src=192.0.2.129
 
 	echo
 	echo "Data path: MDB torture test - IPv4 overlay / IPv4 underlay"
 	echo "----------------------------------------------------------"
 
-	mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \
-		"mausezahn"
+	mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \
+		$grp2_dmac $src "mausezahn"
 }
 
 mdb_torture_ipv6_ipv4()
@@ -2380,15 +2425,17 @@
 	local vtep1_ip=198.51.100.100
 	local vtep2_ip=198.51.100.200
 	local grp1=ff0e::1
+	local grp1_dmac=33:33:00:00:00:01
 	local grp2=ff0e::2
+	local grp2_dmac=33:33:00:00:00:02
 	local src=2001:db8:100::1
 
 	echo
 	echo "Data path: MDB torture test - IPv6 overlay / IPv4 underlay"
 	echo "----------------------------------------------------------"
 
-	mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \
-		"mausezahn -6"
+	mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \
+		$grp2_dmac $src "mausezahn -6"
 }
 
 mdb_torture_ipv4_ipv6()
@@ -2397,15 +2444,17 @@
 	local vtep1_ip=2001:db8:1000::1
 	local vtep2_ip=2001:db8:2000::1
 	local grp1=239.1.1.1
+	local grp1_dmac=01:00:5e:01:01:01
 	local grp2=239.2.2.2
+	local grp2_dmac=01:00:5e:02:02:02
 	local src=192.0.2.129
 
 	echo
 	echo "Data path: MDB torture test - IPv4 overlay / IPv6 underlay"
 	echo "----------------------------------------------------------"
 
-	mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \
-		"mausezahn"
+	mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \
+		$grp2_dmac $src "mausezahn"
 }
 
 mdb_torture_ipv6_ipv6()
@@ -2414,15 +2463,17 @@
 	local vtep1_ip=2001:db8:1000::1
 	local vtep2_ip=2001:db8:2000::1
 	local grp1=ff0e::1
+	local grp1_dmac=33:33:00:00:00:01
 	local grp2=ff0e::2
+	local grp2_dmac=33:33:00:00:00:02
 	local src=2001:db8:100::1
 
 	echo
 	echo "Data path: MDB torture test - IPv6 overlay / IPv6 underlay"
 	echo "----------------------------------------------------------"
 
-	mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \
-		"mausezahn -6"
+	mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \
+		$grp2_dmac $src "mausezahn -6"
 }
 
 ################################################################################
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/tls.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/tls.c
@@ -429,64 +429,6 @@
 	EXPECT_EQ(recv(self->cfd, buf, st.st_size, MSG_WAITALL), st.st_size);
 }
 
-static void chunked_sendfile(struct __test_metadata *_metadata,
-			     struct _test_data_tls *self,
-			     uint16_t chunk_size,
-			     uint16_t extra_payload_size)
-{
-	char buf[TLS_PAYLOAD_MAX_LEN];
-	uint16_t test_payload_size;
-	int size = 0;
-	int ret;
-	char filename[] = "/tmp/mytemp.XXXXXX";
-	int fd = mkstemp(filename);
-	off_t offset = 0;
-
-	unlink(filename);
-	ASSERT_GE(fd, 0);
-	EXPECT_GE(chunk_size, 1);
-	test_payload_size = chunk_size + extra_payload_size;
-	ASSERT_GE(TLS_PAYLOAD_MAX_LEN, test_payload_size);
-	memset(buf, 1, test_payload_size);
-	size = write(fd, buf, test_payload_size);
-	EXPECT_EQ(size, test_payload_size);
-	fsync(fd);
-
-	while (size > 0) {
-		ret = sendfile(self->fd, fd, &offset, chunk_size);
-		EXPECT_GE(ret, 0);
-		size -= ret;
-	}
-
-	EXPECT_EQ(recv(self->cfd, buf, test_payload_size, MSG_WAITALL),
-		  test_payload_size);
-
-	close(fd);
-}
-
-TEST_F(tls, multi_chunk_sendfile)
-{
-	chunked_sendfile(_metadata, self, 4096, 4096);
-	chunked_sendfile(_metadata, self, 4096, 0);
-	chunked_sendfile(_metadata, self, 4096, 1);
-	chunked_sendfile(_metadata, self, 4096, 2048);
-	chunked_sendfile(_metadata, self, 8192, 2048);
-	chunked_sendfile(_metadata, self, 4096, 8192);
-	chunked_sendfile(_metadata, self, 8192, 4096);
-	chunked_sendfile(_metadata, self, 12288, 1024);
-	chunked_sendfile(_metadata, self, 12288, 2000);
-	chunked_sendfile(_metadata, self, 15360, 100);
-	chunked_sendfile(_metadata, self, 15360, 300);
-	chunked_sendfile(_metadata, self, 1, 4096);
-	chunked_sendfile(_metadata, self, 2048, 4096);
-	chunked_sendfile(_metadata, self, 2048, 8192);
-	chunked_sendfile(_metadata, self, 4096, 8192);
-	chunked_sendfile(_metadata, self, 1024, 12288);
-	chunked_sendfile(_metadata, self, 2000, 12288);
-	chunked_sendfile(_metadata, self, 100, 15360);
-	chunked_sendfile(_metadata, self, 300, 15360);
-}
-
 TEST_F(tls, recv_max)
 {
 	unsigned int send_len = TLS_PAYLOAD_MAX_LEN;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/udpgro.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/udpgro.sh
@@ -7,8 +7,6 @@
 
 readonly PEER_NS="ns-peer-$(mktemp -u XXXXXX)"
 
-BPF_FILE="xdp_dummy.o"
-
 # set global exit status, but never reset nonzero one.
 check_err()
 {
@@ -38,7 +36,7 @@
 	ip -netns "${PEER_NS}" addr add dev veth1 192.168.1.1/24
 	ip -netns "${PEER_NS}" addr add dev veth1 2001:db8::1/64 nodad
 	ip -netns "${PEER_NS}" link set dev veth1 up
-	ip -n "${PEER_NS}" link set veth1 xdp object ${BPF_FILE} section xdp
+	ip netns exec "${PEER_NS}" ethtool -K veth1 gro on
 }
 
 run_one() {
@@ -46,17 +44,19 @@
 	local -r all="$@"
 	local -r tx_args=${all%rx*}
 	local -r rx_args=${all#*rx}
+	local ret=0
 
 	cfg_veth
 
-	ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${rx_args} && \
-		echo "ok" || \
-		echo "failed" &
+	ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${rx_args} &
+	local PID1=$!
 
 	wait_local_port_listen ${PEER_NS} 8000 udp
 	./udpgso_bench_tx ${tx_args}
-	ret=$?
-	wait $(jobs -p)
+	check_err $?
+	wait ${PID1}
+	check_err $?
+	[ "$ret" -eq 0 ] && echo "ok" || echo "failed"
 	return $ret
 }
 
@@ -73,6 +73,7 @@
 	local -r all="$@"
 	local -r tx_args=${all%rx*}
 	local -r rx_args=${all#*rx}
+	local ret=0
 
 	if [[ ${tx_args} = *-4* ]]; then
 		ipt_cmd=iptables
@@ -93,16 +94,17 @@
 	# ... so that GRO will match the UDP_GRO enabled socket, but packets
 	# will land on the 'plain' one
 	ip netns exec "${PEER_NS}" ./udpgso_bench_rx -G ${family} -b ${addr1} -n 0 &
-	pid=$!
-	ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${family} -b ${addr2%/*} ${rx_args} && \
-		echo "ok" || \
-		echo "failed"&
+	local PID1=$!
+	ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${family} -b ${addr2%/*} ${rx_args} &
+	local PID2=$!
 
 	wait_local_port_listen "${PEER_NS}" 8000 udp
 	./udpgso_bench_tx ${tx_args}
-	ret=$?
-	kill -INT $pid
-	wait $(jobs -p)
+	check_err $?
+	kill -INT ${PID1}
+	wait ${PID2}
+	check_err $?
+	[ "$ret" -eq 0 ] && echo "ok" || echo "failed"
 	return $ret
 }
 
@@ -111,20 +113,26 @@
 	local -r all="$@"
 	local -r tx_args=${all%rx*}
 	local -r rx_args=${all#*rx}
+	local ret=0
 
 	cfg_veth
 
 	ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${rx_args} -p 12345 &
-	ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 2000 -R 10 ${rx_args} && \
-		echo "ok" || \
-		echo "failed" &
+	local PID1=$!
+	ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 2000 -R 10 ${rx_args} &
+	local PID2=$!
 
 	wait_local_port_listen "${PEER_NS}" 12345 udp
 	./udpgso_bench_tx ${tx_args} -p 12345
+	check_err $?
 	wait_local_port_listen "${PEER_NS}" 8000 udp
 	./udpgso_bench_tx ${tx_args}
-	ret=$?
-	wait $(jobs -p)
+	check_err $?
+	wait ${PID1}
+	check_err $?
+	wait ${PID2}
+	check_err $?
+	[ "$ret" -eq 0 ] && echo "ok" || echo "failed"
 	return $ret
 }
 
@@ -196,11 +204,6 @@
 	return $ret
 }
 
-if [ ! -f ${BPF_FILE} ]; then
-	echo "Missing ${BPF_FILE}. Run 'make' first"
-	exit -1
-fi
-
 if [[ $# -eq 0 ]]; then
 	run_all
 elif [[ $1 == "__subprocess" ]]; then
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/udpgro_fwd.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/net/udpgro_fwd.sh
@@ -241,7 +241,7 @@
 
 	create_vxlan_pair
 	ip netns exec $NS_DST ethtool -K veth$DST rx-gro-list on
-	run_test "GRO frag list over UDP tunnel" $OL_NET$DST 1 1
+	run_test "GRO frag list over UDP tunnel" $OL_NET$DST 10 10
 	cleanup
 
 	# use NAT to circumvent GRO FWD check
@@ -254,13 +254,7 @@
 	# load arp cache before running the test to reduce the amount of
 	# stray traffic on top of the UDP tunnel
 	ip netns exec $NS_SRC $PING -q -c 1 $OL_NET$DST_NAT >/dev/null
-	run_test "GRO fwd over UDP tunnel" $OL_NET$DST_NAT 1 1 $OL_NET$DST
-	cleanup
-
-	create_vxlan_pair
-	run_bench "UDP tunnel fwd perf" $OL_NET$DST
-	ip netns exec $NS_DST ethtool -K veth$DST rx-udp-gro-forwarding on
-	run_bench "UDP tunnel GRO fwd perf" $OL_NET$DST
+	run_test "GRO fwd over UDP tunnel" $OL_NET$DST_NAT 10 10 $OL_NET$DST
 	cleanup
 done
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/net/udpgso.c
+++ linux-qcom-6.8.0/tools/testing/selftests/net/udpgso.c
@@ -34,7 +34,7 @@
 #endif
 
 #ifndef UDP_MAX_SEGMENTS
-#define UDP_MAX_SEGMENTS	(1 << 6UL)
+#define UDP_MAX_SEGMENTS	(1 << 7UL)
 #endif
 
 #define CONST_MTU_TEST	1500
--- linux-qcom-6.8.0.orig/tools/testing/selftests/netfilter/conntrack_dump_flush.c
+++ linux-qcom-6.8.0/tools/testing/selftests/netfilter/conntrack_dump_flush.c
@@ -43,6 +43,8 @@
 	mnl_attr_nest_end(nlh, nest_proto);
 
 	mnl_attr_nest_end(nlh, nest);
+
+	return 0;
 }
 
 static int build_cta_tuple_v6(struct nlmsghdr *nlh, int type,
@@ -71,6 +73,8 @@
 	mnl_attr_nest_end(nlh, nest_proto);
 
 	mnl_attr_nest_end(nlh, nest);
+
+	return 0;
 }
 
 static int build_cta_proto(struct nlmsghdr *nlh)
@@ -90,6 +94,8 @@
 	mnl_attr_nest_end(nlh, nest_proto);
 
 	mnl_attr_nest_end(nlh, nest);
+
+	return 0;
 }
 
 static int conntrack_data_insert(struct mnl_socket *sock, struct nlmsghdr *nlh,
@@ -207,6 +213,7 @@
 static int count_entries(const struct nlmsghdr *nlh, void *data)
 {
 	reply_counter++;
+	return MNL_CB_OK;
 }
 
 static int conntracK_count_zone(struct mnl_socket *sock, uint16_t zone)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/netfilter/ipvs.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/netfilter/ipvs.sh
@@ -114,7 +114,7 @@
 }
 
 server_listen() {
-	ip netns exec ns2 nc -l -p 8080 > "${outfile}" &
+	ip netns exec "$ns2" timeout 5 socat -u -4 TCP-LISTEN:8080,reuseaddr STDOUT > "${outfile}" &
 	server_pid=$!
 	sleep 0.2
 }
--- linux-qcom-6.8.0.orig/tools/testing/selftests/netfilter/nft_audit.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/netfilter/nft_audit.sh
@@ -25,12 +25,31 @@
 trap 'kill $logread_pid; rm -f $logfile $rulefile' EXIT
 exec 3<"$logfile"
 
+lsplit='s/^\(.*\) entries=\([^ ]*\) \(.*\)$/pfx="\1"\nval="\2"\nsfx="\3"/'
+summarize_logs() {
+	sum=0
+	while read line; do
+		eval $(sed "$lsplit" <<< "$line")
+		[[ $sum -gt 0 ]] && {
+			[[ "$pfx $sfx" == "$tpfx $tsfx" ]] && {
+				let "sum += val"
+				continue
+			}
+			echo "$tpfx entries=$sum $tsfx"
+		}
+		tpfx="$pfx"
+		tsfx="$sfx"
+		sum=$val
+	done
+	echo "$tpfx entries=$sum $tsfx"
+}
+
 do_test() { # (cmd, log)
 	echo -n "testing for cmd: $1 ... "
 	cat <&3 >/dev/null
 	$1 >/dev/null || exit 1
 	sleep 0.1
-	res=$(diff -a -u <(echo "$2") - <&3)
+	res=$(diff -a -u <(echo "$2") <(summarize_logs <&3))
 	[ $? -eq 0 ] && { echo "OK"; return; }
 	echo "FAIL"
 	grep -v '^\(---\|+++\|@@\)' <<< "$res"
@@ -129,31 +148,17 @@
 'table=t1 family=2 entries=3 op=nft_reset_rule'
 
 do_test 'nft reset rules table t1' \
-'table=t1 family=2 entries=3 op=nft_reset_rule
-table=t1 family=2 entries=3 op=nft_reset_rule
-table=t1 family=2 entries=3 op=nft_reset_rule'
+'table=t1 family=2 entries=9 op=nft_reset_rule'
 
 do_test 'nft reset rules t2 c3' \
-'table=t2 family=2 entries=189 op=nft_reset_rule
-table=t2 family=2 entries=188 op=nft_reset_rule
-table=t2 family=2 entries=126 op=nft_reset_rule'
+'table=t2 family=2 entries=503 op=nft_reset_rule'
 
 do_test 'nft reset rules t2' \
-'table=t2 family=2 entries=3 op=nft_reset_rule
-table=t2 family=2 entries=3 op=nft_reset_rule
-table=t2 family=2 entries=186 op=nft_reset_rule
-table=t2 family=2 entries=188 op=nft_reset_rule
-table=t2 family=2 entries=129 op=nft_reset_rule'
+'table=t2 family=2 entries=509 op=nft_reset_rule'
 
 do_test 'nft reset rules' \
-'table=t1 family=2 entries=3 op=nft_reset_rule
-table=t1 family=2 entries=3 op=nft_reset_rule
-table=t1 family=2 entries=3 op=nft_reset_rule
-table=t2 family=2 entries=3 op=nft_reset_rule
-table=t2 family=2 entries=3 op=nft_reset_rule
-table=t2 family=2 entries=180 op=nft_reset_rule
-table=t2 family=2 entries=188 op=nft_reset_rule
-table=t2 family=2 entries=135 op=nft_reset_rule'
+'table=t1 family=2 entries=9 op=nft_reset_rule
+table=t2 family=2 entries=509 op=nft_reset_rule'
 
 # resetting sets and elements
 
@@ -177,13 +182,11 @@
 'table=t1 family=2 entries=1 op=nft_reset_obj'
 
 do_test 'nft reset counters t2' \
-'table=t2 family=2 entries=342 op=nft_reset_obj
-table=t2 family=2 entries=158 op=nft_reset_obj'
+'table=t2 family=2 entries=500 op=nft_reset_obj'
 
 do_test 'nft reset counters' \
 'table=t1 family=2 entries=1 op=nft_reset_obj
-table=t2 family=2 entries=341 op=nft_reset_obj
-table=t2 family=2 entries=159 op=nft_reset_obj'
+table=t2 family=2 entries=500 op=nft_reset_obj'
 
 # resetting quotas
 
@@ -194,13 +197,11 @@
 'table=t1 family=2 entries=1 op=nft_reset_obj'
 
 do_test 'nft reset quotas t2' \
-'table=t2 family=2 entries=315 op=nft_reset_obj
-table=t2 family=2 entries=185 op=nft_reset_obj'
+'table=t2 family=2 entries=500 op=nft_reset_obj'
 
 do_test 'nft reset quotas' \
 'table=t1 family=2 entries=1 op=nft_reset_obj
-table=t2 family=2 entries=314 op=nft_reset_obj
-table=t2 family=2 entries=186 op=nft_reset_obj'
+table=t2 family=2 entries=500 op=nft_reset_obj'
 
 # deleting rules
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/netfilter/rpath.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/netfilter/rpath.sh
@@ -61,14 +61,26 @@
 ip -net "$ns1" a a fec0:42::2/64 dev v0 nodad
 ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad
 
+# avoid neighbor lookups and enable martian IPv6 pings
+ns2_hwaddr=$(ip -net "$ns2" link show dev v0 | \
+	     sed -n 's, *link/ether \([^ ]*\) .*,\1,p')
+ns1_hwaddr=$(ip -net "$ns1" link show dev v0 | \
+	     sed -n 's, *link/ether \([^ ]*\) .*,\1,p')
+ip -net "$ns1" neigh add fec0:42::1 lladdr "$ns2_hwaddr" nud permanent dev v0
+ip -net "$ns1" neigh add fec0:23::1 lladdr "$ns2_hwaddr" nud permanent dev v0
+ip -net "$ns2" neigh add fec0:42::2 lladdr "$ns1_hwaddr" nud permanent dev d0
+ip -net "$ns2" neigh add fec0:23::2 lladdr "$ns1_hwaddr" nud permanent dev v0
+
 # firewall matches to test
 [ -n "$iptables" ] && {
 	common='-t raw -A PREROUTING -s 192.168.0.0/16'
+	common+=' -p icmp --icmp-type echo-request'
 	ip netns exec "$ns2" "$iptables" $common -m rpfilter
 	ip netns exec "$ns2" "$iptables" $common -m rpfilter --invert
 }
 [ -n "$ip6tables" ] && {
 	common='-t raw -A PREROUTING -s fec0::/16'
+	common+=' -p icmpv6 --icmpv6-type echo-request'
 	ip netns exec "$ns2" "$ip6tables" $common -m rpfilter
 	ip netns exec "$ns2" "$ip6tables" $common -m rpfilter --invert
 }
@@ -76,8 +88,10 @@
 table inet t {
 	chain c {
 		type filter hook prerouting priority raw;
-		ip saddr 192.168.0.0/16 fib saddr . iif oif exists counter
-		ip6 saddr fec0::/16 fib saddr . iif oif exists counter
+		ip saddr 192.168.0.0/16 icmp type echo-request \
+			fib saddr . iif oif exists counter
+		ip6 saddr fec0::/16 icmpv6 type echo-request \
+			fib saddr . iif oif exists counter
 	}
 }
 EOF
--- linux-qcom-6.8.0.orig/tools/testing/selftests/nolibc/nolibc-test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/nolibc/nolibc-test.c
@@ -533,7 +533,7 @@
 {
 	int ret = 0;
 
-	llen += printf(" = <%s> ", expr);
+	llen += printf(" = <%s> ", expr ? expr : "(null)");
 	if (expr) {
 		ret = 1;
 		result(llen, FAIL);
@@ -552,7 +552,7 @@
 {
 	int ret = 0;
 
-	llen += printf(" = <%s> ", expr);
+	llen += printf(" = <%s> ", expr ? expr : "(null)");
 	if (!expr) {
 		ret = 1;
 		result(llen, FAIL);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/openat2/openat2_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/openat2/openat2_test.c
@@ -5,6 +5,7 @@
  */
 
 #define _GNU_SOURCE
+#define __SANE_USERSPACE_TYPES__ // Use ll64
 #include <fcntl.h>
 #include <sched.h>
 #include <sys/stat.h>
--- linux-qcom-6.8.0.orig/tools/testing/selftests/powerpc/dexcr/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/powerpc/dexcr/Makefile
@@ -3,7 +3,7 @@
 
 include ../../lib.mk
 
-$(OUTPUT)/hashchk_test: CFLAGS += -fno-pie $(call cc-option,-mno-rop-protect)
+$(OUTPUT)/hashchk_test: CFLAGS += -fno-pie -no-pie $(call cc-option,-mno-rop-protect)
 
 $(TEST_GEN_PROGS): ../harness.c ../utils.c ./dexcr.c
 $(TEST_GEN_FILES): ../utils.c ./dexcr.c
--- linux-qcom-6.8.0.orig/tools/testing/selftests/powerpc/papr_vpd/papr_vpd.c
+++ linux-qcom-6.8.0/tools/testing/selftests/powerpc/papr_vpd/papr_vpd.c
@@ -154,7 +154,7 @@
 static int papr_vpd_close_handle_without_reading(void)
 {
 	const int devfd = open(DEVPATH, O_RDONLY);
-	struct papr_location_code lc;
+	struct papr_location_code lc = { .str = "", };
 	int fd;
 
 	SKIP_IF_MSG(devfd < 0 && errno == ENOENT,
--- linux-qcom-6.8.0.orig/tools/testing/selftests/powerpc/ptrace/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/powerpc/ptrace/Makefile
@@ -33,7 +33,7 @@
 $(TESTS_64): CFLAGS += -m64
 $(TM_TESTS): CFLAGS += -I../tm -mhtm
 
-CFLAGS += $(KHDR_INCLUDES) -fno-pie
+CFLAGS += $(KHDR_INCLUDES) -fno-pie -Wno-error=deprecated
 
 $(OUTPUT)/ptrace-gpr: ptrace-gpr.S
 $(OUTPUT)/ptrace-perf-hwbreak: ptrace-perf-asm.S
--- linux-qcom-6.8.0.orig/tools/testing/selftests/rcutorture/bin/torture.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/rcutorture/bin/torture.sh
@@ -567,7 +567,7 @@
 	torture_bootargs="rcupdate.rcu_cpu_stall_suppress_at_boot=1 torture.disable_onoff_at_boot rcupdate.rcu_task_stall_timeout=30000 tsc=watchdog"
 	torture_set "clocksourcewd-1" tools/testing/selftests/rcutorture/bin/kvm.sh --allcpus --duration 45s --configs TREE03 --kconfig "CONFIG_TEST_CLOCKSOURCE_WATCHDOG=y" --trust-make
 
-	torture_bootargs="rcupdate.rcu_cpu_stall_suppress_at_boot=1 torture.disable_onoff_at_boot rcupdate.rcu_task_stall_timeout=30000 clocksource.max_cswd_read_retries=1 tsc=watchdog"
+	torture_bootargs="rcupdate.rcu_cpu_stall_suppress_at_boot=1 torture.disable_onoff_at_boot rcupdate.rcu_task_stall_timeout=30000 tsc=watchdog"
 	torture_set "clocksourcewd-2" tools/testing/selftests/rcutorture/bin/kvm.sh --allcpus --duration 45s --configs TREE03 --kconfig "CONFIG_TEST_CLOCKSOURCE_WATCHDOG=y" --trust-make
 
 	# In case our work is already done...
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/Makefile
@@ -5,6 +5,8 @@
 
 TEST_GEN_PROGS := resctrl_tests
 
+LOCAL_HDRS += $(wildcard *.h)
+
 include ../lib.mk
 
-$(OUTPUT)/resctrl_tests: $(wildcard *.[ch])
+$(OUTPUT)/resctrl_tests: $(wildcard *.c)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/cache.c
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/cache.c
@@ -40,7 +40,7 @@
 	fd_lm = perf_event_open(&pea_llc_miss, pid, cpu_no, -1,
 				PERF_FLAG_FD_CLOEXEC);
 	if (fd_lm == -1) {
-		perror("Error opening leader");
+		ksft_perror("Error opening leader");
 		ctrlc_handler(0, NULL, NULL);
 		return -1;
 	}
@@ -95,7 +95,7 @@
 
 	ret = read(fd_lm, &rf_cqm, sizeof(struct read_format));
 	if (ret == -1) {
-		perror("Could not get llc misses through perf");
+		ksft_perror("Could not get llc misses through perf");
 		return -1;
 	}
 
@@ -124,12 +124,12 @@
 
 	fp = fopen(llc_occup_path, "r");
 	if (!fp) {
-		perror("Failed to open results file");
+		ksft_perror("Failed to open results file");
 
 		return errno;
 	}
 	if (fscanf(fp, "%lu", llc_occupancy) <= 0) {
-		perror("Could not get llc occupancy");
+		ksft_perror("Could not get llc occupancy");
 		fclose(fp);
 
 		return -1;
@@ -159,7 +159,7 @@
 	} else {
 		fp = fopen(filename, "a");
 		if (!fp) {
-			perror("Cannot open results file");
+			ksft_perror("Cannot open results file");
 
 			return errno;
 		}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/cat_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/cat_test.c
@@ -51,7 +51,7 @@
 	ksft_print_msg("Checking for pass/fail\n");
 	fp = fopen(param->filename, "r");
 	if (!fp) {
-		perror("# Cannot open file");
+		ksft_perror("Cannot open file");
 
 		return errno;
 	}
@@ -149,7 +149,7 @@
 	param.num_of_runs = 0;
 
 	if (pipe(pipefd)) {
-		perror("# Unable to create pipe");
+		ksft_perror("Unable to create pipe");
 		return errno;
 	}
 
@@ -185,7 +185,7 @@
 			 * Just print the error message.
 			 * Let while(1) run and wait for itself to be killed.
 			 */
-			perror("# failed signaling parent process");
+			ksft_perror("Failed signaling parent process");
 
 		close(pipefd[1]);
 		while (1)
@@ -197,7 +197,7 @@
 		while (pipe_message != 1) {
 			if (read(pipefd[0], &pipe_message,
 				 sizeof(pipe_message)) < sizeof(pipe_message)) {
-				perror("# failed reading from child process");
+				ksft_perror("Failed reading from child process");
 				break;
 			}
 		}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/cmt_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/cmt_test.c
@@ -37,7 +37,7 @@
 	ksft_print_msg("Checking for pass/fail\n");
 	fp = fopen(param->filename, "r");
 	if (!fp) {
-		perror("# Error in opening file\n");
+		ksft_perror("Error in opening file");
 
 		return errno;
 	}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/fill_buf.c
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/fill_buf.c
@@ -51,29 +51,6 @@
 	sb();
 }
 
-static void *malloc_and_init_memory(size_t buf_size)
-{
-	void *p = NULL;
-	uint64_t *p64;
-	size_t s64;
-	int ret;
-
-	ret = posix_memalign(&p, PAGE_SIZE, buf_size);
-	if (ret < 0)
-		return NULL;
-
-	p64 = (uint64_t *)p;
-	s64 = buf_size / sizeof(uint64_t);
-
-	while (s64 > 0) {
-		*p64 = (uint64_t)rand();
-		p64 += (CL_SIZE / sizeof(uint64_t));
-		s64 -= (CL_SIZE / sizeof(uint64_t));
-	}
-
-	return p;
-}
-
 static int fill_one_span_read(unsigned char *buf, size_t buf_size)
 {
 	unsigned char *end_ptr = buf + buf_size;
@@ -115,7 +92,7 @@
 	/* Consume read result so that reading memory is not optimized out. */
 	fp = fopen("/dev/null", "w");
 	if (!fp) {
-		perror("Unable to write to /dev/null");
+		ksft_perror("Unable to write to /dev/null");
 		return -1;
 	}
 	fprintf(fp, "Sum: %d ", ret);
@@ -135,41 +112,48 @@
 	return 0;
 }
 
-static int fill_cache(size_t buf_size, int memflush, int op, bool once)
+static unsigned char *alloc_buffer(size_t buf_size, int memflush)
 {
-	unsigned char *buf;
+	void *buf = NULL;
+	uint64_t *p64;
+	ssize_t s64;
 	int ret;
 
-	buf = malloc_and_init_memory(buf_size);
-	if (!buf)
-		return -1;
-
-	/* Flush the memory before using to avoid "cache hot pages" effect */
-	if (memflush)
-		mem_flush(buf, buf_size);
-
-	if (op == 0)
-		ret = fill_cache_read(buf, buf_size, once);
-	else
-		ret = fill_cache_write(buf, buf_size, once);
+	ret = posix_memalign(&buf, PAGE_SIZE, buf_size);
+	if (ret < 0)
+		return NULL;
 
-	free(buf);
+	/* Initialize the buffer */
+	p64 = buf;
+	s64 = buf_size / sizeof(uint64_t);
 
-	if (ret) {
-		printf("\n Error in fill cache read/write...\n");
-		return -1;
+	while (s64 > 0) {
+		*p64 = (uint64_t)rand();
+		p64 += (CL_SIZE / sizeof(uint64_t));
+		s64 -= (CL_SIZE / sizeof(uint64_t));
 	}
 
+	/* Flush the memory before using to avoid "cache hot pages" effect */
+	if (memflush)
+		mem_flush(buf, buf_size);
 
-	return 0;
+	return buf;
 }
 
-int run_fill_buf(size_t span, int memflush, int op, bool once)
+int run_fill_buf(size_t buf_size, int memflush, int op, bool once)
 {
-	size_t cache_size = span;
+	unsigned char *buf;
 	int ret;
 
-	ret = fill_cache(cache_size, memflush, op, once);
+	buf = alloc_buffer(buf_size, memflush);
+	if (!buf)
+		return -1;
+
+	if (op == 0)
+		ret = fill_cache_read(buf, buf_size, once);
+	else
+		ret = fill_cache_write(buf, buf_size, once);
+	free(buf);
 	if (ret) {
 		printf("\n Error in fill cache\n");
 		return -1;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/mba_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/mba_test.c
@@ -109,7 +109,7 @@
 
 	fp = fopen(output, "r");
 	if (!fp) {
-		perror(output);
+		ksft_perror(output);
 
 		return errno;
 	}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/mbm_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/mbm_test.c
@@ -59,7 +59,7 @@
 
 	fp = fopen(output, "r");
 	if (!fp) {
-		perror(output);
+		ksft_perror(output);
 
 		return errno;
 	}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/resctrl.h
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/resctrl.h
@@ -37,9 +37,8 @@
 
 #define DEFAULT_SPAN		(250 * MB)
 
-#define PARENT_EXIT(err_msg)			\
+#define PARENT_EXIT()				\
 	do {					\
-		perror(err_msg);		\
 		kill(ppid, SIGKILL);		\
 		umount_resctrlfs();		\
 		exit(EXIT_FAILURE);		\
@@ -92,7 +91,7 @@
 			    char *resctrl_val);
 int perf_event_open(struct perf_event_attr *hw_event, pid_t pid, int cpu,
 		    int group_fd, unsigned long flags);
-int run_fill_buf(size_t span, int memflush, int op, bool once);
+int run_fill_buf(size_t buf_size, int memflush, int op, bool once);
 int resctrl_val(const char * const *benchmark_cmd, struct resctrl_val_param *param);
 int mbm_bw_change(int cpu_no, const char * const *benchmark_cmd);
 void tests_cleanup(void);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/resctrl_val.c
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/resctrl_val.c
@@ -102,13 +102,12 @@
 	char *token[MAX_TOKENS];
 	int i = 0;
 
-	strcat(cas_count_cfg, ",");
 	token[0] = strtok(cas_count_cfg, "=,");
 
 	for (i = 1; i < MAX_TOKENS; i++)
 		token[i] = strtok(NULL, "=,");
 
-	for (i = 0; i < MAX_TOKENS; i++) {
+	for (i = 0; i < MAX_TOKENS - 1; i++) {
 		if (!token[i])
 			break;
 		if (strcmp(token[i], "event") == 0) {
@@ -156,12 +155,12 @@
 	sprintf(imc_counter_type, "%s%s", imc_dir, "type");
 	fp = fopen(imc_counter_type, "r");
 	if (!fp) {
-		perror("Failed to open imc counter type file");
+		ksft_perror("Failed to open iMC counter type file");
 
 		return -1;
 	}
 	if (fscanf(fp, "%u", &imc_counters_config[count][READ].type) <= 0) {
-		perror("Could not get imc type");
+		ksft_perror("Could not get iMC type");
 		fclose(fp);
 
 		return -1;
@@ -175,12 +174,12 @@
 	sprintf(imc_counter_cfg, "%s%s", imc_dir, READ_FILE_NAME);
 	fp = fopen(imc_counter_cfg, "r");
 	if (!fp) {
-		perror("Failed to open imc config file");
+		ksft_perror("Failed to open iMC config file");
 
 		return -1;
 	}
-	if (fscanf(fp, "%s", cas_count_cfg) <= 0) {
-		perror("Could not get imc cas count read");
+	if (fscanf(fp, "%1023s", cas_count_cfg) <= 0) {
+		ksft_perror("Could not get iMC cas count read");
 		fclose(fp);
 
 		return -1;
@@ -193,12 +192,12 @@
 	sprintf(imc_counter_cfg, "%s%s", imc_dir, WRITE_FILE_NAME);
 	fp = fopen(imc_counter_cfg, "r");
 	if (!fp) {
-		perror("Failed to open imc config file");
+		ksft_perror("Failed to open iMC config file");
 
 		return -1;
 	}
-	if  (fscanf(fp, "%s", cas_count_cfg) <= 0) {
-		perror("Could not get imc cas count write");
+	if  (fscanf(fp, "%1023s", cas_count_cfg) <= 0) {
+		ksft_perror("Could not get iMC cas count write");
 		fclose(fp);
 
 		return -1;
@@ -262,12 +261,12 @@
 		}
 		closedir(dp);
 		if (count == 0) {
-			perror("Unable find iMC counters!\n");
+			ksft_print_msg("Unable to find iMC counters\n");
 
 			return -1;
 		}
 	} else {
-		perror("Unable to open PMU directory!\n");
+		ksft_perror("Unable to open PMU directory");
 
 		return -1;
 	}
@@ -292,6 +291,18 @@
 	return 0;
 }
 
+static void perf_close_imc_mem_bw(void)
+{
+	int mc;
+
+	for (mc = 0; mc < imcs; mc++) {
+		if (imc_counters_config[mc][READ].fd != -1)
+			close(imc_counters_config[mc][READ].fd);
+		if (imc_counters_config[mc][WRITE].fd != -1)
+			close(imc_counters_config[mc][WRITE].fd);
+	}
+}
+
 /*
  * get_mem_bw_imc:	Memory band width as reported by iMC counters
  * @cpu_no:		CPU number that the benchmark PID is binded to
@@ -305,26 +316,33 @@
 static int get_mem_bw_imc(int cpu_no, char *bw_report, float *bw_imc)
 {
 	float reads, writes, of_mul_read, of_mul_write;
-	int imc, j, ret;
+	int imc, ret;
+
+	for (imc = 0; imc < imcs; imc++) {
+		imc_counters_config[imc][READ].fd = -1;
+		imc_counters_config[imc][WRITE].fd = -1;
+	}
 
 	/* Start all iMC counters to log values (both read and write) */
 	reads = 0, writes = 0, of_mul_read = 1, of_mul_write = 1;
 	for (imc = 0; imc < imcs; imc++) {
-		for (j = 0; j < 2; j++) {
-			ret = open_perf_event(imc, cpu_no, j);
-			if (ret)
-				return -1;
-		}
-		for (j = 0; j < 2; j++)
-			membw_ioctl_perf_event_ioc_reset_enable(imc, j);
+		ret = open_perf_event(imc, cpu_no, READ);
+		if (ret)
+			goto close_fds;
+		ret = open_perf_event(imc, cpu_no, WRITE);
+		if (ret)
+			goto close_fds;
+
+		membw_ioctl_perf_event_ioc_reset_enable(imc, READ);
+		membw_ioctl_perf_event_ioc_reset_enable(imc, WRITE);
 	}
 
 	sleep(1);
 
 	/* Stop counters after a second to get results (both read and write) */
 	for (imc = 0; imc < imcs; imc++) {
-		for (j = 0; j < 2; j++)
-			membw_ioctl_perf_event_ioc_disable(imc, j);
+		membw_ioctl_perf_event_ioc_disable(imc, READ);
+		membw_ioctl_perf_event_ioc_disable(imc, WRITE);
 	}
 
 	/*
@@ -339,16 +357,14 @@
 
 		if (read(r->fd, &r->return_value,
 			 sizeof(struct membw_read_format)) == -1) {
-			perror("Couldn't get read b/w through iMC");
-
-			return -1;
+			ksft_perror("Couldn't get read b/w through iMC");
+			goto close_fds;
 		}
 
 		if (read(w->fd, &w->return_value,
 			 sizeof(struct membw_read_format)) == -1) {
-			perror("Couldn't get write bw through iMC");
-
-			return -1;
+			ksft_perror("Couldn't get write bw through iMC");
+			goto close_fds;
 		}
 
 		__u64 r_time_enabled = r->return_value.time_enabled;
@@ -368,10 +384,7 @@
 		writes += w->return_value.value * of_mul_write * SCALE;
 	}
 
-	for (imc = 0; imc < imcs; imc++) {
-		close(imc_counters_config[imc][READ].fd);
-		close(imc_counters_config[imc][WRITE].fd);
-	}
+	perf_close_imc_mem_bw();
 
 	if (strcmp(bw_report, "reads") == 0) {
 		*bw_imc = reads;
@@ -385,6 +398,10 @@
 
 	*bw_imc = reads + writes;
 	return 0;
+
+close_fds:
+	perf_close_imc_mem_bw();
+	return -1;
 }
 
 void set_mbm_path(const char *ctrlgrp, const char *mongrp, int resource_id)
@@ -416,7 +433,7 @@
 	int resource_id;
 
 	if (get_resource_id(cpu_no, &resource_id) < 0) {
-		perror("Could not get resource_id");
+		ksft_print_msg("Could not get resource_id\n");
 		return;
 	}
 
@@ -449,12 +466,12 @@
 
 	fp = fopen(mbm_total_path, "r");
 	if (!fp) {
-		perror("Failed to open total bw file");
+		ksft_perror("Failed to open total bw file");
 
 		return -1;
 	}
 	if (fscanf(fp, "%lu", mbm_total) <= 0) {
-		perror("Could not get mbm local bytes");
+		ksft_perror("Could not get mbm local bytes");
 		fclose(fp);
 
 		return -1;
@@ -495,7 +512,7 @@
 	if (sigaction(SIGINT, &sigact, NULL) ||
 	    sigaction(SIGTERM, &sigact, NULL) ||
 	    sigaction(SIGHUP, &sigact, NULL)) {
-		perror("# sigaction");
+		ksft_perror("sigaction");
 		ret = -1;
 	}
 	return ret;
@@ -515,7 +532,7 @@
 	if (sigaction(SIGINT, &sigact, NULL) ||
 	    sigaction(SIGTERM, &sigact, NULL) ||
 	    sigaction(SIGHUP, &sigact, NULL)) {
-		perror("# sigaction");
+		ksft_perror("sigaction");
 	}
 }
 
@@ -540,14 +557,14 @@
 	} else {
 		fp = fopen(filename, "a");
 		if (!fp) {
-			perror("Cannot open results file");
+			ksft_perror("Cannot open results file");
 
 			return errno;
 		}
 		if (fprintf(fp, "Pid: %d \t Mem_BW_iMC: %f \t Mem_BW_resc: %lu \t Difference: %lu\n",
 			    bm_pid, bw_imc, bw_resc, diff) <= 0) {
+			ksft_print_msg("Could not log results\n");
 			fclose(fp);
-			perror("Could not log results.");
 
 			return errno;
 		}
@@ -585,7 +602,7 @@
 	int resource_id;
 
 	if (get_resource_id(cpu_no, &resource_id) < 0) {
-		perror("# Unable to resource_id");
+		ksft_print_msg("Could not get resource_id\n");
 		return;
 	}
 
@@ -647,20 +664,24 @@
 	 * stdio (console)
 	 */
 	fp = freopen("/dev/null", "w", stdout);
-	if (!fp)
-		PARENT_EXIT("Unable to direct benchmark status to /dev/null");
+	if (!fp) {
+		ksft_perror("Unable to direct benchmark status to /dev/null");
+		PARENT_EXIT();
+	}
 
 	if (strcmp(benchmark_cmd[0], "fill_buf") == 0) {
 		/* Execute default fill_buf benchmark */
 		span = strtoul(benchmark_cmd[1], NULL, 10);
 		memflush =  atoi(benchmark_cmd[2]);
 		operation = atoi(benchmark_cmd[3]);
-		if (!strcmp(benchmark_cmd[4], "true"))
+		if (!strcmp(benchmark_cmd[4], "true")) {
 			once = true;
-		else if (!strcmp(benchmark_cmd[4], "false"))
+		} else if (!strcmp(benchmark_cmd[4], "false")) {
 			once = false;
-		else
-			PARENT_EXIT("Invalid once parameter");
+		} else {
+			ksft_print_msg("Invalid once parameter\n");
+			PARENT_EXIT();
+		}
 
 		if (run_fill_buf(span, memflush, operation, once))
 			fprintf(stderr, "Error in running fill buffer\n");
@@ -668,11 +689,12 @@
 		/* Execute specified benchmark */
 		ret = execvp(benchmark_cmd[0], benchmark_cmd);
 		if (ret)
-			perror("wrong\n");
+			ksft_perror("execvp");
 	}
 
 	fclose(stdout);
-	PARENT_EXIT("Unable to run specified benchmark");
+	ksft_print_msg("Unable to run specified benchmark\n");
+	PARENT_EXIT();
 }
 
 /*
@@ -709,7 +731,7 @@
 	ppid = getpid();
 
 	if (pipe(pipefd)) {
-		perror("# Unable to create pipe");
+		ksft_perror("Unable to create pipe");
 
 		return -1;
 	}
@@ -721,7 +743,7 @@
 	fflush(stdout);
 	bm_pid = fork();
 	if (bm_pid == -1) {
-		perror("# Unable to fork");
+		ksft_perror("Unable to fork");
 
 		return -1;
 	}
@@ -738,15 +760,17 @@
 		sigact.sa_flags = SA_SIGINFO;
 
 		/* Register for "SIGUSR1" signal from parent */
-		if (sigaction(SIGUSR1, &sigact, NULL))
-			PARENT_EXIT("Can't register child for signal");
+		if (sigaction(SIGUSR1, &sigact, NULL)) {
+			ksft_perror("Can't register child for signal");
+			PARENT_EXIT();
+		}
 
 		/* Tell parent that child is ready */
 		close(pipefd[0]);
 		pipe_message = 1;
 		if (write(pipefd[1], &pipe_message, sizeof(pipe_message)) <
 		    sizeof(pipe_message)) {
-			perror("# failed signaling parent process");
+			ksft_perror("Failed signaling parent process");
 			close(pipefd[1]);
 			return -1;
 		}
@@ -755,7 +779,8 @@
 		/* Suspend child until delivery of "SIGUSR1" from parent */
 		sigsuspend(&sigact.sa_mask);
 
-		PARENT_EXIT("Child is done");
+		ksft_perror("Child is done");
+		PARENT_EXIT();
 	}
 
 	ksft_print_msg("Benchmark PID: %d\n", bm_pid);
@@ -796,7 +821,7 @@
 	while (pipe_message != 1) {
 		if (read(pipefd[0], &pipe_message, sizeof(pipe_message)) <
 		    sizeof(pipe_message)) {
-			perror("# failed reading message from child process");
+			ksft_perror("Failed reading message from child process");
 			close(pipefd[0]);
 			goto out;
 		}
@@ -805,7 +830,7 @@
 
 	/* Signal child to start benchmark */
 	if (sigqueue(bm_pid, SIGUSR1, value) == -1) {
-		perror("# sigqueue SIGUSR1 to child");
+		ksft_perror("sigqueue SIGUSR1 to child");
 		ret = errno;
 		goto out;
 	}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/resctrl/resctrlfs.c
+++ linux-qcom-6.8.0/tools/testing/selftests/resctrl/resctrlfs.c
@@ -20,7 +20,7 @@
 
 	mounts = fopen("/proc/mounts", "r");
 	if (!mounts) {
-		perror("/proc/mounts");
+		ksft_perror("/proc/mounts");
 		return -ENXIO;
 	}
 	while (!feof(mounts)) {
@@ -69,7 +69,7 @@
 	ksft_print_msg("Mounting resctrl to \"%s\"\n", RESCTRL_PATH);
 	ret = mount("resctrl", RESCTRL_PATH, "resctrl", 0, NULL);
 	if (ret)
-		perror("# mount");
+		ksft_perror("mount");
 
 	return ret;
 }
@@ -86,7 +86,7 @@
 		return ret;
 
 	if (umount(mountpoint)) {
-		perror("# Unable to umount resctrl");
+		ksft_perror("Unable to umount resctrl");
 
 		return errno;
 	}
@@ -115,12 +115,12 @@
 
 	fp = fopen(phys_pkg_path, "r");
 	if (!fp) {
-		perror("Failed to open physical_package_id");
+		ksft_perror("Failed to open physical_package_id");
 
 		return -1;
 	}
 	if (fscanf(fp, "%d", resource_id) <= 0) {
-		perror("Could not get socket number or l3 id");
+		ksft_perror("Could not get socket number or l3 id");
 		fclose(fp);
 
 		return -1;
@@ -149,7 +149,7 @@
 	} else if (!strcmp(cache_type, "L2")) {
 		cache_num = 2;
 	} else {
-		perror("Invalid cache level");
+		ksft_print_msg("Invalid cache level\n");
 		return -1;
 	}
 
@@ -157,12 +157,12 @@
 		cpu_no, cache_num);
 	fp = fopen(cache_path, "r");
 	if (!fp) {
-		perror("Failed to open cache size");
+		ksft_perror("Failed to open cache size");
 
 		return -1;
 	}
-	if (fscanf(fp, "%s", cache_str) <= 0) {
-		perror("Could not get cache_size");
+	if (fscanf(fp, "%63s", cache_str) <= 0) {
+		ksft_perror("Could not get cache_size");
 		fclose(fp);
 
 		return -1;
@@ -214,12 +214,12 @@
 
 	fp = fopen(cbm_mask_path, "r");
 	if (!fp) {
-		perror("Failed to open cache level");
+		ksft_perror("Failed to open cache level");
 
 		return -1;
 	}
 	if (fscanf(fp, "%s", cbm_mask) <= 0) {
-		perror("Could not get max cbm_mask");
+		ksft_perror("Could not get max cbm_mask");
 		fclose(fp);
 
 		return -1;
@@ -246,12 +246,12 @@
 
 	fp = fopen(core_siblings_path, "r");
 	if (!fp) {
-		perror("Failed to open core siblings path");
+		ksft_perror("Failed to open core siblings path");
 
 		return -1;
 	}
 	if (fscanf(fp, "%s", cpu_list_str) <= 0) {
-		perror("Could not get core_siblings list");
+		ksft_perror("Could not get core_siblings list");
 		fclose(fp);
 
 		return -1;
@@ -286,7 +286,7 @@
 	CPU_SET(cpu_no, &my_set);
 
 	if (sched_setaffinity(bm_pid, sizeof(cpu_set_t), &my_set)) {
-		perror("Unable to taskset benchmark");
+		ksft_perror("Unable to taskset benchmark");
 
 		return -1;
 	}
@@ -325,7 +325,7 @@
 		}
 		closedir(dp);
 	} else {
-		perror("Unable to open resctrl for group");
+		ksft_perror("Unable to open resctrl for group");
 
 		return -1;
 	}
@@ -333,7 +333,7 @@
 	/* Requested grp doesn't exist, hence create it */
 	if (found_grp == 0) {
 		if (mkdir(grp, 0) == -1) {
-			perror("Unable to create group");
+			ksft_perror("Unable to create group");
 
 			return -1;
 		}
@@ -348,12 +348,12 @@
 
 	fp = fopen(tasks, "w");
 	if (!fp) {
-		perror("Failed to open tasks file");
+		ksft_perror("Failed to open tasks file");
 
 		return -1;
 	}
 	if (fprintf(fp, "%d\n", pid) < 0) {
-		perror("Failed to wr pid to tasks file");
+		ksft_print_msg("Failed to write pid to tasks file\n");
 		fclose(fp);
 
 		return -1;
@@ -420,7 +420,7 @@
 out:
 	ksft_print_msg("Writing benchmark parameters to resctrl FS\n");
 	if (ret)
-		perror("# writing to resctrlfs");
+		ksft_print_msg("Failed writing to resctrlfs\n");
 
 	return ret;
 }
@@ -617,7 +617,7 @@
 
 	ret = pipe(pipefds);
 	if (ret) {
-		perror("pipe");
+		ksft_perror("pipe");
 		return ret;
 	}
 	fflush(stdout);
@@ -626,13 +626,13 @@
 		close(pipefds[0]);
 		dup2(pipefds[1], STDOUT_FILENO);
 		execlp("dmesg", "dmesg", NULL);
-		perror("executing dmesg");
+		ksft_perror("Executing dmesg");
 		exit(1);
 	}
 	close(pipefds[1]);
 	fp = fdopen(pipefds[0], "r");
 	if (!fp) {
-		perror("fdopen(pipe)");
+		ksft_perror("fdopen(pipe)");
 		kill(pid, SIGTERM);
 
 		return -1;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/riscv/hwprobe/cbo.c
+++ linux-qcom-6.8.0/tools/testing/selftests/riscv/hwprobe/cbo.c
@@ -19,7 +19,7 @@
 #include "hwprobe.h"
 #include "../../kselftest.h"
 
-#define MK_CBO(fn) cpu_to_le32((fn) << 20 | 10 << 15 | 2 << 12 | 0 << 7 | 15)
+#define MK_CBO(fn) le32_bswap((uint32_t)(fn) << 20 | 10 << 15 | 2 << 12 | 0 << 7 | 15)
 
 static char mem[4096] __aligned(4096) = { [0 ... 4095] = 0xa5 };
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/riscv/hwprobe/hwprobe.h
+++ linux-qcom-6.8.0/tools/testing/selftests/riscv/hwprobe/hwprobe.h
@@ -4,6 +4,16 @@
 #include <stddef.h>
 #include <asm/hwprobe.h>
 
+#if __BYTE_ORDER == __BIG_ENDIAN
+# define le32_bswap(_x)				\
+	((((_x) & 0x000000ffU) << 24) |		\
+	 (((_x) & 0x0000ff00U) <<  8) |		\
+	 (((_x) & 0x00ff0000U) >>  8) |		\
+	 (((_x) & 0xff000000U) >> 24))
+#else
+# define le32_bswap(_x) (_x)
+#endif
+
 /*
  * Rather than relying on having a new enough libc to define this, just do it
  * ourselves.  This way we don't need to be coupled to a new-enough libc to
--- linux-qcom-6.8.0.orig/tools/testing/selftests/rseq/rseq.c
+++ linux-qcom-6.8.0/tools/testing/selftests/rseq/rseq.c
@@ -60,12 +60,6 @@
 /* Flags used during rseq registration.  */
 unsigned int rseq_flags;
 
-/*
- * rseq feature size supported by the kernel. 0 if the registration was
- * unsuccessful.
- */
-unsigned int rseq_feature_size = -1U;
-
 static int rseq_ownership;
 static int rseq_reg_success;	/* At least one rseq registration has succeded. */
 
@@ -111,6 +105,43 @@
 	}
 }
 
+/* The rseq areas need to be at least 32 bytes. */
+static
+unsigned int get_rseq_min_alloc_size(void)
+{
+	unsigned int alloc_size = rseq_size;
+
+	if (alloc_size < ORIG_RSEQ_ALLOC_SIZE)
+		alloc_size = ORIG_RSEQ_ALLOC_SIZE;
+	return alloc_size;
+}
+
+/*
+ * Return the feature size supported by the kernel.
+ *
+ * Depending on the value returned by getauxval(AT_RSEQ_FEATURE_SIZE):
+ *
+ * 0:   Return ORIG_RSEQ_FEATURE_SIZE (20)
+ * > 0: Return the value from getauxval(AT_RSEQ_FEATURE_SIZE).
+ *
+ * It should never return a value below ORIG_RSEQ_FEATURE_SIZE.
+ */
+static
+unsigned int get_rseq_kernel_feature_size(void)
+{
+	unsigned long auxv_rseq_feature_size, auxv_rseq_align;
+
+	auxv_rseq_align = getauxval(AT_RSEQ_ALIGN);
+	assert(!auxv_rseq_align || auxv_rseq_align <= RSEQ_THREAD_AREA_ALLOC_SIZE);
+
+	auxv_rseq_feature_size = getauxval(AT_RSEQ_FEATURE_SIZE);
+	assert(!auxv_rseq_feature_size || auxv_rseq_feature_size <= RSEQ_THREAD_AREA_ALLOC_SIZE);
+	if (auxv_rseq_feature_size)
+		return auxv_rseq_feature_size;
+	else
+		return ORIG_RSEQ_FEATURE_SIZE;
+}
+
 int rseq_register_current_thread(void)
 {
 	int rc;
@@ -119,7 +150,7 @@
 		/* Treat libc's ownership as a successful registration. */
 		return 0;
 	}
-	rc = sys_rseq(&__rseq_abi, rseq_size, 0, RSEQ_SIG);
+	rc = sys_rseq(&__rseq_abi, get_rseq_min_alloc_size(), 0, RSEQ_SIG);
 	if (rc) {
 		if (RSEQ_READ_ONCE(rseq_reg_success)) {
 			/* Incoherent success/failure within process. */
@@ -140,28 +171,12 @@
 		/* Treat libc's ownership as a successful unregistration. */
 		return 0;
 	}
-	rc = sys_rseq(&__rseq_abi, rseq_size, RSEQ_ABI_FLAG_UNREGISTER, RSEQ_SIG);
+	rc = sys_rseq(&__rseq_abi, get_rseq_min_alloc_size(), RSEQ_ABI_FLAG_UNREGISTER, RSEQ_SIG);
 	if (rc)
 		return -1;
 	return 0;
 }
 
-static
-unsigned int get_rseq_feature_size(void)
-{
-	unsigned long auxv_rseq_feature_size, auxv_rseq_align;
-
-	auxv_rseq_align = getauxval(AT_RSEQ_ALIGN);
-	assert(!auxv_rseq_align || auxv_rseq_align <= RSEQ_THREAD_AREA_ALLOC_SIZE);
-
-	auxv_rseq_feature_size = getauxval(AT_RSEQ_FEATURE_SIZE);
-	assert(!auxv_rseq_feature_size || auxv_rseq_feature_size <= RSEQ_THREAD_AREA_ALLOC_SIZE);
-	if (auxv_rseq_feature_size)
-		return auxv_rseq_feature_size;
-	else
-		return ORIG_RSEQ_FEATURE_SIZE;
-}
-
 static __attribute__((constructor))
 void rseq_init(void)
 {
@@ -178,28 +193,54 @@
 	}
 	if (libc_rseq_size_p && libc_rseq_offset_p && libc_rseq_flags_p &&
 			*libc_rseq_size_p != 0) {
+		unsigned int libc_rseq_size;
+
 		/* rseq registration owned by glibc */
 		rseq_offset = *libc_rseq_offset_p;
-		rseq_size = *libc_rseq_size_p;
+		libc_rseq_size = *libc_rseq_size_p;
 		rseq_flags = *libc_rseq_flags_p;
-		rseq_feature_size = get_rseq_feature_size();
-		if (rseq_feature_size > rseq_size)
-			rseq_feature_size = rseq_size;
+
+		/*
+		 * Previous versions of glibc expose the value
+		 * 32 even though the kernel only supported 20
+		 * bytes initially. Therefore treat 32 as a
+		 * special-case. glibc 2.40 exposes a 20 bytes
+		 * __rseq_size without using getauxval(3) to
+		 * query the supported size, while still allocating a 32
+		 * bytes area. Also treat 20 as a special-case.
+		 *
+		 * Special-cases are handled by using the following
+		 * value as active feature set size:
+		 *
+		 *   rseq_size = min(32, get_rseq_kernel_feature_size())
+		 */
+		switch (libc_rseq_size) {
+		case ORIG_RSEQ_FEATURE_SIZE:
+			fallthrough;
+		case ORIG_RSEQ_ALLOC_SIZE:
+		{
+			unsigned int rseq_kernel_feature_size = get_rseq_kernel_feature_size();
+
+			if (rseq_kernel_feature_size < ORIG_RSEQ_ALLOC_SIZE)
+				rseq_size = rseq_kernel_feature_size;
+			else
+				rseq_size = ORIG_RSEQ_ALLOC_SIZE;
+			break;
+		}
+		default:
+			/* Otherwise just use the __rseq_size from libc as rseq_size. */
+			rseq_size = libc_rseq_size;
+			break;
+		}
 		return;
 	}
 	rseq_ownership = 1;
 	if (!rseq_available()) {
 		rseq_size = 0;
-		rseq_feature_size = 0;
 		return;
 	}
 	rseq_offset = (void *)&__rseq_abi - rseq_thread_pointer();
 	rseq_flags = 0;
-	rseq_feature_size = get_rseq_feature_size();
-	if (rseq_feature_size == ORIG_RSEQ_FEATURE_SIZE)
-		rseq_size = ORIG_RSEQ_ALLOC_SIZE;
-	else
-		rseq_size = RSEQ_THREAD_AREA_ALLOC_SIZE;
 }
 
 static __attribute__((destructor))
@@ -209,7 +250,6 @@
 		return;
 	rseq_offset = 0;
 	rseq_size = -1U;
-	rseq_feature_size = -1U;
 	rseq_ownership = 0;
 }
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/rseq/rseq.h
+++ linux-qcom-6.8.0/tools/testing/selftests/rseq/rseq.h
@@ -68,12 +68,6 @@
 /* Flags used during rseq registration. */
 extern unsigned int rseq_flags;
 
-/*
- * rseq feature size supported by the kernel. 0 if the registration was
- * unsuccessful.
- */
-extern unsigned int rseq_feature_size;
-
 enum rseq_mo {
 	RSEQ_MO_RELAXED = 0,
 	RSEQ_MO_CONSUME = 1,	/* Unused */
@@ -193,7 +187,7 @@
 
 static inline bool rseq_node_id_available(void)
 {
-	return (int) rseq_feature_size >= rseq_offsetofend(struct rseq_abi, node_id);
+	return (int) rseq_size >= rseq_offsetofend(struct rseq_abi, node_id);
 }
 
 /*
@@ -207,7 +201,7 @@
 
 static inline bool rseq_mm_cid_available(void)
 {
-	return (int) rseq_feature_size >= rseq_offsetofend(struct rseq_abi, mm_cid);
+	return (int) rseq_size >= rseq_offsetofend(struct rseq_abi, mm_cid);
 }
 
 static inline uint32_t rseq_current_mm_cid(void)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ linux-qcom-6.8.0/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -784,7 +784,7 @@
 	bool die = (bool)data;
 
 	if (die) {
-		prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
+		syscall(__NR_getpid);
 		return (void *)SIBLING_EXIT_FAILURE;
 	}
 
@@ -803,11 +803,11 @@
 {
 	pthread_t thread;
 	void *status;
-	/* Kill only when calling __NR_prctl. */
+	/* Kill only when calling __NR_getpid. */
 	struct sock_filter filter_thread[] = {
 		BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 			offsetof(struct seccomp_data, nr)),
-		BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
+		BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
 		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD),
 		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 	};
@@ -819,7 +819,7 @@
 	struct sock_filter filter_process[] = {
 		BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 			offsetof(struct seccomp_data, nr)),
-		BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
+		BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
 		BPF_STMT(BPF_RET|BPF_K, kill),
 		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 	};
@@ -3709,7 +3709,12 @@
 	ASSERT_GE(pid, 0);
 
 	if (pid == 0) {
-		ASSERT_EQ(unshare(CLONE_NEWPID), 0);
+		ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
+			if (errno == EPERM)
+				SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
+			else if (errno == EINVAL)
+				SKIP(return, "CLONE_NEWPID is invalid (missing CONFIG_PID_NS?)");
+		}
 
 		pid2 = fork();
 		ASSERT_GE(pid2, 0);
@@ -3727,6 +3732,8 @@
 	ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
 		if (errno == EPERM)
 			SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
+		else if (errno == EINVAL)
+			SKIP(return, "CLONE_NEWPID is invalid (missing CONFIG_PID_NS?)");
 	}
 	ASSERT_EQ(errno, 0);
 
@@ -4037,6 +4044,16 @@
 	EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
 }
 
+
+int get_next_fd(int prev_fd)
+{
+	for (int i = prev_fd + 1; i < FD_SETSIZE; ++i) {
+		if (fcntl(i, F_GETFD) == -1)
+			return i;
+	}
+	_exit(EXIT_FAILURE);
+}
+
 TEST(user_notification_addfd)
 {
 	pid_t pid;
@@ -4053,7 +4070,7 @@
 	/* There may be arbitrary already-open fds at test start. */
 	memfd = memfd_create("test", 0);
 	ASSERT_GE(memfd, 0);
-	nextfd = memfd + 1;
+	nextfd = get_next_fd(memfd);
 
 	ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 	ASSERT_EQ(0, ret) {
@@ -4064,7 +4081,8 @@
 	/* Check that the basic notification machinery works */
 	listener = user_notif_syscall(__NR_getppid,
 				      SECCOMP_FILTER_FLAG_NEW_LISTENER);
-	ASSERT_EQ(listener, nextfd++);
+	ASSERT_EQ(listener, nextfd);
+	nextfd = get_next_fd(nextfd);
 
 	pid = fork();
 	ASSERT_GE(pid, 0);
@@ -4119,14 +4137,16 @@
 
 	/* Verify we can set an arbitrary remote fd */
 	fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
-	EXPECT_EQ(fd, nextfd++);
+	EXPECT_EQ(fd, nextfd);
+	nextfd = get_next_fd(nextfd);
 	EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
 
 	/* Verify we can set an arbitrary remote fd with large size */
 	memset(&big, 0x0, sizeof(big));
 	big.addfd = addfd;
 	fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big);
-	EXPECT_EQ(fd, nextfd++);
+	EXPECT_EQ(fd, nextfd);
+	nextfd = get_next_fd(nextfd);
 
 	/* Verify we can set a specific remote fd */
 	addfd.newfd = 42;
@@ -4164,7 +4184,8 @@
 	 * Child has earlier "low" fds and now 42, so we expect the next
 	 * lowest available fd to be assigned here.
 	 */
-	EXPECT_EQ(fd, nextfd++);
+	EXPECT_EQ(fd, nextfd);
+	nextfd = get_next_fd(nextfd);
 	ASSERT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
 
 	/*
--- linux-qcom-6.8.0.orig/tools/testing/selftests/seccomp/settings
+++ linux-qcom-6.8.0/tools/testing/selftests/seccomp/settings
@@ -1 +1 @@
-timeout=120
+timeout=300
--- linux-qcom-6.8.0.orig/tools/testing/selftests/sigaltstack/current_stack_pointer.h
+++ linux-qcom-6.8.0/tools/testing/selftests/sigaltstack/current_stack_pointer.h
@@ -8,7 +8,7 @@
 register unsigned long sp asm("esp");
 #elif __loongarch64
 register unsigned long sp asm("$sp");
-#elif __ppc__
+#elif __powerpc__
 register unsigned long sp asm("r1");
 #elif __s390x__
 register unsigned long sp asm("%15");
--- linux-qcom-6.8.0.orig/tools/testing/selftests/syscall_user_dispatch/sud_test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/syscall_user_dispatch/sud_test.c
@@ -158,6 +158,20 @@
 
 	/* In preparation for sigreturn. */
 	SYSCALL_DISPATCH_OFF(glob_sel);
+
+	/*
+	 * The tests for argument handling assume that `syscall(x) == x`. This
+	 * is a NOP on x86 because the syscall number is passed in %rax, which
+	 * happens to also be the function ABI return register.  Other
+	 * architectures may need to swizzle the arguments around.
+	 */
+#if defined(__riscv)
+/* REG_A7 is not defined in libc headers */
+# define REG_A7 (REG_A0 + 7)
+
+	((ucontext_t *)ucontext)->uc_mcontext.__gregs[REG_A0] =
+			((ucontext_t *)ucontext)->uc_mcontext.__gregs[REG_A7];
+#endif
 }
 
 TEST(dispatch_and_return)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/tc-testing/tc-tests/filters/flow.json
+++ linux-qcom-6.8.0/tools/testing/selftests/tc-testing/tc-tests/filters/flow.json
@@ -78,10 +78,10 @@
         "setup": [
             "$TC qdisc add dev $DEV1 ingress"
         ],
-        "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: handle 1 prio 1 protocol ip flow map key dst rshift 0xff",
+        "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: handle 1 prio 1 protocol ip flow map key dst rshift 0x1f",
         "expExitCode": "0",
         "verifyCmd": "$TC filter get dev $DEV1 parent ffff: handle 1 protocol ip prio 1 flow",
-        "matchPattern": "filter parent ffff: protocol ip pref 1 flow chain [0-9]+ handle 0x1 map keys dst rshift 255 baseclass",
+        "matchPattern": "filter parent ffff: protocol ip pref 1 flow chain [0-9]+ handle 0x1 map keys dst rshift 31 baseclass",
         "matchCount": "1",
         "teardown": [
             "$TC qdisc del dev $DEV1 ingress"
--- linux-qcom-6.8.0.orig/tools/testing/selftests/tc-testing/tc-tests/filters/u32.json
+++ linux-qcom-6.8.0/tools/testing/selftests/tc-testing/tc-tests/filters/u32.json
@@ -329,5 +329,29 @@
         "teardown": [
             "$TC qdisc del dev $DEV1 parent root drr"
         ]
+    },
+    {
+        "id": "1234",
+        "name": "Exercise IDR leaks by creating/deleting a filter many (2048) times",
+        "category": [
+            "filter",
+            "u32"
+        ],
+        "plugins": {
+            "requires": "nsPlugin"
+        },
+        "setup": [
+            "$TC qdisc add dev $DEV1 parent root handle 10: drr",
+            "$TC filter add dev $DEV1 parent 10:0 protocol ip prio 2 u32 match ip src 0.0.0.2/32 action drop",
+            "$TC filter add dev $DEV1 parent 10:0 protocol ip prio 3 u32 match ip src 0.0.0.3/32 action drop"
+        ],
+        "cmdUnderTest": "bash -c 'for i in {1..2048} ;do echo filter delete dev $DEV1 pref 3;echo filter add dev $DEV1 parent 10:0 protocol ip prio 3 u32 match ip src 0.0.0.3/32 action drop;done | $TC -b -'",
+        "expExitCode": "0",
+        "verifyCmd": "$TC filter show dev $DEV1",
+        "matchPattern": "protocol ip pref 3 u32",
+        "matchCount": "3",
+        "teardown": [
+            "$TC qdisc del dev $DEV1 parent root drr"
+        ]
     }
 ]
--- linux-qcom-6.8.0.orig/tools/testing/selftests/tc-testing/tc-tests/qdiscs/taprio.json
+++ linux-qcom-6.8.0/tools/testing/selftests/tc-testing/tc-tests/qdiscs/taprio.json
@@ -133,6 +133,50 @@
         ]
     },
     {
+        "id": "6f62",
+        "name": "Add taprio Qdisc with too short interval",
+        "category": [
+            "qdisc",
+            "taprio"
+        ],
+        "plugins": {
+            "requires": "nsPlugin"
+        },
+        "setup": [
+            "echo \"1 1 8\" > /sys/bus/netdevsim/new_device"
+        ],
+        "cmdUnderTest": "$TC qdisc add dev $ETH root handle 1: taprio num_tc 2 queues 1@0 1@1 sched-entry S 01 300 sched-entry S 02 1700 clockid CLOCK_TAI",
+        "expExitCode": "2",
+        "verifyCmd": "$TC qdisc show dev $ETH",
+        "matchPattern": "qdisc taprio 1: root refcnt",
+        "matchCount": "0",
+        "teardown": [
+            "echo \"1\" > /sys/bus/netdevsim/del_device"
+        ]
+    },
+    {
+        "id": "831f",
+        "name": "Add taprio Qdisc with too short cycle-time",
+        "category": [
+            "qdisc",
+            "taprio"
+        ],
+        "plugins": {
+            "requires": "nsPlugin"
+        },
+        "setup": [
+            "echo \"1 1 8\" > /sys/bus/netdevsim/new_device"
+        ],
+        "cmdUnderTest": "$TC qdisc add dev $ETH root handle 1: taprio num_tc 2 queues 1@0 1@1 sched-entry S 01 200000 sched-entry S 02 200000 cycle-time 100 clockid CLOCK_TAI",
+        "expExitCode": "2",
+        "verifyCmd": "$TC qdisc show dev $ETH",
+        "matchPattern": "qdisc taprio 1: root refcnt",
+        "matchCount": "0",
+        "teardown": [
+            "echo \"1\" > /sys/bus/netdevsim/del_device"
+        ]
+    },
+    {
         "id": "3e1e",
         "name": "Add taprio Qdisc with an invalid cycle-time",
         "category": [
--- linux-qcom-6.8.0.orig/tools/testing/selftests/tc-testing/tdc.py
+++ linux-qcom-6.8.0/tools/testing/selftests/tc-testing/tdc.py
@@ -143,7 +143,6 @@
             except Exception as ee:
                 print('exception {} in call to pre_case for {} plugin'.
                       format(ee, pgn_inst.__class__))
-                print('test_ordinal is {}'.format(test_ordinal))
                 print('testid is {}'.format(caseinfo['id']))
                 raise
 
--- linux-qcom-6.8.0.orig/tools/testing/selftests/timens/exec.c
+++ linux-qcom-6.8.0/tools/testing/selftests/timens/exec.c
@@ -30,7 +30,7 @@
 
 		for (i = 0; i < 2; i++) {
 			_gettime(CLOCK_MONOTONIC, &tst, i);
-			if (abs(tst.tv_sec - now.tv_sec) > 5)
+			if (labs(tst.tv_sec - now.tv_sec) > 5)
 				return pr_fail("%ld %ld\n", now.tv_sec, tst.tv_sec);
 		}
 		return 0;
@@ -50,7 +50,7 @@
 
 	for (i = 0; i < 2; i++) {
 		_gettime(CLOCK_MONOTONIC, &tst, i);
-		if (abs(tst.tv_sec - now.tv_sec) > 5)
+		if (labs(tst.tv_sec - now.tv_sec) > 5)
 			return pr_fail("%ld %ld\n",
 					now.tv_sec, tst.tv_sec);
 	}
@@ -70,7 +70,7 @@
 		/* Check that a child process is in the new timens. */
 		for (i = 0; i < 2; i++) {
 			_gettime(CLOCK_MONOTONIC, &tst, i);
-			if (abs(tst.tv_sec - now.tv_sec - OFFSET) > 5)
+			if (labs(tst.tv_sec - now.tv_sec - OFFSET) > 5)
 				return pr_fail("%ld %ld\n",
 						now.tv_sec + OFFSET, tst.tv_sec);
 		}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/timens/timer.c
+++ linux-qcom-6.8.0/tools/testing/selftests/timens/timer.c
@@ -56,7 +56,7 @@
 			return pr_perror("timerfd_gettime");
 
 		elapsed = new_value.it_value.tv_sec;
-		if (abs(elapsed - 3600) > 60) {
+		if (llabs(elapsed - 3600) > 60) {
 			ksft_test_result_fail("clockid: %d elapsed: %lld\n",
 					      clockid, elapsed);
 			return 1;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/timens/timerfd.c
+++ linux-qcom-6.8.0/tools/testing/selftests/timens/timerfd.c
@@ -61,7 +61,7 @@
 			return pr_perror("timerfd_gettime(%d)", clockid);
 
 		elapsed = new_value.it_value.tv_sec;
-		if (abs(elapsed - 3600) > 60) {
+		if (llabs(elapsed - 3600) > 60) {
 			ksft_test_result_fail("clockid: %d elapsed: %lld\n",
 					      clockid, elapsed);
 			return 1;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/timens/vfork_exec.c
+++ linux-qcom-6.8.0/tools/testing/selftests/timens/vfork_exec.c
@@ -32,7 +32,7 @@
 
 	for (i = 0; i < 2; i++) {
 		_gettime(CLOCK_MONOTONIC, &tst, i);
-		if (abs(tst.tv_sec - now->tv_sec) > 5) {
+		if (labs(tst.tv_sec - now->tv_sec) > 5) {
 			pr_fail("%s: in-thread: unexpected value: %ld (%ld)\n",
 				args->tst_name, tst.tv_sec, now->tv_sec);
 			return (void *)1UL;
@@ -64,7 +64,7 @@
 
 	for (i = 0; i < 2; i++) {
 		_gettime(CLOCK_MONOTONIC, &tst, i);
-		if (abs(tst.tv_sec - now->tv_sec) > 5)
+		if (labs(tst.tv_sec - now->tv_sec) > 5)
 			return pr_fail("%s: unexpected value: %ld (%ld)\n",
 					tst_name, tst.tv_sec, now->tv_sec);
 	}
--- linux-qcom-6.8.0.orig/tools/testing/selftests/timers/posix_timers.c
+++ linux-qcom-6.8.0/tools/testing/selftests/timers/posix_timers.c
@@ -66,7 +66,7 @@
 	diff = end.tv_usec - start.tv_usec;
 	diff += (end.tv_sec - start.tv_sec) * USECS_PER_SEC;
 
-	if (abs(diff - DELAY * USECS_PER_SEC) > USECS_PER_SEC / 2) {
+	if (llabs(diff - DELAY * USECS_PER_SEC) > USECS_PER_SEC / 2) {
 		printf("Diff too high: %lld..", diff);
 		return -1;
 	}
@@ -184,80 +184,71 @@
 	return 0;
 }
 
-int remain;
-__thread int got_signal;
+static pthread_t ctd_thread;
+static volatile int ctd_count, ctd_failed;
 
-static void *distribution_thread(void *arg)
+static void ctd_sighandler(int sig)
 {
-	while (__atomic_load_n(&remain, __ATOMIC_RELAXED));
-	return NULL;
-}
-
-static void distribution_handler(int nr)
-{
-	if (!__atomic_exchange_n(&got_signal, 1, __ATOMIC_RELAXED))
-		__atomic_fetch_sub(&remain, 1, __ATOMIC_RELAXED);
+	if (pthread_self() != ctd_thread)
+		ctd_failed = 1;
+	ctd_count--;
 }
 
-/*
- * Test that all running threads _eventually_ receive CLOCK_PROCESS_CPUTIME_ID
- * timer signals. This primarily tests that the kernel does not favour any one.
- */
-static int check_timer_distribution(void)
+static void *ctd_thread_func(void *arg)
 {
-	int err, i;
-	timer_t id;
-	const int nthreads = 10;
-	pthread_t threads[nthreads];
 	struct itimerspec val = {
 		.it_value.tv_sec = 0,
 		.it_value.tv_nsec = 1000 * 1000,
 		.it_interval.tv_sec = 0,
 		.it_interval.tv_nsec = 1000 * 1000,
 	};
+	timer_t id;
 
-	remain = nthreads + 1;  /* worker threads + this thread */
-	signal(SIGALRM, distribution_handler);
-	err = timer_create(CLOCK_PROCESS_CPUTIME_ID, NULL, &id);
-	if (err < 0) {
-		ksft_perror("Can't create timer");
-		return -1;
-	}
-	err = timer_settime(id, 0, &val, NULL);
-	if (err < 0) {
-		ksft_perror("Can't set timer");
-		return -1;
-	}
+	/* 1/10 seconds to ensure the leader sleeps */
+	usleep(10000);
 
-	for (i = 0; i < nthreads; i++) {
-		err = pthread_create(&threads[i], NULL, distribution_thread,
-				     NULL);
-		if (err) {
-			ksft_print_msg("Can't create thread: %s (%d)\n",
-				       strerror(errno), errno);
-			return -1;
-		}
-	}
+	ctd_count = 100;
+	if (timer_create(CLOCK_PROCESS_CPUTIME_ID, NULL, &id))
+		return "Can't create timer\n";
+	if (timer_settime(id, 0, &val, NULL))
+		return "Can't set timer\n";
 
-	/* Wait for all threads to receive the signal. */
-	while (__atomic_load_n(&remain, __ATOMIC_RELAXED));
+	while (ctd_count > 0 && !ctd_failed)
+		;
 
-	for (i = 0; i < nthreads; i++) {
-		err = pthread_join(threads[i], NULL);
-		if (err) {
-			ksft_print_msg("Can't join thread: %s (%d)\n",
-				       strerror(errno), errno);
-			return -1;
-		}
-	}
+	if (timer_delete(id))
+		return "Can't delete timer\n";
 
-	if (timer_delete(id)) {
-		ksft_perror("Can't delete timer");
-		return -1;
-	}
+	return NULL;
+}
 
-	ksft_test_result_pass("check_timer_distribution\n");
+/*
+ * Test that only the running thread receives the timer signal.
+ */
+static int check_timer_distribution(void)
+{
+	const char *errmsg;
+
+	signal(SIGALRM, ctd_sighandler);
+
+	errmsg = "Can't create thread\n";
+	if (pthread_create(&ctd_thread, NULL, ctd_thread_func, NULL))
+		goto err;
+
+	errmsg = "Can't join thread\n";
+	if (pthread_join(ctd_thread, (void **)&errmsg) || errmsg)
+		goto err;
+
+	if (!ctd_failed)
+		ksft_test_result_pass("check signal distribution\n");
+	else if (ksft_min_kernel_version(6, 3))
+		ksft_test_result_fail("check signal distribution\n");
+	else
+		ksft_test_result_skip("check signal distribution (old kernel)\n");
 	return 0;
+err:
+	ksft_print_msg("%s", errmsg);
+	return -1;
 }
 
 int main(int argc, char **argv)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/timers/rtcpie.c
+++ linux-qcom-6.8.0/tools/testing/selftests/timers/rtcpie.c
@@ -111,11 +111,11 @@
 			timersub(&end, &start, &diff);
 			if (diff.tv_sec > 0 ||
 			    diff.tv_usec > ((1000000L / tmp) * 1.10)) {
-				fprintf(stderr, "\nPIE delta error: %ld.%06ld should be close to 0.%06ld\n",
+				fprintf(stderr, "\nUbuntu Testing Force Pass LP #1814234: PIE delta error: %ld.%06ld should be close to 0.%06ld\n",
 				       diff.tv_sec, diff.tv_usec,
 				       (1000000L / tmp));
 				fflush(stdout);
-				exit(-1);
+				break; // LP: #1814234
 			}
 
 			fprintf(stderr, " %d",i);
--- linux-qcom-6.8.0.orig/tools/testing/selftests/timers/valid-adjtimex.c
+++ linux-qcom-6.8.0/tools/testing/selftests/timers/valid-adjtimex.c
@@ -21,9 +21,6 @@
  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *   GNU General Public License for more details.
  */
-
-
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <time.h>
@@ -62,45 +59,47 @@
 #define NUM_FREQ_OUTOFRANGE 4
 #define NUM_FREQ_INVALID 2
 
+#define SHIFTED_PPM (1 << 16)
+
 long valid_freq[NUM_FREQ_VALID] = {
-	-499<<16,
-	-450<<16,
-	-400<<16,
-	-350<<16,
-	-300<<16,
-	-250<<16,
-	-200<<16,
-	-150<<16,
-	-100<<16,
-	-75<<16,
-	-50<<16,
-	-25<<16,
-	-10<<16,
-	-5<<16,
-	-1<<16,
+	 -499 * SHIFTED_PPM,
+	 -450 * SHIFTED_PPM,
+	 -400 * SHIFTED_PPM,
+	 -350 * SHIFTED_PPM,
+	 -300 * SHIFTED_PPM,
+	 -250 * SHIFTED_PPM,
+	 -200 * SHIFTED_PPM,
+	 -150 * SHIFTED_PPM,
+	 -100 * SHIFTED_PPM,
+	  -75 * SHIFTED_PPM,
+	  -50 * SHIFTED_PPM,
+	  -25 * SHIFTED_PPM,
+	  -10 * SHIFTED_PPM,
+	   -5 * SHIFTED_PPM,
+	   -1 * SHIFTED_PPM,
 	-1000,
-	1<<16,
-	5<<16,
-	10<<16,
-	25<<16,
-	50<<16,
-	75<<16,
-	100<<16,
-	150<<16,
-	200<<16,
-	250<<16,
-	300<<16,
-	350<<16,
-	400<<16,
-	450<<16,
-	499<<16,
+	    1 * SHIFTED_PPM,
+	    5 * SHIFTED_PPM,
+	   10 * SHIFTED_PPM,
+	   25 * SHIFTED_PPM,
+	   50 * SHIFTED_PPM,
+	   75 * SHIFTED_PPM,
+	  100 * SHIFTED_PPM,
+	  150 * SHIFTED_PPM,
+	  200 * SHIFTED_PPM,
+	  250 * SHIFTED_PPM,
+	  300 * SHIFTED_PPM,
+	  350 * SHIFTED_PPM,
+	  400 * SHIFTED_PPM,
+	  450 * SHIFTED_PPM,
+	  499 * SHIFTED_PPM,
 };
 
 long outofrange_freq[NUM_FREQ_OUTOFRANGE] = {
-	-1000<<16,
-	-550<<16,
-	550<<16,
-	1000<<16,
+	-1000 * SHIFTED_PPM,
+	 -550 * SHIFTED_PPM,
+	  550 * SHIFTED_PPM,
+	 1000 * SHIFTED_PPM,
 };
 
 #define LONG_MAX (~0UL>>1)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/vDSO/parse_vdso.c
+++ linux-qcom-6.8.0/tools/testing/selftests/vDSO/parse_vdso.c
@@ -36,6 +36,12 @@
 #define ELF_BITS_XFORM(bits, x) ELF_BITS_XFORM2(bits, x)
 #define ELF(x) ELF_BITS_XFORM(ELF_BITS, x)
 
+#ifdef __s390x__
+#define ELF_HASH_ENTRY ELF(Xword)
+#else
+#define ELF_HASH_ENTRY ELF(Word)
+#endif
+
 static struct vdso_info
 {
 	bool valid;
@@ -47,22 +53,28 @@
 	/* Symbol table */
 	ELF(Sym) *symtab;
 	const char *symstrings;
-	ELF(Word) *bucket, *chain;
-	ELF(Word) nbucket, nchain;
+	ELF_HASH_ENTRY *bucket, *chain;
+	ELF_HASH_ENTRY nbucket, nchain;
 
 	/* Version table */
 	ELF(Versym) *versym;
 	ELF(Verdef) *verdef;
 } vdso_info;
 
-/* Straight from the ELF specification. */
-static unsigned long elf_hash(const unsigned char *name)
+/*
+ * Straight from the ELF specification...and then tweaked slightly, in order to
+ * avoid a few clang warnings.
+ */
+static unsigned long elf_hash(const char *name)
 {
 	unsigned long h = 0, g;
-	while (*name)
+	const unsigned char *uch_name = (const unsigned char *)name;
+
+	while (*uch_name)
 	{
-		h = (h << 4) + *name++;
-		if (g = h & 0xf0000000)
+		h = (h << 4) + *uch_name++;
+		g = h & 0xf0000000;
+		if (g)
 			h ^= g >> 24;
 		h &= ~g;
 	}
@@ -109,7 +121,7 @@
 	/*
 	 * Fish out the useful bits of the dynamic table.
 	 */
-	ELF(Word) *hash = 0;
+	ELF_HASH_ENTRY *hash = 0;
 	vdso_info.symstrings = 0;
 	vdso_info.symtab = 0;
 	vdso_info.versym = 0;
@@ -127,7 +139,7 @@
 				 + vdso_info.load_offset);
 			break;
 		case DT_HASH:
-			hash = (ELF(Word) *)
+			hash = (ELF_HASH_ENTRY *)
 				((uintptr_t)dyn[i].d_un.d_ptr
 				 + vdso_info.load_offset);
 			break;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/vDSO/vdso_config.h
+++ linux-qcom-6.8.0/tools/testing/selftests/vDSO/vdso_config.h
@@ -18,18 +18,18 @@
 #elif defined(__aarch64__)
 #define VDSO_VERSION		3
 #define VDSO_NAMES		0
-#elif defined(__powerpc__)
+#elif defined(__powerpc64__)
 #define VDSO_VERSION		1
 #define VDSO_NAMES		0
-#define VDSO_32BIT		1
-#elif defined(__powerpc64__)
+#elif defined(__powerpc__)
 #define VDSO_VERSION		1
 #define VDSO_NAMES		0
-#elif defined (__s390__)
+#define VDSO_32BIT		1
+#elif defined (__s390__) && !defined(__s390x__)
 #define VDSO_VERSION		2
 #define VDSO_NAMES		0
 #define VDSO_32BIT		1
-#elif defined (__s390X__)
+#elif defined (__s390x__)
 #define VDSO_VERSION		2
 #define VDSO_NAMES		0
 #elif defined(__mips__)
--- linux-qcom-6.8.0.orig/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c
+++ linux-qcom-6.8.0/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c
@@ -18,7 +18,7 @@
 
 #include "parse_vdso.h"
 
-/* We need a libc functions... */
+/* We need some libc functions... */
 int strcmp(const char *a, const char *b)
 {
 	/* This implementation is buggy: it never returns -1. */
@@ -34,6 +34,20 @@
 	return 0;
 }
 
+/*
+ * The clang build needs this, although gcc does not.
+ * Stolen from lib/string.c.
+ */
+void *memcpy(void *dest, const void *src, size_t count)
+{
+	char *tmp = dest;
+	const char *s = src;
+
+	while (count--)
+		*tmp++ = *s++;
+	return dest;
+}
+
 /* ...and two syscalls.  This is x86-specific. */
 static inline long x86_syscall3(long nr, long a0, long a1, long a2)
 {
@@ -70,7 +84,7 @@
 	}
 }
 
-__attribute__((externally_visible)) void c_main(void **stack)
+void c_main(void **stack)
 {
 	/* Parse the stack */
 	long argc = (long)*stack;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/vDSO/vdso_test_correctness.c
+++ linux-qcom-6.8.0/tools/testing/selftests/vDSO/vdso_test_correctness.c
@@ -114,6 +114,12 @@
 	if (!vdso)
 		vdso = dlopen("linux-gate.so.1",
 			      RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
+	if (!vdso)
+		vdso = dlopen("linux-vdso32.so.1",
+			      RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
+	if (!vdso)
+		vdso = dlopen("linux-vdso64.so.1",
+			      RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
 	if (!vdso) {
 		printf("[WARN]\tfailed to find vDSO\n");
 		return;
--- linux-qcom-6.8.0.orig/tools/testing/selftests/watchdog/watchdog-test.c
+++ linux-qcom-6.8.0/tools/testing/selftests/watchdog/watchdog-test.c
@@ -334,7 +334,13 @@
 
 	printf("Watchdog Ticking Away!\n");
 
+	/*
+	 * Register the signals
+	 */
 	signal(SIGINT, term);
+	signal(SIGTERM, term);
+	signal(SIGKILL, term);
+	signal(SIGQUIT, term);
 
 	while (1) {
 		keep_alive();
--- linux-qcom-6.8.0.orig/tools/testing/selftests/wireguard/netns.sh
+++ linux-qcom-6.8.0/tools/testing/selftests/wireguard/netns.sh
@@ -332,6 +332,7 @@
 waitiface $netns2 veths
 
 n0 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward'
+[[ -e /proc/sys/net/netfilter/nf_conntrack_udp_timeout ]] || modprobe nf_conntrack
 n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout'
 n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream'
 n0 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j SNAT --to 10.0.0.1
--- linux-qcom-6.8.0.orig/tools/testing/selftests/wireguard/qemu/Makefile
+++ linux-qcom-6.8.0/tools/testing/selftests/wireguard/qemu/Makefile
@@ -109,9 +109,9 @@
 KERNEL_BZIMAGE := $(KERNEL_BUILD_PATH)/arch/x86/boot/bzImage
 QEMU_VPORT_RESULT := virtio-serial-device
 ifeq ($(HOST_ARCH),$(ARCH))
-QEMU_MACHINE := -cpu host -machine microvm,accel=kvm,pit=off,pic=off,rtc=off -no-acpi
+QEMU_MACHINE := -cpu host -machine microvm,accel=kvm,pit=off,pic=off,rtc=off,acpi=off
 else
-QEMU_MACHINE := -cpu max -machine microvm -no-acpi
+QEMU_MACHINE := -cpu max -machine microvm,acpi=off
 endif
 else ifeq ($(ARCH),i686)
 CHOST := i686-linux-musl
@@ -120,9 +120,9 @@
 KERNEL_BZIMAGE := $(KERNEL_BUILD_PATH)/arch/x86/boot/bzImage
 QEMU_VPORT_RESULT := virtio-serial-device
 ifeq ($(subst x86_64,i686,$(HOST_ARCH)),$(ARCH))
-QEMU_MACHINE := -cpu host -machine microvm,accel=kvm,pit=off,pic=off,rtc=off -no-acpi
+QEMU_MACHINE := -cpu host -machine microvm,accel=kvm,pit=off,pic=off,rtc=off,acpi=off
 else
-QEMU_MACHINE := -cpu coreduo -machine microvm -no-acpi
+QEMU_MACHINE := -cpu coreduo -machine microvm,acpi=off
 endif
 else ifeq ($(ARCH),mips64)
 CHOST := mips64-linux-musl
--- linux-qcom-6.8.0.orig/tools/testing/selftests/wireguard/qemu/arch/riscv32.config
+++ linux-qcom-6.8.0/tools/testing/selftests/wireguard/qemu/arch/riscv32.config
@@ -3,6 +3,7 @@
 CONFIG_MMU=y
 CONFIG_FPU=y
 CONFIG_SOC_VIRT=y
+CONFIG_RISCV_ISA_FALLBACK=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
--- linux-qcom-6.8.0.orig/tools/testing/selftests/wireguard/qemu/arch/riscv64.config
+++ linux-qcom-6.8.0/tools/testing/selftests/wireguard/qemu/arch/riscv64.config
@@ -2,6 +2,7 @@
 CONFIG_MMU=y
 CONFIG_FPU=y
 CONFIG_SOC_VIRT=y
+CONFIG_RISCV_ISA_FALLBACK=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
--- linux-qcom-6.8.0.orig/tools/testing/vsock/vsock_perf.c
+++ linux-qcom-6.8.0/tools/testing/vsock/vsock_perf.c
@@ -33,7 +33,7 @@
 
 static unsigned int port = DEFAULT_PORT;
 static unsigned long buf_size_bytes = DEFAULT_BUF_SIZE_BYTES;
-static unsigned long vsock_buf_bytes = DEFAULT_VSOCK_BUF_BYTES;
+static unsigned long long vsock_buf_bytes = DEFAULT_VSOCK_BUF_BYTES;
 static bool zerocopy;
 
 static void error(const char *s)
@@ -133,7 +133,7 @@
 	       ((float)ns_delta / NSEC_PER_SEC);
 }
 
-static void run_receiver(unsigned long rcvlowat_bytes)
+static void run_receiver(int rcvlowat_bytes)
 {
 	unsigned int read_cnt;
 	time_t rx_begin_ns;
@@ -162,8 +162,8 @@
 	printf("Run as receiver\n");
 	printf("Listen port %u\n", port);
 	printf("RX buffer %lu bytes\n", buf_size_bytes);
-	printf("vsock buffer %lu bytes\n", vsock_buf_bytes);
-	printf("SO_RCVLOWAT %lu bytes\n", rcvlowat_bytes);
+	printf("vsock buffer %llu bytes\n", vsock_buf_bytes);
+	printf("SO_RCVLOWAT %d bytes\n", rcvlowat_bytes);
 
 	fd = socket(AF_VSOCK, SOCK_STREAM, 0);
 
@@ -439,7 +439,7 @@
 int main(int argc, char **argv)
 {
 	unsigned long to_send_bytes = DEFAULT_TO_SEND_BYTES;
-	unsigned long rcvlowat_bytes = DEFAULT_RCVLOWAT_BYTES;
+	int rcvlowat_bytes = DEFAULT_RCVLOWAT_BYTES;
 	int peer_cid = -1;
 	bool sender = false;
 
--- linux-qcom-6.8.0.orig/tools/testing/vsock/vsock_test.c
+++ linux-qcom-6.8.0/tools/testing/vsock/vsock_test.c
@@ -427,7 +427,7 @@
 
 static void test_seqpacket_msg_bounds_server(const struct test_opts *opts)
 {
-	unsigned long sock_buf_size;
+	unsigned long long sock_buf_size;
 	unsigned long remote_hash;
 	unsigned long curr_hash;
 	int fd;
@@ -632,7 +632,8 @@
 
 static void test_seqpacket_bigmsg_client(const struct test_opts *opts)
 {
-	unsigned long sock_buf_size;
+	unsigned long long sock_buf_size;
+	size_t buf_size;
 	socklen_t len;
 	void *data;
 	int fd;
@@ -653,13 +654,20 @@
 
 	sock_buf_size++;
 
-	data = malloc(sock_buf_size);
+	/* size_t can be < unsigned long long */
+	buf_size = (size_t)sock_buf_size;
+	if (buf_size != sock_buf_size) {
+		fprintf(stderr, "Returned BUFFER_SIZE too large\n");
+		exit(EXIT_FAILURE);
+	}
+
+	data = malloc(buf_size);
 	if (!data) {
 		perror("malloc");
 		exit(EXIT_FAILURE);
 	}
 
-	send_buf(fd, data, sock_buf_size, 0, -EMSGSIZE);
+	send_buf(fd, data, buf_size, 0, -EMSGSIZE);
 
 	control_writeln("CLISENT");
 
@@ -833,7 +841,7 @@
 
 static void test_stream_poll_rcvlowat_client(const struct test_opts *opts)
 {
-	unsigned long lowat_val = RCVLOWAT_BUF_SIZE;
+	int lowat_val = RCVLOWAT_BUF_SIZE;
 	char buf[RCVLOWAT_BUF_SIZE];
 	struct pollfd fds;
 	short poll_flags;
@@ -1276,9 +1284,10 @@
 static void test_stream_credit_update_test(const struct test_opts *opts,
 					   bool low_rx_bytes_test)
 {
-	size_t recv_buf_size;
+	int recv_buf_size;
 	struct pollfd fds;
 	size_t buf_size;
+	unsigned long long sock_buf_size;
 	void *buf;
 	int fd;
 
@@ -1290,8 +1299,11 @@
 
 	buf_size = RCVLOWAT_CREDIT_UPD_BUF_SIZE;
 
+	/* size_t can be < unsigned long long */
+	sock_buf_size = buf_size;
+
 	if (setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_SIZE,
-		       &buf_size, sizeof(buf_size))) {
+		       &sock_buf_size, sizeof(sock_buf_size))) {
 		perror("setsockopt(SO_VM_SOCKETS_BUFFER_SIZE)");
 		exit(EXIT_FAILURE);
 	}
--- linux-qcom-6.8.0.orig/tools/tracing/latency/latency-collector.c
+++ linux-qcom-6.8.0/tools/tracing/latency/latency-collector.c
@@ -935,12 +935,12 @@
 	}
 
 	if (!tracers) {
-		warnx(no_tracer_msg);
+		warnx("%s", no_tracer_msg);
 		return;
 	}
 
 	if (!found) {
-		warnx(no_latency_tr_msg);
+		warnx("%s", no_latency_tr_msg);
 		tracefs_list_free(tracers);
 		return;
 	}
@@ -983,7 +983,7 @@
 	for (i = 0; relevant_tracers[i]; i++) {
 		valid = tracer_valid(relevant_tracers[i], &notracer);
 		if (notracer)
-			errx(EXIT_FAILURE, no_tracer_msg);
+			errx(EXIT_FAILURE, "%s", no_tracer_msg);
 		if (valid)
 			return relevant_tracers[i];
 	}
@@ -1878,7 +1878,7 @@
 			}
 			valid = tracer_valid(current_tracer, &notracer);
 			if (notracer)
-				errx(EXIT_FAILURE, no_tracer_msg);
+				errx(EXIT_FAILURE, "%s", no_tracer_msg);
 			if (!valid)
 				errx(EXIT_FAILURE,
 "The tracer %s is not supported by your kernel!\n", current_tracer);
--- linux-qcom-6.8.0.orig/tools/tracing/rtla/Makefile
+++ linux-qcom-6.8.0/tools/tracing/rtla/Makefile
@@ -111,6 +111,9 @@
 	$(ERROR_OUT)
 endif
 
+%.o: %.c
+	$(CC) $(CFLAGS) -c -o $@ $<
+
 rtla: $(OBJ)
 	$(CC) -o rtla $(LDFLAGS) $(OBJ) $(LIBS)
 
--- linux-qcom-6.8.0.orig/tools/tracing/rtla/src/osnoise_top.c
+++ linux-qcom-6.8.0/tools/tracing/rtla/src/osnoise_top.c
@@ -428,7 +428,7 @@
 		case 'd':
 			params->duration = parse_seconds_duration(optarg);
 			if (!params->duration)
-				osnoise_top_usage(params, "Invalid -D duration\n");
+				osnoise_top_usage(params, "Invalid -d duration\n");
 			break;
 		case 'e':
 			tevent = trace_event_alloc(optarg);
@@ -624,8 +624,10 @@
 		return NULL;
 
 	tool->data = osnoise_alloc_top(nr_cpus);
-	if (!tool->data)
-		goto out_err;
+	if (!tool->data) {
+		osnoise_destroy_tool(tool);
+		return NULL;
+	}
 
 	tool->params = params;
 
@@ -633,11 +635,6 @@
 				   osnoise_top_handler, NULL);
 
 	return tool;
-
-out_err:
-	osnoise_free_top(tool->data);
-	osnoise_destroy_tool(tool);
-	return NULL;
 }
 
 static int stop_tracing;
--- linux-qcom-6.8.0.orig/tools/tracing/rtla/src/timerlat_aa.c
+++ linux-qcom-6.8.0/tools/tracing/rtla/src/timerlat_aa.c
@@ -16,6 +16,9 @@
 	TIMERLAT_WAITING_THREAD,
 };
 
+/* Used to fill spaces in the output */
+static const char *spaces  = "                                                         ";
+
 #define MAX_COMM		24
 
 /*
@@ -274,14 +277,17 @@
 		taa_data->prev_irq_timstamp = start;
 
 		trace_seq_reset(taa_data->prev_irqs_seq);
-		trace_seq_printf(taa_data->prev_irqs_seq, "\t%24s	\t\t\t%9.2f us\n",
-			 "nmi", ns_to_usf(duration));
+		trace_seq_printf(taa_data->prev_irqs_seq, "  %24s %.*s %9.2f us\n",
+				 "nmi",
+				 24, spaces,
+				 ns_to_usf(duration));
 		return 0;
 	}
 
 	taa_data->thread_nmi_sum += duration;
-	trace_seq_printf(taa_data->nmi_seq, "	%24s	\t\t\t%9.2f us\n",
-		 "nmi", ns_to_usf(duration));
+	trace_seq_printf(taa_data->nmi_seq, "  %24s %.*s %9.2f us\n",
+			 "nmi",
+			 24, spaces, ns_to_usf(duration));
 
 	return 0;
 }
@@ -323,8 +329,10 @@
 		taa_data->prev_irq_timstamp = start;
 
 		trace_seq_reset(taa_data->prev_irqs_seq);
-		trace_seq_printf(taa_data->prev_irqs_seq, "\t%24s:%-3llu	\t\t%9.2f us\n",
-				 desc, vector, ns_to_usf(duration));
+		trace_seq_printf(taa_data->prev_irqs_seq, "  %24s:%-3llu %.*s %9.2f us\n",
+				 desc, vector,
+				 15, spaces,
+				 ns_to_usf(duration));
 		return 0;
 	}
 
@@ -372,8 +380,10 @@
 	 * IRQ interference.
 	 */
 	taa_data->thread_irq_sum += duration;
-	trace_seq_printf(taa_data->irqs_seq, "	%24s:%-3llu	\t	%9.2f us\n",
-			 desc, vector, ns_to_usf(duration));
+	trace_seq_printf(taa_data->irqs_seq, "  %24s:%-3llu %.*s %9.2f us\n",
+			 desc, vector,
+			 24, spaces,
+			 ns_to_usf(duration));
 
 	return 0;
 }
@@ -408,8 +418,10 @@
 
 	taa_data->thread_softirq_sum += duration;
 
-	trace_seq_printf(taa_data->softirqs_seq, "\t%24s:%-3llu	\t	%9.2f us\n",
-			 softirq_name[vector], vector, ns_to_usf(duration));
+	trace_seq_printf(taa_data->softirqs_seq, "  %24s:%-3llu %.*s %9.2f us\n",
+			 softirq_name[vector], vector,
+			 24, spaces,
+			 ns_to_usf(duration));
 	return 0;
 }
 
@@ -452,8 +464,10 @@
 	} else {
 		taa_data->thread_thread_sum += duration;
 
-		trace_seq_printf(taa_data->threads_seq, "\t%24s:%-3llu	\t\t%9.2f us\n",
-			 comm, pid, ns_to_usf(duration));
+		trace_seq_printf(taa_data->threads_seq, "  %24s:%-12llu %.*s %9.2f us\n",
+				 comm, pid,
+				 15, spaces,
+				 ns_to_usf(duration));
 	}
 
 	return 0;
@@ -482,7 +496,8 @@
 			function = tep_find_function(taa_ctx->tool->trace.tep, caller[i]);
 			if (!function)
 				break;
-			trace_seq_printf(taa_data->stack_seq, "\t\t-> %s\n", function);
+			trace_seq_printf(taa_data->stack_seq, " %.*s -> %s\n",
+					 14, spaces, function);
 		}
 	}
 	return 0;
@@ -568,23 +583,24 @@
 	exp_irq_ts = taa_data->timer_irq_start_time - taa_data->timer_irq_start_delay;
 	if (exp_irq_ts < taa_data->prev_irq_timstamp + taa_data->prev_irq_duration) {
 		if (taa_data->prev_irq_timstamp < taa_data->timer_irq_start_time)
-			printf("  Previous IRQ interference:	\t\t up to  %9.2f us\n",
-				ns_to_usf(taa_data->prev_irq_duration));
+			printf("  Previous IRQ interference: %.*s up to  %9.2f us\n",
+			       16, spaces,
+			       ns_to_usf(taa_data->prev_irq_duration));
 	}
 
 	/*
 	 * The delay that the IRQ suffered before starting.
 	 */
-	printf("  IRQ handler delay:		%16s	%9.2f us (%.2f %%)\n",
-		(ns_to_usf(taa_data->timer_exit_from_idle) > 10) ? "(exit from idle)" : "",
-		ns_to_usf(taa_data->timer_irq_start_delay),
-		ns_to_per(total, taa_data->timer_irq_start_delay));
+	printf("  IRQ handler delay: %.*s %16s  %9.2f us (%.2f %%)\n", 16, spaces,
+	       (ns_to_usf(taa_data->timer_exit_from_idle) > 10) ? "(exit from idle)" : "",
+	       ns_to_usf(taa_data->timer_irq_start_delay),
+	       ns_to_per(total, taa_data->timer_irq_start_delay));
 
 	/*
 	 * Timerlat IRQ.
 	 */
-	printf("  IRQ latency:	\t\t\t\t	%9.2f us\n",
-		ns_to_usf(taa_data->tlat_irq_latency));
+	printf("  IRQ latency: %.*s %9.2f us\n", 40, spaces,
+	       ns_to_usf(taa_data->tlat_irq_latency));
 
 	if (irq) {
 		/*
@@ -595,15 +611,16 @@
 		 * so it will be displayed, it is the key.
 		 */
 		printf("  Blocking thread:\n");
-		printf("	%24s:%-9llu\n",
-			taa_data->run_thread_comm, taa_data->run_thread_pid);
+		printf(" %.*s %24s:%-9llu\n", 6, spaces, taa_data->run_thread_comm,
+		       taa_data->run_thread_pid);
 	} else  {
 		/*
 		 * The duration of the IRQ handler that handled the timerlat IRQ.
 		 */
-		printf("  Timerlat IRQ duration:	\t\t	%9.2f us (%.2f %%)\n",
-			ns_to_usf(taa_data->timer_irq_duration),
-			ns_to_per(total, taa_data->timer_irq_duration));
+		printf("  Timerlat IRQ duration: %.*s %9.2f us (%.2f %%)\n",
+		       30, spaces,
+		       ns_to_usf(taa_data->timer_irq_duration),
+		       ns_to_per(total, taa_data->timer_irq_duration));
 
 		/*
 		 * The amount of time that the current thread postponed the scheduler.
@@ -611,13 +628,13 @@
 		 * Recalling that it is net from NMI/IRQ/Softirq interference, so there
 		 * is no need to compute values here.
 		 */
-		printf("  Blocking thread:	\t\t\t	%9.2f us (%.2f %%)\n",
-			ns_to_usf(taa_data->thread_blocking_duration),
-			ns_to_per(total, taa_data->thread_blocking_duration));
-
-		printf("	%24s:%-9llu		%9.2f us\n",
-			taa_data->run_thread_comm, taa_data->run_thread_pid,
-			ns_to_usf(taa_data->thread_blocking_duration));
+		printf("  Blocking thread: %.*s %9.2f us (%.2f %%)\n", 36, spaces,
+		       ns_to_usf(taa_data->thread_blocking_duration),
+		       ns_to_per(total, taa_data->thread_blocking_duration));
+
+		printf(" %.*s %24s:%-9llu %.*s %9.2f us\n", 6, spaces,
+		       taa_data->run_thread_comm, taa_data->run_thread_pid,
+		       12, spaces, ns_to_usf(taa_data->thread_blocking_duration));
 	}
 
 	/*
@@ -629,9 +646,9 @@
 	 * NMIs can happen during the IRQ, so they are always possible.
 	 */
 	if (taa_data->thread_nmi_sum)
-		printf("  NMI interference	\t\t\t	%9.2f us (%.2f %%)\n",
-			ns_to_usf(taa_data->thread_nmi_sum),
-			ns_to_per(total, taa_data->thread_nmi_sum));
+		printf("  NMI interference %.*s %9.2f us (%.2f %%)\n", 36, spaces,
+		       ns_to_usf(taa_data->thread_nmi_sum),
+		       ns_to_per(total, taa_data->thread_nmi_sum));
 
 	/*
 	 * If it is an IRQ latency, the other factors can be skipped.
@@ -643,9 +660,9 @@
 	 * Prints the interference caused by IRQs to the thread latency.
 	 */
 	if (taa_data->thread_irq_sum) {
-		printf("  IRQ interference	\t\t\t	%9.2f us (%.2f %%)\n",
-			ns_to_usf(taa_data->thread_irq_sum),
-			ns_to_per(total, taa_data->thread_irq_sum));
+		printf("  IRQ interference %.*s %9.2f us (%.2f %%)\n", 36, spaces,
+		       ns_to_usf(taa_data->thread_irq_sum),
+		       ns_to_per(total, taa_data->thread_irq_sum));
 
 		trace_seq_do_printf(taa_data->irqs_seq);
 	}
@@ -654,9 +671,9 @@
 	 * Prints the interference caused by Softirqs to the thread latency.
 	 */
 	if (taa_data->thread_softirq_sum) {
-		printf("  Softirq interference	\t\t\t	%9.2f us (%.2f %%)\n",
-			ns_to_usf(taa_data->thread_softirq_sum),
-			ns_to_per(total, taa_data->thread_softirq_sum));
+		printf("  Softirq interference %.*s %9.2f us (%.2f %%)\n", 32, spaces,
+		       ns_to_usf(taa_data->thread_softirq_sum),
+		       ns_to_per(total, taa_data->thread_softirq_sum));
 
 		trace_seq_do_printf(taa_data->softirqs_seq);
 	}
@@ -670,9 +687,9 @@
 	 * timer handling latency.
 	 */
 	if (taa_data->thread_thread_sum) {
-		printf("  Thread interference	\t\t\t	%9.2f us (%.2f %%)\n",
-			ns_to_usf(taa_data->thread_thread_sum),
-			ns_to_per(total, taa_data->thread_thread_sum));
+		printf("  Thread interference %.*s %9.2f us (%.2f %%)\n", 33, spaces,
+		       ns_to_usf(taa_data->thread_thread_sum),
+		       ns_to_per(total, taa_data->thread_thread_sum));
 
 		trace_seq_do_printf(taa_data->threads_seq);
 	}
@@ -682,8 +699,8 @@
 	 */
 print_total:
 	printf("------------------------------------------------------------------------\n");
-	printf("  %s latency:	\t\t\t	%9.2f us (100%%)\n", irq ? "IRQ" : "Thread",
-		ns_to_usf(total));
+	printf("  %s latency: %.*s %9.2f us (100%%)\n", irq ? "   IRQ" : "Thread",
+	       37, spaces, ns_to_usf(total));
 }
 
 static int timerlat_auto_analysis_collect_trace(struct timerlat_aa_context *taa_ctx)
--- linux-qcom-6.8.0.orig/tools/tracing/rtla/src/timerlat_hist.c
+++ linux-qcom-6.8.0/tools/tracing/rtla/src/timerlat_hist.c
@@ -58,9 +58,9 @@
 	int			*thread;
 	int			*user;
 
-	int			irq_count;
-	int			thread_count;
-	int			user_count;
+	unsigned long long	irq_count;
+	unsigned long long	thread_count;
+	unsigned long long	user_count;
 
 	unsigned long long	min_irq;
 	unsigned long long	sum_irq;
@@ -300,15 +300,15 @@
 			continue;
 
 		if (!params->no_irq)
-			trace_seq_printf(trace->seq, "%9d ",
+			trace_seq_printf(trace->seq, "%9llu ",
 					data->hist[cpu].irq_count);
 
 		if (!params->no_thread)
-			trace_seq_printf(trace->seq, "%9d ",
+			trace_seq_printf(trace->seq, "%9llu ",
 					data->hist[cpu].thread_count);
 
 		if (params->user_hist)
-			trace_seq_printf(trace->seq, "%9d ",
+			trace_seq_printf(trace->seq, "%9llu ",
 					 data->hist[cpu].user_count);
 	}
 	trace_seq_printf(trace->seq, "\n");
@@ -323,17 +323,29 @@
 		if (!data->hist[cpu].irq_count && !data->hist[cpu].thread_count)
 			continue;
 
-		if (!params->no_irq)
-			trace_seq_printf(trace->seq, "%9llu ",
-					data->hist[cpu].min_irq);
+		if (!params->no_irq) {
+			if (data->hist[cpu].irq_count)
+				trace_seq_printf(trace->seq, "%9llu ",
+						data->hist[cpu].min_irq);
+			else
+				trace_seq_printf(trace->seq, "        - ");
+		}
 
-		if (!params->no_thread)
-			trace_seq_printf(trace->seq, "%9llu ",
-					data->hist[cpu].min_thread);
+		if (!params->no_thread) {
+			if (data->hist[cpu].thread_count)
+				trace_seq_printf(trace->seq, "%9llu ",
+						data->hist[cpu].min_thread);
+			else
+				trace_seq_printf(trace->seq, "        - ");
+		}
 
-		if (params->user_hist)
-			trace_seq_printf(trace->seq, "%9llu ",
-					data->hist[cpu].min_user);
+		if (params->user_hist) {
+			if (data->hist[cpu].user_count)
+				trace_seq_printf(trace->seq, "%9llu ",
+						data->hist[cpu].min_user);
+			else
+				trace_seq_printf(trace->seq, "        - ");
+		}
 	}
 	trace_seq_printf(trace->seq, "\n");
 
@@ -383,17 +395,29 @@
 		if (!data->hist[cpu].irq_count && !data->hist[cpu].thread_count)
 			continue;
 
-		if (!params->no_irq)
-			trace_seq_printf(trace->seq, "%9llu ",
-					data->hist[cpu].max_irq);
+		if (!params->no_irq) {
+			if (data->hist[cpu].irq_count)
+				trace_seq_printf(trace->seq, "%9llu ",
+						 data->hist[cpu].max_irq);
+			else
+				trace_seq_printf(trace->seq, "        - ");
+		}
 
-		if (!params->no_thread)
-			trace_seq_printf(trace->seq, "%9llu ",
-					data->hist[cpu].max_thread);
+		if (!params->no_thread) {
+			if (data->hist[cpu].thread_count)
+				trace_seq_printf(trace->seq, "%9llu ",
+						data->hist[cpu].max_thread);
+			else
+				trace_seq_printf(trace->seq, "        - ");
+		}
 
-		if (params->user_hist)
-			trace_seq_printf(trace->seq, "%9llu ",
-					data->hist[cpu].max_user);
+		if (params->user_hist) {
+			if (data->hist[cpu].user_count)
+				trace_seq_printf(trace->seq, "%9llu ",
+						data->hist[cpu].max_user);
+			else
+				trace_seq_printf(trace->seq, "        - ");
+		}
 	}
 	trace_seq_printf(trace->seq, "\n");
 	trace_seq_do_printf(trace->seq);
--- linux-qcom-6.8.0.orig/tools/tracing/rtla/src/timerlat_top.c
+++ linux-qcom-6.8.0/tools/tracing/rtla/src/timerlat_top.c
@@ -49,9 +49,9 @@
 };
 
 struct timerlat_top_cpu {
-	int			irq_count;
-	int			thread_count;
-	int			user_count;
+	unsigned long long	irq_count;
+	unsigned long long	thread_count;
+	unsigned long long	user_count;
 
 	unsigned long long	cur_irq;
 	unsigned long long	min_irq;
@@ -211,6 +211,8 @@
 	trace_seq_printf(s, "\n");
 }
 
+static const char *no_value = "        -";
+
 /*
  * timerlat_top_print - prints the output of a given CPU
  */
@@ -235,13 +237,10 @@
 	/*
 	 * Unless trace is being lost, IRQ counter is always the max.
 	 */
-	trace_seq_printf(s, "%3d #%-9d |", cpu, cpu_data->irq_count);
+	trace_seq_printf(s, "%3d #%-9llu |", cpu, cpu_data->irq_count);
 
 	if (!cpu_data->irq_count) {
-		trace_seq_printf(s, "        - ");
-		trace_seq_printf(s, "        - ");
-		trace_seq_printf(s, "        - ");
-		trace_seq_printf(s, "        - |");
+		trace_seq_printf(s, "%s %s %s %s |", no_value, no_value, no_value, no_value);
 	} else {
 		trace_seq_printf(s, "%9llu ", cpu_data->cur_irq / params->output_divisor);
 		trace_seq_printf(s, "%9llu ", cpu_data->min_irq / params->output_divisor);
@@ -250,10 +249,7 @@
 	}
 
 	if (!cpu_data->thread_count) {
-		trace_seq_printf(s, "        - ");
-		trace_seq_printf(s, "        - ");
-		trace_seq_printf(s, "        - ");
-		trace_seq_printf(s, "        -\n");
+		trace_seq_printf(s, "%s %s %s %s", no_value, no_value, no_value, no_value);
 	} else {
 		trace_seq_printf(s, "%9llu ", cpu_data->cur_thread / divisor);
 		trace_seq_printf(s, "%9llu ", cpu_data->min_thread / divisor);
@@ -270,10 +266,7 @@
 	trace_seq_printf(s, " |");
 
 	if (!cpu_data->user_count) {
-		trace_seq_printf(s, "        - ");
-		trace_seq_printf(s, "        - ");
-		trace_seq_printf(s, "        - ");
-		trace_seq_printf(s, "        -\n");
+		trace_seq_printf(s, "%s %s %s %s\n", no_value, no_value, no_value, no_value);
 	} else {
 		trace_seq_printf(s, "%9llu ", cpu_data->cur_user / divisor);
 		trace_seq_printf(s, "%9llu ", cpu_data->min_user / divisor);
@@ -346,7 +339,7 @@
 		"	  -c/--cpus cpus: run the tracer only on the given cpus",
 		"	  -H/--house-keeping cpus: run rtla control threads only on the given cpus",
 		"	  -C/--cgroup[=cgroup_name]: set cgroup, if no cgroup_name is passed, the rtla's cgroup will be inherited",
-		"	  -d/--duration time[m|h|d]: duration of the session in seconds",
+		"	  -d/--duration time[s|m|h|d]: duration of the session",
 		"	  -D/--debug: print debug info",
 		"	     --dump-tasks: prints the task running on all CPUs if stop conditions are met (depends on !--no-aa)",
 		"	  -t/--trace[=file]: save the stopped trace to [file|timerlat_trace.txt]",
@@ -492,7 +485,7 @@
 		case 'd':
 			params->duration = parse_seconds_duration(optarg);
 			if (!params->duration)
-				timerlat_top_usage("Invalid -D duration\n");
+				timerlat_top_usage("Invalid -d duration\n");
 			break;
 		case 'e':
 			tevent = trace_event_alloc(optarg);
--- linux-qcom-6.8.0.orig/tools/tracing/rtla/src/utils.c
+++ linux-qcom-6.8.0/tools/tracing/rtla/src/utils.c
@@ -233,7 +233,7 @@
 
 #define SCHED_DEADLINE		6
 
-static inline int sched_setattr(pid_t pid, const struct sched_attr *attr,
+static inline int syscall_sched_setattr(pid_t pid, const struct sched_attr *attr,
 				unsigned int flags) {
 	return syscall(__NR_sched_setattr, pid, attr, flags);
 }
@@ -243,7 +243,7 @@
 	int flags = 0;
 	int retval;
 
-	retval = sched_setattr(pid, attr, flags);
+	retval = syscall_sched_setattr(pid, attr, flags);
 	if (retval < 0) {
 		err_msg("Failed to set sched attributes to the pid %d: %s\n",
 			pid, strerror(errno));
--- linux-qcom-6.8.0.orig/tools/tracing/rtla/src/utils.h
+++ linux-qcom-6.8.0/tools/tracing/rtla/src/utils.h
@@ -46,6 +46,7 @@
 	*a += *b;
 }
 
+#ifndef SCHED_ATTR_SIZE_VER0
 struct sched_attr {
 	uint32_t size;
 	uint32_t sched_policy;
@@ -56,6 +57,7 @@
 	uint64_t sched_deadline;
 	uint64_t sched_period;
 };
+#endif /* SCHED_ATTR_SIZE_VER0 */
 
 int parse_prio(char *arg, struct sched_attr *sched_param);
 int parse_cpu_set(char *cpu_list, cpu_set_t *set);
--- linux-qcom-6.8.0.orig/tools/usb/usbip/configure.ac
+++ linux-qcom-6.8.0/tools/usb/usbip/configure.ac
@@ -18,7 +18,7 @@
 # Silent build for automake >= 1.11
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
-AC_SUBST([EXTRA_CFLAGS], ["-Wall -Werror -Wextra -std=gnu99"])
+AC_SUBST([EXTRA_CFLAGS], ["-Wall -Werror -Wextra -Wno-address-of-packed-member -std=gnu99"])
 
 # Checks for programs.
 AC_PROG_CC
--- linux-qcom-6.8.0.orig/tools/usb/usbip/src/usbip_detach.c
+++ linux-qcom-6.8.0/tools/usb/usbip/src/usbip_detach.c
@@ -68,6 +68,7 @@
 	}
 
 	if (!found) {
+		ret = -1;
 		err("Invalid port %s > maxports %d",
 			port, vhci_driver->nports);
 		goto call_driver_close;
--- linux-qcom-6.8.0.orig/tools/verification/dot2/automata.py
+++ linux-qcom-6.8.0/tools/verification/dot2/automata.py
@@ -29,11 +29,11 @@
 
     def __get_model_name(self):
         basename = ntpath.basename(self.__dot_path)
-        if basename.endswith(".dot") == False:
+        if not basename.endswith(".dot") and not basename.endswith(".gv"):
             print("not a dot file")
             raise Exception("not a dot file: %s" % self.__dot_path)
 
-        model_name = basename[0:-4]
+        model_name = ntpath.splitext(basename)[0]
         if model_name.__len__() == 0:
             raise Exception("not a dot file: %s" % self.__dot_path)
 
@@ -68,9 +68,9 @@
     def __get_cursor_begin_events(self):
         cursor = 0
         while self.__dot_lines[cursor].split()[0] != "{node":
-           cursor += 1
+            cursor += 1
         while self.__dot_lines[cursor].split()[0] == "{node":
-           cursor += 1
+            cursor += 1
         # skip initial state transition
         cursor += 1
         return cursor
@@ -94,11 +94,11 @@
                 initial_state = state[7:]
             else:
                 states.append(state)
-                if self.__dot_lines[cursor].__contains__("doublecircle") == True:
+                if "doublecircle" in self.__dot_lines[cursor]:
                     final_states.append(state)
                     has_final_states = True
 
-                if self.__dot_lines[cursor].__contains__("ellipse") == True:
+                if "ellipse" in self.__dot_lines[cursor]:
                     final_states.append(state)
                     has_final_states = True
 
@@ -110,7 +110,7 @@
         # Insert the initial state at the bein og the states
         states.insert(0, initial_state)
 
-        if has_final_states == False:
+        if not has_final_states:
             final_states.append(initial_state)
 
         return states, initial_state, final_states
@@ -120,7 +120,7 @@
         cursor = self.__get_cursor_begin_events()
 
         events = []
-        while self.__dot_lines[cursor][1] == '"':
+        while self.__dot_lines[cursor].lstrip()[0] == '"':
             # transitions have the format:
             # "all_fired" -> "both_fired" [ label = "disable_irq" ];
             #  ------------ event is here ------------^^^^^
@@ -161,7 +161,7 @@
         # and we are back! Let's fill the matrix
         cursor = self.__get_cursor_begin_events()
 
-        while self.__dot_lines[cursor][1] == '"':
+        while self.__dot_lines[cursor].lstrip()[0] == '"':
             if self.__dot_lines[cursor].split()[1] == "->":
                 line = self.__dot_lines[cursor].split()
                 origin_state = line[0].replace('"','').replace(',','_')
--- linux-qcom-6.8.0.orig/ubuntu/Kconfig
+++ linux-qcom-6.8.0/ubuntu/Kconfig
@@ -0,0 +1,24 @@
+menu "Ubuntu Supplied Third-Party Device Drivers"
+
+
+config UBUNTU_ODM_DRIVERS
+	bool "Ubuntu ODM supplied drivers"
+	help
+	  Turn on support for Ubuntu ODM supplied drivers
+
+#
+# NOTE: to allow drivers to be added and removed without causing merge
+# collisions you should add new entries in the middle of the six lines
+# of ## at the bottom of the list.  Always add three lines of ## above
+# your new entry and maintain the six lines below.
+#
+
+##
+##
+##
+source "ubuntu/ubuntu-host/Kconfig"
+##
+##
+##
+
+endmenu
--- linux-qcom-6.8.0.orig/ubuntu/Makefile
+++ linux-qcom-6.8.0/ubuntu/Makefile
@@ -0,0 +1,26 @@
+#
+# Makefile for the Linux kernel ubuntu supplied third-party device drivers.
+#
+
+#
+# NOTE: to allow drivers to be added and removed without causing merge
+# collisions you should add new entries in the middle of the six lines
+# of ## at the bottom of the list.  Always add three lines of ## above
+# your new entry and maintain the six lines below.
+#
+
+##
+##
+##
+obj-$(CONFIG_UBUNTU_HOST)      += ubuntu-host/
+##
+##
+##
+
+##
+##
+##
+obj-$(CONFIG_ARCH_QCOM)		+= qcom/
+##
+##
+##
--- linux-qcom-6.8.0.orig/ubuntu/hio/Makefile
+++ linux-qcom-6.8.0/ubuntu/hio/Makefile
@@ -0,0 +1,69 @@
+ifneq ($(KERNELRELEASE),)
+#	hio-y := hio_main.o
+#	obj-$(CONFIG_HIO_DRIVER) += hio.o
+	obj-m += hio.o
+else
+
+KVER=
+ifeq ($(KVER),)
+  KVER=$(shell uname -r)
+endif
+
+PDIR=
+ifeq ($(PDIR),)
+  PDIR=extra
+endif
+
+PREFIX=
+
+MODDIR=/lib/modules/$(KVER)/$(PDIR)/hio/
+MOD=hio.ko
+
+ifeq ($(KVER),2.6.32-300.3.1.el6uek.x86_64)
+  FLAGS += -DSSD_QUEUE_PBIO
+endif
+ifeq ($(KVER),2.6.32-220.el6.x86_64)
+  FLAGS += -DSSD_QUEUE_PBIO
+endif
+ifeq ($(KVER),2.6.32-358.el6.x86_64)
+  FLAGS += -DSSD_QUEUE_PBIO
+endif
+ifeq ($(KVER),2.6.32-358.23.2.el6.x86_64)
+  FLAGS += -DSSD_QUEUE_PBIO
+endif
+ifeq ($(KVER),3.0.58-0.6.6-xen)
+  FLAGS += -DSSD_QUEUE_PBIO
+endif
+ifeq ($(KVER),3.2.0-4-amd64)
+  FLAGS += -DSSD_BIOVEC_PHYS_MERGEABLE_FIXED
+endif
+ifeq ($(KVER),2.6.39-400.209.1.el5uek) #Oracle Linux Server release 5.10
+  FLAGS += -DSSD_BIOVEC_PHYS_MERGEABLE_FIXED
+endif
+ifeq ($(KVER),2.6.39-400.215.10.el5uek) #Oracle Linux Server release 5.11
+  FLAGS += -DSSD_BIOVEC_PHYS_MERGEABLE_FIXED
+endif
+ifeq ($(KVER),2.6.39-200.24.1.el6uek.x86_64) #Oracle Linux Server release 6.3
+  FLAGS += -DSSD_BIOVEC_PHYS_MERGEABLE_FIXED
+endif
+ifeq ($(KVER),2.6.39-400.17.1.el6uek.x86_64) #Oracle Linux Server release 6.4
+  FLAGS += -DSSD_BIOVEC_PHYS_MERGEABLE_FIXED
+endif
+
+
+KERNELDIR ?= /lib/modules/$(KVER)/build
+PWD       := $(shell pwd)
+
+default:
+	$(MAKE) -C $(KERNELDIR) M=$(PWD) EXTRA_CFLAGS="$(FLAGS)" modules
+clean:
+	rm -rf *.o *~ core .depend .*.cmd *.ko *.mod.c .tmp_versions Module.*
+
+install: default
+	mkdir -p $(PREFIX)/$(MODDIR)
+	install -m 444 $(MOD) $(PREFIX)/$(MODDIR)
+	@if [ "$(PREFIX)" = "" ]; then /sbin/depmod -a ;\
+	else echo " *** Run 'depmod -a' to update the module database.";\
+	fi
+endif
+
--- linux-qcom-6.8.0.orig/ubuntu/hio/hio.c
+++ linux-qcom-6.8.0/ubuntu/hio/hio.c
@@ -0,0 +1,12527 @@
+/*
+* Huawei SSD device driver
+* Copyright (c) 2016, Huawei Technologies Co., Ltd.
+*
+* This program is free software; you can redistribute it and/or modify it
+* under the terms and conditions of the GNU General Public License,
+* version 2, as published by the Free Software Foundation.
+*
+* This program is distributed in the hope it will be useful, but WITHOUT
+* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+* more details.
+*/
+
+#ifndef LINUX_VERSION_CODE
+#include <linux/version.h>
+#endif
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16))
+#include <linux/config.h>
+#endif
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/bio.h>
+#include <linux/timer.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/blkdev.h>
+#include <linux/sched.h>
+#include <linux/fcntl.h>
+#include <linux/interrupt.h>
+#include <linux/compiler.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <linux/time.h>
+#include <linux/stat.h>
+#include <linux/fs.h>
+#include <linux/dma-mapping.h>
+#include <linux/completion.h>
+#include <linux/workqueue.h>
+#include <linux/mm.h>
+#include <linux/ioctl.h>
+#include <linux/hdreg.h>	/* HDIO_GETGEO */
+#include <linux/list.h>
+#include <linux/reboot.h>
+#include <linux/kthread.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0))
+#include <linux/seq_file.h>
+#endif
+#include <asm/uaccess.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,2,0))
+#include <linux/scatterlist.h>
+#include <linux/vmalloc.h>
+#else
+#include <asm/scatterlist.h>
+#endif
+#include <asm/io.h>
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,17))
+#include <linux/devfs_fs_kernel.h>
+#endif
+
+/* driver */
+#define MODULE_NAME		"hio"
+#define DRIVER_VERSION	"2.1.0.23"
+#define DRIVER_VERSION_LEN	16
+
+#define SSD_FW_MIN		0x1
+
+#define SSD_DEV_NAME	MODULE_NAME
+#define SSD_DEV_NAME_LEN	16
+#define SSD_CDEV_NAME	"c"SSD_DEV_NAME
+#define SSD_SDEV_NAME	"s"SSD_DEV_NAME
+
+
+#define SSD_CMAJOR		0
+#define SSD_MAJOR		0
+#define SSD_MAJOR_SL	0
+#define SSD_MINORS		16
+
+#define SSD_MAX_DEV		702
+#define SSD_ALPHABET_NUM	26
+
+#define hio_info(f, arg...) printk(KERN_INFO MODULE_NAME"info: " f , ## arg)
+#define hio_note(f, arg...) printk(KERN_NOTICE MODULE_NAME"note: " f , ## arg)
+#define hio_warn(f, arg...) printk(KERN_WARNING MODULE_NAME"warn: " f , ## arg)
+#define hio_err(f, arg...)  printk(KERN_ERR MODULE_NAME"err: " f , ## arg)
+
+/* slave port */
+#define SSD_SLAVE_PORT_DEVID	0x000a
+
+/* int mode */
+
+/* 2.6.9 msi affinity bug, should turn msi & msi-x off */
+//#define SSD_MSI
+#define SSD_ESCAPE_IRQ
+
+//#define SSD_MSIX
+#ifndef MODULE
+#define SSD_MSIX
+#endif
+#define SSD_MSIX_VEC	8
+#ifdef SSD_MSIX
+#undef SSD_MSI
+//#undef SSD_ESCAPE_IRQ
+#define SSD_MSIX_AFFINITY_FORCE
+#endif
+
+#define SSD_TRIM
+
+/* Over temperature protect */
+#define SSD_OT_PROTECT
+
+#ifdef SSD_QUEUE_PBIO
+#define BIO_SSD_PBIO		20
+#endif
+
+/* debug */
+//#define SSD_DEBUG_ERR
+
+/* cmd timer */
+#define SSD_CMD_TIMEOUT		(60*HZ)
+
+/* i2c & smbus */
+#define SSD_SPI_TIMEOUT		(5*HZ)
+#define SSD_I2C_TIMEOUT		(5*HZ)
+
+#define SSD_I2C_MAX_DATA	(127)
+#define SSD_SMBUS_BLOCK_MAX	(32)
+#define SSD_SMBUS_DATA_MAX	(SSD_SMBUS_BLOCK_MAX + 2)
+
+/* wait for init */
+#define SSD_INIT_WAIT		(1000) //1s
+#define SSD_CONTROLLER_WAIT	(20*1000/SSD_INIT_WAIT)	//20s
+#define SSD_INIT_MAX_WAIT	(500*1000/SSD_INIT_WAIT) //500s
+#define SSD_INIT_MAX_WAIT_V3_2	(1400*1000/SSD_INIT_WAIT) //1400s
+#define SSD_RAM_INIT_MAX_WAIT	(10*1000/SSD_INIT_WAIT) //10s
+#define SSD_CH_INFO_MAX_WAIT	(10*1000/SSD_INIT_WAIT) //10s
+
+/* blkdev busy wait */
+#define SSD_DEV_BUSY_WAIT	1000 //ms
+#define SSD_DEV_BUSY_MAX_WAIT	(8*1000/SSD_DEV_BUSY_WAIT) //8s
+
+/* smbus retry */
+#define SSD_SMBUS_RETRY_INTERVAL	(5) //ms
+#define SSD_SMBUS_RETRY_MAX			(1000/SSD_SMBUS_RETRY_INTERVAL)
+
+#define SSD_BM_RETRY_MAX			7
+
+/* bm routine interval */
+#define SSD_BM_CAP_LEARNING_DELAY	(10*60*1000)
+
+/* routine interval */
+#define SSD_ROUTINE_INTERVAL		(10*1000)	//10s
+#define SSD_HWMON_ROUTINE_TICK		(60*1000/SSD_ROUTINE_INTERVAL)
+#define SSD_CAPMON_ROUTINE_TICK		((3600*1000/SSD_ROUTINE_INTERVAL)*24*30)
+#define SSD_CAPMON2_ROUTINE_TICK	(10*60*1000/SSD_ROUTINE_INTERVAL)	//fault recover
+
+/* dma align */
+#define SSD_DMA_ALIGN		(16)
+
+/* some hw defalut */
+#define SSD_LOG_MAX_SZ		4096
+
+#define SSD_NAND_OOB_SZ		1024
+#define SSD_NAND_ID_SZ		8
+#define SSD_NAND_ID_BUFF_SZ	1024
+#define SSD_NAND_MAX_CE		2
+
+#define SSD_BBT_RESERVED	8
+
+#define SSD_ECC_MAX_FLIP	(64+1)
+
+#define SSD_RAM_ALIGN		16
+
+
+#define SSD_RELOAD_FLAG		0x3333CCCC
+#define SSD_RELOAD_FW		0xAA5555AA
+#define SSD_RESET_NOINIT	0xAA5555AA
+#define SSD_RESET			0x55AAAA55
+#define SSD_RESET_FULL		0x5A
+//#define SSD_RESET_WAIT		1000	//1s
+//#define SSD_RESET_MAX_WAIT	(200*1000/SSD_RESET_WAIT) //200s
+
+
+/* reverion 1 */
+#define SSD_PROTOCOL_V1			0x0
+
+#define SSD_ROM_SIZE			(16*1024*1024)
+#define SSD_ROM_BLK_SIZE		(256*1024)
+#define SSD_ROM_PAGE_SIZE		(256)
+#define SSD_ROM_NR_BRIDGE_FW	2
+#define SSD_ROM_NR_CTRL_FW		2
+#define SSD_ROM_BRIDGE_FW_BASE	0
+#define SSD_ROM_BRIDGE_FW_SIZE	(2*1024*1024)
+#define SSD_ROM_CTRL_FW_BASE	(SSD_ROM_NR_BRIDGE_FW*SSD_ROM_BRIDGE_FW_SIZE)
+#define SSD_ROM_CTRL_FW_SIZE	(5*1024*1024)
+#define SSD_ROM_LABEL_BASE		(SSD_ROM_CTRL_FW_BASE+SSD_ROM_CTRL_FW_SIZE*SSD_ROM_NR_CTRL_FW)
+#define SSD_ROM_VP_BASE			(SSD_ROM_LABEL_BASE+SSD_ROM_BLK_SIZE)
+
+/* reverion 3 */
+#define SSD_PROTOCOL_V3			0x3000000
+#define SSD_PROTOCOL_V3_1_1		0x3010001
+#define SSD_PROTOCOL_V3_1_3		0x3010003
+#define SSD_PROTOCOL_V3_2		0x3020000
+#define SSD_PROTOCOL_V3_2_1		0x3020001	/* <4KB improved */
+#define SSD_PROTOCOL_V3_2_2		0x3020002	/* ot protect */
+#define SSD_PROTOCOL_V3_2_4		0x3020004
+
+
+#define SSD_PV3_ROM_NR_BM_FW	1
+#define SSD_PV3_ROM_BM_FW_SZ	(64*1024*8)
+
+#define SSD_ROM_LOG_SZ			(64*1024*4)
+
+#define SSD_ROM_NR_SMART_MAX	2
+#define SSD_PV3_ROM_NR_SMART	SSD_ROM_NR_SMART_MAX
+#define SSD_PV3_ROM_SMART_SZ	(64*1024)
+
+/* reverion 3.2 */
+#define SSD_PV3_2_ROM_LOG_SZ	(64*1024*80) /* 5MB */
+#define SSD_PV3_2_ROM_SEC_SZ	(256*1024) /* 256KB */
+
+
+/* register */
+#define SSD_REQ_FIFO_REG		0x0000
+#define SSD_RESP_FIFO_REG		0x0008	//0x0010
+#define SSD_RESP_PTR_REG		0x0010	//0x0018
+#define SSD_INTR_INTERVAL_REG	0x0018
+#define SSD_READY_REG			0x001C
+#define SSD_BRIDGE_TEST_REG		0x0020
+#define SSD_STRIPE_SIZE_REG		0x0028
+#define SSD_CTRL_VER_REG		0x0030	//controller
+#define SSD_BRIDGE_VER_REG		0x0034	//bridge
+#define SSD_PCB_VER_REG			0x0038
+#define SSD_BURN_FLAG_REG		0x0040
+#define SSD_BRIDGE_INFO_REG		0x0044
+
+#define SSD_WL_VAL_REG			0x0048	//32-bit
+
+#define SSD_BB_INFO_REG			0x004C
+
+#define SSD_ECC_TEST_REG		0x0050 //test only
+#define SSD_ERASE_TEST_REG		0x0058 //test only
+#define SSD_WRITE_TEST_REG		0x0060 //test only
+
+#define SSD_RESET_REG 			0x0068
+#define SSD_RELOAD_FW_REG		0x0070
+
+#define SSD_RESERVED_BLKS_REG	0x0074
+#define SSD_VALID_PAGES_REG		0x0078
+#define SSD_CH_INFO_REG			0x007C
+
+#define SSD_CTRL_TEST_REG_SZ	0x8
+#define SSD_CTRL_TEST_REG0		0x0080
+#define SSD_CTRL_TEST_REG1		0x0088
+#define SSD_CTRL_TEST_REG2		0x0090
+#define SSD_CTRL_TEST_REG3		0x0098
+#define SSD_CTRL_TEST_REG4		0x00A0
+#define SSD_CTRL_TEST_REG5		0x00A8
+#define SSD_CTRL_TEST_REG6		0x00B0
+#define SSD_CTRL_TEST_REG7		0x00B8
+
+#define SSD_FLASH_INFO_REG0		0x00C0
+#define SSD_FLASH_INFO_REG1		0x00C8
+#define SSD_FLASH_INFO_REG2		0x00D0
+#define SSD_FLASH_INFO_REG3		0x00D8
+#define SSD_FLASH_INFO_REG4		0x00E0
+#define SSD_FLASH_INFO_REG5		0x00E8
+#define SSD_FLASH_INFO_REG6		0x00F0
+#define SSD_FLASH_INFO_REG7		0x00F8
+
+#define SSD_RESP_INFO_REG		0x01B8
+#define SSD_NAND_BUFF_BASE		0x01BC //for nand write
+
+#define SSD_CHIP_INFO_REG_SZ	0x10
+#define SSD_CHIP_INFO_REG0		0x0100	//128 bit
+#define SSD_CHIP_INFO_REG1		0x0110
+#define SSD_CHIP_INFO_REG2		0x0120
+#define SSD_CHIP_INFO_REG3		0x0130
+#define SSD_CHIP_INFO_REG4		0x0140
+#define SSD_CHIP_INFO_REG5		0x0150
+#define SSD_CHIP_INFO_REG6		0x0160
+#define SSD_CHIP_INFO_REG7		0x0170
+
+#define SSD_RAM_INFO_REG		0x01C4
+
+#define SSD_BBT_BASE_REG		0x01C8
+#define SSD_ECT_BASE_REG		0x01CC
+
+#define SSD_CLEAR_INTR_REG		0x01F0
+
+#define SSD_INIT_STATE_REG_SZ	0x8
+#define SSD_INIT_STATE_REG0		0x0200
+#define SSD_INIT_STATE_REG1		0x0208
+#define SSD_INIT_STATE_REG2		0x0210
+#define SSD_INIT_STATE_REG3		0x0218
+#define SSD_INIT_STATE_REG4		0x0220
+#define SSD_INIT_STATE_REG5		0x0228
+#define SSD_INIT_STATE_REG6		0x0230
+#define SSD_INIT_STATE_REG7		0x0238
+
+#define SSD_ROM_INFO_REG		0x0600
+#define SSD_ROM_BRIDGE_FW_INFO_REG	0x0604
+#define SSD_ROM_CTRL_FW_INFO_REG	0x0608
+#define SSD_ROM_VP_INFO_REG		0x060C
+
+#define SSD_LOG_INFO_REG		0x0610
+#define SSD_LED_REG				0x0614
+#define SSD_MSG_BASE_REG		0x06F8
+
+/*spi reg */
+#define SSD_SPI_REG_CMD			0x0180
+#define SSD_SPI_REG_CMD_HI		0x0184
+#define SSD_SPI_REG_WDATA		0x0188
+#define SSD_SPI_REG_ID			0x0190
+#define SSD_SPI_REG_STATUS		0x0198
+#define SSD_SPI_REG_RDATA		0x01A0
+#define SSD_SPI_REG_READY		0x01A8
+
+/* i2c register */
+#define SSD_I2C_CTRL_REG		0x06F0
+#define SSD_I2C_RDATA_REG		0x06F4
+
+/* temperature reg */
+#define SSD_BRIGE_TEMP_REG		0x0618
+
+#define SSD_CTRL_TEMP_REG0		0x0700
+#define SSD_CTRL_TEMP_REG1		0x0708
+#define SSD_CTRL_TEMP_REG2		0x0710
+#define SSD_CTRL_TEMP_REG3		0x0718
+#define SSD_CTRL_TEMP_REG4		0x0720
+#define SSD_CTRL_TEMP_REG5		0x0728
+#define SSD_CTRL_TEMP_REG6		0x0730
+#define SSD_CTRL_TEMP_REG7		0x0738
+
+/* reversion 3 reg */
+#define SSD_PROTOCOL_VER_REG	0x01B4
+
+#define SSD_FLUSH_TIMEOUT_REG	0x02A4
+#define SSD_BM_FAULT_REG		0x0660
+
+#define SSD_PV3_RAM_STATUS_REG_SZ	0x4
+#define SSD_PV3_RAM_STATUS_REG0	0x0260
+#define SSD_PV3_RAM_STATUS_REG1	0x0264
+#define SSD_PV3_RAM_STATUS_REG2	0x0268
+#define SSD_PV3_RAM_STATUS_REG3	0x026C
+#define SSD_PV3_RAM_STATUS_REG4	0x0270
+#define SSD_PV3_RAM_STATUS_REG5	0x0274
+#define SSD_PV3_RAM_STATUS_REG6	0x0278
+#define SSD_PV3_RAM_STATUS_REG7	0x027C
+
+#define SSD_PV3_CHIP_INFO_REG_SZ	0x40
+#define SSD_PV3_CHIP_INFO_REG0	0x0300
+#define SSD_PV3_CHIP_INFO_REG1	0x0340
+#define SSD_PV3_CHIP_INFO_REG2	0x0380
+#define SSD_PV3_CHIP_INFO_REG3	0x03B0
+#define SSD_PV3_CHIP_INFO_REG4	0x0400
+#define SSD_PV3_CHIP_INFO_REG5	0x0440
+#define SSD_PV3_CHIP_INFO_REG6	0x0480
+#define SSD_PV3_CHIP_INFO_REG7	0x04B0
+
+#define SSD_PV3_INIT_STATE_REG_SZ 0x20
+#define SSD_PV3_INIT_STATE_REG0	0x0500
+#define SSD_PV3_INIT_STATE_REG1	0x0520
+#define SSD_PV3_INIT_STATE_REG2	0x0540
+#define SSD_PV3_INIT_STATE_REG3	0x0560
+#define SSD_PV3_INIT_STATE_REG4	0x0580
+#define SSD_PV3_INIT_STATE_REG5	0x05A0
+#define SSD_PV3_INIT_STATE_REG6	0x05C0
+#define SSD_PV3_INIT_STATE_REG7	0x05E0
+
+/* reversion 3.1.1 reg */
+#define SSD_FULL_RESET_REG		0x01B0
+
+#define SSD_CTRL_REG_ZONE_SZ	0x800
+
+#define SSD_BB_THRESHOLD_L1_REG	0x2C0
+#define SSD_BB_THRESHOLD_L2_REG	0x2C4
+
+#define SSD_BB_ACC_REG_SZ		0x4
+#define SSD_BB_ACC_REG0			0x21C0
+#define SSD_BB_ACC_REG1			0x29C0
+#define SSD_BB_ACC_REG2			0x31C0
+
+#define SSD_EC_THRESHOLD_L1_REG	0x2C8
+#define SSD_EC_THRESHOLD_L2_REG	0x2CC
+
+#define SSD_EC_ACC_REG_SZ		0x4
+#define SSD_EC_ACC_REG0			0x21E0
+#define SSD_EC_ACC_REG1			0x29E0
+#define SSD_EC_ACC_REG2			0x31E0
+
+/* reversion 3.1.2 & 3.1.3 reg */
+#define SSD_HW_STATUS_REG		0x02AC
+
+#define SSD_PLP_INFO_REG		0x0664
+
+/*reversion 3.2 reg*/
+#define SSD_POWER_ON_REG		0x01EC
+#define SSD_PCIE_LINKSTATUS_REG	0x01F8
+#define SSD_PL_CAP_LEARN_REG	0x01FC
+
+#define SSD_FPGA_1V0_REG0		0x2070
+#define SSD_FPGA_1V8_REG0		0x2078
+#define SSD_FPGA_1V0_REG1		0x2870
+#define SSD_FPGA_1V8_REG1		0x2878
+
+/*reversion 3.2 reg*/
+#define SSD_READ_OT_REG0		0x2260
+#define SSD_WRITE_OT_REG0		0x2264
+#define SSD_READ_OT_REG1		0x2A60
+#define SSD_WRITE_OT_REG1		0x2A64
+
+
+/* function */
+#define SSD_FUNC_READ			0x01
+#define SSD_FUNC_WRITE			0x02
+#define SSD_FUNC_NAND_READ_WOOB	0x03
+#define SSD_FUNC_NAND_READ		0x04
+#define SSD_FUNC_NAND_WRITE		0x05
+#define SSD_FUNC_NAND_ERASE		0x06
+#define SSD_FUNC_NAND_READ_ID	0x07
+#define SSD_FUNC_READ_LOG		0x08
+#define SSD_FUNC_TRIM			0x09
+#define SSD_FUNC_RAM_READ		0x10
+#define SSD_FUNC_RAM_WRITE		0x11
+#define SSD_FUNC_FLUSH			0x12	//cache / bbt
+
+/* spi function */
+#define SSD_SPI_CMD_PROGRAM		0x02
+#define SSD_SPI_CMD_READ		0x03
+#define SSD_SPI_CMD_W_DISABLE	0x04
+#define SSD_SPI_CMD_READ_STATUS	0x05
+#define SSD_SPI_CMD_W_ENABLE	0x06
+#define SSD_SPI_CMD_ERASE		0xd8
+#define SSD_SPI_CMD_CLSR		0x30
+#define SSD_SPI_CMD_READ_ID		0x9f
+
+/* i2c */
+#define SSD_I2C_CTRL_READ		0x00
+#define SSD_I2C_CTRL_WRITE		0x01
+
+/* i2c internal register */
+#define SSD_I2C_CFG_REG			0x00
+#define SSD_I2C_DATA_REG		0x01
+#define SSD_I2C_CMD_REG			0x02
+#define SSD_I2C_STATUS_REG		0x03
+#define SSD_I2C_SADDR_REG		0x04
+#define SSD_I2C_LEN_REG			0x05
+#define SSD_I2C_RLEN_REG		0x06
+#define SSD_I2C_WLEN_REG		0x07
+#define SSD_I2C_RESET_REG		0x08	//write for reset
+#define SSD_I2C_PRER_REG		0x09
+
+
+/* hw mon */
+/* FPGA volt = ADC_value / 4096 * 3v */
+#define SSD_FPGA_1V0_ADC_MIN	1228 // 0.9v
+#define SSD_FPGA_1V0_ADC_MAX	1502 // 1.1v
+#define SSD_FPGA_1V8_ADC_MIN	2211 // 1.62v
+#define SSD_FPGA_1V8_ADC_MAX	2703 // 1.98
+
+/* ADC value */
+#define SSD_FPGA_VOLT_MAX(val)	(((val) & 0xffff) >> 4)
+#define SSD_FPGA_VOLT_MIN(val)	(((val >> 16) & 0xffff) >> 4)
+#define SSD_FPGA_VOLT_CUR(val)	(((val >> 32) & 0xffff) >> 4)
+#define SSD_FPGA_VOLT(val)		((val * 3000) >> 12)
+
+#define SSD_VOLT_LOG_DATA(idx, ctrl, volt)	(((uint32_t)idx << 24) | ((uint32_t)ctrl << 16) | ((uint32_t)volt))
+
+enum ssd_fpga_volt
+{
+	SSD_FPGA_1V0 = 0, 
+	SSD_FPGA_1V8, 
+	SSD_FPGA_VOLT_NR 
+};
+
+enum ssd_clock
+{
+	SSD_CLOCK_166M_LOST = 0, 
+	SSD_CLOCK_166M_SKEW, 
+	SSD_CLOCK_156M_LOST, 
+	SSD_CLOCK_156M_SKEW, 
+	SSD_CLOCK_NR
+};
+
+/* sensor */
+#define SSD_SENSOR_LM75_SADDRESS	(0x49 << 1)
+#define SSD_SENSOR_LM80_SADDRESS	(0x28 << 1)
+
+#define SSD_SENSOR_CONVERT_TEMP(val)	((int)(val >> 8))
+
+#define SSD_INLET_OT_TEMP			(55)	//55 DegC
+#define SSD_INLET_OT_HYST			(50)	//50 DegC
+#define SSD_FLASH_OT_TEMP			(70)	//70 DegC
+#define SSD_FLASH_OT_HYST			(65)	//65 DegC
+
+enum ssd_sensor
+{
+	SSD_SENSOR_LM80 = 0,
+	SSD_SENSOR_LM75,
+	SSD_SENSOR_NR
+};
+
+
+/* lm75 */
+enum ssd_lm75_reg
+{
+	SSD_LM75_REG_TEMP = 0, 
+	SSD_LM75_REG_CONF, 
+	SSD_LM75_REG_THYST, 
+	SSD_LM75_REG_TOS
+};
+
+/* lm96080 */
+#define SSD_LM80_REG_IN_MAX(nr)		(0x2a + (nr) * 2)
+#define SSD_LM80_REG_IN_MIN(nr)		(0x2b + (nr) * 2)
+#define SSD_LM80_REG_IN(nr)			(0x20 + (nr))
+
+#define SSD_LM80_REG_FAN1			0x28
+#define SSD_LM80_REG_FAN2			0x29
+#define SSD_LM80_REG_FAN_MIN(nr)	(0x3b + (nr))
+
+#define SSD_LM80_REG_TEMP			0x27
+#define SSD_LM80_REG_TEMP_HOT_MAX	0x38
+#define SSD_LM80_REG_TEMP_HOT_HYST	0x39
+#define SSD_LM80_REG_TEMP_OS_MAX	0x3a
+#define SSD_LM80_REG_TEMP_OS_HYST	0x3b
+
+#define SSD_LM80_REG_CONFIG			0x00
+#define SSD_LM80_REG_ALARM1			0x01
+#define SSD_LM80_REG_ALARM2			0x02
+#define SSD_LM80_REG_MASK1			0x03
+#define SSD_LM80_REG_MASK2			0x04
+#define SSD_LM80_REG_FANDIV			0x05
+#define SSD_LM80_REG_RES			0x06
+
+#define SSD_LM80_CONVERT_VOLT(val)	((val * 10) >> 8)
+
+#define SSD_LM80_3V3_VOLT(val)		((val)*33/19)
+
+#define SSD_LM80_CONV_INTERVAL		(1000)
+
+enum ssd_lm80_in
+{
+	SSD_LM80_IN_CAP = 0, 
+	SSD_LM80_IN_1V2, 
+	SSD_LM80_IN_1V2a, 
+	SSD_LM80_IN_1V5, 
+	SSD_LM80_IN_1V8, 
+	SSD_LM80_IN_FPGA_3V3, 
+	SSD_LM80_IN_3V3, 
+	SSD_LM80_IN_NR 
+};
+
+struct ssd_lm80_limit
+{
+	uint8_t low;
+	uint8_t high;
+};
+
+/* +/- 5% except cap in*/
+static struct ssd_lm80_limit ssd_lm80_limit[SSD_LM80_IN_NR] = {
+	{171, 217}, /* CAP in: 1710 ~ 2170 */
+	{114, 126}, 
+	{114, 126}, 
+	{142, 158}, 
+	{171, 189}, 
+	{180, 200}, 
+	{180, 200}, 
+};
+
+/* temperature sensors */
+enum ssd_temp_sensor
+{
+	SSD_TEMP_INLET = 0, 
+	SSD_TEMP_FLASH, 
+	SSD_TEMP_CTRL, 
+	SSD_TEMP_NR 
+};
+
+
+#ifdef SSD_OT_PROTECT
+#define SSD_OT_DELAY		(60) //ms
+
+#define SSD_OT_TEMP			(90) //90 DegC
+
+#define SSD_OT_TEMP_HYST	(85) //85 DegC
+#endif
+
+/* fpga temperature */
+//#define CONVERT_TEMP(val)	((float)(val)*503.975f/4096.0f-273.15f)
+#define CONVERT_TEMP(val)	((val)*504/4096-273)
+
+#define MAX_TEMP(val)		CONVERT_TEMP(((val & 0xffff) >> 4))
+#define MIN_TEMP(val)		CONVERT_TEMP((((val>>16) & 0xffff) >> 4))
+#define CUR_TEMP(val)		CONVERT_TEMP((((val>>32) & 0xffff) >> 4))
+
+
+/* CAP monitor */
+#define SSD_PL_CAP_U1				SSD_LM80_REG_IN(SSD_LM80_IN_CAP)
+#define SSD_PL_CAP_U2				SSD_LM80_REG_IN(SSD_LM80_IN_1V8)
+#define SSD_PL_CAP_LEARN(u1, u2, t)	((t*(u1+u2))/(2*162*(u1-u2)))
+#define SSD_PL_CAP_LEARN_WAIT		(20)	//20ms
+#define SSD_PL_CAP_LEARN_MAX_WAIT	(1000/SSD_PL_CAP_LEARN_WAIT)	//1s
+
+#define SSD_PL_CAP_CHARGE_WAIT		(1000)
+#define SSD_PL_CAP_CHARGE_MAX_WAIT	((120*1000)/SSD_PL_CAP_CHARGE_WAIT)	//120s
+
+#define SSD_PL_CAP_VOLT(val)		(val*7)
+
+#define SSD_PL_CAP_VOLT_FULL		(13700)
+#define SSD_PL_CAP_VOLT_READY		(12880)
+
+#define SSD_PL_CAP_THRESHOLD		(8900)
+#define SSD_PL_CAP_CP_THRESHOLD		(5800)
+#define SSD_PL_CAP_THRESHOLD_HYST	(100)
+
+enum ssd_pl_cap_status
+{
+	SSD_PL_CAP = 0, 
+	SSD_PL_CAP_NR
+};
+
+enum ssd_pl_cap_type
+{
+	SSD_PL_CAP_DEFAULT = 0,	/* 4 cap */
+	SSD_PL_CAP_CP	/* 3 cap */
+};
+
+
+/* hwmon offset */
+#define SSD_HWMON_OFFS_TEMP			(0)
+#define SSD_HWMON_OFFS_SENSOR		(SSD_HWMON_OFFS_TEMP + SSD_TEMP_NR)
+#define SSD_HWMON_OFFS_PL_CAP		(SSD_HWMON_OFFS_SENSOR + SSD_SENSOR_NR)
+#define SSD_HWMON_OFFS_LM80			(SSD_HWMON_OFFS_PL_CAP + SSD_PL_CAP_NR)
+#define SSD_HWMON_OFFS_CLOCK		(SSD_HWMON_OFFS_LM80 + SSD_LM80_IN_NR)
+#define SSD_HWMON_OFFS_FPGA 		(SSD_HWMON_OFFS_CLOCK + SSD_CLOCK_NR) 
+
+#define SSD_HWMON_TEMP(idx) 		(SSD_HWMON_OFFS_TEMP + idx)
+#define SSD_HWMON_SENSOR(idx) 		(SSD_HWMON_OFFS_SENSOR + idx)
+#define SSD_HWMON_PL_CAP(idx)		(SSD_HWMON_OFFS_PL_CAP + idx)
+#define SSD_HWMON_LM80(idx)			(SSD_HWMON_OFFS_LM80 + idx)
+#define SSD_HWMON_CLOCK(idx)		(SSD_HWMON_OFFS_CLOCK + idx)
+#define SSD_HWMON_FPGA(ctrl, idx)	(SSD_HWMON_OFFS_FPGA + (ctrl * SSD_FPGA_VOLT_NR) + idx)
+
+
+
+/* fifo */
+typedef struct sfifo
+{
+	uint32_t in;
+	uint32_t out;
+	uint32_t size;
+	uint32_t esize;
+	uint32_t mask;
+	spinlock_t lock;
+	void *data;
+} sfifo_t;
+
+static int sfifo_alloc(struct sfifo *fifo, uint32_t size, uint32_t esize)
+{
+	uint32_t __size = 1;
+
+	if (!fifo || size > INT_MAX || esize == 0) {
+		return -EINVAL;
+	}
+
+	while (__size < size) __size <<= 1;
+
+	if (__size < 2) {
+		return -EINVAL;
+	}
+
+	fifo->data = vmalloc(esize * __size);
+	if (!fifo->data) {
+		return -ENOMEM;
+	}
+
+	fifo->in = 0;
+	fifo->out = 0;
+	fifo->mask = __size - 1;
+	fifo->size = __size;
+	fifo->esize = esize;
+	spin_lock_init(&fifo->lock);
+
+	return 0;
+}
+
+static void sfifo_free(struct sfifo *fifo)
+{
+	if (!fifo) {
+		return;
+	}
+
+	vfree(fifo->data);
+	fifo->data = NULL;
+	fifo->in = 0;
+	fifo->out = 0;
+	fifo->mask = 0;
+	fifo->size = 0;
+	fifo->esize = 0;
+}
+
+static int __sfifo_put(struct sfifo *fifo, void *val)
+{
+	if (((fifo->in + 1) & fifo->mask) == fifo->out) {
+		return -1;
+	}
+
+	memcpy((fifo->data + (fifo->in * fifo->esize)), val, fifo->esize);
+	fifo->in = (fifo->in + 1) & fifo->mask;
+
+	return 0;
+}
+
+static int sfifo_put(struct sfifo *fifo, void *val)
+{
+	int ret = 0;
+
+	if (!fifo || !val) {
+		return -EINVAL;
+	}
+	
+	if (!in_interrupt()) {
+		spin_lock_irq(&fifo->lock);
+		ret = __sfifo_put(fifo, val);
+		spin_unlock_irq(&fifo->lock);
+	} else {
+		spin_lock(&fifo->lock);
+		ret = __sfifo_put(fifo, val);
+		spin_unlock(&fifo->lock);
+	}
+
+	return ret;
+}
+
+static int __sfifo_get(struct sfifo *fifo, void *val)
+{
+	if (fifo->out == fifo->in) {
+		return -1;
+	}
+
+	memcpy(val, (fifo->data + (fifo->out * fifo->esize)), fifo->esize);
+	fifo->out = (fifo->out + 1) & fifo->mask;
+
+	return 0;
+}
+
+static int sfifo_get(struct sfifo *fifo, void *val)
+{
+	int ret = 0;
+
+	if (!fifo || !val) {
+		return -EINVAL;
+	}
+
+	if (!in_interrupt()) {
+		spin_lock_irq(&fifo->lock);
+		ret = __sfifo_get(fifo, val);
+		spin_unlock_irq(&fifo->lock);
+	} else {
+		spin_lock(&fifo->lock);
+		ret = __sfifo_get(fifo, val);
+		spin_unlock(&fifo->lock);
+	}
+
+	return ret;
+}
+
+/* bio list */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
+struct ssd_blist {
+	struct bio *prev;
+	struct bio *next;
+};
+
+static inline void ssd_blist_init(struct ssd_blist *ssd_bl)
+{
+	ssd_bl->prev = NULL;
+	ssd_bl->next = NULL;
+}
+
+static inline struct bio *ssd_blist_get(struct ssd_blist *ssd_bl)
+{
+	struct bio *bio = ssd_bl->prev;
+
+	ssd_bl->prev = NULL;
+	ssd_bl->next = NULL;
+
+	return bio;
+}
+
+static inline void ssd_blist_add(struct ssd_blist *ssd_bl, struct bio *bio)
+{
+	bio->bi_next = NULL;
+
+	if (ssd_bl->next) {
+		ssd_bl->next->bi_next = bio;
+	} else {
+		ssd_bl->prev = bio;
+	}
+
+	ssd_bl->next = bio;
+}
+
+#else
+#define ssd_blist		bio_list
+#define ssd_blist_init	bio_list_init
+#define ssd_blist_get	bio_list_get
+#define ssd_blist_add	bio_list_add
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0))
+#define bio_start(bio)	(bio->bi_sector)
+#else
+#define bio_start(bio)	(bio->bi_iter.bi_sector)
+#endif
+
+/* mutex */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16))
+#define mutex_lock down
+#define mutex_unlock up
+#define mutex semaphore
+#define mutex_init init_MUTEX
+#endif
+
+/* i2c */
+typedef union ssd_i2c_ctrl {
+	uint32_t val;
+	struct {
+		uint8_t wdata;
+		uint8_t addr;
+		uint16_t rw:1;
+		uint16_t pad:15;
+	} bits;
+}__attribute__((packed)) ssd_i2c_ctrl_t;
+
+typedef union ssd_i2c_data {
+	uint32_t val;
+	struct {
+		uint32_t rdata:8;
+		uint32_t valid:1;
+		uint32_t pad:23;
+	} bits;
+}__attribute__((packed)) ssd_i2c_data_t;
+
+/* write mode */
+enum ssd_write_mode
+{
+	SSD_WMODE_BUFFER = 0,
+	SSD_WMODE_BUFFER_EX,
+	SSD_WMODE_FUA,
+	/* dummy */
+	SSD_WMODE_AUTO, 
+	SSD_WMODE_DEFAULT
+};
+
+/* reset type */
+enum ssd_reset_type
+{
+	SSD_RST_NOINIT = 0,
+	SSD_RST_NORMAL,
+	SSD_RST_FULL
+};
+
+/* ssd msg */
+typedef struct ssd_sg_entry
+{
+	uint64_t block:48;
+	uint64_t length:16;
+	uint64_t buf;
+}__attribute__((packed))ssd_sg_entry_t;
+
+typedef struct ssd_rw_msg
+{
+	uint8_t tag;
+	uint8_t flag;
+	uint8_t nsegs;
+	uint8_t fun;
+	uint32_t reserved;	//for 64-bit align
+	struct ssd_sg_entry sge[1]; //base
+}__attribute__((packed))ssd_rw_msg_t;
+
+typedef struct ssd_resp_msg
+{
+	uint8_t tag;
+	uint8_t status:2;
+	uint8_t bitflip:6;
+	uint8_t log;
+	uint8_t fun;
+	uint32_t reserved;
+}__attribute__((packed))ssd_resp_msg_t;
+
+typedef struct ssd_flush_msg
+{
+	uint8_t tag;
+	uint8_t flag:2;	//flash cache 0 or bbt 1
+	uint8_t flash:6;
+	uint8_t ctrl_idx;
+	uint8_t fun;
+	uint32_t reserved;	//align
+}__attribute__((packed))ssd_flush_msg_t;
+
+typedef struct ssd_nand_op_msg
+{
+	uint8_t tag;
+	uint8_t flag;
+	uint8_t ctrl_idx;
+	uint8_t fun;
+	uint32_t reserved;	//align
+	uint16_t page_count;
+	uint8_t chip_ce;
+	uint8_t chip_no;
+	uint32_t page_no;
+	uint64_t buf;
+}__attribute__((packed))ssd_nand_op_msg_t;
+
+typedef struct ssd_ram_op_msg
+{
+	uint8_t tag;
+	uint8_t flag;
+	uint8_t ctrl_idx;
+	uint8_t fun;
+	uint32_t reserved;	//align
+	uint32_t start;
+	uint32_t length;
+	uint64_t buf;
+}__attribute__((packed))ssd_ram_op_msg_t;
+
+
+/* log msg */
+typedef struct ssd_log_msg
+{
+	uint8_t tag;
+	uint8_t flag;
+	uint8_t ctrl_idx;
+	uint8_t fun;
+	uint32_t reserved;	//align
+	uint64_t buf;
+}__attribute__((packed))ssd_log_msg_t;
+
+typedef struct ssd_log_op_msg
+{
+	uint8_t tag;
+	uint8_t flag;
+	uint8_t ctrl_idx;
+	uint8_t fun;
+	uint32_t reserved;	//align
+	uint64_t reserved1;	//align
+	uint64_t buf;
+}__attribute__((packed))ssd_log_op_msg_t;
+
+typedef struct ssd_log_resp_msg
+{
+	uint8_t tag;
+	uint16_t status :2;
+	uint16_t reserved1 :2;	//align with the normal resp msg
+	uint16_t nr_log :12;
+	uint8_t fun;
+	uint32_t reserved;
+}__attribute__((packed))ssd_log_resp_msg_t;
+
+
+/* resp msg */
+typedef union ssd_response_msq
+{
+	ssd_resp_msg_t resp_msg;
+	ssd_log_resp_msg_t log_resp_msg;
+	uint64_t u64_msg;
+	uint32_t u32_msg[2];
+} ssd_response_msq_t;
+
+
+/* custom struct */
+typedef struct ssd_protocol_info
+{
+	uint32_t ver;
+	uint32_t init_state_reg;
+	uint32_t init_state_reg_sz;
+	uint32_t chip_info_reg;
+	uint32_t chip_info_reg_sz;
+} ssd_protocol_info_t;
+
+typedef struct ssd_hw_info
+{
+	uint32_t bridge_ver;
+	uint32_t ctrl_ver;
+
+	uint32_t cmd_fifo_sz;
+	uint32_t cmd_fifo_sz_mask;
+	uint32_t cmd_max_sg;
+	uint32_t sg_max_sec;
+	uint32_t resp_ptr_sz;
+	uint32_t resp_msg_sz;
+
+	uint16_t nr_ctrl;
+
+	uint16_t nr_data_ch;
+	uint16_t nr_ch;
+	uint16_t max_ch;
+	uint16_t nr_chip;
+
+	uint8_t  pcb_ver;
+	uint8_t  upper_pcb_ver;
+
+	uint8_t  nand_vendor_id;
+	uint8_t  nand_dev_id;
+
+	uint8_t  max_ce;
+	uint8_t  id_size;
+	uint16_t oob_size;
+
+	uint16_t bbf_pages;
+	uint16_t bbf_seek;	//
+
+	uint16_t page_count;	//per block
+	uint32_t page_size;
+	uint32_t block_count;	//per flash
+
+	uint64_t ram_size;
+	uint32_t ram_align;
+	uint32_t ram_max_len;
+
+	uint64_t bbt_base;
+	uint32_t bbt_size;
+	uint64_t md_base; //metadata
+	uint32_t md_size;
+	uint32_t md_entry_sz;
+
+	uint32_t log_sz;
+
+	uint64_t nand_wbuff_base;
+
+	uint32_t md_reserved_blks;
+	uint32_t reserved_blks;
+	uint32_t valid_pages;
+	uint32_t max_valid_pages;
+	uint64_t size;
+} ssd_hw_info_t;
+
+typedef struct ssd_hw_info_extend
+{
+	uint8_t board_type;
+	uint8_t cap_type;
+	uint8_t plp_type;
+	uint8_t work_mode;
+	uint8_t form_factor;
+
+	uint8_t pad[59];
+}ssd_hw_info_extend_t;
+
+typedef struct ssd_rom_info
+{
+	uint32_t size;
+	uint32_t block_size;
+	uint16_t page_size;
+	uint8_t  nr_bridge_fw;
+	uint8_t  nr_ctrl_fw;
+	uint8_t  nr_bm_fw;
+	uint8_t  nr_smart;
+	uint32_t bridge_fw_base;
+	uint32_t bridge_fw_sz;
+	uint32_t ctrl_fw_base;
+	uint32_t ctrl_fw_sz;
+	uint32_t bm_fw_base;
+	uint32_t bm_fw_sz;
+	uint32_t log_base;
+	uint32_t log_sz;
+	uint32_t smart_base;
+	uint32_t smart_sz;
+	uint32_t vp_base;
+	uint32_t label_base;
+} ssd_rom_info_t;
+
+/* debug info */
+enum ssd_debug_type
+{
+	SSD_DEBUG_NONE = 0, 
+	SSD_DEBUG_READ_ERR, 
+	SSD_DEBUG_WRITE_ERR, 
+	SSD_DEBUG_RW_ERR, 
+	SSD_DEBUG_READ_TO, 
+	SSD_DEBUG_WRITE_TO, 
+	SSD_DEBUG_RW_TO, 
+	SSD_DEBUG_LOG, 
+	SSD_DEBUG_OFFLINE, 
+	SSD_DEBUG_NR
+};
+
+typedef struct ssd_debug_info
+{
+	int type;
+	union {
+		struct {
+			uint64_t off;
+			uint32_t len;
+		} loc;
+		struct {
+			int event;
+			uint32_t extra;
+		} log;
+	} data;
+}ssd_debug_info_t;
+
+/* label */
+#define SSD_LABEL_FIELD_SZ	32
+#define SSD_SN_SZ			16
+
+typedef struct ssd_label
+{
+	char date[SSD_LABEL_FIELD_SZ];
+	char sn[SSD_LABEL_FIELD_SZ];
+	char part[SSD_LABEL_FIELD_SZ];
+	char desc[SSD_LABEL_FIELD_SZ];
+	char other[SSD_LABEL_FIELD_SZ];
+	char maf[SSD_LABEL_FIELD_SZ];
+} ssd_label_t;
+
+#define SSD_LABEL_DESC_SZ	256
+
+typedef struct ssd_labelv3
+{
+	char boardtype[SSD_LABEL_FIELD_SZ];
+	char barcode[SSD_LABEL_FIELD_SZ];
+	char item[SSD_LABEL_FIELD_SZ];
+	char description[SSD_LABEL_DESC_SZ];
+	char manufactured[SSD_LABEL_FIELD_SZ];
+	char vendorname[SSD_LABEL_FIELD_SZ];
+	char issuenumber[SSD_LABEL_FIELD_SZ];
+	char cleicode[SSD_LABEL_FIELD_SZ];
+	char bom[SSD_LABEL_FIELD_SZ];
+} ssd_labelv3_t;
+
+/* battery */
+typedef struct ssd_battery_info
+{
+	uint32_t fw_ver;
+} ssd_battery_info_t;
+
+/* ssd power stat */
+typedef struct ssd_power_stat
+{
+	uint64_t nr_poweron;
+	uint64_t nr_powerloss;
+	uint64_t init_failed;
+} ssd_power_stat_t;
+
+/* io stat */
+typedef struct ssd_io_stat
+{
+	uint64_t run_time;
+	uint64_t nr_to;
+	uint64_t nr_ioerr;
+	uint64_t nr_rwerr;
+	uint64_t nr_read;
+	uint64_t nr_write;
+	uint64_t rsectors;
+	uint64_t wsectors;
+} ssd_io_stat_t;
+
+/* ecc */
+typedef struct ssd_ecc_info
+{
+	uint64_t bitflip[SSD_ECC_MAX_FLIP];
+} ssd_ecc_info_t;
+
+/* log */
+enum ssd_log_level
+{
+	SSD_LOG_LEVEL_INFO = 0,
+	SSD_LOG_LEVEL_NOTICE,
+	SSD_LOG_LEVEL_WARNING,
+	SSD_LOG_LEVEL_ERR,
+	SSD_LOG_NR_LEVEL
+};
+
+typedef struct ssd_log_info
+{
+	uint64_t nr_log;
+	uint64_t stat[SSD_LOG_NR_LEVEL];
+} ssd_log_info_t;
+
+/* S.M.A.R.T. */
+#define SSD_SMART_MAGIC	(0x5452414D53445353ull)
+
+typedef struct ssd_smart
+{
+	struct ssd_power_stat pstat;
+	struct ssd_io_stat io_stat;
+	struct ssd_ecc_info ecc_info;
+	struct ssd_log_info log_info;
+	uint64_t version;
+	uint64_t magic;
+} ssd_smart_t;
+
+/* internal log */
+typedef struct ssd_internal_log
+{
+	uint32_t nr_log;
+	void *log;
+} ssd_internal_log_t;
+
+/* ssd cmd */
+typedef struct ssd_cmd
+{
+	struct bio *bio;
+	struct scatterlist *sgl;
+	struct list_head list;
+	void *dev;
+	int nsegs;
+	int flag;		/*pbio(1) or bio(0)*/
+
+	int tag;
+	void *msg;
+	dma_addr_t msg_dma;
+
+	unsigned long start_time;
+
+	int errors;
+	unsigned int nr_log;
+
+	struct timer_list cmd_timer;
+	struct completion *waiting;
+} ssd_cmd_t;
+
+typedef void (*send_cmd_func)(struct ssd_cmd *);
+typedef int (*ssd_event_call)(struct gendisk *, int, int);	/* gendisk, event id, event level */
+
+/* dcmd sz */
+#define SSD_DCMD_MAX_SZ 32
+
+typedef struct ssd_dcmd
+{
+	struct list_head list;
+	void *dev;
+	uint8_t msg[SSD_DCMD_MAX_SZ];
+} ssd_dcmd_t;
+
+
+enum ssd_state {
+	SSD_INIT_WORKQ, 
+	SSD_INIT_BD, 
+	SSD_ONLINE, 
+	/* full reset */
+	SSD_RESETING, 
+	/* hw log */
+	SSD_LOG_HW, 
+	/* log err */
+	SSD_LOG_ERR
+};
+
+#define SSD_QUEUE_NAME_LEN	16
+typedef struct ssd_queue {
+	char name[SSD_QUEUE_NAME_LEN];
+	void *dev;
+
+	int idx;
+
+	uint32_t resp_idx;
+	uint32_t resp_idx_mask;
+	uint32_t resp_msg_sz;
+
+	void *resp_msg;
+	void *resp_ptr;
+
+	struct ssd_cmd *cmd;
+
+	struct ssd_io_stat io_stat;
+	struct ssd_ecc_info ecc_info;
+} ssd_queue_t;
+
+typedef struct ssd_device {
+	char name[SSD_DEV_NAME_LEN];
+
+	int idx;
+	int major;
+	int readonly;
+
+	int int_mode;
+#ifdef SSD_ESCAPE_IRQ
+	int irq_cpu;
+#endif
+
+	int reload_fw;
+
+	int ot_delay; //in ms
+
+	atomic_t refcnt;
+	atomic_t tocnt;
+	atomic_t in_flight[2]; //r&w
+
+	uint64_t uptime;
+
+	struct list_head list;
+	struct pci_dev *pdev;
+
+	unsigned long mmio_base;
+	unsigned long mmio_len;
+	void __iomem *ctrlp;
+
+	struct mutex spi_mutex;
+	struct mutex i2c_mutex;
+
+	struct ssd_protocol_info protocol_info;
+	struct ssd_hw_info hw_info;
+	struct ssd_rom_info rom_info;
+	struct ssd_label label;
+
+	struct ssd_smart smart;
+
+	atomic_t in_sendq;
+	spinlock_t sendq_lock;
+	struct ssd_blist sendq;
+	struct task_struct *send_thread;
+	wait_queue_head_t send_waitq;
+
+	atomic_t in_doneq;
+	spinlock_t doneq_lock;
+	struct ssd_blist doneq;
+	struct task_struct *done_thread;
+	wait_queue_head_t done_waitq;
+
+	struct ssd_dcmd *dcmd;
+	spinlock_t dcmd_lock;
+	struct list_head dcmd_list; /* direct cmd list */
+	wait_queue_head_t dcmd_wq;
+
+	unsigned long *tag_map;
+	wait_queue_head_t tag_wq;
+
+	spinlock_t cmd_lock;
+	struct ssd_cmd *cmd;
+	send_cmd_func scmd;
+
+	ssd_event_call event_call;
+	void *msg_base;
+	dma_addr_t msg_base_dma;
+
+	uint32_t resp_idx;
+	void *resp_msg_base;
+	void *resp_ptr_base;
+	dma_addr_t resp_msg_base_dma;
+	dma_addr_t resp_ptr_base_dma;
+
+	int nr_queue;
+	struct msix_entry entry[SSD_MSIX_VEC];
+	struct ssd_queue queue[SSD_MSIX_VEC];
+
+	struct request_queue *rq; /* The device request queue */
+	struct gendisk *gd; /* The gendisk structure */
+
+	struct mutex internal_log_mutex;
+	struct ssd_internal_log internal_log;
+	struct workqueue_struct *workq;
+	struct work_struct log_work; /* get log */
+	void *log_buf;
+
+	unsigned long state; /* device state, for example, block device inited */
+
+	struct module *owner;
+
+	/* extend */
+
+	int slave;
+	int cmajor;
+	int save_md;
+	int ot_protect;
+
+	struct kref kref;
+
+	struct mutex gd_mutex;
+	struct ssd_log_info log_info; /* volatile */
+
+	atomic_t queue_depth;
+	struct mutex barrier_mutex;
+	struct mutex fw_mutex;
+
+	struct ssd_hw_info_extend hw_info_ext;
+	struct ssd_labelv3 labelv3;
+
+	int wmode;
+	int user_wmode;
+	struct mutex bm_mutex;
+	struct work_struct bm_work; /* check bm */
+	struct timer_list bm_timer;
+	struct sfifo log_fifo;
+
+	struct timer_list routine_timer;
+	unsigned long routine_tick;
+	unsigned long hwmon;
+
+	struct work_struct hwmon_work; /* check hw */
+	struct work_struct capmon_work; /* check battery */
+	struct work_struct tempmon_work; /* check temp */
+
+	/* debug info */
+	struct ssd_debug_info db_info;
+} ssd_device_t;
+
+
+/* Ioctl struct */
+typedef struct ssd_acc_info {
+	uint32_t threshold_l1;
+	uint32_t threshold_l2;
+	uint32_t val;
+} ssd_acc_info_t;
+
+typedef struct ssd_reg_op_info
+{
+	uint32_t offset;
+	uint32_t value;
+} ssd_reg_op_info_t;
+
+typedef struct ssd_spi_op_info
+{
+	void __user *buf;
+	uint32_t off;
+	uint32_t len;
+} ssd_spi_op_info_t;
+
+typedef struct ssd_i2c_op_info
+{
+	uint8_t saddr;
+	uint8_t wsize;
+	uint8_t rsize;
+	void __user *wbuf;
+	void __user *rbuf;
+} ssd_i2c_op_info_t;
+
+typedef struct ssd_smbus_op_info
+{
+	uint8_t saddr;
+	uint8_t cmd;
+	uint8_t size;
+	void __user *buf;
+} ssd_smbus_op_info_t;
+
+typedef struct ssd_ram_op_info {
+	uint8_t ctrl_idx;
+	uint32_t length;
+	uint64_t start;
+	uint8_t __user *buf;
+} ssd_ram_op_info_t;
+
+typedef struct ssd_flash_op_info {
+	uint32_t page;
+	uint16_t flash;
+	uint8_t chip;
+	uint8_t ctrl_idx;
+	uint8_t __user *buf;
+} ssd_flash_op_info_t;
+
+typedef struct ssd_sw_log_info {
+	uint16_t event;
+	uint16_t pad;
+	uint32_t data;
+} ssd_sw_log_info_t;
+
+typedef struct ssd_version_info
+{
+	uint32_t bridge_ver;	/* bridge fw version */
+	uint32_t ctrl_ver;		/* controller fw version */
+	uint32_t bm_ver;		/* battery manager fw version */
+	uint8_t  pcb_ver;		/* main pcb version */
+	uint8_t  upper_pcb_ver;
+	uint8_t  pad0;
+	uint8_t  pad1;
+} ssd_version_info_t;
+
+typedef struct pci_addr
+{
+	uint16_t domain;
+	uint8_t bus;
+	uint8_t slot;
+	uint8_t func;
+} pci_addr_t;
+
+typedef struct ssd_drv_param_info {
+	int mode;
+	int status_mask;
+	int int_mode;
+	int threaded_irq;
+	int log_level;
+	int wmode;
+	int ot_protect;
+	int finject;
+	int pad[8];
+} ssd_drv_param_info_t;
+
+
+/* form factor */
+enum ssd_form_factor
+{
+	SSD_FORM_FACTOR_HHHL = 0, 
+	SSD_FORM_FACTOR_FHHL
+};
+
+
+/* ssd power loss protect */
+enum ssd_plp_type
+{
+	SSD_PLP_SCAP = 0,
+	SSD_PLP_CAP,
+	SSD_PLP_NONE
+};
+
+/* ssd bm */
+#define SSD_BM_SLAVE_ADDRESS	0x16
+#define SSD_BM_CAP	5
+
+/* SBS cmd */
+#define SSD_BM_SAFETYSTATUS			0x51
+#define SSD_BM_OPERATIONSTATUS		0x54
+
+/* ManufacturerAccess */
+#define SSD_BM_MANUFACTURERACCESS	0x00		
+#define SSD_BM_ENTER_CAP_LEARNING	0x0023		/* cap learning */
+
+/* Data flash access */
+#define SSD_BM_DATA_FLASH_SUBCLASS_ID 0x77
+#define SSD_BM_DATA_FLASH_SUBCLASS_ID_PAGE1 0x78
+#define SSD_BM_SYSTEM_DATA_SUBCLASS_ID	56
+#define SSD_BM_CONFIGURATION_REGISTERS_ID	64
+
+/* min cap voltage */
+#define SSD_BM_CAP_VOLT_MIN			500
+
+/*
+enum ssd_bm_cap
+{
+	SSD_BM_CAP_VINA = 1, 
+	SSD_BM_CAP_JH = 3
+};*/
+
+enum ssd_bmstatus
+{
+	SSD_BMSTATUS_OK = 0,
+	SSD_BMSTATUS_CHARGING, 		/* not fully charged */
+	SSD_BMSTATUS_WARNING
+};
+
+enum sbs_unit {
+	SBS_UNIT_VALUE = 0,
+	SBS_UNIT_TEMPERATURE,
+	SBS_UNIT_VOLTAGE,
+	SBS_UNIT_CURRENT,
+	SBS_UNIT_ESR,
+	SBS_UNIT_PERCENT,
+	SBS_UNIT_CAPACITANCE
+};
+
+enum sbs_size {
+	SBS_SIZE_BYTE = 1,
+	SBS_SIZE_WORD,
+	SBS_SIZE_BLK,
+};
+
+struct sbs_cmd {
+	uint8_t cmd;
+	uint8_t size;
+	uint8_t unit;
+	uint8_t off;
+	uint16_t mask;
+	char *desc;
+};
+
+struct ssd_bm {
+	uint16_t temp;
+	uint16_t volt;
+	uint16_t curr;
+	uint16_t esr;
+	uint16_t rsoc;
+	uint16_t health;
+	uint16_t cap;
+	uint16_t chg_curr;
+	uint16_t chg_volt;
+	uint16_t cap_volt[SSD_BM_CAP];
+	uint16_t sf_alert;
+	uint16_t sf_status;
+	uint16_t op_status;
+	uint16_t sys_volt;
+};
+
+struct ssd_bm_manufacturer_data
+{
+	uint16_t pack_lot_code;
+	uint16_t pcb_lot_code;
+	uint16_t firmware_ver;
+	uint16_t hardware_ver;
+};
+
+struct ssd_bm_configuration_registers
+{
+	struct {
+		uint16_t cc:3;
+		uint16_t rsvd:5;
+		uint16_t stack:1;
+		uint16_t rsvd1:2;
+		uint16_t temp:2;
+		uint16_t rsvd2:1;
+		uint16_t lt_en:1;
+		uint16_t rsvd3:1;
+	} operation_cfg;
+	uint16_t pad;
+	uint16_t fet_action;
+	uint16_t pad1;
+	uint16_t fault;
+};
+
+#define SBS_VALUE_MASK	0xffff
+
+#define bm_var_offset(var)	((size_t) &((struct ssd_bm *)0)->var)
+#define bm_var(start, offset)	((void *) start + (offset))
+
+static struct sbs_cmd ssd_bm_sbs[] = {
+	{0x08, SBS_SIZE_WORD, SBS_UNIT_TEMPERATURE, bm_var_offset(temp), SBS_VALUE_MASK, "Temperature"}, 
+	{0x09, SBS_SIZE_WORD, SBS_UNIT_VOLTAGE, bm_var_offset(volt), SBS_VALUE_MASK, "Voltage"}, 
+	{0x0a, SBS_SIZE_WORD, SBS_UNIT_CURRENT, bm_var_offset(curr), SBS_VALUE_MASK, "Current"}, 
+	{0x0b, SBS_SIZE_WORD, SBS_UNIT_ESR, bm_var_offset(esr), SBS_VALUE_MASK, "ESR"}, 
+	{0x0d, SBS_SIZE_BYTE, SBS_UNIT_PERCENT, bm_var_offset(rsoc), SBS_VALUE_MASK, "RelativeStateOfCharge"}, 
+	{0x0e, SBS_SIZE_BYTE, SBS_UNIT_PERCENT, bm_var_offset(health), SBS_VALUE_MASK, "Health"}, 
+	{0x10, SBS_SIZE_WORD, SBS_UNIT_CAPACITANCE, bm_var_offset(cap), SBS_VALUE_MASK, "Capacitance"}, 
+	{0x14, SBS_SIZE_WORD, SBS_UNIT_CURRENT, bm_var_offset(chg_curr), SBS_VALUE_MASK, "ChargingCurrent"}, 
+	{0x15, SBS_SIZE_WORD, SBS_UNIT_VOLTAGE, bm_var_offset(chg_volt), SBS_VALUE_MASK, "ChargingVoltage"}, 
+	{0x3b, SBS_SIZE_WORD, SBS_UNIT_VOLTAGE, (uint8_t)bm_var_offset(cap_volt[4]), SBS_VALUE_MASK, "CapacitorVoltage5"}, 
+	{0x3c, SBS_SIZE_WORD, SBS_UNIT_VOLTAGE, (uint8_t)bm_var_offset(cap_volt[3]), SBS_VALUE_MASK, "CapacitorVoltage4"}, 
+	{0x3d, SBS_SIZE_WORD, SBS_UNIT_VOLTAGE, (uint8_t)bm_var_offset(cap_volt[2]), SBS_VALUE_MASK, "CapacitorVoltage3"}, 
+	{0x3e, SBS_SIZE_WORD, SBS_UNIT_VOLTAGE, (uint8_t)bm_var_offset(cap_volt[1]), SBS_VALUE_MASK, "CapacitorVoltage2"}, 
+	{0x3f, SBS_SIZE_WORD, SBS_UNIT_VOLTAGE, (uint8_t)bm_var_offset(cap_volt[0]), SBS_VALUE_MASK, "CapacitorVoltage1"}, 
+	{0x50, SBS_SIZE_WORD, SBS_UNIT_VALUE, bm_var_offset(sf_alert), 0x870F, "SafetyAlert"}, 
+	{0x51, SBS_SIZE_WORD, SBS_UNIT_VALUE, bm_var_offset(sf_status), 0xE7BF, "SafetyStatus"}, 
+	{0x54, SBS_SIZE_WORD, SBS_UNIT_VALUE, bm_var_offset(op_status), 0x79F4, "OperationStatus"}, 
+	{0x5a, SBS_SIZE_WORD, SBS_UNIT_VOLTAGE, bm_var_offset(sys_volt), SBS_VALUE_MASK, "SystemVoltage"}, 
+	{0, 0, 0, 0, 0, NULL}, 
+};
+
+/* ssd ioctl  */
+#define SSD_CMD_GET_PROTOCOL_INFO	_IOR('H', 100, struct ssd_protocol_info)
+#define SSD_CMD_GET_HW_INFO			_IOR('H', 101, struct ssd_hw_info)
+#define SSD_CMD_GET_ROM_INFO		_IOR('H', 102, struct ssd_rom_info)
+#define SSD_CMD_GET_SMART			_IOR('H', 103, struct ssd_smart)
+#define SSD_CMD_GET_IDX				_IOR('H', 105, int)
+#define SSD_CMD_GET_AMOUNT			_IOR('H', 106, int)
+#define SSD_CMD_GET_TO_INFO			_IOR('H', 107, int)
+#define SSD_CMD_GET_DRV_VER			_IOR('H', 108, char[DRIVER_VERSION_LEN])
+
+#define SSD_CMD_GET_BBACC_INFO		_IOR('H', 109, struct ssd_acc_info)
+#define SSD_CMD_GET_ECACC_INFO		_IOR('H', 110, struct ssd_acc_info)
+
+#define SSD_CMD_GET_HW_INFO_EXT		_IOR('H', 111, struct ssd_hw_info_extend)
+
+#define SSD_CMD_REG_READ			_IOWR('H', 120, struct ssd_reg_op_info)
+#define SSD_CMD_REG_WRITE			_IOWR('H', 121, struct ssd_reg_op_info)
+
+#define SSD_CMD_SPI_READ			_IOWR('H', 125, struct ssd_spi_op_info)
+#define SSD_CMD_SPI_WRITE			_IOWR('H', 126, struct ssd_spi_op_info)
+#define SSD_CMD_SPI_ERASE			_IOWR('H', 127, struct ssd_spi_op_info)
+
+#define SSD_CMD_I2C_READ			_IOWR('H', 128, struct ssd_i2c_op_info)
+#define SSD_CMD_I2C_WRITE			_IOWR('H', 129, struct ssd_i2c_op_info)
+#define SSD_CMD_I2C_WRITE_READ		_IOWR('H', 130, struct ssd_i2c_op_info)
+
+#define SSD_CMD_SMBUS_SEND_BYTE		_IOWR('H', 131, struct ssd_smbus_op_info)
+#define SSD_CMD_SMBUS_RECEIVE_BYTE	_IOWR('H', 132, struct ssd_smbus_op_info)
+#define SSD_CMD_SMBUS_WRITE_BYTE	_IOWR('H', 133, struct ssd_smbus_op_info)
+#define SSD_CMD_SMBUS_READ_BYTE		_IOWR('H', 135, struct ssd_smbus_op_info)
+#define SSD_CMD_SMBUS_WRITE_WORD	_IOWR('H', 136, struct ssd_smbus_op_info)
+#define SSD_CMD_SMBUS_READ_WORD		_IOWR('H', 137, struct ssd_smbus_op_info)
+#define SSD_CMD_SMBUS_WRITE_BLOCK	_IOWR('H', 138, struct ssd_smbus_op_info)
+#define SSD_CMD_SMBUS_READ_BLOCK	_IOWR('H', 139, struct ssd_smbus_op_info)
+
+#define SSD_CMD_BM_GET_VER			_IOR('H', 140, uint16_t)
+#define SSD_CMD_BM_GET_NR_CAP		_IOR('H', 141, int)
+#define SSD_CMD_BM_CAP_LEARNING		_IOW('H', 142, int)
+#define SSD_CMD_CAP_LEARN			_IOR('H', 143, uint32_t)
+#define SSD_CMD_GET_CAP_STATUS		_IOR('H', 144, int)
+
+#define SSD_CMD_RAM_READ			_IOWR('H', 150, struct ssd_ram_op_info)
+#define SSD_CMD_RAM_WRITE			_IOWR('H', 151, struct ssd_ram_op_info)
+
+#define SSD_CMD_NAND_READ_ID		_IOR('H', 160, struct ssd_flash_op_info)
+#define SSD_CMD_NAND_READ			_IOWR('H', 161, struct ssd_flash_op_info) //with oob
+#define SSD_CMD_NAND_WRITE			_IOWR('H', 162, struct ssd_flash_op_info)
+#define SSD_CMD_NAND_ERASE			_IOWR('H', 163, struct ssd_flash_op_info)
+#define SSD_CMD_NAND_READ_EXT		_IOWR('H', 164, struct ssd_flash_op_info) //ingore EIO
+
+#define SSD_CMD_UPDATE_BBT			_IOW('H', 180, struct ssd_flash_op_info)
+
+#define SSD_CMD_CLEAR_ALARM			_IOW('H', 190, int)
+#define SSD_CMD_SET_ALARM			_IOW('H', 191, int)
+
+#define SSD_CMD_RESET				_IOW('H', 200, int)
+#define SSD_CMD_RELOAD_FW			_IOW('H', 201, int)
+#define SSD_CMD_UNLOAD_DEV			_IOW('H', 202, int)
+#define SSD_CMD_LOAD_DEV			_IOW('H', 203, int)
+#define SSD_CMD_UPDATE_VP			_IOWR('H', 205, uint32_t)
+#define SSD_CMD_FULL_RESET			_IOW('H', 206, int)
+
+#define SSD_CMD_GET_NR_LOG			_IOR('H', 220, uint32_t)
+#define SSD_CMD_GET_LOG				_IOR('H', 221, void *)
+#define SSD_CMD_LOG_LEVEL			_IOW('H', 222, int)
+
+#define SSD_CMD_OT_PROTECT			_IOW('H', 223, int)
+#define SSD_CMD_GET_OT_STATUS		_IOR('H', 224, int)
+
+#define SSD_CMD_CLEAR_LOG			_IOW('H', 230, int)
+#define SSD_CMD_CLEAR_SMART			_IOW('H', 231, int)
+
+#define SSD_CMD_SW_LOG				_IOW('H', 232, struct ssd_sw_log_info)
+
+#define SSD_CMD_GET_LABEL			_IOR('H', 235, struct ssd_label)
+#define SSD_CMD_GET_VERSION			_IOR('H', 236, struct ssd_version_info)
+#define SSD_CMD_GET_TEMPERATURE		_IOR('H', 237, int)
+#define SSD_CMD_GET_BMSTATUS		_IOR('H', 238, int)
+#define SSD_CMD_GET_LABEL2			_IOR('H', 239, void *)
+
+
+#define SSD_CMD_FLUSH				_IOW('H', 240, int)
+#define SSD_CMD_SAVE_MD				_IOW('H', 241, int)
+
+#define SSD_CMD_SET_WMODE			_IOW('H', 242, int)
+#define SSD_CMD_GET_WMODE			_IOR('H', 243, int)
+#define SSD_CMD_GET_USER_WMODE		_IOR('H', 244, int)
+
+#define SSD_CMD_DEBUG				_IOW('H', 250, struct ssd_debug_info)
+#define SSD_CMD_DRV_PARAM_INFO		_IOR('H', 251, struct ssd_drv_param_info)
+
+
+/* log */
+#define SSD_LOG_MAX_SZ				4096
+#define SSD_LOG_LEVEL				SSD_LOG_LEVEL_NOTICE
+
+enum ssd_log_data
+{
+	SSD_LOG_DATA_NONE = 0,
+	SSD_LOG_DATA_LOC, 
+	SSD_LOG_DATA_HEX
+};
+
+typedef struct ssd_log_entry
+{
+	union {
+		struct {
+			uint32_t page:10;
+			uint32_t block:14;
+			uint32_t flash:8;
+		} loc;
+		struct {
+			uint32_t page:12;
+			uint32_t block:12;
+			uint32_t flash:8;
+		} loc1;
+		uint32_t val;
+	} data;
+	uint16_t event:10;
+	uint16_t mod:6;
+	uint16_t idx;
+}__attribute__((packed))ssd_log_entry_t;
+
+typedef struct ssd_log
+{
+	uint64_t time:56;
+	uint64_t ctrl_idx:8;
+	ssd_log_entry_t le;
+} __attribute__((packed)) ssd_log_t;
+
+typedef struct ssd_log_desc
+{
+	uint16_t event;
+	uint8_t level;
+	uint8_t data;
+	uint8_t sblock;
+	uint8_t spage;
+	char *desc;
+} __attribute__((packed)) ssd_log_desc_t;
+
+#define SSD_LOG_SW_IDX		0xF
+#define SSD_UNKNOWN_EVENT	((uint16_t)-1)
+static struct ssd_log_desc ssd_log_desc[] = {
+	/* event, level, show flash, show block, show page, desc */
+	{0x0,  SSD_LOG_LEVEL_WARNING, SSD_LOG_DATA_LOC,  0, 0, "Create BBT failure"}, //g3
+	{0x1,  SSD_LOG_LEVEL_WARNING, SSD_LOG_DATA_LOC,  0, 0, "Read BBT failure"}, //g3
+	{0x2,  SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "Mark bad block"}, 
+	{0x3,  SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  0, 0, "Flush BBT failure"}, 
+	{0x4,  SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Program failure"}, 
+	{0x7,  SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "No available blocks"}, 
+	{0x8,  SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "Bad EC header"}, 
+	{0x9,  SSD_LOG_LEVEL_WARNING, SSD_LOG_DATA_LOC,  1, 0, "Bad VID header"}, //g3
+	{0xa,  SSD_LOG_LEVEL_INFO,    SSD_LOG_DATA_LOC,  1, 0, "Wear leveling"}, 
+	{0xb,  SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "WL read back failure"}, 
+	{0x11, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "Data recovery failure"}, // err
+	{0x20, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "Init: scan mapping table failure"}, // err g3
+	{0x21, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Program failure"}, 
+	{0x22, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Program failure"}, 
+	{0x23, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Program failure"}, 
+	{0x24, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "Merge: read mapping page failure"}, 
+	{0x25, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Merge: read back failure"}, 
+	{0x26, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Program failure"}, 
+	{0x27, SSD_LOG_LEVEL_WARNING, SSD_LOG_DATA_LOC,  1, 1, "Data corrupted for abnormal power down"}, //g3
+	{0x28, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Merge: mapping page corrupted"}, 
+	{0x29, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "Init: no mapping page"}, 
+	{0x2a, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: mapping pages incomplete"}, 
+	{0x2b, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "Read back failure after programming failure"}, // err
+	{0xf1, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "Read failure without recovery"}, // err
+	{0xf2, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  0, 0, "No available blocks"}, // maybe err g3
+	{0xf3, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 0, "Init: RAID incomplete"}, // err g3
+	{0xf4, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Program failure"}, 
+	{0xf5, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Read failure in moving data"}, 
+	{0xf6, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Program failure"}, 
+	{0xf7, SSD_LOG_LEVEL_WARNING, SSD_LOG_DATA_LOC,  1, 1, "Init: RAID not complete"}, 
+	{0xf8, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "Init: data moving interrupted"}, 
+	{0xfe, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  0, 0, "Data inspection failure"}, 
+	{0xff, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "IO: ECC failed"}, 
+
+	/* new */
+	{0x2e, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  0, 0, "No available reserved blocks" }, // err
+	{0x30, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  0, 0, "Init: PMT membership not found"}, 
+	{0x31, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_HEX,  0, 0, "Init: PMT corrupted"}, 
+	{0x32, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  0, 0, "Init: PBT membership not found"}, 
+	{0x33, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  0, 0, "Init: PBT not found"}, 
+	{0x34, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  0, 0, "Init: PBT corrupted"}, 
+	{0x35, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: PMT page read failure"}, 
+	{0x36, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: PBT page read failure"}, 
+	{0x37, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: PBT backup page read failure"}, 
+	{0x38, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: PBMT read failure"}, 
+	{0x39, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "Init: PBMT scan failure"}, // err
+	{0x3a, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: first page read failure"}, 
+	{0x3b, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "Init: first page scan failure"}, // err
+	{0x3c, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "Init: scan unclosed block failure"}, // err
+	{0x3d, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: write pointer mismatch"}, 
+	{0x3e, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: PMT recovery: PBMT read failure"}, 
+	{0x3f, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "Init: PMT recovery: PBMT scan failure"}, 
+	{0x40, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "Init: PMT recovery: data page read failure"}, //err
+	{0x41, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: PBT write pointer mismatch"}, 
+	{0x42, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: PBT latest version corrupted"}, 
+	{0x43, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 0, "Init: too many unclosed blocks"}, 
+	{0x44, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_HEX,  0, 0, "Init: PDW block found"}, 
+	{0x45, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_HEX,  0, 0, "Init: more than one PDW block found"}, //err
+	{0x46, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Init: first page is blank or read failure"}, 
+	{0x47, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  0, 0, "Init: PDW block not found"}, 
+
+	{0x50, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 0, "Cache: hit error data"}, // err
+	{0x51, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 0, "Cache: read back failure"}, // err
+	{0x52, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "Cache: unknown command"}, //?
+	{0x53, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_LOC,  1, 1, "GC/WL read back failure"}, // err
+
+	{0x60, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "Erase failure"}, 
+
+	{0x70, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "LPA not matched"}, 
+	{0x71, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "PBN not matched"}, 
+	{0x72, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Read retry failure"}, 
+	{0x73, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Need raid recovery"}, 
+	{0x74, SSD_LOG_LEVEL_INFO,    SSD_LOG_DATA_LOC,  1, 1, "Need read retry"}, 
+	{0x75, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Read invalid data page"}, 
+	{0x76, SSD_LOG_LEVEL_INFO,    SSD_LOG_DATA_LOC,  1, 1, "ECC error, data in cache, PBN matched"}, 
+	{0x77, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "ECC error, data in cache, PBN not matched"}, 
+	{0x78, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "ECC error, data in flash, PBN not matched"}, 
+	{0x79, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "ECC ok, data in cache, LPA not matched"},
+	{0x7a, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "ECC ok, data in flash, LPA not matched"},
+	{0x7b, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "RAID data in cache, LPA not matched"}, 
+	{0x7c, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "RAID data in flash, LPA not matched"}, 
+	{0x7d, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Read data page status error"}, 
+	{0x7e, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Read blank page"}, 
+	{0x7f, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Access flash timeout"}, 
+
+	{0x80, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "EC overflow"}, 
+	{0x81, SSD_LOG_LEVEL_INFO,    SSD_LOG_DATA_NONE, 0, 0, "Scrubbing completed"}, 
+	{0x82, SSD_LOG_LEVEL_INFO,    SSD_LOG_DATA_LOC,  1, 0, "Unstable block(too much bit flip)"}, 
+	{0x83, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "GC: ram error"}, //?
+	{0x84, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "GC: one PBMT read failure"}, 
+
+	{0x88, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "GC: mark bad block"}, 
+	{0x89, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 0, "GC: invalid page count error"}, // maybe err
+	{0x8a, SSD_LOG_LEVEL_WARNING, SSD_LOG_DATA_NONE, 0, 0, "Warning: Bad Block close to limit"}, 
+	{0x8b, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_NONE, 0, 0, "Error: Bad Block over limit"}, 
+	{0x8c, SSD_LOG_LEVEL_WARNING, SSD_LOG_DATA_NONE, 0, 0, "Warning: P/E cycles close to limit"}, 
+	{0x8d, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_NONE, 0, 0, "Error: P/E cycles over limit"}, 
+
+	{0x90, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "Over temperature"}, //xx
+	{0x91, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "Temperature is OK"}, //xx
+	{0x92, SSD_LOG_LEVEL_WARNING, SSD_LOG_DATA_NONE, 0, 0, "Battery fault"}, 
+	{0x93, SSD_LOG_LEVEL_WARNING, SSD_LOG_DATA_NONE, 0, 0, "SEU fault"}, //err
+	{0x94, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_NONE, 0, 0, "DDR error"}, //err
+	{0x95, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_NONE, 0, 0, "Controller serdes error"}, //err
+	{0x96, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_NONE, 0, 0, "Bridge serdes 1 error"}, //err
+	{0x97, SSD_LOG_LEVEL_ERR,     SSD_LOG_DATA_NONE, 0, 0, "Bridge serdes 2 error"}, //err
+	{0x98, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "SEU fault (corrected)"}, //err
+	{0x99, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "Battery is OK"}, 
+	{0x9a, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "Temperature close to limit"}, //xx
+	
+	{0x9b, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_HEX,  0, 0, "SEU fault address (low)"}, 
+	{0x9c, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_HEX,  0, 0, "SEU fault address (high)"}, 
+	{0x9d, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "I2C fault" }, 
+	{0x9e, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "DDR single bit error" }, 
+	{0x9f, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "Board voltage fault" },
+
+	{0xa0, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_HEX,  0, 0, "LPA not matched"}, 
+	{0xa1, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Re-read data in cache"}, 
+	{0xa2, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Read blank page"}, 
+	{0xa3, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "RAID recovery: Read blank page"}, 
+	{0xa4, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "RAID recovery: new data in cache"}, 
+	{0xa5, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "RAID recovery: PBN not matched"}, 
+	{0xa6, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Read data with error flag"}, 
+	{0xa7, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "RAID recovery: recoverd data with error flag"}, 
+	{0xa8, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Blank page in cache, PBN matched"}, 
+	{0xa9, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "RAID recovery: Blank page in cache, PBN matched"}, 
+	{0xaa, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  0, 0, "Flash init failure"}, 
+	{0xab, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "Mapping table recovery failure"}, 
+	{0xac, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_LOC,  1, 1, "RAID recovery: ECC failed"}, 
+	{0xb0, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "Temperature is up to degree 95"},
+	{0xb1, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_NONE, 0, 0, "Temperature is up to degree 100"},
+
+	{0x300, SSD_LOG_LEVEL_ERR,    SSD_LOG_DATA_HEX,  0, 0, "CMD timeout"}, 
+	{0x301, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "Power on"}, 
+	{0x302, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Power off"}, 
+	{0x303, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Clear log"}, 
+	{0x304, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "Set capacity"}, 
+	{0x305, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Clear data"}, 
+	{0x306, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "BM safety status"}, 
+	{0x307, SSD_LOG_LEVEL_ERR,    SSD_LOG_DATA_HEX,  0, 0, "I/O error"}, 
+	{0x308, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "CMD error"}, 
+	{0x309, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "Set wmode"}, 
+	{0x30a, SSD_LOG_LEVEL_ERR,    SSD_LOG_DATA_HEX,  0, 0, "DDR init failed" }, 
+	{0x30b, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "PCIe link status" }, 
+	{0x30c, SSD_LOG_LEVEL_ERR,    SSD_LOG_DATA_HEX,  0, 0, "Controller reset sync error" }, 
+	{0x30d, SSD_LOG_LEVEL_ERR,    SSD_LOG_DATA_HEX,  0, 0, "Clock fault" }, 
+	{0x30e, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "FPGA voltage fault status" }, 
+	{0x30f, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "Set capacity finished"}, 
+	{0x310, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Clear data finished"}, 
+	{0x311, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "Reset"}, 
+	{0x312, SSD_LOG_LEVEL_WARNING,SSD_LOG_DATA_HEX,  0, 0, "CAP: voltage fault"}, 
+	{0x313, SSD_LOG_LEVEL_WARNING,SSD_LOG_DATA_NONE, 0, 0, "CAP: learn fault"}, 
+	{0x314, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "CAP status"}, 
+	{0x315, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_HEX,  0, 0, "Board voltage fault status"}, 
+	{0x316, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Inlet over temperature"}, 
+	{0x317, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Inlet temperature is OK"}, 
+	{0x318, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Flash over temperature"}, 
+	{0x319, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Flash temperature is OK"}, 
+	{0x31a, SSD_LOG_LEVEL_WARNING,SSD_LOG_DATA_NONE, 0, 0, "CAP: short circuit"}, 
+	{0x31b, SSD_LOG_LEVEL_WARNING,SSD_LOG_DATA_HEX,  0, 0, "Sensor fault"}, 
+	{0x31c, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Erase all data"}, 
+	{0x31d, SSD_LOG_LEVEL_NOTICE, SSD_LOG_DATA_NONE, 0, 0, "Erase all data finished"},
+
+	{SSD_UNKNOWN_EVENT, SSD_LOG_LEVEL_NOTICE,  SSD_LOG_DATA_HEX,  0, 0, "unknown event"}, 
+};
+/* */
+#define SSD_LOG_OVER_TEMP		0x90
+#define SSD_LOG_NORMAL_TEMP		0x91
+#define SSD_LOG_WARN_TEMP		0x9a
+#define SSD_LOG_SEU_FAULT		0x93
+#define SSD_LOG_SEU_FAULT1		0x98
+#define SSD_LOG_BATTERY_FAULT	0x92
+#define SSD_LOG_BATTERY_OK		0x99
+#define SSD_LOG_BOARD_VOLT_FAULT	0x9f
+
+/* software log */
+#define SSD_LOG_TIMEOUT			0x300
+#define SSD_LOG_POWER_ON		0x301
+#define SSD_LOG_POWER_OFF		0x302
+#define SSD_LOG_CLEAR_LOG		0x303
+#define SSD_LOG_SET_CAPACITY	0x304
+#define SSD_LOG_CLEAR_DATA		0x305
+#define SSD_LOG_BM_SFSTATUS		0x306
+#define SSD_LOG_EIO				0x307
+#define SSD_LOG_ECMD			0x308
+#define SSD_LOG_SET_WMODE		0x309
+#define SSD_LOG_DDR_INIT_ERR	0x30a
+#define SSD_LOG_PCIE_LINK_STATUS	0x30b
+#define SSD_LOG_CTRL_RST_SYNC	0x30c
+#define SSD_LOG_CLK_FAULT		0x30d
+#define SSD_LOG_VOLT_FAULT		0x30e
+#define SSD_LOG_SET_CAPACITY_END	0x30F
+#define SSD_LOG_CLEAR_DATA_END	0x310
+#define SSD_LOG_RESET			0x311
+#define SSD_LOG_CAP_VOLT_FAULT	0x312
+#define SSD_LOG_CAP_LEARN_FAULT	0x313
+#define SSD_LOG_CAP_STATUS		0x314
+#define SSD_LOG_VOLT_STATUS		0x315
+#define SSD_LOG_INLET_OVER_TEMP	0x316
+#define SSD_LOG_INLET_NORMAL_TEMP	0x317
+#define SSD_LOG_FLASH_OVER_TEMP	0x318
+#define SSD_LOG_FLASH_NORMAL_TEMP	0x319
+#define SSD_LOG_CAP_SHORT_CIRCUIT	0x31a
+#define SSD_LOG_SENSOR_FAULT	0x31b
+#define SSD_LOG_ERASE_ALL		0x31c
+#define SSD_LOG_ERASE_ALL_END	0x31d
+
+
+/* sw log fifo depth */
+#define SSD_LOG_FIFO_SZ		1024
+
+
+/* done queue */
+static DEFINE_PER_CPU(struct list_head, ssd_doneq);
+static DEFINE_PER_CPU(struct tasklet_struct, ssd_tasklet);
+
+
+/* unloading driver */
+static volatile int ssd_exiting = 0;
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,12))
+static struct class_simple *ssd_class;
+#else
+static struct class *ssd_class;
+#endif
+
+static int ssd_cmajor = SSD_CMAJOR;
+
+/* ssd block device major, minors */
+static int ssd_major = SSD_MAJOR;
+static int ssd_major_sl = SSD_MAJOR_SL;
+static int ssd_minors = SSD_MINORS;
+
+/* ssd device list */
+static struct list_head	ssd_list;
+static unsigned long ssd_index_bits[SSD_MAX_DEV / BITS_PER_LONG + 1];
+static unsigned long ssd_index_bits_sl[SSD_MAX_DEV / BITS_PER_LONG + 1];
+static atomic_t ssd_nr;
+
+/* module param */
+enum ssd_drv_mode
+{
+	SSD_DRV_MODE_STANDARD = 0,	/* full */
+	SSD_DRV_MODE_DEBUG = 2,	/* debug */
+	SSD_DRV_MODE_BASE	/* base only */
+};
+
+enum ssd_int_mode
+{
+	SSD_INT_LEGACY = 0, 
+	SSD_INT_MSI, 
+	SSD_INT_MSIX
+};
+
+#if (defined SSD_MSIX)
+#define SSD_INT_MODE_DEFAULT SSD_INT_MSIX
+#elif (defined SSD_MSI)
+#define SSD_INT_MODE_DEFAULT SSD_INT_MSI
+#else
+/* auto select the defaut int mode according to the kernel version*/
+/* suse 11 sp1 irqbalance bug: use msi instead*/
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35)) || (defined RHEL_MAJOR && RHEL_MAJOR >= 6) || (defined RHEL_MAJOR && RHEL_MAJOR == 5 && RHEL_MINOR >= 5))
+#define SSD_INT_MODE_DEFAULT SSD_INT_MSIX
+#else
+#define SSD_INT_MODE_DEFAULT SSD_INT_MSI
+#endif
+#endif
+
+static int mode = SSD_DRV_MODE_STANDARD;
+static int status_mask = 0xFF;
+static int int_mode = SSD_INT_MODE_DEFAULT;
+static int threaded_irq = 0;
+static int log_level = SSD_LOG_LEVEL_WARNING;
+static int ot_protect = 1;
+static int wmode = SSD_WMODE_DEFAULT;
+static int finject = 0;
+
+module_param(mode, int, 0);
+module_param(status_mask, int, 0);
+module_param(int_mode, int, 0);
+module_param(threaded_irq, int, 0);
+module_param(log_level, int, 0);
+module_param(ot_protect, int, 0);
+module_param(wmode, int, 0);
+module_param(finject, int, 0);
+
+
+MODULE_PARM_DESC(mode, "driver mode, 0 - standard, 1 - debug, 2 - debug without IO, 3 - basic debug mode");
+MODULE_PARM_DESC(status_mask, "command status mask, 0 - without command error, 0xff - with command error");
+MODULE_PARM_DESC(int_mode, "preferred interrupt mode, 0 - legacy, 1 - msi, 2 - msix");
+MODULE_PARM_DESC(threaded_irq, "threaded irq, 0 - normal irq, 1 - threaded irq");
+MODULE_PARM_DESC(log_level, "log level to display, 0 - info and above, 1 - notice and above, 2 - warning and above, 3 - error only");
+MODULE_PARM_DESC(ot_protect, "over temperature protect, 0 - disable, 1 - enable");
+MODULE_PARM_DESC(wmode, "write mode, 0 - write buffer (with risk for the 6xx firmware), 1 - write buffer ex, 2 - write through, 3 - auto, 4 - default");
+MODULE_PARM_DESC(finject, "enable fault simulation, 0 - off, 1 - on, for debug purpose only");
+
+
+#ifndef MODULE
+static int __init ssd_drv_mode(char *str)
+{
+	mode = (int)simple_strtoul(str, NULL, 0);
+
+	return 1;
+}
+
+static int __init ssd_status_mask(char *str)
+{
+	status_mask = (int)simple_strtoul(str, NULL, 16);
+
+	return 1;
+}
+
+static int __init ssd_int_mode(char *str)
+{
+	int_mode = (int)simple_strtoul(str, NULL, 0);
+
+	return 1;
+}
+
+static int __init ssd_threaded_irq(char *str)
+{
+	threaded_irq = (int)simple_strtoul(str, NULL, 0);
+
+	return 1;
+}
+
+static int __init ssd_log_level(char *str)
+{
+	log_level = (int)simple_strtoul(str, NULL, 0);
+
+	return 1;
+}
+
+static int __init ssd_ot_protect(char *str)
+{
+	ot_protect = (int)simple_strtoul(str, NULL, 0);
+
+	return 1;
+}
+
+static int __init ssd_wmode(char *str)
+{
+	wmode = (int)simple_strtoul(str, NULL, 0);
+
+	return 1;
+}
+
+static int __init ssd_finject(char *str)
+{
+	finject = (int)simple_strtoul(str, NULL, 0);
+
+	return 1;
+}
+
+__setup(MODULE_NAME"_mode=", ssd_drv_mode);
+__setup(MODULE_NAME"_status_mask=", ssd_status_mask);
+__setup(MODULE_NAME"_int_mode=", ssd_int_mode);
+__setup(MODULE_NAME"_threaded_irq=", ssd_threaded_irq);
+__setup(MODULE_NAME"_log_level=", ssd_log_level);
+__setup(MODULE_NAME"_ot_protect=", ssd_ot_protect);
+__setup(MODULE_NAME"_wmode=", ssd_wmode);
+__setup(MODULE_NAME"_finject=", ssd_finject);
+#endif
+
+
+#ifdef CONFIG_PROC_FS
+#include <linux/proc_fs.h>
+#include <asm/uaccess.h>
+
+#define SSD_PROC_DIR	MODULE_NAME
+#define SSD_PROC_INFO	"info"
+
+static struct proc_dir_entry *ssd_proc_dir = NULL;
+static struct proc_dir_entry *ssd_proc_info = NULL;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,2,0))
+static int ssd_proc_read(char *page, char **start, 
+	off_t off, int count, int *eof, void *data)
+{
+	struct ssd_device *dev = NULL;
+	struct ssd_device *n = NULL;
+	uint64_t size;
+	int idx;
+	int len = 0;
+	//char type; //xx
+
+	if (ssd_exiting) {
+		return 0;
+	}
+
+	len += snprintf((page + len), (count - len), "Driver          Version:\t%s\n", DRIVER_VERSION);
+
+	list_for_each_entry_safe(dev, n, &ssd_list, list) {
+		idx = dev->idx + 1;
+		size = dev->hw_info.size ;
+		do_div(size, 1000000000);
+
+		len += snprintf((page + len), (count - len), "\n");
+
+		len += snprintf((page + len), (count - len), "HIO %d              Size:\t%uGB\n", idx, (uint32_t)size);
+
+		len += snprintf((page + len), (count - len), "HIO %d     Bridge FW VER:\t%03X\n", idx, dev->hw_info.bridge_ver);
+		if (dev->hw_info.ctrl_ver != 0) {
+			len += snprintf((page + len), (count - len), "HIO %d Controller FW VER:\t%03X\n", idx, dev->hw_info.ctrl_ver);
+		}
+
+		len += snprintf((page + len), (count - len), "HIO %d           PCB VER:\t.%c\n", idx, dev->hw_info.pcb_ver);
+
+		if (dev->hw_info.upper_pcb_ver >= 'A') {
+			len += snprintf((page + len), (count - len), "HIO %d     Upper PCB VER:\t.%c\n", idx, dev->hw_info.upper_pcb_ver);
+		}
+
+		len += snprintf((page + len), (count - len), "HIO %d            Device:\t%s\n", idx, dev->name);
+	}
+
+	return len;
+}
+
+#else
+
+static int ssd_proc_show(struct seq_file *m, void *v)
+{
+	struct ssd_device *dev = NULL;
+	struct ssd_device *n = NULL;
+	uint64_t size;
+	int idx;
+
+	if (ssd_exiting) {
+		return 0;
+	}
+
+	seq_printf(m, "Driver          Version:\t%s\n", DRIVER_VERSION);
+
+	list_for_each_entry_safe(dev, n, &ssd_list, list) {
+		idx = dev->idx + 1;
+		size = dev->hw_info.size ;
+		do_div(size, 1000000000);
+
+		seq_printf(m, "\n");
+
+		seq_printf(m, "HIO %d              Size:\t%uGB\n", idx, (uint32_t)size);
+
+		seq_printf(m, "HIO %d     Bridge FW VER:\t%03X\n", idx, dev->hw_info.bridge_ver);
+		if (dev->hw_info.ctrl_ver != 0) {
+			seq_printf(m, "HIO %d Controller FW VER:\t%03X\n", idx, dev->hw_info.ctrl_ver);
+		}
+
+		seq_printf(m, "HIO %d           PCB VER:\t.%c\n", idx, dev->hw_info.pcb_ver);
+
+		if (dev->hw_info.upper_pcb_ver >= 'A') {
+			seq_printf(m, "HIO %d     Upper PCB VER:\t.%c\n", idx, dev->hw_info.upper_pcb_ver);
+		}
+
+		seq_printf(m, "HIO %d            Device:\t%s\n", idx, dev->name);
+	}
+
+	return 0;
+}
+
+static int ssd_proc_open(struct inode *inode, struct file *file)
+{
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,9,0))
+	return single_open(file, ssd_proc_show, PDE(inode)->data);
+#else
+	return single_open(file, ssd_proc_show, PDE_DATA(inode));
+#endif
+}
+
+static const struct file_operations ssd_proc_fops = {
+	.open		= ssd_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+#endif
+
+
+static void ssd_cleanup_proc(void)
+{
+	if (ssd_proc_info) {
+		remove_proc_entry(SSD_PROC_INFO, ssd_proc_dir);
+		ssd_proc_info = NULL;
+	}
+	if (ssd_proc_dir) {
+		remove_proc_entry(SSD_PROC_DIR, NULL);
+		ssd_proc_dir = NULL;
+	}
+}
+static int ssd_init_proc(void)
+{
+	ssd_proc_dir = proc_mkdir(SSD_PROC_DIR, NULL);
+	if (!ssd_proc_dir)
+		goto out_proc_mkdir;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,2,0))
+	ssd_proc_info = create_proc_entry(SSD_PROC_INFO, S_IFREG | S_IRUGO | S_IWUSR, ssd_proc_dir);
+	if (!ssd_proc_info)
+		goto out_create_proc_entry;
+
+	ssd_proc_info->read_proc = ssd_proc_read;
+
+/* kernel bug */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
+	ssd_proc_info->owner = THIS_MODULE;
+#endif
+#else
+	ssd_proc_info = proc_create(SSD_PROC_INFO, 0600, ssd_proc_dir, &ssd_proc_fops);
+	if (!ssd_proc_info)
+		goto out_create_proc_entry;
+#endif
+
+	return 0;
+
+out_create_proc_entry:
+	remove_proc_entry(SSD_PROC_DIR, NULL);
+out_proc_mkdir:
+	return -ENOMEM;
+}
+
+#else
+static void ssd_cleanup_proc(void)
+{
+	return;
+}
+static int ssd_init_proc(void)
+{
+	return 0;
+}
+#endif /* CONFIG_PROC_FS */
+
+/* sysfs */
+static void ssd_unregister_sysfs(struct ssd_device *dev)
+{
+	return;
+}
+
+static int ssd_register_sysfs(struct ssd_device *dev)
+{
+	return 0;
+}
+
+static void ssd_cleanup_sysfs(void)
+{
+	return;
+}
+
+static int ssd_init_sysfs(void)
+{
+	return 0;
+}
+
+static inline void ssd_put_index(int slave, int index)
+{
+	unsigned long *index_bits = ssd_index_bits;
+
+	if (slave) {
+		index_bits = ssd_index_bits_sl;
+	}
+
+	if (test_and_clear_bit(index,  index_bits)) {
+		atomic_dec(&ssd_nr);
+	}
+}
+
+static inline int ssd_get_index(int slave)
+{
+	unsigned long *index_bits = ssd_index_bits;
+	int index;
+
+	if (slave) {
+		index_bits = ssd_index_bits_sl;
+	}
+
+find_index:
+	if ((index = find_first_zero_bit(index_bits, SSD_MAX_DEV)) >= SSD_MAX_DEV) {
+			return -1;
+	}
+
+	if (test_and_set_bit(index, index_bits)) {
+		goto find_index;
+	}
+
+	atomic_inc(&ssd_nr);
+
+	return index;
+}
+
+static void ssd_cleanup_index(void)
+{
+	return;
+}
+
+static int ssd_init_index(void)
+{
+	INIT_LIST_HEAD(&ssd_list);
+	atomic_set(&ssd_nr, 0);
+	memset(ssd_index_bits, 0, (SSD_MAX_DEV / BITS_PER_LONG + 1));
+	memset(ssd_index_bits_sl, 0, (SSD_MAX_DEV / BITS_PER_LONG + 1));
+
+	return 0;
+}
+
+static void ssd_set_dev_name(char *name, size_t size, int idx)
+{
+	if(idx < SSD_ALPHABET_NUM) {
+		snprintf(name, size, "%c", 'a'+idx);
+	} else {
+		idx -= SSD_ALPHABET_NUM;
+		snprintf(name, size, "%c%c", 'a'+(idx/SSD_ALPHABET_NUM), 'a'+(idx%SSD_ALPHABET_NUM));
+	}
+}
+
+/* pci register r&w */
+static inline void ssd_reg_write(void *addr, uint64_t val)
+{
+	iowrite32((uint32_t)val, addr);
+	iowrite32((uint32_t)(val >> 32), addr + 4);
+	wmb();
+}
+
+static inline uint64_t ssd_reg_read(void *addr)
+{
+	uint64_t val;
+	uint32_t val_lo, val_hi;
+
+	val_lo = ioread32(addr);
+	val_hi = ioread32(addr + 4);
+
+	rmb();
+	val = val_lo | ((uint64_t)val_hi << 32);
+
+	return val;
+}
+
+
+#define ssd_reg32_write(addr, val)	writel(val, addr)
+#define ssd_reg32_read(addr)		readl(addr)
+
+/* alarm led */
+static void ssd_clear_alarm(struct ssd_device *dev)
+{
+	uint32_t val;
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return;
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_LED_REG);
+
+	/* firmware control */
+	val &= ~0x2;
+
+	ssd_reg32_write(dev->ctrlp + SSD_LED_REG, val);
+}
+
+static void ssd_set_alarm(struct ssd_device *dev)
+{
+	uint32_t val;
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return;
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_LED_REG);
+
+	/* light up */
+	val &= ~0x1;
+	/* software control */
+	val |= 0x2;
+
+	ssd_reg32_write(dev->ctrlp + SSD_LED_REG, val);
+}
+
+#define u32_swap(x) \
+	((uint32_t)( \
+	(((uint32_t)(x) & (uint32_t)0x000000ffUL) << 24) | \
+	(((uint32_t)(x) & (uint32_t)0x0000ff00UL) <<  8) | \
+	(((uint32_t)(x) & (uint32_t)0x00ff0000UL) >>  8) | \
+	(((uint32_t)(x) & (uint32_t)0xff000000UL) >> 24)))
+
+#define u16_swap(x) \
+	((uint16_t)( \
+	(((uint16_t)(x) & (uint16_t)0x00ff) <<  8) | \
+	(((uint16_t)(x) & (uint16_t)0xff00) >>  8) ))
+
+
+#if 0
+/* No lock, for init only*/
+static int ssd_spi_read_id(struct ssd_device *dev, uint32_t *id)
+{
+	uint32_t val;
+	unsigned long st;
+	int ret = 0;
+
+	if (!dev || !id) {
+		return -EINVAL;
+	}
+
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_READ_ID);
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+	val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+	val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+	val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+
+	st = jiffies;
+	for (;;) {
+		val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+		if (val == 0x1000000) {
+			break;
+		}
+
+		if (time_after(jiffies, (st + SSD_SPI_TIMEOUT))) {
+			ret = -ETIMEDOUT;
+			goto out;
+		}
+		cond_resched();
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_ID);
+	*id = val;
+
+out:
+	return ret;
+}
+#endif
+
+/* spi access */
+static int ssd_init_spi(struct ssd_device *dev)
+{
+	uint32_t val;
+	unsigned long st;
+	int ret = 0;
+
+	mutex_lock(&dev->spi_mutex);
+	st = jiffies;
+	for(;;) {
+		ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_READ_STATUS);
+
+		do {
+			val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+
+			if (time_after(jiffies, (st + SSD_SPI_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out;
+			}
+			cond_resched();
+		} while (val != 0x1000000);
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_STATUS);
+		if (!(val & 0x1)) {
+			break;
+		}
+
+		if (time_after(jiffies, (st + SSD_SPI_TIMEOUT))) {
+			ret = -ETIMEDOUT;
+			goto out;
+		}
+		cond_resched();
+	}
+
+out:
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		if (val & 0x1) {
+			ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_CLSR);
+		}
+	}
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_W_DISABLE);
+	mutex_unlock(&dev->spi_mutex);
+
+	ret = 0;
+
+	return ret;
+}
+
+static int ssd_spi_page_read(struct ssd_device *dev, void *buf, uint32_t off, uint32_t size)
+{
+	uint32_t val;
+	uint32_t rlen = 0;
+	unsigned long st;
+	int ret = 0;
+
+	if (!dev || !buf) {
+		return -EINVAL;
+	}
+
+	if ((off % sizeof(uint32_t)) != 0 || (size % sizeof(uint32_t)) != 0 || size == 0 || 
+		((uint64_t)off + (uint64_t)size) > dev->rom_info.size || size > dev->rom_info.page_size) {
+		return -EINVAL;
+	}
+
+	mutex_lock(&dev->spi_mutex);
+	while (rlen < size) {
+		ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD_HI, ((off + rlen) >> 24));
+		wmb();
+		ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, (((off + rlen) << 8) | SSD_SPI_CMD_READ));
+
+		(void)ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+		(void)ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+		(void)ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+		(void)ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+
+		st = jiffies;
+		for (;;) {
+			val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+			if (val == 0x1000000) {
+				break;
+			}
+
+			if (time_after(jiffies, (st + SSD_SPI_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out;
+			}
+			cond_resched();
+		}
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_RDATA);
+		*(uint32_t *)(buf + rlen)= u32_swap(val);
+
+		rlen += sizeof(uint32_t);
+	}
+
+out:
+	mutex_unlock(&dev->spi_mutex);
+	return ret;
+}
+
+static int ssd_spi_page_write(struct ssd_device *dev, void *buf, uint32_t off, uint32_t size)
+{
+	uint32_t val;
+	uint32_t wlen;
+	unsigned long st;
+	int i;
+	int ret = 0;
+
+	if (!dev || !buf) {
+		return -EINVAL;
+	}
+
+	if ((off % sizeof(uint32_t)) != 0 || (size % sizeof(uint32_t)) != 0 || size == 0 || 
+		((uint64_t)off + (uint64_t)size) > dev->rom_info.size || size > dev->rom_info.page_size || 
+		(off / dev->rom_info.page_size) !=  ((off + size - 1) / dev->rom_info.page_size)) {
+		return -EINVAL;
+	}
+
+	mutex_lock(&dev->spi_mutex);
+
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_W_ENABLE);
+
+	wlen = size / sizeof(uint32_t);
+	for (i=0; i<(int)wlen; i++) {
+		ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_WDATA, u32_swap(*((uint32_t *)buf + i)));
+	}
+
+	wmb();
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD_HI, (off >> 24));
+	wmb();
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, ((off << 8) | SSD_SPI_CMD_PROGRAM));
+
+	udelay(1);
+
+	st = jiffies;
+	for (;;) {
+		ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_READ_STATUS);
+		do {
+			val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+
+			if (time_after(jiffies, (st + SSD_SPI_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out;
+			}
+			cond_resched();
+		} while (val != 0x1000000);
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_STATUS);
+		if (!(val & 0x1)) {
+			break;
+		}
+
+		if (time_after(jiffies, (st + SSD_SPI_TIMEOUT))) {
+			ret = -ETIMEDOUT;
+			goto out;
+		}
+		cond_resched();
+	}
+
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		if ((val >> 6) & 0x1) {
+			ret = -EIO;
+			goto out;
+		}
+	}
+
+out:
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		if (val & 0x1) {
+			ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_CLSR);
+		}
+	}
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_W_DISABLE);
+
+	mutex_unlock(&dev->spi_mutex);
+
+	return ret;
+}
+
+static int ssd_spi_block_erase(struct ssd_device *dev, uint32_t off)
+{
+	uint32_t val;
+	unsigned long st;
+	int ret = 0;
+
+	if (!dev) {
+		return -EINVAL;
+	}
+
+	if ((off % dev->rom_info.block_size) != 0 || off >= dev->rom_info.size) {
+		return -EINVAL;
+	}
+
+	mutex_lock(&dev->spi_mutex);
+
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_W_ENABLE);
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_W_ENABLE);
+
+	wmb();
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD_HI, (off >> 24));
+	wmb();
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, ((off << 8) | SSD_SPI_CMD_ERASE));
+
+	st = jiffies;
+	for (;;) {
+		ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_READ_STATUS);
+
+		do {
+			val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_READY);
+
+			if (time_after(jiffies, (st + SSD_SPI_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out;
+			}
+			cond_resched();
+		} while (val != 0x1000000);
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_STATUS);
+		if (!(val & 0x1)) {
+			break;
+		}
+
+		if (time_after(jiffies, (st + SSD_SPI_TIMEOUT))) {
+			ret = -ETIMEDOUT;
+			goto out;
+		}
+		cond_resched();
+	}
+
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		if ((val >> 5) & 0x1) {
+			ret = -EIO;
+			goto out;
+		}
+	}
+
+out:
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		if (val & 0x1) {
+			ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_CLSR);
+		}
+	}
+	ssd_reg32_write(dev->ctrlp + SSD_SPI_REG_CMD, SSD_SPI_CMD_W_DISABLE);
+
+	mutex_unlock(&dev->spi_mutex);
+
+	return ret;
+}
+
+static int ssd_spi_read(struct ssd_device *dev, void *buf, uint32_t off, uint32_t size)
+{
+	uint32_t len = 0;
+	uint32_t roff;
+	uint32_t rsize;
+	int ret = 0;
+
+	if (!dev || !buf) {
+		return -EINVAL;
+	}
+
+	if ((off % sizeof(uint32_t)) != 0 || (size % sizeof(uint32_t)) != 0 || size == 0 || 
+		((uint64_t)off + (uint64_t)size) > dev->rom_info.size) {
+		return -EINVAL;
+	}
+
+	while (len < size) {
+		roff = (off + len) % dev->rom_info.page_size;
+		rsize = dev->rom_info.page_size - roff;
+		if ((size - len) < rsize) {
+			rsize = (size - len);
+		}
+		roff = off + len;
+
+		ret = ssd_spi_page_read(dev, (buf + len), roff, rsize);
+		if (ret) {
+			goto out;
+		}
+
+		len += rsize;
+
+		cond_resched();
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_spi_write(struct ssd_device *dev, void *buf, uint32_t off, uint32_t size)
+{
+	uint32_t len = 0;
+	uint32_t woff;
+	uint32_t wsize;
+	int ret = 0;
+
+	if (!dev || !buf) {
+		return -EINVAL;
+	}
+
+	if ((off % sizeof(uint32_t)) != 0 || (size % sizeof(uint32_t)) != 0 || size == 0 || 
+		((uint64_t)off + (uint64_t)size) > dev->rom_info.size) {
+		return -EINVAL;
+	}
+
+	while (len < size) {
+		woff = (off + len) % dev->rom_info.page_size;
+		wsize = dev->rom_info.page_size - woff;
+		if ((size - len) < wsize) {
+			wsize = (size - len);
+		}
+		woff = off + len;
+
+		ret = ssd_spi_page_write(dev, (buf + len), woff, wsize);
+		if (ret) {
+			goto out;
+		}
+
+		len += wsize;
+
+		cond_resched();
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_spi_erase(struct ssd_device *dev, uint32_t off, uint32_t size)
+{
+	uint32_t len = 0;
+	uint32_t eoff;
+	int ret = 0;
+
+	if (!dev) {
+		return -EINVAL;
+	}
+
+	if (size == 0 || ((uint64_t)off + (uint64_t)size) > dev->rom_info.size ||
+		(off % dev->rom_info.block_size) != 0 || (size % dev->rom_info.block_size) != 0) {
+		return -EINVAL;
+	}
+
+	while (len < size) {
+		eoff = (off + len);
+
+		ret = ssd_spi_block_erase(dev, eoff);
+		if (ret) {
+			goto out;
+		}
+
+		len += dev->rom_info.block_size;
+
+		cond_resched();
+	}
+
+out:
+	return ret;
+}
+
+/* i2c access */
+static uint32_t __ssd_i2c_reg32_read(void *addr)
+{
+	return ssd_reg32_read(addr);
+}
+
+static void __ssd_i2c_reg32_write(void *addr, uint32_t val)
+{
+	ssd_reg32_write(addr, val);
+	ssd_reg32_read(addr);
+}
+
+static int __ssd_i2c_clear(struct ssd_device *dev, uint8_t saddr)
+{
+	ssd_i2c_ctrl_t ctrl;
+	ssd_i2c_data_t data;
+	uint8_t status = 0;
+	int nr_data = 0;
+	unsigned long st;
+	int ret = 0;
+
+check_status:
+	ctrl.bits.wdata	= 0;
+	ctrl.bits.addr	= SSD_I2C_STATUS_REG;
+	ctrl.bits.rw 	= SSD_I2C_CTRL_READ;
+	__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+	st = jiffies;
+	for (;;) {
+		data.val = __ssd_i2c_reg32_read(dev->ctrlp + SSD_I2C_RDATA_REG);
+		if (data.bits.valid == 0) {
+			break;
+		}
+
+		/* retry */
+		if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+			ret = -ETIMEDOUT;
+			goto out;
+		}
+		cond_resched();
+	}
+	status = data.bits.rdata;
+
+	if (!(status & 0x4)) {
+		/* clear read fifo data */
+		ctrl.bits.wdata	= 0;
+		ctrl.bits.addr	= SSD_I2C_DATA_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_READ;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+		st = jiffies;
+		for (;;) {
+			data.val = __ssd_i2c_reg32_read(dev->ctrlp + SSD_I2C_RDATA_REG);
+			if (data.bits.valid == 0) {
+				break;
+			}
+
+			/* retry */
+			if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out;
+			}
+			cond_resched();
+		}
+
+		nr_data++;
+		if (nr_data <= SSD_I2C_MAX_DATA) {
+			goto check_status;
+		} else {
+			goto out_reset;
+		}
+	}
+
+	if (status & 0x3) {
+		/* clear int */
+		ctrl.bits.wdata	= 0x04;
+		ctrl.bits.addr	= SSD_I2C_CMD_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+	}
+
+	if (!(status & 0x8)) {
+out_reset:
+		/* reset i2c controller */
+		ctrl.bits.wdata	= 0x0;
+		ctrl.bits.addr	= SSD_I2C_RESET_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_i2c_write(struct ssd_device *dev, uint8_t saddr, uint8_t size, uint8_t *buf)
+{
+	ssd_i2c_ctrl_t ctrl;
+	ssd_i2c_data_t data;
+	uint8_t off = 0;
+	uint8_t status = 0;
+	unsigned long st;
+	int ret = 0;
+
+	mutex_lock(&dev->i2c_mutex);
+
+	ctrl.val = 0;
+
+	/* slave addr */
+	ctrl.bits.wdata	= saddr;
+	ctrl.bits.addr	= SSD_I2C_SADDR_REG;
+	ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+	__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+	/* data */
+	while (off < size) {
+		ctrl.bits.wdata	= buf[off];
+		ctrl.bits.addr	= SSD_I2C_DATA_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+		off++;
+	}
+
+	/* write */
+	ctrl.bits.wdata	= 0x01;
+	ctrl.bits.addr	= SSD_I2C_CMD_REG;
+	ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+	__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+	/* wait */
+	st = jiffies;
+	for (;;) {
+		ctrl.bits.wdata	= 0;
+		ctrl.bits.addr	= SSD_I2C_STATUS_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_READ;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+		for (;;) {
+			data.val = __ssd_i2c_reg32_read(dev->ctrlp + SSD_I2C_RDATA_REG);
+			if (data.bits.valid == 0) {
+				break;
+			}
+
+			/* retry */
+			if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out_clear;
+			}
+			cond_resched();
+		}
+
+		status = data.bits.rdata;
+		if (status & 0x1) {
+			break;
+		}
+
+		if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+			ret = -ETIMEDOUT;
+			goto out_clear;
+		}
+		cond_resched();
+	}
+
+	if (!(status & 0x1)) {
+		ret =  -1;
+		goto out_clear;
+	}
+
+	/* busy ? */
+	if (status & 0x20) {
+		ret =  -2;
+		goto out_clear;
+	}
+
+	/* ack ? */
+	if (status & 0x10) {
+		ret =  -3;
+		goto out_clear;
+	}
+
+	/* clear */
+out_clear:
+	if (__ssd_i2c_clear(dev, saddr)) {
+		if (!ret) ret = -4;
+	}
+
+	mutex_unlock(&dev->i2c_mutex);
+
+	return ret;
+}
+
+static int ssd_i2c_read(struct ssd_device *dev, uint8_t saddr, uint8_t size, uint8_t *buf)
+{
+	ssd_i2c_ctrl_t ctrl;
+	ssd_i2c_data_t data;
+	uint8_t off = 0;
+	uint8_t status = 0;
+	unsigned long st;
+	int ret = 0;
+
+	mutex_lock(&dev->i2c_mutex);
+
+	ctrl.val = 0;
+
+	/* slave addr */
+	ctrl.bits.wdata	= saddr;
+	ctrl.bits.addr	= SSD_I2C_SADDR_REG;
+	ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+	__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+	/* read len */
+	ctrl.bits.wdata	= size;
+	ctrl.bits.addr	= SSD_I2C_LEN_REG;
+	ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+	__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+	/* read */
+	ctrl.bits.wdata	= 0x02;
+	ctrl.bits.addr	= SSD_I2C_CMD_REG;
+	ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+	__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+	/* wait */
+	st = jiffies;
+	for (;;) {
+		ctrl.bits.wdata	= 0;
+		ctrl.bits.addr	= SSD_I2C_STATUS_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_READ;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+		for (;;) {
+			data.val = __ssd_i2c_reg32_read(dev->ctrlp + SSD_I2C_RDATA_REG);
+			if (data.bits.valid == 0) {
+				break;
+			}
+
+			/* retry */
+			if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out_clear;
+			}
+			cond_resched();
+		}
+
+		status = data.bits.rdata;
+		if (status & 0x2) {
+			break;
+		}
+
+		if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+			ret = -ETIMEDOUT;
+			goto out_clear;
+		}
+		cond_resched();
+	}
+
+	if (!(status & 0x2)) {
+		ret =  -1;
+		goto out_clear;
+	}
+
+	/* busy ? */
+	if (status & 0x20) {
+		ret =  -2;
+		goto out_clear;
+	}
+
+	/* ack ? */
+	if (status & 0x10) {
+		ret =  -3;
+		goto out_clear;
+	}
+
+	/* data */
+	while (off < size) {
+		ctrl.bits.wdata	= 0;
+		ctrl.bits.addr	= SSD_I2C_DATA_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_READ;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+		st = jiffies;
+		for (;;) {
+			data.val = __ssd_i2c_reg32_read(dev->ctrlp + SSD_I2C_RDATA_REG);
+			if (data.bits.valid == 0) {
+				break;
+			}
+
+			/* retry */
+			if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out_clear;
+			}
+			cond_resched();
+		}
+
+		buf[off] = data.bits.rdata;
+
+		off++;
+	}
+
+	/* clear */
+out_clear:
+	if (__ssd_i2c_clear(dev, saddr)) {
+		if (!ret) ret = -4;
+	}
+
+	mutex_unlock(&dev->i2c_mutex);
+
+	return ret;
+}
+
+static int ssd_i2c_write_read(struct ssd_device *dev, uint8_t saddr, uint8_t wsize, uint8_t *wbuf, uint8_t rsize, uint8_t *rbuf)
+{
+	ssd_i2c_ctrl_t ctrl;
+	ssd_i2c_data_t data;
+	uint8_t off = 0;
+	uint8_t status = 0;
+	unsigned long st;
+	int ret = 0;
+
+	mutex_lock(&dev->i2c_mutex);
+
+	ctrl.val = 0;
+
+	/* slave addr */
+	ctrl.bits.wdata	= saddr;
+	ctrl.bits.addr	= SSD_I2C_SADDR_REG;
+	ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+	__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+	/* data */
+	off = 0;
+	while (off < wsize) {
+		ctrl.bits.wdata	= wbuf[off];
+		ctrl.bits.addr	= SSD_I2C_DATA_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+		off++;
+	}
+
+	/* read len */
+	ctrl.bits.wdata	= rsize;
+	ctrl.bits.addr	= SSD_I2C_LEN_REG;
+	ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+	__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+	/* write -> read */
+	ctrl.bits.wdata	= 0x03;
+	ctrl.bits.addr	= SSD_I2C_CMD_REG;
+	ctrl.bits.rw 	= SSD_I2C_CTRL_WRITE;
+	__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+	/* wait */
+	st = jiffies;
+	for (;;) {
+		ctrl.bits.wdata	= 0;
+		ctrl.bits.addr	= SSD_I2C_STATUS_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_READ;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+		for (;;) {
+			data.val = __ssd_i2c_reg32_read(dev->ctrlp + SSD_I2C_RDATA_REG);
+			if (data.bits.valid == 0) {
+				break;
+			}
+
+			/* retry */
+			if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out_clear;
+			}
+			cond_resched();
+		}
+
+		status = data.bits.rdata;
+		if (status & 0x2) {
+			break;
+		}
+
+		if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+			ret = -ETIMEDOUT;
+			goto out_clear;
+		}
+		cond_resched();
+	}
+
+	if (!(status & 0x2)) {
+		ret =  -1;
+		goto out_clear;
+	}
+
+	/* busy ? */
+	if (status & 0x20) {
+		ret =  -2;
+		goto out_clear;
+	}
+
+	/* ack ? */
+	if (status & 0x10) {
+		ret =  -3;
+		goto out_clear;
+	}
+
+	/* data */
+	off = 0;
+	while (off < rsize) {
+		ctrl.bits.wdata	= 0;
+		ctrl.bits.addr	= SSD_I2C_DATA_REG;
+		ctrl.bits.rw 	= SSD_I2C_CTRL_READ;
+		__ssd_i2c_reg32_write(dev->ctrlp + SSD_I2C_CTRL_REG, ctrl.val);
+
+		st = jiffies;
+		for (;;) {
+			data.val = __ssd_i2c_reg32_read(dev->ctrlp + SSD_I2C_RDATA_REG);
+			if (data.bits.valid == 0) {
+				break;
+			}
+
+			/* retry */
+			if (time_after(jiffies, (st + SSD_I2C_TIMEOUT))) {
+				ret = -ETIMEDOUT;
+				goto out_clear;
+			}
+			cond_resched();
+		}
+
+		rbuf[off] = data.bits.rdata;
+
+		off++;
+	}
+
+	/* clear */
+out_clear:
+	if (__ssd_i2c_clear(dev, saddr)) {
+		if (!ret) ret = -4;
+	}
+	mutex_unlock(&dev->i2c_mutex);
+
+	return ret;
+}
+
+static int ssd_smbus_send_byte(struct ssd_device *dev, uint8_t saddr, uint8_t *buf)
+{
+	int i = 0;
+	int ret = 0;
+
+	for (;;) {
+		ret = ssd_i2c_write(dev, saddr, 1, buf);
+		if (!ret || -ETIMEDOUT == ret) {
+			break;
+		}
+
+		i++;
+		if (i >= SSD_SMBUS_RETRY_MAX) {
+			break;
+		}
+		msleep(SSD_SMBUS_RETRY_INTERVAL);
+	}
+
+	return ret;
+}
+
+static int ssd_smbus_receive_byte(struct ssd_device *dev, uint8_t saddr, uint8_t *buf)
+{
+	int i = 0;
+	int ret = 0;
+
+	for (;;) {
+		ret = ssd_i2c_read(dev, saddr, 1, buf);
+		if (!ret || -ETIMEDOUT == ret) {
+			break;
+		}
+
+		i++;
+		if (i >= SSD_SMBUS_RETRY_MAX) {
+			break;
+		}
+		msleep(SSD_SMBUS_RETRY_INTERVAL);
+	}
+
+	return ret;
+}
+
+static int ssd_smbus_write_byte(struct ssd_device *dev, uint8_t saddr, uint8_t cmd, uint8_t *buf)
+{
+	uint8_t smb_data[SSD_SMBUS_DATA_MAX] = {0};
+	int i = 0;
+	int ret = 0;
+
+	smb_data[0] = cmd;
+	memcpy((smb_data + 1), buf, 1);
+
+	for (;;) {
+		ret = ssd_i2c_write(dev, saddr, 2, smb_data);
+		if (!ret || -ETIMEDOUT == ret) {
+			break;
+		}
+
+		i++;
+		if (i >= SSD_SMBUS_RETRY_MAX) {
+			break;
+		}
+		msleep(SSD_SMBUS_RETRY_INTERVAL);
+	}
+
+	return ret;
+}
+
+static int ssd_smbus_read_byte(struct ssd_device *dev, uint8_t saddr, uint8_t cmd, uint8_t *buf)
+{
+	uint8_t smb_data[SSD_SMBUS_DATA_MAX] = {0};
+	int i = 0;
+	int ret = 0;
+
+	smb_data[0] = cmd;
+
+	for (;;) {
+		ret = ssd_i2c_write_read(dev, saddr, 1, smb_data, 1, buf);
+		if (!ret || -ETIMEDOUT == ret) {
+			break;
+		}
+
+		i++;
+		if (i >= SSD_SMBUS_RETRY_MAX) {
+			break;
+		}
+		msleep(SSD_SMBUS_RETRY_INTERVAL);
+	}
+
+	return ret;
+}
+
+static int ssd_smbus_write_word(struct ssd_device *dev, uint8_t saddr, uint8_t cmd, uint8_t *buf)
+{
+	uint8_t smb_data[SSD_SMBUS_DATA_MAX] = {0};
+	int i = 0;
+	int ret = 0;
+
+	smb_data[0] = cmd;
+	memcpy((smb_data + 1), buf, 2);
+
+	for (;;) {
+		ret = ssd_i2c_write(dev, saddr, 3, smb_data);
+		if (!ret || -ETIMEDOUT == ret) {
+			break;
+		}
+
+		i++;
+		if (i >= SSD_SMBUS_RETRY_MAX) {
+			break;
+		}
+		msleep(SSD_SMBUS_RETRY_INTERVAL);
+	}
+
+	return ret;
+}
+
+static int ssd_smbus_read_word(struct ssd_device *dev, uint8_t saddr, uint8_t cmd, uint8_t *buf)
+{
+	uint8_t smb_data[SSD_SMBUS_DATA_MAX] = {0};
+	int i = 0;
+	int ret = 0;
+
+	smb_data[0] = cmd;
+
+	for (;;) {
+		ret = ssd_i2c_write_read(dev, saddr, 1, smb_data, 2, buf);
+		if (!ret || -ETIMEDOUT == ret) {
+			break;
+		}
+
+		i++;
+		if (i >= SSD_SMBUS_RETRY_MAX) {
+			break;
+		}
+		msleep(SSD_SMBUS_RETRY_INTERVAL);
+	}
+
+	return ret;
+}
+
+static int ssd_smbus_write_block(struct ssd_device *dev, uint8_t saddr, uint8_t cmd, uint8_t size, uint8_t *buf)
+{
+	uint8_t smb_data[SSD_SMBUS_DATA_MAX] = {0};
+	int i = 0;
+	int ret = 0;
+
+	smb_data[0] = cmd;
+	smb_data[1] = size;
+	memcpy((smb_data + 2), buf, size);
+
+	for (;;) {
+		ret = ssd_i2c_write(dev, saddr, (2 + size), smb_data);
+		if (!ret || -ETIMEDOUT == ret) {
+			break;
+		}
+
+		i++;
+		if (i >= SSD_SMBUS_RETRY_MAX) {
+			break;
+		}
+		msleep(SSD_SMBUS_RETRY_INTERVAL);
+	}
+
+	return ret;
+}
+
+static int ssd_smbus_read_block(struct ssd_device *dev, uint8_t saddr, uint8_t cmd, uint8_t size, uint8_t *buf)
+{
+	uint8_t smb_data[SSD_SMBUS_DATA_MAX] = {0};
+	uint8_t rsize;
+	int i = 0;
+	int ret = 0;
+
+	smb_data[0] = cmd;
+
+	for (;;) {
+		ret = ssd_i2c_write_read(dev, saddr, 1, smb_data, (SSD_SMBUS_BLOCK_MAX + 1), (smb_data + 1));
+		if (!ret || -ETIMEDOUT == ret) {
+			break;
+		}
+
+		i++;
+		if (i >= SSD_SMBUS_RETRY_MAX) {
+			break;
+		}
+		msleep(SSD_SMBUS_RETRY_INTERVAL);
+	}
+	if (ret) {
+		return ret;
+	}
+
+	rsize = smb_data[1];
+
+	if (rsize > size ) {
+		rsize = size;
+	}
+
+	memcpy(buf, (smb_data + 2), rsize);
+
+	return 0;
+}
+
+
+static int ssd_gen_swlog(struct ssd_device *dev, uint16_t event, uint32_t data);
+
+/* sensor */
+static int ssd_init_lm75(struct ssd_device *dev, uint8_t saddr)
+{
+	uint8_t conf = 0;
+	int ret = 0;
+
+	ret = ssd_smbus_read_byte(dev, saddr, SSD_LM75_REG_CONF, &conf);
+	if (ret) {
+		goto out;
+	}
+
+	conf &= (uint8_t)(~1u);
+
+	ret = ssd_smbus_write_byte(dev, saddr, SSD_LM75_REG_CONF, &conf);
+	if (ret) {
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_lm75_read(struct ssd_device *dev, uint8_t saddr, uint16_t *data)
+{
+	uint16_t val = 0;
+	int ret;
+
+	ret = ssd_smbus_read_word(dev, saddr, SSD_LM75_REG_TEMP, (uint8_t *)&val);
+	if (ret) {
+		return ret;
+	}
+
+	*data = u16_swap(val);
+
+	return 0;
+}
+
+static int ssd_init_lm80(struct ssd_device *dev, uint8_t saddr)
+{
+	uint8_t val;
+	uint8_t low, high;
+	int i;
+	int ret = 0;
+
+	/* init */
+	val = 0x80;
+	ret = ssd_smbus_write_byte(dev, saddr, SSD_LM80_REG_CONFIG, &val);
+	if (ret) {
+		goto out;
+	}
+
+	/* 11-bit temp */
+	val = 0x08;
+	ret = ssd_smbus_write_byte(dev, saddr, SSD_LM80_REG_RES, &val);
+	if (ret) {
+		goto out;
+	}
+
+	/* set volt limit */
+	for (i=0; i<SSD_LM80_IN_NR; i++) {
+		high = ssd_lm80_limit[i].high;
+		low = ssd_lm80_limit[i].low;
+
+		if (SSD_LM80_IN_CAP == i) {
+			low = 0;
+		}
+
+		if (dev->hw_info.nr_ctrl <= 1 && SSD_LM80_IN_1V2 == i) {
+			high = 0xFF;
+			low = 0;
+		}
+
+		/* high limit */
+		ret = ssd_smbus_write_byte(dev, saddr, SSD_LM80_REG_IN_MAX(i), &high);
+		if (ret) {
+			goto out;
+		}
+
+		/* low limit*/
+		ret = ssd_smbus_write_byte(dev, saddr, SSD_LM80_REG_IN_MIN(i), &low);
+		if (ret) {
+			goto out;
+		}
+	}
+
+	/* set interrupt mask: allow volt in interrupt except cap in*/
+	val = 0x81;
+	ret = ssd_smbus_write_byte(dev, saddr, SSD_LM80_REG_MASK1, &val);
+	if (ret) {
+		goto out;
+	}
+
+	/* set interrupt mask: disable others */
+	val = 0xFF;
+	ret = ssd_smbus_write_byte(dev, saddr, SSD_LM80_REG_MASK2, &val);
+	if (ret) {
+		goto out;
+	}
+
+	/* start */
+	val = 0x03;
+	ret = ssd_smbus_write_byte(dev, saddr, SSD_LM80_REG_CONFIG, &val);
+	if (ret) {
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_lm80_enable_in(struct ssd_device *dev, uint8_t saddr, int idx)
+{
+	uint8_t val = 0;
+	int ret = 0;
+
+	if (idx >= SSD_LM80_IN_NR || idx < 0) {
+		return -EINVAL;
+	}
+
+	ret = ssd_smbus_read_byte(dev, saddr, SSD_LM80_REG_MASK1, &val);
+	if (ret) {
+		goto out;
+	}
+
+	val &= ~(1UL << (uint32_t)idx);
+
+	ret = ssd_smbus_write_byte(dev, saddr, SSD_LM80_REG_MASK1, &val);
+	if (ret) {
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_lm80_disable_in(struct ssd_device *dev, uint8_t saddr, int idx)
+{
+	uint8_t val = 0;
+	int ret = 0;
+
+	if (idx >= SSD_LM80_IN_NR || idx < 0) {
+		return -EINVAL;
+	}
+
+	ret = ssd_smbus_read_byte(dev, saddr, SSD_LM80_REG_MASK1, &val);
+	if (ret) {
+		goto out;
+	}
+
+	val |= (1UL << (uint32_t)idx);
+
+	ret = ssd_smbus_write_byte(dev, saddr, SSD_LM80_REG_MASK1, &val);
+	if (ret) {
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_lm80_read_temp(struct ssd_device *dev, uint8_t saddr, uint16_t *data)
+{
+	uint16_t val = 0;
+	int ret;
+
+	ret = ssd_smbus_read_word(dev, saddr, SSD_LM80_REG_TEMP, (uint8_t *)&val);
+	if (ret) {
+		return ret;
+	}
+
+	*data = u16_swap(val);
+
+	return 0;
+}
+
+static int ssd_lm80_check_event(struct ssd_device *dev, uint8_t saddr)
+{
+	uint32_t volt;
+	uint16_t val = 0, status;
+	uint8_t alarm1 = 0, alarm2 = 0;
+	int i;
+	int ret = 0;
+
+	/* read interrupt status to clear interrupt */
+	ret = ssd_smbus_read_byte(dev, saddr, SSD_LM80_REG_ALARM1, &alarm1);
+	if (ret) {
+		goto out;
+	}
+
+	ret = ssd_smbus_read_byte(dev, saddr, SSD_LM80_REG_ALARM2, &alarm2);
+	if (ret) {
+		goto out;
+	}
+
+	status = (uint16_t)alarm1 | ((uint16_t)alarm2 << 8);
+
+	/* parse inetrrupt status */
+	for (i=0; i<SSD_LM80_IN_NR; i++) {
+		if (!((status >> (uint32_t)i) & 0x1)) {
+			if (test_and_clear_bit(SSD_HWMON_LM80(i), &dev->hwmon)) {
+				/* enable INx irq */
+				ret = ssd_lm80_enable_in(dev, saddr, i);
+				if (ret) {
+					goto out;
+				}
+			}
+
+			continue;
+		}
+
+		/* disable INx irq */
+		ret = ssd_lm80_disable_in(dev, saddr, i);
+		if (ret) {
+			goto out;
+		}
+
+		if (test_and_set_bit(SSD_HWMON_LM80(i), &dev->hwmon)) {
+			continue;
+		}
+
+		ret = ssd_smbus_read_word(dev, saddr, SSD_LM80_REG_IN(i), (uint8_t *)&val);
+		if (ret) {
+			goto out;
+		}
+
+		volt = SSD_LM80_CONVERT_VOLT(u16_swap(val));
+
+		switch (i) {
+			case SSD_LM80_IN_CAP: {
+				if (0 == volt) {
+					ssd_gen_swlog(dev, SSD_LOG_CAP_SHORT_CIRCUIT, 0);
+				} else {
+					ssd_gen_swlog(dev, SSD_LOG_CAP_VOLT_FAULT, SSD_PL_CAP_VOLT(volt));
+				}
+				break;
+			}
+
+			case SSD_LM80_IN_1V2:
+			case SSD_LM80_IN_1V2a:
+			case SSD_LM80_IN_1V5:
+			case SSD_LM80_IN_1V8: {
+				ssd_gen_swlog(dev, SSD_LOG_VOLT_STATUS, SSD_VOLT_LOG_DATA(i, 0, volt));
+				break;
+			}
+			case SSD_LM80_IN_FPGA_3V3:
+			case SSD_LM80_IN_3V3: {
+				ssd_gen_swlog(dev, SSD_LOG_VOLT_STATUS, SSD_VOLT_LOG_DATA(i, 0, SSD_LM80_3V3_VOLT(volt)));
+				break;
+			}
+			default:
+				break;
+		}
+	}
+
+out:
+	if (ret) {
+		if (!test_and_set_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM80), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_SENSOR_FAULT, (uint32_t)saddr);
+		}
+	} else {
+		test_and_clear_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM80), &dev->hwmon);
+	}
+	return ret;
+}
+
+static int ssd_init_sensor(struct ssd_device *dev)
+{
+	int ret = 0;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		goto out;
+	}
+
+	ret = ssd_init_lm75(dev, SSD_SENSOR_LM75_SADDRESS);
+	if (ret) {
+		hio_warn("%s: init lm75 failed\n", dev->name);
+		if (!test_and_set_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM75), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_SENSOR_FAULT, SSD_SENSOR_LM75_SADDRESS);
+		}
+		goto out;
+	}
+
+	if (dev->hw_info.pcb_ver >= 'B' || dev->hw_info_ext.form_factor == SSD_FORM_FACTOR_HHHL) {
+		ret = ssd_init_lm80(dev, SSD_SENSOR_LM80_SADDRESS);
+		if (ret) {
+			hio_warn("%s: init lm80 failed\n", dev->name);
+			if (!test_and_set_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM80), &dev->hwmon)) {
+				ssd_gen_swlog(dev, SSD_LOG_SENSOR_FAULT, SSD_SENSOR_LM80_SADDRESS);
+			}
+			goto out;
+		}
+	}
+
+out:
+	/* skip error if not in standard mode */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ret = 0;
+	}
+	return ret;
+}
+
+/* board volt */
+static int ssd_mon_boardvolt(struct ssd_device *dev)
+{
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		return 0;
+	}
+
+	if (dev->hw_info_ext.form_factor == SSD_FORM_FACTOR_FHHL && dev->hw_info.pcb_ver < 'B') {
+		return 0;
+	}
+
+	return ssd_lm80_check_event(dev, SSD_SENSOR_LM80_SADDRESS);
+}
+
+/* temperature */
+static int ssd_mon_temp(struct ssd_device *dev)
+{
+	int cur;
+	uint16_t val = 0;
+	int ret = 0;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		return 0;
+	}
+
+	if (dev->hw_info_ext.form_factor == SSD_FORM_FACTOR_FHHL && dev->hw_info.pcb_ver < 'B') {
+		return 0;
+	}
+
+	/* inlet */
+	ret = ssd_lm80_read_temp(dev, SSD_SENSOR_LM80_SADDRESS, &val);
+	if (ret) {
+		if (!test_and_set_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM80), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_SENSOR_FAULT, SSD_SENSOR_LM80_SADDRESS);
+		}
+		goto out;
+	}
+	test_and_clear_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM80), &dev->hwmon);
+
+	cur = SSD_SENSOR_CONVERT_TEMP(val);
+	if (cur >= SSD_INLET_OT_TEMP) {
+		if (!test_and_set_bit(SSD_HWMON_TEMP(SSD_TEMP_INLET), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_INLET_OVER_TEMP, (uint32_t)cur);
+		}
+	} else if(cur < SSD_INLET_OT_HYST) {
+		if (test_and_clear_bit(SSD_HWMON_TEMP(SSD_TEMP_INLET), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_INLET_NORMAL_TEMP, (uint32_t)cur);
+		}
+	}
+
+	/* flash */
+	ret = ssd_lm75_read(dev, SSD_SENSOR_LM75_SADDRESS, &val);
+	if (ret) {
+		if (!test_and_set_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM75), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_SENSOR_FAULT, SSD_SENSOR_LM75_SADDRESS);
+		}
+		goto out;
+	}
+	test_and_clear_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM75), &dev->hwmon);
+
+	cur = SSD_SENSOR_CONVERT_TEMP(val);
+	if (cur >= SSD_FLASH_OT_TEMP) {
+		if (!test_and_set_bit(SSD_HWMON_TEMP(SSD_TEMP_FLASH), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_FLASH_OVER_TEMP, (uint32_t)cur);
+		}
+	} else if(cur < SSD_FLASH_OT_HYST) {
+		if (test_and_clear_bit(SSD_HWMON_TEMP(SSD_TEMP_FLASH), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_FLASH_NORMAL_TEMP, (uint32_t)cur);
+		}
+	}
+
+out:
+	return ret;
+}
+
+/* cmd tag */
+static inline void ssd_put_tag(struct ssd_device *dev, int tag)
+{
+	test_and_clear_bit(tag,  dev->tag_map);
+	wake_up(&dev->tag_wq);
+}
+
+static inline int ssd_get_tag(struct ssd_device *dev, int wait)
+{
+	int tag;
+
+find_tag:
+	while ((tag = find_first_zero_bit(dev->tag_map, dev->hw_info.cmd_fifo_sz)) >= atomic_read(&dev->queue_depth)) {
+		DEFINE_WAIT(__wait);
+
+		if (!wait) {
+			return -1;
+		}
+
+		prepare_to_wait_exclusive(&dev->tag_wq, &__wait, TASK_UNINTERRUPTIBLE);
+		schedule();
+
+		finish_wait(&dev->tag_wq, &__wait);
+	}
+
+	if (test_and_set_bit(tag, dev->tag_map)) {
+		goto find_tag;
+	}
+
+	return tag;
+}
+
+static void ssd_barrier_put_tag(struct ssd_device *dev, int tag)
+{
+	test_and_clear_bit(tag,  dev->tag_map);
+}
+
+static int ssd_barrier_get_tag(struct ssd_device *dev)
+{
+	int tag = 0;
+
+	if (test_and_set_bit(tag, dev->tag_map)) {
+		return -1;
+	}
+
+	return tag;
+}
+
+static void ssd_barrier_end(struct ssd_device *dev)
+{
+	atomic_set(&dev->queue_depth, dev->hw_info.cmd_fifo_sz);
+	wake_up_all(&dev->tag_wq);
+
+	mutex_unlock(&dev->barrier_mutex);
+}
+
+static int ssd_barrier_start(struct ssd_device *dev)
+{
+	int i;
+
+	mutex_lock(&dev->barrier_mutex);
+
+	atomic_set(&dev->queue_depth, 0);
+
+	for (i=0; i<SSD_CMD_TIMEOUT; i++) {
+		if (find_first_bit(dev->tag_map, dev->hw_info.cmd_fifo_sz) >= dev->hw_info.cmd_fifo_sz) {
+			return 0;
+		}
+
+		__set_current_state(TASK_INTERRUPTIBLE);
+		schedule_timeout(1);
+	}
+
+	atomic_set(&dev->queue_depth, dev->hw_info.cmd_fifo_sz);
+	wake_up_all(&dev->tag_wq);
+
+	mutex_unlock(&dev->barrier_mutex);
+
+	return -EBUSY;
+}
+
+static int ssd_busy(struct ssd_device *dev)
+{
+	if (find_first_bit(dev->tag_map, dev->hw_info.cmd_fifo_sz) >= dev->hw_info.cmd_fifo_sz) {
+		return 0;
+	}
+
+	return 1;
+}
+
+static int ssd_wait_io(struct ssd_device *dev)
+{
+	int i;
+
+	for (i=0; i<SSD_CMD_TIMEOUT; i++) {
+		if (find_first_bit(dev->tag_map, dev->hw_info.cmd_fifo_sz) >= dev->hw_info.cmd_fifo_sz) {
+			return 0;
+		}
+
+		__set_current_state(TASK_INTERRUPTIBLE);
+		schedule_timeout(1);
+	}
+
+	return -EBUSY;
+}
+
+#if 0
+static int ssd_in_barrier(struct ssd_device *dev)
+{
+	return (0 == atomic_read(&dev->queue_depth));
+}
+#endif
+
+static void ssd_cleanup_tag(struct ssd_device *dev)
+{
+	kfree(dev->tag_map);
+}
+
+static int ssd_init_tag(struct ssd_device *dev)
+{
+	int nr_ulongs = ALIGN(dev->hw_info.cmd_fifo_sz, BITS_PER_LONG) / BITS_PER_LONG;
+
+	mutex_init(&dev->barrier_mutex);
+
+	atomic_set(&dev->queue_depth, dev->hw_info.cmd_fifo_sz);
+
+	dev->tag_map = kmalloc(nr_ulongs * sizeof(unsigned long), GFP_ATOMIC);
+	if (!dev->tag_map) {
+		return -ENOMEM;
+	}
+
+	memset(dev->tag_map, 0, nr_ulongs * sizeof(unsigned long));
+
+	init_waitqueue_head(&dev->tag_wq);
+
+	return 0;
+}
+
+/* io stat */
+static void ssd_end_io_acct(struct ssd_cmd *cmd)
+{
+	struct ssd_device *dev = cmd->dev;
+	struct bio *bio = cmd->bio;
+	unsigned long dur = jiffies - cmd->start_time;
+	int rw = bio_data_dir(bio);
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3,0,0)) || (defined RHEL_MAJOR && RHEL_MAJOR == 6 && RHEL_MINOR >= 7))
+	int cpu = part_stat_lock();
+	struct hd_struct *part = disk_map_sector_rcu(dev->gd, bio_start(bio));
+	part_round_stats(cpu, part);
+	part_stat_add(cpu, part, ticks[rw], dur);
+	part_dec_in_flight(part, rw);
+	part_stat_unlock();
+#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
+	int cpu = part_stat_lock();
+	struct hd_struct *part = &dev->gd->part0;
+	part_round_stats(cpu, part);
+	part_stat_add(cpu, part, ticks[rw], dur);
+	part_stat_unlock();
+	part->in_flight[rw] = atomic_dec_return(&dev->in_flight[rw]);
+#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,14))
+	preempt_disable();
+	disk_round_stats(dev->gd);
+	preempt_enable();
+	disk_stat_add(dev->gd, ticks[rw], dur);
+	dev->gd->in_flight = atomic_dec_return(&dev->in_flight[0]);
+#else
+	preempt_disable();
+	disk_round_stats(dev->gd);
+	preempt_enable();
+	if (rw == WRITE) {
+		disk_stat_add(dev->gd, write_ticks, dur);
+	} else {
+		disk_stat_add(dev->gd, read_ticks, dur);
+	}
+	dev->gd->in_flight = atomic_dec_return(&dev->in_flight[0]);
+#endif
+}
+
+static void ssd_start_io_acct(struct ssd_cmd *cmd)
+{
+	struct ssd_device *dev = cmd->dev;
+	struct bio *bio = cmd->bio;
+	int rw = bio_data_dir(bio);
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3,0,0)) || (defined RHEL_MAJOR && RHEL_MAJOR == 6 && RHEL_MINOR >= 7))
+	int cpu = part_stat_lock();
+	struct hd_struct *part = disk_map_sector_rcu(dev->gd, bio_start(bio));
+	part_round_stats(cpu, part);
+	part_stat_inc(cpu, part, ios[rw]);
+	part_stat_add(cpu, part, sectors[rw], bio_sectors(bio));
+	part_inc_in_flight(part, rw);
+	part_stat_unlock();
+#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
+	int cpu = part_stat_lock();
+	struct hd_struct *part = &dev->gd->part0;
+	part_round_stats(cpu, part);
+	part_stat_inc(cpu, part, ios[rw]);
+	part_stat_add(cpu, part, sectors[rw], bio_sectors(bio));
+	part_stat_unlock();
+	part->in_flight[rw] = atomic_inc_return(&dev->in_flight[rw]);
+#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,14))
+	preempt_disable();
+	disk_round_stats(dev->gd);
+	preempt_enable();
+	disk_stat_inc(dev->gd, ios[rw]);
+	disk_stat_add(dev->gd, sectors[rw], bio_sectors(bio));
+	dev->gd->in_flight = atomic_inc_return(&dev->in_flight[0]);
+#else
+	preempt_disable();
+	disk_round_stats(dev->gd);
+	preempt_enable();
+	if (rw == WRITE) {
+		disk_stat_inc(dev->gd, writes);
+		disk_stat_add(dev->gd, write_sectors, bio_sectors(bio));
+	} else {
+		disk_stat_inc(dev->gd, reads);
+		disk_stat_add(dev->gd, read_sectors, bio_sectors(bio));
+	}
+	dev->gd->in_flight = atomic_inc_return(&dev->in_flight[0]);
+#endif
+
+	cmd->start_time = jiffies;
+}
+
+/* io */
+static void ssd_queue_bio(struct ssd_device *dev, struct bio *bio)
+{
+	spin_lock(&dev->sendq_lock);
+	ssd_blist_add(&dev->sendq, bio);
+	spin_unlock(&dev->sendq_lock);
+
+	atomic_inc(&dev->in_sendq);
+	wake_up(&dev->send_waitq);
+}
+
+static inline void ssd_end_request(struct ssd_cmd *cmd)
+{
+	struct ssd_device *dev = cmd->dev;
+	struct bio *bio = cmd->bio;
+	int errors = cmd->errors;
+	int tag = cmd->tag;
+
+	if (bio) {
+#if (defined SSD_TRIM && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,36)))
+		if (!(bio->bi_rw & REQ_DISCARD)) {
+			ssd_end_io_acct(cmd);
+			if (!cmd->flag) {
+				pci_unmap_sg(dev->pdev, cmd->sgl, cmd->nsegs, 
+					bio_data_dir(bio) == READ ? PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
+			}
+		}
+#elif (defined SSD_TRIM && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,32)))
+		if (!bio_rw_flagged(bio, BIO_RW_DISCARD)) {
+			ssd_end_io_acct(cmd);
+			if (!cmd->flag) {
+				pci_unmap_sg(dev->pdev, cmd->sgl, cmd->nsegs, 
+					bio_data_dir(bio) == READ ? PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
+			}
+		}
+#else
+		ssd_end_io_acct(cmd);
+
+		if (!cmd->flag) {
+			pci_unmap_sg(dev->pdev, cmd->sgl, cmd->nsegs, 
+				bio_data_dir(bio) == READ ? PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
+		}
+#endif
+
+		cmd->bio = NULL;
+		ssd_put_tag(dev, tag);
+
+		if (SSD_INT_MSIX == dev->int_mode || tag < 16 || errors) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+			bio_endio(bio, errors);
+#else
+			bio_endio(bio, bio->bi_size, errors);
+#endif
+		} else /* if (bio->bi_idx >= bio->bi_vcnt)*/ {
+			spin_lock(&dev->doneq_lock);
+			ssd_blist_add(&dev->doneq, bio);
+			spin_unlock(&dev->doneq_lock);
+
+			atomic_inc(&dev->in_doneq);
+			wake_up(&dev->done_waitq);
+		}
+	} else {
+		if (cmd->waiting) {
+			complete(cmd->waiting);
+		}
+	}
+}
+
+static void ssd_end_timeout_request(struct ssd_cmd *cmd)
+{
+	struct ssd_device *dev = cmd->dev;
+	struct ssd_rw_msg *msg = (struct ssd_rw_msg *)cmd->msg;
+	int i;
+
+	for (i=0; i<dev->nr_queue; i++) {
+		disable_irq(dev->entry[i].vector);
+	}
+
+	atomic_inc(&dev->tocnt);
+	//if (cmd->bio) {
+		hio_err("%s: cmd timeout: tag %d fun %#x\n", dev->name, msg->tag, msg->fun);
+		cmd->errors = -ETIMEDOUT;
+		ssd_end_request(cmd);
+	//}
+
+	for (i=0; i<dev->nr_queue; i++) {
+		enable_irq(dev->entry[i].vector);
+	}
+
+	/* alarm led */
+	ssd_set_alarm(dev);
+}
+
+/* cmd timer */
+static void ssd_cmd_add_timer(struct ssd_cmd *cmd, int timeout, void (*complt)(struct ssd_cmd *))
+{
+	init_timer(&cmd->cmd_timer);
+
+	cmd->cmd_timer.data = (unsigned long)cmd;
+	cmd->cmd_timer.expires = jiffies + timeout;
+	cmd->cmd_timer.function = (void (*)(unsigned long)) complt;
+
+	add_timer(&cmd->cmd_timer);
+}
+
+static int ssd_cmd_del_timer(struct ssd_cmd *cmd)
+{
+	return del_timer(&cmd->cmd_timer);
+}
+
+static void ssd_add_timer(struct timer_list *timer, int timeout, void (*complt)(void *), void *data)
+{
+	init_timer(timer);
+
+	timer->data = (unsigned long)data;
+	timer->expires = jiffies + timeout;
+	timer->function = (void (*)(unsigned long)) complt;
+
+	add_timer(timer);
+}
+
+static int ssd_del_timer(struct timer_list *timer)
+{
+	return del_timer(timer);
+}
+
+static void ssd_cmd_timeout(struct ssd_cmd *cmd)
+{
+	struct ssd_device *dev = cmd->dev;
+	uint32_t msg = *(uint32_t *)cmd->msg;
+
+	ssd_end_timeout_request(cmd);
+
+	ssd_gen_swlog(dev, SSD_LOG_TIMEOUT, msg);
+}
+
+
+static void __ssd_done(unsigned long data)
+{
+	struct ssd_cmd *cmd;
+	LIST_HEAD(localq);
+
+	local_irq_disable();
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,13,0))
+	list_splice_init(&__get_cpu_var(ssd_doneq), &localq);
+#else
+	list_splice_init(this_cpu_ptr(&ssd_doneq), &localq);
+#endif
+	local_irq_enable();
+
+	while (!list_empty(&localq)) {
+		cmd = list_entry(localq.next, struct ssd_cmd, list);
+		list_del_init(&cmd->list);
+
+		ssd_end_request(cmd);
+	}
+}
+
+static void __ssd_done_db(unsigned long data)
+{
+	struct ssd_cmd *cmd;
+	struct ssd_device *dev;
+	struct bio *bio;
+	LIST_HEAD(localq);
+
+	local_irq_disable();
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,13,0))
+	list_splice_init(&__get_cpu_var(ssd_doneq), &localq);
+#else
+	list_splice_init(this_cpu_ptr(&ssd_doneq), &localq);
+#endif
+	local_irq_enable();
+
+	while (!list_empty(&localq)) {
+		cmd = list_entry(localq.next, struct ssd_cmd, list);
+		list_del_init(&cmd->list);
+
+		dev = (struct ssd_device *)cmd->dev;
+		bio = cmd->bio;
+
+		if (bio) {
+			sector_t off = dev->db_info.data.loc.off;
+			uint32_t len = dev->db_info.data.loc.len;
+
+			switch (dev->db_info.type) {
+				case SSD_DEBUG_READ_ERR:
+					if (bio_data_dir(bio) == READ && 
+						!((off + len) <= bio_start(bio) || off >= (bio_start(bio) + bio_sectors(bio)))) {
+						cmd->errors = -EIO;
+					}
+					break;
+				case SSD_DEBUG_WRITE_ERR:
+					if (bio_data_dir(bio) == WRITE && 
+						!((off + len) <= bio_start(bio) || off >= (bio_start(bio) + bio_sectors(bio)))) {
+						cmd->errors = -EROFS;
+					}
+					break;
+				case SSD_DEBUG_RW_ERR:
+					if (!((off + len) <= bio_start(bio) || off >= (bio_start(bio) + bio_sectors(bio)))) {
+						if (bio_data_dir(bio) == READ) {
+							cmd->errors = -EIO;
+						} else {
+							cmd->errors = -EROFS;
+						}
+					}
+					break;
+				default:
+					break;
+			}
+		}
+
+		ssd_end_request(cmd);
+	}
+}
+
+static inline void ssd_done_bh(struct ssd_cmd *cmd)
+{
+	unsigned long flags = 0;
+
+	if (unlikely(!ssd_cmd_del_timer(cmd))) {
+		struct ssd_device *dev = cmd->dev;
+		struct ssd_rw_msg *msg = (struct ssd_rw_msg *)cmd->msg;
+		hio_err("%s: unknown cmd: tag %d fun %#x\n", dev->name, msg->tag, msg->fun);
+
+		/* alarm led */
+		ssd_set_alarm(dev);
+		return;
+	}
+
+	local_irq_save(flags);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,13,0))
+	list_add_tail(&cmd->list, &__get_cpu_var(ssd_doneq));
+	tasklet_hi_schedule(&__get_cpu_var(ssd_tasklet));
+#else
+	list_add_tail(&cmd->list, this_cpu_ptr(&ssd_doneq));
+	tasklet_hi_schedule(this_cpu_ptr(&ssd_tasklet));
+#endif
+	local_irq_restore(flags);
+
+	return;
+}
+
+static inline void ssd_done(struct ssd_cmd *cmd)
+{
+	if (unlikely(!ssd_cmd_del_timer(cmd))) {
+		struct ssd_device *dev = cmd->dev;
+		struct ssd_rw_msg *msg = (struct ssd_rw_msg *)cmd->msg;
+		hio_err("%s: unknown cmd: tag %d fun %#x\n", dev->name, msg->tag, msg->fun);
+
+		/* alarm led */
+		ssd_set_alarm(dev);
+		return;
+	}
+
+	ssd_end_request(cmd);
+
+	return;
+}
+
+static inline void ssd_dispatch_cmd(struct ssd_cmd *cmd)
+{
+	struct ssd_device *dev = (struct ssd_device *)cmd->dev;
+
+	ssd_cmd_add_timer(cmd, SSD_CMD_TIMEOUT, ssd_cmd_timeout);
+
+	spin_lock(&dev->cmd_lock);
+	ssd_reg_write(dev->ctrlp + SSD_REQ_FIFO_REG, cmd->msg_dma);
+	spin_unlock(&dev->cmd_lock);
+}
+
+static inline void ssd_send_cmd(struct ssd_cmd *cmd)
+{
+	struct ssd_device *dev = (struct ssd_device *)cmd->dev;
+
+	ssd_cmd_add_timer(cmd, SSD_CMD_TIMEOUT, ssd_cmd_timeout);
+
+	ssd_reg32_write(dev->ctrlp + SSD_REQ_FIFO_REG, ((uint32_t)cmd->tag | ((uint32_t)cmd->nsegs << 16)));
+}
+
+static inline void ssd_send_cmd_db(struct ssd_cmd *cmd)
+{
+	struct ssd_device *dev = (struct ssd_device *)cmd->dev;
+	struct bio *bio = cmd->bio;
+
+	ssd_cmd_add_timer(cmd, SSD_CMD_TIMEOUT, ssd_cmd_timeout);
+
+	if (bio) {
+		switch (dev->db_info.type) {
+			case SSD_DEBUG_READ_TO:
+				if (bio_data_dir(bio) == READ) {
+					return;
+				}
+				break;
+			case SSD_DEBUG_WRITE_TO:
+				if (bio_data_dir(bio) == WRITE) {
+					return;
+				}
+				break;
+			case SSD_DEBUG_RW_TO:
+				return;
+				break;
+			default:
+				break;
+		}
+	}
+
+	ssd_reg32_write(dev->ctrlp + SSD_REQ_FIFO_REG, ((uint32_t)cmd->tag | ((uint32_t)cmd->nsegs << 16)));
+}
+
+
+/* fixed for BIOVEC_PHYS_MERGEABLE */
+#ifdef SSD_BIOVEC_PHYS_MERGEABLE_FIXED
+#include <linux/bio.h>
+#include <linux/io.h>
+#include <xen/page.h>
+
+static bool xen_biovec_phys_mergeable_fixed(const struct bio_vec *vec1,
+			       const struct bio_vec *vec2)
+{
+	unsigned long mfn1 = pfn_to_mfn(page_to_pfn(vec1->bv_page));
+	unsigned long mfn2 = pfn_to_mfn(page_to_pfn(vec2->bv_page));
+
+	return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
+		((mfn1 == mfn2) || ((mfn1+1) == mfn2));
+}
+
+#ifdef BIOVEC_PHYS_MERGEABLE
+#undef BIOVEC_PHYS_MERGEABLE
+#endif
+#define BIOVEC_PHYS_MERGEABLE(vec1, vec2)				\
+	(__BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&				\
+	 (!xen_domain() || xen_biovec_phys_mergeable_fixed(vec1, vec2)))
+
+#endif
+
+static inline int ssd_bio_map_sg(struct ssd_device *dev, struct bio *bio, struct scatterlist *sgl)
+{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0))
+	struct bio_vec *bvec, *bvprv = NULL;
+	struct scatterlist *sg = NULL;
+	int i = 0, nsegs = 0;
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,23))
+	sg_init_table(sgl, dev->hw_info.cmd_max_sg);
+#endif
+
+	/*
+	* for each segment in bio
+	*/
+	bio_for_each_segment(bvec, bio, i) {
+		if (bvprv && BIOVEC_PHYS_MERGEABLE(bvprv, bvec)) {
+			sg->length += bvec->bv_len;
+		} else {
+			if (unlikely(nsegs >= (int)dev->hw_info.cmd_max_sg)) {
+				break;
+			}
+
+			sg = sg ? (sg + 1) : sgl;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+			sg_set_page(sg, bvec->bv_page, bvec->bv_len, bvec->bv_offset);
+#else
+			sg->page = bvec->bv_page;
+			sg->length = bvec->bv_len;
+			sg->offset = bvec->bv_offset;
+#endif
+			nsegs++;
+		}
+		bvprv = bvec;
+	}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+	if (sg) {
+		sg_mark_end(sg);
+	}
+#endif
+
+	bio->bi_idx = i;
+
+	return nsegs;
+#else
+	struct bio_vec bvec, bvprv;
+	struct bvec_iter iter;
+	struct scatterlist *sg = NULL;
+	int nsegs = 0;
+	int first = 1;
+
+	sg_init_table(sgl, dev->hw_info.cmd_max_sg);
+
+	/*
+	* for each segment in bio
+	*/
+	bio_for_each_segment(bvec, bio, iter) {
+		if (!first && BIOVEC_PHYS_MERGEABLE(&bvprv, &bvec)) {
+			sg->length += bvec.bv_len;
+		} else {
+			if (unlikely(nsegs >= (int)dev->hw_info.cmd_max_sg)) {
+				break;
+			}
+
+			sg = sg ? (sg + 1) : sgl;
+
+			sg_set_page(sg, bvec.bv_page, bvec.bv_len, bvec.bv_offset);
+
+			nsegs++;
+			first = 0;
+		}
+		bvprv = bvec;
+	}
+
+	if (sg) {
+		sg_mark_end(sg);
+	}
+
+	return nsegs;
+#endif
+}
+
+
+static int __ssd_submit_pbio(struct ssd_device *dev, struct bio *bio, int wait)
+{
+	struct ssd_cmd *cmd;
+	struct ssd_rw_msg *msg;
+	struct ssd_sg_entry *sge;
+	sector_t block = bio_start(bio);
+	int tag;
+	int i;
+
+	tag = ssd_get_tag(dev, wait);
+	if (tag < 0) {
+		return -EBUSY;
+	}
+
+	cmd = &dev->cmd[tag];
+	cmd->bio = bio;
+	cmd->flag = 1;
+
+	msg = (struct ssd_rw_msg *)cmd->msg;
+
+#if (defined SSD_TRIM && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,36)))
+	if (bio->bi_rw & REQ_DISCARD) {
+		unsigned int length = bio_sectors(bio);
+
+		//printk(KERN_WARNING "%s: discard len %u, block %llu\n", dev->name, bio_sectors(bio), block);
+		msg->tag = tag;
+		msg->fun = SSD_FUNC_TRIM;
+
+		sge = msg->sge;
+		for (i=0; i<(dev->hw_info.cmd_max_sg); i++) {
+			sge->block = block;
+			sge->length = (length >= dev->hw_info.sg_max_sec) ? dev->hw_info.sg_max_sec : length;
+			sge->buf = 0;
+
+			block += sge->length;
+			length -= sge->length;
+			sge++;
+
+			if (length <= 0) {
+				break;
+			}
+		}
+		msg->nsegs = cmd->nsegs = (i + 1);
+
+		dev->scmd(cmd);
+		return 0;
+	}
+#elif (defined SSD_TRIM && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,32)))
+	if (bio_rw_flagged(bio, BIO_RW_DISCARD)) {
+		unsigned int length = bio_sectors(bio);
+
+		//printk(KERN_WARNING "%s: discard len %u, block %llu\n", dev->name, bio_sectors(bio), block);
+		msg->tag = tag;
+		msg->fun = SSD_FUNC_TRIM;
+
+		sge = msg->sge;
+		for (i=0; i<(dev->hw_info.cmd_max_sg); i++) {
+			sge->block = block;
+			sge->length = (length >= dev->hw_info.sg_max_sec) ? dev->hw_info.sg_max_sec : length;
+			sge->buf = 0;
+
+			block += sge->length;
+			length -= sge->length;
+			sge++;
+
+			if (length <= 0) {
+				break;
+			}
+		}
+		msg->nsegs = cmd->nsegs = (i + 1);
+
+		dev->scmd(cmd);
+		return 0;
+	}
+#endif
+
+	//msg->nsegs = cmd->nsegs = ssd_bio_map_sg(dev, bio, sgl);
+	msg->nsegs = cmd->nsegs = bio->bi_vcnt;
+
+	//xx
+	if (bio_data_dir(bio) == READ) {
+		msg->fun = SSD_FUNC_READ;
+		msg->flag = 0;
+	} else {
+		msg->fun = SSD_FUNC_WRITE;
+		msg->flag = dev->wmode;
+	}
+
+	sge = msg->sge;
+	for (i=0; i<bio->bi_vcnt; i++) {
+		sge->block = block;
+		sge->length = bio->bi_io_vec[i].bv_len >> 9;
+		sge->buf = (uint64_t)((void *)bio->bi_io_vec[i].bv_page + bio->bi_io_vec[i].bv_offset);
+
+		block += sge->length;
+		sge++;
+	}
+
+	msg->tag = tag;
+
+#ifdef SSD_OT_PROTECT
+	if (unlikely(dev->ot_delay > 0 && dev->ot_protect != 0)) {
+		msleep_interruptible(dev->ot_delay);
+	}
+#endif
+
+	ssd_start_io_acct(cmd);
+	dev->scmd(cmd);
+
+	return 0;
+}
+
+static inline int ssd_submit_bio(struct ssd_device *dev, struct bio *bio, int wait)
+{
+	struct ssd_cmd *cmd;
+	struct ssd_rw_msg *msg;
+	struct ssd_sg_entry *sge;
+	struct scatterlist *sgl;
+	sector_t block = bio_start(bio);
+	int tag;
+	int i;
+
+	tag = ssd_get_tag(dev, wait);
+	if (tag < 0) {
+		return -EBUSY;
+	}
+
+	cmd = &dev->cmd[tag];
+	cmd->bio = bio;
+	cmd->flag = 0;
+
+	msg = (struct ssd_rw_msg *)cmd->msg;
+
+	sgl = cmd->sgl;
+
+#if (defined SSD_TRIM && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,36)))
+	if (bio->bi_rw & REQ_DISCARD) {
+		unsigned int length = bio_sectors(bio);
+
+		//printk(KERN_WARNING "%s: discard len %u, block %llu\n", dev->name, bio_sectors(bio), block);
+		msg->tag = tag;
+		msg->fun = SSD_FUNC_TRIM;
+
+		sge = msg->sge;
+		for (i=0; i<(dev->hw_info.cmd_max_sg); i++) {
+			sge->block = block;
+			sge->length = (length >= dev->hw_info.sg_max_sec) ? dev->hw_info.sg_max_sec : length;
+			sge->buf = 0;
+
+			block += sge->length;
+			length -= sge->length;
+			sge++;
+
+			if (length <= 0) {
+				break;
+			}
+		}
+		msg->nsegs = cmd->nsegs = (i + 1);
+
+		dev->scmd(cmd);
+		return 0;
+	}
+#elif (defined SSD_TRIM && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,32)))
+	if (bio_rw_flagged(bio, BIO_RW_DISCARD)) {
+		unsigned int length = bio_sectors(bio);
+
+		//printk(KERN_WARNING "%s: discard len %u, block %llu\n", dev->name, bio_sectors(bio), block);
+		msg->tag = tag;
+		msg->fun = SSD_FUNC_TRIM;
+
+		sge = msg->sge;
+		for (i=0; i<(dev->hw_info.cmd_max_sg); i++) {
+			sge->block = block;
+			sge->length = (length >= dev->hw_info.sg_max_sec) ? dev->hw_info.sg_max_sec : length;
+			sge->buf = 0;
+
+			block += sge->length;
+			length -= sge->length;
+			sge++;
+
+			if (length <= 0) {
+				break;
+			}
+		}
+		msg->nsegs = cmd->nsegs = (i + 1);
+
+		dev->scmd(cmd);
+		return 0;
+	}
+#endif
+
+	msg->nsegs = cmd->nsegs = ssd_bio_map_sg(dev, bio, sgl);
+
+	//xx
+	if (bio_data_dir(bio) == READ) {
+		msg->fun = SSD_FUNC_READ;
+		msg->flag = 0;
+		pci_map_sg(dev->pdev, sgl, cmd->nsegs, PCI_DMA_FROMDEVICE);
+	} else {
+		msg->fun = SSD_FUNC_WRITE;
+		msg->flag = dev->wmode;
+		pci_map_sg(dev->pdev, sgl, cmd->nsegs, PCI_DMA_TODEVICE);
+	}
+
+	sge = msg->sge;
+	for (i=0; i<cmd->nsegs; i++) {
+		sge->block = block;
+		sge->length = sg_dma_len(sgl) >> 9;
+		sge->buf = sg_dma_address(sgl);
+
+		block += sge->length;
+		sgl++;
+		sge++;
+	}
+
+	msg->tag = tag;
+
+#ifdef SSD_OT_PROTECT
+	if (unlikely(dev->ot_delay > 0 && dev->ot_protect != 0)) {
+		msleep_interruptible(dev->ot_delay);
+	}
+#endif
+
+	ssd_start_io_acct(cmd);
+	dev->scmd(cmd);
+
+	return 0;
+}
+
+/* threads */
+static int ssd_done_thread(void *data)
+{
+	struct ssd_device *dev;
+	struct bio *bio;
+	struct bio *next;
+#ifdef SSD_ESCAPE_IRQ
+	cpumask_t new_mask;
+#endif
+
+	if (!data) {
+		return -EINVAL;
+	}
+	dev = data;
+
+	//set_user_nice(current, -5);
+
+	while (!kthread_should_stop()) {
+		wait_event_interruptible(dev->done_waitq, (atomic_read(&dev->in_doneq) || kthread_should_stop()));
+
+		while (atomic_read(&dev->in_doneq)) {
+			if (threaded_irq) {
+				spin_lock(&dev->doneq_lock);
+				bio = ssd_blist_get(&dev->doneq);
+				spin_unlock(&dev->doneq_lock);
+			} else {
+				spin_lock_irq(&dev->doneq_lock);
+				bio = ssd_blist_get(&dev->doneq);
+				spin_unlock_irq(&dev->doneq_lock);
+			}
+
+			while (bio) {
+				next = bio->bi_next;
+				bio->bi_next = NULL;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+				bio_endio(bio, 0);
+#else
+				bio_endio(bio, bio->bi_size, 0);
+#endif
+				atomic_dec(&dev->in_doneq);
+				bio = next;
+			}
+
+			cond_resched();
+
+#ifdef SSD_ESCAPE_IRQ
+			if (unlikely(smp_processor_id() == dev->irq_cpu)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28))
+				cpumask_setall(&new_mask);
+				cpumask_clear_cpu(dev->irq_cpu, &new_mask);
+				set_cpus_allowed_ptr(current, &new_mask);
+#else
+				cpus_setall(new_mask);
+				cpu_clear(dev->irq_cpu, new_mask);
+				set_cpus_allowed(current, new_mask);
+#endif
+			}
+#endif
+		}
+	}
+	return 0;
+}
+
+static int ssd_send_thread(void *data)
+{
+	struct ssd_device *dev;
+	struct bio *bio;
+	struct bio *next;
+#ifdef SSD_ESCAPE_IRQ
+	cpumask_t new_mask;
+#endif
+
+	if (!data) {
+		return -EINVAL;
+	}
+	dev = data;
+
+	//set_user_nice(current, -5);
+
+	while (!kthread_should_stop()) {
+		wait_event_interruptible(dev->send_waitq, (atomic_read(&dev->in_sendq) || kthread_should_stop()));
+
+		while (atomic_read(&dev->in_sendq)) {
+			spin_lock(&dev->sendq_lock);
+			bio = ssd_blist_get(&dev->sendq);
+			spin_unlock(&dev->sendq_lock);
+
+			while (bio) {
+				next = bio->bi_next;
+				bio->bi_next = NULL;
+#ifdef SSD_QUEUE_PBIO
+				if (test_and_clear_bit(BIO_SSD_PBIO, &bio->bi_flags)) {
+					__ssd_submit_pbio(dev, bio, 1);
+				} else {
+					ssd_submit_bio(dev, bio, 1);
+				}
+#else
+				ssd_submit_bio(dev, bio, 1);
+#endif
+				atomic_dec(&dev->in_sendq);
+				bio = next;
+			}
+
+			cond_resched();
+
+#ifdef SSD_ESCAPE_IRQ
+			if (unlikely(smp_processor_id() == dev->irq_cpu)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28))
+				cpumask_setall(&new_mask);
+				cpumask_clear_cpu(dev->irq_cpu, &new_mask);
+				set_cpus_allowed_ptr(current, &new_mask);
+#else
+				cpus_setall(new_mask);
+				cpu_clear(dev->irq_cpu, new_mask);
+				set_cpus_allowed(current, new_mask);
+#endif
+			}
+#endif
+		}
+	}
+
+	return 0;
+}
+
+static void ssd_cleanup_thread(struct ssd_device *dev)
+{
+	kthread_stop(dev->send_thread);
+	kthread_stop(dev->done_thread);
+}
+
+static int ssd_init_thread(struct ssd_device *dev)
+{
+	int ret;
+
+	atomic_set(&dev->in_doneq, 0);
+	atomic_set(&dev->in_sendq, 0);
+
+	spin_lock_init(&dev->doneq_lock);
+	spin_lock_init(&dev->sendq_lock);
+
+	ssd_blist_init(&dev->doneq);
+	ssd_blist_init(&dev->sendq);
+
+	init_waitqueue_head(&dev->done_waitq);
+	init_waitqueue_head(&dev->send_waitq);
+
+	dev->done_thread = kthread_run(ssd_done_thread, dev, "%s/d", dev->name);
+	if (IS_ERR(dev->done_thread)) {
+		ret = PTR_ERR(dev->done_thread);
+		goto out_done_thread;
+	}
+
+	dev->send_thread = kthread_run(ssd_send_thread, dev, "%s/s", dev->name);
+	if (IS_ERR(dev->send_thread)) {
+		ret = PTR_ERR(dev->send_thread);
+		goto out_send_thread;
+	}
+
+	return 0;
+
+out_send_thread:
+	kthread_stop(dev->done_thread);
+out_done_thread:
+	return ret;
+}
+
+/* dcmd pool */
+static void ssd_put_dcmd(struct ssd_dcmd *dcmd)
+{
+	struct ssd_device *dev = (struct ssd_device *)dcmd->dev;
+
+	spin_lock(&dev->dcmd_lock);
+	list_add_tail(&dcmd->list, &dev->dcmd_list);
+	spin_unlock(&dev->dcmd_lock);
+}
+
+static struct ssd_dcmd *ssd_get_dcmd(struct ssd_device *dev)
+{
+	struct ssd_dcmd *dcmd = NULL;
+
+	spin_lock(&dev->dcmd_lock);
+	if (!list_empty(&dev->dcmd_list)) {
+		dcmd = list_entry(dev->dcmd_list.next, 
+				 struct ssd_dcmd, list);
+		list_del_init(&dcmd->list);
+	}
+	spin_unlock(&dev->dcmd_lock);
+
+	return dcmd;
+}
+
+static void ssd_cleanup_dcmd(struct ssd_device *dev)
+{
+	kfree(dev->dcmd);
+}
+
+static int ssd_init_dcmd(struct ssd_device *dev)
+{
+	struct ssd_dcmd *dcmd;
+	int dcmd_sz = sizeof(struct ssd_dcmd)*dev->hw_info.cmd_fifo_sz;
+	int i;
+
+	spin_lock_init(&dev->dcmd_lock);
+	INIT_LIST_HEAD(&dev->dcmd_list);
+	init_waitqueue_head(&dev->dcmd_wq);
+
+	dev->dcmd = kmalloc(dcmd_sz, GFP_KERNEL);
+	if (!dev->dcmd) {
+		hio_warn("%s: can not alloc dcmd\n", dev->name);
+		goto out_alloc_dcmd;
+	}
+	memset(dev->dcmd, 0, dcmd_sz);
+
+	for (i=0, dcmd=dev->dcmd; i<(int)dev->hw_info.cmd_fifo_sz; i++, dcmd++) {
+		dcmd->dev = dev;
+		INIT_LIST_HEAD(&dcmd->list);
+		list_add_tail(&dcmd->list, &dev->dcmd_list);
+	}
+
+	return 0;
+
+out_alloc_dcmd:
+	return -ENOMEM;
+}
+
+static void ssd_put_dmsg(void *msg)
+{
+	struct ssd_dcmd *dcmd = container_of(msg, struct ssd_dcmd, msg);
+	struct ssd_device *dev = (struct ssd_device *)dcmd->dev;
+
+	memset(dcmd->msg, 0, SSD_DCMD_MAX_SZ);
+	ssd_put_dcmd(dcmd);
+	wake_up(&dev->dcmd_wq);
+}
+
+static void *ssd_get_dmsg(struct ssd_device *dev)
+{
+	struct ssd_dcmd *dcmd = ssd_get_dcmd(dev);
+
+	while (!dcmd) {
+		DEFINE_WAIT(wait);
+		prepare_to_wait_exclusive(&dev->dcmd_wq, &wait, TASK_UNINTERRUPTIBLE);
+		schedule();
+
+		dcmd = ssd_get_dcmd(dev);
+
+		finish_wait(&dev->dcmd_wq, &wait);
+	}
+	return dcmd->msg;
+}
+
+/* do direct cmd */
+static int ssd_do_request(struct ssd_device *dev, int rw, void *msg, int *done)
+{
+	DECLARE_COMPLETION(wait);
+	struct ssd_cmd *cmd;
+	int tag;
+	int ret = 0;
+
+	tag = ssd_get_tag(dev, 1);
+	if (tag < 0) {
+		return -EBUSY;
+	}
+
+	cmd = &dev->cmd[tag];
+	cmd->nsegs = 1;
+	memcpy(cmd->msg, msg, SSD_DCMD_MAX_SZ);
+	((struct ssd_rw_msg *)cmd->msg)->tag = tag;
+
+	cmd->waiting = &wait;
+
+	dev->scmd(cmd);
+
+	wait_for_completion(cmd->waiting);
+	cmd->waiting = NULL;
+
+	if (cmd->errors == -ETIMEDOUT) {
+		ret = cmd->errors;
+	} else if (cmd->errors) {
+		ret = -EIO;
+	}
+
+	if (done != NULL) {
+		*done = cmd->nr_log;
+	}
+	ssd_put_tag(dev, cmd->tag);
+
+	return ret;
+}
+
+static int ssd_do_barrier_request(struct ssd_device *dev, int rw, void *msg, int *done)
+{
+	DECLARE_COMPLETION(wait);
+	struct ssd_cmd *cmd;
+	int tag;
+	int ret = 0;
+
+	tag = ssd_barrier_get_tag(dev);
+	if (tag < 0) {
+		return -EBUSY;
+	}
+
+	cmd = &dev->cmd[tag];
+	cmd->nsegs = 1;
+	memcpy(cmd->msg, msg, SSD_DCMD_MAX_SZ);
+	((struct ssd_rw_msg *)cmd->msg)->tag = tag;
+
+	cmd->waiting = &wait;
+
+	dev->scmd(cmd);
+
+	wait_for_completion(cmd->waiting);
+	cmd->waiting = NULL;
+
+	if (cmd->errors == -ETIMEDOUT) {
+		ret = cmd->errors;
+	} else if (cmd->errors) {
+		ret = -EIO;
+	}
+
+	if (done != NULL) {
+		*done = cmd->nr_log;
+	}
+	ssd_barrier_put_tag(dev, cmd->tag);
+
+	return ret;
+}
+
+#ifdef SSD_OT_PROTECT
+static void ssd_check_temperature(struct ssd_device *dev, int temp)
+{
+	uint64_t val;
+	uint32_t off;
+	int cur;
+	int i;
+
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		return;
+	}
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+	}
+
+	for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+		off = SSD_CTRL_TEMP_REG0 + i * sizeof(uint64_t);
+
+		val = ssd_reg_read(dev->ctrlp + off);
+		if (val == 0xffffffffffffffffull) {
+			continue;
+		}
+
+		cur = (int)CUR_TEMP(val);
+		if (cur >= temp) {
+			if (!test_and_set_bit(SSD_HWMON_TEMP(SSD_TEMP_CTRL), &dev->hwmon)) {
+				if (dev->protocol_info.ver > SSD_PROTOCOL_V3 && dev->protocol_info.ver < SSD_PROTOCOL_V3_2_2) {
+					hio_warn("%s: Over temperature, please check the fans.\n", dev->name);
+					dev->ot_delay = SSD_OT_DELAY;
+				}
+			}
+			return;
+		}
+	}
+
+	if (test_and_clear_bit(SSD_HWMON_TEMP(SSD_TEMP_CTRL), &dev->hwmon)) {
+		if (dev->protocol_info.ver > SSD_PROTOCOL_V3 && dev->protocol_info.ver < SSD_PROTOCOL_V3_2_2) {
+			hio_warn("%s: Temperature is OK.\n", dev->name);
+			dev->ot_delay = 0;
+		}
+	}
+}
+#endif
+
+static int ssd_get_ot_status(struct ssd_device *dev, int *status)
+{
+	uint32_t off;
+	uint32_t val;
+	int i;
+
+	if (!dev || !status) {
+		return -EINVAL;
+	}
+
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2_2) {
+		for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+			off = SSD_READ_OT_REG0 + (i * SSD_CTRL_REG_ZONE_SZ);
+			val = ssd_reg32_read(dev->ctrlp + off);
+			if ((val >> 22) & 0x1) {
+				*status = 1;
+				goto out;
+			}
+
+			
+			off = SSD_WRITE_OT_REG0 + (i * SSD_CTRL_REG_ZONE_SZ);
+			val = ssd_reg32_read(dev->ctrlp + off);
+			if ((val >> 22) & 0x1) {
+				*status = 1;
+				goto out;
+			}
+		}
+	} else {
+		*status = !!dev->ot_delay;
+	}
+
+out:
+	return 0;
+}
+
+static void ssd_set_ot_protect(struct ssd_device *dev, int protect)
+{
+	uint32_t off;
+	uint32_t val;
+	int i;
+	
+	mutex_lock(&dev->fw_mutex);
+
+	dev->ot_protect = !!protect;
+
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2_2) {
+		for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+			off = SSD_READ_OT_REG0 + (i * SSD_CTRL_REG_ZONE_SZ);
+			val = ssd_reg32_read(dev->ctrlp + off);
+			if (dev->ot_protect) {
+				val |= (1U << 21);
+			} else {
+				val &= ~(1U << 21);
+			}
+			ssd_reg32_write(dev->ctrlp + off, val);
+
+			
+			off = SSD_WRITE_OT_REG0 + (i * SSD_CTRL_REG_ZONE_SZ);
+			val = ssd_reg32_read(dev->ctrlp + off);
+			if (dev->ot_protect) {
+				val |= (1U << 21);
+			} else {
+				val &= ~(1U << 21);
+			}
+			ssd_reg32_write(dev->ctrlp + off, val);
+		}
+	}
+
+	mutex_unlock(&dev->fw_mutex);
+}
+
+static int ssd_init_ot_protect(struct ssd_device *dev)
+{
+	ssd_set_ot_protect(dev, ot_protect);
+
+#ifdef SSD_OT_PROTECT
+	ssd_check_temperature(dev, SSD_OT_TEMP);
+#endif
+
+	return 0;
+}
+
+/* log */
+static int ssd_read_log(struct ssd_device *dev, int ctrl_idx, void *buf, int *nr_log)
+{
+	struct ssd_log_op_msg *msg;
+	struct ssd_log_msg *lmsg;
+	dma_addr_t buf_dma;
+	size_t length = dev->hw_info.log_sz;
+	int ret = 0;
+
+	if (ctrl_idx >= dev->hw_info.nr_ctrl) {
+		return -EINVAL;
+	}
+
+	buf_dma = pci_map_single(dev->pdev, buf, length, PCI_DMA_FROMDEVICE);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,26))
+	ret = dma_mapping_error(buf_dma);
+#else
+	ret = dma_mapping_error(&(dev->pdev->dev), buf_dma);
+#endif
+	if (ret) {
+		hio_warn("%s: unable to map read DMA buffer\n", dev->name);
+		goto out_dma_mapping;
+	}
+
+	msg = (struct ssd_log_op_msg *)ssd_get_dmsg(dev);
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		lmsg = (struct ssd_log_msg *)msg;
+		lmsg->fun = SSD_FUNC_READ_LOG;
+		lmsg->ctrl_idx = ctrl_idx;
+		lmsg->buf = buf_dma;
+	} else {
+		msg->fun = SSD_FUNC_READ_LOG;
+		msg->ctrl_idx = ctrl_idx;
+		msg->buf = buf_dma;
+	}
+
+	ret = ssd_do_request(dev, READ, msg, nr_log);
+	ssd_put_dmsg(msg);
+
+	pci_unmap_single(dev->pdev, buf_dma, length, PCI_DMA_FROMDEVICE);
+
+out_dma_mapping:
+	 return ret;
+}
+
+#define SSD_LOG_PRINT_BUF_SZ	256
+static int ssd_parse_log(struct ssd_device *dev, struct ssd_log *log, int print)
+{
+	struct ssd_log_desc *log_desc = ssd_log_desc;
+	struct ssd_log_entry *le;
+	char *sn = NULL;
+	char print_buf[SSD_LOG_PRINT_BUF_SZ];
+	int print_len;
+
+	le = &log->le;
+
+	/* find desc */
+	while (log_desc->event != SSD_UNKNOWN_EVENT) {
+		if (log_desc->event == le->event) {
+			break;
+		}
+		log_desc++;
+	}
+
+	if (!print) {
+		goto out;
+	}
+
+	if (log_desc->level < log_level) {
+		goto out;
+	}
+
+	/* parse */
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		sn = dev->label.sn;
+	} else {
+		sn = dev->labelv3.barcode;
+	}
+
+	print_len = snprintf(print_buf, SSD_LOG_PRINT_BUF_SZ, "%s (%s): <%#x>", dev->name, sn, le->event);
+
+	if (log->ctrl_idx != SSD_LOG_SW_IDX) {
+	 	print_len += snprintf((print_buf + print_len), (SSD_LOG_PRINT_BUF_SZ - print_len), " controller %d", log->ctrl_idx);
+	}
+
+	switch (log_desc->data) {
+		case SSD_LOG_DATA_NONE:
+			break;
+		case SSD_LOG_DATA_LOC:
+			if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+				print_len += snprintf((print_buf + print_len), (SSD_LOG_PRINT_BUF_SZ - print_len), " flash %d", le->data.loc.flash);
+				if (log_desc->sblock) {
+					print_len += snprintf((print_buf + print_len), (SSD_LOG_PRINT_BUF_SZ - print_len), " block %d", le->data.loc.block);
+				}
+				if (log_desc->spage) {
+					print_len += snprintf((print_buf + print_len), (SSD_LOG_PRINT_BUF_SZ - print_len), " page %d", le->data.loc.page);
+				}
+			} else {
+				print_len += snprintf((print_buf + print_len), (SSD_LOG_PRINT_BUF_SZ - print_len), " flash %d", le->data.loc1.flash);
+				if (log_desc->sblock) {
+					print_len += snprintf((print_buf + print_len), (SSD_LOG_PRINT_BUF_SZ - print_len), " block %d", le->data.loc1.block);
+				}
+				if (log_desc->spage) {
+					print_len += snprintf((print_buf + print_len), (SSD_LOG_PRINT_BUF_SZ - print_len), " page %d", le->data.loc1.page);
+				}
+			}
+			break;
+		case SSD_LOG_DATA_HEX: 
+			print_len += snprintf((print_buf + print_len), (SSD_LOG_PRINT_BUF_SZ - print_len), " info %#x", le->data.val);
+			break;
+		default:
+			break;
+	}
+	/*print_len += */snprintf((print_buf + print_len), (SSD_LOG_PRINT_BUF_SZ - print_len), ": %s", log_desc->desc);
+
+	switch (log_desc->level) {
+		case SSD_LOG_LEVEL_INFO:
+			hio_info("%s\n", print_buf);
+			break;
+		case SSD_LOG_LEVEL_NOTICE:
+			hio_note("%s\n", print_buf);
+			break;
+		case SSD_LOG_LEVEL_WARNING:
+			hio_warn("%s\n", print_buf);
+			break;
+		case SSD_LOG_LEVEL_ERR:
+			hio_err("%s\n", print_buf);
+			//printk(KERN_ERR MODULE_NAME": some exception occurred, please check the data or refer to FAQ.");
+			break;
+		default:
+			hio_warn("%s\n", print_buf);
+			break;
+	}
+
+out:
+	return log_desc->level;
+}
+
+static int ssd_bm_get_sfstatus(struct ssd_device *dev, uint16_t *status);
+static int ssd_switch_wmode(struct ssd_device *dev, int wmode);
+
+
+static int ssd_handle_event(struct ssd_device *dev, uint16_t event, int level)
+{
+	int ret = 0;
+
+	switch (event) {
+		case SSD_LOG_OVER_TEMP: {
+#ifdef SSD_OT_PROTECT
+			if (!test_and_set_bit(SSD_HWMON_TEMP(SSD_TEMP_CTRL), &dev->hwmon)) {
+				if (dev->protocol_info.ver > SSD_PROTOCOL_V3 && dev->protocol_info.ver < SSD_PROTOCOL_V3_2_2) {
+					hio_warn("%s: Over temperature, please check the fans.\n", dev->name);
+					dev->ot_delay = SSD_OT_DELAY;
+				}
+			}
+#endif
+			break;
+		}
+
+		case SSD_LOG_NORMAL_TEMP: {
+#ifdef SSD_OT_PROTECT
+			/* need to check all controller's temperature */
+			ssd_check_temperature(dev, SSD_OT_TEMP_HYST);
+#endif
+			break;
+		}
+
+		case SSD_LOG_BATTERY_FAULT: {
+			uint16_t sfstatus;
+
+			if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+				if (!ssd_bm_get_sfstatus(dev, &sfstatus)) {
+					ssd_gen_swlog(dev, SSD_LOG_BM_SFSTATUS, sfstatus);
+				}
+			}
+
+			if (!test_and_set_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+				ssd_switch_wmode(dev, dev->user_wmode); 
+			}
+			break;
+		}
+
+		case SSD_LOG_BATTERY_OK: {
+			if (test_and_clear_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+				ssd_switch_wmode(dev, dev->user_wmode); 
+			}
+			break;
+		}
+
+		case SSD_LOG_BOARD_VOLT_FAULT: {
+			ssd_mon_boardvolt(dev);
+			break;
+		}
+
+		case SSD_LOG_CLEAR_LOG: {
+			/* update smart */
+			memset(&dev->smart.log_info, 0, sizeof(struct ssd_log_info));
+			break;
+		}
+
+		case SSD_LOG_CAP_VOLT_FAULT: 
+		case SSD_LOG_CAP_LEARN_FAULT: 
+		case SSD_LOG_CAP_SHORT_CIRCUIT: {
+			if (!test_and_set_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+				ssd_switch_wmode(dev, dev->user_wmode); 
+			}
+			break;
+		}
+
+		default:
+			break;
+	}
+
+	/* ssd event call */
+	if (dev->event_call) {
+		dev->event_call(dev->gd, event, level);
+
+		/* FIXME */
+		if (SSD_LOG_CAP_VOLT_FAULT == event || SSD_LOG_CAP_LEARN_FAULT == event || SSD_LOG_CAP_SHORT_CIRCUIT == event) {
+			dev->event_call(dev->gd, SSD_LOG_BATTERY_FAULT, level);
+		}
+	}
+
+	return ret;
+}
+
+static int ssd_save_log(struct ssd_device *dev, struct ssd_log *log)
+{
+	uint32_t off, size;
+	void *internal_log;
+	int ret = 0;
+
+	mutex_lock(&dev->internal_log_mutex);
+
+	size = sizeof(struct ssd_log);
+	off = dev->internal_log.nr_log * size;
+
+	if (off == dev->rom_info.log_sz) {
+		if (dev->internal_log.nr_log == dev->smart.log_info.nr_log) {
+			hio_warn("%s: internal log is full\n", dev->name);
+		}
+		goto out;
+	}
+
+	internal_log = dev->internal_log.log + off;
+	memcpy(internal_log, log, size);
+
+	if (dev->protocol_info.ver > SSD_PROTOCOL_V3) {
+		off += dev->rom_info.log_base;
+
+		ret = ssd_spi_write(dev, log, off, size);
+		if (ret) {
+			goto out;
+		}
+	}
+
+	dev->internal_log.nr_log++;
+
+out:
+	mutex_unlock(&dev->internal_log_mutex);
+	return ret;
+}
+
+static int ssd_save_swlog(struct ssd_device *dev, uint16_t event, uint32_t data)
+{
+	struct ssd_log log;
+	struct timeval tv;
+	int level;
+	int ret = 0;
+
+	if (unlikely(mode != SSD_DRV_MODE_STANDARD))
+		return 0;
+
+	memset(&log, 0, sizeof(struct ssd_log));
+
+	do_gettimeofday(&tv);
+	log.ctrl_idx = SSD_LOG_SW_IDX;
+	log.time = tv.tv_sec;
+	log.le.event = event;
+	log.le.data.val = data;
+
+	level = ssd_parse_log(dev, &log, 0);
+	if (level >= SSD_LOG_LEVEL) {
+		ret = ssd_save_log(dev, &log);
+	}
+
+	/* set alarm */
+	if (SSD_LOG_LEVEL_ERR == level) {
+		ssd_set_alarm(dev);
+	}
+
+	/* update smart */
+	dev->smart.log_info.nr_log++;
+	dev->smart.log_info.stat[level]++;
+
+	/* handle event */
+	ssd_handle_event(dev, event, level);
+
+	return ret;
+}
+
+static int ssd_gen_swlog(struct ssd_device *dev, uint16_t event, uint32_t data)
+{
+	struct ssd_log_entry le;
+	int ret;
+
+	if (unlikely(mode != SSD_DRV_MODE_STANDARD))
+		return 0;
+
+	/* slave port ? */
+	if (dev->slave) {
+		return 0;
+	}
+
+	memset(&le, 0, sizeof(struct ssd_log_entry));
+	le.event = event;
+	le.data.val = data;
+
+	ret = sfifo_put(&dev->log_fifo, &le);
+	if (ret) {
+		return ret;
+	}
+
+	if (test_bit(SSD_INIT_WORKQ, &dev->state)) {
+		queue_work(dev->workq, &dev->log_work);
+	}
+
+	return 0;
+}
+
+static int ssd_do_swlog(struct ssd_device *dev)
+{
+	struct ssd_log_entry le;
+	int ret = 0;
+
+	memset(&le, 0, sizeof(struct ssd_log_entry));
+	while (!sfifo_get(&dev->log_fifo, &le)) {
+		ret = ssd_save_swlog(dev, le.event, le.data.val);
+		if (ret) {
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static int __ssd_clear_log(struct ssd_device *dev)
+{
+	uint32_t off, length;
+	int ret;
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return 0;
+	}
+
+	if (dev->internal_log.nr_log == 0) {
+		return 0;
+	}
+
+	mutex_lock(&dev->internal_log_mutex);
+
+	off = dev->rom_info.log_base;
+	length = dev->rom_info.log_sz;
+
+	ret = ssd_spi_erase(dev, off, length);
+	if (ret) {
+		hio_warn("%s: log erase: failed\n", dev->name);
+		goto out;
+	}
+
+	dev->internal_log.nr_log = 0;
+
+out:
+	mutex_unlock(&dev->internal_log_mutex);
+	return ret;
+}
+
+static int ssd_clear_log(struct ssd_device *dev)
+{
+	int ret;
+
+	ret = __ssd_clear_log(dev);
+	if(!ret) {
+		ssd_gen_swlog(dev, SSD_LOG_CLEAR_LOG, 0);
+	}
+
+	return ret;
+}
+
+static int ssd_do_log(struct ssd_device *dev, int ctrl_idx, void *buf)
+{
+	struct ssd_log_entry *le;
+	struct ssd_log log;
+	struct timeval tv;
+	int nr_log = 0;
+	int level;
+	int ret = 0;
+
+	ret = ssd_read_log(dev, ctrl_idx, buf, &nr_log);
+	if (ret) {
+		return ret;
+	}
+
+	do_gettimeofday(&tv);
+
+	log.time = tv.tv_sec;
+	log.ctrl_idx = ctrl_idx;
+
+	le = (ssd_log_entry_t *)buf;
+	while (nr_log > 0) {
+		memcpy(&log.le, le, sizeof(struct ssd_log_entry));
+
+		level = ssd_parse_log(dev, &log, 1);
+		if (level >= SSD_LOG_LEVEL) {
+			ssd_save_log(dev, &log);
+		}
+
+		/* set alarm */
+		if (SSD_LOG_LEVEL_ERR == level) {
+			ssd_set_alarm(dev);
+		}
+		
+		dev->smart.log_info.nr_log++;
+		if (SSD_LOG_SEU_FAULT != le->event && SSD_LOG_SEU_FAULT1 != le->event) {
+			dev->smart.log_info.stat[level]++;
+		} else {
+			/* SEU fault */
+
+			/* log to the volatile log info */
+			dev->log_info.nr_log++;
+			dev->log_info.stat[level]++;
+
+			/* do something */
+			dev->reload_fw = 1;
+			ssd_reg32_write(dev->ctrlp + SSD_RELOAD_FW_REG, SSD_RELOAD_FLAG);
+
+			/*dev->readonly = 1;
+			set_disk_ro(dev->gd, 1);
+			hio_warn("%s: switched to read-only mode.\n", dev->name);*/
+		}
+
+		/* handle event */
+		ssd_handle_event(dev, le->event, level);
+
+		le++;
+		nr_log--;
+	}
+
+	return 0;
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+static void ssd_log_worker(void *data)
+{
+	struct ssd_device *dev = (struct ssd_device *)data;
+#else
+static void ssd_log_worker(struct work_struct *work)
+{
+	struct ssd_device *dev = container_of(work, struct ssd_device, log_work);
+#endif
+	int i;
+	int ret;
+
+	if (!test_bit(SSD_LOG_ERR, &dev->state) && test_bit(SSD_ONLINE, &dev->state)) {
+		/* alloc log buf */
+		if (!dev->log_buf) {
+			dev->log_buf = kmalloc(dev->hw_info.log_sz, GFP_KERNEL);
+			if (!dev->log_buf) {
+				hio_warn("%s: ssd_log_worker: no mem\n", dev->name);
+				return;
+			}
+		}
+
+		/* get log */
+		if (test_and_clear_bit(SSD_LOG_HW, &dev->state)) {
+			for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+				ret = ssd_do_log(dev, i, dev->log_buf);
+				if (ret) {
+					(void)test_and_set_bit(SSD_LOG_ERR, &dev->state);
+					hio_warn("%s: do log fail\n", dev->name);
+				}
+			}
+		}
+	}
+
+	ret = ssd_do_swlog(dev);
+	if (ret) {
+		hio_warn("%s: do swlog fail\n", dev->name);
+	}
+}
+
+static void ssd_cleanup_log(struct ssd_device *dev)
+{
+	if (dev->log_buf) {
+		kfree(dev->log_buf);
+		dev->log_buf = NULL;
+	}
+
+	sfifo_free(&dev->log_fifo);
+
+	if (dev->internal_log.log) {
+		vfree(dev->internal_log.log);
+		dev->internal_log.log = NULL;
+	}
+}
+
+static int ssd_init_log(struct ssd_device *dev)
+{
+	struct ssd_log *log;
+	uint32_t off, size;
+	uint32_t len = 0;
+	int ret = 0;
+
+	mutex_init(&dev->internal_log_mutex);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+	INIT_WORK(&dev->log_work, ssd_log_worker, dev);
+#else
+	INIT_WORK(&dev->log_work, ssd_log_worker);
+#endif
+
+	off = dev->rom_info.log_base;
+	size = dev->rom_info.log_sz;
+
+	dev->internal_log.log = vmalloc(size);
+	if (!dev->internal_log.log) {
+		ret = -ENOMEM;
+		goto out_alloc_log;
+	}
+
+	ret = sfifo_alloc(&dev->log_fifo, SSD_LOG_FIFO_SZ, sizeof(struct ssd_log_entry));
+	if (ret < 0) {
+		goto out_alloc_log_fifo;
+	}
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return 0;
+	}
+
+	log = (struct ssd_log *)dev->internal_log.log;
+	while (len < size) {
+		ret = ssd_spi_read(dev, log, off, sizeof(struct ssd_log));
+		if (ret) {
+			goto out_read_log;
+		}
+
+		if (log->ctrl_idx == 0xff) {
+			break;
+		}
+
+		dev->internal_log.nr_log++;
+		log++;
+		len += sizeof(struct ssd_log);
+		off += sizeof(struct ssd_log);
+	}
+
+	return 0;
+
+out_read_log:
+	sfifo_free(&dev->log_fifo);
+out_alloc_log_fifo:
+	vfree(dev->internal_log.log);
+	dev->internal_log.log = NULL;
+	dev->internal_log.nr_log = 0;
+out_alloc_log:
+	/* skip error if not in standard mode */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ret = 0;
+	}
+	return ret;
+}
+
+/* work queue */
+static void ssd_stop_workq(struct ssd_device *dev)
+{
+	test_and_clear_bit(SSD_INIT_WORKQ, &dev->state);
+	flush_workqueue(dev->workq);
+}
+
+static void ssd_start_workq(struct ssd_device *dev)
+{
+	(void)test_and_set_bit(SSD_INIT_WORKQ, &dev->state);
+
+	/* log ? */
+	queue_work(dev->workq, &dev->log_work);
+}
+
+static void ssd_cleanup_workq(struct ssd_device *dev)
+{
+	flush_workqueue(dev->workq);
+	destroy_workqueue(dev->workq);
+	dev->workq = NULL;
+}
+
+static int ssd_init_workq(struct ssd_device *dev)
+{
+	int ret = 0;
+	
+	dev->workq = create_singlethread_workqueue(dev->name);
+	if (!dev->workq) {
+		ret = -ESRCH;
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+/* rom */
+static int ssd_init_rom_info(struct ssd_device *dev)
+{
+	uint32_t val;
+
+	mutex_init(&dev->spi_mutex);
+	mutex_init(&dev->i2c_mutex);
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		/* fix bug: read data to clear status */
+		(void)ssd_reg32_read(dev->ctrlp + SSD_SPI_REG_RDATA);
+
+		dev->rom_info.size = SSD_ROM_SIZE;
+		dev->rom_info.block_size = SSD_ROM_BLK_SIZE;
+		dev->rom_info.page_size = SSD_ROM_PAGE_SIZE;
+
+		dev->rom_info.bridge_fw_base = SSD_ROM_BRIDGE_FW_BASE;
+		dev->rom_info.bridge_fw_sz = SSD_ROM_BRIDGE_FW_SIZE;
+		dev->rom_info.nr_bridge_fw = SSD_ROM_NR_BRIDGE_FW;
+
+		dev->rom_info.ctrl_fw_base = SSD_ROM_CTRL_FW_BASE;
+		dev->rom_info.ctrl_fw_sz = SSD_ROM_CTRL_FW_SIZE;
+		dev->rom_info.nr_ctrl_fw = SSD_ROM_NR_CTRL_FW;
+
+		dev->rom_info.log_sz = SSD_ROM_LOG_SZ;
+
+		dev->rom_info.vp_base = SSD_ROM_VP_BASE;
+		dev->rom_info.label_base = SSD_ROM_LABEL_BASE;
+	} else if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		val = ssd_reg32_read(dev->ctrlp + SSD_ROM_INFO_REG);
+		dev->rom_info.size = 0x100000 * (1U << (val & 0xFF));
+		dev->rom_info.block_size = 0x10000 * (1U << ((val>>8) & 0xFF));
+		dev->rom_info.page_size = (val>>16) & 0xFFFF;
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_ROM_BRIDGE_FW_INFO_REG);
+		dev->rom_info.bridge_fw_base = dev->rom_info.block_size * (val & 0xFFFF);
+		dev->rom_info.bridge_fw_sz = dev->rom_info.block_size * ((val>>16) & 0x3FFF);
+		dev->rom_info.nr_bridge_fw = ((val >> 30) & 0x3) + 1;
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_ROM_CTRL_FW_INFO_REG);
+		dev->rom_info.ctrl_fw_base = dev->rom_info.block_size * (val & 0xFFFF);
+		dev->rom_info.ctrl_fw_sz = dev->rom_info.block_size * ((val>>16) & 0x3FFF);
+		dev->rom_info.nr_ctrl_fw = ((val >> 30) & 0x3) + 1;
+
+		dev->rom_info.bm_fw_base = dev->rom_info.ctrl_fw_base + (dev->rom_info.nr_ctrl_fw * dev->rom_info.ctrl_fw_sz);
+		dev->rom_info.bm_fw_sz = SSD_PV3_ROM_BM_FW_SZ;
+		dev->rom_info.nr_bm_fw = SSD_PV3_ROM_NR_BM_FW;
+
+		dev->rom_info.log_base = dev->rom_info.bm_fw_base + (dev->rom_info.nr_bm_fw * dev->rom_info.bm_fw_sz);
+		dev->rom_info.log_sz = SSD_ROM_LOG_SZ;
+
+		dev->rom_info.smart_base = dev->rom_info.log_base + dev->rom_info.log_sz;
+		dev->rom_info.smart_sz = SSD_PV3_ROM_SMART_SZ;
+		dev->rom_info.nr_smart = SSD_PV3_ROM_NR_SMART;
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_ROM_VP_INFO_REG);
+		dev->rom_info.vp_base = dev->rom_info.block_size * val;
+		dev->rom_info.label_base = dev->rom_info.vp_base + dev->rom_info.block_size;
+		if (dev->rom_info.label_base >= dev->rom_info.size) {
+			dev->rom_info.label_base = dev->rom_info.vp_base - dev->rom_info.block_size;
+		}
+	} else {
+		val = ssd_reg32_read(dev->ctrlp + SSD_ROM_INFO_REG);
+		dev->rom_info.size = 0x100000 * (1U << (val & 0xFF));
+		dev->rom_info.block_size = 0x10000 * (1U << ((val>>8) & 0xFF));
+		dev->rom_info.page_size = (val>>16) & 0xFFFF;
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_ROM_BRIDGE_FW_INFO_REG);
+		dev->rom_info.bridge_fw_base = dev->rom_info.block_size * (val & 0xFFFF);
+		dev->rom_info.bridge_fw_sz = dev->rom_info.block_size * ((val>>16) & 0x3FFF);
+		dev->rom_info.nr_bridge_fw = ((val >> 30) & 0x3) + 1;
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_ROM_CTRL_FW_INFO_REG);
+		dev->rom_info.ctrl_fw_base = dev->rom_info.block_size * (val & 0xFFFF);
+		dev->rom_info.ctrl_fw_sz = dev->rom_info.block_size * ((val>>16) & 0x3FFF);
+		dev->rom_info.nr_ctrl_fw = ((val >> 30) & 0x3) + 1;
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_ROM_VP_INFO_REG);
+		dev->rom_info.vp_base = dev->rom_info.block_size * val;
+		dev->rom_info.label_base = dev->rom_info.vp_base - SSD_PV3_2_ROM_SEC_SZ;
+
+		dev->rom_info.nr_smart = SSD_PV3_ROM_NR_SMART;
+		dev->rom_info.smart_sz = SSD_PV3_2_ROM_SEC_SZ;
+		dev->rom_info.smart_base = dev->rom_info.label_base - (dev->rom_info.smart_sz * dev->rom_info.nr_smart);
+		if (dev->rom_info.smart_sz > dev->rom_info.block_size) {
+			dev->rom_info.smart_sz = dev->rom_info.block_size;
+		}
+
+		dev->rom_info.log_sz = SSD_PV3_2_ROM_LOG_SZ;
+		dev->rom_info.log_base = dev->rom_info.smart_base - dev->rom_info.log_sz;
+	}
+
+	return ssd_init_spi(dev);
+}
+
+/* smart */
+static int ssd_update_smart(struct ssd_device *dev, struct ssd_smart *smart)
+{
+	struct timeval tv;
+	uint64_t run_time;
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
+	struct hd_struct *part;
+	int cpu;
+#endif
+	int i, j;
+	int ret = 0;
+
+	if (!test_bit(SSD_INIT_BD, &dev->state)) {
+		return 0;
+	}
+
+	do_gettimeofday(&tv);
+	if ((uint64_t)tv.tv_sec < dev->uptime) {
+		run_time = 0;
+	} else {
+		run_time = tv.tv_sec - dev->uptime;
+	}
+
+	/* avoid frequently update */
+	if (run_time >= 60) {
+		ret = 1;
+	}
+
+	/* io stat */
+	smart->io_stat.run_time += run_time;
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
+	cpu = part_stat_lock();
+	part = &dev->gd->part0;
+	part_round_stats(cpu, part);
+	part_stat_unlock();
+
+	smart->io_stat.nr_read += part_stat_read(part, ios[READ]);
+	smart->io_stat.nr_write += part_stat_read(part, ios[WRITE]);
+	smart->io_stat.rsectors += part_stat_read(part, sectors[READ]);
+	smart->io_stat.wsectors += part_stat_read(part, sectors[WRITE]);
+#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,14))
+	preempt_disable();
+	disk_round_stats(dev->gd);
+	preempt_enable();
+
+	smart->io_stat.nr_read += disk_stat_read(dev->gd, ios[READ]);
+	smart->io_stat.nr_write += disk_stat_read(dev->gd, ios[WRITE]);
+	smart->io_stat.rsectors += disk_stat_read(dev->gd, sectors[READ]);
+	smart->io_stat.wsectors += disk_stat_read(dev->gd, sectors[WRITE]);
+#else
+	preempt_disable();
+	disk_round_stats(dev->gd);
+	preempt_enable();
+
+	smart->io_stat.nr_read += disk_stat_read(dev->gd, reads);
+	smart->io_stat.nr_write += disk_stat_read(dev->gd, writes);
+	smart->io_stat.rsectors += disk_stat_read(dev->gd, read_sectors);
+	smart->io_stat.wsectors += disk_stat_read(dev->gd, write_sectors);
+#endif
+
+	smart->io_stat.nr_to += atomic_read(&dev->tocnt);
+
+	for (i=0; i<dev->nr_queue; i++) {
+		smart->io_stat.nr_rwerr += dev->queue[i].io_stat.nr_rwerr;
+		smart->io_stat.nr_ioerr += dev->queue[i].io_stat.nr_ioerr;
+	}
+
+	for (i=0; i<dev->nr_queue; i++) {
+		for (j=0; j<SSD_ECC_MAX_FLIP; j++) {
+			smart->ecc_info.bitflip[j] += dev->queue[i].ecc_info.bitflip[j];
+		}
+	}
+
+	//dev->uptime = tv.tv_sec;
+
+	return ret;
+}
+
+static int ssd_clear_smart(struct ssd_device *dev)
+{
+	struct timeval tv;
+	uint64_t sversion;
+	uint32_t off, length;
+	int i;
+	int ret;
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return 0;
+	}
+
+	/* clear smart */
+	off = dev->rom_info.smart_base;
+	length = dev->rom_info.smart_sz * dev->rom_info.nr_smart;
+
+	ret = ssd_spi_erase(dev, off, length);
+	if (ret) {
+		hio_warn("%s: info erase: failed\n", dev->name);
+		goto out;
+	}
+
+	sversion = dev->smart.version;
+
+	memset(&dev->smart, 0, sizeof(struct ssd_smart));
+	dev->smart.version = sversion + 1;
+	dev->smart.magic = SSD_SMART_MAGIC;
+
+	/* clear all tmp acc */
+	for (i=0; i<dev->nr_queue; i++) {
+		memset(&(dev->queue[i].io_stat), 0, sizeof(struct ssd_io_stat));
+		memset(&(dev->queue[i].ecc_info), 0, sizeof(struct ssd_ecc_info));
+	}
+
+	atomic_set(&dev->tocnt, 0);
+
+	/* clear tmp log info */
+	memset(&dev->log_info, 0, sizeof(struct ssd_log_info));
+
+	do_gettimeofday(&tv);
+	dev->uptime = tv.tv_sec;
+
+	/* clear alarm ? */
+	//ssd_clear_alarm(dev);
+out:
+	return ret;
+}
+
+static int ssd_save_smart(struct ssd_device *dev)
+{
+	uint32_t off, size;
+	int i;
+	int ret = 0;
+
+	if (unlikely(mode != SSD_DRV_MODE_STANDARD))
+		return 0;
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return 0;
+	}
+
+	if (!ssd_update_smart(dev, &dev->smart)) {
+		return 0;
+	}
+
+	dev->smart.version++;
+
+	for (i=0; i<dev->rom_info.nr_smart; i++) {
+		off = dev->rom_info.smart_base + (dev->rom_info.smart_sz * i);
+		size = dev->rom_info.smart_sz;
+
+		ret = ssd_spi_erase(dev, off, size);
+		if (ret) {
+			hio_warn("%s: info erase failed\n", dev->name);
+			goto out;
+		}
+
+		size = sizeof(struct ssd_smart);
+
+		ret = ssd_spi_write(dev, &dev->smart, off, size);
+		if (ret) {
+			hio_warn("%s: info write failed\n", dev->name);
+			goto out;
+		}
+
+		//xx
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_init_smart(struct ssd_device *dev)
+{
+	struct ssd_smart *smart;
+	struct timeval tv;
+	uint32_t off, size;
+	int i;
+	int ret = 0;
+
+	do_gettimeofday(&tv);
+	dev->uptime = tv.tv_sec;
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return 0;
+	}
+
+	smart = kmalloc(sizeof(struct ssd_smart) * SSD_ROM_NR_SMART_MAX, GFP_KERNEL);
+	if (!smart) {
+		ret = -ENOMEM;
+		goto out_nomem;
+	}
+
+	memset(&dev->smart, 0, sizeof(struct ssd_smart));
+
+	/* read smart */
+	for (i=0; i<dev->rom_info.nr_smart; i++) {
+		memset(&smart[i], 0, sizeof(struct ssd_smart));
+
+		off = dev->rom_info.smart_base + (dev->rom_info.smart_sz * i);
+		size = sizeof(struct ssd_smart);
+
+		ret = ssd_spi_read(dev, &smart[i], off, size);
+		if (ret) {
+			hio_warn("%s: info read failed\n", dev->name);
+			goto out;
+		}
+
+		if (smart[i].magic != SSD_SMART_MAGIC) {
+			smart[i].magic = 0;
+			smart[i].version = 0;
+			continue;
+		}
+
+		if (smart[i].version > dev->smart.version) {
+			memcpy(&dev->smart, &smart[i], sizeof(struct ssd_smart));
+		}
+	}
+
+	if (dev->smart.magic != SSD_SMART_MAGIC) {
+		/* first time power up */
+		dev->smart.magic = SSD_SMART_MAGIC;
+		dev->smart.version = 1;
+	}
+
+	/* check log info */
+	{
+		struct ssd_log_info log_info;
+		struct ssd_log *log = (struct ssd_log *)dev->internal_log.log;
+
+		memset(&log_info, 0, sizeof(struct ssd_log_info));
+
+		while (log_info.nr_log < dev->internal_log.nr_log) {
+			/* skip the volatile log info */
+			if (SSD_LOG_SEU_FAULT != log->le.event && SSD_LOG_SEU_FAULT1 != log->le.event) {
+				log_info.stat[ssd_parse_log(dev, log, 0)]++;
+			}
+
+			log_info.nr_log++;
+			log++;
+		}
+
+		/* check */
+		for (i=(SSD_LOG_NR_LEVEL-1); i>=0; i--) {
+			if (log_info.stat[i] > dev->smart.log_info.stat[i]) {
+				/* unclean */
+				memcpy(&dev->smart.log_info, &log_info, sizeof(struct ssd_log_info));
+				dev->smart.version++;
+				break;
+			}
+		}
+	}
+
+	for (i=0; i<dev->rom_info.nr_smart; i++) {
+		if (smart[i].magic == SSD_SMART_MAGIC && smart[i].version == dev->smart.version) {
+			continue;
+		}
+
+		off = dev->rom_info.smart_base + (dev->rom_info.smart_sz * i);
+		size = dev->rom_info.smart_sz;
+
+		ret = ssd_spi_erase(dev, off, size);
+		if (ret) {
+			hio_warn("%s: info erase failed\n", dev->name);
+			goto out;
+		}
+
+		size = sizeof(struct ssd_smart);
+		ret = ssd_spi_write(dev, &dev->smart, off, size);
+		if (ret) {
+			hio_warn("%s: info write failed\n", dev->name);
+			goto out;
+		}
+
+		//xx
+	}
+
+	/* sync smart with alarm led */
+	if (dev->smart.io_stat.nr_to || dev->smart.io_stat.nr_rwerr || dev->smart.log_info.stat[SSD_LOG_LEVEL_ERR]) {
+		hio_warn("%s: some fault found in the history info\n", dev->name);
+		ssd_set_alarm(dev);
+	}
+
+out:
+	kfree(smart);
+out_nomem:
+	/* skip error if not in standard mode */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ret = 0;
+	}
+	return ret;
+}
+
+/* bm */
+static int __ssd_bm_get_version(struct ssd_device *dev, uint16_t *ver)
+{
+	struct ssd_bm_manufacturer_data bm_md = {0};
+	uint16_t sc_id = SSD_BM_SYSTEM_DATA_SUBCLASS_ID;
+	uint8_t cmd;
+	int ret = 0;
+
+	if (!dev || !ver) {
+		return -EINVAL;
+	}
+
+	mutex_lock(&dev->bm_mutex);
+
+	cmd = SSD_BM_DATA_FLASH_SUBCLASS_ID;
+	ret = ssd_smbus_write_word(dev, SSD_BM_SLAVE_ADDRESS, cmd, (uint8_t *)&sc_id);
+	if (ret) {
+		goto out;
+	}
+
+	cmd = SSD_BM_DATA_FLASH_SUBCLASS_ID_PAGE1;
+	ret = ssd_smbus_read_block(dev, SSD_BM_SLAVE_ADDRESS, cmd, sizeof(struct ssd_bm_manufacturer_data), (uint8_t *)&bm_md);
+	if (ret) {
+		goto out;
+	}
+
+	if (bm_md.firmware_ver & 0xF000) {
+		ret = -EIO;
+		goto out;
+	}
+
+	*ver = bm_md.firmware_ver;
+
+out:
+	mutex_unlock(&dev->bm_mutex);
+	return ret;
+}
+
+static int ssd_bm_get_version(struct ssd_device *dev, uint16_t *ver)
+{
+	uint16_t tmp = 0;
+	int i = SSD_BM_RETRY_MAX;
+	int ret = 0;
+
+	while (i-- > 0) {
+		ret = __ssd_bm_get_version(dev, &tmp);
+		if (!ret) {
+			break;
+		}
+	}
+	if (ret) {
+		return ret;
+	}
+
+	*ver = tmp;
+
+	return 0;
+}
+
+static int __ssd_bm_nr_cap(struct ssd_device *dev, int *nr_cap)
+{
+	struct ssd_bm_configuration_registers bm_cr;
+	uint16_t sc_id = SSD_BM_CONFIGURATION_REGISTERS_ID;
+	uint8_t cmd;
+	int ret;
+
+	mutex_lock(&dev->bm_mutex);
+
+	cmd = SSD_BM_DATA_FLASH_SUBCLASS_ID;
+	ret = ssd_smbus_write_word(dev, SSD_BM_SLAVE_ADDRESS, cmd, (uint8_t *)&sc_id);
+	if (ret) {
+		goto out;
+	}
+
+	cmd = SSD_BM_DATA_FLASH_SUBCLASS_ID_PAGE1;
+	ret = ssd_smbus_read_block(dev, SSD_BM_SLAVE_ADDRESS, cmd, sizeof(struct ssd_bm_configuration_registers), (uint8_t *)&bm_cr);
+	if (ret) {
+		goto out;
+	}
+
+	if (bm_cr.operation_cfg.cc == 0 || bm_cr.operation_cfg.cc > 4) {
+		ret = -EIO;
+		goto out;
+	}
+
+	*nr_cap = bm_cr.operation_cfg.cc + 1;
+
+out:
+	mutex_unlock(&dev->bm_mutex);
+	return ret;
+}
+
+static int ssd_bm_nr_cap(struct ssd_device *dev, int *nr_cap)
+{
+	int tmp = 0;
+	int i = SSD_BM_RETRY_MAX;
+	int ret = 0;
+
+	while (i-- > 0) {
+		ret = __ssd_bm_nr_cap(dev, &tmp);
+		if (!ret) {
+			break;
+		}
+	}
+	if (ret) {
+		return ret;
+	}
+
+	*nr_cap = tmp;
+
+	return 0;
+}
+
+static int ssd_bm_enter_cap_learning(struct ssd_device *dev)
+{
+	uint16_t buf = SSD_BM_ENTER_CAP_LEARNING;
+	uint8_t cmd = SSD_BM_MANUFACTURERACCESS;
+	int ret;
+
+	ret = ssd_smbus_write_word(dev, SSD_BM_SLAVE_ADDRESS, cmd, (uint8_t *)&buf);
+	if (ret) {
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_bm_get_sfstatus(struct ssd_device *dev, uint16_t *status)
+{
+	uint16_t val = 0;
+	uint8_t cmd = SSD_BM_SAFETYSTATUS;
+	int ret;
+
+	ret = ssd_smbus_read_word(dev, SSD_BM_SLAVE_ADDRESS, cmd, (uint8_t *)&val);
+	if (ret) {
+		goto out;
+	}
+
+	*status = val;
+out:
+	return ret;
+}
+
+static int ssd_bm_get_opstatus(struct ssd_device *dev, uint16_t *status)
+{
+	uint16_t val = 0;
+	uint8_t cmd = SSD_BM_OPERATIONSTATUS;
+	int ret;
+
+	ret = ssd_smbus_read_word(dev, SSD_BM_SLAVE_ADDRESS, cmd, (uint8_t *)&val);
+	if (ret) {
+		goto out;
+	}
+
+	*status = val;
+out:
+	return ret;
+}
+ 
+static int ssd_get_bmstruct(struct ssd_device *dev, struct ssd_bm *bm_status_out)
+{
+	struct sbs_cmd *bm_sbs = ssd_bm_sbs;
+	struct ssd_bm bm_status;
+	uint8_t buf[2] = {0, };
+	uint16_t val = 0;
+	uint16_t cval;
+	int ret = 0;
+
+	memset(&bm_status, 0, sizeof(struct ssd_bm));
+
+	while (bm_sbs->desc != NULL) {
+		switch (bm_sbs->size) {
+			case SBS_SIZE_BYTE:
+				ret = ssd_smbus_read_byte(dev, SSD_BM_SLAVE_ADDRESS, bm_sbs->cmd, buf);
+				if (ret) {
+					//printf("Error: smbus read byte %#x\n", bm_sbs->cmd);
+					goto out;
+				}
+				val = buf[0];
+				break;
+			case SBS_SIZE_WORD:
+				ret = ssd_smbus_read_word(dev, SSD_BM_SLAVE_ADDRESS, bm_sbs->cmd, (uint8_t *)&val);
+				if (ret) {
+					//printf("Error: smbus read word %#x\n", bm_sbs->cmd);
+					goto out;
+				}
+				//val = *(uint16_t *)buf;
+				break;
+			default:
+				ret = -1;
+				goto out;
+				break;
+		}
+
+		switch (bm_sbs->unit) {
+			case SBS_UNIT_VALUE:
+				*(uint16_t *)bm_var(&bm_status, bm_sbs->off) = val & bm_sbs->mask;
+				break;
+			case SBS_UNIT_TEMPERATURE:
+				cval = (uint16_t)(val - 2731) / 10;
+				*(uint16_t *)bm_var(&bm_status, bm_sbs->off) = cval;
+				break;
+			case SBS_UNIT_VOLTAGE:
+				*(uint16_t *)bm_var(&bm_status, bm_sbs->off) = val;
+				break;
+			case SBS_UNIT_CURRENT:
+				*(uint16_t *)bm_var(&bm_status, bm_sbs->off) = val;
+				break;
+			case SBS_UNIT_ESR:
+				*(uint16_t *)bm_var(&bm_status, bm_sbs->off) = val;
+				break;
+			case SBS_UNIT_PERCENT:
+				*(uint16_t *)bm_var(&bm_status, bm_sbs->off) = val;
+				break;
+			case SBS_UNIT_CAPACITANCE:
+				*(uint16_t *)bm_var(&bm_status, bm_sbs->off) = val;
+				break;
+			default:
+				ret = -1;
+				goto out;
+				break;
+		}
+
+		bm_sbs++;
+	}
+
+	memcpy(bm_status_out, &bm_status, sizeof(struct ssd_bm));
+
+out:
+	return ret;
+}
+
+static int __ssd_bm_status(struct ssd_device *dev, int *status)
+{
+	struct ssd_bm bm_status = {0};
+	int nr_cap = 0;
+	int i;
+	int ret = 0;
+
+	ret = ssd_get_bmstruct(dev, &bm_status);
+	if (ret) {
+		goto out;
+	}
+
+	/* capacitor voltage */
+	ret = ssd_bm_nr_cap(dev, &nr_cap);
+	if (ret) {
+		goto out;
+	}
+
+	for (i=0; i<nr_cap; i++) {
+		if (bm_status.cap_volt[i] < SSD_BM_CAP_VOLT_MIN) {
+			*status = SSD_BMSTATUS_WARNING;
+			goto out;
+		}
+	}
+
+	/* Safety Status */
+	if (bm_status.sf_status) {
+		*status = SSD_BMSTATUS_WARNING;
+		goto out;
+	}
+
+	/* charge status */
+	if (!((bm_status.op_status >> 12) & 0x1)) {
+		*status = SSD_BMSTATUS_CHARGING;
+	}else{
+		*status = SSD_BMSTATUS_OK;
+	}
+
+out:
+	return ret;
+}
+
+static void ssd_set_flush_timeout(struct ssd_device *dev, int mode);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+static void ssd_bm_worker(void *data)
+{
+	struct ssd_device *dev = (struct ssd_device *)data;
+#else
+static void ssd_bm_worker(struct work_struct *work)
+{
+	struct ssd_device *dev = container_of(work, struct ssd_device, bm_work);
+#endif
+
+	uint16_t opstatus;
+	int ret = 0;
+
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		return;
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_1) {
+		return;
+	}
+
+	if (dev->hw_info_ext.plp_type != SSD_PLP_SCAP) {
+		return;
+	}
+
+	ret = ssd_bm_get_opstatus(dev, &opstatus);
+	if (ret) {
+		hio_warn("%s: get bm operationstatus failed\n", dev->name);
+		return;
+	}
+
+	/* need cap learning ? */
+	if (!(opstatus & 0xF0)) {
+		ret = ssd_bm_enter_cap_learning(dev);
+		if (ret) {
+			hio_warn("%s: enter capacitance learning failed\n", dev->name);
+			return;
+		}
+	}
+}
+
+static void ssd_bm_routine_start(void *data)
+{
+	struct ssd_device *dev;
+
+	if (!data) {
+		return;
+	}
+	dev = data;
+
+	if (test_bit(SSD_INIT_WORKQ, &dev->state)) {
+		if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+			queue_work(dev->workq, &dev->bm_work);
+		} else {
+			queue_work(dev->workq, &dev->capmon_work);
+		}
+	}
+}
+
+/* CAP */
+static int ssd_do_cap_learn(struct ssd_device *dev, uint32_t *cap)
+{
+	uint32_t u1, u2, t;
+	uint16_t val = 0;
+	int wait = 0;
+	int ret = 0;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		*cap = 0;
+		return 0;
+	}
+
+	if (dev->hw_info_ext.form_factor == SSD_FORM_FACTOR_FHHL && dev->hw_info.pcb_ver < 'B') {
+		*cap = 0;
+		return 0;
+	}
+
+	/* make sure the lm80 voltage value is updated */
+	msleep(SSD_LM80_CONV_INTERVAL);
+
+	/* check if full charged */
+	wait = 0;
+	for (;;) {
+		ret = ssd_smbus_read_word(dev, SSD_SENSOR_LM80_SADDRESS, SSD_PL_CAP_U1, (uint8_t *)&val);
+		if (ret) {
+			if (!test_and_set_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM80), &dev->hwmon)) {
+				ssd_gen_swlog(dev, SSD_LOG_SENSOR_FAULT, SSD_SENSOR_LM80_SADDRESS);
+			}
+			goto out;
+		}
+		u1 = SSD_LM80_CONVERT_VOLT(u16_swap(val));
+		if (SSD_PL_CAP_VOLT(u1) >= SSD_PL_CAP_VOLT_FULL) {
+			break;
+		}
+
+		wait++;
+		if (wait > SSD_PL_CAP_CHARGE_MAX_WAIT) {
+			ret = -ETIMEDOUT;
+			goto out;
+		}
+		msleep(SSD_PL_CAP_CHARGE_WAIT);
+	}
+
+	ret = ssd_smbus_read_word(dev, SSD_SENSOR_LM80_SADDRESS, SSD_PL_CAP_U2, (uint8_t *)&val);
+	if (ret) {
+		if (!test_and_set_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM80), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_SENSOR_FAULT, SSD_SENSOR_LM80_SADDRESS);
+		}
+		goto out;
+	}
+	u2 = SSD_LM80_CONVERT_VOLT(u16_swap(val));
+
+	if (u1 == u2) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	/* enter cap learn */
+	ssd_reg32_write(dev->ctrlp + SSD_PL_CAP_LEARN_REG, 0x1);
+	
+	wait = 0;
+	for (;;) {
+		msleep(SSD_PL_CAP_LEARN_WAIT);
+
+		t = ssd_reg32_read(dev->ctrlp + SSD_PL_CAP_LEARN_REG);
+		if (!((t >> 1) & 0x1)) {
+			break;
+		}
+
+		wait++;
+		if (wait > SSD_PL_CAP_LEARN_MAX_WAIT) {
+			ret = -ETIMEDOUT;
+			goto out;
+		}
+	}
+
+	if ((t >> 4) & 0x1) {
+		ret = -ETIMEDOUT;
+		goto out;
+	}
+
+	t = (t >> 8);
+	if (0 == t) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	*cap = SSD_PL_CAP_LEARN(u1, u2, t);
+
+out:
+	return ret;
+}
+
+static int ssd_cap_learn(struct ssd_device *dev, uint32_t *cap)
+{
+	int ret = 0;
+
+	if (!dev || !cap) {
+		return -EINVAL;
+	}
+
+	mutex_lock(&dev->bm_mutex);
+
+	ssd_stop_workq(dev);
+
+	ret = ssd_do_cap_learn(dev, cap);
+	if (ret) {
+		ssd_gen_swlog(dev, SSD_LOG_CAP_LEARN_FAULT, 0);
+		goto out;
+	}
+
+	ssd_gen_swlog(dev, SSD_LOG_CAP_STATUS, *cap);
+
+out:
+	ssd_start_workq(dev);
+	mutex_unlock(&dev->bm_mutex);
+
+	return ret;
+}
+
+static int ssd_check_pl_cap(struct ssd_device *dev)
+{
+	uint32_t u1;
+	uint16_t val = 0;
+	uint8_t low = 0;
+	int wait = 0;
+	int ret = 0;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		return 0;
+	}
+
+	if (dev->hw_info_ext.form_factor == SSD_FORM_FACTOR_FHHL && dev->hw_info.pcb_ver < 'B') {
+		return 0;
+	}
+
+	/* cap ready ? */
+	wait = 0;
+	for (;;) {
+		ret = ssd_smbus_read_word(dev, SSD_SENSOR_LM80_SADDRESS, SSD_PL_CAP_U1, (uint8_t *)&val);
+		if (ret) {
+			if (!test_and_set_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM80), &dev->hwmon)) {
+				ssd_gen_swlog(dev, SSD_LOG_SENSOR_FAULT, SSD_SENSOR_LM80_SADDRESS);
+			}
+			goto out;
+		}
+		u1 = SSD_LM80_CONVERT_VOLT(u16_swap(val));
+		if (SSD_PL_CAP_VOLT(u1) >= SSD_PL_CAP_VOLT_READY) {
+			break;
+		}
+
+		wait++;
+		if (wait > SSD_PL_CAP_CHARGE_MAX_WAIT) {
+			ret = -ETIMEDOUT;
+			ssd_gen_swlog(dev, SSD_LOG_CAP_VOLT_FAULT, SSD_PL_CAP_VOLT(u1));
+			goto out;
+		}
+		msleep(SSD_PL_CAP_CHARGE_WAIT);
+	}
+
+	low = ssd_lm80_limit[SSD_LM80_IN_CAP].low;
+	ret = ssd_smbus_write_byte(dev, SSD_SENSOR_LM80_SADDRESS, SSD_LM80_REG_IN_MIN(SSD_LM80_IN_CAP), &low);
+	if (ret) {
+		goto out;
+	}
+
+	/* enable cap INx */
+	ret = ssd_lm80_enable_in(dev, SSD_SENSOR_LM80_SADDRESS, SSD_LM80_IN_CAP);
+	if (ret) {
+		if (!test_and_set_bit(SSD_HWMON_SENSOR(SSD_SENSOR_LM80), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_SENSOR_FAULT, SSD_SENSOR_LM80_SADDRESS);
+		}
+		goto out;
+	}
+
+out:
+	/* skip error if not in standard mode */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ret = 0;
+	}
+	return ret;
+}
+
+static int ssd_check_pl_cap_fast(struct ssd_device *dev)
+{
+	uint32_t u1;
+	uint16_t val = 0;
+	int ret = 0;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		return 0;
+	}
+
+	if (dev->hw_info_ext.form_factor == SSD_FORM_FACTOR_FHHL && dev->hw_info.pcb_ver < 'B') {
+		return 0;
+	}
+
+	/* cap ready ? */
+	ret = ssd_smbus_read_word(dev, SSD_SENSOR_LM80_SADDRESS, SSD_PL_CAP_U1, (uint8_t *)&val);
+	if (ret) {
+		goto out;
+	}
+	u1 = SSD_LM80_CONVERT_VOLT(u16_swap(val));
+	if (SSD_PL_CAP_VOLT(u1) < SSD_PL_CAP_VOLT_READY) {
+		ret = 1;
+	}
+
+out:
+	return ret;
+}
+
+static int ssd_init_pl_cap(struct ssd_device *dev)
+{
+	int ret = 0;
+
+	/* set here: user write mode */
+	dev->user_wmode = wmode;
+	
+	mutex_init(&dev->bm_mutex);
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		uint32_t val;
+		val = ssd_reg32_read(dev->ctrlp + SSD_BM_FAULT_REG);
+		if ((val >> 1) & 0x1) {
+			(void)test_and_set_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon);
+		}
+	} else {
+		ret = ssd_check_pl_cap(dev);
+		if (ret) {
+			(void)test_and_set_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon);
+		}
+	}
+
+	return 0;
+}
+
+/* label */
+static void __end_str(char *str, int len)
+{
+	int i;
+
+	for(i=0; i<len; i++) {
+		if (*(str+i) == '\0')
+			return;
+	}
+	*str = '\0';
+}
+
+static int ssd_init_label(struct ssd_device *dev)
+{
+	uint32_t off;
+	uint32_t size;
+	int ret;
+
+	/* label location */
+	off = dev->rom_info.label_base;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		size = sizeof(struct ssd_label);
+
+		/* read label */
+		ret = ssd_spi_read(dev, &dev->label, off, size);
+		if (ret) {
+			memset(&dev->label, 0, size);
+			goto out;
+		}
+
+		__end_str(dev->label.date, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->label.sn, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->label.part, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->label.desc, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->label.other, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->label.maf, SSD_LABEL_FIELD_SZ);
+	} else {
+		size = sizeof(struct ssd_labelv3);
+
+		/* read label */
+		ret = ssd_spi_read(dev, &dev->labelv3, off, size);
+		if (ret) {
+			memset(&dev->labelv3, 0, size);
+			goto out;
+		}
+
+		__end_str(dev->labelv3.boardtype, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->labelv3.barcode, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->labelv3.item, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->labelv3.description, SSD_LABEL_DESC_SZ);
+		__end_str(dev->labelv3.manufactured, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->labelv3.vendorname, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->labelv3.issuenumber, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->labelv3.cleicode, SSD_LABEL_FIELD_SZ);
+		__end_str(dev->labelv3.bom, SSD_LABEL_FIELD_SZ);
+	}
+
+out:
+	/* skip error if not in standard mode */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ret = 0;
+	}
+	return ret;
+}
+
+int ssd_get_label(struct block_device *bdev, struct ssd_label *label)
+{
+	struct ssd_device *dev;
+
+	if (!bdev || !label || !(bdev->bd_disk)) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		memset(label, 0, sizeof(struct ssd_label));
+		memcpy(label->date, dev->labelv3.manufactured, SSD_LABEL_FIELD_SZ);
+		memcpy(label->sn, dev->labelv3.barcode, SSD_LABEL_FIELD_SZ);
+		memcpy(label->desc, dev->labelv3.boardtype, SSD_LABEL_FIELD_SZ);
+		memcpy(label->maf, dev->labelv3.vendorname, SSD_LABEL_FIELD_SZ);
+	} else {
+		memcpy(label, &dev->label, sizeof(struct ssd_label));
+	}
+
+	return 0;
+}
+
+static int __ssd_get_version(struct ssd_device *dev, struct ssd_version_info *ver)
+{
+	uint16_t bm_ver = 0;
+	int ret = 0;
+
+	if (dev->protocol_info.ver > SSD_PROTOCOL_V3 && dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		ret = ssd_bm_get_version(dev, &bm_ver);
+		if(ret){
+			goto out;
+		}
+	}
+
+	ver->bridge_ver = dev->hw_info.bridge_ver;
+	ver->ctrl_ver = dev->hw_info.ctrl_ver;
+	ver->bm_ver = bm_ver;
+	ver->pcb_ver = dev->hw_info.pcb_ver;
+	ver->upper_pcb_ver = dev->hw_info.upper_pcb_ver;
+
+out:
+	return ret;
+
+}
+
+int ssd_get_version(struct block_device *bdev, struct ssd_version_info *ver)
+{
+	struct ssd_device *dev;
+	int ret;
+
+	if (!bdev || !ver || !(bdev->bd_disk)) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+
+	mutex_lock(&dev->fw_mutex);
+	ret = __ssd_get_version(dev, ver);
+	mutex_unlock(&dev->fw_mutex);
+
+	return ret;
+}
+
+static int __ssd_get_temperature(struct ssd_device *dev, int *temp)
+{
+	uint64_t val;
+	uint32_t off;
+	int max = -300;
+	int cur;
+	int i;
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		*temp = 0;
+		return 0;
+	}
+
+	if (finject) {
+		if (dev->db_info.type == SSD_DEBUG_LOG && 
+			(dev->db_info.data.log.event == SSD_LOG_OVER_TEMP || 
+			dev->db_info.data.log.event == SSD_LOG_NORMAL_TEMP || 
+			dev->db_info.data.log.event == SSD_LOG_WARN_TEMP)) {
+			*temp = (int)dev->db_info.data.log.extra;
+			return 0;
+		}
+	}
+
+	for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+		off = SSD_CTRL_TEMP_REG0 + i * sizeof(uint64_t);
+
+		val = ssd_reg_read(dev->ctrlp + off);
+		if (val == 0xffffffffffffffffull) {
+			continue;
+		}
+
+		cur = (int)CUR_TEMP(val);
+		if (cur >= max) {
+			max = cur;
+		}
+	}
+
+	*temp = max;
+
+	return 0;
+}
+
+int ssd_get_temperature(struct block_device *bdev, int *temp)
+{
+	struct ssd_device *dev;
+	int ret;
+
+	if (!bdev || !temp || !(bdev->bd_disk)) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+
+
+	mutex_lock(&dev->fw_mutex);
+	ret = __ssd_get_temperature(dev, temp);
+	mutex_unlock(&dev->fw_mutex);
+
+	return ret;
+}
+
+int ssd_set_otprotect(struct block_device *bdev, int otprotect)
+ {
+ 	struct ssd_device *dev;
+
+	if (!bdev || !(bdev->bd_disk)) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data; 
+	ssd_set_ot_protect(dev, !!otprotect);
+
+	return 0;
+ }
+
+int ssd_bm_status(struct block_device *bdev, int *status)
+{
+	struct ssd_device *dev;
+	int ret = 0;
+
+	if (!bdev || !status || !(bdev->bd_disk)) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+
+	mutex_lock(&dev->fw_mutex);
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		if (test_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+			*status = SSD_BMSTATUS_WARNING;
+		} else {
+			*status = SSD_BMSTATUS_OK;
+		}
+	} else if(dev->protocol_info.ver > SSD_PROTOCOL_V3) {
+		ret = __ssd_bm_status(dev, status);
+	} else {
+		*status = SSD_BMSTATUS_OK;
+	}
+	mutex_unlock(&dev->fw_mutex);
+
+	return ret;
+}
+
+int ssd_get_pciaddr(struct block_device *bdev, struct pci_addr *paddr)
+{
+	struct ssd_device *dev;
+
+	if (!bdev || !paddr || !bdev->bd_disk) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+
+	paddr->domain = pci_domain_nr(dev->pdev->bus);
+	paddr->bus = dev->pdev->bus->number;
+	paddr->slot = PCI_SLOT(dev->pdev->devfn);
+	paddr->func= PCI_FUNC(dev->pdev->devfn);
+
+	return 0;
+}
+
+/* acc */
+static int ssd_bb_acc(struct ssd_device *dev, struct ssd_acc_info *acc)
+{
+	uint32_t val;
+	int ctrl, chip;
+	
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_1) {
+		return -EOPNOTSUPP;
+	}
+
+	acc->threshold_l1 = ssd_reg32_read(dev->ctrlp + SSD_BB_THRESHOLD_L1_REG);
+	if (0xffffffffull == acc->threshold_l1) {
+		return -EIO;
+	}
+	acc->threshold_l2 = ssd_reg32_read(dev->ctrlp + SSD_BB_THRESHOLD_L2_REG);
+	if (0xffffffffull == acc->threshold_l2) {
+		return -EIO;
+	}
+	acc->val = 0;
+
+	for (ctrl=0; ctrl<dev->hw_info.nr_ctrl; ctrl++) {
+		for (chip=0; chip<dev->hw_info.nr_chip; chip++) {
+			val = ssd_reg32_read(dev->ctrlp + SSD_BB_ACC_REG0 + (SSD_CTRL_REG_ZONE_SZ * ctrl) + (SSD_BB_ACC_REG_SZ * chip));
+			if (0xffffffffull == acc->val) {
+				return -EIO;
+			}
+			if (val > acc->val) {
+				acc->val = val;
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int ssd_ec_acc(struct ssd_device *dev, struct ssd_acc_info *acc)
+{
+	uint32_t val;
+	int ctrl, chip;
+	
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_1) {
+		return -EOPNOTSUPP;
+	}
+
+	acc->threshold_l1 = ssd_reg32_read(dev->ctrlp + SSD_EC_THRESHOLD_L1_REG);
+	if (0xffffffffull == acc->threshold_l1) {
+		return -EIO;
+	}
+	acc->threshold_l2 = ssd_reg32_read(dev->ctrlp + SSD_EC_THRESHOLD_L2_REG);
+	if (0xffffffffull == acc->threshold_l2) {
+		return -EIO;
+	}
+	acc->val = 0;
+
+	for (ctrl=0; ctrl<dev->hw_info.nr_ctrl; ctrl++) {
+		for (chip=0; chip<dev->hw_info.nr_chip; chip++) {
+			val = ssd_reg32_read(dev->ctrlp + SSD_EC_ACC_REG0 + (SSD_CTRL_REG_ZONE_SZ * ctrl) + (SSD_EC_ACC_REG_SZ * chip));
+			if (0xffffffffull == acc->val) {
+				return -EIO;
+			}
+
+			if (val > acc->val) {
+				acc->val = val;
+			}
+		}
+	}
+
+	return 0;
+}
+
+
+/* ram r&w */
+static int ssd_ram_read_4k(struct ssd_device *dev, void *buf, size_t length, loff_t ofs, int ctrl_idx)
+{
+	struct ssd_ram_op_msg *msg;
+	dma_addr_t buf_dma;
+	size_t len = length;
+	loff_t ofs_w = ofs;
+	int ret = 0;
+
+	if (ctrl_idx >= dev->hw_info.nr_ctrl || (uint64_t)(ofs + length) > dev->hw_info.ram_size 
+		|| !length || length > dev->hw_info.ram_max_len 
+		|| (length & (dev->hw_info.ram_align - 1)) != 0 || ((uint64_t)ofs & (dev->hw_info.ram_align - 1)) != 0) {
+		return -EINVAL;
+	}
+
+	len /= dev->hw_info.ram_align;
+	do_div(ofs_w, dev->hw_info.ram_align);
+
+	buf_dma = pci_map_single(dev->pdev, buf, length, PCI_DMA_FROMDEVICE);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,26))
+	ret = dma_mapping_error(buf_dma);
+#else
+	ret = dma_mapping_error(&(dev->pdev->dev), buf_dma);
+#endif
+	if (ret) {
+		hio_warn("%s: unable to map read DMA buffer\n", dev->name);
+		goto out_dma_mapping;
+	}
+
+	msg = (struct ssd_ram_op_msg *)ssd_get_dmsg(dev);
+
+	msg->fun = SSD_FUNC_RAM_READ;
+	msg->ctrl_idx = ctrl_idx;
+	msg->start = (uint32_t)ofs_w;
+	msg->length = len;
+	msg->buf = buf_dma;
+
+	ret = ssd_do_request(dev, READ, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	pci_unmap_single(dev->pdev, buf_dma, length, PCI_DMA_FROMDEVICE);
+
+out_dma_mapping:
+	 return ret;
+}
+
+static int ssd_ram_write_4k(struct ssd_device *dev, void *buf, size_t length, loff_t ofs, int ctrl_idx)
+{
+	struct ssd_ram_op_msg *msg;
+	dma_addr_t buf_dma;
+	size_t len = length;
+	loff_t ofs_w = ofs;
+	int ret = 0;
+
+	if (ctrl_idx >= dev->hw_info.nr_ctrl || (uint64_t)(ofs + length) > dev->hw_info.ram_size 
+		|| !length || length > dev->hw_info.ram_max_len 
+		|| (length & (dev->hw_info.ram_align - 1)) != 0 || ((uint64_t)ofs & (dev->hw_info.ram_align - 1)) != 0) {
+		return -EINVAL;
+	}
+
+	len /= dev->hw_info.ram_align;
+	do_div(ofs_w, dev->hw_info.ram_align);
+
+	buf_dma = pci_map_single(dev->pdev, buf, length, PCI_DMA_TODEVICE);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,26))
+	ret = dma_mapping_error(buf_dma);
+#else
+	ret = dma_mapping_error(&(dev->pdev->dev), buf_dma);
+#endif
+	if (ret) {
+		hio_warn("%s: unable to map write DMA buffer\n", dev->name);
+		goto out_dma_mapping;
+	}
+
+	msg = (struct ssd_ram_op_msg *)ssd_get_dmsg(dev);
+
+	msg->fun = SSD_FUNC_RAM_WRITE;
+	msg->ctrl_idx = ctrl_idx;
+	msg->start = (uint32_t)ofs_w;
+	msg->length = len;
+	msg->buf = buf_dma;
+
+	ret = ssd_do_request(dev, WRITE, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	pci_unmap_single(dev->pdev, buf_dma, length, PCI_DMA_TODEVICE);
+
+out_dma_mapping:
+	 return ret;
+
+}
+
+static int ssd_ram_read(struct ssd_device *dev, void *buf, size_t length, loff_t ofs, int ctrl_idx)
+{
+	int left = length;
+	size_t len;
+	loff_t off = ofs;
+	int ret = 0;
+
+	if (ctrl_idx >= dev->hw_info.nr_ctrl || (uint64_t)(ofs + length) > dev->hw_info.ram_size || !length 
+		|| (length & (dev->hw_info.ram_align - 1)) != 0 || ((uint64_t)ofs & (dev->hw_info.ram_align - 1)) != 0) {
+		return -EINVAL;
+	}
+
+	while (left > 0) {
+		len = dev->hw_info.ram_max_len;
+		if (left < (int)dev->hw_info.ram_max_len) {
+			len = left;
+		}
+
+		ret = ssd_ram_read_4k(dev, buf, len, off, ctrl_idx);
+		if (ret) {
+			break;
+		}
+
+		left -= len;
+		off += len;
+		buf += len;
+	}
+
+	return ret;
+}
+
+static int ssd_ram_write(struct ssd_device *dev, void *buf, size_t length, loff_t ofs, int ctrl_idx)
+{
+	int left = length;
+	size_t len;
+	loff_t off = ofs;
+	int ret = 0;
+
+	if (ctrl_idx >= dev->hw_info.nr_ctrl || (uint64_t)(ofs + length) > dev->hw_info.ram_size || !length 
+		|| (length & (dev->hw_info.ram_align - 1)) != 0 || ((uint64_t)ofs & (dev->hw_info.ram_align - 1)) != 0) {
+		return -EINVAL;
+	}
+
+	while (left > 0) {
+		len = dev->hw_info.ram_max_len;
+		if (left < (int)dev->hw_info.ram_max_len) {
+			len = left;
+		}
+
+		ret = ssd_ram_write_4k(dev, buf, len, off, ctrl_idx);
+		if (ret) {
+			break;
+		}
+
+		left -= len;
+		off += len;
+		buf += len;
+	}
+
+	return ret;
+}
+
+
+/* flash op */
+static int ssd_check_flash(struct ssd_device *dev, int flash, int page, int ctrl_idx)
+{
+	int cur_ch = flash % dev->hw_info.max_ch;
+	int cur_chip = flash /dev->hw_info.max_ch;
+
+	if (ctrl_idx >= dev->hw_info.nr_ctrl) {
+		return -EINVAL;
+	}
+
+	if (cur_ch >= dev->hw_info.nr_ch || cur_chip >= dev->hw_info.nr_chip) {
+		return -EINVAL;
+	}
+
+	if (page >= (int)(dev->hw_info.block_count * dev->hw_info.page_count)) {
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int ssd_nand_read_id(struct ssd_device *dev, void *id, int flash, int chip, int ctrl_idx)
+{
+	struct ssd_nand_op_msg *msg;
+	dma_addr_t buf_dma;
+	int ret = 0;
+
+	if (unlikely(!id))
+		return -EINVAL;
+
+	buf_dma = pci_map_single(dev->pdev, id, SSD_NAND_ID_BUFF_SZ, PCI_DMA_FROMDEVICE);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,26))
+	ret = dma_mapping_error(buf_dma);
+#else
+	ret = dma_mapping_error(&(dev->pdev->dev), buf_dma);
+#endif
+	if (ret) {
+		hio_warn("%s: unable to map read DMA buffer\n", dev->name);
+		goto out_dma_mapping;
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		flash = ((uint32_t)flash << 1) | (uint32_t)chip;
+		chip = 0;
+	}
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	msg->fun = SSD_FUNC_NAND_READ_ID;
+	msg->chip_no = flash;
+	msg->chip_ce = chip;
+	msg->ctrl_idx = ctrl_idx;
+	msg->buf = buf_dma;
+
+	ret = ssd_do_request(dev, READ, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	pci_unmap_single(dev->pdev, buf_dma, SSD_NAND_ID_BUFF_SZ, PCI_DMA_FROMDEVICE);
+
+out_dma_mapping:
+	return ret;
+}
+
+#if 0
+static int ssd_nand_read(struct ssd_device *dev, void *buf,
+	int flash, int chip, int page, int page_count, int ctrl_idx)
+{
+	struct ssd_nand_op_msg *msg;
+	dma_addr_t buf_dma;
+	int length;
+	int ret = 0;
+
+	if (!buf) {
+		return -EINVAL;
+	}
+
+	if ((page + page_count) > dev->hw_info.block_count*dev->hw_info.page_count) {
+		return -EINVAL;
+	}
+
+	ret = ssd_check_flash(dev, flash, page, ctrl_idx);
+	if (ret) {
+		return ret;
+	}
+
+	length = page_count * dev->hw_info.page_size;
+
+	buf_dma = pci_map_single(dev->pdev, buf, length, PCI_DMA_FROMDEVICE);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,26))
+	ret = dma_mapping_error(buf_dma);
+#else
+	ret = dma_mapping_error(&(dev->pdev->dev), buf_dma);
+#endif
+	if (ret) {
+		hio_warn("%s: unable to map read DMA buffer\n", dev->name);
+		goto out_dma_mapping;
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		flash = (flash << 1) | chip;
+		chip = 0;
+	}
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	msg->fun = SSD_FUNC_NAND_READ;
+	msg->ctrl_idx = ctrl_idx;
+	msg->chip_no = flash;
+	msg->chip_ce = chip;
+	msg->page_no = page;
+	msg->page_count = page_count;
+	msg->buf = buf_dma;
+
+	ret = ssd_do_request(dev, READ, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	pci_unmap_single(dev->pdev, buf_dma, length, PCI_DMA_FROMDEVICE);
+
+out_dma_mapping:
+	return ret;
+}
+#endif
+
+static int ssd_nand_read_w_oob(struct ssd_device *dev, void *buf, 
+	int flash, int chip, int page, int count, int ctrl_idx)
+{
+	struct ssd_nand_op_msg *msg;
+	dma_addr_t buf_dma;
+	int length;
+	int ret = 0;
+
+	if (!buf) {
+		return -EINVAL;
+	}
+
+	if ((page + count) > (int)(dev->hw_info.block_count * dev->hw_info.page_count)) {
+		return -EINVAL;
+	}
+
+	ret = ssd_check_flash(dev, flash, page, ctrl_idx);
+	if (ret) {
+		return ret;
+	}
+
+	length = count * (dev->hw_info.page_size + dev->hw_info.oob_size);
+
+	buf_dma = pci_map_single(dev->pdev, buf, length, PCI_DMA_FROMDEVICE);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,26))
+	ret = dma_mapping_error(buf_dma);
+#else
+	ret = dma_mapping_error(&(dev->pdev->dev), buf_dma);
+#endif
+	if (ret) {
+		hio_warn("%s: unable to map read DMA buffer\n", dev->name);
+		goto out_dma_mapping;
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		flash = ((uint32_t)flash << 1) | (uint32_t)chip;
+		chip = 0;
+	}
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	msg->fun = SSD_FUNC_NAND_READ_WOOB;
+	msg->ctrl_idx = ctrl_idx;
+	msg->chip_no = flash;
+	msg->chip_ce = chip;
+	msg->page_no = page;
+	msg->page_count = count;
+	msg->buf = buf_dma;
+
+	ret = ssd_do_request(dev, READ, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	pci_unmap_single(dev->pdev, buf_dma, length, PCI_DMA_FROMDEVICE);
+
+out_dma_mapping:
+	return ret;
+}
+
+/* write 1 page */
+static int ssd_nand_write(struct ssd_device *dev, void *buf, 
+	int flash, int chip, int page, int count, int ctrl_idx)
+{
+	struct ssd_nand_op_msg *msg;
+	dma_addr_t buf_dma;
+	int length;
+	int ret = 0;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		return -EINVAL;
+	}
+
+	if (!buf) {
+		return -EINVAL;
+	}
+
+	if (count != 1) {
+		return -EINVAL;
+	}
+
+	ret = ssd_check_flash(dev, flash, page, ctrl_idx);
+	if (ret) {
+		return ret;
+	}
+
+	length = count * (dev->hw_info.page_size + dev->hw_info.oob_size);
+
+	/* write data to ram */
+	/*ret = ssd_ram_write(dev, buf, length, dev->hw_info.nand_wbuff_base, ctrl_idx);
+	if (ret) {
+		return ret;
+	}*/
+
+	buf_dma = pci_map_single(dev->pdev, buf, length, PCI_DMA_TODEVICE);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,26))
+	ret = dma_mapping_error(buf_dma);
+#else
+	ret = dma_mapping_error(&(dev->pdev->dev), buf_dma);
+#endif
+	if (ret) {
+		hio_warn("%s: unable to map write DMA buffer\n", dev->name);
+		goto out_dma_mapping;
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		flash = ((uint32_t)flash << 1) | (uint32_t)chip;
+		chip = 0;
+	}
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	msg->fun = SSD_FUNC_NAND_WRITE;
+	msg->ctrl_idx = ctrl_idx;
+	msg->chip_no = flash;
+	msg->chip_ce = chip;
+
+	msg->page_no = page;
+	msg->page_count = count;
+	msg->buf = buf_dma;
+
+	ret = ssd_do_request(dev, WRITE, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	pci_unmap_single(dev->pdev, buf_dma, length, PCI_DMA_TODEVICE);
+
+out_dma_mapping:
+	return ret;
+}
+
+static int ssd_nand_erase(struct ssd_device *dev, int flash, int chip, int page, int ctrl_idx)
+{
+	struct ssd_nand_op_msg *msg;
+	int ret = 0;
+
+	ret = ssd_check_flash(dev, flash, page, ctrl_idx);
+	if (ret) {
+		return ret;
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		flash = ((uint32_t)flash << 1) | (uint32_t)chip;
+		chip = 0;
+	}
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	msg->fun = SSD_FUNC_NAND_ERASE;
+	msg->ctrl_idx = ctrl_idx;
+	msg->chip_no = flash;
+	msg->chip_ce = chip;
+	msg->page_no = page;
+
+	ret = ssd_do_request(dev, WRITE, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	return ret;
+}
+
+static int ssd_update_bbt(struct ssd_device *dev, int flash, int ctrl_idx)
+{
+	struct ssd_nand_op_msg *msg;
+	struct ssd_flush_msg *fmsg;
+	int ret = 0;
+
+	ret = ssd_check_flash(dev, flash, 0, ctrl_idx);
+	if (ret) {
+		return ret;
+	}
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		fmsg = (struct ssd_flush_msg *)msg;
+
+		fmsg->fun = SSD_FUNC_FLUSH;
+		fmsg->flag = 0x1;
+		fmsg->flash = flash;
+		fmsg->ctrl_idx = ctrl_idx;
+	} else {
+		msg->fun = SSD_FUNC_FLUSH;
+		msg->flag = 0x1;
+		msg->chip_no = flash;
+		msg->ctrl_idx = ctrl_idx;
+	}
+
+	ret = ssd_do_request(dev, WRITE, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	return ret;
+}
+
+/* flash controller init state */
+static int __ssd_check_init_state(struct ssd_device *dev)
+{
+	uint32_t *init_state = NULL;
+	int reg_base, reg_sz;
+	int max_wait = SSD_INIT_MAX_WAIT;
+	int init_wait = 0;
+	int i, j, k;
+	int ch_start = 0;
+
+/*
+	for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+		ssd_reg32_write(dev->ctrlp + SSD_CTRL_TEST_REG0 + i * 8, test_data);
+		read_data = ssd_reg32_read(dev->ctrlp + SSD_CTRL_TEST_REG0 + i * 8);
+		if (read_data == ~test_data) {
+			//dev->hw_info.nr_ctrl++;
+			dev->hw_info.nr_ctrl_map |= 1<<i;
+		}
+	}
+*/
+
+/*
+	read_data = ssd_reg32_read(dev->ctrlp + SSD_READY_REG);
+	j=0;
+	for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+		if (((read_data>>i) & 0x1) == 0) {
+			j++;
+		}
+	}
+
+	if (dev->hw_info.nr_ctrl != j) {
+		printk(KERN_WARNING "%s: nr_ctrl mismatch: %d %d\n", dev->name, dev->hw_info.nr_ctrl, j);
+		return -1;
+	}
+*/
+
+/*
+	init_state = ssd_reg_read(dev->ctrlp + SSD_FLASH_INFO_REG0);
+	for (j=1; j<dev->hw_info.nr_ctrl;j++) {
+		if (init_state != ssd_reg_read(dev->ctrlp + SSD_FLASH_INFO_REG0 + j*8)) {
+			printk(KERN_WARNING "SSD_FLASH_INFO_REG[%d], not match\n", j);
+			return -1;
+			}
+		}
+*/
+
+/*	init_state = ssd_reg_read(dev->ctrlp + SSD_CHIP_INFO_REG0);
+	for (j=1; j<dev->hw_info.nr_ctrl; j++) {
+		if (init_state != ssd_reg_read(dev->ctrlp + SSD_CHIP_INFO_REG0 + j*16)) {
+			printk(KERN_WARNING "SSD_CHIP_INFO_REG Lo [%d], not match\n", j);
+			return -1;
+			}
+		}
+
+	init_state = ssd_reg_read(dev->ctrlp + SSD_CHIP_INFO_REG0 + 8);
+	for (j=1; j<dev->hw_info.nr_ctrl; j++) {
+		if (init_state != ssd_reg_read(dev->ctrlp + SSD_CHIP_INFO_REG0 + 8 + j*16)) {
+			printk(KERN_WARNING "SSD_CHIP_INFO_REG Hi [%d], not match\n", j);
+			return -1;
+			}
+		}
+*/
+
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		max_wait = SSD_INIT_MAX_WAIT_V3_2;
+	}
+
+	reg_base = dev->protocol_info.init_state_reg;
+	reg_sz = dev->protocol_info.init_state_reg_sz;
+
+	init_state = (uint32_t *)kmalloc(reg_sz, GFP_KERNEL);
+	if (!init_state) {
+		return -ENOMEM;
+	}
+
+	for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+check_init:
+		for (j=0, k=0; j<reg_sz; j+=sizeof(uint32_t), k++) {
+			init_state[k] = ssd_reg32_read(dev->ctrlp + reg_base + j);
+		}
+
+		if (dev->protocol_info.ver > SSD_PROTOCOL_V3) {
+			/* just check the last bit, no need to check all channel */
+			ch_start = dev->hw_info.max_ch - 1;
+		} else {
+			ch_start = 0;
+		}
+
+		for (j=0; j<dev->hw_info.nr_chip; j++) {
+			for (k=ch_start; k<dev->hw_info.max_ch; k++) {
+				if (test_bit((j*dev->hw_info.max_ch + k), (void *)init_state)) {
+					continue;
+				}
+
+				init_wait++;
+				if (init_wait <= max_wait) {
+					msleep(SSD_INIT_WAIT);
+					goto check_init;
+				} else {
+					if (k < dev->hw_info.nr_ch) {
+						hio_warn("%s: controller %d chip %d ch %d init failed\n", 
+							dev->name, i, j, k);
+					} else {
+						hio_warn("%s: controller %d chip %d init failed\n", 
+							dev->name, i, j);
+					}
+
+					kfree(init_state);
+					return -1;
+				}
+			}
+		}
+		reg_base += reg_sz;
+	}
+	//printk(KERN_WARNING "%s: init wait %d\n", dev->name, init_wait);
+
+	kfree(init_state);
+	return 0;
+}
+
+static int ssd_check_init_state(struct ssd_device *dev)
+{
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		return 0;
+	}
+
+	return __ssd_check_init_state(dev);
+}
+
+static void ssd_reset_resp_ptr(struct ssd_device *dev);
+
+/* reset flash controller etc */
+static int __ssd_reset(struct ssd_device *dev, int type)
+{
+	if (type < SSD_RST_NOINIT || type > SSD_RST_FULL) {
+		return -EINVAL;
+	}
+
+	mutex_lock(&dev->fw_mutex);
+
+	if (type == SSD_RST_NOINIT) {	//no init
+		ssd_reg32_write(dev->ctrlp + SSD_RESET_REG, SSD_RESET_NOINIT);
+	} else if (type == SSD_RST_NORMAL) {	//reset & init
+		ssd_reg32_write(dev->ctrlp + SSD_RESET_REG, SSD_RESET);
+	} else {	// full reset
+		if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+			mutex_unlock(&dev->fw_mutex);
+			return -EINVAL;
+		}
+
+		ssd_reg32_write(dev->ctrlp + SSD_FULL_RESET_REG, SSD_RESET_FULL);
+
+		/* ?? */
+		ssd_reset_resp_ptr(dev);
+	}
+
+#ifdef SSD_OT_PROTECT
+	dev->ot_delay = 0;
+#endif
+
+	msleep(1000);
+
+	/* xx */
+	ssd_set_flush_timeout(dev, dev->wmode);
+
+	mutex_unlock(&dev->fw_mutex);
+	ssd_gen_swlog(dev, SSD_LOG_RESET, (uint32_t)type);
+
+	return __ssd_check_init_state(dev);
+}
+
+static int ssd_save_md(struct ssd_device *dev)
+{
+	struct ssd_nand_op_msg *msg;
+	int ret = 0;
+
+	if (unlikely(mode != SSD_DRV_MODE_STANDARD))
+		return 0;
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return 0;
+	}
+
+	if (!dev->save_md) {
+		return 0;
+	}
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	msg->fun = SSD_FUNC_FLUSH;
+	msg->flag = 0x2;
+	msg->ctrl_idx = 0;
+	msg->chip_no = 0;
+
+	ret = ssd_do_request(dev, WRITE, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	return ret;
+}
+
+static int ssd_barrier_save_md(struct ssd_device *dev)
+{
+	struct ssd_nand_op_msg *msg;
+	int ret = 0;
+
+	if (unlikely(mode != SSD_DRV_MODE_STANDARD))
+		return 0;
+
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return 0;
+	}
+
+	if (!dev->save_md) {
+		return 0;
+	}
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	msg->fun = SSD_FUNC_FLUSH;
+	msg->flag = 0x2;
+	msg->ctrl_idx = 0;
+	msg->chip_no = 0;
+
+	ret = ssd_do_barrier_request(dev, WRITE, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	return ret;
+}
+
+static int ssd_flush(struct ssd_device *dev)
+{
+	struct ssd_nand_op_msg *msg;
+	struct ssd_flush_msg *fmsg;
+	int ret = 0;
+
+	if (unlikely(mode != SSD_DRV_MODE_STANDARD))
+		return 0;
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		fmsg = (struct ssd_flush_msg *)msg;
+
+		fmsg->fun = SSD_FUNC_FLUSH;
+		fmsg->flag = 0;
+		fmsg->ctrl_idx = 0;
+		fmsg->flash = 0;
+	} else {
+		msg->fun = SSD_FUNC_FLUSH;
+		msg->flag = 0;
+		msg->ctrl_idx = 0;
+		msg->chip_no = 0;
+	}
+
+	ret = ssd_do_request(dev, WRITE, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	return ret;
+}
+
+static int ssd_barrier_flush(struct ssd_device *dev)
+{
+	struct ssd_nand_op_msg *msg;
+	struct ssd_flush_msg *fmsg;
+	int ret = 0;
+
+	if (unlikely(mode != SSD_DRV_MODE_STANDARD))
+		return 0;
+
+	msg = (struct ssd_nand_op_msg *)ssd_get_dmsg(dev);
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		fmsg = (struct ssd_flush_msg *)msg;
+
+		fmsg->fun = SSD_FUNC_FLUSH;
+		fmsg->flag = 0;
+		fmsg->ctrl_idx = 0;
+		fmsg->flash = 0;
+	} else {
+		msg->fun = SSD_FUNC_FLUSH;
+		msg->flag = 0;
+		msg->ctrl_idx = 0;
+		msg->chip_no = 0;
+	}
+
+	ret = ssd_do_barrier_request(dev, WRITE, msg, NULL);
+	ssd_put_dmsg(msg);
+
+	return ret;
+}
+
+#define SSD_WMODE_BUFFER_TIMEOUT	0x00c82710
+#define SSD_WMODE_BUFFER_EX_TIMEOUT	0x000500c8
+#define SSD_WMODE_FUA_TIMEOUT		0x000503E8
+static void ssd_set_flush_timeout(struct ssd_device *dev, int m)
+{
+	uint32_t to;
+	uint32_t val = 0;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_1) {
+		return;
+	}
+
+	switch(m) {
+		case SSD_WMODE_BUFFER:
+			to = SSD_WMODE_BUFFER_TIMEOUT;
+			break;
+		case SSD_WMODE_BUFFER_EX:
+			if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2_1) {
+				to = SSD_WMODE_BUFFER_EX_TIMEOUT;
+			} else {
+				to = SSD_WMODE_BUFFER_TIMEOUT;
+			}
+			break;
+		case SSD_WMODE_FUA:
+			to = SSD_WMODE_FUA_TIMEOUT;
+			break;
+		default:
+			return;
+	}
+
+	val = (((uint32_t)((uint32_t)m & 0x3) << 28) | to);
+
+	ssd_reg32_write(dev->ctrlp + SSD_FLUSH_TIMEOUT_REG, val);
+}
+
+static int ssd_do_switch_wmode(struct ssd_device *dev, int m)
+{
+	int ret = 0;
+
+	ret = ssd_barrier_start(dev);
+	if (ret) {
+		goto out;
+	}
+
+	ret = ssd_barrier_flush(dev);
+	if (ret) {
+		goto out_barrier_end;
+	}
+
+	/* set contoller flush timeout */
+	ssd_set_flush_timeout(dev, m);
+
+	dev->wmode = m;
+	mb();
+
+out_barrier_end:
+	ssd_barrier_end(dev);
+out:
+	return ret;
+}
+
+static int ssd_switch_wmode(struct ssd_device *dev, int m)
+{
+	int default_wmode;
+	int next_wmode;
+	int ret = 0;
+
+	if (!test_bit(SSD_ONLINE, &dev->state)) {
+		return -ENODEV;
+	}
+	
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		default_wmode = SSD_WMODE_BUFFER;
+	} else {
+		default_wmode = SSD_WMODE_BUFFER_EX;
+	}
+
+	if (SSD_WMODE_AUTO == m) {
+		/* battery fault ? */
+		if (test_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+			next_wmode = SSD_WMODE_FUA;
+		} else {
+			next_wmode = default_wmode;
+		}
+	} else if (SSD_WMODE_DEFAULT == m) {
+		next_wmode = default_wmode;
+	} else {
+		next_wmode = m;
+	}
+
+	if (next_wmode != dev->wmode) {
+		hio_warn("%s: switch write mode (%d -> %d)\n", dev->name, dev->wmode, next_wmode);
+		ret = ssd_do_switch_wmode(dev, next_wmode);
+		if (ret) {
+			hio_err("%s: can not switch write mode (%d -> %d)\n", dev->name, dev->wmode, next_wmode);
+		}
+	}
+
+	return ret;
+}
+
+static int ssd_init_wmode(struct ssd_device *dev)
+{
+	int default_wmode;
+	int ret = 0;
+	
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		default_wmode = SSD_WMODE_BUFFER;
+	} else {
+		default_wmode = SSD_WMODE_BUFFER_EX;
+	}
+
+	/* dummy mode */
+	if (SSD_WMODE_AUTO == dev->user_wmode) {
+		/* battery fault ? */
+		if (test_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+			dev->wmode = SSD_WMODE_FUA;
+		} else {
+			dev->wmode = default_wmode;
+		}
+	} else if (SSD_WMODE_DEFAULT == dev->user_wmode) {
+		dev->wmode = default_wmode;
+	} else {
+		dev->wmode = dev->user_wmode;
+	}
+	ssd_set_flush_timeout(dev, dev->wmode);
+
+	return ret;
+}
+
+static int __ssd_set_wmode(struct ssd_device *dev, int m)
+{
+	int ret = 0;
+
+	/* not support old fw*/
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_1) {
+		ret = -EOPNOTSUPP;
+		goto out;
+	}
+
+	if (m < SSD_WMODE_BUFFER || m > SSD_WMODE_DEFAULT) {
+		ret = -EINVAL;
+		goto out;
+	}
+	
+	ssd_gen_swlog(dev, SSD_LOG_SET_WMODE, m);
+
+	dev->user_wmode = m;
+
+	ret = ssd_switch_wmode(dev, dev->user_wmode);
+	if (ret) {
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+int ssd_set_wmode(struct block_device *bdev, int m)
+{
+	struct ssd_device *dev;
+
+	if (!bdev || !(bdev->bd_disk)) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+
+	return __ssd_set_wmode(dev, m);
+}
+
+static int ssd_do_reset(struct ssd_device *dev)
+{
+	int ret = 0;
+
+	if (test_and_set_bit(SSD_RESETING, &dev->state)) {
+		return 0;
+	}
+
+	ssd_stop_workq(dev);
+
+	ret = ssd_barrier_start(dev);
+	if (ret) {
+		goto out;
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		/* old reset */
+		ret = __ssd_reset(dev, SSD_RST_NORMAL);
+	} else {
+		/* full reset */
+		//ret = __ssd_reset(dev, SSD_RST_FULL);
+		ret = __ssd_reset(dev, SSD_RST_NORMAL);
+	}
+	if (ret) {
+		goto out_barrier_end;
+	}
+
+out_barrier_end:
+	ssd_barrier_end(dev);
+out:
+	ssd_start_workq(dev);
+	test_and_clear_bit(SSD_RESETING, &dev->state);
+	return ret;
+}
+
+static int ssd_full_reset(struct ssd_device *dev)
+{
+	int ret = 0;
+
+	if (test_and_set_bit(SSD_RESETING, &dev->state)) {
+		return 0;
+	}
+
+	ssd_stop_workq(dev);
+
+	ret = ssd_barrier_start(dev);
+	if (ret) {
+		goto out;
+	}
+
+	ret = ssd_barrier_flush(dev);
+	if (ret) {
+		goto out_barrier_end;
+	}
+
+	ret = ssd_barrier_save_md(dev);
+	if (ret) {
+		goto out_barrier_end;
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		/* old reset */
+		ret = __ssd_reset(dev, SSD_RST_NORMAL);
+	} else {
+		/* full reset */
+		//ret = __ssd_reset(dev, SSD_RST_FULL);
+		ret = __ssd_reset(dev, SSD_RST_NORMAL);
+	}
+	if (ret) {
+		goto out_barrier_end;
+	}
+
+out_barrier_end:
+	ssd_barrier_end(dev);
+out:
+	ssd_start_workq(dev);
+	test_and_clear_bit(SSD_RESETING, &dev->state);
+	return ret;
+}
+
+int ssd_reset(struct block_device *bdev)
+{
+	struct ssd_device *dev;
+
+	if (!bdev || !(bdev->bd_disk)) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+
+	return ssd_full_reset(dev);
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+static int ssd_issue_flush_fn(struct request_queue *q, struct gendisk *disk, 
+		sector_t *error_sector)
+{
+	struct ssd_device *dev = q->queuedata;
+
+	return ssd_flush(dev);
+}
+#endif
+
+void ssd_submit_pbio(struct request_queue *q, struct bio *bio)
+{
+	struct ssd_device *dev = q->queuedata;
+#ifdef SSD_QUEUE_PBIO
+	int ret = -EBUSY;
+#endif
+
+	if (!test_bit(SSD_ONLINE, &dev->state)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -ENODEV);
+#else
+		bio_endio(bio, bio->bi_size, -ENODEV);
+#endif
+		goto out;
+	}
+
+#ifdef SSD_DEBUG_ERR
+	if (atomic_read(&dev->tocnt)) {
+		hio_warn("%s: IO rejected because of IO timeout!\n", dev->name);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EIO);
+#else
+		bio_endio(bio, bio->bi_size, -EIO);
+#endif
+		goto out;
+	}
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,32))
+	if (unlikely(bio_barrier(bio))) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EOPNOTSUPP);
+#else
+		bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+#endif
+		goto out;
+	}
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,36))
+	if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EOPNOTSUPP);
+#else
+		bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+#endif
+		goto out;
+	}
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37))
+	if (unlikely(bio->bi_rw & REQ_HARDBARRIER)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EOPNOTSUPP);
+#else
+		bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+#endif
+		goto out;
+	}
+#else
+	//xx
+	if (unlikely(bio->bi_rw & REQ_FUA)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EOPNOTSUPP);
+#else
+		bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+#endif
+		goto out;
+	}
+#endif
+
+	 if (unlikely(dev->readonly && bio_data_dir(bio) == WRITE)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EROFS);
+#else
+		bio_endio(bio, bio->bi_size, -EROFS);
+#endif
+		goto out;
+	}
+
+#ifdef SSD_QUEUE_PBIO
+	if (0 == atomic_read(&dev->in_sendq)) {
+		ret = __ssd_submit_pbio(dev, bio, 0);
+	}
+
+	if (ret) {
+		(void)test_and_set_bit(BIO_SSD_PBIO, &bio->bi_flags);
+		ssd_queue_bio(dev, bio);
+	}
+#else
+	__ssd_submit_pbio(dev, bio, 1);
+#endif
+
+out:
+	return;
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,2,0))
+static int ssd_make_request(struct request_queue *q, struct bio *bio)
+#else
+static void ssd_make_request(struct request_queue *q, struct bio *bio)
+#endif
+{
+	struct ssd_device *dev = q->queuedata;
+	int ret = -EBUSY;
+
+	if (!test_bit(SSD_ONLINE, &dev->state)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -ENODEV);
+#else
+		bio_endio(bio, bio->bi_size, -ENODEV);
+#endif
+		goto out;
+	}
+
+#ifdef SSD_DEBUG_ERR
+	if (atomic_read(&dev->tocnt)) {
+		hio_warn("%s: IO rejected because of IO timeout!\n", dev->name);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EIO);
+#else
+		bio_endio(bio, bio->bi_size, -EIO);
+#endif
+		goto out;
+	}
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,32))
+	if (unlikely(bio_barrier(bio))) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EOPNOTSUPP);
+#else
+		bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+#endif
+		goto out;
+	}
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,36))
+	if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EOPNOTSUPP);
+#else
+		bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+#endif
+		goto out;
+	}
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37))
+	if (unlikely(bio->bi_rw & REQ_HARDBARRIER)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EOPNOTSUPP);
+#else
+		bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+#endif
+		goto out;
+	}
+#else
+	//xx
+	if (unlikely(bio->bi_rw & REQ_FUA)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+		bio_endio(bio, -EOPNOTSUPP);
+#else
+		bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+#endif
+		goto out;
+	}
+
+	/* writeback_cache_control.txt: REQ_FLUSH requests without data can be completed successfully without doing any work */
+	if (unlikely((bio->bi_rw & REQ_FLUSH) && !bio_sectors(bio))) {
+		bio_endio(bio, 0);
+		goto out;
+	}
+
+#endif
+
+	if (0 == atomic_read(&dev->in_sendq)) {
+		ret = ssd_submit_bio(dev, bio, 0);
+	}
+
+	if (ret) {
+		ssd_queue_bio(dev, bio);
+	}
+
+out:
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,2,0))
+	return 0;
+#else
+	return;
+#endif
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16))
+static int ssd_block_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+{
+	struct ssd_device *dev;
+
+	if (!bdev) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+	if (!dev) {
+		return -EINVAL;
+	}
+
+	geo->heads = 4;
+	geo->sectors = 16;
+	geo->cylinders = (dev->hw_info.size & ~0x3f) >> 6;
+	return 0;
+}
+#endif
+
+static void ssd_cleanup_blkdev(struct ssd_device *dev);
+static int ssd_init_blkdev(struct ssd_device *dev);
+static int ssd_ioctl_common(struct ssd_device *dev, unsigned int cmd, unsigned long arg)
+{
+	void __user *argp = (void __user *)arg;
+	void __user *buf = NULL;
+	void *kbuf = NULL;
+	int ret = 0;
+
+	switch (cmd) {
+		case SSD_CMD_GET_PROTOCOL_INFO:
+			if (copy_to_user(argp, &dev->protocol_info, sizeof(struct ssd_protocol_info))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+
+		case SSD_CMD_GET_HW_INFO:
+			if (copy_to_user(argp, &dev->hw_info, sizeof(struct ssd_hw_info))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+
+		case SSD_CMD_GET_ROM_INFO:
+			if (copy_to_user(argp, &dev->rom_info, sizeof(struct ssd_rom_info))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+
+		case SSD_CMD_GET_SMART: {
+			struct ssd_smart smart;
+			int i;
+
+			memcpy(&smart, &dev->smart, sizeof(struct ssd_smart));
+
+			mutex_lock(&dev->gd_mutex);
+			ssd_update_smart(dev, &smart);
+			mutex_unlock(&dev->gd_mutex);
+
+			/* combine the volatile log info */
+			if (dev->log_info.nr_log) {
+				for (i=0; i<SSD_LOG_NR_LEVEL; i++) {
+					smart.log_info.stat[i] += dev->log_info.stat[i];
+				}
+			}
+
+			if (copy_to_user(argp, &smart, sizeof(struct ssd_smart))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_GET_IDX:
+			if (copy_to_user(argp, &dev->idx, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+
+		case SSD_CMD_GET_AMOUNT: {
+			int nr_ssd = atomic_read(&ssd_nr);
+			if (copy_to_user(argp, &nr_ssd, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_TO_INFO: {
+			int tocnt = atomic_read(&dev->tocnt);
+
+			if (copy_to_user(argp, &tocnt, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_DRV_VER: {
+			char ver[] = DRIVER_VERSION;
+			int len = sizeof(ver);
+
+			if (len > (DRIVER_VERSION_LEN - 1)) {
+				len = (DRIVER_VERSION_LEN - 1);
+			}
+			if (copy_to_user(argp, ver, len)) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_BBACC_INFO: {
+			struct ssd_acc_info acc;
+
+			mutex_lock(&dev->fw_mutex);
+			ret = ssd_bb_acc(dev, &acc);
+			mutex_unlock(&dev->fw_mutex);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(argp, &acc, sizeof(struct ssd_acc_info))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_ECACC_INFO: {
+			struct ssd_acc_info acc;
+
+			mutex_lock(&dev->fw_mutex);
+			ret = ssd_ec_acc(dev, &acc);
+			mutex_unlock(&dev->fw_mutex);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(argp, &acc, sizeof(struct ssd_acc_info))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_HW_INFO_EXT:
+			if (copy_to_user(argp, &dev->hw_info_ext, sizeof(struct ssd_hw_info_extend))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+
+		case SSD_CMD_REG_READ: {
+			struct ssd_reg_op_info reg_info;
+
+			if (copy_from_user(&reg_info, argp, sizeof(struct ssd_reg_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			if (reg_info.offset > dev->mmio_len-sizeof(uint32_t)) {
+				ret = -EINVAL;
+				break;
+			}
+
+			reg_info.value = ssd_reg32_read(dev->ctrlp + reg_info.offset);
+			if (copy_to_user(argp, &reg_info, sizeof(struct ssd_reg_op_info))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_REG_WRITE: {
+			struct ssd_reg_op_info reg_info;
+
+			if (copy_from_user(&reg_info, argp, sizeof(struct ssd_reg_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			if (reg_info.offset > dev->mmio_len-sizeof(uint32_t)) {
+				ret = -EINVAL;
+				break;
+			}
+
+			ssd_reg32_write(dev->ctrlp + reg_info.offset, reg_info.value);
+
+			break;
+		}
+
+		case SSD_CMD_SPI_READ: {
+			struct ssd_spi_op_info spi_info;
+			uint32_t off, size;
+
+			if (copy_from_user(&spi_info, argp, sizeof(struct ssd_spi_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			off = spi_info.off;
+			size = spi_info.len;
+			buf = spi_info.buf;
+
+			if (size > dev->rom_info.size || 0 == size || (off + size) > dev->rom_info.size) {
+				ret = -EINVAL;
+				break;
+			}
+
+			kbuf = kmalloc(size, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			ret = ssd_spi_page_read(dev, kbuf, off, size);
+			if (ret) {
+				kfree(kbuf);
+				break;
+			}
+
+			if (copy_to_user(buf, kbuf, size)) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			kfree(kbuf);
+
+			break;
+		}
+
+		case SSD_CMD_SPI_WRITE: {
+			struct ssd_spi_op_info spi_info;
+			uint32_t off, size;
+
+			if (copy_from_user(&spi_info, argp, sizeof(struct ssd_spi_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			off = spi_info.off;
+			size = spi_info.len;
+			buf = spi_info.buf;
+
+			if (size > dev->rom_info.size || 0 == size || (off + size) > dev->rom_info.size) {
+				ret = -EINVAL;
+				break;
+			}
+
+			kbuf = kmalloc(size, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			if (copy_from_user(kbuf, buf, size)) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = ssd_spi_page_write(dev, kbuf, off, size);
+			if (ret) {
+				kfree(kbuf);
+				break;
+			}
+
+			kfree(kbuf);
+
+			break;
+		}
+
+		case SSD_CMD_SPI_ERASE: {
+			struct ssd_spi_op_info spi_info;
+			uint32_t off;
+
+			if (copy_from_user(&spi_info, argp, sizeof(struct ssd_spi_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			off = spi_info.off;
+
+			if ((off + dev->rom_info.block_size) > dev->rom_info.size) {
+				ret = -EINVAL;
+				break;
+			}
+
+			ret = ssd_spi_block_erase(dev, off);
+			if (ret) {
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_I2C_READ: {
+			struct ssd_i2c_op_info i2c_info;
+			uint8_t saddr;
+			uint8_t rsize;
+
+			if (copy_from_user(&i2c_info, argp, sizeof(struct ssd_i2c_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = i2c_info.saddr;
+			rsize = i2c_info.rsize;
+			buf = i2c_info.rbuf;
+
+			if (rsize <= 0 || rsize > SSD_I2C_MAX_DATA) {
+				ret = -EINVAL;
+				break;
+			}
+
+			kbuf = kmalloc(rsize, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			ret = ssd_i2c_read(dev, saddr, rsize, kbuf);
+			if (ret) {
+				kfree(kbuf);
+				break;
+			}
+
+			if (copy_to_user(buf, kbuf, rsize)) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			kfree(kbuf);
+
+			break;
+		}
+
+		case SSD_CMD_I2C_WRITE: {
+			struct ssd_i2c_op_info i2c_info;
+			uint8_t saddr;
+			uint8_t wsize;
+
+			if (copy_from_user(&i2c_info, argp, sizeof(struct ssd_i2c_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = i2c_info.saddr;
+			wsize = i2c_info.wsize;
+			buf = i2c_info.wbuf;
+
+			if (wsize <= 0 || wsize > SSD_I2C_MAX_DATA) {
+				ret = -EINVAL;
+				break;
+			}
+
+			kbuf = kmalloc(wsize, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			if (copy_from_user(kbuf, buf, wsize)) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = ssd_i2c_write(dev, saddr, wsize, kbuf);
+			if (ret) {
+				kfree(kbuf);
+				break;
+			}
+
+			kfree(kbuf);
+
+			break;
+		}
+
+		case SSD_CMD_I2C_WRITE_READ: {
+			struct ssd_i2c_op_info i2c_info;
+			uint8_t saddr;
+			uint8_t wsize;
+			uint8_t rsize;
+			uint8_t size;
+
+			if (copy_from_user(&i2c_info, argp, sizeof(struct ssd_i2c_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = i2c_info.saddr;
+			wsize = i2c_info.wsize;
+			rsize = i2c_info.rsize;
+			buf = i2c_info.wbuf;
+
+			if (wsize <= 0 || wsize > SSD_I2C_MAX_DATA) {
+				ret = -EINVAL;
+				break;
+			}
+
+			if (rsize <= 0 || rsize > SSD_I2C_MAX_DATA) {
+				ret = -EINVAL;
+				break;
+			}
+
+			size = wsize + rsize;
+
+			kbuf = kmalloc(size, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			if (copy_from_user((kbuf + rsize), buf, wsize)) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			buf = i2c_info.rbuf;
+
+			ret = ssd_i2c_write_read(dev, saddr, wsize, (kbuf + rsize), rsize, kbuf);
+			if (ret) {
+				kfree(kbuf);
+				break;
+			}
+
+			if (copy_to_user(buf, kbuf, rsize)) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			kfree(kbuf);
+
+			break;
+		}
+
+		case SSD_CMD_SMBUS_SEND_BYTE: {
+			struct ssd_smbus_op_info smbus_info;
+			uint8_t smb_data[SSD_SMBUS_BLOCK_MAX];
+			uint8_t saddr;
+			uint8_t size;
+
+			if (copy_from_user(&smbus_info, argp, sizeof(struct ssd_smbus_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = smbus_info.saddr;
+			buf = smbus_info.buf;
+			size = 1;
+
+			if (copy_from_user(smb_data, buf, size)) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = ssd_smbus_send_byte(dev, saddr, smb_data);
+			if (ret) {
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_SMBUS_RECEIVE_BYTE: {
+			struct ssd_smbus_op_info smbus_info;
+			uint8_t smb_data[SSD_SMBUS_BLOCK_MAX];
+			uint8_t saddr;
+			uint8_t size;
+
+			if (copy_from_user(&smbus_info, argp, sizeof(struct ssd_smbus_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = smbus_info.saddr;
+			buf = smbus_info.buf;
+			size = 1;
+
+			ret = ssd_smbus_receive_byte(dev, saddr, smb_data);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(buf, smb_data, size)) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_SMBUS_WRITE_BYTE: {
+			struct ssd_smbus_op_info smbus_info;
+			uint8_t smb_data[SSD_SMBUS_BLOCK_MAX];
+			uint8_t saddr;
+			uint8_t command;
+			uint8_t size;
+
+			if (copy_from_user(&smbus_info, argp, sizeof(struct ssd_smbus_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = smbus_info.saddr;
+			command = smbus_info.cmd;
+			buf = smbus_info.buf;
+			size = 1;
+
+			if (copy_from_user(smb_data, buf, size)) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = ssd_smbus_write_byte(dev, saddr, command, smb_data);
+			if (ret) {
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_SMBUS_READ_BYTE: {
+			struct ssd_smbus_op_info smbus_info;
+			uint8_t smb_data[SSD_SMBUS_BLOCK_MAX];
+			uint8_t saddr;
+			uint8_t command;
+			uint8_t size;
+
+			if (copy_from_user(&smbus_info, argp, sizeof(struct ssd_smbus_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = smbus_info.saddr;
+			command = smbus_info.cmd;
+			buf = smbus_info.buf;
+			size = 1;
+
+			ret = ssd_smbus_read_byte(dev, saddr, command, smb_data);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(buf, smb_data, size)) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_SMBUS_WRITE_WORD: {
+			struct ssd_smbus_op_info smbus_info;
+			uint8_t smb_data[SSD_SMBUS_BLOCK_MAX];
+			uint8_t saddr;
+			uint8_t command;
+			uint8_t size;
+
+			if (copy_from_user(&smbus_info, argp, sizeof(struct ssd_smbus_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = smbus_info.saddr;
+			command = smbus_info.cmd;
+			buf = smbus_info.buf;
+			size = 2;
+
+			if (copy_from_user(smb_data, buf, size)) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = ssd_smbus_write_word(dev, saddr, command, smb_data);
+			if (ret) {
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_SMBUS_READ_WORD: {
+			struct ssd_smbus_op_info smbus_info;
+			uint8_t smb_data[SSD_SMBUS_BLOCK_MAX];
+			uint8_t saddr;
+			uint8_t command;
+			uint8_t size;
+
+			if (copy_from_user(&smbus_info, argp, sizeof(struct ssd_smbus_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = smbus_info.saddr;
+			command = smbus_info.cmd;
+			buf = smbus_info.buf;
+			size = 2;
+
+			ret = ssd_smbus_read_word(dev, saddr, command, smb_data);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(buf, smb_data, size)) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_SMBUS_WRITE_BLOCK: {
+			struct ssd_smbus_op_info smbus_info;
+			uint8_t smb_data[SSD_SMBUS_BLOCK_MAX];
+			uint8_t saddr;
+			uint8_t command;
+			uint8_t size;
+
+			if (copy_from_user(&smbus_info, argp, sizeof(struct ssd_smbus_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = smbus_info.saddr;
+			command = smbus_info.cmd;
+			buf = smbus_info.buf;
+			size = smbus_info.size;
+
+			if (size > SSD_SMBUS_BLOCK_MAX) {
+				ret = -EINVAL;
+				break;
+			}
+
+			if (copy_from_user(smb_data, buf, size)) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = ssd_smbus_write_block(dev, saddr, command, size, smb_data);
+			if (ret) {
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_SMBUS_READ_BLOCK: {
+			struct ssd_smbus_op_info smbus_info;
+			uint8_t smb_data[SSD_SMBUS_BLOCK_MAX];
+			uint8_t saddr;
+			uint8_t command;
+			uint8_t size;
+
+			if (copy_from_user(&smbus_info, argp, sizeof(struct ssd_smbus_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			saddr = smbus_info.saddr;
+			command = smbus_info.cmd;
+			buf = smbus_info.buf;
+			size = smbus_info.size;
+
+			if (size > SSD_SMBUS_BLOCK_MAX) {
+				ret = -EINVAL;
+				break;
+			}
+
+			ret = ssd_smbus_read_block(dev, saddr, command, size, smb_data);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(buf, smb_data, size)) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_BM_GET_VER: {
+			uint16_t ver;
+
+			ret = ssd_bm_get_version(dev, &ver);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(argp, &ver, sizeof(uint16_t))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_BM_GET_NR_CAP: {
+			int nr_cap;
+
+			ret = ssd_bm_nr_cap(dev, &nr_cap);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(argp, &nr_cap, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_BM_CAP_LEARNING: {
+			ret = ssd_bm_enter_cap_learning(dev);
+
+			if (ret) {
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_CAP_LEARN: {
+			uint32_t cap = 0;
+
+			ret = ssd_cap_learn(dev, &cap);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(argp, &cap, sizeof(uint32_t))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_GET_CAP_STATUS: {
+			int cap_status = 0;
+
+			if (test_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+				cap_status = 1;
+			}
+
+			if (copy_to_user(argp, &cap_status, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_RAM_READ: {
+			struct ssd_ram_op_info ram_info;
+			uint64_t ofs;
+			uint32_t length;
+			size_t rlen, len = dev->hw_info.ram_max_len;
+			int ctrl_idx;
+
+			if (copy_from_user(&ram_info, argp, sizeof(struct ssd_ram_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			ofs = ram_info.start;
+			length = ram_info.length;
+			buf = ram_info.buf;
+			ctrl_idx = ram_info.ctrl_idx;
+
+			if (ofs >= dev->hw_info.ram_size || length > dev->hw_info.ram_size || 0 == length || (ofs + length) > dev->hw_info.ram_size) {
+				ret = -EINVAL;
+				break;
+			}
+
+			kbuf = kmalloc(len, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			for (rlen=0; rlen<length; rlen+=len, buf+=len, ofs+=len) {
+				if ((length - rlen) < len) {
+					len = length - rlen;
+				}
+
+				ret = ssd_ram_read(dev, kbuf, len, ofs, ctrl_idx);
+				if (ret) {
+					break;
+				}
+
+				if (copy_to_user(buf, kbuf, len)) {
+					ret = -EFAULT;
+					break;
+				}
+			}
+
+			kfree(kbuf);
+
+			break;
+		}
+
+		case SSD_CMD_RAM_WRITE: {
+			struct ssd_ram_op_info ram_info;
+			uint64_t ofs;
+			uint32_t length;
+			size_t wlen, len = dev->hw_info.ram_max_len;
+			int ctrl_idx;
+
+			if (copy_from_user(&ram_info, argp, sizeof(struct ssd_ram_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			ofs = ram_info.start;
+			length = ram_info.length;
+			buf = ram_info.buf;
+			ctrl_idx = ram_info.ctrl_idx;
+
+			if (ofs >= dev->hw_info.ram_size || length > dev->hw_info.ram_size || 0 == length || (ofs + length) > dev->hw_info.ram_size) {
+				ret = -EINVAL;
+				break;
+			}
+
+			kbuf = kmalloc(len, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			for (wlen=0; wlen<length; wlen+=len, buf+=len, ofs+=len) {
+				if ((length - wlen) < len) {
+					len = length - wlen;
+				}
+
+				if (copy_from_user(kbuf, buf, len)) {
+					ret = -EFAULT;
+					break;
+				}
+
+				ret = ssd_ram_write(dev, kbuf, len, ofs, ctrl_idx);
+				if (ret) {
+					break;
+				}
+			}
+
+			kfree(kbuf);
+
+			break;
+		}
+
+		case SSD_CMD_NAND_READ_ID: {
+			struct ssd_flash_op_info flash_info;
+			int chip_no, chip_ce, length, ctrl_idx;
+
+			if (copy_from_user(&flash_info, argp, sizeof(struct ssd_flash_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			chip_no = flash_info.flash;
+			chip_ce = flash_info.chip;
+			ctrl_idx = flash_info.ctrl_idx;
+			buf = flash_info.buf;
+			length = dev->hw_info.id_size;
+
+			//kbuf = kmalloc(length, GFP_KERNEL);
+			kbuf = kmalloc(SSD_NAND_ID_BUFF_SZ, GFP_KERNEL); //xx
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+			memset(kbuf, 0, length);
+
+			ret = ssd_nand_read_id(dev, kbuf, chip_no, chip_ce, ctrl_idx);
+ 			if (ret) {
+				kfree(kbuf);
+				break;
+			}
+
+			if (copy_to_user(buf, kbuf, length)) {
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			kfree(kbuf);
+
+			break;
+		}
+
+		case SSD_CMD_NAND_READ: {	//with oob
+			struct ssd_flash_op_info flash_info;
+			uint32_t length;
+			int flash, chip, page, ctrl_idx;
+			int err = 0;
+
+			if (copy_from_user(&flash_info, argp, sizeof(struct ssd_flash_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			flash = flash_info.flash;
+			chip = flash_info.chip;
+			page = flash_info.page;
+			buf = flash_info.buf;
+			ctrl_idx = flash_info.ctrl_idx;
+
+			length = dev->hw_info.page_size + dev->hw_info.oob_size;
+
+			kbuf = kmalloc(length, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			err = ret = ssd_nand_read_w_oob(dev, kbuf, flash, chip, page, 1, ctrl_idx);
+			if (ret && (-EIO != ret)) {
+				kfree(kbuf);
+				break;
+			}
+
+			if (copy_to_user(buf, kbuf, length)) {
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = err;
+
+			kfree(kbuf);
+			break;
+		}
+
+		case SSD_CMD_NAND_WRITE: {
+			struct ssd_flash_op_info flash_info;
+			int flash, chip, page, ctrl_idx;
+			uint32_t length;
+
+			if (copy_from_user(&flash_info, argp, sizeof(struct ssd_flash_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			flash = flash_info.flash;
+			chip = flash_info.chip;
+			page = flash_info.page;
+			buf = flash_info.buf;
+			ctrl_idx = flash_info.ctrl_idx;
+
+			length = dev->hw_info.page_size + dev->hw_info.oob_size;
+
+			kbuf = kmalloc(length, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			if (copy_from_user(kbuf, buf, length)) {
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = ssd_nand_write(dev, kbuf, flash, chip, page, 1, ctrl_idx);
+			if (ret) {
+				kfree(kbuf);
+				break;
+			}
+
+			kfree(kbuf);
+			break;
+		}
+
+		case SSD_CMD_NAND_ERASE: {
+			struct ssd_flash_op_info flash_info;
+			int flash, chip, page, ctrl_idx;
+
+			if (copy_from_user(&flash_info, argp, sizeof(struct ssd_flash_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			flash = flash_info.flash;
+			chip = flash_info.chip;
+			page = flash_info.page;
+			ctrl_idx = flash_info.ctrl_idx;
+
+			if ((page % dev->hw_info.page_count) != 0) {
+				ret = -EINVAL;
+				break;
+			}
+
+			//hio_warn("erase fs = %llx\n", ofs);
+			ret = ssd_nand_erase(dev, flash, chip, page, ctrl_idx);
+			if (ret) {
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_NAND_READ_EXT: {	//ingore EIO
+			struct ssd_flash_op_info flash_info;
+			uint32_t length;
+			int flash, chip, page, ctrl_idx;
+
+			if (copy_from_user(&flash_info, argp, sizeof(struct ssd_flash_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			flash = flash_info.flash;
+			chip = flash_info.chip;
+			page = flash_info.page;
+			buf = flash_info.buf;
+			ctrl_idx = flash_info.ctrl_idx;
+
+			length = dev->hw_info.page_size + dev->hw_info.oob_size;
+
+			kbuf = kmalloc(length, GFP_KERNEL);
+			if (!kbuf) {
+				ret = -ENOMEM;
+				break;
+			}
+
+			ret = ssd_nand_read_w_oob(dev, kbuf, flash, chip, page, 1, ctrl_idx);
+			if (-EIO == ret) {	//ingore EIO
+				ret = 0;
+			}
+			if (ret) {
+				kfree(kbuf);
+				break;
+			}
+
+			if (copy_to_user(buf, kbuf, length)) {
+				kfree(kbuf);
+				ret = -EFAULT;
+				break;
+			}
+
+			kfree(kbuf);
+			break;
+		}
+
+		case SSD_CMD_UPDATE_BBT: {
+			struct ssd_flash_op_info flash_info;
+			int ctrl_idx, flash;
+
+			if (copy_from_user(&flash_info, argp, sizeof(struct ssd_flash_op_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			ctrl_idx = flash_info.ctrl_idx;
+			flash = flash_info.flash;
+			ret = ssd_update_bbt(dev, flash, ctrl_idx);
+			if (ret) {
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_CLEAR_ALARM:
+			ssd_clear_alarm(dev);
+			break;
+
+		case SSD_CMD_SET_ALARM:
+			ssd_set_alarm(dev);
+			break;
+
+		case SSD_CMD_RESET:
+			ret = ssd_do_reset(dev);
+			break;
+
+		case SSD_CMD_RELOAD_FW:
+			dev->reload_fw = 1;
+			if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+				ssd_reg32_write(dev->ctrlp + SSD_RELOAD_FW_REG, SSD_RELOAD_FLAG);
+			} else if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_1_1) {
+				ssd_reg32_write(dev->ctrlp + SSD_RELOAD_FW_REG, SSD_RELOAD_FW);
+				
+			}
+			break;
+
+		case SSD_CMD_UNLOAD_DEV: {
+			if (atomic_read(&dev->refcnt)) {
+				ret = -EBUSY;
+				break;
+			}
+
+			/* save smart */
+			ssd_save_smart(dev);
+
+			ret = ssd_flush(dev);
+			if (ret) {
+				break;
+			}
+
+			/* cleanup the block device */
+			if (test_and_clear_bit(SSD_INIT_BD, &dev->state)) {
+				mutex_lock(&dev->gd_mutex);
+				ssd_cleanup_blkdev(dev);
+				mutex_unlock(&dev->gd_mutex);
+			}
+
+			break;
+		}
+
+		case SSD_CMD_LOAD_DEV: {
+
+			if (test_bit(SSD_INIT_BD, &dev->state)) {
+				ret = -EINVAL;
+				break;
+			}
+
+			ret = ssd_init_smart(dev);
+			if (ret) {
+				hio_warn("%s: init info: failed\n", dev->name);
+				break;
+			}
+
+			ret = ssd_init_blkdev(dev);
+			if (ret) {
+				hio_warn("%s: register block device: failed\n", dev->name);
+				break;
+			}
+			(void)test_and_set_bit(SSD_INIT_BD, &dev->state);
+
+			break;
+		}
+
+		case SSD_CMD_UPDATE_VP: {
+			uint32_t val;
+			uint32_t new_vp, new_vp1 = 0;
+
+			if (test_bit(SSD_INIT_BD, &dev->state)) {
+				ret = -EINVAL;
+				break;
+			}
+
+			if (copy_from_user(&new_vp, argp, sizeof(uint32_t))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			if (new_vp > dev->hw_info.max_valid_pages || new_vp <= 0) {
+				ret = -EINVAL;
+				break;
+			}
+
+			while (new_vp <= dev->hw_info.max_valid_pages) {
+				ssd_reg32_write(dev->ctrlp + SSD_VALID_PAGES_REG, new_vp);
+				msleep(10);
+				val = ssd_reg32_read(dev->ctrlp + SSD_VALID_PAGES_REG);
+				if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+					new_vp1 = val & 0x3FF;
+				} else {
+					new_vp1 = val & 0x7FFF;
+				}
+
+				if (new_vp1 == new_vp) {
+					break;
+				}
+
+				new_vp++;
+				/*if (new_vp == dev->hw_info.valid_pages) {
+					new_vp++;
+				}*/
+			}
+
+			if (new_vp1 != new_vp || new_vp > dev->hw_info.max_valid_pages) {
+				/* restore */
+				ssd_reg32_write(dev->ctrlp + SSD_VALID_PAGES_REG, dev->hw_info.valid_pages);
+				ret = -EINVAL;
+				break;
+			}
+
+			if (copy_to_user(argp, &new_vp, sizeof(uint32_t))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ssd_reg32_write(dev->ctrlp + SSD_VALID_PAGES_REG, dev->hw_info.valid_pages);
+				ret = -EFAULT;
+				break;
+			}
+
+			/* new */
+			dev->hw_info.valid_pages = new_vp;
+			dev->hw_info.size = (uint64_t)dev->hw_info.valid_pages * dev->hw_info.page_size;
+			dev->hw_info.size *= (dev->hw_info.block_count - dev->hw_info.reserved_blks);
+			dev->hw_info.size *= ((uint64_t)dev->hw_info.nr_data_ch * (uint64_t)dev->hw_info.nr_chip * (uint64_t)dev->hw_info.nr_ctrl);
+
+			break;
+		}
+
+		case SSD_CMD_FULL_RESET: {
+			ret = ssd_full_reset(dev);
+			break;
+		}
+
+		case SSD_CMD_GET_NR_LOG: {
+			if (copy_to_user(argp, &dev->internal_log.nr_log, sizeof(dev->internal_log.nr_log))) {
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_LOG: {
+			uint32_t length = dev->rom_info.log_sz;
+
+			buf = argp;
+
+			if (copy_to_user(buf, dev->internal_log.log, length)) {
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case SSD_CMD_LOG_LEVEL: {
+			int level = 0;
+			if (copy_from_user(&level, argp, sizeof(int))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			if (level >= SSD_LOG_NR_LEVEL || level < SSD_LOG_LEVEL_INFO) {
+				level = SSD_LOG_LEVEL_ERR;
+			}
+
+			//just for showing log, no need to protect
+			log_level = level;
+			break;
+		}
+
+		case SSD_CMD_OT_PROTECT: {
+			int protect = 0;
+
+			if (copy_from_user(&protect, argp, sizeof(int))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			ssd_set_ot_protect(dev, !!protect);
+			break;
+		}
+
+		case SSD_CMD_GET_OT_STATUS: {
+			int status = ssd_get_ot_status(dev, &status);
+
+			if (copy_to_user(argp, &status, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_CLEAR_LOG: {
+			ret = ssd_clear_log(dev);
+			break;
+		}
+
+		case SSD_CMD_CLEAR_SMART: {
+			ret = ssd_clear_smart(dev);
+			break;
+		}
+
+		case SSD_CMD_SW_LOG: {
+			struct ssd_sw_log_info sw_log;
+
+			if (copy_from_user(&sw_log, argp, sizeof(struct ssd_sw_log_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = ssd_gen_swlog(dev, sw_log.event, sw_log.data);
+			break;
+		}
+
+		case SSD_CMD_GET_LABEL: {
+
+			if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+				ret = -EINVAL;
+				break;
+			}
+			
+			if (copy_to_user(argp, &dev->label, sizeof(struct ssd_label))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_VERSION: {
+			struct ssd_version_info ver;
+
+			mutex_lock(&dev->fw_mutex);
+			ret = __ssd_get_version(dev, &ver);
+			mutex_unlock(&dev->fw_mutex);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(argp, &ver, sizeof(struct ssd_version_info))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_TEMPERATURE: {
+			int temp;
+
+			mutex_lock(&dev->fw_mutex);
+			ret = __ssd_get_temperature(dev, &temp);
+			mutex_unlock(&dev->fw_mutex);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(argp, &temp, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_BMSTATUS: {
+			int status;
+
+			mutex_lock(&dev->fw_mutex);
+			if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+				if (test_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+					status = SSD_BMSTATUS_WARNING;
+				} else {
+					status = SSD_BMSTATUS_OK;
+				}
+			} else if(dev->protocol_info.ver > SSD_PROTOCOL_V3) {
+				ret = __ssd_bm_status(dev, &status);
+			} else {
+				status = SSD_BMSTATUS_OK;
+			}
+			mutex_unlock(&dev->fw_mutex);
+			if (ret) {
+				break;
+			}
+
+			if (copy_to_user(argp, &status, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_GET_LABEL2: {
+			void *label;
+			int length;
+
+			if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+				label = &dev->label;
+				length = sizeof(struct ssd_label);
+			} else {
+				label = &dev->labelv3;
+				length = sizeof(struct ssd_labelv3);
+			}
+
+			if (copy_to_user(argp, label, length)) {
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		case SSD_CMD_FLUSH:
+			ret = ssd_flush(dev);
+			if (ret) {
+				hio_warn("%s: ssd_flush: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+
+		case SSD_CMD_SAVE_MD: {
+			int save_md = 0;
+
+			if (copy_from_user(&save_md, argp, sizeof(int))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			dev->save_md = !!save_md;
+			break;
+		}
+
+		case SSD_CMD_SET_WMODE: {
+			int new_wmode = 0;
+			
+			if (copy_from_user(&new_wmode, argp, sizeof(int))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			ret = __ssd_set_wmode(dev, new_wmode);
+			if (ret) {
+				break;
+			}
+			
+			break;
+		}
+
+		case SSD_CMD_GET_WMODE: {
+			if (copy_to_user(argp, &dev->wmode, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			
+			break;
+		}
+
+		case SSD_CMD_GET_USER_WMODE: {
+			if (copy_to_user(argp, &dev->user_wmode, sizeof(int))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			
+			break;
+		}
+
+		case SSD_CMD_DEBUG: {
+			struct ssd_debug_info db_info;
+
+			if (!finject) {
+				ret = -EOPNOTSUPP;
+				break;
+			}
+
+			if (copy_from_user(&db_info, argp, sizeof(struct ssd_debug_info))) {
+				hio_warn("%s: copy_from_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+
+			if (db_info.type < SSD_DEBUG_NONE || db_info.type >= SSD_DEBUG_NR) {
+				ret = -EINVAL;
+				break;
+			}
+
+			/* IO */
+			if (db_info.type >= SSD_DEBUG_READ_ERR && db_info.type <= SSD_DEBUG_RW_ERR && 
+				(db_info.data.loc.off + db_info.data.loc.len) > (dev->hw_info.size >> 9)) {
+				ret = -EINVAL;
+				break;
+			}
+
+			memcpy(&dev->db_info, &db_info, sizeof(struct ssd_debug_info));
+
+#ifdef SSD_OT_PROTECT
+			/* temperature */
+			if (db_info.type == SSD_DEBUG_NONE) {
+				ssd_check_temperature(dev, SSD_OT_TEMP);
+			} else if (db_info.type == SSD_DEBUG_LOG) {
+				if (db_info.data.log.event == SSD_LOG_OVER_TEMP) {
+					dev->ot_delay = SSD_OT_DELAY;
+				} else if (db_info.data.log.event == SSD_LOG_NORMAL_TEMP) {
+					dev->ot_delay = 0;
+				}
+			}
+#endif
+
+			/* offline */
+			if (db_info.type == SSD_DEBUG_OFFLINE) {
+				test_and_clear_bit(SSD_ONLINE, &dev->state);
+			} else if (db_info.type == SSD_DEBUG_NONE) {
+				(void)test_and_set_bit(SSD_ONLINE, &dev->state);
+			}
+
+			/* log */
+			if (db_info.type == SSD_DEBUG_LOG && dev->event_call && dev->gd) {
+				dev->event_call(dev->gd, db_info.data.log.event, 0);
+			}
+
+			break;
+		}
+
+		case SSD_CMD_DRV_PARAM_INFO: {
+			struct ssd_drv_param_info drv_param;
+
+			memset(&drv_param, 0, sizeof(struct ssd_drv_param_info));
+
+			drv_param.mode = mode;
+			drv_param.status_mask = status_mask;
+			drv_param.int_mode = int_mode;
+			drv_param.threaded_irq = threaded_irq;
+			drv_param.log_level = log_level;
+			drv_param.wmode = wmode;
+			drv_param.ot_protect = ot_protect;
+			drv_param.finject = finject;
+
+			if (copy_to_user(argp, &drv_param, sizeof(struct ssd_drv_param_info))) {
+				hio_warn("%s: copy_to_user: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+		}
+
+		default:
+			ret = -EINVAL;
+			break;
+	}
+
+	return ret;
+}
+
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,27))
+static int ssd_block_ioctl(struct inode *inode, struct file *file, 
+		unsigned int cmd, unsigned long arg)
+{
+	struct ssd_device *dev;
+	void __user *argp = (void __user *)arg;
+	int ret = 0;
+
+	if (!inode) {
+		return -EINVAL;
+	}
+	dev = inode->i_bdev->bd_disk->private_data;
+	if (!dev) {
+		return -EINVAL;
+	}
+#else
+static int ssd_block_ioctl(struct block_device *bdev, fmode_t mode, 
+		unsigned int cmd, unsigned long arg)
+{
+	struct ssd_device *dev;
+	void __user *argp = (void __user *)arg;
+	int ret = 0;
+
+	if (!bdev) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+	if (!dev) {
+		return -EINVAL;
+	}
+#endif
+
+	switch (cmd) {
+		case HDIO_GETGEO: {
+			struct hd_geometry geo;
+			geo.cylinders = (dev->hw_info.size & ~0x3f) >> 6;
+			geo.heads = 4;
+			geo.sectors = 16;
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,27))
+			geo.start = get_start_sect(inode->i_bdev);
+#else
+			geo.start = get_start_sect(bdev);
+#endif
+			if (copy_to_user(argp, &geo, sizeof(geo))) {
+				ret = -EFAULT;
+				break;
+			}
+
+			break;
+		}
+
+		case BLKFLSBUF:
+			ret = ssd_flush(dev);
+			if (ret) {
+				hio_warn("%s: ssd_flush: failed\n", dev->name);
+				ret = -EFAULT;
+				break;
+			}
+			break;
+
+		default:
+			if (!dev->slave) {
+				ret = ssd_ioctl_common(dev, cmd, arg);
+			} else {
+				ret = -EFAULT;
+			}
+			break;
+	}
+
+	return ret;
+}
+
+
+static void ssd_free_dev(struct kref *kref)
+{
+	struct ssd_device *dev;
+
+	if (!kref) {
+		return;
+	}
+
+	dev = container_of(kref, struct ssd_device, kref);
+
+	put_disk(dev->gd);
+
+	ssd_put_index(dev->slave, dev->idx);
+
+	kfree(dev);
+}
+
+static void ssd_put(struct ssd_device *dev)
+{
+	kref_put(&dev->kref, ssd_free_dev);
+}
+
+static int ssd_get(struct ssd_device *dev)
+{
+	kref_get(&dev->kref);
+	return 0;
+}
+
+/* block device */
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,27))
+static int ssd_block_open(struct inode *inode, struct file *filp)
+{
+	struct ssd_device *dev;
+
+	if (!inode) {
+		return -EINVAL;
+	}
+
+	dev = inode->i_bdev->bd_disk->private_data;
+	if (!dev) {
+		return -EINVAL;
+	}
+#else
+static int ssd_block_open(struct block_device *bdev, fmode_t mode)
+{
+	struct ssd_device *dev;
+
+	if (!bdev) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+	if (!dev) {
+		return -EINVAL;
+	}
+#endif
+
+	/*if (!try_module_get(dev->owner))
+		return -ENODEV;
+	*/
+
+	ssd_get(dev);
+
+	atomic_inc(&dev->refcnt);
+
+	return 0;
+}
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,27))
+static int ssd_block_release(struct inode *inode, struct file *filp)
+{
+	struct ssd_device *dev;
+
+	if (!inode) {
+		return -EINVAL;
+	}
+
+	dev = inode->i_bdev->bd_disk->private_data;
+	if (!dev) {
+		return -EINVAL;
+	}
+#elif (LINUX_VERSION_CODE <= KERNEL_VERSION(3,9,0))
+static int ssd_block_release(struct gendisk *disk, fmode_t mode)
+{
+	struct ssd_device *dev;
+
+	if (!disk) {
+		return -EINVAL;
+	}
+
+	dev = disk->private_data;
+	if (!dev) {
+		return -EINVAL;
+	}
+#else
+static void ssd_block_release(struct gendisk *disk, fmode_t mode)
+{
+	struct ssd_device *dev;
+
+	if (!disk) {
+		return;
+	}
+
+	dev = disk->private_data;
+	if (!dev) {
+		return;
+	}
+#endif
+
+	atomic_dec(&dev->refcnt);
+
+	ssd_put(dev);
+
+	//module_put(dev->owner);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3,9,0))
+	return 0;
+#endif
+}
+
+static struct block_device_operations ssd_fops = {
+	.owner		= THIS_MODULE,
+	.open		= ssd_block_open,
+	.release	= ssd_block_release,
+	.ioctl		= ssd_block_ioctl,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16))
+	.getgeo		= ssd_block_getgeo,
+#endif
+};
+
+static void ssd_init_trim(ssd_device_t *dev)
+{
+#if (defined SSD_TRIM && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,32)))
+	if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+		return;
+	}
+	queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, dev->rq);
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,33)) || (defined RHEL_MAJOR && RHEL_MAJOR >= 6))
+	dev->rq->limits.discard_zeroes_data = 1;
+	dev->rq->limits.discard_alignment = 4096;
+	dev->rq->limits.discard_granularity = 4096;
+#endif
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2_4) {
+		dev->rq->limits.max_discard_sectors = dev->hw_info.sg_max_sec;
+	} else {
+		dev->rq->limits.max_discard_sectors = (dev->hw_info.sg_max_sec) * (dev->hw_info.cmd_max_sg);
+	}
+#endif
+}
+
+static void ssd_cleanup_queue(struct ssd_device *dev)
+{
+	ssd_wait_io(dev);
+
+	blk_cleanup_queue(dev->rq);
+	dev->rq = NULL;
+}
+
+static int ssd_init_queue(struct ssd_device *dev)
+{
+	dev->rq = blk_alloc_queue(GFP_KERNEL);
+	if (dev->rq == NULL) {
+		hio_warn("%s: alloc queue: failed\n ", dev->name);
+		goto out_init_queue;
+	}
+
+	/* must be first */
+	blk_queue_make_request(dev->rq, ssd_make_request);
+
+#if ((LINUX_VERSION_CODE < KERNEL_VERSION(2,6,34)) && !(defined RHEL_MAJOR && RHEL_MAJOR == 6))
+	blk_queue_max_hw_segments(dev->rq, dev->hw_info.cmd_max_sg);
+	blk_queue_max_phys_segments(dev->rq, dev->hw_info.cmd_max_sg);
+	blk_queue_max_sectors(dev->rq, dev->hw_info.sg_max_sec);
+#else
+	blk_queue_max_segments(dev->rq, dev->hw_info.cmd_max_sg);
+	blk_queue_max_hw_sectors(dev->rq, dev->hw_info.sg_max_sec);
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,31))
+	blk_queue_hardsect_size(dev->rq, 512);
+#else
+	blk_queue_logical_block_size(dev->rq, 512);
+#endif
+	/* not work for make_request based drivers(bio) */
+	blk_queue_max_segment_size(dev->rq, dev->hw_info.sg_max_sec << 9);
+
+	blk_queue_bounce_limit(dev->rq, BLK_BOUNCE_HIGH);
+
+	dev->rq->queuedata = dev;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+	blk_queue_issue_flush_fn(dev->rq, ssd_issue_flush_fn);
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28))
+	queue_flag_set_unlocked(QUEUE_FLAG_NONROT, dev->rq);
+#endif
+
+	ssd_init_trim(dev);
+
+	return 0;
+
+out_init_queue:
+	return -ENOMEM;
+}
+
+static void ssd_cleanup_blkdev(struct ssd_device *dev)
+{
+	del_gendisk(dev->gd);
+}
+
+static int ssd_init_blkdev(struct ssd_device *dev)
+{
+	if (dev->gd) {
+		put_disk(dev->gd);
+	}
+
+	dev->gd = alloc_disk(ssd_minors);
+	if (!dev->gd) {
+		hio_warn("%s: alloc_disk fail\n", dev->name);
+		goto out_alloc_gd;
+	}
+	dev->gd->major = dev->major;
+	dev->gd->first_minor = dev->idx * ssd_minors;
+	dev->gd->fops = &ssd_fops;
+	dev->gd->queue = dev->rq;
+	dev->gd->private_data = dev;
+	dev->gd->driverfs_dev = &dev->pdev->dev;
+	snprintf (dev->gd->disk_name, sizeof(dev->gd->disk_name), "%s", dev->name);
+
+	set_capacity(dev->gd, dev->hw_info.size >> 9);
+
+	add_disk(dev->gd);
+
+	return 0;
+
+out_alloc_gd:
+	return -ENOMEM;
+}
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,10))
+static int ssd_ioctl(struct inode *inode, struct file *file, 
+		unsigned int cmd, unsigned long arg)
+#else
+static long ssd_ioctl(struct file *file, 
+		unsigned int cmd, unsigned long arg)
+#endif
+{
+	struct ssd_device *dev;
+
+	if (!file) {
+		return -EINVAL;
+	}
+
+	dev = file->private_data;
+	if (!dev) {
+		return -EINVAL;
+	}
+
+	return (long)ssd_ioctl_common(dev, cmd, arg);
+}
+
+static int ssd_open(struct inode *inode, struct file *file)
+{
+	struct ssd_device *dev = NULL;
+	struct ssd_device *n = NULL;
+	int idx;
+	int ret = -ENODEV;
+
+	if (!inode || !file) {
+		return -EINVAL;
+	}
+
+	idx = iminor(inode);
+
+	list_for_each_entry_safe(dev, n, &ssd_list, list) {
+		if (dev->idx == idx) {
+			ret = 0;
+			break;
+		}
+	}
+
+	if (ret) {
+		return ret;
+	}
+
+	file->private_data = dev;
+
+	ssd_get(dev);
+
+	return 0;
+}
+
+static int ssd_release(struct inode *inode, struct file *file)
+{
+	struct ssd_device *dev;
+
+	if (!file) {
+		return -EINVAL;
+	}
+
+	dev = file->private_data;
+	if (!dev) {
+		return -EINVAL;
+	}
+
+	ssd_put(dev);
+
+	file->private_data = NULL;
+
+	return 0;
+}
+
+static struct file_operations ssd_cfops = {
+	.owner		= THIS_MODULE, 
+	.open		= ssd_open, 
+	.release	= ssd_release, 
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,10))
+	.ioctl		= ssd_ioctl,
+#else
+	.unlocked_ioctl = ssd_ioctl, 
+#endif
+};
+
+static void ssd_cleanup_chardev(struct ssd_device *dev)
+{
+	if (dev->slave) {
+		return;
+	}
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,12))
+	class_simple_device_remove(MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx));
+	devfs_remove("c%s", dev->name);
+#elif (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,14))
+	class_device_destroy(ssd_class, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx));
+	devfs_remove("c%s", dev->name);
+#elif (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,17))
+	class_device_destroy(ssd_class, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx));
+	devfs_remove("c%s", dev->name);
+#elif (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,24))
+	class_device_destroy(ssd_class, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx));
+#else
+	device_destroy(ssd_class, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx));
+#endif
+}
+
+static int ssd_init_chardev(struct ssd_device *dev)
+{
+	int ret = 0;
+
+	if (dev->slave) {
+		return 0;
+	}
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,12))
+	ret = devfs_mk_cdev(MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), S_IFCHR|S_IRUSR|S_IWUSR, "c%s", dev->name);
+	if (ret) {
+		goto out;
+	}
+	class_simple_device_add(ssd_class, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), NULL, "c%s", dev->name);
+out:
+#elif (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,14))
+	ret = devfs_mk_cdev(MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), S_IFCHR|S_IRUSR|S_IWUSR, "c%s", dev->name);
+	if (ret) {
+		goto out;
+	}
+	class_device_create(ssd_class, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), NULL, "c%s", dev->name);
+out:
+#elif (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,17))
+	ret = devfs_mk_cdev(MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), S_IFCHR|S_IRUSR|S_IWUSR, "c%s", dev->name);
+	if (ret) {
+		goto out;
+	}
+	class_device_create(ssd_class, NULL, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), NULL, "c%s", dev->name);
+out:
+#elif (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,24))
+	class_device_create(ssd_class, NULL, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), NULL, "c%s", dev->name);
+#elif (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,26))
+	device_create(ssd_class, NULL, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), "c%s", dev->name);
+#elif (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,27))
+	device_create_drvdata(ssd_class, NULL, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), NULL, "c%s", dev->name);
+#else
+	device_create(ssd_class, NULL, MKDEV((dev_t)dev->cmajor, (dev_t)dev->idx), NULL, "c%s", dev->name);
+#endif
+
+	return ret;
+}
+
+static int ssd_check_hw(struct ssd_device *dev)
+{
+	uint32_t test_data = 0x55AA5AA5;
+	uint32_t read_data;
+
+	ssd_reg32_write(dev->ctrlp + SSD_BRIDGE_TEST_REG, test_data);
+	read_data = ssd_reg32_read(dev->ctrlp + SSD_BRIDGE_TEST_REG);
+	if (read_data != ~(test_data)) {
+		//hio_warn("%s: check bridge error: %#x\n", dev->name, read_data);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int ssd_check_fw(struct ssd_device *dev)
+{
+	uint32_t val = 0;
+	int i;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_3) {
+		return 0;
+	}
+
+	for (i=0; i<SSD_CONTROLLER_WAIT; i++) {
+		val = ssd_reg32_read(dev->ctrlp + SSD_HW_STATUS_REG);
+		if ((val & 0x1) && ((val >> 8) & 0x1)) {
+			break;
+		}
+
+		msleep(SSD_INIT_WAIT);
+	}
+
+	if (!(val & 0x1)) {
+		/* controller fw status */
+		hio_warn("%s: controller firmware load failed: %#x\n", dev->name, val);
+		return -1;
+	} else if (!((val >> 8) & 0x1)) {
+		/* controller state */
+		hio_warn("%s: controller state error: %#x\n", dev->name, val);
+		return -1;
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_RELOAD_FW_REG);
+	if (val) {
+		dev->reload_fw = 1;
+	}
+
+	return 0;
+}
+
+static int ssd_init_fw_info(struct ssd_device *dev)
+{
+	uint32_t val;
+	int ret = 0;
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_BRIDGE_VER_REG);
+	dev->hw_info.bridge_ver = val & 0xFFF;
+	if (dev->hw_info.bridge_ver < SSD_FW_MIN) {
+		hio_warn("%s: bridge firmware version %03X is not supported\n", dev->name, dev->hw_info.bridge_ver);
+		return -EINVAL;
+	}
+	hio_info("%s: bridge firmware version: %03X\n", dev->name, dev->hw_info.bridge_ver);
+
+	ret = ssd_check_fw(dev);
+	if (ret) {
+		goto out;
+	}
+
+out:
+	/* skip error if not in standard mode */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ret = 0;
+	}
+	return ret;
+}
+
+static int ssd_check_clock(struct ssd_device *dev)
+{
+	uint32_t val;
+	int ret = 0;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_3) {
+		return 0;
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_HW_STATUS_REG);
+
+	/* clock status */
+	if (!((val >> 4 ) & 0x1)) {
+		if (!test_and_set_bit(SSD_HWMON_CLOCK(SSD_CLOCK_166M_LOST), &dev->hwmon)) {
+			hio_warn("%s: 166MHz clock losed: %#x\n", dev->name, val);
+			ssd_gen_swlog(dev, SSD_LOG_CLK_FAULT, val);
+		}
+		ret = -1;
+	}
+
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		if (!((val >> 5 ) & 0x1)) {
+			if (!test_and_set_bit(SSD_HWMON_CLOCK(SSD_CLOCK_166M_SKEW), &dev->hwmon)) {
+				hio_warn("%s: 166MHz clock is skew: %#x\n", dev->name, val);
+				ssd_gen_swlog(dev, SSD_LOG_CLK_FAULT, val);
+			}
+			ret = -1;
+		}
+		if (!((val >> 6 ) & 0x1)) {
+			if (!test_and_set_bit(SSD_HWMON_CLOCK(SSD_CLOCK_156M_LOST), &dev->hwmon)) {
+				hio_warn("%s: 156.25MHz clock lost: %#x\n", dev->name, val);
+				ssd_gen_swlog(dev, SSD_LOG_CLK_FAULT, val);
+			}
+			ret = -1;
+		}
+		if (!((val >> 7 ) & 0x1)) {
+			if (!test_and_set_bit(SSD_HWMON_CLOCK(SSD_CLOCK_156M_SKEW), &dev->hwmon)) {
+				hio_warn("%s: 156.25MHz clock is skew: %#x\n", dev->name, val);
+				ssd_gen_swlog(dev, SSD_LOG_CLK_FAULT, val);
+			}
+			ret = -1;
+		}
+	}
+
+	return ret;
+}
+
+static int ssd_check_volt(struct ssd_device *dev)
+{
+	int i = 0;
+	uint64_t val;
+	uint32_t adc_val;
+	int ret =0;
+	
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		return 0;
+	}
+
+	for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+		/* 1.0v */
+		if (!test_bit(SSD_HWMON_FPGA(i, SSD_FPGA_1V0), &dev->hwmon)) {
+			val = ssd_reg_read(dev->ctrlp + SSD_FPGA_1V0_REG0 + i * SSD_CTRL_REG_ZONE_SZ);
+			adc_val = SSD_FPGA_VOLT_MAX(val);
+			if (adc_val < SSD_FPGA_1V0_ADC_MIN || adc_val > SSD_FPGA_1V0_ADC_MAX) {
+				(void)test_and_set_bit(SSD_HWMON_FPGA(i, SSD_FPGA_1V0), &dev->hwmon);
+				hio_warn("%s: controller %d 1.0V fault: %d mV.\n", dev->name, i, SSD_FPGA_VOLT(adc_val));
+				ssd_gen_swlog(dev, SSD_LOG_VOLT_FAULT, SSD_VOLT_LOG_DATA(SSD_FPGA_1V0, i, adc_val));
+				ret = -1;
+			}
+
+			adc_val = SSD_FPGA_VOLT_MIN(val);
+			if (adc_val < SSD_FPGA_1V0_ADC_MIN || adc_val > SSD_FPGA_1V0_ADC_MAX) {
+				(void)test_and_set_bit(SSD_HWMON_FPGA(i, SSD_FPGA_1V0), &dev->hwmon);
+				hio_warn("%s: controller %d 1.0V fault: %d mV.\n", dev->name, i, SSD_FPGA_VOLT(adc_val));
+				ssd_gen_swlog(dev, SSD_LOG_VOLT_FAULT, SSD_VOLT_LOG_DATA(SSD_FPGA_1V0, i, adc_val));
+				ret = -2;
+			}
+		}
+
+		/* 1.8v */
+		if (!test_bit(SSD_HWMON_FPGA(i, SSD_FPGA_1V8), &dev->hwmon)) {
+			val = ssd_reg_read(dev->ctrlp + SSD_FPGA_1V8_REG0 + i * SSD_CTRL_REG_ZONE_SZ);
+			adc_val = SSD_FPGA_VOLT_MAX(val);
+			if (adc_val < SSD_FPGA_1V8_ADC_MIN || adc_val > SSD_FPGA_1V8_ADC_MAX) {
+				(void)test_and_set_bit(SSD_HWMON_FPGA(i, SSD_FPGA_1V8), &dev->hwmon);
+				hio_warn("%s: controller %d 1.8V fault: %d mV.\n", dev->name, i, SSD_FPGA_VOLT(adc_val));
+				ssd_gen_swlog(dev, SSD_LOG_VOLT_FAULT, SSD_VOLT_LOG_DATA(SSD_FPGA_1V8, i, adc_val));
+				ret = -3;
+			}
+
+			adc_val = SSD_FPGA_VOLT_MIN(val);
+			if (adc_val < SSD_FPGA_1V8_ADC_MIN || adc_val > SSD_FPGA_1V8_ADC_MAX) {
+				(void)test_and_set_bit(SSD_HWMON_FPGA(i, SSD_FPGA_1V8), &dev->hwmon);
+				hio_warn("%s: controller %d 1.8V fault: %d mV.\n", dev->name, i, SSD_FPGA_VOLT(adc_val));
+				ssd_gen_swlog(dev, SSD_LOG_VOLT_FAULT, SSD_VOLT_LOG_DATA(SSD_FPGA_1V8, i, adc_val));
+				ret = -4;
+			}
+		}
+	}
+
+	return ret;
+}
+
+static int ssd_check_reset_sync(struct ssd_device *dev)
+{
+	uint32_t val;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_3) {
+		return 0;
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_HW_STATUS_REG);
+	if (!((val >> 8) & 0x1)) {
+		/* controller state */
+		hio_warn("%s: controller state error: %#x\n", dev->name, val);
+		return -1;
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		return 0;
+	}
+
+	if (((val >> 9 ) & 0x1)) {
+		hio_warn("%s: controller reset asynchronously: %#x\n", dev->name, val);
+		ssd_gen_swlog(dev, SSD_LOG_CTRL_RST_SYNC, val);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int ssd_check_hw_bh(struct ssd_device *dev)
+{
+	int ret;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_3) {
+		return 0;
+	}
+
+	/* clock status */
+	ret = ssd_check_clock(dev);
+	if (ret) {
+		goto out;
+	}
+
+out:
+	/* skip error if not in standard mode */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ret = 0;
+	}
+	return ret;
+}
+
+static int ssd_check_controller(struct ssd_device *dev)
+{
+	int ret;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_1_3) {
+		return 0;
+	}
+
+	/* sync reset */
+	ret = ssd_check_reset_sync(dev);
+	if (ret) {
+		goto out;
+	}
+
+out:
+	/* skip error if not in standard mode */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ret = 0;
+	}
+	return ret;
+}
+
+static int ssd_check_controller_bh(struct ssd_device *dev)
+{
+	uint32_t test_data = 0x55AA5AA5;
+	uint32_t val;
+	int reg_base, reg_sz;
+	int init_wait = 0;
+	int i;
+	int ret = 0;
+
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		return 0;
+	}
+
+	/* controller */
+	val = ssd_reg32_read(dev->ctrlp + SSD_READY_REG);
+	if (val & 0x1) {
+		hio_warn("%s: controller 0 not ready\n", dev->name);
+		return -1;
+	}
+
+	for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+		reg_base = SSD_CTRL_TEST_REG0 + i * SSD_CTRL_TEST_REG_SZ;
+		ssd_reg32_write(dev->ctrlp + reg_base, test_data);
+		val = ssd_reg32_read(dev->ctrlp + reg_base);
+		if (val != ~(test_data)) {
+			hio_warn("%s: check controller %d error: %#x\n", dev->name, i, val);
+			return -1;
+		}
+	}
+
+	/* clock */
+	ret = ssd_check_volt(dev);
+	if (ret) {
+		return ret;
+	}
+
+	/* ddr */
+	if (dev->protocol_info.ver > SSD_PROTOCOL_V3) {
+		reg_base = SSD_PV3_RAM_STATUS_REG0;
+		reg_sz = SSD_PV3_RAM_STATUS_REG_SZ;
+
+		for (i=0; i<dev->hw_info.nr_ctrl; i++) {
+check_ram_status:
+			val = ssd_reg32_read(dev->ctrlp + reg_base);
+
+			if (!((val >> 1) & 0x1)) {
+				init_wait++;
+				if (init_wait <= SSD_RAM_INIT_MAX_WAIT) {
+					msleep(SSD_INIT_WAIT);
+					goto check_ram_status;
+				} else {
+					hio_warn("%s: controller %d ram init failed: %#x\n", dev->name, i, val);
+					ssd_gen_swlog(dev, SSD_LOG_DDR_INIT_ERR, i);
+					return -1;
+				}
+			}
+
+			reg_base += reg_sz;
+		}
+	}
+
+	/* ch info */
+	for (i=0; i<SSD_CH_INFO_MAX_WAIT; i++) {
+		val = ssd_reg32_read(dev->ctrlp + SSD_CH_INFO_REG);
+		if (!((val >> 31) & 0x1)) {
+			break;
+		}
+
+		msleep(SSD_INIT_WAIT);
+	}
+	if ((val >> 31) & 0x1) {
+		hio_warn("%s: channel info init failed: %#x\n", dev->name, val);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int ssd_init_protocol_info(struct ssd_device *dev)
+{
+	uint32_t val;
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_PROTOCOL_VER_REG);
+	if (val == (uint32_t)-1) {
+		hio_warn("%s: protocol version error: %#x\n", dev->name, val);
+		return -EINVAL;
+	}
+	dev->protocol_info.ver = val;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		dev->protocol_info.init_state_reg = SSD_INIT_STATE_REG0;
+		dev->protocol_info.init_state_reg_sz = SSD_INIT_STATE_REG_SZ;
+
+		dev->protocol_info.chip_info_reg = SSD_CHIP_INFO_REG0;
+		dev->protocol_info.chip_info_reg_sz = SSD_CHIP_INFO_REG_SZ;
+	} else {
+		dev->protocol_info.init_state_reg = SSD_PV3_INIT_STATE_REG0;
+		dev->protocol_info.init_state_reg_sz = SSD_PV3_INIT_STATE_REG_SZ;
+
+		dev->protocol_info.chip_info_reg = SSD_PV3_CHIP_INFO_REG0;
+		dev->protocol_info.chip_info_reg_sz = SSD_PV3_CHIP_INFO_REG_SZ;
+	}
+
+	return 0;
+}
+
+static int ssd_init_hw_info(struct ssd_device *dev)
+{
+	uint64_t val64;
+	uint32_t val;
+	uint32_t nr_ctrl;
+	int ret = 0;
+
+	/* base info */
+	val = ssd_reg32_read(dev->ctrlp + SSD_RESP_INFO_REG);
+	dev->hw_info.resp_ptr_sz = 16 * (1U << (val & 0xFF));
+	dev->hw_info.resp_msg_sz = 16 * (1U << ((val >> 8) & 0xFF));
+
+	if (0 == dev->hw_info.resp_ptr_sz || 0 == dev->hw_info.resp_msg_sz) {
+		hio_warn("%s: response info error\n", dev->name);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_BRIDGE_INFO_REG);
+	dev->hw_info.cmd_fifo_sz = 1U << ((val >> 4) & 0xF);
+	dev->hw_info.cmd_max_sg = 1U << ((val >> 8) & 0xF);
+	dev->hw_info.sg_max_sec = 1U << ((val >> 12) & 0xF);
+	dev->hw_info.cmd_fifo_sz_mask = dev->hw_info.cmd_fifo_sz - 1;
+
+	if (0 == dev->hw_info.cmd_fifo_sz || 0 == dev->hw_info.cmd_max_sg || 0 == dev->hw_info.sg_max_sec) {
+		hio_warn("%s: cmd info error\n", dev->name);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	/* check hw */
+	if (ssd_check_hw_bh(dev)) {
+		hio_warn("%s: check hardware status failed\n", dev->name);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	if (ssd_check_controller(dev)) {
+		hio_warn("%s: check controller state failed\n", dev->name);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	/* nr controller : read again*/
+	val = ssd_reg32_read(dev->ctrlp + SSD_BRIDGE_INFO_REG);
+	dev->hw_info.nr_ctrl = (val >> 16) & 0xF;
+
+	/* nr ctrl configured */
+	nr_ctrl = (val >> 20) & 0xF;
+	if (0 == dev->hw_info.nr_ctrl) {
+		hio_warn("%s: nr controller error: %u\n", dev->name, dev->hw_info.nr_ctrl);
+		ret = -EINVAL;
+		goto out;
+	} else if (0 != nr_ctrl && nr_ctrl != dev->hw_info.nr_ctrl) {
+		hio_warn("%s: nr controller error: configured %u but found %u\n", dev->name, nr_ctrl, dev->hw_info.nr_ctrl);
+		if (mode <= SSD_DRV_MODE_STANDARD) {
+			ret = -EINVAL;
+			goto out;
+		}
+	}
+
+	if (ssd_check_controller_bh(dev)) {
+		hio_warn("%s: check controller failed\n", dev->name);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_PCB_VER_REG);
+	dev->hw_info.pcb_ver = (uint8_t) ((val >> 4) & 0xF) + 'A' -1;
+	if ((val & 0xF) != 0xF) {
+		dev->hw_info.upper_pcb_ver = (uint8_t) (val & 0xF) + 'A' -1;
+	}
+
+	if (dev->hw_info.pcb_ver < 'A' || (0 != dev->hw_info.upper_pcb_ver && dev->hw_info.upper_pcb_ver < 'A')) {
+		hio_warn("%s: PCB version error: %#x %#x\n", dev->name, dev->hw_info.pcb_ver, dev->hw_info.upper_pcb_ver);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	/* channel info */
+	if (mode <= SSD_DRV_MODE_DEBUG) {
+		val = ssd_reg32_read(dev->ctrlp + SSD_CH_INFO_REG);
+		dev->hw_info.nr_data_ch = val & 0xFF;
+		dev->hw_info.nr_ch = dev->hw_info.nr_data_ch + ((val >> 8) & 0xFF);
+		dev->hw_info.nr_chip = (val >> 16) & 0xFF;
+
+		if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+			dev->hw_info.max_ch = 1;
+			while (dev->hw_info.max_ch < dev->hw_info.nr_ch) dev->hw_info.max_ch <<= 1;
+		} else {
+			/* set max channel 32  */
+			dev->hw_info.max_ch = 32;
+		}
+
+		if (0 == dev->hw_info.nr_chip) {
+			//for debug mode
+			dev->hw_info.nr_chip = 1;
+		}
+
+		//xx
+		dev->hw_info.id_size = SSD_NAND_ID_SZ;
+		dev->hw_info.max_ce = SSD_NAND_MAX_CE;
+
+		if (0 == dev->hw_info.nr_data_ch || 0 == dev->hw_info.nr_ch || 0 == dev->hw_info.nr_chip) {
+			hio_warn("%s: channel info error: data_ch %u ch %u chip %u\n", dev->name, dev->hw_info.nr_data_ch, dev->hw_info.nr_ch, dev->hw_info.nr_chip);
+			ret = -EINVAL;
+			goto out;
+		}
+	}
+
+	/* ram info */
+	if (mode <= SSD_DRV_MODE_DEBUG) {
+		val = ssd_reg32_read(dev->ctrlp + SSD_RAM_INFO_REG);
+		dev->hw_info.ram_size = 0x4000000ull * (1ULL << (val & 0xF));
+		dev->hw_info.ram_align = 1U << ((val >> 12) & 0xF);
+		if (dev->hw_info.ram_align < SSD_RAM_ALIGN) {
+			if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+				dev->hw_info.ram_align = SSD_RAM_ALIGN;
+			} else {
+				hio_warn("%s: ram align error: %u\n", dev->name, dev->hw_info.ram_align);
+				ret = -EINVAL;
+				goto out;
+			}
+		}
+		dev->hw_info.ram_max_len = 0x1000 * (1U << ((val >> 16) & 0xF));
+
+		if (0 == dev->hw_info.ram_size || 0 == dev->hw_info.ram_align || 0 == dev->hw_info.ram_max_len || dev->hw_info.ram_align > dev->hw_info.ram_max_len) {
+			hio_warn("%s: ram info error\n", dev->name);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+			dev->hw_info.log_sz = SSD_LOG_MAX_SZ;
+		} else {
+			val = ssd_reg32_read(dev->ctrlp + SSD_LOG_INFO_REG);
+			dev->hw_info.log_sz = 0x1000 * (1U << (val & 0xFF));
+		}
+		if (0 == dev->hw_info.log_sz) {
+			hio_warn("%s: log size error\n", dev->name);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_BBT_BASE_REG);
+		dev->hw_info.bbt_base = 0x40000ull * (val & 0xFFFF);
+		dev->hw_info.bbt_size = 0x40000 * (((val >> 16) & 0xFFFF) + 1) / (dev->hw_info.max_ch * dev->hw_info.nr_chip);
+		if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+			if (dev->hw_info.bbt_base > dev->hw_info.ram_size || 0 == dev->hw_info.bbt_size) {
+				hio_warn("%s: bbt info error\n", dev->name);
+				ret = -EINVAL;
+				goto out;
+			}
+		}
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_ECT_BASE_REG);
+		dev->hw_info.md_base = 0x40000ull * (val & 0xFFFF);
+		if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+			dev->hw_info.md_size = 0x40000 * (((val >> 16) & 0xFFF) + 1) / (dev->hw_info.max_ch * dev->hw_info.nr_chip);
+		} else {
+			dev->hw_info.md_size = 0x40000 * (((val >> 16) & 0xFFF) + 1) / (dev->hw_info.nr_chip);
+		}
+		dev->hw_info.md_entry_sz = 8 * (1U << ((val >> 28) & 0xF));
+		if (dev->protocol_info.ver >= SSD_PROTOCOL_V3) {
+			if (dev->hw_info.md_base > dev->hw_info.ram_size || 0 == dev->hw_info.md_size || 
+				0 == dev->hw_info.md_entry_sz || dev->hw_info.md_entry_sz > dev->hw_info.md_size) {
+				hio_warn("%s: md info error\n", dev->name);
+				ret = -EINVAL;
+				goto out;
+			}
+		}
+
+		if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+			dev->hw_info.nand_wbuff_base = dev->hw_info.ram_size + 1;
+		} else {
+			val = ssd_reg32_read(dev->ctrlp + SSD_NAND_BUFF_BASE);
+			dev->hw_info.nand_wbuff_base = 0x8000ull * val;
+		}
+	}
+
+	/* flash info */
+	if (mode <= SSD_DRV_MODE_DEBUG) {
+		if (dev->hw_info.nr_ctrl > 1) {
+			val = ssd_reg32_read(dev->ctrlp + SSD_CTRL_VER_REG);
+			dev->hw_info.ctrl_ver = val & 0xFFF;
+			hio_info("%s: controller firmware version: %03X\n", dev->name, dev->hw_info.ctrl_ver);
+		}
+
+		val64 = ssd_reg_read(dev->ctrlp + SSD_FLASH_INFO_REG0);
+		dev->hw_info.nand_vendor_id = ((val64 >> 56) & 0xFF);
+		dev->hw_info.nand_dev_id = ((val64 >> 48) & 0xFF);
+
+		dev->hw_info.block_count = (((val64 >> 32) & 0xFFFF) + 1);
+		dev->hw_info.page_count = ((val64>>16) & 0xFFFF);
+		dev->hw_info.page_size = (val64 & 0xFFFF);
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_BB_INFO_REG);
+		dev->hw_info.bbf_pages = val & 0xFF;
+		dev->hw_info.bbf_seek = (val >> 8) & 0x1;
+
+		if (0 == dev->hw_info.block_count || 0 == dev->hw_info.page_count || 0 == dev->hw_info.page_size || dev->hw_info.block_count > INT_MAX) {
+			hio_warn("%s: flash info error\n", dev->name);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		//xx
+		dev->hw_info.oob_size = SSD_NAND_OOB_SZ;	//(dev->hw_info.page_size) >> 5;
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_VALID_PAGES_REG);
+		if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+			dev->hw_info.valid_pages = val & 0x3FF;
+			dev->hw_info.max_valid_pages = (val>>20) & 0x3FF;
+		} else {
+			dev->hw_info.valid_pages = val & 0x7FFF;
+			dev->hw_info.max_valid_pages = (val>>15) & 0x7FFF;
+		}
+		if (0 == dev->hw_info.valid_pages || 0 == dev->hw_info.max_valid_pages || 
+			dev->hw_info.valid_pages > dev->hw_info.max_valid_pages || dev->hw_info.max_valid_pages > dev->hw_info.page_count) {
+			hio_warn("%s: valid page info error: valid_pages %d, max_valid_pages %d\n", dev->name, dev->hw_info.valid_pages, dev->hw_info.max_valid_pages);
+			ret = -EINVAL;
+			goto out;
+		}
+
+		val = ssd_reg32_read(dev->ctrlp + SSD_RESERVED_BLKS_REG);
+		dev->hw_info.reserved_blks = val & 0xFFFF;
+		dev->hw_info.md_reserved_blks = (val >> 16) & 0xFF;
+		if (dev->protocol_info.ver <= SSD_PROTOCOL_V3) {
+			dev->hw_info.md_reserved_blks = SSD_BBT_RESERVED;
+		}
+		if (dev->hw_info.reserved_blks > dev->hw_info.block_count || dev->hw_info.md_reserved_blks > dev->hw_info.block_count) {
+			hio_warn("%s: reserved blocks info error: reserved_blks %d, md_reserved_blks %d\n", dev->name, dev->hw_info.reserved_blks, dev->hw_info.md_reserved_blks);
+			ret = -EINVAL;
+			goto out;
+		}
+	}
+
+	/* size */
+	if (mode < SSD_DRV_MODE_DEBUG) {
+		dev->hw_info.size = (uint64_t)dev->hw_info.valid_pages * dev->hw_info.page_size;
+		dev->hw_info.size *= (dev->hw_info.block_count - dev->hw_info.reserved_blks);
+		dev->hw_info.size *= ((uint64_t)dev->hw_info.nr_data_ch * (uint64_t)dev->hw_info.nr_chip * (uint64_t)dev->hw_info.nr_ctrl);
+	}
+
+	/* extend hardware info */
+	val = ssd_reg32_read(dev->ctrlp + SSD_PCB_VER_REG);
+	dev->hw_info_ext.board_type = (val >> 24) & 0xF;
+
+	dev->hw_info_ext.form_factor = SSD_FORM_FACTOR_FHHL;
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2_1) {
+		dev->hw_info_ext.form_factor = (val >> 31) & 0x1;
+	}
+	/*
+	dev->hw_info_ext.cap_type = (val >> 28) & 0x3;
+	if (SSD_BM_CAP_VINA != dev->hw_info_ext.cap_type && SSD_BM_CAP_JH != dev->hw_info_ext.cap_type) {
+		dev->hw_info_ext.cap_type = SSD_BM_CAP_VINA;
+	}*/
+
+	/* power loss protect */
+	val = ssd_reg32_read(dev->ctrlp + SSD_PLP_INFO_REG);
+	dev->hw_info_ext.plp_type = (val & 0x3);
+	if (dev->protocol_info.ver >= SSD_PROTOCOL_V3_2) {
+		/* 3 or 4 cap */
+		dev->hw_info_ext.cap_type = ((val >> 2)& 0x1);
+	}
+
+	/* work mode */
+	val = ssd_reg32_read(dev->ctrlp + SSD_CH_INFO_REG);
+	dev->hw_info_ext.work_mode = (val >> 25) & 0x1;
+
+out:
+	/* skip error if not in standard mode */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ret = 0;
+	}
+	return ret;
+}
+
+static void ssd_cleanup_response(struct ssd_device *dev)
+{
+	int resp_msg_sz = dev->hw_info.resp_msg_sz * dev->hw_info.cmd_fifo_sz * SSD_MSIX_VEC;
+	int resp_ptr_sz = dev->hw_info.resp_ptr_sz * SSD_MSIX_VEC;
+
+	pci_free_consistent(dev->pdev, resp_ptr_sz, dev->resp_ptr_base, dev->resp_ptr_base_dma);
+	pci_free_consistent(dev->pdev, resp_msg_sz, dev->resp_msg_base, dev->resp_msg_base_dma);
+}
+
+static int ssd_init_response(struct ssd_device *dev)
+{
+	int resp_msg_sz = dev->hw_info.resp_msg_sz * dev->hw_info.cmd_fifo_sz * SSD_MSIX_VEC;
+	int resp_ptr_sz = dev->hw_info.resp_ptr_sz * SSD_MSIX_VEC;
+
+	dev->resp_msg_base = pci_alloc_consistent(dev->pdev, resp_msg_sz, &(dev->resp_msg_base_dma));
+	if (!dev->resp_msg_base) {
+		hio_warn("%s: unable to allocate resp msg DMA buffer\n", dev->name);
+		goto out_alloc_resp_msg;
+	}
+	memset(dev->resp_msg_base, 0xFF, resp_msg_sz);
+
+	dev->resp_ptr_base = pci_alloc_consistent(dev->pdev, resp_ptr_sz, &(dev->resp_ptr_base_dma));
+	if (!dev->resp_ptr_base){
+		hio_warn("%s: unable to allocate resp ptr DMA buffer\n", dev->name);
+		goto out_alloc_resp_ptr;
+	}
+	memset(dev->resp_ptr_base, 0, resp_ptr_sz);
+	dev->resp_idx = *(uint32_t *)(dev->resp_ptr_base) = dev->hw_info.cmd_fifo_sz * 2 - 1;
+
+	ssd_reg_write(dev->ctrlp + SSD_RESP_FIFO_REG, dev->resp_msg_base_dma);
+	ssd_reg_write(dev->ctrlp + SSD_RESP_PTR_REG, dev->resp_ptr_base_dma);
+
+	return 0;
+
+out_alloc_resp_ptr:
+	pci_free_consistent(dev->pdev, resp_msg_sz, dev->resp_msg_base, dev->resp_msg_base_dma);
+out_alloc_resp_msg:
+	return -ENOMEM;
+}
+
+static int ssd_cleanup_cmd(struct ssd_device *dev)
+{
+	int msg_sz = ALIGN(sizeof(struct ssd_rw_msg) + (dev->hw_info.cmd_max_sg - 1) * sizeof(struct ssd_sg_entry), SSD_DMA_ALIGN);
+	int i;
+
+	for (i=0; i<(int)dev->hw_info.cmd_fifo_sz; i++) {
+		kfree(dev->cmd[i].sgl);
+	}
+	kfree(dev->cmd);
+	pci_free_consistent(dev->pdev, (msg_sz * dev->hw_info.cmd_fifo_sz), dev->msg_base, dev->msg_base_dma);
+	return 0;
+}
+
+static int ssd_init_cmd(struct ssd_device *dev)
+{
+	int sgl_sz = sizeof(struct scatterlist) * dev->hw_info.cmd_max_sg;
+	int cmd_sz = sizeof(struct ssd_cmd) * dev->hw_info.cmd_fifo_sz;
+	int msg_sz = ALIGN(sizeof(struct ssd_rw_msg) + (dev->hw_info.cmd_max_sg - 1) * sizeof(struct ssd_sg_entry), SSD_DMA_ALIGN);
+	int i;
+
+	spin_lock_init(&dev->cmd_lock);
+
+	dev->msg_base = pci_alloc_consistent(dev->pdev, (msg_sz * dev->hw_info.cmd_fifo_sz), &dev->msg_base_dma);
+	if (!dev->msg_base) {
+		hio_warn("%s: can not alloc cmd msg\n", dev->name);
+		goto out_alloc_msg;
+	}
+
+	dev->cmd = kmalloc(cmd_sz, GFP_KERNEL);
+	if (!dev->cmd) {
+		hio_warn("%s: can not alloc cmd\n", dev->name);
+		goto out_alloc_cmd;
+	}
+	memset(dev->cmd, 0, cmd_sz);
+
+	for (i=0; i<(int)dev->hw_info.cmd_fifo_sz; i++) {
+		dev->cmd[i].sgl = kmalloc(sgl_sz, GFP_KERNEL);
+		if (!dev->cmd[i].sgl) {
+			hio_warn("%s: can not alloc cmd sgl %d\n", dev->name, i);
+			goto out_alloc_sgl;
+		}
+
+		dev->cmd[i].msg = dev->msg_base + (msg_sz * i);
+		dev->cmd[i].msg_dma = dev->msg_base_dma + ((dma_addr_t)msg_sz * i);
+
+		dev->cmd[i].dev = dev;
+		dev->cmd[i].tag = i;
+		dev->cmd[i].flag = 0;
+
+		INIT_LIST_HEAD(&dev->cmd[i].list);
+	}
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3) {
+		dev->scmd = ssd_dispatch_cmd;
+	} else {
+		ssd_reg_write(dev->ctrlp + SSD_MSG_BASE_REG, dev->msg_base_dma);
+		if (finject) {
+			dev->scmd = ssd_send_cmd_db;
+		} else {
+			dev->scmd = ssd_send_cmd;
+		}
+	}
+
+	return 0;
+
+out_alloc_sgl:
+	for (i--; i>=0; i--) {
+		kfree(dev->cmd[i].sgl);
+	}
+	kfree(dev->cmd);
+out_alloc_cmd:
+	pci_free_consistent(dev->pdev, (msg_sz * dev->hw_info.cmd_fifo_sz), dev->msg_base, dev->msg_base_dma);
+out_alloc_msg:
+	return -ENOMEM;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
+static irqreturn_t ssd_interrupt_check(int irq, void *dev_id)
+{
+	struct ssd_queue *queue = (struct ssd_queue *)dev_id;
+
+	if (*(uint32_t *)queue->resp_ptr == queue->resp_idx) {
+		return IRQ_NONE;
+	}
+
+	return IRQ_WAKE_THREAD;
+}
+
+static irqreturn_t ssd_interrupt_threaded(int irq, void *dev_id)
+{
+	struct ssd_queue *queue = (struct ssd_queue *)dev_id;
+	struct ssd_device *dev = (struct ssd_device *)queue->dev;
+	struct ssd_cmd *cmd;
+	union ssd_response_msq __msg;
+	union ssd_response_msq *msg = &__msg;
+	uint64_t *u64_msg;
+	uint32_t resp_idx = queue->resp_idx;
+	uint32_t new_resp_idx = *(uint32_t *)queue->resp_ptr;
+	uint32_t end_resp_idx;
+
+	if (unlikely(resp_idx == new_resp_idx)) {
+		return IRQ_NONE;
+	}
+
+	end_resp_idx = new_resp_idx & queue->resp_idx_mask;
+
+	do {
+		resp_idx = (resp_idx + 1) & queue->resp_idx_mask;
+
+		/* the resp msg */
+		u64_msg = (uint64_t *)(queue->resp_msg + queue->resp_msg_sz * resp_idx);
+		msg->u64_msg = *u64_msg;
+
+		if (unlikely(msg->u64_msg == (uint64_t)(-1))) {
+			hio_err("%s: empty resp msg: queue %d idx %u\n", dev->name, queue->idx, resp_idx);
+			continue;
+		}
+		/* clear the resp msg */
+		*u64_msg = (uint64_t)(-1);
+
+		cmd = &queue->cmd[msg->resp_msg.tag];
+		/*if (unlikely(!cmd->bio)) {
+			printk(KERN_WARNING "%s: unknown tag %d fun %#x\n", 
+				dev->name, msg->resp_msg.tag, msg->resp_msg.fun);
+			continue;
+		}*/
+
+		if(unlikely(msg->resp_msg.status & (uint32_t)status_mask)) {
+			cmd->errors = -EIO;
+		} else {
+			cmd->errors = 0;
+		}
+		cmd->nr_log = msg->log_resp_msg.nr_log;
+
+		ssd_done(cmd);
+
+		if (unlikely(msg->resp_msg.fun != SSD_FUNC_READ_LOG && msg->resp_msg.log > 0)) {
+			(void)test_and_set_bit(SSD_LOG_HW, &dev->state);
+			if (test_bit(SSD_INIT_WORKQ, &dev->state)) {
+				queue_work(dev->workq, &dev->log_work);
+			}
+		}
+
+		if (unlikely(msg->resp_msg.status)) {
+			if (msg->resp_msg.fun == SSD_FUNC_READ || msg->resp_msg.fun == SSD_FUNC_WRITE) {
+				hio_err("%s: I/O error %d: tag %d fun %#x\n", 
+					dev->name, msg->resp_msg.status, msg->resp_msg.tag, msg->resp_msg.fun);
+
+				/* alarm led */
+				ssd_set_alarm(dev);
+				queue->io_stat.nr_rwerr++;
+				ssd_gen_swlog(dev, SSD_LOG_EIO, msg->u32_msg[0]);
+			} else {
+				hio_info("%s: CMD error %d: tag %d fun %#x\n", 
+					dev->name, msg->resp_msg.status, msg->resp_msg.tag, msg->resp_msg.fun);
+
+				ssd_gen_swlog(dev, SSD_LOG_ECMD, msg->u32_msg[0]);
+			}
+			queue->io_stat.nr_ioerr++;
+		}
+
+		if (msg->resp_msg.fun == SSD_FUNC_READ || 
+			msg->resp_msg.fun == SSD_FUNC_NAND_READ_WOOB ||
+			msg->resp_msg.fun == SSD_FUNC_NAND_READ) {
+
+			queue->ecc_info.bitflip[msg->resp_msg.bitflip]++;
+		}
+	}while (resp_idx != end_resp_idx);
+
+	queue->resp_idx = new_resp_idx;
+
+	return IRQ_HANDLED;
+}
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19))
+static irqreturn_t ssd_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+#else
+static irqreturn_t ssd_interrupt(int irq, void *dev_id)
+#endif
+{
+	struct ssd_queue *queue = (struct ssd_queue *)dev_id;
+	struct ssd_device *dev = (struct ssd_device *)queue->dev;
+	struct ssd_cmd *cmd;
+	union ssd_response_msq __msg;
+	union ssd_response_msq *msg = &__msg;
+	uint64_t *u64_msg;
+	uint32_t resp_idx = queue->resp_idx;
+	uint32_t new_resp_idx = *(uint32_t *)queue->resp_ptr;
+	uint32_t end_resp_idx;
+
+	if (unlikely(resp_idx == new_resp_idx)) {
+		return IRQ_NONE;
+	}
+
+#if (defined SSD_ESCAPE_IRQ)
+	if (SSD_INT_MSIX != dev->int_mode) {
+		dev->irq_cpu = smp_processor_id();
+	}
+#endif
+
+	end_resp_idx = new_resp_idx & queue->resp_idx_mask;
+
+	do {
+		resp_idx = (resp_idx + 1) & queue->resp_idx_mask;
+
+		/* the resp msg */
+		u64_msg = (uint64_t *)(queue->resp_msg + queue->resp_msg_sz * resp_idx);
+		msg->u64_msg = *u64_msg;
+
+		if (unlikely(msg->u64_msg == (uint64_t)(-1))) {
+			hio_err("%s: empty resp msg: queue %d idx %u\n", dev->name, queue->idx, resp_idx);
+			continue;
+		}
+		/* clear the resp msg */
+		*u64_msg = (uint64_t)(-1);
+
+		cmd = &queue->cmd[msg->resp_msg.tag];
+		/*if (unlikely(!cmd->bio)) {
+			printk(KERN_WARNING "%s: unknown tag %d fun %#x\n", 
+				dev->name, msg->resp_msg.tag, msg->resp_msg.fun);
+			continue;
+		}*/
+
+		if(unlikely(msg->resp_msg.status & (uint32_t)status_mask)) {
+			cmd->errors = -EIO;
+		} else {
+			cmd->errors = 0;
+		}
+		cmd->nr_log = msg->log_resp_msg.nr_log;
+
+		ssd_done_bh(cmd);
+
+		if (unlikely(msg->resp_msg.fun != SSD_FUNC_READ_LOG && msg->resp_msg.log > 0)) {
+			(void)test_and_set_bit(SSD_LOG_HW, &dev->state);
+			if (test_bit(SSD_INIT_WORKQ, &dev->state)) {
+				queue_work(dev->workq, &dev->log_work);
+			}
+		}
+
+		if (unlikely(msg->resp_msg.status)) {
+			if (msg->resp_msg.fun == SSD_FUNC_READ || msg->resp_msg.fun == SSD_FUNC_WRITE) {				
+				hio_err("%s: I/O error %d: tag %d fun %#x\n", 
+					dev->name, msg->resp_msg.status, msg->resp_msg.tag, msg->resp_msg.fun);
+
+				/* alarm led */
+				ssd_set_alarm(dev);
+				queue->io_stat.nr_rwerr++;
+				ssd_gen_swlog(dev, SSD_LOG_EIO, msg->u32_msg[0]);
+			} else {
+				hio_info("%s: CMD error %d: tag %d fun %#x\n", 
+					dev->name, msg->resp_msg.status, msg->resp_msg.tag, msg->resp_msg.fun);
+
+				ssd_gen_swlog(dev, SSD_LOG_ECMD, msg->u32_msg[0]);
+			}
+			queue->io_stat.nr_ioerr++;
+		}
+
+		if (msg->resp_msg.fun == SSD_FUNC_READ || 
+			msg->resp_msg.fun == SSD_FUNC_NAND_READ_WOOB ||
+			msg->resp_msg.fun == SSD_FUNC_NAND_READ) {
+
+			queue->ecc_info.bitflip[msg->resp_msg.bitflip]++;
+		}
+	}while (resp_idx != end_resp_idx);
+
+	queue->resp_idx = new_resp_idx;
+
+	return IRQ_HANDLED;
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19))
+static irqreturn_t ssd_interrupt_legacy(int irq, void *dev_id, struct pt_regs *regs)
+#else
+static irqreturn_t ssd_interrupt_legacy(int irq, void *dev_id)
+#endif
+{
+	irqreturn_t ret;
+	struct ssd_queue *queue = (struct ssd_queue *)dev_id;
+	struct ssd_device *dev = (struct ssd_device *)queue->dev;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19))
+	ret = ssd_interrupt(irq, dev_id, regs);
+#else
+	ret = ssd_interrupt(irq, dev_id);
+#endif
+
+	/* clear intr */ 
+	if (IRQ_HANDLED == ret) {
+		ssd_reg32_write(dev->ctrlp + SSD_CLEAR_INTR_REG, 1);
+	}
+
+	return ret;
+}
+
+static void ssd_reset_resp_ptr(struct ssd_device *dev)
+{
+	int i;
+
+	for (i=0; i<dev->nr_queue; i++) {
+		*(uint32_t *)dev->queue[i].resp_ptr = dev->queue[i].resp_idx = (dev->hw_info.cmd_fifo_sz * 2) - 1;
+	}
+}
+
+static void ssd_free_irq(struct ssd_device *dev)
+{
+	int i;
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35)) || (defined RHEL_MAJOR && RHEL_MAJOR == 6))
+	if (SSD_INT_MSIX == dev->int_mode) {
+		for (i=0; i<dev->nr_queue; i++) {
+			irq_set_affinity_hint(dev->entry[i].vector, NULL);
+		}
+	}
+#endif
+
+	for (i=0; i<dev->nr_queue; i++) {
+		free_irq(dev->entry[i].vector, &dev->queue[i]);
+	}
+
+	if (SSD_INT_MSIX == dev->int_mode) {
+		pci_disable_msix(dev->pdev);
+	} else if (SSD_INT_MSI == dev->int_mode) {
+		pci_disable_msi(dev->pdev);
+	}
+
+}
+
+static int ssd_init_irq(struct ssd_device *dev)
+{
+#if (!defined MODULE) && (defined SSD_MSIX_AFFINITY_FORCE)
+	const struct cpumask *cpu_mask;
+	static int cpu_affinity = 0;
+#endif
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35)) || (defined RHEL_MAJOR && RHEL_MAJOR == 6))
+	const struct cpumask *mask;
+	static int cpu = 0;
+	int j;
+#endif
+	int i;
+	unsigned long flags = 0;
+	int ret = 0;
+
+	ssd_reg32_write(dev->ctrlp + SSD_INTR_INTERVAL_REG, 0x800);
+
+#ifdef SSD_ESCAPE_IRQ
+	dev->irq_cpu = -1;
+#endif
+
+	if (int_mode >= SSD_INT_MSIX && pci_find_capability(dev->pdev, PCI_CAP_ID_MSIX)) {
+		dev->nr_queue = SSD_MSIX_VEC;
+		for (i=0; i<dev->nr_queue; i++) {
+			dev->entry[i].entry = i;
+		}
+		for (;;) {
+			ret = pci_enable_msix(dev->pdev, dev->entry, dev->nr_queue);
+			if (ret == 0) {
+				break;
+			} else if (ret > 0) {
+				dev->nr_queue = ret;
+			} else {
+				hio_warn("%s: can not enable msix\n", dev->name);
+				/* alarm led */
+				ssd_set_alarm(dev);
+				goto out;
+			}
+		}
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35)) || (defined RHEL_MAJOR && RHEL_MAJOR == 6))
+		mask = (dev_to_node(&dev->pdev->dev) == -1) ? cpu_online_mask : cpumask_of_node(dev_to_node(&dev->pdev->dev));
+		if ((0 == cpu) || (!cpumask_intersects(mask, cpumask_of(cpu)))) {
+			cpu = cpumask_first(mask);
+		}
+		for (i=0; i<dev->nr_queue; i++) {
+			irq_set_affinity_hint(dev->entry[i].vector, cpumask_of(cpu));
+			cpu = cpumask_next(cpu, mask);
+			if (cpu >= nr_cpu_ids) {
+				cpu = cpumask_first(mask);
+			}
+		}
+#endif
+
+		dev->int_mode = SSD_INT_MSIX;
+	} else if (int_mode >= SSD_INT_MSI && pci_find_capability(dev->pdev, PCI_CAP_ID_MSI)) {
+		ret = pci_enable_msi(dev->pdev);
+		if (ret) {
+			hio_warn("%s: can not enable msi\n", dev->name);
+			/* alarm led */
+			ssd_set_alarm(dev);
+			goto out;
+		}
+
+		dev->nr_queue = 1;
+		dev->entry[0].vector = dev->pdev->irq;
+
+		dev->int_mode = SSD_INT_MSI;
+	} else {
+		dev->nr_queue = 1;
+		dev->entry[0].vector = dev->pdev->irq;
+
+		dev->int_mode = SSD_INT_LEGACY;
+	}
+
+	for (i=0; i<dev->nr_queue; i++) {
+		if (dev->nr_queue > 1) {
+			snprintf(dev->queue[i].name, SSD_QUEUE_NAME_LEN, "%s_e100-%d", dev->name, i);
+		} else {
+			snprintf(dev->queue[i].name, SSD_QUEUE_NAME_LEN, "%s_e100", dev->name);
+		}
+
+		dev->queue[i].dev = dev;
+		dev->queue[i].idx = i;
+
+		dev->queue[i].resp_idx = (dev->hw_info.cmd_fifo_sz * 2) - 1;
+		dev->queue[i].resp_idx_mask = dev->hw_info.cmd_fifo_sz - 1;
+
+		dev->queue[i].resp_msg_sz = dev->hw_info.resp_msg_sz;
+		dev->queue[i].resp_msg = dev->resp_msg_base + dev->hw_info.resp_msg_sz * dev->hw_info.cmd_fifo_sz * i;
+		dev->queue[i].resp_ptr = dev->resp_ptr_base + dev->hw_info.resp_ptr_sz * i;
+		*(uint32_t *)dev->queue[i].resp_ptr = dev->queue[i].resp_idx;
+
+		dev->queue[i].cmd = dev->cmd;
+	}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20))
+	flags = IRQF_SHARED;
+#else
+	flags = SA_SHIRQ;
+#endif
+
+	for (i=0; i<dev->nr_queue; i++) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
+		if (threaded_irq) {
+			ret = request_threaded_irq(dev->entry[i].vector, ssd_interrupt_check, ssd_interrupt_threaded, flags, dev->queue[i].name, &dev->queue[i]);
+		} else if (dev->int_mode == SSD_INT_LEGACY) {
+			ret = request_irq(dev->entry[i].vector, &ssd_interrupt_legacy, flags, dev->queue[i].name, &dev->queue[i]);
+		} else {
+			ret = request_irq(dev->entry[i].vector, &ssd_interrupt, flags, dev->queue[i].name, &dev->queue[i]);
+		}
+#else
+		if (dev->int_mode == SSD_INT_LEGACY) {
+			ret = request_irq(dev->entry[i].vector, &ssd_interrupt_legacy, flags, dev->queue[i].name, &dev->queue[i]);
+		} else {
+			ret = request_irq(dev->entry[i].vector, &ssd_interrupt, flags, dev->queue[i].name, &dev->queue[i]);
+		}
+#endif
+		if (ret) {
+			hio_warn("%s: request irq failed\n", dev->name);
+			/* alarm led */
+			ssd_set_alarm(dev);
+			goto out_request_irq;
+		}
+
+#if (!defined MODULE) && (defined SSD_MSIX_AFFINITY_FORCE)
+		cpu_mask = (dev_to_node(&dev->pdev->dev) == -1) ? cpu_online_mask : cpumask_of_node(dev_to_node(&dev->pdev->dev));
+		if (SSD_INT_MSIX == dev->int_mode) {
+			if ((0 == cpu_affinity) || (!cpumask_intersects(mask, cpumask_of(cpu_affinity)))) {
+				cpu_affinity = cpumask_first(cpu_mask);
+			}
+
+			irq_set_affinity(dev->entry[i].vector, cpumask_of(cpu_affinity));
+			cpu_affinity = cpumask_next(cpu_affinity, cpu_mask);
+			if (cpu_affinity >= nr_cpu_ids) {
+				cpu_affinity = cpumask_first(cpu_mask);
+			}
+		}
+#endif
+	}
+
+	return ret;
+
+out_request_irq:
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35)) || (defined RHEL_MAJOR && RHEL_MAJOR == 6))
+	if (SSD_INT_MSIX == dev->int_mode) {
+		for (j=0; j<dev->nr_queue; j++) {
+			irq_set_affinity_hint(dev->entry[j].vector, NULL);
+		}
+	}
+#endif
+
+	for (i--; i>=0; i--) {
+		free_irq(dev->entry[i].vector, &dev->queue[i]);
+	}
+
+	if (SSD_INT_MSIX == dev->int_mode) {
+		pci_disable_msix(dev->pdev);
+	} else if (SSD_INT_MSI == dev->int_mode) {
+		pci_disable_msi(dev->pdev);
+	}
+
+out:
+	return ret;
+}
+
+static void ssd_initial_log(struct ssd_device *dev)
+{
+	uint32_t val;
+	uint32_t speed, width;
+	
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		return;
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_POWER_ON_REG);
+	if (val) {
+		ssd_gen_swlog(dev, SSD_LOG_POWER_ON, dev->hw_info.bridge_ver);
+	}
+
+	val = ssd_reg32_read(dev->ctrlp + SSD_PCIE_LINKSTATUS_REG);
+	speed = val & 0xF;
+	width = (val >> 4)& 0x3F;
+	if (0x1 == speed) {
+		hio_info("%s: PCIe: 2.5GT/s, x%u\n", dev->name, width);
+	} else if (0x2 == speed) {
+		hio_info("%s: PCIe: 5GT/s, x%u\n", dev->name, width);
+	} else {
+		hio_info("%s: PCIe: unknown GT/s, x%u\n", dev->name, width);
+	}
+	ssd_gen_swlog(dev, SSD_LOG_PCIE_LINK_STATUS, val);
+
+	return;
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+static void ssd_hwmon_worker(void *data)
+{
+	struct ssd_device *dev = (struct ssd_device *)data;
+#else
+static void ssd_hwmon_worker(struct work_struct *work)
+{
+	struct ssd_device *dev = container_of(work, struct ssd_device, hwmon_work);
+#endif
+
+	if (ssd_check_hw(dev)) {
+		//hio_err("%s: check hardware failed\n", dev->name);
+		return;
+	}
+
+	ssd_check_clock(dev);
+	ssd_check_volt(dev);
+
+	ssd_mon_boardvolt(dev);
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+static void ssd_tempmon_worker(void *data)
+{
+	struct ssd_device *dev = (struct ssd_device *)data;
+#else
+static void ssd_tempmon_worker(struct work_struct *work)
+{
+	struct ssd_device *dev = container_of(work, struct ssd_device, tempmon_work);
+#endif
+
+	if (ssd_check_hw(dev)) {
+		//hio_err("%s: check hardware failed\n", dev->name);
+		return;
+	}
+
+	ssd_mon_temp(dev);
+}
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+static void ssd_capmon_worker(void *data)
+{
+	struct ssd_device *dev = (struct ssd_device *)data;
+#else
+static void ssd_capmon_worker(struct work_struct *work)
+{
+	struct ssd_device *dev = container_of(work, struct ssd_device, capmon_work);
+#endif
+	uint32_t cap = 0;
+	uint32_t cap_threshold = SSD_PL_CAP_THRESHOLD;
+	int ret = 0;
+
+	if (dev->protocol_info.ver < SSD_PROTOCOL_V3_2) {
+		return;
+	}
+
+	if (dev->hw_info_ext.form_factor == SSD_FORM_FACTOR_FHHL && dev->hw_info.pcb_ver < 'B') {
+		return;
+	}
+
+	/* fault before? */
+	if (test_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+		ret = ssd_check_pl_cap_fast(dev);
+		if (ret) {
+			return;
+		}
+	}
+
+	/* learn */
+	ret = ssd_do_cap_learn(dev, &cap);
+	if (ret) {
+		hio_err("%s: cap learn failed\n", dev->name);
+		ssd_gen_swlog(dev, SSD_LOG_CAP_LEARN_FAULT, 0);
+		return;
+	}
+
+	ssd_gen_swlog(dev, SSD_LOG_CAP_STATUS, cap);
+
+	if (SSD_PL_CAP_CP == dev->hw_info_ext.cap_type) {
+		cap_threshold = SSD_PL_CAP_CP_THRESHOLD;
+	}
+
+	//use the fw event id?
+	if (cap < cap_threshold) {
+		if (!test_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_BATTERY_FAULT, 0);
+		}
+	} else if (cap >= (cap_threshold + SSD_PL_CAP_THRESHOLD_HYST)) {
+		if (test_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon)) {
+			ssd_gen_swlog(dev, SSD_LOG_BATTERY_OK, 0);
+		}
+	}
+}
+
+static void ssd_routine_start(void *data)
+{
+	struct ssd_device *dev;
+
+	if (!data) {
+		return;
+	}
+	dev = data;
+
+	dev->routine_tick++;
+
+	if (test_bit(SSD_INIT_WORKQ, &dev->state) && !ssd_busy(dev)) {
+		(void)test_and_set_bit(SSD_LOG_HW, &dev->state);
+		queue_work(dev->workq, &dev->log_work);
+	}
+
+	if ((dev->routine_tick % SSD_HWMON_ROUTINE_TICK) == 0 && test_bit(SSD_INIT_WORKQ, &dev->state)) {
+		queue_work(dev->workq, &dev->hwmon_work);
+	}
+
+	if ((dev->routine_tick % SSD_CAPMON_ROUTINE_TICK) == 0 && test_bit(SSD_INIT_WORKQ, &dev->state)) {
+		queue_work(dev->workq, &dev->capmon_work);
+	}
+
+	if ((dev->routine_tick % SSD_CAPMON2_ROUTINE_TICK) == 0 && test_bit(SSD_HWMON_PL_CAP(SSD_PL_CAP), &dev->hwmon) && test_bit(SSD_INIT_WORKQ, &dev->state)) {
+		/* CAP fault? check again */
+		queue_work(dev->workq, &dev->capmon_work);
+	}
+
+	if (test_bit(SSD_INIT_WORKQ, &dev->state)) {
+		queue_work(dev->workq, &dev->tempmon_work);
+	}
+
+	/* schedule routine */
+	mod_timer(&dev->routine_timer, jiffies + msecs_to_jiffies(SSD_ROUTINE_INTERVAL));
+}
+
+static void ssd_cleanup_routine(struct ssd_device *dev)
+{
+	if (unlikely(mode != SSD_DRV_MODE_STANDARD))
+		return;
+
+	(void)ssd_del_timer(&dev->routine_timer);
+
+	(void)ssd_del_timer(&dev->bm_timer);
+}
+
+static int ssd_init_routine(struct ssd_device *dev)
+{
+	if (unlikely(mode != SSD_DRV_MODE_STANDARD))
+		return 0;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+	INIT_WORK(&dev->bm_work, ssd_bm_worker, dev);
+	INIT_WORK(&dev->hwmon_work, ssd_hwmon_worker, dev);
+	INIT_WORK(&dev->capmon_work, ssd_capmon_worker, dev);
+	INIT_WORK(&dev->tempmon_work, ssd_tempmon_worker, dev);
+#else
+	INIT_WORK(&dev->bm_work, ssd_bm_worker);
+	INIT_WORK(&dev->hwmon_work, ssd_hwmon_worker);
+	INIT_WORK(&dev->capmon_work, ssd_capmon_worker);
+	INIT_WORK(&dev->tempmon_work, ssd_tempmon_worker);
+#endif
+
+	/* initial log */
+	ssd_initial_log(dev);
+
+	/* schedule bm routine */
+	ssd_add_timer(&dev->bm_timer, msecs_to_jiffies(SSD_BM_CAP_LEARNING_DELAY), ssd_bm_routine_start, dev);
+
+	/* schedule routine */
+	ssd_add_timer(&dev->routine_timer, msecs_to_jiffies(SSD_ROUTINE_INTERVAL), ssd_routine_start, dev);
+
+	return 0;
+}
+
+static void 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,38))
+__devexit 
+#endif
+ssd_remove_one (struct pci_dev *pdev)
+{
+	struct ssd_device *dev;
+
+	if (!pdev) {
+		return;
+	}
+
+	dev = pci_get_drvdata(pdev);
+	if (!dev) {
+		return;
+	}
+
+	list_del_init(&dev->list);
+
+	ssd_unregister_sysfs(dev);
+
+	/* offline firstly */
+	test_and_clear_bit(SSD_ONLINE, &dev->state);
+
+	/* clean work queue first */
+	if (!dev->slave) {
+		test_and_clear_bit(SSD_INIT_WORKQ, &dev->state);
+		ssd_cleanup_workq(dev);
+	}
+
+	/* flush cache */
+	(void)ssd_flush(dev);
+	(void)ssd_save_md(dev);
+
+	/* save smart */
+	if (!dev->slave) {
+		ssd_save_smart(dev);
+	}
+
+	if (test_and_clear_bit(SSD_INIT_BD, &dev->state)) {
+		ssd_cleanup_blkdev(dev);
+	}
+
+	if (!dev->slave) {
+		ssd_cleanup_chardev(dev);
+	}
+
+	/* clean routine */
+	if (!dev->slave) {
+		ssd_cleanup_routine(dev);
+	}
+
+	ssd_cleanup_queue(dev);
+
+	ssd_cleanup_tag(dev);
+	ssd_cleanup_thread(dev);
+
+	ssd_free_irq(dev);
+
+	ssd_cleanup_dcmd(dev);
+	ssd_cleanup_cmd(dev);
+	ssd_cleanup_response(dev);
+
+	if (!dev->slave) {
+		ssd_cleanup_log(dev);
+	}
+
+	if (dev->reload_fw) { //reload fw
+		ssd_reg32_write(dev->ctrlp + SSD_RELOAD_FW_REG, SSD_RELOAD_FW);
+	}
+
+	/* unmap physical adress */
+#ifdef LINUX_SUSE_OS
+	iounmap(dev->ctrlp);
+#else
+	pci_iounmap(pdev, dev->ctrlp);
+#endif
+
+	release_mem_region(dev->mmio_base, dev->mmio_len);
+
+	pci_disable_device(pdev);
+
+	pci_set_drvdata(pdev, NULL);
+
+	ssd_put(dev);
+}
+
+static int 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,38))
+__devinit 
+#endif
+ssd_init_one(struct pci_dev *pdev, 
+	const struct pci_device_id *ent)
+{
+	struct ssd_device *dev;
+	int ret = 0;
+
+	if (!pdev || !ent) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	dev = kmalloc(sizeof(struct ssd_device), GFP_KERNEL);
+	if (!dev) {
+		ret = -ENOMEM;
+		goto out_alloc_dev;
+	}
+	memset(dev, 0, sizeof(struct ssd_device));
+
+	dev->owner = THIS_MODULE;
+
+	if (SSD_SLAVE_PORT_DEVID == ent->device) {
+		dev->slave = 1;
+	}
+
+	dev->idx = ssd_get_index(dev->slave);
+	if (dev->idx < 0) {
+		ret = -ENOMEM;
+		goto out_get_index;
+	}
+
+	if (!dev->slave) {
+		snprintf(dev->name, SSD_DEV_NAME_LEN, SSD_DEV_NAME);
+		ssd_set_dev_name(&dev->name[strlen(SSD_DEV_NAME)], SSD_DEV_NAME_LEN-strlen(SSD_DEV_NAME), dev->idx);
+		
+		dev->major = ssd_major;
+		dev->cmajor = ssd_cmajor;
+	} else {
+		snprintf(dev->name, SSD_DEV_NAME_LEN, SSD_SDEV_NAME);
+		ssd_set_dev_name(&dev->name[strlen(SSD_SDEV_NAME)], SSD_DEV_NAME_LEN-strlen(SSD_SDEV_NAME), dev->idx);
+		dev->major = ssd_major_sl;
+		dev->cmajor = 0;
+	}
+
+	atomic_set(&(dev->refcnt), 0);
+	atomic_set(&(dev->tocnt), 0);
+
+	mutex_init(&dev->fw_mutex);
+
+	//xx
+	mutex_init(&dev->gd_mutex);
+
+	dev->pdev = pdev;
+	pci_set_drvdata(pdev, dev);
+
+	kref_init(&dev->kref);
+
+	ret = pci_enable_device(pdev);
+	if (ret) {
+		hio_warn("%s: can not enable device\n", dev->name);
+		goto out_enable_device;
+	}
+
+	pci_set_master(pdev);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,31))
+	ret = pci_set_dma_mask(pdev, DMA_64BIT_MASK);
+#else
+	ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
+#endif
+	if (ret) {
+		hio_warn("%s: set dma mask: failed\n", dev->name);
+		goto out_set_dma_mask;
+	}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,31))
+	ret = pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK);
+#else
+	ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
+#endif
+	if (ret) {
+		hio_warn("%s: set consistent dma mask: failed\n", dev->name);
+		goto out_set_dma_mask;
+	}
+
+	dev->mmio_base = pci_resource_start(pdev, 0);
+	dev->mmio_len = pci_resource_len(pdev, 0);
+
+	if (!request_mem_region(dev->mmio_base, dev->mmio_len, SSD_DEV_NAME)) {
+		hio_warn("%s: can not reserve MMIO region 0\n", dev->name);
+		ret = -EBUSY;
+		goto out_request_mem_region;
+	}
+
+	/* 2.6.9 kernel bug */
+	dev->ctrlp = pci_iomap(pdev, 0, 0);
+	if (!dev->ctrlp) {
+		hio_warn("%s: can not remap IO region 0\n", dev->name);
+		ret = -ENOMEM;
+		goto out_pci_iomap;
+	}
+
+	ret = ssd_check_hw(dev);
+	if (ret) {
+		hio_err("%s: check hardware failed\n", dev->name);
+		goto out_check_hw;
+	}
+
+	ret = ssd_init_protocol_info(dev);
+	if (ret) {
+		hio_err("%s: init protocol info failed\n", dev->name);
+		goto out_init_protocol_info;
+	}
+
+	/* alarm led ? */
+	ssd_clear_alarm(dev);
+
+	ret = ssd_init_fw_info(dev);
+	if (ret) {
+		hio_err("%s: init firmware info failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_init_fw_info;
+	}
+	
+	/* slave port ? */
+	if (dev->slave) {
+		goto init_next1;
+	}
+
+	ret = ssd_init_rom_info(dev);
+	if (ret) {
+		hio_err("%s: init rom info failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_init_rom_info;
+	}
+
+	ret = ssd_init_label(dev);
+	if (ret) {
+		hio_err("%s: init label failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_init_label;
+	}
+
+	ret = ssd_init_workq(dev);
+	if (ret) {
+		hio_warn("%s: init workq failed\n", dev->name);
+		goto out_init_workq;
+	}
+	(void)test_and_set_bit(SSD_INIT_WORKQ, &dev->state);
+
+	ret = ssd_init_log(dev);
+	if (ret) {
+		hio_err("%s: init log failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_init_log;
+	}
+
+	ret = ssd_init_smart(dev);
+	if (ret) {
+		hio_err("%s: init info failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_init_smart;
+	}
+
+init_next1:
+	ret = ssd_init_hw_info(dev);
+	if (ret) {
+		hio_err("%s: init hardware info failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_init_hw_info;
+	}
+
+	/* slave port ? */
+	if (dev->slave) {
+		goto init_next2;
+	}
+
+	ret = ssd_init_sensor(dev);
+	if (ret) {
+		hio_err("%s: init sensor failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_init_sensor;
+	}
+
+	ret = ssd_init_pl_cap(dev);
+	if (ret) {
+		hio_err("%s: int pl_cap failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_init_pl_cap;
+	}
+
+init_next2:
+	ret = ssd_check_init_state(dev);
+	if (ret) {
+		hio_err("%s: check init state failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_check_init_state;
+	}
+
+	ret = ssd_init_response(dev);
+	if (ret) {
+		hio_warn("%s: init resp_msg failed\n", dev->name);
+		goto out_init_response;
+	}
+
+	ret = ssd_init_cmd(dev);
+	if (ret) {
+		hio_warn("%s: init msg failed\n", dev->name);
+		goto out_init_cmd;
+	}
+
+	ret = ssd_init_dcmd(dev);
+	if (ret) {
+		hio_warn("%s: init cmd failed\n", dev->name);
+		goto out_init_dcmd;
+	}
+
+	ret = ssd_init_irq(dev);
+	if (ret) {
+		hio_warn("%s: init irq failed\n", dev->name);
+		goto out_init_irq;
+	}
+
+	ret = ssd_init_thread(dev);
+	if (ret) {
+		hio_warn("%s: init thread failed\n", dev->name);
+		goto out_init_thread;
+	}
+
+	ret = ssd_init_tag(dev);
+	if(ret) {
+		hio_warn("%s: init tags failed\n", dev->name);
+		goto out_init_tags;
+	}
+
+	/*  */
+	(void)test_and_set_bit(SSD_ONLINE, &dev->state);
+
+	ret = ssd_init_queue(dev);
+	if (ret) {
+		hio_warn("%s: init queue failed\n", dev->name);
+		goto out_init_queue;
+	}
+
+	/* slave port ? */
+	if (dev->slave) {
+		goto init_next3;
+	}
+
+	ret = ssd_init_ot_protect(dev);
+	if (ret) {
+		hio_err("%s: int ot_protect failed\n", dev->name);
+		/* alarm led */
+		ssd_set_alarm(dev);
+		goto out_int_ot_protect;
+	}
+
+	ret = ssd_init_wmode(dev);
+	if (ret) {
+		hio_warn("%s: init write mode\n", dev->name);
+		goto out_init_wmode;
+	}
+
+	/* init routine after hw is ready */
+	ret = ssd_init_routine(dev);
+	if (ret) {
+		hio_warn("%s: init routine\n", dev->name);
+		goto out_init_routine;
+	}
+
+	ret = ssd_init_chardev(dev);
+	if (ret) {
+		hio_warn("%s: register char device failed\n", dev->name);
+		goto out_init_chardev;
+	}
+
+init_next3:
+	ret = ssd_init_blkdev(dev);
+	if (ret) {
+		hio_warn("%s: register block device failed\n", dev->name);
+		goto out_init_blkdev;
+	}
+	(void)test_and_set_bit(SSD_INIT_BD, &dev->state);
+
+	ret = ssd_register_sysfs(dev);
+	if (ret) {
+		hio_warn("%s: register sysfs failed\n", dev->name);
+		goto out_register_sysfs;
+	}
+
+	dev->save_md = 1;
+
+	list_add_tail(&dev->list, &ssd_list);
+
+	return 0;
+
+out_register_sysfs:
+	test_and_clear_bit(SSD_INIT_BD, &dev->state);
+	ssd_cleanup_blkdev(dev);
+out_init_blkdev:
+	/* slave port ? */
+	if (!dev->slave) {
+		ssd_cleanup_chardev(dev);
+	}
+out_init_chardev:
+	/* slave port ? */
+	if (!dev->slave) {
+		ssd_cleanup_routine(dev);
+	}
+out_init_routine:
+out_init_wmode:
+out_int_ot_protect:
+	ssd_cleanup_queue(dev);
+out_init_queue:
+	test_and_clear_bit(SSD_ONLINE, &dev->state);
+	ssd_cleanup_tag(dev);
+out_init_tags:
+	ssd_cleanup_thread(dev);
+out_init_thread:
+	ssd_free_irq(dev);
+out_init_irq:
+	ssd_cleanup_dcmd(dev);
+out_init_dcmd:
+	ssd_cleanup_cmd(dev);
+out_init_cmd:
+	ssd_cleanup_response(dev);
+out_init_response:
+out_check_init_state:
+out_init_pl_cap:
+out_init_sensor:
+out_init_hw_info:
+out_init_smart:
+	/* slave port ? */
+	if (!dev->slave) {
+		ssd_cleanup_log(dev);
+	}
+out_init_log:
+	/* slave port ? */
+	if (!dev->slave) {
+		test_and_clear_bit(SSD_INIT_WORKQ, &dev->state);
+		ssd_cleanup_workq(dev);
+	}
+out_init_workq:
+out_init_label:
+out_init_rom_info:
+out_init_fw_info:
+out_init_protocol_info:
+out_check_hw:
+#ifdef LINUX_SUSE_OS
+	iounmap(dev->ctrlp);
+#else
+	pci_iounmap(pdev, dev->ctrlp);
+#endif
+out_pci_iomap:
+	release_mem_region(dev->mmio_base, dev->mmio_len);
+out_request_mem_region:
+out_set_dma_mask:
+	pci_disable_device(pdev);
+out_enable_device:
+	pci_set_drvdata(pdev, NULL);
+out_get_index:
+	kfree(dev);
+out_alloc_dev:
+out:
+	return ret;
+}
+
+static void ssd_cleanup_tasklet(void)
+{
+	int i;
+	for_each_online_cpu(i) {
+		tasklet_kill(&per_cpu(ssd_tasklet, i));
+	}
+}
+
+static int ssd_init_tasklet(void)
+{
+	int i;
+
+	for_each_online_cpu(i) {
+		INIT_LIST_HEAD(&per_cpu(ssd_doneq, i));
+
+		if (finject) {
+			tasklet_init(&per_cpu(ssd_tasklet, i), __ssd_done_db, 0);
+		} else {
+			tasklet_init(&per_cpu(ssd_tasklet, i), __ssd_done, 0);
+		}
+	}
+
+	return 0;
+}
+
+static struct pci_device_id ssd_pci_tbl[] = {
+	{ 0x10ee, 0x0007, PCI_ANY_ID, PCI_ANY_ID, }, /* g3 */
+	{ 0x19e5, 0x0007, PCI_ANY_ID, PCI_ANY_ID, }, /* v1 */
+	//{ 0x19e5, 0x0008, PCI_ANY_ID, PCI_ANY_ID, }, /* v1 sp*/
+	{ 0x19e5, 0x0009, PCI_ANY_ID, PCI_ANY_ID, }, /* v2 */
+	{ 0x19e5, 0x000a, PCI_ANY_ID, PCI_ANY_ID, }, /* v2 dp slave*/
+	{ 0, }
+};
+MODULE_DEVICE_TABLE(pci, ssd_pci_tbl);
+
+static struct pci_driver ssd_driver = {
+	.name		= MODULE_NAME, 
+	.id_table	= ssd_pci_tbl, 
+	.probe		= ssd_init_one, 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,38))	
+	.remove		= __devexit_p(ssd_remove_one), 
+#else
+	.remove		= ssd_remove_one, 
+#endif
+};
+
+/* notifier block to get a notify on system shutdown/halt/reboot */
+static int ssd_notify_reboot(struct notifier_block *nb, unsigned long event, void *buf)
+{
+	struct ssd_device *dev = NULL;
+	struct ssd_device *n = NULL;
+
+	list_for_each_entry_safe(dev, n, &ssd_list, list) {
+		ssd_gen_swlog(dev, SSD_LOG_POWER_OFF, 0);
+	
+		(void)ssd_flush(dev);
+		(void)ssd_save_md(dev);
+
+		/* slave port ? */
+		if (!dev->slave) {
+			ssd_save_smart(dev);
+
+			ssd_stop_workq(dev);
+
+			if (dev->reload_fw) {
+				ssd_reg32_write(dev->ctrlp + SSD_RELOAD_FW_REG, SSD_RELOAD_FW);
+			}
+		}
+	}
+
+	return NOTIFY_OK;
+}
+
+static struct notifier_block ssd_notifier = {
+	ssd_notify_reboot, NULL, 0
+};
+
+static int __init ssd_init_module(void)
+{
+	int ret = 0;
+
+	hio_info("driver version: %s\n", DRIVER_VERSION);
+
+	ret = ssd_init_index();
+	if (ret) {
+		hio_warn("init index failed\n");
+		goto out_init_index;
+	}
+
+	ret = ssd_init_proc();
+	if (ret) {
+		hio_warn("init proc failed\n");
+		goto out_init_proc;
+	}
+
+	ret = ssd_init_sysfs();
+	if (ret) {
+		hio_warn("init sysfs failed\n");
+		goto out_init_sysfs;
+	}
+
+	ret = ssd_init_tasklet();
+	if (ret) {
+		hio_warn("init tasklet failed\n");
+		goto out_init_tasklet;
+	}
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,12))
+	ssd_class = class_simple_create(THIS_MODULE, SSD_DEV_NAME);
+#else
+	ssd_class = class_create(THIS_MODULE, SSD_DEV_NAME);
+#endif
+	if (IS_ERR(ssd_class)) {
+		ret = PTR_ERR(ssd_class);
+		goto out_class_create;
+	}
+
+	if (ssd_cmajor > 0) {
+		ret = register_chrdev(ssd_cmajor, SSD_CDEV_NAME, &ssd_cfops);
+	} else {
+		ret = ssd_cmajor = register_chrdev(ssd_cmajor, SSD_CDEV_NAME, &ssd_cfops);
+	}
+	if (ret < 0) {
+		hio_warn("unable to register chardev major number\n");
+		goto out_register_chardev;
+	}
+
+	if (ssd_major > 0) {
+		ret = register_blkdev(ssd_major, SSD_DEV_NAME);
+	} else {
+		ret = ssd_major = register_blkdev(ssd_major, SSD_DEV_NAME);
+	}
+	if (ret < 0) {
+		hio_warn("unable to register major number\n");
+		goto out_register_blkdev;
+	}
+
+	if (ssd_major_sl > 0) {
+		ret = register_blkdev(ssd_major_sl, SSD_SDEV_NAME);
+	} else {
+		ret = ssd_major_sl = register_blkdev(ssd_major_sl, SSD_SDEV_NAME);
+	}
+	if (ret < 0) {
+		hio_warn("unable to register slave major number\n");
+		goto out_register_blkdev_sl;
+	}
+
+	if (mode < SSD_DRV_MODE_STANDARD || mode > SSD_DRV_MODE_BASE) {
+		mode = SSD_DRV_MODE_STANDARD;
+	}
+
+	/* for debug */
+	if (mode != SSD_DRV_MODE_STANDARD) {
+		ssd_minors = 1;
+	}
+
+	if (int_mode < SSD_INT_LEGACY || int_mode > SSD_INT_MSIX) {
+		int_mode = SSD_INT_MODE_DEFAULT;
+	}
+
+	if (threaded_irq) {
+		int_mode = SSD_INT_MSI;
+	}
+
+	if (log_level >= SSD_LOG_NR_LEVEL || log_level < SSD_LOG_LEVEL_INFO) {
+		log_level = SSD_LOG_LEVEL_ERR;
+	}
+
+	if (wmode < SSD_WMODE_BUFFER || wmode > SSD_WMODE_DEFAULT) {
+		wmode = SSD_WMODE_DEFAULT;
+	}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20))
+	ret = pci_module_init(&ssd_driver);
+#else
+	ret = pci_register_driver(&ssd_driver);
+#endif
+	if (ret) {
+		hio_warn("pci init failed\n");
+		goto out_pci_init;
+	}
+
+	ret = register_reboot_notifier(&ssd_notifier);
+	if (ret) {
+		hio_warn("register reboot notifier failed\n");
+		goto out_register_reboot_notifier;
+	}
+
+	return 0;
+
+out_register_reboot_notifier:
+out_pci_init:
+	pci_unregister_driver(&ssd_driver);
+	unregister_blkdev(ssd_major_sl, SSD_SDEV_NAME);
+out_register_blkdev_sl:
+	unregister_blkdev(ssd_major, SSD_DEV_NAME);
+out_register_blkdev:
+	unregister_chrdev(ssd_cmajor, SSD_CDEV_NAME);
+out_register_chardev:
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,12))
+	class_simple_destroy(ssd_class);
+#else
+	class_destroy(ssd_class);
+#endif
+out_class_create:
+	ssd_cleanup_tasklet();
+out_init_tasklet:
+	ssd_cleanup_sysfs();
+out_init_sysfs:
+	ssd_cleanup_proc();
+out_init_proc:
+	ssd_cleanup_index();
+out_init_index:
+	return ret;
+
+}
+
+static void __exit ssd_cleanup_module(void)
+{
+
+	hio_info("unload driver: %s\n", DRIVER_VERSION);
+	/* exiting */
+	ssd_exiting = 1;
+
+	unregister_reboot_notifier(&ssd_notifier);
+
+	pci_unregister_driver(&ssd_driver);
+
+	unregister_blkdev(ssd_major_sl, SSD_SDEV_NAME);
+	unregister_blkdev(ssd_major, SSD_DEV_NAME);
+	unregister_chrdev(ssd_cmajor, SSD_CDEV_NAME);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,12))
+	class_simple_destroy(ssd_class);
+#else
+	class_destroy(ssd_class);
+#endif
+
+	ssd_cleanup_tasklet();
+	ssd_cleanup_sysfs();
+	ssd_cleanup_proc();
+	ssd_cleanup_index();
+}
+
+int ssd_register_event_notifier(struct block_device *bdev, ssd_event_call event_call)
+{
+	struct ssd_device *dev;
+	struct timeval tv;
+	struct ssd_log *le;
+	uint64_t cur;
+	int log_nr;
+
+	if (!bdev || !event_call || !(bdev->bd_disk)) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+	dev->event_call = event_call;
+
+	do_gettimeofday(&tv);
+	cur = tv.tv_sec;
+
+	le = (struct ssd_log *)(dev->internal_log.log);
+	log_nr = dev->internal_log.nr_log;
+
+	while (log_nr--) {
+		if (le->time <= cur && le->time >= dev->uptime) {
+			(void)dev->event_call(dev->gd, le->le.event, ssd_parse_log(dev, le, 0));
+		}
+		le++;
+	}
+
+	return 0;
+}
+
+int ssd_unregister_event_notifier(struct block_device *bdev)
+{
+	struct ssd_device *dev;
+
+	if (!bdev || !(bdev->bd_disk)) {
+		return -EINVAL;
+	}
+
+	dev = bdev->bd_disk->private_data;
+	dev->event_call = NULL;
+
+	return 0;
+}
+
+EXPORT_SYMBOL(ssd_get_label);
+EXPORT_SYMBOL(ssd_get_version);
+EXPORT_SYMBOL(ssd_set_otprotect);
+EXPORT_SYMBOL(ssd_bm_status);
+EXPORT_SYMBOL(ssd_submit_pbio);
+EXPORT_SYMBOL(ssd_get_pciaddr);
+EXPORT_SYMBOL(ssd_get_temperature);
+EXPORT_SYMBOL(ssd_register_event_notifier);
+EXPORT_SYMBOL(ssd_unregister_event_notifier);
+EXPORT_SYMBOL(ssd_reset);
+EXPORT_SYMBOL(ssd_set_wmode);
+
+
+
+module_init(ssd_init_module);
+module_exit(ssd_cleanup_module);
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Huawei SSD DEV Team");
+MODULE_DESCRIPTION("Huawei SSD driver");
--- linux-qcom-6.8.0.orig/ubuntu/hio/hio.h
+++ linux-qcom-6.8.0/ubuntu/hio/hio.h
@@ -0,0 +1,104 @@
+/*
+* Huawei SSD device driver
+* Copyright (c) 2016, Huawei Technologies Co., Ltd.
+*
+* This program is free software; you can redistribute it and/or modify it
+* under the terms and conditions of the GNU General Public License,
+* version 2, as published by the Free Software Foundation.
+*
+* This program is distributed in the hope it will be useful, but WITHOUT
+* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+* more details.
+*/
+
+#ifndef _HIO_H
+#define _HIO_H
+
+#include <linux/types.h>
+#include <linux/genhd.h>
+#include <linux/blkdev.h>
+#include <linux/genhd.h>
+
+
+
+typedef int (*ssd_event_call)(struct gendisk *, int, int);	/* gendisk, event id, event level */
+extern int ssd_register_event_notifier(struct block_device *bdev, ssd_event_call event_call);
+/* unregister event notifier before module exit */
+extern int ssd_unregister_event_notifier(struct block_device *bdev);
+
+
+/* label */
+#define SSD_LABEL_FIELD_SZ	32
+#define SSD_SN_SZ			16
+
+typedef struct ssd_label
+{
+	char date[SSD_LABEL_FIELD_SZ];
+	char sn[SSD_LABEL_FIELD_SZ];
+	char part[SSD_LABEL_FIELD_SZ];
+	char desc[SSD_LABEL_FIELD_SZ];
+	char other[SSD_LABEL_FIELD_SZ];
+	char maf[SSD_LABEL_FIELD_SZ];
+} ssd_label_t;
+
+
+/* version */
+typedef struct ssd_version_info
+{
+	uint32_t bridge_ver;	/* bridge fw version: hex */
+	uint32_t ctrl_ver;		/* controller fw version: hex */
+	uint32_t bm_ver;		/* battery manager fw version: hex */
+	uint8_t  pcb_ver;		/* main pcb version: char */
+	uint8_t  upper_pcb_ver;
+	uint8_t  pad0;
+	uint8_t  pad1;
+} ssd_version_info_t;
+
+extern int ssd_get_label(struct block_device *bdev, struct ssd_label *label);
+extern int ssd_get_version(struct block_device *bdev, struct ssd_version_info *ver);
+extern int ssd_get_temperature(struct block_device *bdev, int *temp);
+
+
+enum ssd_bmstatus
+{
+	SSD_BMSTATUS_OK = 0,
+	SSD_BMSTATUS_CHARGING, 
+	SSD_BMSTATUS_WARNING
+};
+extern int ssd_bm_status(struct block_device *bdev, int *status);
+
+enum ssd_otprotect
+{
+	SSD_OTPROTECT_OFF = 0,
+	SSD_OTPROTECT_ON
+};
+extern int ssd_set_otprotect(struct block_device *bdev, int otprotect);
+
+typedef struct pci_addr
+{
+	uint16_t domain;
+	uint8_t bus;
+	uint8_t slot;
+	uint8_t func;
+} pci_addr_t;
+extern int ssd_get_pciaddr(struct block_device *bdev, struct pci_addr *paddr);
+
+/* submit phys bio: phys addr in iovec */
+extern void ssd_submit_pbio(struct request_queue *q, struct bio *bio);
+
+extern int ssd_reset(struct block_device *bdev);
+
+enum ssd_write_mode
+{
+	SSD_WMODE_BUFFER = 0,
+	SSD_WMODE_BUFFER_EX,
+	SSD_WMODE_FUA,
+	/* dummy */
+	SSD_WMODE_AUTO, 
+	SSD_WMODE_DEFAULT
+};
+extern int ssd_set_wmode(struct block_device *bdev, int wmode);
+
+#endif
+
--- linux-qcom-6.8.0.orig/ubuntu/include/Kbuild
+++ linux-qcom-6.8.0/ubuntu/include/Kbuild
@@ -0,0 +1,2 @@
+
+
--- linux-qcom-6.8.0.orig/ubuntu/include/README
+++ linux-qcom-6.8.0/ubuntu/include/README
@@ -0,0 +1,4 @@
+Only use this directory for things which need to share their headers with
+other parts of the kernel or other modules in ubuntu/
+
+Otherwise, keep them local to the module directory.
--- linux-qcom-6.8.0.orig/ubuntu/qcom/Makefile
+++ linux-qcom-6.8.0/ubuntu/qcom/Makefile
@@ -0,0 +1,27 @@
+subdir-ccflags-y += -Wno-packed-bitfield-compat
+subdir-ccflags-y += -Wno-enum-int-mismatch
+
+export MACHINE = qcm6490
+export KERNEL_ROOT=/
+
+###
+
+export KGSL_PATH := $(srctree)/$(src)/graphics
+export KERNEL_SRC := $(srctree)
+obj-y += graphics/
+
+###
+
+obj-y += camera-qcm6490/
+obj-y += camera-qcs9100/
+
+###
+
+obj-y += qps615/
+
+
+###
+
+export VIDEO_KERNEL_ROOT := $(srctree)/$(src)/video
+
+obj-y += video/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera-qcm6490/Makefile
+++ linux-qcom-6.8.0/ubuntu/qcom/camera-qcm6490/Makefile
@@ -0,0 +1,17 @@
+CAMERA_ARCH=qcm6490
+SOC_FAM=qcm6490
+CAMERA_KERNEL_ROOT := $(srctree)/$(src)/../camera
+
+include $(srctree)/$(src)/../camera/Kbuild
+
+obj-m := camera-qcm6490.o
+
+camera-qcm6490-objs := $(camera-y) $(camera-m)
+
+srcs := $(camera-qcm6490-objs:%.o=%.c)
+
+$(addprefix $(obj)/, $(srcs)): $(obj)/%.c: $(src)/../camera/%.c FORCE
+	$(Q)mkdir -p $(dir $@)
+	$(call if_changed,copy)
+
+targets += $(srcs)
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera-qcs9100/Makefile
+++ linux-qcom-6.8.0/ubuntu/qcom/camera-qcs9100/Makefile
@@ -0,0 +1,17 @@
+CAMERA_ARCH=qcs9100
+SOC_FAM=qcs9100
+CAMERA_KERNEL_ROOT := $(srctree)/$(src)/../camera
+
+include $(srctree)/$(src)/../camera/Kbuild
+
+obj-m := camera-qcs9100.o
+
+camera-qcs9100-objs := $(camera-y) $(camera-m)
+
+srcs := $(camera-qcs9100-objs:%.o=%.c)
+
+$(addprefix $(obj)/, $(srcs)): $(obj)/%.c: $(src)/../camera/%.c FORCE
+	$(Q)mkdir -p $(dir $@)
+	$(call if_changed,copy)
+
+targets += $(srcs)
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/Kbuild
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/Kbuild
@@ -0,0 +1,504 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+#$(info "CAMERA_KERNEL_ROOT is: $(CAMERA_KERNEL_ROOT)")
+#$(info "KERNEL_ROOT is: $(KERNEL_ROOT)")
+#$(info "SOC_FAM is: $(SOC_FAM)")
+#$(info "CAMERA_ARCH is: $(CAMERA_ARCH)")
+
+# Include Architecture configurations
+ifdef SOC_FAM
+include $(CAMERA_KERNEL_ROOT)/config/$(SOC_FAM)-camera.mk
+else
+$(info "SOC_FAM not defined.")
+endif
+
+ifneq ($(KBUILD_EXTRA_CONFIGS),)
+include $(KBUILD_EXTRA_CONFIGS)
+endif
+
+# List of all camera-kernel headers
+
+ifeq ($(CAMERA_ARCH), qcm6490)
+cam_include_dirs := $(shell find $(CAMERA_KERNEL_ROOT)/camera_kt -name '*.h' ! -path '*/tfe_hw/*' ! -path '*/tfe_csid_hw/*' ! -path '*/sfe_hw/*' ! -path '*/ppi_hw/*' -exec dirname {} \; | uniq)
+cam_include_dirs += $(shell dirname `find $(CAMERA_KERNEL_ROOT)/common -name '*.h'` | uniq)
+else
+cam_include_dirs := $(shell dirname `find $(CAMERA_KERNEL_ROOT)/camera -name '*.h'` | uniq)
+cam_include_dirs += $(shell dirname `find $(CAMERA_KERNEL_ROOT)/common -name '*.h'` | uniq)
+endif
+
+
+ifeq ($(CAMERA_ARCH), qcm6490)
+# Include UAPI headers
+USERINCLUDE +=                              \
+	-I$(CAMERA_KERNEL_ROOT)/camera_kt/include/uapi/
+# Include Kernel headers
+LINUXINCLUDE +=                                                  \
+	-I$(KERNEL_ROOT)                                         \
+	$(addprefix -I,$(cam_include_dirs))                      \
+	-I$(CAMERA_KERNEL_ROOT)/camera_kt/include/uapi/camera/media \
+	-I$(CAMERA_KERNEL_ROOT)/camera_kt/include/uapi/camera       \
+	-I$(CAMERA_KERNEL_ROOT)/camera_kt/include/uapi              \
+	-I$(CAMERA_KERNEL_ROOT)/camera_kt                           \
+	-I$(CAMERA_KERNEL_ROOT)/
+
+# After creating lists, add content of 'ccflags-m' variable to 'ccflags-y' one.
+ccflags-y += ${ccflags-m}
+
+camera-y := \
+	camera_kt/drivers/cam_req_mgr/cam_req_mgr_core.o \
+	camera_kt/drivers/cam_req_mgr/cam_req_mgr_dev.o \
+	camera_kt/drivers/cam_req_mgr/cam_req_mgr_debug.o \
+	camera_kt/drivers/cam_utils/cam_soc_util.o \
+	camera_kt/drivers/cam_utils/cam_packet_util.o \
+	camera_kt/drivers/cam_utils/cam_trace.o \
+	camera_kt/drivers/cam_core/cam_context.o \
+	camera_kt/drivers/cam_core/cam_context_utils.o \
+	camera_kt/drivers/cam_core/cam_node.o \
+	camera_kt/drivers/cam_core/cam_subdev.o \
+	camera_kt/drivers/cam_sync/cam_sync.o \
+	camera_kt/drivers/cam_sync/cam_sync_util.o \
+	camera_kt/drivers/cam_cpas/cpas_top/cam_cpastop_hw.o \
+	camera_kt/drivers/cam_cpas/camss_top/cam_camsstop_hw.o \
+	camera_kt/drivers/cam_cpas/cam_cpas_soc.o \
+	camera_kt/drivers/cam_cpas/cam_cpas_intf.o \
+	camera_kt/drivers/cam_cpas/cam_cpas_hw.o \
+	camera_kt/drivers/cam_cdm/cam_cdm_soc.o \
+	camera_kt/drivers/cam_cdm/cam_cdm_util.o \
+	camera_kt/drivers/cam_cdm/cam_cdm_intf.o \
+	camera_kt/drivers/cam_cdm/cam_cdm_core_common.o \
+	camera_kt/drivers/cam_cdm/cam_cdm_virtual_core.o \
+	camera_kt/drivers/cam_cdm/cam_cdm_hw_core.o \
+	camera_kt/drivers/cam_req_mgr/cam_mem_mgr.o \
+	camera_kt/drivers/cam_smmu/cam_smmu_api.o \
+	common/cam_common_util.o \
+	common/cam_compat.o \
+	common/cam_debug_util.o \
+	common/cam_io_util.o \
+	common/cam_req_mgr_timer.o \
+	common/cam_req_mgr_util.o \
+	common/cam_req_mgr_workq.o \
+	common/cam_soc_icc.o
+
+camera-$(CONFIG_QCOM_CX_IPEAK) += camera_kt/drivers/cam_utils/cam_cx_ipeak.o
+camera-$(CONFIG_QCOM_BUS_SCALING) += camera_kt/drivers/cam_utils/cam_soc_bus.o
+
+camera-$(CONFIG_SPECTRA_ISP) += \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_tasklet_util.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid17x.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite17x.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.o \
+	camera_kt/drivers/cam_isp/cam_isp_dev.o \
+	camera_kt/drivers/cam_isp/cam_isp_context.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver2.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_soc.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_core.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver3.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_dev.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver1.o
+
+camera-$(CONFIG_SPECTRA_ICP) += \
+	camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.o \
+	camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_dev.o \
+	camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.o \
+	camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.o \
+	camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_dev.o \
+	camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_core.o \
+	camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_soc.o \
+	camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_dev.o \
+	camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_core.o \
+	camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_soc.o \
+	camera_kt/drivers/cam_icp/cam_icp_subdev.o \
+	camera_kt/drivers/cam_icp/cam_icp_context.o \
+	camera_kt/drivers/cam_icp/hfi.o
+
+camera-$(CONFIG_SPECTRA_JPEG) += \
+	camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.o \
+	camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.o \
+	camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.o \
+	camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.o \
+	camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.o \
+	camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.o \
+	camera_kt/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.o \
+	camera_kt/drivers/cam_jpeg/cam_jpeg_dev.o \
+	camera_kt/drivers/cam_jpeg/cam_jpeg_context.o
+
+camera-$(CONFIG_SPECTRA_FD) += \
+	camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_dev.o \
+	camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.o \
+	camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.o \
+	camera_kt/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.o \
+	camera_kt/drivers/cam_fd/cam_fd_dev.o \
+	camera_kt/drivers/cam_fd/cam_fd_context.o
+
+camera-$(CONFIG_SPECTRA_LRME) += \
+	camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_dev.o \
+	camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.o \
+	camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.o \
+	camera_kt/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.o \
+	camera_kt/drivers/cam_lrme/cam_lrme_dev.o \
+	camera_kt/drivers/cam_lrme/cam_lrme_context.o
+
+camera-$(CONFIG_SPECTRA_SENSOR) += \
+	camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.o \
+	camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.o \
+	camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_core.o \
+	camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_soc.o \
+	camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.o \
+	camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.o \
+	camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.o  \
+	camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.o \
+	camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_core.o \
+	camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_soc.o \
+	camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.o \
+	camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.o \
+	camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.o \
+	camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_cci_i2c.o \
+	camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_qup_i2c.o \
+	camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.o \
+	camera_kt/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.o \
+	camera_kt/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.o \
+	camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_core.o \
+	camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_soc.o \
+	camera_kt/drivers/cam_sensor_module/cam_dp_bdg/cam_dp_bdg_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_dp_bdg/cam_dp_bdg_core.o \
+	camera_kt/drivers/cam_sensor_module/cam_hdmi_bdg/cam_hdmi_bdg_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_hdmi_bdg/cam_hdmi_bdg_core.o \
+	camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_dev.o \
+	camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_core.o \
+	camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_soc.o
+
+camera-$(CONFIG_SPECTRA_CUSTOM) += \
+	camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.o \
+	camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.o \
+	camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.o \
+	camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.o \
+	camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.o \
+	camera_kt/drivers/cam_cust/cam_custom_dev.o \
+	camera_kt/drivers/cam_cust/cam_custom_context.o
+
+camera-$(CONFIG_SPECTRA_OPE) += \
+	camera_kt/drivers/cam_ope/cam_ope_subdev.o \
+	camera_kt/drivers/cam_ope/cam_ope_context.o \
+	camera_kt/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.o \
+	camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev.o \
+	camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.o \
+	camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.o \
+	camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.o \
+	camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.o\
+	camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.o
+
+camera-$(CONFIG_SPECTRA_TFE) += \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid530.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.o
+
+camera-$(CONFIG_SPECTRA_SFE) += \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.o \
+	camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.o
+
+camera-y += camera_kt/drivers/camera_main.o
+
+ccflags-y += -Wmissing-prototypes
+
+obj-m += camera.o
+BOARD_VENDOR_KERNEL_MODULES += $(KERNEL_MODULES_OUT)/camera.ko
+else
+# Include UAPI headers
+USERINCLUDE +=                              \
+	-I$(CAMERA_KERNEL_ROOT)/camera/include/uapi/
+# Include Kernel headers
+LINUXINCLUDE +=                                                       \
+	-I$(KERNEL_ROOT)                                              \
+	$(addprefix -I,$(cam_include_dirs))                           \
+	-I$(CAMERA_KERNEL_ROOT)/camera/include/uapi/camera/media \
+	-I$(CAMERA_KERNEL_ROOT)/camera/include/uapi/camera       \
+	-I$(CAMERA_KERNEL_ROOT)/camera/include/uapi              \
+	-I$(CAMERA_KERNEL_ROOT)/camera                           \
+	-I$(CAMERA_KERNEL_ROOT)/
+
+# Optional include directories
+# SYNXVENDORDIR=$(CAMERA_KERNEL_ROOT)/../synx-kernel
+# ccflags-$(CONFIG_MSM_GLOBAL_SYNX) += -I$(KERNEL_ROOT)/camera/drivers/media/platform/msm/synx
+# ccflags-$(TARGET_SYNX_ENABLE) += -I$(SYNXVENDORDIR)/include/uapi/synx/media
+# ccflags-$(TARGET_SYNX_ENABLE) += -I$(SYNXVENDORDIR)/msm/synx
+# ccflags-$(TARGET_SYNX_ENABLE) += -DCONFIG_TARGET_SYNX_ENABLE=1
+# ccflags-y += -I$(CAMERA_KERNEL_ROOT)/../securemsm-kernel/
+# ccflags-y += -I$(CAMERA_KERNEL_ROOT)/../securemsm-kernel/include/
+
+# After creating lists, add content of 'ccflags-m' variable to 'ccflags-y' one.
+ccflags-y += ${ccflags-m}
+camera-y := \
+	camera/drivers/cam_req_mgr/cam_req_mgr_core.o \
+	camera/drivers/cam_req_mgr/cam_req_mgr_dev.o \
+	camera/drivers/cam_req_mgr/cam_mem_mgr.o \
+	camera/drivers/cam_req_mgr/cam_req_mgr_debug.o \
+	camera/drivers/cam_utils/cam_soc_util.o \
+	camera/drivers/cam_utils/cam_packet_util.o \
+	camera/drivers/cam_utils/cam_trace.o \
+	camera/drivers/cam_core/cam_context.o \
+	camera/drivers/cam_core/cam_context_utils.o \
+	camera/drivers/cam_core/cam_node.o \
+	camera/drivers/cam_core/cam_subdev.o \
+	camera/drivers/cam_sync/cam_sync.o \
+	camera/drivers/cam_sync/cam_sync_util.o \
+	camera/drivers/cam_sync/cam_sync_dma_fence.o \
+	camera/drivers/cam_cpas/cpas_top/cam_cpastop_hw.o \
+	camera/drivers/cam_cpas/camss_top/cam_camsstop_hw.o \
+	camera/drivers/cam_cpas/cam_cpas_soc.o \
+	camera/drivers/cam_cpas/cam_cpas_intf.o \
+	camera/drivers/cam_cpas/cam_cpas_hw.o \
+	camera/drivers/cam_cdm/cam_cdm_soc.o \
+	camera/drivers/cam_cdm/cam_cdm_util.o \
+	camera/drivers/cam_cdm/cam_cdm_intf.o \
+	camera/drivers/cam_cdm/cam_cdm_core_common.o \
+	camera/drivers/cam_cdm/cam_cdm_virtual_core.o \
+	camera/drivers/cam_cdm/cam_cdm_hw_core.o \
+	camera/drivers/cam_smmu/cam_smmu_api.o \
+	common/cam_common_util.o \
+	common/cam_compat.o \
+	common/cam_debug_util.o \
+	common/cam_io_util.o \
+	common/cam_req_mgr_timer.o \
+	common/cam_req_mgr_util.o \
+	common/cam_req_mgr_workq.o \
+	common/cam_soc_icc.o
+
+ifeq (,$(filter $(CONFIG_CAM_PRESIL),y m))
+	camera-y += camera/drivers/cam_presil/stub/cam_presil_hw_access_stub.o
+else
+	ccflags-y += -DCONFIG_CAM_PRESIL=1
+endif
+
+camera-$(TARGET_SYNX_ENABLE) += camera/drivers/cam_sync/cam_sync_synx.o
+camera-$(CONFIG_QCOM_CX_IPEAK) += camera/drivers/cam_utils/cam_cx_ipeak.o
+camera-$(CONFIG_QCOM_BUS_SCALING) += camera/drivers/cam_utils/cam_soc_bus.o
+
+camera-$(CONFIG_SPECTRA_ISP) += \
+	camera/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_tasklet_util.o \
+	camera/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.o \
+	camera/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_common.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver1.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver2.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_mod.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite_mod.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver4.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.o \
+	camera/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.o \
+	camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.o \
+	camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr_addons.o \
+	camera/drivers/cam_isp/cam_isp_dev.o \
+	camera/drivers/cam_isp/cam_isp_context.o
+
+camera-$(CONFIG_SPECTRA_ICP) += \
+	camera/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.o \
+	camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_dev.o \
+	camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.o \
+	camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.o \
+	camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_dev.o \
+	camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_core.o \
+	camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_dev.o \
+	camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_core.o \
+	camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_proc_common.o \
+	camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_soc_common.o \
+	camera/drivers/cam_icp/icp_hw/icp_proc/cam_icp_proc.o \
+	camera/drivers/cam_icp/icp_hw/bps_hw/bps_dev.o \
+	camera/drivers/cam_icp/icp_hw/bps_hw/bps_core.o \
+	camera/drivers/cam_icp/icp_hw/bps_hw/bps_soc.o \
+	camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_dev.o \
+	camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_core.o \
+	camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_soc.o \
+	camera/drivers/cam_icp/cam_icp_subdev.o \
+	camera/drivers/cam_icp/cam_icp_context.o \
+	camera/drivers/cam_icp/hfi.o
+
+camera-$(CONFIG_SPECTRA_JPEG) += \
+	camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.o \
+	camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.o \
+	camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.o \
+	camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.o \
+	camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.o \
+	camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.o \
+	camera/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.o \
+	camera/drivers/cam_jpeg/cam_jpeg_dev.o \
+	camera/drivers/cam_jpeg/cam_jpeg_context.o
+
+camera-$(CONFIG_SPECTRA_FD) += \
+	camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_dev.o \
+	camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.o \
+	camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.o \
+	camera/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.o \
+	camera/drivers/cam_fd/cam_fd_dev.o \
+	camera/drivers/cam_fd/cam_fd_context.o
+
+camera-$(CONFIG_SPECTRA_LRME) += \
+	camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_dev.o \
+	camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.o \
+	camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.o \
+	camera/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.o \
+	camera/drivers/cam_lrme/cam_lrme_dev.o \
+	camera/drivers/cam_lrme/cam_lrme_context.o
+
+camera-$(CONFIG_SPECTRA_SENSOR) += \
+	camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.o \
+	camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.o \
+	camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.o \
+	camera/drivers/cam_sensor_module/cam_cci/cam_cci_dev.o \
+	camera/drivers/cam_sensor_module/cam_cci/cam_cci_core.o \
+	camera/drivers/cam_sensor_module/cam_cci/cam_cci_soc.o \
+	camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_dev.o \
+	camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_core.o \
+	camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw.o \
+	camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_common.o \
+	camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_0/tpg_hw_v_1_0.o \
+	camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_2/tpg_hw_v_1_2.o \
+	camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3.o \
+	camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4.o \
+	camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.o \
+	camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.o \
+	camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.o \
+	camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.o \
+	camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.o  \
+	camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.o \
+	camera/drivers/cam_sensor_module/cam_ois/cam_ois_dev.o \
+	camera/drivers/cam_sensor_module/cam_ois/cam_ois_core.o \
+	camera/drivers/cam_sensor_module/cam_ois/cam_ois_soc.o \
+	camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.o \
+	camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.o \
+	camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.o \
+	camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.o \
+	camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_cci_i2c.o \
+	camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_qup_i2c.o \
+	camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_qup_i3c.o \
+	camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.o \
+	camera/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.o \
+	camera/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.o \
+	camera/drivers/cam_sensor_module/cam_flash/cam_flash_dev.o \
+	camera/drivers/cam_sensor_module/cam_flash/cam_flash_core.o \
+	camera/drivers/cam_sensor_module/cam_flash/cam_flash_soc.o \
+	camera/drivers/cam_sensor_module/cam_sensor_module_debug.o
+
+camera-$(CONFIG_SPECTRA_CUSTOM) += \
+	camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.o \
+	camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.o \
+	camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.o \
+	camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.o \
+	camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.o \
+	camera/drivers/cam_cust/cam_custom_dev.o \
+	camera/drivers/cam_cust/cam_custom_context.o
+
+camera-$(CONFIG_SPECTRA_OPE) += \
+	camera/drivers/cam_ope/cam_ope_subdev.o \
+	camera/drivers/cam_ope/cam_ope_context.o \
+	camera/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.o \
+	camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev.o \
+	camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.o \
+	camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.o \
+	camera/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.o \
+	camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.o\
+	camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.o
+
+camera-$(CONFIG_SPECTRA_CRE) += \
+	camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_core.o \
+	camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_soc.o \
+	camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_dev.o \
+	camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/top/cre_top.o \
+	camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_rd/cre_bus_rd.o \
+	camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_wr/cre_bus_wr.o \
+	camera/drivers/cam_cre/cam_cre_hw_mgr/cam_cre_hw_mgr.o \
+	camera/drivers/cam_cre/cam_cre_dev.o \
+	camera/drivers/cam_cre/cam_cre_context.o
+
+camera-$(CONFIG_SPECTRA_TFE) += \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.o \
+	camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid.o \
+	camera/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.o
+
+camera-y += camera/drivers/camera_main.o
+
+obj-m += camera.o
+BOARD_VENDOR_KERNEL_MODULES += $(KERNEL_MODULES_OUT)/camera.ko
+endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/Makefile
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/Makefile
@@ -0,0 +1,28 @@
+KBUILD_OPTIONS += CAMERA_KERNEL_ROOT=$(shell pwd)
+KBUILD_OPTIONS += KERNEL_ROOT=$(ROOT_DIR)/$(KERNEL_DIR)
+KBUILD_OPTIONS += MODNAME=camera
+
+.PHONY: clean all
+
+all: modules
+
+CAMERA_COMPILE_TIME = $(shell date)
+CAMERA_COMPILE_HOST = $(shell uname -n)
+CAMERA_CC_VERSION = $(shell LC_ALL=C $(CC) --version 2>/dev/null | head -n 1)
+
+cam_generated_h: $(shell find . -iname "*.c") $(shell find . -iname "*.h") $(shell find . -iname "*.mk")
+	echo '#define CAMERA_COMPILE_TIME "$(CAMERA_COMPILE_TIME)"' > cam_generated_h
+	echo '#define CAMERA_COMPILE_HOST "$(CAMERA_COMPILE_HOST)"' >> cam_generated_h
+	echo '#define CAMERA_CC_VERSION "$(CAMERA_CC_VERSION)"' >> cam_generated_h
+
+SRC := $(shell pwd)
+
+modules: cam_generated_h
+
+headers_install:
+	echo "Processing target $@"
+	IN_DIR=$(HEADERS_DIR)/include/uapi/camera/media/ OUT_DIR=sanitized_headers/camera/media/ bash sanitize_uapi.sh
+
+%:
+	echo "Processing glob target $@"
+	$(MAKE) -C $(KERNEL_SRC) M=$(SRC) $@ $(KBUILD_OPTIONS)
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm.h
@@ -0,0 +1,606 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_H_
+#define _CAM_CDM_H_
+
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/random.h>
+#include <linux/spinlock_types.h>
+#include <linux/mutex.h>
+#include <linux/workqueue.h>
+#include <linux/bug.h>
+
+#include "cam_cdm_intf_api.h"
+#include "cam_soc_util.h"
+#include "cam_cpas_api.h"
+#include "cam_hw_intf.h"
+#include "cam_hw.h"
+#include "cam_debug_util.h"
+
+#define CAM_MAX_SW_CDM_VERSION_SUPPORTED  1
+#define CAM_SW_CDM_INDEX                  0
+#define CAM_CDM_INFLIGHT_WORKS            5
+#define CAM_CDM_HW_RESET_TIMEOUT          300
+#define CAM_CDM_PAUSE_CORE_US_TIMEOUT     10000
+
+/*
+ * Macros to get prepare and get information
+ * from client CDM handles.
+ */
+
+#define CAM_CDM_HW_ID_MASK      0xF
+#define CAM_CDM_HW_ID_SHIFT     0x10
+
+#define CAM_CDM_CLIENTS_ID_MASK 0xFF
+
+#define CAM_CDM_BL_FIFO_ID_MASK 0xF
+#define CAM_CDM_BL_FIFO_ID_SHIFT 0x8
+
+#define CAM_CDM_GET_HW_IDX(x) (((x) >> CAM_CDM_HW_ID_SHIFT) & \
+	CAM_CDM_HW_ID_MASK)
+
+#define CAM_CDM_GET_BLFIFO_IDX(x) (((x) >> CAM_CDM_BL_FIFO_ID_SHIFT) & \
+	CAM_CDM_BL_FIFO_ID_MASK)
+
+#define CAM_CDM_CREATE_CLIENT_HANDLE(hw_idx, priority, client_idx) \
+	((((hw_idx) & CAM_CDM_HW_ID_MASK) << CAM_CDM_HW_ID_SHIFT) | \
+	(((priority) & CAM_CDM_BL_FIFO_ID_MASK) << CAM_CDM_BL_FIFO_ID_SHIFT)| \
+	 ((client_idx) & CAM_CDM_CLIENTS_ID_MASK))
+#define CAM_CDM_GET_CLIENT_IDX(x) ((x) & CAM_CDM_CLIENTS_ID_MASK)
+#define CAM_PER_CDM_MAX_REGISTERED_CLIENTS (CAM_CDM_CLIENTS_ID_MASK + 1)
+#define CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM (CAM_CDM_HW_ID_MASK + 1)
+
+/* Number of FIFO supported on CDM */
+#define CAM_CDM_NUM_BL_FIFO 0x4
+#define CAM_CDM_NUM_TEST_BUS 16
+
+/* Max number of register set for different CDM */
+#define CAM_CDM_BL_FIFO_REG_NUM 0x4
+#define CAM_CDM_BL_FIFO_IRQ_REG_NUM 0x4
+#define CAM_CDM_BL_FIFO_PENDING_REQ_REG_NUM 0x2
+#define CAM_CDM_SCRATCH_REG_NUM 0xc
+#define CAM_CDM_COMP_WAIT_STATUS_REG_NUM 0x2
+#define CAM_CDM_PERF_MON_REG_NUM 0x2
+
+/* BL_FIFO configurations*/
+#define CAM_CDM_BL_FIFO_LENGTH_MAX_DEFAULT 0x40
+#define CAM_CDM_BL_FIFO_LENGTH_CFG_SHIFT 0x10
+#define CAM_CDM_BL_FIFO_FLUSH_SHIFT 0x3
+
+#define CAM_CDM_BL_FIFO_REQ_SIZE_MAX 0x00
+#define CAM_CDM_BL_FIFO_REQ_SIZE_MAX_DIV2 0x01
+#define CAM_CDM_BL_FIFO_REQ_SIZE_MAX_DIV4 0x10
+#define CAM_CDM_BL_FIFO_REQ_SIZE_MAX_DIV8 0x11
+
+/* CDM core status bitmap */
+#define CAM_CDM_HW_INIT_STATUS 0x0
+#define CAM_CDM_FIFO_0_BLDONE_STATUS 0x0
+#define CAM_CDM_FIFO_1_BLDONE_STATUS 0x1
+#define CAM_CDM_FIFO_2_BLDONE_STATUS 0x2
+#define CAM_CDM_FIFO_3_BLDONE_STATUS 0x3
+#define CAM_CDM_RESET_HW_STATUS 0x4
+#define CAM_CDM_ERROR_HW_STATUS 0x5
+#define CAM_CDM_FLUSH_HW_STATUS 0x6
+#define CAM_CDM_RESET_ERR_STATUS 0x7
+#define CAM_CDM_PF_HW_STATUS 0x8
+
+/* Curent used AHB masks and shifts */
+#define CAM_CDM_AHB_LOG_CID_SHIFT    28
+#define CAM_CDM_AHB_LOG_CID_MASK     0X30000000
+#define CAM_CDM_AHB_ADDR_MASK        0x00FFFFFF
+
+/* Invalid command status register's masks and shifts */
+#define CAM_CDM_ICL_STATUS_LAST_CID_SHIFT    4
+#define CAM_CDM_ICL_STATUS_LAST_CID_MASK     0X30
+#define CAM_CDM_ICL_STATUS_INV_CID_MASK      0x03
+
+/* Core_cfg register's masks and shifts */
+#define CAM_CDM_CORE_CFG_PRIORITY_MASK             0XF00000
+#define CAM_CDM_CORE_CFG_PRIORITY_SHIFT            20
+#define CAM_CDM_CORE_CFG_IMPLICIT_WAIT_EN_MASK     0x20000
+#define CAM_CDM_CORE_CFG_ARB_SEL_RR_MASK           0x10000
+#define CAM_CDM_CORE_CFG_AHB_STOP_ON_ERR_MASK      0x100
+#define CAM_CDM_CORE_CFG_AHB_BURST_EN_MASK         0x10
+#define CAM_CDM_CORE_CFG_AHB_BURST_LEN_MASK        0x0F
+
+/* Core enable register masks and shifts */
+#define CAM_CDM_CORE_EN_MASK     0x1
+#define CAM_CDM_CORE_PAUSE_MASK  0X2
+
+/* Core Debug register masks and shifts */
+#define CAM_CDM_CORE_DBG_TEST_BUS_EN_MASK          0X01
+#define CAM_CDM_CORE_DBG_TEST_BUS_SEL_MASK         0XF0
+#define CAM_CDM_CORE_DBG_TEST_BUS_SEL_SHIFT        4
+#define CAM_CDM_CORE_DBG_LOG_AHB_MASK              0X100
+#define CAM_CDM_CORE_DBG_LOG_SHIFT                 8
+#define CAM_CDM_CORE_DBG_FIFO_RB_EN_MASK           0x10000
+#define CAM_CDM_CORE_DBG_FIFO_RB_EN_SHIFT          16
+
+
+/* Curent BL command masks and shifts */
+#define CAM_CDM_CURRENT_BL_LEN   0xFFFFF
+#define CAM_CDM_CURRENT_BL_ARB   0x100000
+#define CAM_CDM_CURRENT_BL_FIFO  0xC00000
+#define CAM_CDM_CURRENT_BL_TAG   0xFF000000
+
+#define CAM_CDM_CURRENT_BL_ARB_SHIFT   0x14
+#define CAM_CDM_CURRENT_BL_FIFO_SHIFT  0x16
+#define CAM_CDM_CURRENT_BL_TAG_SHIFT   0x18
+
+/* IRQ bit-masks */
+#define CAM_CDM_IRQ_STATUS_RST_DONE_MASK 0x1
+#define CAM_CDM_IRQ_STATUS_INLINE_IRQ_MASK 0x2
+#define CAM_CDM_IRQ_STATUS_BL_DONE_MASK 0x4
+#define CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK 0x10000
+#define CAM_CDM_IRQ_STATUS_ERROR_OVER_FLOW_MASK 0x20000
+#define CAM_CDM_IRQ_STATUS_ERROR_AHB_BUS_MASK 0x40000
+#define CAM_CDM_IRQ_STATUS_USR_DATA_MASK 0xFF
+
+#define CAM_CDM_IRQ_STATUS_ERRORS \
+	(CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK | \
+	 CAM_CDM_IRQ_STATUS_ERROR_OVER_FLOW_MASK | \
+	 CAM_CDM_IRQ_STATUS_ERROR_AHB_BUS_MASK)
+
+/* Structure to store hw version info */
+struct cam_version_reg {
+	uint32_t hw_version;
+};
+
+/**
+ * struct cam_cdm_irq_regs - CDM IRQ registers
+ *
+ * @irq_mask:        register offset for irq_mask
+ * @irq_clear:       register offset for irq_clear
+ * @irq_clear_cmd:   register offset to initiate irq clear
+ * @irq_set:         register offset to set irq
+ * @irq_set_cmd:     register offset to issue set_irq from irq_set
+ * @irq_status:      register offset to look which irq is received
+ */
+struct cam_cdm_irq_regs {
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_clear_cmd;
+	uint32_t irq_set;
+	uint32_t irq_set_cmd;
+	uint32_t irq_status;
+};
+
+/**
+ * struct cam_cdm_bl_fifo_regs - BL_FIFO registers
+ *
+ * @bl_fifo_base:    register offset to write bl_cmd base address
+ * @bl_fifo_len:     register offset to write bl_cmd length
+ * @bl_fifo_store:   register offset to commit the BL cmd
+ * @bl_fifo_cfg:     register offset to config BL_FIFO depth, etc.
+ */
+struct cam_cdm_bl_fifo_regs {
+	uint32_t bl_fifo_base;
+	uint32_t bl_fifo_len;
+	uint32_t bl_fifo_store;
+	uint32_t bl_fifo_cfg;
+};
+
+/**
+ * struct cam_cdm_bl_pending_req_reg_params - BL_FIFO pending registers
+ *
+ * @rb_offset:          register offset pending bl request in BL_FIFO
+ * @rb_mask:            mask to get number of pending BLs in BL_FIFO
+ * @rb_num_fifo:        number of BL_FIFO's information in the register
+ * @rb_next_fifo_shift: shift to get next fifo's pending BLs.
+ */
+struct cam_cdm_bl_pending_req_reg_params {
+	uint32_t rb_offset;
+	uint32_t rb_mask;
+	uint32_t rb_num_fifo;
+	uint32_t rb_next_fifo_shift;
+};
+
+/**
+ * struct cam_cdm_scratch_reg - scratch register
+ *
+ * @scratch_reg:        offset of scratch register
+ */
+struct cam_cdm_scratch_reg {
+	uint32_t scratch_reg;
+};
+
+/* struct cam_cdm_perf_mon_regs - perf_mon registers */
+struct cam_cdm_perf_mon_regs {
+	uint32_t perf_mon_ctrl;
+	uint32_t perf_mon_0;
+	uint32_t perf_mon_1;
+	uint32_t perf_mon_2;
+};
+
+/**
+ * struct cam_cdm_perf_mon_regs - perf mon counter's registers
+ *
+ * @count_cfg_0:         register offset to configure perf measures
+ * @always_count_val:    register offset for always count value
+ * @busy_count_val:      register offset to get busy count
+ * @stall_axi_count_val: register offset to get axi stall counts
+ * @count_status:        register offset to know if count status finished
+ *                       for stall, busy and always.
+ */
+struct cam_cdm_perf_regs {
+	uint32_t count_cfg_0;
+	uint32_t always_count_val;
+	uint32_t busy_count_val;
+	uint32_t stall_axi_count_val;
+	uint32_t count_status;
+};
+
+/**
+ * struct cam_cdm_icl_data_regs - CDM icl data registers
+ *
+ * @icl_last_data_0:     register offset to log last known good command
+ * @icl_last_data_1:     register offset to log last known good command 1
+ * @icl_last_data_2:     register offset to log last known good command 2
+ * @icl_inv_data:        register offset to log CDM cmd that triggered
+ *                       invalid command.
+ */
+struct cam_cdm_icl_data_regs {
+	uint32_t icl_last_data_0;
+	uint32_t icl_last_data_1;
+	uint32_t icl_last_data_2;
+	uint32_t icl_inv_data;
+};
+
+/**
+ * struct cam_cdm_icl_misc_regs - CDM icl misc registers
+ *
+ * @icl_inv_bl_addr:     register offset to give address of bl_cmd that
+ *                       gave invalid command
+ * @icl_status:          register offset for context that gave good BL
+ *                       command and invalid command.
+ */
+struct cam_cdm_icl_misc_regs {
+	uint32_t icl_inv_bl_addr;
+	uint32_t icl_status;
+};
+
+/**
+ * struct cam_cdm_icl_regs - CDM icl registers
+ *
+ * @data_regs:           structure with registers of all cdm good and invalid
+ *                       BL command information.
+ * @misc_regs:           structure with registers for invalid command address
+ *                       and context
+ */
+struct cam_cdm_icl_regs {
+	struct cam_cdm_icl_data_regs *data_regs;
+	struct cam_cdm_icl_misc_regs *misc_regs;
+};
+
+/**
+ * struct cam_cdm_comp_wait_status - BL_FIFO comp_event status register
+ *
+ * @comp_wait_status:    register offset to give information on whether the
+ *                       CDM is waiting for an event from another module
+ */
+struct cam_cdm_comp_wait_status {
+	uint32_t comp_wait_status;
+};
+
+/**
+ * struct cam_cdm_common_reg_data - structure for register data
+ *
+ * @num_bl_fifo:            number of FIFO are there in CDM
+ * @num_bl_fifo_irq:        number of FIFO irqs in CDM
+ * @num_bl_pending_req_reg: number of pending_requests register in CDM
+ * @num_scratch_reg:        number of scratch registers in CDM
+ */
+struct cam_cdm_common_reg_data {
+	uint32_t num_bl_fifo;
+	uint32_t num_bl_fifo_irq;
+	uint32_t num_bl_pending_req_reg;
+	uint32_t num_scratch_reg;
+};
+
+/**
+ * struct cam_cdm_common_regs - common structure to get common registers
+ *                       of CDM
+ *
+ * @cdm_hw_version:      offset to read cdm_hw_version
+ * @cam_version:         offset to read the camera Titan architecture version
+ * @rst_cmd:             offset to reset the CDM
+ * @cgc_cfg:             offset to configure CDM CGC logic
+ * @core_cfg:            offset to configure CDM core with ARB_SEL, implicit
+ *                       wait, etc.
+ * @core_en:             offset to pause/enable CDM
+ * @fe_cfg:              offset to configure CDM fetch engine
+ * @cdm_status:          offset to read CDM status register, this register
+ *                       indicates if CDM is idle, and if a pause operation
+ *                       is successfully completed or not
+ * @irq_context_status   offset to read back irq context status
+ * @bl_fifo_rb:          offset to set BL_FIFO read back
+ * @bl_fifo_base_rb:     offset to read back base address on offset set by
+ *                       bl_fifo_rb
+ * @bl_fifo_len_rb:      offset to read back base len and tag on offset set by
+ *                       bl_fifo_rb
+ * @usr_data:            offset to read user data from GEN_IRQ commands
+ * @wait_status:         offset to read status for last WAIT command
+ * @last_ahb_addr:       offset to read back last AHB address generated by CDM
+ * @last_ahb_data:       offset to read back last AHB data generated by CDM
+ * @core_debug:          offset to configure CDM debug bus and debug features
+ * @last_ahb_err_addr:   offset to read back last AHB Error address generated
+ *                       by CDM
+ * @last_ahb_err_data:   offset to read back last AHB Error data generated
+ *                       by CDM
+ * @current_bl_base:     offset to read back current command buffer BASE address
+ *                       value out of BL_FIFO
+ * @current_bl_len:      offset to read back current command buffer len, TAG,
+ *                       context ID ARB value out of BL_FIFO
+ * @current_used_ahb_base: offset to read back current base address used by
+ *                       CDM to access camera register
+ * @debug_status:        offset to read back current CDM status
+ * @bus_misr_cfg0:       offset to enable bus MISR and configure sampling mode
+ * @bus_misr_cfg1:       offset to select from one of the six MISR's for reading
+ *                       signature value
+ * @bus_misr_rd_val:     offset to read MISR signature
+ * @pending_req:         registers to read pending request in FIFO
+ * @comp_wait:           registers to read comp_event CDM is waiting for
+ * @perf_mon:            registers to read perf_mon information
+ * @scratch:             registers to read scratch register value
+ * @perf_reg:            registers to read performance counters value
+ * @icl_reg:             registers to read information related to good
+ *                       and invalid commands in FIFO
+ * @spare:               spare register
+ * @priority_group_bit_offset offset of priority group bits
+ *
+ */
+struct cam_cdm_common_regs {
+	uint32_t cdm_hw_version;
+	const struct cam_version_reg *cam_version;
+	uint32_t rst_cmd;
+	uint32_t cgc_cfg;
+	uint32_t core_cfg;
+	uint32_t core_en;
+	uint32_t fe_cfg;
+	uint32_t cdm_status;
+	uint32_t irq_context_status;
+	uint32_t bl_fifo_rb;
+	uint32_t bl_fifo_base_rb;
+	uint32_t bl_fifo_len_rb;
+	uint32_t usr_data;
+	uint32_t wait_status;
+	uint32_t last_ahb_addr;
+	uint32_t last_ahb_data;
+	uint32_t core_debug;
+	uint32_t last_ahb_err_addr;
+	uint32_t last_ahb_err_data;
+	uint32_t current_bl_base;
+	uint32_t current_bl_len;
+	uint32_t current_used_ahb_base;
+	uint32_t debug_status;
+	uint32_t bus_misr_cfg0;
+	uint32_t bus_misr_cfg1;
+	uint32_t bus_misr_rd_val;
+	const struct cam_cdm_bl_pending_req_reg_params
+		*pending_req[CAM_CDM_BL_FIFO_PENDING_REQ_REG_NUM];
+	const struct cam_cdm_comp_wait_status
+		*comp_wait[CAM_CDM_COMP_WAIT_STATUS_REG_NUM];
+	const struct cam_cdm_perf_mon_regs
+		*perf_mon[CAM_CDM_PERF_MON_REG_NUM];
+	const struct cam_cdm_scratch_reg
+		*scratch[CAM_CDM_SCRATCH_REG_NUM];
+	const struct cam_cdm_perf_regs *perf_reg;
+	const struct cam_cdm_icl_regs *icl_reg;
+	uint32_t spare;
+	uint32_t priority_group_bit_offset;
+};
+
+/**
+ * struct cam_cdm_hw_reg_offset - BL_FIFO comp_event status register
+ *
+ * @cmn_reg:             pointer to structure to get common registers of a CDM
+ * @bl_fifo_reg:         pointer to structure to get BL_FIFO registers of a CDM
+ * @irq_reg:             pointer to structure to get IRQ registers of a CDM
+ * @reg_data:            pointer to structure to reg_data related to CDM
+ *                       registers
+ */
+struct cam_cdm_hw_reg_offset {
+	const struct cam_cdm_common_regs *cmn_reg;
+	const struct cam_cdm_bl_fifo_regs *bl_fifo_reg[CAM_CDM_BL_FIFO_REG_NUM];
+	const struct cam_cdm_irq_regs *irq_reg[CAM_CDM_BL_FIFO_IRQ_REG_NUM];
+	const struct cam_cdm_common_reg_data *reg_data;
+};
+
+/* enum cam_cdm_hw_process_intf_cmd - interface commands.*/
+enum cam_cdm_hw_process_intf_cmd {
+	CAM_CDM_HW_INTF_CMD_ACQUIRE,
+	CAM_CDM_HW_INTF_CMD_RELEASE,
+	CAM_CDM_HW_INTF_CMD_SUBMIT_BL,
+	CAM_CDM_HW_INTF_CMD_RESET_HW,
+	CAM_CDM_HW_INTF_CMD_FLUSH_HW,
+	CAM_CDM_HW_INTF_CMD_HANDLE_ERROR,
+	CAM_CDM_HW_INTF_CMD_HANG_DETECT,
+	CAM_CDM_HW_INTF_DUMP_DBG_REGS,
+	CAM_CDM_HW_INTF_CMD_INVALID,
+};
+
+/* enum cam_cdm_flags - Bit fields for CDM flags used */
+enum cam_cdm_flags {
+	CAM_CDM_FLAG_SHARED_CDM,
+	CAM_CDM_FLAG_PRIVATE_CDM,
+};
+
+/* enum cam_cdm_type - Enum for possible CAM CDM types */
+enum cam_cdm_type {
+	CAM_VIRTUAL_CDM,
+	CAM_HW_CDM,
+};
+
+/* enum cam_cdm_mem_base_index - Enum for possible CAM CDM types */
+enum cam_cdm_mem_base_index {
+	CAM_HW_CDM_BASE_INDEX,
+	CAM_HW_CDM_MAX_INDEX = CAM_SOC_MAX_BLOCK,
+};
+
+/* enum cam_cdm_bl_cb_type - Enum for possible CAM CDM cb request types */
+enum cam_cdm_bl_cb_type {
+	CAM_HW_CDM_BL_CB_CLIENT = 1,
+	CAM_HW_CDM_BL_CB_INTERNAL,
+};
+
+/* enum cam_cdm_arbitration - Enum type of arbitration */
+enum cam_cdm_arbitration {
+	CAM_CDM_ARBITRATION_NONE,
+	CAM_CDM_ARBITRATION_ROUND_ROBIN,
+	CAM_CDM_ARBITRATION_PRIORITY_BASED,
+	CAM_CDM_ARBITRATION_MAX,
+};
+
+enum cam_cdm_hw_version {
+	CAM_CDM_VERSION = 0,
+	CAM_CDM_VERSION_1_0 = 0x10000000,
+	CAM_CDM_VERSION_1_1 = 0x10010000,
+	CAM_CDM_VERSION_1_2 = 0x10020000,
+	CAM_CDM_VERSION_2_0 = 0x20000000,
+	CAM_CDM_VERSION_2_1 = 0x20010000,
+	CAM_CDM_VERSION_2_2 = 0x20020000,
+	CAM_CDM_VERSION_MAX,
+};
+
+/* struct cam_cdm_client - struct for cdm clients data.*/
+struct cam_cdm_client {
+	struct cam_cdm_acquire_data data;
+	void __iomem  *changebase_addr;
+	uint32_t stream_on;
+	uint32_t refcount;
+	struct mutex lock;
+	uint32_t handle;
+};
+
+/* struct cam_cdm_work_payload - struct for cdm work payload data.*/
+struct cam_cdm_work_payload {
+	struct cam_hw_info *hw;
+	uint32_t irq_status;
+	uint32_t irq_data;
+	int fifo_idx;
+	ktime_t workq_scheduled_ts;
+	struct work_struct work;
+};
+
+/* struct cam_cdm_bl_cb_request_entry - callback entry for work to process.*/
+struct cam_cdm_bl_cb_request_entry {
+	uint8_t bl_tag;
+	enum cam_cdm_bl_cb_type request_type;
+	uint32_t client_hdl;
+	void *userdata;
+	uint32_t cookie;
+	struct list_head entry;
+};
+
+/* struct cam_cdm_hw_intf_cmd_submit_bl - cdm interface submit command.*/
+struct cam_cdm_hw_intf_cmd_submit_bl {
+	uint32_t handle;
+	struct cam_cdm_bl_request *data;
+};
+
+/* struct cam_cdm_bl_fifo - CDM hw memory struct */
+struct cam_cdm_bl_fifo {
+	struct completion bl_complete;
+	struct workqueue_struct *work_queue;
+	struct list_head bl_request_list;
+	struct mutex fifo_lock;
+	uint8_t bl_tag;
+	uint32_t bl_depth;
+	uint8_t last_bl_tag_done;
+	atomic_t work_record;
+};
+
+/**
+ * struct cam_cdm - CDM hw device struct
+ *
+ * @index:               index of CDM hardware
+ * @name:                cdm_name
+ * @id:                  enum for possible CDM hardwares
+ * @flags:               enum to tell if CDM is private of shared
+ * @reset_complete:      completion event to make CDM wait for reset
+ * @work_queue:          workqueue to schedule work for virtual CDM
+ * @bl_request_list:     bl_request list for submitted commands in
+ *                       virtual CDM
+ * @version:             CDM version with major, minor, incr and reserved
+ * @hw_version:          CDM version as read from the cdm_version register
+ * @hw_family_version:   version of hw family the CDM belongs to
+ * @iommu_hdl:           CDM iommu handle
+ * @offsets:             pointer to structure of CDM registers
+ * @ops:                 CDM ops for generating cdm commands
+ * @clients:             CDM clients array currently active on CDM
+ * @bl_fifo:             structure with per fifo related attributes
+ * @cdm_status:          bitfield with bits assigned for different cdm status
+ * @bl_tag:              slot value at which the next bl cmd will be written
+ *                       in case of virtual CDM
+ * @gen_irq:             memory region in which gen_irq command will be written
+ * @cpas_handle:         handle for cpas driver
+ * @arbitration:         type of arbitration to be used for the CDM
+ * @num_active_clients:  Number of currently active clients
+ */
+struct cam_cdm {
+	uint32_t index;
+	char name[128];
+	enum cam_cdm_id id;
+	enum cam_cdm_flags flags;
+	struct completion reset_complete;
+	struct workqueue_struct *work_queue;
+	struct list_head bl_request_list;
+	struct cam_hw_version version;
+	uint32_t hw_version;
+	uint32_t hw_family_version;
+	struct cam_iommu_handle iommu_hdl;
+	struct cam_cdm_hw_reg_offset *offsets;
+	struct cam_cdm_utils_ops *ops;
+	struct cam_cdm_client *clients[CAM_PER_CDM_MAX_REGISTERED_CLIENTS];
+	struct cam_cdm_bl_fifo bl_fifo[CAM_CDM_BL_FIFO_MAX];
+	unsigned long cdm_status;
+	uint8_t bl_tag;
+	uint32_t cpas_handle;
+	enum cam_cdm_arbitration arbitration;
+	uint8_t num_active_clients;
+};
+
+/* struct cam_cdm_private_dt_data - CDM hw custom dt data */
+struct cam_cdm_private_dt_data {
+	bool dt_cdm_shared;
+	bool config_fifo;
+	bool is_single_ctx_cdm;
+	uint8_t priority_group;
+	uint32_t fifo_depth[CAM_CDM_BL_FIFO_MAX];
+	uint32_t dt_num_supported_clients;
+	uint32_t pid;
+	uint32_t mid;
+	const char *dt_cdm_client_name[CAM_PER_CDM_MAX_REGISTERED_CLIENTS];
+};
+
+/* struct cam_cdm_intf_devices - CDM mgr interface devices */
+struct cam_cdm_intf_devices {
+	struct mutex lock;
+	uint32_t refcount;
+	struct cam_hw_intf *device;
+	struct cam_cdm_private_dt_data *data;
+};
+
+/* struct cam_cdm_intf_mgr - CDM mgr interface device struct */
+struct cam_cdm_intf_mgr {
+	bool probe_done;
+	uint32_t cdm_count;
+	uint32_t dt_supported_hw_cdm;
+	int32_t refcount;
+	struct cam_cdm_intf_devices nodes[CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM];
+	struct dentry *dentry;
+};
+
+int cam_cdm_intf_register_hw_cdm(struct cam_hw_intf *hw,
+	struct cam_cdm_private_dt_data *data, enum cam_cdm_type type,
+	uint32_t *index);
+int cam_cdm_intf_deregister_hw_cdm(struct cam_hw_intf *hw,
+	struct cam_cdm_private_dt_data *data, enum cam_cdm_type type,
+	uint32_t index);
+
+#endif /* _CAM_CDM_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_core_common.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_core_common.c
@@ -0,0 +1,955 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include "cam_soc_util.h"
+#include "cam_smmu_api.h"
+#include "cam_io_util.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm.h"
+#include "cam_cdm_soc.h"
+#include "cam_cdm_core_common.h"
+
+int cam_cdm_util_cpas_start(struct cam_hw_info *cdm_hw)
+{
+	struct cam_cdm *core = NULL;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	int rc = 0;
+
+	if (!cdm_hw) {
+		CAM_ERR(CAM_CDM, "Invalid cdm hw");
+		return -EINVAL;
+	}
+
+	core = (struct cam_cdm *)cdm_hw->core_info;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CDM[%d] CPAS start failed rc=%d", core->index, rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static void cam_cdm_get_client_refcount(struct cam_cdm_client *client)
+{
+	mutex_lock(&client->lock);
+	CAM_DBG(CAM_CDM, "CDM client get refcount=%d",
+		client->refcount);
+	client->refcount++;
+	mutex_unlock(&client->lock);
+}
+
+static void cam_cdm_put_client_refcount(struct cam_cdm_client *client)
+{
+	mutex_lock(&client->lock);
+	CAM_DBG(CAM_CDM, "CDM client put refcount=%d",
+		client->refcount);
+	if (client->refcount > 0) {
+		client->refcount--;
+	} else {
+		CAM_ERR(CAM_CDM, "Refcount put when zero");
+		WARN_ON(1);
+	}
+	mutex_unlock(&client->lock);
+}
+
+bool cam_cdm_set_cam_hw_version(
+	uint32_t ver, struct cam_hw_version *cam_version)
+{
+	switch (ver) {
+	case CAM_CDM100_VERSION:
+	case CAM_CDM110_VERSION:
+	case CAM_CDM120_VERSION:
+	case CAM_CDM200_VERSION:
+	case CAM_CDM210_VERSION:
+	case CAM_CDM211_VERSION:
+	case CAM_CDM220_VERSION:
+		cam_version->major    = (ver & 0xF0000000);
+		cam_version->minor    = (ver & 0xFFF0000);
+		cam_version->incr     = (ver & 0xFFFF);
+		cam_version->reserved = 0;
+		return true;
+	default:
+		CAM_ERR(CAM_CDM, "CDM Version=%x not supported in util", ver);
+	break;
+	}
+	return false;
+}
+
+bool cam_cdm_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	if (!irq_data)
+		return false;
+
+	CAM_DBG(CAM_CDM, "CPAS error callback type=%d", irq_data->irq_type);
+
+	return false;
+}
+
+struct cam_cdm_utils_ops *cam_cdm_get_ops(
+	uint32_t ver, struct cam_hw_version *cam_version, bool by_cam_version)
+{
+	if (by_cam_version == false) {
+		switch (ver) {
+		case CAM_CDM100_VERSION:
+		case CAM_CDM110_VERSION:
+		case CAM_CDM120_VERSION:
+		case CAM_CDM200_VERSION:
+		case CAM_CDM210_VERSION:
+		case CAM_CDM211_VERSION:
+		case CAM_CDM220_VERSION:
+			return &CDM170_ops;
+		default:
+			CAM_ERR(CAM_CDM, "CDM Version=%x not supported in util",
+				ver);
+		}
+	} else if (cam_version) {
+		if (((cam_version->major == 1) &&
+			(cam_version->minor == 0) &&
+			(cam_version->incr == 0)) ||
+			((cam_version->major == 1) &&
+			(cam_version->minor == 1) &&
+			(cam_version->incr == 0)) ||
+			((cam_version->major == 1) &&
+			(cam_version->minor == 2) &&
+			(cam_version->incr == 0))) {
+
+			CAM_DBG(CAM_CDM,
+				"cam_hw_version=%x:%x:%x supported",
+				cam_version->major, cam_version->minor,
+				cam_version->incr);
+			return &CDM170_ops;
+		}
+
+		CAM_ERR(CAM_CDM, "cam_hw_version=%x:%x:%x not supported",
+			cam_version->major, cam_version->minor,
+			cam_version->incr);
+	}
+
+	return NULL;
+}
+
+struct cam_cdm_bl_cb_request_entry *cam_cdm_find_request_by_bl_tag(
+	uint32_t tag, struct list_head *bl_list)
+{
+	struct cam_cdm_bl_cb_request_entry *node;
+
+	list_for_each_entry(node, bl_list, entry) {
+		if (node->bl_tag == tag)
+			return node;
+	}
+	CAM_ERR(CAM_CDM, "Could not find the bl request for tag=%x", tag);
+
+	return NULL;
+}
+
+int cam_cdm_get_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_cdm *cdm_core;
+
+	if ((cdm_hw) && (cdm_hw->core_info) && (get_hw_cap_args) &&
+		(sizeof(struct cam_iommu_handle) == arg_size)) {
+		cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+		*((struct cam_iommu_handle *)get_hw_cap_args) =
+			cdm_core->iommu_hdl;
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+int cam_cdm_find_free_client_slot(struct cam_cdm *hw)
+{
+	int i;
+
+	for (i = 0; i < CAM_PER_CDM_MAX_REGISTERED_CLIENTS; i++) {
+		if (hw->clients[i] == NULL) {
+			CAM_DBG(CAM_CDM, "Found client slot %d", i);
+			return i;
+		}
+	}
+	CAM_ERR(CAM_CDM, "No more client slots");
+
+	return -EBUSY;
+}
+
+static int cam_cdm_get_last_client_idx(struct cam_cdm *core)
+{
+	int i, last_client = 0;
+
+	for (i = 0; i < CAM_PER_CDM_MAX_REGISTERED_CLIENTS; i++) {
+		if (core->clients[i])
+			last_client = i;
+	}
+
+	return last_client;
+}
+
+void cam_cdm_notify_clients(struct cam_hw_info *cdm_hw,
+	enum cam_cdm_cb_status status, void *data)
+{
+	int i;
+	struct cam_cdm *core = NULL;
+	struct cam_cdm_client *client = NULL;
+	struct cam_cdm_bl_cb_request_entry *node = NULL;
+	struct cam_hw_dump_pf_args pf_args = {0};
+	int client_idx, last_client;
+
+	if (!cdm_hw) {
+		CAM_ERR(CAM_CDM, "CDM Notify called with NULL hw info");
+		return;
+	}
+	core = (struct cam_cdm *)cdm_hw->core_info;
+
+	switch (status) {
+	case CAM_CDM_CB_STATUS_BL_SUCCESS:
+		node = (struct cam_cdm_bl_cb_request_entry *)data;
+
+		client_idx = CAM_CDM_GET_CLIENT_IDX(node->client_hdl);
+		client = core->clients[client_idx];
+		if ((!client) || (client->handle != node->client_hdl)) {
+			CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client,
+				node->client_hdl);
+			return;
+		}
+		cam_cdm_get_client_refcount(client);
+		mutex_lock(&client->lock);
+		if (client->data.cam_cdm_callback) {
+			CAM_DBG(CAM_CDM, "Calling client=%s cb cookie=%d",
+				client->data.identifier, node->cookie);
+			client->data.cam_cdm_callback(node->client_hdl,
+				node->userdata, CAM_CDM_CB_STATUS_BL_SUCCESS,
+				(void *)(&node->cookie));
+			CAM_DBG(CAM_CDM, "Exit client cb cookie=%d",
+				node->cookie);
+		} else {
+			CAM_ERR(CAM_CDM, "No cb registered for client hdl=%x",
+				node->client_hdl);
+		}
+		mutex_unlock(&client->lock);
+		cam_cdm_put_client_refcount(client);
+		break;
+	case CAM_CDM_CB_STATUS_HW_RESET_DONE:
+	case CAM_CDM_CB_STATUS_HW_FLUSH:
+	case CAM_CDM_CB_STATUS_HW_RESUBMIT:
+	case CAM_CDM_CB_STATUS_INVALID_BL_CMD:
+	case CAM_CDM_CB_STATUS_HW_ERROR:
+		node = (struct cam_cdm_bl_cb_request_entry *)data;
+
+		client_idx = CAM_CDM_GET_CLIENT_IDX(node->client_hdl);
+		client = core->clients[client_idx];
+		if ((!client) || (client->handle != node->client_hdl)) {
+			CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client,
+				node->client_hdl);
+			return;
+		}
+		cam_cdm_get_client_refcount(client);
+		mutex_lock(&client->lock);
+		if (client->data.cam_cdm_callback) {
+			client->data.cam_cdm_callback(
+				client->handle,
+				client->data.userdata,
+				status,
+				(void *)(&node->cookie));
+		} else {
+			CAM_ERR(CAM_CDM,
+				"No cb registered for client: name %s, hdl=%x",
+				client->data.identifier, client->handle);
+		}
+		mutex_unlock(&client->lock);
+		cam_cdm_put_client_refcount(client);
+		break;
+	case CAM_CDM_CB_STATUS_PAGEFAULT:
+		last_client = cam_cdm_get_last_client_idx(core);
+		pf_args.pf_smmu_info = (struct cam_smmu_pf_info *)data;
+		pf_args.handle_sec_pf = true;
+		for (i = 0; i < CAM_PER_CDM_MAX_REGISTERED_CLIENTS; i++) {
+			client = core->clients[i];
+			if (!client)
+				continue;
+			cam_cdm_get_client_refcount(client);
+			if (client->data.cam_cdm_callback) {
+				if (i == last_client)
+					/*
+					 * If the fault causing client is not found,
+					 * make the last client of this CDM sends PF
+					 * notification to userspace. This avoids multiple
+					 * PF notifications and ensures at least one
+					 * notification is sent.
+					 */
+					pf_args.pf_context_info.force_send_pf_evt = true;
+				mutex_lock(&client->lock);
+				CAM_DBG(CAM_CDM, "Found client slot %d name %s",
+					i, client->data.identifier);
+				client->data.cam_cdm_callback(
+					client->handle,
+					client->data.userdata,
+					status,
+					&pf_args);
+				if (pf_args.pf_context_info.ctx_found ||
+					pf_args.pf_context_info.force_send_pf_evt) {
+					if (pf_args.pf_context_info.ctx_found)
+						CAM_ERR(CAM_CDM,
+							"Page Fault found on client: [%s][%u]",
+							client->data.identifier,
+							client->data.cell_index);
+					mutex_unlock(&client->lock);
+					cam_cdm_put_client_refcount(client);
+					break;
+				}
+				mutex_unlock(&client->lock);
+			} else {
+				CAM_ERR(CAM_CDM, "No cb registered for client hdl=%x",
+					client->handle);
+			}
+			cam_cdm_put_client_refcount(client);
+		}
+
+		break;
+	default:
+		CAM_ERR(CAM_CDM, "Invalid cdm cb status: %u", status);
+	}
+}
+
+static int cam_cdm_stream_handle_init(void *hw_priv, bool init)
+{
+	int rc = -EPERM;
+
+	if (init) {
+		rc = cam_hw_cdm_init(hw_priv, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_CDM, "CDM HW init failed");
+			return rc;
+		}
+	} else {
+		rc = cam_hw_cdm_deinit(hw_priv, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_CDM, "Deinit failed in streamoff");
+	}
+
+	return rc;
+}
+
+int cam_cdm_stream_ops_internal(void *hw_priv,
+	void *start_args, bool operation)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_cdm *core = NULL;
+	int rc = -EPERM;
+	int client_idx;
+	struct cam_cdm_client *client;
+	uint32_t *handle = start_args;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	core = (struct cam_cdm *)cdm_hw->core_info;
+
+	/*
+	 * If this CDM HW encounters Page Fault, block any futher
+	 * stream on/off until this CDM get released and acquired
+	 * again. CDM page fault handler will stream off the device.
+	 */
+	if (test_bit(CAM_CDM_PF_HW_STATUS, &core->cdm_status)) {
+		CAM_WARN(CAM_CDM,
+			"Attempt to stream %s failed. %s%u has encountered a page fault",
+			operation ? "on" : "off",
+			core->name, core->id);
+		return -EAGAIN;
+	}
+
+	mutex_lock(&cdm_hw->hw_mutex);
+	client_idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+	client = core->clients[client_idx];
+	if (!client) {
+		CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client, *handle);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		return -EINVAL;
+	}
+	cam_cdm_get_client_refcount(client);
+	if (*handle != client->handle) {
+		CAM_ERR(CAM_CDM, "client id given handle=%x invalid", *handle);
+		rc = -EINVAL;
+		goto end;
+	}
+	if (operation == true) {
+		if (true == client->stream_on) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM client is already streamed ON");
+			goto end;
+		}
+	} else {
+		if (client->stream_on == false) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM client is already streamed Off");
+			goto end;
+		}
+	}
+
+	if (operation == true) {
+		if (!cdm_hw->open_count) {
+			rc = cam_cdm_util_cpas_start(cdm_hw);
+			if (rc != 0) {
+				CAM_ERR(CAM_CDM, "CPAS start failed");
+				goto end;
+			}
+			CAM_DBG(CAM_CDM, "CDM init first time");
+			if (core->id == CAM_CDM_VIRTUAL) {
+				CAM_DBG(CAM_CDM,
+					"Virtual CDM HW init first time");
+				rc = 0;
+			} else {
+				CAM_DBG(CAM_CDM, "CDM HW init first time");
+				rc = cam_cdm_stream_handle_init(hw_priv, true);
+			}
+			if (rc == 0) {
+				cdm_hw->open_count++;
+				client->stream_on = true;
+			} else {
+				if (cam_cpas_stop(core->cpas_handle))
+					CAM_ERR(CAM_CDM, "CPAS stop failed");
+			}
+		} else {
+			cdm_hw->open_count++;
+			CAM_DBG(CAM_CDM, "CDM HW already ON count=%d",
+				cdm_hw->open_count);
+			rc = 0;
+			client->stream_on = true;
+		}
+	} else {
+		if (cdm_hw->open_count) {
+			cdm_hw->open_count--;
+			CAM_DBG(CAM_CDM, "stream OFF CDM %d",
+				cdm_hw->open_count);
+			if (!cdm_hw->open_count) {
+				CAM_DBG(CAM_CDM, "CDM Deinit now");
+				if (core->id == CAM_CDM_VIRTUAL) {
+					CAM_DBG(CAM_CDM,
+						"Virtual CDM HW Deinit");
+					rc = 0;
+				} else {
+					CAM_DBG(CAM_CDM, "CDM HW Deinit now");
+					rc = cam_cdm_stream_handle_init(hw_priv,
+						false);
+				}
+				if (rc == 0) {
+					client->stream_on = false;
+					rc = cam_cpas_stop(core->cpas_handle);
+					if (rc)
+						CAM_ERR(CAM_CDM,
+							"CPAS stop failed");
+				}
+			} else {
+				client->stream_on = false;
+				rc = 0;
+				CAM_DBG(CAM_CDM,
+					"Client stream off success =%d",
+					cdm_hw->open_count);
+			}
+		} else {
+			CAM_DBG(CAM_CDM, "stream OFF CDM Invalid %d",
+				cdm_hw->open_count);
+			rc = -ENXIO;
+		}
+	}
+end:
+	cam_cdm_put_client_refcount(client);
+	mutex_unlock(&cdm_hw->hw_mutex);
+	return rc;
+}
+
+int cam_cdm_pf_stream_off_all_clients(struct cam_hw_info *cdm_hw)
+{
+	struct cam_cdm *core;
+	struct cam_cdm_client *client;
+	int i, rc;
+
+	if (!cdm_hw)
+		return -EINVAL;
+
+	core = cdm_hw->core_info;
+
+	if (!cdm_hw->open_count) {
+		CAM_DBG(CAM_CDM, "%s%u already streamed off. Open count %d",
+			core->name, core->id, cdm_hw->open_count);
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_CDM, "streaming off %s%u internally",
+		core->name, core->id);
+
+	rc = cam_hw_cdm_pf_deinit(cdm_hw, NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_CDM, "Deinit failed in stream off rc: %d", rc);
+
+	for (i = 0; i < CAM_PER_CDM_MAX_REGISTERED_CLIENTS; i++) {
+		client = core->clients[i];
+		if (!client)
+			continue;
+
+		mutex_lock(&client->lock);
+		client->stream_on = false;
+		mutex_unlock(&client->lock);
+	}
+
+	rc = cam_cpas_stop(core->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_CDM, "CPAS stop failed in stream off rc %d", rc);
+
+	cdm_hw->open_count = 0;
+
+	return rc;
+}
+
+int cam_cdm_stream_start(void *hw_priv,
+	void *start_args, uint32_t size)
+{
+	int rc = 0;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	rc = cam_cdm_stream_ops_internal(hw_priv, start_args, true);
+	return rc;
+
+}
+
+int cam_cdm_stream_stop(void *hw_priv,
+	void *start_args, uint32_t size)
+{
+	int rc = 0;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	rc = cam_cdm_stream_ops_internal(hw_priv, start_args, false);
+	return rc;
+
+}
+
+int cam_cdm_process_cmd(void *hw_priv,
+	uint32_t cmd, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_cdm *core = NULL;
+	int rc = -EINVAL;
+
+	if ((!hw_priv) || (!cmd_args) ||
+		(cmd >= CAM_CDM_HW_INTF_CMD_INVALID))
+		return rc;
+
+	core = (struct cam_cdm *)cdm_hw->core_info;
+
+	/*
+	 * When CDM has encountered a page fault, other than release no
+	 * other command will be serviced. PF handler notifies all clients
+	 * on the error, clients are expected to handle it, and release
+	 * its reference to the CDM core.
+	 */
+	if (test_bit(CAM_CDM_PF_HW_STATUS, &core->cdm_status) &&
+		(cmd != CAM_CDM_HW_INTF_CMD_RELEASE)) {
+		CAM_ERR(CAM_CDM,
+			"%s%u has encountered a page fault, unable to service cmd %u",
+			core->name, core->id, cmd);
+		return -EAGAIN;
+	}
+
+	switch (cmd) {
+	case CAM_CDM_HW_INTF_CMD_SUBMIT_BL: {
+		struct cam_cdm_hw_intf_cmd_submit_bl *req;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(struct cam_cdm_hw_intf_cmd_submit_bl) != arg_size) {
+			CAM_ERR(CAM_CDM, "Invalid CDM cmd %d arg size=%x", cmd,
+				arg_size);
+			break;
+		}
+		req = (struct cam_cdm_hw_intf_cmd_submit_bl *)cmd_args;
+		if ((req->data->type < 0) ||
+			(req->data->type > CAM_CDM_BL_CMD_TYPE_KERNEL_IOVA)) {
+			CAM_ERR(CAM_CDM, "Invalid req bl cmd addr type=%d",
+				req->data->type);
+			break;
+		}
+		idx = CAM_CDM_GET_CLIENT_IDX(req->handle);
+		client = core->clients[idx];
+		if ((!client) || (req->handle != client->handle)) {
+			CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client,
+				req->handle);
+			break;
+		}
+		cam_cdm_get_client_refcount(client);
+		if (req->data->flag &&
+			(!client->data.cam_cdm_callback)) {
+			CAM_ERR(CAM_CDM,
+				"CDM request cb without registering cb");
+			cam_cdm_put_client_refcount(client);
+			break;
+		}
+		if (client->stream_on != true) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM needs to be streamed ON first");
+			cam_cdm_put_client_refcount(client);
+			break;
+		}
+		if (core->id == CAM_CDM_VIRTUAL)
+			rc = cam_virtual_cdm_submit_bl(cdm_hw, req, client);
+		else
+			rc = cam_hw_cdm_submit_bl(cdm_hw, req, client);
+
+		cam_cdm_put_client_refcount(client);
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_ACQUIRE: {
+		struct cam_cdm_acquire_data *data;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(struct cam_cdm_acquire_data) != arg_size) {
+			CAM_ERR(CAM_CDM, "Invalid CDM cmd %d arg size=%x", cmd,
+				arg_size);
+			break;
+		}
+
+		mutex_lock(&cdm_hw->hw_mutex);
+		data = (struct cam_cdm_acquire_data *)cmd_args;
+		CAM_DBG(CAM_CDM, "Trying to acquire client=%s in hw idx=%d",
+			data->identifier, core->index);
+
+		if (data->priority >= CAM_CDM_BL_FIFO_MAX) {
+			mutex_unlock(&cdm_hw->hw_mutex);
+			CAM_ERR(CAM_CDM,
+				"Invalid priority requested %d",
+				data->priority);
+			rc = -EINVAL;
+			break;
+		}
+
+		if (core->id != CAM_CDM_VIRTUAL &&
+				core->bl_fifo[data->priority].bl_depth == 0) {
+			mutex_unlock(&cdm_hw->hw_mutex);
+			CAM_ERR(CAM_CDM,
+				"FIFO %d not supported for core %d",
+				data->priority,
+				core->id);
+			rc = -EINVAL;
+			break;
+		}
+
+		idx = cam_cdm_find_free_client_slot(core);
+		if ((idx < 0) || (core->clients[idx])) {
+			mutex_unlock(&cdm_hw->hw_mutex);
+			CAM_ERR(CAM_CDM,
+				"Fail to client slots, client=%s in hw idx=%d",
+			data->identifier, core->index);
+			break;
+		}
+		core->clients[idx] = kzalloc(sizeof(struct cam_cdm_client),
+			GFP_KERNEL);
+		if (!core->clients[idx]) {
+			mutex_unlock(&cdm_hw->hw_mutex);
+			rc = -ENOMEM;
+			break;
+		}
+		core->num_active_clients++;
+		mutex_unlock(&cdm_hw->hw_mutex);
+
+		client = core->clients[idx];
+		mutex_init(&client->lock);
+		data->ops = core->ops;
+		if (core->id == CAM_CDM_VIRTUAL) {
+			data->cdm_version.major = 1;
+			data->cdm_version.minor = 0;
+			data->cdm_version.incr = 0;
+			data->cdm_version.reserved = 0;
+			data->ops = cam_cdm_get_ops(0,
+					&data->cdm_version, true);
+			if (!data->ops) {
+				mutex_destroy(&client->lock);
+				mutex_lock(&cdm_hw->hw_mutex);
+				kfree(core->clients[idx]);
+				core->clients[idx] = NULL;
+				core->num_active_clients--;
+				mutex_unlock(
+					&cdm_hw->hw_mutex);
+				rc = -EPERM;
+				CAM_ERR(CAM_CDM, "Invalid ops for virtual cdm");
+				break;
+			}
+		} else {
+			data->cdm_version = core->version;
+		}
+
+		cam_cdm_get_client_refcount(client);
+		mutex_lock(&client->lock);
+		memcpy(&client->data, data,
+			sizeof(struct cam_cdm_acquire_data));
+		client->handle = CAM_CDM_CREATE_CLIENT_HANDLE(
+					core->index,
+					data->priority,
+					idx);
+		client->stream_on = false;
+		data->handle = client->handle;
+		CAM_DBG(CAM_CDM, "Acquired client=%s in hwidx=%d",
+			data->identifier, core->index);
+		mutex_unlock(&client->lock);
+		rc = 0;
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_RELEASE: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+			return -EINVAL;
+		}
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		mutex_lock(&cdm_hw->hw_mutex);
+		client = core->clients[idx];
+		if ((!client) || (*handle != client->handle)) {
+			CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x",
+				client, *handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+		cam_cdm_put_client_refcount(client);
+		mutex_lock(&client->lock);
+		if (client->refcount != 0) {
+			CAM_ERR(CAM_CDM, "CDM Client refcount not zero %d",
+				client->refcount);
+			rc = -EPERM;
+			mutex_unlock(&client->lock);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+		core->clients[idx] = NULL;
+		mutex_unlock(&client->lock);
+		mutex_destroy(&client->lock);
+		kfree(client);
+		if (core->num_active_clients)
+			core->num_active_clients--;
+		else
+			CAM_ERR(CAM_CDM,
+				"Invalid active client decrement %u for %s%u",
+				core->num_active_clients, core->name, core->id);
+		if (!core->num_active_clients) {
+			CAM_DBG(CAM_CDM, "Clear cdm status bits for %s%u",
+				core->name, core->id);
+			core->cdm_status = 0;
+		}
+		mutex_unlock(&cdm_hw->hw_mutex);
+		rc = 0;
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_RESET_HW: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		mutex_lock(&cdm_hw->hw_mutex);
+		client = core->clients[idx];
+		if (!client) {
+			CAM_ERR(CAM_CDM,
+				"Client not present for handle %d",
+				*handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+
+		if (*handle != client->handle) {
+			CAM_ERR(CAM_CDM,
+				"handle mismatch, client handle %d index %d received handle %d",
+				client->handle, idx, *handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+		rc = cam_hw_cdm_reset_hw(cdm_hw, *handle);
+		if (rc) {
+			CAM_ERR(CAM_CDM,
+				"CDM HW reset failed for handle 0x%x rc = %d",
+				*handle, rc);
+		} else {
+			CAM_INFO_RATE_LIMIT(CAM_CDM,
+				"CDM HW reset done for handle 0x%x",
+				*handle);
+		}
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_FLUSH_HW: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		mutex_lock(&cdm_hw->hw_mutex);
+		client = core->clients[idx];
+		if (!client) {
+			CAM_ERR(CAM_CDM,
+				"Client not present for handle %d",
+				*handle);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+		}
+
+		if (*handle != client->handle) {
+			CAM_ERR(CAM_CDM,
+				"handle mismatch, client handle %d index %d received handle %d",
+				client->handle, idx, *handle);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+		}
+
+		rc = cam_hw_cdm_flush_hw(cdm_hw, *handle);
+		if (rc) {
+			CAM_ERR(CAM_CDM,
+				"CDM HW flush failed for handle 0x%x rc = %d",
+				*handle, rc);
+		} else {
+			CAM_INFO_RATE_LIMIT(CAM_CDM,
+				"CDM HW flush done for handle 0x%x",
+				*handle);
+		}
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_HANDLE_ERROR: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		mutex_lock(&cdm_hw->hw_mutex);
+		client = core->clients[idx];
+		if (!client) {
+			CAM_ERR(CAM_CDM,
+				"Client not present for handle %d",
+				*handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+
+		if (*handle != client->handle) {
+			CAM_ERR(CAM_CDM,
+				"handle mismatch, client handle %d index %d received handle %d",
+				client->handle, idx, *handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+
+		rc = cam_hw_cdm_handle_error_info(cdm_hw, *handle);
+		if (rc) {
+			CAM_ERR(CAM_CDM,
+				"CDM HW handle error failed for handle 0x%x rc = %d",
+				*handle, rc);
+		} else {
+			CAM_INFO_RATE_LIMIT(CAM_CDM,
+				"CDM HW handle error done for handle 0x%x",
+				*handle);
+		}
+
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_HANG_DETECT: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		client = core->clients[idx];
+		if (!client) {
+			CAM_ERR(CAM_CDM,
+				"Client not present for handle %d",
+				*handle);
+			break;
+		}
+
+		if (*handle != client->handle) {
+			CAM_ERR(CAM_CDM,
+				"handle mismatch, client handle %d index %d received handle %d",
+				client->handle, idx, *handle);
+			break;
+		}
+
+		rc = cam_hw_cdm_hang_detect(cdm_hw, *handle);
+		break;
+	}
+	case CAM_CDM_HW_INTF_DUMP_DBG_REGS:
+	{
+		uint32_t *handle = cmd_args;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=0x%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+
+		mutex_lock(&cdm_hw->hw_mutex);
+		cam_hw_cdm_dump_core_debug_registers(cdm_hw, true);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_CDM, "CDM HW intf command not valid =%d", cmd);
+		break;
+	}
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_core_common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_core_common.h
@@ -0,0 +1,69 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_CORE_COMMON_H_
+#define _CAM_CDM_CORE_COMMON_H_
+
+#include "cam_mem_mgr.h"
+
+#define CAM_CDM100_VERSION 0x10000000
+#define CAM_CDM110_VERSION 0x10010000
+#define CAM_CDM120_VERSION 0x10020000
+#define CAM_CDM200_VERSION 0x20000000
+#define CAM_CDM210_VERSION 0x20010000
+#define CAM_CDM211_VERSION 0x20010001
+#define CAM_CDM220_VERSION 0x20020000
+
+
+#define CAM_CDM_AHB_BURST_LEN_1  (BIT(1) - 1)
+#define CAM_CDM_AHB_BURST_LEN_4  (BIT(2) - 1)
+#define CAM_CDM_AHB_BURST_LEN_8  (BIT(3) - 1)
+#define CAM_CDM_AHB_BURST_LEN_16 (BIT(4) - 1)
+#define CAM_CDM_AHB_BURST_EN      BIT(4)
+#define CAM_CDM_AHB_STOP_ON_ERROR BIT(8)
+#define CAM_CDM_ARB_SEL_RR        BIT(16)
+#define CAM_CDM_IMPLICIT_WAIT_EN  BIT(17)
+#define CAM_CDM_PAUSE_CORE_ENABLE_MASK  (0x1 << 1)
+
+extern struct cam_cdm_utils_ops CDM170_ops;
+
+int cam_hw_cdm_init(void *hw_priv, void *init_hw_args, uint32_t arg_size);
+int cam_hw_cdm_deinit(void *hw_priv, void *init_hw_args, uint32_t arg_size);
+int cam_hw_cdm_pf_deinit(void *hw_priv, void *init_hw_args,
+	uint32_t arg_size);
+int cam_cdm_get_caps(void *hw_priv, void *get_hw_cap_args, uint32_t arg_size);
+int cam_cdm_stream_ops_internal(void *hw_priv, void *start_args,
+	bool operation);
+int cam_cdm_pf_stream_off_all_clients(struct cam_hw_info *cdm_hw);
+int cam_cdm_stream_start(void *hw_priv, void *start_args, uint32_t size);
+int cam_cdm_stream_stop(void *hw_priv, void *start_args, uint32_t size);
+int cam_cdm_process_cmd(void *hw_priv, uint32_t cmd, void *cmd_args,
+	uint32_t arg_size);
+bool cam_cdm_set_cam_hw_version(
+	uint32_t ver, struct cam_hw_version *cam_version);
+bool cam_cdm_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data);
+struct cam_cdm_utils_ops *cam_cdm_get_ops(
+	uint32_t ver, struct cam_hw_version *cam_version, bool by_cam_version);
+int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	struct cam_cdm_client *client);
+int cam_hw_cdm_submit_bl(struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	struct cam_cdm_client *client);
+int cam_hw_cdm_reset_hw(struct cam_hw_info *cdm_hw, uint32_t handle);
+int cam_hw_cdm_flush_hw(struct cam_hw_info *cdm_hw, uint32_t handle);
+int cam_hw_cdm_hang_detect(struct cam_hw_info *cdm_hw, uint32_t handle);
+int cam_hw_cdm_handle_error_info(struct cam_hw_info *cdm_hw, uint32_t handle);
+struct cam_cdm_bl_cb_request_entry *cam_cdm_find_request_by_bl_tag(
+	uint32_t tag, struct list_head *bl_list);
+void cam_cdm_notify_clients(struct cam_hw_info *cdm_hw,
+	enum cam_cdm_cb_status status, void *data);
+void cam_hw_cdm_dump_core_debug_registers(
+	struct cam_hw_info *cdm_hw, bool pause_core);
+int cam_cdm_util_cpas_start(struct cam_hw_info *cdm_hw);
+
+#endif /* _CAM_CDM_CORE_COMMON_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_core.c
@@ -0,0 +1,2626 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include <media/cam_req_mgr.h>
+#include "cam_soc_util.h"
+#include "cam_smmu_api.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm.h"
+#include "cam_cdm_core_common.h"
+#include "cam_cdm_soc.h"
+#include "cam_io_util.h"
+#include "cam_cdm_hw_reg_1_0.h"
+#include "cam_cdm_hw_reg_1_1.h"
+#include "cam_cdm_hw_reg_1_2.h"
+#include "cam_cdm_hw_reg_2_0.h"
+#include "cam_cdm_hw_reg_2_1.h"
+#include "cam_cdm_hw_reg_2_2.h"
+#include "camera_main.h"
+#include "cam_trace.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+#define CAM_CDM_BL_FIFO_WAIT_TIMEOUT         2000
+#define CAM_CDM_DBG_GEN_IRQ_USR_DATA         0xff
+#define CAM_CDM_MAX_BL_LENGTH                0x100000
+#define CAM_CDM_FIFO_LEN_REG_LEN_MASK        0xFFFFF
+#define CAM_CDM_FIFO_LEN_REG_TAG_MASK        0xFF
+#define CAM_CDM_FIFO_LEN_REG_TAG_SHIFT       24
+#define CAM_CDM_FIFO_LEN_REG_ARB_SHIFT       20
+
+static void cam_hw_cdm_work(struct work_struct *work);
+
+/* DT match table entry for all CDM variants*/
+static const struct of_device_id msm_cam_hw_cdm_dt_match[] = {
+	{
+		.compatible = CAM_HW_CDM_CPAS_0_NAME,
+		.data = &cam_cdm_1_0_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_1_0,
+		.data = &cam_cdm_1_0_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_1_1,
+		.data = &cam_cdm_1_1_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_1_2,
+		.data = &cam_cdm_1_2_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_IFE_NAME_1_2,
+		.data = &cam_cdm_1_2_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_2_0,
+		.data = &cam_cdm_2_0_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_OPE_NAME_2_0,
+		.data = &cam_cdm_2_0_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_2_1,
+		.data = &cam_cdm_2_1_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_RT_NAME_2_1,
+		.data = &cam_cdm_2_1_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_OPE_NAME_2_1,
+		.data = &cam_cdm_2_1_reg_offset,
+	},
+	{
+		.compatible  = CAM_HW_CDM_RT_NAME_2_2,
+		.data = &cam_cdm_2_2_reg_offset,
+	},
+	{},
+};
+
+static enum cam_cdm_id cam_hw_cdm_get_id_by_name(char *name)
+{
+	if (strnstr(name, CAM_HW_CDM_CPAS_0_NAME,
+			strlen(CAM_HW_CDM_CPAS_0_NAME)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_1_0,
+			strlen(CAM_HW_CDM_CPAS_NAME_1_0)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_1_1,
+			strlen(CAM_HW_CDM_CPAS_NAME_1_1)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_1_2,
+			strlen(CAM_HW_CDM_CPAS_NAME_1_2)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_IFE_NAME_1_2,
+			strlen(CAM_HW_CDM_IFE_NAME_1_2)))
+		return CAM_CDM_IFE;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_2_0,
+			strlen(CAM_HW_CDM_CPAS_NAME_2_0)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_OPE_NAME_2_0,
+			strlen(CAM_HW_CDM_OPE_NAME_2_0)))
+		return CAM_CDM_OPE;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_2_1,
+			strlen(CAM_HW_CDM_CPAS_NAME_2_1)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_RT_NAME_2_1,
+			strlen(CAM_HW_CDM_RT_NAME_2_1)))
+		return CAM_CDM_RT;
+	if (strnstr(name, CAM_HW_CDM_OPE_NAME_2_1,
+			strlen(CAM_HW_CDM_OPE_NAME_2_1)))
+		return CAM_CDM_OPE;
+	if (strnstr(name, CAM_HW_CDM_RT_NAME_2_2,
+			strlen(CAM_HW_CDM_RT_NAME_2_2)))
+		return CAM_CDM_RT;
+	return CAM_CDM_MAX;
+}
+
+static int cam_hw_cdm_enable_bl_done_irq(struct cam_hw_info *cdm_hw,
+	bool enable, uint32_t fifo_idx)
+{
+	int rc = -EIO;
+	uint32_t irq_mask = 0;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[fifo_idx]->irq_mask,
+			&irq_mask)) {
+		CAM_ERR(CAM_CDM, "Failed to read CDM IRQ mask");
+		return rc;
+	}
+
+	if (enable == true) {
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				core->offsets->irq_reg[fifo_idx]->irq_mask,
+				(irq_mask | 0x4))) {
+			CAM_ERR(CAM_CDM, "Write failed to enable BL done irq");
+		} else {
+			set_bit(fifo_idx, &core->cdm_status);
+			rc = 0;
+			CAM_DBG(CAM_CDM, "BL done irq enabled =%d",
+				test_bit(fifo_idx, &core->cdm_status));
+		}
+	} else {
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				core->offsets->irq_reg[fifo_idx]->irq_mask,
+				(irq_mask & 0x70003))) {
+			CAM_ERR(CAM_CDM, "Write failed to disable BL done irq");
+		} else {
+			clear_bit(fifo_idx, &core->cdm_status);
+			rc = 0;
+			CAM_DBG(CAM_CDM, "BL done irq disable =%d",
+				test_bit(fifo_idx, &core->cdm_status));
+		}
+	}
+	return rc;
+}
+
+static int cam_hw_cdm_pause_core(struct cam_hw_info *cdm_hw, bool pause)
+{
+	int rc = 0;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	uint32_t val = 0x1, core_en_reg, cdm_status_reg;
+
+	if (pause)
+		val |= 0x2;
+
+	if (core->offsets->cmn_reg->cdm_status) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->core_en, &core_en_reg);
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->cdm_status, &cdm_status_reg);
+
+		/* In both pause or resume, further action need not/cannot be taken */
+		if ((core_en_reg & CAM_CDM_PAUSE_CORE_ENABLE_MASK) &&
+			!(cdm_status_reg & CAM_CDM_PAUSE_CORE_DONE_MASK)) {
+			if (!pause)
+				CAM_ERR(CAM_CDM, "Pause core not done yet, can't resume core");
+			return -EAGAIN;
+		}
+	}
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->core_en, val)) {
+		CAM_ERR(CAM_CDM, "Failed to Write core_en for %s%u",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		rc = -EIO;
+	}
+	if (pause && core->offsets->cmn_reg->cdm_status) {
+		uint32_t us_wait_time = 0;
+
+		while (us_wait_time < CAM_CDM_PAUSE_CORE_US_TIMEOUT) {
+			cam_cdm_read_hw_reg(cdm_hw,
+				core->offsets->cmn_reg->cdm_status,
+				&cdm_status_reg);
+			if (cdm_status_reg & CAM_CDM_PAUSE_CORE_DONE_MASK) {
+				CAM_DBG(CAM_CDM, "Pause core time (us): %lu",
+					us_wait_time);
+				break;
+			}
+			us_wait_time += 100;
+			usleep_range(100, 110);
+		}
+		CAM_WARN(CAM_CDM, "Pause core operation not successful");
+	}
+
+	return rc;
+}
+
+int cam_hw_cdm_enable_core_dbg(struct cam_hw_info *cdm_hw, uint32_t value)
+{
+	int rc = 0;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->core_debug,
+			value)) {
+		CAM_ERR(CAM_CDM, "Failed to Write CDM HW core debug");
+		rc = -EIO;
+	}
+
+	return rc;
+}
+
+int cam_hw_cdm_disable_core_dbg(struct cam_hw_info *cdm_hw)
+{
+	int rc = 0;
+	struct cam_cdm *cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->core_debug, 0)) {
+		CAM_ERR(CAM_CDM, "Failed to Write CDM HW core debug");
+		rc = -EIO;
+	}
+
+	return rc;
+}
+
+void cam_hw_cdm_dump_scratch_registors(struct cam_hw_info *cdm_hw)
+{
+	uint32_t dump_reg = 0;
+	int i;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->core_en, &dump_reg);
+	CAM_ERR(CAM_CDM, "dump core en=%x", dump_reg);
+
+	for (i = 0; i < core->offsets->reg_data->num_scratch_reg; i++) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->scratch[i]->scratch_reg,
+			&dump_reg);
+		CAM_ERR(CAM_CDM, "dump scratch%d=%x", i, dump_reg);
+	}
+}
+
+int cam_hw_cdm_bl_fifo_pending_bl_rb_in_fifo(
+	struct cam_hw_info *cdm_hw,
+	uint32_t fifo_idx,
+	uint32_t *pending_bl_req)
+{
+	int rc = 0;
+	uint32_t fifo_reg;
+	uint32_t fifo_id;
+
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (fifo_idx >= CAM_CDM_BL_FIFO_REG_NUM) {
+		CAM_ERR(CAM_CDM,
+			"BL_FIFO index is wrong. fifo_idx %d",
+			fifo_idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	fifo_reg = fifo_idx / 2;
+	fifo_id = fifo_idx % 2;
+
+	if (core->offsets->cmn_reg->pending_req[fifo_reg]) {
+		if (cam_cdm_read_hw_reg(cdm_hw,
+				core->offsets->cmn_reg->pending_req
+					[fifo_reg]->rb_offset,
+				pending_bl_req)) {
+			CAM_ERR(CAM_CDM, "Error reading CDM register");
+			rc = -EIO;
+			goto end;
+		}
+
+		*pending_bl_req = (*pending_bl_req >> (
+			core->offsets->cmn_reg->pending_req
+				[fifo_reg]->rb_next_fifo_shift *
+			fifo_id)) & core->offsets->cmn_reg->pending_req
+				[fifo_reg]->rb_mask;
+		rc = 0;
+	}
+
+	CAM_DBG(CAM_CDM, "Number of pending bl entries:%d in fifo: %d",
+			*pending_bl_req, fifo_id);
+
+end:
+	return rc;
+}
+
+static void cam_hw_cdm_dump_bl_fifo_data(struct cam_hw_info *cdm_hw)
+{
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	int i, j;
+	uint32_t num_pending_req = 0, dump_reg[2];
+
+	for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++) {
+		cam_hw_cdm_bl_fifo_pending_bl_rb_in_fifo(cdm_hw, i, &num_pending_req);
+
+		CAM_INFO(CAM_CDM, "Fifo:%d content dump. num_pending_BLs: %d", i, num_pending_req);
+
+		if (!num_pending_req)
+			continue;
+
+		for (j = 0; j < core->bl_fifo[i].bl_depth; j++) {
+			cam_cdm_write_hw_reg(cdm_hw, core->offsets->cmn_reg->bl_fifo_rb, j);
+			cam_cdm_read_hw_reg(cdm_hw, core->offsets->cmn_reg->bl_fifo_base_rb,
+				&dump_reg[0]);
+			cam_cdm_read_hw_reg(cdm_hw, core->offsets->cmn_reg->bl_fifo_len_rb,
+				&dump_reg[1]);
+			CAM_INFO(CAM_CDM,
+				"BL_entry:%d base_addr:0x%x, len:%d, ARB:%d, tag:%d",
+				j, dump_reg[0],
+				(dump_reg[1] & CAM_CDM_CURRENT_BL_LEN),
+				(dump_reg[1] & CAM_CDM_CURRENT_BL_ARB) >>
+					CAM_CDM_CURRENT_BL_ARB_SHIFT,
+				(dump_reg[1] & CAM_CDM_CURRENT_BL_TAG) >>
+					CAM_CDM_CURRENT_BL_TAG_SHIFT);
+		}
+	}
+}
+
+void cam_hw_cdm_dump_core_debug_registers(struct cam_hw_info *cdm_hw,
+	bool pause_core)
+{
+	uint32_t dump_reg[4];
+	uint32_t core_dbg = CAM_CDM_CORE_DBG_TEST_BUS_EN_MASK |
+		CAM_CDM_CORE_DBG_LOG_AHB_MASK |
+		CAM_CDM_CORE_DBG_FIFO_RB_EN_MASK;
+	uint32_t cdm_version = 0;
+	int i;
+	bool is_core_paused_already;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	const struct cam_cdm_icl_regs *inv_cmd_log =
+		core->offsets->cmn_reg->icl_reg;
+
+	CAM_INFO(CAM_CDM, "Dumping debug data for %s%u",
+		cdm_hw->soc_info.label_name, cdm_hw->soc_info.index);
+
+
+	if (pause_core)
+		cam_hw_cdm_pause_core(cdm_hw, true);
+
+	cam_cdm_read_hw_reg(cdm_hw, core->offsets->cmn_reg->cdm_hw_version,
+		&cdm_version);
+
+	if (core_dbg & CAM_CDM_CORE_DBG_TEST_BUS_EN_MASK) {
+		for (i = 0; i < CAM_CDM_NUM_TEST_BUS; i++) {
+			core_dbg &= ~CAM_CDM_CORE_DBG_TEST_BUS_SEL_MASK;
+			core_dbg |= ((i << CAM_CDM_CORE_DBG_TEST_BUS_SEL_SHIFT) &
+				(CAM_CDM_CORE_DBG_TEST_BUS_SEL_MASK));
+			cam_hw_cdm_enable_core_dbg(cdm_hw, core_dbg);
+			cam_cdm_read_hw_reg(cdm_hw, core->offsets->cmn_reg->debug_status,
+				&dump_reg[0]);
+
+			CAM_INFO(CAM_CDM, "Core_dbg: 0x%x, Debug_status[%d]: 0x%x",
+				core_dbg, i, dump_reg[0]);
+		}
+
+		core_dbg &= ~(CAM_CDM_CORE_DBG_TEST_BUS_EN_MASK |
+			CAM_CDM_CORE_DBG_TEST_BUS_SEL_MASK) |
+			CAM_CDM_CORE_DBG_LOG_AHB_MASK |
+			CAM_CDM_CORE_DBG_FIFO_RB_EN_MASK;
+		cam_hw_cdm_enable_core_dbg(cdm_hw, core_dbg);
+	}
+
+	if (core_dbg & CAM_CDM_CORE_DBG_LOG_AHB_MASK ||
+			core_dbg & CAM_CDM_CORE_DBG_FIFO_RB_EN_MASK){
+		cam_hw_cdm_enable_core_dbg(cdm_hw, core_dbg);
+
+		cam_cdm_read_hw_reg(cdm_hw, core->offsets->cmn_reg->debug_status,
+			&dump_reg[0]);
+
+		CAM_INFO(CAM_CDM, "Debug_status: 0x%x", dump_reg[0]);
+	}
+
+	cam_cdm_read_hw_reg(cdm_hw, core->offsets->cmn_reg->core_en, &dump_reg[0]);
+	cam_cdm_read_hw_reg(cdm_hw, core->offsets->cmn_reg->usr_data, &dump_reg[1]);
+	CAM_INFO(CAM_CDM, "Core_en: %u, Core_pause: %u User_data: 0x%x",
+		(dump_reg[0] & CAM_CDM_CORE_EN_MASK),
+		(bool)(dump_reg[0] & CAM_CDM_CORE_PAUSE_MASK),
+		dump_reg[1]);
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->current_used_ahb_base, &dump_reg[0]);
+
+	if (cdm_version >= CAM_CDM_VERSION_2_0)
+		CAM_INFO(CAM_CDM,
+			"Current AHB base address: 0x%x set by change base cmd by fifo: %u",
+			dump_reg[0] & CAM_CDM_AHB_ADDR_MASK,
+			(dump_reg[0] & CAM_CDM_AHB_LOG_CID_MASK) >>
+				CAM_CDM_AHB_LOG_CID_SHIFT);
+	else
+		CAM_INFO(CAM_CDM,
+			"Current AHB base address: 0x%x set by change base cmd",
+			dump_reg[0] & CAM_CDM_AHB_ADDR_MASK);
+
+	if (core_dbg & CAM_CDM_CORE_DBG_LOG_AHB_MASK) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->last_ahb_addr,
+			&dump_reg[0]);
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->last_ahb_data,
+			&dump_reg[1]);
+
+		if (cdm_version >= CAM_CDM_VERSION_2_0)
+			CAM_INFO(CAM_CDM,
+				"Last AHB addr: 0x%x, data: 0x%x that cdm sent out from fifo: %u",
+				(dump_reg[0] & CAM_CDM_AHB_ADDR_MASK),
+				dump_reg[1],
+				(dump_reg[0] & CAM_CDM_AHB_LOG_CID_MASK) >>
+					CAM_CDM_AHB_LOG_CID_SHIFT);
+		else
+			CAM_INFO(CAM_CDM,
+				"Last AHB addr: 0x%x, data: 0x%x that cdm sent out",
+				(dump_reg[0] & CAM_CDM_AHB_ADDR_MASK),
+				dump_reg[1]);
+	} else {
+		CAM_INFO(CAM_CDM, "CDM HW AHB dump not enabled");
+	}
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->last_ahb_err_addr,
+		&dump_reg[0]);
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->last_ahb_err_data,
+		&dump_reg[1]);
+
+	if (cdm_version >= CAM_CDM_VERSION_2_0)
+		CAM_INFO(CAM_CDM,
+			"Last Bad AHB addr: 0x%x and data: 0x%x from fifo: %u",
+			(dump_reg[0] & CAM_CDM_AHB_ADDR_MASK), dump_reg[1],
+			(dump_reg[0] & CAM_CDM_AHB_LOG_CID_MASK) >>
+				CAM_CDM_AHB_LOG_CID_SHIFT);
+	else
+		CAM_INFO(CAM_CDM, "Last Bad AHB addr: 0x%x and data: 0x%x",
+			(dump_reg[0] & CAM_CDM_AHB_ADDR_MASK), dump_reg[1]);
+
+	if (inv_cmd_log) {
+		if (inv_cmd_log->misc_regs) {
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->misc_regs->icl_status,
+				&dump_reg[0]);
+			CAM_INFO(CAM_CDM,
+				"ICL_Status: last_invalid_fifo: %u, last known good fifo: %u",
+				(dump_reg[0] & CAM_CDM_ICL_STATUS_INV_CID_MASK),
+				(dump_reg[0] &
+					CAM_CDM_ICL_STATUS_LAST_CID_MASK) >>
+					CAM_CDM_ICL_STATUS_LAST_CID_SHIFT);
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->misc_regs->icl_inv_bl_addr,
+				&dump_reg[0]);
+			CAM_INFO(CAM_CDM,
+				"Last Inv Command BL's base_addr: 0x%x",
+				dump_reg[0]);
+		}
+		if (inv_cmd_log->data_regs) {
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->data_regs->icl_inv_data,
+				&dump_reg[0]);
+			CAM_INFO(CAM_CDM, "First word of Last Inv cmd: 0x%x",
+				dump_reg[0]);
+
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->data_regs->icl_last_data_0,
+				&dump_reg[0]);
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->data_regs->icl_last_data_1,
+				&dump_reg[1]);
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->data_regs->icl_last_data_2,
+				&dump_reg[2]);
+
+			CAM_INFO(CAM_CDM,
+				"Last good cdm command's word[0]: 0x%x, word[1]: 0x%x, word[2]: 0x%x",
+				dump_reg[0], dump_reg[1], dump_reg[2]);
+		}
+	}
+
+	if (core_dbg & CAM_CDM_CORE_DBG_FIFO_RB_EN_MASK) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->core_en, &dump_reg[0]);
+		is_core_paused_already = (bool)(dump_reg[0] & 0x20);
+		if (!is_core_paused_already)
+			cam_hw_cdm_pause_core(cdm_hw, true);
+
+		cam_hw_cdm_dump_bl_fifo_data(cdm_hw);
+
+		if (!is_core_paused_already)
+			cam_hw_cdm_pause_core(cdm_hw, false);
+	}
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->core_cfg, &dump_reg[0]);
+
+	if (cdm_version >= CAM_CDM_VERSION_2_0)
+		CAM_INFO(CAM_CDM,
+			"Core cfg: AHB_Burst_Len: %u, AHB_Burst_En: %u, AHB_stop_on_err: %u, Priority: %s, Imp_Wait: %u, Pririty_mask: 0x%x",
+			dump_reg[0] & CAM_CDM_CORE_CFG_AHB_BURST_LEN_MASK,
+			(bool)(dump_reg[0] &
+				CAM_CDM_CORE_CFG_AHB_BURST_EN_MASK),
+			(bool)(dump_reg[0] &
+				CAM_CDM_CORE_CFG_AHB_STOP_ON_ERR_MASK),
+			(dump_reg[0] & CAM_CDM_CORE_CFG_ARB_SEL_RR_MASK) ? "RR":
+				"PRI",
+			(bool)(dump_reg[0] &
+				CAM_CDM_CORE_CFG_IMPLICIT_WAIT_EN_MASK),
+			(dump_reg[0] & CAM_CDM_CORE_CFG_PRIORITY_MASK) >>
+				CAM_CDM_CORE_CFG_PRIORITY_SHIFT);
+	else
+		CAM_INFO(CAM_CDM,
+			"Core cfg: AHB_Burst_Len: %u, AHB_Burst_En: %u, AHB_stop_on_err: %u",
+			dump_reg[0] & CAM_CDM_CORE_CFG_AHB_BURST_LEN_MASK,
+			(bool)(dump_reg[0] &
+				CAM_CDM_CORE_CFG_AHB_BURST_EN_MASK),
+			(bool)(dump_reg[0] &
+				CAM_CDM_CORE_CFG_AHB_STOP_ON_ERR_MASK));
+
+	if (cdm_version >= CAM_CDM_VERSION_2_1) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->irq_context_status,
+			&dump_reg[0]);
+		CAM_INFO(CAM_CDM, "irq_context_status: 0x%x", dump_reg[0]);
+	}
+
+	for (i = 0; i < core->offsets->reg_data->num_bl_fifo_irq; i++) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_status, &dump_reg[0]);
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_set, &dump_reg[1]);
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_mask, &dump_reg[2]);
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_clear, &dump_reg[3]);
+
+		CAM_INFO(CAM_CDM,
+			"cnt %d irq status 0x%x set 0x%x mask 0x%x clear 0x%x",
+			i, dump_reg[0], dump_reg[1], dump_reg[2], dump_reg[3]);
+	}
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->current_bl_base, &dump_reg[0]);
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->current_bl_len, &dump_reg[1]);
+
+	if (cdm_version >= CAM_CDM_VERSION_2_0)
+		CAM_INFO(CAM_CDM,
+			"Last fetched BL by cdm from fifo: %u has Base: 0x%x, len: %d ARB: %d tag: %d ",
+			(dump_reg[1] & CAM_CDM_CURRENT_BL_FIFO) >>
+				CAM_CDM_CURRENT_BL_FIFO_SHIFT,
+			dump_reg[0],
+			(dump_reg[1] & CAM_CDM_CURRENT_BL_LEN),
+			(dump_reg[1] & CAM_CDM_CURRENT_BL_ARB) >>
+				CAM_CDM_CURRENT_BL_ARB_SHIFT,
+			(dump_reg[1] & CAM_CDM_CURRENT_BL_TAG) >>
+				CAM_CDM_CURRENT_BL_TAG_SHIFT);
+	else
+		CAM_INFO(CAM_CDM,
+			"Last fetched BL by cdm has Base: 0x%x, len: %d tag: %d ",
+			dump_reg[0],
+			(dump_reg[1] & CAM_CDM_CURRENT_BL_LEN),
+			(dump_reg[1] & CAM_CDM_CURRENT_BL_TAG) >>
+				CAM_CDM_CURRENT_BL_TAG_SHIFT);
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->wait_status, &dump_reg[0]);
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->comp_wait[0]->comp_wait_status,
+		&dump_reg[1]);
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->comp_wait[1]->comp_wait_status,
+		&dump_reg[2]);
+	CAM_INFO(CAM_CDM, "Wait status: 0x%x, Comp_wait_status0: 0x%x:, Comp_wait_status1: 0x%x",
+		dump_reg[0], dump_reg[1], dump_reg[2]);
+
+	cam_hw_cdm_disable_core_dbg(cdm_hw);
+	if (pause_core)
+		cam_hw_cdm_pause_core(cdm_hw, false);
+}
+
+enum cam_cdm_arbitration cam_cdm_get_arbitration_type(
+		uint32_t cdm_version,
+		enum cam_cdm_id id)
+{
+	enum cam_cdm_arbitration arbitration;
+
+	if (cdm_version < CAM_CDM_VERSION_2_0) {
+		arbitration = CAM_CDM_ARBITRATION_NONE;
+		goto end;
+	}
+	switch (id) {
+	case CAM_CDM_CPAS:
+		arbitration = CAM_CDM_ARBITRATION_ROUND_ROBIN;
+		break;
+	default:
+		arbitration = CAM_CDM_ARBITRATION_PRIORITY_BASED;
+		break;
+	}
+end:
+	return arbitration;
+}
+
+int cam_hw_cdm_set_cdm_blfifo_cfg(struct cam_hw_info *cdm_hw)
+{
+	int rc = 0, i;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	for (i = 0; i < core->offsets->reg_data->num_bl_fifo_irq; i++) {
+		if (!core->bl_fifo[i].bl_depth)
+			continue;
+
+		rc = cam_cdm_write_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_mask, 0x70003);
+		if (rc) {
+			CAM_ERR(CAM_CDM,
+				"Unable to write to %s%u irq mask register",
+				cdm_hw->soc_info.label_name,
+				cdm_hw->soc_info.index);
+			rc = -EIO;
+			goto end;
+		}
+	}
+
+	if (core->hw_version >= CAM_CDM_VERSION_2_0) {
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++) {
+			rc = cam_cdm_write_hw_reg(cdm_hw,
+				core->offsets->bl_fifo_reg[i]->bl_fifo_cfg,
+				core->bl_fifo[i].bl_depth
+				<< CAM_CDM_BL_FIFO_LENGTH_CFG_SHIFT);
+			if (rc) {
+				CAM_ERR(CAM_CDM,
+					"Unable to write to %s%u irq mask register",
+					cdm_hw->soc_info.label_name,
+					cdm_hw->soc_info.index);
+				rc = -EIO;
+				goto end;
+			}
+		}
+	}
+end:
+	return rc;
+}
+
+int cam_hw_cdm_set_cdm_core_cfg(struct cam_hw_info *cdm_hw)
+{
+	uint32_t cdm_version;
+	uint32_t cfg_mask = 0;
+	int rc;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	struct cam_cdm_private_dt_data *pvt_data =
+		(struct cam_cdm_private_dt_data *)cdm_hw->soc_info.soc_private;
+
+	cfg_mask = cfg_mask |
+			CAM_CDM_AHB_STOP_ON_ERROR|
+			CAM_CDM_AHB_BURST_EN|
+			CAM_CDM_AHB_BURST_LEN_16;
+
+	/* use version from cdm_core structure. */
+	if (cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->cdm_hw_version,
+			&cdm_version)) {
+		CAM_ERR(CAM_CDM, "Error reading %s%u register",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		rc = -EIO;
+		goto end;
+	}
+
+	if (cdm_version >= CAM_CDM_VERSION_2_0) {
+		if (core->id != CAM_CDM_CPAS &&
+			(!pvt_data->is_single_ctx_cdm))
+			cfg_mask = cfg_mask | CAM_CDM_IMPLICIT_WAIT_EN;
+
+		if (core->arbitration == CAM_CDM_ARBITRATION_ROUND_ROBIN)
+			cfg_mask = cfg_mask | CAM_CDM_ARB_SEL_RR;
+
+	}
+
+	if (cdm_version >= CAM_CDM_VERSION_2_1) {
+		cfg_mask = cfg_mask | ((uint32_t)pvt_data->priority_group <<
+			core->offsets->cmn_reg->priority_group_bit_offset);
+	}
+
+	rc = cam_cdm_write_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->core_cfg, cfg_mask);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Error writing %s%u core cfg",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		rc = -EIO;
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+int cam_hw_cdm_wait_for_bl_fifo(
+		struct cam_hw_info *cdm_hw,
+		uint32_t            bl_count,
+		uint32_t            fifo_idx)
+{
+	uint32_t pending_bl = 0;
+	int32_t available_bl_slots = 0;
+	int rc = -EIO;
+	long time_left;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	struct cam_cdm_bl_fifo *bl_fifo = NULL;
+
+	if (fifo_idx >= CAM_CDM_BL_FIFO_MAX) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CDM,
+			"Invalid fifo index %d rc = %d",
+			fifo_idx, rc);
+		goto end;
+	}
+
+	bl_fifo = &core->bl_fifo[fifo_idx];
+
+	do {
+		if (cam_hw_cdm_bl_fifo_pending_bl_rb_in_fifo(cdm_hw, fifo_idx, &pending_bl)) {
+			CAM_ERR(CAM_CDM, "Failed to read CDM pending BL's");
+			rc = -EIO;
+			break;
+		}
+		available_bl_slots = bl_fifo->bl_depth - pending_bl;
+		if (available_bl_slots < 0) {
+			CAM_ERR(CAM_CDM, "Invalid available slots %d:%d:%d",
+				available_bl_slots, bl_fifo->bl_depth,
+				pending_bl);
+			break;
+		}
+		if (0 == (available_bl_slots - 1)) {
+			reinit_completion(&core->bl_fifo[fifo_idx].bl_complete);
+
+			rc = cam_hw_cdm_enable_bl_done_irq(cdm_hw,
+				true, fifo_idx);
+			if (rc) {
+				CAM_ERR(CAM_CDM, "Enable BL done irq failed");
+				break;
+			}
+			time_left = cam_common_wait_for_completion_timeout(
+				&core->bl_fifo[fifo_idx].bl_complete,
+				msecs_to_jiffies(
+				CAM_CDM_BL_FIFO_WAIT_TIMEOUT));
+			if (time_left <= 0) {
+				CAM_ERR(CAM_CDM,
+					"CDM HW BL Wait timed out failed");
+				if (cam_hw_cdm_enable_bl_done_irq(cdm_hw,
+					false, fifo_idx))
+					CAM_ERR(CAM_CDM,
+						"Disable BL done irq failed");
+				rc = -EIO;
+				break;
+			}
+			if (cam_hw_cdm_enable_bl_done_irq(cdm_hw,
+					false, fifo_idx))
+				CAM_ERR(CAM_CDM, "Disable BL done irq failed");
+			rc = 1;
+			CAM_DBG(CAM_CDM, "CDM HW is ready for data");
+		} else {
+			CAM_DBG(CAM_CDM,
+				"BL slot available_cnt=%d requested=%d",
+				(available_bl_slots - 1), bl_count);
+			rc = available_bl_slots - 1;
+			break;
+		}
+	} while (1);
+
+end:
+
+	return rc;
+}
+
+bool cam_hw_cdm_bl_write(
+		struct cam_hw_info *cdm_hw, uint32_t src,
+		uint32_t len, uint32_t tag, bool set_arb,
+		uint32_t fifo_idx)
+{
+	struct cam_cdm *cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	CAM_DBG(CAM_CDM, "%s%d Base: 0x%x, Len: %u, Tag: %u, set_arb: %u, fifo_idx: %u",
+		cdm_hw->soc_info.label_name, cdm_hw->soc_info.index,
+		src, len, tag, set_arb, fifo_idx);
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+		cdm_core->offsets->bl_fifo_reg[fifo_idx]->bl_fifo_base,
+		src)) {
+		CAM_ERR(CAM_CDM, "Failed to write CDM base to BL base");
+		return true;
+	}
+	if (cam_cdm_write_hw_reg(cdm_hw,
+		cdm_core->offsets->bl_fifo_reg[fifo_idx]->bl_fifo_len,
+		((len & CAM_CDM_FIFO_LEN_REG_LEN_MASK) |
+			((tag & CAM_CDM_FIFO_LEN_REG_TAG_MASK) << CAM_CDM_FIFO_LEN_REG_TAG_SHIFT)) |
+			((set_arb) ? (1 << CAM_CDM_FIFO_LEN_REG_ARB_SHIFT) : (0)))) {
+		CAM_ERR(CAM_CDM, "Failed to write CDM BL len");
+		return true;
+	}
+	return false;
+}
+
+bool cam_hw_cdm_commit_bl_write(struct cam_hw_info *cdm_hw, uint32_t fifo_idx)
+{
+	struct cam_cdm *cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+		cdm_core->offsets->bl_fifo_reg[fifo_idx]->bl_fifo_store,
+		1)) {
+		CAM_ERR(CAM_CDM, "Failed to write CDM commit BL");
+		return true;
+	}
+	return false;
+}
+
+int cam_hw_cdm_submit_gen_irq(
+	struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	uint32_t fifo_idx)
+{
+	struct cam_cdm_bl_cb_request_entry *node;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	struct cam_cdm_bl_request *cdm_cmd = req->data;
+	dma_addr_t hw_vaddr_ptr = 0;
+	int rc;
+	bool bit_wr_enable = false;
+	size_t len, genirq_cmd_size;
+
+	if (core->bl_fifo[fifo_idx].bl_tag > (core->bl_fifo[fifo_idx].bl_depth - 1)) {
+		CAM_ERR(CAM_CDM, "Invalid BL Tag: %d, BL Depth: %d Fifo_idx: %d",
+			core->bl_fifo[fifo_idx].bl_tag,
+			core->bl_fifo[fifo_idx].bl_depth,
+			fifo_idx);
+		return -EINVAL;
+	}
+
+	genirq_cmd_size = 4 * core->ops->cdm_required_size_genirq();
+
+	CAM_DBG(CAM_CDM, "Last Tag: 0x%x Total BLs: %d, Cookie: %d",
+		core->bl_fifo[fifo_idx].bl_tag, cdm_cmd->cmd_arrary_count, cdm_cmd->cookie);
+
+	rc = cam_mem_get_io_buf(cdm_cmd->genirq_buff->handle, core->iommu_hdl.non_secure,
+		&hw_vaddr_ptr, &len, NULL, NULL);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Getting a hwva from mem_hdl failed. rc: %d", rc);
+		return -EINVAL;
+	}
+
+	node = kzalloc(sizeof(struct cam_cdm_bl_cb_request_entry),
+			GFP_KERNEL);
+	if (!node) {
+		CAM_ERR(CAM_CDM, "Failed while getting memory for the Node");
+		return -ENOMEM;
+	}
+
+	if (core->offsets->reg_data->num_bl_fifo > 1)
+		bit_wr_enable = true;
+
+	node->request_type = CAM_HW_CDM_BL_CB_CLIENT;
+	node->client_hdl = req->handle;
+	node->cookie = cdm_cmd->cookie;
+	node->bl_tag = core->bl_fifo[fifo_idx].bl_tag;
+	node->userdata = cdm_cmd->userdata;
+	list_add_tail(&node->entry, &core->bl_fifo[fifo_idx].bl_request_list);
+
+	core->ops->cdm_write_genirq(
+		cdm_cmd->genirq_buff->cpu_addr + (cdm_cmd->genirq_buff->used_bytes / 4),
+		core->bl_fifo[fifo_idx].bl_tag, bit_wr_enable, fifo_idx);
+	rc = cam_hw_cdm_bl_write(cdm_hw,
+		(uint32_t)(hw_vaddr_ptr + cdm_cmd->genirq_buff->offset),
+		genirq_cmd_size - 1,
+		core->bl_fifo[fifo_idx].bl_tag, cdm_cmd->gen_irq_arb, fifo_idx);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CDM hw bl write failed for gen irq bltag=%d",
+			core->bl_fifo[fifo_idx].bl_tag);
+		list_del_init(&node->entry);
+		kfree(node);
+		node = NULL;
+		return -EIO;
+	}
+
+	CAM_DBG(CAM_CDM, "GenIRQ BL: First Word: 0x%llx Second Word: 0x%llx",
+		*(cdm_cmd->genirq_buff->cpu_addr + (cdm_cmd->genirq_buff->used_bytes / 4)),
+		*(cdm_cmd->genirq_buff->cpu_addr + (cdm_cmd->genirq_buff->used_bytes / 4) + 1));
+
+	cdm_cmd->genirq_buff->used_bytes += genirq_cmd_size;
+	cdm_cmd->genirq_buff->offset += genirq_cmd_size;
+
+	if (cam_presil_mode_enabled()) {
+		CAM_DBG(CAM_PRESIL,
+			"Sending CDM gen irq cmd buffer:%d with iommu_hdl:%d",
+			cdm_cmd->genirq_buff->handle, core->iommu_hdl.non_secure);
+
+		rc = cam_mem_mgr_send_buffer_to_presil(core->iommu_hdl.non_secure,
+			cdm_cmd->genirq_buff->handle);
+		if (rc) {
+			CAM_ERR(CAM_PRESIL,
+				"Failed to send CDM gen irq cmd buffer fifo_idx:%d mem_handle:%d rc:%d",
+				fifo_idx, cdm_cmd->genirq_buff->handle, rc);
+			return rc;
+		}
+	}
+
+	if (cam_hw_cdm_commit_bl_write(cdm_hw, fifo_idx)) {
+		CAM_ERR(CAM_CDM,
+			"Cannot commit the genirq BL with Tag: %d",
+			core->bl_fifo[fifo_idx].bl_tag);
+		list_del_init(&node->entry);
+		kfree(node);
+		node = NULL;
+		rc = -EIO;
+	}
+
+	trace_cam_log_event("CDM_START", "CDM_START_IRQ", cdm_cmd->cookie, 0);
+
+	return rc;
+}
+
+int cam_hw_cdm_submit_debug_gen_irq(
+	struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	uint32_t            fifo_idx)
+{
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	struct cam_cdm_bl_request *cdm_cmd = req->data;
+	dma_addr_t hw_vaddr_ptr = 0;
+	int rc;
+	bool bit_wr_enable = false;
+	size_t len, genirq_cmd_size;
+
+	genirq_cmd_size = 4 * core->ops->cdm_required_size_genirq();
+
+	if (core->bl_fifo[fifo_idx].bl_tag > (core->bl_fifo[fifo_idx].bl_depth - 1)) {
+		CAM_ERR(CAM_CDM, "Invalid BL Tag: %d, BL Depth: %d Fifo_idx: %d",
+			core->bl_fifo[fifo_idx].bl_tag,
+			core->bl_fifo[fifo_idx].bl_depth,
+			fifo_idx);
+		return -EINVAL;
+	}
+
+	if ((cdm_cmd->genirq_buff->size - cdm_cmd->genirq_buff->used_bytes) < genirq_cmd_size) {
+		CAM_ERR(CAM_CDM, "Insufficient memory for GenIRQ Command");
+		return -ENOMEM;
+	}
+
+	CAM_DBG(CAM_CDM, "Last Tag: 0x%x Total BLs: %d, Cookie: %d",
+		core->bl_fifo[fifo_idx].bl_tag, cdm_cmd->cmd_arrary_count, cdm_cmd->cookie);
+
+	rc = cam_mem_get_io_buf(cdm_cmd->genirq_buff->handle, core->iommu_hdl.non_secure,
+		&hw_vaddr_ptr, &len, NULL, NULL);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Getting a hwva from mem_hdl failed. rc: %d", rc);
+		return -EINVAL;
+	}
+
+	if (core->offsets->reg_data->num_bl_fifo > 1)
+		bit_wr_enable = true;
+
+	core->ops->cdm_write_genirq(
+		cdm_cmd->genirq_buff->cpu_addr + (cdm_cmd->genirq_buff->used_bytes / 4),
+		CAM_CDM_DBG_GEN_IRQ_USR_DATA, bit_wr_enable, fifo_idx);
+	rc = cam_hw_cdm_bl_write(cdm_hw,
+		(uint32_t)(hw_vaddr_ptr + cdm_cmd->genirq_buff->offset),
+		genirq_cmd_size - 1,
+		core->bl_fifo[fifo_idx].bl_tag,
+		false, fifo_idx);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CDM hw bl write failed for Debug GenIRQ USRdata: %d, Tag: 0x%x",
+			CAM_CDM_DBG_GEN_IRQ_USR_DATA, core->bl_fifo[fifo_idx].bl_tag);
+		return -EIO;
+	}
+
+	cdm_cmd->genirq_buff->used_bytes += genirq_cmd_size;
+	cdm_cmd->genirq_buff->offset += genirq_cmd_size;
+
+	if (cam_hw_cdm_commit_bl_write(cdm_hw, fifo_idx)) {
+		CAM_ERR(CAM_CDM, "Cannot commit the Debug GenIRQ BL with Tag: 0x%x",
+			core->bl_fifo[fifo_idx].bl_tag);
+		return -EIO;
+	}
+
+	return rc;
+}
+
+int cam_hw_cdm_submit_bl(struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	struct cam_cdm_client *client)
+{
+	unsigned int i;
+	int rc = 0;
+	struct cam_cdm_bl_request *cdm_cmd = req->data;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	struct cam_cdm_bl_fifo *bl_fifo = NULL;
+	uint32_t fifo_idx = 0;
+	int write_count = 0;
+
+	fifo_idx = CAM_CDM_GET_BLFIFO_IDX(client->handle);
+
+	CAM_DBG(CAM_CDM, "Submit bl to %s%u", cdm_hw->soc_info.label_name,
+		cdm_hw->soc_info.index);
+	if (fifo_idx >= CAM_CDM_BL_FIFO_MAX) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CDM, "Invalid handle 0x%x, rc = %d",
+			client->handle, rc);
+		goto end;
+	}
+
+	if ((cdm_cmd->genirq_buff->size - cdm_cmd->genirq_buff->used_bytes) <
+		(core->ops->cdm_required_size_genirq() * 4)) {
+		CAM_ERR(CAM_CDM, "Insufficient memory for GenIRQ Command");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bl_fifo = &core->bl_fifo[fifo_idx];
+
+	if (req->data->cmd_arrary_count > bl_fifo->bl_depth) {
+		CAM_INFO(CAM_CDM,
+			"requested BL more than max size, cnt=%d max=%d",
+			req->data->cmd_arrary_count,
+			bl_fifo->bl_depth);
+	}
+
+	mutex_lock(&core->bl_fifo[fifo_idx].fifo_lock);
+	mutex_lock(&client->lock);
+
+	/*
+	 * Check PF status bit to avoid submiting commands to CDM
+	 */
+	if (test_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status) ||
+			test_bit(CAM_CDM_RESET_HW_STATUS, &core->cdm_status) ||
+			test_bit(CAM_CDM_PF_HW_STATUS, &core->cdm_status)) {
+		mutex_unlock(&client->lock);
+		mutex_unlock(&core->bl_fifo[fifo_idx].fifo_lock);
+		return -EAGAIN;
+	}
+
+	for (i = 0; i < req->data->cmd_arrary_count ; i++) {
+		dma_addr_t hw_vaddr_ptr = 0;
+		size_t len = 0;
+
+		if ((!cdm_cmd->cmd_flex[i].len) ||
+				(cdm_cmd->cmd_flex[i].len > CAM_CDM_MAX_BL_LENGTH)) {
+			CAM_ERR(CAM_CDM,
+				"cmd len=: %d is invalid_ent: %d, num_cmd_ent: %d",
+				cdm_cmd->cmd_flex[i].len, i,
+				req->data->cmd_arrary_count);
+			rc = -EINVAL;
+			break;
+		}
+
+		/*
+		 * While commands submission is ongoing, if error/reset/PF occurs, prevent
+		 * further command submission.
+		 */
+		if (test_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status) ||
+				test_bit(CAM_CDM_RESET_HW_STATUS, &core->cdm_status) ||
+				test_bit(CAM_CDM_PF_HW_STATUS, &core->cdm_status)) {
+			CAM_ERR_RATE_LIMIT(CAM_CDM,
+				"In error/reset/PF state cnt=%d total cnt=%d cdm_status 0x%x",
+				i, req->data->cmd_arrary_count,
+				core->cdm_status);
+			rc = -EAGAIN;
+			break;
+		}
+		if (write_count == 0) {
+			write_count = cam_hw_cdm_wait_for_bl_fifo(cdm_hw,
+				(req->data->cmd_arrary_count - i), fifo_idx);
+			if (write_count < 0) {
+				CAM_ERR(CAM_CDM,
+					"wait for bl fifo failed for ent: %u", i);
+				rc = -EIO;
+				break;
+			}
+		}
+
+		if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE) {
+			rc = cam_mem_get_io_buf(cdm_cmd->cmd_flex[i].bl_addr.mem_handle,
+				core->iommu_hdl.non_secure, &hw_vaddr_ptr,
+				&len, NULL, NULL);
+			if (rc) {
+				CAM_ERR(CAM_CDM,
+					"Getting a hwva from mem_hdl failed. rc: %d, cmd_ent: %u",
+					rc, i);
+				rc = -EINVAL;
+				break;
+			}
+		} else if (req->data->type == CAM_CDM_BL_CMD_TYPE_HW_IOVA) {
+			if (!cdm_cmd->cmd_flex[i].bl_addr.hw_iova) {
+				CAM_ERR(CAM_CDM, "hw_iova is null for ent: %d", i);
+				rc = -EINVAL;
+				break;
+			}
+
+			hw_vaddr_ptr = (dma_addr_t)cdm_cmd->cmd_flex[i].bl_addr.hw_iova;
+			len = cdm_cmd->cmd_flex[i].len + cdm_cmd->cmd_flex[i].offset;
+		} else {
+			CAM_ERR(CAM_CDM,
+				"Only mem hdl/hw va type is supported %d",
+				req->data->type);
+			rc = -EINVAL;
+			break;
+		}
+
+		if ((hw_vaddr_ptr) && (len) && (len >= cdm_cmd->cmd_flex[i].offset)) {
+			if ((len - cdm_cmd->cmd_flex[i].offset) < cdm_cmd->cmd_flex[i].len) {
+				CAM_ERR(CAM_CDM,
+					"Not enough buffer cmd offset: %u cmd length: %u",
+					cdm_cmd->cmd_flex[i].offset,
+					cdm_cmd->cmd_flex[i].len);
+				rc = -EINVAL;
+				break;
+			}
+
+			CAM_DBG(CAM_CDM, "Got the hwva: %pK, type: %u",
+				hw_vaddr_ptr, req->data->type);
+
+			rc = cam_hw_cdm_bl_write(cdm_hw,
+				((uint32_t)hw_vaddr_ptr + cdm_cmd->cmd_flex[i].offset),
+				(cdm_cmd->cmd_flex[i].len - 1),
+				core->bl_fifo[fifo_idx].bl_tag,
+				cdm_cmd->cmd_flex[i].arbitrate,
+				fifo_idx);
+			if (rc) {
+				CAM_ERR(CAM_CDM, "Hw bl write failed %d:%d",
+					i, req->data->cmd_arrary_count);
+				rc = -EIO;
+				break;
+			}
+
+			if (cam_hw_cdm_commit_bl_write(cdm_hw, fifo_idx)) {
+				CAM_ERR(CAM_CDM, "Commit failed for BL: %d Tag: %u",
+					i, core->bl_fifo[fifo_idx].bl_tag);
+				rc = -EIO;
+				break;
+			}
+
+			CAM_DBG(CAM_CDM, "Commit success for BL: %d of %d, Tag: %u", (i + 1),
+				req->data->cmd_arrary_count,
+				core->bl_fifo[fifo_idx].bl_tag);
+
+			write_count--;
+			core->bl_fifo[fifo_idx].bl_tag++;
+			core->bl_fifo[fifo_idx].bl_tag %= (bl_fifo->bl_depth - 1);
+
+			if (cdm_cmd->cmd_flex[i].enable_debug_gen_irq) {
+				if (write_count == 0) {
+					write_count =
+						cam_hw_cdm_wait_for_bl_fifo(cdm_hw, 1, fifo_idx);
+					if (write_count < 0) {
+						CAM_ERR(CAM_CDM, "wait for bl fifo failed %d:%d",
+							i, req->data->cmd_arrary_count);
+						rc = -EIO;
+						break;
+					}
+				}
+
+				rc = cam_hw_cdm_submit_debug_gen_irq(cdm_hw, req, fifo_idx);
+				if (!rc) {
+					CAM_DBG(CAM_CDM,
+						"Commit success for Dbg_GenIRQ_BL, Tag: %d",
+						core->bl_fifo[fifo_idx].bl_tag);
+					write_count--;
+					core->bl_fifo[fifo_idx].bl_tag++;
+					core->bl_fifo[fifo_idx].bl_tag %= (bl_fifo->bl_depth - 1);
+				} else {
+					CAM_WARN(CAM_CDM,
+						"Failed in submitting the debug gen entry. rc: %d",
+						rc);
+					continue;
+				}
+			}
+
+			if (req->data->flag && (i == (req->data->cmd_arrary_count - 1))) {
+
+				if (write_count == 0) {
+					write_count =
+						cam_hw_cdm_wait_for_bl_fifo(cdm_hw, 1, fifo_idx);
+					if (write_count < 0) {
+						CAM_ERR(CAM_CDM, "wait for bl fifo failed %d:%d",
+							i, req->data->cmd_arrary_count);
+						rc = -EIO;
+						break;
+					}
+				}
+
+				if (core->arbitration == CAM_CDM_ARBITRATION_PRIORITY_BASED)
+					cdm_cmd->gen_irq_arb = true;
+				else
+					cdm_cmd->gen_irq_arb = false;
+
+				rc = cam_hw_cdm_submit_gen_irq(cdm_hw, req, fifo_idx);
+				if (!rc) {
+					CAM_DBG(CAM_CDM, "Commit success for GenIRQ_BL, Tag: %d",
+						core->bl_fifo[fifo_idx].bl_tag);
+					core->bl_fifo[fifo_idx].bl_tag++;
+					core->bl_fifo[fifo_idx].bl_tag %= (bl_fifo->bl_depth - 1);
+				}
+			}
+		} else {
+			CAM_ERR(CAM_CDM,
+				"Sanity check failed for cdm_cmd: %d, Hdl: 0x%x, len: %zu, offset: 0x%x, num_cmds: %d",
+				i, cdm_cmd->cmd_flex[i].bl_addr.mem_handle, len,
+				cdm_cmd->cmd_flex[i].offset, req->data->cmd_arrary_count);
+			rc = -EINVAL;
+			break;
+		}
+	}
+	mutex_unlock(&client->lock);
+	mutex_unlock(&core->bl_fifo[fifo_idx].fifo_lock);
+
+end:
+	return rc;
+
+}
+
+static void cam_hw_cdm_reset_cleanup(
+	struct cam_hw_info *cdm_hw,
+	uint32_t            handle)
+{
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	int i;
+	struct cam_cdm_bl_cb_request_entry *node, *tnode;
+	bool flush_hw = false;
+	bool reset_err = false;
+
+	if (test_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status) ||
+		test_bit(CAM_CDM_FLUSH_HW_STATUS, &core->cdm_status))
+		flush_hw = true;
+
+	if (test_bit(CAM_CDM_RESET_ERR_STATUS, &core->cdm_status))
+		reset_err = true;
+
+	for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++) {
+		list_for_each_entry_safe(node, tnode,
+			&core->bl_fifo[i].bl_request_list, entry) {
+			if (node->request_type ==
+					CAM_HW_CDM_BL_CB_CLIENT) {
+				CAM_DBG(CAM_CDM,
+					"Notifying client %d for tag %d",
+					node->client_hdl, node->bl_tag);
+				if (flush_hw) {
+					enum cam_cdm_cb_status status;
+
+					status = reset_err ?
+						CAM_CDM_CB_STATUS_HW_ERROR :
+						CAM_CDM_CB_STATUS_HW_RESUBMIT;
+
+					cam_cdm_notify_clients(cdm_hw,
+						(node->client_hdl == handle) ?
+						CAM_CDM_CB_STATUS_HW_FLUSH :
+						status,
+						(void *)node);
+				}
+				else
+					cam_cdm_notify_clients(cdm_hw,
+						CAM_CDM_CB_STATUS_HW_RESET_DONE,
+						(void *)node);
+			}
+			list_del_init(&node->entry);
+			kfree(node);
+			node = NULL;
+		}
+		core->bl_fifo[i].bl_tag = 0;
+		core->bl_fifo[i].last_bl_tag_done = -1;
+		atomic_set(&core->bl_fifo[i].work_record, 0);
+	}
+}
+
+static void cam_hw_cdm_work(struct work_struct *work)
+{
+	struct cam_cdm_work_payload *payload;
+	struct cam_hw_info *cdm_hw;
+	struct cam_cdm *core;
+	int i, fifo_idx;
+	struct cam_cdm_bl_cb_request_entry *tnode = NULL;
+	struct cam_cdm_bl_cb_request_entry *node = NULL;
+
+	payload = container_of(work, struct cam_cdm_work_payload, work);
+	if (!payload) {
+		CAM_ERR(CAM_CDM, "NULL payload");
+		return;
+	}
+
+	cdm_hw = payload->hw;
+	core = (struct cam_cdm *)cdm_hw->core_info;
+	fifo_idx = payload->fifo_idx;
+	if ((fifo_idx >= core->offsets->reg_data->num_bl_fifo) ||
+		(!core->bl_fifo[fifo_idx].bl_depth)) {
+		CAM_ERR(CAM_CDM, "Invalid fifo idx %d",
+			fifo_idx);
+		kfree(payload);
+		payload = NULL;
+		return;
+	}
+
+	cam_common_util_thread_switch_delay_detect(
+		"cam_cdm_workq", "schedule", cam_hw_cdm_work,
+		payload->workq_scheduled_ts,
+		CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+
+	CAM_DBG(CAM_CDM, "IRQ status=0x%x", payload->irq_status);
+	if (payload->irq_status &
+		CAM_CDM_IRQ_STATUS_INLINE_IRQ_MASK) {
+		CAM_DBG(CAM_CDM, "inline IRQ data=0x%x last tag: 0x%x",
+			payload->irq_data, core->bl_fifo[payload->fifo_idx].last_bl_tag_done);
+
+		if (payload->irq_data == 0xff) {
+			CAM_INFO(CAM_CDM, "%s%u Debug genirq received",
+				cdm_hw->soc_info.label_name,
+				cdm_hw->soc_info.index);
+			kfree(payload);
+			payload = NULL;
+			return;
+		}
+
+		mutex_lock(&cdm_hw->hw_mutex);
+		mutex_lock(&core->bl_fifo[fifo_idx].fifo_lock);
+
+		if (atomic_read(&core->bl_fifo[fifo_idx].work_record))
+			atomic_dec(&core->bl_fifo[fifo_idx].work_record);
+
+		if (list_empty(&core->bl_fifo[fifo_idx].bl_request_list)) {
+			CAM_INFO(CAM_CDM, "Fifo list empty, idx %d tag %d arb %d",
+				fifo_idx, payload->irq_data, core->arbitration);
+			mutex_unlock(&core->bl_fifo[fifo_idx].fifo_lock);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			kfree(payload);
+			payload = NULL;
+			return;
+		}
+
+		if (core->bl_fifo[fifo_idx].last_bl_tag_done != payload->irq_data) {
+			core->bl_fifo[fifo_idx].last_bl_tag_done = payload->irq_data;
+			list_for_each_entry_safe(node, tnode,
+				&core->bl_fifo[fifo_idx].bl_request_list, entry) {
+				if (node->request_type == CAM_HW_CDM_BL_CB_CLIENT) {
+					cam_cdm_notify_clients(cdm_hw,
+						CAM_CDM_CB_STATUS_BL_SUCCESS, (void *)node);
+				} else if (node->request_type == CAM_HW_CDM_BL_CB_INTERNAL) {
+					CAM_ERR(CAM_CDM, "Invalid node=%pK %d",
+						node, node->request_type);
+				}
+
+				list_del_init(&node->entry);
+				if (node->bl_tag == payload->irq_data) {
+					kfree(node);
+					node = NULL;
+					break;
+				}
+
+				kfree(node);
+				node = NULL;
+			}
+		} else {
+			CAM_INFO(CAM_CDM, "Skip GenIRQ, tag 0x%x fifo %d",
+				payload->irq_data, payload->fifo_idx);
+		}
+
+		mutex_unlock(&core->bl_fifo[payload->fifo_idx].fifo_lock);
+		mutex_unlock(&cdm_hw->hw_mutex);
+	}
+
+	if (payload->irq_status &
+		CAM_CDM_IRQ_STATUS_BL_DONE_MASK) {
+		if (test_bit(payload->fifo_idx, &core->cdm_status)) {
+			CAM_DBG(CAM_CDM, "%s%u HW BL done IRQ",
+				cdm_hw->soc_info.label_name, cdm_hw->soc_info.index);
+			complete(&core->bl_fifo[payload->fifo_idx].bl_complete);
+		}
+	}
+	if (payload->irq_status &
+		CAM_CDM_IRQ_STATUS_ERRORS) {
+		int reset_hw_hdl = 0x0;
+
+		CAM_ERR_RATE_LIMIT(CAM_CDM, "%s%u Error IRQ status %d\n",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index, payload->irq_status);
+		set_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status);
+		mutex_lock(&cdm_hw->hw_mutex);
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++)
+			mutex_lock(&core->bl_fifo[i].fifo_lock);
+
+		cam_hw_cdm_dump_core_debug_registers(cdm_hw, true);
+
+		if (payload->irq_status &
+		CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK) {
+			node = list_first_entry_or_null(
+			&core->bl_fifo[payload->fifo_idx].bl_request_list,
+			struct cam_cdm_bl_cb_request_entry, entry);
+
+			if (node != NULL) {
+				if (node->request_type ==
+					CAM_HW_CDM_BL_CB_CLIENT) {
+					cam_cdm_notify_clients(cdm_hw,
+					CAM_CDM_CB_STATUS_INVALID_BL_CMD,
+						(void *)node);
+				} else if (node->request_type ==
+					CAM_HW_CDM_BL_CB_INTERNAL) {
+					CAM_ERR(CAM_CDM,
+						"Invalid node=%pK %d", node,
+						node->request_type);
+				}
+				list_del_init(&node->entry);
+				kfree(node);
+			}
+		}
+
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++)
+			mutex_unlock(&core->bl_fifo[i].fifo_lock);
+
+		if (payload->irq_status &
+			CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK)
+			cam_hw_cdm_reset_hw(cdm_hw, reset_hw_hdl);
+
+		mutex_unlock(&cdm_hw->hw_mutex);
+		if (!(payload->irq_status &
+				CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK))
+			clear_bit(CAM_CDM_ERROR_HW_STATUS,
+				&core->cdm_status);
+	}
+
+	kfree(payload);
+	payload = NULL;
+
+}
+
+static void cam_hw_cdm_iommu_fault_handler(struct cam_smmu_pf_info *pf_info)
+{
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_cdm *core = NULL;
+	struct cam_cdm_private_dt_data *pvt_data;
+	int i, rc;
+
+	if (!pf_info) {
+		CAM_ERR(CAM_CDM, "pf_info is null");
+		return;
+	}
+
+	if (pf_info->token) {
+		cdm_hw = (struct cam_hw_info *)pf_info->token;
+		core = (struct cam_cdm *)cdm_hw->core_info;
+		pvt_data = (struct cam_cdm_private_dt_data *) cdm_hw->soc_info.soc_private;
+		CAM_ERR_RATE_LIMIT(CAM_CDM, "Page fault iova addr %pK\n",
+			(void *)pf_info->iova);
+
+		/* Check if the PID and MID are valid, if not handle the pf */
+		if ((pvt_data->pid >= 0) && (pvt_data->mid >= 0)) {
+			if (((pf_info->pid == pvt_data->pid) && (pf_info->mid == pvt_data->mid)))
+				goto handle_cdm_pf;
+			else
+				return;
+		}
+
+handle_cdm_pf:
+
+		CAM_ERR(CAM_CDM, "Page Fault on %s%u, flags: %u, status: %llu",
+			core->name, core->id, core->flags, core->cdm_status);
+		set_bit(CAM_CDM_PF_HW_STATUS, &core->cdm_status);
+		mutex_lock(&cdm_hw->hw_mutex);
+		/* Pausing CDM HW from doing any further memory transactions */
+		cam_hw_cdm_pause_core(cdm_hw, true);
+
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++)
+			mutex_lock(&core->bl_fifo[i].fifo_lock);
+
+		if (cdm_hw->hw_state == CAM_HW_STATE_POWER_UP) {
+			cam_hw_cdm_dump_core_debug_registers(cdm_hw, true);
+		} else
+			CAM_INFO(CAM_CDM, "%s%u hw is power in off state",
+				cdm_hw->soc_info.label_name,
+				cdm_hw->soc_info.index);
+
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++)
+			mutex_unlock(&core->bl_fifo[i].fifo_lock);
+
+		/* Notify clients to handle PF event */
+		cam_cdm_notify_clients(cdm_hw, CAM_CDM_CB_STATUS_PAGEFAULT, (void *)pf_info);
+		/* Stream off CDM completely */
+		rc = cam_cdm_pf_stream_off_all_clients(cdm_hw);
+		if (rc)
+			CAM_ERR(CAM_CDM, "Stream off failed for %s%u rc: %d",
+				core->name, core->id, rc);
+		mutex_unlock(&cdm_hw->hw_mutex);
+	} else {
+		CAM_ERR(CAM_CDM, "Invalid token");
+	}
+}
+
+irqreturn_t cam_hw_cdm_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *cdm_hw = data;
+	struct cam_hw_soc_info *soc_info = &cdm_hw->soc_info;
+	struct cam_cdm *cdm_core = cdm_hw->core_info;
+	struct cam_cdm_work_payload *payload[CAM_CDM_BL_FIFO_MAX] = {0};
+	uint8_t rst_done_cnt = 0;
+	uint32_t user_data = 0;
+	uint32_t irq_status[CAM_CDM_BL_FIFO_MAX] = {0};
+	uint32_t irq_context_summary = 0xF;
+	bool work_status;
+	int i;
+
+	CAM_DBG(CAM_CDM, "Got irq hw_version 0x%x from %s%u",
+		cdm_core->hw_version, soc_info->label_name,
+		soc_info->index);
+	cam_hw_util_hw_lock(cdm_hw);
+	if (cdm_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_DBG(CAM_CDM, "CDM is in power down state");
+		cam_hw_util_hw_unlock(cdm_hw);
+		return IRQ_HANDLED;
+	}
+	if (cdm_core->hw_version >= CAM_CDM_VERSION_2_1) {
+		if (cam_cdm_read_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->irq_context_status,
+			&irq_context_summary)) {
+			CAM_ERR(CAM_CDM, "Failed to read CDM HW IRQ status");
+		}
+	}
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo_irq; i++) {
+		if (!(BIT(i) & irq_context_summary)) {
+			continue;
+		}
+		if (cam_cdm_read_hw_reg(cdm_hw,
+			cdm_core->offsets->irq_reg[i]->irq_status,
+			&irq_status[i])) {
+			CAM_ERR(CAM_CDM, "Failed to read %s%u HW IRQ status",
+				soc_info->label_name,
+				soc_info->index);
+		}
+		if (cam_cdm_write_hw_reg(cdm_hw,
+			cdm_core->offsets->irq_reg[i]->irq_clear,
+			irq_status[i])) {
+			CAM_ERR(CAM_CDM, "Failed to Write %s%u HW IRQ Clear",
+				soc_info->label_name,
+				soc_info->index);
+		}
+	}
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+		cdm_core->offsets->irq_reg[0]->irq_clear_cmd, 0x01))
+		CAM_ERR(CAM_CDM, "Failed to Write %s%u HW IRQ clr cmd",
+				soc_info->label_name,
+				soc_info->index);
+	if (cam_cdm_read_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->usr_data,
+			&user_data))
+		CAM_ERR(CAM_CDM, "Failed to read %s%u HW IRQ data",
+				soc_info->label_name,
+				soc_info->index);
+
+	cam_hw_util_hw_unlock(cdm_hw);
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo_irq; i++) {
+		if (!irq_status[i])
+			continue;
+
+		if (irq_status[i] & CAM_CDM_IRQ_STATUS_RST_DONE_MASK) {
+			rst_done_cnt++;
+			continue;
+		}
+
+		payload[i] = kzalloc(sizeof(struct cam_cdm_work_payload),
+			GFP_ATOMIC);
+
+		if (!payload[i]) {
+			CAM_ERR(CAM_CDM,
+				"failed to allocate memory for fifo %d payload",
+				i);
+			continue;
+		}
+
+		if (irq_status[i] & CAM_CDM_IRQ_STATUS_INLINE_IRQ_MASK) {
+
+			payload[i]->irq_data = (user_data >> (i * 0x8)) &
+				CAM_CDM_IRQ_STATUS_USR_DATA_MASK;
+
+			if (payload[i]->irq_data == CAM_CDM_DBG_GEN_IRQ_USR_DATA)
+				CAM_INFO(CAM_CDM, "Debug gen_irq received");
+
+			atomic_inc(&cdm_core->bl_fifo[i].work_record);
+		}
+
+		CAM_DBG(CAM_CDM,
+			"Rcvd of fifo %d userdata 0x%x tag 0x%x irq_stat 0x%x",
+			i, user_data, payload[i]->irq_data, irq_status[i]);
+
+		payload[i]->fifo_idx = i;
+		payload[i]->irq_status = irq_status[i];
+		payload[i]->hw = cdm_hw;
+
+		INIT_WORK((struct work_struct *)&payload[i]->work,
+			cam_hw_cdm_work);
+
+		trace_cam_log_event("CDM_DONE", "CDM_DONE_IRQ",
+			payload[i]->irq_status,
+			cdm_hw->soc_info.index);
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				cdm_core->offsets->irq_reg[i]->irq_clear,
+				payload[i]->irq_status)) {
+			CAM_ERR(CAM_CDM, "Failed to Write %s%u HW IRQ Clear",
+				soc_info->label_name,
+				soc_info->index);
+			kfree(payload[i]);
+			return IRQ_HANDLED;
+		}
+
+		payload[i]->workq_scheduled_ts = ktime_get();
+
+		work_status = queue_work(
+			cdm_core->bl_fifo[i].work_queue,
+			&payload[i]->work);
+
+		if (work_status == false) {
+			CAM_ERR(CAM_CDM,
+				"Failed to queue work for FIFO: %d irq=0x%x",
+				i, payload[i]->irq_status);
+			kfree(payload[i]);
+			payload[i] = NULL;
+		}
+	}
+	if (rst_done_cnt == cdm_core->offsets->reg_data->num_bl_fifo_irq) {
+		CAM_DBG(CAM_CDM, "%s%u HW reset done IRQ",
+			soc_info->label_name,
+			soc_info->index);
+		complete(&cdm_core->reset_complete);
+	}
+	if (rst_done_cnt &&
+		(rst_done_cnt != cdm_core->offsets->reg_data->num_bl_fifo_irq))
+		CAM_INFO(CAM_CDM,
+			"%s%u Reset IRQ received for %d fifos instead of %d",
+			soc_info->label_name,
+			soc_info->index, rst_done_cnt,
+			cdm_core->offsets->reg_data->num_bl_fifo_irq);
+	return IRQ_HANDLED;
+}
+
+int cam_hw_cdm_reset_hw(struct cam_hw_info *cdm_hw, uint32_t handle)
+{
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_hw_soc_info *soc_info = &cdm_hw->soc_info;
+	long time_left;
+	int i, rc = -EIO;
+	int reset_val = 1;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_lock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	set_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+
+	reinit_completion(&cdm_core->reset_complete);
+
+	cam_hw_cdm_pause_core(cdm_hw, true);
+
+	if (cam_cdm_write_hw_reg(cdm_hw, cdm_core->offsets->cmn_reg->rst_cmd, reset_val)) {
+		CAM_ERR(CAM_CDM, "Failed to Write %s%u HW reset",
+			soc_info->label_name,
+			soc_info->index);
+		goto end;
+	}
+
+	CAM_DBG(CAM_CDM, "Waiting for %s%u HW reset done", soc_info->label_name, soc_info->index);
+	time_left = cam_common_wait_for_completion_timeout(
+			&cdm_core->reset_complete,
+			msecs_to_jiffies(CAM_CDM_HW_RESET_TIMEOUT));
+
+	if (time_left <= 0) {
+		rc = -ETIMEDOUT;
+
+		CAM_ERR(CAM_CDM, "%s%u HW reset Wait failed rc=%d",
+			soc_info->label_name,
+			soc_info->index, rc);
+
+		cam_hw_cdm_dump_core_debug_registers(cdm_hw, false);
+		cam_hw_cdm_pause_core(cdm_hw, false);
+		goto end;
+	}
+
+	rc = cam_hw_cdm_set_cdm_core_cfg(cdm_hw);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to configure %s%u rc=%d",
+			soc_info->label_name,
+			soc_info->index, rc);
+		goto end;
+	}
+
+	rc = cam_hw_cdm_set_cdm_blfifo_cfg(cdm_hw);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to configure %s%u fifo rc=%d",
+			soc_info->label_name,
+			soc_info->index, rc);
+		goto end;
+	}
+
+	cam_hw_cdm_reset_cleanup(cdm_hw, handle);
+end:
+	clear_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_unlock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	return rc;
+}
+
+int cam_hw_cdm_handle_error_info(
+	struct cam_hw_info *cdm_hw,
+	uint32_t            handle)
+{
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_cdm_bl_cb_request_entry *node = NULL;
+	long time_left;
+	int i, rc = -EIO, reset_hw_hdl = 0x0;
+	uint32_t current_bl_data = 0, current_fifo = 0, current_tag = 0;
+	int reset_val = 1;
+	struct cam_hw_soc_info *soc_info = &cdm_hw->soc_info;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_lock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	reinit_completion(&cdm_core->reset_complete);
+	set_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	set_bit(CAM_CDM_FLUSH_HW_STATUS, &cdm_core->cdm_status);
+
+	if (cdm_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_CDM, "CDM is in power down state");
+		goto end;
+	}
+
+	cam_hw_cdm_pause_core(cdm_hw, true);
+
+	rc = cam_cdm_read_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->current_bl_len,
+			&current_bl_data);
+
+	current_fifo = ((CAM_CDM_CURRENT_BL_FIFO & current_bl_data)
+		>> CAM_CDM_CURRENT_BL_FIFO_SHIFT);
+	current_tag = ((CAM_CDM_CURRENT_BL_TAG & current_bl_data)
+		>> CAM_CDM_CURRENT_BL_TAG_SHIFT);
+
+	if (current_fifo >= CAM_CDM_BL_FIFO_MAX) {
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_ERR(CAM_CDM, "Hang detected for %s%u's fifo %d with tag 0x%x",
+		soc_info->label_name, soc_info->index,
+		current_fifo, current_tag);
+
+	/* dump cdm registers for further debug */
+	cam_hw_cdm_dump_core_debug_registers(cdm_hw, false);
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		if (!cdm_core->bl_fifo[i].bl_depth)
+			continue;
+
+		reset_val = reset_val |
+			(1 << (i + CAM_CDM_BL_FIFO_FLUSH_SHIFT));
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				cdm_core->offsets->irq_reg[i]->irq_mask,
+				0x70003)) {
+			CAM_ERR(CAM_CDM, "Failed to Write CDM HW IRQ mask");
+			goto end;
+		}
+	}
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->rst_cmd, reset_val)) {
+		CAM_ERR(CAM_CDM, "Failed to Write CDM HW reset");
+		goto end;
+	}
+
+	CAM_DBG(CAM_CDM, "Waiting for CDM HW resetdone");
+	time_left = cam_common_wait_for_completion_timeout(
+			&cdm_core->reset_complete,
+			msecs_to_jiffies(CAM_CDM_HW_RESET_TIMEOUT));
+
+	if (time_left <= 0) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_CDM, "CDM HW reset Wait failed rc=%d", rc);
+		set_bit(CAM_CDM_RESET_ERR_STATUS, &cdm_core->cdm_status);
+	}
+
+	rc = cam_hw_cdm_set_cdm_core_cfg(cdm_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to configure CDM rc=%d", rc);
+		goto end;
+	}
+
+	rc = cam_hw_cdm_set_cdm_blfifo_cfg(cdm_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to configure CDM fifo rc=%d", rc);
+		goto end;
+	}
+
+	node = list_first_entry_or_null(
+			&cdm_core->bl_fifo[current_fifo].bl_request_list,
+			struct cam_cdm_bl_cb_request_entry, entry);
+
+	if (node != NULL) {
+		if (node->request_type == CAM_HW_CDM_BL_CB_CLIENT) {
+			cam_cdm_notify_clients(cdm_hw,
+					CAM_CDM_CB_STATUS_HW_ERROR,
+					(void *)node);
+		} else if (node->request_type == CAM_HW_CDM_BL_CB_INTERNAL) {
+			CAM_ERR(CAM_CDM, "Invalid node=%pK %d", node,
+					node->request_type);
+		}
+		list_del_init(&node->entry);
+		kfree(node);
+		node = NULL;
+	}
+
+	cam_hw_cdm_reset_cleanup(cdm_hw, reset_hw_hdl);
+end:
+	clear_bit(CAM_CDM_FLUSH_HW_STATUS, &cdm_core->cdm_status);
+	clear_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	clear_bit(CAM_CDM_RESET_ERR_STATUS, &cdm_core->cdm_status);
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_unlock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	return rc;
+}
+
+int cam_hw_cdm_flush_hw(struct cam_hw_info *cdm_hw, uint32_t handle)
+{
+	struct cam_cdm *cdm_core = NULL;
+	int rc = 0;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	set_bit(CAM_CDM_FLUSH_HW_STATUS, &cdm_core->cdm_status);
+	rc = cam_hw_cdm_reset_hw(cdm_hw, handle);
+	clear_bit(CAM_CDM_FLUSH_HW_STATUS, &cdm_core->cdm_status);
+
+	return rc;
+}
+
+int cam_hw_cdm_hang_detect(
+	struct cam_hw_info *cdm_hw,
+	uint32_t            handle)
+{
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_hw_soc_info *soc_info;
+	int i, rc = -1;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+	soc_info = &cdm_hw->soc_info;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		if (atomic_read(&cdm_core->bl_fifo[i].work_record)) {
+			CAM_WARN(CAM_CDM,
+				"fifo: %d Workqueue got delayed for %s%u, work_record :%u",
+				i, soc_info->label_name, soc_info->index,
+				atomic_read(&cdm_core->bl_fifo[i].work_record));
+			rc = 0;
+			break;
+		}
+
+	return rc;
+}
+
+int cam_hw_cdm_get_cdm_config(struct cam_hw_info *cdm_hw)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cdm *core = NULL;
+	int rc = 0, ret = 0;
+
+	core = (struct cam_cdm *)cdm_hw->core_info;
+	soc_info = &cdm_hw->soc_info;
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+			soc_info->lowest_clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Enable platform failed for dev %s",
+				soc_info->dev_name);
+		goto end;
+	} else {
+		CAM_DBG(CAM_CDM, "%s%u init success",
+			soc_info->label_name, soc_info->index);
+		cdm_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	}
+
+	if (cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->cdm_hw_version,
+			&core->hw_version)) {
+		CAM_ERR(CAM_CDM, "Failed to read HW Version for %s%u",
+			soc_info->label_name, soc_info->index);
+		rc = -EIO;
+		goto disable_platform_resource;
+	}
+
+	if (core->offsets->cmn_reg->cam_version) {
+		if (cam_cdm_read_hw_reg(cdm_hw,
+				core->offsets->cmn_reg->cam_version->hw_version,
+				&core->hw_family_version)) {
+			CAM_ERR(CAM_CDM, "Failed to read %s%d family Version",
+				soc_info->label_name, soc_info->index);
+			rc = -EIO;
+			goto disable_platform_resource;
+		}
+	}
+
+	if (cam_presil_mode_enabled()) {
+		uint32_t override_family = 0;
+		uint32_t override_version = 0;
+
+		rc = of_property_read_u32(soc_info->pdev->dev.of_node,
+			"override-cdm-family", &override_family);
+		if (rc) {
+			CAM_INFO(CAM_CDM,
+				"no cdm family override,using current hw family 0x%x",
+				core->hw_family_version);
+			rc = 0;
+		} else {
+			core->hw_family_version = override_family;
+		}
+
+		rc = of_property_read_u32(soc_info->pdev->dev.of_node,
+			"override-cdm-version", &override_version);
+		if (rc) {
+			CAM_INFO(CAM_CDM,
+				"no cdm version override,using current hw version 0x%x",
+				core->hw_version);
+			rc = 0;
+		} else {
+			core->hw_version = override_version;
+		}
+	}
+
+	CAM_DBG(CAM_CDM,
+		"%s%d Hw version read success family =%x hw =%x",
+		soc_info->label_name, soc_info->index,
+		core->hw_family_version, core->hw_version);
+
+	core->ops = cam_cdm_get_ops(core->hw_version, NULL,
+		false);
+
+	if (!core->ops) {
+		CAM_ERR(CAM_CDM, "Failed to util ops for cdm hw name %s",
+			core->name);
+		rc = -EINVAL;
+		goto disable_platform_resource;
+	}
+
+disable_platform_resource:
+	ret = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (ret) {
+		CAM_ERR(CAM_CDM, "disable platform failed for dev %s",
+				soc_info->dev_name);
+	} else {
+		CAM_DBG(CAM_CDM, "%s%d Deinit success",
+			soc_info->label_name, soc_info->index);
+		cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	}
+end:
+	return rc;
+}
+
+int cam_hw_cdm_init(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	int rc, i, reset_hw_hdl = 0x0;
+	unsigned long flags = 0;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	soc_info = &cdm_hw->soc_info;
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		soc_info->lowest_clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Enable platform failed for %s%d",
+			soc_info->label_name, soc_info->index);
+		goto end;
+	}
+	flags = cam_hw_util_hw_lock_irqsave(cdm_hw);
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	cam_hw_util_hw_unlock_irqrestore(cdm_hw, flags);
+
+	CAM_DBG(CAM_CDM, "Enable soc done for %s%d",
+		soc_info->label_name, soc_info->index);
+
+/* Before triggering the reset to HW, clear the reset complete */
+	clear_bit(CAM_CDM_ERROR_HW_STATUS, &cdm_core->cdm_status);
+
+	for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+		clear_bit(i, &cdm_core->cdm_status);
+		reinit_completion(&cdm_core->bl_fifo[i].bl_complete);
+	}
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		cdm_core->bl_fifo[i].last_bl_tag_done = -1;
+		atomic_set(&cdm_core->bl_fifo[i].work_record, 0);
+	}
+
+	rc = cam_hw_cdm_reset_hw(cdm_hw, reset_hw_hdl);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "%s%u HW reset Wait failed rc=%d",
+			soc_info->label_name,
+			soc_info->index, rc);
+		goto disable_return;
+	}
+
+	CAM_DBG(CAM_CDM, "%s%u Init success", soc_info->label_name, soc_info->index);
+	return 0;
+
+disable_return:
+	rc = -EIO;
+	flags = cam_hw_util_hw_lock_irqsave(cdm_hw);
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	cam_hw_util_hw_unlock_irqrestore(cdm_hw, flags);
+	cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+end:
+	return rc;
+}
+
+static inline void cam_hw_cdm_clear_bl_requests(struct cam_cdm *cdm_core)
+{
+	struct cam_cdm_bl_cb_request_entry *node, *tnode;
+	int i;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		list_for_each_entry_safe(node, tnode,
+			&cdm_core->bl_fifo[i].bl_request_list, entry) {
+			list_del_init(&node->entry);
+			kfree(node);
+			node = NULL;
+		}
+	}
+}
+
+int cam_hw_cdm_pf_deinit(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	int i, rc;
+	unsigned long flags = 0;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	soc_info = &cdm_hw->soc_info;
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_lock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	/* clear bl request */
+	cam_hw_cdm_clear_bl_requests(cdm_core);
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_unlock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	flags = cam_hw_util_hw_lock_irqsave(cdm_hw);
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	cam_hw_util_hw_unlock_irqrestore(cdm_hw, flags);
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc)
+		CAM_ERR(CAM_CDM, "disable platform failed for %s%u",
+			soc_info->label_name, soc_info->index);
+	else
+		CAM_DBG(CAM_CDM, "%s%u Deinit success",
+			soc_info->label_name, soc_info->index);
+
+	return rc;
+}
+
+int cam_hw_cdm_deinit(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	int rc = 0, i;
+	uint32_t reset_val = 1;
+	long time_left;
+	unsigned long flags = 0;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	soc_info = &cdm_hw->soc_info;
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_lock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	/*clear bl request */
+	cam_hw_cdm_clear_bl_requests(cdm_core);
+
+	set_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	reinit_completion(&cdm_core->reset_complete);
+
+	cam_hw_cdm_pause_core(cdm_hw, true);
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		if (!cdm_core->bl_fifo[i].bl_depth)
+			continue;
+
+		reset_val = reset_val |
+			(1 << (i + CAM_CDM_BL_FIFO_FLUSH_SHIFT));
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				cdm_core->offsets->irq_reg[i]->irq_mask,
+				0x70003)) {
+			CAM_ERR(CAM_CDM, "Failed to Write CDM HW IRQ mask");
+		}
+	}
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->rst_cmd, reset_val)) {
+		CAM_ERR(CAM_CDM, "Failed to Write CDM HW reset");
+	}
+
+	CAM_DBG(CAM_CDM, "Waiting for %s%u HW reset done",
+		soc_info->label_name, soc_info->index);
+	time_left = cam_common_wait_for_completion_timeout(
+			&cdm_core->reset_complete,
+			msecs_to_jiffies(CAM_CDM_HW_RESET_TIMEOUT));
+
+	if (time_left <= 0) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_CDM, "%s%u HW reset Wait failed rc=%d",
+		soc_info->label_name, soc_info->index, rc);
+	}
+
+	clear_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_unlock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	flags = cam_hw_util_hw_lock_irqsave(cdm_hw);
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	cam_hw_util_hw_unlock_irqrestore(cdm_hw, flags);
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "disable platform failed for %s%u",
+			soc_info->label_name, soc_info->index);
+	} else {
+		CAM_DBG(CAM_CDM, "%s%u Deinit success",
+			soc_info->label_name, soc_info->index);
+	}
+
+	return rc;
+}
+
+#ifdef CONFIG_CAM_TEST_IRQ_LINE
+static int cam_cdm_test_irq_line(void *hw_priv)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_cdm *core = NULL;
+	int rc = 0;
+
+	if (!cdm_hw) {
+		CAM_ERR(CAM_CDM, "Invalid cdm hw");
+		return -EINVAL;
+	}
+
+	core = (struct cam_cdm *)cdm_hw->core_info;
+
+	rc = cam_cdm_util_cpas_start(cdm_hw);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CDM[%d] Failed in cpas start rc", core->index, rc);
+		goto done;
+	}
+
+	rc = cam_hw_cdm_init(cdm_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CDM[%d] Failed in cdm init rc", core->index, rc);
+		goto cpas_stop;
+	}
+
+	rc = cam_hw_cdm_deinit(cdm_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CDM[%d] Failed in cdm deinit rc", core->index, rc);
+		goto cpas_stop;
+	}
+
+cpas_stop:
+	rc = cam_cpas_stop(core->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_CDM, "CDM[%d] Failed in cpas stop rc", core->index, rc);
+done:
+	return rc;
+}
+#else
+static int cam_cdm_test_irq_line(void *hw_priv)
+{
+	return -EPERM;
+}
+#endif
+
+
+#if (defined(CONFIG_CAM_TEST_IRQ_LINE) && defined(CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE))
+static int cam_cdm_test_irq_line_at_probe(struct cam_hw_info *cdm_hw)
+{
+	return cam_cdm_test_irq_line(cdm_hw);
+}
+#else
+static int cam_cdm_test_irq_line_at_probe(struct cam_hw_info *cdm_hw)
+{
+	return -EPERM;
+}
+#endif
+
+static int cam_hw_cdm_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc, len = 0, i, j;
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_hw_intf *cdm_hw_intf = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_cdm_private_dt_data *soc_private = NULL;
+	struct cam_cpas_register_params cpas_parms;
+	char cdm_name[128], work_q_name[128];
+	struct platform_device *pdev = to_platform_device(dev);
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	cdm_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!cdm_hw_intf)
+		return -ENOMEM;
+
+	cdm_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!cdm_hw) {
+		kfree(cdm_hw_intf);
+		cdm_hw_intf = NULL;
+		return -ENOMEM;
+	}
+
+	cdm_hw->core_info = kzalloc(sizeof(struct cam_cdm), GFP_KERNEL);
+	if (!cdm_hw->core_info) {
+		kfree(cdm_hw);
+		cdm_hw = NULL;
+		kfree(cdm_hw_intf);
+		cdm_hw_intf = NULL;
+		return -ENOMEM;
+	}
+
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	cdm_hw->soc_info.pdev = pdev;
+	cdm_hw->soc_info.dev = &pdev->dev;
+	cdm_hw->soc_info.dev_name = pdev->name;
+	cdm_hw_intf->hw_type = CAM_HW_CDM;
+	cdm_hw->open_count = 0;
+	mutex_init(&cdm_hw->hw_mutex);
+	cam_hw_util_init_hw_lock(cdm_hw);
+	init_completion(&cdm_hw->hw_complete);
+
+	rc = cam_hw_cdm_soc_get_dt_properties(cdm_hw, msm_cam_hw_cdm_dt_match);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to get dt properties");
+		goto release_mem;
+	}
+	cdm_hw_intf->hw_idx = cdm_hw->soc_info.index;
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+	soc_private = (struct cam_cdm_private_dt_data *)
+		cdm_hw->soc_info.soc_private;
+	if (soc_private->dt_cdm_shared == true)
+		cdm_core->flags = CAM_CDM_FLAG_SHARED_CDM;
+	else
+		cdm_core->flags = CAM_CDM_FLAG_PRIVATE_CDM;
+
+	cdm_core->id = cam_hw_cdm_get_id_by_name(cdm_core->name);
+
+	CAM_DBG(CAM_CDM, "cdm_name %s", cdm_core->name);
+
+	if (cdm_core->id >= CAM_CDM_MAX) {
+		CAM_ERR(CAM_CDM, "Failed to get CDM HW name for %s",
+			cdm_core->name);
+		goto release_private_mem;
+	}
+
+	init_completion(&cdm_core->reset_complete);
+	cdm_hw_intf->hw_priv = cdm_hw;
+	cdm_hw_intf->hw_ops.get_hw_caps = cam_cdm_get_caps;
+	cdm_hw_intf->hw_ops.init = cam_hw_cdm_init;
+	cdm_hw_intf->hw_ops.deinit = cam_hw_cdm_deinit;
+	cdm_hw_intf->hw_ops.start = cam_cdm_stream_start;
+	cdm_hw_intf->hw_ops.stop = cam_cdm_stream_stop;
+	cdm_hw_intf->hw_ops.read = NULL;
+	cdm_hw_intf->hw_ops.write = NULL;
+	cdm_hw_intf->hw_ops.process_cmd = cam_cdm_process_cmd;
+	cdm_hw_intf->hw_ops.test_irq_line = cam_cdm_test_irq_line;
+	mutex_lock(&cdm_hw->hw_mutex);
+
+	CAM_DBG(CAM_CDM, "type %d index %d", cdm_hw_intf->hw_type,
+		cdm_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, cdm_hw_intf);
+
+	snprintf(cdm_name, sizeof(cdm_name), "%s", cdm_hw->soc_info.label_name);
+
+	rc = cam_smmu_get_handle(cdm_name, &cdm_core->iommu_hdl.non_secure);
+	if (rc < 0) {
+		if (rc != -EALREADY) {
+			CAM_ERR(CAM_CDM,
+				"%s get iommu handle failed, rc = %d",
+				cdm_name, rc);
+			goto unlock_release_mem;
+		}
+		rc = 0;
+	}
+
+	cam_smmu_set_client_page_fault_handler(cdm_core->iommu_hdl.non_secure,
+		cam_hw_cdm_iommu_fault_handler, cdm_hw);
+
+	cdm_core->iommu_hdl.secure = -1;
+
+	for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+		INIT_LIST_HEAD(&cdm_core->bl_fifo[i].bl_request_list);
+
+		mutex_init(&cdm_core->bl_fifo[i].fifo_lock);
+
+		init_completion(&cdm_core->bl_fifo[i].bl_complete);
+
+		len = strscpy(work_q_name, cdm_hw->soc_info.label_name,
+				sizeof(work_q_name));
+		snprintf(work_q_name + len, sizeof(work_q_name) - len, "%d_%d", cdm_hw->soc_info.index, i);
+		cdm_core->bl_fifo[i].work_queue = alloc_workqueue(work_q_name,
+				WQ_UNBOUND | WQ_MEM_RECLAIM | WQ_SYSFS,
+				CAM_CDM_INFLIGHT_WORKS);
+		if (!cdm_core->bl_fifo[i].work_queue) {
+			CAM_ERR(CAM_CDM,
+				"Workqueue allocation failed for FIFO %d, cdm %s",
+				i, cdm_core->name);
+			goto failed_workq_create;
+		}
+
+		CAM_DBG(CAM_CDM, "wq %s", work_q_name);
+	}
+
+	for (i = 0; i < cdm_hw->soc_info.irq_count; i++)
+		irq_data[i] = cdm_hw;
+
+	rc = cam_soc_util_request_platform_resource(&cdm_hw->soc_info,
+			cam_hw_cdm_irq, &(irq_data[0]));
+	if (rc) {
+		CAM_ERR(CAM_CDM,
+			"Failed to request platform resource for %s%u",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		goto destroy_non_secure_hdl;
+	}
+	cpas_parms.cam_cpas_client_cb = cam_cdm_cpas_cb;
+	cpas_parms.cell_index = cdm_hw->soc_info.index;
+	cpas_parms.dev = &pdev->dev;
+	cpas_parms.userdata = cdm_hw_intf;
+	strscpy(cpas_parms.identifier, cdm_hw->soc_info.label_name,
+		CAM_HW_IDENTIFIER_LENGTH);
+	rc = cam_cpas_register_client(&cpas_parms);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Virtual CDM CPAS registration failed");
+		goto release_platform_resource;
+	}
+	CAM_DBG(CAM_CDM, "CPAS registration successful handle=%d",
+		cpas_parms.client_handle);
+	cdm_core->cpas_handle = cpas_parms.client_handle;
+
+	rc = cam_cdm_util_cpas_start(cdm_hw);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CPAS start failed");
+		goto cpas_unregister;
+	}
+
+	rc = cam_hw_cdm_get_cdm_config(cdm_hw);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to get cdm configuration rc = %d", rc);
+		goto cpas_stop;
+	}
+
+	if (cdm_core->hw_version < CAM_CDM_VERSION_2_0) {
+		for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+			cdm_core->bl_fifo[i].bl_depth =
+				CAM_CDM_BL_FIFO_LENGTH_MAX_DEFAULT;
+			CAM_DBG(CAM_CDM, "Setting FIFO%d length to %d",
+				i, cdm_core->bl_fifo[i].bl_depth);
+		}
+	} else {
+		for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+			cdm_core->bl_fifo[i].bl_depth =
+				soc_private->fifo_depth[i];
+			CAM_DBG(CAM_CDM, "Setting FIFO%d length to %d",
+				i, cdm_core->bl_fifo[i].bl_depth);
+		}
+	}
+
+	cdm_core->arbitration = cam_cdm_get_arbitration_type(
+		cdm_core->hw_version, cdm_core->id);
+
+	cdm_core->cdm_status = CAM_CDM_HW_INIT_STATUS;
+
+	cdm_core->ops = cam_cdm_get_ops(cdm_core->hw_version, NULL,
+		false);
+
+	if (!cdm_core->ops) {
+		CAM_ERR(CAM_CDM, "Failed to util ops for %s%u HW",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		rc = -EINVAL;
+		goto cpas_stop;
+	}
+
+	if (!cam_cdm_set_cam_hw_version(cdm_core->hw_version,
+		&cdm_core->version)) {
+		CAM_ERR(CAM_CDM, "Failed to set cam hw version for hw");
+		rc = -EINVAL;
+		goto cpas_stop;
+	}
+
+	rc = cam_cpas_stop(cdm_core->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CPAS stop failed");
+		goto cpas_unregister;
+	}
+
+	rc = cam_cdm_intf_register_hw_cdm(cdm_hw_intf,
+		soc_private, CAM_HW_CDM, &cdm_core->index);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "HW CDM Interface registration failed");
+		goto cpas_unregister;
+	}
+
+	cam_cdm_test_irq_line_at_probe(cdm_hw);
+	mutex_unlock(&cdm_hw->hw_mutex);
+
+	CAM_DBG(CAM_CDM, "%s component bound successfully", cdm_core->name);
+
+	return rc;
+
+cpas_stop:
+	if (cam_cpas_stop(cdm_core->cpas_handle))
+		CAM_ERR(CAM_CDM, "CPAS stop failed");
+cpas_unregister:
+	if (cam_cpas_unregister_client(cdm_core->cpas_handle))
+		CAM_ERR(CAM_CDM, "CPAS unregister failed");
+release_platform_resource:
+	if (cam_soc_util_release_platform_resource(&cdm_hw->soc_info))
+		CAM_ERR(CAM_CDM, "Release platform resource failed");
+failed_workq_create:
+	for (j = 0; j < i; j++) {
+		flush_workqueue(cdm_core->bl_fifo[j].work_queue);
+		destroy_workqueue(cdm_core->bl_fifo[j].work_queue);
+	}
+destroy_non_secure_hdl:
+	cam_smmu_set_client_page_fault_handler(cdm_core->iommu_hdl.non_secure,
+		NULL, cdm_hw);
+	if (cam_smmu_destroy_handle(cdm_core->iommu_hdl.non_secure))
+		CAM_ERR(CAM_CDM, "Release iommu secure hdl failed");
+unlock_release_mem:
+	mutex_unlock(&cdm_hw->hw_mutex);
+release_private_mem:
+	kfree(cdm_hw->soc_info.soc_private);
+	cdm_hw->soc_info.soc_private = NULL;
+release_mem:
+	mutex_destroy(&cdm_hw->hw_mutex);
+	kfree(cdm_hw_intf);
+	cdm_hw_intf = NULL;
+	kfree(cdm_hw->core_info);
+	cdm_hw->core_info = NULL;
+	kfree(cdm_hw);
+	cdm_hw = NULL;
+	return rc;
+}
+
+static void cam_hw_cdm_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = -EBUSY, i;
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_hw_intf *cdm_hw_intf = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	cdm_hw_intf = platform_get_drvdata(pdev);
+	if (!cdm_hw_intf) {
+		CAM_ERR(CAM_CDM, "Failed to get dev private data");
+		return;
+	}
+
+	cdm_hw = cdm_hw_intf->hw_priv;
+	if (!cdm_hw) {
+		CAM_ERR(CAM_CDM,
+			"Failed to get hw private data for type=%d idx=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx);
+		return;
+	}
+
+	cdm_core = cdm_hw->core_info;
+	if (!cdm_core) {
+		CAM_ERR(CAM_CDM,
+			"Failed to get hw core data for type=%d idx=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx);
+		return;
+	}
+
+	if (cdm_hw->open_count != 0) {
+		CAM_ERR(CAM_CDM, "Hw open count invalid type=%d idx=%d cnt=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx,
+			cdm_hw->open_count);
+		return;
+	}
+
+	if (cdm_hw->hw_state == CAM_HW_STATE_POWER_UP) {
+		rc = cam_hw_cdm_deinit(cdm_hw, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_CDM, "Deinit failed for hw");
+			return;
+		}
+	}
+
+	rc = cam_cdm_intf_deregister_hw_cdm(cdm_hw_intf,
+		cdm_hw->soc_info.soc_private, CAM_HW_CDM, cdm_core->index);
+	if (rc) {
+		CAM_ERR(CAM_CDM,
+			"HW_CDM interface deregistration failed: rd: %d", rc);
+	}
+
+	rc = cam_cpas_unregister_client(cdm_core->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CPAS unregister failed");
+		return;
+	}
+
+	if (cam_soc_util_release_platform_resource(&cdm_hw->soc_info))
+		CAM_ERR(CAM_CDM, "Release platform resource failed");
+
+	for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+		flush_workqueue(cdm_core->bl_fifo[i].work_queue);
+		destroy_workqueue(cdm_core->bl_fifo[i].work_queue);
+	}
+
+	cam_smmu_unset_client_page_fault_handler(
+		cdm_core->iommu_hdl.non_secure, cdm_hw);
+	if (cam_smmu_destroy_handle(cdm_core->iommu_hdl.non_secure))
+		CAM_ERR(CAM_CDM, "Release iommu secure hdl failed");
+
+	mutex_destroy(&cdm_hw->hw_mutex);
+	kfree(cdm_hw->soc_info.soc_private);
+	cdm_hw->soc_info.soc_private = NULL;
+	kfree(cdm_hw_intf);
+	cdm_hw_intf = NULL;
+	kfree(cdm_hw->core_info);
+	cdm_hw->core_info = NULL;
+	kfree(cdm_hw);
+	cdm_hw = NULL;
+}
+
+const static struct component_ops cam_hw_cdm_component_ops = {
+	.bind = cam_hw_cdm_component_bind,
+	.unbind = cam_hw_cdm_component_unbind,
+};
+
+int cam_hw_cdm_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CDM, "Adding HW CDM component");
+	rc = component_add(&pdev->dev, &cam_hw_cdm_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CDM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_hw_cdm_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_hw_cdm_component_ops);
+	return 0;
+}
+
+struct platform_driver cam_hw_cdm_driver = {
+	.probe = cam_hw_cdm_probe,
+	.remove = cam_hw_cdm_remove,
+	.driver = {
+		.name = "msm_cam_cdm",
+		.owner = THIS_MODULE,
+		.of_match_table = msm_cam_hw_cdm_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_hw_cdm_init_module(void)
+{
+	return platform_driver_register(&cam_hw_cdm_driver);
+}
+
+void cam_hw_cdm_exit_module(void)
+{
+	platform_driver_unregister(&cam_hw_cdm_driver);
+}
+
+MODULE_DESCRIPTION("MSM Camera HW CDM driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_1_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_1_0.h
@@ -0,0 +1,163 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+static struct cam_version_reg cdm_hw_1_0_titan_version = {
+	.hw_version = 0x4,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_1_0_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x7F,
+	.rb_num_fifo = 0x1,
+	.rb_next_fifo_shift = 0x0,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_1_0_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_1_0_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_1_0_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_0_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_0_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_common_regs cdm_hw_1_0_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = &cdm_hw_1_0_titan_version,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.cdm_status = 0x0,
+	.irq_context_status = 0x0,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_1_0_bl_pending_req0,
+			NULL,
+		},
+	.comp_wait = {
+			&cdm_1_0_comp_wait_status0,
+			&cdm_1_0_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_1_0_perf_mon0,
+			NULL,
+		},
+	.scratch = {
+			&cdm_1_0_scratch_reg0,
+			&cdm_1_0_scratch_reg1,
+			&cdm_1_0_scratch_reg2,
+			&cdm_1_0_scratch_reg3,
+			&cdm_1_0_scratch_reg4,
+			&cdm_1_0_scratch_reg5,
+			&cdm_1_0_scratch_reg6,
+			&cdm_1_0_scratch_reg7,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.perf_reg = NULL,
+	.icl_reg = NULL,
+	.spare = 0x200,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_1_0_cmn_reg_data = {
+	.num_bl_fifo = 0x1,
+	.num_bl_fifo_irq = 0x1,
+	.num_bl_pending_req_reg = 0x1,
+	.num_scratch_reg = 0x8,
+};
+
+static struct cam_cdm_hw_reg_offset cam_cdm_1_0_reg_offset = {
+	.cmn_reg = &cdm_hw_1_0_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_1_0_bl_fifo0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.irq_reg = {
+			&cdm_hw_1_0_irq0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.reg_data = &cdm_hw_1_0_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_1_1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_1_1.h
@@ -0,0 +1,163 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+static struct cam_version_reg cdm_hw_1_1_titan_version = {
+	.hw_version = 0x4,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_1_1_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x7f,
+	.rb_num_fifo = 0x1,
+	.rb_next_fifo_shift = 0x0,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_1_1_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_1_1_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_1_1_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_1_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_1_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_common_regs cdm_hw_1_1_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = &cdm_hw_1_1_titan_version,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.cdm_status = 0x0,
+	.irq_context_status = 0x0,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_1_1_bl_pending_req0,
+			NULL,
+		},
+	.comp_wait = {
+			&cdm_1_1_comp_wait_status0,
+			&cdm_1_1_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_1_1_perf_mon0,
+			NULL,
+		},
+	.scratch = {
+			&cdm_1_1_scratch_reg0,
+			&cdm_1_1_scratch_reg1,
+			&cdm_1_1_scratch_reg2,
+			&cdm_1_1_scratch_reg3,
+			&cdm_1_1_scratch_reg4,
+			&cdm_1_1_scratch_reg5,
+			&cdm_1_1_scratch_reg6,
+			&cdm_1_1_scratch_reg7,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.perf_reg = NULL,
+	.icl_reg = NULL,
+	.spare = 0x1fc,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_1_1_cmn_reg_data = {
+	.num_bl_fifo = 0x1,
+	.num_bl_fifo_irq = 0x1,
+	.num_bl_pending_req_reg = 0x1,
+	.num_scratch_reg = 0x8,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_1_1_reg_offset = {
+	.cmn_reg = &cdm_hw_1_1_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_1_1_bl_fifo0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.irq_reg = {
+			&cdm_hw_1_1_irq0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.reg_data = &cdm_hw_1_1_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_1_2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_1_2.h
@@ -0,0 +1,183 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+static struct cam_version_reg cdm_hw_1_2_titan_version = {
+	.hw_version = 0x4,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_1_2_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x7f,
+	.rb_num_fifo = 0x1,
+	.rb_next_fifo_shift = 0x0,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_1_2_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_1_2_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_1_2_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_2_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_2_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_perf_regs cdm_1_2_perf = {
+	.count_cfg_0 = 0x180,
+	.always_count_val = 0x184,
+	.busy_count_val = 0x188,
+	.stall_axi_count_val = 0x18c,
+	.count_status = 0x190,
+};
+
+static struct cam_cdm_icl_data_regs cdm_1_2_icl_data = {
+	.icl_last_data_0 = 0x1c0,
+	.icl_last_data_1 = 0x1c4,
+	.icl_last_data_2 = 0x1c8,
+	.icl_inv_data = 0x1cc,
+};
+
+static struct cam_cdm_icl_regs cdm_1_2_icl = {
+	.data_regs = &cdm_1_2_icl_data,
+	.misc_regs = NULL,
+};
+
+static struct cam_cdm_common_regs cdm_hw_1_2_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = &cdm_hw_1_2_titan_version,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.cdm_status = 0x0,
+	.irq_context_status = 0x0,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_1_2_bl_pending_req0,
+			NULL,
+		},
+	.comp_wait = {
+			&cdm_1_2_comp_wait_status0,
+			&cdm_1_2_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_1_2_perf_mon0,
+			NULL,
+		},
+	.scratch = {
+			&cdm_1_2_scratch_reg0,
+			&cdm_1_2_scratch_reg1,
+			&cdm_1_2_scratch_reg2,
+			&cdm_1_2_scratch_reg3,
+			&cdm_1_2_scratch_reg4,
+			&cdm_1_2_scratch_reg5,
+			&cdm_1_2_scratch_reg6,
+			&cdm_1_2_scratch_reg7,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.perf_reg = &cdm_1_2_perf,
+	.icl_reg = &cdm_1_2_icl,
+	.spare = 0x1fc,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_1_2_cmn_reg_data = {
+	.num_bl_fifo = 0x1,
+	.num_bl_fifo_irq = 0x1,
+	.num_bl_pending_req_reg = 0x1,
+	.num_scratch_reg = 0x8,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_1_2_reg_offset = {
+	.cmn_reg = &cdm_hw_1_2_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_1_2_bl_fifo0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.irq_reg = {
+			&cdm_hw_1_2_irq0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.reg_data = &cdm_hw_1_2_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_2_0.h
@@ -0,0 +1,254 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_0_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_0_bl_pending_req1 = {
+	.rb_offset = 0x70,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_0_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_0_irq1 = {
+	.irq_mask = 0x130,
+	.irq_clear = 0x134,
+	.irq_clear_cmd = 0x138,
+	.irq_set = 0x13c,
+	.irq_set_cmd = 0x140,
+	.irq_status = 0x144,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_0_irq2 = {
+	.irq_mask = 0x230,
+	.irq_clear = 0x234,
+	.irq_clear_cmd = 0x238,
+	.irq_set = 0x23c,
+	.irq_set_cmd = 0x240,
+	.irq_status = 0x244,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_0_irq3 = {
+	.irq_mask = 0x330,
+	.irq_clear = 0x334,
+	.irq_clear_cmd = 0x338,
+	.irq_set = 0x33c,
+	.irq_set_cmd = 0x340,
+	.irq_status = 0x344,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_0_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_0_bl_fifo1 = {
+	.bl_fifo_base = 0x150,
+	.bl_fifo_len = 0x154,
+	.bl_fifo_store = 0x158,
+	.bl_fifo_cfg = 0x15c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_0_bl_fifo2 = {
+	.bl_fifo_base = 0x250,
+	.bl_fifo_len = 0x254,
+	.bl_fifo_store = 0x258,
+	.bl_fifo_cfg = 0x25c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_0_bl_fifo3 = {
+	.bl_fifo_base = 0x350,
+	.bl_fifo_len = 0x354,
+	.bl_fifo_store = 0x358,
+	.bl_fifo_cfg = 0x35c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg8 = {
+	.scratch_reg = 0xb0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg9 = {
+	.scratch_reg = 0xb4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg10  = {
+	.scratch_reg = 0xb8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg11  = {
+	.scratch_reg = 0xbc,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_0_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_0_perf_mon1 = {
+	.perf_mon_ctrl = 0x120,
+	.perf_mon_0 = 0x124,
+	.perf_mon_1 = 0x128,
+	.perf_mon_2 = 0x12c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_0_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_0_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_icl_data_regs cdm_2_0_icl_data = {
+	.icl_last_data_0 = 0x1c0,
+	.icl_last_data_1 = 0x1c4,
+	.icl_last_data_2 = 0x1c8,
+	.icl_inv_data = 0x1cc,
+};
+
+static struct cam_cdm_icl_misc_regs cdm_2_0_icl_misc = {
+	.icl_inv_bl_addr = 0x1d0,
+	.icl_status = 0x1d4,
+};
+
+static struct cam_cdm_icl_regs cdm_2_0_icl = {
+	.data_regs = &cdm_2_0_icl_data,
+	.misc_regs = &cdm_2_0_icl_misc,
+};
+
+static struct cam_cdm_common_regs cdm_hw_2_0_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = NULL,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.cdm_status = 0x0,
+	.irq_context_status = 0x0,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_2_0_bl_pending_req0,
+			&cdm_hw_2_0_bl_pending_req1,
+		},
+	.comp_wait = {
+			&cdm_2_0_comp_wait_status0,
+			&cdm_2_0_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_2_0_perf_mon0,
+			&cdm_2_0_perf_mon1,
+		},
+	.scratch = {
+			&cdm_2_0_scratch_reg0,
+			&cdm_2_0_scratch_reg1,
+			&cdm_2_0_scratch_reg2,
+			&cdm_2_0_scratch_reg3,
+			&cdm_2_0_scratch_reg4,
+			&cdm_2_0_scratch_reg5,
+			&cdm_2_0_scratch_reg6,
+			&cdm_2_0_scratch_reg7,
+			&cdm_2_0_scratch_reg8,
+			&cdm_2_0_scratch_reg9,
+			&cdm_2_0_scratch_reg10,
+			&cdm_2_0_scratch_reg11,
+		},
+	.perf_reg = NULL,
+	.icl_reg = &cdm_2_0_icl,
+	.spare = 0x1fc,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_2_0_cmn_reg_data = {
+	.num_bl_fifo = 0x4,
+	.num_bl_fifo_irq = 0x4,
+	.num_bl_pending_req_reg = 0x2,
+	.num_scratch_reg = 0xc,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_2_0_reg_offset = {
+	.cmn_reg = &cdm_hw_2_0_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_2_0_bl_fifo0,
+			&cdm_hw_2_0_bl_fifo1,
+			&cdm_hw_2_0_bl_fifo2,
+			&cdm_hw_2_0_bl_fifo3,
+		},
+	.irq_reg = {
+			&cdm_hw_2_0_irq0,
+			&cdm_hw_2_0_irq1,
+			&cdm_hw_2_0_irq2,
+			&cdm_hw_2_0_irq3,
+		},
+	.reg_data = &cdm_hw_2_0_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_2_1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_2_1.h
@@ -0,0 +1,255 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_1_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_1_bl_pending_req1 = {
+	.rb_offset = 0x70,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_1_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_1_irq1 = {
+	.irq_mask = 0x130,
+	.irq_clear = 0x134,
+	.irq_clear_cmd = 0x138,
+	.irq_set = 0x13c,
+	.irq_set_cmd = 0x140,
+	.irq_status = 0x144,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_1_irq2 = {
+	.irq_mask = 0x230,
+	.irq_clear = 0x234,
+	.irq_clear_cmd = 0x238,
+	.irq_set = 0x23c,
+	.irq_set_cmd = 0x240,
+	.irq_status = 0x244,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_1_irq3 = {
+	.irq_mask = 0x330,
+	.irq_clear = 0x334,
+	.irq_clear_cmd = 0x338,
+	.irq_set = 0x33c,
+	.irq_set_cmd = 0x340,
+	.irq_status = 0x344,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_1_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_1_bl_fifo1 = {
+	.bl_fifo_base = 0x150,
+	.bl_fifo_len = 0x154,
+	.bl_fifo_store = 0x158,
+	.bl_fifo_cfg = 0x15c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_1_bl_fifo2 = {
+	.bl_fifo_base = 0x250,
+	.bl_fifo_len = 0x254,
+	.bl_fifo_store = 0x258,
+	.bl_fifo_cfg = 0x25c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_1_bl_fifo3 = {
+	.bl_fifo_base = 0x350,
+	.bl_fifo_len = 0x354,
+	.bl_fifo_store = 0x358,
+	.bl_fifo_cfg = 0x35c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg8 = {
+	.scratch_reg = 0xb0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg9 = {
+	.scratch_reg = 0xb4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg10  = {
+	.scratch_reg = 0xb8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg11  = {
+	.scratch_reg = 0xbc,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_1_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_1_perf_mon1 = {
+	.perf_mon_ctrl = 0x120,
+	.perf_mon_0 = 0x124,
+	.perf_mon_1 = 0x128,
+	.perf_mon_2 = 0x12c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_1_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_1_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_icl_data_regs cdm_2_1_icl_data = {
+	.icl_last_data_0 = 0x1c0,
+	.icl_last_data_1 = 0x1c4,
+	.icl_last_data_2 = 0x1c8,
+	.icl_inv_data = 0x1cc,
+};
+
+static struct cam_cdm_icl_misc_regs cdm_2_1_icl_misc = {
+	.icl_inv_bl_addr = 0x1d0,
+	.icl_status = 0x1d8,
+};
+
+static struct cam_cdm_icl_regs cdm_2_1_icl = {
+	.data_regs = &cdm_2_1_icl_data,
+	.misc_regs = &cdm_2_1_icl_misc,
+};
+
+static struct cam_cdm_common_regs cdm_hw_2_1_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = NULL,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.cdm_status = 0x0,
+	.irq_context_status = 0x2c,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_2_1_bl_pending_req0,
+			&cdm_hw_2_1_bl_pending_req1,
+		},
+	.comp_wait = {
+			&cdm_2_1_comp_wait_status0,
+			&cdm_2_1_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_2_1_perf_mon0,
+			&cdm_2_1_perf_mon1,
+		},
+	.scratch = {
+			&cdm_2_1_scratch_reg0,
+			&cdm_2_1_scratch_reg1,
+			&cdm_2_1_scratch_reg2,
+			&cdm_2_1_scratch_reg3,
+			&cdm_2_1_scratch_reg4,
+			&cdm_2_1_scratch_reg5,
+			&cdm_2_1_scratch_reg6,
+			&cdm_2_1_scratch_reg7,
+			&cdm_2_1_scratch_reg8,
+			&cdm_2_1_scratch_reg9,
+			&cdm_2_1_scratch_reg10,
+			&cdm_2_1_scratch_reg11,
+		},
+	.perf_reg = NULL,
+	.icl_reg = &cdm_2_1_icl,
+	.spare = 0x3fc,
+	.priority_group_bit_offset = 20,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_2_1_cmn_reg_data = {
+	.num_bl_fifo = 0x4,
+	.num_bl_fifo_irq = 0x4,
+	.num_bl_pending_req_reg = 0x2,
+	.num_scratch_reg = 0xc,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_2_1_reg_offset = {
+	.cmn_reg = &cdm_hw_2_1_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_2_1_bl_fifo0,
+			&cdm_hw_2_1_bl_fifo1,
+			&cdm_hw_2_1_bl_fifo2,
+			&cdm_hw_2_1_bl_fifo3,
+		},
+	.irq_reg = {
+			&cdm_hw_2_1_irq0,
+			&cdm_hw_2_1_irq1,
+			&cdm_hw_2_1_irq2,
+			&cdm_hw_2_1_irq3,
+		},
+	.reg_data = &cdm_hw_2_1_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_2_2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_hw_reg_2_2.h
@@ -0,0 +1,257 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+#define CAM_CDM_PAUSE_CORE_DONE_MASK    (0x1 << 1)
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_2_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_2_bl_pending_req1 = {
+	.rb_offset = 0x70,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_2_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_2_irq1 = {
+	.irq_mask = 0x130,
+	.irq_clear = 0x134,
+	.irq_clear_cmd = 0x138,
+	.irq_set = 0x13c,
+	.irq_set_cmd = 0x140,
+	.irq_status = 0x144,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_2_irq2 = {
+	.irq_mask = 0x230,
+	.irq_clear = 0x234,
+	.irq_clear_cmd = 0x238,
+	.irq_set = 0x23c,
+	.irq_set_cmd = 0x240,
+	.irq_status = 0x244,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_2_irq3 = {
+	.irq_mask = 0x330,
+	.irq_clear = 0x334,
+	.irq_clear_cmd = 0x338,
+	.irq_set = 0x33c,
+	.irq_set_cmd = 0x340,
+	.irq_status = 0x344,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_2_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_2_bl_fifo1 = {
+	.bl_fifo_base = 0x150,
+	.bl_fifo_len = 0x154,
+	.bl_fifo_store = 0x158,
+	.bl_fifo_cfg = 0x15c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_2_bl_fifo2 = {
+	.bl_fifo_base = 0x250,
+	.bl_fifo_len = 0x254,
+	.bl_fifo_store = 0x258,
+	.bl_fifo_cfg = 0x25c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_2_bl_fifo3 = {
+	.bl_fifo_base = 0x350,
+	.bl_fifo_len = 0x354,
+	.bl_fifo_store = 0x358,
+	.bl_fifo_cfg = 0x35c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg8 = {
+	.scratch_reg = 0xb0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg9 = {
+	.scratch_reg = 0xb4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg10  = {
+	.scratch_reg = 0xb8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_2_scratch_reg11  = {
+	.scratch_reg = 0xbc,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_2_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_2_perf_mon1 = {
+	.perf_mon_ctrl = 0x120,
+	.perf_mon_0 = 0x124,
+	.perf_mon_1 = 0x128,
+	.perf_mon_2 = 0x12c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_2_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_2_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_icl_data_regs cdm_2_2_icl_data = {
+	.icl_last_data_0 = 0x1c0,
+	.icl_last_data_1 = 0x1c4,
+	.icl_last_data_2 = 0x1c8,
+	.icl_inv_data = 0x1cc,
+};
+
+static struct cam_cdm_icl_misc_regs cdm_2_2_icl_misc = {
+	.icl_inv_bl_addr = 0x1d0,
+	.icl_status = 0x1d8,
+};
+
+static struct cam_cdm_icl_regs cdm_2_2_icl = {
+	.data_regs = &cdm_2_2_icl_data,
+	.misc_regs = &cdm_2_2_icl_misc,
+};
+
+static struct cam_cdm_common_regs cdm_hw_2_2_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = NULL,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.cdm_status = 0x28,
+	.irq_context_status = 0x2c,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_2_2_bl_pending_req0,
+			&cdm_hw_2_2_bl_pending_req1,
+		},
+	.comp_wait = {
+			&cdm_2_2_comp_wait_status0,
+			&cdm_2_2_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_2_2_perf_mon0,
+			&cdm_2_2_perf_mon1,
+		},
+	.scratch = {
+			&cdm_2_2_scratch_reg0,
+			&cdm_2_2_scratch_reg1,
+			&cdm_2_2_scratch_reg2,
+			&cdm_2_2_scratch_reg3,
+			&cdm_2_2_scratch_reg4,
+			&cdm_2_2_scratch_reg5,
+			&cdm_2_2_scratch_reg6,
+			&cdm_2_2_scratch_reg7,
+			&cdm_2_2_scratch_reg8,
+			&cdm_2_2_scratch_reg9,
+			&cdm_2_2_scratch_reg10,
+			&cdm_2_2_scratch_reg11,
+		},
+	.perf_reg = NULL,
+	.icl_reg = &cdm_2_2_icl,
+	.spare = 0x3fc,
+	.priority_group_bit_offset = 20,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_2_2_cmn_reg_data = {
+	.num_bl_fifo = 0x4,
+	.num_bl_fifo_irq = 0x4,
+	.num_bl_pending_req_reg = 0x2,
+	.num_scratch_reg = 0xc,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_2_2_reg_offset = {
+	.cmn_reg = &cdm_hw_2_2_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_2_2_bl_fifo0,
+			&cdm_hw_2_2_bl_fifo1,
+			&cdm_hw_2_2_bl_fifo2,
+			&cdm_hw_2_2_bl_fifo3,
+		},
+	.irq_reg = {
+			&cdm_hw_2_2_irq0,
+			&cdm_hw_2_2_irq1,
+			&cdm_hw_2_2_irq2,
+			&cdm_hw_2_2_irq3,
+		},
+	.reg_data = &cdm_hw_2_2_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_intf.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_intf.c
@@ -0,0 +1,830 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm.h"
+#include "cam_cdm_virtual.h"
+#include "cam_soc_util.h"
+#include "cam_cdm_soc.h"
+#include "cam_cdm_core_common.h"
+#include "camera_main.h"
+
+static struct cam_cdm_intf_mgr cdm_mgr;
+static DEFINE_MUTEX(cam_cdm_mgr_lock);
+
+static const struct of_device_id msm_cam_cdm_intf_dt_match[] = {
+	{ .compatible = "qcom,cam-cdm-intf", },
+	{}
+};
+
+static int get_cdm_mgr_refcount(void)
+{
+	int rc = 0;
+
+	mutex_lock(&cam_cdm_mgr_lock);
+	if (cdm_mgr.probe_done == false) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr not probed yet");
+		rc = -EPERM;
+	} else {
+		CAM_DBG(CAM_CDM, "CDM intf mgr get refcount=%d",
+			cdm_mgr.refcount);
+		cdm_mgr.refcount++;
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+	return rc;
+}
+
+static void put_cdm_mgr_refcount(void)
+{
+	mutex_lock(&cam_cdm_mgr_lock);
+	if (cdm_mgr.probe_done == false) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr not probed yet");
+	} else {
+		CAM_DBG(CAM_CDM, "CDM intf mgr put refcount=%d",
+			cdm_mgr.refcount);
+		if (cdm_mgr.refcount > 0) {
+			cdm_mgr.refcount--;
+		} else {
+			CAM_ERR(CAM_CDM, "Refcount put when zero");
+			WARN_ON(1);
+		}
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+}
+
+static int get_cdm_iommu_handle(struct cam_iommu_handle *cdm_handles,
+	uint32_t hw_idx)
+{
+	int rc = -EPERM;
+	struct cam_hw_intf *hw = cdm_mgr.nodes[hw_idx].device;
+
+	if (hw->hw_ops.get_hw_caps) {
+		rc = hw->hw_ops.get_hw_caps(hw->hw_priv, cdm_handles,
+			sizeof(struct cam_iommu_handle));
+	}
+
+	return rc;
+}
+
+static int get_cdm_index_by_id(char *identifier,
+	uint32_t cell_index, uint32_t *hw_index)
+{
+	int rc = -EPERM, i, j;
+	char client_name[128], name_index[160];
+
+	snprintf(client_name, sizeof(client_name), "%s", identifier);
+	snprintf(name_index, sizeof(name_index), "%s%d",
+		identifier, cell_index);
+
+	CAM_DBG(CAM_CDM,
+		"Looking for HW id of =%s or %s and index=%d cdm_count %d",
+		identifier, name_index, cell_index, cdm_mgr.cdm_count);
+	mutex_lock(&cam_cdm_mgr_lock);
+	for (i = 0; i < cdm_mgr.cdm_count; i++) {
+		mutex_lock(&cdm_mgr.nodes[i].lock);
+		CAM_DBG(CAM_CDM, "dt_num_supported_clients=%d",
+			cdm_mgr.nodes[i].data->dt_num_supported_clients);
+
+		for (j = 0; j <
+			cdm_mgr.nodes[i].data->dt_num_supported_clients; j++) {
+			CAM_DBG(CAM_CDM, "client name:%s dev Index: %d",
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				i);
+			if (!strcmp(
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				client_name) || !strcmp(
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				name_index)) {
+				rc = 0;
+				*hw_index = i;
+				break;
+			}
+		}
+		mutex_unlock(&cdm_mgr.nodes[i].lock);
+		if (rc == 0)
+			break;
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+
+	return rc;
+}
+
+int cam_cdm_get_iommu_handle(char *identifier,
+	struct cam_iommu_handle *cdm_handles)
+{
+	int i, j, rc = -EPERM;
+
+	if ((!identifier) || (!cdm_handles))
+		return -EINVAL;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return rc;
+	}
+	CAM_DBG(CAM_CDM, "Looking for Iommu handle of %s", identifier);
+
+	for (i = 0; i < cdm_mgr.cdm_count; i++) {
+		mutex_lock(&cdm_mgr.nodes[i].lock);
+		if (!cdm_mgr.nodes[i].data) {
+			mutex_unlock(&cdm_mgr.nodes[i].lock);
+			continue;
+		}
+		CAM_DBG(CAM_CDM, "dt_num_supported_clients=%d",
+			cdm_mgr.nodes[i].data->dt_num_supported_clients);
+		for (j = 0; j <
+			 cdm_mgr.nodes[i].data->dt_num_supported_clients;
+			j++) {
+			CAM_DBG(CAM_CDM, "client name:%s dev Index: %d",
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				i);
+			if (!strcmp(
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				identifier)) {
+				rc = get_cdm_iommu_handle(cdm_handles, i);
+				break;
+			}
+		}
+		mutex_unlock(&cdm_mgr.nodes[i].lock);
+		if (rc == 0)
+			break;
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_get_iommu_handle);
+
+int cam_cdm_acquire(struct cam_cdm_acquire_data *data)
+{
+	int rc = -EPERM;
+	struct cam_hw_intf *hw;
+	struct cam_hw_info *cdm_hw;
+	struct cam_cdm *core = NULL;
+	uint32_t hw_index = 0;
+
+	if ((!data) || (!data->base_array_cnt))
+		return -EINVAL;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return rc;
+	}
+
+	if (data->id > CAM_CDM_HW_ANY) {
+		CAM_ERR(CAM_CDM,
+			"only CAM_CDM_VIRTUAL/CAM_CDM_HW_ANY is supported");
+		rc = -EPERM;
+		goto end;
+	}
+	rc = get_cdm_index_by_id(data->identifier, data->cell_index,
+		&hw_index);
+	if ((rc < 0) && (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM)) {
+		CAM_ERR(CAM_CDM, "Failed to identify associated hw id");
+		goto end;
+	} else {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			cdm_hw = hw->hw_priv;
+			core = (struct cam_cdm *)cdm_hw->core_info;
+			data->id = core->id;
+			data->hw_idx = hw->hw_idx;
+			CAM_DBG(CAM_CDM,
+				"Device = %s, hw_index = %d, CDM id = %d",
+				data->identifier, hw_index, data->id);
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_ACQUIRE, data,
+				sizeof(struct cam_cdm_acquire_data));
+			if (rc < 0) {
+				CAM_ERR(CAM_CDM, "CDM hw acquire failed");
+				goto end;
+			}
+		} else {
+			CAM_ERR(CAM_CDM, "idx %d doesn't have acquire ops",
+				hw_index);
+			rc = -EPERM;
+		}
+	}
+end:
+	if (rc < 0) {
+		CAM_ERR(CAM_CDM, "CDM acquire failed for id=%d name=%s, idx=%d",
+			data->id, data->identifier, data->cell_index);
+		put_cdm_mgr_refcount();
+	}
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_acquire);
+
+struct cam_cdm_utils_ops *cam_cdm_publish_ops(void)
+{
+	struct cam_hw_version cdm_version;
+
+	cdm_version.major = 1;
+	cdm_version.minor = 0;
+	cdm_version.incr = 0;
+	cdm_version.reserved = 0;
+
+	return cam_cdm_get_ops(0, &cdm_version, true);
+}
+EXPORT_SYMBOL(cam_cdm_publish_ops);
+
+int cam_cdm_release(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EPERM;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+					CAM_CDM_HW_INTF_CMD_RELEASE, &handle,
+					sizeof(handle));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"hw release failed for handle=%x",
+					handle);
+		} else
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have release ops",
+				hw_index);
+	}
+	put_cdm_mgr_refcount();
+	if (rc == 0)
+		put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_release);
+
+
+int cam_cdm_submit_bls(uint32_t handle, struct cam_cdm_bl_request *data)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (!data)
+		return rc;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		struct cam_cdm_hw_intf_cmd_submit_bl req;
+
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			req.data = data;
+			req.handle = handle;
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_SUBMIT_BL, &req,
+				sizeof(struct cam_cdm_hw_intf_cmd_submit_bl));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"hw submit bl failed for handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have submit ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_submit_bls);
+
+int cam_cdm_stream_on(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+			if (hw && hw->hw_ops.start) {
+				rc = hw->hw_ops.start(hw->hw_priv, &handle,
+						sizeof(uint32_t));
+				if (rc < 0)
+					CAM_ERR(CAM_CDM,
+						"hw start failed handle=%x",
+						handle);
+			} else {
+				CAM_ERR(CAM_CDM,
+					"hw idx %d doesn't have start ops",
+					hw_index);
+			}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_stream_on);
+
+int cam_cdm_stream_off(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.stop) {
+			rc = hw->hw_ops.stop(hw->hw_priv, &handle,
+					sizeof(uint32_t));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM, "hw stop failed handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have stop ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_stream_off);
+
+int cam_cdm_reset_hw(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+					CAM_CDM_HW_INTF_CMD_RESET_HW, &handle,
+					sizeof(handle));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"CDM hw release failed for handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have release ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_reset_hw);
+
+int cam_cdm_flush_hw(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_FLUSH_HW, &handle,
+				sizeof(handle));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"CDM hw release failed for handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have release ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_flush_hw);
+
+int cam_cdm_handle_error(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_HANDLE_ERROR,
+				&handle,
+				sizeof(handle));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"CDM hw release failed for handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have release ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_handle_error);
+
+int cam_cdm_detect_hang_error(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd)
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_HANG_DETECT,
+				&handle,
+				sizeof(handle));
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_detect_hang_error);
+
+int cam_cdm_dump_debug_registers(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd)
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_DUMP_DBG_REGS,
+				&handle,
+				sizeof(handle));
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+
+int cam_cdm_intf_register_hw_cdm(struct cam_hw_intf *hw,
+	struct cam_cdm_private_dt_data *data, enum cam_cdm_type type,
+	uint32_t *index)
+{
+	int rc = -EINVAL;
+
+	if ((!hw) || (!data) || (!index))
+		return rc;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return rc;
+	}
+
+	mutex_lock(&cam_cdm_mgr_lock);
+	if ((type == CAM_VIRTUAL_CDM) &&
+		(!cdm_mgr.nodes[CAM_SW_CDM_INDEX].device)) {
+		mutex_lock(&cdm_mgr.nodes[CAM_SW_CDM_INDEX].lock);
+		cdm_mgr.nodes[CAM_SW_CDM_INDEX].device = hw;
+		cdm_mgr.nodes[CAM_SW_CDM_INDEX].data = data;
+		*index = cdm_mgr.cdm_count;
+		mutex_unlock(&cdm_mgr.nodes[CAM_SW_CDM_INDEX].lock);
+		cdm_mgr.cdm_count++;
+		rc = 0;
+	} else if ((type == CAM_HW_CDM) && (cdm_mgr.cdm_count > 0)) {
+		mutex_lock(&cdm_mgr.nodes[cdm_mgr.cdm_count].lock);
+		cdm_mgr.nodes[cdm_mgr.cdm_count].device = hw;
+		cdm_mgr.nodes[cdm_mgr.cdm_count].data = data;
+		*index = cdm_mgr.cdm_count;
+		mutex_unlock(&cdm_mgr.nodes[cdm_mgr.cdm_count].lock);
+		cdm_mgr.cdm_count++;
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_CDM, "CDM registration failed type=%d count=%d",
+			type, cdm_mgr.cdm_count);
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+
+int cam_cdm_intf_deregister_hw_cdm(struct cam_hw_intf *hw,
+	struct cam_cdm_private_dt_data *data, enum cam_cdm_type type,
+	uint32_t index)
+{
+	int rc = -EINVAL;
+
+	if ((!hw) || (!data))
+		return rc;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	mutex_lock(&cam_cdm_mgr_lock);
+	if ((type == CAM_VIRTUAL_CDM) &&
+		(hw == cdm_mgr.nodes[CAM_SW_CDM_INDEX].device) &&
+		(index == CAM_SW_CDM_INDEX)) {
+		mutex_lock(&cdm_mgr.nodes[cdm_mgr.cdm_count].lock);
+		cdm_mgr.nodes[CAM_SW_CDM_INDEX].device = NULL;
+		cdm_mgr.nodes[CAM_SW_CDM_INDEX].data = NULL;
+		mutex_unlock(&cdm_mgr.nodes[cdm_mgr.cdm_count].lock);
+		rc = 0;
+	} else if ((type == CAM_HW_CDM) &&
+		(hw == cdm_mgr.nodes[index].device)) {
+		mutex_lock(&cdm_mgr.nodes[index].lock);
+		cdm_mgr.nodes[index].device = NULL;
+		cdm_mgr.nodes[index].data = NULL;
+		mutex_unlock(&cdm_mgr.nodes[index].lock);
+		cdm_mgr.cdm_count--;
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_CDM, "CDM Deregistration failed type=%d index=%d",
+			type, index);
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+
+static int cam_cdm_set_irq_line_test(void *data, u64 val)
+{
+	int i, rc = 0;
+	struct cam_hw_intf *hw_intf;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return rc;
+	}
+	mutex_lock(&cam_cdm_mgr_lock);
+
+	for (i = 0 ; i < cdm_mgr.cdm_count; i++) {
+		if (!cdm_mgr.nodes[i].device || !cdm_mgr.nodes[i].data) {
+			CAM_ERR(CAM_CDM, "invalid node present in index=%d", i);
+			continue;
+		}
+
+		hw_intf = cdm_mgr.nodes[i].device;
+
+		if (hw_intf->hw_ops.test_irq_line) {
+			CAM_DBG(CAM_CDM, "Testing irq line for CDM at index %d", i);
+
+			rc = hw_intf->hw_ops.test_irq_line(hw_intf->hw_priv);
+			if (rc)
+				CAM_ERR(CAM_CDM,
+					"[%d] : CDM%d type %d - irq line test failed rc %d",
+					i, hw_intf->hw_idx, hw_intf->hw_type, rc);
+			else
+				CAM_INFO(CAM_CDM,
+					"[%d] : CDM%d type %d - irq line test passed",
+					i, hw_intf->hw_idx, hw_intf->hw_type);
+		} else {
+			CAM_WARN(CAM_CDM, "test irq line interface not present for cdm at index %d",
+				i);
+		}
+	}
+
+	mutex_unlock(&cam_cdm_mgr_lock);
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+
+static int cam_cdm_get_irq_line_test(void *data, u64 *val)
+{
+	return 0;
+}
+
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_cdm_irq_line_test, cam_cdm_get_irq_line_test,
+	cam_cdm_set_irq_line_test, "%16llu");
+
+int cam_cdm_debugfs_init(struct cam_cdm_intf_mgr *mgr)
+{
+	struct dentry *dbgfileptr = NULL;
+	int rc;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("cdm", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "DebugFS could not create directory!");
+		return rc;
+	}
+
+	mgr->dentry = dbgfileptr;
+
+	debugfs_create_file("test_irq_line", 0644,
+		mgr->dentry, NULL, &cam_cdm_irq_line_test);
+
+	return 0;
+}
+
+static int cam_cdm_intf_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i, rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	rc = cam_cdm_intf_mgr_soc_get_dt_properties(pdev, &cdm_mgr);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to get dt properties");
+		return rc;
+	}
+	mutex_lock(&cam_cdm_mgr_lock);
+	for (i = 0 ; i < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM; i++) {
+		mutex_init(&cdm_mgr.nodes[i].lock);
+		cdm_mgr.nodes[i].device = NULL;
+		cdm_mgr.nodes[i].data = NULL;
+		cdm_mgr.nodes[i].refcount = 0;
+	}
+	cdm_mgr.probe_done = true;
+	cdm_mgr.refcount = 0;
+	mutex_unlock(&cam_cdm_mgr_lock);
+	rc = cam_virtual_cdm_probe(pdev);
+	if (rc) {
+		mutex_lock(&cam_cdm_mgr_lock);
+		cdm_mgr.probe_done = false;
+		for (i = 0 ; i < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM; i++) {
+			if (cdm_mgr.nodes[i].device || cdm_mgr.nodes[i].data ||
+				(cdm_mgr.nodes[i].refcount != 0))
+				CAM_ERR(CAM_CDM,
+					"Valid node present in index=%d", i);
+			mutex_destroy(&cdm_mgr.nodes[i].lock);
+			cdm_mgr.nodes[i].device = NULL;
+			cdm_mgr.nodes[i].data = NULL;
+			cdm_mgr.nodes[i].refcount = 0;
+		}
+		mutex_unlock(&cam_cdm_mgr_lock);
+	}
+
+	cam_cdm_debugfs_init(&cdm_mgr);
+
+	CAM_DBG(CAM_CDM, "CDM Intf component bound successfully");
+
+	return rc;
+}
+
+static void cam_cdm_intf_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return;
+	}
+
+	if (cam_virtual_cdm_remove(pdev)) {
+		CAM_ERR(CAM_CDM, "Virtual CDM remove failed");
+		return;
+	}
+	put_cdm_mgr_refcount();
+
+	mutex_lock(&cam_cdm_mgr_lock);
+	if (cdm_mgr.refcount != 0) {
+		CAM_ERR(CAM_CDM, "cdm manger refcount not zero %d",
+			cdm_mgr.refcount);
+		goto end;
+	}
+
+	for (i = 0 ; i < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM; i++) {
+		if (cdm_mgr.nodes[i].device || cdm_mgr.nodes[i].data ||
+			(cdm_mgr.nodes[i].refcount != 0)) {
+			CAM_ERR(CAM_CDM, "Valid node present in index=%d", i);
+			goto end;
+		}
+		mutex_lock(&cdm_mgr.nodes[i].lock);
+		cdm_mgr.nodes[i].device = NULL;
+		cdm_mgr.nodes[i].data = NULL;
+		cdm_mgr.nodes[i].refcount = 0;
+		mutex_unlock(&cdm_mgr.nodes[i].lock);
+		mutex_destroy(&cdm_mgr.nodes[i].lock);
+	}
+
+	cdm_mgr.probe_done = false;
+
+end:
+	mutex_unlock(&cam_cdm_mgr_lock);
+}
+
+const static struct component_ops cam_cdm_intf_component_ops = {
+	.bind = cam_cdm_intf_component_bind,
+	.unbind = cam_cdm_intf_component_unbind,
+};
+
+static int cam_cdm_intf_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CDM, "Adding CDM INTF component");
+	rc = component_add(&pdev->dev, &cam_cdm_intf_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CDM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_cdm_intf_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_cdm_intf_component_ops);
+	return 0;
+}
+
+struct platform_driver cam_cdm_intf_driver = {
+	.probe = cam_cdm_intf_probe,
+	.remove = cam_cdm_intf_remove,
+	.driver = {
+		.name = "msm_cam_cdm_intf",
+		.owner = THIS_MODULE,
+		.of_match_table = msm_cam_cdm_intf_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_cdm_intf_init_module(void)
+{
+	return platform_driver_register(&cam_cdm_intf_driver);
+}
+
+void cam_cdm_intf_exit_module(void)
+{
+	platform_driver_unregister(&cam_cdm_intf_driver);
+}
+
+MODULE_DESCRIPTION("MSM Camera CDM Intf driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_intf_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_intf_api.h
@@ -0,0 +1,349 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_API_H_
+#define _CAM_CDM_API_H_
+
+#include <media/cam_defs.h>
+#include "cam_cdm_util.h"
+#include "cam_soc_util.h"
+#include "cam_packet_util.h"
+
+#define CAM_CDM_BL_CMD_MAX  25
+
+/* enum cam_cdm_id - Enum for possible CAM CDM hardwares */
+enum cam_cdm_id {
+	CAM_CDM_VIRTUAL,
+	CAM_CDM_HW_ANY,
+	CAM_CDM_CPAS,
+	CAM_CDM_IFE,
+	CAM_CDM_TFE,
+	CAM_CDM_OPE,
+	CAM_CDM_IPE0,
+	CAM_CDM_IPE1,
+	CAM_CDM_BPS,
+	CAM_CDM_VFE,
+	CAM_CDM_RT,
+	CAM_CDM_MAX
+};
+
+/* enum cam_cdm_cb_status - Enum for possible CAM CDM callback */
+enum cam_cdm_cb_status {
+	CAM_CDM_CB_STATUS_BL_SUCCESS,
+	CAM_CDM_CB_STATUS_INVALID_BL_CMD,
+	CAM_CDM_CB_STATUS_PAGEFAULT,
+	CAM_CDM_CB_STATUS_HW_RESET_ONGOING,
+	CAM_CDM_CB_STATUS_HW_RESET_DONE,
+	CAM_CDM_CB_STATUS_HW_FLUSH,
+	CAM_CDM_CB_STATUS_HW_RESUBMIT,
+	CAM_CDM_CB_STATUS_HW_ERROR,
+	CAM_CDM_CB_STATUS_UNKNOWN_ERROR,
+};
+
+/* enum cam_cdm_bl_cmd_addr_type - Enum for possible CDM bl cmd addr types */
+enum cam_cdm_bl_cmd_addr_type {
+	CAM_CDM_BL_CMD_TYPE_MEM_HANDLE,
+	CAM_CDM_BL_CMD_TYPE_HW_IOVA,
+	CAM_CDM_BL_CMD_TYPE_KERNEL_IOVA,
+};
+
+/* enum cam_cdm_bl_fifo - interface commands.*/
+enum cam_cdm_bl_fifo_queue {
+	CAM_CDM_BL_FIFO_0,
+	CAM_CDM_BL_FIFO_1,
+	CAM_CDM_BL_FIFO_2,
+	CAM_CDM_BL_FIFO_3,
+	CAM_CDM_BL_FIFO_MAX,
+};
+
+/**
+ * struct cam_cdm_acquire_data - Cam CDM acquire data structure
+ *
+ * @identifier : Input identifier string which is the device label from dt
+ *                     like vfe, ife, jpeg etc
+ * @cell_index : Input integer identifier pointing to the cell index from dt
+ *                     of the device. This can be used to form a unique string
+ *                     with @identifier like vfe0, ife1, jpeg0 etc
+ * @id : ID of a specific or any CDM HW which needs to be acquired.
+ * @userdata : Input private data which will be returned as part
+ *                     of callback.
+ * @cam_cdm_callback : Input callback pointer for triggering the
+ *                     callbacks from CDM driver
+ *                     @handle : CDM Client handle
+ *                     @userdata : Private data given at the time of acquire
+ *                     @status : Callback status
+ *                     @cookie : Cookie if the callback is gen irq status or
+ *                               pf_args if it is page fault
+ * @base_array_cnt : Input number of ioremapped address pair pointing
+ *                     in base_array, needed only if selected cdm is a virtual.
+ * @base_array : Input pointer to ioremapped address pair arrary
+ *                     needed only if selected cdm is a virtual.
+ * @priority : Priority of the client.
+ * @cdm_version : CDM version is output while acquiring HW cdm and
+ *                     it is Input while acquiring virtual cdm.
+ *                     Currently fixing it to one version below
+ *                     acquire API.
+ * @ops : Output pointer updated by cdm driver to the CDM
+ *                     util ops for this HW version of CDM acquired.
+ * @handle  : Output Unique handle generated for this acquire
+ * @hw_idx  : The physical CDM acquired
+ *
+ */
+struct cam_cdm_acquire_data {
+	char identifier[128];
+	uint32_t cell_index;
+	enum cam_cdm_id id;
+	void *userdata;
+	void (*cam_cdm_callback)(uint32_t handle, void *userdata,
+		enum cam_cdm_cb_status status, void *cookie);
+	uint32_t base_array_cnt;
+	struct cam_soc_reg_map *base_array[CAM_SOC_MAX_BLOCK];
+	enum cam_cdm_bl_fifo_queue priority;
+	struct cam_hw_version cdm_version;
+	struct cam_cdm_utils_ops *ops;
+	uint32_t handle;
+	uint32_t hw_idx;
+};
+
+/**
+ * struct cam_cdm_bl_cmd - Cam CDM HW bl command
+ *
+ * @bl_addr : Union of all three type for CDM BL commands
+ * @mem_handle : Input mem handle of bl cmd
+ * @offset : Input offset of the actual bl cmd in the memory pointed
+ *           by mem_handle
+ * @len : Input length of the BL command, Cannot be more than 1MB and
+ *           this is will be validated with offset+size of the memory pointed
+ *           by mem_handle
+ * @enable_debug_gen_irq : bool flag to submit extra gen_irq afteR bl_command
+ * @arbitrate : bool flag to arbitrate on submitted BL boundary
+ */
+struct cam_cdm_bl_cmd {
+	union {
+		int32_t mem_handle;
+		uint32_t *hw_iova;
+		uintptr_t kernel_iova;
+	} bl_addr;
+	uint32_t offset;
+	uint32_t len;
+	bool enable_debug_gen_irq;
+	bool arbitrate;
+};
+
+/**
+ * struct cam_cdm_bl_request - Cam CDM HW base & length (BL) request
+ *
+ * @flag : 1 for callback needed and 0 for no callback when this BL
+ *            request is done
+ * @gen_irq_arb : enum for setting arbitration in gen_irq
+ * @userdata :Input private data which will be returned as part
+ *             of callback if request for this bl request in flags.
+ * @type : type of the submitted bl cmd address.
+ * @cmd_arrary_count : Input number of BL commands to be submitted to CDM
+ * @cookie : Cookie if the callback is gen irq status
+ * @avail_buff_size: Available buffer size in bytes
+ * @bl_cmd_array     : Input payload holding the BL cmd's arrary
+ *                     to be sumbitted.
+ *
+ */
+struct cam_cdm_bl_request {
+	bool flag;
+	bool gen_irq_arb;
+	void *userdata;
+	enum cam_cdm_bl_cmd_addr_type type;
+	uint32_t cmd_arrary_count;
+	struct cam_kmd_buf_info *genirq_buff;
+	uint64_t cookie;
+	union {
+		struct cam_cdm_bl_cmd cmd[1];
+		__DECLARE_FLEX_ARRAY(struct cam_cdm_bl_cmd, cmd_flex);
+	};
+};
+
+/**
+ * struct cam_cdm_bl_data - last submiited CDM BL data
+ *
+ * @mem_handle : Input mem handle of bl cmd
+ * @hw_addr    : Hw address of submitted Bl command
+ * @offset     : Input offset of the actual bl cmd in the memory pointed
+ *               by mem_handle
+ * @len        : length of submitted Bl command to CDM.
+ * @input_len  : Input length of the BL command, Cannot be more than 1MB and
+ *           this is will be validated with offset+size of the memory pointed
+ *           by mem_handle
+ * @type       :  CDM bl cmd addr types.
+ */
+struct cam_cdm_bl_data {
+	int32_t mem_handle;
+	dma_addr_t hw_addr;
+	uint32_t offset;
+	size_t len;
+	uint32_t  input_len;
+	enum cam_cdm_bl_cmd_addr_type type;
+};
+
+/**
+ * struct cam_cdm_bl_info
+ *
+ * @bl_count   : No. of Bl commands submiited to CDM.
+ * @cmd        : payload holding the BL cmd's arrary
+ *               that is sumbitted.
+ *
+ */
+struct cam_cdm_bl_info {
+	int32_t bl_count;
+	struct cam_cdm_bl_data cmd[CAM_CDM_BL_CMD_MAX];
+};
+
+/**
+ * @brief : API to get the CDM capabilities for a camera device type
+ *
+ * @identifier : Input pointer to a string which is the device label from dt
+ *                   like vfe, ife, jpeg etc, We do not need cell index
+ *                   assuming all devices of a single type maps to one SMMU
+ *                   client
+ * @cdm_handles : Input iommu handle memory pointer to update handles
+ *
+ * @return 0 on success
+ */
+int cam_cdm_get_iommu_handle(char *identifier,
+	struct cam_iommu_handle *cdm_handles);
+
+/**
+ * @brief : API to acquire a CDM
+ *
+ * @data : Input data for the CDM to be acquired
+ *
+ * @return 0 on success
+ */
+int cam_cdm_acquire(struct cam_cdm_acquire_data *data);
+
+/**
+ * @brief : API to release a previously acquired CDM
+ *
+ * @handle : Input handle for the CDM to be released
+ *
+ * @return 0 on success
+ */
+int cam_cdm_release(uint32_t handle);
+
+/**
+ * @brief : API to submit the base & length (BL's) for acquired CDM
+ *
+ * @handle : Input cdm handle to which the BL's needs to be sumbitted.
+ * @data   : Input pointer to the BL's to be sumbitted
+ *
+ * @return 0 on success
+ */
+int cam_cdm_submit_bls(uint32_t handle, struct cam_cdm_bl_request *data);
+
+/**
+ * @brief : API to stream ON a previously acquired CDM,
+ *          during this we turn on/off clocks/power based on active clients.
+ *
+ * @handle : Input handle for the CDM to be released
+ *
+ * @return 0 on success
+ */
+int cam_cdm_stream_on(uint32_t handle);
+
+/**
+ * @brief : API to stream OFF a previously acquired CDM,
+ *          during this we turn on/off clocks/power based on active clients.
+ *
+ * @handle : Input handle for the CDM to be released
+ *
+ * @return 0 on success
+ */
+int cam_cdm_stream_off(uint32_t handle);
+
+/**
+ * @brief : API to reset previously acquired CDM,
+ *          this should be only performed only if the CDM is private.
+ *
+ * @handle : Input handle of the CDM to reset
+ *
+ * @return 0 on success
+ */
+int cam_cdm_reset_hw(uint32_t handle);
+
+/**
+ * @brief : API to publish CDM ops to HW blocks like IFE
+ *
+ * @return : CDM operations
+ *
+ */
+struct cam_cdm_utils_ops *cam_cdm_publish_ops(void);
+
+/**
+ * @brief : API to register CDM hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_hw_cdm_init_module(void);
+
+/**
+ * @brief : API to register CDM interface to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_cdm_intf_init_module(void);
+
+/**
+ * @brief : API to remove CDM interface from platform framework.
+ */
+void cam_cdm_intf_exit_module(void);
+
+/**
+ * @brief : API to remove CDM hw from platform framework.
+ */
+void cam_hw_cdm_exit_module(void);
+
+/**
+ * @brief : API to flush previously acquired CDM,
+ *          this should be only performed only if the CDM is private.
+ *
+ * @handle : Input handle of the CDM to reset
+ *
+ * @return 0 on success
+ */
+int cam_cdm_flush_hw(uint32_t handle);
+
+/**
+ * @brief : API to detect culprit bl_tag in previously acquired CDM,
+ *          this should be only performed only if the CDM is private.
+ *
+ * @handle : Input handle of the CDM to reset
+ *
+ * @return 0 on success
+ */
+int cam_cdm_handle_error(uint32_t handle);
+
+/**
+ * @brief : API get CDM ops
+ *
+ * @return : CDM operations
+ *
+ */
+struct cam_cdm_utils_ops *cam_cdm_publish_ops(void);
+
+/**
+ * @brief : API to detect hang in previously acquired CDM,
+ *          this should be only performed only if the CDM is private.
+ *
+ * @handle : Input handle of the CDM to detect hang
+ *
+ * @return 0 on success
+ */
+int cam_cdm_detect_hang_error(uint32_t handle);
+
+/**
+ * @brief : API to dump the CDM Debug registers
+ *
+ * @handle : Input handle of the CDM to dump the registers
+ *
+ * @return 0 on success
+ */
+int cam_cdm_dump_debug_registers(uint32_t handle);
+#endif /* _CAM_CDM_API_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_soc.c
@@ -0,0 +1,242 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include "cam_soc_util.h"
+#include "cam_smmu_api.h"
+#include "cam_cdm.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cdm_soc.h"
+
+#define CAM_CDM_OFFSET_FROM_REG(x, y) ((x)->offsets[y].offset)
+#define CAM_CDM_ATTR_FROM_REG(x, y) ((x)->offsets[y].attribute)
+
+bool cam_cdm_read_hw_reg(struct cam_hw_info *cdm_hw,
+	uint32_t reg, uint32_t *value)
+{
+	void __iomem *reg_addr;
+	void __iomem *base =
+		cdm_hw->soc_info.reg_map[CAM_HW_CDM_BASE_INDEX].mem_base;
+	resource_size_t mem_len =
+		cdm_hw->soc_info.reg_map[CAM_HW_CDM_BASE_INDEX].size;
+
+	CAM_DBG(CAM_CDM, "E: b=%pK blen=%d off=%x", (void __iomem *)base,
+		(int)mem_len, reg);
+
+	reg_addr = (base + reg);
+	if (reg_addr > (base + mem_len)) {
+		CAM_ERR_RATE_LIMIT(CAM_CDM,
+			"Invalid mapped region %d", reg);
+		goto permission_error;
+	}
+	*value = cam_io_r_mb(reg_addr);
+	CAM_DBG(CAM_CDM, "X b=%pK off=%x val=%x",
+		(void __iomem *)base, reg,
+		*value);
+	return false;
+
+permission_error:
+	*value = 0;
+	return true;
+
+}
+
+bool cam_cdm_write_hw_reg(struct cam_hw_info *cdm_hw,
+	uint32_t reg, uint32_t value)
+{
+	void __iomem *reg_addr;
+	void __iomem *base =
+		cdm_hw->soc_info.reg_map[CAM_HW_CDM_BASE_INDEX].mem_base;
+	resource_size_t mem_len =
+		cdm_hw->soc_info.reg_map[CAM_HW_CDM_BASE_INDEX].size;
+
+	CAM_DBG(CAM_CDM, "E: b=%pK off=%x val=%x", (void __iomem *)base,
+		reg, value);
+
+	reg_addr = (base + reg);
+	if (reg_addr > (base + mem_len)) {
+		CAM_ERR_RATE_LIMIT(CAM_CDM,
+			"Accessing invalid region:%d\n",
+			reg);
+		goto permission_error;
+	}
+	cam_io_w_mb(value, reg_addr);
+	return false;
+
+permission_error:
+	return true;
+
+}
+
+int cam_cdm_soc_load_dt_private(struct platform_device *pdev,
+	struct cam_cdm_private_dt_data *cdm_pvt_data)
+{
+	int i, rc = -EINVAL, num_fifo_entries = 0, num_clients = 0;
+
+	num_clients = of_property_count_strings(
+			pdev->dev.of_node, "cdm-client-names");
+	if ((num_clients <= 0) ||
+		(num_clients > CAM_PER_CDM_MAX_REGISTERED_CLIENTS)) {
+		CAM_ERR(CAM_CDM, "Invalid count of client names count=%d",
+			num_clients);
+
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cdm_pvt_data->dt_num_supported_clients = (uint32_t)num_clients;
+	CAM_DBG(CAM_CDM, "Num supported cdm_client = %u",
+		cdm_pvt_data->dt_num_supported_clients);
+
+	cdm_pvt_data->dt_cdm_shared = true;
+
+	for (i = 0; i < cdm_pvt_data->dt_num_supported_clients; i++) {
+		rc = of_property_read_string_index(pdev->dev.of_node,
+			"cdm-client-names", i,
+			&(cdm_pvt_data->dt_cdm_client_name[i]));
+		CAM_DBG(CAM_CDM, "cdm-client-names[%d] = %s", i,
+			cdm_pvt_data->dt_cdm_client_name[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_CDM,
+				"Reading cdm-client-names failed for client: %d",
+				i);
+			goto end;
+		}
+
+	}
+
+	cdm_pvt_data->is_single_ctx_cdm =
+		of_property_read_bool(pdev->dev.of_node, "single-context-cdm");
+
+	rc = of_property_read_u32(pdev->dev.of_node, "cam_hw_pid", &cdm_pvt_data->pid);
+	if (rc)
+		cdm_pvt_data->pid = -1;
+
+	rc = of_property_read_u32(pdev->dev.of_node, "cam-hw-mid", &cdm_pvt_data->mid);
+	if (rc)
+		cdm_pvt_data->mid = -1;
+
+	rc = of_property_read_u8(pdev->dev.of_node, "cdm-priority-group",
+			&cdm_pvt_data->priority_group);
+	if (rc < 0) {
+		cdm_pvt_data->priority_group = 0;
+		rc = 0;
+	}
+
+	cdm_pvt_data->config_fifo = of_property_read_bool(pdev->dev.of_node,
+		"config-fifo");
+	if (cdm_pvt_data->config_fifo) {
+		num_fifo_entries = of_property_count_u32_elems(
+			pdev->dev.of_node,
+			"fifo-depths");
+		if (num_fifo_entries != CAM_CDM_NUM_BL_FIFO) {
+			CAM_ERR(CAM_CDM,
+				"Wrong number of configurable FIFOs %d",
+				num_fifo_entries);
+			rc = -EINVAL;
+			goto end;
+		}
+		for (i = 0; i < num_fifo_entries; i++) {
+			rc = of_property_read_u32_index(pdev->dev.of_node,
+				"fifo-depths", i, &cdm_pvt_data->fifo_depth[i]);
+			if (rc < 0) {
+				CAM_ERR(CAM_CDM,
+					"Unable to read fifo-depth rc %d",
+					rc);
+				goto end;
+			}
+			CAM_DBG(CAM_CDM, "FIFO%d depth is %d",
+				i, cdm_pvt_data->fifo_depth[i]);
+		}
+	} else {
+		for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+			cdm_pvt_data->fifo_depth[i] =
+				CAM_CDM_BL_FIFO_LENGTH_MAX_DEFAULT;
+			CAM_DBG(CAM_CDM, "FIFO%d depth is %d",
+				i, cdm_pvt_data->fifo_depth[i]);
+		}
+	}
+end:
+	return rc;
+}
+
+int cam_hw_cdm_soc_get_dt_properties(struct cam_hw_info *cdm_hw,
+	const struct of_device_id *table)
+{
+	int rc;
+	struct cam_hw_soc_info *soc_ptr;
+	const struct of_device_id *id;
+	struct cam_cdm *cdm_core = NULL;
+
+	if (!cdm_hw  || (cdm_hw->soc_info.soc_private)
+		|| !(cdm_hw->soc_info.pdev))
+		return -EINVAL;
+
+	cdm_core = cdm_hw->core_info;
+	soc_ptr = &cdm_hw->soc_info;
+
+	rc = cam_soc_util_get_dt_properties(soc_ptr);
+	if (rc != 0) {
+		CAM_ERR(CAM_CDM, "Failed to retrieve the CDM dt properties");
+		goto end;
+	}
+
+	soc_ptr->soc_private = kzalloc(
+			sizeof(struct cam_cdm_private_dt_data),
+			GFP_KERNEL);
+	if (!soc_ptr->soc_private)
+		return -ENOMEM;
+
+	rc = cam_cdm_soc_load_dt_private(soc_ptr->pdev,
+		soc_ptr->soc_private);
+	if (rc != 0) {
+		CAM_ERR(CAM_CDM, "Failed to load CDM dt private data");
+		goto error;
+	}
+
+	id = of_match_node(table, soc_ptr->pdev->dev.of_node);
+	if ((!id) || !(id->data)) {
+		CAM_ERR(CAM_CDM, "Failed to retrieve the CDM id table");
+		goto error;
+	}
+	cdm_core->offsets =
+		(struct cam_cdm_hw_reg_offset *)id->data;
+
+	CAM_DBG(CAM_CDM, "name %s", cdm_core->name);
+
+	snprintf(cdm_core->name, sizeof(cdm_core->name), "%s%d",
+		id->compatible, soc_ptr->index);
+
+	CAM_DBG(CAM_CDM, "name %s", cdm_core->name);
+
+	goto end;
+
+error:
+	rc = -EINVAL;
+	kfree(soc_ptr->soc_private);
+	soc_ptr->soc_private = NULL;
+end:
+	return rc;
+}
+
+int cam_cdm_intf_mgr_soc_get_dt_properties(
+	struct platform_device *pdev, struct cam_cdm_intf_mgr *mgr)
+{
+	int rc;
+
+	rc = of_property_read_u32(pdev->dev.of_node,
+		"num-hw-cdm", &mgr->dt_supported_hw_cdm);
+	CAM_DBG(CAM_CDM, "Number of HW cdm supported =%d",
+		mgr->dt_supported_hw_cdm);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_soc.h
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_SOC_H_
+#define _CAM_CDM_SOC_H_
+
+#define CAM_HW_CDM_CPAS_0_NAME   "qcom,cam170-cpas-cdm0"
+#define CAM_HW_CDM_CPAS_NAME_1_0 "qcom,cam-cpas-cdm1_0"
+#define CAM_HW_CDM_CPAS_NAME_1_1 "qcom,cam-cpas-cdm1_1"
+#define CAM_HW_CDM_CPAS_NAME_1_2 "qcom,cam-cpas-cdm1_2"
+#define CAM_HW_CDM_IFE_NAME_1_2  "qcom,cam-ife-cdm1_2"
+#define CAM_HW_CDM_CPAS_NAME_2_0 "qcom,cam-cpas-cdm2_0"
+#define CAM_HW_CDM_OPE_NAME_2_0  "qcom,cam-ope-cdm2_0"
+#define CAM_HW_CDM_CPAS_NAME_2_1 "qcom,cam-cpas-cdm2_1"
+#define CAM_HW_CDM_RT_NAME_2_1   "qcom,cam-rt-cdm2_1"
+#define CAM_HW_CDM_OPE_NAME_2_1  "qcom,cam-ope-cdm2_1"
+#define CAM_HW_CDM_RT_NAME_2_2   "qcom,cam-rt-cdm2_2"
+
+int cam_hw_cdm_soc_get_dt_properties(struct cam_hw_info *cdm_hw,
+	const struct of_device_id *table);
+bool cam_cdm_read_hw_reg(struct cam_hw_info *cdm_hw,
+	uint32_t reg, uint32_t *value);
+bool cam_cdm_write_hw_reg(struct cam_hw_info *cdm_hw,
+	uint32_t reg, uint32_t value);
+int cam_cdm_intf_mgr_soc_get_dt_properties(
+	struct platform_device *pdev,
+	struct cam_cdm_intf_mgr *mgr);
+int cam_cdm_soc_load_dt_private(struct platform_device *pdev,
+	struct cam_cdm_private_dt_data *ptr);
+
+#endif /* _CAM_CDM_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_util.c
@@ -0,0 +1,1188 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/bug.h>
+
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm_util.h"
+#include "cam_cdm.h"
+#include "cam_io_util.h"
+
+#define CAM_CDM_DWORD 4
+
+#define CAM_CDM_SW_CMD_COUNT    2
+#define CAM_CMD_LENGTH_MASK     0xFFFF
+#define CAM_CDM_REG_OFFSET_MASK 0x00FFFFFF
+
+#define CAM_CDM_DMI_DATA_HI_OFFSET   8
+#define CAM_CDM_DMI_DATA_OFFSET      8
+#define CAM_CDM_DMI_DATA_LO_OFFSET   12
+
+static unsigned int CDMCmdHeaderSizes[
+	CAM_CDM_CMD_PRIVATE_BASE + CAM_CDM_SW_CMD_COUNT] = {
+	0, /* UNUSED*/
+	3, /* DMI*/
+	0, /* UNUSED*/
+	2, /* RegContinuous*/
+	1, /* RegRandom*/
+	2, /* BUFFER_INDIREC*/
+	2, /* GenerateIRQ*/
+	3, /* WaitForEvent*/
+	1, /* ChangeBase*/
+	1, /* PERF_CONTROL*/
+	3, /* DMI32*/
+	3, /* DMI64*/
+	3, /* WaitCompEvent*/
+	3, /* ClearCompEvent*/
+	3, /* WaitPrefetchDisable*/
+};
+
+/**
+ * struct cdm_regrandom_cmd - Definition for CDM random register command.
+ * @count: Number of register writes
+ * @reserved: reserved bits
+ * @cmd: Command ID (CDMCmd)
+ */
+struct cdm_regrandom_cmd {
+	unsigned int count    : 16;
+	unsigned int reserved : 8;
+	unsigned int cmd      : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_regcontinuous_cmd - Definition for a CDM register range command.
+ * @count: Number of register writes
+ * @reserved0: reserved bits
+ * @cmd: Command ID (CDMCmd)
+ * @offset: Start address of the range of registers
+ * @reserved1: reserved bits
+ */
+struct cdm_regcontinuous_cmd {
+	unsigned int count     : 16;
+	unsigned int reserved0 : 8;
+	unsigned int cmd       : 8;
+	unsigned int offset    : 24;
+	unsigned int reserved1 : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_dmi_cmd - Definition for a CDM DMI command.
+ * @length: Number of bytes in LUT - 1
+ * @reserved: reserved bits
+ * @cmd: Command ID (CDMCmd)
+ * @addr: Address of the LUT in memory
+ * @DMIAddr: Address of the target DMI config register
+ * @DMISel: DMI identifier
+ */
+struct cdm_dmi_cmd {
+	unsigned int length   : 16;
+	unsigned int reserved : 8;
+	unsigned int cmd      : 8;
+	unsigned int addr;
+	unsigned int DMIAddr  : 24;
+	unsigned int DMISel   : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_indirect_cmd - Definition for a CDM indirect buffer command.
+ * @length: Number of bytes in buffer - 1
+ * @reserved: reserved bits
+ * @cmd: Command ID (CDMCmd)
+ * @addr:  Device address of the indirect buffer
+ */
+struct cdm_indirect_cmd {
+	unsigned int length     : 16;
+	unsigned int reserved   : 8;
+	unsigned int cmd        : 8;
+	unsigned int addr;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_changebase_cmd - Definition for CDM base address change command.
+ * @base: Base address to be changed to
+ * @cmd:Command ID (CDMCmd)
+ */
+struct cdm_changebase_cmd {
+	unsigned int base   : 24;
+	unsigned int cmd    : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_wait_event_cmd - Definition for a CDM Gen IRQ command.
+ * @mask: Mask for the events
+ * @id: ID to read back for debug
+ * @iw_reserved: reserved bits
+ * @iw: iw AHB write bit
+ * @cmd:Command ID (CDMCmd)
+ * @offset: Offset to where data is written
+ * @offset_reserved: reserved bits
+ * @data: data returned in IRQ_USR_DATA
+ */
+struct cdm_wait_event_cmd {
+	unsigned int mask             : 8;
+	unsigned int id               : 8;
+	unsigned int iw_reserved      : 7;
+	unsigned int iw               : 1;
+	unsigned int cmd              : 8;
+	unsigned int offset           : 24;
+	unsigned int offset_reserved  : 8;
+	unsigned int data;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_genirq_cmd - Definition for a CDM Wait event command.
+ * @reserved: reserved bits
+ * @cmd:Command ID (CDMCmd)
+ * @userdata: userdata returned in IRQ_USR_DATA
+ */
+struct cdm_genirq_cmd {
+	unsigned int reserved   : 24;
+	unsigned int cmd        : 8;
+	unsigned int userdata;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_perf_ctrl_cmd_t - Definition for CDM perf control command.
+ * @perf: perf command
+ * @reserved: reserved bits
+ * @cmd:Command ID (CDMCmd)
+ */
+struct cdm_perf_ctrl_cmd {
+	unsigned int perf     : 2;
+	unsigned int reserved : 22;
+	unsigned int cmd      : 8;
+} __attribute__((__packed__));
+
+struct cdm_wait_comp_event_cmd {
+	unsigned int reserved   : 8;
+	unsigned int id         : 8;
+	unsigned int id_reserved: 8;
+	unsigned int cmd        : 8;
+	unsigned int mask1;
+	unsigned int mask2;
+} __attribute__((__packed__));
+
+struct cdm_clear_comp_event_cmd {
+	unsigned int reserved   : 8;
+	unsigned int id         : 8;
+	unsigned int id_reserved: 8;
+	unsigned int cmd        : 8;
+	unsigned int mask1;
+	unsigned int mask2;
+} __attribute__((__packed__));
+
+struct cdm_prefetch_disable_event_cmd {
+	unsigned int reserved   : 8;
+	unsigned int id         : 8;
+	unsigned int id_reserved: 8;
+	unsigned int cmd        : 8;
+	unsigned int mask1;
+	unsigned int mask2;
+} __attribute__((__packed__));
+
+uint32_t cam_cdm_get_cmd_header_size(unsigned int command)
+{
+	return CDMCmdHeaderSizes[command];
+}
+
+uint32_t cam_cdm_required_size_dmi(void)
+{
+	return cam_cdm_get_cmd_header_size(CAM_CDM_CMD_DMI);
+}
+
+uint32_t cam_cdm_required_size_reg_continuous(uint32_t numVals)
+{
+	if (!numVals) {
+		CAM_WARN(CAM_CDM, "numVals cant be 0");
+		return 0;
+	}
+
+	return cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT) + numVals;
+}
+
+uint32_t cam_cdm_required_size_reg_random(uint32_t numRegVals)
+{
+	return cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM) +
+		(2 * numRegVals);
+}
+
+uint32_t cam_cdm_required_size_indirect(void)
+{
+	return cam_cdm_get_cmd_header_size(CAM_CDM_CMD_BUFF_INDIRECT);
+}
+
+uint32_t cam_cdm_required_size_genirq(void)
+{
+	return cam_cdm_get_cmd_header_size(CAM_CDM_CMD_GEN_IRQ);
+}
+
+uint32_t cam_cdm_required_size_wait_event(void)
+{
+	return cam_cdm_get_cmd_header_size(CAM_CDM_CMD_WAIT_EVENT);
+}
+
+uint32_t cam_cdm_required_size_changebase(void)
+{
+	return cam_cdm_get_cmd_header_size(CAM_CDM_CMD_CHANGE_BASE);
+}
+
+uint32_t cam_cdm_required_size_comp_wait(void)
+{
+	return cam_cdm_get_cmd_header_size(CAM_CDM_CMD_COMP_WAIT);
+}
+
+uint32_t cam_cdm_required_size_clear_comp_event(void)
+{
+	return cam_cdm_get_cmd_header_size(CAM_CDM_CLEAR_COMP_WAIT);
+}
+
+uint32_t cam_cdm_required_size_prefetch_disable(void)
+{
+	return cam_cdm_get_cmd_header_size(CAM_CDM_WAIT_PREFETCH_DISABLE);
+}
+
+uint32_t cam_cdm_offsetof_dmi_addr(void)
+{
+	return offsetof(struct cdm_dmi_cmd, addr);
+}
+
+uint32_t cam_cdm_offsetof_indirect_addr(void)
+{
+	return offsetof(struct cdm_indirect_cmd, addr);
+}
+
+uint32_t *cam_cdm_write_dmi(uint32_t *pCmdBuffer, uint8_t dmiCmd,
+	uint32_t DMIAddr, uint8_t DMISel, uint32_t dmiBufferAddr,
+	uint32_t length)
+{
+	struct cdm_dmi_cmd *pHeader = (struct cdm_dmi_cmd *)pCmdBuffer;
+
+	pHeader->cmd        = CAM_CDM_CMD_DMI;
+	pHeader->addr = dmiBufferAddr;
+	pHeader->length = length;
+	pHeader->DMIAddr = DMIAddr;
+	pHeader->DMISel = DMISel;
+
+	pCmdBuffer += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_DMI);
+
+	return pCmdBuffer;
+}
+
+uint32_t *cam_cdm_write_regcontinuous(uint32_t *pCmdBuffer, uint32_t reg,
+	uint32_t numVals, uint32_t *pVals)
+{
+	uint32_t i;
+	struct cdm_regcontinuous_cmd *pHeader =
+		(struct cdm_regcontinuous_cmd *)pCmdBuffer;
+
+	pHeader->count = numVals;
+	pHeader->cmd = CAM_CDM_CMD_REG_CONT;
+	pHeader->reserved0 = 0;
+	pHeader->reserved1 = 0;
+	pHeader->offset = reg;
+
+	pCmdBuffer += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT);
+
+	for (i = 0; i < numVals; i++)
+		(((uint32_t *)pCmdBuffer)[i]) = (((uint32_t *)pVals)[i]);
+
+	pCmdBuffer += numVals;
+
+	return pCmdBuffer;
+}
+
+uint32_t *cam_cdm_write_regrandom(uint32_t *pCmdBuffer, uint32_t numRegVals,
+	uint32_t *pRegVals)
+{
+	uint32_t i;
+	uint32_t *dst, *src;
+	struct cdm_regrandom_cmd *pHeader =
+		(struct cdm_regrandom_cmd *)pCmdBuffer;
+
+	if (!numRegVals) {
+		CAM_ERR(CAM_CDM, "Number of reg-val pairs can not be 0");
+		return pCmdBuffer;
+	}
+
+	pHeader->count = numRegVals;
+	pHeader->cmd = CAM_CDM_CMD_REG_RANDOM;
+	pHeader->reserved = 0;
+
+	pCmdBuffer += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+	dst = pCmdBuffer;
+	src = pRegVals;
+	for (i = 0; i < numRegVals; i++) {
+		*dst++ = *src++;
+		*dst++ = *src++;
+	}
+
+	return dst;
+}
+
+uint32_t *cam_cdm_write_indirect(uint32_t *pCmdBuffer, uint32_t indirectBufAddr,
+	uint32_t length)
+{
+	struct cdm_indirect_cmd *pHeader =
+		(struct cdm_indirect_cmd *)pCmdBuffer;
+
+	pHeader->cmd = CAM_CDM_CMD_BUFF_INDIRECT;
+	pHeader->addr = indirectBufAddr;
+	pHeader->length = length - 1;
+
+	pCmdBuffer += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_BUFF_INDIRECT);
+
+	return pCmdBuffer;
+}
+
+void cam_cdm_write_genirq(uint32_t *pCmdBuffer, uint32_t userdata,
+		bool bit_wr_enable, uint32_t fifo_idx)
+{
+	struct cdm_genirq_cmd *pHeader = (struct cdm_genirq_cmd *)pCmdBuffer;
+
+	CAM_DBG(CAM_CDM, "userdata 0x%x, fifo_idx %d",
+		userdata, fifo_idx);
+
+	if (bit_wr_enable)
+		pHeader->reserved = (unsigned int)((fifo_idx << 1)
+			| (unsigned int)(bit_wr_enable));
+
+	pHeader->cmd = CAM_CDM_CMD_GEN_IRQ;
+	pHeader->userdata = (userdata << (8 * fifo_idx));
+}
+
+uint32_t *cam_cdm_write_wait_event(uint32_t *pcmdbuffer, uint32_t iw,
+	uint32_t id, uint32_t mask,
+	uint32_t offset, uint32_t data)
+{
+	struct cdm_wait_event_cmd *pheader =
+		(struct cdm_wait_event_cmd *)pcmdbuffer;
+
+	pheader->cmd = CAM_CDM_CMD_WAIT_EVENT;
+	pheader->mask = mask;
+	pheader->data = data;
+	pheader->id = id;
+	pheader->iw = iw;
+	pheader->offset = offset;
+	pheader->iw_reserved = 0;
+	pheader->offset_reserved = 0;
+
+	pcmdbuffer += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_WAIT_EVENT);
+
+	return pcmdbuffer;
+}
+
+uint32_t *cam_cdm_write_changebase(uint32_t *pCmdBuffer, uint32_t base)
+{
+	struct cdm_changebase_cmd *pHeader =
+		(struct cdm_changebase_cmd *)pCmdBuffer;
+
+	CAM_DBG(CAM_CDM, "Change to base 0x%x", base);
+
+	pHeader->cmd = CAM_CDM_CMD_CHANGE_BASE;
+	pHeader->base = base;
+	pCmdBuffer += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_CHANGE_BASE);
+
+	return pCmdBuffer;
+}
+
+uint32_t *cam_cdm_write_wait_comp_event(
+	uint32_t *pCmdBuffer, uint32_t mask1, uint32_t mask2)
+{
+	struct cdm_wait_comp_event_cmd *pHeader =
+		(struct cdm_wait_comp_event_cmd *)pCmdBuffer;
+
+	pHeader->cmd = CAM_CDM_CMD_COMP_WAIT;
+	pHeader->mask1 = mask1;
+	pHeader->mask2 = mask2;
+
+	pCmdBuffer += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_COMP_WAIT);
+
+	return pCmdBuffer;
+}
+
+uint32_t *cam_cdm_write_clear_comp_event(
+	uint32_t *pCmdBuffer, uint32_t mask1, uint32_t mask2)
+{
+	struct cdm_clear_comp_event_cmd *pHeader =
+		(struct cdm_clear_comp_event_cmd *)pCmdBuffer;
+
+	pHeader->cmd = CAM_CDM_CLEAR_COMP_WAIT;
+	pHeader->mask1 = mask1;
+	pHeader->mask2 = mask2;
+
+	pCmdBuffer += cam_cdm_get_cmd_header_size(CAM_CDM_CLEAR_COMP_WAIT);
+
+	return pCmdBuffer;
+}
+
+uint32_t *cam_cdm_write_wait_prefetch_disable(
+	uint32_t                   *pCmdBuffer,
+	uint32_t                    id,
+	uint32_t                    mask1,
+	uint32_t                    mask2)
+{
+	struct cdm_prefetch_disable_event_cmd *pHeader =
+		(struct cdm_prefetch_disable_event_cmd *)pCmdBuffer;
+
+	pHeader->cmd = CAM_CDM_WAIT_PREFETCH_DISABLE;
+	pHeader->id  = id;
+	pHeader->mask1 = mask1;
+	pHeader->mask2 = mask2;
+
+	pCmdBuffer += cam_cdm_get_cmd_header_size(CAM_CDM_WAIT_PREFETCH_DISABLE);
+
+	return pCmdBuffer;
+}
+
+
+struct cam_cdm_utils_ops CDM170_ops = {
+	.cdm_get_cmd_header_size              = cam_cdm_get_cmd_header_size,
+	.cdm_required_size_dmi                = cam_cdm_required_size_dmi,
+	.cdm_required_size_reg_continuous     = cam_cdm_required_size_reg_continuous,
+	.cdm_required_size_reg_random         = cam_cdm_required_size_reg_random,
+	.cdm_required_size_indirect           = cam_cdm_required_size_indirect,
+	.cdm_required_size_genirq             = cam_cdm_required_size_genirq,
+	.cdm_required_size_wait_event         = cam_cdm_required_size_wait_event,
+	.cdm_required_size_changebase         = cam_cdm_required_size_changebase,
+	.cdm_required_size_comp_wait          = cam_cdm_required_size_comp_wait,
+	.cdm_required_size_clear_comp_event   = cam_cdm_required_size_clear_comp_event,
+	.cdm_required_size_prefetch_disable   = cam_cdm_required_size_prefetch_disable,
+	.cdm_offsetof_dmi_addr                = cam_cdm_offsetof_dmi_addr,
+	.cdm_offsetof_indirect_addr           = cam_cdm_offsetof_indirect_addr,
+	.cdm_write_dmi                        = cam_cdm_write_dmi,
+	.cdm_write_regcontinuous              = cam_cdm_write_regcontinuous,
+	.cdm_write_regrandom                  = cam_cdm_write_regrandom,
+	.cdm_write_indirect                   = cam_cdm_write_indirect,
+	.cdm_write_genirq                     = cam_cdm_write_genirq,
+	.cdm_write_wait_event                 = cam_cdm_write_wait_event,
+	.cdm_write_changebase                 = cam_cdm_write_changebase,
+	.cdm_write_wait_comp_event            = cam_cdm_write_wait_comp_event,
+	.cdm_write_clear_comp_event           = cam_cdm_write_clear_comp_event,
+	.cdm_write_wait_prefetch_disable      = cam_cdm_write_wait_prefetch_disable,
+};
+
+int cam_cdm_get_ioremap_from_base(uint32_t hw_base,
+	uint32_t base_array_size,
+	struct cam_soc_reg_map *base_table[CAM_SOC_MAX_BLOCK],
+	void __iomem **device_base)
+{
+	int ret = -EINVAL, i;
+
+	for (i = 0; i < base_array_size; i++) {
+		if (base_table[i])
+			CAM_DBG(CAM_CDM, "In loop %d ioremap for %x addr=%x",
+			i, (base_table[i])->mem_cam_base, hw_base);
+		if ((base_table[i]) &&
+			((base_table[i])->mem_cam_base == hw_base)) {
+			*device_base = (base_table[i])->mem_base;
+			ret = 0;
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static int cam_cdm_util_reg_cont_write(void __iomem *base_addr,
+	uint32_t *cmd_buf, uint32_t cmd_buf_size, uint32_t *used_bytes)
+{
+	int ret = 0;
+	uint32_t *data;
+	struct cdm_regcontinuous_cmd *reg_cont;
+
+	if ((cmd_buf_size < cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT)) ||
+		(!base_addr)) {
+		CAM_ERR(CAM_CDM, "invalid base addr and data length  %d %pK",
+			cmd_buf_size, base_addr);
+		return -EINVAL;
+	}
+
+	reg_cont = (struct cdm_regcontinuous_cmd *)cmd_buf;
+	if ((!reg_cont->count) || (((reg_cont->count * sizeof(uint32_t)) +
+			cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT)) >
+			cmd_buf_size)) {
+		CAM_ERR(CAM_CDM, "buffer size %d is not sufficient for count%d",
+			cmd_buf_size, reg_cont->count);
+		return -EINVAL;
+	}
+	data = cmd_buf + cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT);
+	cam_io_memcpy(base_addr + reg_cont->offset,	data,
+		reg_cont->count * sizeof(uint32_t));
+
+	*used_bytes = (reg_cont->count * sizeof(uint32_t)) +
+		(4 * cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT));
+
+	return ret;
+}
+
+static int cam_cdm_util_reg_random_write(void __iomem *base_addr,
+	uint32_t *cmd_buf, uint32_t cmd_buf_size, uint32_t *used_bytes)
+{
+	uint32_t i;
+	struct cdm_regrandom_cmd *reg_random;
+	uint32_t *data;
+
+	if (!base_addr) {
+		CAM_ERR(CAM_CDM, "invalid base address");
+		return -EINVAL;
+	}
+
+	reg_random = (struct cdm_regrandom_cmd *) cmd_buf;
+	if ((!reg_random->count) || (((reg_random->count * (sizeof(uint32_t) * 2)) +
+		cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM)) >
+			cmd_buf_size)) {
+		CAM_ERR(CAM_CDM, "invalid reg_count  %d cmd_buf_size %d",
+			reg_random->count, cmd_buf_size);
+		return -EINVAL;
+	}
+	data = cmd_buf + cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+
+	for (i = 0; i < reg_random->count; i++) {
+		CAM_DBG(CAM_CDM, "reg random: offset %pK, value 0x%x",
+			((void __iomem *)(base_addr + data[0])),
+			data[1]);
+		cam_io_w(data[1], base_addr + data[0]);
+		data += 2;
+	}
+
+	*used_bytes = ((reg_random->count * (sizeof(uint32_t) * 2)) +
+		(4 * cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM)));
+
+	return 0;
+}
+
+static int cam_cdm_util_swd_dmi_write(uint32_t cdm_cmd_type,
+	void __iomem *base_addr, uint32_t *cmd_buf, uint32_t cmd_buf_size,
+	uint32_t *used_bytes)
+{
+	uint32_t i;
+	struct cdm_dmi_cmd *swd_dmi;
+	uint32_t *data;
+
+	swd_dmi = (struct cdm_dmi_cmd *)cmd_buf;
+
+	if (cmd_buf_size < (cam_cdm_required_size_dmi() + swd_dmi->length + 1)) {
+		CAM_ERR(CAM_CDM, "invalid CDM_SWD_DMI length %d",
+			swd_dmi->length + 1);
+		return -EINVAL;
+	}
+	data = cmd_buf + cam_cdm_required_size_dmi();
+
+	if (cdm_cmd_type == CAM_CDM_CMD_SWD_DMI_64) {
+		for (i = 0; i < (swd_dmi->length + 1)/8; i++) {
+			cam_io_w_mb(data[0], base_addr +
+				swd_dmi->DMIAddr + CAM_CDM_DMI_DATA_LO_OFFSET);
+			cam_io_w_mb(data[1], base_addr +
+				swd_dmi->DMIAddr + CAM_CDM_DMI_DATA_HI_OFFSET);
+			data += 2;
+		}
+	} else if (cdm_cmd_type == CAM_CDM_CMD_DMI) {
+		for (i = 0; i < (swd_dmi->length + 1)/4; i++) {
+			cam_io_w_mb(data[0], base_addr +
+				swd_dmi->DMIAddr + CAM_CDM_DMI_DATA_OFFSET);
+			data += 1;
+		}
+	} else {
+		for (i = 0; i < (swd_dmi->length + 1)/4; i++) {
+			cam_io_w_mb(data[0], base_addr +
+				swd_dmi->DMIAddr + CAM_CDM_DMI_DATA_LO_OFFSET);
+			data += 1;
+		}
+	}
+	*used_bytes = (4 * cam_cdm_required_size_dmi()) + swd_dmi->length + 1;
+
+	return 0;
+}
+
+int cam_cdm_util_cmd_buf_write(void __iomem **current_device_base,
+	uint32_t *cmd_buf, uint32_t cmd_buf_size,
+	struct cam_soc_reg_map *base_table[CAM_SOC_MAX_BLOCK],
+	uint32_t base_array_size, uint8_t bl_tag)
+{
+	int ret = 0;
+	uint32_t cdm_cmd_type = 0;
+	uint32_t used_bytes = 0;
+
+	while (cmd_buf_size > 0) {
+		CAM_DBG(CAM_CDM, "cmd data=%x", *cmd_buf);
+		cdm_cmd_type = (*cmd_buf >> CAM_CDM_COMMAND_OFFSET);
+		switch (cdm_cmd_type) {
+		case CAM_CDM_CMD_REG_CONT: {
+			ret = cam_cdm_util_reg_cont_write(*current_device_base,
+				cmd_buf, cmd_buf_size, &used_bytes);
+			if (ret)
+				break;
+
+			if (used_bytes > 0) {
+				cmd_buf_size -= used_bytes;
+				cmd_buf += used_bytes/4;
+			}
+			}
+			break;
+		case CAM_CDM_CMD_REG_RANDOM: {
+			ret = cam_cdm_util_reg_random_write(
+				*current_device_base, cmd_buf, cmd_buf_size,
+				&used_bytes);
+			if (ret)
+				break;
+
+			if (used_bytes > 0) {
+				cmd_buf_size -= used_bytes;
+				cmd_buf += used_bytes / 4;
+			}
+			}
+			break;
+		case CAM_CDM_CMD_DMI:
+		case CAM_CDM_CMD_SWD_DMI_32:
+		case CAM_CDM_CMD_SWD_DMI_64: {
+			if (*current_device_base == 0) {
+				CAM_ERR(CAM_CDM,
+					"Got SWI DMI cmd =%d for invalid hw",
+					cdm_cmd_type);
+				ret = -EINVAL;
+				break;
+			}
+			ret = cam_cdm_util_swd_dmi_write(cdm_cmd_type,
+				*current_device_base, cmd_buf, cmd_buf_size,
+				&used_bytes);
+			if (ret)
+				break;
+
+			if (used_bytes > 0) {
+				cmd_buf_size -= used_bytes;
+				cmd_buf += used_bytes / 4;
+			}
+			}
+			break;
+		case CAM_CDM_CMD_CHANGE_BASE: {
+			struct cdm_changebase_cmd *change_base_cmd =
+				(struct cdm_changebase_cmd *)cmd_buf;
+
+			ret = cam_cdm_get_ioremap_from_base(
+				change_base_cmd->base, base_array_size,
+				base_table, current_device_base);
+			if (ret != 0) {
+				CAM_ERR(CAM_CDM,
+					"Get ioremap change base failed %x",
+					change_base_cmd->base);
+				break;
+			}
+			CAM_DBG(CAM_CDM, "Got ioremap for %x addr=%pK",
+				change_base_cmd->base,
+				current_device_base);
+			cmd_buf_size -= (4 *
+				cam_cdm_required_size_changebase());
+			cmd_buf += cam_cdm_required_size_changebase();
+			}
+			break;
+		default:
+			CAM_ERR(CAM_CDM, "unsupported cdm_cmd_type type 0%x",
+			cdm_cmd_type);
+			ret = -EINVAL;
+			break;
+		}
+
+		if (ret < 0)
+			break;
+	}
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_dmi_cmd(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	long ret = 0;
+	struct cdm_dmi_cmd *p_dmi_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+
+	p_dmi_cmd = (struct cdm_dmi_cmd *)cmd_buf_addr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_DMI];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_DMI];
+
+	if (temp_ptr > cmd_buf_addr_end)
+		CAM_ERR(CAM_CDM,
+			"Invalid cmd start addr:%pK end addr:%pK",
+			temp_ptr, cmd_buf_addr_end);
+
+	CAM_INFO(CAM_CDM,
+		"DMI: LEN: %u DMIAddr: 0x%X DMISel: 0x%X LUT_addr: 0x%X",
+		p_dmi_cmd->length, p_dmi_cmd->DMIAddr,
+		p_dmi_cmd->DMISel, p_dmi_cmd->addr);
+	return ret;
+}
+
+static long cam_cdm_util_dump_buff_indirect(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	long ret = 0;
+	struct cdm_indirect_cmd *p_indirect_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+
+	p_indirect_cmd = (struct cdm_indirect_cmd *)cmd_buf_addr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_BUFF_INDIRECT];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_BUFF_INDIRECT];
+
+	if (temp_ptr > cmd_buf_addr_end)
+		CAM_ERR(CAM_CDM,
+			"Invalid cmd start addr:%pK end addr:%pK",
+			temp_ptr, cmd_buf_addr_end);
+
+	CAM_INFO(CAM_CDM,
+		"Buff Indirect: LEN: %u addr: 0x%X",
+		p_indirect_cmd->length, p_indirect_cmd->addr);
+	return ret;
+}
+
+static long cam_cdm_util_dump_reg_cont_cmd(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	long ret = 0;
+	struct cdm_regcontinuous_cmd *p_regcont_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+	int i = 0;
+
+	p_regcont_cmd = (struct cdm_regcontinuous_cmd *)temp_ptr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_CONT];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_CONT];
+
+	CAM_INFO(CAM_CDM, "REG_CONT: COUNT: %u OFFSET: 0x%X",
+		p_regcont_cmd->count, p_regcont_cmd->offset);
+
+	for (i = 0; i < p_regcont_cmd->count; i++) {
+		if (temp_ptr > cmd_buf_addr_end) {
+			CAM_ERR(CAM_CDM,
+				"Invalid cmd(%d) start addr:%pK end addr:%pK",
+				i, temp_ptr, cmd_buf_addr_end);
+			break;
+		}
+		CAM_INFO(CAM_CDM, "DATA_%d: 0x%X", i,
+			*temp_ptr);
+		temp_ptr++;
+		ret++;
+	}
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_reg_random_cmd(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	struct cdm_regrandom_cmd *p_regrand_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+	long ret = 0;
+	int i = 0;
+
+	p_regrand_cmd = (struct cdm_regrandom_cmd *)temp_ptr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_RANDOM];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_RANDOM];
+
+	CAM_INFO(CAM_CDM, "REG_RAND: COUNT: %u",
+		p_regrand_cmd->count);
+
+	for (i = 0; i < p_regrand_cmd->count; i++) {
+		if (temp_ptr > cmd_buf_addr_end) {
+			CAM_ERR(CAM_CDM,
+				"Invalid cmd(%d) start addr:%pK end addr:%pK",
+				i, temp_ptr, cmd_buf_addr_end);
+			break;
+		}
+		CAM_INFO(CAM_CDM, "OFFSET_%d: 0x%X DATA_%d: 0x%X",
+			i, *temp_ptr & CAM_CDM_REG_OFFSET_MASK, i,
+			*(temp_ptr + 1));
+		temp_ptr += 2;
+		ret += 2;
+	}
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_gen_irq_cmd(uint32_t *cmd_buf_addr)
+{
+	long ret = 0;
+
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_GEN_IRQ];
+
+	CAM_INFO(CAM_CDM, "GEN_IRQ");
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_wait_event_cmd(uint32_t *cmd_buf_addr)
+{
+	long ret = 0;
+
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_WAIT_EVENT];
+
+	CAM_INFO(CAM_CDM, "WAIT_EVENT");
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_change_base_cmd(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	long ret = 0;
+	struct cdm_changebase_cmd *p_cbase_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+
+	if (temp_ptr > cmd_buf_addr_end) {
+		CAM_ERR(CAM_CDM,
+			"Invalid cmd start addr:%pK end addr:%pK",
+			temp_ptr, cmd_buf_addr_end);
+
+		return 0;
+	}
+
+	p_cbase_cmd = (struct cdm_changebase_cmd *)temp_ptr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_CHANGE_BASE];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_CHANGE_BASE];
+
+	CAM_INFO(CAM_CDM, "CHANGE_BASE: 0x%X, curr cmd addr: %pK",
+		p_cbase_cmd->base, temp_ptr);
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_comp_wait_event_cmd(uint32_t *cmd_buf_addr)
+{
+	long ret = 0;
+
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_COMP_WAIT];
+
+	CAM_INFO(CAM_CDM, "WAIT_EVENT");
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_perf_ctrl_cmd(uint32_t *cmd_buf_addr)
+{
+	long ret = 0;
+
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_PERF_CTRL];
+
+	CAM_INFO(CAM_CDM, "PERF_CTRL");
+
+	return ret;
+}
+
+bool cam_cdm_util_validate_cmd_buf(
+	uint32_t *cmd_buf_start, uint32_t *cmd_buf_end)
+{
+	uint32_t *buf_now = cmd_buf_start;
+	uint32_t *buf_end = cmd_buf_end;
+	uint32_t cmd = 0;
+	int i = 0;
+	struct cdm_regcontinuous_cmd *p_regcont_cmd = NULL;
+	struct cdm_regrandom_cmd *p_regrand_cmd = NULL;
+
+	if (!cmd_buf_start || !cmd_buf_end) {
+		CAM_ERR(CAM_CDM, "Invalid args");
+		return true;
+	}
+
+	do {
+		cmd = *buf_now;
+		cmd = cmd >> CAM_CDM_COMMAND_OFFSET;
+
+		switch (cmd) {
+		case CAM_CDM_CMD_DMI:
+		case CAM_CDM_CMD_DMI_32:
+		case CAM_CDM_CMD_DMI_64:
+			if (buf_now > buf_end)
+				return true;
+
+			buf_now += CDMCmdHeaderSizes[CAM_CDM_CMD_DMI];
+			break;
+		case CAM_CDM_CMD_REG_CONT:
+			p_regcont_cmd = (struct cdm_regcontinuous_cmd *)buf_now;
+			buf_now += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_CONT];
+			for (i = 0; i < p_regcont_cmd->count; i++) {
+				if (buf_now > buf_end)
+					return true;
+
+				buf_now++;
+			}
+			break;
+		case CAM_CDM_CMD_REG_RANDOM:
+			p_regrand_cmd = (struct cdm_regrandom_cmd *)buf_now;
+			buf_now += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_RANDOM];
+			for (i = 0; i < p_regrand_cmd->count; i++) {
+				if (buf_now > buf_end)
+					return true;
+
+				buf_now += 2;
+			}
+			break;
+		case CAM_CDM_CMD_BUFF_INDIRECT:
+			buf_now += CDMCmdHeaderSizes[CAM_CDM_CMD_BUFF_INDIRECT];
+			if (buf_now > buf_end)
+				return true;
+
+			break;
+		case CAM_CDM_CMD_GEN_IRQ:
+			buf_now += CDMCmdHeaderSizes[CAM_CDM_CMD_GEN_IRQ];
+			break;
+		case CAM_CDM_CMD_WAIT_EVENT:
+			buf_now += CDMCmdHeaderSizes[CAM_CDM_CMD_WAIT_EVENT];
+			break;
+		case CAM_CDM_CMD_CHANGE_BASE:
+			if (buf_now > buf_end)
+				return true;
+
+			buf_now += CDMCmdHeaderSizes[CAM_CDM_CMD_CHANGE_BASE];
+			break;
+		case CAM_CDM_CMD_PERF_CTRL:
+			buf_now += CDMCmdHeaderSizes[CAM_CDM_CMD_PERF_CTRL];
+			break;
+		case CAM_CDM_CMD_COMP_WAIT:
+			buf_now += CDMCmdHeaderSizes[CAM_CDM_CMD_COMP_WAIT];
+			break;
+		default:
+			CAM_ERR(CAM_CDM, "Invalid CMD: 0x%x buf 0x%x",
+				cmd, *buf_now);
+			return true;
+		}
+	} while (buf_now < cmd_buf_end);
+
+	return false;
+}
+
+void cam_cdm_util_dump_cmd_buf(
+	uint32_t *cmd_buf_start, uint32_t *cmd_buf_end)
+{
+	uint32_t *buf_now = cmd_buf_start;
+	uint32_t *buf_end = cmd_buf_end;
+	uint32_t cmd = 0;
+
+	if (!cmd_buf_start || !cmd_buf_end) {
+		CAM_ERR(CAM_CDM, "Invalid args");
+		return;
+	}
+
+	do {
+		cmd = *buf_now;
+		cmd = cmd >> CAM_CDM_COMMAND_OFFSET;
+
+		switch (cmd) {
+		case CAM_CDM_CMD_DMI:
+		case CAM_CDM_CMD_DMI_32:
+		case CAM_CDM_CMD_DMI_64:
+			buf_now += cam_cdm_util_dump_dmi_cmd(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_REG_CONT:
+			buf_now += cam_cdm_util_dump_reg_cont_cmd(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_REG_RANDOM:
+			buf_now += cam_cdm_util_dump_reg_random_cmd(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_BUFF_INDIRECT:
+			buf_now += cam_cdm_util_dump_buff_indirect(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_GEN_IRQ:
+			buf_now += cam_cdm_util_dump_gen_irq_cmd(buf_now);
+			break;
+		case CAM_CDM_CMD_WAIT_EVENT:
+			buf_now += cam_cdm_util_dump_wait_event_cmd(buf_now);
+			break;
+		case CAM_CDM_CMD_CHANGE_BASE:
+			buf_now += cam_cdm_util_dump_change_base_cmd(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_PERF_CTRL:
+			buf_now += cam_cdm_util_dump_perf_ctrl_cmd(buf_now);
+			break;
+		case CAM_CDM_CMD_COMP_WAIT:
+			buf_now +=
+				cam_cdm_util_dump_comp_wait_event_cmd(buf_now);
+			break;
+		default:
+			CAM_ERR(CAM_CDM, "Invalid CMD: 0x%x buf 0x%x",
+				cmd, *buf_now);
+			buf_now++;
+			break;
+		}
+	} while (buf_now < cmd_buf_end);
+}
+
+static uint32_t cam_cdm_util_dump_reg_cont_cmd_v2(
+	uint32_t                         *cmd_buf_addr,
+	struct cam_cdm_cmd_buf_dump_info *dump_info)
+{
+	int                             i;
+	long                            ret;
+	uint8_t                        *dst;
+	size_t                          remain_len;
+	uint32_t                       *temp_ptr = cmd_buf_addr;
+	uint32_t                       *addr, *start;
+	uint32_t                        min_len;
+	struct cdm_regcontinuous_cmd   *p_regcont_cmd;
+	struct cam_cdm_cmd_dump_header *hdr;
+
+	p_regcont_cmd = (struct cdm_regcontinuous_cmd *)temp_ptr;
+	temp_ptr += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT);
+	ret = cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT);
+
+	min_len = (sizeof(uint32_t) * p_regcont_cmd->count) +
+		sizeof(struct cam_cdm_cmd_dump_header) +
+		(2 * sizeof(uint32_t));
+	remain_len = dump_info->dst_max_size - dump_info->dst_offset;
+
+	if (remain_len < min_len) {
+		CAM_WARN_RATE_LIMIT(CAM_CDM,
+			"Dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		return ret;
+	}
+
+	dst = (char *)dump_info->dst_start + dump_info->dst_offset;
+	hdr = (struct cam_cdm_cmd_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_CDM_CMD_TAG_MAX_LEN, "CDM_REG_CONT:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_cdm_cmd_dump_header));
+	start = addr;
+	*addr++ = p_regcont_cmd->offset;
+	*addr++ = p_regcont_cmd->count;
+	for (i = 0; i < p_regcont_cmd->count; i++) {
+		*addr = *temp_ptr;
+		temp_ptr++;
+		addr++;
+		ret++;
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_info->dst_offset += hdr->size +
+		sizeof(struct cam_cdm_cmd_dump_header);
+
+	return ret;
+}
+
+static uint32_t cam_cdm_util_dump_reg_random_cmd_v2(
+	uint32_t                         *cmd_buf_addr,
+	struct cam_cdm_cmd_buf_dump_info *dump_info)
+{
+	int                             i;
+	long                            ret;
+	uint8_t                        *dst;
+	uint32_t                       *temp_ptr = cmd_buf_addr;
+	uint32_t                       *addr, *start;
+	size_t                          remain_len;
+	uint32_t                        min_len;
+	struct cdm_regrandom_cmd       *p_regrand_cmd;
+	struct cam_cdm_cmd_dump_header *hdr;
+
+	p_regrand_cmd = (struct cdm_regrandom_cmd *)temp_ptr;
+	temp_ptr += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+	ret = cam_cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+
+	min_len = (2 * sizeof(uint32_t) * p_regrand_cmd->count) +
+		sizeof(struct cam_cdm_cmd_dump_header) + sizeof(uint32_t);
+	remain_len = dump_info->dst_max_size - dump_info->dst_offset;
+
+	if (remain_len < min_len) {
+		CAM_WARN_RATE_LIMIT(CAM_CDM,
+			"Dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		return ret;
+	}
+
+	dst = (char *)dump_info->dst_start + dump_info->dst_offset;
+	hdr = (struct cam_cdm_cmd_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_CDM_CMD_TAG_MAX_LEN, "CDM_REG_RANDOM:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_cdm_cmd_dump_header));
+	start = addr;
+	*addr++ = p_regrand_cmd->count;
+	for (i = 0; i < p_regrand_cmd->count; i++) {
+		addr[0] = temp_ptr[0] & CAM_CDM_REG_OFFSET_MASK;
+		addr[1] = temp_ptr[1];
+		temp_ptr += 2;
+		addr += 2;
+		ret += 2;
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_info->dst_offset += hdr->size +
+		sizeof(struct cam_cdm_cmd_dump_header);
+	return ret;
+}
+
+int cam_cdm_util_dump_cmd_bufs_v2(
+	struct cam_cdm_cmd_buf_dump_info *dump_info)
+{
+	uint32_t  cmd;
+	uint32_t *buf_now;
+	int rc = 0;
+
+	if (!dump_info || !dump_info->src_start || !dump_info->src_end ||
+		!dump_info->dst_start) {
+		CAM_INFO(CAM_CDM, "Invalid args");
+		return -EINVAL;
+	}
+
+	buf_now = dump_info->src_start;
+	do {
+		if (dump_info->dst_offset >= dump_info->dst_max_size) {
+			CAM_WARN(CAM_CDM,
+				"Dump overshoot offset %zu size %zu",
+				dump_info->dst_offset,
+				dump_info->dst_max_size);
+			return -ENOSPC;
+		}
+		cmd = *buf_now;
+		cmd = cmd >> CAM_CDM_COMMAND_OFFSET;
+
+		switch (cmd) {
+		case CAM_CDM_CMD_DMI:
+		case CAM_CDM_CMD_DMI_32:
+		case CAM_CDM_CMD_DMI_64:
+			buf_now += cam_cdm_get_cmd_header_size(CAM_CDM_CMD_DMI);
+			break;
+		case CAM_CDM_CMD_REG_CONT:
+			buf_now += cam_cdm_util_dump_reg_cont_cmd_v2(buf_now,
+				dump_info);
+			break;
+		case CAM_CDM_CMD_REG_RANDOM:
+			buf_now += cam_cdm_util_dump_reg_random_cmd_v2(buf_now,
+				dump_info);
+			break;
+		case CAM_CDM_CMD_BUFF_INDIRECT:
+			buf_now += cam_cdm_get_cmd_header_size(
+				CAM_CDM_CMD_BUFF_INDIRECT);
+			break;
+		case CAM_CDM_CMD_GEN_IRQ:
+			buf_now += cam_cdm_get_cmd_header_size(
+				CAM_CDM_CMD_GEN_IRQ);
+			break;
+		case CAM_CDM_CMD_WAIT_EVENT:
+			buf_now += cam_cdm_get_cmd_header_size(
+				CAM_CDM_CMD_WAIT_EVENT);
+			break;
+		case CAM_CDM_CMD_CHANGE_BASE:
+			buf_now += cam_cdm_get_cmd_header_size(
+				CAM_CDM_CMD_CHANGE_BASE);
+			break;
+		case CAM_CDM_CMD_PERF_CTRL:
+			buf_now += cam_cdm_get_cmd_header_size(
+				CAM_CDM_CMD_PERF_CTRL);
+			break;
+		case CAM_CDM_CMD_COMP_WAIT:
+			buf_now += cam_cdm_get_cmd_header_size(
+				CAM_CDM_CMD_COMP_WAIT);
+			break;
+		default:
+			CAM_ERR(CAM_CDM, "Invalid CMD: 0x%x", cmd);
+			buf_now++;
+			break;
+		}
+	} while (buf_now < dump_info->src_end);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_util.h
@@ -0,0 +1,271 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_UTIL_H_
+#define _CAM_CDM_UTIL_H_
+
+/* Max len for tag name for header while dumping cmd buffer*/
+#define CAM_CDM_CMD_TAG_MAX_LEN 128
+#define CAM_CDM_COMMAND_OFFSET  24
+
+#include <linux/types.h>
+
+enum cam_cdm_command {
+	CAM_CDM_CMD_UNUSED = 0x0,
+	CAM_CDM_CMD_DMI = 0x1,
+	CAM_CDM_CMD_NOT_DEFINED = 0x2,
+	CAM_CDM_CMD_REG_CONT = 0x3,
+	CAM_CDM_CMD_REG_RANDOM = 0x4,
+	CAM_CDM_CMD_BUFF_INDIRECT = 0x5,
+	CAM_CDM_CMD_GEN_IRQ = 0x6,
+	CAM_CDM_CMD_WAIT_EVENT = 0x7,
+	CAM_CDM_CMD_CHANGE_BASE = 0x8,
+	CAM_CDM_CMD_PERF_CTRL = 0x9,
+	CAM_CDM_CMD_DMI_32 = 0xa,
+	CAM_CDM_CMD_DMI_64 = 0xb,
+	CAM_CDM_CMD_COMP_WAIT = 0xc,
+	CAM_CDM_CLEAR_COMP_WAIT = 0xd,
+	CAM_CDM_WAIT_PREFETCH_DISABLE = 0xe,
+	CAM_CDM_CMD_PRIVATE_BASE = 0xf,
+	CAM_CDM_CMD_SWD_DMI_32 = (CAM_CDM_CMD_PRIVATE_BASE + 0x64),
+	CAM_CDM_CMD_SWD_DMI_64 = (CAM_CDM_CMD_PRIVATE_BASE + 0x65),
+	CAM_CDM_CMD_PRIVATE_BASE_MAX = 0x7F,
+};
+
+/**
+ * struct cam_cdm_utils_ops - Camera CDM util ops
+ *
+ * @cdm_get_cmd_header_size: Returns the size of the given command header
+ *                           in DWORDs.
+ *      @command Command ID
+ *      @return Size of the command in DWORDs
+ *
+ * @cdm_required_size_reg_continuous: Calculates the size of a reg-continuous
+ *                                    command in dwords.
+ *      @numVals Number of continuous values
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_reg_random: Calculates the size of a reg-random command
+ *                                in dwords.
+ *      @numRegVals  Number of register/value pairs
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_dmi: Calculates the size of a DMI command in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_genirq: Calculates size of a Genirq command in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_indirect: Calculates the size of an indirect command
+ *                              in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_comp_wait: Calculates the size of a comp-wait command
+ *                                in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_clear_comp_event: Calculates the size of clear-comp-event
+ *                                      command in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_changebase: Calculates the size of a change-base command
+ *                                in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_offsetof_dmi_addr: Returns the offset of address field in the DMI
+ *                         command header.
+ *      @return Offset of addr field
+ *
+ * @cdm_offsetof_indirect_addr: Returns the offset of address field in the
+ *                              indirect command header.
+ *      @return Offset of addr field
+ *
+ * @cdm_write_regcontinuous: Writes a command into the command buffer.
+ *      @pCmdBuffer:  Pointer to command buffer
+ *      @reg: Beginning of the register address range where
+ *            values will be written.
+ *      @numVals: Number of values (registers) that will be written
+ *      @pVals : An array of values that will be written
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_regrandom: Writes a command into the command buffer in
+ *                       register/value pairs.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @numRegVals: Number of register/value pairs that will be written
+ *      @pRegVals: An array of register/value pairs that will be written
+ *                 The even indices are registers and the odd indices
+ *                 arevalues, e.g., {reg1, val1, reg2, val2, ...}.
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_dmi: Writes a DMI command into the command bufferM.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @dmiCmd: DMI command
+ *      @DMIAddr: Address of the DMI
+ *      @DMISel: Selected bank that the DMI will write to
+ *      @length: Size of data in bytes
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_indirect: Writes a indirect command into the command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @indirectBufferAddr: Device address of the indirect cmd buffer.
+ *      @length: Size of data in bytes
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_changebase: Writes a changing CDM (address) base command into
+ *                        the command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @base: New base (device) address
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_genirq: Writes a gen irq command into the command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @userdata: userdata or cookie return by hardware during irq.
+ *
+ * @cdm_write_wait_comp_event: Writes a wait comp event cmd into the
+ *                             command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @mask1: This value decides which comp events to wait (0 - 31).
+ *      @mask2: This value decides which comp events to wait (32 - 65).
+ *
+ * @cdm_write_clear_comp_event: Writes a clear comp event cmd into the
+ *                             command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @mask1: This value decides which comp events to clear (0 - 31).
+ *      @mask2: This value decides which comp events to clear (32 - 65).
+ */
+struct cam_cdm_utils_ops {
+uint32_t (*cdm_get_cmd_header_size)(unsigned int command);
+uint32_t (*cdm_required_size_dmi)(void);
+uint32_t (*cdm_required_size_reg_continuous)(uint32_t  numVals);
+uint32_t (*cdm_required_size_reg_random)(uint32_t numRegVals);
+uint32_t (*cdm_required_size_indirect)(void);
+uint32_t (*cdm_required_size_genirq)(void);
+uint32_t (*cdm_required_size_wait_event)(void);
+uint32_t (*cdm_required_size_changebase)(void);
+uint32_t (*cdm_required_size_comp_wait)(void);
+uint32_t (*cdm_required_size_clear_comp_event)(void);
+uint32_t (*cdm_required_size_prefetch_disable)(void);
+uint32_t (*cdm_offsetof_dmi_addr)(void);
+uint32_t (*cdm_offsetof_indirect_addr)(void);
+uint32_t *(*cdm_write_dmi)(
+	uint32_t *pCmdBuffer,
+	uint8_t   dmiCmd,
+	uint32_t  DMIAddr,
+	uint8_t   DMISel,
+	uint32_t  dmiBufferAddr,
+	uint32_t  length);
+uint32_t* (*cdm_write_regcontinuous)(
+	uint32_t *pCmdBuffer,
+	uint32_t  reg,
+	uint32_t  numVals,
+	uint32_t *pVals);
+uint32_t *(*cdm_write_regrandom)(
+	uint32_t *pCmdBuffer,
+	uint32_t  numRegVals,
+	uint32_t *pRegVals);
+uint32_t *(*cdm_write_indirect)(
+	uint32_t *pCmdBuffer,
+	uint32_t  indirectBufferAddr,
+	uint32_t  length);
+void (*cdm_write_genirq)(
+	uint32_t *pCmdBuffer,
+	uint32_t  userdata,
+	bool      bit_wr_enable,
+	uint32_t  fifo_idx);
+uint32_t *(*cdm_write_wait_event)(
+	uint32_t *pCmdBuffer,
+	uint32_t  iw,
+	uint32_t  id,
+	uint32_t  mask,
+	uint32_t  offset,
+	uint32_t  data);
+uint32_t *(*cdm_write_changebase)(
+	uint32_t *pCmdBuffer,
+	uint32_t  base);
+uint32_t *(*cdm_write_wait_comp_event)(
+	uint32_t *pCmdBuffer,
+	uint32_t  mask1,
+	uint32_t  mask2);
+uint32_t *(*cdm_write_clear_comp_event)(
+	uint32_t *pCmdBuffer,
+	uint32_t  mask1,
+	uint32_t  mask2);
+uint32_t *(*cdm_write_wait_prefetch_disable)(
+	uint32_t *pCmdBuffer,
+	uint32_t  id,
+	uint32_t  mask1,
+	uint32_t  mask2);
+};
+
+/**
+ * struct cam_cdm_cmd_buf_dump_info; - Camera CDM dump info
+ * @dst_offset:      dst offset
+ * @dst_max_size     max size of destination buffer
+ * @src_start:       source start address
+ * @src_end:         source end   address
+ * @dst_start:       dst start address
+ */
+struct cam_cdm_cmd_buf_dump_info {
+	size_t    dst_offset;
+	size_t    dst_max_size;
+	uint32_t *src_start;
+	uint32_t *src_end;
+	uintptr_t dst_start;
+};
+
+/**
+ * struct cam_cdm_cmd_dump_header- Camera CDM dump header
+ * @tag:       tag name for header
+ * @size:      size of data
+ * @word_size: size of each word
+ */
+struct cam_cdm_cmd_dump_header {
+	uint8_t   tag[CAM_CDM_CMD_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * cam_cdm_util_validate_cmd_buf()
+ *
+ * @brief:            Util function to validate cdm command buffers
+ *
+ * @cmd_buffer_start: Pointer to start of cmd buffer
+ * @cmd_buffer_end:   Pointer to end of cmd buffer
+ *
+ * return true if invalid cmd found, otherwise false
+ *
+ */
+bool cam_cdm_util_validate_cmd_buf(
+	uint32_t *cmd_buffer_start, uint32_t *cmd_buffer_end);
+
+/**
+ * cam_cdm_util_log_cmd_bufs()
+ *
+ * @brief:            Util function to log cdm command buffers
+ *
+ * @cmd_buffer_start: Pointer to start of cmd buffer
+ * @cmd_buffer_end:   Pointer to end of cmd buffer
+ *
+ */
+void cam_cdm_util_dump_cmd_buf(
+	uint32_t *cmd_buffer_start, uint32_t *cmd_buffer_end);
+
+/**
+ * cam_cdm_util_dump_cmd_bufs_v2()
+ *
+ * @brief:        Util function to cdm command buffers
+ *                to a buffer
+ *
+ * @dump_info:    Information about source and destination buffers
+ *
+ * return SUCCESS/FAILURE
+ */
+int cam_cdm_util_dump_cmd_bufs_v2(
+	struct cam_cdm_cmd_buf_dump_info *dump_info);
+
+
+#endif /* _CAM_CDM_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_virtual.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_virtual.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_VIRTUAL_H_
+#define _CAM_CDM_VIRTUAL_H_
+
+#include "cam_cdm_intf_api.h"
+
+int cam_virtual_cdm_probe(struct platform_device *pdev);
+int cam_virtual_cdm_remove(struct platform_device *pdev);
+int cam_cdm_util_cmd_buf_write(void __iomem **current_device_base,
+	uint32_t *cmd_buf, uint32_t cmd_buf_size,
+	struct cam_soc_reg_map *base_table[CAM_SOC_MAX_BLOCK],
+	uint32_t base_array_size, uint8_t bl_tag);
+
+#endif /* _CAM_CDM_VIRTUAL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_virtual_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cdm/cam_cdm_virtual_core.c
@@ -0,0 +1,409 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include "cam_soc_util.h"
+#include "cam_smmu_api.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm.h"
+#include "cam_cdm_util.h"
+#include "cam_cdm_virtual.h"
+#include "cam_cdm_core_common.h"
+#include "cam_cdm_soc.h"
+#include "cam_io_util.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+#define CAM_CDM_VIRTUAL_NAME "qcom,cam_virtual_cdm"
+
+static void cam_virtual_cdm_work(struct work_struct *work)
+{
+	struct cam_cdm_work_payload *payload;
+	struct cam_hw_info *cdm_hw;
+	struct cam_cdm *core;
+
+	payload = container_of(work, struct cam_cdm_work_payload, work);
+	if (payload) {
+		cdm_hw = payload->hw;
+		core = (struct cam_cdm *)cdm_hw->core_info;
+
+		cam_common_util_thread_switch_delay_detect(
+			"virtual_cdm_workq", "schedule", cam_virtual_cdm_work,
+			payload->workq_scheduled_ts,
+			CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+
+		if (payload->irq_status & 0x2) {
+			struct cam_cdm_bl_cb_request_entry *node;
+
+			CAM_DBG(CAM_CDM, "CDM HW Gen/inline IRQ with data=%x",
+				payload->irq_data);
+			mutex_lock(&cdm_hw->hw_mutex);
+			node = cam_cdm_find_request_by_bl_tag(
+				payload->irq_data,
+				&core->bl_request_list);
+			if (node) {
+				if (node->request_type ==
+					CAM_HW_CDM_BL_CB_CLIENT) {
+					cam_cdm_notify_clients(cdm_hw,
+						CAM_CDM_CB_STATUS_BL_SUCCESS,
+						(void *)node);
+				} else if (node->request_type ==
+					CAM_HW_CDM_BL_CB_INTERNAL) {
+					CAM_ERR(CAM_CDM, "Invalid node=%pK %d",
+						node, node->request_type);
+				}
+				list_del_init(&node->entry);
+				kfree(node);
+			} else {
+				CAM_ERR(CAM_CDM, "Invalid node for inline irq");
+			}
+			mutex_unlock(&cdm_hw->hw_mutex);
+		}
+		if (payload->irq_status & 0x1) {
+			CAM_DBG(CAM_CDM, "CDM HW reset done IRQ");
+			complete(&core->reset_complete);
+		}
+		kfree(payload);
+	}
+
+}
+
+int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	struct cam_cdm_client *client)
+{
+	int i, rc = -EINVAL;
+	struct cam_cdm_bl_request *cdm_cmd = req->data;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	mutex_lock(&client->lock);
+	for (i = 0; i < req->data->cmd_arrary_count ; i++) {
+		uintptr_t vaddr_ptr = 0;
+		size_t len = 0;
+
+		if ((!cdm_cmd->cmd_flex[i].len) &&
+			(cdm_cmd->cmd_flex[i].len > 0x100000)) {
+			CAM_ERR(CAM_CDM,
+				"len(%d) is invalid count=%d total cnt=%d",
+				cdm_cmd->cmd_flex[i].len, i,
+				req->data->cmd_arrary_count);
+			rc = -EINVAL;
+			break;
+		}
+		if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE) {
+			rc = cam_mem_get_cpu_buf(
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle, &vaddr_ptr,
+				&len);
+			if (rc) {
+				CAM_ERR(CAM_CDM,
+					"Falied to get CPU addr_i[%d] req_type %d", i,
+					req->data->type);
+			}
+		} else if (req->data->type ==
+			CAM_CDM_BL_CMD_TYPE_KERNEL_IOVA) {
+			rc = 0;
+			vaddr_ptr = cdm_cmd->cmd_flex[i].bl_addr.kernel_iova;
+			len = cdm_cmd->cmd_flex[i].offset + cdm_cmd->cmd_flex[i].len;
+		} else {
+			CAM_ERR(CAM_CDM,
+				"Only mem hdl/Kernel va type is supported %d",
+				req->data->type);
+			rc = -EINVAL;
+		}
+
+		if ((!rc) && (vaddr_ptr) && (len) &&
+			(len >= cdm_cmd->cmd_flex[i].offset)) {
+
+
+			if ((len - cdm_cmd->cmd_flex[i].offset) <
+				cdm_cmd->cmd_flex[i].len) {
+				CAM_ERR(CAM_CDM, "Not enough buffer");
+				rc = -EINVAL;
+				goto put_cpu_buf;
+			}
+			CAM_DBG(CAM_CDM,
+				"hdl=%x vaddr=%pK offset=%d cmdlen=%d:%zu",
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle,
+				(void *)vaddr_ptr, cdm_cmd->cmd_flex[i].offset,
+				cdm_cmd->cmd_flex[i].len, len);
+			rc = cam_cdm_util_cmd_buf_write(
+				&client->changebase_addr,
+				((uint32_t *)vaddr_ptr +
+					((cdm_cmd->cmd_flex[i].offset)/4)),
+				cdm_cmd->cmd_flex[i].len, client->data.base_array,
+				client->data.base_array_cnt, core->bl_tag);
+			if (rc) {
+				CAM_ERR(CAM_CDM,
+					"write failed for cnt=%d:%d len %u",
+					i, req->data->cmd_arrary_count,
+					cdm_cmd->cmd_flex[i].len);
+				goto put_cpu_buf;
+			}
+		} else {
+			CAM_ERR(CAM_CDM,
+				"Sanity check failed for hdl=%x len=%zu:%d",
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle, len,
+				cdm_cmd->cmd_flex[i].offset);
+			CAM_ERR(CAM_CDM,
+				"Sanity check failed for cmd_count=%d cnt=%d",
+				i, req->data->cmd_arrary_count);
+			rc = -EINVAL;
+			goto err;
+		}
+		if (!rc) {
+			struct cam_cdm_work_payload *payload;
+
+			CAM_DBG(CAM_CDM,
+				"write BL success for cnt=%d with tag=%d",
+				i, core->bl_tag);
+			if (req->data->flag && (i == req->data->cmd_arrary_count)) {
+				struct cam_cdm_bl_cb_request_entry *node;
+
+				node = kzalloc(sizeof(
+					struct cam_cdm_bl_cb_request_entry),
+					GFP_KERNEL);
+				if (!node) {
+					rc = -ENOMEM;
+					goto err;
+				}
+				node->request_type = CAM_HW_CDM_BL_CB_CLIENT;
+				node->client_hdl = req->handle;
+				node->cookie = req->data->cookie;
+				node->bl_tag = core->bl_tag;
+				node->userdata = req->data->userdata;
+				mutex_lock(&cdm_hw->hw_mutex);
+				list_add_tail(&node->entry,
+					&core->bl_request_list);
+				mutex_unlock(&cdm_hw->hw_mutex);
+
+				payload = kzalloc(sizeof(
+					struct cam_cdm_work_payload),
+					GFP_ATOMIC);
+				if (payload) {
+					payload->irq_status = 0x2;
+					payload->irq_data = core->bl_tag;
+					payload->hw = cdm_hw;
+					INIT_WORK((struct work_struct *)
+						&payload->work,
+						cam_virtual_cdm_work);
+					payload->workq_scheduled_ts =
+						ktime_get();
+					queue_work(core->work_queue,
+						&payload->work);
+				}
+			}
+			core->bl_tag++;
+			CAM_DBG(CAM_CDM,
+				"Now commit the BL nothing for virtual");
+			if (!rc && (core->bl_tag == 63))
+				core->bl_tag = 0;
+
+			if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE)
+				cam_mem_put_cpu_buf(cdm_cmd->cmd_flex[i].bl_addr.mem_handle);
+		}
+
+	}
+	mutex_unlock(&client->lock);
+	return rc;
+
+put_cpu_buf:
+	if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE)
+		cam_mem_put_cpu_buf(cdm_cmd->cmd_flex[i].bl_addr.mem_handle);
+
+err:
+	mutex_unlock(&client->lock);
+	return rc;
+
+}
+
+int cam_virtual_cdm_probe(struct platform_device *pdev)
+{
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_hw_intf *cdm_hw_intf = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_cdm_private_dt_data *soc_private = NULL;
+	int rc;
+	struct cam_cpas_register_params cpas_parms;
+
+	cdm_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!cdm_hw_intf)
+		return -ENOMEM;
+
+	cdm_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!cdm_hw) {
+		kfree(cdm_hw_intf);
+		return -ENOMEM;
+	}
+
+	cdm_hw->core_info = kzalloc(sizeof(struct cam_cdm), GFP_KERNEL);
+	if (!cdm_hw->core_info) {
+		kfree(cdm_hw);
+		kfree(cdm_hw_intf);
+		return -ENOMEM;
+	}
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	cdm_hw->soc_info.pdev = pdev;
+	cdm_hw_intf->hw_type = CAM_VIRTUAL_CDM;
+	cdm_hw->soc_info.soc_private = kzalloc(
+			sizeof(struct cam_cdm_private_dt_data), GFP_KERNEL);
+	if (!cdm_hw->soc_info.soc_private) {
+		rc = -ENOMEM;
+		goto soc_load_failed;
+	}
+
+	rc = cam_cdm_soc_load_dt_private(pdev, cdm_hw->soc_info.soc_private);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to load CDM dt private data");
+		kfree(cdm_hw->soc_info.soc_private);
+		cdm_hw->soc_info.soc_private = NULL;
+		goto soc_load_failed;
+	}
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+	soc_private = (struct cam_cdm_private_dt_data *)
+					cdm_hw->soc_info.soc_private;
+	if (soc_private->dt_cdm_shared == true)
+		cdm_core->flags = CAM_CDM_FLAG_SHARED_CDM;
+	else
+		cdm_core->flags = CAM_CDM_FLAG_PRIVATE_CDM;
+
+	cdm_core->bl_tag = 0;
+	INIT_LIST_HEAD(&cdm_core->bl_request_list);
+	init_completion(&cdm_core->reset_complete);
+	cdm_hw_intf->hw_priv = cdm_hw;
+	cdm_hw_intf->hw_ops.get_hw_caps = cam_cdm_get_caps;
+	cdm_hw_intf->hw_ops.init = NULL;
+	cdm_hw_intf->hw_ops.deinit = NULL;
+	cdm_hw_intf->hw_ops.start = cam_cdm_stream_start;
+	cdm_hw_intf->hw_ops.stop = cam_cdm_stream_stop;
+	cdm_hw_intf->hw_ops.read = NULL;
+	cdm_hw_intf->hw_ops.write = NULL;
+	cdm_hw_intf->hw_ops.process_cmd = cam_cdm_process_cmd;
+
+	CAM_DBG(CAM_CDM, "type %d index %d", cdm_hw_intf->hw_type,
+		cdm_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, cdm_hw_intf);
+
+	cdm_hw->open_count = 0;
+	cdm_core->iommu_hdl.non_secure = -1;
+	cdm_core->iommu_hdl.secure = -1;
+	mutex_init(&cdm_hw->hw_mutex);
+	spin_lock_init(&cdm_hw->hw_lock);
+	init_completion(&cdm_hw->hw_complete);
+	mutex_lock(&cdm_hw->hw_mutex);
+	cdm_core->id = CAM_CDM_VIRTUAL;
+	memcpy(cdm_core->name, CAM_CDM_VIRTUAL_NAME,
+		sizeof(CAM_CDM_VIRTUAL_NAME));
+	cdm_core->work_queue = alloc_workqueue(cdm_core->name,
+		WQ_UNBOUND | WQ_MEM_RECLAIM | WQ_SYSFS,
+		CAM_CDM_INFLIGHT_WORKS);
+	cdm_core->ops = NULL;
+
+	cpas_parms.cam_cpas_client_cb = cam_cdm_cpas_cb;
+	cpas_parms.cell_index = cdm_hw->soc_info.index;
+	cpas_parms.dev = &pdev->dev;
+	cpas_parms.userdata = cdm_hw_intf;
+	strscpy(cpas_parms.identifier, "cam-cdm-intf",
+		CAM_HW_IDENTIFIER_LENGTH);
+	rc = cam_cpas_register_client(&cpas_parms);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Virtual CDM CPAS registration failed");
+		goto cpas_registration_failed;
+	}
+	CAM_DBG(CAM_CDM, "CPAS registration successful handle=%d",
+		cpas_parms.client_handle);
+	cdm_core->cpas_handle = cpas_parms.client_handle;
+
+	CAM_DBG(CAM_CDM, "CDM%d probe successful", cdm_hw_intf->hw_idx);
+
+	rc = cam_cdm_intf_register_hw_cdm(cdm_hw_intf,
+			soc_private, CAM_VIRTUAL_CDM, &cdm_core->index);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Virtual CDM Interface registration failed");
+		goto intf_registration_failed;
+	}
+	CAM_DBG(CAM_CDM, "CDM%d registered to intf successful",
+		cdm_hw_intf->hw_idx);
+	mutex_unlock(&cdm_hw->hw_mutex);
+
+	return 0;
+intf_registration_failed:
+	cam_cpas_unregister_client(cdm_core->cpas_handle);
+cpas_registration_failed:
+	kfree(cdm_hw->soc_info.soc_private);
+	flush_workqueue(cdm_core->work_queue);
+	destroy_workqueue(cdm_core->work_queue);
+	mutex_unlock(&cdm_hw->hw_mutex);
+	mutex_destroy(&cdm_hw->hw_mutex);
+soc_load_failed:
+	kfree(cdm_hw->core_info);
+	kfree(cdm_hw);
+	kfree(cdm_hw_intf);
+	return rc;
+}
+
+int cam_virtual_cdm_remove(struct platform_device *pdev)
+{
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_hw_intf *cdm_hw_intf = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	int rc = -EBUSY;
+
+	cdm_hw_intf = platform_get_drvdata(pdev);
+	if (!cdm_hw_intf) {
+		CAM_ERR(CAM_CDM, "Failed to get dev private data");
+		return rc;
+	}
+
+	cdm_hw = cdm_hw_intf->hw_priv;
+	if (!cdm_hw) {
+		CAM_ERR(CAM_CDM,
+			"Failed to get virtual private data for type=%d idx=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx);
+		return rc;
+	}
+
+	cdm_core = cdm_hw->core_info;
+	if (!cdm_core) {
+		CAM_ERR(CAM_CDM,
+			"Failed to get virtual core data for type=%d idx=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx);
+		return rc;
+	}
+
+	rc = cam_cpas_unregister_client(cdm_core->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CPAS unregister failed");
+		return rc;
+	}
+
+	rc = cam_cdm_intf_deregister_hw_cdm(cdm_hw_intf,
+			cdm_hw->soc_info.soc_private, CAM_VIRTUAL_CDM,
+			cdm_core->index);
+	if (rc) {
+		CAM_ERR(CAM_CDM,
+			"Virtual CDM Interface de-registration failed");
+		return rc;
+	}
+
+	flush_workqueue(cdm_core->work_queue);
+	destroy_workqueue(cdm_core->work_queue);
+	mutex_destroy(&cdm_hw->hw_mutex);
+	kfree(cdm_hw->soc_info.soc_private);
+	kfree(cdm_hw->core_info);
+	kfree(cdm_hw);
+	kfree(cdm_hw_intf);
+	rc = 0;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_context.c
@@ -0,0 +1,842 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/refcount.h>
+
+#include "cam_context.h"
+#include "cam_debug_util.h"
+#include "cam_node.h"
+#include "cam_context_utils.h"
+
+static int cam_context_handle_hw_event(void *context, uint32_t evt_id,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_context *ctx = (struct cam_context *)context;
+
+	if (!ctx || !ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (ctx->state_machine[ctx->state].irq_ops)
+		rc = ctx->state_machine[ctx->state].irq_ops(ctx, evt_id,
+			evt_data);
+	else
+		CAM_DBG(CAM_CORE,
+			"No function to handle event %d in dev %d, state %d",
+			evt_id, ctx->dev_hdl, ctx->state);
+	return rc;
+}
+
+int cam_context_shutdown(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_release_dev_cmd cmd;
+
+	if (ctx->state > CAM_CTX_AVAILABLE && ctx->state < CAM_CTX_STATE_MAX) {
+		cmd.session_handle = ctx->session_hdl;
+		cmd.dev_handle = ctx->dev_hdl;
+		rc = cam_context_handle_release_dev(ctx, &cmd);
+		if (rc)
+			CAM_ERR(CAM_CORE,
+				"context release failed for dev_name %s",
+				ctx->dev_name);
+		else
+			cam_context_putref(ctx);
+	} else {
+		CAM_WARN(CAM_CORE,
+			"dev %s context id %u state %d invalid to release hdl",
+			ctx->dev_name, ctx->ctx_id, ctx->state);
+		rc = -EINVAL;
+	}
+
+	if (ctx->dev_hdl != -1) {
+		rc = cam_destroy_device_hdl(ctx->dev_hdl);
+		if (rc)
+			CAM_ERR(CAM_CORE,
+				"destroy device hdl failed for node %s",
+				ctx->dev_name);
+		else
+			ctx->dev_hdl = -1;
+	}
+
+	return rc;
+}
+
+int cam_context_handle_crm_get_dev_info(struct cam_context *ctx,
+	struct cam_req_mgr_device_info *info)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!info) {
+		CAM_ERR(CAM_CORE, "Invalid get device info payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.get_dev_info) {
+		rc = ctx->state_machine[ctx->state].crm_ops.get_dev_info(
+			ctx, info);
+	} else {
+		CAM_ERR(CAM_CORE, "No get device info in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_link(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *link)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!link) {
+		CAM_ERR(CAM_CORE, "Invalid link payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.link) {
+		rc = ctx->state_machine[ctx->state].crm_ops.link(ctx, link);
+	} else {
+		CAM_ERR(CAM_CORE, "No crm link in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_unlink(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!unlink) {
+		CAM_ERR(CAM_CORE, "Invalid unlink payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.unlink) {
+		rc = ctx->state_machine[ctx->state].crm_ops.unlink(
+			ctx, unlink);
+	} else {
+		CAM_ERR(CAM_CORE, "No crm unlink in dev %d, name %s, state %d",
+			ctx->dev_hdl, ctx->dev_name, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_apply_req(struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!apply) {
+		CAM_ERR(CAM_CORE, "Invalid apply request payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.apply_req) {
+		rc = ctx->state_machine[ctx->state].crm_ops.apply_req(ctx,
+			apply);
+	} else {
+		CAM_ERR(CAM_CORE, "No crm apply req in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_notify_frame_skip(
+	struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!apply) {
+		CAM_ERR(CAM_CORE, "Invalid apply request payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.notify_frame_skip)
+		rc = ctx->state_machine[ctx->state].crm_ops.notify_frame_skip(
+			ctx, apply);
+	else
+		CAM_DBG(CAM_CORE,
+			"No crm notify_frame_skip in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_flush_req(struct cam_context *ctx,
+	struct cam_req_mgr_flush_request *flush)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state != CAM_CTX_FLUSHED) {
+		if (ctx->state_machine[ctx->state].crm_ops.flush_req) {
+			rc = ctx->state_machine[ctx->state].crm_ops.flush_req(ctx,
+				flush);
+		} else {
+			CAM_INFO(CAM_CORE, "No crm flush req in dev %d, state %d, name %s",
+				ctx->dev_hdl, ctx->state, ctx->dev_name);
+			rc = -EPROTO;
+		}
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_process_evt(struct cam_context *ctx,
+	struct cam_req_mgr_link_evt_data *process_evt)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.process_evt) {
+		rc = ctx->state_machine[ctx->state].crm_ops.process_evt(ctx,
+			process_evt);
+	} else {
+		/* handling of this message is optional */
+		CAM_DBG(CAM_CORE, "No crm process evt in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_dump_req(struct cam_context *ctx,
+	struct cam_req_mgr_dump_info *dump)
+{
+	int rc = 0;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Invalid Context");
+		return -EINVAL;
+	}
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context %s ctx_id %d is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EINVAL;
+	}
+	mutex_lock(&ctx->ctx_mutex);
+
+	if (ctx->state_machine[ctx->state].crm_ops.dump_req)
+		rc = ctx->state_machine[ctx->state].crm_ops.dump_req(ctx,
+			dump);
+	else
+		CAM_ERR(CAM_CORE, "No crm dump req for %s dev %d, state %d",
+			ctx->dev_name, ctx->dev_hdl, ctx->state);
+
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_mini_dump_from_hw(struct cam_context *ctx,
+	void  *args)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context [id %d name:%s] is not ready", ctx->ctx_id,
+			ctx->dev_name);
+		return -EINVAL;
+	}
+
+	if ((ctx->state >= CAM_CTX_AVAILABLE) && (ctx->state < CAM_CTX_STATE_MAX)) {
+		if (ctx->state_machine[ctx->state].mini_dump_ops)
+			rc = ctx->state_machine[ctx->state].mini_dump_ops(ctx, args);
+		else
+			CAM_WARN(CAM_CORE, "No dump ctx in dev %d, state %d",
+				ctx->dev_hdl, ctx->state);
+	}
+	return rc;
+}
+
+int cam_context_dump_pf_info(void *data, void *args)
+{
+	struct cam_context *ctx = data;
+	struct cam_hw_dump_pf_args *pf_args = args;
+	int rc = 0;
+
+	if (!pf_args) {
+		CAM_ERR(CAM_CORE, "PF args is NULL");
+		return -EINVAL;
+	}
+
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Context is NULL");
+		if (pf_args->pf_context_info.force_send_pf_evt) {
+			rc = cam_context_send_pf_evt(ctx, pf_args);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"Failed to notify PF event to userspace rc: %d", rc);
+		}
+		return -EINVAL;
+	}
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if ((ctx->state > CAM_CTX_AVAILABLE) &&
+		(ctx->state < CAM_CTX_STATE_MAX)) {
+		if (ctx->state_machine[ctx->state].pagefault_ops) {
+			rc = ctx->state_machine[ctx->state].pagefault_ops(
+				ctx, pf_args);
+		} else {
+			CAM_WARN(CAM_CORE, "No dump ctx in dev %d, state %d",
+				ctx->dev_hdl, ctx->state);
+		}
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_message(struct cam_context *ctx,
+	uint32_t msg_type, void *data)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if ((ctx->state > CAM_CTX_AVAILABLE) &&
+		(ctx->state < CAM_CTX_STATE_MAX)) {
+		if (ctx->state_machine[ctx->state].msg_cb_ops) {
+			rc = ctx->state_machine[ctx->state].msg_cb_ops(
+				ctx, msg_type, data);
+		} else {
+			CAM_WARN(CAM_CORE,
+				"No message handler for ctx %d, state %d msg_type :%d",
+				ctx->dev_hdl, ctx->state, msg_type);
+		}
+	}
+
+	return rc;
+}
+
+int cam_context_handle_acquire_dev(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+	int i;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid acquire device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.acquire_dev) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.acquire_dev(
+			ctx, cmd);
+	} else {
+		CAM_ERR(CAM_CORE, "No acquire device in dev %d, state %d",
+			cmd->dev_handle, ctx->state);
+		rc = -EPROTO;
+	}
+
+	INIT_LIST_HEAD(&ctx->active_req_list);
+	INIT_LIST_HEAD(&ctx->wait_req_list);
+	INIT_LIST_HEAD(&ctx->pending_req_list);
+	INIT_LIST_HEAD(&ctx->free_req_list);
+
+	for (i = 0; i < ctx->req_size; i++) {
+		INIT_LIST_HEAD(&ctx->req_list[i].list);
+		list_add_tail(&ctx->req_list[i].list, &ctx->free_req_list);
+	}
+
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_acquire_hw(struct cam_context *ctx,
+	void *args)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!args) {
+		CAM_ERR(CAM_CORE, "Invalid acquire device hw command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.acquire_hw) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.acquire_hw(
+			ctx, args);
+	} else {
+		CAM_ERR(CAM_CORE, "No acquire hw for dev %s, state %d",
+			ctx->dev_name, ctx->state);
+		rc = -EPROTO;
+	}
+
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_release_dev(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid release device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.release_dev) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.release_dev(
+			ctx, cmd);
+	} else {
+		CAM_ERR(CAM_CORE, "No release device in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_release_hw(struct cam_context *ctx,
+	void *args)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!args) {
+		CAM_ERR(CAM_CORE, "Invalid release HW command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.release_hw) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.release_hw(
+			ctx, args);
+	} else {
+		CAM_ERR(CAM_CORE, "No release hw for dev %s, state %d",
+			ctx->dev_name, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_flush_dev(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid flush device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.flush_dev) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.flush_dev(
+			ctx, cmd);
+	} else {
+		CAM_WARN(CAM_CORE, "No flush device in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_config_dev(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid config device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.config_dev) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.config_dev(
+			ctx, cmd);
+	} else {
+		CAM_INFO(CAM_CORE, "No config device in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_start_dev(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	if (!ctx || !ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid start device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.start_dev)
+		rc = ctx->state_machine[ctx->state].ioctl_ops.start_dev(
+			ctx, cmd);
+	else
+		/* start device can be optional for some driver */
+		CAM_DBG(CAM_CORE, "No start device in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_stop_dev(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	if (!ctx || !ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid stop device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.stop_dev)
+		rc = ctx->state_machine[ctx->state].ioctl_ops.stop_dev(
+			ctx, cmd);
+	else
+		/* stop device can be optional for some driver */
+		CAM_WARN(CAM_CORE, "No stop device in dev %d, name %s state %d",
+			ctx->dev_hdl, ctx->dev_name, ctx->state);
+
+	ctx->last_flush_req = 0;
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_info_dump(void *context,
+	enum cam_context_dump_id id)
+{
+	int rc = 0;
+	struct cam_context *ctx = (struct cam_context *)context;
+
+	if (!ctx || !ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].dumpinfo_ops)
+		rc = ctx->state_machine[ctx->state].dumpinfo_ops(ctx,
+			id);
+	mutex_unlock(&ctx->ctx_mutex);
+
+	if (rc)
+		CAM_WARN(CAM_CORE,
+			"Dump for id %u failed on ctx_id %u name %s state %d",
+			id, ctx->ctx_id, ctx->dev_name, ctx->state);
+
+	return rc;
+}
+
+int cam_context_handle_dump_dev(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc = 0;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Invalid Context");
+		return -EINVAL;
+	}
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context %s ctx_id %d is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE,
+			"Context %s ctx_id %d Invalid dump command payload",
+			ctx->dev_name, ctx->ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	CAM_DBG(CAM_CORE, "dump device in dev %d, name %s state %d",
+		ctx->dev_hdl, ctx->dev_name, ctx->state);
+	if (ctx->state_machine[ctx->state].ioctl_ops.dump_dev)
+		rc = ctx->state_machine[ctx->state].ioctl_ops.dump_dev(
+			ctx, cmd);
+	else
+		CAM_WARN(CAM_CORE, "No dump device in dev %d, name %s state %d",
+			ctx->dev_hdl, ctx->dev_name, ctx->state);
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_hw_recovery(void *priv, void *data)
+{
+	struct cam_context *ctx = priv;
+	int rc = 0;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "null context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state != CAM_CTX_ACTIVATED) {
+		CAM_DBG(CAM_CORE, "skipping recovery for ctx:%d dev:%s in state:%d", ctx->ctx_id,
+			ctx->dev_name, ctx->state);
+		goto end;
+	}
+	CAM_DBG(CAM_CORE, "try hw recovery for ctx:%d dev:%s", ctx->ctx_id, ctx->dev_name);
+	if (ctx->state_machine[ctx->state].recovery_ops)
+		rc = ctx->state_machine[ctx->state].recovery_ops(priv, data);
+	else
+		CAM_WARN(CAM_CORE, "no recovery op in state:%d for ctx:%d dev:%s",
+			ctx->state, ctx->ctx_id, ctx->dev_name);
+end:
+	mutex_unlock(&ctx->ctx_mutex);
+	return rc;
+}
+
+int cam_context_init(struct cam_context *ctx,
+	const char *dev_name,
+	uint64_t dev_id,
+	uint32_t ctx_id,
+	struct cam_req_mgr_kmd_ops *crm_node_intf,
+	struct cam_hw_mgr_intf *hw_mgr_intf,
+	struct cam_ctx_request *req_list,
+	uint32_t req_size, int img_iommu_hdl)
+{
+	int i;
+
+	/* crm_node_intf is optinal */
+	if (!ctx || !hw_mgr_intf || !req_list) {
+		CAM_ERR(CAM_CORE, "Invalid input parameters");
+		return -EINVAL;
+	}
+
+	memset(ctx, 0, sizeof(*ctx));
+	ctx->dev_hdl = -1;
+	ctx->link_hdl = -1;
+	ctx->session_hdl = -1;
+	INIT_LIST_HEAD(&ctx->list);
+	mutex_init(&ctx->ctx_mutex);
+	mutex_init(&ctx->sync_mutex);
+	spin_lock_init(&ctx->lock);
+
+	strscpy(ctx->dev_name, dev_name, CAM_CTX_DEV_NAME_MAX_LENGTH);
+	ctx->dev_id = dev_id;
+	ctx->ctx_id = ctx_id;
+	ctx->last_flush_req = 0;
+	ctx->ctx_crm_intf = NULL;
+	ctx->crm_ctx_intf = crm_node_intf;
+	ctx->hw_mgr_intf = hw_mgr_intf;
+	ctx->irq_cb_intf = cam_context_handle_hw_event;
+
+	INIT_LIST_HEAD(&ctx->active_req_list);
+	INIT_LIST_HEAD(&ctx->wait_req_list);
+	INIT_LIST_HEAD(&ctx->pending_req_list);
+	INIT_LIST_HEAD(&ctx->free_req_list);
+	ctx->req_list = req_list;
+	ctx->req_size = req_size;
+	for (i = 0; i < req_size; i++) {
+		INIT_LIST_HEAD(&ctx->req_list[i].list);
+		list_add_tail(&ctx->req_list[i].list, &ctx->free_req_list);
+		ctx->req_list[i].ctx = ctx;
+		ctx->req_list[i].index = i;
+	}
+	ctx->state = CAM_CTX_AVAILABLE;
+	ctx->state_machine = NULL;
+	ctx->ctx_priv = NULL;
+	ctx->img_iommu_hdl = img_iommu_hdl;
+
+	return 0;
+}
+
+int cam_context_deinit(struct cam_context *ctx)
+{
+	if (!ctx)
+		return -EINVAL;
+
+	/**
+	 * This is called from platform device remove.
+	 * Everyting should be released at this moment.
+	 * so we just free the memory for the context
+	 */
+	if (ctx->state != CAM_CTX_AVAILABLE)
+		CAM_ERR(CAM_CORE, "Device did not shutdown cleanly");
+
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
+
+void cam_context_putref(struct cam_context *ctx)
+{
+	if (kref_read(&ctx->refcount))
+		kref_put(&ctx->refcount, cam_node_put_ctxt_to_free_list);
+	else
+		WARN(1, "ctx %s %d state %d devhdl %X\n", ctx->dev_name,
+			ctx->ctx_id, ctx->state, ctx->dev_hdl);
+
+	CAM_DBG(CAM_CORE,
+		"ctx device hdl %ld, ref count %d, dev_name %s",
+		ctx->dev_hdl, refcount_read(&(ctx->refcount.refcount)),
+		ctx->dev_name);
+}
+
+void cam_context_getref(struct cam_context *ctx)
+{
+	if (kref_get_unless_zero(&ctx->refcount) == 0) {
+		/* should never happen */
+		WARN(1, "%s fail\n", __func__);
+	}
+	CAM_DBG(CAM_CORE,
+		"ctx device hdl %ld, ref count %d, dev_name %s",
+		ctx->dev_hdl, refcount_read(&(ctx->refcount.refcount)),
+		ctx->dev_name);
+}
+
+int cam_context_add_evt_inject(struct cam_context *ctx, void *evt_args)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if ((ctx->state > CAM_CTX_AVAILABLE) &&
+		(ctx->state < CAM_CTX_STATE_MAX)) {
+		if (ctx->state_machine[ctx->state].evt_inject_ops) {
+			rc = ctx->state_machine[ctx->state].evt_inject_ops(
+				ctx, evt_args);
+		} else {
+			CAM_WARN(CAM_CORE, "No evt inject ops in dev %d, state %d",
+				ctx->dev_hdl, ctx->state);
+		}
+	} else {
+		rc = -EINVAL;
+	}
+
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_context.h
@@ -0,0 +1,668 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CONTEXT_H_
+#define _CAM_CONTEXT_H_
+
+#include <linux/mutex.h>
+#include <linux/spinlock_types.h>
+#include <linux/kref.h>
+#include <media/v4l2-subdev.h>
+#include "cam_req_mgr_interface.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_smmu_api.h"
+#include "cam_common_util.h"
+
+/* Forward declarations */
+struct cam_context;
+
+/* max device name string length*/
+#define CAM_CTX_DEV_NAME_MAX_LENGTH 20
+
+/* max request number */
+#define CAM_CTX_REQ_MAX              20
+#define CAM_CTX_ICP_REQ_MAX          40
+#define CAM_CTX_CFG_MAX              20
+#define CAM_CTX_RES_MAX              20
+
+/* max tag  dump header string length*/
+#define CAM_CTXT_DUMP_TAG_MAX_LEN 128
+
+/* Number of words to be dumped for context*/
+#define CAM_CTXT_DUMP_NUM_WORDS 10
+
+/**
+ * enum cam_ctx_state -  context top level states
+ *
+ */
+enum cam_context_state {
+	CAM_CTX_UNINIT               = 0,
+	CAM_CTX_AVAILABLE            = 1,
+	CAM_CTX_ACQUIRED             = 2,
+	CAM_CTX_READY                = 3,
+	CAM_CTX_FLUSHED              = 4,
+	CAM_CTX_ACTIVATED            = 5,
+	CAM_CTX_STATE_MAX            = 6,
+};
+
+/**
+ * struct cam_ctx_request - Common request structure for the context
+ *
+ * @list:                  Link list entry
+ * @status:                Request status
+ * @request_id:            Request id
+ * @req_priv:              Derived request object
+ * @hw_update_entries:     Hardware update entries
+ * @num_hw_update_entries: Number of hardware update entries
+ * @in_map_entries:        Entries for in fences
+ * @num_in_map_entries:    Number of in map entries
+ * @out_map_entries:       Entries for out fences
+ * @num_out_map_entries:   Number of out map entries
+ * @num_in_acked:          Number of in fence acked
+ * @num_out_acked:         Number of out fence acked
+ * @index:                 Index of request in the list
+ * @flushed:               Request is flushed
+ * @ctx:                   The context to which this request belongs
+ * @buf_tracker:           List of buffers we want to keep ref counts on
+ *                         used by the HW block for a particular req
+ * @pf_data                page fault debug data
+ *
+ */
+struct cam_ctx_request {
+	struct list_head               list;
+	uint32_t                       status;
+	uint64_t                       request_id;
+	void                          *req_priv;
+	struct cam_hw_update_entry    *hw_update_entries;
+	uint32_t                       num_hw_update_entries;
+	struct cam_hw_fence_map_entry *in_map_entries;
+	uint32_t                       num_in_map_entries;
+	struct cam_hw_fence_map_entry *out_map_entries;
+	uint32_t                       num_out_map_entries;
+	atomic_t                       num_in_acked;
+	uint32_t                       num_out_acked;
+	uint32_t                       index;
+	int                            flushed;
+	struct cam_context            *ctx;
+	struct list_head               buf_tracker;
+	struct cam_hw_mgr_pf_request_info  pf_data;
+};
+
+/**
+ * struct cam_ctx_ioctl_ops - Function table for handling IOCTL calls
+ *
+ * @acquire_dev:           Function pointer for acquire device
+ * @release_dev:           Function pointer for release device
+ * @config_dev:            Function pointer for config device
+ * @start_dev:             Function pointer for start device
+ * @stop_dev:              Function pointer for stop device
+ * @flush_dev:             Function pointer for flush device
+ * @acquire_hw:            Function pointer for acquire hw
+ * @release_hw:            Function pointer for release hw
+ * @dump_dev:              Function pointer for dump dev
+ *
+ */
+struct cam_ctx_ioctl_ops {
+	int (*acquire_dev)(struct cam_context *ctx,
+			struct cam_acquire_dev_cmd *cmd);
+	int (*release_dev)(struct cam_context *ctx,
+			struct cam_release_dev_cmd *cmd);
+	int (*config_dev)(struct cam_context *ctx,
+			struct cam_config_dev_cmd *cmd);
+	int (*start_dev)(struct cam_context *ctx,
+			struct cam_start_stop_dev_cmd *cmd);
+	int (*stop_dev)(struct cam_context *ctx,
+			struct cam_start_stop_dev_cmd *cmd);
+	int (*flush_dev)(struct cam_context *ctx,
+			struct cam_flush_dev_cmd *cmd);
+	int (*acquire_hw)(struct cam_context *ctx, void *args);
+	int (*release_hw)(struct cam_context *ctx, void *args);
+	int (*dump_dev)(struct cam_context *ctx,
+			struct cam_dump_req_cmd *cmd);
+};
+
+/**
+ * struct cam_ctx_crm_ops -  Function table for handling CRM to context calls
+ *
+ * @get_dev_info:          Get device informaiton
+ * @link:                  Link the context
+ * @unlink:                Unlink the context
+ * @apply_req:             Apply setting for the context
+ * @notify_frame_skip:     Notify device that a frame is skipped
+ * @flush_req:             Flush request to remove request ids
+ * @process_evt:           Handle event notification from CRM.(optional)
+ * @dump_req:              Dump information for the issue request
+ *
+ */
+struct cam_ctx_crm_ops {
+	int (*get_dev_info)(struct cam_context *ctx,
+			struct cam_req_mgr_device_info *device_info);
+	int (*link)(struct cam_context *ctx,
+			struct cam_req_mgr_core_dev_link_setup *link);
+	int (*unlink)(struct cam_context *ctx,
+			struct cam_req_mgr_core_dev_link_setup *unlink);
+	int (*apply_req)(struct cam_context *ctx,
+			struct cam_req_mgr_apply_request *apply);
+	int (*notify_frame_skip)(struct cam_context *ctx,
+			struct cam_req_mgr_apply_request *apply);
+	int (*flush_req)(struct cam_context *ctx,
+			struct cam_req_mgr_flush_request *flush);
+	int (*process_evt)(struct cam_context *ctx,
+			struct cam_req_mgr_link_evt_data *evt_data);
+	int (*dump_req)(struct cam_context *ctx,
+			struct cam_req_mgr_dump_info *dump);
+};
+
+
+/**
+ * struct cam_ctx_ops - Collection of the interface funciton tables
+ *
+ * @ioctl_ops:             Ioctl funciton table
+ * @crm_ops:               CRM to context interface function table
+ * @irq_ops:               Hardware event handle function
+ * @pagefault_ops:         Function to be called on page fault
+ * @dumpinfo_ops:          Function to be invoked for dumping any
+ *                         context info
+ * @recovery_ops:          Function to be invoked to try hardware recovery
+ * @mini_dump_ops:         Function for mini dump
+ * @err_inject_ops:        Function for error injection
+ * @msg_cb_ops:            Function to be called on any message from
+ *                         other subdev notifications
+ *
+ */
+struct cam_ctx_ops {
+	struct cam_ctx_ioctl_ops     ioctl_ops;
+	struct cam_ctx_crm_ops       crm_ops;
+	cam_hw_event_cb_func         irq_ops;
+	cam_hw_pagefault_cb_func     pagefault_ops;
+	cam_ctx_info_dump_cb_func    dumpinfo_ops;
+	cam_ctx_recovery_cb_func     recovery_ops;
+	cam_ctx_mini_dump_cb_func    mini_dump_ops;
+	cam_ctx_err_inject_cb_func   evt_inject_ops;
+	cam_ctx_message_cb_func      msg_cb_ops;
+};
+
+
+/**
+ * struct cam_context - camera context object for the subdevice node
+ *
+ * @dev_name:              String giving name of device associated
+ * @dev_id:                ID of device associated
+ * @ctx_id:                ID for this context
+ * @list:                  Link list entry
+ * @sessoin_hdl:           Session handle
+ * @dev_hdl:               Device handle
+ * @link_hdl:              Link handle
+ * @ctx_mutex:             Mutex for ioctl calls
+ * @lock:                  Spin lock
+ * @active_req_list:       Requests pending for done event
+ * @pending_req_list:      Requests pending for reg upd event
+ * @wait_req_list:         Requests waiting for apply
+ * @free_req_list:         Requests that are free
+ * @req_list:              Reference to the request storage
+ * @req_size:              Size of the request storage
+ * @hw_mgr_intf:           Context to HW interface
+ * @ctx_crm_intf:          Context to CRM interface
+ * @crm_ctx_intf:          CRM to context interface
+ * @irq_cb_intf:           HW to context callback interface
+ * @state:                 Current state for top level state machine
+ * @state_machine:         Top level state machine
+ * @ctx_priv:              Private context pointer
+ * @ctxt_to_hw_map:        Context to hardware mapping pointer
+ * @hw_mgr_ctx_id:         Hw Mgr context id returned from hw mgr
+ * @ctx_id_string:         Context id string constructed with dev type,
+ *                         ctx id, hw mgr ctx id, hw id
+ * @refcount:              Context object refcount
+ * @node:                  The main node to which this context belongs
+ * @sync_mutex:            mutex to sync with sync cb thread
+ * @last_flush_req:        Last request to flush
+ * @max_hw_update_entries: Max hw update entries
+ * @max_in_map_entries:    Max in map entries
+ * @max_out_map_entries:   Max out in map entries
+ * @hw_updater_entry:      Hw update entry
+ * @in_map_entries:        In map update entry
+ * @out_map_entries:       Out map entry
+ * @mini dump cb:          Mini dump cb
+ * @img_iommu_hdl:         Image IOMMU handle
+ * @cdm_done_ts:           CDM callback done timestamp
+ */
+struct cam_context {
+	char                         dev_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	uint64_t                     dev_id;
+	uint32_t                     ctx_id;
+	struct list_head             list;
+	int32_t                      session_hdl;
+	int32_t                      dev_hdl;
+	int32_t                      link_hdl;
+
+	struct mutex                 ctx_mutex;
+	spinlock_t                   lock;
+
+	struct list_head               active_req_list;
+	struct list_head               pending_req_list;
+	struct list_head               wait_req_list;
+	struct list_head               free_req_list;
+	struct cam_ctx_request        *req_list;
+	uint32_t                       req_size;
+
+	struct cam_hw_mgr_intf        *hw_mgr_intf;
+	struct cam_req_mgr_crm_cb     *ctx_crm_intf;
+	struct cam_req_mgr_kmd_ops    *crm_ctx_intf;
+	cam_hw_event_cb_func           irq_cb_intf;
+
+	enum cam_context_state         state;
+	struct cam_ctx_ops            *state_machine;
+
+	void                          *ctx_priv;
+	void                          *ctxt_to_hw_map;
+	uint32_t                       hw_mgr_ctx_id;
+	char                           ctx_id_string[128];
+
+	struct kref                    refcount;
+	void                          *node;
+	struct mutex                   sync_mutex;
+	uint32_t                       last_flush_req;
+	uint32_t                       max_hw_update_entries;
+	uint32_t                       max_in_map_entries;
+	uint32_t                       max_out_map_entries;
+	struct cam_hw_update_entry    **hw_update_entry;
+	struct cam_hw_fence_map_entry **in_map_entries;
+	struct cam_hw_fence_map_entry **out_map_entries;
+	cam_ctx_mini_dump_cb_func      mini_dump_cb;
+	int                            img_iommu_hdl;
+	struct timespec64              cdm_done_ts;
+};
+
+/**
+ * struct cam_context_stream_dump - camera context stream information
+ *
+ * @hw_mgr_ctx_id:         Hw Mgr context id returned from hw mgr
+ * @dev_id:                ID of device associated
+ * @dev_hdl:               Device handle
+ * @link_hdl:              Link handle
+ * @sessoin_hdl:           Session handle
+ * @refcount:              Context object refcount
+ * @last_flush_req:        Last request to flush
+ * @state:                 Current state for top level state machine
+ */
+struct cam_context_stream_dump {
+	uint32_t                       hw_mgr_ctx_id;
+	uint32_t                       dev_id;
+	uint32_t                       dev_hdl;
+	uint32_t                       link_hdl;
+	uint32_t                       session_hdl;
+	uint32_t                       refcount;
+	uint32_t                       last_flush_req;
+	enum cam_context_state         state;
+};
+
+/**
+ * struct cam_context_each_req_info - camera each request information
+ *
+ * @request_id:         request id
+ */
+struct cam_context_each_req_info {
+	uint64_t              request_id;
+};
+
+/**
+ * struct cam_context_dump_header -  Function for context dump header
+ *
+ * @tag         :    Tag for context dump header
+ * @size        :    Size of data
+ * @word_size   :    Word size of data
+ */
+struct cam_context_dump_header {
+	uint8_t   tag[CAM_CTXT_DUMP_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * cam_context_shutdown()
+ *
+ * @brief:        Calls while device close or shutdown
+ *
+ * @ctx:          Object pointer for cam_context
+ *
+ */
+int cam_context_shutdown(struct cam_context *ctx);
+
+/**
+ * cam_context_handle_crm_get_dev_info()
+ *
+ * @brief:        Handle get device information command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @info:         Device information returned
+ *
+ */
+int cam_context_handle_crm_get_dev_info(struct cam_context *ctx,
+		struct cam_req_mgr_device_info *info);
+
+/**
+ * cam_context_handle_crm_link()
+ *
+ * @brief:        Handle link command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @link:         Link command payload
+ *
+ */
+int cam_context_handle_crm_link(struct cam_context *ctx,
+		struct cam_req_mgr_core_dev_link_setup *link);
+
+/**
+ * cam_context_handle_crm_unlink()
+ *
+ * @brief:        Handle unlink command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @unlink:       Unlink command payload
+ *
+ */
+int cam_context_handle_crm_unlink(struct cam_context *ctx,
+		struct cam_req_mgr_core_dev_link_setup *unlink);
+
+/**
+ * cam_context_handle_crm_apply_req()
+ *
+ * @brief:        Handle apply request command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @apply:        Apply request command payload
+ *
+ */
+int cam_context_handle_crm_apply_req(struct cam_context *ctx,
+		struct cam_req_mgr_apply_request *apply);
+
+/**
+ * cam_context_handle_crm_notify_frame_skip()
+ *
+ * @brief:        Handle notify frame skip command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @apply:        Notify frame skip command payload
+ *
+ */
+int cam_context_handle_crm_notify_frame_skip(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply);
+
+/**
+ * cam_context_handle_crm_flush_req()
+ *
+ * @brief:        Handle flush request command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @apply:        Flush request command payload
+ *
+ */
+int cam_context_handle_crm_flush_req(struct cam_context *ctx,
+		struct cam_req_mgr_flush_request *apply);
+
+/**
+ * cam_context_handle_crm_process_evt()
+ *
+ * @brief:        Handle process event command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @process_evt:  process event command payload
+ *
+ */
+int cam_context_handle_crm_process_evt(struct cam_context *ctx,
+	struct cam_req_mgr_link_evt_data *process_evt);
+
+/**
+ * cam_context_handle_crm_dump_req()
+ *
+ * @brief:        Handle CRM dump request
+ *
+ * @ctx:          Object pointer for cam_context
+ * @dump:         Dump request command payload
+ *
+ */
+int cam_context_handle_crm_dump_req(struct cam_context *ctx,
+	struct cam_req_mgr_dump_info *dump);
+
+/**
+ * cam_context_mini_dump_from_hw()
+ *
+ * @brief:        Handle mini dump request command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @args:         Args to be passed
+ *
+ */
+int cam_context_mini_dump_from_hw(struct cam_context *ctx,
+	void  *args);
+
+/**
+ * cam_context_dump_pf_info()
+ *
+ * @brief:        Handle dump active request request command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @pf_args:      pf args to dump pf info to hw
+ *
+ */
+int cam_context_dump_pf_info(void *ctx,
+	void *pf_args);
+
+/**
+ * cam_context_handle_message()
+ *
+ * @brief:        Handle message callback command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @msg_type:     message type sent from other subdev
+ * @data:         data from other subdev
+ *
+ */
+int cam_context_handle_message(struct cam_context *ctx,
+	uint32_t msg_type, void *data);
+
+/**
+ * cam_context_handle_acquire_dev()
+ *
+ * @brief:        Handle acquire device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Acquire device command payload
+ *
+ */
+int cam_context_handle_acquire_dev(struct cam_context *ctx,
+		struct cam_acquire_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_acquire_hw()
+ *
+ * @brief:        Handle acquire HW command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Acquire HW command payload
+ *
+ */
+int cam_context_handle_acquire_hw(struct cam_context *ctx,
+		void *cmd);
+
+/**
+ * cam_context_handle_release_dev()
+ *
+ * @brief:        Handle release device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Release device command payload
+ *
+ */
+int cam_context_handle_release_dev(struct cam_context *ctx,
+		struct cam_release_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_release_hw()
+ *
+ * @brief:        Handle release HW command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Release HW command payload
+ *
+ */
+int cam_context_handle_release_hw(struct cam_context *ctx,
+		void *cmd);
+
+/**
+ * cam_context_handle_config_dev()
+ *
+ * @brief:        Handle config device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Config device command payload
+ *
+ */
+int cam_context_handle_config_dev(struct cam_context *ctx,
+		struct cam_config_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_flush_dev()
+ *
+ * @brief:        Handle flush device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Flush device command payload
+ *
+ */
+int cam_context_handle_flush_dev(struct cam_context *ctx,
+		struct cam_flush_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_start_dev()
+ *
+ * @brief:        Handle start device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Start device command payload
+ *
+ */
+int cam_context_handle_start_dev(struct cam_context *ctx,
+		struct cam_start_stop_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_stop_dev()
+ *
+ * @brief:        Handle stop device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Stop device command payload
+ *
+ */
+int cam_context_handle_stop_dev(struct cam_context *ctx,
+		struct cam_start_stop_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_dump_dev()
+ *
+ * @brief:        Handle dump device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Dump device command payload
+ *
+ */
+int cam_context_handle_dump_dev(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd);
+
+/**
+ * cam_context_handle_info_dump()
+ *
+ * @brief:        Handle any dump info for the context
+ *
+ * @ctx:          Object pointer for cam_context
+ * @id:           To indicate which info pertaining
+ *                to that ctx needs to be dumped
+ *
+ */
+int cam_context_handle_info_dump(void *context,
+	enum cam_context_dump_id id);
+
+/**
+ * cam_context_handle_hw_recovery()
+ *
+ * @brief:        Handle hardware recovery. This function can be scheduled in
+ *                cam_req_mgr_workq.
+ *
+ * @context:      Object pointer for cam_context
+ * @data:         Recovery data that is to be passsed to hw mgr
+ *
+ */
+int cam_context_handle_hw_recovery(void *context, void *data);
+
+/**
+ * cam_context_deinit()
+ *
+ * @brief:        Camera context deinitialize function
+ *
+ * @ctx:          Object pointer for cam_context
+ *
+ */
+int cam_context_deinit(struct cam_context *ctx);
+
+/**
+ * cam_context_init()
+ *
+ * @brief:        Camera context initialize function
+ *
+ * @ctx:                   Object pointer for cam_context
+ * @dev_name:              String giving name of device associated
+ * @dev_id:                ID of the device associated
+ * @ctx_id:                ID for this context
+ * @crm_node_intf:         Function table for crm to context interface
+ * @hw_mgr_intf:           Function table for context to hw interface
+ * @req_list:              Requests storage
+ * @req_size:              Size of the request storage
+ * @img_iommu_hdl:         IOMMU Handle for image buffers
+ *
+ */
+int cam_context_init(struct cam_context *ctx,
+		const char *dev_name,
+		uint64_t dev_id,
+		uint32_t ctx_id,
+		struct cam_req_mgr_kmd_ops *crm_node_intf,
+		struct cam_hw_mgr_intf *hw_mgr_intf,
+		struct cam_ctx_request *req_list,
+		uint32_t req_size, int img_iommu_hdl);
+
+/**
+ * cam_context_putref()
+ *
+ * @brief:       Put back context reference.
+ *
+ * @ctx:                  Context for which ref is returned
+ *
+ */
+void cam_context_putref(struct cam_context *ctx);
+
+/**
+ * cam_context_getref()
+ *
+ * @brief:       Get back context reference.
+ *
+ * @ctx:                  Context for which ref is taken
+ *
+ */
+void cam_context_getref(struct cam_context *ctx);
+
+/**
+ * cam_context_add_evt_inject()
+ *
+ * @brief:       Add error inject parameters through evt_inject_ops.
+ *
+ * @ctx:         Context for which error is to be injected
+ *
+ * @inject_args: Event injection parameters
+ *
+ */
+int cam_context_add_evt_inject(struct cam_context *ctx,
+	void *inject_args);
+
+#endif  /* _CAM_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_context_utils.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_context_utils.c
@@ -0,0 +1,2100 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <media/cam_sync.h>
+#include <media/cam_defs.h>
+
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_mem_mgr.h"
+#include "cam_node.h"
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_sync_api.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_packet_util.h"
+
+static uint cam_debug_ctx_req_list;
+module_param(cam_debug_ctx_req_list, uint, 0644);
+
+static inline int cam_context_validate_thread(void)
+{
+	if (in_interrupt()) {
+		WARN(1, "Invalid execution context\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static void cam_context_free_mem_hw_entries(struct cam_context *ctx)
+{
+	int  i;
+
+	if (ctx->out_map_entries) {
+		for (i = 0; i < ctx->req_size; i++) {
+			kfree(ctx->out_map_entries[i]);
+			ctx->out_map_entries[i] = NULL;
+		}
+
+		kfree(ctx->out_map_entries);
+		ctx->out_map_entries = NULL;
+	}
+
+	if (ctx->in_map_entries) {
+		for (i = 0; i < ctx->req_size; i++) {
+			kfree(ctx->in_map_entries[i]);
+			ctx->in_map_entries[i] = NULL;
+		}
+
+		kfree(ctx->in_map_entries);
+		ctx->in_map_entries = NULL;
+	}
+
+	if (ctx->hw_update_entry) {
+		for (i = 0; i < ctx->req_size; i++) {
+			kfree(ctx->hw_update_entry[i]);
+			ctx->hw_update_entry[i] = NULL;
+		}
+
+		kfree(ctx->hw_update_entry);
+		ctx->hw_update_entry = NULL;
+	}
+}
+
+static int cam_context_allocate_mem_hw_entries(struct cam_context *ctx)
+{
+	int rc = 0;
+	unsigned int i;
+	struct cam_ctx_request          *req;
+	struct cam_ctx_request          *temp_req;
+
+	CAM_DBG(CAM_CTXT,
+		"%s[%d] num: max_hw %u in_map %u out_map %u req %u",
+		ctx->dev_name,
+		ctx->ctx_id,
+		ctx->max_hw_update_entries,
+		ctx->max_in_map_entries,
+		ctx->max_out_map_entries,
+		ctx->req_size);
+
+	ctx->hw_update_entry = kcalloc(ctx->req_size,
+		sizeof(struct cam_hw_update_entry *), GFP_KERNEL);
+
+	if (!ctx->hw_update_entry) {
+		CAM_ERR(CAM_CTXT, "%s[%d] no memory for hw_update_entry",
+			ctx->dev_name, ctx->ctx_id);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < ctx->req_size; i++) {
+		ctx->hw_update_entry[i] = kcalloc(ctx->max_hw_update_entries,
+			sizeof(struct cam_hw_update_entry), GFP_KERNEL);
+
+		if (!ctx->hw_update_entry[i]) {
+			CAM_ERR(CAM_CTXT, "%s[%d] no memory for hw_update_entry: %u",
+				ctx->dev_name, ctx->ctx_id, i);
+			rc = -ENOMEM;
+			goto free_mem;
+		}
+	}
+
+	ctx->in_map_entries = kcalloc(ctx->req_size, sizeof(struct cam_hw_fence_map_entry *),
+		GFP_KERNEL);
+
+	if (!ctx->in_map_entries) {
+		CAM_ERR(CAM_CTXT, "%s[%d] no memory for in_map_entries",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -ENOMEM;
+		goto free_mem;
+	}
+
+	for (i = 0; i < ctx->req_size; i++) {
+		ctx->in_map_entries[i] = kcalloc(ctx->max_in_map_entries,
+			sizeof(struct cam_hw_fence_map_entry), GFP_KERNEL);
+
+		if (!ctx->in_map_entries[i]) {
+			CAM_ERR(CAM_CTXT, "%s[%d] no memory for in_map_entries: %u",
+				ctx->dev_name, ctx->ctx_id, i);
+			rc = -ENOMEM;
+			goto free_mem;
+		}
+	}
+
+	ctx->out_map_entries = kcalloc(ctx->req_size, sizeof(struct cam_hw_fence_map_entry *),
+		GFP_KERNEL);
+
+	if (!ctx->out_map_entries) {
+		CAM_ERR(CAM_CTXT, "%s[%d] no memory for out_map_entries",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -ENOMEM;
+		goto free_mem;
+	}
+
+	for (i = 0; i < ctx->req_size; i++) {
+		ctx->out_map_entries[i] = kcalloc(ctx->max_out_map_entries,
+			sizeof(struct cam_hw_fence_map_entry), GFP_KERNEL);
+
+		if (!ctx->out_map_entries[i]) {
+			CAM_ERR(CAM_CTXT, "%s[%d] no memory for out_map_entries: %u",
+				ctx->dev_name, ctx->ctx_id, i);
+			rc = -ENOMEM;
+			goto free_mem;
+		}
+	}
+
+	list_for_each_entry_safe(req, temp_req, &ctx->free_req_list, list) {
+		req->hw_update_entries = ctx->hw_update_entry[req->index];
+		req->in_map_entries = ctx->in_map_entries[req->index];
+		req->out_map_entries = ctx->out_map_entries[req->index];
+	}
+
+	return rc;
+
+free_mem:
+	cam_context_free_mem_hw_entries(ctx);
+	return rc;
+}
+
+int cam_context_buf_done_from_hw(struct cam_context *ctx,
+	void *done_event_data, uint32_t evt_id)
+{
+	int j, result, rc;
+	struct cam_ctx_request *req;
+	struct cam_hw_done_event_data *done =
+		(struct cam_hw_done_event_data *)done_event_data;
+	struct cam_packet *packet;
+
+	if (!ctx || !done) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, done);
+		return -EINVAL;
+	}
+
+	rc = cam_context_validate_thread();
+	if (rc)
+		return rc;
+
+	spin_lock(&ctx->lock);
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] no active request",
+			ctx->dev_name, ctx->ctx_id);
+		spin_unlock(&ctx->lock);
+		return -EIO;
+	}
+	req = list_first_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+
+	trace_cam_buf_done("UTILS", ctx, req);
+
+	if (done->request_id != req->request_id) {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] mismatch: done req[%lld], active req[%lld]",
+			ctx->dev_name, ctx->ctx_id,
+			done->request_id, req->request_id);
+		spin_unlock(&ctx->lock);
+		return -EIO;
+	}
+
+	if (!req->num_out_map_entries) {
+		CAM_DBG(CAM_CTXT, "[%s][%d] no output fence to signal",
+			ctx->dev_name, ctx->ctx_id);
+		list_del_init(&req->list);
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		list_add_tail(&req->list, &ctx->free_req_list);
+		req->ctx = NULL;
+		spin_unlock(&ctx->lock);
+		return -EIO;
+	}
+
+	/*
+	 * since another thread may be adding/removing from active
+	 * list, so hold the lock
+	 */
+	list_del_init(&req->list);
+	spin_unlock(&ctx->lock);
+
+	cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+
+	if (evt_id == CAM_CTX_EVT_ID_SUCCESS)
+		result = CAM_SYNC_STATE_SIGNALED_SUCCESS;
+	else  if (evt_id == CAM_CTX_EVT_ID_CANCEL)
+		result = CAM_SYNC_STATE_SIGNALED_CANCEL;
+	else
+		result = CAM_SYNC_STATE_SIGNALED_ERROR;
+
+	CAM_DBG(CAM_REQ,
+		"[%s][ctx_id %d] : req[%llu] : Signaling %d",
+		ctx->dev_name, ctx->ctx_id, req->request_id, result);
+
+	if (cam_presil_mode_enabled()) {
+		rc = cam_packet_util_get_packet_addr(&packet, req->pf_data.packet_handle,
+			req->pf_data.packet_offset);
+		if (rc) {
+			CAM_ERR(CAM_CTXT,
+				"[%s][%d] : req[%llu] failed to get packet address for handle: 0x%llx",
+				ctx->dev_name, ctx->ctx_id, req->request_id,
+				req->pf_data.packet_handle);
+			return rc;
+		}
+	}
+
+	for (j = 0; j < req->num_out_map_entries; j++) {
+		/* Get buf handles from packet and retrieve them from presil framework */
+		if (cam_presil_mode_enabled()) {
+			rc = cam_presil_retrieve_buffers_from_packet(packet,
+				ctx->img_iommu_hdl, req->out_map_entries[j].resource_handle);
+			if (rc) {
+				CAM_ERR(CAM_CTXT, "Failed to retrieve image buffers rc:%d", rc);
+				cam_packet_util_put_packet_addr(req->pf_data.packet_handle);
+				return rc;
+			}
+		}
+
+		CAM_DBG(CAM_REQ, "fence %d signal with %d",
+			req->out_map_entries[j].sync_id, result);
+		cam_sync_signal(req->out_map_entries[j].sync_id, result,
+			done->evt_param);
+		req->out_map_entries[j].sync_id = -1;
+	}
+
+	if (cam_presil_mode_enabled())
+		cam_packet_util_put_packet_addr(req->pf_data.packet_handle);
+
+	if (cam_debug_ctx_req_list & ctx->dev_id)
+		CAM_INFO(CAM_CTXT,
+			"[%s][%d] : Moving req[%llu] from active_list to free_list",
+			ctx->dev_name, ctx->ctx_id, req->request_id);
+
+	cam_cpas_notify_event(ctx->ctx_id_string, req->request_id);
+
+	/*
+	 * another thread may be adding/removing from free list,
+	 * so hold the lock
+	 */
+	spin_lock(&ctx->lock);
+	list_add_tail(&req->list, &ctx->free_req_list);
+	req->ctx = NULL;
+	spin_unlock(&ctx->lock);
+
+	return 0;
+}
+
+static int cam_context_apply_req_to_hw(struct cam_ctx_request *req,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_context *ctx = req->ctx;
+	struct cam_hw_config_args cfg;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	spin_lock(&ctx->lock);
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->active_req_list);
+	spin_unlock(&ctx->lock);
+
+	if (cam_debug_ctx_req_list & ctx->dev_id)
+		CAM_INFO(CAM_CTXT,
+			"[%s][%d] : Moving req[%llu] from pending_list to active_list",
+			ctx->dev_name, ctx->ctx_id, req->request_id);
+
+	cfg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	cfg.request_id = req->request_id;
+	cfg.hw_update_entries = req->hw_update_entries;
+	cfg.num_hw_update_entries = req->num_hw_update_entries;
+	cfg.out_map_entries = req->out_map_entries;
+	cfg.num_out_map_entries = req->num_out_map_entries;
+	cfg.priv = req->req_priv;
+
+	rc = ctx->hw_mgr_intf->hw_config(ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc) {
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		spin_lock(&ctx->lock);
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->free_req_list);
+		spin_unlock(&ctx->lock);
+
+		if (cam_debug_ctx_req_list & ctx->dev_id)
+			CAM_INFO(CAM_CTXT,
+				"[%s][%d] : Moving req[%llu] from active_list to free_list",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+	}
+
+end:
+	return rc;
+}
+
+static void cam_context_sync_callback(int32_t sync_obj, int status, void *data)
+{
+	struct cam_ctx_request *req = data;
+	struct cam_context *ctx = NULL;
+	struct cam_context_utils_flush_args flush_args;
+	struct cam_flush_dev_cmd flush_cmd;
+	struct cam_req_mgr_apply_request apply;
+	int rc;
+
+	if (!req) {
+		CAM_ERR(CAM_CTXT, "Invalid input param");
+		return;
+	}
+	rc = cam_context_validate_thread();
+	if (rc)
+		return;
+
+	ctx = req->ctx;
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid ctx for req %llu", req->request_id);
+		return;
+	}
+
+	if (atomic_inc_return(&req->num_in_acked) == req->num_in_map_entries) {
+		apply.request_id = req->request_id;
+		/*
+		 * take mutex to ensure that another thread does
+		 * not flush the request while this
+		 * thread is submitting it to h/w. The submit to
+		 * h/w and adding to the active list should happen
+		 * in a critical section which is provided by this
+		 * mutex.
+		 */
+		if ((status == CAM_SYNC_STATE_SIGNALED_ERROR) ||
+			(status == CAM_SYNC_STATE_SIGNALED_CANCEL)) {
+			CAM_DBG(CAM_CTXT, "fence error: %d on obj %d",
+				status, sync_obj);
+			flush_cmd.req_id = req->request_id;
+			flush_args.cmd = &flush_cmd;
+			flush_args.flush_active_req = false;
+			cam_context_flush_req_to_hw(ctx, &flush_args);
+		}
+
+		mutex_lock(&ctx->sync_mutex);
+		if (!req->flushed) {
+			cam_context_apply_req_to_hw(req, &apply);
+			mutex_unlock(&ctx->sync_mutex);
+		} else {
+			req->flushed = 0;
+			req->ctx = NULL;
+			mutex_unlock(&ctx->sync_mutex);
+			spin_lock(&ctx->lock);
+			list_del_init(&req->list);
+			list_add_tail(&req->list, &ctx->free_req_list);
+			spin_unlock(&ctx->lock);
+
+			if (cam_debug_ctx_req_list & ctx->dev_id)
+				CAM_INFO(CAM_CTXT,
+					"[%s][%d] : Moving req[%llu] from pending_list to free_list",
+					ctx->dev_name, ctx->ctx_id,
+					req->request_id);
+		}
+	}
+	cam_context_putref(ctx);
+}
+
+int32_t cam_context_release_dev_to_hw(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	struct cam_hw_release_args arg;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid input param");
+		return -EINVAL;
+	}
+
+	if ((!ctx->hw_mgr_intf) || (!ctx->hw_mgr_intf->hw_release)) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EINVAL;
+	}
+
+	arg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	arg.active_req = false;
+
+	ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv, &arg);
+	cam_context_free_mem_hw_entries(ctx);
+	ctx->ctxt_to_hw_map = NULL;
+
+	ctx->session_hdl = -1;
+	ctx->dev_hdl = -1;
+	ctx->link_hdl = -1;
+
+	return 0;
+}
+
+int32_t cam_context_config_dev_to_hw(
+	struct cam_context *ctx, struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	size_t len;
+	struct cam_hw_stream_setttings cfg;
+	uintptr_t packet_addr;
+	struct cam_packet *packet;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		return -EINVAL;
+	}
+
+	if (!ctx->hw_mgr_intf->hw_config_stream_settings) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		return rc;
+	}
+
+	rc = cam_context_validate_thread();
+	if (rc) {
+		CAM_ERR(CAM_CTXT,
+			"Not executing in the right context");
+		return rc;
+	}
+
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] Can not get packet address",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	packet = (struct cam_packet *) ((uint8_t *)packet_addr +
+		(uint32_t)cmd->offset);
+
+	cfg.packet = packet;
+	cfg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	cfg.priv = NULL;
+
+	CAM_DBG(CAM_CTXT, "Processing config settings");
+	rc = ctx->hw_mgr_intf->hw_config_stream_settings(
+		ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc) {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] Config failed stream settings",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+	}
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+}
+
+int32_t cam_context_prepare_dev_to_hw(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_ctx_request *req = NULL;
+	struct cam_hw_prepare_update_args cfg;
+	struct cam_packet *packet;
+	size_t remain_len = 0;
+	int32_t i = 0, j = 0;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		return -EINVAL;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EFAULT;
+	}
+	rc = cam_context_validate_thread();
+	if (rc)
+		return rc;
+
+	spin_lock(&ctx->lock);
+	if (!list_empty(&ctx->free_req_list)) {
+		req = list_first_entry(&ctx->free_req_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+	}
+	spin_unlock(&ctx->lock);
+
+	if (!req) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] No more request obj free",
+			ctx->dev_name, ctx->ctx_id);
+		return -ENOMEM;
+	}
+
+	INIT_LIST_HEAD(&req->buf_tracker);
+	INIT_LIST_HEAD(&req->list);
+	req->ctx = ctx;
+	req->num_hw_update_entries  = 0;
+	req->num_in_map_entries     = 0;
+	req->num_out_map_entries    = 0;
+	req->num_out_acked          = 0;
+	req->flushed                = 0;
+	atomic_set(&req->num_in_acked, 0);
+
+	remain_len = cam_context_parse_config_cmd(ctx, cmd, &packet);
+	if (IS_ERR(packet)) {
+		rc = PTR_ERR(packet);
+		goto free_req;
+	}
+
+	if (packet->header.request_id <= ctx->last_flush_req) {
+		CAM_INFO(CAM_CORE,
+			"request %lld has been flushed, reject packet",
+			packet->header.request_id);
+		rc = -EBADR;
+		goto free_req;
+	}
+
+	if (packet->header.request_id > ctx->last_flush_req)
+		ctx->last_flush_req = 0;
+
+	/* preprocess the configuration */
+	cfg.packet = packet;
+	cfg.remain_len = remain_len;
+	cfg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	cfg.max_hw_update_entries = ctx->max_hw_update_entries;
+	cfg.num_hw_update_entries = req->num_hw_update_entries;
+	cfg.hw_update_entries = req->hw_update_entries;
+	cfg.max_out_map_entries = ctx->max_out_map_entries;
+	cfg.out_map_entries = req->out_map_entries;
+	cfg.max_in_map_entries = ctx->max_in_map_entries;
+	cfg.in_map_entries = req->in_map_entries;
+	cfg.pf_data = &(req->pf_data);
+	cfg.priv = req->req_priv;
+	cfg.num_in_map_entries = 0;
+	cfg.num_out_map_entries = 0;
+	cfg.buf_tracker = &req->buf_tracker;
+	memset(req->out_map_entries, 0, sizeof(struct cam_hw_fence_map_entry)
+		* ctx->max_out_map_entries);
+
+	rc = ctx->hw_mgr_intf->hw_prepare_update(
+		ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc != 0) {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] Prepare config packet failed in HW layer",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto free_req;
+	}
+
+	req->num_hw_update_entries = cfg.num_hw_update_entries;
+	req->num_out_map_entries = cfg.num_out_map_entries;
+	req->num_in_map_entries = cfg.num_in_map_entries;
+	atomic_set(&req->num_in_acked, 0);
+	req->request_id = packet->header.request_id;
+	req->status = 1;
+	req->req_priv = cfg.priv;
+	req->pf_data.packet_handle = cmd->packet_handle;
+	req->pf_data.packet_offset = cmd->offset;
+	req->pf_data.req = req;
+
+	for (i = 0; i < req->num_out_map_entries; i++) {
+		rc = cam_sync_get_obj_ref(req->out_map_entries[i].sync_id);
+		if (rc) {
+			CAM_ERR(CAM_CTXT, "Can't get ref for sync %d",
+				req->out_map_entries[i].sync_id);
+			goto put_ref;
+		}
+	}
+
+	spin_lock(&ctx->lock);
+	list_add_tail(&req->list, &ctx->pending_req_list);
+	spin_unlock(&ctx->lock);
+	if (cam_debug_ctx_req_list & ctx->dev_id)
+		CAM_INFO(CAM_CTXT,
+			"[%s][%d] : Moving req[%llu] from free_list to pending_list",
+			ctx->dev_name, ctx->ctx_id, req->request_id);
+
+	if (req->num_in_map_entries > 0) {
+		for (j = 0; j < req->num_in_map_entries; j++) {
+			rc = cam_sync_check_valid(
+				req->in_map_entries[j].sync_id);
+			if (rc) {
+				spin_lock(&ctx->lock);
+				list_del_init(&req->list);
+				spin_unlock(&ctx->lock);
+				CAM_ERR(CAM_CTXT,
+					"invalid in map sync object %d",
+					req->in_map_entries[j].sync_id);
+				goto put_ref;
+			}
+		}
+
+		for (j = 0; j < req->num_in_map_entries; j++) {
+			cam_context_getref(ctx);
+			rc = cam_sync_register_callback(
+					cam_context_sync_callback,
+					(void *)req,
+					req->in_map_entries[j].sync_id);
+			if (rc) {
+				CAM_ERR(CAM_CTXT,
+					"[%s][%d] Failed register fence cb: %d ret = %d",
+					ctx->dev_name, ctx->ctx_id,
+					req->in_map_entries[j].sync_id, rc);
+				spin_lock(&ctx->lock);
+				list_del_init(&req->list);
+				spin_unlock(&ctx->lock);
+
+				if (cam_debug_ctx_req_list & ctx->dev_id)
+					CAM_INFO(CAM_CTXT,
+						"[%s][%d] : Moving req[%llu] from pending_list to free_list",
+						ctx->dev_name, ctx->ctx_id,
+						req->request_id);
+
+				cam_context_putref(ctx);
+				goto put_ref;
+			}
+			CAM_DBG(CAM_CTXT, "register in fence cb: %d ret = %d",
+				req->in_map_entries[j].sync_id, rc);
+		}
+	} else {
+		struct cam_req_mgr_apply_request apply;
+
+		/* If there are no input fences submit request immediately */
+		apply.request_id = req->request_id;
+		mutex_lock(&ctx->sync_mutex);
+		rc = cam_context_apply_req_to_hw(req, &apply);
+		mutex_unlock(&ctx->sync_mutex);
+		if (rc)
+			CAM_ERR(CAM_CTXT,
+				"[%s][%d] : Failed to apply req: %llu with no input dependencies",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+	}
+
+	return rc;
+put_ref:
+	for (--i; i >= 0; i--) {
+		if (cam_sync_put_obj_ref(req->out_map_entries[i].sync_id))
+			CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d",
+				req->out_map_entries[i].sync_id);
+	}
+free_req:
+	cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+	spin_lock(&ctx->lock);
+	list_add_tail(&req->list, &ctx->free_req_list);
+	req->ctx = NULL;
+	spin_unlock(&ctx->lock);
+
+	return rc;
+}
+
+int32_t cam_context_acquire_dev_to_hw(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_hw_acquire_args param;
+	struct cam_create_dev_hdl req_hdl_param;
+	struct cam_hw_release_args release;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_CTXT, "ses hdl: %x, num_res: %d, type: %d, res: %lld",
+		cmd->session_handle, cmd->num_resources, cmd->handle_type,
+		cmd->resource_hdl);
+
+	if (cmd->num_resources > CAM_CTX_RES_MAX) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] resource[%d] limit exceeded",
+			ctx->dev_name, ctx->ctx_id, cmd->num_resources);
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	/* for now we only support user pointer */
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_CTXT, "[%s][%d] Only user pointer is supported",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* fill in parameters */
+	param.context_data = ctx;
+	param.ctx_id = ctx->ctx_id;
+	param.event_cb = ctx->irq_cb_intf;
+	param.mini_dump_cb = ctx->mini_dump_cb;
+	param.num_acq = cmd->num_resources;
+	param.acquire_info = cmd->resource_hdl;
+
+	/* Allocate memory for hw and map entries */
+	rc = cam_context_allocate_mem_hw_entries(ctx);
+
+	if (rc != 0) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] Alloc entries failed",
+			ctx->dev_name, ctx->ctx_id);
+		goto end;
+	}
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] Acquire device failed session hdl: 0x%x dev hdl: 0x%x",
+			ctx->dev_name, ctx->ctx_id, ctx->session_hdl, ctx->dev_hdl);
+		goto end;
+	}
+
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+	ctx->hw_mgr_ctx_id = param.hw_mgr_ctx_id;
+
+	snprintf(ctx->ctx_id_string, sizeof(ctx->ctx_id_string),
+		"%s_ctx[%d]_hwmgrctx[%d]_Done",
+		ctx->dev_name,
+		ctx->ctx_id,
+		ctx->hw_mgr_ctx_id);
+
+	/* if hw resource acquire successful, acquire dev handle */
+	req_hdl_param.session_hdl = cmd->session_handle;
+	/* bridge is not ready for these flags. so false for now */
+	req_hdl_param.v4l2_sub_dev_flag = 0;
+	req_hdl_param.media_entity_flag = 0;
+	req_hdl_param.priv = ctx;
+	req_hdl_param.ops = ctx->crm_ctx_intf;
+	req_hdl_param.dev_id = ctx->dev_id;
+	ctx->dev_hdl = cam_create_device_hdl(&req_hdl_param);
+	if (ctx->dev_hdl <= 0) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_CTXT, "[%s][%d] Can not create device handle",
+			ctx->dev_name, ctx->ctx_id);
+		goto free_hw;
+	}
+	cmd->dev_handle = ctx->dev_hdl;
+
+	/* store session information */
+	ctx->session_hdl = cmd->session_handle;
+
+	CAM_TRACE(CAM_CTXT, "Ctx[%s]: session_hdl 0x%x, dev_hdl 0x%x",
+		ctx->ctx_id_string, ctx->session_hdl, ctx->dev_hdl);
+
+	return rc;
+
+free_hw:
+	release.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv, &release);
+	ctx->ctxt_to_hw_map = NULL;
+	ctx->dev_hdl = -1;
+end:
+	return rc;
+}
+
+int32_t cam_context_flush_ctx_to_hw(struct cam_context *ctx)
+{
+	struct cam_hw_flush_args flush_args = {0};
+	struct list_head temp_list;
+	struct list_head *list;
+	struct cam_ctx_request *req;
+	uint32_t i, num_entries = 0;
+	int rc = 0;
+	bool free_req;
+
+	CAM_DBG(CAM_CTXT, "[%s] E: NRT flush ctx", ctx->dev_name);
+
+	/*
+	 * flush pending requests, take the sync lock to synchronize with the
+	 * sync callback thread so that the sync cb thread does not try to
+	 * submit request to h/w while the request is being flushed
+	 */
+	mutex_lock(&ctx->sync_mutex);
+	INIT_LIST_HEAD(&temp_list);
+	spin_lock(&ctx->lock);
+	list_splice_init(&ctx->pending_req_list, &temp_list);
+	spin_unlock(&ctx->lock);
+
+	if (cam_debug_ctx_req_list & ctx->dev_id)
+		CAM_INFO(CAM_CTXT,
+			"[%s][%d] : Moving all pending requests from pending_list to temp_list",
+			ctx->dev_name, ctx->ctx_id);
+
+	flush_args.last_flush_req = ctx->last_flush_req;
+	list_for_each(list, &temp_list) {
+		num_entries++;
+	}
+	if (num_entries) {
+		flush_args.flush_req_pending =
+			kcalloc(num_entries, sizeof(void *), GFP_KERNEL);
+		if (!flush_args.flush_req_pending) {
+			CAM_ERR(CAM_CTXT, "[%s][%d] : Flush array memory alloc fail",
+				ctx->dev_name, ctx->ctx_id);
+			mutex_unlock(&ctx->sync_mutex);
+			rc = -ENOMEM;
+			goto end;
+		}
+	}
+
+	while (num_entries) {
+
+		if (list_empty(&temp_list))
+			break;
+
+		req = list_first_entry(&temp_list,
+				struct cam_ctx_request, list);
+
+		list_del_init(&req->list);
+		req->flushed = 1;
+
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		flush_args.flush_req_pending[flush_args.num_req_pending++] =
+			req->req_priv;
+
+		free_req = false;
+		for (i = 0; i < req->num_in_map_entries; i++) {
+			rc = cam_sync_deregister_callback(
+				cam_context_sync_callback,
+				(void *)req,
+				req->in_map_entries[i].sync_id);
+			if (!rc) {
+				cam_context_putref(ctx);
+				if (atomic_inc_return(&req->num_in_acked) ==
+					req->num_in_map_entries)
+					free_req = true;
+			}
+		}
+
+		for (i = 0; i < req->num_out_map_entries; i++) {
+			if (req->out_map_entries[i].sync_id != -1) {
+				rc = cam_sync_signal(
+					req->out_map_entries[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_FLUSH);
+				if (rc == -EALREADY) {
+					CAM_ERR(CAM_CTXT,
+					"Req: %llu already signalled, sync_id:%d",
+					req->request_id,
+					req->out_map_entries[i].sync_id);
+					break;
+				}
+			}
+		}
+
+		/*
+		 * If we have deregistered the last sync callback, req will
+		 * not be put on the free list. So put it on the free list here
+		 */
+		if (free_req) {
+			req->ctx = NULL;
+			spin_lock(&ctx->lock);
+			list_add_tail(&req->list, &ctx->free_req_list);
+			spin_unlock(&ctx->lock);
+		}
+
+		if (cam_debug_ctx_req_list & ctx->dev_id)
+			CAM_INFO(CAM_CTXT,
+				"[%s][%d] : Deleting req[%llu] from temp_list",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+	}
+	mutex_unlock(&ctx->sync_mutex);
+
+	if (ctx->hw_mgr_intf->hw_flush) {
+		num_entries = 0;
+
+		/*
+		 * Hold the ctx lock till the active requests are populated for
+		 * flush, allocate memory in atomic context. We want to ensure the
+		 * allocated memory is sufficient for the requests in the active list.
+		 * The active list should not be reinitialized since it is possible that
+		 * any buf done's from HW is serviced before the flush
+		 * makes it to the HW layer
+		 */
+		spin_lock(&ctx->lock);
+		list_for_each(list, &ctx->active_req_list)
+			num_entries++;
+
+		if (num_entries) {
+			flush_args.flush_req_active =
+				kcalloc(num_entries, sizeof(void *), GFP_ATOMIC);
+			if (!flush_args.flush_req_active) {
+				spin_unlock(&ctx->lock);
+				CAM_ERR(CAM_CTXT, "[%s][%d] : Flush array memory alloc fail",
+					ctx->dev_name, ctx->ctx_id);
+				rc = -ENOMEM;
+				goto end;
+			}
+
+			list_for_each_entry(req, &ctx->active_req_list, list) {
+				flush_args.flush_req_active[flush_args.num_req_active++] =
+					req->req_priv;
+			}
+		}
+		spin_unlock(&ctx->lock);
+
+		if (flush_args.num_req_pending || flush_args.num_req_active) {
+			flush_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+			flush_args.flush_type = CAM_FLUSH_TYPE_ALL;
+			ctx->hw_mgr_intf->hw_flush(
+				ctx->hw_mgr_intf->hw_mgr_priv, &flush_args);
+		}
+	}
+
+	INIT_LIST_HEAD(&temp_list);
+	spin_lock(&ctx->lock);
+	list_splice_init(&ctx->active_req_list, &temp_list);
+	spin_unlock(&ctx->lock);
+
+	if (cam_debug_ctx_req_list & ctx->dev_id)
+		CAM_INFO(CAM_CTXT,
+			"[%s][%d] : Moving all requests from active_list to temp_list",
+			ctx->dev_name, ctx->ctx_id);
+
+	while (num_entries) {
+
+		if (list_empty(&temp_list))
+			break;
+
+		req = list_first_entry(&temp_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		for (i = 0; i < req->num_out_map_entries; i++) {
+			if (req->out_map_entries[i].sync_id != -1) {
+				rc = cam_sync_signal(
+					req->out_map_entries[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_FLUSH);
+				if (rc == -EALREADY) {
+					CAM_ERR(CAM_CTXT,
+						"Req: %llu already signalled ctx: %pK dev_name: %s dev_handle: %d ctx_state: %d",
+						req->request_id, req->ctx,
+						req->ctx->dev_name,
+						req->ctx->dev_hdl,
+						req->ctx->state);
+					break;
+				}
+			}
+		}
+
+		req->ctx = NULL;
+		spin_lock(&ctx->lock);
+		list_add_tail(&req->list, &ctx->free_req_list);
+		spin_unlock(&ctx->lock);
+
+		if (cam_debug_ctx_req_list & ctx->dev_id)
+			CAM_INFO(CAM_CTXT,
+				"[%s][%d] : Moving req[%llu] from temp_list to free_list",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+	}
+
+	rc = 0;
+	CAM_DBG(CAM_CTXT, "[%s] X: NRT flush ctx", ctx->dev_name);
+
+end:
+	kfree(flush_args.flush_req_active);
+	kfree(flush_args.flush_req_pending);
+	return rc;
+}
+
+int32_t cam_context_flush_req_to_hw(struct cam_context *ctx,
+	struct cam_context_utils_flush_args *args)
+{
+	struct cam_ctx_request *req = NULL;
+	struct cam_hw_flush_args flush_args = {0};
+	struct cam_flush_dev_cmd *cmd = args->cmd;
+	uint32_t i = 0;
+	int32_t sync_id = 0;
+	int rc = 0;
+	bool free_req = false;
+
+	CAM_DBG(CAM_CTXT, "[%s] E: NRT flush req", ctx->dev_name);
+
+	flush_args.flush_req_pending = kzalloc(sizeof(void *), GFP_KERNEL);
+	if (!flush_args.flush_req_pending) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] : Flush array memory alloc fail",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -ENOMEM;
+		goto end;
+	}
+	mutex_lock(&ctx->sync_mutex);
+	spin_lock(&ctx->lock);
+	list_for_each_entry(req, &ctx->pending_req_list, list) {
+		if (req->request_id != cmd->req_id)
+			continue;
+
+		if (cam_debug_ctx_req_list & ctx->dev_id)
+			CAM_INFO(CAM_CTXT,
+				"[%s][%d] : Deleting req[%llu] from pending_list",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+
+		list_del_init(&req->list);
+		req->flushed = 1;
+
+		flush_args.flush_req_pending[flush_args.num_req_pending++] =
+			req->req_priv;
+		break;
+	}
+	spin_unlock(&ctx->lock);
+	mutex_unlock(&ctx->sync_mutex);
+
+	if (ctx->hw_mgr_intf->hw_flush) {
+		if (!flush_args.num_req_pending) {
+			flush_args.flush_req_active = kzalloc(sizeof(void *), GFP_KERNEL);
+			if (!flush_args.flush_req_active) {
+				CAM_ERR(CAM_CTXT, "[%s][%d] : Flush array memory alloc fail",
+					ctx->dev_name, ctx->ctx_id);
+				rc = -ENOMEM;
+				goto end;
+			}
+
+			spin_lock(&ctx->lock);
+			list_for_each_entry(req, &ctx->active_req_list, list) {
+				if (req->request_id != cmd->req_id)
+					continue;
+
+				if (!args->flush_active_req) {
+					CAM_ERR(CAM_CTXT,
+						"[%s][%d] : Flushing active request id: %llu is not supported",
+						ctx->dev_name, ctx->ctx_id, req->request_id);
+					rc = -EPERM;
+					spin_unlock(&ctx->lock);
+					goto end;
+				}
+
+				list_del_init(&req->list);
+				flush_args.flush_req_active[
+					flush_args.num_req_active++] =
+					req->req_priv;
+				break;
+			}
+			spin_unlock(&ctx->lock);
+		}
+
+		if (flush_args.num_req_pending || flush_args.num_req_active) {
+			flush_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+			flush_args.flush_type = CAM_FLUSH_TYPE_REQ;
+			ctx->hw_mgr_intf->hw_flush(
+				ctx->hw_mgr_intf->hw_mgr_priv, &flush_args);
+		}
+	}
+
+	if (req) {
+		if (flush_args.num_req_pending) {
+			for (i = 0; i < req->num_in_map_entries; i++) {
+				rc = cam_sync_deregister_callback(
+					cam_context_sync_callback,
+					(void *)req,
+					req->in_map_entries[i].sync_id);
+				if (rc)
+					continue;
+
+				cam_context_putref(ctx);
+				if (atomic_inc_return(&req->num_in_acked) ==
+					req->num_in_map_entries)
+					free_req = true;
+			}
+		}
+
+		if (flush_args.num_req_pending || flush_args.num_req_active) {
+			cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+
+			for (i = 0; i < req->num_out_map_entries; i++) {
+				sync_id =
+					req->out_map_entries[i].sync_id;
+				if (sync_id != -1) {
+					rc = cam_sync_signal(sync_id,
+						CAM_SYNC_STATE_SIGNALED_CANCEL,
+						CAM_SYNC_COMMON_EVENT_FLUSH);
+					if (rc == -EALREADY) {
+						CAM_ERR(CAM_CTXT,
+						"Req: %llu already signalled, sync_id:%d",
+						req->request_id, sync_id);
+						break;
+					}
+				}
+			}
+			if (flush_args.num_req_active || free_req) {
+				req->ctx = NULL;
+				spin_lock(&ctx->lock);
+				list_add_tail(&req->list, &ctx->free_req_list);
+				spin_unlock(&ctx->lock);
+
+				if (cam_debug_ctx_req_list & ctx->dev_id)
+					CAM_INFO(CAM_CTXT,
+						"[%s][%d] : Moving req[%llu] from %s to free_list",
+						ctx->dev_name, ctx->ctx_id,
+						req->request_id,
+						flush_args.num_req_active ?
+							"active_list" :
+							"pending_list");
+			}
+		}
+
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] : No pending or active request to flush for req id: %llu",
+			ctx->dev_name, ctx->ctx_id, cmd->req_id);
+		rc = -EINVAL;
+	}
+
+	CAM_DBG(CAM_CTXT, "[%s] X: NRT flush req", ctx->dev_name);
+
+end:
+	kfree(flush_args.flush_req_active);
+	kfree(flush_args.flush_req_pending);
+	return rc;
+}
+
+int32_t cam_context_flush_dev_to_hw(struct cam_context *ctx,
+	struct cam_context_utils_flush_args *flush_args)
+{
+	int rc = 0;
+
+	if (!ctx || !flush_args) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, flush_args);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (flush_args->cmd->flush_type == CAM_FLUSH_TYPE_ALL) {
+		ctx->last_flush_req = flush_args->cmd->req_id;
+		rc = cam_context_flush_ctx_to_hw(ctx);
+	} else if (flush_args->cmd->flush_type == CAM_FLUSH_TYPE_REQ)
+		rc = cam_context_flush_req_to_hw(ctx, flush_args);
+	else {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CORE, "[%s][%d] Invalid flush type %d",
+			ctx->dev_name, ctx->ctx_id, flush_args->cmd->flush_type);
+	}
+
+end:
+	return rc;
+}
+
+int32_t cam_context_start_dev_to_hw(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_hw_start_args arg;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if ((cmd->session_handle != ctx->session_hdl) ||
+		(cmd->dev_handle != ctx->dev_hdl)) {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] Invalid session hdl[%d], dev_handle[%d]",
+			ctx->dev_name, ctx->ctx_id,
+			cmd->session_handle, cmd->dev_handle);
+		rc = -EPERM;
+		goto end;
+	}
+
+	if (ctx->hw_mgr_intf->hw_start) {
+		arg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		rc = ctx->hw_mgr_intf->hw_start(ctx->hw_mgr_intf->hw_mgr_priv,
+				&arg);
+		if (rc) {
+			/* HW failure. user need to clean up the resource */
+			CAM_ERR(CAM_CTXT, "[%s][%d] Start HW failed",
+				ctx->dev_name, ctx->ctx_id);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+int32_t cam_context_stop_dev_to_hw(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_hw_stop_args stop;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid input param");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_context_validate_thread();
+	if (rc)
+		goto end;
+
+	rc = cam_context_flush_ctx_to_hw(ctx);
+	if (rc)
+		goto end;
+
+	/* stop hw first */
+	if (ctx->hw_mgr_intf->hw_stop) {
+		stop.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		ctx->hw_mgr_intf->hw_stop(ctx->hw_mgr_intf->hw_mgr_priv,
+			&stop);
+	}
+
+end:
+	return rc;
+}
+
+static void cam_context_util_translate_pf_info_to_string(struct cam_req_mgr_pf_err_msg *pf_msg,
+	char **pf_evt_str, char **pf_type_str, char **pf_stage_str)
+{
+	switch (pf_msg->pf_evt) {
+	case CAM_REQ_MGR_PF_EVT_BUF_NOT_FOUND:
+		*pf_evt_str = "PF Evt: faulting buffer not found";
+		break;
+	case CAM_REQ_MGR_PF_EVT_BUF_FOUND_IO_CFG:
+		*pf_evt_str = "PF Evt: faulting IO Config buffer";
+		break;
+	case CAM_REQ_MGR_PF_EVT_BUF_FOUND_REF_BUF:
+		*pf_evt_str = "PF Evt: faulting Ref buffer";
+		break;
+	case CAM_REQ_MGR_PF_EVT_BUF_FOUND_CDM:
+		*pf_evt_str = "PF Evt: faulting CDM buffer";
+		break;
+	case CAM_REQ_MGR_PF_EVT_BUF_FOUND_SHARED:
+		*pf_evt_str = "PF Evt: faulting shared memory buffer";
+		break;
+	default:
+		CAM_ERR(CAM_CTXT, "Invalid PF Evt %u", pf_msg->pf_evt);
+		*pf_evt_str = "PF Evt: Unknown";
+	}
+
+	switch (pf_msg->pf_type) {
+	case CAM_REQ_MGR_PF_TYPE_NULL:
+		*pf_type_str = "PF Type: faulting addr is NULL";
+		break;
+	case CAM_REQ_MGR_PF_TYPE_OUT_OF_BOUND:
+		*pf_type_str = "PF Type: faulting addr out of bounds";
+		break;
+	case CAM_REQ_MGR_PF_TYPE_MAPPED_REGION:
+		*pf_type_str = "PF Type: faulting addr within mapped region";
+		break;
+	default:
+		CAM_ERR(CAM_CTXT, "Invalid PF Type %u", pf_msg->pf_type);
+		*pf_type_str = "PF Type: Unknown";
+	}
+
+	switch (pf_msg->pf_stage) {
+	case CAM_REQ_MGR_STAGE1_FAULT:
+		*pf_stage_str = "PF Stage: stage 1 (non-secure)";
+		break;
+	case CAM_REQ_MGR_STAGE2_FAULT:
+		*pf_stage_str = "PF Stage: stage 2 (secure)";
+		break;
+	default:
+		CAM_ERR(CAM_CTXT, "Invalid PF Stage %u", pf_msg->pf_stage);
+		*pf_stage_str = "PF Stage: Unknown";
+	}
+}
+
+static void cam_context_get_pf_evt(struct cam_context *ctx,
+	struct cam_context_pf_info  *pf_context_info, struct cam_req_mgr_pf_err_msg *pf_msg,
+	char *log_info, size_t *len, uint32_t buf_size)
+{
+	if (pf_context_info->mem_type != CAM_FAULT_BUF_NOT_FOUND) {
+		pf_msg->buf_hdl = pf_context_info->buf_hdl;
+		pf_msg->offset = pf_context_info->offset;
+		pf_msg->far_delta = pf_context_info->delta;
+		pf_msg->req_id = pf_context_info->req_id;
+
+		CAM_ERR_BUF(CAM_CTXT, log_info, buf_size, len,
+			"buf_hdl: 0x%x, offset: 0x%x, req_id: %llu, delta: 0x%llx",
+			pf_msg->buf_hdl, pf_msg->offset, pf_msg->req_id,
+			pf_msg->far_delta);
+
+		if (pf_context_info->mem_type == CAM_FAULT_PATCH_BUF) {
+			pf_msg->patch_id = pf_context_info->patch_idx;
+			if (pf_context_info->mem_flag & CAM_MEM_FLAG_CMD_BUF_TYPE)
+				pf_msg->pf_evt = CAM_REQ_MGR_PF_EVT_BUF_FOUND_CDM;
+			else if (pf_context_info->mem_flag & CAM_MEM_FLAG_HW_SHARED_ACCESS)
+				pf_msg->pf_evt = CAM_REQ_MGR_PF_EVT_BUF_FOUND_SHARED;
+			else
+				pf_msg->pf_evt = CAM_REQ_MGR_PF_EVT_BUF_FOUND_REF_BUF;
+
+			CAM_ERR_BUF(CAM_CTXT, log_info, buf_size, len,
+				"Faulted patch found in patch index: %u",
+				pf_msg->patch_id);
+		} else
+			pf_msg->pf_evt = CAM_REQ_MGR_PF_EVT_BUF_FOUND_IO_CFG;
+
+	} else
+		pf_msg->pf_evt = CAM_REQ_MGR_PF_EVT_BUF_NOT_FOUND;
+
+}
+
+int32_t cam_context_send_pf_evt(struct cam_context *ctx,
+	struct cam_hw_dump_pf_args *pf_args)
+{
+	struct cam_req_mgr_message           req_msg = {0};
+	struct cam_req_mgr_pf_err_msg       *pf_msg = &req_msg.u.pf_err_msg;
+	struct cam_context_pf_info          *pf_context_info;
+	struct cam_smmu_pf_info             *pf_smmu_info;
+	char log_info[512];
+	int rc = 0;
+	size_t buf_size = 0, len = 0;
+	char *pf_evt_str, *pf_type_str, *pf_stage_str;
+
+	if (!pf_args) {
+		CAM_ERR(CAM_CTXT, "Invalid input PF args");
+		return -EINVAL;
+	}
+
+	buf_size = sizeof(log_info);
+	pf_msg->pf_evt = CAM_REQ_MGR_PF_EVT_BUF_NOT_FOUND;
+	pf_context_info = &(pf_args->pf_context_info);
+	pf_smmu_info = pf_args->pf_smmu_info;
+
+	if (ctx) {
+		req_msg.session_hdl = ctx->session_hdl;
+		pf_msg->device_hdl = ctx->dev_hdl;
+		pf_msg->link_hdl = ctx->link_hdl;
+		pf_msg->port_id = pf_context_info->resource_type;
+
+		CAM_ERR_BUF(CAM_CTXT, log_info, buf_size, &len,
+			"Faulted ctx: [%s][%d] session_hdl: 0x%x, device_hdl: 0x%x, link_hdl: 0x%x, port_id: 0x%x",
+			ctx->dev_name, ctx->ctx_id, req_msg.session_hdl, pf_msg->device_hdl,
+			pf_msg->link_hdl, pf_msg->port_id);
+
+		cam_context_get_pf_evt(ctx, pf_context_info, pf_msg, log_info, &len, buf_size);
+	} else
+		CAM_ERR_BUF(CAM_CTXT, log_info, buf_size, &len, "Faulted ctx NOT found");
+
+	if (pf_smmu_info->iova == 0)
+		pf_msg->pf_type = CAM_REQ_MGR_PF_TYPE_NULL;
+	else if (pf_smmu_info->in_map_region)
+		pf_msg->pf_type = CAM_REQ_MGR_PF_TYPE_MAPPED_REGION;
+	else
+		pf_msg->pf_type = CAM_REQ_MGR_PF_TYPE_OUT_OF_BOUND;
+
+	pf_msg->pf_stage = pf_smmu_info->is_secure;
+	pf_msg->bid = pf_smmu_info->bid;
+	pf_msg->pid = pf_smmu_info->pid;
+	pf_msg->mid = pf_smmu_info->mid;
+
+	cam_context_util_translate_pf_info_to_string(pf_msg, &pf_evt_str,
+		&pf_type_str, &pf_stage_str);
+
+	CAM_ERR_BUF(CAM_CTXT, log_info, buf_size, &len,
+		"%s, %s, %s",
+		pf_evt_str, pf_type_str, pf_stage_str);
+
+	CAM_ERR_BUF(CAM_CTXT, log_info, buf_size, &len,
+		"bid: %u, pid: %u, mid: %u",
+		pf_msg->bid, pf_msg->pid, pf_msg->mid);
+
+	CAM_ERR(CAM_CTXT, "PF INFO: %s", log_info);
+
+	rc = cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_PF_ERROR,
+		V4L_EVENT_CAM_REQ_MGR_EVENT);
+
+	return rc;
+}
+
+int32_t cam_context_dump_pf_info_to_hw(struct cam_context *ctx,
+	struct cam_hw_dump_pf_args *pf_args,
+	struct cam_hw_mgr_pf_request_info *pf_req_info)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args cmd_args;
+	struct cam_hw_cmd_pf_args pf_cmd_args;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK ", ctx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (ctx->hw_mgr_intf->hw_cmd) {
+		pf_cmd_args.pf_args = pf_args;
+		pf_cmd_args.pf_req_info = pf_req_info;
+		cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		cmd_args.cmd_type = CAM_HW_MGR_CMD_DUMP_PF_INFO;
+		cmd_args.u.pf_cmd_args = &pf_cmd_args;
+		ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&cmd_args);
+	}
+
+end:
+	return rc;
+}
+
+int32_t cam_context_dump_hw_acq_info(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args cmd_args;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid input params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (ctx->hw_mgr_intf->hw_cmd) {
+		cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		cmd_args.cmd_type = CAM_HW_MGR_CMD_DUMP_ACQ_INFO;
+		ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&cmd_args);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_context_dump_data_validaion(void *src, void *dest,
+		uint32_t base_len, uint32_t actual_len, uint32_t bytes_required)
+{
+	if (base_len + bytes_required >= actual_len) {
+		CAM_ERR(CAM_CTXT, "actual len %pK base len %pK",
+			actual_len, base_len);
+		return -ENOSPC;
+	}
+	memcpy(dest, src, bytes_required);
+	return 0;
+}
+
+static int cam_context_stream_dump_validation(struct cam_context *ctx,
+	uint64_t *addr, uint32_t local_len, uint32_t buf_len)
+{
+	struct cam_context_stream_dump   stream_dump;
+
+	stream_dump.hw_mgr_ctx_id =  ctx->hw_mgr_ctx_id;
+	stream_dump.dev_id =         ctx->dev_id;
+	stream_dump.dev_hdl =        ctx->dev_hdl;
+	stream_dump.link_hdl =       ctx->link_hdl;
+	stream_dump.session_hdl =    ctx->session_hdl;
+	stream_dump.refcount    =    refcount_read(&(ctx->refcount.refcount));
+	stream_dump.last_flush_req = ctx->last_flush_req;
+	stream_dump.state =          ctx->state;
+	if (cam_context_dump_data_validaion(&stream_dump, addr,
+		local_len, buf_len,
+		sizeof(struct cam_context_stream_dump))) {
+		CAM_WARN(CAM_CTXT, "failed to copy the stream info");
+		return -ENOSPC;
+	}
+	return 0;
+}
+
+static int cam_context_user_dump(struct cam_context *ctx,
+	struct cam_hw_dump_args *dump_args)
+{
+	int                              rc, i;
+	struct cam_ctx_request          *req = NULL, *req_temp;
+	struct cam_context_dump_header  *hdr;
+	uint8_t                         *dst;
+	uint64_t                        *addr, *start;
+	size_t                           buf_len, remain_len;
+	uintptr_t                        cpu_addr;
+	uint32_t                         local_len;
+
+	if (!ctx || !dump_args) {
+		CAM_ERR(CAM_CORE, "Invalid parameters %pK %pK",
+			ctx, dump_args);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&cpu_addr, &buf_len);
+
+	if (rc) {
+		CAM_ERR(CAM_CTXT, "Invalid hdl %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+
+	if (dump_args->offset >= buf_len) {
+		CAM_WARN(CAM_CTXT, "dump buffer overshoot offset %zu len %zu",
+			dump_args->offset, buf_len);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	/* Dump context info */
+	remain_len = buf_len - dump_args->offset;
+	if (remain_len < sizeof(struct cam_context_dump_header)) {
+		CAM_WARN(CAM_CTXT,
+			"No sufficient space in dump buffer for headers, remain buf size: %d, header size: %d",
+			remain_len, sizeof(struct cam_context_dump_header));
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)cpu_addr + dump_args->offset;
+	hdr = (struct cam_context_dump_header *)dst;
+	local_len =
+		(dump_args->offset + sizeof(struct cam_context_dump_header));
+	scnprintf(hdr->tag, CAM_CTXT_DUMP_TAG_MAX_LEN,
+		"%s_CTX_INFO:", ctx->dev_name);
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_context_dump_header));
+	start = addr;
+	if (cam_context_stream_dump_validation(ctx, addr, local_len, buf_len)) {
+		CAM_WARN(CAM_CTXT, "%s_CTX_INFO failed to copy the stream info ", ctx->dev_name);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+	addr = addr + sizeof(struct cam_context_stream_dump);
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_context_dump_header);
+
+	/* Dump waiting requests */
+	if (!list_empty(&ctx->wait_req_list)) {
+		list_for_each_entry_safe(req, req_temp, &ctx->wait_req_list, list) {
+			for (i = 0; i < req->num_out_map_entries; i++) {
+				remain_len = buf_len - dump_args->offset;
+				if (remain_len < sizeof(struct cam_context_dump_header)) {
+					CAM_WARN(CAM_CTXT,
+						"No sufficient space in dump buffer for headers, remain buf size: %d, header size: %d",
+						remain_len, sizeof(struct cam_context_dump_header));
+					cam_mem_put_cpu_buf(dump_args->buf_handle);
+					return -ENOSPC;
+				}
+
+				dst = (uint8_t *)cpu_addr + dump_args->offset;
+				hdr = (struct cam_context_dump_header *)dst;
+				local_len = dump_args->offset +
+					sizeof(struct cam_context_dump_header);
+				scnprintf(hdr->tag, CAM_CTXT_DUMP_TAG_MAX_LEN,
+					"%s_OUT_FENCE_REQUEST_APPLIED.%d.%d.%d:",
+					ctx->dev_name,
+					req->out_map_entries[i].resource_handle,
+					&(req->out_map_entries[i].image_buf_addr),
+					req->out_map_entries[i].sync_id);
+				hdr->word_size = sizeof(uint64_t);
+				addr = (uint64_t *)(dst + sizeof(struct cam_context_dump_header));
+				start = addr;
+				if (cam_context_dump_data_validaion(&req->request_id, addr,
+					local_len, buf_len,
+					sizeof(struct cam_context_each_req_info))) {
+					CAM_WARN(CAM_CTXT, "%s_CTX_INFO waiting_req: failed to copy the request info",
+						ctx->dev_name);
+					goto cleanup;
+				}
+				addr = addr + sizeof(struct cam_context_each_req_info);
+				hdr->size = hdr->word_size * (addr - start);
+				dump_args->offset += hdr->size +
+					sizeof(struct cam_context_dump_header);
+			}
+		}
+	}
+
+	/* Dump pending requests */
+	if (!list_empty(&ctx->pending_req_list)) {
+		list_for_each_entry_safe(req, req_temp, &ctx->pending_req_list, list) {
+			for (i = 0; i < req->num_out_map_entries; i++) {
+				remain_len = buf_len - dump_args->offset;
+				if (remain_len < sizeof(struct cam_context_dump_header)) {
+					CAM_WARN(CAM_CTXT,
+						"No sufficient space in dump buffer for headers, remain buf size: %d, header size: %d",
+						remain_len, sizeof(struct cam_context_dump_header));
+					cam_mem_put_cpu_buf(dump_args->buf_handle);
+					return -ENOSPC;
+				}
+
+				dst = (uint8_t *)cpu_addr + dump_args->offset;
+				hdr = (struct cam_context_dump_header *)dst;
+				local_len = dump_args->offset +
+					sizeof(struct cam_context_dump_header);
+				scnprintf(hdr->tag, CAM_CTXT_DUMP_TAG_MAX_LEN,
+					"%s_OUT_FENCE_REQUEST_PENDING.%d.%d.%d:",
+					ctx->dev_name,
+					req->out_map_entries[i].resource_handle,
+					&(req->out_map_entries[i].image_buf_addr),
+					req->out_map_entries[i].sync_id);
+				hdr->word_size = sizeof(uint64_t);
+				addr = (uint64_t *)(dst + sizeof(struct cam_context_dump_header));
+				start = addr;
+				if (cam_context_dump_data_validaion(&req->request_id, addr,
+					local_len, buf_len,
+					sizeof(struct cam_context_each_req_info))) {
+					CAM_WARN(CAM_CTXT, "%s_CTX_INFO pending_req: failed to copy the request info",
+						ctx->dev_name);
+					goto cleanup;
+				}
+				addr = addr + sizeof(struct cam_context_each_req_info);
+				hdr->size = hdr->word_size * (addr - start);
+				dump_args->offset += hdr->size +
+					sizeof(struct cam_context_dump_header);
+			}
+		}
+	}
+
+	/* Dump active requests */
+	if (!list_empty(&ctx->active_req_list)) {
+		list_for_each_entry_safe(req, req_temp, &ctx->active_req_list, list) {
+			for (i = 0; i < req->num_out_map_entries; i++) {
+				remain_len = buf_len - dump_args->offset;
+				if (remain_len < sizeof(struct cam_context_dump_header)) {
+					CAM_WARN(CAM_CTXT,
+						"No sufficient space in dump buffer for headers, remain buf size: %d, header size: %d",
+						remain_len, sizeof(struct cam_context_dump_header));
+					cam_mem_put_cpu_buf(dump_args->buf_handle);
+					return -ENOSPC;
+				}
+
+				dst = (uint8_t *)cpu_addr + dump_args->offset;
+				hdr = (struct cam_context_dump_header *)dst;
+				local_len = dump_args->offset +
+					sizeof(struct cam_context_dump_header);
+				scnprintf(hdr->tag, CAM_CTXT_DUMP_TAG_MAX_LEN,
+					"%s_OUT_FENCE_REQUEST_ACTIVE.%d.%d.%d:",
+					ctx->dev_name,
+					req->out_map_entries[i].resource_handle,
+					&(req->out_map_entries[i].image_buf_addr),
+					req->out_map_entries[i].sync_id);
+				hdr->word_size = sizeof(uint64_t);
+				addr = (uint64_t *)(dst + sizeof(struct cam_context_dump_header));
+				start = addr;
+				if (cam_context_dump_data_validaion(&req->request_id, addr,
+					local_len, buf_len,
+					sizeof(struct cam_context_each_req_info))) {
+					CAM_WARN(CAM_CTXT, "%s_CTX_INFO active_req: failed to copy the request info",
+						ctx->dev_name);
+					goto cleanup;
+				}
+				addr = addr + sizeof(struct cam_context_each_req_info);
+				hdr->size = hdr->word_size * (addr - start);
+				dump_args->offset += hdr->size +
+					sizeof(struct cam_context_dump_header);
+			}
+		}
+	}
+cleanup:
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return 0;
+}
+
+int32_t cam_context_dump_dev_to_hw(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int                     rc = 0;
+	struct cam_hw_dump_args dump_args;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		return -EINVAL;
+	}
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EFAULT;
+	}
+
+	if (ctx->hw_mgr_intf->hw_dump) {
+		dump_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		dump_args.buf_handle = cmd->buf_handle;
+		dump_args.offset = cmd->offset;
+		dump_args.request_id = cmd->issue_req_id;
+		dump_args.error_type = cmd->error_type;
+
+		rc = cam_context_user_dump(ctx, &dump_args);
+		if (rc) {
+			CAM_ERR(CAM_CTXT, "[%s][%d] handle[%u] failed",
+				ctx->dev_name, ctx->ctx_id, dump_args.buf_handle);
+			return rc;
+		}
+
+		rc  = ctx->hw_mgr_intf->hw_dump(
+			ctx->hw_mgr_intf->hw_mgr_priv,
+			&dump_args);
+		if (rc) {
+			CAM_ERR(CAM_CTXT, "[%s][%d] handle[%u] failed",
+			    ctx->dev_name, ctx->ctx_id, dump_args.buf_handle);
+			return rc;
+		}
+
+
+		if (dump_args.offset > cmd->offset) {
+			cmd->offset  = dump_args.offset;
+		}
+	} else {
+		CAM_DBG(CAM_CTXT, "%s hw dump not registered", ctx->dev_name);
+	}
+	return rc;
+}
+
+size_t cam_context_parse_config_cmd(struct cam_context *ctx, struct cam_config_dev_cmd *cmd,
+	struct cam_packet **packet)
+{
+	size_t len;
+	uintptr_t packet_addr;
+	int rc = 0;
+
+	if (!ctx || !cmd || !packet) {
+		CAM_ERR(CAM_CTXT, "invalid args");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	/* for config dev, only memory handle is supported */
+	/* map packet from the memhandle */
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle, &packet_addr, &len);
+	if (rc != 0) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] Can not get packet address for handle:%llx",
+			ctx->dev_name, ctx->ctx_id, cmd->packet_handle);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	if ((len < sizeof(struct cam_packet)) ||
+		((size_t)cmd->offset >= len - sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_CTXT, "invalid buff length: %zu or offset: %zu", len,
+			(size_t)cmd->offset);
+		rc = -EINVAL;
+		goto put_cpu_buf;
+	}
+
+	*packet = (struct cam_packet *) ((uint8_t *)packet_addr + (uint32_t)cmd->offset);
+
+	CAM_DBG(CAM_CTXT,
+		"handle:%llx, addr:0x%zx, offset:%0xllx, len:%zu, req:%llu, size:%u, opcode:0x%x",
+		cmd->packet_handle, packet_addr, cmd->offset, len, (*packet)->header.request_id,
+		(*packet)->header.size, (*packet)->header.op_code);
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return (len - (size_t)cmd->offset);
+
+put_cpu_buf:
+	if (cmd)
+		cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+err:
+	if (packet)
+		*packet = ERR_PTR(rc);
+	return 0;
+}
+
+static void __cam_context_req_mini_dump(struct cam_ctx_request *req,
+	uint8_t *start_addr, uint8_t *end_addr,
+	unsigned long *bytes_updated)
+{
+	struct cam_hw_req_mini_dump      *req_md;
+	struct cam_buf_io_cfg            *io_cfg;
+	struct cam_packet                *packet = NULL;
+	unsigned long                     bytes_written = 0;
+	unsigned long                     bytes_required = 0;
+	int rc;
+
+	bytes_required = sizeof(*req_md);
+	if (start_addr + bytes_written + bytes_required > end_addr)
+		goto end;
+
+	req_md = (struct cam_hw_req_mini_dump *)start_addr;
+
+	req_md->num_fence_map_in = req->num_in_map_entries;
+	req_md->num_fence_map_out = req->num_out_map_entries;
+	req_md->num_in_acked = atomic_read(&req->num_in_acked);
+	req_md->num_out_acked = req->num_out_acked;
+	req_md->request_id = req->request_id;
+	bytes_written += bytes_required;
+
+	if (req->num_out_map_entries) {
+		bytes_required = sizeof(struct cam_hw_fence_map_entry) *
+					req->num_out_map_entries;
+		if (start_addr + bytes_written + bytes_required > end_addr)
+			goto end;
+
+		req_md->fence_map_out = (struct cam_hw_fence_map_entry *)
+				(start_addr + bytes_written);
+		memcpy(req_md->fence_map_out, req->out_map_entries, bytes_required);
+		req_md->num_fence_map_out = req->num_out_map_entries;
+		bytes_written += bytes_required;
+	}
+
+	if (req->num_in_map_entries) {
+		bytes_required = sizeof(struct cam_hw_fence_map_entry) *
+				    req->num_in_map_entries;
+		if (start_addr + bytes_written + bytes_required > end_addr)
+			goto end;
+
+		req_md->fence_map_in = (struct cam_hw_fence_map_entry *)
+				(start_addr + bytes_written);
+		memcpy(req_md->fence_map_in, req->in_map_entries, bytes_required);
+		req_md->num_fence_map_in = req->num_in_map_entries;
+		bytes_written += bytes_required;
+	}
+
+	rc = cam_packet_util_get_packet_addr(&packet, req->pf_data.packet_handle,
+		req->pf_data.packet_offset);
+	if (rc)
+		return;
+
+	if (packet && packet->num_io_configs) {
+		bytes_required = packet->num_io_configs * sizeof(struct cam_buf_io_cfg);
+		if (start_addr + bytes_written + bytes_required > end_addr)
+			goto exit;
+
+		io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload_flex +
+			packet->io_configs_offset / 4);
+		req_md->io_cfg = (struct cam_buf_io_cfg *)(start_addr + bytes_written);
+		memcpy(req_md->io_cfg, io_cfg, bytes_required);
+		bytes_written += bytes_required;
+		req_md->num_io_cfg = packet->num_io_configs;
+	}
+exit:
+	cam_packet_util_put_packet_addr(req->pf_data.packet_handle);
+end:
+	*bytes_updated = bytes_written;
+}
+
+static int cam_context_apply_buf_done_err_injection(struct cam_context *ctx,
+	struct cam_common_evt_inject_data *inject_evt)
+{
+	struct cam_hw_done_event_data buf_done_data = {0};
+	int rc;
+
+	buf_done_data.request_id = inject_evt->evt_params->req_id;
+	buf_done_data.evt_param = inject_evt->evt_params->u.buf_err_evt.sync_error;
+	rc = cam_context_buf_done_from_hw(ctx, &buf_done_data,
+		CAM_CTX_EVT_ID_ERROR);
+	if (rc)
+		CAM_ERR(CAM_CTXT,
+			"Fail to apply buf done error injection with req id: %llu ctx id: %u rc: %d",
+			buf_done_data.request_id, ctx->ctx_id, rc);
+
+	return rc;
+}
+
+static int cam_context_apply_pf_evt_injection(struct cam_context *ctx,
+	struct cam_hw_inject_evt_param *evt_params)
+{
+	struct cam_hw_dump_pf_args pf_args         = {0};
+	struct cam_smmu_pf_info pf_info            = {0};
+	int rc;
+
+	pf_args.pf_context_info.req_id = evt_params->req_id;
+	pf_args.pf_context_info.ctx_found = evt_params->u.evt_notify.u.pf_evt_params.ctx_found;
+	pf_args.pf_smmu_info = &pf_info;
+
+	rc = cam_context_send_pf_evt(ctx, &pf_args);
+	if (rc)
+		CAM_ERR(CAM_CTXT,
+			"Fail to apply Page Fault event injection with req id: %llu ctx id: %u rc: %d",
+			evt_params->req_id, ctx->ctx_id, rc);
+
+	return rc;
+}
+
+static int cam_context_apply_node_event_injection(struct cam_context *ctx,
+	struct cam_hw_inject_evt_param *evt_params)
+{
+	struct cam_hw_inject_node_evt_param *node_evt_params =
+		&evt_params->u.evt_notify.u.node_evt_params;
+	struct cam_req_mgr_message req_msg                   = {0};
+	int rc;
+
+	req_msg.u.node_msg.request_id  = evt_params->req_id;
+	req_msg.u.node_msg.link_hdl    = ctx->link_hdl;
+	req_msg.u.node_msg.device_hdl  = ctx->dev_hdl;
+	req_msg.u.node_msg.event_type  = node_evt_params->event_type;
+	req_msg.u.node_msg.event_cause = node_evt_params->event_cause;
+	req_msg.session_hdl            = ctx->session_hdl;
+
+	rc = cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_ERROR, V4L_EVENT_CAM_REQ_MGR_EVENT);
+	if (rc)
+		CAM_ERR(CAM_CTXT,
+			"Fail to apply error event injection with req id: %llu ctx id: %u rc: %d",
+			evt_params->req_id, ctx->ctx_id, rc);
+
+	return rc;
+}
+
+static int cam_context_apply_error_event_injection(struct cam_context *ctx,
+	struct cam_hw_inject_evt_param *evt_params)
+{
+	struct cam_hw_inject_err_evt_param *err_evt_params =
+		&evt_params->u.evt_notify.u.err_evt_params;
+	struct cam_req_mgr_message req_msg                 = {0};
+	int rc;
+
+	req_msg.u.err_msg.device_hdl    = ctx->dev_hdl;
+	req_msg.u.err_msg.error_type    = err_evt_params->err_type;
+	req_msg.u.err_msg.link_hdl      = ctx->link_hdl;
+	req_msg.u.err_msg.request_id    = evt_params->req_id;
+	req_msg.u.err_msg.resource_size = 0x0;
+	req_msg.u.err_msg.error_code    = err_evt_params->err_code;
+	req_msg.session_hdl             = ctx->session_hdl;
+
+	rc = cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_ERROR, V4L_EVENT_CAM_REQ_MGR_EVENT);
+	if (rc)
+		CAM_ERR(CAM_CTXT,
+			"Fail to apply V4L2 Node event injection with req id: %llu ctx id: %u rc: %d",
+			evt_params->req_id, ctx->ctx_id, rc);
+
+	return rc;
+}
+
+int cam_context_apply_evt_injection(struct cam_context *ctx, void *inject_evt_arg)
+{
+	struct cam_common_evt_inject_data *inject_evt;
+	struct cam_hw_inject_evt_param *evt_params;
+	uint32_t evt_notify_type;
+	int rc = -EINVAL;
+
+	if (!ctx || !inject_evt_arg) {
+		CAM_ERR(CAM_CTXT, "Invalid parameters ctx %s inject evt args %s",
+			CAM_IS_NULL_TO_STR(ctx), CAM_IS_NULL_TO_STR(inject_evt_arg));
+		return -EINVAL;
+	}
+
+	inject_evt = inject_evt_arg;
+	evt_params = inject_evt->evt_params;
+
+	switch (evt_params->inject_id) {
+	case CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE:
+		rc = cam_context_apply_buf_done_err_injection(ctx, inject_evt);
+		break;
+	case CAM_COMMON_EVT_INJECT_NOTIFY_EVENT_TYPE:
+		evt_notify_type = evt_params->u.evt_notify.evt_notify_type;
+		switch (evt_notify_type) {
+		case V4L_EVENT_CAM_REQ_MGR_ERROR:
+			rc = cam_context_apply_error_event_injection(ctx, evt_params);
+			break;
+		case V4L_EVENT_CAM_REQ_MGR_PF_ERROR:
+			rc = cam_context_apply_pf_evt_injection(ctx, evt_params);
+			break;
+		case V4L_EVENT_CAM_REQ_MGR_NODE_EVENT:
+			rc = cam_context_apply_node_event_injection(ctx, evt_params);
+			break;
+		default:
+			CAM_ERR(CAM_CTXT, "Invalid notify type %u", evt_notify_type);
+		}
+		break;
+	default:
+		CAM_ERR(CAM_CTXT, "Invalid inject id %u", evt_params->inject_id);
+	}
+
+	return rc;
+}
+
+int cam_context_mini_dump(struct cam_context *ctx, void *args)
+{
+	struct cam_hw_mini_dump_info *md;
+	struct cam_ctx_request *req, *req_temp;
+	struct cam_hw_mini_dump_args *md_args;
+	uint8_t                      *start_addr;
+	uint8_t                      *end_addr;
+	unsigned long                 bytes_written = 0;
+	unsigned long                 bytes_updated = 0;
+
+	if (!ctx || !args) {
+		CAM_ERR(CAM_CTXT, "invalid params");
+		return -EINVAL;
+	}
+
+	md_args = (struct cam_hw_mini_dump_args *)args;
+	if (md_args->len < sizeof(*md)) {
+		md_args->bytes_written = 0;
+		CAM_ERR(CAM_CTXT, "Insufficient len %lu, bytes_written %lu", md_args->len,
+			md_args->bytes_written);
+		return 0;
+	}
+
+	start_addr = (uint8_t *)md_args->start_addr;
+	end_addr  = start_addr + md_args->len;
+	md = (struct cam_hw_mini_dump_info *)md_args->start_addr;
+	md->ctx_id = ctx->ctx_id;
+	md->last_flush_req = ctx->last_flush_req;
+	md->hw_mgr_ctx_id = ctx->hw_mgr_ctx_id;
+	md->dev_id = ctx->dev_id;
+	md->link_hdl = ctx->link_hdl;
+	md->state = ctx->state;
+	md->session_hdl = ctx->session_hdl;
+	md->dev_hdl = ctx->dev_hdl;
+	scnprintf(md->name, CAM_HW_MINI_DUMP_DEV_NAME_LEN, ctx->dev_name);
+	bytes_written += sizeof(*md);
+
+	if (!list_empty(&ctx->active_req_list)) {
+		md->active_list = (struct cam_hw_req_mini_dump *)
+			    (start_addr + bytes_written);
+		list_for_each_entry_safe(req, req_temp, &ctx->active_req_list, list) {
+			bytes_updated = 0;
+			__cam_context_req_mini_dump(req,
+				(uint8_t *)&md->active_list[md->active_cnt++],
+				end_addr, &bytes_updated);
+			if ((start_addr + bytes_written + bytes_updated >= end_addr))
+				goto end;
+			bytes_written += bytes_updated;
+		}
+	}
+
+	if (!list_empty(&ctx->wait_req_list)) {
+		md->wait_list = (struct cam_hw_req_mini_dump *)
+			    (start_addr + bytes_written);
+		list_for_each_entry_safe(req, req_temp, &ctx->wait_req_list, list) {
+			bytes_updated = 0;
+			__cam_context_req_mini_dump(req,
+				(uint8_t *)&md->wait_list[md->wait_cnt++],
+				end_addr, &bytes_updated);
+			if ((start_addr + bytes_written + bytes_updated >= end_addr))
+				goto end;
+			bytes_written += bytes_updated;
+		}
+	}
+
+	if (!list_empty(&ctx->pending_req_list)) {
+		md->pending_list = (struct cam_hw_req_mini_dump *)
+			    (start_addr + bytes_written);
+		list_for_each_entry_safe(req, req_temp, &ctx->pending_req_list, list) {
+			bytes_updated = 0;
+			__cam_context_req_mini_dump(req,
+				(uint8_t *)&md->pending_list[md->pending_cnt++],
+				end_addr, &bytes_updated);
+			if ((start_addr + bytes_written + bytes_updated >= end_addr))
+				goto end;
+			bytes_written += bytes_updated;
+		}
+	}
+end:
+	md_args->bytes_written = bytes_written;
+	CAM_INFO(CAM_CTXT, "Ctx %s bytes_written %lu", ctx->dev_name, md_args->bytes_written);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_context_utils.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_context_utils.h
@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CONTEXT_UTILS_H_
+#define _CAM_CONTEXT_UTILS_H_
+
+#include <linux/types.h>
+#include "cam_smmu_api.h"
+
+/**
+ * struct cam_context_utils_flush_args - arguments for flush context util
+ *
+ * @cmd: flush dev command from userland
+ * @flush_active_req: flag to indicate if the device supports flushing a particular
+ *                    active request or not
+ */
+struct cam_context_utils_flush_args {
+	struct cam_flush_dev_cmd *cmd;
+	bool flush_active_req;
+};
+
+int cam_context_buf_done_from_hw(struct cam_context *ctx,
+	void *done_event_data, uint32_t evt_id);
+int32_t cam_context_release_dev_to_hw(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd);
+int32_t cam_context_prepare_dev_to_hw(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd);
+int32_t cam_context_config_dev_to_hw(
+	struct cam_context *ctx, struct cam_config_dev_cmd *cmd);
+int32_t cam_context_acquire_dev_to_hw(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd);
+int32_t cam_context_start_dev_to_hw(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd);
+int32_t cam_context_stop_dev_to_hw(struct cam_context *ctx);
+int32_t cam_context_flush_dev_to_hw(struct cam_context *ctx,
+	struct cam_context_utils_flush_args *args);
+int32_t cam_context_flush_ctx_to_hw(struct cam_context *ctx);
+int32_t cam_context_flush_req_to_hw(struct cam_context *ctx,
+	struct cam_context_utils_flush_args *args);
+int32_t cam_context_send_pf_evt(struct cam_context *ctx,
+	struct cam_hw_dump_pf_args *pf_args);
+int32_t cam_context_dump_pf_info_to_hw(struct cam_context *ctx,
+	struct cam_hw_dump_pf_args *pf_args,
+	struct cam_hw_mgr_pf_request_info *pf_req_info);
+int32_t cam_context_dump_hw_acq_info(struct cam_context *ctx);
+int32_t cam_context_dump_dev_to_hw(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd);
+size_t cam_context_parse_config_cmd(struct cam_context *ctx, struct cam_config_dev_cmd *cmd,
+	struct cam_packet **packet);
+int cam_context_mini_dump(struct cam_context *ctx, void *args);
+int cam_context_apply_evt_injection(struct cam_context *ctx, void *inject_evt_arg);
+#endif /* _CAM_CONTEXT_UTILS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_hw.h
@@ -0,0 +1,52 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_HW_H_
+#define _CAM_HW_H_
+
+#include "cam_soc_util.h"
+
+/*
+ * This file declares Enums, Structures and APIs to be used as template
+ * when writing any HW driver in the camera subsystem.
+ */
+
+/* Hardware state enum */
+enum cam_hw_state {
+	CAM_HW_STATE_POWER_DOWN,
+	CAM_HW_STATE_POWER_UP,
+};
+
+/**
+ * struct cam_hw_info - Common hardware information
+ *
+ * @hw_mutex:              Hardware mutex
+ * @hw_lock:               Hardware spinlock
+ * @hw_complete:           Hardware Completion
+ * @open_count:            Count to track the HW enable from the client
+ * @hw_state:              Hardware state
+ * @soc_info:              Platform SOC properties for hardware
+ * @node_info:             Private HW data related to nodes
+ * @core_info:             Private HW data related to core logic
+ * @presil_hw_lock:        Mutex lock used for presil in place of hw_lock,
+ *                         for drivers like CDM
+ *
+ */
+struct cam_hw_info {
+	struct mutex                    hw_mutex;
+	spinlock_t                      hw_lock;
+	struct completion               hw_complete;
+	uint32_t                        open_count;
+	enum cam_hw_state               hw_state;
+	struct cam_hw_soc_info          soc_info;
+	void                           *node_info;
+	void                           *core_info;
+
+#ifdef CONFIG_CAM_PRESIL
+	struct mutex                    presil_hw_lock;
+#endif
+};
+
+#endif /* _CAM_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_hw_intf.h
@@ -0,0 +1,154 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_HW_INTF_H_
+#define _CAM_HW_INTF_H_
+
+#include <linux/types.h>
+#include "cam_hw.h"
+
+/*
+ * This file declares Constants, Enums, Structures and APIs to be used as
+ * Interface between HW driver and HW Manager.
+ */
+
+#define CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ 6
+
+enum cam_clk_bw_state {
+	CAM_CLK_BW_STATE_INIT,
+	CAM_CLK_BW_STATE_UNCHANGED,
+	CAM_CLK_BW_STATE_INCREASE,
+	CAM_CLK_BW_STATE_DECREASE,
+};
+
+/**
+ * struct cam_hw_ops - Hardware layer interface functions
+ *
+ * @get_hw_caps:           Function pointer for get hw caps
+ * @init:                  Function poniter for initialize hardware
+ * @deinit:                Function pointer for deinitialize hardware
+ * @reset:                 Function pointer for reset hardware
+ * @reserve:               Function pointer for reserve hardware
+ * @release:               Function pointer for release hardware
+ * @start:                 Function pointer for start hardware
+ * @stop:                  Function pointer for stop hardware
+ * @read:                  Function pointer for read hardware registers
+ * @write:                 Function pointer for Write hardware registers
+ * @process_cmd:           Function pointer for additional hardware controls
+ * @flush_cmd:             Function pointer for flush requests
+ * @test_irq_line:         Function pointer for testing irq line
+ *
+ */
+struct cam_hw_ops {
+	int (*get_hw_caps)(void *hw_priv,
+		void *get_hw_cap_args, uint32_t arg_size);
+	int (*init)(void *hw_priv,
+		void *init_hw_args, uint32_t arg_size);
+	int (*deinit)(void *hw_priv,
+		void *init_hw_args, uint32_t arg_size);
+	int (*reset)(void *hw_priv,
+		void *reset_core_args, uint32_t arg_size);
+	int (*reserve)(void *hw_priv,
+		void *reserve_args, uint32_t arg_size);
+	int (*release)(void *hw_priv,
+		void *release_args, uint32_t arg_size);
+	int (*start)(void *hw_priv,
+		void *start_args, uint32_t arg_size);
+	int (*stop)(void *hw_priv,
+		void *stop_args, uint32_t arg_size);
+	int (*read)(void *hw_priv,
+		void *read_args, uint32_t arg_size);
+	int (*write)(void *hw_priv,
+		void *write_args, uint32_t arg_size);
+	int (*process_cmd)(void *hw_priv,
+		uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+	int (*flush)(void *hw_priv,
+		void *flush_args, uint32_t arg_size);
+	int (*test_irq_line)(void *hw_priv);
+};
+
+/**
+ * struct cam_hw_intf - Common hardware node
+ *
+ * @hw_type:               Hardware type
+ * @hw_idx:                Hardware ID
+ * @hw_ops:                Hardware interface function table
+ * @hw_priv:               Private hardware node pointer
+ *
+ */
+struct cam_hw_intf {
+	uint32_t                     hw_type;
+	uint32_t                     hw_idx;
+	struct cam_hw_ops            hw_ops;
+	void                        *hw_priv;
+};
+
+/* hardware event callback function type */
+typedef int (*cam_hw_mgr_event_cb_func)(void *priv, uint32_t evt_id,
+	void *evt_data);
+
+#ifdef CONFIG_CAM_PRESIL
+static inline void cam_hw_util_init_hw_lock(struct cam_hw_info *hw_info)
+{
+	mutex_init(&hw_info->presil_hw_lock);
+}
+
+static inline unsigned long cam_hw_util_hw_lock_irqsave(struct cam_hw_info *hw_info)
+{
+	mutex_lock(&hw_info->presil_hw_lock);
+
+	return 0;
+}
+
+static inline void cam_hw_util_hw_unlock_irqrestore(struct cam_hw_info *hw_info,
+	unsigned long flags)
+{
+	mutex_unlock(&hw_info->presil_hw_lock);
+}
+
+static inline void cam_hw_util_hw_lock(struct cam_hw_info *hw_info)
+{
+	mutex_lock(&hw_info->presil_hw_lock);
+}
+
+static inline void cam_hw_util_hw_unlock(struct cam_hw_info *hw_info)
+{
+	mutex_unlock(&hw_info->presil_hw_lock);
+}
+#else
+static inline void cam_hw_util_init_hw_lock(struct cam_hw_info *hw_info)
+{
+	spin_lock_init(&hw_info->hw_lock);
+}
+
+static inline unsigned long cam_hw_util_hw_lock_irqsave(struct cam_hw_info *hw_info)
+{
+	unsigned long flags = 0;
+
+	if (!in_irq())
+		spin_lock_irqsave(&hw_info->hw_lock, flags);
+
+	return flags;
+}
+
+static inline void cam_hw_util_hw_unlock_irqrestore(struct cam_hw_info *hw_info,
+	unsigned long flags)
+{
+	if (!in_irq())
+		spin_unlock_irqrestore(&hw_info->hw_lock, flags);
+}
+
+static inline void cam_hw_util_hw_lock(struct cam_hw_info *hw_info)
+{
+	spin_lock(&hw_info->hw_lock);
+}
+
+static inline void cam_hw_util_hw_unlock(struct cam_hw_info *hw_info)
+{
+	spin_unlock(&hw_info->hw_lock);
+}
+#endif /* CONFIG_CAM_PRESIL */
+
+#endif /* _CAM_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_hw_mgr_intf.h
@@ -0,0 +1,698 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_HW_MGR_INTF_H_
+#define _CAM_HW_MGR_INTF_H_
+
+#include <linux/time64.h>
+#include <linux/types.h>
+#include <media/cam_defs.h>
+#include "cam_smmu_api.h"
+
+/*
+ * This file declares Constants, Enums, Structures and APIs to be used as
+ * Interface between HW Manager and Context.
+ */
+
+
+/* maximum context numbers */
+#define CAM_CTX_MAX                         10
+#define CAM_MAX_OFFLINE_HW                   2
+
+/* maximum buf done irqs */
+#define CAM_NUM_OUT_PER_COMP_IRQ_MAX        12
+
+/* Maximum reg dump cmd buffer entries in a context */
+#define CAM_REG_DUMP_MAX_BUF_ENTRIES        10
+
+/* max device name string length*/
+#define CAM_HW_MINI_DUMP_DEV_NAME_LEN       20
+
+/**
+ * enum cam_context_dump_id -
+ *              context dump type
+ *
+ */
+enum cam_context_dump_id {
+	CAM_CTX_DUMP_TYPE_NONE,
+	CAM_CTX_DUMP_ACQ_INFO,
+	CAM_CTX_DUMP_TYPE_MAX,
+};
+
+/**
+ * enum cam_faulted_mem_type -
+ *    page fault buffer type found in packet
+ *
+ */
+enum cam_faulted_mem_type {
+	CAM_FAULT_BUF_NOT_FOUND,
+	CAM_FAULT_IO_CFG_BUF,
+	CAM_FAULT_PATCH_BUF
+};
+
+#define CAM_CTX_EVT_ID_SUCCESS 0
+#define CAM_CTX_EVT_ID_ERROR   1
+#define CAM_CTX_EVT_ID_CANCEL  2
+
+/* hardware event callback function type */
+typedef int (*cam_hw_event_cb_func)(void *context, uint32_t evt_id,
+	void *evt_data);
+
+/* hardware page fault callback function type */
+typedef int (*cam_hw_pagefault_cb_func)(void *context,
+	void *pf_args);
+
+/* ctx dump callback function type */
+typedef int (*cam_ctx_info_dump_cb_func)(void *context,
+	enum cam_context_dump_id dump_id);
+
+/* ctx recovery callback function type */
+typedef int (*cam_ctx_recovery_cb_func)(void *context,
+	void *recovery_data);
+
+/* ctx mini dump callback function type */
+typedef int (*cam_ctx_mini_dump_cb_func)(void *context,
+	void *args);
+
+/* ctx error inject callback function type */
+typedef int (*cam_ctx_err_inject_cb_func)(void *context,
+	void *args);
+
+/* message callback function type */
+typedef int (*cam_ctx_message_cb_func)(void *context,
+	uint32_t message_type, void *data);
+
+/**
+ * struct cam_hw_update_entry - Entry for hardware config
+ *
+ * @handle:                Memory handle for the configuration
+ * @offset:                Memory offset
+ * @len:                   Size of the configuration
+ * @flags:                 Flags for the config entry(eg. DMI)
+ * @addr:                  Address of hardware update entry
+ *
+ */
+struct cam_hw_update_entry {
+	int                handle;
+	uint32_t           offset;
+	uint32_t           len;
+	uint32_t           flags;
+	uintptr_t          addr;
+};
+
+/**
+ * struct cam_hw_fence_map_entry - Entry for the resource to sync id map
+ *
+ * @resrouce_handle:       Resource port id for the buffer
+ * @sync_id:               Sync id
+ * @image_buf_addr:        Image buffer address array
+ * @buffer_tracker:        Some buffers with fences have buf dones come
+ *                         separately from each out port, and signalled
+ *                         independently. Ref counting needs to be handled
+ *                         independently as well corresponding to individual
+ *                         buf dones.
+ *
+ */
+struct cam_hw_fence_map_entry {
+	uint32_t                        resource_handle;
+	int32_t                         sync_id;
+	dma_addr_t                      image_buf_addr[CAM_PACKET_MAX_PLANES];
+	struct cam_smmu_buffer_tracker *buffer_tracker;
+};
+
+/**
+ * struct cam_hw_done_event_data - Payload for hw done event
+ *
+ * @num_handles:           number of handles in the event
+ * @resrouce_handle:       list of the resource handle
+ * @timestamp:             time stamp
+ * @request_id:            request identifier
+ * @evt_param:             event parameter
+ *
+ */
+struct cam_hw_done_event_data {
+	uint32_t           num_handles;
+	uint32_t           resource_handle[CAM_NUM_OUT_PER_COMP_IRQ_MAX];
+	struct timespec64  timestamp;
+	uint64_t           request_id;
+	uint32_t           evt_param;
+};
+
+/**
+ * struct cam_hw_acquire_stream_caps - Any HW caps info from HW mgr to ctx
+ *                                     Params to be interpreted by the
+ *                                     respective drivers
+ * @num_valid_params : Number of valid params
+ * @param_list       : List of params interpreted by the driver
+ *
+ */
+struct cam_hw_acquire_stream_caps {
+	uint32_t          num_valid_params;
+	uint32_t          param_list[4];
+};
+
+/**
+ * struct cam_hw_acquire_args - Payload for acquire command
+ *
+ * @context_data:          Context data pointer for the callback function
+ * @ctx_id:                Core context id
+ * @event_cb:              Callback function array
+ * @sec_pf_evt_cb:         Callback function for secondary page fault from HW to ctx.
+ *                         It's the callback that pertains to a PF not directly on
+ *                         this HW. But a different block to which this HW is
+ *                         associated or is a client of
+ * @num_acq:               Total number of acquire in the payload
+ * @acquire_info:          Acquired resource array pointer
+ * @ctxt_to_hw_map:        HW context (returned)
+ * @hw_mgr_ctx_id          HWMgr context id(returned)
+ * @op_flags:              Used as bitwise params from hw_mgr to ctx
+ *                         See xxx_hw_mgr_intf.h for definitions
+ * @link_hdl:              Link handle
+ * @acquired_hw_id:        Acquired hardware mask
+ * @acquired_hw_path:      Acquired path mask for an input
+ *                         if input splits into multiple paths,
+ *                         its updated per hardware
+ * @valid_acquired_hw:     Valid num of acquired hardware
+ * @op_params:             OP Params from hw_mgr to ctx
+ * @mini_dump_cb:          Mini dump callback function
+ *
+ */
+struct cam_hw_acquire_args {
+	void                        *context_data;
+	uint32_t                     ctx_id;
+	cam_hw_event_cb_func         event_cb;
+	cam_hw_pagefault_cb_func     sec_pf_evt_cb;
+	uint32_t                     num_acq;
+	uint32_t                     acquire_info_size;
+	uintptr_t                    acquire_info;
+	void                        *ctxt_to_hw_map;
+	uint32_t                     hw_mgr_ctx_id;
+	uint32_t                     op_flags;
+	int32_t                      link_hdl;
+	uint32_t                     acquired_hw_id[CAM_MAX_ACQ_RES];
+	uint32_t                     acquired_hw_path[CAM_MAX_ACQ_RES][CAM_MAX_HW_SPLIT];
+	uint32_t                     valid_acquired_hw;
+	struct cam_hw_acquire_stream_caps op_params;
+	cam_ctx_mini_dump_cb_func    mini_dump_cb;
+};
+
+/**
+ * struct cam_hw_release_args - Payload for release command
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @active_req:            Active request flag
+ *
+ */
+struct cam_hw_release_args {
+	void              *ctxt_to_hw_map;
+	bool               active_req;
+};
+
+/**
+ * struct cam_hw_start_args - Payload for start command
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @num_hw_update_entries: Number of Hardware configuration
+ * @hw_update_entries:     Hardware configuration list
+ *
+ */
+struct cam_hw_start_args {
+	void                        *ctxt_to_hw_map;
+	uint32_t                     num_hw_update_entries;
+	struct cam_hw_update_entry  *hw_update_entries;
+};
+
+/**
+ * struct cam_hw_stop_args - Payload for stop command
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @args:                  Arguments to pass for stop
+ *
+ */
+struct cam_hw_stop_args {
+	void              *ctxt_to_hw_map;
+	void              *args;
+};
+
+/**
+ * struct cam_hw_mgr_pf_request_info - page fault debug data
+ *
+ * @packet_handle:     packet handle
+ * @offset:            packet offset
+ * @req:               pointer to req (HW specific)
+ */
+struct cam_hw_mgr_pf_request_info {
+	uint64_t packet_handle;
+	uint64_t packet_offset;
+	void    *req;
+};
+
+/**
+ * struct cam_hw_prepare_update_args - Payload for prepare command
+ *
+ * @packet:                CSL packet from user mode driver
+ * @remain_len             Remaining length of CPU buffer after config offset
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @max_hw_update_entries: Maximum hardware update entries supported
+ * @hw_update_entries:     Actual hardware update configuration (returned)
+ * @num_hw_update_entries: Number of actual hardware update entries (returned)
+ * @max_out_map_entries:   Maximum output fence mapping supported
+ * @out_map_entries:       Actual output fence mapping list (returned)
+ * @num_out_map_entries:   Number of actual output fence mapping (returned)
+ * @max_in_map_entries:    Maximum input fence mapping supported
+ * @in_map_entries:        Actual input fence mapping list (returned)
+ * @num_in_map_entries:    Number of acutal input fence mapping (returned)
+ * @reg_dump_buf_desc:     cmd buffer descriptors for reg dump
+ * @num_reg_dump_buf:      Count of descriptors in reg_dump_buf_desc
+ * @priv:                  Private pointer of hw update
+ * @buf_tracker:           Ptr to list of buffers we want to keep ref counts on
+ * @pf_data:               Debug data for page fault
+ *
+ */
+struct cam_hw_prepare_update_args {
+	struct cam_packet              *packet;
+	size_t                          remain_len;
+	void                           *ctxt_to_hw_map;
+	uint32_t                        max_hw_update_entries;
+	struct cam_hw_update_entry     *hw_update_entries;
+	uint32_t                        num_hw_update_entries;
+	uint32_t                        max_out_map_entries;
+	struct cam_hw_fence_map_entry  *out_map_entries;
+	uint32_t                        num_out_map_entries;
+	uint32_t                        max_in_map_entries;
+	struct cam_hw_fence_map_entry  *in_map_entries;
+	uint32_t                        num_in_map_entries;
+	struct cam_cmd_buf_desc         reg_dump_buf_desc[
+					CAM_REG_DUMP_MAX_BUF_ENTRIES];
+	uint32_t                        num_reg_dump_buf;
+	void                           *priv;
+	struct list_head                   *buf_tracker;
+	struct cam_hw_mgr_pf_request_info  *pf_data;
+};
+
+/**
+ * struct cam_hw_stream_setttings - Payload for config stream command
+ *
+ * @packet:                CSL packet from user mode driver
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @priv:                  Private pointer of hw update
+ *
+ */
+struct cam_hw_stream_setttings {
+	struct cam_packet              *packet;
+	void                           *ctxt_to_hw_map;
+	void                           *priv;
+};
+
+/**
+ * enum cam_hw_config_reapply_type
+ */
+enum cam_hw_config_reapply_type {
+	CAM_CONFIG_REAPPLY_NONE,
+	CAM_CONFIG_REAPPLY_IQ,
+	CAM_CONFIG_REAPPLY_IO,
+};
+
+/**
+ * struct cam_hw_config_args - Payload for config command
+ *
+ * @ctxt_to_hw_map:            HW context from the acquire
+ * @num_hw_update_entries:     Number of hardware update entries
+ * @hw_update_entries:         Hardware update list
+ * @out_map_entries:           Out map info
+ * @num_out_map_entries:       Number of out map entries
+ * @priv:                      Private pointer
+ * @request_id:                Request ID
+ * @reapply_type:              On reapply determines what is to be applied
+ * @init_packet:               Set if INIT packet
+ * @cdm_reset_before_apply:    True is need to reset CDM before re-apply bubble
+ *                             request
+ *
+ */
+struct cam_hw_config_args {
+	void                           *ctxt_to_hw_map;
+	uint32_t                        num_hw_update_entries;
+	struct cam_hw_update_entry     *hw_update_entries;
+	struct cam_hw_fence_map_entry  *out_map_entries;
+	uint32_t                        num_out_map_entries;
+	void                           *priv;
+	uint64_t                        request_id;
+	enum cam_hw_config_reapply_type reapply_type;
+	bool                            init_packet;
+	bool                            cdm_reset_before_apply;
+};
+
+/**
+ * struct cam_hw_flush_args - Flush arguments
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @num_req_pending:       Num request to flush, valid when flush type is REQ
+ * @flush_req_pending:     Request pending pointers to flush
+ * @num_req_active:        Num request to flush, valid when flush type is REQ
+ * @flush_req_active:      Request active pointers to flush
+ * @flush_type:            The flush type
+ * @last_flush_req:        last flush req_id notified to hw_mgr for the
+ *                         given stream
+ *
+ */
+struct cam_hw_flush_args {
+	void                           *ctxt_to_hw_map;
+	uint32_t                        num_req_pending;
+	void                          **flush_req_pending;
+	uint32_t                        num_req_active;
+	void                          **flush_req_active;
+	enum flush_type_t               flush_type;
+	uint32_t                        last_flush_req;
+};
+
+/**
+ * struct cam_context_pf_info - Page Fault related info to the faulted context
+ *
+ * @mem_type:              Faulted memory type found in packet
+ * @resource_type:         Resource type of the port which caused page fault
+ * @buf_hdl:               Faulted memory handle
+ * @offset:                Offset for faulted buf_hdl
+ * @req_id:                request id for the faulted request
+ * @delta:                 Delta size between faulted address and buffer
+ *                         Or closest-mapped buffer
+ *                         (if faulted addr isn't found to be in any buffer)
+ * @patch_idx:             Index to which patch in the packet is faulted
+ * @mem_flag:              Memory flag of the faulted buffer
+ * @ctx_found:             If fault pid found in context acquired hardware
+ * @force_send_pf_evt:     Must send page fault notification to UMD even if
+ *                         current ctx is not the faulted ctx
+ */
+struct cam_context_pf_info {
+	enum cam_faulted_mem_type mem_type;
+	uint32_t                  resource_type;
+	int32_t                   buf_hdl;
+	uint32_t                  offset;
+	unsigned long             delta;
+	uint32_t                  patch_idx;
+	uint32_t                  mem_flag;
+	uint64_t                  req_id;
+	bool                      ctx_found;
+	bool                      force_send_pf_evt;
+};
+
+/**
+ * struct cam_hw_dump_pf_args - General payload contains all PF relateed info.
+ *
+ * @pf_smmu_info:          Page fault info from SMMU driver
+ * @pf_context_info:       Page fault info related to faulted context or
+ *                         faulted request.
+ * @handle_sec_pf:         Indicates if this PF args comes from HW level
+ */
+struct cam_hw_dump_pf_args {
+	struct cam_smmu_pf_info    *pf_smmu_info;
+	struct cam_context_pf_info  pf_context_info;
+	bool                        handle_sec_pf;
+};
+
+/**
+ * struct cam_hw_cmd_pf_args - page fault command payload to hw manager.
+ * @pf_args:            Page Fault related info.
+ * @cmd_pf_req_info:    Command payload related to request info. Used to
+ *                      submit to HW for PF processing.
+ *
+ */
+struct cam_hw_cmd_pf_args {
+	struct cam_hw_dump_pf_args          *pf_args;
+	struct cam_hw_mgr_pf_request_info   *pf_req_info;
+};
+
+/**
+ * struct cam_hw_reset_args -hw reset arguments
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ *
+ */
+struct cam_hw_reset_args {
+	void                           *ctxt_to_hw_map;
+};
+
+/**
+ * struct cam_hw_dump_args - Dump arguments
+ *
+ * @request_id:            request_id
+ * @offset:                Buffer offset. This is updated by the drivers.
+ * @buf_handle:            Buffer handle
+ * @error_type:            Error type, to be used to extend dump information
+ * @ctxt_to_hw_map:        HW context from the acquire
+ */
+struct cam_hw_dump_args {
+	uint64_t          request_id;
+	size_t            offset;
+	uint32_t          buf_handle;
+	uint32_t          error_type;
+	void             *ctxt_to_hw_map;
+};
+
+/* enum cam_hw_mgr_command - Hardware manager command type */
+enum cam_hw_mgr_command {
+	CAM_HW_MGR_CMD_INTERNAL,
+	CAM_HW_MGR_CMD_DUMP_PF_INFO,
+	CAM_HW_MGR_CMD_REG_DUMP_ON_FLUSH,
+	CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR,
+	CAM_HW_MGR_CMD_DUMP_ACQ_INFO,
+};
+
+/**
+ * struct cam_hw_cmd_args - Payload for hw manager command
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @cmd_type               HW command type
+ * @internal_args          Arguments for internal command
+ * @pf_cmd_args            Arguments for Dump PF info command
+ *
+ */
+struct cam_hw_cmd_args {
+	void                               *ctxt_to_hw_map;
+	uint32_t                            cmd_type;
+	union {
+		void                           *internal_args;
+		struct cam_hw_cmd_pf_args      *pf_cmd_args;
+	} u;
+};
+
+/**
+ * struct cam_hw_mini_dump_args - Mini Dump arguments
+ *
+ * @start_addr:          Start address of buffer
+ * @len:                 Len of Buffer
+ * @bytes_written:       Bytes written
+ */
+struct cam_hw_mini_dump_args {
+	void             *start_addr;
+	unsigned long     len;
+	unsigned long     bytes_written;
+};
+
+/**
+ * struct cam_hw_req_mini_dump - Mini dump context req
+ *
+ * @fence_map_out:       Fence map out array
+ * @fence_map_in:        Fence map in array
+ * @io_cfg:              IO cfg.
+ * @request_id:          Request id
+ * @num_fence_map_in:    num of fence map in
+ * @num_fence_map_in:    num of fence map out
+ * @num_io_cfg:          num of io cfg
+ * @num_in_acked:        num in acked
+ * @num_out_acked:       num out acked
+ * @status:              Status
+ * @flushed:             whether request is flushed
+ *
+ */
+struct cam_hw_req_mini_dump {
+	struct cam_hw_fence_map_entry     *fence_map_out;
+	struct cam_hw_fence_map_entry     *fence_map_in;
+	struct cam_buf_io_cfg             *io_cfg;
+	uint64_t                           request_id;
+	uint16_t                           num_fence_map_in;
+	uint16_t                           num_fence_map_out;
+	uint16_t                           num_io_cfg;
+	uint16_t                           num_in_acked;
+	uint16_t                           num_out_acked;
+	uint8_t                            status;
+	uint8_t                            flushed;
+};
+
+/**
+ * struct cam_hw_mini_dump_info - Mini dump context info
+ *
+ * @active_list:          array of active req in context
+ * @wait_list:            array of  wait req in context
+ * @pending_list:         array of pending req in context
+ * @name:                 name of context
+ * @dev_id:               dev id.
+ * @last_flush_req:       last flushed request id
+ * @refcount:             kernel ref count
+ * @ctx_id:               Context id
+ * @session_hdl:          Session handle
+ * @link_hdl:             link handle
+ * @dev_hdl:              Dev hdl
+ * @state:                State of context
+ * @hw_mgr_ctx_id:        ctx id with hw mgr
+ *
+ */
+struct cam_hw_mini_dump_info {
+	struct   cam_hw_req_mini_dump   *active_list;
+	struct   cam_hw_req_mini_dump   *wait_list;
+	struct   cam_hw_req_mini_dump   *pending_list;
+	char                             name[CAM_HW_MINI_DUMP_DEV_NAME_LEN];
+	uint64_t                         dev_id;
+	uint32_t                         last_flush_req;
+	uint32_t                         refcount;
+	uint32_t                         ctx_id;
+	uint32_t                         active_cnt;
+	uint32_t                         pending_cnt;
+	uint32_t                         wait_cnt;
+	int32_t                          session_hdl;
+	int32_t                          link_hdl;
+	int32_t                          dev_hdl;
+	uint8_t                          state;
+	uint8_t                          hw_mgr_ctx_id;
+};
+
+/**
+ * cam_hw_inject_err_evt_param - error evt injection parameters
+ *
+ * @err_type:         error type for the injected err evt
+ * @err_code:         error code for the injected err evt
+ */
+struct cam_hw_inject_err_evt_param {
+	uint32_t err_type;
+	uint32_t err_code;
+};
+
+/**
+ * cam_hw_inject_node_evt_param - node evt injection parameters
+ * @event_type:       event type for the injected node evt
+ * @event_cause:      event cause for the injected node evt
+ */
+struct cam_hw_inject_node_evt_param {
+	uint32_t event_type;
+	uint32_t event_cause;
+};
+
+/**
+ * cam_hw_inject_pf_evt_param - pf evt injection parameters
+ *
+ * @ctx_found:        flag to indicate if page fault notification sent with ctx or not
+ */
+struct cam_hw_inject_pf_evt_param {
+	bool ctx_found;
+};
+
+/**
+ * cam_hw_inject_evt_notification_param - notify event parameters
+ *
+ * @evt_notify_type:   type of event notification
+ * @u:                 union which can be either error event/Page Fault event/Node event
+ */
+
+struct cam_hw_inject_evt_notification_param {
+	uint32_t evt_notify_type;
+	union {
+		struct cam_hw_inject_err_evt_param  err_evt_params;
+		struct cam_hw_inject_pf_evt_param   pf_evt_params;
+		struct cam_hw_inject_node_evt_param node_evt_params;
+	} u;
+};
+
+/**
+ * cam_hw_inject_buffer_error_param - buffer error injection parameters
+ *
+ * @sync_error:        sync error code
+ */
+struct cam_hw_inject_buffer_error_param {
+	uint32_t sync_error;
+};
+
+/**
+ * cam_hw_inject_evt_param - CRM event injection parameters
+ *
+ * @inject_id:        generic inject identifier
+ * @req_id:           Req Id for which the event is injected
+ * @u:                union which can be either buffer done error/event notification
+ * @is_valid:         bool flag to indicate if event injection is enabled for a context
+ */
+struct cam_hw_inject_evt_param {
+	uint8_t inject_id;
+	uint64_t req_id;
+	union {
+		struct cam_hw_inject_buffer_error_param buf_err_evt;
+		struct cam_hw_inject_evt_notification_param evt_notify;
+	} u;
+	bool is_valid;
+};
+
+/**
+ * cam_hw_mgr_intf - HW manager interface
+ *
+ * @hw_mgr_priv:                         HW manager object
+ * @hw_get_caps:                         Function pointer for get hw caps
+ *                                         args = cam_query_cap_cmd
+ * @hw_get_caps_v2:                      Function pointer for get hw caps v2
+ *                                         args = cam_query_cap_cmd_v2
+ * @hw_acquire:                          Function poniter for acquire hw resources
+ *                                         args = cam_hw_acquire_args
+ * @hw_release:                          Function pointer for release hw device resource
+ *                                         args = cam_hw_release_args
+ * @hw_start:                            Function pointer for start hw devices
+ *                                         args = cam_hw_start_args
+ * @hw_stop:                             Function pointer for stop hw devices
+ *                                         args = cam_hw_stop_args
+ * @hw_prepare_update:                   Function pointer for prepare hw update for hw
+ *                                       devices args = cam_hw_prepare_update_args
+ * @hw_config_stream_settings:           Function pointer for configure stream for hw
+ *                                       devices args = cam_hw_stream_setttings
+ * @hw_config:                           Function pointer for configure hw devices
+ *                                         args = cam_hw_config_args
+ * @hw_read:                             Function pointer for read hardware registers
+ * @hw_write:                            Function pointer for Write hardware registers
+ * @hw_cmd:                              Function pointer for any customized commands for
+ *                                       the hardware manager
+ * @hw_open:                             Function pointer for HW init
+ * @hw_close:                            Function pointer for HW deinit
+ * @hw_flush:                            Function pointer for HW flush
+ * @hw_reset:                            Function pointer for HW reset
+ * @hw_dump:                             Function pointer for HW dump
+ * @hw_recovery:                         Function pointer for HW recovery callback
+ * @hw_inject_evt:                       Function pointer for HW event injection callback
+ * @synx_trigger:                        Function pointer for synx test trigger
+ * @hw_update_sensor_grp_stream_cfg:     Function pointer for sensor group config data update
+ *
+ */
+struct cam_hw_mgr_intf {
+	void *hw_mgr_priv;
+
+	int (*hw_get_caps)(void *hw_priv, void *hw_caps_args);
+	int (*hw_get_caps_v2)(void *hw_priv, void *hw_caps_args);
+	int (*hw_acquire)(void *hw_priv, void *hw_acquire_args);
+	int (*hw_release)(void *hw_priv, void *hw_release_args);
+	int (*hw_start)(void *hw_priv, void *hw_start_args);
+	int (*hw_stop)(void *hw_priv, void *hw_stop_args);
+	int (*hw_prepare_update)(void *hw_priv, void *hw_prepare_update_args);
+	int (*hw_config_stream_settings)(void *hw_priv,
+		void *hw_stream_settings);
+	int (*hw_config)(void *hw_priv, void *hw_config_args);
+	int (*hw_read)(void *hw_priv, void *read_args);
+	int (*hw_write)(void *hw_priv, void *write_args);
+	int (*hw_cmd)(void *hw_priv, void *write_args);
+	int (*hw_open)(void *hw_priv, void *fw_download_args);
+	int (*hw_close)(void *hw_priv, void *hw_close_args);
+	int (*hw_flush)(void *hw_priv, void *hw_flush_args);
+	int (*hw_reset)(void *hw_priv, void *hw_reset_args);
+	int (*hw_dump)(void *hw_priv, void *hw_dump_args);
+	int (*hw_recovery)(void *hw_priv, void *hw_recovery_args);
+	void (*hw_inject_evt)(void *hw_priv, void *evt_args);
+	int (*synx_trigger)(void *hw_priv, void *synx_params);
+	int (*hw_update_sensor_grp_stream_cfg)(void *hw_priv, void *hw_cfg_args);
+};
+
+#endif /* _CAM_HW_MGR_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_node.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_node.c
@@ -0,0 +1,1111 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+
+#include "cam_node.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+
+static void cam_node_print_ctx_state(
+	struct cam_node *node)
+{
+	int i;
+	struct cam_context *ctx;
+
+	CAM_INFO(CAM_CORE, "[%s] state=%d, ctx_size %d",
+		node->name, node->state, node->ctx_size);
+
+	mutex_lock(&node->list_mutex);
+	for (i = 0; i < node->ctx_size; i++) {
+		ctx = &node->ctx_list[i];
+
+		spin_lock_bh(&ctx->lock);
+		CAM_INFO(CAM_CORE,
+			"[%s][%d] : state=%d, refcount=%d, active_req_list=%d, pending_req_list=%d, wait_req_list=%d, free_req_list=%d",
+			ctx->dev_name,
+			i, ctx->state,
+			atomic_read(&(ctx->refcount.refcount.refs)),
+			list_empty(&ctx->active_req_list),
+			list_empty(&ctx->pending_req_list),
+			list_empty(&ctx->wait_req_list),
+			list_empty(&ctx->free_req_list));
+		spin_unlock_bh(&ctx->lock);
+	}
+	mutex_unlock(&node->list_mutex);
+}
+
+static struct cam_context *cam_node_get_ctxt_from_free_list(
+		struct cam_node *node)
+{
+	struct cam_context *ctx = NULL;
+
+	mutex_lock(&node->list_mutex);
+	if (!list_empty(&node->free_ctx_list)) {
+		ctx = list_first_entry(&node->free_ctx_list,
+			struct cam_context, list);
+		list_del_init(&ctx->list);
+	}
+	mutex_unlock(&node->list_mutex);
+	if (ctx)
+		kref_init(&ctx->refcount);
+	return ctx;
+}
+
+void cam_node_put_ctxt_to_free_list(struct kref *ref)
+{
+	struct cam_context *ctx =
+		container_of(ref, struct cam_context, refcount);
+	struct cam_node *node = ctx->node;
+
+	mutex_lock(&node->list_mutex);
+	list_add_tail(&ctx->list, &node->free_ctx_list);
+	mutex_unlock(&node->list_mutex);
+}
+
+static int __cam_node_handle_update_sensor_stream_cap(
+	struct cam_node *node,
+	struct cam_update_sensor_stream_cfg_cmd *update_sensor_stream)
+{
+	int rc = 0;
+
+	if (!update_sensor_stream || !node) {
+		CAM_ERR(CAM_CORE, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (node->hw_mgr_intf.hw_update_sensor_grp_stream_cfg) {
+		rc = node->hw_mgr_intf.hw_update_sensor_grp_stream_cfg(
+			node->hw_mgr_intf.hw_mgr_priv, update_sensor_stream);
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "update_sensor_static data failed: %d", rc);
+
+	return rc;
+}
+
+static int __cam_node_handle_query_cap(uint32_t version,
+	struct cam_node *node, struct cam_query_cap_cmd *query)
+{
+	struct cam_hw_mgr_intf *hw_mgr_intf = &node->hw_mgr_intf;
+	int rc = 0;
+
+	if (!query) {
+		CAM_ERR(CAM_CORE, "Invalid params");
+		return -EINVAL;
+	}
+
+	switch (version) {
+	case CAM_QUERY_CAP:
+		if (!hw_mgr_intf->hw_get_caps) {
+			CAM_ERR(CAM_CORE, "Node %s query cap version: %u get hw cap intf is NULL",
+				node->name, version);
+			return -EINVAL;
+		}
+		rc = hw_mgr_intf->hw_get_caps(hw_mgr_intf->hw_mgr_priv, query);
+		break;
+	case CAM_QUERY_CAP_V2:
+		if (!hw_mgr_intf->hw_get_caps_v2) {
+			CAM_ERR(CAM_CORE, "Node %s query cap version: %u get hw cap intf is NULL",
+				node->name, version);
+			return -EINVAL;
+		}
+		rc = hw_mgr_intf->hw_get_caps_v2(hw_mgr_intf->hw_mgr_priv, query);
+		break;
+	default:
+		CAM_ERR(CAM_CORE, "Invalid version number %u", version);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int __cam_node_handle_acquire_dev(struct cam_node *node,
+	struct cam_acquire_dev_cmd *acquire)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!acquire)
+		return -EINVAL;
+
+	ctx = cam_node_get_ctxt_from_free_list(node);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE,
+			"No free ctx in free list node %s with size:%d",
+			node->name, node->ctx_size);
+		cam_node_print_ctx_state(node);
+
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	ctx->last_flush_req = 0;
+
+	rc = cam_handle_validate(acquire->session_handle, acquire->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for acquire dev");
+		goto free_ctx;
+	}
+
+	rc = cam_context_handle_acquire_dev(ctx, acquire);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Acquire device failed for node %s",
+			node->name);
+		goto free_ctx;
+	}
+
+	CAM_DBG(CAM_CORE, "[%s] Acquire ctx_id %d",
+		node->name, ctx->ctx_id);
+
+	return 0;
+free_ctx:
+	cam_context_putref(ctx);
+err:
+	return rc;
+}
+
+static void __cam_node_handle_acquired_hw_dump(
+	struct cam_node *node)
+{
+	int i;
+
+	for (i = 0; i < node->ctx_size; i++)
+		cam_context_handle_info_dump(&(node->ctx_list[i]),
+			CAM_CTX_DUMP_ACQ_INFO);
+}
+
+static int __cam_node_handle_acquire_hw_v1(struct cam_node *node,
+	struct cam_acquire_hw_cmd_v1 *acquire)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!acquire)
+		return -EINVAL;
+
+	rc = cam_handle_validate(acquire->session_handle, acquire->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return rc;
+	}
+
+	rc = cam_handle_validate(acquire->session_handle, acquire->dev_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return rc;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(acquire->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			acquire->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_acquire_hw(ctx, acquire);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Acquire device failed for node %s",
+			node->name);
+		__cam_node_handle_acquired_hw_dump(node);
+		return rc;
+	}
+
+	CAM_DBG(CAM_CORE, "[%s] Acquire ctx_id %d",
+		node->name, ctx->ctx_id);
+
+	return 0;
+}
+
+static int __cam_node_handle_acquire_hw_v2(struct cam_node *node,
+	struct cam_acquire_hw_cmd_v2 *acquire)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!acquire)
+		return -EINVAL;
+
+	rc = cam_handle_validate(acquire->session_handle, acquire->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return rc;
+	}
+
+	rc = cam_handle_validate(acquire->session_handle, acquire->dev_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return rc;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(acquire->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			acquire->dev_handle);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_acquire_hw(ctx, acquire);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Acquire device failed for node %s",
+			node->name);
+		__cam_node_handle_acquired_hw_dump(node);
+		return rc;
+	}
+
+	CAM_DBG(CAM_CORE, "[%s] Acquire ctx_id %d",
+		node->name, ctx->ctx_id);
+
+	return 0;
+}
+
+static int __cam_node_handle_start_dev(struct cam_node *node,
+	struct cam_start_stop_dev_cmd *start)
+{
+	struct cam_context *ctx = NULL;
+	int rc;
+
+	if (!start)
+		return -EINVAL;
+
+	rc = cam_handle_validate(start->session_handle, start->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return rc;
+	}
+
+	rc = cam_handle_validate(start->session_handle, start->dev_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return rc;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(start->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			start->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_start_dev(ctx, start);
+	if (rc)
+		CAM_ERR(CAM_CORE, "Start failure for node %s", node->name);
+
+	return rc;
+}
+
+static int __cam_node_handle_stop_dev(struct cam_node *node,
+	struct cam_start_stop_dev_cmd *stop)
+{
+	struct cam_context *ctx = NULL;
+	int rc;
+
+	if (!stop)
+		return -EINVAL;
+
+	rc = cam_handle_validate(stop->session_handle, stop->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return rc;
+	}
+
+	rc = cam_handle_validate(stop->session_handle, stop->dev_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return rc;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(stop->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			stop->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_stop_dev(ctx, stop);
+	if (rc)
+		CAM_ERR(CAM_CORE, "Stop failure for node %s", node->name);
+
+	return rc;
+}
+
+static int __cam_node_handle_config_dev(struct cam_node *node,
+	struct cam_config_dev_cmd *config)
+{
+	struct cam_context *ctx = NULL;
+	int rc;
+
+	if (!config)
+		return -EINVAL;
+
+	rc = cam_handle_validate(config->session_handle, config->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return rc;
+	}
+
+	rc = cam_handle_validate(config->session_handle, config->dev_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return rc;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(config->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			config->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_config_dev(ctx, config);
+	if (rc) {
+		if (ctx->state == CAM_CTX_FLUSHED)
+			CAM_INFO(CAM_CORE,
+				"Config failure for node %s, it has been flushed",
+				node->name);
+		else
+			CAM_ERR(CAM_CORE, "Config failure for node %s", node->name);
+	}
+	return rc;
+}
+
+static int __cam_node_handle_flush_dev(struct cam_node *node,
+	struct cam_flush_dev_cmd *flush)
+{
+	struct cam_context *ctx = NULL;
+	int rc;
+
+	if (!flush)
+		return -EINVAL;
+
+	rc = cam_handle_validate(flush->session_handle, flush->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return rc;
+	}
+
+	rc = cam_handle_validate(flush->session_handle, flush->dev_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return rc;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(flush->dev_handle);
+	if (!ctx) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Can not get context for handle %d",
+			flush->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_flush_dev(ctx, flush);
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Flush failure for node %s", node->name);
+
+	return rc;
+}
+
+static int __cam_node_handle_release_dev(struct cam_node *node,
+	struct cam_release_dev_cmd *release)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!release)
+		return -EINVAL;
+
+	rc = cam_handle_validate(release->session_handle, release->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return rc;
+	}
+
+	rc = cam_handle_validate(release->session_handle, release->dev_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return rc;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(release->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d node %s",
+			release->dev_handle, node->name);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	if (ctx->state > CAM_CTX_UNINIT && ctx->state < CAM_CTX_STATE_MAX) {
+		rc = cam_context_handle_release_dev(ctx, release);
+		if (rc)
+			CAM_ERR(CAM_CORE, "context release failed for node %s",
+				node->name);
+	} else {
+		CAM_WARN(CAM_CORE,
+			"node %s context id %u state %d invalid to release hdl",
+			node->name, ctx->ctx_id, ctx->state);
+		goto destroy_dev_hdl;
+	}
+
+	cam_context_putref(ctx);
+
+destroy_dev_hdl:
+	rc = cam_destroy_device_hdl(release->dev_handle);
+	if (rc)
+		CAM_ERR(CAM_CORE, "destroy device hdl failed for node %s",
+			node->name);
+	else
+		ctx->dev_hdl = -1;
+
+	CAM_DBG(CAM_CORE, "[%s] Release ctx_id=%d, refcount=%d",
+		node->name, ctx->ctx_id,
+		atomic_read(&(ctx->refcount.refcount.refs)));
+
+	return rc;
+}
+
+static int __cam_node_handle_dump_dev(struct cam_node *node,
+	struct cam_dump_req_cmd *dump)
+{
+	int                 rc;
+	struct cam_context *ctx = NULL;
+
+	if (!dump)
+		return -EINVAL;
+
+	rc = cam_handle_validate(dump->session_handle, dump->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return rc;
+	}
+
+	rc = cam_handle_validate(dump->session_handle, dump->dev_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return rc;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(dump->dev_handle);
+	if (!ctx) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Can not get context for handle %d",
+			dump->dev_handle);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_dump_dev(ctx, dump);
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Dump failure for node %s", node->name);
+
+	return rc;
+}
+
+static int __cam_node_handle_release_hw_v1(struct cam_node *node,
+	struct cam_release_hw_cmd_v1 *release)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!release)
+		return -EINVAL;
+
+	rc = cam_handle_validate(release->session_handle, release->session_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return rc;
+	}
+
+	rc = cam_handle_validate(release->session_handle, release->dev_handle);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return rc;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(release->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d node %s",
+			release->dev_handle, node->name);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_release_hw(ctx, release);
+	if (rc)
+		CAM_ERR(CAM_CORE, "context release failed node %s", node->name);
+
+	CAM_DBG(CAM_CORE, "[%s] Release ctx_id=%d, refcount=%d",
+		node->name, ctx->ctx_id,
+		atomic_read(&(ctx->refcount.refcount.refs)));
+
+	return rc;
+}
+
+static int __cam_node_crm_get_dev_info(struct cam_req_mgr_device_info *info)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!info)
+		return -EINVAL;
+
+	ctx = (struct cam_context *) cam_get_device_priv(info->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context  for handle %d",
+			info->dev_hdl);
+		return -EINVAL;
+	}
+	return cam_context_handle_crm_get_dev_info(ctx, info);
+}
+
+static int __cam_node_crm_link_setup(
+	struct cam_req_mgr_core_dev_link_setup *setup)
+{
+	int rc;
+	struct cam_context *ctx = NULL;
+
+	if (!setup)
+		return -EINVAL;
+
+	ctx = (struct cam_context *) cam_get_device_priv(setup->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			setup->dev_hdl);
+		return -EINVAL;
+	}
+
+	if (setup->link_enable)
+		rc = cam_context_handle_crm_link(ctx, setup);
+	else
+		rc = cam_context_handle_crm_unlink(ctx, setup);
+
+	return rc;
+}
+
+static int __cam_node_crm_apply_req(struct cam_req_mgr_apply_request *apply)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!apply)
+		return -EINVAL;
+
+	ctx = (struct cam_context *) cam_get_device_priv(apply->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			apply->dev_hdl);
+		return -EINVAL;
+	}
+
+	trace_cam_apply_req("Node", ctx->ctx_id, apply->request_id, apply->link_hdl);
+
+	return cam_context_handle_crm_apply_req(ctx, apply);
+}
+
+static int __cam_node_crm_notify_frame_skip(
+	struct cam_req_mgr_apply_request *apply)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!apply)
+		return -EINVAL;
+
+	ctx = (struct cam_context *) cam_get_device_priv(apply->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			apply->dev_hdl);
+		return -EINVAL;
+	}
+
+	trace_cam_apply_req("Node", ctx->ctx_id, apply->request_id, apply->link_hdl);
+
+	return cam_context_handle_crm_notify_frame_skip(ctx, apply);
+}
+
+static int __cam_node_crm_flush_req(struct cam_req_mgr_flush_request *flush)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!flush) {
+		CAM_ERR(CAM_CORE, "Invalid flush request payload");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *) cam_get_device_priv(flush->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			flush->dev_hdl);
+		return -EINVAL;
+	}
+
+	return cam_context_handle_crm_flush_req(ctx, flush);
+}
+
+static int __cam_node_crm_process_evt(
+	struct cam_req_mgr_link_evt_data *evt_data)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_CORE, "Invalid process event request payload");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *) cam_get_device_priv(evt_data->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			evt_data->dev_hdl);
+		return -EINVAL;
+	}
+	return cam_context_handle_crm_process_evt(ctx, evt_data);
+}
+
+static int __cam_node_crm_dump_req(struct cam_req_mgr_dump_info *dump)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!dump) {
+		CAM_ERR(CAM_CORE, "Invalid dump request payload");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *) cam_get_device_priv(dump->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			dump->dev_hdl);
+		return -EINVAL;
+	}
+
+	return cam_context_handle_crm_dump_req(ctx, dump);
+}
+
+int cam_node_deinit(struct cam_node *node)
+{
+	if (node)
+		memset(node, 0, sizeof(*node));
+
+	CAM_DBG(CAM_CORE, "deinit complete");
+
+	return 0;
+}
+
+int cam_node_shutdown(struct cam_node *node)
+{
+	int i = 0;
+	int rc = 0;
+
+	if (!node)
+		return -EINVAL;
+
+	for (i = 0; i < node->ctx_size; i++) {
+		if (node->ctx_list[i].dev_hdl > 0) {
+			rc = cam_context_shutdown(&(node->ctx_list[i]));
+			CAM_DBG(CAM_CORE,
+				"Node [%s] invoking shutdown on context [%d], rc %d",
+				node->name, i, rc);
+		}
+	}
+
+	if (node->hw_mgr_intf.hw_close)
+		node->hw_mgr_intf.hw_close(node->hw_mgr_intf.hw_mgr_priv,
+			NULL);
+
+	return 0;
+}
+
+static int __cam_node_handle_synx_test(
+	struct cam_node *node, void *params)
+{
+	int i, rc = -EINVAL;
+
+	for (i = 0; i < node->ctx_size; i++) {
+		if (node->ctx_list[i].dev_hdl > 0) {
+			CAM_ERR(CAM_CORE, "Node [%s] has active context [%d]",
+				node->name, i);
+			return -EAGAIN;
+		}
+	}
+
+	if (node->hw_mgr_intf.synx_trigger)
+		rc = node->hw_mgr_intf.synx_trigger(
+			node->hw_mgr_intf.hw_mgr_priv, params);
+
+	return rc;
+}
+
+int cam_node_init(struct cam_node *node, struct cam_hw_mgr_intf *hw_mgr_intf,
+	struct cam_context *ctx_list, uint32_t ctx_size, char *name)
+{
+	int rc = 0;
+	int i;
+
+	if (!node || !hw_mgr_intf ||
+		sizeof(node->hw_mgr_intf) != sizeof(*hw_mgr_intf)) {
+		return -EINVAL;
+	}
+
+	strscpy(node->name, name, sizeof(node->name));
+
+	memcpy(&node->hw_mgr_intf, hw_mgr_intf, sizeof(node->hw_mgr_intf));
+	node->crm_node_intf.apply_req = __cam_node_crm_apply_req;
+	node->crm_node_intf.get_dev_info = __cam_node_crm_get_dev_info;
+	node->crm_node_intf.link_setup = __cam_node_crm_link_setup;
+	node->crm_node_intf.flush_req = __cam_node_crm_flush_req;
+	node->crm_node_intf.process_evt = __cam_node_crm_process_evt;
+	node->crm_node_intf.dump_req = __cam_node_crm_dump_req;
+	node->crm_node_intf.notify_frame_skip =
+		__cam_node_crm_notify_frame_skip;
+
+	mutex_init(&node->list_mutex);
+	INIT_LIST_HEAD(&node->free_ctx_list);
+	node->ctx_list = ctx_list;
+	node->ctx_size = ctx_size;
+	for (i = 0; i < ctx_size; i++) {
+		if (!ctx_list[i].state_machine) {
+			CAM_ERR(CAM_CORE,
+				"camera context %d is not initialized", i);
+			rc = -1;
+			goto err;
+		}
+		INIT_LIST_HEAD(&ctx_list[i].list);
+		list_add_tail(&ctx_list[i].list, &node->free_ctx_list);
+		ctx_list[i].node = node;
+	}
+
+	node->state = CAM_NODE_STATE_INIT;
+err:
+	CAM_DBG(CAM_CORE, "Exit. (rc = %d)", rc);
+	return rc;
+}
+
+int cam_node_handle_ioctl(struct cam_node *node, struct cam_control *cmd)
+{
+	int rc = 0;
+
+	if (!cmd)
+		return -EINVAL;
+
+	CAM_DBG(CAM_CORE, "handle cmd %d", cmd->op_code);
+
+	switch (cmd->op_code) {
+	case CAM_QUERY_CAP:
+		fallthrough;
+	case CAM_QUERY_CAP_V2: {
+		struct cam_query_cap_cmd query;
+
+		if (copy_from_user(&query, u64_to_user_ptr(cmd->handle),
+			sizeof(query))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = __cam_node_handle_query_cap(cmd->op_code, node, &query);
+		if (rc) {
+			CAM_ERR(CAM_CORE, "querycap is failed(rc = %d)",
+				rc);
+			break;
+		}
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle), &query, sizeof(query)))
+			rc = -EFAULT;
+
+		break;
+	}
+	case CAM_ACQUIRE_DEV: {
+		struct cam_acquire_dev_cmd acquire;
+
+		if (copy_from_user(&acquire, u64_to_user_ptr(cmd->handle),
+			sizeof(acquire))) {
+			rc = -EFAULT;
+			break;
+		}
+		rc = __cam_node_handle_acquire_dev(node, &acquire);
+		if (rc) {
+			CAM_ERR(CAM_CORE, "acquire device failed(rc = %d)",
+				rc);
+			break;
+		}
+		if (copy_to_user(u64_to_user_ptr(cmd->handle), &acquire,
+			sizeof(acquire)))
+			rc = -EFAULT;
+		break;
+	}
+	case CAM_ACQUIRE_HW: {
+		uint32_t api_version;
+		void *acquire_ptr = NULL;
+		size_t acquire_size;
+
+		if (copy_from_user(&api_version, (void __user *)cmd->handle,
+			sizeof(api_version))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		if (api_version == 1) {
+			acquire_size = sizeof(struct cam_acquire_hw_cmd_v1);
+		} else if (api_version == 2) {
+			acquire_size = sizeof(struct cam_acquire_hw_cmd_v2);
+		} else {
+			CAM_ERR(CAM_CORE, "Unsupported api version %d",
+				api_version);
+			rc = -EINVAL;
+			break;
+		}
+
+		acquire_ptr = kzalloc(acquire_size, GFP_KERNEL);
+		if (!acquire_ptr) {
+			CAM_ERR(CAM_CORE, "No memory for acquire HW");
+			rc = -ENOMEM;
+			break;
+		}
+
+		if (copy_from_user(acquire_ptr, (void __user *)cmd->handle,
+			acquire_size)) {
+			rc = -EFAULT;
+			goto acquire_kfree;
+		}
+
+		if (api_version == 1) {
+			rc = __cam_node_handle_acquire_hw_v1(node, acquire_ptr);
+			if (rc) {
+				CAM_ERR(CAM_CORE,
+					"acquire hw failed(rc = %d)", rc);
+				goto acquire_kfree;
+			}
+		} else if (api_version == 2) {
+			rc = __cam_node_handle_acquire_hw_v2(node, acquire_ptr);
+			if (rc) {
+				CAM_ERR(CAM_CORE,
+					"acquire hw failed(rc = %d)", rc);
+				goto acquire_kfree;
+			}
+		}
+
+		if (copy_to_user((void __user *)cmd->handle, acquire_ptr,
+			acquire_size))
+			rc = -EFAULT;
+
+acquire_kfree:
+		kfree(acquire_ptr);
+		break;
+	}
+	case CAM_START_DEV: {
+		struct cam_start_stop_dev_cmd start;
+
+		if (copy_from_user(&start, u64_to_user_ptr(cmd->handle),
+			sizeof(start)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_start_dev(node, &start);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"start device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_STOP_DEV: {
+		struct cam_start_stop_dev_cmd stop;
+
+		if (copy_from_user(&stop, u64_to_user_ptr(cmd->handle),
+			sizeof(stop)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_stop_dev(node, &stop);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"stop device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_CONFIG_DEV: {
+		struct cam_config_dev_cmd config;
+
+		if (copy_from_user(&config, u64_to_user_ptr(cmd->handle),
+			sizeof(config)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_config_dev(node, &config);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"config device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_RELEASE_DEV: {
+		struct cam_release_dev_cmd release;
+
+		if (copy_from_user(&release, u64_to_user_ptr(cmd->handle),
+			sizeof(release)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_release_dev(node, &release);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"release device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_RELEASE_HW: {
+		uint32_t api_version;
+		size_t release_size;
+		void *release_ptr = NULL;
+
+		if (copy_from_user(&api_version, (void __user *)cmd->handle,
+			sizeof(api_version))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		if (api_version == 1) {
+			release_size = sizeof(struct cam_release_hw_cmd_v1);
+		} else {
+			CAM_ERR(CAM_CORE, "Unsupported api version %d",
+				api_version);
+			rc = -EINVAL;
+			break;
+		}
+
+		release_ptr = kzalloc(release_size, GFP_KERNEL);
+		if (!release_ptr) {
+			CAM_ERR(CAM_CORE, "No memory for release HW");
+			rc = -ENOMEM;
+			break;
+		}
+
+		if (copy_from_user(release_ptr, (void __user *)cmd->handle,
+			release_size)) {
+			rc = -EFAULT;
+			goto release_kfree;
+		}
+
+		if (api_version == 1) {
+			rc = __cam_node_handle_release_hw_v1(node, release_ptr);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"release device failed(rc = %d)", rc);
+		}
+
+release_kfree:
+		kfree(release_ptr);
+		break;
+	}
+	case CAM_FLUSH_REQ: {
+		struct cam_flush_dev_cmd flush;
+
+		if (copy_from_user(&flush, u64_to_user_ptr(cmd->handle),
+			sizeof(flush)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_flush_dev(node, &flush);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"flush device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_DUMP_REQ: {
+		struct cam_dump_req_cmd dump;
+
+		if (copy_from_user(&dump, u64_to_user_ptr(cmd->handle),
+			sizeof(dump))) {
+			rc = -EFAULT;
+			break;
+		}
+		rc = __cam_node_handle_dump_dev(node, &dump);
+		if (rc) {
+			CAM_ERR(CAM_CORE,
+			    "Dump device %s failed(rc = %d) ",
+			    node->name, rc);
+			break;
+		}
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&dump, sizeof(dump))) {
+			CAM_ERR(CAM_CORE,
+			    "Dump device %s copy_to_user fail",
+			    node->name);
+			rc = -EFAULT;
+		}
+		break;
+	}
+	case CAM_SYNX_TEST_TRIGGER: {
+		struct cam_synx_test_params synx_params;
+
+		if (copy_from_user(&synx_params, u64_to_user_ptr(cmd->handle),
+			sizeof(synx_params))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = __cam_node_handle_synx_test(node, &synx_params);
+		if (rc)
+			CAM_ERR(CAM_CORE, "Synx test on %s failed(rc = %d)",
+			    node->name, rc);
+		break;
+	}
+	case CAM_UPDATE_SENSOR_STREAM_CONFIG: {
+		struct cam_update_sensor_stream_cfg_cmd update_sensor_stream;
+
+		if (copy_from_user(&update_sensor_stream, u64_to_user_ptr(cmd->handle),
+			sizeof(update_sensor_stream)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_update_sensor_stream_cap(node,
+				&update_sensor_stream);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"update sensor stream config failed(rc = %d)", rc);
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_CORE, "Unknown op code %d", cmd->op_code);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_node.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_node.h
@@ -0,0 +1,123 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_NODE_H_
+#define _CAM_NODE_H_
+
+#include <linux/kref.h>
+#include "cam_context.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_interface.h"
+
+
+#define CAM_NODE_STATE_UNINIT           0
+#define CAM_NODE_STATE_INIT             1
+
+/**
+ * struct cam_node - Singleton Node for camera HW devices
+ *
+ * @name:                  Name for struct cam_node
+ * @state:                 Node state:
+ *                         0 = uninitialized, 1 = initialized
+ * @device_idx:            Index to identify which device this node belongs to
+ * @list_mutex:            Mutex for the context pool
+ * @free_ctx_list:         Free context pool list
+ * @ctx_list:              Context list
+ * @ctx_size:              Context list size
+ * @hw_mgr_intf:           Interface for cam_node to HW
+ * @crm_node_intf:         Interface for the CRM to cam_node
+ * @sd_handler:            Shutdown handler for this subdev
+ *
+ */
+struct cam_node {
+	char                              name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	uint32_t                          state;
+	uint32_t                          device_idx;
+
+	/* context pool */
+	struct mutex                      list_mutex;
+	struct list_head                  free_ctx_list;
+	struct cam_context               *ctx_list;
+	uint32_t                          ctx_size;
+
+	/* interfaces */
+	struct cam_hw_mgr_intf            hw_mgr_intf;
+	struct cam_req_mgr_kmd_ops        crm_node_intf;
+
+	int (*sd_handler)(struct v4l2_subdev *sd,
+		struct v4l2_subdev_fh *fh);
+};
+
+/**
+ * cam_node_handle_ioctl()
+ *
+ * @brief:       Handle ioctl commands
+ *
+ * @node:                  Node handle
+ * @cmd:                   IOCTL command
+ *
+ */
+int cam_node_handle_ioctl(struct cam_node *node, struct cam_control *cmd);
+
+/**
+ * cam_node_deinit()
+ *
+ * @brief:       Deinitialization function for the Node interface
+ *
+ * @node:                  Node handle
+ *
+ */
+int cam_node_deinit(struct cam_node *node);
+
+/**
+ * cam_node_shutdown()
+ *
+ * @brief:       Shutdowns/Closes the cam node.
+ *
+ * @node:                  Cam_node pointer
+ *
+ */
+int cam_node_shutdown(struct cam_node *node);
+
+/**
+ * cam_node_init()
+ *
+ * @brief:       Initialization function for the Node interface.
+ *
+ * @node:                  Cam_node pointer
+ * @hw_mgr_intf:           HW manager interface blob
+ * @ctx_list:              List of cam_contexts to be added
+ * @ctx_size:              Size of the cam_context
+ * @name:                  Name for the node
+ *
+ */
+int cam_node_init(struct cam_node *node, struct cam_hw_mgr_intf *hw_mgr_intf,
+	struct cam_context *ctx_list, uint32_t ctx_size, char *name);
+
+/**
+ * cam_node_put_ctxt_to_free_list()
+ *
+ * @brief:       Put context in node free list.
+ *
+ * @ref:         Context's kref object
+ *
+ */
+void cam_node_put_ctxt_to_free_list(struct kref *ref);
+
+/**
+ * cam_get_dev_handle_info()
+ *
+ * @brief:       provides the active dev index.
+ *
+ * @handle:      pointer to struct v4l2_dev
+ * @ctx:         pointer to struct cam_context
+ * @dev_index:   dev index
+ *
+ */
+int32_t cam_get_dev_handle_info(uint64_t handle,
+	struct cam_context **ctx, int32_t dev_index);
+
+#endif /* _CAM_NODE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_core/cam_subdev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_core/cam_subdev.c
@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2018, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_debug_util.h"
+
+/**
+ * cam_subdev_subscribe_event()
+ *
+ * @brief: function to subscribe to v4l2 events
+ *
+ * @sd:                    Pointer to struct v4l2_subdev.
+ * @fh:                    Pointer to struct v4l2_fh.
+ * @sub:                   Pointer to struct v4l2_event_subscription.
+ */
+static int cam_subdev_subscribe_event(struct v4l2_subdev *sd,
+	struct v4l2_fh *fh,
+	struct v4l2_event_subscription *sub)
+{
+	return v4l2_event_subscribe(fh, sub, CAM_SUBDEVICE_EVENT_MAX, NULL);
+}
+
+/**
+ * cam_subdev_unsubscribe_event()
+ *
+ * @brief: function to unsubscribe from v4l2 events
+ *
+ * @sd:                    Pointer to struct v4l2_subdev.
+ * @fh:                    Pointer to struct v4l2_fh.
+ * @sub:                   Pointer to struct v4l2_event_subscription.
+ */
+static int cam_subdev_unsubscribe_event(struct v4l2_subdev *sd,
+	struct v4l2_fh *fh,
+	struct v4l2_event_subscription *sub)
+{
+	return v4l2_event_unsubscribe(fh, sub);
+}
+
+static long cam_subdev_ioctl(struct v4l2_subdev *sd, unsigned int cmd,
+	void *arg)
+{
+	long rc;
+	struct cam_node *node =
+		(struct cam_node *) v4l2_get_subdevdata(sd);
+	struct v4l2_subdev_fh *fh = (struct v4l2_subdev_fh *)arg;
+
+	if (!node || node->state == CAM_NODE_STATE_UNINIT) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+		rc = cam_node_handle_ioctl(node,
+			(struct cam_control *) arg);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_WARN(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		if (!node->sd_handler) {
+			CAM_ERR(CAM_CORE,
+				"No shutdown routine for %s", node->name);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		CAM_DBG(CAM_CORE, "Shutdown for %s from media device", node->name);
+		rc = node->sd_handler(sd, fh);
+		if (rc)
+			CAM_ERR(CAM_CORE,
+				"shutdown device failed(rc = %d) for %s",
+				rc, node->name);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_CORE, "Invalid command %d for %s", cmd,
+			node->name);
+		rc = -EINVAL;
+	}
+end:
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_subdev_compat_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int rc;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_CORE, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+	rc = cam_subdev_ioctl(sd, cmd, &cmd_data);
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_CORE,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+const struct v4l2_subdev_core_ops cam_subdev_core_ops = {
+	.ioctl = cam_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_subdev_compat_ioctl,
+#endif
+	.subscribe_event = cam_subdev_subscribe_event,
+	.unsubscribe_event = cam_subdev_unsubscribe_event,
+};
+
+static const struct v4l2_subdev_ops cam_subdev_ops = {
+	.core = &cam_subdev_core_ops,
+};
+
+int cam_subdev_remove(struct cam_subdev *sd)
+{
+	if (!sd)
+		return -EINVAL;
+
+	cam_node_deinit((struct cam_node *)sd->token);
+	kfree(sd->token);
+	memset(sd, 0, sizeof(struct cam_subdev));
+
+	return 0;
+}
+
+int cam_subdev_probe(struct cam_subdev *sd, struct platform_device *pdev,
+	char *name, uint32_t dev_type)
+{
+	int rc = 0;
+	struct cam_node *node = NULL;
+
+	if (!sd || !pdev || !name) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	node = kzalloc(sizeof(*node), GFP_KERNEL);
+	if (!node) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	/* Setup camera v4l2 subdevice */
+	sd->pdev = pdev;
+	sd->name = name;
+	sd->ops = &cam_subdev_ops;
+	sd->token = node;
+	sd->sd_flags =
+		V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+	sd->ent_function = dev_type;
+end:
+	return rc;
+}
+
+int cam_subdev_register(struct cam_subdev *sd, struct platform_device *pdev)
+{
+	int rc;
+
+	if (!sd || !pdev)
+		return -EINVAL;
+
+	rc = cam_register_subdev(sd);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "cam_register_subdev() failed for dev: %s",
+			sd->name);
+		goto end;
+	}
+	platform_set_drvdata(sd->pdev, sd);
+end:
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_hw.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_hw.c
@@ -0,0 +1,4904 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/pm_opp.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+
+#include "cam_cpas_hw.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_soc.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_smmu_api.h"
+#include "cam_compat.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_req_mgr_interface.h"
+
+#define CAM_CPAS_LOG_BUF_LEN      512
+#define CAM_CPAS_APPLY_TYPE_START  1
+#define CAM_CPAS_APPLY_TYPE_STOP   2
+#define CAM_CPAS_APPLY_TYPE_UPDATE 3
+
+static uint cam_min_camnoc_ib_bw;
+module_param(cam_min_camnoc_ib_bw, uint, 0644);
+
+static void cam_cpas_update_monitor_array(struct cam_hw_info *cpas_hw,
+	const char *identifier_string, int32_t identifier_value);
+static void cam_cpas_dump_monitor_array(
+	struct cam_hw_info *cpas_hw);
+static int cam_cpas_log_vote(struct cam_hw_info *cpas_hw, bool ddr_only);
+
+static struct cam_cpas_subpart_info g_cam_cpas_camera_subpart_info = {
+	.num_bits = 8,
+	/*
+	 * Below fuse indexing is based on software fuse definition which is in SMEM and provided
+	 * by XBL team.
+	 */
+	.hw_bitmap_mask = {
+		{CAM_CPAS_CAM_FUSE, BIT(0)},
+		{CAM_CPAS_ISP_FUSE, BIT(0)},
+		{CAM_CPAS_ISP_FUSE, BIT(1)},
+		{CAM_CPAS_ISP_FUSE, BIT(2)},
+		{CAM_CPAS_SFE_FUSE, BIT(0)},
+		{CAM_CPAS_SFE_FUSE, BIT(1)},
+		{CAM_CPAS_SFE_FUSE, BIT(2)},
+		{CAM_CPAS_CUSTOM_FUSE, BIT(0)},
+	}
+};
+
+static void cam_cpas_process_drv_bw_overrides(
+	struct cam_cpas_bus_client *bus_client, uint64_t *high_ab, uint64_t *high_ib,
+	uint64_t *low_ab, uint64_t *low_ib, const struct cam_cpas_debug_settings *cpas_settings)
+{
+	uint64_t curr_ab_high = *high_ab;
+	uint64_t curr_ib_high = *high_ib;
+	uint64_t curr_ab_low = *low_ab;
+	uint64_t curr_ib_low = *low_ib;
+	size_t name_len = strlen(bus_client->common_data.name);
+
+	if (!cpas_settings) {
+		CAM_ERR(CAM_CPAS, "Invalid cpas debug settings");
+		return;
+	}
+
+	if (strnstr(bus_client->common_data.name, "cam_ife_0_drv",
+		name_len)) {
+		if (cpas_settings->cam_ife_0_drv_ab_high_bw)
+			*high_ab = cpas_settings->cam_ife_0_drv_ab_high_bw;
+		if (cpas_settings->cam_ife_0_drv_ib_high_bw)
+			*high_ib = cpas_settings->cam_ife_0_drv_ib_high_bw;
+		if (cpas_settings->cam_ife_0_drv_ab_low_bw)
+			*low_ab = cpas_settings->cam_ife_0_drv_ab_low_bw;
+		if (cpas_settings->cam_ife_0_drv_ib_low_bw)
+			*low_ib = cpas_settings->cam_ife_0_drv_ib_low_bw;
+		if (cpas_settings->cam_ife_0_drv_low_set_zero) {
+			*low_ab = 0;
+			*low_ib = 0;
+		}
+	} else if (strnstr(bus_client->common_data.name, "cam_ife_1_drv",
+		name_len)) {
+		if (cpas_settings->cam_ife_1_drv_ab_high_bw)
+			*high_ab = cpas_settings->cam_ife_1_drv_ab_high_bw;
+		if (cpas_settings->cam_ife_1_drv_ib_high_bw)
+			*high_ib = cpas_settings->cam_ife_1_drv_ib_high_bw;
+		if (cpas_settings->cam_ife_1_drv_ab_low_bw)
+			*low_ab = cpas_settings->cam_ife_1_drv_ab_low_bw;
+		if (cpas_settings->cam_ife_1_drv_ib_low_bw)
+			*low_ib = cpas_settings->cam_ife_1_drv_ib_low_bw;
+		if (cpas_settings->cam_ife_1_drv_low_set_zero) {
+			*low_ab = 0;
+			*low_ib = 0;
+		}
+	} else if (strnstr(bus_client->common_data.name, "cam_ife_2_drv",
+		name_len)) {
+		if (cpas_settings->cam_ife_2_drv_ab_high_bw)
+			*high_ab = cpas_settings->cam_ife_2_drv_ab_high_bw;
+		if (cpas_settings->cam_ife_2_drv_ib_high_bw)
+			*high_ib = cpas_settings->cam_ife_2_drv_ib_high_bw;
+		if (cpas_settings->cam_ife_2_drv_ab_low_bw)
+			*low_ab = cpas_settings->cam_ife_2_drv_ab_low_bw;
+		if (cpas_settings->cam_ife_2_drv_ib_low_bw)
+			*low_ib = cpas_settings->cam_ife_2_drv_ib_low_bw;
+		if (cpas_settings->cam_ife_2_drv_low_set_zero) {
+			*low_ab = 0;
+			*low_ib = 0;
+		}
+	} else {
+		CAM_ERR(CAM_CPAS, "unknown mnoc port: %s, bw override failed",
+			bus_client->common_data.name);
+		return;
+	}
+
+	CAM_INFO(CAM_CPAS,
+		"Overriding mnoc bw for: %s with [AB IB] high: [%llu %llu], low: [%llu %llu], curr high: [%llu %llu], curr low: [%llu %llu]",
+		bus_client->common_data.name, *high_ab, *high_ib, *low_ab, *low_ib,
+		curr_ab_high, curr_ib_high, curr_ab_low, curr_ib_low);
+}
+
+static void cam_cpas_process_bw_overrides(
+	struct cam_cpas_bus_client *bus_client, uint64_t *ab, uint64_t *ib,
+	const struct cam_cpas_debug_settings *cpas_settings)
+{
+	uint64_t curr_ab = *ab;
+	uint64_t curr_ib = *ib;
+	size_t name_len = strlen(bus_client->common_data.name);
+
+	if (!cpas_settings) {
+		CAM_ERR(CAM_CPAS, "Invalid cpas debug settings");
+		return;
+	}
+
+	if (strnstr(bus_client->common_data.name, "cam_hf_0", name_len)) {
+		if (cpas_settings->mnoc_hf_0_ab_bw)
+			*ab = cpas_settings->mnoc_hf_0_ab_bw;
+		if (cpas_settings->mnoc_hf_0_ib_bw)
+			*ib = cpas_settings->mnoc_hf_0_ib_bw;
+	} else if (strnstr(bus_client->common_data.name, "cam_hf_1",
+		name_len)) {
+		if (cpas_settings->mnoc_hf_1_ab_bw)
+			*ab = cpas_settings->mnoc_hf_1_ab_bw;
+		if (cpas_settings->mnoc_hf_1_ib_bw)
+			*ib = cpas_settings->mnoc_hf_1_ib_bw;
+	} else if (strnstr(bus_client->common_data.name, "cam_sf_0",
+		name_len)) {
+		if (cpas_settings->mnoc_sf_0_ab_bw)
+			*ab = cpas_settings->mnoc_sf_0_ab_bw;
+		if (cpas_settings->mnoc_sf_0_ib_bw)
+			*ib = cpas_settings->mnoc_sf_0_ib_bw;
+	} else if (strnstr(bus_client->common_data.name, "cam_sf_1",
+		name_len)) {
+		if (cpas_settings->mnoc_sf_1_ab_bw)
+			*ab = cpas_settings->mnoc_sf_1_ab_bw;
+		if (cpas_settings->mnoc_sf_1_ib_bw)
+			*ib = cpas_settings->mnoc_sf_1_ib_bw;
+	} else if (strnstr(bus_client->common_data.name, "cam_sf_icp",
+		name_len)) {
+		if (cpas_settings->mnoc_sf_icp_ab_bw)
+			*ab = cpas_settings->mnoc_sf_icp_ab_bw;
+		if (cpas_settings->mnoc_sf_icp_ib_bw)
+			*ib = cpas_settings->mnoc_sf_icp_ib_bw;
+	} else {
+		CAM_ERR(CAM_CPAS, "unknown mnoc port: %s, bw override failed",
+			bus_client->common_data.name);
+		return;
+	}
+
+	CAM_INFO(CAM_CPAS,
+		"Overriding mnoc bw for: %s with ab: %llu, ib: %llu, curr_ab: %llu, curr_ib: %llu",
+		bus_client->common_data.name, *ab, *ib, curr_ab, curr_ib);
+}
+
+int cam_cpas_util_reg_read(struct cam_hw_info *cpas_hw,
+	enum cam_cpas_reg_base reg_base, struct cam_cpas_reg *reg_info)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	uint32_t value;
+	int reg_base_index;
+
+	if (!reg_info->enable)
+		return 0;
+
+	reg_base_index = cpas_core->regbase_index[reg_base];
+	if (reg_base_index == -1)
+		return -EINVAL;
+
+	value = cam_io_r_mb(
+		soc_info->reg_map[reg_base_index].mem_base + reg_info->offset);
+
+	CAM_INFO(CAM_CPAS, "Base[%d] Offset[0x%08x] Value[0x%08x]",
+		reg_base, reg_info->offset, value);
+
+	return 0;
+}
+
+int cam_cpas_util_reg_update(struct cam_hw_info *cpas_hw,
+	enum cam_cpas_reg_base reg_base, struct cam_cpas_reg *reg_info)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	uint32_t value;
+	int reg_base_index;
+
+	if (reg_info->enable == false)
+		return 0;
+
+	reg_base_index = cpas_core->regbase_index[reg_base];
+	if (reg_base_index == -1)
+		return -EINVAL;
+
+	if (reg_info->masked_value) {
+		value = cam_io_r_mb(
+			soc_info->reg_map[reg_base_index].mem_base +
+			reg_info->offset);
+		value = value & (~reg_info->mask);
+		value = value | (reg_info->value << reg_info->shift);
+	} else {
+		value = reg_info->value;
+	}
+
+	CAM_DBG(CAM_CPAS, "Base[%d]:[0x%08x] Offset[0x%08x] Value[0x%08x]",
+		reg_base, soc_info->reg_map[reg_base_index].mem_base, reg_info->offset, value);
+
+	cam_io_w_mb(value, soc_info->reg_map[reg_base_index].mem_base +
+		reg_info->offset);
+
+	return 0;
+}
+
+static int cam_cpas_util_vote_bus_client_level(
+	struct cam_cpas_bus_client *bus_client, unsigned int level)
+{
+	int rc = 0;
+
+	if (!bus_client->valid) {
+		CAM_ERR(CAM_CPAS, "bus client not valid");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (level >= CAM_MAX_VOTE) {
+		CAM_ERR(CAM_CPAS,
+			"Invalid votelevel=%d,usecases=%d,Bus client=[%s]",
+			level, bus_client->common_data.num_usecases,
+			bus_client->common_data.name);
+		return -EINVAL;
+	}
+
+	if (level == bus_client->curr_vote_level)
+		goto end;
+
+	rc = cam_soc_bus_client_update_request(bus_client->soc_bus_client,
+		level);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Client: %s update request failed rc: %d",
+			bus_client->common_data.name, rc);
+		goto end;
+	}
+	bus_client->curr_vote_level = level;
+
+end:
+	return rc;
+}
+
+static int cam_cpas_util_vote_drv_bus_client_bw(struct cam_cpas_bus_client *bus_client,
+	struct cam_cpas_axi_bw_info *curr_vote, struct cam_cpas_axi_bw_info *applied_vote)
+{
+	int rc = 0;
+	const struct camera_debug_settings *cam_debug = NULL;
+
+	if (!bus_client->valid) {
+		CAM_ERR(CAM_CPAS, "bus client: %s not valid",
+			bus_client->common_data.name);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&bus_client->lock);
+	if ((curr_vote->drv_vote.high.ab > 0) &&
+		(curr_vote->drv_vote.high.ab < CAM_CPAS_AXI_MIN_MNOC_AB_BW))
+		curr_vote->drv_vote.high.ab = CAM_CPAS_AXI_MIN_MNOC_AB_BW;
+
+	if ((curr_vote->drv_vote.high.ib > 0) &&
+		(curr_vote->drv_vote.high.ib < CAM_CPAS_AXI_MIN_MNOC_IB_BW))
+		curr_vote->drv_vote.high.ib = CAM_CPAS_AXI_MIN_MNOC_IB_BW;
+
+	if ((curr_vote->drv_vote.low.ab > 0) &&
+		(curr_vote->drv_vote.low.ab < CAM_CPAS_AXI_MIN_MNOC_AB_BW))
+		curr_vote->drv_vote.low.ab = CAM_CPAS_AXI_MIN_MNOC_AB_BW;
+
+	if ((curr_vote->drv_vote.low.ib > 0) &&
+		(curr_vote->drv_vote.low.ib < CAM_CPAS_AXI_MIN_MNOC_IB_BW))
+		curr_vote->drv_vote.low.ib = CAM_CPAS_AXI_MIN_MNOC_IB_BW;
+
+	cam_debug = cam_debug_get_settings();
+
+	if ((curr_vote->drv_vote.high.ab || curr_vote->drv_vote.high.ib ||
+		curr_vote->drv_vote.low.ab || curr_vote->drv_vote.low.ib) &&
+		cam_debug && cam_debug->cpas_settings.is_updated)
+		cam_cpas_process_drv_bw_overrides(bus_client, &curr_vote->drv_vote.high.ab,
+			&curr_vote->drv_vote.high.ib, &curr_vote->drv_vote.low.ab,
+			&curr_vote->drv_vote.low.ib, &cam_debug->cpas_settings);
+
+	if (debug_drv)
+		CAM_INFO(CAM_CPAS, "Bus_client: %s, DRV vote high=[%llu %llu] low=[%llu %llu]",
+			bus_client->common_data.name, curr_vote->drv_vote.high.ab,
+			curr_vote->drv_vote.high.ib, curr_vote->drv_vote.low.ab,
+			curr_vote->drv_vote.low.ib);
+
+	CAM_DBG(CAM_CPAS, "Bus_client: %s, DRV vote high=[%llu %llu] low=[%llu %llu]",
+		bus_client->common_data.name, curr_vote->drv_vote.high.ab,
+		curr_vote->drv_vote.high.ib, curr_vote->drv_vote.low.ab,
+		curr_vote->drv_vote.low.ib);
+
+	rc = cam_soc_bus_client_update_bw(bus_client->soc_bus_client, curr_vote->drv_vote.high.ab,
+		curr_vote->drv_vote.high.ib, CAM_SOC_BUS_PATH_DATA_DRV_HIGH);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Update bw failed, Bus path: %s ab[%llu] ib[%llu]",
+			cam_soc_bus_path_data_to_str(CAM_SOC_BUS_PATH_DATA_DRV_HIGH),
+			curr_vote->drv_vote.high.ab, curr_vote->drv_vote.high.ib);
+		goto unlock_client;
+	}
+
+	rc = cam_soc_bus_client_update_bw(bus_client->soc_bus_client, curr_vote->drv_vote.low.ab,
+		curr_vote->drv_vote.low.ib, CAM_SOC_BUS_PATH_DATA_DRV_LOW);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Update bw failed, Bus path: %s ab[%llu] ib[%llu]",
+			cam_soc_bus_path_data_to_str(CAM_SOC_BUS_PATH_DATA_DRV_LOW),
+			curr_vote->drv_vote.low.ab, curr_vote->drv_vote.low.ib);
+		goto unlock_client;
+	}
+
+	if (applied_vote)
+		memcpy(applied_vote, curr_vote, sizeof(struct cam_cpas_axi_bw_info));
+
+unlock_client:
+	mutex_unlock(&bus_client->lock);
+end:
+	return rc;
+}
+
+static int cam_cpas_util_vote_hlos_bus_client_bw(
+	struct cam_cpas_bus_client *bus_client, uint64_t ab, uint64_t ib,
+	bool is_camnoc_bw, uint64_t *applied_ab, uint64_t *applied_ib)
+{
+	int rc = 0;
+	uint64_t min_camnoc_ib_bw = CAM_CPAS_AXI_MIN_CAMNOC_IB_BW;
+	const struct camera_debug_settings *cam_debug = NULL;
+
+	if (!bus_client->valid) {
+		CAM_ERR(CAM_CPAS, "bus client: %s not valid",
+			bus_client->common_data.name);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cam_min_camnoc_ib_bw > 0)
+		min_camnoc_ib_bw = (uint64_t)cam_min_camnoc_ib_bw * 1000000L;
+
+	CAM_DBG(CAM_CPAS,
+		"Bus_client: %s, cam_min_camnoc_ib_bw = %d, min_camnoc_ib_bw=%llu",
+		bus_client->common_data.name, cam_min_camnoc_ib_bw,
+		min_camnoc_ib_bw);
+
+	mutex_lock(&bus_client->lock);
+	if (is_camnoc_bw) {
+		if ((ab > 0) && (ab < CAM_CPAS_AXI_MIN_CAMNOC_AB_BW))
+			ab = CAM_CPAS_AXI_MIN_CAMNOC_AB_BW;
+
+		if ((ib > 0) && (ib < min_camnoc_ib_bw))
+			ib = min_camnoc_ib_bw;
+	} else {
+		if ((ab > 0) && (ab < CAM_CPAS_AXI_MIN_MNOC_AB_BW))
+			ab = CAM_CPAS_AXI_MIN_MNOC_AB_BW;
+
+		if ((ib > 0) && (ib < CAM_CPAS_AXI_MIN_MNOC_IB_BW))
+			ib = CAM_CPAS_AXI_MIN_MNOC_IB_BW;
+	}
+
+	cam_debug = cam_debug_get_settings();
+
+	if ((ab || ib) && cam_debug && cam_debug->cpas_settings.is_updated)
+		cam_cpas_process_bw_overrides(bus_client, &ab, &ib,
+			&cam_debug->cpas_settings);
+
+	rc = cam_soc_bus_client_update_bw(bus_client->soc_bus_client, ab, ib,
+		CAM_SOC_BUS_PATH_DATA_HLOS);
+	if (rc) {
+		CAM_ERR(CAM_CPAS,
+			"Update bw failed, Bus path %s ab[%llu] ib[%llu]",
+			cam_soc_bus_path_data_to_str(CAM_SOC_BUS_PATH_DATA_HLOS), ab, ib);
+		goto unlock_client;
+	}
+
+	if (applied_ab)
+		*applied_ab = ab;
+	if (applied_ib)
+		*applied_ib = ib;
+
+unlock_client:
+	mutex_unlock(&bus_client->lock);
+end:
+	return rc;
+}
+
+static int cam_cpas_util_register_bus_client(
+	struct cam_hw_soc_info *soc_info, struct device_node *dev_node,
+	struct cam_cpas_bus_client *bus_client)
+{
+	int rc = 0;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) soc_info->soc_private;
+
+	rc = cam_soc_bus_client_register(soc_info->pdev, dev_node,
+		&bus_client->soc_bus_client, &bus_client->common_data,
+		soc_private->use_cam_icc_path_str);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Bus client: %s registertion failed ,rc: %d",
+			bus_client->common_data.name, rc);
+		return rc;
+	}
+
+	bus_client->curr_vote_level = 0;
+	bus_client->valid = true;
+	mutex_init(&bus_client->lock);
+
+	return 0;
+}
+
+static int cam_cpas_util_unregister_bus_client(
+	struct cam_cpas_bus_client *bus_client)
+{
+	if (!bus_client->valid) {
+		CAM_ERR(CAM_CPAS, "bus client not valid");
+		return -EINVAL;
+	}
+
+	cam_soc_bus_client_unregister(&bus_client->soc_bus_client);
+	bus_client->curr_vote_level = 0;
+	bus_client->valid = false;
+	mutex_destroy(&bus_client->lock);
+
+	return 0;
+}
+
+static int cam_cpas_util_axi_cleanup(struct cam_cpas *cpas_core,
+	struct cam_hw_soc_info *soc_info)
+{
+	int i = 0;
+
+	if (cpas_core->num_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_axi_ports: %d",
+			cpas_core->num_axi_ports);
+		return -EINVAL;
+	}
+
+	if (cpas_core->num_camnoc_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_camnoc_axi_ports: %d",
+			cpas_core->num_camnoc_axi_ports);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		cam_cpas_util_unregister_bus_client(
+			&cpas_core->axi_port[i].bus_client);
+		of_node_put(cpas_core->axi_port[i].axi_port_node);
+		cpas_core->axi_port[i].axi_port_node = NULL;
+	}
+
+	for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+		cam_cpas_util_unregister_bus_client(
+			&cpas_core->camnoc_axi_port[i].bus_client);
+		of_node_put(cpas_core->camnoc_axi_port[i].axi_port_node);
+		cpas_core->camnoc_axi_port[i].axi_port_node = NULL;
+	}
+
+	return 0;
+}
+
+static int cam_cpas_util_axi_setup(struct cam_cpas *cpas_core,
+	struct cam_hw_soc_info *soc_info)
+{
+	int i = 0, rc = 0;
+	struct device_node *axi_port_mnoc_node = NULL;
+	struct device_node *axi_port_camnoc_node = NULL;
+
+	if (cpas_core->num_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_axi_ports: %d",
+			cpas_core->num_axi_ports);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		axi_port_mnoc_node = cpas_core->axi_port[i].axi_port_node;
+		rc = cam_cpas_util_register_bus_client(soc_info,
+			axi_port_mnoc_node, &cpas_core->axi_port[i].bus_client);
+		if (rc)
+			goto bus_register_fail;
+	}
+	for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+		axi_port_camnoc_node =
+			cpas_core->camnoc_axi_port[i].axi_port_node;
+		rc = cam_cpas_util_register_bus_client(soc_info,
+			axi_port_camnoc_node,
+			&cpas_core->camnoc_axi_port[i].bus_client);
+		if (rc)
+			goto bus_register_fail;
+	}
+
+	return 0;
+bus_register_fail:
+	of_node_put(cpas_core->axi_port[i].axi_port_node);
+	return rc;
+}
+
+int cam_cpas_util_vote_default_ahb_axi(struct cam_hw_info *cpas_hw,
+	int enable)
+{
+	int rc, i = 0;
+	struct cam_cpas *cpas_core = (struct cam_cpas *)cpas_hw->core_info;
+	uint64_t ab_bw, ib_bw;
+	uint64_t applied_ab_bw = 0, applied_ib_bw = 0;
+
+	rc = cam_cpas_util_vote_bus_client_level(&cpas_core->ahb_bus_client,
+		(enable == true) ? CAM_LOWSVS_D1_VOTE : CAM_SUSPEND_VOTE);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed in AHB vote, enable=%d, rc=%d",
+			enable, rc);
+		return rc;
+	}
+
+	if (enable) {
+		ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	} else {
+		ab_bw = 0;
+		ib_bw = 0;
+	}
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		if (cpas_core->axi_port[i].bus_client.common_data.is_drv_port)
+			continue;
+
+		rc = cam_cpas_util_vote_hlos_bus_client_bw(
+			&cpas_core->axi_port[i].bus_client,
+			ab_bw, ib_bw, false, &applied_ab_bw, &applied_ib_bw);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in mnoc vote, enable=%d, rc=%d",
+				enable, rc);
+			goto remove_ahb_vote;
+		}
+
+		cpas_core->axi_port[i].applied_bw.hlos_vote.ab = applied_ab_bw;
+		cpas_core->axi_port[i].applied_bw.hlos_vote.ib = applied_ib_bw;
+	}
+
+	return 0;
+remove_ahb_vote:
+	cam_cpas_util_vote_bus_client_level(&cpas_core->ahb_bus_client,
+		CAM_SUSPEND_VOTE);
+	return rc;
+}
+
+static int cam_cpas_hw_reg_write(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle, enum cam_cpas_reg_base reg_base,
+	uint32_t offset, bool mb, uint32_t value)
+{
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_client *cpas_client = NULL;
+	int reg_base_index = cpas_core->regbase_index[reg_base];
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (reg_base_index < 0 || reg_base_index >= soc_info->num_reg_map) {
+		CAM_ERR(CAM_CPAS,
+			"Invalid reg_base=%d, reg_base_index=%d, num_map=%d",
+			reg_base, reg_base_index, soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] has not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto unlock_client;
+	}
+
+	if (mb)
+		cam_io_w_mb(value,
+			soc_info->reg_map[reg_base_index].mem_base + offset);
+	else
+		cam_io_w(value,
+			soc_info->reg_map[reg_base_index].mem_base + offset);
+
+unlock_client:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	return rc;
+}
+
+static int cam_cpas_hw_reg_read(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle, enum cam_cpas_reg_base reg_base,
+	uint32_t offset, bool mb, uint32_t *value)
+{
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_client *cpas_client = NULL;
+	int reg_base_index = cpas_core->regbase_index[reg_base];
+	uint32_t reg_value;
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (!value)
+		return -EINVAL;
+
+	if (reg_base_index < 0 || reg_base_index >= soc_info->num_reg_map) {
+		CAM_ERR(CAM_CPAS,
+			"Invalid reg_base=%d, reg_base_index=%d, num_map=%d",
+			reg_base, reg_base_index, soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] has not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		return -EPERM;
+	}
+
+	if (mb)
+		reg_value = cam_io_r_mb(
+			soc_info->reg_map[reg_base_index].mem_base + offset);
+	else
+		reg_value = cam_io_r(
+			soc_info->reg_map[reg_base_index].mem_base + offset);
+
+	*value = reg_value;
+
+	return rc;
+}
+
+static int cam_cpas_hw_dump_camnoc_buff_fill_info(
+	struct cam_hw_info *cpas_hw,
+	uint32_t client_handle)
+{
+	int rc = 0, i, camnoc_idx;
+	uint32_t val = 0, client_idx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_camnoc_info *camnoc_info;
+	char log_buf[CAM_CPAS_LOG_BUF_LEN];
+	size_t len;
+
+	if (!CAM_CPAS_CLIENT_VALID(client_idx)) {
+		CAM_ERR(CAM_CPAS, "Invalid client idx: %u", client_idx);
+		return -EPERM;
+	}
+
+	/* log buffer fill level of both RT/NRT NIU */
+	for (camnoc_idx = 0; camnoc_idx < cpas_core->num_valid_camnoc; camnoc_idx++) {
+		log_buf[0] = '\0';
+		len = 0;
+		camnoc_info = cpas_core->camnoc_info[camnoc_idx];
+
+		for (i = 0; i < camnoc_info->specific_size; i++) {
+			if ((!camnoc_info->specific[i].enable) ||
+				(!camnoc_info->specific[i].maxwr_low.enable))
+				continue;
+
+			rc = cam_cpas_hw_reg_read(cpas_hw, client_handle,
+				camnoc_info->reg_base,
+				camnoc_info->specific[i].maxwr_low.offset, true, &val);
+			if (rc)
+				break;
+
+			len += scnprintf((log_buf + len), (CAM_CPAS_LOG_BUF_LEN - len),
+				" %s:[%d %d]", camnoc_info->specific[i].port_name,
+				(val & 0x7FF), (val & 0x7F0000) >> 16);
+		}
+
+		CAM_INFO(CAM_CPAS, "%s Fill level [Queued Pending] %s",
+			camnoc_info->camnoc_name, log_buf);
+	}
+
+	return rc;
+}
+
+static void cam_cpas_print_smart_qos_priority(
+	struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_camnoc_info *camnoc_info = NULL;
+	struct cam_cpas_tree_node *niu_node;
+	uint8_t i;
+	int32_t reg_indx;
+	char log_buf[CAM_CPAS_LOG_BUF_LEN] = {0};
+	size_t len = 0;
+	uint32_t val_low = 0, val_high = 0;
+
+	/* Smart QOS only apply to CPAS RT nius */
+	camnoc_info = cpas_core->camnoc_info[cpas_core->camnoc_rt_idx];
+	reg_indx = cpas_core->regbase_index[camnoc_info->reg_base];
+
+	for (i = 0; i < soc_private->smart_qos_info->num_rt_wr_nius; i++) {
+		niu_node = soc_private->smart_qos_info->rt_wr_niu_node[i];
+
+		val_high = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base +
+			niu_node->pri_lut_high_offset);
+
+		val_low = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base +
+			niu_node->pri_lut_low_offset);
+
+		len += scnprintf((log_buf + len), (CAM_CPAS_LOG_BUF_LEN - len),
+			" [%s:high 0x%x low 0x%x]", niu_node->node_name,
+			val_high, val_low);
+	}
+
+	CAM_INFO(CAM_CPAS, "%s SmartQoS [Node Pri_lut] %s", camnoc_info->camnoc_name, log_buf);
+}
+
+static bool cam_cpas_is_new_rt_bw_lower(
+	const struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int i;
+	struct cam_cpas_axi_port *temp_axi_port = NULL;
+	uint64_t applied_total = 0, new_total = 0;
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		temp_axi_port = &cpas_core->axi_port[i];
+
+		if (!temp_axi_port->is_rt)
+			continue;
+
+		if (temp_axi_port->bus_client.common_data.is_drv_port) {
+			CAM_DBG(CAM_PERF, "Port %s DRV ab applied [%llu %llu] new [%llu %llu]",
+				temp_axi_port->axi_port_name,
+				temp_axi_port->applied_bw.drv_vote.high.ab,
+				temp_axi_port->applied_bw.drv_vote.low.ab,
+				temp_axi_port->curr_bw.drv_vote.high.ab,
+				temp_axi_port->curr_bw.drv_vote.low.ab);
+
+			applied_total += temp_axi_port->applied_bw.drv_vote.high.ab;
+			new_total += temp_axi_port->curr_bw.drv_vote.high.ab;
+		} else {
+			CAM_DBG(CAM_PERF, "Port %s HLOS ab applied %llu new %llu",
+				temp_axi_port->axi_port_name,
+				temp_axi_port->applied_bw.hlos_vote.ab,
+				temp_axi_port->curr_bw.hlos_vote.ab);
+
+			applied_total += temp_axi_port->applied_bw.hlos_vote.ab;
+			new_total += temp_axi_port->curr_bw.hlos_vote.ab;
+		}
+	}
+
+	return (new_total < applied_total) ? true : false;
+}
+
+static void cam_cpas_reset_niu_priorities(
+	struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	uint8_t i;
+
+	for (i = 0; i < soc_private->smart_qos_info->num_rt_wr_nius; i++) {
+		soc_private->smart_qos_info->rt_wr_niu_node[i]->applied_priority_low = 0x0;
+		soc_private->smart_qos_info->rt_wr_niu_node[i]->applied_priority_high = 0x0;
+	}
+}
+
+static bool cam_cpas_calculate_smart_qos(
+	struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas_tree_node *niu_node;
+	uint8_t i;
+	bool needs_update = false;
+	uint64_t bw_per_kb, total_camnoc_bw, max_bw_per_kb = 0, remainder, ramp_val;
+	uint64_t total_bw_per_kb = 0, total_bw_ramp_val = 0;
+	int8_t pos;
+	uint64_t priority;
+	uint8_t val, clamp_threshold;
+
+	for (i = 0; i < soc_private->smart_qos_info->num_rt_wr_nius; i++) {
+		niu_node = soc_private->smart_qos_info->rt_wr_niu_node[i];
+
+		bw_per_kb = niu_node->bw_info[CAM_CPAS_PORT_HLOS_DRV].hlos_vote.camnoc;
+
+		if (soc_private->enable_cam_clk_drv)
+			bw_per_kb += niu_node->bw_info[CAM_CPAS_PORT_DRV_0].drv_vote.high.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_0].drv_vote.low.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_1].drv_vote.high.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_1].drv_vote.low.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_2].drv_vote.high.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_2].drv_vote.low.camnoc;
+
+		total_camnoc_bw = bw_per_kb;
+		remainder = do_div(bw_per_kb, niu_node->niu_size);
+		total_bw_per_kb += bw_per_kb;
+
+		if (max_bw_per_kb < bw_per_kb)
+			max_bw_per_kb = bw_per_kb;
+
+		CAM_DBG(CAM_PERF,
+			"NIU[%d][%s]camnoc_bw %llu, niu_size %u, init_bw_per_kb %lld, remainder %lld, max_bw_per_kb %lld, total_bw_per_kb %lld",
+			i, niu_node->node_name, total_camnoc_bw, niu_node->niu_size,
+			bw_per_kb, remainder, max_bw_per_kb, total_bw_per_kb);
+	}
+
+	if (!max_bw_per_kb) {
+		CAM_DBG(CAM_PERF, "No valid bw on NIU nodes");
+		return false;
+	}
+
+	for (i = 0; i < soc_private->smart_qos_info->num_rt_wr_nius; i++) {
+		niu_node = soc_private->smart_qos_info->rt_wr_niu_node[i];
+
+		bw_per_kb = niu_node->bw_info[CAM_CPAS_PORT_HLOS_DRV].hlos_vote.camnoc;
+
+		if (soc_private->enable_cam_clk_drv)
+			bw_per_kb += niu_node->bw_info[CAM_CPAS_PORT_DRV_0].drv_vote.high.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_0].drv_vote.low.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_1].drv_vote.high.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_1].drv_vote.low.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_2].drv_vote.high.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_2].drv_vote.low.camnoc;
+
+		do_div(bw_per_kb, niu_node->niu_size);
+
+		if ((bw_per_kb * CAM_CPAS_MAX_STRESS_INDICATOR) >
+			(total_bw_per_kb *
+			soc_private->smart_qos_info->highstress_indicator_th)) {
+			clamp_threshold = soc_private->smart_qos_info->moststressed_clamp_th;
+			CAM_DBG(CAM_PERF, "Current niu clamp_threshold=%d",
+				clamp_threshold);
+		} else {
+			ramp_val = soc_private->smart_qos_info->bw_ratio_scale_factor *
+				bw_per_kb;
+			ramp_val = ramp_val *
+				(soc_private->smart_qos_info->leaststressed_clamp_th -
+				soc_private->smart_qos_info->moststressed_clamp_th);
+
+			/*
+			 * Stress indicator threshold may have a float type value
+			 * such as 0.5 according max stress indicator value 1,
+			 * we take in percentages to avoid float type calcaulate.
+			 */
+			total_bw_ramp_val = total_bw_per_kb *
+				(soc_private->smart_qos_info->highstress_indicator_th -
+				soc_private->smart_qos_info->lowstress_indicator_th) /
+				CAM_CPAS_MAX_STRESS_INDICATOR;
+
+			CAM_DBG(CAM_PERF, "ramp_val=%lld, total_bw_ramp_val=%lld",
+				ramp_val, total_bw_ramp_val);
+
+			remainder = do_div(ramp_val, total_bw_ramp_val);
+			/* round the value */
+			if ((remainder * 2) >= total_bw_ramp_val)
+				ramp_val += 1;
+
+			val = (uint8_t)(ramp_val);
+			clamp_threshold =
+				soc_private->smart_qos_info->leaststressed_clamp_th - val;
+
+			CAM_DBG(CAM_PERF, "Current niu clamp_threshold=%d, val=%d",
+				clamp_threshold, val);
+		}
+
+		priority = 0;
+
+		for (pos = 15; pos >= clamp_threshold; pos--) {
+			val = soc_private->smart_qos_info->rt_wr_priority_clamp;
+			priority = priority << 4;
+			priority |= val;
+
+			CAM_DBG(CAM_PERF, "pos=%d, val=0x%x, priority=0x%llx", pos, val, priority);
+		}
+
+		for (pos = clamp_threshold - 1; pos >= 0; pos--) {
+			if (pos == 0) {
+				val = soc_private->smart_qos_info->rt_wr_priority_min;
+			} else {
+				ramp_val = pos * bw_per_kb;
+				/*
+				 * Slope factor may have a float type value such as 0.7
+				 * according max slope factor value 1,
+				 * we take in percentages to avoid float type calcaulate.
+				 */
+				ramp_val = ramp_val *
+					soc_private->smart_qos_info->rt_wr_slope_factor /
+					CAM_CPAS_MAX_SLOPE_FACTOR;
+				remainder = do_div(ramp_val, max_bw_per_kb);
+
+				CAM_DBG(CAM_PERF,
+					"pos=%d, bw_per_kb=%lld, pos*bw_per_kb=%lld, ramp_val=%lld, remainder=%lld, max_bw_per_kb=%lld",
+					pos, bw_per_kb, pos * bw_per_kb, ramp_val, remainder,
+					max_bw_per_kb);
+
+				/* round the value */
+				if ((remainder * 2) >= max_bw_per_kb)
+					ramp_val += 1;
+
+				val = (uint8_t)(ramp_val);
+				val += soc_private->smart_qos_info->rt_wr_priority_min;
+				val = min(val, soc_private->smart_qos_info->rt_wr_priority_max);
+			}
+
+			priority = priority << 4;
+			priority |= val;
+
+			CAM_DBG(CAM_PERF, "pos=%d, val=0x%x, priority=0x%llx", pos, val, priority);
+		}
+
+		niu_node->curr_priority_low = (uint32_t)(priority & 0xFFFFFFFF);
+		niu_node->curr_priority_high = (uint32_t)((priority >> 32) & 0xFFFFFFFF);
+
+		if ((niu_node->curr_priority_low != niu_node->applied_priority_low) ||
+			(niu_node->curr_priority_high != niu_node->applied_priority_high))
+			needs_update = true;
+
+		CAM_DBG(CAM_PERF,
+			"Node[%d][%s]Priority applied high 0x%x low 0x%x, new high 0x%x low 0x%x, needs_update %d",
+			i, niu_node->node_name,
+			niu_node->applied_priority_high, niu_node->applied_priority_low,
+			niu_node->curr_priority_high, niu_node->curr_priority_low,
+			needs_update);
+	}
+
+	if (cpas_core->smart_qos_dump && needs_update) {
+		uint64_t total_camnoc;
+		for (i = 0; i < soc_private->smart_qos_info->num_rt_wr_nius; i++) {
+			niu_node = soc_private->smart_qos_info->rt_wr_niu_node[i];
+
+			total_camnoc = niu_node->bw_info[CAM_CPAS_PORT_HLOS_DRV].hlos_vote.camnoc;
+
+			if (soc_private->enable_cam_clk_drv)
+				total_camnoc +=
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_0].drv_vote.high.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_0].drv_vote.low.camnoc  +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_1].drv_vote.high.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_1].drv_vote.low.camnoc  +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_2].drv_vote.high.camnoc +
+				niu_node->bw_info[CAM_CPAS_PORT_DRV_2].drv_vote.low.camnoc;
+
+			CAM_INFO(CAM_PERF,
+				"Node[%d][%s] camnoc_bw=%lld, niu_size=%d, offset high 0x%x, low 0x%x, Priority new high 0x%x low 0x%x, applied high 0x%x low 0x%x",
+				i, niu_node->node_name, total_camnoc, niu_node->niu_size,
+				niu_node->pri_lut_high_offset, niu_node->pri_lut_low_offset,
+				niu_node->curr_priority_high, niu_node->curr_priority_low,
+				niu_node->applied_priority_high, niu_node->applied_priority_low);
+		}
+	}
+
+	return needs_update;
+}
+
+static int cam_cpas_apply_smart_qos(
+	struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas_tree_node *niu_node;
+	struct cam_camnoc_info *camnoc_info;
+	uint8_t i;
+	int32_t reg_indx, cam_qos_cnt = 0, ret = 0;
+	uint32_t reg_base_mask;
+	struct qcom_scm_camera_qos scm_buf[QCOM_SCM_CAMERA_MAX_QOS_CNT] = {0};
+
+	if (cpas_core->smart_qos_dump) {
+		CAM_INFO(CAM_PERF, "Printing SmartQoS values before update");
+		cam_cpas_print_smart_qos_priority(cpas_hw);
+	}
+
+	/* Smart QOS only apply to CPAS RT nius */
+	camnoc_info = cpas_core->camnoc_info[cpas_core->camnoc_rt_idx];
+	reg_indx = cpas_core->regbase_index[camnoc_info->reg_base];
+
+	switch (camnoc_info->reg_base) {
+	case CAM_CPAS_REG_CAMNOC:
+		reg_base_mask = (CAM_CAMNOC_HW_COMBINED_MASK << CAM_CAMNOC_HW_TYPE_SHIFT);
+		break;
+	case CAM_CPAS_REG_CAMNOC_RT:
+		reg_base_mask = (CAM_CAMNOC_HW_RT_MASK << CAM_CAMNOC_HW_TYPE_SHIFT);
+		break;
+	case CAM_CPAS_REG_CAMNOC_NRT:
+		reg_base_mask = (CAM_CAMNOC_HW_NRT_MASK << CAM_CAMNOC_HW_TYPE_SHIFT);
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Reg base %d is not supported in updating smart QoS",
+			camnoc_info->reg_base);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_private->smart_qos_info->num_rt_wr_nius; i++) {
+		niu_node = soc_private->smart_qos_info->rt_wr_niu_node[i];
+
+		if (niu_node->curr_priority_high != niu_node->applied_priority_high) {
+			if (!soc_private->enable_secure_qos_update) {
+				cam_io_w_mb(niu_node->curr_priority_high,
+					soc_info->reg_map[reg_indx].mem_base +
+					niu_node->pri_lut_high_offset);
+			} else {
+				scm_buf[cam_qos_cnt].offset =
+					niu_node->pri_lut_high_offset | reg_base_mask;
+				scm_buf[cam_qos_cnt].val = niu_node->curr_priority_high;
+				cam_qos_cnt++;
+			}
+
+			niu_node->applied_priority_high = niu_node->curr_priority_high;
+		}
+
+		if (niu_node->curr_priority_low != niu_node->applied_priority_low) {
+			if (!soc_private->enable_secure_qos_update) {
+				cam_io_w_mb(niu_node->curr_priority_low,
+					soc_info->reg_map[reg_indx].mem_base +
+					niu_node->pri_lut_low_offset);
+			} else {
+				scm_buf[cam_qos_cnt].offset =
+					niu_node->pri_lut_low_offset | reg_base_mask;
+				scm_buf[cam_qos_cnt].val = niu_node->curr_priority_low;
+				cam_qos_cnt++;
+			}
+
+			niu_node->applied_priority_low = niu_node->curr_priority_low;
+		}
+	}
+
+	if (soc_private->enable_secure_qos_update && cam_qos_cnt) {
+		CAM_DBG(CAM_PERF, "Updating secure camera smartQoS count: %d", cam_qos_cnt);
+		ret = cam_update_camnoc_qos_settings(CAM_QOS_UPDATE_TYPE_SMART,
+			cam_qos_cnt, scm_buf);
+		if (ret) {
+			CAM_ERR(CAM_PERF, "Secure camera smartQoS update failed: %d", ret);
+		}
+		CAM_DBG(CAM_PERF, "Updated secure camera smartQoS");
+	}
+
+	if (cpas_core->smart_qos_dump) {
+		CAM_INFO(CAM_PERF, "Printing SmartQoS values after update");
+		cam_cpas_print_smart_qos_priority(cpas_hw);
+	}
+
+	return 0;
+}
+
+static int cam_cpas_util_camnoc_drv_idx_to_cesta_hw_client_idx(int camnoc_drv_idx)
+{
+	int hw_client = -1;
+
+	switch (camnoc_drv_idx) {
+	case CAM_CPAS_PORT_HLOS_DRV:
+		hw_client = -1;
+		break;
+	case CAM_CPAS_PORT_DRV_0:
+		hw_client = 0;
+		break;
+	case CAM_CPAS_PORT_DRV_1:
+		hw_client = 1;
+		break;
+	case CAM_CPAS_PORT_DRV_2:
+		hw_client = 2;
+		break;
+	default:
+		CAM_WARN(CAM_CPAS, "Invalid drv idx %d", camnoc_drv_idx);
+		break;
+	}
+
+	return hw_client;
+}
+
+static int cam_cpas_util_set_camnoc_axi_drv_clk_rate(struct cam_hw_soc_info *soc_info,
+	struct cam_cpas_private_soc *soc_private, struct cam_cpas *cpas_core, int cesta_drv_idx)
+{
+	struct cam_cpas_tree_node *tree_node = NULL;
+	uint64_t req_drv_high_camnoc_bw = 0, intermediate_drv_high_result = 0,
+		req_drv_low_camnoc_bw = 0, intermediate_drv_low_result = 0;
+	int64_t drv_high_clk_rate = 0, drv_low_clk_rate = 0;
+	int i, rc = 0;
+
+	if (!soc_private->enable_cam_clk_drv) {
+		CAM_ERR(CAM_CPAS, "Clk DRV not enabled, can't set clk rates through cesta APIs");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_CPAS_MAX_TREE_NODES; i++) {
+		tree_node = soc_private->tree_node[i];
+		if (!tree_node ||
+			!tree_node->camnoc_max_needed)
+			continue;
+
+		if (req_drv_high_camnoc_bw <
+			(tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc *
+			tree_node->bus_width_factor))
+			req_drv_high_camnoc_bw =
+				(tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc *
+				tree_node->bus_width_factor);
+
+		if (req_drv_low_camnoc_bw <
+			(tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc *
+			tree_node->bus_width_factor))
+			req_drv_low_camnoc_bw =
+				(tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc *
+				tree_node->bus_width_factor);
+	}
+
+	intermediate_drv_high_result = req_drv_high_camnoc_bw *
+		soc_private->camnoc_axi_clk_bw_margin;
+	intermediate_drv_low_result = req_drv_low_camnoc_bw *
+		soc_private->camnoc_axi_clk_bw_margin;
+	do_div(intermediate_drv_high_result, 100);
+	do_div(intermediate_drv_low_result, 100);
+	req_drv_high_camnoc_bw += intermediate_drv_high_result;
+	req_drv_low_camnoc_bw += intermediate_drv_low_result;
+
+	/*
+	 * Since all low votes are considered as part of high votes as well, add low camnoc bw
+	 * to final requested high camnoc bw value.
+	 */
+	req_drv_high_camnoc_bw += req_drv_low_camnoc_bw;
+
+	intermediate_drv_high_result = req_drv_high_camnoc_bw;
+	intermediate_drv_low_result = req_drv_low_camnoc_bw;
+	do_div(intermediate_drv_high_result, soc_private->camnoc_bus_width);
+	do_div(intermediate_drv_low_result, soc_private->camnoc_bus_width);
+	drv_high_clk_rate = intermediate_drv_high_result;
+	drv_low_clk_rate = intermediate_drv_low_result;
+
+	if (cpas_core->streamon_clients) {
+		int hw_client_idx;
+
+		/*
+		 * cesta_drv_idx is based on enum we set in dtsi properties which is +1 of actual
+		 * corresponding hw client index
+		 */
+		hw_client_idx = cam_cpas_util_camnoc_drv_idx_to_cesta_hw_client_idx(cesta_drv_idx);
+		if (hw_client_idx == -1) {
+			CAM_ERR(CAM_CPAS, "Invalid hw client idx %d, cesta_drv_idx %d",
+				hw_client_idx, cesta_drv_idx);
+			return rc;
+		}
+
+		if (debug_drv)
+			CAM_INFO(CAM_PERF,
+				"Setting camnoc axi cesta clk rate[BW Clk] : High [%llu %lld] Low [%llu %lld] cesta/hw_client_idx:[%d][%d]",
+				req_drv_high_camnoc_bw, drv_high_clk_rate, req_drv_low_camnoc_bw,
+				drv_low_clk_rate, cesta_drv_idx, hw_client_idx);
+		else
+			CAM_DBG(CAM_PERF,
+				"Setting camnoc axi cesta clk rate[BW Clk] : High [%llu %lld] Low [%llu %lld] cesta/hw_client_idx:[%d][%d]",
+				req_drv_high_camnoc_bw, drv_high_clk_rate, req_drv_low_camnoc_bw,
+				drv_low_clk_rate, cesta_drv_idx, hw_client_idx);
+
+		rc = cam_soc_util_set_src_clk_rate(soc_info, hw_client_idx,
+			drv_high_clk_rate, drv_low_clk_rate);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in setting camnoc cesta clk rates[high low]:[%ld %ld] client_idx:%d rc:%d",
+				drv_high_clk_rate, drv_low_clk_rate, hw_client_idx,
+				rc);
+			return rc;
+		}
+
+		cpas_core->applied_camnoc_axi_rate.hw_client[hw_client_idx].high =
+			drv_high_clk_rate;
+		cpas_core->applied_camnoc_axi_rate.hw_client[hw_client_idx].low =
+			drv_low_clk_rate;
+
+		if (debug_drv)
+			CAM_INFO(CAM_PERF, "Triggering channel switch for cesta client %d",
+				hw_client_idx);
+		else
+			CAM_DBG(CAM_PERF, "Triggering channel switch for cesta client %d",
+				hw_client_idx);
+
+		rc = cam_soc_util_cesta_channel_switch(hw_client_idx, "cpas_update");
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed to apply power states for cesta client:%d rc:%d",
+				hw_client_idx, rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_cpas_util_set_camnoc_axi_hlos_clk_rate(struct cam_hw_soc_info *soc_info,
+	struct cam_cpas_private_soc *soc_private, struct cam_cpas *cpas_core)
+{
+	struct cam_cpas_tree_node *tree_node = NULL;
+	uint64_t req_hlos_camnoc_bw = 0, intermediate_hlos_result = 0;
+	int64_t hlos_clk_rate = 0;
+	int i, rc = 0;
+	const struct camera_debug_settings *cam_debug = NULL;
+
+	for (i = 0; i < CAM_CPAS_MAX_TREE_NODES; i++) {
+		tree_node = soc_private->tree_node[i];
+		if (!tree_node || !tree_node->camnoc_max_needed)
+			continue;
+
+		if (req_hlos_camnoc_bw <
+			(tree_node->bw_info[CAM_CPAS_PORT_HLOS_DRV].hlos_vote.camnoc *
+			tree_node->bus_width_factor)) {
+			req_hlos_camnoc_bw =
+				(tree_node->bw_info[CAM_CPAS_PORT_HLOS_DRV].hlos_vote.camnoc *
+				tree_node->bus_width_factor);
+		}
+	}
+
+	intermediate_hlos_result = req_hlos_camnoc_bw * soc_private->camnoc_axi_clk_bw_margin;
+	do_div(intermediate_hlos_result, 100);
+	req_hlos_camnoc_bw += intermediate_hlos_result;
+
+	if (cpas_core->streamon_clients && (req_hlos_camnoc_bw == 0)) {
+		CAM_DBG(CAM_CPAS,
+			"Set min vote if streamon_clients is non-zero : streamon_clients=%d",
+			cpas_core->streamon_clients);
+		req_hlos_camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	}
+
+	if ((req_hlos_camnoc_bw > 0) && (req_hlos_camnoc_bw < soc_private->camnoc_axi_min_ib_bw))
+		req_hlos_camnoc_bw = soc_private->camnoc_axi_min_ib_bw;
+
+	cam_debug = cam_debug_get_settings();
+	if (cam_debug && cam_debug->cpas_settings.camnoc_bw) {
+		if (cam_debug->cpas_settings.camnoc_bw < soc_private->camnoc_bus_width)
+			req_hlos_camnoc_bw = soc_private->camnoc_bus_width;
+
+		else
+			req_hlos_camnoc_bw = cam_debug->cpas_settings.camnoc_bw;
+		CAM_INFO(CAM_CPAS, "Overriding camnoc bw: %llu", req_hlos_camnoc_bw);
+	}
+
+	intermediate_hlos_result = req_hlos_camnoc_bw;
+	do_div(intermediate_hlos_result, soc_private->camnoc_bus_width);
+	hlos_clk_rate = intermediate_hlos_result;
+
+	CAM_DBG(CAM_PERF, "Setting camnoc axi HLOS clk rate[BW Clk] : [%llu %lld]",
+		req_hlos_camnoc_bw, hlos_clk_rate);
+
+	/*
+	 * CPAS hw is not powered on for the first client.
+	 * Also, clk_rate will be overwritten with default
+	 * value while power on. So, skipping this for first
+	 * client.
+	 */
+	if (cpas_core->streamon_clients) {
+		rc = cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX,
+			hlos_clk_rate, 0);
+		if (rc)
+			CAM_ERR(CAM_CPAS,
+				"Failed in setting camnoc axi clk [BW Clk]:[%llu %lld] rc:%d",
+				req_hlos_camnoc_bw, hlos_clk_rate, rc);
+
+		cpas_core->applied_camnoc_axi_rate.sw_client = hlos_clk_rate;
+	}
+
+	return rc;
+}
+
+static int cam_cpas_util_set_camnoc_axi_clk_rate(struct cam_hw_info *cpas_hw,
+	int cesta_drv_idx)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int rc = 0;
+
+	CAM_DBG(CAM_CPAS, "control_camnoc_axi_clk=%d", soc_private->control_camnoc_axi_clk);
+
+	if (cesta_drv_idx == CAM_CPAS_PORT_HLOS_DRV) {
+		rc = cam_cpas_util_set_camnoc_axi_hlos_clk_rate(soc_info,
+			soc_private, cpas_core);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in setting hlos clk rate rc: %d",
+				rc);
+			goto end;
+		}
+	} else {
+		rc = cam_cpas_util_set_camnoc_axi_drv_clk_rate(soc_info,
+			soc_private, cpas_core, cesta_drv_idx);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in setting drv clk rate drv_idx:%d rc: %d",
+				cesta_drv_idx, rc);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_cpas_util_translate_client_paths(
+	struct cam_axi_vote *axi_vote)
+{
+	int i;
+	uint32_t *path_data_type = NULL;
+
+	if (!axi_vote)
+		return -EINVAL;
+
+	for (i = 0; i < axi_vote->num_paths; i++) {
+		path_data_type = &axi_vote->axi_path[i].path_data_type;
+		/* Update path_data_type from UAPI value to internal value */
+		if (*path_data_type >= CAM_CPAS_PATH_DATA_CONSO_OFFSET)
+			*path_data_type = CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT +
+				(*path_data_type %
+				CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT);
+		else
+			*path_data_type %= CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT;
+
+		if (*path_data_type >= CAM_CPAS_PATH_DATA_MAX) {
+			CAM_ERR(CAM_CPAS, "index Invalid: %d", path_data_type);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cpas_axi_consolidate_path_votes(
+	struct cam_cpas_client *cpas_client,
+	struct cam_axi_vote *axi_vote)
+{
+	int rc = 0, i, k, l;
+	struct cam_axi_vote *con_axi_vote = &cpas_client->axi_vote;
+	bool path_found = false, cons_entry_found;
+	struct cam_cpas_tree_node *curr_tree_node = NULL;
+	struct cam_cpas_tree_node *sum_tree_node = NULL;
+	uint32_t transac_type;
+	uint32_t path_data_type;
+	struct cam_cpas_axi_per_path_bw_vote *axi_path;
+
+	con_axi_vote->num_paths = 0;
+
+	for (i = 0; i < axi_vote->num_paths; i++) {
+		path_found = false;
+		path_data_type = axi_vote->axi_path[i].path_data_type;
+		transac_type = axi_vote->axi_path[i].transac_type;
+
+		if ((path_data_type >= CAM_CPAS_PATH_DATA_MAX) ||
+			(transac_type >= CAM_CPAS_TRANSACTION_MAX)) {
+			CAM_ERR(CAM_CPAS, "Invalid path or transac type: %d %d",
+				path_data_type, transac_type);
+			return -EINVAL;
+		}
+
+		axi_path = &con_axi_vote->axi_path[con_axi_vote->num_paths];
+
+		curr_tree_node =
+			cpas_client->tree_node[path_data_type][transac_type];
+		if (curr_tree_node) {
+			memcpy(axi_path, &axi_vote->axi_path[i],
+				sizeof(struct cam_cpas_axi_per_path_bw_vote));
+			con_axi_vote->num_paths++;
+			continue;
+		}
+
+		for (k = 0; k < CAM_CPAS_PATH_DATA_MAX; k++) {
+			sum_tree_node = cpas_client->tree_node[k][transac_type];
+
+			if (!sum_tree_node)
+				continue;
+
+			if (sum_tree_node->constituent_paths[path_data_type]) {
+				path_found = true;
+				/*
+				 * Check if corresponding consolidated path
+				 * entry is already added into consolidated list
+				 */
+				cons_entry_found = false;
+				for (l = 0; l < con_axi_vote->num_paths; l++) {
+					if ((con_axi_vote->axi_path[l].path_data_type == k) &&
+					(con_axi_vote->axi_path[l].transac_type == transac_type)) {
+						cons_entry_found = true;
+						con_axi_vote->axi_path[l].camnoc_bw +=
+							axi_vote->axi_path[i].camnoc_bw;
+
+						con_axi_vote->axi_path[l].mnoc_ab_bw +=
+							axi_vote->axi_path[i].mnoc_ab_bw;
+
+						con_axi_vote->axi_path[l].mnoc_ib_bw +=
+							axi_vote->axi_path[i].mnoc_ib_bw;
+						break;
+					}
+				}
+
+				/* If not found, add a new entry */
+				if (!cons_entry_found) {
+					axi_path->path_data_type = k;
+					axi_path->transac_type = transac_type;
+					axi_path->camnoc_bw = axi_vote->axi_path[i].camnoc_bw;
+					axi_path->mnoc_ab_bw = axi_vote->axi_path[i].mnoc_ab_bw;
+					axi_path->mnoc_ib_bw = axi_vote->axi_path[i].mnoc_ib_bw;
+					axi_path->vote_level = axi_vote->axi_path[i].vote_level;
+					con_axi_vote->num_paths++;
+				}
+				break;
+			}
+		}
+
+		if (!path_found) {
+			CAM_ERR(CAM_CPAS,
+				"Client [%s][%d] i=%d num_paths=%d Consolidated path not found for path=%d, transac=%d",
+				cpas_client->data.identifier, cpas_client->data.cell_index, i,
+				axi_vote->num_paths, path_data_type, transac_type);
+			return -EINVAL;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_cpas_update_axi_vote_bw(
+	struct cam_hw_info *cpas_hw,
+	struct cam_cpas_tree_node *cpas_tree_node,
+	int ddr_drv_idx, int cesta_drv_idx,
+	bool   *mnoc_axi_port_updated,
+	bool   *camnoc_axi_port_updated)
+{
+	int axi_port_idx = -1;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+
+	axi_port_idx = cpas_tree_node->axi_port_idx_arr[ddr_drv_idx];
+
+	if ((axi_port_idx < 0) || (axi_port_idx >= CAM_CPAS_MAX_AXI_PORTS)) {
+		CAM_ERR(CAM_CPAS, "Invalid axi_port_idx: %d drv_idx: %d", axi_port_idx,
+			ddr_drv_idx);
+		return -EINVAL;
+	}
+
+	memcpy(&cpas_core->axi_port[axi_port_idx].curr_bw, &cpas_tree_node->bw_info[ddr_drv_idx],
+		sizeof(struct cam_cpas_axi_bw_info));
+
+	/* Add low value to high for drv */
+	if (ddr_drv_idx > CAM_CPAS_PORT_HLOS_DRV) {
+		cpas_core->axi_port[axi_port_idx].curr_bw.drv_vote.high.ab +=
+			cpas_core->axi_port[axi_port_idx].curr_bw.drv_vote.low.ab;
+		cpas_core->axi_port[axi_port_idx].curr_bw.drv_vote.high.ib +=
+			cpas_core->axi_port[axi_port_idx].curr_bw.drv_vote.low.ib;
+	}
+
+	mnoc_axi_port_updated[axi_port_idx] = true;
+
+	if (soc_private->control_camnoc_axi_clk)
+		return 0;
+
+	if (cesta_drv_idx > CAM_CPAS_PORT_HLOS_DRV)
+		cpas_core->camnoc_axi_port[cpas_tree_node->axi_port_idx_arr[CAM_CPAS_PORT_HLOS_DRV]]
+			.curr_bw.hlos_vote.camnoc =
+			cpas_tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc +
+			cpas_tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc;
+	else
+		cpas_core->camnoc_axi_port[cpas_tree_node->axi_port_idx_arr[CAM_CPAS_PORT_HLOS_DRV]]
+			.curr_bw.hlos_vote.camnoc =
+			cpas_tree_node->bw_info[cesta_drv_idx].hlos_vote.camnoc;
+
+	camnoc_axi_port_updated[cpas_tree_node->camnoc_axi_port_idx] = true;
+	return 0;
+}
+
+static int cam_cpas_camnoc_set_bw_vote(struct cam_hw_info *cpas_hw,
+	bool   *camnoc_axi_port_updated)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int i;
+	int rc = 0;
+	struct cam_cpas_axi_port *camnoc_axi_port = NULL;
+	uint64_t camnoc_bw;
+	uint64_t applied_ab = 0, applied_ib = 0;
+
+	/* Below code is executed if we just vote and do not set the clk rate
+	 * for camnoc
+	 */
+
+	if (cpas_core->num_camnoc_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_camnoc_axi_ports: %d",
+			cpas_core->num_camnoc_axi_ports);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+		if (camnoc_axi_port_updated[i])
+			camnoc_axi_port = &cpas_core->camnoc_axi_port[i];
+		else
+			continue;
+
+		CAM_DBG(CAM_PERF, "Port[%s] : camnoc_bw=%lld",
+			camnoc_axi_port->axi_port_name,
+			camnoc_axi_port->curr_bw.hlos_vote.camnoc);
+
+		if (camnoc_axi_port->curr_bw.hlos_vote.camnoc)
+			camnoc_bw = camnoc_axi_port->curr_bw.hlos_vote.camnoc;
+		else if (camnoc_axi_port->additional_bw)
+			camnoc_bw = camnoc_axi_port->additional_bw;
+		else if (cpas_core->streamon_clients)
+			camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		else
+			camnoc_bw = 0;
+
+		rc = cam_cpas_util_vote_hlos_bus_client_bw(
+			&camnoc_axi_port->bus_client,
+			0, camnoc_bw, true, &applied_ab, &applied_ib);
+
+		CAM_DBG(CAM_CPAS,
+			"camnoc vote camnoc_bw[%llu] rc=%d %s",
+			camnoc_bw, rc, camnoc_axi_port->axi_port_name);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in camnoc vote camnoc_bw[%llu] rc=%d",
+				camnoc_bw, rc);
+			break;
+		}
+
+		camnoc_axi_port->applied_bw.hlos_vote.ab = applied_ab;
+		camnoc_axi_port->applied_bw.hlos_vote.ib = applied_ib;
+	}
+	return rc;
+}
+
+static int cam_cpas_util_apply_client_axi_vote(
+	struct cam_hw_info *cpas_hw,
+	struct cam_cpas_client *cpas_client,
+	struct cam_axi_vote *axi_vote, uint32_t apply_type)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_axi_vote *con_axi_vote = NULL;
+	struct cam_cpas_axi_port *mnoc_axi_port = NULL;
+	struct cam_cpas_tree_node *curr_tree_node = NULL;
+	struct cam_cpas_tree_node *par_tree_node = NULL;
+	uint32_t transac_type;
+	uint32_t path_data_type;
+	bool mnoc_axi_port_updated[CAM_CPAS_MAX_AXI_PORTS] = {false};
+	bool camnoc_axi_port_updated[CAM_CPAS_MAX_AXI_PORTS] = {false};
+	struct cam_cpas_axi_bw_info curr_mnoc_old = {0}, par_mnoc_old = {0}, curr_camnoc_old = {0},
+		par_camnoc_old = {0}, curr_port_bw = {0}, applied_port_bw = {0};
+	int rc = 0, i = 0, ddr_drv_idx, merge_type_factor = 1;
+	bool apply_smart_qos = false;
+	bool rt_bw_updated = false;
+	bool camnoc_unchanged;
+	int cesta_drv_idx = CAM_CPAS_PORT_HLOS_DRV;
+	int first_ddr_drv_idx = -1, first_cesta_drv_idx = -1;
+
+	mutex_lock(&cpas_core->tree_lock);
+	if (!cpas_client->tree_node_valid) {
+		/*
+		 * This is by assuming apply_client_axi_vote is called
+		 * for these clients from only cpas_start, cpas_stop.
+		 * not called from hw_update_axi_vote
+		 */
+		for (i = 0; i < cpas_core->num_axi_ports; i++) {
+			if (cpas_core->axi_port[i].bus_client.common_data.is_drv_port)
+				continue;
+
+			if (axi_vote->axi_path[0].mnoc_ab_bw) {
+				/* start case */
+				cpas_core->axi_port[i].additional_bw +=
+					CAM_CPAS_DEFAULT_AXI_BW;
+			} else {
+				/* stop case */
+				cpas_core->axi_port[i].additional_bw -=
+					CAM_CPAS_DEFAULT_AXI_BW;
+			}
+			mnoc_axi_port_updated[i] = true;
+		}
+
+		for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+			if (axi_vote->axi_path[0].camnoc_bw) {
+				/* start case */
+				cpas_core->camnoc_axi_port[i].additional_bw +=
+					CAM_CPAS_DEFAULT_AXI_BW;
+			} else {
+				/* stop case */
+				cpas_core->camnoc_axi_port[i].additional_bw -=
+					CAM_CPAS_DEFAULT_AXI_BW;
+			}
+			camnoc_axi_port_updated[i] = true;
+		}
+
+		goto vote_start_clients;
+	}
+
+	rc = cam_cpas_axi_consolidate_path_votes(cpas_client, axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_PERF, "Failed in bw consolidation, Client [%s][%d]",
+			cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		goto unlock_tree;
+	}
+
+	con_axi_vote = &cpas_client->axi_vote;
+
+	cam_cpas_dump_axi_vote_info(cpas_client, "Consolidated Vote", con_axi_vote);
+	cam_cpas_dump_full_tree_state(cpas_hw, "BeforeClientVoteUpdate");
+
+	/* Traverse through node tree and update bw vote values */
+	for (i = 0; i < con_axi_vote->num_paths; i++) {
+		camnoc_unchanged = false;
+		path_data_type = con_axi_vote->axi_path[i].path_data_type;
+		transac_type = con_axi_vote->axi_path[i].transac_type;
+		curr_tree_node = cpas_client->tree_node[path_data_type][transac_type];
+		ddr_drv_idx = curr_tree_node->drv_voting_idx;
+		cesta_drv_idx = curr_tree_node->drv_voting_idx;
+
+		if (!soc_private->enable_cam_ddr_drv || cpas_core->force_hlos_drv) {
+			ddr_drv_idx = CAM_CPAS_PORT_HLOS_DRV;
+			cesta_drv_idx = CAM_CPAS_PORT_HLOS_DRV;
+		} else if (!soc_private->enable_cam_clk_drv || cpas_core->force_cesta_sw_client) {
+			cesta_drv_idx = CAM_CPAS_PORT_HLOS_DRV;
+		}
+
+		if ((ddr_drv_idx < 0) || (ddr_drv_idx > CAM_CPAS_PORT_DRV_2) ||
+			(cesta_drv_idx < 0) || (cesta_drv_idx > CAM_CPAS_PORT_DRV_2)) {
+			CAM_ERR(CAM_CPAS, "Invalid drv idx : ddr_drv_idx=%d, cesta_drv_idx=%d",
+				ddr_drv_idx, cesta_drv_idx);
+			goto unlock_tree;
+		}
+
+		if (i == 0) {
+			first_ddr_drv_idx = ddr_drv_idx;
+			first_cesta_drv_idx = cesta_drv_idx;
+		} else if ((first_ddr_drv_idx != ddr_drv_idx) ||
+			(first_cesta_drv_idx != cesta_drv_idx)) {
+			/*
+			 * drv indices won't change for a given client for different paths in a
+			 * given axi vote update
+			 */
+			CAM_WARN(CAM_CPAS, "DRV indices different : DDR: %d, %d, CESTA %d %d",
+				first_ddr_drv_idx, ddr_drv_idx, first_cesta_drv_idx, cesta_drv_idx);
+		}
+
+		memcpy(&curr_camnoc_old, &curr_tree_node->bw_info[cesta_drv_idx],
+					sizeof(struct cam_cpas_axi_bw_info));
+		memcpy(&curr_mnoc_old, &curr_tree_node->bw_info[ddr_drv_idx],
+			sizeof(struct cam_cpas_axi_bw_info));
+		cam_cpas_dump_tree_vote_info(cpas_hw, curr_tree_node, "Level0 before update",
+			ddr_drv_idx, cesta_drv_idx);
+
+		/* Check and update camnoc bw first */
+		if (con_axi_vote->axi_path[i].vote_level == CAM_CPAS_VOTE_LEVEL_HIGH) {
+			if ((apply_type != CAM_CPAS_APPLY_TYPE_STOP) &&
+				(curr_tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc ==
+				con_axi_vote->axi_path[i].camnoc_bw)) {
+				camnoc_unchanged = true;
+				goto update_l0_mnoc;
+			}
+
+			curr_tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc =
+				con_axi_vote->axi_path[i].camnoc_bw;
+			curr_tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc = 0;
+		} else {
+			if (cesta_drv_idx > CAM_CPAS_PORT_HLOS_DRV) {
+				if ((apply_type != CAM_CPAS_APPLY_TYPE_STOP) &&
+					(curr_tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc
+					== con_axi_vote->axi_path[i].camnoc_bw)) {
+					camnoc_unchanged = true;
+					goto update_l0_mnoc;
+				}
+
+				curr_tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc =
+					con_axi_vote->axi_path[i].camnoc_bw;
+				curr_tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc = 0;
+			} else {
+				if (curr_tree_node->bw_info[cesta_drv_idx].hlos_vote.camnoc ==
+					con_axi_vote->axi_path[i].camnoc_bw) {
+					camnoc_unchanged = true;
+					goto update_l0_mnoc;
+				}
+
+				curr_tree_node->bw_info[cesta_drv_idx].hlos_vote.camnoc =
+					con_axi_vote->axi_path[i].camnoc_bw;
+			}
+		}
+
+update_l0_mnoc:
+		/* Check and update mnoc ab and ib */
+		if (con_axi_vote->axi_path[i].vote_level == CAM_CPAS_VOTE_LEVEL_HIGH) {
+			if ((apply_type != CAM_CPAS_APPLY_TYPE_STOP) && camnoc_unchanged &&
+				(curr_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ab ==
+				con_axi_vote->axi_path[i].mnoc_ab_bw) &&
+				(curr_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ib ==
+				con_axi_vote->axi_path[i].mnoc_ib_bw))
+				continue;
+
+			curr_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ab =
+				con_axi_vote->axi_path[i].mnoc_ab_bw;
+			curr_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ib =
+				con_axi_vote->axi_path[i].mnoc_ib_bw;
+			curr_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ab = 0;
+			curr_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ib = 0;
+		} else {
+			if (ddr_drv_idx > CAM_CPAS_PORT_HLOS_DRV) {
+				if ((apply_type != CAM_CPAS_APPLY_TYPE_STOP) && camnoc_unchanged &&
+					(curr_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ab ==
+					con_axi_vote->axi_path[i].mnoc_ab_bw) &&
+					(curr_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ib ==
+					con_axi_vote->axi_path[i].mnoc_ib_bw))
+					continue;
+
+				curr_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ab =
+					con_axi_vote->axi_path[i].mnoc_ab_bw;
+				curr_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ib =
+					con_axi_vote->axi_path[i].mnoc_ib_bw;
+				curr_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ab = 0;
+				curr_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ib = 0;
+			} else {
+				if (camnoc_unchanged &&
+					(curr_tree_node->bw_info[ddr_drv_idx].hlos_vote.ab ==
+					con_axi_vote->axi_path[i].mnoc_ab_bw) &&
+					(curr_tree_node->bw_info[ddr_drv_idx].hlos_vote.ib ==
+					con_axi_vote->axi_path[i].mnoc_ib_bw))
+					continue;
+
+				curr_tree_node->bw_info[ddr_drv_idx].hlos_vote.ab =
+					con_axi_vote->axi_path[i].mnoc_ab_bw;
+				curr_tree_node->bw_info[ddr_drv_idx].hlos_vote.ib =
+					con_axi_vote->axi_path[i].mnoc_ib_bw;
+			}
+		}
+
+		cam_cpas_dump_tree_vote_info(cpas_hw, curr_tree_node, "Level0 after update",
+			ddr_drv_idx, cesta_drv_idx);
+
+		while (curr_tree_node->parent_node) {
+			par_tree_node = curr_tree_node->parent_node;
+			memcpy(&par_camnoc_old, &par_tree_node->bw_info[cesta_drv_idx],
+				sizeof(struct cam_cpas_axi_bw_info));
+			memcpy(&par_mnoc_old, &par_tree_node->bw_info[ddr_drv_idx],
+				sizeof(struct cam_cpas_axi_bw_info));
+			cam_cpas_dump_tree_vote_info(cpas_hw, par_tree_node, "Parent before update",
+				ddr_drv_idx, cesta_drv_idx);
+
+			if (par_tree_node->merge_type == CAM_CPAS_TRAFFIC_MERGE_SUM) {
+				merge_type_factor = 1;
+			} else if (par_tree_node->merge_type ==
+				CAM_CPAS_TRAFFIC_MERGE_SUM_INTERLEAVE) {
+				merge_type_factor = 2;
+			} else {
+				CAM_ERR(CAM_CPAS, "Invalid Merge type");
+				rc = -EINVAL;
+				goto unlock_tree;
+			}
+
+			/*
+			 * Remove contribution of current node old camnoc bw from parent,
+			 * then add new camnoc bw of current level to the parent
+			 */
+			if (cesta_drv_idx > CAM_CPAS_PORT_HLOS_DRV) {
+				par_tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc -=
+					(curr_camnoc_old.drv_vote.high.camnoc/merge_type_factor);
+				par_tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc -=
+					(curr_camnoc_old.drv_vote.low.camnoc/merge_type_factor);
+
+				par_tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc +=
+				(curr_tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc/
+					merge_type_factor);
+				par_tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc +=
+				(curr_tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc/
+					merge_type_factor);
+			} else {
+				par_tree_node->bw_info[cesta_drv_idx].hlos_vote.camnoc -=
+					(curr_camnoc_old.hlos_vote.camnoc/merge_type_factor);
+
+				par_tree_node->bw_info[cesta_drv_idx].hlos_vote.camnoc +=
+					(curr_tree_node->bw_info[cesta_drv_idx].hlos_vote.camnoc/
+					merge_type_factor);
+			}
+
+			/*
+			 * Remove contribution of current node old mnoc bw from parent,
+			 * then add new mnoc bw of current level to the parent
+			 */
+			if (ddr_drv_idx > CAM_CPAS_PORT_HLOS_DRV) {
+				par_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ab -=
+					curr_mnoc_old.drv_vote.high.ab;
+				par_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ib -=
+					curr_mnoc_old.drv_vote.high.ib;
+				par_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ab -=
+					curr_mnoc_old.drv_vote.low.ab;
+				par_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ib -=
+					curr_mnoc_old.drv_vote.low.ib;
+
+				par_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ab +=
+					curr_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ab;
+				par_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ib +=
+					curr_tree_node->bw_info[ddr_drv_idx].drv_vote.high.ib;
+				par_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ab +=
+					curr_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ab;
+				par_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ib +=
+					curr_tree_node->bw_info[ddr_drv_idx].drv_vote.low.ib;
+			} else {
+				par_tree_node->bw_info[ddr_drv_idx].hlos_vote.ab -=
+					curr_mnoc_old.hlos_vote.ab;
+				par_tree_node->bw_info[ddr_drv_idx].hlos_vote.ib -=
+					curr_mnoc_old.hlos_vote.ib;
+
+				par_tree_node->bw_info[ddr_drv_idx].hlos_vote.ab +=
+					curr_tree_node->bw_info[ddr_drv_idx].hlos_vote.ab;
+				par_tree_node->bw_info[ddr_drv_idx].hlos_vote.ib +=
+					curr_tree_node->bw_info[ddr_drv_idx].hlos_vote.ib;
+			}
+
+			cam_cpas_dump_tree_vote_info(cpas_hw, par_tree_node, "Parent after update",
+				ddr_drv_idx, cesta_drv_idx);
+
+			if (!par_tree_node->parent_node) {
+				rc = cam_cpas_update_axi_vote_bw(cpas_hw, par_tree_node,
+					ddr_drv_idx, cesta_drv_idx, mnoc_axi_port_updated,
+					camnoc_axi_port_updated);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "Update Vote failed");
+					goto unlock_tree;
+				}
+			}
+
+			curr_tree_node = par_tree_node;
+			memcpy(&curr_camnoc_old, &par_camnoc_old,
+				sizeof(struct cam_cpas_axi_bw_info));
+			memcpy(&curr_mnoc_old, &par_mnoc_old, sizeof(struct cam_cpas_axi_bw_info));
+		}
+	}
+
+	cam_cpas_dump_full_tree_state(cpas_hw, "AfterClientVoteUpdate");
+
+	if (!par_tree_node) {
+		CAM_DBG(CAM_CPAS, "No change in BW for all paths");
+		rc = 0;
+		goto unlock_tree;
+	}
+
+	if (soc_private->enable_smart_qos) {
+		CAM_DBG(CAM_PERF, "Start QoS update for client[%s][%d]",
+			cpas_client->data.identifier, cpas_client->data.cell_index);
+		for (i = 0; i < cpas_core->num_axi_ports; i++) {
+			if (mnoc_axi_port_updated[i] && cpas_core->axi_port[i].is_rt) {
+				rt_bw_updated = true;
+				break;
+			}
+		}
+
+		if (rt_bw_updated) {
+			apply_smart_qos = cam_cpas_calculate_smart_qos(cpas_hw);
+
+			if (apply_smart_qos && cam_cpas_is_new_rt_bw_lower(cpas_hw)) {
+				/*
+				 * If new BW is low, apply QoS first and then vote,
+				 * otherwise vote first and then apply QoS
+				 */
+				CAM_DBG(CAM_PERF, "Apply Smart QoS first");
+				rc = cam_cpas_apply_smart_qos(cpas_hw);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+						"Failed in Smart QoS rc=%d", rc);
+					goto unlock_tree;
+				}
+
+				apply_smart_qos = false;
+			}
+		}
+	}
+
+vote_start_clients:
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		if (mnoc_axi_port_updated[i])
+			mnoc_axi_port = &cpas_core->axi_port[i];
+		else
+			continue;
+
+		memcpy(&curr_port_bw, &mnoc_axi_port->curr_bw, sizeof(struct cam_cpas_axi_bw_info));
+
+		if (mnoc_axi_port->bus_client.common_data.is_drv_port) {
+			CAM_DBG(CAM_PERF,
+				"Port[%s] :DRV high [%lld %lld] low [%lld %lld] streamon_clients=%d",
+				mnoc_axi_port->axi_port_name,
+				mnoc_axi_port->curr_bw.drv_vote.high.ab,
+				mnoc_axi_port->curr_bw.drv_vote.high.ib,
+				mnoc_axi_port->curr_bw.drv_vote.low.ab,
+				mnoc_axi_port->curr_bw.drv_vote.low.ib,
+				cpas_core->streamon_clients);
+
+			if (!mnoc_axi_port->ib_bw_voting_needed) {
+				curr_port_bw.drv_vote.high.ib = 0;
+				curr_port_bw.drv_vote.low.ib = 0;
+			}
+
+			/* Vote bw on appropriate bus id */
+			rc = cam_cpas_util_vote_drv_bus_client_bw(&mnoc_axi_port->bus_client,
+				&curr_port_bw, &applied_port_bw);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "Failed in mnoc vote for %s rc=%d",
+					mnoc_axi_port->axi_port_name, rc);
+				goto unlock_tree;
+			}
+
+			/* Do start/stop/channel switch based on apply type */
+			if ((apply_type == CAM_CPAS_APPLY_TYPE_START) &&
+				!mnoc_axi_port->is_drv_started) {
+				rc = cam_cpas_start_drv_for_dev(mnoc_axi_port->cam_rsc_dev);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "Port[%s] failed in DRV start rc:%d",
+						mnoc_axi_port->axi_port_name, rc);
+					goto unlock_tree;
+				}
+
+				if (debug_drv)
+					CAM_INFO(CAM_CPAS, "Started rsc dev %s mnoc port:%s",
+						dev_name(mnoc_axi_port->cam_rsc_dev),
+						mnoc_axi_port->axi_port_name);
+
+				CAM_DBG(CAM_CPAS, "Started rsc dev %s mnoc port:%s",
+					dev_name(mnoc_axi_port->cam_rsc_dev),
+					mnoc_axi_port->axi_port_name);
+				mnoc_axi_port->is_drv_started = true;
+			} else if ((apply_type == CAM_CPAS_APPLY_TYPE_STOP) &&
+				mnoc_axi_port->is_drv_started &&
+				(applied_port_bw.drv_vote.high.ab == 0) &&
+				(applied_port_bw.drv_vote.high.ib == 0) &&
+				(applied_port_bw.drv_vote.low.ab == 0) &&
+				(applied_port_bw.drv_vote.low.ib == 0)) {
+				rc = cam_cpas_stop_drv_for_dev(mnoc_axi_port->cam_rsc_dev);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "Port[%s] failed in DRV stop rc:%d",
+						mnoc_axi_port->axi_port_name, rc);
+					goto unlock_tree;
+				}
+
+				if (debug_drv)
+					CAM_INFO(CAM_CPAS, "Stopped rsc dev %s mnoc port:%s",
+						dev_name(mnoc_axi_port->cam_rsc_dev),
+						mnoc_axi_port->axi_port_name);
+
+				CAM_DBG(CAM_CPAS, "Stopped rsc dev %s mnoc port:%s",
+					dev_name(mnoc_axi_port->cam_rsc_dev),
+					mnoc_axi_port->axi_port_name);
+				mnoc_axi_port->is_drv_started = false;
+			} else {
+				if (mnoc_axi_port->is_drv_started) {
+					rc = cam_cpas_drv_channel_switch_for_dev(
+						mnoc_axi_port->cam_rsc_dev);
+					if (rc) {
+						CAM_ERR(CAM_CPAS,
+							"Port[%s] failed in channel switch rc:%d",
+							mnoc_axi_port->axi_port_name, rc);
+						goto unlock_tree;
+					}
+
+					if (debug_drv)
+						CAM_INFO(CAM_CPAS,
+							"Channel switch for rsc dev %s mnoc port:%s",
+							dev_name(mnoc_axi_port->cam_rsc_dev),
+							mnoc_axi_port->axi_port_name);
+
+					CAM_DBG(CAM_CPAS,
+						"Channel switch for rsc dev %s mnoc port:%s",
+						dev_name(mnoc_axi_port->cam_rsc_dev),
+						mnoc_axi_port->axi_port_name);
+				}
+			}
+
+		} else {
+			CAM_DBG(CAM_PERF,
+				"Port[%s] :HLOS ab=%lld ib=%lld additional=%lld, streamon_clients=%d",
+				mnoc_axi_port->axi_port_name, mnoc_axi_port->curr_bw.hlos_vote.ab,
+				mnoc_axi_port->curr_bw.hlos_vote.ib, mnoc_axi_port->additional_bw,
+				cpas_core->streamon_clients);
+
+			if (!mnoc_axi_port->curr_bw.hlos_vote.ab) {
+				if (mnoc_axi_port->additional_bw)
+					curr_port_bw.hlos_vote.ab = mnoc_axi_port->additional_bw;
+				else if (cpas_core->streamon_clients)
+					curr_port_bw.hlos_vote.ab = CAM_CPAS_DEFAULT_AXI_BW;
+				else
+					curr_port_bw.hlos_vote.ab = 0;
+			}
+
+			if (!mnoc_axi_port->ib_bw_voting_needed)
+				curr_port_bw.hlos_vote.ib = 0;
+
+			rc = cam_cpas_util_vote_hlos_bus_client_bw(&mnoc_axi_port->bus_client,
+				curr_port_bw.hlos_vote.ab, curr_port_bw.hlos_vote.ib, false,
+				&applied_port_bw.hlos_vote.ab, &applied_port_bw.hlos_vote.ib);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "Failed in mnoc vote for %s rc=%d",
+					mnoc_axi_port->axi_port_name, rc);
+				goto unlock_tree;
+			}
+		}
+
+		memcpy(&mnoc_axi_port->applied_bw, &applied_port_bw,
+			sizeof(struct cam_cpas_axi_bw_info));
+	}
+
+	if (soc_private->control_camnoc_axi_clk) {
+		rc = cam_cpas_util_set_camnoc_axi_clk_rate(cpas_hw, cesta_drv_idx);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in setting axi clk rate rc=%d", rc);
+			goto unlock_tree;
+		}
+	} else {
+		rc = cam_cpas_camnoc_set_bw_vote(cpas_hw, camnoc_axi_port_updated);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in setting camnoc bw vote rc=%d", rc);
+			goto unlock_tree;
+		}
+	}
+
+	if (soc_private->enable_smart_qos && apply_smart_qos) {
+		CAM_DBG(CAM_PERF, "Apply Smart QoS after bw votes");
+
+		rc = cam_cpas_apply_smart_qos(cpas_hw);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in Smart QoS rc=%d", rc);
+			goto unlock_tree;
+		}
+	}
+
+unlock_tree:
+	mutex_unlock(&cpas_core->tree_lock);
+	return rc;
+}
+
+static int cam_cpas_util_apply_default_axi_vote(
+	struct cam_hw_info *cpas_hw, bool enable)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_axi_port *axi_port = NULL;
+	uint64_t mnoc_ab_bw = 0, mnoc_ib_bw = 0;
+	int rc = 0, i = 0;
+
+	mutex_lock(&cpas_core->tree_lock);
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		if ((!cpas_core->axi_port[i].bus_client.common_data.is_drv_port) &&
+			(!cpas_core->axi_port[i].curr_bw.hlos_vote.ab ||
+			!cpas_core->axi_port[i].curr_bw.hlos_vote.ib))
+			axi_port = &cpas_core->axi_port[i];
+		else
+			continue;
+
+		if (enable)
+			mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		else
+			mnoc_ib_bw = 0;
+
+		CAM_DBG(CAM_CPAS, "Port=[%s] :ab[%llu] ib[%llu]",
+			axi_port->axi_port_name, mnoc_ab_bw, mnoc_ib_bw);
+
+		rc = cam_cpas_util_vote_hlos_bus_client_bw(&axi_port->bus_client,
+			mnoc_ab_bw, mnoc_ib_bw, false, &axi_port->applied_bw.hlos_vote.ab,
+			&axi_port->applied_bw.hlos_vote.ib);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in mnoc vote ab[%llu] ib[%llu] rc=%d",
+				mnoc_ab_bw, mnoc_ib_bw, rc);
+			goto unlock_tree;
+		}
+	}
+
+unlock_tree:
+	mutex_unlock(&cpas_core->tree_lock);
+	return rc;
+}
+
+static int cam_cpas_hw_update_axi_vote(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle, struct cam_axi_vote *client_axi_vote)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_client *cpas_client = NULL;
+	struct cam_axi_vote *axi_vote = NULL;
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (!client_axi_vote) {
+		CAM_ERR(CAM_CPAS, "Invalid arg, client_handle=%d",
+			client_handle);
+		return -EINVAL;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+
+	axi_vote = kmemdup(client_axi_vote, sizeof(struct cam_axi_vote),
+		GFP_KERNEL);
+	if (!axi_vote) {
+		CAM_ERR(CAM_CPAS, "Out of memory");
+		mutex_unlock(&cpas_core->client_mutex[client_indx]);
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return -ENOMEM;
+	}
+
+	cam_cpas_dump_axi_vote_info(cpas_core->cpas_client[client_indx],
+		"Incoming Vote", axi_vote);
+
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] has not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto unlock_client;
+	}
+
+	rc = cam_cpas_util_translate_client_paths(axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CPAS,
+			"Unable to translate per path votes rc: %d", rc);
+		goto unlock_client;
+	}
+
+	cam_cpas_dump_axi_vote_info(cpas_core->cpas_client[client_indx],
+		"Translated Vote", axi_vote);
+
+	rc = cam_cpas_util_apply_client_axi_vote(cpas_hw,
+		cpas_core->cpas_client[client_indx], axi_vote, CAM_CPAS_APPLY_TYPE_UPDATE);
+
+	/* Log an entry whenever there is an AXI update - after updating */
+	cam_cpas_update_monitor_array(cpas_hw, "CPAS AXI post-update",
+		client_indx);
+unlock_client:
+	cam_free_clear((void *)axi_vote);
+	axi_vote = NULL;
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_util_get_ahb_level(struct cam_hw_info *cpas_hw,
+	struct device *dev, unsigned long freq, enum cam_vote_level *req_level)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct dev_pm_opp *opp;
+	unsigned int corner;
+	enum cam_vote_level level = CAM_LOWSVS_D1_VOTE;
+	unsigned long corner_freq = freq;
+	int i;
+
+	if (!dev || !req_level) {
+		CAM_ERR(CAM_CPAS, "Invalid params %pK, %pK", dev, req_level);
+		return -EINVAL;
+	}
+
+	opp = dev_pm_opp_find_freq_ceil(dev, &corner_freq);
+	if (IS_ERR(opp)) {
+		CAM_DBG(CAM_CPAS, "OPP Ceil not available for freq :%ld, %pK",
+			corner_freq, opp);
+		*req_level = CAM_TURBO_VOTE;
+		return 0;
+	}
+
+	corner = dev_pm_opp_get_voltage(opp);
+
+	for (i = 0; i < soc_private->num_vdd_ahb_mapping; i++)
+		if (corner == soc_private->vdd_ahb[i].vdd_corner)
+			level = soc_private->vdd_ahb[i].ahb_level;
+
+	CAM_DBG(CAM_CPAS,
+		"From OPP table : freq=[%ld][%ld], corner=%d, level=%d",
+		freq, corner_freq, corner, level);
+
+	*req_level = level;
+
+	return 0;
+}
+
+static int cam_cpas_util_apply_client_ahb_vote(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_client *cpas_client, struct cam_ahb_vote *ahb_vote,
+	enum cam_vote_level *applied_level)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_bus_client *ahb_bus_client = &cpas_core->ahb_bus_client;
+	enum cam_vote_level required_level;
+	enum cam_vote_level highest_level;
+	int i, rc = 0;
+
+	if (!ahb_bus_client->valid) {
+		CAM_ERR(CAM_CPAS, "AHB Bus client not valid");
+		return -EINVAL;
+	}
+
+	if (ahb_vote->type == CAM_VOTE_DYNAMIC) {
+		rc = cam_cpas_util_get_ahb_level(cpas_hw, cpas_client->data.dev,
+			ahb_vote->vote.freq, &required_level);
+		if (rc)
+			return rc;
+	} else {
+		required_level = ahb_vote->vote.level;
+	}
+
+	if (cpas_client->ahb_level == required_level)
+		return 0;
+
+	mutex_lock(&ahb_bus_client->lock);
+	cpas_client->ahb_level = required_level;
+
+	CAM_DBG(CAM_CPAS, "Client[%s] required level[%d], curr_level[%d]",
+		ahb_bus_client->common_data.name, required_level,
+		ahb_bus_client->curr_vote_level);
+
+	if (required_level == ahb_bus_client->curr_vote_level)
+		goto unlock_bus_client;
+
+	highest_level = required_level;
+	for (i = 0; i < cpas_core->num_clients; i++) {
+		if (cpas_core->cpas_client[i] && (highest_level <
+			cpas_core->cpas_client[i]->ahb_level))
+			highest_level = cpas_core->cpas_client[i]->ahb_level;
+	}
+
+	CAM_DBG(CAM_CPAS, "Required highest_level[%d]", highest_level);
+
+	if (!cpas_core->ahb_bus_scaling_disable) {
+		rc = cam_cpas_util_vote_bus_client_level(ahb_bus_client,
+			highest_level);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in ahb vote, level=%d, rc=%d",
+				highest_level, rc);
+			goto unlock_bus_client;
+		}
+	}
+
+	if (cpas_core->streamon_clients) {
+		rc = cam_soc_util_set_clk_rate_level(&cpas_hw->soc_info, CAM_CLK_SW_CLIENT_IDX,
+			highest_level, 0, true);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in scaling clock rate level %d for AHB",
+				highest_level);
+			goto unlock_bus_client;
+		}
+	}
+
+	if (applied_level)
+		*applied_level = highest_level;
+
+unlock_bus_client:
+	mutex_unlock(&ahb_bus_client->lock);
+	return rc;
+}
+
+static int cam_cpas_hw_update_ahb_vote(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle, struct cam_ahb_vote *client_ahb_vote)
+{
+	struct cam_ahb_vote ahb_vote;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_client *cpas_client = NULL;
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (!client_ahb_vote) {
+		CAM_ERR(CAM_CPAS, "Invalid input arg");
+		return -EINVAL;
+	}
+
+	ahb_vote = *client_ahb_vote;
+
+	if (ahb_vote.vote.level == 0) {
+		CAM_DBG(CAM_CPAS, "0 ahb vote from client %d",
+			client_handle);
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] has not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto unlock_client;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"client=[%d][%s][%d] : type[%d], level[%d], freq[%ld], applied[%d]",
+		client_indx, cpas_client->data.identifier,
+		cpas_client->data.cell_index, ahb_vote.type,
+		ahb_vote.vote.level, ahb_vote.vote.freq,
+		cpas_core->cpas_client[client_indx]->ahb_level);
+
+	rc = cam_cpas_util_apply_client_ahb_vote(cpas_hw,
+		cpas_core->cpas_client[client_indx], &ahb_vote, NULL);
+
+unlock_client:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_util_create_vote_all_paths(
+	struct cam_cpas_client *cpas_client,
+	struct cam_axi_vote *axi_vote)
+{
+	int i, j;
+	uint64_t camnoc_bw, mnoc_ab_bw, mnoc_ib_bw;
+	struct cam_cpas_axi_per_path_bw_vote *axi_path;
+
+	if (!cpas_client || !axi_vote)
+		return -EINVAL;
+
+	camnoc_bw = axi_vote->axi_path[0].camnoc_bw;
+	mnoc_ab_bw = axi_vote->axi_path[0].mnoc_ab_bw;
+	mnoc_ib_bw = axi_vote->axi_path[0].mnoc_ib_bw;
+
+	axi_vote->num_paths = 0;
+
+	for (i = 0; i < CAM_CPAS_TRANSACTION_MAX; i++) {
+		for (j = 0; j < CAM_CPAS_PATH_DATA_MAX; j++) {
+			if (cpas_client->tree_node[j][i]) {
+				axi_path = &axi_vote->axi_path[axi_vote->num_paths];
+
+				axi_path->path_data_type = j;
+				axi_path->transac_type = i;
+				axi_path->camnoc_bw = camnoc_bw;
+				axi_path->mnoc_ab_bw = mnoc_ab_bw;
+				axi_path->mnoc_ib_bw = mnoc_ib_bw;
+				if (cpas_client->tree_node[j][i]->drv_voting_idx >
+					CAM_CPAS_PORT_HLOS_DRV)
+					axi_path->vote_level = CAM_CPAS_VOTE_LEVEL_LOW;
+
+				axi_vote->num_paths++;
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cpas_hw_start(void *hw_priv, void *start_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	uint32_t client_indx;
+	struct cam_cpas_hw_cmd_start *cmd_hw_start;
+	struct cam_cpas_client *cpas_client;
+	struct cam_ahb_vote *ahb_vote;
+	struct cam_ahb_vote remove_ahb;
+	struct cam_axi_vote axi_vote = {0};
+	enum cam_vote_level applied_level = CAM_LOWSVS_D1_VOTE;
+	int rc, i = 0, err_val = 0;
+	struct cam_cpas_private_soc *soc_private = NULL;
+	bool invalid_start = true;
+	int count;
+
+	if (!hw_priv || !start_args) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK",
+			hw_priv, start_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_cpas_hw_cmd_start) != arg_size) {
+		CAM_ERR(CAM_CPAS, "HW_CAPS size mismatch %zd %d",
+			sizeof(struct cam_cpas_hw_cmd_start), arg_size);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)hw_priv;
+	cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+	cmd_hw_start = (struct cam_cpas_hw_cmd_start *)start_args;
+	client_indx = CAM_CPAS_GET_CLIENT_IDX(cmd_hw_start->client_handle);
+	ahb_vote = cmd_hw_start->ahb_vote;
+
+	if (!ahb_vote || !cmd_hw_start->axi_vote)
+		return -EINVAL;
+
+	if (!ahb_vote->vote.level) {
+		CAM_ERR(CAM_CPAS, "Invalid vote ahb[%d]",
+			ahb_vote->vote.level);
+		return -EINVAL;
+	}
+
+	memcpy(&axi_vote, cmd_hw_start->axi_vote, sizeof(struct cam_axi_vote));
+	for (i = 0; i < axi_vote.num_paths; i++) {
+		if ((axi_vote.axi_path[i].camnoc_bw != 0) ||
+			(axi_vote.axi_path[i].mnoc_ab_bw != 0) ||
+			(axi_vote.axi_path[i].mnoc_ib_bw != 0)) {
+			invalid_start = false;
+			break;
+		}
+	}
+
+	if (invalid_start) {
+		CAM_ERR(CAM_CPAS, "Zero start vote");
+		return -EINVAL;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_REGISTERED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d] is not registered",
+			client_indx);
+		rc = -EPERM;
+		goto error;
+	}
+
+	if (CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] is in start state",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto error;
+	}
+
+	CAM_DBG(CAM_CPAS,
+		"AHB :client=[%d][%s][%d] type[%d], level[%d], applied[%d]",
+		client_indx, cpas_client->data.identifier,
+		cpas_client->data.cell_index,
+		ahb_vote->type, ahb_vote->vote.level, cpas_client->ahb_level);
+	rc = cam_cpas_util_apply_client_ahb_vote(cpas_hw, cpas_client,
+		ahb_vote, &applied_level);
+	if (rc)
+		goto error;
+
+	cam_cpas_dump_axi_vote_info(cpas_client, "CPAS Start Vote",
+		&axi_vote);
+
+	/*
+	 * If client has indicated start bw to be applied on all paths
+	 * of client, apply that otherwise apply whatever the client supplies
+	 * for specific paths
+	 */
+	if (axi_vote.axi_path[0].path_data_type ==
+		CAM_CPAS_API_PATH_DATA_STD_START) {
+		rc = cam_cpas_util_create_vote_all_paths(cpas_client,
+			&axi_vote);
+	} else {
+		rc = cam_cpas_util_translate_client_paths(&axi_vote);
+	}
+
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Unable to create or translate paths rc: %d",
+			rc);
+		goto remove_ahb_vote;
+	}
+
+	cam_cpas_dump_axi_vote_info(cpas_client, "CPAS Start Translated Vote", &axi_vote);
+
+	if (cpas_core->streamon_clients == 0) {
+		if (cpas_core->force_hlos_drv) {
+			soc_private->enable_cam_ddr_drv = false;
+			soc_private->enable_cam_clk_drv = false;
+		}
+
+		if (cpas_core->force_cesta_sw_client)
+			soc_private->enable_cam_clk_drv = false;
+
+		if (debug_drv)
+			CAM_INFO(CAM_CPAS, "DRV enable[DDR CLK]:[%s %s]",
+				CAM_BOOL_TO_YESNO(soc_private->enable_cam_ddr_drv),
+				CAM_BOOL_TO_YESNO(soc_private->enable_cam_clk_drv));
+
+		rc = cam_cpas_util_apply_default_axi_vote(cpas_hw, true);
+		if (rc)
+			goto remove_ahb_vote;
+
+		atomic_set(&cpas_core->soc_access_count, 1);
+
+		count = cam_soc_util_regulators_enabled(&cpas_hw->soc_info);
+		if (count > 0)
+			CAM_DBG(CAM_CPAS, "Regulators already enabled %d", count);
+
+		rc = cam_cpas_soc_enable_resources(&cpas_hw->soc_info,
+			applied_level);
+		if (rc) {
+			atomic_set(&cpas_core->soc_access_count, 0);
+			CAM_ERR(CAM_CPAS, "enable_resorce failed, rc=%d", rc);
+			goto remove_ahb_vote;
+		}
+
+		if (cpas_core->internal_ops.qchannel_handshake) {
+			rc = cpas_core->internal_ops.qchannel_handshake(cpas_hw, true, false);
+			if (rc) {
+				CAM_WARN(CAM_CPAS, "failed in qchannel_handshake rc=%d", rc);
+				/* Do not return error, passthrough */
+
+				rc = cpas_core->internal_ops.qchannel_handshake(cpas_hw,
+					true, true);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+						"failed in qchannel_handshake, hw blocks may not work rc=%d",
+						rc);
+					/* Do not return error, passthrough */
+				}
+			}
+		}
+
+		if (cpas_core->internal_ops.power_on) {
+			rc = cpas_core->internal_ops.power_on(cpas_hw);
+			if (rc) {
+				atomic_set(&cpas_core->soc_access_count, 0);
+				cam_cpas_soc_disable_resources(
+					&cpas_hw->soc_info, true, true);
+				CAM_ERR(CAM_CPAS,
+					"failed in power_on settings rc=%d",
+					rc);
+				goto remove_ahb_vote;
+			}
+		}
+		CAM_DBG(CAM_CPAS, "soc_access_count=%d\n",
+			atomic_read(&cpas_core->soc_access_count));
+
+		if (soc_private->enable_smart_qos)
+			cam_cpas_reset_niu_priorities(cpas_hw);
+
+		cam_smmu_reset_cb_page_fault_cnt();
+		cpas_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	}
+
+	/*
+	 * Need to apply axi vote after we enable clocks, since we need certain clocks enabled for
+	 * drv channel switch
+	 */
+	rc = cam_cpas_util_apply_client_axi_vote(cpas_hw, cpas_client, &axi_vote,
+		CAM_CPAS_APPLY_TYPE_START);
+	if (rc)
+		goto remove_ahb_vote;
+
+	cpas_client->started = true;
+	cpas_core->streamon_clients++;
+
+	if (debug_drv && (cpas_core->streamon_clients == 1)) {
+		cam_cpas_log_vote(cpas_hw, false);
+		cam_cpas_dump_full_tree_state(cpas_hw, "StartFirstClient");
+	}
+
+	CAM_DBG(CAM_CPAS, "client=[%d][%s][%d] streamon_clients=%d",
+		client_indx, cpas_client->data.identifier,
+		cpas_client->data.cell_index, cpas_core->streamon_clients);
+
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+
+remove_ahb_vote:
+	remove_ahb.type = CAM_VOTE_ABSOLUTE;
+	remove_ahb.vote.level = CAM_SUSPEND_VOTE;
+	err_val = cam_cpas_util_apply_client_ahb_vote(cpas_hw, cpas_client,
+		&remove_ahb, NULL);
+	if (err_val)
+		CAM_ERR(CAM_CPAS, "Removing AHB vote failed, rc=%d", err_val);
+
+error:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int _check_soc_access_count(struct cam_cpas *cpas_core)
+{
+	return (atomic_read(&cpas_core->soc_access_count) > 0) ? 0 : 1;
+}
+
+static int cam_cpas_util_validate_stop_bw(struct cam_cpas_private_soc *soc_private,
+	struct cam_cpas *cpas_core)
+{
+	int i;
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		if (soc_private->enable_cam_ddr_drv &&
+			(cpas_core->axi_port[i].bus_client.common_data.is_drv_port)) {
+
+			if ((cpas_core->axi_port[i].applied_bw.drv_vote.high.ab) ||
+				(cpas_core->axi_port[i].applied_bw.drv_vote.high.ib) ||
+				(cpas_core->axi_port[i].applied_bw.drv_vote.low.ab) ||
+				(cpas_core->axi_port[i].applied_bw.drv_vote.low.ib)) {
+				CAM_ERR(CAM_CPAS,
+					"port:%s Non zero DRV applied BW high[%llu %llu] low[%llu %llu]",
+					cpas_core->axi_port[i].axi_port_name,
+					cpas_core->axi_port[i].applied_bw.drv_vote.high.ab,
+					cpas_core->axi_port[i].applied_bw.drv_vote.high.ib,
+					cpas_core->axi_port[i].applied_bw.drv_vote.low.ab,
+					cpas_core->axi_port[i].applied_bw.drv_vote.low.ib);
+				return -EINVAL;
+			}
+		} else {
+			if (cpas_core->axi_port[i].bus_client.common_data.is_drv_port)
+				continue;
+
+			if ((cpas_core->axi_port[i].applied_bw.hlos_vote.ab) ||
+				(cpas_core->axi_port[i].applied_bw.hlos_vote.ib)) {
+				CAM_ERR(CAM_CPAS,
+					"port:%s Non zero HLOS applied BW [%llu %llu]",
+					cpas_core->axi_port[i].axi_port_name,
+					cpas_core->axi_port[i].applied_bw.hlos_vote.ab,
+					cpas_core->axi_port[i].applied_bw.hlos_vote.ib);
+				return -EINVAL;
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cpas_hw_stop(void *hw_priv, void *stop_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	uint32_t client_indx;
+	struct cam_cpas_hw_cmd_stop *cmd_hw_stop;
+	struct cam_cpas_client *cpas_client;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	struct cam_cpas_private_soc *soc_private = NULL;
+	int rc = 0, count;
+	long result;
+	int retry_camnoc_idle = 0;
+
+	if (!hw_priv || !stop_args) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK",
+			hw_priv, stop_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_cpas_hw_cmd_stop) != arg_size) {
+		CAM_ERR(CAM_CPAS, "HW_CAPS size mismatch %zd %d",
+			sizeof(struct cam_cpas_hw_cmd_stop), arg_size);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)hw_priv;
+	cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+	cmd_hw_stop = (struct cam_cpas_hw_cmd_stop *)stop_args;
+	client_indx = CAM_CPAS_GET_CLIENT_IDX(cmd_hw_stop->client_handle);
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	CAM_DBG(CAM_CPAS, "Client=[%d][%s][%d] streamon_clients=%d",
+		client_indx, cpas_client->data.identifier,
+		cpas_client->data.cell_index, cpas_core->streamon_clients);
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "Client=[%d][%s][%d] is not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto done;
+	}
+
+	rc = cam_cpas_util_create_vote_all_paths(cpas_client, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Unable to create per path votes rc: %d", rc);
+		goto done;
+	}
+
+	cam_cpas_dump_axi_vote_info(cpas_client, "CPAS Stop Vote", &axi_vote);
+
+	rc = cam_cpas_util_apply_client_axi_vote(cpas_hw, cpas_client, &axi_vote,
+		CAM_CPAS_APPLY_TYPE_STOP);
+	if (rc)
+		goto done;
+
+	cpas_client->started = false;
+
+	if (debug_drv && (cpas_core->streamon_clients == 1)) {
+		cam_cpas_log_vote(cpas_hw, false);
+		cam_cpas_dump_full_tree_state(cpas_hw, "StopLastClient");
+	}
+
+	cpas_core->streamon_clients--;
+
+	if (cpas_core->streamon_clients == 0) {
+		if (cpas_core->internal_ops.power_off) {
+			rc = cpas_core->internal_ops.power_off(cpas_hw);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"failed in power_off settings rc=%d",
+					rc);
+				/* Do not return error, passthrough */
+			}
+		}
+
+		if (cpas_core->internal_ops.qchannel_handshake) {
+			rc = cpas_core->internal_ops.qchannel_handshake(cpas_hw, false, false);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "failed in qchannel_handshake rc=%d", rc);
+				retry_camnoc_idle = 1;
+				/* Do not return error, passthrough */
+			}
+		}
+
+		rc = cam_cpas_soc_disable_irq(&cpas_hw->soc_info);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "disable_irq failed, rc=%d", rc);
+			goto done;
+		}
+
+		/* Wait for any IRQs still being handled */
+		atomic_dec(&cpas_core->soc_access_count);
+		result = wait_event_timeout(cpas_core->soc_access_count_wq,
+			_check_soc_access_count(cpas_core), HZ);
+		if (result == 0) {
+			CAM_ERR(CAM_CPAS, "Wait failed: soc_access_count=%d",
+				atomic_read(&cpas_core->soc_access_count));
+		}
+
+		/* try again incase camnoc is still not idle */
+		if (cpas_core->internal_ops.qchannel_handshake &&
+			retry_camnoc_idle) {
+			rc = cpas_core->internal_ops.qchannel_handshake(cpas_hw, false, false);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "failed in qchannel_handshake rc=%d", rc);
+				/* Do not return error, passthrough */
+			}
+		}
+
+		rc = cam_cpas_soc_disable_resources(&cpas_hw->soc_info,
+			true, false);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "disable_resorce failed, rc=%d", rc);
+			goto done;
+		}
+		CAM_DBG(CAM_CPAS, "Disabled all the resources: soc_access_count=%d",
+			atomic_read(&cpas_core->soc_access_count));
+
+		count = cam_soc_util_regulators_enabled(&cpas_hw->soc_info);
+		if (count > 0)
+			CAM_WARN(CAM_CPAS,
+				"Client=[%d][%s][%d] qchannel shut down while top gdsc is still on %d",
+				client_indx, cpas_client->data.identifier,
+				cpas_client->data.cell_index, count);
+
+		rc = cam_cpas_util_apply_default_axi_vote(cpas_hw, false);
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in power off default vote rc: %d", rc);
+
+		rc = cam_cpas_util_validate_stop_bw(soc_private, cpas_core);
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Invalid applied bw at stop rc: %d", rc);
+
+		cpas_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	}
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_SUSPEND_VOTE;
+	rc = cam_cpas_util_apply_client_ahb_vote(cpas_hw, cpas_client,
+		&ahb_vote, NULL);
+	if (rc)
+		goto done;
+
+done:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_hw_init(void *hw_priv, void *init_hw_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	int rc = 0;
+
+	if (!hw_priv || !init_hw_args) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK",
+			hw_priv, init_hw_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_cpas_hw_caps) != arg_size) {
+		CAM_ERR(CAM_CPAS, "INIT HW size mismatch %zd %d",
+			sizeof(struct cam_cpas_hw_caps), arg_size);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)hw_priv;
+	cpas_core = (struct cam_cpas *)cpas_hw->core_info;
+
+	if (cpas_core->internal_ops.init_hw_version) {
+		rc = cpas_core->internal_ops.init_hw_version(cpas_hw,
+			(struct cam_cpas_hw_caps *)init_hw_args);
+	}
+
+	return rc;
+}
+
+static int cam_cpas_hw_register_client(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_register_params *register_params)
+{
+	int rc;
+	char client_name[CAM_HW_IDENTIFIER_LENGTH + 3];
+	int32_t client_indx = -1;
+	struct cam_cpas *cpas_core = (struct cam_cpas *)cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+
+	if ((!register_params) ||
+		(strlen(register_params->identifier) < 1)) {
+		CAM_ERR(CAM_CPAS, "Invalid cpas client identifier");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CPAS, "Register params : identifier=%s, cell_index=%d",
+		register_params->identifier, register_params->cell_index);
+
+	if (soc_private->client_id_based)
+		snprintf(client_name, sizeof(client_name), "%s%d",
+			register_params->identifier,
+			register_params->cell_index);
+	else
+		snprintf(client_name, sizeof(client_name), "%s",
+			register_params->identifier);
+
+	mutex_lock(&cpas_hw->hw_mutex);
+
+	rc = cam_common_util_get_string_index(soc_private->client_name,
+		soc_private->num_clients, client_name, &client_indx);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Client %s is not found in CPAS client list rc=%d",
+			client_name, rc);
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return -ENODEV;
+	}
+
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+
+	if (rc || !CAM_CPAS_CLIENT_VALID(client_indx) ||
+		CAM_CPAS_CLIENT_REGISTERED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS,
+			"Inval client %s %d : %d %d %pK %d",
+			register_params->identifier,
+			register_params->cell_index,
+			CAM_CPAS_CLIENT_VALID(client_indx),
+			CAM_CPAS_CLIENT_REGISTERED(cpas_core, client_indx),
+			cpas_core->cpas_client[client_indx], rc);
+		mutex_unlock(&cpas_core->client_mutex[client_indx]);
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return -EPERM;
+	}
+
+	register_params->client_handle =
+		CAM_CPAS_GET_CLIENT_HANDLE(client_indx);
+	memcpy(&cpas_core->cpas_client[client_indx]->data, register_params,
+		sizeof(struct cam_cpas_register_params));
+	cpas_core->registered_clients++;
+	cpas_core->cpas_client[client_indx]->registered = true;
+
+	CAM_DBG(CAM_CPAS, "client=[%d][%s][%d], registered_clients=%d",
+		client_indx,
+		cpas_core->cpas_client[client_indx]->data.identifier,
+		cpas_core->cpas_client[client_indx]->data.cell_index,
+		cpas_core->registered_clients);
+
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+
+	return 0;
+}
+
+static int cam_cpas_hw_unregister_client(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+
+	if (!CAM_CPAS_CLIENT_REGISTERED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "Client=[%d][%s][%d] not registered",
+			client_indx,
+			cpas_core->cpas_client[client_indx]->data.identifier,
+			cpas_core->cpas_client[client_indx]->data.cell_index);
+		rc = -EPERM;
+		goto done;
+	}
+
+	if (CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "Client=[%d][%s][%d] is not stopped",
+			client_indx,
+			cpas_core->cpas_client[client_indx]->data.identifier,
+			cpas_core->cpas_client[client_indx]->data.cell_index);
+
+		rc = -EPERM;
+		goto done;
+	}
+
+	CAM_DBG(CAM_CPAS, "client=[%d][%s][%d], registered_clients=%d",
+		client_indx,
+		cpas_core->cpas_client[client_indx]->data.identifier,
+		cpas_core->cpas_client[client_indx]->data.cell_index,
+		cpas_core->registered_clients);
+
+	cpas_core->cpas_client[client_indx]->registered = false;
+	cpas_core->registered_clients--;
+done:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_hw_get_hw_info(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	struct cam_cpas_hw_caps *hw_caps;
+	struct cam_cpas_private_soc *soc_private;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK",
+			hw_priv, get_hw_cap_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_cpas_hw_caps) != arg_size) {
+		CAM_ERR(CAM_CPAS, "HW_CAPS size mismatch %zd %d",
+			sizeof(struct cam_cpas_hw_caps), arg_size);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)hw_priv;
+	cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	hw_caps = (struct cam_cpas_hw_caps *)get_hw_cap_args;
+	*hw_caps = cpas_core->hw_caps;
+
+	/*Extract Fuse Info*/
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+
+	hw_caps->fuse_info = soc_private->fuse_info;
+	CAM_DBG(CAM_CPAS, "fuse info->num_fuses %d", hw_caps->fuse_info.num_fuses);
+
+	return 0;
+}
+
+static int cam_cpas_log_vote(struct cam_hw_info *cpas_hw, bool ddr_only)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	uint32_t i, vcd_idx;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas_cesta_info *cesta_info =
+		(struct cam_cpas_cesta_info *)cpas_core->cesta_info;
+
+	if ((cpas_core->streamon_clients > 0) && soc_private->enable_smart_qos && !ddr_only)
+		cam_cpas_print_smart_qos_priority(cpas_hw);
+
+
+	/*
+	 * First print rpmh registers as early as possible to catch nearest
+	 * state of rpmh after an issue (overflow) occurs.
+	 */
+	if ((cpas_core->streamon_clients > 0) &&
+		(cpas_core->regbase_index[CAM_CPAS_REG_RPMH] != -1)) {
+		int reg_base_index =
+			cpas_core->regbase_index[CAM_CPAS_REG_RPMH];
+		void __iomem *rpmh_base =
+			soc_info->reg_map[reg_base_index].mem_base;
+		uint32_t offset_fe, offset_be;
+		uint32_t fe_val, be_val;
+		uint32_t *rpmh_info = &soc_private->rpmh_info[0];
+		uint32_t ddr_bcm_index =
+			soc_private->rpmh_info[CAM_RPMH_BCM_DDR_INDEX];
+		uint32_t mnoc_bcm_index =
+			soc_private->rpmh_info[CAM_RPMH_BCM_MNOC_INDEX];
+
+		/*
+		 * print 12 registers from 0x4, 0x800 offsets -
+		 * this will give ddr, mmnoc and other BCM info.
+		 * i=0 for DDR, i=4 for mnoc, but double check for each chipset.
+		 */
+		for (i = 0; i < rpmh_info[CAM_RPMH_NUMBER_OF_BCMS]; i++) {
+			if ((!cpas_core->full_state_dump) &&
+				(i != ddr_bcm_index) &&
+				(i != mnoc_bcm_index))
+				continue;
+
+			offset_fe = rpmh_info[CAM_RPMH_BCM_FE_OFFSET] +
+				(i * 0x4);
+			offset_be = rpmh_info[CAM_RPMH_BCM_BE_OFFSET] +
+				(i * 0x4);
+
+			fe_val = cam_io_r_mb(rpmh_base + offset_fe);
+			be_val = cam_io_r_mb(rpmh_base + offset_be);
+
+			CAM_INFO(CAM_CPAS,
+				"i=%d, FE[offset=0x%x, value=0x%x] BE[offset=0x%x, value=0x%x]",
+				i, offset_fe, fe_val, offset_be, be_val);
+		}
+	}
+
+	if ((cpas_core->streamon_clients > 0) &&
+		cpas_core->regbase_index[CAM_CPAS_REG_CESTA] != -1) {
+		int reg_base_index =
+			cpas_core->regbase_index[CAM_CPAS_REG_CESTA];
+		void __iomem *cesta_base =
+			soc_info->reg_map[reg_base_index].mem_base;
+		uint32_t vcd_base_inc =
+			cesta_info->cesta_reg_info->vcd_currol.vcd_base_inc;
+		uint32_t num_vcds = cesta_info->num_vcds;
+		uint32_t vcd_curr_lvl_base =
+			cesta_info->cesta_reg_info->vcd_currol.reg_offset;
+		uint32_t cesta_vcd_curr_perfol_offset, cesta_vcd_curr_perfol_val;
+
+		if (!atomic_inc_not_zero(&cpas_core->soc_access_count))
+			goto skip_vcd_dump;
+
+		for (i = 0; i < num_vcds; i++) {
+			vcd_idx = cesta_info->vcd_info[i].index;
+			cesta_vcd_curr_perfol_offset = vcd_curr_lvl_base +
+				(vcd_base_inc * vcd_idx);
+			cesta_vcd_curr_perfol_val =
+				cam_io_r_mb(cesta_base + cesta_vcd_curr_perfol_offset);
+
+			CAM_INFO(CAM_CPAS,
+				"i=%d, VCD[index=%d, type=%d, name=%s] [offset=0x%x, value=0x%x]",
+				i, cesta_info->vcd_info[i].index,
+				cesta_info->vcd_info[i].type,
+				cesta_info->vcd_info[i].clk,
+				cesta_vcd_curr_perfol_offset,
+				cesta_vcd_curr_perfol_val);
+		}
+
+		atomic_dec(&cpas_core->soc_access_count);
+		wake_up(&cpas_core->soc_access_count_wq);
+	}
+
+skip_vcd_dump:
+	if (ddr_only)
+		return 0;
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		if (cpas_core->axi_port[i].bus_client.common_data.is_drv_port) {
+			CAM_INFO(CAM_PERF,
+				"[%s] DRV applied: high [%llu %llu] low[%llu %llu] new: high [%llu %llu] low [%llu %llu]",
+				cpas_core->axi_port[i].axi_port_name,
+				cpas_core->axi_port[i].applied_bw.drv_vote.high.ab,
+				cpas_core->axi_port[i].applied_bw.drv_vote.high.ib,
+				cpas_core->axi_port[i].applied_bw.drv_vote.low.ab,
+				cpas_core->axi_port[i].applied_bw.drv_vote.low.ib,
+				cpas_core->axi_port[i].curr_bw.drv_vote.high.ab,
+				cpas_core->axi_port[i].curr_bw.drv_vote.high.ib,
+				cpas_core->axi_port[i].curr_bw.drv_vote.low.ab,
+				cpas_core->axi_port[i].curr_bw.drv_vote.low.ib);
+		} else {
+			CAM_INFO(CAM_PERF, "Port %s HLOS applied [%llu %llu] new [%llu %llu]",
+				cpas_core->axi_port[i].axi_port_name,
+				cpas_core->axi_port[i].applied_bw.hlos_vote.ab,
+				cpas_core->axi_port[i].applied_bw.hlos_vote.ib,
+				cpas_core->axi_port[i].curr_bw.hlos_vote.ab,
+				cpas_core->axi_port[i].curr_bw.hlos_vote.ib);
+		}
+	}
+
+	if (soc_private->control_camnoc_axi_clk) {
+		CAM_INFO(CAM_CPAS, "applied camnoc axi clk sw_client[%lld]",
+			cpas_core->applied_camnoc_axi_rate.sw_client);
+
+		if (soc_private->enable_cam_clk_drv)
+			CAM_INFO(CAM_CPAS,
+				"applied camnoc axi clk hw_client[high low] cesta_idx0:[%lld %lld] cesta_idx1:[%lld %lld] cesta_idx2:[%lld %lld]",
+				cpas_core->applied_camnoc_axi_rate.hw_client[0].high,
+				cpas_core->applied_camnoc_axi_rate.hw_client[0].low,
+				cpas_core->applied_camnoc_axi_rate.hw_client[1].high,
+				cpas_core->applied_camnoc_axi_rate.hw_client[1].low,
+				cpas_core->applied_camnoc_axi_rate.hw_client[2].high,
+				cpas_core->applied_camnoc_axi_rate.hw_client[2].low);
+	} else {
+		for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+			CAM_INFO(CAM_CPAS,
+				"[%s] ab_bw[%lld] ib_bw[%lld] additional_bw[%lld] applied_ab[%lld] applied_ib[%lld]",
+				cpas_core->camnoc_axi_port[i].axi_port_name,
+				cpas_core->camnoc_axi_port[i].curr_bw.hlos_vote.ab,
+				cpas_core->camnoc_axi_port[i].curr_bw.hlos_vote.ib,
+				cpas_core->camnoc_axi_port[i].additional_bw,
+				cpas_core->camnoc_axi_port[i].applied_bw.hlos_vote.ab,
+				cpas_core->camnoc_axi_port[i].applied_bw.hlos_vote.ib);
+		}
+	}
+
+	CAM_INFO(CAM_CPAS, "ahb client curr vote level[%d]",
+		cpas_core->ahb_bus_client.curr_vote_level);
+
+	if (!cpas_core->full_state_dump) {
+		CAM_DBG(CAM_CPAS, "CPAS full state dump not enabled");
+		return 0;
+	}
+
+	/* This will traverse through all nodes in the tree and print stats */
+	cam_cpas_dump_full_tree_state(cpas_hw, "state_dump_on_error");
+
+	cam_cpas_dump_monitor_array(cpas_hw);
+
+	if (cpas_core->internal_ops.print_poweron_settings)
+		cpas_core->internal_ops.print_poweron_settings(cpas_hw);
+	else
+		CAM_DBG(CAM_CPAS, "No ops for print_poweron_settings");
+
+	return 0;
+}
+
+static void cam_cpas_update_monitor_array(struct cam_hw_info *cpas_hw,
+	const char *identifier_string, int32_t identifier_value)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_camnoc_info *camnoc_info = NULL;
+	struct cam_cpas_cesta_info *cesta_info = cpas_core->cesta_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas_monitor *entry;
+	int iterator, i, j = 0, vcd_idx, camnoc_reg_idx;
+	uint32_t val = 0, camnoc_idx;
+
+	CAM_CPAS_INC_MONITOR_HEAD(&cpas_core->monitor_head, &iterator);
+
+	entry = &cpas_core->monitor_entries[iterator];
+	entry->cpas_hw = cpas_hw;
+
+	CAM_GET_TIMESTAMP(entry->timestamp);
+	strscpy(entry->identifier_string, identifier_string,
+		sizeof(entry->identifier_string));
+
+	entry->identifier_value = identifier_value;
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		entry->axi_info[i].axi_port_name = cpas_core->axi_port[i].axi_port_name;
+		memcpy(&entry->axi_info[i].curr_bw, &cpas_core->axi_port[i].curr_bw,
+			sizeof(struct cam_cpas_axi_bw_info));
+
+		/* camnoc bw value not applicable for mnoc ports */
+		entry->axi_info[i].camnoc_bw = 0;
+		memcpy(&entry->axi_info[i].applied_bw, &cpas_core->axi_port[i].applied_bw,
+			sizeof(struct cam_cpas_axi_bw_info));
+		entry->axi_info[i].is_drv_started = cpas_core->axi_port[i].is_drv_started;
+	}
+
+	memcpy(&entry->applied_camnoc_clk, &cpas_core->applied_camnoc_axi_rate,
+		sizeof(struct cam_soc_util_clk_rates));
+	entry->applied_ahb_level = cpas_core->ahb_bus_client.curr_vote_level;
+
+	if ((cpas_core->streamon_clients > 0) &&
+		(cpas_core->regbase_index[CAM_CPAS_REG_RPMH] != -1) &&
+		soc_private->rpmh_info[CAM_RPMH_NUMBER_OF_BCMS]) {
+		int reg_base_index =
+			cpas_core->regbase_index[CAM_CPAS_REG_RPMH];
+		void __iomem *rpmh_base =
+			soc_info->reg_map[reg_base_index].mem_base;
+		uint32_t fe_ddr_offset =
+			soc_private->rpmh_info[CAM_RPMH_BCM_FE_OFFSET] +
+			(0x4 * soc_private->rpmh_info[CAM_RPMH_BCM_DDR_INDEX]);
+		uint32_t fe_mnoc_offset =
+			soc_private->rpmh_info[CAM_RPMH_BCM_FE_OFFSET] +
+			(0x4 * soc_private->rpmh_info[CAM_RPMH_BCM_MNOC_INDEX]);
+		uint32_t be_ddr_offset =
+			soc_private->rpmh_info[CAM_RPMH_BCM_BE_OFFSET] +
+			(0x4 * soc_private->rpmh_info[CAM_RPMH_BCM_DDR_INDEX]);
+		uint32_t be_mnoc_offset =
+			soc_private->rpmh_info[CAM_RPMH_BCM_BE_OFFSET] +
+			(0x4 * soc_private->rpmh_info[CAM_RPMH_BCM_MNOC_INDEX]);
+		uint32_t be_shub_offset =
+			soc_private->rpmh_info[CAM_RPMH_BCM_BE_OFFSET] +
+			(0x4 * 1); /* i=1 for SHUB, hardcode for now */
+
+		/*
+		 * 0x4, 0x800 - DDR
+		 * 0x800, 0x810 - mmnoc
+		 */
+		entry->fe_ddr = cam_io_r_mb(rpmh_base + fe_ddr_offset);
+		entry->fe_mnoc = cam_io_r_mb(rpmh_base + fe_mnoc_offset);
+		entry->be_ddr = cam_io_r_mb(rpmh_base + be_ddr_offset);
+		entry->be_mnoc = cam_io_r_mb(rpmh_base + be_mnoc_offset);
+		entry->be_shub = cam_io_r_mb(rpmh_base + be_shub_offset);
+
+		CAM_DBG(CAM_CPAS,
+			"fe_ddr=0x%x, fe_mnoc=0x%x, be_ddr=0x%x, be_mnoc=0x%x",
+			entry->fe_ddr, entry->fe_mnoc, entry->be_ddr,
+			entry->be_mnoc);
+	}
+
+	if ((cpas_core->streamon_clients > 0) &&
+		cpas_core->regbase_index[CAM_CPAS_REG_CESTA] != -1) {
+		int reg_base_index =
+			cpas_core->regbase_index[CAM_CPAS_REG_CESTA];
+		void __iomem *cesta_base =
+			soc_info->reg_map[reg_base_index].mem_base;
+		uint32_t vcd_base_inc = cesta_info->cesta_reg_info->vcd_currol.vcd_base_inc;
+		uint32_t num_vcds = cesta_info->num_vcds;
+		uint32_t vcd_curr_lvl_base = cesta_info->cesta_reg_info->vcd_currol.reg_offset;
+		uint32_t cesta_vcd_curr_perfol_offset, cesta_vcd_curr_perfol_val;
+
+		if (atomic_inc_not_zero(&cpas_core->soc_access_count)) {
+			for (i = 0; i < num_vcds; i++) {
+				vcd_idx = cesta_info->vcd_info[i].index;
+
+				cesta_vcd_curr_perfol_offset = vcd_curr_lvl_base +
+					(vcd_base_inc * vcd_idx);
+				cesta_vcd_curr_perfol_val =
+					cam_io_r_mb(cesta_base +
+					cesta_vcd_curr_perfol_offset);
+				entry->vcd_reg_debug_info.vcd_curr_lvl_debug_info[i].index =
+					cesta_info->vcd_info[i].index;
+				entry->vcd_reg_debug_info.vcd_curr_lvl_debug_info[i]
+					.reg_value = cesta_vcd_curr_perfol_val;
+			}
+			atomic_dec(&cpas_core->soc_access_count);
+			wake_up(&cpas_core->soc_access_count_wq);
+		}
+	}
+
+	for (camnoc_idx = 0; camnoc_idx < cpas_core->num_valid_camnoc; camnoc_idx++) {
+
+		camnoc_info = cpas_core->camnoc_info[camnoc_idx];
+		camnoc_reg_idx = cpas_core->regbase_index[camnoc_info->reg_base];
+
+		for (i = 0, j = 0; i < camnoc_info->specific_size; i++) {
+			if ((!camnoc_info->specific[i].enable) ||
+				(!camnoc_info->specific[i].maxwr_low.enable))
+				continue;
+
+			if (j >= CAM_CAMNOC_FILL_LVL_REG_INFO_MAX) {
+				CAM_WARN(CAM_CPAS,
+					"CPAS monitor reg info buffer full, max : %d",
+					j);
+				break;
+			}
+
+			entry->camnoc_port_name[camnoc_idx][j] =
+				camnoc_info->specific[i].port_name;
+			val = cam_io_r_mb(soc_info->reg_map[camnoc_reg_idx].mem_base +
+				camnoc_info->specific[i].maxwr_low.offset);
+			entry->camnoc_fill_level[camnoc_idx][j] = val;
+			j++;
+		}
+
+		entry->num_camnoc_lvl_regs[camnoc_idx] = j;
+	}
+
+	if (soc_private->enable_smart_qos) {
+
+		camnoc_info = cpas_core->camnoc_info[cpas_core->camnoc_rt_idx];
+		camnoc_reg_idx = cpas_core->regbase_index[camnoc_info->reg_base];
+
+		for (i = 0; i < soc_private->smart_qos_info->num_rt_wr_nius; i++) {
+			struct cam_cpas_tree_node *niu_node =
+				soc_private->smart_qos_info->rt_wr_niu_node[i];
+
+			entry->rt_wr_niu_pri_lut_high[i] =
+				cam_io_r_mb(soc_info->reg_map[camnoc_reg_idx].mem_base +
+					niu_node->pri_lut_high_offset);
+
+			entry->rt_wr_niu_pri_lut_low[i] =
+				cam_io_r_mb(soc_info->reg_map[camnoc_reg_idx].mem_base +
+					niu_node->pri_lut_low_offset);
+		}
+	}
+}
+
+static void cam_cpas_dump_monitor_array(
+	struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	int i = 0, k = 0;
+	int64_t state_head = 0;
+	uint32_t index, num_entries, oldest_entry, camnoc_idx, j;
+	uint64_t ms, hrs, min, sec;
+	struct cam_cpas_monitor *entry;
+	struct timespec64 curr_timestamp;
+	char log_buf[CAM_CPAS_LOG_BUF_LEN];
+	size_t len;
+	uint8_t vcd_index;
+	struct cam_cpas_cesta_info *cesta_info = cpas_core->cesta_info;
+	struct cam_camnoc_info *camnoc_info;
+
+	if (!cpas_core->full_state_dump)
+		return;
+
+	state_head = atomic64_read(&cpas_core->monitor_head);
+
+	if (state_head == -1) {
+		CAM_WARN(CAM_CPAS, "No valid entries in cpas monitor array");
+		return;
+	} else if (state_head < CAM_CPAS_MONITOR_MAX_ENTRIES) {
+		num_entries = state_head;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_CPAS_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1,
+			CAM_CPAS_MONITOR_MAX_ENTRIES, &oldest_entry);
+	}
+
+	CAM_GET_TIMESTAMP(curr_timestamp);
+	CAM_CONVERT_TIMESTAMP_FORMAT(curr_timestamp, hrs, min, sec, ms);
+
+	CAM_INFO(CAM_CPAS,
+		"**** %llu:%llu:%llu.%llu : ======== Dumping monitor information ===========",
+		hrs, min, sec, ms);
+
+	index = oldest_entry;
+
+	for (i = 0; i < num_entries; i++) {
+		entry = &cpas_core->monitor_entries[index];
+		CAM_CONVERT_TIMESTAMP_FORMAT(entry->timestamp, hrs, min, sec, ms);
+		log_buf[0] = '\0';
+
+		CAM_INFO(CAM_CPAS,
+			"**** %llu:%llu:%llu.%llu : Index[%d] Identifier[%s][%d] camnoc=sw : %ld, hw clients [%ld %ld][%ld %ld][%ld %ld], ahb=%d",
+			hrs, min, sec, ms,
+			index,
+			entry->identifier_string, entry->identifier_value,
+			entry->applied_camnoc_clk.sw_client,
+			entry->applied_camnoc_clk.hw_client[0].high,
+			entry->applied_camnoc_clk.hw_client[0].low,
+			entry->applied_camnoc_clk.hw_client[1].high,
+			entry->applied_camnoc_clk.hw_client[1].low,
+			entry->applied_camnoc_clk.hw_client[2].high,
+			entry->applied_camnoc_clk.hw_client[2].low,
+			entry->applied_ahb_level);
+
+		for (j = 0; j < cpas_core->num_axi_ports; j++) {
+			if ((entry->axi_info[j].applied_bw.vote_type == CAM_CPAS_VOTE_TYPE_DRV) &&
+				!cpas_core->force_hlos_drv)
+				CAM_INFO(CAM_CPAS,
+					"BW [%s] : DRV started:%s high=[%lld %lld], low=[%lld %lld]",
+					entry->axi_info[j].axi_port_name,
+					CAM_BOOL_TO_YESNO(entry->axi_info[j].is_drv_started),
+					entry->axi_info[j].applied_bw.drv_vote.high.ab,
+					entry->axi_info[j].applied_bw.drv_vote.high.ib,
+					entry->axi_info[j].applied_bw.drv_vote.low.ab,
+					entry->axi_info[j].applied_bw.drv_vote.low.ib);
+
+			else
+				CAM_INFO(CAM_CPAS,
+					"BW [%s] : HLOS ab=%lld, ib=%lld, DRV high_ab=%lld, high_ib=%lld, low_ab=%lld, low_ib=%lld",
+					entry->axi_info[j].axi_port_name,
+					entry->axi_info[j].applied_bw.hlos_vote.ab,
+					entry->axi_info[j].applied_bw.hlos_vote.ib);
+		}
+
+		if (cpas_core->regbase_index[CAM_CPAS_REG_RPMH] != -1) {
+			CAM_INFO(CAM_CPAS,
+				"fe_ddr=0x%x, fe_mnoc=0x%x, be_ddr=0x%x, be_mnoc=0x%x, be_shub=0x%x",
+				entry->fe_ddr, entry->fe_mnoc,
+				entry->be_ddr, entry->be_mnoc, entry->be_shub);
+		}
+
+		if (cpas_core->regbase_index[CAM_CPAS_REG_CESTA] != -1) {
+			uint32_t vcd_base_inc =
+				cesta_info->cesta_reg_info->vcd_currol.vcd_base_inc;
+			uint32_t vcd_curr_lvl_base =
+				cesta_info->cesta_reg_info->vcd_currol.reg_offset;
+			uint32_t reg_offset;
+			uint32_t num_vcds = cesta_info->num_vcds;
+
+			for (k = 0; k < num_vcds; k++) {
+				vcd_index =
+					entry->vcd_reg_debug_info.vcd_curr_lvl_debug_info[k].index;
+				reg_offset = vcd_curr_lvl_base + (vcd_base_inc * vcd_index);
+				CAM_INFO(CAM_CPAS,
+					"VCD[index=%d, type=%d, name=%s] [offset=0x%x, value=0x%x]",
+					vcd_index,
+					cesta_info->vcd_info[k].type,
+					cesta_info->vcd_info[k].clk,
+					reg_offset,
+					entry->vcd_reg_debug_info.vcd_curr_lvl_debug_info[k]
+					.reg_value);
+			}
+		}
+
+		for (camnoc_idx = 0; camnoc_idx < cpas_core->num_valid_camnoc; camnoc_idx++) {
+
+			camnoc_info = cpas_core->camnoc_info[camnoc_idx];
+			log_buf[0] = '\0';
+			len = 0;
+
+			for (j = 0; j < entry->num_camnoc_lvl_regs[camnoc_idx]; j++) {
+				len += scnprintf((log_buf + len),
+					(CAM_CPAS_LOG_BUF_LEN - len), " %s:[%d %d]",
+					entry->camnoc_port_name[camnoc_idx][j],
+					(entry->camnoc_fill_level[camnoc_idx][j] & 0x7FF),
+					(entry->camnoc_fill_level[camnoc_idx][j] & 0x7F0000)
+					>> 16);
+			}
+
+			CAM_INFO(CAM_CPAS, "%s REG[Queued Pending] %s",
+				camnoc_info->camnoc_name, log_buf);
+		}
+
+		if (soc_private->enable_smart_qos) {
+			len = 0;
+			for (j = 0; j < soc_private->smart_qos_info->num_rt_wr_nius; j++) {
+				struct cam_cpas_tree_node *niu_node =
+					soc_private->smart_qos_info->rt_wr_niu_node[j];
+
+				len += scnprintf((log_buf + len),
+					(CAM_CPAS_LOG_BUF_LEN - len), " [%s: high 0x%x low 0x%x]",
+					niu_node->node_name,
+					entry->rt_wr_niu_pri_lut_high[j],
+					entry->rt_wr_niu_pri_lut_low[j]);
+			}
+			CAM_INFO(CAM_CPAS, "SmartQoS [Node: Pri_lut] %s", log_buf);
+		}
+
+		index = (index + 1) % CAM_CPAS_MONITOR_MAX_ENTRIES;
+	}
+}
+
+static void *cam_cpas_user_dump_state_monitor_array_info(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	uint64_t *addr;
+	struct cam_common_hw_dump_header *hdr;
+	struct cam_cpas_monitor *monitor = (struct cam_cpas_monitor *)dump_struct;
+	struct cam_cpas_axi_port_debug_info *axi_info = NULL;
+	struct cam_cpas_cesta_vcd_reg_debug_info *vcd_reg_debug_info = NULL;
+	struct cam_hw_info *cpas_hw = (struct cam_hw_info *) monitor->cpas_hw;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_tree_node *niu_node;
+	uint8_t *dst;
+	uint32_t num_vcds = CAM_CPAS_MAX_CESTA_VCD_NUM, camnoc_idx, i;
+
+	addr = (uint64_t *)addr_ptr;
+
+	*addr++ = monitor->timestamp.tv_sec;
+	*addr++ = monitor->timestamp.tv_nsec / NSEC_PER_USEC;
+
+	*addr++ = monitor->identifier_value;
+	*addr++ = monitor->applied_camnoc_clk.sw_client,
+	*addr++ = monitor->applied_camnoc_clk.hw_client[0].high,
+	*addr++ = monitor->applied_camnoc_clk.hw_client[0].low,
+	*addr++ = monitor->applied_camnoc_clk.hw_client[1].high,
+	*addr++ = monitor->applied_camnoc_clk.hw_client[1].low,
+	*addr++ = monitor->applied_camnoc_clk.hw_client[2].high,
+	*addr++ = monitor->applied_camnoc_clk.hw_client[2].low,
+	*addr++ = monitor->applied_ahb_level;
+	*addr++ = cpas_core->num_valid_camnoc;
+
+	if (soc_private->enable_smart_qos)
+		*addr++ = soc_private->smart_qos_info->num_rt_wr_nius;
+
+	*addr++ = num_vcds;
+	*addr++ = cpas_core->num_axi_ports;
+
+	*addr++ = monitor->fe_ddr;
+	*addr++ = monitor->be_ddr;
+	*addr++ = monitor->fe_mnoc;
+	*addr++ = monitor->be_mnoc;
+	*addr++ = monitor->be_shub;
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		axi_info = &monitor->axi_info[i];
+		dst = (uint8_t *)addr;
+		hdr = (struct cam_common_hw_dump_header *)dst;
+
+		if (axi_info->applied_bw.vote_type == CAM_CPAS_VOTE_TYPE_DRV) {
+			scnprintf(hdr->tag, CAM_COMMON_HW_DUMP_TAG_MAX_LEN, "%s.%s.%s:",
+				axi_info->axi_port_name, "DRV",
+				CAM_BOOL_TO_YESNO(axi_info->is_drv_started));
+			addr = (uint64_t *)(dst + sizeof(struct cam_common_hw_dump_header));
+			*addr++ = axi_info->applied_bw.drv_vote.high.ab;
+			*addr++ = axi_info->applied_bw.drv_vote.high.ib;
+			*addr++ = axi_info->applied_bw.drv_vote.low.ab;
+			*addr++ = axi_info->applied_bw.drv_vote.low.ib;
+		} else {
+			scnprintf(hdr->tag, CAM_COMMON_HW_DUMP_TAG_MAX_LEN, "%s.%s.%s:",
+				axi_info->axi_port_name, "HLOS",
+				CAM_BOOL_TO_YESNO(axi_info->is_drv_started));
+			addr = (uint64_t *)(dst + sizeof(struct cam_common_hw_dump_header));
+			*addr++ = axi_info->applied_bw.hlos_vote.ab;
+			*addr++ = axi_info->applied_bw.hlos_vote.ib;
+		}
+	}
+
+	for (camnoc_idx = 0; camnoc_idx < cpas_core->num_valid_camnoc; camnoc_idx++) {
+		*addr++ = monitor->num_camnoc_lvl_regs[camnoc_idx];
+		for (i = 0; i < monitor->num_camnoc_lvl_regs[camnoc_idx]; i++) {
+			dst = (uint8_t *)addr;
+			hdr = (struct cam_common_hw_dump_header *)dst;
+			scnprintf(hdr->tag, CAM_COMMON_HW_DUMP_TAG_MAX_LEN, "%s:[%d %d].",
+				monitor->camnoc_port_name[camnoc_idx][i],
+				monitor->camnoc_fill_level[camnoc_idx][i] & 0x7FF,
+				(monitor->camnoc_fill_level[camnoc_idx][i] & 0x7F0000) >> 16);
+			addr = (uint64_t *)(dst + sizeof(struct cam_common_hw_dump_header));
+		}
+	}
+
+	if (soc_private->enable_smart_qos) {
+		for (i = 0; i < soc_private->smart_qos_info->num_rt_wr_nius; i++) {
+			niu_node = soc_private->smart_qos_info->rt_wr_niu_node[i];
+			dst = (uint8_t *)addr;
+			hdr = (struct cam_common_hw_dump_header *)dst;
+			scnprintf(hdr->tag, CAM_COMMON_HW_DUMP_TAG_MAX_LEN, "%s:", niu_node->node_name);
+			addr = (uint64_t *)(dst + sizeof(struct cam_common_hw_dump_header));
+			*addr++ = monitor->rt_wr_niu_pri_lut_high[i];
+			*addr++ = monitor->rt_wr_niu_pri_lut_low[i];
+		}
+	}
+
+	vcd_reg_debug_info = &monitor->vcd_reg_debug_info;
+
+	for (i = 0; i < num_vcds; i++) {
+		*addr++ = vcd_reg_debug_info->vcd_curr_lvl_debug_info[i].index;
+		*addr++ = vcd_reg_debug_info->vcd_curr_lvl_debug_info[i].reg_value;
+	}
+
+	return addr;
+}
+
+/**
+ * cam_cpas_dump_state_monitor_array_info()
+ *
+ * @brief     : dump the state monitor array info, dump from monitor_head
+ *              to save state information in time order.
+ * @cpas_hw   : hardware information
+ * @dump_info : dump payload
+ */
+static int cam_cpas_dump_state_monitor_array_info(
+	struct cam_hw_info *cpas_hw,
+	struct cam_req_mgr_dump_info *dump_info)
+{
+	int                             rc = 0;
+	int                             i, j;
+	struct cam_common_hw_dump_args  dump_args;
+	size_t                          buf_len;
+	size_t                          remain_len;
+	uint32_t                        min_len = 0, camnoc_idx;
+	uintptr_t                       cpu_addr;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int64_t                         state_head = 0;
+	uint32_t                        index, num_entries, oldest_entry;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas_monitor         *entry;
+	uint32_t monitor_idx;
+
+	state_head = atomic64_read(&cpas_core->monitor_head);
+	if (state_head == -1) {
+		CAM_WARN(CAM_CPAS, "No valid entries in cpas monitor array");
+		return 0;
+	} else if (state_head < CAM_CPAS_MONITOR_MAX_ENTRIES) {
+		num_entries = state_head;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_CPAS_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1,
+			CAM_CPAS_MONITOR_MAX_ENTRIES, &oldest_entry);
+	}
+
+	monitor_idx = index = oldest_entry;
+
+	rc = cam_mem_get_cpu_buf(dump_info->buf_handle, &cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Invalid handle %u rc %d",
+			dump_info->buf_handle, rc);
+		return rc;
+	}
+
+	if (buf_len <= dump_info->offset) {
+		CAM_WARN(CAM_CPAS, "Dump buffer overshoot len %zu offset %zu",
+			buf_len, dump_info->offset);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return -ENOSPC;
+	}
+
+	remain_len = buf_len - dump_info->offset;
+	for (i = 0; i < num_entries; i++) {
+		min_len += sizeof(struct cam_common_hw_dump_header) +
+			CAM_CPAS_DUMP_NUM_WORDS_COMM * sizeof(uint64_t);
+		entry = &cpas_core->monitor_entries[monitor_idx];
+		for (j = 0; j < cpas_core->num_axi_ports; j++) {
+			if (entry->axi_info[j].applied_bw.vote_type ==
+				CAM_CPAS_VOTE_TYPE_DRV) {
+				min_len += sizeof(struct cam_common_hw_dump_header) +
+					CAM_CPAS_DUMP_NUM_WORDS_VOTE_TYEP_DRV * sizeof(uint64_t);
+			} else {
+				min_len += sizeof(struct cam_common_hw_dump_header) +
+					CAM_CPAS_DUMP_NUM_WORDS_VOTE_TYEP_HLOS * sizeof(uint64_t);
+			}
+		}
+
+		for (camnoc_idx = 0; camnoc_idx < cpas_core->num_valid_camnoc; camnoc_idx++) {
+			min_len += sizeof(uint64_t);
+			for (j = 0; j < entry->num_camnoc_lvl_regs[camnoc_idx]; j++)
+				min_len += sizeof(struct cam_common_hw_dump_header);
+		}
+
+		if (soc_private->enable_smart_qos) {
+			for (j = 0; j < soc_private->smart_qos_info->num_rt_wr_nius; j++)
+				min_len += sizeof(struct cam_common_hw_dump_header) +
+					CAM_CPAS_DUMP_NUM_WORDS_RT_WR_NIUS * sizeof(uint64_t);
+		}
+
+		for (j = 0; j < CAM_CPAS_MAX_CESTA_VCD_NUM; j++)
+			min_len += CAM_CPAS_DUMP_NUM_WORDS_VCD_CURR_LVL * sizeof(uint64_t);
+
+		monitor_idx = (monitor_idx + 1) % CAM_CPAS_MONITOR_MAX_ENTRIES;
+	}
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_CPAS, "Dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return -ENOSPC;
+	}
+
+	dump_args.req_id = dump_info->req_id;
+	dump_args.cpu_addr = cpu_addr;
+	dump_args.buf_len = buf_len;
+	dump_args.offset = dump_info->offset;
+	dump_args.ctxt_to_hw_map = NULL;
+	for (i = 0; i < num_entries; i++) {
+		rc = cam_common_user_dump_helper(&dump_args,
+			cam_cpas_user_dump_state_monitor_array_info,
+			&cpas_core->monitor_entries[index],
+			sizeof(uint64_t), "CPAS_MONITOR.%d.%s:", index,
+			&cpas_core->monitor_entries[index].identifier_string);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Dump state info failed, rc: %d", rc);
+			cam_mem_put_cpu_buf(dump_info->buf_handle);
+			return rc;
+		}
+
+		index = (index + 1) % CAM_CPAS_MONITOR_MAX_ENTRIES;
+	}
+
+	dump_info->offset = dump_args.offset;
+	cam_mem_put_cpu_buf(dump_info->buf_handle);
+
+	return rc;
+}
+
+static int cam_cpas_log_event(struct cam_hw_info *cpas_hw,
+	const char *identifier_string, int32_t identifier_value)
+{
+	cam_cpas_update_monitor_array(cpas_hw, identifier_string,
+		identifier_value);
+
+	return 0;
+}
+
+static int cam_cpas_select_qos(struct cam_hw_info *cpas_hw,
+	uint32_t selection_mask)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int rc = 0;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+
+	if (cpas_hw->hw_state == CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_CPAS,
+			"Hw already in power up state, can't change QoS settings");
+		rc = -EINVAL;
+		goto done;
+	}
+
+	if (cpas_core->internal_ops.setup_qos_settings) {
+		rc = cpas_core->internal_ops.setup_qos_settings(cpas_hw,
+			selection_mask);
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in changing QoS %d", rc);
+	} else {
+		CAM_WARN(CAM_CPAS, "No ops for qos_settings");
+	}
+
+done:
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_hw_enable_tpg_mux_sel(struct cam_hw_info *cpas_hw,
+	uint32_t tpg_mux)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int rc = 0;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+
+	if (cpas_core->internal_ops.set_tpg_mux_sel) {
+		rc = cpas_core->internal_ops.set_tpg_mux_sel(
+			cpas_hw, tpg_mux);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"failed in tpg mux selection rc=%d",
+				rc);
+		}
+	} else {
+		CAM_ERR(CAM_CPAS,
+			"CPAS tpg mux sel not enabled");
+		rc = -EINVAL;
+	}
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_activate_cache(
+	struct cam_hw_info *cpas_hw,
+	struct cam_sys_cache_info *cache_info)
+{
+	int rc = 0;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	cache_info->ref_cnt++;
+	if (cache_info->ref_cnt > 1) {
+		mutex_unlock(&cpas_hw->hw_mutex);
+		CAM_DBG(CAM_CPAS, "Cache: %s has already been activated cnt: %d",
+			cache_info->name, cache_info->ref_cnt);
+		return rc;
+	}
+
+	rc = llcc_slice_activate(cache_info->slic_desc);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed to activate cache:%s",
+			cache_info->name);
+		goto end;
+	}
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	CAM_DBG(CAM_CPAS, "Activated cache:%s", cache_info->name);
+	return rc;
+
+end:
+	cache_info->ref_cnt--;
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_deactivate_cache(
+	struct cam_hw_info *cpas_hw,
+	struct cam_sys_cache_info *cache_info)
+{
+	int rc = 0;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	if (!cache_info->ref_cnt) {
+		mutex_unlock(&cpas_hw->hw_mutex);
+		CAM_ERR(CAM_CPAS, "Unbalanced deactivate");
+		return -EFAULT;
+	}
+
+	cache_info->ref_cnt--;
+	if (cache_info->ref_cnt) {
+		mutex_unlock(&cpas_hw->hw_mutex);
+		CAM_DBG(CAM_CPAS, "activate cnt for: %s non-zero: %d",
+			cache_info->name, cache_info->ref_cnt);
+		return rc;
+	}
+
+	rc = llcc_slice_deactivate(cache_info->slic_desc);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "Failed to deactivate cache:%s",
+			cache_info->name);
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	CAM_DBG(CAM_CPAS, "De-activated cache:%s", cache_info->name);
+	return rc;
+}
+
+#if IS_ENABLED(CONFIG_SPECTRA_LLCC_STALING)
+static int cam_cpas_configure_staling_cache(
+	struct cam_hw_info *cpas_hw,
+	struct cam_sys_cache_info *cache_info,
+	struct cam_sys_cache_local_info *sys_cache_info)
+{
+	int rc = 0;
+	struct llcc_staling_mode_params staling_params;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	switch (sys_cache_info->mode) {
+	case CAM_LLCC_STALING_MODE_CAPACITY: {
+		staling_params.staling_mode = LLCC_STALING_MODE_CAPACITY;
+		break;
+	}
+	case CAM_LLCC_STALING_MODE_NOTIFY: {
+		staling_params.staling_mode = LLCC_STALING_MODE_NOTIFY;
+		break;
+	}
+	default:
+		CAM_ERR(CAM_CPAS, "CPAS LLCC sys cache mode is not valid =%d"
+				, sys_cache_info->mode);
+		break;
+	}
+
+	switch (sys_cache_info->op_type) {
+	case CAM_LLCC_NOTIFY_STALING_EVICT: {
+		staling_params.notify_params.op = LLCC_NOTIFY_STALING_WRITEBACK;
+		break;
+	}
+	default:
+		CAM_ERR(CAM_CPAS, "CPAS LLCC sys cache op_type is not valid =%d"
+				, sys_cache_info->op_type);
+		break;
+	}
+	staling_params.notify_params.staling_distance
+		= cache_info->staling_distance;
+	rc = llcc_configure_staling_mode(cache_info->slic_desc,
+			&staling_params);
+	if (!rc) {
+		cache_info->staling_distance = sys_cache_info->staling_distance;
+		cache_info->mode = sys_cache_info->mode;
+		cache_info->op_type = sys_cache_info->op_type;
+	} else if (rc == -EOPNOTSUPP) {
+		CAM_ERR(CAM_CPAS, "llcc staling feature is not supported cache:%s",
+			cache_info->name);
+	} else if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed to enable llcc notif cache:%s",
+			cache_info->name);
+	}
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	CAM_DBG(CAM_CPAS,
+		"llcc notif cache name:%s staling_distance %d cache mode :%d cache op_type :%s",
+		cache_info->name, cache_info->staling_distance,
+		cache_info->mode, cache_info->op_type);
+	return rc;
+}
+
+static int cam_cpas_notif_stalling_inc_cache(
+	struct cam_hw_info *cpas_hw,
+	struct cam_sys_cache_info *cache_info)
+{
+	int rc = 0;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	rc = llcc_notif_staling_inc_counter(cache_info->slic_desc);
+	if (rc == -EOPNOTSUPP)
+		CAM_ERR(CAM_CPAS, "llcc notif stalling inc not supported: %s",
+			cache_info->name);
+	else if (rc)
+		CAM_ERR(CAM_CPAS, "Failed to llcc staling frame trigger:%s",
+			cache_info->name);
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	CAM_DBG(CAM_CPAS, "llcc staling frame triggered cache:%s",
+		cache_info->name);
+	return rc;
+}
+#endif
+
+static inline int cam_cpas_validate_cache_type(
+	uint32_t num_caches, enum cam_sys_cache_config_types type)
+{
+	if ((!num_caches) || (type < 0) || (type >= CAM_LLCC_MAX))
+		return -EINVAL;
+	else
+		return 0;
+}
+
+static int cam_cpas_get_slice_id(
+	struct cam_hw_info *cpas_hw,
+	enum cam_sys_cache_config_types type)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *)cpas_hw->soc_info.soc_private;
+	uint32_t num_caches = soc_private->num_caches;
+	int scid = -1, i;
+
+	if (cam_cpas_validate_cache_type(num_caches, type))
+		goto end;
+
+	for (i = 0; i < num_caches; i++) {
+		if (type == soc_private->llcc_info[i].type) {
+			scid = soc_private->llcc_info[i].scid;
+			CAM_DBG(CAM_CPAS, "Cache:%s type:%d scid:%d",
+				soc_private->llcc_info[i].name, type, scid);
+			break;
+		}
+	}
+
+end:
+	return scid;
+}
+
+static int cam_cpas_activate_cache_slice(
+	struct cam_hw_info *cpas_hw,
+	enum cam_sys_cache_config_types type)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *)cpas_hw->soc_info.soc_private;
+	uint32_t num_caches = soc_private->num_caches;
+	int rc = 0, i;
+
+	CAM_DBG(CAM_CPAS, "Activate type: %d", type);
+	if (cam_cpas_validate_cache_type(num_caches, type))
+		goto end;
+
+	for (i = 0; i < num_caches; i++) {
+		if (type == soc_private->llcc_info[i].type)
+			rc = cam_cpas_activate_cache(cpas_hw,
+				&soc_private->llcc_info[i]);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_cpas_deactivate_cache_slice(
+	struct cam_hw_info *cpas_hw,
+	enum cam_sys_cache_config_types type)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *)cpas_hw->soc_info.soc_private;
+	uint32_t num_caches = soc_private->num_caches;
+	int rc = 0, i;
+
+	CAM_DBG(CAM_CPAS, "De-activate type: %d", type);
+	if (cam_cpas_validate_cache_type(num_caches, type))
+		goto end;
+
+	for (i = 0; i < num_caches; i++) {
+		if (type == soc_private->llcc_info[i].type)
+			rc = cam_cpas_deactivate_cache(cpas_hw,
+				&soc_private->llcc_info[i]);
+	}
+
+end:
+	return rc;
+}
+
+#if IS_ENABLED(CONFIG_SPECTRA_LLCC_STALING)
+static int cam_cpas_configure_staling_cache_slice(
+	struct cam_hw_info *cpas_hw,
+	struct cam_sys_cache_local_info sys_cache_info)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *)cpas_hw->soc_info.soc_private;
+	uint32_t num_caches = soc_private->num_caches;
+	int rc = 0, i;
+
+	CAM_DBG(CAM_CPAS, "De-activate type: %d", sys_cache_info.type);
+	if (cam_cpas_validate_cache_type(num_caches, sys_cache_info.type))
+		goto end;
+
+	for (i = 0; i < num_caches; i++) {
+		if (sys_cache_info.type == soc_private->llcc_info[i].type) {
+			rc = cam_cpas_configure_staling_cache(cpas_hw,
+				&soc_private->llcc_info[i], &sys_cache_info);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "llc sys cache type %d config failed, rc: %d",
+					soc_private->llcc_info[i].type, rc);
+			}
+			break;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_cpas_notif_stalling_inc_cache_slice(
+	struct cam_hw_info *cpas_hw,
+	enum cam_sys_cache_config_types type)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *)cpas_hw->soc_info.soc_private;
+	uint32_t num_caches = soc_private->num_caches;
+	int rc = 0, i;
+
+	CAM_DBG(CAM_CPAS, "De-activate type: %d", type);
+	if (cam_cpas_validate_cache_type(num_caches, type))
+		goto end;
+
+	for (i = 0; i < num_caches; i++) {
+		if (type == soc_private->llcc_info[i].type)
+			rc = cam_cpas_notif_stalling_inc_cache(cpas_hw,
+				&soc_private->llcc_info[i]);
+	}
+
+end:
+	return rc;
+}
+
+#else
+static int cam_cpas_configure_staling_cache_slice(
+	struct cam_hw_info *cpas_hw,
+	struct cam_sys_cache_local_info sys_cache_info)
+{
+	return -EOPNOTSUPP;
+}
+
+static int cam_cpas_notif_stalling_inc_cache_slice(
+	struct cam_hw_info *cpas_hw,
+	enum cam_sys_cache_config_types type)
+{
+	return -EOPNOTSUPP;
+}
+#endif
+
+static int cam_cpas_hw_csid_input_core_info_update(struct cam_hw_info *cpas_hw,
+	int csid_idx, int sfe_idx, bool set_port)
+{
+	int i, j, rc = 0;
+	char client_name[CAM_HW_IDENTIFIER_LENGTH + 3];
+	int32_t client_indx = -1;
+
+	struct cam_cpas_private_soc *soc_private =
+			(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_tree_node *tree_node = NULL;
+
+	if (!soc_private->enable_cam_ddr_drv || cpas_core->force_hlos_drv)
+		return 0;
+
+	if ((csid_idx < 0) || (sfe_idx < 0)) {
+		CAM_ERR(CAM_CPAS, "Invalid core info csid:%d sfe:%d", csid_idx, sfe_idx);
+		return -EINVAL;
+	}
+
+	snprintf(client_name, sizeof(client_name), "%s%d", "sfe", sfe_idx);
+
+	rc = cam_common_util_get_string_index(soc_private->client_name,
+		soc_private->num_clients, client_name, &client_indx);
+
+	if (!cpas_core->cpas_client[client_indx]->is_drv_dyn)
+		return 0;
+
+	for (i = 0; i < CAM_CPAS_PATH_DATA_MAX; i++) {
+		for (j = 0; j < CAM_CPAS_TRANSACTION_MAX; j++) {
+			tree_node = cpas_core->cpas_client[client_indx]->tree_node[i][j];
+			if (!tree_node)
+				continue;
+
+			if (set_port)
+				tree_node->drv_voting_idx = CAM_CPAS_PORT_DRV_0 + csid_idx;
+			else
+				tree_node->drv_voting_idx = CAM_CPAS_PORT_DRV_DYN;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_cpas_hw_enable_domain_id_clks(struct cam_hw_info *cpas_hw,
+	bool enable)
+{
+	int rc = 0, i;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas_domain_id_support_clks *domain_id_clks =
+		soc_private->domain_id_clks;
+
+	if (!soc_private->domain_id_info.domain_id_supported) {
+		CAM_DBG(CAM_CPAS, "Domain-id not supported on target");
+		return -EINVAL;
+	}
+
+	if (enable) {
+		for (i = 0; i < domain_id_clks->number_clks; i++) {
+			rc = cam_soc_util_clk_enable(&cpas_hw->soc_info, CAM_CLK_SW_CLIENT_IDX,
+				true, domain_id_clks->clk_idx[i], 0);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "Domain-id clk %s enable failed, rc: %d",
+					domain_id_clks->clk_names[i], i);
+				goto clean_up;
+			}
+		}
+		CAM_DBG(CAM_CPAS, "Domain-id clks enable success");
+	} else {
+		for (i = 0; i < domain_id_clks->number_clks; i++) {
+			rc = cam_soc_util_clk_disable(&cpas_hw->soc_info, CAM_CLK_SW_CLIENT_IDX,
+				true, domain_id_clks->clk_idx[i]);
+			if (rc)
+				CAM_WARN(CAM_CPAS, "Domain-id clk %s disable failed, rc: %d",
+					domain_id_clks->clk_names[i], rc);
+		}
+		if (!rc)
+			CAM_DBG(CAM_CPAS, "Domain-id clks disable success");
+	}
+
+	return rc;
+
+clean_up:
+	for (--i; i >= 0; i--)
+		cam_soc_util_clk_disable(&cpas_hw->soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+			domain_id_clks->clk_idx[i]);
+
+	return rc;
+}
+
+static int cam_cpas_hw_csid_process_resume(struct cam_hw_info *cpas_hw, uint32_t csid_idx)
+{
+	int i, rc = 0;
+
+	struct cam_cpas_private_soc *soc_private =
+			(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+
+	if (!soc_private->enable_cam_ddr_drv)
+		return 0;
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		if (!cpas_core->axi_port[i].bus_client.common_data.is_drv_port ||
+			!cpas_core->axi_port[i].is_drv_started ||
+			(cpas_core->axi_port[i].drv_idx != (CAM_CPAS_PORT_DRV_0 + csid_idx)))
+			continue;
+
+		/* Apply last applied bw again to applicable DRV port */
+		rc = cam_cpas_util_vote_drv_bus_client_bw(&cpas_core->axi_port[i].bus_client,
+			&cpas_core->axi_port[i].applied_bw, &cpas_core->axi_port[i].applied_bw);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in BW update on resume rc:%d", rc);
+			goto end;
+		}
+
+		/* Trigger channel switch for RSC dev */
+		rc = cam_cpas_drv_channel_switch_for_dev(cpas_core->axi_port[i].cam_rsc_dev);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Port[%s] failed in channel switch during resume rc:%d",
+				cpas_core->axi_port[i].axi_port_name, rc);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_cpas_hw_process_cmd(void *hw_priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!hw_priv || !cmd_args ||
+		(cmd_type >= CAM_CPAS_HW_CMD_INVALID)) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK %d",
+			hw_priv, cmd_args, cmd_type);
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_CPAS_HW_CMD_REGISTER_CLIENT: {
+		struct cam_cpas_register_params *register_params;
+
+		if (sizeof(struct cam_cpas_register_params) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		register_params = (struct cam_cpas_register_params *)cmd_args;
+		rc = cam_cpas_hw_register_client(hw_priv, register_params);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_UNREGISTER_CLIENT: {
+		uint32_t *client_handle;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		client_handle = (uint32_t *)cmd_args;
+		rc = cam_cpas_hw_unregister_client(hw_priv, *client_handle);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_REG_WRITE: {
+		struct cam_cpas_hw_cmd_reg_read_write *reg_write;
+
+		if (sizeof(struct cam_cpas_hw_cmd_reg_read_write) !=
+			arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		reg_write =
+			(struct cam_cpas_hw_cmd_reg_read_write *)cmd_args;
+		rc = cam_cpas_hw_reg_write(hw_priv, reg_write->client_handle,
+			reg_write->reg_base, reg_write->offset, reg_write->mb,
+			reg_write->value);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_REG_READ: {
+		struct cam_cpas_hw_cmd_reg_read_write *reg_read;
+
+		if (sizeof(struct cam_cpas_hw_cmd_reg_read_write) !=
+			arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		reg_read =
+			(struct cam_cpas_hw_cmd_reg_read_write *)cmd_args;
+		rc = cam_cpas_hw_reg_read(hw_priv,
+			reg_read->client_handle, reg_read->reg_base,
+			reg_read->offset, reg_read->mb, &reg_read->value);
+
+		break;
+	}
+	case CAM_CPAS_HW_CMD_AHB_VOTE: {
+		struct cam_cpas_hw_cmd_ahb_vote *cmd_ahb_vote;
+
+		if (sizeof(struct cam_cpas_hw_cmd_ahb_vote) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		cmd_ahb_vote = (struct cam_cpas_hw_cmd_ahb_vote *)cmd_args;
+		rc = cam_cpas_hw_update_ahb_vote(hw_priv,
+			cmd_ahb_vote->client_handle, cmd_ahb_vote->ahb_vote);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_AXI_VOTE: {
+		struct cam_cpas_hw_cmd_axi_vote *cmd_axi_vote;
+
+		if (sizeof(struct cam_cpas_hw_cmd_axi_vote) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		cmd_axi_vote = (struct cam_cpas_hw_cmd_axi_vote *)cmd_args;
+		rc = cam_cpas_hw_update_axi_vote(hw_priv,
+			cmd_axi_vote->client_handle, cmd_axi_vote->axi_vote);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_LOG_VOTE: {
+		bool *ddr_only;
+
+		if (sizeof(bool) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		ddr_only = (bool *) cmd_args;
+		rc = cam_cpas_log_vote(hw_priv, *ddr_only);
+		break;
+	}
+
+	case CAM_CPAS_HW_CMD_LOG_EVENT: {
+		struct cam_cpas_hw_cmd_notify_event *event;
+
+		if (sizeof(struct cam_cpas_hw_cmd_notify_event) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		event = (struct cam_cpas_hw_cmd_notify_event *)cmd_args;
+
+		rc = cam_cpas_log_event(hw_priv, event->identifier_string,
+			event->identifier_value);
+		break;
+	}
+
+	case CAM_CPAS_HW_CMD_SELECT_QOS: {
+		uint32_t *selection_mask;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		selection_mask = (uint32_t *)cmd_args;
+		rc = cam_cpas_select_qos(hw_priv, *selection_mask);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_GET_SCID: {
+		enum cam_sys_cache_config_types type;
+
+		if (sizeof(enum cam_sys_cache_config_types) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+		type = *((enum cam_sys_cache_config_types *) cmd_args);
+		rc = cam_cpas_get_slice_id(hw_priv, type);
+	}
+		break;
+	case CAM_CPAS_HW_CMD_ACTIVATE_LLC: {
+		enum cam_sys_cache_config_types type;
+
+		if (sizeof(enum cam_sys_cache_config_types) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+		type = *((enum cam_sys_cache_config_types *) cmd_args);
+		rc = cam_cpas_activate_cache_slice(hw_priv, type);
+	}
+		break;
+	case CAM_CPAS_HW_CMD_DEACTIVATE_LLC: {
+		enum cam_sys_cache_config_types type;
+
+		if (sizeof(enum cam_sys_cache_config_types) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+		type = *((enum cam_sys_cache_config_types *) cmd_args);
+		rc = cam_cpas_deactivate_cache_slice(hw_priv, type);
+	}
+		break;
+	case CAM_CPAS_HW_CMD_CONFIGURE_STALING_LLC: {
+		struct cam_sys_cache_local_info sys_cache_info;
+
+		if (sizeof(struct cam_sys_cache_local_info) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+		sys_cache_info =
+			*((struct cam_sys_cache_local_info *) cmd_args);
+		rc = cam_cpas_configure_staling_cache_slice(hw_priv, sys_cache_info);
+	}
+		break;
+	case CAM_CPAS_HW_CMD_NOTIF_STALL_INC_LLC: {
+		enum cam_sys_cache_config_types type;
+
+		if (sizeof(enum cam_sys_cache_config_types) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+		type = *((enum cam_sys_cache_config_types *) cmd_args);
+		rc = cam_cpas_notif_stalling_inc_cache_slice(hw_priv, type);
+	}
+		break;
+	case CAM_CPAS_HW_CMD_DUMP_BUFF_FILL_INFO: {
+		uint32_t *client_handle;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		client_handle = (uint32_t *)cmd_args;
+		rc = cam_cpas_hw_dump_camnoc_buff_fill_info(hw_priv,
+			*client_handle);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_CSID_INPUT_CORE_INFO_UPDATE: {
+		struct cam_cpas_hw_cmd_csid_input_core_info_update *core_info_update;
+
+		if (sizeof(struct cam_cpas_hw_cmd_csid_input_core_info_update) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d", cmd_type, arg_size);
+			break;
+		}
+
+		core_info_update = (struct cam_cpas_hw_cmd_csid_input_core_info_update *)cmd_args;
+		rc = cam_cpas_hw_csid_input_core_info_update(hw_priv, core_info_update->csid_idx,
+			core_info_update->sfe_idx, core_info_update->set_port);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_CSID_PROCESS_RESUME: {
+		uint32_t *csid_idx;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		csid_idx = (uint32_t *)cmd_args;
+		rc = cam_cpas_hw_csid_process_resume(hw_priv, *csid_idx);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_TPG_MUX_SEL: {
+		uint32_t *tpg_mux_sel;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		tpg_mux_sel = (uint32_t *)cmd_args;
+		rc = cam_cpas_hw_enable_tpg_mux_sel(hw_priv, *tpg_mux_sel);
+		break;
+
+	}
+	case CAM_CPAS_HW_CMD_ENABLE_DISABLE_DOMAIN_ID_CLK: {
+		bool *enable;
+
+		if (sizeof(bool) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		enable = (bool *)cmd_args;
+		rc = cam_cpas_hw_enable_domain_id_clks(hw_priv, *enable);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_DUMP_STATE_MONITOR_INFO: {
+		struct cam_req_mgr_dump_info *info;
+
+		if (sizeof(struct cam_req_mgr_dump_info) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		info = (struct cam_req_mgr_dump_info *)cmd_args;
+		rc = cam_cpas_dump_state_monitor_array_info(hw_priv, info);
+		break;
+	}
+
+	default:
+		CAM_ERR(CAM_CPAS, "CPAS HW command not valid =%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_cpas_util_client_setup(struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int i;
+
+	for (i = 0; i < CAM_CPAS_MAX_CLIENTS; i++) {
+		mutex_init(&cpas_core->client_mutex[i]);
+	}
+
+	return 0;
+}
+
+int cam_cpas_util_client_cleanup(struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int i;
+
+	for (i = 0; i < CAM_CPAS_MAX_CLIENTS; i++) {
+		if (cpas_core->cpas_client[i] &&
+			cpas_core->cpas_client[i]->registered) {
+			cam_cpas_hw_unregister_client(cpas_hw, i);
+		}
+		kfree(cpas_core->cpas_client[i]);
+		cpas_core->cpas_client[i] = NULL;
+		mutex_destroy(&cpas_core->client_mutex[i]);
+	}
+
+	return 0;
+}
+
+static int cam_cpas_util_get_internal_ops(struct platform_device *pdev,
+	struct cam_hw_intf *hw_intf, struct cam_cpas_internal_ops *internal_ops)
+{
+	struct device_node *of_node = pdev->dev.of_node;
+	int rc;
+	const char *compat_str = NULL;
+
+	rc = of_property_read_string_index(of_node, "arch-compat", 0,
+		(const char **)&compat_str);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed to get arch-compat rc=%d", rc);
+		return -EINVAL;
+	}
+
+	if (strnstr(compat_str, "camss_top", strlen(compat_str))) {
+		hw_intf->hw_type = CAM_HW_CAMSSTOP;
+		rc = cam_camsstop_get_internal_ops(internal_ops);
+	} else if (strnstr(compat_str, "cpas_top", strlen(compat_str))) {
+		hw_intf->hw_type = CAM_HW_CPASTOP;
+		rc = cam_cpastop_get_internal_ops(internal_ops);
+	} else {
+		CAM_ERR(CAM_CPAS, "arch-compat %s not supported", compat_str);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_cpas_util_create_debugfs(struct cam_cpas *cpas_core)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("cpas", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_CPAS,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	cpas_core->dentry = dbgfileptr;
+
+	debugfs_create_bool("ahb_bus_scaling_disable", 0644,
+		cpas_core->dentry, &cpas_core->ahb_bus_scaling_disable);
+
+	debugfs_create_bool("full_state_dump", 0644,
+		cpas_core->dentry, &cpas_core->full_state_dump);
+
+	debugfs_create_bool("smart_qos_dump", 0644,
+		cpas_core->dentry, &cpas_core->smart_qos_dump);
+
+	debugfs_create_bool("force_hlos_drv", 0644,
+		cpas_core->dentry, &cpas_core->force_hlos_drv);
+
+	debugfs_create_bool("force_cesta_sw_client", 0644,
+		cpas_core->dentry, &cpas_core->force_cesta_sw_client);
+
+end:
+	return rc;
+}
+
+static struct cam_hw_info *cam_cpas_kobj_to_cpas_hw(struct kobject *kobj)
+{
+	return container_of(kobj, struct cam_cpas_kobj_map, base_kobj)->cpas_hw;
+}
+
+static ssize_t cam_cpas_sysfs_get_subparts_info(struct kobject *kobj, struct kobj_attribute *attr,
+	char *buf)
+{
+	int len = 0;
+	struct cam_hw_info *cpas_hw = cam_cpas_kobj_to_cpas_hw(kobj);
+	struct cam_cpas_private_soc *soc_private = NULL;
+	struct cam_cpas_sysfs_info *sysfs_info = NULL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	soc_private = (struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	sysfs_info  = &soc_private->sysfs_info;
+
+	len += scnprintf(buf, PAGE_SIZE, "num_ifes: 0x%x, 0x%x\nnum_ife_lites: 0x%x, 0x%x\n"
+		"num_sfes: 0x%x, 0x%x\nnum_custom: 0x%x, 0x%x\n",
+		sysfs_info->num_ifes[CAM_CPAS_AVAILABLE_NUM_SUBPARTS],
+		sysfs_info->num_ifes[CAM_CPAS_FUNCTIONAL_NUM_SUBPARTS],
+		sysfs_info->num_ife_lites[CAM_CPAS_AVAILABLE_NUM_SUBPARTS],
+		sysfs_info->num_ife_lites[CAM_CPAS_FUNCTIONAL_NUM_SUBPARTS],
+		sysfs_info->num_sfes[CAM_CPAS_AVAILABLE_NUM_SUBPARTS],
+		sysfs_info->num_sfes[CAM_CPAS_FUNCTIONAL_NUM_SUBPARTS],
+		sysfs_info->num_custom[CAM_CPAS_AVAILABLE_NUM_SUBPARTS],
+		sysfs_info->num_custom[CAM_CPAS_FUNCTIONAL_NUM_SUBPARTS]);
+	/*
+	 * subparts_info sysfs string looks like below.
+	 * num_ifes: 0x3, 0x3 (If all IFEs are available)/0x2 (If 1 IFE is unavailable)
+	 * num_ife_lites: 0x2, 0x2
+	 * num_sfes: 0x3, 0x3 (If all SFEs are available)/0x2 (If 1 SFE is unavailable)
+	 * num_custom: 0x0, 0x0
+	 */
+
+	if (len >= PAGE_SIZE) {
+		CAM_ERR(CAM_CPAS, "camera subparts info sysfs string is truncated, len: %d", len);
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return -EOVERFLOW;
+	}
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return len;
+}
+
+static struct kobj_attribute cam_subparts_info_attribute = __ATTR(subparts_info, 0444,
+	cam_cpas_sysfs_get_subparts_info, NULL);
+
+static void cam_cpas_hw_kobj_release(struct kobject *kobj)
+{
+	CAM_DBG(CAM_CPAS, "Release kobj");
+	kfree(container_of(kobj, struct cam_cpas_kobj_map, base_kobj));
+}
+
+static struct kobj_type kobj_cam_cpas_hw_type = {
+	.release = cam_cpas_hw_kobj_release,
+	.sysfs_ops = &kobj_sysfs_ops
+};
+
+static void cam_cpas_remove_sysfs(struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas_private_soc *soc_private = NULL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	soc_private = (struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+
+	sysfs_remove_file(soc_private->sysfs_info.kobj, &cam_subparts_info_attribute.attr);
+	kobject_put(soc_private->sysfs_info.kobj);
+	mutex_unlock(&cpas_hw->hw_mutex);
+}
+
+static int cam_cpas_create_sysfs(struct cam_hw_info *cpas_hw)
+{
+	int rc = 0;
+	struct cam_cpas_kobj_map *kobj_camera = NULL;
+	struct cam_cpas_private_soc *soc_private = NULL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	soc_private = (struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+
+	kobj_camera = kzalloc(sizeof(*kobj_camera), GFP_KERNEL);
+	if (!kobj_camera) {
+		CAM_ERR(CAM_CPAS, "failed to allocate memory for kobj_camera");
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return -ENOMEM;
+	}
+
+	kobject_init(&kobj_camera->base_kobj, &kobj_cam_cpas_hw_type);
+	kobj_camera->cpas_hw = cpas_hw;
+	soc_private->sysfs_info.kobj = &kobj_camera->base_kobj;
+
+	rc = kobject_add(&kobj_camera->base_kobj, kernel_kobj, "%s", "camera");
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed to add camera entry in sysfs");
+		goto end;
+	}
+
+	/* sysfs file is created in /sys/kernel/camera */
+	rc = sysfs_create_file(&kobj_camera->base_kobj, &cam_subparts_info_attribute.attr);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed to create subparts_info file, rc: %d", rc);
+		goto end;
+	}
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return 0;
+end:
+	kobject_put(&kobj_camera->base_kobj);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+int cam_cpas_hw_probe(struct platform_device *pdev,
+	struct cam_hw_intf **hw_intf)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_info *cpas_hw = NULL;
+	struct cam_hw_intf *cpas_hw_intf = NULL;
+	struct cam_cpas *cpas_core = NULL;
+	struct cam_cpas_private_soc *soc_private;
+	struct cam_cpas_internal_ops *internal_ops;
+
+	cpas_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!cpas_hw_intf)
+		return -ENOMEM;
+
+	cpas_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!cpas_hw) {
+		kfree(cpas_hw_intf);
+		return -ENOMEM;
+	}
+
+	cpas_core = kzalloc(sizeof(struct cam_cpas), GFP_KERNEL);
+	if (!cpas_core) {
+		kfree(cpas_hw);
+		kfree(cpas_hw_intf);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < CAM_CPAS_REG_MAX; i++)
+		cpas_core->regbase_index[i] = -1;
+
+	cpas_hw_intf->hw_priv = cpas_hw;
+	cpas_hw->core_info = cpas_core;
+
+	cpas_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	cpas_hw->soc_info.pdev = pdev;
+	cpas_hw->soc_info.dev = &pdev->dev;
+	cpas_hw->soc_info.dev_name = pdev->name;
+	cpas_hw->open_count = 0;
+	cpas_core->ahb_bus_scaling_disable = false;
+	cpas_core->full_state_dump = false;
+	cpas_core->smart_qos_dump = false;
+
+	atomic64_set(&cpas_core->monitor_head, -1);
+
+	mutex_init(&cpas_hw->hw_mutex);
+	spin_lock_init(&cpas_hw->hw_lock);
+	init_completion(&cpas_hw->hw_complete);
+
+	cpas_hw_intf->hw_ops.get_hw_caps = cam_cpas_hw_get_hw_info;
+	cpas_hw_intf->hw_ops.init = cam_cpas_hw_init;
+	cpas_hw_intf->hw_ops.deinit = NULL;
+	cpas_hw_intf->hw_ops.reset = NULL;
+	cpas_hw_intf->hw_ops.reserve = NULL;
+	cpas_hw_intf->hw_ops.release = NULL;
+	cpas_hw_intf->hw_ops.start = cam_cpas_hw_start;
+	cpas_hw_intf->hw_ops.stop = cam_cpas_hw_stop;
+	cpas_hw_intf->hw_ops.read = NULL;
+	cpas_hw_intf->hw_ops.write = NULL;
+	cpas_hw_intf->hw_ops.process_cmd = cam_cpas_hw_process_cmd;
+
+	cpas_core->work_queue = alloc_workqueue(CAM_CPAS_WORKQUEUE_NAME,
+		WQ_UNBOUND | WQ_MEM_RECLAIM, CAM_CPAS_INFLIGHT_WORKS);
+	if (!cpas_core->work_queue) {
+		rc = -ENOMEM;
+		goto release_mem;
+	}
+
+	internal_ops = &cpas_core->internal_ops;
+	rc = cam_cpas_util_get_internal_ops(pdev, cpas_hw_intf, internal_ops);
+	if (rc)
+		goto release_workq;
+
+	rc = cam_cpas_soc_init_resources(&cpas_hw->soc_info,
+		internal_ops->handle_irq, cpas_hw);
+	if (rc)
+		goto release_workq;
+
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+
+	rc = cam_cpas_create_sysfs(cpas_hw);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed to create sysfs entries, rc: %d", rc);
+		goto sysfs_fail;
+	}
+
+	cpas_core->num_clients = soc_private->num_clients;
+	atomic_set(&cpas_core->soc_access_count, 0);
+	init_waitqueue_head(&cpas_core->soc_access_count_wq);
+
+	if (internal_ops->setup_regbase) {
+		rc = internal_ops->setup_regbase(&cpas_hw->soc_info,
+			cpas_core->regbase_index, CAM_CPAS_REG_MAX);
+		if (rc)
+			goto deinit_platform_res;
+	}
+
+	rc = cam_cpas_util_client_setup(cpas_hw);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in client setup, rc=%d", rc);
+		goto deinit_platform_res;
+	}
+
+	rc = cam_cpas_util_register_bus_client(&cpas_hw->soc_info,
+		cpas_hw->soc_info.pdev->dev.of_node,
+		&cpas_core->ahb_bus_client);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in ahb setup, rc=%d", rc);
+		goto client_cleanup;
+	}
+
+	rc = cam_cpas_util_axi_setup(cpas_core, &cpas_hw->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in axi setup, rc=%d", rc);
+		goto ahb_cleanup;
+	}
+
+	/* Need to vote first before enabling clocks */
+	rc = cam_cpas_util_vote_default_ahb_axi(cpas_hw, true);
+	if (rc)
+		goto axi_cleanup;
+
+	rc = cam_cpas_soc_enable_resources(&cpas_hw->soc_info,
+		cpas_hw->soc_info.lowest_clk_level);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in soc_enable_resources, rc=%d", rc);
+		goto remove_default_vote;
+	}
+
+	if (internal_ops->get_hw_info) {
+		rc = internal_ops->get_hw_info(cpas_hw, &cpas_core->hw_caps);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "failed in get_hw_info, rc=%d", rc);
+			goto disable_soc_res;
+		}
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid get_hw_info");
+		goto disable_soc_res;
+	}
+
+	rc = cam_cpas_hw_init(cpas_hw_intf->hw_priv,
+		&cpas_core->hw_caps, sizeof(struct cam_cpas_hw_caps));
+	if (rc)
+		goto disable_soc_res;
+
+	cpas_core->cam_subpart_info = &g_cam_cpas_camera_subpart_info;
+
+	rc = cam_get_subpart_info(&soc_private->part_info, CAM_CPAS_CAMERA_INSTANCES);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed to get subpart_info, rc = %d", rc);
+		goto disable_soc_res;
+	}
+
+	rc = cam_cpas_soc_disable_resources(&cpas_hw->soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in soc_disable_resources, rc=%d", rc);
+		goto remove_default_vote;
+	}
+
+	rc = cam_cpas_util_vote_default_ahb_axi(cpas_hw, false);
+	if (rc)
+		goto axi_cleanup;
+
+	rc = cam_cpas_util_create_debugfs(cpas_core);
+	if (unlikely(rc))
+		CAM_WARN(CAM_CPAS, "failed to create cpas debugfs rc: %d", rc);
+
+	*hw_intf = cpas_hw_intf;
+	return 0;
+
+disable_soc_res:
+	cam_cpas_soc_disable_resources(&cpas_hw->soc_info, true, true);
+remove_default_vote:
+	cam_cpas_util_vote_default_ahb_axi(cpas_hw, false);
+axi_cleanup:
+	cam_cpas_util_axi_cleanup(cpas_core, &cpas_hw->soc_info);
+ahb_cleanup:
+	cam_cpas_util_unregister_bus_client(&cpas_core->ahb_bus_client);
+client_cleanup:
+	cam_cpas_util_client_cleanup(cpas_hw);
+	cam_cpas_node_tree_cleanup(cpas_core, cpas_hw->soc_info.soc_private);
+deinit_platform_res:
+	cam_cpas_remove_sysfs(cpas_hw);
+sysfs_fail:
+	cam_cpas_soc_deinit_resources(&cpas_hw->soc_info);
+release_workq:
+	flush_workqueue(cpas_core->work_queue);
+	destroy_workqueue(cpas_core->work_queue);
+release_mem:
+	mutex_destroy(&cpas_hw->hw_mutex);
+	kfree(cpas_core);
+	kfree(cpas_hw);
+	kfree(cpas_hw_intf);
+	CAM_ERR(CAM_CPAS, "failed in hw probe");
+	return rc;
+}
+
+int cam_cpas_hw_remove(struct cam_hw_intf *cpas_hw_intf)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+
+	if (!cpas_hw_intf) {
+		CAM_ERR(CAM_CPAS, "cpas interface not initialized");
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)cpas_hw_intf->hw_priv;
+	cpas_core = (struct cam_cpas *)cpas_hw->core_info;
+
+	if (cpas_hw->hw_state == CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_CPAS, "cpas hw is in power up state");
+		return -EINVAL;
+	}
+
+	cam_cpas_remove_sysfs(cpas_hw);
+	cam_cpas_util_axi_cleanup(cpas_core, &cpas_hw->soc_info);
+	cam_cpas_node_tree_cleanup(cpas_core, cpas_hw->soc_info.soc_private);
+	cam_cpas_util_unregister_bus_client(&cpas_core->ahb_bus_client);
+	cam_cpas_util_client_cleanup(cpas_hw);
+	cam_cpas_soc_deinit_resources(&cpas_hw->soc_info);
+	cpas_core->dentry = NULL;
+	flush_workqueue(cpas_core->work_queue);
+	destroy_workqueue(cpas_core->work_queue);
+	mutex_destroy(&cpas_hw->hw_mutex);
+	kfree(cpas_core);
+	kfree(cpas_hw);
+	kfree(cpas_hw_intf);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_hw.h
@@ -0,0 +1,466 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CPAS_HW_H_
+#define _CAM_CPAS_HW_H_
+
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_cpas_api.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_common_util.h"
+#include "cam_soc_bus.h"
+
+#define CAM_CPAS_INFLIGHT_WORKS              5
+#define CAM_CPAS_MAX_CLIENTS                 43
+#define CAM_CPAS_MAX_AXI_PORTS               6
+#define CAM_CPAS_MAX_DRV_PORTS               4
+#define CAM_CPAS_MAX_TREE_LEVELS             4
+#define CAM_CPAS_MAX_RT_WR_NIU_NODES         10
+#define CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT   32
+#define CAM_CPAS_PATH_DATA_MAX               42
+#define CAM_CPAS_TRANSACTION_MAX             2
+#define CAM_CAMNOC_FILL_LVL_REG_INFO_MAX     6
+#define CAM_CPAS_MAX_SLOPE_FACTOR            100
+#define CAM_CPAS_MAX_STRESS_INDICATOR        100
+
+/* Number of camera (CAM_SS) instances */
+#define CAM_CPAS_CAMERA_INSTANCES            1
+
+#define CAM_CPAS_AXI_MIN_MNOC_AB_BW   (2048 * 1024)
+#define CAM_CPAS_AXI_MIN_MNOC_IB_BW   (2048 * 1024)
+#define CAM_CPAS_AXI_MIN_CAMNOC_AB_BW (2048 * 1024)
+#define CAM_CPAS_AXI_MIN_CAMNOC_IB_BW (3000000000UL)
+
+#define CAM_CPAS_GET_CLIENT_IDX(handle) (handle)
+#define CAM_CPAS_GET_CLIENT_HANDLE(indx) (indx)
+
+#define CAM_CPAS_WORKQUEUE_NAME "cam-cpas"
+
+#define CAM_CPAS_CLIENT_VALID(indx) \
+	((indx >= 0) && (indx < CAM_CPAS_MAX_CLIENTS))
+#define CAM_CPAS_CLIENT_REGISTERED(cpas_core, indx)        \
+	((CAM_CPAS_CLIENT_VALID(indx)) && \
+	(cpas_core->cpas_client[indx]->registered))
+#define CAM_CPAS_CLIENT_STARTED(cpas_core, indx)          \
+	((CAM_CPAS_CLIENT_REGISTERED(cpas_core, indx)) && \
+	(cpas_core->cpas_client[indx]->started))
+
+/* Array indices to represent corresponding RPMH BCM info */
+#define CAM_RPMH_NUMBER_OF_BCMS 0
+#define CAM_RPMH_BCM_FE_OFFSET  1
+#define CAM_RPMH_BCM_BE_OFFSET  2
+#define CAM_RPMH_BCM_DDR_INDEX  3
+#define CAM_RPMH_BCM_MNOC_INDEX 4
+#define CAM_RPMH_BCM_INFO_MAX   5
+
+#define CAM_CPAS_MONITOR_MAX_ENTRIES   100
+#define CAM_CPAS_INC_MONITOR_HEAD(head, ret) \
+	div_u64_rem(atomic64_add_return(1, head),\
+	CAM_CPAS_MONITOR_MAX_ENTRIES, (ret))
+#define CAM_CPAS_MAX_CESTA_VCD_NUM 9
+
+#define CAM_CPAS_DUMP_NUM_WORDS_COMM              20
+#define CAM_CPAS_DUMP_NUM_WORDS_VOTE_TYEP_DRV     4
+#define CAM_CPAS_DUMP_NUM_WORDS_VOTE_TYEP_HLOS    2
+#define CAM_CPAS_DUMP_NUM_WORDS_RT_WR_NIUS        2
+#define CAM_CPAS_DUMP_NUM_WORDS_VCD_CURR_LVL      2
+
+/**
+ * enum cam_camnoc_domain_type - Enum for different camnoc domains
+ * @CAM_CAMNOC_HW_COMBINED: refer to legacy camnoc info that combines RT/NRT HW
+ * @CAM_CAMNOC_HW_RT: type for camnoc RT info
+ * @CAM_CAMNOC_HW_NRT: type for camnoc NRT info
+ * @CAM_CAMNOC_HW_TYPE_MAX: camnoc info maximum type
+ */
+enum cam_camnoc_hw_type {
+	CAM_CAMNOC_HW_COMBINED,
+	CAM_CAMNOC_HW_RT,
+	CAM_CAMNOC_HW_NRT,
+	CAM_CAMNOC_HW_TYPE_MAX,
+};
+
+/**
+ * enum cam_cpas_access_type - Enum for Register access type
+ */
+enum cam_cpas_access_type {
+	CAM_REG_TYPE_READ,
+	CAM_REG_TYPE_WRITE,
+	CAM_REG_TYPE_READ_WRITE,
+};
+
+/**
+ * struct cam_cpas_vdd_ahb_mapping : Voltage to ahb level mapping
+ *
+ * @vdd_corner : Voltage corner value
+ * @ahb_level : AHB vote level corresponds to this vdd_corner
+ *
+ */
+struct cam_cpas_vdd_ahb_mapping {
+	unsigned int vdd_corner;
+	enum cam_vote_level ahb_level;
+};
+
+/**
+ * struct cam_cpas_bw_vote : AXI bw vote
+ *
+ * @ab:     AB bw value
+ * @ib:     IB bw value
+ * @camnoc: CAMNOC bw value
+ *
+ */
+struct cam_cpas_bw_vote {
+	uint64_t ab;
+	uint64_t ib;
+	uint64_t camnoc;
+};
+
+/**
+ * struct cam_cpas_drv_vote : DRV bw vote
+ *
+ * @high: Active bw values
+ * @low:  Sleep bw values
+ *
+ */
+struct cam_cpas_drv_vote {
+	struct cam_cpas_bw_vote high;
+	struct cam_cpas_bw_vote low;
+};
+
+/**
+ * struct cam_cpas_axi_bw_info : AXI bw info
+ *
+ * @vote_type:  HLOS or DRV vote type
+ * @hlos_vote: HLOS bw values
+ * @drv_vote:  DRV bw values
+ *
+ */
+struct cam_cpas_axi_bw_info {
+	enum cam_cpas_vote_type vote_type;
+	union {
+		struct cam_cpas_bw_vote hlos_vote;
+		struct cam_cpas_drv_vote drv_vote;
+	};
+};
+
+/**
+ * struct cam_cpas_kobj_map: wrapper structure for base kobject
+ *                               and cam cpas private soc info
+ * @base_kobj: kernel object for camera sysfs
+ * @cpas_hw: pointer to cam_hw_info structure
+ */
+struct cam_cpas_kobj_map {
+	struct kobject base_kobj;
+	struct cam_hw_info *cpas_hw;
+};
+
+/**
+ * struct cam_cpas_internal_ops - CPAS Hardware layer internal ops
+ *
+ * @get_hw_info: Function pointer for get hw info
+ * @init_hw_version: Function pointer for hw init based on version
+ * @handle_irq: Function poniter for irq handling
+ * @setup_regbase: Function pointer for setup rebase indices
+ * @power_on: Function pointer for hw core specific power on settings
+ * @power_off: Function pointer for hw core specific power off settings
+ * @setup_qos_settings: Function pointer for hw to select a specific qos header
+ * @print_poweron_settings: Function pointer for hw to print poweron settings
+ * @qchannel_handshake: Function pointer for hw core specific qchannel
+ *                      handshake settings
+ * @set_tpg_mux_sel: Set tpg mux select on CPAS TOP register
+ *
+ */
+struct cam_cpas_internal_ops {
+	int (*get_hw_info)(struct cam_hw_info *cpas_hw,
+		struct cam_cpas_hw_caps *hw_caps);
+	int (*init_hw_version)(struct cam_hw_info *cpas_hw,
+		struct cam_cpas_hw_caps *hw_caps);
+	irqreturn_t (*handle_irq)(int irq_num, void *data);
+	int (*setup_regbase)(struct cam_hw_soc_info *soc_info,
+		int32_t regbase_index[], int32_t num_reg_map);
+	int (*power_on)(struct cam_hw_info *cpas_hw);
+	int (*power_off)(struct cam_hw_info *cpas_hw);
+	int (*setup_qos_settings)(struct cam_hw_info *cpas_hw,
+		uint32_t selection_mask);
+	int (*print_poweron_settings)(struct cam_hw_info *cpas_hw);
+	int (*qchannel_handshake)(struct cam_hw_info *cpas_hw, bool power_on, bool force_on);
+	int (*set_tpg_mux_sel)(struct cam_hw_info *cpas_hw, uint32_t tpg_num);
+};
+
+/**
+ * struct cam_cpas_reg : CPAS register info
+ *
+ * @enable: Whether this reg info need to be enabled
+ * @access_type: Register access type
+ * @masked_value: Whether this register write/read is based on mask, shift
+ * @mask: Mask for this register value
+ * @shift: Shift for this register value
+ * @value: Register value
+ *
+ */
+struct cam_cpas_reg {
+	bool enable;
+	enum cam_cpas_access_type access_type;
+	bool masked_value;
+	uint32_t offset;
+	uint32_t mask;
+	uint32_t shift;
+	uint32_t value;
+};
+
+/**
+ * struct cam_cpas_client : CPAS Client structure info
+ *
+ * @data: Client register params
+ * @registered: Whether client has registered with cpas
+ * @started: Whether client has streamed on
+ * @tree_node_valid: Indicates whether tree node has at least one valid node
+ * @is_drv_dyn: Indicates whether this client is DRV dynamic voting client
+ * @ahb_level: Determined/Applied ahb level for the client
+ * @axi_vote: Determined/Applied axi vote for the client
+ * @axi_port: Client's parent axi port
+ * @tree_node: All granular path voting nodes for the client
+ *
+ */
+struct cam_cpas_client {
+	struct cam_cpas_register_params data;
+	bool registered;
+	bool started;
+	bool tree_node_valid;
+	bool is_drv_dyn;
+	enum cam_vote_level ahb_level;
+	struct cam_axi_vote axi_vote;
+	struct cam_cpas_axi_port *axi_port;
+	struct cam_cpas_tree_node *tree_node[CAM_CPAS_PATH_DATA_MAX]
+		[CAM_CPAS_TRANSACTION_MAX];
+};
+
+/**
+ * struct cam_cpas_bus_client : Bus client information
+ *
+ * @valid: Whether bus client is valid
+ * @name: Name of the bus client
+ * @lock: Mutex lock used while voting on this client
+ * @curr_vote_level: current voted index
+ * @common_data: Common data fields for bus client
+ * @soc_bus_client: Bus client private information
+ */
+struct cam_cpas_bus_client {
+	bool valid;
+	struct mutex lock;
+	unsigned int curr_vote_level;
+	struct cam_soc_bus_client_common_data common_data;
+	void *soc_bus_client;
+};
+
+/**
+ * struct cam_cpas_axi_port : AXI port information
+ *
+ * @axi_port_name: Name of this AXI port
+ * @bus_client: bus client info for this port
+ * @ib_bw_voting_needed: if this port can update ib bw dynamically
+ * @is_rt: if this port represents a real time axi port
+ * @axi_port_node: Node representing AXI Port info in device tree
+ * @drv_idx: DRV index for axi port node
+ * @cam_rsc_dev: Cam RSC device for DRV
+ * @is_drv_started: Indicates if DRV started for RSC device corresponding to port
+ * @curr_bw: Current voted bw after cpas consolidation
+ * @additional_bw: Additional bandwidth to cover non-hw cpas clients
+ * @applied_bw: Actual applied bw to port
+ */
+struct cam_cpas_axi_port {
+	const char *axi_port_name;
+	struct cam_cpas_bus_client bus_client;
+	bool ib_bw_voting_needed;
+	bool is_rt;
+	struct device_node *axi_port_node;
+	uint32_t drv_idx;
+	const struct device *cam_rsc_dev;
+	bool is_drv_started;
+	struct cam_cpas_axi_bw_info curr_bw;
+	uint64_t additional_bw;
+	struct cam_cpas_axi_bw_info applied_bw;
+};
+
+/**
+ * struct cam_cpas_axi_port_debug_info : AXI port information
+ *
+ * @axi_port_name: Name of this AXI port
+ * @curr_bw: Current voted bw after cpas consolidation
+ * @camnoc_bw: CAMNOC bw value for this port
+ * @applied_bw: Actual applied bw to port
+ * @is_drv_started: Indicates if DRV started for RSC device corresponding to port
+ */
+struct cam_cpas_axi_port_debug_info {
+	const char *axi_port_name;
+	struct cam_cpas_axi_bw_info curr_bw;
+	uint64_t camnoc_bw;
+	struct cam_cpas_axi_bw_info applied_bw;
+	bool is_drv_started;
+};
+
+struct cam_cpas_cesta_vcd_curr_lvl_debug_info {
+	uint8_t index;
+	uint32_t reg_value;
+};
+
+/**
+ * struct cam_cpas_cesta_vcd_reg_debug_info : to hold all cesta register information
+ *
+ * @vcd_currol: vcd control reg info
+ *
+ */
+struct cam_cpas_cesta_vcd_reg_debug_info {
+	struct cam_cpas_cesta_vcd_curr_lvl_debug_info
+		vcd_curr_lvl_debug_info[CAM_CPAS_MAX_CESTA_VCD_NUM];
+};
+
+
+/**
+ * struct cam_cpas_monitor : CPAS monitor array
+ *
+ * @timestamp: Timestamp at which this monitor entry is saved
+ * @identifier_string: String passed by caller
+ * @identifier_value: Identifier value passed by caller
+ * @axi_info: AXI port information
+ * @applied_camnoc_clk: Applied camnoc axi clock rate with sw, hw clients
+ * @applied_ahb_level: Applied camcc ahb level
+ * @fe_ddr: RPMH DDR BCM FE (front-end) status register value.
+ *          This indicates requested clock plan
+ * @be_ddr: RPMH DDR BCM BE (back-end) status register value.
+ *          This indicates actual current clock plan
+ * @fe_mnoc: RPMH MNOC BCM FE (front-end) status register value.
+ *           This indicates requested clock plan
+ * @be_mnoc: RPMH MNOC BCM BE (back-end) status register value.
+ *           This indicates actual current clock plan
+ * @be_shub: RPMH SHUB BCM BE (back-end) status register value.
+ *           This indicates actual current clock plan
+ * @num_camnoc_lvl_regs: Number of enabled camnoc fill level
+ *           monitoring registers
+ * @camnoc_port_name: Camnoc port names
+ * @camnoc_fill_level: Camnoc fill level register info
+ * @rt_wr_niu_pri_lut_low: priority lut low values of RT Wr NIUs
+ * @rt_wr_niu_pri_lut_high: priority lut high values of RT Wr NIUs
+ * @vcd_reg_debug_info: vcd reg debug information
+ */
+struct cam_cpas_monitor {
+	struct timespec64   timestamp;
+	char                identifier_string[128];
+	int32_t             identifier_value;
+	struct cam_cpas_axi_port_debug_info axi_info[CAM_CPAS_MAX_AXI_PORTS];
+	struct cam_soc_util_clk_rates       applied_camnoc_clk;
+	unsigned int        applied_ahb_level;
+	uint32_t            fe_ddr;
+	uint32_t            be_ddr;
+	uint32_t            fe_mnoc;
+	uint32_t            be_mnoc;
+	uint32_t            be_shub;
+	uint32_t            num_camnoc_lvl_regs[CAM_CAMNOC_HW_TYPE_MAX];
+	const char          *camnoc_port_name[CAM_CAMNOC_HW_TYPE_MAX]
+		[CAM_CAMNOC_FILL_LVL_REG_INFO_MAX];
+	uint32_t            camnoc_fill_level[CAM_CAMNOC_HW_TYPE_MAX]
+		[CAM_CAMNOC_FILL_LVL_REG_INFO_MAX];
+	uint32_t            rt_wr_niu_pri_lut_low[CAM_CPAS_MAX_RT_WR_NIU_NODES];
+	uint32_t            rt_wr_niu_pri_lut_high[CAM_CPAS_MAX_RT_WR_NIU_NODES];
+	struct cam_cpas_cesta_vcd_reg_debug_info vcd_reg_debug_info;
+	struct cam_hw_info  *cpas_hw;
+};
+
+/**
+ * struct cam_cpas : CPAS core data structure info
+ *
+ * @hw_caps: CPAS hw capabilities
+ * @cpas_client: Array of pointers to CPAS clients info
+ * @client_mutex: Mutex for accessing client info
+ * @tree_lock: Mutex lock for accessing CPAS node tree
+ * @num_clients: Total number of clients that CPAS supports
+ * @num_axi_ports: Total number of axi ports found in device tree
+ * @num_camnoc_axi_ports: Total number of camnoc axi ports found in device tree
+ * @registered_clients: Number of Clients registered currently
+ * @streamon_clients: Number of Clients that are in start state currently
+ * @slave_err_irq_idx: Index of slave error in irq error data structure,
+ *                     avoids iterating the entire structure to find this
+ *                     idx in irq th
+ * @regbase_index: Register base indices for CPAS register base IDs
+ * @ahb_bus_client: AHB Bus client info
+ * @axi_port: AXI port info for a specific axi index
+ * @camnoc_axi_port: CAMNOC AXI port info for a specific camnoc axi index
+ * @cam_subpart_info: camera subparts fuse description
+ * @internal_ops: CPAS HW internal ops
+ * @work_queue: Work queue handle
+ * @soc_access_count: atomic soc_access_count count
+ * @soc_access_count_wq: wait variable to ensure CPAS is not stop,
+ *						 while accessing hw through CPAS
+ * @dentry: debugfs file entry
+ * @ahb_bus_scaling_disable: ahb scaling based on src clk corner for bus
+ * @applied_camnoc_axi_rate: applied camnoc axi clock rate through sw, hw clients
+ * @monitor_head: Monitor array head
+ * @monitor_entries: cpas monitor array
+ * @camnoc_info: array of camnoc info pointer
+ * @cesta_info: Pointer to cesta header info
+ * @num_valid_camnoc: number of valid camnoc info
+ * @camnoc_rt_idx: index to real time camnoc info array
+ * @camnoc_info_idx: map camnoc hw type to index used for camnoc_info array indexing
+ * @full_state_dump: Whether to enable full cpas state dump or not
+ * @smart_qos_dump: Whether to dump smart qos information on update
+ * @slave_err_irq_en: Whether slave error irq is enabled to detect memory
+ *                    config issues
+ * @smmu_fault_handled: Handled address decode error, on fault at SMMU
+ * @force_hlos_drv: Whether to force disable DRV voting
+ * @force_cesta_sw_client: Whether to force voting through cesta sw client
+ */
+struct cam_cpas {
+	struct cam_cpas_hw_caps hw_caps;
+	struct cam_cpas_client *cpas_client[CAM_CPAS_MAX_CLIENTS];
+	struct mutex client_mutex[CAM_CPAS_MAX_CLIENTS];
+	struct mutex tree_lock;
+	uint32_t num_clients;
+	uint32_t num_axi_ports;
+	uint32_t num_camnoc_axi_ports;
+	uint32_t registered_clients;
+	uint32_t streamon_clients;
+	uint32_t slave_err_irq_idx[CAM_CAMNOC_HW_TYPE_MAX];
+	int32_t regbase_index[CAM_CPAS_REG_MAX];
+	struct cam_cpas_bus_client ahb_bus_client;
+	struct cam_cpas_axi_port axi_port[CAM_CPAS_MAX_AXI_PORTS];
+	struct cam_cpas_axi_port camnoc_axi_port[CAM_CPAS_MAX_AXI_PORTS];
+	struct cam_cpas_subpart_info *cam_subpart_info;
+	struct cam_cpas_internal_ops internal_ops;
+	struct workqueue_struct *work_queue;
+	atomic_t soc_access_count;
+	wait_queue_head_t soc_access_count_wq;
+	struct dentry *dentry;
+	bool ahb_bus_scaling_disable;
+	struct cam_soc_util_clk_rates applied_camnoc_axi_rate;
+	atomic64_t  monitor_head;
+	struct cam_cpas_monitor monitor_entries[CAM_CPAS_MONITOR_MAX_ENTRIES];
+	void *camnoc_info[CAM_CAMNOC_HW_TYPE_MAX];
+	void *cesta_info;
+	uint8_t num_valid_camnoc;
+	int8_t camnoc_rt_idx;
+	int8_t camnoc_info_idx[CAM_CAMNOC_HW_TYPE_MAX];
+	bool full_state_dump;
+	bool smart_qos_dump;
+	bool slave_err_irq_en[CAM_CAMNOC_HW_TYPE_MAX];
+	bool smmu_fault_handled;
+	bool force_hlos_drv;
+	bool force_cesta_sw_client;
+};
+
+int cam_camsstop_get_internal_ops(struct cam_cpas_internal_ops *internal_ops);
+int cam_cpastop_get_internal_ops(struct cam_cpas_internal_ops *internal_ops);
+
+int cam_cpas_util_reg_update(struct cam_hw_info *cpas_hw,
+	enum cam_cpas_reg_base reg_base, struct cam_cpas_reg *reg_info);
+int cam_cpas_util_reg_read(struct cam_hw_info *cpas_hw,
+	enum cam_cpas_reg_base reg_base, struct cam_cpas_reg *reg_info);
+
+int cam_cpas_util_client_cleanup(struct cam_hw_info *cpas_hw);
+
+int cam_cpas_util_vote_default_ahb_axi(struct cam_hw_info *cpas_hw,
+	int enable);
+
+#endif /* _CAM_CPAS_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_hw_intf.h
@@ -0,0 +1,211 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CPAS_HW_INTF_H_
+#define _CAM_CPAS_HW_INTF_H_
+
+#include <linux/platform_device.h>
+
+#include "cam_cpas_api.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_debug_util.h"
+
+/* Number of times to retry while polling */
+#define CAM_CPAS_POLL_RETRY_CNT 5
+/* Minimum usecs to sleep while polling */
+#define CAM_CPAS_POLL_MIN_USECS 200
+/* Maximum usecs to sleep while polling */
+#define CAM_CPAS_POLL_MAX_USECS 250
+/* Number of times to retry while polling */
+#define CAM_CPAS_POLL_QH_RETRY_CNT 50
+
+/* Number of CPAS hw caps registers */
+#define CAM_CPAS_MAX_CAPS_REGS 2
+
+/**
+ * enum cam_cpas_hw_type - Enum for CPAS HW type
+ */
+enum cam_cpas_hw_type {
+	CAM_HW_CPASTOP,
+	CAM_HW_CAMSSTOP,
+};
+
+/**
+ * enum cam_cpas_reg_base - Enum for register base identifier. These
+ *                          are the identifiers used in generic register
+ *                          write/read APIs provided by cpas driver.
+ */
+enum cam_cpas_reg_base {
+	CAM_CPAS_REG_CPASTOP,
+	CAM_CPAS_REG_CAMNOC,
+	CAM_CPAS_REG_CAMSS,
+	CAM_CPAS_REG_RPMH,
+	CAM_CPAS_REG_CESTA,
+	CAM_CPAS_REG_CAMNOC_RT,
+	CAM_CPAS_REG_CAMNOC_NRT,
+	CAM_CPAS_REG_MAX
+};
+
+/**
+ * enum cam_cpas_hw_cmd_process - Enum for CPAS HW process command type
+ */
+enum cam_cpas_hw_cmd_process {
+	CAM_CPAS_HW_CMD_REGISTER_CLIENT,
+	CAM_CPAS_HW_CMD_UNREGISTER_CLIENT,
+	CAM_CPAS_HW_CMD_REG_WRITE,
+	CAM_CPAS_HW_CMD_REG_READ,
+	CAM_CPAS_HW_CMD_AHB_VOTE,
+	CAM_CPAS_HW_CMD_AXI_VOTE,
+	CAM_CPAS_HW_CMD_LOG_VOTE,
+	CAM_CPAS_HW_CMD_SELECT_QOS,
+	CAM_CPAS_HW_CMD_LOG_EVENT,
+	CAM_CPAS_HW_CMD_GET_SCID,
+	CAM_CPAS_HW_CMD_ACTIVATE_LLC,
+	CAM_CPAS_HW_CMD_DEACTIVATE_LLC,
+	CAM_CPAS_HW_CMD_CONFIGURE_STALING_LLC,
+	CAM_CPAS_HW_CMD_NOTIF_STALL_INC_LLC,
+	CAM_CPAS_HW_CMD_DUMP_BUFF_FILL_INFO,
+	CAM_CPAS_HW_CMD_CSID_INPUT_CORE_INFO_UPDATE,
+	CAM_CPAS_HW_CMD_CSID_PROCESS_RESUME,
+	CAM_CPAS_HW_CMD_ENABLE_DISABLE_DOMAIN_ID_CLK,
+	CAM_CPAS_HW_CMD_TPG_MUX_SEL,
+	CAM_CPAS_HW_CMD_DUMP_STATE_MONITOR_INFO,
+	CAM_CPAS_HW_CMD_INVALID,
+};
+
+/**
+ * struct cam_cpas_hw_cmd_csid_input_core_info_update : CPAS cmd struct for updating acquired
+ *                                                      csid core info to cpas
+ *
+ * @csid_idx: CSID core index
+ * @sfe_idx:  SFE core index corresponding to CSID core
+ * @set_port: Indicates whether to set or reset port for given client
+ *
+ */
+struct cam_cpas_hw_cmd_csid_input_core_info_update {
+	int csid_idx;
+	int sfe_idx;
+	bool set_port;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_reg_read_write : CPAS cmd struct for reg read, write
+ *
+ * @client_handle: Client handle
+ * @reg_base: Register base type
+ * @offset: Register offset
+ * @value: Register value
+ * @mb: Whether to do operation with memory barrier
+ *
+ */
+struct cam_cpas_hw_cmd_reg_read_write {
+	uint32_t client_handle;
+	enum cam_cpas_reg_base reg_base;
+	uint32_t offset;
+	uint32_t value;
+	bool mb;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_ahb_vote : CPAS cmd struct for AHB vote
+ *
+ * @client_handle: Client handle
+ * @ahb_vote: AHB voting info
+ *
+ */
+struct cam_cpas_hw_cmd_ahb_vote {
+	uint32_t client_handle;
+	struct cam_ahb_vote *ahb_vote;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_axi_vote : CPAS cmd struct for AXI vote
+ *
+ * @client_handle: Client handle
+ * @axi_vote: axi bandwidth vote
+ *
+ */
+struct cam_cpas_hw_cmd_axi_vote {
+	uint32_t client_handle;
+	struct cam_axi_vote *axi_vote;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_start : CPAS cmd struct for start
+ *
+ * @client_handle: Client handle
+ *
+ */
+struct cam_cpas_hw_cmd_start {
+	uint32_t client_handle;
+	struct cam_ahb_vote *ahb_vote;
+	struct cam_axi_vote *axi_vote;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_stop : CPAS cmd struct for stop
+ *
+ * @client_handle: Client handle
+ *
+ */
+struct cam_cpas_hw_cmd_stop {
+	uint32_t client_handle;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_notify_event : CPAS cmd struct for notify event
+ *
+ * @identifier_string: Identifier string passed by caller
+ * @identifier_value: Identifier value passed by caller
+ *
+ */
+struct cam_cpas_hw_cmd_notify_event {
+	const char *identifier_string;
+	int32_t identifier_value;
+};
+
+/**
+ * struct cam_cpas_hw_caps : CPAS HW capabilities
+ *
+ * @camera_family: Camera family type
+ * @camera_version: Camera version
+ * @cpas_version: CPAS version
+ * @camera_capability: array of camera hw capabilities
+ * @num_capability_reg: Number of camera hw capabilities registers
+ * @fuse_info: Fuse information
+ *
+ */
+struct cam_cpas_hw_caps {
+	uint32_t camera_family;
+	struct cam_hw_version camera_version;
+	struct cam_hw_version cpas_version;
+	uint32_t camera_capability[CAM_CPAS_MAX_CAPS_REGS];
+	uint32_t num_capability_reg;
+	struct cam_cpas_fuse_info fuse_info;
+};
+
+int cam_cpas_hw_probe(struct platform_device *pdev,
+	struct cam_hw_intf **hw_intf);
+int cam_cpas_hw_remove(struct cam_hw_intf *cpas_hw_intf);
+
+/**
+ * @brief : API to register CPAS hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_cpas_dev_init_module(void);
+
+/**
+ * @brief : API to remove CPAS interface from platform framework.
+ */
+void cam_cpas_dev_exit_module(void);
+
+/**
+ * @brief : API to select TPG mux select.
+ */
+int cam_cpas_enable_tpg_mux_sel(uint32_t tpg_mux_sel);
+
+#endif /* _CAM_CPAS_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_intf.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_intf.c
@@ -0,0 +1,1721 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_subdev.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_soc.h"
+#include "cam_cpastop_hw.h"
+#include "camera_main.h"
+#include "cam_cpas_hw.h"
+
+#include <linux/soc/qcom/llcc-qcom.h>
+#include "cam_req_mgr_interface.h"
+
+#ifdef CONFIG_DYNAMIC_FD_PORT_CONFIG
+#include <linux/IClientEnv.h>
+#include <linux/ITrustedCameraDriver.h>
+#include <linux/CTrustedCameraDriver.h>
+#define CAM_CPAS_ERROR_NOT_ALLOWED 10
+#endif
+
+#define CAM_CPAS_DEV_NAME    "cam-cpas"
+#define CAM_CPAS_INTF_INITIALIZED() (g_cpas_intf && g_cpas_intf->probe_done)
+
+/**
+ * struct cam_cpas_intf : CPAS interface
+ *
+ * @pdev: Platform device
+ * @subdev: Subdev info
+ * @hw_intf: CPAS HW interface
+ * @hw_caps: CPAS HW capabilities
+ * @intf_lock: CPAS interface mutex
+ * @open_cnt: CPAS subdev open count
+ * @probe_done: Whether CPAS prove completed
+ *
+ */
+struct cam_cpas_intf {
+	struct platform_device *pdev;
+	struct cam_subdev subdev;
+	struct cam_hw_intf *hw_intf;
+	struct cam_cpas_hw_caps hw_caps;
+	struct mutex intf_lock;
+	uint32_t open_cnt;
+	bool probe_done;
+};
+
+static struct cam_cpas_intf *g_cpas_intf;
+
+const char *cam_cpas_axi_util_path_type_to_string(
+	uint32_t path_data_type)
+{
+	switch (path_data_type) {
+	/* IFE Paths */
+	case CAM_AXI_PATH_DATA_IFE_LINEAR:
+		return "IFE_LINEAR";
+	case CAM_AXI_PATH_DATA_IFE_VID:
+		return "IFE_VID";
+	case CAM_AXI_PATH_DATA_IFE_DISP:
+		return "IFE_DISP";
+	case CAM_AXI_PATH_DATA_IFE_STATS:
+		return "IFE_STATS";
+	case CAM_AXI_PATH_DATA_IFE_RDI0:
+		return "IFE_RDI0";
+	case CAM_AXI_PATH_DATA_IFE_RDI1:
+		return "IFE_RDI1";
+	case CAM_AXI_PATH_DATA_IFE_RDI2:
+		return "IFE_RDI2";
+	case CAM_AXI_PATH_DATA_IFE_RDI3:
+		return "IFE_RDI3";
+	case CAM_AXI_PATH_DATA_IFE_PDAF:
+		return "IFE_PDAF";
+	case CAM_AXI_PATH_DATA_IFE_PIXEL_RAW:
+		return "IFE_PIXEL_RAW";
+
+	/* IPE Paths */
+	case CAM_AXI_PATH_DATA_IPE_RD_IN:
+		return "IPE_RD_IN";
+	case CAM_AXI_PATH_DATA_IPE_RD_REF:
+		return "IPE_RD_REF";
+	case CAM_AXI_PATH_DATA_IPE_WR_VID:
+		return "IPE_WR_VID";
+	case CAM_AXI_PATH_DATA_IPE_WR_DISP:
+		return "IPE_WR_DISP";
+	case CAM_AXI_PATH_DATA_IPE_WR_REF:
+		return "IPE_WR_REF";
+	case CAM_AXI_PATH_DATA_IPE_WR_APP:
+		return "IPE_WR_APP";
+
+	/* OPE Paths */
+	case CAM_AXI_PATH_DATA_OPE_RD_IN:
+		return "OPE_RD_IN";
+	case CAM_AXI_PATH_DATA_OPE_RD_REF:
+		return "OPE_RD_REF";
+	case CAM_AXI_PATH_DATA_OPE_WR_VID:
+		return "OPE_WR_VID";
+	case CAM_AXI_PATH_DATA_OPE_WR_DISP:
+		return "OPE_WR_DISP";
+	case CAM_AXI_PATH_DATA_OPE_WR_REF:
+		return "OPE_WR_REF";
+
+	/* SFE Paths */
+	case CAM_AXI_PATH_DATA_SFE_NRDI:
+		return "SFE_NRDI";
+	case CAM_AXI_PATH_DATA_SFE_RDI0:
+		return "SFE_RDI0";
+	case CAM_AXI_PATH_DATA_SFE_RDI1:
+		return "SFE_RDI1";
+	case CAM_AXI_PATH_DATA_SFE_RDI2:
+		return "SFE_RDI2";
+	case CAM_AXI_PATH_DATA_SFE_RDI3:
+		return "SFE_RDI3";
+	case CAM_AXI_PATH_DATA_SFE_RDI4:
+		return "SFE_RDI4";
+	case CAM_AXI_PATH_DATA_SFE_STATS:
+		return "SFE_STATS";
+	case CAM_AXI_PATH_DATA_CRE_RD_IN:
+		return "CRE_RD_IN";
+	case CAM_AXI_PATH_DATA_CRE_WR_OUT:
+		return "CRE_WR_OUT";
+
+	/* OFE Paths */
+	case CAM_AXI_PATH_DATA_OFE_RD_EXT:
+		return "OFE_RD_EXT";
+	case CAM_AXI_PATH_DATA_OFE_RD_INT_PDI:
+		return "OFE_RD_INT_PDI";
+	case CAM_AXI_PATH_DATA_OFE_RD_INT_HDR:
+		return "OFE_RD_INT_HDR";
+	case CAM_AXI_PATH_DATA_OFE_WR_VID:
+		return "OFE_WR_VID";
+	case CAM_AXI_PATH_DATA_OFE_WR_DISP:
+		return "OFE_WR_DISP";
+	case CAM_AXI_PATH_DATA_OFE_WR_IR:
+		return "OFE_WR_IR";
+	case CAM_AXI_PATH_DATA_OFE_WR_HDR_LTM:
+		return "OFE_WR_HDR_LTM";
+	case CAM_AXI_PATH_DATA_OFE_WR_DC4:
+		return "OFE_WR_DC4";
+	case CAM_AXI_PATH_DATA_OFE_WR_AI:
+		return "OFE_WR_AI";
+	case CAM_AXI_PATH_DATA_OFE_WR_PDI:
+		return "OFE_WR_PDI";
+	case CAM_AXI_PATH_DATA_OFE_WR_IDEALRAW:
+		return "OFE_WR_IDEALRAW";
+	case CAM_AXI_PATH_DATA_OFE_WR_STATS:
+		return "OFE_WR_STATS";
+
+	/* Common Paths */
+	case CAM_AXI_PATH_DATA_ALL:
+		return "DATA_ALL";
+	default:
+		return "CPAS_PATH_INVALID";
+	}
+}
+EXPORT_SYMBOL(cam_cpas_axi_util_path_type_to_string);
+
+const char *cam_cpas_axi_util_trans_type_to_string(
+	uint32_t transac_type)
+{
+	switch (transac_type) {
+	case CAM_AXI_TRANSACTION_READ:
+		return "TRANSAC_READ";
+	case CAM_AXI_TRANSACTION_WRITE:
+		return "TRANSAC_WRITE";
+	default:
+		return "TRANSAC_INVALID";
+	}
+}
+EXPORT_SYMBOL(cam_cpas_axi_util_trans_type_to_string);
+
+const char *cam_cpas_axi_util_drv_vote_lvl_to_string(
+	uint32_t vote_lvl)
+{
+	switch (vote_lvl) {
+	case CAM_CPAS_VOTE_LEVEL_LOW:
+		return "VOTE_LVL_LOW";
+	case CAM_CPAS_VOTE_LEVEL_HIGH:
+		return "VOTE_LVL_HIGH";
+	default:
+		return "VOTE_LVL_INVALID";
+	}
+}
+EXPORT_SYMBOL(cam_cpas_axi_util_drv_vote_lvl_to_string);
+
+const char *cam_cpas_util_vote_type_to_string(enum cam_cpas_vote_type vote_type)
+{
+	switch (vote_type) {
+	case CAM_CPAS_VOTE_TYPE_HLOS:
+		return "VOTE_TYPE_HLOS";
+	case CAM_CPAS_VOTE_TYPE_DRV:
+		return "VOTE_TYPE_DRV";
+	default:
+		return "VOTE_TYPE_INVALID";
+	}
+}
+EXPORT_SYMBOL(cam_cpas_util_vote_type_to_string);
+
+int cam_cpas_query_drv_enable(bool *is_ddr_drv_enabled, bool *is_clk_drv_enabled)
+{
+	struct cam_hw_info *cpas_hw = NULL;
+	struct cam_cpas_private_soc *soc_private = NULL;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!is_ddr_drv_enabled && !is_clk_drv_enabled) {
+		CAM_ERR(CAM_CPAS, "invalid input ddr: %pK clk: %pK", is_ddr_drv_enabled,
+			is_clk_drv_enabled);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info  *) g_cpas_intf->hw_intf->hw_priv;
+	soc_private = (struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+
+	if (is_ddr_drv_enabled)
+		*is_ddr_drv_enabled = soc_private->enable_cam_ddr_drv;
+
+	if (is_clk_drv_enabled)
+		*is_clk_drv_enabled = soc_private->enable_cam_clk_drv;
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_cpas_query_drv_enable);
+
+int cam_cpas_csid_process_resume(uint32_t csid_idx)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_CSID_PROCESS_RESUME, &csid_idx,
+			sizeof(uint32_t));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_csid_process_resume);
+
+
+int cam_cpas_csid_input_core_info_update(int csid_idx, int sfe_idx, bool set_port)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_csid_input_core_info_update core_info_update;
+
+		core_info_update.csid_idx = csid_idx;
+		core_info_update.sfe_idx = sfe_idx;
+		core_info_update.set_port = set_port;
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_CSID_INPUT_CORE_INFO_UPDATE, &core_info_update,
+			sizeof(core_info_update));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_csid_input_core_info_update);
+
+int cam_cpas_dump_camnoc_buff_fill_info(uint32_t client_handle)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_DUMP_BUFF_FILL_INFO, &client_handle,
+			sizeof(uint32_t));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_dump_camnoc_buff_fill_info);
+
+bool cam_cpas_is_part_supported(uint32_t flag, uint32_t hw_map, uint32_t part_info)
+{
+	int32_t i;
+	struct cam_hw_info *cpas_hw = g_cpas_intf->hw_intf->hw_priv;
+	struct cam_cpas *cpas_core = NULL;
+	struct cam_cpas_subpart_info *cam_subpart_info = NULL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	cpas_core = cpas_hw->core_info;
+	cam_subpart_info = cpas_core->cam_subpart_info;
+
+	if (!cam_subpart_info) {
+		CAM_DBG(CAM_CPAS, "Invalid address of cam_subpart_info");
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return true;
+	}
+
+	for (i = 0; i < cam_subpart_info->num_bits; i++) {
+		if ((cam_subpart_info->hw_bitmap_mask[i][0] == flag) &&
+				(cam_subpart_info->hw_bitmap_mask[i][1] == hw_map)) {
+			CAM_DBG(CAM_CPAS, "flag: %u hw_map: %u part_info:0x%x",
+					flag, hw_map, part_info);
+			mutex_unlock(&cpas_hw->hw_mutex);
+			return ((part_info & BIT(i)) == 0);
+		}
+	}
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return true;
+}
+
+bool cam_cpas_is_feature_supported(uint32_t flag, uint32_t hw_map,
+	uint32_t *fuse_val)
+{
+	struct cam_hw_info *cpas_hw = NULL;
+	struct cam_cpas_private_soc *soc_private = NULL;
+	bool supported = true;
+	int32_t i;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return false;
+	}
+
+	cpas_hw = (struct cam_hw_info *) g_cpas_intf->hw_intf->hw_priv;
+	soc_private =
+		(struct cam_cpas_private_soc *)cpas_hw->soc_info.soc_private;
+
+	if (flag >= CAM_CPAS_FUSE_FEATURE_MAX) {
+		CAM_ERR(CAM_CPAS, "Unknown feature flag %x", flag);
+		return false;
+	}
+
+	supported = cam_cpas_is_part_supported(flag, hw_map, soc_private->part_info);
+
+	for (i = 0; i < soc_private->num_feature_info; i++)
+		if (soc_private->feature_info[i].feature == flag)
+			break;
+
+	if (i == soc_private->num_feature_info)
+		goto end;
+
+	if (soc_private->feature_info[i].type == CAM_CPAS_FEATURE_TYPE_DISABLE
+		|| (soc_private->feature_info[i].type ==
+		CAM_CPAS_FEATURE_TYPE_ENABLE)) {
+		if ((soc_private->feature_info[i].hw_map & hw_map) == hw_map) {
+			if (!(supported && soc_private->feature_info[i].enable))
+				supported = false;
+		}
+	} else {
+		if (!fuse_val) {
+			CAM_ERR(CAM_CPAS,
+				"Invalid arg fuse_val");
+		} else {
+			*fuse_val = soc_private->feature_info[i].value;
+		}
+	}
+
+end:
+	return supported;
+}
+EXPORT_SYMBOL(cam_cpas_is_feature_supported);
+
+int cam_cpas_get_cpas_hw_version(uint32_t *hw_version)
+{
+	struct cam_hw_info *cpas_hw = NULL;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!hw_version) {
+		CAM_ERR(CAM_CPAS, "invalid input %pK", hw_version);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info  *) g_cpas_intf->hw_intf->hw_priv;
+
+	*hw_version = cpas_hw->soc_info.hw_version;
+
+	if (*hw_version == CAM_CPAS_TITAN_NONE) {
+		CAM_DBG(CAM_CPAS, "Didn't find a valid HW Version %d",
+			*hw_version);
+	}
+
+	return 0;
+}
+
+int cam_cpas_get_hw_info(uint32_t *camera_family,
+	struct cam_hw_version *camera_version,
+	struct cam_hw_version *cpas_version,
+	uint32_t **cam_caps, uint32_t *num_cap_mask,
+	struct cam_cpas_fuse_info *cam_fuse_info,
+	struct cam_cpas_domain_id_caps *domain_id_info)
+{
+	struct cam_hw_info              *cpas_hw;
+	struct cam_cpas_private_soc     *soc_private;
+	struct cam_cpas_domain_id_info   cpas_domain_id;
+	int i;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!camera_family || !camera_version || !cpas_version || !cam_caps || !num_cap_mask) {
+		CAM_ERR(CAM_CPAS, "invalid input %pK %pK %pK %pK %pK",
+			camera_family, camera_version, cpas_version, cam_caps, num_cap_mask);
+		return -EINVAL;
+	}
+
+	cpas_hw = g_cpas_intf->hw_intf->hw_priv;
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+
+	*camera_family  = g_cpas_intf->hw_caps.camera_family;
+	*camera_version = g_cpas_intf->hw_caps.camera_version;
+	*cpas_version   = g_cpas_intf->hw_caps.cpas_version;
+	*cam_caps       = g_cpas_intf->hw_caps.camera_capability;
+	*num_cap_mask   = g_cpas_intf->hw_caps.num_capability_reg;
+
+	if (cam_fuse_info)
+		*cam_fuse_info  = g_cpas_intf->hw_caps.fuse_info;
+	if (domain_id_info) {
+		cpas_domain_id = soc_private->domain_id_info;
+
+		if (!soc_private->domain_id_info.domain_id_supported) {
+			domain_id_info->num_mapping = 0;
+			domain_id_info->is_supported = 0;
+		} else {
+			domain_id_info->is_supported = 1;
+			domain_id_info->num_mapping =
+				soc_private->domain_id_info.num_domain_ids;
+
+			for (i = 0; i < domain_id_info->num_mapping; i++) {
+				domain_id_info->entries[i].domain_type =
+					cpas_domain_id.domain_id_entries[i].domain_type;
+				domain_id_info->entries[i].mapping_id =
+					cpas_domain_id.domain_id_entries[i].mapping_id;
+			}
+		}
+	}
+
+	CAM_DBG(CAM_CPAS, "Family %d, version %d.%d cam_caps %d, domain_id: %s",
+		*camera_family, camera_version->major,
+		camera_version->minor, *cam_caps,
+		CAM_BOOL_TO_YESNO(soc_private->domain_id_info.domain_id_supported));
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_cpas_get_hw_info);
+
+static inline enum cam_cpas_reg_base __cam_cpas_get_internal_reg_base(
+	enum cam_cpas_regbase_types reg_base)
+{
+	switch (reg_base) {
+	case CAM_CPAS_REGBASE_CPASTOP:
+		return CAM_CPAS_REG_CPASTOP;
+	default:
+		return CAM_CPAS_REG_MAX;
+	}
+}
+
+int cam_cpas_reg_write(uint32_t client_handle, enum cam_cpas_regbase_types reg_base,
+	uint32_t offset, bool mb, uint32_t value)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_reg_read_write cmd_reg_write;
+		enum cam_cpas_reg_base internal_reg_base;
+
+		internal_reg_base = __cam_cpas_get_internal_reg_base(reg_base);
+		if (internal_reg_base >= CAM_CPAS_REG_MAX) {
+			CAM_ERR(CAM_CPAS, "Invalid reg base: %d for write ops client: %u",
+				reg_base, client_handle);
+			return -EINVAL;
+		}
+
+		cmd_reg_write.client_handle = client_handle;
+		cmd_reg_write.reg_base = internal_reg_base;
+		cmd_reg_write.offset = offset;
+		cmd_reg_write.value = value;
+		cmd_reg_write.mb = mb;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_REG_WRITE, &cmd_reg_write,
+			sizeof(struct cam_cpas_hw_cmd_reg_read_write));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_reg_write);
+
+int cam_cpas_reg_read(uint32_t client_handle, enum cam_cpas_regbase_types reg_base,
+	uint32_t offset, bool mb, uint32_t *value)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!value) {
+		CAM_ERR(CAM_CPAS, "Invalid arg value");
+		return -EINVAL;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_reg_read_write cmd_reg_read;
+		enum cam_cpas_reg_base internal_reg_base;
+
+		internal_reg_base = __cam_cpas_get_internal_reg_base(reg_base);
+		if (internal_reg_base >= CAM_CPAS_REG_MAX) {
+			CAM_ERR(CAM_CPAS, "Invalid reg base: %d for read ops client: %u",
+				reg_base, client_handle);
+			return -EINVAL;
+		}
+
+		cmd_reg_read.client_handle = client_handle;
+		cmd_reg_read.reg_base = internal_reg_base;
+		cmd_reg_read.offset = offset;
+		cmd_reg_read.mb = mb;
+		cmd_reg_read.value = 0;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_REG_READ, &cmd_reg_read,
+			sizeof(struct cam_cpas_hw_cmd_reg_read_write));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+			return rc;
+		}
+
+		*value = cmd_reg_read.value;
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_reg_read);
+
+int cam_cpas_update_axi_vote(uint32_t client_handle,
+	struct cam_axi_vote *axi_vote)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!axi_vote) {
+		CAM_ERR(CAM_CPAS, "NULL axi vote");
+		return -EINVAL;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_axi_vote cmd_axi_vote;
+
+		cmd_axi_vote.client_handle = client_handle;
+		cmd_axi_vote.axi_vote = axi_vote;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_AXI_VOTE, &cmd_axi_vote,
+			sizeof(struct cam_cpas_hw_cmd_axi_vote));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_update_axi_vote);
+
+int cam_cpas_update_ahb_vote(uint32_t client_handle,
+	struct cam_ahb_vote *ahb_vote)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_ahb_vote cmd_ahb_vote;
+
+		cmd_ahb_vote.client_handle = client_handle;
+		cmd_ahb_vote.ahb_vote = ahb_vote;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_AHB_VOTE, &cmd_ahb_vote,
+			sizeof(struct cam_cpas_hw_cmd_ahb_vote));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_update_ahb_vote);
+
+int cam_cpas_stop(uint32_t client_handle)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.stop) {
+		struct cam_cpas_hw_cmd_stop cmd_hw_stop;
+
+		cmd_hw_stop.client_handle = client_handle;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.stop(
+			g_cpas_intf->hw_intf->hw_priv, &cmd_hw_stop,
+			sizeof(struct cam_cpas_hw_cmd_stop));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in stop, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid stop ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_stop);
+
+int cam_cpas_start(uint32_t client_handle,
+	struct cam_ahb_vote *ahb_vote, struct cam_axi_vote *axi_vote)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!axi_vote) {
+		CAM_ERR(CAM_CPAS, "NULL axi vote");
+		return -EINVAL;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.start) {
+		struct cam_cpas_hw_cmd_start cmd_hw_start;
+
+		cmd_hw_start.client_handle = client_handle;
+		cmd_hw_start.ahb_vote = ahb_vote;
+		cmd_hw_start.axi_vote = axi_vote;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.start(
+			g_cpas_intf->hw_intf->hw_priv, &cmd_hw_start,
+			sizeof(struct cam_cpas_hw_cmd_start));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in start, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid start ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_start);
+
+void cam_cpas_log_votes(bool ddr_only)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_LOG_VOTE, &ddr_only,
+			sizeof(ddr_only));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+	}
+
+}
+EXPORT_SYMBOL(cam_cpas_log_votes);
+
+int cam_cpas_select_qos_settings(uint32_t selection_mask)
+{
+	int rc = 0;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -EBADR;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_SELECT_QOS, &selection_mask,
+			sizeof(selection_mask));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EBADR;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_select_qos_settings);
+
+int cam_cpas_enable_tpg_mux_sel(uint32_t tpg_mux_sel)
+{
+	int rc = 0;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -EBADR;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_TPG_MUX_SEL, &tpg_mux_sel,
+			sizeof(tpg_mux_sel));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EBADR;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_enable_tpg_mux_sel);
+
+int cam_cpas_notify_event(const char *identifier_string,
+	int32_t identifier_value)
+{
+	int rc = 0;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -EBADR;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_notify_event event = { 0 };
+
+		event.identifier_string = identifier_string;
+		event.identifier_value = identifier_value;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_LOG_EVENT, &event,
+			sizeof(event));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EBADR;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_notify_event);
+
+int cam_cpas_unregister_client(uint32_t client_handle)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_UNREGISTER_CLIENT,
+			&client_handle, sizeof(uint32_t));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_unregister_client);
+
+int cam_cpas_register_client(
+	struct cam_cpas_register_params *register_params)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_REGISTER_CLIENT, register_params,
+			sizeof(struct cam_cpas_register_params));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_register_client);
+
+int cam_cpas_get_scid(
+	enum cam_sys_cache_config_types type)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_GET_SCID, &type,
+			sizeof(type));
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_get_scid);
+
+int cam_cpas_prepare_subpart_info(enum cam_subparts_index idx, uint32_t num_subpart_available,
+	uint32_t num_subpart_functional)
+{
+	struct cam_hw_info *cpas_hw = NULL;
+	struct cam_cpas_private_soc *soc_private = NULL;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+	cpas_hw = (struct cam_hw_info *) g_cpas_intf->hw_intf->hw_priv;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	soc_private = (struct cam_cpas_private_soc *)cpas_hw->soc_info.soc_private;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_CPAS, "Invalid soc_private: 0x%x", soc_private);
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return -EINVAL;
+	}
+
+	switch (idx) {
+	case CAM_IFE_HW_IDX:
+		soc_private->sysfs_info.num_ifes[CAM_CPAS_AVAILABLE_NUM_SUBPARTS] =
+			num_subpart_available;
+		soc_private->sysfs_info.num_ifes[CAM_CPAS_FUNCTIONAL_NUM_SUBPARTS] =
+			num_subpart_functional;
+		break;
+	case CAM_IFE_LITE_HW_IDX:
+		soc_private->sysfs_info.num_ife_lites[CAM_CPAS_AVAILABLE_NUM_SUBPARTS] =
+			num_subpart_available;
+		soc_private->sysfs_info.num_ife_lites[CAM_CPAS_FUNCTIONAL_NUM_SUBPARTS] =
+			num_subpart_functional;
+		break;
+	case CAM_SFE_HW_IDX:
+		soc_private->sysfs_info.num_sfes[CAM_CPAS_AVAILABLE_NUM_SUBPARTS] =
+			num_subpart_available;
+		soc_private->sysfs_info.num_sfes[CAM_CPAS_FUNCTIONAL_NUM_SUBPARTS] =
+			num_subpart_functional;
+		break;
+	case CAM_CUSTOM_HW_IDX:
+		soc_private->sysfs_info.num_custom[CAM_CPAS_AVAILABLE_NUM_SUBPARTS] =
+			num_subpart_available;
+		soc_private->sysfs_info.num_custom[CAM_CPAS_FUNCTIONAL_NUM_SUBPARTS] =
+			num_subpart_functional;
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Invalid camera subpart index : %d", idx);
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return -EINVAL;
+	}
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return 0;
+}
+EXPORT_SYMBOL(cam_cpas_prepare_subpart_info);
+
+int cam_cpas_activate_llcc(
+	enum cam_sys_cache_config_types type)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_ACTIVATE_LLC, &type,
+			sizeof(type));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_activate_llcc);
+
+int cam_cpas_deactivate_llcc(
+	enum cam_sys_cache_config_types type)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_DEACTIVATE_LLC, &type,
+			sizeof(type));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_deactivate_llcc);
+
+int cam_cpas_configure_staling_llcc(
+	enum cam_sys_cache_config_types type,
+	enum cam_sys_cache_llcc_staling_mode mode_param,
+	enum cam_sys_cache_llcc_staling_op_type operation_type,
+	uint32_t staling_distance)
+{
+	int rc;
+	struct cam_sys_cache_local_info sys_cache_info;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+	if (!cam_cpas_is_notif_staling_supported())
+		return -EOPNOTSUPP;
+
+	sys_cache_info.mode = mode_param;
+	sys_cache_info.op_type = operation_type;
+	sys_cache_info.staling_distance
+		= staling_distance;
+	sys_cache_info.type = type;
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_CONFIGURE_STALING_LLC, &sys_cache_info,
+			sizeof(struct cam_sys_cache_local_info));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_configure_staling_llcc);
+
+int cam_cpas_notif_increment_staling_counter(
+	enum cam_sys_cache_config_types type)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+	if (!cam_cpas_is_notif_staling_supported())
+		return -EOPNOTSUPP;
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_NOTIF_STALL_INC_LLC, &type,
+			sizeof(type));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_notif_increment_staling_counter);
+
+bool cam_cpas_is_notif_staling_supported(void)
+{
+	#if IS_ENABLED(CONFIG_SPECTRA_LLCC_STALING)
+		return true;
+	#else
+		return false;
+	#endif
+}
+EXPORT_SYMBOL(cam_cpas_is_notif_staling_supported);
+
+bool cam_cpas_query_domain_id_security_support(void)
+{
+	struct cam_hw_info *cpas_hw = NULL;
+	struct cam_cpas_private_soc *soc_private = NULL;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return false;
+	}
+
+	cpas_hw = (struct cam_hw_info *) g_cpas_intf->hw_intf->hw_priv;
+	soc_private =
+		(struct cam_cpas_private_soc *)cpas_hw->soc_info.soc_private;
+
+	return soc_private->domain_id_info.domain_id_supported;
+}
+EXPORT_SYMBOL(cam_cpas_query_domain_id_security_support);
+
+int cam_cpas_enable_clks_for_domain_id(bool enable)
+{
+	int rc = 0;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_ENABLE_DISABLE_DOMAIN_ID_CLK, &enable,
+			sizeof(enable));
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_enable_clks_for_domain_id);
+
+int cam_cpas_dump_state_monitor_info(struct cam_req_mgr_dump_info *info)
+{
+	int rc = 0;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_DUMP_STATE_MONITOR_INFO, info,
+			sizeof(*info));
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_dump_state_monitor_info);
+
+#ifdef CONFIG_DYNAMIC_FD_PORT_CONFIG
+static int cam_cpas_handle_fd_port_config(uint32_t is_secure)
+{
+	int rc = 0;
+	struct Object client_env, sc_object;
+	struct cam_hw_info *cpas_hw = NULL;
+	struct cam_cpas *cpas_core;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *) g_cpas_intf->hw_intf->hw_priv;
+	if (cpas_hw) {
+		cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+		mutex_lock(&cpas_hw->hw_mutex);
+		if (cpas_core->streamon_clients > 0) {
+			CAM_ERR(CAM_CPAS,
+				"FD port config can not be updated during the session");
+			mutex_unlock(&cpas_hw->hw_mutex);
+			return -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_CPAS, "cpas_hw handle not initialized");
+		return -EINVAL;
+	}
+
+	/* Need to vote first before enabling clocks */
+	rc = cam_cpas_util_vote_default_ahb_axi(cpas_hw, true);
+	if (rc) {
+		CAM_ERR(CAM_CPAS,
+			"failed to vote for the default ahb/axi clock, rc=%d", rc);
+		goto release_mutex;
+	}
+
+	rc = cam_cpas_soc_enable_resources(&cpas_hw->soc_info,
+		cpas_hw->soc_info.lowest_clk_level);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in soc_enable_resources, rc=%d", rc);
+		goto remove_default_vote;
+	}
+
+	rc = get_client_env_object(&client_env);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed getting mink env object, rc: %d", rc);
+		goto disable_resources;
+	}
+
+	rc = IClientEnv_open(client_env, CTrustedCameraDriver_UID, &sc_object);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed getting mink sc_object, rc: %d", rc);
+		goto client_release;
+	}
+
+	rc = ITrustedCameraDriver_dynamicConfigureFDPort(sc_object, is_secure);
+	if (rc) {
+		if (rc == CAM_CPAS_ERROR_NOT_ALLOWED) {
+			CAM_ERR(CAM_CPAS, "Dynamic FD port config not allowed");
+			rc = -EPERM;
+		} else {
+			CAM_ERR(CAM_CPAS, "Mink secure call failed, rc: %d", rc);
+			rc = -EINVAL;
+		}
+		goto obj_release;
+	}
+
+	rc = Object_release(sc_object);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY, "Failed releasing secure camera object, rc: %d", rc);
+		goto client_release;
+	}
+
+	rc = Object_release(client_env);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY, "Failed releasing mink env object, rc: %d", rc);
+		goto disable_resources;
+	}
+
+	rc = cam_cpas_soc_disable_resources(&cpas_hw->soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in soc_disable_resources, rc=%d", rc);
+		goto remove_default_vote;
+	}
+
+	rc = cam_cpas_util_vote_default_ahb_axi(cpas_hw, false);
+	if (rc)
+		CAM_ERR(CAM_CPAS,
+			"failed remove the vote on ahb/axi clock, rc=%d", rc);
+
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+
+obj_release:
+	Object_release(sc_object);
+client_release:
+	Object_release(client_env);
+disable_resources:
+	cam_cpas_soc_disable_resources(&cpas_hw->soc_info, true, true);
+remove_default_vote:
+	cam_cpas_util_vote_default_ahb_axi(cpas_hw, false);
+release_mutex:
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+#endif
+
+static int cam_cpas_handle_custom_config_cmd(struct cam_cpas_intf *cpas_intf,
+	struct cam_custom_cmd *cmd)
+{
+	int32_t rc = 0;
+
+	if (!cmd) {
+		CAM_ERR(CAM_CPAS, "Invalid input cmd");
+		return -EINVAL;
+	}
+
+	switch (cmd->cmd_type) {
+#ifdef CONFIG_DYNAMIC_FD_PORT_CONFIG
+	case CAM_CPAS_CUSTOM_CMD_FD_PORT_CFG: {
+		struct cam_cpas_fd_port_config cfg;
+
+		if (cmd->size < sizeof(cfg))
+			return -EINVAL;
+
+		rc = copy_from_user(&cfg, u64_to_user_ptr(cmd->handle),
+			sizeof(cfg));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in copy from user, rc=%d",
+				rc);
+			rc = -EINVAL;
+			break;
+		}
+
+		rc = cam_cpas_handle_fd_port_config(cfg.is_secure);
+		break;
+	}
+#endif
+	default:
+		CAM_ERR(CAM_CPAS, "Invalid custom command %d for CPAS", cmd->cmd_type);
+		rc = -EINVAL;
+		break;
+
+	}
+
+	return rc;
+}
+
+int cam_cpas_subdev_cmd(struct cam_cpas_intf *cpas_intf,
+	struct cam_control *cmd)
+{
+	int rc = 0;
+	uint32_t *camera_capability, num_cap_mask;
+
+	if (!cmd) {
+		CAM_ERR(CAM_CPAS, "Invalid input cmd");
+		return -EINVAL;
+	}
+
+	switch (cmd->op_code) {
+	case CAM_QUERY_CAP: {
+		struct cam_cpas_query_cap query;
+
+		rc = copy_from_user(&query, u64_to_user_ptr(cmd->handle),
+			sizeof(query));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in copy from user, rc=%d",
+				rc);
+			break;
+		}
+
+		rc = cam_cpas_get_hw_info(&query.camera_family,
+			&query.camera_version, &query.cpas_version,
+			&camera_capability, &num_cap_mask, NULL, NULL);
+		if (rc)
+			break;
+
+		query.reserved = camera_capability[0];
+
+		rc = copy_to_user(u64_to_user_ptr(cmd->handle), &query,
+			sizeof(query));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in copy to user, rc=%d", rc);
+
+		break;
+	}
+	case CAM_QUERY_CAP_V2: {
+		struct cam_cpas_query_cap_v2 query;
+
+		rc = copy_from_user(&query, u64_to_user_ptr(cmd->handle),
+			sizeof(query));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in copy from user, rc=%d",
+				rc);
+			break;
+		}
+
+		rc = cam_cpas_get_hw_info(&query.camera_family,
+			&query.camera_version, &query.cpas_version,
+			&camera_capability, &num_cap_mask,
+			&query.fuse_info, NULL);
+		if (rc)
+			break;
+
+		query.reserved = camera_capability[0];
+
+		rc = copy_to_user(u64_to_user_ptr(cmd->handle), &query,
+			sizeof(query));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in copy to user, rc=%d", rc);
+
+		break;
+	}
+	case CAM_QUERY_CAP_V3: {
+		struct cam_cpas_query_cap_v3 query;
+
+		rc = copy_from_user(&query, u64_to_user_ptr(cmd->handle),
+			sizeof(query));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in copy from user, rc=%d",
+				rc);
+			break;
+		}
+
+		rc = cam_cpas_get_hw_info(&query.camera_family,
+			&query.camera_version, &query.cpas_version,
+			&camera_capability, &num_cap_mask, &query.fuse_info,
+			&query.domain_id_info);
+		if (rc)
+			break;
+
+		query.camera_caps = camera_capability[0];
+
+		rc = copy_to_user(u64_to_user_ptr(cmd->handle), &query,
+			sizeof(query));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in copy to user, rc=%d", rc);
+
+		break;
+	}
+	case CAM_CUSTOM_DEV_CONFIG: {
+		struct cam_custom_cmd custom_cmd;
+
+		rc = copy_from_user(&custom_cmd, u64_to_user_ptr(cmd->handle),
+			sizeof(custom_cmd));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in copy from user, rc=%d",
+				rc);
+			break;
+		}
+		rc = cam_cpas_handle_custom_config_cmd(cpas_intf, &custom_cmd);
+		break;
+	}
+	case CAM_SD_SHUTDOWN:
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Unknown op code %d for CPAS", cmd->op_code);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_cpas_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_cpas_intf *cpas_intf = v4l2_get_subdevdata(sd);
+
+	if (!cpas_intf || !cpas_intf->probe_done) {
+		CAM_ERR(CAM_CPAS, "CPAS not initialized");
+		return -ENODEV;
+	}
+
+	mutex_lock(&cpas_intf->intf_lock);
+	cpas_intf->open_cnt++;
+	CAM_DBG(CAM_CPAS, "CPAS Subdev open count %d", cpas_intf->open_cnt);
+	mutex_unlock(&cpas_intf->intf_lock);
+
+	return 0;
+}
+
+static int __cam_cpas_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_cpas_intf *cpas_intf = v4l2_get_subdevdata(sd);
+
+	if (!cpas_intf || !cpas_intf->probe_done) {
+		CAM_ERR(CAM_CPAS, "CPAS not initialized");
+		return -ENODEV;
+	}
+
+	mutex_lock(&cpas_intf->intf_lock);
+	if (cpas_intf->open_cnt <= 0) {
+		CAM_WARN(CAM_CPAS, "device already closed, open_cnt: %d", cpas_intf->open_cnt);
+		mutex_unlock(&cpas_intf->intf_lock);
+		return 0;
+	}
+	cpas_intf->open_cnt--;
+	CAM_DBG(CAM_CPAS, "CPAS Subdev close count %d", cpas_intf->open_cnt);
+	mutex_unlock(&cpas_intf->intf_lock);
+
+	return 0;
+}
+
+static int cam_cpas_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_CPAS, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return __cam_cpas_subdev_close(sd, fh);
+}
+
+static long cam_cpas_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int32_t rc;
+	struct cam_cpas_intf *cpas_intf = v4l2_get_subdevdata(sd);
+
+	if (!cpas_intf || !cpas_intf->probe_done) {
+		CAM_ERR(CAM_CPAS, "CPAS not initialized");
+		return -ENODEV;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_cpas_subdev_cmd(cpas_intf, (struct cam_control *) arg);
+		break;
+	case CAM_SD_SHUTDOWN:
+		rc = __cam_cpas_subdev_close(sd, NULL);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_CPAS, "Invalid command %d for CPAS!", cmd);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_cpas_subdev_compat_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc;
+	struct cam_cpas_intf *cpas_intf = v4l2_get_subdevdata(sd);
+
+	if (!cpas_intf || !cpas_intf->probe_done) {
+		CAM_ERR(CAM_CPAS, "CPAS not initialized");
+		return -ENODEV;
+	}
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_CPAS, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_cpas_subdev_cmd(cpas_intf, &cmd_data);
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Invalid command %d for CPAS!", cmd);
+		rc = -EINVAL;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_CPAS,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+static struct v4l2_subdev_core_ops cpas_subdev_core_ops = {
+	.ioctl = cam_cpas_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_cpas_subdev_compat_ioctl,
+#endif
+};
+
+static const struct v4l2_subdev_ops cpas_subdev_ops = {
+	.core = &cpas_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cpas_subdev_intern_ops = {
+	.open = cam_cpas_subdev_open,
+	.close = cam_cpas_subdev_close,
+};
+
+static int cam_cpas_subdev_register(struct platform_device *pdev)
+{
+	int rc;
+	struct cam_subdev *subdev;
+
+	if (!g_cpas_intf)
+		return -EINVAL;
+
+	subdev = &g_cpas_intf->subdev;
+
+	subdev->name = CAM_CPAS_DEV_NAME;
+	subdev->pdev = pdev;
+	subdev->ops = &cpas_subdev_ops;
+	subdev->internal_ops = &cpas_subdev_intern_ops;
+	subdev->token = g_cpas_intf;
+	subdev->sd_flags =
+		V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+	subdev->ent_function = CAM_CPAS_DEVICE_TYPE;
+	subdev->close_seq_prior = CAM_SD_CLOSE_LOW_PRIORITY;
+
+	rc = cam_register_subdev(subdev);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed register subdev: %s!",
+			CAM_CPAS_DEV_NAME);
+		return rc;
+	}
+
+	platform_set_drvdata(g_cpas_intf->pdev, g_cpas_intf);
+	return rc;
+}
+
+static int cam_cpas_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_cpas_hw_caps *hw_caps;
+	struct cam_hw_intf *hw_intf;
+	int rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	if (g_cpas_intf) {
+		CAM_ERR(CAM_CPAS, "cpas component already binded");
+		return -EALREADY;
+	}
+
+	g_cpas_intf = kzalloc(sizeof(*g_cpas_intf), GFP_KERNEL);
+	if (!g_cpas_intf)
+		return -ENOMEM;
+
+	mutex_init(&g_cpas_intf->intf_lock);
+	g_cpas_intf->pdev = pdev;
+
+	rc = cam_cpas_hw_probe(pdev, &g_cpas_intf->hw_intf);
+	if (rc || (g_cpas_intf->hw_intf == NULL)) {
+		CAM_ERR(CAM_CPAS, "Failed in hw probe, rc=%d", rc);
+		goto error_destroy_mem;
+	}
+
+	hw_intf = g_cpas_intf->hw_intf;
+	hw_caps = &g_cpas_intf->hw_caps;
+
+	if (hw_intf->hw_ops.get_hw_caps) {
+		rc = hw_intf->hw_ops.get_hw_caps(hw_intf->hw_priv,
+			hw_caps, sizeof(struct cam_cpas_hw_caps));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in get_hw_caps, rc=%d", rc);
+			goto error_hw_remove;
+		}
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid get_hw_caps ops");
+		goto error_hw_remove;
+	}
+
+	rc = cam_cpas_subdev_register(pdev);
+	if (rc)
+		goto error_hw_remove;
+
+	g_cpas_intf->probe_done = true;
+	CAM_DBG(CAM_CPAS,
+		"Component bound successfully %d, %d.%d.%d, %d.%d.%d, 0x%x",
+		hw_caps->camera_family, hw_caps->camera_version.major,
+		hw_caps->camera_version.minor, hw_caps->camera_version.incr,
+		hw_caps->cpas_version.major, hw_caps->cpas_version.minor,
+		hw_caps->cpas_version.incr, hw_caps->camera_capability);
+
+	return rc;
+
+error_hw_remove:
+	cam_cpas_hw_remove(g_cpas_intf->hw_intf);
+error_destroy_mem:
+	mutex_destroy(&g_cpas_intf->intf_lock);
+	kfree(g_cpas_intf);
+	g_cpas_intf = NULL;
+	CAM_ERR(CAM_CPAS, "CPAS component bind failed");
+	return rc;
+}
+
+static void cam_cpas_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return;
+	}
+
+	mutex_lock(&g_cpas_intf->intf_lock);
+	g_cpas_intf->probe_done = false;
+	cam_unregister_subdev(&g_cpas_intf->subdev);
+	cam_cpas_hw_remove(g_cpas_intf->hw_intf);
+	mutex_unlock(&g_cpas_intf->intf_lock);
+	mutex_destroy(&g_cpas_intf->intf_lock);
+	kfree(g_cpas_intf);
+	g_cpas_intf = NULL;
+}
+
+const static struct component_ops cam_cpas_dev_component_ops = {
+	.bind = cam_cpas_dev_component_bind,
+	.unbind = cam_cpas_dev_component_unbind,
+};
+
+static int cam_cpas_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CPAS, "Adding CPAS INTF component");
+	rc = component_add(&pdev->dev, &cam_cpas_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_cpas_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_cpas_dev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_cpas_dt_match[] = {
+	{.compatible = "qcom,cam-cpas"},
+	{}
+};
+
+struct platform_driver cam_cpas_driver = {
+	.probe = cam_cpas_dev_probe,
+	.remove = cam_cpas_dev_remove,
+	.driver = {
+		.name = CAM_CPAS_DEV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_cpas_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_cpas_dev_init_module(void)
+{
+	return platform_driver_register(&cam_cpas_driver);
+}
+
+void cam_cpas_dev_exit_module(void)
+{
+	platform_driver_unregister(&cam_cpas_driver);
+}
+
+MODULE_DESCRIPTION("MSM CPAS driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_soc.c
@@ -0,0 +1,1905 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_cpas_api.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_hw.h"
+#include "cam_cpas_soc.h"
+#include "cam_compat.h"
+
+static uint cpas_dump;
+module_param(cpas_dump, uint, 0644);
+
+#define CAM_ICP_CLK_NAME "cam_icp_clk"
+
+void cam_cpas_dump_tree_vote_info(struct cam_hw_info *cpas_hw,
+	const struct cam_cpas_tree_node *tree_node,
+	const char *identifier, int ddr_drv_idx, int cesta_drv_idx)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+
+	if ((cpas_dump & BIT(0)) == 0)
+		return;
+
+	if (cesta_drv_idx > CAM_CPAS_PORT_HLOS_DRV)
+		CAM_INFO(CAM_PERF,
+			"%s node:%s lvl:%d cesta_drv_idx:%d DRV BW camnoc[%llu %llu]",
+			identifier, tree_node->node_name, tree_node->level_idx, cesta_drv_idx,
+			tree_node->bw_info[cesta_drv_idx].drv_vote.high.camnoc,
+			tree_node->bw_info[cesta_drv_idx].drv_vote.low.camnoc);
+	else
+		CAM_INFO(CAM_PERF,
+			"%s node:%s lvl:%d cesta_drv_idx:%d HLOS BW camnoc[%llu]",
+			identifier, tree_node->node_name, tree_node->level_idx, cesta_drv_idx,
+			tree_node->bw_info[cesta_drv_idx].hlos_vote.camnoc);
+
+	if (ddr_drv_idx > CAM_CPAS_PORT_HLOS_DRV)
+		CAM_INFO(CAM_PERF,
+			"%s node:%s lvl:%d ddr_drv_idx:%d DRV BW ab[%llu %llu] ib[%llu %llu]",
+			identifier, tree_node->node_name, tree_node->level_idx, ddr_drv_idx,
+			tree_node->bw_info[ddr_drv_idx].drv_vote.high.ab,
+			tree_node->bw_info[ddr_drv_idx].drv_vote.low.ab,
+			tree_node->bw_info[ddr_drv_idx].drv_vote.high.ib,
+			tree_node->bw_info[ddr_drv_idx].drv_vote.low.ib);
+	else
+		CAM_INFO(CAM_PERF,
+			"%s node:%s lvl:%d ddr_drv_idx:%d HLOS BW ab[%llu] ib[%llu]",
+			identifier, tree_node->node_name, tree_node->level_idx, ddr_drv_idx,
+			tree_node->bw_info[ddr_drv_idx].hlos_vote.ab,
+			tree_node->bw_info[ddr_drv_idx].hlos_vote.ib);
+
+	if (soc_private->enable_cam_ddr_drv) {
+		int i;
+
+		CAM_INFO(CAM_PERF,
+			"%s node:%s lvl:%d drv_idx:%d cesta_drv_idx:%d ==== printing full node state",
+			identifier, tree_node->node_name, tree_node->level_idx,
+			ddr_drv_idx, cesta_drv_idx);
+
+		for (i = 0; i < CAM_CPAS_MAX_DRV_PORTS; i++) {
+
+			if (i == CAM_CPAS_PORT_HLOS_DRV)
+				CAM_INFO(CAM_PERF,
+					"idx[%d] HLOS camnoc[%llu], DDR ab[%llu] ib[%llu]",
+					i,
+					tree_node->bw_info[i].hlos_vote.camnoc,
+					tree_node->bw_info[i].hlos_vote.ab,
+					tree_node->bw_info[i].hlos_vote.ib);
+			else
+				CAM_INFO(CAM_PERF,
+					"idx[%d] DRV camnoc[%llu %llu], DDR ab[%llu %llu] ib[%llu %llu]",
+					i,
+					tree_node->bw_info[i].drv_vote.high.camnoc,
+					tree_node->bw_info[i].drv_vote.low.camnoc,
+					tree_node->bw_info[i].drv_vote.high.ab,
+					tree_node->bw_info[i].drv_vote.low.ab,
+					tree_node->bw_info[i].drv_vote.high.ib,
+					tree_node->bw_info[i].drv_vote.low.ib);
+		}
+	}
+
+}
+
+void cam_cpas_dump_full_tree_state(struct cam_hw_info *cpas_hw, const char *identifier)
+{
+	int j;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas_tree_node *curr_node;
+
+	if ((cpas_dump & BIT(1)) == 0)
+		return;
+
+	CAM_INFO(CAM_CPAS, "Dumping cpas tree full state start ============== %s", identifier);
+
+	/* This will traverse through all nodes in the tree and print stats*/
+	for (j = 0; j < CAM_CPAS_MAX_TREE_NODES; j++) {
+		if (!soc_private->tree_node[j])
+			continue;
+
+		curr_node = soc_private->tree_node[j];
+
+		if (soc_private->enable_cam_ddr_drv) {
+			int i;
+
+			CAM_INFO(CAM_PERF,
+				"Identifier[%s] node:[%s] cell:%d lvl:%d PortIdx mnoc[%d %d %d %d] camnoc[%d] camnoc_max %d, bus_width:%d, drv_idx:%d",
+				identifier, curr_node->node_name, curr_node->cell_idx,
+				curr_node->level_idx,
+				curr_node->axi_port_idx_arr[CAM_CPAS_PORT_HLOS_DRV],
+				curr_node->axi_port_idx_arr[CAM_CPAS_PORT_DRV_0],
+				curr_node->axi_port_idx_arr[CAM_CPAS_PORT_DRV_1],
+				curr_node->axi_port_idx_arr[CAM_CPAS_PORT_DRV_2],
+				curr_node->camnoc_axi_port_idx,
+				curr_node->camnoc_max_needed,
+				curr_node->bus_width_factor,
+				curr_node->drv_voting_idx);
+
+			for (i = 0; i < CAM_CPAS_MAX_DRV_PORTS; i++) {
+				if (i == CAM_CPAS_PORT_HLOS_DRV)
+					CAM_INFO(CAM_PERF,
+						"    idx[%d] HLOS camnoc[%llu], DDR ab[%llu] ib[%llu]",
+						i,
+						curr_node->bw_info[i].hlos_vote.camnoc,
+						curr_node->bw_info[i].hlos_vote.ab,
+						curr_node->bw_info[i].hlos_vote.ib);
+				else
+					CAM_INFO(CAM_PERF,
+						"    idx[%d] DRV camnoc[%llu %llu], DDR ab[%llu %llu] ib[%llu %llu]",
+						i,
+						curr_node->bw_info[i].drv_vote.high.camnoc,
+						curr_node->bw_info[i].drv_vote.low.camnoc,
+						curr_node->bw_info[i].drv_vote.high.ab,
+						curr_node->bw_info[i].drv_vote.low.ab,
+						curr_node->bw_info[i].drv_vote.high.ib,
+						curr_node->bw_info[i].drv_vote.low.ib);
+			}
+		} else {
+			CAM_INFO(CAM_CPAS,
+				"[%s] Cell[%d] level[%d] PortIdx[%d][%d] camnoc_bw[%d %d %lld %lld] mnoc_bw[%lld %lld]",
+				curr_node->node_name, curr_node->cell_idx,
+				curr_node->level_idx,
+				curr_node->axi_port_idx_arr[CAM_CPAS_PORT_HLOS_DRV],
+				curr_node->camnoc_axi_port_idx,
+				curr_node->camnoc_max_needed,
+				curr_node->bus_width_factor,
+				curr_node->bw_info[CAM_CPAS_PORT_HLOS_DRV].hlos_vote.camnoc,
+				curr_node->bw_info[CAM_CPAS_PORT_HLOS_DRV].hlos_vote.camnoc *
+				curr_node->bus_width_factor,
+				curr_node->bw_info[CAM_CPAS_PORT_HLOS_DRV].hlos_vote.ab,
+				curr_node->bw_info[CAM_CPAS_PORT_HLOS_DRV].hlos_vote.ib);
+		}
+	}
+
+	CAM_INFO(CAM_CPAS, "Dumping cpas tree full state end ============== %s", identifier);
+}
+
+void cam_cpas_dump_axi_vote_info(
+	const struct cam_cpas_client *cpas_client,
+	const char *identifier,
+	struct cam_axi_vote *axi_vote)
+{
+	int i;
+
+	if ((cpas_dump & BIT(0)) == 0)
+		return;
+
+	if (!axi_vote || (axi_vote->num_paths >
+		CAM_CPAS_MAX_PATHS_PER_CLIENT)) {
+		CAM_ERR(CAM_PERF, "Invalid num_paths %d",
+			axi_vote ? axi_vote->num_paths : -1);
+		return;
+	}
+
+	for (i = 0; i < axi_vote->num_paths; i++) {
+		CAM_INFO(CAM_PERF,
+		"Client [%s][%d] : [%s], Path=[%d] [%d], [%s], camnoc[%llu], mnoc_ab[%llu], mnoc_ib[%llu]",
+		cpas_client->data.identifier, cpas_client->data.cell_index,
+		identifier,
+		axi_vote->axi_path[i].path_data_type,
+		axi_vote->axi_path[i].transac_type,
+		cam_cpas_axi_util_drv_vote_lvl_to_string(axi_vote->axi_path[i].vote_level),
+		axi_vote->axi_path[i].camnoc_bw,
+		axi_vote->axi_path[i].mnoc_ab_bw,
+		axi_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+}
+
+void cam_cpas_util_debug_parse_data(
+	struct cam_cpas_private_soc *soc_private)
+{
+	int i, j;
+	struct cam_cpas_tree_node *curr_node = NULL;
+
+	if ((cpas_dump & BIT(0)) == 0)
+		return;
+
+	for (i = 0; i < CAM_CPAS_MAX_TREE_NODES; i++) {
+		if (!soc_private->tree_node[i])
+			break;
+
+		curr_node = soc_private->tree_node[i];
+		CAM_INFO(CAM_CPAS,
+			"NODE cell_idx: %d, level: %d, name: %s, axi_port_idx: %d, merge_type: %d, parent_name: %s camnoc_max_needed: %d",
+			curr_node->cell_idx, curr_node->level_idx,
+			curr_node->node_name, curr_node->axi_port_idx_arr[CAM_CPAS_PORT_HLOS_DRV],
+			curr_node->merge_type, curr_node->parent_node ?
+			curr_node->parent_node->node_name : "no parent",
+			curr_node->camnoc_max_needed);
+
+		if (curr_node->level_idx)
+			continue;
+
+		CAM_INFO(CAM_CPAS, "path_type: %d, transac_type: %s drv_voting_idx:%d",
+			curr_node->path_data_type,
+			cam_cpas_axi_util_trans_type_to_string(
+			curr_node->path_trans_type), curr_node->drv_voting_idx);
+
+		for (j = 0; j < CAM_CPAS_PATH_DATA_MAX; j++) {
+			if (curr_node->constituent_paths[j])
+				CAM_INFO(CAM_CPAS, "Constituent path: %d", j);
+		}
+	}
+
+	CAM_INFO(CAM_CPAS, "NUMBER OF NODES PARSED: %d", i);
+}
+
+int cam_cpas_node_tree_cleanup(struct cam_cpas *cpas_core,
+	struct cam_cpas_private_soc *soc_private)
+{
+	int i = 0;
+
+	for (i = 0; i < CAM_CPAS_MAX_TREE_NODES; i++) {
+		if (soc_private->tree_node[i]) {
+			kfree(soc_private->tree_node[i]->bw_info);
+			kfree(soc_private->tree_node[i]->axi_port_idx_arr);
+			soc_private->tree_node[i]->bw_info = NULL;
+			soc_private->tree_node[i]->axi_port_idx_arr = NULL;
+			of_node_put(soc_private->tree_node[i]->tree_dev_node);
+			kfree(soc_private->tree_node[i]);
+			soc_private->tree_node[i] = NULL;
+		}
+	}
+
+	for (i = 0; i < CAM_CPAS_MAX_TREE_LEVELS; i++) {
+		if (soc_private->level_node[i]) {
+			of_node_put(soc_private->level_node[i]);
+			soc_private->level_node[i] = NULL;
+		}
+	}
+
+	if (soc_private->camera_bus_node) {
+		of_node_put(soc_private->camera_bus_node);
+		soc_private->camera_bus_node = NULL;
+	}
+
+	mutex_destroy(&cpas_core->tree_lock);
+
+	return 0;
+}
+
+static int cam_cpas_util_path_type_to_idx(uint32_t *path_data_type)
+{
+	if (*path_data_type >= CAM_CPAS_PATH_DATA_CONSO_OFFSET) {
+		*path_data_type = CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT +
+			(*path_data_type % CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT);
+	}
+	else {
+		*path_data_type %= CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT;
+	}
+
+	if (*path_data_type >= CAM_CPAS_PATH_DATA_MAX) {
+		CAM_ERR(CAM_CPAS, "index Invalid: %u", *path_data_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_cpas_update_camnoc_node(struct cam_cpas *cpas_core,
+	struct device_node *curr_node,
+	struct cam_cpas_tree_node *cpas_node_ptr,
+	int *camnoc_idx)
+
+{
+	struct device_node *camnoc_node;
+	int rc;
+
+	camnoc_node = of_find_node_by_name(curr_node,
+			"qcom,axi-port-camnoc");
+	if (camnoc_node) {
+
+		if (*camnoc_idx >=
+			CAM_CPAS_MAX_AXI_PORTS) {
+			CAM_ERR(CAM_CPAS, "CAMNOC axi index overshoot %d",
+				*camnoc_idx);
+			return -EINVAL;
+		}
+
+		cpas_core->camnoc_axi_port[*camnoc_idx]
+			.axi_port_node = camnoc_node;
+		rc = of_property_read_string(
+			curr_node,
+			"qcom,axi-port-name",
+			&cpas_core->camnoc_axi_port[*camnoc_idx]
+			.axi_port_name);
+
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"fail to read camnoc-port-name rc=%d",
+				rc);
+			return rc;
+		}
+		cpas_node_ptr->camnoc_axi_port_idx = *camnoc_idx;
+		cpas_core->num_camnoc_axi_ports++;
+		(*camnoc_idx)++;
+	}
+	return 0;
+}
+
+static int cam_cpas_parse_mnoc_node(struct cam_cpas *cpas_core,
+	struct cam_cpas_private_soc *soc_private, struct cam_cpas_tree_node *curr_node_ptr,
+	struct device_node *mnoc_node, int *mnoc_idx)
+{
+	int rc = 0, count, i;
+	bool ib_voting_needed = false, is_rt_port = false;
+	struct of_phandle_args src_args = {0}, dst_args = {0};
+	struct cam_cpas_axi_port *curr_axi_port;
+
+	ib_voting_needed = of_property_read_bool(curr_node_ptr->tree_dev_node,
+		"ib-bw-voting-needed");
+	is_rt_port = of_property_read_bool(curr_node_ptr->tree_dev_node, "rt-axi-port");
+
+	if (soc_private->bus_icc_based) {
+		if (soc_private->use_cam_icc_path_str)
+			count = of_property_count_strings(mnoc_node, "cam-icc-path-names");
+		else
+			count = of_property_count_strings(mnoc_node, "interconnect-names");
+
+		if (count <= 0) {
+			CAM_ERR(CAM_ISP, "Missing icc info for camera bus nodes count: %d", count);
+			return -EINVAL;
+		} else if (count > CAM_CPAS_MAX_DRV_PORTS) {
+			CAM_ERR(CAM_CPAS, "Number of interconnects %d greater than max ports %d",
+				count, CAM_CPAS_MAX_DRV_PORTS);
+			return -EINVAL;
+		}
+
+		for (i = 0; i < count; i++) {
+			if ((i > 0) && !soc_private->enable_cam_ddr_drv)
+				break;
+
+			if (*mnoc_idx >= CAM_CPAS_MAX_AXI_PORTS) {
+				CAM_ERR(CAM_CPAS, "Invalid mnoc index: %d", *mnoc_idx);
+				return -EINVAL;
+			}
+
+			curr_axi_port =  &cpas_core->axi_port[*mnoc_idx];
+			curr_axi_port->axi_port_node = mnoc_node;
+
+			if (soc_private->use_cam_icc_path_str) {
+				rc = of_property_read_string_index(mnoc_node, "cam-icc-path-names",
+					i, &curr_axi_port->bus_client.common_data.name);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+						"failed to read cam icc name strings mnoc_node: %s i: %d rc=%d",
+						curr_node_ptr->node_name, i, rc);
+					return rc;
+				}
+			} else {
+				rc = of_property_read_string_index(mnoc_node,
+					"interconnect-names", i,
+					&curr_axi_port->bus_client.common_data.name);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "failed to read interconnect-names rc=%d",
+						rc);
+					return rc;
+				}
+
+				rc = of_parse_phandle_with_args(mnoc_node, "interconnects",
+					"#interconnect-cells", (2 * i), &src_args);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+						"failed to read axi bus src info rc=%d",
+						rc);
+					return -EINVAL;
+				}
+
+				of_node_put(src_args.np);
+				if (src_args.args_count != 1) {
+					CAM_ERR(CAM_CPAS, "Invalid number of axi src args: %d",
+						src_args.args_count);
+					return -EINVAL;
+				}
+
+				curr_axi_port->bus_client.common_data.src_id = src_args.args[0];
+
+				rc = of_parse_phandle_with_args(mnoc_node, "interconnects",
+					"#interconnect-cells", ((2 * i) + 1), &dst_args);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "failed to read axi bus dst info rc=%d",
+						rc);
+					return -EINVAL;
+				}
+
+				of_node_put(dst_args.np);
+				if (dst_args.args_count != 1) {
+					CAM_ERR(CAM_CPAS, "Invalid number of axi dst args: %d",
+						dst_args.args_count);
+					return -EINVAL;
+				}
+
+				curr_axi_port->bus_client.common_data.dst_id = dst_args.args[0];
+			}
+
+			curr_axi_port->bus_client.common_data.num_usecases = 2;
+			curr_axi_port->axi_port_name = curr_axi_port->bus_client.common_data.name;
+			curr_axi_port->drv_idx = i;
+
+			if (i > CAM_CPAS_PORT_HLOS_DRV) {
+				curr_axi_port->bus_client.common_data.is_drv_port = true;
+				curr_axi_port->curr_bw.vote_type = CAM_CPAS_VOTE_TYPE_DRV;
+				curr_axi_port->applied_bw.vote_type = CAM_CPAS_VOTE_TYPE_DRV;
+				curr_axi_port->cam_rsc_dev =
+					cam_cpas_get_rsc_dev_for_drv(i - CAM_CPAS_PORT_DRV_0);
+				if (!curr_axi_port->cam_rsc_dev) {
+					CAM_ERR(CAM_CPAS,
+						"Port[%s][%d] Failed to get rsc device drv_idx:%d",
+						curr_axi_port->axi_port_name, *mnoc_idx, i);
+					rc = -ENODEV;
+					goto err;
+				}
+			}
+
+			/*
+			 * The indexes of axi_port_idx_arr map to drv_voting_idx,
+			 * with 0 pointing to hlos drv bus ID
+			 */
+			curr_node_ptr->axi_port_idx_arr[i] = *mnoc_idx;
+			curr_axi_port->ib_bw_voting_needed = ib_voting_needed;
+			curr_axi_port->is_rt = is_rt_port;
+			CAM_DBG(CAM_PERF, "Adding Bus Client=[%s] : src=%d, dst=%d mnoc_idx:%d",
+				curr_axi_port->bus_client.common_data.name,
+				curr_axi_port->bus_client.common_data.src_id,
+				curr_axi_port->bus_client.common_data.dst_id,
+				*mnoc_idx);
+			(*mnoc_idx)++;
+			cpas_core->num_axi_ports++;
+		}
+	} else {
+		if (soc_private->enable_cam_ddr_drv) {
+			CAM_ERR(CAM_CPAS, "DRV not supported for old bus scaling clients");
+			return -EPERM;
+		}
+
+		if (*mnoc_idx >= CAM_CPAS_MAX_AXI_PORTS) {
+			CAM_ERR(CAM_CPAS, "Invalid mnoc index: %d", *mnoc_idx);
+			return -EINVAL;
+		}
+
+		curr_axi_port =  &cpas_core->axi_port[*mnoc_idx];
+		curr_axi_port->axi_port_node = mnoc_node;
+		rc =  of_property_read_string(curr_node_ptr->tree_dev_node, "qcom,axi-port-name",
+			&curr_axi_port->bus_client.common_data.name);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"failed to read mnoc-port-name rc=%d",
+				rc);
+			return rc;
+		}
+
+		curr_axi_port->axi_port_name =
+			curr_axi_port->bus_client.common_data.name;
+		curr_node_ptr->axi_port_idx_arr[0] = *mnoc_idx;
+		curr_axi_port->ib_bw_voting_needed = ib_voting_needed;
+		curr_axi_port->is_rt = is_rt_port;
+		(*mnoc_idx)++;
+		cpas_core->num_axi_ports++;
+	}
+
+err:
+	return rc;
+}
+
+static int cam_cpas_parse_node_tree(struct cam_cpas *cpas_core,
+	struct device_node *of_node, struct cam_cpas_private_soc *soc_private)
+{
+	struct device_node *camera_bus_node;
+	struct device_node *level_node;
+	struct device_node *curr_node;
+	struct device_node *parent_node;
+	struct device_node *mnoc_node;
+	int mnoc_idx = 0, camnoc_idx = 0, level_idx = 0;
+	uint32_t path_idx;
+	bool camnoc_max_needed = false;
+	struct cam_cpas_tree_node *curr_node_ptr = NULL;
+	struct cam_cpas_client *curr_client = NULL;
+	const char *client_name = NULL;
+	uint32_t client_idx = 0, cell_idx = 0;
+	uint8_t niu_idx = 0;
+	int rc = 0, count = 0, i, j, num_drv_ports;
+
+	camera_bus_node = of_get_child_by_name(of_node, "camera-bus-nodes");
+	if (!camera_bus_node) {
+		CAM_ERR(CAM_CPAS, "Camera Bus node not found in cpas DT node");
+		return -EINVAL;
+	}
+
+	soc_private->camera_bus_node = camera_bus_node;
+
+	for_each_available_child_of_node(camera_bus_node, level_node) {
+		rc = of_property_read_u32(level_node, "level-index", &level_idx);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Error reading level idx rc: %d", rc);
+			return rc;
+		}
+		if (level_idx >= CAM_CPAS_MAX_TREE_LEVELS) {
+			CAM_ERR(CAM_CPAS, "Invalid level idx: %d", level_idx);
+			return -EINVAL;
+		}
+
+		soc_private->level_node[level_idx] = level_node;
+	}
+
+	if (soc_private->enable_smart_qos)
+		soc_private->smart_qos_info->num_rt_wr_nius = 0;
+
+	if (soc_private->enable_cam_ddr_drv)
+		num_drv_ports = CAM_CPAS_MAX_DRV_PORTS;
+	else
+		num_drv_ports = 1;
+
+	for (level_idx = (CAM_CPAS_MAX_TREE_LEVELS - 1); level_idx >= 0;
+		level_idx--) {
+		level_node = soc_private->level_node[level_idx];
+		if (!level_node)
+			continue;
+
+		CAM_DBG(CAM_CPAS, "Parsing level %d nodes", level_idx);
+
+		camnoc_max_needed = of_property_read_bool(level_node, "camnoc-max-needed");
+		for_each_available_child_of_node(level_node, curr_node) {
+			curr_node_ptr = kzalloc(sizeof(struct cam_cpas_tree_node), GFP_KERNEL);
+			if (!curr_node_ptr)
+				return -ENOMEM;
+
+			curr_node_ptr->tree_dev_node = curr_node;
+			rc = of_property_read_u32(curr_node, "cell-index",
+				&curr_node_ptr->cell_idx);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "Node index not found");
+				return rc;
+			}
+
+			CAM_DBG(CAM_CPAS, "Parsing Node with cell index %d",
+					curr_node_ptr->cell_idx);
+
+			if (curr_node_ptr->cell_idx >=
+				CAM_CPAS_MAX_TREE_NODES) {
+				CAM_ERR(CAM_CPAS, "Invalid cell idx: %d", curr_node_ptr->cell_idx);
+				return -EINVAL;
+			}
+
+			soc_private->tree_node[curr_node_ptr->cell_idx] = curr_node_ptr;
+			curr_node_ptr->level_idx = level_idx;
+
+			rc = of_property_read_string(curr_node, "node-name",
+				&curr_node_ptr->node_name);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "failed to read node-name rc=%d", rc);
+				return rc;
+			}
+
+			curr_node_ptr->bw_info = kzalloc((sizeof(struct cam_cpas_axi_bw_info) *
+				num_drv_ports), GFP_KERNEL);
+			if (!curr_node_ptr->bw_info) {
+				CAM_ERR(CAM_CPAS, "Failed in allocating memory for bw info");
+				return -ENOMEM;
+			}
+
+			curr_node_ptr->axi_port_idx_arr = kzalloc((sizeof(int) * num_drv_ports),
+				GFP_KERNEL);
+			if (!curr_node_ptr->axi_port_idx_arr) {
+				CAM_ERR(CAM_CPAS, "Failed in allocating memory for port indices");
+				return -ENOMEM;
+			}
+
+			if (soc_private->enable_smart_qos && (level_idx == 1) &&
+				of_property_read_bool(curr_node, "rt-wr-niu")) {
+
+				rc = of_property_read_u32(curr_node, "priority-lut-low-offset",
+					&curr_node_ptr->pri_lut_low_offset);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "Invalid priority low offset rc %d", rc);
+					return rc;
+				}
+
+				rc = of_property_read_u32(curr_node, "priority-lut-high-offset",
+					&curr_node_ptr->pri_lut_high_offset);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "Invalid priority high offset rc %d", rc);
+					return rc;
+				}
+
+				rc = of_property_read_u32(curr_node, "niu-size",
+					&curr_node_ptr->niu_size);
+				if (rc || !curr_node_ptr->niu_size) {
+					CAM_ERR(CAM_CPAS, "Invalid niu size rc %d", rc);
+					return rc;
+				}
+
+				niu_idx = soc_private->smart_qos_info->num_rt_wr_nius;
+				if (niu_idx >= CAM_CPAS_MAX_RT_WR_NIU_NODES) {
+					CAM_ERR(CAM_CPAS, "Invalid number of level1 nodes %d",
+						soc_private->smart_qos_info->num_rt_wr_nius);
+					return -EINVAL;
+				}
+
+				soc_private->smart_qos_info->rt_wr_niu_node[niu_idx] =
+					curr_node_ptr;
+				soc_private->smart_qos_info->num_rt_wr_nius++;
+
+				CAM_DBG(CAM_CPAS,
+					"level1[%d] : Node %s idx %d priority offset 0x%x, NIU size %dKB",
+					niu_idx, curr_node_ptr->node_name, curr_node_ptr->cell_idx,
+					curr_node_ptr->pri_lut_low_offset, curr_node_ptr->niu_size);
+			}
+
+			curr_node_ptr->camnoc_max_needed = camnoc_max_needed;
+			rc = of_property_read_u32(curr_node, "bus-width-factor",
+				&curr_node_ptr->bus_width_factor);
+			if (rc)
+				curr_node_ptr->bus_width_factor = 1;
+
+			rc = of_property_read_u32(curr_node, "traffic-merge-type",
+				&curr_node_ptr->merge_type);
+			if (rc)
+				curr_node_ptr->merge_type = CAM_CPAS_TRAFFIC_MERGE_SUM;
+
+			for (j = 0; j < num_drv_ports; j++)
+				curr_node_ptr->axi_port_idx_arr[j] = -1;
+
+			mnoc_node = of_get_child_by_name(curr_node, "qcom,axi-port-mnoc");
+			if (mnoc_node) {
+				rc = cam_cpas_parse_mnoc_node(cpas_core, soc_private, curr_node_ptr,
+					mnoc_node, &mnoc_idx);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "failed to parse mnoc node info rc=%d",
+						rc);
+					return rc;
+				}
+			}
+
+			if (!soc_private->control_camnoc_axi_clk) {
+				rc = cam_cpas_update_camnoc_node(cpas_core, curr_node,
+					curr_node_ptr, &camnoc_idx);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "failed to parse camnoc node info rc=%d",
+						rc);
+					return rc;
+				}
+			}
+
+			rc = of_property_read_string(curr_node, "client-name", &client_name);
+			if (!rc) {
+				rc = of_property_read_u32(curr_node, "traffic-data",
+					&curr_node_ptr->path_data_type);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+						"Path Data type not found");
+					return rc;
+				}
+
+				rc = cam_cpas_util_path_type_to_idx(&curr_node_ptr->path_data_type);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "Incorrect path type for client: %s",
+						client_name);
+					return rc;
+				}
+
+				rc = of_property_read_u32(curr_node, "traffic-transaction-type",
+					&curr_node_ptr->path_trans_type);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "Path Transac type not found");
+					return rc;
+				}
+
+				if (curr_node_ptr->path_trans_type >= CAM_CPAS_TRANSACTION_MAX) {
+					CAM_ERR(CAM_CPAS, "Invalid transac type: %d",
+						curr_node_ptr->path_trans_type);
+					return -EINVAL;
+				}
+
+				count = of_property_count_u32_elems(curr_node, "constituent-paths");
+				for (i = 0; i < count; i++) {
+					rc = of_property_read_u32_index(curr_node,
+						"constituent-paths", i, &path_idx);
+					if (rc) {
+						CAM_ERR(CAM_CPAS, "No constituent path at %d", i);
+						return rc;
+					}
+
+					rc = cam_cpas_util_path_type_to_idx(&path_idx);
+					if (rc)
+						return rc;
+
+					curr_node_ptr->constituent_paths[path_idx] = true;
+				}
+
+				rc = cam_common_util_get_string_index(soc_private->client_name,
+					soc_private->num_clients, client_name, &client_idx);
+				if (rc) {
+					CAM_ERR(CAM_CPAS, "client name not found in list: %s",
+						client_name);
+					return rc;
+				}
+
+				if (client_idx >= CAM_CPAS_MAX_CLIENTS)
+					return -EINVAL;
+
+				curr_client = cpas_core->cpas_client[client_idx];
+				curr_client->tree_node_valid = true;
+				curr_client->tree_node[curr_node_ptr->path_data_type]
+					[curr_node_ptr->path_trans_type] = curr_node_ptr;
+
+				if (soc_private->enable_cam_ddr_drv) {
+					rc = of_property_read_u32(curr_node, "drv-voting-index",
+						&curr_node_ptr->drv_voting_idx);
+					if (rc)
+						curr_node_ptr->merge_type = CAM_CPAS_PORT_HLOS_DRV;
+
+					if (curr_node_ptr->drv_voting_idx == CAM_CPAS_PORT_DRV_DYN)
+						curr_client->is_drv_dyn = true;
+
+					if (curr_client->is_drv_dyn &&
+						(curr_node_ptr->drv_voting_idx !=
+						CAM_CPAS_PORT_DRV_DYN))
+						CAM_ERR(CAM_CPAS,
+							"Invalid config for drv dyn client: %s drv_idx: %d",
+							client_name, curr_node_ptr->drv_voting_idx);
+				}
+
+				CAM_DBG(CAM_CPAS,
+					"Node Added: Client[%s] DataType[%d] TransType[%d] DRV idx[%d]",
+					client_name,
+					curr_node_ptr->path_data_type,
+					curr_node_ptr->path_trans_type,
+					curr_node_ptr->drv_voting_idx);
+			}
+
+			if (soc_private->enable_cam_ddr_drv)
+				for (j = CAM_CPAS_PORT_DRV_0; j < num_drv_ports; j++)
+					curr_node_ptr->bw_info[j].vote_type =
+						CAM_CPAS_VOTE_TYPE_DRV;
+
+			parent_node = of_parse_phandle(curr_node, "parent-node", 0);
+			if (parent_node) {
+				of_property_read_u32(parent_node, "cell-index", &cell_idx);
+				curr_node_ptr->parent_node = soc_private->tree_node[cell_idx];
+			} else {
+				CAM_DBG(CAM_CPAS, "no parent node at this level");
+			}
+		}
+	}
+
+	mutex_init(&cpas_core->tree_lock);
+	cam_cpas_util_debug_parse_data(soc_private);
+
+	return 0;
+}
+
+int cam_cpas_get_hw_features(struct platform_device *pdev,
+	struct cam_cpas_private_soc *soc_private)
+{
+	struct device_node *of_node;
+	void *fuse;
+	uint32_t fuse_addr, fuse_mask, fuse_shift;
+	uint32_t val = 0, fuse_val = 0, feature;
+	uint32_t enable_type = 0, hw_map = 0;
+	int count = 0, i = 0, j = 0,  num_feature = 0, num_fuse = 0;
+	struct cam_cpas_feature_info *feature_info;
+
+	of_node = pdev->dev.of_node;
+	count = of_property_count_u32_elems(of_node, "cam_hw_fuse");
+
+	CAM_DBG(CAM_CPAS, "fuse info elements count %d", count);
+
+	if (count <= 0) {
+		goto end;
+	} else if (count%5 != 0) {
+		CAM_INFO(CAM_CPAS, "fuse entries should be multiple of 5 %d",
+			count);
+		goto end;
+	}
+
+	for (i = 0; (i + 5) <= count; i = i + 5) {
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i,
+				&feature);
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i + 1,
+				&fuse_addr);
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i + 2,
+				&fuse_mask);
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i + 3,
+				&enable_type);
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i + 4,
+				&hw_map);
+		val = ffs(fuse_mask);
+		if (val == 0) {
+			CAM_ERR(CAM_CPAS, "fuse_mask not valid 0x%x",
+				fuse_mask);
+			fuse_shift = 0;
+		} else {
+			fuse_shift = val - 1;
+		}
+		CAM_INFO(CAM_CPAS,
+			"feature 0x%x addr 0x%x, mask 0x%x, shift 0x%x type 0x%x hw_map 0x%x",
+			feature, fuse_addr, fuse_mask, fuse_shift, enable_type,
+			hw_map);
+
+		fuse = ioremap(fuse_addr, 4);
+		if (fuse) {
+			fuse_val = cam_io_r(fuse);
+			for (j = 0; (j < num_fuse) && (j < CAM_CPAS_FUSES_MAX);
+				j++) {
+				if (soc_private->fuse_info.fuse_val[j].fuse_id
+					== fuse_addr)
+					break;
+			}
+			if (j >= CAM_CPAS_FUSES_MAX) {
+				CAM_ERR(CAM_CPAS,
+					"fuse_info array overflow! %d", j);
+				goto end;
+			}
+			if (j == num_fuse) {
+				soc_private->fuse_info.fuse_val[j].fuse_id =
+					fuse_addr;
+				soc_private->fuse_info.fuse_val[j].fuse_val =
+					fuse_val;
+				CAM_INFO(CAM_CPAS,
+					"fuse_addr 0x%x, fuse_val %x",
+					fuse_addr, fuse_val);
+				num_fuse++;
+			}
+		} else {
+			/* if fuse ioremap is failed, disable the feature */
+			CAM_ERR(CAM_CPAS,
+				"fuse register io remap failed fuse_addr:0x%x feature0x%x ",
+				fuse_addr, feature);
+
+			if (enable_type == CAM_CPAS_FEATURE_TYPE_ENABLE ||
+				enable_type == CAM_CPAS_FEATURE_TYPE_DISABLE)
+				fuse_val = (enable_type) ? ~fuse_mask :
+					fuse_mask;
+			else
+				fuse_val = 0;
+		}
+
+		if (num_feature >= CAM_CPAS_MAX_FUSE_FEATURE) {
+			CAM_ERR(CAM_CPAS, "feature_info array overflow %d",
+				num_feature);
+			goto end;
+		}
+
+		soc_private->feature_info[num_feature].feature =
+			feature;
+		soc_private->feature_info[num_feature].hw_map = hw_map;
+		soc_private->feature_info[num_feature].type = enable_type;
+		feature_info = &soc_private->feature_info[num_feature];
+
+		if (enable_type != CAM_CPAS_FEATURE_TYPE_VALUE) {
+			if (enable_type == CAM_CPAS_FEATURE_TYPE_ENABLE) {
+				/*
+				 * fuse is for enable feature
+				 * if fust bit is set means feature is enabled
+				 * or HW is enabled
+				 */
+				if (fuse_val & fuse_mask)
+					feature_info->enable = true;
+				else
+					feature_info->enable = false;
+			} else if (enable_type ==
+				CAM_CPAS_FEATURE_TYPE_DISABLE){
+				/*
+				 * fuse is for disable feature
+				 * if fust bit is set means feature is disabled
+				 * or HW is disabled
+				 */
+				if (fuse_val & fuse_mask)
+					feature_info->enable = false;
+				else
+					feature_info->enable = true;
+			} else {
+				CAM_ERR(CAM_CPAS,
+					"Feature type not valid, type: %d",
+					enable_type);
+				goto end;
+			}
+			CAM_INFO(CAM_CPAS,
+				"feature 0x%x enable=%d hw_map=0x%x",
+				feature_info->feature, feature_info->enable,
+				feature_info->hw_map);
+		} else {
+			feature_info->value =
+				(fuse_val & fuse_mask) >> fuse_shift;
+			CAM_INFO(CAM_CPAS,
+				"feature 0x%x value=0x%x hw_map=0x%x",
+				feature_info->feature, feature_info->value,
+				feature_info->hw_map);
+		}
+		num_feature++;
+		iounmap(fuse);
+	}
+
+end:
+	soc_private->fuse_info.num_fuses = num_fuse;
+	soc_private->num_feature_info = num_feature;
+	return 0;
+}
+
+static inline enum cam_sys_cache_config_types cam_cpas_find_type_from_string(
+	const char *cache_name)
+{
+	if (strcmp(cache_name, "small-1") == 0)
+		return CAM_LLCC_SMALL_1;
+	else if (strcmp(cache_name, "small-2") == 0)
+		return CAM_LLCC_SMALL_2;
+	else if (strcmp(cache_name, "large-1") == 0)
+		return CAM_LLCC_LARGE_1;
+	else if (strcmp(cache_name, "large-2") == 0)
+		return CAM_LLCC_LARGE_2;
+	else if (strcmp(cache_name, "large-3") == 0)
+		return CAM_LLCC_LARGE_3;
+	else if (strcmp(cache_name, "large-4") == 0)
+		return CAM_LLCC_LARGE_4;
+	else
+		return CAM_LLCC_MAX;
+}
+
+static int cam_cpas_parse_sys_cache_uids(
+	struct device_node          *of_node,
+	struct cam_cpas_private_soc *soc_private)
+{
+	enum cam_sys_cache_config_types type = CAM_LLCC_MAX;
+	int num_caches, i, rc;
+	uint32_t scid;
+
+	soc_private->llcc_info = NULL;
+	soc_private->num_caches = 0;
+
+	num_caches = of_property_count_strings(of_node, "sys-cache-names");
+	if (num_caches <= 0) {
+		CAM_DBG(CAM_CPAS, "no cache-names found");
+		return 0;
+	}
+
+	if (num_caches > CAM_LLCC_MAX) {
+		CAM_ERR(CAM_CPAS,
+			"invalid number of cache-names found: 0x%x",
+			num_caches);
+		return -EINVAL;
+	}
+
+	soc_private->llcc_info = kcalloc(num_caches,
+		sizeof(struct cam_sys_cache_info), GFP_KERNEL);
+	if (!soc_private->llcc_info)
+		return -ENOMEM;
+
+	for (i = 0; i < num_caches; i++) {
+		rc = of_property_read_string_index(of_node, "sys-cache-names", i,
+			&soc_private->llcc_info[i].name);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "failed to read cache-names at %d", i);
+			goto end;
+		}
+
+		type = cam_cpas_find_type_from_string(
+			soc_private->llcc_info[i].name);
+		if (type == CAM_LLCC_MAX) {
+			CAM_ERR(CAM_CPAS, "Unsupported cache found: %s",
+				soc_private->llcc_info[i].name);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		soc_private->llcc_info[i].type = type;
+		rc = of_property_read_u32_index(of_node,
+				"sys-cache-uids", i,
+				&soc_private->llcc_info[i].uid);
+		if (rc < 0) {
+			CAM_ERR(CAM_CPAS,
+				"unable to read sys cache uid at index %d", i);
+			goto end;
+		}
+
+		soc_private->llcc_info[i].slic_desc =
+			llcc_slice_getd(soc_private->llcc_info[i].uid);
+
+		if (IS_ERR_OR_NULL(soc_private->llcc_info[i].slic_desc)) {
+			CAM_ERR(CAM_CPAS,
+				"Failed to get slice desc for uid %u",
+				soc_private->llcc_info[i].uid);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		scid = llcc_get_slice_id(soc_private->llcc_info[i].slic_desc);
+		soc_private->llcc_info[i].scid = scid;
+		soc_private->llcc_info[i].size =
+			llcc_get_slice_size(soc_private->llcc_info[i].slic_desc);
+		soc_private->llcc_info[i].staling_distance = 0;
+		soc_private->llcc_info[i].mode = CAM_LLCC_STALING_MODE_CAPACITY;
+		soc_private->llcc_info[i].op_type = CAM_LLCC_NOTIFY_STALING_EVICT;
+		soc_private->num_caches++;
+
+		CAM_DBG(CAM_CPAS,
+			"Cache: %s uid: %u scid: %d size: %zukb",
+			soc_private->llcc_info[i].name,
+			soc_private->llcc_info[i].uid, scid,
+			soc_private->llcc_info[i].size);
+	}
+
+	return 0;
+
+end:
+	kfree(soc_private->llcc_info);
+	soc_private->llcc_info = NULL;
+	return rc;
+}
+
+#ifdef CONFIG_DOMAIN_ID_SECURE_CAMERA
+static int cam_cpas_parse_domain_id_mapping(struct device_node *of_node,
+	struct cam_cpas_private_soc *soc_private)
+{
+	int count, i, rc = 0;
+
+	soc_private->domain_id_info.num_domain_ids = 0;
+	soc_private->domain_id_info.domain_id_supported = false;
+	soc_private->domain_id_info.domain_id_entries = NULL;
+	count = of_property_count_u32_elems(of_node, "domain-id");
+	if (count <= 0) {
+		CAM_DBG(CAM_CPAS, "No domain-id mapping found, count: %d", count);
+		return rc;
+	}
+
+	/* This property will always be specified in pairs  */
+	if (count % 2) {
+		CAM_ERR(CAM_CPAS,
+			"Mismatch in domain-id mapping, found %d number of entries", count);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	soc_private->domain_id_info.num_domain_ids = count / 2;
+
+	if (soc_private->domain_id_info.num_domain_ids > CAM_CPAS_DOMAIN_ID_MAX) {
+		CAM_ERR(CAM_CPAS,
+			"Number of domain id types: %u more than supported: %d",
+			soc_private->domain_id_info.num_domain_ids, CAM_CPAS_DOMAIN_ID_MAX);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	soc_private->domain_id_info.domain_id_entries =
+		kcalloc(soc_private->domain_id_info.num_domain_ids,
+			sizeof(struct cam_cpas_domain_id_mapping), GFP_KERNEL);
+	if (!soc_private->domain_id_info.domain_id_entries) {
+		CAM_ERR(CAM_CPAS,
+			"Error allocating memory for %u domain-id mapping(s)",
+			soc_private->domain_id_info.num_domain_ids);
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < soc_private->domain_id_info.num_domain_ids; i++) {
+		struct cam_cpas_domain_id_mapping *domain_id_entry =
+			&soc_private->domain_id_info.domain_id_entries[i];
+
+		rc = of_property_read_u32_index(of_node, "domain-id",
+		(i * 2), &domain_id_entry->domain_type);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Error reading domain-id type entry at pos %d", i);
+			rc = -EINVAL;
+			goto err;
+		}
+
+		if (domain_id_entry->domain_type > CAM_CPAS_SECURE_DOMAIN) {
+			CAM_ERR(CAM_CPAS, "Unexpected domain id type: %u",
+				domain_id_entry->domain_type);
+			rc =  -EINVAL;
+			goto err;
+		}
+
+		rc = of_property_read_u32_index(of_node, "domain-id",
+		((i * 2) + 1), &domain_id_entry->mapping_id);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Error reading domain-id mapping id at pos %d", i);
+			rc = -EINVAL;
+			goto err;
+		}
+
+		CAM_DBG(CAM_CPAS, "Domain-id type: %u, mapping: %u at pos: %d",
+			domain_id_entry->domain_type, domain_id_entry->mapping_id, i);
+	}
+
+	soc_private->domain_id_info.domain_id_supported = true;
+
+	return rc;
+
+err:
+	soc_private->domain_id_info.num_domain_ids = 0;
+	kfree(soc_private->domain_id_info.domain_id_entries);
+	soc_private->domain_id_info.domain_id_entries = NULL;
+	return rc;
+}
+#endif
+
+static int cam_cpas_get_domain_id_support_clks(struct device_node *of_node,
+	struct cam_hw_soc_info *soc_info, struct cam_cpas_private_soc *soc_private)
+{
+	int rc = 0, count, i;
+	struct cam_cpas_domain_id_support_clks *domain_id_clks;
+
+	soc_private->domain_id_clks = kzalloc(sizeof(struct cam_cpas_domain_id_support_clks),
+		GFP_KERNEL);
+	if (!soc_private->domain_id_clks) {
+		CAM_ERR(CAM_CPAS, "Failed in allocating memory for domain_id_clk");
+		return -ENOMEM;
+	}
+
+	domain_id_clks = soc_private->domain_id_clks;
+
+	count = of_property_count_strings(of_node, "domain-id-support-clks");
+	CAM_DBG(CAM_CPAS, "Domain-id clk count: %d", count);
+	if (count > CAM_SOC_MAX_OPT_CLK) {
+		CAM_ERR(CAM_CPAS, "Invalid cnt of clocks, count: %d", count);
+		rc  = -EINVAL;
+		goto err;
+	}
+	if (count <= 0) {
+		CAM_ERR(CAM_CPAS, "No domain-id clk found");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	domain_id_clks->number_clks = count;
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node, "domain-id-support-clks",
+			i, &domain_id_clks->clk_names[i]);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed reading domain-id clk name at i: %d, total clks: %d",
+				i, count);
+			rc = -EINVAL;
+			goto err;
+		}
+
+		rc = cam_soc_util_get_option_clk_by_name(soc_info, domain_id_clks->clk_names[i],
+			&domain_id_clks->clk_idx[i]);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed reading domain-id clk %s at i: %d, total clks; %d",
+					domain_id_clks->clk_names[i], i, count);
+			rc = -EINVAL;
+			goto err;
+		}
+
+	CAM_DBG(CAM_CPAS, "Domain-id-clk %s with clk index %d",
+		domain_id_clks->clk_names[i], domain_id_clks->clk_idx[i]);
+
+	}
+
+	return rc;
+
+err:
+	kfree(domain_id_clks);
+	return rc;
+}
+
+int cam_cpas_get_custom_dt_info(struct cam_hw_info *cpas_hw,
+	struct platform_device *pdev, struct cam_cpas_private_soc *soc_private)
+{
+	struct device_node *of_node;
+	struct of_phandle_args src_args = {0}, dst_args = {0};
+	int count = 0, i = 0, rc = 0, num_bw_values = 0, num_levels = 0;
+	uint32_t cam_drv_en_mask_val = 0;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	uint32_t ahb_bus_client_ab = 0, ahb_bus_client_ib = 0;
+
+	if (!soc_private || !pdev) {
+		CAM_ERR(CAM_CPAS, "invalid input arg %pK %pK",
+			soc_private, pdev);
+		return -EINVAL;
+	}
+
+	of_node = pdev->dev.of_node;
+
+	rc = of_property_read_string(of_node, "arch-compat",
+		&soc_private->arch_compat);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "device %s failed to read arch-compat",
+			pdev->name);
+		return rc;
+	}
+
+	cam_cpas_get_hw_features(pdev, soc_private);
+
+#ifdef CONFIG_DOMAIN_ID_SECURE_CAMERA
+	/* get domain id mapping info */
+	rc = cam_cpas_parse_domain_id_mapping(of_node, soc_private);
+	if (rc)
+		return rc;
+	/* check if the domain ID configuration is available in the DTSI */
+	if (soc_private->domain_id_info.domain_id_supported == false) {
+		CAM_ERR(CAM_CPAS, "Domain ID configuration is expected for this target");
+		return -EINVAL;
+	}
+#endif
+
+	soc_private->camnoc_axi_min_ib_bw = 0;
+	rc = of_property_read_u64(of_node, "camnoc-axi-min-ib-bw",
+		&soc_private->camnoc_axi_min_ib_bw);
+	if (rc == -EOVERFLOW) {
+		soc_private->camnoc_axi_min_ib_bw = 0;
+		rc = of_property_read_u32(of_node, "camnoc-axi-min-ib-bw",
+			(u32 *)&soc_private->camnoc_axi_min_ib_bw);
+	}
+
+	if (rc) {
+		CAM_DBG(CAM_CPAS, "failed to read camnoc-axi-min-ib-bw rc:%d", rc);
+		soc_private->camnoc_axi_min_ib_bw = CAM_CPAS_AXI_MIN_CAMNOC_IB_BW;
+	}
+
+	CAM_DBG(CAM_CPAS, "camnoc-axi-min-ib-bw = %llu", soc_private->camnoc_axi_min_ib_bw);
+
+	soc_private->client_id_based = of_property_read_bool(of_node, "client-id-based");
+	soc_private->bus_icc_based = of_property_read_bool(of_node, "interconnects");
+
+	if (soc_private->bus_icc_based) {
+		soc_private->use_cam_icc_path_str = of_property_read_bool(of_node,
+			"cam-icc-path-names");
+		if (soc_private->use_cam_icc_path_str) {
+			rc = of_property_read_string(of_node, "cam-icc-path-names",
+				&cpas_core->ahb_bus_client.common_data.name);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "device %s failed to read ahb cam-icc-path-names",
+					pdev->name);
+				return rc;
+			}
+
+			goto parse_ahb_table;
+		}
+
+		rc = of_property_read_string(of_node, "interconnect-names",
+			&cpas_core->ahb_bus_client.common_data.name);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "device %s failed to read ahb interconnect-names",
+				pdev->name);
+			return rc;
+		}
+
+		rc = of_parse_phandle_with_args(of_node, "interconnects",
+			"#interconnect-cells", 0, &src_args);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "device %s failed to read ahb bus src info", pdev->name);
+			return rc;
+		}
+
+		of_node_put(src_args.np);
+		if (src_args.args_count != 1) {
+			CAM_ERR(CAM_CPAS, "Invalid number of ahb src args: %d",
+				src_args.args_count);
+			return -EINVAL;
+		}
+
+		cpas_core->ahb_bus_client.common_data.src_id = src_args.args[0];
+
+		rc = of_parse_phandle_with_args(of_node, "interconnects",
+			"#interconnect-cells", 1, &dst_args);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "device %s failed to read ahb bus dst info", pdev->name);
+			return rc;
+		}
+
+		of_node_put(dst_args.np);
+		if (dst_args.args_count != 1) {
+			CAM_ERR(CAM_CPAS, "Invalid number of ahb dst args: %d",
+				dst_args.args_count);
+			return -EINVAL;
+		}
+
+		cpas_core->ahb_bus_client.common_data.dst_id = dst_args.args[0];
+
+parse_ahb_table:
+		rc = of_property_read_u32(of_node, "cam-ahb-num-cases",
+			&cpas_core->ahb_bus_client.common_data.num_usecases);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"device %s failed to read ahb num usecases",
+				pdev->name);
+			return rc;
+		}
+
+		if (cpas_core->ahb_bus_client.common_data.num_usecases >
+			CAM_SOC_BUS_MAX_NUM_USECASES) {
+			CAM_ERR(CAM_UTIL, "Invalid number of usecases: %d",
+				cpas_core->ahb_bus_client.common_data.num_usecases);
+			return -EINVAL;
+		}
+
+		num_bw_values = of_property_count_u32_elems(of_node, "cam-ahb-bw-KBps");
+		if (num_bw_values <= 0) {
+			CAM_ERR(CAM_UTIL, "Error counting ahb bw values");
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_CPAS, "AHB: num bw values %d", num_bw_values);
+		num_levels = (num_bw_values / 2);
+
+		if (num_levels !=
+			cpas_core->ahb_bus_client.common_data.num_usecases) {
+			CAM_ERR(CAM_UTIL, "Invalid number of levels: %d", num_bw_values/2);
+			return -EINVAL;
+		}
+
+		for (i = 0; i < num_levels; i++) {
+			rc = of_property_read_u32_index(of_node, "cam-ahb-bw-KBps", (i * 2),
+				&ahb_bus_client_ab);
+			if (rc) {
+				CAM_ERR(CAM_UTIL, "Error reading ab bw value, rc=%d", rc);
+				return rc;
+			}
+
+			cpas_core->ahb_bus_client.common_data.bw_pair[i].ab = ahb_bus_client_ab;
+
+			rc = of_property_read_u32_index(of_node, "cam-ahb-bw-KBps", ((i * 2) + 1),
+				&ahb_bus_client_ib);
+			if (rc) {
+				CAM_ERR(CAM_UTIL, "Error reading ib bw value, rc=%d", rc);
+				return rc;
+			}
+
+			cpas_core->ahb_bus_client.common_data.bw_pair[i].ib = ahb_bus_client_ib;
+
+			CAM_DBG(CAM_CPAS, "AHB: Level: %d, ab_value %llu, ib_value: %llu",
+				i, cpas_core->ahb_bus_client.common_data.bw_pair[i].ab,
+				cpas_core->ahb_bus_client.common_data.bw_pair[i].ib);
+		}
+	}
+
+	count = of_property_count_strings(of_node, "client-names");
+	if (count <= 0) {
+		CAM_ERR(CAM_CPAS, "no client-names found");
+		return -EINVAL;
+	} else if (count > CAM_CPAS_MAX_CLIENTS) {
+		CAM_ERR(CAM_CPAS, "Number of clients %d greater than max %d",
+			count, CAM_CPAS_MAX_CLIENTS);
+		return -EINVAL;
+	}
+
+	soc_private->num_clients = count;
+	CAM_DBG(CAM_CPAS,
+		"arch-compat=%s, client_id_based = %d, num_clients=%d",
+		soc_private->arch_compat, soc_private->client_id_based,
+		soc_private->num_clients);
+
+	for (i = 0; i < soc_private->num_clients; i++) {
+		rc = of_property_read_string_index(of_node,
+			"client-names", i, &soc_private->client_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "no client-name at cnt=%d", i);
+			return -EINVAL;
+		}
+
+		cpas_core->cpas_client[i] =
+			kzalloc(sizeof(struct cam_cpas_client), GFP_KERNEL);
+		if (!cpas_core->cpas_client[i]) {
+			rc = -ENOMEM;
+			goto cleanup_clients;
+		}
+
+		CAM_DBG(CAM_CPAS, "Client[%d] : %s", i,
+			soc_private->client_name[i]);
+	}
+
+	soc_private->control_camnoc_axi_clk = of_property_read_bool(of_node,
+		"control-camnoc-axi-clk");
+
+	if (soc_private->control_camnoc_axi_clk == true) {
+		rc = of_property_read_u32(of_node, "camnoc-bus-width",
+			&soc_private->camnoc_bus_width);
+		if (rc || (soc_private->camnoc_bus_width == 0)) {
+			CAM_ERR(CAM_CPAS, "Bus width not found rc=%d, %d",
+				rc, soc_private->camnoc_bus_width);
+			goto cleanup_clients;
+		}
+
+		if (of_property_read_u32(of_node,
+			"camnoc-axi-clk-bw-margin-perc",
+			&soc_private->camnoc_axi_clk_bw_margin)) {
+
+			/* this is not fatal, overwrite to 0 */
+			soc_private->camnoc_axi_clk_bw_margin = 0;
+		}
+	}
+
+	CAM_DBG(CAM_CPAS,
+		"control_camnoc_axi_clk=%d, width=%d, margin=%d",
+		soc_private->control_camnoc_axi_clk,
+		soc_private->camnoc_bus_width,
+		soc_private->camnoc_axi_clk_bw_margin);
+
+	count = of_property_count_u32_elems(of_node, "vdd-corners");
+	if ((count > 0) && (count <= CAM_REGULATOR_LEVEL_MAX) &&
+		(of_property_count_strings(of_node, "vdd-corner-ahb-mapping") ==
+		count)) {
+		const char *ahb_string;
+
+		for (i = 0; i < count; i++) {
+			rc = of_property_read_u32_index(of_node, "vdd-corners",
+				i, &soc_private->vdd_ahb[i].vdd_corner);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"vdd-corners failed at index=%d", i);
+				rc = -ENODEV;
+				goto cleanup_clients;
+			}
+
+			rc = of_property_read_string_index(of_node,
+				"vdd-corner-ahb-mapping", i, &ahb_string);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"no ahb-mapping at index=%d", i);
+				rc = -ENODEV;
+				goto cleanup_clients;
+			}
+
+			rc = cam_soc_util_get_level_from_string(ahb_string,
+				&soc_private->vdd_ahb[i].ahb_level);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"invalid ahb-string at index=%d", i);
+				rc = -EINVAL;
+				goto cleanup_clients;
+			}
+
+			CAM_DBG(CAM_CPAS,
+				"Vdd-AHB mapping [%d] : [%d] [%s] [%d]", i,
+				soc_private->vdd_ahb[i].vdd_corner,
+				ahb_string, soc_private->vdd_ahb[i].ahb_level);
+		}
+
+		soc_private->num_vdd_ahb_mapping = count;
+	}
+
+	soc_private->enable_smart_qos = of_property_read_bool(of_node,
+			"enable-smart-qos");
+	soc_private->enable_secure_qos_update = of_property_read_bool(of_node,
+			"enable-secure-qos-update");
+	CAM_DBG(CAM_CPAS, "Enable secure qos update: %s",
+		CAM_BOOL_TO_YESNO(soc_private->enable_secure_qos_update));
+
+	if (soc_private->enable_smart_qos) {
+		uint32_t value;
+
+		soc_private->smart_qos_info = kzalloc(sizeof(struct cam_cpas_smart_qos_info),
+			GFP_KERNEL);
+		if (!soc_private->smart_qos_info) {
+			rc = -ENOMEM;
+			goto cleanup_clients;
+		}
+
+		/*
+		 * If enabled, we expect min and max priority values,
+		 * clamp priority value, slope factor, least and most
+		 * stressed clamp threshold values, high and low stress
+		 * indicator threshold values, bw ratio scale factor value,
+		 * so treat as fatal error if not available.
+		 */
+		rc = of_property_read_u32(of_node, "rt-wr-priority-min",
+			&value);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Invalid min Qos priority rc %d", rc);
+			goto cleanup_clients;
+		}
+		soc_private->smart_qos_info->rt_wr_priority_min = (uint8_t)value;
+
+		rc = of_property_read_u32(of_node, "rt-wr-priority-max",
+			&value);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Invalid max Qos priority rc %d", rc);
+			goto cleanup_clients;
+		}
+		soc_private->smart_qos_info->rt_wr_priority_max = (uint8_t)value;
+
+		rc = of_property_read_u32(of_node, "rt-wr-priority-clamp",
+			&value);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Invalid clamp Qos priority rc %d", rc);
+			goto cleanup_clients;
+		}
+		soc_private->smart_qos_info->rt_wr_priority_clamp = (uint8_t)value;
+
+		rc = of_property_read_u32(of_node, "rt-wr-slope-factor",
+			&value);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Invalid slope factor rc %d", rc);
+			goto cleanup_clients;
+		}
+
+		if (value > CAM_CPAS_MAX_SLOPE_FACTOR) {
+			CAM_ERR(CAM_UTIL, "Invalid slope factor value %d", value);
+			rc = -EINVAL;
+			goto cleanup_clients;
+		} else
+			soc_private->smart_qos_info->rt_wr_slope_factor = (uint8_t)value;
+
+		CAM_DBG(CAM_CPAS,
+			"SmartQoS enabled, priority min=%u, max=%u, clamp=%u, slope factor=%u",
+			(uint32_t)soc_private->smart_qos_info->rt_wr_priority_min,
+			(uint32_t)soc_private->smart_qos_info->rt_wr_priority_max,
+			(uint32_t)soc_private->smart_qos_info->rt_wr_priority_clamp,
+			(uint32_t)soc_private->smart_qos_info->rt_wr_slope_factor);
+
+		rc = of_property_read_u32(of_node, "rt-wr-leaststressed-clamp-threshold",
+			&value);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Invalid leaststressed clamp threshold rc %d", rc);
+			goto cleanup_clients;
+		}
+		soc_private->smart_qos_info->leaststressed_clamp_th = (uint8_t)value;
+
+		rc = of_property_read_u32(of_node, "rt-wr-moststressed-clamp-threshold",
+			&value);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Invalid moststressed clamp threshold rc %d", rc);
+			goto cleanup_clients;
+		}
+		soc_private->smart_qos_info->moststressed_clamp_th = (uint8_t)value;
+
+		CAM_DBG(CAM_CPAS,
+			"leaststressed_clamp_th=%u, moststressed_clamp_th=%u",
+			(uint32_t)soc_private->smart_qos_info->leaststressed_clamp_th,
+			(uint32_t)soc_private->smart_qos_info->moststressed_clamp_th);
+
+		rc = of_property_read_u32(of_node, "rt-wr-highstress-indicator-threshold",
+			&value);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Invalid highstress indicator threshold rc %d", rc);
+			goto cleanup_clients;
+		}
+
+		if (value > CAM_CPAS_MAX_STRESS_INDICATOR) {
+			CAM_ERR(CAM_UTIL, "Invalid highstress indicator threshold value %d", value);
+			rc = -EINVAL;
+			goto cleanup_clients;
+		} else
+			soc_private->smart_qos_info->highstress_indicator_th = (uint8_t)value;
+
+		rc = of_property_read_u32(of_node, "rt-wr-lowstress-indicator-threshold",
+			&value);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Invalid lowstress indicator threshold rc %d", rc);
+			goto cleanup_clients;
+		}
+
+		if (value > CAM_CPAS_MAX_STRESS_INDICATOR) {
+			CAM_ERR(CAM_UTIL, "Invalid lowstress indicator threshold value %d", value);
+			rc = -EINVAL;
+			goto cleanup_clients;
+		} else
+			soc_private->smart_qos_info->lowstress_indicator_th = (uint8_t)value;
+
+		rc = of_property_read_u32(of_node, "rt-wr-bw-ratio-scale-factor",
+			&value);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Invalid bw ratio scale factor rc %d", rc);
+			goto cleanup_clients;
+		}
+		soc_private->smart_qos_info->bw_ratio_scale_factor = (uint8_t)value;
+
+		CAM_DBG(CAM_CPAS,
+			"highstress_indicator_th=%u, lowstress_indicator_th=%u, scale factor=%u",
+			(uint32_t)soc_private->smart_qos_info->highstress_indicator_th,
+			(uint32_t)soc_private->smart_qos_info->lowstress_indicator_th,
+			(uint32_t)soc_private->smart_qos_info->bw_ratio_scale_factor);
+	} else {
+		CAM_DBG(CAM_CPAS, "SmartQoS not enabled, use static settings");
+		soc_private->smart_qos_info = NULL;
+	}
+
+	rc = of_property_read_u32(of_node, "enable-cam-drv", &cam_drv_en_mask_val);
+
+	if (!rc) {
+		if (cam_drv_en_mask_val & CAM_DDR_DRV)
+			soc_private->enable_cam_ddr_drv = true;
+
+		if (cam_drv_en_mask_val & CAM_CLK_DRV) {
+			if (!soc_private->enable_cam_ddr_drv) {
+				CAM_ERR(CAM_CPAS, "DDR DRV needs to be enabled for Clock DRV");
+				rc = -EPERM;
+				goto cleanup_clients;
+			}
+
+			soc_private->enable_cam_clk_drv = true;
+			rc = cam_soc_util_cesta_populate_crm_device();
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "Failed to populate cam cesta crm device rc %d",
+					rc);
+				goto cleanup_clients;
+			}
+		}
+	}
+
+	CAM_DBG(CAM_CPAS, "enable_cam_ddr_drv %d enable_cam_clk_drv %d cam_drv_en_mask_val %d",
+		soc_private->enable_cam_ddr_drv, soc_private->enable_cam_clk_drv,
+		cam_drv_en_mask_val);
+
+	rc = cam_cpas_parse_node_tree(cpas_core, of_node, soc_private);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Node tree parsing failed rc: %d", rc);
+		goto cleanup_tree;
+	}
+
+	/* If SmartQoS is enabled, we expect few tags in dtsi, validate */
+	if (soc_private->enable_smart_qos) {
+		int port_idx;
+		bool rt_port_exists = false;
+
+		if ((soc_private->smart_qos_info->num_rt_wr_nius == 0) ||
+			(soc_private->smart_qos_info->num_rt_wr_nius >
+			CAM_CPAS_MAX_RT_WR_NIU_NODES)) {
+			CAM_ERR(CAM_CPAS, "Invalid number of level1 nodes %d",
+				soc_private->smart_qos_info->num_rt_wr_nius);
+			rc = -EINVAL;
+			goto cleanup_tree;
+		}
+
+		for (port_idx = 0; port_idx < cpas_core->num_axi_ports;
+			port_idx++) {
+			CAM_DBG(CAM_CPAS, "[%d] : Port[%s] is_rt=%d",
+				port_idx, cpas_core->axi_port[port_idx].axi_port_name,
+				cpas_core->axi_port[port_idx].is_rt);
+			if (cpas_core->axi_port[port_idx].is_rt) {
+				rt_port_exists = true;
+				break;
+			}
+		}
+
+		if (!rt_port_exists) {
+			CAM_ERR(CAM_CPAS,
+				"RT AXI port not tagged, num ports %d",
+				cpas_core->num_axi_ports);
+			rc = -EINVAL;
+			goto cleanup_tree;
+		}
+	}
+
+	/* Optional rpmh bcm info */
+	count = of_property_count_u32_elems(of_node, "rpmh-bcm-info");
+	/*
+	 * We expect count=5(CAM_RPMH_BCM_INFO_MAX) if valid rpmh bcm info
+	 * is available.
+	 * 0 - Total number of BCMs
+	 * 1 - First BCM FE (front-end) register offset.
+	 *     These represent requested clk plan by sw
+	 * 2 - First BCM BE (back-end) register offset.
+	 *     These represent actual clk plan at hw
+	 * 3 - DDR BCM index
+	 * 4 - MMNOC BCM index
+	 */
+	if (count == CAM_RPMH_BCM_INFO_MAX) {
+		for (i = 0; i < count; i++) {
+			rc = of_property_read_u32_index(of_node,
+				"rpmh-bcm-info", i, &soc_private->rpmh_info[i]);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"Incorrect rpmh info at %d, count=%d",
+					i, count);
+				break;
+			}
+			CAM_DBG(CAM_CPAS, "RPMH BCM Info [%d]=0x%x",
+				i, soc_private->rpmh_info[i]);
+		}
+
+		if (rc)
+			soc_private->rpmh_info[CAM_RPMH_NUMBER_OF_BCMS] = 0;
+	} else {
+		CAM_DBG(CAM_CPAS, "RPMH BCM info not available in DT, count=%d",
+			count);
+	}
+
+	/* check cache info */
+	rc = cam_cpas_parse_sys_cache_uids(of_node, soc_private);
+	if (rc)
+		goto cache_parse_fail;
+
+	return 0;
+
+cache_parse_fail:
+	soc_private->rpmh_info[CAM_RPMH_NUMBER_OF_BCMS] = 0;
+cleanup_tree:
+	cam_cpas_node_tree_cleanup(cpas_core, soc_private);
+cleanup_clients:
+	cam_cpas_util_client_cleanup(cpas_hw);
+	return rc;
+}
+
+static int cam_cpas_soc_fill_irq_data(struct cam_hw_info *cpas_hw,
+	struct cam_hw_soc_info *soc_info, void **irq_data)
+{
+	struct cam_cpas_private_soc *soc_private = soc_info->soc_private;
+	int i;
+
+	for (i = 0; i < soc_info->irq_count; i++) {
+		soc_private->irq_data[i].cpas_hw = cpas_hw;
+
+		if (!strcmp(soc_info->irq_name[i], "cpas_camnoc"))
+			soc_private->irq_data[i].camnoc_type = CAM_CAMNOC_HW_COMBINED;
+		else if (!strcmp(soc_info->irq_name[i], "cpas_camnoc_rt"))
+			soc_private->irq_data[i].camnoc_type = CAM_CAMNOC_HW_RT;
+		else if (!strcmp(soc_info->irq_name[i], "cpas_camnoc_nrt"))
+			soc_private->irq_data[i].camnoc_type = CAM_CAMNOC_HW_NRT;
+		else {
+			CAM_ERR(CAM_CPAS, "Unable to identify interrupt name: %s",
+				soc_info->irq_name[i]);
+			return -EINVAL;
+		}
+
+		irq_data[i] = &soc_private->irq_data[i];
+	}
+
+	return 0;
+}
+
+int cam_cpas_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, struct cam_hw_info *cpas_hw)
+{
+	int rc = 0;
+	struct cam_cpas_private_soc *soc_private;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in get_dt_properties, rc=%d", rc);
+		return rc;
+	}
+
+	if (soc_info->irq_count > 0 && !irq_handler) {
+		CAM_ERR(CAM_CPAS, "Invalid IRQ handler");
+		return -EINVAL;
+	}
+
+	soc_info->soc_private = kzalloc(sizeof(struct cam_cpas_private_soc),
+		GFP_KERNEL);
+	if (!soc_info->soc_private) {
+		CAM_ERR(CAM_CPAS, "Failed to allocate soc private");
+		return -ENOMEM;
+	}
+	soc_private = (struct cam_cpas_private_soc *)soc_info->soc_private;
+
+	rc = cam_cpas_get_custom_dt_info(cpas_hw, soc_info->pdev, soc_private);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in get_custom_info, rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	soc_private->irq_data = kcalloc(soc_info->irq_count, sizeof(struct cam_cpas_soc_irq_data),
+		GFP_KERNEL);
+	if (!soc_private->irq_data) {
+		CAM_ERR(CAM_CPAS, "Failed to allocate irq data");
+		rc = -ENOMEM;
+		goto free_soc_private;
+	}
+
+	rc = cam_cpas_soc_fill_irq_data(cpas_hw, soc_info, &(irq_data[0]));
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed to fill irq data rc=%d", rc);
+		goto free_irq_data;
+	}
+
+	soc_info->is_clk_drv_en = soc_private->enable_cam_clk_drv;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler, &(irq_data[0]));
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in request_platform_resource, rc=%d", rc);
+		goto free_irq_data;
+	}
+
+	rc = cam_soc_util_get_option_clk_by_name(soc_info, CAM_ICP_CLK_NAME,
+		&soc_private->icp_clk_index);
+	if (rc) {
+		CAM_DBG(CAM_CPAS, "ICP option clk get failed with rc %d", rc);
+		soc_private->icp_clk_index = -1;
+		rc = 0;
+	} else {
+		CAM_DBG(CAM_CPAS, "ICP option clk get success index %d",
+			soc_private->icp_clk_index);
+	}
+
+	if (soc_private->domain_id_info.domain_id_supported) {
+		rc = cam_cpas_get_domain_id_support_clks(soc_info->pdev->dev.of_node,
+			soc_info, soc_private);
+		if (rc)
+			goto release_res;
+	}
+
+	return rc;
+
+release_res:
+	cam_soc_util_release_platform_resource(soc_info);
+free_irq_data:
+	kfree(soc_private->irq_data);
+free_soc_private:
+	kfree(soc_private->llcc_info);
+	kfree(soc_private->smart_qos_info);
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+	return rc;
+}
+
+int cam_cpas_soc_deinit_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc, i;
+	struct cam_cpas_private_soc *soc_private = soc_info->soc_private;
+
+	for (i = 0; i < soc_private->num_caches; i++)
+		llcc_slice_putd(soc_private->llcc_info[i].slic_desc);
+
+	if (soc_private->icp_clk_index != -1) {
+		rc = cam_soc_util_put_optional_clk(soc_info, soc_private->icp_clk_index);
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Error Put optional clk failed rc=%d", rc);
+	}
+
+	kfree(soc_private->domain_id_info.domain_id_entries);
+
+	kfree(soc_private->domain_id_clks);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "release platform failed, rc=%d", rc);
+
+	kfree(soc_private->irq_data);
+	kfree(soc_private->llcc_info);
+	kfree(soc_private->smart_qos_info);
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+
+	return rc;
+}
+
+int cam_cpas_soc_enable_resources(struct cam_hw_soc_info *soc_info,
+	enum cam_vote_level default_level)
+{
+	struct cam_cpas_private_soc *soc_private = soc_info->soc_private;
+	int rc = 0;
+
+	/* set this everytime in order to support debugfs to disable clk drv between runs */
+	soc_info->is_clk_drv_en = soc_private->enable_cam_clk_drv;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		default_level, true);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "enable platform resource failed, rc=%d", rc);
+
+	return rc;
+}
+
+int cam_cpas_soc_disable_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clocks, bool disable_irq)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX,
+		disable_clocks, disable_irq);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "disable platform failed, rc=%d", rc);
+
+	return rc;
+}
+
+int cam_cpas_soc_disable_irq(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_irq_disable(soc_info);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "disable irq failed, rc=%d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cam_cpas_soc.h
@@ -0,0 +1,338 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CPAS_SOC_H_
+#define _CAM_CPAS_SOC_H_
+
+#include <linux/soc/qcom/llcc-qcom.h>
+#include "cam_soc_util.h"
+#include "cam_cpas_hw.h"
+
+#define CAM_REGULATOR_LEVEL_MAX 16
+#define CAM_CPAS_MAX_TREE_NODES 63
+#define CAM_CPAS_MAX_FUSE_FEATURE 10
+
+/**
+ * enum cam_cpas_num_subparts_types - Enum for types of number of camera subparts
+ */
+enum cam_cpas_num_subparts_types {
+	CAM_CPAS_AVAILABLE_NUM_SUBPARTS,
+	CAM_CPAS_FUNCTIONAL_NUM_SUBPARTS,
+	CAM_CPAS_NUM_SUBPARTS_MAX_TYPES,
+};
+
+/**
+ * struct cpas_tree_node: Generic cpas tree node for BW voting
+ *
+ * @cell_idx: Index to identify node from device tree and its parent
+ * @level_idx: Index to identify at what level the node is present
+ * @axi_port_idx_arr: Index to identify which axi port to vote the consolidated bw.
+ *                    It can point to multiple indexes in case of camera DRV
+ * @drv_voting_idx: Specifies the index to which the child node would finally vote.
+ * @camnoc_axi_port_idx: Index to find which axi port to vote consolidated bw
+ * @path_data_type: Traffic type info from device tree (ife-vid, ife-disp etc)
+ * @path_trans_type: Transaction type info from device tree (rd, wr)
+ * @merge_type: Traffic merge type (calculation info) from device tree
+ * @bus_width_factor: Factor for accounting bus width in CAMNOC bw calculation
+ * @bw_info: AXI BW info for all drv ports
+ * @camnoc_max_needed: If node is needed for CAMNOC BW calculation then true
+ * @constituent_paths: Constituent paths presence info from device tree
+ *     Ex: For CAM_CPAS_PATH_DATA_IFE_UBWC_STATS, index corresponding to
+ *     CAM_CPAS_PATH_DATA_IFE_VID, CAM_CPAS_PATH_DATA_IFE_DISP and
+ *     CAM_CPAS_PATH_DATA_IFE_STATS
+ * @tree_dev_node: Device node from devicetree for current tree node
+ * @parent_node: Pointer to node one or more level above the current level
+ *     (starting from end node of cpas client)
+ * @pri_lut_low_offset: Register offset value for priority lut low.
+ *                           Valid only for level1 nodes (representing NIUs)
+ * @pri_lut_high_offset: Register offset value for priority lut high.
+ *                           Valid only for level1 nodes (representing NIUs)
+ * @niu_size: Size of NIU that this node represents. Size in KB
+ * @curr_priority_low:     New calculated priority lut low values
+ * @curr_priority_high:    New calculated priority lut high values
+ * @applied_priority_low:  Currently applied priority lut low values
+ * @applied_priority_high: Currently applied priority lut high values
+ *
+ */
+struct cam_cpas_tree_node {
+	uint32_t cell_idx;
+	int level_idx;
+	int *axi_port_idx_arr;
+	int drv_voting_idx;
+	int camnoc_axi_port_idx;
+	const char *node_name;
+	uint32_t path_data_type;
+	uint32_t path_trans_type;
+	uint32_t merge_type;
+	uint32_t bus_width_factor;
+	struct cam_cpas_axi_bw_info *bw_info;
+	bool camnoc_max_needed;
+	bool constituent_paths[CAM_CPAS_PATH_DATA_MAX];
+	struct device_node *tree_dev_node;
+	struct cam_cpas_tree_node *parent_node;
+	uint32_t pri_lut_low_offset;
+	uint32_t pri_lut_high_offset;
+	uint32_t niu_size;
+	uint32_t curr_priority_low;
+	uint32_t curr_priority_high;
+	uint32_t applied_priority_low;
+	uint32_t applied_priority_high;
+};
+
+/**
+ * struct cam_cpas_feature_info : CPAS fuse feature info
+ * @feature: Identifier for feature
+ * @type: Type of feature
+ * @value: Fuse value
+ * @enable: Feature enable or disable
+ * @hw_map: Each bit position indicates if the hw_id for the feature
+ */
+
+struct cam_cpas_feature_info {
+	uint32_t feature;
+	uint32_t type;
+	uint32_t value;
+	bool enable;
+	uint32_t hw_map;
+};
+
+/**
+ * struct cam_sys_cache_local_info : camera cache info saving locally
+ *
+ * @type:      cache type small/large etc.
+ * @staling_distance:       staling_distance
+ * @mode:      camera llc's stalling mode
+ * @op_type:      cache operation type EVICT, FORGET
+ */
+struct cam_sys_cache_local_info {
+	enum cam_sys_cache_config_types  type;
+	uint32_t staling_distance;
+	enum cam_sys_cache_llcc_staling_mode mode;
+	enum cam_sys_cache_llcc_staling_op_type op_type;
+};
+
+/**
+ * struct cam_sys_cache_info : Last level camera cache info
+ *
+ * @ref_cnt:   Ref cnt activate/deactivate cache
+ * @type:      cache type small/large etc.
+ * @uid:       Client user ID
+ * @size:      Cache size
+ * @scid:      Slice ID
+ * @slic_desc: Slice descriptor
+ * @staling_distance:       staling_distance
+ * @mode:      camera llc's stalling mode
+ * @op_type:      cache operation type EVICT, FORGET
+ */
+struct cam_sys_cache_info {
+	uint32_t                         ref_cnt;
+	enum cam_sys_cache_config_types  type;
+	uint32_t                         uid;
+	size_t                           size;
+	int32_t                          scid;
+	const char                      *name;
+	struct llcc_slice_desc          *slic_desc;
+	uint32_t staling_distance;
+	enum cam_sys_cache_llcc_staling_mode mode;
+	enum cam_sys_cache_llcc_staling_op_type op_type;
+
+};
+
+
+/**
+ * struct cam_cpas_smart_qos_info : Smart QOS info
+ *
+ * @rt_wr_priority_min:      Minimum priority value for rt write nius
+ * @rt_wr_priority_max:      Maximum priority value for rt write nius
+ * @rt_wr_priority_clamp:    Clamp priority value for rt write nius
+ * @rt_wr_slope_factor:      Slope factor value for rt write nius
+ * @leaststressed_clamp_th:  Leaststressed clamp threshold value for rt write nius
+ * @moststressed_clamp_th:   Moststressed clamp threshold value for rt write nius
+ * @highstress_indicator_th: Highstress indicator threshold value for rt write nius
+ * @lowstress_indicator_th:  Lowstress indicator threshold value for rt write nius
+ * @bw_ratio_scale_factor:   BW ratio scale factor value for rt write nius
+ * @num_rt_wr_nius:          Number of rt write nius
+ * @rt_wr_niu_node:          List of level1 nodes representing rt write nius
+ */
+struct cam_cpas_smart_qos_info {
+	uint8_t rt_wr_priority_min;
+	uint8_t rt_wr_priority_max;
+	uint8_t rt_wr_priority_clamp;
+	uint8_t rt_wr_slope_factor;
+	uint8_t leaststressed_clamp_th;
+	uint8_t moststressed_clamp_th;
+	uint8_t highstress_indicator_th;
+	uint8_t lowstress_indicator_th;
+	uint8_t bw_ratio_scale_factor;
+	uint8_t num_rt_wr_nius;
+	struct cam_cpas_tree_node *rt_wr_niu_node[CAM_CPAS_MAX_RT_WR_NIU_NODES];
+};
+
+/**
+ * struct cam_cpas_domain_id_mapping : Domain id mapping
+ *
+ * @domain_type: Domain type, currently defined as two,
+ *               secure/non-secure. This will be expanded
+ *               later to more types, and correspnding ID
+ * @mapping_id: ID of domain type
+ */
+struct cam_cpas_domain_id_mapping {
+	uint32_t domain_type;
+	uint32_t mapping_id;
+};
+
+/**
+ * struct cam_cpas_domain_id_info : Stores all information related
+ *                                  to domain-id support
+ * @domain_id_entries: Stores mapping between domain types and their IDs
+ * @num_domain_ids: Num of domain id types found from dtsi
+ * @domain_id_supported: Whether domain id is supported
+ */
+struct cam_cpas_domain_id_info {
+	struct cam_cpas_domain_id_mapping *domain_id_entries;
+	uint32_t num_domain_ids;
+	bool domain_id_supported;
+};
+
+/**
+ * struct cam_cpas_domain_id_support_clks : Stores all information
+ *                                          related to clocks
+ *                                          needed to turn on SWIs
+ *                                          for domain id programming
+ * @clk_names:   Clock names as declared in DT
+ * @clk_idx:     Corresponding clk index as declared in DT
+ * @number_clks: Number of clocks declared to turn all CSIDs
+ */
+struct cam_cpas_domain_id_support_clks {
+	const char *clk_names[CAM_SOC_MAX_OPT_CLK];
+	int32_t clk_idx[CAM_SOC_MAX_OPT_CLK];
+	int number_clks;
+};
+
+/**
+ * struct cam_cpas_soc_irq_data: irq data to be passed in irq handler from ISR
+ *
+ * @cpas_hw: cpas hw info
+ * @camnoc_type: type of camnoc associated with the irq
+ *
+ */
+struct cam_cpas_soc_irq_data {
+	struct cam_hw_info *cpas_hw;
+	enum cam_camnoc_hw_type camnoc_type;
+};
+
+/**
+ * struct cam_cpas_sysfs_info - cpas sysfs info
+ *
+ * @kobj:          Kobj for camera directory
+ * @num_ifes:      Number of available and functional IFEs
+ * @num_ife_lites: Number of available and functional IFE-LITEs
+ * @num_sfes:      Number of available and functional SFEs
+ * @num_custom:    Number of available and functional CUSTOM
+ */
+struct cam_cpas_sysfs_info {
+	struct kobject *kobj;
+	uint32_t        num_ifes[CAM_CPAS_NUM_SUBPARTS_MAX_TYPES];
+	uint32_t        num_ife_lites[CAM_CPAS_NUM_SUBPARTS_MAX_TYPES];
+	uint32_t        num_sfes[CAM_CPAS_NUM_SUBPARTS_MAX_TYPES];
+	uint32_t        num_custom[CAM_CPAS_NUM_SUBPARTS_MAX_TYPES];
+};
+
+/**
+ * struct cam_cpas_private_soc : CPAS private DT info
+ *
+ * @arch_compat: ARCH compatible string
+ * @client_id_based: Whether clients are id based
+ * @bus_icc_based: Interconnect based bus interaction
+ * @use_cam_icc_path_str: Indicates if AXI path from interconnect is taken based on
+ *                       cam specified property
+ * @num_clients: Number of clients supported
+ * @client_name: Client names
+ * @tree_node: Array of pointers to all tree nodes required to calculate
+ *      axi bw, arranged with help of cell index in device tree
+ * @camera_bus_node: Device tree node from cpas node
+ * @level_node: Device tree node for each level in camera_bus_node
+ * @num_vdd_ahb_mapping : Number of vdd to ahb level mapping supported
+ * @vdd_ahb : AHB level mapping info for the supported vdd levels
+ * @control_camnoc_axi_clk : Whether CPAS driver need to set camnoc axi clk freq
+ * @camnoc_bus_width : CAMNOC Bus width
+ * @camnoc_axi_clk_bw_margin : BW Margin in percentage to add while calculating
+ *      camnoc axi clock
+ * @camnoc_axi_min_ib_bw: Min camnoc BW which varies based on target
+ * @fuse_info: fuse information
+ * @sysfs_info: Camera subparts sysfs information
+ * @rpmh_info: RPMH BCM info
+ * @num_feature_info: number of feature_info entries
+ * @feature_info: Structure for storing feature information
+ * @num_caches: Number of last level caches
+ * @part_info: Camera Hw subpart info
+ * @llcc_info: Cache info
+ * @enable_secure_qos_update: whether to program QoS securely on current chipset
+ * @enable_smart_qos: Whether to enable Smart QoS mechanism on current chipset
+ * @enable_cam_ddr_drv: Whether to enable Camera DDR DRV on current chipset
+ * @enable_cam_clk_drv: Whether to enable Camera Clk DRV on current chipset
+ * @smart_qos_info: Pointer to smart qos info
+ * @icp_clk_index: Index of optional icp clk
+ * @domain_id_info: Stores all information related to domain id support
+ * @domain_id_clks: All clock related information for domain id support
+ * @irq_data: array of data for each irq line to be passed in irq handler
+ */
+struct cam_cpas_private_soc {
+	const char *arch_compat;
+	bool client_id_based;
+	bool bus_icc_based;
+	bool use_cam_icc_path_str;
+	uint32_t num_clients;
+	const char *client_name[CAM_CPAS_MAX_CLIENTS];
+	struct cam_cpas_tree_node *tree_node[CAM_CPAS_MAX_TREE_NODES];
+	struct device_node *camera_bus_node;
+	struct device_node *level_node[CAM_CPAS_MAX_TREE_LEVELS];
+	uint32_t num_vdd_ahb_mapping;
+	struct cam_cpas_vdd_ahb_mapping vdd_ahb[CAM_REGULATOR_LEVEL_MAX];
+	bool control_camnoc_axi_clk;
+	uint32_t camnoc_bus_width;
+	uint32_t camnoc_axi_clk_bw_margin;
+	uint64_t camnoc_axi_min_ib_bw;
+	struct cam_cpas_fuse_info fuse_info;
+	struct cam_cpas_sysfs_info sysfs_info;
+	uint32_t rpmh_info[CAM_RPMH_BCM_INFO_MAX];
+	uint32_t num_feature_info;
+	struct cam_cpas_feature_info  feature_info[CAM_CPAS_MAX_FUSE_FEATURE];
+	uint32_t num_caches;
+	uint32_t part_info;
+	struct cam_sys_cache_info *llcc_info;
+	bool enable_secure_qos_update;
+	bool enable_smart_qos;
+	bool enable_cam_ddr_drv;
+	bool enable_cam_clk_drv;
+	struct cam_cpas_smart_qos_info *smart_qos_info;
+	int32_t icp_clk_index;
+	struct cam_cpas_domain_id_info domain_id_info;
+	struct cam_cpas_domain_id_support_clks *domain_id_clks;
+	struct cam_cpas_soc_irq_data *irq_data;
+};
+
+void cam_cpas_dump_tree_vote_info(struct cam_hw_info *cpas_hw,
+	const struct cam_cpas_tree_node *tree_node,
+	const char *identifier, int ddr_drv_idx, int cesta_drv_idx);
+void cam_cpas_dump_full_tree_state(struct cam_hw_info *cpas_hw, const char *identifier);
+
+void cam_cpas_util_debug_parse_data(struct cam_cpas_private_soc *soc_private);
+void cam_cpas_dump_axi_vote_info(
+	const struct cam_cpas_client *cpas_client,
+	const char *identifier,
+	struct cam_axi_vote *axi_vote);
+int cam_cpas_node_tree_cleanup(struct cam_cpas *cpas_core,
+	struct cam_cpas_private_soc *soc_private);
+int cam_cpas_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t vfe_irq_handler, struct cam_hw_info *cpas_hw);
+int cam_cpas_soc_deinit_resources(struct cam_hw_soc_info *soc_info);
+int cam_cpas_soc_enable_resources(struct cam_hw_soc_info *soc_info,
+	enum cam_vote_level default_level);
+int cam_cpas_soc_disable_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clocks, bool disable_irq);
+int cam_cpas_soc_disable_irq(struct cam_hw_soc_info *soc_info);
+#endif /* _CAM_CPAS_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/camss_top/cam_camsstop_hw.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/camss_top/cam_camsstop_hw.c
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2018, 2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_hw.h"
+#include "cam_cpas_soc.h"
+
+int cam_camsstop_get_hw_info(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_hw_caps *hw_caps)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int32_t reg_indx = cpas_core->regbase_index[CAM_CPAS_REG_CAMSS];
+	uint32_t reg_value;
+
+	if (reg_indx == -1)
+		return -EINVAL;
+
+	hw_caps->camera_family = CAM_FAMILY_CAMERA_SS;
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base + 0x0);
+	hw_caps->camera_version.major =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1c);
+	hw_caps->camera_version.minor =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->camera_version.incr =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	CAM_DBG(CAM_FD, "Family %d, version %d.%d.%d",
+		hw_caps->camera_family, hw_caps->camera_version.major,
+		hw_caps->camera_version.minor, hw_caps->camera_version.incr);
+
+	return 0;
+}
+
+int cam_camsstop_setup_regbase_indices(struct cam_hw_soc_info *soc_info,
+	int32_t regbase_index[], int32_t num_reg_map)
+{
+	uint32_t index;
+	int rc;
+
+	if (num_reg_map > CAM_CPAS_REG_MAX) {
+		CAM_ERR(CAM_CPAS, "invalid num_reg_map=%d", num_reg_map);
+		return -EINVAL;
+	}
+
+	if (soc_info->num_mem_block > CAM_SOC_MAX_BLOCK) {
+		CAM_ERR(CAM_CPAS, "invalid num_mem_block=%d",
+			soc_info->num_mem_block);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_camss", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_CAMSS] = index;
+	} else {
+		CAM_ERR(CAM_CPAS, "regbase not found for CAM_CPAS_REG_CAMSS");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_camsstop_get_internal_ops(struct cam_cpas_internal_ops *internal_ops)
+{
+	if (!internal_ops) {
+		CAM_ERR(CAM_CPAS, "invalid NULL param");
+		return -EINVAL;
+	}
+
+	internal_ops->get_hw_info = cam_camsstop_get_hw_info;
+	internal_ops->init_hw_version = NULL;
+	internal_ops->handle_irq = NULL;
+	internal_ops->setup_regbase = cam_camsstop_setup_regbase_indices;
+	internal_ops->power_on = NULL;
+	internal_ops->power_off = NULL;
+	internal_ops->setup_qos_settings = NULL;
+	internal_ops->print_poweron_settings = NULL;
+	internal_ops->qchannel_handshake = NULL;
+	internal_ops->set_tpg_mux_sel = NULL;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cam_cpastop_hw.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cam_cpastop_hw.c
@@ -0,0 +1,1625 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/slab.h>
+
+#include "cam_compat.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_hw.h"
+#include "cam_cpastop_hw.h"
+#include "cam_io_util.h"
+#include "cam_cpas_soc.h"
+#include "cpastop100.h"
+#include "cpastop_v150_100.h"
+#include "cpastop_v170_200.h"
+#include "cpastop_v170_110.h"
+#include "cpastop_v175_100.h"
+#include "cpastop_v175_101.h"
+#include "cpastop_v175_120.h"
+#include "cpastop_v175_130.h"
+#include "cpastop_v480_100.h"
+#include "cpastop_v480_custom.h"
+#include "cpastop_v580_100.h"
+#include "cpastop_v580_custom.h"
+#include "cpastop_v540_100.h"
+#include "cpastop_v520_100.h"
+#include "cpastop_v545_100.h"
+#include "cpastop_v570_100.h"
+#include "cpastop_v570_200.h"
+#include "cpastop_v680_100.h"
+#include "cpastop_v680_110.h"
+#include "cpastop_v165_100.h"
+#include "cpastop_v780_100.h"
+#include "cpastop_v640_200.h"
+#include "cpastop_v640_210.h"
+#include "cpastop_v880_100.h"
+#include "cpastop_v980_100.h"
+#include "cpastop_v860_100.h"
+#include "cpastop_v770_100.h"
+#include "cpastop_v665_100.h"
+#include "cpastop_v690_100.h"
+#include "cpastop_v692_100.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+struct cam_camnoc_info *camnoc_info[CAM_CAMNOC_HW_TYPE_MAX];
+struct cam_cpas_info *cpas_info;
+struct cam_cpas_camnoc_qchannel *qchannel_info;
+struct cam_cpas_top_regs *cpas_top_info;
+
+#if (defined(CONFIG_CAM_TEST_IRQ_LINE) && defined(CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE))
+	struct completion test_irq_hw_complete[CAM_CAMNOC_HW_TYPE_MAX];
+#endif
+
+#define CAMNOC_SLAVE_MAX_ERR_CODE 7
+static const char * const camnoc_slave_err_code[] = {
+	"Target Error",              /* err code 0 */
+	"Address decode error",      /* err code 1 */
+	"Unsupported request",       /* err code 2 */
+	"Disconnected target",       /* err code 3 */
+	"Security violation",        /* err code 4 */
+	"Hidden security violation", /* err code 5 */
+	"Timeout Error",             /* err code 6 */
+	"Unknown Error",             /* unknown err code */
+};
+
+static const uint32_t cam_cpas_hw_version_map
+	[CAM_CPAS_CAMERA_VERSION_ID_MAX][CAM_CPAS_VERSION_ID_MAX] = {
+	/* for camera_150 */
+	{
+		CAM_CPAS_TITAN_150_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_170 */
+	{
+		CAM_CPAS_TITAN_170_V100,
+		0,
+		CAM_CPAS_TITAN_170_V110,
+		CAM_CPAS_TITAN_170_V120,
+		0,
+		CAM_CPAS_TITAN_170_V200,
+		0,
+	},
+	/* for camera_175 */
+	{
+		CAM_CPAS_TITAN_175_V100,
+		CAM_CPAS_TITAN_175_V101,
+		0,
+		CAM_CPAS_TITAN_175_V120,
+		CAM_CPAS_TITAN_175_V130,
+		0,
+		0,
+	},
+	/* for camera_480 */
+	{
+		CAM_CPAS_TITAN_480_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_580 */
+	{
+		CAM_CPAS_TITAN_580_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_520 */
+	{
+		CAM_CPAS_TITAN_520_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+
+	},
+	/* for camera_540 */
+	{
+		CAM_CPAS_TITAN_540_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_545 */
+	{
+		CAM_CPAS_TITAN_545_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_570 */
+	{
+		CAM_CPAS_TITAN_570_V100,
+		0,
+		0,
+		0,
+		0,
+		CAM_CPAS_TITAN_570_V200,
+		0,
+	},
+	/* for camera_680 */
+	{
+		CAM_CPAS_TITAN_680_V100,
+		0,
+		CAM_CPAS_TITAN_680_V110,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_165 */
+	{
+		CAM_CPAS_TITAN_165_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_780 */
+	{
+		CAM_CPAS_TITAN_780_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_640 */
+	{
+		0,
+		0,
+		0,
+		0,
+		0,
+		CAM_CPAS_TITAN_640_V200,
+		CAM_CPAS_TITAN_640_V210,
+	},
+	/* for camera_880 */
+	{
+		CAM_CPAS_TITAN_880_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_980 */
+	{
+		CAM_CPAS_TITAN_980_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_860 */
+	{
+		CAM_CPAS_TITAN_860_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_770 */
+	{
+		CAM_CPAS_TITAN_770_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_665 */
+	{
+		CAM_CPAS_TITAN_665_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_690 */
+	{
+		CAM_CPAS_TITAN_690_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_692 */
+	{
+		CAM_CPAS_TITAN_692_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+};
+
+static char *cam_cpastop_get_camnoc_name(enum cam_camnoc_hw_type type)
+{
+	switch (type) {
+	case CAM_CAMNOC_HW_COMBINED:
+		return "CAMNOC_COMBINED";
+	case CAM_CAMNOC_HW_RT:
+		return "CAMNOC_RT";
+	case CAM_CAMNOC_HW_NRT:
+		return "CAMNOC_NRT";
+	default:
+		return "Invalid CAMNOC";
+	}
+}
+
+static int cam_cpas_translate_camera_cpas_version_id(
+	uint32_t cam_version,
+	uint32_t cpas_version,
+	uint32_t *cam_version_id,
+	uint32_t *cpas_version_id)
+{
+
+	switch (cam_version) {
+
+	case CAM_CPAS_CAMERA_VERSION_150:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_150;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_170:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_170;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_175:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_175;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_480:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_480;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_520:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_520;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_540:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_540;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_580:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_580;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_545:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_545;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_570:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_570;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_680:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_680;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_165:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_165;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_780:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_780;
+		break;
+	case CAM_CPAS_CAMERA_VERSION_640:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_640;
+		break;
+	case CAM_CPAS_CAMERA_VERSION_880:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_880;
+		break;
+	case CAM_CPAS_CAMERA_VERSION_980:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_980;
+		break;
+	case CAM_CPAS_CAMERA_VERSION_860:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_860;
+		break;
+	case CAM_CPAS_CAMERA_VERSION_770:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_770;
+		break;
+	case CAM_CPAS_CAMERA_VERSION_665:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_665;
+		break;
+	case CAM_CPAS_CAMERA_VERSION_690:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_690;
+		break;
+	case CAM_CPAS_CAMERA_VERSION_692:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_692;
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Invalid cam version %u",
+			cam_version);
+		return -EINVAL;
+	}
+
+	switch (cpas_version) {
+
+	case CAM_CPAS_VERSION_100:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_100;
+		break;
+
+	case CAM_CPAS_VERSION_101:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_101;
+		break;
+	case CAM_CPAS_VERSION_110:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_110;
+		break;
+
+	case CAM_CPAS_VERSION_120:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_120;
+		break;
+
+	case CAM_CPAS_VERSION_130:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_130;
+		break;
+
+	case CAM_CPAS_VERSION_200:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_200;
+		break;
+
+	case CAM_CPAS_VERSION_210:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_210;
+		break;
+
+	default:
+		CAM_ERR(CAM_CPAS, "Invalid cpas version %u",
+			cpas_version);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int cam_cpastop_get_hw_info(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_hw_caps *hw_caps)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int32_t reg_indx = cpas_core->regbase_index[CAM_CPAS_REG_CPASTOP];
+	uint32_t cam_version, cpas_version;
+	uint32_t cam_version_id, cpas_version_id;
+	int rc;
+
+	if (reg_indx == -1) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_caps->camera_family = CAM_FAMILY_CPAS_SS;
+
+	cam_version = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base + 0x0);
+	hw_caps->camera_version.major =
+		CAM_BITS_MASK_SHIFT(cam_version, 0xff0000, 0x10);
+	hw_caps->camera_version.minor =
+		CAM_BITS_MASK_SHIFT(cam_version, 0xff00, 0x8);
+	hw_caps->camera_version.incr =
+		CAM_BITS_MASK_SHIFT(cam_version, 0xff, 0x0);
+
+	cpas_version = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base + 0x4);
+	hw_caps->cpas_version.major =
+		CAM_BITS_MASK_SHIFT(cpas_version, 0xf0000000, 0x1c);
+	hw_caps->cpas_version.minor =
+		CAM_BITS_MASK_SHIFT(cpas_version, 0xfff0000, 0x10);
+	hw_caps->cpas_version.incr =
+		CAM_BITS_MASK_SHIFT(cpas_version, 0xffff, 0x0);
+
+	CAM_DBG(CAM_CPAS, "Family %d, version %d.%d.%d, cpas %d.%d.%d",
+		hw_caps->camera_family, hw_caps->camera_version.major,
+		hw_caps->camera_version.minor, hw_caps->camera_version.incr,
+		hw_caps->cpas_version.major, hw_caps->cpas_version.minor,
+		hw_caps->cpas_version.incr);
+
+	soc_info->hw_version = CAM_CPAS_TITAN_NONE;
+	rc = cam_cpas_translate_camera_cpas_version_id(cam_version,
+		cpas_version, &cam_version_id, &cpas_version_id);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Invalid Version, Camera: 0x%x CPAS: 0x%x",
+			cam_version, cpas_version);
+		return -EINVAL;
+	}
+
+	soc_info->hw_version =
+		cam_cpas_hw_version_map[cam_version_id][cpas_version_id];
+
+	CAM_DBG(CAM_CPAS, "CPAS HW VERSION %x", soc_info->hw_version);
+
+	return 0;
+}
+
+static int cam_cpastop_setup_regbase_indices(struct cam_hw_soc_info *soc_info,
+	int32_t regbase_index[], int32_t num_reg_map)
+{
+	uint32_t index;
+	int rc;
+
+	if (num_reg_map > CAM_CPAS_REG_MAX) {
+		CAM_ERR(CAM_CPAS, "invalid num_reg_map=%d", num_reg_map);
+		return -EINVAL;
+	}
+
+	if (soc_info->num_mem_block > CAM_SOC_MAX_BLOCK) {
+		CAM_ERR(CAM_CPAS, "invalid num_mem_block=%d",
+			soc_info->num_mem_block);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_cpas_top", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_CPASTOP] = index;
+	} else if (rc) {
+		CAM_ERR(CAM_CPAS, "failed to get index for CPASTOP rc=%d", rc);
+		return rc;
+	} else {
+		CAM_ERR(CAM_CPAS, "regbase not found for CPASTOP, rc=%d, %d %d",
+			rc, index, num_reg_map);
+		return -EINVAL;
+	}
+
+	/*
+	 * camnoc reg base represents reg base for legacy camnoc, this becomes optional since
+	 * some targets have camnoc split into RT/NRT
+	 */
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_camnoc", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_CAMNOC] = index;
+		CAM_DBG(CAM_CPAS, "regbase found for CAMNOC, rc=%d, %d %d",
+			rc, index, num_reg_map);
+	}  else {
+		CAM_DBG(CAM_CPAS, "regbase not found for CAMNOC, rc=%d, %d %d",
+			rc, index, num_reg_map);
+		regbase_index[CAM_CPAS_REG_CAMNOC] = -1;
+	}
+
+	/* optional - reg base for a target where camnoc reg is split into two domains: rt/nrt */
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_camnoc_rt", &index);
+	if ((rc == 0) &&  (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_CAMNOC_RT] = index;
+		CAM_DBG(CAM_CPAS, "regbase found for CAMNOC RT, rc=%d, %d %d",
+			rc, index, num_reg_map);
+	} else {
+		CAM_DBG(CAM_CPAS, "regbase not found for CAMNOC RT, rc=%d, %d %d",
+			rc, index, num_reg_map);
+		regbase_index[CAM_CPAS_REG_CAMNOC_RT] = -1;
+	}
+
+	/* optional - reg base for a target where camnoc reg is split into two domains: rt/nrt */
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_camnoc_nrt", &index);
+	if ((rc == 0) &&  (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_CAMNOC_NRT] = index;
+		CAM_DBG(CAM_CPAS, "regbase found for CAMNOC NRT, rc=%d, %d %d",
+			rc, index, num_reg_map);
+	} else {
+		CAM_DBG(CAM_CPAS, "regbase not found for CAMNOC NRT, rc=%d, %d %d",
+			rc, index, num_reg_map);
+		regbase_index[CAM_CPAS_REG_CAMNOC_NRT] = -1;
+	}
+
+	/* optional - rpmh register map */
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_rpmh", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_RPMH] = index;
+		CAM_DBG(CAM_CPAS, "regbase found for RPMH, rc=%d, %d %d",
+			rc, index, num_reg_map);
+	} else {
+		CAM_DBG(CAM_CPAS, "regbase not found for RPMH, rc=%d, %d %d",
+			rc, index, num_reg_map);
+		regbase_index[CAM_CPAS_REG_RPMH] = -1;
+	}
+
+	/* optional - cesta register map */
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_cesta", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_CESTA] = index;
+		CAM_DBG(CAM_CPAS, "regbase found for cesta, rc=%d, %d %d",
+			rc, index, num_reg_map);
+	} else {
+		CAM_DBG(CAM_CPAS, "regbase not found for cesta, rc=%d, %d %d",
+			rc, index, num_reg_map);
+		regbase_index[CAM_CPAS_REG_CESTA] = -1;
+	}
+
+	return 0;
+}
+
+static int cam_cpastop_handle_errlogger(int camnoc_idx,
+	struct cam_cpas *cpas_core, struct cam_hw_soc_info *soc_info,
+	struct cam_camnoc_irq_slave_err_data *slave_err)
+{
+	int regbase_idx = cpas_core->regbase_index[camnoc_info[camnoc_idx]->reg_base];
+	int err_code_index = 0;
+
+	if (!camnoc_info[camnoc_idx]->err_logger) {
+		CAM_ERR_RATE_LIMIT(CAM_CPAS, "Invalid err logger info");
+		return -EINVAL;
+	}
+
+	slave_err->errlog0_low.value = cam_io_r_mb(
+		soc_info->reg_map[regbase_idx].mem_base +
+		camnoc_info[camnoc_idx]->err_logger->errlog0_low);
+
+	err_code_index = slave_err->errlog0_low.err_code;
+	if (err_code_index > CAMNOC_SLAVE_MAX_ERR_CODE)
+		err_code_index = CAMNOC_SLAVE_MAX_ERR_CODE;
+
+	CAM_ERR_RATE_LIMIT(CAM_CPAS,
+		"[%s] Possible memory configuration issue, fault at SMMU raised as CAMNOC SLAVE_IRQ err_code=%d(%s)",
+		camnoc_info[camnoc_idx]->camnoc_name, slave_err->errlog0_low.err_code,
+		camnoc_slave_err_code[err_code_index]);
+
+	return 0;
+}
+
+static int cam_cpastop_handle_ubwc_enc_err(int camnoc_idx,
+	struct cam_cpas *cpas_core, struct cam_hw_soc_info *soc_info, int i,
+	struct cam_camnoc_irq_ubwc_enc_data *enc_err)
+{
+	int regbase_idx = cpas_core->regbase_index[camnoc_info[camnoc_idx]->reg_base];
+
+	enc_err->encerr_status.value =
+		cam_io_r_mb(soc_info->reg_map[regbase_idx].mem_base +
+			camnoc_info[camnoc_idx]->irq_err[i].err_status.offset);
+
+	/* Let clients handle the UBWC errors */
+	CAM_DBG(CAM_CPAS,
+		"[%s] ubwc enc err [%d]: offset[0x%x] value[0x%x]",
+		camnoc_info[camnoc_idx]->camnoc_name, i,
+		camnoc_info[camnoc_idx]->irq_err[i].err_status.offset,
+		enc_err->encerr_status.value);
+
+	return 0;
+}
+
+static int cam_cpastop_handle_ubwc_dec_err(int camnoc_idx,
+	struct cam_cpas *cpas_core, struct cam_hw_soc_info *soc_info, int i,
+	struct cam_camnoc_irq_ubwc_dec_data *dec_err)
+{
+	int regbase_idx = cpas_core->regbase_index[camnoc_info[camnoc_idx]->reg_base];
+
+	dec_err->decerr_status.value =
+		cam_io_r_mb(soc_info->reg_map[regbase_idx].mem_base +
+		camnoc_info[camnoc_idx]->irq_err[i].err_status.offset);
+
+	/* Let clients handle the UBWC errors */
+	CAM_DBG(CAM_CPAS,
+		"[%s] ubwc dec err status [%d]: offset[0x%x] value[0x%x] thr_err=%d, fcl_err=%d, len_md_err=%d, format_err=%d",
+		camnoc_info[camnoc_idx]->camnoc_name, i,
+		camnoc_info[camnoc_idx]->irq_err[i].err_status.offset, dec_err->decerr_status.value,
+		dec_err->decerr_status.thr_err, dec_err->decerr_status.fcl_err,
+		dec_err->decerr_status.len_md_err, dec_err->decerr_status.format_err);
+
+	return 0;
+}
+
+static int cam_cpastop_handle_ahb_timeout_err(int camnoc_idx,
+	struct cam_hw_info *cpas_hw, struct cam_camnoc_irq_ahb_timeout_data *ahb_err)
+{
+	CAM_ERR_RATE_LIMIT(CAM_CPAS, "[%s] ahb timeout error",
+		camnoc_info[camnoc_idx]->camnoc_name);
+
+	return 0;
+}
+
+#if (defined(CONFIG_CAM_TEST_IRQ_LINE) && defined(CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE))
+static int cam_cpastop_enable_test_irq(int camnoc_idx,
+	struct cam_hw_info *cpas_hw)
+{
+	int i;
+
+	camnoc_info[camnoc_idx]->irq_sbm->sbm_enable.value |=
+		camnoc_info[camnoc_idx]->test_irq_info.sbm_enable_mask;
+	camnoc_info[camnoc_idx]->irq_sbm->sbm_clear.value |=
+		camnoc_info[camnoc_idx]->test_irq_info.sbm_clear_mask;
+
+	for (i = 0; i < camnoc_info[camnoc_idx]->irq_err_size; i++) {
+		if (camnoc_info[camnoc_idx]->irq_err[i].irq_type ==
+			CAM_CAMNOC_HW_IRQ_CAMNOC_TEST)
+			camnoc_info[camnoc_idx]->irq_err[i].enable = true;
+	}
+
+	return 0;
+}
+
+static int cam_cpastop_disable_test_irq(int camnoc_idx,
+	struct cam_hw_info *cpas_hw)
+{
+	int i;
+
+	camnoc_info[camnoc_idx]->irq_sbm->sbm_enable.value &=
+		~camnoc_info[camnoc_idx]->test_irq_info.sbm_enable_mask;
+	camnoc_info[camnoc_idx]->irq_sbm->sbm_clear.value &=
+		~camnoc_info[camnoc_idx]->test_irq_info.sbm_clear_mask;
+
+	for (i = 0; i < camnoc_info[camnoc_idx]->irq_err_size; i++) {
+		if (camnoc_info[camnoc_idx]->irq_err[i].irq_type ==
+			CAM_CAMNOC_HW_IRQ_CAMNOC_TEST)
+			camnoc_info[camnoc_idx]->irq_err[i].enable = false;
+	}
+
+	return 0;
+}
+
+static void cam_cpastop_check_test_irq(int camnoc_idx,
+	struct cam_hw_info *cpas_hw, uint32_t irq_status)
+{
+	int i;
+
+	for (i = 0; i < camnoc_info[camnoc_idx]->irq_err_size; i++) {
+		if ((camnoc_info[camnoc_idx]->irq_err[i].irq_type ==
+			CAM_CAMNOC_HW_IRQ_CAMNOC_TEST) &&
+			(irq_status & camnoc_info[camnoc_idx]->irq_err[i].sbm_port) &&
+			(camnoc_info[camnoc_idx]->irq_err[i].enable)) {
+			complete(&test_irq_hw_complete[camnoc_idx]);
+			CAM_INFO(CAM_CPAS, "[%s] Test IRQ triggerred",
+				camnoc_info[camnoc_idx]->camnoc_name);
+		}
+	}
+}
+#endif
+
+static void cam_cpastop_enable_camnoc_irqs(
+	struct cam_hw_info *cpas_hw, int camnoc_idx)
+{
+	int i;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+
+	cpas_core->smmu_fault_handled = false;
+
+	/* clear and enable all irq errors */
+	for (i = 0; i < camnoc_info[camnoc_idx]->irq_err_size; i++) {
+		if (camnoc_info[camnoc_idx]->irq_err[i].enable) {
+			cam_cpas_util_reg_update(cpas_hw, camnoc_info[camnoc_idx]->reg_base,
+				&camnoc_info[camnoc_idx]->irq_err[i].err_clear);
+			cam_cpas_util_reg_update(cpas_hw, camnoc_info[camnoc_idx]->reg_base,
+				&camnoc_info[camnoc_idx]->irq_err[i].err_enable);
+		}
+	}
+
+	/* On poweron reset enable all error irqs applicable for the target */
+	cam_cpas_util_reg_update(cpas_hw, camnoc_info[camnoc_idx]->reg_base,
+		&camnoc_info[camnoc_idx]->irq_sbm->sbm_enable);
+}
+
+static void cam_cpastop_handle_camnoc_irqs(uint32_t irq_status,
+	struct cam_hw_info *cpas_hw, int camnoc_idx)
+{
+	int i, regbase_idx;
+	struct cam_cpas *cpas_core = cpas_hw->core_info;
+	uint32_t updated_sbm_mask = 0;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	enum cam_cpas_reg_base reg_base;
+
+	reg_base = camnoc_info[camnoc_idx]->reg_base;
+	regbase_idx = cpas_core->regbase_index[reg_base];
+
+	for (i = 0; i < camnoc_info[camnoc_idx]->irq_err_size; i++) {
+		if ((camnoc_info[camnoc_idx]->irq_err[i].enable) &&
+			(camnoc_info[camnoc_idx]->irq_err[i].sbm_port & irq_status)) {
+			/* Clear the error status */
+			cam_cpas_util_reg_update(cpas_hw, reg_base,
+				&camnoc_info[camnoc_idx]->irq_err[i].err_clear);
+			updated_sbm_mask |= camnoc_info[camnoc_idx]->irq_err[i].sbm_port;
+		}
+	}
+
+	/* Disable all serviced irqs, all disabled irqs are enabled only when CPAS restarts */
+	cam_io_w(((~updated_sbm_mask) & (camnoc_info[camnoc_idx]->irq_sbm->sbm_enable.value)),
+		soc_info->reg_map[regbase_idx].mem_base +
+		camnoc_info[camnoc_idx]->irq_sbm->sbm_enable.offset);
+}
+
+static int cam_cpastop_reset_irq(uint32_t irq_status,
+	struct cam_hw_info *cpas_hw, int camnoc_idx)
+{
+#if (defined(CONFIG_CAM_TEST_IRQ_LINE) && defined(CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE))
+	static int counter[CAM_CAMNOC_HW_TYPE_MAX] = {0};
+	bool wait_for_irq = false;
+
+	if (counter[camnoc_idx] == 0)  {
+		CAM_INFO(CAM_CPAS, "Enabling %s test irq",
+			camnoc_info[camnoc_idx]->camnoc_name);
+		cam_cpastop_enable_test_irq(camnoc_idx, cpas_hw);
+		wait_for_irq = true;
+		init_completion(&test_irq_hw_complete[camnoc_idx]);
+		counter[camnoc_idx] = 1;
+	} else if (counter[camnoc_idx] == 1) {
+		CAM_INFO(CAM_CPAS, "Disabling %s test irq",
+			camnoc_info[camnoc_idx]->camnoc_name);
+		cam_cpastop_disable_test_irq(camnoc_idx, cpas_hw);
+		counter[camnoc_idx] = 2;
+	}
+#endif
+
+	if (!camnoc_info[camnoc_idx]->irq_sbm->sbm_enable.enable)
+		return 0;
+
+	cam_cpas_util_reg_update(cpas_hw, camnoc_info[camnoc_idx]->reg_base,
+		&camnoc_info[camnoc_idx]->irq_sbm->sbm_clear);
+
+	if (irq_status)
+		cam_cpastop_handle_camnoc_irqs(irq_status, cpas_hw, camnoc_idx);
+	else
+		/* poweron reset */
+		cam_cpastop_enable_camnoc_irqs(cpas_hw, camnoc_idx);
+
+#if (defined(CONFIG_CAM_TEST_IRQ_LINE) && defined(CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE))
+	if (wait_for_irq) {
+		if (!cam_common_wait_for_completion_timeout(&test_irq_hw_complete[camnoc_idx],
+			msecs_to_jiffies(2000)))
+			CAM_ERR(CAM_CPAS, "[%s] CAMNOC Test IRQ line verification timed out",
+				camnoc_info[camnoc_idx]->camnoc_name);
+		CAM_INFO(CAM_CPAS, "[%s] IRQ test Success",
+			camnoc_info[camnoc_idx]->camnoc_name);
+	}
+#endif
+
+	return 0;
+}
+
+static void cam_cpastop_notify_clients(struct cam_cpas *cpas_core,
+	struct cam_cpas_irq_data *irq_data, bool force_notify)
+{
+	int i;
+	struct cam_cpas_client *cpas_client;
+	bool error_handled = false;
+
+	CAM_DBG(CAM_CPAS,
+		"Notify CB : num_clients=%d, registered=%d, started=%d",
+		cpas_core->num_clients, cpas_core->registered_clients,
+		cpas_core->streamon_clients);
+
+	for (i = 0; i < cpas_core->num_clients; i++) {
+		if (CAM_CPAS_CLIENT_STARTED(cpas_core, i)) {
+			cpas_client = cpas_core->cpas_client[i];
+			if (cpas_client->data.cam_cpas_client_cb) {
+				CAM_DBG(CAM_CPAS,
+					"Calling client CB %d : %d",
+					i, irq_data->irq_type);
+				error_handled =
+					cpas_client->data.cam_cpas_client_cb(
+					cpas_client->data.client_handle,
+					cpas_client->data.userdata,
+					irq_data);
+				if (error_handled && !force_notify)
+					break;
+			}
+		}
+	}
+}
+
+static void cam_cpastop_work(struct work_struct *work)
+{
+	struct cam_cpas_work_payload *payload;
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	struct cam_hw_soc_info *soc_info;
+	int i;
+	enum cam_camnoc_hw_irq_type irq_type;
+	struct cam_cpas_irq_data irq_data;
+	int camnoc_idx;
+
+	payload = container_of(work, struct cam_cpas_work_payload, work);
+	if (!payload) {
+		CAM_ERR(CAM_CPAS, "NULL payload");
+		return;
+	}
+
+	camnoc_idx = payload->camnoc_idx;
+	cam_common_util_thread_switch_delay_detect(
+		"cam_cpas_workq", "schedule", cam_cpastop_work,
+		payload->workq_scheduled_ts,
+		CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+
+	cpas_hw = payload->hw;
+	cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	soc_info = &cpas_hw->soc_info;
+
+	if (!atomic_inc_not_zero(&cpas_core->soc_access_count)) {
+		CAM_ERR(CAM_CPAS, "CPAS off");
+		return;
+	}
+
+	for (i = 0; i < camnoc_info[camnoc_idx]->irq_err_size; i++) {
+		if ((payload->irq_status & camnoc_info[camnoc_idx]->irq_err[i].sbm_port) &&
+			(camnoc_info[camnoc_idx]->irq_err[i].enable)) {
+			irq_type = camnoc_info[camnoc_idx]->irq_err[i].irq_type;
+			CAM_ERR_RATE_LIMIT(CAM_CPAS,
+				"Error occurred, irq type=%d", irq_type);
+			memset(&irq_data, 0x0, sizeof(irq_data));
+			irq_data.irq_type = (enum cam_camnoc_irq_type)irq_type;
+
+			switch (irq_type) {
+			case CAM_CAMNOC_HW_IRQ_SLAVE_ERROR:
+				cam_cpastop_handle_errlogger(camnoc_idx,
+					cpas_core, soc_info,
+					&irq_data.u.slave_err);
+				break;
+			case CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_OFE_UBWC_WRITE_ENCODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_TFE_UBWC_ENCODE_ERROR:
+				cam_cpastop_handle_ubwc_enc_err(camnoc_idx,
+					cpas_core, soc_info, i,
+					&irq_data.u.enc_err);
+				break;
+			case CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_OFE_UBWC_READ_DECODE_ERROR:
+				cam_cpastop_handle_ubwc_dec_err(camnoc_idx,
+					cpas_core, soc_info, i,
+					&irq_data.u.dec_err);
+				break;
+			case CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT:
+				cam_cpastop_handle_ahb_timeout_err(camnoc_idx,
+					cpas_hw, &irq_data.u.ahb_err);
+				break;
+			case CAM_CAMNOC_HW_IRQ_CAMNOC_TEST:
+				CAM_INFO(CAM_CPAS, "TEST IRQ for %s",
+					camnoc_info[camnoc_idx]->camnoc_name);
+				break;
+			default:
+				CAM_ERR(CAM_CPAS, "Invalid IRQ type: %u", irq_type);
+				break;
+			}
+
+			cam_cpastop_notify_clients(cpas_core, &irq_data, false);
+
+			payload->irq_status &=
+				~camnoc_info[camnoc_idx]->irq_err[i].sbm_port;
+		}
+	}
+	atomic_dec(&cpas_core->soc_access_count);
+	wake_up(&cpas_core->soc_access_count_wq);
+	CAM_DBG(CAM_CPAS, "soc_access_count=%d\n", atomic_read(&cpas_core->soc_access_count));
+
+	if (payload->irq_status)
+		CAM_ERR(CAM_CPAS, "%s IRQ not handled irq_status=0x%x",
+			camnoc_info[camnoc_idx]->camnoc_name, payload->irq_status);
+
+	kfree(payload);
+}
+
+static irqreturn_t cam_cpastop_handle_irq(int irq_num, void *data)
+{
+	struct cam_cpas_soc_irq_data *soc_irq_data = data;
+	struct cam_hw_info *cpas_hw = soc_irq_data->cpas_hw;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int regbase_idx, slave_err_irq_idx, camnoc_idx;
+	struct cam_cpas_work_payload *payload;
+	struct cam_cpas_irq_data irq_data;
+	enum cam_camnoc_hw_type camnoc_type;
+
+	if (!atomic_inc_not_zero(&cpas_core->soc_access_count)) {
+		CAM_ERR(CAM_CPAS, "CPAS off");
+		return IRQ_HANDLED;
+	}
+
+	camnoc_type = soc_irq_data->camnoc_type;
+	if ((camnoc_type < 0) || (camnoc_type >= CAM_CAMNOC_HW_TYPE_MAX)) {
+		CAM_ERR(CAM_CPAS, "Invalid camnoc type: %d", camnoc_type);
+		goto done;
+	}
+
+	camnoc_idx = cpas_core->camnoc_info_idx[camnoc_type];
+	if ((camnoc_idx < 0) || (camnoc_idx >= cpas_core->num_valid_camnoc)) {
+		CAM_ERR(CAM_CPAS, "Invalid camnoc idx: %d", camnoc_idx);
+		goto done;
+	}
+
+	payload = kzalloc(sizeof(struct cam_cpas_work_payload), GFP_ATOMIC);
+	if (!payload)
+		goto done;
+
+	regbase_idx = cpas_core->regbase_index[camnoc_info[camnoc_idx]->reg_base];
+
+	payload->irq_status = cam_io_r_mb(soc_info->reg_map[regbase_idx].mem_base +
+		camnoc_info[camnoc_idx]->irq_sbm->sbm_status.offset);
+	payload->camnoc_idx = camnoc_idx;
+
+	CAM_DBG(CAM_CPAS, "IRQ callback of %s irq_status=0x%x",
+		camnoc_info[camnoc_idx]->camnoc_name, payload->irq_status);
+
+#if (defined(CONFIG_CAM_TEST_IRQ_LINE) && defined(CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE))
+	cam_cpastop_check_test_irq(camnoc_idx, cpas_hw, payload->irq_status);
+#endif
+
+	/* Clear irq */
+	cam_cpastop_reset_irq(payload->irq_status, cpas_hw, camnoc_idx);
+
+	slave_err_irq_idx = cpas_core->slave_err_irq_idx[camnoc_idx];
+
+	/* Check for slave error irq */
+	if ((cpas_core->slave_err_irq_en[camnoc_idx]) && (payload->irq_status  &
+		camnoc_info[camnoc_idx]->irq_err[slave_err_irq_idx].sbm_port)) {
+		struct cam_camnoc_irq_slave_err_data *slave_err = &irq_data.u.slave_err;
+
+		irq_data.irq_type = (enum cam_camnoc_irq_type)
+			camnoc_info[camnoc_idx]->irq_err[slave_err_irq_idx].irq_type;
+		slave_err->errlog0_low.value = cam_io_r_mb(
+			soc_info->reg_map[regbase_idx].mem_base +
+			camnoc_info[camnoc_idx]->err_logger->errlog0_low);
+
+		/* Validate address decode error */
+		if (slave_err->errlog0_low.err_code == CAM_CAMNOC_ADDRESS_DECODE_ERROR) {
+			/* Notify clients about potential page fault */
+			if (!cpas_core->smmu_fault_handled) {
+				cam_cpastop_notify_clients(cpas_core, &irq_data, true);
+				CAM_ERR_RATE_LIMIT(CAM_CPAS,
+					"Fault at SMMU raised as CAMNOC SLAVE IRQ, address decode error");
+			}
+
+			cpas_core->smmu_fault_handled = true;
+			/* Skip bh if no other irq is set */
+			payload->irq_status &=
+				~camnoc_info[camnoc_idx]->irq_err[slave_err_irq_idx].sbm_port;
+			if (!payload->irq_status) {
+				kfree(payload);
+				goto done;
+			}
+		}
+	}
+
+	payload->hw = cpas_hw;
+	INIT_WORK((struct work_struct *)&payload->work, cam_cpastop_work);
+
+	payload->workq_scheduled_ts = ktime_get();
+	queue_work(cpas_core->work_queue, &payload->work);
+
+done:
+	atomic_dec(&cpas_core->soc_access_count);
+	wake_up(&cpas_core->soc_access_count_wq);
+
+	return IRQ_HANDLED;
+}
+
+static int cam_cpastop_print_poweron_settings(struct cam_hw_info *cpas_hw)
+{
+	int i, j;
+	enum cam_cpas_reg_base reg_base;
+	struct cam_cpas *cpas_core = cpas_hw->core_info;
+
+	for (i = 0; i < cpas_core->num_valid_camnoc; i++) {
+		CAM_INFO(CAM_CPAS, "QOS settings for %s :",
+			camnoc_info[i]->camnoc_name);
+		for (j = 0; j < camnoc_info[i]->specific_size; j++) {
+			if (camnoc_info[i]->specific[j].enable) {
+				CAM_INFO(CAM_CPAS,
+					"Reading QoS settings port: %d port name: %s",
+					camnoc_info[i]->specific[j].port_type,
+					camnoc_info[i]->specific[j].port_name);
+				reg_base = camnoc_info[i]->reg_base;
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].priority_lut_low);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].priority_lut_high);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].urgency);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].danger_lut);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].safe_lut);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].ubwc_ctl);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].flag_out_set0_low);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].dynattr_mainctl);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].qosgen_mainctl);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].qosgen_shaping_low);
+				cam_cpas_util_reg_read(cpas_hw, reg_base,
+					&camnoc_info[i]->specific[j].qosgen_shaping_high);
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cpastop_poweron(struct cam_hw_info *cpas_hw)
+{
+	int i, j, rc =0;
+	struct cam_cpas *cpas_core = cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+			(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+
+	for (i = 0; i < cpas_core->num_valid_camnoc; i++)
+		cam_cpastop_reset_irq(0x0, cpas_hw, i);
+
+	if (!soc_private->enable_secure_qos_update) {
+		for (i = 0; i < cpas_core->num_valid_camnoc; i++) {
+			CAM_DBG(CAM_CPAS, "QOS settings for %s :",
+				camnoc_info[i]->camnoc_name);
+			for (j = 0; j < camnoc_info[i]->specific_size; j++) {
+				if (camnoc_info[i]->specific[j].enable) {
+					CAM_DBG(CAM_CPAS,
+						"Updating QoS settings port: %d prot name: %s",
+						camnoc_info[i]->specific[j].port_type,
+						camnoc_info[i]->specific[j].port_name);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].priority_lut_low);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].priority_lut_high);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].urgency);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].danger_lut);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].safe_lut);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].ubwc_ctl);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].flag_out_set0_low);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].dynattr_mainctl);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].qosgen_mainctl);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].qosgen_shaping_low);
+					cam_cpas_util_reg_update(cpas_hw, camnoc_info[i]->reg_base,
+						&camnoc_info[i]->specific[j].qosgen_shaping_high);
+				}
+			}
+		}
+	} else  {
+		CAM_DBG(CAM_CPAS, "Updating secure camera static QoS settings");
+		rc = cam_update_camnoc_qos_settings(CAM_QOS_UPDATE_TYPE_STATIC, 0, NULL);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Secure camera static OoS update failed: %d", rc);
+		}
+		CAM_DBG(CAM_CPAS, "Updated secure camera static QoS settings");
+	}
+
+	return 0;
+}
+
+static int cam_cpastop_poweroff(struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int camnoc_index, rc = 0;
+	struct cam_cpas_hw_errata_wa_list *errata_wa_list;
+	struct cam_cpas_hw_errata_wa *errata_wa;
+
+	errata_wa_list = camnoc_info[0]->errata_wa_list;
+	if (!errata_wa_list)
+		return 0;
+
+	if (errata_wa_list->camnoc_flush_slave_pending_trans.enable) {
+		errata_wa = &errata_wa_list->camnoc_flush_slave_pending_trans;
+		camnoc_index = cpas_core->regbase_index[camnoc_info[0]->reg_base];
+
+		rc = cam_io_poll_value_wmask(
+			soc_info->reg_map[camnoc_index].mem_base +
+			errata_wa->data.reg_info.offset,
+			errata_wa->data.reg_info.value,
+			errata_wa->data.reg_info.mask,
+			CAM_CPAS_POLL_RETRY_CNT,
+			CAM_CPAS_POLL_MIN_USECS, CAM_CPAS_POLL_MAX_USECS);
+		if (rc) {
+			CAM_DBG(CAM_CPAS,
+				"camnoc flush slave pending trans failed");
+			/* Do not return error, passthrough */
+			rc = 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_cpastop_qchannel_handshake(struct cam_hw_info *cpas_hw,
+	bool power_on, bool force_on)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int32_t reg_indx = cpas_core->regbase_index[CAM_CPAS_REG_CPASTOP];
+	uint32_t mask = 0;
+	uint32_t wait_data, qchannel_status, qdeny;
+	int rc = 0, ret = 0, i;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas_hw_errata_wa_list *errata_wa_list;
+	bool icp_clk_enabled = false;
+	struct cam_cpas_camnoc_qchannel *qchannel_info;
+
+	if (reg_indx == -1)
+		return -EINVAL;
+
+	for (i = 0; i < cpas_info->num_qchannel; i++) {
+		qchannel_info = cpas_info->qchannel_info[i];
+
+		if (!icp_clk_enabled) {
+			errata_wa_list = camnoc_info[i]->errata_wa_list;
+			if (errata_wa_list && errata_wa_list->enable_icp_clk_for_qchannel.enable) {
+				CAM_DBG(CAM_CPAS, "Enabling ICP clk for qchannel handshake");
+
+				if (soc_private->icp_clk_index == -1) {
+					CAM_ERR(CAM_CPAS,
+						"ICP clock not added as optional clk, qchannel handshake will fail");
+				} else {
+					rc = cam_soc_util_clk_enable(soc_info,
+						CAM_CLK_SW_CLIENT_IDX, true,
+						soc_private->icp_clk_index, -1);
+					if (rc)
+						CAM_ERR(CAM_CPAS,
+							"Error enable icp clk failed rc=%d", rc);
+					else
+						icp_clk_enabled = true;
+				}
+			}
+		}
+
+		if (power_on) {
+			if (force_on) {
+				cam_io_w_mb(0x1,
+					soc_info->reg_map[reg_indx].mem_base +
+					qchannel_info->qchannel_ctrl);
+				CAM_DBG(CAM_CPAS, "Force qchannel on for %s",
+						camnoc_info[i]->camnoc_name);
+			}
+			/* wait for QACCEPTN in QCHANNEL status*/
+			mask = BIT(0);
+			wait_data = 1;
+		} else {
+
+			/* Clear the quiecience request in QCHANNEL ctrl*/
+			cam_io_w_mb(0, soc_info->reg_map[reg_indx].mem_base +
+				qchannel_info->qchannel_ctrl);
+			/* wait for QACCEPTN and QDENY in QCHANNEL status*/
+			mask = BIT(1) | BIT(0);
+			wait_data = 0;
+		}
+
+		rc = cam_io_poll_value_wmask(
+			soc_info->reg_map[reg_indx].mem_base +
+			qchannel_info->qchannel_status,
+			wait_data, mask, CAM_CPAS_POLL_QH_RETRY_CNT,
+			CAM_CPAS_POLL_MIN_USECS, CAM_CPAS_POLL_MAX_USECS);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"CPAS_%s %s idle sequence failed, qstat 0x%x",
+				power_on ? "START" : "STOP", camnoc_info[i]->camnoc_name,
+			cam_io_r(soc_info->reg_map[reg_indx].mem_base +
+				qchannel_info->qchannel_status));
+			ret = rc;
+			/* Do not return error, passthrough */
+		}
+
+		/* check if deny bit is set */
+		qchannel_status = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base +
+			qchannel_info->qchannel_status);
+		CAM_DBG(CAM_CPAS,
+			"CPAS_%s %s : qchannel status 0x%x", power_on ? "START" : "STOP",
+			camnoc_info[i]->camnoc_name, qchannel_status);
+
+		qdeny = (qchannel_status & BIT(1));
+		if (!power_on && qdeny)
+			ret = -EBUSY;
+	}
+
+	if (icp_clk_enabled) {
+		rc = cam_soc_util_clk_disable(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+			soc_private->icp_clk_index);
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Error disable icp clk failed rc=%d", rc);
+	}
+
+	return ret;
+}
+
+static int cam_cpastop_set_up_camnoc_info(struct cam_cpas *cpas_core,
+	struct cam_camnoc_info **alloc_camnoc)
+{
+	int i, j, camnoc_cnt = 0;
+
+	for (i = 0; i < CAM_CAMNOC_HW_TYPE_MAX; i++) {
+		if (alloc_camnoc[i]) {
+			alloc_camnoc[i]->camnoc_name = cam_cpastop_get_camnoc_name(i);
+			camnoc_info[camnoc_cnt] = alloc_camnoc[i];
+			cpas_core->camnoc_info[camnoc_cnt] = alloc_camnoc[i];
+			cpas_core->camnoc_info_idx[i] = camnoc_cnt;
+
+			switch (i) {
+			case CAM_CAMNOC_HW_COMBINED:
+				camnoc_info[i]->reg_base = CAM_CPAS_REG_CAMNOC;
+				break;
+			case CAM_CAMNOC_HW_RT:
+				camnoc_info[i]->reg_base = CAM_CPAS_REG_CAMNOC_RT;
+				break;
+			case CAM_CAMNOC_HW_NRT:
+				camnoc_info[i]->reg_base = CAM_CPAS_REG_CAMNOC_NRT;
+				break;
+			default:
+				CAM_ERR(CAM_CPAS, "Invalid camnoc type %u", i);
+				return -EINVAL;
+			}
+
+			camnoc_cnt++;
+
+			if (cpas_core->regbase_index[camnoc_info[i]->reg_base] == -1) {
+				CAM_ERR(CAM_CPAS, "Regbase not set up for %s",
+					camnoc_info[i]->camnoc_name);
+				return -EINVAL;
+			}
+		} else {
+			cpas_core->camnoc_info_idx[i] = -1;
+		}
+	}
+
+	if (camnoc_cnt == 0) {
+		CAM_ERR(CAM_CPAS, "No available camnoc header for binding");
+		return -EINVAL;
+	}
+
+	if (cpas_info->num_qchannel && cpas_info->num_qchannel != camnoc_cnt) {
+		CAM_ERR(CAM_CPAS, "Invalid number of qchannel: %u number of camnoc: %u",
+			cpas_info->num_qchannel, camnoc_cnt);
+		return -EINVAL;
+	}
+
+	cpas_core->num_valid_camnoc = camnoc_cnt;
+
+	if (cpas_core->camnoc_info_idx[CAM_CAMNOC_HW_COMBINED] >= 0)
+		cpas_core->camnoc_rt_idx = cpas_core->camnoc_info_idx[CAM_CAMNOC_HW_COMBINED];
+	else if (cpas_core->camnoc_info_idx[CAM_CAMNOC_HW_RT] >= 0)
+		cpas_core->camnoc_rt_idx = cpas_core->camnoc_info_idx[CAM_CAMNOC_HW_RT];
+	else {
+		cpas_core->camnoc_rt_idx = -1;
+		CAM_ERR(CAM_CPAS, "No CAMNOC RT idx found");
+		return -EINVAL;
+	}
+
+	/* Check if slave error irq is enabled */
+	for (i = 0; i < cpas_core->num_valid_camnoc; i++) {
+		for (j = 0; j < camnoc_info[i]->irq_err_size; j++) {
+			if (camnoc_info[i]->irq_err[j].irq_type ==
+				CAM_CAMNOC_HW_IRQ_SLAVE_ERROR) {
+				if (camnoc_info[i]->irq_err[j].enable) {
+					cpas_core->slave_err_irq_en[i] = true;
+					cpas_core->slave_err_irq_idx[i] = j;
+					break;
+				}
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cpastop_get_hw_capability(struct cam_hw_info *cpas_hw)
+{
+	int i, reg_idx;
+	struct cam_cpas *cpas_core = cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas_hw_cap_info *hw_caps_info;
+	struct cam_cpas_hw_caps *hw_caps = &cpas_core->hw_caps;
+
+	hw_caps_info = &cpas_info->hw_caps_info;
+	reg_idx = cpas_core->regbase_index[CAM_CPAS_REG_CPASTOP];
+
+	/* At least one hw caps register must be present */
+	if (!hw_caps_info->num_caps_registers ||
+		hw_caps_info->num_caps_registers > CAM_CPAS_MAX_CAPS_REGS) {
+		CAM_ERR(CAM_CPAS,
+			"Invalid number of populated caps registers: %u",
+			hw_caps_info->num_caps_registers);
+		return -EINVAL;
+	}
+
+	hw_caps->num_capability_reg = hw_caps_info->num_caps_registers;
+	for (i = 0; i < hw_caps_info->num_caps_registers; i++) {
+		hw_caps->camera_capability[i] = cam_io_r_mb(soc_info->reg_map[reg_idx].mem_base +
+			hw_caps_info->hw_caps_offsets[i]);
+		CAM_DBG(CAM_CPAS, "camera_caps_%d = 0x%x", i, hw_caps->camera_capability[i]);
+	}
+
+	return 0;
+}
+
+static int cam_cpastop_set_tpg_mux_sel(struct cam_hw_info *cpas_hw,
+	uint32_t tpg_mux)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int reg_cpas_top;
+	uint32_t curr_tpg_mux = 0;
+
+	reg_cpas_top = cpas_core->regbase_index[CAM_CPAS_REG_CPASTOP];
+
+	if (cpas_top_info == NULL)
+		return 0;
+
+	if (!cpas_top_info->tpg_mux_sel_enabled)
+		return 0;
+
+	curr_tpg_mux = cam_io_r_mb(soc_info->reg_map[reg_cpas_top].mem_base +
+		cpas_top_info->tpg_mux_sel);
+
+	curr_tpg_mux = curr_tpg_mux | ((1 << tpg_mux) << cpas_top_info->tpg_mux_sel_shift);
+	cam_io_w_mb(curr_tpg_mux, soc_info->reg_map[reg_cpas_top].mem_base +
+		cpas_top_info->tpg_mux_sel);
+	CAM_DBG(CAM_CPAS, "SET TPG MUX to 0x%x", curr_tpg_mux);
+
+	return 0;
+}
+
+static int cam_cpastop_init_hw_version(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_hw_caps *hw_caps)
+{
+	int rc = 0;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_cesta_info *cesta_info = NULL;
+	struct cam_camnoc_info *alloc_camnoc_info[CAM_CAMNOC_HW_TYPE_MAX] = {0};
+
+	qchannel_info = NULL;
+	cpas_top_info = NULL;
+
+	CAM_DBG(CAM_CPAS,
+		"hw_version=0x%x Camera Version %d.%d.%d, cpas version %d.%d.%d",
+		soc_info->hw_version,
+		hw_caps->camera_version.major,
+		hw_caps->camera_version.minor,
+		hw_caps->camera_version.incr,
+		hw_caps->cpas_version.major,
+		hw_caps->cpas_version.minor,
+		hw_caps->cpas_version.incr);
+
+	switch (soc_info->hw_version) {
+	case CAM_CPAS_TITAN_170_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam170_cpas100_camnoc_info;
+		cpas_info = &cam170_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_170_V110:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam170_cpas110_camnoc_info;
+		cpas_info = &cam170_cpas110_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_170_V200:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam170_cpas200_camnoc_info;
+		cpas_info = &cam170_cpas200_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_175_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam175_cpas100_camnoc_info;
+		cpas_info = &cam175_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_175_V101:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam175_cpas101_camnoc_info;
+		cpas_info = &cam175_cpas101_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_175_V120:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam175_cpas120_camnoc_info;
+		cpas_info = &cam175_cpas120_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_175_V130:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam175_cpas130_camnoc_info;
+		cpas_info = &cam175_cpas130_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_150_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam150_cpas100_camnoc_info;
+		cpas_info = &cam150_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_480_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam480_cpas100_camnoc_info;
+		cpas_info = &cam480_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_580_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam580_cpas100_camnoc_info;
+		cpas_info = &cam580_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_540_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam540_cpas100_camnoc_info;
+		cpas_info = &cam540_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_520_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam520_cpas100_camnoc_info;
+		cpas_info = &cam520_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_545_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam545_cpas100_camnoc_info;
+		cpas_info = &cam545_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_570_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam570_cpas100_camnoc_info;
+		cpas_info = &cam570_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_570_V200:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam570_cpas200_camnoc_info;
+		cpas_info = &cam570_cpas200_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_680_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam680_cpas100_camnoc_info;
+		cpas_info = &cam680_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_680_V110:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam680_cpas110_camnoc_info;
+		cpas_info = &cam680_cpas110_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_165_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam165_cpas100_camnoc_info;
+		cpas_info = &cam165_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_780_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam780_cpas100_camnoc_info;
+		cpas_info = &cam780_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_640_V200:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam640_cpas200_camnoc_info;
+		cpas_info = &cam640_cpas200_cpas_info;
+		cpas_top_info = &cam640_cpas200_cpas_top_info;
+		break;
+	case CAM_CPAS_TITAN_640_V210:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam640_cpas210_camnoc_info;
+		cpas_info = &cam640_cpas210_cpas_info;
+		cpas_top_info = &cam640_cpas210_cpas_top_info;
+		break;
+	case CAM_CPAS_TITAN_880_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam880_cpas100_camnoc_info;
+		cpas_info = &cam880_cpas100_cpas_info;
+		cesta_info = &cam_v880_cesta_info;
+		break;
+	case CAM_CPAS_TITAN_980_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_RT] = &cam980_cpas100_camnoc_info_rt;
+		alloc_camnoc_info[CAM_CAMNOC_HW_NRT] = &cam980_cpas100_camnoc_info_nrt;
+		cpas_info = &cam980_cpas100_cpas_info;
+		cesta_info = &cam_v980_cesta_info;
+		break;
+	case CAM_CPAS_TITAN_860_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam860_cpas100_camnoc_info;
+		cpas_info = &cam860_cpas100_cpas_info;
+		cesta_info = &cam_v860_cesta_info;
+		break;
+	case CAM_CPAS_TITAN_770_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam770_cpas100_camnoc_info;
+		cpas_info = &cam770_cpas100_cpas_info;
+		cpas_top_info = &cam770_cpas100_cpas_top_info;
+		break;
+	case CAM_CPAS_TITAN_665_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam665_cpas100_camnoc_info;
+		cpas_info = &cam665_cpas100_cpas_info;
+		cpas_top_info = &cam665_cpas100_cpas_top_info;
+		break;
+	case CAM_CPAS_TITAN_690_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam690_cpas100_camnoc_info;
+		cpas_info = &cam690_cpas100_cpas_info;
+		break;
+	case CAM_CPAS_TITAN_692_V100:
+		alloc_camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam692_cpas100_camnoc_info;
+		cpas_info = &cam692_cpas100_cpas_info;
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Camera Version not supported %d.%d.%d",
+			hw_caps->camera_version.major,
+			hw_caps->camera_version.minor,
+			hw_caps->camera_version.incr);
+		return -EINVAL;
+	}
+
+	cpas_core->cesta_info = cesta_info;
+
+	rc = cam_cpastop_set_up_camnoc_info(cpas_core, alloc_camnoc_info);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed to set up camnoc info rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpastop_get_hw_capability(cpas_hw);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed to get titan hw capability rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int cam_cpastop_setup_qos_settings(struct cam_hw_info *cpas_hw,
+	uint32_t selection_mask)
+{
+	int rc = 0;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+
+	CAM_DBG(CAM_CPAS,
+		"QoS selection : hw_version=0x%x selection_mask 0x%x",
+		soc_info->hw_version,
+		selection_mask);
+
+	switch (soc_info->hw_version) {
+	case CAM_CPAS_TITAN_480_V100:
+		if (selection_mask & CAM_CPAS_QOS_CUSTOM_SETTINGS_MASK)
+			camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam480_custom_camnoc_info;
+		else if (selection_mask & CAM_CPAS_QOS_DEFAULT_SETTINGS_MASK)
+			camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam480_cpas100_camnoc_info;
+		else
+			CAM_ERR(CAM_CPAS, "Invalid selection mask 0x%x",
+				selection_mask);
+		break;
+	case CAM_CPAS_TITAN_580_V100:
+		if (selection_mask & CAM_CPAS_QOS_CUSTOM_SETTINGS_MASK)
+			camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam580_custom_camnoc_info;
+		else if (selection_mask & CAM_CPAS_QOS_DEFAULT_SETTINGS_MASK)
+			camnoc_info[CAM_CAMNOC_HW_COMBINED] = &cam580_cpas100_camnoc_info;
+		else
+			CAM_ERR(CAM_CPAS,
+				"Invalid selection mask 0x%x for hw 0x%x",
+				selection_mask, soc_info->hw_version);
+		break;
+	default:
+		CAM_WARN(CAM_CPAS, "QoS selection not supported for 0x%x",
+			soc_info->hw_version);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int cam_cpastop_get_internal_ops(struct cam_cpas_internal_ops *internal_ops)
+{
+	if (!internal_ops) {
+		CAM_ERR(CAM_CPAS, "invalid NULL param");
+		return -EINVAL;
+	}
+
+	internal_ops->get_hw_info = cam_cpastop_get_hw_info;
+	internal_ops->init_hw_version = cam_cpastop_init_hw_version;
+	internal_ops->handle_irq = cam_cpastop_handle_irq;
+	internal_ops->setup_regbase = cam_cpastop_setup_regbase_indices;
+	internal_ops->power_on = cam_cpastop_poweron;
+	internal_ops->power_off = cam_cpastop_poweroff;
+	internal_ops->setup_qos_settings = cam_cpastop_setup_qos_settings;
+	internal_ops->print_poweron_settings =
+		cam_cpastop_print_poweron_settings;
+	internal_ops->qchannel_handshake = cam_cpastop_qchannel_handshake;
+	internal_ops->set_tpg_mux_sel = cam_cpastop_set_tpg_mux_sel;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cam_cpastop_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cam_cpastop_hw.h
@@ -0,0 +1,550 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CPASTOP_HW_H_
+#define _CAM_CPASTOP_HW_H_
+
+#include "cam_cpas_api.h"
+#include "cam_cpas_hw.h"
+
+/* Camera Hw parts array indices */
+#define CAM_CPAS_PART_MAX_FUSE_BITS 8
+#define CAM_CPAS_PART_MAX_FUSE_BIT_INFO 2
+
+/**
+ * enum cam_camnoc_hw_irq_type - Enum for camnoc error types
+ *
+ * @CAM_CAMNOC_HW_IRQ_SLAVE_ERROR                  : Each slave port in CAMNOC
+ *                                                  (3 QSB ports and 1 QHB port)
+ *                                                   has an error logger. The
+ *                                                   error observed at any slave
+ *                                                   port is logged into the
+ *                                                   error logger register and
+ *                                                   an IRQ is triggered
+ * @CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR        : Triggered if any error
+ *                                                   detected in the IFE UBWC
+ *                                                   encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR  : Triggered if any error
+ *                                                   detected in the IFE UBWC-
+ *                                                   Stats encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR: Triggered if any error
+ *                                                   detected in the IFE UBWC-
+ *                                                   Stats 1 encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR      : Triggered if any error
+ *                                                   detected in the IFE0 UBWC
+ *                                                   encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR      : Triggered if any error
+ *                                                   detected in the IFE1 or
+ *                                                   IFE3 UBWC encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR       : Triggered if any UBWC error
+ *                                                   is detected in IFE0 write
+ *                                                   path
+ * @CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR : Triggered if any UBWC error
+ *                                                   is detected in IFE1 write
+ *                                                   path slave  times out after
+ *                                                   4000 AHB cycles
+ * @CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR        : Triggered if any error
+ *                                                   detected in the IPE
+ *                                                   UBWC encoder instance
+ * @CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR        : Triggered if any error
+ *                                                   detected in the BPS
+ *                                                   UBWC encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR   : Triggered if any error
+ *                                                   detected in the IPE1/BPS
+ *                                                   read path decoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR       : Triggered if any error
+ *                                                   detected in the IPE0 read
+ *                                                   path decoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR       : Triggered if any error
+ *                                                   detected in the IPE1 read
+ *                                                   path decoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR    : Triggered if any error
+ *                                                   detected in the IPE/BPS
+ *                                                   UBWC decoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR    : Triggered if any error
+ *                                                   detected in the IPE/BPS
+ *                                                   UBWC encoder instance
+ * @CAM_CAMNOC_HW_IRQ_OFE_UBWC_WRITE_ENCODE_ERROR  : Triggered if any error
+ *                                                   detected in the OFE write
+ *                                                   path enconder instance
+ * @CAM_CAMNOC_HW_IRQ_OFE_UBWC_READ_DECODE_ERROR   : Triggered if any error
+ *                                                   detected in the OFE read
+ *                                                   path enconder instance
+ * @CAM_CAMNOC_HW_IRQ_TFE_UBWC_ENCODE_ERROR        : Triggered if any error
+ *                                                   detected in the TFE
+ *                                                   UBWC enconder instance
+ * @CAM_CAMNOC_HW_IRQ_RESERVED1                    : Reserved
+ * @CAM_CAMNOC_HW_IRQ_RESERVED2                    : Reserved
+ * @CAM_CAMNOC_HW_IRQ_CAMNOC_TEST                  : To test the IRQ logic
+ */
+enum cam_camnoc_hw_irq_type {
+	CAM_CAMNOC_HW_IRQ_SLAVE_ERROR =
+		CAM_CAMNOC_IRQ_SLAVE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE0_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_BPS_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE0_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE1_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_OFE_UBWC_WRITE_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_OFE_WR_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_OFE_UBWC_READ_DECODE_ERROR =
+		CAM_CAMNOC_IRQ_OFE_RD_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_TFE_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_TFE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT =
+		CAM_CAMNOC_IRQ_AHB_TIMEOUT,
+	CAM_CAMNOC_HW_IRQ_RESERVED1,
+	CAM_CAMNOC_HW_IRQ_RESERVED2,
+	CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+};
+
+/**
+ * enum cam_camnoc_port_type - Enum for different camnoc hw ports. All CAMNOC
+ *         settings like QoS, LUT mappings need to be configured for
+ *         each of these ports.
+ *
+ * @CAM_CAMNOC_CDM: Indicates CDM HW connection to camnoc
+ * @CAM_CAMNOC_SFE_RD: Indicates read data from all SFEs to cammnoc
+ * @CAM_CAMNOC_IFE02: Indicates IFE0, IFE2 HW connection to camnoc
+ * @CAM_CAMNOC_IFE13: Indicates IFE1, IFE3 HW connection to camnoc
+ * @CAM_CAMNOC_IFE_LITE: Indicates all IFE lites connection to camnoc
+ * @CAM_CAMNOC_IFE_LINEAR: Indicates linear data from all IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_LINEAR_STATS: Indicates linear and stats data from certan
+ *         IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_LINEAR_STATS_1: Indicates linear and stats data from certan
+ *         IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_PDAF: Indicates pdaf data from all IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_UBWC: Indicates ubwc from all IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_UBWC_STATS: Indicates ubwc+stats from certain IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_UBWC_STATS_1: Indicates ubwc+stats from certain
+ *         IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_RDI_WR: Indicates RDI write data from certain IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_RDI_WR_1: Indicates RDI write data from certain
+ *         IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_RDI_RD: Indicates RDI read data from all IFEs to cammnoc
+ * @CAM_CAMNOC_IFE0123_RDI_WRITE: RDI write only for all IFEx
+ * @CAM_CAMNOC_IFE0_NRDI_WRITE: IFE0 non-RDI write
+ * @CAM_CAMNOC_IFE01_RDI_READ: IFE0/1 RDI READ
+ * @CAM_CAMNOC_IFE1_NRDI_WRITE: IFE1 non-RDI write
+ * @CAM_CAMNOC_IPE_BPS_LRME_READ: Indicates IPE, BPS, LRME Read HW
+ *         connection to camnoc
+ * @CAM_CAMNOC_IPE_BPS_LRME_WRITE: Indicates IPE, BPS, LRME Write HW
+ *         connection to camnoc
+ * @CAM_CAMNOC_IPE_VID_DISP_WRITE: Indicates IPE's VID/DISP Wrire HW
+ *         connection to camnoc
+ * @CAM_CAMNOC_IPE_WR: Indicates IPE HW's write connection to camnoc
+ * @CAM_CAMNOC_IPE0_RD: Indicates IPE's Read0 HW connection to camnoc
+ * @CAM_CAMNOC_IPE1_RD: Indicates IPE's Read1 HW connection to camnoc
+ * @CAM_CAMNOC_IPE1_BPS_RD: Indicates IPE's Read1 + BPS Read HW connection
+ *         to camnoc
+ * @CAM_CAMNOC_IPE_BPS_WR: Indicates IPE+BPS Write HW connection to camnoc
+ * @CAM_CAMNOC_BPS_WR: Indicates BPS HW's write connection to camnoc
+ * @CAM_CAMNOC_BPS_RD: Indicates BPS HW's read connection to camnoc
+ * @CAM_CAMNOC_JPEG: Indicates JPEG HW connection to camnoc
+ * @CAM_CAMNOC_FD: Indicates FD HW connection to camnoc
+ * @CAM_CAMNOC_ICP: Indicates ICP HW connection to camnoc
+ * @CAM_CAMNOC_TFE: Indicates TFE0 HW connection to camnoc
+ * @CAM_CAMNOC_TFE_1: Indicates TFE1 HW connection to camnoc
+ * @CAM_CAMNOC_TFE_2: Indicates TFE2 HW connection to camnoc
+ * @CAM_CAMNOC_OPE: Indicates OPE HW connection to camnoc
+ */
+ /* Deprecated, do not use this anymore. port_name serves the purpose instead of this */
+enum cam_camnoc_port_type {
+	CAM_CAMNOC_CDM,
+	CAM_CAMNOC_SFE_RD,
+	CAM_CAMNOC_IFE02,
+	CAM_CAMNOC_IFE13,
+	CAM_CAMNOC_IFE_LITE,
+	CAM_CAMNOC_IFE_LINEAR,
+	CAM_CAMNOC_IFE_LINEAR_STATS,
+	CAM_CAMNOC_IFE_LINEAR_STATS_1,
+	CAM_CAMNOC_IFE_PDAF,
+	CAM_CAMNOC_IFE_UBWC,
+	CAM_CAMNOC_IFE_UBWC_STATS,
+	CAM_CAMNOC_IFE_UBWC_STATS_1,
+	CAM_CAMNOC_IFE_RDI_WR,
+	CAM_CAMNOC_IFE_RDI_WR_1,
+	CAM_CAMNOC_IFE_RDI_RD,
+	CAM_CAMNOC_IFE0123_RDI_WRITE,
+	CAM_CAMNOC_IFE0_NRDI_WRITE,
+	CAM_CAMNOC_IFE01_RDI_READ,
+	CAM_CAMNOC_IFE1_NRDI_WRITE,
+	CAM_CAMNOC_IPE_BPS_LRME_READ,
+	CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+	CAM_CAMNOC_IPE_VID_DISP_WRITE,
+	CAM_CAMNOC_IPE_WR,
+	CAM_CAMNOC_IPE0_RD,
+	CAM_CAMNOC_IPE1_RD,
+	CAM_CAMNOC_IPE1_BPS_RD,
+	CAM_CAMNOC_IPE_BPS_WR,
+	CAM_CAMNOC_BPS_WR,
+	CAM_CAMNOC_BPS_RD,
+	CAM_CAMNOC_JPEG,
+	CAM_CAMNOC_FD,
+	CAM_CAMNOC_ICP,
+	CAM_CAMNOC_TFE_BAYER_STATS,
+	CAM_CAMNOC_TFE_BAYER_STATS_1,
+	CAM_CAMNOC_TFE_BAYER_STATS_2,
+	CAM_CAMNOC_TFE_RAW,
+	CAM_CAMNOC_TFE_RAW_1,
+	CAM_CAMNOC_TFE_RAW_2,
+	CAM_CAMNOC_TFE,
+	CAM_CAMNOC_TFE_1,
+	CAM_CAMNOC_TFE_2,
+	CAM_CAMNOC_OPE,
+	CAM_CAMNOC_OPE_BPS_WR,
+	CAM_CAMNOC_OPE_BPS_CDM_RD,
+	CAM_CAMNOC_CRE,
+	CAM_CAMNOC_IFE01234_RDI_WRITE,
+	CAM_CAMNOC_IFE01_NRDI_WRITE,
+	CAM_CAMNOC_IFE2_NRDI_WRITE,
+};
+
+/**
+ * struct cam_camnoc_specific : CPAS camnoc specific settings
+ *
+ * @port_type: Port type
+ * @port_name: Port name
+ * @enable: Whether to enable settings for this connection
+ * @priority_lut_low: Priority Low LUT mapping for this connection
+ * @priority_lut_high: Priority High LUT mapping for this connection
+ * @urgency: Urgency (QoS) settings for this connection
+ * @danger_lut: Danger LUT mapping for this connection
+ * @safe_lut: Safe LUT mapping for this connection
+ * @ubwc_ctl: UBWC control settings for this connection
+ * @qosgen_mainctl: qosgen shaping control configuration for this connection
+ * @qosgen_shaping_low: qosgen shaping low configuration for this connection
+ * @qosgen_shaping_high: qosgen shaping high configuration for this connection
+ * @maxwr_low: maxwr low configuration for this connection
+ * @dynattr_mainctl: Dynamic attribute main control register for this connection
+ *
+ */
+struct cam_camnoc_specific {
+	enum cam_camnoc_port_type port_type;
+	const char *port_name;
+	bool enable;
+	struct cam_cpas_reg priority_lut_low;
+	struct cam_cpas_reg priority_lut_high;
+	struct cam_cpas_reg urgency;
+	struct cam_cpas_reg danger_lut;
+	struct cam_cpas_reg safe_lut;
+	struct cam_cpas_reg ubwc_ctl;
+	struct cam_cpas_reg flag_out_set0_low;
+	struct cam_cpas_reg qosgen_mainctl;
+	struct cam_cpas_reg qosgen_shaping_low;
+	struct cam_cpas_reg qosgen_shaping_high;
+	struct cam_cpas_reg maxwr_low;
+	struct cam_cpas_reg dynattr_mainctl;
+};
+
+/**
+ * struct cam_camnoc_irq_sbm : Sideband manager settings for all CAMNOC IRQs
+ *
+ * @sbm_enable: SBM settings for IRQ enable
+ * @sbm_status: SBM settings for IRQ status
+ * @sbm_clear: SBM settings for IRQ clear
+ *
+ */
+struct cam_camnoc_irq_sbm {
+	struct cam_cpas_reg sbm_enable;
+	struct cam_cpas_reg sbm_status;
+	struct cam_cpas_reg sbm_clear;
+};
+
+/**
+ * struct cam_camnoc_irq_err : Error settings specific to each CAMNOC IRQ
+ *
+ * @irq_type: Type of IRQ
+ * @enable: Whether to enable error settings for this IRQ
+ * @sbm_port: Corresponding SBM port for this IRQ
+ * @err_enable: Error enable settings for this IRQ
+ * @err_status: Error status settings for this IRQ
+ * @err_clear: Error clear settings for this IRQ
+ *
+ */
+struct cam_camnoc_irq_err {
+	enum cam_camnoc_hw_irq_type irq_type;
+	bool enable;
+	uint32_t sbm_port;
+	struct cam_cpas_reg err_enable;
+	struct cam_cpas_reg err_status;
+	struct cam_cpas_reg err_clear;
+};
+
+/**
+ * struct cam_cpas_hw_errata_wa : Struct for HW errata workaround info
+ *
+ * @enable: Whether to enable this errata workround
+ * @data: HW Errata workaround data
+ *
+ */
+struct cam_cpas_hw_errata_wa {
+	bool enable;
+	union {
+		struct cam_cpas_reg reg_info;
+	} data;
+};
+
+/**
+ * struct cam_cpas_subpart_info : Struct for camera Hw parts info
+ *
+ * @num_bits: Number of entries in hw_bitmap_mask
+ * @hw_bitmap_mask: Contains Fuse flag and hw_map info
+ *
+ */
+struct cam_cpas_subpart_info {
+	uint32_t num_bits;
+	uint32_t hw_bitmap_mask[CAM_CPAS_PART_MAX_FUSE_BITS][CAM_CPAS_PART_MAX_FUSE_BIT_INFO];
+};
+
+/**
+ * struct cam_cpas_hw_errata_wa_list : List of HW Errata workaround info
+ *
+ * @camnoc_flush_slave_pending_trans: Errata workaround info for flushing
+ *         camnoc slave pending transactions before turning off CPAS_TOP gdsc
+ * @tcsr_camera_hf_sf_ares_glitch: Errata workaround info from ignoring
+ *         erroneous signals at camera start
+ * @enable_icp_clk_for_qchannel: Need to enable ICP clk while qchannel handshake
+ */
+struct cam_cpas_hw_errata_wa_list {
+	struct cam_cpas_hw_errata_wa camnoc_flush_slave_pending_trans;
+	struct cam_cpas_hw_errata_wa tcsr_camera_hf_sf_ares_glitch;
+	struct cam_cpas_hw_errata_wa enable_icp_clk_for_qchannel;
+};
+
+/**
+ * struct cam_camnoc_err_logger_info : CAMNOC error logger register offsets
+ *
+ * @mainctrl: Register offset for mainctrl
+ * @errvld: Register offset for errvld
+ * @errlog0_low: Register offset for errlog0_low
+ * @errlog0_high: Register offset for errlog0_high
+ * @errlog1_low: Register offset for errlog1_low
+ * @errlog1_high: Register offset for errlog1_high
+ * @errlog2_low: Register offset for errlog2_low
+ * @errlog2_high: Register offset for errlog2_high
+ * @errlog3_low: Register offset for errlog3_low
+ * @errlog3_high: Register offset for errlog3_high
+ *
+ */
+struct cam_camnoc_err_logger_info {
+	uint32_t mainctrl;
+	uint32_t errvld;
+	uint32_t errlog0_low;
+	uint32_t errlog0_high;
+	uint32_t errlog1_low;
+	uint32_t errlog1_high;
+	uint32_t errlog2_low;
+	uint32_t errlog2_high;
+	uint32_t errlog3_low;
+	uint32_t errlog3_high;
+};
+
+/**
+ * struct cam_cpas_test_irq_info : CAMNOC Test IRQ mask information
+ *
+ * @sbm_enable_mask: sbm mask to enable camnoc test irq
+ * @sbm_clear_mask: sbm mask to clear camnoc test irq
+ *
+ */
+struct cam_cpas_test_irq_info {
+	uint32_t sbm_enable_mask;
+	uint32_t sbm_clear_mask;
+};
+
+/**
+ * struct cam_cpas_cesta_crm_type : CESTA crm type information
+ *
+ * @CAM_CESTA_CRMB: CRM for bandwidth
+ * @CAM_CESTA_CRMC: CRM for clocks
+ *
+ */
+enum cam_cpas_cesta_crm_type {
+	CAM_CESTA_CRMB = 0,
+	CAM_CESTA_CRMC,
+};
+
+/**
+ * struct cam_vcd_info : cpas vcd(virtual clk domain) information
+ *
+ * @vcd_index: vcd number of each clk
+ * @type: type of clk domain CESTA_CRMB, CESTA_CRMC
+ * @clk_name: name of each vcd clk, exmp: cam_cc_ife_0_clk_src
+ *
+ */
+struct cam_cpas_vcd_info {
+	uint8_t index;
+	enum cam_cpas_cesta_crm_type type;
+	const char *clk;
+};
+
+/**
+ * struct cam_cpas_cesta_vcd_curr_lvl : cesta vcd operating level information
+ *
+ * @reg_offset: register offset
+ * @vcd_base_inc: each vcd base addr offset
+ * @num_vcds: number of vcds
+ *
+ */
+struct cam_cpas_cesta_vcd_curr_lvl {
+	uint32_t reg_offset;
+	uint32_t vcd_base_inc;
+	uint8_t num_vcds;
+};
+
+/**
+ * struct cam_cpas_cesta_vcd_reg_info : to hold all cesta register information
+ *
+ * @vcd_currol: vcd current perf level reg info
+ *
+ */
+struct cam_cpas_cesta_vcd_reg_info {
+	struct cam_cpas_cesta_vcd_curr_lvl vcd_currol;
+};
+
+/**
+ * struct cam_cpas_cesta_info : to hold all cesta register information
+ *
+ * @vcd_info: vcd info
+ * @num_vcds: number of vcds
+ * @cesta_reg_info: cesta vcds reg info
+ *
+ */
+struct cam_cpas_cesta_info {
+	struct cam_cpas_vcd_info *vcd_info;
+	int num_vcds;
+	struct cam_cpas_cesta_vcd_reg_info *cesta_reg_info;
+};
+
+/**
+ * struct cam_cpas_hw_cap_info : CPAS Hardware capability information
+ *
+ * @num_caps_registers: number of hw capability registers
+ * @hw_caps_offsets: array of hw cap register offsets
+ *
+ */
+struct cam_cpas_hw_cap_info {
+	uint32_t num_caps_registers;
+	uint32_t hw_caps_offsets[CAM_CPAS_MAX_CAPS_REGS];
+};
+
+/**
+ * struct cam_camnoc_info : Overall CAMNOC settings info
+ *
+ * @camnoc_type: type of camnoc (RT/NRT/COMBINED)
+ * @camnoc_name: name of camnoc (CAMNOC_RT/CAMNOC_NRT/CAMNOC_COMBINED)
+ * @reg_base: register base for camnoc RT/NRT/COMBINED register space
+ * @specific: Pointer to CAMNOC SPECIFICTONTTPTR settings
+ * @specific_size: Array size of SPECIFICTONTTPTR settings
+ * @irq_sbm: Pointer to CAMNOC IRQ SBM settings
+ * @irq_err: Pointer to CAMNOC IRQ Error settings
+ * @irq_err_size: Array size of IRQ Error settings
+ * @err_logger: Pointer to CAMNOC IRQ Error logger read registers
+ * @errata_wa_list: HW Errata workaround info
+ * @test_irq_info: CAMNOC Test IRQ info
+ * @cesta_info: cpas cesta reg info
+ *
+ */
+struct cam_camnoc_info {
+	/* Below fields populated at probe on camera version */
+	enum cam_camnoc_hw_type camnoc_type;
+	char *camnoc_name;
+	enum cam_cpas_reg_base reg_base;
+
+	/* Below fields populated from the cpas header */
+	struct cam_camnoc_specific *specific;
+	int specific_size;
+	struct cam_camnoc_irq_sbm *irq_sbm;
+	struct cam_camnoc_irq_err *irq_err;
+	int irq_err_size;
+	struct cam_camnoc_err_logger_info *err_logger;
+	struct cam_cpas_hw_errata_wa_list *errata_wa_list;
+	struct cam_cpas_test_irq_info test_irq_info;
+	struct cam_cpas_cesta_info *cesta_info;
+};
+
+/**
+ * struct cam_cpas_work_payload : Struct for cpas work payload data
+ *
+ * @camnoc_idx: index to camnoc info array
+ * @hw: Pointer to HW info
+ * @irq_status: IRQ status value
+ * @irq_data: IRQ data
+ * @workq_scheduled_ts: workqueue scheduled timestamp
+ * @work: Work handle
+ *
+ */
+struct cam_cpas_work_payload {
+	int8_t camnoc_idx;
+	struct cam_hw_info *hw;
+	uint32_t irq_status;
+	uint32_t irq_data;
+	ktime_t workq_scheduled_ts;
+	struct work_struct work;
+};
+
+/**
+ * struct cam_cpas_camnoc_qchannel : Cpas camnoc qchannel info
+ *
+ * @qchannel_ctrl: offset to configure to control camnoc qchannel interface
+ * @qchannel_status: offset to read camnoc qchannel interface status
+ *
+ */
+struct cam_cpas_camnoc_qchannel {
+	uint32_t qchannel_ctrl;
+	uint32_t qchannel_status;
+};
+
+/**
+ * struct cam_cpas_info: CPAS information
+ *
+ * @qchannel_info: CPAS qchannel info
+ * @hw_cap_info: CPAS Hardware capability information
+ * @num_qchannel: Number of qchannel
+ */
+struct cam_cpas_info {
+	struct cam_cpas_camnoc_qchannel *qchannel_info[CAM_CAMNOC_HW_TYPE_MAX];
+	struct cam_cpas_hw_cap_info hw_caps_info;
+	uint8_t num_qchannel;
+};
+
+/**
+ * struct cam_cpas_top_regs : CPAS Top registers
+ * @tpg_mux_sel_shift:     TPG mux select shift value
+ * @tpg_mux_sel:           For selecting TPG
+ * @tpg_mux_sel_enabled:   TPG mux select enabled or not
+ *
+ */
+struct cam_cpas_top_regs {
+	uint32_t tpg_mux_sel_shift;
+	uint32_t tpg_mux_sel;
+	bool     tpg_mux_sel_enabled;
+};
+
+#endif /* _CAM_CPASTOP_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop100.h
@@ -0,0 +1,539 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP100_H_
+#define _CPASTOP100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x3,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x3,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = false,
+	}
+};
+
+static struct cam_camnoc_err_logger_info cam170_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam170_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = true,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+struct cam_camnoc_info cam170_cpas100_camnoc_info = {
+	.specific = &cam_cpas100_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas100_camnoc_specific) /
+		sizeof(cam_cpas100_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas100_irq_sbm,
+	.irq_err = &cam_cpas100_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas100_irq_err) /
+		sizeof(cam_cpas100_irq_err[0]),
+	.err_logger = &cam170_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam170_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_info cam170_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v150_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v150_100.h
@@ -0,0 +1,538 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V150_100_H_
+#define _CPASTOP_V150_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v150_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v150_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v150_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 0x5,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam150_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam150_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam150_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v150_100_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas_v150_100_camnoc_specific) /
+		sizeof(cam_cpas_v150_100_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas_v150_100_irq_sbm,
+	.irq_err = &cam_cpas_v150_100_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas_v150_100_irq_err) /
+		sizeof(cam_cpas_v150_100_irq_err[0]),
+	.err_logger = &cam150_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam150_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_info cam150_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V150_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v165_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v165_100.h
@@ -0,0 +1,719 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+ #ifndef _CPASTOP_V165_100_H_
+ #define _CPASTOP_V165_100_H_
+
+ #define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v165_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2240, /* SBM_FAULTINEN0_LOW */
+		.value =  0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2248, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2280, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v165_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x4F08, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x4F10, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x4F18, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3BA0, /* SPECIFIC_IFE0_MAIN_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3B90,
+			/* SPECIFIC_IFE0_MAIN_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x3B98, /* SPECIFIC_IFE0_MAIN_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x55A0, /* SPECIFIC_IFE1_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5590, /* SPECIFIC_IFE1_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5598, /* SPECIFIC_IFE1_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2F20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2F10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2F18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2BA0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2B90,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2B98, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v165_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4230, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4234, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0, /* CDM_Urgency_Low */
+			.offset = 0x4238,
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4240, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4248, /* CDM_SAFELUT_LOW */
+			.value = 0xFFFF,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE01234_RDI_WRITE,
+		.port_name = "IFE01234_RDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3630, /* IFE01234_RDI_PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3634, /* IFE01234_RDI_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3638, /* IFE01234_RDI_LINEAR_URGENCY_LOW */
+			.mask = 0x1FF0,
+			.shift = 0x4,
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3640, /* IFE01234_RDI_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3648, /* IFE01234_RDI_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x3620, /* IFE01234_RDI_MAXWR_LOW */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4808, /* IFE01234_RDI_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4820, /* IFE01234_RDI_QOSGEN_SHAPING_LOW */
+			.value = 0x07070707,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4824, /* IFE01234_RDI_QOSGEN_SHAPING_HIGH */
+			.value = 0x07070707,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE01_NRDI_WRITE,
+		.port_name = "IFE01_NRDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A30, /* IFE01_NRDI_PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A34, /* IFE01_NRDI_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3A38, /* IFE01_NRDI_URGENCY_LOW */
+			/* IFE01_NRDI_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x1FF0,
+			/* IFE01_NRDI_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A40, /* IFE01_NRDI_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A48, /* IFE01_NRDI_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		/* no reg for this */
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3B88, /* IFE01_NRDI_ENCCTL_LOW */
+			.value = 1,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x3A20, /* IFE01_MAXWR_LOW */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4708, /* IFE01_NRDI_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4720, /* IFE01_NRDI_QOSGEN_SHAPING_LOW */
+			.value = 0x07070707,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4724, /* IFE01_NRDI_QOSGEN_SHAPING_HIGH */
+			.value = 0x07070707,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE2_NRDI_WRITE,
+		.port_name = "IFE2_NRDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5430, /* IFE2_NDRI_PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* IFE2_NRDI_PRIORITYLUT_HIGH */
+			.offset = 0x5434,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x5438, /* IFE2_NRDI_URGENCY_LOW */
+			/* IFE2_NRDI_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x1FF0,
+			/* IFE2_NRDI_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5440, /* IFE2_NRDI_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5448, /* IFE2_NRDI_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5588, /* IFE2_NRDI_ENCCTL_LOW */
+			.value = 0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5420, /* IFE2_MAXWR_LOW */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5188, /* IFE2_NRDI_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x51A0, /* IFE2_NRDI_QOSGEN_SHAPING_LOW */
+			.value = 0x07070707,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x51A4, /* IFE2_NRDI_QOSGEN_SHAPING_HIGH */
+			.value = 0x07070707,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.port_name = "IPE_BPS_LRME_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* IPE_BPS_LRME_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333, /*Value is 0 in excel sheet */
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* IPE_BPS_LRME_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333, /*Value is 0 in excel sheet */
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2E38, /* IPE_BPS_LRME_RD_URGENCY_LOW */
+			/* IPE_BPS_LRME_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* IPE_BPS_LRME_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* IPE_BPS_LRME_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* IPE_BPS_LRME_RD_SAFELUT_LOW */
+			.value = 0xFFFF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2F08, /* IPE_BPS_LRME_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.port_name = "IPE_BPS_LRME_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A30, /* IPE_BPS_LRME_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A34, /* IPE_BPS_LRME_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2A38, /* IPE_BPS_LRME_WR_URGENCY_LOW */
+			/* IPE_BPS_LRME_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* IPE_BPS_LRME_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A40, /* IPE_BPS_LRME_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A48, /* IPE_BPS_LRME_WR_SAFELUT_LOW */
+			.value = 0xFFFF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2B88, /* IPE_BPS_LRME_WR_ENCCTL_LOW */
+			.value = 0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2A20, /* IBL_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2630, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2634, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2638, /* JPEG_URGENCY_LOW */
+			.mask = 0x3F,
+			.shift = 0x0,
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2640, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2648, /* JPEG_SAFELUT_LOW */
+			.value = 0xFFFF,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2620, /* JPEG_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		/*SidebandManager_main_SidebandManager_FlagOutSet0_Low*/
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x5088,
+			.value = 0x50,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam165_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x4F08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x4F10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x4F20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x4F24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x4F28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x4F2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x4F30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x4F34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x4F38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x4F3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam165_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam165_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v165_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v165_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v165_100_irq_sbm,
+	.irq_err = &cam_cpas_v165_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v165_100_irq_err),
+	.err_logger = &cam165_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam165_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_info cam165_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V165_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v170_110.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v170_110.h
@@ -0,0 +1,546 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V170_110_H_
+#define _CPASTOP_V170_110_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas110_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas110_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas110_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam170_cpas110_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam170_cpas110_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam170_cpas110_camnoc_info = {
+	.specific = &cam_cpas110_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas110_camnoc_specific) /
+		sizeof(cam_cpas110_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas110_irq_sbm,
+	.irq_err = &cam_cpas110_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas110_irq_err) /
+		sizeof(cam_cpas110_irq_err[0]),
+	.err_logger = &cam170_cpas110_err_logger_offsets,
+	.errata_wa_list = &cam170_cpas110_errata_wa_list,
+};
+
+static struct cam_cpas_info cam170_cpas110_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V170_110_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v170_200.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v170_200.h
@@ -0,0 +1,582 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V170_200_H_
+#define _CPASTOP_V170_200_H_
+
+#define TEST_IRQ_ENABLE 0
+#define TCSR_CONN_RESET 0x0
+#define TCSR_CONN_SET  0x3
+
+static struct cam_camnoc_irq_sbm cam_cpas_v170_200_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v170_200_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v170_200_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.port_name = "IFE02",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2420, /* IFE02_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.port_name = "IFE13",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2620, /* IFE13_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.port_name = "IPE_BPS_LRME_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.port_name = "IPE_BPS_LRME_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2A20, /* IPE_BPS_LRME_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2C20, /* IPE_BPS_LRME_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.port_name = "FD",
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam170_cpas200_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam170_cpas200_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam170_cpas200_camnoc_info = {
+	.specific = &cam_cpas_v170_200_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v170_200_camnoc_specific),
+	.irq_sbm = &cam_cpas_v170_200_irq_sbm,
+	.irq_err = &cam_cpas_v170_200_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v170_200_irq_err),
+	.err_logger = &cam170_cpas200_err_logger_offsets,
+	.errata_wa_list = &cam170_cpas200_errata_wa_list,
+};
+
+static struct cam_cpas_info cam170_cpas200_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V170_200_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v175_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v175_100.h
@@ -0,0 +1,566 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V175_100_H_
+#define _CPASTOP_V175_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v175_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v175_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v175_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam175_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam175_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam175_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v175_100_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas_v175_100_camnoc_specific) /
+		sizeof(cam_cpas_v175_100_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas_v175_100_irq_sbm,
+	.irq_err = &cam_cpas_v175_100_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas_v175_100_irq_err) /
+		sizeof(cam_cpas_v175_100_irq_err[0]),
+	.err_logger = &cam175_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam175_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_info cam175_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V175_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v175_101.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v175_101.h
@@ -0,0 +1,566 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V175_101_H_
+#define _CPASTOP_V175_101_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v175_101_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v175_101_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v175_101_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam175_cpas101_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam175_cpas101_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam175_cpas101_camnoc_info = {
+	.specific = &cam_cpas_v175_101_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas_v175_101_camnoc_specific) /
+		sizeof(cam_cpas_v175_101_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas_v175_101_irq_sbm,
+	.irq_err = &cam_cpas_v175_101_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas_v175_101_irq_err) /
+		sizeof(cam_cpas_v175_101_irq_err[0]),
+	.err_logger = &cam175_cpas101_err_logger_offsets,
+	.errata_wa_list = &cam175_cpas101_errata_wa_list,
+};
+
+static struct cam_cpas_info cam175_cpas101_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V175_101_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v175_120.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v175_120.h
@@ -0,0 +1,768 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V175_120_H_
+#define _CPASTOP_V175_120_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v175_120_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2240, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2248, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2280, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v175_120_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x4F08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x4F10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x4F18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3BA0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3B90, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x3B98, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x55a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5590, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5598, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2F20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2F10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2F18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2Ba0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2B90,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2B98, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v175_120_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4230, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4234, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			/* cdm_main_SpecificToNttpTr_Urgency_Low */
+			.offset = 0x4238,
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4240, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4248, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE0123_RDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE0123_PRIORITYLUT_LOW */
+			.offset = 0x3630,
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE0123_PRIORITYLUT_HIGH */
+			.offset = 0x3634,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3638, /* SPECIFIC_IFE0123_URGENCY_LOW */
+			/* SPECIFIC_IFE0123_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE0123_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3640, /* SPECIFIC_IFE0123_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3648, /* SPECIFIC_IFE0123_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE0_NRDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A30, /* SPECIFIC_IFE0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A34, /* SPECIFIC_IFE0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3A38, /* SPECIFIC_IFE0_URGENCY_LOW */
+			/* SPECIFIC_IFE0_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE0_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A40, /* SPECIFIC_IFE0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A48, /* SPECIFIC_IFE0_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3B88, /* SPECIFIC_IFE0_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		/* IFE0/1 RDI READ PATH */
+		.port_type = CAM_CAMNOC_IFE01_RDI_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3230, /* SPECIFIC_IFE1_PRIORITYLUT_LOW */
+			.value = 0x44443333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3234, /* SPECIFIC_IFE1_PRIORITYLUT_HIGH */
+			.value = 0x66665555,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3238, /* SPECIFIC_IFE1_URGENCY_LOW */
+			/* SPECIFIC_IFE1_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IFE1_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3240, /* SPECIFIC_IFE1_DANGERLUT_LOW */
+			.value = 0x00000000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3248, /* SPECIFIC_IFE1_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE1_NRDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5430, /* SPECIFIC_IFE1_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE1_WR_PRIORITYLUT_HIGH */
+			.offset = 0x5434,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x5438, /* SPECIFIC_IFE1_WR_URGENCY_LOW */
+			/* SPECIFIC_IFE1_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE1_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5440, /* SPECIFIC_IFE1_WR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5448, /* SPECIFIC_IFE1_WR_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5588, /* SPECIFIC_IFE1_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2E38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2F08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A30, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A34, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2A38, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A40, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A48, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2B88, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_VID_DISP_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_PRIORITYLUT_LOW */
+			.offset = 0x5E30,
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_PRIORITYLUT_HIGH */
+			.offset = 0x5E34,
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW */
+			.offset = 0x5E38,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW_READ_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC__IPE_VID_DISP_DANGERLUT_LOW */
+			.offset = 0x5E40,
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_SAFELUT_LOW */
+			.offset = 0x5E48,
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5F88, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2630, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2634, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2638, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2640, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2648, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E30, /* SPECIFIC_FD_PRIORITYLUT_LOW */
+			.value = 0x44444444,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E34, /* SPECIFIC_FD_PRIORITYLUT_HIGH */
+			.value = 0x44444444,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E38, /* SPECIFIC_FD_URGENCY_LOW */
+			.value = 0x44,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E40, /* SPECIFIC_FD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E48, /* SPECIFIC_FD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+
+	},
+	{
+		/*SidebandManager_main_SidebandManager_FlagOutSet0_Low*/
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2288,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam175_cpas120_err_logger_offsets = {
+	.mainctrl     =  0x4F08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x4F10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x4F20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x4F24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x4F28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x4F2c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x4F30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x4F34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x4F38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x4F3c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam175_cpas120_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam175_cpas120_camnoc_info = {
+	.specific = &cam_cpas_v175_120_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v175_120_camnoc_specific),
+	.irq_sbm = &cam_cpas_v175_120_irq_sbm,
+	.irq_err = &cam_cpas_v175_120_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v175_120_irq_err),
+	.err_logger = &cam175_cpas120_err_logger_offsets,
+	.errata_wa_list = &cam175_cpas120_errata_wa_list,
+};
+
+static struct cam_cpas_info cam175_cpas120_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V175_120_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v175_130.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v175_130.h
@@ -0,0 +1,840 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V175_130_H_
+#define _CPASTOP_V175_130_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v175_130_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2240, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2248, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2280, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v175_130_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x4F08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x4F10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x4F18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3BA0, /* SPECIFIC_IFE0_MAIN_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			/* SPECIFIC_IFE0_MAIN_ENCERRSTATUS_LOW */
+			.offset = 0x3B90,
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x3B98, /* SPECIFIC_IFE0_MAIN_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x55A0, /* SPECIFIC_IFE1_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			/* SPECIFIC_IFE1_WR_ENCERRSTATUS_LOW */
+			.offset = 0x5590,
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5598, /* SPECIFIC_IFE1_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2F20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2F10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2F18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2BA0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2B90,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2B98, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v175_130_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4230, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4234, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			/* cdm_main_SpecificToNttpTr_Urgency_Low */
+			.offset = 0x4238,
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4240, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4248, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE0123_RDI_WRITE,
+		.port_name = "IFE0123_RDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE0123_PRIORITYLUT_LOW */
+			.offset = 0x3630,
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE0123_PRIORITYLUT_HIGH */
+			.offset = 0x3634,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3638, /* SPECIFIC_IFE0123_URGENCY_LOW */
+			/* SPECIFIC_IFE0123_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE0123_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3640, /* SPECIFIC_IFE0123_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3648, /* SPECIFIC_IFE0123_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x3620, /* IFE0123_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE0_NRDI_WRITE,
+		.port_name = "IFE0_NRDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A30, /* SPECIFIC_IFE0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A34, /* SPECIFIC_IFE0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3A38, /* SPECIFIC_IFE0_URGENCY_LOW */
+			/* SPECIFIC_IFE0_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE0_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A40, /* SPECIFIC_IFE0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A48, /* SPECIFIC_IFE0_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3B88, /* SPECIFIC_IFE0_ENCCTL_LOW */
+			.value = 1,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x3A20, /* IFE0_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		/* IFE0/1 RDI READ PATH */
+		.port_type = CAM_CAMNOC_IFE01_RDI_READ,
+		.port_name = "IFE01_RDI_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3230, /* SPECIFIC_IFE1_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3234, /* SPECIFIC_IFE1_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3238, /* SPECIFIC_IFE1_URGENCY_LOW */
+			/* SPECIFIC_IFE1_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IFE1_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3240, /* SPECIFIC_IFE1_DANGERLUT_LOW */
+			.value = 0x00000000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3248, /* SPECIFIC_IFE1_SAFELUT_LOW */
+			.value = 0xFFFFFFFF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE1_NRDI_WRITE,
+		.port_name = "IFE1_NRDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5430, /* SPECIFIC_IFE1_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE1_WR_PRIORITYLUT_HIGH */
+			.offset = 0x5434,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x5438, /* SPECIFIC_IFE1_WR_URGENCY_LOW */
+			/* SPECIFIC_IFE1_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE1_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5440, /* SPECIFIC_IFE1_WR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5448, /* SPECIFIC_IFE1_WR_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5588, /* SPECIFIC_IFE1_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5420, /* IFE1_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.port_name = "IPE_BPS_LRME_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2E38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2F08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.port_name = "IPE_BPS_LRME_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A30, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A34, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2A38, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A40, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A48, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2B88, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2A20, /* IBL_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_VID_DISP_WRITE,
+		.port_name = "IPE_VID_DISP_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_PRIORITYLUT_LOW */
+			.offset = 0x5E30,
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_PRIORITYLUT_HIGH */
+			.offset = 0x5E34,
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW */
+			.offset = 0x5E38,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW_READ_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC__IPE_VID_DISP_DANGERLUT_LOW */
+			.offset = 0x5E40,
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_SAFELUT_LOW */
+			.offset = 0x5E48,
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5F88, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5E20, /* IPE_VID_DISP_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2630, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2634, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2638, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2640, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2648, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2620, /* JPEG_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.port_name = "FD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E30, /* SPECIFIC_FD_PRIORITYLUT_LOW */
+			.value = 0x44444444,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E34, /* SPECIFIC_FD_PRIORITYLUT_HIGH */
+			.value = 0x44444444,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E38, /* SPECIFIC_FD_URGENCY_LOW */
+			.value = 0x44,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E40, /* SPECIFIC_FD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E48, /* SPECIFIC_FD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x3E20, /* FD_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		/*SidebandManager_main_SidebandManager_FlagOutSet0_Low*/
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2288,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam175_cpas130_err_logger_offsets = {
+	.mainctrl     =  0x4F08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x4F10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x4F20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x4F24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x4F28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x4F2c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x4F30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x4F34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x4F38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x4F3c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam175_cpas130_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+	/* TZ owned register */
+	.tcsr_camera_hf_sf_ares_glitch = {
+		.enable = true,
+		.data.reg_info = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			/* TCSR_CAMERA_HF_SF_ARES_GLITCH_MASK */
+			.offset = 0x01FCA08C,
+			.value = 0x4, /* set bit[2] to 1 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam175_cpas130_camnoc_info = {
+	.specific = &cam_cpas_v175_130_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v175_130_camnoc_specific),
+	.irq_sbm = &cam_cpas_v175_130_irq_sbm,
+	.irq_err = &cam_cpas_v175_130_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v175_130_irq_err),
+	.err_logger = &cam175_cpas130_err_logger_offsets,
+	.errata_wa_list = &cam175_cpas130_errata_wa_list,
+};
+
+static struct cam_cpas_info cam175_cpas130_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V175_130_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v480_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v480_100.h
@@ -0,0 +1,772 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V480_100_H_
+#define _CPASTOP_V480_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v480_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x40 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v480_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90, /* IFE_UBWC_STATS_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v480_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.port_name = "FD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x630, /* FD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x634, /* FD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x638, /* FD_URGENCY_LOW */
+			.value = 0x33,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x640, /* FD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x648, /* FD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x620, /* FD_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.port_name = "IFE_LINEAR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0xA20, /* IFE_LINEAR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.port_name = "IFE_RDI_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.port_name = "IFE_RDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x1420, /* IFE_RDI_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.port_name = "IFE_UBWC_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34, /* IFE_UBWC_STATS_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_ENCCTL_LOW */
+			.value = 1,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x1A20, /* IFE_UBWC_STATS_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.port_name = "IPE0_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.port_name = "IPE1_BPS_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.port_name = "IPE_BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2820, /* IPE_BPS_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2E20, /* JPEG_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam480_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam480_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam480_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v480_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v480_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v480_100_irq_sbm,
+	.irq_err = &cam_cpas_v480_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v480_100_irq_err),
+	.err_logger = &cam480_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam480_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_info cam480_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V480_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v480_custom.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v480_custom.h
@@ -0,0 +1,719 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V480_CUSTOM_H_
+#define _CPASTOP_V480_CUSTOM_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v480_custom_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x40 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v480_custom_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90, /* IFE_UBWC_STATS_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v480_custom_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x630, /* FD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x634, /* FD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x638, /* FD_URGENCY_LOW */
+			.value = 0x33,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x640, /* FD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x648, /* FD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_URGENCY_LOW */
+			.value = 0x1070,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_DANGERLUT_LOW */
+			.value = 0xFFFFFFF0,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34, /* IFE_UBWC_STATS_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam480_custom_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam480_custom_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam480_custom_camnoc_info = {
+	.specific = &cam_cpas_v480_custom_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v480_custom_camnoc_specific),
+	.irq_sbm = &cam_cpas_v480_custom_irq_sbm,
+	.irq_err = &cam_cpas_v480_custom_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v480_custom_irq_err),
+	.err_logger = &cam480_custom_err_logger_offsets,
+	.errata_wa_list = &cam480_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_info cam480_custom_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V480_CUSTOM_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v520_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v520_100.h
@@ -0,0 +1,271 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V520_100_H_
+#define _CPASTOP_V520_100_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v520_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0xA40, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1,    /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0xA48, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0xA80, /* SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v520_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xD08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xD10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xD18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xA88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xA90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+
+static struct cam_camnoc_specific
+	cam_cpas_v520_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE38, /* CDM_URGENCY_LOW */
+			.value = 0x00000003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE,
+		.port_name = "TFE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x30,
+			.value = 0x44443333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x34,
+			.value = 0x66665555,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x40, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x48, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x20, /* TFE_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE,
+		.port_name = "OPE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* OPE_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* OPE_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x438, /* OPE_URGENCY_LOW */
+			.value = 0x00000033,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* OPE_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* OPE_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x420, /* OPE_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam520_cpas100_err_logger_offsets = {
+	.mainctrl     =  0xD08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0xD10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0xD20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0xD24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0xD28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0xD2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0xD30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0xD34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0xD38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0xD3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_camnoc_info cam520_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v520_100_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v520_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v520_100_irq_sbm,
+	.irq_err = &cam_cpas_v520_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v520_100_irq_err),
+	.err_logger = &cam520_cpas100_err_logger_offsets,
+	.errata_wa_list = NULL,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x2,
+		.sbm_clear_mask = 0x2,
+	}
+};
+
+static struct cam_cpas_camnoc_qchannel cam520_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+
+static struct cam_cpas_info cam520_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam520_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V520_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v540_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v540_100.h
@@ -0,0 +1,272 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V540_100_H_
+#define _CPASTOP_V540_100_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v540_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0xA40, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1,    /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0xA48, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0xA80, /* SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v540_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xD08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xD10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xD18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xA88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xA90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+
+// TODO: Need to update cam_cpas_v540_100_camnoc_specific values based on QoS
+static struct cam_camnoc_specific
+	cam_cpas_v540_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE38, /* CDM_URGENCY_LOW */
+			.value = 0x00000003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE,
+		.port_name = "TFE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x30,
+			.value = 0x44443333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x34,
+			.value = 0x66665555,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x40, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x48, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x20, /* TFE_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE,
+		.port_name = "OPE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* OPE_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* OPE_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x438, /* OPE_URGENCY_LOW */
+			.value = 0x00000033,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* OPE_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* OPE_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x420, /* OPE_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam540_cpas100_err_logger_offsets = {
+	.mainctrl     =  0xD08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0xD10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0xD20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0xD24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0xD28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0xD2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0xD30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0xD34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0xD38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0xD3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_camnoc_info cam540_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v540_100_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v540_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v540_100_irq_sbm,
+	.irq_err = &cam_cpas_v540_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v540_100_irq_err),
+	.err_logger = &cam540_cpas100_err_logger_offsets,
+	.errata_wa_list = NULL,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x2,
+		.sbm_clear_mask = 0x2,
+	}
+};
+
+static struct cam_cpas_camnoc_qchannel cam540_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+
+static struct cam_cpas_info cam540_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam540_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V540_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v545_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v545_100.h
@@ -0,0 +1,365 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V545_100_H_
+#define _CPASTOP_V545_100_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v545_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0xA40, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1,    /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0xA48, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0xA80, /* SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v545_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xD08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xD10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xD18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xA88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xA90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+
+static struct cam_camnoc_specific
+	cam_cpas_v545_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE38, /* CDM_URGENCY_LOW */
+			.value = 0x00000003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE,
+		.port_name = "TFE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x30,
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x34,
+			.value = 0x66666655,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x40, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x48, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x20, /* TFE_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_1,
+		.port_name = "TFE_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x4030,
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x4034,
+			.value = 0x66666655,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4038, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x4040, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x4048, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x4020, /* TFE_1_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_2,
+		.port_name = "TFE_2",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x5030,
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x5034,
+			.value = 0x66666655,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5038, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5040, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5048, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5020, /* TFE_2_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE,
+		.port_name = "OPE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* OPE_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* OPE_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x438, /* OPE_URGENCY_LOW */
+			.value = 0x00000033,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* OPE_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* OPE_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x420, /* OPE_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam545_cpas100_err_logger_offsets = {
+	.mainctrl     =  0xD08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0xD10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0xD20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0xD24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0xD28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0xD2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0xD30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0xD34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0xD38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0xD3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_camnoc_info cam545_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v545_100_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v545_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v545_100_irq_sbm,
+	.irq_err = &cam_cpas_v545_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v545_100_irq_err),
+	.err_logger = &cam545_cpas100_err_logger_offsets,
+	.errata_wa_list = NULL,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x2,
+		.sbm_clear_mask = 0x2,
+	}
+};
+
+static struct cam_cpas_camnoc_qchannel cam545_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+
+static struct cam_cpas_info cam545_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam545_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V545_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v570_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v570_100.h
@@ -0,0 +1,939 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V570_100_H_
+#define _CPASTOP_V570_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v570_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x7A40, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x1000 | /* SBM_FAULTINEN0_LOW_PORT12_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x40 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x7A48, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x7A80, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v570_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7908, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7910, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7918, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x63A0, /* IFE_NIU_0_NIU_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6390,
+			/* IFE_NIU_0_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6398, /* IFE_NIU_0_NIU_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6B20, /* NRT_NIU_0_NIU_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6B10, /* NRT_NIU_0_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6B18, /* NRT_NIU_0_NIU_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6F20, /* NRT_NIU_2_NIU_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6F10, /* NRT_NIU_2_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6F18, /* NRT_NIU_2_NIU_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6DA0, /* NRT_NIU_1_NIU_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6D90,
+			/* NRT_NIU_1_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6D98, /* NRT_NIU_1_NIU_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7A88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7A90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7A88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7A90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v570_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6030, /* CDM_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6034, /* CDM_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6038, /* CDM_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6040, /* CDM_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6048, /* CDM_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5008, /* CDM_QOSGEN_MAINCTL_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5020, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5024, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.port_name = "IFE_LINEAR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6430, /* IFE_NIU_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6434, /* IFE_NIU_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6438, /* IFE_NIU_1_NIU_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x6440, /* IFE_NIU_1_NIU_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x6448, /* IFE_NIU_1_NIU_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5108, /* IFE_NIU_1_NIU_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5120, /* IFE_NIU_1_NIU_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5124, /* IFE_NIU_1_NIU_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6420, /* IFE_NIU_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.port_name = "IFE_RDI_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6630, /* IFE_NIU_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6634, /* IFE_NIU_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6638, /* IFE_NIU_2_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x6640, /* IFE_NIU_2_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x6648, /* IFE_NIU_2_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5188, /* IFE_NIU_2_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x51A0, /* IFE_NIU_2_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x51A4, /* IFE_NIU_2_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.port_name = "IFE_RDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6830, /* IFE_NIU_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6834, /* IFE_NIU_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6838, /* IFE_NIU_3_NIU_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x6840, /* IFE_NIU_3_NIU_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x6848, /* IFE_NIU_3_NIU_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5208, /* IFE_NIU_3_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5220, /* IFE_NIU_3_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5224, /* IFE_NIU_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6820, /* IFE_NIU_3_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.port_name = "IFE_UBWC_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6230, /* IFE_NIU_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6234,
+			/* IFE_NIU_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6238, /* IFE_NIU_0_NIU_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x6240, /* IFE_NIU_0_NIU_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x6248, /*IFE_NIU_0_NIU_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6388, /* IFE_NIU_0_NIU_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5088, /* IFE_NIU_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x50A0,
+			/* IFE_NIU_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x50A4,
+			/* IFE_NIU_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6220, /* IFE_NIU_0_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.port_name = "IPE0_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E30, /* NRT_NIU_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E34, /* NRT_NIU_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E38, /* NRT_NIU_2_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E40, /* NRT_NIU_2_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E48, /* NRT_NIU_2_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6F08, /* NRT_NIU_2_NIU_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5388, /* NRT_NIU_2_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x53A0, /* NRT_NIU_2_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x53A4, /* NRT_NIU_2_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.port_name = "IPE1_BPS_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A30, /* NRT_NIU_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A34, /* NRT_NIU_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A38, /* NRT_NIU_0_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A40, /* NRT_NIU_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A48, /* NRT_NIU_0_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6B08, /* NRT_NIU_0_NIU_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5288, /* NRT_NIU_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		//  TITAN_A_CAMNOC_cam_noc_amm_NRT_NIU_0_qosgen_Shaping_Low
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x52A0, /* NRT_NIU_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x52A4, /* NRT_NIU_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.port_name = "IPE_BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C30, /* NRT_NIU_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C34, /* NRT_NIU_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C38, /* NRT_NIU_1_NIU_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C40, /* NRT_NIU_1_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C48, /* NRT_NIU_1_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6D88, /* NRT_NIU_1_NIU_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5308, /* NRT_NIU_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5320, /* NRT_NIU_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5324, /* NRT_NIU_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6C20, /* NRT_NIU_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7030, /* NRT_NIU_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7034, /* NRT_NIU_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7038, /* NRT_NIU_3_NIU_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7040, /* NRT_NIU_3_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7048, /* NRT_NIU_3_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5408, /* NRT_NIU_3_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5420, /* NRT_NIU_3_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5424, /* NRT_NIU_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7020, /* NRT_NIU_3_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x7A88,  /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5488, /* ICP_QOSGEN_MAINCTL_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x54A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x54A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam570_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x7908, /* ERL_MAINCTL_LOW */
+	.errvld       =  0x7910, /* ERL_ERRVLD_LOW */
+	.errlog0_low  =  0x7920, /* ERL_ERRLOG0_LOW */
+	.errlog0_high =  0x7924, /* ERL_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7928, /* ERL_ERRLOG1_LOW */
+	.errlog1_high =  0x792c, /* ERL_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7930, /* ERL_ERRLOG2_LOW */
+	.errlog2_high =  0x7934, /* ERL_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7938, /* ERL_ERRLOG3_LOW */
+	.errlog3_high =  0x793c, /* ERL_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam570_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+	},
+};
+
+static struct cam_camnoc_info cam570_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v570_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v570_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v570_100_irq_sbm,
+	.irq_err = &cam_cpas_v570_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v570_100_irq_err),
+	.err_logger = &cam570_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam570_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_camnoc_qchannel cam570_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam570_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam570_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V570_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v570_200.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v570_200.h
@@ -0,0 +1,944 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V570_200_H_
+#define _CPASTOP_V570_200_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v570_200_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x1000, /* SBM_FAULTINEN0_LOW_PORT12_MASK */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v570_200_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_0_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90,
+			/* IFE_UBWC_STATS_0_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_0_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v570_200_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x408, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x420, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x424, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.port_name = "IFE_LINEAR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE08, /* IFE_LINEAR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE20, /* IFE_LINEAR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE24, /* IFE_LINEAR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0xA20, /* IFE_LINEAR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.port_name = "IFE_RDI_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF08, /* IFE_RDI_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF20, /* IFE_RDI_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF24, /* IFE_RDI_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.port_name = "IFE_RDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_0_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1808, /* IFE_RDI_WR_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1820, /* IFE_RDI_WR_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1824, /* IFE_RDI_WR_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x1420, /* IFE_RDI_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.port_name = "IFE_UBWC_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_0_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34,
+			/* IFE_UBWC_STATS_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_UBWC_STATS_0_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1908, /* IFE_UBWC_STATS_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1920,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1924,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x1A20, /* IFE_UBWC_STATS_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.port_name = "IPE0_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2208, /* IPE0_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2220, /* IPE0_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x12121212,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2224, /* IPE0_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x12121212,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.port_name = "IPE1_BPS_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2308, /* IPE1_BPS_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		//  TITAN_A_CAMNOC_cam_noc_amm_nrt_niu_0_qosgen_Shaping_Low
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2320, /* IPE1_BPS_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x23232323,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2324, /* IPE1_BPS_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x23232323,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.port_name = "IPE_BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C08, /* IPE_BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C20, /* IPE_BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C24, /* IPE_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2820, /* IFE_IPE_BPS_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D08, /* JPEG_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D20, /* JPEG_QOSGEN_SHAPING_LOW */
+			.value = 0xA0A0A0A,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D24, /* JPEG_QOSGEN_SHAPING_HIGH */
+			.value = 0xA0A0A0A,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2E20, /* IFE_JPEG_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x3888,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3488, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam570_cpas200_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam570_cpas200_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x3900, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam570_cpas200_camnoc_info = {
+	.specific = &cam_cpas_v570_200_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v570_200_camnoc_specific),
+	.irq_sbm = &cam_cpas_v570_200_irq_sbm,
+	.irq_err = &cam_cpas_v570_200_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v570_200_irq_err),
+	.err_logger = &cam570_cpas200_err_logger_offsets,
+	.errata_wa_list = &cam570_cpas200_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x40,
+		.sbm_clear_mask = 0x4,
+	}
+};
+
+static struct cam_cpas_camnoc_qchannel cam570_cpas200_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam570_cpas200_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam570_cpas200_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V570_200_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v580_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v580_100.h
@@ -0,0 +1,1122 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V580_100_H_
+#define _CPASTOP_V580_100_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v580_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x1000, /* SBM_FAULTINEN0_LOW_PORT12_MASK */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v580_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_0_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90,
+			/* IFE_UBWC_STATS_0_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_0_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1000, /* SBM_FAULTINSTATUS0_LOW_PORT12_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x77A0, /* IFE_UBWC_STATS_1_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7790,
+			/* IFE_UBWC_STATS_1_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7798, /* IFE_UBWC_STATS_1_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v580_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x408, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x420, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x424, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.port_name = "IFE_LINEAR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE08, /* IFE_LINEAR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE20, /* IFE_LINEAR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE24, /* IFE_LINEAR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0xA20, /* IFE_LINEAR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.port_name = "IFE_RDI_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF08, /* IFE_RDI_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF20, /* IFE_RDI_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF24, /* IFE_RDI_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.port_name = "IFE_RDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1808, /* IFE_RDI_WR_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1820, /* IFE_RDI_WR_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1824, /* IFE_RDI_WR_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x1420, /* IFE_RDI_WR_0_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR_1,
+		.port_name = "IFE_RDI_WR_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7430, /* IFE_RDI_WR_1_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7434, /* IFE_RDI_WR_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7438, /* IFE_RDI_WR_1_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7440, /* IFE_RDI_WR_1_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7448, /* IFE_RDI_WR_1_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C08, /* IFE_RDI_WR_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C20, /* IFE_RDI_WR_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C24, /* IFE_RDI_WR_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7420, /* IFE_RDI_WR_1_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.port_name = "IFE_UBWC_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34,
+			/* IFE_UBWC_STATS_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_UBWC_STATS_0_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1908, /* IFE_UBWC_STATS_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1920,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1924,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x1A20, /* IFE_UBWC_STATS_0_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS_1,
+		.port_name = "IFE_UBWC_STATS_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7630, /* IFE_UBWC_STATS_1_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7634,
+			/* IFE_UBWC_STATS_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7638, /* IFE_UBWC_STATS_1_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7640, /* IFE_UBWC_STATS_1_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7648, /* IFE_UBWC_STATS_1_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7788, /* IFE_UBWC_STATS_1_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C88, /* IFE_UBWC_STATS_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7CA0,
+			/* IFE_UBWC_STATS_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7CA4,
+			/* IFE_UBWC_STATS_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7620, /* IFE_UBWC_STATS_1_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.port_name = "IPE0_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2208, /* IPE0_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2220, /* IPE0_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x13131313,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2224, /* IPE0_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x13131313,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.port_name = "IPE1_BPS_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2308, /* IPE1_BPS_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2320, /* IPE1_BPS_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x24242424,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2324, /* IPE1_BPS_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x24242424,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.port_name = "IPE_BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C08, /* IPE_BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C20, /* IPE_BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C24, /* IPE_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2820, /* IFE_IPE_BPS_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D08, /* JPEG_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D20, /* JPEG_QOSGEN_SHAPING_LOW */
+			.value = 0x10101010,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D24, /* JPEG_QOSGEN_SHAPING_HIGH */
+			.value = 0x10101010,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x2E20, /* IFE_JPEG_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x3888,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3488, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam580_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam580_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x3900, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam580_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v580_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v580_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v580_100_irq_sbm,
+	.irq_err = &cam_cpas_v580_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v580_100_irq_err),
+	.err_logger = &cam580_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam580_cpas100_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x40,
+		.sbm_clear_mask = 0x4,
+	}
+};
+
+static struct cam_cpas_camnoc_qchannel cam580_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam580_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam580_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V580_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v580_custom.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v580_custom.h
@@ -0,0 +1,1054 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V580_CUSTOM_H_
+#define _CPASTOP_V580_CUSTOM_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v580_custom_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x1000, /* SBM_FAULTINEN0_LOW_PORT12_MASK */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v580_custom_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_0_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90,
+			/* IFE_UBWC_STATS_0_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_0_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1000, /* SBM_FAULTINSTATUS0_LOW_PORT12_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x77A0, /* IFE_UBWC_STATS_1_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7790,
+			/* IFE_UBWC_STATS_1_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7798, /* IFE_UBWC_STATS_1_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v580_custom_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x408, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x420, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x424, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE08, /* IFE_LINEAR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE20, /* IFE_LINEAR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE24, /* IFE_LINEAR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF08, /* IFE_RDI_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF20, /* IFE_RDI_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF24, /* IFE_RDI_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_0_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_0_SAFELUT_LOW */
+			.value = 0x0000,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1808, /* IFE_RDI_WR_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1820, /* IFE_RDI_WR_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1824, /* IFE_RDI_WR_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR_1,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7430, /* IFE_RDI_WR_1_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7434, /* IFE_RDI_WR_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7438, /* IFE_RDI_WR_1_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7440, /* IFE_RDI_WR_1_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7448, /* IFE_RDI_WR_1_SAFELUT_LOW */
+			.value = 0x0000,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C08, /* IFE_RDI_WR_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C20, /* IFE_RDI_WR_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C24, /* IFE_RDI_WR_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34,
+			/* IFE_UBWC_STATS_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_UBWC_STATS_0_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1908, /* IFE_UBWC_STATS_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1920,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1924,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS_1,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7630, /* IFE_UBWC_STATS_1_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7634,
+			/* IFE_UBWC_STATS_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7638, /* IFE_UBWC_STATS_1_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7640, /* IFE_UBWC_STATS_1_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7648, /* IFE_UBWC_STATS_1_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7788, /* IFE_UBWC_STATS_1_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C88, /* IFE_UBWC_STATS_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7CA0,
+			/* IFE_UBWC_STATS_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7CA4,
+			/* IFE_UBWC_STATS_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2208, /* IPE0_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2220, /* IPE0_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x13131313,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2224, /* IPE0_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x13131313,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2308, /* IPE1_BPS_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2320, /* IPE1_BPS_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x24242424,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2324, /* IPE1_BPS_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x24242424,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C08, /* IPE_BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C20, /* IPE_BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C24, /* IPE_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D08, /* JPEG_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D20, /* JPEG_QOSGEN_SHAPING_LOW */
+			.value = 0x10101010,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D24, /* JPEG_QOSGEN_SHAPING_HIGH */
+			.value = 0x10101010,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x3888,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3488, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam580_custom_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam580_custom_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x3900, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam580_custom_camnoc_info = {
+	.specific = &cam_cpas_v580_custom_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v580_custom_camnoc_specific),
+	.irq_sbm = &cam_cpas_v580_custom_irq_sbm,
+	.irq_err = &cam_cpas_v580_custom_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v580_custom_irq_err),
+	.err_logger = &cam580_custom_err_logger_offsets,
+	.errata_wa_list = &cam580_custom_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x40,
+		.sbm_clear_mask = 0x4,
+	}
+};
+
+static struct cam_cpas_info cam580_custom_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+};
+
+#endif /* _CPASTOP_V580_CUSTOM_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v640_200.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v640_200.h
@@ -0,0 +1,586 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V640_200_H_
+#define _CPASTOP_V640_200_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v640_200_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x6840, /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x2 |    /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |     /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |     /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 |    /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x80 :    /* SBM_FAULTINEN0_LOW_PORT7_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x6848, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x6880, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v640_200_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6608, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6610, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6618, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5DA0, /* WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5D90, /* WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5D98, /* WR_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5F20, /* CAM_NOC_IPE_0_RD_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5F10, /* CAM_NOC_IPE_0_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5F18, /* CAM_NOC_IPE_0_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6888, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6890, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v640_200_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_TFE_BAYER_STATS,
+		.port_name = "TFE_BAYER",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5830, /*PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5834, /* PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5838, /* URGENCY_LOW */
+			.value = 0x00000030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5840, /* DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5848, /* SAFELUT_LOW */
+			.value = 0x0000000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4208, /* QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4220, /* QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4224, /* QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5820, /* UBWC_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_RAW,
+		.port_name = "TFE_RDI_RAW",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A30, /* PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A34, /* PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A38, /* URGENCY_LOW */
+			.value = 0x00000003,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A40, /* DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A48, /* SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4408, /* QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4420, /* QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4424, /* QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5A20, /* STATS_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE_BPS_WR,
+		.port_name = "OPE_BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C30, /* PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C34, /* PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C38, /* URGENCY_LOW */
+			.value = 0x00000030,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C40, /* DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C48, /* SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4608, /* QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4620, /* QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4624, /* QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5C20, /* MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE_BPS_CDM_RD,
+		.port_name = "OPE_BPS_CDM_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E30, /* IPE_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E34, /* IPE_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E38, /* IPE_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E40, /* IPE_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E48, /* IPE_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4808, /* IPE_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4820, /* IPE_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4824, /* IPE_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_CRE,
+		.port_name = "CRE_RD_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6030, /* BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6034, /* BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6038, /* BPS_WR_URGENCY_LOW */
+			.value = 0x03,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6040, /* BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6048, /* BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4A08, /* BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4A20, /* BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4A24, /* BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6020, /* BPS_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x6888,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4008, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4020, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4024, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam640_cpas200_err_logger_offsets = {
+	.mainctrl     =  0x6608, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x6610, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x6620, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x6624, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x6628, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x662c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x6630, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x6634, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x6638, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x663c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam640_cpas200_errata_wa_list = {
+	.enable_icp_clk_for_qchannel = {
+		.enable = true,
+	},
+};
+
+static struct cam_camnoc_info cam640_cpas200_camnoc_info = {
+	.specific = &cam_cpas_v640_200_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v640_200_camnoc_specific),
+	.irq_sbm = &cam_cpas_v640_200_irq_sbm,
+	.irq_err = &cam_cpas_v640_200_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v640_200_irq_err),
+	.err_logger = &cam640_cpas200_err_logger_offsets,
+	.errata_wa_list = &cam640_cpas200_errata_wa_list,
+};
+
+static struct cam_cpas_camnoc_qchannel cam640_cpas200_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam640_cpas200_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam640_cpas200_qchannel_info},
+	.num_qchannel = 1,
+};
+
+static struct cam_cpas_top_regs cam640_cpas200_cpas_top_info = {
+	.tpg_mux_sel_enabled = true,
+	.tpg_mux_sel_shift   = 0x0,
+	.tpg_mux_sel         = 0x1C,
+};
+
+#endif /* _CPASTOP_V640_200_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v640_210.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v640_210.h
@@ -0,0 +1,583 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V640_210_H_
+#define _CPASTOP_V640_210_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v640_210_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x6840, /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x2 |    /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |     /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |     /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 |    /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x80 :    /* SBM_FAULTINEN0_LOW_PORT7_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x6848, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x6880, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v640_210_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6608, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6610, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6618, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5DA0, /* WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5D90, /* WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5D98, /* WR_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5F20, /* CAM_NOC_IPE_0_RD_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5F10, /* CAM_NOC_IPE_0_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5F18, /* CAM_NOC_IPE_0_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6888, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6890, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v640_210_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_TFE_BAYER_STATS,
+		.port_name = "TFE_BAYER",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5830, /*PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5834, /* PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5838, /* URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5840, /* DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5848, /* SAFELUT_LOW */
+			.value = 0x0000000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4208, /* QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4220, /* QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4224, /* QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5820, /* UBWC_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_RAW,
+		.port_name = "TFE_RDI_RAW",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A30, /* PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A34, /* PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A38, /* URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A40, /* DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A48, /* SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4408, /* QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4420, /* QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4424, /* QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5A20, /* STATS_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE_BPS_WR,
+		.port_name = "OPE_BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C30, /* PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C34, /* PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C38, /* URGENCY_LOW */
+			.value = 0x00000030,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C40, /* DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5C48, /* SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4608, /* QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4620, /* QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4624, /* QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5C20, /* MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE_BPS_CDM_RD,
+		.port_name = "OPE_BPS_CDM_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E30, /* IPE_WR_PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E34, /* IPE_WR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E38, /* IPE_WR_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E40, /* IPE_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E48, /* IPE_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4808, /* IPE_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4820, /* IPE_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4824, /* IPE_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_CRE,
+		.port_name = "CRE_RD_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6030, /* BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6034, /* BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6038, /* BPS_WR_URGENCY_LOW */
+			.value = 0x03,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6040, /* BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6048, /* BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4A08, /* BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4A20, /* BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4A24, /* BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6020, /* BPS_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = false,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x6888,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4008, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4020, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4024, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam640_cpas210_err_logger_offsets = {
+	.mainctrl     =  0x6608, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x6610, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x6620, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x6624, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x6628, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x662c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x6630, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x6634, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x6638, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x663c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam640_cpas210_errata_wa_list = {
+};
+
+static struct cam_camnoc_info cam640_cpas210_camnoc_info = {
+	.specific = &cam_cpas_v640_210_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v640_210_camnoc_specific),
+	.irq_sbm = &cam_cpas_v640_210_irq_sbm,
+	.irq_err = &cam_cpas_v640_210_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v640_210_irq_err),
+	.err_logger = &cam640_cpas210_err_logger_offsets,
+	.errata_wa_list = &cam640_cpas210_errata_wa_list,
+};
+
+static struct cam_cpas_camnoc_qchannel cam640_cpas210_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+
+static struct cam_cpas_info cam640_cpas210_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam640_cpas210_qchannel_info},
+	.num_qchannel = 1,
+};
+
+static struct cam_cpas_top_regs cam640_cpas210_cpas_top_info = {
+	.tpg_mux_sel_enabled = true,
+	.tpg_mux_sel_shift   = 0x0,
+	.tpg_mux_sel         = 0x1C,
+};
+
+#endif /* _CPASTOP_V640_210_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v665_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v665_100.h
@@ -0,0 +1,649 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V665_100_H_
+#define _CPASTOP_V665_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v665_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x240, /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x2 |    /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |     /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |     /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 |    /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x80 :    /* SBM_FAULTINEN0_LOW_PORT7_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v665_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x10, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x18, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x89A0, /* WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8990, /* WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8998, /* WR_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8720, /* CAM_NOC_IPE_0_RD_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8710, /* CAM_NOC_IPE_0_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8718, /* CAM_NOC_IPE_0_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v665_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_TFE_BAYER_STATS,
+		.port_name = "TFE_BAYER",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A30, /* TFE_BAYER_NIU_PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A34, /* TFE_BAYER_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66555555,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A38, /* TFE_BAYER_NIU_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A40, /* TFE_BAYER_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A48, /* TFE_BAYER_NIU_SAFELUT_LOW */
+			.value = 0x0000000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9008, /* TFE_BAYER_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9020, /* TFE_BAYER_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9024, /* TFE_BAYER_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8A20, /* TFE_BAYER_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_RAW,
+		.port_name = "TFE_RDI_RAW",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C30, /* TFE_RDI_NIU_PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C34, /* TFE_RDI_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66555555,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C38, /* TFE_RDI_RAW_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C40, /* TFE_RDI_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C48, /* TFE_RDI_NIU_SAFELUT_LOW */
+			.value = 0x0000000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9088, /* TFE_RDI_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x90A0, /* TFE_RDI_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x90A4, /* TFE_RDI_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8C20, /* TFE_RDI_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE_BPS_WR,
+		.port_name = "OPE_BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8830, /* OFFLINE_WR_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8834, /* OFFLINE_WR_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8838, /* OFFLINE_WR_NIU_URGENCY_LOW */
+			.value = 0x030,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8840, /* OFFLINE_WR_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8848, /* OFFLINE_WR_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8F88, /* OFFLINE_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8FA0, /* OFFLINE_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8FA4, /* OFFLINE_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8820, /* OFFLINE_WR_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE_BPS_CDM_RD,
+		.port_name = "OPE_BPS_CDM_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8630, /* OFFLINE_RD_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8634, /* OFFLINE_RD_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8638, /* OFFLINE_RD_NIU_URGENCY_LOW */
+			.value = 0x003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8640, /* OFFLINE_RD_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8648, /* OFFLINE_RD_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8F08, /* OFFLINE_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8F20, /* OFFLINE_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8F24, /* OFFLINE_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_CRE,
+		.port_name = "CRE_RD_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8230, /* CRE_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8234, /* CRE_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8238, /* CRE_NIU_URGENCY_LOW */
+			.value = 0x033,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8240, /* CRE_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8248, /* CRE_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E88, /* CRE_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8EA0, /* CRE_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8EA4, /* CRE_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8220, /* CRE_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8030, /* CDM_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8034, /* CDM_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8038, /* CDM_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8040, /* CDM_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8048, /* CDM_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E08, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E20, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E24, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = false,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x288,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9108, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9120, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9124, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam665_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x8,    /* ERL_MAINCTL_LOW */
+	.errvld       =  0x10,   /* ERl_ERRVLD_LOW */
+	.errlog0_low  =  0x20,   /* ERL_ERRLOG0_LOW */
+	.errlog0_high =  0x24,   /* ERL_ERRLOG0_HIGH */
+	.errlog1_low  =  0x28,   /* ERL_ERRLOG1_LOW */
+	.errlog1_high =  0x2C,   /* ERL_ERRLOG1_HIGH */
+	.errlog2_low  =  0x30,   /* ERL_ERRLOG2_LOW */
+	.errlog2_high =  0x34,   /* ERL_ERRLOG2_HIGH */
+	.errlog3_low  =  0x38,   /* ERL_ERRLOG3_LOW */
+	.errlog3_high =  0x3C,   /* ERL_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam665_cpas100_errata_wa_list = {
+	.enable_icp_clk_for_qchannel = {
+		.enable = true,
+	},
+};
+
+static struct cam_camnoc_info cam665_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v665_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v665_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v665_100_irq_sbm,
+	.irq_err = &cam_cpas_v665_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v665_100_irq_err),
+	.err_logger = &cam665_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam665_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_camnoc_qchannel cam665_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+
+static struct cam_cpas_info cam665_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam665_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+static struct cam_cpas_top_regs cam665_cpas100_cpas_top_info = {
+	.tpg_mux_sel_enabled = true,
+	.tpg_mux_sel_shift   = 0x0,
+	.tpg_mux_sel         = 0x1C,
+};
+
+#endif /* _CPASTOP_V665_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v680_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v680_100.h
@@ -0,0 +1,1305 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V680_100_H_
+#define _CPASTOP_V680_100_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v680_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2240, /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x2 |    /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |    /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |    /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20,     /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v680_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2008, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2010, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2018, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x59A0, /* IFE_UBWC_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5990, /* IFE_UBWC_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5998, /* IFE_UBWC_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7A0, /* CAM_NOC_BPS_WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x790, /* CAM_NOC_BPS_WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x798, /* CAM_NOC_BPS_WR_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5F20, /* CAM_NOC_IPE_0_RD_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5F10, /* CAM_NOC_IPE_0_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5F18, /* CAM_NOC_IPE_0_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6520, /* CAM_NOC_IPE_1_RD_NIU_DECERREN_LOW */
+			.value = 0XFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6510, /* CAM_NOC_IPE_1_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6518, /* CAM_NOC_IPE_1_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6BA0, /* CAM_NOC_IPE_WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6B90, /* CAM_NOC_IPE_WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6B98, /* CAM_NOC_IPE_WR_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x80, /* SBM_FAULTINSTATUS0_LOW_PORT7_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v680_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "IFE_UBWC",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5830, /* IFE_UBWC_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5834, /* IFE_UBWC_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5838, /* IFE_UBWC_URGENCY_LOW */
+			.value = 0x1E30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5840, /* IFE_UBWC_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5848, /* IFE_UBWC_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A08, /* IFE_UBWC_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A20, /* IFE_UBWC_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A24, /* IFE_UBWC_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5820, /* IFE_UBWC_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.port_name = "IFE_RDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5230, /* IFE_RDI_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5234, /* IFE_RDI_WR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5238, /* IFE_RDI_WR_URGENCY_LOW */
+			.value = 0x1E30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5240, /* IFE_RDI_WR_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5248, /* IFE_RDI_WR_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5408, /* IFE_RDI_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5420, /* IFE_RDI_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5424, /* IFE_RDI_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5220, /* IFE_RDI_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_PDAF,
+		.port_name = "IFE_PDAF",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c30, /* IFE_PDAF_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c34, /* IFE_PDAF_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c38, /* IFE_PDAF_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c40, /* IFE_PDAF_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c48, /* IFE_PDAF_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4e08, /* IFE_PDAF_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4e20, /* IFE_PDAF_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4e24, /* IFE_PDAF_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x4C20, /* IFE_PDAF_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR_STATS,
+		.port_name = "IFE_LINEAR_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4030, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4034, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4038, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4040, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4048, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4208, /* IFE_LINEAR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4220, /* IFE_LINEAR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4224, /* IFE_LINEAR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x4020, /* IFE_LINEAR_STATS_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR_STATS_1,
+		.port_name = "IFE_LINEAR_STATS_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8230, /* IFE_LINEAR_1_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8234, /* IFE_LINEAR_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8238, /* IFE_LINEAR_1_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8240, /* IFE_LINEAR_1_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8248, /* IFE_LINEAR_1_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8408, /* IFE_LINEAR_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8420, /* IFE_LINEAR_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8424, /* IFE_LINEAR_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8220, /* IFE_LINEAR_STATS_1_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LITE,
+		.port_name = "IFE_LITE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4630, /* IFE_LITE_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4634, /* IFE_LITE_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4638, /* IFE_LITE_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4640, /* IFE_LITE_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4648, /* IFE_LITE_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4808, /* IFE_LITE_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4820, /* IFE_LITE_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4824, /* IFE_LITE_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x4620, /* IFE_LITE_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_SFE_RD,
+		.port_name = "SFE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7030, /* SFE_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7034, /* SFE_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7038, /* SFE_RD_URGENCY_LOW */
+			.value = 0x4,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7040, /* SFE_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7048, /* SFE_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7208, /* SFE_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7220, /* SFE_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7224, /* SFE_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_WR,
+		.port_name = "IPE_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a30, /* IPE_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a34, /* IPE_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a38, /* IPE_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a40, /* IPE_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a48, /* IPE_WR_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6c08, /* IPE_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6c20, /* IPE_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6c24, /* IPE_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6A20, /* IPE_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_BPS_WR,
+		.port_name = "BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x630, /* BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x634, /* BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x638, /* BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x640, /* BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x648, /* BPS_WR_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x808, /* BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x820, /* BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x824, /* BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x620, /* BPS_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_BPS_RD,
+		.port_name = "BPS_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* BPS_RD_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x208, /* BPS_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x220, /* BPS_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x14141414,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x224, /* BPS_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x14141414,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c48, /* JPEG_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7e08, /* JPEG_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7e20, /* JPEG_QOSGEN_SHAPING_LOW */
+			.value = 0x10101010,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7e24, /* JPEG_QOSGEN_SHAPING_HIGH */
+			.value = 0x10101010,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7C20, /* JPEG_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.port_name = "IPE0_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6008, /* IPE0_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6020, /* IPE0_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x29292929,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6024, /* IPE0_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x29292929,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_RD,
+		.port_name = "IPE1_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6430, /* IPE1_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6434, /* IPE1_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6438, /* IPE1_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6440, /* IPE1_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6448, /* IPE1_RD_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6608, /* IPE1_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6620, /* IPE1_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x29292929,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6624, /* IPE1_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x29292929,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3830, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3834, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3838, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3840, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3848, /* CDM_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3a08, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3a20, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3a24, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2288,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7688, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x76A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x76A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam680_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x2008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x202c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x203c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam680_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam680_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v680_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v680_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v680_100_irq_sbm,
+	.irq_err = &cam_cpas_v680_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v680_100_irq_err),
+	.err_logger = &cam680_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam680_cpas100_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x80,
+		.sbm_clear_mask = 0x4,
+	}
+};
+
+static struct cam_cpas_camnoc_qchannel cam680_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam680_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam680_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V680_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v680_110.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v680_110.h
@@ -0,0 +1,1306 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V680_110_H_
+#define _CPASTOP_V680_110_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v680_110_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2240, /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x2 |    /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |     /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |     /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 |    /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x80 :    /* SBM_FAULTINEN0_LOW_PORT7_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v680_110_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2008, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2010, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2018, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x59A0, /* IFE_UBWC_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5990, /* IFE_UBWC_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5998, /* IFE_UBWC_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7A0, /* CAM_NOC_BPS_WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x790, /* CAM_NOC_BPS_WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x798, /* CAM_NOC_BPS_WR_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5F20, /* CAM_NOC_IPE_0_RD_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5F10, /* CAM_NOC_IPE_0_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5F18, /* CAM_NOC_IPE_0_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6520, /* CAM_NOC_IPE_1_RD_NIU_DECERREN_LOW */
+			.value = 0XFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6510, /* CAM_NOC_IPE_1_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6518, /* CAM_NOC_IPE_1_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6BA0, /* CAM_NOC_IPE_WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6B90, /* CAM_NOC_IPE_WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6B98, /* CAM_NOC_IPE_WR_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x80, /* SBM_FAULTINSTATUS0_LOW_PORT7_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v680_110_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "IFE_UBWC",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5830, /* IFE_UBWC_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5834, /* IFE_UBWC_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5838, /* IFE_UBWC_URGENCY_LOW */
+			.value = 0x1E30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5840, /* IFE_UBWC_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5848, /* IFE_UBWC_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A08, /* IFE_UBWC_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A20, /* IFE_UBWC_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A24, /* IFE_UBWC_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5820, /* IFE_UBWC_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.port_name = "IFE_RDI_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5230, /* IFE_RDI_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5234, /* IFE_RDI_WR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5238, /* IFE_RDI_WR_URGENCY_LOW */
+			.value = 0x1E30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5240, /* IFE_RDI_WR_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5248, /* IFE_RDI_WR_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5408, /* IFE_RDI_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5420, /* IFE_RDI_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5424, /* IFE_RDI_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x5220, /* IFE_RDI_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_PDAF,
+		.port_name = "IFE_PDAF",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c30, /* IFE_PDAF_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c34, /* IFE_PDAF_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c38, /* IFE_PDAF_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c40, /* IFE_PDAF_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c48, /* IFE_PDAF_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4e08, /* IFE_PDAF_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4e20, /* IFE_PDAF_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4e24, /* IFE_PDAF_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x4C20, /* IFE_PDAF_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR_STATS,
+		.port_name = "IFE_LINEAR_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4030, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4034, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4038, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4040, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4048, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4208, /* IFE_LINEAR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4220, /* IFE_LINEAR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4224, /* IFE_LINEAR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x4020, /* IFE_LINEAR_STATS_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR_STATS_1,
+		.port_name = "IFE_LINEAR_STATS_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8230, /* IFE_LINEAR_1_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8234, /* IFE_LINEAR_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8238, /* IFE_LINEAR_1_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8240, /* IFE_LINEAR_1_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8248, /* IFE_LINEAR_1_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8408, /* IFE_LINEAR_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8420, /* IFE_LINEAR_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8424, /* IFE_LINEAR_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8220, /* IFE_LINEAR_STATS_1_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LITE,
+		.port_name = "IFE_LITE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4630, /* IFE_LITE_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4634, /* IFE_LITE_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4638, /* IFE_LITE_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4640, /* IFE_LITE_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4648, /* IFE_LITE_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4808, /* IFE_LITE_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4820, /* IFE_LITE_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4824, /* IFE_LITE_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x4620, /* IFE_LITE_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_SFE_RD,
+		.port_name = "SFE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7030, /* SFE_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7034, /* SFE_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7038, /* SFE_RD_URGENCY_LOW */
+			.value = 0x4,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7040, /* SFE_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7048, /* SFE_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7208, /* SFE_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7220, /* SFE_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7224, /* SFE_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_WR,
+		.port_name = "IPE_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a30, /* IPE_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a34, /* IPE_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a38, /* IPE_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a40, /* IPE_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a48, /* IPE_WR_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6c08, /* IPE_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6c20, /* IPE_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6c24, /* IPE_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6A20, /* IPE_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_BPS_WR,
+		.port_name = "BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x630, /* BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x634, /* BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x638, /* BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x640, /* BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x648, /* BPS_WR_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x808, /* BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x820, /* BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x824, /* BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x620, /* BPS_WR_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_BPS_RD,
+		.port_name = "BPS_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* BPS_RD_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x208, /* BPS_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x220, /* BPS_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x14141414,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x224, /* BPS_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x14141414,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c48, /* JPEG_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7e08, /* JPEG_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7e20, /* JPEG_QOSGEN_SHAPING_LOW */
+			.value = 0x10101010,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7e24, /* JPEG_QOSGEN_SHAPING_HIGH */
+			.value = 0x10101010,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7C20, /* JPEG_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.port_name = "IPE0_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6008, /* IPE0_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6020, /* IPE0_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x29292929,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6024, /* IPE0_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x29292929,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_RD,
+		.port_name = "IPE1_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6430, /* IPE1_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6434, /* IPE1_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6438, /* IPE1_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6440, /* IPE1_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6448, /* IPE1_RD_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6608, /* IPE1_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6620, /* IPE1_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x29292929,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6624, /* IPE1_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x29292929,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3830, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3834, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3838, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3840, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3848, /* CDM_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3a08, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3a20, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3a24, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2288,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7688, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x76A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x76A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam680_cpas110_err_logger_offsets = {
+	.mainctrl     =  0x2008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x202c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x203c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam680_cpas110_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam680_cpas110_camnoc_info = {
+	.specific = &cam_cpas_v680_110_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v680_110_camnoc_specific),
+	.irq_sbm = &cam_cpas_v680_110_irq_sbm,
+	.irq_err = &cam_cpas_v680_110_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v680_110_irq_err),
+	.err_logger = &cam680_cpas110_err_logger_offsets,
+	.errata_wa_list = &cam680_cpas110_errata_wa_list,
+};
+
+static struct cam_cpas_camnoc_qchannel cam680_cpas110_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam680_cpas110_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam680_cpas110_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V680_110_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v690_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v690_100.h
@@ -0,0 +1,455 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V690_100_H_
+#define _CPASTOP_V690_100_H_
+
+#include "cam_cpas_hw.h"
+
+static struct cam_camnoc_irq_sbm cam_cpas_v690_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x240, /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x04 |    /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20,     /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v690_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x10, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x18, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = false,
+			.offset = 0x67A0, /* CAM_NOC_RT_2_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = false,
+			.offset = 0x6790, /* CAM_NOC_RT_2_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = false,
+			.offset = 0x6798, /* CAM_NOC_RT_2_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5F20, /* CAM_NOC_NRT_2_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5F10, /* CAM_NOC_NRT_1_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5F18, /* CAM_NOC_NRT_1_NIU_DECERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = false,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = false,
+			.offset = 0x61A0, /* CAM_NOC_NRT_2_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = false,
+			.offset = 0x6190, /* CAM_NOC_NRT_2_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = false,
+			.offset = 0x6198, /* CAM_NOC_NRT_2_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x80, /* SBM_FAULTINSTATUS0_LOW_PORT7_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v690_100_camnoc_specific[] = {
+	{
+		//RT_0
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "RT_0",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6230, /* CAMNOC_CAM_NOC_RT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6234, /* CAMNOC_CAM_NOC_RT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6238, /* CAMNOC_CAM_NOC_RT_0_NIU_URGENCY_LOW */
+			.value = 0x1003,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6240, /* CAMNOC_CAM_NOC_RT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6248, /* CAMNOC_CAM_NOC_RT_0_NIU_SAFELUT_LOW */
+			.value = 0x0000FFFF,
+		},
+	},
+	{
+		//RT_1
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "RT_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6430, /* CAMNOC_CAM_NOC_RT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6434, /* CAMNOC_CAM_NOC_RT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6438, /* CAMNOC_CAM_NOC_RT_1_NIU_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6440, /* CAMNOC_CAM_NOC_RT_1_NIU_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6448, /* CAMNOC_CAM_NOC_RT_1_NIU_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+	},
+	{
+		//RT_2
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "RT_2",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6630, /* CAMNOC_CAM_NOC_RT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6634, /* CAMNOC_CAM_NOC_RT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6638, /* CAMNOC_CAM_NOC_RT_2_NIU_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6640, /* CAMNOC_CAM_NOC_RT_2_NIU_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6648, /* CAMNOC_CAM_NOC_RT_2_NIU_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+	},
+	{
+		//NRT_0
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "NRT_0",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5C30, /* CAMNOC_CAM_NOC_NRT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5C34, /* CAMNOC_CAM_NOC_NRT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5C38, /* CAMNOC_CAM_NOC_NRT_0_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+	},
+	{
+		//NRT_1
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "NRT_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5E30, /* CAMNOC_CAM_NOC_NRT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5E34, /* CAMNOC_CAM_NOC_NRT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5E38, /* CAMNOC_CAM_NOC_NRT_1_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+	},
+	{
+		//NRT_2
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "NRT_2",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6030, /* CAMNOC_CAM_NOC_NRT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6034, /* CAMNOC_CAM_NOC_NRT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6038, /* CAMNOC_CAM_NOC_NRT_2_NIU_URGENCY_LOW */
+			.value = 0x30,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5308, /* CAMNOC_CAM_NOC_XM_ICP_QOSGEN_MAINCTL_LOW */
+			.value = 0x50,
+		},
+		.dynattr_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6B08, /* CAMNOC_CAM_NOC_XM_ICP_DYNATTR_MAINCTL_LOW */
+			.value = 0x10,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam690_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x0008, /* CAMNOC_CAM_NOC_ERL_MAINCTL_LOW */
+	.errvld       =  0x0010, /* CAMNOC_CAM_NOC_ERl_ERRVLD_LOW */
+	.errlog0_low  =  0x0020, /* CAMNOC_CAM_NOC_ERL_ERRLOG0_LOW */
+	.errlog0_high =  0x0024, /* CAMNOC_CAM_NOC_ERL_ERRLOG0_HIGH */
+	.errlog1_low  =  0x0028, /* CAMNOC_CAM_NOC_ERL_ERRLOG1_LOW */
+	.errlog1_high =  0x002c, /* CAMNOC_CAM_NOC_ERL_ERRLOG1_HIGH */
+	.errlog2_low  =  0x0030, /* CAMNOC_CAM_NOC_ERL_ERRLOG2_LOW */
+	.errlog2_high =  0x0034, /* CAMNOC_CAM_NOC_ERL_ERRLOG2_HIGH */
+	.errlog3_low  =  0x0038, /* CAMNOC_CAM_NOC_ERL_ERRLOG3_LOW */
+	.errlog3_high =  0x003c, /* CAMNOC_CAM_NOC_ERL_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam690_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+	.enable_icp_clk_for_qchannel = {
+		.enable = true,
+	},
+};
+
+static struct cam_camnoc_info cam690_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v690_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v690_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v690_100_irq_sbm,
+	.irq_err = &cam_cpas_v690_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v690_100_irq_err),
+	.err_logger = &cam690_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam690_cpas100_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x80,
+		.sbm_clear_mask = 0x4,
+	}
+};
+
+static struct cam_cpas_camnoc_qchannel cam690_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam690_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam690_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V690_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v692_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v692_100.h
@@ -0,0 +1,455 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V692_100_H_
+#define _CPASTOP_V692_100_H_
+
+#include "cam_cpas_hw.h"
+
+static struct cam_camnoc_irq_sbm cam_cpas_v692_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x240, /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x04 |    /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20,     /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v692_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x10, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x18, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = false,
+			.offset = 0x67A0, /* CAM_NOC_RT_2_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = false,
+			.offset = 0x6790, /* CAM_NOC_RT_2_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = false,
+			.offset = 0x6798, /* CAM_NOC_RT_2_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5F20, /* CAM_NOC_NRT_2_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5F10, /* CAM_NOC_NRT_1_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5F18, /* CAM_NOC_NRT_1_NIU_DECERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = false,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = false,
+			.offset = 0x61A0, /* CAM_NOC_NRT_2_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = false,
+			.offset = 0x6190, /* CAM_NOC_NRT_2_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = false,
+			.offset = 0x6198, /* CAM_NOC_NRT_2_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x80, /* SBM_FAULTINSTATUS0_LOW_PORT7_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v692_100_camnoc_specific[] = {
+	{
+		//RT_0
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "RT_0",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6230, /* CAMNOC_CAM_NOC_RT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6234, /* CAMNOC_CAM_NOC_RT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6238, /* CAMNOC_CAM_NOC_RT_0_NIU_URGENCY_LOW */
+			.value = 0x1003,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6240, /* CAMNOC_CAM_NOC_RT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6248, /* CAMNOC_CAM_NOC_RT_0_NIU_SAFELUT_LOW */
+			.value = 0x0000FFFF,
+		},
+	},
+	{
+		//RT_1
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "RT_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6430, /* CAMNOC_CAM_NOC_RT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6434, /* CAMNOC_CAM_NOC_RT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6438, /* CAMNOC_CAM_NOC_RT_1_NIU_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6440, /* CAMNOC_CAM_NOC_RT_1_NIU_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6448, /* CAMNOC_CAM_NOC_RT_1_NIU_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+	},
+	{
+		//RT_2
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "RT_2",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6630, /* CAMNOC_CAM_NOC_RT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6634, /* CAMNOC_CAM_NOC_RT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6638, /* CAMNOC_CAM_NOC_RT_2_NIU_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6640, /* CAMNOC_CAM_NOC_RT_2_NIU_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6648, /* CAMNOC_CAM_NOC_RT_2_NIU_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+	},
+	{
+		//NRT_0
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "NRT_0",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5C30, /* CAMNOC_CAM_NOC_NRT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5C34, /* CAMNOC_CAM_NOC_NRT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5C38, /* CAMNOC_CAM_NOC_NRT_0_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+	},
+	{
+		//NRT_1
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "NRT_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5E30, /* CAMNOC_CAM_NOC_NRT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5E34, /* CAMNOC_CAM_NOC_NRT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5E38, /* CAMNOC_CAM_NOC_NRT_1_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+	},
+	{
+		//NRT_2
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.port_name = "NRT_2",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6030, /* CAMNOC_CAM_NOC_NRT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6034, /* CAMNOC_CAM_NOC_NRT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6038, /* CAMNOC_CAM_NOC_NRT_2_NIU_URGENCY_LOW */
+			.value = 0x30,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = true,
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x5308, /* CAMNOC_CAM_NOC_XM_ICP_QOSGEN_MAINCTL_LOW */
+			.value = 0x50,
+		},
+		.dynattr_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0x0,
+			.offset = 0x6B08, /* CAMNOC_CAM_NOC_XM_ICP_DYNATTR_MAINCTL_LOW */
+			.value = 0x10,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam692_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x0008, /* CAMNOC_CAM_NOC_ERL_MAINCTL_LOW */
+	.errvld       =  0x0010, /* CAMNOC_CAM_NOC_ERl_ERRVLD_LOW */
+	.errlog0_low  =  0x0020, /* CAMNOC_CAM_NOC_ERL_ERRLOG0_LOW */
+	.errlog0_high =  0x0024, /* CAMNOC_CAM_NOC_ERL_ERRLOG0_HIGH */
+	.errlog1_low  =  0x0028, /* CAMNOC_CAM_NOC_ERL_ERRLOG1_LOW */
+	.errlog1_high =  0x002c, /* CAMNOC_CAM_NOC_ERL_ERRLOG1_HIGH */
+	.errlog2_low  =  0x0030, /* CAMNOC_CAM_NOC_ERL_ERRLOG2_LOW */
+	.errlog2_high =  0x0034, /* CAMNOC_CAM_NOC_ERL_ERRLOG2_HIGH */
+	.errlog3_low  =  0x0038, /* CAMNOC_CAM_NOC_ERL_ERRLOG3_LOW */
+	.errlog3_high =  0x003c, /* CAMNOC_CAM_NOC_ERL_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam692_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+	.enable_icp_clk_for_qchannel = {
+		.enable = true,
+	},
+};
+
+static struct cam_camnoc_info cam692_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v692_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v692_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v692_100_irq_sbm,
+	.irq_err = &cam_cpas_v692_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v692_100_irq_err),
+	.err_logger = &cam692_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam692_cpas100_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x80,
+		.sbm_clear_mask = 0x4,
+	}
+};
+
+static struct cam_cpas_camnoc_qchannel cam692_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam692_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam692_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V692_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v770_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v770_100.h
@@ -0,0 +1,692 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V770_100_H_
+#define _CPASTOP_V770_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v770_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x240, /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x2 |    /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |     /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |     /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 |    /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x80 :    /* SBM_FAULTINEN0_LOW_PORT7_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v770_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x10, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x18, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x89A0, /* WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8990, /* WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8998, /* WR_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8720, /* CAM_NOC_IPE_0_RD_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8710, /* CAM_NOC_IPE_0_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8718, /* CAM_NOC_IPE_0_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v770_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_TFE_BAYER_STATS,
+		.port_name = "TFE_BAYER",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A30, /* TFE_BAYER_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A34, /* TFE_BAYER_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A38, /* TFE_BAYER_NIU_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A40, /* TFE_BAYER_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A48, /* TFE_BAYER_NIU_SAFELUT_LOW */
+			.value = 0x0000000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9008, /* TFE_BAYER_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9020, /* TFE_BAYER_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9024, /* TFE_BAYER_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8A20, /* TFE_BAYER_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_RAW,
+		.port_name = "TFE_RDI_RAW",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C30, /* TFE_RDI_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C34, /* TFE_RDI_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C38, /* TFE_RDI_RAW_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C40, /* TFE_RDI_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C48, /* TFE_RDI_NIU_SAFELUT_LOW */
+			.value = 0x0000000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9088, /* TFE_RDI_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x90A0, /* TFE_RDI_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x90A4, /* TFE_RDI_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8C20, /* TFE_RDI_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE_BPS_WR,
+		.port_name = "OPE_BPS_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8830, /* OFFLINE_WR_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8834, /* OFFLINE_WR_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8838, /* OFFLINE_WR_NIU_URGENCY_LOW */
+			.value = 0x030,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8840, /* OFFLINE_WR_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8848, /* OFFLINE_WR_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8F88, /* OFFLINE_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8FA0, /* OFFLINE_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8FA4, /* OFFLINE_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8820, /* OFFLINE_WR_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE_BPS_CDM_RD,
+		.port_name = "OPE_BPS_CDM_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8630, /* OFFLINE_RD_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8634, /* OFFLINE_RD_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8638, /* OFFLINE_RD_NIU_URGENCY_LOW */
+			.value = 0x003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8640, /* OFFLINE_RD_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8648, /* OFFLINE_RD_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8F08, /* OFFLINE_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8F20, /* OFFLINE_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8F24, /* OFFLINE_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_CRE,
+		.port_name = "CRE_RD_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8230, /* CRE_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8234, /* CRE_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8238, /* CRE_NIU_URGENCY_LOW */
+			.value = 0x033,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8240, /* CRE_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8248, /* CRE_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E88, /* CRE_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8EA0, /* CRE_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8EA4, /* CRE_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8220, /* CRE_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.port_name = "JPEG",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8430, /* JPEG_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8434, /* JPEG_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8438, /* JPEG_NIU_URGENCY_LOW */
+			.value = 0x33,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8440, /* JPEG_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8448, /* JPEG_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.port_name = "CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8030, /* CDM_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8034, /* CDM_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8038, /* CDM_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8040, /* CDM_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8048, /* CDM_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E08, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E20, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E24, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.port_name = "ICP",
+		.enable = false,
+		.flag_out_set0_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x288,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9108, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9120, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9124, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam770_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x8,    /* ERL_MAINCTL_LOW */
+	.errvld       =  0x10,   /* ERl_ERRVLD_LOW */
+	.errlog0_low  =  0x20,   /* ERL_ERRLOG0_LOW */
+	.errlog0_high =  0x24,   /* ERL_ERRLOG0_HIGH */
+	.errlog1_low  =  0x28,   /* ERL_ERRLOG1_LOW */
+	.errlog1_high =  0x2C,   /* ERL_ERRLOG1_HIGH */
+	.errlog2_low  =  0x30,   /* ERL_ERRLOG2_LOW */
+	.errlog2_high =  0x34,   /* ERL_ERRLOG2_HIGH */
+	.errlog3_low  =  0x38,   /* ERL_ERRLOG3_LOW */
+	.errlog3_high =  0x3C,   /* ERL_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam770_cpas100_errata_wa_list = {
+	.enable_icp_clk_for_qchannel = {
+		.enable = true,
+	},
+};
+
+static struct cam_camnoc_info cam770_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v770_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v770_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v770_100_irq_sbm,
+	.irq_err = &cam_cpas_v770_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v770_100_irq_err),
+	.err_logger = &cam770_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam770_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_camnoc_qchannel cam770_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+
+static struct cam_cpas_info cam770_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam770_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+static struct cam_cpas_top_regs cam770_cpas100_cpas_top_info = {
+	.tpg_mux_sel_enabled = true,
+	.tpg_mux_sel_shift   = 0x0,
+	.tpg_mux_sel         = 0x1C,
+};
+
+#endif /* _CPASTOP_V770_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v780_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v780_100.h
@@ -0,0 +1,1229 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V780_100_H_
+#define _CPASTOP_V780_100_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v780_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x240,  /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x01 | /* SBM_FAULTINEN0_LOW_PORT0_MASK */
+			0x02 |    /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |    /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |    /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20,     /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v780_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x10, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x18, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x77A0, /* IFE_UBWC : RT_1_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7790, /* IFE_UBWC : RT_1_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7798, /* IFE_UBWC : RT_1_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6BA0, /* BPS_WR : NRT_2_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6B90, /* BPS_WR : NRT_2_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6B98, /* BPS_WR : NRT_2_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6F20, /* IPE_0_RD : NRT_4_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6F10, /* IPE_0_RD : NRT_4_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6F18, /* IPE_0_RD : NRT_4_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7120, /* IPE_1_RD : NRT_5_NIU_DECERREN_LOW */
+			.value = 0XFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7110, /* IPE_1_RD : NRT_5_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7118, /* IPE_1_RD : NRT_5_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x73A0, /* IPE_WR : NRT_6_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7390, /* IPE_WR : NRT_6_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7398, /* IPE_WR : NRT_6_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x80, /* SBM_FAULTINSTATUS0_LOW_PORT7_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x3,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v780_100_camnoc_specific[] = {
+	/* RT ports */
+	{
+		.port_name = "RT0-SFE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7430, /* SFE_RD : NOC_RT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7434, /* SFE_RD : NOC_RT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7438, /* SFE_RD : NOC_RT_0_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7440, /* SFE_RD : NOC_RT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7448, /* SFE_RD : NOC_RT_0_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8188, /* SFE_RD : NOC_RT_0_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5388, /* SFE_RD : NOC_RT_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x53A0, /* SFE_RD : NOC_RT_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x53A4, /* SFE_RD : NOC_RT_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT1-IFE_UBWC_LINEAR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7630, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7634, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7638, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7640, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7648, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8208, /* IFE_UBWC_LINEAR : NOC_RT_1_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5408, /* IFE_UBWC_LINEAR : NOC_RT_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5420, /* IFE_UBWC_LINEAR : NOC_RT_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5424, /* IFE_UBWC_LINEAR : NOC_RT_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7620, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT2-IFE_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7830, /* IFE_STATS : NOC_RT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7834, /* IFE_STATS : NOC_RT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7838, /* IFE_STATS : NOC_RT_2_NIU_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7840, /* IFE_STATS : NOC_RT_2_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7848, /* IFE_STATS : NOC_RT_2_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8288, /* IFE_STATS : NOC_RT_2_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5488, /* IFE_STATS : NOC_RT_2_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x54A0, /* IFE_STATS : NOC_RT_2_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x54A4, /* IFE_STATS : NOC_RT_2_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7820, /* IFE_STATS : NOC_RT_2_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT3-IFE_PDAF_IFELITE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7A30, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7A34, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7A38, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7A40, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7A48, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8308, /* IFE_PDAF_IFELITE : NOC_RT_3_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5508, /* IFE_PDAF_IFELITE : NOC_RT_3_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5520, /* IFE_PDAF_IFELITE : NOC_RT_3_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5524, /* IFE_PDAF_IFELITE : NOC_RT_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7A20, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT4-IFE_RDI_SFE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C30, /* IFE_RDI_SFE : NOC_RT_4_NIU_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C34, /* IFE_RDI_SFE : NOC_RT_4_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C38, /* IFE_RDI_SFE : NOC_RT_4_NIU_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C40, /* IFE_RDI_SFE : NOC_RT_4_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C48, /* IFE_RDI_SFE : NOC_RT_4_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8388, /* IFE_RDI_SFE : NOC_RT_4_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5588, /* IFE_RDI_SFE : NOC_RT_4_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x55A0, /* IFE_RDI_SFE : NOC_RT_4_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x55A4, /* IFE_RDI_SFE : NOC_RT_4_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7C20, /* IFE_RDI_SFE : NOC_RT_4_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	/* NRT ports */
+	{
+		.port_name = "NRT0-CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6630, /* CDM : NOC_NRT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6634, /* CDM : NOC_NRT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6638, /* CDM : NOC_NRT_0_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6640, /* CDM : NOC_NRT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6648, /* CDM : NOC_NRT_0_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7E08, /* CDM : NOC_NRT_0_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5008, /* CDM : NOC_NRT_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5020, /* CDM : NOC_NRT_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5024, /* CDM : NOC_NRT_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT1-JPEG_RD_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6830, /* JPEG : NOC_NRT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6834, /* JPEG : NOC_NRT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6838, /* JPEG : NOC_NRT_1_NIU_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6840, /* JPEG : NOC_NRT_1_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6848, /* JPEG : NOC_NRT_1_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7E88, /* JPEG : NOC_NRT_1_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5088, /* JPEG : NOC_NRT_1_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x50A0, /* JPEG : NOC_NRT_1_QOSGEN_SHAPING_LOW */
+			.value = 0x10101010,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x50A4, /* JPEG : NOC_NRT_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x10101010,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6820, /* JPEG : NOC_NRT_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT2-BPS_CRE_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A30, /* BPS_CRE_WR : NOC_NRT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A34, /* BPS_CRE_WR : NOC_NRT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A38, /* BPS_CRE_WR : NOC_NRT_2_NIU_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A40, /* BPS_CRE_WR : NOC_NRT_2_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6A48, /* BPS_CRE_WR : NOC_NRT_2_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7F08, /* BPS_CRE_WR : NOC_NRT_2_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5108, /* BPS_CRE_WR : NOC_NRT_2_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5120, /* BPS_CRE_WR : NOC_NRT_2_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5124, /* BPS_CRE_WR : NOC_NRT_2_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x6A20, /* BPS_CRE_WR : NOC_NRT_2_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT3-BPS_CRE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C30, /* BPS_CRE_RD : NOC_NRT_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C34, /* BPS_CRE_RD : NOC_NRT_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C38, /* BPS_CRE_RD : NOC_NRT_3_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C40, /* BPS_CRE_RD : NOC_NRT_3_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6C48, /* BPS_CRE_RD : NOC_NRT_3_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7F88, /* BPS_CRE_RD : NOC_NRT_3_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5188, /* BPS_CRE_RD : NOC_NRT_3_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x51A0, /* BPS_CRE_RD : NOC_NRT_3_QOSGEN_SHAPING_LOW */
+			.value = 0x14141414,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x51A4, /* BPS_CRE_RD : NOC_NRT_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x14141414,
+		},
+	},
+	{
+		.port_name = "NRT4-IPE_0_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E30, /* IPE_0_RD : NOC_NRT_4_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E34, /* IPE_0_RD : NOC_NRT_4_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E38, /* IPE_0_RD : NOC_NRT_4_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E40, /* IPE_0_RD : NOC_NRT_4_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6E48, /* IPE_0_RD : NOC_NRT_4_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6F08, /* IPE_0_RD : NOC_NRT_4_NIU_DECCTL_LOW */
+			.value = 1,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8008, /* IPE_0_RD : NOC_NRT_4_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5208, /* IPE_0_RD : NOC_NRT_4_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5220, /* IPE_0_RD : NOC_NRT_4_QOSGEN_SHAPING_LOW */
+			.value = 0x29292929,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5224, /* IPE_0_RD : NOC_NRT_4_QOSGEN_SHAPING_HIGH */
+			.value = 0x29292929,
+		},
+	},
+	{
+		.port_name = "NRT5-IPE_1_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7030, /* IPE_1_RD : NOC_NRT_5_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7034, /* IPE_1_RD : NOC_NRT_5_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7038, /* IPE_1_RD : NOC_NRT_5_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7040, /* IPE_1_RD : NOC_NRT_5_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7048, /* IPE_1_RD : NOC_NRT_5_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8088, /* IPE_1_RD : NOC_NRT_5_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5288, /* IPE_1_RD : NOC_NRT_5_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x52A0, /* IPE_1_RD : NOC_NRT_5_QOSGEN_SHAPING_LOW */
+			.value = 0x29292929,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x52A4, /* IPE_1_RD : NOC_NRT_5_QOSGEN_SHAPING_HIGH */
+			.value = 0x29292929,
+		},
+	},
+	{
+		.port_name = "NRT6-IPE_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7230, /* IPE_WR : NOC_NRT_6_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7234, /* IPE_WR : NOC_NRT_6_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7238, /* IPE_WR : NOC_NRT_6_NIU_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7240, /* IPE_WR : NOC_NRT_6_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7248, /* IPE_WR : NOC_NRT_6_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8108, /* IPE_WR : NOC_NRT_6_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5308, /* IPE_WR : NOC_NRT_6_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5320, /* IPE_WR : NOC_NRT_6_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5324, /* IPE_WR : NOC_NRT_6_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x7220, /* IPE_WR : NOC_NRT_6_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "ICP_RD_WR",
+		.enable = false,
+		.dynattr_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8408, /* ICP_RD_WR : NOC_XM_ICP_DYNATTR_MAINCTL */
+			.value = 0x10,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5608, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_MAINCTL */
+			.value = 0x40,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5620, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5624, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam780_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x08, /* NOC_ERL_MAINCTL_LOW */
+	.errvld       =  0x10, /* NOC_ERL_ERRVLD_LOW */
+	.errlog0_low  =  0x20, /* NOC_ERL_ERRLOG0_LOW */
+	.errlog0_high =  0x24, /* NOC_ERL_ERRLOG0_HIGH */
+	.errlog1_low  =  0x28, /* NOC_ERL_ERRLOG1_LOW */
+	.errlog1_high =  0x2C, /* NOC_ERL_ERRLOG1_HIGH */
+	.errlog2_low  =  0x30, /* NOC_ERL_ERRLOG2_LOW */
+	.errlog2_high =  0x34, /* NOC_ERL_ERRLOG2_HIGH */
+	.errlog3_low  =  0x38, /* NOC_ERL_ERRLOG3_LOW */
+	.errlog3_high =  0x3C, /* NOC_ERL_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam780_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+	.enable_icp_clk_for_qchannel = {
+		.enable = true,
+	},
+};
+
+static struct cam_camnoc_info cam780_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v780_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v780_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v780_100_irq_sbm,
+	.irq_err = &cam_cpas_v780_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v780_100_irq_err),
+	.err_logger = &cam780_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam780_cpas100_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x80,
+		.sbm_clear_mask = 0x2,
+	}
+};
+
+static struct cam_cpas_camnoc_qchannel cam780_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam780_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 1,
+		.hw_caps_offsets = {0x8},
+	},
+	.qchannel_info = {&cam780_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V780_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v860_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v860_100.h
@@ -0,0 +1,1347 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V860_100_H_
+#define _CPASTOP_V860_100_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v860_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x240,  /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x01 |/* SBM_FAULTINEN0_LOW_PORT0_MASK */
+			0x02 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |    /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |    /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20,     /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = 0xE,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v860_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x10, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x18, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x93A0, /* IFE_UBWC : RT_1_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x9390, /* IFE_UBWC : RT_1_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x9398, /* IFE_UBWC : RT_1_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x87A0, /* BPS_WR : NRT_2_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8790, /* BPS_WR : NRT_2_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8798, /* BPS_WR : NRT_2_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8B20, /* IPE_0_RD : NRT_4_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8B10, /* IPE_0_RD : NRT_4_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8B18, /* IPE_0_RD : NRT_4_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8D20, /* IPE_1_RD : NRT_5_NIU_DECERREN_LOW */
+			.value = 0XFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8D10, /* IPE_1_RD : NRT_5_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8D18, /* IPE_1_RD : NRT_5_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8FA0, /* IPE_WR : NRT_6_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8F90, /* IPE_WR : NRT_6_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8F98, /* IPE_WR : NRT_6_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x80, /* SBM_FAULTINSTATUS0_LOW_PORT7_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x3,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v860_100_camnoc_specific[] = {
+	/* RT ports */
+	{
+		.port_name = "RT0-SFE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9030, /* SFE_RD : NOC_RT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x44444444,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9034, /* SFE_RD : NOC_RT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x44444444,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9038, /* SFE_RD : NOC_RT_0_NIU_URGENCY_LOW */
+			.value = 0x1004,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9040, /* SFE_RD : NOC_RT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9048, /* SFE_RD : NOC_RT_0_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9D88, /* SFE_RD : NOC_RT_0_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7388, /* SFE_RD : NOC_RT_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x73A0, /* SFE_RD : NOC_RT_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x73A4, /* SFE_RD : NOC_RT_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT1-IFE_UBWC",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9230, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x65555544,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9234, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9238, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_URGENCY_LOW */
+			.value = 0x1E40,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9240, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9248, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9E08, /* IFE_UBWC_LINEAR : NOC_RT_1_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7408, /* IFE_UBWC_LINEAR : NOC_RT_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7420, /* IFE_UBWC_LINEAR : NOC_RT_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7424, /* IFE_UBWC_LINEAR : NOC_RT_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x9220, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT2-IFE_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9430, /* IFE_STATS : NOC_RT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x65555544,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9434, /* IFE_STATS : NOC_RT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9438, /* IFE_STATS : NOC_RT_2_NIU_URGENCY_LOW */
+			.value = 0x1C40,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9440, /* IFE_STATS : NOC_RT_2_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9448, /* IFE_STATS : NOC_RT_2_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9E88, /* IFE_STATS : NOC_RT_2_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7488, /* IFE_STATS : NOC_RT_2_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x74A0, /* IFE_STATS : NOC_RT_2_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x74A4, /* IFE_STATS : NOC_RT_2_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x9420, /* IFE_STATS : NOC_RT_2_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT3-IFE_PDAF_LINEAR_IFELITE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9630, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x65555544,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9634, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9638, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_URGENCY_LOW */
+			.value = 0x1C40,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9640, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9648, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9F08, /* IFE_PDAF_IFELITE : NOC_RT_3_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7508, /* IFE_PDAF_IFELITE : NOC_RT_3_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7520, /* IFE_PDAF_IFELITE : NOC_RT_3_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7524, /* IFE_PDAF_IFELITE : NOC_RT_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x9620, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT4-IFE_RDI_SFE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9830, /* IFE_RDI_SFE : NOC_RT_4_NIU_PRIORITYLUT_LOW */
+			.value = 0x65555544,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9834, /* IFE_RDI_SFE : NOC_RT_4_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9838, /* IFE_RDI_SFE : NOC_RT_4_NIU_URGENCY_LOW */
+			.value = 0x1E40,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9840, /* IFE_RDI_SFE : NOC_RT_4_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9848, /* IFE_RDI_SFE : NOC_RT_4_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9F88, /* IFE_RDI_SFE : NOC_RT_4_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7588, /* IFE_RDI_SFE : NOC_RT_4_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x75A0, /* IFE_RDI_SFE : NOC_RT_4_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x75A4, /* IFE_RDI_SFE : NOC_RT_4_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x9820, /* IFE_RDI_SFE : NOC_RT_4_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	/* NRT ports */
+	{
+		.port_name = "NRT0-CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8230, /* CDM : NOC_NRT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8234, /* CDM : NOC_NRT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8238, /* CDM : NOC_NRT_0_NIU_URGENCY_LOW */
+			.value = 0x1003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8240, /* CDM : NOC_NRT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8248, /* CDM : NOC_NRT_0_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9A08, /* CDM : NOC_NRT_0_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7008, /* CDM : NOC_NRT_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7020, /* CDM : NOC_NRT_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7024, /* CDM : NOC_NRT_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT1-JPEG_RD_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8430, /* JPEG : NOC_NRT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8434, /* JPEG : NOC_NRT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8438, /* JPEG : NOC_NRT_1_NIU_URGENCY_LOW */
+			.value = 0x0022,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8440, /* JPEG : NOC_NRT_1_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8448, /* JPEG : NOC_NRT_1_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9A88, /* JPEG : NOC_NRT_1_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7088, /* JPEG : NOC_NRT_1_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x70A0, /* JPEG : NOC_NRT_1_QOSGEN_SHAPING_LOW */
+			.value = 0x10101010,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x70A4, /* JPEG : NOC_NRT_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x10101010,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8420, /* JPEG : NOC_NRT_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT2-BPS_CRE_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8630, /* BPS_CRE_WR : NOC_NRT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8634, /* BPS_CRE_WR : NOC_NRT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8638, /* BPS_CRE_WR : NOC_NRT_2_NIU_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8640, /* BPS_CRE_WR : NOC_NRT_2_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8648, /* BPS_CRE_WR : NOC_NRT_2_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9B08, /* BPS_CRE_WR : NOC_NRT_2_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7108, /* BPS_CRE_WR : NOC_NRT_2_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7120, /* BPS_CRE_WR : NOC_NRT_2_QOSGEN_SHAPING_LOW */
+			.value = 0x14141414,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7124, /* BPS_CRE_WR : NOC_NRT_2_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x14141414,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8620, /* BPS_CRE_WR : NOC_NRT_2_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT3-BPS_CRE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8830, /* BPS_CRE_RD : NOC_NRT_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8834, /* BPS_CRE_RD : NOC_NRT_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8838, /* BPS_CRE_RD : NOC_NRT_3_NIU_URGENCY_LOW */
+			.value = 0x1003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8840, /* BPS_CRE_RD : NOC_NRT_3_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8848, /* BPS_CRE_RD : NOC_NRT_3_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9B88, /* BPS_CRE_RD : NOC_NRT_3_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7188, /* BPS_CRE_RD : NOC_NRT_3_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x71A0, /* BPS_CRE_RD : NOC_NRT_3_QOSGEN_SHAPING_LOW */
+			.value = 0x14141414,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x71A4, /* BPS_CRE_RD : NOC_NRT_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x14141414,
+		},
+	},
+	{
+		.port_name = "NRT4-IPE_0_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A30, /* IPE_0_RD : NOC_NRT_4_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A34, /* IPE_0_RD : NOC_NRT_4_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A38, /* IPE_0_RD : NOC_NRT_4_NIU_URGENCY_LOW */
+			.value = 0x1003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A40, /* IPE_0_RD : NOC_NRT_4_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A48, /* IPE_0_RD : NOC_NRT_4_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8B08, /* IPE_0_RD : NOC_NRT_4_NIU_DECCTL_LOW */
+			.value = 1,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9C08, /* IPE_0_RD : NOC_NRT_4_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7208, /* IPE_0_RD : NOC_NRT_4_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7220, /* IPE_0_RD : NOC_NRT_4_QOSGEN_SHAPING_LOW */
+			.value = 0x2E2E2E2E,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7224, /* IPE_0_RD : NOC_NRT_4_QOSGEN_SHAPING_HIGH */
+			.value = 0x2E2E2E2E,
+		},
+	},
+	{
+		.port_name = "NRT5-IPE_1_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C30, /* IPE_1_RD : NOC_NRT_5_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C34, /* IPE_1_RD : NOC_NRT_5_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C38, /* IPE_1_RD : NOC_NRT_5_NIU_URGENCY_LOW */
+			.value = 0x1003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C40, /* IPE_1_RD : NOC_NRT_5_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C48, /* IPE_1_RD : NOC_NRT_5_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9C88, /* IPE_1_RD : NOC_NRT_5_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7288, /* IPE_1_RD : NOC_NRT_5_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x72A0, /* IPE_1_RD : NOC_NRT_5_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x72A4, /* IPE_1_RD : NOC_NRT_5_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT6-IPE_WR_0",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E30, /* IPE_WR_0 : NOC_NRT_6_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E34, /* IPE_WR_0 : NOC_NRT_6_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E38, /* IPE_WR_0 : NOC_NRT_6_NIU_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E40, /* IPE_WR_0 : NOC_NRT_6_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E48, /* IPE_WR_0 : NOC_NRT_6_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9D08, /* IPE_WR_0 : NOC_NRT_6_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7308, /* IPE_WR_0 : NOC_NRT_6_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7320, /* IPE_WR_0 : NOC_NRT_6_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7324, /* IPE_WR_0 : NOC_NRT_6_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8E20, /* IPE_WR_0 : NOC_NRT_6_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+		{
+		.port_name = "NRT7-IPE_WR_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA430, /* IPE_WR_1 : NOC_NRT_7_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA434, /* IPE_WR_1 : NOC_NRT_7_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA438, /* IPE_WR_1 : NOC_NRT_7_NIU_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA440, /* IPE_WR_1 : NOC_NRT_7_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA448, /* IPE_WR_1 : NOC_NRT_7_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA608, /* IPE_WR_1 : NOC_NRT_7_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA688, /* IPE_WR_1 : NOC_NRT_7_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA6A0, /* IPE_WR_1 : NOC_NRT_7_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA6A4, /* IPE_WR_1 : NOC_NRT_7_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0xA420, /* IPE_WR_1 : NOC_NRT_7_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "ICP_RD_WR",
+		.enable = false,
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA008, /* ICP_RD_WR : NOC_XM_ICP_DYNATTR_MAINCTL */
+			.value = 0x10,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7608, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_MAINCTL */
+			.value = 0x1000040,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7620, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7624, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam860_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x08, /* NOC_ERL_MAINCTL_LOW */
+	.errvld       =  0x10, /* NOC_ERL_ERRVLD_LOW */
+	.errlog0_low  =  0x20, /* NOC_ERL_ERRLOG0_LOW */
+	.errlog0_high =  0x24, /* NOC_ERL_ERRLOG0_HIGH */
+	.errlog1_low  =  0x28, /* NOC_ERL_ERRLOG1_LOW */
+	.errlog1_high =  0x2C, /* NOC_ERL_ERRLOG1_HIGH */
+	.errlog2_low  =  0x30, /* NOC_ERL_ERRLOG2_LOW */
+	.errlog2_high =  0x34, /* NOC_ERL_ERRLOG2_HIGH */
+	.errlog3_low  =  0x38, /* NOC_ERL_ERRLOG3_LOW */
+	.errlog3_high =  0x3C, /* NOC_ERL_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam860_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+	.enable_icp_clk_for_qchannel = {
+		.enable = true,
+	},
+};
+
+static struct cam_cpas_cesta_vcd_reg_info cam_cpas_v860_100_cesta_reg_info = {
+	.vcd_currol = {
+		.reg_offset = 0x300c,
+		.vcd_base_inc = 0x200,
+		.num_vcds = 8,
+	},
+
+};
+
+static struct cam_cpas_vcd_info cam_v860_100_vcd_info[] = {
+	{
+		.index = 0, .type = CAM_CESTA_CRMC, .clk = "cam_cc_ife_0_clk_src",
+	},
+	{
+		.index = 1, .type = CAM_CESTA_CRMC, .clk = "cam_cc_ife_1_clk_src",
+	},
+	{
+		.index = 2, .type = CAM_CESTA_CRMC, .clk = "cam_cc_ife_2_clk_src",
+	},
+	{
+		.index = 3, .type = CAM_CESTA_CRMC, .clk = "cam_cc_sfe_0_clk_src",
+	},
+	{
+		.index = 4, .type = CAM_CESTA_CRMC, .clk = "cam_cc_sfe_1_clk_src",
+	},
+	{
+		.index = 6, .type = CAM_CESTA_CRMC, .clk = "cam_cc_csid_clk_src",
+	},
+	{
+		.index = 7, .type = CAM_CESTA_CRMC, .clk = "cam_cc_cphy_rx_clk_src",
+	},
+	{
+		.index = 8, .type = CAM_CESTA_CRMB, .clk = "cam_cc_camnoc_axi_rt_clk_src",
+	},
+};
+
+static struct cam_cpas_cesta_info cam_v860_cesta_info = {
+	 .vcd_info = &cam_v860_100_vcd_info[0],
+	 .num_vcds = ARRAY_SIZE(cam_v860_100_vcd_info),
+	 .cesta_reg_info = &cam_cpas_v860_100_cesta_reg_info,
+};
+
+static struct cam_camnoc_info cam860_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v860_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v860_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v860_100_irq_sbm,
+	.irq_err = &cam_cpas_v860_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v860_100_irq_err),
+	.err_logger = &cam860_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam860_cpas100_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x80,
+		.sbm_clear_mask = 0x4,
+	},
+};
+
+static struct cam_cpas_camnoc_qchannel cam860_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam860_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 2,
+		.hw_caps_offsets = {0x8, 0xDC},
+	},
+	.qchannel_info = {&cam860_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V860_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v880_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v880_100.h
@@ -0,0 +1,1351 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V880_100_H_
+#define _CPASTOP_V880_100_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v880_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x240,  /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x01 |/* SBM_FAULTINEN0_LOW_PORT0_MASK */
+			0x02 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |    /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |    /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20,     /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = 0xE,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v880_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x10, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x18, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x93A0, /* IFE_UBWC : RT_1_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x9390, /* IFE_UBWC : RT_1_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x9398, /* IFE_UBWC : RT_1_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x87A0, /* BPS_WR : NRT_2_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8790, /* BPS_WR : NRT_2_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8798, /* BPS_WR : NRT_2_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8B20, /* IPE_0_RD : NRT_4_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8B10, /* IPE_0_RD : NRT_4_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8B18, /* IPE_0_RD : NRT_4_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8D20, /* IPE_1_RD : NRT_5_NIU_DECERREN_LOW */
+			.value = 0XFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8D10, /* IPE_1_RD : NRT_5_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8D18, /* IPE_1_RD : NRT_5_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8FA0, /* IPE_WR : NRT_6_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x8F90, /* IPE_WR : NRT_6_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x8F98, /* IPE_WR : NRT_6_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x80, /* SBM_FAULTINSTATUS0_LOW_PORT7_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x3,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v880_100_camnoc_specific[] = {
+	/* RT ports */
+	{
+		.port_name = "RT0-SFE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9030, /* SFE_RD : NOC_RT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9034, /* SFE_RD : NOC_RT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9038, /* SFE_RD : NOC_RT_0_NIU_URGENCY_LOW */
+			.value = 0x4,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9040, /* SFE_RD : NOC_RT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9048, /* SFE_RD : NOC_RT_0_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9D88, /* SFE_RD : NOC_RT_0_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7388, /* SFE_RD : NOC_RT_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x73A0, /* SFE_RD : NOC_RT_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x73A4, /* SFE_RD : NOC_RT_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT1-IFE_UBWC",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9230, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x65555544,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9234, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9238, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_URGENCY_LOW */
+			.value = 0x1E40,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9240, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9248, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9E08, /* IFE_UBWC_LINEAR : NOC_RT_1_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7408, /* IFE_UBWC_LINEAR : NOC_RT_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7420, /* IFE_UBWC_LINEAR : NOC_RT_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7424, /* IFE_UBWC_LINEAR : NOC_RT_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x9220, /* IFE_UBWC_LINEAR : NOC_RT_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT2-IFE_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9430, /* IFE_STATS : NOC_RT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x65555544,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9434, /* IFE_STATS : NOC_RT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9438, /* IFE_STATS : NOC_RT_2_NIU_URGENCY_LOW */
+			.value = 0x1C40,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9440, /* IFE_STATS : NOC_RT_2_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9448, /* IFE_STATS : NOC_RT_2_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9E88, /* IFE_STATS : NOC_RT_2_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7488, /* IFE_STATS : NOC_RT_2_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x74A0, /* IFE_STATS : NOC_RT_2_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x74A4, /* IFE_STATS : NOC_RT_2_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x9420, /* IFE_STATS : NOC_RT_2_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT3-IFE_PDAF_LINEAR_IFELITE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9630, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x65555544,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9634, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9638, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_URGENCY_LOW */
+			.value = 0x1C40,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9640, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9648, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9F08, /* IFE_PDAF_IFELITE : NOC_RT_3_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7508, /* IFE_PDAF_IFELITE : NOC_RT_3_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7520, /* IFE_PDAF_IFELITE : NOC_RT_3_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7524, /* IFE_PDAF_IFELITE : NOC_RT_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x9620, /* IFE_PDAF_IFELITE : NOC_RT_3_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT4-IFE_RDI_SFE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9830, /* IFE_RDI_SFE : NOC_RT_4_NIU_PRIORITYLUT_LOW */
+			.value = 0x65555544,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9834, /* IFE_RDI_SFE : NOC_RT_4_NIU_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9838, /* IFE_RDI_SFE : NOC_RT_4_NIU_URGENCY_LOW */
+			.value = 0x1E40,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9840, /* IFE_RDI_SFE : NOC_RT_4_NIU_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9848, /* IFE_RDI_SFE : NOC_RT_4_NIU_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9F88, /* IFE_RDI_SFE : NOC_RT_4_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7588, /* IFE_RDI_SFE : NOC_RT_4_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x75A0, /* IFE_RDI_SFE : NOC_RT_4_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x75A4, /* IFE_RDI_SFE : NOC_RT_4_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x9820, /* IFE_RDI_SFE : NOC_RT_4_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	/* NRT ports */
+	{
+		.port_name = "NRT0-CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8230, /* CDM : NOC_NRT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8234, /* CDM : NOC_NRT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8238, /* CDM : NOC_NRT_0_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8240, /* CDM : NOC_NRT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8248, /* CDM : NOC_NRT_0_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9A08, /* CDM : NOC_NRT_0_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7008, /* CDM : NOC_NRT_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7020, /* CDM : NOC_NRT_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7024, /* CDM : NOC_NRT_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT1-JPEG_RD_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8430, /* JPEG : NOC_NRT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8434, /* JPEG : NOC_NRT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8438, /* JPEG : NOC_NRT_1_NIU_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8440, /* JPEG : NOC_NRT_1_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8448, /* JPEG : NOC_NRT_1_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9A88, /* JPEG : NOC_NRT_1_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7088, /* JPEG : NOC_NRT_1_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x70A0, /* JPEG : NOC_NRT_1_QOSGEN_SHAPING_LOW */
+			.value = 0x10101010,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x70A4, /* JPEG : NOC_NRT_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x10101010,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8420, /* JPEG : NOC_NRT_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT2-BPS_CRE_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8630, /* BPS_CRE_WR : NOC_NRT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8634, /* BPS_CRE_WR : NOC_NRT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8638, /* BPS_CRE_WR : NOC_NRT_2_NIU_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8640, /* BPS_CRE_WR : NOC_NRT_2_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8648, /* BPS_CRE_WR : NOC_NRT_2_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9B08, /* BPS_CRE_WR : NOC_NRT_2_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7108, /* BPS_CRE_WR : NOC_NRT_2_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7120, /* BPS_CRE_WR : NOC_NRT_2_QOSGEN_SHAPING_LOW */
+			.value = 0x14141414,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7124, /* BPS_CRE_WR : NOC_NRT_2_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x14141414,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8620, /* BPS_CRE_WR : NOC_NRT_2_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT3-BPS_CRE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8830, /* BPS_CRE_RD : NOC_NRT_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8834, /* BPS_CRE_RD : NOC_NRT_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8838, /* BPS_CRE_RD : NOC_NRT_3_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8840, /* BPS_CRE_RD : NOC_NRT_3_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8848, /* BPS_CRE_RD : NOC_NRT_3_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9B88, /* BPS_CRE_RD : NOC_NRT_3_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7188, /* BPS_CRE_RD : NOC_NRT_3_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x71A0, /* BPS_CRE_RD : NOC_NRT_3_QOSGEN_SHAPING_LOW */
+			.value = 0x14141414,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x71A4, /* BPS_CRE_RD : NOC_NRT_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x14141414,
+		},
+	},
+	{
+		.port_name = "NRT4-IPE_0_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A30, /* IPE_0_RD : NOC_NRT_4_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A34, /* IPE_0_RD : NOC_NRT_4_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A38, /* IPE_0_RD : NOC_NRT_4_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A40, /* IPE_0_RD : NOC_NRT_4_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8A48, /* IPE_0_RD : NOC_NRT_4_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8B08, /* IPE_0_RD : NOC_NRT_4_NIU_DECCTL_LOW */
+			.value = 1,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9C08, /* IPE_0_RD : NOC_NRT_4_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7208, /* IPE_0_RD : NOC_NRT_4_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7220, /* IPE_0_RD : NOC_NRT_4_QOSGEN_SHAPING_LOW */
+			.value = 0x2E2E2E2E,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7224, /* IPE_0_RD : NOC_NRT_4_QOSGEN_SHAPING_HIGH */
+			.value = 0x2E2E2E2E,
+		},
+	},
+	{
+		.port_name = "NRT5-IPE_1_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C30, /* IPE_1_RD : NOC_NRT_5_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C34, /* IPE_1_RD : NOC_NRT_5_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C38, /* IPE_1_RD : NOC_NRT_5_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C40, /* IPE_1_RD : NOC_NRT_5_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8C48, /* IPE_1_RD : NOC_NRT_5_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9C88, /* IPE_1_RD : NOC_NRT_5_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7288, /* IPE_1_RD : NOC_NRT_5_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x72A0, /* IPE_1_RD : NOC_NRT_5_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x72A4, /* IPE_1_RD : NOC_NRT_5_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT6-IPE_WR_0",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E30, /* IPE_WR_0 : NOC_NRT_6_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E34, /* IPE_WR_0 : NOC_NRT_6_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E38, /* IPE_WR_0 : NOC_NRT_6_NIU_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E40, /* IPE_WR_0 : NOC_NRT_6_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8E48, /* IPE_WR_0 : NOC_NRT_6_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x9D08, /* IPE_WR_0 : NOC_NRT_6_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7308, /* IPE_WR_0 : NOC_NRT_6_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7320, /* IPE_WR_0 : NOC_NRT_6_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7324, /* IPE_WR_0 : NOC_NRT_6_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x8E20, /* IPE_WR_0 : NOC_NRT_6_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+		{
+		.port_name = "NRT7-IPE_WR_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA430, /* IPE_WR_1 : NOC_NRT_7_NIU_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA434, /* IPE_WR_1 : NOC_NRT_7_NIU_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA438, /* IPE_WR_1 : NOC_NRT_7_NIU_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA440, /* IPE_WR_1 : NOC_NRT_7_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA448, /* IPE_WR_1 : NOC_NRT_7_NIU_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA608, /* IPE_WR_1 : NOC_NRT_7_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA688, /* IPE_WR_1 : NOC_NRT_7_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA6A0, /* IPE_WR_1 : NOC_NRT_7_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA6A4, /* IPE_WR_1 : NOC_NRT_7_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0xA420, /* IPE_WR_1 : NOC_NRT_7_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "ICP_RD_WR",
+		.enable = false,
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA008, /* ICP_RD_WR : NOC_XM_ICP_DYNATTR_MAINCTL */
+			.value = 0x10,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7608, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_MAINCTL */
+			.value = 0x50,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7620, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7624, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam880_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x08, /* NOC_ERL_MAINCTL_LOW */
+	.errvld       =  0x10, /* NOC_ERL_ERRVLD_LOW */
+	.errlog0_low  =  0x20, /* NOC_ERL_ERRLOG0_LOW */
+	.errlog0_high =  0x24, /* NOC_ERL_ERRLOG0_HIGH */
+	.errlog1_low  =  0x28, /* NOC_ERL_ERRLOG1_LOW */
+	.errlog1_high =  0x2C, /* NOC_ERL_ERRLOG1_HIGH */
+	.errlog2_low  =  0x30, /* NOC_ERL_ERRLOG2_LOW */
+	.errlog2_high =  0x34, /* NOC_ERL_ERRLOG2_HIGH */
+	.errlog3_low  =  0x38, /* NOC_ERL_ERRLOG3_LOW */
+	.errlog3_high =  0x3C, /* NOC_ERL_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam880_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+	.enable_icp_clk_for_qchannel = {
+		.enable = true,
+	},
+};
+
+static struct cam_cpas_cesta_vcd_reg_info cam_cpas_v880_100_cesta_reg_info = {
+	.vcd_currol = {
+		.reg_offset = 0x300c,
+		.vcd_base_inc = 0x200,
+		.num_vcds = 8,
+	},
+
+};
+
+static struct cam_cpas_vcd_info cam_v880_100_vcd_info[] = {
+	{
+		.index = 0, .type = CAM_CESTA_CRMC, .clk = "cam_cc_ife_0_clk_src",
+	},
+	{
+		.index = 1, .type = CAM_CESTA_CRMC, .clk = "cam_cc_ife_1_clk_src",
+	},
+	{
+		.index = 2, .type = CAM_CESTA_CRMC, .clk = "cam_cc_ife_2_clk_src",
+	},
+	{
+		.index = 3, .type = CAM_CESTA_CRMC, .clk = "cam_cc_sfe_0_clk_src",
+	},
+	{
+		.index = 4, .type = CAM_CESTA_CRMC, .clk = "cam_cc_sfe_1_clk_src",
+	},
+	{
+		.index = 5, .type = CAM_CESTA_CRMC, .clk = "cam_cc_sfe_2_clk_src",
+	},
+	{
+		.index = 6, .type = CAM_CESTA_CRMC, .clk = "cam_cc_csid_clk_src",
+	},
+	{
+		.index = 7, .type = CAM_CESTA_CRMC, .clk = "cam_cc_cphy_rx_clk_src",
+	},
+	{
+		.index = 8, .type = CAM_CESTA_CRMB, .clk = "cam_cc_camnoc_axi_rt_clk_src",
+	},
+};
+
+static struct cam_cpas_cesta_info cam_v880_cesta_info = {
+	 .vcd_info = &cam_v880_100_vcd_info[0],
+	 .num_vcds = ARRAY_SIZE(cam_v880_100_vcd_info),
+	 .cesta_reg_info = &cam_cpas_v880_100_cesta_reg_info,
+};
+
+static struct cam_camnoc_info cam880_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v880_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v880_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v880_100_irq_sbm,
+	.irq_err = &cam_cpas_v880_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v880_100_irq_err),
+	.err_logger = &cam880_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam880_cpas100_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x80,
+		.sbm_clear_mask = 0x4,
+	},
+};
+
+static struct cam_cpas_camnoc_qchannel cam880_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+
+static struct cam_cpas_info cam880_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 2,
+		.hw_caps_offsets = {0x8, 0xDC},
+	},
+	.qchannel_info = {&cam880_cpas100_qchannel_info},
+	.num_qchannel = 1,
+};
+
+#endif /* _CPASTOP_V880_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v980_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/cpas_top/cpastop_v980_100.h
@@ -0,0 +1,1615 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V980_100_H_
+#define _CPASTOP_V980_100_H_
+
+static struct cam_camnoc_irq_sbm cam_cpas_v980_100_irq_sbm_rt = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x240,  /* CAM_NOC_RT_SBM_FAULTINEN0_LOW */
+		.value = 0x01 |   /* RT_SBM_FAULTINEN0_LOW_PORT0_MASK - Slave error IRQ */
+			0x02,    /* RT_SBM_FAULTINEN0_LOW_PORT1_MASK - TFE UBWC Encoder Error IRQ */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x248, /* CAM_NOC_RT_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x280, /* CAM_NOC_RT_SBM_FLAGOUTCLR0_LOW */
+		.value = 0x7,
+	}
+};
+
+static struct cam_camnoc_irq_sbm cam_cpas_v980_100_irq_sbm_nrt = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x240,  /* CAM_NOC_NRT_SBM_FAULTINEN0_LOW */
+		.value = 0x01 |   /* NRT_SBM_FAULTINEN0_LOW_PORT0_MASK - Slave Error */
+			0x02 |    /* NRT_SBM_FAULTINEN0_LOW_PORT1_MASK - IPE WR UBWC En */
+			0x04 |    /* NRT_SBM_FAULTINEN0_LOW_PORT2_MASK - OFE WR UBWC En */
+			0x08 |    /* NRT_SBM_FAULTINEN0_LOW_PORT3_MASK - OFE RD UBWC De */
+			0x10 |    /* NRT_SBM_FAULTINEN0_LOW_PORT4_MASK - IPE RD UBWC En */
+			0x20,     /* NRT_SBM_FAULTINEN0_LOW_PORT5_MASK - IPE RD UBWC En */
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x248, /* CAM_NOC_NRT_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x280, /* CAM_NOC_NRT_SBM_FLAGOUTCLR0_LOW */
+		.value = 0x7,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v980_100_irq_err_rt[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* RT_SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8, /* CAM_NOC_RT_ERL_MAINCTL_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x10, /* CAM_NOC_RT_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x18, /* CAM_NOC_RT_ERL_ERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_TFE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* RT_SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x47A0, /* TFE_UBWC : RT_0_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x4790, /* IFE_UBWC : RT_0_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x4798, /* IFE_UBWC : RT_0_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x20, /* RT_SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* RT_CAM_NOC_RT_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_RT_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_RT_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v980_100_irq_err_nrt[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* NRT_SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x8, /* CAM_NOC_NRT_ERL_MAINCTL_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x10, /* CAM_NOC_NRT_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x18, /* CAM_NOC_NRT_ERL_ERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_OFE_UBWC_WRITE_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* NRT_SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x63A0, /* OFE_WR : NRT_3_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6390, /* OFE_WR : NRT_3_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6398, /* OFE_WR : NRT_3_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_OFE_UBWC_READ_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* NRT_SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6520, /* OFE_RD : NRT_4_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6510, /* OFE_RD : NRT_4_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6518, /* OFE_RD : NRT_4_NIU_DECERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* NRT_SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x59A0, /* IPE_WR : NRT_1_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5990, /* IPE_WR : NRT_1_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5998, /* IPE_WR : NRT_1_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x20, /* NRT_SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6D20, /* IPE_0_RD : NRT_8_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6D10, /* IPE_0_RD : NRT_8_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6D18, /* IPE_0_RD : NRT_8_NIU_DECERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* NRT_SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6B20, /* IPE_1_RD : NRT_7_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6B10, /* IPE_1_RD : NRT_7_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6B18, /* IPE_1_RD : NRT_7_NIU_DECERRCLR_LOW */
+			.value = 0xFF,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* NRT_SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_NRT_SBM_FLAGOUTSET0_LOW */
+			.value = 0xE,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_NRT_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_NRT_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = false,
+		.sbm_port = 0x400, /* NRT_SBM_FAULTINSTATUS0_LOW_PORT10_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x288, /* CAM_NOC_NRT_SBM_FLAGOUTSET0_LOW */
+			.value = 0x2,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x290, /* CAM_NOC_NRT_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_NRT_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v980_100_camnoc_specific_rt[] = {
+	/* RT ports */
+	{
+		.port_name = "RT0-TFE_LINEAR_RDI",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_0_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_0_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_0_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT1-TFE_FD_PDAF_IFE_LITE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_FD_PDAF_IFE_LITE : NOC_RT_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT2-TFE_STATS",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_STATS : NOC_RT_2_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT3-TFE_IFE_LITE_CDM",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_IFE_LITE_CDM : NOC_RT_3_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "RT4-TFE_LINEAR_RDI",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* TFE_LINEAR_RDI : NOC_RT_4_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v980_100_camnoc_specific_nrt[] = {
+	/* NRT ports */
+	{
+		.port_name = "NRT0-IPE_WR_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_0_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_0_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_0_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_0_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_0_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_0_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT1-IPE_WR_0",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_0 : NOC_NRT_1_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT2-OFE_WR_1-CRE_WR",
+		.enable = false,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_1-CRE_WR : NOC_NRT_2_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT3-OFE_WR_0",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_0 : NOC_NRT_3_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_0 : NOC_NRT_3_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_0 : NOC_NRT_3_NIU_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_0 : NOC_NRT_3_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_0 : NOC_NRT_3_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_0 : NOC_NRT_3_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_0 : NOC_NRT_3_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_0 : NOC_NRT_3_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_WR_0 : NOC_NRT_3_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT4-OFE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_NIU_DECCTL_LOW */
+			.value = 1,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* OFE_RD : NOC_NRT_4_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT5-CRE_RD",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CRE_RD : NOC_NRT_5_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CRE_RD : NOC_NRT_5_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CRE_RD : NOC_NRT_5_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CRE_RD : NOC_NRT_5_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CRE_RD : NOC_NRT_5_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CRE_RD : NOC_NRT_5_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CRE_RD : NOC_NRT_5_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CRE_RD : NOC_NRT_5_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CRE_RD : NOC_NRT_5_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT6-JPEG_RD_WR",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* JPEG_RD_WR : NOC_NRT_6_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT7-IPE_WR_1",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_WR_1 : NOC_NRT_7_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT8-IPE_RD_0",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* IPE_RD_0 : NOC_NRT_8_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "NRT9-CDM_IPE_OFE",
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_NIU_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_NIU_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_NIU_URGENCY_LOW */
+			.value = 0x0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_NIU_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_NIU_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+		.dynattr_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+		.maxwr_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ,
+			.masked_value = 0,
+			.offset = 0x0, /* CDM_IPE_OFE : NOC_NRT_9_NIU_MAXWR_LOW */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_name = "ICP_RD_WR",
+		.enable = false,
+		.dynattr_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* ICP_RD_WR : NOC_XM_ICP_DYNATTR_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x0, /* ICP_RD_WR : NOC_XM_ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam980_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x08, /* NOC_ERL_MAINCTL_LOW */
+	.errvld       =  0x10, /* NOC_ERL_ERRVLD_LOW */
+	.errlog0_low  =  0x20, /* NOC_ERL_ERRLOG0_LOW */
+	.errlog0_high =  0x24, /* NOC_ERL_ERRLOG0_HIGH */
+	.errlog1_low  =  0x28, /* NOC_ERL_ERRLOG1_LOW */
+	.errlog1_high =  0x2C, /* NOC_ERL_ERRLOG1_HIGH */
+	.errlog2_low  =  0x30, /* NOC_ERL_ERRLOG2_LOW */
+	.errlog2_high =  0x34, /* NOC_ERL_ERRLOG2_HIGH */
+	.errlog3_low  =  0x38, /* NOC_ERL_ERRLOG3_LOW */
+	.errlog3_high =  0x3C, /* NOC_ERL_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam980_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+	.enable_icp_clk_for_qchannel = {
+		.enable = false,
+	},
+};
+
+static struct cam_cpas_cesta_vcd_reg_info cam_cpas_v980_100_cesta_reg_info = {
+	.vcd_currol = {
+		.reg_offset = 0x266C,
+		.vcd_base_inc = 0x210,
+		.num_vcds = 8,
+	},
+};
+
+static struct cam_cpas_vcd_info cam_v980_100_vcd_info[] = {
+	{
+		.index = 0, .type = CAM_CESTA_CRMC, .clk = "cam_cc_tfe_0_clk_src",
+	},
+	{
+		.index = 1, .type = CAM_CESTA_CRMC, .clk = "cam_cc_tfe_1_clk_src",
+	},
+	{
+		.index = 2, .type = CAM_CESTA_CRMC, .clk = "cam_cc_tfe_2_clk_src",
+	},
+	{
+		.index = 6, .type = CAM_CESTA_CRMC, .clk = "cam_cc_csid_clk_src",
+	},
+	{
+		.index = 7, .type = CAM_CESTA_CRMC, .clk = "cam_cc_cphy_rx_clk_src",
+	},
+	{
+		.index = 8, .type = CAM_CESTA_CRMB, .clk = "cam_cc_camnoc_axi_rt_clk_src",
+	},
+};
+
+static struct cam_cpas_cesta_info cam_v980_cesta_info = {
+	 .vcd_info = &cam_v980_100_vcd_info[0],
+	 .num_vcds = ARRAY_SIZE(cam_v980_100_vcd_info),
+	 .cesta_reg_info = &cam_cpas_v980_100_cesta_reg_info,
+};
+
+static struct cam_camnoc_info cam980_cpas100_camnoc_info_rt = {
+	.specific = &cam_cpas_v980_100_camnoc_specific_rt[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v980_100_camnoc_specific_rt),
+	.irq_sbm = &cam_cpas_v980_100_irq_sbm_rt,
+	.irq_err = &cam_cpas_v980_100_irq_err_rt[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v980_100_irq_err_rt),
+	.err_logger = &cam980_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam980_cpas100_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x20,
+		.sbm_clear_mask = 0x4,
+	},
+};
+
+static struct cam_camnoc_info cam980_cpas100_camnoc_info_nrt = {
+	.specific = &cam_cpas_v980_100_camnoc_specific_nrt[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v980_100_camnoc_specific_nrt),
+	.irq_sbm = &cam_cpas_v980_100_irq_sbm_nrt,
+	.irq_err = &cam_cpas_v980_100_irq_err_nrt[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v980_100_irq_err_nrt),
+	.err_logger = &cam980_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam980_cpas100_errata_wa_list,
+	.test_irq_info = {
+		.sbm_enable_mask = 0x400,
+		.sbm_clear_mask = 0x1,
+	},
+};
+
+static struct cam_cpas_camnoc_qchannel cam980_cpas100_qchannel_info_rt = {
+	.qchannel_ctrl   = 0xEC,
+	.qchannel_status = 0xF0,
+};
+
+static struct cam_cpas_camnoc_qchannel cam980_cpas100_qchannel_info_nrt = {
+	.qchannel_ctrl   = 0xF4,
+	.qchannel_status = 0xF8,
+};
+
+static struct cam_cpas_info cam980_cpas100_cpas_info = {
+	.hw_caps_info = {
+		.num_caps_registers = 2,
+		.hw_caps_offsets = {0x8, 0xDC},
+	},
+	.qchannel_info = {&cam980_cpas100_qchannel_info_rt,
+		&cam980_cpas100_qchannel_info_nrt},
+	.num_qchannel = 2,
+};
+
+#endif /* _CPASTOP_V980_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cpas/include/cam_cpas_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cpas/include/cam_cpas_api.h
@@ -0,0 +1,1083 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CPAS_API_H_
+#define _CAM_CPAS_API_H_
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+
+#include <media/cam_cpas.h>
+#include "cam_soc_util.h"
+#include "cam_req_mgr_interface.h"
+
+#define CAM_HW_IDENTIFIER_LENGTH 128
+
+/* Default AXI Bandwidth vote */
+#define CAM_CPAS_DEFAULT_AXI_BW 1024
+
+/* Default RT AXI Bandwidth vote */
+#define CAM_CPAS_DEFAULT_RT_AXI_BW 2000000000L
+
+#define CAM_CPAS_MAX_PATHS_PER_CLIENT 15
+#define CAM_CPAS_API_PATH_DATA_STD_START 512
+
+#define CAM_CPAS_VOTE_LEVEL_NONE 0
+#define CAM_CPAS_VOTE_LEVEL_MAX 3
+
+/* QoS Selection mask */
+#define CAM_CPAS_QOS_DEFAULT_SETTINGS_MASK 0x1
+#define CAM_CPAS_QOS_CUSTOM_SETTINGS_MASK  0x2
+
+/* Reg base type for Smart QoS update */
+#define CAM_CAMNOC_HW_RT_MASK       0x1
+#define CAM_CAMNOC_HW_NRT_MASK      0x2
+#define CAM_CAMNOC_HW_COMBINED_MASK 0x4
+#define CAM_CAMNOC_HW_TYPE_SHIFT    28
+
+/**
+ * Secure camera QoS update id - Enum for identify QOS settings update type
+ */
+enum secure_camera_qos_update_type {
+	CAM_QOS_UPDATE_TYPE_STATIC = 0x0,
+	CAM_QOS_UPDATE_TYPE_SMART = 0x1,
+	CAM_QOS_UPDATE_TYPE_MAX,
+};
+
+/**
+ * enum cam_cpas_regbase_types - Enum for cpas regbase available for clients
+ *                             to read/write
+ */
+enum cam_cpas_regbase_types {
+	CAM_CPAS_REGBASE_CPASTOP,
+	CAM_CPAS_REGBASE_MAX
+};
+
+/**
+ * enum cam_cpas_vote_type - Enum for cpas vote type
+ */
+enum cam_cpas_vote_type {
+	CAM_CPAS_VOTE_TYPE_HLOS,
+	CAM_CPAS_VOTE_TYPE_DRV,
+	CAM_CPAS_VOTE_TYPE_MAX,
+};
+
+/**
+ * enum cam_cpas_hw_index  - Enum for identify HW index
+ */
+enum cam_cpas_hw_index {
+	CAM_CPAS_HW_IDX_ANY = 0,
+	CAM_CPAS_HW_IDX_0 = 1<<0,
+	CAM_CPAS_HW_IDX_1 = 1<<1,
+	CAM_CPAS_HW_IDX_2 = 1<<2,
+	CAM_CPAS_HW_IDX_3 = 1<<3,
+	CAM_CPAS_HW_IDX_4 = 1<<4,
+	CAM_CPAS_HW_IDX_5 = 1<<5,
+	CAM_CPAS_HW_IDX_6 = 1<<6,
+	CAM_CPAS_HW_IDX_7 = 1<<7,
+	CAM_CPAS_HW_IDX_MAX = 1<<8
+};
+
+/**
+ * enum cam_cpas_camera_version Enum for Titan Camera Versions
+ */
+enum cam_cpas_camera_version {
+	CAM_CPAS_CAMERA_VERSION_NONE = 0,
+	CAM_CPAS_CAMERA_VERSION_150  = 0x00010500,
+	CAM_CPAS_CAMERA_VERSION_170  = 0x00010700,
+	CAM_CPAS_CAMERA_VERSION_175  = 0x00010705,
+	CAM_CPAS_CAMERA_VERSION_480  = 0x00040800,
+	CAM_CPAS_CAMERA_VERSION_520  = 0x00050200,
+	CAM_CPAS_CAMERA_VERSION_540  = 0x00050400,
+	CAM_CPAS_CAMERA_VERSION_580  = 0x00050800,
+	CAM_CPAS_CAMERA_VERSION_545  = 0x00050405,
+	CAM_CPAS_CAMERA_VERSION_570  = 0x00050700,
+	CAM_CPAS_CAMERA_VERSION_680  = 0x00060800,
+	CAM_CPAS_CAMERA_VERSION_165  = 0x00010605,
+	CAM_CPAS_CAMERA_VERSION_780  = 0x00070800,
+	CAM_CPAS_CAMERA_VERSION_640  = 0x00060400,
+	CAM_CPAS_CAMERA_VERSION_880  = 0x00080800,
+	CAM_CPAS_CAMERA_VERSION_980  = 0x00090800,
+	CAM_CPAS_CAMERA_VERSION_860  = 0x00080600,
+	CAM_CPAS_CAMERA_VERSION_770  = 0x00070700,
+	CAM_CPAS_CAMERA_VERSION_665  = 0x00060605,
+	CAM_CPAS_CAMERA_VERSION_690  = 0x00060900,
+	CAM_CPAS_CAMERA_VERSION_692  = 0x00060902,
+	CAM_CPAS_CAMERA_VERSION_MAX
+};
+
+/**
+ * enum cam_cpas_version Enum for Titan CPAS Versions
+ */
+enum cam_cpas_version {
+	CAM_CPAS_VERSION_NONE = 0,
+	CAM_CPAS_VERSION_100  = 0x10000000,
+	CAM_CPAS_VERSION_101  = 0x10000001,
+	CAM_CPAS_VERSION_110  = 0x10010000,
+	CAM_CPAS_VERSION_120  = 0x10020000,
+	CAM_CPAS_VERSION_130  = 0x10030000,
+	CAM_CPAS_VERSION_200  = 0x20000000,
+	CAM_CPAS_VERSION_210  = 0x20010000,
+	CAM_CPAS_VERSION_MAX
+};
+
+/**
+ * enum cam_cpas_camera_version_map_id Enum for camera version map id
+ * This enum is mapped with cam_cpas_camera_version
+ */
+enum cam_cpas_camera_version_map_id {
+	CAM_CPAS_CAMERA_VERSION_ID_150  = 0x0,
+	CAM_CPAS_CAMERA_VERSION_ID_170  = 0x1,
+	CAM_CPAS_CAMERA_VERSION_ID_175  = 0x2,
+	CAM_CPAS_CAMERA_VERSION_ID_480  = 0x3,
+	CAM_CPAS_CAMERA_VERSION_ID_580  = 0x4,
+	CAM_CPAS_CAMERA_VERSION_ID_520  = 0x5,
+	CAM_CPAS_CAMERA_VERSION_ID_540  = 0x6,
+	CAM_CPAS_CAMERA_VERSION_ID_545  = 0x7,
+	CAM_CPAS_CAMERA_VERSION_ID_570  = 0x8,
+	CAM_CPAS_CAMERA_VERSION_ID_680  = 0x9,
+	CAM_CPAS_CAMERA_VERSION_ID_165  = 0xA,
+	CAM_CPAS_CAMERA_VERSION_ID_780  = 0xB,
+	CAM_CPAS_CAMERA_VERSION_ID_640  = 0xC,
+	CAM_CPAS_CAMERA_VERSION_ID_880  = 0xD,
+	CAM_CPAS_CAMERA_VERSION_ID_980  = 0xE,
+	CAM_CPAS_CAMERA_VERSION_ID_860  = 0xF,
+	CAM_CPAS_CAMERA_VERSION_ID_770  = 0x10,
+	CAM_CPAS_CAMERA_VERSION_ID_665  = 0x11,
+	CAM_CPAS_CAMERA_VERSION_ID_690  = 0x12,
+	CAM_CPAS_CAMERA_VERSION_ID_692  = 0x13,
+	CAM_CPAS_CAMERA_VERSION_ID_MAX
+};
+
+/**
+ * enum cam_cpas_version_map_id Enum for cpas version map id
+ * This enum is mapped with cam_cpas_version
+ */
+enum cam_cpas_version_map_id {
+	CAM_CPAS_VERSION_ID_100  = 0x0,
+	CAM_CPAS_VERSION_ID_101  = 0x1,
+	CAM_CPAS_VERSION_ID_110  = 0x2,
+	CAM_CPAS_VERSION_ID_120  = 0x3,
+	CAM_CPAS_VERSION_ID_130  = 0x4,
+	CAM_CPAS_VERSION_ID_200  = 0x5,
+	CAM_CPAS_VERSION_ID_210  = 0x6,
+	CAM_CPAS_VERSION_ID_MAX
+};
+
+/**
+ * enum cam_cpas_hw_version - Enum for Titan CPAS HW Versions
+ */
+enum cam_cpas_hw_version {
+	CAM_CPAS_TITAN_NONE = 0,
+	CAM_CPAS_TITAN_150_V100 = 0x150100,
+	CAM_CPAS_TITAN_165_V100 = 0x165100,
+	CAM_CPAS_TITAN_170_V100 = 0x170100,
+	CAM_CPAS_TITAN_170_V110 = 0x170110,
+	CAM_CPAS_TITAN_170_V120 = 0x170120,
+	CAM_CPAS_TITAN_170_V200 = 0x170200,
+	CAM_CPAS_TITAN_175_V100 = 0x175100,
+	CAM_CPAS_TITAN_175_V101 = 0x175101,
+	CAM_CPAS_TITAN_175_V120 = 0x175120,
+	CAM_CPAS_TITAN_175_V130 = 0x175130,
+	CAM_CPAS_TITAN_480_V100 = 0x480100,
+	CAM_CPAS_TITAN_580_V100 = 0x580100,
+	CAM_CPAS_TITAN_540_V100 = 0x540100,
+	CAM_CPAS_TITAN_520_V100 = 0x520100,
+	CAM_CPAS_TITAN_545_V100 = 0x545100,
+	CAM_CPAS_TITAN_570_V100 = 0x570100,
+	CAM_CPAS_TITAN_570_V200 = 0x570200,
+	CAM_CPAS_TITAN_680_V100 = 0x680100,
+	CAM_CPAS_TITAN_680_V110 = 0x680110,
+	CAM_CPAS_TITAN_780_V100 = 0x780100,
+	CAM_CPAS_TITAN_640_V200 = 0x640200,
+	CAM_CPAS_TITAN_640_V210 = 0x640210,
+	CAM_CPAS_TITAN_880_V100 = 0x880100,
+	CAM_CPAS_TITAN_980_V100 = 0x980100,
+	CAM_CPAS_TITAN_860_V100 = 0x860100,
+	CAM_CPAS_TITAN_770_V100 = 0x770100,
+	CAM_CPAS_TITAN_665_V100 = 0x665100,
+	CAM_CPAS_TITAN_690_V100 = 0x690100,
+	CAM_CPAS_TITAN_692_V100 = 0x692100,
+	CAM_CPAS_TITAN_MAX
+};
+
+/**
+ * enum cam_camnoc_slave_error_codes - Enum for camnoc slave error codes
+ *
+ */
+enum cam_camnoc_slave_error_codes {
+	CAM_CAMNOC_TARGET_ERROR,
+	CAM_CAMNOC_ADDRESS_DECODE_ERROR,
+	CAM_CAMNOC_UNSUPPORTED_REQUEST_ERROR,
+	CAM_CAMNOC_DISCONNECTED_TARGET_ERROR,
+	CAM_CAMNOC_SECURITY_VIOLATION,
+	CAM_CAMNOC_HIDDEN_SECURITY_VIOLATION,
+	CAM_CAMNOC_TIME_OUT,
+	CAM_CAMNOC_UNUSED,
+};
+
+/**
+ * enum cam_camnoc_irq_type - Enum for camnoc irq types
+ *
+ * @CAM_CAMNOC_IRQ_SLAVE_ERROR: Each slave port in CAMNOC (3 QSB ports and
+ *                              1 QHB port) has an error logger. The error
+ *                              observed at any slave port is logged into
+ *                              the error logger register and an IRQ is
+ *                              triggered
+ * @CAM_CAMNOC_IRQ_IFE_UBWC_ENCODE_ERROR      : Triggered if any error detected
+ *                                              in the IFE UBWC encoder instance
+ * @CAM_CAMNOC_IRQ_IFE_UBWC_STATS_ENCODE_ERROR: Triggered if any error detected
+ *                                              in the IFE UBWC-Stats encoder
+ *                                              instance
+ * @CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR  : Triggered if any error detected
+ *                                            in the IFE0 UBWC encoder instance
+ * @CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR  : Triggered if any error detected
+ *                                            in the IFE1 or IFE3 UBWC encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_IFE0_UBWC_ENCODE_ERROR   : Triggered if any error detected
+ *                                            in the IFE0 UBWC encoder instance
+ * @CAM_CAMNOC_IRQ_IFE1_WR_UBWC_ENCODE_ERROR  : Triggered if any error detected
+ *                                            in the IFE1 UBWC encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_IPE_UBWC_ENCODE_ERROR    : Triggered if any error detected
+ *                                            in the IPE write path encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_BPS_UBWC_ENCODE_ERROR    : Triggered if any error detected
+ *                                            in the BPS write path encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_IPE1_BPS_UBWC_DECODE_ERROR: Triggered if any error detected
+ *                                             in the IPE1/BPS read path decoder
+ *                                             instance
+ * @CAM_CAMNOC_IRQ_IPE0_UBWC_DECODE_ERROR    : Triggered if any error detected
+ *                                             in the IPE0 read path decoder
+ *                                             instance
+ * @CAM_CAMNOC_IRQ_IPE1_UBWC_DECODE_ERROR    : Triggered if any error detected
+ *                                             in the IPE1 read path decoder
+ *                                             instance
+ * @CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR: Triggered if any error detected
+ *                                            in the IPE/BPS UBWC decoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR: Triggered if any error detected
+ *                                            in the IPE/BPS UBWC encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_OFE_WR_UBWC_ENCODE_ERROR : Triggered if any error detected
+ *                                            in the OFE write UBWC decoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_OFE_RD_UBWC_DECODE_ERROR : Triggered if any error detected
+ *                                            in the OFE read UBWC decoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_TFE_UBWC_ENCODE_ERROR    : Triggered if any error detected
+ *                                            in the TFE UBWC encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_AHB_TIMEOUT              : Triggered when the QHS_ICP slave
+ *                                            times out after 4000 AHB cycles
+ */
+enum cam_camnoc_irq_type {
+	CAM_CAMNOC_IRQ_SLAVE_ERROR,
+	CAM_CAMNOC_IRQ_IFE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE0_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_BPS_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE0_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE1_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_OFE_WR_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_OFE_RD_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_IRQ_TFE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_AHB_TIMEOUT,
+};
+
+
+/**
+ * enum cam_sys_cache_config_types - Enum for camera llc's
+ */
+enum cam_sys_cache_config_types {
+	CAM_LLCC_SMALL_1 = 0,
+	CAM_LLCC_SMALL_2 = 1,
+	CAM_LLCC_LARGE_1 = 2,
+	CAM_LLCC_LARGE_2 = 3,
+	CAM_LLCC_LARGE_3 = 4,
+	CAM_LLCC_LARGE_4 = 5,
+	CAM_LLCC_MAX     = 6,
+};
+
+/**
+ * enum cam_sys_cache_llcc_staling_mode - Enum for camera llc's stalling mode
+ */
+enum cam_sys_cache_llcc_staling_mode {
+	CAM_LLCC_STALING_MODE_CAPACITY,
+	CAM_LLCC_STALING_MODE_NOTIFY,
+	CAM_LLCC_STALING_MODE_MAX,
+};
+
+/**
+ * enum cam_sys_cache_llcc_staling_mode - Enum for camera llc's stalling mode
+ */
+enum cam_sys_cache_llcc_staling_op_type {
+	CAM_LLCC_NOTIFY_STALING_EVICT,
+	CAM_LLCC_NOTIFY_STALING_FORGET,
+	CAM_LLCC_NOTIFY_STALING_OPS_MAX
+};
+
+/**
+ * enum cam_subparts_index - Enum for camera subparts indices
+ */
+enum cam_subparts_index {
+	CAM_IFE_HW_IDX,
+	CAM_IFE_LITE_HW_IDX,
+	CAM_SFE_HW_IDX,
+	CAM_CUSTOM_HW_IDX
+};
+
+/**
+ * struct cam_camnoc_irq_slave_err_data : Data for Slave error.
+ *
+ * @mainctrl     : Err logger mainctrl info
+ * @errvld       : Err logger errvld info
+ * @errlog0_low  : Err logger errlog0_low info
+ * @errlog0_high : Err logger errlog0_high info
+ * @errlog1_low  : Err logger errlog1_low info
+ * @errlog1_high : Err logger errlog1_high info
+ * @errlog2_low  : Err logger errlog2_low info
+ * @errlog2_high : Err logger errlog2_high info
+ * @errlog3_low  : Err logger errlog3_low info
+ * @errlog3_high : Err logger errlog3_high info
+ *
+ */
+struct cam_camnoc_irq_slave_err_data {
+	union {
+		struct {
+			uint32_t stall_en : 1; /* bit 0 */
+			uint32_t fault_en : 1; /* bit 1 */
+			uint32_t rsv      : 30; /* bits 2-31 */
+		};
+		uint32_t value;
+	} mainctrl;
+	union {
+		struct {
+			uint32_t err_vld : 1; /* bit 0 */
+			uint32_t rsv     : 31; /* bits 1-31 */
+		};
+		uint32_t value;
+	} errvld;
+	union {
+		struct {
+			uint32_t loginfo_vld : 1; /* bit 0 */
+			uint32_t word_error  : 1; /* bit 1 */
+			uint32_t non_secure  : 1; /* bit 2 */
+			uint32_t device      : 1; /* bit 3 */
+			uint32_t opc         : 3; /* bits 4 - 6 */
+			uint32_t rsv0        : 1; /* bit 7 */
+			uint32_t err_code    : 3; /* bits 8 - 10 */
+			uint32_t sizef       : 3; /* bits 11 - 13 */
+			uint32_t rsv1        : 2; /* bits 14 - 15 */
+			uint32_t addr_space  : 6; /* bits 16 - 21 */
+			uint32_t rsv2        : 10; /* bits 22 - 31 */
+		};
+		uint32_t value;
+	}  errlog0_low;
+	union {
+		struct {
+			uint32_t len1 : 10; /* bits 0 - 9 */
+			uint32_t rsv  : 22; /* bits 10 - 31 */
+		};
+		uint32_t value;
+	} errlog0_high;
+	union {
+		struct {
+			uint32_t path : 16; /* bits 0 - 15 */
+			uint32_t rsv  : 16; /* bits 16 - 31 */
+		};
+		uint32_t value;
+	} errlog1_low;
+	union {
+		struct {
+			uint32_t extid : 18; /* bits 0 - 17 */
+			uint32_t rsv   : 14; /* bits 18 - 31 */
+		};
+		uint32_t value;
+	} errlog1_high;
+	union {
+		struct {
+			uint32_t errlog2_lsb : 32; /* bits 0 - 31 */
+		};
+		uint32_t value;
+	} errlog2_low;
+	union {
+		struct {
+			uint32_t errlog2_msb : 16; /* bits 0 - 16 */
+			uint32_t rsv         : 16; /* bits 16 - 31 */
+		};
+		uint32_t value;
+	} errlog2_high;
+	union {
+		struct {
+			uint32_t errlog3_lsb : 32; /* bits 0 - 31 */
+		};
+		uint32_t value;
+	} errlog3_low;
+	union {
+		struct {
+			uint32_t errlog3_msb : 32; /* bits 0 - 31 */
+		};
+		uint32_t value;
+	} errlog3_high;
+};
+
+/**
+ * struct cam_camnoc_irq_ubwc_enc_data : Data for UBWC Encode error.
+ *
+ * @encerr_status : Encode error status
+ *
+ */
+struct cam_camnoc_irq_ubwc_enc_data {
+	union {
+		struct {
+			uint32_t encerrstatus : 3; /* bits 0 - 2 */
+			uint32_t rsv          : 29; /* bits 3 - 31 */
+		};
+		uint32_t value;
+	} encerr_status;
+};
+
+/**
+ * struct cam_camnoc_irq_ubwc_dec_data : Data for UBWC Decode error.
+ *
+ * @decerr_status : Decoder error status
+ * @thr_err       : Set to 1 if
+ *                  At least one of the bflc_len fields in the bit steam exceeds
+ *                  its threshold value. This error is possible only for
+ *                  RGBA1010102, TP10, and RGB565 formats
+ * @fcl_err       : Set to 1 if
+ *                  Fast clear with a legal non-RGB format
+ * @len_md_err    : Set to 1 if
+ *                  The calculated burst length does not match burst length
+ *                  specified by the metadata value
+ * @format_err    : Set to 1 if
+ *                  Illegal format
+ *                  1. bad format :2,3,6
+ *                  2. For 32B MAL, metadata=6
+ *                  3. For 32B MAL RGB565, Metadata != 0,1,7
+ *                  4. For 64B MAL RGB565, metadata[3:1] == 1,2
+ *
+ */
+struct cam_camnoc_irq_ubwc_dec_data {
+	union {
+		struct {
+			uint32_t thr_err    : 1; /* bit 0 */
+			uint32_t fcl_err    : 1; /* bit 1 */
+			uint32_t len_md_err : 1; /* bit 2 */
+			uint32_t format_err : 1; /* bit 3 */
+			uint32_t rsv        : 28; /* bits 4 - 31 */
+		};
+		uint32_t value;
+	} decerr_status;
+};
+
+struct cam_camnoc_irq_ahb_timeout_data {
+	uint32_t data;
+};
+
+/**
+ * struct cam_cpas_irq_data : CAMNOC IRQ data
+ *
+ * @irq_type  : To identify the type of IRQ
+ * @u         : Union of irq err data information
+ * @slave_err : Data for Slave error.
+ *              Valid if type is CAM_CAMNOC_IRQ_SLAVE_ERROR
+ * @enc_err   : Data for UBWC Encode error.
+ *              Valid if type is one of below:
+ *              CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR
+ *              CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR
+ *              CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR
+ * @dec_err   : Data for UBWC Decode error.
+ *              Valid if type is CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR
+ * @ahb_err   : Data for Slave error.
+ *              Valid if type is CAM_CAMNOC_IRQ_AHB_TIMEOUT
+ *
+ */
+struct cam_cpas_irq_data {
+	enum cam_camnoc_irq_type irq_type;
+	union {
+		struct cam_camnoc_irq_slave_err_data   slave_err;
+		struct cam_camnoc_irq_ubwc_enc_data    enc_err;
+		struct cam_camnoc_irq_ubwc_dec_data    dec_err;
+		struct cam_camnoc_irq_ahb_timeout_data ahb_err;
+	} u;
+};
+
+/*
+ * CPAS client callback
+ *
+ * @client_handle : CPAS client handle
+ * @userdata      : User data given at the time of register
+ * @irq_data      : Event data
+ */
+typedef bool (*cam_cpas_client_cb_func)(
+	uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data);
+
+/**
+ * struct cam_cpas_register_params : Register params for cpas client
+ *
+ * @identifier        : Input identifier string which is the device label
+ *                      from dt like vfe, ife, jpeg etc
+ * @cell_index        : Input integer identifier pointing to the cell index
+ *                      from dt of the device. This can be used to form a
+ *                      unique string with @identifier like vfe0, ife1,
+ *                      jpeg0, etc
+ * @dev               : device handle
+ * @userdata          : Input private data which will be passed as
+ *                      an argument while callback.
+ * @cam_cpas_callback : Input callback pointer for triggering the
+ *                      callbacks from CPAS driver.
+ * @client_handle     : Output Unique handle generated for this register
+ *
+ */
+struct cam_cpas_register_params {
+	char            identifier[CAM_HW_IDENTIFIER_LENGTH];
+	uint32_t        cell_index;
+	struct device  *dev;
+	void           *userdata;
+	cam_cpas_client_cb_func cam_cpas_client_cb;
+	uint32_t        client_handle;
+};
+
+/**
+ * enum cam_vote_type - Enum for voting type
+ *
+ * @CAM_VOTE_ABSOLUTE : Absolute vote
+ * @CAM_VOTE_DYNAMIC  : Dynamic vote
+ */
+enum cam_vote_type {
+	CAM_VOTE_ABSOLUTE,
+	CAM_VOTE_DYNAMIC,
+};
+
+/**
+ * struct cam_ahb_vote : AHB vote
+ *
+ * @type  : AHB voting type.
+ *          CAM_VOTE_ABSOLUTE : vote based on the value 'level' is set
+ *          CAM_VOTE_DYNAMIC  : vote calculated dynamically using 'freq'
+ *                              and 'dev' handle is set
+ * @level : AHB vote level
+ * @freq  : AHB vote dynamic frequency
+ *
+ */
+struct cam_ahb_vote {
+	enum cam_vote_type   type;
+	union {
+		enum cam_vote_level  level;
+		unsigned long        freq;
+	} vote;
+};
+
+/**
+ * struct cam_cpas_axi_per_path_bw_vote - Internal per path bandwidth vote information
+ *
+ * @usage_data:              client usage data (left/right/rdi)
+ * @transac_type:            Transaction type on the path (read/write)
+ * @path_data_type:          Path for which vote is given (video, display, rdi)
+ * @vote_level:              Vote level for this path
+ * @camnoc_bw:               CAMNOC bw for this path
+ * @mnoc_ab_bw:              MNOC AB bw for this path
+ * @mnoc_ib_bw:              MNOC IB bw for this path
+ */
+struct cam_cpas_axi_per_path_bw_vote {
+	uint32_t                      usage_data;
+	uint32_t                      transac_type;
+	uint32_t                      path_data_type;
+	uint32_t                      vote_level;
+	uint64_t                      camnoc_bw;
+	uint64_t                      mnoc_ab_bw;
+	uint64_t                      mnoc_ib_bw;
+};
+
+/**
+ * struct cam_axi_vote : AXI vote
+ *
+ * @num_paths: Number of paths on which BW vote is sent to CPAS
+ * @axi_path: Per path BW vote info
+ *
+ */
+struct cam_axi_vote {
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_CPAS_MAX_PATHS_PER_CLIENT];
+};
+
+/**
+ * cam_cpas_prepare_subpart_info()
+ *
+ * @brief: API to update the number of ifes, ife_lites, sfes and custom
+ *         in the struct cam_cpas_private_soc.
+ *
+ * @idx                   : Camera subpart index
+ * @num_subpart_available : Number of available subparts
+ * @num_subpart_functional: Number of functional subparts
+ *
+ * @returns 0 on success & -EINVAL when @subpart_type is invalid.
+ *
+ */
+int cam_cpas_prepare_subpart_info(
+	enum cam_subparts_index idx, uint32_t num_subpart_available,
+	uint32_t num_subpart_functional);
+
+/**
+ * cam_cpas_register_client()
+ *
+ * @brief: API to register cpas client
+ *
+ * @register_params: Input params to register as a client to CPAS
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_register_client(
+	struct cam_cpas_register_params *register_params);
+
+/**
+ * cam_cpas_unregister_client()
+ *
+ * @brief: API to unregister cpas client
+ *
+ * @client_handle: Client handle to be unregistered
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_unregister_client(uint32_t client_handle);
+
+/**
+ * cam_cpas_start()
+ *
+ * @brief: API to start cpas client hw. Clients have to vote for minimal
+ *     bandwidth requirements for AHB, AXI. Use cam_cpas_update_ahb_vote
+ *     to scale bandwidth after start.
+ *
+ * @client_handle: client cpas handle
+ * @ahb_vote     : Pointer to ahb vote info
+ * @axi_vote     : Pointer to axi bandwidth vote info
+ *
+ * If AXI vote is not applicable to a particular client, use the value exposed
+ * by CAM_CPAS_DEFAULT_AXI_BW as the default vote request.
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_start(
+	uint32_t               client_handle,
+	struct cam_ahb_vote   *ahb_vote,
+	struct cam_axi_vote   *axi_vote);
+
+/**
+ * cam_cpas_stop()
+ *
+ * @brief: API to stop cpas client hw. Bandwidth for AHB, AXI votes
+ *     would be removed for this client on this call. Clients should not
+ *     use cam_cpas_update_ahb_vote or cam_cpas_update_axi_vote
+ *     to remove their bandwidth vote.
+ *
+ * @client_handle: client cpas handle
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_stop(uint32_t client_handle);
+
+/**
+ * cam_cpas_update_ahb_vote()
+ *
+ * @brief: API to update AHB vote requirement. Use this function only
+ *     between cam_cpas_start and cam_cpas_stop in case clients wants
+ *     to scale to different vote level. Do not use this function to de-vote,
+ *     removing client's vote is implicit on cam_cpas_stop
+ *
+ * @client_handle : Client cpas handle
+ * @ahb_vote      : Pointer to ahb vote info
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_update_ahb_vote(
+	uint32_t               client_handle,
+	struct cam_ahb_vote   *ahb_vote);
+
+/**
+ * cam_cpas_update_axi_vote()
+ *
+ * @brief: API to update AXI vote requirement. Use this function only
+ *     between cam_cpas_start and cam_cpas_stop in case clients wants
+ *     to scale to different vote level. Do not use this function to de-vote,
+ *     removing client's vote is implicit on cam_cpas_stop
+ *
+ * @client_handle : Client cpas handle
+ * @axi_vote      : Pointer to axi bandwidth vote info
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_update_axi_vote(
+	uint32_t             client_handle,
+	struct cam_axi_vote *axi_vote);
+
+/**
+ * cam_cpas_reg_write()
+ *
+ * @brief: API to write a register value in CPAS register space
+ *
+ * @client_handle : Client cpas handle
+ * @reg_base      : Register base identifier
+ * @offset        : Offset from the register base address
+ * @mb            : Whether to do reg write with memory barrier
+ * @value         : Value to be written in register
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_reg_write(
+	uint32_t                  client_handle,
+	enum cam_cpas_regbase_types reg_base,
+	uint32_t                  offset,
+	bool                      mb,
+	uint32_t                  value);
+
+/**
+ * cam_cpas_reg_read()
+ *
+ * @brief: API to read a register value from CPAS register space
+ *
+ * @client_handle : Client cpas handle
+ * @reg_base      : Register base identifier
+ * @offset        : Offset from the register base address
+ * @mb            : Whether to do reg read with memory barrier
+ * @value         : Value to be red from register
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_reg_read(
+	uint32_t                  client_handle,
+	enum cam_cpas_regbase_types reg_base,
+	uint32_t                  offset,
+	bool                      mb,
+	uint32_t                 *value);
+
+/**
+ * cam_cpas_get_hw_info()
+ *
+ * @brief: API to get camera hw information
+ *
+ * @camera_family  : Camera family type. One of
+ *                   CAM_FAMILY_CAMERA_SS
+ *                   CAM_FAMILY_CPAS_SS
+ * @camera_version : Camera platform version
+ * @cpas_version   : Camera cpas version
+ * @cam_caps       : Camera capability array
+ * @num_cap_mask   : number of capability masks
+ * @cam_fuse_info  : Camera fuse info
+ * @domain_id_info : Domain id info
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_get_hw_info(
+	uint32_t                       *camera_family,
+	struct cam_hw_version          *camera_version,
+	struct cam_hw_version          *cpas_version,
+	uint32_t                      **cam_caps,
+	uint32_t                       *num_cap_mask,
+	struct cam_cpas_fuse_info      *cam_fuse_info,
+	struct cam_cpas_domain_id_caps *domain_id_info);
+
+/**
+ * cam_cpas_get_cpas_hw_version()
+ *
+ * @brief: API to get camera cpas hw version
+ *
+ * @hw_version  : Camera cpas hw version
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_get_cpas_hw_version(uint32_t *hw_version);
+
+/**
+ * cam_cpas_is_feature_supported()
+ *
+ * @brief: API to get camera features
+ *
+ * @flag  : Camera hw features to check
+ *
+ * @hw_map : To indicate which HWs are supported
+ *
+ * @fule_val : Return fule value in case of value type feature
+ *
+ * @return 1 if feature is supported
+ *
+ */
+bool cam_cpas_is_feature_supported(uint32_t flag, uint32_t hw_map,
+	uint32_t *fuse_val);
+
+/**
+ * cam_cpas_axi_util_path_type_to_string()
+ *
+ * @brief: API to get string for given path type
+ *
+ * @path_data_type  : Path type
+ *
+ * @return string.
+ *
+ */
+const char *cam_cpas_axi_util_path_type_to_string(
+	uint32_t path_data_type);
+
+/**
+ * cam_cpas_axi_util_trans_type_to_string()
+ *
+ * @brief: API to get string for given transaction type
+ *
+ * @path_data_type  : Transaction type
+ *
+ * @return string.
+ *
+ */
+const char *cam_cpas_axi_util_trans_type_to_string(
+	uint32_t path_data_type);
+
+/**
+ * cam_cpas_axi_util_drv_vote_lvl_to_string()
+ *
+ * @brief: API to get string for given DRV vote level
+ *
+ * @vote_lvl  : DRV vote level
+ *
+ * @return string.
+ *
+ */
+const char *cam_cpas_axi_util_drv_vote_lvl_to_string(
+	uint32_t vote_lvl);
+
+/**
+ * cam_cpas_util_vote_type_to_string()
+ *
+ * @brief: API to get string for given vote type
+ *
+ * @vote_type  : DRV vote level
+ *
+ * @return string.
+ *
+ */
+const char *cam_cpas_util_vote_type_to_string(enum cam_cpas_vote_type vote_type);
+
+/**
+ * cam_cpas_log_votes()
+ *
+ * @brief: API to print the all bw votes of axi client. It also print the
+ *     applied camnoc axi clock vote value and ahb vote value
+ *
+ * @ddr_only: Print only DDR info
+ *
+ * @return 0 on success.
+ *
+ */
+void cam_cpas_log_votes(bool ddr_only);
+
+/**
+ * cam_cpas_select_qos_settings()
+ *
+ * @brief: API to select specific qos settings based on usecase requirements
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_select_qos_settings(uint32_t selection_mask);
+
+/**
+ * cam_cpas_notify_event()
+ *
+ * @brief: API that clients can notify about their events. CPAS save the event
+ *         and any other useful information related to this event. This will
+ *         be printed while cpas state dump - cam_cpas_log_votes.
+ *         One such example is IFE notifiying SOF or EPOCH to cpas and cpas
+ *         saving axi clock information (camnoc_axi, mnoc_hf) at that point
+ *         and printing latest history on IFE overflow.
+ *
+ * @identifier_string: Identifier string passed by caller
+ * @identifier_value: Identifier value passed by caller
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_notify_event(const char *identifier_string,
+	int32_t identifier_value);
+
+/**
+ * cam_cpas_get_scid()
+ *
+ * @brief: API to obtain slice id for the given type
+ *
+ * @type: Cache type
+ *
+ * @return slice id, -1 for invalid id.
+ *
+ */
+int cam_cpas_get_scid(enum cam_sys_cache_config_types  type);
+
+/**
+ * cam_cpas_activate_llcc()
+ *
+ * @brief: API to activate system cache
+ *
+ * @type: Cache type
+ *
+ * @return 0 for success.
+ *
+ */
+int cam_cpas_activate_llcc(enum cam_sys_cache_config_types type);
+
+/**
+ * cam_cpas_deactivate_llcc()
+ *
+ * @brief: API to de-activate system cache
+ *
+ * @type: Cache type
+ *
+ * @return 0 for success.
+ *
+ */
+int cam_cpas_deactivate_llcc(enum cam_sys_cache_config_types type);
+
+/**
+ * cam_cpas_configure_staling_llcc()
+ *
+ * @brief:  Configure cache staling mode by setting the
+ *          staling_mode and corresponding params
+ *
+ * @type: Cache type
+ * @mode_param: llcc stalling mode params
+ * @operation_type: cache operation type
+ * @stalling_distance: llcc sys cache stalling distance
+ *
+ * @return 0 for success.
+ *
+ */
+int cam_cpas_configure_staling_llcc(
+	enum cam_sys_cache_config_types type,
+	enum cam_sys_cache_llcc_staling_mode mode_param,
+	enum cam_sys_cache_llcc_staling_op_type operation_type,
+	uint32_t staling_distance);
+
+/**
+ * cam_cpas_notif_increment_staling_counter()
+ *
+ * @brief: This will increment the stalling counter
+ *         depends on what operation it does.
+ *         The operation mode what we have setup in other function.
+ *
+ * @type: Cache type
+ *
+ * @return 0 for success.
+ *
+ */
+int cam_cpas_notif_increment_staling_counter(
+	enum cam_sys_cache_config_types type);
+
+/**
+ * cam_cpas_dump_camnoc_buff_fill_info()
+ *
+ * @brief: API to dump camnoc buffer fill level info
+ *
+ * @client_handle : Client cpas handle
+ *
+ * @return 0 on success
+ *
+ */
+int cam_cpas_dump_camnoc_buff_fill_info(uint32_t client_handle);
+
+/**
+ * cam_cpas_csid_input_core_info_update()
+ *
+ * @brief: API to communicate csid input core info to cpas
+ *
+ * @csid_idx: csid hw index connected to particular sfe
+ * @sfe_idx:  sfe idx to be connected to particular DRV path
+ * @set_port: Indicates whether to set or reset DRV port info in dynamic client
+ *
+ * @return 0 on success
+ *
+ */
+int cam_cpas_csid_input_core_info_update(int csid_idx, int sfe_idx, bool set_port);
+
+/**
+ * cam_cpas_csid_process_resume()
+ *
+ * @brief: API to process csid resume in cpas
+ * @csid_idx: CSID idx to notify resume for
+ *
+ * @return 0 on success
+ *
+ */
+int cam_cpas_csid_process_resume(uint32_t csid_idx);
+
+/**
+ * cam_cpas_query_drv_enable()
+ *
+ * @brief: API to indicate DRV enabled on hw or not
+ * @is_ddr_drv_enabled: If DDR DRV enabled
+ * @is_clk_drv_enabled: If Clock Cesta DRV enabled
+ *
+ * @return 0 on success
+ *
+ */
+int cam_cpas_query_drv_enable(bool *is_ddr_drv_enabled, bool *is_clk_drv_enabled);
+
+/**
+ * cam_cpas_query_domain_id_security_support()
+ * @brief: API to determine if target supports domain id feature
+ *         This information is determined by cpas during probe
+ *
+ * @return true if there's support, false otherwise
+ */
+bool cam_cpas_query_domain_id_security_support(void);
+
+/**
+ * cam_cpas_enable_clks_for_domain_id()
+ *
+ * @brief: API to enable/disable clocks for domain id support.
+ *         All CSIDs including those not in use for a ctxt
+ *         needs to be programmed in a secure session.
+ * @enable: True to turn on, false otherwise.
+ * @return 0 on success
+ */
+int cam_cpas_enable_clks_for_domain_id(bool enable);
+
+/**
+ * cam_cpas_is_notif_staling_supported()
+ *
+ * @brief: API to check stalling feature is supported or not
+ *
+ * @return rue if supported
+ */
+bool cam_cpas_is_notif_staling_supported(void);
+
+/**
+ * cam_cpas_dump_state_monitor_info()
+ *
+ * @brief: API to dump the state monitor info of cpas.
+ * @info:  Dump information.
+ * @return 0 on success
+ */
+int cam_cpas_dump_state_monitor_info(struct cam_req_mgr_dump_info *info);
+
+#endif /* _CAM_CPAS_API_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_context.c
@@ -0,0 +1,292 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#include "cam_trace.h"
+#include "cam_mem_mgr.h"
+#include "cam_cre_context.h"
+#include "cam_context_utils.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+#include "cam_context.h"
+
+static const char cre_dev_name[] = "cam-cre";
+
+static int __cam_cre_start_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_start_dev_to_hw(ctx, cmd);
+	if (!rc) {
+		ctx->state = CAM_CTX_READY;
+		trace_cam_context_state("CRE", ctx);
+	}
+
+	return rc;
+}
+
+
+static int __cam_cre_ctx_flush_dev_in_ready(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_context_utils_flush_args flush_args;
+
+	flush_args.cmd = cmd;
+	flush_args.flush_active_req = false;
+
+	rc = cam_context_flush_dev_to_hw(ctx, &flush_args);
+	if (rc)
+		CAM_ERR(CAM_CRE, "Failed to flush device");
+
+	return rc;
+}
+
+static int __cam_cre_ctx_dump_dev_in_ready(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_CRE, "Failed to dump device");
+
+	return rc;
+}
+
+static int __cam_cre_ctx_config_dev_in_ready(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+	size_t len;
+	uintptr_t packet_addr;
+
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "[%s][%d] Can not get packet address",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+
+	if (rc)
+		CAM_ERR(CAM_CRE, "Failed to prepare device");
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+}
+
+static int __cam_cre_ctx_stop_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc)
+		CAM_ERR(CAM_CRE, "Failed to stop device");
+
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("CRE", ctx);
+	return rc;
+}
+
+static int __cam_cre_ctx_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_CRE, "Unable to release device %d", rc);
+
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	return rc;
+}
+
+static int __cam_cre_ctx_release_dev_in_ready(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = __cam_cre_ctx_stop_dev_in_ready(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_CRE, "Failed to stop device");
+
+	rc = __cam_cre_ctx_release_dev_in_acquired(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_CRE, "Failed to release device");
+
+	return rc;
+}
+
+static int __cam_cre_ctx_handle_buf_done_in_ready(void *ctx,
+	uint32_t evt_id, void *done)
+{
+	return cam_context_buf_done_from_hw(ctx, done, evt_id);
+}
+
+static int cam_cre_context_dump_active_request(void *data, void *args)
+{
+
+	struct cam_context         *ctx = (struct cam_context *)data;
+	struct cam_ctx_request     *req = NULL;
+	struct cam_ctx_request     *req_temp = NULL;
+	struct cam_hw_dump_pf_args *pf_args = (struct cam_hw_dump_pf_args *)args;
+	int rc = 0;
+
+	if (!ctx || !pf_args) {
+		CAM_ERR(CAM_CRE, "Invalid ctx %pK or pf arguments %pK",
+			ctx, pf_args);
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_CRE, "iommu fault for cre ctx %d state %d",
+		ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+			&ctx->active_req_list, list) {
+
+		CAM_INFO(CAM_CRE, "Active req_id: %llu ctx_id: %u",
+			req->request_id, ctx->ctx_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_args, &req->pf_data);
+		if (rc)
+			CAM_ERR(CAM_CRE, "Failed to dump pf info ctx_id: %u state: %d",
+				ctx->ctx_id, ctx->state);
+	}
+
+	if (pf_args->pf_context_info.ctx_found) {
+		/* Send PF notification to UMD if PF found on current CTX */
+		rc = cam_context_send_pf_evt(ctx, pf_args);
+		if (rc)
+			CAM_ERR(CAM_CRE,
+				"Failed to notify PF event to userspace rc: %d", rc);
+	}
+
+	return rc;
+}
+
+static int __cam_cre_ctx_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_CRE, "Unable to Acquire device %d", rc);
+	else
+		ctx->state = CAM_CTX_ACQUIRED;
+
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_cre_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = { },
+		.crm_ops = { },
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_cre_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = { },
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.release_dev = __cam_cre_ctx_release_dev_in_acquired,
+			.start_dev = __cam_cre_start_dev_in_acquired,
+			.config_dev = __cam_cre_ctx_config_dev_in_ready,
+			.flush_dev = __cam_cre_ctx_flush_dev_in_ready,
+			.dump_dev = __cam_cre_ctx_dump_dev_in_ready,
+		},
+		.crm_ops = { },
+		.irq_ops = __cam_cre_ctx_handle_buf_done_in_ready,
+		.pagefault_ops = cam_cre_context_dump_active_request,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_cre_ctx_stop_dev_in_ready,
+			.release_dev = __cam_cre_ctx_release_dev_in_ready,
+			.config_dev = __cam_cre_ctx_config_dev_in_ready,
+			.flush_dev = __cam_cre_ctx_flush_dev_in_ready,
+			.dump_dev = __cam_cre_ctx_dump_dev_in_ready,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_cre_ctx_handle_buf_done_in_ready,
+		.pagefault_ops = cam_cre_context_dump_active_request,
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_cre_context_dump_active_request,
+	},
+};
+
+int cam_cre_context_init(struct cam_cre_context *ctx,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id, int img_iommu_hdl)
+{
+	int rc;
+	int i;
+
+	if (!ctx || !ctx->base) {
+		CAM_ERR(CAM_CRE, "Invalid Context");
+		rc = -EFAULT;
+		goto err;
+	}
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++)
+		ctx->req_base[i].req_priv = ctx;
+
+	rc = cam_context_init(ctx->base, cre_dev_name, CAM_CRE, ctx_id,
+		NULL, hw_intf, ctx->req_base, CAM_CTX_REQ_MAX, img_iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "Camera Context Base init failed");
+		goto err;
+	}
+
+	ctx->base->state_machine = cam_cre_ctx_state_machine;
+	ctx->base->ctx_priv = ctx;
+
+	ctx->base->max_hw_update_entries = CAM_CTX_CFG_MAX;
+	ctx->base->max_in_map_entries = CAM_CTX_CFG_MAX;
+	ctx->base->max_out_map_entries = CAM_CTX_CFG_MAX;
+err:
+	return rc;
+}
+
+int cam_cre_context_deinit(struct cam_cre_context *ctx)
+{
+	if (!ctx || !ctx->base) {
+		CAM_ERR(CAM_CRE, "Invalid params: %pK", ctx);
+		return -EINVAL;
+	}
+
+	cam_context_deinit(ctx->base);
+
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_context.h
@@ -0,0 +1,67 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CRE_CONTEXT_H_
+#define _CAM_CRE_CONTEXT_H_
+
+#include <media/cam_cre.h>
+
+#include "cam_context.h"
+#include "cam_cre_hw_mgr_intf.h"
+
+#define CAM_CRE_HW_EVENT_MAX 20
+
+/**
+ * struct cam_cre_context - CRE context
+ * @base: Base cre cam context object
+ * @req_base: Common request structure
+ */
+struct cam_cre_context {
+	struct cam_context *base;
+	struct cam_ctx_request req_base[CAM_CTX_REQ_MAX];
+};
+
+/* cam cre context irq handling function type */
+typedef int (*cam_cre_hw_event_cb_func)(
+	struct cam_cre_context *ctx_cre,
+	void *evt_data);
+
+/**
+ * struct cam_cre_ctx_irq_ops - Function table for handling IRQ callbacks
+ *
+ * @irq_ops: Array of handle function pointers.
+ *
+ */
+struct cam_cre_ctx_irq_ops {
+	cam_cre_hw_event_cb_func irq_ops[CAM_CRE_HW_EVENT_MAX];
+};
+
+/**
+ * cam_cre_context_init()
+ *
+ * @brief: Initialization function for the CRE context
+ *
+ * @ctx: CRE context obj to be initialized
+ * @hw_intf: CRE hw manager interface
+ * @ctx_id: ID for this context
+ * @img_iommu_hdl: IOMMU HDL for image buffers
+ *
+ */
+int cam_cre_context_init(struct cam_cre_context *ctx,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id,
+	int img_iommu_hdl);
+
+/**
+ * cam_cre_context_deinit()
+ *
+ * @brief: Deinitialize function for the CRE context
+ *
+ * @ctx: CRE context obj to be deinitialized
+ *
+ */
+int cam_cre_context_deinit(struct cam_cre_context *ctx);
+
+#endif  /* __CAM_CRE_CONTEXT_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_dev.c
@@ -0,0 +1,269 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_node.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_cre_hw_mgr.h"
+#include "cam_cre_dev.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+#include "cam_context_utils.h"
+
+#define CAM_CRE_DEV_NAME "cam-cre"
+
+struct cam_cre_subdev {
+	struct cam_subdev sd;
+	struct cam_node *node;
+	struct cam_context ctx[CRE_CTX_MAX];
+	struct cam_cre_context ctx_cre[CRE_CTX_MAX];
+	struct mutex cre_lock;
+	int32_t open_cnt;
+	int32_t reserved;
+};
+static struct cam_cre_subdev g_cre_dev;
+
+static void cam_cre_dev_iommu_fault_handler(
+	struct cam_smmu_pf_info *pf_smmu_info)
+{
+	int i, rc;
+	struct cam_node *node = NULL;
+	struct cam_hw_dump_pf_args pf_args = {0};
+
+	if (!pf_smmu_info || !pf_smmu_info->token) {
+		CAM_ERR(CAM_CRE, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_smmu_info->token;
+
+	pf_args.pf_smmu_info = pf_smmu_info;
+
+	for (i = 0; i < node->ctx_size; i++) {
+		cam_context_dump_pf_info(&(node->ctx_list[i]), &pf_args);
+		if (pf_args.pf_context_info.ctx_found)
+			/* found ctx and packet of the faulted address */
+			break;
+	}
+
+	if (i == node->ctx_size) {
+		/* Faulted ctx not found. Report PF to userspace */
+		rc = cam_context_send_pf_evt(NULL, &pf_args);
+		if (rc)
+			CAM_ERR(CAM_CRE,
+				"Failed to notify PF event to userspace rc: %d", rc);
+	}
+}
+
+static int cam_cre_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+
+	mutex_lock(&g_cre_dev.cre_lock);
+	g_cre_dev.open_cnt++;
+	mutex_unlock(&g_cre_dev.cre_lock);
+
+	return 0;
+}
+
+static int cam_cre_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+
+	mutex_lock(&g_cre_dev.cre_lock);
+	if (g_cre_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_CRE, "CRE subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	g_cre_dev.open_cnt--;
+
+	if (!node) {
+		CAM_ERR(CAM_CRE, "Node ptr is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (g_cre_dev.open_cnt == 0)
+		cam_node_shutdown(node);
+
+end:
+	mutex_unlock(&g_cre_dev.cre_lock);
+	return rc;
+}
+
+static int cam_cre_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_ICP, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_cre_subdev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_cre_subdev_internal_ops = {
+	.close = cam_cre_subdev_close,
+	.open = cam_cre_subdev_open,
+};
+
+static int cam_cre_subdev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+	int rc = 0;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	struct cam_node *node;
+	int iommu_hdl = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	g_cre_dev.sd.pdev = pdev;
+	g_cre_dev.sd.internal_ops = &cam_cre_subdev_internal_ops;
+	rc = cam_subdev_probe(&g_cre_dev.sd, pdev, CAM_CRE_DEV_NAME,
+		CAM_CRE_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "CRE cam_subdev_probe failed %d", rc);
+		goto err;
+	}
+	node = (struct cam_node *)g_cre_dev.sd.token;
+
+	hw_mgr_intf = kzalloc(sizeof(*hw_mgr_intf), GFP_KERNEL);
+	if (!hw_mgr_intf) {
+		CAM_ERR(CAM_CRE, "Error allocating memory");
+		rc = -ENOMEM;
+		goto hw_alloc_fail;
+	}
+
+	rc = cam_cre_hw_mgr_init(pdev->dev.of_node, hw_mgr_intf,
+		&iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "Can not initialize CRE HWmanager %d", rc);
+		goto hw_init_fail;
+	}
+
+	memset(g_cre_dev.ctx_cre, 0,  sizeof(g_cre_dev.ctx_cre));
+	for (i = 0; i < CAM_CRE_CTX_MAX; i++) {
+		g_cre_dev.ctx_cre[i].base = &g_cre_dev.ctx[i];
+		rc = cam_cre_context_init(&g_cre_dev.ctx_cre[i],
+			hw_mgr_intf, i, iommu_hdl);
+		if (rc) {
+			CAM_ERR(CAM_CRE, "CRE context init failed %d %d",
+				i, rc);
+			goto ctx_init_fail;
+		}
+	}
+
+	rc = cam_node_init(node, hw_mgr_intf, g_cre_dev.ctx,
+		CAM_CRE_CTX_MAX, CAM_CRE_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "CRE node init failed %d", rc);
+		goto ctx_init_fail;
+	}
+
+	node->sd_handler = cam_cre_subdev_close_internal;
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_cre_dev_iommu_fault_handler, node);
+
+	g_cre_dev.open_cnt = 0;
+	mutex_init(&g_cre_dev.cre_lock);
+
+	rc = cam_subdev_register(&g_cre_dev.sd, pdev);
+	CAM_DBG(CAM_CRE, "Component bound successfully");
+
+	return rc;
+
+ctx_init_fail:
+	for (--i; i >= 0; i--)
+		if (cam_cre_context_deinit(&g_cre_dev.ctx_cre[i]))
+			CAM_ERR(CAM_CRE, "deinit fail %d %d", i, rc);
+hw_init_fail:
+	kfree(hw_mgr_intf);
+hw_alloc_fail:
+	if (cam_subdev_remove(&g_cre_dev.sd))
+		CAM_ERR(CAM_CRE, "remove fail %d", rc);
+err:
+	return rc;
+}
+
+static void cam_cre_subdev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+
+	for (i = 0; i < CRE_CTX_MAX; i++)
+		cam_cre_context_deinit(&g_cre_dev.ctx_cre[i]);
+
+	cam_node_deinit(g_cre_dev.node);
+	cam_unregister_subdev(&g_cre_dev.sd);
+	cam_subdev_remove(&g_cre_dev.sd);
+	mutex_destroy(&g_cre_dev.cre_lock);
+}
+
+const static struct component_ops cam_cre_subdev_component_ops = {
+	.bind = cam_cre_subdev_component_bind,
+	.unbind = cam_cre_subdev_component_unbind,
+};
+
+static int cam_cre_subdev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_cre_subdev_component_ops);
+	return 0;
+}
+
+static int cam_cre_subdev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CRE, "Adding CRE sub component");
+	rc = component_add(&pdev->dev, &cam_cre_subdev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CRE, "failed to add component rc: %d", rc);
+	return rc;
+}
+
+static const struct of_device_id cam_cre_subdev_dt_match[] = {
+	{
+		.compatible = "qcom,cam-cre",
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_cre_subdev_dt_match);
+
+struct platform_driver cam_cre_subdev_driver = {
+	.probe = cam_cre_subdev_probe,
+	.remove = cam_cre_subdev_remove,
+	.driver = {
+		.name = "cam_cre",
+		.of_match_table = cam_cre_subdev_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_cre_subdev_init_module(void)
+{
+	return platform_driver_register(&cam_cre_subdev_driver);
+}
+
+void cam_cre_subdev_exit_module(void)
+{
+	platform_driver_unregister(&cam_cre_subdev_driver);
+}
+
+MODULE_DESCRIPTION("MSM CRE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_dev.h
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CRE_DEV_H_
+#define _CAM_CRE_DEV_H_
+
+#include "cam_subdev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_context.h"
+#include "cam_cre_context.h"
+
+/**
+ * struct cam_cre_dev - Camera CRE V4l2 device node
+ *
+ * @sd: Commone camera subdevice node
+ * @node: Pointer to cre subdevice
+ * @ctx: CRE base context storage
+ * @ctx_cre: CRE private context storage
+ * @cre_mutex: CRE dev mutex
+ * @open_cnt: Open device count
+ */
+struct cam_cre_dev {
+	struct cam_subdev sd;
+	struct cam_node *node;
+	struct cam_context ctx[CAM_CRE_CTX_MAX];
+	struct cam_cre_context ctx_cre[CAM_CRE_CTX_MAX];
+	struct mutex cre_mutex;
+	int32_t open_cnt;
+};
+
+/**
+ * @brief : API to register CRE dev to platform framework.
+ * @return struct platform_device pointer on success, or ERR_PTR() on error.
+ */
+int cam_cre_dev_init_module(void);
+
+/**
+ * @brief : API to remove CRE dev from platform framework.
+ */
+void cam_cre_dev_exit_module(void);
+#endif /* __CAM_CRE_DEV_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cam_cre_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cam_cre_hw_mgr.c
@@ -0,0 +1,3053 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+#include <linux/timer.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <linux/debugfs.h>
+#include <media/cam_defs.h>
+#include <media/cam_cre.h>
+#include <media/cam_cpas.h>
+
+#include "cam_sync_api.h"
+#include "cam_packet_util.h"
+#include "cam_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_cre_hw_mgr_intf.h"
+#include "cam_cre_hw_mgr.h"
+#include "cre_hw.h"
+#include "cam_smmu_api.h"
+#include "cam_mem_mgr.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_debug_util.h"
+#include "cam_soc_util.h"
+#include "cam_cpas_api.h"
+#include "cam_common_util.h"
+#include "cre_dev_intf.h"
+#include "cam_compat.h"
+
+static struct cam_cre_hw_mgr *cre_hw_mgr;
+
+static bool cam_cre_debug_clk_update(struct cam_cre_clk_info *hw_mgr_clk_info)
+{
+	if (cre_hw_mgr->cre_debug_clk &&
+		cre_hw_mgr->cre_debug_clk != hw_mgr_clk_info->curr_clk) {
+		hw_mgr_clk_info->base_clk = cre_hw_mgr->cre_debug_clk;
+		hw_mgr_clk_info->curr_clk = cre_hw_mgr->cre_debug_clk;
+		hw_mgr_clk_info->uncompressed_bw = cre_hw_mgr->cre_debug_clk;
+		hw_mgr_clk_info->compressed_bw = cre_hw_mgr->cre_debug_clk;
+		CAM_DBG(CAM_PERF, "bc = %d cc = %d ub %d cb %d",
+			hw_mgr_clk_info->base_clk, hw_mgr_clk_info->curr_clk,
+			hw_mgr_clk_info->uncompressed_bw,
+			hw_mgr_clk_info->compressed_bw);
+		return true;
+	}
+
+	return false;
+}
+
+static struct cam_cre_io_buf_info *cam_cre_mgr_get_rsc(
+	struct cam_cre_ctx *ctx_data,
+	struct cam_buf_io_cfg *in_io_buf)
+{
+	int k = 0;
+
+	if (in_io_buf->direction == CAM_BUF_INPUT) {
+		for (k = 0; k < CRE_MAX_IN_RES; k++) {
+			if (ctx_data->cre_acquire.in_res[k].res_id ==
+				in_io_buf->resource_type)
+				return &ctx_data->cre_acquire.in_res[k];
+		}
+		if (k == CRE_MAX_IN_RES) {
+			CAM_ERR(CAM_CRE, "Invalid res_id %d",
+				in_io_buf->resource_type);
+			goto end;
+		}
+	} else if (in_io_buf->direction == CAM_BUF_OUTPUT) {
+		for (k = 0; k < CRE_MAX_OUT_RES; k++) {
+			if (ctx_data->cre_acquire.out_res[k].res_id ==
+				in_io_buf->resource_type)
+				return &ctx_data->cre_acquire.out_res[k];
+		}
+		if (k == CRE_MAX_OUT_RES) {
+			CAM_ERR(CAM_CRE, "Invalid res_id %d",
+				in_io_buf->resource_type);
+			goto end;
+		}
+	}
+
+end:
+	return NULL;
+}
+
+static int cam_cre_mgr_update_reg_set(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_request *cre_req, int batch_index)
+{
+	struct cam_cre_dev_reg_set_update reg_set_upd_cmd;
+	int i;
+
+	reg_set_upd_cmd.cre_reg_buf = cre_req->cre_reg_buf[batch_index];
+
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv,
+			CRE_HW_REG_SET_UPDATE,
+			&reg_set_upd_cmd, sizeof(reg_set_upd_cmd));
+	}
+
+	return 0;
+}
+
+static void cam_cre_free_io_config(struct cam_cre_request *req)
+{
+	int i, j;
+
+	for (i = 0; i < CRE_MAX_BATCH_SIZE; i++) {
+		for (j = 0; j < CRE_MAX_IO_BUFS; j++) {
+			if (req->io_buf[i][j]) {
+				cam_free_clear(req->io_buf[i][j]);
+				req->io_buf[i][j] = NULL;
+			}
+		}
+	}
+}
+
+static int cam_cre_mgr_process_cmd_io_buf_req(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_packet *packet, struct cam_cre_ctx *ctx_data,
+	uint32_t req_idx, struct list_head *buf_tracker)
+{
+	int rc = 0;
+	int i, j, k;
+	dma_addr_t iova_addr;
+
+	size_t len;
+	struct cam_cre_request *cre_request;
+	struct cre_io_buf *io_buf;
+	struct plane_info *plane_info;
+
+	uint32_t alignment;
+	bool     is_secure;
+	struct   cam_buf_io_cfg *io_cfg_ptr = NULL;
+	struct   cam_cre_io_buf_info *acq_io_buf;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload_flex +
+			packet->io_configs_offset / 4);
+
+	cre_request = ctx_data->req_list[req_idx];
+	cre_request->num_batch = ctx_data->cre_acquire.batch_size;
+	CAM_DBG(CAM_CRE, "num_io_configs %d", packet->num_io_configs);
+
+	for (i = 0; i < cre_request->num_batch; i++) {
+		for (j = 0; j < packet->num_io_configs; j++) {
+			cre_request->num_io_bufs[i]++;
+			acq_io_buf = cam_cre_mgr_get_rsc(ctx_data, &io_cfg_ptr[j]);
+			if (!acq_io_buf) {
+				CAM_ERR(CAM_CRE, "get rsc failed");
+				return -EINVAL;
+			}
+
+			cre_request->io_buf[i][j] =
+				kzalloc(sizeof(struct cre_io_buf), GFP_KERNEL);
+			if (!cre_request->io_buf[i][j]) {
+				CAM_ERR(CAM_CRE,
+					"IO config allocation failure");
+				cam_cre_free_io_config(cre_request);
+				return -ENOMEM;
+			}
+
+			io_buf = cre_request->io_buf[i][j];
+			io_buf->num_planes = acq_io_buf->num_planes;
+			io_buf->resource_type = acq_io_buf->res_id;
+			io_buf->direction = acq_io_buf->direction;
+			io_buf->format = acq_io_buf->format;
+
+			alignment = acq_io_buf->alignment;
+			io_buf->fence = io_cfg_ptr[j].fence;
+
+			CAM_DBG(CAM_CRE,
+				"i %d j %d Number of planes %d res_type %d dir %d, fence %d format %d align %d",
+				i, j, io_buf->num_planes, io_buf->resource_type,
+				io_buf->direction, io_buf->fence, io_buf->format, alignment);
+
+			for (k = 0; k < io_buf->num_planes; k++) {
+				is_secure = cam_mem_is_secure_buf(
+					io_cfg_ptr[j].mem_handle[k]);
+
+				if (is_secure)
+					rc = cam_mem_get_io_buf(
+						io_cfg_ptr[j].mem_handle[k],
+						hw_mgr->iommu_sec_hdl,
+						&iova_addr, &len, NULL, buf_tracker);
+				else
+					rc = cam_mem_get_io_buf(
+						io_cfg_ptr[j].mem_handle[k],
+						hw_mgr->iommu_hdl,
+						&iova_addr, &len, NULL, buf_tracker);
+
+				if (rc) {
+					CAM_ERR(CAM_CRE, "get buf failed: %d",
+						rc);
+					return -EINVAL;
+				}
+				iova_addr += io_cfg_ptr[j].offsets[k];
+				plane_info = &io_buf->p_info[k];
+
+				plane_info->offset = io_cfg_ptr[j].offsets[k];
+				plane_info->format = acq_io_buf->format;
+				plane_info->iova_addr = iova_addr +
+					((io_cfg_ptr[j].planes[k].plane_stride *
+					  io_cfg_ptr[j].planes[k].slice_height) * k);
+
+				plane_info->stride    =
+					io_cfg_ptr[j].planes[k].plane_stride;
+
+				/* Width for WE has to be updated in number of pixels */
+				if (acq_io_buf->direction == CAM_BUF_OUTPUT) {
+					if (plane_info->format == CAM_FORMAT_PLAIN16_10) {
+						plane_info->width =
+							io_cfg_ptr[j].planes[k].plane_stride/2;
+					} else if (plane_info->format == CAM_FORMAT_PLAIN128) {
+						/* PLAIN 128/8 = 16 Bytes per pixel */
+						plane_info->width =
+							io_cfg_ptr[j].planes[k].plane_stride/16;
+					} else {
+						plane_info->width =
+							io_cfg_ptr[j].planes[k].width;
+					}
+				} else {
+					/* FE width should be in bytes */
+					plane_info->width     =
+						io_cfg_ptr[j].planes[k].plane_stride;
+				}
+				plane_info->height    =
+					io_cfg_ptr[j].planes[k].height;
+				plane_info->len       = len;
+				plane_info->alignment = alignment;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static void cam_cre_device_timer_reset(struct cam_cre_hw_mgr *hw_mgr)
+{
+
+	if (hw_mgr->clk_info.watch_dog) {
+		CAM_DBG(CAM_CRE, "reset timer");
+		crm_timer_reset(hw_mgr->clk_info.watch_dog);
+			hw_mgr->clk_info.watch_dog_reset_counter++;
+	}
+}
+
+static int cam_cre_mgr_reset_hw(void)
+{
+	struct cam_cre_hw_mgr *hw_mgr = cre_hw_mgr;
+	int i, rc = 0;
+
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		rc = hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv, CRE_HW_RESET,
+			NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_CRE, "CRE Reset failed: %d", rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+
+static void cam_cre_ctx_wait_for_idle_irq(struct cam_cre_ctx *ctx)
+{
+	int rc;
+
+	if (ctx->ctx_state != CRE_CTX_STATE_ACQUIRED) {
+		CAM_ERR(CAM_CRE, "ctx %u is in %d state",
+			ctx->ctx_id, ctx->ctx_state);
+		return;
+	}
+
+	rc = cam_common_wait_for_completion_timeout(
+		&ctx->cre_top->idle_done,
+		msecs_to_jiffies(CAM_CRE_RESPONSE_TIME_THRESHOLD));
+	if (!rc) {
+		cam_cre_device_timer_reset(cre_hw_mgr);
+	} else {
+		CAM_DBG(CAM_CRE, "IDLE done for req idx %d",
+			ctx->last_req_idx);
+	}
+}
+
+static int cam_cre_mgr_create_cre_reg_buf(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_cre_ctx *ctx_data, uint32_t req_idx)
+{
+	int i, rc = 0;
+	struct cam_cre_dev_prepare_req prepare_req;
+
+	prepare_req.ctx_data = ctx_data;
+	prepare_req.hw_mgr = hw_mgr;
+	prepare_req.packet = packet;
+	prepare_req.prepare_args = prepare_args;
+	prepare_req.req_idx = req_idx;
+
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		rc = hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv,
+			CRE_HW_PREPARE, &prepare_req, sizeof(prepare_req));
+		if (rc) {
+			CAM_ERR(CAM_CRE, "CRE Dev prepare failed: %d", rc);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_cre_mgr_calculate_num_path(
+	struct cam_cre_clk_bw_req_internal_v2 *clk_info,
+	struct cam_cre_ctx *ctx_data)
+{
+	int i, path_index = 0;
+
+	for (i = 0; i < CAM_CRE_MAX_PER_PATH_VOTES; i++) {
+		if ((clk_info->axi_path[i].path_data_type <
+			CAM_AXI_PATH_DATA_CRE_START_OFFSET) ||
+			(clk_info->axi_path[i].path_data_type >
+			CAM_AXI_PATH_DATA_CRE_MAX_OFFSET) ||
+			((clk_info->axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_CRE_START_OFFSET) >=
+			CAM_CRE_MAX_PER_PATH_VOTES)) {
+			CAM_DBG(CAM_CRE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_CRE_START_OFFSET,
+				CAM_CRE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		path_index = clk_info->axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_CRE_START_OFFSET;
+
+		CAM_DBG(CAM_CRE,
+			"clk_info: i[%d]: [%s %s] bw [%lld %lld] num_path: %d",
+			i,
+			cam_cpas_axi_util_trans_type_to_string(
+			clk_info->axi_path[i].transac_type),
+			cam_cpas_axi_util_path_type_to_string(
+			clk_info->axi_path[i].path_data_type),
+			clk_info->axi_path[i].camnoc_bw,
+			clk_info->axi_path[i].mnoc_ab_bw,
+			clk_info->num_paths);
+	}
+	return 0;
+}
+
+static int cam_cre_update_cpas_vote(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data)
+{
+	int i = 0;
+	struct cam_cre_clk_info *clk_info;
+	struct cam_cre_dev_bw_update bw_update = {{0}, {0}, 0, 0};
+
+	clk_info = &hw_mgr->clk_info;
+
+	bw_update.ahb_vote.type = CAM_VOTE_DYNAMIC;
+	bw_update.ahb_vote.vote.freq = 0;
+	bw_update.ahb_vote_valid = false;
+
+	bw_update.axi_vote.num_paths = clk_info->num_paths;
+	memcpy(&bw_update.axi_vote.axi_path[0],
+		&clk_info->axi_path[0],
+		bw_update.axi_vote.num_paths *
+		sizeof(struct cam_cpas_axi_per_path_bw_vote));
+
+	bw_update.axi_vote_valid = true;
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv,
+			CRE_HW_BW_UPDATE,
+			&bw_update, sizeof(bw_update));
+	}
+	return 0;
+}
+
+static int cam_cre_mgr_remove_bw(struct cam_cre_hw_mgr *hw_mgr, int ctx_id)
+{
+	int path_index, i, rc = 0;
+	struct cam_cre_ctx *ctx_data = NULL;
+	struct cam_cre_clk_info *hw_mgr_clk_info;
+
+	ctx_data = &hw_mgr->ctx[ctx_id];
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index =
+		ctx_data->clk_info.axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_CRE_START_OFFSET;
+		if (path_index >= CAM_CRE_MAX_PER_PATH_VOTES) {
+			CAM_WARN(CAM_CRE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_CRE_START_OFFSET,
+				CAM_CRE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw -=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+	}
+
+	rc = cam_cre_update_cpas_vote(hw_mgr, ctx_data);
+
+	return rc;
+}
+
+static bool cam_cre_update_bw_v2(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data,
+	struct cam_cre_clk_info *hw_mgr_clk_info,
+	struct cam_cre_clk_bw_req_internal_v2 *clk_info,
+	bool busy)
+{
+	int i, path_index;
+	bool update_required = true;
+
+	for (i = 0; i < clk_info->num_paths; i++)
+		CAM_DBG(CAM_CRE, "clk_info camnoc = %lld busy = %d",
+			clk_info->axi_path[i].camnoc_bw, busy);
+
+	if (clk_info->num_paths == ctx_data->clk_info.num_paths) {
+		update_required = false;
+		for (i = 0; i < clk_info->num_paths; i++) {
+			if ((clk_info->axi_path[i].transac_type ==
+			ctx_data->clk_info.axi_path[i].transac_type) &&
+				(clk_info->axi_path[i].path_data_type ==
+			ctx_data->clk_info.axi_path[i].path_data_type) &&
+				(clk_info->axi_path[i].camnoc_bw ==
+			ctx_data->clk_info.axi_path[i].camnoc_bw) &&
+				(clk_info->axi_path[i].mnoc_ab_bw ==
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw)) {
+				continue;
+			} else {
+				update_required = true;
+				break;
+			}
+		}
+	}
+	if (!update_required) {
+		CAM_DBG(CAM_CRE,
+		"Incoming BW hasn't changed, no update required");
+		return false;
+	}
+
+	/*
+	 * Remove previous vote of this context from hw mgr first.
+	 * hw_mgr_clk_info has all valid paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index =
+		ctx_data->clk_info.axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_CRE_START_OFFSET;
+
+		if (path_index >= CAM_CRE_MAX_PER_PATH_VOTES) {
+			CAM_WARN(CAM_CRE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_CRE_START_OFFSET,
+				CAM_CRE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw -=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+	}
+
+	ctx_data->clk_info.num_paths =
+		cam_cre_mgr_calculate_num_path(clk_info, ctx_data);
+
+	memcpy(&ctx_data->clk_info.axi_path[0],
+		&clk_info->axi_path[0],
+		clk_info->num_paths * sizeof(struct cam_cpas_axi_per_path_bw_vote));
+
+	/*
+	 * Add new vote of this context in hw mgr.
+	 * hw_mgr_clk_info has all paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index =
+		ctx_data->clk_info.axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_CRE_START_OFFSET;
+
+		if (path_index >= CAM_CRE_MAX_PER_PATH_VOTES) {
+			CAM_WARN(CAM_CRE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_CRE_START_OFFSET,
+				CAM_CRE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		hw_mgr_clk_info->axi_path[path_index].path_data_type =
+			ctx_data->clk_info.axi_path[i].path_data_type;
+		hw_mgr_clk_info->axi_path[path_index].transac_type =
+			ctx_data->clk_info.axi_path[i].transac_type;
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw +=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		CAM_DBG(CAM_CRE,
+			"Consolidate Path Vote : Dev[%s] i[%d] path_idx[%d] : [%s %s] [%lld %lld]",
+			ctx_data->cre_acquire.dev_name,
+			i, path_index,
+			cam_cpas_axi_util_trans_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].transac_type),
+			cam_cpas_axi_util_path_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].path_data_type),
+			hw_mgr_clk_info->axi_path[path_index].camnoc_bw,
+			hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw);
+	}
+
+	if (hw_mgr_clk_info->num_paths < ctx_data->clk_info.num_paths)
+		hw_mgr_clk_info->num_paths = ctx_data->clk_info.num_paths;
+
+	return true;
+}
+
+static bool cam_cre_check_bw_update(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data, int idx)
+{
+	bool busy = false, bw_updated = false;
+	int i;
+	struct cam_cre_clk_bw_req_internal_v2 *clk_info_v2;
+	struct cam_cre_clk_info *hw_mgr_clk_info;
+	uint64_t req_id;
+
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+	req_id = ctx_data->req_list[idx]->request_id;
+	if (ctx_data->req_cnt > 1)
+		busy = true;
+
+	clk_info_v2 = &ctx_data->req_list[idx]->clk_info_v2;
+
+	bw_updated = cam_cre_update_bw_v2(hw_mgr, ctx_data,
+		hw_mgr_clk_info, clk_info_v2, busy);
+	for (i = 0; i < hw_mgr_clk_info->num_paths; i++) {
+		CAM_DBG(CAM_CRE,
+			"Final path_type: %s, transac_type: %s, camnoc_bw = %lld mnoc_ab_bw = %lld, mnoc_ib_bw = %lld, device: %s",
+			cam_cpas_axi_util_path_type_to_string(
+			hw_mgr_clk_info->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			hw_mgr_clk_info->axi_path[i].transac_type),
+			hw_mgr_clk_info->axi_path[i].camnoc_bw,
+			hw_mgr_clk_info->axi_path[i].mnoc_ab_bw,
+			hw_mgr_clk_info->axi_path[i].mnoc_ib_bw,
+			ctx_data->cre_acquire.dev_name);
+	}
+
+	return bw_updated;
+}
+
+static int cam_cre_mgr_handle_config_err(
+	struct cam_hw_config_args *config_args,
+	struct cam_cre_ctx *ctx_data)
+{
+	struct cam_hw_done_event_data err_data;
+	struct cam_cre_request *cre_req;
+	uint32_t req_idx;
+
+	cre_req = config_args->priv;
+
+	err_data.request_id = cre_req->request_id;
+	err_data.evt_param = CAM_SYNC_CRE_EVENT_CONFIG_ERR;
+	ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_CTX_EVT_ID_ERROR,
+		&err_data);
+
+	req_idx = cre_req->req_idx;
+	cre_req->request_id = 0;
+	cam_cre_free_io_config(ctx_data->req_list[req_idx]);
+	cam_free_clear(ctx_data->req_list[req_idx]);
+	ctx_data->req_list[req_idx] = NULL;
+	clear_bit(req_idx, ctx_data->bitmap);
+	return 0;
+}
+
+static bool cam_cre_is_pending_request(struct cam_cre_ctx *ctx_data)
+{
+	return !bitmap_empty(ctx_data->bitmap, CAM_CTX_REQ_MAX);
+}
+
+static int cam_cre_supported_clk_rates(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data)
+{
+	int i;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_hw_info *dev = NULL;
+
+	dev_intf = hw_mgr->cre_dev_intf[0];
+	if (!dev_intf) {
+		CAM_ERR(CAM_CRE, "dev_intf is invalid");
+		return -EINVAL;
+	}
+
+	dev = (struct cam_hw_info *)dev_intf->hw_priv;
+	soc_info = &dev->soc_info;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++) {
+		ctx_data->clk_info.clk_rate[i] =
+			soc_info->clk_rate[i][soc_info->src_clk_idx];
+		CAM_DBG(CAM_CRE, "clk_info[%d] = %d",
+			i, ctx_data->clk_info.clk_rate[i]);
+	}
+
+	return 0;
+}
+
+static int cam_cre_ctx_clk_info_init(struct cam_cre_ctx *ctx_data)
+{
+	int i;
+
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+
+	for (i = 0; i < CAM_CRE_MAX_PER_PATH_VOTES; i++) {
+		ctx_data->clk_info.axi_path[i].camnoc_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ab_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ib_bw = 0;
+	}
+
+	cam_cre_supported_clk_rates(cre_hw_mgr, ctx_data);
+
+	return 0;
+}
+
+static int32_t cam_cre_deinit_idle_clk(void *priv, void *data)
+{
+	struct cam_cre_hw_mgr *hw_mgr = (struct cam_cre_hw_mgr *)priv;
+	struct cre_clk_work_data *task_data = (struct cre_clk_work_data *)data;
+	struct cam_cre_clk_info *clk_info =
+		(struct cam_cre_clk_info *)task_data->data;
+	uint32_t id;
+	uint32_t i;
+	struct cam_cre_ctx *ctx_data;
+	struct cam_hw_intf *dev_intf = NULL;
+	int rc = 0;
+	bool busy = false;
+
+	clk_info->base_clk = 0;
+	clk_info->curr_clk = 0;
+	clk_info->over_clked = 0;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	for (i = 0; i < CRE_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx[i];
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (ctx_data->ctx_state == CRE_CTX_STATE_ACQUIRED) {
+			busy = cam_cre_is_pending_request(ctx_data);
+			if (busy) {
+				mutex_unlock(&ctx_data->ctx_mutex);
+				break;
+			}
+			cam_cre_ctx_clk_info_init(ctx_data);
+		}
+		mutex_unlock(&ctx_data->ctx_mutex);
+	}
+
+	if (busy) {
+		cam_cre_device_timer_reset(hw_mgr);
+		rc = -EBUSY;
+		goto done;
+	}
+
+	dev_intf = hw_mgr->cre_dev_intf[0];
+	id = CRE_HW_CLK_DISABLE;
+
+	CAM_DBG(CAM_CRE, "Disable %d", clk_info->hw_type);
+
+	dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, id, NULL, 0);
+
+done:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static void cam_cre_device_timer_cb(struct timer_list *timer_data)
+{
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct cre_clk_work_data *task_data;
+	struct cam_req_mgr_timer *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+
+	spin_lock_irqsave(&cre_hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(cre_hw_mgr->timer_work);
+	if (!task) {
+		CAM_ERR(CAM_CRE, "no empty task");
+		spin_unlock_irqrestore(&cre_hw_mgr->hw_mgr_lock, flags);
+		return;
+	}
+
+	task_data = (struct cre_clk_work_data *)task->payload;
+	task_data->data = timer->parent;
+	task_data->type = CRE_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_cre_deinit_idle_clk;
+	cam_req_mgr_workq_enqueue_task(task, cre_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&cre_hw_mgr->hw_mgr_lock, flags);
+}
+
+static int cam_cre_device_timer_start(struct cam_cre_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+
+	if (!hw_mgr->clk_info.watch_dog) {
+		rc = crm_timer_init(&hw_mgr->clk_info.watch_dog,
+			CRE_DEVICE_IDLE_TIMEOUT, &hw_mgr->clk_info,
+			&cam_cre_device_timer_cb);
+		if (rc)
+			CAM_ERR(CAM_CRE, "Failed to start timer");
+		hw_mgr->clk_info.watch_dog_reset_counter = 0;
+	}
+
+	return rc;
+}
+
+static void cam_cre_device_timer_stop(struct cam_cre_hw_mgr *hw_mgr)
+{
+	if (hw_mgr->clk_info.watch_dog) {
+		hw_mgr->clk_info.watch_dog_reset_counter = 0;
+		crm_timer_exit(&hw_mgr->clk_info.watch_dog);
+		hw_mgr->clk_info.watch_dog = NULL;
+	}
+}
+
+static int cam_cre_mgr_process_cmd(void *priv, void *data)
+{
+	int rc = 0, i = 0;
+	struct cre_cmd_work_data *task_data = NULL;
+	struct cam_cre_ctx *ctx_data;
+	struct cam_cre_request *cre_req;
+	struct cam_cre_hw_mgr *hw_mgr = cre_hw_mgr;
+	uint32_t num_batch;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRE, "Invalid params%pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	ctx_data = priv;
+	task_data = (struct cre_cmd_work_data *)data;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	mutex_lock(&ctx_data->ctx_mutex);
+
+	if (ctx_data->ctx_state != CRE_CTX_STATE_ACQUIRED) {
+		CAM_ERR(CAM_CRE, "ctx id :%u is not in use",
+			ctx_data->ctx_id);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	if (task_data->req_idx >= CAM_CTX_REQ_MAX) {
+		CAM_ERR(CAM_CRE, "Invalid reqIdx = %llu",
+			task_data->req_idx);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	if (task_data->request_id <= ctx_data->last_flush_req) {
+		CAM_WARN(CAM_CRE,
+			"request %lld has been flushed, reject packet", task_data->request_id);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	cre_req = ctx_data->req_list[task_data->req_idx];
+	if (cre_req->request_id > ctx_data->last_flush_req)
+		ctx_data->last_flush_req = 0;
+
+	if (!cam_cre_is_pending_request(ctx_data)) {
+		CAM_WARN(CAM_CRE, "no pending req, req %lld last flush %lld",
+			cre_req->request_id, ctx_data->last_flush_req);
+		rc = -EINVAL;
+		goto err;
+	}
+	hw_mgr = task_data->data;
+	num_batch = cre_req->num_batch;
+
+	if (num_batch > CRE_MAX_BATCH_SIZE) {
+		CAM_WARN(CAM_CRE, "num_batch = %u is greater than max",
+				num_batch);
+		num_batch = CRE_MAX_BATCH_SIZE;
+	}
+
+	CAM_DBG(CAM_CRE,
+		"Ctx %d Going to configure cre for req %d, req_idx %d num_batch %d",
+		ctx_data->ctx_id, cre_req->request_id, cre_req->req_idx, num_batch);
+
+	for (i = 0; i < num_batch; i++) {
+		if (i != 0) {
+			rc = cam_common_wait_for_completion_timeout(
+					&ctx_data->cre_top->bufdone,
+					msecs_to_jiffies(100));
+			if (!rc) {
+				cam_cre_device_timer_reset(cre_hw_mgr);
+				CAM_ERR(CAM_CRE,
+					"Timedout waiting for bufdone on last frame");
+				rc = -EINVAL;
+				goto err;
+			} else {
+				reinit_completion(&ctx_data->cre_top->bufdone);
+				CAM_INFO(CAM_CRE,
+					"done for frame %d in batch of %d",
+					i-1, num_batch);
+			}
+		}
+
+		cam_cre_mgr_update_reg_set(hw_mgr, cre_req, i);
+		cam_cre_ctx_wait_for_idle_irq(ctx_data);
+	}
+err:
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int32_t cam_cre_mgr_process_msg(void *priv, void *data)
+{
+	struct cre_msg_work_data *task_data;
+	struct cam_hw_done_event_data buf_data;
+	struct cam_cre_hw_mgr *hw_mgr;
+	struct cam_cre_ctx *ctx;
+	struct cam_cre_request *active_req;
+	struct cam_cre_irq_data irq_data;
+	struct cam_cre_hw_cfg_req *cfg_req = NULL;
+	uint32_t evt_id;
+	uint32_t active_req_idx;
+	int rc = 0;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRE, "Invalid data");
+		return -EINVAL;
+	}
+
+	task_data = data;
+	hw_mgr = priv;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	cfg_req = list_first_entry(&hw_mgr->hw_config_req_list,
+		struct cam_cre_hw_cfg_req, list);
+	if (!cfg_req) {
+		CAM_ERR(CAM_CRE, "Hw config req list empty");
+		rc = -EFAULT;
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return rc;
+	}
+	list_del_init(&cfg_req->list);
+
+	if (cfg_req->ctx_id < 0) {
+		CAM_ERR(CAM_CRE, "No valid context to handle error");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	ctx = &hw_mgr->ctx[cfg_req->ctx_id];
+	mutex_lock(&ctx->ctx_mutex);
+
+	irq_data = task_data->irq_data;
+	if (ctx->ctx_state != CRE_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_CRE, "ctx id: %d not in right state: %d",
+			cfg_req->ctx_id, ctx->ctx_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	active_req_idx = find_next_bit(ctx->bitmap, ctx->bits, ctx->last_done_req_idx);
+	CAM_DBG(CAM_CRE, "Ctx %d active_req_idx %d last_done_req_idx %d", ctx->ctx_id,
+		active_req_idx, ctx->last_done_req_idx);
+
+	if (active_req_idx >= CAM_CTX_REQ_MAX) {
+		CAM_WARN(CAM_CRE, "ctx %d not valid req idx active_req_idx %d", active_req_idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	active_req = ctx->req_list[active_req_idx];
+	if (!active_req) {
+		CAM_ERR(CAM_CRE, "Active req cannot be null");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (irq_data.error) {
+		evt_id = CAM_CTX_EVT_ID_ERROR;
+		buf_data.evt_param = CAM_SYNC_CRE_EVENT_HW_ERR;
+		buf_data.request_id = active_req->request_id;
+		ctx->ctxt_event_cb(ctx->context_priv, evt_id, &buf_data);
+		rc = cam_cre_mgr_reset_hw();
+		clear_bit(active_req_idx, ctx->bitmap);
+		cam_cre_free_io_config(active_req);
+		cam_free_clear((void *)active_req);
+		ctx->req_cnt--;
+		ctx->req_list[active_req_idx] = NULL;
+	} else if (irq_data.wr_buf_done) {
+		/* Signal Buf done */
+		active_req->frames_done++;
+		CAM_DBG(CAM_CRE, "Ctx %d Received frames_done %d num_batch %d req id %d",
+			ctx->ctx_id, active_req->frames_done, active_req->num_batch,
+			active_req->request_id);
+		complete(&ctx->cre_top->bufdone);
+		if (active_req->frames_done == active_req->num_batch) {
+			ctx->last_done_req_idx = active_req_idx;
+			CAM_DBG(CAM_CRE, "Ctx %d signaling buff done for req %d",
+				ctx->ctx_id, active_req->request_id);
+			evt_id = CAM_CTX_EVT_ID_SUCCESS;
+			buf_data.evt_param = CAM_SYNC_COMMON_EVENT_SUCCESS;
+			buf_data.request_id = active_req->request_id;
+			ctx->ctxt_event_cb(ctx->context_priv, evt_id, &buf_data);
+			clear_bit(active_req_idx, ctx->bitmap);
+			cam_cre_free_io_config(active_req);
+			cam_free_clear((void *)active_req);
+			ctx->req_cnt--;
+			ctx->req_list[active_req_idx] = NULL;
+		}
+	}
+end:
+	list_add_tail(&cfg_req->list, &hw_mgr->free_req_list);
+	mutex_unlock(&ctx->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_cre_get_actual_clk_rate_idx(
+	struct cam_cre_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return i;
+
+	/*
+	 * Caller has to ensure returned index is within array
+	 * size bounds while accessing that index.
+	 */
+
+	return i;
+}
+
+static bool cam_cre_is_over_clk(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data,
+	struct cam_cre_clk_info *hw_mgr_clk_info)
+{
+	int base_clk_idx;
+	int curr_clk_idx;
+
+	base_clk_idx = cam_cre_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->base_clk);
+
+	curr_clk_idx = cam_cre_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->curr_clk);
+
+	CAM_DBG(CAM_CRE, "bc_idx = %d cc_idx = %d %d %d",
+		base_clk_idx, curr_clk_idx, hw_mgr_clk_info->base_clk,
+		hw_mgr_clk_info->curr_clk);
+
+	if (curr_clk_idx > base_clk_idx)
+		return true;
+
+	return false;
+}
+
+static int cam_cre_get_lower_clk_rate(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_cre_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	while (i > 0) {
+		if (ctx_data->clk_info.clk_rate[i - 1])
+			return ctx_data->clk_info.clk_rate[i - 1];
+		i--;
+	}
+
+	CAM_DBG(CAM_CRE, "Already clk at lower level");
+
+	return base_clk;
+}
+
+static int cam_cre_get_next_clk_rate(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_cre_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	while (i < CAM_MAX_VOTE - 1) {
+		if (ctx_data->clk_info.clk_rate[i + 1])
+			return ctx_data->clk_info.clk_rate[i + 1];
+		i++;
+	}
+
+	CAM_DBG(CAM_CRE, "Already clk at higher level");
+	return base_clk;
+}
+
+static bool cam_cre_update_clk_overclk_free(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data,
+	struct cam_cre_clk_info *hw_mgr_clk_info,
+	struct cam_cre_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	int rc = false;
+
+	/*
+	 * In caseof no pending packets case
+	 *    1. In caseof overclk cnt is less than threshold, increase
+	 *       overclk count and no update in the clock rate
+	 *    2. In caseof overclk cnt is greater than or equal to threshold
+	 *       then lower clock rate by one level and update hw_mgr current
+	 *       clock value.
+	 *        a. In case of new clock rate greater than sum of clock
+	 *           rates, reset overclk count value to zero if it is
+	 *           overclock
+	 *        b. if it is less than sum of base clocks then go to next
+	 *           level of clock and make overclk count to zero
+	 *        c. if it is same as sum of base clock rates update overclock
+	 *           cnt to 0
+	 */
+	if (hw_mgr_clk_info->over_clked < hw_mgr_clk_info->threshold) {
+		hw_mgr_clk_info->over_clked++;
+		rc = false;
+	} else {
+		hw_mgr_clk_info->curr_clk =
+			cam_cre_get_lower_clk_rate(hw_mgr, ctx_data,
+			hw_mgr_clk_info->curr_clk);
+		if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk) {
+			if (cam_cre_is_over_clk(hw_mgr, ctx_data,
+				hw_mgr_clk_info))
+				hw_mgr_clk_info->over_clked = 0;
+		} else if (hw_mgr_clk_info->curr_clk <
+			hw_mgr_clk_info->base_clk) {
+			hw_mgr_clk_info->curr_clk =
+			cam_cre_get_next_clk_rate(hw_mgr, ctx_data,
+				hw_mgr_clk_info->curr_clk);
+				hw_mgr_clk_info->over_clked = 0;
+		} else if (hw_mgr_clk_info->curr_clk ==
+			hw_mgr_clk_info->base_clk) {
+			hw_mgr_clk_info->over_clked = 0;
+		}
+		rc = true;
+	}
+
+	return rc;
+}
+
+static int cam_cre_calc_total_clk(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_clk_info *hw_mgr_clk_info, uint32_t dev_type)
+{
+	int i;
+	struct cam_cre_ctx *ctx_data;
+
+	hw_mgr_clk_info->base_clk = 0;
+	for (i = 0; i < CRE_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx[i];
+		if (ctx_data->ctx_state == CRE_CTX_STATE_ACQUIRED)
+			hw_mgr_clk_info->base_clk +=
+				ctx_data->clk_info.base_clk;
+	}
+
+	return 0;
+}
+
+static int cam_cre_get_actual_clk_rate(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return ctx_data->clk_info.clk_rate[i];
+
+	return base_clk;
+}
+
+static bool cam_cre_update_clk_busy(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data,
+	struct cam_cre_clk_info *hw_mgr_clk_info,
+	struct cam_cre_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	uint32_t next_clk_level;
+	uint32_t actual_clk;
+	bool rc = false;
+
+	/* 1. if current request frame cycles(fc) are more than previous
+	 *      frame fc
+	 *      Calculate the new base clock.
+	 *      if sum of base clocks are more than next available clk level
+	 *       Update clock rate, change curr_clk_rate to sum of base clock
+	 *       rates and make over_clked to zero
+	 *      else
+	 *       Update clock rate to next level, update curr_clk_rate and make
+	 *       overclked cnt to zero
+	 * 2. if current fc is less than or equal to previous  frame fc
+	 *      Still Bump up the clock to next available level
+	 *      if it is available, then update clock, make overclk cnt to
+	 *      zero. If the clock is already at highest clock rate then
+	 *      no need to update the clock
+	 */
+	ctx_data->clk_info.base_clk = base_clk;
+	hw_mgr_clk_info->over_clked = 0;
+	if (clk_info->frame_cycles > ctx_data->clk_info.curr_fc) {
+		cam_cre_calc_total_clk(hw_mgr, hw_mgr_clk_info,
+			ctx_data->cre_acquire.dev_type);
+		actual_clk = cam_cre_get_actual_clk_rate(hw_mgr,
+			ctx_data, base_clk);
+		if (hw_mgr_clk_info->base_clk > actual_clk) {
+			hw_mgr_clk_info->curr_clk = hw_mgr_clk_info->base_clk;
+		} else {
+			next_clk_level = cam_cre_get_next_clk_rate(hw_mgr,
+				ctx_data, hw_mgr_clk_info->curr_clk);
+			hw_mgr_clk_info->curr_clk = next_clk_level;
+		}
+		rc = true;
+	} else {
+		next_clk_level =
+			cam_cre_get_next_clk_rate(hw_mgr, ctx_data,
+				hw_mgr_clk_info->curr_clk);
+		if (hw_mgr_clk_info->curr_clk < next_clk_level) {
+			hw_mgr_clk_info->curr_clk = next_clk_level;
+			rc = true;
+		}
+	}
+	ctx_data->clk_info.curr_fc = clk_info->frame_cycles;
+
+	return rc;
+}
+
+static bool cam_cre_update_clk_free(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data,
+	struct cam_cre_clk_info *hw_mgr_clk_info,
+	struct cam_cre_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	int rc = false;
+	bool over_clocked = false;
+
+	ctx_data->clk_info.curr_fc = clk_info->frame_cycles;
+	ctx_data->clk_info.base_clk = base_clk;
+	cam_cre_calc_total_clk(hw_mgr, hw_mgr_clk_info,
+		ctx_data->cre_acquire.dev_type);
+
+	/*
+	 * Current clock is not always sum of base clocks, due to
+	 * clock scales update to next higher or lower levels, it
+	 * equals to one of discrete clock values supported by hardware.
+	 * So even current clock is higher than sum of base clocks, we
+	 * can not consider it is over clocked. if it is greater than
+	 * discrete clock level then only it is considered as over clock.
+	 * 1. Handle over clock case
+	 * 2. If current clock is less than sum of base clocks
+	 *    update current clock
+	 * 3. If current clock is same as sum of base clocks no action
+	 */
+
+	over_clocked = cam_cre_is_over_clk(hw_mgr, ctx_data,
+		hw_mgr_clk_info);
+
+	if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk &&
+		over_clocked) {
+		rc = cam_cre_update_clk_overclk_free(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+	} else if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->over_clked = 0;
+		rc = false;
+	}  else if (hw_mgr_clk_info->curr_clk < hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->curr_clk = cam_cre_get_actual_clk_rate(hw_mgr,
+			ctx_data, hw_mgr_clk_info->base_clk);
+		rc = true;
+	}
+
+	return rc;
+}
+
+static uint32_t cam_cre_mgr_calc_base_clk(uint32_t frame_cycles,
+	uint64_t budget)
+{
+	uint64_t mul = 1000000000;
+	uint64_t base_clk = frame_cycles * mul;
+
+	do_div(base_clk, budget);
+
+	CAM_DBG(CAM_CRE, "budget = %lld fc = %d ib = %lld base_clk = %lld",
+		budget, frame_cycles,
+		(long long)(frame_cycles * mul), base_clk);
+
+	return base_clk;
+}
+
+static bool cam_cre_check_clk_update(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data, int idx)
+{
+	bool busy = false, rc = false;
+	uint64_t base_clk;
+	struct cam_cre_clk_bw_request *clk_info;
+	uint64_t req_id;
+	struct cam_cre_clk_info *hw_mgr_clk_info;
+
+	cam_cre_device_timer_reset(hw_mgr);
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+	req_id = ctx_data->req_list[idx]->request_id;
+	if (ctx_data->req_cnt > 1)
+		busy = true;
+
+	CAM_DBG(CAM_CRE, "busy = %d req_id = %lld", busy, req_id);
+
+	clk_info = &ctx_data->req_list[idx]->clk_info;
+
+	/* Calculate base clk rate */
+	base_clk = cam_cre_mgr_calc_base_clk(
+		clk_info->frame_cycles, clk_info->budget_ns);
+	ctx_data->clk_info.rt_flag = clk_info->rt_flag;
+
+	if (cre_hw_mgr->cre_debug_clk)
+		return cam_cre_debug_clk_update(hw_mgr_clk_info);
+
+	if (busy)
+		rc = cam_cre_update_clk_busy(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+	else
+		rc = cam_cre_update_clk_free(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+
+	CAM_DBG(CAM_CRE, "bc = %d cc = %d busy = %d overclk = %d uc = %d",
+		hw_mgr_clk_info->base_clk, hw_mgr_clk_info->curr_clk,
+		busy, hw_mgr_clk_info->over_clked, rc);
+
+	return rc;
+}
+
+static int cam_cre_mgr_update_clk_rate(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data)
+{
+	struct cam_cre_dev_clk_update clk_upd_cmd;
+	int i;
+
+	clk_upd_cmd.clk_rate = hw_mgr->clk_info.curr_clk;
+
+	CAM_DBG(CAM_PERF, "clk_rate %u for dev_type %d", clk_upd_cmd.clk_rate,
+		ctx_data->cre_acquire.dev_type);
+
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv,
+			CRE_HW_CLK_UPDATE,
+			&clk_upd_cmd, sizeof(clk_upd_cmd));
+	}
+
+	return 0;
+}
+
+static int cam_cre_mgr_cre_clk_remove(struct cam_cre_hw_mgr *hw_mgr, int ctx_id)
+{
+	struct cam_cre_ctx *ctx_data = NULL;
+	struct cam_cre_clk_info *hw_mgr_clk_info;
+
+	ctx_data = &hw_mgr->ctx[ctx_id];
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+
+	if (hw_mgr_clk_info->base_clk >= ctx_data->clk_info.base_clk)
+		hw_mgr_clk_info->base_clk -= ctx_data->clk_info.base_clk;
+
+	/* reset clock info */
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+	return 0;
+}
+
+
+static int cam_cre_mgr_cre_clk_update(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data, int idx)
+{
+	int rc = 0;
+
+	if (cam_cre_check_clk_update(hw_mgr, ctx_data, idx))
+		rc = cam_cre_mgr_update_clk_rate(hw_mgr, ctx_data);
+
+	if (cam_cre_check_bw_update(hw_mgr, ctx_data, idx))
+		rc |= cam_cre_update_cpas_vote(hw_mgr, ctx_data);
+
+	return rc;
+}
+
+int32_t cam_cre_hw_mgr_cb(void *irq_data, int32_t result_size, void *data)
+{
+	int32_t rc = 0;
+	unsigned long flags;
+	struct cam_cre_hw_mgr *hw_mgr = data;
+	struct crm_workq_task *task;
+	struct cre_msg_work_data *task_data;
+	struct cam_cre_irq_data *local_irq_data = irq_data;
+
+	if (!data) {
+		CAM_ERR(CAM_CRE, "irq cb data is NULL");
+		return rc;
+	}
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(cre_hw_mgr->msg_work);
+	if (!task) {
+		CAM_ERR(CAM_CRE, "no empty task");
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+		return -ENOMEM;
+	}
+
+	task_data = (struct cre_msg_work_data *)task->payload;
+	task_data->data = hw_mgr;
+	task_data->irq_data = *local_irq_data;
+	task_data->type = CRE_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_cre_mgr_process_msg;
+	rc = cam_req_mgr_workq_enqueue_task(task, cre_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+
+	return rc;
+}
+
+static int cam_cre_mgr_process_io_cfg(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_packet *packet,
+	struct cam_cre_ctx *ctx_data,
+	uint32_t req_idx,
+	struct cam_hw_prepare_update_args *prep_arg)
+{
+	int i, j = 0, k = 0, l, rc = 0;
+	struct cre_io_buf *io_buf;
+	int32_t sync_in_obj[CRE_MAX_IN_RES];
+	int32_t merged_sync_in_obj;
+	struct cam_cre_request *cre_request;
+
+	rc = cam_cre_mgr_process_cmd_io_buf_req(hw_mgr, packet, ctx_data,
+		req_idx, prep_arg->buf_tracker);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "Process CRE cmd io request is failed: %d",
+			rc);
+		goto end;
+	}
+
+	cre_request = ctx_data->req_list[req_idx];
+	prep_arg->num_out_map_entries = 0;
+	prep_arg->num_in_map_entries = 0;
+
+	CAM_DBG(CAM_CRE, "E: req_idx = %u %x num batch%d",
+			req_idx, packet, cre_request->num_batch);
+
+	for (i = 0; i < cre_request->num_batch; i++) {
+		for (l = 0; l < cre_request->num_io_bufs[i]; l++) {
+			io_buf = cre_request->io_buf[i][l];
+			if (io_buf->direction == CAM_BUF_INPUT) {
+				if (io_buf->fence != -1) {
+					if (j < CRE_MAX_IN_RES) {
+						sync_in_obj[j++] =
+							io_buf->fence;
+						prep_arg->num_in_map_entries++;
+					} else {
+						CAM_ERR(CAM_CRE,
+						"reached max in_res %d %d",
+						io_buf->resource_type,
+						cre_request->request_id);
+					}
+				} else {
+					CAM_ERR(CAM_CRE, "Invalid fence %d %d",
+						io_buf->resource_type,
+						cre_request->request_id);
+				}
+			} else {
+				if (io_buf->fence != -1) {
+					prep_arg->out_map_entries[k].sync_id =
+						io_buf->fence;
+					k++;
+					prep_arg->num_out_map_entries++;
+				}
+			}
+			CAM_DBG(CAM_CRE,
+				"ctx_id: %u req_id: %llu dir[%d] %u, fence: %d",
+				ctx_data->ctx_id, packet->header.request_id, i,
+				io_buf->direction, io_buf->fence);
+		}
+	}
+
+	if (prep_arg->num_in_map_entries > 1 &&
+		prep_arg->num_in_map_entries <= CRE_MAX_IN_RES)
+		prep_arg->num_in_map_entries =
+			cam_common_util_remove_duplicate_arr(
+			sync_in_obj, prep_arg->num_in_map_entries);
+
+	if (prep_arg->num_in_map_entries > 1 &&
+		prep_arg->num_in_map_entries <= CRE_MAX_IN_RES) {
+		rc = cam_sync_merge(&sync_in_obj[0],
+			prep_arg->num_in_map_entries, &merged_sync_in_obj);
+		if (rc) {
+			prep_arg->num_out_map_entries = 0;
+			prep_arg->num_in_map_entries = 0;
+			return rc;
+		}
+
+		cre_request->in_resource = merged_sync_in_obj;
+
+		prep_arg->in_map_entries[0].sync_id = merged_sync_in_obj;
+		prep_arg->num_in_map_entries = 1;
+		CAM_DBG(CAM_CRE, "ctx_id: %u req_id: %llu Merged Sync obj: %d",
+			ctx_data->ctx_id, packet->header.request_id,
+			merged_sync_in_obj);
+	} else if (prep_arg->num_in_map_entries == 1) {
+		prep_arg->in_map_entries[0].sync_id = sync_in_obj[0];
+		prep_arg->num_in_map_entries = 1;
+		cre_request->in_resource = 0;
+	} else {
+		CAM_ERR(CAM_CRE,
+			"Invalid count of input fences, count: %d",
+			prep_arg->num_in_map_entries);
+		prep_arg->num_in_map_entries = 0;
+		cre_request->in_resource = 0;
+		rc = -EINVAL;
+	}
+end:
+	return rc;
+}
+
+static bool cam_cre_mgr_is_valid_inconfig(struct cam_packet *packet)
+{
+	int i, num_in_map_entries = 0;
+	bool in_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+					packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT)
+			num_in_map_entries++;
+
+	if (num_in_map_entries <= CRE_MAX_IN_RES) {
+		in_config_valid = true;
+	} else {
+		CAM_ERR(CAM_CRE, "In config entries(%u) more than allowed(%u)",
+				num_in_map_entries, CRE_MAX_IN_RES);
+	}
+
+	CAM_DBG(CAM_CRE, "number of in_config info: %u %u %u %u",
+			packet->num_io_configs, CRE_MAX_IO_BUFS,
+			num_in_map_entries, CRE_MAX_IN_RES);
+
+	return in_config_valid;
+}
+
+static bool cam_cre_mgr_is_valid_outconfig(struct cam_packet *packet)
+{
+	int i, num_out_map_entries = 0;
+	bool out_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+					packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+		if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT)
+			num_out_map_entries++;
+
+	if (num_out_map_entries <= CRE_MAX_OUT_RES) {
+		out_config_valid = true;
+	} else {
+		CAM_ERR(CAM_CRE, "Out config entries(%u) more than allowed(%u)",
+				num_out_map_entries, CRE_MAX_OUT_RES);
+	}
+
+	CAM_DBG(CAM_CRE, "number of out_config info: %u %u %u %u",
+			packet->num_io_configs, CRE_MAX_IO_BUFS,
+			num_out_map_entries, CRE_MAX_OUT_RES);
+
+	return out_config_valid;
+}
+
+static int cam_cre_mgr_pkt_validation(struct cam_packet *packet)
+{
+	if ((packet->header.op_code & 0xff) !=
+		CAM_CRE_OPCODE_CONFIG) {
+		CAM_ERR(CAM_CRE, "Invalid Opcode in pkt: %d",
+			packet->header.op_code & 0xff);
+		return -EINVAL;
+	}
+
+	if (!packet->num_io_configs ||
+		packet->num_io_configs > CRE_MAX_IO_BUFS) {
+		CAM_ERR(CAM_CRE, "Invalid number of io configs: %d %d",
+			CRE_MAX_IO_BUFS, packet->num_io_configs);
+		return -EINVAL;
+	}
+
+	if (packet->num_cmd_buf > CRE_PACKET_MAX_CMD_BUFS) {
+		CAM_ERR(CAM_CRE, "Invalid number of cmd buffers: %d %d",
+			CRE_PACKET_MAX_CMD_BUFS, packet->num_cmd_buf);
+		return -EINVAL;
+	}
+
+	if (!cam_cre_mgr_is_valid_inconfig(packet) ||
+		!cam_cre_mgr_is_valid_outconfig(packet)) {
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CRE, "number of cmd/patch info: %u %u %u %u",
+			packet->num_cmd_buf,
+			packet->num_io_configs, CRE_MAX_IO_BUFS,
+			packet->num_patches);
+	return 0;
+}
+
+static int cam_cre_validate_acquire_res_info(
+	struct cam_cre_acquire_dev_info *cre_acquire)
+{
+	int i;
+
+	if (cre_acquire->num_out_res > CRE_MAX_OUT_RES) {
+		CAM_ERR(CAM_CRE, "num of out resources exceeding : %u",
+			cre_acquire->num_out_res);
+		return -EINVAL;
+	}
+
+	if (cre_acquire->num_in_res > CRE_MAX_IN_RES) {
+		CAM_ERR(CAM_CRE, "num of in resources exceeding : %u",
+			cre_acquire->num_in_res);
+		return -EINVAL;
+	}
+
+	if (cre_acquire->dev_type >= CAM_CRE_DEV_TYPE_MAX) {
+		CAM_ERR(CAM_CRE, "Invalid device type: %d",
+			cre_acquire->dev_type);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < cre_acquire->num_in_res; i++) {
+		switch (cre_acquire->in_res[i].format) {
+			case CAM_FORMAT_MIPI_RAW_10:
+			case CAM_FORMAT_MIPI_RAW_12:
+			case CAM_FORMAT_MIPI_RAW_14:
+			case CAM_FORMAT_MIPI_RAW_20:
+			case CAM_FORMAT_PLAIN128:
+				break;
+			default:
+				CAM_ERR(CAM_CRE, "Invalid input format %d",
+					cre_acquire->in_res[i].format);
+				return -EINVAL;
+		}
+
+		if (!cre_acquire->in_res[i].width || !cre_acquire->in_res[i].height) {
+			CAM_ERR(CAM_CRE, "Invalid width %d height %d for in res %d",
+				cre_acquire->in_res[i].width, cre_acquire->in_res[i].height, i);
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < cre_acquire->num_out_res; i++) {
+		switch (cre_acquire->out_res[i].format) {
+			case CAM_FORMAT_PLAIN16_8:
+			case CAM_FORMAT_PLAIN16_10:
+			case CAM_FORMAT_PLAIN16_12:
+			case CAM_FORMAT_PLAIN16_14:
+			case CAM_FORMAT_PLAIN16_16:
+			case CAM_FORMAT_PLAIN32_20:
+			case CAM_FORMAT_PLAIN32:
+			case CAM_FORMAT_PLAIN128:
+				break;
+			default:
+				CAM_ERR(CAM_CRE, "Invalid output format %d",
+					cre_acquire->out_res[i].format);
+				return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cre_get_acquire_info(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_hw_acquire_args *args,
+	struct cam_cre_ctx *ctx)
+{
+	int i = 0;
+
+	if (args->num_acq > CRE_DEV_MAX) {
+		CAM_ERR(CAM_CRE, "Invalid number of resources: %d",
+			args->num_acq);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&ctx->cre_acquire,
+		(void __user *)args->acquire_info,
+		sizeof(struct cam_cre_acquire_dev_info))) {
+		CAM_ERR(CAM_CRE, "Failed in acquire");
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_CRE, "top: %u %s %u %u %u",
+		ctx->cre_acquire.dev_type,
+		ctx->cre_acquire.dev_name,
+		ctx->cre_acquire.secure_mode,
+		ctx->cre_acquire.num_in_res, ctx->cre_acquire.num_out_res);
+
+	for (i = 0; i < ctx->cre_acquire.num_in_res; i++) {
+		CAM_DBG(CAM_CRE, "IN: %u %u %u %u",
+		ctx->cre_acquire.in_res[i].res_id,
+		ctx->cre_acquire.in_res[i].width,
+		ctx->cre_acquire.in_res[i].height,
+		ctx->cre_acquire.in_res[i].format);
+	}
+
+	for (i = 0; i < ctx->cre_acquire.num_out_res; i++) {
+		CAM_DBG(CAM_CRE, "OUT: %u %u %u %u",
+		ctx->cre_acquire.out_res[i].res_id,
+		ctx->cre_acquire.out_res[i].width,
+		ctx->cre_acquire.out_res[i].height,
+		ctx->cre_acquire.out_res[i].format);
+	}
+
+	if (cam_cre_validate_acquire_res_info(&ctx->cre_acquire))
+		return -EINVAL;
+
+	return 0;
+}
+
+static int cam_cre_get_free_ctx(struct cam_cre_hw_mgr *hw_mgr)
+{
+	int i;
+
+	i = find_first_zero_bit(hw_mgr->ctx_bitmap, hw_mgr->ctx_bits);
+	if (i >= CRE_CTX_MAX || i < 0) {
+		CAM_ERR(CAM_CRE, "Invalid ctx id = %d", i);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx[i].ctx_mutex);
+	if (hw_mgr->ctx[i].ctx_state != CRE_CTX_STATE_FREE) {
+		CAM_ERR(CAM_CRE, "Invalid ctx %d state %d",
+			i, hw_mgr->ctx[i].ctx_state);
+		mutex_unlock(&hw_mgr->ctx[i].ctx_mutex);
+		return -EINVAL;
+	}
+	set_bit(i, hw_mgr->ctx_bitmap);
+	mutex_unlock(&hw_mgr->ctx[i].ctx_mutex);
+
+	return i;
+}
+
+
+static int cam_cre_put_free_ctx(struct cam_cre_hw_mgr *hw_mgr, uint32_t ctx_id)
+{
+	if (ctx_id >= CRE_CTX_MAX) {
+		CAM_ERR(CAM_CRE, "Invalid ctx_id: %d", ctx_id);
+		return 0;
+	}
+
+	hw_mgr->ctx[ctx_id].ctx_state = CRE_CTX_STATE_FREE;
+	clear_bit(ctx_id, hw_mgr->ctx_bitmap);
+
+	return 0;
+}
+
+static int cam_cre_mgr_get_hw_caps(void *hw_priv, void *hw_caps_args)
+{
+	struct cam_cre_hw_mgr *hw_mgr;
+	struct cam_query_cap_cmd *query_cap = hw_caps_args;
+	struct cam_cre_hw_ver hw_ver;
+	int rc = 0, i;
+
+	if (!hw_priv || !hw_caps_args) {
+		CAM_ERR(CAM_CRE, "Invalid args: %x %x", hw_priv, hw_caps_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_cre_query_cap_cmd) != query_cap->size) {
+		CAM_ERR(CAM_CRE,
+			"Input query cap size:%u does not match expected query cap size: %u",
+			query_cap->size, sizeof(struct cam_cre_query_cap_cmd));
+		return -EFAULT;
+	}
+
+	hw_mgr = hw_priv;
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (copy_from_user(&hw_mgr->cre_caps,
+		u64_to_user_ptr(query_cap->caps_handle),
+		sizeof(struct cam_cre_query_cap_cmd))) {
+		CAM_ERR(CAM_CRE, "copy_from_user failed: size = %d",
+			sizeof(struct cam_cre_query_cap_cmd));
+		rc = -EFAULT;
+		goto end;
+	}
+
+	for (i = 0; i < hw_mgr->num_cre; i++) {
+		rc = hw_mgr->cre_dev_intf[i]->hw_ops.get_hw_caps(
+			hw_mgr->cre_dev_intf[i]->hw_priv,
+			&hw_ver, sizeof(hw_ver));
+		if (rc)
+			goto end;
+
+		hw_mgr->cre_caps.dev_ver[i] = hw_ver;
+	}
+
+	hw_mgr->cre_caps.dev_iommu_handle.non_secure = hw_mgr->iommu_hdl;
+	hw_mgr->cre_caps.dev_iommu_handle.secure = hw_mgr->iommu_sec_hdl;
+
+	CAM_DBG(CAM_CRE, "iommu sec %d iommu ns %d",
+		hw_mgr->cre_caps.dev_iommu_handle.secure,
+		hw_mgr->cre_caps.dev_iommu_handle.non_secure);
+
+	if (copy_to_user(u64_to_user_ptr(query_cap->caps_handle),
+		&hw_mgr->cre_caps, sizeof(struct cam_cre_query_cap_cmd))) {
+		CAM_ERR(CAM_CRE, "copy_to_user failed: size = %d",
+			sizeof(struct cam_cre_query_cap_cmd));
+		rc = -EFAULT;
+	}
+
+end:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_cre_mgr_acquire_hw(void *hw_priv, void *hw_acquire_args)
+{
+	int rc = 0, i;
+	int ctx_id;
+	struct cam_cre_hw_mgr *hw_mgr = hw_priv;
+	struct cam_cre_ctx *ctx;
+	struct cam_hw_acquire_args *args = hw_acquire_args;
+	struct cam_cre_dev_acquire cre_dev_acquire;
+	struct cam_cre_dev_release cre_dev_release;
+	struct cam_cre_dev_init init;
+	struct cam_cre_dev_clk_update clk_update;
+	struct cam_cre_dev_bw_update *bw_update;
+	struct cam_cre_set_irq_cb irq_cb;
+	struct cam_hw_info *dev = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	int32_t idx;
+
+	if ((!hw_priv) || (!hw_acquire_args)) {
+		CAM_ERR(CAM_CRE, "Invalid args: %x %x",
+			hw_priv, hw_acquire_args);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	ctx_id = cam_cre_get_free_ctx(hw_mgr);
+	if (ctx_id < 0) {
+		CAM_ERR(CAM_CRE, "No free ctx");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return ctx_id;
+	}
+
+	ctx = &hw_mgr->ctx[ctx_id];
+	ctx->ctx_id = ctx_id;
+	mutex_lock(&ctx->ctx_mutex);
+	rc = cam_cre_get_acquire_info(hw_mgr, args, ctx);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRE, "get_acquire info failed: %d", rc);
+		goto end;
+	}
+
+	if (!hw_mgr->cre_ctx_cnt) {
+		for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+			rc = hw_mgr->cre_dev_intf[i]->hw_ops.init(
+				hw_mgr->cre_dev_intf[i]->hw_priv, &init,
+				sizeof(init));
+			if (rc) {
+				CAM_ERR(CAM_CRE, "CRE Dev init failed: %d", rc);
+				goto end;
+			}
+		}
+
+		/* Install IRQ CB */
+		irq_cb.cre_hw_mgr_cb = cam_cre_hw_mgr_cb;
+		irq_cb.data = hw_mgr;
+		for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+			rc = hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+				hw_mgr->cre_dev_intf[i]->hw_priv,
+				CRE_HW_SET_IRQ_CB,
+				&irq_cb, sizeof(irq_cb));
+			if (rc) {
+				CAM_ERR(CAM_CRE, "CRE Dev init failed: %d", rc);
+				goto cre_irq_set_failed;
+			}
+		}
+
+		dev = (struct cam_hw_info *)hw_mgr->cre_dev_intf[0]->hw_priv;
+		soc_info = &dev->soc_info;
+		idx = soc_info->src_clk_idx;
+
+		hw_mgr->clk_info.base_clk =
+			soc_info->clk_rate[CAM_TURBO_VOTE][idx];
+		hw_mgr->clk_info.threshold = 5;
+		hw_mgr->clk_info.over_clked = 0;
+
+		for (i = 0; i < CAM_CRE_MAX_PER_PATH_VOTES; i++) {
+			hw_mgr->clk_info.axi_path[i].camnoc_bw = 0;
+			hw_mgr->clk_info.axi_path[i].mnoc_ab_bw = 0;
+			hw_mgr->clk_info.axi_path[i].mnoc_ib_bw = 0;
+		}
+	}
+
+	cre_dev_acquire.ctx_id = ctx_id;
+	cre_dev_acquire.cre_acquire = &ctx->cre_acquire;
+
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		rc = hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv, CRE_HW_ACQUIRE,
+			&cre_dev_acquire, sizeof(cre_dev_acquire));
+		if (rc) {
+			CAM_ERR(CAM_CRE, "CRE Dev acquire failed: %d", rc);
+			goto cre_dev_acquire_failed;
+		}
+	}
+
+	ctx->cre_top = cre_dev_acquire.cre_top;
+
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		dev = (struct cam_hw_info *)hw_mgr->cre_dev_intf[i]->hw_priv;
+		soc_info = &dev->soc_info;
+		idx = soc_info->src_clk_idx;
+		clk_update.clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][idx];
+		hw_mgr->clk_info.curr_clk =
+			soc_info->clk_rate[CAM_TURBO_VOTE][idx];
+
+		rc = hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv, CRE_HW_CLK_UPDATE,
+			&clk_update, sizeof(clk_update));
+		if (rc) {
+			CAM_ERR(CAM_CRE, "CRE Dev clk update failed: %d", rc);
+			goto cre_clk_update_failed;
+		}
+	}
+
+	bw_update = kzalloc(sizeof(struct cam_cre_dev_bw_update), GFP_KERNEL);
+	if (!bw_update) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		goto cre_clk_update_failed;
+	}
+	bw_update->ahb_vote_valid = false;
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		bw_update->axi_vote.num_paths = 1;
+		bw_update->axi_vote_valid = true;
+		bw_update->axi_vote.axi_path[0].camnoc_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].mnoc_ab_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].mnoc_ib_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].transac_type =
+			CAM_AXI_TRANSACTION_WRITE;
+		bw_update->axi_vote.axi_path[0].path_data_type =
+			CAM_AXI_PATH_DATA_ALL;
+		rc = hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv, CRE_HW_BW_UPDATE,
+			bw_update, sizeof(*bw_update));
+		if (rc) {
+			CAM_ERR(CAM_CRE, "CRE Dev clk update failed: %d", rc);
+			goto free_bw_update;
+		}
+	}
+
+	cam_cre_device_timer_start(hw_mgr);
+	hw_mgr->cre_ctx_cnt++;
+	ctx->context_priv = args->context_data;
+	args->ctxt_to_hw_map = ctx;
+	ctx->ctxt_event_cb = args->event_cb;
+	cam_cre_ctx_clk_info_init(ctx);
+	ctx->ctx_state = CRE_CTX_STATE_ACQUIRED;
+	cam_free_clear(bw_update);
+	bw_update = NULL;
+
+	mutex_unlock(&ctx->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_INFO(CAM_CRE, "CRE: %d acquire succesfull rc %d", ctx_id, rc);
+	return rc;
+
+free_bw_update:
+	cam_free_clear(bw_update);
+	bw_update = NULL;
+cre_clk_update_failed:
+	cre_dev_release.ctx_id = ctx_id;
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		if (hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv, CRE_HW_RELEASE,
+			&cre_dev_release, sizeof(cre_dev_release)))
+			CAM_ERR(CAM_CRE, "CRE Dev release failed");
+	}
+cre_dev_acquire_failed:
+	if (!hw_mgr->cre_ctx_cnt) {
+		irq_cb.cre_hw_mgr_cb = NULL;
+		irq_cb.data = hw_mgr;
+		for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+			if (hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+				hw_mgr->cre_dev_intf[i]->hw_priv,
+				CRE_HW_SET_IRQ_CB,
+				&irq_cb, sizeof(irq_cb)))
+				CAM_ERR(CAM_CRE,
+					"CRE IRQ de register failed");
+		}
+	}
+cre_irq_set_failed:
+	if (!hw_mgr->cre_ctx_cnt) {
+		for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+			if (hw_mgr->cre_dev_intf[i]->hw_ops.deinit(
+				hw_mgr->cre_dev_intf[i]->hw_priv, NULL, 0))
+				CAM_ERR(CAM_CRE, "CRE deinit fail");
+		}
+	}
+end:
+	args->ctxt_to_hw_map = NULL;
+	cam_cre_put_free_ctx(hw_mgr, ctx_id);
+	mutex_unlock(&ctx->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_cre_mgr_release_ctx(struct cam_cre_hw_mgr *hw_mgr, int ctx_id)
+{
+	int i = 0, rc = 0;
+	struct cam_cre_dev_release cre_dev_release;
+
+	if (ctx_id >= CRE_CTX_MAX) {
+		CAM_ERR(CAM_CRE, "ctx_id is wrong: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+	if (hw_mgr->ctx[ctx_id].ctx_state !=
+		CRE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+		CAM_DBG(CAM_CRE, "ctx id: %d not in right state: %d",
+			ctx_id, hw_mgr->ctx[ctx_id].ctx_state);
+		return 0;
+	}
+
+	hw_mgr->ctx[ctx_id].ctx_state = CRE_CTX_STATE_RELEASE;
+
+	for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+		cre_dev_release.ctx_id = ctx_id;
+		rc = hw_mgr->cre_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->cre_dev_intf[i]->hw_priv, CRE_HW_RELEASE,
+			&cre_dev_release, sizeof(cre_dev_release));
+		if (rc)
+			CAM_ERR(CAM_CRE, "CRE Dev release failed: %d", rc);
+	}
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		if (!hw_mgr->ctx[ctx_id].req_list[i])
+			continue;
+		cam_cre_free_io_config(hw_mgr->ctx[ctx_id].req_list[i]);
+		cam_free_clear(hw_mgr->ctx[ctx_id].req_list[i]);
+		hw_mgr->ctx[ctx_id].req_list[i] = NULL;
+		clear_bit(i, hw_mgr->ctx[ctx_id].bitmap);
+	}
+
+	hw_mgr->ctx[ctx_id].req_cnt = 0;
+	hw_mgr->ctx[ctx_id].last_flush_req = 0;
+	hw_mgr->ctx[ctx_id].last_req_idx = 0;
+	hw_mgr->ctx[ctx_id].last_done_req_idx = 0;
+	cam_cre_put_free_ctx(hw_mgr, ctx_id);
+
+	rc = cam_cre_mgr_cre_clk_remove(hw_mgr, ctx_id);
+	if (rc)
+		CAM_ERR(CAM_CRE, "CRE clk update failed: %d", rc);
+
+	hw_mgr->cre_ctx_cnt--;
+	mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+	CAM_DBG(CAM_CRE, "X: ctx_id = %d", ctx_id);
+
+	return 0;
+}
+
+static int cam_cre_mgr_release_hw(void *hw_priv, void *hw_release_args)
+{
+	int i, rc = 0;
+	int ctx_id = 0;
+	struct cam_hw_release_args *release_hw = hw_release_args;
+	struct cam_cre_hw_mgr *hw_mgr = hw_priv;
+	struct cam_cre_ctx *ctx_data = NULL;
+	struct cam_cre_set_irq_cb irq_cb;
+	struct cam_hw_intf *dev_intf;
+
+	if (!release_hw || !hw_mgr) {
+		CAM_ERR(CAM_CRE, "Invalid args: %pK %pK", release_hw, hw_mgr);
+		return -EINVAL;
+	}
+
+	ctx_data = release_hw->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_CRE, "NULL ctx data");
+		return -EINVAL;
+	}
+
+	ctx_id = ctx_data->ctx_id;
+	if (ctx_id < 0 || ctx_id >= CRE_CTX_MAX) {
+		CAM_ERR(CAM_CRE, "Invalid ctx id: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+	if (hw_mgr->ctx[ctx_id].ctx_state != CRE_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_CRE, "ctx is not in use: %d", ctx_id);
+		mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	rc = cam_cre_mgr_release_ctx(hw_mgr, ctx_id);
+	if (!hw_mgr->cre_ctx_cnt) {
+		CAM_DBG(CAM_CRE, "Last Release #of CRE %d", cre_hw_mgr->num_cre);
+		for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+			dev_intf = hw_mgr->cre_dev_intf[i];
+			irq_cb.cre_hw_mgr_cb = NULL;
+			irq_cb.data = NULL;
+			rc = dev_intf->hw_ops.process_cmd(
+				hw_mgr->cre_dev_intf[i]->hw_priv,
+				CRE_HW_SET_IRQ_CB,
+				&irq_cb, sizeof(irq_cb));
+			if (rc)
+				CAM_ERR(CAM_CRE, "IRQ dereg failed: %d", rc);
+		}
+		for (i = 0; i < cre_hw_mgr->num_cre; i++) {
+			dev_intf = hw_mgr->cre_dev_intf[i];
+			rc = dev_intf->hw_ops.deinit(
+				hw_mgr->cre_dev_intf[i]->hw_priv,
+				NULL, 0);
+			if (rc)
+				CAM_ERR(CAM_CRE, "deinit failed: %d", rc);
+		}
+		cam_cre_device_timer_stop(hw_mgr);
+	}
+
+	rc = cam_cre_mgr_remove_bw(hw_mgr, ctx_id);
+	if (rc)
+		CAM_ERR(CAM_CRE, "CRE remove bw failed: %d", rc);
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_CRE, "Release done for ctx_id %d", ctx_id);
+	return rc;
+}
+
+static int cam_cre_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	struct cam_cre_clk_bw_request *clk_info;
+	struct cam_cre_clk_bw_req_internal_v2 *clk_info_v2;
+	struct cre_clk_bw_request_v2 *soc_req;
+
+	struct cre_cmd_generic_blob *blob;
+	struct cam_cre_ctx *ctx_data;
+	uint32_t index;
+	size_t clk_update_size = 0;
+	int rc = 0, i;
+
+	if (!blob_data || (blob_size == 0)) {
+		CAM_ERR(CAM_CRE, "Invalid blob info %pK %d", blob_data,
+		blob_size);
+		return -EINVAL;
+	}
+
+	blob = (struct cre_cmd_generic_blob *)user_data;
+	ctx_data = blob->ctx;
+	index = blob->req_idx;
+
+	switch (blob_type) {
+	case CAM_CRE_CMD_GENERIC_BLOB_CLK_V2:
+		if (blob_size < sizeof(struct cre_clk_bw_request_v2)) {
+			CAM_ERR(CAM_CRE, "Mismatch blob size %d expected %lu",
+				blob_size,
+				sizeof(struct cre_clk_bw_request_v2));
+			return -EINVAL;
+		}
+
+		soc_req = (struct cre_clk_bw_request_v2 *)blob_data;
+		if (soc_req->num_paths > CAM_CRE_MAX_PER_PATH_VOTES) {
+			CAM_ERR(CAM_CRE, "Invalid num paths: %d",
+				soc_req->num_paths);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (soc_req->num_paths != 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote) >
+				((UINT_MAX -
+				sizeof(struct cre_clk_bw_request_v2)) /
+				(soc_req->num_paths - 1))) {
+				CAM_ERR(CAM_CRE,
+					"Size exceeds limit paths:%u size per path:%lu",
+					soc_req->num_paths - 1,
+					sizeof(
+					struct cam_axi_per_path_bw_vote));
+			return -EINVAL;
+			}
+		}
+
+		clk_update_size = sizeof(struct cre_clk_bw_request_v2) +
+			((soc_req->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote));
+		if (blob_size < clk_update_size) {
+			CAM_ERR(CAM_CRE, "Invalid blob size: %u",
+				blob_size);
+			return -EINVAL;
+		}
+
+		clk_info = &ctx_data->req_list[index]->clk_info;
+		clk_info_v2 = &ctx_data->req_list[index]->clk_info_v2;
+		clk_info_v2->budget_ns = soc_req->budget_ns;
+		clk_info_v2->frame_cycles = soc_req->frame_cycles;
+		clk_info_v2->rt_flag = soc_req->rt_flag;
+		clk_info_v2->num_paths = soc_req->num_paths;
+
+		for (i = 0; i < soc_req->num_paths; i++) {
+			clk_info_v2->axi_path[i].usage_data = soc_req->axi_path_flex[i].usage_data;
+			clk_info_v2->axi_path[i].transac_type = soc_req->axi_path_flex[i].transac_type;
+			clk_info_v2->axi_path[i].path_data_type =
+				soc_req->axi_path_flex[i].path_data_type;
+			clk_info_v2->axi_path[i].vote_level = 0;
+			clk_info_v2->axi_path[i].camnoc_bw = soc_req->axi_path_flex[i].camnoc_bw;
+			clk_info_v2->axi_path[i].mnoc_ab_bw = soc_req->axi_path_flex[i].mnoc_ab_bw;
+			clk_info_v2->axi_path[i].mnoc_ib_bw = soc_req->axi_path_flex[i].mnoc_ib_bw;
+		}
+
+		/* Use v1 structure for clk fields */
+		clk_info->budget_ns = clk_info_v2->budget_ns;
+		clk_info->frame_cycles = clk_info_v2->frame_cycles;
+		clk_info->rt_flag = clk_info_v2->rt_flag;
+
+		CAM_DBG(CAM_CRE, "budget=%llu, frame_cycle=%llu, rt_flag=%d",
+			clk_info_v2->budget_ns, clk_info_v2->frame_cycles,
+			clk_info_v2->rt_flag);
+		break;
+
+	default:
+		CAM_WARN(CAM_CRE, "Invalid blob type %d", blob_type);
+		break;
+	}
+	return rc;
+}
+
+static int cam_cre_process_generic_cmd_buffer(
+	struct cam_packet *packet,
+	struct cam_cre_ctx *ctx_data,
+	int32_t index,
+	uint64_t *io_buf_addr)
+{
+	int i, rc = 0;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct cre_cmd_generic_blob cmd_generic_blob;
+
+	cmd_generic_blob.ctx = ctx_data;
+	cmd_generic_blob.req_idx = index;
+	cmd_generic_blob.io_buf_addr = io_buf_addr;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data != CAM_CRE_CMD_META_GENERIC_BLOB)
+			continue;
+
+		rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+				cam_cre_packet_generic_blob_handler, &cmd_generic_blob);
+		if (rc)
+			CAM_ERR(CAM_CRE, "Failed in processing blobs %d", rc);
+	}
+
+	return rc;
+}
+
+static int cam_cre_mgr_prepare_hw_update(void *hw_priv,
+	void *hw_prepare_update_args)
+{
+	int rc = 0;
+	struct cam_packet *packet = NULL;
+	struct cam_cre_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_prepare_update_args *prepare_args =
+		hw_prepare_update_args;
+	struct cam_cre_ctx *ctx_data = NULL;
+	uint32_t request_idx = 0;
+	struct cam_cre_request *cre_req;
+	struct timespec64 ts;
+
+	if ((!prepare_args) || (!hw_mgr) || (!prepare_args->packet)) {
+		CAM_ERR(CAM_CRE, "Invalid args: %x %x",
+			prepare_args, hw_mgr);
+		return -EINVAL;
+	}
+
+	ctx_data = prepare_args->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_CRE, "Invalid Context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->ctx_state != CRE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_CRE, "ctx id %u is not acquired state: %d",
+			ctx_data->ctx_id, ctx_data->ctx_state);
+		return -EINVAL;
+	}
+
+	packet = prepare_args->packet;
+	rc = cam_packet_util_validate_packet(packet, prepare_args->remain_len);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_CRE,
+			"packet validation failed: %d req_id: %d ctx: %d",
+			rc, packet->header.request_id, ctx_data->ctx_id);
+		return rc;
+	}
+
+	rc = cam_cre_mgr_pkt_validation(packet);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_CRE,
+			"cre packet validation failed: %d req_id: %d ctx: %d",
+			rc, packet->header.request_id, ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	rc = cam_packet_util_process_patches(packet, prepare_args->buf_tracker,
+			hw_mgr->iommu_hdl, hw_mgr->iommu_sec_hdl, true);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_CRE, "Patch processing failed %d", rc);
+		return rc;
+	}
+
+	request_idx  = find_next_zero_bit(ctx_data->bitmap,
+			ctx_data->bits, ctx_data->last_req_idx);
+	if (request_idx >= CAM_CTX_REQ_MAX || request_idx < 0) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_CRE, "Invalid ctx req slot = %d", request_idx);
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_CRE, "req_idx %d last_req_idx %d bitmap size in bits %d",
+		request_idx, ctx_data->last_req_idx, ctx_data->bits);
+	ctx_data->last_req_idx = request_idx;
+
+	ctx_data->req_list[request_idx] =
+		kzalloc(sizeof(struct cam_cre_request), GFP_KERNEL);
+	if (!ctx_data->req_list[request_idx]) {
+		CAM_ERR(CAM_CRE, "mem allocation failed ctx:%d req_idx:%d",
+			ctx_data->ctx_id, request_idx);
+		rc = -ENOMEM;
+		goto req_mem_alloc_failed;
+	}
+	memset(ctx_data->req_list[request_idx], 0,
+			sizeof(struct cam_cre_request));
+
+	cre_req = ctx_data->req_list[request_idx];
+	cre_req->request_id = packet->header.request_id;
+	cre_req->frames_done = 0;
+	cre_req->req_idx = request_idx;
+
+	rc = cam_cre_mgr_process_io_cfg(hw_mgr, packet, ctx_data,
+			request_idx, prepare_args);
+	if (rc) {
+		CAM_ERR(CAM_CRE,
+			"IO cfg processing failed: %d ctx: %d req_id:%d",
+			rc, ctx_data->ctx_id, packet->header.request_id);
+		goto end;
+	}
+
+	rc = cam_cre_mgr_create_cre_reg_buf(hw_mgr, packet, prepare_args,
+		ctx_data, request_idx);
+	if (rc) {
+		CAM_ERR(CAM_CRE,
+			"create kmd buf failed: %d ctx: %d request_id:%d",
+			rc, ctx_data->ctx_id, packet->header.request_id);
+		goto end;
+	}
+
+	rc = cam_cre_process_generic_cmd_buffer(packet, ctx_data,
+		request_idx, NULL);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "Failed: %d ctx: %d req_id: %d req_idx: %d",
+			rc, ctx_data->ctx_id, packet->header.request_id,
+			request_idx);
+		goto end;
+	}
+
+	prepare_args->num_hw_update_entries = 1;
+	prepare_args->priv = ctx_data->req_list[request_idx];
+	ktime_get_boottime_ts64(&ts);
+	ctx_data->last_req_time = (uint64_t)((ts.tv_sec * 1000000000) +
+		ts.tv_nsec);
+	CAM_DBG(CAM_REQ, "req_id= %llu ctx_id= %d lrt=%llu",
+		packet->header.request_id, ctx_data->ctx_id,
+		ctx_data->last_req_time);
+	set_bit(request_idx, ctx_data->bitmap);
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	CAM_DBG(CAM_REQ, "Prepare Hw update Successful request_id: %d  ctx: %d",
+		packet->header.request_id, ctx_data->ctx_id);
+	return rc;
+
+end:
+	cam_free_clear((void *)ctx_data->req_list[request_idx]);
+	ctx_data->req_list[request_idx] = NULL;
+req_mem_alloc_failed:
+	clear_bit(request_idx, ctx_data->bitmap);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return rc;
+}
+
+static int cam_cre_mgr_enqueue_config(struct cam_cre_hw_mgr *hw_mgr,
+	struct cam_cre_ctx *ctx_data,
+	struct cam_hw_config_args *config_args)
+{
+	int rc = 0;
+	uint64_t request_id = 0;
+	struct crm_workq_task *task;
+	struct cre_cmd_work_data *task_data;
+	struct cam_hw_update_entry *hw_update_entries;
+	struct cam_cre_request *cre_req = NULL;
+
+	cre_req = config_args->priv;
+	request_id = config_args->request_id;
+	hw_update_entries = config_args->hw_update_entries;
+
+	CAM_DBG(CAM_CRE, "Ctx %d req_id = %lld %pK", ctx_data->ctx_id,
+		request_id, config_args->priv);
+
+	task = cam_req_mgr_workq_get_task(cre_hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_CRE, "no empty task");
+		return -ENOMEM;
+	}
+
+	task_data = (struct cre_cmd_work_data *)task->payload;
+	task_data->data = (void *)hw_mgr;
+	task_data->req_idx = cre_req->req_idx;
+	task_data->request_id = cre_req->request_id;
+	task_data->type = CRE_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_cre_mgr_process_cmd;
+
+	if (ctx_data->cre_acquire.dev_type == CAM_CRE_DEV_TYPE_RT)
+		rc = cam_req_mgr_workq_enqueue_task(task, ctx_data,
+			CRM_TASK_PRIORITY_0);
+	else
+		rc = cam_req_mgr_workq_enqueue_task(task, ctx_data,
+			CRM_TASK_PRIORITY_1);
+
+	return rc;
+}
+
+static int cam_cre_mgr_config_hw(void *hw_priv, void *hw_config_args)
+{
+	int rc = 0;
+	struct cam_cre_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_config_args *config_args = hw_config_args;
+	struct cam_cre_ctx *ctx_data = NULL;
+	struct cam_cre_request *cre_req = NULL;
+	struct cam_cre_hw_cfg_req  *cfg_req = NULL;
+
+	if (!hw_mgr || !config_args) {
+		CAM_ERR(CAM_CRE, "Invalid arguments %pK %pK",
+			hw_mgr, config_args);
+		return -EINVAL;
+	}
+
+	if (!config_args->num_hw_update_entries) {
+		CAM_ERR(CAM_CRE, "No hw update enteries are available");
+		return -EINVAL;
+	}
+
+	ctx_data = config_args->ctxt_to_hw_map;
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->ctx_state != CRE_CTX_STATE_ACQUIRED) {
+		CAM_ERR(CAM_CRE, "ctx id :%u is not in use",
+			ctx_data->ctx_id);
+		rc= -EINVAL;
+		goto end;
+	}
+
+	if (list_empty(&hw_mgr->free_req_list)) {
+		CAM_ERR(CAM_CRE, "No request in free list");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	cfg_req = list_first_entry(&hw_mgr->free_req_list,
+		struct cam_cre_hw_cfg_req, list);
+	list_del_init(&cfg_req->list);
+
+	cre_req = config_args->priv;
+
+	cam_cre_mgr_cre_clk_update(hw_mgr, ctx_data, cre_req->req_idx);
+	ctx_data->req_list[cre_req->req_idx]->submit_timestamp = ktime_get();
+
+	CAM_DBG(CAM_CRE, "ctx id :%u req id %lld", ctx_data->ctx_id, cre_req->request_id);
+
+	cfg_req->req_id = cre_req->request_id;
+	cfg_req->ctx_id = ctx_data->ctx_id;
+
+	if (cre_req->request_id <= ctx_data->last_flush_req) {
+		CAM_WARN(CAM_CRE,
+			"Anomaly submitting flushed req %llu [last_flush %llu] in ctx %u",
+			cre_req->request_id, ctx_data->last_flush_req,
+			ctx_data->ctx_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	list_add_tail(&cfg_req->list, &hw_mgr->hw_config_req_list);
+
+	rc = cam_cre_mgr_enqueue_config(hw_mgr, ctx_data, config_args);
+	if (rc)
+		goto config_err;
+
+	CAM_DBG(CAM_REQ, "req_id %llu, ctx_id %u io config",
+		cre_req->request_id, ctx_data->ctx_id);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+config_err:
+	cam_cre_mgr_handle_config_err(config_args, ctx_data);
+end:
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static void cam_cre_mgr_dump_pf_data(struct cam_cre_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_pf_args *pf_cmd_args)
+{
+	int rc = 0;
+	struct cam_packet          *packet;
+	struct cam_hw_dump_pf_args *pf_args;
+	size_t                      len;
+	uintptr_t                   packet_addr;
+
+	pf_args = pf_cmd_args->pf_args;
+
+	rc = cam_mem_get_cpu_buf(pf_cmd_args->pf_req_info->packet_handle, &packet_addr, &len);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "Fail to get packet address from handle: %llu",
+			pf_cmd_args->pf_req_info->packet_handle);
+		return;
+	}
+	packet = (struct cam_packet *)((uint8_t *)packet_addr +
+		(uint32_t)pf_cmd_args->pf_req_info->packet_offset);
+
+	cam_packet_util_dump_io_bufs(packet, hw_mgr->iommu_hdl,
+		hw_mgr->iommu_sec_hdl, pf_args, false);
+
+	cam_packet_util_dump_patch_info(packet, hw_mgr->iommu_hdl,
+		hw_mgr->iommu_sec_hdl, pf_args);
+
+	cam_mem_put_cpu_buf(pf_cmd_args->pf_req_info->packet_handle);
+}
+
+static int cam_cre_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_cre_hw_mgr  *hw_mgr = hw_mgr_priv;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_CRE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_cre_mgr_dump_pf_data(hw_mgr, hw_cmd_args->u.pf_cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_CRE, "Invalid cmd");
+	}
+
+	return rc;
+}
+
+static int cam_cre_mgr_flush_req(struct cam_cre_ctx *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	int idx;
+	int64_t request_id;
+	uint32_t evt_id;
+	struct cam_hw_done_event_data buf_data;
+
+	request_id = *(int64_t *)flush_args->flush_req_pending[0];
+	for (idx = 0; idx < CAM_CTX_REQ_MAX; idx++) {
+		if (!ctx_data->req_list[idx])
+			continue;
+
+		if (ctx_data->req_list[idx]->request_id != request_id)
+			continue;
+
+		evt_id = CAM_CTX_EVT_ID_ERROR;
+		buf_data.evt_param = CAM_SYNC_CRE_EVENT_HW_ERR;
+		buf_data.request_id = ctx_data->req_list[idx]->request_id;
+		ctx_data->ctxt_event_cb(ctx_data->context_priv, evt_id, &buf_data);
+		ctx_data->req_list[idx]->request_id = 0;
+		cam_cre_free_io_config(ctx_data->req_list[idx]);
+		cam_free_clear(ctx_data->req_list[idx]);
+		ctx_data->req_list[idx] = NULL;
+		clear_bit(idx, ctx_data->bitmap);
+	}
+
+	return 0;
+}
+
+static int cam_cre_mgr_flush_all(struct cam_cre_ctx *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	int i, rc;
+	uint32_t evt_id;
+	struct cam_hw_done_event_data buf_data;
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	rc = cam_cre_mgr_reset_hw();
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		if (!ctx_data->req_list[i])
+			continue;
+
+		evt_id = CAM_CTX_EVT_ID_ERROR;
+		buf_data.evt_param = CAM_SYNC_CRE_EVENT_HW_ERR;
+		buf_data.request_id = ctx_data->req_list[i]->request_id;
+		ctx_data->ctxt_event_cb(ctx_data->context_priv, evt_id, &buf_data);
+		ctx_data->req_list[i]->request_id = 0;
+		cam_cre_free_io_config(ctx_data->req_list[i]);
+		cam_free_clear(ctx_data->req_list[i]);
+		ctx_data->req_list[i] = NULL;
+		clear_bit(i, ctx_data->bitmap);
+	}
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return rc;
+}
+
+static int cam_cre_mgr_hw_dump(void *hw_priv, void *hw_dump_args)
+{
+	struct cam_cre_ctx *ctx_data;
+	struct cam_cre_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_dump_args  *dump_args;
+	int idx;
+	ktime_t cur_time;
+	struct timespec64 cur_ts, req_ts;
+	uint64_t diff;
+
+	if ((!hw_priv) || (!hw_dump_args)) {
+		CAM_ERR(CAM_CRE, "Invalid params %pK %pK",
+			hw_priv, hw_dump_args);
+		return -EINVAL;
+	}
+
+	dump_args = (struct cam_hw_dump_args *)hw_dump_args;
+	ctx_data = dump_args->ctxt_to_hw_map;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_CRE, "Invalid context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	mutex_lock(&ctx_data->ctx_mutex);
+
+	CAM_INFO(CAM_CRE, "Req %lld", dump_args->request_id);
+	for (idx = 0; idx < CAM_CTX_REQ_MAX; idx++) {
+		if (!ctx_data->req_list[idx])
+			continue;
+
+		if (ctx_data->req_list[idx]->request_id ==
+			dump_args->request_id)
+			break;
+	}
+
+	/* no matching request found */
+	if (idx == CAM_CTX_REQ_MAX) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return 0;
+	}
+
+	cur_time = ktime_get();
+	diff = ktime_us_delta(cur_time,
+			ctx_data->req_list[idx]->submit_timestamp);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(ctx_data->req_list[idx]->submit_timestamp);
+
+	if (diff < (CRE_REQUEST_TIMEOUT * 1000)) {
+		CAM_INFO(CAM_CRE,
+			"No Error req %llu req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return 0;
+	}
+
+	CAM_ERR(CAM_CRE, "Error req %llu req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return 0;
+}
+
+static int cam_cre_mgr_hw_flush(void *hw_priv, void *hw_flush_args)
+{
+	struct cam_hw_flush_args *flush_args = hw_flush_args;
+	struct cam_cre_ctx *ctx_data;
+	struct cam_cre_hw_mgr *hw_mgr = cre_hw_mgr;
+
+	if ((!hw_priv) || (!hw_flush_args)) {
+		CAM_ERR(CAM_CRE, "Input params are Null");
+		return -EINVAL;
+	}
+
+	ctx_data = flush_args->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_CRE, "Ctx data is NULL");
+		return -EINVAL;
+	}
+
+	if ((flush_args->flush_type >= CAM_FLUSH_TYPE_MAX) ||
+		(flush_args->flush_type < CAM_FLUSH_TYPE_REQ)) {
+		CAM_ERR(CAM_CRE, "Invalid flush type: %d",
+			flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_ALL:
+		mutex_lock(&hw_mgr->hw_mgr_mutex);
+		ctx_data->last_flush_req = flush_args->last_flush_req;
+
+		CAM_DBG(CAM_REQ, "ctx_id %d Flush type %d last_flush_req %u",
+				ctx_data->ctx_id, flush_args->flush_type,
+				ctx_data->last_flush_req);
+
+		cam_cre_mgr_flush_all(ctx_data, flush_args);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		break;
+	case CAM_FLUSH_TYPE_REQ:
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (flush_args->num_req_active) {
+			CAM_ERR(CAM_CRE, "Flush request is not supported");
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return -EINVAL;
+		}
+		if (flush_args->num_req_pending)
+			cam_cre_mgr_flush_req(ctx_data, flush_args);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		break;
+	default:
+		CAM_ERR(CAM_CRE, "Invalid flush type: %d",
+				flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_cre_mgr_alloc_devs(struct device_node *of_node)
+{
+	int rc;
+	uint32_t num_dev;
+
+	rc = of_property_read_u32(of_node, "num-cre", &num_dev);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "getting num of cre failed: %d", rc);
+		return -EINVAL;
+	}
+
+	cre_hw_mgr->devices[CRE_DEV_CRE] = kzalloc(
+		sizeof(struct cam_hw_intf *) * num_dev, GFP_KERNEL);
+	if (!cre_hw_mgr->devices[CRE_DEV_CRE])
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int cam_cre_mgr_init_devs(struct device_node *of_node)
+{
+	int rc = 0;
+	int count, i;
+	const char *name = NULL;
+	struct device_node *child_node = NULL;
+	struct platform_device *child_pdev = NULL;
+	struct cam_hw_intf *child_dev_intf = NULL;
+	struct cam_hw_info *cre_dev;
+	struct cam_hw_soc_info *soc_info = NULL;
+
+	rc = cam_cre_mgr_alloc_devs(of_node);
+	if (rc)
+		return rc;
+
+	count = of_property_count_strings(of_node, "compat-hw-name");
+	if (!count) {
+		CAM_ERR(CAM_CRE, "no compat hw found in dev tree, cnt = %d",
+			count);
+		rc = -EINVAL;
+		goto compat_hw_name_failed;
+	}
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node, "compat-hw-name",
+			i, &name);
+		if (rc) {
+			CAM_ERR(CAM_CRE, "getting dev object name failed");
+			goto compat_hw_name_failed;
+		}
+
+		child_node = of_find_node_by_name(NULL, name);
+		if (!child_node) {
+			CAM_ERR(CAM_CRE, "Cannot find node in dtsi %s", name);
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+
+		child_pdev = of_find_device_by_node(child_node);
+		if (!child_pdev) {
+			CAM_ERR(CAM_CRE, "failed to find device on bus %s",
+				child_node->name);
+			rc = -ENODEV;
+			of_node_put(child_node);
+			goto compat_hw_name_failed;
+		}
+
+		child_dev_intf = (struct cam_hw_intf *)platform_get_drvdata(
+			child_pdev);
+		if (!child_dev_intf) {
+			CAM_ERR(CAM_CRE, "no child device");
+			of_node_put(child_node);
+			goto compat_hw_name_failed;
+		}
+		cre_hw_mgr->devices[child_dev_intf->hw_type]
+			[child_dev_intf->hw_idx] = child_dev_intf;
+
+		if (!child_dev_intf->hw_ops.process_cmd)
+			goto compat_hw_name_failed;
+
+		of_node_put(child_node);
+	}
+
+	cre_hw_mgr->num_cre = count;
+	for (i = 0; i < count; i++) {
+		cre_hw_mgr->cre_dev_intf[i] =
+			cre_hw_mgr->devices[CRE_DEV_CRE][i];
+			cre_dev = cre_hw_mgr->cre_dev_intf[i]->hw_priv;
+			soc_info = &cre_dev->soc_info;
+	}
+
+	return 0;
+compat_hw_name_failed:
+	kfree(cre_hw_mgr->devices[CRE_DEV_CRE]);
+	cre_hw_mgr->devices[CRE_DEV_CRE] = NULL;
+	return rc;
+}
+
+static void cam_req_mgr_process_cre_command_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_cre_msg_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_cre_timer_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int cam_cre_mgr_create_wq(void)
+{
+
+	int rc;
+	int i;
+
+	rc = cam_req_mgr_workq_create("cre_command_queue", CRE_WORKQ_NUM_TASK,
+		&cre_hw_mgr->cmd_work, CRM_WORKQ_USAGE_NON_IRQ,
+		0, cam_req_mgr_process_cre_command_queue);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "unable to create a command worker");
+		goto cmd_work_failed;
+	}
+
+	rc = cam_req_mgr_workq_create("cre_message_queue", CRE_WORKQ_NUM_TASK,
+		&cre_hw_mgr->msg_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_cre_msg_queue);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "unable to create a message worker");
+		goto msg_work_failed;
+	}
+
+	rc = cam_req_mgr_workq_create("cre_timer_queue", CRE_WORKQ_NUM_TASK,
+		&cre_hw_mgr->timer_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_cre_timer_queue);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "unable to create a timer worker");
+		goto timer_work_failed;
+	}
+
+	cre_hw_mgr->cmd_work_data =
+		kzalloc(sizeof(struct cre_cmd_work_data) * CRE_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!cre_hw_mgr->cmd_work_data) {
+		rc = -ENOMEM;
+		goto cmd_work_data_failed;
+	}
+
+	cre_hw_mgr->msg_work_data =
+		kzalloc(sizeof(struct cre_msg_work_data) * CRE_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!cre_hw_mgr->msg_work_data) {
+		rc = -ENOMEM;
+		goto msg_work_data_failed;
+	}
+
+	cre_hw_mgr->timer_work_data =
+		kzalloc(sizeof(struct cre_clk_work_data) * CRE_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!cre_hw_mgr->timer_work_data) {
+		rc = -ENOMEM;
+		goto timer_work_data_failed;
+	}
+
+	for (i = 0; i < CRE_WORKQ_NUM_TASK; i++)
+		cre_hw_mgr->msg_work->task.pool[i].payload =
+				&cre_hw_mgr->msg_work_data[i];
+
+	for (i = 0; i < CRE_WORKQ_NUM_TASK; i++)
+		cre_hw_mgr->cmd_work->task.pool[i].payload =
+				&cre_hw_mgr->cmd_work_data[i];
+
+	for (i = 0; i < CRE_WORKQ_NUM_TASK; i++)
+		cre_hw_mgr->timer_work->task.pool[i].payload =
+				&cre_hw_mgr->timer_work_data[i];
+	return 0;
+
+timer_work_data_failed:
+	kfree(cre_hw_mgr->msg_work_data);
+msg_work_data_failed:
+	kfree(cre_hw_mgr->cmd_work_data);
+cmd_work_data_failed:
+	cam_req_mgr_workq_destroy(&cre_hw_mgr->timer_work);
+timer_work_failed:
+	cam_req_mgr_workq_destroy(&cre_hw_mgr->msg_work);
+msg_work_failed:
+	cam_req_mgr_workq_destroy(&cre_hw_mgr->cmd_work);
+cmd_work_failed:
+	return rc;
+}
+
+static int cam_cre_set_dbg_default_clk(void *data, u64 val)
+{
+	cre_hw_mgr->cre_debug_clk = val;
+	return 0;
+}
+
+static int cam_cre_get_dbg_default_clk(void *data, u64 *val)
+{
+	*val = cre_hw_mgr->cre_debug_clk;
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(cam_cre_debug_default_clk,
+	cam_cre_get_dbg_default_clk,
+	cam_cre_set_dbg_default_clk, "%16llu");
+
+static int cam_cre_create_debug_fs(void)
+{
+	if (!cam_debugfs_available())
+		return 0;
+
+	cam_debugfs_create_subdir("cre", &cre_hw_mgr->dentry);
+	if (!cre_hw_mgr->dentry) {
+		CAM_ERR(CAM_CRE, "failed to create dentry");
+		return -ENOMEM;
+	}
+
+	debugfs_create_bool("dump_req_data_enable", 0644, cre_hw_mgr->dentry,
+		&cre_hw_mgr->dump_req_data_enable);
+
+	debugfs_create_file("cre_debug_clk", 0644, cre_hw_mgr->dentry,
+		NULL, &cam_cre_debug_default_clk);
+
+	return 0;
+}
+
+int cam_cre_hw_mgr_init(struct device_node *of_node, void *hw_mgr,
+	int *iommu_hdl)
+{
+	int i, rc = 0, j;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+
+	if (!of_node || !hw_mgr) {
+		CAM_ERR(CAM_CRE, "Invalid args of_node %pK hw_mgr %pK",
+			of_node, hw_mgr);
+		return -EINVAL;
+	}
+	hw_mgr_intf = (struct cam_hw_mgr_intf *)hw_mgr;
+
+	cre_hw_mgr = kzalloc(sizeof(struct cam_cre_hw_mgr), GFP_KERNEL);
+	if (!cre_hw_mgr) {
+		CAM_ERR(CAM_CRE, "Unable to allocate mem for: size = %d",
+			sizeof(struct cam_cre_hw_mgr));
+		return -ENOMEM;
+	}
+
+	hw_mgr_intf->hw_mgr_priv = cre_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_cre_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire = cam_cre_mgr_acquire_hw;
+	hw_mgr_intf->hw_release = cam_cre_mgr_release_hw;
+	hw_mgr_intf->hw_start   = NULL;
+	hw_mgr_intf->hw_stop    = NULL;
+	hw_mgr_intf->hw_prepare_update = cam_cre_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config_stream_settings = NULL;
+	hw_mgr_intf->hw_config = cam_cre_mgr_config_hw;
+	hw_mgr_intf->hw_read   = NULL;
+	hw_mgr_intf->hw_write  = NULL;
+	hw_mgr_intf->hw_cmd = cam_cre_mgr_cmd;
+	hw_mgr_intf->hw_flush = cam_cre_mgr_hw_flush;
+	hw_mgr_intf->hw_dump = cam_cre_mgr_hw_dump;
+
+	cre_hw_mgr->secure_mode = false;
+	mutex_init(&cre_hw_mgr->hw_mgr_mutex);
+	spin_lock_init(&cre_hw_mgr->hw_mgr_lock);
+
+	for (i = 0; i < CRE_CTX_MAX; i++) {
+		cre_hw_mgr->ctx[i].bitmap_size =
+			BITS_TO_LONGS(CAM_CTX_REQ_MAX) *
+			sizeof(long);
+		cre_hw_mgr->ctx[i].bitmap = kzalloc(
+			cre_hw_mgr->ctx[i].bitmap_size, GFP_KERNEL);
+		if (!cre_hw_mgr->ctx[i].bitmap) {
+			CAM_ERR(CAM_CRE, "bitmap allocation failed: size = %d",
+				cre_hw_mgr->ctx[i].bitmap_size);
+			rc = -ENOMEM;
+			goto cre_ctx_bitmap_failed;
+		}
+		cre_hw_mgr->ctx[i].bits = cre_hw_mgr->ctx[i].bitmap_size *
+			BITS_PER_BYTE;
+		mutex_init(&cre_hw_mgr->ctx[i].ctx_mutex);
+	}
+
+	rc = cam_cre_mgr_init_devs(of_node);
+	if (rc)
+		goto dev_init_failed;
+
+	cre_hw_mgr->ctx_bitmap_size =
+		BITS_TO_LONGS(CRE_CTX_MAX) * sizeof(long);
+	cre_hw_mgr->ctx_bitmap = kzalloc(cre_hw_mgr->ctx_bitmap_size,
+		GFP_KERNEL);
+	if (!cre_hw_mgr->ctx_bitmap) {
+		rc = -ENOMEM;
+		goto ctx_bitmap_alloc_failed;
+	}
+
+	cre_hw_mgr->ctx_bits = cre_hw_mgr->ctx_bitmap_size *
+		BITS_PER_BYTE;
+
+	rc = cam_smmu_get_handle("cre", &cre_hw_mgr->iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "get mmu handle failed: %d", rc);
+		goto cre_get_hdl_failed;
+	}
+
+	rc = cam_smmu_get_handle("cam-secure", &cre_hw_mgr->iommu_sec_hdl);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "get secure mmu handle failed: %d", rc);
+		goto secure_hdl_failed;
+	}
+
+	rc = cam_cre_mgr_create_wq();
+	if (rc)
+		goto cre_wq_create_failed;
+
+	INIT_LIST_HEAD(&cre_hw_mgr->hw_config_req_list);
+	INIT_LIST_HEAD(&cre_hw_mgr->free_req_list);
+	for (i = 0; i < CAM_CRE_HW_CFG_Q_MAX; i++) {
+		INIT_LIST_HEAD(&cre_hw_mgr->req_list[i].list);
+		list_add_tail(&cre_hw_mgr->req_list[i].list,
+			&cre_hw_mgr->free_req_list);
+	}
+
+	cam_cre_create_debug_fs();
+
+	if (iommu_hdl)
+		*iommu_hdl = cre_hw_mgr->iommu_hdl;
+
+	return rc;
+
+cre_wq_create_failed:
+	cam_smmu_destroy_handle(cre_hw_mgr->iommu_sec_hdl);
+	cre_hw_mgr->iommu_sec_hdl = -1;
+secure_hdl_failed:
+	cam_smmu_destroy_handle(cre_hw_mgr->iommu_hdl);
+	cre_hw_mgr->iommu_hdl = -1;
+cre_get_hdl_failed:
+	cam_free_clear(cre_hw_mgr->ctx_bitmap);
+	cre_hw_mgr->ctx_bitmap = NULL;
+	cre_hw_mgr->ctx_bitmap_size = 0;
+	cre_hw_mgr->ctx_bits = 0;
+ctx_bitmap_alloc_failed:
+	cam_free_clear(cre_hw_mgr->devices[CRE_DEV_CRE]);
+	cre_hw_mgr->devices[CRE_DEV_CRE] = NULL;
+dev_init_failed:
+cre_ctx_bitmap_failed:
+	mutex_destroy(&cre_hw_mgr->hw_mgr_mutex);
+	for (j = i - 1; j >= 0; j--) {
+		mutex_destroy(&cre_hw_mgr->ctx[j].ctx_mutex);
+		cam_free_clear(cre_hw_mgr->ctx[j].bitmap);
+		cre_hw_mgr->ctx[j].bitmap = NULL;
+		cre_hw_mgr->ctx[j].bitmap_size = 0;
+		cre_hw_mgr->ctx[j].bits = 0;
+	}
+	cam_free_clear(cre_hw_mgr);
+	cre_hw_mgr = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cam_cre_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cam_cre_hw_mgr.h
@@ -0,0 +1,444 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_CRE_HW_MGR_H
+#define CAM_CRE_HW_MGR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_cre.h>
+
+#include "cam_cre_hw_intf.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_context.h"
+#include "cre_top.h"
+
+#define CRE_CTX_MAX                  32
+
+#define CRE_WORKQ_NUM_TASK           64
+#define CRE_WORKQ_TASK_CMD_TYPE      1
+#define CRE_WORKQ_TASK_MSG_TYPE      2
+
+#define CRE_PACKET_MAX_CMD_BUFS      1
+
+#define CRE_CTX_STATE_FREE           0
+#define CRE_CTX_STATE_IN_USE         1
+#define CRE_CTX_STATE_ACQUIRED       2
+#define CRE_CTX_STATE_RELEASE        3
+
+#define CRE_MAX_IN_RES               2
+#define CRE_MAX_OUT_RES              2
+#define CRE_MAX_IO_BUFS              3
+
+#define CAM_CRE_BW_CONFIG_UNKNOWN    0
+#define CAM_CRE_BW_CONFIG_V2         2
+
+#define CRE_DEVICE_IDLE_TIMEOUT      400
+#define CRE_REQUEST_TIMEOUT          200
+
+#define CAM_CRE_MAX_PER_PATH_VOTES   2
+#define CAM_CRE_MAX_REG_SET          32
+
+#define CAM_CRE_MAX_ACTIVE           8
+/*
+ * Response time threshold in ms beyond which a request is not expected
+ * to be with CRE hw
+ */
+#define CAM_CRE_RESPONSE_TIME_THRESHOLD   300
+
+/*
+ * struct cam_cre_irq_data
+ *
+ * @error:          IRQ error
+ * @top_irq_status: CRE top irq status
+ * @wr_buf_done:    write engine buf done
+ */
+struct cam_cre_irq_data {
+	uint32_t error;
+	uint32_t top_irq_status;
+	uint32_t wr_buf_done;
+};
+
+
+/**
+ * struct cam_cre_hw_intf_data - CRE hw intf data
+ *
+ * @Brief:        cre hw intf pointer and pid list data
+ *
+ * @devices:      cre hw intf pointer
+ * @num_devices:  Number of CRE devices
+ * @num_hw_pid:   Number of pids for this hw
+ * @hw_pid:       cre hw pid values
+ *
+ */
+struct cam_cre_hw_intf_data {
+	struct cam_hw_intf  *hw_intf;
+	uint32_t             num_hw_pid;
+	uint32_t             hw_pid[CRE_DEV_MAX];
+};
+
+/**
+ * struct cam_cre_ctx_clk_info
+ * @curr_fc: Context latest request frame cycles
+ * @rt_flag: Flag to indicate real time request
+ * @base_clk: Base clock to process the request
+ * @reserved: Reserved field
+ * @clk_rate: Supported clock rates for the context
+ * @num_paths: Number of valid AXI paths
+ * @axi_path: ctx based per path bw vote
+ */
+struct cam_cre_ctx_clk_info {
+	uint32_t curr_fc;
+	uint32_t rt_flag;
+	uint32_t base_clk;
+	uint32_t reserved;
+	int32_t clk_rate[CAM_MAX_VOTE];
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_CRE_MAX_PER_PATH_VOTES];
+};
+
+/**
+ * struct cre_cmd_generic_blob
+ * @ctx: Current context info
+ * @req_info_idx: Index used for request
+ * @io_buf_addr: pointer to io buffer address
+ */
+struct cre_cmd_generic_blob {
+	struct cam_cre_ctx *ctx;
+	uint32_t req_idx;
+	uint64_t *io_buf_addr;
+};
+
+/**
+ * struct cam_cre_clk_info
+ * @base_clk: Base clock to process request
+ * @curr_clk: Current clock of hadrware
+ * @threshold: Threshold for overclk count
+ * @over_clked: Over clock count
+ * @num_paths: Number of AXI vote paths
+ * @axi_path: Current per path bw vote info
+ * @hw_type: IPE/BPS device type
+ * @watch_dog: watchdog timer handle
+ * @watch_dog_reset_counter: Counter for watch dog reset
+ * @uncompressed_bw: uncompressed BW
+ * @compressed_bw: compressed BW
+ */
+struct cam_cre_clk_info {
+	uint32_t base_clk;
+	uint32_t curr_clk;
+	uint32_t threshold;
+	uint32_t over_clked;
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_CRE_MAX_PER_PATH_VOTES];
+	uint32_t hw_type;
+	struct cam_req_mgr_timer *watch_dog;
+	uint32_t watch_dog_reset_counter;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+};
+
+/**
+ * struct cre_cmd_work_data
+ *
+ * @type:        Type of work data
+ * @data:        Private data
+ * @req_idx:     Request Idx
+ * @request_id:  Request id
+ */
+struct cre_cmd_work_data {
+	uint32_t type;
+	void *data;
+	int64_t req_idx;
+	uint64_t request_id;
+};
+
+/**
+ * struct cre_msg_work_data
+ *
+ * @type:       Type of work data
+ * @data:       Private data
+ * @irq_status: IRQ status
+ */
+struct cre_msg_work_data {
+	uint32_t type;
+	void *data;
+	struct cam_cre_irq_data irq_data;
+};
+
+/**
+ * struct cre_clk_work_data
+ *
+ * @type: Type of work data
+ * @data: Private data
+ */
+struct cre_clk_work_data {
+	uint32_t type;
+	void *data;
+};
+
+struct plane_info {
+	uintptr_t  cpu_addr;
+	dma_addr_t iova_addr;
+	uint32_t   width;
+	uint32_t   height;
+	uint32_t   stride;
+	uint32_t   format;
+	uint32_t   alignment;
+	uint32_t   offset;
+	size_t     len;
+};
+
+/**
+ * struct cre_io_buf
+ *
+ * @direction:     Direction of a buffer
+ * @resource_type: Resource type of IO Buffer
+ * @format:     Format
+ * @fence:         Fence
+ * @num_planes:    Number of planes
+ * p_info:         per plane info
+ */
+struct cre_io_buf {
+	uint32_t direction;
+	uint32_t resource_type;
+	uint32_t format;
+	uint32_t fence;
+	uint32_t num_planes;
+	struct   plane_info p_info[CAM_CRE_MAX_PLANES];
+};
+
+struct cre_reg_set {
+	uint32_t offset;
+	uint32_t value;
+};
+
+struct cre_reg_buffer {
+	uint32_t num_rd_reg_set;
+	uint32_t num_wr_reg_set;
+	struct cre_reg_set rd_reg_set[CAM_CRE_MAX_REG_SET];
+	struct cre_reg_set wr_reg_set[CAM_CRE_MAX_REG_SET];
+};
+
+/**
+ * struct cam_cre_clk_bw_request
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @uncompressed_bw: Bandwidth required to process frame
+ * @compressed_bw: Compressed bandwidth to process frame
+ */
+struct cam_cre_clk_bw_request {
+	uint64_t budget_ns;
+	uint32_t frame_cycles;
+	uint32_t rt_flag;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+};
+
+/**
+ * struct cam_cre_clk_bw_req_internal_v2
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @reserved: Reserved for future use
+ * @num_paths: Number of paths for per path bw vote
+ * @axi_path: Per path vote info for CRE
+ */
+struct cam_cre_clk_bw_req_internal_v2 {
+	uint64_t budget_ns;
+	uint32_t frame_cycles;
+	uint32_t rt_flag;
+	uint32_t reserved;
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_CRE_MAX_PER_PATH_VOTES];
+};
+
+/**
+ * struct cam_cre_request
+ *
+ * @request_id:          Request Id
+ * @req_idx:             Index in request list
+ * @state:               Request state
+ * @num_batch:           Number of batches
+ * @num_frame_bufs:      Number of frame buffers
+ * @num_pass_bufs:       Number of pass Buffers
+ * @num_io_bufs:         Number of IO Buffers
+ * @in_resource:         Input resource
+ * @cre_debug_buf:       Debug buffer
+ * @io_buf:              IO config info of a request
+ * @clk_info:            Clock Info V1
+ * @clk_info_v2:         Clock Info V2
+ * @hang_data:           Debug data for HW error
+ * @submit_timestamp:    Submit timestamp to hw
+ */
+struct cam_cre_request {
+	uint64_t  request_id;
+	uint32_t  req_idx;
+	uint32_t  state;
+	uint32_t  num_batch;
+	uint32_t  frames_done;
+	uint32_t  num_frame_bufs;
+	uint32_t  num_pass_bufs;
+	uint32_t  num_io_bufs[CRE_MAX_BATCH_SIZE];
+	uint32_t  in_resource;
+	struct    cre_reg_buffer cre_reg_buf[CRE_MAX_BATCH_SIZE];
+	struct    cre_io_buf *io_buf[CRE_MAX_BATCH_SIZE][CRE_MAX_IO_BUFS];
+	struct    cam_cre_clk_bw_request clk_info;
+	struct    cam_cre_clk_bw_req_internal_v2 clk_info_v2;
+	struct    cam_hw_mgr_pf_request_info hang_data;
+	ktime_t   submit_timestamp;
+};
+
+/**
+ * struct cam_cre_ctx
+ *
+ * @ctx_id:            Context ID
+ * @ctx_state:         State of a context
+ * @req_cnt:           Requests count
+ * @last_flush_req:    last flush req for this ctx
+ * @last_req_time:     Timestamp of last request
+ * @last_req_idx:      Last submitted req index
+ * @last_done_req_idx: Last done req index
+ * @bitmap:            Context bit map
+ * @bitmap_size:       Context bit map size
+ * @bits:              Context bit map bits
+ * @context_priv:      Private data of context
+ * @iommu_hdl:         smmu handle
+ * @ctx_mutex:         Mutex for context
+ * @acquire_dev_cmd:   Cam acquire command
+ * @cre_acquire:       CRE acquire command
+ * @clk_info:          CRE Ctx clock info
+ * @packet:            Current packet to process
+ * @cre_top:           Pointer to CRE top data structure
+ * @req_list:          Request List
+ * @ctxt_event_cb:     Callback of a context
+ */
+struct cam_cre_ctx {
+	uint32_t ctx_id;
+	uint32_t ctx_state;
+	uint32_t req_cnt;
+	uint64_t last_flush_req;
+	uint64_t last_req_time;
+	uint64_t last_req_idx;
+	uint64_t last_done_req_idx;
+	void    *bitmap;
+	size_t   bitmap_size;
+	size_t   bits;
+	void    *context_priv;
+	int      iommu_hdl;
+
+	struct mutex                     ctx_mutex;
+	struct cam_acquire_dev_cmd       acquire_dev_cmd;
+	struct cam_cre_acquire_dev_info  cre_acquire;
+	struct cam_cre_ctx_clk_info      clk_info;
+	struct cre_top                  *cre_top;
+	struct cam_packet               *packet;
+	struct cam_cre_request          *req_list[CAM_CTX_REQ_MAX];
+	cam_hw_event_cb_func ctxt_event_cb;
+};
+
+/**
+ * struct cam_cre_hw_cfg_req
+ *
+ * @list:              Requests submiited to HW
+ * @req_id:            Request id
+ * ctx_id:             Ctx id
+ *
+ */
+struct cam_cre_hw_cfg_req {
+	struct list_head   list;
+	uint64_t           req_id;
+	uint32_t           ctx_id;
+};
+
+/**
+ * struct cam_cre_hw_mgr
+ *
+ * @cre_ctx_cnt:       Open context count
+ * @hw_mgr_mutex:      Mutex for HW manager
+ * @hw_mgr_lock:       Spinlock for HW manager
+ * @iommu_hdl:         CRE Handle
+ * @iommu_sec_hdl:     CRE Handle for secure
+ * @num_cre:           Number of CRE
+ * @secure_mode:       Mode of CRE creration
+ * @ctx_bitmap:        Context bit map
+ * @ctx_bitmap_size:   Context bit map size
+ * @ctx_bits:          Context bit map bits
+ * @ctx:               CRE context
+ * @devices:           CRE devices
+ * @cre_caps:          CRE capabilities
+ * @cmd_work:          Command work
+ * @msg_work:          Message work
+ * @timer_work:        Timer work
+ * @cmd_work_data:     Command work data
+ * @msg_work_data:     Message work data
+ * @timer_work_data:   Timer work data
+ * @cre_dev_intf:      CRE device interface
+ * @clk_info:          CRE clock Info for HW manager
+ * @dentry:            Pointer to CRE debugfs directory
+ * @dump_req_data_enable: CRE hang dump enablement
+ * @hw_config_req_list: Requests submitted to HW
+ * @free_req_list:     Requests that are free
+ * @req_list:          Request list which is applied
+ */
+struct cam_cre_hw_mgr {
+	uint32_t      cre_ctx_cnt;
+	struct mutex  hw_mgr_mutex;
+	spinlock_t    hw_mgr_lock;
+	int32_t       iommu_hdl;
+	int32_t       iommu_sec_hdl;
+	uint32_t      num_cre;
+	uint64_t      cre_debug_clk;
+	bool          secure_mode;
+	void    *ctx_bitmap;
+	size_t   ctx_bitmap_size;
+	size_t   ctx_bits;
+	struct   cam_cre_ctx  ctx[CRE_CTX_MAX];
+	struct   cam_hw_intf  **devices[CRE_DEV_MAX];
+	struct   cam_cre_query_cap_cmd cre_caps;
+
+	struct cam_req_mgr_core_workq *cmd_work;
+	struct cam_req_mgr_core_workq *msg_work;
+	struct cam_req_mgr_core_workq *timer_work;
+	struct cre_cmd_work_data *cmd_work_data;
+	struct cre_msg_work_data *msg_work_data;
+	struct cre_clk_work_data *timer_work_data;
+	struct cam_hw_intf *cre_dev_intf[CRE_DEV_MAX];
+	struct cam_soc_reg_map *reg_map[CRE_DEV_MAX][CRE_BASE_MAX];
+	struct cam_cre_clk_info clk_info;
+	struct dentry *dentry;
+	bool   dump_req_data_enable;
+
+	struct list_head hw_config_req_list;
+	struct list_head free_req_list;
+	struct cam_cre_hw_cfg_req req_list[CAM_CRE_HW_CFG_Q_MAX];
+};
+
+/**
+ * struct cam_cre_hw_ctx_data
+ *
+ * @context_priv: Context private data, cam_context from
+ *     acquire.
+ * @ctx_mutex: Mutex for context
+ * @cre_dev_acquire_info: Acquire device info
+ * @ctxt_event_cb: Context callback function
+ * @in_use: Flag for context usage
+ * @wait_complete: Completion info
+ * @last_flush_req: req id which was flushed last.
+ */
+struct cam_cre_hw_ctx_data {
+	void *context_priv;
+	struct mutex ctx_mutex;
+	struct cam_cre_acquire_dev_info cre_dev_acquire_info;
+	cam_hw_event_cb_func ctxt_event_cb;
+	bool in_use;
+	struct completion wait_complete;
+	uint64_t last_flush_req;
+};
+#endif /* CAM_CRE_HW_MGR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_rd/cre_bus_rd.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_rd/cre_bus_rd.c
@@ -0,0 +1,558 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+#include "cre_core.h"
+#include "cre_hw.h"
+#include "cre_dev_intf.h"
+#include "cre_bus_rd.h"
+#include <media/cam_cre.h>
+
+static struct cre_bus_rd *bus_rd;
+
+#define update_cre_reg_set(cre_reg_buf, off, val) \
+	do {                                           \
+		cre_reg_buf->rd_reg_set[cre_reg_buf->num_rd_reg_set].offset = (off); \
+		cre_reg_buf->rd_reg_set[cre_reg_buf->num_rd_reg_set].value = (val); \
+		cre_reg_buf->num_rd_reg_set++; \
+	} while (0)
+
+static int cam_cre_bus_rd_in_port_idx(uint32_t input_port_id)
+{
+	int i;
+
+	for (i = 0; i < CRE_MAX_IN_RES; i++)
+		if (bus_rd->in_port_to_rm[i].input_port_id ==
+			input_port_id)
+			return i;
+
+	return -EINVAL;
+}
+
+static void cam_cre_update_read_reg_val(struct plane_info p_info,
+	struct cam_cre_bus_rd_client_reg_val *rd_client_reg_val)
+{
+	switch (p_info.format) {
+		case CAM_FORMAT_MIPI_RAW_10:
+			rd_client_reg_val->format = 0xd;
+			break;
+		case CAM_FORMAT_MIPI_RAW_12:
+			rd_client_reg_val->format = 0xe;
+			break;
+		case CAM_FORMAT_MIPI_RAW_14:
+			rd_client_reg_val->format = 0xf;
+			break;
+		case CAM_FORMAT_MIPI_RAW_20:
+			rd_client_reg_val->format = 0x13;
+			break;
+		case CAM_FORMAT_PLAIN128:
+			rd_client_reg_val->format = 0x0;
+			break;
+		default:
+			CAM_ERR(CAM_CRE, "Unsupported read format");
+			return;
+	}
+
+	CAM_DBG(CAM_CRE,
+		"format %d width(in bytes) %d height %d stride(in byte) %d",
+		p_info.format, p_info.width, p_info.height, p_info.stride);
+	CAM_DBG(CAM_CRE, "alignment 0x%x",
+		p_info.alignment);
+
+	/* Fetch engine width has to be updated in number of bytes */
+	rd_client_reg_val->img_width  = p_info.width;
+	rd_client_reg_val->stride     = p_info.stride;
+	rd_client_reg_val->img_height = p_info.height;
+	rd_client_reg_val->alignment  = p_info.alignment;
+}
+
+static int cam_cre_bus_rd_release(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	if (ctx_id < 0 || ctx_id >= CRE_CTX_MAX) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	vfree(bus_rd->bus_rd_ctx[ctx_id]);
+	bus_rd->bus_rd_ctx[ctx_id] = NULL;
+
+	return 0;
+}
+
+static int cam_cre_bus_rd_update(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, struct cre_reg_buffer *cre_reg_buf, int batch_idx,
+	int io_idx, struct cam_cre_dev_prepare_req *prepare)
+{
+	int k, in_port_idx;
+	uint32_t req_idx, val;
+	uint32_t iova_base, iova_offset;
+	struct cam_hw_prepare_update_args *prepare_args;
+	struct cam_cre_ctx *ctx_data;
+	struct cam_cre_request *cre_request;
+	struct cre_io_buf *io_buf;
+	struct cam_cre_bus_rd_reg *rd_reg;
+	struct cam_cre_bus_rd_client_reg *rd_reg_client;
+	struct cam_cre_bus_rd_reg_val *rd_reg_val;
+	struct cam_cre_bus_rd_client_reg_val *rd_client_reg_val;
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d %x", ctx_id, prepare);
+		return -EINVAL;
+	}
+
+	if (batch_idx >= CRE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_CRE, "Invalid batch idx: %d", batch_idx);
+		return -EINVAL;
+	}
+
+	if (io_idx >= CRE_MAX_IO_BUFS) {
+		CAM_ERR(CAM_CRE, "Invalid IO idx: %d", io_idx);
+		return -EINVAL;
+	}
+
+	prepare_args = prepare->prepare_args;
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+
+	cre_request = ctx_data->req_list[req_idx];
+	CAM_DBG(CAM_CRE, "req_idx = %d req_id = %lld",
+		req_idx, cre_request->request_id);
+	rd_reg = cam_cre_hw_info->bus_rd_reg_offset;
+	rd_reg_val = cam_cre_hw_info->bus_rd_reg_val;
+	io_buf = cre_request->io_buf[batch_idx][io_idx];
+
+	CAM_DBG(CAM_CRE,
+		"req_idx = %d req_id = %lld rsc %d",
+		req_idx, cre_request->request_id,
+		io_buf->resource_type);
+	CAM_DBG(CAM_CRE, "batch:%d iobuf:%d direction:%d",
+		batch_idx, io_idx, io_buf->direction);
+
+	in_port_idx =
+	cam_cre_bus_rd_in_port_idx(io_buf->resource_type);
+	if (in_port_idx < 0) {
+		CAM_ERR(CAM_CRE, "Invalid in_port_idx for resource %d", io_buf->resource_type);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CRE, "in_port_idx %d", in_port_idx);
+	for (k = 0; k < io_buf->num_planes; k++) {
+		rd_reg_client = &rd_reg->rd_clients[in_port_idx];
+		rd_client_reg_val = &rd_reg_val->rd_clients[in_port_idx];
+
+		/* security cfg */
+		update_cre_reg_set(cre_reg_buf,
+				rd_reg->offset + rd_reg->security_cfg,
+				ctx_data->cre_acquire.secure_mode & 0x1);
+
+		/* enable client */
+		update_cre_reg_set(cre_reg_buf,
+			rd_reg->offset + rd_reg_client->core_cfg,
+			1);
+
+		/* ccif meta data */
+		update_cre_reg_set(cre_reg_buf,
+			(rd_reg->offset + rd_reg_client->ccif_meta_data),
+			0);
+		/*
+		 * As CRE have 36 Bit addressing support Image Address
+		 * register will have 28 bit MSB of 36 bit iova.
+		 * and addr_config will have 8 bit byte offset.
+		 */
+		iova_base = CAM_36BIT_INTF_GET_IOVA_BASE(
+				io_buf->p_info[k].iova_addr);
+		update_cre_reg_set(cre_reg_buf,
+			rd_reg->offset + rd_reg_client->img_addr,
+			iova_base);
+		iova_offset = CAM_36BIT_INTF_GET_IOVA_OFFSET(
+				io_buf->p_info[k].iova_addr);
+		update_cre_reg_set(cre_reg_buf,
+			rd_reg->offset + rd_reg_client->addr_cfg,
+			iova_offset);
+
+		cam_cre_update_read_reg_val(io_buf->p_info[k],
+			rd_client_reg_val);
+
+		/* Buffer size */
+		update_cre_reg_set(cre_reg_buf,
+			rd_reg->offset + rd_reg_client->rd_width,
+			ctx_data->cre_acquire.in_res[in_port_idx].width);
+		update_cre_reg_set(cre_reg_buf,
+			rd_reg->offset + rd_reg_client->rd_height,
+			rd_client_reg_val->img_height);
+
+		/* stride */
+		update_cre_reg_set(cre_reg_buf,
+			rd_reg->offset + rd_reg_client->rd_stride,
+			rd_client_reg_val->stride);
+
+		val = 0;
+		val |= (rd_client_reg_val->format &
+			rd_client_reg_val->format_mask) <<
+			rd_client_reg_val->format_shift;
+		val |= (rd_client_reg_val->alignment &
+			rd_client_reg_val->alignment_mask) <<
+			rd_client_reg_val->alignment_shift;
+		/* unpacker cfg : format and alignment */
+		update_cre_reg_set(cre_reg_buf,
+			rd_reg->offset + rd_reg_client->unpacker_cfg,
+			val);
+
+		/* Enable Debug cfg */
+		val = 0xFFFF;
+		update_cre_reg_set(cre_reg_buf,
+			rd_reg->offset + rd_reg_client->debug_status_cfg,
+			val);
+	}
+
+	return 0;
+}
+
+static int cam_cre_bus_rd_prepare(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	int i, j;
+	uint32_t req_idx;
+	struct cam_cre_dev_prepare_req *prepare;
+	struct cam_cre_ctx *ctx_data;
+	struct cam_cre_request *cre_request;
+	struct cre_io_buf *io_buf;
+	struct cam_cre_bus_rd_reg *rd_reg;
+	struct cam_cre_bus_rd_reg_val *rd_reg_val;
+	struct cre_reg_buffer *cre_reg_buf = NULL;
+
+	int val;
+
+	if (ctx_id < 0 || !data) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+	prepare = data;
+
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+
+	cre_request = ctx_data->req_list[req_idx];
+
+	CAM_DBG(CAM_CRE, "req_idx = %d req_id = %lld",
+		req_idx, cre_request->request_id);
+	rd_reg = cam_cre_hw_info->bus_rd_reg_offset;
+	rd_reg_val = cam_cre_hw_info->bus_rd_reg_val;
+
+	for (i = 0; i < cre_request->num_batch; i++) {
+		cre_reg_buf = &cre_request->cre_reg_buf[i];
+		for (j = 0; j < cre_request->num_io_bufs[i]; j++) {
+			io_buf = cre_request->io_buf[i][j];
+			if (io_buf->direction != CAM_BUF_INPUT)
+				continue;
+
+			CAM_DBG(CAM_CRE, "batch:%d iobuf:%d direction:%d",
+				i, j, io_buf->direction);
+
+			rc = cam_cre_bus_rd_update(cam_cre_hw_info,
+				ctx_id, cre_reg_buf, i, j, prepare);
+			if (rc)
+				goto end;
+		}
+
+		/* Go command */
+		val = 0;
+		val |= rd_reg_val->go_cmd;
+		val |= rd_reg_val->static_prg & rd_reg_val->static_prg_mask;
+		update_cre_reg_set(cre_reg_buf,
+			rd_reg->offset + rd_reg->input_if_cmd,
+			val);
+	}
+	if (cre_reg_buf) {
+		for (i = 0; i < cre_reg_buf->num_rd_reg_set; i++) {
+			CAM_DBG(CAM_CRE, "CRE value 0x%x offset 0x%x",
+					cre_reg_buf->rd_reg_set[i].value,
+					cre_reg_buf->rd_reg_set[i].offset);
+		}
+	}
+end:
+	return 0;
+}
+
+static int cam_cre_bus_rd_acquire(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i;
+	struct cam_cre_acquire_dev_info *in_acquire;
+	struct cre_bus_rd_ctx *bus_rd_ctx;
+	struct cre_bus_in_port_to_rm *in_port_to_rm;
+	struct cam_cre_bus_rd_reg_val *bus_rd_reg_val;
+	int in_port_idx;
+
+	if (ctx_id < 0 || !data || !cam_cre_hw_info || ctx_id >= CRE_CTX_MAX) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d %x %x",
+			ctx_id, data, cam_cre_hw_info);
+		return -EINVAL;
+	}
+
+	bus_rd->bus_rd_ctx[ctx_id] = vzalloc(sizeof(struct cre_bus_rd_ctx));
+	if (!bus_rd->bus_rd_ctx[ctx_id]) {
+		CAM_ERR(CAM_CRE, "Out of memory");
+		return -ENOMEM;
+	}
+
+	bus_rd->bus_rd_ctx[ctx_id]->cre_acquire = data;
+	in_acquire = data;
+	bus_rd_ctx = bus_rd->bus_rd_ctx[ctx_id];
+	bus_rd_ctx->num_in_ports = in_acquire->num_in_res;
+	bus_rd_ctx->security_flag = in_acquire->secure_mode;
+	bus_rd_reg_val = cam_cre_hw_info->bus_rd_reg_val;
+
+	for (i = 0; i < in_acquire->num_in_res; i++) {
+		if (!in_acquire->in_res[i].width)
+			continue;
+
+		CAM_DBG(CAM_CRE, "i = %d format = %u width = 0x%x height = 0x%x res id %d",
+			i, in_acquire->in_res[i].format,
+			in_acquire->in_res[i].width,
+			in_acquire->in_res[i].height,
+			in_acquire->in_res[i].res_id);
+
+		in_port_idx =
+		cam_cre_bus_rd_in_port_idx(in_acquire->in_res[i].res_id);
+		if (in_port_idx < 0) {
+			CAM_ERR(CAM_CRE, "Invalid in_port_idx: %d", i + 1);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		in_port_to_rm = &bus_rd->in_port_to_rm[in_port_idx];
+		if (!in_port_to_rm->num_rm) {
+			CAM_ERR(CAM_CRE, "Invalid format for Input port");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		CAM_DBG(CAM_CRE, "i:%d port_id = %u format %u",
+			i, in_acquire->in_res[i].res_id,
+			in_acquire->in_res[i].format);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_cre_bus_rd_reg_set_update(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int i;
+	uint32_t num_reg_set;
+	struct cre_reg_set *rd_reg_set;
+	struct cam_cre_dev_reg_set_update *reg_set_upd_cmd =
+		(struct cam_cre_dev_reg_set_update *)data;
+
+	num_reg_set = reg_set_upd_cmd->cre_reg_buf.num_rd_reg_set;
+	rd_reg_set = reg_set_upd_cmd->cre_reg_buf.rd_reg_set;
+
+	for (i = 0; i < num_reg_set; i++) {
+		CAM_DBG(CAM_CRE, "base 0x%x CRE value 0x%x offset 0x%x",
+			cam_cre_hw_info->bus_rd_reg_offset->base,
+			rd_reg_set[i].value, rd_reg_set[i].offset);
+		cam_io_w_mb(rd_reg_set[i].value,
+			cam_cre_hw_info->bus_rd_reg_offset->base + rd_reg_set[i].offset);
+	}
+	return 0;
+}
+
+static int cam_cre_bus_rd_init(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	struct cam_cre_bus_rd_reg_val *bus_rd_reg_val;
+	struct cam_cre_bus_rd_reg *bus_rd_reg;
+	struct cam_cre_dev_init *dev_init = data;
+
+	if (!cam_cre_hw_info) {
+		CAM_ERR(CAM_CRE, "Invalid cam_cre_hw_info");
+		return -EINVAL;
+	}
+
+	bus_rd_reg_val = cam_cre_hw_info->bus_rd_reg_val;
+	bus_rd_reg = cam_cre_hw_info->bus_rd_reg_offset;
+	bus_rd_reg->base =
+	dev_init->core_info->cre_hw_info->cre_hw->bus_rd_reg_offset->base;
+
+	/* enable interrupt mask */
+	cam_io_w_mb(bus_rd_reg_val->irq_mask,
+		cam_cre_hw_info->bus_rd_reg_offset->base + bus_rd_reg->irq_mask);
+
+	return 0;
+}
+
+static int cam_cre_bus_rd_probe(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int i, k, rm_idx;
+	struct cam_cre_bus_rd_reg_val *bus_rd_reg_val;
+	struct cam_cre_bus_rd_reg *bus_rd_reg;
+	struct cre_bus_in_port_to_rm *in_port_to_rm;
+	uint32_t input_port_idx;
+
+	if (!cam_cre_hw_info) {
+		CAM_ERR(CAM_CRE, "Invalid cam_cre_hw_info");
+		return -EINVAL;
+	}
+
+	bus_rd = kzalloc(sizeof(struct cre_bus_rd), GFP_KERNEL);
+	if (!bus_rd) {
+		CAM_ERR(CAM_CRE, "Out of memory");
+		return -ENOMEM;
+	}
+	bus_rd->cre_hw_info = cam_cre_hw_info;
+	bus_rd_reg_val = cam_cre_hw_info->bus_rd_reg_val;
+	bus_rd_reg = cam_cre_hw_info->bus_rd_reg_offset;
+
+	for (i = 0; i < bus_rd_reg_val->num_clients; i++) {
+		input_port_idx =
+			bus_rd_reg_val->rd_clients[i].rm_port_id;
+		in_port_to_rm = &bus_rd->in_port_to_rm[input_port_idx];
+
+		rm_idx = in_port_to_rm->num_rm;
+		in_port_to_rm->input_port_id =
+			bus_rd_reg_val->rd_clients[i].input_port_id;
+		in_port_to_rm->rm_port_id[rm_idx] =
+			bus_rd_reg_val->rd_clients[i].rm_port_id;
+		in_port_to_rm->num_rm++;
+	}
+
+	for (i = 0; i < CRE_MAX_IN_RES; i++) {
+		in_port_to_rm = &bus_rd->in_port_to_rm[i];
+		CAM_DBG(CAM_CRE, "input port id = %d",
+			in_port_to_rm->input_port_id);
+			CAM_DBG(CAM_CRE, "num_rms = %d",
+				in_port_to_rm->num_rm);
+			for (k = 0; k < in_port_to_rm->num_rm; k++) {
+				CAM_DBG(CAM_CRE, "rm port id = %d",
+					in_port_to_rm->rm_port_id[k]);
+			}
+	}
+
+	return 0;
+}
+
+static int cam_cre_bus_rd_isr(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	uint32_t irq_status;
+	uint32_t const_violation_status;
+	uint32_t ccif_violation_status;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	struct cam_cre_bus_rd_reg *bus_rd_reg;
+	struct cam_cre_bus_rd_reg_val *bus_rd_reg_val;
+	struct cam_cre_irq_data *irq_data = data;
+
+	if (!cam_cre_hw_info) {
+		CAM_ERR(CAM_CRE, "Invalid cam_cre_hw_info");
+		return -EINVAL;
+	}
+
+	bus_rd_reg = cam_cre_hw_info->bus_rd_reg_offset;
+	bus_rd_reg_val = cam_cre_hw_info->bus_rd_reg_val;
+
+	/* Read and Clear Top Interrupt status */
+	irq_status = cam_io_r_mb(bus_rd_reg->base + bus_rd_reg->irq_status);
+	cam_io_w_mb(irq_status,
+		bus_rd_reg->base + bus_rd_reg->irq_clear);
+
+	cam_io_w_mb(bus_rd_reg_val->irq_cmd_clear,
+		bus_rd_reg->base + bus_rd_reg->irq_cmd);
+
+	CAM_DBG(CAM_CRE, "BUS irq_status 0x%x", irq_status);
+
+	if (irq_status & bus_rd_reg_val->rup_done)
+		CAM_DBG(CAM_CRE, "CRE Read Bus RUP done");
+
+	if (irq_status & bus_rd_reg_val->rd_buf_done)
+		CAM_DBG(CAM_CRE, "CRE Read Bus Buff done");
+
+	if ((irq_status & bus_rd_reg_val->cons_violation) ||
+		(irq_status & bus_rd_reg_val->ccif_violation)) {
+		irq_data->error = 1;
+		const_violation_status = cam_io_r_mb(bus_rd_reg->base +
+			bus_rd_reg->cons_violation);
+		ccif_violation_status = cam_io_r_mb(bus_rd_reg->base +
+			bus_rd_reg->ccif_violation);
+		debug_status_0 = cam_io_r_mb(bus_rd_reg->base +
+			bus_rd_reg->rd_clients[0].debug_status_0);
+		debug_status_1 = cam_io_r_mb(bus_rd_reg->base +
+			bus_rd_reg->rd_clients[0].debug_status_1);
+		CAM_DBG(CAM_CRE, "CRE Read Bus Violation");
+		CAM_DBG(CAM_CRE,
+			"violation status 0x%x 0x%x debug status 0/1 0x%x/0x%x",
+			const_violation_status, ccif_violation_status,
+			debug_status_0, debug_status_1);
+	}
+
+	return 0;
+}
+
+int cam_cre_bus_rd_process(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data)
+{
+	int rc = -EINVAL;
+
+	switch (cmd_id) {
+	case CRE_HW_PROBE:
+		CAM_DBG(CAM_CRE, "CRE_HW_PROBE: E");
+		rc = cam_cre_bus_rd_probe(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_PROBE: X");
+		break;
+	case CRE_HW_INIT:
+		CAM_DBG(CAM_CRE, "CRE_HW_INIT: E");
+		rc = cam_cre_bus_rd_init(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_INIT: X");
+		break;
+	case CRE_HW_ACQUIRE:
+		CAM_DBG(CAM_CRE, "CRE_HW_ACQUIRE: E");
+		rc = cam_cre_bus_rd_acquire(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_ACQUIRE: X");
+		break;
+	case CRE_HW_RELEASE:
+		CAM_DBG(CAM_CRE, "CRE_HW_RELEASE: E");
+		rc = cam_cre_bus_rd_release(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_RELEASE: X");
+		break;
+	case CRE_HW_PREPARE:
+		CAM_DBG(CAM_CRE, "CRE_HW_PREPARE: E");
+		rc = cam_cre_bus_rd_prepare(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_PREPARE: X");
+		break;
+	case CRE_HW_ISR:
+		rc = cam_cre_bus_rd_isr(cam_cre_hw_info, 0, data);
+		break;
+	case CRE_HW_REG_SET_UPDATE:
+		rc = cam_cre_bus_rd_reg_set_update(cam_cre_hw_info, 0, data);
+		break;
+	case CRE_HW_DEINIT:
+	case CRE_HW_START:
+	case CRE_HW_STOP:
+	case CRE_HW_FLUSH:
+	case CRE_HW_CLK_UPDATE:
+	case CRE_HW_BW_UPDATE:
+	case CRE_HW_RESET:
+	case CRE_HW_SET_IRQ_CB:
+		rc = 0;
+		CAM_DBG(CAM_CRE, "Unhandled cmds: %d", cmd_id);
+		break;
+	default:
+		CAM_ERR(CAM_CRE, "Unsupported cmd: %d", cmd_id);
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_rd/cre_bus_rd.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_rd/cre_bus_rd.h
@@ -0,0 +1,57 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CRE_BUS_RD_H
+#define CRE_BUS_RD_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_cre.h>
+#include "cre_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_soc_util.h"
+#include "cam_cre_hw_mgr.h"
+
+/**
+ * struct cre_bus_rd_ctx
+ *
+ * @cre_acquire:    CRE acquire structure
+ * @security_flag:  security flag
+ * @num_in_ports:   Number of in ports
+ */
+struct cre_bus_rd_ctx {
+	struct cam_cre_acquire_dev_info *cre_acquire;
+	bool security_flag;
+	uint32_t num_in_ports;
+};
+
+/**
+ * struct cre_bus_in_port_to_rm
+ *
+ * @input_port_id:  Intput port ID
+ * @num_rm:         Number of RMs
+ * @rm_port_id:     RM port Id
+ */
+struct cre_bus_in_port_to_rm {
+	uint32_t input_port_id;
+	uint32_t num_rm;
+	uint32_t rm_port_id[CRE_MAX_IN_RES];
+};
+
+/**
+ * struct cre_bus_rd
+ *
+ * @cre_hw_info:    CRE hardware info
+ * @in_port_to_rm:  IO port to RM mapping
+ * @bus_rd_ctx:     RM context
+ */
+struct cre_bus_rd {
+	struct cam_cre_hw *cre_hw_info;
+	struct cre_bus_in_port_to_rm in_port_to_rm[CRE_MAX_IN_RES];
+	struct cre_bus_rd_ctx *bus_rd_ctx[CRE_CTX_MAX];
+	struct completion reset_complete;
+};
+#endif /* CRE_BUS_RD_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_wr/cre_bus_wr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_wr/cre_bus_wr.c
@@ -0,0 +1,595 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/delay.h>
+#include "cam_io_util.h"
+#include "cam_hw_intf.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+#include "cre_core.h"
+#include "cre_hw.h"
+#include "cre_dev_intf.h"
+#include "cre_bus_wr.h"
+#include <media/cam_cre.h>
+
+static struct cre_bus_wr *wr_info;
+
+#define update_cre_reg_set(cre_reg_buf, off, val) \
+	do {                                           \
+		cre_reg_buf->wr_reg_set[cre_reg_buf->num_wr_reg_set].offset = (off); \
+		cre_reg_buf->wr_reg_set[cre_reg_buf->num_wr_reg_set].value = (val); \
+		cre_reg_buf->num_wr_reg_set++; \
+	} while (0)
+
+static uint32_t cam_cre_bus_wr_format_idx(uint32_t format)
+{
+	uint32_t format_idx = 0;
+
+	switch(format) {
+	case CAM_FORMAT_PLAIN128:
+		format_idx = 0x0;
+		break;
+	case CAM_FORMAT_PLAIN8:
+		format_idx = 0x1;
+		break;
+	case CAM_FORMAT_PLAIN8_SWAP:
+		format_idx = 0x2;
+		break;
+	case CAM_FORMAT_PLAIN8_10:
+		format_idx = 0x3;
+		break;
+	case CAM_FORMAT_PLAIN8_10_SWAP:
+		format_idx = 0x4;
+		break;
+	case CAM_FORMAT_PLAIN16_10:
+		format_idx = 0x5;
+		break;
+	case CAM_FORMAT_PLAIN16_12:
+		format_idx = 0x6;
+		break;
+	case CAM_FORMAT_PLAIN16_14:
+		format_idx = 0x7;
+		break;
+	case CAM_FORMAT_PLAIN16_16:
+		format_idx = 0x8;
+		break;
+	case CAM_FORMAT_PLAIN32:
+		format_idx = 0x9;
+		break;
+	case CAM_FORMAT_PLAIN64:
+		format_idx = 0xA;
+		break;
+	case CAM_FORMAT_PD10:
+		format_idx = 0xB;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		format_idx = 0xC;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		format_idx = 0xD;
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		format_idx = 0xE;
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		format_idx = 0xF;
+		break;
+	case CAM_FORMAT_PLAIN32_20:
+		format_idx = 0x10;
+		break;
+	default:
+		CAM_WARN(CAM_CRE, "Invalid format %d", format);
+		break;
+	}
+
+	return format_idx;
+}
+
+static int cam_cre_translate_write_format(struct plane_info p_info,
+	struct cam_cre_bus_wr_client_reg_val *wr_client_reg_val)
+{
+	CAM_DBG(CAM_CRE, "width 0x%x, height 0x%x stride 0x%x alignment 0x%x",
+		p_info.width, p_info.height, p_info.stride, p_info.alignment);
+
+	/* Number of output pixels */
+	wr_client_reg_val->width     = p_info.width;
+	/* Number of output bytes */
+	wr_client_reg_val->stride    = p_info.stride;
+	/* Number of output lines */
+	wr_client_reg_val->height    = p_info.height;
+	wr_client_reg_val->alignment = p_info.alignment;
+
+	wr_client_reg_val->format = p_info.format;
+
+	return 0;
+}
+
+static int cam_cre_bus_wr_out_port_idx(uint32_t output_port_id)
+{
+	int i;
+
+	for (i = 0; i < CRE_MAX_OUT_RES; i++)
+		if (wr_info->out_port_to_wm[i].output_port_id == output_port_id)
+			return i;
+
+	return -EINVAL;
+}
+
+static int cam_cre_bus_wr_reg_set_update(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int i;
+	uint32_t num_reg_set;
+	struct cre_reg_set *wr_reg_set;
+	struct cam_cre_dev_reg_set_update *reg_set_upd_cmd =
+		(struct cam_cre_dev_reg_set_update *)data;
+
+	num_reg_set = reg_set_upd_cmd->cre_reg_buf.num_wr_reg_set;
+	wr_reg_set = reg_set_upd_cmd->cre_reg_buf.wr_reg_set;
+
+	for (i = 0; i < num_reg_set; i++) {
+		CAM_DBG(CAM_CRE, "base 0x%x CRE value 0x%x offset 0x%x",
+				cam_cre_hw_info->bus_wr_reg_offset->base,
+				wr_reg_set[i].value, wr_reg_set[i].offset);
+		cam_io_w_mb(wr_reg_set[i].value,
+			cam_cre_hw_info->bus_wr_reg_offset->base + wr_reg_set[i].offset);
+	}
+	return 0;
+}
+
+static int cam_cre_bus_wr_release(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	if (ctx_id < 0 || ctx_id >= CRE_CTX_MAX) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	vfree(wr_info->bus_wr_ctx[ctx_id]);
+	wr_info->bus_wr_ctx[ctx_id] = NULL;
+
+	return 0;
+}
+
+static int cam_cre_bus_wr_update(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, struct cam_cre_dev_prepare_req *prepare,
+	int batch_idx, int io_idx,
+	struct cre_reg_buffer *cre_reg_buf)
+{
+	int rc, k, out_port_idx;
+	uint32_t req_idx;
+	uint32_t val = 0;
+	uint32_t format_idx = 0;
+	uint32_t iova_base, iova_offset;
+	struct cam_hw_prepare_update_args *prepare_args;
+	struct cam_cre_ctx *ctx_data;
+	struct cam_cre_request *cre_request;
+	struct cre_io_buf *io_buf;
+	struct cam_cre_bus_wr_reg *wr_reg;
+	struct cam_cre_bus_wr_client_reg *wr_reg_client;
+	struct cam_cre_bus_wr_reg_val *wr_reg_val;
+	struct cam_cre_bus_wr_client_reg_val *wr_client_reg_val;
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d %x", ctx_id, prepare);
+		return -EINVAL;
+	}
+
+	if (batch_idx >= CRE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_CRE, "Invalid batch idx: %d", batch_idx);
+		return -EINVAL;
+	}
+
+	if (io_idx >= CRE_MAX_IO_BUFS) {
+		CAM_ERR(CAM_CRE, "Invalid IO idx: %d", io_idx);
+		return -EINVAL;
+	}
+
+	prepare_args = prepare->prepare_args;
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+
+	cre_request = ctx_data->req_list[req_idx];
+	wr_reg = cam_cre_hw_info->bus_wr_reg_offset;
+	wr_reg_val = cam_cre_hw_info->bus_wr_reg_val;
+
+	CAM_DBG(CAM_CRE, "req_idx = %d req_id = %lld",
+		req_idx, cre_request->request_id);
+
+	io_buf = cre_request->io_buf[batch_idx][io_idx];
+	CAM_DBG(CAM_CRE, "batch = %d io buf num = %d dir = %d rsc %d",
+		batch_idx, io_idx, io_buf->direction, io_buf->resource_type);
+
+	out_port_idx =
+		cam_cre_bus_wr_out_port_idx(io_buf->resource_type);
+	if (out_port_idx < 0) {
+		CAM_ERR(CAM_CRE, "Invalid idx for rsc type: %d",
+			io_buf->resource_type);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CRE, "out_port_idx = %d", out_port_idx);
+
+	for (k = 0; k < io_buf->num_planes; k++) {
+		wr_reg_client = &wr_reg->wr_clients[out_port_idx];
+		wr_client_reg_val = &wr_reg_val->wr_clients[out_port_idx];
+
+		CAM_DBG(CAM_CRE, "wr_reg_client %x wr_client_reg_val %x",
+				wr_reg_client, wr_client_reg_val, wr_client_reg_val);
+
+		/* Core cfg: enable, Mode */
+		val = 0;
+		val |= ((wr_client_reg_val->mode &
+			wr_client_reg_val->mode_mask) <<
+			wr_client_reg_val->mode_shift);
+		val |= wr_client_reg_val->client_en;
+
+		update_cre_reg_set(cre_reg_buf,
+			wr_reg->offset + wr_reg_client->client_cfg,
+			val);
+
+		/*
+		 * As CRE have 36 Bit addressing support Image Address
+		 * register will have 28 bit MSB of 36 bit iova.
+		 * and addr_config will have 8 bit byte offset.
+		 */
+		iova_base = CAM_36BIT_INTF_GET_IOVA_BASE(io_buf->p_info[k].iova_addr);
+		update_cre_reg_set(cre_reg_buf,
+			wr_reg->offset + wr_reg_client->img_addr,
+			iova_base);
+		iova_offset = CAM_36BIT_INTF_GET_IOVA_OFFSET(io_buf->p_info[k].iova_addr);
+		update_cre_reg_set(cre_reg_buf,
+			wr_reg->offset + wr_reg_client->addr_cfg,
+			iova_offset);
+
+		rc = cam_cre_translate_write_format(io_buf->p_info[k],
+				wr_client_reg_val);
+		if (rc < 0)
+			return -EINVAL;
+
+		/* Buffer size */
+		val = 0;
+		val = wr_client_reg_val->width;
+		val |= (wr_client_reg_val->height &
+				wr_client_reg_val->height_mask) <<
+				wr_client_reg_val->height_shift;
+		update_cre_reg_set(cre_reg_buf,
+			wr_reg->offset + wr_reg_client->img_cfg_0,
+			val);
+
+		/* stride */
+		update_cre_reg_set(cre_reg_buf,
+			wr_reg->offset + wr_reg_client->img_cfg_2,
+			wr_client_reg_val->stride);
+
+		val = 0;
+		format_idx = cam_cre_bus_wr_format_idx(wr_client_reg_val->format);
+		val |= ((format_idx & wr_client_reg_val->format_mask) <<
+			wr_client_reg_val->format_shift);
+
+		/* Update alignment as LSB by default*/
+		val |= (0x1 << wr_client_reg_val->alignment_shift);
+
+		/* pack cfg : Format and alignment */
+		update_cre_reg_set(cre_reg_buf,
+			wr_reg->offset + wr_reg_client->packer_cfg,
+			val);
+
+		/* Upadte debug status CFG*/
+		val = 0xFFFF;
+		update_cre_reg_set(cre_reg_buf,
+			wr_reg->offset + wr_reg_client->debug_status_cfg,
+			val);
+	}
+
+	return 0;
+}
+
+static int cam_cre_bus_wr_prepare(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	int i, j = 0;
+	uint32_t req_idx;
+	struct cam_cre_dev_prepare_req *prepare;
+	struct cam_cre_ctx *ctx_data;
+	struct cam_cre_request *cre_request;
+	struct cre_io_buf *io_buf;
+	struct cre_reg_buffer *cre_reg_buf;
+
+	if (ctx_id < 0 || !data) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+	prepare = data;
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+
+	cre_request = ctx_data->req_list[req_idx];
+
+	CAM_DBG(CAM_CRE, "req_idx = %d req_id = %lld num_io_bufs = %d",
+		req_idx, cre_request->request_id, cre_request->num_io_bufs[0]);
+
+	for (i = 0; i < cre_request->num_batch; i++) {
+		cre_reg_buf = &cre_request->cre_reg_buf[i];
+		for (j = 0; j < cre_request->num_io_bufs[i]; j++) {
+			io_buf = cre_request->io_buf[i][j];
+			CAM_DBG(CAM_CRE, "batch = %d io buf num = %d",
+				i, j);
+			if (io_buf->direction != CAM_BUF_OUTPUT)
+				continue;
+
+			rc = cam_cre_bus_wr_update(cam_cre_hw_info,
+				ctx_id, prepare, i, j,
+				cre_reg_buf);
+			if (rc)
+				goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_cre_bus_wr_acquire(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i;
+	struct cam_cre_acquire_dev_info *in_acquire;
+	struct cre_bus_wr_ctx *bus_wr_ctx;
+	struct cre_bus_out_port_to_wm *out_port_to_wr;
+	int out_port_idx;
+
+	if (ctx_id < 0 || !data || ctx_id >= CRE_CTX_MAX) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+
+	wr_info->bus_wr_ctx[ctx_id] = vzalloc(sizeof(struct cre_bus_wr_ctx));
+	if (!wr_info->bus_wr_ctx[ctx_id]) {
+		CAM_ERR(CAM_CRE, "Out of memory");
+		return -ENOMEM;
+	}
+
+	wr_info->bus_wr_ctx[ctx_id]->cre_acquire = data;
+	in_acquire = data;
+	bus_wr_ctx = wr_info->bus_wr_ctx[ctx_id];
+	bus_wr_ctx->num_out_ports = in_acquire->num_out_res;
+	bus_wr_ctx->security_flag = in_acquire->secure_mode;
+
+	for (i = 0; i < in_acquire->num_out_res; i++) {
+		if (!in_acquire->out_res[i].width)
+			continue;
+
+		CAM_DBG(CAM_CRE, "i = %d format = %u width = 0x%x height = 0x%x res_id %d",
+			i, in_acquire->out_res[i].format,
+			in_acquire->out_res[i].width,
+			in_acquire->out_res[i].height,
+			in_acquire->in_res[i].res_id);
+
+		out_port_idx =
+		cam_cre_bus_wr_out_port_idx(in_acquire->out_res[i].res_id);
+		if (out_port_idx < 0) {
+			CAM_DBG(CAM_CRE, "Invalid out_port_idx: %d",
+				in_acquire->out_res[i].res_id);
+			rc = -EINVAL;
+			goto end;
+		}
+		CAM_DBG(CAM_CRE, "out_port_idx %d", out_port_idx);
+		out_port_to_wr = &wr_info->out_port_to_wm[out_port_idx];
+		if (!out_port_to_wr->num_wm) {
+			CAM_DBG(CAM_CRE, "Invalid format for Input port");
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_cre_bus_wr_init(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	struct cam_cre_bus_wr_reg_val *bus_wr_reg_val;
+	struct cam_cre_bus_wr_reg *bus_wr_reg;
+	struct cam_cre_dev_init *dev_init = data;
+
+	if (!cam_cre_hw_info) {
+		CAM_ERR(CAM_CRE, "Invalid cam_cre_hw_info");
+		return -EINVAL;
+	}
+
+	wr_info->cre_hw_info = cam_cre_hw_info;
+	bus_wr_reg_val = cam_cre_hw_info->bus_wr_reg_val;
+	bus_wr_reg = cam_cre_hw_info->bus_wr_reg_offset;
+	bus_wr_reg->base = dev_init->core_info->cre_hw_info->cre_bus_wr_base;
+
+	CAM_DBG(CAM_CRE, "bus_wr_reg->base 0x%x", bus_wr_reg->base);
+
+	cam_io_w_mb(bus_wr_reg_val->irq_mask_0,
+		bus_wr_reg->base + bus_wr_reg->irq_mask_0);
+	cam_io_w_mb(bus_wr_reg_val->irq_mask_1,
+		bus_wr_reg->base + bus_wr_reg->irq_mask_1);
+
+	return 0;
+}
+
+static int cam_cre_bus_wr_probe(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int i, k;
+	struct cam_cre_bus_wr_reg_val *bus_wr_reg_val;
+	struct cre_bus_out_port_to_wm *out_port_to_wm;
+	uint32_t output_port_idx;
+	uint32_t wm_idx;
+
+	if (!cam_cre_hw_info) {
+		CAM_ERR(CAM_CRE, "Invalid cam_cre_hw_info");
+		return -EINVAL;
+	}
+	wr_info = kzalloc(sizeof(struct cre_bus_wr), GFP_KERNEL);
+	if (!wr_info) {
+		CAM_ERR(CAM_CRE, "Out of memory");
+		return -ENOMEM;
+	}
+
+	wr_info->cre_hw_info = cam_cre_hw_info;
+	bus_wr_reg_val = cam_cre_hw_info->bus_wr_reg_val;
+
+	for (i = 0; i < bus_wr_reg_val->num_clients; i++) {
+		output_port_idx =
+			bus_wr_reg_val->wr_clients[i].wm_port_id;
+		out_port_to_wm = &wr_info->out_port_to_wm[output_port_idx];
+		wm_idx = out_port_to_wm->num_wm;
+		out_port_to_wm->output_port_id =
+			bus_wr_reg_val->wr_clients[i].output_port_id;
+		out_port_to_wm->wm_port_id[wm_idx] =
+			bus_wr_reg_val->wr_clients[i].wm_port_id;
+		out_port_to_wm->num_wm++;
+	}
+
+	for (i = 0; i < CRE_MAX_OUT_RES; i++) {
+		out_port_to_wm = &wr_info->out_port_to_wm[i];
+		CAM_DBG(CAM_CRE, "output port id = %d",
+			out_port_to_wm->output_port_id);
+		CAM_DBG(CAM_CRE, "num_wms = %d",
+			out_port_to_wm->num_wm);
+		for (k = 0; k < out_port_to_wm->num_wm; k++) {
+			CAM_DBG(CAM_CRE, "wm port id = %d",
+				out_port_to_wm->wm_port_id[k]);
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cre_bus_wr_isr(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	uint32_t irq_status_0, irq_status_1;
+	struct cam_cre_bus_wr_reg *bus_wr_reg;
+	struct cam_cre_bus_wr_reg_val *bus_wr_reg_val;
+	struct cam_cre_irq_data *irq_data = data;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	uint32_t img_violation_status;
+	uint32_t violation_status;
+	int i;
+
+	if (!cam_cre_hw_info || !irq_data) {
+		CAM_ERR(CAM_CRE, "Invalid cam_cre_hw_info");
+		return -EINVAL;
+	}
+
+	bus_wr_reg = cam_cre_hw_info->bus_wr_reg_offset;
+	bus_wr_reg_val = cam_cre_hw_info->bus_wr_reg_val;
+
+	/* Read and Clear Top Interrupt status */
+	irq_status_0 = cam_io_r_mb(bus_wr_reg->base + bus_wr_reg->irq_status_0);
+	irq_status_1 = cam_io_r_mb(bus_wr_reg->base + bus_wr_reg->irq_status_1);
+
+	CAM_DBG(CAM_CRE, "BUS irq_status_0 0x%x irq_status_1 0x%x",
+		irq_status_0, irq_status_1);
+
+	cam_io_w_mb(irq_status_0,
+		bus_wr_reg->base + bus_wr_reg->irq_clear_0);
+	cam_io_w_mb(irq_status_1,
+		bus_wr_reg->base + bus_wr_reg->irq_clear_1);
+
+	cam_io_w_mb(bus_wr_reg_val->irq_cmd_clear,
+		bus_wr_reg->base + bus_wr_reg->irq_cmd);
+
+	if (irq_status_0 & bus_wr_reg_val->cons_violation) {
+		irq_data->error = 1;
+		CAM_ERR(CAM_CRE, "cre bus wr cons_violation");
+	}
+
+	if ((irq_status_0 & bus_wr_reg_val->violation) ||
+		(irq_status_0 & bus_wr_reg_val->img_size_violation) ||
+		(irq_status_0 & bus_wr_reg_val->cons_violation)) {
+		irq_data->error = 1;
+		img_violation_status = cam_io_r_mb(bus_wr_reg->base +
+			bus_wr_reg->image_size_violation_status);
+		violation_status = cam_io_r_mb(bus_wr_reg->base +
+			bus_wr_reg->violation_status);
+
+		debug_status_0 = cam_io_r_mb(bus_wr_reg->base +
+			bus_wr_reg->wr_clients[0].debug_status_0);
+		debug_status_1 = cam_io_r_mb(bus_wr_reg->base +
+			bus_wr_reg->wr_clients[0].debug_status_1);
+		CAM_ERR(CAM_CRE,
+			"violation status 0x%x 0x%x debug status 0/1 0x%x/0x%x",
+			violation_status, img_violation_status,
+			debug_status_0, debug_status_1);
+	}
+
+	if (irq_status_0 & bus_wr_reg_val->comp_buf_done) {
+		for (i = 0; i < bus_wr_reg_val->num_clients; i++) {
+			if (irq_status_1 & bus_wr_reg_val->
+				wr_clients[i].client_buf_done)
+				CAM_INFO(CAM_CRE, "Cleint %d Buff done", i);
+				irq_data->wr_buf_done = 1 << i;
+		}
+	}
+
+	return 0;
+}
+
+int cam_cre_bus_wr_process(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data)
+{
+	int rc = 0;
+
+	switch (cmd_id) {
+	case CRE_HW_PROBE:
+		CAM_DBG(CAM_CRE, "CRE_HW_PROBE: E");
+		rc = cam_cre_bus_wr_probe(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_PROBE: X");
+		break;
+	case CRE_HW_INIT:
+		CAM_DBG(CAM_CRE, "CRE_HW_INIT: E");
+		rc = cam_cre_bus_wr_init(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_INIT: X");
+		break;
+	case CRE_HW_ACQUIRE:
+		CAM_DBG(CAM_CRE, "CRE_HW_ACQUIRE: E");
+		rc = cam_cre_bus_wr_acquire(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_ACQUIRE: X");
+		break;
+	case CRE_HW_RELEASE:
+		CAM_DBG(CAM_CRE, "CRE_HW_RELEASE: E");
+		rc = cam_cre_bus_wr_release(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_RELEASE: X");
+		break;
+	case CRE_HW_PREPARE:
+		CAM_DBG(CAM_CRE, "CRE_HW_PREPARE: E");
+		rc = cam_cre_bus_wr_prepare(cam_cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_PREPARE: X");
+		break;
+	case CRE_HW_REG_SET_UPDATE:
+		rc = cam_cre_bus_wr_reg_set_update(cam_cre_hw_info, 0, data);
+		break;
+	case CRE_HW_DEINIT:
+	case CRE_HW_START:
+	case CRE_HW_STOP:
+	case CRE_HW_FLUSH:
+	case CRE_HW_CLK_UPDATE:
+	case CRE_HW_BW_UPDATE:
+	case CRE_HW_RESET:
+	case CRE_HW_SET_IRQ_CB:
+		rc = 0;
+		CAM_DBG(CAM_CRE, "Unhandled cmds: %d", cmd_id);
+		break;
+	case CRE_HW_ISR:
+		rc = cam_cre_bus_wr_isr(cam_cre_hw_info, 0, data);
+		break;
+	default:
+		CAM_ERR(CAM_CRE, "Unsupported cmd: %d", cmd_id);
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_wr/cre_bus_wr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/bus_wr/cre_bus_wr.h
@@ -0,0 +1,57 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CRE_BUS_WR_H
+#define CRE_BUS_WR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_cre.h>
+#include "cre_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_soc_util.h"
+#include "cam_cre_hw_mgr.h"
+
+/**
+ * struct cre_bus_out_port_to_wm
+ *
+ * @output_port_id: Output port ID
+ * @num_combos:     Number of combos
+ * @num_wm:         Number of WMs
+ * @wm_port_id:     WM port Id
+ */
+struct cre_bus_out_port_to_wm {
+	uint32_t output_port_id;
+	uint32_t num_wm;
+	uint32_t wm_port_id[CRE_MAX_OUT_RES];
+};
+
+/**
+ * struct cre_bus_wr_ctx
+ *
+ * @cre_acquire:       CRE acquire structure
+ * @security_flag:     security flag
+ * @num_out_ports:     Number of out ports
+ */
+struct cre_bus_wr_ctx {
+	struct cam_cre_acquire_dev_info *cre_acquire;
+	bool security_flag;
+	uint32_t num_out_ports;
+};
+
+/**
+ * struct cre_bus_wr
+ *
+ * @cre_hw_info:    CRE hardware info
+ * @out_port_to_wm: IO port to WM mapping
+ * @bus_wr_ctx:     WM context
+ */
+struct cre_bus_wr {
+	struct cam_cre_hw *cre_hw_info;
+	struct cre_bus_out_port_to_wm out_port_to_wm[CRE_MAX_OUT_RES];
+	struct cre_bus_wr_ctx *bus_wr_ctx[CRE_CTX_MAX];
+};
+#endif /* CRE_BUS_WR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_core.c
@@ -0,0 +1,577 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cre_core.h"
+#include "cre_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cre_hw_intf.h"
+#include "cam_cre_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cre_dev_intf.h"
+#include "cam_compat.h"
+#include "cre_bus_wr.h"
+#include "cre_bus_rd.h"
+
+#define CAM_CRE_RESET_TIMEOUT msecs_to_jiffies(500)
+
+struct cam_cre_irq_data irq_data;
+
+static int cam_cre_caps_vote(struct cam_cre_device_core_info *core_info,
+	struct cam_cre_dev_bw_update *cpas_vote)
+{
+	int rc = 0;
+
+	if (cpas_vote->ahb_vote_valid)
+		rc = cam_cpas_update_ahb_vote(core_info->cpas_handle,
+			&cpas_vote->ahb_vote);
+	if (cpas_vote->axi_vote_valid)
+		rc = cam_cpas_update_axi_vote(core_info->cpas_handle,
+			&cpas_vote->axi_vote);
+	if (rc)
+		CAM_ERR(CAM_CRE, "cpas vote is failed: %d", rc);
+
+	return rc;
+}
+
+int cam_cre_get_hw_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *cre_dev = hw_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cre_device_core_info *core_info = NULL;
+	struct cam_cre_hw_ver *cre_hw_ver;
+	struct cam_cre_top_reg_val *top_reg_val;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_CRE, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &cre_dev->soc_info;
+	core_info = (struct cam_cre_device_core_info *)cre_dev->core_info;
+
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_CRE, "soc_info = %x core_info = %x",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	if (!get_hw_cap_args) {
+		CAM_ERR(CAM_CRE, "Invalid caps");
+		return -EINVAL;
+	}
+
+	top_reg_val = core_info->cre_hw_info->cre_hw->top_reg_val;
+	cre_hw_ver = get_hw_cap_args;
+	cre_hw_ver->hw_ver.major =
+		(core_info->hw_version & top_reg_val->major_mask) >>
+		top_reg_val->major_shift;
+	cre_hw_ver->hw_ver.minor =
+		(core_info->hw_version & top_reg_val->minor_mask) >>
+		top_reg_val->minor_shift;
+
+	return 0;
+}
+
+static int cam_cre_dev_process_init(struct cam_cre_hw *cre_hw,
+	void *cmd_args)
+{
+	int rc = 0;
+
+	rc = cam_cre_top_process(cre_hw, 0, CRE_HW_INIT, cmd_args);
+	if (rc)
+		goto top_init_fail;
+
+	rc = cam_cre_bus_wr_process(cre_hw, 0, CRE_HW_INIT, cmd_args);
+		if (rc)
+			goto bus_wr_init_fail;
+
+	rc = cam_cre_bus_rd_process(cre_hw, 0, CRE_HW_INIT, cmd_args);
+		if (rc)
+			goto bus_rd_init_fail;
+
+	return rc;
+
+bus_rd_init_fail:
+	rc = cam_cre_bus_wr_process(cre_hw, 0,
+		CRE_HW_DEINIT, NULL);
+bus_wr_init_fail:
+	rc = cam_cre_top_process(cre_hw, 0,
+		CRE_HW_DEINIT, NULL);
+top_init_fail:
+	return rc;
+}
+
+static int cam_cre_process_init(struct cam_cre_hw *cre_hw,
+	void *cmd_args)
+{
+	return cam_cre_dev_process_init(cre_hw, cmd_args);
+}
+
+int cam_cre_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cre_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cre_device_core_info *core_info = NULL;
+	struct cam_cre_cpas_vote *cpas_vote;
+	int rc = 0;
+	struct cam_cre_dev_init *init;
+	struct cam_cre_hw *cre_hw;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_CRE, "Invalid cam_dev_info");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_info = &cre_dev->soc_info;
+	core_info = (struct cam_cre_device_core_info *)cre_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_CRE, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		rc = -EINVAL;
+		goto end;
+	}
+	cre_hw = core_info->cre_hw_info->cre_hw;
+
+	cpas_vote = kzalloc(sizeof(struct cam_cre_cpas_vote), GFP_KERNEL);
+	if (!cpas_vote) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	cpas_vote->ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote->ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	cpas_vote->axi_vote.num_paths = 1;
+	cpas_vote->axi_vote.axi_path[0].path_data_type =
+		CAM_AXI_PATH_DATA_ALL;
+	cpas_vote->axi_vote.axi_path[0].transac_type =
+		CAM_AXI_TRANSACTION_WRITE;
+	cpas_vote->axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote->ahb_vote, &cpas_vote->axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CRE, "cpass start failed: %d", rc);
+		goto free_cpas_vote;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_cre_enable_soc_resources(soc_info);
+	if (rc)
+		goto enable_soc_resource_failed;
+	else
+		core_info->clk_enable = true;
+
+	init = init_hw_args;
+
+	init->core_info = core_info;
+	rc = cam_cre_process_init(cre_hw, init_hw_args);
+	if (rc)
+		goto process_init_failed;
+	else
+		goto free_cpas_vote;
+
+process_init_failed:
+	if (cam_cre_disable_soc_resources(soc_info))
+		CAM_ERR(CAM_CRE, "disable soc resource failed");
+enable_soc_resource_failed:
+	if (cam_cpas_stop(core_info->cpas_handle))
+		CAM_ERR(CAM_CRE, "cpas stop is failed");
+	else
+		core_info->cpas_start = false;
+free_cpas_vote:
+	cam_free_clear((void *)cpas_vote);
+	cpas_vote = NULL;
+end:
+	return rc;
+}
+
+int cam_cre_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cre_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cre_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_CRE, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &cre_dev->soc_info;
+	core_info = (struct cam_cre_device_core_info *)cre_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_CRE, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	rc = cam_cre_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_CRE, "soc disable is failed : %d", rc);
+	core_info->clk_enable = false;
+
+	if (cam_cpas_stop(core_info->cpas_handle))
+		CAM_ERR(CAM_CRE, "cpas stop is failed");
+	else
+		core_info->cpas_start = false;
+
+	return rc;
+}
+
+static int cam_cre_dev_process_dump_debug_reg(struct cam_cre_hw *cre_hw)
+{
+	int rc = 0;
+
+	rc = cam_cre_top_process(cre_hw, -1,
+		CRE_HW_DUMP_DEBUG, NULL);
+
+	return rc;
+}
+
+static int cam_cre_dev_process_reset(struct cam_cre_hw *cre_hw, void *cmd_args)
+{
+	int rc = 0;
+
+	rc = cam_cre_top_process(cre_hw, -1,
+		CRE_HW_RESET, NULL);
+
+	return rc;
+}
+
+static int cam_cre_dev_process_release(struct cam_cre_hw *cre_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_cre_dev_release *cre_dev_release;
+
+	cre_dev_release = cmd_args;
+	rc = cam_cre_top_process(cre_hw, cre_dev_release->ctx_id,
+		CRE_HW_RELEASE, NULL);
+
+	rc |= cam_cre_bus_wr_process(cre_hw, cre_dev_release->ctx_id,
+		CRE_HW_RELEASE, NULL);
+
+	rc |= cam_cre_bus_rd_process(cre_hw, cre_dev_release->ctx_id,
+		CRE_HW_RELEASE, NULL);
+
+	return rc;
+}
+
+static int cam_cre_dev_process_acquire(struct cam_cre_hw *cre_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_cre_dev_acquire *cre_dev_acquire;
+
+	if (!cmd_args || !cre_hw) {
+		CAM_ERR(CAM_CRE, "Invalid arguments: %pK %pK",
+		cmd_args, cre_hw);
+		return -EINVAL;
+	}
+
+	cre_dev_acquire = cmd_args;
+	rc = cam_cre_top_process(cre_hw, cre_dev_acquire->ctx_id,
+		CRE_HW_ACQUIRE, cre_dev_acquire);
+	if (rc)
+		goto top_acquire_fail;
+
+	rc = cam_cre_bus_wr_process(cre_hw, cre_dev_acquire->ctx_id,
+		CRE_HW_ACQUIRE, cre_dev_acquire->cre_acquire);
+	if (rc)
+		goto bus_wr_acquire_fail;
+
+	rc = cam_cre_bus_rd_process(cre_hw, cre_dev_acquire->ctx_id,
+		CRE_HW_ACQUIRE, cre_dev_acquire->cre_acquire);
+	if (rc)
+		goto bus_rd_acquire_fail;
+
+	return 0;
+
+bus_rd_acquire_fail:
+	cam_cre_bus_wr_process(cre_hw, cre_dev_acquire->ctx_id,
+		CRE_HW_RELEASE, cre_dev_acquire->cre_acquire);
+bus_wr_acquire_fail:
+	cam_cre_top_process(cre_hw, cre_dev_acquire->ctx_id,
+		CRE_HW_RELEASE, cre_dev_acquire->cre_acquire);
+top_acquire_fail:
+	return rc;
+}
+
+static int cam_cre_dev_process_reg_set_update(struct cam_cre_hw *cre_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_cre_dev_reg_set_update *reg_set_update;
+
+	reg_set_update = cmd_args;
+
+	rc = cam_cre_top_process(cre_hw, 0,
+		CRE_HW_REG_SET_UPDATE, reg_set_update);
+	if (rc)
+		goto end;
+
+	rc = cam_cre_bus_wr_process(cre_hw, 0,
+		CRE_HW_REG_SET_UPDATE, reg_set_update);
+	if (rc)
+		goto end;
+
+	rc = cam_cre_bus_rd_process(cre_hw, 0,
+		CRE_HW_REG_SET_UPDATE, reg_set_update);
+	if (rc)
+		goto end;
+
+end:
+	return rc;
+}
+
+static int cam_cre_dev_process_prepare(struct cam_cre_hw *cre_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_cre_dev_prepare_req *cre_dev_prepare_req;
+
+	cre_dev_prepare_req = cmd_args;
+
+	rc = cam_cre_top_process(cre_hw, cre_dev_prepare_req->ctx_data->ctx_id,
+		CRE_HW_PREPARE, cre_dev_prepare_req);
+	if (rc)
+		goto end;
+
+	rc = cam_cre_bus_wr_process(cre_hw,
+		cre_dev_prepare_req->ctx_data->ctx_id,
+		CRE_HW_PREPARE, cre_dev_prepare_req);
+	if (rc)
+		goto end;
+
+	rc = cam_cre_bus_rd_process(cre_hw,
+		cre_dev_prepare_req->ctx_data->ctx_id,
+		CRE_HW_PREPARE, cre_dev_prepare_req);
+	if (rc)
+		goto end;
+
+end:
+	return rc;
+}
+
+static int cam_cre_dev_process_probe(struct cam_cre_hw *cre_hw,
+	void *cmd_args)
+{
+	cam_cre_top_process(cre_hw, -1, CRE_HW_PROBE, NULL);
+	cam_cre_bus_wr_process(cre_hw, -1, CRE_HW_PROBE, NULL);
+	cam_cre_bus_rd_process(cre_hw, -1, CRE_HW_PROBE, NULL);
+
+	return 0;
+}
+
+static int cam_cre_process_probe(struct cam_cre_hw *cre_hw,
+	void *cmd_args)
+{
+	return cam_cre_dev_process_probe(cre_hw, cmd_args);
+}
+
+static int cam_cre_process_dump_debug_reg(struct cam_cre_hw *cre_hw)
+{
+	return cam_cre_dev_process_dump_debug_reg(cre_hw);
+}
+
+static int cam_cre_process_reset(struct cam_cre_hw *cre_hw,
+	void *cmd_args)
+{
+	return cam_cre_dev_process_reset(cre_hw, cmd_args);
+}
+
+static int cam_cre_process_release(struct cam_cre_hw *cre_hw,
+	void *cmd_args)
+{
+	return cam_cre_dev_process_release(cre_hw, cmd_args);
+}
+
+static int cam_cre_process_acquire(struct cam_cre_hw *cre_hw,
+	void *cmd_args)
+{
+	return cam_cre_dev_process_acquire(cre_hw, cmd_args);
+}
+
+static int cam_cre_process_prepare(struct cam_cre_hw *cre_hw,
+	void *cmd_args)
+{
+	return cam_cre_dev_process_prepare(cre_hw, cmd_args);
+}
+
+static int cam_cre_process_reg_set_update(struct cam_cre_hw *cre_hw,
+	void *cmd_args)
+{
+	return cam_cre_dev_process_reg_set_update(cre_hw, cmd_args);
+}
+
+int cam_cre_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_hw_info *cre_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cre_device_core_info *core_info = NULL;
+	struct cam_cre_hw *cre_hw;
+	unsigned long flags;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_CRE, "Invalid args %x for cmd %u",
+			device_priv, cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &cre_dev->soc_info;
+	core_info = (struct cam_cre_device_core_info *)cre_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_CRE, "soc_info = %x core_info = %x",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	cre_hw = core_info->cre_hw_info->cre_hw;
+	if (!cre_hw) {
+		CAM_ERR(CAM_CRE, "Invalid cre hw info");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CRE_HW_PROBE:
+		rc = cam_cre_process_probe(cre_hw, cmd_args);
+		break;
+	case CRE_HW_ACQUIRE:
+		rc = cam_cre_process_acquire(cre_hw, cmd_args);
+		break;
+	case CRE_HW_RELEASE:
+		rc = cam_cre_process_release(cre_hw, cmd_args);
+		break;
+	case CRE_HW_PREPARE:
+		rc = cam_cre_process_prepare(cre_hw, cmd_args);
+		break;
+	case CRE_HW_START:
+		break;
+	case CRE_HW_STOP:
+		break;
+	case CRE_HW_FLUSH:
+		break;
+	case CRE_HW_RESET:
+		rc = cam_cre_process_reset(cre_hw, cmd_args);
+		break;
+	case CRE_HW_CLK_UPDATE: {
+		struct cam_cre_dev_clk_update *clk_upd_cmd =
+			(struct cam_cre_dev_clk_update *)cmd_args;
+
+		if (!core_info->clk_enable) {
+			rc = cam_soc_util_clk_enable_default(soc_info, CAM_CLK_SW_CLIENT_IDX,
+				soc_info->lowest_clk_level);
+			if (rc) {
+				CAM_ERR(CAM_CRE, "Clock enable is failed");
+				return rc;
+			}
+			core_info->clk_enable = true;
+		}
+
+		rc = cam_cre_update_clk_rate(soc_info, clk_upd_cmd->clk_rate);
+		if (rc)
+			CAM_ERR(CAM_CRE, "Failed to update clk: %d", rc);
+		}
+		break;
+	case CRE_HW_CLK_DISABLE: {
+		if (core_info->clk_enable)
+			cam_soc_util_clk_disable_default(soc_info, CAM_CLK_SW_CLIENT_IDX);
+
+		core_info->clk_enable = false;
+		}
+		break;
+	case CRE_HW_BW_UPDATE: {
+		struct cam_cre_dev_bw_update *cpas_vote = cmd_args;
+
+		if (!cmd_args)
+			return -EINVAL;
+
+		rc = cam_cre_caps_vote(core_info, cpas_vote);
+		if (rc)
+			CAM_ERR(CAM_CRE, "failed to update bw: %d", rc);
+		}
+		break;
+	case CRE_HW_SET_IRQ_CB: {
+		struct cam_cre_set_irq_cb *irq_cb = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_CRE, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		spin_lock_irqsave(&cre_dev->hw_lock, flags);
+		core_info->irq_cb.cre_hw_mgr_cb = irq_cb->cre_hw_mgr_cb;
+		core_info->irq_cb.data = irq_cb->data;
+		spin_unlock_irqrestore(&cre_dev->hw_lock, flags);
+		}
+		break;
+	case CRE_HW_REG_SET_UPDATE:
+		rc = cam_cre_process_reg_set_update(cre_hw, cmd_args);
+		break;
+	case CRE_HW_DUMP_DEBUG:
+		rc = cam_cre_process_dump_debug_reg(cre_hw);
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+irqreturn_t cam_cre_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *cre_dev = data;
+	struct cam_cre_device_core_info *core_info = NULL;
+	struct cam_cre_hw *cre_hw;
+
+	if (!data) {
+		CAM_ERR(CAM_CRE, "Invalid cam_dev_info or query_cap args");
+		return IRQ_HANDLED;
+	}
+
+	core_info = (struct cam_cre_device_core_info *)cre_dev->core_info;
+	cre_hw = core_info->cre_hw_info->cre_hw;
+
+	irq_data.error = 0;
+	irq_data.wr_buf_done = 0;
+
+	cam_cre_top_process(cre_hw, 0, CRE_HW_ISR, &irq_data);
+
+	if (irq_data.top_irq_status & CAM_CRE_WE_IRQ)
+		cam_cre_bus_wr_process(cre_hw, 0, CRE_HW_ISR, &irq_data);
+	if (irq_data.top_irq_status & CAM_CRE_FE_IRQ)
+		cam_cre_bus_rd_process(cre_hw, 0, CRE_HW_ISR, &irq_data);
+
+	spin_lock(&cre_dev->hw_lock);
+	CAM_DBG(CAM_CRE, "core_info->irq_cb.cre_hw_mgr_cb %x core_info->irq_cb.data %x",
+			core_info->irq_cb.cre_hw_mgr_cb, core_info->irq_cb.data);
+	if (core_info->irq_cb.cre_hw_mgr_cb && core_info->irq_cb.data)
+		if (irq_data.error || irq_data.wr_buf_done)
+			core_info->irq_cb.cre_hw_mgr_cb(&irq_data,
+				sizeof(struct cam_hw_info),
+				core_info->irq_cb.data);
+	spin_unlock(&cre_dev->hw_lock);
+
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_core.h
@@ -0,0 +1,89 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_CRE_CORE_H
+#define CAM_CRE_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/dma-buf.h>
+#include <media/cam_cre.h>
+#include "cam_cpas_api.h"
+#include "cre_hw.h"
+#include "cam_cre_hw_intf.h"
+
+#define CAM_CRE_IDLE_IRQ  0x8
+#define CAM_CRE_FE_IRQ 0x4
+#define CAM_CRE_WE_IRQ 0x2
+#define CAM_CRE_RESET_IRQ 0x1
+
+/**
+ * struct cam_cre_cpas_vote
+ * @ahb_vote: AHB vote info
+ * @axi_vote: AXI vote info
+ * @ahb_vote_valid: Flag for ahb vote data
+ * @axi_vote_valid: flag for axi vote data
+ */
+struct cam_cre_cpas_vote {
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote;
+	uint32_t ahb_vote_valid;
+	uint32_t axi_vote_valid;
+};
+
+
+struct cam_cre_device_hw_info {
+	struct cam_cre_hw *cre_hw;
+	uint32_t hw_idx;
+	void *cre_top_base;
+	void *cre_qos_base;
+	void *cre_pp_base;
+	void *cre_bus_rd_base;
+	void *cre_bus_wr_base;
+	uint32_t reserved;
+};
+
+struct cam_cre_device_core_info {
+	struct   cam_cre_device_hw_info *cre_hw_info;
+	uint32_t hw_version;
+	uint32_t hw_idx;
+	uint32_t hw_type;
+	uint32_t cpas_handle;
+	bool     cpas_start;
+	bool     clk_enable;
+	struct   cam_cre_set_irq_cb irq_cb;
+};
+
+int cam_cre_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_cre_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_cre_start_hw(void *device_priv,
+	void *start_hw_args, uint32_t arg_size);
+int cam_cre_stop_hw(void *device_priv,
+	void *stop_hw_args, uint32_t arg_size);
+int cam_cre_reset_hw(void *device_priv,
+	void *reset_hw_args, uint32_t arg_size);
+int cam_cre_flush_hw(void *device_priv,
+	void *flush_args, uint32_t arg_size);
+int cam_cre_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_cre_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+irqreturn_t cam_cre_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register CRE hw to platform framework.
+ * @return struct platform_device pointer on success, or ERR_PTR() on error.
+ */
+int cam_cre_init_module(void);
+
+/**
+ * @brief : API to remove CRE Hw from platform framework.
+ */
+void cam_cre_exit_module(void);
+#endif /* CAM_CRE_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_dev.c
@@ -0,0 +1,325 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/module.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+
+#include "cam_node.h"
+#include "cre_core.h"
+#include "cre_soc.h"
+#include "cam_hw.h"
+#include "cre_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_cre_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cre_hw_100.h"
+#include "cre_hw_110.h"
+#include "cre_dev_intf.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+
+static struct cam_cre_hw_intf_data cam_cre_dev_list[CRE_DEV_MAX];
+static struct cam_cre_device_hw_info cre_hw_info;
+static struct cam_cre_soc_private cre_soc_info;
+
+static char cre_dev_name[8];
+
+static struct cre_hw_version_reg cre_hw_version_reg = {
+	.hw_ver = 0x0,
+};
+
+static int cam_cre_init_hw_version(struct cam_hw_soc_info *soc_info,
+	struct cam_cre_device_core_info *core_info)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CRE, "soc_info = %x core_info = %x",
+		soc_info, core_info);
+	CAM_DBG(CAM_CRE, "TOP: %x RD: %x WR: %x",
+		soc_info->reg_map[CRE_TOP_BASE].mem_base,
+		soc_info->reg_map[CRE_BUS_RD].mem_base,
+		soc_info->reg_map[CRE_BUS_WR].mem_base);
+
+	core_info->cre_hw_info->cre_top_base =
+		soc_info->reg_map[CRE_TOP_BASE].mem_base;
+	core_info->cre_hw_info->cre_bus_rd_base =
+		soc_info->reg_map[CRE_BUS_RD].mem_base;
+	core_info->cre_hw_info->cre_bus_wr_base =
+		soc_info->reg_map[CRE_BUS_WR].mem_base;
+
+	core_info->hw_version = cam_io_r_mb(
+			core_info->cre_hw_info->cre_top_base +
+			cre_hw_version_reg.hw_ver);
+
+	switch (core_info->hw_version) {
+	case CRE_HW_VER_1_0_0:
+		core_info->cre_hw_info->cre_hw = &cre_hw_100;
+
+		cre_hw_100.top_reg_offset->base = core_info->cre_hw_info->cre_top_base;
+		cre_hw_100.bus_rd_reg_offset->base = core_info->cre_hw_info->cre_bus_rd_base;
+		cre_hw_100.bus_wr_reg_offset->base = core_info->cre_hw_info->cre_bus_wr_base;
+		break;
+	case CRE_HW_VER_1_1_0:
+		core_info->cre_hw_info->cre_hw = &cre_hw_110;
+
+		cre_hw_110.top_reg_offset->base = core_info->cre_hw_info->cre_top_base;
+		cre_hw_110.bus_rd_reg_offset->base = core_info->cre_hw_info->cre_bus_rd_base;
+		cre_hw_110.bus_wr_reg_offset->base = core_info->cre_hw_info->cre_bus_wr_base;
+		break;
+	default:
+		CAM_ERR(CAM_CRE, "Unsupported version : %u",
+			core_info->hw_version);
+		rc = -EINVAL;
+		break;
+	}
+
+
+	return rc;
+}
+
+int cam_cre_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_cre_device_core_info *core_info,
+	uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "cre", sizeof("cre"));
+	cpas_register_params.cam_cpas_client_cb = NULL;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRE, "failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_cre_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf                *cre_dev_intf = NULL;
+	struct cam_hw_info                *cre_dev = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_cre_device_core_info   *core_info = NULL;
+	struct cam_cre_dev_probe           cre_probe;
+	struct cam_cre_cpas_vote           cpas_vote;
+	struct cam_cre_soc_private        *soc_private;
+	int i;
+	uint32_t hw_idx;
+	int rc = 0;
+
+	struct platform_device *pdev = to_platform_device(dev);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &hw_idx);
+
+	cre_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!cre_dev_intf)
+		return -ENOMEM;
+
+	cre_dev_intf->hw_idx = hw_idx;
+	cre_dev_intf->hw_type = CRE_DEV_CRE;
+	cre_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!cre_dev) {
+		rc = -ENOMEM;
+		goto cre_dev_alloc_failed;
+	}
+
+	memset(cre_dev_name, 0, sizeof(cre_dev_name));
+	snprintf(cre_dev_name, sizeof(cre_dev_name),
+		"cre%1u", cre_dev_intf->hw_idx);
+
+	cre_dev->soc_info.pdev = pdev;
+	cre_dev->soc_info.dev = &pdev->dev;
+	cre_dev->soc_info.dev_name = cre_dev_name;
+	cre_dev_intf->hw_priv = cre_dev;
+	cre_dev_intf->hw_ops.init = cam_cre_init_hw;
+	cre_dev_intf->hw_ops.deinit = cam_cre_deinit_hw;
+	cre_dev_intf->hw_ops.get_hw_caps = cam_cre_get_hw_caps;
+	cre_dev_intf->hw_ops.process_cmd = cam_cre_process_cmd;
+
+	CAM_DBG(CAM_CRE, "type %d index %d",
+		cre_dev_intf->hw_type,
+		cre_dev_intf->hw_idx);
+
+	if (cre_dev_intf->hw_idx < CRE_DEV_MAX)
+		cam_cre_dev_list[cre_dev_intf->hw_idx].hw_intf =
+			cre_dev_intf;
+
+	platform_set_drvdata(pdev, cre_dev_intf);
+
+
+	cre_dev->core_info = kzalloc(sizeof(struct cam_cre_device_core_info),
+		GFP_KERNEL);
+	if (!cre_dev->core_info) {
+		rc = -ENOMEM;
+		goto cre_core_alloc_failed;
+	}
+	core_info = (struct cam_cre_device_core_info *)cre_dev->core_info;
+	core_info->cre_hw_info = &cre_hw_info;
+	cre_dev->soc_info.soc_private = &cre_soc_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		rc = -EINVAL;
+		CAM_DBG(CAM_CRE, "No cre hardware info");
+		goto cre_match_dev_failed;
+	}
+
+	rc = cam_cre_init_soc_resources(&cre_dev->soc_info, cam_cre_irq,
+		cre_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRE, "failed to init_soc");
+		goto init_soc_failed;
+	}
+	core_info->hw_type = CRE_DEV_CRE;
+	core_info->hw_idx = hw_idx;
+	rc = cam_cre_register_cpas(&cre_dev->soc_info,
+		core_info, cre_dev_intf->hw_idx);
+	if (rc < 0)
+		goto register_cpas_failed;
+
+	rc = cam_cre_enable_soc_resources(&cre_dev->soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRE, "enable soc resorce failed: %d", rc);
+		goto enable_soc_failed;
+	}
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_AXI_PATH_DATA_CRE_WR_OUT;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_AXI_TRANSACTION_WRITE;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+
+	rc = cam_cre_init_hw_version(&cre_dev->soc_info, cre_dev->core_info);
+	if (rc)
+		goto init_hw_failure;
+
+	cam_cre_disable_soc_resources(&cre_dev->soc_info);
+	cam_cpas_stop(core_info->cpas_handle);
+	cre_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	cam_cre_process_cmd(cre_dev, CRE_HW_PROBE,
+		&cre_probe, sizeof(cre_probe));
+	mutex_init(&cre_dev->hw_mutex);
+	spin_lock_init(&cre_dev->hw_lock);
+	init_completion(&cre_dev->hw_complete);
+
+	CAM_DBG(CAM_CRE, "CRE:%d component bound successfully",
+		cre_dev_intf->hw_idx);
+	soc_private = cre_dev->soc_info.soc_private;
+	cam_cre_dev_list[cre_dev_intf->hw_idx].num_hw_pid =
+		soc_private->num_pid;
+
+	for (i = 0; i < soc_private->num_pid; i++)
+		cam_cre_dev_list[cre_dev_intf->hw_idx].hw_pid[i] =
+			soc_private->pid[i];
+
+	return rc;
+
+init_hw_failure:
+enable_soc_failed:
+register_cpas_failed:
+init_soc_failed:
+cre_match_dev_failed:
+	kfree(cre_dev->core_info);
+cre_core_alloc_failed:
+	kfree(cre_dev);
+cre_dev_alloc_failed:
+	kfree(cre_dev_intf);
+	return rc;
+}
+
+static void cam_cre_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_CRE, "Unbinding component: %s", pdev->name);
+}
+
+int cam_cre_hw_init(struct cam_cre_hw_intf_data **cre_hw_intf_data,
+		uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_cre_dev_list[hw_idx].hw_intf) {
+		*cre_hw_intf_data = &cam_cre_dev_list[hw_idx];
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_CRE, "inval param");
+		*cre_hw_intf_data = NULL;
+		rc = -ENODEV;
+	}
+	return rc;
+}
+
+const static struct component_ops cam_cre_component_ops = {
+	.bind = cam_cre_component_bind,
+	.unbind = cam_cre_component_unbind,
+};
+
+int cam_cre_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CRE, "Adding CRE component");
+	rc = component_add(&pdev->dev, &cam_cre_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CRE, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static const struct of_device_id cam_cre_dt_match[] = {
+	{
+		.compatible = "qcom,cre",
+		.data = &cre_hw_version_reg,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_cre_dt_match);
+
+struct platform_driver cam_cre_driver = {
+	.probe = cam_cre_probe,
+	.driver = {
+		.name = "cre",
+		.of_match_table = cam_cre_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_cre_init_module(void)
+{
+	return platform_driver_register(&cam_cre_driver);
+}
+
+void cam_cre_exit_module(void)
+{
+	platform_driver_unregister(&cam_cre_driver);
+}
+
+MODULE_DESCRIPTION("CAM CRE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_dev_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_dev_intf.h
@@ -0,0 +1,137 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+#ifndef CAM_CRE_DEV_INTF_H
+#define CAM_CRE_DEV_INTF_H
+
+#include <media/cam_cre.h>
+#include "cam_cre_hw_mgr.h"
+#include "cam_cpas_api.h"
+#include "cre_top.h"
+
+#define CRE_HW_INIT            0x1
+#define CRE_HW_DEINIT          0x2
+#define CRE_HW_ACQUIRE         0x3
+#define CRE_HW_RELEASE         0x4
+#define CRE_HW_START           0x5
+#define CRE_HW_STOP            0x6
+#define CRE_HW_FLUSH           0x7
+#define CRE_HW_PREPARE         0x8
+#define CRE_HW_ISR             0x9
+#define CRE_HW_PROBE           0xA
+#define CRE_HW_CLK_UPDATE      0xB
+#define CRE_HW_BW_UPDATE       0xC
+#define CRE_HW_RESET           0xD
+#define CRE_HW_SET_IRQ_CB      0xE
+#define CRE_HW_CLK_DISABLE     0xF
+#define CRE_HW_CLK_ENABLE      0x10
+#define CRE_HW_DUMP_DEBUG      0x11
+#define CRE_HW_REG_SET_UPDATE  0x12
+
+/**
+ * struct cam_cre_dev_probe
+ *
+ * @reserved: Reserved field for future use
+ */
+struct cam_cre_dev_probe {
+	uint32_t reserved;
+};
+
+/**
+ * struct cam_cre_dev_init
+ *
+ * @core_info: CRE core info
+ */
+struct cam_cre_dev_init {
+	struct cam_cre_device_core_info *core_info;
+};
+
+/**
+ * struct cam_cre_dev_clk_update
+ *
+ * @clk_rate: Clock rate
+ */
+struct cam_cre_dev_clk_update {
+	uint32_t clk_rate;
+};
+
+struct cam_cre_dev_reg_set_update {
+	struct cre_reg_buffer cre_reg_buf;
+};
+
+/**
+ * struct cam_cre_dev_bw_update
+ *
+ * @ahb_vote:       AHB vote info
+ * @axi_vote:       AXI vote info
+ * @ahb_vote_valid: Flag for ahb vote
+ * @axi_vote_valid: Flag for axi vote
+ */
+struct cam_cre_dev_bw_update {
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote;
+	uint32_t ahb_vote_valid;
+	uint32_t axi_vote_valid;
+};
+
+/**
+ * struct cam_cre_dev_acquire
+ *
+ * @ctx_id:      Context id
+ * @cre_acquire: CRE acquire info
+ * @bus_wr_ctx:  Bus Write context
+ * @bus_rd_ctx:  Bus Read context
+ */
+struct cam_cre_dev_acquire {
+	uint32_t ctx_id;
+	struct cre_top *cre_top;
+	struct cam_cre_acquire_dev_info *cre_acquire;
+	struct cre_bus_wr_ctx *bus_wr_ctx;
+	struct cre_bus_rd_ctx *bus_rd_ctx;
+};
+
+/**
+ * struct cam_cre_dev_release
+ *
+ * @ctx_id:      Context id
+ * @bus_wr_ctx:  Bus Write context
+ * @bus_rd_ctx:  Bus Read context
+ */
+struct cam_cre_dev_release {
+	uint32_t ctx_id;
+	struct cre_bus_wr_ctx *bus_wr_ctx;
+	struct cre_bus_rd_ctx *bus_rd_ctx;
+};
+
+/**
+ * struct cam_cre_dev_prepare_req
+ *
+ * @hw_mgr:         CRE hardware manager
+ * @packet:         Packet
+ * @prepare_args:   Prepare request args
+ * @ctx_data:       Context data
+ * @frame_process:  Frame process command
+ * @req_idx:        Request Index
+ */
+struct cam_cre_dev_prepare_req {
+	struct cam_cre_hw_mgr *hw_mgr;
+	struct cam_packet *packet;
+	struct cam_hw_prepare_update_args *prepare_args;
+	struct cam_cre_ctx *ctx_data;
+	uint32_t req_idx;
+};
+
+int cam_cre_subdev_init_module(void);
+void cam_cre_subdev_exit_module(void);
+
+int cam_cre_top_process(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data);
+
+int cam_cre_bus_rd_process(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data);
+
+int cam_cre_bus_wr_process(struct cam_cre_hw *cam_cre_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data);
+
+#endif /* CAM_CRE_DEV_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_hw.h
@@ -0,0 +1,348 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_CRE_HW_H
+#define CAM_CRE_HW_H
+
+#define CRE_HW_VER_1_0_0 0x10000000
+#define CRE_HW_VER_1_1_0 0x10010000
+
+#define CRE_DEV_CRE  0
+#define CRE_DEV_MAX  1
+
+#define MAX_CRE_RD_CLIENTS   1
+#define MAX_CRE_WR_CLIENTS   1
+
+#define CRE_TOP_BASE     0x0
+#define CRE_BUS_RD       0x1
+#define CRE_BUS_WR       0x2
+#define CRE_BASE_MAX     0x3
+
+#define CRE_WAIT_BUS_WR_RUP    0x1
+#define CRE_WAIT_BUS_WR_DONE   0x2
+#define CRE_WAIT_BUS_RD_DONE   0x3
+#define CRE_WAIT_IDLE_IRQ      0x4
+
+#define CAM_CRE_HW_CFG_Q_MAX 30
+
+struct cam_cre_top_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t hw_cap;
+	uint32_t debug_0;
+	uint32_t debug_1;
+	uint32_t debug_cfg;
+	uint32_t testbus_ctrl;
+	uint32_t scratch_0;
+	uint32_t irq_status;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_set;
+	uint32_t irq_cmd;
+	uint32_t reset_cmd;
+	uint32_t core_clk_cfg_ctrl_0;
+	uint32_t core_clk_cfg_ctrl_1;
+	uint32_t top_spare;
+};
+
+struct cam_cre_top_reg_val {
+	uint32_t hw_version;
+	uint32_t hw_cap;
+	uint32_t major_mask;
+	uint32_t major_shift;
+	uint32_t minor_mask;
+	uint32_t minor_shift;
+	uint32_t irq_mask;
+	uint32_t irq_set;
+	uint32_t irq_clear;
+	uint32_t irq_cmd_set;
+	uint32_t irq_cmd_clear;
+	uint32_t idle;
+	uint32_t fe_done;
+	uint32_t we_done;
+	uint32_t rst_done;
+	uint32_t sw_reset_cmd;
+	uint32_t hw_reset_cmd;
+	uint32_t core_clk_cfg_ctrl_0;
+	uint32_t core_clk_cfg_ctrl_1;
+	uint32_t top_override;
+	uint32_t we_override;
+	uint32_t fe_override;
+	uint32_t ahb_override;
+};
+
+struct cam_cre_bus_rd_client_reg {
+	uint32_t bus_ctrl;
+	uint32_t spare;
+	uint32_t cons_violation;
+	uint32_t cons_violation_status;
+	uint32_t core_cfg;
+	uint32_t ccif_meta_data;
+	uint32_t img_addr;
+	uint32_t rd_width;
+	uint32_t rd_height;
+	uint32_t rd_stride;
+	uint32_t unpacker_cfg;
+	uint32_t latency_buf_allocation;
+	uint32_t misr_cfg_0;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_val;
+	uint32_t system_cache_cfg;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	uint32_t read_buff_cfg;
+	uint32_t addr_cfg;
+};
+
+struct cam_cre_bus_rd_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_cmd;
+	uint32_t irq_status;
+	uint32_t input_if_cmd;
+	uint32_t irq_set;
+	uint32_t misr_reset;
+	uint32_t security_cfg;
+	uint32_t iso_cfg;
+	uint32_t iso_seed;
+	uint32_t test_bus_ctrl;
+	uint32_t cons_violation;
+	uint32_t ccif_violation;
+
+	uint32_t num_clients;
+	struct   cam_cre_bus_rd_client_reg rd_clients[MAX_CRE_RD_CLIENTS];
+};
+
+struct cam_cre_bus_rd_client_reg_val {
+	uint32_t client_en;
+	uint32_t ai_en;
+	uint32_t ai_en_mask;
+	uint32_t ai_en_shift;
+	uint32_t pix_pattern;
+	uint32_t pix_pattern_mask;
+	uint32_t pix_pattern_shift;
+	uint32_t stripe_location;
+	uint32_t stripe_location_mask;
+	uint32_t stripe_location_shift;
+	uint32_t img_addr;
+	uint32_t img_width;
+	uint32_t img_height;
+	uint32_t stride;
+	uint32_t alignment;
+	uint32_t alignment_mask;
+	uint32_t alignment_shift;
+	uint32_t format;
+	uint32_t format_mask;
+	uint32_t format_shift;
+	uint32_t latency_buf_size;
+	uint32_t latency_buf_size_mask;
+	uint32_t misr_cfg_en;
+	uint32_t misr_cfg_en_mask;
+	uint32_t misr_cfg_samp_mode;
+	uint32_t misr_cfg_samp_mode_mask;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_val;
+	uint32_t x_int;
+	uint32_t x_int_mask;
+	uint32_t byte_offset;
+	uint32_t byte_offset_mask;
+	uint32_t input_port_id;
+	uint32_t rm_port_id;
+};
+
+struct cam_cre_bus_rd_reg_val {
+	uint32_t hw_version;
+	uint32_t cgc_override;
+	uint32_t irq_mask;
+	uint32_t irq_status;
+	uint32_t irq_cmd_set;
+	uint32_t irq_cmd_clear;
+	uint32_t rup_done;
+	uint32_t rd_buf_done;
+	uint32_t cons_violation;
+	uint32_t ccif_violation;
+	uint32_t static_prg;
+	uint32_t static_prg_mask;
+	uint32_t ica_en;
+	uint32_t ica_en_mask;
+	uint32_t go_cmd;
+	uint32_t go_cmd_mask;
+	uint32_t irq_set;
+	uint32_t irq_clear;
+	uint32_t misr_reset;
+	uint32_t security_cfg;
+	uint32_t iso_bpp_select;
+	uint32_t iso_bpp_select_mask;
+	uint32_t iso_pattern_select;
+	uint32_t iso_pattern_select_mask;
+	uint32_t iso_en;
+	uint32_t iso_en_mask;
+	uint32_t iso_seed;
+	uint32_t bus_ctrl;
+	uint32_t spare;
+	uint32_t num_clients;
+	struct   cam_cre_bus_rd_client_reg_val rd_clients[MAX_CRE_RD_CLIENTS];
+};
+
+struct cam_cre_bus_wr_client_reg {
+	uint32_t client_cfg;
+	uint32_t img_addr;
+	uint32_t img_cfg_0;
+	uint32_t img_cfg_1;
+	uint32_t img_cfg_2;
+	uint32_t packer_cfg;
+	uint32_t bw_limit;
+	uint32_t system_cache_cfg;
+	uint32_t addr_cfg;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+};
+
+struct cam_cre_bus_wr_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t cgc_override;
+	uint32_t irq_mask_0;
+	uint32_t irq_mask_1;
+	uint32_t irq_clear_0;
+	uint32_t irq_clear_1;
+	uint32_t irq_status_0;
+	uint32_t irq_status_1;
+	uint32_t irq_cmd;
+	uint32_t frame_header_cfg_0;
+	uint32_t local_frame_header_cfg_0;
+	uint32_t irq_set_0;
+	uint32_t irq_set_1;
+	uint32_t iso_cfg;
+	uint32_t violation_status;
+	uint32_t image_size_violation_status;
+	uint32_t perf_count_cfg_0;
+	uint32_t perf_count_cfg_1;
+	uint32_t perf_count_cfg_2;
+	uint32_t perf_count_cfg_3;
+	uint32_t perf_count_val_0;
+	uint32_t perf_count_val_1;
+	uint32_t perf_count_val_2;
+	uint32_t perf_count_val_3;
+	uint32_t perf_count_status;
+	uint32_t misr_cfg_0;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_sel;
+	uint32_t misr_reset;
+	uint32_t misr_val;
+
+	uint32_t num_clients;
+	struct   cam_cre_bus_wr_client_reg wr_clients[MAX_CRE_WR_CLIENTS];
+};
+
+struct cam_cre_bus_wr_client_reg_val {
+	uint32_t client_en;
+	uint32_t client_en_mask;
+	uint32_t client_en_shift;
+	uint32_t auto_recovery_en;
+	uint32_t auto_recovery_en_mask;
+	uint32_t auto_recovery_en_shift;
+	uint32_t mode;
+	uint32_t mode_mask;
+	uint32_t mode_shift;
+	uint32_t img_addr;
+	uint32_t width;
+	uint32_t width_mask;
+	uint32_t width_shift;
+	uint32_t height;
+	uint32_t height_mask;
+	uint32_t height_shift;
+	uint32_t x_init;
+	uint32_t x_init_mask;
+	uint32_t stride;
+	uint32_t stride_mask;
+	uint32_t client_buf_done;
+	uint32_t format;
+	uint32_t format_mask;
+	uint32_t format_shift;
+	uint32_t alignment;
+	uint32_t alignment_mask;
+	uint32_t alignment_shift;
+	uint32_t bw_limit_en;
+	uint32_t bw_limit_en_mask;
+	uint32_t bw_limit_counter;
+	uint32_t bw_limit_counter_mask;
+	uint32_t frame_header_addr;
+	uint32_t output_port_id;
+	uint32_t wm_port_id;
+};
+
+struct cam_cre_bus_wr_reg_val {
+	uint32_t hw_version;
+	uint32_t cgc_override;
+	uint32_t irq_mask_0;
+	uint32_t irq_set_0;
+	uint32_t irq_clear_0;
+	uint32_t irq_status_0;
+	uint32_t img_size_violation;
+	uint32_t violation;
+	uint32_t cons_violation;
+	uint32_t comp_buf_done;
+	uint32_t comp_rup_done;
+	uint32_t irq_mask_1;
+	uint32_t irq_set_1;
+	uint32_t irq_clear_1;
+	uint32_t irq_status_1;
+	uint32_t irq_cmd_set;
+	uint32_t irq_cmd_clear;
+	uint32_t frame_header_cfg_0;
+	uint32_t local_frame_header_cfg_0;
+	uint32_t iso_en;
+	uint32_t iso_en_mask;
+	uint32_t violation_status;
+	uint32_t img_size_violation_status;
+	uint32_t misr_0_en;
+	uint32_t misr_0_en_mask;
+	uint32_t misr_0_samp_mode;
+	uint32_t misr_0_samp_mode_mask;
+	uint32_t misr_0_id;
+	uint32_t misr_0_id_mask;
+	uint32_t misr_rd_misr_sel;
+	uint32_t misr_rd_misr_sel_mask;
+	uint32_t misr_rd_word_sel;
+	uint32_t misr_rd_word_sel_mask;
+	uint32_t misr_reset;
+	uint32_t misr_val;
+
+	uint32_t num_clients;
+	struct cam_cre_bus_wr_client_reg_val wr_clients[MAX_CRE_WR_CLIENTS];
+};
+
+struct cam_cre_debug_register {
+	uint32_t offset;
+};
+
+struct cam_cre_hw {
+	struct cam_cre_top_reg        *top_reg_offset;
+	struct cam_cre_top_reg_val    *top_reg_val;
+
+	struct cam_cre_bus_rd_reg     *bus_rd_reg_offset;
+	struct cam_cre_bus_rd_reg_val *bus_rd_reg_val;
+
+	struct cam_cre_bus_wr_reg     *bus_wr_reg_offset;
+	struct cam_cre_bus_wr_reg_val *bus_wr_reg_val;
+
+	struct cam_cre_common         *common;
+};
+
+struct cre_hw_version_reg {
+	uint32_t hw_ver;
+	uint32_t reserved;
+};
+
+#endif /* CAM_CRE_HW_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_hw_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_hw_100.h
@@ -0,0 +1,241 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_CRE_HW_100_H
+#define CAM_CRE_HW_100_H
+
+#include "cre_hw.h"
+
+#define CRE_BUS_RD_TYPE            0x1
+#define CRE_BUS_WR_TYPE            0x2
+
+static struct cam_cre_top_reg cre100_top_reg = {
+	.hw_version            =  0x000,
+	.hw_cap                =  0x004,
+	.debug_0               =  0x080,
+	.debug_1               =  0x084,
+	.debug_cfg             =  0x0DC,
+	.testbus_ctrl          =  0x1F4,
+	.scratch_0             =  0x1F8,
+	.irq_status            =  0x00C,
+	.irq_mask              =  0x010,
+	.irq_clear             =  0x014,
+	.irq_set               =  0x018,
+	.irq_cmd               =  0x01C,
+	.reset_cmd             =  0x008,
+	.core_clk_cfg_ctrl_0   =  0x020,
+	.core_clk_cfg_ctrl_1   =  0x024,
+	.top_spare             =  0x1FC,
+};
+
+struct cam_cre_top_reg_val cre100_top_reg_value = {
+	.hw_version = 0x10000000,
+	.hw_cap = 0x4000,
+	.irq_mask = 0xf,
+	.irq_clear = 0xf,
+	.irq_set = 0xf,
+	.irq_cmd_set = 0xf,
+	.irq_cmd_clear = 0xf,
+	.idle = 0x8,
+	.fe_done = 0x4,
+	.we_done = 0x2,
+	.rst_done = 0x1,
+	.sw_reset_cmd = 0x2,
+	.hw_reset_cmd = 0x1,
+};
+
+struct cam_cre_bus_rd_reg cre100_bus_rd_reg = {
+	.hw_version     = 0x00,
+	.irq_mask       = 0x04,
+	.irq_clear      = 0x08,
+	.irq_cmd        = 0x0C,
+	.irq_status     = 0x10,
+	.input_if_cmd   = 0x14,
+	.irq_set        = 0x18,
+	.misr_reset     = 0x1C,
+	.security_cfg   = 0x20,
+	.iso_cfg        = 0x24,
+	.iso_seed       = 0x28,
+	.test_bus_ctrl  = 0x2C,
+	.num_clients    = 1,
+	.rd_clients[0]  = {
+		.core_cfg               = 0x50,
+		.ccif_meta_data         = 0x54,
+		.img_addr               = 0x58,
+		.rd_width               = 0x5C,
+		.rd_height              = 0x60,
+		.rd_stride              = 0x64,
+		.unpacker_cfg           = 0x68,
+		.latency_buf_allocation = 0x7C,
+		.misr_cfg_0             = 0x84,
+		.misr_cfg_1             = 0x88,
+		.misr_rd_val            = 0x8C,
+		.debug_status_cfg       = 0x90,
+		.debug_status_0         = 0x94,
+		.debug_status_1         = 0x98,
+		.read_buff_cfg          = 0xA0,
+		.addr_cfg               = 0xA4,
+		.spare                  = 0x30,
+		.cons_violation         = 0x34,
+	},
+};
+
+struct cam_cre_bus_wr_reg_val cre100_bus_wr_reg_value = {
+	.hw_version                   = 0x30000000,
+	.cgc_override                 = 0x1,
+	.irq_mask_0                   = 0xd0000101,
+	.irq_set_0                    = 0xd0000101,
+	.irq_clear_0                  = 0xd0000101,
+	.img_size_violation           = 0x80000000,
+	.violation                    = 0x40000000,
+	.cons_violation               = 0x10000000,
+	.comp_buf_done                = 0x100,
+	.comp_rup_done                = 0x1,
+	.irq_mask_1                   = 0x1,
+	.irq_set_1                    = 0x1,
+	.irq_clear_1                  = 0x1,
+	.irq_status_1                 = 0x1,
+	.irq_cmd_set                  = 0x10,
+	.irq_cmd_clear                = 0x1,
+	.iso_en                       = 0x1,
+	.iso_en_mask                  = 0x1,
+	.misr_0_en                    = 0x1,
+	.misr_0_en_mask               = 0x1,
+	.misr_0_samp_mode             = 0x1,
+	.misr_0_samp_mode_mask        = 0x10000,
+	.misr_0_id_mask               = 0xff,
+	.misr_rd_misr_sel_mask        = 0xf,
+	.misr_rd_word_sel_mask        = 0x70,
+	.num_clients = 1,
+	.wr_clients[0] = {
+		.client_en                = 0x1,
+		.client_en_mask           = 0x1,
+		.client_en_shift          = 0x0,
+		.auto_recovery_en         = 0x1,
+		.auto_recovery_en_mask    = 0x1,
+		.auto_recovery_en_shift   = 0x4,
+		.mode_mask                = 0x3,
+		.mode_shift               = 0x10,
+		.width_mask               = 0xffff,
+		.width_shift              = 0x0,
+		.height_mask              = 0xffff,
+		.height_shift             = 0x10,
+		.x_init_mask              = 0xff,
+		.stride_mask              = 0xffffff,
+		.format_mask              = 0xf,
+		.format_shift             = 0x0,
+		.alignment_mask           = 0x1,
+		.alignment_shift          = 0x5,
+		.bw_limit_en              = 0x1,
+		.bw_limit_en_mask         = 0x1,
+		.bw_limit_counter_mask    = 0x1fe,
+	        .client_buf_done          = 0x1,
+		.output_port_id           = CAM_CRE_OUTPUT_IMAGE,
+		.wm_port_id               = 0,
+	},
+};
+
+struct cam_cre_bus_rd_reg_val cre100_bus_rd_reg_value = {
+	.hw_version              = 0x30000000,
+	.irq_mask                = 0x1, /* INFO_CONS_VIOLATION */
+	.rd_buf_done             = 0x4,
+	.rup_done                = 0x2,
+	.cons_violation          = 0x1,
+	.irq_cmd_set             = 0x10,
+	.irq_cmd_clear           = 0x1,
+	.static_prg              = 0x8,
+	.static_prg_mask         = 0x8,
+	.ica_en                  = 0x1,
+	.ica_en_mask             = 0x2,
+	.go_cmd                  = 0x1,
+	.go_cmd_mask             = 0x1,
+	.irq_set                 = 0x7,
+	.irq_clear               = 0x7,
+	.misr_reset              = 0x1,
+	.security_cfg            = 0x1,
+	.iso_bpp_select_mask     = 0x60,
+	.iso_pattern_select_mask = 0x6,
+	.iso_en                  = 0x1,
+	.iso_en_mask             = 0x1,
+	.num_clients = 1,
+	.rd_clients[0] = {
+		.client_en               = 0x1,
+		.ai_en                   = 0x1,
+		.ai_en_mask              = 0x1000,
+		.ai_en_shift             = 0xc,
+		.pix_pattern_mask        = 0xfc,
+		.pix_pattern_shift       = 0x2,
+		.stripe_location_mask    = 0x3,
+		.stripe_location_shift   = 0x0,
+		.alignment_mask          = 0x1,
+		.alignment_shift         = 0x5,
+		.format_mask             = 0x1f,
+		.format_shift            = 0x0,
+		.latency_buf_size_mask   = 0xffff,
+		.misr_cfg_en_mask        = 0x4,
+		.misr_cfg_samp_mode_mask = 0x3,
+		.x_int_mask              = 0xffff,
+		.byte_offset_mask        = 0xff,
+		.input_port_id           = CAM_CRE_INPUT_IMAGE,
+		.rm_port_id              = 0x0,
+	},
+};
+
+struct cam_cre_bus_wr_reg cre100_bus_wr_reg = {
+	.hw_version                   = 0x00,
+	.cgc_override                 = 0x08,
+	.irq_mask_0                   = 0x18,
+	.irq_mask_1                   = 0x1C,
+	.irq_clear_0                  = 0x20,
+	.irq_clear_1                  = 0x24,
+	.irq_status_0                 = 0x28,
+	.irq_status_1                 = 0x2C,
+	.irq_cmd                      = 0x30,
+	.frame_header_cfg_0           = 0x0,
+	.local_frame_header_cfg_0     = 0x4C,
+	.irq_set_0                    = 0x50,
+	.irq_set_1                    = 0x54,
+	.iso_cfg                      = 0x5C,
+	.violation_status             = 0x64,
+	.image_size_violation_status  = 0x70,
+	.perf_count_cfg_0             = 0x74,
+	.perf_count_cfg_1             = 0x78,
+	.perf_count_cfg_2             = 0x7C,
+	.perf_count_cfg_3             = 0x80,
+	.perf_count_val_0             = 0x94,
+	.perf_count_val_1             = 0x98,
+	.perf_count_val_2             = 0x9C,
+	.perf_count_val_3             = 0xA0,
+	.perf_count_status            = 0xB4,
+	.misr_cfg_0                   = 0xB8,
+	.misr_cfg_1                   = 0xBC,
+	.misr_rd_sel                  = 0xC8,
+	.misr_reset                   = 0xCC,
+	.misr_val                     = 0xD0,
+	.wr_clients[0]             = {
+		.client_cfg           = 0x200,
+		.img_addr             = 0x204,
+		.img_cfg_0            = 0x20C,
+		.img_cfg_1            = 0x210,
+		.img_cfg_2            = 0x214,
+		.packer_cfg           = 0x218,
+		.bw_limit             = 0x21C,
+		.addr_cfg             = 0x270,
+		.debug_status_cfg     = 0x284,
+		.debug_status_0       = 0x288,
+		.debug_status_1       = 0x28C,
+	},
+};
+
+static struct cam_cre_hw cre_hw_100 = {
+	.top_reg_offset    = &cre100_top_reg,
+	.top_reg_val       = &cre100_top_reg_value,
+	.bus_wr_reg_offset = &cre100_bus_wr_reg,
+	.bus_wr_reg_val    = &cre100_bus_wr_reg_value,
+	.bus_rd_reg_offset = &cre100_bus_rd_reg,
+	.bus_rd_reg_val    = &cre100_bus_rd_reg_value,
+};
+#endif // CAM_CRE_HW_100_H
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_hw_110.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_hw_110.h
@@ -0,0 +1,243 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_CRE_HW_110_H
+#define CAM_CRE_HW_110_H
+
+#include "cre_hw.h"
+
+#define CRE_BUS_RD_TYPE            0x1
+#define CRE_BUS_WR_TYPE            0x2
+
+static struct cam_cre_top_reg cre110_top_reg = {
+	.hw_version            =  0x000,
+	.hw_cap                =  0x004,
+	.debug_0               =  0x080,
+	.debug_1               =  0x084,
+	.debug_cfg             =  0x0DC,
+	.testbus_ctrl          =  0x1F4,
+	.scratch_0             =  0x1F8,
+	.irq_status            =  0x00C,
+	.irq_mask              =  0x010,
+	.irq_clear             =  0x014,
+	.irq_set               =  0x018,
+	.irq_cmd               =  0x01C,
+	.reset_cmd             =  0x008,
+	.core_clk_cfg_ctrl_0   =  0x020,
+	.core_clk_cfg_ctrl_1   =  0x024,
+	.top_spare             =  0x1FC,
+};
+
+struct cam_cre_top_reg_val cre110_top_reg_value = {
+	.hw_version = 0x10010000,
+	.hw_cap = 0x4000,
+	.irq_mask = 0xf,
+	.irq_clear = 0xf,
+	.irq_set = 0xf,
+	.irq_cmd_set = 0xf,
+	.irq_cmd_clear = 0xf,
+	.idle = 0x8,
+	.fe_done = 0x4,
+	.we_done = 0x2,
+	.rst_done = 0x1,
+	.sw_reset_cmd = 0x2,
+	.hw_reset_cmd = 0x1,
+};
+
+struct cam_cre_bus_rd_reg cre110_bus_rd_reg = {
+	.hw_version     = 0x00,
+	.irq_mask       = 0x04,
+	.irq_clear      = 0x08,
+	.irq_cmd        = 0x0C,
+	.irq_status     = 0x10,
+	.input_if_cmd   = 0x14,
+	.irq_set        = 0x18,
+	.misr_reset     = 0x1C,
+	.security_cfg   = 0x20,
+	.iso_cfg        = 0x24,
+	.iso_seed       = 0x28,
+	.test_bus_ctrl  = 0x2C,
+	.cons_violation = 0x30,
+	.ccif_violation = 0x34,
+	.num_clients    = 1,
+	.rd_clients[0]  = {
+		.core_cfg               = 0x50,
+		.ccif_meta_data         = 0x54,
+		.img_addr               = 0x58,
+		.rd_width               = 0x5C,
+		.rd_height              = 0x60,
+		.rd_stride              = 0x64,
+		.unpacker_cfg           = 0x68,
+		.latency_buf_allocation = 0x7C,
+		.misr_cfg_0             = 0x84,
+		.misr_cfg_1             = 0x88,
+		.misr_rd_val            = 0x8C,
+		.system_cache_cfg       = 0x90,
+		.read_buff_cfg          = 0x94,
+		.addr_cfg               = 0x98,
+		.debug_status_cfg       = 0xA4,
+		.debug_status_0         = 0xA8,
+		.debug_status_1         = 0xAC,
+		.spare                  = 0x38,
+	},
+};
+
+struct cam_cre_bus_wr_reg_val cre110_bus_wr_reg_value = {
+	.hw_version                   = 0x40000000,
+	.cgc_override                 = 0x1,
+	.irq_mask_0                   = 0xd0000101,
+	.irq_set_0                    = 0xd0000101,
+	.irq_clear_0                  = 0xd0000101,
+	.img_size_violation           = 0x80000000,
+	.violation                    = 0x40000000,
+	.cons_violation               = 0x10000000,
+	.comp_buf_done                = 0x100,
+	.comp_rup_done                = 0x1,
+	.irq_mask_1                   = 0x1,
+	.irq_set_1                    = 0x1,
+	.irq_clear_1                  = 0x1,
+	.irq_status_1                 = 0x1,
+	.irq_cmd_set                  = 0x10,
+	.irq_cmd_clear                = 0x1,
+	.iso_en                       = 0x1,
+	.iso_en_mask                  = 0x1,
+	.misr_0_en                    = 0x1,
+	.misr_0_en_mask               = 0x1,
+	.misr_0_samp_mode             = 0x1,
+	.misr_0_samp_mode_mask        = 0x10000,
+	.misr_0_id_mask               = 0xff,
+	.misr_rd_misr_sel_mask        = 0xf,
+	.misr_rd_word_sel_mask        = 0x70,
+	.num_clients = 1,
+	.wr_clients[0] = {
+		.client_en                = 0x1,
+		.client_en_mask           = 0x1,
+		.client_en_shift          = 0x0,
+		.auto_recovery_en         = 0x1,
+		.auto_recovery_en_mask    = 0x1,
+		.auto_recovery_en_shift   = 0x4,
+		.mode_mask                = 0x3,
+		.mode_shift               = 0x10,
+		.width_mask               = 0xffff,
+		.width_shift              = 0x0,
+		.height_mask              = 0xffff,
+		.height_shift             = 0x10,
+		.x_init_mask              = 0xff,
+		.stride_mask              = 0xffffff,
+		.format_mask              = 0xf,
+		.format_shift             = 0x0,
+		.alignment_mask           = 0x1,
+		.alignment_shift          = 0x5,
+		.bw_limit_en              = 0x1,
+		.bw_limit_en_mask         = 0x1,
+		.bw_limit_counter_mask    = 0x1fe,
+		.client_buf_done          = 0x1,
+		.output_port_id           = CAM_CRE_OUTPUT_IMAGE,
+		.wm_port_id               = 0,
+	},
+};
+
+struct cam_cre_bus_rd_reg_val cre110_bus_rd_reg_value = {
+	.hw_version              = 0x40000000,
+	.irq_mask                = 0x80000001,
+	.rd_buf_done             = 0x4,
+	.rup_done                = 0x2,
+	.cons_violation          = 0x1,
+	.ccif_violation          = 0x80000000,
+	.irq_cmd_set             = 0x10,
+	.irq_cmd_clear           = 0x1,
+	.static_prg              = 0x8,
+	.static_prg_mask         = 0x8,
+	.ica_en                  = 0x1,
+	.ica_en_mask             = 0x2,
+	.go_cmd                  = 0x1,
+	.go_cmd_mask             = 0x1,
+	.irq_set                 = 0x7,
+	.irq_clear               = 0x7,
+	.misr_reset              = 0x1,
+	.security_cfg            = 0x1,
+	.iso_bpp_select_mask     = 0x60,
+	.iso_pattern_select_mask = 0x6,
+	.iso_en                  = 0x1,
+	.iso_en_mask             = 0x1,
+	.num_clients = 1,
+	.rd_clients[0] = {
+		.client_en               = 0x1,
+		.ai_en                   = 0x1,
+		.ai_en_mask              = 0x1000,
+		.ai_en_shift             = 0xc,
+		.pix_pattern_mask        = 0xfc,
+		.pix_pattern_shift       = 0x2,
+		.stripe_location_mask    = 0x3,
+		.stripe_location_shift   = 0x0,
+		.alignment_mask          = 0x1,
+		.alignment_shift         = 0x5,
+		.format_mask             = 0x1f,
+		.format_shift            = 0x0,
+		.latency_buf_size_mask   = 0xffff,
+		.misr_cfg_en_mask        = 0x4,
+		.misr_cfg_samp_mode_mask = 0x3,
+		.x_int_mask              = 0xffff,
+		.byte_offset_mask        = 0xff,
+		.input_port_id           = CAM_CRE_INPUT_IMAGE,
+		.rm_port_id              = 0x0,
+	},
+};
+
+struct cam_cre_bus_wr_reg cre110_bus_wr_reg = {
+	.hw_version                   = 0x00,
+	.cgc_override                 = 0x08,
+	.irq_mask_0                   = 0x18,
+	.irq_mask_1                   = 0x1C,
+	.irq_clear_0                  = 0x20,
+	.irq_clear_1                  = 0x24,
+	.irq_status_0                 = 0x28,
+	.irq_status_1                 = 0x2C,
+	.irq_cmd                      = 0x30,
+	.local_frame_header_cfg_0     = 0x4C,
+	.irq_set_0                    = 0x50,
+	.irq_set_1                    = 0x54,
+	.iso_cfg                      = 0x5C,
+	.violation_status             = 0x64,
+	.image_size_violation_status  = 0x70,
+	.perf_count_cfg_0             = 0x74,
+	.perf_count_cfg_1             = 0x78,
+	.perf_count_cfg_2             = 0x7C,
+	.perf_count_cfg_3             = 0x80,
+	.perf_count_val_0             = 0x94,
+	.perf_count_val_1             = 0x98,
+	.perf_count_val_2             = 0x9C,
+	.perf_count_val_3             = 0xA0,
+	.perf_count_status            = 0xB4,
+	.misr_cfg_0                   = 0xB8,
+	.misr_cfg_1                   = 0xBC,
+	.misr_rd_sel                  = 0xC8,
+	.misr_reset                   = 0xCC,
+	.misr_val                     = 0xD0,
+	.wr_clients[0]             = {
+		.client_cfg           = 0x200,
+		.img_addr             = 0x204,
+		.img_cfg_0            = 0x20C,
+		.img_cfg_1            = 0x210,
+		.img_cfg_2            = 0x214,
+		.packer_cfg           = 0x218,
+		.bw_limit             = 0x21C,
+		.system_cache_cfg     = 0x268,
+		.addr_cfg             = 0x270,
+		.debug_status_cfg     = 0x288,
+		.debug_status_0       = 0x28c,
+		.debug_status_1       = 0x290,
+	},
+};
+
+static struct cam_cre_hw cre_hw_110 = {
+	.top_reg_offset    = &cre110_top_reg,
+	.top_reg_val       = &cre110_top_reg_value,
+	.bus_wr_reg_offset = &cre110_bus_wr_reg,
+	.bus_wr_reg_val    = &cre110_bus_wr_reg_value,
+	.bus_rd_reg_offset = &cre110_bus_rd_reg,
+	.bus_rd_reg_val    = &cre110_bus_rd_reg_value,
+};
+#endif // CAM_CRE_HW_110_H
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_soc.c
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_cre.h>
+
+#include "cre_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+int cam_cre_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t cre_irq_handler, void *data)
+{
+	int rc, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info,
+		cre_irq_handler, &(irq_data[0]));
+	if (rc)
+		CAM_ERR(CAM_CRE, "init soc failed %d", rc);
+
+	return rc;
+}
+
+int cam_cre_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		soc_info->lowest_clk_level, true);
+	if (rc)
+		CAM_ERR(CAM_CRE, "enable platform failed %d", rc);
+
+	return rc;
+}
+
+int cam_cre_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc)
+		CAM_ERR(CAM_CRE, "disable platform failed %d", rc);
+
+	return rc;
+}
+
+int cam_cre_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate)
+{
+	int32_t src_clk_idx;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_CRE, "Invalid soc info");
+		return -EINVAL;
+	}
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	CAM_DBG(CAM_CRE, "clk_rate = %u src_clk_index = %d",
+		clk_rate, src_clk_idx);
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE] == true) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_CRE, "clk_rate %d greater than max, reset to %d",
+			clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	CAM_DBG(CAM_CRE, "clk_rate = %u src_clk_index = %d",
+		clk_rate, src_clk_idx);
+	return cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX, clk_rate, 0);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/cre_soc.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CRE_SOC_H_
+#define _CAM_CRE_SOC_H_
+
+#include "cam_soc_util.h"
+
+#define CAM_CRE_HW_MAX_NUM_PID 2
+
+/**
+ * struct cam_cre_soc_private
+ *
+ * @num_pid: CRE number of pids
+ * @pid:     CRE pid value list
+ */
+struct cam_cre_soc_private {
+	uint32_t num_pid;
+	uint32_t pid[CAM_CRE_HW_MAX_NUM_PID];
+};
+
+int cam_cre_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t cre_irq_handler, void *irq_data);
+
+int cam_cre_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_cre_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_cre_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate);
+#endif /* _CAM_CRE_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/include/cam_cre_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/include/cam_cre_hw_intf.h
@@ -0,0 +1,50 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_CRE_HW_INTF_H
+#define CAM_CRE_HW_INTF_H
+
+#include "cam_cpas_api.h"
+
+#define CAM_CRE_DEV_PER_TYPE_MAX     1
+
+#define CAM_CRE_CMD_BUF_MAX_SIZE     128
+#define CAM_CRE_MSG_BUF_MAX_SIZE     CAM_CRE_CMD_BUF_MAX_SIZE
+
+#define CRE_VOTE                     640000000
+
+#define CAM_CRE_HW_DUMP_TAG_MAX_LEN 128
+#define CAM_CRE_HW_DUMP_NUM_WORDS   5
+
+struct cam_cre_set_irq_cb {
+	int32_t (*cre_hw_mgr_cb)(void *irq_data,
+		 int32_t result_size, void *data);
+	void *data;
+	uint32_t b_set_cb;
+};
+
+struct cam_cre_hw_dump_args {
+	uint64_t  request_id;
+	uintptr_t cpu_addr;
+	size_t    offset;
+	size_t    buf_len;
+};
+
+struct cam_cre_hw_dump_header {
+	uint8_t     tag[CAM_CRE_HW_DUMP_TAG_MAX_LEN];
+	uint64_t    size;
+	uint32_t    word_size;
+};
+
+enum cam_cre_cmd_type {
+	CAM_CRE_CMD_CFG,
+	CAM_CRE_CMD_SET_IRQ_CB,
+	CAM_CRE_CMD_HW_DUMP,
+	CAM_CRE_CMD_RESET_HW,
+	CAM_CRE_CMD_MAX,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/include/cam_cre_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/include/cam_cre_hw_mgr_intf.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_CRE_HW_MGR_INTF_H
+#define CAM_CRE_HW_MGR_INTF_H
+
+#include <linux/of.h>
+#include <media/cam_cre.h>
+#include <media/cam_defs.h>
+
+#define CAM_CRE_CTX_MAX        16
+
+int cam_cre_hw_mgr_init(struct device_node *of_node,
+	void *hw_mgr, int *iommu_hdl);
+
+#endif /* CAM_CRE_HW_MGR_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/top/cre_top.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/top/cre_top.c
@@ -0,0 +1,309 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/completion.h>
+#include <media/cam_cre.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cre_core.h"
+#include "cre_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cre_hw.h"
+#include "cre_dev_intf.h"
+#include "cre_top.h"
+
+static struct cre_top cre_top_info;
+
+static int cam_cre_top_reset(struct cam_cre_hw *cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_cre_top_reg *top_reg;
+	struct cam_cre_top_reg_val *top_reg_val;
+	uint32_t irq_mask, irq_status;
+	unsigned long flags;
+
+	if (!cre_hw_info) {
+		CAM_ERR(CAM_CRE, "Invalid cre_hw_info");
+		return -EINVAL;
+	}
+
+	top_reg = cre_hw_info->top_reg_offset;
+	top_reg_val = cre_hw_info->top_reg_val;
+
+	mutex_lock(&cre_top_info.cre_hw_mutex);
+	reinit_completion(&cre_top_info.reset_complete);
+	reinit_completion(&cre_top_info.idle_done);
+
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		cre_hw_info->top_reg_offset->base + top_reg->irq_mask);
+
+	/* CRE HW RESET */
+	cam_io_w_mb(top_reg_val->hw_reset_cmd,
+		cre_hw_info->top_reg_offset->base + top_reg->reset_cmd);
+
+	rc = wait_for_completion_timeout(
+			&cre_top_info.reset_complete,
+			msecs_to_jiffies(60));
+
+	if (!rc || rc < 0) {
+		spin_lock_irqsave(&cre_top_info.hw_lock, flags);
+		if (!completion_done(&cre_top_info.reset_complete)) {
+			CAM_DBG(CAM_CRE,
+				"IRQ delayed, checking the status registers");
+			irq_mask = cam_io_r_mb(cre_hw_info->top_reg_offset->base +
+				top_reg->irq_mask);
+			irq_status = cam_io_r_mb(cre_hw_info->top_reg_offset->base +
+				top_reg->irq_status);
+			if (irq_status & top_reg_val->rst_done) {
+				CAM_DBG(CAM_CRE, "cre reset done");
+				cam_io_w_mb(irq_status,
+					top_reg->base + top_reg->irq_clear);
+				cam_io_w_mb(top_reg_val->irq_cmd_clear,
+					top_reg->base + top_reg->irq_cmd);
+			} else {
+				CAM_ERR(CAM_CRE,
+					"irq mask 0x%x irq status 0x%x",
+					irq_mask, irq_status);
+				rc = -ETIMEDOUT;
+			}
+		} else {
+			rc = 0;
+		}
+		spin_unlock_irqrestore(&cre_top_info.hw_lock, flags);
+	} else {
+		rc = 0;
+	}
+
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		cre_hw_info->top_reg_offset->base + top_reg->irq_mask);
+
+	mutex_unlock(&cre_top_info.cre_hw_mutex);
+	return rc;
+}
+
+static int cam_cre_top_release(struct cam_cre_hw *cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (ctx_id < 0) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	cre_top_info.top_ctx[ctx_id].cre_acquire = NULL;
+
+	return rc;
+}
+
+static int cam_cre_top_acquire(struct cam_cre_hw *cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_cre_dev_acquire *cre_dev_acquire = data;
+
+	if (ctx_id < 0 || !data) {
+		CAM_ERR(CAM_CRE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+
+	cre_top_info.top_ctx[ctx_id].cre_acquire = cre_dev_acquire->cre_acquire;
+	cre_dev_acquire->cre_top = &cre_top_info;
+
+	return rc;
+}
+
+static int cam_cre_top_init(struct cam_cre_hw *cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_cre_top_reg *top_reg;
+	struct cam_cre_top_reg_val *top_reg_val;
+	struct cam_cre_dev_init *dev_init = data;
+	uint32_t irq_mask, irq_status;
+	unsigned long flags;
+
+	if (!cre_hw_info) {
+		CAM_ERR(CAM_CRE, "Invalid cre_hw_info");
+		return -EINVAL;
+	}
+
+	top_reg = cre_hw_info->top_reg_offset;
+	top_reg_val = cre_hw_info->top_reg_val;
+
+	top_reg->base = dev_init->core_info->cre_hw_info->cre_top_base;
+
+	mutex_init(&cre_top_info.cre_hw_mutex);
+	/* CRE SW RESET */
+	init_completion(&cre_top_info.reset_complete);
+	init_completion(&cre_top_info.idle_done);
+	init_completion(&cre_top_info.bufdone);
+
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		cre_hw_info->top_reg_offset->base + top_reg->irq_mask);
+	cam_io_w_mb(top_reg_val->sw_reset_cmd,
+		cre_hw_info->top_reg_offset->base + top_reg->reset_cmd);
+
+	rc = wait_for_completion_timeout(
+			&cre_top_info.reset_complete,
+			msecs_to_jiffies(60));
+
+	if (!rc || rc < 0) {
+		spin_lock_irqsave(&cre_top_info.hw_lock, flags);
+		if (!completion_done(&cre_top_info.reset_complete)) {
+			CAM_DBG(CAM_CRE,
+				"IRQ delayed, checking the status registers");
+			irq_mask = cam_io_r_mb(cre_hw_info->top_reg_offset->base +
+				top_reg->irq_mask);
+			irq_status = cam_io_r_mb(cre_hw_info->top_reg_offset->base +
+				top_reg->irq_status);
+			if (irq_status & top_reg_val->rst_done) {
+				CAM_DBG(CAM_CRE, "cre reset done");
+				cam_io_w_mb(irq_status,
+					top_reg->base + top_reg->irq_clear);
+				cam_io_w_mb(top_reg_val->irq_cmd_clear,
+					top_reg->base + top_reg->irq_cmd);
+			} else {
+				CAM_ERR(CAM_CRE,
+					"irq mask 0x%x irq status 0x%x",
+					irq_mask, irq_status);
+				rc = -ETIMEDOUT;
+			}
+		} else {
+			CAM_DBG(CAM_CRE, "reset done");
+			rc = 0;
+		}
+		spin_unlock_irqrestore(&cre_top_info.hw_lock, flags);
+	} else {
+		rc = 0;
+	}
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		cre_hw_info->top_reg_offset->base + top_reg->irq_mask);
+	return rc;
+}
+
+static int cam_cre_top_probe(struct cam_cre_hw *cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (!cre_hw_info) {
+		CAM_ERR(CAM_CRE, "Invalid cre_hw_info");
+		return -EINVAL;
+	}
+
+	cre_top_info.cre_hw_info = cre_hw_info;
+	spin_lock_init(&cre_top_info.hw_lock);
+
+	return rc;
+}
+
+static int cam_cre_top_isr(struct cam_cre_hw *cre_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	uint32_t irq_status;
+	struct cam_cre_top_reg *top_reg;
+	struct cam_cre_top_reg_val *top_reg_val;
+	struct cam_cre_irq_data *irq_data = data;
+
+	if (!cre_hw_info) {
+		CAM_ERR(CAM_CRE, "Invalid cre_hw_info");
+		return -EINVAL;
+	}
+
+	top_reg = cre_hw_info->top_reg_offset;
+	top_reg_val = cre_hw_info->top_reg_val;
+
+	spin_lock(&cre_top_info.hw_lock);
+	/* Read and Clear Top Interrupt status */
+	irq_status = cam_io_r_mb(top_reg->base + top_reg->irq_status);
+	cam_io_w_mb(irq_status,
+		top_reg->base + top_reg->irq_clear);
+
+	cam_io_w_mb(top_reg_val->irq_cmd_clear,
+		top_reg->base + top_reg->irq_cmd);
+
+	if (irq_status & top_reg_val->rst_done) {
+		CAM_DBG(CAM_CRE, "cre reset done");
+		complete(&cre_top_info.reset_complete);
+	}
+
+	if (irq_status & top_reg_val->idle) {
+		CAM_DBG(CAM_CRE, "cre idle IRQ, can configure new settings");
+		complete(&cre_top_info.idle_done);
+	}
+
+	if (irq_status & top_reg_val->we_done)
+		CAM_DBG(CAM_CRE, "Received Write Engine IRQ");
+
+	if (irq_status & top_reg_val->fe_done)
+		CAM_DBG(CAM_CRE, "Received Fetch Engine IRQ");
+
+	irq_data->top_irq_status = irq_status;
+	spin_unlock(&cre_top_info.hw_lock);
+
+	return rc;
+}
+
+int cam_cre_top_process(struct cam_cre_hw *cre_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data)
+{
+	int rc = 0;
+
+	switch (cmd_id) {
+	case CRE_HW_PROBE:
+		CAM_DBG(CAM_CRE, "CRE_HW_PROBE: E");
+		rc = cam_cre_top_probe(cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_PROBE: X");
+		break;
+	case CRE_HW_INIT:
+		CAM_DBG(CAM_CRE, "CRE_HW_INIT: E");
+		rc = cam_cre_top_init(cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_INIT: X");
+		break;
+	case CRE_HW_DEINIT:
+		break;
+	case CRE_HW_ACQUIRE:
+		CAM_DBG(CAM_CRE, "CRE_HW_ACQUIRE: E");
+		rc = cam_cre_top_acquire(cre_hw_info, ctx_id, data);
+		CAM_DBG(CAM_CRE, "CRE_HW_ACQUIRE: X");
+		break;
+	case CRE_HW_PREPARE:
+		break;
+	case CRE_HW_RELEASE:
+		rc = cam_cre_top_release(cre_hw_info, ctx_id, data);
+		break;
+	case CRE_HW_REG_SET_UPDATE:
+		break;
+	case CRE_HW_START:
+		break;
+	case CRE_HW_STOP:
+		break;
+	case CRE_HW_FLUSH:
+		break;
+	case CRE_HW_ISR:
+		rc = cam_cre_top_isr(cre_hw_info, ctx_id, data);
+		break;
+	case CRE_HW_RESET:
+		rc = cam_cre_top_reset(cre_hw_info, ctx_id, 0);
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/top/cre_top.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cre/cam_cre_hw_mgr/cre_hw/top/cre_top.h
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CRE_TOP_H
+#define CRE_TOP_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_cre.h>
+#include "cre_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_soc_util.h"
+#include "cam_context.h"
+#include "cam_cre_context.h"
+#include "cam_cre_hw_mgr.h"
+
+/**
+ * struct cre_top_ctx
+ *
+ * @cre_acquire: CRE acquire info
+ */
+struct cre_top_ctx {
+	struct cam_cre_acquire_dev_info *cre_acquire;
+};
+
+/**
+ * struct cre_top
+ *
+ * @cre_hw_info:    CRE hardware info
+ * @top_ctx:        CRE top context
+ * @reset_complete: Reset complete flag
+ * @cre_mutex:      CRE hardware mutex
+ * @hw_lock:        CRE hardware spinlock
+ */
+struct cre_top {
+	struct cam_cre_hw *cre_hw_info;
+	struct cre_top_ctx top_ctx[CAM_CRE_CTX_MAX];
+	struct completion reset_complete;
+	struct completion idle_done;
+	struct completion bufdone;
+	struct mutex      cre_hw_mutex;
+	spinlock_t        hw_lock;
+};
+#endif /* CRE_TOP_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_context.c
@@ -0,0 +1,1733 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/ratelimit.h>
+
+#include "cam_mem_mgr.h"
+#include "cam_sync_api.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+#include "cam_context_utils.h"
+#include "cam_custom_context.h"
+#include "cam_common_util.h"
+
+static const char custom_dev_name[] = "cam-custom";
+
+static int __cam_custom_ctx_handle_irq_in_activated(
+	void *context, uint32_t evt_id, void *evt_data);
+
+static int __cam_custom_ctx_start_dev_in_ready(
+	struct cam_context *ctx, struct cam_start_stop_dev_cmd *cmd);
+
+static int __cam_custom_ctx_apply_req_in_activated_state(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply,
+	uint32_t next_state);
+
+static int __cam_custom_ctx_apply_default_settings(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply);
+
+static int __cam_custom_ctx_apply_req_in_activated(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	rc = __cam_custom_ctx_apply_req_in_activated_state(
+		ctx, apply, CAM_CUSTOM_CTX_ACTIVATED_APPLIED);
+	CAM_DBG(CAM_CUSTOM, "new substate %d", custom_ctx->substate_activated);
+
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Apply failed in state %d rc %d",
+			custom_ctx->substate_activated, rc);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_handle_error(
+	struct cam_custom_context *custom_ctx, void *evt_data)
+{
+	/*
+	 * Handle any HW error scenerios here, all the
+	 * requests in all the lists can be signaled error.
+	 * Notify UMD about this error if needed.
+	 */
+
+	return 0;
+}
+
+static int __cam_custom_ctx_reg_upd_in_sof(
+	struct cam_custom_context *custom_ctx, void *evt_data)
+{
+	struct cam_ctx_request *req = NULL;
+	struct cam_custom_dev_ctx_req *req_custom;
+	struct cam_context *ctx = custom_ctx->base;
+
+	custom_ctx->frame_id++;
+
+	/*
+	 * This is for the first update before streamon.
+	 * The initial setting will cause the reg_upd in the
+	 * first frame.
+	 */
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		if (req_custom->num_fence_map_out == req_custom->num_acked) {
+			list_add_tail(&req->list, &ctx->free_req_list);
+		} else {
+			list_add_tail(&req->list, &ctx->active_req_list);
+			custom_ctx->active_req_cnt++;
+			CAM_DBG(CAM_REQ,
+				"move request %lld to active list(cnt = %d), ctx %u",
+				req->request_id, custom_ctx->active_req_cnt,
+				ctx->ctx_id);
+		}
+	}
+
+	return 0;
+}
+
+static int __cam_custom_ctx_reg_upd_in_applied_state(
+	struct cam_custom_context *custom_ctx, void *evt_data)
+{
+	struct cam_ctx_request         *req;
+	struct cam_context             *ctx = custom_ctx->base;
+	struct cam_custom_dev_ctx_req  *req_custom;
+
+	custom_ctx->frame_id++;
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_CUSTOM,
+				"Reg upd ack with no waiting request");
+		goto end;
+	}
+	req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+	list_del_init(&req->list);
+
+	req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+	if (req_custom->num_fence_map_out != 0) {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		custom_ctx->active_req_cnt++;
+		CAM_DBG(CAM_REQ,
+			"move request %lld to active list(cnt = %d), ctx %u",
+			req->request_id, custom_ctx->active_req_cnt,
+			ctx->ctx_id);
+	} else {
+		/* no io config, so the request is completed. */
+		list_add_tail(&req->list, &ctx->free_req_list);
+		CAM_DBG(CAM_ISP,
+			"move active request %lld to free list(cnt = %d), ctx %u",
+			req->request_id, custom_ctx->active_req_cnt,
+			ctx->ctx_id);
+	}
+
+	custom_ctx->substate_activated = CAM_CUSTOM_CTX_ACTIVATED_SOF;
+	CAM_DBG(CAM_CUSTOM, "next substate %d", custom_ctx->substate_activated);
+
+end:
+	return 0;
+}
+
+static int __cam_custom_ctx_frame_done(
+	struct cam_custom_context *custom_ctx, void *evt_data)
+{
+	int rc = 0, i, j;
+	uint64_t frame_done_req_id;
+	struct cam_ctx_request  *req;
+	struct cam_custom_dev_ctx_req  *req_custom;
+	struct cam_context *ctx = custom_ctx->base;
+	struct cam_custom_hw_done_event_data *done_data =
+		(struct cam_custom_hw_done_event_data *)evt_data;
+
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_DBG(CAM_CUSTOM, "Frame done with no active request");
+		return 0;
+	}
+
+	req = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+	req_custom = req->req_priv;
+
+	for (i = 0; i < done_data->num_handles; i++) {
+		for (j = 0; j < req_custom->num_fence_map_out; j++) {
+			if (done_data->resource_handle[i] ==
+				req_custom->fence_map_out[j].resource_handle)
+				break;
+		}
+
+		if (j == req_custom->num_fence_map_out) {
+			CAM_ERR(CAM_CUSTOM,
+				"Can not find matching rsrc handle 0x%x!",
+				done_data->resource_handle[i]);
+			rc = -EINVAL;
+			continue;
+		}
+
+		if (req_custom->fence_map_out[j].sync_id == -1) {
+			CAM_WARN(CAM_CUSTOM,
+				"Duplicate frame done for req %lld",
+				req->request_id);
+			continue;
+		}
+
+		if (!req_custom->bubble_detected) {
+			rc = cam_sync_signal(
+				req_custom->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_SUCCESS,
+				CAM_SYNC_COMMON_EVENT_SUCCESS);
+			if (rc)
+				CAM_ERR(CAM_CUSTOM,
+					"Sync failed with rc = %d", rc);
+		} else if (!req_custom->bubble_report) {
+			rc = cam_sync_signal(
+				req_custom->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_ERROR,
+				CAM_SYNC_ISP_EVENT_BUBBLE);
+			if (rc)
+				CAM_ERR(CAM_CUSTOM,
+					"Sync failed with rc = %d", rc);
+		} else {
+			req_custom->num_acked++;
+			CAM_DBG(CAM_CUSTOM, "frame done with bubble for %llu",
+				req->request_id);
+			continue;
+		}
+
+		req_custom->num_acked++;
+		req_custom->fence_map_out[j].sync_id = -1;
+	}
+
+	if (req_custom->num_acked > req_custom->num_fence_map_out) {
+		CAM_ERR(CAM_CUSTOM,
+			"WARNING: req_id %lld num_acked %d > map_out %d, ctx %u",
+			req->request_id, req_custom->num_acked,
+			req_custom->num_fence_map_out, ctx->ctx_id);
+	}
+
+	if (req_custom->num_acked != req_custom->num_fence_map_out)
+		return rc;
+
+	custom_ctx->active_req_cnt--;
+	frame_done_req_id = req->request_id;
+	if (req_custom->bubble_detected && req_custom->bubble_report) {
+		req_custom->num_acked = 0;
+		req_custom->bubble_detected = false;
+		list_del_init(&req->list);
+		if (frame_done_req_id <= ctx->last_flush_req) {
+			for (i = 0; i < req_custom->num_fence_map_out; i++)
+				rc = cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+
+			list_add_tail(&req->list, &ctx->free_req_list);
+			atomic_set(&custom_ctx->process_bubble, 0);
+			CAM_DBG(CAM_REQ,
+				"Move active request %lld to free list(cnt = %d) [flushed], ctx %u",
+				frame_done_req_id, custom_ctx->active_req_cnt,
+				ctx->ctx_id);
+		} else {
+			list_add(&req->list, &ctx->pending_req_list);
+			atomic_set(&custom_ctx->process_bubble, 0);
+			CAM_DBG(CAM_REQ,
+				"Move active request %lld to pending list in ctx %u",
+				frame_done_req_id, ctx->ctx_id);
+		}
+	} else {
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->free_req_list);
+		CAM_DBG(CAM_REQ,
+			"Move active request %lld to free list(cnt = %d) [all fences done], ctx %u",
+			frame_done_req_id,
+			custom_ctx->active_req_cnt,
+			ctx->ctx_id);
+	}
+
+	return rc;
+}
+
+static int __cam_custom_ctx_handle_bubble(
+	struct cam_context *ctx, uint64_t req_id)
+{
+	int                              rc = -EINVAL;
+	bool                             found = false;
+	struct cam_ctx_request          *req = NULL;
+	struct cam_ctx_request          *req_temp;
+	struct cam_custom_dev_ctx_req   *req_custom;
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->wait_req_list, list) {
+		if (req->request_id == req_id) {
+			req_custom =
+				(struct cam_custom_dev_ctx_req *)req->req_priv;
+			if (!req_custom->bubble_report) {
+				CAM_DBG(CAM_CUSTOM,
+					"Skip bubble recovery for %llu",
+					req_id);
+				goto end;
+			}
+
+			req_custom->bubble_detected = true;
+			found = true;
+			CAM_DBG(CAM_CUSTOM,
+				"Found bubbled req %llu in wait list",
+				req_id);
+		}
+	}
+
+	if (found) {
+		rc = 0;
+		goto end;
+	}
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->active_req_list, list) {
+		if (req->request_id == req_id) {
+			req_custom =
+				(struct cam_custom_dev_ctx_req *)req->req_priv;
+			if (!req_custom->bubble_report) {
+				CAM_DBG(CAM_CUSTOM,
+					"Skip bubble recovery for %llu",
+					req_id);
+				goto end;
+			}
+
+			req_custom->bubble_detected = true;
+			found = true;
+			CAM_DBG(CAM_CUSTOM,
+				"Found bubbled req %llu in active list",
+				req_id);
+		}
+	}
+
+	if (found)
+		rc = 0;
+	else
+		CAM_ERR(CAM_CUSTOM,
+			"req %llu not found in wait or active list bubble recovery failed ctx: %u",
+			req_id, ctx->ctx_id);
+
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_handle_evt(
+	struct cam_context *ctx,
+	struct cam_req_mgr_link_evt_data *evt_data)
+{
+	int rc = -1;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (evt_data->u.error == CRM_KMD_ERR_BUBBLE) {
+		rc = __cam_custom_ctx_handle_bubble(ctx, evt_data->req_id);
+		if (rc)
+			return rc;
+	} else {
+		CAM_WARN(CAM_CUSTOM, "Unsupported error type %d",
+			evt_data->u.error);
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Set bubble flag for req %llu in ctx %u",
+		evt_data->req_id, ctx->ctx_id);
+	atomic_set(&custom_ctx->process_bubble, 1);
+	return 0;
+}
+
+static struct cam_ctx_ops
+	cam_custom_ctx_activated_state_machine
+	[CAM_CUSTOM_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_custom_ctx_apply_req_in_activated,
+			.notify_frame_skip =
+				__cam_custom_ctx_apply_default_settings,
+		},
+		.irq_ops = NULL,
+	},
+	/* APPLIED */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_custom_ctx_apply_req_in_activated,
+			.notify_frame_skip =
+				__cam_custom_ctx_apply_default_settings,
+		},
+		.irq_ops = NULL,
+	},
+	/* HW ERROR */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HALT */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+};
+
+static struct cam_custom_ctx_irq_ops
+	cam_custom_ctx_activated_state_machine_irq
+	[CAM_CUSTOM_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			__cam_custom_ctx_handle_error,
+			__cam_custom_ctx_reg_upd_in_sof,
+			__cam_custom_ctx_frame_done,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_custom_ctx_handle_error,
+			__cam_custom_ctx_reg_upd_in_applied_state,
+			__cam_custom_ctx_frame_done,
+		},
+	},
+	/* HW ERROR */
+	{
+		.irq_ops = {
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* HALT */
+	{
+	},
+};
+
+static int __cam_custom_ctx_enqueue_request_in_order(
+	struct cam_context *ctx, struct cam_ctx_request *req)
+{
+	struct cam_ctx_request           *req_current;
+	struct cam_ctx_request           *req_prev;
+	struct list_head                  temp_list;
+
+	INIT_LIST_HEAD(&temp_list);
+	spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->pending_req_list)) {
+		list_add_tail(&req->list, &ctx->pending_req_list);
+	} else {
+		list_for_each_entry_safe_reverse(
+			req_current, req_prev, &ctx->pending_req_list, list) {
+			if (req->request_id < req_current->request_id) {
+				list_del_init(&req_current->list);
+				list_add(&req_current->list, &temp_list);
+				continue;
+			} else if (req->request_id == req_current->request_id) {
+				CAM_WARN(CAM_CUSTOM,
+					"Received duplicated request %lld",
+					req->request_id);
+			}
+			break;
+		}
+		list_add_tail(&req->list, &ctx->pending_req_list);
+
+		if (!list_empty(&temp_list)) {
+			list_for_each_entry_safe(
+				req_current, req_prev, &temp_list, list) {
+				list_del_init(&req_current->list);
+				list_add_tail(&req_current->list,
+					&ctx->pending_req_list);
+			}
+		}
+	}
+	spin_unlock_bh(&ctx->lock);
+	return 0;
+}
+
+static int __cam_custom_ctx_flush_req(struct cam_context *ctx,
+	struct list_head *req_list, struct cam_req_mgr_flush_request *flush_req)
+{
+	int i, rc;
+	uint32_t cancel_req_id_found = 0;
+	struct cam_ctx_request           *req;
+	struct cam_ctx_request           *req_temp;
+	struct cam_custom_dev_ctx_req    *req_custom;
+	struct list_head                  flush_list;
+
+	INIT_LIST_HEAD(&flush_list);
+	if (list_empty(req_list)) {
+		CAM_DBG(CAM_CUSTOM, "request list is empty");
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			CAM_INFO(CAM_CUSTOM, "no request to cancel (req:%lld)", flush_req->req_id);
+			return -EINVAL;
+		} else {
+			return 0;
+		}
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Flush [%u] in progress for req_id %llu",
+		flush_req->type, flush_req->req_id);
+	list_for_each_entry_safe(req, req_temp, req_list, list) {
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			if (req->request_id != flush_req->req_id) {
+				continue;
+			} else {
+				list_del_init(&req->list);
+				list_add_tail(&req->list, &flush_list);
+				cancel_req_id_found = 1;
+				break;
+			}
+		}
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &flush_list);
+	}
+
+	list_for_each_entry_safe(req, req_temp, &flush_list, list) {
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		for (i = 0; i < req_custom->num_fence_map_out; i++) {
+			if (req_custom->fence_map_out[i].sync_id != -1) {
+				CAM_DBG(CAM_CUSTOM,
+					"Flush req 0x%llx, fence %d",
+					 req->request_id,
+					req_custom->fence_map_out[i].sync_id);
+				rc = cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_FLUSH);
+				if (rc)
+					CAM_ERR_RATE_LIMIT(CAM_CUSTOM,
+						"signal fence failed\n");
+				req_custom->fence_map_out[i].sync_id = -1;
+			}
+		}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ &&
+		!cancel_req_id_found)
+		CAM_DBG(CAM_CUSTOM,
+			"Flush request id:%lld is not found in the list",
+			flush_req->req_id);
+
+	return 0;
+}
+
+static int __cam_custom_ctx_unlink_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+
+	return 0;
+}
+
+static int __cam_custom_ctx_unlink_in_ready(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	return 0;
+}
+
+static int __cam_custom_ctx_get_dev_info_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_device_info *dev_info)
+{
+	dev_info->dev_hdl = ctx->dev_hdl;
+	strscpy(dev_info->name, CAM_CUSTOM_DEV_NAME, sizeof(dev_info->name));
+	dev_info->dev_id = CAM_REQ_MGR_DEVICE_CUSTOM_HW;
+	dev_info->p_delay = 1;
+	dev_info->trigger = CAM_TRIGGER_POINT_SOF;
+
+	return 0;
+}
+
+static int __cam_custom_ctx_flush_req_in_top_state(
+	struct cam_context *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	int rc = 0;
+	struct cam_custom_context      *custom_ctx;
+	struct cam_hw_reset_args        reset_args;
+	struct cam_hw_stop_args         stop_args;
+	struct cam_custom_stop_args     custom_stop;
+
+	custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_CUSTOM, "Flushing pending list");
+	spin_lock_bh(&ctx->lock);
+	__cam_custom_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
+	spin_unlock_bh(&ctx->lock);
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		if (ctx->state <= CAM_CTX_READY) {
+			ctx->state = CAM_CTX_ACQUIRED;
+			goto end;
+		}
+
+		spin_lock_bh(&ctx->lock);
+		ctx->state = CAM_CTX_FLUSHED;
+		spin_unlock_bh(&ctx->lock);
+
+		CAM_INFO(CAM_CUSTOM, "Last request id to flush is %lld",
+			flush_req->req_id);
+		ctx->last_flush_req = flush_req->req_id;
+
+		/* stop hw first */
+		if (ctx->hw_mgr_intf->hw_stop) {
+			custom_stop.stop_only = true;
+			stop_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+			stop_args.args = (void *) &custom_stop;
+			rc = ctx->hw_mgr_intf->hw_stop(
+				ctx->hw_mgr_intf->hw_mgr_priv, &stop_args);
+			if (rc)
+				CAM_ERR(CAM_CUSTOM,
+					"HW stop failed in flush rc %d", rc);
+		}
+
+		spin_lock_bh(&ctx->lock);
+		if (!list_empty(&ctx->wait_req_list))
+			__cam_custom_ctx_flush_req(ctx, &ctx->wait_req_list,
+			flush_req);
+
+		if (!list_empty(&ctx->active_req_list))
+			__cam_custom_ctx_flush_req(ctx, &ctx->active_req_list,
+			flush_req);
+
+		custom_ctx->active_req_cnt = 0;
+		spin_unlock_bh(&ctx->lock);
+
+		reset_args.ctxt_to_hw_map = custom_ctx->hw_ctx;
+		rc = ctx->hw_mgr_intf->hw_reset(ctx->hw_mgr_intf->hw_mgr_priv,
+			&reset_args);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM,
+				"Reset HW failed in flush rc %d", rc);
+
+		custom_ctx->init_received = false;
+	}
+
+end:
+	atomic_set(&custom_ctx->process_bubble, 0);
+	return rc;
+}
+
+static int __cam_custom_ctx_flush_req_in_ready(
+	struct cam_context *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	int rc = 0;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_CUSTOM, "try to flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_custom_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
+
+	/* if nothing is in pending req list, change state to acquire */
+	if (list_empty(&ctx->pending_req_list))
+		ctx->state = CAM_CTX_ACQUIRED;
+	spin_unlock_bh(&ctx->lock);
+
+	atomic_set(&custom_ctx->process_bubble, 0);
+	CAM_DBG(CAM_CUSTOM, "Flush request in ready state. next state %d",
+		 ctx->state);
+	return rc;
+}
+
+static int __cam_custom_stop_dev_core(
+	struct cam_context *ctx, struct cam_start_stop_dev_cmd *stop_cmd)
+{
+	int rc = 0;
+	uint32_t i;
+	struct cam_custom_context          *ctx_custom =
+		(struct cam_custom_context *)   ctx->ctx_priv;
+	struct cam_ctx_request             *req;
+	struct cam_custom_dev_ctx_req      *req_custom;
+	struct cam_hw_stop_args             stop;
+	struct cam_custom_stop_args         custom_stop;
+
+	if ((ctx->state != CAM_CTX_FLUSHED) && (ctx_custom->hw_ctx) &&
+		(ctx->hw_mgr_intf->hw_stop)) {
+		custom_stop.stop_only = false;
+		stop.ctxt_to_hw_map = ctx_custom->hw_ctx;
+		stop.args = (void *) &custom_stop;
+		rc = ctx->hw_mgr_intf->hw_stop(ctx->hw_mgr_intf->hw_mgr_priv,
+			&stop);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "HW stop failed rc %d", rc);
+	}
+
+	while (!list_empty(&ctx->pending_req_list)) {
+		req = list_first_entry(&ctx->pending_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_CUSTOM,
+			"signal fence in pending list. fence num %d",
+			 req_custom->num_fence_map_out);
+		for (i = 0; i < req_custom->num_fence_map_out; i++)
+			if (req_custom->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_STOP);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	while (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_CUSTOM, "signal fence in wait list. fence num %d",
+			 req_custom->num_fence_map_out);
+		for (i = 0; i < req_custom->num_fence_map_out; i++)
+			if (req_custom->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_STOP);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	while (!list_empty(&ctx->active_req_list)) {
+		req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_CUSTOM, "signal fence in active list. fence num %d",
+			 req_custom->num_fence_map_out);
+		for (i = 0; i < req_custom->num_fence_map_out; i++)
+			if (req_custom->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_STOP);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+	ctx_custom->frame_id = 0;
+	ctx_custom->active_req_cnt = 0;
+
+	CAM_DBG(CAM_CUSTOM, "Stop device success next state %d on ctx %u",
+		ctx->state, ctx->ctx_id);
+
+	if (!stop_cmd) {
+		rc = __cam_custom_ctx_unlink_in_ready(ctx, NULL);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "Unlink failed rc=%d", rc);
+	}
+	return rc;
+}
+
+static int __cam_custom_stop_dev_in_activated(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	struct cam_custom_context *ctx_custom =
+		(struct cam_custom_context *)ctx->ctx_priv;
+
+	__cam_custom_stop_dev_core(ctx, cmd);
+	ctx_custom->init_received = false;
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	return 0;
+}
+
+static int __cam_custom_ctx_release_hw_in_top_state(
+	struct cam_context *ctx, void *cmd)
+{
+	int rc = 0;
+	struct cam_hw_release_args        rel_arg;
+	struct cam_req_mgr_flush_request  flush_req;
+	struct cam_custom_context        *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (custom_ctx->hw_ctx) {
+		rel_arg.ctxt_to_hw_map = custom_ctx->hw_ctx;
+		rc = ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv,
+			&rel_arg);
+		custom_ctx->hw_ctx = NULL;
+		if (rc)
+			CAM_ERR(CAM_CUSTOM,
+				"Failed to release HW for ctx:%u", ctx->ctx_id);
+	} else {
+		CAM_ERR(CAM_CUSTOM, "No HW resources acquired for this ctx");
+	}
+
+	ctx->last_flush_req = 0;
+	custom_ctx->frame_id = 0;
+	custom_ctx->active_req_cnt = 0;
+	custom_ctx->hw_acquired = false;
+	custom_ctx->init_received = false;
+
+	/* check for active requests as well */
+	flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_ALL;
+	flush_req.link_hdl = ctx->link_hdl;
+	flush_req.dev_hdl = ctx->dev_hdl;
+	flush_req.req_id = 0;
+
+	CAM_DBG(CAM_CUSTOM, "try to flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_custom_ctx_flush_req(ctx, &ctx->pending_req_list,
+		&flush_req);
+	spin_unlock_bh(&ctx->lock);
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	CAM_DBG(CAM_CUSTOM, "Release HW success[%u] next state %d",
+		ctx->ctx_id, ctx->state);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_release_hw_in_activated_state(
+	struct cam_context *ctx, void *cmd)
+{
+	int rc = 0;
+
+	rc = __cam_custom_stop_dev_in_activated(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Stop device failed rc=%d", rc);
+
+	rc = __cam_custom_ctx_release_hw_in_top_state(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Release hw failed rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_custom_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_custom_context *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+	struct cam_req_mgr_flush_request flush_req;
+
+	if (cmd && ctx_custom->hw_ctx) {
+		CAM_ERR(CAM_CUSTOM, "releasing hw");
+		__cam_custom_ctx_release_hw_in_top_state(ctx, NULL);
+	}
+
+	ctx->ctx_crm_intf = NULL;
+	ctx->last_flush_req = 0;
+	ctx_custom->frame_id = 0;
+	ctx_custom->active_req_cnt = 0;
+	ctx_custom->hw_acquired = false;
+	ctx_custom->init_received = false;
+
+	if (!list_empty(&ctx->active_req_list))
+		CAM_ERR(CAM_CUSTOM, "Active list is not empty");
+
+	/* Flush all the pending request list  */
+	flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_ALL;
+	flush_req.link_hdl = ctx->link_hdl;
+	flush_req.dev_hdl = ctx->dev_hdl;
+	flush_req.req_id = 0;
+
+	CAM_DBG(CAM_CUSTOM, "try to flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_custom_ctx_flush_req(ctx, &ctx->pending_req_list,
+		&flush_req);
+	spin_unlock_bh(&ctx->lock);
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	CAM_DBG(CAM_CUSTOM, "Release device success[%u] next state %d",
+		ctx->ctx_id, ctx->state);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_apply_default_settings(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args        hw_cmd_args;
+	struct cam_custom_hw_cmd_args custom_hw_cmd_args;
+
+	hw_cmd_args.ctxt_to_hw_map = custom_ctx->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	custom_hw_cmd_args.cmd_type =
+		CAM_CUSTOM_HW_MGR_PROG_DEFAULT_CONFIG;
+	hw_cmd_args.u.internal_args = (void *)&custom_hw_cmd_args;
+
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&hw_cmd_args);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM,
+			"Failed to apply default settings rc %d", rc);
+	else
+		CAM_DBG(CAM_CUSTOM, "Applied default settings rc %d", rc);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_apply_req_in_activated_state(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply,
+	uint32_t next_state)
+{
+	int rc = 0;
+	struct cam_ctx_request          *req;
+	struct cam_custom_dev_ctx_req   *req_custom;
+	struct cam_custom_context       *custom_ctx = NULL;
+	struct cam_hw_config_args        cfg;
+
+	if (atomic_read(&custom_ctx->process_bubble)) {
+		CAM_WARN(CAM_CUSTOM,
+			"ctx_id:%d Processing bubble cannot apply Request Id %llu",
+			ctx->ctx_id, apply->request_id);
+		rc = -EAGAIN;
+		goto end;
+	}
+
+	if (list_empty(&ctx->pending_req_list)) {
+		CAM_ERR(CAM_CUSTOM, "No available request for Apply id %lld",
+			apply->request_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (!list_empty(&ctx->wait_req_list))
+		CAM_WARN(CAM_CUSTOM, "Apply invoked with a req in wait list");
+
+	custom_ctx = (struct cam_custom_context *) ctx->ctx_priv;
+	spin_lock_bh(&ctx->lock);
+	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+		list);
+	spin_unlock_bh(&ctx->lock);
+
+	/*
+	 * Check whether the request id is matching the tip
+	 */
+	if (req->request_id != apply->request_id) {
+		CAM_ERR_RATE_LIMIT(CAM_CUSTOM,
+			"Invalid Request Id asking %llu existing %llu",
+			apply->request_id, req->request_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+	req_custom->bubble_report = apply->report_if_bubble;
+	cfg.ctxt_to_hw_map = custom_ctx->hw_ctx;
+	cfg.request_id = req->request_id;
+	cfg.hw_update_entries = req_custom->cfg;
+	cfg.num_hw_update_entries = req_custom->num_cfg;
+	cfg.priv  = &req_custom->hw_update_data;
+	cfg.init_packet = 0;
+
+	rc = ctx->hw_mgr_intf->hw_config(ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_CUSTOM,
+			"Can not apply the configuration");
+	} else {
+		spin_lock_bh(&ctx->lock);
+		custom_ctx->substate_activated = next_state;
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->wait_req_list);
+		spin_unlock_bh(&ctx->lock);
+	}
+
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_acquire_hw_v1(
+	struct cam_context *ctx, void *args)
+{
+	int rc = 0;
+	struct cam_acquire_hw_cmd_v1 *cmd =
+		(struct cam_acquire_hw_cmd_v1 *)args;
+	struct cam_hw_acquire_args         param;
+	struct cam_custom_context         *ctx_custom =
+		(struct cam_custom_context *)  ctx->ctx_priv;
+	struct cam_custom_acquire_hw_info *acquire_hw_info = NULL;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CUSTOM, "HW interface is not ready");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_CUSTOM,
+		"session_hdl 0x%x, hdl type %d, res %lld",
+		cmd->session_handle, cmd->handle_type, cmd->resource_hdl);
+
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_CUSTOM, "Only user pointer is supported");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cmd->data_size < sizeof(*acquire_hw_info)) {
+		CAM_ERR(CAM_CUSTOM, "data_size is not a valid value");
+		goto end;
+	}
+
+	acquire_hw_info = kzalloc(cmd->data_size, GFP_KERNEL);
+	if (!acquire_hw_info) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "start copy resources from user");
+
+	if (copy_from_user(acquire_hw_info, (void __user *)cmd->resource_hdl,
+		cmd->data_size)) {
+		rc = -EFAULT;
+		goto free_res;
+	}
+
+	memset(&param, 0, sizeof(param));
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.acquire_info_size = cmd->data_size;
+	param.acquire_info = (uint64_t) acquire_hw_info;
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_CUSTOM, "Acquire HW failed");
+		goto free_res;
+	}
+
+	ctx_custom->substate_machine_irq =
+		cam_custom_ctx_activated_state_machine_irq;
+	ctx_custom->substate_machine =
+		cam_custom_ctx_activated_state_machine;
+	ctx_custom->hw_ctx = param.ctxt_to_hw_map;
+	ctx_custom->hw_acquired = true;
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Acquire HW success on session_hdl 0x%xs for ctx_id %u",
+		ctx->session_hdl, ctx->ctx_id);
+
+	kfree(acquire_hw_info);
+	return rc;
+
+free_res:
+	kfree(acquire_hw_info);
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_acquire_dev_in_available(
+	struct cam_context *ctx, struct cam_acquire_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_create_dev_hdl  req_hdl_param;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CUSTOM, "HW interface is not ready");
+		rc = -EFAULT;
+		return rc;
+	}
+
+	CAM_DBG(CAM_CUSTOM,
+		"session_hdl 0x%x, num_resources %d, hdl type %d, res %lld",
+		cmd->session_handle, cmd->num_resources,
+		cmd->handle_type, cmd->resource_hdl);
+
+	if (cmd->num_resources != CAM_API_COMPAT_CONSTANT) {
+		CAM_ERR(CAM_CUSTOM, "Invalid num_resources 0x%x",
+			cmd->num_resources);
+		return -EINVAL;
+	}
+
+	req_hdl_param.session_hdl = cmd->session_handle;
+	req_hdl_param.v4l2_sub_dev_flag = 0;
+	req_hdl_param.media_entity_flag = 0;
+	req_hdl_param.ops = ctx->crm_ctx_intf;
+	req_hdl_param.priv = ctx;
+
+	CAM_DBG(CAM_CUSTOM, "get device handle from bridge");
+	ctx->dev_hdl = cam_create_device_hdl(&req_hdl_param);
+	if (ctx->dev_hdl <= 0) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_CUSTOM, "Can not create device handle");
+		return rc;
+	}
+
+	cmd->dev_handle = ctx->dev_hdl;
+	ctx->session_hdl = cmd->session_handle;
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Acquire dev success on session_hdl 0x%x for ctx %u",
+		cmd->session_handle, ctx->ctx_id);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_enqueue_init_request(
+	struct cam_context *ctx, struct cam_ctx_request *req)
+{
+	int rc = 0;
+	struct cam_ctx_request           *req_old;
+	struct cam_custom_dev_ctx_req    *req_custom_old;
+	struct cam_custom_dev_ctx_req    *req_custom_new;
+
+	spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->pending_req_list)) {
+		list_add_tail(&req->list, &ctx->pending_req_list);
+		goto end;
+	}
+
+	req_old = list_first_entry(&ctx->pending_req_list,
+		struct cam_ctx_request, list);
+	req_custom_old = (struct cam_custom_dev_ctx_req *) req_old->req_priv;
+	req_custom_new = (struct cam_custom_dev_ctx_req *) req->req_priv;
+	if (req_custom_old->hw_update_data.packet_opcode_type ==
+		CAM_CUSTOM_PACKET_INIT_DEV) {
+		if ((req_custom_old->num_cfg + req_custom_new->num_cfg) >=
+			CAM_CUSTOM_CTX_CFG_MAX) {
+			CAM_WARN(CAM_CUSTOM, "Can not merge INIT pkt");
+			rc = -ENOMEM;
+		}
+
+		if (req_custom_old->num_fence_map_out != 0 ||
+			req_custom_old->num_fence_map_in != 0) {
+			CAM_WARN(CAM_CUSTOM, "Invalid INIT pkt sequence");
+			rc = -EINVAL;
+		}
+
+		if (!rc) {
+			memcpy(req_custom_old->fence_map_out,
+				req_custom_new->fence_map_out,
+				sizeof(req_custom_new->fence_map_out[0])*
+				req_custom_new->num_fence_map_out);
+			req_custom_old->num_fence_map_out =
+				req_custom_new->num_fence_map_out;
+
+			memcpy(req_custom_old->fence_map_in,
+				req_custom_new->fence_map_in,
+				sizeof(req_custom_new->fence_map_in[0])*
+				req_custom_new->num_fence_map_in);
+			req_custom_old->num_fence_map_in =
+				req_custom_new->num_fence_map_in;
+
+			memcpy(&req_custom_old->cfg[req_custom_old->num_cfg],
+				req_custom_new->cfg,
+				sizeof(req_custom_new->cfg[0])*
+				req_custom_new->num_cfg);
+			req_custom_old->num_cfg += req_custom_new->num_cfg;
+
+			req_old->request_id = req->request_id;
+
+			list_add_tail(&req->list, &ctx->free_req_list);
+		}
+	} else {
+		CAM_WARN(CAM_CUSTOM,
+			"Received Update pkt before INIT pkt. req_id= %lld",
+			req->request_id);
+		rc = -EINVAL;
+	}
+end:
+	spin_unlock_bh(&ctx->lock);
+	return rc;
+}
+
+static int __cam_custom_ctx_config_dev(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0, i;
+	struct cam_ctx_request           *req = NULL;
+	struct cam_custom_dev_ctx_req    *req_custom;
+	struct cam_packet                *packet;
+	struct cam_hw_prepare_update_args cfg;
+	struct cam_req_mgr_add_request    add_req;
+	struct cam_custom_context        *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	/* get free request */
+	spin_lock_bh(&ctx->lock);
+	if (!list_empty(&ctx->free_req_list)) {
+		req = list_first_entry(&ctx->free_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+	}
+	spin_unlock_bh(&ctx->lock);
+
+	if (!req) {
+		CAM_ERR(CAM_CUSTOM, "No more request obj free");
+		return -ENOMEM;
+	}
+
+	req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+
+	cam_context_parse_config_cmd(ctx, cmd, &packet);
+	if (IS_ERR(packet)) {
+		rc = PTR_ERR(packet);
+		goto free_req;
+	}
+
+	if ((((packet->header.op_code) & 0xF) ==
+		CAM_CUSTOM_PACKET_UPDATE_DEV)
+		&& (packet->header.request_id <= ctx->last_flush_req)) {
+		CAM_DBG(CAM_CUSTOM,
+			"request %lld has been flushed, reject packet",
+			packet->header.request_id);
+		rc = -EINVAL;
+		goto free_req;
+	}
+
+	/* preprocess the configuration */
+	memset(&cfg, 0, sizeof(cfg));
+	cfg.packet = packet;
+	cfg.ctxt_to_hw_map = ctx_custom->hw_ctx;
+	cfg.out_map_entries = req_custom->fence_map_out;
+	cfg.max_out_map_entries = CAM_CUSTOM_DEV_CTX_RES_MAX;
+	cfg.in_map_entries = req_custom->fence_map_in;
+	cfg.max_in_map_entries = CAM_CUSTOM_DEV_CTX_RES_MAX;
+	cfg.priv  = &req_custom->hw_update_data;
+	cfg.pf_data = &(req->pf_data);
+
+	rc = ctx->hw_mgr_intf->hw_prepare_update(
+		ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc != 0) {
+		CAM_ERR(CAM_CUSTOM, "Prepare config packet failed in HW layer");
+		rc = -EFAULT;
+		goto free_req;
+	}
+
+	req_custom->num_cfg = cfg.num_hw_update_entries;
+	req_custom->num_fence_map_out = cfg.num_out_map_entries;
+	req_custom->num_fence_map_in = cfg.num_in_map_entries;
+	req_custom->num_acked = 0;
+	req_custom->hw_update_data.num_cfg = cfg.num_out_map_entries;
+
+	for (i = 0; i < req_custom->num_fence_map_out; i++) {
+		rc = cam_sync_get_obj_ref(req_custom->fence_map_out[i].sync_id);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can't get ref for fence %d",
+				req_custom->fence_map_out[i].sync_id);
+			goto put_ref;
+		}
+	}
+
+	CAM_DBG(CAM_CUSTOM,
+		"num_entry: %d, num fence out: %d, num fence in: %d",
+		req_custom->num_cfg, req_custom->num_fence_map_out,
+		req_custom->num_fence_map_in);
+
+	req->request_id = packet->header.request_id;
+	req->status = 1;
+
+	CAM_DBG(CAM_CUSTOM, "Packet request id %lld packet opcode:%d",
+		packet->header.request_id,
+		req_custom->hw_update_data.packet_opcode_type);
+
+	if (req_custom->hw_update_data.packet_opcode_type ==
+		CAM_CUSTOM_PACKET_INIT_DEV) {
+		if (ctx->state < CAM_CTX_ACTIVATED) {
+			rc = __cam_custom_ctx_enqueue_init_request(ctx, req);
+			if (rc)
+				CAM_ERR(CAM_CUSTOM, "Enqueue INIT pkt failed");
+			ctx_custom->init_received = true;
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_CUSTOM, "Recevied INIT pkt in wrong state");
+		}
+	} else {
+		if ((ctx->state != CAM_CTX_FLUSHED) &&
+			(ctx->state >= CAM_CTX_READY) &&
+			(ctx->ctx_crm_intf->add_req)) {
+			memset(&add_req, 0, sizeof(add_req));
+			add_req.link_hdl = ctx->link_hdl;
+			add_req.dev_hdl  = ctx->dev_hdl;
+			add_req.req_id   = req->request_id;
+			rc = ctx->ctx_crm_intf->add_req(&add_req);
+			if (rc) {
+				CAM_ERR(CAM_CUSTOM,
+					"Add req failed: req id=%llu",
+					req->request_id);
+			} else {
+				__cam_custom_ctx_enqueue_request_in_order(
+					ctx, req);
+			}
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_CUSTOM, "Recevied Update in wrong state");
+		}
+	}
+
+	if (rc)
+		goto put_ref;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Preprocessing Config req_id %lld successful on ctx %u",
+		req->request_id, ctx->ctx_id);
+
+	return rc;
+
+put_ref:
+	for (--i; i >= 0; i--) {
+		if (cam_sync_put_obj_ref(req_custom->fence_map_out[i].sync_id))
+			CAM_ERR(CAM_CUSTOM, "Failed to put ref of fence %d",
+				req_custom->fence_map_out[i].sync_id);
+	}
+free_req:
+	spin_lock_bh(&ctx->lock);
+	list_add_tail(&req->list, &ctx->free_req_list);
+	spin_unlock_bh(&ctx->lock);
+
+	return rc;
+
+}
+
+static int __cam_custom_ctx_config_dev_in_flushed(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_start_stop_dev_cmd start_cmd;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (!custom_ctx->hw_acquired) {
+		CAM_ERR(CAM_CUSTOM, "HW is not acquired, reject packet");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = __cam_custom_ctx_config_dev(ctx, cmd);
+	if (rc)
+		goto end;
+
+	if (!custom_ctx->init_received) {
+		CAM_WARN(CAM_CUSTOM,
+			"Received update packet in flushed state, skip start");
+		goto end;
+	}
+
+	start_cmd.dev_handle = cmd->dev_handle;
+	start_cmd.session_handle = cmd->session_handle;
+	rc = __cam_custom_ctx_start_dev_in_ready(ctx, &start_cmd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM,
+			"Failed to re-start HW after flush rc: %d", rc);
+	else
+		CAM_INFO(CAM_CUSTOM,
+			"Received init after flush. Re-start HW complete.");
+
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_config_dev_in_acquired(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_custom_context        *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (!ctx_custom->hw_acquired) {
+		CAM_ERR(CAM_CUSTOM, "HW not acquired, reject config packet");
+		return -EAGAIN;
+	}
+
+	rc = __cam_custom_ctx_config_dev(ctx, cmd);
+
+	if (!rc && (ctx->link_hdl >= 0))
+		ctx->state = CAM_CTX_READY;
+
+	return rc;
+}
+
+static int __cam_custom_ctx_link_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *link)
+{
+	struct cam_custom_context *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	ctx->link_hdl = link->link_hdl;
+	ctx->ctx_crm_intf = link->crm_cb;
+
+	/* change state only if we had the init config */
+	if (ctx_custom->init_received)
+		ctx->state = CAM_CTX_READY;
+
+	CAM_DBG(CAM_CUSTOM, "next state %d", ctx->state);
+
+	return 0;
+}
+
+static int __cam_custom_ctx_start_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_custom_start_args     custom_start;
+	struct cam_ctx_request          *req;
+	struct cam_custom_dev_ctx_req   *req_custom;
+	struct cam_custom_context       *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (cmd->session_handle != ctx->session_hdl ||
+		cmd->dev_handle != ctx->dev_hdl) {
+		rc = -EPERM;
+		goto end;
+	}
+
+	if (list_empty(&ctx->pending_req_list)) {
+		/* should never happen */
+		CAM_ERR(CAM_CUSTOM, "Start device with empty configuration");
+		rc = -EFAULT;
+		goto end;
+	} else {
+		req = list_first_entry(&ctx->pending_req_list,
+			struct cam_ctx_request, list);
+	}
+	req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+
+	if (!ctx_custom->hw_ctx) {
+		CAM_ERR(CAM_CUSTOM, "Wrong hw context pointer.");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	custom_start.hw_config.ctxt_to_hw_map = ctx_custom->hw_ctx;
+	custom_start.hw_config.request_id = req->request_id;
+	custom_start.hw_config.hw_update_entries = req_custom->cfg;
+	custom_start.hw_config.num_hw_update_entries = req_custom->num_cfg;
+	custom_start.hw_config.priv  = &req_custom->hw_update_data;
+	custom_start.hw_config.init_packet = 1;
+	if (ctx->state == CAM_CTX_FLUSHED)
+		custom_start.start_only = true;
+	else
+		custom_start.start_only = false;
+
+	ctx_custom->frame_id = 0;
+	ctx_custom->active_req_cnt = 0;
+	atomic_set(&ctx_custom->process_bubble, 0);
+	ctx_custom->substate_activated =
+		(req_custom->num_fence_map_out) ?
+		CAM_CUSTOM_CTX_ACTIVATED_APPLIED :
+		CAM_CUSTOM_CTX_ACTIVATED_SOF;
+
+	ctx->state = CAM_CTX_ACTIVATED;
+	rc = ctx->hw_mgr_intf->hw_start(ctx->hw_mgr_intf->hw_mgr_priv,
+		&custom_start);
+	if (rc) {
+		/* HW failure. User need to clean up the resource */
+		CAM_ERR(CAM_CUSTOM, "Start HW failed");
+		ctx->state = CAM_CTX_READY;
+		goto end;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "start device success ctx %u",
+		ctx->ctx_id);
+
+	spin_lock_bh(&ctx->lock);
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->wait_req_list);
+	spin_unlock_bh(&ctx->lock);
+
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_release_dev_in_activated(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	rc = __cam_custom_stop_dev_core(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Stop device failed rc=%d", rc);
+
+	rc = __cam_custom_release_dev_in_acquired(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Release device failed rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_unlink_in_activated(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc = 0;
+
+	CAM_WARN(CAM_CUSTOM,
+		"Received unlink in activated state. It's unexpected");
+
+	rc = __cam_custom_stop_dev_in_activated(ctx, NULL);
+	if (rc)
+		CAM_WARN(CAM_CUSTOM, "Stop device failed rc=%d", rc);
+
+	rc = __cam_custom_ctx_unlink_in_ready(ctx, unlink);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Unlink failed rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_handle_irq_in_activated(void *context,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc = 0;
+	struct cam_custom_ctx_irq_ops *custom_irq_ops = NULL;
+	struct cam_context *ctx = (struct cam_context *)context;
+	struct cam_custom_context *ctx_custom =
+		(struct cam_custom_context *)ctx->ctx_priv;
+
+	spin_lock(&ctx->lock);
+	CAM_DBG(CAM_CUSTOM, "Enter: State %d, Substate %d, evt id %d",
+		 ctx->state, ctx_custom->substate_activated, evt_id);
+	custom_irq_ops = &ctx_custom->substate_machine_irq[
+				ctx_custom->substate_activated];
+	if (custom_irq_ops->irq_ops[evt_id])
+		rc = custom_irq_ops->irq_ops[evt_id](ctx_custom,
+			evt_data);
+	else
+		CAM_DBG(CAM_CUSTOM, "No handle function for substate %d",
+			ctx_custom->substate_activated);
+
+	CAM_DBG(CAM_CUSTOM, "Exit: State %d Substate %d",
+		 ctx->state, ctx_custom->substate_activated);
+
+	spin_unlock(&ctx->lock);
+	return rc;
+}
+
+static int __cam_custom_ctx_acquire_hw_in_acquired(
+	struct cam_context *ctx, void *args)
+{
+	int rc = -EINVAL;
+	uint32_t api_version;
+
+	if (!ctx || !args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input pointer");
+		return rc;
+	}
+
+	api_version = *((uint32_t *)args);
+	if (api_version == 1)
+		rc = __cam_custom_ctx_acquire_hw_v1(ctx, args);
+	else
+		CAM_ERR(CAM_CUSTOM, "Unsupported api version %d",
+			api_version);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_apply_req(struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_ctx_ops *ctx_ops = NULL;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Enter: apply req in Substate %d request _id:%lld",
+		 custom_ctx->substate_activated, apply->request_id);
+
+	ctx_ops = &custom_ctx->substate_machine[
+		custom_ctx->substate_activated];
+	if (ctx_ops->crm_ops.apply_req) {
+		rc = ctx_ops->crm_ops.apply_req(ctx, apply);
+	} else {
+		CAM_WARN_RATE_LIMIT(CAM_CUSTOM,
+			"No handle function in activated substate %d",
+			custom_ctx->substate_activated);
+		rc = -EFAULT;
+	}
+
+	if (rc)
+		CAM_WARN_RATE_LIMIT(CAM_CUSTOM,
+			"Apply failed in active substate %d rc %d",
+			custom_ctx->substate_activated, rc);
+	return rc;
+}
+
+static int __cam_custom_ctx_apply_default_req(
+	struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_ctx_ops *ctx_ops = NULL;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Enter: apply req in Substate %d request _id:%lld",
+		 custom_ctx->substate_activated, apply->request_id);
+
+	ctx_ops = &custom_ctx->substate_machine[
+		custom_ctx->substate_activated];
+	if (ctx_ops->crm_ops.notify_frame_skip) {
+		rc = ctx_ops->crm_ops.notify_frame_skip(ctx, apply);
+	} else {
+		CAM_WARN_RATE_LIMIT(CAM_CUSTOM,
+			"No handle function in activated substate %d",
+			custom_ctx->substate_activated);
+		rc = -EFAULT;
+	}
+
+	if (rc)
+		CAM_WARN_RATE_LIMIT(CAM_CUSTOM,
+			"Apply default failed in active substate %d rc %d",
+			custom_ctx->substate_activated, rc);
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_custom_dev_ctx_top_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev =
+				__cam_custom_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.acquire_hw = __cam_custom_ctx_acquire_hw_in_acquired,
+			.release_dev = __cam_custom_release_dev_in_acquired,
+			.config_dev = __cam_custom_ctx_config_dev_in_acquired,
+			.release_hw = __cam_custom_ctx_release_hw_in_top_state,
+		},
+		.crm_ops = {
+			.link = __cam_custom_ctx_link_in_acquired,
+			.unlink = __cam_custom_ctx_unlink_in_acquired,
+			.get_dev_info =
+				__cam_custom_ctx_get_dev_info_in_acquired,
+			.flush_req = __cam_custom_ctx_flush_req_in_top_state,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = NULL,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {
+			.start_dev = __cam_custom_ctx_start_dev_in_ready,
+			.release_dev = __cam_custom_release_dev_in_acquired,
+			.config_dev = __cam_custom_ctx_config_dev,
+			.release_hw = __cam_custom_ctx_release_hw_in_top_state,
+		},
+		.crm_ops = {
+			.unlink = __cam_custom_ctx_unlink_in_ready,
+			.flush_req = __cam_custom_ctx_flush_req_in_ready,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = NULL,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_custom_stop_dev_in_activated,
+			.release_dev =
+				__cam_custom_ctx_release_dev_in_activated,
+			.config_dev = __cam_custom_ctx_config_dev_in_flushed,
+			.release_hw =
+				__cam_custom_ctx_release_hw_in_activated_state,
+		},
+		.crm_ops = {
+			.unlink = __cam_custom_ctx_unlink_in_ready,
+			.process_evt = __cam_custom_ctx_handle_evt,
+		},
+		.irq_ops = NULL,
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_custom_stop_dev_in_activated,
+			.release_dev =
+				__cam_custom_ctx_release_dev_in_activated,
+			.config_dev = __cam_custom_ctx_config_dev,
+			.release_hw =
+				__cam_custom_ctx_release_hw_in_activated_state,
+		},
+		.crm_ops = {
+			.unlink = __cam_custom_ctx_unlink_in_activated,
+			.apply_req = __cam_custom_ctx_apply_req,
+			.notify_frame_skip =
+				__cam_custom_ctx_apply_default_req,
+			.flush_req = __cam_custom_ctx_flush_req_in_top_state,
+			.process_evt = __cam_custom_ctx_handle_evt,
+		},
+		.irq_ops = __cam_custom_ctx_handle_irq_in_activated,
+		.pagefault_ops = NULL,
+	},
+};
+
+int cam_custom_dev_context_init(struct cam_custom_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_req_mgr_kmd_ops *crm_node_intf,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id, int img_iommu_hdl)
+{
+	int rc = -1, i = 0;
+
+	if (!ctx || !ctx_base) {
+		CAM_ERR(CAM_CUSTOM, "Invalid Context");
+		return -EINVAL;
+	}
+
+	/* Custom HW context setup */
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->base = ctx_base;
+	ctx->frame_id = 0;
+	ctx->active_req_cnt = 0;
+	ctx->hw_ctx = NULL;
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		ctx->req_base[i].req_priv = &ctx->req_custom[i];
+		ctx->req_custom[i].base = &ctx->req_base[i];
+	}
+
+	/* camera context setup */
+	rc = cam_context_init(ctx_base, custom_dev_name, CAM_CUSTOM, ctx_id,
+		crm_node_intf, hw_intf, ctx->req_base, CAM_CTX_REQ_MAX, img_iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Camera Context Base init failed");
+		return rc;
+	}
+
+	ctx_base->max_hw_update_entries = CAM_CTX_CFG_MAX;
+	ctx_base->max_in_map_entries = CAM_CTX_CFG_MAX;
+	ctx_base->max_out_map_entries = CAM_CTX_CFG_MAX;
+	/* link camera context with custom HW context */
+	ctx_base->state_machine = cam_custom_dev_ctx_top_state_machine;
+	ctx_base->ctx_priv = ctx;
+
+	return rc;
+}
+
+int cam_custom_dev_context_deinit(struct cam_custom_context *ctx)
+{
+	if (ctx->base)
+		cam_context_deinit(ctx->base);
+
+	memset(ctx, 0, sizeof(*ctx));
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_context.h
@@ -0,0 +1,155 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_CONTEXT_H_
+#define _CAM_CUSTOM_CONTEXT_H_
+
+#include <linux/spinlock_types.h>
+
+#include <media/cam_custom.h>
+#include <media/cam_defs.h>
+
+#include "cam_context.h"
+#include "cam_custom_hw_mgr_intf.h"
+
+/*
+ * Maximum hw resource - This number is based on the maximum
+ * output port resource. The current maximum resource number
+ * is 2.
+ */
+#define CAM_CUSTOM_DEV_CTX_RES_MAX                     1
+
+#define CAM_CUSTOM_CTX_CFG_MAX                         8
+
+/* forward declaration */
+struct cam_custom_context;
+
+/* cam custom context irq handling function type */
+typedef int (*cam_custom_hw_event_cb_func)(
+	struct cam_custom_context *custom_ctx, void *evt_data);
+
+/**
+ * enum cam_custom_ctx_activated_substate - sub states for activated
+ *
+ */
+enum cam_custom_ctx_activated_substate {
+	CAM_CUSTOM_CTX_ACTIVATED_SOF,
+	CAM_CUSTOM_CTX_ACTIVATED_APPLIED,
+	CAM_CUSTOM_CTX_ACTIVATED_HW_ERROR,
+	CAM_CUSTOM_CTX_ACTIVATED_HALT,
+	CAM_CUSTOM_CTX_ACTIVATED_MAX,
+};
+
+/**
+ * struct cam_custom_ctx_irq_ops - Function table for handling IRQ callbacks
+ *
+ * @irq_ops:               Array of handle function pointers.
+ *
+ */
+struct cam_custom_ctx_irq_ops {
+	cam_custom_hw_event_cb_func         irq_ops[CAM_CUSTOM_HW_EVENT_MAX];
+};
+
+/**
+ * struct cam_custom_dev_ctx_req - Custom context request object
+ *
+ * @base:                  Common request object pointer
+ * @cfg:                   Custom hardware configuration array
+ * @num_cfg:               Number of custom hardware configuration entries
+ * @fence_map_out:         Output fence mapping array
+ * @num_fence_map_out:     Number of the output fence map
+ * @fence_map_in:          Input fence mapping array
+ * @num_fence_map_in:      Number of input fence map
+ * @num_acked:             Count to track acked entried for output.
+ *                         If count equals the number of fence out, it means
+ *                         the request has been completed.
+ * @bubble_report:         If bubble recovery is needed
+ * @bubble_detected:       request has bubbled
+ * @hw_update_data:        HW update data for this request
+ *
+ */
+struct cam_custom_dev_ctx_req {
+	struct cam_ctx_request                  *base;
+	struct cam_hw_update_entry               cfg
+						[CAM_CUSTOM_CTX_CFG_MAX];
+	uint32_t                                 num_cfg;
+	struct cam_hw_fence_map_entry            fence_map_out
+						[CAM_CUSTOM_DEV_CTX_RES_MAX];
+	uint32_t                                 num_fence_map_out;
+	struct cam_hw_fence_map_entry            fence_map_in
+						[CAM_CUSTOM_DEV_CTX_RES_MAX];
+	uint32_t                                 num_fence_map_in;
+	uint32_t                                 num_acked;
+	int32_t                                  bubble_report;
+	bool                                     bubble_detected;
+	struct cam_custom_prepare_hw_update_data hw_update_data;
+};
+
+/**
+ * struct cam_custom_context - Custom device context
+ * @base: custom device context object
+ * @state_machine: state machine for Custom device context
+ * @state: Common context state
+ * @hw_ctx: HW object returned by the acquire device command
+ * @init_received: Indicate whether init config packet is received
+ * @active_req_cnt: Counter for the active request
+ * @frame_id: Frame id tracking for the custom context
+ * @hw_acquired: Flag to indicate if HW is acquired for this context
+ * @process_bubble: If ctx currently processing bubble
+ * @substate_actiavted: Current substate for the activated state.
+ * @substate_machine: Custom substate machine for external interface
+ * @substate_machine_irq: Custom substate machine for irq handling
+ * @req_base: common request structure
+ * @req_custom: custom request structure
+ *
+ */
+struct cam_custom_context {
+	struct cam_context            *base;
+	struct cam_ctx_ops            *state_machine;
+	uint32_t                       state;
+	void                          *hw_ctx;
+	bool                           init_received;
+	uint32_t                       active_req_cnt;
+	int64_t                        frame_id;
+	bool                           hw_acquired;
+	uint32_t                       substate_activated;
+	atomic_t                       process_bubble;
+	struct cam_ctx_ops            *substate_machine;
+	struct cam_custom_ctx_irq_ops *substate_machine_irq;
+	struct cam_ctx_request         req_base[CAM_CTX_REQ_MAX];
+	struct cam_custom_dev_ctx_req  req_custom[CAM_CTX_REQ_MAX];
+};
+
+
+/**
+ * cam_custom_dev_context_init()
+ *
+ * @brief:              Initialization function for the custom context
+ *
+ * @ctx:                Custom context obj to be initialized
+ * @bridge_ops:         Bridge call back funciton
+ * @hw_intf:            Cust hw manager interface
+ * @ctx_id:             ID for this context
+ * @img_iommu_hdl:      IOMMU HDL for Image buffers
+ *
+ */
+int cam_custom_dev_context_init(struct cam_custom_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_req_mgr_kmd_ops *bridge_ops,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id, int img_iommu_hdl);
+
+/**
+ * cam_custom_dev_context_deinit()
+ *
+ * @brief:               Deinitialize function for the Custom context
+ *
+ * @ctx:                 Custom context obj to be deinitialized
+ *
+ */
+int cam_custom_dev_context_deinit(struct cam_custom_context *ctx);
+
+#endif  /* _CAM_CUSTOM_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_dev.c
@@ -0,0 +1,259 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <dt-bindings/msm-camera.h>
+
+#include <media/cam_req_mgr.h>
+
+#include "cam_custom_dev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_custom_hw_mgr_intf.h"
+#include "cam_node.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "cam_compat.h"
+#include "camera_main.h"
+
+static struct cam_custom_dev g_custom_dev;
+static uint32_t g_num_custom_hws;
+
+static void cam_custom_dev_iommu_fault_handler(
+	struct cam_smmu_pf_info *pf_info)
+{
+	int i = 0;
+	struct cam_node *node = NULL;
+
+	if (!pf_info || !pf_info->token) {
+		CAM_ERR(CAM_CUSTOM, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_info->token;
+
+	for (i = 0; i < node->ctx_size; i++)
+		cam_context_dump_pf_info(&(node->ctx_list[i]), pf_info);
+}
+
+static const struct of_device_id cam_custom_dt_match[] = {
+	{
+		.compatible = "qcom,cam-custom"
+	},
+	{}
+};
+
+static int cam_custom_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	mutex_lock(&g_custom_dev.custom_dev_mutex);
+	g_custom_dev.open_cnt++;
+	mutex_unlock(&g_custom_dev.custom_dev_mutex);
+
+	return 0;
+}
+
+static int cam_custom_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&g_custom_dev.custom_dev_mutex);
+	if (g_custom_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_CUSTOM, "Custom subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	g_custom_dev.open_cnt--;
+	if (!node) {
+		CAM_ERR(CAM_CUSTOM, "Node ptr is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (g_custom_dev.open_cnt == 0)
+		cam_node_shutdown(node);
+
+end:
+	mutex_unlock(&g_custom_dev.custom_dev_mutex);
+	return rc;
+}
+
+static int cam_custom_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_CUSTOM, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_custom_subdev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_custom_subdev_internal_ops = {
+	.close = cam_custom_subdev_close,
+	.open = cam_custom_subdev_open,
+};
+
+static int cam_custom_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = -EINVAL;
+	int i;
+	struct cam_hw_mgr_intf         hw_mgr_intf;
+	struct cam_node                *node;
+	int iommu_hdl = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	g_custom_dev.sd.internal_ops = &cam_custom_subdev_internal_ops;
+	g_custom_dev.sd.close_seq_prior = CAM_SD_CLOSE_HIGH_PRIORITY;
+
+	if (!cam_cpas_is_feature_supported(CAM_CPAS_CUSTOM_FUSE, BIT(0), NULL)) {
+		CAM_DBG(CAM_CUSTOM, "CUSTOM:0 is not supported");
+		goto err;
+	}
+
+	rc = cam_subdev_probe(&g_custom_dev.sd, pdev, CAM_CUSTOM_DEV_NAME,
+		CAM_CUSTOM_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Custom device cam_subdev_probe failed!");
+		goto err;
+	}
+	node = (struct cam_node *) g_custom_dev.sd.token;
+
+	memset(&hw_mgr_intf, 0, sizeof(hw_mgr_intf));
+	rc = cam_custom_hw_mgr_init(pdev->dev.of_node,
+		&hw_mgr_intf, &iommu_hdl);
+	if (rc != 0) {
+		CAM_ERR(CAM_CUSTOM, "Can not initialized Custom HW manager!");
+		goto unregister;
+	}
+
+	for (i = 0; i < CAM_CUSTOM_HW_MAX_INSTANCES; i++) {
+		rc = cam_custom_dev_context_init(&g_custom_dev.ctx_custom[i],
+			&g_custom_dev.ctx[i],
+			&node->crm_node_intf,
+			&node->hw_mgr_intf,
+			i, iommu_hdl);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Custom context init failed!");
+			goto unregister;
+		}
+	}
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_custom_dev.ctx,
+		CAM_CUSTOM_HW_MAX_INSTANCES, CAM_CUSTOM_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Custom HW node init failed!");
+		goto unregister;
+	}
+
+	node->sd_handler = cam_custom_subdev_close_internal;
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_custom_dev_iommu_fault_handler, node);
+
+	mutex_init(&g_custom_dev.custom_dev_mutex);
+
+	rc = cam_subdev_register(&g_custom_dev.sd, pdev);
+
+	CAM_DBG(CAM_CUSTOM, "%s component bound successfully", pdev->name);
+
+	return rc;
+unregister:
+	rc = cam_subdev_remove(&g_custom_dev.sd);
+err:
+	return rc;
+}
+
+void cam_custom_get_num_hws(uint32_t *custom_num)
+{
+	if (custom_num)
+		*custom_num = g_num_custom_hws;
+	else
+		CAM_ERR(CAM_CUSTOM, "Invalid argument, g_num_custom_hws: %u", g_num_custom_hws);
+}
+
+static void cam_custom_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	int i;
+
+	/* clean up resources */
+	for (i = 0; i < CAM_CUSTOM_HW_MAX_INSTANCES; i++) {
+		rc = cam_custom_dev_context_deinit(&g_custom_dev.ctx_custom[i]);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM,
+				"Custom context %d deinit failed", i);
+	}
+
+	rc = cam_unregister_subdev(&g_custom_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Unregister failed");
+
+	rc = cam_subdev_remove(&g_custom_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Subdev remove failed");
+
+	memset(&g_custom_dev, 0, sizeof(g_custom_dev));
+}
+
+const static struct component_ops cam_custom_component_ops = {
+	.bind = cam_custom_component_bind,
+	.unbind = cam_custom_component_unbind,
+};
+
+static int cam_custom_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_custom_component_ops);
+	return 0;
+}
+
+static int cam_custom_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CUSTOM, "Adding Custom HW component");
+	g_num_custom_hws++;
+
+	rc = component_add(&pdev->dev, &cam_custom_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+struct platform_driver custom_driver = {
+	.probe = cam_custom_dev_probe,
+	.remove = cam_custom_dev_remove,
+	.driver = {
+		.name = "cam_custom",
+		.of_match_table = cam_custom_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_custom_dev_init_module(void)
+{
+	return platform_driver_register(&custom_driver);
+}
+
+void cam_custom_dev_exit_module(void)
+{
+	platform_driver_unregister(&custom_driver);
+}
+
+MODULE_DESCRIPTION("MSM CUSTOM driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_dev.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_DEV_H_
+#define _CAM_CUSTOM_DEV_H_
+
+#include "cam_subdev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_custom_hw_mgr.h"
+#include "cam_context.h"
+#include "cam_custom_context.h"
+
+#define CAM_CUSTOM_HW_MAX_INSTANCES 3
+
+/**
+ * struct cam_custom_dev - Camera Custom V4l2 device node
+ *
+ * @sd:                    Common camera subdevice node
+ * @ctx:                   Custom base context storage
+ * @ctx_custom:            Custom private context storage
+ * @custom_dev_mutex:      Custom dev mutex
+ * @open_cnt:              Open device count
+ */
+struct cam_custom_dev {
+	struct cam_subdev          sd;
+	struct cam_context         ctx[CAM_CUSTOM_HW_MAX_INSTANCES];
+	struct cam_custom_context  ctx_custom[CAM_CUSTOM_HW_MAX_INSTANCES];
+	struct mutex               custom_dev_mutex;
+	int32_t                    open_cnt;
+};
+
+/**
+ * @brief : API to register Custom hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_custom_dev_init_module(void);
+
+/**
+ * @brief : API to remove Custom hw interface from platform framework.
+ */
+void cam_custom_dev_exit_module(void);
+#endif /* _CAM_CUSTOM_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid480.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid480.h
@@ -0,0 +1,288 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_CSID_480_H_
+#define _CAM_CUSTOM_CSID_480_H_
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+
+#define CAM_CSID_VERSION_V480                 0x40080000
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_custom_csid_480_udi_0_reg_offset = {
+	.irq_status_addr                 = 0x30,
+	.irq_mask_addr                   = 0x34,
+	.irq_clear_addr                  = 0x38,
+	.irq_set_addr                    = 0x3c,
+	.cfg0_addr                       = 0x200,
+	.cfg1_addr                       = 0x204,
+	.ctrl_addr                       = 0x208,
+	.frm_drop_pattern_addr           = 0x20c,
+	.frm_drop_period_addr            = 0x210,
+	.irq_subsample_pattern_addr      = 0x214,
+	.irq_subsample_period_addr       = 0x218,
+	.hcrop_addr                      = 0x21c,
+	.vcrop_addr                      = 0x220,
+	.pix_drop_pattern_addr           = 0x224,
+	.pix_drop_period_addr            = 0x228,
+	.line_drop_pattern_addr          = 0x22c,
+	.line_drop_period_addr           = 0x230,
+	.rst_strobes_addr                = 0x240,
+	.status_addr                     = 0x250,
+	.misr_val0_addr                  = 0x254,
+	.misr_val1_addr                  = 0x258,
+	.misr_val2_addr                  = 0x25c,
+	.misr_val3_addr                  = 0x260,
+	.format_measure_cfg0_addr        = 0x270,
+	.format_measure_cfg1_addr        = 0x274,
+	.format_measure0_addr            = 0x278,
+	.format_measure1_addr            = 0x27c,
+	.format_measure2_addr            = 0x280,
+	.timestamp_curr0_sof_addr        = 0x290,
+	.timestamp_curr1_sof_addr        = 0x294,
+	.timestamp_prev0_sof_addr        = 0x298,
+	.timestamp_prev1_sof_addr        = 0x29c,
+	.timestamp_curr0_eof_addr        = 0x2a0,
+	.timestamp_curr1_eof_addr        = 0x2a4,
+	.timestamp_prev0_eof_addr        = 0x2a8,
+	.timestamp_prev1_eof_addr        = 0x2ac,
+	.err_recovery_cfg0_addr          = 0x2b0,
+	.err_recovery_cfg1_addr          = 0x2b4,
+	.err_recovery_cfg2_addr          = 0x2b8,
+	.multi_vcdt_cfg0_addr            = 0x2bc,
+	.byte_cntr_ping_addr             = 0x2e0,
+	.byte_cntr_pong_addr             = 0x2e4,
+	/* configurations */
+	.plain_fmt_shift_val             = 10,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.ccif_violation_en               = 1,
+	.overflow_ctrl_en                = 0,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_custom_csid_480_udi_1_reg_offset = {
+	.irq_status_addr                 = 0x40,
+	.irq_mask_addr                   = 0x44,
+	.irq_clear_addr                  = 0x48,
+	.irq_set_addr                    = 0x4c,
+	.cfg0_addr                       = 0x300,
+	.cfg1_addr                       = 0x304,
+	.ctrl_addr                       = 0x308,
+	.frm_drop_pattern_addr           = 0x30c,
+	.frm_drop_period_addr            = 0x310,
+	.irq_subsample_pattern_addr      = 0x314,
+	.irq_subsample_period_addr       = 0x318,
+	.hcrop_addr                      = 0x31c,
+	.vcrop_addr                      = 0x320,
+	.pix_drop_pattern_addr           = 0x324,
+	.pix_drop_period_addr            = 0x328,
+	.line_drop_pattern_addr          = 0x32c,
+	.line_drop_period_addr           = 0x330,
+	.rst_strobes_addr                = 0x340,
+	.status_addr                     = 0x350,
+	.misr_val0_addr                  = 0x354,
+	.misr_val1_addr                  = 0x358,
+	.misr_val2_addr                  = 0x35c,
+	.misr_val3_addr                  = 0x360,
+	.format_measure_cfg0_addr        = 0x370,
+	.format_measure_cfg1_addr        = 0x374,
+	.format_measure0_addr            = 0x378,
+	.format_measure1_addr            = 0x37c,
+	.format_measure2_addr            = 0x380,
+	.timestamp_curr0_sof_addr        = 0x390,
+	.timestamp_curr1_sof_addr        = 0x394,
+	.timestamp_prev0_sof_addr        = 0x398,
+	.timestamp_prev1_sof_addr        = 0x39c,
+	.timestamp_curr0_eof_addr        = 0x3a0,
+	.timestamp_curr1_eof_addr        = 0x3a4,
+	.timestamp_prev0_eof_addr        = 0x3a8,
+	.timestamp_prev1_eof_addr        = 0x3ac,
+	.err_recovery_cfg0_addr          = 0x3b0,
+	.err_recovery_cfg1_addr          = 0x3b4,
+	.err_recovery_cfg2_addr          = 0x3b8,
+	.multi_vcdt_cfg0_addr            = 0x3bc,
+	.byte_cntr_ping_addr             = 0x3e0,
+	.byte_cntr_pong_addr             = 0x3e4,
+	/* configurations */
+	.mipi_pack_supported             = 1,
+	.packing_fmt_shift_val           = 30,
+	.plain_fmt_shift_val             = 10,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.drop_v_en_shift_val             = 4,
+	.drop_h_en_shift_val             = 3,
+	.timestamp_en_shift_val          = 2,
+	.ccif_violation_en               = 1,
+	.format_measure_en_shift_val     = 1,
+	.overflow_ctrl_en                = 0,
+	.non_fatal_err_mask              = 0x2e000,
+	.fatal_err_mask                  = 0x4,
+	.overflow_ctrl_mode_val          = 0x8,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_custom_csid_480_udi_2_reg_offset = {
+	.irq_status_addr                 = 0x50,
+	.irq_mask_addr                   = 0x54,
+	.irq_clear_addr                  = 0x58,
+	.irq_set_addr                    = 0x5c,
+	.cfg0_addr                       = 0x400,
+	.cfg1_addr                       = 0x404,
+	.ctrl_addr                       = 0x408,
+	.frm_drop_pattern_addr           = 0x40c,
+	.frm_drop_period_addr            = 0x410,
+	.irq_subsample_pattern_addr      = 0x414,
+	.irq_subsample_period_addr       = 0x418,
+	.hcrop_addr                      = 0x41c,
+	.vcrop_addr                      = 0x420,
+	.pix_drop_pattern_addr           = 0x424,
+	.pix_drop_period_addr            = 0x428,
+	.line_drop_pattern_addr          = 0x42c,
+	.line_drop_period_addr           = 0x430,
+	.yuv_chroma_conversion_addr      = 0x434,
+	.rst_strobes_addr                = 0x440,
+	.status_addr                     = 0x450,
+	.misr_val0_addr                  = 0x454,
+	.misr_val1_addr                  = 0x458,
+	.misr_val2_addr                  = 0x45c,
+	.misr_val3_addr                  = 0x460,
+	.format_measure_cfg0_addr        = 0x470,
+	.format_measure_cfg1_addr        = 0x474,
+	.format_measure0_addr            = 0x478,
+	.format_measure1_addr            = 0x47c,
+	.format_measure2_addr            = 0x480,
+	.timestamp_curr0_sof_addr        = 0x490,
+	.timestamp_curr1_sof_addr        = 0x494,
+	.timestamp_prev0_sof_addr        = 0x498,
+	.timestamp_prev1_sof_addr        = 0x49c,
+	.timestamp_curr0_eof_addr        = 0x4a0,
+	.timestamp_curr1_eof_addr        = 0x4a4,
+	.timestamp_prev0_eof_addr        = 0x4a8,
+	.timestamp_prev1_eof_addr        = 0x4ac,
+	.err_recovery_cfg0_addr          = 0x4b0,
+	.err_recovery_cfg1_addr          = 0x4b4,
+	.err_recovery_cfg2_addr          = 0x4b8,
+	.multi_vcdt_cfg0_addr            = 0x4bc,
+	.byte_cntr_ping_addr             = 0x4e0,
+	.byte_cntr_pong_addr             = 0x4e4,
+	/* configurations */
+	.plain_fmt_shift_val             = 10,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.ccif_violation_en               = 1,
+	.overflow_ctrl_en                = 0,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_info
+			cam_custom_csid_480_csi2_reg_info = {
+	.irq_status_addr                 = 0x20,
+	.irq_mask_addr                   = 0x24,
+	.irq_clear_addr                  = 0x28,
+	.irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.cfg0_addr                       = 0x100,
+	.cfg1_addr                       = 0x104,
+	.capture_ctrl_addr               = 0x108,
+	.rst_strobes_addr                = 0x110,
+	.de_scramble_cfg0_addr           = 0x114,
+	.de_scramble_cfg1_addr           = 0x118,
+	.cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.captured_short_pkt_0_addr       = 0x128,
+	.captured_short_pkt_1_addr       = 0x12c,
+	.captured_long_pkt_0_addr        = 0x130,
+	.captured_long_pkt_1_addr        = 0x134,
+	.captured_long_pkt_ftr_addr      = 0x138,
+	.captured_cphy_pkt_hdr_addr      = 0x13c,
+	.lane0_misr_addr                 = 0x150,
+	.lane1_misr_addr                 = 0x154,
+	.lane2_misr_addr                 = 0x158,
+	.lane3_misr_addr                 = 0x15c,
+	.total_pkts_rcvd_addr            = 0x160,
+	.stats_ecc_addr                  = 0x164,
+	.total_crc_err_addr              = 0x168,
+
+	.rst_srb_all                     = 0x3FFF,
+	.rst_done_shift_val              = 27,
+	.irq_mask_all                    = 0xFFFFFFF,
+	.misr_enable_shift_val           = 6,
+	.vc_mode_shift_val               = 2,
+	.capture_long_pkt_en_shift       = 0,
+	.capture_short_pkt_en_shift      = 1,
+	.capture_cphy_pkt_en_shift       = 2,
+	.capture_long_pkt_dt_shift       = 4,
+	.capture_long_pkt_vc_shift       = 10,
+	.capture_short_pkt_vc_shift      = 15,
+	.capture_cphy_pkt_dt_shift       = 20,
+	.capture_cphy_pkt_vc_shift       = 26,
+	.phy_num_mask                    = 0x3,
+	.fatal_err_mask                  = 0x78000,
+	.part_fatal_err_mask             = 0x1801800,
+};
+
+static struct cam_ife_csid_ver1_common_reg_info
+			cam_custom_csid_480_cmn_reg_offset = {
+	.hw_version_addr                 = 0x0,
+	.cfg0_addr                       = 0x4,
+	.ctrl_addr                       = 0x8,
+	.reset_addr                      = 0xc,
+	.rst_strobes_addr                = 0x10,
+
+	.test_bus_ctrl_addr              = 0x14,
+	.top_irq_status_addr             = 0x70,
+	.top_irq_mask_addr               = 0x74,
+	.top_irq_clear_addr              = 0x78,
+	.top_irq_set_addr                = 0x7c,
+	.irq_cmd_addr                    = 0x80,
+
+	/*configurations */
+	.major_version                   = 1,
+	.minor_version                   = 7,
+	.version_incr                    = 0,
+	.num_udis                        = 3,
+	.num_rdis                        = 0,
+	.num_pix                         = 0,
+	.num_ppp                         = 0,
+	.rst_sw_reg_stb                  = 1,
+	.rst_hw_reg_stb                  = 0x1e,
+	.rst_sw_hw_reg_stb               = 0x1f,
+	.path_rst_stb_all                = 0x7f,
+	.rst_done_shift_val              = 1,
+	.path_en_shift_val               = 31,
+	.dt_id_shift_val                 = 27,
+	.vc_shift_val                    = 22,
+	.dt_shift_val                    = 16,
+	.fmt_shift_val                   = 12,
+	.ipp_irq_mask_all                = 0,
+	.rdi_irq_mask_all                = 0,
+	.ppp_irq_mask_all                = 0,
+	.udi_irq_mask_all                = 0x7FFF,
+	.measure_en_hbi_vbi_cnt_mask     = 0xC,
+	.num_bytes_out_shift_val         = 3,
+};
+
+static struct cam_ife_csid_ver1_reg_info cam_custom_csid_480_reg_offset = {
+	.cmn_reg          = &cam_custom_csid_480_cmn_reg_offset,
+	.csi2_reg         = &cam_custom_csid_480_csi2_reg_info,
+	.ipp_reg          = NULL,
+	.ppp_reg          = NULL,
+	.rdi_reg = {
+		NULL,
+		NULL,
+		NULL,
+		NULL,
+	},
+	.udi_reg = {
+		&cam_custom_csid_480_udi_0_reg_offset,
+		&cam_custom_csid_480_udi_1_reg_offset,
+		&cam_custom_csid_480_udi_2_reg_offset,
+	},
+	.tpg_reg = NULL,
+};
+
+#endif /*_CAM_IFE_CSID_480_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.c
@@ -0,0 +1,226 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include "linux/module.h"
+#include "cam_custom_csid_dev.h"
+#include "cam_ife_csid_common.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_custom_csid480.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+#define CAM_CUSTOM_CSID_DRV_NAME  "custom_csid"
+
+static struct cam_hw_intf *cam_custom_csid_hw_list[CAM_IFE_CSID_HW_NUM_MAX] = {
+	0, 0, 0, 0};
+
+static struct cam_ife_csid_core_info cam_custom_csid480_hw_info = {
+	.csid_reg = &cam_custom_csid_480_reg_offset,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static int cam_custom_csid_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf	       *csid_hw_intf;
+	struct cam_hw_info	       *csid_hw_info;
+	const struct of_device_id      *match_dev = NULL;
+	struct cam_ife_csid_core_info  *csid_core_info = NULL;
+	uint32_t			csid_dev_idx;
+	int				rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	csid_hw_intf = kzalloc(sizeof(*csid_hw_intf), GFP_KERNEL);
+	if (!csid_hw_intf) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	csid_hw_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+
+	if (!csid_hw_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	/* get custom csid hw index */
+	of_property_read_u32(pdev->dev.of_node, "cell-index", &csid_dev_idx);
+	/* get custom csid hw information */
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_CUSTOM,
+			"No matching table for the CUSTOM CSID HW!");
+		rc = -EINVAL;
+		goto free_hw_info;
+	}
+
+	csid_hw_intf->hw_idx = csid_dev_idx;
+	csid_hw_intf->hw_type = CAM_ISP_HW_TYPE_IFE_CSID;
+	csid_hw_intf->hw_priv = csid_hw_info;
+
+	csid_hw_info->soc_info.pdev = pdev;
+	csid_hw_info->soc_info.dev = &pdev->dev;
+	csid_hw_info->soc_info.dev_name = pdev->name;
+	csid_hw_info->soc_info.index = csid_dev_idx;
+
+	csid_core_info = (struct cam_ife_csid_core_info  *)match_dev->data;
+
+	/* call the driver init and fill csid_hw_info->core_info */
+	rc = cam_ife_csid_hw_probe_init(csid_hw_intf, csid_core_info, true);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%d] probe init failed",
+		    csid_dev_idx);
+		goto free_hw_info;
+	}
+
+	platform_set_drvdata(pdev, csid_hw_intf);
+	CAM_DBG(CAM_ISP, "CSID:%d component bound successfully",
+		csid_hw_intf->hw_idx);
+
+	if (csid_hw_intf->hw_idx < CAM_IFE_CSID_HW_NUM_MAX)
+		cam_custom_csid_hw_list[csid_hw_intf->hw_idx] = csid_hw_intf;
+	else
+		goto free_hw_info;
+
+	CAM_DBG(CAM_CUSTOM, "CSID:%d component bound successfully",
+		csid_hw_intf->hw_idx);
+
+	return 0;
+
+free_hw_info:
+	kfree(csid_hw_info);
+free_hw_intf:
+	kfree(csid_hw_intf);
+err:
+	return rc;
+}
+
+static void cam_custom_csid_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf             *csid_hw_intf = NULL;
+	struct cam_hw_info             *csid_hw_info;
+	struct cam_ife_csid_core_info  *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+	const struct of_device_id      *match_dev = NULL;
+
+	csid_hw_intf = (struct cam_hw_intf *)platform_get_drvdata(pdev);
+
+	if (!csid_hw_intf) {
+		CAM_ERR(CAM_CUSTOM, "ERROR No data in csid_hw_intf");
+		return;
+	}
+
+	csid_hw_info = csid_hw_intf->hw_priv;
+	core_info = csid_hw_info->core_info;
+
+	CAM_DBG(CAM_CUSTOM, "CSID:%d component unbind",
+		csid_hw_intf->hw_idx);
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "No matching table for the IFE CSID HW!");
+		goto free_mem;
+	}
+
+	cam_ife_csid_hw_deinit(csid_hw_intf, core_info);
+
+free_mem:
+	/*release the csid device memory */
+	kfree(csid_hw_info);
+	kfree(csid_hw_intf);
+}
+
+const static struct component_ops cam_custom_csid_component_ops = {
+	.bind = cam_custom_csid_component_bind,
+	.unbind = cam_custom_csid_component_unbind,
+};
+
+static int cam_custom_csid_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CUSTOM, "Adding Custom CSID component");
+	rc = component_add(&pdev->dev, &cam_custom_csid_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_custom_csid_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_custom_csid_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_custom_csid_dt_match[] = {
+	{
+		.compatible = "qcom,csid-custom480",
+		.data = &cam_custom_csid480_hw_info
+	},
+	{
+		.compatible = "qcom,csid-custom580",
+		.data = &cam_custom_csid480_hw_info
+	},
+	{},
+};
+
+MODULE_DEVICE_TABLE(of, cam_custom_csid_dt_match);
+
+struct platform_driver cam_custom_csid_driver = {
+	.probe = cam_custom_csid_probe,
+	.driver = {
+		.name = "qcom,custom-csid",
+		.of_match_table = cam_custom_csid_dt_match,
+		.suppress_bind_attrs = true,
+	},
+	.remove = cam_custom_csid_remove,
+};
+
+int cam_custom_csid_driver_init(void)
+{
+	int32_t rc = 0;
+
+	rc = platform_driver_register(&cam_custom_csid_driver);
+	if (rc < 0)
+		CAM_ERR(CAM_CUSTOM, "platform_driver_register Failed: rc = %d",
+			rc);
+
+	return rc;
+}
+
+int cam_custom_csid_hw_init(struct cam_hw_intf **custom_csid_hw,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_custom_csid_hw_list[hw_idx]) {
+		*custom_csid_hw = cam_custom_csid_hw_list[hw_idx];
+	} else {
+		*custom_csid_hw = NULL;
+		rc = -1;
+	}
+
+	return rc;
+}
+
+void cam_custom_csid_driver_exit(void)
+{
+	platform_driver_unregister(&cam_custom_csid_driver);
+}
+
+MODULE_DESCRIPTION("cam_custom_csid_driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_CSID_DEV_H_
+#define _CAM_CUSTOM_CSID_DEV_H_
+
+#include "cam_debug_util.h"
+#include "cam_custom_hw_mgr_intf.h"
+
+/**
+ * @brief : API to register Custom CSID hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_custom_csid_driver_init(void);
+
+/**
+ * @brief : API to remove Custom CSID hw interface from platform framework.
+ */
+void cam_custom_csid_driver_exit(void);
+
+#endif /*_CAM_CUSTOM_CSID_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.c
@@ -0,0 +1,333 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/timer.h>
+#include <linux/ratelimit.h>
+#include "cam_custom_sub_mod_core.h"
+
+int cam_custom_hw_sub_mod_get_hw_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+	/* Add HW Capabilities to be published */
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_custom_resource_node   *custom_res = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	custom_hw->open_count++;
+	if (custom_hw->open_count > 1) {
+		mutex_unlock(&custom_hw->hw_mutex);
+		CAM_DBG(CAM_CUSTOM,
+			"Cam Custom has already been initialized cnt %d",
+			custom_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	soc_info = &custom_hw->soc_info;
+
+	/* Turn ON Regulators, Clocks and other SOC resources */
+	rc = cam_custom_hw_sub_mod_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Enable SOC failed");
+		rc = -EFAULT;
+		goto decrement_open_cnt;
+	}
+
+	custom_res   = (struct cam_custom_resource_node *)init_hw_args;
+	if (custom_res && custom_res->init) {
+		rc = custom_res->init(custom_res, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "init Failed rc=%d", rc);
+			goto decrement_open_cnt;
+		}
+	}
+
+	rc = cam_custom_hw_sub_mod_reset(hw_priv, NULL, 0);
+	if (rc < 0) {
+		CAM_ERR(CAM_CUSTOM, "Custom HW reset failed : %d", rc);
+		goto decrement_open_cnt;
+	}
+	/* Initialize all resources here */
+	custom_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	return rc;
+
+decrement_open_cnt:
+	mutex_lock(&custom_hw->hw_mutex);
+	custom_hw->open_count--;
+	mutex_unlock(&custom_hw->hw_mutex);
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_custom_resource_node   *custom_res = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	if (!custom_hw->open_count) {
+		mutex_unlock(&custom_hw->hw_mutex);
+		CAM_ERR(CAM_CUSTOM, "Error! Unbalanced deinit");
+		return -EFAULT;
+	}
+	custom_hw->open_count--;
+	if (custom_hw->open_count) {
+		mutex_unlock(&custom_hw->hw_mutex);
+		CAM_DBG(CAM_CUSTOM,
+			"open_cnt non-zero =%d", custom_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	soc_info = &custom_hw->soc_info;
+
+	custom_res   = (struct cam_custom_resource_node *)deinit_hw_args;
+	if (custom_res && custom_res->deinit) {
+		rc = custom_res->deinit(custom_res, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "deinit failed");
+	}
+
+	rc = cam_custom_hw_sub_mod_reset(hw_priv, NULL, 0);
+	if (rc)
+		CAM_WARN(CAM_CUSTOM, "Reset of HW failed, rc: %d", rc);
+
+	/* Turn OFF Regulators, Clocks and other SOC resources */
+	CAM_DBG(CAM_CUSTOM, "Disable SOC resource");
+	rc = cam_custom_hw_sub_mod_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Disable SOC failed");
+
+	custom_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_reset(void *hw_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	/* Do Reset of HW */
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_reserve(void *hw_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	int rc = 0;
+
+	if (!hw_priv || !reserve_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	/*Reserve Args */
+	return rc;
+}
+
+
+int cam_custom_hw_sub_mod_release(void *hw_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw  = hw_priv;
+	int rc = 0;
+
+	if (!hw_priv || !release_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	/* Release Resources */
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	return rc;
+}
+
+
+int cam_custom_hw_sub_mod_start(void *hw_priv,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw  = hw_priv;
+	int rc = 0;
+
+	if (!hw_priv || !start_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	/* Start HW -- Stream On*/
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_stop(void *hw_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw  = hw_priv;
+	int rc = 0;
+
+	if (!hw_priv || !stop_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	/* Stop HW */
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_read(void *hw_priv,
+	void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_custom_hw_sub_mod_write(void *hw_priv,
+	void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_custom_hw_submit_req(void *hw_priv, void *hw_submit_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info			         *custom_dev = hw_priv;
+	struct cam_custom_sub_mod_req_to_dev *submit_req =
+		(struct cam_custom_sub_mod_req_to_dev *)hw_submit_args;
+	struct cam_custom_sub_mod_core_info  *core_info = NULL;
+
+	core_info =
+		(struct cam_custom_sub_mod_core_info *)custom_dev->core_info;
+
+	spin_lock(&custom_dev->hw_lock);
+	if (core_info->curr_req) {
+		CAM_WARN(CAM_CUSTOM, "Req %lld still processed by %s",
+			core_info->curr_req->req_id,
+			custom_dev->soc_info.dev_name);
+		spin_unlock(&custom_dev->hw_lock);
+		return -EAGAIN;
+	}
+
+	core_info->curr_req = submit_req;
+	spin_unlock(&custom_dev->hw_lock);
+
+	/* Do other submit procedures */
+	return 0;
+}
+
+irqreturn_t cam_custom_hw_sub_mod_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *custom_dev = data;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_custom_hw_cb_args cb_args;
+	struct cam_custom_sub_mod_core_info *core_info = NULL;
+	uint32_t irq_status = 0;
+
+	if (!data) {
+		CAM_ERR(CAM_CUSTOM, "Invalid custom_dev_info");
+		return IRQ_HANDLED;
+	}
+
+	soc_info = &custom_dev->soc_info;
+	core_info =
+		(struct cam_custom_sub_mod_core_info *)custom_dev->core_info;
+
+	irq_status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				core_info->device_hw_info->irq_status);
+
+	cam_io_w_mb(irq_status,
+			soc_info->reg_map[0].mem_base +
+			core_info->device_hw_info->irq_clear);
+
+	spin_lock(&custom_dev->hw_lock);
+	core_info->curr_req = NULL;
+	if (core_info->irq_cb.custom_hw_mgr_cb)
+		core_info->irq_cb.custom_hw_mgr_cb(
+			core_info->irq_cb.data, &cb_args);
+	spin_unlock(&custom_dev->hw_lock);
+
+	return IRQ_HANDLED;
+}
+
+int cam_custom_hw_sub_mod_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                  *hw = hw_priv;
+	struct cam_custom_sub_mod_core_info *core_info = NULL;
+	unsigned long flag = 0;
+	int rc = 0;
+
+	if (!hw_priv || !cmd_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	core_info = hw->core_info;
+	/* Handle any custom process cmds */
+
+	switch (cmd_type) {
+	case CAM_CUSTOM_SET_IRQ_CB: {
+		struct cam_custom_sub_mod_set_irq_cb *irq_cb = cmd_args;
+		/* This can be deprecated */
+		CAM_DBG(CAM_CUSTOM, "Setting irq cb");
+		spin_lock_irqsave(&hw->hw_lock, flag);
+		core_info->irq_cb.custom_hw_mgr_cb = irq_cb->custom_hw_mgr_cb;
+		core_info->irq_cb.data = irq_cb->data;
+		spin_unlock_irqrestore(&hw->hw_lock, flag);
+		break;
+	}
+	case CAM_CUSTOM_SUBMIT_REQ: {
+		rc = cam_custom_hw_submit_req(hw_priv, cmd_args, arg_size);
+		break;
+	}
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.h
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_SUB_MOD_CORE_H_
+#define _CAM_CUSTOM_SUB_MOD_CORE_H_
+
+#include "cam_debug_util.h"
+#include "cam_custom_hw.h"
+#include "cam_custom_sub_mod_soc.h"
+#include "cam_custom_hw_mgr_intf.h"
+
+struct cam_custom_sub_mod_set_irq_cb {
+	int32_t (*custom_hw_mgr_cb)(void *data,
+		struct cam_custom_hw_cb_args *cb_args);
+	void *data;
+};
+
+struct cam_custom_sub_mod_req_to_dev {
+	uint64_t req_id;
+	uint32_t ctx_idx;
+	uint32_t dev_idx;
+};
+
+struct cam_custom_device_hw_info {
+	uint32_t hw_ver;
+	uint32_t irq_status;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+};
+
+struct cam_custom_sub_mod_core_info {
+	uint32_t cpas_handle;
+	bool cpas_start;
+	bool clk_enable;
+	struct cam_custom_sub_mod_set_irq_cb irq_cb;
+	struct cam_custom_sub_mod_req_to_dev *curr_req;
+	struct cam_custom_device_hw_info *device_hw_info;
+	struct cam_hw_info *custom_hw_info;
+};
+
+enum cam_custom_hw_resource_type {
+	CAM_CUSTOM_HW_RESOURCE_UNINT,
+	CAM_CUSTOM_HW_RESOURCE_SRC,
+	CAM_CUSTOM_HW_RESOURCE_MAX,
+};
+
+struct cam_custom_sub_mod_acq {
+	enum cam_custom_hw_resource_type   rsrc_type;
+	int32_t                            acq;
+	cam_hw_mgr_event_cb_func           event_cb;
+	void                              *priv;
+	struct cam_custom_resource_node   *rsrc_node;
+};
+
+int cam_custom_hw_sub_mod_get_hw_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_reset(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_reserve(void *hw_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_release(void *hw_priv,
+	void *release_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_start(void *hw_priv,
+	void *start_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_stop(void *hw_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_read(void *hw_priv,
+	void *read_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_write(void *hw_priv,
+	void *write_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+irqreturn_t cam_custom_hw_sub_mod_irq(int irq_num, void *data);
+
+#endif /* _CAM_CUSTOM_SUB_MOD_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.c
@@ -0,0 +1,181 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of_device.h>
+#include "cam_custom_sub_mod_dev.h"
+#include "cam_custom_sub_mod_core.h"
+#include "cam_custom_sub_mod_soc.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_hw_intf *cam_custom_hw_sub_mod_list
+	[CAM_CUSTOM_SUB_MOD_MAX_INSTANCES] = {0, 0};
+
+struct cam_custom_device_hw_info cam_custom_hw_info = {
+	.hw_ver = 0x0,
+	.irq_status = 0x0,
+	.irq_mask = 0x0,
+	.irq_clear = 0x0,
+};
+EXPORT_SYMBOL(cam_custom_hw_info);
+
+int cam_custom_hw_sub_mod_init(struct cam_hw_intf **custom_hw, uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_custom_hw_sub_mod_list[hw_idx]) {
+		*custom_hw = cam_custom_hw_sub_mod_list[hw_idx];
+	} else {
+		*custom_hw = NULL;
+		rc = -ENODEV;
+	}
+	return rc;
+}
+
+static int cam_custom_hw_sub_mod_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info		    *hw = NULL;
+	struct cam_hw_intf		    *hw_intf = NULL;
+	struct cam_custom_sub_mod_core_info *core_info = NULL;
+	int				   rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!hw_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &hw_intf->hw_idx);
+
+	hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!hw) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	hw->soc_info.pdev = pdev;
+	hw->soc_info.dev = &pdev->dev;
+	hw->soc_info.dev_name = pdev->name;
+	hw_intf->hw_priv = hw;
+	hw_intf->hw_ops.get_hw_caps = cam_custom_hw_sub_mod_get_hw_caps;
+	hw_intf->hw_ops.init = cam_custom_hw_sub_mod_init_hw;
+	hw_intf->hw_ops.deinit = cam_custom_hw_sub_mod_deinit_hw;
+	hw_intf->hw_ops.reset = cam_custom_hw_sub_mod_reset;
+	hw_intf->hw_ops.reserve = cam_custom_hw_sub_mod_reserve;
+	hw_intf->hw_ops.release = cam_custom_hw_sub_mod_release;
+	hw_intf->hw_ops.start = cam_custom_hw_sub_mod_start;
+	hw_intf->hw_ops.stop = cam_custom_hw_sub_mod_stop;
+	hw_intf->hw_ops.read = cam_custom_hw_sub_mod_read;
+	hw_intf->hw_ops.write = cam_custom_hw_sub_mod_write;
+	hw_intf->hw_ops.process_cmd = cam_custom_hw_sub_mod_process_cmd;
+	hw_intf->hw_type = CAM_CUSTOM_HW_TYPE_1;
+
+	platform_set_drvdata(pdev, hw_intf);
+
+	hw->core_info = kzalloc(sizeof(struct cam_custom_sub_mod_core_info),
+		GFP_KERNEL);
+	if (!hw->core_info) {
+		CAM_DBG(CAM_CUSTOM, "Failed to alloc for core");
+		rc = -ENOMEM;
+		goto free_hw;
+	}
+	core_info = (struct cam_custom_sub_mod_core_info *)hw->core_info;
+
+	core_info->custom_hw_info = hw;
+
+	rc = cam_custom_hw_sub_mod_init_soc_resources(&hw->soc_info,
+		cam_custom_hw_sub_mod_irq, hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_CUSTOM, "Failed to init soc rc=%d", rc);
+		goto free_core_info;
+	}
+
+	/* Initialize HW */
+
+	hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&hw->hw_mutex);
+	spin_lock_init(&hw->hw_lock);
+	init_completion(&hw->hw_complete);
+
+	if (hw_intf->hw_idx < CAM_CUSTOM_HW_SUB_MOD_MAX)
+		cam_custom_hw_sub_mod_list[hw_intf->hw_idx] = hw_intf;
+
+	/* needs to be invoked when custom hw is in place */
+	//cam_custom_hw_sub_mod_init_hw(hw, NULL, 0);
+
+	CAM_DBG(CAM_CUSTOM, "HW idx:%d component bound successfully",
+		hw_intf->hw_idx);
+	return rc;
+
+free_core_info:
+	kfree(hw->core_info);
+free_hw:
+	kfree(hw);
+free_hw_intf:
+	kfree(hw_intf);
+	return rc;
+}
+
+static void cam_custom_hw_sub_mod_component_unbind(
+	struct device *dev, struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_CUSTOM, "Unbinding component: %s", pdev->name);
+}
+
+const static struct component_ops cam_custom_hw_sub_mod_component_ops = {
+	.bind = cam_custom_hw_sub_mod_component_bind,
+	.unbind = cam_custom_hw_sub_mod_component_unbind,
+};
+
+int cam_custom_hw_sub_mod_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CUSTOM, "Adding Custom HW sub module component");
+	rc = component_add(&pdev->dev, &cam_custom_hw_sub_mod_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static const struct of_device_id cam_custom_hw_sub_mod_dt_match[] = {
+	{
+		.compatible = "qcom,cam_custom_hw_sub_mod",
+		.data = &cam_custom_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_custom_hw_sub_mod_dt_match);
+
+struct platform_driver cam_custom_hw_sub_mod_driver = {
+	.probe = cam_custom_hw_sub_mod_probe,
+	.driver = {
+		.name = CAM_CUSTOM_SUB_MOD_NAME,
+		.of_match_table = cam_custom_hw_sub_mod_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_custom_hw_sub_module_init(void)
+{
+	return platform_driver_register(&cam_custom_hw_sub_mod_driver);
+}
+
+void cam_custom_hw_sub_module_exit(void)
+{
+	platform_driver_unregister(&cam_custom_hw_sub_mod_driver);
+}
+
+MODULE_DESCRIPTION("CAM CUSTOM HW SUB MODULE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_SUB_MOD_DEV_H_
+#define _CAM_CUSTOM_SUB_MOD_DEV_H_
+
+#include "cam_custom_hw_mgr_intf.h"
+
+#define CAM_CUSTOM_SUB_MOD_NAME "cam_custom_sub_mod"
+
+#define CAM_CUSTOM_SUB_MOD_MAX_INSTANCES                   2
+
+/**
+ * @brief : API to register Custom submodule to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_custom_hw_sub_module_init(void);
+
+/**
+ * @brief : API to remove Custom submodule interface from platform framework.
+ */
+void cam_custom_hw_sub_module_exit(void);
+#endif /* _CAM_CUSTOM_SUB_MOD_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.c
@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_cpas_api.h"
+#include "cam_custom_sub_mod_soc.h"
+#include "cam_debug_util.h"
+
+int cam_custom_hw_sub_mod_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *data)
+{
+	int                               rc = 0, i;
+	struct cam_custom_hw_soc_private *soc_private = NULL;
+	struct cam_cpas_register_params   cpas_register_param;
+	void                             *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_CUSTOM,
+			"Error! Get DT properties failed rc=%d", rc);
+		/* For Test Purposes */
+		return 0;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_custom_hw_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_CUSTOM, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler, &(irq_data[0]));
+	if (rc < 0) {
+		CAM_ERR(CAM_CUSTOM,
+			"Error! Request platform resources failed rc=%d", rc);
+		return rc;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+
+	strscpy(cpas_register_param.identifier, "custom",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	cpas_register_param.cam_cpas_client_cb = NULL;
+	cpas_register_param.userdata = soc_info;
+
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc < 0)
+		goto release_soc;
+
+	soc_private->cpas_handle =
+		cpas_register_param.client_handle;
+
+	rc = cam_cpas_select_qos_settings(CAM_CPAS_QOS_CUSTOM_SETTINGS_MASK);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Custom QoS selection failed %d", rc);
+		goto unregister_cpas;
+	}
+
+	return rc;
+
+unregister_cpas:
+	if (cam_cpas_unregister_client(soc_private->cpas_handle))
+		CAM_ERR(CAM_CUSTOM, "CPAS0 unregistration failed");
+release_soc:
+	if (cam_soc_util_release_platform_resource(soc_info))
+		CAM_ERR(CAM_CUSTOM, "CPAS0 release resource failed");
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_custom_hw_soc_private *soc_private = NULL;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_CUSTOM, "Error! soc_info NULL");
+		return -ENODEV;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_CUSTOM, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "CPAS0 unregistration failed rc=%d", rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_CUSTOM,
+			"Error! Release platform resources failed rc=%d", rc);
+
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_custom_hw_soc_private *soc_private = soc_info->soc_private;
+	struct cam_ahb_vote               ahb_vote;
+	struct cam_axi_vote axi_vote =    {0};
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ib_bw = 7200000;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = 512000000;
+	axi_vote.axi_path[1].mnoc_ab_bw = 512000000;
+	axi_vote.axi_path[1].mnoc_ib_bw = 512000000;
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Error! CPAS0 start failed rc=%d", rc);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		soc_info->lowest_clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Error! enable platform failed rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return 0;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_disable_soc_resources(
+	struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_custom_hw_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_CUSTOM, "Error! Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Disable platform failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Error! CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_HW_SUB_MOD_SOC_H_
+#define _CAM_CUSTOM_HW_SUB_MOD_SOC_H_
+
+#include "cam_soc_util.h"
+/*
+ * struct cam_custom_hw_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to Custom HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ */
+struct cam_custom_hw_soc_private {
+	uint32_t    cpas_handle;
+};
+
+int cam_custom_hw_sub_mod_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *irq_data);
+
+int cam_custom_hw_sub_mod_deinit_soc_resources(
+	struct cam_hw_soc_info *soc_info);
+
+int cam_custom_hw_sub_mod_enable_soc_resources(
+	struct cam_hw_soc_info *soc_info);
+
+int cam_custom_hw_sub_mod_disable_soc_resources(
+	struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_CUSTOM_HW_SUB_MOD_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.c
@@ -0,0 +1,1568 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+
+#include <media/cam_custom.h>
+#include <media/cam_sync.h>
+
+#include "cam_compat.h"
+#include "cam_sync_api.h"
+#include "cam_smmu_api.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_custom_hw_mgr.h"
+#include "cam_packet_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_common_util.h"
+#include "cam_hw.h"
+
+static struct cam_custom_hw_mgr g_custom_hw_mgr;
+
+static int cam_custom_mgr_get_hw_caps(void *hw_mgr_priv, void *hw_caps_args)
+{
+	int rc = 0;
+	struct cam_custom_hw_mgr          *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd          *query = hw_caps_args;
+	struct cam_custom_query_cap_cmd    custom_hw_cap;
+
+	if (sizeof(struct cam_custom_query_cap_cmd) != query->size) {
+		CAM_ERR(CAM_CUSTOM,
+			"Input query cap size:%u does not match expected query cap size: %u",
+			query->size, sizeof(struct cam_custom_query_cap_cmd));
+		return -EFAULT;
+	}
+	CAM_DBG(CAM_CUSTOM, "enter");
+
+	if (query->handle_type != CAM_HANDLE_USER_POINTER)
+		CAM_ERR(CAM_CUSTOM, "Wrong Args");
+
+	if (copy_from_user(&custom_hw_cap,
+		u64_to_user_ptr(query->caps_handle),
+		sizeof(struct cam_custom_query_cap_cmd))) {
+		rc = -EFAULT;
+		return rc;
+	}
+
+	custom_hw_cap.device_iommu.non_secure = hw_mgr->img_iommu_hdl;
+	custom_hw_cap.device_iommu.secure = -1;
+
+	/* Initializing cdm handles to -1 */
+	custom_hw_cap.cdm_iommu.non_secure = -1;
+	custom_hw_cap.cdm_iommu.secure = -1;
+
+	custom_hw_cap.num_dev = 1;
+	custom_hw_cap.dev_caps[0].hw_type = 0;
+	custom_hw_cap.dev_caps[0].hw_version = 0;
+
+	if (copy_to_user(u64_to_user_ptr(query->caps_handle),
+		&custom_hw_cap, sizeof(struct cam_custom_query_cap_cmd)))
+		rc = -EFAULT;
+
+	CAM_DBG(CAM_CUSTOM, "exit rc :%d", rc);
+	return rc;
+}
+
+enum cam_custom_hw_resource_state
+	cam_custom_hw_mgr_get_custom_res_state(
+	uint32_t						in_rsrc_state)
+{
+	enum cam_custom_hw_resource_state     rsrc_state;
+
+	CAM_DBG(CAM_CUSTOM, "rsrc_state %x", in_rsrc_state);
+
+	switch (in_rsrc_state) {
+	case CAM_ISP_RESOURCE_STATE_UNAVAILABLE:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_UNAVAILABLE;
+		break;
+	case CAM_ISP_RESOURCE_STATE_AVAILABLE:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_AVAILABLE;
+		break;
+	case CAM_ISP_RESOURCE_STATE_RESERVED:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_RESERVED;
+		break;
+	case CAM_ISP_RESOURCE_STATE_INIT_HW:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_INIT_HW;
+		break;
+	case CAM_ISP_RESOURCE_STATE_STREAMING:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_STREAMING;
+		break;
+	default:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_UNAVAILABLE;
+		CAM_DBG(CAM_CUSTOM, "invalid rsrc type");
+		break;
+	}
+
+	return rsrc_state;
+}
+
+enum cam_isp_resource_state
+	cam_custom_hw_mgr_get_isp_res_state(
+	uint32_t						in_rsrc_state)
+{
+	enum cam_isp_resource_state     rsrc_state;
+
+	CAM_DBG(CAM_CUSTOM, "rsrc_state %x", in_rsrc_state);
+
+	switch (in_rsrc_state) {
+	case CAM_CUSTOM_HW_RESOURCE_STATE_UNAVAILABLE:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+		break;
+	case CAM_CUSTOM_HW_RESOURCE_STATE_AVAILABLE:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		break;
+	case CAM_CUSTOM_HW_RESOURCE_STATE_RESERVED:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+		break;
+	case CAM_CUSTOM_HW_RESOURCE_STATE_INIT_HW:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+		break;
+	case CAM_CUSTOM_HW_RESOURCE_STATE_STREAMING:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+		break;
+	default:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+		CAM_DBG(CAM_CUSTOM, "invalid rsrc type");
+		break;
+	}
+
+	return rsrc_state;
+}
+
+enum cam_isp_resource_type
+	cam_custom_hw_mgr_get_isp_res_type(
+	enum cam_custom_hw_mgr_res_type res_type)
+{
+	switch (res_type) {
+	case CAM_CUSTOM_CID_HW:
+		return CAM_ISP_RESOURCE_CID;
+	case CAM_CUSTOM_CSID_HW:
+		return CAM_ISP_RESOURCE_PIX_PATH;
+	default:
+		return CAM_ISP_RESOURCE_MAX;
+	}
+}
+
+static void cam_custom_mgr_count_functional_hws(uint32_t *num_custom_functional)
+{
+	int i;
+
+	for (i = 0; i < CAM_CUSTOM_CSID_HW_MAX; i++) {
+		if (g_custom_hw_mgr.custom_hw[i])
+			(*num_custom_functional)++;
+	}
+}
+
+static int cam_custom_hw_mgr_deinit_hw_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.deinit) {
+		CAM_DBG(CAM_CUSTOM, "DEINIT HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.deinit(hw_intf->hw_priv,
+			isp_rsrc_node, sizeof(struct cam_isp_resource_node));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_DBG(CAM_CUSTOM, "DEINIT HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_hw_mgr_stop_hw_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_csid_hw_stop_args  stop_cmd;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.stop) {
+		CAM_DBG(CAM_CUSTOM, "STOP HW for res_id:%u",
+			hw_mgr_res->res_id);
+		stop_cmd.num_res = 1;
+		stop_cmd.node_res = &isp_rsrc_node;
+		stop_cmd.stop_cmd = CAM_CSID_HALT_AT_FRAME_BOUNDARY;
+		rc = hw_intf->hw_ops.stop(hw_intf->hw_priv,
+			&stop_cmd, sizeof(struct cam_csid_hw_stop_args));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_DBG(CAM_CUSTOM, "STOP HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_mgr_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_custom_stop_args      *custom_args;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_custom_hw_mgr_res     *hw_mgr_res;
+	struct cam_custom_hw_mgr_ctx     *ctx;
+
+	if (!hw_mgr_priv || !stop_hw_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	custom_args = (struct cam_custom_stop_args *)stop_args->args;
+	ctx = (struct cam_custom_hw_mgr_ctx *)
+		stop_args->ctxt_to_hw_map;
+
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_CUSTOM, " Enter...ctx id:%d", ctx->ctx_index);
+
+	/* Stop custom cid here */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_stop_hw_res(hw_mgr_res);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "failed to stop hw %d",
+				hw_mgr_res->res_id);
+	}
+
+	/* Stop custom csid here */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_stop_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "failed to stop hw %d",
+				hw_mgr_res->res_id);
+		}
+	}
+
+
+	/* stop custom hw here */
+
+	if (custom_args->stop_only)
+		goto end;
+
+	/* Deinit custom cid here */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_deinit_hw_res(hw_mgr_res);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "failed to stop hw %d",
+			hw_mgr_res->res_id);
+	}
+
+	/* Deinit custom csid here */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_deinit_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "failed to stop hw %d",
+				hw_mgr_res->res_id);
+		}
+	}
+
+	/* deinit custom rsrc */
+
+end:
+	return rc;
+}
+
+static int cam_custom_hw_mgr_init_hw_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.init) {
+		CAM_DBG(CAM_CUSTOM, "INIT HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.init(hw_intf->hw_priv,
+			isp_rsrc_node, sizeof(struct cam_isp_resource_node));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_DBG(CAM_CUSTOM, "INIT HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_hw_mgr_start_hw_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.start) {
+		CAM_DBG(CAM_CUSTOM, "Start HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.start(hw_intf->hw_priv,
+			isp_rsrc_node, sizeof(struct cam_isp_resource_node));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_DBG(CAM_CUSTOM, "START HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_mgr_start_hw(void *hw_mgr_priv,
+	void *start_hw_args)
+{
+	int                                      rc = 0;
+	struct cam_hw_config_args               *hw_config;
+	struct cam_hw_stop_args                  stop_args;
+	struct cam_custom_hw_mgr_res            *hw_mgr_res;
+	struct cam_custom_hw_mgr_ctx            *ctx;
+	struct cam_custom_stop_args              custom_stop_args;
+	struct cam_custom_start_args            *custom_args;
+
+	if (!hw_mgr_priv || !start_hw_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	custom_args =
+		(struct cam_custom_start_args *)start_hw_args;
+
+	hw_config = (struct cam_hw_config_args *)
+		&custom_args->hw_config;
+
+	ctx = (struct cam_custom_hw_mgr_ctx *)
+		hw_config->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Enter... ctx id:%d",
+		ctx->ctx_index);
+
+	if (custom_args->start_only)
+		goto start_only;
+
+	/* Init custom cid */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can not INIT CID(id :%d)",
+				hw_mgr_res->res_id);
+			goto deinit_hw;
+		}
+	}
+
+	/* Init custom csid */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can not INIT CSID(id :%d)",
+				hw_mgr_res->res_id);
+			goto deinit_hw;
+		}
+	}
+
+
+	/* Init custom hw here */
+
+	/* Apply init config */
+
+start_only:
+
+	/* Start custom csid */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_start_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can not START CSID(id :%d)",
+				hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	/* Start custom cid */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_start_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can not START CID(id :%d)",
+				hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Start success for ctx id:%d", ctx->ctx_index);
+	return 0;
+
+err:
+	custom_stop_args.stop_only = false;
+	stop_args.args = (void *) &custom_stop_args;
+	stop_args.ctxt_to_hw_map = hw_config->ctxt_to_hw_map;
+	cam_custom_mgr_stop_hw(hw_mgr_priv, &stop_args);
+deinit_hw:
+	/* deinit the hw previously initialized */
+	CAM_DBG(CAM_CUSTOM, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static int cam_custom_mgr_read(void *hw_mgr_priv, void *read_args)
+{
+	return -EPERM;
+}
+
+static int cam_custom_mgr_write(void *hw_mgr_priv, void *write_args)
+{
+	return -EPERM;
+}
+
+static int cam_custom_hw_mgr_notify(
+	uint32_t evt_id,
+	struct cam_custom_hw_mgr_ctx *custom_ctx,
+	struct cam_custom_hw_event_info *evt_info)
+{
+	int rc = 0;
+	struct cam_custom_hw_reg_update_event_data reg_upd_data;
+	struct cam_custom_hw_done_event_data done_evt_data;
+	struct cam_custom_hw_error_event_data err_evt_data;
+
+	switch (evt_id) {
+	case CAM_CUSTOM_HW_EVENT_RUP_DONE:
+		CAM_DBG(CAM_CUSTOM, "Notify RUP for ctx %u",
+			custom_ctx->ctx_index);
+		/* fill the evt data struct */
+		custom_ctx->event_cb(custom_ctx->cb_priv,
+			CAM_CUSTOM_HW_EVENT_RUP_DONE, &reg_upd_data);
+		break;
+	case CAM_CUSTOM_HW_EVENT_FRAME_DONE:
+		CAM_DBG(CAM_CUSTOM, "Notify FRAME DONE for ctx %u",
+			custom_ctx->ctx_index);
+		/* fill the evt data struct */
+		done_evt_data.num_handles = 1;
+		custom_ctx->event_cb(custom_ctx->cb_priv,
+			CAM_CUSTOM_HW_EVENT_RUP_DONE, &done_evt_data);
+		break;
+	case CAM_CUSTOM_HW_EVENT_ERROR:
+		CAM_DBG(CAM_CUSTOM, "Notify ERROR for ctx %u",
+			custom_ctx->ctx_index);
+		/* fill the evt data struct */
+		custom_ctx->event_cb(custom_ctx->cb_priv,
+			CAM_CUSTOM_HW_EVENT_RUP_DONE, &err_evt_data);
+		break;
+	default:
+		CAM_ERR(CAM_CUSTOM, "Invalid evt_id %u", evt_id);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_custom_hw_mgr_evt_handler(
+	void *priv, uint32_t evt_id, void *hw_evt_info)
+{
+	int                              rc = 0;
+	struct cam_custom_hw_mgr_ctx    *custom_ctx = NULL;
+	struct cam_custom_hw_mgr_ctx    *custom_ctx_tmp = NULL;
+	struct cam_custom_hw_event_info *evt_info = NULL;
+	struct cam_custom_hw_mgr        *hw_mgr = &g_custom_hw_mgr;
+	bool                             ctx_found = false;
+
+	if (!hw_evt_info) {
+		CAM_ERR(CAM_CUSTOM, "invalid evt info");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Invoked for HW Event ID 0x%x",
+		evt_id);
+	evt_info = (struct cam_custom_hw_event_info *)hw_evt_info;
+
+	list_for_each_entry_safe(custom_ctx, custom_ctx_tmp,
+		&hw_mgr->used_ctx_list, list) {
+		if (custom_ctx->task_type  == evt_info->task_type) {
+			ctx_found = true;
+			rc = cam_custom_hw_mgr_notify(evt_id, custom_ctx,
+				evt_info);
+			if (rc) {
+				CAM_ERR(CAM_CUSTOM, "Failed to notify");
+				return rc;
+			}
+			break;
+		}
+	}
+
+	if (!ctx_found)
+		CAM_DBG(CAM_CUSTOM, "Failed to find affected ctx");
+
+	return rc;
+}
+
+static int cam_custom_hw_mgr_put_ctx(
+	struct list_head                 *src_list,
+	struct cam_custom_hw_mgr_ctx    **custom_ctx)
+{
+	struct cam_custom_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	ctx_ptr = *custom_ctx;
+	if (ctx_ptr)
+		list_add_tail(&ctx_ptr->list, src_list);
+	*custom_ctx = NULL;
+	return 0;
+}
+
+static int cam_custom_hw_mgr_get_ctx(
+	struct list_head                *src_list,
+	struct cam_custom_hw_mgr_ctx       **custom_ctx)
+{
+	struct cam_custom_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	if (!list_empty(src_list)) {
+		ctx_ptr = list_first_entry(src_list,
+			struct cam_custom_hw_mgr_ctx, list);
+		list_del_init(&ctx_ptr->list);
+	} else {
+		CAM_ERR(CAM_CUSTOM, "No more free custom hw mgr ctx");
+		return -EINVAL;
+	}
+	*custom_ctx = ctx_ptr;
+	memset(ctx_ptr->sub_hw_list, 0,
+		sizeof(struct cam_custom_hw_mgr_res) *
+		CAM_CUSTOM_HW_RES_MAX);
+
+	return 0;
+}
+
+static int cam_custom_hw_mgr_put_res(
+	struct list_head                *src_list,
+	struct cam_custom_hw_mgr_res   **res)
+{
+	struct cam_custom_hw_mgr_res *res_ptr = NULL;
+
+	res_ptr = *res;
+	if (res_ptr)
+		list_add_tail(&res_ptr->list, src_list);
+
+	return 0;
+}
+
+static int cam_custom_hw_mgr_get_res(
+	struct list_head                *src_list,
+	struct cam_custom_hw_mgr_res   **res)
+{
+	int rc = 0;
+	struct cam_custom_hw_mgr_res *res_ptr = NULL;
+
+	if (!list_empty(src_list)) {
+		res_ptr = list_first_entry(src_list,
+			struct cam_custom_hw_mgr_res, list);
+		list_del_init(&res_ptr->list);
+	} else {
+		CAM_ERR(CAM_CUSTOM, "No more free custom ctx rsrc");
+		rc = -1;
+	}
+	*res = res_ptr;
+
+	return rc;
+}
+
+static enum cam_ife_pix_path_res_id
+	cam_custom_hw_mgr_get_csid_res_type(
+	uint32_t						out_port_type,
+	struct cam_custom_hw_mgr_ctx   *custom_ctx)
+{
+	enum cam_ife_pix_path_res_id path_id;
+
+	CAM_DBG(CAM_CUSTOM, "out_port_type %x", out_port_type);
+
+	switch (out_port_type) {
+	case CAM_CUSTOM_OUT_RES_UDI_0:
+		path_id = CAM_IFE_PIX_PATH_RES_UDI_0;
+		break;
+	case CAM_CUSTOM_OUT_RES_UDI_1:
+		path_id = CAM_IFE_PIX_PATH_RES_UDI_1;
+		custom_ctx->task_type = CAM_CUSTOM_EVENT_TASK2;
+		break;
+	case CAM_CUSTOM_OUT_RES_UDI_2:
+		path_id = CAM_IFE_PIX_PATH_RES_UDI_2;
+		custom_ctx->task_type = CAM_CUSTOM_EVENT_TASK3;
+		break;
+	default:
+		path_id = CAM_IFE_PIX_PATH_RES_MAX;
+		CAM_DBG(CAM_CUSTOM, "maximum rdi output type exceeded");
+		break;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "out_port %x path_id %d", out_port_type, path_id);
+
+	return path_id;
+}
+
+static int cam_custom_hw_mgr_acquire_cid_res(
+	struct cam_custom_hw_mgr_ctx           *custom_ctx,
+	struct cam_isp_in_port_generic_info    *in_port,
+	struct cam_custom_hw_mgr_res          **cid_res,
+	enum cam_ife_pix_path_res_id            path_res_id,
+	struct cam_isp_resource_node          **cid_rsrc_node)
+{
+	int rc = -1;
+	int i;
+	struct cam_custom_hw_mgr             *custom_hw_mgr;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_custom_hw_mgr_res         *cid_res_temp;
+	struct cam_csid_hw_reserve_resource_args  csid_acquire;
+	struct cam_isp_resource_node          *isp_rsrc_node;
+
+	custom_hw_mgr = custom_ctx->hw_mgr;
+	*cid_res = NULL;
+
+	rc = cam_custom_hw_mgr_get_res(
+		&custom_ctx->free_res_list, cid_res);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "No more free hw mgr resource");
+		goto end;
+	}
+
+	memset(&csid_acquire, 0, sizeof(csid_acquire));
+	cid_res_temp = *cid_res;
+	csid_acquire.res_type = CAM_ISP_RESOURCE_CID;
+	csid_acquire.in_port = in_port;
+	csid_acquire.res_id =  path_res_id;
+	csid_acquire.node_res = NULL;
+	CAM_DBG(CAM_CUSTOM, "path_res_id %d", path_res_id);
+
+	for (i = 0; i < CAM_CUSTOM_CSID_HW_MAX; i++) {
+		if (!custom_hw_mgr->csid_devices[i])
+			continue;
+
+		hw_intf = custom_hw_mgr->csid_devices[i];
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+		/* since there is a need of 1 cid at this stage */
+			if (rc)
+				continue;
+			else
+				break;
+
+	}
+
+	if (!csid_acquire.node_res) {
+		CAM_ERR(CAM_CUSTOM,
+			"Can not acquire custom cid resource for path %d",
+			path_res_id);
+		rc = -EAGAIN;
+		goto put_res;
+	}
+
+	*cid_rsrc_node = csid_acquire.node_res;
+	isp_rsrc_node = csid_acquire.node_res;
+	cid_res_temp->rsrc_node = isp_rsrc_node;
+	cid_res_temp->res_type = CAM_CUSTOM_CID_HW;
+	cid_res_temp->res_id = isp_rsrc_node->res_id;
+	cam_custom_hw_mgr_put_res(&custom_ctx->res_list_custom_cid,
+		&cid_res_temp);
+
+	CAM_DBG(CAM_CUSTOM, "CID acquired successfully %u",
+		isp_rsrc_node->res_id);
+
+	return 0;
+
+put_res:
+	cam_custom_hw_mgr_put_res(&custom_ctx->free_res_list, cid_res);
+end:
+	return rc;
+
+}
+
+static int cam_custom_hw_mgr_acquire_csid_res(
+	struct cam_custom_hw_mgr_ctx        *custom_ctx,
+	struct cam_isp_in_port_generic_info *in_port_info)
+{
+	int rc = 0, i = 0;
+	struct cam_isp_out_port_generic_info    *out_port;
+	struct cam_custom_hw_mgr_res            *custom_csid_res;
+	struct cam_custom_hw_mgr_res            *custom_cid_res;
+	struct cam_hw_intf                      *hw_intf;
+	struct cam_csid_hw_reserve_resource_args custom_csid_acquire;
+	enum cam_ife_pix_path_res_id             path_res_id;
+	struct cam_isp_resource_node            *isp_rsrc_node;
+	struct cam_isp_resource_node            *cid_rsrc_node = NULL;
+
+	for (i = 0; i < in_port_info->num_out_res; i++) {
+		out_port = &in_port_info->data[i];
+		path_res_id = cam_custom_hw_mgr_get_csid_res_type(
+			out_port->res_type, custom_ctx);
+
+		if (path_res_id == CAM_IFE_PIX_PATH_RES_MAX) {
+			CAM_WARN(CAM_CUSTOM, "Invalid out port res_type %u",
+				out_port->res_type);
+			continue;
+		}
+
+		rc = cam_custom_hw_mgr_acquire_cid_res(custom_ctx, in_port_info,
+			&custom_cid_res, path_res_id, &cid_rsrc_node);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "No free cid rsrc %d", rc);
+			goto end;
+		}
+
+		rc = cam_custom_hw_mgr_get_res(&custom_ctx->free_res_list,
+			&custom_csid_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "No more free hw mgr rsrc");
+			goto end;
+		}
+
+		memset(&custom_csid_acquire, 0, sizeof(custom_csid_acquire));
+		custom_csid_acquire.res_id = path_res_id;
+		custom_csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		custom_csid_acquire.in_port = in_port_info;
+		custom_csid_acquire.out_port = out_port;
+		custom_csid_acquire.sync_mode = 0;
+		custom_csid_acquire.node_res = NULL;
+
+		hw_intf = cid_rsrc_node->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&custom_csid_acquire, sizeof(custom_csid_acquire));
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM,
+				"Custom csid acquire failed for hw_idx %u rc %d",
+				hw_intf->hw_idx, rc);
+			goto put_res;
+		}
+
+		if (custom_csid_acquire.node_res == NULL) {
+			CAM_ERR(CAM_CUSTOM, "Acquire custom csid failed");
+			rc = -EAGAIN;
+			goto put_res;
+		}
+
+		isp_rsrc_node = custom_csid_acquire.node_res;
+		custom_csid_res->rsrc_node = isp_rsrc_node;
+		custom_csid_res->res_type = CAM_CUSTOM_CSID_HW;
+		custom_csid_res->res_id = custom_csid_acquire.res_id;
+		cam_custom_hw_mgr_put_res(
+			&custom_ctx->res_list_custom_csid,
+			&custom_csid_res);
+		CAM_DBG(CAM_CUSTOM, "Custom CSID acquired for path %d",
+			path_res_id);
+	}
+
+	return 0;
+
+put_res:
+	cam_custom_hw_mgr_put_res(&custom_ctx->free_res_list,
+		&custom_csid_res);
+end:
+	return rc;
+}
+
+static int cam_custom_hw_mgr_free_hw_res(
+	struct cam_custom_hw_mgr_res   *hw_mgr_res)
+{
+	int rc = 0;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.release) {
+		CAM_DBG(CAM_CUSTOM, "RELEASE HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.release(hw_intf->hw_priv,
+			isp_rsrc_node, sizeof(struct cam_isp_resource_node));
+		if (rc)
+			CAM_ERR(CAM_CUSTOM,
+				"Release HW failed for hw_idx %d",
+				hw_intf->hw_idx);
+	}
+
+	/* caller should make sure the resource is in a list */
+	list_del_init(&hw_mgr_res->list);
+	memset(hw_mgr_res, 0, sizeof(*hw_mgr_res));
+	INIT_LIST_HEAD(&hw_mgr_res->list);
+
+	return 0;
+}
+
+static int cam_custom_hw_mgr_release_hw_for_ctx(
+	struct cam_custom_hw_mgr_ctx *custom_ctx)
+{
+	int rc = -1;
+	struct cam_custom_hw_mgr_res     *hw_mgr_res;
+	struct cam_custom_hw_mgr_res	 *hw_mgr_res_temp;
+
+	/* Release custom cid */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&custom_ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_free_hw_res(hw_mgr_res);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "Can not release CID(id :%d)",
+				hw_mgr_res->res_id);
+		cam_custom_hw_mgr_put_res(
+			&custom_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* Release custom csid */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&custom_ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_free_hw_res(hw_mgr_res);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "Can not release CSID(id :%d)",
+				hw_mgr_res->res_id);
+		cam_custom_hw_mgr_put_res(
+			&custom_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* Release custom HW Here */
+
+	return 0;
+}
+static int cam_custom_mgr_release_hw(void *hw_mgr_priv,
+	void *release_hw_args)
+{
+	int                               rc           = 0;
+	struct cam_hw_release_args       *release_args = release_hw_args;
+	struct cam_custom_hw_mgr_ctx     *custom_ctx;
+
+	if (!hw_mgr_priv || !release_hw_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	custom_ctx =
+		(struct cam_custom_hw_mgr_ctx *)release_args->ctxt_to_hw_map;
+	if (!custom_ctx || !custom_ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Enter...ctx id:%d",
+		custom_ctx->ctx_index);
+
+	cam_custom_hw_mgr_release_hw_for_ctx(custom_ctx);
+	list_del_init(&custom_ctx->list);
+	custom_ctx->scratch_buffer_addr = 0;
+	custom_ctx->ctx_in_use = 0;
+	custom_ctx->task_type = CAM_CUSTOM_EVENT_INVALID;
+	cam_custom_hw_mgr_put_ctx(&g_custom_hw_mgr.free_ctx_list, &custom_ctx);
+	CAM_DBG(CAM_CUSTOM, "Release Exit..");
+	return rc;
+}
+
+static int cam_custom_hw_mgr_acquire_get_unified_dev_str(
+	struct cam_custom_acquire_hw_info *acquire_hw_info,
+	uint32_t *input_size,
+	struct cam_isp_in_port_generic_info **gen_port_info)
+{
+	int32_t rc = 0, i;
+	uint32_t in_port_length = 0;
+	struct cam_custom_in_port_info *in = NULL;
+	struct cam_isp_in_port_generic_info *port_info = NULL;
+
+	in = (struct cam_custom_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset + *input_size);
+
+	in_port_length = sizeof(struct cam_custom_in_port_info) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_custom_out_port_info);
+
+	*input_size += in_port_length;
+
+	if ((*input_size) > acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_CUSTOM, "Input is not proper");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	port_info = kzalloc(
+		sizeof(struct cam_isp_in_port_generic_info), GFP_KERNEL);
+
+	if (!port_info)
+		return -ENOMEM;
+
+	port_info->res_type        =  in->res_type +
+		CAM_ISP_IFE_IN_RES_BASE - CAM_CUSTOM_IN_RES_BASE;
+	port_info->lane_type       =  in->lane_type;
+	port_info->lane_num        =  in->lane_num;
+	port_info->lane_cfg        =  in->lane_cfg;
+	port_info->vc[0]           =  in->vc[0];
+	port_info->dt[0]           =  in->dt[0];
+	port_info->num_valid_vc_dt =  in->num_valid_vc_dt;
+	port_info->format[0]       =  in->format;
+	port_info->test_pattern    =  in->test_pattern;
+	port_info->usage_type      =  in->usage_type;
+	port_info->left_start      =  in->left_start;
+	port_info->left_stop       =  in->left_stop;
+	port_info->left_width      =  in->left_width;
+	port_info->right_start     =  in->right_start;
+	port_info->right_stop      =  in->right_stop;
+	port_info->right_width     =  in->right_width;
+	port_info->line_start      =  in->line_start;
+	port_info->line_stop       =  in->line_stop;
+	port_info->height          =  in->height;
+	port_info->pixel_clk       =  in->pixel_clk;
+	port_info->cust_node       =  1;
+	port_info->num_out_res     =  in->num_out_res;
+	port_info->num_bytes_out   =  in->num_bytes_out;
+
+	port_info->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_out_port_generic_info),
+		GFP_KERNEL);
+	if (port_info->data == NULL) {
+		rc = -ENOMEM;
+		goto release_port_mem;
+	}
+
+	for (i = 0; i < in->num_out_res; i++) {
+		port_info->data[i].res_type     = in->data_flex[i].res_type;
+		port_info->data[i].format       = in->data_flex[i].format;
+	}
+
+	*gen_port_info = port_info;
+	return 0;
+
+release_port_mem:
+	kfree(port_info);
+	return rc;
+}
+
+static int cam_custom_mgr_acquire_hw_for_ctx(
+	struct cam_custom_hw_mgr_ctx           *custom_ctx,
+	struct cam_isp_in_port_generic_info    *in_port_info,
+	uint32_t *acquired_hw_id, uint32_t *acquired_hw_path)
+{
+	int rc = 0, i = 0;
+	struct cam_hw_intf            *hw_intf;
+	struct cam_custom_hw_mgr      *custom_hw_mgr;
+	struct cam_custom_sub_mod_acq acq;
+
+	custom_hw_mgr = custom_ctx->hw_mgr;
+
+	/* Acquire custom csid */
+	rc = cam_custom_hw_mgr_acquire_csid_res(custom_ctx, in_port_info);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Custom csid acquire failed rc %d");
+		goto err;
+	}
+
+	/* Acquire custom hw */
+	for (i = 0; i < CAM_CUSTOM_HW_SUB_MOD_MAX; i++) {
+		hw_intf = custom_hw_mgr->custom_hw[i];
+		if (!hw_intf)
+			continue;
+
+		acq.event_cb = cam_custom_hw_mgr_evt_handler;
+		acq.priv = custom_ctx;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&acq, sizeof(acq));
+		if (rc) {
+			CAM_DBG(CAM_CUSTOM,
+				"No custom resource from hw %d",
+				hw_intf->hw_idx);
+			continue;
+		}
+		/* need to be set in reserve based on HW being acquired */
+		//custom_ctx->sub_hw_list[i].hw_res = acq.rsrc_node;
+		//custom_ctx->sub_hw_list[i].res_type = <res_type>
+		//custom_ctx->sub_hw_list[i].res_id = <res_id>;
+		break;
+	}
+
+err:
+	return rc;
+}
+
+static int cam_custom_mgr_acquire_hw(
+	void *hw_mgr_priv,
+	void *acquire_hw_args)
+{
+	int rc = -1, i;
+	uint32_t                             input_size = 0;
+	struct cam_custom_hw_mgr_ctx        *custom_ctx;
+	struct cam_custom_hw_mgr            *custom_hw_mgr;
+	struct cam_custom_acquire_hw_info   *acquire_hw_info = NULL;
+	struct cam_isp_in_port_generic_info *gen_port_info = NULL;
+	struct cam_hw_acquire_args          *acquire_args =
+		(struct cam_hw_acquire_args *)acquire_hw_args;
+
+	if (!hw_mgr_priv || !acquire_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid params");
+		return -EINVAL;
+	}
+
+	custom_hw_mgr = (struct cam_custom_hw_mgr *) hw_mgr_priv;
+	mutex_lock(&g_custom_hw_mgr.ctx_mutex);
+	rc = cam_custom_hw_mgr_get_ctx(
+		&custom_hw_mgr->free_ctx_list, &custom_ctx);
+	if (rc || !custom_ctx) {
+		CAM_ERR(CAM_CUSTOM, "Get custom hw context failed");
+		mutex_unlock(&g_custom_hw_mgr.ctx_mutex);
+		goto err;
+	}
+	mutex_unlock(&g_custom_hw_mgr.ctx_mutex);
+
+	custom_ctx->hw_mgr = custom_hw_mgr;
+	custom_ctx->cb_priv = acquire_args->context_data;
+	custom_ctx->event_cb = acquire_args->event_cb;
+
+	acquire_hw_info =
+		(struct cam_custom_acquire_hw_info *)acquire_args->acquire_info;
+
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		rc = cam_custom_hw_mgr_acquire_get_unified_dev_str(
+			acquire_hw_info, &input_size, &gen_port_info);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_CUSTOM, "Failed in parsing: %d", rc);
+			goto free_res;
+		}
+
+		CAM_DBG(CAM_CUSTOM, "in_res_type %x", gen_port_info->res_type);
+		rc = cam_custom_mgr_acquire_hw_for_ctx(custom_ctx,
+			gen_port_info, &acquire_args->acquired_hw_id[i],
+			acquire_args->acquired_hw_path[i]);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "can not acquire resource");
+			goto free_mem;
+		}
+
+		kfree(gen_port_info->data);
+		kfree(gen_port_info);
+		gen_port_info = NULL;
+	}
+
+	custom_ctx->ctx_in_use = 1;
+	custom_ctx->scratch_buffer_addr = 0;
+	acquire_args->ctxt_to_hw_map = custom_ctx;
+	cam_custom_hw_mgr_put_ctx(&custom_hw_mgr->used_ctx_list, &custom_ctx);
+	CAM_DBG(CAM_CUSTOM, "Exit...(success)");
+	return 0;
+
+free_mem:
+	kfree(gen_port_info->data);
+	kfree(gen_port_info);
+free_res:
+	cam_custom_hw_mgr_release_hw_for_ctx(custom_ctx);
+	cam_custom_hw_mgr_put_ctx(&custom_hw_mgr->free_ctx_list, &custom_ctx);
+err:
+	CAM_DBG(CAM_CUSTOM, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static int cam_custom_add_io_buffers(
+	int                                   iommu_hdl,
+	struct cam_hw_prepare_update_args    *prepare)
+{
+	int rc = 0, i = 0, num_out_buf = 0;
+	int32_t                             hdl;
+	uint32_t                            plane_id;
+	size_t                              size;
+	struct cam_buf_io_cfg              *io_cfg;
+	struct cam_hw_fence_map_entry      *out_map_entries;
+	struct cam_custom_prepare_hw_update_data *prepare_hw_data;
+	bool                                is_buf_secure;
+
+	io_cfg = (struct cam_buf_io_cfg *)((uint8_t *)
+			&prepare->packet->payload_flex +
+			prepare->packet->io_configs_offset);
+	prepare_hw_data =
+			(struct cam_custom_prepare_hw_update_data *)
+			prepare->priv;
+
+	/* Validate hw update entries */
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		CAM_DBG(CAM_CUSTOM, "======= io config idx %d ============", i);
+		CAM_DBG(CAM_CUSTOM,
+			"i %d req_id %llu resource_type:%d fence:%d direction %d",
+			i, prepare->packet->header.request_id,
+			io_cfg[i].resource_type, io_cfg[i].fence,
+			io_cfg[i].direction);
+
+		CAM_DBG(CAM_CUSTOM, "format: %d", io_cfg[i].format);
+
+		if (io_cfg[i].direction == CAM_BUF_OUTPUT) {
+			CAM_DBG(CAM_CUSTOM,
+				"output fence 0x%x", io_cfg[i].fence);
+			out_map_entries =
+				&prepare->out_map_entries[num_out_buf];
+			if (num_out_buf < prepare->max_out_map_entries) {
+				out_map_entries->resource_handle =
+					io_cfg[i].resource_type;
+				out_map_entries->sync_id =
+					io_cfg[i].fence;
+				num_out_buf++;
+			} else {
+				CAM_ERR(CAM_CUSTOM, "out: %d max: %d",
+					num_out_buf,
+					prepare->max_out_map_entries);
+				return -EINVAL;
+			}
+		} else if (io_cfg[i].direction == CAM_BUF_INPUT) {
+			CAM_DBG(CAM_CUSTOM,
+				"input fence 0x%x", io_cfg[i].fence);
+			return -EINVAL;
+		} else {
+			CAM_ERR(CAM_CUSTOM, "Invalid io config direction :%d",
+				io_cfg[i].direction);
+			return -EINVAL;
+		}
+
+		if (io_cfg[i].direction == CAM_BUF_OUTPUT) {
+			for (plane_id = 0; plane_id < CAM_PACKET_MAX_PLANES;
+				plane_id++) {
+				/* for custom HW it's one plane only */
+				if (!io_cfg[i].mem_handle[plane_id])
+					continue;
+
+				hdl = io_cfg[i].mem_handle[plane_id];
+				is_buf_secure = cam_mem_is_secure_buf(hdl);
+				if (is_buf_secure) {
+					CAM_ERR(CAM_CUSTOM,
+						"secure buffer not supported");
+					return -EINVAL;
+				}
+
+				rc = cam_mem_get_io_buf(
+					io_cfg[i].mem_handle[plane_id],
+					iommu_hdl,
+					&prepare_hw_data->io_addr[plane_id],
+					&size, NULL, NULL);
+				if (rc) {
+					CAM_ERR(CAM_CUSTOM,
+						"No io addr for plane: %d",
+						plane_id);
+					return -EINVAL;
+				}
+
+				prepare_hw_data->io_addr[plane_id] +=
+					io_cfg[i].offsets[plane_id];
+				CAM_DBG(CAM_CUSTOM,
+					"handle 0x%x for plane %d addr %pK",
+					hdl, plane_id,
+					prepare_hw_data->io_addr[plane_id]);
+			}
+		}
+	}
+
+	prepare->num_out_map_entries = num_out_buf;
+	prepare->num_in_map_entries = 0;
+	return rc;
+}
+
+static int cam_custom_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int rc = 0;
+	struct cam_hw_prepare_update_args        *prepare;
+	struct cam_cmd_buf_desc                  *cmd_desc = NULL;
+	struct cam_custom_prepare_hw_update_data *prepare_hw_data;
+	struct cam_custom_hw_mgr                 *hw_mgr;
+	struct cam_custom_hw_mgr_ctx             *ctx = NULL;
+	uint32_t                                 *ptr;
+	size_t                                    len;
+	struct cam_custom_cmd_buf_type_1         *custom_buf_type1;
+
+	if (!hw_mgr_priv || !prepare_hw_update_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_mgr = (struct cam_custom_hw_mgr *) hw_mgr_priv;
+	prepare =
+		(struct cam_hw_prepare_update_args *) prepare_hw_update_args;
+
+	CAM_DBG(CAM_CUSTOM, "Enter for req_id %lld",
+		prepare->packet->header.request_id);
+
+	/* Prepare packet */
+	prepare_hw_data =
+		(struct cam_custom_prepare_hw_update_data *)prepare->priv;
+	prepare_hw_data->packet_opcode_type =
+		(prepare->packet->header.op_code & 0xFFF);
+	ctx = (struct cam_custom_hw_mgr_ctx *) prepare->ctxt_to_hw_map;
+
+	prepare->num_hw_update_entries = 0;
+	prepare->num_in_map_entries = 0;
+	prepare->num_out_map_entries = 0;
+
+	/* Test purposes-check the data in cmd buffer */
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint8_t *)&prepare->packet->payload_flex +
+		prepare->packet->cmd_buf_offset);
+	rc = cam_packet_util_get_cmd_mem_addr(
+			cmd_desc->mem_handle, &ptr, &len);
+	if (rc == -EINVAL) {
+		CAM_ERR(CAM_CUSTOM, "Failed to get CPU addr handle 0x%x",
+			cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+
+	if (!rc) {
+		ptr += (cmd_desc->offset / 4);
+		custom_buf_type1 =
+			(struct cam_custom_cmd_buf_type_1 *)ptr;
+		CAM_DBG(CAM_CUSTOM, "frame num %u",
+			custom_buf_type1->custom_info);
+	}
+
+	/*
+	 * Populate scratch buffer addr here based on INIT
+	 */
+	ctx->scratch_buffer_addr = 0x0;
+	prepare_hw_data->num_cfg = 0;
+	cam_custom_add_io_buffers(hw_mgr->img_iommu_hdl, prepare);
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return 0;
+}
+
+static int cam_custom_hw_mgr_reset_csid_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_csid_reset_cfg_args  csid_reset_args;
+	struct cam_isp_resource_node *custom_rsrc_node = NULL;
+	struct cam_hw_intf *hw_intf = NULL;
+
+	custom_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!custom_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	csid_reset_args.reset_type = CAM_IFE_CSID_RESET_PATH;
+	csid_reset_args.node_res = custom_rsrc_node;
+	hw_intf = custom_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.reset) {
+		CAM_DBG(CAM_CUSTOM, "RESET HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.reset(hw_intf->hw_priv,
+			&csid_reset_args,
+			sizeof(struct cam_csid_reset_cfg_args));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_ERR(CAM_CUSTOM,
+		"RESET HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_hw_mgr_reset(
+	void *hw_mgr_priv, void *hw_reset_args)
+{
+	struct cam_hw_reset_args         *reset_args =
+		hw_reset_args;
+	struct cam_custom_hw_mgr_ctx     *ctx;
+	struct cam_custom_hw_mgr_res     *hw_mgr_res;
+	int                               rc = 0;
+
+	if (!hw_mgr_priv || !hw_reset_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_custom_hw_mgr_ctx *)
+		reset_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Reset SBI CSID and SBI core");
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_reset_csid_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM,
+				"Failed to reset CSID:%d rc: %d",
+				hw_mgr_res->res_id, rc);
+			goto end;
+		}
+	}
+
+	/* Reset SBI HW */
+
+end:
+	return rc;
+}
+
+static int cam_custom_mgr_config_hw(void *hw_mgr_priv,
+	void *hw_config_args)
+{
+	int rc = 0;
+	int i = 0;
+	struct cam_custom_hw_mgr_ctx *custom_ctx;
+	struct cam_custom_hw_mgr_res *res;
+	struct cam_hw_config_args    *cfg;
+	struct cam_hw_intf           *hw_intf = NULL;
+	struct cam_custom_prepare_hw_update_data *prepare_hw_data;
+
+	CAM_DBG(CAM_CUSTOM, "Enter");
+	if (!hw_mgr_priv || !hw_config_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	cfg =
+		(struct cam_hw_config_args *)hw_config_args;
+	custom_ctx = cfg->ctxt_to_hw_map;
+
+	if (!custom_ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context parameters");
+		return -EPERM;
+	}
+
+	prepare_hw_data =
+		(struct cam_custom_prepare_hw_update_data *)
+		cfg->priv;
+	for (i = 0; i < prepare_hw_data->num_cfg; i++) {
+		CAM_DBG(CAM_CUSTOM, "plane %d io_addr %pK",
+			i, prepare_hw_data->io_addr[i]);
+	}
+
+	prepare_hw_data =
+		(struct cam_custom_prepare_hw_update_data *)cfg->priv;
+	for (i = 0; i < prepare_hw_data->num_cfg; i++) {
+		CAM_DBG(CAM_CUSTOM, "plane %d io_addr %p cfg %u", i,
+			prepare_hw_data->io_addr[i],
+			prepare_hw_data->num_cfg);
+		/* this will be ZSLBuffer addr */
+	}
+
+	for (i = 0; i < CAM_CUSTOM_HW_SUB_MOD_MAX; i++) {
+		res = &custom_ctx->sub_hw_list[i];
+		if (res->hw_res) {
+			hw_intf = res->hw_res->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				struct cam_custom_sub_mod_req_to_dev req_to_dev;
+
+				req_to_dev.ctx_idx = custom_ctx->ctx_index;
+				req_to_dev.dev_idx = i;
+				req_to_dev.req_id = cfg->request_id;
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_CUSTOM_SUBMIT_REQ,
+					&req_to_dev, sizeof(req_to_dev));
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_custom_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args        *hw_cmd_args = cmd_args;
+	struct cam_custom_hw_cmd_args *custom_hw_cmd_args;
+	struct cam_custom_hw_mgr_ctx  *custom_ctx = NULL;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	custom_ctx =
+		(struct cam_custom_hw_mgr_ctx *)
+		hw_cmd_args->ctxt_to_hw_map;
+
+	if (!custom_ctx || !custom_ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Fatal: Invalid context is used");
+		return -EPERM;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_INTERNAL:
+		if (!hw_cmd_args->u.internal_args) {
+			CAM_ERR(CAM_CUSTOM, "Invalid cmd arguments");
+			return -EINVAL;
+		}
+
+		custom_hw_cmd_args = (struct cam_custom_hw_cmd_args *)
+					hw_cmd_args->u.internal_args;
+
+		switch (custom_hw_cmd_args->cmd_type) {
+		case CAM_CUSTOM_HW_MGR_PROG_DEFAULT_CONFIG:
+			CAM_DBG(CAM_CUSTOM, "configure RUP and scratch buffer");
+			//use custom_ctx->scratch_buffer_addr
+			break;
+		default:
+			CAM_ERR(CAM_CUSTOM, "Invalid HW mgr command:0x%x",
+				hw_cmd_args->cmd_type);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	default:
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int cam_custom_hw_mgr_init(struct device_node *of_node,
+	struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl)
+{
+	int rc = 0;
+	int i, j;
+	uint32_t num_custom_available, num_custom_functional = 0;
+
+	memset(&g_custom_hw_mgr, 0, sizeof(g_custom_hw_mgr));
+	mutex_init(&g_custom_hw_mgr.ctx_mutex);
+
+	/* fill custom hw intf information */
+	for (i = 0; i < CAM_CUSTOM_HW_SUB_MOD_MAX; i++) {
+		/* Initialize sub modules */
+		rc = cam_custom_hw_sub_mod_init(
+				&g_custom_hw_mgr.custom_hw[i], i);
+		CAM_DBG(CAM_CUSTOM, "sub module initialized. rc:%d", rc);
+	}
+
+	for (i = 0; i < CAM_CUSTOM_CSID_HW_MAX; i++) {
+		/* Initialize csid custom modules */
+		rc = cam_custom_csid_hw_init(
+			&g_custom_hw_mgr.csid_devices[i], i);
+		CAM_DBG(CAM_CUSTOM, "csid custom module initialized. rc:%d", rc);
+	}
+
+	INIT_LIST_HEAD(&g_custom_hw_mgr.free_ctx_list);
+	INIT_LIST_HEAD(&g_custom_hw_mgr.used_ctx_list);
+
+	/*
+	 *  for now, we only support one iommu handle. later
+	 *  we will need to setup more iommu handle for other
+	 *  use cases.
+	 *  Also, we have to release them once we have the
+	 *  deinit support
+	 */
+	if (cam_smmu_get_handle("custom",
+		&g_custom_hw_mgr.img_iommu_hdl)) {
+		CAM_ERR(CAM_CUSTOM, "Can not get iommu handle");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		memset(&g_custom_hw_mgr.ctx_pool[i], 0,
+			sizeof(g_custom_hw_mgr.ctx_pool[i]));
+		INIT_LIST_HEAD(&g_custom_hw_mgr.ctx_pool[i].list);
+
+		/* init context pool */
+		INIT_LIST_HEAD(&g_custom_hw_mgr.ctx_pool[i].free_res_list);
+		INIT_LIST_HEAD(
+			&g_custom_hw_mgr.ctx_pool[i].res_list_custom_csid);
+		INIT_LIST_HEAD(
+			&g_custom_hw_mgr.ctx_pool[i].res_list_custom_cid);
+		for (j = 0; j < CAM_CUSTOM_HW_RES_MAX; j++) {
+			INIT_LIST_HEAD(
+				&g_custom_hw_mgr.ctx_pool[i].res_pool[j].list);
+			list_add_tail(
+				&g_custom_hw_mgr.ctx_pool[i].res_pool[j].list,
+				&g_custom_hw_mgr.ctx_pool[i].free_res_list);
+		}
+
+		g_custom_hw_mgr.ctx_pool[i].ctx_index = i;
+		g_custom_hw_mgr.ctx_pool[i].hw_mgr = &g_custom_hw_mgr;
+
+		list_add_tail(&g_custom_hw_mgr.ctx_pool[i].list,
+			&g_custom_hw_mgr.free_ctx_list);
+	}
+
+	/* fill return structure */
+	hw_mgr_intf->hw_mgr_priv = &g_custom_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_custom_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire = cam_custom_mgr_acquire_hw;
+	hw_mgr_intf->hw_start = cam_custom_mgr_start_hw;
+	hw_mgr_intf->hw_stop = cam_custom_mgr_stop_hw;
+	hw_mgr_intf->hw_read = cam_custom_mgr_read;
+	hw_mgr_intf->hw_write = cam_custom_mgr_write;
+	hw_mgr_intf->hw_release = cam_custom_mgr_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_custom_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config = cam_custom_mgr_config_hw;
+	hw_mgr_intf->hw_reset = cam_custom_hw_mgr_reset;
+	hw_mgr_intf->hw_cmd = cam_custom_mgr_cmd;
+
+	if (iommu_hdl)
+		*iommu_hdl = g_custom_hw_mgr.img_iommu_hdl;
+
+	cam_custom_get_num_hws(&num_custom_available);
+	cam_custom_mgr_count_functional_hws(&num_custom_functional);
+	rc = cam_cpas_prepare_subpart_info(CAM_CUSTOM_HW_IDX, num_custom_available,
+		num_custom_functional);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Failed to populate num_custom, rc: %d", rc);
+
+	CAM_DBG(CAM_CUSTOM, "HW manager initialized");
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.h
@@ -0,0 +1,196 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_HW_MGR_H_
+#define _CAM_CUSTOM_HW_MGR_H_
+
+#include <linux/completion.h>
+#include "cam_custom_hw_mgr_intf.h"
+#include "cam_custom_sub_mod_core.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_custom_hw.h"
+
+#include <media/cam_defs.h>
+#include <media/cam_custom.h>
+
+enum cam_custom_hw_mgr_res_type {
+	CAM_CUSTOM_HW_SUB_MODULE,
+	CAM_CUSTOM_CID_HW,
+	CAM_CUSTOM_CSID_HW,
+	CAM_CUSTOM_HW_MAX,
+};
+
+/* Needs to be suitably defined */
+#define CAM_CUSTOM_HW_OUT_RES_MAX 1
+
+/**
+ * struct cam_custom_hw_mgr_res - HW resources for the Custom manager
+ *
+ * @list:                used by the resource list
+ * @res_type:            Custom manager resource type
+ * @res_id:              resource id based on the resource type for root or
+ *                       leaf resource, it matches the KMD interface port id.
+ *                       For branch resource, it is defined by the Custom HW
+ *                       layer
+ * @rsrc_node:           isp hw layer resource for csid/cid
+ * @hw_res:              hw layer resource array.
+ */
+struct cam_custom_hw_mgr_res {
+	struct list_head                 list;
+	enum cam_custom_hw_mgr_res_type  res_type;
+	uint32_t                         res_id;
+	void                            *rsrc_node;
+	struct cam_custom_resource_node *hw_res;
+};
+
+
+/**
+ * struct ctx_base_info - Base hardware information for the context
+ *
+ * @idx:                  Base resource index
+ *
+ */
+struct ctx_base_info {
+	uint32_t                       idx;
+};
+
+
+/**
+ * struct cam_custom_hw_mgr_ctx - Custom HW manager ctx object
+ *
+ * @list:                   used by the ctx list.
+ * @ctx_index:              acquired context id.
+ * @hw_mgr:                 Custom hw mgr which owns this context
+ * @ctx_in_use:             flag to tell whether context is active
+ * @res_list_custom_csid:   custom csid modules for this context
+ * @res_list_custom_cid:    custom cid modules for this context
+ * @sub_hw_list:            HW submodules for this context
+ * @free_res_list:          Free resources list for the branch node
+ * @res_pool:               memory storage for the free resource list
+ * @base:                   device base index array contain the all
+ *                          Custom HW instance associated with this ctx.
+ * @num_base:               number of valid base data in the base array
+ * @init_done:              indicate whether init hw is done
+ * @event_cb:               event_cb to ctx
+ * @scratch_buffer_addr:    scratch buffer address
+ * @task_type:              Custom HW task type
+ * @cb_priv:                data sent back with event_cb
+ *
+ */
+struct cam_custom_hw_mgr_ctx {
+	struct list_head                list;
+
+	uint32_t                        ctx_index;
+	struct cam_custom_hw_mgr       *hw_mgr;
+	uint32_t                        ctx_in_use;
+
+	struct list_head                res_list_custom_csid;
+	struct list_head                res_list_custom_cid;
+	struct cam_custom_hw_mgr_res    sub_hw_list[
+		CAM_CUSTOM_HW_RES_MAX];
+
+	struct list_head                free_res_list;
+	struct cam_custom_hw_mgr_res    res_pool[CAM_CUSTOM_HW_RES_MAX];
+	struct ctx_base_info            base[CAM_CUSTOM_HW_SUB_MOD_MAX];
+	uint32_t                        num_base;
+	bool                            init_done;
+	cam_hw_event_cb_func            event_cb;
+	uint64_t                        scratch_buffer_addr;
+	enum cam_custom_hw_task_type    task_type;
+	void                           *cb_priv;
+};
+
+/**
+ * struct cam_custom_hw_mgr - Custom HW Manager
+ *
+ * @img_iommu_hdl:         iommu handle
+ * @custom_hw:             Custom device instances array. This will be filled by
+ *                         HW layer during initialization
+ * @csid_devices:          Custom csid device instance array
+ * @ctx_mutex:             mutex for the hw context pool
+ * @free_ctx_list:         free hw context list
+ * @used_ctx_list:         used hw context list
+ * @ctx_pool:              context storage
+ *
+ */
+struct cam_custom_hw_mgr {
+	int                            img_iommu_hdl;
+	struct cam_hw_intf            *custom_hw[CAM_CUSTOM_HW_SUB_MOD_MAX];
+	struct cam_hw_intf            *csid_devices[CAM_CUSTOM_CSID_HW_MAX];
+	struct mutex                   ctx_mutex;
+	struct list_head               free_ctx_list;
+	struct list_head               used_ctx_list;
+	struct cam_custom_hw_mgr_ctx   ctx_pool[CAM_CTX_MAX];
+};
+
+/**
+ * cam_custom_get_num_hws()
+ *
+ * @brief : Populates number of custom.
+ *
+ * @num_custom : Fills number of custom hws in the address passed.
+ *
+ */
+void cam_custom_get_num_hws(uint32_t *num_custom);
+
+/**
+ * cam_custom_hw_mgr_init()
+ *
+ * @brief:              Initialize the Custom hardware manger. This is the
+ *                      etnry functinon for the Cust HW manager.
+ *
+ * @of_node:            Device node
+ * @hw_mgr_intf:        Custom hardware manager object returned
+ * @iommu_hdl:          Iommu handle to be returned
+ *
+ */
+int cam_custom_hw_mgr_init(struct device_node *of_node,
+	struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl);
+
+
+/* Utility APIs */
+
+/**
+ * cam_custom_hw_mgr_get_custom_res_state()
+ *
+ * @brief:              Obtain equivalent custom rsrc state
+ *                      from isp rsrc state
+ *
+ * @in_rsrc_state:      isp rsrc state
+ *
+ */
+enum cam_custom_hw_resource_state
+	cam_custom_hw_mgr_get_custom_res_state(
+	uint32_t in_rsrc_state);
+
+/**
+ * cam_custom_hw_mgr_get_isp_res_state()
+ *
+ * @brief:              Obtain equivalent isp rsrc state
+ *                      from custom rsrc state
+ *
+ * @in_rsrc_state:      custom rsrc state
+ *
+ */
+enum cam_isp_resource_state
+	cam_custom_hw_mgr_get_isp_res_state(
+	uint32_t in_rsrc_state);
+
+/**
+ * cam_custom_hw_mgr_get_isp_res_type()
+ *
+ * @brief:         Obtain equivalent isp rsrc type
+ *                 from custom rsrc type
+ *
+ * @res_type:      custom rsrc type
+ *
+ */
+enum cam_isp_resource_type
+	cam_custom_hw_mgr_get_isp_res_type(
+	enum cam_custom_hw_mgr_res_type res_type);
+
+#endif /* _CAM_CUSTOM_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/include/cam_custom_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/include/cam_custom_hw.h
@@ -0,0 +1,80 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_HW_H_
+#define _CAM_CUSTOM_HW_H_
+
+#include <linux/of.h>
+#include <linux/time.h>
+#include <linux/list.h>
+
+#include <media/cam_custom.h>
+
+enum cam_custom_hw_resource_state {
+	CAM_CUSTOM_HW_RESOURCE_STATE_UNAVAILABLE   = 0,
+	CAM_CUSTOM_HW_RESOURCE_STATE_AVAILABLE     = 1,
+	CAM_CUSTOM_HW_RESOURCE_STATE_RESERVED      = 2,
+	CAM_CUSTOM_HW_RESOURCE_STATE_INIT_HW       = 3,
+	CAM_CUSTOM_HW_RESOURCE_STATE_STREAMING     = 4,
+};
+
+enum cam_custom_hw_task_type {
+	CAM_CUSTOM_EVENT_INVALID,
+	CAM_CUSTOM_EVENT_TASK1,
+	CAM_CUSTOM_EVENT_TASK2,
+	CAM_CUSTOM_EVENT_TASK3,
+	CAM_CUSTOM_EVENT_MAX,
+};
+
+/*
+ * struct cam_custom_hw_event_info:
+ *
+ * @Brief:          Structure to pass event details to hw mgr
+ *
+ * @task_type:      Type of CUSTOM HW Task
+ * @err_type:       Error type if any
+ *
+ */
+struct cam_custom_hw_event_info {
+	enum cam_custom_hw_task_type  task_type;
+	uint32_t                      err_type;
+};
+
+/*
+ * struct cam_custom_resource_node:
+ *
+ * @Brief:                        Structure representing HW resource object
+ *
+ * @res_id:                       Unique resource ID within res_type objects
+ *                                for a particular HW
+ * @res_state:                    State of the resource
+ * @hw_intf:                      HW Interface of HW to which this resource
+ *                                belongs
+ * @res_priv:                     Private data of the resource
+ * @irq_handle:                   handle returned on subscribing for IRQ event
+ * @init:                         function pointer to init the HW resource
+ * @deinit:                       function pointer to deinit the HW resource
+ * @start:                        function pointer to start the HW resource
+ * @stop:                         function pointer to stop the HW resource
+ * @process_cmd:                  function pointer for processing commands
+ *                                specific to the resource
+ */
+struct cam_custom_resource_node {
+	uint32_t                          res_id;
+	enum cam_custom_hw_resource_state res_state;
+	struct cam_hw_intf               *hw_intf;
+	void                             *res_priv;
+	int                               irq_handle;
+
+	int (*init)(struct cam_custom_resource_node *rsrc_node,
+		void *init_args, uint32_t arg_size);
+	int (*deinit)(struct cam_custom_resource_node *rsrc_node,
+		void *deinit_args, uint32_t arg_size);
+	int (*start)(struct cam_custom_resource_node *rsrc_node);
+	int (*stop)(struct cam_custom_resource_node *rsrc_node);
+	int (*process_cmd)(struct cam_custom_resource_node *rsrc_node,
+		uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+};
+#endif /* _CAM_CUSTOM_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/include/cam_custom_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_cust/cam_custom_hw_mgr/include/cam_custom_hw_mgr_intf.h
@@ -0,0 +1,172 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_HW_MGR_INTF_H_
+#define _CAM_CUSTOM_HW_MGR_INTF_H_
+
+#include <linux/of.h>
+#include <linux/time.h>
+#include <linux/list.h>
+#include <media/cam_custom.h>
+#include "cam_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_custom_hw.h"
+
+#define CAM_CUSTOM_HW_TYPE_1   1
+
+#define CAM_CUSTOM_HW_RES_MAX 32
+
+#define CAM_CUSTOM_HW_SUB_MOD_MAX 1
+#define CAM_CUSTOM_CSID_HW_MAX    1
+
+enum cam_custom_hw_event_type {
+	CAM_CUSTOM_HW_EVENT_ERROR,
+	CAM_CUSTOM_HW_EVENT_RUP_DONE,
+	CAM_CUSTOM_HW_EVENT_FRAME_DONE,
+	CAM_CUSTOM_HW_EVENT_MAX
+};
+
+enum cam_custom_cmd_types {
+	CAM_CUSTOM_CMD_NONE,
+	CAM_CUSTOM_SET_IRQ_CB,
+	CAM_CUSTOM_SUBMIT_REQ,
+};
+
+enum cam_custom_hw_mgr_cmd {
+	CAM_CUSTOM_HW_MGR_CMD_NONE,
+	CAM_CUSTOM_HW_MGR_PROG_DEFAULT_CONFIG,
+};
+
+/**
+ * struct cam_custom_hw_cmd_args - Payload for hw manager command
+ *
+ * @cmd_type               HW command type
+ * @reserved               any other required data
+ */
+struct cam_custom_hw_cmd_args {
+	uint32_t                   cmd_type;
+	uint32_t                   reserved;
+};
+
+/**
+ * struct cam_custom_hw_sof_event_data - Event payload for CAM_HW_EVENT_SOF
+ *
+ * @timestamp:   Time stamp for the sof event
+ * @boot_time:   Boot time stamp for the sof event
+ *
+ */
+struct cam_custom_hw_sof_event_data {
+	uint64_t       timestamp;
+	uint64_t       boot_time;
+};
+
+/**
+ * struct cam_custom_hw_reg_update_event_data - Event payload for
+ *                         CAM_HW_EVENT_REG_UPDATE
+ *
+ * @timestamp:     Time stamp for the reg update event
+ *
+ */
+struct cam_custom_hw_reg_update_event_data {
+	uint64_t       timestamp;
+};
+
+/**
+ * struct cam_custom_hw_done_event_data - Event payload for CAM_HW_EVENT_DONE
+ *
+ * @num_handles:           Number of resource handeles
+ * @resource_handle:       Resource handle array
+ *
+ */
+struct cam_custom_hw_done_event_data {
+	uint32_t             num_handles;
+	uint32_t             resource_handle[CAM_NUM_OUT_PER_COMP_IRQ_MAX];
+};
+
+/**
+ * struct cam_custom_hw_error_event_data - Event payload for CAM_HW_EVENT_ERROR
+ *
+ * @error_type:            Error type for the error event
+ * @timestamp:             Timestamp for the error event
+ */
+struct cam_custom_hw_error_event_data {
+	uint32_t             error_type;
+	uint64_t             timestamp;
+};
+
+/**
+ * struct cam_custom_stop_args - hardware stop arguments
+ *
+ * @stop_only                  Send stop only to hw drivers. No Deinit to be
+ *                             done.
+ */
+struct cam_custom_stop_args {
+	bool                          stop_only;
+};
+
+/**
+ * struct cam_custom_start_args - custom hardware start arguments
+ *
+ * @hw_config:                 Hardware configuration commands.
+ * @start_only                 Send start only to hw drivers. No init to
+ *                             be done.
+ *
+ */
+struct cam_custom_start_args {
+	struct cam_hw_config_args     hw_config;
+	bool                          start_only;
+};
+
+/**
+ * struct cam_custom_prepare_hw_update_data - hw prepare data
+ *
+ * @packet_opcode_type:     Packet header opcode in the packet header
+ *                          this opcode defines, packet is init packet or
+ *                          update packet
+ * @buffer_addr:            IO Buffer address
+ *
+ */
+struct cam_custom_prepare_hw_update_data {
+	uint32_t                    packet_opcode_type;
+	uint32_t                    num_cfg;
+	uint64_t                    io_addr[CAM_PACKET_MAX_PLANES];
+};
+
+/**
+ * struct cam_custom_hw_cb_args : HW manager callback args
+ *
+ * @res_type : resource type
+ * @err_type : error type
+ */
+struct cam_custom_hw_cb_args {
+	uint32_t                              res_type;
+	uint32_t                              err_type;
+};
+
+/**
+ * cam_custom_hw_sub_mod_init()
+ *
+ * @Brief:                  Initialize Custom HW device
+ *
+ * @custom_hw:              cust_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of Custom HW
+ */
+int cam_custom_hw_sub_mod_init(struct cam_hw_intf **custom_hw, uint32_t hw_idx);
+
+/**
+ * cam_custom_csid_hw_init()
+ *
+ * @Brief:                  Initialize Custom HW device
+ *
+ * @custom_hw:              cust_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of Custom HW
+ */
+int cam_custom_csid_hw_init(
+	struct cam_hw_intf **custom_hw, uint32_t hw_idx);
+
+#endif /* _CAM_CUSTOM_HW_MGR_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/cam_fd_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/cam_fd_context.c
@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_debug_util.h"
+#include "cam_fd_context.h"
+#include "cam_trace.h"
+
+static const char fd_dev_name[] = "cam-fd";
+
+/* Functions in Available state */
+static int __cam_fd_ctx_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Acquire dev, rc=%d", rc);
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("FD", ctx);
+
+	return rc;
+}
+
+/* Functions in Acquired state */
+static int __cam_fd_ctx_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Release dev, rc=%d", rc);
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_AVAILABLE;
+	trace_cam_context_state("FD", ctx);
+
+	return rc;
+}
+
+static int __cam_fd_ctx_config_dev_in_acquired(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Prepare dev, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __cam_fd_ctx_start_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_start_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Start dev, rc=%d", rc);
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACTIVATED;
+	trace_cam_context_state("FD", ctx);
+
+	return rc;
+}
+
+/* Functions in Activated state */
+static int __cam_fd_ctx_stop_dev_in_activated(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Stop dev, rc=%d", rc);
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("FD", ctx);
+
+	return rc;
+}
+
+static int __cam_fd_ctx_release_dev_in_activated(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = __cam_fd_ctx_stop_dev_in_activated(ctx, NULL);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Stop dev, rc=%d", rc);
+		return rc;
+	}
+
+	rc = __cam_fd_ctx_release_dev_in_acquired(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Release dev, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __cam_fd_ctx_dump_dev_in_activated(
+	struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed to dump device, rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_fd_ctx_flush_dev_in_activated(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_context_utils_flush_args flush_args;
+
+	flush_args.cmd = cmd;
+	flush_args.flush_active_req = true;
+
+	rc = cam_context_flush_dev_to_hw(ctx, &flush_args);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to flush device, rc=%d", rc);
+
+	return rc;
+}
+static int __cam_fd_ctx_config_dev_in_activated(
+	struct cam_context *ctx, struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Prepare dev, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __cam_fd_ctx_handle_irq_in_activated(void *context,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc;
+
+	rc = cam_context_buf_done_from_hw(context, evt_data, evt_id);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in buf done, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_fd_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_fd_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.release_dev = __cam_fd_ctx_release_dev_in_acquired,
+			.config_dev = __cam_fd_ctx_config_dev_in_acquired,
+			.start_dev = __cam_fd_ctx_start_dev_in_acquired,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_fd_ctx_stop_dev_in_activated,
+			.release_dev = __cam_fd_ctx_release_dev_in_activated,
+			.config_dev = __cam_fd_ctx_config_dev_in_activated,
+			.flush_dev = __cam_fd_ctx_flush_dev_in_activated,
+			.dump_dev = __cam_fd_ctx_dump_dev_in_activated,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_fd_ctx_handle_irq_in_activated,
+	},
+};
+
+
+int cam_fd_context_init(struct cam_fd_context *fd_ctx,
+	struct cam_context *base_ctx, struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id, int img_iommu_hdl)
+{
+	int rc;
+
+	if (!base_ctx || !fd_ctx) {
+		CAM_ERR(CAM_FD, "Invalid Context %pK %pK", base_ctx, fd_ctx);
+		return -EINVAL;
+	}
+
+	memset(fd_ctx, 0, sizeof(*fd_ctx));
+
+	rc = cam_context_init(base_ctx, fd_dev_name, CAM_FD, ctx_id,
+		NULL, hw_intf, fd_ctx->req_base, CAM_CTX_REQ_MAX, img_iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Camera Context Base init failed, rc=%d", rc);
+		return rc;
+	}
+
+	fd_ctx->base = base_ctx;
+	base_ctx->ctx_priv = fd_ctx;
+	base_ctx->state_machine = cam_fd_ctx_state_machine;
+	base_ctx->max_hw_update_entries = CAM_CTX_CFG_MAX;
+	base_ctx->max_in_map_entries = CAM_CTX_CFG_MAX;
+	base_ctx->max_out_map_entries = CAM_CTX_CFG_MAX;
+
+	return rc;
+}
+
+int cam_fd_context_deinit(struct cam_fd_context *fd_ctx)
+{
+	int rc = 0;
+
+	if (!fd_ctx || !fd_ctx->base) {
+		CAM_ERR(CAM_FD, "Invalid inputs %pK", fd_ctx);
+		return -EINVAL;
+	}
+
+	rc = cam_context_deinit(fd_ctx->base);
+	if (rc)
+		CAM_ERR(CAM_FD, "Error in base deinit, rc=%d", rc);
+
+	memset(fd_ctx, 0, sizeof(*fd_ctx));
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/cam_fd_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/cam_fd_context.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_CONTEXT_H_
+#define _CAM_FD_CONTEXT_H_
+
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_interface.h"
+
+/**
+ * struct cam_fd_context - Face Detection context information
+ *
+ * @base     : Base context pointer for this FD context
+ * @req_base : List of base requests for this FD context
+ */
+struct cam_fd_context {
+	struct cam_context       *base;
+	struct cam_ctx_request    req_base[CAM_CTX_REQ_MAX];
+};
+
+int cam_fd_context_init(struct cam_fd_context *fd_ctx,
+	struct cam_context *base_ctx, struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id, int img_iommu_hdl);
+int cam_fd_context_deinit(struct cam_fd_context *ctx);
+
+#endif /* _CAM_FD_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/cam_fd_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/cam_fd_dev.c
@@ -0,0 +1,261 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_fd_context.h"
+#include "cam_fd_hw_mgr.h"
+#include "cam_fd_hw_mgr_intf.h"
+#include "camera_main.h"
+
+#define CAM_FD_DEV_NAME "cam-fd"
+
+/**
+ * struct cam_fd_dev - FD device information
+ *
+ * @sd:         Subdev information
+ * @base_ctx:   List of base contexts
+ * @fd_ctx:     List of FD contexts
+ * @lock:       Mutex handle
+ * @open_cnt:   FD subdev open count
+ * @probe_done: Whether FD probe is completed
+ */
+struct cam_fd_dev {
+	struct cam_subdev     sd;
+	struct cam_context    base_ctx[CAM_CTX_MAX];
+	struct cam_fd_context fd_ctx[CAM_CTX_MAX];
+	struct mutex          lock;
+	uint32_t              open_cnt;
+	bool                  probe_done;
+};
+
+static struct cam_fd_dev g_fd_dev;
+
+static int cam_fd_dev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_fd_dev *fd_dev = &g_fd_dev;
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
+	if (!fd_dev->probe_done) {
+		CAM_ERR(CAM_FD, "FD Dev not initialized, fd_dev=%pK", fd_dev);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+		return -ENODEV;
+	}
+
+	mutex_lock(&fd_dev->lock);
+	fd_dev->open_cnt++;
+	CAM_DBG(CAM_FD, "FD Subdev open count %d", fd_dev->open_cnt);
+	mutex_unlock(&fd_dev->lock);
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
+	return 0;
+}
+
+static int cam_fd_dev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_fd_dev *fd_dev = &g_fd_dev;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	if (!fd_dev->probe_done) {
+		CAM_ERR(CAM_FD, "FD Dev not initialized, fd_dev=%pK", fd_dev);
+		return -ENODEV;
+	}
+
+	mutex_lock(&fd_dev->lock);
+	if (fd_dev->open_cnt == 0) {
+		CAM_WARN(CAM_FD, "device already closed");
+		mutex_unlock(&fd_dev->lock);
+		return 0;
+	}
+	fd_dev->open_cnt--;
+	CAM_DBG(CAM_FD, "FD Subdev open count %d", fd_dev->open_cnt);
+	mutex_unlock(&fd_dev->lock);
+
+	if (!node) {
+		CAM_ERR(CAM_FD, "Node ptr is NULL");
+		return -EINVAL;
+	}
+
+	cam_node_shutdown(node);
+
+	return 0;
+}
+
+static int cam_fd_dev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_FD, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_fd_dev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_fd_subdev_internal_ops = {
+	.open = cam_fd_dev_open,
+	.close = cam_fd_dev_close,
+};
+
+static int cam_fd_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+	int i;
+	struct cam_hw_mgr_intf hw_mgr_intf;
+	struct cam_node *node;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	g_fd_dev.sd.internal_ops = &cam_fd_subdev_internal_ops;
+	g_fd_dev.sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	/* Initialize the v4l2 subdevice first. (create cam_node) */
+	rc = cam_subdev_probe(&g_fd_dev.sd, pdev, CAM_FD_DEV_NAME,
+		CAM_FD_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_FD, "FD cam_subdev_probe failed, rc=%d", rc);
+		return rc;
+	}
+	node = (struct cam_node *) g_fd_dev.sd.token;
+
+	rc = cam_fd_hw_mgr_init(pdev->dev.of_node, &hw_mgr_intf);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in initializing FD HW manager, rc=%d",
+			rc);
+		goto unregister_subdev;
+	}
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_fd_context_init(&g_fd_dev.fd_ctx[i],
+			&g_fd_dev.base_ctx[i], &node->hw_mgr_intf, i, -1);
+		if (rc) {
+			CAM_ERR(CAM_FD, "FD context init failed i=%d, rc=%d",
+				i, rc);
+			goto deinit_ctx;
+		}
+	}
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_fd_dev.base_ctx, CAM_CTX_MAX,
+		CAM_FD_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_FD, "FD node init failed, rc=%d", rc);
+		goto deinit_ctx;
+	}
+
+	node->sd_handler = cam_fd_dev_close_internal;
+	mutex_init(&g_fd_dev.lock);
+	cam_subdev_probe(&g_fd_dev.sd, pdev);
+	g_fd_dev.probe_done = true;
+	CAM_DBG(CAM_FD, "Component bound successfully");
+
+	return 0;
+
+deinit_ctx:
+	for (--i; i >= 0; i--) {
+		if (cam_fd_context_deinit(&g_fd_dev.fd_ctx[i]))
+			CAM_ERR(CAM_FD, "FD context %d deinit failed", i);
+	}
+unregister_subdev:
+	if (cam_subdev_remove(&g_fd_dev.sd))
+		CAM_ERR(CAM_FD, "Failed in subdev remove");
+
+	return rc;
+}
+
+static void cam_fd_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i, rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_fd_context_deinit(&g_fd_dev.fd_ctx[i]);
+		if (rc)
+			CAM_ERR(CAM_FD, "FD context %d deinit failed, rc=%d",
+				i, rc);
+	}
+
+	rc = cam_fd_hw_mgr_deinit(pdev->dev.of_node);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed in hw mgr deinit, rc=%d", rc);
+
+	rc = cam_unregister_subdev(&g_fd_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_FD, "Unregister failed, rc=%d", rc);
+
+	rc = cam_subdev_remove(&g_fd_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_FD, "Subdev remove failed, rc=%d", rc);
+
+	mutex_destroy(&g_fd_dev.lock);
+	g_fd_dev.probe_done = false;
+}
+
+const static struct component_ops cam_fd_dev_component_ops = {
+	.bind = cam_fd_dev_component_bind,
+	.unbind = cam_fd_dev_component_unbind,
+};
+
+static int cam_fd_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_FD, "Adding FD dev component");
+	rc = component_add(&pdev->dev, &cam_fd_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_FD, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_fd_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_fd_dev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_fd_dt_match[] = {
+	{
+		.compatible = "qcom,cam-fd"
+	},
+	{}
+};
+
+struct platform_driver cam_fd_driver = {
+	.probe = cam_fd_dev_probe,
+	.remove = cam_fd_dev_remove,
+	.driver = {
+		.name = "cam_fd",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_fd_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_fd_dev_init_module(void)
+{
+	return platform_driver_register(&cam_fd_driver);
+}
+
+void cam_fd_dev_exit_module(void)
+{
+	platform_driver_unregister(&cam_fd_driver);
+}
+
+MODULE_DESCRIPTION("MSM FD driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/cam_fd_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/cam_fd_dev.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_DEV_H_
+#define _CAM_FD_DEV_H_
+
+/**
+ * @brief : API to register FD Dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_fd_dev_init_module(void);
+
+/**
+ * @brief : API to remove FD Dev interface from platform framework.
+ */
+void cam_fd_dev_exit_module(void);
+
+#endif /* _CAM_FD_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
@@ -0,0 +1,2210 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_sync.h>
+
+#include "cam_io_util.h"
+#include "cam_soc_util.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_smmu_api.h"
+#include "cam_packet_util.h"
+#include "cam_fd_context.h"
+#include "cam_fd_hw_intf.h"
+#include "cam_fd_hw_core.h"
+#include "cam_fd_hw_soc.h"
+#include "cam_fd_hw_mgr_intf.h"
+#include "cam_fd_hw_mgr.h"
+#include "cam_trace.h"
+
+static struct cam_fd_hw_mgr g_fd_hw_mgr;
+
+static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet,
+	size_t remain_len)
+{
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	int i, rc;
+
+	if (!packet)
+		return -EINVAL;
+
+	CAM_DBG(CAM_FD, "Packet request=%d, op_code=0x%x, size=%d, flags=%d",
+		packet->header.request_id, packet->header.op_code,
+		packet->header.size, packet->header.flags);
+	CAM_DBG(CAM_FD,
+		"Packet cmdbuf(offset=%d, num=%d) io(offset=%d, num=%d)",
+		packet->cmd_buf_offset, packet->num_cmd_buf,
+		packet->io_configs_offset, packet->num_io_configs);
+	CAM_DBG(CAM_FD,
+		"Packet Patch(offset=%d, num=%d) kmd(offset=%d, num=%d)",
+		packet->patch_offset, packet->num_patches,
+		packet->kmd_cmd_buf_offset, packet->kmd_cmd_buf_index);
+
+	if (cam_packet_util_validate_packet(packet, remain_len)) {
+		CAM_ERR(CAM_FD, "invalid packet:%d %d %d %d %d",
+			packet->kmd_cmd_buf_index,
+			packet->num_cmd_buf, packet->cmd_buf_offset,
+			packet->io_configs_offset, packet->header.size);
+		return -EINVAL;
+	}
+
+	/* All buffers must come through io config, do not support patching */
+	if (packet->num_patches || !packet->num_io_configs || !packet->num_cmd_buf) {
+		CAM_ERR(CAM_FD, "wrong number of cmd/patch info: %u %u",
+			packet->num_cmd_buf, packet->num_patches);
+		return -EINVAL;
+	}
+
+	/* KMD Buf index can never be greater than or equal to num cmd bufs */
+	if (packet->kmd_cmd_buf_index >= packet->num_cmd_buf) {
+		CAM_ERR(CAM_FD, "Invalid kmd index %d (%d)",
+			packet->kmd_cmd_buf_index, packet->num_cmd_buf);
+		return -EINVAL;
+	}
+
+	if ((packet->header.op_code & 0xff) !=
+		CAM_PACKET_OPCODES_FD_FRAME_UPDATE) {
+		CAM_ERR(CAM_FD, "Invalid op_code %u",
+			packet->header.op_code & 0xff);
+		return -EINVAL;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *) ((uint8_t *)&packet->payload_flex +
+		packet->cmd_buf_offset);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+		/*
+		 * We can allow 0 length cmd buffer. This can happen in case
+		 * umd gives an empty cmd buffer as kmd buffer
+		 */
+		if (!cmd_desc[i].length)
+			continue;
+
+		if ((cmd_desc[i].meta_data != CAM_FD_CMD_BUFFER_ID_GENERIC) &&
+			(cmd_desc[i].meta_data != CAM_FD_CMD_BUFFER_ID_CDM)) {
+			CAM_ERR(CAM_FD, "Invalid meta_data [%d] %u", i,
+				cmd_desc[i].meta_data);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_FD,
+			"CmdBuf[%d] hdl=%d, offset=%d, size=%d, len=%d, type=%d, meta_data=%d",
+			i,
+			cmd_desc[i].mem_handle, cmd_desc[i].offset,
+			cmd_desc[i].size, cmd_desc[i].length, cmd_desc[i].type,
+			cmd_desc[i].meta_data);
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc) {
+			CAM_ERR(CAM_FD, "Invalid cmd buffer %d", i);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_fd_mgr_util_put_ctx(
+	struct list_head *src_list,
+	struct cam_fd_hw_mgr_ctx **fd_ctx)
+{
+	int rc = 0;
+	struct cam_fd_hw_mgr_ctx *ctx_ptr = NULL;
+
+	mutex_lock(&g_fd_hw_mgr.ctx_mutex);
+	ctx_ptr = *fd_ctx;
+	if (ctx_ptr)
+		list_add_tail(&ctx_ptr->list, src_list);
+	*fd_ctx = NULL;
+	mutex_unlock(&g_fd_hw_mgr.ctx_mutex);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_get_ctx(
+	struct list_head *src_list,
+	struct cam_fd_hw_mgr_ctx **fd_ctx)
+{
+	int rc = 0;
+	struct cam_fd_hw_mgr_ctx *ctx_ptr = NULL;
+
+	mutex_lock(&g_fd_hw_mgr.ctx_mutex);
+	if (!list_empty(src_list)) {
+		ctx_ptr = list_first_entry(src_list,
+			struct cam_fd_hw_mgr_ctx, list);
+		list_del_init(&ctx_ptr->list);
+	} else {
+		CAM_ERR(CAM_FD, "No more free fd hw mgr ctx");
+		rc = -1;
+	}
+	*fd_ctx = ctx_ptr;
+	mutex_unlock(&g_fd_hw_mgr.ctx_mutex);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_put_frame_req(
+	struct list_head *src_list,
+	struct cam_fd_mgr_frame_request **frame_req, bool free_buffer)
+{
+	int rc = 0;
+	struct cam_fd_mgr_frame_request *req_ptr = NULL;
+
+	mutex_lock(&g_fd_hw_mgr.frame_req_mutex);
+	req_ptr = *frame_req;
+	if (req_ptr) {
+		if (free_buffer)
+			cam_mem_put_cpu_buf(frame_req->hw_update_entries[0]->handle);
+
+		list_del_init(&req_ptr->list);
+		list_add_tail(&req_ptr->list, src_list);
+	}
+	*frame_req = NULL;
+	mutex_unlock(&g_fd_hw_mgr.frame_req_mutex);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_get_frame_req(
+	struct list_head *src_list,
+	struct cam_fd_mgr_frame_request **frame_req)
+{
+	int rc = 0;
+	struct cam_fd_mgr_frame_request *req_ptr = NULL;
+
+	mutex_lock(&g_fd_hw_mgr.frame_req_mutex);
+	if (!list_empty(src_list)) {
+		req_ptr = list_first_entry(src_list,
+			struct cam_fd_mgr_frame_request, list);
+		list_del_init(&req_ptr->list);
+	} else {
+		CAM_DBG(CAM_FD, "Frame req not available");
+		rc = -EPERM;
+	}
+	*frame_req = req_ptr;
+	mutex_unlock(&g_fd_hw_mgr.frame_req_mutex);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_get_device(struct cam_fd_hw_mgr *hw_mgr,
+	struct cam_fd_hw_mgr_ctx *hw_ctx, struct cam_fd_device **hw_device)
+{
+	if (!hw_mgr || !hw_ctx || !hw_device) {
+		CAM_ERR(CAM_FD, "Invalid input %pK %pK %pK", hw_mgr, hw_ctx,
+			hw_device);
+		return -EINVAL;
+	}
+
+	if ((hw_ctx->device_index < 0) ||
+		(hw_ctx->device_index >= CAM_FD_HW_MAX)) {
+		CAM_ERR(CAM_FD, "Invalid device indx %d", hw_ctx->device_index);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_FD, "ctx_index=%u, hw_ctx=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	*hw_device = &hw_mgr->hw_device[hw_ctx->device_index];
+
+	return 0;
+}
+
+static int cam_fd_mgr_util_release_device(struct cam_fd_hw_mgr *hw_mgr,
+	struct cam_fd_hw_mgr_ctx *hw_ctx)
+{
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_release_args hw_release_args;
+	int rc;
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	if (hw_device->hw_intf->hw_ops.release) {
+		hw_release_args.hw_ctx = hw_ctx;
+		hw_release_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+		rc = hw_device->hw_intf->hw_ops.release(
+			hw_device->hw_intf->hw_priv, &hw_release_args,
+			sizeof(hw_release_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW release %d", rc);
+			return rc;
+		}
+	} else {
+		CAM_ERR(CAM_FD, "Invalid release function");
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	hw_device->num_ctxts--;
+
+	if (!hw_device->num_ctxts) {
+		mutex_lock(&hw_device->lock);
+		hw_device->ready_to_process = true;
+		hw_device->req_id = -1;
+		hw_device->cur_hw_ctx = NULL;
+		mutex_unlock(&hw_device->lock);
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	hw_ctx->device_index = -1;
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_select_device(struct cam_fd_hw_mgr *hw_mgr,
+	struct cam_fd_hw_mgr_ctx *hw_ctx,
+	struct cam_fd_acquire_dev_info *fd_acquire_args)
+{
+	int i, rc;
+	struct cam_fd_hw_reserve_args hw_reserve_args;
+	struct cam_fd_device *hw_device = NULL;
+
+	if (!hw_mgr || !hw_ctx || !fd_acquire_args) {
+		CAM_ERR(CAM_FD, "Invalid input %pK %pK %pK", hw_mgr, hw_ctx,
+			fd_acquire_args);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	/* Check if a device is free which can satisfy the requirements */
+	for (i = 0; i < hw_mgr->num_devices; i++) {
+		hw_device = &hw_mgr->hw_device[i];
+		CAM_DBG(CAM_FD,
+			"[%d] : num_ctxts=%d, modes=%d, raw_results=%d",
+			i, hw_device->num_ctxts,
+			hw_device->hw_caps.supported_modes,
+			hw_device->hw_caps.raw_results_available);
+		if ((hw_device->num_ctxts == 0) &&
+			(fd_acquire_args->mode &
+			hw_device->hw_caps.supported_modes) &&
+			(!fd_acquire_args->get_raw_results ||
+			hw_device->hw_caps.raw_results_available)) {
+			CAM_DBG(CAM_FD, "Found dedicated HW Index=%d", i);
+			mutex_lock(&hw_device->lock);
+			hw_device->ready_to_process = true;
+			hw_device->req_id = -1;
+			hw_device->cur_hw_ctx = NULL;
+			mutex_unlock(&hw_device->lock);
+			hw_device->num_ctxts++;
+			break;
+		}
+	}
+
+	/*
+	 * We couldn't find a free HW which meets requirement, now check if
+	 * there is a HW which meets acquire requirements
+	 */
+	if (i == hw_mgr->num_devices) {
+		for (i = 0; i < hw_mgr->num_devices; i++) {
+			hw_device = &hw_mgr->hw_device[i];
+			if ((fd_acquire_args->mode &
+				hw_device->hw_caps.supported_modes) &&
+				(!fd_acquire_args->get_raw_results ||
+				hw_device->hw_caps.raw_results_available)) {
+				hw_device->num_ctxts++;
+				CAM_DBG(CAM_FD,
+					"Found sharing HW Index=%d, num_ctxts=%d",
+					i, hw_device->num_ctxts);
+				break;
+			}
+		}
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	if ((i == hw_mgr->num_devices) || !hw_device) {
+		CAM_ERR(CAM_FD, "Couldn't acquire HW %d %d",
+			fd_acquire_args->mode,
+			fd_acquire_args->get_raw_results);
+		return -EBUSY;
+	}
+
+	CAM_DBG(CAM_FD, "Device index %d selected for this acquire", i);
+
+	/* Check if we can reserve this HW */
+	if (hw_device->hw_intf->hw_ops.reserve) {
+		hw_reserve_args.hw_ctx = hw_ctx;
+		hw_reserve_args.mode = fd_acquire_args->mode;
+		rc = hw_device->hw_intf->hw_ops.reserve(
+			hw_device->hw_intf->hw_priv, &hw_reserve_args,
+			sizeof(hw_reserve_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW reserve %d", rc);
+			return rc;
+		}
+		hw_ctx->ctx_hw_private = hw_reserve_args.ctx_hw_private;
+	} else {
+		CAM_ERR(CAM_FD, "Invalid reserve function");
+		return -EPERM;
+	}
+
+	/* Update required info in hw context */
+	hw_ctx->device_index = i;
+
+	CAM_DBG(CAM_FD, "ctx index=%u, device_index=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	return 0;
+}
+
+static int cam_fd_mgr_util_pdev_get_hw_intf(struct device_node *of_node,
+	int i, struct cam_hw_intf **device_hw_intf)
+{
+	struct device_node *device_node = NULL;
+	struct platform_device *child_pdev = NULL;
+	struct cam_hw_intf *hw_intf = NULL;
+	const char *name = NULL;
+	int rc;
+
+	rc = of_property_read_string_index(of_node, "compat-hw-name", i, &name);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Getting dev object name failed %d %d", i, rc);
+		goto put_node;
+	}
+
+	device_node = of_find_node_by_name(NULL, name);
+	if (!device_node) {
+		CAM_ERR(CAM_FD, "Cannot find node in dtsi %s", name);
+		return -ENODEV;
+	}
+
+	child_pdev = of_find_device_by_node(device_node);
+	if (!child_pdev) {
+		CAM_ERR(CAM_FD, "Failed to find device on bus %s",
+			device_node->name);
+		rc = -ENODEV;
+		goto put_node;
+	}
+
+	hw_intf = (struct cam_hw_intf *)platform_get_drvdata(child_pdev);
+	if (!hw_intf) {
+		CAM_ERR(CAM_FD, "No driver data for child device");
+		rc = -ENODEV;
+		goto put_node;
+	}
+
+	CAM_DBG(CAM_FD, "child type %d index %d child_intf %pK",
+		hw_intf->hw_type, hw_intf->hw_idx, hw_intf);
+
+	if (hw_intf->hw_idx >= CAM_FD_HW_MAX) {
+		CAM_ERR(CAM_FD, "hw_idx invalid %d", hw_intf->hw_idx);
+		rc = -ENODEV;
+		goto put_node;
+	}
+
+	rc = 0;
+	*device_hw_intf = hw_intf;
+
+put_node:
+	of_node_put(device_node);
+
+	return rc;
+}
+
+static int cam_fd_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	struct cam_fd_hw_cmd_prestart_args *prestart_args =
+		(struct cam_fd_hw_cmd_prestart_args *)user_data;
+
+	if (!blob_data || (blob_size == 0)) {
+		CAM_ERR(CAM_FD, "Invalid blob info %pK %u", blob_data,
+			blob_size);
+		return -EINVAL;
+	}
+
+	if (!prestart_args) {
+		CAM_ERR(CAM_FD, "Invalid user data");
+		return -EINVAL;
+	}
+
+	switch (blob_type) {
+	case CAM_FD_BLOB_TYPE_RAW_RESULTS_REQUIRED: {
+		uint32_t *get_raw_results = (uint32_t *)blob_data;
+
+		if (sizeof(uint32_t) != blob_size) {
+			CAM_ERR(CAM_FD, "Invalid blob size %zu %u",
+				sizeof(uint32_t), blob_size);
+			return -EINVAL;
+		}
+
+		prestart_args->get_raw_results = *get_raw_results;
+		break;
+	}
+	case CAM_FD_BLOB_TYPE_SOC_CLOCK_BW_REQUEST: {
+		struct cam_fd_soc_clock_bw_request *clk_req =
+			(struct cam_fd_soc_clock_bw_request *)blob_data;
+
+		if (sizeof(struct cam_fd_soc_clock_bw_request) != blob_size) {
+			CAM_ERR(CAM_FD, "Invalid blob size %zu %u",
+				sizeof(struct cam_fd_soc_clock_bw_request),
+				blob_size);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_FD, "SOC Clk Request clock=%lld, bw=%lld",
+			clk_req->clock_rate, clk_req->bandwidth);
+
+		break;
+	}
+	default:
+		CAM_WARN(CAM_FD, "Unknown blob type %d", blob_type);
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_fd_mgr_util_parse_generic_cmd_buffer(
+	struct cam_fd_hw_mgr_ctx *hw_ctx, struct cam_packet *packet,
+	struct cam_fd_hw_cmd_prestart_args *prestart_args)
+{
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	int i, rc = 0;
+
+	cmd_desc = (struct cam_cmd_buf_desc *) ((uint8_t *)&packet->payload_flex +
+		packet->cmd_buf_offset);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data == CAM_FD_CMD_BUFFER_ID_CDM)
+			continue;
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+			cam_fd_packet_generic_blob_handler, prestart_args);
+		if (rc)
+			CAM_ERR(CAM_FD, "Failed in processing blobs %d", rc);
+
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_get_buf_map_requirement(uint32_t direction,
+	uint32_t resource_type, bool *need_io_map, bool *need_cpu_map)
+{
+	if (!need_io_map || !need_cpu_map) {
+		CAM_ERR(CAM_FD, "Invalid input pointers %pK %pK", need_io_map,
+			need_cpu_map);
+		return -EINVAL;
+	}
+
+	if (direction == CAM_BUF_INPUT) {
+		switch (resource_type) {
+		case CAM_FD_INPUT_PORT_ID_IMAGE:
+			*need_io_map = true;
+			*need_cpu_map = false;
+			break;
+		default:
+			CAM_WARN(CAM_FD, "Invalid port: dir %d, id %d",
+				direction, resource_type);
+			return -EINVAL;
+		}
+	} else if (direction == CAM_BUF_OUTPUT) {
+		switch (resource_type) {
+		case CAM_FD_OUTPUT_PORT_ID_RESULTS:
+			*need_io_map = true;
+			*need_cpu_map = true;
+			break;
+		case CAM_FD_OUTPUT_PORT_ID_RAW_RESULTS:
+			*need_io_map = true;
+			*need_cpu_map = true;
+			break;
+		case CAM_FD_OUTPUT_PORT_ID_WORK_BUFFER:
+			*need_io_map = true;
+			*need_cpu_map = false;
+			break;
+		default:
+			CAM_WARN(CAM_FD, "Invalid port: dir %d, id %d",
+				direction, resource_type);
+			return -EINVAL;
+		}
+	} else {
+		CAM_WARN(CAM_FD, "Invalid direction %d", direction);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_fd_mgr_put_cpu_buf(struct cam_hw_prepare_update_args *prepare)
+{
+	int i, rc;
+	uint32_t plane;
+	bool need_io_map, need_cpu_map;
+	struct cam_buf_io_cfg *io_cfg;
+
+	io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+		&prepare->packet->payload_flex + prepare->packet->io_configs_offset);
+
+	if (!io_cfg)
+		return -EINVAL;
+
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		rc = cam_fd_mgr_util_get_buf_map_requirement(
+			io_cfg[i].direction, io_cfg[i].resource_type,
+			&need_io_map, &need_cpu_map);
+
+		if (rc || !need_cpu_map)
+			continue;
+
+		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++)
+			cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane]);
+	}
+	return 0;
+}
+
+static int cam_fd_mgr_util_prepare_io_buf_info(int32_t iommu_hdl,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_fd_hw_io_buffer *input_buf,
+	struct cam_fd_hw_io_buffer *output_buf, uint32_t io_buf_size)
+{
+	int rc = -EINVAL;
+	uint32_t plane, num_out_buf, num_in_buf;
+	int i, j;
+	struct cam_buf_io_cfg *io_cfg;
+	dma_addr_t io_addr[CAM_PACKET_MAX_PLANES];
+	uintptr_t cpu_addr[CAM_PACKET_MAX_PLANES];
+	size_t size;
+	bool need_io_map, need_cpu_map;
+
+	/* Get IO Buf information */
+	num_out_buf = 0;
+	num_in_buf  = 0;
+	io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+		&prepare->packet->payload_flex + prepare->packet->io_configs_offset);
+
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		CAM_DBG(CAM_FD,
+			"IOConfig[%d] : handle[%d] Dir[%d] Res[%d] Fence[%d], Format[%d]",
+			i, io_cfg[i].mem_handle[0], io_cfg[i].direction,
+			io_cfg[i].resource_type,
+			io_cfg[i].fence, io_cfg[i].format);
+
+		if ((num_in_buf >= io_buf_size) ||
+			(num_out_buf >= io_buf_size)) {
+			CAM_ERR(CAM_FD, "Invalid number of buffers %d %d %d",
+				num_in_buf, num_out_buf, io_buf_size);
+			return -EINVAL;
+		}
+
+		rc = cam_fd_mgr_util_get_buf_map_requirement(
+			io_cfg[i].direction, io_cfg[i].resource_type,
+			&need_io_map, &need_cpu_map);
+		if (rc) {
+			CAM_WARN(CAM_FD, "Invalid io buff [%d] : %d %d %d",
+				i, io_cfg[i].direction,
+				io_cfg[i].resource_type, rc);
+			continue;
+		}
+
+		memset(io_addr, 0x0, sizeof(io_addr));
+		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {
+			if (!io_cfg[i].mem_handle[plane])
+				break;
+
+			io_addr[plane] = 0x0;
+			cpu_addr[plane] = 0x0;
+
+			if (need_io_map) {
+				rc = cam_mem_get_io_buf(
+					io_cfg[i].mem_handle[plane],
+					iommu_hdl, &io_addr[plane], &size, NULL,
+					prepare->buf_tracker);
+				if (rc) {
+					CAM_ERR(CAM_FD,
+						"Failed to get io buf %u %u %u %d",
+						io_cfg[i].direction,
+						io_cfg[i].resource_type, plane,
+						rc);
+					return -ENOMEM;
+				}
+
+				if (io_cfg[i].offsets[plane] >= size) {
+					CAM_ERR(CAM_FD,
+						"Invalid io buf %u %u %u %d %u %zu",
+						io_cfg[i].direction,
+						io_cfg[i].resource_type, plane,
+						i, io_cfg[i].offsets[plane],
+						size);
+					return -EINVAL;
+				}
+
+				io_addr[plane] += io_cfg[i].offsets[plane];
+			}
+
+			if (need_cpu_map) {
+				rc = cam_mem_get_cpu_buf(
+					io_cfg[i].mem_handle[plane],
+					&cpu_addr[plane], &size);
+				if (rc || ((io_addr[plane] & 0xFFFFFFFF)
+					!= io_addr[plane])) {
+					rc = -ENOSPC;
+					CAM_ERR(CAM_FD,
+						"Invalid cpu buf %d %d %d %d",
+						io_cfg[i].direction,
+						io_cfg[i].resource_type, plane,
+						rc);
+					return rc;
+				}
+				if (io_cfg[i].offsets[plane] >= size) {
+					CAM_ERR(CAM_FD,
+						"Invalid cpu buf %d %d %d",
+						io_cfg[i].direction,
+						io_cfg[i].resource_type, plane);
+					cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane]);
+					rc = -EINVAL;
+					return rc;
+				}
+				cpu_addr[plane] += io_cfg[i].offsets[plane];
+			}
+
+			CAM_DBG(CAM_FD, "IO Address[%d][%d] : %pK, %pK",
+				io_cfg[i].direction, plane, io_addr[plane],
+				cpu_addr[plane]);
+		}
+
+		switch (io_cfg[i].direction) {
+		case CAM_BUF_INPUT: {
+			prepare->in_map_entries[num_in_buf].resource_handle =
+				io_cfg[i].resource_type;
+			prepare->in_map_entries[num_in_buf].sync_id =
+				io_cfg[i].fence;
+
+			input_buf[num_in_buf].valid = true;
+			for (j = 0; j < plane; j++) {
+				input_buf[num_in_buf].io_addr[j] = io_addr[j];
+				input_buf[num_in_buf].cpu_addr[j] = cpu_addr[j];
+			}
+			input_buf[num_in_buf].num_buf = plane;
+			input_buf[num_in_buf].io_cfg = &io_cfg[i];
+
+			num_in_buf++;
+			break;
+		}
+		case CAM_BUF_OUTPUT: {
+			prepare->out_map_entries[num_out_buf].resource_handle =
+				io_cfg[i].resource_type;
+			prepare->out_map_entries[num_out_buf].sync_id =
+				io_cfg[i].fence;
+
+			output_buf[num_out_buf].valid = true;
+			for (j = 0; j < plane; j++) {
+				output_buf[num_out_buf].io_addr[j] = io_addr[j];
+				output_buf[num_out_buf].cpu_addr[j] =
+					cpu_addr[j];
+			}
+			output_buf[num_out_buf].num_buf = plane;
+			output_buf[num_out_buf].io_cfg = &io_cfg[i];
+
+			num_out_buf++;
+			break;
+		}
+		default:
+			CAM_ERR(CAM_FD, "Unsupported io direction %d",
+				io_cfg[i].direction);
+			rc = -EINVAL;
+			break;
+		}
+	}
+
+	prepare->num_in_map_entries  = num_in_buf;
+	prepare->num_out_map_entries = num_out_buf;
+	return rc;
+}
+
+static int cam_fd_mgr_util_prepare_hw_update_entries(
+	struct cam_fd_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_fd_hw_cmd_prestart_args *prestart_args,
+	struct cam_kmd_buf_info *kmd_buf_info)
+{
+	int i, rc;
+	struct cam_hw_update_entry *hw_entry;
+	uint32_t num_ent;
+	struct cam_fd_hw_mgr_ctx *hw_ctx =
+		(struct cam_fd_hw_mgr_ctx *)prepare->ctxt_to_hw_map;
+	struct cam_fd_device *hw_device;
+	uint32_t kmd_buf_max_size, kmd_buf_used_bytes = 0;
+	uint32_t *kmd_buf_addr;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	kmd_buf_addr = (uint32_t *)((uint8_t *)kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes);
+	kmd_buf_max_size = kmd_buf_info->size - kmd_buf_info->used_bytes;
+
+	prestart_args->cmd_buf_addr = kmd_buf_addr;
+	prestart_args->size  = kmd_buf_max_size;
+	prestart_args->pre_config_buf_size = 0;
+	prestart_args->post_config_buf_size = 0;
+
+	if (hw_device->hw_intf->hw_ops.process_cmd) {
+		rc = hw_device->hw_intf->hw_ops.process_cmd(
+			hw_device->hw_intf->hw_priv, CAM_FD_HW_CMD_PRESTART,
+			prestart_args,
+			sizeof(struct cam_fd_hw_cmd_prestart_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in CMD_PRESTART %d", rc);
+			return rc;
+		}
+	}
+
+	kmd_buf_used_bytes += prestart_args->pre_config_buf_size;
+	kmd_buf_used_bytes += prestart_args->post_config_buf_size;
+
+	/* HW layer is expected to add commands */
+	if (!kmd_buf_used_bytes || (kmd_buf_used_bytes > kmd_buf_max_size)) {
+		CAM_ERR(CAM_FD, "Invalid kmd used bytes %d (%d)",
+			kmd_buf_used_bytes, kmd_buf_max_size);
+		return -ENOMEM;
+	}
+
+	hw_entry = prepare->hw_update_entries;
+	num_ent = 0;
+
+	if (prestart_args->pre_config_buf_size) {
+		if ((num_ent + 1) >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_FD, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		hw_entry[num_ent].handle = kmd_buf_info->handle;
+		hw_entry[num_ent].len  = prestart_args->pre_config_buf_size;
+		hw_entry[num_ent].offset = kmd_buf_info->offset;
+
+		kmd_buf_info->used_bytes += prestart_args->pre_config_buf_size;
+		kmd_buf_info->offset += prestart_args->pre_config_buf_size;
+		num_ent++;
+	}
+
+	/*
+	 * set the cmd_desc to point the first command descriptor in the
+	 * packet and update hw entries with CDM command buffers
+	 */
+	cmd_desc = (struct cam_cmd_buf_desc *)((uint8_t *)
+		&prepare->packet->payload_flex + prepare->packet->cmd_buf_offset);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data != CAM_FD_CMD_BUFFER_ID_CDM)
+			continue;
+
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_FD, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+		hw_entry[num_ent].len = cmd_desc[i].length;
+		hw_entry[num_ent].offset = cmd_desc[i].offset;
+		num_ent++;
+	}
+
+	if (prestart_args->post_config_buf_size) {
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_FD, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		hw_entry[num_ent].handle = kmd_buf_info->handle;
+		hw_entry[num_ent].len    = prestart_args->post_config_buf_size;
+		hw_entry[num_ent].offset = kmd_buf_info->offset;
+
+		kmd_buf_info->used_bytes += prestart_args->post_config_buf_size;
+		kmd_buf_info->offset     += prestart_args->post_config_buf_size;
+
+		num_ent++;
+	}
+
+	prepare->num_hw_update_entries = num_ent;
+
+	CAM_DBG(CAM_FD, "FinalConfig : hw_entries=%d, Sync(in=%d, out=%d)",
+		prepare->num_hw_update_entries, prepare->num_in_map_entries,
+		prepare->num_out_map_entries);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_submit_frame(void *priv, void *data)
+{
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_mgr *hw_mgr;
+	struct cam_fd_mgr_frame_request *frame_req;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_hw_cmd_start_args start_args;
+	int rc;
+
+	if (!priv) {
+		CAM_ERR(CAM_FD, "Invalid data");
+		return -EINVAL;
+	}
+
+	hw_mgr = (struct cam_fd_hw_mgr *)priv;
+	mutex_lock(&hw_mgr->frame_req_mutex);
+
+	/* Check if we have any frames pending in high priority list */
+	if (!list_empty(&hw_mgr->frame_pending_list_high)) {
+		CAM_DBG(CAM_FD, "Pending frames in high priority list");
+		frame_req = list_first_entry(&hw_mgr->frame_pending_list_high,
+			struct cam_fd_mgr_frame_request, list);
+	} else if (!list_empty(&hw_mgr->frame_pending_list_normal)) {
+		CAM_DBG(CAM_FD, "Pending frames in normal priority list");
+		frame_req = list_first_entry(&hw_mgr->frame_pending_list_normal,
+			struct cam_fd_mgr_frame_request, list);
+	} else {
+		mutex_unlock(&hw_mgr->frame_req_mutex);
+		CAM_DBG(CAM_FD, "No pending frames");
+		return 0;
+	}
+
+	CAM_DBG(CAM_FD, "FrameSubmit : Frame[%lld]", frame_req->request_id);
+	hw_ctx = frame_req->hw_ctx;
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		mutex_unlock(&hw_mgr->frame_req_mutex);
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&hw_device->lock);
+	if (hw_device->ready_to_process == false) {
+		if (hw_mgr->num_pending_frames > 6) {
+			CAM_WARN(CAM_FD,
+				"Device busy for longer time with cur_hw_ctx=%pK, ReqId=%lld",
+				hw_device->cur_hw_ctx, hw_device->req_id);
+		}
+		mutex_unlock(&hw_device->lock);
+		mutex_unlock(&hw_mgr->frame_req_mutex);
+		return -EBUSY;
+	}
+
+	trace_cam_submit_to_hw("FD", frame_req->request_id);
+
+	list_del_init(&frame_req->list);
+	hw_mgr->num_pending_frames--;
+	list_add_tail(&frame_req->list, &hw_mgr->frame_processing_list);
+
+	if (hw_device->hw_intf->hw_ops.start) {
+		start_args.hw_ctx = hw_ctx;
+		start_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+		start_args.hw_req_private = &frame_req->hw_req_private;
+		start_args.hw_update_entries = frame_req->hw_update_entries;
+		start_args.num_hw_update_entries =
+			frame_req->num_hw_update_entries;
+
+		rc = hw_device->hw_intf->hw_ops.start(
+			hw_device->hw_intf->hw_priv, &start_args,
+			sizeof(start_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW Start %d", rc);
+			list_del_init(&frame_req->list);
+			mutex_unlock(&hw_device->lock);
+			mutex_unlock(&hw_mgr->frame_req_mutex);
+			goto put_req_into_free_list;
+		}
+	} else {
+		CAM_ERR(CAM_FD, "Invalid hw_ops.start");
+		list_del_init(&frame_req->list);
+		mutex_unlock(&hw_device->lock);
+		mutex_unlock(&hw_mgr->frame_req_mutex);
+		rc = -EPERM;
+		goto put_req_into_free_list;
+	}
+
+	hw_device->ready_to_process = false;
+	hw_device->cur_hw_ctx = hw_ctx;
+	hw_device->req_id = frame_req->request_id;
+	mutex_unlock(&hw_device->lock);
+	mutex_unlock(&hw_mgr->frame_req_mutex);
+
+	return rc;
+put_req_into_free_list:
+	cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list, &frame_req, true);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_schedule_frame_worker_task(
+	struct cam_fd_hw_mgr *hw_mgr)
+{
+	int32_t rc = 0;
+	struct crm_workq_task *task;
+	struct cam_fd_mgr_work_data *work_data;
+
+	task = cam_req_mgr_workq_get_task(hw_mgr->work);
+	if (!task) {
+		CAM_ERR(CAM_FD, "no empty task available");
+		return -ENOMEM;
+	}
+
+	work_data = (struct cam_fd_mgr_work_data *)task->payload;
+	work_data->type = CAM_FD_WORK_FRAME;
+
+	task->process_cb = cam_fd_mgr_util_submit_frame;
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr, CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int32_t cam_fd_mgr_workq_irq_cb(void *priv, void *data)
+{
+	struct cam_fd_device *hw_device = NULL;
+	struct cam_fd_hw_mgr *hw_mgr;
+	struct cam_fd_mgr_work_data *work_data;
+	struct cam_fd_mgr_frame_request *frame_req = NULL;
+	enum cam_fd_hw_irq_type irq_type;
+	uint32_t evt_id = CAM_CTX_EVT_ID_ERROR;
+	int rc;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_FD, "Invalid data %pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	hw_mgr = (struct cam_fd_hw_mgr *)priv;
+	work_data = (struct cam_fd_mgr_work_data *)data;
+	irq_type = work_data->irq_type;
+
+	CAM_DBG(CAM_FD, "FD IRQ type=%d", irq_type);
+
+	if (irq_type == CAM_FD_IRQ_HALT_DONE) {
+		/* HALT would be followed by a RESET, ignore this */
+		CAM_DBG(CAM_FD, "HALT IRQ callback");
+		return 0;
+	}
+
+	/* Get the frame from processing list */
+	rc = cam_fd_mgr_util_get_frame_req(&hw_mgr->frame_processing_list,
+		&frame_req);
+	if (rc || !frame_req) {
+		/*
+		 * This can happen if reset is triggered while no frames
+		 * were pending, so not an error, just continue to check if
+		 * there are any pending frames and submit
+		 */
+		CAM_DBG(CAM_FD, "No Frame in processing list, rc=%d", rc);
+		goto submit_next_frame;
+	}
+
+	if (!frame_req->hw_ctx) {
+		CAM_ERR(CAM_FD, "Invalid Frame request %lld",
+			frame_req->request_id);
+		goto put_req_in_free_list;
+	}
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, frame_req->hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		goto put_req_in_free_list;
+	}
+
+	/* Read frame results first */
+	if (irq_type == CAM_FD_IRQ_FRAME_DONE) {
+		struct cam_fd_hw_frame_done_args frame_done_args;
+
+		CAM_DBG(CAM_FD, "FrameDone : Frame[%lld]",
+			frame_req->request_id);
+
+		frame_done_args.hw_ctx = frame_req->hw_ctx;
+		frame_done_args.ctx_hw_private =
+			frame_req->hw_ctx->ctx_hw_private;
+		frame_done_args.request_id = frame_req->request_id;
+		frame_done_args.hw_req_private = &frame_req->hw_req_private;
+
+		if (hw_device->hw_intf->hw_ops.process_cmd) {
+			rc = hw_device->hw_intf->hw_ops.process_cmd(
+				hw_device->hw_intf->hw_priv,
+				CAM_FD_HW_CMD_FRAME_DONE,
+				&frame_done_args, sizeof(frame_done_args));
+			if (rc) {
+				CAM_ERR(CAM_FD, "Failed in CMD_PRESTART %d",
+					rc);
+				goto notify_context;
+			}
+		}
+
+		evt_id = CAM_CTX_EVT_ID_SUCCESS;
+	}
+
+	trace_cam_irq_handled("FD", irq_type);
+
+notify_context:
+	/* Do a callback to inform frame done or stop done */
+	if (frame_req->hw_ctx->event_cb) {
+		struct cam_hw_done_event_data buf_data;
+
+		CAM_DBG(CAM_FD, "FrameHALT : Frame[%lld]",
+			frame_req->request_id);
+
+		buf_data.num_handles = frame_req->num_hw_update_entries;
+		buf_data.request_id = frame_req->request_id;
+		buf_data.evt_param = (irq_type == CAM_FD_IRQ_FRAME_DONE) ?
+			CAM_SYNC_FD_EVENT_IRQ_FRAME_DONE :
+			CAM_SYNC_FD_EVENT_IRQ_RESET_DONE;
+
+		rc = frame_req->hw_ctx->event_cb(frame_req->hw_ctx->cb_priv,
+			evt_id, &buf_data);
+		if (rc)
+			CAM_ERR(CAM_FD, "Error in event cb handling %d", rc);
+	}
+
+	/*
+	 * Now we can set hw device is free to process further frames.
+	 * Note - Do not change state to IDLE until we read the frame results,
+	 * Otherwise, other thread may schedule frame processing before
+	 * reading current frame's results. Also, we need to set to IDLE state
+	 * in case some error happens after getting this irq callback
+	 */
+	mutex_lock(&hw_device->lock);
+	hw_device->ready_to_process = true;
+	hw_device->req_id = -1;
+	hw_device->cur_hw_ctx = NULL;
+	CAM_DBG(CAM_FD, "ready_to_process=%d", hw_device->ready_to_process);
+	mutex_unlock(&hw_device->lock);
+
+put_req_in_free_list:
+	rc = cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+		&frame_req, true);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in putting frame req in free list");
+		/* continue */
+	}
+
+submit_next_frame:
+	/* Check if there are any frames pending for processing and submit */
+	rc = cam_fd_mgr_util_submit_frame(hw_mgr, NULL);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error while submit frame, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_irq_cb(void *data, enum cam_fd_hw_irq_type irq_type)
+{
+	struct cam_fd_hw_mgr *hw_mgr = &g_fd_hw_mgr;
+	int rc = 0;
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct cam_fd_mgr_work_data *work_data;
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_slock, flags);
+	task = cam_req_mgr_workq_get_task(hw_mgr->work);
+	if (!task) {
+		CAM_ERR(CAM_FD, "no empty task available");
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_slock, flags);
+		return -ENOMEM;
+	}
+
+	work_data = (struct cam_fd_mgr_work_data *)task->payload;
+	work_data->type = CAM_FD_WORK_IRQ;
+	work_data->irq_type = irq_type;
+
+	task->process_cb = cam_fd_mgr_workq_irq_cb;
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr, CRM_TASK_PRIORITY_0);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed in enqueue work task, rc=%d", rc);
+
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_slock, flags);
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_get_caps(void *hw_mgr_priv, void *hw_get_caps_args)
+{
+	int rc = 0;
+	struct cam_fd_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd *query = hw_get_caps_args;
+	struct cam_fd_query_cap_cmd query_fd;
+	void __user *caps_handle =
+		u64_to_user_ptr(query->caps_handle);
+
+	if (sizeof(struct cam_fd_query_cap_cmd) != query->size) {
+		CAM_ERR(CAM_FD,
+			"Input query cap size:%u does not match expected query cap size: %u",
+			query->size, sizeof(struct cam_fd_query_cap_cmd));
+		return -EFAULT;
+	}
+
+	if (copy_from_user(&query_fd, caps_handle,
+		sizeof(struct cam_fd_query_cap_cmd))) {
+		CAM_ERR(CAM_FD, "Failed in copy from user, rc=%d", rc);
+		return -EFAULT;
+	}
+
+	query_fd  = hw_mgr->fd_caps;
+
+	CAM_DBG(CAM_FD,
+		"IOMMU device(%d, %d), CDM(%d, %d), versions %d.%d, %d.%d",
+		query_fd.device_iommu.secure, query_fd.device_iommu.non_secure,
+		query_fd.cdm_iommu.secure, query_fd.cdm_iommu.non_secure,
+		query_fd.hw_caps.core_version.major,
+		query_fd.hw_caps.core_version.minor,
+		query_fd.hw_caps.wrapper_version.major,
+		query_fd.hw_caps.wrapper_version.minor);
+
+	if (copy_to_user(caps_handle, &query_fd,
+		sizeof(struct cam_fd_query_cap_cmd)))
+		rc = -EFAULT;
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_acquire(void *hw_mgr_priv, void *hw_acquire_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args =
+		(struct cam_hw_acquire_args *)hw_acquire_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_acquire_dev_info fd_acquire_args;
+	int rc;
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_FD, "Invalid acquire args %pK", acquire_args);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&fd_acquire_args,
+		(void __user *)acquire_args->acquire_info,
+		sizeof(struct cam_fd_acquire_dev_info))) {
+		CAM_ERR(CAM_FD, "Copy from user failed");
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_FD, "Acquire : mode=%d, get_raw_results=%d, priority=%d",
+		fd_acquire_args.mode, fd_acquire_args.get_raw_results,
+		fd_acquire_args.priority);
+
+	/* get a free fd hw mgr ctx */
+	rc = cam_fd_mgr_util_get_ctx(&hw_mgr->free_ctx_list, &hw_ctx);
+	if (rc || !hw_ctx) {
+		CAM_ERR(CAM_FD, "Get hw context failed, rc=%d, hw_ctx=%pK",
+			rc, hw_ctx);
+		return -EINVAL;
+	}
+
+	if (fd_acquire_args.get_raw_results && !hw_mgr->raw_results_available) {
+		CAM_ERR(CAM_FD, "HW cannot support raw results %d (%d)",
+			fd_acquire_args.get_raw_results,
+			hw_mgr->raw_results_available);
+		goto put_ctx;
+	}
+
+	if (!(fd_acquire_args.mode & hw_mgr->supported_modes)) {
+		CAM_ERR(CAM_FD, "HW cannot support requested mode 0x%x (0x%x)",
+			fd_acquire_args.mode, hw_mgr->supported_modes);
+		rc = -EPERM;
+		goto put_ctx;
+	}
+
+	rc = cam_fd_mgr_util_select_device(hw_mgr, hw_ctx, &fd_acquire_args);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in selecting device, rc=%d", rc);
+		goto put_ctx;
+	}
+
+	hw_ctx->ctx_in_use = true;
+	hw_ctx->hw_mgr = hw_mgr;
+	hw_ctx->get_raw_results = fd_acquire_args.get_raw_results;
+	hw_ctx->mode = fd_acquire_args.mode;
+
+	/* Save incoming cam core info into hw ctx*/
+	hw_ctx->cb_priv = acquire_args->context_data;
+	hw_ctx->event_cb = acquire_args->event_cb;
+
+	/* Update out args */
+	acquire_args->ctxt_to_hw_map = hw_ctx;
+
+	cam_fd_mgr_util_put_ctx(&hw_mgr->used_ctx_list, &hw_ctx);
+
+	return 0;
+put_ctx:
+	list_del_init(&hw_ctx->list);
+	cam_fd_mgr_util_put_ctx(&hw_mgr->free_ctx_list, &hw_ctx);
+	return rc;
+}
+
+static int cam_fd_mgr_hw_release(void *hw_mgr_priv, void *hw_release_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_release_args *release_args = hw_release_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	int rc;
+
+	if (!hw_mgr_priv || !hw_release_args) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK, %pK",
+			hw_mgr_priv, hw_release_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)release_args->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+
+	rc = cam_fd_mgr_util_release_device(hw_mgr, hw_ctx);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed in release device, rc=%d", rc);
+
+	hw_ctx->ctx_in_use = false;
+	list_del_init(&hw_ctx->list);
+	cam_fd_mgr_util_put_ctx(&hw_mgr->free_ctx_list, &hw_ctx);
+
+	return 0;
+}
+
+static int cam_fd_mgr_hw_start(void *hw_mgr_priv, void *mgr_start_args)
+{
+	int rc = 0;
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_start_args *hw_mgr_start_args =
+		(struct cam_hw_start_args *)mgr_start_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_init_args hw_init_args;
+	struct cam_hw_info *fd_hw;
+	struct cam_fd_core *fd_core;
+
+	if (!hw_mgr_priv || !hw_mgr_start_args) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK",
+			hw_mgr_priv, hw_mgr_start_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)hw_mgr_start_args->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_FD, "ctx index=%u, device_index=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	fd_hw = (struct cam_hw_info *)hw_device->hw_intf->hw_priv;
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+
+	if (hw_device->hw_intf->hw_ops.init) {
+		hw_init_args.hw_ctx = hw_ctx;
+		hw_init_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+		hw_init_args.is_hw_reset = false;
+		if (fd_core->hw_static_info->enable_errata_wa.skip_reset)
+			hw_init_args.reset_required = false;
+		else
+			hw_init_args.reset_required = true;
+
+		rc = hw_device->hw_intf->hw_ops.init(
+			hw_device->hw_intf->hw_priv, &hw_init_args,
+			sizeof(hw_init_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW Init %d", rc);
+			return rc;
+		}
+
+		if (hw_init_args.is_hw_reset) {
+			mutex_lock(&hw_device->lock);
+			hw_device->ready_to_process = true;
+			hw_device->req_id = -1;
+			hw_device->cur_hw_ctx = NULL;
+			mutex_unlock(&hw_device->lock);
+		}
+	} else {
+		CAM_ERR(CAM_FD, "Invalid init function");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_flush_req(void *hw_mgr_priv,
+	struct cam_hw_flush_args *flush_args)
+{
+	int rc = 0;
+	struct cam_fd_mgr_frame_request *frame_req, *req_temp, *flush_req;
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_stop_args hw_stop_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	uint32_t i = 0;
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)flush_args->ctxt_to_hw_map;
+
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+	CAM_DBG(CAM_FD, "ctx index=%u, hw_ctx=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&hw_mgr->frame_req_mutex);
+	for (i = 0; i < flush_args->num_req_active; i++) {
+		flush_req = (struct cam_fd_mgr_frame_request *)
+			flush_args->flush_req_active[i];
+
+		list_for_each_entry_safe(frame_req, req_temp,
+			&hw_mgr->frame_pending_list_high, list) {
+			if (frame_req->hw_ctx != hw_ctx)
+				continue;
+
+			if (frame_req->request_id != flush_req->request_id)
+				continue;
+
+			hw_mgr->num_pending_frames--;
+			list_del_init(&frame_req->list);
+			break;
+		}
+
+		list_for_each_entry_safe(frame_req, req_temp,
+			&hw_mgr->frame_pending_list_normal, list) {
+			if (frame_req->hw_ctx != hw_ctx)
+				continue;
+
+			if (frame_req->request_id != flush_req->request_id)
+				continue;
+
+			hw_mgr->num_pending_frames--;
+			list_del_init(&frame_req->list);
+			break;
+		}
+
+		list_for_each_entry_safe(frame_req, req_temp,
+			&hw_mgr->frame_processing_list, list) {
+			if (frame_req->hw_ctx != hw_ctx)
+				continue;
+
+			if (frame_req->request_id != flush_req->request_id)
+				continue;
+
+			list_del_init(&frame_req->list);
+
+			mutex_lock(&hw_device->lock);
+			if ((hw_device->ready_to_process == true) ||
+				(hw_device->cur_hw_ctx != hw_ctx))
+				goto unlock_dev_flush_req;
+
+			if (hw_device->hw_intf->hw_ops.stop) {
+				hw_stop_args.hw_ctx = hw_ctx;
+				rc = hw_device->hw_intf->hw_ops.stop(
+					hw_device->hw_intf->hw_priv,
+					&hw_stop_args,
+					sizeof(hw_stop_args));
+				if (rc) {
+					CAM_ERR(CAM_FD,
+						"Failed in HW Stop %d", rc);
+					goto unlock_dev_flush_req;
+				}
+				hw_device->ready_to_process = true;
+			}
+
+unlock_dev_flush_req:
+			mutex_unlock(&hw_device->lock);
+			break;
+		}
+	}
+	mutex_unlock(&hw_mgr->frame_req_mutex);
+
+	for (i = 0; i < flush_args->num_req_pending; i++) {
+		flush_req = (struct cam_fd_mgr_frame_request *)
+			flush_args->flush_req_pending[i];
+		cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+			&flush_req, true);
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_flush_ctx(void *hw_mgr_priv,
+	struct cam_hw_flush_args *flush_args)
+{
+	int rc = 0;
+	struct cam_fd_mgr_frame_request *frame_req, *req_temp, *flush_req;
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_stop_args hw_stop_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	uint32_t i = 0;
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)flush_args->ctxt_to_hw_map;
+
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+	CAM_DBG(CAM_FD, "ctx index=%u, hw_ctx=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&hw_mgr->frame_req_mutex);
+	list_for_each_entry_safe(frame_req, req_temp,
+		&hw_mgr->frame_pending_list_high, list) {
+		if (frame_req->hw_ctx != hw_ctx)
+			continue;
+
+		hw_mgr->num_pending_frames--;
+		list_del_init(&frame_req->list);
+	}
+
+	list_for_each_entry_safe(frame_req, req_temp,
+		&hw_mgr->frame_pending_list_normal, list) {
+		if (frame_req->hw_ctx != hw_ctx)
+			continue;
+
+		hw_mgr->num_pending_frames--;
+		list_del_init(&frame_req->list);
+	}
+
+	list_for_each_entry_safe(frame_req, req_temp,
+		&hw_mgr->frame_processing_list, list) {
+		if (frame_req->hw_ctx != hw_ctx)
+			continue;
+
+		list_del_init(&frame_req->list);
+		mutex_lock(&hw_device->lock);
+		if ((hw_device->ready_to_process == true) ||
+			(hw_device->cur_hw_ctx != hw_ctx))
+			goto unlock_dev_flush_ctx;
+
+		if (hw_device->hw_intf->hw_ops.stop) {
+			hw_stop_args.hw_ctx = hw_ctx;
+			rc = hw_device->hw_intf->hw_ops.stop(
+				hw_device->hw_intf->hw_priv, &hw_stop_args,
+				sizeof(hw_stop_args));
+			if (rc) {
+				CAM_ERR(CAM_FD, "Failed in HW Stop %d", rc);
+				goto unlock_dev_flush_ctx;
+			}
+			hw_device->ready_to_process = true;
+		}
+
+unlock_dev_flush_ctx:
+	mutex_unlock(&hw_device->lock);
+	}
+	mutex_unlock(&hw_mgr->frame_req_mutex);
+
+	for (i = 0; i < flush_args->num_req_pending; i++) {
+		flush_req = (struct cam_fd_mgr_frame_request *)
+			flush_args->flush_req_pending[i];
+		CAM_DBG(CAM_FD, "flush pending req %llu",
+			flush_req->request_id);
+		cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+			&flush_req, true);
+	}
+
+	for (i = 0; i < flush_args->num_req_active; i++) {
+		flush_req = (struct cam_fd_mgr_frame_request *)
+			flush_args->flush_req_active[i];
+		CAM_DBG(CAM_FD, "flush active req %llu", flush_req->request_id);
+		cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+			&flush_req, true);
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_flush(void *hw_mgr_priv,
+	void *hw_flush_args)
+{
+	int rc = 0;
+	struct cam_hw_flush_args *flush_args =
+		(struct cam_hw_flush_args *)hw_flush_args;
+
+	if (!hw_mgr_priv || !hw_flush_args) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK",
+			hw_mgr_priv, hw_flush_args);
+		return -EINVAL;
+	}
+
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_REQ:
+		rc = cam_fd_mgr_hw_flush_req(hw_mgr_priv, flush_args);
+		break;
+	case CAM_FLUSH_TYPE_ALL:
+		rc = cam_fd_mgr_hw_flush_ctx(hw_mgr_priv, flush_args);
+		break;
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_FD, "Invalid flush type %d",
+			flush_args->flush_type);
+		break;
+	}
+	return rc;
+}
+
+static int cam_fd_mgr_hw_dump(
+	void *hw_mgr_priv,
+	void *hw_dump_args)
+{
+	int                              rc;
+	uint8_t                         *dst;
+	ktime_t                          cur_time;
+	size_t                           remain_len;
+	uint32_t                         min_len;
+	uint64_t                         diff;
+	uint64_t                        *addr, *start;
+	struct timespec64                cur_ts;
+	struct timespec64                req_ts;
+	struct cam_fd_hw_mgr            *hw_mgr;
+	struct cam_hw_dump_args         *dump_args;
+	struct cam_fd_hw_mgr_ctx        *hw_ctx;
+	struct cam_fd_device            *hw_device;
+	struct cam_fd_hw_dump_args       fd_dump_args;
+	struct cam_fd_hw_dump_header    *hdr;
+	struct cam_fd_mgr_frame_request *frame_req, *req_temp;
+
+	hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	dump_args = (struct cam_hw_dump_args *)hw_dump_args;
+	if (!hw_mgr || !dump_args) {
+		CAM_ERR(CAM_FD, "Invalid args %pK %pK",
+			hw_mgr, dump_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)dump_args->ctxt_to_hw_map;
+
+	if (!hw_ctx) {
+		CAM_ERR(CAM_FD, "Invalid ctx");
+		return -EINVAL;
+	}
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	list_for_each_entry_safe(frame_req, req_temp,
+		&hw_mgr->frame_processing_list, list) {
+		if (frame_req->request_id == dump_args->request_id)
+			goto hw_dump;
+	}
+
+	CAM_DBG(CAM_FD, "fd dump cannot find req %llu",
+		dump_args->request_id);
+	return rc;
+hw_dump:
+	cur_time = ktime_get();
+	diff = ktime_us_delta(frame_req->submit_timestamp, cur_time);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(frame_req->submit_timestamp);
+	if (diff < CAM_FD_RESPONSE_TIME_THRESHOLD) {
+		CAM_INFO(CAM_FD,
+			"No Error req %lld req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		return 0;
+	}
+	CAM_INFO(CAM_FD, "Error req %lld req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&fd_dump_args.cpu_addr, &fd_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+	if (fd_dump_args.buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_FD, "dump offset overshoot len %zu offset %zu",
+			fd_dump_args.buf_len, dump_args->offset);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+	remain_len = fd_dump_args.buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_fd_hw_dump_header) +
+		(CAM_FD_HW_DUMP_NUM_WORDS * sizeof(uint64_t));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_FD, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)fd_dump_args.cpu_addr + dump_args->offset;
+	hdr = (struct cam_fd_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_FD_HW_DUMP_TAG_MAX_LEN,
+		"FD_REQ:");
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_fd_hw_dump_header));
+	start = addr;
+	*addr++ = frame_req->request_id;
+	*addr++ = req_ts.tv_sec;
+	*addr++ = req_ts.tv_nsec/NSEC_PER_USEC;
+	*addr++ = cur_ts.tv_sec;
+	*addr++ = cur_ts.tv_nsec/NSEC_PER_USEC;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_fd_hw_dump_header);
+
+	fd_dump_args.request_id = dump_args->request_id;
+	fd_dump_args.offset = dump_args->offset;
+	if (hw_device->hw_intf->hw_ops.process_cmd) {
+		rc = hw_device->hw_intf->hw_ops.process_cmd(
+			hw_device->hw_intf->hw_priv,
+			CAM_FD_HW_CMD_HW_DUMP,
+			&fd_dump_args,
+			sizeof(struct
+			cam_fd_hw_dump_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Hw Dump cmd fails req %lld rc %d",
+				frame_req->request_id, rc);
+			cam_mem_put_cpu_buf(dump_args->buf_handle);
+			return rc;
+		}
+	}
+	CAM_DBG(CAM_FD, "Offset before %zu after %zu",
+		dump_args->offset, fd_dump_args.offset);
+	dump_args->offset = fd_dump_args.offset;
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_fd_mgr_hw_stop(void *hw_mgr_priv, void *mgr_stop_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_stop_args *hw_mgr_stop_args =
+		(struct cam_hw_stop_args *)mgr_stop_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_deinit_args hw_deinit_args;
+	int rc = 0;
+
+	if (!hw_mgr_priv || !hw_mgr_stop_args) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK",
+			hw_mgr_priv, hw_mgr_stop_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)hw_mgr_stop_args->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+	CAM_DBG(CAM_FD, "ctx index=%u, hw_ctx=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_FD, "FD Device ready_to_process = %d",
+		hw_device->ready_to_process);
+
+	if (hw_device->hw_intf->hw_ops.deinit) {
+		hw_deinit_args.hw_ctx = hw_ctx;
+		hw_deinit_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+		rc = hw_device->hw_intf->hw_ops.deinit(
+			hw_device->hw_intf->hw_priv, &hw_deinit_args,
+			sizeof(hw_deinit_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW DeInit %d", rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_prepare_update(void *hw_mgr_priv,
+	void *hw_prepare_update_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_prepare_update_args *prepare =
+		(struct cam_hw_prepare_update_args *) hw_prepare_update_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_device *hw_device;
+	struct cam_kmd_buf_info kmd_buf;
+	int rc;
+	struct cam_fd_hw_cmd_prestart_args prestart_args;
+	struct cam_fd_mgr_frame_request *frame_req;
+
+	if (!hw_mgr_priv || !hw_prepare_update_args) {
+		CAM_ERR(CAM_FD, "Invalid args %pK %pK",
+			hw_mgr_priv, hw_prepare_update_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)prepare->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		goto error;
+	}
+
+	rc = cam_fd_mgr_util_packet_validate(prepare->packet,
+		prepare->remain_len);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in packet validation %d", rc);
+		goto error;
+	}
+
+	rc = cam_packet_util_get_kmd_buffer(prepare->packet, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in get kmd buf buffer %d", rc);
+		goto error;
+	}
+
+	CAM_DBG(CAM_FD,
+		"KMD Buf : hdl=%d, cpu_addr=%pK, offset=%d, size=%d, used=%d",
+		kmd_buf.handle, kmd_buf.cpu_addr, kmd_buf.offset,
+		kmd_buf.size, kmd_buf.used_bytes);
+
+	/* We do not expect any patching, but just do it anyway */
+	rc = cam_packet_util_process_patches(prepare->packet, prepare->buf_tracker,
+		hw_mgr->device_iommu.non_secure, -1, false);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Patch FD packet failed, rc=%d", rc);
+		return rc;
+	}
+
+	memset(&prestart_args, 0x0, sizeof(prestart_args));
+	prestart_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+	prestart_args.hw_ctx = hw_ctx;
+	prestart_args.request_id = prepare->packet->header.request_id;
+
+	rc = cam_fd_mgr_util_parse_generic_cmd_buffer(hw_ctx, prepare->packet,
+		&prestart_args);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in parsing gerneric cmd buffer %d", rc);
+		goto error;
+	}
+
+	rc = cam_fd_mgr_util_prepare_io_buf_info(
+		hw_mgr->device_iommu.non_secure, prepare,
+		prestart_args.input_buf, prestart_args.output_buf,
+		CAM_FD_MAX_IO_BUFFERS);
+
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in prepare IO Buf %d", rc);
+
+		if (rc == -ENOSPC)
+			goto error;
+		goto put_cpu_buf;
+	}
+
+	rc = cam_fd_mgr_util_prepare_hw_update_entries(hw_mgr, prepare,
+		&prestart_args, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in hw update entries %d", rc);
+		goto put_cpu_buf;
+	}
+
+	/* get a free frame req from free list */
+	rc = cam_fd_mgr_util_get_frame_req(&hw_mgr->frame_free_list,
+		&frame_req);
+	if (rc || !frame_req) {
+		CAM_ERR(CAM_FD, "Get frame_req failed, rc=%d, hw_ctx=%pK",
+			rc, hw_ctx);
+		rc = -ENOMEM;
+		goto put_cpu_buf;
+	}
+
+	/* Setup frame request info and queue to pending list */
+	frame_req->hw_ctx = hw_ctx;
+	frame_req->request_id = prepare->packet->header.request_id;
+	/* This has to be passed to HW while calling hw_ops->start */
+	frame_req->hw_req_private = prestart_args.hw_req_private;
+
+	/*
+	 * Save the current frame_req into priv,
+	 * this will come as priv while hw_config
+	 */
+	prepare->priv = frame_req;
+
+	cam_fd_mgr_put_cpu_buf(prepare);
+	CAM_DBG(CAM_FD, "FramePrepare : Frame[%lld]", frame_req->request_id);
+
+	return 0;
+
+put_cpu_buf:
+	cam_fd_mgr_put_cpu_buf(prepare);
+error:
+	return rc;
+}
+
+static int cam_fd_mgr_hw_config(void *hw_mgr_priv, void *hw_config_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_config_args *config =
+		(struct cam_hw_config_args *) hw_config_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_mgr_frame_request *frame_req;
+	int rc;
+	int i;
+	uint64_t req_id;
+
+	if (!hw_mgr || !config) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK", hw_mgr, config);
+		return -EINVAL;
+	}
+
+	if (!config->num_hw_update_entries) {
+		CAM_ERR(CAM_FD, "No hw update enteries are available");
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)config->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+
+	frame_req = config->priv;
+	req_id = frame_req->request_id;
+
+	trace_cam_apply_req("FD", hw_ctx->ctx_index, frame_req->request_id, 0);
+	CAM_DBG(CAM_FD, "FrameHWConfig : Frame[%lld]", frame_req->request_id);
+
+	frame_req->num_hw_update_entries = config->num_hw_update_entries;
+	for (i = 0; i < config->num_hw_update_entries; i++) {
+		frame_req->hw_update_entries[i] = config->hw_update_entries[i];
+		CAM_DBG(CAM_FD, "PreStart HWEntry[%d] : %d %d %d %d %pK",
+			frame_req->hw_update_entries[i].handle,
+			frame_req->hw_update_entries[i].offset,
+			frame_req->hw_update_entries[i].len,
+			frame_req->hw_update_entries[i].flags,
+			frame_req->hw_update_entries[i].addr);
+	}
+
+	if (hw_ctx->priority == CAM_FD_PRIORITY_HIGH) {
+		CAM_DBG(CAM_FD, "Insert frame into prio0 queue");
+		rc = cam_fd_mgr_util_put_frame_req(
+			&hw_mgr->frame_pending_list_high, &frame_req, false);
+	} else {
+		CAM_DBG(CAM_FD, "Insert frame into prio1 queue");
+		rc = cam_fd_mgr_util_put_frame_req(
+			&hw_mgr->frame_pending_list_normal, &frame_req, false);
+	}
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in queuing frame req, rc=%d", rc);
+		goto put_free_list;
+	}
+
+	mutex_lock(&g_fd_hw_mgr.frame_req_mutex);
+	hw_mgr->num_pending_frames++;
+	CAM_DBG(CAM_FD,
+		"Adding ctx[%pK] Req[%llu] : Total number of pending frames %d",
+		hw_ctx, req_id, hw_mgr->num_pending_frames);
+	mutex_unlock(&g_fd_hw_mgr.frame_req_mutex);
+
+	rc = cam_fd_mgr_util_schedule_frame_worker_task(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Worker task scheduling failed %d", rc);
+		goto remove_and_put_free_list;
+	}
+
+	return 0;
+
+remove_and_put_free_list:
+
+	if (hw_ctx->priority == CAM_FD_PRIORITY_HIGH) {
+		CAM_DBG(CAM_FD, "Removing frame into prio0 queue");
+		cam_fd_mgr_util_get_frame_req(
+			&hw_mgr->frame_pending_list_high, &frame_req);
+	} else {
+		CAM_DBG(CAM_FD, "Removing frame into prio1 queue");
+		cam_fd_mgr_util_get_frame_req(
+			&hw_mgr->frame_pending_list_normal, &frame_req);
+	}
+
+	mutex_lock(&g_fd_hw_mgr.frame_req_mutex);
+	hw_mgr->num_pending_frames--;
+	mutex_unlock(&g_fd_hw_mgr.frame_req_mutex);
+put_free_list:
+	cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+		&frame_req, true);
+
+	return rc;
+}
+
+int cam_fd_hw_mgr_deinit(struct device_node *of_node)
+{
+	CAM_DBG(CAM_FD, "HW Mgr Deinit");
+
+	cam_req_mgr_workq_destroy(&g_fd_hw_mgr.work);
+
+	cam_smmu_destroy_handle(g_fd_hw_mgr.device_iommu.non_secure);
+	g_fd_hw_mgr.device_iommu.non_secure = -1;
+
+	mutex_destroy(&g_fd_hw_mgr.ctx_mutex);
+	mutex_destroy(&g_fd_hw_mgr.frame_req_mutex);
+	mutex_destroy(&g_fd_hw_mgr.hw_mgr_mutex);
+
+	return 0;
+}
+
+static void cam_req_mgr_process_workq_cam_fd_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+int cam_fd_hw_mgr_init(struct device_node *of_node,
+	struct cam_hw_mgr_intf *hw_mgr_intf)
+{
+	int count, i, rc = 0;
+	struct cam_hw_intf *hw_intf = NULL;
+	struct cam_fd_hw_mgr_ctx *hw_mgr_ctx;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_mgr_frame_request *frame_req;
+
+	if (!of_node || !hw_mgr_intf) {
+		CAM_ERR(CAM_FD, "Invalid args of_node %pK hw_mgr_intf %pK",
+			of_node, hw_mgr_intf);
+		return -EINVAL;
+	}
+
+	memset(&g_fd_hw_mgr, 0x0, sizeof(g_fd_hw_mgr));
+	memset(hw_mgr_intf, 0x0, sizeof(*hw_mgr_intf));
+
+	mutex_init(&g_fd_hw_mgr.ctx_mutex);
+	mutex_init(&g_fd_hw_mgr.frame_req_mutex);
+	mutex_init(&g_fd_hw_mgr.hw_mgr_mutex);
+	spin_lock_init(&g_fd_hw_mgr.hw_mgr_slock);
+
+	count = of_property_count_strings(of_node, "compat-hw-name");
+	if (!count || (count > CAM_FD_HW_MAX)) {
+		CAM_ERR(CAM_FD, "Invalid compat names in dev tree %d", count);
+		return -EINVAL;
+	}
+	g_fd_hw_mgr.num_devices = count;
+
+	g_fd_hw_mgr.raw_results_available = false;
+	g_fd_hw_mgr.supported_modes = 0;
+
+	for (i = 0; i < count; i++) {
+		hw_device = &g_fd_hw_mgr.hw_device[i];
+
+		rc = cam_fd_mgr_util_pdev_get_hw_intf(of_node, i, &hw_intf);
+		if (rc) {
+			CAM_ERR(CAM_FD, "hw intf from pdev failed, rc=%d", rc);
+			return rc;
+		}
+
+		mutex_init(&hw_device->lock);
+
+		hw_device->valid = true;
+		hw_device->hw_intf = hw_intf;
+		hw_device->ready_to_process = true;
+		hw_device->req_id = -1;
+		hw_device->cur_hw_ctx = NULL;
+
+		if (hw_device->hw_intf->hw_ops.process_cmd) {
+			struct cam_fd_hw_cmd_set_irq_cb irq_cb_args;
+
+			irq_cb_args.cam_fd_hw_mgr_cb = cam_fd_mgr_irq_cb;
+			irq_cb_args.data = hw_device;
+
+			rc = hw_device->hw_intf->hw_ops.process_cmd(
+				hw_device->hw_intf->hw_priv,
+				CAM_FD_HW_CMD_REGISTER_CALLBACK,
+				&irq_cb_args, sizeof(irq_cb_args));
+			if (rc) {
+				CAM_ERR(CAM_FD,
+					"Failed in REGISTER_CALLBACK %d", rc);
+				return rc;
+			}
+		}
+
+		if (hw_device->hw_intf->hw_ops.get_hw_caps) {
+			rc = hw_device->hw_intf->hw_ops.get_hw_caps(
+				hw_intf->hw_priv, &hw_device->hw_caps,
+				sizeof(hw_device->hw_caps));
+			if (rc) {
+				CAM_ERR(CAM_FD, "Failed in get_hw_caps %d", rc);
+				return rc;
+			}
+
+			g_fd_hw_mgr.raw_results_available |=
+				hw_device->hw_caps.raw_results_available;
+			g_fd_hw_mgr.supported_modes |=
+				hw_device->hw_caps.supported_modes;
+
+			CAM_DBG(CAM_FD,
+				"Device[mode=%d, raw=%d], Mgr[mode=%d, raw=%d]",
+				hw_device->hw_caps.supported_modes,
+				hw_device->hw_caps.raw_results_available,
+				g_fd_hw_mgr.supported_modes,
+				g_fd_hw_mgr.raw_results_available);
+		}
+	}
+
+	INIT_LIST_HEAD(&g_fd_hw_mgr.free_ctx_list);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.used_ctx_list);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.frame_free_list);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.frame_pending_list_high);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.frame_pending_list_normal);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.frame_processing_list);
+
+	g_fd_hw_mgr.device_iommu.non_secure = -1;
+	g_fd_hw_mgr.device_iommu.secure = -1;
+	g_fd_hw_mgr.cdm_iommu.non_secure = -1;
+	g_fd_hw_mgr.cdm_iommu.secure = -1;
+	g_fd_hw_mgr.num_pending_frames = 0;
+
+	rc = cam_smmu_get_handle("fd",
+		&g_fd_hw_mgr.device_iommu.non_secure);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Get iommu handle failed, rc=%d", rc);
+		goto destroy_mutex;
+	}
+
+	rc = cam_cdm_get_iommu_handle("fd", &g_fd_hw_mgr.cdm_iommu);
+	if (rc)
+		CAM_DBG(CAM_FD, "Failed to acquire the CDM iommu handles");
+
+	CAM_DBG(CAM_FD, "iommu handles : device(%d, %d), cdm(%d, %d)",
+		g_fd_hw_mgr.device_iommu.non_secure,
+		g_fd_hw_mgr.device_iommu.secure,
+		g_fd_hw_mgr.cdm_iommu.non_secure,
+		g_fd_hw_mgr.cdm_iommu.secure);
+
+	/* Init hw mgr contexts and add to free list */
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		hw_mgr_ctx = &g_fd_hw_mgr.ctx_pool[i];
+
+		memset(hw_mgr_ctx, 0x0, sizeof(*hw_mgr_ctx));
+		INIT_LIST_HEAD(&hw_mgr_ctx->list);
+
+		hw_mgr_ctx->ctx_index = i;
+		hw_mgr_ctx->device_index = -1;
+		hw_mgr_ctx->hw_mgr = &g_fd_hw_mgr;
+
+		list_add_tail(&hw_mgr_ctx->list, &g_fd_hw_mgr.free_ctx_list);
+	}
+
+	/* Init hw mgr frame requests and add to free list */
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		frame_req = &g_fd_hw_mgr.frame_req[i];
+
+		memset(frame_req, 0x0, sizeof(*frame_req));
+		INIT_LIST_HEAD(&frame_req->list);
+
+		list_add_tail(&frame_req->list, &g_fd_hw_mgr.frame_free_list);
+	}
+
+	rc = cam_req_mgr_workq_create("cam_fd_worker", CAM_FD_WORKQ_NUM_TASK,
+		&g_fd_hw_mgr.work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_cam_fd_worker);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Unable to create a worker, rc=%d", rc);
+		goto detach_smmu;
+	}
+
+	g_fd_hw_mgr.work_data = kcalloc(CAM_FD_WORKQ_NUM_TASK,
+		sizeof(struct cam_fd_mgr_work_data), GFP_KERNEL);
+
+	for (i = 0; i < CAM_FD_WORKQ_NUM_TASK; i++)
+		g_fd_hw_mgr.work->task.pool[i].payload =
+			&g_fd_hw_mgr.work_data[i];
+
+	/* Setup hw cap so that we can just return the info when requested */
+	memset(&g_fd_hw_mgr.fd_caps, 0, sizeof(g_fd_hw_mgr.fd_caps));
+	g_fd_hw_mgr.fd_caps.device_iommu = g_fd_hw_mgr.device_iommu;
+	g_fd_hw_mgr.fd_caps.cdm_iommu = g_fd_hw_mgr.cdm_iommu;
+	g_fd_hw_mgr.fd_caps.hw_caps = g_fd_hw_mgr.hw_device[0].hw_caps;
+
+	CAM_DBG(CAM_FD,
+		"IOMMU device(%d, %d), CDM(%d, %d) versions core[%d.%d], wrapper[%d.%d]",
+		g_fd_hw_mgr.fd_caps.device_iommu.secure,
+		g_fd_hw_mgr.fd_caps.device_iommu.non_secure,
+		g_fd_hw_mgr.fd_caps.cdm_iommu.secure,
+		g_fd_hw_mgr.fd_caps.cdm_iommu.non_secure,
+		g_fd_hw_mgr.fd_caps.hw_caps.core_version.major,
+		g_fd_hw_mgr.fd_caps.hw_caps.core_version.minor,
+		g_fd_hw_mgr.fd_caps.hw_caps.wrapper_version.major,
+		g_fd_hw_mgr.fd_caps.hw_caps.wrapper_version.minor);
+
+	hw_mgr_intf->hw_mgr_priv = &g_fd_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_fd_mgr_hw_get_caps;
+	hw_mgr_intf->hw_acquire = cam_fd_mgr_hw_acquire;
+	hw_mgr_intf->hw_release = cam_fd_mgr_hw_release;
+	hw_mgr_intf->hw_start = cam_fd_mgr_hw_start;
+	hw_mgr_intf->hw_stop = cam_fd_mgr_hw_stop;
+	hw_mgr_intf->hw_prepare_update = cam_fd_mgr_hw_prepare_update;
+	hw_mgr_intf->hw_config = cam_fd_mgr_hw_config;
+	hw_mgr_intf->hw_read = NULL;
+	hw_mgr_intf->hw_write = NULL;
+	hw_mgr_intf->hw_close = NULL;
+	hw_mgr_intf->hw_flush = cam_fd_mgr_hw_flush;
+	hw_mgr_intf->hw_dump = cam_fd_mgr_hw_dump;
+
+	return rc;
+
+detach_smmu:
+	cam_smmu_destroy_handle(g_fd_hw_mgr.device_iommu.non_secure);
+	g_fd_hw_mgr.device_iommu.non_secure = -1;
+destroy_mutex:
+	mutex_destroy(&g_fd_hw_mgr.ctx_mutex);
+	mutex_destroy(&g_fd_hw_mgr.frame_req_mutex);
+	mutex_destroy(&g_fd_hw_mgr.hw_mgr_mutex);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.h
@@ -0,0 +1,190 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_MGR_H_
+#define _CAM_FD_HW_MGR_H_
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include <media/cam_fd.h>
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_fd_hw_intf.h"
+
+#define CAM_FD_HW_MAX            1
+#define CAM_FD_WORKQ_NUM_TASK    10
+
+/*
+ * Response time threshold in ms beyond which a request is not expected to be
+ * with FD hw
+ */
+#define CAM_FD_RESPONSE_TIME_THRESHOLD   100000
+
+struct cam_fd_hw_mgr;
+
+/**
+ * enum cam_fd_mgr_work_type - Type of worker task
+ *
+ * @CAM_FD_WORK_FRAME : Work type indicating frame task
+ * @CAM_FD_WORK_IRQ   : Work type indicating irq task
+ */
+enum cam_fd_mgr_work_type {
+	CAM_FD_WORK_FRAME,
+	CAM_FD_WORK_IRQ,
+};
+
+/**
+ * struct cam_fd_hw_mgr_ctx : FD HW Mgr context
+ *
+ * @list            : List pointer used to maintain this context
+ *                    in free, used list
+ * @ctx_index       : Index of this context
+ * @ctx_in_use      : Whether this context is in use
+ * @event_cb        : Event callback pointer to notify cam core context
+ * @cb_priv         : Event callback private pointer
+ * @hw_mgr          : Pointer to hw manager
+ * @get_raw_results : Whether this context needs raw results
+ * @mode            : Mode in which this context runs
+ * @device_index    : HW Device used by this context
+ * @ctx_hw_private  : HW layer's private context pointer for this context
+ * @priority        : Priority of this context
+ */
+struct cam_fd_hw_mgr_ctx {
+	struct list_head               list;
+	uint32_t                       ctx_index;
+	bool                           ctx_in_use;
+	cam_hw_event_cb_func           event_cb;
+	void                          *cb_priv;
+	struct cam_fd_hw_mgr          *hw_mgr;
+	bool                           get_raw_results;
+	enum cam_fd_hw_mode            mode;
+	int32_t                        device_index;
+	void                          *ctx_hw_private;
+	uint32_t                       priority;
+};
+
+/**
+ * struct cam_fd_device : FD HW Device
+ *
+ * @hw_caps          : This FD device's capabilities
+ * @hw_intf          : FD device's interface information
+ * @ready_to_process : Whether this device is ready to process next frame
+ * @num_ctxts        : Number of context currently running on this device
+ * @valid            : Whether this device is valid
+ * @lock             : Lock used for protectin
+ * @cur_hw_ctx       : current hw context running in the device
+ * @req_id           : current processing req id
+ */
+struct cam_fd_device {
+	struct cam_fd_hw_caps     hw_caps;
+	struct cam_hw_intf       *hw_intf;
+	bool                      ready_to_process;
+	uint32_t                  num_ctxts;
+	bool                      valid;
+	struct mutex              lock;
+	struct cam_fd_hw_mgr_ctx *cur_hw_ctx;
+	int64_t                   req_id;
+};
+
+/**
+ * struct cam_fd_mgr_frame_request : Frame request information maintained
+ *                                   in HW Mgr layer
+ *
+ * @list                  : List pointer used to maintain this request in
+ *                          free, pending, processing request lists
+ * @request_id            : Request ID corresponding to this request
+ * @hw_ctx                : HW context from which this request is coming
+ * @hw_req_private        : HW layer's private information specific to
+ *                          this request
+ * @hw_update_entries     : HW update entries corresponding to this request
+ *                          which needs to be submitted to HW through CDM
+ * @num_hw_update_entries : Number of HW update entries
+ * @submit_timestamp      : Time stamp for submit req with hw
+ */
+struct cam_fd_mgr_frame_request {
+	struct list_head               list;
+	uint64_t                       request_id;
+	struct cam_fd_hw_mgr_ctx      *hw_ctx;
+	struct cam_fd_hw_req_private   hw_req_private;
+	struct cam_hw_update_entry     hw_update_entries[CAM_FD_MAX_HW_ENTRIES];
+	uint32_t                       num_hw_update_entries;
+	ktime_t                        submit_timestamp;
+};
+
+/**
+ * struct cam_fd_mgr_work_data : HW Mgr work data information
+ *
+ * @type     : Type of work
+ * @irq_type : IRQ type when this work is queued because of irq callback
+ */
+struct cam_fd_mgr_work_data {
+	enum cam_fd_mgr_work_type      type;
+	enum cam_fd_hw_irq_type        irq_type;
+};
+
+/**
+ * struct cam_fd_hw_mgr : FD HW Mgr information
+ *
+ * @free_ctx_list             : List of free contexts available for acquire
+ * @used_ctx_list             : List of contexts that are acquired
+ * @frame_free_list           : List of free frame requests available
+ * @frame_pending_list_high   : List of high priority frame requests pending
+ *                              for processing
+ * @frame_pending_list_normal : List of normal priority frame requests pending
+ *                              for processing
+ * @frame_processing_list     : List of frame requests currently being
+ *                              processed currently. Generally maximum one
+ *                              request would be present in this list
+ * @hw_mgr_mutex              : Mutex to protect hw mgr data when accessed
+ *                              from multiple threads
+ * @hw_mgr_slock              : Spin lock to protect hw mgr data when accessed
+ *                              from multiple threads
+ * @ctx_mutex                 : Mutex to protect context list
+ * @frame_req_mutex           : Mutex to protect frame request list
+ * @device_iommu              : Device IOMMU information
+ * @cdm_iommu                 : CDM IOMMU information
+ * @hw_device                 : Underlying HW device information
+ * @num_devices               : Number of HW devices available
+ * @raw_results_available     : Whether raw results available in this driver
+ * @supported_modes           : Supported modes by this driver
+ * @ctx_pool                  : List of context
+ * @frame_req                 : List of frame requests
+ * @work                      : Worker handle
+ * @work_data                 : Worker data
+ * @fd_caps                   : FD driver capabilities
+ * @num_pending_frames        : Number of total frames pending for processing
+ *                              across contexts
+ */
+struct cam_fd_hw_mgr {
+	struct list_head                   free_ctx_list;
+	struct list_head                   used_ctx_list;
+	struct list_head                   frame_free_list;
+	struct list_head                   frame_pending_list_high;
+	struct list_head                   frame_pending_list_normal;
+	struct list_head                   frame_processing_list;
+	struct mutex                       hw_mgr_mutex;
+	spinlock_t                         hw_mgr_slock;
+	struct mutex                       ctx_mutex;
+	struct mutex                       frame_req_mutex;
+	struct cam_iommu_handle            device_iommu;
+	struct cam_iommu_handle            cdm_iommu;
+	struct cam_fd_device               hw_device[CAM_FD_HW_MAX];
+	uint32_t                           num_devices;
+	bool                               raw_results_available;
+	uint32_t                           supported_modes;
+	struct cam_fd_hw_mgr_ctx           ctx_pool[CAM_CTX_MAX];
+	struct cam_fd_mgr_frame_request    frame_req[CAM_CTX_REQ_MAX];
+	struct cam_req_mgr_core_workq     *work;
+	struct cam_fd_mgr_work_data        *work_data;
+	struct cam_fd_query_cap_cmd        fd_caps;
+	uint32_t                           num_pending_frames;
+};
+
+#endif /* _CAM_FD_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr_intf.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_MGR_INTF_H_
+#define _CAM_FD_HW_MGR_INTF_H_
+
+#include <linux/of.h>
+
+#include "cam_debug_util.h"
+#include "cam_hw_mgr_intf.h"
+
+int cam_fd_hw_mgr_init(struct device_node *of_node,
+	struct cam_hw_mgr_intf *hw_mgr_intf);
+int cam_fd_hw_mgr_deinit(struct device_node *of_node);
+
+#endif /* _CAM_FD_HW_MGR_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.c
@@ -0,0 +1,1280 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_fd_hw_core.h"
+#include "cam_fd_hw_soc.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+
+#define CAM_FD_REG_VAL_PAIR_SIZE 256
+
+static uint32_t cam_fd_cdm_write_reg_val_pair(uint32_t *buffer,
+	uint32_t index, uint32_t reg_offset, uint32_t reg_value)
+{
+	buffer[index++] = reg_offset;
+	buffer[index++] = reg_value;
+
+	CAM_DBG(CAM_FD, "FD_CDM_CMD: Base[FD_CORE] Offset[0x%8x] Value[0x%8x]",
+		reg_offset, reg_value);
+
+	return index;
+}
+
+static void cam_fd_hw_util_cdm_callback(uint32_t handle, void *userdata,
+	enum cam_cdm_cb_status status, void *cookie_arg)
+{
+	uint64_t cookie = 0;
+
+	if (status != CAM_CDM_CB_STATUS_PAGEFAULT)
+		cookie = *(uint64_t *) cookie_arg;
+
+	trace_cam_cdm_cb("FD", status);
+	CAM_DBG(CAM_FD, "CDM hdl=%x, udata=%pK, status=%d, cookie=%llu",
+		handle, userdata, status, cookie);
+}
+
+static void cam_fd_hw_util_enable_power_on_settings(struct cam_hw_info *fd_hw)
+{
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	struct cam_fd_hw_static_info *hw_static_info =
+		((struct cam_fd_core *)fd_hw->core_info)->hw_static_info;
+
+	if (hw_static_info->enable_errata_wa.single_irq_only == false) {
+		/* Enable IRQs here */
+		cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+			hw_static_info->wrapper_regs.irq_mask,
+			hw_static_info->irq_mask);
+	}
+
+	/* QoS settings */
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.vbif_req_priority,
+		hw_static_info->qos_priority);
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.vbif_priority_level,
+		hw_static_info->qos_priority_level);
+}
+
+int cam_fd_hw_util_get_hw_caps(struct cam_hw_info *fd_hw,
+	struct cam_fd_hw_caps *hw_caps)
+{
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	struct cam_fd_hw_static_info *hw_static_info =
+		((struct cam_fd_core *)fd_hw->core_info)->hw_static_info;
+	uint32_t reg_value;
+
+	if (!hw_static_info) {
+		CAM_ERR(CAM_FD, "Invalid hw info data");
+		return -EINVAL;
+	}
+
+	reg_value = cam_fd_soc_register_read(soc_info, CAM_FD_REG_CORE,
+		hw_static_info->core_regs.version);
+	hw_caps->core_version.major =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf00, 0x8);
+	hw_caps->core_version.minor =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0, 0x4);
+	hw_caps->core_version.incr =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf, 0x0);
+
+	reg_value = cam_fd_soc_register_read(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.wrapper_version);
+	hw_caps->wrapper_version.major =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1c);
+	hw_caps->wrapper_version.minor =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->wrapper_version.incr =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	hw_caps->raw_results_available =
+		hw_static_info->results.raw_results_available;
+	hw_caps->supported_modes = hw_static_info->supported_modes;
+
+	CAM_DBG(CAM_FD, "core:%d.%d.%d wrapper:%d.%d.%d intermediate:%d",
+		hw_caps->core_version.major, hw_caps->core_version.minor,
+		hw_caps->core_version.incr, hw_caps->wrapper_version.major,
+		hw_caps->wrapper_version.minor, hw_caps->wrapper_version.incr,
+		hw_caps->raw_results_available);
+
+	return 0;
+}
+
+static int cam_fd_hw_util_fdwrapper_sync_reset(struct cam_hw_info *fd_hw)
+{
+	struct cam_fd_core *fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	struct cam_fd_hw_static_info *hw_static_info = fd_core->hw_static_info;
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	long time_left;
+
+	/* Before triggering reset to HW, clear the reset complete */
+	reinit_completion(&fd_core->reset_complete);
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_CORE,
+		hw_static_info->core_regs.control, 0x1);
+
+	if (hw_static_info->enable_errata_wa.single_irq_only) {
+		cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+			hw_static_info->wrapper_regs.irq_mask,
+			CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE));
+	}
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.sw_reset, 0x1);
+
+	time_left = cam_common_wait_for_completion_timeout(
+			&fd_core->reset_complete,
+			msecs_to_jiffies(CAM_FD_HW_HALT_RESET_TIMEOUT));
+	if (time_left <= 0)
+		CAM_WARN(CAM_FD, "HW reset timeout time_left=%ld", time_left);
+
+	CAM_DBG(CAM_FD, "FD Wrapper SW Sync Reset complete");
+
+	return 0;
+}
+
+
+static int cam_fd_hw_util_fdwrapper_halt(struct cam_hw_info *fd_hw)
+{
+	struct cam_fd_core *fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	struct cam_fd_hw_static_info *hw_static_info = fd_core->hw_static_info;
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	long time_left;
+
+	/* Before triggering halt to HW, clear halt complete */
+	reinit_completion(&fd_core->halt_complete);
+
+	if (hw_static_info->enable_errata_wa.single_irq_only) {
+		cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+			hw_static_info->wrapper_regs.irq_mask,
+			CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE));
+	}
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.hw_stop, 0x1);
+
+	time_left = cam_common_wait_for_completion_timeout(
+			&fd_core->halt_complete,
+			msecs_to_jiffies(CAM_FD_HW_HALT_RESET_TIMEOUT));
+	if (time_left <= 0)
+		CAM_WARN(CAM_FD, "HW halt timeout time_left=%ld", time_left);
+
+	CAM_DBG(CAM_FD, "FD Wrapper Halt complete");
+
+	return 0;
+}
+
+static int cam_fd_hw_util_processcmd_prestart(struct cam_hw_info *fd_hw,
+	struct cam_fd_hw_cmd_prestart_args *prestart_args)
+{
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	struct cam_fd_hw_static_info *hw_static_info =
+		((struct cam_fd_core *)fd_hw->core_info)->hw_static_info;
+	struct cam_fd_ctx_hw_private *ctx_hw_private =
+		prestart_args->ctx_hw_private;
+	uint32_t size, size_required = 0;
+	uint32_t mem_base;
+	uint32_t *cmd_buf_addr = prestart_args->cmd_buf_addr;
+	uint32_t reg_val_pair[CAM_FD_REG_VAL_PAIR_SIZE];
+	uint32_t num_cmds = 0;
+	uint32_t num_regval_pairs = 0;
+	int i;
+	struct cam_fd_hw_io_buffer *io_buf;
+	struct cam_fd_hw_req_private *req_private;
+	uint32_t available_size = prestart_args->size;
+	bool work_buffer_configured = false;
+
+	if (!ctx_hw_private || !cmd_buf_addr) {
+		CAM_ERR(CAM_FD, "Invalid input prestart args %pK %pK",
+			ctx_hw_private, cmd_buf_addr);
+		return -EINVAL;
+	}
+
+	if (prestart_args->get_raw_results &&
+		!hw_static_info->results.raw_results_available) {
+		CAM_ERR(CAM_FD, "Raw results not supported %d %d",
+			prestart_args->get_raw_results,
+			hw_static_info->results.raw_results_available);
+		return -EINVAL;
+	}
+
+	req_private = &prestart_args->hw_req_private;
+	req_private->ctx_hw_private = prestart_args->ctx_hw_private;
+	req_private->request_id = prestart_args->request_id;
+	req_private->get_raw_results = prestart_args->get_raw_results;
+	req_private->fd_results = NULL;
+	req_private->raw_results = NULL;
+
+	/* Start preparing CDM register values that KMD has to insert */
+	num_cmds = cam_fd_cdm_write_reg_val_pair(reg_val_pair, num_cmds,
+		hw_static_info->core_regs.control, 0x1);
+	num_cmds = cam_fd_cdm_write_reg_val_pair(reg_val_pair, num_cmds,
+		hw_static_info->core_regs.control, 0x0);
+
+	for (i = 0; i < CAM_FD_MAX_IO_BUFFERS; i++) {
+		io_buf = &prestart_args->input_buf[i];
+
+		if (io_buf->valid == false)
+			break;
+
+		if (io_buf->io_cfg->direction != CAM_BUF_INPUT) {
+			CAM_ERR(CAM_FD, "Incorrect direction %d %d",
+				io_buf->io_cfg->direction, CAM_BUF_INPUT);
+			return -EINVAL;
+		}
+
+		switch (io_buf->io_cfg->resource_type) {
+		case CAM_FD_INPUT_PORT_ID_IMAGE: {
+			if ((num_cmds + 2) > CAM_FD_REG_VAL_PAIR_SIZE) {
+				CAM_ERR(CAM_FD,
+					"Invalid reg_val pair size %d, %d",
+					num_cmds, CAM_FD_REG_VAL_PAIR_SIZE);
+				return -EINVAL;
+			}
+
+			num_cmds = cam_fd_cdm_write_reg_val_pair(
+				reg_val_pair, num_cmds,
+				hw_static_info->core_regs.image_addr,
+				io_buf->io_addr[0]);
+			break;
+		}
+		default:
+			CAM_ERR(CAM_FD, "Invalid resource type %d",
+				io_buf->io_cfg->resource_type);
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < CAM_FD_MAX_IO_BUFFERS; i++) {
+		io_buf = &prestart_args->output_buf[i];
+
+		if (io_buf->valid == false)
+			break;
+
+		if (io_buf->io_cfg->direction != CAM_BUF_OUTPUT) {
+			CAM_ERR(CAM_FD, "Incorrect direction %d %d",
+				io_buf->io_cfg->direction, CAM_BUF_INPUT);
+			return -EINVAL;
+		}
+
+		switch (io_buf->io_cfg->resource_type) {
+		case CAM_FD_OUTPUT_PORT_ID_RESULTS: {
+			uint32_t face_results_offset;
+
+			size_required = hw_static_info->results.max_faces *
+				hw_static_info->results.per_face_entries * 4;
+
+			if (io_buf->io_cfg->planes[0].plane_stride <
+				size_required) {
+				CAM_ERR(CAM_FD, "Invalid results size %d %d",
+					io_buf->io_cfg->planes[0].plane_stride,
+					size_required);
+				return -EINVAL;
+			}
+
+			req_private->fd_results =
+				(struct cam_fd_results *)io_buf->cpu_addr[0];
+
+			face_results_offset =
+				(uint8_t *)&req_private->fd_results->faces[0] -
+				(uint8_t *)req_private->fd_results;
+
+			if (hw_static_info->ro_mode_supported) {
+				if ((num_cmds + 4) > CAM_FD_REG_VAL_PAIR_SIZE) {
+					CAM_ERR(CAM_FD,
+						"Invalid reg_val size %d, %d",
+						num_cmds,
+						CAM_FD_REG_VAL_PAIR_SIZE);
+					return -EINVAL;
+				}
+				/*
+				 * Face data actually starts 16bytes later in
+				 * the io buffer  Check cam_fd_results.
+				 */
+				num_cmds = cam_fd_cdm_write_reg_val_pair(
+					reg_val_pair, num_cmds,
+					hw_static_info->core_regs.result_addr,
+					io_buf->io_addr[0] +
+					face_results_offset);
+				num_cmds = cam_fd_cdm_write_reg_val_pair(
+					reg_val_pair, num_cmds,
+					hw_static_info->core_regs.ro_mode,
+					0x1);
+
+				req_private->ro_mode_enabled = true;
+			} else {
+				req_private->ro_mode_enabled = false;
+			}
+			break;
+		}
+		case CAM_FD_OUTPUT_PORT_ID_RAW_RESULTS: {
+			size_required =
+				hw_static_info->results.raw_results_entries *
+				sizeof(uint32_t);
+
+			if (io_buf->io_cfg->planes[0].plane_stride <
+				size_required) {
+				CAM_ERR(CAM_FD, "Invalid results size %d %d",
+					io_buf->io_cfg->planes[0].plane_stride,
+					size_required);
+				return -EINVAL;
+			}
+
+			req_private->raw_results =
+				(uint32_t *)io_buf->cpu_addr[0];
+			break;
+		}
+		case CAM_FD_OUTPUT_PORT_ID_WORK_BUFFER: {
+			if ((num_cmds + 2) > CAM_FD_REG_VAL_PAIR_SIZE) {
+				CAM_ERR(CAM_FD,
+					"Invalid reg_val pair size %d, %d",
+					num_cmds, CAM_FD_REG_VAL_PAIR_SIZE);
+				return -EINVAL;
+			}
+
+			num_cmds = cam_fd_cdm_write_reg_val_pair(
+				reg_val_pair, num_cmds,
+				hw_static_info->core_regs.work_addr,
+				io_buf->io_addr[0]);
+
+			work_buffer_configured = true;
+			break;
+		}
+		default:
+			CAM_ERR(CAM_FD, "Invalid resource type %d",
+				io_buf->io_cfg->resource_type);
+			return -EINVAL;
+		}
+	}
+
+	if (!req_private->fd_results || !work_buffer_configured) {
+		CAM_ERR(CAM_FD, "Invalid IO Buffers results=%pK work=%d",
+			req_private->fd_results, work_buffer_configured);
+		return -EINVAL;
+	}
+
+	/* First insert CHANGE_BASE command */
+	size = ctx_hw_private->cdm_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > available_size) {
+		CAM_ERR(CAM_FD, "buf size:%d is not sufficient, expected: %d",
+			prestart_args->size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(soc_info,
+		((struct cam_fd_soc_private *)soc_info->soc_private)->
+		regbase_index[CAM_FD_REG_CORE]);
+
+	if (mem_base == -1) {
+		CAM_ERR(CAM_FD, "failed to get mem_base, index: %d num_reg_map: %u",
+			((struct cam_fd_soc_private *)soc_info->soc_private)->
+			regbase_index[CAM_FD_REG_CORE], soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	ctx_hw_private->cdm_ops->cdm_write_changebase(cmd_buf_addr, mem_base);
+	cmd_buf_addr += size;
+	available_size -= (size * 4);
+	num_regval_pairs = num_cmds / 2;
+
+	if (num_regval_pairs) {
+		size = ctx_hw_private->cdm_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > available_size) {
+			CAM_ERR(CAM_FD,
+				"Insufficient size:%d , expected size:%d",
+				available_size, size);
+			return -ENOMEM;
+		}
+		ctx_hw_private->cdm_ops->cdm_write_regrandom(cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+		cmd_buf_addr += size;
+		available_size -= (size * 4);
+	} else {
+		CAM_DBG(CAM_FD, "No reg val pairs");
+	}
+
+	/* Update pre_config_buf_size in bytes */
+	prestart_args->pre_config_buf_size =
+		prestart_args->size - available_size;
+
+	/* Insert start trigger command into CDM as post config commands. */
+	num_cmds = cam_fd_cdm_write_reg_val_pair(reg_val_pair, 0,
+		hw_static_info->core_regs.control, 0x2);
+
+	num_regval_pairs = num_cmds / 2;
+
+	if (num_regval_pairs) {
+		size = ctx_hw_private->cdm_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+		if ((size * 4) > available_size) {
+			CAM_ERR(CAM_FD,
+				"Insufficient size:%d , expected size:%d",
+				available_size, size);
+			return -ENOMEM;
+		}
+		ctx_hw_private->cdm_ops->cdm_write_regrandom(cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+		cmd_buf_addr += size;
+		available_size -= (size * 4);
+		prestart_args->post_config_buf_size = size * 4;
+	} else {
+		CAM_DBG(CAM_FD, "No reg val pairs");
+		prestart_args->post_config_buf_size = 0;
+	}
+
+	CAM_DBG(CAM_FD, "PreConfig [%pK %d], PostConfig[%pK %d]",
+		prestart_args->cmd_buf_addr, prestart_args->pre_config_buf_size,
+		cmd_buf_addr, prestart_args->post_config_buf_size);
+
+	for (i = 0; i < (prestart_args->pre_config_buf_size +
+		prestart_args->post_config_buf_size) / 4; i++)
+		CAM_DBG(CAM_FD, "CDM KMD Commands [%d] : [%pK] [0x%x]", i,
+			&prestart_args->cmd_buf_addr[i],
+			prestart_args->cmd_buf_addr[i]);
+
+	return 0;
+}
+
+static int cam_fd_hw_util_processcmd_frame_done(struct cam_hw_info *fd_hw,
+	struct cam_fd_hw_frame_done_args *frame_done_args)
+{
+	struct cam_fd_core *fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	struct cam_fd_hw_static_info *hw_static_info = fd_core->hw_static_info;
+	struct cam_fd_hw_req_private *req_private;
+	uint32_t base, face_cnt;
+	uint32_t *buffer;
+	unsigned long flags;
+	int i;
+
+	mutex_lock(&fd_hw->hw_mutex);
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	if ((fd_core->core_state != CAM_FD_CORE_STATE_IDLE) ||
+		(fd_core->results_valid == false) ||
+		!fd_core->hw_req_private) {
+		CAM_ERR(CAM_FD,
+			"Invalid state for results state=%d, results=%d %pK",
+			fd_core->core_state, fd_core->results_valid,
+			fd_core->hw_req_private);
+		spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+		mutex_unlock(&fd_hw->hw_mutex);
+		return -EINVAL;
+	}
+	fd_core->core_state = CAM_FD_CORE_STATE_READING_RESULTS;
+	req_private = fd_core->hw_req_private;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	/*
+	 * Copy the register value as is into output buffers.
+	 * Wehter we are copying the output data by reading registers or
+	 * programming output buffer directly to HW must be transparent to UMD.
+	 * In case HW supports writing face count value directly into
+	 * DDR memory in future, these values should match.
+	 */
+	req_private->fd_results->face_count =
+		cam_fd_soc_register_read(&fd_hw->soc_info, CAM_FD_REG_CORE,
+		hw_static_info->core_regs.result_cnt);
+
+	face_cnt = req_private->fd_results->face_count & 0x3F;
+
+	if (face_cnt > hw_static_info->results.max_faces) {
+		CAM_WARN(CAM_FD, "Face count greater than max %d %d",
+			face_cnt, hw_static_info->results.max_faces);
+		face_cnt = hw_static_info->results.max_faces;
+	}
+
+	CAM_DBG(CAM_FD, "ReqID[%lld] Faces Detected = %d",
+		req_private->request_id, face_cnt);
+
+	/*
+	 * We need to read the face data information from registers only
+	 * if one of below is true
+	 * 1. RO mode is not set. i.e FD HW doesn't write face data into
+	 *    DDR memory
+	 * 2. On the current chipset, results written into DDR memory by FD HW
+	 *    are not gauranteed to be correct
+	 */
+	if (!req_private->ro_mode_enabled ||
+		hw_static_info->enable_errata_wa.ro_mode_results_invalid) {
+		buffer = (uint32_t *)&req_private->fd_results->faces[0];
+		base = hw_static_info->core_regs.results_reg_base;
+
+		/*
+		 * Write register values as is into face data buffer.  Its UMD
+		 * driver responsibility to interpret the data and extract face
+		 * properties from output buffer. Think in case output buffer
+		 * is directly programmed to HW, then KMD has no control to
+		 * extract the face properties and UMD anyway has to extract
+		 * face properties. So we follow the same approach and keep
+		 * this transparent to UMD.
+		 */
+		for (i = 0;
+			i < (face_cnt *
+			hw_static_info->results.per_face_entries); i++) {
+			*buffer = cam_fd_soc_register_read(&fd_hw->soc_info,
+				CAM_FD_REG_CORE, base + (i * 0x4));
+			CAM_DBG(CAM_FD, "FaceData[%d] : 0x%x", i / 4, *buffer);
+			buffer++;
+		}
+	}
+
+	if (req_private->get_raw_results &&
+		req_private->raw_results &&
+		hw_static_info->results.raw_results_available) {
+		buffer = req_private->raw_results;
+		base = hw_static_info->core_regs.raw_results_reg_base;
+
+		for (i = 0;
+			i < hw_static_info->results.raw_results_entries;
+			i++) {
+			*buffer = cam_fd_soc_register_read(&fd_hw->soc_info,
+				CAM_FD_REG_CORE, base + (i * 0x4));
+			CAM_DBG(CAM_FD, "RawData[%d] : 0x%x", i, *buffer);
+			buffer++;
+		}
+	}
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->hw_req_private = NULL;
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+	mutex_unlock(&fd_hw->hw_mutex);
+
+	return 0;
+}
+
+static int cam_fd_hw_util_processcmd_hw_dump(
+	struct cam_hw_info *fd_hw,
+	void               *args)
+{
+	int                            i, j;
+	uint8_t                       *dst;
+	uint32_t                      *addr, *start;
+	uint32_t                       num_reg, min_len;
+	uint64_t                       remain_len;
+	struct cam_hw_soc_info        *soc_info;
+	struct cam_fd_hw_dump_header  *hdr;
+	struct cam_fd_hw_dump_args    *dump_args;
+
+	if (!fd_hw || !args) {
+		CAM_ERR(CAM_FD, "Invalid args %pK %pK",
+			fd_hw, args);
+		return -EINVAL;
+	}
+
+	mutex_lock(&fd_hw->hw_mutex);
+
+	if (fd_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_INFO(CAM_FD, "power off state");
+		mutex_unlock(&fd_hw->hw_mutex);
+		return 0;
+	}
+
+	dump_args = (struct cam_fd_hw_dump_args *)args;
+	soc_info = &fd_hw->soc_info;
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_FD, "dump offset overshoot len %zu offset %zu",
+			dump_args->buf_len, dump_args->offset);
+		mutex_unlock(&fd_hw->hw_mutex);
+		return -ENOSPC;
+	}
+
+	remain_len = dump_args->buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_fd_hw_dump_header) +
+		    soc_info->reg_map[0].size + sizeof(uint32_t);
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_FD, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		mutex_unlock(&fd_hw->hw_mutex);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_fd_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_FD_HW_DUMP_TAG_MAX_LEN,
+		"FD_REG:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_fd_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+
+	for (j = 0; j < soc_info->num_reg_map; j++) {
+		num_reg = soc_info->reg_map[j].size/4;
+		for (i = 0; i < num_reg; i++) {
+			*addr++ = soc_info->mem_block[j]->start + i*4;
+			*addr++ = cam_io_r(soc_info->reg_map[j].mem_base +
+				(i*4));
+		}
+	}
+
+	mutex_unlock(&fd_hw->hw_mutex);
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_fd_hw_dump_header);
+	CAM_DBG(CAM_FD, "%zu", dump_args->offset);
+	return 0;
+}
+
+irqreturn_t cam_fd_hw_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)data;
+	struct cam_fd_core *fd_core;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_fd_hw_static_info *hw_static_info;
+	uint32_t reg_value;
+	enum cam_fd_hw_irq_type irq_type = CAM_FD_IRQ_FRAME_DONE;
+	uint32_t num_irqs = 0;
+
+	if (!fd_hw) {
+		CAM_ERR(CAM_FD, "Invalid data in IRQ callback");
+		return IRQ_NONE;
+	}
+
+	fd_core = (struct cam_fd_core *) fd_hw->core_info;
+	soc_info = &fd_hw->soc_info;
+	hw_static_info = fd_core->hw_static_info;
+
+	reg_value = cam_fd_soc_register_read(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.irq_status);
+
+	CAM_DBG(CAM_FD, "FD IRQ status 0x%x", reg_value);
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.irq_clear,
+		reg_value);
+
+	if (reg_value & CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE)) {
+		complete_all(&fd_core->halt_complete);
+		irq_type = CAM_FD_IRQ_HALT_DONE;
+		num_irqs++;
+	}
+
+	if (reg_value & CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE)) {
+		complete_all(&fd_core->reset_complete);
+		irq_type = CAM_FD_IRQ_RESET_DONE;
+		num_irqs++;
+	}
+
+	if (reg_value & CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE)) {
+		complete_all(&fd_core->processing_complete);
+		irq_type = CAM_FD_IRQ_FRAME_DONE;
+		num_irqs++;
+	}
+
+	/*
+	 * We should never get an IRQ callback with no or more than one mask.
+	 * Validate first to make sure nothing going wrong.
+	 */
+	if (num_irqs != 1) {
+		CAM_ERR(CAM_FD,
+			"Invalid number of IRQs, value=0x%x, num_irqs=%d",
+			reg_value, num_irqs);
+		return IRQ_NONE;
+	}
+
+	trace_cam_irq_activated("FD", irq_type);
+
+	if (irq_type == CAM_FD_IRQ_HALT_DONE) {
+		/*
+		 * Do not send HALT IRQ callback to Hw Mgr,
+		 * a reset would always follow
+		 */
+		return IRQ_HANDLED;
+	}
+
+	spin_lock(&fd_core->spin_lock);
+	/* Do not change state to IDLE on HALT IRQ. Reset must follow halt */
+	if ((irq_type == CAM_FD_IRQ_RESET_DONE) ||
+		(irq_type == CAM_FD_IRQ_FRAME_DONE)) {
+
+		fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+		if (irq_type == CAM_FD_IRQ_FRAME_DONE)
+			fd_core->results_valid = true;
+
+		CAM_DBG(CAM_FD, "FD IRQ type %d, state=%d",
+			irq_type, fd_core->core_state);
+	}
+	spin_unlock(&fd_core->spin_lock);
+
+	if (fd_core->irq_cb.cam_fd_hw_mgr_cb)
+		fd_core->irq_cb.cam_fd_hw_mgr_cb(fd_core->irq_cb.data,
+			irq_type);
+
+	return IRQ_HANDLED;
+}
+
+int cam_fd_hw_get_hw_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_caps *fd_hw_caps =
+		(struct cam_fd_hw_caps *)get_hw_cap_args;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_FD, "Invalid input pointers %pK %pK",
+			hw_priv, get_hw_cap_args);
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	*fd_hw_caps = fd_core->hw_caps;
+
+	CAM_DBG(CAM_FD, "core:%d.%d wrapper:%d.%d mode:%d, raw:%d",
+		fd_hw_caps->core_version.major,
+		fd_hw_caps->core_version.minor,
+		fd_hw_caps->wrapper_version.major,
+		fd_hw_caps->wrapper_version.minor,
+		fd_hw_caps->supported_modes,
+		fd_hw_caps->raw_results_available);
+
+	return 0;
+}
+
+int cam_fd_hw_init(void *hw_priv, void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_init_args *init_args =
+		(struct cam_fd_hw_init_args *)init_hw_args;
+	int rc = 0;
+	unsigned long flags;
+
+	if (!fd_hw || !init_args) {
+		CAM_ERR(CAM_FD, "Invalid argument %pK %pK", fd_hw, init_args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_init_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_init_args));
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+
+	mutex_lock(&fd_hw->hw_mutex);
+	CAM_DBG(CAM_FD, "FD HW Init ref count before %d", fd_hw->open_count);
+
+	if (fd_hw->open_count > 0) {
+		rc = 0;
+		goto cdm_streamon;
+	}
+
+	rc = cam_fd_soc_enable_resources(&fd_hw->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Enable SOC failed, rc=%d", rc);
+		goto unlock_return;
+	}
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	if (init_args->reset_required) {
+		rc = cam_fd_hw_reset(hw_priv, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_FD, "Reset Failed, rc=%d", rc);
+			goto disable_soc;
+		}
+		init_args->is_hw_reset = true;
+	}
+
+	cam_fd_hw_util_enable_power_on_settings(fd_hw);
+
+cdm_streamon:
+	fd_hw->open_count++;
+	CAM_DBG(CAM_FD, "FD HW Init ref count after %d", fd_hw->open_count);
+
+	if (init_args->ctx_hw_private) {
+		struct cam_fd_ctx_hw_private *ctx_hw_private =
+			init_args->ctx_hw_private;
+
+		rc = cam_cdm_stream_on(ctx_hw_private->cdm_handle);
+		if (rc) {
+			CAM_ERR(CAM_FD, "CDM StreamOn fail :handle=0x%x, rc=%d",
+				ctx_hw_private->cdm_handle, rc);
+			fd_hw->open_count--;
+			if (!fd_hw->open_count)
+				goto disable_soc;
+		}
+	}
+
+	mutex_unlock(&fd_hw->hw_mutex);
+
+	return rc;
+
+disable_soc:
+	if (cam_fd_soc_disable_resources(&fd_hw->soc_info))
+		CAM_ERR(CAM_FD, "Error in disable soc resources");
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	fd_core->core_state = CAM_FD_CORE_STATE_POWERDOWN;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+unlock_return:
+	mutex_unlock(&fd_hw->hw_mutex);
+	return rc;
+}
+
+int cam_fd_hw_deinit(void *hw_priv, void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = hw_priv;
+	struct cam_fd_core *fd_core = NULL;
+	struct cam_fd_hw_deinit_args *deinit_args =
+		(struct cam_fd_hw_deinit_args *)deinit_hw_args;
+	int rc = 0;
+	unsigned long flags;
+
+	if (!fd_hw || !deinit_hw_args) {
+		CAM_ERR(CAM_FD, "Invalid argument");
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_deinit_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_deinit_args));
+		return -EINVAL;
+	}
+
+	mutex_lock(&fd_hw->hw_mutex);
+	if (fd_hw->open_count == 0) {
+		mutex_unlock(&fd_hw->hw_mutex);
+		CAM_ERR(CAM_FD, "Error Unbalanced deinit");
+		return -EFAULT;
+	}
+
+	fd_hw->open_count--;
+	CAM_DBG(CAM_FD, "FD HW ref count=%d", fd_hw->open_count);
+
+	if (fd_hw->open_count > 0) {
+		rc = 0;
+		goto positive_ref_cnt;
+	}
+
+	rc = cam_fd_soc_disable_resources(&fd_hw->soc_info);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed in Disable SOC, rc=%d", rc);
+
+	fd_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+
+	/* With the ref_cnt correct, this should never happen */
+	WARN_ON(!fd_core);
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->core_state = CAM_FD_CORE_STATE_POWERDOWN;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+positive_ref_cnt:
+	if (deinit_args->ctx_hw_private) {
+		struct cam_fd_ctx_hw_private *ctx_hw_private =
+			deinit_args->ctx_hw_private;
+
+		rc = cam_cdm_stream_off(ctx_hw_private->cdm_handle);
+		if (rc) {
+			CAM_ERR(CAM_FD,
+				"Failed in CDM StreamOff, handle=0x%x, rc=%d",
+				ctx_hw_private->cdm_handle, rc);
+		}
+	}
+
+	mutex_unlock(&fd_hw->hw_mutex);
+	return rc;
+}
+
+int cam_fd_hw_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_static_info *hw_static_info;
+	struct cam_hw_soc_info *soc_info;
+	unsigned long flags;
+	int rc;
+
+	if (!fd_hw) {
+		CAM_ERR(CAM_FD, "Invalid input handle");
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	hw_static_info = fd_core->hw_static_info;
+	soc_info = &fd_hw->soc_info;
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	if ((fd_core->core_state == CAM_FD_CORE_STATE_POWERDOWN) ||
+		(fd_core->core_state == CAM_FD_CORE_STATE_RESET_PROGRESS)) {
+		CAM_ERR(CAM_FD, "Reset not allowed in %d state",
+			fd_core->core_state);
+		spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+		return -EINVAL;
+	}
+
+	fd_core->results_valid = false;
+	fd_core->core_state = CAM_FD_CORE_STATE_RESET_PROGRESS;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.cgc_disable, 0x1);
+
+	rc = cam_fd_hw_util_fdwrapper_halt(fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in HALT rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_fd_hw_util_fdwrapper_sync_reset(fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in RESET rc=%d", rc);
+		return rc;
+	}
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.cgc_disable, 0x0);
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	return rc;
+}
+
+int cam_fd_hw_start(void *hw_priv, void *hw_start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_static_info *hw_static_info;
+	struct cam_fd_hw_cmd_start_args *start_args =
+		(struct cam_fd_hw_cmd_start_args *)hw_start_args;
+	struct cam_fd_ctx_hw_private *ctx_hw_private;
+	unsigned long flags;
+	int rc;
+
+	if (!hw_priv || !start_args) {
+		CAM_ERR(CAM_FD, "Invalid input args %pK %pK", hw_priv,
+			start_args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_cmd_start_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_cmd_start_args));
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	hw_static_info = fd_core->hw_static_info;
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	if (fd_core->core_state != CAM_FD_CORE_STATE_IDLE) {
+		CAM_ERR(CAM_FD, "Cannot start in %d state",
+			fd_core->core_state);
+		spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+		return -EINVAL;
+	}
+
+	/*
+	 * We are about to start FD HW processing, save the request
+	 * private data which is being processed by HW. Once the frame
+	 * processing is finished, process_cmd(FRAME_DONE) should be called
+	 * with same hw_req_private as input.
+	 */
+	fd_core->hw_req_private = start_args->hw_req_private;
+	fd_core->core_state = CAM_FD_CORE_STATE_PROCESSING;
+	fd_core->results_valid = false;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	ctx_hw_private = start_args->ctx_hw_private;
+
+	/* Before starting HW process, clear processing complete */
+	reinit_completion(&fd_core->processing_complete);
+
+	if (hw_static_info->enable_errata_wa.single_irq_only) {
+		cam_fd_soc_register_write(&fd_hw->soc_info, CAM_FD_REG_WRAPPER,
+			hw_static_info->wrapper_regs.irq_mask,
+			CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE));
+	}
+
+	if (start_args->num_hw_update_entries > 0) {
+		struct cam_cdm_bl_request *cdm_cmd = ctx_hw_private->cdm_cmd;
+		struct cam_hw_update_entry *cmd;
+		int i;
+
+		cdm_cmd->cmd_arrary_count = start_args->num_hw_update_entries;
+		cdm_cmd->type = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+		cdm_cmd->flag = false;
+		cdm_cmd->userdata = NULL;
+		cdm_cmd->cookie = 0;
+		cdm_cmd->gen_irq_arb = false;
+
+		for (i = 0 ; i <= start_args->num_hw_update_entries; i++) {
+			cmd = (start_args->hw_update_entries + i);
+			cdm_cmd->cmd_flex[i].bl_addr.mem_handle = cmd->handle;
+			cdm_cmd->cmd_flex[i].offset = cmd->offset;
+			cdm_cmd->cmd_flex[i].len = cmd->len;
+			cdm_cmd->cmd_flex[i].arbitrate = false;
+		}
+
+		rc = cam_cdm_submit_bls(ctx_hw_private->cdm_handle, cdm_cmd);
+		if (rc) {
+			CAM_ERR(CAM_FD,
+				"Failed to submit cdm commands, rc=%d", rc);
+			goto error;
+		}
+	} else {
+		CAM_ERR(CAM_FD, "Invalid number of hw update entries");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	return 0;
+error:
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	return rc;
+}
+
+int cam_fd_hw_halt_reset(void *hw_priv, void *stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_static_info *hw_static_info;
+	struct cam_hw_soc_info *soc_info;
+	unsigned long flags;
+	int rc;
+
+	if (!fd_hw) {
+		CAM_ERR(CAM_FD, "Invalid input handle");
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	hw_static_info = fd_core->hw_static_info;
+	soc_info = &fd_hw->soc_info;
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	if ((fd_core->core_state == CAM_FD_CORE_STATE_POWERDOWN) ||
+		(fd_core->core_state == CAM_FD_CORE_STATE_RESET_PROGRESS)) {
+		CAM_ERR(CAM_FD, "Reset not allowed in %d state",
+			fd_core->core_state);
+		spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+		return -EINVAL;
+	}
+
+	fd_core->results_valid = false;
+	fd_core->core_state = CAM_FD_CORE_STATE_RESET_PROGRESS;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.cgc_disable, 0x1);
+
+	rc = cam_fd_hw_util_fdwrapper_halt(fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in HALT rc=%d", rc);
+		return rc;
+	}
+
+	/* HALT must be followed by RESET */
+	rc = cam_fd_hw_util_fdwrapper_sync_reset(fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in RESET rc=%d", rc);
+		return rc;
+	}
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.cgc_disable, 0x0);
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	return rc;
+}
+
+int cam_fd_hw_reserve(void *hw_priv, void *hw_reserve_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	int rc = -EINVAL;
+	struct cam_fd_ctx_hw_private *ctx_hw_private;
+	struct cam_fd_hw_reserve_args *reserve_args =
+		(struct cam_fd_hw_reserve_args *)hw_reserve_args;
+	struct cam_cdm_acquire_data cdm_acquire;
+	struct cam_cdm_bl_request *cdm_cmd;
+	int i;
+
+	if (!fd_hw || !reserve_args) {
+		CAM_ERR(CAM_FD, "Invalid input %pK, %pK", fd_hw, reserve_args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_reserve_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_reserve_args));
+		return -EINVAL;
+	}
+
+	cdm_cmd = kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+			((CAM_FD_MAX_HW_ENTRIES - 1) *
+			sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+	if (!cdm_cmd)
+		return -ENOMEM;
+
+	ctx_hw_private = kzalloc(sizeof(struct cam_fd_ctx_hw_private),
+		GFP_KERNEL);
+	if (!ctx_hw_private) {
+		kfree(cdm_cmd);
+		return -ENOMEM;
+	}
+
+	memset(&cdm_acquire, 0, sizeof(cdm_acquire));
+	strscpy(cdm_acquire.identifier, "fd", sizeof("fd"));
+	cdm_acquire.cell_index = fd_hw->soc_info.index;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = ctx_hw_private;
+	cdm_acquire.cam_cdm_callback = cam_fd_hw_util_cdm_callback;
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.base_array_cnt = fd_hw->soc_info.num_reg_map;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	for (i = 0; i < fd_hw->soc_info.num_reg_map; i++)
+		cdm_acquire.base_array[i] = &fd_hw->soc_info.reg_map[i];
+
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to acquire the CDM HW");
+		goto error;
+	}
+
+	ctx_hw_private->hw_ctx = reserve_args->hw_ctx;
+	ctx_hw_private->fd_hw = fd_hw;
+	ctx_hw_private->mode = reserve_args->mode;
+	ctx_hw_private->cdm_handle = cdm_acquire.handle;
+	ctx_hw_private->cdm_ops = cdm_acquire.ops;
+	ctx_hw_private->cdm_cmd = cdm_cmd;
+
+	reserve_args->ctx_hw_private = ctx_hw_private;
+
+	CAM_DBG(CAM_FD, "private=%pK, hw_ctx=%pK, mode=%d, cdm_handle=0x%x",
+		ctx_hw_private, ctx_hw_private->hw_ctx, ctx_hw_private->mode,
+		ctx_hw_private->cdm_handle);
+
+	return 0;
+error:
+	kfree(ctx_hw_private);
+	kfree(cdm_cmd);
+	return rc;
+}
+
+int cam_fd_hw_release(void *hw_priv, void *hw_release_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	int rc = -EINVAL;
+	struct cam_fd_ctx_hw_private *ctx_hw_private;
+	struct cam_fd_hw_release_args *release_args =
+		(struct cam_fd_hw_release_args *)hw_release_args;
+
+	if (!fd_hw || !release_args) {
+		CAM_ERR(CAM_FD, "Invalid input %pK, %pK", fd_hw, release_args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_release_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_release_args));
+		return -EINVAL;
+	}
+
+	ctx_hw_private =
+		(struct cam_fd_ctx_hw_private *)release_args->ctx_hw_private;
+
+	rc = cam_cdm_release(ctx_hw_private->cdm_handle);
+	if (rc)
+		CAM_ERR(CAM_FD, "Release cdm handle failed, handle=0x%x, rc=%d",
+			ctx_hw_private->cdm_handle, rc);
+
+	kfree(ctx_hw_private->cdm_cmd);
+	kfree(ctx_hw_private);
+	release_args->ctx_hw_private = NULL;
+
+	return 0;
+}
+
+int cam_fd_hw_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	int rc = -EINVAL;
+
+	if (!hw_priv || !cmd_args ||
+		(cmd_type >= CAM_FD_HW_CMD_MAX)) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK %d", hw_priv,
+			cmd_args, cmd_type);
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_FD_HW_CMD_REGISTER_CALLBACK: {
+		struct cam_fd_hw_cmd_set_irq_cb *irq_cb_args;
+		struct cam_fd_core *fd_core =
+			(struct cam_fd_core *)fd_hw->core_info;
+
+		if (sizeof(struct cam_fd_hw_cmd_set_irq_cb) != arg_size) {
+			CAM_ERR(CAM_FD, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		irq_cb_args = (struct cam_fd_hw_cmd_set_irq_cb *)cmd_args;
+		fd_core->irq_cb.cam_fd_hw_mgr_cb =
+			irq_cb_args->cam_fd_hw_mgr_cb;
+		fd_core->irq_cb.data = irq_cb_args->data;
+		rc = 0;
+		break;
+	}
+	case CAM_FD_HW_CMD_PRESTART: {
+		struct cam_fd_hw_cmd_prestart_args *prestart_args;
+
+		if (sizeof(struct cam_fd_hw_cmd_prestart_args) != arg_size) {
+			CAM_ERR(CAM_FD, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		prestart_args = (struct cam_fd_hw_cmd_prestart_args *)cmd_args;
+		rc = cam_fd_hw_util_processcmd_prestart(fd_hw, prestart_args);
+		break;
+	}
+	case CAM_FD_HW_CMD_FRAME_DONE: {
+		struct cam_fd_hw_frame_done_args *cmd_frame_results;
+
+		if (sizeof(struct cam_fd_hw_frame_done_args) !=
+			arg_size) {
+			CAM_ERR(CAM_FD, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		cmd_frame_results =
+			(struct cam_fd_hw_frame_done_args *)cmd_args;
+		rc = cam_fd_hw_util_processcmd_frame_done(fd_hw,
+			cmd_frame_results);
+		break;
+	}
+	case CAM_FD_HW_CMD_HW_DUMP: {
+		rc = cam_fd_hw_util_processcmd_hw_dump(fd_hw,
+			cmd_args);
+		break;
+	}
+	default:
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.h
@@ -0,0 +1,239 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_CORE_H_
+#define _CAM_FD_HW_CORE_H_
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_defs.h>
+#include <media/cam_fd.h>
+
+#include "cam_common_util.h"
+#include "cam_debug_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_fd_hw_intf.h"
+#include "cam_fd_hw_soc.h"
+
+#define CAM_FD_IRQ_TO_MASK(irq)        (1 << (irq))
+#define CAM_FD_MASK_TO_IRQ(mask, irq)  ((mask) >> (irq))
+
+#define CAM_FD_HW_HALT_RESET_TIMEOUT   750
+
+/**
+ * enum cam_fd_core_state - FD Core internal states
+ *
+ * @CAM_FD_CORE_STATE_POWERDOWN       : Indicates FD core is powered down
+ * @CAM_FD_CORE_STATE_IDLE            : Indicates FD HW is in idle state.
+ *                                      Core can be in this state when it is
+ *                                      ready to process frames or when
+ *                                      processing is finished and results are
+ *                                      available
+ * @CAM_FD_CORE_STATE_PROCESSING      : Indicates FD core is processing frame
+ * @CAM_FD_CORE_STATE_READING_RESULTS : Indicates results are being read from
+ *                                      FD core
+ * @CAM_FD_CORE_STATE_RESET_PROGRESS  :  Indicates FD Core is in reset state
+ */
+enum cam_fd_core_state {
+	CAM_FD_CORE_STATE_POWERDOWN,
+	CAM_FD_CORE_STATE_IDLE,
+	CAM_FD_CORE_STATE_PROCESSING,
+	CAM_FD_CORE_STATE_READING_RESULTS,
+	CAM_FD_CORE_STATE_RESET_PROGRESS,
+};
+
+/**
+ * struct cam_fd_ctx_hw_private : HW private information for a specific hw ctx.
+ *                                This information is populated by HW layer on
+ *                                reserve() and given back to HW Mgr as private
+ *                                data for the hw context. This private_data
+ *                                has to be passed by HW Mgr layer while
+ *                                further HW layer calls
+ *
+ * @hw_ctx           : Corresponding hw_ctx pointer
+ * @fd_hw            : FD HW info pointer
+ * @cdm_handle       : CDM Handle for this context
+ * @cdm_ops          : CDM Ops
+ * @cdm_cmd          : CDM command pointer
+ * @mode             : Mode this context is running
+ * @curr_req_private : Current Request information
+ *
+ */
+struct cam_fd_ctx_hw_private {
+	void                          *hw_ctx;
+	struct cam_hw_info            *fd_hw;
+	uint32_t                       cdm_handle;
+	struct cam_cdm_utils_ops      *cdm_ops;
+	struct cam_cdm_bl_request     *cdm_cmd;
+	enum cam_fd_hw_mode            mode;
+	struct cam_fd_hw_req_private  *curr_req_private;
+};
+
+/**
+ * struct cam_fd_core_regs : FD HW Core register offsets info
+ *
+ * @version              : Offset of version register
+ * @control              : Offset of control register
+ * @result_cnt           : Offset of result count register
+ * @result_addr          : Offset of results address register
+ * @image_addr           : Offset of image address register
+ * @work_addr            : Offset of work address register
+ * @ro_mode              : Offset of ro_mode register
+ * @results_reg_base     : Offset of results_reg_base register
+ * @raw_results_reg_base : Offset of raw_results_reg_base register
+ *
+ */
+struct cam_fd_core_regs {
+	uint32_t       version;
+	uint32_t       control;
+	uint32_t       result_cnt;
+	uint32_t       result_addr;
+	uint32_t       image_addr;
+	uint32_t       work_addr;
+	uint32_t       ro_mode;
+	uint32_t       results_reg_base;
+	uint32_t       raw_results_reg_base;
+};
+
+/**
+ * struct cam_fd_core_regs : FD HW Wrapper register offsets info
+ *
+ * @wrapper_version     : Offset of wrapper_version register
+ * @cgc_disable         : Offset of cgc_disable register
+ * @hw_stop             : Offset of hw_stop register
+ * @sw_reset            : Offset of sw_reset register
+ * @vbif_req_priority   : Offset of vbif_req_priority register
+ * @vbif_priority_level : Offset of vbif_priority_level register
+ * @vbif_done_status    : Offset of vbif_done_status register
+ * @irq_mask            : Offset of irq mask register
+ * @irq_status          : Offset of irq status register
+ * @irq_clear           : Offset of irq clear register
+ *
+ */
+struct cam_fd_wrapper_regs {
+	uint32_t       wrapper_version;
+	uint32_t       cgc_disable;
+	uint32_t       hw_stop;
+	uint32_t       sw_reset;
+	uint32_t       vbif_req_priority;
+	uint32_t       vbif_priority_level;
+	uint32_t       vbif_done_status;
+	uint32_t       irq_mask;
+	uint32_t       irq_status;
+	uint32_t       irq_clear;
+};
+
+/**
+ * struct cam_fd_hw_errata_wa : FD HW Errata workaround enable/dsiable info
+ *
+ * @single_irq_only         : Whether to enable only one irq at any time
+ * @ro_mode_enable_always   : Whether to enable ro mode always
+ * @ro_mode_results_invalid : Whether results written directly into output
+ *                            memory by HW are valid or not
+ * @skip_reset              : Whether to skip reset during init
+ */
+struct cam_fd_hw_errata_wa {
+	bool   single_irq_only;
+	bool   ro_mode_enable_always;
+	bool   ro_mode_results_invalid;
+	bool   skip_reset;
+};
+
+/**
+ * struct cam_fd_hw_results_prop : FD HW Results properties
+ *
+ * @max_faces             : Maximum number of faces supported
+ * @per_face_entries      : Number of register with properties for each face
+ * @raw_results_entries   : Number of raw results entries for the full search
+ * @raw_results_available : Whether raw results available on this HW
+ *
+ */
+struct cam_fd_hw_results_prop {
+	uint32_t       max_faces;
+	uint32_t       per_face_entries;
+	uint32_t       raw_results_entries;
+	bool           raw_results_available;
+};
+
+/**
+ * struct cam_fd_hw_static_info : FD HW information based on HW version
+ *
+ * @core_version       : Core version of FD HW
+ * @wrapper_version    : Wrapper version of FD HW
+ * @core_regs          : Register offset information for core registers
+ * @wrapper_regs       : Register offset information for wrapper registers
+ * @results            : Information about results available on this HW
+ * @enable_errata_wa   : Errata workaround information
+ * @irq_mask           : IRQ mask to enable
+ * @qos_priority       : QoS priority setting for this chipset
+ * @qos_priority_level : QoS priority level setting for this chipset
+ * @supported_modes    : Supported HW modes on this HW version
+ * @ro_mode_supported  : Whether RO mode is supported on this HW
+ *
+ */
+struct cam_fd_hw_static_info {
+	struct cam_hw_version          core_version;
+	struct cam_hw_version          wrapper_version;
+	struct cam_fd_core_regs        core_regs;
+	struct cam_fd_wrapper_regs     wrapper_regs;
+	struct cam_fd_hw_results_prop  results;
+	struct cam_fd_hw_errata_wa     enable_errata_wa;
+	uint32_t                       irq_mask;
+	uint32_t                       qos_priority;
+	uint32_t                       qos_priority_level;
+	uint32_t                       supported_modes;
+	bool                           ro_mode_supported;
+};
+
+/**
+ * struct cam_fd_core : FD HW core data structure
+ *
+ * @hw_static_info      : HW information specific to version
+ * @hw_caps             : HW capabilities
+ * @core_state          : Current HW state
+ * @processing_complete : Whether processing is complete
+ * @reset_complete      : Whether reset is complete
+ * @halt_complete       : Whether halt is complete
+ * @hw_req_private      : Request that is being currently processed by HW
+ * @results_valid       : Whether HW frame results are available to get
+ * @spin_lock           : Mutex to protect shared data in hw layer
+ * @irq_cb              : HW Manager callback information
+ *
+ */
+struct cam_fd_core {
+	struct cam_fd_hw_static_info   *hw_static_info;
+	struct cam_fd_hw_caps           hw_caps;
+	enum cam_fd_core_state          core_state;
+	struct completion               processing_complete;
+	struct completion               reset_complete;
+	struct completion               halt_complete;
+	struct cam_fd_hw_req_private   *hw_req_private;
+	bool                            results_valid;
+	spinlock_t                      spin_lock;
+	struct cam_fd_hw_cmd_set_irq_cb irq_cb;
+};
+
+int cam_fd_hw_util_get_hw_caps(struct cam_hw_info *fd_hw,
+	struct cam_fd_hw_caps *hw_caps);
+irqreturn_t cam_fd_hw_irq(int irq_num, void *data);
+
+int cam_fd_hw_get_hw_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size);
+int cam_fd_hw_init(void *hw_priv, void *init_hw_args, uint32_t arg_size);
+int cam_fd_hw_deinit(void *hw_priv, void *deinit_hw_args, uint32_t arg_size);
+int cam_fd_hw_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size);
+int cam_fd_hw_reserve(void *hw_priv, void *hw_reserve_args, uint32_t arg_size);
+int cam_fd_hw_release(void *hw_priv, void *hw_release_args, uint32_t arg_size);
+int cam_fd_hw_start(void *hw_priv, void *hw_start_args, uint32_t arg_size);
+int cam_fd_hw_halt_reset(void *hw_priv, void *stop_args, uint32_t arg_size);
+int cam_fd_hw_read(void *hw_priv, void *read_args, uint32_t arg_size);
+int cam_fd_hw_write(void *hw_priv, void *write_args, uint32_t arg_size);
+int cam_fd_hw_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+#endif /* _CAM_FD_HW_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_dev.c
@@ -0,0 +1,253 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_subdev.h"
+#include "cam_fd_hw_intf.h"
+#include "cam_fd_hw_core.h"
+#include "cam_fd_hw_soc.h"
+#include "cam_fd_hw_v41.h"
+#include "cam_fd_hw_v501.h"
+#include "cam_fd_hw_v600.h"
+#include "camera_main.h"
+
+static int cam_fd_hw_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *fd_hw;
+	struct cam_hw_intf *fd_hw_intf;
+	struct cam_fd_core *fd_core;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_fd_hw_static_info *hw_static_info = NULL;
+	int rc = 0;
+	uint32_t hw_idx;
+	struct cam_fd_hw_init_args init_args;
+	struct cam_fd_hw_deinit_args deinit_args;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	fd_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!fd_hw_intf)
+		return -ENOMEM;
+
+	fd_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!fd_hw) {
+		kfree(fd_hw_intf);
+		return -ENOMEM;
+	}
+
+	fd_core = kzalloc(sizeof(struct cam_fd_core), GFP_KERNEL);
+	if (!fd_core) {
+		kfree(fd_hw);
+		kfree(fd_hw_intf);
+		return -ENOMEM;
+	}
+	of_property_read_u32(pdev->dev.of_node,
+			"cell-index", &hw_idx);
+
+	fd_hw_intf->hw_priv = fd_hw;
+	fd_hw->core_info = fd_core;
+	fd_hw_intf->hw_idx = hw_idx;
+
+	fd_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	fd_hw->soc_info.pdev = pdev;
+	fd_hw->soc_info.dev = &pdev->dev;
+	fd_hw->soc_info.dev_name = pdev->name;
+	fd_hw->open_count = 0;
+	mutex_init(&fd_hw->hw_mutex);
+	spin_lock_init(&fd_hw->hw_lock);
+	init_completion(&fd_hw->hw_complete);
+
+	spin_lock_init(&fd_core->spin_lock);
+	init_completion(&fd_core->processing_complete);
+	init_completion(&fd_core->halt_complete);
+	init_completion(&fd_core->reset_complete);
+
+	fd_hw_intf->hw_ops.get_hw_caps = cam_fd_hw_get_hw_caps;
+	fd_hw_intf->hw_ops.init = cam_fd_hw_init;
+	fd_hw_intf->hw_ops.deinit = cam_fd_hw_deinit;
+	fd_hw_intf->hw_ops.reset = cam_fd_hw_reset;
+	fd_hw_intf->hw_ops.reserve = cam_fd_hw_reserve;
+	fd_hw_intf->hw_ops.release = cam_fd_hw_release;
+	fd_hw_intf->hw_ops.start = cam_fd_hw_start;
+	fd_hw_intf->hw_ops.stop = cam_fd_hw_halt_reset;
+	fd_hw_intf->hw_ops.read = NULL;
+	fd_hw_intf->hw_ops.write = NULL;
+	fd_hw_intf->hw_ops.process_cmd = cam_fd_hw_process_cmd;
+	fd_hw_intf->hw_type = CAM_HW_FD;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev || !match_dev->data) {
+		CAM_ERR(CAM_FD, "No Of_match data, %pK", match_dev);
+		rc = -EINVAL;
+		goto free_memory;
+	}
+	hw_static_info = (struct cam_fd_hw_static_info *)match_dev->data;
+	fd_core->hw_static_info = hw_static_info;
+
+	CAM_DBG(CAM_FD, "HW Static Info : version core[%d.%d] wrapper[%d.%d]",
+		hw_static_info->core_version.major,
+		hw_static_info->core_version.minor,
+		hw_static_info->wrapper_version.major,
+		hw_static_info->wrapper_version.minor);
+
+	rc = cam_fd_soc_init_resources(&fd_hw->soc_info, cam_fd_hw_irq, fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to init soc, rc=%d", rc);
+		goto free_memory;
+	}
+
+	memset(&init_args, 0x0, sizeof(init_args));
+	memset(&deinit_args, 0x0, sizeof(deinit_args));
+	init_args.reset_required = true;
+	rc = cam_fd_hw_init(fd_hw, &init_args, sizeof(init_args));
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to hw init, rc=%d", rc);
+		goto deinit_platform_res;
+	}
+
+	rc = cam_fd_hw_util_get_hw_caps(fd_hw, &fd_core->hw_caps);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to get hw caps, rc=%d", rc);
+		goto deinit_hw;
+	}
+
+	rc = cam_fd_hw_deinit(fd_hw, &deinit_args, sizeof(deinit_args));
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to deinit hw, rc=%d", rc);
+		goto deinit_platform_res;
+	}
+
+	platform_set_drvdata(pdev, fd_hw_intf);
+	CAM_DBG(CAM_FD, "FD:%d component bound successfully",
+		fd_hw_intf->hw_idx);
+
+	return rc;
+
+deinit_hw:
+	if (cam_fd_hw_deinit(fd_hw, &deinit_args, sizeof(deinit_args)))
+		CAM_ERR(CAM_FD, "Failed in hw deinit");
+deinit_platform_res:
+	if (cam_fd_soc_deinit_resources(&fd_hw->soc_info))
+		CAM_ERR(CAM_FD, "Failed in soc deinit");
+	mutex_destroy(&fd_hw->hw_mutex);
+free_memory:
+	kfree(fd_hw);
+	kfree(fd_hw_intf);
+	kfree(fd_core);
+
+	return rc;
+}
+
+static void cam_fd_hw_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct cam_hw_intf *fd_hw_intf;
+	struct cam_hw_info *fd_hw;
+	struct cam_fd_core *fd_core;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	fd_hw_intf = platform_get_drvdata(pdev);
+	if (!fd_hw_intf) {
+		CAM_ERR(CAM_FD, "Invalid fd_hw_intf from pdev");
+		return;
+	}
+
+	fd_hw = fd_hw_intf->hw_priv;
+	if (!fd_hw) {
+		CAM_ERR(CAM_FD, "Invalid fd_hw from fd_hw_intf");
+		goto free_fd_hw_intf;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	if (!fd_core) {
+		CAM_ERR(CAM_FD, "Invalid fd_core from fd_hw");
+		goto deinit_platform_res;
+	}
+
+	kfree(fd_core);
+
+deinit_platform_res:
+	rc = cam_fd_soc_deinit_resources(&fd_hw->soc_info);
+	if (rc)
+		CAM_ERR(CAM_FD, "Error in FD soc deinit, rc=%d", rc);
+
+	mutex_destroy(&fd_hw->hw_mutex);
+	kfree(fd_hw);
+
+free_fd_hw_intf:
+	kfree(fd_hw_intf);
+}
+
+const static struct component_ops cam_fd_hw_dev_component_ops = {
+	.bind = cam_fd_hw_dev_component_bind,
+	.unbind = cam_fd_hw_dev_component_unbind,
+};
+
+static int cam_fd_hw_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_FD, "Adding FD HW dev component");
+	rc = component_add(&pdev->dev, &cam_fd_hw_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_FD, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_fd_hw_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_fd_hw_dev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_fd_hw_dt_match[] = {
+	{
+		.compatible = "qcom,fd41",
+		.data = &cam_fd_wrapper120_core410_info,
+	},
+	{
+		.compatible = "qcom,fd501",
+		.data = &cam_fd_wrapper200_core501_info,
+	},
+	{
+		.compatible = "qcom,fd600",
+		.data = &cam_fd_wrapper200_core600_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_fd_hw_dt_match);
+
+struct platform_driver cam_fd_hw_driver = {
+	.probe = cam_fd_hw_dev_probe,
+	.remove = cam_fd_hw_dev_remove,
+	.driver = {
+		.name = "cam_fd_hw",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_fd_hw_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_fd_hw_init_module(void)
+{
+	return platform_driver_register(&cam_fd_hw_driver);
+}
+
+void cam_fd_hw_exit_module(void)
+{
+	platform_driver_unregister(&cam_fd_hw_driver);
+}
+
+MODULE_DESCRIPTION("CAM FD HW driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_intf.h
@@ -0,0 +1,331 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_INTF_H_
+#define _CAM_FD_HW_INTF_H_
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_fd.h>
+
+#include "cam_io_util.h"
+#include "cam_soc_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_subdev.h"
+#include "cam_cpas_api.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+
+#define CAM_FD_MAX_IO_BUFFERS        5
+#define CAM_FD_MAX_HW_ENTRIES        5
+#define CAM_FD_HW_DUMP_TAG_MAX_LEN   128
+#define CAM_FD_HW_DUMP_NUM_WORDS     5
+
+/**
+ * enum cam_fd_hw_type - Enum for FD HW type
+ *
+ * @CAM_HW_FD : FaceDetection HW type
+ */
+enum cam_fd_hw_type {
+	CAM_HW_FD,
+};
+
+/**
+ * enum cam_fd_hw_mode - Mode in which HW can run
+ *
+ * @CAM_FD_MODE_FACEDETECTION : Face Detection mode in which face search
+ *                              is done on the given frame
+ * @CAM_FD_MODE_PYRAMID       : Pyramid mode where a pyramid image is generated
+ *                              from an input image
+ */
+enum cam_fd_hw_mode {
+	CAM_FD_MODE_FACEDETECTION    = 0x1,
+	CAM_FD_MODE_PYRAMID          = 0x2,
+};
+
+/**
+ * enum cam_fd_priority - FD priority levels
+ *
+ * @CAM_FD_PRIORITY_HIGH   : Indicates high priority client, driver prioritizes
+ *                           frame requests coming from contexts with HIGH
+ *                           priority compared to context with normal priority
+ * @CAM_FD_PRIORITY_NORMAL : Indicates normal priority client
+ */
+enum cam_fd_priority {
+	CAM_FD_PRIORITY_HIGH         = 0x0,
+	CAM_FD_PRIORITY_NORMAL,
+};
+
+/**
+ * enum cam_fd_hw_irq_type - FD HW IRQ types
+ *
+ * @CAM_FD_IRQ_FRAME_DONE : Indicates frame processing is finished
+ * @CAM_FD_IRQ_HALT_DONE  : Indicates HW halt is finished
+ * @CAM_FD_IRQ_RESET_DONE : Indicates HW reset is finished
+ */
+enum cam_fd_hw_irq_type {
+	CAM_FD_IRQ_FRAME_DONE,
+	CAM_FD_IRQ_HALT_DONE,
+	CAM_FD_IRQ_RESET_DONE,
+};
+
+/**
+ * enum cam_fd_hw_cmd_type - FD HW layer custom commands
+ *
+ * @CAM_FD_HW_CMD_PRESTART          : Command to process pre-start settings
+ * @CAM_FD_HW_CMD_FRAME_DONE        : Command to process frame done settings
+ * @CAM_FD_HW_CMD_UPDATE_SOC        : Command to process soc update
+ * @CAM_FD_HW_CMD_REGISTER_CALLBACK : Command to set hw mgr callback
+ * @CAM_FD_HW_CMD_MAX               : Indicates max cmd
+ * @CAM_FD_HW_CMD_HW_DUMP           : Command to dump fd hw information
+ */
+enum cam_fd_hw_cmd_type {
+	CAM_FD_HW_CMD_PRESTART,
+	CAM_FD_HW_CMD_FRAME_DONE,
+	CAM_FD_HW_CMD_UPDATE_SOC,
+	CAM_FD_HW_CMD_REGISTER_CALLBACK,
+	CAM_FD_HW_CMD_HW_DUMP,
+	CAM_FD_HW_CMD_MAX,
+};
+
+/**
+ * struct cam_fd_hw_io_buffer : FD HW IO Buffer information
+ *
+ * @valid    : Whether this IO Buf configuration is valid
+ * @io_cfg   : IO Configuration information
+ * @num_buf  : Number planes in io_addr, cpu_addr array
+ * @io_addr  : Array of IO address information for planes
+ * @cpu_addr : Array of CPU address information for planes
+ */
+struct cam_fd_hw_io_buffer {
+	bool                   valid;
+	struct cam_buf_io_cfg *io_cfg;
+	uint32_t               num_buf;
+	uint64_t               io_addr[CAM_PACKET_MAX_PLANES];
+	uintptr_t              cpu_addr[CAM_PACKET_MAX_PLANES];
+};
+
+/**
+ * struct cam_fd_hw_req_private : FD HW layer's private information
+ *               specific to a request
+ *
+ * @ctx_hw_private  : FD HW layer's ctx specific private data
+ * @request_id      : Request ID corresponding to this private information
+ * @get_raw_results : Whether to get raw results for this request
+ * @ro_mode_enabled : Whether RO mode is enabled for this request
+ * @fd_results      : Pointer to save face detection results
+ * @raw_results     : Pointer to save face detection raw results
+ */
+struct cam_fd_hw_req_private {
+	void                  *ctx_hw_private;
+	uint64_t               request_id;
+	bool                   get_raw_results;
+	bool                   ro_mode_enabled;
+	struct cam_fd_results *fd_results;
+	uint32_t              *raw_results;
+};
+
+/**
+ * struct cam_fd_hw_reserve_args : Reserve args for this HW context
+ *
+ * @hw_ctx         : HW context for which reserve is requested
+ * @mode           : Mode for which this reserve is requested
+ * @ctx_hw_private : Pointer to save HW layer's private information specific
+ *                   to this hw context. This has to be passed while calling
+ *                   further HW layer calls
+ */
+struct cam_fd_hw_reserve_args {
+	void                  *hw_ctx;
+	enum cam_fd_hw_mode    mode;
+	void                  *ctx_hw_private;
+};
+
+/**
+ * struct cam_fd_hw_release_args : Release args for this HW context
+ *
+ * @hw_ctx         : HW context for which release is requested
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ */
+struct cam_fd_hw_release_args {
+	void    *hw_ctx;
+	void    *ctx_hw_private;
+};
+
+/**
+ * struct cam_fd_hw_init_args : Init args for this HW context
+ *
+ * @hw_ctx         : HW context for which init is requested
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ * @reset_required : Indicates if the reset is required during init or not
+ * @is_hw_reset    : Output from hw layer, whether hw is reset on this init
+ */
+struct cam_fd_hw_init_args {
+	void    *hw_ctx;
+	void    *ctx_hw_private;
+	bool     reset_required;
+	bool     is_hw_reset;
+};
+
+/**
+ * struct cam_fd_hw_deinit_args : Deinit args for this HW context
+ *
+ * @hw_ctx         : HW context for which deinit is requested
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ */
+struct cam_fd_hw_deinit_args {
+	void    *hw_ctx;
+	void    *ctx_hw_private;
+};
+
+/**
+ * struct cam_fd_hw_cmd_prestart_args : Prestart command args
+ *
+ * @hw_ctx               : HW context which submitted this prestart
+ * @ctx_hw_private       : HW layer's private information specific to
+ *                         this hw context
+ * @request_id           : Request ID corresponds to this pre-start command
+ * @get_raw_results      : Whether to get raw results for this request
+ * @input_buf            : Input IO Buffer information for this request
+ * @output_buf           : Output IO Buffer information for this request
+ * @cmd_buf_addr         : Command buffer address to fill kmd commands
+ * @size                 : Size available in command buffer
+ * @pre_config_buf_size  : Buffer size filled with commands by KMD that has
+ *                         to be inserted before umd commands
+ * @post_config_buf_size : Buffer size filled with commands by KMD that has
+ *                         to be inserted after umd commands
+ * @hw_req_private       : HW layer's private information specific to
+ *                         this request
+ */
+struct cam_fd_hw_cmd_prestart_args {
+	void                         *hw_ctx;
+	void                         *ctx_hw_private;
+	uint64_t                      request_id;
+	bool                          get_raw_results;
+	struct cam_fd_hw_io_buffer    input_buf[CAM_FD_MAX_IO_BUFFERS];
+	struct cam_fd_hw_io_buffer    output_buf[CAM_FD_MAX_IO_BUFFERS];
+	uint32_t                     *cmd_buf_addr;
+	uint32_t                      size;
+	uint32_t                      pre_config_buf_size;
+	uint32_t                      post_config_buf_size;
+	struct cam_fd_hw_req_private  hw_req_private;
+};
+
+/**
+ * struct cam_fd_hw_cmd_start_args : Start command args
+ *
+ * @hw_ctx                : HW context which submitting start command
+ * @ctx_hw_private        : HW layer's private information specific to
+ *                            this hw context
+ * @hw_req_private        : HW layer's private information specific to
+ *          this request
+ * @hw_update_entries     : HW update entries corresponds to this request
+ * @num_hw_update_entries : Number of hw update entries
+ */
+struct cam_fd_hw_cmd_start_args {
+	void                          *hw_ctx;
+	void                          *ctx_hw_private;
+	struct cam_fd_hw_req_private  *hw_req_private;
+	struct cam_hw_update_entry    *hw_update_entries;
+	uint32_t                       num_hw_update_entries;
+};
+
+/**
+ * struct cam_fd_hw_stop_args : Stop command args
+ *
+ * @hw_ctx         : HW context which submitting stop command
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ * @request_id     : Request ID that need to be stopped
+ * @hw_req_private : HW layer's private information specific to this request
+ */
+struct cam_fd_hw_stop_args {
+	void                         *hw_ctx;
+	void                         *ctx_hw_private;
+	uint64_t                      request_id;
+	struct cam_fd_hw_req_private *hw_req_private;
+};
+
+/**
+ * struct cam_fd_hw_frame_done_args : Frame done command args
+ *
+ * @hw_ctx         : HW context which submitting frame done request
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ * @request_id     : Request ID that need to be stopped
+ * @hw_req_private : HW layer's private information specific to this request
+ */
+struct cam_fd_hw_frame_done_args {
+	void                         *hw_ctx;
+	void                         *ctx_hw_private;
+	uint64_t                      request_id;
+	struct cam_fd_hw_req_private *hw_req_private;
+};
+
+/**
+ * struct cam_fd_hw_reset_args : Reset command args
+ *
+ * @hw_ctx         : HW context which submitting reset command
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ */
+struct cam_fd_hw_reset_args {
+	void    *hw_ctx;
+	void    *ctx_hw_private;
+};
+
+/**
+ * struct cam_fd_hw_cmd_set_irq_cb : Set IRQ callback command args
+ *
+ * @cam_fd_hw_mgr_cb : HW Mgr's callback pointer
+ * @data             : HW Mgr's private data
+ */
+struct cam_fd_hw_cmd_set_irq_cb {
+	int (*cam_fd_hw_mgr_cb)(void *data, enum cam_fd_hw_irq_type irq_type);
+	void *data;
+};
+
+/**
+ * struct cam_fd_hw_dump_args : Args for dump request
+ *
+ * @request_id   : Issue request id
+ * @offset       : offset of the buffer
+ * @buf_len      : Length of target buffer
+ * @cpu_addr     : start address of the target buffer
+ */
+struct cam_fd_hw_dump_args {
+	uint64_t  request_id;
+	size_t    offset;
+	size_t    buf_len;
+	uintptr_t cpu_addr;
+};
+
+/**
+ * struct cam_fd_hw_dump_header : fd hw dump header
+ *
+ * @tag       : fd hw dump header tag
+ * @size      : Size of data
+ * @word_size : size of each word
+ */
+struct cam_fd_hw_dump_header {
+	uint8_t  tag[CAM_FD_HW_DUMP_TAG_MAX_LEN];
+	uint64_t size;
+	uint32_t word_size;
+};
+
+/**
+ * @brief : API to register FD Hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_fd_hw_init_module(void);
+
+/**
+ * @brief : API to remove FD Hw interface from platform framework.
+ */
+void cam_fd_hw_exit_module(void);
+
+#endif /* _CAM_FD_HW_INTF_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.c
@@ -0,0 +1,260 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/clk/qcom.h>
+
+#include "cam_fd_hw_core.h"
+#include "cam_fd_hw_soc.h"
+
+static bool cam_fd_hw_util_cpas_callback(uint32_t handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	if (!irq_data)
+		return false;
+
+	CAM_DBG(CAM_FD, "CPAS hdl=%d, udata=%pK, irq_type=%d",
+		handle, userdata, irq_data->irq_type);
+
+	return false;
+}
+
+static int cam_fd_hw_soc_util_setup_regbase_indices(
+	struct cam_hw_soc_info *soc_info)
+{
+	struct cam_fd_soc_private *soc_private =
+		(struct cam_fd_soc_private *)soc_info->soc_private;
+	uint32_t index;
+	int rc, i;
+
+	for (i = 0; i < CAM_FD_REG_MAX; i++)
+		soc_private->regbase_index[i] = -1;
+
+	if ((soc_info->num_mem_block > CAM_SOC_MAX_BLOCK) ||
+		(soc_info->num_mem_block != CAM_FD_REG_MAX)) {
+		CAM_ERR(CAM_FD, "Invalid num_mem_block=%d",
+			soc_info->num_mem_block);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "fd_core", &index);
+	if ((rc == 0) && (index < CAM_FD_REG_MAX)) {
+		soc_private->regbase_index[CAM_FD_REG_CORE] = index;
+	} else {
+		CAM_ERR(CAM_FD, "regbase not found for FD_CORE, rc=%d, %d %d",
+			rc, index, CAM_FD_REG_MAX);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "fd_wrapper", &index);
+	if ((rc == 0) && (index < CAM_FD_REG_MAX)) {
+		soc_private->regbase_index[CAM_FD_REG_WRAPPER] = index;
+	} else {
+		CAM_ERR(CAM_FD, "regbase not found FD_WRAPPER, rc=%d, %d %d",
+			rc, index, CAM_FD_REG_MAX);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_FD, "Reg indices : CORE=%d, WRAPPER=%d",
+		soc_private->regbase_index[CAM_FD_REG_CORE],
+		soc_private->regbase_index[CAM_FD_REG_WRAPPER]);
+
+	return 0;
+}
+
+void cam_fd_soc_register_write(struct cam_hw_soc_info *soc_info,
+	enum cam_fd_reg_base reg_base, uint32_t reg_offset, uint32_t reg_value)
+{
+	struct cam_fd_soc_private *soc_private =
+		(struct cam_fd_soc_private *)soc_info->soc_private;
+	int32_t reg_index = soc_private->regbase_index[reg_base];
+
+	CAM_DBG(CAM_FD, "FD_REG_WRITE: Base[%d] Offset[0x%8x] Value[0x%8x]",
+		reg_base, reg_offset, reg_value);
+
+	cam_io_w_mb(reg_value,
+		soc_info->reg_map[reg_index].mem_base + reg_offset);
+}
+
+uint32_t cam_fd_soc_register_read(struct cam_hw_soc_info *soc_info,
+	enum cam_fd_reg_base reg_base, uint32_t reg_offset)
+{
+	struct cam_fd_soc_private *soc_private =
+		(struct cam_fd_soc_private *)soc_info->soc_private;
+	int32_t reg_index = soc_private->regbase_index[reg_base];
+	uint32_t reg_value;
+
+	reg_value = cam_io_r_mb(
+		soc_info->reg_map[reg_index].mem_base + reg_offset);
+
+	CAM_DBG(CAM_FD, "FD_REG_READ: Base[%d] Offset[0x%8x] Value[0x%8x]",
+		reg_base, reg_offset, reg_value);
+
+	return reg_value;
+}
+
+int cam_fd_soc_enable_resources(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_fd_soc_private *soc_private = soc_info->soc_private;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	int rc;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ib_bw = 7200000;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = 7200000;
+	axi_vote.axi_path[1].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[1].mnoc_ib_bw = 7200000;
+
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in CPAS START, rc=%d", rc);
+		return -EFAULT;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		soc_info->lowest_clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error enable platform failed, rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	if (cam_cpas_stop(soc_private->cpas_handle))
+		CAM_ERR(CAM_FD, "Error in CPAS STOP");
+
+	return rc;
+}
+
+
+int cam_fd_soc_disable_resources(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_fd_soc_private *soc_private;
+	int rc = 0;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_FD, "Invalid soc_info param");
+		return -EINVAL;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc) {
+		CAM_ERR(CAM_FD, "disable platform resources failed, rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in CPAS STOP, handle=0x%x, rc=%d",
+			soc_private->cpas_handle, rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_fd_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *private_data)
+{
+	struct cam_fd_soc_private *soc_private;
+	struct cam_cpas_register_params cpas_register_param;
+	int rc, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in get_dt_properties, rc=%d", rc);
+		return rc;
+	}
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = private_data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler, &(irq_data[0]));
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in request_platform_resource rc=%d",
+			rc);
+		return rc;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_fd_soc_private), GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto release_res;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_fd_hw_soc_util_setup_regbase_indices(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in setup regbase, rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "fd", CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = &soc_info->pdev->dev;
+	cpas_register_param.userdata = private_data;
+	cpas_register_param.cam_cpas_client_cb = cam_fd_hw_util_cpas_callback;
+
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_FD, "CPAS registration failed");
+		goto free_soc_private;
+	}
+	soc_private->cpas_handle = cpas_register_param.client_handle;
+	CAM_DBG(CAM_FD, "CPAS handle=%d", soc_private->cpas_handle);
+
+	return rc;
+
+free_soc_private:
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+release_res:
+	cam_soc_util_release_platform_resource(soc_info);
+
+	return rc;
+}
+
+int cam_fd_soc_deinit_resources(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_fd_soc_private *soc_private =
+		(struct cam_fd_soc_private *)soc_info->soc_private;
+	int rc;
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_FD, "Unregister cpas failed, handle=%d, rc=%d",
+			soc_private->cpas_handle, rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_FD, "release platform failed, rc=%d", rc);
+
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_SOC_H_
+#define _CAM_FD_HW_SOC_H_
+
+#include "cam_soc_util.h"
+
+/**
+ * enum cam_fd_reg_base - Enum for FD register sets
+ *
+ * @CAM_FD_REG_CORE    : Indicates FD Core register space
+ * @CAM_FD_REG_WRAPPER : Indicates FD Wrapper register space
+ * @CAM_FD_REG_MAX     : Max number of register sets supported
+ */
+enum cam_fd_reg_base {
+	CAM_FD_REG_CORE,
+	CAM_FD_REG_WRAPPER,
+	CAM_FD_REG_MAX
+};
+
+/**
+ * struct cam_fd_soc_private : FD private SOC information
+ *
+ * @regbase_index : Mapping between Register base enum to register index in SOC
+ * @cpas_handle   : CPAS handle
+ *
+ */
+struct cam_fd_soc_private {
+	int32_t        regbase_index[CAM_FD_REG_MAX];
+	uint32_t       cpas_handle;
+};
+
+int cam_fd_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *private_data);
+int cam_fd_soc_deinit_resources(struct cam_hw_soc_info *soc_info);
+int cam_fd_soc_enable_resources(struct cam_hw_soc_info *soc_info);
+int cam_fd_soc_disable_resources(struct cam_hw_soc_info *soc_info);
+uint32_t cam_fd_soc_register_read(struct cam_hw_soc_info *soc_info,
+	enum cam_fd_reg_base reg_base, uint32_t reg_offset);
+void cam_fd_soc_register_write(struct cam_hw_soc_info *soc_info,
+	enum cam_fd_reg_base reg_base, uint32_t reg_offset, uint32_t reg_value);
+
+#endif /* _CAM_FD_HW_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v41.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v41.h
@@ -0,0 +1,63 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_V41_H_
+#define _CAM_FD_HW_V41_H_
+
+static struct cam_fd_hw_static_info cam_fd_wrapper120_core410_info = {
+	.core_version = {
+		.major  = 4,
+		.minor  = 1,
+		.incr   = 0,
+	},
+	.wrapper_version = {
+		.major  = 1,
+		.minor  = 2,
+		.incr   = 0,
+	},
+	.core_regs = {
+		.version               = 0x38,
+		.control               = 0x0,
+		.result_cnt            = 0x4,
+		.result_addr           = 0x20,
+		.image_addr            = 0x24,
+		.work_addr             = 0x28,
+		.ro_mode               = 0x34,
+		.results_reg_base      = 0x400,
+		.raw_results_reg_base  = 0x800,
+	},
+	.wrapper_regs = {
+		.wrapper_version       = 0x0,
+		.cgc_disable           = 0x4,
+		.hw_stop               = 0x8,
+		.sw_reset              = 0x10,
+		.vbif_req_priority     = 0x20,
+		.vbif_priority_level   = 0x24,
+		.vbif_done_status      = 0x34,
+		.irq_mask              = 0x50,
+		.irq_status            = 0x54,
+		.irq_clear             = 0x58,
+	},
+	.results = {
+		.max_faces             = 35,
+		.per_face_entries      = 4,
+		.raw_results_available = true,
+		.raw_results_entries   = 512,
+	},
+	.enable_errata_wa = {
+		.single_irq_only         = true,
+		.ro_mode_enable_always   = true,
+		.ro_mode_results_invalid = true,
+	},
+	.irq_mask = CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE),
+	.qos_priority       = 4,
+	.qos_priority_level = 4,
+	.supported_modes    = CAM_FD_MODE_FACEDETECTION | CAM_FD_MODE_PYRAMID,
+	.ro_mode_supported  = true,
+};
+
+#endif /* _CAM_FD_HW_V41_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v501.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v501.h
@@ -0,0 +1,64 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_V501_H_
+#define _CAM_FD_HW_V501_H_
+
+static struct cam_fd_hw_static_info cam_fd_wrapper200_core501_info = {
+	.core_version = {
+		.major  = 5,
+		.minor  = 0,
+		.incr   = 1,
+	},
+	.wrapper_version = {
+		.major  = 2,
+		.minor  = 0,
+		.incr   = 0,
+	},
+	.core_regs = {
+		.version               = 0x38,
+		.control               = 0x0,
+		.result_cnt            = 0x4,
+		.result_addr           = 0x20,
+		.image_addr            = 0x24,
+		.work_addr             = 0x28,
+		.ro_mode               = 0x34,
+		.results_reg_base      = 0x400,
+		.raw_results_reg_base  = 0x800,
+	},
+	.wrapper_regs = {
+		.wrapper_version       = 0x0,
+		.cgc_disable           = 0x4,
+		.hw_stop               = 0x8,
+		.sw_reset              = 0x10,
+		.vbif_req_priority     = 0x20,
+		.vbif_priority_level   = 0x24,
+		.vbif_done_status      = 0x34,
+		.irq_mask              = 0x50,
+		.irq_status            = 0x54,
+		.irq_clear             = 0x58,
+	},
+	.results = {
+		.max_faces             = 35,
+		.per_face_entries      = 4,
+		.raw_results_available = true,
+		.raw_results_entries   = 512,
+	},
+	.enable_errata_wa = {
+		.single_irq_only         = true,
+		.ro_mode_enable_always   = true,
+		.ro_mode_results_invalid = true,
+		.skip_reset              = true,
+	},
+	.irq_mask = CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE),
+	.qos_priority       = 4,
+	.qos_priority_level = 4,
+	.supported_modes    = CAM_FD_MODE_FACEDETECTION | CAM_FD_MODE_PYRAMID,
+	.ro_mode_supported  = true,
+};
+
+#endif /* _CAM_FD_HW_V501_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v600.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v600.h
@@ -0,0 +1,61 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_V600_H_
+#define _CAM_FD_HW_V600_H_
+
+static struct cam_fd_hw_static_info cam_fd_wrapper200_core600_info = {
+	.core_version = {
+		.major  = 6,
+		.minor  = 0,
+		.incr   = 0,
+	},
+	.wrapper_version = {
+		.major  = 2,
+		.minor  = 0,
+		.incr   = 0,
+	},
+	.core_regs = {
+		.version               = 0x38,
+		.control               = 0x0,
+		.result_cnt            = 0x4,
+		.result_addr           = 0x20,
+		.image_addr            = 0x24,
+		.work_addr             = 0x28,
+		.ro_mode               = 0x34,
+		.results_reg_base      = 0x400,
+	},
+	.wrapper_regs = {
+		.wrapper_version       = 0x0,
+		.cgc_disable           = 0x4,
+		.hw_stop               = 0x8,
+		.sw_reset              = 0x10,
+		.vbif_req_priority     = 0x20,
+		.vbif_priority_level   = 0x24,
+		.vbif_done_status      = 0x34,
+		.irq_mask              = 0x50,
+		.irq_status            = 0x54,
+		.irq_clear             = 0x58,
+	},
+	.results = {
+		.max_faces             = 35,
+		.per_face_entries      = 4,
+		.raw_results_available = false,
+	},
+	.enable_errata_wa = {
+		.single_irq_only         = true,
+		.ro_mode_enable_always   = true,
+		.ro_mode_results_invalid = true,
+	},
+	.irq_mask = CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE),
+	.qos_priority       = 4,
+	.qos_priority_level = 4,
+	.supported_modes    = CAM_FD_MODE_FACEDETECTION | CAM_FD_MODE_PYRAMID,
+	.ro_mode_supported  = true,
+};
+
+#endif /* _CAM_FD_HW_V600_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/cam_icp_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/cam_icp_context.c
@@ -0,0 +1,572 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <media/cam_sync.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "cam_node.h"
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_icp_context.h"
+#include "cam_req_mgr_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_icp_hw_mgr_intf.h"
+
+static int cam_icp_context_dump_active_request(void *data, void *args)
+{
+	struct cam_context         *ctx = (struct cam_context *)data;
+	struct cam_ctx_request     *req = NULL;
+	struct cam_ctx_request     *req_temp = NULL;
+	struct cam_hw_dump_pf_args *pf_args = (struct cam_hw_dump_pf_args *)args;
+	int rc = 0;
+
+	if (!ctx || !pf_args) {
+		CAM_ERR(CAM_ICP, "Invalid ctx %pK or pf args %pK",
+			ctx, pf_args);
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_ICP, "[%s] iommu fault for icp ctx %d state %d",
+		ctx->dev_name, ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+			&ctx->active_req_list, list) {
+		CAM_INFO(CAM_ICP, "[%s] ctx[%u]: Active req_id: %llu",
+			ctx->dev_name, ctx->ctx_id, req->request_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_args, &req->pf_data);
+		if (rc)
+			CAM_ERR(CAM_ICP, "[%s] ctx[%u]: Failed to dump pf info.ctx->state: %d",
+				ctx->dev_name, ctx->ctx_id, ctx->state);
+	}
+
+	/*
+	 * Faulted ctx found. Since IPE/BPS instances are shared among contexts,
+	 * faulted ctx is found if and only if the context contains
+	 * faulted buffer
+	 */
+	if (pf_args->pf_context_info.ctx_found) {
+		/* Send PF notification to UMD if PF found on current CTX */
+		rc = cam_context_send_pf_evt(ctx, pf_args);
+		if (rc)
+			CAM_ERR(CAM_ICP,
+				"[%s] ctx[%u]: Failed to notify PF event to userspace rc: %d",
+				ctx->dev_name, ctx->ctx_id, rc);
+	}
+
+	return rc;
+}
+
+static int cam_icp_context_mini_dump(void *priv, void *args)
+{
+	int rc;
+	struct cam_context *ctx;
+
+	if (!priv || !args) {
+		CAM_ERR(CAM_ICP, "Invalid priv %pK args %pK", priv, args);
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)priv;
+	rc = cam_context_mini_dump(ctx, args);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] ctx[%u]: Mini Dump failed rc %d",
+			ctx->dev_name, ctx->ctx_id, rc);
+
+	return rc;
+}
+
+static int __cam_icp_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (!rc) {
+		ctx->state = CAM_CTX_ACQUIRED;
+		trace_cam_context_state(ctx->dev_name, ctx);
+	}
+
+	return rc;
+}
+
+static int __cam_icp_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	cam_common_release_evt_params(ctx->dev_hdl);
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] ctx[%u]: Unable to release device",
+			ctx->dev_name, ctx->ctx_id);
+
+	ctx->state = CAM_CTX_AVAILABLE;
+	trace_cam_context_state(ctx->dev_name, ctx);
+	return rc;
+}
+
+static int __cam_icp_start_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_start_dev_to_hw(ctx, cmd);
+	if (!rc) {
+		ctx->state = CAM_CTX_READY;
+		trace_cam_context_state(ctx->dev_name, ctx);
+	}
+
+	return rc;
+}
+
+static int __cam_icp_dump_dev_in_ready(
+	struct cam_context      *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] ctx[%u]: Failed to dump device",
+			ctx->dev_name, ctx->ctx_id);
+
+	return rc;
+}
+
+static int __cam_icp_flush_dev_in_ready(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_context_utils_flush_args flush_args;
+
+	flush_args.cmd = cmd;
+	flush_args.flush_active_req = false;
+
+	rc = cam_context_flush_dev_to_hw(ctx, &flush_args);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] ctx[%u]: Failed to flush device",
+			ctx->dev_name, ctx->ctx_id);
+
+	return rc;
+}
+
+static int __cam_icp_config_dev_in_ready(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+	size_t len;
+	uintptr_t packet_addr;
+	struct cam_packet *packet;
+	size_t remain_len = 0;
+
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s][%d] Can not get packet address",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	remain_len = len;
+	if ((len < sizeof(struct cam_packet)) ||
+		(cmd->offset >= (len - sizeof(struct cam_packet)))) {
+		CAM_ERR(CAM_CTXT,
+			"[%s] ctx[%u]: Invalid offset, len: %zu cmd offset: %llu sizeof packet: %zu",
+			ctx->dev_name, ctx->ctx_id,
+			len, cmd->offset, sizeof(struct cam_packet));
+		goto put_cpu_buf;
+	}
+
+	remain_len -= (size_t)cmd->offset;
+	packet = (struct cam_packet *) ((uint8_t *)packet_addr +
+		(uint32_t)cmd->offset);
+
+	rc = cam_packet_util_validate_packet(packet, remain_len);
+	if (rc) {
+		CAM_ERR(CAM_CTXT, "[%s] ctx[%u]: Invalid packet params, remain length: %zu",
+			ctx->dev_name, ctx->ctx_id,
+			remain_len);
+		goto put_cpu_buf;
+	}
+
+	if (((packet->header.op_code & 0xff) ==
+		CAM_ICP_OPCODE_IPE_SETTINGS) ||
+		((packet->header.op_code & 0xff) ==
+		CAM_ICP_OPCODE_BPS_SETTINGS) ||
+		((packet->header.op_code & 0xff) ==
+		CAM_ICP_OPCODE_OFE_SETTINGS))
+		rc = cam_context_config_dev_to_hw(ctx, cmd);
+	else
+		rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] ctx[%u]:Failed to prepare device",
+			ctx->dev_name, ctx->ctx_id);
+
+put_cpu_buf:
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+}
+
+static int __cam_icp_stop_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] ctx[%u]: Failed to stop device",
+			ctx->dev_name, ctx->ctx_id);
+
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state(ctx->dev_name, ctx);
+	return rc;
+}
+
+static int __cam_icp_release_dev_in_ready(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = __cam_icp_stop_dev_in_ready(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] ctx[%u]: Failed to stop device",
+			ctx->dev_name, ctx->ctx_id);
+
+	rc = __cam_icp_release_dev_in_acquired(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to release device");
+
+	return rc;
+}
+
+static uint32_t cam_icp_context_get_error_code(uint32_t err_type)
+{
+	switch (err_type) {
+	case CAM_ICP_HW_ERROR_NO_MEM:
+		return CAM_REQ_MGR_ICP_NO_MEMORY;
+	case CAM_ICP_HW_ERROR_SYSTEM_FAILURE:
+		return CAM_REQ_MGR_ICP_SYSTEM_FAILURE;
+	default:
+		return 0;
+	}
+}
+
+static int __cam_icp_notify_v4l2_err_evt(struct cam_context *ctx,
+	uint32_t err_type, uint32_t err_code, uint64_t request_id)
+{
+	struct cam_req_mgr_message req_msg = {0};
+	int rc;
+
+	req_msg.session_hdl = ctx->session_hdl;
+	req_msg.u.err_msg.device_hdl = ctx->dev_hdl;
+	req_msg.u.err_msg.error_type = err_type;
+	req_msg.u.err_msg.link_hdl = ctx->link_hdl;
+	req_msg.u.err_msg.request_id = request_id;
+	req_msg.u.err_msg.resource_size = 0x0;
+	req_msg.u.err_msg.error_code = err_code;
+
+	rc = cam_req_mgr_notify_message(&req_msg, V4L_EVENT_CAM_REQ_MGR_ERROR,
+		V4L_EVENT_CAM_REQ_MGR_EVENT);
+	if (rc)
+		CAM_ERR(CAM_ICP,
+			"[%s] ctx[%u]: Error in notifying the error time for req id:%lld",
+			ctx->dev_name, ctx->ctx_id, request_id);
+
+	CAM_INFO(CAM_ICP,
+		"[%s] ctx[%u]: notifying error to userspace err type: %d, err code: %u, req id: %llu",
+		ctx->dev_name, ctx->ctx_id, err_type, err_code, request_id);
+
+	return rc;
+}
+
+static int cam_icp_ctx_handle_fatal_error(void *ctx, void *err_evt_data)
+{
+	struct cam_icp_hw_error_evt_data *err_evt;
+	uint32_t err_code = 0;
+	int rc;
+
+	err_evt = (struct cam_icp_hw_error_evt_data *)err_evt_data;
+	err_code = cam_icp_context_get_error_code(err_evt->err_type);
+
+	rc = __cam_icp_notify_v4l2_err_evt(ctx, CAM_REQ_MGR_ERROR_TYPE_RECOVERY,
+		err_code, err_evt->req_id);
+
+	return rc;
+}
+
+static int cam_icp_ctx_handle_buf_done_in_ready(void *ctx, void *done_evt_data)
+{
+	struct cam_icp_hw_buf_done_evt_data *buf_done;
+
+	buf_done = (struct cam_icp_hw_buf_done_evt_data *)done_evt_data;
+	return cam_context_buf_done_from_hw(ctx, buf_done->buf_done_data, buf_done->evt_id);
+}
+
+static int cam_icp_ctx_handle_error_inducement(void *ctx, void *inject_evt_arg)
+{
+	return cam_context_apply_evt_injection(ctx, inject_evt_arg);
+}
+
+static int __cam_icp_ctx_handle_hw_event(void *ctx,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc;
+
+	if (!ctx || !evt_data) {
+		CAM_ERR(CAM_ICP, "Invalid ctx  %s and event data %s",
+			CAM_IS_NULL_TO_STR(ctx), CAM_IS_NULL_TO_STR(evt_data));
+		return -EINVAL;
+	}
+
+	switch (evt_id) {
+	case CAM_ICP_EVT_ID_BUF_DONE:
+		rc = cam_icp_ctx_handle_buf_done_in_ready(ctx, evt_data);
+		break;
+	case CAM_ICP_EVT_ID_ERROR:
+		rc = cam_icp_ctx_handle_fatal_error(ctx, evt_data);
+		break;
+	case CAM_ICP_EVT_ID_INJECT_EVENT:
+		rc = cam_icp_ctx_handle_error_inducement(ctx, evt_data);
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid event id: %u", evt_id);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_icp_context_validate_event_notify_injection(struct cam_context *ctx,
+	struct cam_hw_inject_evt_param *evt_params)
+{
+	int rc = 0;
+	uint32_t evt_type;
+	uint64_t req_id;
+
+	req_id   = evt_params->req_id;
+	evt_type = evt_params->u.evt_notify.evt_notify_type;
+
+	switch (evt_type) {
+	case V4L_EVENT_CAM_REQ_MGR_ERROR: {
+		struct cam_hw_inject_err_evt_param *err_evt_params =
+			&evt_params->u.evt_notify.u.err_evt_params;
+
+		switch (err_evt_params->err_type) {
+		case CAM_REQ_MGR_ERROR_TYPE_RECOVERY:
+		case CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY:
+			break;
+		default:
+			CAM_ERR(CAM_ICP,
+				"[%s] ctx[%u]: Invalid error type: %u for error event injection err code: %u req id: %llu dev hdl: %d",
+				ctx->dev_name, ctx->ctx_id, err_evt_params->err_type,
+				err_evt_params->err_code, ctx->dev_hdl);
+			return -EINVAL;
+		}
+
+		CAM_INFO(CAM_ICP,
+			"[%s] ctx[%u]: Inject ERR evt: err code: %u err type: %u req id: %llu dev hdl: %d",
+			ctx->dev_name, ctx->ctx_id, err_evt_params->err_code,
+			err_evt_params->err_type, req_id, ctx->dev_hdl);
+		break;
+	}
+	case V4L_EVENT_CAM_REQ_MGR_PF_ERROR: {
+		struct cam_hw_inject_pf_evt_param *pf_evt_params =
+			&evt_params->u.evt_notify.u.pf_evt_params;
+		bool non_fatal_en;
+
+		rc = cam_smmu_is_cb_non_fatal_fault_en(ctx->img_iommu_hdl, &non_fatal_en);
+		if (rc) {
+			CAM_ERR(CAM_ICP,
+				"[%s] ctx[%u]: Fail to query whether device's cb has non-fatal enabled rc: %d",
+				ctx->dev_name, ctx->ctx_id, rc);
+			return rc;
+		}
+
+		if (!non_fatal_en) {
+			CAM_ERR(CAM_ICP,
+				"[%s] ctx[%u]: Fail to inject page fault event notification. Page fault is fatal for ICP",
+				ctx->dev_name, ctx->ctx_id);
+			return -EINVAL;
+		}
+
+		CAM_INFO(CAM_ICP,
+			"[%s] ctx[%u]: Inject PF evt: req_id: %llu dev hdl: %d ctx found: %hhu",
+			ctx->dev_name, ctx->ctx_id,
+			req_id, ctx->dev_hdl, pf_evt_params->ctx_found);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_ICP, "[%s] ctx[%u]: Event notification type not supported: %u",
+			ctx->dev_name, ctx->ctx_id, evt_type);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_icp_context_inject_evt(void *context, void *evt_args)
+{
+	struct cam_context *ctx = context;
+	struct cam_hw_inject_evt_param *evt_params = NULL;
+	struct cam_hw_inject_buffer_error_param *buf_err_params = NULL;
+	int rc = 0;
+
+	if (!ctx || !evt_args) {
+		CAM_ERR(CAM_ICP,
+			"invalid params ctx %s event args %s",
+			CAM_IS_NULL_TO_STR(ctx), CAM_IS_NULL_TO_STR(evt_args));
+		return -EINVAL;
+	}
+
+	evt_params = (struct cam_hw_inject_evt_param *)evt_args;
+
+	if (evt_params->inject_id == CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE) {
+		buf_err_params = &evt_params->u.buf_err_evt;
+		if (buf_err_params->sync_error > CAM_SYNC_ICP_EVENT_START ||
+			buf_err_params->sync_error < CAM_SYNC_ICP_EVENT_END) {
+			CAM_INFO(CAM_ICP, "[%s] ctx[%u]: Inject buffer sync error %u req id %llu",
+				ctx->dev_name, ctx->ctx_id, buf_err_params->sync_error,
+				evt_params->req_id);
+		} else {
+			CAM_ERR(CAM_ICP, "[%s] ctx[%u]: Invalid buffer sync error %u req id %llu",
+				ctx->dev_name, ctx->ctx_id, buf_err_params->sync_error,
+				evt_params->req_id);
+			return -EINVAL;
+		}
+	} else {
+		rc = cam_icp_context_validate_event_notify_injection(ctx, evt_params);
+		if (rc) {
+			CAM_ERR(CAM_ICP,
+				"[%s] ctx[%u]: Event notification injection failed validation rc: %d",
+				ctx->dev_name, ctx->ctx_id, rc);
+			return -EINVAL;
+		}
+	}
+
+	if (ctx->hw_mgr_intf->hw_inject_evt)
+		ctx->hw_mgr_intf->hw_inject_evt(ctx->ctxt_to_hw_map, evt_args);
+
+	return rc;
+}
+
+static struct cam_ctx_ops
+	cam_icp_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_icp_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+		.mini_dump_ops = cam_icp_context_mini_dump,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.release_dev = __cam_icp_release_dev_in_acquired,
+			.start_dev = __cam_icp_start_dev_in_acquired,
+			.config_dev = __cam_icp_config_dev_in_ready,
+			.flush_dev = __cam_icp_flush_dev_in_ready,
+			.dump_dev = __cam_icp_dump_dev_in_ready,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_icp_ctx_handle_hw_event,
+		.pagefault_ops = cam_icp_context_dump_active_request,
+		.mini_dump_ops = cam_icp_context_mini_dump,
+		.evt_inject_ops = cam_icp_context_inject_evt,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_icp_stop_dev_in_ready,
+			.release_dev = __cam_icp_release_dev_in_ready,
+			.config_dev = __cam_icp_config_dev_in_ready,
+			.flush_dev = __cam_icp_flush_dev_in_ready,
+			.dump_dev = __cam_icp_dump_dev_in_ready,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_icp_ctx_handle_hw_event,
+		.pagefault_ops = cam_icp_context_dump_active_request,
+		.mini_dump_ops = cam_icp_context_mini_dump,
+		.evt_inject_ops = cam_icp_context_inject_evt,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_icp_context_dump_active_request,
+		.mini_dump_ops = cam_icp_context_mini_dump,
+		.evt_inject_ops = cam_icp_context_inject_evt,
+	},
+};
+
+int cam_icp_context_init(struct cam_icp_context *ctx, struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id, int img_iommu_hdl, const char *icp_dev_name)
+{
+	int rc;
+
+	if ((!ctx) || (!ctx->base) || (!hw_intf) || (!icp_dev_name)) {
+		CAM_ERR(CAM_ICP,
+			"Invalid params: ctx: %s hw intf: %s dev name: %s",
+			CAM_IS_NULL_TO_STR(ctx), CAM_IS_NULL_TO_STR(hw_intf),
+			CAM_IS_NULL_TO_STR(icp_dev_name));
+		rc = -EINVAL;
+		goto err;
+	}
+
+	rc = cam_context_init(ctx->base, icp_dev_name, CAM_ICP, ctx_id,
+		NULL, hw_intf, ctx->req_base, CAM_CTX_ICP_REQ_MAX, img_iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Camera Context Base init failed", icp_dev_name);
+		goto err;
+	}
+
+	ctx->base->state_machine = cam_icp_ctx_state_machine;
+	ctx->base->ctx_priv = ctx;
+	ctx->base->max_hw_update_entries = CAM_CTX_CFG_MAX;
+	ctx->base->max_in_map_entries = CAM_CTX_CFG_MAX;
+	ctx->base->max_out_map_entries = CAM_CTX_CFG_MAX;
+	ctx->ctxt_to_hw_map = NULL;
+
+err:
+	return rc;
+}
+
+int cam_icp_context_deinit(struct cam_icp_context *ctx)
+{
+	if ((!ctx) || (!ctx->base)) {
+		CAM_ERR(CAM_ICP, "Invalid params: %pK", ctx);
+		return -EINVAL;
+	}
+
+	cam_context_deinit(ctx->base);
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/cam_icp_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/cam_icp_context.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_CONTEXT_H_
+#define _CAM_ICP_CONTEXT_H_
+
+#include "cam_context.h"
+
+/**
+ * struct cam_icp_context - icp context
+ * @base: icp context object
+ * @state_machine: state machine for ICP context
+ * @req_base: common request structure
+ * @state: icp context state
+ * @ctxt_to_hw_map: context to FW handle mapping
+ */
+struct cam_icp_context {
+	struct cam_context *base;
+	struct cam_ctx_ops *state_machine;
+	struct cam_ctx_request req_base[CAM_CTX_ICP_REQ_MAX];
+	uint32_t state;
+	void *ctxt_to_hw_map;
+};
+
+/**
+ * cam_icp_context_init() - ICP context init
+ * @ctx: Pointer to context
+ * @hw_intf: Pointer to ICP hardware interface
+ * @ctx_id: ID for this context
+ * @img_iommu_hdl: IOMMU HDL for image buffers
+ * @icp_dev_name: name of the icp subdevice
+ */
+int cam_icp_context_init(struct cam_icp_context *ctx,
+	struct cam_hw_mgr_intf *hw_intf, uint32_t ctx_id,
+	int img_iommu_hdl, const char *icp_dev_name);
+
+/**
+ * cam_icp_context_deinit() - ICP context deinit
+ * @ctx: Pointer to context
+ */
+int cam_icp_context_deinit(struct cam_icp_context *ctx);
+
+#endif /* _CAM_ICP_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/cam_icp_subdev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/cam_icp_subdev.c
@@ -0,0 +1,476 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022,2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/platform_device.h>
+#include <linux/videodev2.h>
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "cam_req_mgr_dev.h"
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_context.h"
+#include "cam_icp_context.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+#include "cam_common_util.h"
+#include "cam_context_utils.h"
+
+
+#define CAM_ICP_IS_DEV_IDX_INVALID(dev_idx)                   \
+({                                                            \
+	((dev_idx) < 0) || ((dev_idx) >= CAM_ICP_SUBDEV_MAX); \
+})
+
+struct cam_icp_subdev {
+	struct cam_subdev sd;
+	struct cam_node *node;
+	struct cam_context ctx[CAM_ICP_CTX_MAX];
+	struct cam_icp_context ctx_icp[CAM_ICP_CTX_MAX];
+	struct mutex icp_lock;
+	int32_t open_cnt;
+	int32_t reserved;
+};
+
+static DEFINE_MUTEX(g_dev_lock);
+static struct cam_icp_subdev *g_icp_dev[CAM_ICP_SUBDEV_MAX];
+
+static char cam_icp_subdev_name_arr[CAM_ICP_SUBDEV_MAX][CAM_ICP_SUBDEV_NAME_LEN] = {
+	"cam-icp0",
+	"cam-icp1",
+};
+
+static const struct of_device_id cam_icp_dt_match[] = {
+	{.compatible = "qcom,cam-icp"},
+	{.compatible = "qcom,cam-icp0"},
+	{.compatible = "qcom,cam-icp1"},
+	{}
+};
+
+static int cam_icp_dev_evt_inject_cb(void *inject_args)
+{
+	struct cam_common_inject_evt_param *inject_params = inject_args;
+	struct cam_icp_subdev *icp_dev;
+	int i;
+
+	/* Event Injection currently supported for only a single instance of ICP */
+	icp_dev = g_icp_dev[0];
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		if (icp_dev->ctx[i].dev_hdl == inject_params->dev_hdl) {
+			cam_context_add_evt_inject(&icp_dev->ctx[i],
+				&inject_params->evt_params);
+			return 0;
+		}
+	}
+
+	CAM_ERR(CAM_ICP, "No dev hdl found %d", inject_params->dev_hdl);
+	return -ENODEV;
+}
+
+static void cam_icp_dev_iommu_fault_handler(struct cam_smmu_pf_info *pf_smmu_info)
+{
+	int i, rc;
+	struct cam_node *node = NULL;
+	struct cam_hw_dump_pf_args pf_args = {0};
+
+	if (!pf_smmu_info || !pf_smmu_info->token) {
+		CAM_ERR(CAM_ICP, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_smmu_info->token;
+
+	pf_args.pf_smmu_info = pf_smmu_info;
+
+	for (i = 0; i < node->ctx_size; i++) {
+		cam_context_dump_pf_info(&(node->ctx_list[i]), &pf_args);
+		if (pf_args.pf_context_info.ctx_found)
+			/* found ctx and packet of the faulted address */
+			break;
+	}
+
+	if (i == node->ctx_size) {
+		/* Faulted ctx not found. Report PF to userspace */
+		rc = cam_context_send_pf_evt(NULL, &pf_args);
+		if (rc)
+			CAM_ERR(CAM_ICP,
+				"Failed to notify PF event to userspace rc: %d", rc);
+	}
+}
+
+static void cam_icp_dev_mini_dump_cb(void *priv, void *args)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!priv || !args) {
+		CAM_ERR(CAM_ICP, "Invalid params: priv: %pK args %pK", priv, args);
+		return;
+	}
+
+	ctx = (struct cam_context *)priv;
+	cam_context_mini_dump_from_hw(ctx, args);
+}
+
+static int cam_icp_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_hw_mgr_intf *hw_mgr_intf = NULL;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+	struct cam_icp_subdev *icp_dev = NULL;
+	int rc = 0;
+
+	if (!node) {
+		CAM_ERR(CAM_ICP, "Invalid params: Node is NULL");
+		return -EINVAL;
+	}
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+	CAM_DBG(CAM_ICP, "Enter device open for %s[%u]",
+		sd->name, node->device_idx);
+
+	if (CAM_ICP_IS_DEV_IDX_INVALID(node->device_idx)) {
+		CAM_ERR(CAM_ICP, "Invalid device idx: %u for device: %s",
+			node->device_idx, sd->name);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+		return -ENODEV;
+	}
+	icp_dev = g_icp_dev[node->device_idx];
+
+	mutex_lock(&icp_dev->icp_lock);
+	if (icp_dev->open_cnt >= 1) {
+		CAM_ERR(CAM_ICP, "device[%s] is already opened, open count: %u",
+			sd->name, icp_dev->open_cnt);
+		rc = -EALREADY;
+		goto end;
+	}
+
+	hw_mgr_intf = &node->hw_mgr_intf;
+	rc = hw_mgr_intf->hw_open(hw_mgr_intf->hw_mgr_priv, NULL);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "FW download failed for device [%s]", sd->name);
+		goto end;
+	}
+
+	icp_dev->open_cnt++;
+
+end:
+	mutex_unlock(&icp_dev->icp_lock);
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+	return rc;
+}
+
+static int cam_icp_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_hw_mgr_intf *hw_mgr_intf = NULL;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+	struct cam_icp_subdev *icp_dev = NULL;
+
+	if (!node) {
+		CAM_ERR(CAM_ICP, "device[%s] Invalid params: node is NULL",
+			sd->name);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (CAM_ICP_IS_DEV_IDX_INVALID(node->device_idx)) {
+		CAM_ERR(CAM_ICP, "Invalid device idx: %u for device: %s",
+			node->device_idx, node->name);
+		return -ENODEV;
+	}
+	icp_dev = g_icp_dev[node->device_idx];
+
+	mutex_lock(&icp_dev->icp_lock);
+	if (icp_dev->open_cnt <= 0) {
+		CAM_DBG(CAM_ICP, "device[%s] is already closed",
+			sd->name);
+		goto end;
+	}
+
+	icp_dev->open_cnt--;
+
+	hw_mgr_intf = &node->hw_mgr_intf;
+	if (!hw_mgr_intf) {
+		CAM_ERR(CAM_ICP, "device[%s] hw_mgr_intf is not initialized",
+			sd->name);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_node_shutdown(node);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "device[%s] HW close failed",
+			sd->name);
+		goto end;
+	}
+
+end:
+	mutex_unlock(&icp_dev->icp_lock);
+	return rc;
+}
+
+static int cam_icp_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_ICP,
+			"CRM is ACTIVE, close should be from CRM for device[%s]",
+			sd->name);
+		return 0;
+	}
+
+	return cam_icp_subdev_close_internal(sd, fh);
+}
+
+const struct v4l2_subdev_internal_ops cam_icp_subdev_internal_ops = {
+	.open = cam_icp_subdev_open,
+	.close = cam_icp_subdev_close,
+};
+
+static inline int cam_icp_subdev_clean_up(uint32_t device_idx)
+{
+	kfree(g_icp_dev[device_idx]);
+	g_icp_dev[device_idx] = NULL;
+
+	return 0;
+}
+
+static int cam_icp_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0, i = 0;
+	struct cam_node *node;
+	struct cam_hw_mgr_intf hw_mgr_intf;
+	int iommu_hdl = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct cam_icp_subdev *icp_dev;
+	char *subdev_name;
+	uint32_t device_idx;
+
+	if (!pdev) {
+		CAM_ERR(CAM_ICP, "Invalid params: pdev is %s",
+			CAM_IS_NULL_TO_STR(pdev));
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32(dev->of_node, "cell-index", &device_idx);
+	if (rc)
+		device_idx = 0;
+
+	if (CAM_ICP_IS_DEV_IDX_INVALID(device_idx)) {
+		CAM_ERR(CAM_ICP, "Invalid device idx: %u exceeds subdev max: %u",
+			device_idx, CAM_ICP_SUBDEV_MAX);
+		return -EINVAL;
+	}
+
+	/*
+	 * For targets where only one subdevice exists, cell-index property is not listed
+	 * in the DT node, so the default name and device index are "cam-icp" and 0 respectively
+	 */
+	if (rc)
+		subdev_name = "cam-icp";
+	else
+		subdev_name = cam_icp_subdev_name_arr[device_idx];
+
+
+	mutex_lock(&g_dev_lock);
+	if (g_icp_dev[device_idx]) {
+		CAM_ERR(CAM_ICP,
+			"Invalid device index: %u for pdev: %s, ICP device for this idx is already bound",
+			device_idx, pdev->name);
+		rc = -EBADSLT;
+		mutex_unlock(&g_dev_lock);
+		goto probe_fail;
+	}
+	mutex_unlock(&g_dev_lock);
+
+	icp_dev = kzalloc(sizeof(struct cam_icp_subdev), GFP_KERNEL);
+	if (!icp_dev) {
+		CAM_ERR(CAM_ICP,
+			"Unable to allocate memory for icp device:%s size:%llu",
+			pdev->name, sizeof(struct cam_icp_subdev));
+		return -ENOMEM;
+	}
+
+	mutex_lock(&g_dev_lock);
+	g_icp_dev[device_idx] = icp_dev;
+	mutex_unlock(&g_dev_lock);
+
+	icp_dev->sd.internal_ops = &cam_icp_subdev_internal_ops;
+	icp_dev->sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+	rc = cam_subdev_probe(&icp_dev->sd, pdev, subdev_name,
+		CAM_ICP_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "device[%s] probe failed", subdev_name);
+		goto probe_fail;
+	}
+
+	node = (struct cam_node *) icp_dev->sd.token;
+	node->sd_handler = cam_icp_subdev_close_internal;
+	node->device_idx = device_idx;
+	mutex_init(&icp_dev->icp_lock);
+
+	rc = cam_icp_hw_mgr_init(pdev->dev.of_node, (uint64_t *)(&hw_mgr_intf),
+		&iommu_hdl, cam_icp_dev_mini_dump_cb, device_idx);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "device[%s] HW manager init failed: %d", subdev_name, rc);
+		goto hw_init_fail;
+	}
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		icp_dev->ctx_icp[i].base = &icp_dev->ctx[i];
+		rc = cam_icp_context_init(&icp_dev->ctx_icp[i],
+			&node->hw_mgr_intf, i, iommu_hdl, subdev_name);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "device[%s] context init failed", subdev_name);
+			goto ctx_fail;
+		}
+	}
+
+	rc = cam_node_init(node, &hw_mgr_intf, icp_dev->ctx,
+		CAM_ICP_CTX_MAX, subdev_name);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "device[%s] node init failed", subdev_name);
+		goto ctx_fail;
+	}
+
+	cam_common_register_evt_inject_cb(cam_icp_dev_evt_inject_cb,
+		CAM_COMMON_EVT_INJECT_HW_ICP);
+
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_icp_dev_iommu_fault_handler, node);
+
+	icp_dev->open_cnt = 0;
+	rc = cam_subdev_register(&icp_dev->sd, pdev);
+
+	CAM_DBG(CAM_ICP, "device[%s] id: %u component bound successfully",
+		subdev_name, device_idx);
+
+	return rc;
+
+ctx_fail:
+	for (--i; i >= 0; i--)
+		cam_icp_context_deinit(&icp_dev->ctx_icp[i]);
+	cam_icp_hw_mgr_deinit(device_idx);
+hw_init_fail:
+	cam_node_deinit(icp_dev->node);
+	cam_subdev_remove(&icp_dev->sd);
+probe_fail:
+	cam_icp_subdev_clean_up(device_idx);
+	return rc;
+}
+
+static void cam_icp_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i, rc;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct v4l2_subdev *sd;
+	struct cam_icp_subdev *icp_dev;
+	uint32_t device_idx;
+
+	if (!pdev) {
+		CAM_ERR(CAM_ICP, "pdev is NULL");
+		return;
+	}
+
+	sd = platform_get_drvdata(pdev);
+	if (!sd) {
+		CAM_ERR(CAM_ICP,
+			"V4l2 subdev is NULL for pdev: %s", pdev->name);
+		return;
+	}
+
+	rc = of_property_read_u32(dev->of_node, "cell-index", &device_idx);
+	if (rc)
+		device_idx = 0;
+
+	if (CAM_ICP_IS_DEV_IDX_INVALID(device_idx)) {
+		CAM_ERR(CAM_ICP, "Invalid device idx: %u exceeds subdev max: %u",
+			device_idx, CAM_ICP_SUBDEV_MAX);
+		return;
+	}
+
+	icp_dev = g_icp_dev[device_idx];
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++)
+		cam_icp_context_deinit(&icp_dev->ctx_icp[i]);
+
+	cam_icp_hw_mgr_deinit(device_idx);
+	cam_node_deinit(icp_dev->node);
+	cam_unregister_subdev(&icp_dev->sd);
+	cam_subdev_remove(&icp_dev->sd);
+	mutex_destroy(&icp_dev->icp_lock);
+	cam_icp_subdev_clean_up(device_idx);
+
+	CAM_DBG(CAM_ICP, "device[%s] component unbinded successfully", pdev->name);
+}
+
+const static struct component_ops cam_icp_component_ops = {
+	.bind = cam_icp_component_bind,
+	.unbind = cam_icp_component_unbind,
+};
+
+static int cam_icp_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "%s Adding ICP component", pdev->name);
+	rc = component_add(&pdev->dev, &cam_icp_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "%s failed to add component rc: %d", pdev->name, rc);
+
+	return rc;
+}
+
+static int cam_icp_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_icp_component_ops);
+	return 0;
+}
+
+struct platform_driver cam_icp_driver = {
+	.probe = cam_icp_probe,
+	.remove = cam_icp_remove,
+	.driver = {
+		.name = "cam_icp",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_icp_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_icp_init_module(void)
+{
+	return platform_driver_register(&cam_icp_driver);
+}
+
+void cam_icp_exit_module(void)
+{
+	platform_driver_unregister(&cam_icp_driver);
+}
+
+MODULE_DESCRIPTION("MSM ICP driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/cam_icp_subdev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/cam_icp_subdev.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_SUBDEV_H_
+#define _CAM_ICP_SUBDEV_H_
+
+/**
+ * @brief : API to register ICP subdev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_icp_init_module(void);
+
+/**
+ * @brief : API to remove ICP subdev from platform framework.
+ */
+void cam_icp_exit_module(void);
+
+#endif /* _CAM_ICP_SUBDEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/fw_inc/hfi_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/fw_inc/hfi_intf.h
@@ -0,0 +1,250 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _HFI_INTF_H_
+#define _HFI_INTF_H_
+
+#include <linux/types.h>
+
+#define HFI_CMD_Q_MINI_DUMP_SIZE_IN_BYTES      4096
+#define HFI_MSG_Q_MINI_DUMP_SIZE_IN_BYTES      4096
+
+#define HFI_NUM_MAX                            2
+#define HFI_HANDLE_INIT_VALUE                  HFI_NUM_MAX
+
+#define HFI_CLIENT_NAME_LEN                    32
+
+/**
+ * struct hfi_mem
+ * @len: length of memory
+ * @kva: kernel virtual address
+ * @iova: IO virtual address
+ * @reserved: reserved field
+ */
+struct hfi_mem {
+	uint64_t  len;
+	uintptr_t kva;
+	uint32_t  iova;
+	uint32_t  reserved;
+};
+
+/**
+ * struct hfi_mem_info
+ * @qtbl: qtable hfi memory
+ * @cmd_q: command queue hfi memory for host to firmware communication
+ * @msg_q: message queue hfi memory for firmware to host communication
+ * @dbg_q: debug queue hfi memory for firmware debug information
+ * @sfr_buf: buffer for subsystem failure reason[SFR]
+ * @sec_heap: secondary heap hfi memory for firmware
+ * @qdss: qdss mapped memory for fw
+ * @io_mem: io memory info
+ * @io_mem2: 2nd io memory info
+ * @fw_uncached: FW uncached region info
+ * @global_sync: Global sync mem for IPC
+ * @device_mem: device memory
+ */
+struct hfi_mem_info {
+	struct hfi_mem qtbl;
+	struct hfi_mem cmd_q;
+	struct hfi_mem msg_q;
+	struct hfi_mem dbg_q;
+	struct hfi_mem sfr_buf;
+	struct hfi_mem sec_heap;
+	struct hfi_mem shmem;
+	struct hfi_mem qdss;
+	struct hfi_mem io_mem;
+	struct hfi_mem io_mem2;
+	struct hfi_mem fw_uncached;
+	struct hfi_mem device_mem;
+};
+
+/**
+ * struct hfi_ops
+ * @irq_raise: called to raise H2ICP interrupt
+ * @irq_enable: called to enable interrupts from ICP
+ * @iface_addr: called to get interface registers base address
+ */
+struct hfi_ops {
+	void (*irq_raise)(void *data);
+	void (*irq_enable)(void *data);
+	void __iomem *(*iface_addr)(void *data);
+};
+
+/**
+ * struct hfi_mini_dump_info
+ * @cmd_q: cmd queue
+ * @msg_q: msg queue
+ * @msg_q_state: msg queue state
+ * @cmd_q_state: cmd queue state
+ * @dbg_q_state: dbg queue state
+ */
+struct hfi_mini_dump_info {
+	uint32_t       cmd_q[HFI_CMD_Q_MINI_DUMP_SIZE_IN_BYTES];
+	uint32_t       msg_q[HFI_MSG_Q_MINI_DUMP_SIZE_IN_BYTES];
+	bool           msg_q_state;
+	bool           cmd_q_state;
+	bool           dbg_q_state;
+};
+/**
+ * hfi_write_cmd() - function for hfi write
+ * @client_handle: client handle
+ * @cmd_ptr: pointer to command data for hfi write
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_write_cmd(int client_handle, void *cmd_ptr);
+
+/**
+ * hfi_read_message() - function for hfi read
+ * @client_handle: client handle
+ * @pmsg: buffer to place read message for hfi queue
+ * @q_id: Queue to read from
+ * @buf_words_size: size in words of the input buffer
+ * @words_read: total number of words read from the queue
+ *              returned as output to the caller
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_read_message(int client_handle, uint32_t *pmsg, uint8_t q_id,
+	size_t buf_words_size, uint32_t *words_read);
+
+/**
+ * hfi_init() - function initialize hfi after firmware download
+ * @client_handle: client handle
+ * @hfi_mem: hfi memory info
+ * @hfi_ops: processor-specific hfi ops
+ * @priv: device private data
+ * @event_driven_mode: event mode
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int cam_hfi_init(int client_handle, struct hfi_mem_info *hfi_mem,
+	const struct hfi_ops *hfi_ops, void *priv, uint8_t event_driven_modem);
+
+/**
+ * cam_hfi_register() - function to register user as hfi client and retrieve handle
+ * @client_handle: client handle to be retrieved
+ * @client_name: Name of the client to be registered
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int cam_hfi_register(int *client_handle, const char *client_name);
+
+/**
+ * cam_hfi_unregister() - function to unregister hfi client
+ * @client_handle: client handle
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int cam_hfi_unregister(int *client_handle);
+
+/**
+ * hfi_get_hw_caps() - hardware capabilities from firmware
+ * @query_caps: holds query information from hfi
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_get_hw_caps(void *query_caps);
+
+/**
+ * hfi_get_hw_caps_v2() - hardware capabilities from firmware, used for v2 query cap
+ * @client_handle: client handle
+ * @query_caps: holds query information from hfi
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_get_hw_caps_v2(int client_handle, void *query_caps);
+
+/**
+ * hfi_send_system_cmd() - send hfi system command to firmware
+ * @client_handle: client handle
+ * @type: type of system command
+ * @data: command data
+ * @size: size of command data
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_send_system_cmd(int client_handle, uint32_t type, uint64_t data, uint32_t size);
+
+/**
+ * cam_hfi_deinit() - cleanup HFI
+ * @client_handle: client handle to be retrieved
+ */
+void cam_hfi_deinit(int client_handle);
+/**
+ * hfi_set_debug_level() - set debug level
+ * @client_handle: client handle to be retrieved
+ * @icp_dbg_type: 1 for debug_q & 2 for qdss
+ * @lvl: FW debug message level
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_set_debug_level(int client_handle, u64 icp_dbg_type, uint32_t lvl);
+
+/**
+ * hfi_set_fw_dump_levels() - set firmware hang dump/ramdump levels
+ * @client_handle: client handle to be retrieved
+ * @hang_dump_lvl : level of firmware hang dump
+ * @ram_dump_lvl  : level of firmware ram dump
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_set_fw_dump_levels(int client_handle,
+	uint32_t hang_dump_lvl, uint32_t ram_dump_lvl);
+
+/**
+ * hfi_send_freq_info() - set firmware dump level
+ * @client_handle: client handle to be retrieved
+ * @freq: icp freq
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_send_freq_info(int client_handle, int32_t freq);
+
+/**
+ * hfi_cmd_ubwc_config_ext() - UBWC configuration to firmware
+ * @client_handle: client handle to be retrieved
+ * @ubwc_ipe_cfg: UBWC ipe fetch/write configuration params
+ * @ubwc_bps_cfg: UBWC bps fetch/write configuration params
+ * @ubwc_ofe_cfg: UBWC ofe fetch/write configuration params
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_cmd_ubwc_config_ext(int client_handle, uint32_t *ubwc_ipe_cfg,
+	uint32_t *ubwc_bps_cfg, uint32_t *ubwc_ofe_cfg);
+
+/**
+ * hfi_cmd_ubwc_config() - UBWC configuration to firmware
+ *                         for older targets
+ * @client_handle: client handle to be retrieved
+ * @ubwc_cfg: UBWC configuration parameters
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_cmd_ubwc_config(int client_handle, uint32_t *ubwc_cfg);
+
+/**
+ * cam_hfi_resume() - function to resume
+ * @client_handle: client handle to be retrieved
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int cam_hfi_resume(int client_handle);
+
+/**
+ * cam_hfi_queue_dump() - utility function to dump hfi queues
+ * @client_handle: client handle to be retrieved
+ * @dump_queue_data: if set dumps queue contents
+ */
+void cam_hfi_queue_dump(int client_handle, bool dump_queue_data);
+
+/**
+ * cam_hfi_mini_dump() - utility function for mini dump
+ * @client_handle: client handle to be retrieved
+ * @dst: memory destination
+ */
+void cam_hfi_mini_dump(int client_handle, struct hfi_mini_dump_info *dst);
+#endif /* _HFI_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/fw_inc/hfi_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/fw_inc/hfi_reg.h
@@ -0,0 +1,310 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_HFI_REG_H_
+#define _CAM_HFI_REG_H_
+
+#include <linux/types.h>
+#include "hfi_intf.h"
+
+/* general purpose registers */
+#define GEN_PURPOSE_REG(n)              (n << 2)
+
+#define HFI_REG_FW_VERSION                   GEN_PURPOSE_REG(1)
+#define HFI_REG_HOST_ICP_INIT_REQUEST        GEN_PURPOSE_REG(2)
+#define HFI_REG_ICP_HOST_INIT_RESPONSE       GEN_PURPOSE_REG(3)
+#define HFI_REG_SHARED_MEM_PTR               GEN_PURPOSE_REG(4)
+#define HFI_REG_SHARED_MEM_SIZE              GEN_PURPOSE_REG(5)
+#define HFI_REG_QTBL_PTR                     GEN_PURPOSE_REG(6)
+#define HFI_REG_SECONDARY_HEAP_PTR           GEN_PURPOSE_REG(7)
+#define HFI_REG_SECONDARY_HEAP_SIZE          GEN_PURPOSE_REG(8)
+#define HFI_REG_SFR_PTR                      GEN_PURPOSE_REG(10)
+#define HFI_REG_QDSS_IOVA                    GEN_PURPOSE_REG(11)
+#define HFI_REG_QDSS_IOVA_SIZE               GEN_PURPOSE_REG(12)
+#define HFI_REG_IO_REGION_IOVA               GEN_PURPOSE_REG(13)
+#define HFI_REG_IO_REGION_SIZE               GEN_PURPOSE_REG(14)
+#define HFI_REG_IO2_REGION_IOVA              GEN_PURPOSE_REG(15)
+#define HFI_REG_IO2_REGION_SIZE              GEN_PURPOSE_REG(16)
+#define HFI_REG_FWUNCACHED_REGION_IOVA       GEN_PURPOSE_REG(17)
+#define HFI_REG_FWUNCACHED_REGION_SIZE       GEN_PURPOSE_REG(18)
+#define HFI_REG_DEVICE_REGION_IOVA           GEN_PURPOSE_REG(19)
+#define HFI_REG_DEVICE_REGION_IOVA_SIZE      GEN_PURPOSE_REG(20)
+
+/* start of Queue table and queues */
+#define MAX_ICP_HFI_QUEUES                      4
+#define ICP_QHDR_TX_TYPE_MASK                   0xFF000000
+#define ICP_QHDR_RX_TYPE_MASK                   0x00FF0000
+#define ICP_QHDR_PRI_TYPE_MASK                  0x0000FF00
+#define ICP_QHDR_Q_ID_MASK                      0x000000FF
+#define ICP_QTBL_SIZE_IN_BYTES                  sizeof(struct hfi_qtbl)
+
+#define ICP_CMD_Q_SIZE_IN_BYTES                 8192
+#define ICP_MSG_Q_SIZE_IN_BYTES                 8192
+#define ICP_DBG_Q_SIZE_IN_BYTES                 102400
+#define ICP_MSG_SFR_SIZE_IN_BYTES               4096
+#define ICP_SEC_HEAP_SIZE_IN_BYTES              1048576
+
+#define ICP_HFI_QTBL_HOSTID1                    0x01000000
+#define ICP_HFI_QTBL_STATUS_ENABLED             0x00000001
+#define ICP_HFI_NUMBER_OF_QS                    3
+#define ICP_HFI_NUMBER_OF_ACTIVE_QS             3
+#define ICP_HFI_QTBL_OFFSET                     0
+#define ICP_HFI_VAR_SIZE_PKT                    0
+#define ICP_HFI_MAX_MSG_SIZE_IN_WORDS           128
+
+
+/* Queue Header type masks. Use these to access bitfields in qhdr_type */
+#define HFI_MASK_QHDR_TX_TYPE                   0xFF000000
+#define HFI_MASK_QHDR_RX_TYPE                   0x00FF0000
+#define HFI_MASK_QHDR_PRI_TYPE                  0x0000FF00
+#define HFI_MASK_QHDR_Q_ID_TYPE                 0x000000FF
+
+
+#define TX_EVENT_DRIVEN_MODE_1                  0
+#define RX_EVENT_DRIVEN_MODE_1                  0
+#define TX_EVENT_DRIVEN_MODE_2                  0x01000000
+#define RX_EVENT_DRIVEN_MODE_2                  0x00010000
+#define TX_EVENT_POLL_MODE_2                    0x02000000
+#define RX_EVENT_POLL_MODE_2                    0x00020000
+#define U32_OFFSET                              0x1
+#define BYTE_WORD_SHIFT                         2
+
+#define HFI_GET_CLIENT_HANDLE(idx) (idx)
+#define HFI_GET_INDEX(client_handle) (client_handle)
+#define IS_VALID_HFI_INDEX(idx) (((idx) >= 0) && ((idx) < HFI_NUM_MAX))
+
+/**
+ * @INVALID: Invalid state
+ * @HFI_DEINIT: HFI is not initialized yet
+ * @HFI_INIT: HFI is initialized
+ * @HFI_READY: HFI is ready to send/receive commands/messages
+ */
+enum hfi_state {
+	HFI_DEINIT,
+	HFI_INIT,
+	HFI_READY
+};
+
+/**
+ * @RESET: init success
+ * @SET: init failed
+ */
+enum reg_settings {
+	RESET,
+	SET,
+	SET_WM = 1024
+};
+
+/**
+ * @ICP_INIT_RESP_RESET: reset init state
+ * @ICP_INIT_RESP_SUCCESS: init success
+ * @ICP_INIT_RESP_FAILED: init failed
+ */
+enum host_init_resp {
+	ICP_INIT_RESP_RESET,
+	ICP_INIT_RESP_SUCCESS,
+	ICP_INIT_RESP_FAILED
+};
+
+/**
+ * @ICP_INIT_REQUEST_RESET: reset init request
+ * @ICP_INIT_REQUEST_SET: set init request
+ */
+enum host_init_request {
+	ICP_INIT_REQUEST_RESET,
+	ICP_INIT_REQUEST_SET
+};
+
+/**
+ * @QHDR_INACTIVE: Queue is inactive
+ * @QHDR_ACTIVE: Queue is active
+ */
+enum qhdr_status {
+	QHDR_INACTIVE,
+	QHDR_ACTIVE
+};
+
+/**
+ * @INTR_MODE: event driven mode 1, each send and receive generates interrupt
+ * @WM_MODE: event driven mode 2, interrupts based on watermark mechanism
+ * @POLL_MODE: poll method
+ */
+enum qhdr_event_drv_type {
+	INTR_MODE,
+	WM_MODE,
+	POLL_MODE
+};
+
+/**
+ * @TX_INT: event driven mode 1, each send and receive generates interrupt
+ * @TX_INT_WM: event driven mode 2, interrupts based on watermark mechanism
+ * @TX_POLL: poll method
+ * @ICP_QHDR_TX_TYPE_MASK defines position in qhdr_type
+ */
+enum qhdr_tx_type {
+	TX_INT,
+	TX_INT_WM,
+	TX_POLL
+};
+
+/**
+ * @RX_INT: event driven mode 1, each send and receive generates interrupt
+ * @RX_INT_WM: event driven mode 2, interrupts based on watermark mechanism
+ * @RX_POLL: poll method
+ * @ICP_QHDR_RX_TYPE_MASK defines position in qhdr_type
+ */
+enum qhdr_rx_type {
+	RX_INT,
+	RX_INT_WM,
+	RX_POLL
+};
+
+/**
+ * @Q_CMD: Host to FW command queue
+ * @Q_MSG: FW to Host message queue
+ * @Q_DEBUG: FW to Host debug queue
+ * @ICP_QHDR_Q_ID_MASK defines position in qhdr_type
+ */
+enum qhdr_q_id {
+	Q_CMD,
+	Q_MSG,
+	Q_DBG
+};
+
+/**
+ * struct hfi_qtbl_hdr
+ * @qtbl_version: Queue table version number
+ *                Higher 16 bits: Major version
+ *                Lower 16 bits: Minor version
+ * @qtbl_size: Queue table size from version to last parametr in qhdr entry
+ * @qtbl_qhdr0_offset: Offset to the start of first qhdr
+ * @qtbl_qhdr_size: Queue header size in bytes
+ * @qtbl_num_q: Total number of queues in Queue table
+ * @qtbl_num_active_q: Total number of active queues
+ */
+struct hfi_qtbl_hdr {
+	uint32_t qtbl_version;
+	uint32_t qtbl_size;
+	uint32_t qtbl_qhdr0_offset;
+	uint32_t qtbl_qhdr_size;
+	uint32_t qtbl_num_q;
+	uint32_t qtbl_num_active_q;
+} __packed;
+
+/**
+ * struct hfi_q_hdr
+ * @qhdr_status: Queue status, qhdr_state define possible status
+ * @qhdr_start_addr: Queue start address in non cached memory
+ * @qhdr_type: qhdr_tx, qhdr_rx, qhdr_q_id and priority defines qhdr type
+ * @qhdr_q_size: Queue size
+ *		Number of queue packets if qhdr_pkt_size is non-zero
+ *		Queue size in bytes if qhdr_pkt_size is zero
+ * @qhdr_pkt_size: Size of queue packet entries
+ *		0x0: variable queue packet size
+ *		non zero: size of queue packet entry, fixed
+ * @qhdr_pkt_drop_cnt: Number of packets dropped by sender
+ * @qhdr_rx_wm: Receiver watermark, applicable in event driven mode
+ * @qhdr_tx_wm: Sender watermark, applicable in event driven mode
+ * @qhdr_rx_req: Receiver sets this bit if queue is empty
+ * @qhdr_tx_req: Sender sets this bit if queue is full
+ * @qhdr_rx_irq_status: Receiver sets this bit and triggers an interrupt to
+ *		the sender after packets are dequeued. Sender clears this bit
+ * @qhdr_tx_irq_status: Sender sets this bit and triggers an interrupt to
+ *		the receiver after packets are queued. Receiver clears this bit
+ * @qhdr_read_idx: Read index
+ * @qhdr_write_idx: Write index
+ */
+struct hfi_q_hdr {
+	uint32_t dummy[15];
+	uint32_t qhdr_status;
+	uint32_t dummy1[15];
+	uint32_t qhdr_start_addr;
+	uint32_t dummy2[15];
+	uint32_t qhdr_type;
+	uint32_t dummy3[15];
+	uint32_t qhdr_q_size;
+	uint32_t dummy4[15];
+	uint32_t qhdr_pkt_size;
+	uint32_t dummy5[15];
+	uint32_t qhdr_pkt_drop_cnt;
+	uint32_t dummy6[15];
+	uint32_t qhdr_rx_wm;
+	uint32_t dummy7[15];
+	uint32_t qhdr_tx_wm;
+	uint32_t dummy8[15];
+	uint32_t qhdr_rx_req;
+	uint32_t dummy9[15];
+	uint32_t qhdr_tx_req;
+	uint32_t dummy10[15];
+	uint32_t qhdr_rx_irq_status;
+	uint32_t dummy11[15];
+	uint32_t qhdr_tx_irq_status;
+	uint32_t dummy12[15];
+	uint32_t qhdr_read_idx;
+	uint32_t dummy13[15];
+	uint32_t qhdr_write_idx;
+	uint32_t dummy14[15];
+};
+
+/**
+ * struct sfr_buf
+ * @size: Number of characters
+ * @msg : Subsystem failure reason
+ */
+struct sfr_buf {
+	uint32_t size;
+	char msg[ICP_MSG_SFR_SIZE_IN_BYTES];
+};
+
+/**
+ * struct hfi_q_tbl
+ * @q_tbl_hdr: Queue table header
+ * @q_hdr: Queue header info, it holds info of cmd, msg and debug queues
+ */
+struct hfi_qtbl {
+	struct hfi_qtbl_hdr q_tbl_hdr;
+	struct hfi_q_hdr q_hdr[MAX_ICP_HFI_QUEUES];
+};
+
+/**
+ * struct hfi_info
+ * @map: Hfi shared memory info
+ * @ops: processor-specific ops
+ * @smem_size: Shared memory size
+ * @uncachedheap_size: uncached heap size
+ * @msgpacket_buf: message buffer
+ * @cmd_q_lock: Lock for command queue
+ * @msg_q_lock: Lock for message queue
+ * @dbg_q_lock: Lock for debug queue
+ * @hfi_state: State machine for hfi
+ * @priv: device private data
+ * @dbg_lvl: debug level set to FW
+ * @fw_version: firmware version
+ * @client_name: hfi client's name
+ * @cmd_q_state: State of command queue
+ * @msg_q_state: State of message queue
+ * @dbg_q_state: State of debug queue
+ */
+struct hfi_info {
+	struct hfi_mem_info map;
+	struct hfi_ops ops;
+	uint32_t smem_size;
+	uint32_t uncachedheap_size;
+	uint32_t msgpacket_buf[ICP_HFI_MAX_MSG_SIZE_IN_WORDS];
+	struct mutex cmd_q_lock;
+	struct mutex msg_q_lock;
+	struct mutex dbg_q_lock;
+	uint8_t hfi_state;
+	void *priv;
+	u64 dbg_lvl;
+	uint32_t fw_version;
+	char client_name[HFI_CLIENT_NAME_LEN];
+	bool cmd_q_state;
+	bool msg_q_state;
+	bool dbg_q_state;
+};
+
+#endif /* _CAM_HFI_REG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/fw_inc/hfi_session_defs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/fw_inc/hfi_session_defs.h
@@ -0,0 +1,632 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_HFI_SESSION_DEFS_H
+#define _CAM_HFI_SESSION_DEFS_H
+
+#include <linux/types.h>
+
+#define HFI_IPEBPS_CMD_OPCODE_BPS_CONFIG_IO             0x1
+#define HFI_IPEBPS_CMD_OPCODE_BPS_FRAME_PROCESS         0x2
+#define HFI_IPEBPS_CMD_OPCODE_BPS_ABORT                 0x3
+#define HFI_IPEBPS_CMD_OPCODE_BPS_DESTROY               0x4
+
+#define HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO             0x5
+#define HFI_IPEBPS_CMD_OPCODE_IPE_FRAME_PROCESS         0x6
+#define HFI_IPEBPS_CMD_OPCODE_IPE_ABORT                 0x7
+#define HFI_IPEBPS_CMD_OPCODE_IPE_DESTROY               0x8
+
+#define HFI_OFE_CMD_OPCODE_CONFIG_IO                    0x1
+#define HFI_OFE_CMD_OPCODE_FRAME_PROCESS                0x2
+#define HFI_OFE_CMD_OPCODE_ABORT                        0x3
+#define HFI_OFE_CMD_OPCODE_DESTROY                      0x4
+
+#define HFI_IPEBPS_CMD_OPCODE_BPS_WAIT_FOR_IPE          0x9
+#define HFI_IPEBPS_CMD_OPCODE_BPS_WAIT_FOR_BPS          0xa
+#define HFI_IPEBPS_CMD_OPCODE_IPE_WAIT_FOR_BPS          0xb
+#define HFI_IPEBPS_CMD_OPCODE_IPE_WAIT_FOR_IPE          0xc
+
+#define HFI_IPEBPS_CMD_OPCODE_MEM_MAP                   0xe
+#define HFI_IPEBPS_CMD_OPCODE_MEM_UNMAP                 0xf
+
+#define HFI_IPEBPS_HANDLE_TYPE_BPS_NON_RT               0x1
+#define HFI_IPEBPS_HANDLE_TYPE_IPE_RT                   0x2
+#define HFI_IPEBPS_HANDLE_TYPE_IPE_NON_RT               0x3
+#define HFI_IPEBPS_HANDLE_TYPE_IPE_SEMI_RT              0x4
+#define HFI_IPEBPS_HANDLE_TYPE_BPS_RT                   0x5
+#define HFI_IPEBPS_HANDLE_TYPE_BPS_SEMI_RT              0x6
+
+#define HFI_OFE_HANDLE_TYPE_OFE_RT                      0x1
+#define HFI_OFE_HANDLE_TYPE_OFE_NON_RT                  0x2
+#define HFI_OFE_HANDLE_TYPE_OFE_SEMI_RT                 0x3
+
+/**
+ * struct mem_map_region_data
+ * @start_addr: cmd buffer region start addr
+ * @len       : length of the region
+ *
+ * create mem_map_region_data
+ */
+struct mem_map_region_data {
+	uint32_t               start_addr;
+	uint32_t               len;
+};
+
+/**
+ * struct hfi_cmd_ipe_bps_map
+ * @user_data          : user arg
+ * @mem_map_request_num: number of mappings
+ * @mem_map_region_sets: array of all map/unmap info
+ *
+ * create hfi_cmd_ipe_bps_map
+ */
+struct hfi_cmd_ipe_bps_map {
+	uint64_t                   user_data;
+	uint32_t                   mem_map_request_num;
+	union {
+		struct mem_map_region_data mem_map_region_sets[1];
+		__DECLARE_FLEX_ARRAY(struct mem_map_region_data, mem_map_region_sets_flex);
+	};
+} __packed;
+
+/**
+ * struct hfi_cmd_ipe_bps_map_ack
+ * @rc       : Async return code
+ * @user_data: user_arg
+ *
+ * create hfi_cmd_ipe_bps_map_ack
+ */
+struct hfi_cmd_ipe_bps_map_ack {
+	uint32_t            rc;
+	uint64_t            user_data;
+};
+
+/**
+ * struct abort_data
+ * @num_req_ids: Number of req ids
+ * @num_req_id: point to specific req id
+ *
+ * create abort data
+ */
+struct abort_data {
+	uint32_t num_req_ids;
+	union {
+		uint32_t num_req_id[1];
+		__DECLARE_FLEX_ARRAY(uint32_t, num_req_id_flex);
+	};
+};
+
+/**
+ * struct hfi_cmd_data
+ * @abort: abort data
+ * @user data: user supplied argument
+ *
+ * create session abort data
+ */
+struct hfi_cmd_abort {
+	struct abort_data abort;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_destroy
+ * @user_data: user supplied data
+ *
+ * IPE/BPS/OFE destroy command
+ * @HFI_IPEBPS_CMD_OPCODE_IPE_DESTROY
+ * @HFI_IPEBPS_CMD_OPCODE_BPS_DESTROY
+ * @HFI_OFE_CMD_OPCODE_OFE_DESTROY
+ */
+struct hfi_cmd_destroy {
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_chaining_ops
+ * @wait_hdl: current session handle waits on wait_hdl to complete operation
+ * @user_data: user supplied argument
+ *
+ * this structure for chaining opcodes
+ * BPS_WAITS_FOR_IPE
+ * BPS_WAITS_FOR_BPS
+ * IPE_WAITS_FOR_BPS
+ * IPE_WAITS_FOR_IPE
+ */
+struct hfi_cmd_chaining_ops {
+	uint32_t wait_hdl;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_create_handle
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @handle_type: IPE/BPS/OFE firmware session handle type
+ * @user_data1: caller provided data1
+ * @user_data2: caller provided data2
+ *
+ * create firmware session handle
+ */
+struct hfi_cmd_create_handle {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t handle_type;
+	uint64_t user_data1;
+	uint64_t user_data2;
+} __packed;
+
+/**
+ * struct hfi_cmd_dev_async
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @opcode: opcode for devices I/O async operation
+ *          CONFIG_IO: configures I/O for device handle
+ *          FRAME_PROCESS: image frame to be processed by device
+ *          ABORT: abort all processing frames of device handle
+ *          DESTROY: destroy earlier created device handle
+ *          BPS_WAITS_FOR_IPE: sync for BPS to wait for IPE
+ *          BPS_WAITS_FOR_BPS: sync for BPS to wait for BPS
+ *          IPE_WAITS_FOR_IPE: sync for IPE to wait for IPE
+ *          IPE_WAITS_FOR_BPS: sync for IPE to wait for BPS
+ * @num_fw_handles: number of device firmware handles in fw_handles array
+ * @fw_handles: device handles array
+ * @payload: command payload for device opcodes
+ * @direct: points to actual payload
+ * @indirect: points to address of payload
+ *
+ * sends async command to the earlier created device handle
+ * for asynchronous operation.
+ */
+struct hfi_cmd_dev_async {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t opcode;
+	uint64_t user_data1;
+	uint64_t user_data2;
+	uint32_t num_fw_handles;
+	union {
+		uint32_t fw_handles[1];
+		__DECLARE_FLEX_ARRAY(uint32_t, fw_handles_flex);
+	};
+	union {
+		union {
+			uint32_t direct[1];
+			__DECLARE_FLEX_ARRAY(uint32_t, direct_flex);
+		};
+		uint32_t indirect;
+	} payload;
+} __packed;
+
+/**
+ * struct hfi_msg_create_handle_ack
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @err_type: error code
+ * @fw_handle: output param for device handle
+ * @user_data1: user provided data1
+ * @user_data2: user provided data2
+ *
+ * ack for create handle command of ICP's controlled HW
+ * @HFI_MSG_IPEBPS_CREATE_HANDLE_ACK
+ */
+struct hfi_msg_create_handle_ack {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t err_type;
+	uint32_t fw_handle;
+	uint64_t user_data1;
+	uint64_t user_data2;
+} __packed;
+
+/**
+ * struct hfi_msg_dev_async_ack
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @opcode: opcode of the device async operation
+ * @user_data1: user provided data1
+ * @user_data2: user provided data2
+ * @err_type: error code
+ * @msg_data: device async done message data
+ *
+ * result of device async command
+ * @HFI_MSG_IPEBPS_ASYNC_COMMAND_ACK
+ */
+struct hfi_msg_dev_async_ack {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t opcode;
+	uint64_t user_data1;
+	uint64_t user_data2;
+	uint32_t err_type;
+	union {
+		uint32_t msg_data[1];
+		__DECLARE_FLEX_ARRAY(uint32_t, msg_data_flex);
+	};
+} __packed;
+
+/**
+ * struct hfi_msg_frame_process_done
+ * @result: result of frame process command
+ * @scratch_buffer_address: address of scratch buffer
+ */
+struct hfi_msg_frame_process_done {
+	uint32_t result;
+	uint32_t scratch_buffer_address;
+};
+
+/**
+ * struct hfi_msg_chaining_op
+ * @status: return status
+ * @user_data: user data provided as part of chaining ops
+ *
+ * Device wait response
+ */
+struct hfi_msg_chaining_op {
+	uint32_t status;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_msg_abort_destroy
+ * @status: return status
+ * @user_data: user data provided as part of abort/destroy ops
+ *
+ * Device abort/destroy response
+ */
+struct hfi_msg_abort_destroy {
+	uint32_t status;
+	uint64_t user_data;
+} __packed;
+
+#define MAX_NUM_OF_IMAGE_PLANES	2
+#define MAX_HFR_GROUP          16
+
+enum hfi_ipe_io_images {
+	IPE_INPUT_IMAGE_FULL,
+	IPE_INPUT_IMAGE_DS4,
+	IPE_INPUT_IMAGE_DS16,
+	IPE_INPUT_IMAGE_DS64,
+	IPE_INPUT_IMAGE_FULL_REF,
+	IPE_INPUT_IMAGE_DS4_REF,
+	IPE_INPUT_IMAGE_DS16_REF,
+	IPE_INPUT_IMAGE_DS64_REF,
+	IPE_OUTPUT_IMAGE_DISPLAY,
+	IPE_OUTPUT_IMAGE_VIDEO,
+	IPE_OUTPUT_IMAGE_FULL_REF,
+	IPE_OUTPUT_IMAGE_DS4_REF,
+	IPE_OUTPUT_IMAGE_DS16_REF,
+	IPE_OUTPUT_IMAGE_DS64_REF,
+	IPE_INPUT2_IMAGE_FULL,
+	IPE_INPUT2_IMAGE_DSX,
+	IPE_INPUT_OUTPUT_SCRATCHBUFFER,
+	IPE_INPUT_IMAGE_FIRST = IPE_INPUT_IMAGE_FULL,
+	IPE_INPUT_IMAGE_LAST = IPE_INPUT_IMAGE_DS64_REF,
+	IPE_INPUT_IMAGE_REF_FIRST = IPE_INPUT_IMAGE_FULL_REF,
+	IPE_INPUT_IMAGE_REF_LAST = IPE_INPUT_IMAGE_DS64_REF,
+	IPE_OUTPUT_IMAGE_FIRST = IPE_OUTPUT_IMAGE_DISPLAY,
+	IPE_OUTPUT_IMAGE_LAST = IPE_OUTPUT_IMAGE_DS64_REF,
+	IPE_OUTPUT_IMAGE_REF_FIRST = IPE_OUTPUT_IMAGE_FULL_REF,
+	IPE_OUTPUT_IMAGE_REF_LAST = IPE_OUTPUT_IMAGE_DS64_REF,
+	IPE_INPUT2_IMAGE_FIRST = IPE_INPUT2_IMAGE_FULL,
+	IPE_INPUT2_IMAGE_LAST = IPE_INPUT2_IMAGE_DSX,
+	IPE_INPUT_OUTPUT_IMAGE_LAST = IPE_INPUT_OUTPUT_SCRATCHBUFFER,
+	IPE_IO_IMAGES_MAX
+};
+
+enum bps_io_images {
+	BPS_INPUT_IMAGE,
+	BPS_OUTPUT_IMAGE_FULL,
+	BPS_OUTPUT_IMAGE_DS4,
+	BPS_OUTPUT_IMAGE_DS16,
+	BPS_OUTPUT_IMAGE_DS64,
+	BPS_OUTPUT_IMAGE_STATS_BG,
+	BPS_OUTPUT_IMAGE_STATS_BHIST,
+	BPS_OUTPUT_IMAGE_REG1,
+	BPS_OUTPUT_IMAGE_REG2,
+	BPS_OUTPUT_IMAGE_FIRST = BPS_OUTPUT_IMAGE_FULL,
+	BPS_OUTPUT_IMAGE_LAST = BPS_OUTPUT_IMAGE_REG2,
+	BPS_IO_IMAGES_MAX
+};
+
+struct frame_buffer {
+	uint32_t buf_ptr[MAX_NUM_OF_IMAGE_PLANES];
+	uint32_t meta_buf_ptr[MAX_NUM_OF_IMAGE_PLANES];
+} __packed;
+
+struct bps_frame_process_data {
+	uint32_t max_num_cores;
+	uint32_t target_time;
+	uint32_t ubwc_stats_buffer_addr;
+	uint32_t ubwc_stats_buffer_size;
+	uint32_t cdm_buffer_addr;
+	uint32_t cdm_buffer_size;
+	uint32_t iq_settings_addr;
+	uint32_t strip_lib_out_addr;
+	uint32_t cdm_prog_addr;
+	uint32_t request_id;
+	struct frame_buffer buffers[BPS_IO_IMAGES_MAX];
+};
+
+enum hfi_ipe_image_format {
+	IMAGE_FORMAT_INVALID,
+	IMAGE_FORMAT_MIPI_8,
+	IMAGE_FORMAT_MIPI_10,
+	IMAGE_FORMAT_MIPI_12,
+	IMAGE_FORMAT_MIPI_14,
+	IMAGE_FORMAT_BAYER_8,
+	IMAGE_FORMAT_BAYER_10,
+	IMAGE_FORMAT_BAYER_12,
+	IMAGE_FORMAT_BAYER_14,
+	IMAGE_FORMAT_PDI_10,
+	IMAGE_FORMAT_PD_10,
+	IMAGE_FORMAT_PD_8,
+	IMAGE_FORMAT_INDICATIONS,
+	IMAGE_FORMAT_REFINEMENT,
+	IMAGE_FORMAT_UBWC_TP_10,
+	IMAGE_FORMAT_UBWC_NV_12,
+	IMAGE_FORMAT_UBWC_NV12_4R,
+	IMAGE_FORMAT_UBWC_P010,
+	IMAGE_FORMAT_LINEAR_TP_10,
+	IMAGE_FORMAT_LINEAR_P010,
+	IMAGE_FORMAT_LINEAR_NV12,
+	IMAGE_FORMAT_LINEAR_PLAIN_16,
+	IMAGE_FORMAT_YUV422_8,
+	IMAGE_FORMAT_YUV422_10,
+	IMAGE_FORMAT_STATISTICS_BAYER_GRID,
+	IMAGE_FORMAT_STATISTICS_BAYER_HISTOGRAM,
+	IMAGE_FORMAT_MAX
+};
+
+enum hfi_ipe_plane_format {
+	PLANE_FORMAT_INVALID = 0,
+	PLANE_FORMAT_MIPI_8,
+	PLANE_FORMAT_MIPI_10,
+	PLANE_FORMAT_MIPI_12,
+	PLANE_FORMAT_MIPI_14,
+	PLANE_FORMAT_BAYER_8,
+	PLANE_FORMAT_BAYER_10,
+	PLANE_FORMAT_BAYER_12,
+	PLANE_FORMAT_BAYER_14,
+	PLANE_FORMAT_PDI_10,
+	PLANE_FORMAT_PD_10,
+	PLANE_FORMAT_PD_8,
+	PLANE_FORMAT_INDICATIONS,
+	PLANE_FORMAT_REFINEMENT,
+	PLANE_FORMAT_UBWC_TP_10_Y,
+	PLANE_FORMAT_UBWC_TP_10_C,
+	PLANE_FORMAT_UBWC_NV_12_Y,
+	PLANE_FORMAT_UBWC_NV_12_C,
+	PLANE_FORMAT_UBWC_NV_12_4R_Y,
+	PLANE_FORMAT_UBWC_NV_12_4R_C,
+	PLANE_FORMAT_UBWC_P010_Y,
+	PLANE_FORMAT_UBWC_P010_C,
+	PLANE_FORMAT_LINEAR_TP_10_Y,
+	PLANE_FORMAT_LINEAR_TP_10_C,
+	PLANE_FORMAT_LINEAR_P010_Y,
+	PLANE_FORMAT_LINEAR_P010_C,
+	PLANE_FORMAT_LINEAR_NV12_Y,
+	PLANE_FORMAT_LINEAR_NV12_C,
+	PLANE_FORMAT_LINEAR_PLAIN_16_Y,
+	PLANE_FORMAT_LINEAR_PLAIN_16_C,
+	PLANE_FORMAT_YUV422_8,
+	PLANE_FORMAT_YUV422_10,
+	PLANE_FORMAT_STATISTICS_BAYER_GRID,
+	PLANE_FORMAT_STATISTICS_BAYER_HISTOGRAM,
+	PLANE_FORMAT_MAX
+};
+
+enum hfi_ipe_bayer_pixel_order {
+	FIRST_PIXEL_R,
+	FIRST_PIXEL_GR,
+	FIRST_PIXEL_B,
+	FIRST_PIXEL_GB,
+	FIRST_PIXEL_MAX
+};
+
+enum hfi_ipe_pixel_pack_alignment {
+	PIXEL_LSB_ALIGNED,
+	PIXEL_MSB_ALIGNED,
+};
+
+enum hfi_ipe_yuv_422_order {
+	PIXEL_ORDER_Y_U_Y_V,
+	PIXEL_ORDER_Y_V_Y_U,
+	PIXEL_ORDER_U_Y_V_Y,
+	PIXEL_ORDER_V_Y_U_Y,
+	PIXEL_ORDER_YUV422_MAX
+};
+
+enum ubwc_write_client {
+	IPE_WR_CLIENT_0 = 0,
+	IPE_WR_CLIENT_1,
+	IPE_WR_CLIENT_5,
+	IPE_WR_CLIENT_6,
+	IPE_WR_CLIENT_7,
+	IPE_WR_CLIENT_8,
+	IPE_WR_CLIENT_MAX
+};
+
+/**
+ * struct image_info
+ * @format: image format
+ * @img_width: image width
+ * @img_height: image height
+ * @bayer_order: pixel order
+ * @pix_align: alignment
+ * @yuv422_order: YUV order
+ * @byte_swap: byte swap
+ */
+struct image_info {
+	enum hfi_ipe_image_format format;
+	uint32_t img_width;
+	uint32_t img_height;
+	enum hfi_ipe_bayer_pixel_order bayer_order;
+	enum hfi_ipe_pixel_pack_alignment pix_align;
+	enum hfi_ipe_yuv_422_order yuv422_order;
+	uint32_t byte_swap;
+} __packed;
+
+/**
+ * struct buffer_layout
+ * @buf_stride: buffer stride
+ * @buf_height: buffer height
+ */
+struct buffer_layout {
+	uint32_t buf_stride;
+	uint32_t buf_height;
+} __packed;
+
+/**
+ * struct image_desc
+ * @info: image info
+ * @buf_layout: buffer layout
+ * @meta_buf_layout: meta buffer layout
+ */
+struct image_desc {
+	struct image_info info;
+	struct buffer_layout buf_layout[MAX_NUM_OF_IMAGE_PLANES];
+	struct buffer_layout meta_buf_layout[MAX_NUM_OF_IMAGE_PLANES];
+} __packed;
+
+struct ica_stab_coeff {
+	uint32_t coeffs[8];
+} __packed;
+
+struct ica_stab_params {
+	uint32_t mode;
+	struct ica_stab_coeff transforms[3];
+} __packed;
+
+struct frame_set {
+	struct frame_buffer buffers[IPE_IO_IMAGES_MAX];
+	uint32_t cdm_ica1_addr;
+	uint32_t cdm_ica2_addr;
+} __packed;
+
+struct ipe_frame_process_data {
+	uint32_t strip_lib_out_addr;
+	uint32_t iq_settings_addr;
+	uint32_t scratch_buffer_addr;
+	uint32_t scratch_buffer_size;
+	uint32_t ubwc_stats_buffer_addr;
+	uint32_t ubwc_stats_buffer_size;
+	uint32_t cdm_buffer_addr;
+	uint32_t cdm_buffer_size;
+	uint32_t max_num_cores;
+	uint32_t target_time;
+	uint32_t cdm_prog_base;
+	uint32_t cdm_pre_ltm;
+	uint32_t cdm_post_ltm;
+	uint32_t cdm_anr_full_pass;
+	uint32_t cdm_anr_ds4;
+	uint32_t cdm_anr_ds16;
+	uint32_t cdm_anr_ds64;
+	uint32_t cdm_tf_full_pass;
+	uint32_t cdm_tf_ds4;
+	uint32_t cdm_tf_ds16;
+	uint32_t cdm_tf_ds64;
+	uint32_t cdm_dsx_dc4;
+	uint32_t cdm_dsx_dc16;
+	uint32_t cdm_dsz_dc64;
+	uint32_t cdm_mfhdr_full_pass;
+	uint32_t cdm_mfhdr_dcx;
+	uint32_t request_id;
+	uint32_t frames_in_batch;
+	struct frame_set framesets[MAX_HFR_GROUP];
+} __packed;
+
+/**
+ * struct hfi_cmd_ipe_config
+ * @images: images descreptions
+ * @user_data: user supplied data
+ *
+ * payload for IPE async command
+ */
+struct hfi_cmd_ipe_config {
+	struct image_desc images[IPE_IO_IMAGES_MAX];
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct frame_buffers
+ * @buf_ptr: buffer pointers for all planes
+ * @meta_buf_ptr: meta buffer pointers for all planes
+ */
+struct frame_buffers {
+	uint32_t buf_ptr[MAX_NUM_OF_IMAGE_PLANES];
+	uint32_t meta_buf_ptr[MAX_NUM_OF_IMAGE_PLANES];
+} __packed;
+
+/**
+ * struct hfi_msg_ipe_config
+ * @rc: result of ipe config command
+ * @scratch_mem_size: scratch mem size for a config
+ * @user_data: user data
+ */
+struct hfi_msg_ipe_config {
+	uint32_t rc;
+	uint32_t scratch_mem_size;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_msg_bps_config
+ * @rc: result of bps config command
+ * @user_data: user data
+ */
+struct hfi_msg_bps_config {
+	uint32_t rc;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_msg_ofe_config
+ * @rc: result of ofe config command
+ */
+struct hfi_msg_ofe_config {
+	uint32_t rc;
+} __packed;
+
+/**
+ * struct icp_dev_destroy
+ * @user_data: user data
+ */
+struct icp_dev_destroy {
+	uint64_t userdata;
+};
+
+/**
+ * struct hfi_msg_ipe_frame_process
+ * @status: result of ipe frame process command
+ * @scratch_buf_addr: address of scratch buffer
+ * @user_data: user data
+ */
+struct hfi_msg_ipe_frame_process {
+	uint32_t status;
+	uint32_t scratch_buf_addr;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_synx_test_payload
+ *        Same struct used for cmd and response
+ *
+ * @size: Size of the pkt
+ * @pkt_type: pkt type (cmd/response)
+ * @input_size: Input buffer size
+ * @input_iova: Input buffer address
+ * @output_size: Output buffer size
+ * @output_iova: Output buffer address
+ */
+struct hfi_cmd_synx_test_payload {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t input_size;
+	uint32_t input_iova;
+	uint32_t output_size;
+	uint32_t output_iova;
+} __packed;
+#endif /* _CAM_HFI_SESSION_DEFS_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/fw_inc/hfi_sys_defs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/fw_inc/hfi_sys_defs.h
@@ -0,0 +1,685 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _HFI_DEFS_H_
+#define _HFI_DEFS_H_
+
+#include <linux/types.h>
+
+/*
+ * Following base acts as common starting points
+ * for all enumerations.
+ */
+#define HFI_COMMON_BASE                 0x0
+
+/* HFI Domain base offset for commands and messages */
+#define HFI_DOMAIN_SHFT                 (24)
+#define HFI_DOMAIN_BMSK                 (0x7 << HFI_DOMAIN_SHFT)
+#define HFI_DOMAIN_BASE_ICP             (0x0 << HFI_DOMAIN_SHFT)
+#define HFI_DOMAIN_BASE_IPE_BPS         (0x1 << HFI_DOMAIN_SHFT)
+#define HFI_DOMAIN_BASE_CDM             (0x2 << HFI_DOMAIN_SHFT)
+#define HFI_DOMAIN_BASE_DBG             (0x3 << HFI_DOMAIN_SHFT)
+#define HFI_DOMAIN_BASE_OFE             (0x4 << HFI_DOMAIN_SHFT)
+
+/* Command base offset for commands */
+#define HFI_CMD_START_OFFSET            0x10000
+
+/* Command base offset for messages */
+#define HFI_MSG_START_OFFSET            0x20000
+
+/* System Level Error types */
+#define HFI_ERR_SYS_NONE                (HFI_COMMON_BASE)
+#define HFI_ERR_SYS_FATAL               (HFI_COMMON_BASE + 0x1)
+#define HFI_ERR_SYS_VERSION_MISMATCH    (HFI_COMMON_BASE + 0x2)
+#define HFI_ERR_SYS_UNSUPPORTED_DOMAIN  (HFI_COMMON_BASE + 0x3)
+#define HFI_ERR_SYS_UNSUPPORT_CMD       (HFI_COMMON_BASE + 0x4)
+#define HFI_ERR_SYS_CMDFAILED           (HFI_COMMON_BASE + 0x5)
+#define HFI_ERR_SYS_CMDSIZE             (HFI_COMMON_BASE + 0x6)
+
+/* System Level Event types */
+#define HFI_EVENT_SYS_ERROR             (HFI_COMMON_BASE + 0x1)
+#define HFI_EVENT_ICP_ERROR             (HFI_COMMON_BASE + 0x2)
+#define HFI_EVENT_IPE_BPS_ERROR         (HFI_COMMON_BASE + 0x3)
+#define HFI_EVENT_CDM_ERROR             (HFI_COMMON_BASE + 0x4)
+#define HFI_EVENT_DBG_ERROR             (HFI_COMMON_BASE + 0x5)
+#define HFI_EVENT_OFE_ERROR             (HFI_COMMON_BASE + 0x6)
+
+/* Core level start Ranges for errors */
+#define HFI_ERR_ICP_START               (HFI_COMMON_BASE       + 0x64)
+#define HFI_ERR_IPE_BPS_START           (HFI_ERR_ICP_START     + 0x64)
+#define HFI_ERR_CDM_START               (HFI_ERR_IPE_BPS_START + 0x64)
+#define HFI_ERR_DBG_START               (HFI_ERR_CDM_START     + 0x64)
+#define HFI_ERR_OFE_START               (HFI_ERR_DBG_START     + 0x64)
+
+/*ICP Core level  error messages */
+#define HFI_ERR_NO_RES                  (HFI_ERR_ICP_START + 0x1)
+#define HFI_ERR_UNSUPPORTED_RES         (HFI_ERR_ICP_START + 0x2)
+#define HFI_ERR_UNSUPPORTED_PROP        (HFI_ERR_ICP_START + 0x3)
+#define HFI_ERR_INIT_EXPECTED           (HFI_ERR_ICP_START + 0x4)
+#define HFI_ERR_INIT_IGNORED            (HFI_ERR_ICP_START + 0x5)
+
+/* System level commands */
+#define HFI_CMD_COMMON_START \
+		(HFI_DOMAIN_BASE_ICP + HFI_CMD_START_OFFSET + 0x0)
+#define HFI_CMD_SYS_INIT               (HFI_CMD_COMMON_START + 0x1)
+#define HFI_CMD_SYS_PC_PREP            (HFI_CMD_COMMON_START + 0x2)
+#define HFI_CMD_SYS_SET_PROPERTY       (HFI_CMD_COMMON_START + 0x3)
+#define HFI_CMD_SYS_GET_PROPERTY       (HFI_CMD_COMMON_START + 0x4)
+#define HFI_CMD_SYS_PING               (HFI_CMD_COMMON_START + 0x5)
+#define HFI_CMD_SYS_RESET              (HFI_CMD_COMMON_START + 0x6)
+
+/* General Frame process errors */
+#define CAMERAICP_SUCCESS              0
+#define CAMERAICP_EFAILED              1
+#define CAMERAICP_ENOMEMORY            2
+#define CAMERAICP_EBADSTATE            3
+#define CAMERAICP_EBADPARM             4
+#define CAMERAICP_EBADITEM             5
+#define CAMERAICP_EINVALIDFORMAT       6
+#define CAMERAICP_EUNSUPPORTED         7
+#define CAMERAICP_EOUTOFBOUND          8
+#define CAMERAICP_ETIMEDOUT            9
+#define CAMERAICP_EABORTED             10
+#define CAMERAICP_EHWVIOLATION         11
+#define CAMERAICP_ECDMERROR            12
+
+/* HFI Specific errors. */
+#define CAMERAICP_HFI_ERR_COMMAND_SIZE 1000
+#define CAMERAICP_HFI_ERR_MESSAGE_SIZE 1001
+#define CAMERAICP_HFI_QUEUE_EMPTY      1002
+#define CAMERAICP_HFI_QUEUE_FULL       1003
+
+/* Core level commands */
+/* IPE/BPS core Commands */
+#define HFI_CMD_IPE_BPS_COMMON_START \
+		(HFI_DOMAIN_BASE_IPE_BPS + HFI_CMD_START_OFFSET + 0x0)
+#define HFI_CMD_IPEBPS_CREATE_HANDLE \
+		(HFI_CMD_IPE_BPS_COMMON_START + 0x8)
+#define HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT \
+		(HFI_CMD_IPE_BPS_COMMON_START + 0xa)
+#define HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT \
+		(HFI_CMD_IPE_BPS_COMMON_START + 0xe)
+
+/* Core level commands */
+/* OFE core Commands */
+#define HFI_CMD_OFE_COMMON_START \
+		(HFI_DOMAIN_BASE_OFE + HFI_CMD_START_OFFSET + 0x0)
+#define HFI_CMD_OFE_CREATE_HANDLE \
+		(HFI_CMD_OFE_COMMON_START + 0x08)
+#define HFI_CMD_OFE_ASYNC_COMMAND \
+		(HFI_CMD_OFE_COMMON_START + 0x0e)
+
+/* CDM core Commands */
+#define HFI_CMD_CDM_COMMON_START \
+		(HFI_DOMAIN_BASE_CDM + HFI_CMD_START_OFFSET + 0x0)
+#define HFI_CMD_CDM_TEST_START (HFI_CMD_CDM_COMMON_START + 0x800)
+#define HFI_CMD_CDM_END        (HFI_CMD_CDM_COMMON_START + 0xFFF)
+
+/* Debug/Test Commands */
+#define HFI_CMD_DBG_COMMON_START \
+		(HFI_DOMAIN_BASE_DBG + HFI_CMD_START_OFFSET + 0x0)
+#define HFI_CMD_DBG_TEST_START  (HFI_CMD_DBG_COMMON_START + 0x800)
+#define HFI_CMD_DBG_SYNX_TEST   (HFI_CMD_DBG_TEST_START + 0x1)
+#define HFI_CMD_DBG_END         (HFI_CMD_DBG_COMMON_START + 0xFFF)
+
+/* System level messages */
+#define HFI_MSG_ICP_COMMON_START \
+		(HFI_DOMAIN_BASE_ICP + HFI_MSG_START_OFFSET + 0x0)
+#define HFI_MSG_SYS_INIT_DONE           (HFI_MSG_ICP_COMMON_START + 0x1)
+#define HFI_MSG_SYS_PC_PREP_DONE        (HFI_MSG_ICP_COMMON_START + 0x2)
+#define HFI_MSG_SYS_DEBUG               (HFI_MSG_ICP_COMMON_START + 0x3)
+#define HFI_MSG_SYS_IDLE                (HFI_MSG_ICP_COMMON_START + 0x4)
+#define HFI_MSG_SYS_PROPERTY_INFO       (HFI_MSG_ICP_COMMON_START + 0x5)
+#define HFI_MSG_SYS_PING_ACK            (HFI_MSG_ICP_COMMON_START + 0x6)
+#define HFI_MSG_SYS_RESET_ACK           (HFI_MSG_ICP_COMMON_START + 0x7)
+#define HFI_MSG_EVENT_NOTIFY            (HFI_MSG_ICP_COMMON_START + 0x8)
+
+/* Core level Messages */
+/* IPE/BPS core Messages */
+#define HFI_MSG_IPE_BPS_COMMON_START \
+		(HFI_DOMAIN_BASE_IPE_BPS + HFI_MSG_START_OFFSET + 0x0)
+#define HFI_MSG_IPEBPS_CREATE_HANDLE_ACK \
+		(HFI_MSG_IPE_BPS_COMMON_START + 0x08)
+#define HFI_MSG_IPEBPS_ASYNC_COMMAND_DIRECT_ACK \
+		(HFI_MSG_IPE_BPS_COMMON_START + 0x0a)
+#define HFI_MSG_IPEBPS_ASYNC_COMMAND_INDIRECT_ACK \
+		(HFI_MSG_IPE_BPS_COMMON_START + 0x0e)
+#define HFI_MSG_IPE_BPS_TEST_START \
+		(HFI_MSG_IPE_BPS_COMMON_START + 0x800)
+#define HFI_MSG_IPE_BPS_END \
+		(HFI_MSG_IPE_BPS_COMMON_START + 0xFFF)
+
+/* Core level Messages */
+/* OFE core Messages */
+#define HFI_MSG_OFE_COMMON_START \
+		(HFI_DOMAIN_BASE_OFE + HFI_MSG_START_OFFSET + 0x0)
+#define HFI_MSG_OFE_CREATE_HANDLE_ACK \
+		(HFI_MSG_OFE_COMMON_START + 0X08)
+#define HFI_MSG_OFE_ASYNC_COMMAND_ACK \
+		(HFI_MSG_OFE_COMMON_START + 0x0e)
+#define HFI_MSG_OFE_TEST_START \
+		(HFI_MSG_OFE_COMMON_START + 0x0800)
+#define HFI_MSG_OFE_END \
+		(HFI_MSG_OFE_COMMON_START + 0x0FFF)
+
+/* CDM core Messages */
+#define HFI_MSG_CDM_COMMON_START \
+		(HFI_DOMAIN_BASE_CDM + HFI_MSG_START_OFFSET + 0x0)
+#define  HFI_MSG_PRI_CDM_PAYLOAD_ACK    (HFI_MSG_CDM_COMMON_START + 0xa)
+#define  HFI_MSG_PRI_LLD_PAYLOAD_ACK    (HFI_MSG_CDM_COMMON_START + 0xb)
+#define HFI_MSG_CDM_TEST_START          (HFI_MSG_CDM_COMMON_START + 0x800)
+#define HFI_MSG_CDM_END                 (HFI_MSG_CDM_COMMON_START + 0xFFF)
+
+/* core level test command ranges */
+/* ICP core level test command range */
+#define HFI_CMD_ICP_TEST_START          (HFI_CMD_ICP_COMMON_START + 0x800)
+#define HFI_CMD_ICP_END                 (HFI_CMD_ICP_COMMON_START + 0xFFF)
+
+/* IPE/BPS core level test command range */
+#define HFI_CMD_IPE_BPS_TEST_START \
+		(HFI_CMD_IPE_BPS_COMMON_START + 0x800)
+#define HFI_CMD_IPE_BPS_END (HFI_CMD_IPE_BPS_COMMON_START + 0xFFF)
+
+/* OFE core level test command range */
+#define HFI_CMD_OFE_TEST_START         (HFI_CMD_OFE_COMMON_START + 0x0800)
+#define HFI_CMD_OFE_END                (HFI_CMD_OFE_COMMON_START + 0x0FFF)
+
+/* ICP core level test message range */
+#define HFI_MSG_ICP_TEST_START  (HFI_MSG_ICP_COMMON_START + 0x800)
+#define HFI_MSG_ICP_END         (HFI_MSG_ICP_COMMON_START + 0xFFF)
+
+/* ICP core level Debug test message range */
+#define HFI_MSG_DBG_COMMON_START \
+		(HFI_DOMAIN_BASE_DBG + HFI_MSG_START_OFFSET + 0x0)
+
+#define HFI_MSG_DBG_TEST_START  (HFI_MSG_DBG_COMMON_START + 0x800)
+#define HFI_MSG_DBG_SYNX_TEST   (HFI_MSG_DBG_TEST_START + 0x1)
+#define HFI_MSG_DBG_END         (HFI_MSG_DBG_COMMON_START + 0xFFF)
+
+/* System  level property base offset */
+#define HFI_PROPERTY_ICP_COMMON_START  (HFI_DOMAIN_BASE_ICP + 0x0)
+
+#define HFI_PROP_SYS_DEBUG_CFG             (HFI_PROPERTY_ICP_COMMON_START + 0x1)
+#define HFI_PROP_SYS_UBWC_CFG              (HFI_PROPERTY_ICP_COMMON_START + 0x2)
+#define HFI_PROP_SYS_IMAGE_VER             (HFI_PROPERTY_ICP_COMMON_START + 0x3)
+#define HFI_PROP_SYS_SUPPORTED             (HFI_PROPERTY_ICP_COMMON_START + 0x4)
+#define HFI_PROP_SYS_IPEBPS_PC             (HFI_PROPERTY_ICP_COMMON_START + 0x5)
+#define HFI_PROP_SYS_FW_DUMP_CFG           (HFI_PROPERTY_ICP_COMMON_START + 0x8)
+#define HFI_PROP_SYS_UBWC_CONFIG_EX        (HFI_PROPERTY_ICP_COMMON_START + 0x9)
+#define HFI_PROP_SYS_ICP_HW_FREQUENCY      (HFI_PROPERTY_ICP_COMMON_START + 0xa)
+#define HFI_PROP_SYS_ICP_RAMDUMP_MODE      (HFI_PROPERTY_ICP_COMMON_START + 0xb)
+#define HFI_PROP_SYS_OFE_PC                (HFI_PROPERTY_ICP_COMMON_START + 0xc)
+#define HFI_PROP_SYS_MEM_REGIONS           (HFI_PROPERTY_ICP_COMMON_START + 0xe)
+
+/* Capabilities reported at sys init */
+#define HFI_CAPS_PLACEHOLDER_1         (HFI_COMMON_BASE + 0x1)
+#define HFI_CAPS_PLACEHOLDER_2         (HFI_COMMON_BASE + 0x2)
+
+/* Section describes different debug levels (HFI_DEBUG_MSG_X)
+ * available for debug messages from FW
+ */
+#define  HFI_DEBUG_MSG_LOW      0x00000001
+#define  HFI_DEBUG_MSG_MEDIUM   0x00000002
+#define  HFI_DEBUG_MSG_HIGH     0x00000004
+#define  HFI_DEBUG_MSG_ERROR    0x00000008
+#define  HFI_DEBUG_MSG_FATAL    0x00000010
+/* Messages containing performance data */
+#define  HFI_DEBUG_MSG_PERF     0x00000020
+/* Disable ARM9 WFI in low power mode. */
+#define  HFI_DEBUG_CFG_WFI      0x01000000
+/* Disable ARM9 watchdog. */
+#define  HFI_DEBUG_CFG_ARM9WD   0x10000000
+
+
+/*
+ * HFI_FW_DUMP levels
+ * HFI_FW_DUMP_xx
+ */
+#define HFI_FW_DUMP_DISABLED    0x00000000
+#define HFI_FW_DUMP_ON_FAILURE  0x00000001
+#define HFI_FW_DUMP_ALWAYS      0x00000002
+
+/* Number of available dump levels. */
+#define NUM_HFI_DUMP_LVL        0x00000003
+
+/* Number of available ramdump levels. */
+#define HFI_FW_RAMDUMP_DISABLED 0x00000000
+#define HFI_FW_RAMDUMP_ENABLED  0x00000001
+
+/* Number of available ramdump levels. */
+#define NUM_HFI_RAMDUMP_LVLS    0x00000002
+
+/* Debug Msg Communication types:
+ * Section describes different modes (HFI_DEBUG_MODE_X)
+ * available to communicate the debug messages
+ */
+ /* Debug message output through the interface debug queue. */
+#define HFI_DEBUG_MODE_QUEUE     0x00000001
+ /* Debug message output through QDSS. */
+#define HFI_DEBUG_MODE_QDSS      0x00000002
+ /* Number of debug modes available. */
+#define NUM_HFI_DEBUG_MODE       0x00000002
+
+#define HFI_DEBUG_MSG_LOW        0x00000001
+#define HFI_DEBUG_MSG_MEDIUM     0x00000002
+#define HFI_DEBUG_MSG_HIGH       0x00000004
+#define HFI_DEBUG_MSG_ERROR      0x00000008
+#define HFI_DEBUG_MSG_FATAL      0x00000010
+#define HFI_DEBUG_MSG_PERF       0x00000020
+#define HFI_DEBUG_CFG_WFI        0x01000000
+#define HFI_DEBUG_CFG_ARM9WD     0x10000000
+
+#define HFI_DEV_VERSION_MAX      0x6
+
+#define ICP_PWR_CLP_BPS          0x00000001
+#define ICP_PWR_CLP_IPE0         0x00010000
+#define ICP_PWR_CLP_IPE1         0x00020000
+#define ICP_PWR_CLP_OFE          0x00000001
+
+/* New mem region definitions */
+#define HFI_MEM_REGION_ID_IPCLITE_SHARED_MEM      0
+#define HFI_MEM_REGION_ID_SYNX_HW_MUTEX           1
+#define HFI_MEM_REGION_ID_GLOBAL_ATOMIC_HW_MUTEX  2
+#define HFI_MEM_REGION_ID_GLOBAL_CNTR             3
+
+/* Type of the new regions */
+#define HFI_MEM_REGION_TYPE_CACHED       0
+#define HFI_MEM_REGION_TYPE_UNCACHED     1
+#define HFI_MEM_REGION_TYPE_DEVICE       2
+
+/**
+ * start of sys command packet types
+ * These commands are used to get system level information
+ * from firmware
+ */
+
+/**
+ * struct hfi_caps_support
+ * payload to report caps through HFI_PROPERTY_PARAM_CAPABILITY_SUPPORTED
+ * @type: capability type
+ * @min: minimum supported value for the capability
+ * @max: maximum supported value for the capability
+ * @step_size: supported steps between min-max
+ */
+struct hfi_caps_support {
+	uint32_t type;
+	uint32_t min;
+	uint32_t max;
+	uint32_t step_size;
+} __packed;
+
+/**
+ * struct hfi_caps_support_info
+ * capability report through HFI_PROPERTY_PARAM_CAPABILITY_SUPPORTED
+ * @num_caps: number of capabilities listed
+ * @caps_data: capabilities info array
+ */
+struct hfi_caps_support_info {
+	uint32_t num_caps;
+	union {
+		struct hfi_caps_support caps_data[1];
+		__DECLARE_FLEX_ARRAY(struct hfi_caps_support, caps_data_flex);
+	};
+} __packed;
+
+/**
+ * struct hfi_debug
+ * payload structure to configure HFI_PROPERTY_SYS_DEBUG_CONFIG
+ * @debug_config: it is a result of HFI_DEBUG_MSG_X values that
+ *                are OR-ed together to specify the debug message types
+ *                to output
+ * @debug_mode: debug message output through debug queue/qdss
+ * @HFI_PROPERTY_SYS_DEBUG_CONFIG
+ */
+struct hfi_debug {
+	uint32_t debug_config;
+	uint32_t debug_mode;
+} __packed;
+
+/**
+ * struct hfi_dev_pc
+ * payload structure to configure HFI_PROPERTY_SYS_DEV_PC
+ * @enable: Flag to enable IPE, BPS interfrane power collapse
+ * @core_info: Core information to firmware
+ */
+struct hfi_dev_pc {
+	uint32_t enable;
+	uint32_t core_info;
+} __packed;
+
+/**
+ * struct hfi_cmd_ubwc_cfg
+ * Payload structure to configure HFI_PROP_SYS_UBWC_CFG
+ * @ubwc_fetch_cfg: UBWC configuration for fecth
+ * @ubwc_write_cfg: UBWC configuration for write
+ */
+struct hfi_cmd_ubwc_cfg {
+	uint32_t ubwc_fetch_cfg;
+	uint32_t ubwc_write_cfg;
+} __packed;
+
+/**
+ * struct hfi_cmd_ubwc_cfg_ext
+ * Payload structure to configure HFI_UBWC_CFG_TYPE_EXT
+ * @bps: UBWC configuration for bps
+ * @ipe: UBWC configuration for ipe
+ * @ofe: UBWC configuration for ofe
+ */
+struct hfi_cmd_ubwc_cfg_ext {
+	struct hfi_cmd_ubwc_cfg bps;
+	struct hfi_cmd_ubwc_cfg ipe;
+	struct hfi_cmd_ubwc_cfg ofe;
+} __packed;
+
+/**
+ * struct hfi_cmd_sys_init
+ * command to initialization of system session
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @HFI_CMD_SYS_INIT
+ */
+struct hfi_cmd_sys_init {
+	uint32_t size;
+	uint32_t pkt_type;
+} __packed;
+
+/**
+ * struct hfi_cmd_pc_prep
+ * command to firmware to prepare for power collapse
+ * @eize: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @HFI_CMD_SYS_PC_PREP
+ */
+struct hfi_cmd_pc_prep {
+	uint32_t size;
+	uint32_t pkt_type;
+} __packed;
+
+/**
+ * struct hfi_cmd_prop
+ * command to get/set properties of firmware
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @num_prop: number of properties queried/set
+ * @prop_data: array of property IDs being queried. size depends on num_prop
+ *             array of property IDs and associated structure pairs in set
+ * @HFI_CMD_SYS_GET_PROPERTY
+ * @HFI_CMD_SYS_SET_PROPERTY
+ */
+struct hfi_cmd_prop {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t num_prop;
+	union {
+		uint32_t prop_data[1];
+		__DECLARE_FLEX_ARRAY(uint32_t, prop_data_flex);
+	};
+} __packed;
+
+/**
+ * struct hfi_cmd_ping_pkt
+ * ping command pings the firmware to confirm whether
+ * it is alive.
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @user_data: client data, firmware returns this data
+ *             as part of HFI_MSG_SYS_PING_ACK
+ * @HFI_CMD_SYS_PING
+ */
+struct hfi_cmd_ping_pkt {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_sys_reset_pkt
+ * sends the reset command to FW. FW responds in the same type
+ * of packet. so can be used for reset_ack_pkt type also
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @user_data: client data, firmware returns this data
+ *             as part of HFI_MSG_SYS_RESET_ACK
+ * @HFI_CMD_SYS_RESET
+ */
+struct hfi_cmd_sys_reset_pkt {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_mem_region_info
+ * Payload structure to configure HFI_PROP_SYS_MEM_REGIONS
+ * @region_id: region id (HW mutex/synx global mem/...)
+ * @region_type: Type of the region (cached/uncached/device/..)
+ * @start_addr: va to the start of this region
+ * @size: size of this region
+ */
+struct hfi_cmd_mem_region_info {
+	uint32_t region_id;
+	uint32_t region_type;
+	uint64_t start_addr;
+	uint32_t size;
+} __packed;
+
+/**
+ * struct hfi_cmd_mem_region_info
+ * Payload structure to configure HFI_PROP_SYS_MEM_REGIONS
+ * @num_valid_regions: Valid number of regions configured to FW
+ * @region_info: Region specific info
+ */
+struct hfi_cmd_config_mem_regions {
+	uint32_t num_valid_regions;
+	union {
+		struct hfi_cmd_mem_region_info region_info[1];
+		__DECLARE_FLEX_ARRAY(struct hfi_cmd_mem_region_info, region_info_flex);
+	};
+} __packed;
+
+/* end of sys command packet types */
+
+/* start of sys message packet types */
+
+/**
+ * struct hfi_prop
+ * structure to report maximum supported features of firmware.
+ * @api_ver:    Firmware API version
+ * @dev_ver:    Device version
+ * @num_icp_hw: Number of ICP hardware information
+ * @dev_hw_ver: Supported hardware version information
+ * @force_ipe_8bpp: flag to indicate if 8bpp ipe fuse is blown
+ * @reserved:   Reserved field
+ */
+struct hfi_sys_support {
+	uint32_t api_ver;
+	uint32_t dev_ver;
+	uint32_t num_icp_hw;
+	uint32_t dev_hw_ver[HFI_DEV_VERSION_MAX];
+	uint32_t force_ipe_8bpp;
+	uint32_t reserved;
+} __packed;
+
+/**
+ * struct hfi_supported_prop
+ * structure to report HFI_PROPERTY_PARAM_PROPERTIES_SUPPORTED
+ * for a session
+ * @num_prop: number of properties supported
+ * @prop_data: array of supported property IDs
+ */
+struct hfi_supported_prop {
+	uint32_t num_prop;
+	union {
+		uint32_t prop_data[1];
+		__DECLARE_FLEX_ARRAY(uint32_t, prop_data_flex);
+	};
+} __packed;
+
+/**
+ * struct hfi_image_version
+ * system image version
+ * @major: major version number
+ * @minor: minor version number
+ * @ver_name_size: size of version name
+ * @ver_name: image version name
+ */
+struct hfi_image_version {
+	uint32_t major;
+	uint32_t minor;
+	uint32_t ver_name_size;
+	union {
+		uint8_t ver_name[1];
+		__DECLARE_FLEX_ARRAY(uint8_t, ver_name_flex);
+	};
+} __packed;
+
+/**
+ * struct hfi_msg_init_done_data
+ * @api_ver:    Firmware API version
+ * @dev_ver:    Device version
+ * @num_icp_hw: Number of ICP hardware information
+ * @dev_hw_ver: Supported hardware version information
+ * @reserved:   Reserved field
+ */
+struct hfi_msg_init_done_data {
+	uint32_t api_ver;
+	uint32_t dev_ver;
+	uint32_t num_icp_hw;
+	uint32_t dev_hw_ver[HFI_DEV_VERSION_MAX];
+	uint32_t reserved;
+};
+
+/**
+ * struct hfi_msg_init_done
+ * system init done message from firmware. Many system level properties
+ * are returned with the packet
+ * @size:      Packet size in bytes
+ * @pkt_type:  Opcode of a packet
+ * @err_type:  Error code associated with response
+ * @num_prop:  Number of default capability info
+ * @prop_data: Array of property ids and corresponding structure pairs
+ */
+struct hfi_msg_init_done {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t err_type;
+	uint32_t num_prop;
+	union {
+		uint32_t prop_data[1];
+		__DECLARE_FLEX_ARRAY(uint32_t, prop_data_flex);
+	};
+} __packed;
+
+/**
+ * struct hfi_msg_pc_prep_done
+ * system power collapse preparation done message
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @err_type: error code associated with the response
+ */
+struct hfi_msg_pc_prep_done {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t err_type;
+} __packed;
+
+/**
+ * struct hfi_msg_prop
+ * system property info from firmware
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @num_prop: number of property info structures
+ * @prop_data: array of property IDs and associated structure pairs
+ */
+struct hfi_msg_prop {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t num_prop;
+	union {
+		uint32_t prop_data[1];
+		__DECLARE_FLEX_ARRAY(uint32_t, prop_data_flex);
+	};
+} __packed;
+
+/**
+ * struct hfi_msg_idle
+ * system idle message from firmware
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ */
+struct hfi_msg_idle {
+	uint32_t size;
+	uint32_t pkt_type;
+} __packed;
+
+/**
+ * struct hfi_msg_ping_ack
+ * system ping ack message
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @user_data: this data is sent as part of ping command from host
+ */
+struct hfi_msg_ping_ack {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_msg_debug
+ * system debug message defination
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @msg_type: debug message type
+ * @msg_size: size of debug message in bytes
+ * @timestamp_hi: most significant 32 bits of the 64 bit timestamp field.
+ *                timestamp shall be interpreted as a signed 64-bit value
+ *                representing microseconds.
+ * @timestamp_lo: least significant 32 bits of the 64 bit timestamp field.
+ *                timestamp shall be interpreted as a signed 64-bit value
+ *                representing microseconds.
+ * @msg_data: message data in string form
+ */
+struct hfi_msg_debug {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t msg_type;
+	uint32_t msg_size;
+	uint32_t timestamp_hi;
+	uint32_t timestamp_lo;
+	union {
+		uint8_t  msg_data[1];
+		__DECLARE_FLEX_ARRAY(uint8_t, msg_data_flex);
+	};
+} __packed;
+/**
+ * struct hfi_msg_event_notify
+ * event notify message
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @fw_handle: firmware session handle
+ * @event_id: session event id
+ * @event_data1: event data corresponding to event ID
+ * @event_data2: event data corresponding to event ID
+ * @ext_event_data: info array, interpreted based on event_data1
+ * and event_data2
+ */
+struct hfi_msg_event_notify {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t fw_handle;
+	uint32_t event_id;
+	uint32_t event_data1;
+	uint32_t event_data2;
+	union {
+		uint32_t ext_event_data[1];
+		__DECLARE_FLEX_ARRAY(uint32_t, ext_event_data_flex);
+	};
+} __packed;
+/**
+ * end of sys message packet types
+ */
+#endif /* _HFI_DEFS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/hfi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/hfi.c
@@ -0,0 +1,1441 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <asm/errno.h>
+#include <linux/timer.h>
+#include <media/cam_icp.h>
+#include <linux/iopoll.h>
+
+#include "cam_presil_hw_access.h"
+#include "cam_io_util.h"
+#include "hfi_reg.h"
+#include "hfi_sys_defs.h"
+#include "hfi_session_defs.h"
+#include "hfi_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+#include "cam_compat.h"
+#include "cam_soc_util.h"
+
+#define HFI_VERSION_INFO_MAJOR_VAL  1
+#define HFI_VERSION_INFO_MINOR_VAL  1
+#define HFI_VERSION_INFO_STEP_VAL   0
+#define HFI_VERSION_INFO_MAJOR_BMSK  0xFF000000
+#define HFI_VERSION_INFO_MAJOR_SHFT  24
+#define HFI_VERSION_INFO_MINOR_BMSK  0xFFFF00
+#define HFI_VERSION_INFO_MINOR_SHFT  8
+#define HFI_VERSION_INFO_STEP_BMSK   0xFF
+#define HFI_VERSION_INFO_STEP_SHFT  0
+
+/* TO DO Lower timeout value */
+#define HFI_POLL_DELAY_US 10
+#define HFI_POLL_TIMEOUT_US 1500000
+
+struct hfi_top_info {
+	uint32_t num_hfi;
+	struct hfi_info *hfi[HFI_NUM_MAX];
+};
+
+struct hfi_top_info g_hfi;
+static DEFINE_MUTEX(g_hfi_lock);
+
+
+static int cam_hfi_presil_setup(struct hfi_mem_info *hfi_mem);
+static int cam_hfi_presil_set_init_request(void);
+
+#ifndef CONFIG_CAM_PRESIL
+static void hfi_irq_raise(struct hfi_info *hfi)
+{
+	if (hfi->ops.irq_raise)
+		hfi->ops.irq_raise(hfi->priv);
+}
+#endif
+
+static void hfi_irq_enable(struct hfi_info *hfi)
+{
+	if (hfi->ops.irq_enable)
+		hfi->ops.irq_enable(hfi->priv);
+}
+
+static void __iomem *hfi_iface_addr(struct hfi_info *hfi)
+{
+	void __iomem *ret = NULL;
+
+	if (hfi->ops.iface_addr)
+		ret = hfi->ops.iface_addr(hfi->priv);
+
+	return IS_ERR_OR_NULL(ret) ? NULL : ret;
+}
+
+static inline int hfi_get_client_info(int client_handle, struct hfi_info **hfi)
+{
+	uint32_t idx;
+
+	idx = HFI_GET_INDEX(client_handle);
+	if (!IS_VALID_HFI_INDEX(idx)) {
+		CAM_ERR(CAM_HFI, "Invalid HFI index: %u from hdl:%d",
+			idx, client_handle);
+		return -EINVAL;
+	}
+
+	*hfi = g_hfi.hfi[idx];
+	if (!g_hfi.hfi[idx]) {
+		CAM_ERR(CAM_HFI, "[%s] HFI interface not setup for client hdl: %d",
+			g_hfi.hfi[idx]->client_name, client_handle);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static void hfi_queue_dump(uint32_t *dwords, int count)
+{
+	int i;
+	int rows;
+	int remaining;
+
+	rows = count / 4;
+	remaining = count % 4;
+
+	for (i = 0; i < rows; i++, dwords += 4)
+		CAM_DBG(CAM_HFI,
+			"word[%04d]: 0x%08x 0x%08x 0x%08x 0x%08x",
+			i * 4, dwords[0], dwords[1], dwords[2], dwords[3]);
+
+	if (remaining == 1)
+		CAM_DBG(CAM_HFI, "word[%04d]: 0x%08x", rows * 4, dwords[0]);
+	else if (remaining == 2)
+		CAM_DBG(CAM_HFI, "word[%04d]: 0x%08x 0x%08x",
+			rows * 4, dwords[0], dwords[1]);
+	else if (remaining == 3)
+		CAM_DBG(CAM_HFI, "word[%04d]: 0x%08x 0x%08x 0x%08x",
+			rows * 4, dwords[0], dwords[1], dwords[2]);
+}
+
+void cam_hfi_mini_dump(int client_handle, struct hfi_mini_dump_info *dst)
+{
+	struct hfi_info *hfi;
+	struct hfi_mem_info *hfi_mem;
+	uint32_t *dwords;
+	int rc;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return;
+	}
+
+	hfi_mem = &hfi->map;
+	if (!hfi_mem) {
+		CAM_ERR(CAM_HFI, "[%s] hfi mem info NULL... unable to dump queues for hdl: %d",
+			hfi->client_name, client_handle);
+		return;
+	}
+
+	dwords = (uint32_t *)hfi_mem->cmd_q.kva;
+	memcpy(dst->cmd_q, dwords, ICP_CMD_Q_SIZE_IN_BYTES);
+
+	dwords = (uint32_t *)hfi_mem->msg_q.kva;
+	memcpy(dst->msg_q, dwords, ICP_CMD_Q_SIZE_IN_BYTES);
+	dst->msg_q_state = hfi->msg_q_state;
+	dst->cmd_q_state = hfi->cmd_q_state;
+	dst->dbg_q_state = hfi->dbg_q_state;
+}
+
+void cam_hfi_queue_dump(int client_handle, bool dump_queue_data)
+{
+	struct hfi_info *hfi;
+	struct hfi_mem_info *hfi_mem;
+	struct hfi_qtbl *qtbl;
+	struct hfi_q_hdr *q_hdr;
+	uint32_t *dwords;
+	int num_dwords, rc;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc:%d for hdl:%d",
+			rc, client_handle);
+		return;
+	}
+
+	hfi_mem = &hfi->map;
+	if (!hfi_mem) {
+		CAM_ERR(CAM_HFI, "[%s] mem info NULL... unable to dump queues for hdl: %d",
+			hfi->client_name, client_handle);
+		return;
+	}
+
+	qtbl = (struct hfi_qtbl *)hfi_mem->qtbl.kva;
+	if(!qtbl) {
+		CAM_ERR(CAM_HFI, "NULL Pointer qtbl %p", qtbl);
+		return;
+	}
+
+	CAM_INFO(CAM_HFI,
+		"[%s] hfi hdl: %u qtbl header: version=0x%08x tbl_size=%u numq=%u qhdr_size=%u",
+		hfi->client_name, client_handle, qtbl->q_tbl_hdr.qtbl_version,
+		qtbl->q_tbl_hdr.qtbl_size, qtbl->q_tbl_hdr.qtbl_num_q,
+		qtbl->q_tbl_hdr.qtbl_qhdr_size);
+
+	q_hdr = &qtbl->q_hdr[Q_CMD];
+	if(!q_hdr) {
+		CAM_ERR(CAM_HFI, "NULL Pointer q_hdr %p ", q_hdr);
+		return;
+	}
+
+	CAM_INFO(CAM_HFI,
+		"cmd_q: addr=0x%08x size=%u read_idx=%u write_idx=%u",
+		hfi_mem->cmd_q.iova,
+		q_hdr->qhdr_q_size,
+		q_hdr->qhdr_read_idx,
+		q_hdr->qhdr_write_idx);
+
+	dwords = (uint32_t *)hfi_mem->cmd_q.kva;
+	num_dwords = ICP_CMD_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+
+	if (dump_queue_data)
+		hfi_queue_dump(dwords, num_dwords);
+
+	q_hdr = &qtbl->q_hdr[Q_MSG];
+	if(!q_hdr) {
+		CAM_ERR(CAM_HFI, "NULL Pointer q_hdr %p ", q_hdr);
+		return;
+	}
+
+	CAM_INFO(CAM_HFI,
+		"msg_q: addr=0x%08x size=%u read_idx=%u write_idx=%u",
+		hfi_mem->msg_q.iova,
+		q_hdr->qhdr_q_size,
+		q_hdr->qhdr_read_idx,
+		q_hdr->qhdr_write_idx);
+
+	dwords = (uint32_t *)hfi_mem->msg_q.kva;
+	num_dwords = ICP_MSG_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+
+	if (dump_queue_data)
+		hfi_queue_dump(dwords, num_dwords);
+}
+
+#ifndef CONFIG_CAM_PRESIL
+int hfi_write_cmd(int client_handle, void *cmd_ptr)
+{
+	uint32_t size_in_words, empty_space, new_write_idx, read_idx, temp;
+	uint32_t *write_q, *write_ptr;
+	struct hfi_info *hfi;
+	struct hfi_qtbl *q_tbl;
+	struct hfi_q_hdr *q;
+	int rc = 0;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return rc;
+	}
+
+	if (!cmd_ptr) {
+		CAM_ERR(CAM_HFI, "[%s] command is null for hfi hdl: %d",
+			hfi->client_name, client_handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hfi->cmd_q_lock);
+	if (hfi->hfi_state != HFI_READY ||
+		!hfi->cmd_q_state) {
+		CAM_ERR(CAM_HFI, "[%s] Invalid hfi state: %u cmd q state: %u hfi hdl: %d",
+			hfi->client_name, hfi->hfi_state,
+			hfi->cmd_q_state, client_handle);
+		rc = -ENODEV;
+		goto err;
+	}
+
+	q_tbl = (struct hfi_qtbl *)hfi->map.qtbl.kva;
+	q = &q_tbl->q_hdr[Q_CMD];
+
+	write_q = (uint32_t *)hfi->map.cmd_q.kva;
+
+	size_in_words = (*(uint32_t *)cmd_ptr) >> BYTE_WORD_SHIFT;
+	if (!size_in_words) {
+		CAM_DBG(CAM_HFI, "[%s] hfi hdl: %u word size is NULL",
+			hfi->client_name, client_handle);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	read_idx = q->qhdr_read_idx;
+	empty_space = (q->qhdr_write_idx >= read_idx) ?
+		(q->qhdr_q_size - (q->qhdr_write_idx - read_idx)) :
+		(read_idx - q->qhdr_write_idx);
+	if (empty_space <= size_in_words) {
+		CAM_ERR(CAM_HFI, "[%s] hfi hdl: %u failed: empty space %u, size_in_words %u",
+			hfi->client_name, client_handle, empty_space, size_in_words);
+		rc = -EIO;
+		goto err;
+	}
+
+	new_write_idx = q->qhdr_write_idx + size_in_words;
+	write_ptr = (uint32_t *)(write_q + q->qhdr_write_idx);
+
+	if (new_write_idx < q->qhdr_q_size) {
+		memcpy(write_ptr, (uint8_t *)cmd_ptr,
+			size_in_words << BYTE_WORD_SHIFT);
+	} else {
+		new_write_idx -= q->qhdr_q_size;
+		temp = (size_in_words - new_write_idx) << BYTE_WORD_SHIFT;
+		memcpy(write_ptr, (uint8_t *)cmd_ptr, temp);
+		memcpy(write_q, (uint8_t *)cmd_ptr + temp,
+			new_write_idx << BYTE_WORD_SHIFT);
+	}
+
+	/*
+	 * To make sure command data in a command queue before
+	 * updating write index
+	 */
+	wmb();
+
+	q->qhdr_write_idx = new_write_idx;
+
+	/*
+	 * Before raising interrupt make sure command data is ready for
+	 * firmware to process
+	 */
+	wmb();
+	hfi_irq_raise(hfi);
+
+	/* Ensure HOST2ICP trigger is received by FW */
+	wmb();
+err:
+	mutex_unlock(&hfi->cmd_q_lock);
+	return rc;
+}
+
+int hfi_read_message(int client_handle, uint32_t *pmsg, uint8_t q_id,
+	size_t buf_words_size, uint32_t *words_read)
+{
+	struct hfi_info *hfi;
+	struct hfi_qtbl *q_tbl_ptr;
+	struct hfi_q_hdr *q;
+	uint32_t new_read_idx, size_in_words, word_diff, temp;
+	uint32_t *read_q, *read_ptr, *write_ptr;
+	uint32_t size_upper_bound = 0;
+	struct mutex *q_lock;
+	int rc = 0;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl:%d",
+			rc, client_handle);
+		return rc;
+	}
+
+	if (!pmsg) {
+		CAM_ERR(CAM_HFI, "[%s] client hdl: %d Invalid msg",
+			hfi->client_name, client_handle);
+		return -EINVAL;
+	}
+
+	switch (q_id) {
+	case Q_MSG:
+		q_lock = &hfi->msg_q_lock;
+		break;
+	case Q_DBG:
+		q_lock = &hfi->dbg_q_lock;
+		break;
+	default:
+		CAM_ERR(CAM_HFI, "Invalid q_id: %u for read", q_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(q_lock);
+	if (hfi->hfi_state != HFI_READY ||
+		!hfi->msg_q_state) {
+		CAM_ERR(CAM_HFI, "[%s] Invalid hfi state:%u msg q state: %u hfi hdl: %d",
+			hfi->client_name, hfi->hfi_state, hfi->msg_q_state,
+			client_handle);
+		rc = -ENODEV;
+		goto err;
+	}
+
+	q_tbl_ptr = (struct hfi_qtbl *)hfi->map.qtbl.kva;
+	q = &q_tbl_ptr->q_hdr[q_id];
+
+	if (q->qhdr_read_idx == q->qhdr_write_idx) {
+		CAM_DBG(CAM_HFI, "[%s] hfi hdl: %d Q not ready, state:%u, r idx:%u, w idx:%u",
+			hfi->client_name, client_handle, hfi->hfi_state,
+			q->qhdr_read_idx, q->qhdr_write_idx);
+		rc = -EIO;
+		goto err;
+	}
+
+	size_upper_bound = q->qhdr_q_size;
+	if (q_id == Q_MSG)
+		read_q = (uint32_t *)hfi->map.msg_q.kva;
+	else
+		read_q = (uint32_t *)hfi->map.dbg_q.kva;
+
+	read_ptr = (uint32_t *)(read_q + q->qhdr_read_idx);
+	write_ptr = (uint32_t *)(read_q + q->qhdr_write_idx);
+
+	if (write_ptr > read_ptr)
+		size_in_words = write_ptr - read_ptr;
+	else {
+		word_diff = read_ptr - write_ptr;
+		size_in_words =  q->qhdr_q_size -  word_diff;
+	}
+
+	if ((size_in_words == 0) ||
+		(size_in_words > size_upper_bound)) {
+		CAM_ERR(CAM_HFI, "[%s] Invalid HFI message packet size - 0x%08x hfi hdl:%d",
+			hfi->client_name, size_in_words << BYTE_WORD_SHIFT,
+			client_handle);
+		q->qhdr_read_idx = q->qhdr_write_idx;
+		rc = -EIO;
+		goto err;
+	}
+
+	if (size_in_words > buf_words_size) {
+		CAM_ERR(CAM_HFI,
+			"[%s] hdl: %d Size of buffer: %u is smaller than size to read from queue: %u",
+			hfi->client_name, client_handle, buf_words_size, size_in_words);
+		rc = -EIO;
+		goto err;
+	}
+
+	new_read_idx = q->qhdr_read_idx + size_in_words;
+
+	if (new_read_idx < q->qhdr_q_size) {
+		memcpy(pmsg, read_ptr, size_in_words << BYTE_WORD_SHIFT);
+	} else {
+		new_read_idx -= q->qhdr_q_size;
+		temp = (size_in_words - new_read_idx) << BYTE_WORD_SHIFT;
+		memcpy(pmsg, read_ptr, temp);
+		memcpy((uint8_t *)pmsg + temp, read_q,
+			new_read_idx << BYTE_WORD_SHIFT);
+	}
+
+	q->qhdr_read_idx = new_read_idx;
+	*words_read = size_in_words;
+	/* Memory Barrier to make sure message
+	 * queue parameters are updated after read
+	 */
+	wmb();
+err:
+	mutex_unlock(q_lock);
+	return rc;
+}
+
+#endif /* #ifndef CONFIG_CAM_PRESIL */
+
+int hfi_cmd_ubwc_config(int client_handle, uint32_t *ubwc_cfg)
+{
+	uint8_t *prop;
+	struct hfi_cmd_prop *dbg_prop;
+	struct hfi_info *hfi;
+	uint32_t size = 0;
+	int rc;
+
+	size = sizeof(struct hfi_cmd_prop) +
+		sizeof(struct hfi_cmd_ubwc_cfg);
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl:%d",
+			rc, client_handle);
+		return rc;
+	}
+
+	CAM_DBG(CAM_HFI,
+		"[%s] hfi hdl: %d size of ubwc %u, ubwc_cfg [rd-0x%x,wr-0x%x]",
+		hfi->client_name, client_handle, size, ubwc_cfg[0], ubwc_cfg[1]);
+
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	dbg_prop = (struct hfi_cmd_prop *)prop;
+	dbg_prop->size = size;
+	dbg_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	dbg_prop->num_prop = 1;
+	dbg_prop->prop_data[0] = HFI_PROP_SYS_UBWC_CFG;
+	dbg_prop->prop_data[1] = ubwc_cfg[0];
+	dbg_prop->prop_data[2] = ubwc_cfg[1];
+
+	hfi_write_cmd(client_handle, prop);
+	kfree(prop);
+
+	return 0;
+}
+
+int hfi_cmd_ubwc_config_ext(int client_handle, uint32_t *ubwc_ipe_cfg,
+	uint32_t *ubwc_bps_cfg, uint32_t *ubwc_ofe_cfg)
+{
+	uint8_t *prop;
+	struct hfi_cmd_prop *dbg_prop;
+	struct hfi_info *hfi;
+	uint32_t size = 0;
+	int rc;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl:%d",
+			rc, client_handle);
+		return rc;
+	}
+
+	size = sizeof(struct hfi_cmd_prop) +
+		sizeof(struct hfi_cmd_ubwc_cfg_ext);
+
+	CAM_DBG(CAM_HFI,
+		"[%s] hfi hdl: %d size of ubwc %u, ubwc_ipe_cfg[rd-0x%x,wr-0x%x] ubwc_bps_cfg[rd-0x%x,wr-0x%x] ubwc_ofe_cfg[rd-0x%x,wr-0x%x]",
+		hfi->client_name, client_handle, size,
+		ubwc_ipe_cfg[0], ubwc_ipe_cfg[1], ubwc_bps_cfg[0],
+		ubwc_bps_cfg[1], ubwc_ofe_cfg[0], ubwc_ofe_cfg[1]);
+
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	dbg_prop = (struct hfi_cmd_prop *)prop;
+	dbg_prop->size = size;
+	dbg_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	dbg_prop->num_prop = 1;
+	dbg_prop->prop_data[0] = HFI_PROP_SYS_UBWC_CONFIG_EX;
+	dbg_prop->prop_data[1] = ubwc_bps_cfg[0];
+	dbg_prop->prop_data[2] = ubwc_bps_cfg[1];
+	dbg_prop->prop_data[3] = ubwc_ipe_cfg[0];
+	dbg_prop->prop_data[4] = ubwc_ipe_cfg[1];
+	dbg_prop->prop_data[5] = ubwc_ofe_cfg[0];
+	dbg_prop->prop_data[6] = ubwc_ofe_cfg[1];
+	hfi_write_cmd(client_handle, prop);
+	kfree(prop);
+
+	return 0;
+}
+
+int hfi_set_debug_level(int client_handle, u64 icp_dbg_type, uint32_t lvl)
+{
+	uint8_t *prop;
+	struct hfi_info *hfi;
+	struct hfi_cmd_prop *dbg_prop;
+	uint32_t size = 0, val;
+	int rc;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return rc;
+	}
+
+	val = HFI_DEBUG_MSG_LOW |
+		HFI_DEBUG_MSG_MEDIUM |
+		HFI_DEBUG_MSG_HIGH |
+		HFI_DEBUG_MSG_ERROR |
+		HFI_DEBUG_MSG_FATAL |
+		HFI_DEBUG_MSG_PERF |
+		HFI_DEBUG_CFG_WFI |
+		HFI_DEBUG_CFG_ARM9WD;
+
+	if (lvl > val)
+		return -EINVAL;
+
+	if (hfi)
+		hfi->dbg_lvl = lvl;
+
+	size = sizeof(struct hfi_cmd_prop) +
+		sizeof(struct hfi_debug);
+
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	dbg_prop = (struct hfi_cmd_prop *)prop;
+	dbg_prop->size = size;
+	dbg_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	dbg_prop->num_prop = 1;
+	dbg_prop->prop_data[0] = HFI_PROP_SYS_DEBUG_CFG;
+	dbg_prop->prop_data[1] = lvl;
+	dbg_prop->prop_data[2] = icp_dbg_type;
+	hfi_write_cmd(client_handle, prop);
+
+	kfree(prop);
+
+	return 0;
+}
+
+int hfi_set_fw_dump_levels(int client_handle, uint32_t hang_dump_lvl,
+	uint32_t ram_dump_lvl)
+{
+	uint8_t *prop = NULL;
+	struct hfi_info *hfi;
+	struct hfi_cmd_prop *fw_dump_level_switch_prop = NULL;
+	uint32_t size = 0;
+	int rc;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return rc;
+	}
+
+	CAM_DBG(CAM_HFI, "[%s] hfi hdl: %d fw dump ENTER",
+		hfi->client_name, client_handle);
+
+	size = sizeof(struct hfi_cmd_prop) + sizeof(uint32_t);
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	fw_dump_level_switch_prop = (struct hfi_cmd_prop *)prop;
+	fw_dump_level_switch_prop->size = size;
+	fw_dump_level_switch_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	fw_dump_level_switch_prop->num_prop = 1;
+	fw_dump_level_switch_prop->prop_data[0] = HFI_PROP_SYS_FW_DUMP_CFG;
+	fw_dump_level_switch_prop->prop_data[1] = hang_dump_lvl;
+
+	/* Write hang dump level */
+	hfi_write_cmd(client_handle, prop);
+
+	/* Update and write ramdump level */
+	fw_dump_level_switch_prop->prop_data[0] = HFI_PROP_SYS_ICP_RAMDUMP_MODE;
+	fw_dump_level_switch_prop->prop_data[1] = ram_dump_lvl;
+
+	hfi_write_cmd(client_handle, prop);
+	CAM_DBG(CAM_HFI,
+		"[%s] hfi hdl: %d prop->size = %d prop->pkt_type = %d prop->num_prop = %d hang_dump_lvl = %u ram_dump_lvl = %u",
+		hfi->client_name, client_handle, fw_dump_level_switch_prop->size,
+		fw_dump_level_switch_prop->pkt_type, fw_dump_level_switch_prop->num_prop,
+		hang_dump_lvl, ram_dump_lvl);
+
+	kfree(prop);
+	return 0;
+}
+
+int hfi_send_freq_info(int client_handle, int32_t freq)
+{
+	uint8_t *prop = NULL;
+	struct hfi_info *hfi;
+	struct hfi_cmd_prop *dbg_prop = NULL;
+	uint32_t size = 0;
+	int rc;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return rc;
+	}
+
+	if (!(hfi->dbg_lvl & HFI_DEBUG_MSG_PERF))
+		return -EINVAL;
+
+	size = sizeof(struct hfi_cmd_prop) + sizeof(freq);
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	dbg_prop = (struct hfi_cmd_prop *)prop;
+	dbg_prop->size = size;
+	dbg_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	dbg_prop->num_prop = 1;
+	dbg_prop->prop_data[0] = HFI_PROP_SYS_ICP_HW_FREQUENCY;
+	dbg_prop->prop_data[1] = freq;
+
+	CAM_DBG(CAM_HFI,
+			 "[%s] hfi hdl: %d\n"
+			 "prop->size = %d\n"
+			 "prop->pkt_type = %d\n"
+			 "prop->num_prop = %d\n"
+			 "prop->prop_data[0] = %d\n"
+			 "prop->prop_data[1] = %d\n"
+			 "dbg_lvl = 0x%x\n",
+			 hfi->client_name,
+			 client_handle,
+			 dbg_prop->size,
+			 dbg_prop->pkt_type,
+			 dbg_prop->num_prop,
+			 dbg_prop->prop_data[0],
+			 dbg_prop->prop_data[1],
+			 hfi->dbg_lvl);
+
+	hfi_write_cmd(client_handle, prop);
+	kfree(prop);
+	return 0;
+}
+
+int hfi_send_system_cmd(int client_handle, uint32_t type, uint64_t data, uint32_t size)
+{
+	int rc = 0;
+	struct hfi_info *hfi;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return rc;
+	}
+
+	switch (type) {
+	case HFI_CMD_SYS_INIT: {
+		struct hfi_cmd_sys_init init;
+
+		init.size = sizeof(struct hfi_cmd_sys_init);
+		init.pkt_type = type;
+		rc = hfi_write_cmd(client_handle, &init);
+	}
+		break;
+	case HFI_CMD_SYS_PC_PREP: {
+		struct hfi_cmd_pc_prep prep;
+
+		prep.size = sizeof(struct hfi_cmd_pc_prep);
+		prep.pkt_type = type;
+		rc = hfi_write_cmd(client_handle, &prep);
+	}
+		break;
+	case HFI_CMD_SYS_SET_PROPERTY: {
+		struct hfi_cmd_prop prop;
+
+		if ((uint32_t)data == (uint32_t)HFI_PROP_SYS_DEBUG_CFG) {
+			prop.size = sizeof(struct hfi_cmd_prop);
+			prop.pkt_type = type;
+			prop.num_prop = 1;
+			prop.prop_data_flex[0] = HFI_PROP_SYS_DEBUG_CFG;
+			rc = hfi_write_cmd(client_handle, &prop);
+		}
+	}
+		break;
+	case HFI_CMD_SYS_GET_PROPERTY:
+		break;
+	case HFI_CMD_SYS_PING: {
+		struct hfi_cmd_ping_pkt ping;
+
+		ping.size = sizeof(struct hfi_cmd_ping_pkt);
+		ping.pkt_type = type;
+		ping.user_data = (uint64_t)data;
+		rc = hfi_write_cmd(client_handle, &ping);
+	}
+		break;
+	case HFI_CMD_SYS_RESET: {
+		struct hfi_cmd_sys_reset_pkt reset;
+
+		reset.size = sizeof(struct hfi_cmd_sys_reset_pkt);
+		reset.pkt_type = type;
+		reset.user_data = (uint64_t)data;
+		rc = hfi_write_cmd(client_handle, &reset);
+	}
+		break;
+	case HFI_CMD_IPEBPS_CREATE_HANDLE: {
+		struct hfi_cmd_create_handle handle;
+
+		handle.size = sizeof(struct hfi_cmd_create_handle);
+		handle.pkt_type = type;
+		handle.handle_type = (uint32_t)data;
+		handle.user_data1 = 0;
+		rc = hfi_write_cmd(client_handle, &handle);
+	}
+		break;
+	case HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT:
+		break;
+	default:
+		CAM_ERR(CAM_HFI, "[%s] command not supported: %u client handle: %d",
+			hfi->client_name, type, client_handle);
+		break;
+	}
+
+	return rc;
+}
+
+
+int hfi_get_hw_caps(void *query_buf)
+{
+	int i = 0;
+	struct cam_icp_query_cap_cmd *query_cmd = NULL;
+
+	if (!query_buf) {
+		CAM_ERR(CAM_HFI, "query buf is NULL");
+		return -EINVAL;
+	}
+
+	query_cmd = (struct cam_icp_query_cap_cmd *)query_buf;
+	query_cmd->fw_version.major = 0x12;
+	query_cmd->fw_version.minor = 0x12;
+	query_cmd->fw_version.revision = 0x12;
+
+	query_cmd->api_version.major = 0x13;
+	query_cmd->api_version.minor = 0x13;
+	query_cmd->api_version.revision = 0x13;
+
+	query_cmd->num_ipe = 2;
+	query_cmd->num_bps = 1;
+
+	for (i = 0; i < CAM_ICP_MAX_NUM_OF_DEV_TYPES; i++) {
+		query_cmd->dev_ver[i].dev_type = i;
+		query_cmd->dev_ver[i].hw_ver.major = 0x34 + i;
+		query_cmd->dev_ver[i].hw_ver.minor = 0x34 + i;
+		query_cmd->dev_ver[i].hw_ver.incr = 0x34 + i;
+	}
+	return 0;
+}
+
+int hfi_get_hw_caps_v2(int client_handle, void *query_buf)
+{
+	struct cam_icp_query_cap_cmd_v2 *query_cmd = NULL;
+	struct hfi_info *hfi;
+	int rc = 0;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return rc;
+	}
+
+	if (!query_buf) {
+		CAM_ERR(CAM_HFI, "[%s] query cap buf is NULL", hfi->client_name);
+		return -EINVAL;
+	}
+
+	query_cmd = (struct cam_icp_query_cap_cmd_v2 *)query_buf;
+	query_cmd->fw_version.major = (hfi->fw_version & 0xFF000000) >> 24;
+	query_cmd->fw_version.minor = (hfi->fw_version & 0x00FF0000) >> 16;
+	query_cmd->fw_version.revision = (hfi->fw_version & 0xFFFF);
+
+	return 0;
+}
+
+int cam_hfi_resume(int client_handle)
+{
+	int rc = 0;
+	struct hfi_info *hfi;
+	struct hfi_mem_info *hfi_mem;
+	uint32_t status = 0;
+	void __iomem *icp_base = NULL;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl:%d",
+			rc, client_handle);
+		return rc;
+	}
+
+	icp_base = hfi_iface_addr(hfi);
+
+	if (!icp_base) {
+		CAM_ERR(CAM_HFI, "[%s] Invalid HFI interface address for hdl:%d",
+			hfi->client_name, client_handle);
+		return -EINVAL;
+	}
+
+	if (cam_common_read_poll_timeout(icp_base +
+		HFI_REG_ICP_HOST_INIT_RESPONSE,
+		HFI_POLL_DELAY_US, HFI_POLL_TIMEOUT_US,
+		(uint32_t)UINT_MAX, ICP_INIT_RESP_SUCCESS, &status)) {
+		CAM_ERR(CAM_HFI, "[%s] response poll timed out: status=0x%08x hfi hdl: %d",
+			hfi->client_name, status, client_handle);
+		return -ETIMEDOUT;
+	}
+
+	hfi_irq_enable(hfi);
+
+	CAM_DBG(CAM_HFI, "[%s] hfi hdl: %d fw version : [0x%x]",
+		hfi->client_name, client_handle, hfi->fw_version);
+
+	hfi_mem = &hfi->map;
+	cam_io_w_mb((uint32_t)hfi_mem->qtbl.iova, icp_base + HFI_REG_QTBL_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->sfr_buf.iova,
+		icp_base + HFI_REG_SFR_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->shmem.iova,
+		icp_base + HFI_REG_SHARED_MEM_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->shmem.len,
+		icp_base + HFI_REG_SHARED_MEM_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->sec_heap.iova,
+		icp_base + HFI_REG_SECONDARY_HEAP_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->sec_heap.len,
+		icp_base + HFI_REG_SECONDARY_HEAP_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->qdss.iova,
+		icp_base + HFI_REG_QDSS_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->qdss.len,
+		icp_base + HFI_REG_QDSS_IOVA_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem.iova,
+		icp_base + HFI_REG_IO_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem.len,
+		icp_base + HFI_REG_IO_REGION_SIZE);
+
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem2.iova,
+		icp_base + HFI_REG_IO2_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem2.len,
+		icp_base + HFI_REG_IO2_REGION_SIZE);
+
+	cam_io_w_mb((uint32_t)hfi_mem->fw_uncached.iova,
+		icp_base + HFI_REG_FWUNCACHED_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->fw_uncached.len,
+		icp_base + HFI_REG_FWUNCACHED_REGION_SIZE);
+
+	cam_io_w_mb((uint32_t)hfi_mem->device_mem.iova,
+		icp_base + HFI_REG_DEVICE_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->device_mem.len,
+		icp_base + HFI_REG_DEVICE_REGION_IOVA_SIZE);
+
+	CAM_DBG(CAM_HFI, "IO1 : [0x%x 0x%x] IO2 [0x%x 0x%x]",
+		hfi_mem->io_mem.iova, hfi_mem->io_mem.len,
+		hfi_mem->io_mem2.iova, hfi_mem->io_mem2.len);
+
+	CAM_DBG(CAM_HFI, "FwUncached : [0x%x 0x%x] Shared [0x%x 0x%x]",
+		hfi_mem->fw_uncached.iova, hfi_mem->fw_uncached.len,
+		hfi_mem->shmem.iova, hfi_mem->shmem.len);
+
+	CAM_DBG(CAM_HFI, "SecHeap : [0x%x 0x%x] QDSS [0x%x 0x%x]",
+		hfi_mem->sec_heap.iova, hfi_mem->sec_heap.len,
+		hfi_mem->qdss.iova, hfi_mem->qdss.len);
+
+	CAM_DBG(CAM_HFI, "QTbl : [0x%x 0x%x] Sfr [0x%x 0x%x] Device [0x%x 0x%x]",
+		hfi_mem->qtbl.iova, hfi_mem->qtbl.len,
+		hfi_mem->sfr_buf.iova, hfi_mem->sfr_buf.len,
+		hfi_mem->device_mem.iova, hfi_mem->device_mem.len);
+
+	return rc;
+}
+
+int cam_hfi_init(int client_handle, struct hfi_mem_info *hfi_mem,
+	const struct hfi_ops *hfi_ops,
+	void *priv, uint8_t event_driven_mode)
+{
+	int rc = 0;
+	uint32_t status = 0;
+	struct hfi_info *hfi = NULL;
+	struct hfi_qtbl *qtbl;
+	struct hfi_qtbl_hdr *qtbl_hdr;
+	struct hfi_q_hdr *cmd_q_hdr, *msg_q_hdr, *dbg_q_hdr;
+	struct sfr_buf *sfr_buffer;
+	void __iomem *icp_base;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl %d",
+			rc, client_handle);
+		return rc;
+	}
+
+	if (!hfi_mem || !hfi_ops || !priv) {
+		CAM_ERR(CAM_HFI,
+			"[%s] Invalid arg: hfi_mem=%pK hfi_ops=%pK priv=%pK hfi hdl:%d",
+			hfi->client_name, hfi_mem, hfi_ops, priv, client_handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hfi->cmd_q_lock);
+	mutex_lock(&hfi->msg_q_lock);
+	mutex_lock(&hfi->dbg_q_lock);
+
+	hfi->hfi_state = HFI_INIT;
+	memcpy(&hfi->map, hfi_mem, sizeof(hfi->map));
+
+	qtbl = (struct hfi_qtbl *)hfi_mem->qtbl.kva;
+	qtbl_hdr = &qtbl->q_tbl_hdr;
+	qtbl_hdr->qtbl_version = 0xFFFFFFFF;
+	qtbl_hdr->qtbl_size = sizeof(struct hfi_qtbl);
+	qtbl_hdr->qtbl_qhdr0_offset = offsetof(struct hfi_qtbl, q_hdr);
+	qtbl_hdr->qtbl_qhdr_size = sizeof(struct hfi_q_hdr);
+	qtbl_hdr->qtbl_num_q = ICP_HFI_NUMBER_OF_QS;
+	qtbl_hdr->qtbl_num_active_q = ICP_HFI_NUMBER_OF_QS;
+
+	/* setup host-to-firmware command queue */
+	cmd_q_hdr = &qtbl->q_hdr[Q_CMD];
+	cmd_q_hdr->qhdr_status = QHDR_ACTIVE;
+	cmd_q_hdr->qhdr_start_addr = hfi_mem->cmd_q.iova;
+	cmd_q_hdr->qhdr_q_size =  ICP_CMD_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+	cmd_q_hdr->qhdr_pkt_size = ICP_HFI_VAR_SIZE_PKT;
+	cmd_q_hdr->qhdr_pkt_drop_cnt = RESET;
+	cmd_q_hdr->qhdr_read_idx = RESET;
+	cmd_q_hdr->qhdr_write_idx = RESET;
+
+	/* setup firmware-to-Host message queue */
+	msg_q_hdr = &qtbl->q_hdr[Q_MSG];
+	msg_q_hdr->qhdr_status = QHDR_ACTIVE;
+	msg_q_hdr->qhdr_start_addr = hfi_mem->msg_q.iova;
+	msg_q_hdr->qhdr_q_size = ICP_MSG_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+	msg_q_hdr->qhdr_pkt_size = ICP_HFI_VAR_SIZE_PKT;
+	msg_q_hdr->qhdr_pkt_drop_cnt = RESET;
+	msg_q_hdr->qhdr_read_idx = RESET;
+	msg_q_hdr->qhdr_write_idx = RESET;
+
+	/* setup firmware-to-Host message queue */
+	dbg_q_hdr = &qtbl->q_hdr[Q_DBG];
+	dbg_q_hdr->qhdr_status = QHDR_ACTIVE;
+	dbg_q_hdr->qhdr_start_addr = hfi_mem->dbg_q.iova;
+	dbg_q_hdr->qhdr_q_size = ICP_DBG_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+	dbg_q_hdr->qhdr_pkt_size = ICP_HFI_VAR_SIZE_PKT;
+	dbg_q_hdr->qhdr_pkt_drop_cnt = RESET;
+	dbg_q_hdr->qhdr_read_idx = RESET;
+	dbg_q_hdr->qhdr_write_idx = RESET;
+
+	sfr_buffer = (struct sfr_buf *)hfi_mem->sfr_buf.kva;
+	sfr_buffer->size = ICP_MSG_SFR_SIZE_IN_BYTES;
+
+	switch (event_driven_mode) {
+	case INTR_MODE:
+		cmd_q_hdr->qhdr_type = Q_CMD;
+		cmd_q_hdr->qhdr_rx_wm = SET;
+		cmd_q_hdr->qhdr_tx_wm = SET;
+		cmd_q_hdr->qhdr_rx_req = SET;
+		cmd_q_hdr->qhdr_tx_req = RESET;
+		cmd_q_hdr->qhdr_rx_irq_status = RESET;
+		cmd_q_hdr->qhdr_tx_irq_status = RESET;
+
+		msg_q_hdr->qhdr_type = Q_MSG;
+		msg_q_hdr->qhdr_rx_wm = SET;
+		msg_q_hdr->qhdr_tx_wm = SET;
+		msg_q_hdr->qhdr_rx_req = SET;
+		msg_q_hdr->qhdr_tx_req = RESET;
+		msg_q_hdr->qhdr_rx_irq_status = RESET;
+		msg_q_hdr->qhdr_tx_irq_status = RESET;
+
+		dbg_q_hdr->qhdr_type = Q_DBG;
+		dbg_q_hdr->qhdr_rx_wm = SET;
+		dbg_q_hdr->qhdr_tx_wm = SET_WM;
+		dbg_q_hdr->qhdr_rx_req = RESET;
+		dbg_q_hdr->qhdr_tx_req = RESET;
+		dbg_q_hdr->qhdr_rx_irq_status = RESET;
+		dbg_q_hdr->qhdr_tx_irq_status = RESET;
+
+		break;
+
+	case POLL_MODE:
+		cmd_q_hdr->qhdr_type = Q_CMD | TX_EVENT_POLL_MODE_2 |
+			RX_EVENT_POLL_MODE_2;
+		msg_q_hdr->qhdr_type = Q_MSG | TX_EVENT_POLL_MODE_2 |
+			RX_EVENT_POLL_MODE_2;
+		dbg_q_hdr->qhdr_type = Q_DBG | TX_EVENT_POLL_MODE_2 |
+			RX_EVENT_POLL_MODE_2;
+		break;
+
+	case WM_MODE:
+		cmd_q_hdr->qhdr_type = Q_CMD | TX_EVENT_DRIVEN_MODE_2 |
+			RX_EVENT_DRIVEN_MODE_2;
+		cmd_q_hdr->qhdr_rx_wm = SET;
+		cmd_q_hdr->qhdr_tx_wm = SET;
+		cmd_q_hdr->qhdr_rx_req = RESET;
+		cmd_q_hdr->qhdr_tx_req = SET;
+		cmd_q_hdr->qhdr_rx_irq_status = RESET;
+		cmd_q_hdr->qhdr_tx_irq_status = RESET;
+
+		msg_q_hdr->qhdr_type = Q_MSG | TX_EVENT_DRIVEN_MODE_2 |
+			RX_EVENT_DRIVEN_MODE_2;
+		msg_q_hdr->qhdr_rx_wm = SET;
+		msg_q_hdr->qhdr_tx_wm = SET;
+		msg_q_hdr->qhdr_rx_req = SET;
+		msg_q_hdr->qhdr_tx_req = RESET;
+		msg_q_hdr->qhdr_rx_irq_status = RESET;
+		msg_q_hdr->qhdr_tx_irq_status = RESET;
+
+		dbg_q_hdr->qhdr_type = Q_DBG | TX_EVENT_DRIVEN_MODE_2 |
+			RX_EVENT_DRIVEN_MODE_2;
+		dbg_q_hdr->qhdr_rx_wm = SET;
+		dbg_q_hdr->qhdr_tx_wm = SET_WM;
+		dbg_q_hdr->qhdr_rx_req = RESET;
+		dbg_q_hdr->qhdr_tx_req = RESET;
+		dbg_q_hdr->qhdr_rx_irq_status = RESET;
+		dbg_q_hdr->qhdr_tx_irq_status = RESET;
+		break;
+
+	default:
+		CAM_ERR(CAM_HFI, "[%s] Invalid event driven mode :%u for hdl:%d",
+			hfi->client_name, event_driven_mode, client_handle);
+		break;
+	}
+
+	hfi->ops = *hfi_ops;
+	hfi->priv = priv;
+
+	icp_base = hfi_iface_addr(hfi);
+	if (!icp_base) {
+		CAM_ERR(CAM_HFI, "[%s] Invalid HFI interface address for hdl: %d",
+			hfi->client_name, client_handle);
+		rc = -EINVAL;
+		goto regions_fail;
+	}
+
+	cam_io_w_mb((uint32_t)hfi_mem->qtbl.iova,
+		icp_base + HFI_REG_QTBL_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->sfr_buf.iova,
+		icp_base + HFI_REG_SFR_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->shmem.iova,
+		icp_base + HFI_REG_SHARED_MEM_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->shmem.len,
+		icp_base + HFI_REG_SHARED_MEM_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->sec_heap.iova,
+		icp_base + HFI_REG_SECONDARY_HEAP_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->sec_heap.len,
+		icp_base + HFI_REG_SECONDARY_HEAP_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->qdss.iova,
+		icp_base + HFI_REG_QDSS_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->qdss.len,
+		icp_base + HFI_REG_QDSS_IOVA_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem.iova,
+		icp_base + HFI_REG_IO_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem.len,
+		icp_base + HFI_REG_IO_REGION_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem2.iova,
+		icp_base + HFI_REG_IO2_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem2.len,
+		icp_base + HFI_REG_IO2_REGION_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->fw_uncached.iova,
+		icp_base + HFI_REG_FWUNCACHED_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->fw_uncached.len,
+		icp_base + HFI_REG_FWUNCACHED_REGION_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->device_mem.iova,
+		icp_base + HFI_REG_DEVICE_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->device_mem.len,
+		icp_base + HFI_REG_DEVICE_REGION_IOVA_SIZE);
+
+	CAM_DBG(CAM_HFI, "[%s] HFI handle: %d",
+		hfi->client_name, client_handle);
+
+	CAM_DBG(CAM_HFI, "IO1 : [0x%x 0x%x] IO2 [0x%x 0x%x]",
+		hfi_mem->io_mem.iova, hfi_mem->io_mem.len,
+		hfi_mem->io_mem2.iova, hfi_mem->io_mem2.len);
+
+	CAM_DBG(CAM_HFI, "FwUncached : [0x%x 0x%x] Shared [0x%x 0x%x]",
+		hfi_mem->fw_uncached.iova, hfi_mem->fw_uncached.len,
+		hfi_mem->shmem.iova, hfi_mem->shmem.len);
+
+	CAM_DBG(CAM_HFI, "SecHeap : [0x%x 0x%x] QDSS [0x%x 0x%x]",
+		hfi_mem->sec_heap.iova, hfi_mem->sec_heap.len,
+		hfi_mem->qdss.iova, hfi_mem->qdss.len);
+
+	CAM_DBG(CAM_HFI, "QTbl : [0x%x 0x%x] Sfr [0x%x 0x%x] Device [0x%x 0x%x]",
+		hfi_mem->qtbl.iova, hfi_mem->qtbl.len,
+		hfi_mem->sfr_buf.iova, hfi_mem->sfr_buf.len,
+		hfi_mem->device_mem.iova, hfi_mem->device_mem.len);
+
+	if (cam_presil_mode_enabled())
+		cam_hfi_presil_setup(hfi_mem);
+
+	cam_io_w_mb((uint32_t)ICP_INIT_REQUEST_SET,
+		icp_base + HFI_REG_HOST_ICP_INIT_REQUEST);
+
+	if (cam_presil_mode_enabled())
+		cam_hfi_presil_set_init_request();
+
+	if (cam_common_read_poll_timeout(icp_base +
+		HFI_REG_ICP_HOST_INIT_RESPONSE,
+		HFI_POLL_DELAY_US, HFI_POLL_TIMEOUT_US,
+		(uint32_t)UINT_MAX, ICP_INIT_RESP_SUCCESS, &status)) {
+		CAM_ERR(CAM_HFI, "[%s] hfi hdl:%u response poll timed out: status=0x%08x",
+			hfi->client_name, client_handle, status);
+		rc = -ETIMEDOUT;
+		goto regions_fail;
+	}
+
+	hfi->fw_version = cam_io_r(icp_base + HFI_REG_FW_VERSION);
+	CAM_DBG(CAM_HFI, "[%s] ICP fw version: 0x%x",
+		hfi->client_name, hfi->fw_version);
+
+	hfi->cmd_q_state = true;
+	hfi->msg_q_state = true;
+	hfi->dbg_q_state = true;
+	hfi->hfi_state = HFI_READY;
+
+	hfi_irq_enable(hfi);
+
+	mutex_unlock(&hfi->dbg_q_lock);
+	mutex_unlock(&hfi->msg_q_lock);
+	mutex_unlock(&hfi->cmd_q_lock);
+
+	return rc;
+
+regions_fail:
+	mutex_unlock(&hfi->dbg_q_lock);
+	mutex_unlock(&hfi->msg_q_lock);
+	mutex_unlock(&hfi->cmd_q_lock);
+	return rc;
+}
+
+void cam_hfi_deinit(int client_handle)
+{
+	struct hfi_info *hfi;
+	int rc;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return;
+	}
+
+	if (cam_presil_mode_enabled()) {
+		CAM_DBG(CAM_HFI,
+			"[%s] HFI hdl: %d SYS_RESET Needed in presil for back to back hfi_init success",
+			hfi->client_name, client_handle);
+		hfi_send_system_cmd(client_handle, HFI_CMD_SYS_RESET, 0, 0);
+	}
+
+	mutex_lock(&hfi->cmd_q_lock);
+	mutex_lock(&hfi->msg_q_lock);
+	mutex_lock(&hfi->dbg_q_lock);
+
+	hfi->hfi_state = HFI_DEINIT;
+	hfi->cmd_q_state = false;
+	hfi->msg_q_state = false;
+	hfi->dbg_q_state = false;
+
+	mutex_unlock(&hfi->dbg_q_lock);
+	mutex_unlock(&hfi->cmd_q_lock);
+	mutex_unlock(&hfi->msg_q_lock);
+
+	memset(&hfi->map, 0, sizeof(struct hfi_mem_info));
+	memset(&hfi->ops, 0, sizeof(struct hfi_ops));
+	hfi->smem_size = 0;
+	hfi->uncachedheap_size = 0;
+	memset(hfi->msgpacket_buf, 0, sizeof(ICP_HFI_MAX_MSG_SIZE_IN_WORDS));
+	hfi->priv = NULL;
+	hfi->dbg_lvl = 0;
+}
+
+static int hfi_get_free_index(uint32_t *free_index)
+{
+	int i;
+
+	for (i = 0; i < HFI_NUM_MAX; i++) {
+		if (!g_hfi.hfi[i]) {
+			*free_index = i;
+			return 0;
+		}
+	}
+
+	return -EUSERS;
+}
+
+int cam_hfi_register(int *client_handle, const char *client_name)
+{
+	struct hfi_info *hfi = NULL;
+	int hfi_index, rc = 0;
+
+	if (!client_handle) {
+		CAM_ERR(CAM_HFI, "Client handle is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_hfi_lock);
+	if (IS_VALID_HFI_INDEX(*client_handle)) {
+		rc = hfi_get_client_info(*client_handle, &hfi);
+		if (rc) {
+			CAM_ERR(CAM_HFI, "Unable to retrieve existing hfi info for handle:%d",
+				*client_handle);
+			rc = -EINVAL;
+			goto failed_hfi_register;
+		}
+
+		CAM_ERR(CAM_HFI, "[%s] HFI client handle:%d is already established",
+			hfi->client_name, *client_handle);
+		rc = -EINVAL;
+		goto failed_hfi_register;
+	}
+
+	rc = hfi_get_free_index(&hfi_index);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "No available hfi slots rc:%d", rc);
+		goto failed_hfi_register;
+	}
+
+	hfi = kzalloc(sizeof(struct hfi_info), GFP_KERNEL);
+	if (!hfi) {
+		rc = -ENOMEM;
+		goto failed_hfi_register;
+	}
+
+	if (hfi->hfi_state != HFI_DEINIT) {
+		CAM_ERR(CAM_HFI, "hfi_init: invalid state: %u hfi idx: %u",
+			hfi->hfi_state, hfi_index);
+		rc = -EINVAL;
+		goto hfi_failed_state;
+	}
+
+	g_hfi.hfi[hfi_index] = hfi;
+	g_hfi.num_hfi++;
+	*client_handle = HFI_GET_CLIENT_HANDLE(hfi_index);
+	memcpy(hfi->client_name, client_name, HFI_CLIENT_NAME_LEN);
+	mutex_unlock(&g_hfi_lock);
+
+	mutex_init(&hfi->cmd_q_lock);
+	mutex_init(&hfi->msg_q_lock);
+	mutex_init(&hfi->dbg_q_lock);
+
+	return rc;
+
+hfi_failed_state:
+	kfree(hfi);
+failed_hfi_register:
+	mutex_unlock(&g_hfi_lock);
+	return rc;
+}
+
+int cam_hfi_unregister(int *client_handle)
+{
+	struct hfi_info *hfi;
+	uint32_t idx;
+	int rc;
+
+	rc = hfi_get_client_info(*client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return rc;
+	}
+
+	mutex_lock(&g_hfi_lock);
+	mutex_destroy(&hfi->dbg_q_lock);
+	mutex_destroy(&hfi->msg_q_lock);
+	mutex_destroy(&hfi->cmd_q_lock);
+	cam_free_clear((void *)hfi);
+	idx = HFI_GET_INDEX(*client_handle);
+	g_hfi.hfi[idx] = NULL;
+	g_hfi.num_hfi--;
+	mutex_unlock(&g_hfi_lock);
+
+	*client_handle = HFI_HANDLE_INIT_VALUE;
+
+	return 0;
+}
+
+
+#ifdef CONFIG_CAM_PRESIL
+static int cam_hfi_presil_setup(struct hfi_mem_info *hfi_mem)
+{
+	/**
+	 * The pchost maintains its own set of queue structures and
+	 * needs additional info to accomplish this. Use the set of
+	 * dummy registers to pass along this info.
+	 */
+	/**
+	 * IOVA region length for each queue is currently hardcoded in
+	 * pchost (except for SFR). No need to send for now.
+	 */
+	cam_presil_send_event(CAM_PRESIL_EVENT_HFI_REG_CMD_Q_IOVA, hfi_mem->cmd_q.iova);
+	cam_presil_send_event(CAM_PRESIL_EVENT_HFI_REG_MSG_Q_IOVA, hfi_mem->msg_q.iova);
+	cam_presil_send_event(CAM_PRESIL_EVENT_HFI_REG_DBG_Q_IOVA, hfi_mem->dbg_q.iova);
+	cam_presil_send_event(CAM_PRESIL_EVENT_HFI_REG_SFR_LEN, hfi_mem->sfr_buf.len);
+
+	return 0;
+}
+
+static int cam_hfi_presil_set_init_request(void)
+{
+	CAM_DBG(CAM_PRESIL, "notifying pchost to start HFI init...");
+	cam_presil_send_event(CAM_PRESIL_EVENT_HFI_REG_ICP_V1_HW_VERSION_TO_START_HFI_INIT, 0xFF);
+	CAM_DBG(CAM_PRESIL, "got done with PCHOST HFI init...");
+
+	return 0;
+}
+
+int hfi_write_cmd(int client_handle, void *cmd_ptr)
+{
+	struct hfi_info *hfi;
+	int presil_rc = CAM_PRESIL_BLOCKED;
+	int rc = 0;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl:%d",
+			rc, client_handle);
+		return rc;
+	}
+
+	if (!cmd_ptr) {
+		CAM_ERR(CAM_HFI, "[%s] command is null for hfi hdl:%d",
+			hfi->client_name, client_handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hfi->cmd_q_lock);
+
+	presil_rc = cam_presil_hfi_write_cmd(cmd_ptr, (*(uint32_t *)cmd_ptr),
+		CAM_PRESIL_CLIENT_ID_CAMERA);
+
+	if ((presil_rc != CAM_PRESIL_SUCCESS) && (presil_rc != CAM_PRESIL_BLOCKED)) {
+		CAM_ERR(CAM_HFI, "[%s] hfi hdl: %d failed presil rc %d",
+			hfi->client_name, client_handle, presil_rc);
+		rc = -EINVAL;
+	} else {
+		CAM_DBG(CAM_HFI, "[%s] hfi hdl: %d presil rc %d",
+			hfi->client_name, client_handle, presil_rc);
+	}
+
+	mutex_unlock(&hfi->cmd_q_lock);
+	return rc;
+}
+
+int hfi_read_message(int client_handle, uint32_t *pmsg, uint8_t q_id,
+	size_t buf_words_size, uint32_t *words_read)
+{
+	struct hfi_info *hfi;
+	int presil_rc = CAM_PRESIL_BLOCKED;
+	struct mutex *q_lock = NULL;
+	int rc = 0;
+
+	rc = hfi_get_client_info(client_handle, &hfi);
+	if (rc) {
+		CAM_ERR(CAM_HFI, "Failed to get hfi info rc: %d for hdl: %d",
+			rc, client_handle);
+		return rc;
+	}
+
+	if (!pmsg) {
+		CAM_ERR(CAM_HFI, "[%s] Invalid msg for hdl: %d",
+			hfi->client_name, client_handle);
+		return -EINVAL;
+	}
+
+	switch (q_id) {
+	case Q_MSG:
+		q_lock = &hfi->msg_q_lock;
+		break;
+	case Q_DBG:
+		q_lock = &hfi->dbg_q_lock;
+		break;
+	default:
+		CAM_ERR(CAM_HFI, "Invalid q_id: %u for read", q_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(q_lock);
+
+	memset(pmsg, 0x0, sizeof(uint32_t) * 256 /* ICP_MSG_BUF_SIZE */);
+	*words_read = 0;
+
+	presil_rc = cam_presil_hfi_read_message(pmsg, q_id, words_read,
+		CAM_PRESIL_CLIENT_ID_CAMERA);
+
+	if ((presil_rc != CAM_PRESIL_SUCCESS) && (presil_rc != CAM_PRESIL_BLOCKED)) {
+		CAM_ERR(CAM_HFI, "[%s] hfi hdl: %d failed presil rc %d",
+			hfi->client_name, client_handle, presil_rc);
+		rc = -EINVAL;
+	} else {
+		CAM_DBG(CAM_HFI, "[%s] hfi hdl: %d presil rc %d",
+		hfi->client_name, client_handle, presil_rc);
+	}
+
+	mutex_unlock(q_lock);
+	return rc;
+}
+#else
+/* when presil mode not enabled */
+static int cam_hfi_presil_setup(struct hfi_mem_info *hfi_mem)
+{
+	return 0;
+}
+
+static int cam_hfi_presil_set_init_request(void)
+{
+	return 0;
+}
+#endif /* #ifdef CONFIG_CAM_PRESIL */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_core.c
@@ -0,0 +1,491 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "bps_core.h"
+#include "bps_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_bps_hw_intf.h"
+#include "cam_icp_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "hfi_reg.h"
+#include "cam_common_util.h"
+
+static int cam_bps_cpas_vote(struct cam_bps_device_core_info *core_info,
+			struct cam_icp_cpas_vote *cpas_vote)
+{
+	int rc = 0;
+
+	if (cpas_vote->ahb_vote_valid)
+		rc = cam_cpas_update_ahb_vote(core_info->cpas_handle,
+				&cpas_vote->ahb_vote);
+	if (cpas_vote->axi_vote_valid)
+		rc = cam_cpas_update_axi_vote(core_info->cpas_handle,
+				&cpas_vote->axi_vote);
+
+	if (rc < 0)
+		CAM_ERR(CAM_PERF, "cpas vote is failed: %d", rc);
+
+	return rc;
+}
+
+
+int cam_bps_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *bps_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	struct cam_icp_cpas_vote cpas_vote;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_BPS_DEFAULT_AXI_PATH;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_BPS_DEFAULT_AXI_TRANSAC;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+			&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cpas start failed: %d", rc);
+		goto error;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_bps_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "soc enable is failed: %d", rc);
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	} else {
+		core_info->clk_enable = true;
+	}
+
+error:
+	return rc;
+}
+
+int cam_bps_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *bps_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	rc = cam_bps_disable_soc_resources(soc_info, core_info->clk_enable);
+	if (rc)
+		CAM_ERR(CAM_ICP, "soc disable is failed: %d", rc);
+	core_info->clk_enable = false;
+
+	if (core_info->cpas_start) {
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	}
+
+	return rc;
+}
+
+static int cam_bps_handle_pc(struct cam_hw_info *bps_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	struct cam_bps_device_hw_info *hw_info = NULL;
+	int rc = 0;
+	int pwr_ctrl;
+	int pwr_status;
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	hw_info = core_info->bps_hw_info;
+
+	if (!core_info->cpas_start) {
+		CAM_DBG(CAM_ICP, "CPAS BPS client not started");
+		return 0;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (!(pwr_ctrl & BPS_COLLAPSE_MASK)) {
+		rc = cam_cpas_reg_read(core_info->cpas_handle,
+				CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_status,
+				true, &pwr_status);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+			return rc;
+		}
+
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP,
+			hw_info->pwr_ctrl, true, 0x1);
+
+		if ((pwr_status >> BPS_PWR_ON_MASK))
+			CAM_WARN(CAM_PERF, "BPS: pwr_status(%x):pwr_ctrl(%x)",
+				pwr_status, pwr_ctrl);
+	}
+
+	rc = cam_bps_get_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_status,
+			true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return 0;
+}
+
+static int cam_bps_handle_resume(struct cam_hw_info *bps_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	struct cam_bps_device_hw_info *hw_info = NULL;
+	int pwr_ctrl;
+	int pwr_status;
+	int rc = 0;
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	hw_info = core_info->bps_hw_info;
+
+	if (!core_info->cpas_start) {
+		CAM_DBG(CAM_ICP, "CPAS BPS client not started");
+		return 0;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (pwr_ctrl & BPS_COLLAPSE_MASK) {
+		CAM_DBG(CAM_PERF, "BPS: pwr_ctrl set(%x)", pwr_ctrl);
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP,
+			hw_info->pwr_ctrl, true, 0);
+	}
+
+	rc = cam_bps_transfer_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to transfer gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_status,
+			true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return rc;
+}
+
+static int cam_bps_cmd_reset(struct cam_hw_soc_info *soc_info,
+	struct cam_bps_device_core_info *core_info)
+{
+	uint32_t retry_cnt = 0;
+	uint32_t status = 0;
+	int pwr_ctrl, pwr_status, rc = 0;
+	bool reset_bps_cdm_fail = false;
+	bool reset_bps_top_fail = false;
+	struct cam_bps_device_hw_info *hw_info = NULL;
+
+	CAM_DBG(CAM_ICP, "CAM_ICP_BPS_CMD_RESET");
+
+	if (!core_info->clk_enable || !core_info->cpas_start) {
+		CAM_DBG(CAM_ICP, "BPS not powered on clk_en %d cpas_start %d",
+			core_info->clk_enable, core_info->cpas_start);
+		return 0;
+	}
+
+	hw_info = core_info->bps_hw_info;
+
+	/* Reset BPS CDM core*/
+	cam_io_w_mb(hw_info->cdm_rst_val,
+		soc_info->reg_map[0].mem_base + hw_info->cdm_rst_cmd);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		cam_common_read_poll_timeout((soc_info->reg_map[0].mem_base +
+			hw_info->cdm_irq_status),
+			PC_POLL_DELAY_US, PC_POLL_TIMEOUT_US,
+			BPS_RST_DONE_IRQ_STATUS_BIT, BPS_RST_DONE_IRQ_STATUS_BIT,
+			&status);
+
+		CAM_DBG(CAM_ICP, "bps_cdm_irq_status = %u", status);
+
+		if ((status & BPS_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+
+	if (retry_cnt == HFI_MAX_POLL_TRY) {
+		CAM_ERR(CAM_ICP, "BPS CDM rst failed status 0x%x", status);
+		reset_bps_cdm_fail = true;
+	}
+
+	/* Reset BPS core*/
+	status = 0;
+	retry_cnt = 0;
+	cam_io_w_mb((uint32_t)0x3,
+		soc_info->reg_map[0].mem_base + hw_info->top_rst_cmd);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		cam_common_read_poll_timeout((soc_info->reg_map[0].mem_base +
+			hw_info->top_irq_status),
+			PC_POLL_DELAY_US, PC_POLL_TIMEOUT_US,
+			BPS_RST_DONE_IRQ_STATUS_BIT, BPS_RST_DONE_IRQ_STATUS_BIT,
+			&status);
+
+		CAM_DBG(CAM_ICP, "bps_top_irq_status = %u", status);
+
+		if ((status & BPS_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+
+	if (retry_cnt == HFI_MAX_POLL_TRY) {
+		CAM_ERR(CAM_ICP, "BPS top rst failed status 0x%x", status);
+		reset_bps_top_fail = true;
+	}
+
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, core_info->bps_hw_info->pwr_ctrl,
+		true, &pwr_ctrl);
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, core_info->bps_hw_info->pwr_status,
+		true, &pwr_status);
+	CAM_DBG(CAM_ICP, "(After) pwr_ctrl = %x pwr_status = %x",
+		pwr_ctrl, pwr_status);
+
+	if (reset_bps_cdm_fail || reset_bps_top_fail)
+		rc = -EAGAIN;
+	else
+		CAM_DBG(CAM_ICP, "BPS cdm and BPS top reset success");
+
+	return rc;
+}
+
+int cam_bps_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *bps_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	struct cam_bps_device_hw_info *hw_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_ICP_DEV_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	hw_info = core_info->bps_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ICP_DEV_CMD_VOTE_CPAS: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		cam_bps_cpas_vote(core_info, cpas_vote);
+		break;
+	}
+
+	case CAM_ICP_DEV_CMD_CPAS_START: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		if (!core_info->cpas_start) {
+			rc = cam_cpas_start(core_info->cpas_handle,
+					&cpas_vote->ahb_vote,
+					&cpas_vote->axi_vote);
+			core_info->cpas_start = true;
+		}
+		break;
+	}
+
+	case CAM_ICP_DEV_CMD_CPAS_STOP:
+		if (core_info->cpas_start) {
+			cam_cpas_stop(core_info->cpas_handle);
+			core_info->cpas_start = false;
+		}
+		break;
+	case CAM_ICP_DEV_CMD_POWER_COLLAPSE:
+		rc = cam_bps_handle_pc(bps_dev);
+		break;
+	case CAM_ICP_DEV_CMD_POWER_RESUME:
+		rc = cam_bps_handle_resume(bps_dev);
+		break;
+	case CAM_ICP_DEV_CMD_UPDATE_CLK: {
+		struct cam_icp_dev_clk_update_cmd *clk_upd_cmd = cmd_args;
+		struct cam_ahb_vote ahb_vote;
+		uint32_t clk_rate = clk_upd_cmd->curr_clk_rate;
+		int32_t clk_level  = 0, err = 0;
+
+		CAM_DBG(CAM_PERF, "bps_src_clk rate = %d", (int)clk_rate);
+
+		if (!core_info->clk_enable) {
+			if (clk_upd_cmd->dev_pc_enable) {
+				cam_bps_handle_pc(bps_dev);
+				cam_cpas_reg_write(core_info->cpas_handle,
+					CAM_CPAS_REGBASE_CPASTOP,
+					hw_info->pwr_ctrl, true, 0x0);
+			}
+			rc = cam_bps_toggle_clk(soc_info, true);
+			if (rc)
+				CAM_ERR(CAM_ICP, "Enable failed");
+			else
+				core_info->clk_enable = true;
+			if (clk_upd_cmd->dev_pc_enable) {
+				rc = cam_bps_handle_resume(bps_dev);
+				if (rc)
+					CAM_ERR(CAM_ICP, "BPS resume failed");
+			}
+		}
+		CAM_DBG(CAM_PERF, "clock rate %d", clk_rate);
+		rc = cam_bps_update_clk_rate(soc_info, clk_rate);
+		if (rc)
+			CAM_ERR(CAM_PERF, "Failed to update clk %d", clk_rate);
+
+		err = cam_soc_util_get_clk_level(soc_info,
+			clk_rate, soc_info->src_clk_idx,
+			&clk_level);
+
+		if (!err) {
+			ahb_vote.type = CAM_VOTE_ABSOLUTE;
+			ahb_vote.vote.level = clk_level;
+			cam_cpas_update_ahb_vote(
+				core_info->cpas_handle,
+				&ahb_vote);
+		}
+		break;
+	}
+	case CAM_ICP_DEV_CMD_DISABLE_CLK:
+		if (core_info->clk_enable == true)
+			cam_bps_toggle_clk(soc_info, false);
+		core_info->clk_enable = false;
+		break;
+	case CAM_ICP_DEV_CMD_RESET:
+		rc = cam_bps_cmd_reset(soc_info, core_info);
+		break;
+	case CAM_ICP_DEV_CMD_DUMP_CLK: {
+		rc = cam_soc_util_dump_clk(soc_info);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_ICP, "Invalid Cmd Type:%u", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+irqreturn_t cam_bps_irq(int irq_num, void *data)
+{
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_core.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_BPS_CORE_H
+#define CAM_BPS_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+/* BPS CDM/TOP status register */
+#define BPS_RST_DONE_IRQ_STATUS_BIT  0x1
+
+#define BPS_COLLAPSE_MASK 0x1
+#define BPS_PWR_ON_MASK   0x2
+
+struct cam_bps_device_hw_info {
+	uint32_t hw_idx;
+	uint32_t pwr_ctrl;
+	uint32_t pwr_status;
+
+	uint32_t top_rst_cmd;
+	uint32_t top_irq_status;
+	uint32_t cdm_rst_cmd;
+	uint32_t cdm_irq_status;
+
+	uint32_t cdm_rst_val;
+};
+
+struct cam_bps_device_core_info {
+	struct cam_bps_device_hw_info *bps_hw_info;
+	uint32_t cpas_handle;
+	bool cpas_start;
+	bool clk_enable;
+};
+
+int cam_bps_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_bps_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_bps_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+irqreturn_t cam_bps_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register BPS hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_bps_init_module(void);
+
+/**
+ * @brief : API to remove BPS Hw from platform framework.
+ */
+void cam_bps_exit_module(void);
+#endif /* CAM_BPS_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_dev.c
@@ -0,0 +1,286 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+#include "bps_core.h"
+#include "bps_soc.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_icp_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_bps_device_hw_info cam_bps_hw_info = {
+	.hw_idx = 0,
+	.pwr_ctrl = 0x48,
+	.pwr_status = 0x44,
+	.top_rst_cmd = 0x1008,
+	.top_irq_status = 0x100C,
+	.cdm_rst_cmd = 0x10,
+	.cdm_irq_status = 0x44,
+	.cdm_rst_val = 0xF,
+};
+
+static struct cam_bps_device_hw_info cam_bps680_hw_info = {
+	.hw_idx = 0,
+	.pwr_ctrl = 0x48,
+	.pwr_status = 0x44,
+	.top_rst_cmd = 0x508,
+	.top_irq_status = 0x50C,
+	.cdm_rst_cmd = 0x10,
+	.cdm_irq_status = 0x44,
+	.cdm_rst_val = 0x7F,
+};
+
+static struct cam_bps_device_hw_info cam_bps880_hw_info = {
+	.hw_idx = 0,
+	.pwr_ctrl = 0x48,
+	.pwr_status = 0x44,
+	.top_rst_cmd = 0x1008,
+	.top_irq_status = 0x100C,
+	.cdm_rst_cmd = 0x10,
+	.cdm_irq_status = 0x44,
+	.cdm_rst_val = 0x7F,
+};
+
+static bool cam_bps_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool error_handled = false;
+
+	if (!irq_data)
+		return error_handled;
+
+	switch (irq_data->irq_type) {
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC Decode error type=%d status=%x thr_err=%d, fcl_err=%d, len_md_err=%d, format_err=%d",
+			irq_data->irq_type,
+			irq_data->u.dec_err.decerr_status.value,
+			irq_data->u.dec_err.decerr_status.thr_err,
+			irq_data->u.dec_err.decerr_status.fcl_err,
+			irq_data->u.dec_err.decerr_status.len_md_err,
+			irq_data->u.dec_err.decerr_status.format_err);
+		error_handled = true;
+		break;
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC Encode error type=%d status=%x",
+			irq_data->irq_type,
+			irq_data->u.enc_err.encerr_status.value);
+		error_handled = true;
+		break;
+	default:
+		break;
+	}
+
+	return error_handled;
+}
+
+int cam_bps_register_cpas(struct cam_hw_soc_info *soc_info,
+			struct cam_bps_device_core_info *core_info,
+			uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "bps", sizeof("bps"));
+	cpas_register_params.cam_cpas_client_cb = cam_bps_cpas_cb;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_bps_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info            *bps_dev = NULL;
+	struct cam_hw_intf            *bps_dev_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_bps_device_core_info   *core_info = NULL;
+	struct cam_bps_device_hw_info     *hw_info = NULL;
+	int                                rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	bps_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!bps_dev_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &bps_dev_intf->hw_idx);
+
+	bps_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!bps_dev) {
+		kfree(bps_dev_intf);
+		return -ENOMEM;
+	}
+
+	bps_dev->soc_info.pdev = pdev;
+	bps_dev->soc_info.dev = &pdev->dev;
+	bps_dev->soc_info.dev_name = pdev->name;
+	bps_dev_intf->hw_priv = bps_dev;
+	bps_dev_intf->hw_ops.init = cam_bps_init_hw;
+	bps_dev_intf->hw_ops.deinit = cam_bps_deinit_hw;
+	bps_dev_intf->hw_ops.process_cmd = cam_bps_process_cmd;
+	bps_dev_intf->hw_type = CAM_ICP_DEV_BPS;
+	platform_set_drvdata(pdev, bps_dev_intf);
+	bps_dev->core_info = kzalloc(sizeof(struct cam_bps_device_core_info),
+					GFP_KERNEL);
+	if (!bps_dev->core_info) {
+		kfree(bps_dev);
+		kfree(bps_dev_intf);
+		return -ENOMEM;
+	}
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ICP, "No bps hardware info");
+		kfree(bps_dev->core_info);
+		kfree(bps_dev);
+		kfree(bps_dev_intf);
+		rc = -EINVAL;
+		return rc;
+	}
+	hw_info = (struct cam_bps_device_hw_info *)match_dev->data;
+	core_info->bps_hw_info = hw_info;
+
+	rc = cam_bps_init_soc_resources(&bps_dev->soc_info, cam_bps_irq,
+		bps_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed to init_soc");
+		kfree(bps_dev->core_info);
+		kfree(bps_dev);
+		kfree(bps_dev_intf);
+		return rc;
+	}
+	CAM_DBG(CAM_ICP, "soc info : %pK",
+		(void *)&bps_dev->soc_info);
+
+	rc = cam_bps_register_cpas(&bps_dev->soc_info,
+			core_info, bps_dev_intf->hw_idx);
+	if (rc < 0) {
+		kfree(bps_dev->core_info);
+		kfree(bps_dev);
+		kfree(bps_dev_intf);
+		return rc;
+	}
+	bps_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&bps_dev->hw_mutex);
+	spin_lock_init(&bps_dev->hw_lock);
+	init_completion(&bps_dev->hw_complete);
+	CAM_DBG(CAM_ICP, "BPS:%d component bound successfully",
+		bps_dev_intf->hw_idx);
+
+	return rc;
+}
+
+static void cam_bps_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info            *bps_dev = NULL;
+	struct cam_hw_intf            *bps_dev_intf = NULL;
+	struct cam_bps_device_core_info   *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ICP, "Unbinding component: %s", pdev->name);
+	bps_dev_intf = platform_get_drvdata(pdev);
+
+	if (!bps_dev_intf) {
+		CAM_ERR(CAM_ICP, "Error No data in pdev");
+		return;
+	}
+
+	bps_dev = bps_dev_intf->hw_priv;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	cam_cpas_unregister_client(core_info->cpas_handle);
+	cam_bps_deinit_soc_resources(&bps_dev->soc_info);
+
+	kfree(bps_dev->core_info);
+	kfree(bps_dev);
+	kfree(bps_dev_intf);
+}
+
+const static struct component_ops cam_bps_component_ops = {
+	.bind = cam_bps_component_bind,
+	.unbind = cam_bps_component_unbind,
+};
+
+int cam_bps_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "Adding BPS component");
+	rc = component_add(&pdev->dev, &cam_bps_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_bps_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_bps_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_bps_dt_match[] = {
+	{
+		.compatible = "qcom,cam-bps",
+		.data = &cam_bps_hw_info,
+	},
+	{
+		.compatible = "qcom,cam-bps680",
+		.data = &cam_bps680_hw_info,
+	},
+	{
+		.compatible = "qcom,cam-bps880",
+		.data = &cam_bps880_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_bps_dt_match);
+
+struct platform_driver cam_bps_driver = {
+	.probe = cam_bps_probe,
+	.remove = cam_bps_remove,
+	.driver = {
+		.name = "cam-bps",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_bps_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_bps_init_module(void)
+{
+	return platform_driver_register(&cam_bps_driver);
+}
+
+void cam_bps_exit_module(void)
+{
+	platform_driver_unregister(&cam_bps_driver);
+}
+
+MODULE_DESCRIPTION("CAM BPS driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_soc.c
@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "bps_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+static int cam_bps_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ICP, "get bps dt prop is failed");
+
+	return rc;
+}
+
+static int cam_bps_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t bps_irq_handler, void *data)
+{
+	int rc = 0, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, bps_irq_handler, &(irq_data[0]));
+
+	return rc;
+}
+
+int cam_bps_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t bps_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_bps_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_bps_request_platform_resource(soc_info, bps_irq_handler,
+		irq_data);
+	if (rc < 0)
+		return rc;
+
+	return rc;
+}
+
+void cam_bps_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_WARN(CAM_ICP, "release platform resources fail");
+}
+
+int cam_bps_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		CAM_SVS_VOTE, false);
+	if (rc)
+		CAM_ERR(CAM_ICP, "enable platform failed");
+
+	return rc;
+}
+
+int cam_bps_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, disable_clk,
+		false);
+	if (rc)
+		CAM_ERR(CAM_ICP, "disable platform failed");
+
+	return rc;
+}
+
+int cam_bps_transfer_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	int rc;
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = cam_wrapper_regulator_set_mode(soc_info->rgltr[i],
+			REGULATOR_MODE_FAST);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Regulator set mode %s failed",
+				soc_info->rgltr_name[i]);
+			goto rgltr_set_mode_failed;
+		}
+	}
+	return 0;
+
+rgltr_set_mode_failed:
+	for (i = i - 1; i >= 0; i--)
+		if (soc_info->rgltr[i])
+			cam_wrapper_regulator_set_mode(soc_info->rgltr[i],
+					REGULATOR_MODE_NORMAL);
+
+	return rc;
+}
+
+int cam_bps_get_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	int rc;
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = cam_wrapper_regulator_set_mode(soc_info->rgltr[i],
+			REGULATOR_MODE_NORMAL);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Regulator set mode %s failed",
+				soc_info->rgltr_name[i]);
+			goto rgltr_set_mode_failed;
+		}
+	}
+	return 0;
+
+rgltr_set_mode_failed:
+	for (i = i - 1; i >= 0; i--)
+		if (soc_info->rgltr[i])
+			cam_wrapper_regulator_set_mode(soc_info->rgltr[i],
+					REGULATOR_MODE_FAST);
+
+	return rc;
+}
+
+int cam_bps_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate)
+{
+	int32_t src_clk_idx;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE] == true) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_PERF, "clk_rate %d greater than max, reset to %d",
+			clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	return cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX, clk_rate, 0);
+}
+
+int cam_bps_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable)
+{
+	int rc = 0;
+
+	if (clk_enable)
+		rc = cam_soc_util_clk_enable_default(soc_info, CAM_CLK_SW_CLIENT_IDX, CAM_SVS_VOTE);
+	else
+		cam_soc_util_clk_disable_default(soc_info, CAM_CLK_SW_CLIENT_IDX);
+
+	CAM_DBG(CAM_ICP, "%s BPS clock", clk_enable ? "Enable" : "Disable");
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/bps_hw/bps_soc.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_BPS_SOC_H_
+#define _CAM_BPS_SOC_H_
+
+#include "cam_soc_util.h"
+
+int cam_bps_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t bps_irq_handler, void *irq_data);
+
+int cam_bps_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_bps_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk);
+
+int cam_bps_get_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_bps_transfer_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_bps_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate);
+int cam_bps_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable);
+void cam_bps_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+#endif /* _CAM_BPS_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
@@ -0,0 +1,8351 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/uaccess.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/io.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/mutex.h>
+#include <linux/spinlock_types.h>
+#include <linux/workqueue.h>
+#include <linux/timer.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <linux/debugfs.h>
+#include <linux/rwsem.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include <media/cam_cpas.h>
+
+#include "cam_sync_api.h"
+#include "cam_packet_util.h"
+#include "cam_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_icp_hw_mgr.h"
+#include "cam_bps_hw_intf.h"
+#include "cam_ipe_hw_intf.h"
+#include "cam_smmu_api.h"
+#include "cam_mem_mgr.h"
+#include "hfi_intf.h"
+#include "hfi_reg.h"
+#include "hfi_session_defs.h"
+#include "hfi_sys_defs.h"
+#include "cam_req_mgr_workq.h"
+#include "hfi_sys_defs.h"
+#include "cam_debug_util.h"
+#include "cam_soc_util.h"
+#include "cam_trace.h"
+#include "cam_cpas_api.h"
+#include "cam_common_util.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_presil_hw_access.h"
+#include "cam_icp_proc.h"
+
+#define ICP_WORKQ_TASK_CMD_TYPE 1
+#define ICP_WORKQ_TASK_MSG_TYPE 2
+
+#define ICP_DEVICE_IDLE_TIMEOUT 400
+
+/*
+ * If synx fencing is enabled, send FW memory mapping
+ * for synx hw_mutex, ipc hw_mutex, synx global mem
+ * and global cntr for qtimer
+ */
+#define ICP_NUM_MEM_REGIONS_FOR_SYNX 4
+
+DECLARE_RWSEM(frame_in_process_sem);
+
+static struct cam_icp_hw_mgr *g_icp_hw_mgr[CAM_ICP_SUBDEV_MAX];
+
+uint32_t icp_cpas_mask[CAM_ICP_SUBDEV_MAX] = {CPAS_ICP_BIT, CPAS_ICP1_BIT};
+
+static void cam_icp_mgr_process_dbg_buf(struct cam_icp_hw_mgr *hw_mgr);
+
+static int cam_icp_dump_io_cfg(struct cam_icp_hw_ctx_data *ctx_data,
+	int32_t buf_handle, uint32_t size)
+{
+	uintptr_t vaddr_ptr;
+	uint32_t  *ptr;
+	uint32_t  io_size;
+	size_t    len;
+	int       rc, i;
+	char      buf[512];
+	int       used = 0;
+
+	rc = cam_mem_get_cpu_buf(buf_handle, &vaddr_ptr, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "%s: Unable to get io_cfg buf address",
+			ctx_data->ctx_id_string);
+		return rc;
+	}
+
+	io_size = size / sizeof(uint32_t);
+	ptr = (uint32_t *)vaddr_ptr;
+	for (i = 0; i < io_size; i++) {
+		used += snprintf(buf + used,
+			sizeof(buf) - used, "0X%08X-", ptr[i]);
+		if (!(i % 8)) {
+			CAM_DBG(CAM_ICP, "%s: %s", __func__, buf);
+			used = 0;
+		}
+	}
+	cam_mem_put_cpu_buf(buf_handle);
+	return rc;
+}
+
+static const char *cam_icp_dev_type_to_name(uint32_t dev_type)
+{
+	switch (dev_type) {
+	case CAM_ICP_RES_TYPE_BPS:
+		return "BPS";
+	case CAM_ICP_RES_TYPE_BPS_RT:
+		return "BPS_RT";
+	case CAM_ICP_RES_TYPE_BPS_SEMI_RT:
+		return "BPS_SEMI_RT";
+	case CAM_ICP_RES_TYPE_IPE:
+		return "IPE";
+	case CAM_ICP_RES_TYPE_IPE_RT:
+		return "IPE_RT";
+	case CAM_ICP_RES_TYPE_IPE_SEMI_RT:
+		return "IPE_SEMI_RT";
+	case CAM_ICP_RES_TYPE_OFE:
+		return "OFE";
+	case CAM_ICP_RES_TYPE_OFE_RT:
+		return "OFE_RT";
+	case CAM_ICP_RES_TYPE_OFE_SEMI_RT:
+		return "OFE_SEMI_RT";
+	default:
+		return "Invalid dev type";
+	}
+}
+
+static inline void cam_icp_dump_debug_info(struct cam_icp_hw_mgr *hw_mgr,
+	bool skip_dump)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	uint32_t dump_type;
+	int rc;
+
+	if (skip_dump)
+		return;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is NULL",
+			hw_mgr->hw_mgr_name);
+		return;
+	}
+
+	dump_type = CAM_ICP_DUMP_STATUS_REGISTERS;
+	cam_icp_mgr_process_dbg_buf(hw_mgr);
+	cam_hfi_queue_dump(hw_mgr->hfi_handle, false);
+
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_HW_REG_DUMP, &dump_type, sizeof(dump_type));
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] Fail to dump debug info", hw_mgr->hw_mgr_name);
+}
+
+static int cam_icp_send_ubwc_cfg(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	struct cam_icp_ubwc_cfg_cmd ubwc_cmd;
+	int rc;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is NULL",
+			hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	ubwc_cmd.ubwc_cfg_dev_mask = hw_mgr->hw_cap_mask;
+	ubwc_cmd.disable_ubwc_comp = hw_mgr->disable_ubwc_comp;
+
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv, CAM_ICP_CMD_UBWC_CFG,
+		&ubwc_cmd, sizeof(ubwc_cmd));
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] Fail to submit UBWC config", hw_mgr->hw_mgr_name);
+
+	return rc;
+}
+
+static void cam_icp_hw_mgr_clk_info_update(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct cam_icp_clk_info *dev_clk_info;
+
+	dev_clk_info = &ctx_data->device_info->clk_info;
+
+	if (dev_clk_info->base_clk >= ctx_data->clk_info.base_clk)
+		dev_clk_info->base_clk -= ctx_data->clk_info.base_clk;
+}
+
+static void cam_icp_hw_mgr_reset_clk_info(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_icp_clk_info *clk_info;
+	int i;
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		clk_info = &hw_mgr->dev_info[i].clk_info;
+
+		clk_info->base_clk = 0;
+		clk_info->curr_clk = hw_mgr->icp_svs_clk;
+		clk_info->threshold = ICP_OVER_CLK_THRESHOLD;
+		clk_info->over_clked = 0;
+		clk_info->uncompressed_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		clk_info->compressed_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	}
+
+	hw_mgr->icp_default_clk = hw_mgr->icp_svs_clk;
+}
+
+static int cam_icp_get_actual_clk_rate_idx(
+	struct cam_icp_hw_ctx_data *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return i;
+
+	/*
+	 * Caller has to ensure returned index is within array
+	 * size bounds while accessing that index.
+	 */
+
+	return i;
+}
+
+static bool cam_icp_is_over_clk(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info)
+{
+	int base_clk_idx;
+	int curr_clk_idx;
+
+	base_clk_idx = cam_icp_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->base_clk);
+
+	curr_clk_idx = cam_icp_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->curr_clk);
+
+	CAM_DBG(CAM_PERF, "%s: bc_idx = %d cc_idx = %d %d %d",
+		ctx_data->ctx_id_string, base_clk_idx, curr_clk_idx,
+		hw_mgr_clk_info->base_clk, hw_mgr_clk_info->curr_clk);
+
+	if (curr_clk_idx > base_clk_idx)
+		return true;
+
+	return false;
+}
+
+static int cam_icp_get_lower_clk_rate(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_icp_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	if (i > 0)
+		return ctx_data->clk_info.clk_rate[i - 1];
+
+	CAM_DBG(CAM_PERF, "%s: Already clk at lower level", ctx_data->ctx_id_string);
+	return base_clk;
+}
+
+static int cam_icp_get_next_clk_rate(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_icp_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	if (i < CAM_MAX_VOTE - 1)
+		return ctx_data->clk_info.clk_rate[i + 1];
+
+	CAM_DBG(CAM_PERF, "%s: Already clk at higher level", ctx_data->ctx_id_string);
+
+	return base_clk;
+}
+
+static int cam_icp_get_actual_clk_rate(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return ctx_data->clk_info.clk_rate[i];
+
+	return base_clk;
+}
+
+static int cam_icp_get_supported_clk_rates(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int i;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_hw_info *dev = NULL;
+
+	dev_intf = ctx_data->device_info->dev_intf[0];
+	if (!dev_intf) {
+		CAM_ERR(CAM_ICP, "%s Invalid device intf for %s",
+			ctx_data->ctx_id_string, ctx_data->device_info->dev_name);
+		return -EINVAL;
+	}
+
+	dev = (struct cam_hw_info *)dev_intf->hw_priv;
+	soc_info = &dev->soc_info;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++) {
+		ctx_data->clk_info.clk_rate[i] =
+			soc_info->clk_rate[i][soc_info->src_clk_idx];
+		CAM_DBG(CAM_PERF, "%s: clk_info[%d] = %d",
+			ctx_data->ctx_id_string, i, ctx_data->clk_info.clk_rate[i]);
+	}
+
+	return 0;
+}
+
+static int cam_icp_get_frame_process_idx_from_req_id(struct cam_icp_hw_ctx_data *ctx_data,
+	uint64_t req_id)
+{
+	struct hfi_frame_process_info *frame_process;
+	int i;
+
+	frame_process = &ctx_data->hfi_frame_process;
+
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++)
+		if (frame_process->request_id[i] == req_id)
+			break;
+
+	return i;
+}
+
+static int cam_icp_ctx_clk_info_init(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int i;
+
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+	ctx_data->clk_info.uncompressed_bw = 0;
+	ctx_data->clk_info.compressed_bw = 0;
+	for (i = 0; i < CAM_ICP_MAX_PER_PATH_VOTES; i++) {
+		ctx_data->clk_info.axi_path[i].camnoc_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ab_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ib_bw = 0;
+	}
+
+	cam_icp_get_supported_clk_rates(ctx_data);
+
+	return 0;
+}
+
+static bool cam_icp_frame_pending(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	return !bitmap_empty(ctx_data->hfi_frame_process.bitmap,
+		CAM_FRAME_CMD_MAX);
+}
+
+static int cam_icp_ctx_timer_reset(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	if (ctx_data && ctx_data->watch_dog) {
+		ctx_data->watch_dog_reset_counter++;
+		CAM_DBG(CAM_PERF, "%s: reset timer : counter=%d",
+			ctx_data->ctx_id_string, ctx_data->watch_dog_reset_counter);
+		crm_timer_reset(ctx_data->watch_dog);
+	}
+
+	return 0;
+}
+
+static void cam_icp_device_timer_reset(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_device_info *dev_info)
+{
+	struct cam_icp_clk_info *clk_info = &dev_info->clk_info;
+
+	if (clk_info->watch_dog) {
+		CAM_DBG(CAM_PERF, "[%s] reset timer for device: %s",
+			hw_mgr->hw_mgr_name, dev_info->dev_name);
+		crm_timer_reset(clk_info->watch_dog);
+		clk_info->watch_dog_reset_counter++;
+	}
+}
+
+static int32_t cam_icp_deinit_idle_clk(void *priv, void *data)
+{
+	struct cam_icp_hw_mgr *hw_mgr = (struct cam_icp_hw_mgr *)priv;
+	struct clk_work_data *task_data = (struct clk_work_data *)data;
+	struct cam_icp_hw_device_info *dev_info = task_data->data;
+	struct cam_icp_clk_info *clk_info = &dev_info->clk_info;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_icp_dev_clk_update_cmd clk_upd_cmd;
+	int rc = 0, i;
+	bool busy = false;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	clk_info->base_clk = 0;
+	clk_info->curr_clk = 0;
+	clk_info->over_clked = 0;
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx_data[i];
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (ctx_data->state == CAM_ICP_CTX_STATE_ACQUIRED) {
+			if (ctx_data->device_info->hw_dev_type == dev_info->hw_dev_type) {
+				busy = cam_icp_frame_pending(ctx_data);
+				if (busy) {
+					mutex_unlock(&ctx_data->ctx_mutex);
+					break;
+				}
+				cam_icp_ctx_clk_info_init(ctx_data);
+			}
+		}
+		mutex_unlock(&ctx_data->ctx_mutex);
+	}
+
+	if (busy) {
+		cam_icp_device_timer_reset(hw_mgr, dev_info);
+		rc = -EBUSY;
+		goto done;
+	}
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "[%s] No acquired ctx data found", hw_mgr->hw_mgr_name);
+		rc = -EFAULT;
+		goto done;
+	}
+
+	clk_upd_cmd.dev_pc_enable = hw_mgr->dev_pc_flag;
+
+	CAM_DBG(CAM_PERF, "[%s] Disable %d",
+		hw_mgr->hw_mgr_name, dev_info->dev_name);
+
+	for (i = 0; i < dev_info->hw_dev_cnt; i++) {
+		dev_intf = dev_info->dev_intf[i];
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "[%s] Device intf for %s[%u] is NULL",
+				hw_mgr->hw_mgr_name, dev_info->dev_name, i);
+			rc = -EINVAL;
+			goto done;
+		}
+		dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, CAM_ICP_DEV_CMD_DISABLE_CLK,
+			&clk_upd_cmd, sizeof(clk_upd_cmd));
+	}
+
+done:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static inline bool cam_icp_validate_bw_path_idx(
+	int path_idx, uint32_t path_data_type)
+{
+	if (path_idx < 0) {
+		return true;
+	} else if (path_idx >= CAM_ICP_MAX_PER_PATH_VOTES) {
+		CAM_WARN(CAM_PERF,
+			"Invalid path: %u IPE start offset: %d, OFE start offset: %d max: %d",
+			path_data_type,
+			CAM_AXI_PATH_DATA_IPE_START_OFFSET,
+			CAM_AXI_PATH_DATA_OFE_START_OFFSET,
+			CAM_ICP_MAX_PER_PATH_VOTES);
+		return true;
+	} else {
+		return false;
+	}
+}
+
+static inline int cam_icp_get_axi_path_index(struct cam_cpas_axi_per_path_bw_vote *axi_path,
+	enum cam_icp_hw_type hw_dev_type)
+{
+	switch (hw_dev_type) {
+	case CAM_ICP_DEV_BPS:
+		/* By assuming BPS has Read-All, Write-All votes only */
+		return axi_path->transac_type - CAM_AXI_TRANSACTION_READ;
+	case CAM_ICP_DEV_IPE:
+		return axi_path->path_data_type - CAM_AXI_PATH_DATA_IPE_START_OFFSET;
+	case CAM_ICP_DEV_OFE:
+		return axi_path->path_data_type - CAM_AXI_PATH_DATA_OFE_START_OFFSET;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid hw dev type not supported: %u",
+			hw_dev_type);
+		return -EINVAL;
+	}
+}
+
+static inline int cam_icp_get_bw_device_share_ratio(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_device_info *dev_info)
+{
+	uint32_t device_share_ratio = 1, num_dev;
+
+	/*
+	 * Since there are 2 devices, we assume the load is evenly shared
+	 * between HWs and corresponding AXI paths. So divide total bw by half
+	 * to vote on each device
+	 */
+
+	num_dev = dev_info->hw_dev_cnt;
+	if (num_dev > 1) {
+		device_share_ratio = ICP_TWO_DEV_BW_SHARE_RATIO;
+		if (num_dev > 2) {
+			CAM_ERR(CAM_ICP,
+				"[%s] Number of devices %u not supported for geting bw device share ratio",
+				hw_mgr->hw_mgr_name, num_dev);
+			return -EINVAL;
+		}
+	}
+
+	return device_share_ratio;
+}
+
+static int cam_icp_remove_ctx_bw(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+	struct cam_icp_hw_device_info *dev_info = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+	uint64_t temp, total_ab_bw = 0;
+	struct cam_icp_clk_info *clk_info;
+	struct cam_icp_cpas_vote clk_update;
+	int i = 0, device_share_ratio;
+	enum cam_icp_hw_type hw_dev_type;
+
+	if (!ctx_data->icp_dev_acquire_info) {
+		CAM_WARN(CAM_ICP, "%s: NULL acquire info", ctx_data->ctx_id_string);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"%s: ubw = %lld cbw = %lld curr_fc = %u bc = %u",
+		ctx_data->ctx_id_string,
+		ctx_data->clk_info.uncompressed_bw,
+		ctx_data->clk_info.compressed_bw,
+		ctx_data->clk_info.curr_fc, ctx_data->clk_info.base_clk);
+
+	if (!ctx_data->clk_info.bw_included) {
+		CAM_DBG(CAM_PERF, "%s: BW vote already removed",
+			ctx_data->ctx_id_string);
+		return 0;
+	}
+
+	dev_info = ctx_data->device_info;
+	clk_info = &dev_info->clk_info;
+	hw_dev_type = dev_info->hw_dev_type;
+
+	device_share_ratio = cam_icp_get_bw_device_share_ratio(hw_mgr, dev_info);
+	if (device_share_ratio < 0) {
+		CAM_ERR(CAM_ICP, "%s: Fail to get device share ratio",
+			ctx_data->ctx_id_string);
+		return -EINVAL;
+	}
+
+	if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_V1) {
+		clk_update.axi_vote.num_paths = 1;
+		if (hw_dev_type == CAM_ICP_DEV_BPS) {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_BPS_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_BPS_DEFAULT_AXI_TRANSAC;
+		} else if (hw_dev_type == CAM_ICP_DEV_IPE) {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_IPE_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_IPE_DEFAULT_AXI_TRANSAC;
+		} else {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_OFE_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_OFE_DEFAULT_AXI_TRANSAC;
+		}
+
+		clk_info->compressed_bw -= ctx_data->clk_info.compressed_bw;
+		clk_info->uncompressed_bw -= ctx_data->clk_info.uncompressed_bw;
+
+		total_ab_bw = clk_info->compressed_bw;
+
+		ctx_data->clk_info.uncompressed_bw = 0;
+		ctx_data->clk_info.compressed_bw = 0;
+		ctx_data->clk_info.curr_fc = 0;
+		ctx_data->clk_info.base_clk = 0;
+
+		clk_update.axi_vote.num_paths = 1;
+
+		temp = clk_info->uncompressed_bw;
+		do_div(temp, device_share_ratio);
+		clk_update.axi_vote.axi_path[0].camnoc_bw = temp;
+
+		temp = clk_info->compressed_bw;
+		do_div(temp, device_share_ratio);
+		clk_update.axi_vote.axi_path[0].mnoc_ab_bw = temp;
+		clk_update.axi_vote.axi_path[0].mnoc_ib_bw = temp;
+	} else {
+		int path_index;
+
+		/*
+		 * Remove previous vote of this context from hw mgr first.
+		 * hw_mgr_clk_info has all valid paths, with each path in its
+		 * own index. BW that we wanted to vote now is after removing
+		 * current context's vote from hw mgr consolidated vote
+		 */
+		for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+			path_index = cam_icp_get_axi_path_index(&ctx_data->clk_info.axi_path[i],
+				hw_dev_type);
+
+			if (cam_icp_validate_bw_path_idx(path_index,
+				ctx_data->clk_info.axi_path[i].path_data_type))
+				continue;
+
+			clk_info->axi_path[path_index].camnoc_bw -=
+				ctx_data->clk_info.axi_path[i].camnoc_bw;
+			clk_info->axi_path[path_index].mnoc_ab_bw -=
+				ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+			clk_info->axi_path[path_index].mnoc_ib_bw -=
+				ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+
+			total_ab_bw +=
+				clk_info->axi_path[path_index].mnoc_ab_bw;
+
+			CAM_DBG(CAM_PERF,
+				"%s: Removing ctx bw from path_type: %s, transac_type: %s, camnoc_bw = %lld mnoc_ab_bw = %lld, mnoc_ib_bw = %lld",
+				ctx_data->ctx_id_string,
+				cam_cpas_axi_util_path_type_to_string(
+				ctx_data->clk_info.axi_path[i].path_data_type),
+				cam_cpas_axi_util_trans_type_to_string(
+				ctx_data->clk_info.axi_path[i].transac_type),
+				ctx_data->clk_info.axi_path[i].camnoc_bw,
+				ctx_data->clk_info.axi_path[i].mnoc_ab_bw,
+				ctx_data->clk_info.axi_path[i].mnoc_ib_bw);
+
+			CAM_DBG(CAM_PERF,
+				"%s: Final HW bw for path_type: %s, transac_type: %s, camnoc_bw = %lld mnoc_ab_bw = %lld, mnoc_ib_bw = %lld",
+				ctx_data->ctx_id_string,
+				cam_cpas_axi_util_path_type_to_string(
+				clk_info->axi_path[i].path_data_type),
+				cam_cpas_axi_util_trans_type_to_string(
+				clk_info->axi_path[i].transac_type),
+				clk_info->axi_path[i].camnoc_bw,
+				clk_info->axi_path[i].mnoc_ab_bw,
+				clk_info->axi_path[i].mnoc_ib_bw);
+		}
+
+		memset(&ctx_data->clk_info.axi_path[0], 0,
+			CAM_ICP_MAX_PER_PATH_VOTES *
+			sizeof(struct cam_cpas_axi_per_path_bw_vote));
+		ctx_data->clk_info.curr_fc = 0;
+		ctx_data->clk_info.base_clk = 0;
+
+		clk_update.axi_vote.num_paths = clk_info->num_paths;
+		memcpy(&clk_update.axi_vote.axi_path[0],
+			&clk_info->axi_path[0],
+			clk_update.axi_vote.num_paths *
+			sizeof(struct cam_cpas_axi_per_path_bw_vote));
+
+		if (device_share_ratio > 1) {
+			for (i = 0; i < clk_update.axi_vote.num_paths; i++) {
+				do_div(
+				clk_update.axi_vote.axi_path[i].camnoc_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].mnoc_ab_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].mnoc_ib_bw,
+					device_share_ratio);
+			}
+		}
+	}
+
+	clk_update.axi_vote_valid = true;
+
+	if (total_ab_bw == 0) {
+		/* If no more contexts are active, reduce AHB vote to minimum */
+		clk_update.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		clk_update.ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+		clk_update.ahb_vote_valid = true;
+	} else {
+		clk_update.ahb_vote_valid = false;
+	}
+
+	/*
+	 * If two devices, vote half bandwidth each on both devices.
+	 * Total bw at mnoc - CPAS will take care of adding up.
+	 * camnoc clk calculate is more accurate this way.
+	 */
+
+	for (i = 0; i < dev_info->hw_dev_cnt; i++) {
+		dev_intf = dev_info->dev_intf[i];
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "%s: Device intf for %s[%u] is NULL",
+				ctx_data->ctx_id_string, dev_info->dev_name, i);
+			return -EINVAL;
+		}
+		rc = dev_intf->hw_ops.process_cmd(dev_intf->hw_priv,
+			CAM_ICP_DEV_CMD_VOTE_CPAS, &clk_update, sizeof(clk_update));
+		if (rc) {
+			CAM_ERR(CAM_PERF,
+				"%s: Failed in updating cpas vote for %s cell idx: %u, rc=%d",
+				ctx_data->ctx_id_string, dev_info->dev_name, i, rc);
+		}
+	}
+
+	ctx_data->clk_info.bw_included = false;
+
+	CAM_DBG(CAM_PERF, "%s: X :curr_fc = %u bc = %u", ctx_data->ctx_id_string,
+		ctx_data->clk_info.curr_fc, ctx_data->clk_info.base_clk);
+
+	return rc;
+}
+
+
+static int32_t cam_icp_ctx_timer(void *priv, void *data)
+{
+	struct clk_work_data *task_data = (struct clk_work_data *)data;
+	struct cam_icp_hw_mgr *hw_mgr = priv;
+	struct cam_icp_hw_ctx_data *ctx_data =
+		(struct cam_icp_hw_ctx_data *)task_data->data;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "ctx_data is NULL, failed to update clk");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+
+	CAM_DBG(CAM_PERF,
+		"%s: ubw = %lld cbw = %lld curr_fc = %u bc = %u",
+		ctx_data->ctx_id_string,
+		ctx_data->clk_info.uncompressed_bw,
+		ctx_data->clk_info.compressed_bw,
+		ctx_data->clk_info.curr_fc,
+		ctx_data->clk_info.base_clk);
+
+	if ((ctx_data->state != CAM_ICP_CTX_STATE_ACQUIRED) ||
+		(ctx_data->watch_dog_reset_counter == 0)) {
+		CAM_DBG(CAM_PERF, "%s: state %d, counter=%d",
+			ctx_data->ctx_id_string, ctx_data->state,
+			ctx_data->watch_dog_reset_counter);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return 0;
+	}
+
+	if (cam_icp_frame_pending(ctx_data)) {
+		cam_icp_ctx_timer_reset(ctx_data);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return -EBUSY;
+	}
+
+	cam_icp_remove_ctx_bw(hw_mgr, ctx_data);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return 0;
+}
+
+static void cam_icp_ctx_timer_cb(struct timer_list *timer_data)
+{
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct clk_work_data *task_data;
+	struct cam_req_mgr_timer *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+	struct cam_icp_hw_ctx_data *ctx_data = timer->parent;
+	struct cam_icp_hw_mgr *hw_mgr = ctx_data->hw_mgr_priv;
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(hw_mgr->timer_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "%s: empty task", ctx_data->ctx_id_string);
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+		return;
+	}
+
+	task_data = (struct clk_work_data *)task->payload;
+	task_data->data = ctx_data;
+	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_icp_ctx_timer;
+	cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+}
+
+static void cam_icp_device_timer_cb(struct timer_list *timer_data)
+{
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct clk_work_data *task_data;
+	struct cam_req_mgr_timer *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+	struct cam_icp_hw_device_info *dev_info = timer->parent;
+	struct cam_icp_hw_mgr *hw_mgr = dev_info->clk_info.timeout_cb_data;
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(hw_mgr->timer_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "[%s] empty task", hw_mgr->hw_mgr_name);
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+		return;
+	}
+
+	task_data = (struct clk_work_data *)task->payload;
+	task_data->data = timer->parent;
+	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_icp_deinit_idle_clk;
+	cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+}
+
+static int cam_icp_get_svs_clk_info(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int32_t src_clk_idx;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_hw_info *dev = NULL;
+
+	if (CAM_ICP_IS_DEV_HW_EXIST(hw_mgr->hw_cap_mask, CAM_ICP_DEV_IPE)) {
+		dev_intf = hw_mgr->dev_info[hw_mgr->dev_info_idx[CAM_ICP_DEV_IPE]].dev_intf[0];
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "[%s] IPE dev intf is invalid", hw_mgr->hw_mgr_name);
+			return -EINVAL;
+		}
+	} else if (CAM_ICP_IS_DEV_HW_EXIST(hw_mgr->hw_cap_mask, CAM_ICP_DEV_OFE)) {
+		dev_intf = hw_mgr->dev_info[hw_mgr->dev_info_idx[CAM_ICP_DEV_OFE]].dev_intf[0];
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "[%s] OFE dev inf is invalid", hw_mgr->hw_mgr_name);
+			return -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_ICP, "[%s] No supported device to get svs clock info",
+			hw_mgr->hw_mgr_name);
+		return -ENODEV;
+	}
+
+	dev = (struct cam_hw_info *)dev_intf->hw_priv;
+	soc_info = &dev->soc_info;
+	src_clk_idx = soc_info->src_clk_idx;
+	hw_mgr->icp_svs_clk = soc_info->clk_rate[CAM_SVS_VOTE][src_clk_idx];
+
+	if (hw_mgr->icp_svs_clk <= 0)
+		hw_mgr->icp_svs_clk = ICP_CLK_SVS_HZ;
+
+	CAM_DBG(CAM_PERF, "[%s] icp_svs_clk = %lld", hw_mgr->hw_mgr_name, hw_mgr->icp_svs_clk);
+	return 0;
+}
+
+static int cam_icp_clk_info_init(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int i;
+	struct cam_icp_clk_info *clk_info;
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		clk_info = &hw_mgr->dev_info[i].clk_info;
+
+		clk_info->base_clk = hw_mgr->icp_svs_clk;
+		clk_info->curr_clk = hw_mgr->icp_svs_clk;
+		clk_info->threshold = ICP_OVER_CLK_THRESHOLD;
+		clk_info->over_clked = 0;
+		clk_info->uncompressed_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		clk_info->compressed_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		memset(clk_info->axi_path, 0,
+			CAM_ICP_MAX_PER_PATH_VOTES * sizeof(struct cam_cpas_axi_per_path_bw_vote));
+
+		clk_info->watch_dog_reset_counter = 0;
+	}
+
+	hw_mgr->icp_default_clk = hw_mgr->icp_svs_clk;
+
+	return 0;
+}
+
+static int cam_icp_ctx_timer_start(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+
+	rc = crm_timer_init(&ctx_data->watch_dog,
+		200, ctx_data, &cam_icp_ctx_timer_cb);
+	if (rc)
+		CAM_ERR(CAM_ICP, "%s: Failed to start timer", ctx_data->ctx_id_string);
+
+	ctx_data->watch_dog_reset_counter = 0;
+
+	CAM_DBG(CAM_PERF, "%s: start timer", ctx_data->ctx_id_string);
+	return rc;
+}
+
+static int cam_icp_device_timer_start(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0, i;
+	struct cam_icp_clk_info *clk_info = NULL;
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		clk_info = &hw_mgr->dev_info[i].clk_info;
+		if (!clk_info->watch_dog) {
+			clk_info->timeout_cb_data = hw_mgr;
+			rc = crm_timer_init(&clk_info->watch_dog,
+				ICP_DEVICE_IDLE_TIMEOUT, &hw_mgr->dev_info[i],
+					&cam_icp_device_timer_cb);
+			if (rc)
+				CAM_ERR(CAM_ICP, "[%s] Failed to start %s timer",
+					hw_mgr->hw_mgr_name, hw_mgr->dev_info[i].dev_name);
+			clk_info->watch_dog_reset_counter = 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_icp_ctx_timer_stop(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	if (ctx_data->watch_dog) {
+		CAM_DBG(CAM_PERF, "%s: stop timer", ctx_data->ctx_id_string);
+		ctx_data->watch_dog_reset_counter = 0;
+		crm_timer_exit(&ctx_data->watch_dog);
+		ctx_data->watch_dog = NULL;
+	}
+
+	return 0;
+}
+
+static void cam_icp_device_timer_stop(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_icp_hw_device_info *dev_info = NULL;
+	struct cam_icp_clk_info *clk_info = NULL;
+	int i;
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		dev_info = &hw_mgr->dev_info[i];
+		clk_info = &dev_info->clk_info;
+		if (!dev_info->dev_ctx_info.dev_ctxt_cnt && clk_info->watch_dog) {
+			clk_info->watch_dog_reset_counter = 0;
+			crm_timer_exit(&clk_info->watch_dog);
+			clk_info->watch_dog = NULL;
+		}
+	}
+}
+
+static uint32_t cam_icp_mgr_calc_base_clk(uint32_t frame_cycles,
+	uint64_t budget)
+{
+	uint64_t base_clk;
+	uint64_t mul = 1000000000;
+
+	base_clk = frame_cycles * mul;
+	do_div(base_clk, budget);
+
+	CAM_DBG(CAM_PERF, "budget = %lld fc = %d ib = %lld base_clk = %lld",
+		budget, frame_cycles,
+		(long long)(frame_cycles * mul), base_clk);
+
+	return base_clk;
+}
+
+static bool cam_icp_busy_prev_reqs(struct hfi_frame_process_info *frm_process,
+	uint64_t req_id)
+{
+	int i;
+	int cnt;
+
+	for (i = 0, cnt = 0; i < CAM_FRAME_CMD_MAX; i++) {
+		if (frm_process->request_id[i] && frm_process->fw_process_flag[i]) {
+			CAM_DBG(CAM_PERF, "r id = %lld busy = %d",
+				frm_process->request_id[i],
+				frm_process->fw_process_flag[i]);
+			cnt++;
+		}
+	}
+	if (cnt > 1)
+		return true;
+
+	return false;
+}
+
+static int cam_icp_calc_total_clk(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_clk_info *dev_clk_info, enum cam_icp_hw_type hw_dev_type)
+{
+	int i;
+	struct cam_icp_hw_ctx_data *ctx_data;
+
+	dev_clk_info->base_clk = 0;
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx_data[i];
+		if (ctx_data->state == CAM_ICP_CTX_STATE_ACQUIRED &&
+			(ctx_data->device_info->hw_dev_type == hw_dev_type))
+			dev_clk_info->base_clk += ctx_data->clk_info.base_clk;
+	}
+
+	return 0;
+}
+
+static bool cam_icp_update_clk_busy(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *dev_clk_info,
+	struct cam_icp_clk_bw_request *request_clk_info,
+	uint32_t base_clk)
+{
+	uint32_t next_clk_level;
+	uint32_t actual_clk;
+	bool rc = false;
+
+	/* 1. if current request frame cycles(fc) are more than previous
+	 *      frame fc
+	 *      Calculate the new base clock.
+	 *      if sum of base clocks are more than next available clk level
+	 *       Update clock rate, change curr_clk_rate to sum of base clock
+	 *       rates and make over_clked to zero
+	 *      else
+	 *       Update clock rate to next level, update curr_clk_rate and make
+	 *       overclked cnt to zero
+	 * 2. if current fc is less than or equal to previous  frame fc
+	 *      Still Bump up the clock to next available level
+	 *      if it is available, then update clock, make overclk cnt to
+	 *      zero. If the clock is already at highest clock rate then
+	 *      no need to update the clock
+	 */
+	ctx_data->clk_info.base_clk = base_clk;
+	dev_clk_info->over_clked = 0;
+	if (request_clk_info->frame_cycles > ctx_data->clk_info.curr_fc) {
+		cam_icp_calc_total_clk(hw_mgr, dev_clk_info,
+			ctx_data->device_info->hw_dev_type);
+		actual_clk = cam_icp_get_actual_clk_rate(hw_mgr,
+			ctx_data, base_clk);
+		if (dev_clk_info->base_clk > actual_clk) {
+			dev_clk_info->curr_clk = dev_clk_info->base_clk;
+		} else {
+			next_clk_level = cam_icp_get_next_clk_rate(hw_mgr,
+				ctx_data, dev_clk_info->curr_clk);
+			dev_clk_info->curr_clk = next_clk_level;
+		}
+		rc = true;
+	} else {
+		next_clk_level =
+			cam_icp_get_next_clk_rate(hw_mgr, ctx_data,
+			dev_clk_info->curr_clk);
+		if (dev_clk_info->curr_clk < next_clk_level) {
+			dev_clk_info->curr_clk = next_clk_level;
+			rc = true;
+		}
+	}
+	ctx_data->clk_info.curr_fc = request_clk_info->frame_cycles;
+
+	return rc;
+}
+
+static bool cam_icp_update_clk_overclk_free(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, struct cam_icp_clk_info *dev_clk_info,
+	struct cam_icp_clk_bw_request *request_clk_info, uint32_t base_clk)
+{
+	int rc = false;
+
+	/*
+	 * In caseof no pending packets case
+	 *    1. In caseof overclk cnt is less than threshold, increase
+	 *       overclk count and no update in the clock rate
+	 *    2. In caseof overclk cnt is greater than or equal to threshold
+	 *       then lower clock rate by one level and update hw_mgr current
+	 *       clock value.
+	 *        a. In case of new clock rate greater than sum of clock
+	 *           rates, reset overclk count value to zero if it is
+	 *           overclock
+	 *        b. if it is less than sum of base clocks then go to next
+	 *           level of clock and make overclk count to zero
+	 *        c. if it is same as sum of base clock rates update overclock
+	 *           cnt to 0
+	 */
+	if (dev_clk_info->over_clked < dev_clk_info->threshold) {
+		dev_clk_info->over_clked++;
+		rc = false;
+	} else {
+		dev_clk_info->curr_clk =
+			cam_icp_get_lower_clk_rate(hw_mgr, ctx_data,
+			dev_clk_info->curr_clk);
+		if (dev_clk_info->curr_clk > dev_clk_info->base_clk) {
+			if (cam_icp_is_over_clk(hw_mgr, ctx_data,
+				dev_clk_info))
+				dev_clk_info->over_clked = 0;
+		} else if (dev_clk_info->curr_clk <
+			dev_clk_info->base_clk) {
+			dev_clk_info->curr_clk =
+				cam_icp_get_next_clk_rate(hw_mgr, ctx_data,
+				dev_clk_info->curr_clk);
+				dev_clk_info->over_clked = 0;
+		} else if (dev_clk_info->curr_clk ==
+			dev_clk_info->base_clk) {
+			dev_clk_info->over_clked = 0;
+		}
+		rc = true;
+	}
+
+	return rc;
+}
+
+static bool cam_icp_update_clk_free(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info,
+	struct cam_icp_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	int rc = false;
+	bool over_clocked = false;
+
+	ctx_data->clk_info.curr_fc = clk_info->frame_cycles;
+	ctx_data->clk_info.base_clk = base_clk;
+	cam_icp_calc_total_clk(hw_mgr, hw_mgr_clk_info, ctx_data->device_info->hw_dev_type);
+
+	/*
+	 * Current clock is not always sum of base clocks, due to
+	 * clock scales update to next higher or lower levels, it
+	 * equals to one of discrete clock values supported by hardware.
+	 * So even current clock is higher than sum of base clocks, we
+	 * can not consider it is over clocked. if it is greater than
+	 * discrete clock level then only it is considered as over clock.
+	 * 1. Handle over clock case
+	 * 2. If current clock is less than sum of base clocks
+	 *    update current clock
+	 * 3. If current clock is same as sum of base clocks no action
+	 */
+
+	over_clocked = cam_icp_is_over_clk(hw_mgr, ctx_data,
+		hw_mgr_clk_info);
+
+	if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk &&
+		over_clocked) {
+		rc = cam_icp_update_clk_overclk_free(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+	} else if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->over_clked = 0;
+		rc = false;
+	}  else if (hw_mgr_clk_info->curr_clk < hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->curr_clk = cam_icp_get_actual_clk_rate(hw_mgr,
+			ctx_data, hw_mgr_clk_info->base_clk);
+		rc = true;
+	}
+
+	return rc;
+}
+
+static bool cam_icp_debug_clk_update(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_clk_info *hw_mgr_clk_info)
+{
+	if (hw_mgr->icp_debug_clk &&
+		hw_mgr->icp_debug_clk != hw_mgr_clk_info->curr_clk) {
+		hw_mgr_clk_info->base_clk = hw_mgr->icp_debug_clk;
+		hw_mgr_clk_info->curr_clk = hw_mgr->icp_debug_clk;
+		hw_mgr_clk_info->uncompressed_bw = hw_mgr->icp_debug_clk;
+		hw_mgr_clk_info->compressed_bw = hw_mgr->icp_debug_clk;
+		CAM_DBG(CAM_PERF, "[%s] bc = %d cc = %d",
+			hw_mgr->hw_mgr_name, hw_mgr_clk_info->base_clk,
+			hw_mgr_clk_info->curr_clk);
+		return true;
+	}
+
+	return false;
+}
+
+static bool cam_icp_default_clk_update(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_clk_info *hw_mgr_clk_info)
+{
+	if (hw_mgr->icp_default_clk != hw_mgr_clk_info->curr_clk) {
+		hw_mgr_clk_info->base_clk = hw_mgr->icp_default_clk;
+		hw_mgr_clk_info->curr_clk = hw_mgr->icp_default_clk;
+		hw_mgr_clk_info->uncompressed_bw = hw_mgr->icp_default_clk;
+		hw_mgr_clk_info->compressed_bw = hw_mgr->icp_default_clk;
+		CAM_DBG(CAM_PERF, "[%s] bc = %d cc = %d",
+			hw_mgr->hw_mgr_name, hw_mgr_clk_info->base_clk,
+			hw_mgr_clk_info->curr_clk);
+		return true;
+	}
+
+	return false;
+}
+
+static bool cam_icp_update_bw_v2(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info,
+	struct cam_icp_clk_bw_req_internal_v2 *clk_info,
+	bool busy)
+{
+	int i, path_index;
+	bool update_required = true;
+
+	/*
+	 * If current request bandwidth is different from previous frames, then
+	 * recalculate bandwidth of all contexts of same hardware and update
+	 * voting of bandwidth
+	 */
+
+	for (i = 0; i < clk_info->num_paths; i++)
+		CAM_DBG(CAM_PERF, "%s: clk_info camnoc = %lld busy = %d",
+			ctx_data->ctx_id_string, clk_info->axi_path[i].camnoc_bw, busy);
+
+	if (clk_info->num_paths == ctx_data->clk_info.num_paths) {
+		update_required = false;
+		for (i = 0; i < clk_info->num_paths; i++) {
+			if ((clk_info->axi_path[i].transac_type ==
+				ctx_data->clk_info.axi_path[i].transac_type) &&
+				(clk_info->axi_path[i].path_data_type ==
+				ctx_data->clk_info.axi_path[i].path_data_type) &&
+				(clk_info->axi_path[i].camnoc_bw ==
+				ctx_data->clk_info.axi_path[i].camnoc_bw) &&
+				(clk_info->axi_path[i].mnoc_ab_bw ==
+				ctx_data->clk_info.axi_path[i].mnoc_ab_bw)) {
+				continue;
+			} else {
+				update_required = true;
+				break;
+			}
+		}
+	}
+
+	if (!update_required) {
+		CAM_DBG(CAM_PERF,
+			"%s: Incoming BW hasn't changed, no update required, num_paths=%d",
+			ctx_data->ctx_id_string, clk_info->num_paths);
+		return false;
+	}
+
+	if (busy) {
+		for (i = 0; i < clk_info->num_paths; i++) {
+			if (ctx_data->clk_info.axi_path[i].camnoc_bw >
+				clk_info->axi_path[i].camnoc_bw)
+				return false;
+		}
+	}
+
+	/*
+	 * Remove previous vote of this context from hw mgr first.
+	 * hw_mgr_clk_info has all valid paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+
+		path_index = cam_icp_get_axi_path_index(&ctx_data->clk_info.axi_path[i],
+			ctx_data->device_info->hw_dev_type);
+
+		if (cam_icp_validate_bw_path_idx(path_index,
+			ctx_data->clk_info.axi_path[i].path_data_type))
+			continue;
+
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw -=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+	}
+
+	ctx_data->clk_info.num_paths = clk_info->num_paths;
+
+	memcpy(&ctx_data->clk_info.axi_path[0],
+		&clk_info->axi_path[0],
+		clk_info->num_paths * sizeof(struct cam_cpas_axi_per_path_bw_vote));
+
+	/*
+	 * Add new vote of this context in hw mgr.
+	 * hw_mgr_clk_info has all paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index = cam_icp_get_axi_path_index(&ctx_data->clk_info.axi_path[i],
+			ctx_data->device_info->hw_dev_type);
+
+		if (cam_icp_validate_bw_path_idx(path_index,
+			ctx_data->clk_info.axi_path[i].path_data_type))
+			continue;
+
+		hw_mgr_clk_info->axi_path[path_index].path_data_type =
+			ctx_data->clk_info.axi_path[i].path_data_type;
+		hw_mgr_clk_info->axi_path[path_index].transac_type =
+			ctx_data->clk_info.axi_path[i].transac_type;
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw +=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		CAM_DBG(CAM_PERF,
+			"%s: Consolidate Path Vote: i[%d] path_idx[%d] : [%s %s] [%lld %lld]",
+			ctx_data->ctx_id_string,
+			i, path_index,
+			cam_cpas_axi_util_trans_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].transac_type),
+			cam_cpas_axi_util_path_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].path_data_type),
+			hw_mgr_clk_info->axi_path[path_index].camnoc_bw,
+			hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw);
+	}
+
+	ctx_data->clk_info.bw_included = true;
+
+	if (hw_mgr_clk_info->num_paths < ctx_data->clk_info.num_paths)
+		hw_mgr_clk_info->num_paths = ctx_data->clk_info.num_paths;
+
+	return true;
+}
+
+static bool cam_icp_update_bw(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info,
+	struct cam_icp_clk_bw_request *clk_info,
+	bool busy)
+{
+	int i;
+	struct cam_icp_hw_ctx_data *ctx;
+
+	/*
+	 * If current request bandwidth is different from previous frames, then
+	 * recalculate bandwidth of all contexts of same hardware and update
+	 * voting of bandwidth
+	 */
+	CAM_DBG(CAM_PERF, "%s: ubw ctx = %lld clk_info ubw = %lld busy = %d",
+		ctx_data->ctx_id_string, ctx_data->clk_info.uncompressed_bw,
+		clk_info->uncompressed_bw, busy);
+
+	if ((clk_info->uncompressed_bw == ctx_data->clk_info.uncompressed_bw) &&
+		(ctx_data->clk_info.uncompressed_bw ==
+		hw_mgr_clk_info->uncompressed_bw)) {
+		CAM_DBG(CAM_PERF, "%s: Update not required bw=%lld",
+			ctx_data->ctx_id_string, ctx_data->clk_info.uncompressed_bw);
+		return false;
+	}
+
+	if (busy &&
+		(ctx_data->clk_info.uncompressed_bw >
+		clk_info->uncompressed_bw)) {
+		CAM_DBG(CAM_PERF,
+			"%s: Busy, Update not required existing=%lld, new=%lld",
+			ctx_data->ctx_id_string,
+			ctx_data->clk_info.uncompressed_bw,
+			clk_info->uncompressed_bw);
+		return false;
+	}
+
+	ctx_data->clk_info.uncompressed_bw = clk_info->uncompressed_bw;
+	ctx_data->clk_info.compressed_bw = clk_info->compressed_bw;
+	hw_mgr_clk_info->uncompressed_bw = 0;
+	hw_mgr_clk_info->compressed_bw = 0;
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		ctx = &hw_mgr->ctx_data[i];
+		if (ctx->state == CAM_ICP_CTX_STATE_ACQUIRED &&
+			(ctx_data->device_info->hw_dev_type == ctx->device_info->hw_dev_type)) {
+			hw_mgr_clk_info->uncompressed_bw +=
+				ctx->clk_info.uncompressed_bw;
+			hw_mgr_clk_info->compressed_bw +=
+				ctx->clk_info.compressed_bw;
+			CAM_DBG(CAM_PERF,
+				"%s: Current context=[%lld %lld] Total=[%lld %lld]",
+				ctx_data->ctx_id_string,
+				ctx->clk_info.uncompressed_bw,
+				ctx->clk_info.compressed_bw,
+				hw_mgr_clk_info->uncompressed_bw,
+				hw_mgr_clk_info->compressed_bw);
+		}
+	}
+
+	ctx_data->clk_info.bw_included = true;
+
+	return true;
+}
+
+static bool cam_icp_check_clk_update(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, int idx)
+{
+	bool busy, rc = false;
+	uint32_t base_clk;
+	struct cam_icp_clk_bw_request *request_clk_info;
+	struct hfi_frame_process_info *frame_info;
+	uint64_t req_id;
+	struct cam_icp_hw_device_info *dev_info = ctx_data->device_info;
+	struct cam_icp_clk_info *dev_clk_info;
+
+	cam_icp_ctx_timer_reset(ctx_data);
+	cam_icp_device_timer_reset(hw_mgr, dev_info);
+	CAM_DBG(CAM_ICP, "Reset %s device timer", dev_info->dev_name);
+
+	dev_clk_info = &dev_info->clk_info;
+
+	if (hw_mgr->icp_debug_clk)
+		return cam_icp_debug_clk_update(hw_mgr, dev_clk_info);
+
+	/* Check is there any pending frames in this context */
+	frame_info = &ctx_data->hfi_frame_process;
+	req_id = frame_info->request_id[idx];
+	busy = cam_icp_busy_prev_reqs(frame_info, req_id);
+	CAM_DBG(CAM_PERF, "%s: busy = %d req_id = %lld",
+		ctx_data->ctx_id_string, busy, req_id);
+
+	request_clk_info = &ctx_data->hfi_frame_process.clk_info[idx];
+	if (!request_clk_info->frame_cycles)
+		return cam_icp_default_clk_update(hw_mgr, dev_clk_info);
+
+	ctx_data->clk_info.rt_flag = request_clk_info->rt_flag;
+
+	/* Override base clock to max or calculate base clk rate */
+	if (!ctx_data->clk_info.rt_flag &&
+		(dev_info->hw_dev_type != CAM_ICP_DEV_BPS))
+		base_clk = ctx_data->clk_info.clk_rate[CAM_MAX_VOTE-1];
+	else
+		base_clk = cam_icp_mgr_calc_base_clk(request_clk_info->frame_cycles,
+			request_clk_info->budget_ns);
+
+	if (busy)
+		rc = cam_icp_update_clk_busy(hw_mgr, ctx_data,
+			dev_clk_info, request_clk_info, base_clk);
+	else
+		rc = cam_icp_update_clk_free(hw_mgr, ctx_data,
+			dev_clk_info, request_clk_info, base_clk);
+
+	CAM_DBG(CAM_PERF, "%s: bc = %d cc = %d busy = %d overclk = %d uc = %d",
+		ctx_data->ctx_id_string, dev_clk_info->base_clk, dev_clk_info->curr_clk,
+		busy, dev_clk_info->over_clked, rc);
+
+	return rc;
+}
+
+static bool cam_icp_check_bw_update(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, int idx)
+{
+	bool busy, bw_updated = false;
+	int i;
+	struct cam_icp_clk_bw_request *request_clk_info;
+	struct cam_icp_clk_bw_req_internal_v2 *request_clk_info_v2;
+	struct cam_icp_clk_info *dev_clk_info;
+	struct hfi_frame_process_info *frame_info;
+	uint64_t req_id;
+
+	dev_clk_info = &ctx_data->device_info->clk_info;
+	frame_info = &ctx_data->hfi_frame_process;
+	req_id = frame_info->request_id[idx];
+	busy = cam_icp_busy_prev_reqs(frame_info, req_id);
+
+	if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_V1) {
+		request_clk_info = &ctx_data->hfi_frame_process.clk_info[idx];
+
+		CAM_DBG(CAM_PERF, "%s: Req[%lld] Current camno=%lld, mnoc=%lld",
+			ctx_data->ctx_id_string, req_id, dev_clk_info->uncompressed_bw,
+			dev_clk_info->compressed_bw);
+
+		bw_updated = cam_icp_update_bw(hw_mgr, ctx_data,
+			dev_clk_info, request_clk_info, busy);
+	} else if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_V2) {
+		request_clk_info_v2 = &ctx_data->hfi_frame_process.clk_info_v2[idx];
+
+		CAM_DBG(CAM_PERF, "%s: index=%d, num_paths=%d, ctx_data=%pK",
+			ctx_data->ctx_id_string, idx, request_clk_info_v2->num_paths, ctx_data);
+
+		bw_updated = cam_icp_update_bw_v2(hw_mgr, ctx_data,
+			dev_clk_info, request_clk_info_v2, busy);
+
+		for (i = 0; i < dev_clk_info->num_paths; i++) {
+			CAM_DBG(CAM_PERF,
+				"%s: Final path_type: %s, transac_type: %s, camnoc_bw = %lld mnoc_ab_bw = %lld, mnoc_ib_bw = %lld",
+				ctx_data->ctx_id_string,
+				cam_cpas_axi_util_path_type_to_string(
+				dev_clk_info->axi_path[i].path_data_type),
+				cam_cpas_axi_util_trans_type_to_string(
+				dev_clk_info->axi_path[i].transac_type),
+				dev_clk_info->axi_path[i].camnoc_bw,
+				dev_clk_info->axi_path[i].mnoc_ab_bw,
+				dev_clk_info->axi_path[i].mnoc_ib_bw);
+		}
+	} else {
+		CAM_ERR(CAM_PERF, "%s: Invalid bw config version: %d",
+			hw_mgr->hw_mgr_name, ctx_data->bw_config_version);
+		return false;
+	}
+
+	return bw_updated;
+}
+
+static int cam_icp_update_clk_rate(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	uint32_t i, curr_clk_rate;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_icp_clk_info *dev_clk_info = NULL;
+	struct cam_icp_dev_clk_update_cmd clk_upd_cmd;
+	char tmp_buff[64];
+
+	dev_clk_info = &ctx_data->device_info->clk_info;
+	scnprintf(tmp_buff, sizeof(tmp_buff), "%s Before clk update rate=%u",
+		ctx_data->ctx_id_string,
+		dev_clk_info->prev_clk);
+	cam_cpas_notify_event(tmp_buff, dev_clk_info->prev_clk);
+
+	curr_clk_rate = dev_clk_info->curr_clk;
+	dev_clk_info->prev_clk = curr_clk_rate;
+	scnprintf(tmp_buff, sizeof(tmp_buff), "%s After clk update rate=%u",
+		ctx_data->ctx_id_string,
+		curr_clk_rate);
+	cam_cpas_notify_event(tmp_buff, curr_clk_rate);
+
+	CAM_DBG(CAM_PERF, "%s: clk_rate %u",
+		ctx_data->ctx_id_string, curr_clk_rate);
+
+	clk_upd_cmd.curr_clk_rate = curr_clk_rate;
+	clk_upd_cmd.dev_pc_enable = hw_mgr->dev_pc_flag;
+	clk_upd_cmd.clk_level = -1;
+
+	for (i = 0; i < ctx_data->device_info->hw_dev_cnt; i++) {
+		dev_intf = ctx_data->device_info->dev_intf[i];
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "Device intf for %s[%u] is NULL",
+				ctx_data->device_info->dev_name, i);
+			return -EINVAL;
+		}
+		dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, CAM_ICP_DEV_CMD_UPDATE_CLK,
+			&clk_upd_cmd, sizeof(clk_upd_cmd));
+	}
+
+	/* Scale ICP clock to IPE clk rate or OFE clk rate */
+	if (ctx_data->device_info->hw_dev_type != CAM_ICP_DEV_BPS) {
+		/* update ICP Proc clock */
+		CAM_DBG(CAM_PERF, "%s: Update ICP clk to level [%d]",
+			ctx_data->ctx_id_string, clk_upd_cmd.clk_level);
+		dev_intf = hw_mgr->icp_dev_intf;
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "Device interface is NULL");
+			return -EINVAL;
+		}
+		dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, CAM_ICP_CMD_CLK_UPDATE,
+			&clk_upd_cmd.clk_level, sizeof(clk_upd_cmd.clk_level));
+	}
+
+	return 0;
+}
+
+static int cam_icp_update_cpas_vote(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0, i = 0, device_share_ratio;
+	uint64_t temp;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_icp_clk_info *dev_clk_info;
+	struct cam_icp_cpas_vote clk_update = {0};
+	enum cam_icp_hw_type hw_dev_type;
+
+	dev_clk_info = &ctx_data->device_info->clk_info;
+	hw_dev_type = ctx_data->device_info->hw_dev_type;
+
+	device_share_ratio = cam_icp_get_bw_device_share_ratio(hw_mgr,
+		ctx_data->device_info);
+	if (device_share_ratio < 0) {
+		CAM_ERR(CAM_ICP, "%s: Fail to get device share ratio",
+			ctx_data->ctx_id_string);
+		return -EINVAL;
+	}
+
+	clk_update.ahb_vote.type = CAM_VOTE_DYNAMIC;
+	clk_update.ahb_vote.vote.freq = 0;
+	clk_update.ahb_vote_valid = false;
+
+	if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_V1) {
+		clk_update.axi_vote.num_paths = 1;
+		if (hw_dev_type == CAM_ICP_DEV_BPS) {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_BPS_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_BPS_DEFAULT_AXI_TRANSAC;
+		} else if (hw_dev_type == CAM_ICP_DEV_IPE) {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_IPE_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_IPE_DEFAULT_AXI_TRANSAC;
+		} else {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_OFE_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_OFE_DEFAULT_AXI_TRANSAC;
+		}
+
+		temp = dev_clk_info->uncompressed_bw;
+		do_div(temp, device_share_ratio);
+		clk_update.axi_vote.axi_path[0].camnoc_bw = temp;
+
+		temp = dev_clk_info->compressed_bw;
+		do_div(temp, device_share_ratio);
+		clk_update.axi_vote.axi_path[0].mnoc_ab_bw = temp;
+		clk_update.axi_vote.axi_path[0].mnoc_ib_bw = temp;
+	} else {
+		clk_update.axi_vote.num_paths = dev_clk_info->num_paths;
+		memcpy(&clk_update.axi_vote.axi_path[0],
+			&dev_clk_info->axi_path[0],
+			clk_update.axi_vote.num_paths *
+			sizeof(struct cam_cpas_axi_per_path_bw_vote));
+
+		if (device_share_ratio > 1) {
+			for (i = 0; i < clk_update.axi_vote.num_paths; i++) {
+				do_div(
+				clk_update.axi_vote.axi_path[i].camnoc_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].mnoc_ab_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].mnoc_ib_bw,
+					device_share_ratio);
+			}
+		}
+	}
+
+	clk_update.axi_vote_valid = true;
+
+	/*
+	 * If two devices, vote half bandwidth each on both devices.
+	 * Total bw at mnoc - CPAS will take care of adding up.
+	 * camnoc clk calculate is more accurate this way.
+	 */
+
+	for (i = 0; i < ctx_data->device_info->hw_dev_cnt; i++) {
+		dev_intf = ctx_data->device_info->dev_intf[i];
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "Device intf for %s[%u] is NULL",
+				ctx_data->device_info->dev_name, i);
+			return -EINVAL;
+		}
+		rc = dev_intf->hw_ops.process_cmd(dev_intf->hw_priv,
+			CAM_ICP_DEV_CMD_VOTE_CPAS, &clk_update, sizeof(clk_update));
+		if (rc) {
+			CAM_ERR(CAM_PERF,
+				"%s: Failed in updating cpas vote for %s cell idx: %u, rc=%d",
+				ctx_data->ctx_id_string, ctx_data->device_info->dev_name, i, rc);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_dev_clk_update(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, int idx)
+{
+	int rc = 0;
+
+	if (cam_icp_check_clk_update(hw_mgr, ctx_data, idx))
+		rc = cam_icp_update_clk_rate(hw_mgr, ctx_data);
+
+	if (cam_icp_check_bw_update(hw_mgr, ctx_data, idx))
+		rc |= cam_icp_update_cpas_vote(hw_mgr, ctx_data);
+
+	return rc;
+}
+
+static inline int cam_icp_mgr_get_core_info_mask(enum cam_icp_hw_type hw_dev_type,
+	uint32_t dev_num, uint32_t *core_info_mask)
+{
+	if (dev_num > 2) {
+		CAM_ERR(CAM_ICP, "%u devices core info mask is not supported", dev_num);
+		return -EINVAL;
+	}
+
+	switch (hw_dev_type) {
+	case CAM_ICP_DEV_BPS:
+		*core_info_mask = ICP_PWR_CLP_BPS;
+		break;
+	case CAM_ICP_DEV_IPE:
+		*core_info_mask = ICP_PWR_CLP_IPE0;
+		if (dev_num > 1)
+			*core_info_mask |= ICP_PWR_CLP_IPE1;
+		break;
+	case CAM_ICP_DEV_OFE:
+		*core_info_mask = ICP_PWR_CLP_OFE;
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid hw device type: %u",
+			hw_dev_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_icp_mgr_device_resume(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct cam_icp_hw_device_info *dev_info = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct hfi_cmd_prop *dbg_prop = NULL;
+	uint32_t core_info_mask = 0, size;
+	int rc = 0, i;
+	enum cam_icp_hw_type hw_dev_type;
+
+	hw_dev_type = ctx_data->device_info->hw_dev_type;
+	dev_info = ctx_data->device_info;
+
+	if (dev_info->dev_ctx_info.dev_ctxt_cnt++)
+		goto end;
+
+	for (i = 0; i < dev_info->hw_dev_cnt; i++) {
+		dev_intf = dev_info->dev_intf[i];
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "Device intf for %s[%u] is NULL",
+				dev_info->dev_name, i);
+			rc = -EINVAL;
+			goto end;
+		}
+		if (!dev_info->dev_ctx_info.dev_clk_state) {
+			rc = dev_intf->hw_ops.init(dev_intf->hw_priv, NULL, 0);
+			if (rc) {
+				CAM_ERR(CAM_ICP, "Fail to resume device %s[%u]",
+					dev_info->dev_name, i);
+			}
+			dev_info->dev_ctx_info.dev_clk_state = true;
+		}
+		if (hw_mgr->dev_pc_flag) {
+			dev_intf->hw_ops.process_cmd(dev_intf->hw_priv,
+				CAM_ICP_DEV_CMD_POWER_RESUME, NULL, 0);
+		}
+	}
+
+	rc = cam_icp_mgr_get_core_info_mask(hw_dev_type, dev_info->hw_dev_cnt, &core_info_mask);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"%s Fail to get core info mask for hw dev: %s ctx id: %u rc:%d",
+			ctx_data->ctx_id_string, dev_info->dev_name, ctx_data->ctx_id, rc);
+	}
+
+	CAM_DBG(CAM_PERF, "%s core_info 0x%x",
+		ctx_data->ctx_id_string, core_info_mask);
+
+	size = sizeof(struct hfi_cmd_prop) + sizeof(struct hfi_dev_pc);
+	dbg_prop = kzalloc(size, GFP_KERNEL);
+	if (!dbg_prop) {
+		CAM_ERR(CAM_ICP, "%s Allocate command prop failed",
+			ctx_data->ctx_id_string);
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	dbg_prop->size = size;
+	dbg_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	dbg_prop->num_prop = 1;
+
+	switch (hw_dev_type) {
+	case CAM_ICP_DEV_IPE:
+		fallthrough;
+	case CAM_ICP_DEV_BPS:
+		dbg_prop->prop_data[0] = HFI_PROP_SYS_IPEBPS_PC;
+		break;
+	case CAM_ICP_DEV_OFE:
+		dbg_prop->prop_data[0] = HFI_PROP_SYS_OFE_PC;
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "%s Invalid hw dev type: %u",
+			ctx_data->ctx_id_string, hw_dev_type);
+		rc = -EINVAL;
+		goto free_dbg_prop;
+	}
+
+	dbg_prop->prop_data[1] = hw_mgr->dev_pc_flag;
+	dbg_prop->prop_data[2] = core_info_mask;
+
+	hfi_write_cmd(hw_mgr->hfi_handle, dbg_prop);
+
+free_dbg_prop:
+	kfree(dbg_prop);
+
+end:
+	return rc;
+}
+
+static int cam_icp_mgr_dev_power_collapse(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, int dev_type)
+{
+	int rc = 0, i;
+	struct cam_icp_hw_device_info *dev_info = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Invalid ctx data is NULL");
+		return -EINVAL;
+	}
+
+	dev_info = ctx_data->device_info;
+
+	CAM_DBG(CAM_PERF, "%s: device %s ctx cnt: %u",
+		ctx_data->ctx_id_string, dev_info->dev_name,
+		dev_info->dev_ctx_info.dev_ctxt_cnt);
+
+	if (--dev_info->dev_ctx_info.dev_ctxt_cnt)
+		goto end;
+
+	for (i = 0; i < dev_info->hw_dev_cnt; i++) {
+		dev_intf = dev_info->dev_intf[i];
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "%s Device intf for %s[%u] is NULL",
+				ctx_data->ctx_id_string, dev_info->dev_name, i);
+			return -EINVAL;
+		}
+		if (hw_mgr->dev_pc_flag && !atomic_read(&hw_mgr->recovery)) {
+			dev_intf->hw_ops.process_cmd(dev_intf->hw_priv,
+				CAM_ICP_DEV_CMD_POWER_COLLAPSE, NULL, 0);
+		}
+		if (dev_info->dev_ctx_info.dev_clk_state)
+			dev_intf->hw_ops.deinit(dev_intf->hw_priv, NULL, 0);
+	}
+
+	dev_info->dev_ctx_info.dev_clk_state = false;
+
+end:
+	return rc;
+}
+
+static int cam_icp_mgr_dev_get_gdsc_control(
+	struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0, i, j;
+	struct cam_hw_intf *dev_intf;
+
+	if (!hw_mgr->dev_pc_flag)
+		return rc;
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		for (j = 0; j < hw_mgr->dev_info[i].hw_dev_cnt; j++) {
+			if (!hw_mgr->dev_info[i].dev_ctx_info.dev_clk_state)
+				continue;
+
+			dev_intf = hw_mgr->dev_info[i].dev_intf[j];
+			if (!dev_intf) {
+				CAM_ERR(CAM_ICP, "Device intf for %s[%u] is NULL",
+					hw_mgr->dev_info[i].dev_name, j);
+				return -EINVAL;
+			}
+			rc = dev_intf->hw_ops.process_cmd(dev_intf->hw_priv,
+				CAM_ICP_DEV_CMD_POWER_COLLAPSE, NULL, 0);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_icp_set_dbg_default_clk(void *data, u64 val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	hw_mgr->icp_debug_clk = val;
+	return 0;
+}
+
+static int cam_icp_get_dbg_default_clk(void *data, u64 *val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	*val = hw_mgr->icp_debug_clk;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_icp_debug_default_clk,
+	cam_icp_get_dbg_default_clk,
+	cam_icp_set_dbg_default_clk, "%16llu");
+
+static int cam_icp_set_icp_dbg_lvl(void *data, u64 val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	hw_mgr->icp_dbg_lvl = val;
+	return 0;
+}
+
+static int cam_icp_get_icp_dbg_lvl(void *data, u64 *val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	*val = hw_mgr->icp_dbg_lvl;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_icp_debug_fs, cam_icp_get_icp_dbg_lvl,
+	cam_icp_set_icp_dbg_lvl, "%08llu");
+
+static int cam_icp_set_icp_dbg_type(void *data, u64 val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	if (val <= NUM_HFI_DEBUG_MODE)
+		hw_mgr->icp_debug_type = val;
+
+	return 0;
+}
+
+static int cam_icp_get_icp_dbg_type(void *data, u64 *val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	*val = hw_mgr->icp_debug_type;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_icp_debug_type_fs, cam_icp_get_icp_dbg_type,
+	cam_icp_set_icp_dbg_type, "%08llu");
+
+static int cam_icp_set_icp_fw_hang_dump_lvl(void *data, u64 val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	if (val < NUM_HFI_DUMP_LVL)
+		hw_mgr->icp_fw_dump_lvl = val;
+
+	return 0;
+}
+
+static int cam_icp_get_icp_fw_hang_dump_lvl(void *data, u64 *val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	*val = hw_mgr->icp_fw_dump_lvl;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_icp_debug_fw_dump, cam_icp_get_icp_fw_hang_dump_lvl,
+	cam_icp_set_icp_fw_hang_dump_lvl, "%08llu");
+
+static int cam_icp_set_icp_fw_ramdump_lvl(void *data, u64 val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	if (val < NUM_HFI_RAMDUMP_LVLS)
+		hw_mgr->icp_fw_ramdump_lvl = (uint32_t)val;
+	return 0;
+}
+
+static int cam_icp_get_icp_fw_ramdump_lvl(void *data, u64 *val)
+{
+	struct cam_icp_hw_mgr *hw_mgr = data;
+
+	*val = hw_mgr->icp_fw_ramdump_lvl;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_icp_debug_fw_ramdump, cam_icp_get_icp_fw_ramdump_lvl,
+	cam_icp_set_icp_fw_ramdump_lvl, "%08llu");
+
+#ifdef CONFIG_CAM_TEST_ICP_FW_DOWNLOAD
+static ssize_t cam_icp_hw_mgr_fw_load_unload(
+	struct file *file, const char __user *ubuf,
+	size_t size, loff_t *loff_t)
+{
+	int rc = 0;
+	char input_buf[16];
+	struct cam_icp_hw_mgr *hw_mgr = file->private_data;
+
+	if (copy_from_user(input_buf, ubuf, sizeof(input_buf)))
+		return -EFAULT;
+
+	if (strcmp(input_buf, "load\n") == 0) {
+		rc = cam_mem_mgr_init();
+		if (rc) {
+			CAM_ERR(CAM_ICP, "[%s] memmgr init failed rc: %d",
+				hw_mgr->hw_mgr_name, rc);
+			goto end;
+		}
+		cam_icp_mgr_hw_open(hw_mgr, NULL);
+	} else if (strcmp(input_buf, "unload\n") == 0) {
+		cam_icp_mgr_hw_close(hw_mgr, NULL);
+		cam_mem_mgr_deinit();
+	} else {
+		CAM_WARN(CAM_ICP, "[%s] Invalid input: %s", hw_mgr->hw_mgr_name, input_buf);
+	}
+
+end:
+	return size;
+}
+
+static const struct file_operations cam_icp_hw_mgr_fw_load_options = {
+	.owner = THIS_MODULE,
+	.open  = simple_open,
+	.write = cam_icp_hw_mgr_fw_load_unload,
+};
+#endif
+
+#ifdef CONFIG_CAM_TEST_IRQ_LINE
+
+static int cam_icp_test_irq_line(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = -EINVAL;
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is NULL");
+		return -EINVAL;
+	}
+
+	if (icp_dev_intf->hw_ops.test_irq_line)
+		rc = icp_dev_intf->hw_ops.test_irq_line(icp_dev_intf->hw_priv);
+
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] failed to verify IRQ line", hw_mgr->hw_mgr_name);
+
+	return 0;
+}
+
+#else
+
+static int cam_icp_test_irq_line(struct cam_icp_hw_mgr *hw_mgr)
+{
+	CAM_ERR(CAM_ICP, "[%s] IRQ line verification disabled", hw_mgr->hw_mgr_name);
+	return -EPERM;
+}
+
+#endif
+
+#if (defined(CONFIG_CAM_TEST_IRQ_LINE) && defined(CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE))
+
+static int cam_icp_test_irq_line_at_probe(struct cam_icp_hw_mgr *hw_mgr)
+{
+	return cam_icp_test_irq_line(hw_mgr);
+}
+
+#else
+
+static int cam_icp_test_irq_line_at_probe(struct cam_icp_hw_mgr *hw_mgr)
+{
+	return 0;
+}
+
+#endif
+
+static int cam_icp_set_irq_line_test(void *data, u64 val)
+{
+	cam_icp_test_irq_line(data);
+	return 0;
+}
+
+static int cam_icp_get_irq_line_test(void *data, u64 *val)
+{
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_icp_irq_line_test, cam_icp_get_irq_line_test,
+	cam_icp_set_irq_line_test, "%08llu");
+
+static int cam_icp_hw_mgr_create_debugfs_entry(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir(hw_mgr->hw_mgr_name, &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] DebugFS could not create directory", hw_mgr->hw_mgr_name);
+		rc = -ENOENT;
+		goto end;
+	}
+
+	/* Store parent inode for cleanup in caller */
+	hw_mgr->dentry = dbgfileptr;
+
+	debugfs_create_bool("icp_pc", 0644, hw_mgr->dentry,
+		&hw_mgr->icp_pc_flag);
+
+	debugfs_create_bool("dev_interframe_pc", 0644, hw_mgr->dentry,
+		&hw_mgr->dev_pc_flag);
+
+	debugfs_create_file("icp_debug_clk", 0644,
+		hw_mgr->dentry, hw_mgr, &cam_icp_debug_default_clk);
+
+	debugfs_create_bool("icp_jtag_debug", 0644,
+		hw_mgr->dentry, &hw_mgr->icp_jtag_debug);
+
+	debugfs_create_file("icp_debug_type", 0644,
+		hw_mgr->dentry, hw_mgr, &cam_icp_debug_type_fs);
+
+	debugfs_create_file("icp_debug_lvl", 0644,
+		hw_mgr->dentry, hw_mgr, &cam_icp_debug_fs);
+
+	debugfs_create_file("icp_fw_dump_lvl", 0644,
+		hw_mgr->dentry, hw_mgr, &cam_icp_debug_fw_dump);
+
+	debugfs_create_file("icp_fw_ramdump_lvl", 0644,
+		hw_mgr->dentry, hw_mgr, &cam_icp_debug_fw_ramdump);
+
+	debugfs_create_bool("disable_ubwc_comp", 0644,
+		hw_mgr->dentry, &hw_mgr->disable_ubwc_comp);
+
+	#ifdef CONFIG_CAM_TEST_ICP_FW_DOWNLOAD
+		debugfs_create_file("icp_fw_load_unload", 0644,
+			hw_mgr->dentry, hw_mgr, &cam_icp_hw_mgr_fw_load_options);
+	#endif
+	debugfs_create_file("test_irq_line", 0644,
+		hw_mgr->dentry, hw_mgr, &cam_icp_irq_line_test);
+
+end:
+
+	/* Set default hang dump lvl */
+	hw_mgr->icp_fw_dump_lvl = HFI_FW_DUMP_ON_FAILURE;
+	hw_mgr->icp_fw_ramdump_lvl = HFI_FW_RAMDUMP_ENABLED;
+	return rc;
+}
+
+static int cam_icp_mgr_process_cmd(void *priv, void *data)
+{
+	int rc;
+	struct hfi_cmd_work_data *task_data = NULL;
+	struct cam_icp_hw_mgr *hw_mgr;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_ICP, "Invalid params%pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	hw_mgr = priv;
+	task_data = (struct hfi_cmd_work_data *)data;
+
+	rc = hfi_write_cmd(hw_mgr->hfi_handle, task_data->data);
+
+	return rc;
+}
+
+static int cam_icp_mgr_cleanup_ctx(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int i;
+	struct hfi_frame_process_info *hfi_frame_process;
+	struct cam_icp_hw_buf_done_evt_data icp_evt_data;
+	struct cam_hw_done_event_data buf_data = {0};
+
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++) {
+		if (!hfi_frame_process->request_id[i])
+			continue;
+		buf_data.request_id = hfi_frame_process->request_id[i];
+		icp_evt_data.evt_id = CAM_CTX_EVT_ID_SUCCESS;
+		icp_evt_data.buf_done_data = &buf_data;
+		ctx_data->ctxt_event_cb(ctx_data->context_priv,
+			CAM_ICP_EVT_ID_BUF_DONE, &icp_evt_data);
+		hfi_frame_process->request_id[i] = 0;
+		if (ctx_data->hfi_frame_process.in_resource[i] > 0) {
+			CAM_DBG(CAM_ICP, "%s: Delete merged sync in object: %d",
+				ctx_data->ctx_id_string,
+				ctx_data->hfi_frame_process.in_resource[i]);
+			cam_sync_destroy(
+				ctx_data->hfi_frame_process.in_resource[i]);
+			ctx_data->hfi_frame_process.in_resource[i] = 0;
+		}
+		hfi_frame_process->fw_process_flag[i] = false;
+		clear_bit(i, ctx_data->hfi_frame_process.bitmap);
+	}
+
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++) {
+		if (!hfi_frame_process->in_free_resource[i])
+			continue;
+
+		CAM_DBG(CAM_ICP, "%s: Delete merged sync in object: %d",
+			ctx_data->ctx_id_string,
+			ctx_data->hfi_frame_process.in_free_resource[i]);
+		cam_sync_destroy(
+			ctx_data->hfi_frame_process.in_free_resource[i]);
+		ctx_data->hfi_frame_process.in_free_resource[i] = 0;
+	}
+
+	ctx_data->abort_timed_out = false;
+	return 0;
+}
+
+static uint32_t cam_icp_handle_err_type_to_evt_param(uint32_t error_type)
+{
+	switch (error_type) {
+	case CAMERAICP_ENOMEMORY:
+		return CAM_SYNC_ICP_EVENT_NO_MEMORY;
+	case CAMERAICP_EFAILED:
+		return CAM_SYNC_ICP_EVENT_FRAME_PROCESS_FAILURE;
+	case CAMERAICP_EBADSTATE:
+		return CAM_SYNC_ICP_EVENT_BAD_STATE;
+	case CAMERAICP_EBADPARM:
+		return CAM_SYNC_ICP_EVENT_BAD_PARAM;
+	case CAMERAICP_EBADITEM:
+		return CAM_SYNC_ICP_EVENT_BAD_ITEM;
+	case CAMERAICP_EINVALIDFORMAT:
+		return CAM_SYNC_ICP_EVENT_INVALID_FORMAT;
+	case CAMERAICP_EUNSUPPORTED:
+		return CAM_SYNC_ICP_EVENT_UNSUPPORTED;
+	case CAMERAICP_EOUTOFBOUND:
+		return CAM_SYNC_ICP_EVENT_OUT_OF_BOUND;
+	case CAMERAICP_ETIMEDOUT:
+		return CAM_SYNC_ICP_EVENT_TIME_OUT;
+	case CAMERAICP_EABORTED:
+		return CAM_SYNC_ICP_EVENT_ABORTED;
+	case CAMERAICP_EHWVIOLATION:
+		return CAM_SYNC_ICP_EVENT_HW_VIOLATION;
+	case CAMERAICP_ECDMERROR:
+		return CAM_SYNC_ICP_EVENT_CMD_ERROR;
+	case CAMERAICP_HFI_ERR_COMMAND_SIZE:
+		return CAM_SYNC_ICP_EVENT_HFI_ERR_COMMAND_SIZE;
+	case CAMERAICP_HFI_ERR_MESSAGE_SIZE:
+		return CAM_SYNC_ICP_EVENT_HFI_ERR_MESSAGE_SIZE;
+	case CAMERAICP_HFI_QUEUE_EMPTY:
+		return CAM_SYNC_ICP_EVENT_HFI_ERR_QUEUE_EMPTY;
+	case CAMERAICP_HFI_QUEUE_FULL:
+		return CAM_SYNC_ICP_EVENT_HFI_ERR_QUEUE_FULL;
+	default:
+		return CAM_SYNC_ICP_EVENT_UNKNOWN;
+	}
+}
+
+static const char *cam_icp_error_handle_id_to_type(
+	uint32_t error_handle)
+{
+	const char *name = NULL;
+
+	switch (error_handle) {
+	case CAMERAICP_SUCCESS:
+		name = "SUCCESS";
+		break;
+	case CAMERAICP_EFAILED:
+		name = "EFAILED";
+		break;
+	case CAMERAICP_ENOMEMORY:
+		name = "ENOMEMORY";
+		break;
+	case CAMERAICP_EBADSTATE:
+		name = "EBADSTATE";
+		break;
+	case CAMERAICP_EBADPARM:
+		name = "EBADPARM";
+		break;
+	case CAMERAICP_EBADITEM:
+		name = "EBADITEM";
+		break;
+	case CAMERAICP_EINVALIDFORMAT:
+		name = "EINVALIDFORMAT";
+		break;
+	case CAMERAICP_EUNSUPPORTED:
+		name = "EUNSUPPORTED";
+		break;
+	case CAMERAICP_EOUTOFBOUND:
+		name = "EOUTOFBOUND";
+		break;
+	case CAMERAICP_ETIMEDOUT:
+		name = "ETIMEDOUT";
+		break;
+	case CAMERAICP_EABORTED:
+		name = "EABORTED";
+		break;
+	case CAMERAICP_EHWVIOLATION:
+		name = "EHWVIOLATION";
+		break;
+	case CAMERAICP_ECDMERROR:
+		name = "ECDMERROR";
+		break;
+	case CAMERAICP_HFI_ERR_COMMAND_SIZE:
+		name = "HFI_ERR_COMMAND_SIZE";
+		break;
+	case CAMERAICP_HFI_ERR_MESSAGE_SIZE:
+		name = "HFI_ERR_MESSAGE_SIZE";
+		break;
+	case CAMERAICP_HFI_QUEUE_EMPTY:
+		name = "HFI_QUEUE_EMPTY";
+		break;
+	case CAMERAICP_HFI_QUEUE_FULL:
+		name = "HFI_QUEUE_FULL";
+		break;
+	default:
+		name = NULL;
+		break;
+	}
+	return name;
+}
+
+static inline void cam_icp_mgr_apply_evt_injection(struct cam_hw_done_event_data *buf_done_data,
+	struct cam_icp_hw_ctx_data *ctx_data, bool *signal_fence_buffer)
+{
+	struct cam_hw_inject_evt_param *evt_params = &ctx_data->evt_inject_params;
+	struct cam_common_evt_inject_data inject_evt;
+
+	inject_evt.buf_done_data = buf_done_data;
+	inject_evt.evt_params = evt_params;
+
+	if (ctx_data->ctxt_event_cb)
+		ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_ICP_EVT_ID_INJECT_EVENT,
+			&inject_evt);
+
+	if (ctx_data->evt_inject_params.inject_id ==
+		CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE)
+		*signal_fence_buffer = false;
+
+	evt_params->is_valid = false;
+}
+
+static void cam_icp_mgr_dump_active_req_info(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	char log_info[256];
+	size_t buf_size, len;
+	uint32_t total_active_streams = 0, total_active_requests = 0;
+	int i, j;
+
+	buf_size = sizeof(log_info);
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx_data[i];
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (ctx_data->state != CAM_ICP_CTX_STATE_ACQUIRED) {
+			mutex_unlock(&ctx_data->ctx_mutex);
+			continue;
+		}
+
+		len = 0;
+		for (j = 0; j < CAM_FRAME_CMD_MAX; j++) {
+			if (!ctx_data->hfi_frame_process.request_id[j])
+				continue;
+
+			len += scnprintf(log_info + len, (buf_size - len), " %llu",
+				ctx_data->hfi_frame_process.request_id[j]);
+			total_active_requests++;
+		}
+		total_active_streams++;
+		CAM_INFO(CAM_ICP, "%s: Active Requests IDs: %s",
+			ctx_data->ctx_id_string, len ? log_info : " None");
+		mutex_unlock(&ctx_data->ctx_mutex);
+	}
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_INFO(CAM_ICP, "%s: Total Active streams: %u, Total active requests: %u",
+		hw_mgr->hw_mgr_name, total_active_streams, total_active_requests);
+}
+
+static void cam_icp_mgr_compute_fw_avg_response_time(struct cam_icp_hw_ctx_data *ctx_data,
+	uint32_t request_idx)
+{
+	struct cam_icp_ctx_perf_stats *perf_stats;
+	uint64_t delta;
+
+	delta = ktime_ms_delta(ktime_get(),
+		ctx_data->hfi_frame_process.submit_timestamp[request_idx]);
+
+	perf_stats = &ctx_data->perf_stats;
+	perf_stats->total_resp_time += delta;
+	perf_stats->total_requests++;
+
+	CAM_DBG(CAM_PERF,
+		"%s: Avg response time: current_req: %llu total_processed_requests: %llu avg_time: %llums",
+		ctx_data->ctx_id_string,
+		ctx_data->hfi_frame_process.request_id[request_idx], perf_stats->total_requests,
+		(perf_stats->total_resp_time / perf_stats->total_requests));
+}
+
+static int cam_icp_mgr_dump_clk(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	uint32_t i;
+	struct cam_hw_intf *dev_intf = NULL;
+
+	for (i = 0; i < ctx_data->device_info->hw_dev_cnt; i++) {
+		dev_intf = ctx_data->device_info->dev_intf[i];
+		if (!dev_intf) {
+			CAM_ERR(CAM_ICP, "Device intf for %s[%u] is NULL",
+				ctx_data->device_info->dev_name, i);
+			return -EINVAL;
+		}
+		dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, CAM_ICP_DEV_CMD_DUMP_CLK,
+				NULL, 0);
+	}
+
+	return 0;
+}
+
+static int cam_icp_mgr_handle_frame_process(uint32_t *msg_ptr, int flag)
+{
+	int i, rc;
+	uint32_t idx, event_id;
+	uint64_t request_id;
+	struct cam_icp_hw_mgr *hw_mgr = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct hfi_msg_dev_async_ack *ioconfig_ack = NULL;
+	struct hfi_frame_process_info *hfi_frame_process;
+	struct cam_hw_done_event_data buf_data = {0};
+	struct cam_icp_hw_buf_done_evt_data icp_done_evt;
+	struct cam_icp_hw_error_evt_data icp_err_evt = {0};
+	struct cam_hangdump_mem_regions *mem_regions = NULL;
+	bool signal_fence_buffer = true;
+
+	ioconfig_ack = (struct hfi_msg_dev_async_ack *)msg_ptr;
+	request_id = ioconfig_ack->user_data2;
+	ctx_data = (struct cam_icp_hw_ctx_data *)
+		U64_TO_PTR(ioconfig_ack->user_data1);
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Invalid Context req %llu", request_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	hw_mgr = ctx_data->hw_mgr_priv;
+	cam_icp_ctx_timer_reset(ctx_data);
+	if (ctx_data->state != CAM_ICP_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_ICP, "%s: is in %d state",
+			ctx_data->ctx_id_string, ctx_data->state);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return 0;
+	}
+
+	CAM_DBG(CAM_REQ,
+		"%s: request_id: %lld",
+		ctx_data->ctx_id_string, request_id);
+
+	cam_icp_device_timer_reset(hw_mgr, ctx_data->device_info);
+
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+
+	idx = cam_icp_get_frame_process_idx_from_req_id(ctx_data, request_id);
+	if (idx >= CAM_FRAME_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "%s: pkt not found for req_id =%lld",
+			ctx_data->ctx_id_string, request_id);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return -EINVAL;
+	}
+
+	cam_icp_mgr_compute_fw_avg_response_time(ctx_data, idx);
+
+	if (flag == ICP_FRAME_PROCESS_FAILURE) {
+		if (ioconfig_ack->err_type == CAMERAICP_EABORTED) {
+			CAM_WARN(CAM_ICP,
+				"%s: req %llu has been aborted[flushed]",
+				ctx_data->ctx_id_string, request_id);
+			event_id = CAM_CTX_EVT_ID_CANCEL;
+		} else {
+			CAM_ERR(CAM_ICP,
+				"%s: Done with error: %u err_type= [%s] for req %llu",
+				ctx_data->ctx_id_string, ioconfig_ack->err_type,
+				cam_icp_error_handle_id_to_type(ioconfig_ack->err_type),
+				request_id);
+			event_id = CAM_CTX_EVT_ID_ERROR;
+			rc = cam_icp_mgr_dump_clk(ctx_data);
+		}
+		buf_data.evt_param = cam_icp_handle_err_type_to_evt_param(ioconfig_ack->err_type);
+	} else {
+		event_id = CAM_CTX_EVT_ID_SUCCESS;
+	}
+
+	if (cam_presil_mode_enabled()) {
+		mem_regions = &hfi_frame_process->hangdump_mem_regions[idx];
+		CAM_INFO(CAM_ICP, "Hangdump Num Regions %d",
+			mem_regions->num_mem_regions);
+		for (i = 0; i < mem_regions->num_mem_regions; i++) {
+			CAM_INFO(CAM_PRESIL, "Hangdump Mem %d handle 0x%08x offset 0x%08x len %u",
+				i, mem_regions->mem_info_array[i].mem_handle,
+				mem_regions->mem_info_array[i].offset,
+				mem_regions->mem_info_array[i].size);
+			cam_mem_mgr_retrieve_buffer_from_presil(
+				mem_regions->mem_info_array[i].mem_handle,
+				mem_regions->mem_info_array[i].size,
+				mem_regions->mem_info_array[i].offset,
+				hw_mgr->iommu_hdl);
+		}
+	}
+
+	CAM_TRACE(CAM_ICP,
+		"%s: BufDone Req %llu event_id %d",
+		ctx_data->ctx_id_string, hfi_frame_process->request_id[idx], event_id);
+
+	buf_data.request_id = hfi_frame_process->request_id[idx];
+	if ((ctx_data->evt_inject_params.is_valid) &&
+		(ctx_data->evt_inject_params.req_id == request_id))
+		cam_icp_mgr_apply_evt_injection(&buf_data, ctx_data, &signal_fence_buffer);
+
+	if (signal_fence_buffer) {
+		icp_done_evt.evt_id = event_id;
+		icp_done_evt.buf_done_data = &buf_data;
+		if (ctx_data->ctxt_event_cb)
+			ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_ICP_EVT_ID_BUF_DONE,
+				&icp_done_evt);
+	}
+
+	hfi_frame_process->request_id[idx] = 0;
+	if (ctx_data->hfi_frame_process.in_resource[idx] > 0) {
+		CAM_DBG(CAM_ICP, "%s: Delete merged sync in object: %d",
+			ctx_data->ctx_id_string,
+			ctx_data->hfi_frame_process.in_resource[idx]);
+		cam_sync_destroy(ctx_data->hfi_frame_process.in_resource[idx]);
+		ctx_data->hfi_frame_process.in_resource[idx] = 0;
+	}
+	clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+	hfi_frame_process->fw_process_flag[idx] = false;
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	/* report recovery to userspace if FW encounters no memory */
+	if (ioconfig_ack->err_type == CAMERAICP_ENOMEMORY) {
+		cam_icp_mgr_dump_active_req_info(hw_mgr);
+
+		icp_err_evt.err_type = CAM_ICP_HW_ERROR_NO_MEM;
+		icp_err_evt.req_id = request_id;
+
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (ctx_data->ctxt_event_cb)
+			ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_ICP_EVT_ID_ERROR,
+				&icp_err_evt);
+		mutex_unlock(&ctx_data->ctx_mutex);
+	}
+
+	if (cam_presil_mode_enabled()) {
+		if (!atomic_read(&hw_mgr->frame_in_process)) {
+			CAM_ERR(CAM_PRESIL, "%s: presil: frame_in_process not set",
+				ctx_data->ctx_id_string);
+		} else {
+			hw_mgr->frame_in_process_ctx_id = -1;
+			atomic_set(&hw_mgr->frame_in_process, 0);
+			up_write(&frame_in_process_sem);
+			CAM_DBG(CAM_PRESIL, "%s: presil: unlocked frame_in_process",
+				ctx_data->ctx_id_string);
+		}
+	}
+
+	return 0;
+}
+
+static int cam_icp_mgr_process_msg_frame_process(uint32_t *msg_ptr)
+{
+	struct hfi_msg_dev_async_ack *ioconfig_ack = NULL;
+	struct hfi_msg_frame_process_done *frame_done;
+
+	if (!msg_ptr) {
+		CAM_ERR(CAM_ICP, "msg ptr is NULL");
+		return -EINVAL;
+	}
+
+	ioconfig_ack = (struct hfi_msg_dev_async_ack *)msg_ptr;
+	if (ioconfig_ack->err_type != CAMERAICP_SUCCESS) {
+		cam_icp_mgr_handle_frame_process(msg_ptr,
+			ICP_FRAME_PROCESS_FAILURE);
+		return -EIO;
+	}
+
+	frame_done =
+		(struct hfi_msg_frame_process_done *)ioconfig_ack->msg_data_flex;
+	if (!frame_done) {
+		cam_icp_mgr_handle_frame_process(msg_ptr,
+			ICP_FRAME_PROCESS_FAILURE);
+		return -EINVAL;
+	}
+
+	if (frame_done->result)
+		return cam_icp_mgr_handle_frame_process(msg_ptr,
+			ICP_FRAME_PROCESS_FAILURE);
+	else
+		return cam_icp_mgr_handle_frame_process(msg_ptr,
+			ICP_FRAME_PROCESS_SUCCESS);
+}
+
+static int cam_icp_mgr_process_msg_config_io(uint32_t *msg_ptr)
+{
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct hfi_msg_dev_async_ack *ioconfig_ack = NULL;
+
+	if (!msg_ptr) {
+		CAM_ERR(CAM_ICP, "msg ptr is NULL");
+		return -EINVAL;
+	}
+
+	ioconfig_ack = (struct hfi_msg_dev_async_ack *)msg_ptr;
+
+	if (ioconfig_ack->opcode == HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO) {
+		struct hfi_msg_ipe_config *ipe_config_ack = NULL;
+
+		ipe_config_ack =
+			(struct hfi_msg_ipe_config *)(ioconfig_ack->msg_data_flex);
+		if (ipe_config_ack->rc) {
+			CAM_ERR(CAM_ICP, "rc = %d failed with\n"
+				"err_no = [%u] err_type = [%s]",
+				ipe_config_ack->rc,
+				ioconfig_ack->err_type,
+				cam_icp_error_handle_id_to_type(
+				ioconfig_ack->err_type));
+
+			return -EIO;
+		}
+		ctx_data = (struct cam_icp_hw_ctx_data *)
+			U64_TO_PTR(ioconfig_ack->user_data1);
+		if (!ctx_data) {
+			CAM_ERR(CAM_ICP, "wrong ctx data from IPE config io response");
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ICP, "%s: received IPE config io response",
+			ctx_data->ctx_id_string);
+		ctx_data->scratch_mem_size = ipe_config_ack->scratch_mem_size;
+	} else if (ioconfig_ack->opcode == HFI_IPEBPS_CMD_OPCODE_BPS_CONFIG_IO) {
+		struct hfi_msg_bps_config *bps_config_ack = NULL;
+
+		bps_config_ack =
+			(struct hfi_msg_bps_config *)(ioconfig_ack->msg_data_flex);
+		if (bps_config_ack->rc) {
+			CAM_ERR(CAM_ICP, "rc : %u, opcode :%u",
+				bps_config_ack->rc, ioconfig_ack->opcode);
+			return -EIO;
+		}
+		ctx_data = (struct cam_icp_hw_ctx_data *)
+			U64_TO_PTR(ioconfig_ack->user_data1);
+		if (!ctx_data) {
+			CAM_ERR(CAM_ICP, "wrong ctx data from BPS config io response");
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ICP, "%s: received BPS config io response",
+			ctx_data->ctx_id_string);
+	} else {
+		CAM_ERR(CAM_ICP, "Invalid OPCODE: %u", ioconfig_ack->opcode);
+		return -EINVAL;
+	}
+
+	complete(&ctx_data->wait_complete);
+
+	return 0;
+}
+
+static int cam_icp_mgr_process_msg_create_handle(uint32_t *msg_ptr)
+{
+	struct hfi_msg_create_handle_ack *create_handle_ack = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	int rc = 0;
+
+	create_handle_ack = (struct hfi_msg_create_handle_ack *)msg_ptr;
+	if (!create_handle_ack) {
+		CAM_ERR(CAM_ICP, "Invalid create_handle_ack");
+		return -EINVAL;
+	}
+
+	ctx_data =
+		(struct cam_icp_hw_ctx_data *)(uintptr_t)
+		create_handle_ack->user_data1;
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Invalid ctx_data");
+		return -EINVAL;
+	}
+
+	if (ctx_data->state == CAM_ICP_CTX_STATE_IN_USE) {
+		ctx_data->fw_handle = create_handle_ack->fw_handle;
+		CAM_DBG(CAM_ICP, "%s: fw_handle = %x",
+			ctx_data->ctx_id_string, ctx_data->fw_handle);
+	} else {
+		CAM_WARN(CAM_ICP,
+			"%s: This ctx is no longer in use current state: %d",
+			ctx_data->ctx_id_string, ctx_data->state);
+		ctx_data->fw_handle = 0;
+		rc = -EPERM;
+	}
+	complete(&ctx_data->wait_complete);
+	return rc;
+}
+
+static int cam_icp_mgr_process_msg_ping_ack(uint32_t *msg_ptr)
+{
+	struct hfi_msg_ping_ack *ping_ack = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+
+	ping_ack = (struct hfi_msg_ping_ack *)msg_ptr;
+	if (!ping_ack) {
+		CAM_ERR(CAM_ICP, "Empty ping ack message");
+		return -EINVAL;
+	}
+
+	ctx_data = (struct cam_icp_hw_ctx_data *)
+		U64_TO_PTR(ping_ack->user_data);
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Invalid ctx_data");
+		return -EINVAL;
+	}
+
+	if (ctx_data->state == CAM_ICP_CTX_STATE_IN_USE)
+		complete(&ctx_data->wait_complete);
+
+	return 0;
+}
+
+static int cam_icp_mgr_process_ipebps_indirect_ack_msg(uint32_t *msg_ptr)
+{
+	int rc = 0;
+
+	switch (msg_ptr[ICP_PACKET_OPCODE]) {
+	case HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO:
+	case HFI_IPEBPS_CMD_OPCODE_BPS_CONFIG_IO:
+		CAM_DBG(CAM_ICP, "received IPE/BPS_CONFIG_IO:");
+		rc = cam_icp_mgr_process_msg_config_io(msg_ptr);
+		if (rc)
+			return rc;
+		break;
+	case HFI_IPEBPS_CMD_OPCODE_IPE_FRAME_PROCESS:
+	case HFI_IPEBPS_CMD_OPCODE_BPS_FRAME_PROCESS:
+		CAM_DBG(CAM_ICP, "received IPE/BPS_FRAME_PROCESS:");
+		rc = cam_icp_mgr_process_msg_frame_process(msg_ptr);
+		if (rc)
+			return rc;
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid opcode : %u",
+			msg_ptr[ICP_PACKET_OPCODE]);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_process_ofe_indirect_ack_msg(uint32_t *msg_ptr)
+{
+	int rc = 0;
+
+	switch (msg_ptr[ICP_PACKET_OPCODE]) {
+	case HFI_OFE_CMD_OPCODE_CONFIG_IO: {
+		struct hfi_msg_dev_async_ack *ioconfig_ack =
+			(struct hfi_msg_dev_async_ack *)msg_ptr;
+		struct hfi_msg_ofe_config *ofe_config_ack =
+			(struct hfi_msg_ofe_config *)(ioconfig_ack->msg_data);
+		struct cam_icp_hw_ctx_data *ctx_data = NULL;
+
+		if (ofe_config_ack->rc) {
+			CAM_ERR(CAM_ICP, "rc : %u, error type: %u error: [%s] opcode :%u",
+				ofe_config_ack->rc, ioconfig_ack->err_type,
+				cam_icp_error_handle_id_to_type(ioconfig_ack->err_type),
+				ioconfig_ack->opcode);
+			return -EIO;
+		}
+		ctx_data = (struct cam_icp_hw_ctx_data *)
+			U64_TO_PTR(ioconfig_ack->user_data1);
+		if (!ctx_data) {
+			CAM_ERR(CAM_ICP, "wrong ctx data from OFE config io response");
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ICP, "%s: received OFE config io response",
+			ctx_data->ctx_id_string);
+
+		complete(&ctx_data->wait_complete);
+		break;
+	}
+	case HFI_OFE_CMD_OPCODE_FRAME_PROCESS:
+		CAM_DBG(CAM_ICP, "received OFE_FRAME_PROCESS:");
+		rc = cam_icp_mgr_process_msg_frame_process(msg_ptr);
+		if (rc)
+			return rc;
+		break;
+	case HFI_OFE_CMD_OPCODE_ABORT: {
+		struct hfi_msg_dev_async_ack *ioconfig_ack = NULL;
+		struct cam_icp_hw_ctx_data *ctx_data = NULL;
+		struct cam_icp_hw_mgr *hw_mgr;
+
+		ioconfig_ack = (struct hfi_msg_dev_async_ack *)msg_ptr;
+		ctx_data = U64_TO_PTR(ioconfig_ack->user_data1);
+		if (cam_presil_mode_enabled()) {
+			hw_mgr = ctx_data->hw_mgr_priv;
+			if (atomic_read(&hw_mgr->frame_in_process)) {
+				if (hw_mgr->frame_in_process_ctx_id == ctx_data->ctx_id) {
+					CAM_DBG(CAM_PRESIL, "presil: frame process abort ctx %d",
+						hw_mgr->frame_in_process_ctx_id);
+						hw_mgr->frame_in_process_ctx_id = -1;
+					atomic_set(&hw_mgr->frame_in_process, 0);
+					up_write(&frame_in_process_sem);
+				} else {
+					CAM_WARN(CAM_PRESIL, "presil: abort mismatch %d %d",
+						hw_mgr->frame_in_process_ctx_id,
+						ctx_data->ctx_id);
+				}
+			}
+		}
+		if (ctx_data->state != CAM_ICP_CTX_STATE_FREE)
+			complete(&ctx_data->wait_complete);
+
+		CAM_DBG(CAM_ICP, "received OFE Abort done msg ctx_state: %u",
+			ctx_data->state);
+		break;
+	}
+	case HFI_OFE_CMD_OPCODE_DESTROY: {
+		struct hfi_msg_dev_async_ack *ioconfig_ack = NULL;
+		struct cam_icp_hw_ctx_data *ctx_data = NULL;
+
+		ioconfig_ack = (struct hfi_msg_dev_async_ack *)msg_ptr;
+		ctx_data = U64_TO_PTR(ioconfig_ack->user_data1);
+		if ((ctx_data->state == CAM_ICP_CTX_STATE_RELEASE) ||
+			(ctx_data->state == CAM_ICP_CTX_STATE_IN_USE))
+			complete(&ctx_data->wait_complete);
+
+		CAM_DBG(CAM_ICP, "received OFE destroy done msg: %u",
+			ctx_data->state);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_ICP, "Invalid opcode : %u",
+			msg_ptr[ICP_PACKET_OPCODE]);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_process_direct_ack_msg(uint32_t *msg_ptr)
+{
+	struct cam_icp_hw_mgr *hw_mgr = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct hfi_msg_dev_async_ack *ioconfig_ack = NULL;
+	int rc = 0;
+
+	if (!msg_ptr)
+		return -EINVAL;
+
+	switch (msg_ptr[ICP_PACKET_OPCODE]) {
+	case HFI_IPEBPS_CMD_OPCODE_IPE_ABORT:
+	case HFI_IPEBPS_CMD_OPCODE_BPS_ABORT:
+		ioconfig_ack = (struct hfi_msg_dev_async_ack *)msg_ptr;
+		ctx_data = (struct cam_icp_hw_ctx_data *)
+			U64_TO_PTR(ioconfig_ack->user_data1);
+
+		if (cam_presil_mode_enabled()) {
+			hw_mgr = ctx_data->hw_mgr_priv;
+			if (atomic_read(&hw_mgr->frame_in_process)) {
+				if (hw_mgr->frame_in_process_ctx_id == ctx_data->ctx_id) {
+					CAM_DBG(CAM_PRESIL, "%s: presil: frame process abort",
+						ctx_data->ctx_id_string);
+					hw_mgr->frame_in_process_ctx_id = -1;
+					atomic_set(&hw_mgr->frame_in_process, 0);
+					up_write(&frame_in_process_sem);
+				} else {
+					CAM_WARN(CAM_PRESIL,
+						"%s: presil: abort mismatch frame_in_process_ctx_id: %d",
+						ctx_data->ctx_id_string,
+						hw_mgr->frame_in_process_ctx_id);
+				}
+			}
+		}
+
+		if (ctx_data->state != CAM_ICP_CTX_STATE_FREE)
+			complete(&ctx_data->wait_complete);
+		CAM_DBG(CAM_ICP, "%s: received ABORT: ctx_state =%d",
+			ctx_data->ctx_id_string, ctx_data->state);
+		break;
+	case HFI_IPEBPS_CMD_OPCODE_IPE_DESTROY:
+	case HFI_IPEBPS_CMD_OPCODE_BPS_DESTROY:
+		ioconfig_ack = (struct hfi_msg_dev_async_ack *)msg_ptr;
+		ctx_data = (struct cam_icp_hw_ctx_data *)
+			U64_TO_PTR(ioconfig_ack->user_data1);
+		if ((ctx_data->state == CAM_ICP_CTX_STATE_RELEASE) ||
+			(ctx_data->state == CAM_ICP_CTX_STATE_IN_USE)) {
+			complete(&ctx_data->wait_complete);
+		}
+		CAM_DBG(CAM_ICP, "%s: received DESTROY: ctx_state =%d",
+			ctx_data->ctx_id_string, ctx_data->state);
+		break;
+	case HFI_IPEBPS_CMD_OPCODE_MEM_MAP:
+		ioconfig_ack = (struct hfi_msg_dev_async_ack *)msg_ptr;
+		ctx_data =
+			(struct cam_icp_hw_ctx_data *)ioconfig_ack->user_data1;
+		if (ctx_data->state != CAM_ICP_CTX_STATE_FREE)
+			complete(&ctx_data->wait_complete);
+		CAM_DBG(CAM_ICP, "%s: received\n"
+			"MAP ACK:ctx_state =%d\n"
+			"failed with err_no = [%u] err_type = [%s]",
+			ctx_data->ctx_id_string, ctx_data->state, ioconfig_ack->err_type,
+			cam_icp_error_handle_id_to_type(ioconfig_ack->err_type));
+		break;
+	case HFI_IPEBPS_CMD_OPCODE_MEM_UNMAP:
+		ioconfig_ack = (struct hfi_msg_dev_async_ack *)msg_ptr;
+		ctx_data =
+			(struct cam_icp_hw_ctx_data *)ioconfig_ack->user_data1;
+		if (ctx_data->state != CAM_ICP_CTX_STATE_FREE)
+			complete(&ctx_data->wait_complete);
+		CAM_DBG(CAM_ICP,
+			"%s: received UNMAP ACK:ctx_state =%d\n"
+			"failed with err_no = [%u] err_type = [%s]",
+			ctx_data->ctx_id_string, ctx_data->state, ioconfig_ack->err_type,
+			cam_icp_error_handle_id_to_type(ioconfig_ack->err_type));
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid opcode : %u",
+			msg_ptr[ICP_PACKET_OPCODE]);
+		rc = -EINVAL;
+	}
+	return rc;
+}
+
+static int cam_icp_dev_reset(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0, i, j;
+	struct cam_icp_hw_device_info *dev_info = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		dev_info = &hw_mgr->dev_info[i];
+		if (!dev_info->dev_ctx_info.dev_ctxt_cnt)
+			continue;
+
+		for (j = 0; j < dev_info->hw_dev_cnt; j++) {
+			dev_intf = dev_info->dev_intf[j];
+			if (!dev_intf) {
+				CAM_ERR(CAM_ICP, "Device intf for %s[%u] is NULL",
+					dev_info->dev_name, j);
+				return -EINVAL;
+			}
+			rc = dev_intf->hw_ops.process_cmd(dev_intf->hw_priv,
+				CAM_ICP_DEV_CMD_RESET, NULL, 0);
+			if (rc)
+				CAM_ERR(CAM_ICP, "[%s] %s[%u] reset failed rc: %d",
+					hw_mgr->hw_mgr_name, dev_info->dev_name, j, rc);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_trigger_recovery(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0, i;
+	struct sfr_buf *sfr_buffer = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	struct cam_icp_hw_error_evt_data icp_err_evt = {0};
+
+	CAM_DBG(CAM_ICP, "[%s] Enter", hw_mgr->hw_mgr_name);
+
+	if (atomic_read(&hw_mgr->recovery)) {
+		CAM_ERR(CAM_ICP, "%s Recovery is set", hw_mgr->hw_mgr_name);
+		return rc;
+	}
+
+	sfr_buffer = (struct sfr_buf *)hw_mgr->hfi_mem.sfr_buf.kva;
+	CAM_WARN(CAM_ICP, "[%s] hw_mgr[%u] SFR:%s", hw_mgr->hw_mgr_name,
+		hw_mgr->hw_mgr_id, sfr_buffer->msg);
+	cam_icp_dump_debug_info(hw_mgr, false);
+	cam_icp_mgr_dump_active_req_info(hw_mgr);
+
+	cam_icp_mgr_dev_get_gdsc_control(hw_mgr);
+	cam_icp_dev_reset(hw_mgr);
+
+	atomic_set(&hw_mgr->recovery, 1);
+
+	/* Find any active context and notify userspace of system failure */
+	icp_err_evt.err_type = CAM_ICP_HW_ERROR_SYSTEM_FAILURE;
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx_data[i];
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (ctx_data->state != CAM_CTX_ACQUIRED) {
+			mutex_unlock(&ctx_data->ctx_mutex);
+			continue;
+		}
+		ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_ICP_EVT_ID_ERROR,
+			&icp_err_evt);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		break;
+	}
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	if (i == CAM_ICP_CTX_MAX)
+		CAM_ERR(CAM_ICP,
+			"[%s] Fail to report system failure to userspace due to no active ctx",
+			hw_mgr->hw_mgr_name);
+
+	CAM_DBG(CAM_ICP, "[%s] Done", hw_mgr->hw_mgr_name);
+	return rc;
+}
+
+static int cam_icp_mgr_process_fatal_error(
+	struct cam_icp_hw_mgr *hw_mgr, uint32_t *msg_ptr)
+{
+	struct hfi_msg_event_notify *event_notify;
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "%s: Enter", hw_mgr->hw_mgr_name);
+
+	event_notify = (struct hfi_msg_event_notify *)msg_ptr;
+	if (!event_notify) {
+		CAM_ERR(CAM_ICP, "[%s] Empty event message", hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "[%s] evt_id: %u evt_data1: %u evt_data2: %u",
+		hw_mgr->hw_mgr_name, event_notify->event_id, event_notify->event_data1,
+		event_notify->event_data2);
+
+	if (event_notify->event_id == HFI_EVENT_SYS_ERROR) {
+		CAM_INFO(CAM_ICP, "[%s] received HFI_EVENT_SYS_ERROR",
+			hw_mgr->hw_mgr_name);
+		if (event_notify->event_data1 == HFI_ERR_SYS_FATAL) {
+			CAM_ERR(CAM_ICP, "[%s] received HFI_ERR_SYS_FATAL",
+				hw_mgr->hw_mgr_name);
+			BUG();
+		}
+		rc = cam_icp_mgr_trigger_recovery(hw_mgr);
+	}
+
+	return rc;
+}
+
+static void cam_icp_mgr_process_dbg_buf(struct cam_icp_hw_mgr *hw_mgr)
+{
+	uint32_t *msg_ptr = NULL, *pkt_ptr = NULL;
+	struct hfi_msg_debug *dbg_msg;
+	uint32_t read_len, size_processed = 0, debug_lvl;
+	uint64_t timestamp = 0;
+	char *dbg_buf;
+	int rc = 0;
+
+	rc = hfi_read_message(hw_mgr->hfi_handle, hw_mgr->dbg_buf, Q_DBG,
+		ICP_DBG_BUF_SIZE_IN_WORDS, &read_len);
+	if (rc)
+		return;
+
+	msg_ptr = (uint32_t *)hw_mgr->dbg_buf;
+	debug_lvl = hw_mgr->icp_dbg_lvl;
+	while (true) {
+		pkt_ptr = msg_ptr;
+		if (pkt_ptr[ICP_PACKET_TYPE] == HFI_MSG_SYS_DEBUG) {
+			dbg_msg = (struct hfi_msg_debug *)pkt_ptr;
+			dbg_buf = (char *)&dbg_msg->msg_data_flex;
+			timestamp = ((((uint64_t)(dbg_msg->timestamp_hi) << 32)
+				| dbg_msg->timestamp_lo) >> 16);
+			trace_cam_icp_fw_dbg(dbg_buf, timestamp/2,
+				hw_mgr->hw_mgr_name);
+			if (!debug_lvl)
+				CAM_INFO(CAM_ICP, "[%s]: FW_DBG:%s",
+					hw_mgr->hw_mgr_name, dbg_buf);
+		}
+		size_processed += (pkt_ptr[ICP_PACKET_SIZE] >>
+			BYTE_WORD_SHIFT);
+		if (size_processed >= read_len)
+			return;
+		msg_ptr += (pkt_ptr[ICP_PACKET_SIZE] >>
+		BYTE_WORD_SHIFT);
+	}
+}
+
+static int cam_icp_process_msg_pkt_type(
+	struct cam_icp_hw_mgr *hw_mgr,
+	uint32_t *msg_ptr,
+	uint32_t *msg_processed_len)
+{
+	int rc = 0;
+	int size_processed = 0;
+
+	switch (msg_ptr[ICP_PACKET_TYPE]) {
+	case HFI_MSG_SYS_INIT_DONE:
+		CAM_DBG(CAM_ICP, "[%s] received SYS_INIT_DONE", hw_mgr->hw_mgr_name);
+		complete(&hw_mgr->icp_complete);
+		size_processed = (
+			(struct hfi_msg_init_done *)msg_ptr)->size;
+		break;
+
+	case HFI_MSG_SYS_PC_PREP_DONE:
+		CAM_DBG(CAM_ICP, "[%s] HFI_MSG_SYS_PC_PREP_DONE is received\n",
+			hw_mgr->hw_mgr_name);
+		complete(&hw_mgr->icp_complete);
+		size_processed = sizeof(struct hfi_msg_pc_prep_done);
+		break;
+
+	case HFI_MSG_SYS_PING_ACK:
+		CAM_DBG(CAM_ICP, "[%s] received SYS_PING_ACK", hw_mgr->hw_mgr_name);
+		rc = cam_icp_mgr_process_msg_ping_ack(msg_ptr);
+		size_processed = sizeof(struct hfi_msg_ping_ack);
+		break;
+
+	case HFI_MSG_IPEBPS_CREATE_HANDLE_ACK:
+	case HFI_MSG_OFE_CREATE_HANDLE_ACK:
+		CAM_DBG(CAM_ICP, "[%s] received IPE/BPS/OFE CREATE_HANDLE_ACK",
+			hw_mgr->hw_mgr_name);
+		rc = cam_icp_mgr_process_msg_create_handle(msg_ptr);
+		size_processed = sizeof(struct hfi_msg_create_handle_ack);
+		break;
+
+	case HFI_MSG_IPEBPS_ASYNC_COMMAND_INDIRECT_ACK:
+		CAM_DBG(CAM_ICP, "[%s] received IPE/BPS ASYNC_INDIRECT_ACK",
+			hw_mgr->hw_mgr_name);
+		rc = cam_icp_mgr_process_ipebps_indirect_ack_msg(msg_ptr);
+		size_processed = (
+			(struct hfi_msg_dev_async_ack *)msg_ptr)->size;
+		break;
+
+	case HFI_MSG_OFE_ASYNC_COMMAND_ACK:
+		CAM_DBG(CAM_ICP, "[%s] received OFE ASYNC COMMAND ACK",
+			hw_mgr->hw_mgr_name);
+		rc = cam_icp_mgr_process_ofe_indirect_ack_msg(msg_ptr);
+		size_processed = (
+			(struct hfi_msg_dev_async_ack *)msg_ptr)->size;
+		break;
+
+	case HFI_MSG_IPEBPS_ASYNC_COMMAND_DIRECT_ACK:
+		CAM_DBG(CAM_ICP, "[%s] received ASYNC_DIRECT_ACK", hw_mgr->hw_mgr_name);
+		rc = cam_icp_mgr_process_direct_ack_msg(msg_ptr);
+		size_processed = (
+			(struct hfi_msg_dev_async_ack *)msg_ptr)->size;
+		break;
+
+	case HFI_MSG_EVENT_NOTIFY:
+		CAM_DBG(CAM_ICP, "[%s] received EVENT_NOTIFY", hw_mgr->hw_mgr_name);
+		size_processed = (
+			(struct hfi_msg_event_notify *)msg_ptr)->size;
+		rc = cam_icp_mgr_process_fatal_error(hw_mgr, msg_ptr);
+		if (rc)
+			CAM_ERR(CAM_ICP, "[%s] failed in processing evt notify",
+				hw_mgr->hw_mgr_name);
+
+		break;
+
+	case HFI_MSG_DBG_SYNX_TEST:
+		CAM_DBG(CAM_ICP, "received DBG_SYNX_TEST");
+		size_processed = sizeof(struct hfi_cmd_synx_test_payload);
+		complete(&hw_mgr->icp_complete);
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "[%s] invalid msg : %u",
+			hw_mgr->hw_mgr_name, msg_ptr[ICP_PACKET_TYPE]);
+		rc = -EINVAL;
+	}
+
+	*msg_processed_len = size_processed;
+	return rc;
+}
+
+static int32_t cam_icp_mgr_process_msg(void *priv, void *data)
+{
+	uint32_t read_len, msg_processed_len;
+	uint32_t *msg_ptr = NULL;
+	struct hfi_msg_work_data *task_data;
+	struct cam_icp_hw_mgr *hw_mgr;
+	int rc = 0;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_ICP, "Invalid data");
+		return -EINVAL;
+	}
+
+	task_data = data;
+	hw_mgr = priv;
+
+	rc = hfi_read_message(hw_mgr->hfi_handle, hw_mgr->msg_buf, Q_MSG,
+		ICP_MSG_BUF_SIZE_IN_WORDS, &read_len);
+	if (rc) {
+		CAM_DBG(CAM_ICP, "Unable to read msg q rc %d", rc);
+	} else {
+		read_len = read_len << BYTE_WORD_SHIFT;
+		msg_ptr = (uint32_t *)hw_mgr->msg_buf;
+		while (true) {
+			cam_icp_process_msg_pkt_type(hw_mgr, msg_ptr,
+				&msg_processed_len);
+
+			if (!msg_processed_len) {
+				CAM_ERR(CAM_ICP, "Failed to read");
+				rc = -EINVAL;
+				break;
+			}
+
+			read_len -= msg_processed_len;
+			if (read_len > 0) {
+				msg_ptr += (msg_processed_len >>
+				BYTE_WORD_SHIFT);
+				msg_processed_len = 0;
+			} else {
+				break;
+			}
+		}
+	}
+
+	cam_icp_mgr_process_dbg_buf(hw_mgr);
+
+	if (task_data->recover) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP, "issuing device recovery...");
+
+		rc = cam_icp_mgr_trigger_recovery(hw_mgr);
+	}
+
+	return rc;
+}
+
+static int32_t cam_icp_hw_mgr_cb(void *data, bool recover)
+{
+	int rc = 0;
+	unsigned long flags;
+	struct cam_icp_hw_mgr *hw_mgr = data;
+	struct crm_workq_task *task;
+	struct hfi_msg_work_data *task_data;
+
+	if (!data) {
+		CAM_ERR(CAM_ICP, "irq cb data is NULL");
+		return rc;
+	}
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(hw_mgr->msg_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "no empty task");
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+		return -ENOMEM;
+	}
+
+	task_data = (struct hfi_msg_work_data *)task->payload;
+	task_data->data = hw_mgr;
+	task_data->recover = recover;
+	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_icp_mgr_process_msg;
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+
+	return rc;
+}
+
+static void cam_icp_free_fw_mem(struct cam_icp_hw_mgr *hw_mgr)
+{
+	/* Skip freeing FW memory if not allocated */
+	if (hw_mgr->icp_use_pil)
+		return;
+
+	cam_smmu_dealloc_firmware(hw_mgr->iommu_hdl);
+}
+
+static void cam_icp_free_hfi_mem(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+
+	cam_icp_free_fw_mem(hw_mgr);
+
+	if (hw_mgr->hfi_mem.fw_uncached_region) {
+		rc = cam_mem_mgr_free_memory_region(
+			&hw_mgr->hfi_mem.fw_uncached_generic);
+		if (rc)
+			CAM_ERR(CAM_ICP,
+				"[%s] failed to unreserve fwuncached region", hw_mgr->hw_mgr_name);
+			hw_mgr->hfi_mem.fw_uncached_region = false;
+	} else {
+		rc = cam_mem_mgr_free_memory_region(
+			&hw_mgr->hfi_mem.sec_heap);
+		if (rc)
+			CAM_ERR(CAM_ICP, "[%s] failed to unreserve sec heap", hw_mgr->hw_mgr_name);
+
+		cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.qtbl);
+		cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.cmd_q);
+		cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.msg_q);
+		cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.dbg_q);
+		cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.sfr_buf);
+	}
+
+	cam_smmu_unmap_phy_mem_region(hw_mgr->iommu_hdl, CAM_SMMU_REGION_QDSS, 0);
+
+	/* Skip freeing if not mapped */
+	if (hw_mgr->synx_signaling_en) {
+		cam_smmu_unmap_phy_mem_region(hw_mgr->iommu_hdl, CAM_SMMU_REGION_FWUNCACHED,
+			CAM_SMMU_SUBREGION_GLOBAL_SYNC_MEM);
+		cam_smmu_unmap_phy_mem_region(hw_mgr->iommu_hdl, CAM_SMMU_REGION_DEVICE,
+			CAM_SMMU_SUBREGION_SYNX_HWMUTEX);
+		cam_smmu_unmap_phy_mem_region(hw_mgr->iommu_hdl, CAM_SMMU_REGION_DEVICE,
+			CAM_SMMU_SUBREGION_IPC_HWMUTEX);
+		cam_smmu_unmap_phy_mem_region(hw_mgr->iommu_hdl, CAM_SMMU_REGION_DEVICE,
+			CAM_SMMU_SUBREGION_GLOBAL_CNTR);
+	}
+}
+
+static int cam_icp_alloc_secheap_mem(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_mem_mgr_memory_desc *secheap)
+{
+	int rc;
+	struct cam_mem_mgr_request_desc alloc;
+	struct cam_mem_mgr_memory_desc out;
+	struct cam_smmu_region_info secheap_info;
+
+	rc = cam_smmu_get_region_info(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_SECHEAP, &secheap_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Unable to get secheap memory info", hw_mgr->hw_mgr_name);
+		return rc;
+	}
+
+	alloc.size = secheap_info.iova_len;
+	alloc.align = 0;
+	alloc.flags = 0;
+	alloc.smmu_hdl = hw_mgr->iommu_hdl;
+	rc = cam_mem_mgr_reserve_memory_region(&alloc,
+		CAM_SMMU_REGION_SECHEAP,
+		&out);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Unable to reserve secheap memory", hw_mgr->hw_mgr_name);
+		return rc;
+	}
+
+	*secheap = out;
+	CAM_DBG(CAM_ICP, "[%s] kva: %llX, iova: %x, hdl: %x, len: %lld",
+		hw_mgr->hw_mgr_name, out.kva, out.iova, out.mem_handle, out.len);
+
+	return rc;
+}
+
+static int cam_icp_alloc_shared_mem(
+	struct cam_icp_hw_mgr *hw_mgr, size_t size_requested,
+	struct cam_mem_mgr_memory_desc *alloc_out)
+{
+	int rc;
+	struct cam_mem_mgr_request_desc alloc;
+	struct cam_mem_mgr_memory_desc out;
+
+	alloc.size = size_requested;
+	alloc.align = 0;
+	alloc.flags = CAM_MEM_FLAG_HW_READ_WRITE |
+		CAM_MEM_FLAG_HW_SHARED_ACCESS;
+	alloc.smmu_hdl = hw_mgr->iommu_hdl;
+	rc = cam_mem_mgr_request_mem(&alloc, &out);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in alloc shared mem rc %d",
+		hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	*alloc_out = out;
+	CAM_DBG(CAM_ICP, "[%s] kva: %llX, iova: %x, hdl: %x, len: %lld",
+		hw_mgr->hw_mgr_name,
+		out.kva, out.iova, out.mem_handle, out.len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_fw_mem(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	uintptr_t kvaddr;
+	size_t len;
+	dma_addr_t iova;
+
+	if (hw_mgr->icp_use_pil)
+		return 0;
+
+	rc = cam_smmu_alloc_firmware(hw_mgr->iommu_hdl,
+		&iova, &kvaddr, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in alloc firmware rc %d",
+		hw_mgr->hw_mgr_name, rc);
+		return -ENOMEM;
+	}
+
+	hw_mgr->hfi_mem.fw_buf.len = len;
+	hw_mgr->hfi_mem.fw_buf.kva = kvaddr;
+	hw_mgr->hfi_mem.fw_buf.iova = iova;
+	hw_mgr->hfi_mem.fw_buf.smmu_hdl = hw_mgr->iommu_hdl;
+
+	CAM_DBG(CAM_ICP, "[%s], kva: %zX, iova: %llx, len: %zu",
+		hw_mgr->hw_mgr_name,
+		kvaddr, iova, len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_qdss_mem(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	size_t len;
+	dma_addr_t iova;
+
+	rc = cam_smmu_map_phy_mem_region(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_QDSS, 0, &iova, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in alloc qdss mem rc %d",
+		hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	hw_mgr->hfi_mem.qdss_buf.len = len;
+	hw_mgr->hfi_mem.qdss_buf.iova = iova;
+	hw_mgr->hfi_mem.qdss_buf.smmu_hdl = hw_mgr->iommu_hdl;
+
+	CAM_DBG(CAM_ICP, "[%s] iova: %llx, len: %zu",
+		hw_mgr->hw_mgr_name, iova, len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_global_sync_mem(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	size_t len;
+	dma_addr_t iova;
+
+	rc = cam_smmu_map_phy_mem_region(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_FWUNCACHED,
+		CAM_SMMU_SUBREGION_GLOBAL_SYNC_MEM, &iova, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"[%s] Failed in allocating global sync ipc mem rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	hw_mgr->hfi_mem.fw_uncached_global_sync.len = len;
+	hw_mgr->hfi_mem.fw_uncached_global_sync.iova = iova;
+	hw_mgr->hfi_mem.fw_uncached_global_sync.smmu_hdl = hw_mgr->iommu_hdl;
+
+	CAM_DBG(CAM_ICP, "[%s] iova: %llx, len: %zu",
+		hw_mgr->hw_mgr_name, iova, len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_device_synx_hwmutex_mem(
+	struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	size_t len;
+	dma_addr_t iova;
+
+	rc = cam_smmu_map_phy_mem_region(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_DEVICE, CAM_SMMU_SUBREGION_SYNX_HWMUTEX, &iova, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"Failed in allocating hwmutex mem rc %d", rc);
+		return rc;
+	}
+
+	hw_mgr->hfi_mem.synx_hwmutex.len = len;
+	hw_mgr->hfi_mem.synx_hwmutex.iova = iova;
+	hw_mgr->hfi_mem.synx_hwmutex.smmu_hdl = hw_mgr->iommu_hdl;
+
+	CAM_DBG(CAM_ICP, "[%s] iova: %llx, len: %zu",
+		hw_mgr->hw_mgr_name, iova, len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_device_global_cnt_mem(
+	struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	size_t len;
+	dma_addr_t iova;
+
+	rc = cam_smmu_map_phy_mem_region(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_DEVICE, CAM_SMMU_SUBREGION_GLOBAL_CNTR,
+		&iova, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"Failed in allocating global cntr mem rc %d", rc);
+		return rc;
+	}
+
+	hw_mgr->hfi_mem.global_cntr.len = len;
+	hw_mgr->hfi_mem.global_cntr.iova = iova;
+	hw_mgr->hfi_mem.global_cntr.smmu_hdl = hw_mgr->iommu_hdl;
+
+	CAM_DBG(CAM_ICP, "[%s] iova: %llx, len: %zu",
+		hw_mgr->hw_mgr_name, iova, len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_device_ipc_hwmutex_mem(
+	struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	size_t len;
+	dma_addr_t iova;
+
+	rc = cam_smmu_map_phy_mem_region(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_DEVICE, CAM_SMMU_SUBREGION_IPC_HWMUTEX,
+		&iova, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"Failed in allocating hwmutex mem rc %d", rc);
+		return rc;
+	}
+
+	hw_mgr->hfi_mem.ipc_hwmutex.len = len;
+	hw_mgr->hfi_mem.ipc_hwmutex.iova = iova;
+	hw_mgr->hfi_mem.ipc_hwmutex.smmu_hdl = hw_mgr->iommu_hdl;
+
+	CAM_DBG(CAM_ICP, "[%s] iova: %llx, len: %zu",
+		hw_mgr->hw_mgr_name, iova, len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_mem_for_fence_signaling(
+	struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+
+	rc = cam_smmu_get_region_info(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_DEVICE, &hw_mgr->hfi_mem.device);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"[%s] Unable to get device memory info rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	rc = cam_icp_allocate_global_sync_mem(hw_mgr);
+	if (rc)
+		return rc;
+
+	rc = cam_icp_allocate_device_synx_hwmutex_mem(hw_mgr);
+	if (rc)
+		goto unmap_global_sync;
+
+	rc = cam_icp_allocate_device_ipc_hwmutex_mem(hw_mgr);
+	if (rc)
+		goto unmap_synx_hwmutex;
+
+	rc = cam_icp_allocate_device_global_cnt_mem(hw_mgr);
+	if (rc)
+		goto unmap_ipc_mutex;
+
+	return 0;
+
+unmap_ipc_mutex:
+	cam_smmu_unmap_phy_mem_region(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_DEVICE,
+		CAM_SMMU_SUBREGION_IPC_HWMUTEX);
+unmap_synx_hwmutex:
+	cam_smmu_unmap_phy_mem_region(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_DEVICE,
+		CAM_SMMU_SUBREGION_SYNX_HWMUTEX);
+unmap_global_sync:
+	cam_smmu_unmap_phy_mem_region(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_FWUNCACHED,
+		CAM_SMMU_SUBREGION_GLOBAL_SYNC_MEM);
+
+	return rc;
+}
+
+static int cam_icp_get_io_mem_info(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	size_t len, discard_iova_len;
+	dma_addr_t iova, discard_iova_start;
+
+	rc = cam_smmu_get_io_region_info(hw_mgr->iommu_hdl,
+		&iova, &len, &discard_iova_start, &discard_iova_len);
+	if (rc)
+		return rc;
+
+	hw_mgr->hfi_mem.io_mem.iova_len = len;
+	hw_mgr->hfi_mem.io_mem.iova_start = iova;
+	hw_mgr->hfi_mem.io_mem.discard_iova_start = discard_iova_start;
+	hw_mgr->hfi_mem.io_mem.discard_iova_len = discard_iova_len;
+
+	CAM_DBG(CAM_ICP, "[%s] iova: %llx, len: %zu discard iova %llx len %llx",
+		hw_mgr->hw_mgr_name, iova, len, discard_iova_start, discard_iova_len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_hfi_mem(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	struct cam_smmu_region_info fwuncached_region_info = {0};
+	bool fwuncached_region_exists = false;
+	size_t qtbl_size, cmdq_size, msgq_size, dbgq_size, sfr_size, sec_heap_size;
+
+	rc = cam_smmu_get_region_info(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_SHARED, &hw_mgr->hfi_mem.shmem);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Unable to get shared memory info rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	rc = cam_icp_allocate_fw_mem(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Unable to allocate FW memory rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	rc = cam_icp_allocate_qdss_mem(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Unable to allocate qdss memory rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		goto fw_alloc_failed;
+	}
+
+	/*
+	 * Compute sizes aligned to page size, and add a padding
+	 * of a page between regions
+	 */
+	qtbl_size = ALIGN(ICP_QTBL_SIZE_IN_BYTES, PAGE_SIZE) + PAGE_SIZE;
+	cmdq_size = ALIGN(ICP_CMD_Q_SIZE_IN_BYTES, PAGE_SIZE) + PAGE_SIZE;
+	msgq_size = ALIGN(ICP_MSG_Q_SIZE_IN_BYTES, PAGE_SIZE) + PAGE_SIZE;
+	dbgq_size = ALIGN(ICP_DBG_Q_SIZE_IN_BYTES, PAGE_SIZE) + PAGE_SIZE;
+	sfr_size = ALIGN(ICP_MSG_SFR_SIZE_IN_BYTES, PAGE_SIZE) + PAGE_SIZE;
+	sec_heap_size = ALIGN(ICP_SEC_HEAP_SIZE_IN_BYTES, PAGE_SIZE) + PAGE_SIZE;
+
+	rc = cam_smmu_get_region_info(hw_mgr->iommu_hdl,
+		CAM_SMMU_REGION_FWUNCACHED, &fwuncached_region_info);
+	if (!rc)
+		fwuncached_region_exists = true;
+
+	if (fwuncached_region_exists) {
+		struct cam_mem_mgr_request_desc alloc;
+		struct cam_mem_mgr_memory_desc out;
+		uint32_t offset;
+
+		/*
+		 * FW uncached consists of the qtbl, HFI queues, SFR buffer
+		 * and secondary heap
+		 */
+		alloc.size = qtbl_size + cmdq_size + msgq_size + dbgq_size +
+			sfr_size + sec_heap_size;
+		alloc.align = 0;
+		alloc.flags = CAM_MEM_FLAG_KMD_ACCESS;
+		alloc.smmu_hdl = hw_mgr->iommu_hdl;
+		rc = cam_mem_mgr_reserve_memory_region(&alloc,
+			CAM_SMMU_REGION_FWUNCACHED, &out);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "[%s] Unable to reserve fw uncached memory rc %d",
+				hw_mgr->hw_mgr_name, rc);
+			goto qtbl_alloc_failed;
+		}
+
+		hw_mgr->hfi_mem.fw_uncached_region = true;
+		/*
+		 * If the FW uncached region is carved into different subregions
+		 * send the whole region to FW, resulting in one ICP MMU entry.
+		 * If reserving for FW uncached the SMMU will map the FW uncached
+		 * generic, and return the appropriate va
+		 *
+		 */
+		hw_mgr->hfi_mem.fw_uncached = fwuncached_region_info;
+		hw_mgr->hfi_mem.fw_uncached_generic = out;
+
+		offset = 0;
+
+		hw_mgr->hfi_mem.sec_heap.iova       = out.iova + offset;
+		hw_mgr->hfi_mem.sec_heap.kva        = out.kva + offset;
+		hw_mgr->hfi_mem.sec_heap.len        = sec_heap_size;
+		hw_mgr->hfi_mem.sec_heap.smmu_hdl   = out.smmu_hdl;
+		hw_mgr->hfi_mem.sec_heap.mem_handle = out.mem_handle;
+		hw_mgr->hfi_mem.sec_heap.region     = out.region;
+		offset += (uint32_t)sec_heap_size;
+
+		hw_mgr->hfi_mem.qtbl.iova       = out.iova + offset;
+		hw_mgr->hfi_mem.qtbl.kva        = out.kva + offset;
+		hw_mgr->hfi_mem.qtbl.len        = qtbl_size;
+		hw_mgr->hfi_mem.qtbl.smmu_hdl   = out.smmu_hdl;
+		hw_mgr->hfi_mem.qtbl.mem_handle = out.mem_handle;
+		hw_mgr->hfi_mem.qtbl.region     = out.region;
+		offset += (uint32_t)qtbl_size;
+
+		hw_mgr->hfi_mem.cmd_q.iova       = out.iova + offset;
+		hw_mgr->hfi_mem.cmd_q.kva        = out.kva + offset;
+		hw_mgr->hfi_mem.cmd_q.len        = cmdq_size;
+		hw_mgr->hfi_mem.cmd_q.smmu_hdl   = out.smmu_hdl;
+		hw_mgr->hfi_mem.cmd_q.mem_handle = out.mem_handle;
+		hw_mgr->hfi_mem.cmd_q.region     = out.region;
+		offset += (uint32_t)cmdq_size;
+
+		hw_mgr->hfi_mem.msg_q.iova       = out.iova + offset;
+		hw_mgr->hfi_mem.msg_q.kva        = out.kva + offset;
+		hw_mgr->hfi_mem.msg_q.len        = msgq_size;
+		hw_mgr->hfi_mem.msg_q.smmu_hdl   = out.smmu_hdl;
+		hw_mgr->hfi_mem.msg_q.mem_handle = out.mem_handle;
+		hw_mgr->hfi_mem.msg_q.region     = out.region;
+		offset += (uint32_t)msgq_size;
+
+		hw_mgr->hfi_mem.dbg_q.iova       = out.iova + offset;
+		hw_mgr->hfi_mem.dbg_q.kva        = out.kva + offset;
+		hw_mgr->hfi_mem.dbg_q.len        = dbgq_size;
+		hw_mgr->hfi_mem.dbg_q.smmu_hdl   = out.smmu_hdl;
+		hw_mgr->hfi_mem.dbg_q.mem_handle = out.mem_handle;
+		hw_mgr->hfi_mem.dbg_q.region     = out.region;
+		offset += (uint32_t)dbgq_size;
+
+		hw_mgr->hfi_mem.sfr_buf.iova       = out.iova + offset;
+		hw_mgr->hfi_mem.sfr_buf.kva        = out.kva + offset;
+		hw_mgr->hfi_mem.sfr_buf.len        = sfr_size;
+		hw_mgr->hfi_mem.sfr_buf.smmu_hdl   = out.smmu_hdl;
+		hw_mgr->hfi_mem.sfr_buf.mem_handle = out.mem_handle;
+		hw_mgr->hfi_mem.sfr_buf.region     = out.region;
+		offset += (uint32_t)sfr_size;
+
+		if (offset > out.len) {
+			CAM_ERR(CAM_ICP,
+				"[%s] FW uncached region size %lld not enough, required %lld",
+				hw_mgr->hw_mgr_name, offset, out.len);
+			cam_mem_mgr_free_memory_region(&hw_mgr->hfi_mem.fw_uncached_generic);
+			goto qtbl_alloc_failed;
+		}
+	} else {
+		rc = cam_icp_alloc_shared_mem(hw_mgr, qtbl_size, &hw_mgr->hfi_mem.qtbl);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "[%s] Unable to allocate qtbl memory, rc %d",
+				hw_mgr->hw_mgr_name, rc);
+			goto qtbl_alloc_failed;
+		}
+
+		rc = cam_icp_alloc_shared_mem(hw_mgr, cmdq_size, &hw_mgr->hfi_mem.cmd_q);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "[%s] Unable to allocate cmd q memory rc %d",
+				hw_mgr->hw_mgr_name, rc);
+			goto cmd_q_alloc_failed;
+		}
+
+		rc = cam_icp_alloc_shared_mem(hw_mgr, msgq_size, &hw_mgr->hfi_mem.msg_q);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "[%s] Unable to allocate msg q memory rc %d",
+				hw_mgr->hw_mgr_name, rc);
+			goto msg_q_alloc_failed;
+		}
+
+		rc = cam_icp_alloc_shared_mem(hw_mgr, dbgq_size, &hw_mgr->hfi_mem.dbg_q);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "[%s] Unable to allocate dbg q memory rc %d",
+				hw_mgr->hw_mgr_name, rc);
+			goto dbg_q_alloc_failed;
+		}
+
+		rc = cam_icp_alloc_shared_mem(hw_mgr, sfr_size, &hw_mgr->hfi_mem.sfr_buf);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "[%s] Unable to allocate sfr buffer rc %d",
+				hw_mgr->hw_mgr_name, rc);
+			goto sfr_buf_alloc_failed;
+		}
+
+		rc = cam_icp_alloc_secheap_mem(hw_mgr, &hw_mgr->hfi_mem.sec_heap);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "[%s] Unable to allocate sec heap memory rc %d",
+				hw_mgr->hw_mgr_name, rc);
+			goto sec_heap_alloc_failed;
+		}
+	}
+
+	CAM_DBG(CAM_ICP, "[%s] Shared Region [0x%x %lld] FW Uncached nested Region [0x%x %lld]",
+		hw_mgr->hw_mgr_name,
+		hw_mgr->hfi_mem.shmem.iova_start,
+		hw_mgr->hfi_mem.shmem.iova_len,
+		fwuncached_region_info.iova_start,
+		fwuncached_region_info.iova_len);
+
+	CAM_DBG(CAM_ICP,
+		"[%s] FwUncached[0x%x %lld] FwUncached_Generic[0x%x %p %lld] QTbl[0x%x %p %lld] CmdQ[0x%x %p %lld] MsgQ[0x%x %p %lld]",
+		hw_mgr->hw_mgr_name,
+		hw_mgr->hfi_mem.fw_uncached.iova_start,
+		hw_mgr->hfi_mem.fw_uncached.iova_len,
+		hw_mgr->hfi_mem.fw_uncached_generic.iova,
+		hw_mgr->hfi_mem.fw_uncached_generic.kva,
+		hw_mgr->hfi_mem.fw_uncached_generic.len,
+		hw_mgr->hfi_mem.qtbl.iova,
+		hw_mgr->hfi_mem.qtbl.kva,
+		hw_mgr->hfi_mem.qtbl.len,
+		hw_mgr->hfi_mem.cmd_q.iova,
+		hw_mgr->hfi_mem.cmd_q.kva,
+		hw_mgr->hfi_mem.cmd_q.len,
+		hw_mgr->hfi_mem.msg_q.iova,
+		hw_mgr->hfi_mem.msg_q.kva,
+		hw_mgr->hfi_mem.msg_q.len);
+
+	CAM_DBG(CAM_ICP,
+		"[%s] DbgQ[0x%x %p %lld] SFR[0x%x %p %lld] SecHeap[0x%x %p %lld]",
+		hw_mgr->hw_mgr_name,
+		hw_mgr->hfi_mem.dbg_q.iova,
+		hw_mgr->hfi_mem.dbg_q.kva,
+		hw_mgr->hfi_mem.dbg_q.len,
+		hw_mgr->hfi_mem.sfr_buf.iova,
+		hw_mgr->hfi_mem.sfr_buf.kva,
+		hw_mgr->hfi_mem.sfr_buf.len,
+		hw_mgr->hfi_mem.sec_heap.iova,
+		hw_mgr->hfi_mem.sec_heap.kva,
+		hw_mgr->hfi_mem.sec_heap.len);
+
+	rc = cam_icp_get_io_mem_info(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Unable to get I/O region info rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		if (fwuncached_region_exists) {
+			cam_mem_mgr_free_memory_region(
+				&hw_mgr->hfi_mem.fw_uncached_generic);
+			goto qtbl_alloc_failed;
+		} else {
+			goto get_io_mem_failed;
+		}
+	}
+
+	/* Allocate sync global mem & hwmutex for IPC */
+	if (hw_mgr->synx_signaling_en) {
+		rc = cam_icp_allocate_mem_for_fence_signaling(hw_mgr);
+		if (rc) {
+			if (fwuncached_region_exists) {
+				cam_mem_mgr_free_memory_region(
+					&hw_mgr->hfi_mem.fw_uncached_generic);
+				goto qtbl_alloc_failed;
+			} else {
+				goto get_io_mem_failed;
+			}
+		}
+	}
+
+	return rc;
+get_io_mem_failed:
+	cam_mem_mgr_free_memory_region(&hw_mgr->hfi_mem.sec_heap);
+sec_heap_alloc_failed:
+	cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.sfr_buf);
+sfr_buf_alloc_failed:
+	cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.dbg_q);
+dbg_q_alloc_failed:
+	cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.msg_q);
+msg_q_alloc_failed:
+	cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.cmd_q);
+cmd_q_alloc_failed:
+	cam_mem_mgr_release_mem(&hw_mgr->hfi_mem.qtbl);
+qtbl_alloc_failed:
+	cam_smmu_unmap_phy_mem_region(hw_mgr->iommu_hdl, CAM_SMMU_REGION_QDSS, 0);
+fw_alloc_failed:
+	cam_icp_free_fw_mem(hw_mgr);
+	return rc;
+}
+
+static int cam_icp_mgr_get_free_ctx(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int i = 0;
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		mutex_lock(&hw_mgr->ctx_data[i].ctx_mutex);
+		if (hw_mgr->ctx_data[i].state == CAM_ICP_CTX_STATE_FREE) {
+			hw_mgr->ctx_data[i].state = CAM_ICP_CTX_STATE_IN_USE;
+			mutex_unlock(&hw_mgr->ctx_data[i].ctx_mutex);
+			break;
+		}
+		mutex_unlock(&hw_mgr->ctx_data[i].ctx_mutex);
+	}
+
+	return i;
+}
+
+static void cam_icp_mgr_put_ctx(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	ctx_data->state = CAM_ICP_CTX_STATE_FREE;
+}
+
+static int cam_icp_mgr_send_pc_prep(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] device interface is NULL",
+			hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	reinit_completion(&hw_mgr->icp_complete);
+
+	CAM_DBG(CAM_ICP, "[%s] Sending pc prep command", hw_mgr->hw_mgr_name);
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_PC_PREP, NULL, 0);
+	if (rc)
+		return rc;
+
+	CAM_DBG(CAM_ICP, "[%s] Wait for PC_PREP_DONE Message\n", hw_mgr->hw_mgr_name);
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+		&hw_mgr->icp_complete,
+		msecs_to_jiffies((timeout)), CAM_ICP,
+		"[%s] FW response timeout for PC PREP handle command", hw_mgr->hw_mgr_name);
+	if (!rem_jiffies)
+		rc = -ETIMEDOUT;
+	CAM_DBG(CAM_ICP, "[%s] Done Waiting for PC_PREP Message\n", hw_mgr->hw_mgr_name);
+
+	return rc;
+}
+
+static int cam_icp_device_deint(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_icp_hw_device_info *dev_info = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+	int rc = 0, i, j;
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		dev_info = &hw_mgr->dev_info[i];
+		for (j = 0; j < dev_info->hw_dev_cnt; j++) {
+			if (dev_info->dev_ctx_info.dev_clk_state) {
+				dev_intf = dev_info->dev_intf[j];
+				if (!dev_intf) {
+					CAM_ERR(CAM_ICP, "[%s] Device intf for %s[%u] is NULL",
+						hw_mgr->hw_mgr_name, dev_info->dev_name, j);
+					return -EINVAL;
+				}
+				rc = dev_intf->hw_ops.deinit(dev_intf->hw_priv, NULL, 0);
+				if (rc) {
+					CAM_ERR(CAM_ICP, "[%s] %s[%u] failed to deinit rc: %d",
+						hw_mgr->hw_mgr_name, dev_info->dev_name, j, rc);
+				}
+				dev_info->dev_ctx_info.dev_clk_state = false;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_hw_close_u(void *hw_priv, void *hw_close_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_priv;
+	int rc = 0;
+
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Null hw mgr");
+		return 0;
+	}
+
+	CAM_DBG(CAM_ICP, "[%s] UMD calls close", hw_mgr->hw_mgr_name);
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	rc = cam_icp_mgr_hw_close(hw_mgr, NULL);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_icp_mgr_hw_close_k(void *hw_priv, void *hw_close_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_priv;
+
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Null hw mgr");
+		return 0;
+	}
+
+	CAM_DBG(CAM_ICP, "[%s] KMD calls close", hw_mgr->hw_mgr_name);
+
+	return cam_icp_mgr_hw_close(hw_mgr, NULL);
+
+}
+
+static int cam_icp_mgr_proc_resume(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	int rc;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is NULL");
+		return -EINVAL;
+	}
+
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv, CAM_ICP_CMD_POWER_RESUME,
+		&hw_mgr->icp_jtag_debug, sizeof(hw_mgr->icp_jtag_debug));
+	if (!rc)
+		hw_mgr->icp_resumed = true;
+
+	return rc;
+}
+
+static void cam_icp_mgr_proc_suspend(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	int rc;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is NULL");
+		return;
+	}
+
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv, CAM_ICP_CMD_POWER_COLLAPSE,
+		NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] Fail to suspend processor rc %d",
+			hw_mgr->hw_mgr_name, rc);
+
+	hw_mgr->icp_resumed = false;
+}
+
+static int __power_collapse(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+
+	if (!hw_mgr->icp_pc_flag || atomic_read(&hw_mgr->recovery)) {
+		cam_icp_mgr_proc_suspend(hw_mgr);
+
+		rc = cam_icp_mgr_hw_close_k(hw_mgr, NULL);
+		if (rc)
+			CAM_ERR(CAM_ICP, "[%s] Failed in hw close rc %d",
+				hw_mgr->hw_mgr_name, rc);
+	} else {
+		CAM_DBG(CAM_PERF, "[%s] Sending PC prep ICP PC enabled",
+			hw_mgr->hw_mgr_name);
+
+		rc = cam_icp_mgr_send_pc_prep(hw_mgr);
+		if (rc)
+			CAM_ERR(CAM_ICP, "[%s] Failed in send pc prep rc %d",
+				hw_mgr->hw_mgr_name, rc);
+
+		cam_icp_mgr_proc_suspend(hw_mgr);
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_icp_power_collapse(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	int rc;
+	bool send_freq_info = true;
+
+	CAM_DBG(CAM_PERF, "[%s] ENTER", hw_mgr->hw_mgr_name);
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is NULL", hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	rc = __power_collapse(hw_mgr);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] Fail to power collapse ICP rc: %d",
+			hw_mgr->hw_mgr_name, rc);
+
+	rc = icp_dev_intf->hw_ops.deinit(icp_dev_intf->hw_priv, &send_freq_info,
+		sizeof(send_freq_info));
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] Fail to deinit ICP", hw_mgr->hw_mgr_name);
+
+	CAM_DBG(CAM_PERF, "[%s] EXIT", hw_mgr->hw_mgr_name);
+
+	return rc;
+}
+
+static int cam_icp_mgr_proc_boot(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	struct cam_icp_boot_args args;
+	int rc;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] invalid device interface", hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	if (!hw_mgr->icp_use_pil) {
+		/* We handle the iommu mapping */
+		args.firmware.iova = hw_mgr->hfi_mem.fw_buf.iova;
+		args.firmware.kva = hw_mgr->hfi_mem.fw_buf.kva;
+		args.firmware.len = hw_mgr->hfi_mem.fw_buf.len;
+		args.use_sec_pil = false;
+	} else {
+		args.use_sec_pil = true;
+	}
+
+	args.irq_cb.data = hw_mgr;
+	args.irq_cb.cb = cam_icp_hw_mgr_cb;
+
+	args.debug_enabled = hw_mgr->icp_jtag_debug;
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_PROC_BOOT, &args, sizeof(args));
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] processor boot failed rc=%d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	hw_mgr->icp_resumed = true;
+
+	return rc;
+}
+
+static void cam_icp_mgr_proc_shutdown(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	bool send_freq_info = false;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is NULL",
+			hw_mgr->hw_mgr_name);
+		return;
+	}
+
+	icp_dev_intf->hw_ops.init(icp_dev_intf->hw_priv,
+		&send_freq_info, sizeof(send_freq_info));
+
+	icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_PROC_SHUTDOWN, NULL, 0);
+
+	icp_dev_intf->hw_ops.deinit(icp_dev_intf->hw_priv,
+		&send_freq_info, sizeof(send_freq_info));
+
+	if (hw_mgr->synx_signaling_en)
+		cam_sync_synx_core_recovery(hw_mgr->synx_core_id);
+
+	hw_mgr->icp_resumed = false;
+}
+
+static void cam_icp_mgr_populate_hfi_mem_info(struct cam_icp_hw_mgr *hw_mgr,
+	struct hfi_mem_info *hfi_mem)
+{
+	hfi_mem->qtbl.kva  = hw_mgr->hfi_mem.qtbl.kva;
+	hfi_mem->qtbl.iova = hw_mgr->hfi_mem.qtbl.iova;
+	hfi_mem->qtbl.len  = hw_mgr->hfi_mem.qtbl.len;
+
+	CAM_DBG(CAM_ICP, "[%s] qtbl kva = %llx IOVA = %x length = %lld\n",
+		hw_mgr->hw_mgr_name, hfi_mem->qtbl.kva, hfi_mem->qtbl.iova, hfi_mem->qtbl.len);
+
+	hfi_mem->cmd_q.kva  = hw_mgr->hfi_mem.cmd_q.kva;
+	hfi_mem->cmd_q.iova = hw_mgr->hfi_mem.cmd_q.iova;
+	hfi_mem->cmd_q.len  = hw_mgr->hfi_mem.cmd_q.len;
+	CAM_DBG(CAM_ICP, "[%s] cmd_q kva = %llx IOVA = %x length = %lld\n",
+		hw_mgr->hw_mgr_name, hfi_mem->cmd_q.kva, hfi_mem->cmd_q.iova, hfi_mem->cmd_q.len);
+
+	hfi_mem->msg_q.kva  = hw_mgr->hfi_mem.msg_q.kva;
+	hfi_mem->msg_q.iova = hw_mgr->hfi_mem.msg_q.iova;
+	hfi_mem->msg_q.len  = hw_mgr->hfi_mem.msg_q.len;
+	CAM_DBG(CAM_ICP, "[%s] msg_q kva = %llx IOVA = %x length = %lld\n",
+		hw_mgr->hw_mgr_name, hfi_mem->msg_q.kva, hfi_mem->msg_q.iova, hfi_mem->msg_q.len);
+
+	hfi_mem->dbg_q.kva  = hw_mgr->hfi_mem.dbg_q.kva;
+	hfi_mem->dbg_q.iova = hw_mgr->hfi_mem.dbg_q.iova;
+	hfi_mem->dbg_q.len  = hw_mgr->hfi_mem.dbg_q.len;
+	CAM_DBG(CAM_ICP, "[%s] dbg_q kva = %llx IOVA = %x length = %lld\n",
+		hw_mgr->hw_mgr_name, hfi_mem->dbg_q.kva, hfi_mem->dbg_q.iova, hfi_mem->dbg_q.len);
+
+	hfi_mem->sfr_buf.kva  = hw_mgr->hfi_mem.sfr_buf.kva;
+	hfi_mem->sfr_buf.iova = hw_mgr->hfi_mem.sfr_buf.iova;
+	hfi_mem->sfr_buf.len  = hw_mgr->hfi_mem.sfr_buf.len;
+	CAM_DBG(CAM_ICP, "[%s] sfr kva = %llx IOVA = %x length = %lld\n",
+		hw_mgr->hw_mgr_name, hfi_mem->sfr_buf.kva, hfi_mem->sfr_buf.iova,
+		hfi_mem->sfr_buf.len);
+
+	hfi_mem->sec_heap.kva  = hw_mgr->hfi_mem.sec_heap.kva;
+	hfi_mem->sec_heap.iova = hw_mgr->hfi_mem.sec_heap.iova;
+	hfi_mem->sec_heap.len  = hw_mgr->hfi_mem.sec_heap.len;
+
+	hfi_mem->shmem.iova = hw_mgr->hfi_mem.shmem.iova_start;
+	hfi_mem->shmem.len  = hw_mgr->hfi_mem.shmem.iova_len;
+
+	hfi_mem->qdss.iova = hw_mgr->hfi_mem.qdss_buf.iova;
+	hfi_mem->qdss.len = hw_mgr->hfi_mem.qdss_buf.len;
+
+	if (hw_mgr->synx_signaling_en) {
+		hfi_mem->device_mem.iova = hw_mgr->hfi_mem.device.iova_start;
+		hfi_mem->device_mem.len = hw_mgr->hfi_mem.device.iova_len;
+		CAM_DBG(CAM_ICP,
+			"device memory [iova = 0x%llx len = 0x%llx]",
+			hfi_mem->device_mem.iova, hfi_mem->device_mem.len);
+	}
+
+	if (hw_mgr->hfi_mem.io_mem.discard_iova_start &&
+		hw_mgr->hfi_mem.io_mem.discard_iova_len) {
+		/* IO Region 1 */
+		hfi_mem->io_mem.iova = hw_mgr->hfi_mem.io_mem.iova_start;
+		hfi_mem->io_mem.len =
+			hw_mgr->hfi_mem.io_mem.discard_iova_start -
+			hw_mgr->hfi_mem.io_mem.iova_start;
+
+		/* IO Region 2 */
+		hfi_mem->io_mem2.iova =
+			hw_mgr->hfi_mem.io_mem.discard_iova_start +
+			hw_mgr->hfi_mem.io_mem.discard_iova_len;
+		hfi_mem->io_mem2.len =
+			hw_mgr->hfi_mem.io_mem.iova_start +
+			hw_mgr->hfi_mem.io_mem.iova_len   -
+			hfi_mem->io_mem2.iova;
+	} else {
+		/* IO Region 1 */
+		hfi_mem->io_mem.iova = hw_mgr->hfi_mem.io_mem.iova_start;
+		hfi_mem->io_mem.len = hw_mgr->hfi_mem.io_mem.iova_len;
+
+		/* IO Region 2 */
+		hfi_mem->io_mem2.iova = 0x0;
+		hfi_mem->io_mem2.len = 0x0;
+	}
+
+	hfi_mem->fw_uncached.iova = hw_mgr->hfi_mem.fw_uncached.iova_start;
+	hfi_mem->fw_uncached.len = hw_mgr->hfi_mem.fw_uncached.iova_len;
+
+	CAM_DBG(CAM_ICP,
+		"[%s] IO region1 IOVA = %X length = %lld, IO region2 IOVA = %X length = %lld",
+		hw_mgr->hw_mgr_name,
+		hfi_mem->io_mem.iova,
+		hfi_mem->io_mem.len,
+		hfi_mem->io_mem2.iova,
+		hfi_mem->io_mem2.len);
+}
+
+static int cam_icp_mgr_hfi_resume(struct cam_icp_hw_mgr *hw_mgr)
+{
+	return cam_hfi_resume(hw_mgr->hfi_handle);
+}
+
+static int cam_icp_mgr_populate_abort_cmd(struct cam_icp_hw_ctx_data *ctx_data,
+	struct hfi_cmd_dev_async **abort_cmd_ptr)
+{
+	struct hfi_cmd_dev_async *abort_cmd = NULL;
+	uint32_t opcode, pkt_type;
+	size_t packet_size;
+
+	packet_size = sizeof(struct hfi_cmd_dev_async);
+
+	switch (ctx_data->device_info->hw_dev_type) {
+	case CAM_ICP_DEV_BPS:
+		pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
+		packet_size = packet_size + sizeof(struct hfi_cmd_abort) -
+			sizeof(((struct hfi_cmd_dev_async *)0)->payload.direct);
+		opcode = HFI_IPEBPS_CMD_OPCODE_BPS_ABORT;
+		break;
+	case CAM_ICP_DEV_IPE:
+		pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
+		packet_size = packet_size + sizeof(struct hfi_cmd_abort) -
+			sizeof(((struct hfi_cmd_dev_async *)0)->payload.direct);
+		opcode = HFI_IPEBPS_CMD_OPCODE_IPE_ABORT;
+		break;
+	case CAM_ICP_DEV_OFE:
+		pkt_type = HFI_CMD_OFE_ASYNC_COMMAND;
+		opcode = HFI_OFE_CMD_OPCODE_ABORT;
+		break;
+	default:
+		CAM_ERR(CAM_ICP,
+			"%s: Invalid device type not supported: %u",
+			ctx_data->ctx_id_string, ctx_data->device_info->hw_dev_type);
+		return -EINVAL;
+	}
+
+	abort_cmd = kzalloc(packet_size, GFP_KERNEL);
+	if (!abort_cmd)
+		return -ENOMEM;
+
+	CAM_DBG(CAM_ICP, "%s: abort pkt size = %d",
+		ctx_data->ctx_id_string, (int)packet_size);
+
+	abort_cmd->size = packet_size;
+	abort_cmd->pkt_type = pkt_type;
+	abort_cmd->opcode = opcode;
+	abort_cmd->num_fw_handles = 1;
+	abort_cmd->fw_handles_flex[0] = ctx_data->fw_handle;
+	abort_cmd->user_data1 = PTR_TO_U64(ctx_data);
+	abort_cmd->user_data2 = (uint64_t)0x0;
+
+	*abort_cmd_ptr = abort_cmd;
+
+	return 0;
+}
+
+static int cam_icp_mgr_abort_handle_wq(
+	void *priv, void *data)
+{
+	int rc = 0;
+	struct cam_icp_hw_mgr      *hw_mgr;
+	struct hfi_cmd_work_data   *task_data = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	struct hfi_cmd_dev_async   *abort_cmd;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_ICP, "Invalid params %pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	task_data = (struct hfi_cmd_work_data *)data;
+	ctx_data =
+		(struct cam_icp_hw_ctx_data *)task_data->data;
+	hw_mgr = ctx_data->hw_mgr_priv;
+
+	rc = cam_icp_mgr_populate_abort_cmd(ctx_data, &abort_cmd);
+	if (rc)
+		return rc;
+
+	rc = hfi_write_cmd(hw_mgr->hfi_handle, abort_cmd);
+	if (rc) {
+		kfree(abort_cmd);
+		return rc;
+	}
+	CAM_DBG(CAM_ICP, "%s: fw_handle = 0x%x ctx_data = %pK",
+		ctx_data->ctx_id_string, ctx_data->fw_handle, ctx_data);
+
+	kfree(abort_cmd);
+	return rc;
+}
+
+static int cam_icp_mgr_abort_handle(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+	unsigned long rem_jiffies = 0;
+	int timeout = 2000;
+	struct hfi_cmd_dev_async *abort_cmd;
+	struct cam_icp_hw_mgr *hw_mgr = ctx_data->hw_mgr_priv;
+
+	rc = cam_icp_mgr_populate_abort_cmd(ctx_data, &abort_cmd);
+	if (rc)
+		return rc;
+
+	reinit_completion(&ctx_data->wait_complete);
+
+	rc = hfi_write_cmd(hw_mgr->hfi_handle, abort_cmd);
+	if (rc) {
+		kfree(abort_cmd);
+		return rc;
+	}
+	CAM_DBG(CAM_ICP, "%s: fw_handle = 0x%x ctx_data = %pK",
+		ctx_data->ctx_id_string, ctx_data->fw_handle, ctx_data);
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+			&ctx_data->wait_complete,
+			msecs_to_jiffies(timeout), CAM_ICP,
+			"%s: FW response timeout for Abort handle command",
+			ctx_data->ctx_id_string);
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		cam_icp_dump_debug_info(ctx_data->hw_mgr_priv, false);
+		ctx_data->abort_timed_out = true;
+	}
+
+	kfree(abort_cmd);
+	return rc;
+}
+
+static int cam_icp_mgr_destroy_handle(
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0, opcode, pkt_type;
+	int timeout = 1000;
+	unsigned long rem_jiffies;
+	size_t packet_size;
+	struct hfi_cmd_dev_async *destroy_cmd;
+	struct cam_icp_hw_mgr *hw_mgr = ctx_data->hw_mgr_priv;
+
+	packet_size = sizeof(struct hfi_cmd_dev_async);
+
+	switch (ctx_data->device_info->hw_dev_type) {
+	case CAM_ICP_DEV_BPS:
+		pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
+		packet_size = packet_size + sizeof(struct hfi_cmd_destroy) -
+			sizeof(((struct hfi_cmd_dev_async *)0)->payload.direct);
+		opcode = HFI_IPEBPS_CMD_OPCODE_BPS_DESTROY;
+		break;
+	case CAM_ICP_DEV_IPE:
+		pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
+		packet_size = packet_size + sizeof(struct hfi_cmd_destroy) -
+			sizeof(((struct hfi_cmd_dev_async *)0)->payload.direct);
+		opcode = HFI_IPEBPS_CMD_OPCODE_IPE_DESTROY;
+		break;
+	case CAM_ICP_DEV_OFE:
+		pkt_type = HFI_CMD_OFE_ASYNC_COMMAND;
+		opcode = HFI_OFE_CMD_OPCODE_DESTROY;
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "%s: Invalid hw dev type not supported: %u",
+			ctx_data->ctx_id_string, ctx_data->device_info->hw_dev_type);
+		return -EINVAL;
+	}
+
+	destroy_cmd = kzalloc(packet_size, GFP_KERNEL);
+	if (!destroy_cmd) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	destroy_cmd->size = packet_size;
+	destroy_cmd->pkt_type = pkt_type;
+	destroy_cmd->opcode = opcode;
+	destroy_cmd->num_fw_handles = 1;
+	destroy_cmd->fw_handles_flex[0] = ctx_data->fw_handle;
+	destroy_cmd->user_data1 = PTR_TO_U64(ctx_data);
+	destroy_cmd->user_data2 = (uint64_t)0x0;
+
+	reinit_completion(&ctx_data->wait_complete);
+
+	rc = hfi_write_cmd(hw_mgr->hfi_handle, destroy_cmd);
+	if (rc) {
+		kfree(destroy_cmd);
+		return rc;
+	}
+	CAM_DBG(CAM_ICP, "%s: fw_handle = 0x%x ctx_data = %pK",
+		ctx_data->ctx_id_string, ctx_data->fw_handle, ctx_data);
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+			&ctx_data->wait_complete,
+			msecs_to_jiffies(timeout), CAM_ICP,
+			"%s: FW response timeout for Destroy handle command",
+			ctx_data->ctx_id_string);
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		cam_icp_dump_debug_info(hw_mgr, ctx_data->abort_timed_out);
+	}
+	kfree(destroy_cmd);
+	return rc;
+}
+
+static int cam_icp_mgr_release_ctx(struct cam_icp_hw_mgr *hw_mgr, int ctx_id)
+{
+	struct cam_icp_ctx_perf_stats *perf_stats;
+	int i = 0;
+
+	if (ctx_id >= CAM_ICP_CTX_MAX) {
+		CAM_ERR(CAM_ICP, "[%s] ctx_id is wrong: %d",
+			hw_mgr->hw_mgr_name, ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+	perf_stats = &hw_mgr->ctx_data[ctx_id].perf_stats;
+	CAM_DBG(CAM_PERF,
+		"Avg response time on %s: total_processed_requests: %llu avg_time: %llums",
+		hw_mgr->ctx_data[ctx_id].ctx_id_string, perf_stats->total_requests,
+		perf_stats->total_requests ?
+		(perf_stats->total_resp_time / perf_stats->total_requests) : 0);
+
+	memset(&hw_mgr->ctx_data[ctx_id].evt_inject_params, 0,
+		sizeof(struct cam_hw_inject_evt_param));
+	cam_icp_remove_ctx_bw(hw_mgr, &hw_mgr->ctx_data[ctx_id]);
+	if (hw_mgr->ctx_data[ctx_id].state !=
+		CAM_ICP_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+		CAM_DBG(CAM_ICP,
+			"%s: Not in right state to release: %d",
+			hw_mgr->ctx_data[ctx_id].ctx_id_string,
+			hw_mgr->ctx_data[ctx_id].state);
+		return 0;
+	}
+	cam_icp_mgr_dev_power_collapse(hw_mgr,
+		&hw_mgr->ctx_data[ctx_id], 0);
+	hw_mgr->ctx_data[ctx_id].state = CAM_ICP_CTX_STATE_RELEASE;
+	CAM_DBG(CAM_ICP, "%s: E: recovery = %d",
+		hw_mgr->ctx_data[ctx_id].ctx_id_string,
+		atomic_read(&hw_mgr->recovery));
+
+	if (!atomic_read(&hw_mgr->recovery)) {
+		cam_icp_mgr_abort_handle(&hw_mgr->ctx_data[ctx_id]);
+		cam_icp_mgr_destroy_handle(&hw_mgr->ctx_data[ctx_id]);
+	}
+
+	cam_icp_mgr_cleanup_ctx(&hw_mgr->ctx_data[ctx_id]);
+
+	hw_mgr->ctx_data[ctx_id].fw_handle = 0;
+	hw_mgr->ctx_data[ctx_id].scratch_mem_size = 0;
+	hw_mgr->ctx_data[ctx_id].last_flush_req = 0;
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++)
+		clear_bit(i, hw_mgr->ctx_data[ctx_id].hfi_frame_process.bitmap);
+	kfree(hw_mgr->ctx_data[ctx_id].hfi_frame_process.bitmap);
+	hw_mgr->ctx_data[ctx_id].hfi_frame_process.bitmap = NULL;
+	cam_icp_hw_mgr_clk_info_update(&hw_mgr->ctx_data[ctx_id]);
+	hw_mgr->ctx_data[ctx_id].clk_info.curr_fc = 0;
+	hw_mgr->ctx_data[ctx_id].clk_info.base_clk = 0;
+	hw_mgr->ctxt_cnt--;
+	kfree(hw_mgr->ctx_data[ctx_id].icp_dev_acquire_info);
+	hw_mgr->ctx_data[ctx_id].icp_dev_acquire_info = NULL;
+	hw_mgr->ctx_data[ctx_id].state = CAM_ICP_CTX_STATE_FREE;
+	cam_icp_ctx_timer_stop(&hw_mgr->ctx_data[ctx_id]);
+	hw_mgr->ctx_data[ctx_id].hw_mgr_priv = NULL;
+	mutex_unlock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+
+	CAM_DBG(CAM_ICP, "[%s] X: ctx_id = %d", hw_mgr->hw_mgr_name, ctx_id);
+	return 0;
+}
+
+static unsigned long cam_icp_hw_mgr_mini_dump_cb(void *dst, unsigned long len,
+	void *priv_data)
+{
+	struct cam_icp_hw_mini_dump_info   *md;
+	struct cam_icp_hw_ctx_mini_dump    *ctx_md;
+	struct cam_icp_hw_ctx_data         *ctx;
+	struct cam_icp_hw_mgr              *hw_mgr = NULL;
+	struct cam_hw_mini_dump_args        hw_dump_args;
+	struct cam_icp_hw_dump_args         icp_dump_args;
+	struct cam_hw_intf                 *icp_dev_intf = NULL;
+	uint32_t                            i = 0, j = 0;
+	unsigned long                       dumped_len = 0;
+	unsigned long                       remain_len = len;
+	int                                 rc = 0;
+	uint32_t                            hw_mgr_idx;
+
+	if (!dst || len < sizeof(*md)) {
+		CAM_ERR(CAM_ICP, "Invalid params dst %pk len %lu", dst, len);
+		return 0;
+	}
+
+	hw_mgr_idx = *((uint32_t *)priv_data);
+	if (hw_mgr_idx >= CAM_ICP_SUBDEV_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid index to hw mgr: %u", hw_mgr_idx);
+		return -EINVAL;
+	}
+
+	hw_mgr = g_icp_hw_mgr[hw_mgr_idx];
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Uninitialized hw mgr for subdev: %u", hw_mgr_idx);
+		return -EINVAL;
+	}
+
+	md = (struct cam_icp_hw_mini_dump_info *)dst;
+	md->num_context = 0;
+	cam_hfi_mini_dump(hw_mgr->hfi_handle, &md->hfi_info);
+	memcpy(md->hw_mgr_name, hw_mgr->hw_mgr_name, strlen(md->hw_mgr_name));
+	memcpy(&md->hfi_mem_info, &hw_mgr->hfi_mem,
+		sizeof(struct icp_hfi_mem_info));
+	memcpy(&md->dev_info, hw_mgr->dev_info,
+		hw_mgr->num_dev_info * sizeof(struct cam_icp_hw_device_info));
+	md->num_device_info = hw_mgr->num_dev_info;
+	md->recovery = atomic_read(&hw_mgr->recovery);
+	md->icp_booted = hw_mgr->icp_booted;
+	md->icp_resumed = hw_mgr->icp_resumed;
+	md->disable_ubwc_comp = hw_mgr->disable_ubwc_comp;
+	md->icp_pc_flag = hw_mgr->icp_pc_flag;
+	md->icp_use_pil = hw_mgr->icp_use_pil;
+
+	dumped_len += sizeof(*md);
+	remain_len = len -  dumped_len;
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		ctx = &hw_mgr->ctx_data[i];
+		if (ctx->state == CAM_ICP_CTX_STATE_FREE ||
+			ctx->state == CAM_ICP_CTX_STATE_RELEASE)
+			continue;
+
+		if (remain_len < sizeof(*ctx_md))
+			goto end;
+
+		md->num_context++;
+		ctx_md = (struct cam_icp_hw_ctx_mini_dump *)
+			    ((uint8_t *)dst + dumped_len);
+		md->ctx[i] = ctx_md;
+		ctx_md->state = ctx->state;
+		ctx_md->ctx_id = ctx->ctx_id;
+		memcpy(ctx_md->ctx_id_string, ctx->ctx_id_string,
+			strlen(ctx->ctx_id_string));
+		if (ctx->icp_dev_acquire_info) {
+			ctx_md->acquire.secure_mode =
+				ctx->icp_dev_acquire_info->secure_mode;
+			ctx_md->acquire.dev_type =
+				ctx->icp_dev_acquire_info->dev_type;
+			ctx_md->acquire.num_out_res =
+				ctx->icp_dev_acquire_info->num_out_res;
+			memcpy(&ctx_md->acquire.in_res,
+				&ctx->icp_dev_acquire_info->in_res,
+				sizeof(struct cam_icp_res_info));
+			memcpy(ctx_md->acquire.out_res,
+				ctx->icp_dev_acquire_info->out_res_flex,
+				sizeof(ctx->icp_dev_acquire_info->out_res));
+		} else {
+			memset(&ctx_md->acquire, 0,
+				sizeof(struct cam_icp_mini_dump_acquire_info));
+		}
+
+		memcpy(ctx_md->hfi_frame.request_id, ctx->hfi_frame_process.request_id,
+			sizeof(ctx->hfi_frame_process.request_id));
+		memcpy(ctx_md->hfi_frame.in_resource, ctx->hfi_frame_process.in_resource,
+			sizeof(ctx->hfi_frame_process.in_resource));
+		memcpy(ctx_md->hfi_frame.submit_timestamp,
+			ctx->hfi_frame_process.submit_timestamp,
+			sizeof(ctx->hfi_frame_process.submit_timestamp));
+		memcpy(ctx_md->hfi_frame.num_out_res, ctx->hfi_frame_process.num_out_resources,
+			sizeof(ctx->hfi_frame_process.num_out_resources));
+		memcpy(ctx_md->hfi_frame.out_res, ctx->hfi_frame_process.out_resource,
+			sizeof(ctx->hfi_frame_process.out_resource));
+		for (j = 0; j < CAM_FRAME_CMD_MAX; j++) {
+			ctx_md->hfi_frame.fw_process_flag[j] =
+				ctx->hfi_frame_process.fw_process_flag[j];
+		}
+
+		dumped_len += sizeof(*ctx_md);
+		remain_len = len - dumped_len;
+		hw_dump_args.len = remain_len;
+		hw_dump_args.bytes_written = 0;
+		hw_dump_args.start_addr = (void *)((uint8_t *)dst + dumped_len);
+		hw_mgr->mini_dump_cb(ctx->context_priv, &hw_dump_args);
+		if (dumped_len + hw_dump_args.bytes_written >= len)
+			goto end;
+
+		ctx_md->hw_ctx = hw_dump_args.start_addr;
+		dumped_len += hw_dump_args.bytes_written;
+		remain_len = len - dumped_len;
+	}
+
+	/* Dump fw image */
+	if (!hw_mgr->icp_use_pil) {
+		icp_dump_args.cpu_addr = (uintptr_t)((uint8_t *)dst + dumped_len);
+		icp_dump_args.offset = 0;
+		icp_dump_args.buf_len = remain_len;
+		icp_dev_intf = hw_mgr->icp_dev_intf;
+		rc = icp_dev_intf->hw_ops.process_cmd(
+			icp_dev_intf->hw_priv,
+			CAM_ICP_CMD_HW_MINI_DUMP, &icp_dump_args,
+			sizeof(struct cam_icp_hw_dump_args));
+		if (rc)
+			goto end;
+
+		dumped_len += icp_dump_args.offset;
+		md->fw_img = (void *)icp_dump_args.cpu_addr;
+	}
+end:
+	return dumped_len;
+}
+
+static void cam_icp_mgr_device_deinit(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_icp_hw_device_info *dev_info = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+	int i, j;
+	bool send_freq_info = false;
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		dev_info = &hw_mgr->dev_info[i];
+		for (j = 0; j < dev_info->hw_dev_cnt; j++) {
+			dev_intf = dev_info->dev_intf[j];
+			if (!dev_intf) {
+				CAM_ERR(CAM_ICP, "[%s] Device intf for %s[%u] is NULL",
+					hw_mgr->hw_mgr_name, dev_info->dev_name, j);
+				return;
+			}
+			dev_intf->hw_ops.deinit(dev_intf->hw_priv, NULL, 0);
+			dev_info->dev_ctx_info.dev_clk_state = false;
+		}
+	}
+
+	dev_intf = hw_mgr->icp_dev_intf;
+	if (!dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is NULL",
+			hw_mgr->hw_mgr_name);
+		return;
+	}
+	dev_intf->hw_ops.deinit(dev_intf->hw_priv, &send_freq_info, sizeof(send_freq_info));
+}
+
+static int cam_icp_mgr_hw_close(void *hw_priv, void *hw_close_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_priv;
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "[%s] Enter", hw_mgr->hw_mgr_name);
+	if (!hw_mgr->icp_booted) {
+		CAM_DBG(CAM_ICP, "[%s] hw mgr is already closed", hw_mgr->hw_mgr_name);
+		return 0;
+	}
+
+	if (!hw_mgr->icp_dev_intf) {
+		CAM_DBG(CAM_ICP, "[%s] ICP device interface is NULL", hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	cam_icp_mgr_proc_shutdown(hw_mgr);
+
+	cam_hfi_deinit(hw_mgr->hfi_handle);
+	cam_icp_free_hfi_mem(hw_mgr);
+
+	hw_mgr->icp_booted = false;
+
+	CAM_DBG(CAM_ICP, "[%s] Exit", hw_mgr->hw_mgr_name);
+	return rc;
+}
+
+static int cam_icp_mgr_device_init(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0, i, j;
+	struct cam_icp_hw_device_info *dev_info;
+	struct cam_hw_intf *dev_intf = NULL;
+	bool send_freq_info = false;
+
+	dev_intf = hw_mgr->icp_dev_intf;
+	if (!dev_intf) {
+		CAM_ERR(CAM_ICP, "Invalid ICP device interface");
+		return -EINVAL;
+	}
+	rc = dev_intf->hw_ops.init(dev_intf->hw_priv, &send_freq_info, sizeof(send_freq_info));
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Failed in ICP init rc=%d", rc);
+		return rc;
+	}
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		dev_info = &hw_mgr->dev_info[i];
+		for (j = 0; j < dev_info->hw_dev_cnt; j++) {
+			dev_intf = dev_info->dev_intf[j];
+			if (!dev_intf) {
+				CAM_ERR(CAM_ICP, "Device intf for %s[%u] is NULL",
+					dev_info->dev_name, j);
+				rc = -EINVAL;
+				goto hw_dev_deinit;
+			}
+
+			rc = dev_intf->hw_ops.init(dev_intf->hw_priv, NULL, 0);
+			if (rc) {
+				CAM_ERR(CAM_ICP, "[%s] Failed to init %s[%u]",
+					hw_mgr->hw_mgr_name, dev_info->dev_name, j);
+				goto hw_dev_deinit;
+			}
+			dev_info->dev_ctx_info.dev_clk_state = true;
+		}
+	}
+
+	return rc;
+
+hw_dev_deinit:
+	for (; i >= 0; i--) {
+		dev_info = &hw_mgr->dev_info[i];
+		j = (j == -1) ? (dev_info->hw_dev_cnt - 1) : (j - 1);
+		for (; j >= 0; j--) {
+			dev_intf = dev_info->dev_intf[j];
+			dev_intf->hw_ops.deinit(dev_intf->hw_priv, NULL, 0);
+		}
+		dev_info->dev_ctx_info.dev_clk_state = false;
+	}
+
+	dev_intf = hw_mgr->icp_dev_intf;
+	dev_intf->hw_ops.deinit(dev_intf->hw_priv, &send_freq_info, sizeof(send_freq_info));
+
+	return rc;
+}
+
+static int cam_icp_mgr_hfi_init(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	struct hfi_mem_info hfi_mem = {0};
+	const struct hfi_ops *hfi_ops;
+	int rc;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is invalid", hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	cam_icp_mgr_populate_hfi_mem_info(hw_mgr, &hfi_mem);
+	rc = cam_icp_get_hfi_device_ops(icp_dev_intf->hw_type, &hfi_ops);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Fail to get HFI device ops rc: %d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	if (hw_mgr->synx_signaling_en) {
+		/* Expect global sync to be at the start of FW uncached region */
+		if (hw_mgr->hfi_mem.fw_uncached_global_sync.iova >=
+			hw_mgr->hfi_mem.fw_uncached_generic.iova) {
+			CAM_ERR(CAM_ICP,
+				"global sync memory [start: 0x%x] expected to be at the start of FW uncached [uncached_generic start: 0x%x]",
+				hw_mgr->hfi_mem.fw_uncached_global_sync.iova,
+				hw_mgr->hfi_mem.fw_uncached_generic.iova);
+			return -EINVAL;
+		}
+
+		/*
+		 * Global sync memory is part of FW uncached region, but to FW remove this entry
+		 * from FW uncached to avoid it being mapped with FW uncached. Global sync
+		 * mem will be mapped with sharable attributes for IPC access, and hence
+		 * an independent mapping of it's own.
+		 */
+		hfi_mem.fw_uncached.iova += hw_mgr->hfi_mem.fw_uncached_global_sync.len;
+		hfi_mem.fw_uncached.len -= hw_mgr->hfi_mem.fw_uncached_global_sync.len;
+	}
+
+	rc = cam_hfi_init(hw_mgr->hfi_handle, &hfi_mem, hfi_ops,
+		icp_dev_intf->hw_priv, 0);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed to init HFI rc=%d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_ICP, "[%s] hw mgr succeed hfi init with hfi handle: %d",
+		hw_mgr->hw_mgr_name, hw_mgr->hfi_handle);
+
+	return rc;
+}
+
+static int cam_icp_mgr_send_fw_init(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "%s: ICP device interface is NULL", hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	reinit_completion(&hw_mgr->icp_complete);
+
+	CAM_DBG(CAM_ICP, "[%s] Sending HFI init command", hw_mgr->hw_mgr_name);
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+		CAM_ICP_SEND_INIT, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in sending HFI init command rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+		&hw_mgr->icp_complete,
+		msecs_to_jiffies(timeout), CAM_ICP,
+		"[%s] FW response timeout for FW init handle command",
+		hw_mgr->hw_mgr_name);
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		cam_icp_dump_debug_info(hw_mgr, false);
+	}
+	CAM_DBG(CAM_ICP, "[%s] Done Waiting for INIT DONE Message",
+		hw_mgr->hw_mgr_name);
+
+	return rc;
+}
+
+static int cam_icp_mgr_send_memory_region_info(
+	struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct hfi_cmd_prop *set_prop = NULL;
+	struct hfi_cmd_config_mem_regions *region_info = NULL;
+	uint32_t num_regions = 0;
+	size_t payload_size;
+
+	if (hw_mgr->synx_signaling_en)
+		num_regions += ICP_NUM_MEM_REGIONS_FOR_SYNX;
+
+	if (!num_regions)
+		return 0;
+
+	payload_size = sizeof(struct hfi_cmd_prop) +
+		(sizeof(struct hfi_cmd_config_mem_regions)) +
+		(sizeof(struct hfi_cmd_mem_region_info) * (num_regions - 1));
+
+	set_prop = kzalloc(payload_size, GFP_KERNEL);
+	if (!set_prop)
+		return -ENOMEM;
+
+	set_prop->size = payload_size;
+	set_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	set_prop->num_prop = 1;
+	set_prop->prop_data_flex[0] = HFI_PROP_SYS_MEM_REGIONS;
+
+	region_info = (struct hfi_cmd_config_mem_regions *)&set_prop->prop_data_flex[1];
+	if (hw_mgr->synx_signaling_en) {
+		/* Update synx global mem */
+		region_info->region_info_flex[region_info->num_valid_regions].region_id =
+			HFI_MEM_REGION_ID_IPCLITE_SHARED_MEM;
+		region_info->region_info_flex[region_info->num_valid_regions].region_type =
+			HFI_MEM_REGION_TYPE_UNCACHED;
+		region_info->region_info_flex[region_info->num_valid_regions].start_addr =
+			hw_mgr->hfi_mem.fw_uncached_global_sync.iova;
+		region_info->region_info_flex[region_info->num_valid_regions].size =
+			hw_mgr->hfi_mem.fw_uncached_global_sync.len;
+
+		region_info->num_valid_regions++;
+
+		/* Update synx hw_mutex mem */
+		region_info->region_info_flex[region_info->num_valid_regions].region_id =
+			HFI_MEM_REGION_ID_SYNX_HW_MUTEX;
+		region_info->region_info_flex[region_info->num_valid_regions].region_type =
+			HFI_MEM_REGION_TYPE_DEVICE;
+		region_info->region_info_flex[region_info->num_valid_regions].start_addr =
+			hw_mgr->hfi_mem.synx_hwmutex.iova;
+		region_info->region_info_flex[region_info->num_valid_regions].size =
+			hw_mgr->hfi_mem.synx_hwmutex.len;
+
+		region_info->num_valid_regions++;
+
+		/* Update ipc hw_mutex mem */
+		region_info->region_info_flex[region_info->num_valid_regions].region_id =
+			HFI_MEM_REGION_ID_GLOBAL_ATOMIC_HW_MUTEX;
+		region_info->region_info_flex[region_info->num_valid_regions].region_type =
+			HFI_MEM_REGION_TYPE_DEVICE;
+		region_info->region_info_flex[region_info->num_valid_regions].start_addr =
+			hw_mgr->hfi_mem.ipc_hwmutex.iova;
+		region_info->region_info_flex[region_info->num_valid_regions].size =
+			hw_mgr->hfi_mem.ipc_hwmutex.len;
+
+		region_info->num_valid_regions++;
+
+		/* Update global cntr mem */
+		region_info->region_info_flex[region_info->num_valid_regions].region_id =
+			HFI_MEM_REGION_ID_GLOBAL_CNTR;
+		region_info->region_info_flex[region_info->num_valid_regions].region_type =
+			HFI_MEM_REGION_TYPE_DEVICE;
+		region_info->region_info_flex[region_info->num_valid_regions].start_addr =
+			hw_mgr->hfi_mem.global_cntr.iova;
+		region_info->region_info_flex[region_info->num_valid_regions].size =
+			hw_mgr->hfi_mem.global_cntr.len;
+
+		region_info->num_valid_regions++;
+		CAM_DBG(CAM_ICP,
+			"Synx mem regions global_sync[0x%x:0x%x] synx_hw_mutex[0x%x:0x%x] ipc_hw_mutex[0x%x:0x%x] global_cntr[0x%x:0x%x]",
+			hw_mgr->hfi_mem.fw_uncached_global_sync.iova,
+			hw_mgr->hfi_mem.fw_uncached_global_sync.len,
+			hw_mgr->hfi_mem.synx_hwmutex.iova, hw_mgr->hfi_mem.synx_hwmutex.len,
+			hw_mgr->hfi_mem.ipc_hwmutex.iova, hw_mgr->hfi_mem.ipc_hwmutex.len,
+			hw_mgr->hfi_mem.global_cntr.iova, hw_mgr->hfi_mem.global_cntr.len);
+	}
+
+	CAM_DBG(CAM_ICP,
+		"Mem region property payload size: %zu num_regions: %u",
+		payload_size, region_info->num_valid_regions);
+
+	hfi_write_cmd(hw_mgr->hfi_handle, set_prop);
+	kfree(set_prop);
+
+	return 0;
+}
+
+static int cam_icp_mgr_hw_open_u(void *hw_mgr_priv, void *download_fw_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	int rc = 0;
+
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Null hw mgr");
+		return 0;
+	}
+
+	if (cam_presil_mode_enabled()) {
+		CAM_DBG(CAM_PRESIL, "[%s] hw_open from umd skipped for presil",
+			hw_mgr->hw_mgr_name);
+		return 0;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	rc = cam_icp_mgr_hw_open(hw_mgr, download_fw_args);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_icp_mgr_hw_open_k(void *hw_mgr_priv, void *download_fw_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	int rc;
+
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Null hw mgr");
+		return 0;
+	}
+
+	rc = cam_icp_mgr_hw_open(hw_mgr, download_fw_args);
+	CAM_DBG(CAM_ICP, "[%s] hw_open from kmd done %d",
+		hw_mgr->hw_mgr_name, rc);
+
+	return rc;
+}
+
+static int cam_icp_mgr_icp_resume(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	bool downloadFromResume = true, send_freq_info;
+
+	CAM_DBG(CAM_ICP, "[%s] Enter", hw_mgr->hw_mgr_name);
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is NULL", hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	if (!hw_mgr->icp_booted) {
+		CAM_DBG(CAM_ICP, "[%s] booting ICP processor", hw_mgr->hw_mgr_name);
+		return cam_icp_mgr_hw_open_k(hw_mgr, &downloadFromResume);
+	}
+
+	send_freq_info = true;
+	rc = icp_dev_intf->hw_ops.init(icp_dev_intf->hw_priv, &send_freq_info,
+		sizeof(send_freq_info));
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed to init ICP hw rc: %d", hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	rc = cam_icp_mgr_proc_resume(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed to resume proc rc: %d", hw_mgr->hw_mgr_name, rc);
+		goto hw_deinit;
+	}
+
+	rc = cam_icp_mgr_hfi_resume(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed to resume HFI rc: %d", hw_mgr->hw_mgr_name, rc);
+		goto power_collapse;
+	}
+
+	CAM_DBG(CAM_ICP, "[%s] Exit", hw_mgr->hw_mgr_name);
+	return rc;
+
+power_collapse:
+	__power_collapse(hw_mgr);
+hw_deinit:
+	send_freq_info = false;
+	icp_dev_intf->hw_ops.deinit(icp_dev_intf->hw_priv, &send_freq_info,
+		sizeof(send_freq_info));
+
+	return rc;
+}
+
+static int cam_icp_mgr_hw_open(void *hw_mgr_priv, void *download_fw_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	bool icp_pc = false;
+	uint32_t dump_type;
+	int rc = 0;
+
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "hw_mgr is NULL");
+		return -EINVAL;
+	}
+
+	if (hw_mgr->icp_booted) {
+		CAM_DBG(CAM_ICP, "[%s] ICP already booted", hw_mgr->hw_mgr_name);
+		return rc;
+	}
+
+	if (!hw_mgr->icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is invalid",
+			hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "[%s] Start icp hw open", hw_mgr->hw_mgr_name);
+
+	rc = cam_icp_allocate_hfi_mem(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in alloc hfi mem, rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		goto alloc_hfi_mem_failed;
+	}
+
+	rc = cam_icp_mgr_device_init(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in device init, rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		goto dev_init_fail;
+	}
+
+	rc = cam_icp_mgr_proc_boot(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in proc boot, rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		goto boot_failed;
+	}
+
+	rc = cam_icp_mgr_hfi_init(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in hfi init, rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		dump_type = (CAM_ICP_DUMP_STATUS_REGISTERS | CAM_ICP_DUMP_CSR_REGISTERS);
+		hw_mgr->icp_dev_intf->hw_ops.process_cmd(hw_mgr->icp_dev_intf->hw_priv,
+			CAM_ICP_CMD_HW_REG_DUMP, &dump_type, sizeof(dump_type));
+		goto hfi_init_failed;
+	}
+
+	rc = cam_icp_mgr_send_fw_init(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in sending fw init, rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		goto fw_init_failed;
+	}
+
+	rc = cam_icp_mgr_send_memory_region_info(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed in sending mem region info, rc %d",
+			hw_mgr->hw_mgr_name, rc);
+		goto fw_init_failed;
+	}
+
+	hw_mgr->ctxt_cnt = 0;
+	hw_mgr->icp_booted = true;
+	atomic_set(&hw_mgr->recovery, 0);
+
+	CAM_INFO(CAM_ICP, "[%s] FW download done successfully", hw_mgr->hw_mgr_name);
+
+	rc = cam_icp_device_deint(hw_mgr);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] Failed in ipe bps deinit rc %d",
+			hw_mgr->hw_mgr_name, rc);
+
+	if (download_fw_args)
+		icp_pc = *((bool *)download_fw_args);
+
+	if (icp_pc && hw_mgr->icp_pc_flag) {
+		rc = cam_icp_device_deint(hw_mgr);
+		if (rc)
+			CAM_ERR(CAM_ICP, "[%s] Failed in ipe bps deinit with icp_pc rc %d",
+				hw_mgr->hw_mgr_name, rc);
+
+		CAM_DBG(CAM_ICP, "[%s] deinit all clocks", hw_mgr->hw_mgr_name);
+	}
+
+	if (icp_pc)
+		return rc;
+
+	rc = cam_icp_mgr_icp_power_collapse(hw_mgr);
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] Failed in icp power collapse rc %d",
+			hw_mgr->hw_mgr_name, rc);
+
+	CAM_DBG(CAM_ICP, "[%s] deinit all clocks at boot up", hw_mgr->hw_mgr_name);
+
+	return rc;
+
+fw_init_failed:
+	cam_hfi_deinit(hw_mgr->hfi_handle);
+hfi_init_failed:
+	cam_icp_mgr_proc_shutdown(hw_mgr);
+boot_failed:
+	cam_icp_mgr_device_deinit(hw_mgr);
+dev_init_fail:
+	cam_icp_free_hfi_mem(hw_mgr);
+alloc_hfi_mem_failed:
+	return rc;
+}
+
+static int cam_icp_mgr_handle_config_err(
+	struct cam_hw_config_args *config_args,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	int idx)
+{
+	struct cam_icp_hw_buf_done_evt_data icp_evt_data;
+	struct cam_hw_done_event_data buf_data = {0};
+
+	buf_data.request_id = *(uint64_t *)config_args->priv;
+	buf_data.evt_param = CAM_SYNC_ICP_EVENT_CONFIG_ERR;
+	icp_evt_data.evt_id = CAM_CTX_EVT_ID_ERROR;
+	icp_evt_data.buf_done_data = &buf_data;
+	ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_ICP_EVT_ID_BUF_DONE,
+		&icp_evt_data);
+
+	ctx_data->hfi_frame_process.request_id[idx] = 0;
+	ctx_data->hfi_frame_process.fw_process_flag[idx] = false;
+	clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+
+	return 0;
+}
+
+static int cam_icp_mgr_enqueue_config(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_hw_config_args *config_args)
+{
+	int rc = 0;
+	uint64_t request_id = 0;
+	struct crm_workq_task *task;
+	struct hfi_cmd_work_data *task_data;
+	struct cam_hw_update_entry *hw_update_entries;
+	struct icp_frame_info *frame_info = NULL;
+
+	frame_info = (struct icp_frame_info *)config_args->priv;
+	request_id = frame_info->request_id;
+	hw_update_entries = config_args->hw_update_entries;
+	CAM_DBG(CAM_ICP, "[%s] req_id = %lld %pK",
+		hw_mgr->hw_mgr_name, request_id, config_args->priv);
+
+	task = cam_req_mgr_workq_get_task(hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "[%s] no empty task", hw_mgr->hw_mgr_name);
+		return -ENOMEM;
+	}
+
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)hw_update_entries->addr;
+	task_data->request_id = request_id;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_icp_mgr_send_config_io(struct cam_icp_hw_ctx_data *ctx_data,
+	uint32_t io_buf_addr)
+{
+	int rc = 0;
+	struct cam_icp_hw_mgr *hw_mgr = ctx_data->hw_mgr_priv;
+	struct hfi_cmd_work_data *task_data;
+	struct hfi_cmd_dev_async ioconfig_cmd;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+	struct crm_workq_task *task;
+	uint32_t size_in_words;
+
+	task = cam_req_mgr_workq_get_task(hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP, "%s: No free cmd task", ctx_data->ctx_id_string);
+		return -ENOMEM;
+	}
+
+	switch (ctx_data->device_info->hw_dev_type) {
+	case CAM_ICP_DEV_BPS:
+		ioconfig_cmd.opcode = HFI_IPEBPS_CMD_OPCODE_BPS_CONFIG_IO;
+		ioconfig_cmd.pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT;
+		break;
+	case CAM_ICP_DEV_IPE:
+		ioconfig_cmd.opcode = HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO;
+		ioconfig_cmd.pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT;
+		break;
+	case CAM_ICP_DEV_OFE:
+		ioconfig_cmd.opcode = HFI_OFE_CMD_OPCODE_CONFIG_IO;
+		ioconfig_cmd.pkt_type = HFI_CMD_OFE_ASYNC_COMMAND;
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "%s Invalid hw dev type not supported: %u",
+			ctx_data->ctx_id_string, ctx_data->device_info->hw_dev_type);
+		return -EINVAL;
+	}
+
+	reinit_completion(&ctx_data->wait_complete);
+
+	ioconfig_cmd.size = sizeof(struct hfi_cmd_dev_async);
+	ioconfig_cmd.num_fw_handles = 1;
+	ioconfig_cmd.fw_handles_flex[0] = ctx_data->fw_handle;
+	ioconfig_cmd.payload.indirect = io_buf_addr;
+	ioconfig_cmd.user_data1 = PTR_TO_U64(ctx_data);
+	ioconfig_cmd.user_data2 = (uint64_t)0x0;
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)&ioconfig_cmd;
+	task_data->request_id = 0;
+	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+	size_in_words = (*(uint32_t *)task_data->data) >> 2;
+	CAM_DBG(CAM_ICP, "%s: size_in_words %u",
+		ctx_data->ctx_id_string, size_in_words);
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP, "%s: Failed to enqueue io config task",
+			ctx_data->ctx_id_string);
+		return rc;
+	}
+
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+			&ctx_data->wait_complete,
+			msecs_to_jiffies(timeout), CAM_ICP,
+			"%s: FW response timeout for send IO cfg handle command on",
+			ctx_data->ctx_id_string);
+	if (!rem_jiffies) {
+		/* send specific error for io config failure */
+		rc = -EREMOTEIO;
+		cam_icp_dump_debug_info(hw_mgr, false);
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_send_recfg_io(struct cam_icp_hw_ctx_data *ctx_data,
+	struct hfi_cmd_dev_async *ioconfig_cmd, uint64_t req_id)
+{
+	int rc = 0;
+	struct cam_icp_hw_mgr *hw_mgr = ctx_data->hw_mgr_priv;
+	struct hfi_cmd_work_data *task_data;
+	struct crm_workq_task *task;
+
+	task = cam_req_mgr_workq_get_task(hw_mgr->cmd_work);
+	if (!task)
+		return -ENOMEM;
+
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)ioconfig_cmd;
+	task_data->request_id = req_id;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int cam_icp_mgr_config_hw(void *hw_mgr_priv, void *config_hw_args)
+{
+	int rc = 0;
+	int idx;
+	uint64_t req_id;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_config_args *config_args = config_hw_args;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct icp_frame_info *frame_info = NULL;
+
+	if (!hw_mgr || !config_args) {
+		CAM_ERR(CAM_ICP, "Invalid arguments %pK %pK",
+			hw_mgr, config_args);
+		return -EINVAL;
+	}
+
+	ctx_data = config_args->ctxt_to_hw_map;
+
+	if (!config_args->num_hw_update_entries) {
+		CAM_ERR(CAM_ICP, "%s: No hw update enteries are available",
+			ctx_data->ctx_id_string);
+		return -EINVAL;
+	}
+
+	if (cam_presil_mode_enabled()) {
+		CAM_DBG(CAM_PRESIL, "%s: presil: locking frame_in_process %d req id %u",
+			ctx_data->ctx_id_string, atomic_read(&hw_mgr->frame_in_process),
+			config_args->request_id);
+		down_write(&frame_in_process_sem);
+		atomic_set(&hw_mgr->frame_in_process, 1);
+		hw_mgr->frame_in_process_ctx_id = ctx_data->ctx_id;
+		CAM_DBG(CAM_PRESIL, "%s: presil: locked frame_in_process req id %u ctx_id %d",
+			ctx_data->ctx_id_string, config_args->request_id,
+			hw_mgr->frame_in_process_ctx_id);
+		msleep(100);
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->state != CAM_ICP_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_ICP, "%s: is not in use", ctx_data->ctx_id_string);
+		return -EINVAL;
+	}
+
+	frame_info = (struct icp_frame_info *)config_args->priv;
+	req_id = frame_info->request_id;
+	idx = cam_icp_get_frame_process_idx_from_req_id(ctx_data, req_id);
+	if (idx >= CAM_FRAME_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "%s: frame process index not found for req_id: %llu",
+			ctx_data->ctx_id_string, req_id);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	if (cam_presil_mode_enabled()) {
+		CAM_INFO(CAM_ICP, "%s: Sending relevant buffers for request: %llu to presil",
+			ctx_data->ctx_id_string, config_args->request_id);
+		cam_presil_send_buffers_from_packet(frame_info->pkt, hw_mgr->iommu_hdl,
+			hw_mgr->iommu_hdl);
+	}
+
+	cam_icp_mgr_dev_clk_update(hw_mgr, ctx_data, idx);
+	ctx_data->hfi_frame_process.fw_process_flag[idx] = true;
+	ctx_data->hfi_frame_process.submit_timestamp[idx] = ktime_get();
+
+	CAM_DBG(CAM_ICP, "%s: req_id %llu, io config %llu",
+		ctx_data->ctx_id_string, req_id, frame_info->io_config);
+
+	if (frame_info->io_config != 0) {
+		CAM_INFO(CAM_ICP, "%s: Send recfg io", ctx_data->ctx_id_string);
+		rc = cam_icp_mgr_send_recfg_io(ctx_data,
+			&frame_info->hfi_cfg_io_cmd, req_id);
+		if (rc)
+			CAM_ERR(CAM_ICP, "%s: Fail to send reconfig io cmd",
+				ctx_data->ctx_id_string);
+	}
+
+	if (req_id <= ctx_data->last_flush_req)
+		CAM_WARN(CAM_ICP,
+			"%s: Anomaly submitting flushed req %llu [last_flush %llu]",
+			ctx_data->ctx_id_string, req_id, ctx_data->last_flush_req);
+
+	cam_cpas_notify_event(ctx_data->ctx_id_string, req_id);
+
+	rc = cam_icp_mgr_enqueue_config(hw_mgr, config_args);
+	if (rc)
+		goto config_err;
+
+	CAM_DBG(CAM_REQ, "%s: req_id = %lld queued to FW",
+		ctx_data->ctx_id_string, req_id);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return 0;
+config_err:
+	cam_icp_mgr_handle_config_err(config_args, ctx_data, idx);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_prepare_frame_process_cmd(
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct hfi_cmd_dev_async *hfi_cmd,
+	uint64_t request_id,
+	uint32_t fw_cmd_buf_iova_addr)
+{
+	switch (ctx_data->device_info->hw_dev_type) {
+	case CAM_ICP_DEV_BPS:
+		hfi_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_BPS_FRAME_PROCESS;
+		hfi_cmd->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT;
+		break;
+	case CAM_ICP_DEV_IPE:
+		hfi_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_IPE_FRAME_PROCESS;
+		hfi_cmd->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT;
+		break;
+	case CAM_ICP_DEV_OFE:
+		hfi_cmd->opcode = HFI_OFE_CMD_OPCODE_FRAME_PROCESS;
+		hfi_cmd->pkt_type = HFI_CMD_OFE_ASYNC_COMMAND;
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "%s: Invalid hw dev type not supported: %u",
+			ctx_data->ctx_id_string, ctx_data->device_info->hw_dev_type);
+		return -EINVAL;
+	}
+
+	hfi_cmd->size = sizeof(struct hfi_cmd_dev_async);
+	hfi_cmd->num_fw_handles = 1;
+	hfi_cmd->fw_handles_flex[0] = ctx_data->fw_handle;
+	hfi_cmd->payload.indirect = fw_cmd_buf_iova_addr;
+	hfi_cmd->user_data1 = PTR_TO_U64(ctx_data);
+	hfi_cmd->user_data2 = request_id;
+
+	CAM_DBG(CAM_ICP, "%s: ctx_data : %pK, request_id :%lld cmd_buf %x",
+		ctx_data->ctx_id_string, (void *)ctx_data->context_priv, request_id,
+		fw_cmd_buf_iova_addr);
+
+	return 0;
+}
+
+static bool cam_icp_mgr_is_valid_inconfig(struct cam_packet *packet)
+{
+	int i, num_in_map_entries = 0;
+	bool in_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+		packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT)
+			num_in_map_entries++;
+
+	if (num_in_map_entries <= CAM_MAX_IN_RES)
+		in_config_valid = true;
+	else
+		CAM_ERR(CAM_ICP, "In config entries(%u) more than allowed(%u)",
+			num_in_map_entries, CAM_MAX_IN_RES);
+
+	CAM_DBG(CAM_ICP,
+		"number of io config: %u in config: %u max in res: %u",
+		packet->num_io_configs,
+		num_in_map_entries, CAM_MAX_IN_RES);
+
+	return in_config_valid;
+}
+
+static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet)
+{
+	int i, num_out_map_entries = 0;
+	bool out_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+		packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+		if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||
+			(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT))
+			num_out_map_entries++;
+
+	if (num_out_map_entries <= CAM_MAX_OUT_RES) {
+		out_config_valid = true;
+	} else {
+		CAM_ERR(CAM_ICP, "Out config entries(%u) more than allowed(%u)",
+			num_out_map_entries, CAM_MAX_OUT_RES);
+	}
+
+	CAM_DBG(CAM_ICP,
+		"number of io config: %u out config: %u max out res: %u",
+		packet->num_io_configs,
+		num_out_map_entries, CAM_MAX_OUT_RES);
+
+	return out_config_valid;
+}
+
+static int cam_icp_mgr_pkt_validation(struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_packet *packet)
+{
+	uint32_t op_code;
+	enum cam_icp_hw_type hw_dev_type;
+
+	op_code = packet->header.op_code & 0xff;
+	hw_dev_type = ctx_data->device_info->hw_dev_type;
+
+	if (((op_code != CAM_ICP_OPCODE_IPE_UPDATE) &&
+		hw_dev_type == CAM_ICP_DEV_IPE) ||
+		((op_code != CAM_ICP_OPCODE_BPS_UPDATE) &&
+		hw_dev_type == CAM_ICP_DEV_BPS) ||
+		((op_code != CAM_ICP_OPCODE_OFE_UPDATE) &&
+		hw_dev_type == CAM_ICP_DEV_OFE)) {
+		CAM_ERR(CAM_ICP, "%s: Invalid Opcode in pkt: %d device: %s",
+			ctx_data->ctx_id_string, op_code, ctx_data->device_info->dev_name);
+		return -EINVAL;
+	}
+
+	if (!packet->num_io_configs) {
+		CAM_ERR(CAM_ICP, "%s: Invalid number of io configs: %d",
+			ctx_data->ctx_id_string, packet->num_io_configs);
+		return -EINVAL;
+	}
+
+	if (!packet->num_cmd_buf || packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) {
+		CAM_ERR(CAM_ICP, "%s: Invalid number of cmd buffers: %d max cmd buf: %d",
+			ctx_data->ctx_id_string, packet->num_cmd_buf,
+			CAM_ICP_CTX_MAX_CMD_BUFFERS);
+		return -EINVAL;
+	}
+
+	if (!cam_icp_mgr_is_valid_inconfig(packet) ||
+		!cam_icp_mgr_is_valid_outconfig(packet)) {
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "%s: number of cmd/patch info: %u %u %u",
+		ctx_data->ctx_id_string, packet->num_cmd_buf, packet->num_io_configs,
+		packet->num_patches);
+
+	return 0;
+}
+
+static int cam_icp_mgr_process_cmd_desc(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_packet *packet, struct cam_icp_hw_ctx_data *ctx_data,
+	uint32_t *fw_cmd_buf_iova_addr, struct list_head *buf_tracker)
+{
+	int rc = 0;
+	int i;
+	dma_addr_t addr;
+	size_t len;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	uintptr_t cpu_addr = 0;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+	rc = cam_packet_util_validate_cmd_desc(cmd_desc);
+	if (rc)
+		return rc;
+
+	*fw_cmd_buf_iova_addr = 0;
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		if (cmd_desc[i].type == CAM_CMD_BUF_FW) {
+			rc = cam_mem_get_io_buf(cmd_desc[i].mem_handle,
+				hw_mgr->iommu_hdl, &addr, &len, NULL, buf_tracker);
+			if (rc) {
+				CAM_ERR(CAM_ICP, "%s: get cmd buf failed %x",
+					ctx_data->ctx_id_string, hw_mgr->iommu_hdl);
+				return rc;
+			}
+
+			/* FW buffers are expected to be within 32-bit address range */
+			*fw_cmd_buf_iova_addr = addr;
+
+			if ((cmd_desc[i].offset >= len) ||
+				((len - cmd_desc[i].offset) <
+				cmd_desc[i].size)) {
+				CAM_ERR(CAM_ICP,
+					"%s: Invalid offset, i: %d offset: %u len: %zu size: %zu",
+					ctx_data->ctx_id_string, i, cmd_desc[i].offset,
+					len, cmd_desc[i].size);
+				return -EINVAL;
+			}
+
+			*fw_cmd_buf_iova_addr =
+				(*fw_cmd_buf_iova_addr + cmd_desc[i].offset);
+			rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+				&cpu_addr, &len);
+			if (rc || !cpu_addr) {
+				CAM_ERR(CAM_ICP, "%s: get cmd buf failed %x",
+					ctx_data->ctx_id_string, hw_mgr->iommu_hdl);
+				*fw_cmd_buf_iova_addr = 0;
+				return rc;
+			}
+			if ((len <= cmd_desc[i].offset) ||
+				(cmd_desc[i].size < cmd_desc[i].length) ||
+				((len - cmd_desc[i].offset) <
+				cmd_desc[i].length)) {
+				CAM_ERR(CAM_ICP, "%s: Invalid offset or length",
+					ctx_data->ctx_id_string);
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				return -EINVAL;
+			}
+			cpu_addr = cpu_addr + cmd_desc[i].offset;
+
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+		}
+	}
+
+	if (!cpu_addr) {
+		CAM_ERR(CAM_ICP, "%s: invalid number of cmd buf", ctx_data->ctx_id_string);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prepare_args,
+	int32_t index)
+{
+	int i, j, k, rc = 0;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+	int32_t sync_in_obj[CAM_MAX_IN_RES];
+	int32_t merged_sync_in_obj;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+		packet->io_configs_offset/4);
+	prepare_args->num_out_map_entries = 0;
+	prepare_args->num_in_map_entries = 0;
+
+	for (i = 0, j = 0, k = 0; i < packet->num_io_configs; i++) {
+		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) {
+			sync_in_obj[j++] = io_cfg_ptr[i].fence;
+			prepare_args->num_in_map_entries++;
+		} else if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||
+			(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) {
+			prepare_args->out_map_entries[k].sync_id =
+				io_cfg_ptr[i].fence;
+			prepare_args->out_map_entries[k].resource_handle =
+				io_cfg_ptr[i].resource_type;
+			k++;
+			prepare_args->num_out_map_entries++;
+		} else {
+			CAM_ERR(CAM_ICP, "dir: %d, max_out:%u, out %u",
+				io_cfg_ptr[i].direction,
+				prepare_args->max_out_map_entries,
+				prepare_args->num_out_map_entries);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_REQ,
+			"%s: req_id: %llu dir[%d]: %u, fence: %u resource_type = %u memh %x",
+			ctx_data->ctx_id_string, packet->header.request_id, i,
+			io_cfg_ptr[i].direction, io_cfg_ptr[i].fence,
+			io_cfg_ptr[i].resource_type,
+			io_cfg_ptr[i].mem_handle[0]);
+	}
+
+	if (prepare_args->num_in_map_entries > 1)
+		prepare_args->num_in_map_entries =
+			cam_common_util_remove_duplicate_arr(
+			sync_in_obj, prepare_args->num_in_map_entries);
+
+	if (prepare_args->num_in_map_entries > 1) {
+		rc = cam_sync_merge(&sync_in_obj[0],
+			prepare_args->num_in_map_entries, &merged_sync_in_obj);
+		if (rc) {
+			prepare_args->num_out_map_entries = 0;
+			prepare_args->num_in_map_entries = 0;
+			return rc;
+		}
+
+		ctx_data->hfi_frame_process.in_resource[index] =
+			merged_sync_in_obj;
+		prepare_args->in_map_entries[0].sync_id = merged_sync_in_obj;
+		prepare_args->num_in_map_entries = 1;
+		CAM_DBG(CAM_REQ, "%s: req_id: %llu Merged Sync obj: %d",
+			ctx_data->ctx_id_string, packet->header.request_id,
+			merged_sync_in_obj);
+	} else if (prepare_args->num_in_map_entries == 1) {
+		prepare_args->in_map_entries[0].sync_id = sync_in_obj[0];
+		prepare_args->num_in_map_entries = 1;
+		ctx_data->hfi_frame_process.in_resource[index] = 0;
+	} else {
+		CAM_DBG(CAM_ICP, "%s: No input fences for req id: %llu",
+			ctx_data->ctx_id_string, packet->header.request_id);
+		prepare_args->num_in_map_entries = 0;
+		ctx_data->hfi_frame_process.in_resource[index] = 0;
+	}
+
+	return rc;
+}
+
+static int cam_icp_process_stream_settings(
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_cmd_mem_regions *cmd_mem_regions,
+	bool map_unmap)
+{
+	int rc = 0, i = 0;
+	size_t packet_size, map_cmd_size, len;
+	dma_addr_t iova;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+	struct hfi_cmd_ipe_bps_map  *map_cmd;
+	struct hfi_cmd_dev_async *async_direct;
+	struct cam_icp_hw_mgr *hw_mgr = ctx_data->hw_mgr_priv;
+
+	if (ctx_data->device_info->hw_dev_type == CAM_ICP_DEV_OFE) {
+		CAM_DBG(CAM_ICP, "%s OFE FW does not support map/unmap operations",
+			ctx_data->ctx_id_string);
+		return 0;
+	}
+
+	map_cmd_size =
+		sizeof(struct hfi_cmd_ipe_bps_map) +
+		((cmd_mem_regions->num_regions - 1) *
+		sizeof(struct mem_map_region_data));
+
+	map_cmd = kzalloc(map_cmd_size, GFP_KERNEL);
+	if (!map_cmd)
+		return -ENOMEM;
+
+	for (i = 0; i < cmd_mem_regions->num_regions; i++) {
+		rc = cam_mem_get_io_buf(
+			cmd_mem_regions->map_info_array_flex[i].mem_handle,
+			hw_mgr->iommu_hdl, &iova, &len, NULL, NULL);
+		if (rc) {
+			CAM_ERR(CAM_ICP,
+				"%s: Failed to get cmd region iova for handle %u",
+				ctx_data->ctx_id_string,
+				cmd_mem_regions->map_info_array_flex[i].mem_handle);
+			kfree(map_cmd);
+			return -EINVAL;
+		}
+
+		/* FW/CDM buffers are expected to be mapped in 32-bit address range */
+		map_cmd->mem_map_region_sets_flex[i].start_addr = (uint32_t)iova +
+			(cmd_mem_regions->map_info_array_flex[i].offset);
+		map_cmd->mem_map_region_sets_flex[i].len = (uint32_t) len;
+
+		CAM_DBG(CAM_ICP, "%s: Region %u mem_handle %d iova %pK len %u",
+			ctx_data->ctx_id_string, (i+1),
+			cmd_mem_regions->map_info_array_flex[i].mem_handle,
+			(uint32_t)iova, (uint32_t)len);
+	}
+
+	map_cmd->mem_map_request_num = cmd_mem_regions->num_regions;
+	map_cmd->user_data = 0;
+
+	packet_size =
+		sizeof(struct hfi_cmd_dev_async) +
+		(sizeof(struct hfi_cmd_ipe_bps_map) +
+		((cmd_mem_regions->num_regions - 1) *
+		sizeof(struct mem_map_region_data))) -
+		sizeof(((struct hfi_cmd_dev_async *)0)->payload.direct);
+
+	async_direct = kzalloc(packet_size, GFP_KERNEL);
+	if (!async_direct) {
+		kfree(map_cmd);
+		return -ENOMEM;
+	}
+
+	async_direct->size = packet_size;
+	async_direct->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
+	if (map_unmap)
+		async_direct->opcode = HFI_IPEBPS_CMD_OPCODE_MEM_MAP;
+	else
+		async_direct->opcode = HFI_IPEBPS_CMD_OPCODE_MEM_UNMAP;
+	async_direct->num_fw_handles = 1;
+	async_direct->fw_handles_flex[0] = ctx_data->fw_handle;
+	async_direct->user_data1 = (uint64_t)ctx_data;
+	async_direct->user_data2 = (uint64_t)0x0;
+	memcpy(async_direct->payload.direct_flex, map_cmd,
+		map_cmd_size);
+
+	reinit_completion(&ctx_data->wait_complete);
+	rc = hfi_write_cmd(hw_mgr->hfi_handle, async_direct);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "%s: hfi write failed  rc %d",
+			ctx_data->ctx_id_string, rc);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ICP, "%s: Sent FW %s cmd", ctx_data->ctx_id_string,
+		map_unmap ? "Map" : "Unmap");
+
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+			&ctx_data->wait_complete,
+			msecs_to_jiffies(timeout), CAM_ICP,
+			"%s: FW response timeout for process stream setting handle command",
+			ctx_data->ctx_id_string);
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		cam_icp_dump_debug_info(ctx_data->hw_mgr_priv, false);
+	}
+
+end:
+	kfree(map_cmd);
+	kfree(async_direct);
+	return rc;
+}
+
+static int cam_icp_process_presil_hangdump_info(
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_cmd_mem_regions *cmd_mem_regions,
+	uint32_t index)
+{
+	int i = 0;
+	struct cam_hangdump_mem_regions *mem_regions = NULL;
+
+	if (!ctx_data || !cmd_mem_regions) {
+		CAM_ERR(CAM_ICP, "Invalid hangdump info blob ctx %pK mem_region %pK",
+			ctx_data, cmd_mem_regions);
+		return -EINVAL;
+	}
+
+	if ((cmd_mem_regions->num_regions == 0) ||
+		(cmd_mem_regions->num_regions > HANG_DUMP_REGIONS_MAX)) {
+		CAM_ERR(CAM_ICP, "%s Invalid num hangdump mem regions %d ",
+			ctx_data->ctx_id_string, cmd_mem_regions->num_regions);
+		return -EINVAL;
+	}
+
+	mem_regions = &ctx_data->hfi_frame_process.hangdump_mem_regions[index];
+	CAM_INFO(CAM_ICP, "%s Hangdump Mem Num Regions %d index %d  mem_regions 0x%pK",
+		ctx_data->ctx_id_string, cmd_mem_regions->num_regions, index, mem_regions);
+
+	for (i = 0; i < cmd_mem_regions->num_regions; i++) {
+		mem_regions->mem_info_array[i].mem_handle =
+			cmd_mem_regions->map_info_array_flex[i].mem_handle;
+		mem_regions->mem_info_array[i].offset =
+			cmd_mem_regions->map_info_array_flex[i].offset;
+		mem_regions->mem_info_array[i].size =
+			cmd_mem_regions->map_info_array_flex[i].size;
+		CAM_INFO(CAM_ICP, "%s Hangdump Mem Region %u mem_handle 0x%08x iova 0x%08x len %u",
+			ctx_data->ctx_id_string, i,
+			cmd_mem_regions->map_info_array_flex[i].mem_handle,
+			(uint32_t)cmd_mem_regions->map_info_array_flex[i].offset,
+			(uint32_t)cmd_mem_regions->map_info_array_flex[i].size);
+	}
+	mem_regions->num_mem_regions = cmd_mem_regions->num_regions;
+
+	return 0;
+}
+
+static int cam_icp_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	struct cam_icp_clk_bw_request *soc_req;
+	struct cam_icp_clk_bw_request *clk_info;
+	struct cam_icp_clk_bw_request_v2 *soc_req_v2;
+	struct cam_icp_clk_bw_req_internal_v2 *clk_info_v2;
+	struct cam_cmd_mem_regions *cmd_mem_regions;
+	struct icp_cmd_generic_blob *blob;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	struct cam_icp_hw_mgr *hw_mgr;
+	struct cam_icp_acquire_dev_info dev_io_info;
+	uint32_t index;
+	size_t io_buf_size, clk_update_size;
+	int rc = 0;
+	uintptr_t pResource;
+	uint32_t i = 0;
+
+	if (!blob_data || (blob_size == 0)) {
+		CAM_ERR(CAM_ICP, "Invalid blob info %pK %d", blob_data,
+			blob_size);
+		return -EINVAL;
+	}
+
+	blob = (struct icp_cmd_generic_blob *)user_data;
+	ctx_data = blob->ctx;
+	hw_mgr = ctx_data->hw_mgr_priv;
+	index = blob->frame_info_idx;
+
+	switch (blob_type) {
+	case CAM_ICP_CMD_GENERIC_BLOB_CLK:
+		if (index < 0) {
+			CAM_ERR(CAM_ICP, "Invalid index %d", index);
+			return -EINVAL;
+		}
+
+		CAM_WARN_RATE_LIMIT_CUSTOM(CAM_PERF, 300, 1,
+			"Using deprecated blob type GENERIC_BLOB_CLK");
+		if (blob_size != sizeof(struct cam_icp_clk_bw_request)) {
+			CAM_ERR(CAM_ICP, "%s: Mismatch blob size %d expected %lu",
+				ctx_data->ctx_id_string, blob_size,
+				sizeof(struct cam_icp_clk_bw_request));
+			return -EINVAL;
+		}
+
+		if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_UNKNOWN) {
+			ctx_data->bw_config_version = CAM_ICP_BW_CONFIG_V1;
+		} else if (ctx_data->bw_config_version !=
+			CAM_ICP_BW_CONFIG_V1) {
+			CAM_ERR(CAM_ICP,
+				"%s: Mismatch blob versions %d expected v1 %d, blob_type=%d",
+				ctx_data->ctx_id_string, ctx_data->bw_config_version,
+				CAM_ICP_BW_CONFIG_V1, blob_type);
+			return -EINVAL;
+		}
+
+		clk_info = &ctx_data->hfi_frame_process.clk_info[index];
+
+		soc_req = (struct cam_icp_clk_bw_request *)blob_data;
+		*clk_info = *soc_req;
+		CAM_DBG(CAM_PERF, "%s: budget:%llu fc: %llu %d BW %lld %lld",
+			ctx_data->ctx_id_string, clk_info->budget_ns, clk_info->frame_cycles,
+			clk_info->rt_flag, clk_info->uncompressed_bw,
+			clk_info->compressed_bw);
+		break;
+
+	case CAM_ICP_CMD_GENERIC_BLOB_CLK_V2:
+		if (index < 0) {
+			CAM_ERR(CAM_ICP, "Invalid index %d", index);
+			return -EINVAL;
+		}
+
+		if (blob_size < sizeof(struct cam_icp_clk_bw_request_v2)) {
+			CAM_ERR(CAM_ICP, "%s: Mismatch blob size %d expected %lu",
+				ctx_data->ctx_id_string,
+				blob_size,
+				sizeof(struct cam_icp_clk_bw_request_v2));
+			return -EINVAL;
+		}
+
+		if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_UNKNOWN) {
+			ctx_data->bw_config_version = CAM_ICP_BW_CONFIG_V2;
+		} else if (ctx_data->bw_config_version !=
+			CAM_ICP_BW_CONFIG_V2) {
+			CAM_ERR(CAM_ICP,
+				"%s: Mismatch blob versions %d expected v2 %d, blob_type=%d",
+				ctx_data->ctx_id_string, ctx_data->bw_config_version,
+				CAM_ICP_BW_CONFIG_V2, blob_type);
+			return -EINVAL;
+		}
+
+		soc_req_v2 = (struct cam_icp_clk_bw_request_v2 *)blob_data;
+		if (soc_req_v2->num_paths > CAM_ICP_MAX_PER_PATH_VOTES) {
+			CAM_ERR(CAM_PERF, "%s: Invalid num paths: %d",
+				ctx_data->ctx_id_string, soc_req_v2->num_paths);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (soc_req_v2->num_paths != 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote) >
+				((UINT_MAX -
+				sizeof(struct cam_icp_clk_bw_request_v2)) /
+				(soc_req_v2->num_paths - 1))) {
+				CAM_ERR(CAM_ICP,
+					"%s: Size exceeds limit paths:%u size per path:%lu",
+					ctx_data->ctx_id_string, soc_req_v2->num_paths - 1,
+					sizeof(struct cam_axi_per_path_bw_vote));
+				return -EINVAL;
+			}
+		}
+
+		clk_update_size = sizeof(struct cam_icp_clk_bw_request_v2) +
+			((soc_req_v2->num_paths - 1) * sizeof(struct cam_axi_per_path_bw_vote));
+		if (blob_size < clk_update_size) {
+			CAM_ERR(CAM_ICP, "%s: Invalid blob size: %u",
+				ctx_data->ctx_id_string, blob_size);
+			return -EINVAL;
+		}
+
+		clk_info = &ctx_data->hfi_frame_process.clk_info[index];
+		clk_info_v2 = &ctx_data->hfi_frame_process.clk_info_v2[index];
+		clk_info_v2->budget_ns = soc_req_v2->budget_ns;
+		clk_info_v2->frame_cycles = soc_req_v2->frame_cycles;
+		clk_info_v2->rt_flag = soc_req_v2->rt_flag;
+		clk_info_v2->num_paths = soc_req_v2->num_paths;
+
+		for (i = 0; i < soc_req_v2->num_paths; i++) {
+			clk_info_v2->axi_path[i].usage_data =
+				soc_req_v2->axi_path_flex[i].usage_data;
+			clk_info_v2->axi_path[i].transac_type =
+				soc_req_v2->axi_path_flex[i].transac_type;
+			clk_info_v2->axi_path[i].path_data_type =
+				soc_req_v2->axi_path_flex[i].path_data_type;
+			clk_info_v2->axi_path[i].vote_level = 0;
+			clk_info_v2->axi_path[i].camnoc_bw = soc_req_v2->axi_path_flex[i].camnoc_bw;
+			clk_info_v2->axi_path[i].mnoc_ab_bw =
+				soc_req_v2->axi_path_flex[i].mnoc_ab_bw;
+			clk_info_v2->axi_path[i].mnoc_ib_bw =
+				soc_req_v2->axi_path_flex[i].mnoc_ib_bw;
+		}
+
+		/* Use v1 structure for clk fields */
+		clk_info->budget_ns = clk_info_v2->budget_ns;
+		clk_info->frame_cycles = clk_info_v2->frame_cycles;
+		clk_info->rt_flag = clk_info_v2->rt_flag;
+
+		CAM_DBG(CAM_PERF,
+			"%s: budget=%llu, frame_cycle=%llu, rt_flag=%d, num_paths=%d, index=%d, ctx_data=%pK",
+			ctx_data->ctx_id_string, clk_info_v2->budget_ns,
+			clk_info_v2->frame_cycles, clk_info_v2->rt_flag, clk_info_v2->num_paths,
+			index, ctx_data);
+
+		for (i = 0; i < clk_info_v2->num_paths; i++) {
+			CAM_DBG(CAM_PERF,
+				"%s: [%d] : path_type=%d, trans_type=%d, camnoc=%lld, mnoc_ab=%lld, mnoc_ib=%lld",
+				ctx_data->ctx_id_string,
+				i,
+				clk_info_v2->axi_path[i].path_data_type,
+				clk_info_v2->axi_path[i].transac_type,
+				clk_info_v2->axi_path[i].camnoc_bw,
+				clk_info_v2->axi_path[i].mnoc_ab_bw,
+				clk_info_v2->axi_path[i].mnoc_ib_bw);
+		}
+
+		break;
+
+	case CAM_ICP_CMD_GENERIC_BLOB_CFG_IO:
+		CAM_DBG(CAM_ICP, "%s: CAM_ICP_CMD_GENERIC_BLOB_CFG_IO", ctx_data->ctx_id_string);
+		pResource = *((uint32_t *)blob_data);
+		if (copy_from_user(&dev_io_info,
+			(void __user *)pResource,
+			sizeof(struct cam_icp_acquire_dev_info))) {
+			CAM_ERR(CAM_ICP, "%s: Failed in copy from user", ctx_data->ctx_id_string);
+			return -EFAULT;
+		}
+		CAM_DBG(CAM_ICP, "%s: buf handle %d", ctx_data->ctx_id_string,
+			dev_io_info.io_config_cmd_handle);
+		rc = cam_mem_get_io_buf(dev_io_info.io_config_cmd_handle, hw_mgr->iommu_hdl,
+			blob->io_buf_addr, &io_buf_size, NULL, NULL);
+		if (rc)
+			CAM_ERR(CAM_ICP, "%s: Failed in blob update", ctx_data->ctx_id_string);
+		else
+			CAM_DBG(CAM_ICP, "%s: io buf addr %llu",
+				ctx_data->ctx_id_string, *blob->io_buf_addr);
+		break;
+
+	case CAM_ICP_CMD_GENERIC_BLOB_FW_MEM_MAP:
+		cmd_mem_regions =
+			(struct cam_cmd_mem_regions *)blob_data;
+		if (cmd_mem_regions->num_regions <= 0) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_ICP,
+				"%s: Invalid number of regions for FW map %u",
+				ctx_data->ctx_id_string, cmd_mem_regions->num_regions);
+		} else {
+			CAM_DBG(CAM_ICP,
+				"%s: Processing blob for mapping %u regions",
+				ctx_data->ctx_id_string, cmd_mem_regions->num_regions);
+			rc = cam_icp_process_stream_settings(ctx_data,
+				cmd_mem_regions, true);
+		}
+		break;
+
+	case CAM_ICP_CMD_GENERIC_BLOB_FW_MEM_UNMAP:
+		cmd_mem_regions =
+			(struct cam_cmd_mem_regions *)blob_data;
+		if (cmd_mem_regions->num_regions <= 0) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_ICP,
+				"%s: Invalid number of regions for FW unmap %u",
+				ctx_data->ctx_id_string, cmd_mem_regions->num_regions);
+		} else {
+			CAM_DBG(CAM_ICP,
+				"%s: Processing blob for unmapping %u regions",
+				ctx_data->ctx_id_string, cmd_mem_regions->num_regions);
+			rc = cam_icp_process_stream_settings(ctx_data,
+				cmd_mem_regions, false);
+		}
+		break;
+
+	case CAM_ICP_CMD_GENERIC_BLOB_PRESIL_HANGDUMP:
+		if (index < 0) {
+			CAM_ERR(CAM_ICP, "Invalid index %d", index);
+			return -EINVAL;
+		}
+
+		if (cam_presil_mode_enabled()) {
+			cmd_mem_regions = (struct cam_cmd_mem_regions *)blob_data;
+			if (cmd_mem_regions->num_regions <= 0) {
+				CAM_INFO(CAM_ICP, "%s: Pre-sil Hangdump disabled %u",
+					ctx_data->ctx_id_string, cmd_mem_regions->num_regions);
+			} else {
+				CAM_INFO(CAM_ICP,
+					"%s: Pre-sil Hangdump enabled %u entries index %d",
+					ctx_data->ctx_id_string, cmd_mem_regions->num_regions,
+					index);
+				rc = cam_icp_process_presil_hangdump_info(ctx_data,
+					cmd_mem_regions, index);
+			}
+		}
+		break;
+
+	default:
+		CAM_WARN(CAM_ICP, "%s: Invalid blob type %d", ctx_data->ctx_id_string,
+			blob_type);
+		break;
+	}
+	return rc;
+}
+
+static int cam_icp_process_generic_cmd_buffer(
+	struct cam_packet *packet,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	int32_t index,
+	dma_addr_t *io_buf_addr)
+{
+	int i, rc = 0;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct icp_cmd_generic_blob cmd_generic_blob;
+
+	cmd_generic_blob.ctx = ctx_data;
+	cmd_generic_blob.frame_info_idx = index;
+	cmd_generic_blob.io_buf_addr = io_buf_addr;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data != CAM_ICP_CMD_META_GENERIC_BLOB)
+			continue;
+
+		rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+			cam_icp_packet_generic_blob_handler, &cmd_generic_blob);
+		if (rc)
+			CAM_ERR(CAM_ICP, "Failed in processing blobs %d", rc);
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_process_cfg_io_cmd(
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct hfi_cmd_dev_async *ioconfig_cmd,
+	uint64_t request_id,
+	uint64_t io_config)
+{
+	switch (ctx_data->device_info->hw_dev_type) {
+	case CAM_ICP_DEV_BPS:
+		ioconfig_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_BPS_CONFIG_IO;
+		ioconfig_cmd->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT;
+		break;
+	case CAM_ICP_DEV_IPE:
+		ioconfig_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO;
+		ioconfig_cmd->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT;
+		break;
+	case CAM_ICP_DEV_OFE:
+		ioconfig_cmd->opcode = HFI_OFE_CMD_OPCODE_CONFIG_IO;
+		ioconfig_cmd->pkt_type = HFI_CMD_OFE_ASYNC_COMMAND;
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "%s: Invalid device type %u not supported",
+			ctx_data->ctx_id_string, ctx_data->device_info->hw_dev_type);
+		return -EINVAL;
+	}
+
+	ioconfig_cmd->size = sizeof(struct hfi_cmd_dev_async);
+	ioconfig_cmd->num_fw_handles = 1;
+	ioconfig_cmd->fw_handles_flex[0] = ctx_data->fw_handle;
+	ioconfig_cmd->payload.indirect = io_config;
+	ioconfig_cmd->user_data1 = PTR_TO_U64(ctx_data);
+	ioconfig_cmd->user_data2 = request_id;
+
+	return 0;
+}
+
+static int cam_icp_mgr_update_hfi_frame_process(
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prepare_args,
+	int32_t *idx)
+{
+	int32_t index, rc;
+	struct hfi_cmd_dev_async *hfi_cmd = NULL;
+
+	index = find_first_zero_bit(ctx_data->hfi_frame_process.bitmap,
+		ctx_data->hfi_frame_process.bits);
+	if (index < 0 || index >= CAM_FRAME_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "%s request idx is wrong: %d",
+			ctx_data->ctx_id_string, index);
+		return -EINVAL;
+	}
+	set_bit(index, ctx_data->hfi_frame_process.bitmap);
+
+	ctx_data->hfi_frame_process.request_id[index] =
+		packet->header.request_id;
+	ctx_data->hfi_frame_process.frame_info[index].request_id =
+		packet->header.request_id;
+	ctx_data->hfi_frame_process.frame_info[index].io_config = 0;
+	ctx_data->hfi_frame_process.frame_info[index].pkt = packet;
+	rc = cam_icp_process_generic_cmd_buffer(packet, ctx_data, index,
+		&ctx_data->hfi_frame_process.frame_info[index].io_config);
+	if (rc) {
+		clear_bit(index, ctx_data->hfi_frame_process.bitmap);
+		ctx_data->hfi_frame_process.request_id[index] = -1;
+		return rc;
+	}
+
+	if (ctx_data->hfi_frame_process.frame_info[index].io_config) {
+		hfi_cmd = (struct hfi_cmd_dev_async *)
+		&ctx_data->hfi_frame_process.frame_info[index].hfi_cfg_io_cmd;
+		rc = cam_icp_mgr_process_cfg_io_cmd(ctx_data, hfi_cmd,
+			packet->header.request_id,
+			ctx_data->hfi_frame_process.frame_info[index].io_config);
+	}
+	*idx = index;
+
+	return rc;
+}
+
+static int cam_icp_mgr_config_stream_settings(
+	void *hw_mgr_priv, void *hw_stream_settings)
+{
+	int        rc = 0;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct cam_packet *packet = NULL;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct icp_cmd_generic_blob cmd_generic_blob;
+	struct cam_hw_stream_setttings *config_args =
+		hw_stream_settings;
+
+	if ((!hw_stream_settings) ||
+		(!hw_mgr) || (!config_args->packet)) {
+		CAM_ERR(CAM_ICP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	ctx_data = config_args->ctxt_to_hw_map;
+	mutex_lock(&ctx_data->ctx_mutex);
+	packet = config_args->packet;
+
+	cmd_generic_blob.ctx = ctx_data;
+	cmd_generic_blob.frame_info_idx = -1;
+	cmd_generic_blob.io_buf_addr = NULL;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+
+	rc = cam_packet_util_validate_cmd_desc(cmd_desc);
+	if (rc)
+		goto end;
+
+	if (!cmd_desc[0].length ||
+		cmd_desc[0].meta_data != CAM_ICP_CMD_META_GENERIC_BLOB) {
+		CAM_ERR(CAM_ICP, "%s: Invalid cmd buffer length/metadata",
+			ctx_data->ctx_id_string);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[0],
+		cam_icp_packet_generic_blob_handler, &cmd_generic_blob);
+	if (rc)
+		CAM_ERR(CAM_ICP, "%s: Failed in processing cmd mem blob %d",
+		ctx_data->ctx_id_string, rc);
+
+end:
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int        rc = 0;
+	int32_t    idx;
+	uint32_t   fw_cmd_buf_iova_addr;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct cam_packet *packet = NULL;
+	struct hfi_cmd_dev_async *hfi_cmd = NULL;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_prepare_update_args *prepare_args =
+		prepare_hw_update_args;
+
+	if ((!prepare_args) || (!hw_mgr) || (!prepare_args->packet)) {
+		CAM_ERR(CAM_ICP, "Invalid args");
+		return -EINVAL;
+	}
+
+	ctx_data = prepare_args->ctxt_to_hw_map;
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->state != CAM_ICP_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_ICP, "%s: is not in use", ctx_data->ctx_id_string);
+		return -EINVAL;
+	}
+
+	packet = prepare_args->packet;
+
+	if (cam_packet_util_validate_packet(packet, prepare_args->remain_len)) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return -EINVAL;
+	}
+
+	rc = cam_icp_mgr_pkt_validation(ctx_data, packet);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	rc = cam_icp_mgr_process_cmd_desc(hw_mgr, packet,
+		ctx_data, &fw_cmd_buf_iova_addr, prepare_args->buf_tracker);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	CAM_DBG(CAM_REQ, "%s: req id = %lld", ctx_data->ctx_id_string,
+		packet->header.request_id);
+	/* Update Buffer Address from handles and patch information */
+	rc = cam_packet_util_process_patches(packet, prepare_args->buf_tracker,
+		hw_mgr->iommu_hdl, hw_mgr->iommu_sec_hdl, true);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	rc = cam_icp_mgr_update_hfi_frame_process(ctx_data, packet,
+		prepare_args, &idx);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	rc = cam_icp_mgr_process_io_cfg(hw_mgr, ctx_data,
+		packet, prepare_args, idx);
+	if (rc) {
+		if (ctx_data->hfi_frame_process.in_resource[idx] > 0)
+			cam_sync_destroy(
+				ctx_data->hfi_frame_process.in_resource[idx]);
+		clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+		ctx_data->hfi_frame_process.request_id[idx] = -1;
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	hfi_cmd = (struct hfi_cmd_dev_async *)
+			&ctx_data->hfi_frame_process.hfi_frame_cmd[idx];
+	cam_icp_mgr_prepare_frame_process_cmd(
+		ctx_data, hfi_cmd, packet->header.request_id,
+		fw_cmd_buf_iova_addr);
+
+	prepare_args->num_hw_update_entries = 1;
+	prepare_args->hw_update_entries[0].addr = (uintptr_t)hfi_cmd;
+	prepare_args->priv = &ctx_data->hfi_frame_process.frame_info[idx];
+
+	CAM_DBG(CAM_ICP, "%s: X: req id = %lld", ctx_data->ctx_id_string,
+		packet->header.request_id);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_send_abort_status(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct hfi_frame_process_info *hfi_frame_process;
+	struct cam_icp_hw_buf_done_evt_data icp_evt_data;
+	struct cam_hw_done_event_data buf_data = {0};
+	int idx;
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	buf_data.evt_param = CAM_SYNC_ICP_EVENT_ABORTED;
+	icp_evt_data.evt_id = CAM_CTX_EVT_ID_CANCEL;
+	for (idx = 0; idx < CAM_FRAME_CMD_MAX; idx++) {
+		if (!hfi_frame_process->request_id[idx])
+			continue;
+
+		buf_data.request_id = hfi_frame_process->request_id[idx];
+		icp_evt_data.buf_done_data = &buf_data;
+		ctx_data->ctxt_event_cb(ctx_data->context_priv,
+			CAM_ICP_EVT_ID_BUF_DONE,
+			&icp_evt_data);
+
+		/* now release memory for hfi frame process command */
+		hfi_frame_process->request_id[idx] = 0;
+		if (ctx_data->hfi_frame_process.in_resource[idx] > 0) {
+			CAM_DBG(CAM_ICP, "%s: Delete merged sync in object: %d",
+				ctx_data->ctx_id_string,
+				ctx_data->hfi_frame_process.in_resource[idx]);
+			cam_sync_destroy(
+				ctx_data->hfi_frame_process.in_resource[idx]);
+			ctx_data->hfi_frame_process.in_resource[idx] = 0;
+		}
+		clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+	}
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return 0;
+}
+
+static int cam_icp_mgr_delete_sync(void *priv, void *data)
+{
+	struct hfi_cmd_work_data *task_data = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	struct hfi_frame_process_info *hfi_frame_process;
+	int idx;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_ICP, "Invalid params%pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	task_data = (struct hfi_cmd_work_data *)data;
+	ctx_data = task_data->data;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Null Context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	for (idx = 0; idx < CAM_FRAME_CMD_MAX; idx++) {
+		if (!hfi_frame_process->in_free_resource[idx])
+			continue;
+		//cam_sync_destroy(
+			//ctx_data->hfi_frame_process.in_free_resource[idx]);
+		ctx_data->hfi_frame_process.in_resource[idx] = 0;
+	}
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return 0;
+}
+
+static int cam_icp_mgr_delete_sync_obj(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+	struct crm_workq_task *task;
+	struct hfi_cmd_work_data *task_data;
+	struct cam_icp_hw_mgr *hw_mgr = ctx_data->hw_mgr_priv;
+
+	task = cam_req_mgr_workq_get_task(hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "%s: no empty task", ctx_data->ctx_id_string);
+		return -ENOMEM;
+	}
+
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)ctx_data;
+	task_data->request_id = 0;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_delete_sync;
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_icp_mgr_flush_all(struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	struct hfi_frame_process_info *hfi_frame_process;
+	int idx;
+	bool clear_in_resource = false;
+
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	for (idx = 0; idx < CAM_FRAME_CMD_MAX; idx++) {
+		if (!hfi_frame_process->request_id[idx])
+			continue;
+
+		/* now release memory for hfi frame process command */
+		hfi_frame_process->request_id[idx] = 0;
+		if (ctx_data->hfi_frame_process.in_resource[idx] > 0) {
+			ctx_data->hfi_frame_process.in_free_resource[idx] =
+				ctx_data->hfi_frame_process.in_resource[idx];
+			ctx_data->hfi_frame_process.in_resource[idx] = 0;
+		}
+		clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+		clear_in_resource = true;
+	}
+
+	if (clear_in_resource)
+		cam_icp_mgr_delete_sync_obj(ctx_data);
+
+	return 0;
+}
+
+static int cam_icp_mgr_flush_req(struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	int64_t request_id;
+	struct hfi_frame_process_info *hfi_frame_process;
+	int idx;
+	bool clear_in_resource = false;
+
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	request_id = *(int64_t *)flush_args->flush_req_pending[0];
+	for (idx = 0; idx < CAM_FRAME_CMD_MAX; idx++) {
+		if (!hfi_frame_process->request_id[idx])
+			continue;
+
+		if (hfi_frame_process->request_id[idx] != request_id)
+			continue;
+
+		/* now release memory for hfi frame process command */
+		hfi_frame_process->request_id[idx] = 0;
+		if (ctx_data->hfi_frame_process.in_resource[idx] > 0) {
+			ctx_data->hfi_frame_process.in_free_resource[idx] =
+				ctx_data->hfi_frame_process.in_resource[idx];
+			ctx_data->hfi_frame_process.in_resource[idx] = 0;
+		}
+		clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+		clear_in_resource = true;
+	}
+
+	if (clear_in_resource)
+		cam_icp_mgr_delete_sync_obj(ctx_data);
+
+	return 0;
+}
+
+static void cam_icp_mgr_flush_info_dump(
+	struct cam_hw_flush_args *flush_args, uint32_t ctx_id)
+{
+	int i;
+
+	for (i = 0; i < flush_args->num_req_active; i++) {
+		CAM_DBG(CAM_ICP, "Flushing active request %lld in ctx %u",
+			*(int64_t *)flush_args->flush_req_active[i],
+			ctx_id);
+	}
+
+	for (i = 0; i < flush_args->num_req_pending; i++) {
+		CAM_DBG(CAM_ICP, "Flushing pending request %lld in ctx %u",
+			*(int64_t *)flush_args->flush_req_pending[i],
+			ctx_id);
+	}
+}
+
+static int cam_icp_mgr_enqueue_abort(
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int timeout = 2000, rc;
+	unsigned long rem_jiffies = 0;
+	struct cam_icp_hw_mgr *hw_mgr = ctx_data->hw_mgr_priv;
+	struct hfi_cmd_work_data *task_data;
+	struct crm_workq_task *task;
+
+	task = cam_req_mgr_workq_get_task(hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "%s: no empty task", ctx_data->ctx_id_string);
+		return -ENOMEM;
+	}
+
+	reinit_completion(&ctx_data->wait_complete);
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)ctx_data;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_abort_handle_wq;
+	cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+		&ctx_data->wait_complete,
+		msecs_to_jiffies(timeout), CAM_ICP,
+		"%s FW response timeout for Abort handle command",
+		ctx_data->ctx_id_string);
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		cam_icp_dump_debug_info(hw_mgr, false);
+		ctx_data->abort_timed_out = true;
+		return rc;
+	}
+
+	CAM_DBG(CAM_ICP, "%s: Abort after flush is success", ctx_data->ctx_id_string);
+	return 0;
+}
+
+static int cam_icp_mgr_hw_dump(void *hw_priv, void *hw_dump_args)
+{
+	int                              rc;
+	int                              i, j;
+	size_t                           remain_len;
+	uint8_t                         *dst;
+	uint32_t                         min_len;
+	uint64_t                        *addr, *start;
+	uint64_t                        *clk_addr, *clk_start;
+	uint32_t                        *mgr_addr, *mgr_start;
+	struct timespec64                cur_ts;
+	struct timespec64                req_ts;
+	ktime_t                          cur_time;
+	struct cam_hw_intf              *icp_dev_intf;
+	struct cam_icp_hw_mgr           *hw_mgr;
+	struct cam_hw_dump_args         *dump_args;
+	struct cam_icp_hw_ctx_data      *ctx_data;
+	struct cam_icp_dump_header      *hdr;
+	struct cam_icp_hw_dump_args      icp_dump_args;
+	struct hfi_frame_process_info   *frm_process;
+	int                              frm_idx = -1;
+
+	if ((!hw_priv) || (!hw_dump_args)) {
+		CAM_ERR(CAM_ICP, "Invalid params %pK %pK",
+			hw_priv, hw_dump_args);
+		return -EINVAL;
+	}
+
+	memset(&req_ts, 0, sizeof(struct timespec64));
+
+	dump_args = (struct cam_hw_dump_args *)hw_dump_args;
+	hw_mgr = hw_priv;
+	ctx_data = dump_args->ctxt_to_hw_map;
+	CAM_DBG(CAM_ICP, "[%s] Req %lld",
+		hw_mgr->hw_mgr_name,
+		dump_args->request_id);
+	frm_process = &ctx_data->hfi_frame_process;
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++) {
+		if ((frm_process->request_id[i] ==
+			dump_args->request_id) &&
+			frm_process->fw_process_flag[i]) {
+			frm_idx = i;
+			break;
+		}
+	}
+
+	cur_time = ktime_get();
+	cur_ts = ktime_to_timespec64(cur_time);
+	if (frm_idx >= 0) {
+		req_ts = ktime_to_timespec64(frm_process->submit_timestamp[frm_idx]);
+	}
+
+	CAM_INFO(CAM_ICP,
+		"[%s] Error req %lld req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+		hw_mgr->hw_mgr_name, dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&icp_dump_args.cpu_addr, &icp_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Invalid addr %u rc %d",
+			hw_mgr->hw_mgr_name, dump_args->buf_handle, rc);
+		return rc;
+	}
+	if (icp_dump_args.buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ICP, "[%s] dump buffer overshoot len %zu offset %zu",
+			hw_mgr->hw_mgr_name, icp_dump_args.buf_len, dump_args->offset);
+		rc = -ENOSPC;
+		goto put_cpu_buf;
+	}
+
+	remain_len = icp_dump_args.buf_len - dump_args->offset;
+	min_len = sizeof(struct cam_icp_dump_header) +
+			(CAM_ICP_DUMP_NUM_WORDS * sizeof(uint64_t));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ICP, "[%s] dump buffer exhaust remain %zu min %u",
+			hw_mgr->hw_mgr_name, remain_len, min_len);
+		rc = -ENOSPC;
+		goto put_cpu_buf;
+	}
+
+	/* Dumping clock and bandwidth info */
+	dst = (uint8_t *)icp_dump_args.cpu_addr + dump_args->offset;
+	hdr = (struct cam_icp_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ICP_DUMP_TAG_MAX_LEN, "ICP_HW_CLK:");
+	hdr->word_size = sizeof(uint64_t);
+	clk_addr = (uint64_t *)(dst + sizeof(struct cam_icp_dump_header));
+	clk_start = clk_addr;
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		*clk_addr++ = hw_mgr->dev_info[i].clk_info.prev_clk;
+		*clk_addr++ = hw_mgr->dev_info[i].clk_info.curr_clk;
+	}
+	for (j = 0; j < ctx_data->clk_info.num_paths; j++) {
+		*clk_addr++ = ctx_data->clk_info.axi_path[j].camnoc_bw;
+		*clk_addr++ = ctx_data->clk_info.axi_path[j].mnoc_ab_bw;
+		*clk_addr++ = ctx_data->clk_info.axi_path[j].mnoc_ib_bw;
+	}
+	hdr->size = hdr->word_size * (clk_addr - clk_start);
+	dump_args->offset += (hdr->size + sizeof(struct cam_icp_dump_header));
+
+	/* Dumping hw mgr info */
+	dst = (uint8_t *)icp_dump_args.cpu_addr + dump_args->offset;
+	hdr = (struct cam_icp_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ICP_DUMP_TAG_MAX_LEN, "ICP_HW_MGR.%s:",
+		cam_icp_dev_type_to_name(ctx_data->icp_dev_acquire_info->dev_type));
+	hdr->word_size = sizeof(uint32_t);
+	mgr_addr = (uint32_t *)(dst + sizeof(struct cam_icp_dump_header));
+	mgr_start = mgr_addr;
+	*mgr_addr++ = atomic_read(&hw_mgr->recovery);
+	*mgr_addr++ = hw_mgr->icp_booted;
+	*mgr_addr++ = hw_mgr->icp_resumed;
+	*mgr_addr++ = hw_mgr->disable_ubwc_comp;
+	memcpy(mgr_addr, &hw_mgr->dev_info, sizeof(hw_mgr->dev_info));
+	mgr_addr += sizeof(hw_mgr->dev_info);
+	*mgr_addr++ = hw_mgr->icp_pc_flag;
+	*mgr_addr++ = hw_mgr->dev_pc_flag;
+	*mgr_addr++ = hw_mgr->icp_use_pil;
+	hdr->size = hdr->word_size * (mgr_addr - mgr_start);
+	dump_args->offset += (hdr->size + sizeof(struct cam_icp_dump_header));
+
+	/* Dumping time info */
+	dst = (uint8_t *)icp_dump_args.cpu_addr + dump_args->offset;
+	hdr = (struct cam_icp_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ICP_DUMP_TAG_MAX_LEN, "ICP_REQ:");
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_icp_dump_header));
+	start = addr;
+	*addr++ = dump_args->request_id;
+	*addr++ = req_ts.tv_sec;
+	*addr++ = req_ts.tv_nsec / NSEC_PER_USEC;
+	*addr++ = cur_ts.tv_sec;
+	*addr++ = cur_ts.tv_nsec / NSEC_PER_USEC;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += (hdr->size + sizeof(struct cam_icp_dump_header));
+
+	/* Dumping the fw image*/
+	icp_dump_args.offset = dump_args->offset;
+	icp_dev_intf = hw_mgr->icp_dev_intf;
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is NULL",
+			hw_mgr->hw_mgr_name);
+		rc = -EINVAL;
+		goto put_cpu_buf;
+	}
+	rc = icp_dev_intf->hw_ops.process_cmd(
+		icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_HW_DUMP, &icp_dump_args,
+		sizeof(struct cam_icp_hw_dump_args));
+	CAM_DBG(CAM_ICP, "[%s] Offset before %zu after %zu",
+		hw_mgr->hw_mgr_name, dump_args->offset, icp_dump_args.offset);
+	dump_args->offset = icp_dump_args.offset;
+
+put_cpu_buf:
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_icp_mgr_synx_core_control(
+	struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_synx_core_control *synx_core_ctrl)
+{
+	int rc;
+
+	if (synx_core_ctrl->core_control) {
+		rc = cam_icp_mgr_icp_resume(hw_mgr);
+		if (!rc)
+			/* Set FW log level for synx */
+			if (hw_mgr->icp_debug_type)
+				hfi_set_debug_level(hw_mgr->hfi_handle,
+					hw_mgr->icp_debug_type, hw_mgr->icp_dbg_lvl);
+	} else {
+		rc = cam_icp_mgr_icp_power_collapse(hw_mgr);
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ICP, "[%s] Failed to process core control resume: %s",
+			hw_mgr->hw_mgr_name, CAM_BOOL_TO_YESNO(synx_core_ctrl->core_control));
+
+	CAM_INFO(CAM_ICP, "Synx test core control: %s done rc: %d",
+		CAM_BOOL_TO_YESNO(synx_core_ctrl->core_control), rc);
+	return rc;
+}
+
+static int cam_icp_mgr_synx_send_test_cmd(
+	struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_synx_test_cmd *synx_test_params)
+{
+	int rc = 0;
+	size_t size;
+	dma_addr_t iova;
+	struct hfi_cmd_synx_test_payload synx_test_cmd;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+
+	if (!hw_mgr->icp_resumed) {
+		rc = cam_icp_mgr_icp_resume(hw_mgr);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Failed to resume ICP rc: %d", rc);
+			goto end;
+		}
+
+		/* Set FW log level for synx */
+		if (hw_mgr->icp_debug_type)
+			hfi_set_debug_level(hw_mgr->hfi_handle,
+				hw_mgr->icp_debug_type, hw_mgr->icp_dbg_lvl);
+	}
+
+	synx_test_cmd.pkt_type = HFI_CMD_DBG_SYNX_TEST;
+	synx_test_cmd.size = sizeof(synx_test_cmd);
+
+	rc = cam_mem_get_io_buf(synx_test_params->ip_mem_hdl, hw_mgr->iommu_hdl,
+		&iova, &size, NULL, NULL);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Failed to get buf for hdl: %d rc: %d",
+			synx_test_params->ip_mem_hdl, rc);
+		goto end;
+	}
+
+	synx_test_cmd.input_iova = (uint32_t)iova;
+	synx_test_cmd.input_size = (uint32_t)size;
+
+	rc = cam_mem_get_io_buf(synx_test_params->op_mem_hdl, hw_mgr->iommu_hdl,
+		&iova, &size, NULL, NULL);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Failed to get buf for hdl: %d rc: %d",
+			synx_test_params->ip_mem_hdl, rc);
+		goto end;
+	}
+
+	synx_test_cmd.output_iova = (uint32_t)iova;
+	synx_test_cmd.output_size = (uint32_t)size;
+
+	CAM_DBG(CAM_ICP,
+		"Input (hdl: 0x%x iova: 0x%x size: 0x%x) output (hdl: 0x%x iova: 0x%x size: 0x%x)",
+		synx_test_params->ip_mem_hdl, synx_test_cmd.input_iova, synx_test_cmd.input_size,
+		synx_test_params->op_mem_hdl, synx_test_cmd.output_iova, synx_test_cmd.output_size);
+
+	reinit_completion(&hw_mgr->icp_complete);
+	rc = hfi_write_cmd(hw_mgr->hfi_handle, &synx_test_cmd);
+	if (rc)
+		goto end;
+
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+			&hw_mgr->icp_complete, msecs_to_jiffies(timeout), CAM_ICP,
+			"FW response timeout for synx test cmd");
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		goto end;
+	}
+
+	CAM_INFO(CAM_ICP, "Synx test cmd done rc: %d", rc);
+
+end:
+	return rc;
+}
+
+static int cam_icp_mgr_service_synx_test_cmds(void *hw_priv, void *synx_args)
+{
+	int rc;
+	struct cam_icp_hw_mgr *hw_mgr = hw_priv;
+	struct cam_synx_test_params *synx_params;
+
+	if ((!hw_priv) || (!synx_args)) {
+		CAM_ERR(CAM_ICP, "Input params are Null:");
+		return -EINVAL;
+	}
+
+	synx_params = (struct cam_synx_test_params *)synx_args;
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	switch (synx_params->cmd_type) {
+	case CAM_SYNX_TEST_CMD_TYPE_CORE_CTRL: {
+		rc = cam_icp_mgr_synx_core_control(hw_mgr, &synx_params->u.core_ctrl);
+	}
+		break;
+	case CAM_SYNX_TEST_CMD_TYPE_SYNX_CMD: {
+		rc = cam_icp_mgr_synx_send_test_cmd(hw_mgr, &synx_params->u.test_cmd);
+	}
+		break;
+	default:
+		rc = -EINVAL;
+		goto end;
+	}
+
+end:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_hw_flush(void *hw_priv, void *hw_flush_args)
+{
+	struct cam_hw_flush_args *flush_args = hw_flush_args;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	struct cam_icp_hw_mgr *hw_mgr = hw_priv;
+
+	if ((!hw_priv) || (!hw_flush_args)) {
+		CAM_ERR(CAM_ICP, "Input params are Null:");
+		return -EINVAL;
+	}
+
+	ctx_data = flush_args->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "[%s] ctx data is NULL", hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	if ((flush_args->flush_type >= CAM_FLUSH_TYPE_MAX) ||
+		(flush_args->flush_type < CAM_FLUSH_TYPE_REQ)) {
+		CAM_ERR(CAM_ICP, "%s: Invalid lush type: %d",
+			ctx_data->ctx_id_string, flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	ctx_data->last_flush_req = flush_args->last_flush_req;
+	CAM_DBG(CAM_REQ, "%s: Flush type %d last_flush_req %u",
+		ctx_data->ctx_id_string, flush_args->flush_type,
+		ctx_data->last_flush_req);
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_ALL:
+		mutex_lock(&hw_mgr->hw_mgr_mutex);
+		if (!atomic_read(&hw_mgr->recovery)
+			&& flush_args->num_req_active) {
+			mutex_unlock(&hw_mgr->hw_mgr_mutex);
+			cam_icp_mgr_flush_info_dump(flush_args,
+				ctx_data->ctx_id);
+			cam_icp_mgr_enqueue_abort(ctx_data);
+		} else {
+			mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		}
+		mutex_lock(&ctx_data->ctx_mutex);
+		cam_icp_mgr_flush_all(ctx_data, flush_args);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		break;
+	case CAM_FLUSH_TYPE_REQ:
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (flush_args->num_req_active) {
+			CAM_ERR(CAM_ICP,
+				"%s: Flush a specific active request id: %lld is not supported",
+				ctx_data->ctx_id_string,
+				*(int64_t *)flush_args->flush_req_active[0]);
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return -EINVAL;
+		}
+		if (flush_args->num_req_pending)
+			cam_icp_mgr_flush_req(ctx_data, flush_args);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "%s: Invalid flush type: %d",
+			ctx_data->ctx_id_string, flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_icp_mgr_release_hw(void *hw_mgr_priv, void *release_hw_args)
+{
+	int rc = 0, i;
+	int ctx_id = 0;
+	struct cam_hw_release_args *release_hw = release_hw_args;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+
+	if (!release_hw || !hw_mgr) {
+		CAM_ERR(CAM_ICP, "Invalid args: %pK %pK", release_hw, hw_mgr);
+		return -EINVAL;
+	}
+
+	ctx_data = release_hw->ctxt_to_hw_map;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "NULL ctx data");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "%s: Enter recovery set %d",
+		ctx_data->ctx_id_string, atomic_read(&hw_mgr->recovery));
+
+	ctx_id = ctx_data->ctx_id;
+	if (ctx_id < 0 || ctx_id >= CAM_ICP_CTX_MAX) {
+		CAM_ERR(CAM_ICP, "%s: Invalid ctx id: %d",
+			ctx_data->ctx_id_string, ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+	if (hw_mgr->ctx_data[ctx_id].state != CAM_ICP_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_ICP, "%s: is not in use",
+			hw_mgr->ctx_data[ctx_id].ctx_id_string);
+		mutex_unlock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (!atomic_read(&hw_mgr->recovery) && release_hw->active_req) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		cam_icp_mgr_abort_handle(ctx_data);
+		cam_icp_mgr_send_abort_status(ctx_data);
+	} else {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	rc = cam_icp_mgr_release_ctx(hw_mgr, ctx_id);
+	if (!hw_mgr->ctxt_cnt) {
+		CAM_DBG(CAM_ICP, "[%s] Last Release", hw_mgr->hw_mgr_name);
+		cam_icp_mgr_icp_power_collapse(hw_mgr);
+		cam_icp_hw_mgr_reset_clk_info(hw_mgr);
+		rc = cam_icp_device_deint(hw_mgr);
+	}
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		if (hw_mgr->dev_info[i].dev_ctx_info.dev_ctxt_cnt)
+			break;
+	}
+
+	if (i == hw_mgr->num_dev_info)
+		cam_icp_device_timer_stop(hw_mgr);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_ICP, "[%s] Release done.", hw_mgr->hw_mgr_name);
+	return rc;
+}
+
+static int cam_icp_mgr_create_handle(struct cam_icp_hw_mgr *hw_mgr,
+	uint32_t dev_type, struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct hfi_cmd_create_handle create_handle;
+	struct hfi_cmd_work_data *task_data;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+	struct crm_workq_task *task;
+	int rc = 0;
+	uint32_t handle_type;
+
+	if (ctx_data->device_info->hw_dev_type == CAM_ICP_DEV_OFE) {
+		create_handle.pkt_type = HFI_CMD_OFE_CREATE_HANDLE;
+		switch (dev_type) {
+		case CAM_ICP_RES_TYPE_OFE_RT:
+			handle_type = HFI_OFE_HANDLE_TYPE_OFE_RT;
+			break;
+		case CAM_ICP_RES_TYPE_OFE:
+			handle_type = HFI_OFE_HANDLE_TYPE_OFE_NON_RT;
+			break;
+		case CAM_ICP_RES_TYPE_OFE_SEMI_RT:
+			handle_type = HFI_OFE_HANDLE_TYPE_OFE_SEMI_RT;
+			break;
+		default:
+			CAM_ERR(CAM_ICP, "Invalid OFE stream type: %u", dev_type);
+			return -EINVAL;
+		}
+	} else {
+		create_handle.pkt_type = HFI_CMD_IPEBPS_CREATE_HANDLE;
+		switch (dev_type) {
+		case CAM_ICP_RES_TYPE_BPS:
+			handle_type = HFI_IPEBPS_HANDLE_TYPE_BPS_NON_RT;
+			break;
+		case CAM_ICP_RES_TYPE_IPE_RT:
+			handle_type = HFI_IPEBPS_HANDLE_TYPE_IPE_RT;
+			break;
+		case CAM_ICP_RES_TYPE_IPE:
+			handle_type = HFI_IPEBPS_HANDLE_TYPE_IPE_NON_RT;
+			break;
+		case CAM_ICP_RES_TYPE_IPE_SEMI_RT:
+			handle_type = HFI_IPEBPS_HANDLE_TYPE_IPE_SEMI_RT;
+			break;
+		case CAM_ICP_RES_TYPE_BPS_RT:
+			handle_type = HFI_IPEBPS_HANDLE_TYPE_BPS_RT;
+			break;
+		case CAM_ICP_RES_TYPE_BPS_SEMI_RT:
+			handle_type = HFI_IPEBPS_HANDLE_TYPE_BPS_SEMI_RT;
+			break;
+		default:
+			CAM_ERR(CAM_ICP, "Invalid IPE/BPS stream type: %u", dev_type);
+			return -EINVAL;
+		}
+	}
+	task = cam_req_mgr_workq_get_task(hw_mgr->cmd_work);
+	if (!task)
+		return -ENOMEM;
+
+	create_handle.size = sizeof(struct hfi_cmd_create_handle);
+	create_handle.handle_type = handle_type;
+	create_handle.user_data1 = PTR_TO_U64(ctx_data);
+	reinit_completion(&ctx_data->wait_complete);
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)&create_handle;
+	task_data->request_id = 0;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc)
+		return rc;
+
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+			&ctx_data->wait_complete,
+			msecs_to_jiffies(timeout), CAM_ICP,
+			"%s: FW response timeout for create handle command",
+			ctx_data->ctx_id_string);
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		cam_icp_dump_debug_info(hw_mgr, false);
+	}
+
+	if (ctx_data->fw_handle == 0) {
+		CAM_ERR(CAM_ICP, "%s: Invalid handle created", ctx_data->ctx_id_string);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_send_ping(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct hfi_cmd_ping_pkt ping_pkt;
+	struct hfi_cmd_work_data *task_data;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+	struct crm_workq_task *task;
+	int rc = 0;
+
+	task = cam_req_mgr_workq_get_task(hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "%s: No free task to send ping command",
+			ctx_data->ctx_id_string);
+		return -ENOMEM;
+	}
+
+	ping_pkt.size = sizeof(struct hfi_cmd_ping_pkt);
+	ping_pkt.pkt_type = HFI_CMD_SYS_PING;
+	ping_pkt.user_data = PTR_TO_U64(ctx_data);
+	init_completion(&ctx_data->wait_complete);
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)&ping_pkt;
+	task_data->request_id = 0;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc)
+		return rc;
+
+	rem_jiffies = CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(
+			&ctx_data->wait_complete,
+			msecs_to_jiffies(timeout), CAM_ICP,
+			"%s: FW response timeout for Ping handle command",
+			ctx_data->ctx_id_string);
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		cam_icp_dump_debug_info(hw_mgr, false);
+	}
+
+	return rc;
+}
+
+static int cam_icp_get_acquire_info(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_hw_acquire_args *args,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int i;
+	int acquire_size;
+	struct cam_icp_acquire_dev_info icp_dev_acquire_info;
+	struct cam_icp_res_info *p_icp_out = NULL;
+
+	if (copy_from_user(&icp_dev_acquire_info,
+		(void __user *)args->acquire_info,
+		sizeof(struct cam_icp_acquire_dev_info))) {
+		CAM_ERR(CAM_ICP, "%s: Failed in acquire", ctx_data->ctx_id_string);
+		return -EFAULT;
+	}
+
+	if (icp_dev_acquire_info.secure_mode > CAM_SECURE_MODE_SECURE) {
+		CAM_ERR(CAM_ICP, "%s: Invalid mode: %d",
+			ctx_data->ctx_id_string, icp_dev_acquire_info.secure_mode);
+		return -EINVAL;
+	}
+
+	if ((icp_dev_acquire_info.num_out_res > ICP_MAX_OUTPUT_SUPPORTED) ||
+		(icp_dev_acquire_info.num_out_res <= 0)) {
+		CAM_ERR(CAM_ICP, "%s: Invalid num of out resources: %u",
+			ctx_data->ctx_id_string, icp_dev_acquire_info.num_out_res);
+		return -EINVAL;
+	}
+
+	if (icp_dev_acquire_info.dev_type < CAM_ICP_RES_TYPE_BPS ||
+		icp_dev_acquire_info.dev_type > CAM_ICP_RES_TYPE_OFE_SEMI_RT) {
+		CAM_ERR(CAM_ICP, "%s Invalid device type",
+			ctx_data->ctx_id_string);
+		return -EFAULT;
+	}
+
+	acquire_size = sizeof(struct cam_icp_acquire_dev_info) +
+		((icp_dev_acquire_info.num_out_res - 1) *
+		sizeof(struct cam_icp_res_info));
+	ctx_data->icp_dev_acquire_info = kzalloc(acquire_size, GFP_KERNEL);
+	if (!ctx_data->icp_dev_acquire_info)
+		return -ENOMEM;
+
+	if (copy_from_user(ctx_data->icp_dev_acquire_info,
+		(void __user *)args->acquire_info, acquire_size)) {
+		CAM_ERR(CAM_ICP, "%s: Failed in acquire: size = %d",
+			ctx_data->ctx_id_string, acquire_size);
+		kfree(ctx_data->icp_dev_acquire_info);
+		ctx_data->icp_dev_acquire_info = NULL;
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_ICP, "%s: %x %x %x %x %x %x",
+		ctx_data->ctx_id_string,
+		ctx_data->icp_dev_acquire_info->in_res.format,
+		ctx_data->icp_dev_acquire_info->in_res.width,
+		ctx_data->icp_dev_acquire_info->in_res.height,
+		ctx_data->icp_dev_acquire_info->in_res.fps,
+		ctx_data->icp_dev_acquire_info->num_out_res,
+		ctx_data->icp_dev_acquire_info->scratch_mem_size);
+
+	p_icp_out = ctx_data->icp_dev_acquire_info->out_res_flex;
+	for (i = 0; i < icp_dev_acquire_info.num_out_res; i++)
+		CAM_DBG(CAM_ICP, "%s: out[i] %x %x %x %x",
+			ctx_data->ctx_id_string,
+			p_icp_out[i].format,
+			p_icp_out[i].width,
+			p_icp_out[i].height,
+			p_icp_out[i].fps);
+
+	return 0;
+}
+
+static inline enum cam_icp_hw_type cam_icp_get_hw_dev_type(uint32_t dev_type)
+{
+	switch (dev_type) {
+	case CAM_ICP_RES_TYPE_BPS:
+	case CAM_ICP_RES_TYPE_BPS_RT:
+	case CAM_ICP_RES_TYPE_BPS_SEMI_RT:
+		return CAM_ICP_DEV_BPS;
+	case CAM_ICP_RES_TYPE_IPE:
+	case CAM_ICP_RES_TYPE_IPE_RT:
+	case CAM_ICP_RES_TYPE_IPE_SEMI_RT:
+		return CAM_ICP_DEV_IPE;
+	case CAM_ICP_RES_TYPE_OFE:
+	case CAM_ICP_RES_TYPE_OFE_RT:
+	case CAM_ICP_RES_TYPE_OFE_SEMI_RT:
+		return CAM_ICP_DEV_OFE;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid resource type: %u", dev_type);
+	}
+
+	return CAM_ICP_HW_MAX;
+}
+
+static int cam_icp_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	int rc = 0, bitmap_size = 0, i;
+	uint32_t ctx_id = 0;
+	dma_addr_t io_buf_addr;
+	size_t io_buf_size;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct cam_hw_acquire_args *args = acquire_hw_args;
+	struct cam_icp_acquire_dev_info *icp_dev_acquire_info;
+	struct cam_cmd_mem_regions cmd_mem_region;
+	enum cam_icp_hw_type hw_dev_type;
+
+	if ((!hw_mgr_priv) || (!acquire_hw_args)) {
+		CAM_ERR(CAM_ICP, "Invalid params: %pK %pK", hw_mgr_priv,
+			acquire_hw_args);
+		return -EINVAL;
+	}
+
+	if (args->num_acq > 1) {
+		CAM_ERR(CAM_ICP, "[%s] number of resources are wrong: %u",
+			hw_mgr->hw_mgr_name, args->num_acq);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "[%s] ENTER", hw_mgr->hw_mgr_name);
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	ctx_id = cam_icp_mgr_get_free_ctx(hw_mgr);
+	if (ctx_id >= CAM_ICP_CTX_MAX) {
+		CAM_ERR(CAM_ICP, "[%s] No free ctx space", hw_mgr->hw_mgr_name);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -ENOSPC;
+	}
+	ctx_data = &hw_mgr->ctx_data[ctx_id];
+	ctx_data->ctx_id = ctx_id;
+	ctx_data->hw_mgr_priv = hw_mgr_priv;
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	rc = cam_icp_get_acquire_info(hw_mgr, args, ctx_data);
+	if (rc)
+		goto acquire_info_failed;
+
+	icp_dev_acquire_info = ctx_data->icp_dev_acquire_info;
+	hw_dev_type = cam_icp_get_hw_dev_type(icp_dev_acquire_info->dev_type);
+	if (!CAM_ICP_IS_VALID_HW_DEV_TYPE(hw_dev_type)) {
+		CAM_ERR(CAM_ICP, "[%s] Fail to get hw device type from dev type: %u",
+			hw_mgr->hw_mgr_name, icp_dev_acquire_info->dev_type);
+		rc = -EINVAL;
+		goto get_io_buf_failed;
+	}
+
+	if (!CAM_ICP_IS_DEV_HW_EXIST(hw_mgr->hw_cap_mask, hw_dev_type)) {
+		CAM_ERR(CAM_ICP,
+			"Attempt to acquire device %s not supported by [%s]",
+			cam_icp_dev_type_to_name(icp_dev_acquire_info->dev_type),
+			hw_mgr->hw_mgr_name);
+		rc = -EINVAL;
+		goto get_io_buf_failed;
+	}
+
+	ctx_data->device_info = &hw_mgr->dev_info[hw_mgr->dev_info_idx[hw_dev_type]];
+
+	scnprintf(ctx_data->ctx_id_string, sizeof(ctx_data->ctx_id_string),
+		"[%s]_%s_ctx[%d]_hwmgr_ctx[%d]",
+		hw_mgr->hw_mgr_name,
+		cam_icp_dev_type_to_name(
+		ctx_data->icp_dev_acquire_info->dev_type),
+		args->ctx_id, ctx_data->ctx_id);
+
+	CAM_DBG(CAM_ICP, "%s: acquire io buf handle %d",
+		ctx_data->ctx_id_string, icp_dev_acquire_info->io_config_cmd_handle);
+	/* FW/CDM buffers are expected to be mapped in 32-bit address range */
+	rc = cam_mem_get_io_buf(
+		icp_dev_acquire_info->io_config_cmd_handle,
+		hw_mgr->iommu_hdl,
+		&io_buf_addr, &io_buf_size, NULL, NULL);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "%s: unable to get src buf info from io desc",
+			ctx_data->ctx_id_string);
+		goto get_io_buf_failed;
+	}
+
+	CAM_DBG(CAM_ICP, "%s: hdl: %d, addr: %pK, size: %zu",
+		ctx_data->ctx_id_string, icp_dev_acquire_info->io_config_cmd_handle,
+		(void *)io_buf_addr, io_buf_size);
+
+	if (!hw_mgr->ctxt_cnt) {
+		rc = cam_icp_clk_info_init(hw_mgr);
+		if (rc)
+			goto get_io_buf_failed;
+
+		rc = cam_icp_mgr_icp_resume(hw_mgr);
+		if (rc)
+			goto get_io_buf_failed;
+
+		if (hw_mgr->icp_debug_type)
+			hfi_set_debug_level(hw_mgr->hfi_handle, hw_mgr->icp_debug_type,
+				hw_mgr->icp_dbg_lvl);
+
+		hfi_set_fw_dump_levels(hw_mgr->hfi_handle, hw_mgr->icp_fw_dump_lvl,
+			hw_mgr->icp_fw_ramdump_lvl);
+
+		rc = cam_icp_send_ubwc_cfg(hw_mgr);
+		if (rc)
+			goto ubwc_cfg_failed;
+	}
+
+	rc = cam_icp_mgr_device_resume(hw_mgr, ctx_data);
+	if (rc)
+		goto icp_dev_resume_failed;
+
+	rc = cam_icp_mgr_send_ping(hw_mgr, ctx_data);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "%s: ping ack not received", ctx_data->ctx_id_string);
+		goto send_ping_failed;
+	}
+	CAM_DBG(CAM_ICP, "%s: ping ack received", ctx_data->ctx_id_string);
+
+	rc = cam_icp_mgr_create_handle(hw_mgr, icp_dev_acquire_info->dev_type,
+		ctx_data);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "%s: create handle failed", ctx_data->ctx_id_string);
+		goto create_handle_failed;
+	}
+
+	CAM_DBG(CAM_ICP,
+		"%s: created stream handle",
+		ctx_data->ctx_id_string);
+
+	cmd_mem_region.num_regions = 1;
+	cmd_mem_region.map_info_array_flex[0].mem_handle =
+		icp_dev_acquire_info->io_config_cmd_handle;
+	cmd_mem_region.map_info_array_flex[0].offset = 0;
+	cmd_mem_region.map_info_array_flex[0].size =
+		icp_dev_acquire_info->io_config_cmd_size;
+	cmd_mem_region.map_info_array_flex[0].flags = 0;
+
+	rc = cam_icp_process_stream_settings(ctx_data,
+		&cmd_mem_region, true);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"%s: sending config io mapping failed rc %d",
+				ctx_data->ctx_id_string, rc);
+		goto send_map_info_failed;
+	}
+
+	if (cam_presil_mode_enabled()) {
+		CAM_INFO(CAM_PRESIL, "%s: Sending IO Config buffers to presil: FD %d ",
+			ctx_data->ctx_id_string,
+			(icp_dev_acquire_info->io_config_cmd_handle >> 16));
+		cam_mem_mgr_send_buffer_to_presil(hw_mgr->iommu_hdl,
+			icp_dev_acquire_info->io_config_cmd_handle);
+	}
+
+	rc = cam_icp_mgr_send_config_io(ctx_data, io_buf_addr);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"%s: IO Config command failed %d size:%d",
+			ctx_data->ctx_id_string, rc, icp_dev_acquire_info->io_config_cmd_size);
+		cam_icp_dump_io_cfg(ctx_data,
+			icp_dev_acquire_info->io_config_cmd_handle,
+			icp_dev_acquire_info->io_config_cmd_size);
+		goto ioconfig_failed;
+	}
+
+	rc = cam_icp_process_stream_settings(ctx_data,
+		&cmd_mem_region, false);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"%s: sending config io unmapping failed %d",
+			ctx_data->ctx_id_string, rc);
+		goto send_map_info_failed;
+	}
+
+	ctx_data->context_priv = args->context_data;
+	args->ctxt_to_hw_map = ctx_data;
+	args->hw_mgr_ctx_id = ctx_data->ctx_id;
+
+	bitmap_size = BITS_TO_LONGS(CAM_FRAME_CMD_MAX) * sizeof(long);
+	ctx_data->hfi_frame_process.bitmap =
+			kzalloc(bitmap_size, GFP_KERNEL);
+	if (!ctx_data->hfi_frame_process.bitmap) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"%s: failed to allocate hfi frame bitmap", ctx_data->ctx_id_string);
+			rc = -ENOMEM;
+		goto ioconfig_failed;
+	}
+
+	ctx_data->perf_stats.total_resp_time = 0;
+	ctx_data->perf_stats.total_requests = 0;
+
+	ctx_data->hfi_frame_process.bits = bitmap_size * BITS_PER_BYTE;
+	hw_mgr->ctx_data[ctx_id].ctxt_event_cb = args->event_cb;
+	icp_dev_acquire_info->scratch_mem_size = ctx_data->scratch_mem_size;
+
+	if (copy_to_user((void __user *)args->acquire_info,
+		icp_dev_acquire_info,
+		sizeof(struct cam_icp_acquire_dev_info))) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"%s: copy from user failed", ctx_data->ctx_id_string);
+		goto copy_to_user_failed;
+	}
+
+	cam_icp_ctx_clk_info_init(ctx_data);
+	ctx_data->state = CAM_ICP_CTX_STATE_ACQUIRED;
+	mutex_unlock(&ctx_data->ctx_mutex);
+	CAM_DBG(CAM_ICP, "%s: scratch size = %x fw_handle = %x",
+		ctx_data->ctx_id_string,
+		(unsigned int)icp_dev_acquire_info->scratch_mem_size,
+		(unsigned int)ctx_data->fw_handle);
+
+	/* Start device timer*/
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		if (hw_mgr->dev_info[i].dev_ctx_info.dev_ctxt_cnt == 1)
+			break;
+	}
+
+	if (i != hw_mgr->num_dev_info)
+		cam_icp_device_timer_start(hw_mgr);
+
+	/* Start context timer*/
+	cam_icp_ctx_timer_start(ctx_data);
+	hw_mgr->ctxt_cnt++;
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_ICP, "%s: Acquire Done",
+		ctx_data->ctx_id_string);
+
+	CAM_TRACE(CAM_ICP,
+		"%s: Acquired, in_res : format=%d, widht=%d, height=%d, fps=%d",
+		ctx_data->ctx_id_string,
+		ctx_data->icp_dev_acquire_info->in_res.format,
+		ctx_data->icp_dev_acquire_info->in_res.width,
+		ctx_data->icp_dev_acquire_info->in_res.height,
+		ctx_data->icp_dev_acquire_info->in_res.fps);
+
+	if (ctx_data->icp_dev_acquire_info->num_out_res > 0) {
+		CAM_TRACE(CAM_ICP,
+			"%s: Acquired, out_res[0] : format=%d, widht=%d, height=%d, fps=%d",
+			ctx_data->ctx_id_string,
+			ctx_data->icp_dev_acquire_info->out_res[0].format,
+			ctx_data->icp_dev_acquire_info->out_res[0].width,
+			ctx_data->icp_dev_acquire_info->out_res[0].height,
+			ctx_data->icp_dev_acquire_info->out_res[0].fps);
+	}
+
+	if (ctx_data->icp_dev_acquire_info->num_out_res > 1) {
+		CAM_TRACE(CAM_ICP,
+			"%s: Acquired, out_res[1] : format=%d, widht=%d, height=%d, fps=%d",
+			ctx_data->ctx_id_string,
+			ctx_data->icp_dev_acquire_info->out_res[1].format,
+			ctx_data->icp_dev_acquire_info->out_res[1].width,
+			ctx_data->icp_dev_acquire_info->out_res[1].height,
+			ctx_data->icp_dev_acquire_info->out_res[1].fps);
+	}
+
+	return 0;
+
+copy_to_user_failed:
+	kfree(ctx_data->hfi_frame_process.bitmap);
+	ctx_data->hfi_frame_process.bitmap = NULL;
+ioconfig_failed:
+	cam_icp_process_stream_settings(ctx_data,
+		&cmd_mem_region, false);
+send_map_info_failed:
+	cam_icp_mgr_destroy_handle(ctx_data);
+create_handle_failed:
+send_ping_failed:
+	cam_icp_mgr_dev_power_collapse(hw_mgr, ctx_data, 0);
+icp_dev_resume_failed:
+ubwc_cfg_failed:
+	if (!hw_mgr->ctxt_cnt)
+		cam_icp_mgr_icp_power_collapse(hw_mgr);
+get_io_buf_failed:
+	kfree(hw_mgr->ctx_data[ctx_id].icp_dev_acquire_info);
+	hw_mgr->ctx_data[ctx_id].icp_dev_acquire_info = NULL;
+	hw_mgr->ctx_data[ctx_id].device_info = NULL;
+acquire_info_failed:
+	cam_icp_mgr_put_ctx(ctx_data);
+	cam_icp_mgr_process_dbg_buf(hw_mgr);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_get_hw_caps(void *hw_mgr_priv, void *hw_caps_args)
+{
+	int rc = 0;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd *query_cap = hw_caps_args;
+	struct cam_icp_query_cap_cmd icp_caps;
+
+	if ((!hw_mgr_priv) || (!hw_caps_args)) {
+		CAM_ERR(CAM_ICP, "Invalid params: %pK %pK", hw_mgr_priv, hw_caps_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_icp_query_cap_cmd) != query_cap->size) {
+		CAM_ERR(CAM_ICP,
+			"[%s] Input query cap size:%u does not match expected query cap size: %u",
+			hw_mgr->hw_mgr_name, query_cap->size,
+			sizeof(struct cam_icp_query_cap_cmd));
+		return -EFAULT;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (copy_from_user(&icp_caps,
+		u64_to_user_ptr(query_cap->caps_handle),
+		sizeof(struct cam_icp_query_cap_cmd))) {
+		CAM_ERR(CAM_ICP, "[%s] copy from_user failed", hw_mgr->hw_mgr_name);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = hfi_get_hw_caps(&icp_caps);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Fail to get hfi caps", hw_mgr->hw_mgr_name);
+		goto end;
+	}
+
+	icp_caps.dev_iommu_handle.non_secure = hw_mgr->iommu_hdl;
+	icp_caps.dev_iommu_handle.secure = hw_mgr->iommu_sec_hdl;
+
+	if (copy_to_user(u64_to_user_ptr(query_cap->caps_handle),
+		&icp_caps, sizeof(struct cam_icp_query_cap_cmd))) {
+		CAM_ERR(CAM_ICP, "[%s] copy_to_user failed", hw_mgr->hw_mgr_name);
+		rc = -EFAULT;
+	}
+end:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_get_hw_caps_v2(void *hw_mgr_priv, void *hw_caps_args)
+{
+	int rc = 0;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_icp_hw_device_info *dev_info;
+	struct cam_query_cap_cmd *query_cap = hw_caps_args;
+	struct cam_icp_query_cap_cmd_v2 query_cmd;
+	uint32_t supported_hw_dev, num_supported_device = 0;
+	int i;
+
+	if ((!hw_mgr_priv) || (!hw_caps_args)) {
+		CAM_ERR(CAM_ICP, "Invalid params: %pK %pK",
+			hw_mgr_priv, hw_caps_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_icp_query_cap_cmd_v2) != query_cap->size) {
+		CAM_ERR(CAM_ICP,
+			"[%s] Input query cap size:%u does not match expected query cap size: %ud",
+			hw_mgr->hw_mgr_name, query_cap->size,
+			sizeof(struct cam_icp_query_cap_cmd_v2));
+		return -EFAULT;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (copy_from_user(&query_cmd, u64_to_user_ptr(query_cap->caps_handle),
+		sizeof(struct cam_icp_query_cap_cmd_v2))) {
+		CAM_ERR(CAM_ICP, "[%s] copy from user failed", hw_mgr->hw_mgr_name);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	memset(&query_cmd.dev_info, 0,
+		(CAM_ICP_MAX_NUM_OF_DEV_TYPES * sizeof(struct cam_icp_device_info)));
+
+	for (i = 0; i < CAM_ICP_MAX_ICP_HW_TYPE; i++) {
+		if (!CAM_ICP_IS_DEV_HW_EXIST(hw_mgr->hw_cap_mask, i))
+			continue;
+
+		query_cmd.dev_info[num_supported_device].dev_type = CAM_ICP_DEV_TYPE_ICP;
+		query_cmd.dev_info[num_supported_device].num_devices = CAM_ICP_MAX_ICP_PROC_PER_DEV;
+		num_supported_device++;
+		break;
+	}
+
+	if (!num_supported_device) {
+		CAM_ERR(CAM_ICP, "No ICP HW binded to %s", hw_mgr->hw_mgr_name);
+		rc = -ENODEV;
+		goto end;
+	}
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++) {
+		dev_info = &hw_mgr->dev_info[i];
+
+		switch (dev_info->hw_dev_type) {
+		case CAM_ICP_DEV_IPE:
+			supported_hw_dev = CAM_ICP_DEV_TYPE_IPE;
+			break;
+		case CAM_ICP_DEV_BPS:
+			supported_hw_dev = CAM_ICP_DEV_TYPE_BPS;
+			break;
+		case CAM_ICP_DEV_OFE:
+			supported_hw_dev = CAM_ICP_DEV_TYPE_OFE;
+			break;
+		default:
+			CAM_ERR(CAM_ICP, "[%s] Invalid icp hw type: %u",
+				hw_mgr->hw_mgr_name, i);
+			rc = -EBADSLT;
+			goto end;
+		}
+
+		if (num_supported_device >= CAM_ICP_MAX_NUM_OF_DEV_TYPES) {
+			CAM_ERR(CAM_ICP,
+				"[%s] number of supported hw devices:%u exceeds maximum number of devices supported by query cap struct: %u",
+				hw_mgr->hw_mgr_name, num_supported_device,
+				CAM_ICP_MAX_NUM_OF_DEV_TYPES);
+			rc = -EFAULT;
+			goto end;
+		}
+
+		query_cmd.dev_info[num_supported_device].dev_type = supported_hw_dev;
+		query_cmd.dev_info[num_supported_device].num_devices = dev_info->hw_dev_cnt;
+
+		num_supported_device++;
+	}
+
+	query_cmd.num_dev_info = num_supported_device;
+
+	rc = hfi_get_hw_caps_v2(hw_mgr->hfi_handle, &query_cmd);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Fail to get hfi caps rc:%d",
+			hw_mgr->hw_mgr_name, rc);
+		goto end;
+	}
+
+	query_cmd.dev_iommu_handle.non_secure = hw_mgr->iommu_hdl;
+	query_cmd.dev_iommu_handle.secure = hw_mgr->iommu_sec_hdl;
+
+	if (copy_to_user(u64_to_user_ptr(query_cap->caps_handle),
+		&query_cmd, sizeof(struct cam_icp_query_cap_cmd_v2))) {
+		CAM_ERR(CAM_ICP, "[%s] copy_to_user failed", hw_mgr->hw_mgr_name);
+		rc = -EFAULT;
+	}
+end:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static void cam_icp_mgr_free_hw_devs(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int i;
+
+	for (i = 0; i < hw_mgr->num_dev_info; i++)
+		kfree(hw_mgr->dev_info[i].dev_intf);
+
+	kfree(hw_mgr->dev_info);
+	hw_mgr->dev_info = NULL;
+	hw_mgr->icp_dev_intf = NULL;
+}
+
+static int cam_icp_mgr_verify_hw_caps(struct cam_icp_hw_mgr *hw_mgr, uint32_t *icp_dev_mask,
+	uint32_t num_icp_dev_mask)
+{
+	struct cam_cpas_query_cap query;
+	int rc, i;
+	uint32_t *cam_caps, num_cpas_cap_mask;
+
+	rc = cam_cpas_get_hw_info(&query.camera_family, &query.camera_version,
+			&query.cpas_version, &cam_caps, &num_cpas_cap_mask,
+			NULL, NULL);
+	if (rc)
+		return rc;
+
+	if (num_icp_dev_mask > num_cpas_cap_mask) {
+		CAM_ERR(CAM_ICP,
+			"[%s] Number of found icp device caps mask %u exceeds cpas cap mask %u",
+			hw_mgr->hw_mgr_name, num_icp_dev_mask, num_cpas_cap_mask);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_icp_dev_mask; i++) {
+		if ((icp_dev_mask[i] & cam_caps[i]) != icp_dev_mask[i]) {
+			CAM_ERR(CAM_ICP,
+				"[%s] Found unsupported HW, cpas caps mask: %u icp device mask: %u",
+				hw_mgr->hw_mgr_name, cam_caps[i], icp_dev_mask[i]);
+			return -ENODEV;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_icp_mgr_alloc_devs(struct device_node *np, struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_hw_intf ***devices, uint32_t *hw_dev_cnt)
+{
+	struct cam_hw_intf **alloc_devices = NULL;
+	int rc, i;
+	enum cam_icp_hw_type icp_hw_type;
+	uint32_t num = 0, mask = 0, num_cpas_mask = 0, cpas_hw_mask[MAX_HW_CAPS_MASK] = {0};
+
+	rc = cam_icp_alloc_processor_devs(np, &icp_hw_type, &alloc_devices, hw_dev_cnt);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] proc devices allocation failed rc=%d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	if (!CAM_ICP_IS_VALID_HW_DEV_TYPE(icp_hw_type)) {
+		CAM_ERR(CAM_ICP, "[%s] Invalid hw dev type: %u",
+			hw_mgr->hw_mgr_name, icp_hw_type);
+		rc = -EINVAL;
+		kfree(devices);
+		kfree(alloc_devices);
+		return rc;
+	}
+
+	if (hw_dev_cnt[icp_hw_type] > CAM_ICP_MAX_ICP_PROC_PER_DEV) {
+		CAM_ERR(CAM_ICP,
+			"Invalid number of ICP device: %u allocated exceeds ICP device supported per hw mgr: %u",
+			hw_dev_cnt[icp_hw_type], CAM_ICP_MAX_ICP_PROC_PER_DEV);
+		rc = -EINVAL;
+		goto free_devs;
+	}
+
+	devices[icp_hw_type] = alloc_devices;
+	hw_mgr->hw_cap_mask |= BIT(icp_hw_type);
+	num_cpas_mask = max(num_cpas_mask, (uint32_t)(ICP_CAPS_MASK_IDX + 1));
+
+	rc = of_property_read_u32(np, "icp-mask", &mask);
+	if (!rc)
+		icp_cpas_mask[hw_mgr->hw_mgr_id] = mask;
+
+	cpas_hw_mask[ICP_CAPS_MASK_IDX] |= icp_cpas_mask[hw_mgr->hw_mgr_id];
+
+	rc = of_property_read_u32(np, "num-ipe", &num);
+	if (!rc) {
+		alloc_devices = kcalloc(num, sizeof(*alloc_devices), GFP_KERNEL);
+		if (!alloc_devices) {
+			CAM_ERR(CAM_ICP, "[%s] ipe device allocation failed",
+				hw_mgr->hw_mgr_name);
+			goto free_devs;
+		}
+
+		hw_dev_cnt[CAM_ICP_DEV_IPE] = num;
+		devices[CAM_ICP_DEV_IPE] = alloc_devices;
+		hw_mgr->hw_cap_mask |= BIT(CAM_ICP_DEV_IPE);
+		num_cpas_mask = max(num_cpas_mask, (uint32_t)(IPE_CAPS_MASK_IDX + 1));
+
+		rc = of_property_read_u32(np, "ipe0-mask", &mask);
+		if (!rc)
+			cpas_hw_mask[IPE_CAPS_MASK_IDX] |= mask;
+		else
+			cpas_hw_mask[IPE_CAPS_MASK_IDX] |= CPAS_TITAN_IPE0_CAP_BIT;
+	}
+
+	rc = of_property_read_u32(np, "num-bps", &num);
+	if (!rc) {
+		alloc_devices = kcalloc(num, sizeof(*alloc_devices), GFP_KERNEL);
+		if (!alloc_devices) {
+			CAM_ERR(CAM_ICP, "[%s] bps device allocation failed",
+				hw_mgr->hw_mgr_name);
+			goto free_devs;
+		}
+
+		hw_dev_cnt[CAM_ICP_DEV_BPS] = num;
+		devices[CAM_ICP_DEV_BPS] = alloc_devices;
+		hw_mgr->hw_cap_mask |= BIT(CAM_ICP_DEV_BPS);
+		num_cpas_mask = max(num_cpas_mask, (uint32_t)(BPS_CAPS_MASK_IDX + 1));
+
+		rc = of_property_read_u32(np, "bps-mask", &mask);
+		if (!rc)
+			cpas_hw_mask[BPS_CAPS_MASK_IDX] |= mask;
+		else
+			cpas_hw_mask[BPS_CAPS_MASK_IDX] |= CPAS_BPS_BIT;
+	}
+
+	rc = of_property_read_u32(np, "num-ofe", &num);
+	if (!rc) {
+		alloc_devices = kcalloc(num, sizeof(*alloc_devices), GFP_KERNEL);
+		if (!alloc_devices) {
+			CAM_ERR(CAM_ICP, "[%s] OFE device allocation failed",
+				hw_mgr->hw_mgr_name);
+			goto free_devs;
+		}
+
+		hw_dev_cnt[CAM_ICP_DEV_OFE] = num;
+		devices[CAM_ICP_DEV_OFE] = alloc_devices;
+		hw_mgr->hw_cap_mask |= BIT(CAM_ICP_DEV_OFE);
+		num_cpas_mask = max(num_cpas_mask, (uint32_t)(OFE_CAPS_MASK_IDX + 1));
+		cpas_hw_mask[OFE_CAPS_MASK_IDX] |= CPAS_OFE_BIT;
+	}
+
+	rc = cam_icp_mgr_verify_hw_caps(hw_mgr, cpas_hw_mask, num_cpas_mask);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "CPAS ICP HW capability verification fails rc=%d", rc);
+		goto free_devs;
+	}
+
+	hw_mgr->dev_pc_flag = of_property_read_bool(np, "ipe_bps_pc_en");
+	hw_mgr->icp_pc_flag = of_property_read_bool(np, "icp_pc_en");
+	hw_mgr->icp_use_pil = of_property_read_bool(np, "icp_use_pil");
+	hw_mgr->synx_signaling_en = of_property_read_bool(np, "synx_signaling_en");
+
+	return 0;
+
+free_devs:
+	kfree(alloc_devices);
+	for (i = 0; i < CAM_ICP_HW_MAX; i++)
+		kfree(devices[i]);
+
+	return rc;
+}
+
+static char *cam_icp_hw_dev_type_to_name(enum cam_icp_hw_type hw_dev_type)
+{
+	switch (hw_dev_type) {
+	case CAM_ICP_HW_ICP_V1:
+		return "ICP_V1";
+	case CAM_ICP_HW_ICP_V2:
+		return "ICP_V2";
+	case CAM_ICP_DEV_IPE:
+		return "IPE";
+	case CAM_ICP_DEV_BPS:
+		return "BPS";
+	case CAM_ICP_DEV_OFE:
+		return "OFE";
+	default:
+		return "Invalid hw dev type";
+	}
+}
+
+static int cam_icp_mgr_set_up_dev_info(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_hw_intf ***devices, uint32_t *hw_dev_cnt)
+{
+	int i, j;
+
+	hw_mgr->icp_dev_intf = CAM_ICP_GET_PROC_DEV_INTF(devices);
+	if (!hw_mgr->icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] Invalid ICP dev interface is NULL",
+			hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	for (i = CAM_ICP_DEV_START_IDX; i < CAM_ICP_HW_MAX; i++) {
+		if (hw_dev_cnt[i] > 0)
+			hw_mgr->num_dev_info++;
+	}
+
+	hw_mgr->dev_info = kcalloc(hw_mgr->num_dev_info, sizeof(struct cam_icp_hw_device_info),
+		GFP_KERNEL);
+	if (!hw_mgr->dev_info)
+		return -ENOMEM;
+
+	for (i = CAM_ICP_DEV_START_IDX, j = 0; i < CAM_ICP_HW_MAX; i++) {
+		if (hw_dev_cnt[i] > 0) {
+			hw_mgr->dev_info_idx[i] = j;
+			hw_mgr->dev_info[j].dev_intf = devices[i];
+			hw_mgr->dev_info[j].dev_name = cam_icp_hw_dev_type_to_name(i);
+			hw_mgr->dev_info[j].hw_dev_type = i;
+			hw_mgr->dev_info[j].hw_dev_cnt = hw_dev_cnt[i];
+			j++;
+		} else {
+			hw_mgr->dev_info_idx[i] = -1;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_icp_mgr_init_devs(struct device_node *np, struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc, i, j, count, num_hw;
+	struct cam_hw_intf **devices[CAM_ICP_HW_MAX] = {0};
+	uint32_t hw_dev_cnt[CAM_ICP_HW_MAX] = {0};
+
+	rc = cam_icp_mgr_alloc_devs(np, hw_mgr, devices, hw_dev_cnt);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] devices allocation failed rc=%d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	count = of_property_count_strings(np, "compat-hw-name");
+	if (count < 0) {
+		CAM_ERR(CAM_ICP, "[%s] Invalid compat-hw-name count=%d", hw_mgr->hw_mgr_name,
+			count);
+		rc = count;
+		goto free_devices;
+	}
+
+	for (i = 0; i < count; i++) {
+		const char *name = NULL;
+		struct platform_device *pdev;
+		struct device_node *node;
+		struct cam_hw_intf *iface;
+
+		rc = of_property_read_string_index(np, "compat-hw-name",
+			i, &name);
+		if (rc) {
+			CAM_ERR(CAM_ICP,
+				"[%s] unable to get property name: idx=%d rc=%d",
+				hw_mgr->hw_mgr_name, i, rc);
+			goto free_devices;
+		}
+
+		node = of_find_node_by_name(NULL, name);
+		if (!node) {
+			CAM_ERR(CAM_ICP, "[%s] missing node %s",
+				hw_mgr->hw_mgr_name, name);
+			rc = -ENODEV;
+			goto free_devices;
+		}
+
+		pdev = of_find_device_by_node(node);
+		of_node_put(node);
+		if (!pdev) {
+			CAM_ERR(CAM_ICP,
+				"[%s] platform device not found for %s",
+				hw_mgr->hw_mgr_name, name);
+			rc = -ENODEV;
+			goto free_devices;
+		}
+
+		iface = platform_get_drvdata(pdev);
+		if (!iface || !iface->hw_ops.process_cmd) {
+			CAM_ERR(CAM_ICP,
+				"[%s] invalid interface: iface=%pK process_cmd=%pK",
+				hw_mgr->hw_mgr_name, iface,
+				(iface ? iface->hw_ops.process_cmd : NULL));
+
+			rc = -EINVAL;
+			goto free_devices;
+		}
+
+		if (!CAM_ICP_IS_VALID_HW_DEV_TYPE(iface->hw_type)) {
+			CAM_ERR(CAM_ICP, "[%s] Invalid HW type:%u",
+				hw_mgr->hw_mgr_name, iface->hw_type);
+			rc = -EINVAL;
+			goto free_devices;
+		}
+
+		num_hw = iface->hw_idx + 1;
+		for (j = 0; j < num_hw; j++) {
+			if (!devices[iface->hw_type][j]) {
+				devices[iface->hw_type][j] = iface;
+				break;
+			}
+		}
+	}
+
+	rc = cam_icp_mgr_set_up_dev_info(hw_mgr, devices, hw_dev_cnt);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Failed to set up hw device info rc=%d", rc);
+		goto free_devices;
+	}
+
+	return 0;
+
+free_devices:
+	for (i = 0; i < CAM_ICP_HW_MAX; i++)
+		kfree(devices[i]);
+
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_icp_command_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_workq_icp_message_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_workq_icp_timer_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int cam_icp_mgr_create_wq(struct cam_icp_hw_mgr *hw_mgr)
+{
+	char q_name[32];
+	int rc, i;
+
+	scnprintf(q_name, sizeof(q_name), "%s_command_queue", hw_mgr->hw_mgr_name);
+	rc = cam_req_mgr_workq_create("icp_command_queue", ICP_WORKQ_NUM_TASK,
+		&hw_mgr->cmd_work, CRM_WORKQ_USAGE_NON_IRQ, 0,
+		cam_req_mgr_process_workq_icp_command_queue);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] unable to create a command worker for %s",
+			hw_mgr->hw_mgr_name, q_name);
+		goto cmd_work_failed;
+	}
+
+	scnprintf(q_name, sizeof(q_name), "%s_message_queue", hw_mgr->hw_mgr_name);
+	rc = cam_req_mgr_workq_create(q_name, ICP_WORKQ_NUM_TASK,
+		&hw_mgr->msg_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_icp_message_queue);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] unable to create a message worker for %s",
+			hw_mgr->hw_mgr_name, q_name);
+		goto msg_work_failed;
+	}
+
+	scnprintf(q_name, sizeof(q_name), "%s_timer_queue", hw_mgr->hw_mgr_name);
+	rc = cam_req_mgr_workq_create(q_name, ICP_WORKQ_NUM_TASK,
+		&hw_mgr->timer_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_icp_timer_queue);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] unable to create a timer worker for %s",
+			hw_mgr->hw_mgr_name, q_name);
+		goto timer_work_failed;
+	}
+
+	hw_mgr->cmd_work_data =
+		kzalloc(sizeof(struct hfi_cmd_work_data) * ICP_WORKQ_NUM_TASK, GFP_KERNEL);
+	if (!hw_mgr->cmd_work_data) {
+		CAM_ERR(CAM_ICP, "[%s] Mem reservation fail for cmd_work_data",
+			hw_mgr->hw_mgr_name);
+		goto cmd_work_data_failed;
+	}
+	hw_mgr->msg_work_data =
+		kzalloc(sizeof(struct hfi_msg_work_data) * ICP_WORKQ_NUM_TASK, GFP_KERNEL);
+	if (!hw_mgr->msg_work_data) {
+		CAM_ERR(CAM_ICP, "[%s] Mem reservation fail for msg_work_data",
+			hw_mgr->hw_mgr_name);
+		goto msg_work_data_failed;
+	}
+
+	hw_mgr->timer_work_data =
+		kzalloc(sizeof(struct hfi_msg_work_data) * ICP_WORKQ_NUM_TASK, GFP_KERNEL);
+	if (!hw_mgr->timer_work_data) {
+		CAM_ERR(CAM_ICP, "[%s] Mem reservation fail for timer_work_data",
+			hw_mgr->hw_mgr_name);
+		goto timer_work_data_failed;
+	}
+
+	for (i = 0; i < ICP_WORKQ_NUM_TASK; i++)
+		hw_mgr->msg_work->task.pool[i].payload =
+			&hw_mgr->msg_work_data[i];
+
+	for (i = 0; i < ICP_WORKQ_NUM_TASK; i++)
+		hw_mgr->cmd_work->task.pool[i].payload =
+			&hw_mgr->cmd_work_data[i];
+
+	for (i = 0; i < ICP_WORKQ_NUM_TASK; i++)
+		hw_mgr->timer_work->task.pool[i].payload =
+			&hw_mgr->timer_work_data[i];
+	return 0;
+
+timer_work_data_failed:
+	kfree(hw_mgr->msg_work_data);
+msg_work_data_failed:
+	kfree(hw_mgr->cmd_work_data);
+cmd_work_data_failed:
+	cam_req_mgr_workq_destroy(&hw_mgr->timer_work);
+timer_work_failed:
+	cam_req_mgr_workq_destroy(&hw_mgr->msg_work);
+msg_work_failed:
+	cam_req_mgr_workq_destroy(&hw_mgr->cmd_work);
+cmd_work_failed:
+	return rc;
+}
+
+void cam_icp_mgr_destroy_wq(struct cam_icp_hw_mgr *hw_mgr)
+{
+	cam_req_mgr_workq_destroy(&hw_mgr->timer_work);
+	cam_req_mgr_workq_destroy(&hw_mgr->msg_work);
+	cam_req_mgr_workq_destroy(&hw_mgr->cmd_work);
+}
+
+static void cam_icp_mgr_dump_pf_data(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_hw_cmd_pf_args *pf_cmd_args)
+{
+	struct cam_packet          *packet;
+	struct cam_hw_dump_pf_args *pf_args;
+	int                         rc;
+
+	pf_args = pf_cmd_args->pf_args;
+
+	rc = cam_packet_util_get_packet_addr(&packet, pf_cmd_args->pf_req_info->packet_handle,
+		pf_cmd_args->pf_req_info->packet_offset);
+	if (rc)
+		return;
+
+	/*
+	 * res_id_support is false since ICP doesn't have knowledge
+	 * of res_id. FW submits packet to HW
+	 */
+	cam_packet_util_dump_io_bufs(packet, hw_mgr->iommu_hdl,
+		hw_mgr->iommu_sec_hdl, pf_args, false);
+
+	cam_packet_util_dump_patch_info(packet, hw_mgr->iommu_hdl,
+		hw_mgr->iommu_sec_hdl, pf_args);
+
+	cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
+}
+
+static int cam_icp_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_icp_hw_mgr  *hw_mgr = hw_mgr_priv;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_ICP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_icp_mgr_dump_pf_data(hw_mgr, hw_cmd_args->u.pf_cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "[%s] Invalid cmd", hw_mgr->hw_mgr_name);
+	}
+
+	return rc;
+}
+
+static void cam_icp_mgr_inject_evt(void *hw_mgr_priv, void *evt_args)
+{
+	struct cam_icp_hw_ctx_data *ctx_data       = hw_mgr_priv;
+	struct cam_hw_inject_evt_param *evt_params = evt_args;
+
+	if (!ctx_data || !evt_params) {
+		CAM_ERR(CAM_ICP, "Invalid params ctx data %s event params %s",
+			CAM_IS_NULL_TO_STR(ctx_data), CAM_IS_NULL_TO_STR(evt_params));
+		return;
+	}
+
+	memcpy(&ctx_data->evt_inject_params, evt_params, sizeof(struct cam_hw_inject_evt_param));
+
+	ctx_data->evt_inject_params.is_valid = true;
+}
+
+static int cam_icp_mgr_register_hfi_client(struct cam_icp_hw_mgr *hw_mgr)
+{
+
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	int hfi_handle;
+	int rc;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP device interface is NULL",
+			hw_mgr->hw_mgr_name);
+		return -EINVAL;
+	}
+
+	hw_mgr->hfi_handle = HFI_HANDLE_INIT_VALUE;
+	rc = cam_hfi_register(&hw_mgr->hfi_handle, hw_mgr->hw_mgr_name);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Fail to register hw mgr as hfi client rc=%d",
+			hw_mgr->hw_mgr_name, rc);
+		return rc;
+	}
+
+	hfi_handle = hw_mgr->hfi_handle;
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv, CAM_ICP_CMD_SET_HFI_HANDLE,
+		&hfi_handle, sizeof(hfi_handle));
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Fail to share hfi handle to ICP core rc=%d hfi hdl: %d",
+			hw_mgr->hw_mgr_name, rc, hfi_handle);
+		cam_hfi_unregister(&hw_mgr->hfi_handle);
+		return rc;
+	}
+
+	CAM_DBG(CAM_ICP, "[%s] successfully registered as hfi client with handle: %d",
+		hw_mgr->hw_mgr_name, hfi_handle);
+
+	return 0;
+}
+
+static void cam_icp_mgr_unregister_hfi_client(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	int rc;
+
+	rc = cam_hfi_unregister(&hw_mgr->hfi_handle);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Failed to unregister hfi client hdl: %d rc: %d",
+			hw_mgr->hw_mgr_name, hw_mgr->hfi_handle, rc);
+		return;
+	}
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "[%s] ICP dev intf is NULL", hw_mgr->hw_mgr_name);
+		return;
+	}
+
+	icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv, CAM_ICP_CMD_SET_HFI_HANDLE,
+		&hw_mgr->hfi_handle, sizeof(hw_mgr->hfi_handle));
+}
+
+static int cam_icp_mgr_get_hw_mgr_name(uint32_t device_idx, char *hw_mgr_name)
+{
+	if (!hw_mgr_name) {
+		CAM_ERR(CAM_ICP, "Invalid output parameter hw mgr id NULL");
+		return -EINVAL;
+	}
+
+	if (device_idx)
+		scnprintf(hw_mgr_name, CAM_ICP_HW_MGR_NAME_SIZE, "icp%u", device_idx);
+	else
+		strscpy(hw_mgr_name, "icp", CAM_ICP_HW_MGR_NAME_SIZE);
+
+	return 0;
+}
+
+int cam_icp_hw_mgr_init(struct device_node *of_node, uint64_t *hw_mgr_hdl,
+	int *iommu_hdl, cam_icp_mini_dump_cb mini_dump_cb, int device_idx)
+{
+	int i, rc = 0;
+	struct cam_icp_hw_mgr  *hw_mgr = NULL;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	uint32_t size = 0;
+
+	hw_mgr_intf = (struct cam_hw_mgr_intf *)hw_mgr_hdl;
+	if (!of_node || !hw_mgr_intf) {
+		CAM_ERR(CAM_ICP, "Invalid args of_node %pK hw_mgr %pK",
+			of_node, hw_mgr_intf);
+		return -EINVAL;
+	}
+
+	if (g_icp_hw_mgr[device_idx]) {
+		CAM_ERR(CAM_ICP, "HW mgr for device idx: %u already initialized", device_idx);
+		return -EPERM;
+	}
+
+	memset(hw_mgr_intf, 0, sizeof(struct cam_hw_mgr_intf));
+
+	hw_mgr = kzalloc(sizeof(struct cam_icp_hw_mgr), GFP_KERNEL);
+	if (!hw_mgr)
+		return -ENOMEM;
+
+	hw_mgr->hw_mgr_id = device_idx;
+
+	rc = cam_icp_mgr_get_hw_mgr_name(device_idx, hw_mgr->hw_mgr_name);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Fail to get hw mgr name rc: %d for icp dev[%u]",
+			rc, device_idx);
+		goto free_hw_mgr;
+	}
+
+	CAM_DBG(CAM_ICP, "Initailize hw mgr[%u] with name: %s",
+		device_idx, hw_mgr->hw_mgr_name);
+
+	hw_mgr_intf->hw_mgr_priv = hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_icp_mgr_get_hw_caps;
+	hw_mgr_intf->hw_get_caps_v2 = cam_icp_mgr_get_hw_caps_v2;
+	hw_mgr_intf->hw_acquire = cam_icp_mgr_acquire_hw;
+	hw_mgr_intf->hw_release = cam_icp_mgr_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_icp_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config_stream_settings =
+		cam_icp_mgr_config_stream_settings;
+	hw_mgr_intf->hw_config = cam_icp_mgr_config_hw;
+	hw_mgr_intf->hw_open = cam_icp_mgr_hw_open_u;
+	hw_mgr_intf->hw_close = cam_icp_mgr_hw_close_u;
+	hw_mgr_intf->hw_flush = cam_icp_mgr_hw_flush;
+	hw_mgr_intf->hw_cmd = cam_icp_mgr_cmd;
+	hw_mgr_intf->hw_dump = cam_icp_mgr_hw_dump;
+	hw_mgr_intf->hw_inject_evt = cam_icp_mgr_inject_evt;
+	hw_mgr->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+	hw_mgr->mini_dump_cb = mini_dump_cb;
+	hw_mgr_intf->synx_trigger = cam_icp_mgr_service_synx_test_cmds;
+
+	mutex_init(&hw_mgr->hw_mgr_mutex);
+	spin_lock_init(&hw_mgr->hw_mgr_lock);
+
+	atomic_set(&hw_mgr->frame_in_process, 0);
+	hw_mgr->frame_in_process_ctx_id = -1;
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		mutex_init(&hw_mgr->ctx_data[i].ctx_mutex);
+		if (cam_presil_mode_enabled()) {
+			size = CAM_FRAME_CMD_MAX * sizeof(struct cam_hangdump_mem_regions);
+			hw_mgr->ctx_data[i].hfi_frame_process.hangdump_mem_regions =
+				kzalloc(size, GFP_KERNEL);
+		}
+	}
+
+	rc = cam_icp_mgr_init_devs(of_node, hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] cam_icp_mgr_init_devs fail: rc: %d",
+			hw_mgr->hw_mgr_name, rc);
+		goto destroy_mutex;
+	}
+
+	rc = cam_smmu_get_handle(hw_mgr->hw_mgr_name, &hw_mgr->iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] get mmu handle failed: %d",
+		hw_mgr->hw_mgr_name, rc);
+		goto icp_get_hdl_failed;
+	}
+
+	rc = cam_smmu_get_handle("cam-secure", &hw_mgr->iommu_sec_hdl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] get secure mmu handle failed: %d",
+		hw_mgr->hw_mgr_name, rc);
+		goto secure_hdl_failed;
+	}
+
+	rc = cam_icp_mgr_create_wq(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] cam_icp_mgr_create_wq fail: rc=%d",
+		hw_mgr->hw_mgr_name, rc);
+		goto icp_wq_create_failed;
+	}
+
+	rc = cam_icp_hw_mgr_create_debugfs_entry(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Fail to create debugfs entry",
+			hw_mgr->hw_mgr_name);
+		goto icp_debugfs_create_failed;
+	}
+
+	if (iommu_hdl)
+		*iommu_hdl = hw_mgr->iommu_hdl;
+
+	rc = cam_icp_mgr_register_hfi_client(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s] Fail to register hw mgr as hfi handle",
+			hw_mgr->hw_mgr_name);
+		goto icp_hfi_register_failed;
+	}
+
+	init_completion(&hw_mgr->icp_complete);
+	cam_common_register_mini_dump_cb(cam_icp_hw_mgr_mini_dump_cb, hw_mgr->hw_mgr_name,
+		&hw_mgr->hw_mgr_id);
+
+	cam_icp_test_irq_line_at_probe(hw_mgr);
+
+	rc = cam_icp_get_svs_clk_info(hw_mgr);
+	if (rc)
+		goto icp_get_svs_clk_failed;
+
+	if (hw_mgr->synx_signaling_en) {
+		switch (hw_mgr->hw_mgr_id) {
+		case 0:
+			hw_mgr->synx_core_id = CAM_ICP_0_SYNX_CORE;
+			break;
+		case 1:
+			hw_mgr->synx_core_id = CAM_ICP_1_SYNX_CORE;
+			break;
+		default:
+			hw_mgr->synx_core_id = CAM_INVALID_SYNX_CORE;
+			break;
+		}
+	}
+
+	g_icp_hw_mgr[device_idx] = hw_mgr;
+
+	CAM_DBG(CAM_ICP, "Done hw mgr[%u] init: icp name:%s",
+		device_idx, hw_mgr->hw_mgr_name);
+
+	return rc;
+
+icp_get_svs_clk_failed:
+	cam_hfi_unregister(&hw_mgr->hfi_handle);
+icp_hfi_register_failed:
+	debugfs_remove_recursive(hw_mgr->dentry);
+	hw_mgr->dentry = NULL;
+icp_debugfs_create_failed:
+	cam_icp_mgr_destroy_wq(hw_mgr);
+icp_wq_create_failed:
+	cam_smmu_destroy_handle(hw_mgr->iommu_sec_hdl);
+	hw_mgr->iommu_sec_hdl = -1;
+secure_hdl_failed:
+	cam_smmu_destroy_handle(hw_mgr->iommu_hdl);
+	hw_mgr->iommu_hdl = -1;
+icp_get_hdl_failed:
+	cam_icp_mgr_free_hw_devs(hw_mgr);
+destroy_mutex:
+	mutex_destroy(&hw_mgr->hw_mgr_mutex);
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		mutex_destroy(&hw_mgr->ctx_data[i].ctx_mutex);
+		if (cam_presil_mode_enabled())
+			kfree(hw_mgr->ctx_data[i].hfi_frame_process.hangdump_mem_regions);
+	}
+free_hw_mgr:
+	kfree(hw_mgr);
+
+	return rc;
+}
+
+void cam_icp_hw_mgr_deinit(int device_idx)
+{
+	struct cam_icp_hw_mgr *hw_mgr = NULL;
+	int i = 0;
+
+	hw_mgr = g_icp_hw_mgr[device_idx];
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Uninitialized hw mgr for subdev: %u", device_idx);
+		return;
+	}
+
+	CAM_DBG(CAM_ICP, "hw mgr deinit: %u icp name: %s", device_idx, hw_mgr->hw_mgr_name);
+
+	hw_mgr->dentry = NULL;
+
+	cam_icp_mgr_unregister_hfi_client(hw_mgr);
+	cam_icp_mgr_destroy_wq(hw_mgr);
+	cam_icp_mgr_free_hw_devs(hw_mgr);
+	mutex_destroy(&hw_mgr->hw_mgr_mutex);
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		mutex_destroy(&hw_mgr->ctx_data[i].ctx_mutex);
+		if (cam_presil_mode_enabled())
+			kfree(hw_mgr->ctx_data[i].hfi_frame_process.hangdump_mem_regions);
+	}
+
+	kfree(hw_mgr);
+	g_icp_hw_mgr[device_idx] = NULL;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
@@ -0,0 +1,610 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_ICP_HW_MGR_H
+#define CAM_ICP_HW_MGR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <linux/semaphore.h>
+#include <media/cam_icp.h>
+#include "cam_icp_hw_intf.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "hfi_session_defs.h"
+#include "hfi_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_smmu_api.h"
+#include "cam_soc_util.h"
+#include "cam_req_mgr_timer.h"
+
+#define CAM_ICP_ROLE_PARENT     1
+#define CAM_ICP_ROLE_CHILD      2
+
+#define CAM_FRAME_CMD_MAX       40
+
+#define CAM_MAX_OUT_RES         14
+#define CAM_MAX_IN_RES          16
+
+#define ICP_WORKQ_NUM_TASK      100
+#define ICP_WORKQ_TASK_CMD_TYPE 1
+#define ICP_WORKQ_TASK_MSG_TYPE 2
+
+#define ICP_PACKET_SIZE         0
+#define ICP_PACKET_TYPE         1
+#define ICP_PACKET_OPCODE       2
+#define ICP_MAX_OUTPUT_SUPPORTED 6
+
+#define ICP_FRAME_PROCESS_SUCCESS 0
+#define ICP_FRAME_PROCESS_FAILURE 1
+
+/* size of buffer to drain from msg/dbq queue */
+#define ICP_MSG_BUF_SIZE_IN_WORDS 512
+#define ICP_DBG_BUF_SIZE_IN_WORDS 25600
+
+#define ICP_OVER_CLK_THRESHOLD  5
+#define ICP_TWO_DEV_BW_SHARE_RATIO 2
+
+#define CPAS_IPE0_BIT           0x1000
+#define CPAS_IPE1_BIT           0x2000
+#define CPAS_BPS_BIT            0x400
+#define CPAS_ICP_BIT            0x1
+#define CPAS_ICP1_BIT           0x4
+#define CPAS_OFE_BIT            0x10
+
+/* Used for targets >= 480 and its variants */
+#define CPAS_TITAN_IPE0_CAP_BIT 0x800
+
+#define CAM_ICP_CTX_STATE_FREE      0x0
+#define CAM_ICP_CTX_STATE_IN_USE    0x1
+#define CAM_ICP_CTX_STATE_ACQUIRED  0x2
+#define CAM_ICP_CTX_STATE_RELEASE   0x3
+
+#define CAM_ICP_CTX_MAX_CMD_BUFFERS 0x2
+
+/* Current appliacble vote paths, based on number of UAPI definitions */
+#define CAM_ICP_MAX_PER_PATH_VOTES 12
+
+#define CAM_ICP_HW_MGR_NAME_SIZE  32
+
+#define CAM_ICP_IS_DEV_HW_EXIST(hw_cap_mask, hw_dev_type)  \
+({                                                         \
+	(hw_cap_mask) & BIT((hw_dev_type));                \
+})
+
+#define CAM_ICP_IS_VALID_HW_DEV_TYPE(type)                          \
+({                                                                  \
+	((type) >= CAM_ICP_HW_ICP_V1) && ((type) < CAM_ICP_HW_MAX); \
+})
+
+#define CAM_ICP_MAX_ICP_PROC_PER_DEV 1
+
+struct hfi_mini_dump_info;
+
+/**
+ * struct icp_hfi_mem_info
+ * @qtbl: Memory info of queue table
+ * @cmd_q: Memory info of command queue
+ * @msg_q: Memory info of message queue
+ * @dbg_q: Memory info of debug queue
+ * @sec_heap: Memory info of secondary heap
+ * @fw_buf: Memory info of firmware
+ * @qdss_buf: Memory info of qdss
+ * @sfr_buf: Memory info for sfr buffer
+ * @fw_uncached_generic: Memory info for fw uncached region
+ * @fw_uncached_global_sync: Memory info for global sync, in fw uncached region
+ * @synx_hwmutex: Memory info for synx hwmutex region mapped as device memory
+ * @ipc_hwmutex: Memory info for ipc hwmutex region mapped as device memory
+ * @global_cntr: Memory info for global cntr region mapped as device memory
+ * @shmem: Memory info for shared region
+ * @io_mem: Memory info for io region
+ * @fw_uncached: Memory info for fw uncached nested region
+ * @device: Memory info for the device region
+ * @fw_uncached_region: region support for fw uncached
+ */
+struct icp_hfi_mem_info {
+	struct cam_mem_mgr_memory_desc qtbl;
+	struct cam_mem_mgr_memory_desc cmd_q;
+	struct cam_mem_mgr_memory_desc msg_q;
+	struct cam_mem_mgr_memory_desc dbg_q;
+	struct cam_mem_mgr_memory_desc sec_heap;
+	struct cam_mem_mgr_memory_desc fw_buf;
+	struct cam_mem_mgr_memory_desc qdss_buf;
+	struct cam_mem_mgr_memory_desc sfr_buf;
+	struct cam_mem_mgr_memory_desc fw_uncached_generic;
+	struct cam_mem_mgr_memory_desc fw_uncached_global_sync;
+	struct cam_mem_mgr_memory_desc synx_hwmutex;
+	struct cam_mem_mgr_memory_desc ipc_hwmutex;
+	struct cam_mem_mgr_memory_desc global_cntr;
+	struct cam_smmu_region_info shmem;
+	struct cam_smmu_region_info io_mem;
+	struct cam_smmu_region_info fw_uncached;
+	struct cam_smmu_region_info device;
+	bool fw_uncached_region;
+};
+
+/**
+ * struct hfi_cmd_work_data
+ * @type: Task type
+ * @data: Pointer to command data
+ * @request_id: Request id
+ */
+struct hfi_cmd_work_data {
+	uint32_t type;
+	void *data;
+	int32_t request_id;
+};
+
+/**
+ * struct hfi_msg_work_data
+ * @type: Task type
+ * @data: Pointer to message data
+ * @recover: Device needs recovery
+ */
+struct hfi_msg_work_data {
+	uint32_t type;
+	void *data;
+	bool recover;
+};
+
+/**
+ * struct clk_work_data
+ * @type: Task type
+ * @data: Pointer to clock info
+ */
+struct clk_work_data {
+	uint32_t type;
+	void *data;
+};
+
+/*
+ * struct icp_frame_info
+ * @request_id: request id
+ * @io_config: the address of io config
+ * @hfi_cfg_io_cmd: command struct to be sent to hfi
+ * @pkt: pointer to the packet header of current request
+ */
+struct icp_frame_info {
+	uint64_t request_id;
+	dma_addr_t io_config;
+	struct hfi_cmd_dev_async hfi_cfg_io_cmd;
+	struct cam_packet *pkt;
+};
+
+/**
+ * struct cam_icp_clk_bw_request_v2
+ *
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @reserved: Reserved filed.
+ * @num_paths: Number of paths for per path bw vote
+ * @axi_path: Per path vote info for IPE/BPS
+ */
+struct cam_icp_clk_bw_req_internal_v2 {
+	uint64_t budget_ns;
+	uint32_t frame_cycles;
+	uint32_t rt_flag;
+	uint32_t reserved;
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_ICP_MAX_PER_PATH_VOTES];
+};
+
+#define HANG_DUMP_REGIONS_MAX 10
+
+/**
+ * struct cam_hangdump_mem_regions -
+ *        List of multiple memory descriptors of different
+ *        regions
+ *
+ * @num_regions    : Number of regions
+ * @map_info_array : Array of all the regions
+ */
+struct cam_hangdump_mem_regions {
+	uint32_t num_mem_regions;
+	struct cam_cmd_mem_region_info mem_info_array[HANG_DUMP_REGIONS_MAX];
+};
+
+/**
+ * struct cam_icp_ctx_perf_stats -
+ *        ICP general Perf stats per ctx
+ *
+ * @total_resp_time: accumulative FW response time
+ * @total_requests : accumulative submitted requests
+ */
+struct cam_icp_ctx_perf_stats {
+	uint64_t total_resp_time;
+	uint64_t total_requests;
+};
+
+/**
+ * struct cam_icp_hw_ctx_dev_info -
+ *        Info of ICP devices (IPE/BPS/OFE) that can be attached to a context
+ *
+ * @dev_ctxt_cnt : device context count
+ * @dev_clk_state: device clock state
+ */
+struct cam_icp_hw_ctx_dev_info {
+	uint32_t dev_ctxt_cnt;
+	bool dev_clk_state;
+};
+
+/**
+ * struct hfi_frame_process_info
+ * @hfi_frame_cmd: Frame process command info
+ * @bitmap: Bitmap for hfi_frame_cmd
+ * @bits: Used in hfi_frame_cmd bitmap
+ * @lock: Lock for hfi_frame_cmd
+ * @request_id: Request id list
+ * @num_out_resources: Number of out syncs
+ * @out_resource: Out sync info
+ * @fw_process_flag: Frame process flag
+ * @clk_info: Clock information for a request
+ * @clk_info_v2: Clock info for AXI bw voting v2
+ * @frame_info: information needed to process request
+ * @submit_timestamp: Submit timestamp to hw
+ * @hangdump_mem_regions: Mem regions for hangdump
+ */
+struct hfi_frame_process_info {
+	struct hfi_cmd_dev_async hfi_frame_cmd[CAM_FRAME_CMD_MAX];
+	void *bitmap;
+	size_t bits;
+	struct mutex lock;
+	uint64_t request_id[CAM_FRAME_CMD_MAX];
+	uint32_t num_out_resources[CAM_FRAME_CMD_MAX];
+	uint32_t out_resource[CAM_FRAME_CMD_MAX][CAM_MAX_OUT_RES];
+	uint32_t in_resource[CAM_FRAME_CMD_MAX];
+	uint32_t in_free_resource[CAM_FRAME_CMD_MAX];
+	bool fw_process_flag[CAM_FRAME_CMD_MAX];
+	struct cam_icp_clk_bw_request clk_info[CAM_FRAME_CMD_MAX];
+	struct cam_icp_clk_bw_req_internal_v2 clk_info_v2[CAM_FRAME_CMD_MAX];
+	struct icp_frame_info frame_info[CAM_FRAME_CMD_MAX];
+	ktime_t submit_timestamp[CAM_FRAME_CMD_MAX];
+	struct cam_hangdump_mem_regions *hangdump_mem_regions;
+};
+
+/**
+ * struct cam_ctx_clk_info
+ * @curr_fc: Context latest request frame cycles
+ * @rt_flag: Flag to indicate real time request
+ * @base_clk: Base clock to process the request
+ * @reserved: Reserved field
+ * #uncompressed_bw: Current bandwidth voting
+ * @compressed_bw: Current compressed bandwidth voting
+ * @clk_rate: Supported clock rates for the context
+ * @num_paths: Number of valid AXI paths
+ * @axi_path: ctx based per path bw vote
+ * @bw_included: Whether bw of this context is included in overal voting
+ */
+struct cam_ctx_clk_info {
+	uint32_t curr_fc;
+	uint32_t rt_flag;
+	uint32_t base_clk;
+	uint32_t reserved;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+	int32_t clk_rate[CAM_MAX_VOTE];
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_ICP_MAX_PER_PATH_VOTES];
+	bool bw_included;
+};
+
+/**
+ * struct icp_cmd_generic_blob
+ * @ctx: Current context info
+ * @frame_info_idx: Index used for frame process info
+ * @io_buf_addr: pointer to io buffer address
+ */
+struct icp_cmd_generic_blob {
+	struct cam_icp_hw_ctx_data *ctx;
+	uint32_t frame_info_idx;
+	dma_addr_t *io_buf_addr;
+};
+
+/**
+ * struct cam_icp_clk_info
+ * @base_clk: Base clock to process request
+ * @curr_clk: Current clock of hadrware
+ * @prev_clk: Previous clock of hadrware
+ * @threshold: Threshold for overclk count
+ * @over_clked: Over clock count
+ * @uncompressed_bw: Current bandwidth voting
+ * @compressed_bw: Current compressed bandwidth voting
+ * @num_paths: Number of AXI vote paths
+ * @axi_path: Current per path bw vote info
+ * @watch_dog: watchdog timer handle
+ * @watch_dog_reset_counter: Counter for watch dog reset
+ * @timeout_cb_data: private cb data to be used when device timeouts
+ */
+struct cam_icp_clk_info {
+	uint32_t base_clk;
+	uint32_t curr_clk;
+	uint32_t prev_clk;
+	uint32_t threshold;
+	uint32_t over_clked;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_ICP_MAX_PER_PATH_VOTES];
+	struct cam_req_mgr_timer *watch_dog;
+	uint32_t watch_dog_reset_counter;
+	void *timeout_cb_data;
+};
+
+/**
+ * struct cam_icp_hw_device_info
+ * @dev_name: name of IPE/BPS/OFE device
+ * @hw_dev_type: type of IPE/BPS/OFE device
+ * @dev_intf: interface to device hardware layer
+ * @clk_info: clock info for the device
+ * @dev_ctx_info: context related info for the device
+ * @hw_dev_cnt: number of devices for this particular device type
+ *              Exa - for IPE device - IPE0 and IPE1
+ */
+struct cam_icp_hw_device_info {
+	char *dev_name;
+	enum cam_icp_hw_type hw_dev_type;
+	struct cam_hw_intf **dev_intf;
+	struct cam_icp_clk_info clk_info;
+	struct cam_icp_hw_ctx_dev_info dev_ctx_info;
+	uint32_t hw_dev_cnt;
+};
+
+/**
+ * struct cam_icp_hw_ctx_data
+ * @context_priv: Context private data
+ * @hw_mgr_priv: HW MGR of the context
+ * @device_info: device info associated with this ctx
+ * @ctx_mutex: Mutex for context
+ * @fw_handle: Firmware handle
+ * @scratch_mem_size: Scratch memory size
+ * @icp_dev_acquire_info: Acquire device info
+ * @ctxt_event_cb: Context callback function
+ * @state: context state
+ * @role: Role of a context in case of chaining
+ * @chain_ctx: Peer context
+ * @hfi_frame_process: Frame process command
+ * @wait_complete: Completion info
+ * @ctx_id: Context Id
+ * @bw_config_version: BW config version indicator
+ * @clk_info: Current clock info of a context
+ * @watch_dog: watchdog timer handle
+ * @watch_dog_reset_counter: Counter for watch dog reset
+ * @last_flush_req: last flush req for this ctx
+ * @ctx_id_string: string helps to identify context (primarily used for logging)
+ * @perf_stats: performance statistics info
+ * @evt_inject_params: Event injection data for hw_mgr_ctx
+ * @abort_timed_out: Indicates if abort timed out
+ */
+struct cam_icp_hw_ctx_data {
+	void *context_priv;
+	void *hw_mgr_priv;
+	struct cam_icp_hw_device_info *device_info;
+	struct mutex ctx_mutex;
+	uint32_t fw_handle;
+	uint32_t scratch_mem_size;
+	struct cam_icp_acquire_dev_info *icp_dev_acquire_info;
+	cam_hw_event_cb_func ctxt_event_cb;
+	uint32_t state;
+	uint32_t role;
+	struct cam_icp_hw_ctx_data *chain_ctx;
+	struct hfi_frame_process_info hfi_frame_process;
+	struct completion wait_complete;
+	uint32_t ctx_id;
+	uint32_t bw_config_version;
+	struct cam_ctx_clk_info clk_info;
+	struct cam_req_mgr_timer *watch_dog;
+	uint32_t watch_dog_reset_counter;
+	uint64_t last_flush_req;
+	char ctx_id_string[128];
+	struct cam_icp_ctx_perf_stats perf_stats;
+	struct cam_hw_inject_evt_param evt_inject_params;
+	bool abort_timed_out;
+};
+
+/**
+ * struct cam_icp_hw_mgr
+ * @hw_mgr_mutex: Mutex for ICP hardware manager
+ * @hw_mgr_lock: Spinlock for ICP hardware manager
+ * @dev_info: array of available device info (IPE/BPS/OFE)
+ *            for the hw mgr
+ * @num_dev_info: number of device info for available device for the hw mgr
+ * @dev_info_idx: map hw dev type to index for device info array indexing
+ * @icp_dev_intf: ICP device interface
+ * @ctx_data: Context data
+ * @mini_dump_cb: Mini dump cb
+ * @hw_mgr_name: name of the hw mgr
+ * @hw_mgr_id: ID of the hw mgr, equivalent to hw mgr index
+ * @iommu_hdl: Non secure IOMMU handle
+ * @iommu_sec_hdl: Secure IOMMU handle
+ * @hfi_handle: hfi handle for this ICP hw mgr
+ * @synx_core_id: Synx core ID if applicable
+ * @hfi_mem: Memory for hfi
+ * @cmd_work: Work queue for hfi commands
+ * @msg_work: Work queue for hfi messages
+ * @timer_work: Work queue for timer watchdog
+ * @msg_buf: Drain Buffer for message data from firmware
+ *           Buffer is an array of type __u32, total size
+ *           would be sizeof(_u32) * queue_size
+ * @dbg_buf: Drain Buffer for debug data from firmware
+ * @icp_complete: Completion info
+ * @cmd_work_data: Pointer to command work queue task
+ * @msg_work_data: Pointer to message work queue task
+ * @timer_work_data: Pointer to timer work queue task
+ * @ctxt_cnt: Active context count
+ * @dentry: Debugfs entry
+ * @icp_debug_clk: Set clock based on debug value
+ * @icp_default_clk: Set this clok if user doesn't supply
+ * @secure_mode: Flag to enable/disable secure camera
+ * @icp_debug_type : entry to enable FW debug message/qdss
+ * @icp_dbg_lvl : debug level set to FW.
+ * @icp_fw_dump_lvl : level set for dumping the FW data
+ * @icp_fw_ramdump_lvl : level set for FW ram dumps
+ * @recovery: Flag to validate if in previous session FW
+ *            reported a fatal error or wdt. If set FW is
+ *            re-downloaded for new camera session.
+ * @frame_in_process: Counter for frames in process
+ * @frame_in_process_ctx_id: Contxt id processing frame
+ * @hw_cap_mask: device capability mask to indicate which devices type
+ *               are available in this hw mgr
+ * @icp_booted: Processor is booted i.e. firmware loaded
+ * @icp_resumed: Processor is powered on
+ * @icp_pc_flag: Flag to enable/disable power collapse
+ * @dev_pc_flag: Flag to enable/disable
+ *                   power collapse for ipe & bps
+ * @icp_use_pil: Flag to indicate usage of PIL framework
+ * @icp_jtag_debug: entry to enable ICP JTAG debugging
+ * @disable_ubwc_comp: Disable UBWC compression
+ * @synx_signaling_en: core to core fencing is enabled
+ *                     using synx
+ */
+struct cam_icp_hw_mgr {
+	struct mutex hw_mgr_mutex;
+	spinlock_t hw_mgr_lock;
+
+	struct cam_icp_hw_device_info *dev_info;
+	uint32_t num_dev_info;
+	int8_t dev_info_idx[CAM_ICP_HW_MAX];
+	struct cam_hw_intf *icp_dev_intf;
+	struct cam_icp_hw_ctx_data ctx_data[CAM_ICP_CTX_MAX];
+	cam_icp_mini_dump_cb mini_dump_cb;
+	char hw_mgr_name[CAM_ICP_HW_MGR_NAME_SIZE];
+	uint32_t hw_mgr_id;
+
+	int32_t iommu_hdl;
+	int32_t iommu_sec_hdl;
+	int32_t hfi_handle;
+	enum cam_sync_synx_supported_cores synx_core_id;
+	struct icp_hfi_mem_info hfi_mem;
+	struct cam_req_mgr_core_workq *cmd_work;
+	struct cam_req_mgr_core_workq *msg_work;
+	struct cam_req_mgr_core_workq *timer_work;
+	uint32_t msg_buf[ICP_MSG_BUF_SIZE_IN_WORDS];
+	uint32_t dbg_buf[ICP_DBG_BUF_SIZE_IN_WORDS];
+	struct completion icp_complete;
+	struct hfi_cmd_work_data *cmd_work_data;
+	struct hfi_msg_work_data *msg_work_data;
+	struct hfi_msg_work_data *timer_work_data;
+	uint32_t ctxt_cnt;
+	struct dentry *dentry;
+	uint64_t icp_debug_clk;
+	uint64_t icp_default_clk;
+	uint32_t secure_mode;
+	u64 icp_debug_type;
+	u64 icp_dbg_lvl;
+	u64 icp_fw_dump_lvl;
+	u32 icp_fw_ramdump_lvl;
+	atomic_t recovery;
+	uint64_t icp_svs_clk;
+	atomic_t frame_in_process;
+	int frame_in_process_ctx_id;
+	uint32_t hw_cap_mask;
+	bool icp_booted;
+	bool icp_resumed;
+	bool icp_pc_flag;
+	bool dev_pc_flag;
+	bool icp_use_pil;
+	bool icp_jtag_debug;
+	bool disable_ubwc_comp;
+	bool synx_signaling_en;
+};
+
+/**
+ * struct cam_icp_mini_dump_acquire_info - ICP mini dump device info
+ *
+ * @in_res: resource info used for clock and bandwidth calculation
+ * @out_res: output resource
+ * @num_out_res: number of output resources
+ * @dev_type: device type (IPE_RT/IPE_NON_RT/BPS)
+ * @secure_mode: camera mode (secure/non secure)
+ */
+struct cam_icp_mini_dump_acquire_info {
+	struct cam_icp_res_info out_res[ICP_MAX_OUTPUT_SUPPORTED];
+	struct cam_icp_res_info in_res;
+	uint16_t                num_out_res;
+	uint8_t                 dev_type;
+	uint8_t                 secure_mode;
+};
+
+/**
+ * struct hfi_frame_process_info
+ * @request_id: Request id list
+ * @num_out_res: Number of out syncs
+ * @out_res: Out sync info
+ * @in_resource: In sync info
+ * @submit_timestamp: Submit timestamp to hw
+ * @fw_process_flag: Frame process flag
+ */
+struct  hfi_frame_mini_dump_info {
+	uint64_t                              request_id[CAM_FRAME_CMD_MAX];
+	uint32_t                              num_out_res[CAM_FRAME_CMD_MAX];
+	uint32_t                              out_res[CAM_FRAME_CMD_MAX][CAM_MAX_OUT_RES];
+	uint32_t                              in_resource[CAM_FRAME_CMD_MAX];
+	ktime_t                               submit_timestamp[CAM_FRAME_CMD_MAX];
+	uint8_t                               fw_process_flag[CAM_FRAME_CMD_MAX];
+};
+
+/**
+ * struct cam_icp_hw_ctx_mini_dump
+ * @acquire: Acquire device info
+ * @hfi_frame: Frame  command
+ * @hw_ctx: Context private data
+ * @state: context state
+ * @ctx_id_string: Context id string
+ * @ctx_id: Context Id
+ */
+struct cam_icp_hw_ctx_mini_dump {
+	struct cam_icp_mini_dump_acquire_info acquire;
+	struct hfi_frame_mini_dump_info       hfi_frame;
+	void                                 *hw_ctx;
+	char                                  ctx_id_string[128];
+	uint8_t                               state;
+	uint8_t                               ctx_id;
+};
+
+/**
+ * struct cam_icp_hw_mini_dump_info
+ *
+ * @hw_mgr_name: name of the hw mgr that is dumped
+ * @ctx: Context for minidump
+ * @hfi_info: hfi info
+ * @hfi_mem_info: hfi mem info
+ * @dev_info: array of device info
+ * @fw_img: FW image
+ * @recovery: To indicate if recovery is on
+ * @num_context: number of active context
+ * @num_device_info: number of available device info
+ * @icp_booted: Indicate if ICP is booted
+ * @icp_resumed: Indicate if ICP is resumed
+ * @disable_ubwc_comp: Indicate if ubws comp is disabled
+ * @icp_pc_flag: Is ICP PC enabled
+ * @dev_pc_flag: Is IPE BPS PC enabled
+ * @icp_use_pil: Is PIL used
+ */
+struct cam_icp_hw_mini_dump_info {
+	char                               hw_mgr_name[CAM_ICP_HW_MGR_NAME_SIZE];
+	struct cam_icp_hw_ctx_mini_dump   *ctx[CAM_ICP_CTX_MAX];
+	struct hfi_mini_dump_info          hfi_info;
+	struct icp_hfi_mem_info            hfi_mem_info;
+	struct cam_icp_hw_device_info      dev_info[CAM_ICP_DEV_NUM];
+	void                              *fw_img;
+	uint32_t                           recovery;
+	uint32_t                           num_context;
+	uint32_t                           num_device_info;
+	bool                               icp_booted;
+	bool                               icp_resumed;
+	bool                               disable_ubwc_comp;
+	bool                               icp_pc_flag;
+	bool                               dev_pc_flag;
+	bool                               icp_use_pil;
+};
+
+static int cam_icp_mgr_hw_close(void *hw_priv, void *hw_close_args);
+static int cam_icp_mgr_hw_open(void *hw_mgr_priv, void *download_fw_args);
+static int cam_icp_mgr_icp_resume(struct cam_icp_hw_mgr *hw_mgr);
+static int cam_icp_mgr_icp_power_collapse(struct cam_icp_hw_mgr *hw_mgr);
+#endif /* CAM_ICP_HW_MGR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_bps_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_bps_hw_intf.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_BPS_HW_INTF_H
+#define CAM_BPS_HW_INTF_H
+
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_intf.h"
+
+
+#endif /* CAM_BPS_HW_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_icp_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_icp_hw_intf.h
@@ -0,0 +1,136 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_ICP_HW_INTF_H
+#define CAM_ICP_HW_INTF_H
+
+#define CAM_ICP_CMD_BUF_MAX_SIZE     128
+#define CAM_ICP_MSG_BUF_MAX_SIZE     CAM_ICP_CMD_BUF_MAX_SIZE
+
+#define CAM_ICP_BW_CONFIG_UNKNOWN 0
+#define CAM_ICP_BW_CONFIG_V1      1
+#define CAM_ICP_BW_CONFIG_V2      2
+
+#define CAM_ICP_UBWC_COMP_EN      BIT(1)
+
+#define HFI_MAX_POLL_TRY 5
+#define PC_POLL_DELAY_US 100
+#define PC_POLL_TIMEOUT_US 10000
+
+#define CAM_ICP_DUMP_STATUS_REGISTERS BIT(0)
+#define CAM_ICP_DUMP_CSR_REGISTERS    BIT(1)
+
+#define CAM_ICP_MAX_ICP_HW_TYPE 2
+#define CAM_ICP_DEV_START_IDX CAM_ICP_MAX_ICP_HW_TYPE
+
+#define ICP_CAPS_MASK_IDX 0
+#define IPE_CAPS_MASK_IDX 0
+#define BPS_CAPS_MASK_IDX 0
+#define OFE_CAPS_MASK_IDX 1
+
+/* max caps mask is max value of all device caps mask index added by 1 */
+#define MAX_HW_CAPS_MASK 2
+
+enum cam_icp_hw_type {
+	CAM_ICP_HW_ICP_V1,
+	CAM_ICP_HW_ICP_V2,
+	CAM_ICP_DEV_IPE,
+	CAM_ICP_DEV_BPS,
+	CAM_ICP_DEV_OFE,
+	CAM_ICP_HW_MAX,
+};
+
+#define CAM_ICP_DEV_NUM          (CAM_ICP_HW_MAX - CAM_ICP_DEV_START_IDX)
+
+enum cam_icp_dev_cmd_type {
+	CAM_ICP_DEV_CMD_POWER_COLLAPSE,
+	CAM_ICP_DEV_CMD_POWER_RESUME,
+	CAM_ICP_DEV_CMD_SET_FW_BUF,
+	CAM_ICP_DEV_CMD_VOTE_CPAS,
+	CAM_ICP_DEV_CMD_CPAS_START,
+	CAM_ICP_DEV_CMD_CPAS_STOP,
+	CAM_ICP_DEV_CMD_UPDATE_CLK,
+	CAM_ICP_DEV_CMD_DISABLE_CLK,
+	CAM_ICP_DEV_CMD_RESET,
+	CAM_ICP_DEV_CMD_DUMP_CLK,
+	CAM_ICP_DEV_CMD_MAX
+};
+
+enum cam_icp_cmd_type {
+	CAM_ICP_CMD_PROC_SHUTDOWN,
+	CAM_ICP_CMD_PROC_BOOT,
+	CAM_ICP_CMD_POWER_COLLAPSE,
+	CAM_ICP_CMD_POWER_RESUME,
+	CAM_ICP_CMD_ACQUIRE,
+	CAM_ICP_TEST_IRQ,
+	CAM_ICP_SEND_INIT,
+	CAM_ICP_CMD_VOTE_CPAS,
+	CAM_ICP_CMD_CPAS_START,
+	CAM_ICP_CMD_CPAS_STOP,
+	CAM_ICP_CMD_UBWC_CFG,
+	CAM_ICP_CMD_PC_PREP,
+	CAM_ICP_CMD_CLK_UPDATE,
+	CAM_ICP_CMD_HW_DUMP,
+	CAM_ICP_CMD_HW_MINI_DUMP,
+	CAM_ICP_CMD_HW_REG_DUMP,
+	CAM_ICP_CMD_SET_HFI_HANDLE,
+	CAM_ICP_CMD_MAX,
+};
+
+struct cam_icp_irq_cb {
+	int32_t (*cb)(void *data, bool recover);
+	void *data;
+};
+
+/**
+ * struct cam_icp_boot_args - Boot arguments for ICP processor
+ *
+ * @firmware.iova: device vaddr to firmware region
+ * @firmware.kva: kernel vaddr to firmware region
+ * @firmware.len: length of firmware region
+ * @irq_cb: irq callback
+ * @debug_enabled: processor will be booted with debug enabled
+ * @use_sec_pil: If set to true, use secure PIL for load
+ */
+struct cam_icp_boot_args {
+	struct {
+		uint32_t iova;
+		uint64_t kva;
+		uint64_t len;
+	} firmware;
+
+	struct cam_icp_irq_cb irq_cb;
+	bool debug_enabled;
+	bool use_sec_pil;
+};
+
+/**
+ * struct cam_icp_dev_clk_update_cmd - Payload for hw manager command
+ *
+ * @curr_clk_rate:        clk rate to HW
+ * @clk_level:            clk level corresponding to the clk rate
+ *                        populated as output while the clk is being
+ *                        updated to the given rate
+ * @dev_pc_enable:        power collpase enable flag
+ */
+struct cam_icp_dev_clk_update_cmd {
+	uint32_t  curr_clk_rate;
+	int32_t clk_level;
+	bool  dev_pc_enable;
+};
+
+/**
+ * struct cam_icp_ubwc_cfg_cmd - ubwc cmd to send
+ *
+ * @ubwc_cfg_dev_mask: mask to indicate which device ubwc cfg to send to fw
+ * @disable_ubwc_comp: flag to force disable ubwc
+ */
+struct cam_icp_ubwc_cfg_cmd {
+	uint32_t ubwc_cfg_dev_mask;
+	bool disable_ubwc_comp;
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_ipe_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_ipe_hw_intf.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_IPE_HW_INTF_H
+#define CAM_IPE_HW_INTF_H
+
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_intf.h"
+
+
+#endif /* CAM_IPE_HW_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_ofe_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_ofe_hw_intf.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_OFE_HW_INTF_H
+#define CAM_OFE_HW_INTF_H
+
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_intf.h"
+
+
+#endif /* CAM_OFE_HW_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/cam_icp_proc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/cam_icp_proc.c
@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_debug_util.h"
+#include "cam_icp_proc.h"
+
+uint32_t icp_request_cnt[CAM_ICP_MAX_ICP_HW_TYPE];
+
+static int cam_icp_get_device_num(enum cam_icp_hw_type dev_type, uint32_t *num_dev)
+{
+	int rc = 0;
+
+	switch (dev_type) {
+	case CAM_ICP_HW_ICP_V1:
+		*num_dev = cam_icp_v1_get_device_num();
+		break;
+	case CAM_ICP_HW_ICP_V2:
+		*num_dev = cam_icp_v2_get_device_num();
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid dev type: %d", dev_type);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int cam_icp_alloc_processor_devs(struct device_node *np, enum cam_icp_hw_type *icp_hw_type,
+	struct cam_hw_intf ***devices, uint32_t *hw_dev_cnt)
+{
+	uint32_t num_icp_found = 0, num_icp_listed;
+	int rc, i;
+
+	if (!np) {
+		CAM_ERR(CAM_ICP, "Invalid device node");
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32(np, "num-icp", &num_icp_listed);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "read num-icp failed rc=%d", rc);
+		return -ENODEV;
+	}
+
+	if (!num_icp_listed) {
+		CAM_ERR(CAM_ICP, "No ICP device %d", num_icp_listed);
+		return -EINVAL;
+	}
+
+	/* Only one version of ICP processor supported per ICP subdevice */
+	for (i = 0; i < CAM_ICP_MAX_ICP_HW_TYPE; i++) {
+		rc = cam_icp_get_device_num(i, &num_icp_found);
+		if (rc)
+			return rc;
+
+		if (num_icp_found) {
+			*icp_hw_type = i;
+			break;
+		}
+	}
+
+	if (i == CAM_ICP_MAX_ICP_HW_TYPE) {
+		CAM_ERR(CAM_ICP, "No ICP device probed");
+		return -ENODEV;
+	}
+
+	icp_request_cnt[i] += num_icp_listed;
+
+	if (icp_request_cnt[i] > num_icp_found) {
+		CAM_ERR(CAM_ICP,
+			"number of ICP_V%u total requested: %u exceeds number of icp hw available: %u",
+			i+1, icp_request_cnt[i], num_icp_found);
+		return -EINVAL;
+	}
+
+	*devices = kcalloc(num_icp_listed, sizeof(**devices), GFP_KERNEL);
+	if (!(*devices)) {
+		CAM_ERR(CAM_ICP,
+			"ICP device memory allocation failed. Num devices: %u",
+			num_icp_listed);
+		return -ENOMEM;
+	}
+
+	hw_dev_cnt[i] = num_icp_listed;
+
+	CAM_DBG(CAM_ICP, "allocated device iface for %s",
+		i == CAM_ICP_HW_ICP_V1 ? "ICP_V1" : "ICP_V2");
+
+	return rc;
+}
+
+int cam_icp_get_hfi_device_ops(uint32_t hw_type, const struct hfi_ops **hfi_proc_ops)
+{
+	int rc = 0;
+
+	switch (hw_type) {
+	case CAM_ICP_HW_ICP_V1:
+		cam_icp_v1_populate_hfi_ops(hfi_proc_ops);
+		break;
+	case CAM_ICP_HW_ICP_V2:
+		cam_icp_v2_populate_hfi_ops(hfi_proc_ops);
+		break;
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_ICP, "Invalid ICP device type: %u", hw_type);
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/cam_icp_proc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/cam_icp_proc.h
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_icp_v1_core.h"
+#include "cam_icp_v2_core.h"
+#include "hfi_intf.h"
+
+#define CAM_ICP_GET_PROC_DEV_INTF(devices)                              \
+	(devices[CAM_ICP_HW_ICP_V1] ? devices[CAM_ICP_HW_ICP_V1][0] : \
+	devices[CAM_ICP_HW_ICP_V2][0])
+
+/**
+ * @brief : Get ICP device type (ICP_V1/ICP_V2/...)
+ */
+int cam_icp_alloc_processor_devs(struct device_node *np, enum cam_icp_hw_type *icp_hw_type,
+	struct cam_hw_intf ***devices, uint32_t *hw_dev_cnt);
+
+/**
+ * @brief : Get device operations per device type
+ */
+int cam_icp_get_hfi_device_ops(uint32_t hw_type, const struct hfi_ops **hif_ops);
+
+/**
+ * @brief : Get number of icp_v2 hw instances
+ */
+uint32_t cam_icp_v2_get_device_num(void);
+
+/**
+ * @brief : Get number of icp_v1 hw instances
+ */
+uint32_t cam_icp_v1_get_device_num(void);
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_proc_common.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_proc_common.c
@@ -0,0 +1,272 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_icp_proc_common.h"
+#include "cam_compat.h"
+#include "cam_icp_hw_intf.h"
+#include "hfi_intf.h"
+
+int32_t cam_icp_validate_fw(const uint8_t *elf,
+	uint32_t machine_id)
+{
+	struct elf32_hdr *elf_hdr;
+
+	if (!elf) {
+		CAM_ERR(CAM_ICP, "Invalid params");
+		return -EINVAL;
+	}
+
+	elf_hdr = (struct elf32_hdr *)elf;
+
+	if (memcmp(elf_hdr->e_ident, ELFMAG, SELFMAG)) {
+		CAM_ERR(CAM_ICP, "ICP elf identifier is failed");
+		return -EINVAL;
+	}
+
+	/* check architecture */
+	if (elf_hdr->e_machine != machine_id) {
+		CAM_ERR(CAM_ICP, "unsupported arch: 0x%x", elf_hdr->e_machine);
+		return -EINVAL;
+	}
+
+	/* check elf bit format */
+	if (elf_hdr->e_ident[EI_CLASS] != ELFCLASS32) {
+		CAM_ERR(CAM_ICP, "elf doesn't support 32 bit format");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int32_t cam_icp_get_fw_size(
+	const uint8_t *elf, uint32_t *fw_size)
+{
+	int32_t rc = 0;
+	int32_t i = 0;
+	uint32_t num_prg_hdrs;
+	unsigned char *icp_prg_hdr_tbl;
+	uint32_t seg_mem_size = 0;
+	struct elf32_hdr *elf_hdr;
+	struct elf32_phdr *prg_hdr;
+
+	if (!elf || !fw_size) {
+		CAM_ERR(CAM_ICP, "invalid args");
+		return -EINVAL;
+	}
+
+	*fw_size = 0;
+
+	elf_hdr = (struct elf32_hdr *)elf;
+	num_prg_hdrs = elf_hdr->e_phnum;
+	icp_prg_hdr_tbl = (unsigned char *)elf + elf_hdr->e_phoff;
+	prg_hdr = (struct elf32_phdr *)&icp_prg_hdr_tbl[0];
+
+	if (!prg_hdr) {
+		CAM_ERR(CAM_ICP, "failed to get elf program header attr");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "num_prg_hdrs = %d", num_prg_hdrs);
+	for (i = 0; i < num_prg_hdrs; i++, prg_hdr++) {
+		if (prg_hdr->p_flags == 0)
+			continue;
+
+		seg_mem_size = (prg_hdr->p_memsz + prg_hdr->p_align - 1) &
+			~(prg_hdr->p_align - 1);
+		seg_mem_size += prg_hdr->p_paddr;
+		CAM_DBG(CAM_ICP, "memsz:%x align:%x addr:%x seg_mem_size:%x",
+			(int)prg_hdr->p_memsz, (int)prg_hdr->p_align,
+			(int)prg_hdr->p_paddr, (int)seg_mem_size);
+		if (*fw_size < seg_mem_size)
+			*fw_size = seg_mem_size;
+
+	}
+
+	if (*fw_size == 0) {
+		CAM_ERR(CAM_ICP, "invalid elf fw file");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int32_t cam_icp_program_fw(const uint8_t *elf,
+	uintptr_t fw_kva_addr)
+{
+	int32_t rc = 0;
+	uint32_t num_prg_hdrs;
+	unsigned char *icp_prg_hdr_tbl;
+	int32_t i = 0;
+	u8 *dest;
+	u8 *src;
+	struct elf32_hdr *elf_hdr;
+	struct elf32_phdr *prg_hdr;
+
+	elf_hdr = (struct elf32_hdr *)elf;
+	num_prg_hdrs = elf_hdr->e_phnum;
+	icp_prg_hdr_tbl = (unsigned char *)elf + elf_hdr->e_phoff;
+	prg_hdr = (struct elf32_phdr *)&icp_prg_hdr_tbl[0];
+
+	if (!prg_hdr) {
+		CAM_ERR(CAM_ICP, "failed to get elf program header attr");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_prg_hdrs; i++, prg_hdr++) {
+		if (prg_hdr->p_flags == 0)
+			continue;
+
+		CAM_DBG(CAM_ICP, "Loading FW header size: %u paddr: %pK",
+			prg_hdr->p_filesz, prg_hdr->p_paddr);
+		if (prg_hdr->p_filesz != 0) {
+			src = (u8 *)((u8 *)elf + prg_hdr->p_offset);
+			dest = (u8 *)(((u8 *)fw_kva_addr) +
+				prg_hdr->p_paddr);
+
+			memcpy_toio(dest, src, prg_hdr->p_filesz);
+		}
+	}
+
+	return rc;
+}
+
+int cam_icp_proc_cpas_vote(uint32_t cpas_handle,
+	struct cam_icp_cpas_vote *vote)
+{
+	int rc;
+
+	if (!vote)
+		return -EINVAL;
+
+	if (vote->ahb_vote_valid) {
+		rc = cam_cpas_update_ahb_vote(cpas_handle, &vote->ahb_vote);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "AHB vote update failed rc=%d", rc);
+			return rc;
+		}
+	}
+
+	if (vote->axi_vote_valid) {
+		rc = cam_cpas_update_axi_vote(cpas_handle, &vote->axi_vote);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "AXI vote update failed rc=%d", rc);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+int cam_icp_proc_mini_dump(struct cam_icp_hw_dump_args *args,
+	uintptr_t fw_kva_addr, uint64_t fw_buf_len)
+{
+	u8                          *dest;
+	u8                          *src;
+	struct cam_icp_hw_dump_args *dump_args = args;
+
+	if (!dump_args) {
+		CAM_ERR(CAM_ICP, "Invalid param %pK", dump_args);
+		return -EINVAL;
+	}
+
+	if (!fw_kva_addr || !dump_args->cpu_addr) {
+		CAM_ERR(CAM_ICP, "invalid params %pK, 0x%zx",
+			fw_kva_addr, dump_args->cpu_addr);
+		return -EINVAL;
+	}
+
+	if (dump_args->buf_len < fw_buf_len) {
+		CAM_WARN(CAM_ICP, "Insufficient Len %lu fw_len %llu",
+			dump_args->buf_len, fw_buf_len);
+		return -ENOSPC;
+	}
+
+	dest = (u8 *)dump_args->cpu_addr;
+	src = (u8 *)fw_kva_addr;
+	memcpy_fromio(dest, src, fw_buf_len);
+	dump_args->offset = fw_buf_len;
+
+	return 0;
+}
+
+static int cam_icp_proc_validate_ubwc_cfg(struct cam_icp_ubwc_cfg *ubwc_cfg,
+	uint32_t ubwc_cfg_dev_mask)
+{
+	uint32_t found_ubwc_cfg_mask = ubwc_cfg->found_ubwc_cfg_mask;
+
+	if ((ubwc_cfg_dev_mask & BIT(CAM_ICP_DEV_IPE)) &&
+		!(found_ubwc_cfg_mask & BIT(CAM_ICP_DEV_IPE))) {
+		CAM_ERR(CAM_ICP, "IPE does not have UBWC cfg value");
+		return -ENODATA;
+	}
+
+	if ((ubwc_cfg_dev_mask & BIT(CAM_ICP_DEV_BPS)) &&
+		!(found_ubwc_cfg_mask & BIT(CAM_ICP_DEV_BPS))) {
+		CAM_ERR(CAM_ICP, "BPS does not have UBWC cfg value");
+		return -ENODATA;
+	}
+
+	if ((ubwc_cfg_dev_mask & BIT(CAM_ICP_DEV_OFE)) &&
+		!(found_ubwc_cfg_mask & BIT(CAM_ICP_DEV_OFE))) {
+		CAM_ERR(CAM_ICP, "OFE does not have UBWC cfg value");
+		return -ENODATA;
+	}
+
+	return 0;
+}
+
+int cam_icp_proc_ubwc_configure(struct cam_icp_proc_ubwc_cfg_cmd *ubwc_cfg_cmd,
+	bool force_disable_ubwc, int hfi_handle)
+{
+	struct cam_icp_ubwc_cfg *ubwc_cfg;
+	int i = 0, ddr_type, rc;
+	uint32_t ipe_ubwc_cfg[ICP_UBWC_CFG_MAX] = {0};
+	uint32_t bps_ubwc_cfg[ICP_UBWC_CFG_MAX] = {0};
+	uint32_t ofe_ubwc_cfg[ICP_UBWC_CFG_MAX] = {0};
+
+	if (!ubwc_cfg_cmd) {
+		CAM_ERR(CAM_ICP, "ubwc config command is NULL");
+		return -EINVAL;
+	}
+
+	ubwc_cfg = ubwc_cfg_cmd->ubwc_cfg;
+	rc = cam_icp_proc_validate_ubwc_cfg(ubwc_cfg, ubwc_cfg_cmd->ubwc_cfg_dev_mask);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "UBWC config failed validation rc:%d", rc);
+		return rc;
+	}
+
+	ddr_type = cam_get_ddr_type();
+
+	if (ddr_type == DDR_TYPE_LPDDR5 || ddr_type == DDR_TYPE_LPDDR5X)
+		i = 1;
+
+	ipe_ubwc_cfg[0] = ubwc_cfg->ipe_fetch[i];
+	ipe_ubwc_cfg[1] = ubwc_cfg->ipe_write[i];
+
+	bps_ubwc_cfg[0] = ubwc_cfg->bps_fetch[i];
+	bps_ubwc_cfg[1] = ubwc_cfg->bps_write[i];
+
+	ofe_ubwc_cfg[0] = ubwc_cfg->ofe_fetch[i];
+	ofe_ubwc_cfg[1] = ubwc_cfg->ofe_write[i];
+
+	if (force_disable_ubwc) {
+		ipe_ubwc_cfg[1] &= ~CAM_ICP_UBWC_COMP_EN;
+		bps_ubwc_cfg[1] &= ~CAM_ICP_UBWC_COMP_EN;
+		ofe_ubwc_cfg[1] &= ~CAM_ICP_UBWC_COMP_EN;
+		CAM_DBG(CAM_ICP,
+			"Force disable UBWC compression, ipe_ubwc_cfg: 0x%x, bps_ubwc_cfg: 0x%x ofe_ubwc_cfg: 0x%x",
+			ipe_ubwc_cfg[1], bps_ubwc_cfg[1], ofe_ubwc_cfg[1]);
+	}
+
+	rc = hfi_cmd_ubwc_config_ext(hfi_handle, ipe_ubwc_cfg, bps_ubwc_cfg, ofe_ubwc_cfg);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Failed to write UBWC configure rc=%d", rc);
+		return rc;
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_proc_common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_proc_common.h
@@ -0,0 +1,68 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_UTILS_H_
+#define _CAM_ICP_UTILS_H_
+
+#include <linux/firmware.h>
+#include <linux/elf.h>
+#include <linux/iopoll.h>
+
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_icp_soc_common.h"
+
+#define ICP_FW_NAME_MAX_SIZE    32
+#define PC_POLL_DELAY_US        100
+#define PC_POLL_TIMEOUT_US      10000
+
+/**
+ * struct cam_icp_proc_ubwc_cfg_cmd
+ * @ubwc_cfg: UBWC cfg info parsed from DT
+ * @ubwc_cfg_dev_mask: mask to indicate which device
+ *                     ubwc cfg to send to fw
+ */
+struct cam_icp_proc_ubwc_cfg_cmd {
+	struct cam_icp_ubwc_cfg *ubwc_cfg;
+	uint32_t ubwc_cfg_dev_mask;
+};
+
+/**
+ * @brief : Validate FW elf image
+ */
+int32_t cam_icp_validate_fw(const uint8_t *elf, uint32_t machine_id);
+
+/**
+ * @brief : Get FW elf size
+ */
+int32_t cam_icp_get_fw_size(const uint8_t *elf, uint32_t *fw_size);
+
+/**
+ * @brief : Program FW memory
+ */
+int32_t cam_icp_program_fw(const uint8_t *elf,
+	uintptr_t fw_kva_addr);
+
+/**
+ * @brief : Update ahb and axi votes
+ */
+int cam_icp_proc_cpas_vote(uint32_t cpas_handle,
+	struct cam_icp_cpas_vote *vote);
+
+/**
+ * @brief : dump FW memory into mini dump
+ */
+int cam_icp_proc_mini_dump(struct cam_icp_hw_dump_args *args,
+	uintptr_t fw_kva_addr, uint64_t fw_buf_len);
+
+/**
+ * @brief : Update UBWC configuration for IPE and BPS
+ */
+int cam_icp_proc_ubwc_configure(struct cam_icp_proc_ubwc_cfg_cmd *ubwc_cfg_cmd,
+	bool force_disable_ubwc, int hfi_handle);
+
+#endif /* _CAM_ICP_UTILS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_soc_common.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_soc_common.c
@@ -0,0 +1,319 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/of.h>
+
+#include "cam_debug_util.h"
+#include "cam_soc_util.h"
+#include "hfi_intf.h"
+#include "cam_icp_soc_common.h"
+
+static int __ubwc_config_get(struct device_node *np, char *name, uint32_t *cfg, bool *ubwc_listed)
+{
+	int nconfig, i, rc;
+
+	nconfig = of_property_count_u32_elems(np, name);
+	if (nconfig < 0) {
+		CAM_DBG(CAM_ICP, "prop: %s is not listed", name);
+		*ubwc_listed = false;
+		return 0;
+	}
+	*ubwc_listed = true;
+
+	if (nconfig > ICP_UBWC_CFG_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid number of UBWC configs[=%d] MAX UBWC=%d",
+			nconfig, ICP_UBWC_CFG_MAX);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < nconfig; i++) {
+		rc = of_property_read_u32_index(np, name, i, &cfg[i]);
+		if (rc) {
+			CAM_ERR(CAM_ICP,
+				"Node %pOF has no valid %s prop at index=%d",
+				np, name, i);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_icp_soc_ubwc_config_get(struct device_node *np,
+	struct cam_icp_soc_info *icp_soc_info)
+{
+	struct cam_icp_ubwc_cfg *ubwc_cfg_ext;
+	int rc;
+	uint32_t dev_type;
+	bool ubwc_listed, ubwc_fetch_found, ubwc_write_found;
+
+	dev_type = icp_soc_info->dev_type;
+
+	rc = __ubwc_config_get(np, "ubwc-cfg", icp_soc_info->uconfig.ubwc_cfg,
+		&ubwc_listed);
+	if (ubwc_listed) {
+		if (dev_type == CAM_ICP_HW_ICP_V1)
+			icp_soc_info->is_ubwc_cfg = true;
+		return rc;
+	}
+
+	ubwc_cfg_ext = &icp_soc_info->uconfig.ubwc_cfg_ext;
+	rc = __ubwc_config_get(np, "ubwc-ipe-fetch-cfg",
+		ubwc_cfg_ext->ipe_fetch, &ubwc_fetch_found);
+	if (rc)
+		return rc;
+
+	rc = __ubwc_config_get(np, "ubwc-ipe-write-cfg",
+		ubwc_cfg_ext->ipe_write, &ubwc_write_found);
+	if (rc)
+		return rc;
+
+	if (ubwc_fetch_found && ubwc_write_found)
+		ubwc_cfg_ext->found_ubwc_cfg_mask |= BIT(CAM_ICP_DEV_IPE);
+	else {
+		if (ubwc_fetch_found ^ ubwc_write_found) {
+			CAM_ERR(CAM_ICP, "Missing %s ipe ubwc config",
+				ubwc_fetch_found ? "write" : "fetch");
+			return -EINVAL;
+		}
+	}
+
+	rc = __ubwc_config_get(np, "ubwc-bps-fetch-cfg",
+		ubwc_cfg_ext->bps_fetch, &ubwc_fetch_found);
+	if (rc)
+		return rc;
+
+	rc = __ubwc_config_get(np, "ubwc-bps-write-cfg",
+		ubwc_cfg_ext->bps_write, &ubwc_write_found);
+	if (rc)
+		return rc;
+
+	if (ubwc_fetch_found && ubwc_write_found)
+		ubwc_cfg_ext->found_ubwc_cfg_mask |= BIT(CAM_ICP_DEV_BPS);
+	else {
+		if (ubwc_fetch_found ^ ubwc_write_found) {
+			CAM_ERR(CAM_ICP, "Missing %s bps ubwc config",
+				ubwc_fetch_found ? "write" : "fetch");
+			return -EINVAL;
+		}
+	}
+
+	rc = __ubwc_config_get(np, "ubwc-ofe-fetch-cfg",
+		ubwc_cfg_ext->ofe_fetch, &ubwc_fetch_found);
+	if (rc)
+		return rc;
+
+	rc = __ubwc_config_get(np, "ubwc-ofe-write-cfg",
+		ubwc_cfg_ext->ofe_write, &ubwc_write_found);
+	if (rc)
+		return rc;
+
+	if (ubwc_fetch_found && ubwc_write_found)
+		ubwc_cfg_ext->found_ubwc_cfg_mask |= BIT(CAM_ICP_DEV_OFE);
+	else {
+		if (ubwc_fetch_found ^ ubwc_write_found) {
+			CAM_ERR(CAM_ICP, "Missing %s ofe ubwc config",
+				ubwc_fetch_found ? "write" : "fetch");
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static inline void cam_icp_soc_qos_get(struct device_node *np,
+	struct cam_icp_soc_info *icp_soc_info)
+{
+	if (of_property_read_u32(np, "qos-val", &icp_soc_info->qos_val)) {
+		CAM_WARN(CAM_ICP, "QoS not set for device: %d",
+			icp_soc_info->dev_type);
+		icp_soc_info->qos_val = 0;
+	}
+}
+
+static int cam_icp_soc_get_hw_version(struct device_node *np,
+	struct cam_icp_soc_info *icp_soc_info)
+{
+	int rc;
+	uint32_t version;
+
+	rc = of_property_read_u32(np, "icp-version", &version);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "read icp-version failed rc=%d", rc);
+		return -ENODEV;
+	}
+
+	switch (version) {
+	case CAM_ICP_V1_VERSION:
+	case CAM_ICP_V2_VERSION:
+	case CAM_ICP_V2_1_VERSION:
+	case CAM_ICP_V3_0_VERSION:
+		icp_soc_info->hw_version = version;
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid ICP version: %u", version);
+		rc = -ENODEV;
+	}
+	return rc;
+}
+
+static void cam_icp_soc_get_fw_pas_id(struct device_node *np,
+	struct cam_icp_soc_info *icp_soc_info)
+{
+	if (of_property_read_u32(np, "fw-pas-id", &icp_soc_info->fw_pas_id)) {
+		CAM_WARN(CAM_ICP, "PAS_ID is not passed from DTSI and use default value: %d",
+			CAM_FW_PAS_ID_DEFAULT);
+		icp_soc_info->fw_pas_id = CAM_FW_PAS_ID_DEFAULT;
+	}
+}
+
+static int cam_icp_soc_dt_properties_get(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_icp_soc_info *icp_soc_info;
+	struct device_node *np;
+	int rc;
+
+	if (!soc_info->soc_private) {
+		CAM_ERR(CAM_ICP, "soc private is NULL");
+		return -EINVAL;
+	}
+
+	icp_soc_info = (struct cam_icp_soc_info *)soc_info->soc_private;
+	np = soc_info->pdev->dev.of_node;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get DT properties rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_icp_soc_ubwc_config_get(np, icp_soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get UBWC config props rc=%d", rc);
+		return rc;
+	}
+
+	cam_icp_soc_qos_get(np, icp_soc_info);
+
+	cam_icp_soc_get_fw_pas_id(np, icp_soc_info);
+
+	rc = cam_icp_soc_get_hw_version(np, icp_soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Get ICP HW version failed");
+		return rc;
+	}
+
+	return 0;
+}
+
+int cam_icp_soc_resources_init(struct cam_hw_soc_info *soc_info,
+	irq_handler_t handler, void *data)
+{
+	int rc, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	rc = cam_icp_soc_dt_properties_get(soc_info);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, handler, &(irq_data[0]));
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"request for soc platform resource failed rc=%d", rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+int cam_icp_soc_resources_deinit(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ICP,
+			"release of soc platform resource failed rc=%d", rc);
+
+	return rc;
+}
+
+int cam_icp_soc_resources_enable(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		soc_info->lowest_clk_level, true);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to enable soc resources rc=%d", rc);
+
+	return rc;
+}
+
+int cam_icp_soc_resources_disable(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to disable soc resources rc=%d", rc);
+
+	return rc;
+}
+
+int cam_icp_soc_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	int32_t clk_level, int hfi_handle)
+{
+	int32_t src_clk_idx = 0;
+	int32_t clk_rate = 0;
+	int rc = 0;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ICP, "Invalid soc_info");
+		return -EINVAL;
+	}
+
+	if ((clk_level < 0) || (clk_level >= CAM_MAX_VOTE)) {
+		CAM_ERR(CAM_ICP, "clock level %d is not valid",
+			clk_level);
+		return -EINVAL;
+	}
+
+	if (!soc_info->clk_level_valid[clk_level]) {
+		CAM_ERR(CAM_ICP,
+			"Clock level %d not supported",
+			clk_level);
+		return -EINVAL;
+	}
+
+	src_clk_idx = soc_info->src_clk_idx;
+	if ((src_clk_idx < 0) || (src_clk_idx >= CAM_SOC_MAX_CLK)) {
+		CAM_WARN(CAM_ICP, "src_clk not defined for %s",
+			soc_info->dev_name);
+		return -EINVAL;
+	}
+
+	clk_rate = soc_info->clk_rate[clk_level][src_clk_idx];
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE]) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_ICP, "clk_rate %d greater than max, reset to %d",
+			clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX, clk_rate, 0);
+	if (rc)
+		return rc;
+
+	hfi_send_freq_info(hfi_handle, clk_rate);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_soc_common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_common/cam_icp_soc_common.h
@@ -0,0 +1,77 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_ICP_SOC_COMMON_H
+#define CAM_ICP_SOC_COMMON_H
+
+#include "cam_soc_util.h"
+#include "cam_icp_hw_intf.h"
+
+#define ICP_UBWC_CFG_MAX     2
+#define CAM_ICP_V1_VERSION   0x0100
+#define CAM_ICP_V2_VERSION   0x0200
+#define CAM_ICP_V2_1_VERSION 0x0201
+#define CAM_ICP_V3_0_VERSION 0x0300
+
+#define CAM_FW_PAS_ID_DEFAULT 33
+
+/**
+ * struct cam_icp_ubwc_cfg - ICP ubwc cfg
+ * @ipe_fetch: UBWC configuration for IPE fetch.
+ * @ipe_write: UBWC configuration for IPE write.
+ * @bps_fetch: UBWC configuration for BPS fetch.
+ * @bps_write: UBWC configuration for BPS write.
+ * @ofe_fetch: UBWC configuration for ofe fetch.
+ * @ofe_write: UBWC configuration for ofe write.
+ * @found_ubwc_cfg_mask: mask to indicate which
+ *                      ubwc dev cfg found from DT
+ */
+struct cam_icp_ubwc_cfg {
+	uint32_t ipe_fetch[ICP_UBWC_CFG_MAX];
+	uint32_t ipe_write[ICP_UBWC_CFG_MAX];
+	uint32_t bps_fetch[ICP_UBWC_CFG_MAX];
+	uint32_t bps_write[ICP_UBWC_CFG_MAX];
+	uint32_t ofe_fetch[ICP_UBWC_CFG_MAX];
+	uint32_t ofe_write[ICP_UBWC_CFG_MAX];
+	uint32_t found_ubwc_cfg_mask;
+};
+
+/**
+ * struct cam_icp_soc_info - ICP soc info
+ * @dev_type: Device type.
+ * @qos_val: QOS value.
+ * @hw_version: hw version.
+ * @fw_pas_id: Firmware pas id
+ * @uconfig: union of ubwc_cfg_ext and ubwc_cfg. ubwc_cfg may
+ *           be used in icp_v1 for older chipsets. icp_v2 only
+ *           uses ubwc_cfg_ext.
+ * @is_ubwc_cfg: indicate if ubwc_cfg is used.
+ */
+struct cam_icp_soc_info {
+	enum cam_icp_hw_type dev_type;
+	uint32_t qos_val;
+	uint32_t hw_version;
+	uint32_t fw_pas_id;
+	union {
+		uint32_t ubwc_cfg[ICP_UBWC_CFG_MAX];
+		struct cam_icp_ubwc_cfg ubwc_cfg_ext;
+	} uconfig;
+	bool is_ubwc_cfg;
+};
+
+int cam_icp_soc_resources_init(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *irq_data);
+
+int cam_icp_soc_resources_deinit(struct cam_hw_soc_info *soc_info);
+
+int cam_icp_soc_resources_enable(struct cam_hw_soc_info *soc_info);
+
+int cam_icp_soc_resources_disable(struct cam_hw_soc_info *soc_info);
+
+int cam_icp_soc_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	int32_t clk_level, int hfi_handle);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_core.c
@@ -0,0 +1,783 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <media/cam_icp.h>
+
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_icp_v1_core.h"
+#include "cam_icp_v1_reg.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "hfi_sys_defs.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_icp_proc_common.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+#include "cam_icp_soc_common.h"
+
+static const struct hfi_ops hfi_icp_v1_ops = {
+	.irq_raise = cam_icp_v1_irq_raise,
+	.irq_enable = cam_icp_v1_irq_enable,
+	.iface_addr = cam_icp_v1_iface_addr,
+};
+
+static int cam_icp_v1_cpas_vote(struct cam_icp_v1_device_core_info *core_info,
+	struct cam_icp_cpas_vote *cpas_vote)
+{
+	if (!core_info)
+		return -EINVAL;
+
+	return cam_icp_proc_cpas_vote(core_info->cpas_handle, cpas_vote);
+}
+
+static int32_t cam_icp_v1_download_fw(void *device_priv)
+{
+	int32_t rc = 0;
+	uint32_t fw_size;
+	const uint8_t *fw_start = NULL;
+	struct cam_hw_info *icp_v1_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_icp_v1_device_core_info *core_info = NULL;
+	struct platform_device         *pdev = NULL;
+	const char                     *firmware_name = NULL;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &icp_v1_dev->soc_info;
+	core_info = (struct cam_icp_v1_device_core_info *)icp_v1_dev->core_info;
+	pdev = soc_info->pdev;
+
+	rc = of_property_read_string(pdev->dev.of_node, "fw_name", &firmware_name);
+	if (rc) {
+		CAM_INFO(CAM_ICP,
+			"FW image name not found. Use default name: CAMERA_ICP.elf");
+		rc = firmware_request_nowarn(&core_info->fw_elf,
+			"CAMERA_ICP.elf", &pdev->dev);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Failed to locate fw: %d", rc);
+			return rc;
+		}
+	} else {
+		CAM_INFO(CAM_ICP, "Downloading firmware %s",
+			firmware_name);
+		rc = firmware_request_nowarn(&core_info->fw_elf,
+			firmware_name, &pdev->dev);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Failed to locate fw: %d", rc);
+			return rc;
+		}
+	}
+
+	if (!core_info->fw_elf) {
+		CAM_ERR(CAM_ICP, "Invalid elf size");
+		rc = -EINVAL;
+		goto fw_download_failed;
+	}
+
+	fw_start = core_info->fw_elf->data;
+	rc = cam_icp_validate_fw(fw_start, EM_ARM);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "fw elf validation failed");
+		goto fw_download_failed;
+	}
+
+	rc = cam_icp_get_fw_size(fw_start, &fw_size);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "unable to get fw size");
+		goto fw_download_failed;
+	}
+
+	if (core_info->fw_buf_len < fw_size) {
+		CAM_ERR(CAM_ICP, "mismatch in fw size: %u %llu",
+			fw_size, core_info->fw_buf_len);
+		rc = -EINVAL;
+		goto fw_download_failed;
+	}
+
+	rc = cam_icp_program_fw(fw_start, core_info->fw_kva_addr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "fw program is failed");
+		goto fw_download_failed;
+	}
+
+fw_download_failed:
+	release_firmware(core_info->fw_elf);
+	return rc;
+}
+
+static int cam_icp_v1_fw_dump(
+	struct cam_icp_hw_dump_args    *dump_args,
+	struct cam_icp_v1_device_core_info *core_info)
+{
+	u8                         *dest;
+	u8                         *src;
+	uint64_t                    size_required;
+	struct cam_icp_dump_header *hdr;
+
+	if (!core_info || !dump_args) {
+		CAM_ERR(CAM_ICP, "invalid params %pK %pK",
+			core_info, dump_args);
+		return -EINVAL;
+	}
+	if (!core_info->fw_kva_addr || !dump_args->cpu_addr) {
+		CAM_ERR(CAM_ICP, "invalid params %pK, 0x%zx",
+			core_info->fw_kva_addr, dump_args->cpu_addr);
+		return -EINVAL;
+	}
+
+	size_required = core_info->fw_buf_len +
+		sizeof(struct cam_icp_dump_header);
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ICP, "Dump offset overshoot len %zu offset %zu",
+			dump_args->buf_len, dump_args->offset);
+		return -ENOSPC;
+	}
+
+	if ((dump_args->buf_len - dump_args->offset) < size_required) {
+		CAM_WARN(CAM_ICP, "Dump buffer exhaust required %llu len %llu",
+			size_required, core_info->fw_buf_len);
+		return -ENOSPC;
+	}
+
+	dest = (u8 *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_icp_dump_header *)dest;
+	scnprintf(hdr->tag, CAM_ICP_DUMP_TAG_MAX_LEN, "ICP_FW:");
+	hdr->word_size = sizeof(u8);
+	hdr->size = core_info->fw_buf_len;
+	src = (u8 *)core_info->fw_kva_addr;
+	dest = (u8 *)dest + sizeof(struct cam_icp_dump_header);
+	memcpy_fromio(dest, src, core_info->fw_buf_len);
+	dump_args->offset += hdr->size + sizeof(struct cam_icp_dump_header);
+	return 0;
+}
+
+static int cam_icp_v1_fw_mini_dump(struct cam_icp_hw_dump_args *dump_args,
+	struct cam_icp_v1_device_core_info *core_info)
+{
+	if (!core_info) {
+		CAM_ERR(CAM_ICP, "Invalid param %pK", core_info);
+		return -EINVAL;
+	}
+
+	return cam_icp_proc_mini_dump(dump_args, core_info->fw_kva_addr,
+		core_info->fw_buf_len);
+}
+
+int cam_icp_v1_init_hw(void *device_priv, void *args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *icp_v1_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_icp_v1_device_core_info *core_info = NULL;
+	struct cam_icp_soc_info *icp_v1_soc_info;
+	struct cam_icp_cpas_vote cpas_vote;
+	unsigned long flags;
+	int rc = 0;
+	bool send_freq_info;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &icp_v1_dev->soc_info;
+	core_info = (struct cam_icp_v1_device_core_info *)icp_v1_dev->core_info;
+
+	if ((!soc_info) || (!core_info) || (!args)) {
+		CAM_ERR(CAM_ICP, "soc_info: %pK core_info: %pK args: %pK",
+			soc_info, core_info, args);
+		return -EINVAL;
+	}
+
+	send_freq_info = *((bool *)args);
+
+	spin_lock_irqsave(&icp_v1_dev->hw_lock, flags);
+	if (icp_v1_dev->hw_state == CAM_HW_STATE_POWER_UP) {
+		spin_unlock_irqrestore(&icp_v1_dev->hw_lock, flags);
+		return 0;
+	}
+	spin_unlock_irqrestore(&icp_v1_dev->hw_lock, flags);
+
+	icp_v1_soc_info = soc_info->soc_private;
+
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_ICP_DEFAULT_AXI_PATH;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_ICP_DEFAULT_AXI_TRANSAC;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_ICP_BW_BYTES_VOTE;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_ICP_BW_BYTES_VOTE;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_ICP_BW_BYTES_VOTE;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cpas start failed: %d", rc);
+		goto error;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_icp_soc_resources_enable(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "soc enable is failed: %d", rc);
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	} else {
+		CAM_DBG(CAM_ICP, "icp_v1_qos %d", icp_v1_soc_info->qos_val);
+		if (icp_v1_soc_info->qos_val)
+			cam_io_w_mb(icp_v1_soc_info->qos_val,
+				soc_info->reg_map[ICP_V1_BASE].mem_base +
+				ICP_V1_CSR_ACCESS);
+		if (send_freq_info) {
+			int32_t clk_rate = 0;
+
+			clk_rate = cam_wrapper_clk_get_rate(soc_info->clk[soc_info->src_clk_idx]);
+			hfi_send_freq_info(core_info->hfi_handle, clk_rate);
+		}
+	}
+
+	spin_lock_irqsave(&icp_v1_dev->hw_lock, flags);
+	icp_v1_dev->hw_state = CAM_HW_STATE_POWER_UP;
+	spin_unlock_irqrestore(&icp_v1_dev->hw_lock, flags);
+
+error:
+	return rc;
+}
+
+int cam_icp_v1_deinit_hw(void *device_priv,
+	void *args, uint32_t arg_size)
+{
+	struct cam_hw_info *icp_v1_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_icp_v1_device_core_info *core_info = NULL;
+	unsigned long flags;
+	int rc = 0;
+	bool send_freq_info;
+
+	if (!device_priv || !args) {
+		CAM_ERR(CAM_ICP, "Invalid icp hw info is %s args is %s",
+			CAM_IS_NULL_TO_STR(icp_v1_dev), CAM_IS_NULL_TO_STR(args));
+		return -EINVAL;
+	}
+
+	send_freq_info = *((bool *)args);
+	soc_info = &icp_v1_dev->soc_info;
+	core_info = (struct cam_icp_v1_device_core_info *)icp_v1_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&icp_v1_dev->hw_lock, flags);
+	if (icp_v1_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		spin_unlock_irqrestore(&icp_v1_dev->hw_lock, flags);
+		return 0;
+	}
+	spin_unlock_irqrestore(&icp_v1_dev->hw_lock, flags);
+
+	if (send_freq_info)
+		hfi_send_freq_info(core_info->hfi_handle, 0);
+
+	rc = cam_icp_soc_resources_disable(soc_info);
+
+	if (rc)
+		CAM_ERR(CAM_ICP, "soc disable is failed: %d", rc);
+
+	if (core_info->cpas_start) {
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	}
+
+	spin_lock_irqsave(&icp_v1_dev->hw_lock, flags);
+	icp_v1_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	spin_unlock_irqrestore(&icp_v1_dev->hw_lock, flags);
+
+	return rc;
+}
+
+static int cam_icp_v1_power_resume(struct cam_hw_info *icp_v1_info, bool debug_enabled)
+{
+	uint32_t val = ICP_V1_CSR_FULL_CPU_EN;
+	void __iomem *base;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_icp_soc_info *icp_v1_soc_info;
+
+	if (!icp_v1_info) {
+		CAM_ERR(CAM_ICP, "Invalid ICP device info");
+		return -EINVAL;
+	}
+
+	base = icp_v1_info->soc_info.reg_map[ICP_V1_BASE].mem_base;
+	soc_info = &icp_v1_info->soc_info;
+	icp_v1_soc_info = soc_info->soc_private;
+
+	cam_io_w_mb(ICP_V1_CSR_CPU_EN, base + ICP_V1_CSR_CONTROL);
+	cam_io_w_mb(ICP_V1_CSR_FUNC_RESET, base + ICP_V1_CSR_NSEC_RESET);
+
+	if (debug_enabled)
+		val |= ICP_V1_CSR_FULL_DBG_EN;
+
+	cam_io_w_mb(val, base + ICP_V1_CSR_CONTROL);
+	cam_io_w_mb(icp_v1_soc_info->qos_val,
+		base + ICP_V1_CSR_ACCESS);
+
+	CAM_DBG(CAM_ICP, "icp_v1 qos-val : 0x%x",
+		cam_io_r_mb(base + ICP_V1_CSR_ACCESS));
+
+	return 0;
+}
+
+static int cam_icp_v1_power_collapse(struct cam_hw_info *icp_v1_info)
+{
+	uint32_t val, status = 0;
+	void __iomem *base;
+
+	if (!icp_v1_info) {
+		CAM_ERR(CAM_ICP, "invalid ICP device info");
+		return -EINVAL;
+	}
+
+	base = icp_v1_info->soc_info.reg_map[ICP_V1_BASE].mem_base;
+
+	/**
+	 * Need to poll here to confirm that FW has triggered WFI
+	 * and Host can then proceed. No interrupt is expected
+	 * from FW at this time.
+	 */
+
+	if (cam_common_read_poll_timeout(base +
+			ICP_V1_CSR_STATUS,
+			PC_POLL_DELAY_US, PC_POLL_TIMEOUT_US,
+			ICP_V1_CSR_STANDBYWFI,
+			ICP_V1_CSR_STANDBYWFI, &status)) {
+		CAM_ERR(CAM_ICP, "WFI poll timed out: status=0x%08x", status);
+		return -ETIMEDOUT;
+	}
+
+	val = cam_io_r(base + ICP_V1_CSR_CONTROL);
+	val &= ~(ICP_V1_CSR_CPU_EN | ICP_V1_CSR_WAKE_UP_EN);
+	cam_io_w_mb(val, base + ICP_V1_CSR_CONTROL);
+
+	return 0;
+}
+
+static void prepare_boot(struct cam_hw_info *icp_v1_dev,
+	struct cam_icp_boot_args *args)
+{
+	struct cam_icp_v1_device_core_info *core_info = icp_v1_dev->core_info;
+	unsigned long flags;
+
+	core_info->fw_buf = args->firmware.iova;
+	core_info->fw_kva_addr = args->firmware.kva;
+	core_info->fw_buf_len = args->firmware.len;
+
+	spin_lock_irqsave(&icp_v1_dev->hw_lock, flags);
+	core_info->irq_cb.data = args->irq_cb.data;
+	core_info->irq_cb.cb = args->irq_cb.cb;
+	spin_unlock_irqrestore(&icp_v1_dev->hw_lock, flags);
+}
+
+static void prepare_shutdown(struct cam_hw_info *icp_v1_dev)
+{
+	struct cam_icp_v1_device_core_info *core_info = icp_v1_dev->core_info;
+	unsigned long flags;
+
+	core_info->fw_buf = 0;
+	core_info->fw_kva_addr = 0;
+	core_info->fw_buf_len = 0;
+
+	spin_lock_irqsave(&icp_v1_dev->hw_lock, flags);
+	core_info->irq_cb.data = NULL;
+	core_info->irq_cb.cb = NULL;
+	spin_unlock_irqrestore(&icp_v1_dev->hw_lock, flags);
+}
+
+static int cam_icp_v1_boot(struct cam_hw_info *icp_v1_dev,
+	struct cam_icp_boot_args *args, size_t arg_size)
+{
+	int rc;
+
+	if (!icp_v1_dev || !args) {
+		CAM_ERR(CAM_ICP,
+			"Invalid args: icp_v1_dev=%pK args=%pK",
+			icp_v1_dev, args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_icp_boot_args)) {
+		CAM_ERR(CAM_ICP, "Invalid boot args size");
+		return -EINVAL;
+	}
+
+	prepare_boot(icp_v1_dev, args);
+
+	rc = cam_icp_v1_download_fw(icp_v1_dev);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "firmware download failed rc=%d", rc);
+		goto err;
+	}
+
+	rc = cam_icp_v1_power_resume(icp_v1_dev, args->debug_enabled);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "ICP boot failed rc=%d", rc);
+		goto err;
+	}
+
+	return 0;
+err:
+	prepare_shutdown(icp_v1_dev);
+	return rc;
+}
+
+static int cam_icp_v1_shutdown(struct cam_hw_info *icp_v1_dev)
+{
+	if (!icp_v1_dev) {
+		CAM_ERR(CAM_ICP, "invalid ICP device info");
+		return -EINVAL;
+	}
+
+	prepare_shutdown(icp_v1_dev);
+	cam_icp_v1_power_collapse(icp_v1_dev);
+	return 0;
+}
+
+irqreturn_t cam_icp_v1_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *icp_v1_dev = data;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_icp_v1_device_core_info *core_info = NULL;
+	uint32_t irq_status = 0;
+	bool recover = false;
+
+	if (!data) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info or query_cap args");
+		return IRQ_HANDLED;
+	}
+
+	spin_lock(&icp_v1_dev->hw_lock);
+	if (icp_v1_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ICP, "ICP HW powered off");
+		spin_unlock(&icp_v1_dev->hw_lock);
+		return IRQ_HANDLED;
+	}
+	spin_unlock(&icp_v1_dev->hw_lock);
+
+	soc_info = &icp_v1_dev->soc_info;
+	core_info = (struct cam_icp_v1_device_core_info *)icp_v1_dev->core_info;
+
+	irq_status = cam_io_r_mb(soc_info->reg_map[ICP_V1_BASE].mem_base +
+		ICP_V1_HOST_INT_STATUS);
+
+	cam_io_w_mb(irq_status,
+		soc_info->reg_map[ICP_V1_BASE].mem_base + ICP_V1_HOST_INT_CLR);
+
+	if ((irq_status & ICP_V1_WDT_0) ||
+		(irq_status & ICP_V1_WDT_1)) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP, "watch dog interrupt from ICP");
+		recover = true;
+	}
+
+	spin_lock(&icp_v1_dev->hw_lock);
+	if (core_info->irq_cb.cb)
+		core_info->irq_cb.cb(core_info->irq_cb.data, recover);
+	spin_unlock(&icp_v1_dev->hw_lock);
+
+	return IRQ_HANDLED;
+}
+
+void cam_icp_v1_irq_raise(void *priv)
+{
+	struct cam_hw_info *icp_v1_info = priv;
+
+	if (!icp_v1_info) {
+		CAM_ERR(CAM_ICP, "invalid ICP device info");
+		return;
+	}
+
+	cam_io_w_mb(ICP_V1_HOSTINT,
+		icp_v1_info->soc_info.reg_map[ICP_V1_BASE].mem_base +
+		ICP_V1_CSR_HOST2ICPINT);
+}
+
+void cam_icp_v1_irq_enable(void *priv)
+{
+	struct cam_hw_info *icp_v1_info = priv;
+
+	if (!icp_v1_info) {
+		CAM_ERR(CAM_ICP, "invalid ICP device info");
+		return;
+	}
+
+	cam_io_w_mb(ICP_V1_WDT_WS0EN | ICP_V1_A2HOSTINTEN,
+		icp_v1_info->soc_info.reg_map[ICP_V1_BASE].mem_base +
+		ICP_V1_CSR_A2HOSTINTEN);
+}
+
+void __iomem *cam_icp_v1_iface_addr(void *priv)
+{
+	struct cam_hw_info *icp_v1_info = priv;
+	void __iomem *base;
+
+	if (!icp_v1_info) {
+		CAM_ERR(CAM_ICP, "invalid ICP device info");
+		return ERR_PTR(-EINVAL);
+	}
+
+	base = icp_v1_info->soc_info.reg_map[ICP_V1_BASE].mem_base;
+
+	return base + ICP_V1_GEN_PURPOSE_REG_OFFSET;
+}
+
+void cam_icp_v1_populate_hfi_ops(const struct hfi_ops **hfi_proc_ops)
+{
+	if (!hfi_proc_ops) {
+		CAM_ERR(CAM_ICP, "Invalid hfi ops argument");
+		return;
+	}
+
+	*hfi_proc_ops = &hfi_icp_v1_ops;
+}
+
+static int cam_icp_v1_send_fw_init(struct cam_icp_v1_device_core_info *core_info)
+{
+	int rc;
+
+	if (!core_info) {
+		CAM_ERR(CAM_ICP, "Invalid core info is NULL");
+		return -EINVAL;
+	}
+
+	rc = hfi_send_system_cmd(core_info->hfi_handle, HFI_CMD_SYS_INIT, 0, 0);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Fail to send sys init command for hfi handle: %d",
+			core_info->hfi_handle);
+		return rc;
+	}
+
+	return 0;
+}
+
+static int cam_icp_v1_pc_prep(struct cam_icp_v1_device_core_info *core_info)
+{
+	int rc;
+
+	if (!core_info) {
+		CAM_ERR(CAM_ICP, "Invalid ICP core info is NULL");
+		return -EINVAL;
+	}
+
+	rc = hfi_send_system_cmd(core_info->hfi_handle, HFI_CMD_SYS_PC_PREP, 0, 0);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Fail to send PC collapse command for hfi handle: %d",
+			core_info->hfi_handle);
+		return rc;
+	}
+
+	return 0;
+}
+
+int cam_icp_v1_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *icp_v1_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_icp_v1_device_core_info *core_info = NULL;
+	struct cam_icp_soc_info *icp_soc_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_ICP_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &icp_v1_dev->soc_info;
+	core_info = (struct cam_icp_v1_device_core_info *)icp_v1_dev->core_info;
+
+	switch (cmd_type) {
+	case CAM_ICP_CMD_PROC_SHUTDOWN:
+		rc = cam_icp_v1_shutdown(device_priv);
+		break;
+	case CAM_ICP_CMD_PROC_BOOT:
+		rc = cam_icp_v1_boot(device_priv, cmd_args, arg_size);
+		break;
+	case CAM_ICP_CMD_POWER_COLLAPSE:
+		rc = cam_icp_v1_power_collapse(icp_v1_dev);
+		break;
+	case CAM_ICP_CMD_POWER_RESUME:
+		rc = cam_icp_v1_power_resume(icp_v1_dev, *((bool *)cmd_args));
+		break;
+	case CAM_ICP_SEND_INIT:
+		rc = cam_icp_v1_send_fw_init(core_info);
+		break;
+	case CAM_ICP_CMD_PC_PREP:
+		rc = cam_icp_v1_pc_prep(core_info);
+		break;
+	case CAM_ICP_CMD_VOTE_CPAS: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		cam_icp_v1_cpas_vote(core_info, cpas_vote);
+		break;
+	}
+
+	case CAM_ICP_CMD_SET_HFI_HANDLE: {
+		if (!core_info || !cmd_args) {
+			CAM_ERR(CAM_ICP, "Core info is %s and args is %s",
+				CAM_IS_NULL_TO_STR(core_info), CAM_IS_NULL_TO_STR(cmd_args));
+			return -EINVAL;
+		}
+
+		if (arg_size != sizeof(int)) {
+			CAM_ERR(CAM_ICP, "Invalid set hfi handle command arg size:%u",
+				arg_size);
+			return -EINVAL;
+		}
+
+		core_info->hfi_handle = *((int *)cmd_args);
+		break;
+	}
+
+	case CAM_ICP_CMD_CPAS_START: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		if (!core_info->cpas_start) {
+			rc = cam_cpas_start(core_info->cpas_handle,
+				&cpas_vote->ahb_vote,
+				&cpas_vote->axi_vote);
+			core_info->cpas_start = true;
+		}
+		break;
+	}
+
+	case CAM_ICP_CMD_CPAS_STOP:
+		if (core_info->cpas_start) {
+			cam_cpas_stop(core_info->cpas_handle);
+			core_info->cpas_start = false;
+		}
+		break;
+	case CAM_ICP_CMD_UBWC_CFG: {
+		struct cam_icp_ubwc_cfg_cmd *ubwc_cmd = cmd_args;
+		struct cam_icp_proc_ubwc_cfg_cmd ubwc_proc_cmd;
+
+		icp_soc_info = soc_info->soc_private;
+		if (!icp_soc_info) {
+			CAM_ERR(CAM_ICP, "ICP private soc info is NULL");
+			return -EINVAL;
+		}
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "Invalid ubwc cmd args is NULL");
+			return -EINVAL;
+		}
+
+		if (arg_size != sizeof(struct cam_icp_ubwc_cfg_cmd)) {
+			CAM_ERR(CAM_ICP, "Invalid ubwc cmd size:%u", arg_size);
+			return -EINVAL;
+		}
+
+		if (icp_soc_info->is_ubwc_cfg)
+			rc = hfi_cmd_ubwc_config(core_info->hfi_handle,
+				icp_soc_info->uconfig.ubwc_cfg);
+		else {
+			ubwc_proc_cmd.ubwc_cfg = &icp_soc_info->uconfig.ubwc_cfg_ext;
+			rc = cam_icp_proc_ubwc_configure(&ubwc_proc_cmd,
+				ubwc_cmd->disable_ubwc_comp, core_info->hfi_handle);
+		}
+		break;
+	}
+	case CAM_ICP_CMD_CLK_UPDATE: {
+		int32_t clk_level = 0;
+		struct cam_ahb_vote ahb_vote;
+
+		if (!cmd_args || !core_info) {
+			CAM_ERR(CAM_ICP, "Invalid args: core info is %s cmd args is %s",
+				CAM_IS_NULL_TO_STR(core_info), CAM_IS_NULL_TO_STR(cmd_args));
+			return -EINVAL;
+		}
+
+		if (arg_size != sizeof(int32_t)) {
+			CAM_ERR(CAM_ICP, "Invalid icp clock update command");
+			return -EINVAL;
+		}
+
+		clk_level = *((int32_t *)cmd_args);
+		CAM_DBG(CAM_ICP,
+			"Update ICP clock to level [%d]", clk_level);
+		rc = cam_icp_soc_update_clk_rate(soc_info, clk_level, core_info->hfi_handle);
+		if (rc)
+			CAM_ERR(CAM_ICP,
+				"Failed to update clk to level: %d rc: %d",
+				clk_level, rc);
+
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = clk_level;
+		cam_cpas_update_ahb_vote(
+			core_info->cpas_handle, &ahb_vote);
+		break;
+	}
+	case CAM_ICP_CMD_HW_DUMP: {
+		struct cam_icp_hw_dump_args *dump_args = cmd_args;
+
+		rc = cam_icp_v1_fw_dump(dump_args, core_info);
+		break;
+	}
+
+	case CAM_ICP_CMD_HW_MINI_DUMP: {
+		struct cam_icp_hw_dump_args *dump_args = cmd_args;
+
+		rc = cam_icp_v1_fw_mini_dump(dump_args, core_info);
+		break;
+	}
+	case CAM_ICP_CMD_HW_REG_DUMP: {
+		/* reg dump not supported */
+		break;
+	}
+	default:
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_core.h
@@ -0,0 +1,71 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_ICP_V1_CORE_H
+#define CAM_ICP_V1_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include "cam_icp_hw_intf.h"
+#include "hfi_intf.h"
+
+#define ICP_V1_QGIC_BASE            0
+#define ICP_V1_BASE                 1
+#define ICP_V1_CSR_BASE             2
+
+#define ICP_V1_HOST_INT             0x1
+#define ICP_V1_WDT_0                0x2
+#define ICP_V1_WDT_1                0x4
+
+#define ICP_V1_CSR_ACCESS           0x3C
+
+#define ELF_GUARD_PAGE              (2 * 1024 * 1024)
+
+/**
+ * struct cam_icp_v1_device_hw_info
+ * @icp_v1_hw_info: ICP_V1 hardware info
+ * @fw_elf: start address of fw start with elf header
+ * @fw: start address of fw blob
+ * @fw_buf: smmu alloc/mapped fw buffer
+ * @fw_buf_len: fw buffer length
+ * @query_cap: ICP_V1 query info from firmware
+ * @icp_v1_acquire: Acquire information of ICP_V1
+ * @irq_cb: IRQ callback
+ * @cpas_handle: CPAS handle for ICP_V1
+ * @hfi_handle: hfi handle for ICP V1
+ * @hw_version: hw version of icp v1 processor
+ * @cpas_start: state variable for cpas
+ */
+struct cam_icp_v1_device_core_info {
+	const struct firmware *fw_elf;
+	void *fw;
+	uint32_t fw_buf;
+	uintptr_t fw_kva_addr;
+	uint64_t fw_buf_len;
+	struct cam_icp_irq_cb irq_cb;
+	uint32_t cpas_handle;
+	int32_t hfi_handle;
+	bool cpas_start;
+};
+
+int cam_icp_v1_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_icp_v1_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_icp_v1_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+irqreturn_t cam_icp_v1_irq(int irq_num, void *data);
+
+void cam_icp_v1_irq_raise(void *priv);
+void cam_icp_v1_irq_enable(void *priv);
+void __iomem *cam_icp_v1_iface_addr(void *priv);
+void cam_icp_v1_populate_hfi_ops(const struct hfi_ops **hfi_proc_ops);
+
+#endif /* CAM_ICP_V1_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_dev.c
@@ -0,0 +1,286 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+#include "cam_icp_v1_core.h"
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_icp_soc_common.h"
+#include "cam_icp_v1_dev.h"
+
+static int max_icp_v1_hw_idx = -1;
+
+uint32_t cam_icp_v1_get_device_num(void)
+{
+	return max_icp_v1_hw_idx + 1;
+}
+
+static bool cam_icp_v1_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool error_handled = false;
+
+	if (!irq_data)
+		return error_handled;
+
+	switch (irq_data->irq_type) {
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC Decode error type=%d status=%x thr_err=%d, fcl_err=%d, len_md_err=%d, format_err=%d",
+			irq_data->irq_type,
+			irq_data->u.dec_err.decerr_status.value,
+			irq_data->u.dec_err.decerr_status.thr_err,
+			irq_data->u.dec_err.decerr_status.fcl_err,
+			irq_data->u.dec_err.decerr_status.len_md_err,
+			irq_data->u.dec_err.decerr_status.format_err);
+		error_handled = true;
+		break;
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC Encode error type=%d status=%x",
+			irq_data->irq_type,
+			irq_data->u.enc_err.encerr_status.value);
+		error_handled = true;
+		break;
+	default:
+		break;
+	}
+
+	return error_handled;
+}
+
+int cam_icp_v1_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_icp_v1_device_core_info *core_info, uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "icp", sizeof("icp"));
+	cpas_register_params.cam_cpas_client_cb = cam_icp_v1_cpas_cb;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed: %d", rc);
+		return rc;
+	}
+
+	core_info->cpas_handle = cpas_register_params.client_handle;
+	return rc;
+}
+
+static inline void cam_icp_v1_soc_info_deinit(struct cam_hw_soc_info *soc_info)
+{
+	kfree(soc_info->soc_private);
+}
+
+static int cam_icp_v1_soc_info_init(struct cam_hw_soc_info *soc_info,
+	struct platform_device *pdev)
+{
+	struct cam_icp_soc_info *icp_soc_info = NULL;
+
+	icp_soc_info = kzalloc(sizeof(*icp_soc_info), GFP_KERNEL);
+	if (!icp_soc_info)
+		return -ENOMEM;
+
+	soc_info->pdev = pdev;
+	soc_info->dev = &pdev->dev;
+	soc_info->dev_name = pdev->name;
+	soc_info->soc_private = icp_soc_info;
+
+	icp_soc_info->dev_type = CAM_ICP_HW_ICP_V1;
+
+	return 0;
+}
+
+static int cam_icp_v1_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct cam_hw_info *icp_v1_dev = NULL;
+	struct cam_hw_intf *icp_v1_dev_intf = NULL;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_icp_v1_device_core_info *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	icp_v1_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!icp_v1_dev_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &icp_v1_dev_intf->hw_idx);
+
+	icp_v1_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!icp_v1_dev) {
+		rc = -ENOMEM;
+		goto icp_v1_dev_alloc_failure;
+	}
+
+	icp_v1_dev_intf->hw_priv = icp_v1_dev;
+	icp_v1_dev_intf->hw_ops.init = cam_icp_v1_init_hw;
+	icp_v1_dev_intf->hw_ops.deinit = cam_icp_v1_deinit_hw;
+	icp_v1_dev_intf->hw_ops.process_cmd = cam_icp_v1_process_cmd;
+	icp_v1_dev_intf->hw_type = CAM_ICP_HW_ICP_V1;
+
+	CAM_DBG(CAM_ICP, "type %d index %d",
+		icp_v1_dev_intf->hw_type,
+		icp_v1_dev_intf->hw_idx);
+
+	platform_set_drvdata(pdev, icp_v1_dev_intf);
+
+	core_info = kzalloc(sizeof(struct cam_icp_v1_device_core_info),
+		GFP_KERNEL);
+	if (!core_info) {
+		rc = -ENOMEM;
+		goto core_info_alloc_failure;
+	}
+	icp_v1_dev->core_info = core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ICP, "No icp_v1 hardware info");
+		rc = -EINVAL;
+		goto match_err;
+	}
+
+	rc = cam_icp_v1_soc_info_init(&icp_v1_dev->soc_info, pdev);
+	if (rc)
+		goto init_soc_failure;
+
+	rc = cam_icp_soc_resources_init(&icp_v1_dev->soc_info, cam_icp_v1_irq,
+		icp_v1_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed to init_soc");
+		goto init_soc_failure;
+	}
+
+	rc = cam_icp_v1_register_cpas(&icp_v1_dev->soc_info,
+		core_info, icp_v1_dev_intf->hw_idx);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "icp_v1 cpas registration failed");
+		goto cpas_reg_failed;
+	}
+	core_info->hfi_handle = HFI_HANDLE_INIT_VALUE;
+	icp_v1_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&icp_v1_dev->hw_mutex);
+	spin_lock_init(&icp_v1_dev->hw_lock);
+	init_completion(&icp_v1_dev->hw_complete);
+
+	if ((int)(icp_v1_dev_intf->hw_idx) > max_icp_v1_hw_idx)
+		max_icp_v1_hw_idx = icp_v1_dev_intf->hw_idx;
+
+	CAM_DBG(CAM_ICP, "ICP_V1:%u component bound successfully",
+		icp_v1_dev_intf->hw_idx);
+
+	return 0;
+
+cpas_reg_failed:
+	cam_icp_soc_resources_deinit(&icp_v1_dev->soc_info);
+init_soc_failure:
+	cam_icp_v1_soc_info_deinit(&icp_v1_dev->soc_info);
+match_err:
+	kfree(core_info);
+core_info_alloc_failure:
+	kfree(icp_v1_dev);
+icp_v1_dev_alloc_failure:
+	kfree(icp_v1_dev_intf);
+
+	return rc;
+}
+
+static void cam_icp_v1_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *icp_v1_dev = NULL;
+	struct cam_hw_intf *icp_v1_dev_intf = NULL;
+	struct cam_icp_v1_device_core_info *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	icp_v1_dev_intf = platform_get_drvdata(pdev);
+
+	if (!icp_v1_dev_intf) {
+		CAM_ERR(CAM_ICP, "Error No data in pdev");
+		return;
+	}
+
+	icp_v1_dev = icp_v1_dev_intf->hw_priv;
+	core_info = (struct cam_icp_v1_device_core_info *)icp_v1_dev->core_info;
+
+	cam_cpas_unregister_client(core_info->cpas_handle);
+	cam_icp_soc_resources_deinit(&icp_v1_dev->soc_info);
+	cam_icp_v1_soc_info_deinit(&icp_v1_dev->soc_info);
+
+	max_icp_v1_hw_idx = -1;
+
+	kfree(icp_v1_dev->core_info);
+	kfree(icp_v1_dev);
+	kfree(icp_v1_dev_intf);
+}
+
+static const struct component_ops cam_icp_v1_component_ops = {
+	.bind = cam_icp_v1_component_bind,
+	.unbind = cam_icp_v1_component_unbind,
+};
+
+int cam_icp_v1_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "Adding ICP_V1 component");
+	rc = component_add(&pdev->dev, &cam_icp_v1_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_icp_v1_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_icp_v1_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_icp_v1_dt_match[] = {
+	{.compatible = "qcom,cam-icp_v1",},
+	{},
+};
+MODULE_DEVICE_TABLE(of, cam_icp_v1_dt_match);
+
+struct platform_driver cam_icp_v1_driver = {
+	.probe = cam_icp_v1_probe,
+	.remove = cam_icp_v1_remove,
+	.driver = {
+		.name = "cam-icp_v1",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_icp_v1_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_icp_v1_init_module(void)
+{
+	return platform_driver_register(&cam_icp_v1_driver);
+}
+
+void cam_icp_v1_exit_module(void)
+{
+	platform_driver_unregister(&cam_icp_v1_driver);
+}
+
+MODULE_DESCRIPTION("CAM ICP_V1 driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_dev.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_V1_DEV_H_
+#define _CAM_ICP_V1_DEV_H_
+
+/**
+ * @brief : API to register icp_v1 hw to platform framework.
+ * @return struct platform_device pointer on success, or ERR_PTR() on error.
+ */
+int cam_icp_v1_init_module(void);
+
+/**
+ * @brief : API to remove icp_v1 hw from platform framework.
+ */
+void cam_icp_v1_exit_module(void);
+
+#endif /* _CAM_ICP_V1_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v1_hw/cam_icp_v1_reg.h
@@ -0,0 +1,50 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_V1_REG_H_
+#define _CAM_ICP_V1_REG_H_
+
+#define ICP_V1_CSR_NSEC_RESET           0x4
+#define ICP_V1_GEN_PURPOSE_REG_OFFSET   0x40
+#define ICP_V1_CSR_FUNC_RESET           (1 << 4)
+#define ICP_V1_CSR_DBG_RESET            (1 << 3)
+#define ICP_V1_CSR_CPU_RESET            (1 << 2)
+
+#define ICP_V1_CSR_CONTROL              0x8
+#define ICP_V1_CSR_DBGSWENABLE          (1 << 22)
+#define ICP_V1_CSR_EDBGRQ               (1 << 14)
+#define ICP_V1_CSR_EN_CLKGATE_WFI       (1 << 12)
+#define ICP_V1_CSR_CPU_EN               (1 << 9)
+#define ICP_V1_CSR_WAKE_UP_EN           (1 << 4)
+
+#define ICP_V1_CSR_FULL_DBG_EN          (ICP_V1_CSR_DBGSWENABLE | ICP_V1_CSR_EDBGRQ)
+#define ICP_V1_CSR_FULL_CPU_EN          (ICP_V1_CSR_CPU_EN | \
+					ICP_V1_CSR_WAKE_UP_EN | \
+					ICP_V1_CSR_EN_CLKGATE_WFI)
+
+#define ICP_V1_CSR_A2HOSTINTEN          0x10
+#define ICP_V1_WDT_WS1EN                (1 << 2)
+#define ICP_V1_WDT_WS0EN                (1 << 1)
+#define ICP_V1_A2HOSTINTEN              (1 << 0)
+
+#define ICP_V1_CSR_HOST2ICPINT          0x30
+#define ICP_V1_HOSTINT                  (1 << 0)
+#define ICP_V1_HOST_INT_CLR             0x18
+#define ICP_V1_HOST_INT_STATUS          0x1c
+#define ICP_V1_HOST_INT_SET             0x20
+
+#define ICP_V1_CSR_STATUS               0x200
+#define ICP_V1_CSR_STANDBYWFI           (1 << 7)
+
+#define ICP_V1_INIT_REQ                 0x48
+#define ICP_V1_INIT_RESPONSE            0x4c
+#define ICP_V1_SHARED_MEM_PTR           0x50
+#define ICP_V1_SHARED_MEM_SIZE          0x54
+#define ICP_V1_QTBL_PTR                 0x58
+#define ICP_V1_UNCACHED_HEAP_PTR        0x5c
+#define ICP_V1_UNCACHED_HEAP_SIZE       0x60
+
+#endif /* _CAM_ICP_V1_REG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_core.c
@@ -0,0 +1,1319 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of_address.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/soc/qcom/mdt_loader.h>
+
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_icp_hw_intf.h"
+#include "hfi_intf.h"
+#include "hfi_sys_defs.h"
+#include "cam_icp_proc_common.h"
+#include "cam_icp_v2_core.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+#include "cam_presil_hw_access.h"
+#include "cam_icp_soc_common.h"
+
+#define TZ_STATE_SUSPEND 0
+#define TZ_STATE_RESUME  1
+
+#define ICP_FW_NAME_MAX_SIZE    32
+
+#define ICP_V2_IRQ_TEST_TIMEOUT 1000
+
+static const struct hfi_ops hfi_icp_v2_ops = {
+	.irq_raise = cam_icp_v2_irq_raise,
+	.irq_enable = cam_icp_v2_irq_enable,
+	.iface_addr = cam_icp_v2_iface_addr,
+};
+
+static int cam_icp_v2_ubwc_configure(struct cam_hw_soc_info *soc_info,
+	struct cam_icp_v2_core_info *core_info, void *args, uint32_t arg_size)
+{
+	struct cam_icp_soc_info *soc_priv;
+	struct cam_icp_ubwc_cfg_cmd *ubwc_cmd = args;
+	struct cam_icp_proc_ubwc_cfg_cmd ubwc_proc_cmd;
+
+	if (!soc_info || !core_info || !args) {
+		CAM_ERR(CAM_ICP,
+			"Invalid args: soc info is %s core info is %s cmd args is %s",
+			CAM_IS_NULL_TO_STR(soc_info), CAM_IS_NULL_TO_STR(core_info),
+			CAM_IS_NULL_TO_STR(args));
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_icp_ubwc_cfg_cmd)) {
+		CAM_ERR(CAM_ICP, "Invalid ubwc cfg arg size: %u",
+			arg_size);
+		return -EINVAL;
+	}
+
+	soc_priv = soc_info->soc_private;
+
+	ubwc_proc_cmd.ubwc_cfg = &soc_priv->uconfig.ubwc_cfg_ext;
+	ubwc_proc_cmd.ubwc_cfg_dev_mask = ubwc_cmd->ubwc_cfg_dev_mask;
+
+	return cam_icp_proc_ubwc_configure(&ubwc_proc_cmd,
+		ubwc_cmd->disable_ubwc_comp, core_info->hfi_handle);
+}
+
+static int cam_icp_v2_cpas_vote(struct cam_icp_v2_core_info *core_info,
+	struct cam_icp_cpas_vote *vote)
+{
+	if (!core_info)
+		return -EINVAL;
+
+	return cam_icp_proc_cpas_vote(core_info->cpas_handle, vote);
+}
+
+static bool cam_icp_v2_cpas_cb(uint32_t handle, void *user_data,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool ret = false;
+	(void)user_data;
+
+	if (!irq_data)
+		return false;
+
+	switch (irq_data->irq_type) {
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC decode error status=0x%08x",
+			irq_data->u.dec_err.decerr_status.value);
+		ret = true;
+		break;
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC encode error status=0x%08x",
+			irq_data->u.enc_err.encerr_status.value);
+		ret = true;
+		break;
+	default:
+		break;
+	}
+
+	return ret;
+}
+
+int cam_icp_v2_cpas_register(struct cam_hw_intf *icp_v2_intf)
+{
+	struct cam_cpas_register_params params;
+	struct cam_hw_info *icp_v2_info;
+	struct cam_icp_v2_core_info *core_info;
+	int rc;
+
+	if (!icp_v2_intf)
+		return -EINVAL;
+
+	icp_v2_info = icp_v2_intf->hw_priv;
+
+	params.dev = icp_v2_info->soc_info.dev;
+	params.cell_index = icp_v2_intf->hw_idx;
+	params.cam_cpas_client_cb = cam_icp_v2_cpas_cb;
+	params.userdata = NULL;
+
+	strscpy(params.identifier, "icp", CAM_HW_IDENTIFIER_LENGTH);
+
+	rc = cam_cpas_register_client(&params);
+	if (rc)
+		return rc;
+
+	core_info = icp_v2_info->core_info;
+	core_info->cpas_handle = params.client_handle;
+
+	return rc;
+}
+
+int cam_icp_v2_cpas_unregister(struct cam_hw_intf *icp_v2_intf)
+{
+	struct cam_hw_info *icp_v2_info;
+	struct cam_icp_v2_core_info *core_info;
+
+	if (!icp_v2_intf)
+		return -EINVAL;
+
+	icp_v2_info = icp_v2_intf->hw_priv;
+	core_info = icp_v2_info->core_info;
+
+	return cam_cpas_unregister_client(core_info->cpas_handle);
+}
+
+static int __icp_v2_cpas_start(struct cam_icp_v2_core_info *core_info,
+	struct cam_icp_cpas_vote *vote)
+{
+	int rc;
+
+	if (!core_info || core_info->cpas_start)
+		return -EINVAL;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&vote->ahb_vote, &vote->axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to start cpas rc=%d", rc);
+		return rc;
+	}
+
+	core_info->cpas_start = true;
+
+	return 0;
+}
+
+static int cam_icp_v2_cpas_start(struct cam_icp_v2_core_info *core_info)
+{
+	struct cam_icp_cpas_vote vote;
+
+	vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	vote.ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	vote.axi_vote.num_paths = 1;
+
+	vote.axi_vote.axi_path[0].path_data_type = CAM_ICP_DEFAULT_AXI_PATH;
+	vote.axi_vote.axi_path[0].transac_type = CAM_ICP_DEFAULT_AXI_TRANSAC;
+	vote.axi_vote.axi_path[0].camnoc_bw = CAM_ICP_BW_BYTES_VOTE;
+	vote.axi_vote.axi_path[0].mnoc_ab_bw = CAM_ICP_BW_BYTES_VOTE;
+	vote.axi_vote.axi_path[0].mnoc_ib_bw = CAM_ICP_BW_BYTES_VOTE;
+
+	return __icp_v2_cpas_start(core_info, &vote);
+}
+
+static int cam_icp_v2_cpas_stop(struct cam_icp_v2_core_info *core_info)
+{
+	int rc;
+
+	if (!core_info || !core_info->cpas_start)
+		return -EINVAL;
+
+	rc = cam_cpas_stop(core_info->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to stop cpas rc=%d", rc);
+		return rc;
+	}
+
+	core_info->cpas_start = false;
+
+	return 0;
+}
+
+int cam_icp_v2_hw_init(void *priv, void *args, uint32_t arg_size)
+{
+	struct cam_hw_info *icp_v2 = priv;
+	struct cam_icp_v2_core_info *core_info;
+	unsigned long flags;
+	int rc;
+	bool send_freq_info;
+
+	if (!icp_v2 || !args) {
+		CAM_ERR(CAM_ICP,
+			"Invalid parameters: icp hw info is %s args is %s",
+			CAM_IS_NULL_TO_STR(icp_v2), CAM_IS_NULL_TO_STR(args));
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(bool)) {
+		CAM_ERR(CAM_ICP, "Invalid hw init cmd args");
+		return -EINVAL;
+	}
+
+	send_freq_info = *((bool *)args);
+	core_info = icp_v2->core_info;
+
+	spin_lock_irqsave(&icp_v2->hw_lock, flags);
+	if (icp_v2->hw_state == CAM_HW_STATE_POWER_UP) {
+		spin_unlock_irqrestore(&icp_v2->hw_lock, flags);
+		return 0;
+	}
+	spin_unlock_irqrestore(&icp_v2->hw_lock, flags);
+
+	rc = cam_icp_v2_cpas_start(icp_v2->core_info);
+	if (rc)
+		return rc;
+
+	rc = cam_icp_soc_resources_enable(&icp_v2->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to enable soc resources rc=%d", rc);
+		goto soc_fail;
+	} else {
+		if (send_freq_info) {
+			int32_t clk_rate = 0;
+
+			clk_rate = cam_wrapper_clk_get_rate(
+				icp_v2->soc_info.clk[icp_v2->soc_info.src_clk_idx]);
+			hfi_send_freq_info(core_info->hfi_handle, clk_rate);
+		}
+	}
+
+	spin_lock_irqsave(&icp_v2->hw_lock, flags);
+	icp_v2->hw_state = CAM_HW_STATE_POWER_UP;
+	spin_unlock_irqrestore(&icp_v2->hw_lock, flags);
+
+	return 0;
+
+soc_fail:
+	cam_icp_v2_cpas_stop(icp_v2->core_info);
+	return rc;
+}
+
+int cam_icp_v2_hw_deinit(void *priv, void *args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *icp_v2_info = priv;
+	struct cam_icp_v2_core_info *core_info;
+	unsigned long flags;
+	int rc;
+	bool send_freq_info;
+
+	if (!icp_v2_info || !args) {
+		CAM_ERR(CAM_ICP, "ICP device info is %s cmd args is %s",
+			CAM_IS_NULL_TO_STR(icp_v2_info), CAM_IS_NULL_TO_STR(args));
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(bool)) {
+		CAM_ERR(CAM_ICP, "Invalid hw deinit cmd args");
+		return -EINVAL;
+	}
+
+	send_freq_info = *((bool *)args);
+	core_info = icp_v2_info->core_info;
+
+	spin_lock_irqsave(&icp_v2_info->hw_lock, flags);
+	if (icp_v2_info->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		spin_unlock_irqrestore(&icp_v2_info->hw_lock, flags);
+		return 0;
+	}
+	spin_unlock_irqrestore(&icp_v2_info->hw_lock, flags);
+
+	if (send_freq_info)
+		hfi_send_freq_info(core_info->hfi_handle, 0);
+
+	rc = cam_icp_soc_resources_disable(&icp_v2_info->soc_info);
+	if (rc)
+		CAM_WARN(CAM_ICP,
+			"failed to disable soc resources rc=%d", rc);
+
+	rc = cam_icp_v2_cpas_stop(icp_v2_info->core_info);
+	if (rc)
+		CAM_WARN(CAM_ICP, "cpas stop failed rc=%d", rc);
+
+	spin_lock_irqsave(&icp_v2_info->hw_lock, flags);
+	icp_v2_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	spin_unlock_irqrestore(&icp_v2_info->hw_lock, flags);
+
+	return rc;
+}
+
+static void prepare_boot(struct cam_hw_info *icp_v2_info,
+	struct cam_icp_boot_args *args)
+{
+	struct cam_icp_v2_core_info *core_info = icp_v2_info->core_info;
+	unsigned long flags;
+
+	if (!args->use_sec_pil) {
+		core_info->fw_params.fw_buf = args->firmware.iova;
+		core_info->fw_params.fw_kva_addr = args->firmware.kva;
+		core_info->fw_params.fw_buf_len = args->firmware.len;
+	}
+
+	spin_lock_irqsave(&icp_v2_info->hw_lock, flags);
+	core_info->irq_cb.data = args->irq_cb.data;
+	core_info->irq_cb.cb = args->irq_cb.cb;
+	spin_unlock_irqrestore(&icp_v2_info->hw_lock, flags);
+}
+
+static void prepare_shutdown(struct cam_hw_info *icp_v2_info)
+{
+	struct cam_icp_v2_core_info *core_info = icp_v2_info->core_info;
+	unsigned long flags;
+
+	core_info->fw_params.fw_buf = 0x0;
+	core_info->fw_params.fw_kva_addr = 0x0;
+	core_info->fw_params.fw_buf_len = 0x0;
+
+	spin_lock_irqsave(&icp_v2_info->hw_lock, flags);
+	core_info->irq_cb.data = NULL;
+	core_info->irq_cb.cb = NULL;
+	spin_unlock_irqrestore(&icp_v2_info->hw_lock, flags);
+}
+
+/* Used if ICP_SYS is not protected */
+static int __cam_icp_v2_power_collapse(struct cam_hw_info *icp_v2_info)
+{
+	int32_t sys_base_idx;
+	uint32_t status = 0;
+	void __iomem *base;
+	struct cam_icp_v2_core_info *core_info = NULL;
+
+	if (!icp_v2_info) {
+		CAM_ERR(CAM_ICP, "invalid ICP dev info");
+		return -EINVAL;
+	}
+
+	core_info = icp_v2_info->core_info;
+	sys_base_idx = core_info->reg_base_idx[ICP_V2_SYS_BASE];
+
+	if (sys_base_idx < 0) {
+		CAM_ERR(CAM_ICP, "No reg base idx found for ICP_SYS: %d",
+			sys_base_idx);
+		return -EINVAL;
+	}
+
+	base = icp_v2_info->soc_info.reg_map[sys_base_idx].mem_base;
+
+	/**
+	 * Need to poll here to confirm that FW has triggered WFI
+	 * and Host can then proceed. No interrupt is expected
+	 * from FW at this time.
+	 */
+	if (cam_common_read_poll_timeout(base + ICP_V2_SYS_STATUS,
+		PC_POLL_DELAY_US, PC_POLL_TIMEOUT_US,
+		ICP_V2_STANDBYWFI, ICP_V2_STANDBYWFI,
+		&status)) {
+		CAM_ERR(CAM_ICP, "WFI poll timed out: status=0x%08x", status);
+		return -ETIMEDOUT;
+	}
+
+	cam_io_w_mb(0x0, base + ICP_V2_SYS_CONTROL);
+	return 0;
+}
+
+/* Used if ICP_SYS and ICP_DOM_MASK are not protected */
+static int __cam_icp_v2_power_resume(struct cam_hw_info *icp_v2_info)
+{
+	int32_t sys_base_idx, dom_mask_base_idx;
+	void __iomem *sys_base, *dom_mask_base;
+	struct cam_icp_soc_info     *soc_priv;
+	struct cam_hw_soc_info      *soc_info;
+	struct cam_icp_v2_core_info *core_info = NULL;
+
+	if (!icp_v2_info) {
+		CAM_ERR(CAM_ICP, "invalid ICP dev info");
+		return -EINVAL;
+	}
+
+	soc_info = &icp_v2_info->soc_info;
+	core_info = icp_v2_info->core_info;
+	soc_priv = soc_info->soc_private;
+	sys_base_idx = core_info->reg_base_idx[ICP_V2_SYS_BASE];
+	dom_mask_base_idx = core_info->reg_base_idx[ICP_V2_DOM_MASK_BASE];
+
+	if (sys_base_idx < 0) {
+		CAM_ERR(CAM_ICP, "No reg base idx found for ICP_SYS: %d",
+			sys_base_idx);
+		return -EINVAL;
+	}
+
+	sys_base = icp_v2_info->soc_info.reg_map[sys_base_idx].mem_base;
+
+	cam_io_w_mb(ICP_V2_FUNC_RESET,
+		sys_base + ICP_V2_SYS_RESET);
+
+	if (soc_priv->qos_val)
+		cam_io_w_mb(soc_priv->qos_val, sys_base + ICP_V2_SYS_ACCESS);
+
+	/* Program domain ID reg mask values if reg base is available */
+	if (dom_mask_base_idx >= 0) {
+		dom_mask_base = icp_v2_info->soc_info.reg_map[dom_mask_base_idx].mem_base;
+
+		CAM_DBG(CAM_ICP, "domain_cfg0, offset: 0x%x: 0x%x, domain_cfg1, offset: 0x%x: 0x%x",
+			ICP_V2_DOM_0_CFG_OFFSET, ICP_V2_DOMAIN_MASK_CFG_0,
+			ICP_V2_DOM_1_CFG_OFFSET, ICP_V2_DOMAIN_MASK_CFG_1);
+
+		cam_io_w_mb(ICP_V2_DOMAIN_MASK_CFG_0,
+			dom_mask_base + ICP_V2_DOM_0_CFG_OFFSET);
+		cam_io_w_mb(ICP_V2_DOMAIN_MASK_CFG_1,
+			dom_mask_base + ICP_V2_DOM_1_CFG_OFFSET);
+	}
+
+	cam_io_w_mb(ICP_V2_EN_CPU,
+		sys_base + ICP_V2_SYS_CONTROL);
+
+	return 0;
+}
+
+#ifndef CONFIG_CAM_PRESIL
+/* Used for non secure FW load */
+static int32_t __cam_non_sec_load_fw(void *device_priv)
+{
+	int32_t rc = 0;
+	uint32_t fw_size;
+	char firmware_name[ICP_FW_NAME_MAX_SIZE] = {0};
+	const char               *fw_name;
+	const uint8_t            *fw_start = NULL;
+	struct cam_hw_info       *icp_v2_dev = device_priv;
+	struct cam_hw_soc_info   *soc_info = NULL;
+	struct cam_icp_v2_core_info *core_info = NULL;
+	struct platform_device   *pdev = NULL;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &icp_v2_dev->soc_info;
+	core_info = (struct cam_icp_v2_core_info *)icp_v2_dev->core_info;
+	pdev = soc_info->pdev;
+
+	/**
+	 * Use paddr to map 0xE0400000 and 0xE0420000 as these
+	 * addresses are routed internally by the core. These segments
+	 * are used by the firmware to make use of the rom packing feature.
+	 */
+
+	rc = of_property_read_string(pdev->dev.of_node, "fw_name",
+		&fw_name);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "FW image name not found");
+		return rc;
+	}
+
+	/* Account for ".elf" size [4 characters] */
+	if (strlen(fw_name) >= (ICP_FW_NAME_MAX_SIZE - 4)) {
+		CAM_ERR(CAM_ICP, "Invalid fw name %s", fw_name);
+		return -EINVAL;
+	}
+
+	scnprintf(firmware_name, ARRAY_SIZE(firmware_name),
+		"%s.elf", fw_name);
+
+	rc = firmware_request_nowarn(&core_info->fw_params.fw_elf,
+		firmware_name, &pdev->dev);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Failed to locate %s fw: %d",
+			firmware_name, rc);
+		return rc;
+	}
+
+	if (!core_info->fw_params.fw_elf) {
+		CAM_ERR(CAM_ICP, "Invalid elf size");
+		rc = -EINVAL;
+		goto fw_download_failed;
+	}
+
+	fw_start = core_info->fw_params.fw_elf->data;
+
+	rc = cam_icp_validate_fw(fw_start, EM_XTENSA);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "fw elf validation failed");
+		goto fw_download_failed;
+	}
+
+	rc = cam_icp_get_fw_size(fw_start, &fw_size);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "unable to get fw size");
+		goto fw_download_failed;
+	}
+
+	if (core_info->fw_params.fw_buf_len < fw_size) {
+		CAM_ERR(CAM_ICP, "mismatch in fw size: %u %llu",
+			fw_size, core_info->fw_params.fw_buf_len);
+		rc = -EINVAL;
+		goto fw_download_failed;
+	}
+
+	rc = cam_icp_program_fw(fw_start,
+		core_info->fw_params.fw_kva_addr);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "fw program is failed");
+		goto fw_download_failed;
+	}
+
+fw_download_failed:
+	release_firmware(core_info->fw_params.fw_elf);
+	return rc;
+}
+#else /* #ifndef CONFIG_CAM_PRESIL */
+static int __cam_non_sec_load_fw(struct cam_hw_info *icp_v2_info)
+{
+	if (!icp_v2_info) {
+		CAM_ERR(CAM_ICP, "Invalid ICP dev info");
+		return -EINVAL;
+	}
+
+	cam_presil_send_event(CAM_PRESIL_EVENT_HFI_REG_ON_FIRST_REG_START_FW_DOWNLOAD, 0xFF);
+
+	return 0;
+}
+#endif /* #ifndef CONFIG_CAM_PRESIL */
+
+/* Used for non secure FW load */
+static int cam_icp_v2_non_sec_boot(
+	struct cam_hw_info *icp_v2_info,
+	struct cam_icp_boot_args *args,
+	uint32_t arg_size)
+{
+	int rc;
+	struct cam_icp_soc_info *soc_priv;
+
+	if (!icp_v2_info || !args) {
+		CAM_ERR(CAM_ICP,
+			"invalid args: icp_v2_dev=%pK args=%pK",
+			icp_v2_info, args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_icp_boot_args)) {
+		CAM_ERR(CAM_ICP, "invalid boot args size");
+		return -EINVAL;
+	}
+
+	soc_priv = (struct cam_icp_soc_info *)icp_v2_info->soc_info.soc_private;
+	if (icp_v2_info->soc_info.num_mem_block > ICP_V2_BASE_MAX) {
+		CAM_ERR(CAM_ICP, "check reg config in DT v 0x%x n %d",
+			soc_priv->hw_version, icp_v2_info->soc_info.num_mem_block);
+		return -EINVAL;
+	}
+
+	prepare_boot(icp_v2_info, args);
+
+	rc = __cam_non_sec_load_fw(icp_v2_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"firmware download failed rc=%d", rc);
+		goto err;
+	}
+
+	rc = __cam_icp_v2_power_resume(icp_v2_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "ICP boot failed rc=%d", rc);
+		goto err;
+	}
+
+	return 0;
+
+err:
+	prepare_shutdown(icp_v2_info);
+	return rc;
+}
+
+#if IS_REACHABLE(CONFIG_QCOM_MDT_LOADER)
+static int __load_firmware(struct platform_device *pdev,
+	uint32_t fw_pas_id)
+{
+	const char *fw_name;
+	const struct firmware *firmware = NULL;
+	char firmware_name[ICP_FW_NAME_MAX_SIZE] = {0};
+	void *vaddr = NULL;
+	struct device_node *node;
+	struct resource res;
+	phys_addr_t res_start;
+	size_t res_size;
+	ssize_t fw_size;
+	int rc;
+
+	if (!pdev) {
+		CAM_ERR(CAM_ICP, "invalid args");
+		return -EINVAL;
+	}
+
+	rc = of_property_read_string(pdev->dev.of_node, "fw_name",
+		&fw_name);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "FW image name not found");
+		return rc;
+	}
+
+	/* Account for ".mdt" size [4 characters] */
+	if (strlen(fw_name) >= (ICP_FW_NAME_MAX_SIZE - 4)) {
+		CAM_ERR(CAM_ICP, "Invalid fw name %s", fw_name);
+		return -EINVAL;
+	}
+
+	scnprintf(firmware_name, ARRAY_SIZE(firmware_name),
+		"%s.mbn", fw_name);
+
+	node = of_parse_phandle(pdev->dev.of_node, "memory-region", 0);
+	if (!node) {
+		CAM_ERR(CAM_ICP, "firmware memory region not found");
+		return -ENODEV;
+	}
+
+	rc = of_address_to_resource(node, 0, &res);
+	of_node_put(node);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "missing firmware resource address rc=%d", rc);
+		return rc;
+	}
+
+	res_start = res.start;
+	res_size = (size_t)resource_size(&res);
+
+	rc = firmware_request_nowarn(&firmware, firmware_name, &pdev->dev);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"error requesting %s firmware rc=%d",
+			firmware_name, rc);
+		return rc;
+	}
+
+	/* Make sure carveout and binary sizes are compatible */
+	fw_size = qcom_mdt_get_size(firmware);
+	if (fw_size < 0 || res_size < (size_t)fw_size) {
+		CAM_ERR(CAM_ICP,
+			"carveout[sz=%zu] not big enough for firmware[sz=%zd]",
+			res_size, fw_size);
+		rc = -EINVAL;
+		goto out;
+	}
+
+	vaddr = ioremap_wc(res_start, res_size);
+	if (!vaddr) {
+		CAM_ERR(CAM_ICP, "unable to map firmware carveout");
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	rc = qcom_mdt_load(&pdev->dev, firmware, firmware_name, fw_pas_id,
+			vaddr, res_start, res_size, NULL);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to load firmware rc=%d", rc);
+		goto out;
+	}
+
+out:
+	if (vaddr)
+		iounmap(vaddr);
+
+	release_firmware(firmware);
+	return rc;
+}
+#endif
+
+static int cam_icp_v2_boot(struct cam_hw_info *icp_v2_info,
+	struct cam_icp_boot_args *args, uint32_t arg_size)
+{
+	int rc;
+	struct cam_icp_v2_core_info *core_info = NULL;
+	struct cam_icp_soc_info     *soc_priv;
+
+	if (!IS_REACHABLE(CONFIG_QCOM_MDT_LOADER))
+		return -EOPNOTSUPP;
+
+	if (!icp_v2_info || !args) {
+		CAM_ERR(CAM_ICP,
+			"invalid args: icp_v2_info=%pK args=%pK",
+			icp_v2_info, args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_icp_boot_args)) {
+		CAM_ERR(CAM_ICP, "invalid boot args size");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_icp_v2_core_info *)icp_v2_info->core_info;
+	soc_priv = (struct cam_icp_soc_info *)icp_v2_info->soc_info.soc_private;
+
+	prepare_boot(icp_v2_info, args);
+
+#if IS_REACHABLE(CONFIG_QCOM_MDT_LOADER)
+	rc = __load_firmware(icp_v2_info->soc_info.pdev, soc_priv->fw_pas_id);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "firmware loading failed rc=%d", rc);
+		goto err;
+	}
+#endif
+
+	rc = qcom_scm_pas_auth_and_reset(soc_priv->fw_pas_id);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "auth and reset failed rc=%d", rc);
+		goto err;
+	}
+
+	core_info->use_sec_pil = true;
+	return 0;
+err:
+	prepare_shutdown(icp_v2_info);
+	return rc;
+}
+
+static int cam_icp_v2_shutdown(struct cam_hw_info *icp_v2_info)
+{
+	int rc = 0;
+	struct cam_icp_v2_core_info *core_info =
+		(struct cam_icp_v2_core_info *)icp_v2_info->core_info;
+	struct cam_icp_soc_info *soc_priv =
+		(struct cam_icp_soc_info *)icp_v2_info->soc_info.soc_private;
+
+	prepare_shutdown(icp_v2_info);
+
+	if (core_info->use_sec_pil) {
+		rc = qcom_scm_pas_shutdown(soc_priv->fw_pas_id);
+	}
+	else {
+		int32_t sys_base_idx = core_info->reg_base_idx[ICP_V2_SYS_BASE];
+		void __iomem *base;
+
+		if (sys_base_idx < 0) {
+			CAM_ERR(CAM_ICP, "No reg base idx found for ICP_SYS: %d",
+				sys_base_idx);
+			return -EINVAL;
+		}
+
+		base = icp_v2_info->soc_info.reg_map[sys_base_idx].mem_base;
+		cam_io_w_mb(0x0, base + ICP_V2_SYS_CONTROL);
+	}
+
+	core_info->use_sec_pil = false;
+	return rc;
+}
+
+static void __cam_icp_v2_core_reg_dump(
+	struct cam_hw_info *icp_v2_info, uint32_t dump_type)
+{
+	int i;
+	int32_t csr_base_idx;
+	size_t len = 0;
+	char log_info[512];
+	struct cam_icp_v2_core_info *core_info = icp_v2_info->core_info;
+	void __iomem *irq_base, *csr_base, *csr_gp_base;
+
+	csr_base_idx = core_info->reg_base_idx[ICP_V2_CSR_BASE];
+	csr_base =  icp_v2_info->soc_info.reg_map[csr_base_idx].mem_base;
+	csr_gp_base = csr_base + ICP_V2_GEN_PURPOSE_REG_OFFSET;
+	irq_base = icp_v2_info->soc_info.reg_map[core_info->irq_regbase_idx].mem_base;
+
+	if (dump_type & CAM_ICP_DUMP_STATUS_REGISTERS) {
+		for (i = 0; i < core_info->hw_info->num_pfault_info_regs; i++) {
+			CAM_INFO(CAM_ICP, "ICP PFault offset: 0x%x val: 0x%x",
+				core_info->hw_info->pfault_info[i],
+				cam_io_r_mb(irq_base + core_info->hw_info->pfault_info[i]));
+		}
+	}
+
+	if (dump_type & CAM_ICP_DUMP_CSR_REGISTERS) {
+		for (i = 0; i < ICP_V2_CSR_GP_REG_COUNT;) {
+			CAM_INFO_BUF(CAM_ICP, log_info, 512, &len,
+				"GP_%d: 0x%x GP_%d: 0x%x GP_%d: 0x%x GP_%d: 0x%x",
+				i, cam_io_r_mb(csr_gp_base + (i << 2)),
+				(i + 1), cam_io_r_mb(csr_gp_base + ((i + 1) << 2)),
+				(i + 2), cam_io_r_mb(csr_gp_base + ((i + 2) << 2)),
+				(i + 3), cam_io_r_mb(csr_gp_base + ((i + 3) << 2)));
+			i += 4;
+		}
+
+		CAM_INFO(CAM_ICP, "ICP CSR GP registers - %s", log_info);
+	}
+}
+
+/* API controls collapse/resume of ICP */
+static int cam_icp_v2_core_control(struct cam_hw_info *icp_v2_info,
+	uint32_t state)
+{
+	int rc = 0;
+	struct cam_icp_v2_core_info *core_info =
+		(struct cam_icp_v2_core_info *)icp_v2_info->core_info;
+	struct cam_icp_soc_info *soc_priv =
+		(struct cam_icp_soc_info *)icp_v2_info->soc_info.soc_private;
+
+	if (core_info->use_sec_pil) {
+		rc = qcom_scm_set_remote_state(state, soc_priv->fw_pas_id);
+		if (rc) {
+			CAM_ERR(CAM_ICP,
+				"remote state set to %s failed rc=%d",
+				(state == TZ_STATE_RESUME ? "resume" : "suspend"), rc);
+			__cam_icp_v2_core_reg_dump(icp_v2_info, CAM_ICP_DUMP_STATUS_REGISTERS);
+		}
+	} else {
+		if (state == TZ_STATE_RESUME) {
+			rc = __cam_icp_v2_power_resume(icp_v2_info);
+			if (rc)
+				CAM_ERR(CAM_ICP, "ICP resume failed rc=%d", rc);
+		} else {
+			rc = __cam_icp_v2_power_collapse(icp_v2_info);
+			if (rc)
+				CAM_ERR(CAM_ICP, "ICP collapse failed rc=%d", rc);
+		}
+	}
+
+	return rc;
+}
+
+static inline int cam_icp_v2_download_fw(struct cam_hw_info *icp_v2_info,
+	struct cam_icp_boot_args *args, uint32_t arg_size)
+{
+	int rc;
+
+	CAM_INFO(CAM_ICP, "Loading Secure PIL : %s", CAM_BOOL_TO_YESNO(args->use_sec_pil));
+
+	if (args->use_sec_pil)
+		rc = cam_icp_v2_boot(
+			icp_v2_info, args, arg_size);
+	else
+		rc = cam_icp_v2_non_sec_boot(
+			icp_v2_info, args, arg_size);
+
+	return rc;
+}
+
+static int __cam_icp_v2_update_clk_rate(struct cam_hw_info *icp_v2_info,
+	void *args, uint32_t arg_size)
+{
+	int32_t clk_level = 0, rc;
+	struct cam_ahb_vote       ahb_vote;
+	struct cam_icp_v2_core_info *core_info = NULL;
+	struct cam_hw_soc_info   *soc_info = NULL;
+
+	if (!args) {
+		CAM_ERR(CAM_ICP, "Invalid args is NULL");
+		return -EINVAL;
+	}
+
+	soc_info = &icp_v2_info->soc_info;
+	core_info = icp_v2_info->core_info;
+	if (!core_info || !soc_info) {
+		CAM_ERR(CAM_ICP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(int32_t)) {
+		CAM_ERR(CAM_ICP, "Invalid icp update clk args");
+		return -EINVAL;
+	}
+
+	clk_level = *((int32_t *)args);
+	CAM_DBG(CAM_ICP,
+		"Update ICP clock to level [%d]", clk_level);
+	rc = cam_icp_soc_update_clk_rate(soc_info, clk_level, core_info->hfi_handle);
+	if (rc)
+		CAM_WARN(CAM_ICP,
+			"Failed to update clk to level: %d rc: %d",
+			clk_level, rc);
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = clk_level;
+	rc = cam_cpas_update_ahb_vote(
+		core_info->cpas_handle, &ahb_vote);
+	if (rc)
+		CAM_WARN(CAM_ICP,
+			"Failed to update ahb vote rc: %d", rc);
+
+	return rc;
+}
+
+static int __cam_icp_v2_fw_mini_dump(struct cam_icp_v2_core_info *core_info,
+	struct cam_icp_hw_dump_args *args)
+{
+	if (!core_info) {
+		CAM_ERR(CAM_ICP, "Invalid param %pK", core_info);
+		return -EINVAL;
+	}
+
+	return cam_icp_proc_mini_dump(args, core_info->fw_params.fw_kva_addr,
+		core_info->fw_params.fw_buf_len);
+}
+
+static int cam_icp_v2_send_fw_init(struct cam_icp_v2_core_info *core_info)
+{
+	int rc;
+
+	if (!core_info) {
+		CAM_ERR(CAM_ICP, "Core info is NULL");
+		return -EINVAL;
+	}
+
+	rc = hfi_send_system_cmd(core_info->hfi_handle, HFI_CMD_SYS_INIT, 0, 0);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Fail to send sys init command for hfi handle: %d",
+			core_info->hfi_handle);
+		return rc;
+	}
+
+	return 0;
+}
+
+static int cam_icp_v2_pc_prep(struct cam_icp_v2_core_info *core_info)
+{
+	int rc;
+
+	if (!core_info) {
+		CAM_ERR(CAM_ICP, "Invalid core info is NULL");
+		return -EINVAL;
+	}
+
+	rc = hfi_send_system_cmd(core_info->hfi_handle, HFI_CMD_SYS_PC_PREP, 0, 0);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Fail to send PC collapse command for hfi handle: %d",
+			core_info->hfi_handle);
+		return rc;
+	}
+
+	return 0;
+}
+
+int cam_icp_v2_set_hfi_handle(struct cam_icp_v2_core_info *core_info,
+	void *args, uint32_t arg_size)
+{
+	if (!core_info || !args) {
+		CAM_ERR(CAM_ICP, "Core info is %s and args is %s",
+			CAM_IS_NULL_TO_STR(core_info), CAM_IS_NULL_TO_STR(args));
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(int)) {
+		CAM_ERR(CAM_ICP, "Invalid set hfi handle command arg size:%u",
+			arg_size);
+		return -EINVAL;
+	}
+
+	core_info->hfi_handle = *((int *)args);
+
+	return 0;
+}
+
+int cam_icp_v2_process_cmd(void *priv, uint32_t cmd_type,
+	void *args, uint32_t arg_size)
+{
+	struct cam_hw_info *icp_v2_info = priv;
+	int rc = -EINVAL;
+
+	if (!icp_v2_info) {
+		CAM_ERR(CAM_ICP, "ICP device info cannot be NULL");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ICP_CMD_SET_HFI_HANDLE:
+		rc = cam_icp_v2_set_hfi_handle(icp_v2_info->core_info, args, arg_size);
+		break;
+	case CAM_ICP_CMD_PROC_SHUTDOWN:
+		rc = cam_icp_v2_shutdown(icp_v2_info);
+		break;
+	case CAM_ICP_CMD_PROC_BOOT:
+		rc = cam_icp_v2_download_fw(icp_v2_info, args, arg_size);
+		break;
+	case CAM_ICP_CMD_POWER_COLLAPSE:
+		rc = cam_icp_v2_core_control(icp_v2_info, TZ_STATE_SUSPEND);
+		break;
+	case CAM_ICP_CMD_POWER_RESUME:
+		rc = cam_icp_v2_core_control(icp_v2_info, TZ_STATE_RESUME);
+		break;
+	case CAM_ICP_CMD_VOTE_CPAS:
+		rc = cam_icp_v2_cpas_vote(icp_v2_info->core_info, args);
+		break;
+	case CAM_ICP_CMD_CPAS_START:
+		rc = __icp_v2_cpas_start(icp_v2_info->core_info, args);
+		break;
+	case CAM_ICP_CMD_CPAS_STOP:
+		rc = cam_icp_v2_cpas_stop(icp_v2_info->core_info);
+		break;
+	case CAM_ICP_CMD_UBWC_CFG:
+		rc = cam_icp_v2_ubwc_configure(&icp_v2_info->soc_info,
+			icp_v2_info->core_info, args, arg_size);
+		break;
+	case CAM_ICP_SEND_INIT:
+		rc = cam_icp_v2_send_fw_init(icp_v2_info->core_info);
+		break;
+	case CAM_ICP_CMD_PC_PREP:
+		rc = cam_icp_v2_pc_prep(icp_v2_info->core_info);
+		break;
+	case CAM_ICP_CMD_CLK_UPDATE: {
+		rc = __cam_icp_v2_update_clk_rate(icp_v2_info, args, arg_size);
+		break;
+	}
+	case CAM_ICP_CMD_HW_DUMP:
+		/* Not supported for ICP_V2 */
+		rc = 0;
+		break;
+	case CAM_ICP_CMD_HW_MINI_DUMP: {
+		rc = __cam_icp_v2_fw_mini_dump(icp_v2_info->core_info, args);
+		break;
+	}
+	case CAM_ICP_CMD_HW_REG_DUMP: {
+		uint32_t dump_type;
+
+		if (!args) {
+			CAM_ERR(CAM_ICP, "Invalid args");
+			break;
+		}
+
+		dump_type = *(uint32_t *) args;
+		__cam_icp_v2_core_reg_dump(icp_v2_info, dump_type);
+		rc = 0;
+		break;
+	}
+	default:
+		CAM_ERR(CAM_ICP, "invalid command type=%u", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+irqreturn_t cam_icp_v2_handle_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *icp_v2_info = data;
+	struct cam_icp_v2_core_info *core_info = NULL;
+	bool recover = false;
+	uint32_t status = 0;
+	int32_t wd0_base_idx;
+	void __iomem *irq_base;
+
+	if (!icp_v2_info) {
+		CAM_ERR(CAM_ICP, "invalid ICP device info");
+		return IRQ_NONE;
+	}
+
+	core_info = icp_v2_info->core_info;
+	irq_base = icp_v2_info->soc_info.reg_map[core_info->irq_regbase_idx].mem_base;
+
+	status = cam_io_r_mb(irq_base + core_info->hw_info->ob_irq_status);
+
+	cam_io_w_mb(status, irq_base + core_info->hw_info->ob_irq_clear);
+	cam_io_w_mb(ICP_V2_IRQ_CLEAR_CMD, irq_base + core_info->hw_info->ob_irq_cmd);
+
+	if (core_info->is_irq_test) {
+		CAM_INFO(CAM_ICP, "ICP_V2 IRQ verified (status=0x%x)", status);
+		core_info->is_irq_test = false;
+		complete(&icp_v2_info->hw_complete);
+		return IRQ_HANDLED;
+	}
+
+	/* WD clear sequence - SW listens only to WD0 */
+	if (status & ICP_V2_WDT_BITE_WS0) {
+		wd0_base_idx = core_info->reg_base_idx[ICP_V2_WD0_BASE];
+
+		cam_io_w_mb(0x0,
+			icp_v2_info->soc_info.reg_map[wd0_base_idx].mem_base +
+			ICP_V2_WD_CTRL);
+		cam_io_w_mb(0x1,
+			icp_v2_info->soc_info.reg_map[wd0_base_idx].mem_base +
+			ICP_V2_WD_INTCLR);
+		CAM_ERR_RATE_LIMIT(CAM_ICP, "Fatal: Watchdog Bite from ICP");
+		recover = true;
+	}
+
+	spin_lock(&icp_v2_info->hw_lock);
+	if (core_info->irq_cb.cb)
+		core_info->irq_cb.cb(core_info->irq_cb.data,
+			recover);
+	spin_unlock(&icp_v2_info->hw_lock);
+
+	return IRQ_HANDLED;
+}
+
+void cam_icp_v2_irq_raise(void *priv)
+{
+	struct cam_hw_info *icp_v2_info = priv;
+	struct cam_icp_v2_core_info *core_info = NULL;
+
+	if (!icp_v2_info) {
+		CAM_ERR(CAM_ICP, "Invalid ICP device info");
+		return;
+	}
+
+	core_info = icp_v2_info->core_info;
+	cam_io_w_mb(ICP_V2_HOST2ICPINT,
+		icp_v2_info->soc_info.reg_map[core_info->irq_regbase_idx].mem_base +
+		core_info->hw_info->host2icpint);
+}
+
+void cam_icp_v2_irq_enable(void *priv)
+{
+	struct cam_hw_info *icp_v2_info = priv;
+	struct cam_icp_v2_core_info *core_info = NULL;
+
+	if (!icp_v2_info) {
+		CAM_ERR(CAM_ICP, "Invalid ICP device info");
+		return;
+	}
+
+	core_info = icp_v2_info->core_info;
+	cam_io_w_mb(ICP_V2_WDT_BITE_WS0 | ICP_V2_ICP2HOSTINT,
+		icp_v2_info->soc_info.reg_map[core_info->irq_regbase_idx].mem_base +
+		core_info->hw_info->ob_irq_mask);
+}
+
+int cam_icp_v2_test_irq_line(void *priv)
+{
+	struct cam_hw_info *icp_v2_info = priv;
+	struct cam_icp_v2_core_info *core_info = NULL;
+	void __iomem *irq_membase;
+	unsigned long rem_jiffies;
+	bool send_freq_info = false;
+
+	if (!icp_v2_info) {
+		CAM_ERR(CAM_ICP, "invalid ICP device info");
+		return -EINVAL;
+	}
+
+	core_info = icp_v2_info->core_info;
+	irq_membase = icp_v2_info->soc_info.reg_map[core_info->irq_regbase_idx].mem_base;
+
+	reinit_completion(&icp_v2_info->hw_complete);
+	core_info->is_irq_test = true;
+
+	cam_icp_v2_hw_init(priv, NULL, 0);
+
+	cam_io_w_mb(ICP_V2_WDT_BARK_WS0, irq_membase + core_info->hw_info->ob_irq_mask);
+	cam_io_w_mb(ICP_V2_WDT_BARK_WS0, irq_membase + core_info->hw_info->ob_irq_set);
+	cam_io_w_mb(ICP_V2_IRQ_SET_CMD, irq_membase + core_info->hw_info->ob_irq_cmd);
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(&icp_v2_info->hw_complete,
+		msecs_to_jiffies(ICP_V2_IRQ_TEST_TIMEOUT));
+	if (!rem_jiffies)
+		CAM_ERR(CAM_ICP, "ICP IRQ verification timed out");
+
+	cam_io_w_mb(0, irq_membase + core_info->hw_info->ob_irq_mask);
+	cam_icp_v2_hw_deinit(priv, &send_freq_info, sizeof(send_freq_info));
+
+	core_info->is_irq_test = false;
+
+	return 0;
+}
+
+void __iomem *cam_icp_v2_iface_addr(void *priv)
+{
+	int32_t csr_base_idx;
+	struct cam_hw_info *icp_v2_info = priv;
+	struct cam_icp_v2_core_info *core_info = NULL;
+	void __iomem *base;
+
+	if (!icp_v2_info) {
+		CAM_ERR(CAM_ICP, "invalid icp device info");
+		return ERR_PTR(-EINVAL);
+	}
+
+	core_info = icp_v2_info->core_info;
+	csr_base_idx = core_info->reg_base_idx[ICP_V2_CSR_BASE];
+	base = icp_v2_info->soc_info.reg_map[csr_base_idx].mem_base;
+
+	return base + ICP_V2_GEN_PURPOSE_REG_OFFSET;
+}
+
+void cam_icp_v2_populate_hfi_ops(const struct hfi_ops **hfi_proc_ops)
+{
+	if (!hfi_proc_ops) {
+		CAM_ERR(CAM_ICP, "Invalid hfi ops argument");
+		return;
+	}
+
+	*hfi_proc_ops = &hfi_icp_v2_ops;
+}
+
+static int cam_icp_v2_setup_register_base_indexes(
+	struct cam_hw_soc_info *soc_info, uint32_t hw_version,
+	int32_t regbase_index[], int32_t num_reg_map)
+{
+	int rc;
+	uint32_t index;
+
+	if (num_reg_map > ICP_V2_BASE_MAX) {
+		CAM_ERR(CAM_ICP, "Number of reg maps: %d exceeds max: %d",
+			num_reg_map, ICP_V2_BASE_MAX);
+		return -EINVAL;
+	}
+
+	if (soc_info->num_mem_block > CAM_SOC_MAX_BLOCK) {
+		CAM_ERR(CAM_ICP, "Invalid number of mem blocks: %d",
+			soc_info->num_mem_block);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "icp_csr", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[ICP_V2_CSR_BASE] = index;
+	} else {
+		CAM_ERR(CAM_ICP,
+			"Failed to get index for icp_csr, rc: %d index: %u num_reg_map: %u",
+			rc, index, num_reg_map);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "icp_wd0", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[ICP_V2_WD0_BASE] = index;
+	} else {
+		CAM_ERR(CAM_ICP,
+			"Failed to get index for icp_wd0, rc: %d index: %u num_reg_map: %u",
+			rc, index, num_reg_map);
+		return -EINVAL;
+	}
+
+	if (hw_version == CAM_ICP_V2_VERSION || hw_version == CAM_ICP_V3_0_VERSION) {
+		rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+			soc_info->num_mem_block, "icp_cirq", &index);
+		if ((rc == 0) && (index < num_reg_map)) {
+			regbase_index[ICP_V2_CIRQ_BASE] = index;
+		} else {
+			CAM_ERR(CAM_ICP,
+				"Failed to get index for icp_cirq, rc: %d index: %u num_reg_map: %u",
+				rc, index, num_reg_map);
+			return -EINVAL;
+		}
+	} else {
+		/* Optional for other versions */
+		regbase_index[ICP_V2_CIRQ_BASE] = -1;
+	}
+
+	/* optional - ICP SYS map */
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "icp_sys", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[ICP_V2_SYS_BASE] = index;
+	}  else {
+		CAM_DBG(CAM_ICP,
+			"Failed to get index for icp_sys, rc: %d index: %u num_reg_map: %u",
+			rc, index, num_reg_map);
+		regbase_index[ICP_V2_SYS_BASE] = -1;
+	}
+
+	/* optional - for non secure FW loading */
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "icp_dom_mask", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[ICP_V2_DOM_MASK_BASE] = index;
+	} else {
+		CAM_DBG(CAM_ICP,
+			"Failed to get index for icp_dom_mask, rc: %d index: %u num_reg_map: %u",
+			rc, index, num_reg_map);
+		regbase_index[ICP_V2_DOM_MASK_BASE] = -1;
+	}
+
+	return 0;
+}
+
+int cam_icp_v2_core_init(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_icp_v2_core_info *core_info)
+{
+	int rc = 0;
+	struct cam_icp_soc_info *soc_priv;
+
+	soc_priv = (struct cam_icp_soc_info *)soc_info->soc_private;
+
+	rc = cam_icp_v2_setup_register_base_indexes(soc_info,
+		soc_priv->hw_version, core_info->reg_base_idx, ICP_V2_BASE_MAX);
+	if (rc)
+		return rc;
+
+	/* Associate OB/HOST2ICP IRQ reg base */
+	switch (soc_priv->hw_version) {
+	case CAM_ICP_V2_1_VERSION:
+		core_info->irq_regbase_idx =
+			core_info->reg_base_idx[ICP_V2_CSR_BASE];
+		break;
+	case CAM_ICP_V2_VERSION:
+	case CAM_ICP_V3_0_VERSION:
+		core_info->irq_regbase_idx =
+			core_info->reg_base_idx[ICP_V2_CIRQ_BASE];
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Unsupported ICP HW version: %u",
+			soc_priv->hw_version);
+		rc = -EINVAL;
+	}
+
+	core_info->hfi_handle = HFI_HANDLE_INIT_VALUE;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_core.h
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_V2_CORE_H_
+#define _CAM_ICP_V2_CORE_H_
+
+#include "cam_hw_intf.h"
+#include "cam_icp_hw_intf.h"
+#include "hfi_intf.h"
+#include "cam_icp_v2_reg.h"
+
+/* Domain ID masks */
+#define ICP_V2_DOMAIN_MASK_CFG_0 0x00FF00FF
+#define ICP_V2_DOMAIN_MASK_CFG_1 0xFF00FF00
+
+enum cam_icp_v2_reg_base {
+	ICP_V2_CSR_BASE,
+	ICP_V2_CIRQ_BASE,
+	ICP_V2_WD0_BASE,
+	ICP_V2_SYS_BASE,
+	ICP_V2_DOM_MASK_BASE,
+	ICP_V2_BASE_MAX,
+};
+
+struct cam_icp_v2_core_info {
+	struct cam_icp_irq_cb irq_cb;
+	struct cam_icp_v2_hw_info *hw_info;
+	int32_t reg_base_idx[ICP_V2_BASE_MAX];
+	uint32_t cpas_handle;
+	int hfi_handle;
+	enum cam_icp_v2_reg_base irq_regbase_idx;
+	struct {
+		const struct firmware *fw_elf;
+		void *fw;
+		uint32_t fw_buf;
+		uintptr_t fw_kva_addr;
+		uint64_t fw_buf_len;
+	} fw_params;
+	bool cpas_start;
+	bool use_sec_pil;
+	bool is_irq_test;
+};
+
+int cam_icp_v2_hw_init(void *priv, void *args, uint32_t arg_size);
+int cam_icp_v2_hw_deinit(void *priv, void *args, uint32_t arg_size);
+int cam_icp_v2_process_cmd(void *priv, uint32_t cmd_type,
+	void *args, uint32_t arg_size);
+int cam_icp_v2_test_irq_line(void *priv);
+
+int cam_icp_v2_cpas_register(struct cam_hw_intf *icp_v2_intf);
+int cam_icp_v2_cpas_unregister(struct cam_hw_intf *icp_v2_intf);
+
+irqreturn_t cam_icp_v2_handle_irq(int irq_num, void *data);
+
+void cam_icp_v2_irq_raise(void *priv);
+void cam_icp_v2_irq_enable(void *priv);
+void __iomem *cam_icp_v2_iface_addr(void *priv);
+void cam_icp_v2_populate_hfi_ops(const struct hfi_ops **hfi_proc_ops);
+
+int cam_icp_v2_core_init(struct cam_hw_soc_info *soc_info,
+	struct cam_icp_v2_core_info *core_info);
+
+#endif /* _CAM_ICP_V2_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_dev.c
@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+
+#include "camera_main.h"
+#include "cam_debug_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_icp_hw_intf.h"
+#include "cam_icp_v2_core.h"
+#include "cam_icp_soc_common.h"
+
+static int max_icp_v2_hw_idx = -1;
+
+struct cam_icp_v2_hw_info cam_icp_v2_hw_info[] = {
+	{
+		.ob_irq_status		= 0xC,
+		.ob_irq_mask		= 0x0,
+		.ob_irq_clear		= 0x4,
+		.ob_irq_set		= 0x8,
+		.ob_irq_cmd		= 0x10,
+		.host2icpint		= 0x124,
+		.pfault_info		= {
+			0x128,
+		},
+		.num_pfault_info_regs	= 1,
+	},
+};
+
+struct cam_icp_v2_hw_info cam_icp_v2_1_hw_info[] = {
+	{
+		.ob_irq_status		= 0x20C,
+		.ob_irq_mask		= 0x200,
+		.ob_irq_clear		= 0x204,
+		.ob_irq_set		= 0x208,
+		.ob_irq_cmd		= 0x210,
+		.host2icpint		= 0x300,
+		.pfault_info		= {
+			0x400,
+		},
+		.num_pfault_info_regs	= 1,
+	},
+};
+
+struct cam_icp_v2_hw_info cam_icp_v3_0_hw_info[] = {
+	{
+		.ob_irq_status		= 0xC,
+		.ob_irq_mask		= 0x0,
+		.ob_irq_clear		= 0x4,
+		.ob_irq_set		= 0x8,
+		.ob_irq_cmd		= 0x10,
+		.host2icpint		= 0x124,
+		.pfault_info		= {
+			0x140,
+			0x144,
+			0x148,
+			0x14C,
+			0x150,
+			0x154,
+		},
+		.num_pfault_info_regs	= 6,
+	},
+};
+
+uint32_t cam_icp_v2_get_device_num(void)
+{
+	return max_icp_v2_hw_idx + 1;
+}
+
+static int cam_icp_v2_soc_info_init(struct cam_hw_soc_info *soc_info,
+	struct platform_device *pdev)
+{
+	struct cam_icp_soc_info *icp_soc_info = NULL;
+
+	icp_soc_info = kzalloc(sizeof(*icp_soc_info), GFP_KERNEL);
+	if (!icp_soc_info)
+		return -ENOMEM;
+
+	soc_info->pdev = pdev;
+	soc_info->dev = &pdev->dev;
+	soc_info->dev_name = pdev->name;
+	soc_info->soc_private = icp_soc_info;
+
+	icp_soc_info->dev_type = CAM_ICP_HW_ICP_V2;
+
+	return 0;
+}
+
+static inline void cam_icp_v2_soc_info_deinit(struct cam_hw_soc_info *soc_info)
+{
+	kfree(soc_info->soc_private);
+}
+
+static int cam_icp_v2_component_bind(struct device *dev,
+	struct device *mdev, void *data)
+{
+	int rc = 0;
+	struct cam_hw_intf *icp_v2_intf = NULL;
+	struct cam_hw_info *icp_v2_info = NULL;
+	struct cam_icp_v2_core_info *core_info = NULL;
+	const struct of_device_id *match_dev = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	match_dev = of_match_device(
+		pdev->dev.driver->of_match_table, &pdev->dev);
+	if (!match_dev) {
+		CAM_DBG(CAM_ICP, "No ICP v2 hardware info");
+		return -EINVAL;
+	}
+
+	icp_v2_intf = kzalloc(sizeof(*icp_v2_intf), GFP_KERNEL);
+	if (!icp_v2_intf)
+		return -ENOMEM;
+
+	icp_v2_info = kzalloc(sizeof(*icp_v2_info), GFP_KERNEL);
+	if (!icp_v2_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	core_info = kzalloc(sizeof(*core_info), GFP_KERNEL);
+	if (!core_info) {
+		rc = -ENOMEM;
+		goto free_hw_info;
+	}
+
+	core_info->hw_info = (struct cam_icp_v2_hw_info *)match_dev->data;
+	icp_v2_info->core_info = core_info;
+
+	rc = cam_icp_v2_soc_info_init(&icp_v2_info->soc_info, pdev);
+	if (rc)
+		goto free_core_info;
+
+	mutex_init(&icp_v2_info->hw_mutex);
+	spin_lock_init(&icp_v2_info->hw_lock);
+	init_completion(&icp_v2_info->hw_complete);
+
+	rc = cam_icp_soc_resources_init(&icp_v2_info->soc_info,
+		cam_icp_v2_handle_irq, icp_v2_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "soc resources init failed rc=%d", rc);
+		goto free_soc_info;
+	}
+
+	rc = cam_icp_v2_core_init(&icp_v2_info->soc_info, core_info);
+	if (rc)
+		goto free_soc_info;
+
+	icp_v2_intf->hw_priv = icp_v2_info;
+	icp_v2_intf->hw_type = CAM_ICP_HW_ICP_V2;
+	icp_v2_intf->hw_idx = icp_v2_info->soc_info.index;
+	icp_v2_intf->hw_ops.init = cam_icp_v2_hw_init;
+	icp_v2_intf->hw_ops.deinit = cam_icp_v2_hw_deinit;
+	icp_v2_intf->hw_ops.process_cmd = cam_icp_v2_process_cmd;
+	icp_v2_intf->hw_ops.test_irq_line = cam_icp_v2_test_irq_line;
+
+	rc = cam_icp_v2_cpas_register(icp_v2_intf);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cpas registration failed rc=%d", rc);
+		goto res_deinit;
+	}
+
+	if ((int)(icp_v2_intf->hw_idx) > max_icp_v2_hw_idx)
+		max_icp_v2_hw_idx = icp_v2_intf->hw_idx;
+
+	platform_set_drvdata(pdev, icp_v2_intf);
+
+	return 0;
+
+res_deinit:
+	cam_icp_soc_resources_deinit(&icp_v2_info->soc_info);
+free_soc_info:
+	cam_icp_v2_soc_info_deinit(&icp_v2_info->soc_info);
+free_core_info:
+	kfree(core_info);
+free_hw_info:
+	kfree(icp_v2_info);
+free_hw_intf:
+	kfree(icp_v2_intf);
+
+	return rc;
+}
+
+static void cam_icp_v2_component_unbind(struct device *dev,
+	struct device *mdev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct cam_hw_intf *icp_v2_intf = NULL;
+	struct cam_hw_info *icp_v2_info = NULL;
+
+	icp_v2_intf = platform_get_drvdata(pdev);
+
+	if (!icp_v2_intf) {
+		CAM_ERR(CAM_ICP, "Error No data in pdev");
+		return;
+	}
+
+	icp_v2_info = icp_v2_intf->hw_priv;
+
+	cam_icp_v2_cpas_unregister(icp_v2_intf);
+	cam_icp_soc_resources_deinit(&icp_v2_info->soc_info);
+	cam_icp_v2_soc_info_deinit(&icp_v2_info->soc_info);
+
+	max_icp_v2_hw_idx = -1;
+
+	kfree(icp_v2_info->core_info);
+	kfree(icp_v2_info);
+	kfree(icp_v2_intf);
+}
+
+static const struct component_ops cam_icp_v2_component_ops = {
+	.bind = cam_icp_v2_component_bind,
+	.unbind = cam_icp_v2_component_unbind,
+};
+
+static const struct of_device_id cam_icp_v2_match[] = {
+	{
+		.compatible = "qcom,cam-icp_v2",
+		.data = &cam_icp_v2_hw_info,
+	},
+	{
+		.compatible = "qcom,cam-icp_v2_1",
+		.data = &cam_icp_v2_1_hw_info,
+	},
+	{
+		.compatible = "qcom,cam-icp_v3_0",
+		.data = &cam_icp_v3_0_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_icp_v2_match);
+
+static int cam_icp_v2_driver_probe(struct platform_device *pdev)
+{
+	int rc;
+
+	rc = component_add(&pdev->dev, &cam_icp_v2_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "cam-icp_v2 component add failed rc=%d", rc);
+
+	return rc;
+}
+
+static int cam_icp_v2_driver_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_icp_v2_component_ops);
+
+	return 0;
+}
+
+struct platform_driver cam_icp_v2_driver = {
+	.probe = cam_icp_v2_driver_probe,
+	.remove = cam_icp_v2_driver_remove,
+	.driver = {
+		.name = "cam-icp_v2",
+		.of_match_table = cam_icp_v2_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_icp_v2_init_module(void)
+{
+	return platform_driver_register(&cam_icp_v2_driver);
+}
+
+void cam_icp_v2_exit_module(void)
+{
+	platform_driver_unregister(&cam_icp_v2_driver);
+}
+
+MODULE_DESCRIPTION("Camera ICP_V2 driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_dev.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_V2_DEV_H_
+#define _CAM_ICP_V2_DEV_H_
+
+int cam_icp_v2_init_module(void);
+void cam_icp_v2_exit_module(void);
+
+#endif /* _CAM_ICP_V2_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/icp_proc/icp_v2_hw/cam_icp_v2_reg.h
@@ -0,0 +1,60 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_V2_REG_H_
+#define _CAM_ICP_V2_REG_H_
+
+/* ICP CSR info */
+#define ICP_V2_GEN_PURPOSE_REG_OFFSET     0x20
+#define ICP_V2_CSR_DBG_STATUS_REG_OFFSET  0xC0
+#define ICP_V2_CSR_DBG_CTRL_REG_OFFSET    0xC4
+#define ICP_V2_CSR_GP_REG_COUNT           0x18
+
+/* ICP_SYS - Protected reg space defined in AC policy */
+#define ICP_V2_SYS_RESET      0x0
+#define ICP_V2_SYS_CONTROL    0x4
+#define ICP_V2_SYS_STATUS     0xC
+#define ICP_V2_SYS_ACCESS     0x10
+
+#define ICP_V2_STANDBYWFI     (1 << 7)
+#define ICP_V2_EN_CPU         (1 << 9)
+#define ICP_V2_FUNC_RESET     (1 << 4)
+
+/* ICP WD reg space */
+#define ICP_V2_WD_CTRL        0x8
+#define ICP_V2_WD_INTCLR      0xC
+
+/* ICP DOM_MASK reg space */
+#define ICP_V2_DOM_0_CFG_OFFSET    0x0
+#define ICP_V2_DOM_1_CFG_OFFSET    0x20
+
+/* These bitfields are shared by OB_MASK, OB_CLEAR, OB_STATUS */
+#define ICP_V2_WDT_BITE_WS1       (1 << 6)
+#define ICP_V2_WDT_BARK_WS1       (1 << 5)
+#define ICP_V2_WDT_BITE_WS0       (1 << 4)
+#define ICP_V2_WDT_BARK_WS0       (1 << 3)
+#define ICP_V2_ICP2HOSTINT        (1 << 2)
+
+#define ICP_V2_IRQ_CLEAR_CMD      (1 << 1)
+#define ICP_V2_IRQ_SET_CMD        (1 << 0)
+
+#define ICP_V2_HOST2ICPINT        (1 << 0)
+
+/* Maximum number of ICP pfault info registers */
+#define ICP_PFAULT_INFO_REG_NUM_MAX 0x6
+
+struct cam_icp_v2_hw_info {
+	uint32_t ob_irq_status;
+	uint32_t ob_irq_mask;
+	uint32_t ob_irq_clear;
+	uint32_t ob_irq_set;
+	uint32_t ob_irq_cmd;
+	uint32_t host2icpint;
+	uint32_t pfault_info[ICP_PFAULT_INFO_REG_NUM_MAX];
+	uint32_t num_pfault_info_regs;
+};
+
+#endif /* _CAM_ICP_V2_REG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/include/cam_icp_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/include/cam_icp_hw_mgr_intf.h
@@ -0,0 +1,124 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_ICP_HW_MGR_INTF_H
+#define CAM_ICP_HW_MGR_INTF_H
+
+#include <linux/of.h>
+#include <media/cam_icp.h>
+#include <media/cam_defs.h>
+#include "cam_cpas_api.h"
+
+
+#define CAM_ICP_SUBDEV_NAME_LEN  32
+#define CAM_ICP_SUBDEV_NAME      "cam-icp"
+
+#define ICP_CLK_TURBO_HZ         600000000
+#define ICP_CLK_SVS_HZ           400000000
+
+#define CAM_ICP_BW_BYTES_VOTE    40000000
+
+#define CAM_ICP_CTX_MAX          54
+
+#define CPAS_IPE1_BIT            0x2000
+
+#define CAM_IPE_DEFAULT_AXI_PATH    CAM_AXI_PATH_DATA_IPE_WR_VID
+#define CAM_IPE_DEFAULT_AXI_TRANSAC CAM_AXI_TRANSACTION_WRITE
+#define CAM_BPS_DEFAULT_AXI_PATH    CAM_AXI_PATH_DATA_ALL
+#define CAM_BPS_DEFAULT_AXI_TRANSAC CAM_AXI_TRANSACTION_WRITE
+#define CAM_OFE_DEFAULT_AXI_PATH    CAM_AXI_PATH_DATA_OFE_WR_VID
+#define CAM_OFE_DEFAULT_AXI_TRANSAC CAM_AXI_TRANSACTION_WRITE
+#define CAM_ICP_DEFAULT_AXI_PATH    CAM_AXI_PATH_DATA_ALL
+#define CAM_ICP_DEFAULT_AXI_TRANSAC CAM_AXI_TRANSACTION_READ
+
+#define CAM_ICP_DUMP_TAG_MAX_LEN 128
+#define CAM_ICP_DUMP_NUM_WORDS   5
+
+enum cam_icp_subdev_id {
+	CAM_ICP0_SUBDEV,
+	CAM_ICP1_SUBDEV,
+	CAM_ICP_SUBDEV_MAX
+};
+
+enum cam_icp_hw_event_type {
+	CAM_ICP_EVT_ID_BUF_DONE,
+	CAM_ICP_EVT_ID_ERROR,
+	CAM_ICP_EVT_ID_INJECT_EVENT,
+};
+
+enum cam_icp_hw_error_type {
+	CAM_ICP_HW_ERROR_NO_MEM,
+	CAM_ICP_HW_ERROR_SYSTEM_FAILURE,
+};
+
+typedef void(*cam_icp_mini_dump_cb)(void *priv,
+	void *args);
+
+/**
+ * struct cam_icp_cpas_vote
+ * @ahb_vote: AHB vote info
+ * @axi_vote: AXI vote info
+ * @ahb_vote_valid: Flag for ahb vote data
+ * @axi_vote_valid: flag for axi vote data
+ */
+struct cam_icp_cpas_vote {
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote;
+	uint32_t ahb_vote_valid;
+	uint32_t axi_vote_valid;
+};
+
+/**
+ * struct cam_icp_hw_dump_args
+ * @cpu_addr: kernel vaddr
+ * @buf_len:  buffer length
+ * @offset:   offset
+ */
+struct cam_icp_hw_dump_args {
+	uintptr_t  cpu_addr;
+	size_t     buf_len;
+	size_t     offset;
+};
+
+/**
+ * struct cam_icp_dump_header
+ * @tag:        tag of the packet
+ * @size:       size of data in packet
+ * @word_size:  size of each word in packet
+ */
+struct cam_icp_dump_header {
+	uint8_t    tag[CAM_ICP_DUMP_TAG_MAX_LEN];
+	uint64_t   size;
+	int32_t    word_size;
+};
+
+/**
+ * struct cam_icp_hw_buf_done_evt_data
+ * @buf_done_data:    buf done payload
+ * @evt_id:           event id (success/cancel/error)
+ */
+struct cam_icp_hw_buf_done_evt_data {
+	void      *buf_done_data;
+	uint32_t   evt_id;
+};
+
+/**
+ * struct cam_icp_hw_error_evt_data
+ * @req_id:    request id
+ * @err_type:      type of fatal error
+ */
+struct cam_icp_hw_error_evt_data {
+	uint64_t                       req_id;
+	enum cam_icp_hw_error_type     err_type;
+};
+
+int cam_icp_hw_mgr_init(struct device_node *of_node,
+	uint64_t *hw_mgr_hdl, int *iommu_hdl,
+	cam_icp_mini_dump_cb mini_dump_cb, int device_idx);
+
+void cam_icp_hw_mgr_deinit(int device_idx);
+
+#endif /* CAM_ICP_HW_MGR_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.c
@@ -0,0 +1,483 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ipe_core.h"
+#include "ipe_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_ipe_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "hfi_reg.h"
+#include "cam_common_util.h"
+
+static int cam_ipe_cpas_vote(struct cam_ipe_device_core_info *core_info,
+	struct cam_icp_cpas_vote *cpas_vote)
+{
+	int rc = 0;
+
+	if (cpas_vote->ahb_vote_valid)
+		rc = cam_cpas_update_ahb_vote(core_info->cpas_handle,
+			&cpas_vote->ahb_vote);
+	if (cpas_vote->axi_vote_valid)
+		rc = cam_cpas_update_axi_vote(core_info->cpas_handle,
+			&cpas_vote->axi_vote);
+
+	if (rc)
+		CAM_ERR(CAM_PERF, "cpas vote is failed: %d", rc);
+
+	return rc;
+}
+
+int cam_ipe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ipe_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	struct cam_icp_cpas_vote cpas_vote;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_IPE_DEFAULT_AXI_PATH;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_IPE_DEFAULT_AXI_TRANSAC;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cpas start failed: %d", rc);
+		goto error;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_ipe_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "soc enable is failed : %d", rc);
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	} else {
+		core_info->clk_enable = true;
+	}
+
+error:
+	return rc;
+}
+
+int cam_ipe_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ipe_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	rc = cam_ipe_disable_soc_resources(soc_info, core_info->clk_enable);
+	if (rc)
+		CAM_ERR(CAM_ICP, "soc disable is failed : %d", rc);
+	core_info->clk_enable = false;
+
+	if (core_info->cpas_start) {
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	}
+
+	return rc;
+}
+
+static int cam_ipe_handle_pc(struct cam_hw_info *ipe_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	struct cam_ipe_device_hw_info *hw_info = NULL;
+	int rc = 0;
+	int pwr_ctrl;
+	int pwr_status;
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	hw_info = core_info->ipe_hw_info;
+
+	if (!core_info->cpas_start) {
+		CAM_DBG(CAM_ICP, "CPAS IPE client not started");
+		return 0;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (!(pwr_ctrl & IPE_COLLAPSE_MASK)) {
+		rc = cam_cpas_reg_read(core_info->cpas_handle,
+				CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_status,
+				true, &pwr_status);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+			return rc;
+		}
+
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP,
+			hw_info->pwr_ctrl, true, 0x1);
+
+		if (pwr_status >> IPE_PWR_ON_MASK)
+			CAM_WARN(CAM_PERF, "BPS: pwr_status(%x):pwr_ctrl(%x)",
+				pwr_status, pwr_ctrl);
+
+	}
+
+	rc = cam_ipe_get_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_status,
+			true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return 0;
+}
+
+static int cam_ipe_handle_resume(struct cam_hw_info *ipe_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	struct cam_ipe_device_hw_info *hw_info = NULL;
+	int pwr_ctrl;
+	int pwr_status;
+	int rc = 0;
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	hw_info = core_info->ipe_hw_info;
+
+	if (!core_info->cpas_start) {
+		CAM_DBG(CAM_ICP, "CPAS IPE client not started");
+		return 0;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (pwr_ctrl & IPE_COLLAPSE_MASK) {
+		CAM_DBG(CAM_PERF, "IPE pwr_ctrl set(%x)", pwr_ctrl);
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP,
+			hw_info->pwr_ctrl, true, 0);
+	}
+
+	rc = cam_ipe_transfer_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to transfer gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_status,
+			true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return rc;
+}
+
+static int cam_ipe_cmd_reset(struct cam_hw_soc_info *soc_info,
+	struct cam_ipe_device_core_info *core_info)
+{
+	int pwr_ctrl, pwr_status, rc = 0;
+	uint32_t status = 0, retry_cnt = 0;
+	bool reset_ipe_cdm_fail = false;
+	bool reset_ipe_top_fail = false;
+	struct cam_ipe_device_hw_info *hw_info = NULL;
+
+	CAM_DBG(CAM_ICP, "CAM_ICP_IPE_CMD_RESET");
+	if (!core_info->clk_enable || !core_info->cpas_start) {
+		CAM_DBG(CAM_ICP, "IPE not powered on clk_en %d cpas_start %d",
+				core_info->clk_enable, core_info->cpas_start);
+		return 0;
+	}
+
+	hw_info = core_info->ipe_hw_info;
+
+	/* IPE CDM core reset*/
+	cam_io_w_mb(hw_info->cdm_rst_val,
+		soc_info->reg_map[0].mem_base + hw_info->cdm_rst_cmd);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		cam_common_read_poll_timeout((soc_info->reg_map[0].mem_base +
+			hw_info->cdm_irq_status),
+			PC_POLL_DELAY_US, PC_POLL_TIMEOUT_US,
+			IPE_RST_DONE_IRQ_STATUS_BIT, IPE_RST_DONE_IRQ_STATUS_BIT,
+			&status);
+
+		CAM_DBG(CAM_ICP, "ipe_cdm_irq_status = %u", status);
+		if ((status & IPE_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+
+	if (retry_cnt == HFI_MAX_POLL_TRY) {
+		CAM_ERR(CAM_ICP, "IPE CDM rst failed status 0x%x", status);
+		reset_ipe_cdm_fail = true;
+	}
+
+	/* IPE reset*/
+	status = 0;
+	retry_cnt = 0;
+	cam_io_w_mb((uint32_t)0x3,
+		soc_info->reg_map[0].mem_base + hw_info->top_rst_cmd);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		cam_common_read_poll_timeout((soc_info->reg_map[0].mem_base +
+			hw_info->top_irq_status),
+			PC_POLL_DELAY_US, PC_POLL_TIMEOUT_US,
+			IPE_RST_DONE_IRQ_STATUS_BIT, IPE_RST_DONE_IRQ_STATUS_BIT,
+			&status);
+
+		CAM_DBG(CAM_ICP, "ipe_top_irq_status = %u", status);
+
+		if ((status & IPE_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+
+	if (retry_cnt == HFI_MAX_POLL_TRY) {
+		CAM_ERR(CAM_ICP, "IPE top rst failed status 0x%x", status);
+		reset_ipe_top_fail = true;
+	}
+
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, core_info->ipe_hw_info->pwr_ctrl,
+		true, &pwr_ctrl);
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, core_info->ipe_hw_info->pwr_status,
+		true, &pwr_status);
+	CAM_DBG(CAM_ICP, "(After)pwr_ctrl = %x pwr_status = %x",
+		pwr_ctrl, pwr_status);
+
+	if (reset_ipe_cdm_fail || reset_ipe_top_fail)
+		rc = -EAGAIN;
+	else
+		CAM_DBG(CAM_ICP, "IPE cdm and IPE top reset success");
+
+	return rc;
+}
+
+int cam_ipe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ipe_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	struct cam_ipe_device_hw_info *hw_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_ICP_DEV_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	hw_info = core_info->ipe_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ICP_DEV_CMD_VOTE_CPAS: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args)
+			return -EINVAL;
+
+		cam_ipe_cpas_vote(core_info, cpas_vote);
+		break;
+	}
+
+	case CAM_ICP_DEV_CMD_CPAS_START: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args)
+			return -EINVAL;
+
+		if (!core_info->cpas_start) {
+			rc = cam_cpas_start(core_info->cpas_handle,
+				&cpas_vote->ahb_vote, &cpas_vote->axi_vote);
+			core_info->cpas_start = true;
+		}
+		break;
+	}
+
+	case CAM_ICP_DEV_CMD_CPAS_STOP:
+		if (core_info->cpas_start) {
+			cam_cpas_stop(core_info->cpas_handle);
+			core_info->cpas_start = false;
+		}
+		break;
+	case CAM_ICP_DEV_CMD_POWER_COLLAPSE:
+		rc = cam_ipe_handle_pc(ipe_dev);
+		break;
+	case CAM_ICP_DEV_CMD_POWER_RESUME:
+		rc = cam_ipe_handle_resume(ipe_dev);
+		break;
+	case CAM_ICP_DEV_CMD_UPDATE_CLK: {
+		struct cam_icp_dev_clk_update_cmd *clk_upd_cmd = cmd_args;
+		struct cam_ahb_vote ahb_vote;
+		uint32_t clk_rate = clk_upd_cmd->curr_clk_rate;
+		int32_t clk_level  = 0, err = 0;
+
+		CAM_DBG(CAM_PERF, "ipe_src_clk rate = %d", (int)clk_rate);
+		if (!core_info->clk_enable) {
+			if (clk_upd_cmd->dev_pc_enable) {
+				cam_ipe_handle_pc(ipe_dev);
+				cam_cpas_reg_write(core_info->cpas_handle,
+					CAM_CPAS_REGBASE_CPASTOP,
+					hw_info->pwr_ctrl, true, 0x0);
+			}
+			rc = cam_ipe_toggle_clk(soc_info, true);
+			if (rc)
+				CAM_ERR(CAM_ICP, "Enable failed");
+			else
+				core_info->clk_enable = true;
+			if (clk_upd_cmd->dev_pc_enable) {
+				rc = cam_ipe_handle_resume(ipe_dev);
+				if (rc)
+					CAM_ERR(CAM_ICP, "bps resume failed");
+			}
+		}
+		CAM_DBG(CAM_PERF, "clock rate %d", clk_rate);
+
+		rc = cam_ipe_update_clk_rate(soc_info, &clk_rate);
+		if (rc)
+			CAM_ERR(CAM_PERF, "Failed to update clk %d", clk_rate);
+
+		err = cam_soc_util_get_clk_level(soc_info,
+			clk_rate, soc_info->src_clk_idx,
+			&clk_level);
+
+		if (!err) {
+			clk_upd_cmd->clk_level = clk_level;
+			ahb_vote.type = CAM_VOTE_ABSOLUTE;
+			ahb_vote.vote.level = clk_level;
+			cam_cpas_update_ahb_vote(
+				core_info->cpas_handle,
+				&ahb_vote);
+		}
+		break;
+	}
+	case CAM_ICP_DEV_CMD_DISABLE_CLK:
+		if (core_info->clk_enable == true)
+			cam_ipe_toggle_clk(soc_info, false);
+		core_info->clk_enable = false;
+		break;
+	case CAM_ICP_DEV_CMD_RESET:
+		rc = cam_ipe_cmd_reset(soc_info, core_info);
+		break;
+	case CAM_ICP_DEV_CMD_DUMP_CLK: {
+		rc = cam_soc_util_dump_clk(soc_info);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_ICP, "Invalid Cmd Type:%u", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+irqreturn_t cam_ipe_irq(int irq_num, void *data)
+{
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.h
@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_IPE_CORE_H
+#define CAM_IPE_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+/* IPE CDM/TOP status register */
+#define IPE_RST_DONE_IRQ_STATUS_BIT  0x1
+
+#define IPE_COLLAPSE_MASK 0x1
+#define IPE_PWR_ON_MASK   0x2
+
+struct cam_ipe_device_hw_info {
+	uint32_t hw_idx;
+	uint32_t pwr_ctrl;
+	uint32_t pwr_status;
+
+	uint32_t top_rst_cmd;
+	uint32_t top_irq_status;
+	uint32_t cdm_rst_cmd;
+	uint32_t cdm_irq_status;
+
+	uint32_t cdm_rst_val;
+};
+
+struct cam_ipe_device_core_info {
+	struct cam_ipe_device_hw_info *ipe_hw_info;
+	uint32_t cpas_handle;
+	bool cpas_start;
+	bool clk_enable;
+};
+
+int cam_ipe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ipe_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ipe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+irqreturn_t cam_ipe_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register IPE hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_ipe_init_module(void);
+
+/**
+ * @brief : API to remove IPE Hw from platform framework.
+ */
+void cam_ipe_exit_module(void);
+#endif /* CAM_IPE_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_dev.c
@@ -0,0 +1,265 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+#include "ipe_core.h"
+#include "ipe_soc.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_icp_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_ipe_device_hw_info cam_ipe_hw_info[] = {
+	{
+		.hw_idx = 0,
+		.pwr_ctrl = 0x40,
+		.pwr_status = 0x3C,
+		.top_rst_cmd = 0x1008,
+		.top_irq_status = 0x100C,
+		.cdm_rst_cmd = 0x10,
+		.cdm_irq_status = 0x44,
+		.cdm_rst_val = 0xF,
+	},
+};
+
+static struct cam_ipe_device_hw_info cam_ipe680_hw_info[] = {
+	{
+		.hw_idx = 0,
+		.pwr_ctrl = 0x40,
+		.pwr_status = 0x3C,
+		.top_rst_cmd = 0x1008,
+		.top_irq_status = 0x100C,
+		.cdm_rst_cmd = 0x10,
+		.cdm_irq_status = 0x44,
+		.cdm_rst_val = 0x7F,
+	},
+};
+
+int cam_ipe_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_ipe_device_core_info *core_info,
+	uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "ipe", sizeof("ipe"));
+	cpas_register_params.cam_cpas_client_cb = NULL;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_ipe_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info            *ipe_dev = NULL;
+	struct cam_hw_intf            *ipe_dev_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_ipe_device_core_info   *core_info = NULL;
+	struct cam_ipe_device_hw_info     *hw_info = NULL;
+	int                                rc = 0;
+	struct cam_cpas_query_cap query;
+	uint32_t *cam_caps, num_cap_mask;
+	uint32_t hw_idx;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &hw_idx);
+
+	rc = cam_cpas_get_hw_info(&query.camera_family,
+			&query.camera_version, &query.cpas_version,
+			&cam_caps, &num_cap_mask, NULL, NULL);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get hw info rc=%d", rc);
+		return rc;
+	}
+
+	if ((!(cam_caps[IPE_CAPS_MASK_IDX] & CPAS_IPE1_BIT)) && (hw_idx)) {
+		CAM_ERR(CAM_ICP, "IPE1 hw idx = %d\n", hw_idx);
+		return -EINVAL;
+	}
+
+	ipe_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!ipe_dev_intf)
+		return -ENOMEM;
+
+	ipe_dev_intf->hw_idx = hw_idx;
+	ipe_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!ipe_dev) {
+		kfree(ipe_dev_intf);
+		return -ENOMEM;
+	}
+
+	ipe_dev->soc_info.pdev = pdev;
+	ipe_dev->soc_info.dev = &pdev->dev;
+	ipe_dev->soc_info.dev_name = pdev->name;
+	ipe_dev_intf->hw_priv = ipe_dev;
+	ipe_dev_intf->hw_ops.init = cam_ipe_init_hw;
+	ipe_dev_intf->hw_ops.deinit = cam_ipe_deinit_hw;
+	ipe_dev_intf->hw_ops.process_cmd = cam_ipe_process_cmd;
+	ipe_dev_intf->hw_type = CAM_ICP_DEV_IPE;
+
+	CAM_DBG(CAM_ICP, "IPE component bind type %d index %d",
+		ipe_dev_intf->hw_type,
+		ipe_dev_intf->hw_idx);
+
+	platform_set_drvdata(pdev, ipe_dev_intf);
+
+	ipe_dev->core_info = kzalloc(sizeof(struct cam_ipe_device_core_info),
+		GFP_KERNEL);
+	if (!ipe_dev->core_info) {
+		kfree(ipe_dev);
+		kfree(ipe_dev_intf);
+		return -ENOMEM;
+	}
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_DBG(CAM_ICP, "No ipe hardware info");
+		kfree(ipe_dev->core_info);
+		kfree(ipe_dev);
+		kfree(ipe_dev_intf);
+		rc = -EINVAL;
+		return rc;
+	}
+	hw_info = (struct cam_ipe_device_hw_info *)match_dev->data;
+	core_info->ipe_hw_info = hw_info;
+
+	rc = cam_ipe_init_soc_resources(&ipe_dev->soc_info, cam_ipe_irq,
+		ipe_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed to init_soc");
+		kfree(ipe_dev->core_info);
+		kfree(ipe_dev);
+		kfree(ipe_dev_intf);
+		return rc;
+	}
+
+	CAM_DBG(CAM_ICP, "cam_ipe_init_soc_resources : %pK",
+		(void *)&ipe_dev->soc_info);
+	rc = cam_ipe_register_cpas(&ipe_dev->soc_info,
+		core_info, ipe_dev_intf->hw_idx);
+	if (rc < 0) {
+		kfree(ipe_dev->core_info);
+		kfree(ipe_dev);
+		kfree(ipe_dev_intf);
+		return rc;
+	}
+	ipe_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&ipe_dev->hw_mutex);
+	spin_lock_init(&ipe_dev->hw_lock);
+	init_completion(&ipe_dev->hw_complete);
+
+	CAM_DBG(CAM_ICP, "IPE:%d component bound successfully",
+		ipe_dev_intf->hw_idx);
+
+	return rc;
+}
+
+static void cam_ipe_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info            *ipe_dev = NULL;
+	struct cam_hw_intf            *ipe_dev_intf = NULL;
+	struct cam_ipe_device_core_info   *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ICP, "Unbinding component: %s", pdev->name);
+	ipe_dev_intf = platform_get_drvdata(pdev);
+
+	if (!ipe_dev_intf) {
+		CAM_ERR(CAM_ICP, "Error No data in pdev");
+		return;
+	}
+
+	ipe_dev = ipe_dev_intf->hw_priv;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	cam_cpas_unregister_client(core_info->cpas_handle);
+	cam_ipe_deinit_soc_resources(&ipe_dev->soc_info);
+	kfree(ipe_dev->core_info);
+	kfree(ipe_dev);
+	kfree(ipe_dev_intf);
+}
+
+
+const static struct component_ops cam_ipe_component_ops = {
+	.bind = cam_ipe_component_bind,
+	.unbind = cam_ipe_component_unbind,
+};
+
+int cam_ipe_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "Adding IPE component");
+	rc = component_add(&pdev->dev, &cam_ipe_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_ipe_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ipe_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_ipe_dt_match[] = {
+	{
+		.compatible = "qcom,cam-ipe",
+		.data = &cam_ipe_hw_info,
+	},
+	{
+		.compatible = "qcom,cam-ipe680",
+		.data = &cam_ipe680_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_ipe_dt_match);
+
+struct platform_driver cam_ipe_driver = {
+	.probe = cam_ipe_probe,
+	.remove = cam_ipe_remove,
+	.driver = {
+		.name = "cam-ipe",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ipe_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ipe_init_module(void)
+{
+	return platform_driver_register(&cam_ipe_driver);
+}
+
+void cam_ipe_exit_module(void)
+{
+	platform_driver_unregister(&cam_ipe_driver);
+}
+
+MODULE_DESCRIPTION("CAM IPE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.c
@@ -0,0 +1,180 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "ipe_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+
+int cam_ipe_transfer_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	int rc;
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = cam_wrapper_regulator_set_mode(soc_info->rgltr[i],
+			REGULATOR_MODE_FAST);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Regulator set mode %s failed",
+				soc_info->rgltr_name[i]);
+			goto rgltr_set_mode_failed;
+		}
+	}
+	return 0;
+
+rgltr_set_mode_failed:
+	for (i = i - 1; i >= 0; i--)
+		if (soc_info->rgltr[i])
+			cam_wrapper_regulator_set_mode(soc_info->rgltr[i],
+				REGULATOR_MODE_NORMAL);
+
+	return rc;
+}
+
+int cam_ipe_get_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	int rc;
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = cam_wrapper_regulator_set_mode(soc_info->rgltr[i],
+					REGULATOR_MODE_NORMAL);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Regulator set mode %s failed",
+				soc_info->rgltr_name[i]);
+			goto rgltr_set_mode_failed;
+		}
+	}
+	return 0;
+
+rgltr_set_mode_failed:
+	for (i = i - 1; i >= 0; i--)
+		if (soc_info->rgltr[i])
+			cam_wrapper_regulator_set_mode(soc_info->rgltr[i],
+					REGULATOR_MODE_FAST);
+
+	return rc;
+}
+
+static int cam_ipe_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ICP, "get ipe dt prop is failed");
+
+	return rc;
+}
+
+static int cam_ipe_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t ipe_irq_handler, void *data)
+{
+	int rc, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, ipe_irq_handler, &(irq_data[0]));
+
+	return rc;
+}
+
+int cam_ipe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ipe_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_ipe_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_ipe_request_platform_resource(soc_info, ipe_irq_handler,
+		irq_data);
+	if (rc < 0)
+		return rc;
+
+	return rc;
+}
+
+void cam_ipe_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_WARN(CAM_ICP, "release platform resources fail");
+}
+
+int cam_ipe_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		CAM_SVS_VOTE, false);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "enable platform failed");
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_ipe_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, disable_clk,
+		false);
+	if (rc)
+		CAM_ERR(CAM_ICP, "enable platform failed");
+
+	return rc;
+}
+
+int cam_ipe_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t *clk_rate)
+{
+	int32_t src_clk_idx;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE] == true) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(*clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_PERF, "clk_rate %d greater than max, reset to %d",
+			*clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		*clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	return cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX, *clk_rate, 0);
+}
+
+int cam_ipe_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable)
+{
+	int rc = 0;
+
+	if (clk_enable)
+		rc = cam_soc_util_clk_enable_default(soc_info, CAM_CLK_SW_CLIENT_IDX, CAM_SVS_VOTE);
+	else
+		cam_soc_util_clk_disable_default(soc_info, CAM_CLK_SW_CLIENT_IDX);
+
+	CAM_DBG(CAM_ICP, "%s IPE clock", clk_enable ? "Enable" : "Disable");
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_IPE_SOC_H
+#define CAM_IPE_SOC_H
+
+#include "cam_soc_util.h"
+
+int cam_ipe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ipe_irq_handler, void *irq_data);
+
+int cam_ipe_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_ipe_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk);
+
+int cam_ipe_get_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_ipe_transfer_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_ipe_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t *clk_rate);
+int cam_ipe_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable);
+void cam_ipe_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+#endif /* CAM_IPE_SOC_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_core.c
@@ -0,0 +1,483 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ofe_core.h"
+#include "ofe_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_ofe_hw_intf.h"
+#include "cam_icp_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "hfi_reg.h"
+#include "cam_common_util.h"
+
+static int cam_ofe_cpas_vote(struct cam_ofe_device_core_info *core_info,
+	struct cam_icp_cpas_vote *cpas_vote)
+{
+	int rc = 0;
+
+	if (cpas_vote->ahb_vote_valid)
+		rc = cam_cpas_update_ahb_vote(core_info->cpas_handle,
+			&cpas_vote->ahb_vote);
+	if (rc)
+		CAM_ERR(CAM_PERF, "CPAS AHB vote failed rc:%d", rc);
+
+	if (cpas_vote->axi_vote_valid)
+		rc = cam_cpas_update_axi_vote(core_info->cpas_handle,
+			&cpas_vote->axi_vote);
+	if (rc)
+		CAM_ERR(CAM_PERF, "CPAS AXI vote failed rc:%d", rc);
+
+	return rc;
+}
+
+int cam_ofe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ofe_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ofe_device_core_info *core_info = NULL;
+	struct cam_icp_cpas_vote cpas_vote;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ofe_dev->soc_info;
+	core_info = (struct cam_ofe_device_core_info *)ofe_dev->core_info;
+
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_OFE_DEFAULT_AXI_PATH;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_OFE_DEFAULT_AXI_TRANSAC;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cpas start failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_ofe_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "soc enable failed rc:%d", rc);
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop failed");
+		else
+			core_info->cpas_start = false;
+	} else {
+		core_info->clk_enable = true;
+	}
+
+	return rc;
+}
+
+int cam_ofe_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ofe_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ofe_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ofe_dev->soc_info;
+	core_info = (struct cam_ofe_device_core_info *)ofe_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	rc = cam_ofe_disable_soc_resources(soc_info, core_info->clk_enable);
+	if (rc)
+		CAM_ERR(CAM_ICP, "soc disable failed: %d", rc);
+	else
+		core_info->clk_enable = false;
+
+	if (core_info->cpas_start) {
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop failed");
+		else
+			core_info->cpas_start = false;
+	}
+
+	return rc;
+}
+
+static int cam_ofe_handle_pc(struct cam_hw_info *ofe_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ofe_device_core_info *core_info = NULL;
+	struct cam_ofe_device_hw_info *hw_info = NULL;
+	int rc = 0, pwr_ctrl, pwr_status;
+
+	soc_info = &ofe_dev->soc_info;
+	core_info = (struct cam_ofe_device_core_info *)ofe_dev->core_info;
+	hw_info = core_info->ofe_hw_info;
+
+	if (!core_info->cpas_start) {
+		CAM_DBG(CAM_ICP, "CPAS OFE client not started");
+		return 0;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+		true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (!(pwr_ctrl & OFE_COLLAPSE_MASK)) {
+		rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_status,
+			true, &pwr_status);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+			return rc;
+		}
+
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP,
+			hw_info->pwr_ctrl, true, 0x1);
+
+		if ((pwr_status >> OFE_PWR_ON_MASK))
+			CAM_WARN(CAM_PERF, "OFE: pwr_status(%x):pwr_ctrl(%x)",
+				pwr_status, pwr_ctrl);
+	}
+
+	rc = cam_ofe_get_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+		true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_status,
+		true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return 0;
+}
+
+static int cam_ofe_handle_resume(struct cam_hw_info *ofe_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ofe_device_core_info *core_info = NULL;
+	struct cam_ofe_device_hw_info *hw_info = NULL;
+	int pwr_ctrl, pwr_status, rc = 0;
+
+	soc_info = &ofe_dev->soc_info;
+	core_info = (struct cam_ofe_device_core_info *)ofe_dev->core_info;
+	hw_info = core_info->ofe_hw_info;
+
+	if (!core_info->cpas_start) {
+		CAM_DBG(CAM_ICP, "CPAS OFE client not started");
+		return 0;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+		true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (pwr_ctrl & OFE_COLLAPSE_MASK) {
+		CAM_DBG(CAM_PERF, "OFE: pwr_ctrl set(%x)", pwr_ctrl);
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REGBASE_CPASTOP,
+			hw_info->pwr_ctrl, true, 0);
+	}
+
+	rc = cam_ofe_transfer_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to transfer gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_ctrl,
+		true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, hw_info->pwr_status,
+		true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return rc;
+}
+
+static int cam_ofe_cmd_reset(struct cam_hw_soc_info *soc_info,
+	struct cam_ofe_device_core_info *core_info)
+{
+	uint32_t retry_cnt = 0, status = 0;
+	int pwr_ctrl, pwr_status, rc = 0;
+	bool reset_ofe_cdm_fail = false, reset_ofe_top_fail = false;
+	struct cam_ofe_device_hw_info *hw_info = NULL;
+
+	CAM_DBG(CAM_ICP, "CAM_ICP_OFE_CMD_RESET");
+
+	if (!core_info->clk_enable || !core_info->cpas_start) {
+		CAM_DBG(CAM_ICP, "OFE not powered on clk_en %d cpas_start %d",
+			core_info->clk_enable, core_info->cpas_start);
+		return 0;
+	}
+
+	hw_info = core_info->ofe_hw_info;
+
+	/* Reset OFE CDM core*/
+	cam_io_w_mb(hw_info->cdm_rst_val,
+		soc_info->reg_map[0].mem_base + hw_info->cdm_rst_cmd);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		cam_common_read_poll_timeout((soc_info->reg_map[0].mem_base +
+			hw_info->cdm_irq_status),
+			PC_POLL_DELAY_US, PC_POLL_TIMEOUT_US,
+			OFE_RST_DONE_IRQ_STATUS_BIT, OFE_RST_DONE_IRQ_STATUS_BIT,
+			&status);
+
+		CAM_DBG(CAM_ICP, "ofe_cdm_irq_status = %u", status);
+
+		if ((status & OFE_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+
+	if (retry_cnt == HFI_MAX_POLL_TRY) {
+		CAM_ERR(CAM_ICP, "OFE CDM rst failed status 0x%x", status);
+		reset_ofe_cdm_fail = true;
+	}
+
+	/* Reset OFE core*/
+	status = 0;
+	retry_cnt = 0;
+	cam_io_w_mb(hw_info->top_rst_val,
+		soc_info->reg_map[0].mem_base + hw_info->top_rst_cmd);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		cam_common_read_poll_timeout((soc_info->reg_map[0].mem_base +
+			hw_info->top_irq_status),
+			PC_POLL_DELAY_US, PC_POLL_TIMEOUT_US,
+			OFE_RST_DONE_IRQ_STATUS_BIT, OFE_RST_DONE_IRQ_STATUS_BIT,
+			&status);
+
+		CAM_DBG(CAM_ICP, "ofe_top_irq_status = %u", status);
+
+		if ((status & OFE_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+
+	if (retry_cnt == HFI_MAX_POLL_TRY) {
+		CAM_ERR(CAM_ICP, "OFE top rst failed status 0x%x", status);
+		reset_ofe_top_fail = true;
+	}
+
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, core_info->ofe_hw_info->pwr_ctrl,
+		true, &pwr_ctrl);
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REGBASE_CPASTOP, core_info->ofe_hw_info->pwr_status,
+		true, &pwr_status);
+	CAM_DBG(CAM_ICP, "(After) pwr_ctrl = %x pwr_status = %x",
+		pwr_ctrl, pwr_status);
+
+	if (reset_ofe_cdm_fail || reset_ofe_top_fail)
+		rc = -EAGAIN;
+	else
+		CAM_DBG(CAM_ICP, "OFE cdm and OFE top reset success");
+
+	return rc;
+}
+
+int cam_ofe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ofe_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ofe_device_core_info *core_info = NULL;
+	struct cam_ofe_device_hw_info *hw_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_ICP_DEV_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &ofe_dev->soc_info;
+	core_info = (struct cam_ofe_device_core_info *)ofe_dev->core_info;
+	hw_info = core_info->ofe_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ICP_DEV_CMD_VOTE_CPAS: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		cam_ofe_cpas_vote(core_info, cpas_vote);
+		break;
+	}
+
+	case CAM_ICP_DEV_CMD_CPAS_START: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		if (!core_info->cpas_start) {
+			rc = cam_cpas_start(core_info->cpas_handle,
+				&cpas_vote->ahb_vote,
+				&cpas_vote->axi_vote);
+			core_info->cpas_start = true;
+		}
+		break;
+	}
+
+	case CAM_ICP_DEV_CMD_CPAS_STOP:
+		if (core_info->cpas_start) {
+			cam_cpas_stop(core_info->cpas_handle);
+			core_info->cpas_start = false;
+		}
+		break;
+	case CAM_ICP_DEV_CMD_POWER_COLLAPSE:
+		rc = cam_ofe_handle_pc(ofe_dev);
+		break;
+	case CAM_ICP_DEV_CMD_POWER_RESUME:
+		rc = cam_ofe_handle_resume(ofe_dev);
+		break;
+	case CAM_ICP_DEV_CMD_UPDATE_CLK: {
+		struct cam_icp_dev_clk_update_cmd *clk_upd_cmd = cmd_args;
+		struct cam_ahb_vote ahb_vote;
+		uint32_t clk_rate = clk_upd_cmd->curr_clk_rate;
+		int32_t clk_level = 0, err = 0;
+
+		CAM_DBG(CAM_PERF, "ofe_src_clk rate = %d", (int)clk_rate);
+
+		if (!core_info->clk_enable) {
+			if (clk_upd_cmd->dev_pc_enable) {
+				cam_ofe_handle_pc(ofe_dev);
+				cam_cpas_reg_write(core_info->cpas_handle,
+					CAM_CPAS_REGBASE_CPASTOP,
+					hw_info->pwr_ctrl, true, 0x0);
+			}
+			rc = cam_ofe_toggle_clk(soc_info, true);
+			if (rc)
+				CAM_ERR(CAM_ICP, "Enable failed");
+			else
+				core_info->clk_enable = true;
+			if (clk_upd_cmd->dev_pc_enable) {
+				rc = cam_ofe_handle_resume(ofe_dev);
+				if (rc)
+					CAM_ERR(CAM_ICP, "OFE resume failed");
+			}
+		}
+		CAM_DBG(CAM_PERF, "clock rate %d", clk_rate);
+		rc = cam_ofe_update_clk_rate(soc_info, clk_rate);
+		if (rc)
+			CAM_ERR(CAM_PERF, "Failed to update clk %d", clk_rate);
+
+		err = cam_soc_util_get_clk_level(soc_info,
+			clk_rate, soc_info->src_clk_idx,
+			&clk_level);
+
+		if (!err) {
+			clk_upd_cmd->clk_level = clk_level;
+			ahb_vote.type = CAM_VOTE_ABSOLUTE;
+			ahb_vote.vote.level = clk_level;
+			cam_cpas_update_ahb_vote(
+				core_info->cpas_handle,
+				&ahb_vote);
+		}
+		break;
+	}
+	case CAM_ICP_DEV_CMD_DISABLE_CLK:
+		if (core_info->clk_enable)
+			cam_ofe_toggle_clk(soc_info, false);
+		core_info->clk_enable = false;
+		break;
+	case CAM_ICP_DEV_CMD_RESET:
+		rc = cam_ofe_cmd_reset(soc_info, core_info);
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid Cmd Type:%u", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+irqreturn_t cam_ofe_irq(int irq_num, void *data)
+{
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_core.h
@@ -0,0 +1,61 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_OFE_CORE_H
+#define CAM_OFE_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+/* OFE CDM/TOP status register */
+#define OFE_RST_DONE_IRQ_STATUS_BIT  0x1
+
+#define OFE_COLLAPSE_MASK 0x1
+#define OFE_PWR_ON_MASK   0x2
+
+struct cam_ofe_device_hw_info {
+	uint32_t hw_idx;
+	uint32_t pwr_ctrl;
+	uint32_t pwr_status;
+
+	uint32_t top_rst_cmd;
+	uint32_t top_irq_status;
+	uint32_t top_rst_val;
+	uint32_t cdm_rst_cmd;
+	uint32_t cdm_irq_status;
+
+	uint32_t cdm_rst_val;
+};
+
+struct cam_ofe_device_core_info {
+	struct cam_ofe_device_hw_info *ofe_hw_info;
+	uint32_t cpas_handle;
+	bool cpas_start;
+	bool clk_enable;
+};
+
+int cam_ofe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ofe_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ofe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+irqreturn_t cam_ofe_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register OFE hw to platform framework.
+ * @return struct platform_device pointer on success, or ERR_PTR() on error.
+ */
+int cam_ofe_init_module(void);
+
+/**
+ * @brief : API to remove OFE Hw from platform framework.
+ */
+void cam_ofe_exit_module(void);
+#endif /* CAM_OFE_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_dev.c
@@ -0,0 +1,257 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+#include "ofe_core.h"
+#include "ofe_soc.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_icp_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_ofe_device_hw_info cam_ofe_hw_info = {
+	.hw_idx         = 0x0,
+	.pwr_ctrl       = 0x100,
+	.pwr_status     = 0xFC,
+	.top_rst_cmd    = 0x5B4,
+	.top_irq_status = 0x5C4,
+	.top_rst_val    = 0x3,
+	.cdm_rst_cmd    = 0x10,
+	.cdm_irq_status = 0x44,
+	.cdm_rst_val    = 0x7F,
+};
+
+static bool cam_ofe_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool error_handled = false;
+
+	if (!irq_data)
+		return error_handled;
+
+	switch (irq_data->irq_type) {
+	case CAM_CAMNOC_IRQ_OFE_WR_UBWC_ENCODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"OFE Write UBWC Decode error type=%d status=%x thr_err=%d, fcl_err=%d, len_md_err=%d, format_err=%d",
+			irq_data->irq_type,
+			irq_data->u.dec_err.decerr_status.value,
+			irq_data->u.dec_err.decerr_status.thr_err,
+			irq_data->u.dec_err.decerr_status.fcl_err,
+			irq_data->u.dec_err.decerr_status.len_md_err,
+			irq_data->u.dec_err.decerr_status.format_err);
+		error_handled = true;
+		break;
+	case CAM_CAMNOC_IRQ_OFE_RD_UBWC_DECODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"OFE Read UBWC Decode error type=%d status=%x thr_err=%d, fcl_err=%d, len_md_err=%d, format_err=%d",
+			irq_data->irq_type,
+			irq_data->u.dec_err.decerr_status.value,
+			irq_data->u.dec_err.decerr_status.thr_err,
+			irq_data->u.dec_err.decerr_status.fcl_err,
+			irq_data->u.dec_err.decerr_status.len_md_err,
+			irq_data->u.dec_err.decerr_status.format_err);
+		error_handled = true;
+		break;
+	default:
+		break;
+	}
+
+	return error_handled;
+}
+
+int cam_ofe_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_ofe_device_core_info *core_info, uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "ofe", sizeof("ofe"));
+	cpas_register_params.cam_cpas_client_cb = cam_ofe_cpas_cb;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_ofe_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info                *ofe_dev      = NULL;
+	struct cam_hw_intf                *ofe_dev_intf = NULL;
+	const struct of_device_id         *match_dev    = NULL;
+	struct cam_ofe_device_core_info   *core_info    = NULL;
+	struct cam_ofe_device_hw_info     *hw_info      = NULL;
+	int                                rc           = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	ofe_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!ofe_dev_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &ofe_dev_intf->hw_idx);
+
+	ofe_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!ofe_dev) {
+		rc = -ENOMEM;
+		goto free_dev_intf;
+	}
+
+	ofe_dev->soc_info.pdev = pdev;
+	ofe_dev->soc_info.dev = &pdev->dev;
+	ofe_dev->soc_info.dev_name = pdev->name;
+	ofe_dev_intf->hw_priv = ofe_dev;
+	ofe_dev_intf->hw_ops.init = cam_ofe_init_hw;
+	ofe_dev_intf->hw_ops.deinit = cam_ofe_deinit_hw;
+	ofe_dev_intf->hw_ops.process_cmd = cam_ofe_process_cmd;
+	ofe_dev_intf->hw_type = CAM_ICP_DEV_OFE;
+	platform_set_drvdata(pdev, ofe_dev_intf);
+	ofe_dev->core_info = kzalloc(sizeof(struct cam_ofe_device_core_info), GFP_KERNEL);
+	if (!ofe_dev->core_info) {
+		rc = -ENOMEM;
+		goto free_dev;
+	}
+	core_info = (struct cam_ofe_device_core_info *)ofe_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table, &pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ICP, "No ofe hardware info");
+		goto free_core_info;
+	}
+
+	hw_info = (struct cam_ofe_device_hw_info *)match_dev->data;
+	core_info->ofe_hw_info = hw_info;
+
+	rc = cam_ofe_init_soc_resources(&ofe_dev->soc_info, cam_ofe_irq, ofe_dev);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to init_soc");
+		goto free_core_info;
+	}
+	CAM_DBG(CAM_ICP, "soc info : %pK", (void *)&ofe_dev->soc_info);
+
+	rc = cam_ofe_register_cpas(&ofe_dev->soc_info,
+			core_info, ofe_dev_intf->hw_idx);
+	if (rc)
+		goto free_soc_resources;
+
+	ofe_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&ofe_dev->hw_mutex);
+	spin_lock_init(&ofe_dev->hw_lock);
+	init_completion(&ofe_dev->hw_complete);
+	CAM_DBG(CAM_ICP, "OFE:%d component bound successfully",
+		ofe_dev_intf->hw_idx);
+
+	return rc;
+
+free_soc_resources:
+	cam_ofe_deinit_soc_resources(&ofe_dev->soc_info);
+free_core_info:
+	kfree(ofe_dev->core_info);
+free_dev:
+	kfree(ofe_dev);
+free_dev_intf:
+	kfree(ofe_dev_intf);
+
+	return rc;
+}
+
+static void cam_ofe_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info            *ofe_dev = NULL;
+	struct cam_hw_intf            *ofe_dev_intf = NULL;
+	struct cam_ofe_device_core_info   *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ICP, "Unbinding component: %s", pdev->name);
+	ofe_dev_intf = platform_get_drvdata(pdev);
+
+	if (!ofe_dev_intf) {
+		CAM_ERR(CAM_ICP, "Error No data in pdev");
+		return;
+	}
+
+	ofe_dev = ofe_dev_intf->hw_priv;
+	core_info = (struct cam_ofe_device_core_info *)ofe_dev->core_info;
+	cam_cpas_unregister_client(core_info->cpas_handle);
+	cam_ofe_deinit_soc_resources(&ofe_dev->soc_info);
+
+	kfree(ofe_dev->core_info);
+	kfree(ofe_dev);
+	kfree(ofe_dev_intf);
+}
+
+static const struct component_ops cam_ofe_component_ops = {
+	.bind = cam_ofe_component_bind,
+	.unbind = cam_ofe_component_unbind,
+};
+
+int cam_ofe_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "Adding OFE component");
+	rc = component_add(&pdev->dev, &cam_ofe_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_ofe_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ofe_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_ofe_dt_match[] = {
+	{
+		.compatible = "qcom,cam-ofe",
+		.data = &cam_ofe_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_ofe_dt_match);
+
+struct platform_driver cam_ofe_driver = {
+	.probe = cam_ofe_probe,
+	.remove = cam_ofe_remove,
+	.driver = {
+		.name = "cam-ofe",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ofe_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ofe_init_module(void)
+{
+	return platform_driver_register(&cam_ofe_driver);
+}
+
+void cam_ofe_exit_module(void)
+{
+	platform_driver_unregister(&cam_ofe_driver);
+}
+
+MODULE_DESCRIPTION("CAM OFE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_soc.c
@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "ofe_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+static int cam_ofe_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ICP, "get ofe dt prop is failed");
+
+	return rc;
+}
+
+static int cam_ofe_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t ofe_irq_handler, void *data)
+{
+	int rc = 0, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info,
+		ofe_irq_handler, &(irq_data[0]));
+
+	return rc;
+}
+
+int cam_ofe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ofe_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_ofe_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_ofe_request_platform_resource(soc_info,
+		ofe_irq_handler, irq_data);
+	if (rc < 0)
+		return rc;
+
+	return rc;
+}
+
+void cam_ofe_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_WARN(CAM_ICP, "release platform resources fail");
+}
+
+int cam_ofe_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX,
+		true, CAM_SVS_VOTE, false);
+	if (rc)
+		CAM_ERR(CAM_ICP, "enable platform failed");
+
+	return rc;
+}
+
+int cam_ofe_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX,
+		disable_clk, false);
+	if (rc)
+		CAM_ERR(CAM_ICP, "disable platform failed");
+
+	return rc;
+}
+
+static inline int cam_ofe_set_regulators_mode(struct cam_hw_soc_info *soc_info, uint32_t mode)
+{
+	int i, rc;
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = cam_wrapper_regulator_set_mode(soc_info->rgltr[i], mode);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Regulator set mode %s failed",
+				soc_info->rgltr_name[i]);
+			goto rgltr_set_mode_failed;
+		}
+	}
+	return 0;
+
+rgltr_set_mode_failed:
+	for (i = i - 1; i >= 0; i--) {
+		if (soc_info->rgltr[i])
+			cam_wrapper_regulator_set_mode(soc_info->rgltr[i],
+				(mode == REGULATOR_MODE_NORMAL ?
+				REGULATOR_MODE_FAST : REGULATOR_MODE_NORMAL));
+	}
+
+	return rc;
+}
+
+int cam_ofe_transfer_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	return cam_ofe_set_regulators_mode(soc_info, REGULATOR_MODE_FAST);
+}
+
+int cam_ofe_get_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	return cam_ofe_set_regulators_mode(soc_info, REGULATOR_MODE_NORMAL);
+}
+
+int cam_ofe_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate)
+{
+	int32_t src_clk_idx;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE] == true) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_PERF, "clk_rate %d greater than max, reset to %d",
+			clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	return cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX, clk_rate, 0);
+}
+
+int cam_ofe_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable)
+{
+	int rc = 0;
+
+	if (clk_enable)
+		rc = cam_soc_util_clk_enable_default(soc_info, CAM_CLK_SW_CLIENT_IDX, CAM_SVS_VOTE);
+	else
+		cam_soc_util_clk_disable_default(soc_info, CAM_CLK_SW_CLIENT_IDX);
+
+	CAM_DBG(CAM_ICP, "%s OFE clock", clk_enable ? "Enable" : "Disable");
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_icp/icp_hw/ofe_hw/ofe_soc.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_OFE_SOC_H_
+#define _CAM_OFE_SOC_H_
+
+#include "cam_soc_util.h"
+
+int cam_ofe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ofe_irq_handler, void *irq_data);
+
+int cam_ofe_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_ofe_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk);
+
+int cam_ofe_get_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_ofe_transfer_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_ofe_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate);
+
+int cam_ofe_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable);
+
+void cam_ofe_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+#endif /* _CAM_OFE_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/cam_isp_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/cam_isp_context.c
@@ -0,0 +1,9845 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/ratelimit.h>
+
+#include "cam_mem_mgr.h"
+#include "cam_sync_api.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+#include "cam_context_utils.h"
+#include "cam_cdm_util.h"
+#include "cam_isp_context.h"
+#include "cam_common_util.h"
+#include "cam_req_mgr_debug.h"
+#include "cam_cpas_api.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_subdev.h"
+
+static const char isp_dev_name[] = "cam-isp";
+
+static struct cam_isp_ctx_debug isp_ctx_debug;
+
+#define INC_HEAD(head, max_entries, ret) \
+	div_u64_rem(atomic64_add_return(1, head),\
+	max_entries, (ret))
+
+static int cam_isp_context_dump_requests(void *data,
+	void *pf_args);
+
+static int cam_isp_context_hw_recovery(void *priv, void *data);
+static int cam_isp_context_handle_message(void *context,
+	uint32_t msg_type, void *data);
+
+static int __cam_isp_ctx_start_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd);
+
+static void __cam_isp_ctx_dump_state_monitor_array(
+	struct cam_isp_context *ctx_isp);
+
+static const char *__cam_isp_hw_evt_val_to_type(
+	uint32_t evt_id);
+
+static const char *__cam_isp_ctx_substate_val_to_type(
+	enum cam_isp_ctx_activated_substate type);
+
+static int __cam_isp_ctx_check_deferred_buf_done(
+	struct cam_isp_context *ctx_isp,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state);
+
+static const char *__cam_isp_evt_val_to_type(
+	uint32_t evt_id)
+{
+	switch (evt_id) {
+	case CAM_ISP_CTX_EVENT_SUBMIT:
+		return "SUBMIT";
+	case CAM_ISP_CTX_EVENT_APPLY:
+		return "APPLY";
+	case CAM_ISP_CTX_EVENT_EPOCH:
+		return "EPOCH";
+	case CAM_ISP_CTX_EVENT_RUP:
+		return "RUP";
+	case CAM_ISP_CTX_EVENT_BUFDONE:
+		return "BUFDONE";
+	case CAM_ISP_CTX_EVENT_SHUTTER:
+		return "SHUTTER_NOTIFICATION";
+	default:
+		return "CAM_ISP_EVENT_INVALID";
+	}
+}
+
+static inline void __cam_isp_ctx_move_req_to_free_list(
+	struct cam_context *ctx, struct cam_ctx_request *req)
+{
+	struct cam_isp_ctx_req *req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	struct cam_kmd_buf_info *kmd_cmd_buff_info = &(req_isp->hw_update_data.kmd_cmd_buff_info);
+
+	CAM_DBG(CAM_ISP,
+		"Free req id: %lld, ctx_idx: %u, link: 0x%x",
+		req->request_id, ctx->ctx_id, ctx->link_hdl);
+	cam_mem_put_kref(kmd_cmd_buff_info->handle);
+
+	list_add_tail(&req->list, &ctx->free_req_list);
+}
+
+
+static void __cam_isp_ctx_update_event_record(
+	struct cam_isp_context *ctx_isp,
+	enum cam_isp_ctx_event  event,
+	struct cam_ctx_request *req,
+	void *event_data)
+{
+	int                      iterator = 0;
+	ktime_t                  cur_time;
+	struct cam_isp_ctx_req  *req_isp;
+
+	if (!ctx_isp) {
+		CAM_ERR(CAM_ISP, "Invalid Args");
+		return;
+	}
+	switch (event) {
+	case CAM_ISP_CTX_EVENT_EPOCH:
+	case CAM_ISP_CTX_EVENT_RUP:
+	case CAM_ISP_CTX_EVENT_BUFDONE:
+	case CAM_ISP_CTX_EVENT_SHUTTER:
+		break;
+	case CAM_ISP_CTX_EVENT_SUBMIT:
+	case CAM_ISP_CTX_EVENT_APPLY:
+		if (!req) {
+			CAM_ERR(CAM_ISP, "Invalid arg for event %d", event);
+			return;
+		}
+		break;
+	default:
+		break;
+	}
+
+	INC_HEAD(&ctx_isp->dbg_monitors.event_record_head[event],
+		CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES, &iterator);
+	cur_time = ktime_get();
+	if (req) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		ctx_isp->dbg_monitors.event_record[event][iterator].req_id =
+			req->request_id;
+		req_isp->event_timestamp[event] = cur_time;
+	} else {
+		ctx_isp->dbg_monitors.event_record[event][iterator].req_id = 0;
+	}
+	ctx_isp->dbg_monitors.event_record[event][iterator].timestamp  = cur_time;
+
+	if (event_data == NULL)
+		return;
+	/* Update event specific data */
+	ctx_isp->dbg_monitors.event_record[event][iterator].event_type = event;
+	if (event == CAM_ISP_CTX_EVENT_SHUTTER) {
+		ctx_isp->dbg_monitors.event_record[event][iterator].req_id =
+			((struct shutter_event *)event_data)->req_id;
+		ctx_isp->dbg_monitors.event_record[event][iterator].event.shutter_event.req_id =
+			((struct shutter_event *)event_data)->req_id;
+		ctx_isp->dbg_monitors.event_record[event][iterator].event.shutter_event.status =
+			((struct shutter_event *)event_data)->status;
+		ctx_isp->dbg_monitors.event_record[event][iterator].event.shutter_event.frame_id =
+			((struct shutter_event *)event_data)->frame_id;
+		ctx_isp->dbg_monitors.event_record[event][iterator].event.shutter_event.boot_ts =
+			((struct shutter_event *)event_data)->boot_ts;
+		ctx_isp->dbg_monitors.event_record[event][iterator].event.shutter_event.sof_ts =
+			((struct shutter_event *)event_data)->sof_ts;
+	}
+}
+
+static int __cam_isp_ctx_handle_sof_freeze_evt(
+	struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_isp_context      *ctx_isp;
+	struct cam_hw_cmd_args       hw_cmd_args;
+	struct cam_isp_hw_cmd_args   isp_hw_cmd_args;
+
+	ctx_isp = (struct cam_isp_context *)ctx->ctx_priv;
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_SOF_DEBUG;
+	isp_hw_cmd_args.u.sof_irq_enable = 1;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+
+	ctx_isp->sof_dbg_irq_en = true;
+	return rc;
+}
+
+static void *cam_isp_ctx_user_dump_events(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	uint64_t                             *addr;
+	struct cam_isp_context_event_record  *record;
+	struct timespec64                     ts;
+
+	record = (struct cam_isp_context_event_record *)dump_struct;
+
+	addr = (uint64_t *)addr_ptr;
+	ts = ktime_to_timespec64(record->timestamp);
+	*addr++ = record->req_id;
+	*addr++ = ts.tv_sec;
+	*addr++ = ts.tv_nsec / NSEC_PER_USEC;
+
+	return addr;
+}
+
+static int __cam_isp_ctx_print_event_record(struct cam_isp_context *ctx_isp)
+{
+	int                                  i, j, rc = 0;
+	int                                  index;
+	uint32_t                             oldest_entry, num_entries;
+	uint64_t                             state_head;
+	struct cam_isp_context_event_record *record;
+	uint32_t                             len;
+	uint8_t                              buf[CAM_ISP_CONTEXT_DBG_BUF_LEN];
+	struct timespec64                    ts;
+	struct cam_context                  *ctx = ctx_isp->base;
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++) {
+		state_head = atomic64_read(&ctx_isp->dbg_monitors.event_record_head[i]);
+
+		if (state_head == -1) {
+			return 0;
+		} else if (state_head < CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES) {
+			num_entries = state_head + 1;
+			oldest_entry = 0;
+		} else {
+			num_entries = CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES;
+			div_u64_rem(state_head + 1,
+				CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES,
+				&oldest_entry);
+		}
+
+		index = oldest_entry;
+		len = 0;
+		memset(buf, 0, CAM_ISP_CONTEXT_DBG_BUF_LEN);
+		for (j = 0; j < num_entries; j++) {
+			record = &ctx_isp->dbg_monitors.event_record[i][index];
+			ts = ktime_to_timespec64(record->timestamp);
+			if (len >= CAM_ISP_CONTEXT_DBG_BUF_LEN) {
+				CAM_WARN(CAM_ISP, "Overshooting buffer length %llu", len);
+				break;
+			}
+			if (record->event_type != CAM_ISP_CTX_EVENT_SHUTTER)
+				len += scnprintf(buf + len, CAM_ISP_CONTEXT_DBG_BUF_LEN - len,
+					"%llu[%lld:%06lld] ", record->req_id, ts.tv_sec,
+					ts.tv_nsec / NSEC_PER_USEC);
+			else
+				/*
+				 * Output format
+				 * req Id[timestamp] status frmId softs bootts
+				 */
+				len += scnprintf(buf + len, (CAM_ISP_CONTEXT_DBG_BUF_LEN) - len,
+					"%llu[%lld:%06lld] [%d %lld %llu %llu] | ",
+					record->req_id, ts.tv_sec,
+					ts.tv_nsec / NSEC_PER_USEC,
+					record->event.shutter_event.status,
+					record->event.shutter_event.frame_id,
+					record->event.shutter_event.sof_ts,
+					record->event.shutter_event.boot_ts);
+			index = (index + 1) %
+				CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES;
+		}
+		if (len)
+			CAM_INFO(CAM_ISP, "Ctx:%d %s: %s",
+		ctx->ctx_id, __cam_isp_evt_val_to_type(i), buf);
+	}
+	return rc;
+}
+
+static int __cam_isp_ctx_dump_event_record(
+	struct cam_isp_context *ctx_isp,
+	struct cam_common_hw_dump_args *dump_args)
+{
+	int                                  i, j, rc = 0;
+	int                                  index;
+	size_t                               remain_len;
+	uint32_t                             oldest_entry, num_entries;
+	uint32_t                             min_len;
+	uint64_t                             state_head;
+	struct cam_isp_context_event_record *record;
+
+	if (!dump_args || !ctx_isp) {
+		CAM_ERR(CAM_ISP, "Invalid args %pK %pK",
+			dump_args, ctx_isp);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++) {
+		state_head = atomic64_read(&ctx_isp->dbg_monitors.event_record_head[i]);
+
+		if (state_head == -1)
+			return 0;
+		else if (state_head < CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES) {
+			num_entries = state_head + 1;
+			oldest_entry = 0;
+		} else {
+			num_entries = CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES;
+			div_u64_rem(state_head + 1, CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES,
+				&oldest_entry);
+		}
+
+		index = oldest_entry;
+
+		if (dump_args->buf_len <= dump_args->offset) {
+			CAM_WARN(CAM_ISP, "Dump buffer overshoot len %zu offset %zu",
+				dump_args->buf_len, dump_args->offset);
+			return -ENOSPC;
+		}
+
+		min_len = (sizeof(struct cam_isp_context_dump_header) +
+			(CAM_ISP_CTX_DUMP_EVENT_NUM_WORDS * sizeof(uint64_t))) * num_entries;
+		remain_len = dump_args->buf_len - dump_args->offset;
+
+		if (remain_len < min_len) {
+			CAM_WARN(CAM_ISP,
+				"Dump buffer exhaust remain %zu min %u",
+				remain_len, min_len);
+			return -ENOSPC;
+		}
+		for (j = 0; j < num_entries; j++) {
+			record = &ctx_isp->dbg_monitors.event_record[i][index];
+
+			rc = cam_common_user_dump_helper(dump_args, cam_isp_ctx_user_dump_events,
+				record, sizeof(uint64_t), "ISP_EVT_%s:",
+				__cam_isp_evt_val_to_type(i));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"CAM_ISP_CONTEXT DUMP_EVENT_RECORD: Dump failed, rc: %d",
+					rc);
+				return rc;
+			}
+
+			index = (index + 1) % CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES;
+		}
+	}
+	return rc;
+}
+
+static void __cam_isp_ctx_req_mini_dump(struct cam_ctx_request *req,
+	uint8_t *start_addr, uint8_t *end_addr,
+	unsigned long *bytes_updated)
+{
+	struct cam_isp_ctx_req_mini_dump *req_md;
+	struct cam_buf_io_cfg            *io_cfg;
+	struct cam_isp_ctx_req           *req_isp;
+	struct cam_packet                *packet = NULL;
+	unsigned long                     bytes_required = 0;
+
+	bytes_required = sizeof(*req_md);
+	*bytes_updated = 0;
+	if (start_addr + bytes_required > end_addr)
+		return;
+
+	req_md = (struct cam_isp_ctx_req_mini_dump *)start_addr;
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	req_md->num_acked = req_isp->num_acked;
+	req_md->num_deferred_acks = req_isp->num_deferred_acks;
+	req_md->bubble_report = req_isp->bubble_report;
+	req_md->bubble_detected = req_isp->bubble_detected;
+	req_md->reapply_type = req_isp->reapply_type;
+	req_md->request_id = req->request_id;
+	*bytes_updated += bytes_required;
+
+	if (req_isp->num_fence_map_out) {
+		bytes_required = sizeof(struct cam_hw_fence_map_entry) *
+			req_isp->num_fence_map_out;
+		if (start_addr + *bytes_updated + bytes_required > end_addr)
+			return;
+
+		req_md->map_out = (struct cam_hw_fence_map_entry *)
+				((uint8_t *)start_addr + *bytes_updated);
+		memcpy(req_md->map_out, req_isp->fence_map_out, bytes_required);
+		req_md->num_fence_map_out = req_isp->num_fence_map_out;
+		*bytes_updated += bytes_required;
+	}
+
+	if (req_isp->num_fence_map_in) {
+		bytes_required = sizeof(struct cam_hw_fence_map_entry) *
+			req_isp->num_fence_map_in;
+		if (start_addr + *bytes_updated + bytes_required > end_addr)
+			return;
+
+		req_md->map_in = (struct cam_hw_fence_map_entry *)
+			((uint8_t *)start_addr + *bytes_updated);
+		memcpy(req_md->map_in, req_isp->fence_map_in, bytes_required);
+		req_md->num_fence_map_in = req_isp->num_fence_map_in;
+		*bytes_updated += bytes_required;
+	}
+
+	packet = req_isp->hw_update_data.packet;
+	if (packet && packet->num_io_configs) {
+		bytes_required = packet->num_io_configs * sizeof(struct cam_buf_io_cfg);
+		if (start_addr + *bytes_updated + bytes_required > end_addr)
+			return;
+
+		io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload_flex +
+			    packet->io_configs_offset / 4);
+		req_md->io_cfg = (struct cam_buf_io_cfg *)((uint8_t *)start_addr + *bytes_updated);
+		memcpy(req_md->io_cfg, io_cfg, bytes_required);
+		*bytes_updated += bytes_required;
+		req_md->num_io_cfg = packet->num_io_configs;
+	}
+}
+
+static int __cam_isp_ctx_minidump_cb(void *priv, void *args)
+{
+	struct cam_isp_ctx_mini_dump_info *md;
+	struct cam_isp_context            *ctx_isp;
+	struct cam_context                *ctx;
+	struct cam_ctx_request            *req, *req_temp;
+	struct cam_hw_mini_dump_args      *dump_args;
+	uint8_t                           *start_addr;
+	uint8_t                           *end_addr;
+	unsigned long                      total_bytes = 0;
+	unsigned long                      bytes_updated = 0;
+	uint32_t                           i;
+
+	if (!priv || !args) {
+		CAM_ERR(CAM_ISP, "invalid params");
+		return 0;
+	}
+
+	dump_args = (struct cam_hw_mini_dump_args *)args;
+	if (dump_args->len < sizeof(*md)) {
+		CAM_ERR(CAM_ISP,
+			"In sufficient size received %lu required size: %zu",
+			dump_args->len, sizeof(*md));
+		return 0;
+	}
+
+	ctx = (struct cam_context *)priv;
+	ctx_isp = (struct cam_isp_context *)ctx->ctx_priv;
+	start_addr = (uint8_t *)dump_args->start_addr;
+	end_addr = start_addr + dump_args->len;
+	md = (struct cam_isp_ctx_mini_dump_info *)dump_args->start_addr;
+
+	md->sof_timestamp_val = ctx_isp->sof_timestamp_val;
+	md->boot_timestamp = ctx_isp->boot_timestamp;
+	md->last_sof_timestamp = ctx_isp->last_sof_timestamp;
+	md->init_timestamp = ctx_isp->init_timestamp;
+	md->frame_id = ctx_isp->frame_id;
+	md->reported_req_id = ctx_isp->reported_req_id;
+	md->last_applied_req_id = ctx_isp->last_applied_req_id;
+	md->last_bufdone_err_apply_req_id =
+		ctx_isp->last_bufdone_err_apply_req_id;
+	md->frame_id_meta = ctx_isp->frame_id_meta;
+	md->substate_activated = ctx_isp->substate_activated;
+	md->ctx_id = ctx->ctx_id;
+	md->subscribe_event = ctx_isp->subscribe_event;
+	md->bubble_frame_cnt = ctx_isp->bubble_frame_cnt;
+	md->isp_device_type = ctx_isp->isp_device_type;
+	md->active_req_cnt = ctx_isp->active_req_cnt;
+	md->trigger_id = ctx_isp->trigger_id;
+	md->rdi_only_context = ctx_isp->rdi_only_context;
+	md->offline_context = ctx_isp->offline_context;
+	md->hw_acquired = ctx_isp->hw_acquired;
+	md->init_received = ctx_isp->init_received;
+	md->split_acquire = ctx_isp->split_acquire;
+	md->use_frame_header_ts = ctx_isp->use_frame_header_ts;
+	md->support_consumed_addr = ctx_isp->support_consumed_addr;
+	md->use_default_apply = ctx_isp->use_default_apply;
+	md->apply_in_progress = atomic_read(&ctx_isp->apply_in_progress);
+	md->process_bubble = atomic_read(&ctx_isp->process_bubble);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++) {
+		memcpy(md->event_record[i], ctx_isp->dbg_monitors.event_record[i],
+			sizeof(struct cam_isp_context_event_record) *
+			CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES);
+	}
+
+	total_bytes += sizeof(*md);
+	if (start_addr + total_bytes >= end_addr)
+		goto end;
+
+	if (!list_empty(&ctx->active_req_list)) {
+		md->active_list = (struct cam_isp_ctx_req_mini_dump *)
+			    (start_addr + total_bytes);
+		list_for_each_entry_safe(req, req_temp, &ctx->active_req_list, list) {
+			bytes_updated = 0;
+			 __cam_isp_ctx_req_mini_dump(req,
+				(uint8_t *)&md->active_list[md->active_cnt++],
+				end_addr, &bytes_updated);
+			total_bytes +=  bytes_updated;
+			if ((start_addr + total_bytes >= end_addr))
+				goto end;
+		}
+	}
+
+	if (!list_empty(&ctx->wait_req_list)) {
+		md->wait_list = (struct cam_isp_ctx_req_mini_dump *)
+			(start_addr + total_bytes);
+		list_for_each_entry_safe(req, req_temp, &ctx->wait_req_list, list) {
+			bytes_updated = 0;
+			__cam_isp_ctx_req_mini_dump(req,
+				(uint8_t *)&md->wait_list[md->wait_cnt++],
+				end_addr, &bytes_updated);
+			total_bytes +=  bytes_updated;
+			if ((start_addr + total_bytes >= end_addr))
+				goto end;
+		}
+	}
+
+	if (!list_empty(&ctx->pending_req_list)) {
+		md->pending_list = (struct cam_isp_ctx_req_mini_dump *)
+			(start_addr + total_bytes);
+		list_for_each_entry_safe(req, req_temp, &ctx->pending_req_list, list) {
+			bytes_updated = 0;
+			__cam_isp_ctx_req_mini_dump(req,
+				(uint8_t *)&md->pending_list[md->pending_cnt++],
+				end_addr, &bytes_updated);
+			total_bytes +=  bytes_updated;
+			if ((start_addr + total_bytes >= end_addr))
+				goto end;
+		}
+	}
+end:
+	dump_args->bytes_written = total_bytes;
+	return 0;
+}
+
+static void __cam_isp_ctx_update_state_monitor_array(
+	struct cam_isp_context *ctx_isp,
+	enum cam_isp_state_change_trigger trigger_type,
+	uint64_t req_id)
+{
+	int iterator;
+	struct cam_context *ctx = ctx_isp->base;
+
+	INC_HEAD(&ctx_isp->dbg_monitors.state_monitor_head,
+		CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES, &iterator);
+
+	ctx_isp->dbg_monitors.state_monitor[iterator].curr_state =
+		ctx_isp->substate_activated;
+	ctx_isp->dbg_monitors.state_monitor[iterator].frame_id =
+		ctx_isp->frame_id;
+	ctx_isp->dbg_monitors.state_monitor[iterator].trigger =
+		trigger_type;
+	ctx_isp->dbg_monitors.state_monitor[iterator].req_id =
+		req_id;
+
+	if (trigger_type == CAM_ISP_STATE_CHANGE_TRIGGER_CDM_DONE)
+		ctx_isp->dbg_monitors.state_monitor[iterator].evt_time_stamp =
+			ctx->cdm_done_ts;
+	else
+		ktime_get_clocktai_ts64(
+			&ctx_isp->dbg_monitors.state_monitor[iterator].evt_time_stamp);
+}
+
+static int __cam_isp_ctx_update_frame_timing_record(
+	enum cam_isp_hw_event_type hw_evt, struct cam_isp_context *ctx_isp)
+{
+	uint32_t index = 0;
+
+	/* Update event index on IFE SOF - primary event */
+	if (hw_evt == CAM_ISP_HW_EVENT_SOF)
+		INC_HEAD(&ctx_isp->dbg_monitors.frame_monitor_head,
+			CAM_ISP_CTX_MAX_FRAME_RECORDS, &index);
+	else
+		div_u64_rem(atomic64_read(&ctx_isp->dbg_monitors.frame_monitor_head),
+			CAM_ISP_CTX_MAX_FRAME_RECORDS, &index);
+
+	switch (hw_evt) {
+	case CAM_ISP_HW_EVENT_SOF:
+		CAM_GET_BOOT_TIMESTAMP(ctx_isp->dbg_monitors.frame_monitor[index].sof_ts);
+		break;
+	case CAM_ISP_HW_EVENT_EOF:
+		CAM_GET_BOOT_TIMESTAMP(ctx_isp->dbg_monitors.frame_monitor[index].eof_ts);
+		break;
+	case CAM_ISP_HW_EVENT_EPOCH:
+		CAM_GET_BOOT_TIMESTAMP(ctx_isp->dbg_monitors.frame_monitor[index].epoch_ts);
+		break;
+	case CAM_ISP_HW_SECONDARY_EVENT:
+		CAM_GET_BOOT_TIMESTAMP(ctx_isp->dbg_monitors.frame_monitor[index].secondary_sof_ts);
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static void __cam_isp_ctx_dump_frame_timing_record(
+	struct cam_isp_context *ctx_isp)
+{
+	int i = 0;
+	int64_t state_head = 0;
+	uint32_t index, num_entries, oldest_entry;
+
+	state_head = atomic64_read(&ctx_isp->dbg_monitors.frame_monitor_head);
+
+	if (state_head == -1)
+		return;
+
+	if (state_head < CAM_ISP_CTX_MAX_FRAME_RECORDS) {
+		num_entries = state_head + 1;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_ISP_CTX_MAX_FRAME_RECORDS;
+		div_u64_rem(state_head + 1, CAM_ISP_CTX_MAX_FRAME_RECORDS,
+			&oldest_entry);
+	}
+
+	index = oldest_entry;
+	for (i = 0; i < num_entries; i++) {
+		CAM_INFO(CAM_ISP,
+			"Index: %u SOF_TS: %llu.%llu EPOCH_TS: %llu.%llu EOF_TS: %llu.%llu SEC_SOF: %llu.%llu",
+			index,
+			ctx_isp->dbg_monitors.frame_monitor[index].sof_ts.tv_sec,
+			ctx_isp->dbg_monitors.frame_monitor[index].sof_ts.tv_nsec / NSEC_PER_USEC,
+			ctx_isp->dbg_monitors.frame_monitor[index].epoch_ts.tv_sec,
+			ctx_isp->dbg_monitors.frame_monitor[index].epoch_ts.tv_nsec / NSEC_PER_USEC,
+			ctx_isp->dbg_monitors.frame_monitor[index].eof_ts.tv_sec,
+			ctx_isp->dbg_monitors.frame_monitor[index].eof_ts.tv_nsec / NSEC_PER_USEC,
+			ctx_isp->dbg_monitors.frame_monitor[index].secondary_sof_ts.tv_sec,
+			ctx_isp->dbg_monitors.frame_monitor[index].secondary_sof_ts.tv_nsec /
+			NSEC_PER_USEC);
+
+		index = (index + 1) % CAM_ISP_CTX_MAX_FRAME_RECORDS;
+	}
+}
+
+static const char *__cam_isp_ctx_substate_val_to_type(
+	enum cam_isp_ctx_activated_substate type)
+{
+	switch (type) {
+	case CAM_ISP_CTX_ACTIVATED_SOF:
+		return "SOF";
+	case CAM_ISP_CTX_ACTIVATED_APPLIED:
+		return "APPLIED";
+	case CAM_ISP_CTX_ACTIVATED_EPOCH:
+		return "EPOCH";
+	case CAM_ISP_CTX_ACTIVATED_BUBBLE:
+		return "BUBBLE";
+	case CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED:
+		return "BUBBLE_APPLIED";
+	case CAM_ISP_CTX_ACTIVATED_HW_ERROR:
+		return "HW_ERROR";
+	case CAM_ISP_CTX_ACTIVATED_HALT:
+		return "HALT";
+	default:
+		return "INVALID";
+	}
+}
+
+static const char *__cam_isp_hw_evt_val_to_type(
+	uint32_t evt_id)
+{
+	switch (evt_id) {
+	case CAM_ISP_STATE_CHANGE_TRIGGER_ERROR:
+		return "ERROR";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_APPLIED:
+		return "APPLIED";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_SOF:
+		return "SOF";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE:
+		return "REG_UPDATE";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH:
+		return "EPOCH";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_EOF:
+		return "EOF";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_CDM_DONE:
+		return "CDM_DONE";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_DONE:
+		return "DONE";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_FLUSH:
+		return "FLUSH";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_SEC_EVT_SOF:
+		return "SEC_EVT_SOF";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_SEC_EVT_EPOCH:
+		return "SEC_EVT_EPOCH";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_FRAME_DROP:
+		return "OUT_OF_SYNC_FRAME_DROP";
+	default:
+		return "CAM_ISP_EVENT_INVALID";
+	}
+}
+
+static void __cam_isp_ctx_dump_state_monitor_array(
+	struct cam_isp_context *ctx_isp)
+{
+	int i = 0;
+	int64_t state_head = 0;
+	uint32_t index, num_entries, oldest_entry;
+	struct tm ts;
+
+	state_head = atomic64_read(&ctx_isp->dbg_monitors.state_monitor_head);
+
+	if (state_head == -1)
+		return;
+
+	if (state_head < CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES) {
+		num_entries = state_head + 1;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1, CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES,
+			&oldest_entry);
+	}
+
+	CAM_ERR(CAM_ISP,
+		"Dumping state information for preceding requests");
+
+	index = oldest_entry;
+
+	for (i = 0; i < num_entries; i++) {
+		time64_to_tm(ctx_isp->dbg_monitors.state_monitor[index].evt_time_stamp.tv_sec,
+			0, &ts);
+		CAM_ERR(CAM_ISP,
+			"Idx[%d] time[%d-%d %d:%d:%d.%lld]:Substate[%s] Frame[%lld] Req[%llu] evt[%s]",
+			index, ts.tm_mon + 1, ts.tm_mday, ts.tm_hour, ts.tm_min, ts.tm_sec,
+			ctx_isp->dbg_monitors.state_monitor[index].evt_time_stamp.tv_nsec / 1000000,
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->dbg_monitors.state_monitor[index].curr_state),
+			ctx_isp->dbg_monitors.state_monitor[index].frame_id,
+			ctx_isp->dbg_monitors.state_monitor[index].req_id,
+			__cam_isp_hw_evt_val_to_type(
+				ctx_isp->dbg_monitors.state_monitor[index].trigger));
+
+		index = (index + 1) % CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES;
+	}
+}
+
+static void *cam_isp_ctx_user_dump_state_monitor_array_info(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_isp_context_state_monitor  *evt = NULL;
+	uint64_t                *addr;
+
+	evt = (struct cam_isp_context_state_monitor *)dump_struct;
+
+	addr = (uint64_t *)addr_ptr;
+
+	*addr++ = evt->evt_time_stamp.tv_sec;
+	*addr++ = evt->evt_time_stamp.tv_nsec / NSEC_PER_USEC;
+	*addr++ = evt->frame_id;
+	*addr++ = evt->req_id;
+	return addr;
+}
+
+static int __cam_isp_ctx_user_dump_state_monitor_array(
+	struct cam_isp_context *ctx_isp,
+	struct cam_common_hw_dump_args *dump_args)
+{
+	int                                          i, rc = 0;
+	int                                          index;
+	uint32_t                                     oldest_entry;
+	uint32_t                                     num_entries;
+	uint64_t                                     state_head = 0;
+
+	if (!dump_args || !ctx_isp) {
+		CAM_ERR(CAM_ISP, "Invalid args %pK %pK",
+			dump_args, ctx_isp);
+		return -EINVAL;
+	}
+
+	state_head = atomic64_read(&ctx_isp->dbg_monitors.state_monitor_head);
+
+	if (state_head == -1) {
+		return 0;
+	} else if (state_head < CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES) {
+		num_entries = state_head;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1,
+			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES, &oldest_entry);
+	}
+	CAM_ERR(CAM_ISP,
+		"Dumping state information for preceding requests");
+
+	index = oldest_entry;
+	for (i = 0; i < num_entries; i++) {
+
+		rc = cam_common_user_dump_helper(dump_args,
+			cam_isp_ctx_user_dump_state_monitor_array_info,
+			&ctx_isp->dbg_monitors.state_monitor[index],
+			sizeof(uint64_t), "ISP_STATE_MONITOR.%s.%s:",
+			__cam_isp_ctx_substate_val_to_type(
+				ctx_isp->dbg_monitors.state_monitor[index].curr_state),
+			__cam_isp_hw_evt_val_to_type(
+				ctx_isp->dbg_monitors.state_monitor[index].trigger));
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CAM ISP CONTEXT: Event record dump failed, rc: %d", rc);
+			return rc;
+		}
+
+		index = (index + 1) % CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES;
+
+	}
+	return rc;
+}
+
+static int cam_isp_context_info_dump(void *context,
+	enum cam_context_dump_id id)
+{
+	struct cam_context *ctx = (struct cam_context *)context;
+
+	switch (id) {
+	case CAM_CTX_DUMP_ACQ_INFO: {
+		cam_context_dump_hw_acq_info(ctx);
+		break;
+	}
+	default:
+		CAM_DBG(CAM_ISP, "DUMP id not valid %u, ctx_idx: %u, link: 0x%x",
+			id, ctx->ctx_id, ctx->link_hdl);
+		break;
+	}
+
+	return 0;
+}
+
+static const char *__cam_isp_ctx_crm_trigger_point_to_string(
+	int trigger_point)
+{
+	switch (trigger_point) {
+	case CAM_TRIGGER_POINT_SOF:
+		return "SOF";
+	case CAM_TRIGGER_POINT_EOF:
+		return "EOF";
+	default:
+		return "Invalid";
+	}
+}
+
+static int __cam_isp_ctx_notify_trigger_util(
+	int trigger_type, struct cam_isp_context *ctx_isp)
+{
+	int                                rc = -EINVAL;
+	struct cam_context                *ctx = ctx_isp->base;
+	struct cam_req_mgr_trigger_notify  notify;
+
+	/* Trigger type not supported, return */
+	if (!(ctx_isp->subscribe_event & trigger_type)) {
+		CAM_DBG(CAM_ISP,
+			"%s trigger point not subscribed for in mask: %u in ctx: %u on link: 0x%x last_bufdone: %lld",
+			__cam_isp_ctx_crm_trigger_point_to_string(trigger_type),
+			ctx_isp->subscribe_event, ctx->ctx_id, ctx->link_hdl,
+			ctx_isp->req_info.last_bufdone_req_id);
+		return 0;
+	}
+
+	/* Skip CRM notify when recovery is in progress */
+	if (atomic_read(&ctx_isp->internal_recovery_set)) {
+		CAM_DBG(CAM_ISP,
+			"Internal recovery in progress skip notifying %s trigger point in ctx: %u on link: 0x%x",
+			__cam_isp_ctx_crm_trigger_point_to_string(trigger_type),
+			ctx->ctx_id, ctx->link_hdl);
+		return 0;
+	}
+
+	notify.link_hdl = ctx->link_hdl;
+	notify.dev_hdl = ctx->dev_hdl;
+	notify.frame_id = ctx_isp->frame_id;
+	notify.trigger = trigger_type;
+	notify.req_id = ctx_isp->req_info.last_bufdone_req_id;
+	notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+	notify.trigger_id = ctx_isp->trigger_id;
+
+	CAM_DBG(CAM_ISP,
+		"Notify CRM %s on frame: %llu ctx: %u link: 0x%x last_buf_done_req: %lld",
+		__cam_isp_ctx_crm_trigger_point_to_string(trigger_type),
+		ctx_isp->frame_id, ctx->ctx_id, ctx->link_hdl,
+		ctx_isp->req_info.last_bufdone_req_id);
+
+	rc = ctx->ctx_crm_intf->notify_trigger(&notify);
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"Failed to notify CRM %s on frame: %llu ctx: %u link: 0x%x last_buf_done_req: %lld rc: %d",
+			__cam_isp_ctx_crm_trigger_point_to_string(trigger_type),
+			ctx_isp->frame_id, ctx->ctx_id, ctx->link_hdl,
+			ctx_isp->req_info.last_bufdone_req_id, rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_notify_v4l2_error_event(
+	uint32_t error_type, uint32_t error_code,
+	uint64_t error_request_id, struct cam_context *ctx)
+{
+	int                         rc = 0;
+	struct cam_req_mgr_message  req_msg;
+
+	req_msg.session_hdl = ctx->session_hdl;
+	req_msg.u.err_msg.device_hdl = ctx->dev_hdl;
+	req_msg.u.err_msg.error_type = error_type;
+	req_msg.u.err_msg.link_hdl = ctx->link_hdl;
+	req_msg.u.err_msg.request_id = error_request_id;
+	req_msg.u.err_msg.resource_size = 0x0;
+	req_msg.u.err_msg.error_code = error_code;
+
+	CAM_DBG(CAM_ISP,
+		"v4l2 error event [type: %u code: %u] for req: %llu in ctx: %u on link: 0x%x notified successfully",
+		error_type, error_code, error_request_id, ctx->ctx_id, ctx->link_hdl);
+
+	rc = cam_req_mgr_notify_message(&req_msg,
+			V4L_EVENT_CAM_REQ_MGR_ERROR,
+			V4L_EVENT_CAM_REQ_MGR_EVENT);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Notifying v4l2 error [type: %u code: %u] failed for req id:%llu in ctx %u on link: 0x%x",
+			error_type, error_code, error_request_id, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_notify_error_util(
+	uint32_t trigger_type, enum cam_req_mgr_device_error error,
+	uint64_t req_id, struct cam_isp_context *ctx_isp)
+{
+	int                                rc = -EINVAL;
+	struct cam_context                *ctx = ctx_isp->base;
+	struct cam_req_mgr_error_notify    notify;
+
+	notify.link_hdl = ctx->link_hdl;
+	notify.dev_hdl = ctx->dev_hdl;
+	notify.req_id = req_id;
+	notify.error = error;
+	notify.trigger = trigger_type;
+	notify.frame_id = ctx_isp->frame_id;
+	notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+
+	if ((error == CRM_KMD_ERR_BUBBLE) || (error == CRM_KMD_WARN_INTERNAL_RECOVERY))
+		CAM_WARN(CAM_ISP,
+			"Notify CRM about bubble req: %llu frame: %llu in ctx: %u on link: 0x%x",
+			req_id, ctx_isp->frame_id, ctx->ctx_id, ctx->link_hdl);
+	else
+		CAM_ERR(CAM_ISP,
+			"Notify CRM about fatal error: %u req: %llu frame: %llu in ctx: %u on link: 0x%x",
+			error, req_id, ctx_isp->frame_id, ctx->ctx_id, ctx->link_hdl);
+
+	rc = ctx->ctx_crm_intf->notify_err(&notify);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Failed to notify error: %u for req: %lu on ctx: %u in link: 0x%x",
+			error, req_id, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_trigger_reg_dump(
+	enum cam_hw_mgr_command cmd,
+	struct cam_context     *ctx)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args hw_cmd_args;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = cmd;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Reg dump on error failed ctx: %u link: 0x%x rc: %d",
+			ctx->ctx_id, ctx->link_hdl, rc);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Reg dump type: %u successful in ctx: %u on link: 0x%x",
+		cmd, ctx->ctx_id, ctx->link_hdl);
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_pause_crm_timer(
+	struct cam_context *ctx)
+{
+	int rc = -EINVAL;
+	struct cam_req_mgr_timer_notify  timer;
+
+	if (!ctx || !ctx->ctx_crm_intf)
+		goto end;
+
+	timer.link_hdl = ctx->link_hdl;
+	timer.dev_hdl = ctx->dev_hdl;
+	timer.state = false;
+	rc = ctx->ctx_crm_intf->notify_timer(&timer);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to pause sof timer in ctx: %u on link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "Notify CRM to pause timer for ctx: %u link: 0x%x success",
+		ctx->ctx_id, ctx->link_hdl);
+
+end:
+	return rc;
+}
+
+static inline void __cam_isp_ctx_update_sof_ts_util(
+	struct cam_isp_hw_sof_event_data *sof_event_data,
+	struct cam_isp_context *ctx_isp)
+{
+	/* Delayed update, skip if ts is already updated */
+	if (ctx_isp->sof_timestamp_val == sof_event_data->timestamp)
+		return;
+
+	ctx_isp->frame_id++;
+	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
+	ctx_isp->boot_timestamp = sof_event_data->boot_time;
+}
+
+static int cam_isp_ctx_dump_req(
+	struct cam_isp_ctx_req  *req_isp,
+	uintptr_t                cpu_addr,
+	size_t                   buf_len,
+	size_t                  *offset,
+	bool                     dump_to_buff)
+{
+	int i, rc = 0;
+	size_t len = 0;
+	uint32_t *buf_addr;
+	uint32_t *buf_start, *buf_end;
+	size_t remain_len = 0;
+	struct cam_cdm_cmd_buf_dump_info dump_info;
+
+	for (i = 0; i < req_isp->num_cfg; i++) {
+		rc = cam_packet_util_get_cmd_mem_addr(
+			req_isp->cfg[i].handle, &buf_addr, &len);
+		if (rc) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"Failed to get_cmd_mem_addr, rc=%d",
+				rc);
+		} else {
+			if (req_isp->cfg[i].offset >= ((uint32_t)len)) {
+				CAM_ERR(CAM_ISP,
+					"Invalid offset exp %u actual %u",
+					req_isp->cfg[i].offset, (uint32_t)len);
+				cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
+				return -EINVAL;
+			}
+			remain_len = len - req_isp->cfg[i].offset;
+
+			if (req_isp->cfg[i].len >
+				((uint32_t)remain_len)) {
+				CAM_ERR(CAM_ISP,
+					"Invalid len exp %u remain_len %u",
+					req_isp->cfg[i].len,
+					(uint32_t)remain_len);
+				cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
+				return -EINVAL;
+			}
+
+			buf_start = (uint32_t *)((uint8_t *) buf_addr +
+				req_isp->cfg[i].offset);
+			buf_end = (uint32_t *)((uint8_t *) buf_start +
+				req_isp->cfg[i].len - 1);
+
+			if (dump_to_buff) {
+				if (!cpu_addr || !offset || !buf_len) {
+					CAM_ERR(CAM_ISP, "Invalid args");
+					cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
+					break;
+				}
+				dump_info.src_start = buf_start;
+				dump_info.src_end =   buf_end;
+				dump_info.dst_start = cpu_addr;
+				dump_info.dst_offset = *offset;
+				dump_info.dst_max_size = buf_len;
+				rc = cam_cdm_util_dump_cmd_bufs_v2(
+					&dump_info);
+				*offset = dump_info.dst_offset;
+				if (rc) {
+					cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
+					return rc;
+				}
+			} else
+				cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
+			cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
+		}
+	}
+	return rc;
+}
+
+static int __cam_isp_ctx_enqueue_request_in_order(
+	struct cam_context *ctx, struct cam_ctx_request *req, bool lock)
+{
+	struct cam_ctx_request           *req_current;
+	struct cam_ctx_request           *req_prev;
+	struct list_head                  temp_list;
+	struct cam_isp_context           *ctx_isp;
+
+	INIT_LIST_HEAD(&temp_list);
+	if (lock)
+		spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->pending_req_list)) {
+		list_add_tail(&req->list, &ctx->pending_req_list);
+	} else {
+		list_for_each_entry_safe_reverse(
+			req_current, req_prev, &ctx->pending_req_list, list) {
+			if (req->request_id < req_current->request_id) {
+				list_del_init(&req_current->list);
+				list_add(&req_current->list, &temp_list);
+				continue;
+			} else if (req->request_id == req_current->request_id) {
+				CAM_WARN(CAM_ISP,
+					"Received duplicated request %lld, ctx_idx: %u link: 0x%x",
+					req->request_id, ctx->ctx_id, ctx->link_hdl);
+			}
+			break;
+		}
+		list_add_tail(&req->list, &ctx->pending_req_list);
+
+		if (!list_empty(&temp_list)) {
+			list_for_each_entry_safe(
+				req_current, req_prev, &temp_list, list) {
+				list_del_init(&req_current->list);
+				list_add_tail(&req_current->list,
+					&ctx->pending_req_list);
+			}
+		}
+	}
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_SUBMIT, req, NULL);
+	if (lock)
+		spin_unlock_bh(&ctx->lock);
+	return 0;
+}
+
+static int __cam_isp_ctx_enqueue_init_request(
+	struct cam_context *ctx, struct cam_ctx_request *req)
+{
+	int rc = 0;
+	struct cam_ctx_request                *req_old;
+	struct cam_isp_ctx_req                *req_isp_old;
+	struct cam_isp_ctx_req                *req_isp_new;
+	struct cam_isp_prepare_hw_update_data *req_update_old;
+	struct cam_isp_prepare_hw_update_data *req_update_new;
+	struct cam_isp_prepare_hw_update_data *hw_update_data;
+	struct cam_isp_fcg_config_info        *fcg_info_old;
+	struct cam_isp_fcg_config_info        *fcg_info_new;
+
+	spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->pending_req_list)) {
+		list_add_tail(&req->list, &ctx->pending_req_list);
+		CAM_DBG(CAM_ISP, "INIT packet added req id= %d, ctx_idx: %u, link: 0x%x",
+			req->request_id, ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+
+	req_old = list_first_entry(&ctx->pending_req_list,
+		struct cam_ctx_request, list);
+	req_isp_old = (struct cam_isp_ctx_req *) req_old->req_priv;
+	req_isp_new = (struct cam_isp_ctx_req *) req->req_priv;
+	if (req_isp_old->hw_update_data.packet_opcode_type ==
+		CAM_ISP_PACKET_INIT_DEV) {
+		if ((req_isp_old->num_cfg + req_isp_new->num_cfg) >=
+			ctx->max_hw_update_entries) {
+			CAM_WARN(CAM_ISP,
+				"Can not merge INIT pkt num_cfgs = %d, ctx_idx: %u, link: 0x%x",
+				(req_isp_old->num_cfg +
+					req_isp_new->num_cfg), ctx->ctx_id, ctx->link_hdl);
+			rc = -ENOMEM;
+		}
+
+		if (req_isp_old->num_fence_map_out != 0 ||
+			req_isp_old->num_fence_map_in != 0) {
+			CAM_WARN(CAM_ISP, "Invalid INIT pkt sequence, ctx_idx: %u, link: 0x%x",
+				ctx->ctx_id, ctx->link_hdl);
+			rc = -EINVAL;
+		}
+
+		if (!rc) {
+			memcpy(req_isp_old->fence_map_out,
+				req_isp_new->fence_map_out,
+				sizeof(req_isp_new->fence_map_out[0])*
+				req_isp_new->num_fence_map_out);
+			req_isp_old->num_fence_map_out =
+				req_isp_new->num_fence_map_out;
+
+			memcpy(req_isp_old->fence_map_in,
+				req_isp_new->fence_map_in,
+				sizeof(req_isp_new->fence_map_in[0])*
+				req_isp_new->num_fence_map_in);
+			req_isp_old->num_fence_map_in =
+				req_isp_new->num_fence_map_in;
+
+			/* Copy hw update entries, num_cfg is updated later */
+			memcpy(&req_isp_old->cfg[req_isp_old->num_cfg],
+				req_isp_new->cfg,
+				sizeof(req_isp_new->cfg[0]) *
+				req_isp_new->num_cfg);
+
+			memcpy(&req_old->pf_data, &req->pf_data,
+				sizeof(struct cam_hw_mgr_pf_request_info));
+
+			if (req_isp_new->hw_update_data.num_reg_dump_buf) {
+				req_update_new = &req_isp_new->hw_update_data;
+				req_update_old = &req_isp_old->hw_update_data;
+				memcpy(&req_update_old->reg_dump_buf_desc,
+					&req_update_new->reg_dump_buf_desc,
+					sizeof(struct cam_cmd_buf_desc) *
+					req_update_new->num_reg_dump_buf);
+				req_update_old->num_reg_dump_buf =
+					req_update_new->num_reg_dump_buf;
+			}
+
+			/* Update HW update params for ePCR */
+			hw_update_data = &req_isp_new->hw_update_data;
+			req_isp_old->hw_update_data.frame_header_res_id =
+				req_isp_new->hw_update_data.frame_header_res_id;
+			req_isp_old->hw_update_data.frame_header_cpu_addr =
+				hw_update_data->frame_header_cpu_addr;
+			if (req_isp_new->hw_update_data.mup_en) {
+				req_isp_old->hw_update_data.mup_en =
+					req_isp_new->hw_update_data.mup_en;
+				req_isp_old->hw_update_data.mup_val =
+					req_isp_new->hw_update_data.mup_val;
+				req_isp_old->hw_update_data.num_exp =
+					req_isp_new->hw_update_data.num_exp;
+			}
+
+			/* Copy FCG HW update params */
+			fcg_info_new = &hw_update_data->fcg_info;
+			fcg_info_old = &req_isp_old->hw_update_data.fcg_info;
+			fcg_info_old->use_current_cfg = true;
+
+			if (fcg_info_new->ife_fcg_online) {
+				fcg_info_old->ife_fcg_online = true;
+				fcg_info_old->ife_fcg_entry_idx =
+					req_isp_old->num_cfg +
+					fcg_info_new->ife_fcg_entry_idx;
+				memcpy(&fcg_info_old->ife_fcg_config,
+					&fcg_info_new->ife_fcg_config,
+					sizeof(struct cam_isp_fcg_config_internal));
+			}
+
+			if (fcg_info_new->sfe_fcg_online) {
+				fcg_info_old->sfe_fcg_online = true;
+				fcg_info_old->sfe_fcg_entry_idx =
+					req_isp_old->num_cfg +
+					fcg_info_new->sfe_fcg_entry_idx;
+				memcpy(&fcg_info_old->sfe_fcg_config,
+					&fcg_info_new->sfe_fcg_config,
+					sizeof(struct cam_isp_fcg_config_internal));
+			}
+			req_isp_old->num_cfg += req_isp_new->num_cfg;
+			req_old->request_id = req->request_id;
+			list_splice_init(&req->buf_tracker, &req_old->buf_tracker);
+
+			__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		}
+	} else {
+		CAM_WARN(CAM_ISP,
+			"Received Update pkt before INIT pkt. req_id= %lld, ctx_idx: %u, link: 0x%x",
+			req->request_id, ctx->ctx_id, ctx->link_hdl);
+		rc = -EINVAL;
+	}
+end:
+	spin_unlock_bh(&ctx->lock);
+	return rc;
+}
+
+static char *__cam_isp_ife_sfe_resource_handle_id_to_type(
+	uint32_t resource_handle)
+{
+	switch (resource_handle) {
+	/* IFE output ports */
+	case CAM_ISP_IFE_OUT_RES_FULL:                  return "IFE_FULL";
+	case CAM_ISP_IFE_OUT_RES_DS4:                   return "IFE_DS4";
+	case CAM_ISP_IFE_OUT_RES_DS16:                  return "IFE_DS16";
+	case CAM_ISP_IFE_OUT_RES_RAW_DUMP:              return "IFE_RAW_DUMP";
+	case CAM_ISP_IFE_OUT_RES_FD:                    return "IFE_FD";
+	case CAM_ISP_IFE_OUT_RES_PDAF:                  return "IFE_PDAF";
+	case CAM_ISP_IFE_OUT_RES_RDI_0:                 return "IFE_RDI_0";
+	case CAM_ISP_IFE_OUT_RES_RDI_1:                 return "IFE_RDI_1";
+	case CAM_ISP_IFE_OUT_RES_RDI_2:                 return "IFE_RDI_2";
+	case CAM_ISP_IFE_OUT_RES_RDI_3:                 return "IFE_RDI_3";
+	case CAM_ISP_IFE_OUT_RES_RDI_4:                 return "IFE_RDI_4";
+	case CAM_ISP_IFE_OUT_RES_RDI_5:                 return "IFE_RDI_5";
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BE:          return "IFE_STATS_HDR_BE";
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST:       return "IFE_STATS_HDR_BHIST";
+	case CAM_ISP_IFE_OUT_RES_STATS_TL_BG:           return "IFE_STATS_TL_BG";
+	case CAM_ISP_IFE_OUT_RES_STATS_BF:              return "IFE_STATS_BF";
+	case CAM_ISP_IFE_OUT_RES_STATS_AWB_BG:          return "IFE_STATS_AWB_BG";
+	case CAM_ISP_IFE_OUT_RES_STATS_BHIST:           return "IFE_STATS_BHIST";
+	case CAM_ISP_IFE_OUT_RES_STATS_RS:              return "IFE_STATS_RS";
+	case CAM_ISP_IFE_OUT_RES_STATS_CS:              return "IFE_STATS_CS";
+	case CAM_ISP_IFE_OUT_RES_STATS_IHIST:           return "IFE_STATS_IHIST";
+	case CAM_ISP_IFE_OUT_RES_FULL_DISP:             return "IFE_FULL_DISP";
+	case CAM_ISP_IFE_OUT_RES_DS4_DISP:              return "IFE_DS4_DISP";
+	case CAM_ISP_IFE_OUT_RES_DS16_DISP:             return "IFE_DS16_DISP";
+	case CAM_ISP_IFE_OUT_RES_2PD:                   return "IFE_2PD";
+	case CAM_ISP_IFE_OUT_RES_LCR:                   return "IFE_LCR";
+	case CAM_ISP_IFE_OUT_RES_AWB_BFW:               return "IFE_AWB_BFW";
+	case CAM_ISP_IFE_OUT_RES_PREPROCESS_2PD:        return "IFE_PREPROCESS_2PD";
+	case CAM_ISP_IFE_OUT_RES_STATS_AEC_BE:          return "IFE_STATS_AEC_BE";
+	case CAM_ISP_IFE_OUT_RES_LTM_STATS:             return "IFE_LTM_STATS";
+	case CAM_ISP_IFE_OUT_RES_STATS_GTM_BHIST:       return "IFE_STATS_GTM_BHIST";
+	case CAM_ISP_IFE_LITE_OUT_RES_STATS_BG:         return "IFE_STATS_BG";
+	case CAM_ISP_IFE_LITE_OUT_RES_PREPROCESS_RAW:   return "IFE_PREPROCESS_RAW";
+	case CAM_ISP_IFE_OUT_RES_SPARSE_PD:             return "IFE_SPARSE_PD";
+	case CAM_ISP_IFE_OUT_RES_STATS_CAF:             return "IFE_STATS_CAF";
+	case CAM_ISP_IFE_OUT_RES_STATS_BAYER_RS:        return "IFE_STATS_BAYER_RS";
+	case CAM_ISP_IFE_OUT_RES_PDAF_PARSED_DATA:      return "IFE_PDAF_PARSED_DATA";
+	case CAM_ISP_IFE_OUT_RES_STATS_ALSC:            return "IFE_STATS_ALSC";
+	case CAM_ISP_IFE_OUT_RES_AI_OUT_1:              return "IFE_AI_OUT_1";
+	case CAM_ISP_IFE_OUT_RES_AI_OUT_2:              return "IFE_AI_OUT_2";
+	case CAM_ISP_IFE_OUT_RES_IR:                    return "IR_OUT";
+	case CAM_ISP_IFE_OUT_RES_STATS_IR_BG:           return "STATS_IR_BG";
+	case CAM_ISP_IFE_OUT_RES_STATS_IR_BHIST:        return "STATS_IR_BHIST";
+	/* SFE output ports */
+	case CAM_ISP_SFE_OUT_RES_RDI_0:                 return "SFE_RDI_0";
+	case CAM_ISP_SFE_OUT_RES_RDI_1:                 return "SFE_RDI_1";
+	case CAM_ISP_SFE_OUT_RES_RDI_2:                 return "SFE_RDI_2";
+	case CAM_ISP_SFE_OUT_RES_RDI_3:                 return "SFE_RDI_3";
+	case CAM_ISP_SFE_OUT_RES_RDI_4:                 return "SFE_RDI_4";
+	case CAM_ISP_SFE_OUT_BE_STATS_0:                return "SFE_BE_STATS_0";
+	case CAM_ISP_SFE_OUT_BE_STATS_1:                return "SFE_BE_STATS_1";
+	case CAM_ISP_SFE_OUT_BE_STATS_2:                return "SFE_BE_STATS_2";
+	case CAM_ISP_SFE_OUT_BHIST_STATS_0:             return "SFE_BHIST_STATS_0";
+	case CAM_ISP_SFE_OUT_BHIST_STATS_1:             return "SFE_BHIST_STATS_1";
+	case CAM_ISP_SFE_OUT_BHIST_STATS_2:             return "SFE_BHIST_STATS_2";
+	case CAM_ISP_SFE_OUT_RES_LCR:                   return "SFE_LCR";
+	case CAM_ISP_SFE_OUT_RES_RAW_DUMP:              return "SFE_PROCESSED_RAW";
+	case CAM_ISP_SFE_OUT_RES_IR:                    return "SFE_IR";
+	case CAM_ISP_SFE_OUT_BAYER_RS_STATS_0:          return "SFE_RS_STATS_0";
+	case CAM_ISP_SFE_OUT_BAYER_RS_STATS_1:          return "SFE_RS_STATS_1";
+	case CAM_ISP_SFE_OUT_BAYER_RS_STATS_2:          return "SFE_RS_STATS_2";
+	case CAM_ISP_SFE_OUT_HDR_STATS:                 return "HDR_STATS";
+	/* SFE input ports */
+	case CAM_ISP_SFE_IN_RD_0:                       return "SFE_RD_0";
+	case CAM_ISP_SFE_IN_RD_1:                       return "SFE_RD_1";
+	case CAM_ISP_SFE_IN_RD_2:                       return "SFE_RD_2";
+	/* Handle invalid type */
+	default:                                        return "Invalid_Resource_Type";
+	}
+}
+
+static const char *__cam_isp_tfe_resource_handle_id_to_type(
+	uint32_t resource_handle)
+{
+	switch (resource_handle) {
+	/* TFE output ports */
+	case CAM_ISP_TFE_OUT_RES_FULL:                  return "TFE_FULL";
+	case CAM_ISP_TFE_OUT_RES_RAW_DUMP:              return "TFE_RAW_DUMP";
+	case CAM_ISP_TFE_OUT_RES_PDAF:                  return "TFE_PDAF";
+	case CAM_ISP_TFE_OUT_RES_RDI_0:                 return "TFE_RDI_0";
+	case CAM_ISP_TFE_OUT_RES_RDI_1:                 return "TFE_RDI_1";
+	case CAM_ISP_TFE_OUT_RES_RDI_2:                 return "TFE_RDI_2";
+	case CAM_ISP_TFE_OUT_RES_STATS_HDR_BE:          return "TFE_STATS_HDR_BE";
+	case CAM_ISP_TFE_OUT_RES_STATS_HDR_BHIST:       return "TFE_STATS_HDR_BHIST";
+	case CAM_ISP_TFE_OUT_RES_STATS_TL_BG:           return "TFE_STATS_TL_BG";
+	case CAM_ISP_TFE_OUT_RES_STATS_BF:              return "TFE_STATS_BF";
+	case CAM_ISP_TFE_OUT_RES_STATS_AWB_BG:          return "TFE_STATS_AWB_BG";
+	case CAM_ISP_TFE_OUT_RES_STATS_RS:              return "TFE_STATS_RS";
+	case CAM_ISP_TFE_OUT_RES_DS4:                   return "TFE_DS_4";
+	case CAM_ISP_TFE_OUT_RES_DS16:                  return "TFE_DS_16";
+	case CAM_ISP_TFE_OUT_RES_AI:                    return "TFE_AI";
+	case CAM_ISP_TFE_OUT_RES_PD_LCR_STATS:          return "TFE_LCR_STATS";
+	case CAM_ISP_TFE_OUT_RES_PD_PREPROCESSED:       return "TFE_PD_PREPROCESSED";
+	case CAM_ISP_TFE_OUT_RES_PD_PARSED:             return "TFE_PD_PARSED";
+	/* Handle invalid type */
+	default:                                        return "Invalid_Resource_Type";
+	}
+}
+
+static const char *__cam_isp_resource_handle_id_to_type(
+	uint32_t device_type, uint32_t resource_handle)
+{
+	switch (device_type) {
+	case CAM_IFE_DEVICE_TYPE:
+	case CAM_TFE_MC_DEVICE_TYPE:
+		return __cam_isp_ife_sfe_resource_handle_id_to_type(resource_handle);
+	case CAM_TFE_DEVICE_TYPE:
+		return __cam_isp_tfe_resource_handle_id_to_type(resource_handle);
+	default:
+		return "INVALID_DEV_TYPE";
+	}
+}
+
+static uint64_t __cam_isp_ctx_get_event_ts(uint32_t evt_id, void *evt_data)
+{
+	uint64_t ts = 0;
+
+	if (!evt_data)
+		return 0;
+
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_ERROR:
+		ts = ((struct cam_isp_hw_error_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_SOF:
+		ts = ((struct cam_isp_hw_sof_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		ts = ((struct cam_isp_hw_reg_update_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_EPOCH:
+		ts = ((struct cam_isp_hw_epoch_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_EOF:
+		ts = ((struct cam_isp_hw_eof_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_DONE:
+	case CAM_ISP_HW_SECONDARY_EVENT:
+		break;
+	default:
+		CAM_DBG(CAM_ISP, "Invalid Event Type %d", evt_id);
+	}
+
+	return ts;
+}
+
+static int __cam_isp_ctx_get_hw_timestamp(struct cam_context *ctx, uint64_t *prev_ts,
+	uint64_t *curr_ts, uint64_t *boot_ts)
+{
+	struct cam_hw_cmd_args hw_cmd_args;
+	struct cam_isp_hw_cmd_args isp_hw_cmd_args;
+	int rc;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	hw_cmd_args.u.internal_args = &isp_hw_cmd_args;
+
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_GET_SOF_TS;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->ctxt_to_hw_map, &hw_cmd_args);
+	if (rc)
+		return rc;
+
+	if (isp_hw_cmd_args.u.sof_ts.prev >= isp_hw_cmd_args.u.sof_ts.curr) {
+		CAM_ERR(CAM_ISP, "ctx:%u link:0x%x prev timestamp greater than curr timestamp",
+			ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	*prev_ts = isp_hw_cmd_args.u.sof_ts.prev;
+	*curr_ts = isp_hw_cmd_args.u.sof_ts.curr;
+	*boot_ts = isp_hw_cmd_args.u.sof_ts.boot;
+
+	return 0;
+}
+
+static int __cam_isp_ctx_get_cdm_done_timestamp(struct cam_context *ctx,
+	uint64_t *last_cdm_done_req)
+{
+	struct cam_hw_cmd_args hw_cmd_args;
+	struct cam_isp_hw_cmd_args isp_hw_cmd_args;
+	struct tm ts;
+	int rc;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	hw_cmd_args.u.internal_args = &isp_hw_cmd_args;
+
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_GET_LAST_CDM_DONE;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->ctxt_to_hw_map, &hw_cmd_args);
+	if (rc)
+		return rc;
+
+	*last_cdm_done_req = isp_hw_cmd_args.u.last_cdm_done;
+	ctx->cdm_done_ts = isp_hw_cmd_args.cdm_done_ts;
+	time64_to_tm(isp_hw_cmd_args.cdm_done_ts.tv_sec, 0, &ts);
+	CAM_DBG(CAM_ISP,
+		"last_cdm_done req: %llu ctx: %u link: 0x%x time[%d-%d %d:%d:%d.%lld]",
+		*last_cdm_done_req, ctx->ctx_id, ctx->link_hdl,
+		ts.tm_mon + 1, ts.tm_mday, ts.tm_hour, ts.tm_min, ts.tm_sec,
+		isp_hw_cmd_args.cdm_done_ts.tv_nsec / 1000000);
+
+	return 0;
+}
+
+static int __cam_isp_ctx_recover_sof_timestamp(struct cam_context *ctx, uint64_t request_id)
+{
+	struct cam_isp_context *ctx_isp = ctx->ctx_priv;
+	uint64_t prev_ts, curr_ts, boot_ts;
+	uint64_t a, b, c;
+	int rc;
+
+	rc = __cam_isp_ctx_get_hw_timestamp(ctx, &prev_ts, &curr_ts, &boot_ts);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "ctx:%u link: 0x%x Failed to get timestamp from HW",
+			ctx->ctx_id, ctx->link_hdl);
+		return rc;
+	}
+
+	/**
+	 * If the last received SOF was for frame A and we have missed the SOF for frame B,
+	 * then we need to find out if the hardware is at frame B or C.
+	 *   +-----+-----+-----+
+	 *   |  A  |  B  |  C  |
+	 *   +-----+-----+-----+
+	 */
+	a = ctx_isp->sof_timestamp_val;
+	if (a == prev_ts) {
+		/* Hardware is at frame B */
+		b = curr_ts;
+		CAM_DBG(CAM_ISP, "ctx:%u link:0x%x recover time(last:0x%llx,curr:0x%llx)req:%llu",
+			ctx->ctx_id, ctx->link_hdl, a, b, request_id);
+	} else if (a < prev_ts) {
+		/* Hardware is at frame C */
+		b = prev_ts;
+		c = curr_ts;
+
+		CAM_DBG(CAM_ISP,
+			"ctx:%u link:0x%x recover time(last:0x%llx,prev:0x%llx,curr:0x%llx)req:%llu",
+			ctx->ctx_id, ctx->link_hdl, a, b, c, request_id);
+	} else {
+		/* Hardware is at frame A (which we supposedly missed) */
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"ctx:%u link: 0x%x erroneous call to SOF recovery(last:0x%llx, prev:0x%llx, curr:0x%llx) req: %llu",
+			ctx->ctx_id, ctx->link_hdl, a, prev_ts, curr_ts, request_id);
+		return 0;
+	}
+
+	ctx_isp->boot_timestamp = boot_ts + (b - curr_ts);
+	ctx_isp->sof_timestamp_val = b;
+	ctx_isp->frame_id++;
+	return 0;
+}
+
+static void __cam_isp_ctx_send_sof_boot_timestamp(
+	struct cam_isp_context *ctx_isp, uint64_t request_id,
+	uint32_t sof_event_status, struct shutter_event *shutter_event)
+{
+	struct cam_req_mgr_message   req_msg;
+
+	req_msg.session_hdl = ctx_isp->base->session_hdl;
+	req_msg.u.frame_msg.frame_id = ctx_isp->frame_id;
+	req_msg.u.frame_msg.request_id = request_id;
+	req_msg.u.frame_msg.timestamp = ctx_isp->boot_timestamp;
+	req_msg.u.frame_msg.link_hdl = ctx_isp->base->link_hdl;
+	req_msg.u.frame_msg.sof_status = sof_event_status;
+	req_msg.u.frame_msg.frame_id_meta = ctx_isp->frame_id_meta;
+
+	CAM_DBG(CAM_ISP,
+		"request id:%lld frame number:%lld boot time stamp:0x%llx status:%u",
+		 request_id, ctx_isp->frame_id,
+		 ctx_isp->boot_timestamp, sof_event_status);
+	shutter_event->frame_id = ctx_isp->frame_id;
+	shutter_event->req_id   = request_id;
+	shutter_event->boot_ts  = ctx_isp->boot_timestamp;
+	shutter_event->sof_ts   = ctx_isp->sof_timestamp_val;
+
+	if (cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_SOF_BOOT_TS,
+		V4L_EVENT_CAM_REQ_MGR_EVENT))
+		CAM_ERR(CAM_ISP,
+			"Error in notifying the boot time for req id:%lld",
+			request_id);
+
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_SHUTTER, NULL, shutter_event);
+}
+
+static void __cam_isp_ctx_send_unified_timestamp(
+	struct cam_isp_context *ctx_isp, uint64_t request_id,
+	struct shutter_event *shutter_event)
+{
+	struct cam_req_mgr_message   req_msg;
+
+	req_msg.session_hdl = ctx_isp->base->session_hdl;
+	req_msg.u.frame_msg_v2.frame_id = ctx_isp->frame_id;
+	req_msg.u.frame_msg_v2.request_id = request_id;
+	req_msg.u.frame_msg_v2.timestamps[CAM_REQ_SOF_QTIMER_TIMESTAMP] =
+		(request_id == 0) ? 0 : ctx_isp->sof_timestamp_val;
+	req_msg.u.frame_msg_v2.timestamps[CAM_REQ_BOOT_TIMESTAMP] = ctx_isp->boot_timestamp;
+	req_msg.u.frame_msg_v2.link_hdl = ctx_isp->base->link_hdl;
+	req_msg.u.frame_msg_v2.frame_id_meta = ctx_isp->frame_id_meta;
+
+	CAM_DBG(CAM_ISP,
+		"link hdl 0x%x request id:%lld frame number:%lld SOF time stamp:0x%llx ctx %d\
+		boot time stamp:0x%llx", ctx_isp->base->link_hdl, request_id,
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val,ctx_isp->base->ctx_id,
+		ctx_isp->boot_timestamp);
+	shutter_event->frame_id = ctx_isp->frame_id;
+	shutter_event->req_id   = request_id;
+	shutter_event->boot_ts  = ctx_isp->boot_timestamp;
+	shutter_event->sof_ts   = ctx_isp->sof_timestamp_val;
+
+	if (cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_SOF_UNIFIED_TS, V4L_EVENT_CAM_REQ_MGR_EVENT))
+		CAM_ERR(CAM_ISP,
+			"Error in notifying the sof and boot time for req id:%lld",
+			request_id);
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_SHUTTER, NULL, shutter_event);
+}
+
+static void __cam_isp_ctx_send_sof_timestamp_frame_header(
+	struct cam_isp_context *ctx_isp, uint32_t *frame_header_cpu_addr,
+	uint64_t request_id, uint32_t sof_event_status)
+{
+	uint32_t *time32 = NULL;
+	uint64_t timestamp = 0;
+	struct cam_req_mgr_message   req_msg;
+
+	time32 = frame_header_cpu_addr;
+	timestamp = (uint64_t) time32[1];
+	timestamp = timestamp << 24;
+	timestamp |= (uint64_t)(time32[0] >> 8);
+	timestamp = mul_u64_u32_div(timestamp,
+			CAM_IFE_QTIMER_MUL_FACTOR,
+			CAM_IFE_QTIMER_DIV_FACTOR);
+
+	ctx_isp->sof_timestamp_val = timestamp;
+	req_msg.session_hdl = ctx_isp->base->session_hdl;
+	req_msg.u.frame_msg.frame_id = ctx_isp->frame_id;
+	req_msg.u.frame_msg.request_id = request_id;
+	req_msg.u.frame_msg.timestamp = ctx_isp->sof_timestamp_val;
+	req_msg.u.frame_msg.link_hdl = ctx_isp->base->link_hdl;
+	req_msg.u.frame_msg.sof_status = sof_event_status;
+
+	CAM_DBG(CAM_ISP,
+		"request id:%lld frame number:%lld SOF time stamp:0x%llx status:%u",
+		 request_id, ctx_isp->frame_id,
+		ctx_isp->sof_timestamp_val, sof_event_status);
+
+	if (cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_SOF, V4L_EVENT_CAM_REQ_MGR_EVENT))
+		CAM_ERR(CAM_ISP,
+			"Error in notifying the sof time for req id:%lld",
+			request_id);
+}
+
+static void __cam_isp_ctx_send_sof_timestamp(
+	struct cam_isp_context *ctx_isp, uint64_t request_id,
+	uint32_t sof_event_status)
+{
+	struct cam_req_mgr_message   req_msg;
+	struct cam_context           *ctx = ctx_isp->base;
+	struct shutter_event         shutter_event = {0};
+
+	/*Offline context no needed to send sof event to userspace*/
+	if (ctx_isp->offline_context)
+		return;
+
+	if (ctx_isp->reported_frame_id == ctx_isp->frame_id) {
+		if (__cam_isp_ctx_recover_sof_timestamp(ctx_isp->base, request_id))
+			CAM_WARN(CAM_ISP, "Missed SOF.No SOF timestamp recovery,ctx:%u,link:0x%x",
+				ctx->ctx_id, ctx->link_hdl);
+	}
+
+	if (request_id == 0 && (ctx_isp->reported_frame_id == ctx_isp->frame_id)) {
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Missed SOF Recovery for invalid req, Skip notificaiton to userspace Ctx: %u link: 0x%x frame_id %u",
+			ctx->ctx_id, ctx->link_hdl, ctx_isp->frame_id);
+		return;
+	}
+
+	ctx_isp->reported_frame_id = ctx_isp->frame_id;
+	shutter_event.status = sof_event_status;
+
+	if ((ctx_isp->v4l2_event_sub_ids & (1 << V4L_EVENT_CAM_REQ_MGR_SOF_UNIFIED_TS))
+		&& !ctx_isp->use_frame_header_ts) {
+		__cam_isp_ctx_send_unified_timestamp(ctx_isp, request_id, &shutter_event);
+		return;
+	}
+
+	if ((ctx_isp->use_frame_header_ts) || (request_id == 0))
+		goto end;
+
+	req_msg.session_hdl = ctx_isp->base->session_hdl;
+	req_msg.u.frame_msg.frame_id = ctx_isp->frame_id;
+	req_msg.u.frame_msg.request_id = request_id;
+	req_msg.u.frame_msg.timestamp = ctx_isp->sof_timestamp_val;
+	req_msg.u.frame_msg.link_hdl = ctx_isp->base->link_hdl;
+	req_msg.u.frame_msg.sof_status = sof_event_status;
+	req_msg.u.frame_msg.frame_id_meta = ctx_isp->frame_id_meta;
+
+	CAM_DBG(CAM_ISP,
+		"request id:%lld frame number:%lld SOF time stamp:0x%llx status:%u ctx_idx: %u, link: 0x%x",
+		request_id, ctx_isp->frame_id,
+		ctx_isp->sof_timestamp_val, sof_event_status, ctx->ctx_id, ctx->link_hdl);
+
+	if (cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_SOF, V4L_EVENT_CAM_REQ_MGR_EVENT))
+		CAM_ERR(CAM_ISP,
+			"Error in notifying the sof time for req id:%lld, ctx_idx: %u, link: 0x%x",
+			request_id, ctx->ctx_id, ctx->link_hdl);
+
+end:
+	__cam_isp_ctx_send_sof_boot_timestamp(ctx_isp,
+		request_id, sof_event_status, &shutter_event);
+}
+
+static void __cam_isp_ctx_handle_buf_done_fail_log(
+	struct cam_isp_context *ctx_isp, uint64_t request_id,
+	struct cam_isp_ctx_req *req_isp)
+{
+	int i;
+	struct cam_context *ctx = ctx_isp->base;
+	const char *handle_type;
+
+	if (req_isp->num_fence_map_out >= CAM_ISP_CTX_RES_MAX) {
+		CAM_ERR(CAM_ISP,
+			"Num Resources exceed mMAX %d >= %d ",
+			req_isp->num_fence_map_out, CAM_ISP_CTX_RES_MAX);
+		return;
+	}
+
+	CAM_WARN_RATE_LIMIT(CAM_ISP,
+		"Prev Req[%lld] : num_out=%d, num_acked=%d, bubble : report=%d, detected=%d",
+		request_id, req_isp->num_fence_map_out, req_isp->num_acked,
+		req_isp->bubble_report, req_isp->bubble_detected);
+	CAM_WARN_RATE_LIMIT(CAM_ISP,
+		"Resource Handles that fail to generate buf_done in prev frame");
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		if (req_isp->fence_map_out[i].sync_id != -1) {
+			handle_type = __cam_isp_resource_handle_id_to_type(
+				ctx_isp->isp_device_type,
+				req_isp->fence_map_out[i].resource_handle);
+
+			trace_cam_log_event("Buf_done Congestion",
+				handle_type, request_id, req_isp->fence_map_out[i].sync_id);
+
+			CAM_WARN_RATE_LIMIT(CAM_ISP,
+				"Resource_Handle: [%s][0x%x] Sync_ID: [0x%x]",
+				handle_type,
+				req_isp->fence_map_out[i].resource_handle,
+				req_isp->fence_map_out[i].sync_id);
+		}
+	}
+
+	ctx_isp->congestion_cnt++;
+
+	/* Trigger SOF freeze debug dump on 3 or greater instances of congestion */
+	if ((ctx_isp->congestion_cnt >= CAM_ISP_CONTEXT_CONGESTION_CNT_MAX) &&
+		(!ctx_isp->sof_dbg_irq_en))
+		__cam_isp_ctx_handle_sof_freeze_evt(ctx);
+}
+
+static void __cam_isp_context_reset_internal_recovery_params(
+	struct cam_isp_context    *ctx_isp)
+{
+	atomic_set(&ctx_isp->internal_recovery_set, 0);
+	atomic_set(&ctx_isp->process_bubble, 0);
+	ctx_isp->aeb_error_cnt = 0;
+	ctx_isp->bubble_frame_cnt = 0;
+	ctx_isp->congestion_cnt = 0;
+	ctx_isp->sof_dbg_irq_en = false;
+}
+
+static int __cam_isp_context_try_internal_recovery(
+	struct cam_isp_context    *ctx_isp)
+{
+	int rc = 0;
+	struct cam_context        *ctx = ctx_isp->base;
+	struct cam_ctx_request    *req;
+	struct cam_isp_ctx_req    *req_isp;
+
+	/*
+	 * Start with wait list, if recovery is stil set
+	 * errored request has not been moved to pending yet.
+	 * Buf done for errored request has not occurred recover
+	 * from here
+	 */
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request, list);
+		req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+
+		if (req->request_id == ctx_isp->recovery_req_id) {
+			rc = __cam_isp_ctx_notify_error_util(CAM_TRIGGER_POINT_SOF,
+				CRM_KMD_WARN_INTERNAL_RECOVERY, ctx_isp->recovery_req_id, ctx_isp);
+			if (rc) {
+				/* Unable to do bubble recovery reset back to normal */
+				CAM_WARN(CAM_ISP,
+					"Unable to perform internal recovery [bubble reporting failed] for req: %llu in ctx: %u on link: 0x%x",
+					req->request_id, ctx->ctx_id, ctx->link_hdl);
+				__cam_isp_context_reset_internal_recovery_params(ctx_isp);
+				req_isp->bubble_detected = false;
+				goto end;
+			}
+
+			list_del_init(&req->list);
+			list_add(&req->list, &ctx->pending_req_list);
+			ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+			CAM_INFO(CAM_ISP,
+				"Internal recovery for req: %llu in ctx: %u on link: 0x%x triggered",
+				ctx_isp->recovery_req_id, ctx->ctx_id, ctx->link_hdl);
+			goto end;
+		}
+	}
+
+	/*
+	 * If not in wait list only other possibility is request is in pending list
+	 * on error detection, bubble detect is set assuming new frame after detection
+	 * comes in, there is an rup it's moved to active list and it finishes with
+	 * it's buf done's
+	 */
+	if (!list_empty(&ctx->pending_req_list)) {
+		req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request, list);
+		req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+
+		if (req->request_id == ctx_isp->recovery_req_id) {
+			rc = __cam_isp_ctx_notify_error_util(CAM_TRIGGER_POINT_SOF,
+				CRM_KMD_WARN_INTERNAL_RECOVERY, ctx_isp->recovery_req_id, ctx_isp);
+			if (rc) {
+				/* Unable to do bubble recovery reset back to normal */
+				CAM_WARN(CAM_ISP,
+					"Unable to perform internal recovery [bubble reporting failed] for req: %llu in ctx: %u on link: 0x%x",
+					req->request_id, ctx->ctx_id, ctx->link_hdl);
+				__cam_isp_context_reset_internal_recovery_params(ctx_isp);
+				req_isp->bubble_detected = false;
+				goto end;
+			}
+			ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+			CAM_INFO(CAM_ISP,
+				"Internal recovery for req: %llu in ctx: %u on link: 0x%x triggered",
+				ctx_isp->recovery_req_id, ctx->ctx_id, ctx->link_hdl);
+			goto end;
+		}
+	}
+
+	/* If request is not found in either of the lists skip recovery */
+	__cam_isp_context_reset_internal_recovery_params(ctx_isp);
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_buf_done_for_req_list(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request *req)
+{
+	int rc = 0, i;
+	uint64_t buf_done_req_id;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	ctx_isp->active_req_cnt--;
+	buf_done_req_id = req->request_id;
+
+	if (req_isp->bubble_detected && req_isp->bubble_report) {
+		req_isp->num_acked = 0;
+		req_isp->num_deferred_acks = 0;
+		req_isp->bubble_detected = false;
+		list_del_init(&req->list);
+		atomic_set(&ctx_isp->process_bubble, 0);
+		req_isp->cdm_reset_before_apply = false;
+		ctx_isp->bubble_frame_cnt = 0;
+
+		if (buf_done_req_id <= ctx->last_flush_req) {
+			cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+			for (i = 0; i < req_isp->num_fence_map_out; i++)
+				rc = cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+			__cam_isp_ctx_move_req_to_free_list(ctx, req);
+			CAM_DBG(CAM_REQ,
+				"Move active request %lld to free list(cnt = %d) [flushed], ctx %u, link: 0x%x",
+				buf_done_req_id, ctx_isp->active_req_cnt,
+				ctx->ctx_id, ctx->link_hdl);
+			ctx_isp->last_bufdone_err_apply_req_id = 0;
+		} else {
+			list_add(&req->list, &ctx->pending_req_list);
+			CAM_DBG(CAM_REQ,
+				"Move active request %lld to pending list(cnt = %d) [bubble recovery], ctx %u, link: 0x%x",
+				req->request_id, ctx_isp->active_req_cnt,
+				ctx->ctx_id, ctx->link_hdl);
+		}
+	} else {
+		if (!ctx_isp->use_frame_header_ts) {
+			if (ctx_isp->reported_req_id < buf_done_req_id) {
+				ctx_isp->reported_req_id = buf_done_req_id;
+				__cam_isp_ctx_send_sof_timestamp(ctx_isp,
+					buf_done_req_id,
+					CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+			}
+		}
+		list_del_init(&req->list);
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		req_isp->reapply_type = CAM_CONFIG_REAPPLY_NONE;
+		req_isp->cdm_reset_before_apply = false;
+		req_isp->num_acked = 0;
+		req_isp->num_deferred_acks = 0;
+		/*
+		 * Only update the process_bubble and bubble_frame_cnt
+		 * when bubble is detected on this req, in case the other
+		 * request is processing bubble.
+		 */
+		if (req_isp->bubble_detected) {
+			atomic_set(&ctx_isp->process_bubble, 0);
+			ctx_isp->bubble_frame_cnt = 0;
+			req_isp->bubble_detected = false;
+		}
+		CAM_DBG(CAM_REQ,
+			"Move active request %lld to free list(cnt = %d) [all fences done], ctx %u link: 0x%x",
+			buf_done_req_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->req_info.last_bufdone_req_id = req->request_id;
+		ctx_isp->last_bufdone_err_apply_req_id = 0;
+	}
+
+	if (atomic_read(&ctx_isp->internal_recovery_set) && !ctx_isp->active_req_cnt)
+		__cam_isp_context_try_internal_recovery(ctx_isp);
+
+	cam_cpas_notify_event("IFE BufDone", buf_done_req_id);
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_DONE, buf_done_req_id);
+
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_BUFDONE, req, NULL);
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_buf_done_for_request(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request  *req,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state,
+	struct cam_isp_hw_done_event_data *done_next_req)
+{
+	int rc = 0;
+	int i, j, k;
+	bool not_found = false;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+	const char *handle_type;
+	struct cam_isp_context_comp_record *comp_grp = NULL;
+
+	trace_cam_buf_done("ISP", ctx, req);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	CAM_DBG(CAM_ISP, "Enter with bubble_state %d, req_bubble_detected %d, ctx %u link: 0x%x",
+		bubble_state, req_isp->bubble_detected, ctx->ctx_id, ctx->link_hdl);
+
+	done_next_req->resource_handle = 0;
+	done_next_req->timestamp = done->timestamp;
+
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		if (done->resource_handle ==
+			req_isp->fence_map_out[i].resource_handle)
+			break;
+	}
+
+	if (done->hw_type == CAM_ISP_HW_TYPE_SFE)
+		comp_grp = &ctx_isp->sfe_bus_comp_grp[done->comp_group_id];
+	else
+		comp_grp = &ctx_isp->vfe_bus_comp_grp[done->comp_group_id];
+
+	if (!comp_grp) {
+		CAM_ERR(CAM_ISP, "comp_grp is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (i == req_isp->num_fence_map_out) {
+		for (j = 0; j < comp_grp->num_res; j++) {
+			not_found = false;
+			if (comp_grp->res_id[j] == done->resource_handle)
+				continue;
+
+			for (k = 0; k < req_isp->num_fence_map_out; k++)
+				if (comp_grp->res_id[j] ==
+					req_isp->fence_map_out[k].resource_handle)
+					break;
+
+			if ((k == req_isp->num_fence_map_out) && (j != comp_grp->num_res - 1))
+				continue;
+			else if (k != req_isp->num_fence_map_out)
+				break;
+			else
+				not_found = true;
+		}
+	}
+
+	if (not_found) {
+		/*
+		 * If not found in current request, it could be
+		 * belonging to next request, this can happen if
+		 * IRQ delay happens. It is only valid when the
+		 * platform doesn't have last consumed address.
+		 */
+		CAM_WARN(CAM_ISP,
+			"BUF_DONE for res %s not found in Req %lld ",
+			__cam_isp_resource_handle_id_to_type(
+			ctx_isp->isp_device_type,
+			done->resource_handle),
+			req->request_id);
+
+		done_next_req->hw_type = done->hw_type;
+		done_next_req->resource_handle = done->resource_handle;
+		done_next_req->comp_group_id = done->comp_group_id;
+		goto check_deferred;
+	}
+
+	for (i = 0; i < comp_grp->num_res; i++) {
+		for (j = 0; j < req_isp->num_fence_map_out; j++) {
+			if (comp_grp->res_id[i] ==
+				req_isp->fence_map_out[j].resource_handle)
+				break;
+		}
+
+		if (j == req_isp->num_fence_map_out) {
+			/*
+			 * If not found in current request, it could be
+			 * belonging to an active port with no valid fence
+			 * bound to it, we needn't process it.
+			 */
+			CAM_DBG(CAM_ISP,
+				"BUF_DONE for res %s not active in Req %lld ctx %u link: 0x%x",
+				__cam_isp_resource_handle_id_to_type(
+				ctx_isp->isp_device_type,
+				comp_grp->res_id[i]),
+				req->request_id, ctx->ctx_id, ctx->link_hdl);
+			continue;
+		}
+
+		if (req_isp->fence_map_out[j].sync_id == -1) {
+			handle_type =
+				__cam_isp_resource_handle_id_to_type(
+				ctx_isp->isp_device_type,
+				req_isp->fence_map_out[j].resource_handle);
+
+			CAM_WARN(CAM_ISP,
+				"Duplicate BUF_DONE for req %lld : i=%d, j=%d, res=%s, ctx %u link: 0x%x",
+				req->request_id, i, j, handle_type, ctx->ctx_id, ctx->link_hdl);
+
+			trace_cam_log_event("Duplicate BufDone",
+				handle_type, req->request_id, ctx->ctx_id);
+			continue;
+		}
+
+		/* Get buf handles from packet and retrieve them from presil framework */
+		if (cam_presil_mode_enabled()) {
+			rc = cam_presil_retrieve_buffers_from_packet(req_isp->hw_update_data.packet,
+				ctx->img_iommu_hdl, req_isp->fence_map_out[j].resource_handle);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed to retrieve image buffers req_id:%d ctx_id:%u link: 0x%x bubble detected:%d rc:%d",
+					req->request_id, ctx->ctx_id, ctx->link_hdl,
+					req_isp->bubble_detected, rc);
+				return rc;
+			}
+		}
+
+		if (!req_isp->bubble_detected) {
+			handle_type = __cam_isp_resource_handle_id_to_type(
+				ctx_isp->isp_device_type,
+				req_isp->fence_map_out[j].resource_handle);
+			CAM_DBG(CAM_ISP,
+				"Sync with success: req %lld res 0x%x fd 0x%x, ctx %u link: 0x%x port %s",
+				req->request_id,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id,
+				ctx->ctx_id, ctx->link_hdl, handle_type);
+
+			cam_smmu_buffer_tracker_buffer_putref(
+				req_isp->fence_map_out[j].buffer_tracker);
+
+			rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_SUCCESS,
+				CAM_SYNC_COMMON_EVENT_SUCCESS);
+			if (rc)
+				CAM_DBG(CAM_ISP, "Sync failed with rc = %d, ctx %u link: 0x%x",
+					 rc, ctx->ctx_id, ctx->link_hdl);
+		} else if (!req_isp->bubble_report) {
+			CAM_DBG(CAM_ISP,
+				"Sync with failure: req %lld res 0x%x fd 0x%x, ctx %u link: 0x%x",
+				req->request_id,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id,
+				ctx->ctx_id, ctx->link_hdl);
+
+			cam_smmu_buffer_tracker_buffer_putref(
+				req_isp->fence_map_out[j].buffer_tracker);
+
+			rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_ERROR,
+				CAM_SYNC_ISP_EVENT_BUBBLE);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Sync failed with rc = %d, ctx %u link: 0x%x",
+					rc, ctx->ctx_id, ctx->link_hdl);
+		} else {
+			/*
+			 * Ignore the buffer done if bubble detect is on
+			 * Increment the ack number here, and queue the
+			 * request back to pending list whenever all the
+			 * buffers are done.
+			 */
+			req_isp->num_acked++;
+			CAM_DBG(CAM_ISP,
+				"buf done with bubble state %d recovery %d for req %lld, ctx %u link: 0x%x",
+				bubble_state,
+				req_isp->bubble_report,
+				req->request_id,
+				ctx->ctx_id, ctx->link_hdl);
+			continue;
+		}
+
+		CAM_DBG(CAM_ISP, "req %lld, reset sync id 0x%x ctx %u link: 0x%x",
+			req->request_id,
+			req_isp->fence_map_out[j].sync_id, ctx->ctx_id, ctx->link_hdl);
+		if (!rc) {
+			req_isp->num_acked++;
+			req_isp->fence_map_out[j].sync_id = -1;
+		}
+
+		if ((ctx_isp->use_frame_header_ts) &&
+			(req_isp->hw_update_data.frame_header_res_id ==
+			req_isp->fence_map_out[j].resource_handle))
+			__cam_isp_ctx_send_sof_timestamp_frame_header(
+				ctx_isp,
+				req_isp->hw_update_data.frame_header_cpu_addr,
+				req->request_id, CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	}
+
+check_deferred:
+	if (req_isp->num_acked > req_isp->num_fence_map_out) {
+		/* Should not happen */
+		CAM_ERR(CAM_ISP,
+			"WARNING: req_id %lld num_acked %d > map_out %d, ctx %u link: 0x%x",
+			req->request_id, req_isp->num_acked,
+			req_isp->num_fence_map_out, ctx->ctx_id, ctx->link_hdl);
+		WARN_ON(req_isp->num_acked > req_isp->num_fence_map_out);
+	}
+
+	if (req_isp->num_acked != req_isp->num_fence_map_out)
+		return rc;
+
+	rc = __cam_isp_ctx_handle_buf_done_for_req_list(ctx_isp, req);
+	return rc;
+}
+
+static int __cam_isp_handle_deferred_buf_done(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request  *req,
+	bool bubble_handling,
+	uint32_t status, uint32_t event_cause)
+{
+	int i, j;
+	int rc = 0;
+	struct cam_isp_ctx_req *req_isp =
+		(struct cam_isp_ctx_req *) req->req_priv;
+	struct cam_context *ctx = ctx_isp->base;
+
+	CAM_DBG(CAM_ISP,
+		"ctx[%u] link[0x%x] : Req %llu : Handling %d deferred buf_dones num_acked=%d, bubble_handling=%d",
+		ctx->ctx_id, ctx->link_hdl, req->request_id, req_isp->num_deferred_acks,
+		req_isp->num_acked, bubble_handling);
+
+	for (i = 0; i < req_isp->num_deferred_acks; i++) {
+		j = req_isp->deferred_fence_map_index[i];
+
+		CAM_DBG(CAM_ISP,
+			"ctx[%u] link[0x%x] : Sync with status=%d, event_cause=%d: req %lld res 0x%x sync_id 0x%x",
+			ctx->ctx_id, ctx->link_hdl, status, event_cause,
+			req->request_id,
+			req_isp->fence_map_out[j].resource_handle,
+			req_isp->fence_map_out[j].sync_id);
+
+		if (req_isp->fence_map_out[j].sync_id == -1) {
+			CAM_WARN(CAM_ISP,
+				"ctx[%u] link[0x%x] :  Deferred buf_done already signalled, req_id=%llu, j=%d, res=0x%x",
+				ctx->ctx_id, ctx->link_hdl, req->request_id, j,
+				req_isp->fence_map_out[j].resource_handle);
+			continue;
+		}
+
+		if (!bubble_handling) {
+			CAM_WARN(CAM_ISP,
+				"Unexpected Buf done for res=0x%x on ctx[%u] link[0x%x] for Req %llu, status=%d, possible bh delays",
+				req_isp->fence_map_out[j].resource_handle, ctx->ctx_id,
+				ctx->link_hdl, req->request_id, status);
+
+			rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+				status, event_cause);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"ctx[%u] link[0x%x] : Sync signal for Req %llu, sync_id %d status=%d failed with rc = %d",
+					ctx->ctx_id, ctx->link_hdl, req->request_id,
+					req_isp->fence_map_out[j].sync_id,
+					status, rc);
+			} else {
+				req_isp->num_acked++;
+				req_isp->fence_map_out[j].sync_id = -1;
+			}
+		} else {
+			req_isp->num_acked++;
+		}
+	}
+
+	CAM_DBG(CAM_ISP,
+		"ctx[%u] link[0x%x] : Req %llu : Handled %d deferred buf_dones num_acked=%d, num_fence_map_out=%d",
+		ctx->ctx_id, ctx->link_hdl, req->request_id, req_isp->num_deferred_acks,
+		req_isp->num_acked, req_isp->num_fence_map_out);
+
+	req_isp->num_deferred_acks = 0;
+
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_deferred_buf_done_in_bubble(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request  *req)
+{
+	int                     rc = 0;
+	struct cam_context     *ctx = ctx_isp->base;
+	struct cam_isp_ctx_req *req_isp;
+
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+
+	if (req_isp->num_deferred_acks)
+		rc = __cam_isp_handle_deferred_buf_done(ctx_isp, req,
+			req_isp->bubble_report,
+			CAM_SYNC_STATE_SIGNALED_ERROR,
+			CAM_SYNC_ISP_EVENT_BUBBLE);
+
+	if (req_isp->num_acked > req_isp->num_fence_map_out) {
+		/* Should not happen */
+		CAM_ERR(CAM_ISP,
+			"WARNING: req_id %lld num_acked %d > map_out %d, ctx %u, link[0x%x]",
+			req->request_id, req_isp->num_acked,
+			req_isp->num_fence_map_out, ctx->ctx_id, ctx->link_hdl);
+		WARN_ON(req_isp->num_acked > req_isp->num_fence_map_out);
+	}
+
+	if (req_isp->num_acked == req_isp->num_fence_map_out)
+		rc = __cam_isp_ctx_handle_buf_done_for_req_list(ctx_isp, req);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_buf_done_for_request_verify_addr(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request  *req,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state,
+	bool verify_consumed_addr,
+	bool defer_buf_done)
+{
+	int rc = 0;
+	int i, j, k, def_idx;
+	bool not_found = false;
+	bool duplicate_defer_buf_done = false;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+	const char *handle_type;
+	uint32_t cmp_addr = 0;
+	struct cam_isp_hw_done_event_data   unhandled_done = {0};
+	struct cam_isp_context_comp_record *comp_grp = NULL;
+	struct cam_hw_cmd_args   hw_cmd_args;
+	struct cam_isp_hw_cmd_args  isp_hw_cmd_args;
+
+	trace_cam_buf_done("ISP", ctx, req);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	CAM_DBG(CAM_ISP, "Enter with bubble_state %d, req_bubble_detected %d, ctx %u, link[0x%x]",
+		bubble_state, req_isp->bubble_detected, ctx->ctx_id, ctx->link_hdl);
+
+	unhandled_done.timestamp = done->timestamp;
+
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		if (done->resource_handle ==
+			req_isp->fence_map_out[i].resource_handle) {
+			cmp_addr = cam_smmu_is_expanded_memory() ? CAM_36BIT_INTF_GET_IOVA_BASE(
+				req_isp->fence_map_out[i].image_buf_addr[0]) :
+				req_isp->fence_map_out[i].image_buf_addr[0];
+			if (!verify_consumed_addr ||
+				(verify_consumed_addr && (done->last_consumed_addr == cmp_addr))) {
+				break;
+			}
+		}
+	}
+
+	if (done->hw_type == CAM_ISP_HW_TYPE_SFE)
+		comp_grp = &ctx_isp->sfe_bus_comp_grp[done->comp_group_id];
+	else
+		comp_grp = &ctx_isp->vfe_bus_comp_grp[done->comp_group_id];
+
+	if (!comp_grp) {
+		CAM_ERR(CAM_ISP, "comp_grp is NULL for hw_type: %d", done->hw_type);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (i == req_isp->num_fence_map_out) {
+		not_found = true;
+		for (j = 0; j < comp_grp->num_res; j++) {
+			/* If the res is same with original res, we don't need to read again  */
+			if (comp_grp->res_id[j] == done->resource_handle)
+				continue;
+
+			/* Check if the res in the requested list */
+			for (k = 0; k < req_isp->num_fence_map_out; k++)
+				if (comp_grp->res_id[j] ==
+					req_isp->fence_map_out[k].resource_handle)
+					break;
+
+			/* If res_id[j] isn't in requested list, then try next res in the group */
+			if (k == req_isp->num_fence_map_out) {
+				if (j != comp_grp->num_res - 1)
+					continue;
+				else
+					break;
+			}
+
+			if (!verify_consumed_addr) {
+				not_found = false;
+				break;
+			}
+
+			/*
+			 * Find out the res from the requested list,
+			 * then we can get last consumed address from this port.
+			 */
+			done->resource_handle = comp_grp->res_id[j];
+			done->last_consumed_addr = 0;
+
+			hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+			hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+			isp_hw_cmd_args.cmd_type =
+				CAM_ISP_HW_MGR_GET_LAST_CONSUMED_ADDR;
+			isp_hw_cmd_args.cmd_data = done;
+			hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+			rc = ctx->hw_mgr_intf->hw_cmd(
+				ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "HW command failed, ctx %u, link: 0x%x",
+					ctx->ctx_id, ctx->link_hdl);
+				return rc;
+			}
+
+			cmp_addr = cam_smmu_is_expanded_memory() ?
+				CAM_36BIT_INTF_GET_IOVA_BASE(
+				req_isp->fence_map_out[k].image_buf_addr[0]) :
+				req_isp->fence_map_out[k].image_buf_addr[0];
+			CAM_DBG(CAM_ISP,
+				"Get res %s comp_grp_rec_idx:%d fence_map_idx:%d last_consumed_addr:0x%x cmp_addr:0x%x",
+				__cam_isp_resource_handle_id_to_type(
+				ctx_isp->isp_device_type, done->resource_handle), j, k,
+				done->last_consumed_addr, cmp_addr);
+			if (done->last_consumed_addr == cmp_addr) {
+				CAM_DBG(CAM_ISP, "Consumed addr compare success for res:%s ",
+					__cam_isp_resource_handle_id_to_type(
+				ctx_isp->isp_device_type, done->resource_handle));
+				not_found = false;
+				break;
+			}
+		}
+	}
+
+	if (not_found) {
+		/*
+		 * If not found in current request, it could be
+		 * belonging to next request, this can happen if
+		 * IRQ delay happens. It is only valid when the
+		 * platform doesn't have last consumed address.
+		 */
+		CAM_WARN(CAM_ISP,
+			"BUF_DONE for res %s last_consumed_addr:0x%x not found in Req %lld ",
+			__cam_isp_resource_handle_id_to_type(
+			ctx_isp->isp_device_type, done->resource_handle),
+			done->last_consumed_addr,
+			req->request_id);
+
+		unhandled_done.hw_type = done->hw_type;
+		unhandled_done.resource_handle = done->resource_handle;
+		unhandled_done.comp_group_id = done->comp_group_id;
+		unhandled_done.last_consumed_addr = done->last_consumed_addr;
+		goto check_deferred;
+	}
+
+	for (i = 0; i < comp_grp->num_res; i++) {
+		for (j = 0; j < req_isp->num_fence_map_out; j++) {
+			if (comp_grp->res_id[i] ==
+				req_isp->fence_map_out[j].resource_handle)
+				break;
+		}
+
+		if (j == req_isp->num_fence_map_out) {
+			/*
+			 * If not found in current request, it could be
+			 * belonging to an active port with no valid fence
+			 * bound to it, we needn't process it.
+			 */
+			CAM_DBG(CAM_ISP,
+				"BUF_DONE for res %s not active in Req %lld ctx %u, link[0x%x]",
+				__cam_isp_resource_handle_id_to_type(
+				ctx_isp->isp_device_type, comp_grp->res_id[i]),
+				req->request_id, ctx->ctx_id, ctx->link_hdl);
+			continue;
+		}
+
+		if (req_isp->fence_map_out[j].sync_id == -1) {
+			handle_type = __cam_isp_resource_handle_id_to_type(
+				ctx_isp->isp_device_type,
+				req_isp->fence_map_out[j].resource_handle);
+
+			CAM_WARN(CAM_ISP,
+				"Duplicate BUF_DONE for req %lld : i=%d, j=%d, res=%s, ctx %u, link[0x%x]",
+				req->request_id, i, j, handle_type, ctx->ctx_id, ctx->link_hdl);
+
+			trace_cam_log_event("Duplicate BufDone",
+				handle_type, req->request_id, ctx->ctx_id);
+			continue;
+		}
+
+		/* Get buf handles from packet and retrieve them from presil framework */
+		if (cam_presil_mode_enabled()) {
+			rc = cam_presil_retrieve_buffers_from_packet(req_isp->hw_update_data.packet,
+				ctx->img_iommu_hdl, req_isp->fence_map_out[j].resource_handle);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed to retrieve image buffers req_id:%d ctx_id:%u link[0x%x] bubble detected:%d rc:%d",
+					req->request_id, ctx->ctx_id, ctx->link_hdl,
+					req_isp->bubble_detected, rc);
+				return rc;
+			}
+		}
+
+		if (defer_buf_done) {
+			uint32_t deferred_indx = req_isp->num_deferred_acks;
+			duplicate_defer_buf_done = false;
+
+			for (k = 0; k < req_isp->num_deferred_acks; k++) {
+				def_idx = req_isp->deferred_fence_map_index[k];
+				if (def_idx == j) {
+					CAM_WARN(CAM_ISP,
+						"duplicate deferred ack for ctx[%u] link[0x%x] req %lld res 0x%x sync_id 0x%x",
+						ctx->ctx_id, ctx->link_hdl,
+						req->request_id,
+						req_isp->fence_map_out[j].resource_handle,
+						req_isp->fence_map_out[j].sync_id);
+					duplicate_defer_buf_done = true;
+					break;
+				}
+			}
+
+			if (duplicate_defer_buf_done)
+				continue;
+
+			if (req_isp->num_deferred_acks == req_isp->num_fence_map_out) {
+				CAM_WARN(CAM_ISP,
+					"WARNING: req_id %lld num_deferred_acks %d > map_out %d, ctx_idx:%u link[0x%x]",
+					req->request_id, req_isp->num_deferred_acks,
+					req_isp->num_fence_map_out, ctx->ctx_id, ctx->link_hdl);
+				continue;
+			}
+
+			/*
+			 * If we are handling this BUF_DONE event for a request
+			 * that is still in wait_list, do not signal now,
+			 * instead mark it as done and handle it later -
+			 * if this request is going into BUBBLE state later
+			 * it will automatically be re-applied. If this is not
+			 * going into BUBBLE, signal fences later.
+			 * Note - we will come here only if the last consumed
+			 * address matches with this ports buffer.
+			 */
+			req_isp->deferred_fence_map_index[deferred_indx] = j;
+			req_isp->num_deferred_acks++;
+			CAM_DBG(CAM_ISP,
+				"ctx[%u] link[0x%x]:Deferred buf done for %llu with bubble state %d recovery %d",
+				ctx->ctx_id, ctx->link_hdl, req->request_id, bubble_state,
+				req_isp->bubble_report);
+			CAM_DBG(CAM_ISP,
+				"ctx[%u] link[0x%x]:Deferred info:num_acks=%d,fence_map_index=%d,resource_handle=0x%x,sync_id=%d",
+				ctx->ctx_id, ctx->link_hdl, req_isp->num_deferred_acks, j,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id);
+			continue;
+		} else if (!req_isp->bubble_detected) {
+			CAM_DBG(CAM_ISP,
+				"Sync with success: req %lld res 0x%x fd 0x%x, ctx %u res %s",
+				req->request_id,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id,
+				ctx->ctx_id,
+				__cam_isp_resource_handle_id_to_type(ctx_isp->isp_device_type,
+				req_isp->fence_map_out[j].resource_handle));
+
+			cam_smmu_buffer_tracker_buffer_putref(
+				req_isp->fence_map_out[j].buffer_tracker);
+
+			rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_SUCCESS,
+				CAM_SYNC_COMMON_EVENT_SUCCESS);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Sync=%u for req=%llu failed with rc=%d ctx:%u link[0x%x]",
+					req_isp->fence_map_out[j].sync_id, req->request_id,
+					rc, ctx->ctx_id, ctx->link_hdl);
+			} else if (req_isp->num_deferred_acks) {
+				/* Process deferred buf_done acks */
+				__cam_isp_handle_deferred_buf_done(ctx_isp,
+					req, false,
+					CAM_SYNC_STATE_SIGNALED_SUCCESS,
+					CAM_SYNC_COMMON_EVENT_SUCCESS);
+			}
+			/* Reset fence */
+			req_isp->fence_map_out[j].sync_id = -1;
+		} else if (!req_isp->bubble_report) {
+
+			CAM_DBG(CAM_ISP,
+				"Sync with failure: req %lld res 0x%x fd 0x%x, ctx:%u link[0x%x]",
+				req->request_id,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id,
+				ctx->ctx_id, ctx->link_hdl);
+
+			cam_smmu_buffer_tracker_buffer_putref(
+				req_isp->fence_map_out[j].buffer_tracker);
+
+			rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_ERROR,
+				CAM_SYNC_ISP_EVENT_BUBBLE);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Sync:%u for req:%llu failed with rc:%d,ctx:%u,link[0x%x]",
+					req_isp->fence_map_out[j].sync_id, req->request_id,
+					rc, ctx->ctx_id, ctx->link_hdl);
+			} else if (req_isp->num_deferred_acks) {
+				/* Process deferred buf_done acks */
+				__cam_isp_handle_deferred_buf_done(ctx_isp, req,
+					false,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+			}
+			/* Reset fence */
+			req_isp->fence_map_out[j].sync_id = -1;
+		} else {
+			/*
+			 * Ignore the buffer done if bubble detect is on
+			 * Increment the ack number here, and queue the
+			 * request back to pending list whenever all the
+			 * buffers are done.
+			 */
+			req_isp->num_acked++;
+			CAM_DBG(CAM_ISP,
+				"buf done with bubble state %d recovery %d for req %lld, ctx_idx:%u link[0x%x]",
+				bubble_state,
+				req_isp->bubble_report,
+				req->request_id,
+				ctx->ctx_id, ctx->link_hdl);
+
+			/* Process deferred buf_done acks */
+			if (req_isp->num_deferred_acks)
+				__cam_isp_handle_deferred_buf_done(ctx_isp, req,
+					true,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+
+			if (req_isp->num_acked == req_isp->num_fence_map_out) {
+				rc = __cam_isp_ctx_handle_buf_done_for_req_list(ctx_isp, req);
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"Error in buf done for req = %llu with rc = %d, ctx_idx:%u link[0x%x]",
+						req->request_id, rc, ctx->ctx_id, ctx->link_hdl);
+				return rc;
+			}
+			continue;
+		}
+
+		CAM_DBG(CAM_ISP, "req %lld, reset sync id 0x%x ctx_idx:%u link[0x%x]",
+			req->request_id,
+			req_isp->fence_map_out[j].sync_id, ctx->ctx_id, ctx->link_hdl);
+		if (!rc) {
+			req_isp->num_acked++;
+		}
+
+		if ((ctx_isp->use_frame_header_ts) &&
+			(req_isp->hw_update_data.frame_header_res_id ==
+			req_isp->fence_map_out[j].resource_handle))
+			__cam_isp_ctx_send_sof_timestamp_frame_header(
+				ctx_isp,
+				req_isp->hw_update_data.frame_header_cpu_addr,
+				req->request_id, CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	}
+
+check_deferred:
+	if ((unhandled_done.resource_handle > 0) && (!defer_buf_done))
+		__cam_isp_ctx_check_deferred_buf_done(
+			ctx_isp, &unhandled_done, bubble_state);
+
+	if (req_isp->num_acked > req_isp->num_fence_map_out) {
+		/* Should not happen */
+		CAM_ERR(CAM_ISP,
+			"WARNING: req_id %lld num_acked %d > map_out %d, ctx_idx:%u link[0x%x]",
+			req->request_id, req_isp->num_acked,
+			req_isp->num_fence_map_out, ctx->ctx_id, ctx->link_hdl);
+	}
+
+	if (req_isp->num_acked != req_isp->num_fence_map_out)
+		return rc;
+
+	rc = __cam_isp_ctx_handle_buf_done_for_req_list(ctx_isp, req);
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_buf_done(
+	struct cam_isp_context *ctx_isp,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state)
+{
+	int rc = 0;
+	struct cam_ctx_request *req;
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_isp_hw_done_event_data done_next_req = {0};
+
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_WARN(CAM_ISP, "Buf done with no active request, ctx_idx:%u link[0x%x]",
+			ctx->ctx_id, ctx->link_hdl);
+		return 0;
+	}
+
+	req = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+
+	rc = __cam_isp_ctx_handle_buf_done_for_request(ctx_isp, req, done,
+		bubble_state, &done_next_req);
+
+	if (done_next_req.resource_handle) {
+		struct cam_isp_hw_done_event_data unhandled_res = {0};
+		struct cam_ctx_request  *next_req = list_last_entry(
+			&ctx->active_req_list, struct cam_ctx_request, list);
+
+		if (next_req->request_id != req->request_id) {
+			/*
+			 * Few resource handles are already signalled in the
+			 * current request, lets check if there is another
+			 * request waiting for these resources. This can
+			 * happen if handling some of next request's buf done
+			 * events are happening first before handling current
+			 * request's remaining buf dones due to IRQ scheduling.
+			 * Lets check only one more request as we will have
+			 * maximum of 2 requests in active_list at any time.
+			 */
+
+			CAM_WARN(CAM_ISP,
+				"Unhandled bufdone resources for req %lld,trying next request %lld,ctx:%u link[0x%x]",
+				req->request_id, next_req->request_id, ctx->ctx_id, ctx->link_hdl);
+
+			__cam_isp_ctx_handle_buf_done_for_request(ctx_isp,
+				next_req, &done_next_req,
+				bubble_state, &unhandled_res);
+
+			if (unhandled_res.resource_handle == 0)
+				CAM_INFO(CAM_ISP,
+					"BUF Done event handed for next request %lld, ctx_idx:%u link[0x%x]",
+					next_req->request_id, ctx->ctx_id, ctx->link_hdl);
+			else
+				CAM_ERR(CAM_ISP,
+					"BUF Done not handled for next request %lld, ctx_idx:%u link[0x%x]",
+					next_req->request_id, ctx->ctx_id, ctx->link_hdl);
+		} else {
+			CAM_WARN(CAM_ISP,
+				"Req %lld only active request, spurious buf_done rxd, ctx_idx:%u link[0x%x]",
+				req->request_id, ctx->ctx_id, ctx->link_hdl);
+		}
+	}
+
+	return rc;
+}
+
+static void __cam_isp_ctx_buf_done_match_req(
+	struct cam_ctx_request *req,
+	struct cam_isp_hw_done_event_data *done,
+	bool *irq_delay_detected)
+{
+	int i;
+	uint32_t match_count = 0;
+	struct cam_isp_ctx_req *req_isp;
+	uint32_t cmp_addr = 0;
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		cmp_addr = cam_smmu_is_expanded_memory() ? CAM_36BIT_INTF_GET_IOVA_BASE(
+			req_isp->fence_map_out[i].image_buf_addr[0]) :
+			req_isp->fence_map_out[i].image_buf_addr[0];
+		if ((done->resource_handle ==
+			 req_isp->fence_map_out[i].resource_handle) &&
+			(done->last_consumed_addr == cmp_addr)) {
+			match_count++;
+			break;
+		}
+	}
+
+	if (match_count > 0)
+		*irq_delay_detected = true;
+	else
+		*irq_delay_detected = false;
+
+	CAM_DBG(CAM_ISP,
+		"buf done num handles %d match count %d for next req:%lld",
+		done->resource_handle, match_count, req->request_id);
+	CAM_DBG(CAM_ISP,
+		"irq_delay_detected %d", *irq_delay_detected);
+}
+
+static void __cam_isp_ctx_try_buf_done_process_for_active_request(
+	uint32_t deferred_ack_start_idx, struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request *deferred_req)
+{
+	int i, j, deferred_map_idx, rc;
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_ctx_request *curr_active_req;
+	struct cam_isp_ctx_req *curr_active_isp_req;
+	struct cam_isp_ctx_req *deferred_isp_req;
+
+	if (list_empty(&ctx->active_req_list))
+		return;
+
+	curr_active_req = list_first_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+	curr_active_isp_req = (struct cam_isp_ctx_req *)curr_active_req->req_priv;
+	deferred_isp_req = (struct cam_isp_ctx_req *)deferred_req->req_priv;
+
+	/* Check from newly updated deferred acks */
+	for (i = deferred_ack_start_idx; i < deferred_isp_req->num_deferred_acks; i++) {
+		deferred_map_idx = deferred_isp_req->deferred_fence_map_index[i];
+
+		for (j = 0; j < curr_active_isp_req->num_fence_map_out; j++) {
+			/* resource needs to match */
+			if (curr_active_isp_req->fence_map_out[j].resource_handle !=
+				deferred_isp_req->fence_map_out[deferred_map_idx].resource_handle)
+				continue;
+
+			/* Check if fence is valid */
+			if (curr_active_isp_req->fence_map_out[j].sync_id == -1)
+				break;
+
+			CAM_WARN(CAM_ISP,
+				"Processing delayed buf done req: %llu bubble_detected: %s res: 0x%x fd: 0x%x, ctx: %u link: 0x%x [deferred req: %llu last applied: %llu]",
+				curr_active_req->request_id,
+				CAM_BOOL_TO_YESNO(curr_active_isp_req->bubble_detected),
+				curr_active_isp_req->fence_map_out[j].resource_handle,
+				curr_active_isp_req->fence_map_out[j].sync_id,
+				ctx->ctx_id, ctx->link_hdl,
+				deferred_req->request_id, ctx_isp->last_applied_req_id);
+
+			/* Signal only if bubble is not detected for this request */
+			if (!curr_active_isp_req->bubble_detected) {
+				rc = cam_sync_signal(curr_active_isp_req->fence_map_out[j].sync_id,
+					CAM_SYNC_STATE_SIGNALED_SUCCESS,
+					CAM_SYNC_COMMON_EVENT_SUCCESS);
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"Sync: %d for req: %llu failed with rc: %d, ctx: %u link: 0x%x",
+						curr_active_isp_req->fence_map_out[j].sync_id,
+						curr_active_req->request_id, rc,
+						ctx->ctx_id, ctx->link_hdl);
+
+				curr_active_isp_req->fence_map_out[j].sync_id = -1;
+			}
+
+			curr_active_isp_req->num_acked++;
+			break;
+		}
+	}
+}
+
+static int __cam_isp_ctx_check_deferred_buf_done(
+	struct cam_isp_context *ctx_isp,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state)
+{
+	int rc = 0;
+	uint32_t curr_num_deferred = 0;
+	struct cam_ctx_request *req;
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_isp_ctx_req *req_isp;
+	bool  req_in_pending_wait_list = false;
+
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		curr_num_deferred = req_isp->num_deferred_acks;
+
+		req_in_pending_wait_list = true;
+		if (ctx_isp->last_applied_req_id !=
+			ctx_isp->last_bufdone_err_apply_req_id) {
+			CAM_DBG(CAM_ISP,
+				"Trying to find buf done with req in wait list, req %llu last apply id:%lld last err id:%lld curr_num_deferred: %u, ctx: %u link: 0x%x",
+				req->request_id, ctx_isp->last_applied_req_id,
+				ctx_isp->last_bufdone_err_apply_req_id, curr_num_deferred,
+				ctx->ctx_id, ctx->link_hdl);
+			ctx_isp->last_bufdone_err_apply_req_id =
+				ctx_isp->last_applied_req_id;
+		}
+
+		/*
+		 * Verify consumed address for this request to make sure
+		 * we are handling the buf_done for the correct
+		 * buffer. Also defer actual buf_done handling, i.e
+		 * do not signal the fence as this request may go into
+		 * Bubble state eventully.
+		 */
+		rc = __cam_isp_ctx_handle_buf_done_for_request_verify_addr(
+			ctx_isp, req, done, bubble_state, true, true);
+
+		/* Check for active req if any deferred is processed */
+		if (req_isp->num_deferred_acks > curr_num_deferred)
+			__cam_isp_ctx_try_buf_done_process_for_active_request(
+				curr_num_deferred, ctx_isp, req);
+	} else if (!list_empty(&ctx->pending_req_list)) {
+		/*
+		 * We saw the case that the hw config is blocked due to
+		 * some reason, the we get the reg upd and buf done before
+		 * the req is added to wait req list.
+		 */
+		req = list_first_entry(&ctx->pending_req_list,
+			struct cam_ctx_request, list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		curr_num_deferred = req_isp->num_deferred_acks;
+
+		req_in_pending_wait_list = true;
+		if (ctx_isp->last_applied_req_id !=
+			ctx_isp->last_bufdone_err_apply_req_id) {
+			CAM_DBG(CAM_ISP,
+				"Trying to find buf done with req in pending list, req %llu last apply id:%lld last err id:%lld curr_num_deferred: %u, ctx: %u link: 0x%x",
+				req->request_id, ctx_isp->last_applied_req_id,
+				ctx_isp->last_bufdone_err_apply_req_id, curr_num_deferred,
+				ctx->ctx_id, ctx->link_hdl);
+			ctx_isp->last_bufdone_err_apply_req_id =
+				ctx_isp->last_applied_req_id;
+		}
+
+		/*
+		 * Verify consumed address for this request to make sure
+		 * we are handling the buf_done for the correct
+		 * buffer. Also defer actual buf_done handling, i.e
+		 * do not signal the fence as this request may go into
+		 * Bubble state eventully.
+		 */
+		rc = __cam_isp_ctx_handle_buf_done_for_request_verify_addr(
+			ctx_isp, req, done, bubble_state, true, true);
+
+		/* Check for active req if any deferred is processed */
+		if (req_isp->num_deferred_acks > curr_num_deferred)
+			__cam_isp_ctx_try_buf_done_process_for_active_request(
+				curr_num_deferred, ctx_isp, req);
+	}
+
+	if (!req_in_pending_wait_list  && (ctx_isp->last_applied_req_id !=
+		ctx_isp->last_bufdone_err_apply_req_id)) {
+		CAM_DBG(CAM_ISP,
+			"Bufdone without active request bubble_state=%d last_applied_req_id:%lld,ctx:%u link:0x%x",
+			bubble_state, ctx_isp->last_applied_req_id, ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->last_bufdone_err_apply_req_id =
+				ctx_isp->last_applied_req_id;
+	}
+
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_buf_done_verify_addr(
+	struct cam_isp_context *ctx_isp,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state)
+{
+	int rc = 0;
+	bool irq_delay_detected = false;
+	struct cam_ctx_request *req;
+	struct cam_ctx_request *next_req = NULL;
+	struct cam_context *ctx = ctx_isp->base;
+
+	if (list_empty(&ctx->active_req_list)) {
+		return __cam_isp_ctx_check_deferred_buf_done(
+			ctx_isp, done, bubble_state);
+	}
+
+	req = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+
+	if (ctx_isp->active_req_cnt > 1) {
+		next_req = list_last_entry(
+			&ctx->active_req_list,
+			struct cam_ctx_request, list);
+
+		if (next_req->request_id != req->request_id)
+			__cam_isp_ctx_buf_done_match_req(next_req, done,
+				&irq_delay_detected);
+		else
+			CAM_WARN(CAM_ISP,
+				"Req %lld only active request, spurious buf_done rxd, ctx: %u link: 0x%x",
+				req->request_id, ctx->ctx_id, ctx->link_hdl);
+	}
+
+	/*
+	 * If irq delay isn't detected, then we need to verify
+	 * the consumed address for current req, otherwise, we
+	 * can't verify the consumed address.
+	 */
+	rc = __cam_isp_ctx_handle_buf_done_for_request_verify_addr(
+		ctx_isp, req, done, bubble_state,
+		!irq_delay_detected, false);
+
+	/*
+	 * Verify the consumed address for next req all the time,
+	 * since the reported buf done event may belong to current
+	 * req, then we can't signal this event for next req.
+	 */
+	if (!rc && irq_delay_detected)
+		rc = __cam_isp_ctx_handle_buf_done_for_request_verify_addr(
+			ctx_isp, next_req, done,
+			bubble_state, true, false);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_buf_done_in_activated_state(
+	struct cam_isp_context *ctx_isp,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state)
+{
+	int rc = 0;
+
+	if (ctx_isp->support_consumed_addr)
+		rc = __cam_isp_ctx_handle_buf_done_verify_addr(
+			ctx_isp, done, bubble_state);
+	else
+		rc = __cam_isp_ctx_handle_buf_done(
+			ctx_isp, done, bubble_state);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_pending_req(
+	void *priv, void *data)
+{
+	int rc = 0;
+	int64_t prev_applied_req;
+	struct cam_context *ctx = NULL;
+	struct cam_isp_context *ctx_isp = priv;
+	struct cam_ctx_request *req;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_hw_config_args cfg = {0};
+
+	if (!ctx_isp) {
+		CAM_ERR(CAM_ISP, "Invalid ctx_isp:%pK", ctx);
+		rc = -EINVAL;
+		goto end;
+	}
+	ctx = ctx_isp->base;
+
+	if (list_empty(&ctx->pending_req_list)) {
+		CAM_DBG(CAM_ISP,
+			"No pending requests to apply, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (ctx_isp->vfps_aux_context) {
+		if (ctx_isp->substate_activated == CAM_ISP_CTX_ACTIVATED_APPLIED)
+			goto end;
+
+		if (ctx_isp->active_req_cnt >= 1)
+			goto end;
+	} else {
+		if ((ctx->state != CAM_CTX_ACTIVATED) ||
+			(ctx_isp->substate_activated == CAM_ISP_CTX_ACTIVATED_APPLIED))
+			goto end;
+
+		if (ctx_isp->active_req_cnt >= 2)
+			goto end;
+	}
+
+	spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->pending_req_list)) {
+		CAM_DBG(CAM_ISP, "No pending requests to apply");
+		rc = -EFAULT;
+		spin_unlock_bh(&ctx->lock);
+		goto end;
+	}
+	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+		list);
+	spin_unlock_bh(&ctx->lock);
+
+	if (atomic_read(&req->num_in_acked) < req->num_in_map_entries)
+		goto end;
+	atomic_set(&req->num_in_acked, 0);
+
+	CAM_DBG(CAM_REQ, "Apply request %lld in substate %d ctx_idx: %u, link: 0x%x",
+		req->request_id, ctx_isp->substate_activated, ctx->ctx_id, ctx->link_hdl);
+	if (req->request_id == 0) {
+		spin_lock_bh(&ctx->lock);
+		list_del_init(&req->list);
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		spin_unlock_bh(&ctx->lock);
+		goto end;
+	}
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	cfg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	cfg.request_id = req->request_id;
+	cfg.hw_update_entries = req_isp->cfg;
+	cfg.num_hw_update_entries = req_isp->num_cfg;
+	cfg.priv = &req_isp->hw_update_data;
+
+	/*
+	 * Offline mode may receive the SOF and REG_UPD earlier than
+	 * CDM processing return back, so we set the substate before
+	 * apply setting.
+	 */
+	spin_lock_bh(&ctx->lock);
+
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_APPLIED;
+	prev_applied_req = ctx_isp->last_applied_req_id;
+	ctx_isp->last_applied_req_id = req->request_id;
+	atomic_set(&ctx_isp->apply_in_progress, 1);
+
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->wait_req_list);
+
+	spin_unlock_bh(&ctx->lock);
+
+	rc = ctx->hw_mgr_intf->hw_config(ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"Can not apply the configuration,ctx: %u,link: 0x%x",
+				ctx->ctx_id, ctx->link_hdl);
+		spin_lock_bh(&ctx->lock);
+
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+		ctx_isp->last_applied_req_id = prev_applied_req;
+		atomic_set(&ctx_isp->apply_in_progress, 0);
+
+		list_del_init(&req->list);
+		list_add(&req->list, &ctx->pending_req_list);
+
+		spin_unlock_bh(&ctx->lock);
+	} else {
+		atomic_set(&ctx_isp->apply_in_progress, 0);
+		CAM_DBG(CAM_ISP, "New substate state %d, applied req %lld, ctx: %u, link: 0x%x",
+			CAM_ISP_CTX_ACTIVATED_APPLIED,
+			ctx_isp->last_applied_req_id, ctx->ctx_id, ctx->link_hdl);
+
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_APPLIED,
+			req->request_id);
+	}
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_start_offline(
+	void *priv, void *data)
+{
+	struct cam_hw_cmd_args           hw_cmd_args;
+	struct cam_isp_hw_cmd_args       isp_hw_cmd_args;
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+	struct cam_isp_context *ctx_isp = priv;
+
+	if (!ctx_isp) {
+		CAM_ERR(CAM_ISP, "Invalid ctx_isp:%pK", ctx);
+		rc = -EINVAL;
+		return rc;
+	}
+	ctx = ctx_isp->base;
+	memset(&hw_cmd_args, 0, sizeof(hw_cmd_args));
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_CHECK_START_OFFLINE;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+	if (rc)
+		CAM_ERR(CAM_ISP, "HW command failed");
+	return rc;
+}
+
+static int __cam_isp_ctx_schedule_start_offline(
+	struct cam_isp_context *ctx_isp)
+{
+	int rc = 0;
+	struct crm_workq_task *task;
+
+	task = cam_req_mgr_workq_get_task(ctx_isp->workq);
+	if (!task) {
+		CAM_ERR(CAM_ISP, "No task for worker");
+		return -ENOMEM;
+	}
+
+	task->process_cb = __cam_isp_ctx_start_offline;
+	rc = cam_req_mgr_workq_enqueue_task(task, ctx_isp, CRM_TASK_PRIORITY_0);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to schedule task rc:%d", rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_schedule_apply_req_offline(
+	struct cam_isp_context *ctx_isp)
+{
+	int rc = 0;
+	struct crm_workq_task *task;
+
+	task = cam_req_mgr_workq_get_task(ctx_isp->workq);
+	if (!task) {
+		CAM_ERR(CAM_ISP, "No task for worker");
+		return -ENOMEM;
+	}
+
+	task->process_cb = __cam_isp_ctx_apply_pending_req;
+	rc = cam_req_mgr_workq_enqueue_task(task, ctx_isp, CRM_TASK_PRIORITY_0);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to schedule task rc:%d", rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_offline_eof_in_activated_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc;
+	struct cam_context *ctx = ctx_isp->base;
+	CAM_DBG(CAM_ISP, "EOF frame %lld ctx %u", ctx_isp->frame_id,
+		ctx->ctx_id);
+
+
+	rc = __cam_isp_ctx_schedule_apply_req_offline(ctx_isp);
+
+	if (ctx_isp->offline_context)
+		__cam_isp_ctx_schedule_start_offline(ctx_isp);
+	return rc;
+}
+
+static int __cam_isp_ctx_offline_epoch_in_activated_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_ctx_request *req, *req_temp;
+	uint64_t request_id = 0;
+	int rc = 0;
+
+
+	CAM_DBG(CAM_ISP, "SOF frame %lld ctx %u link: 0x%x", ctx_isp->frame_id,
+		ctx->ctx_id, ctx->link_hdl);
+
+	/*
+	 * For offline it is not possible for epoch to be generated without
+	 * RUP done. IRQ scheduling delays can possibly cause this.
+	 */
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_WARN(CAM_ISP,
+			"Active list empty on ctx:%u link:0x%x - EPOCH serviced before RUP",
+			ctx->ctx_id, ctx->link_hdl);
+	} else {
+		list_for_each_entry_safe(req, req_temp, &ctx->active_req_list, list) {
+			if (req->request_id > ctx_isp->reported_req_id) {
+				request_id = req->request_id;
+				ctx_isp->reported_req_id = request_id;
+				break;
+			}
+		}
+	}
+
+	/*
+	 * If no valid request, wait for RUP shutter posted after buf done
+	 */
+	if (request_id)
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH,
+		request_id);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_reg_upd_in_epoch_bubble_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	if (ctx_isp->frame_id == 1)
+		CAM_DBG(CAM_ISP, "Reg update in Substate[%s] for early PCR",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated));
+	else
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"ctx:%u Unexpected regupdate in activated Substate[%s] for frame_id:%lld",
+			ctx_isp->base->ctx_id,
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated),
+			ctx_isp->frame_id);
+	return 0;
+}
+
+static int __cam_isp_ctx_reg_upd_in_applied_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_ctx_request  *req;
+	struct cam_context      *ctx = ctx_isp->base;
+	struct cam_isp_ctx_req  *req_isp;
+	uint64_t                 request_id = 0;
+
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+	req = list_first_entry(&ctx->wait_req_list,
+		struct cam_ctx_request, list);
+	list_del_init(&req->list);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	if (req_isp->num_fence_map_out != 0) {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		request_id = req->request_id;
+		CAM_DBG(CAM_REQ,
+			"move request %lld to active list(cnt = %d), ctx %u, link: 0x%x",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_RUP, req, NULL);
+	} else {
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		/* no io config, so the request is completed. */
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		CAM_DBG(CAM_ISP,
+			"move active request %lld to free list(cnt = %d), ctx %u, link: 0x%x",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+	}
+
+	/*
+	 * This function only called directly from applied and bubble applied
+	 * state so change substate here.
+	 */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
+	CAM_DBG(CAM_ISP, "next Substate[%s], ctx %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE, request_id);
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_offline_epoch_in_bubble_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Offline IFE RUP missed!");
+	rc = __cam_isp_ctx_reg_upd_in_applied_state(ctx_isp, evt_data);
+	if (!rc)
+		rc = __cam_isp_ctx_offline_epoch_in_activated_state(ctx_isp,
+				 evt_data);
+	return rc;
+}
+
+static int __cam_isp_ctx_notify_sof_in_activated_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	uint64_t  request_id  = 0;
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_ctx_request  *req;
+	struct cam_isp_ctx_req  *req_isp;
+	struct cam_hw_cmd_args   hw_cmd_args;
+	struct cam_isp_hw_cmd_args  isp_hw_cmd_args;
+	uint64_t last_cdm_done_req = 0;
+	struct cam_isp_hw_epoch_event_data *epoch_done_event_data =
+			(struct cam_isp_hw_epoch_event_data *)evt_data;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "invalid event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id_meta = epoch_done_event_data->frame_id_meta;
+
+	if (atomic_read(&ctx_isp->process_bubble)) {
+		if (list_empty(&ctx->active_req_list)) {
+			CAM_ERR(CAM_ISP,
+				"No available active req in bubble, ctx %u, link: 0x%x",
+				ctx->ctx_id, ctx->link_hdl);
+			atomic_set(&ctx_isp->process_bubble, 0);
+			ctx_isp->bubble_frame_cnt = 0;
+			rc = -EINVAL;
+			return rc;
+		}
+
+		if (ctx_isp->last_sof_timestamp ==
+			ctx_isp->sof_timestamp_val) {
+			CAM_DBG(CAM_ISP,
+				"Tasklet delay detected! Bubble frame check skipped, sof_timestamp: %lld, ctx %u, link: 0x%x",
+				ctx_isp->sof_timestamp_val, ctx->ctx_id, ctx->link_hdl);
+			goto notify_only;
+		}
+
+		req = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+		if (ctx_isp->bubble_frame_cnt >= 1 &&
+			req_isp->bubble_detected) {
+			hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+			hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+			isp_hw_cmd_args.cmd_type =
+				CAM_ISP_HW_MGR_GET_LAST_CDM_DONE;
+			hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+			rc = ctx->hw_mgr_intf->hw_cmd(
+				ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "HW command failed, ctx %u, link: 0x%x",
+					ctx->ctx_id, ctx->link_hdl);
+				return rc;
+			}
+
+			last_cdm_done_req = isp_hw_cmd_args.u.last_cdm_done;
+			CAM_DBG(CAM_ISP, "last_cdm_done req: %d, ctx %u, link: 0x%x",
+				last_cdm_done_req, ctx->ctx_id, ctx->link_hdl);
+
+			if (last_cdm_done_req >= req->request_id) {
+				CAM_DBG(CAM_ISP,
+					"invalid sof event data CDM cb detected for req: %lld, possible buf_done delay, waiting for buf_done, ctx %u, link: 0x%x",
+					req->request_id, ctx->ctx_id, ctx->link_hdl);
+				ctx_isp->bubble_frame_cnt = 0;
+			} else {
+				CAM_DBG(CAM_ISP,
+					"CDM callback not happened for req: %lld, possible CDM stuck or workqueue delay, ctx %u, link: 0x%x",
+					req->request_id, ctx->ctx_id, ctx->link_hdl);
+				req_isp->num_acked = 0;
+				req_isp->num_deferred_acks = 0;
+				ctx_isp->bubble_frame_cnt = 0;
+				req_isp->bubble_detected = false;
+				req_isp->cdm_reset_before_apply = true;
+				list_del_init(&req->list);
+				list_add(&req->list, &ctx->pending_req_list);
+				atomic_set(&ctx_isp->process_bubble, 0);
+				ctx_isp->active_req_cnt--;
+				CAM_DBG(CAM_REQ,
+					"Move active req: %lld to pending list(cnt = %d) [bubble re-apply], ctx %u link: 0x%x",
+					req->request_id,
+					ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+			}
+		} else if (req_isp->bubble_detected) {
+			ctx_isp->bubble_frame_cnt++;
+			CAM_DBG(CAM_ISP,
+				"Waiting on bufdone for bubble req: %lld, since frame_cnt = %lld, ctx %u link: 0x%x",
+				req->request_id,
+				ctx_isp->bubble_frame_cnt, ctx->ctx_id, ctx->link_hdl);
+		} else {
+			CAM_DBG(CAM_ISP, "Delayed bufdone for req: %lld, ctx %u link: 0x%x",
+				req->request_id, ctx->ctx_id, ctx->link_hdl);
+		}
+	}
+
+notify_only:
+	/*
+	 * notify reqmgr with sof signal. Note, due to scheduling delay
+	 * we can run into situation that two active requests has already
+	 * be in the active queue while we try to do the notification.
+	 * In this case, we need to skip the current notification. This
+	 * helps the state machine to catch up the delay.
+	 */
+	if (ctx_isp->active_req_cnt <= 2) {
+		__cam_isp_ctx_notify_trigger_util(CAM_TRIGGER_POINT_SOF, ctx_isp);
+
+		list_for_each_entry(req, &ctx->active_req_list, list) {
+			req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+			if ((!req_isp->bubble_detected) &&
+				(req->request_id > ctx_isp->reported_req_id)) {
+				request_id = req->request_id;
+				__cam_isp_ctx_update_event_record(ctx_isp,
+					CAM_ISP_CTX_EVENT_EPOCH, req, NULL);
+				break;
+			}
+		}
+
+		if (ctx_isp->substate_activated == CAM_ISP_CTX_ACTIVATED_BUBBLE)
+			request_id = 0;
+
+		if (request_id != 0)
+			ctx_isp->reported_req_id = request_id;
+
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH,
+			request_id);
+	}
+
+	ctx_isp->last_sof_timestamp = ctx_isp->sof_timestamp_val;
+	return 0;
+}
+
+static int __cam_isp_ctx_notify_eof_in_activated_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_context *ctx = ctx_isp->base;
+	uint64_t last_cdm_done_req = 0;
+
+	/* update last cdm done timestamp */
+	rc = __cam_isp_ctx_get_cdm_done_timestamp(ctx, &last_cdm_done_req);
+	if (rc)
+		CAM_ERR(CAM_ISP, "ctx:%u link: 0x%x Failed to get timestamp from HW",
+			ctx->ctx_id, ctx->link_hdl);
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_CDM_DONE, last_cdm_done_req);
+
+	/* notify reqmgr with eof signal */
+	rc = __cam_isp_ctx_notify_trigger_util(CAM_TRIGGER_POINT_EOF, ctx_isp);
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_EOF, 0);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_reg_upd_in_hw_error(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+	return 0;
+}
+
+static int __cam_isp_ctx_sof_in_activated_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	struct cam_ctx_request *req = NULL;
+	struct cam_context *ctx = ctx_isp->base;
+	uint64_t request_id = 0;
+
+	ctx_isp->last_sof_jiffies = jiffies;
+
+	/* First check if there is a valid request in active list */
+	list_for_each_entry(req, &ctx->active_req_list, list) {
+		if (req->request_id > ctx_isp->reported_req_id) {
+			request_id = req->request_id;
+			break;
+		}
+	}
+
+	/*
+	 * If nothing in active list, current request might have not moved
+	 * from wait to active list. This could happen if REG_UPDATE to sw
+	 * is coming immediately after SOF
+	 */
+	if (request_id == 0) {
+		req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+		if (req)
+			request_id = req->request_id;
+	}
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	__cam_isp_ctx_update_sof_ts_util(sof_event_data, ctx_isp);
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_SOF, request_id);
+
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx, ctx %u request %llu, link: 0x%x",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val, ctx->ctx_id, request_id,
+		ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_reg_upd_in_sof(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_ctx_request *req = NULL;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+
+	if (ctx->state != CAM_CTX_ACTIVATED && ctx_isp->frame_id > 1) {
+		CAM_DBG(CAM_ISP, "invalid RUP");
+		goto end;
+	}
+
+	/*
+	 * This is for the first update. The initial setting will
+	 * cause the reg_upd in the first frame.
+	 */
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if (req_isp->num_fence_map_out == req_isp->num_acked)
+			__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		else
+			CAM_ERR(CAM_ISP,
+				"receive rup in unexpected state, ctx_idx: %u, link: 0x%x",
+				 ctx->ctx_id, ctx->link_hdl);
+	}
+	if (req != NULL) {
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE,
+			req->request_id);
+	}
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_epoch_in_applied(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	uint64_t request_id = 0;
+	uint32_t wait_req_cnt = 0;
+	uint32_t sof_event_status = CAM_REQ_MGR_SOF_EVENT_SUCCESS;
+	struct cam_ctx_request             *req;
+	struct cam_isp_ctx_req             *req_isp;
+	struct cam_context                 *ctx = ctx_isp->base;
+	struct cam_isp_hw_epoch_event_data *epoch_done_event_data =
+		(struct cam_isp_hw_epoch_event_data *)evt_data;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "invalid event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id_meta = epoch_done_event_data->frame_id_meta;
+	if (list_empty(&ctx->wait_req_list)) {
+		/*
+		 * If no wait req in epoch, this is an error case.
+		 * The recovery is to go back to sof state
+		 */
+		CAM_ERR(CAM_ISP, "Ctx:%u link: 0x%x No wait request", ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+
+		/* Send SOF event as empty frame*/
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_EPOCH, NULL, NULL);
+		goto end;
+	}
+
+	if (ctx_isp->last_applied_jiffies >= ctx_isp->last_sof_jiffies) {
+		list_for_each_entry(req, &ctx->wait_req_list, list) {
+			wait_req_cnt++;
+		}
+
+		/*
+		 * The previous req is applied after SOF and there is only
+		 * one applied req, we don't need to report bubble for this case.
+		 */
+		if (wait_req_cnt == 1 && !ctx_isp->is_tfe_shdr) {
+			req = list_first_entry(&ctx->wait_req_list,
+				struct cam_ctx_request, list);
+			request_id = req->request_id;
+			CAM_INFO(CAM_ISP,
+				"ctx:%d Don't report the bubble for req:%lld",
+				ctx->ctx_id, request_id);
+			goto end;
+		}
+	}
+
+	/* Update state prior to notifying CRM */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
+		list);
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	req_isp->bubble_detected = true;
+	req_isp->reapply_type = CAM_CONFIG_REAPPLY_IO;
+	req_isp->cdm_reset_before_apply = false;
+	atomic_set(&ctx_isp->process_bubble, 1);
+
+	CAM_INFO_RATE_LIMIT(CAM_ISP, "ctx:%u link: 0x%x Report Bubble flag %d req id:%lld",
+		ctx->ctx_id, ctx->link_hdl, req_isp->bubble_report, req->request_id);
+
+	if (req_isp->bubble_report) {
+		__cam_isp_ctx_notify_error_util(CAM_TRIGGER_POINT_SOF, CRM_KMD_ERR_BUBBLE,
+			req->request_id, ctx_isp);
+		trace_cam_log_event("Bubble", "Rcvd epoch in applied state",
+			req->request_id, ctx->ctx_id);
+	} else {
+		req_isp->bubble_report = 0;
+		CAM_DBG(CAM_ISP, "Skip bubble recovery for req %lld ctx %u, link: 0x%x",
+			req->request_id, ctx->ctx_id, ctx->link_hdl);
+
+		if (ctx_isp->active_req_cnt <= 1)
+			__cam_isp_ctx_notify_trigger_util(CAM_TRIGGER_POINT_SOF, ctx_isp);
+	}
+
+	/*
+	 * Always move the request to active list. Let buf done
+	 * function handles the rest.
+	 */
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->active_req_list);
+	ctx_isp->active_req_cnt++;
+	CAM_DBG(CAM_REQ, "move request %lld to active list(cnt = %d), ctx %u, link: 0x%x",
+		req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+
+	/*
+	 * Handle the deferred buf done after moving
+	 * the bubble req to active req list.
+	 */
+	__cam_isp_ctx_handle_deferred_buf_done_in_bubble(
+		ctx_isp, req);
+
+	/*
+	 * Update the record before req pointer to
+	 * other invalid req.
+	 */
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_EPOCH, req, NULL);
+
+	/*
+	 * Get the req again from active_req_list in case
+	 * the active req cnt is 2.
+	 */
+	list_for_each_entry(req, &ctx->active_req_list, list) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if ((!req_isp->bubble_report) &&
+			(req->request_id > ctx_isp->reported_req_id)) {
+			request_id = req->request_id;
+			ctx_isp->reported_req_id = request_id;
+			CAM_DBG(CAM_ISP,
+				"ctx %u link: 0x%x reported_req_id update to %lld",
+				ctx->ctx_id, ctx->link_hdl, ctx_isp->reported_req_id);
+			break;
+		}
+	}
+
+	if ((request_id != 0) && req_isp->bubble_detected)
+		sof_event_status = CAM_REQ_MGR_SOF_EVENT_ERROR;
+
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		sof_event_status);
+
+	cam_req_mgr_debug_delay_detect();
+	trace_cam_delay_detect("ISP",
+		"bubble epoch_in_applied", req->request_id,
+		ctx->ctx_id, ctx->link_hdl, ctx->session_hdl,
+		CAM_DEFAULT_VALUE);
+end:
+	if (request_id == 0) {
+		req = list_last_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, req->request_id);
+	} else {
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, request_id);
+	}
+
+	CAM_DBG(CAM_ISP, "next Substate[%s], ctx_idx: %u link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+	return 0;
+}
+
+static int __cam_isp_ctx_buf_done_in_sof(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 0);
+	return rc;
+}
+
+static int __cam_isp_ctx_buf_done_in_applied(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 0);
+	return rc;
+}
+
+
+static int __cam_isp_ctx_sof_in_epoch(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_context                    *ctx = ctx_isp->base;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	struct cam_ctx_request *req;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->last_sof_jiffies = jiffies;
+
+	if (atomic_read(&ctx_isp->apply_in_progress))
+		CAM_INFO(CAM_ISP, "Apply is in progress at the time of SOF, ctx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+	__cam_isp_ctx_update_sof_ts_util(sof_event_data, ctx_isp);
+
+	if (list_empty(&ctx->active_req_list))
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+	else
+		CAM_DBG(CAM_ISP, "Still need to wait for the buf done, ctx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+	req = list_last_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+	if (req)
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_SOF,
+			req->request_id);
+
+	if (ctx_isp->frame_id == 1)
+		CAM_INFO(CAM_ISP,
+			"First SOF in EPCR ctx:%u link: 0x%x frame_id:%lld next substate %s",
+			ctx->ctx_id, ctx->link_hdl, ctx_isp->frame_id,
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated));
+
+	CAM_DBG(CAM_ISP, "SOF in epoch ctx:%u link: 0x%x frame_id:%lld next substate:%s",
+		ctx->ctx_id, ctx->link_hdl, ctx_isp->frame_id,
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	return rc;
+}
+
+static int __cam_isp_ctx_buf_done_in_epoch(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 0);
+	return rc;
+}
+
+static int __cam_isp_ctx_buf_done_in_bubble(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 1);
+	return rc;
+}
+
+static int __cam_isp_ctx_epoch_in_bubble_applied(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	uint64_t  request_id = 0;
+	struct cam_ctx_request             *req;
+	struct cam_isp_ctx_req             *req_isp;
+	struct cam_context                 *ctx = ctx_isp->base;
+	struct cam_isp_hw_epoch_event_data *epoch_done_event_data =
+		(struct cam_isp_hw_epoch_event_data *)evt_data;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "invalid event data, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id_meta = epoch_done_event_data->frame_id_meta;
+
+	/*
+	 * This means we missed the reg upd ack. So we need to
+	 * transition to BUBBLE state again.
+	 */
+
+	if (list_empty(&ctx->wait_req_list)) {
+		/*
+		 * If no pending req in epoch, this is an error case.
+		 * Just go back to the bubble state.
+		 */
+		CAM_ERR(CAM_ISP, "ctx:%u link: 0x%x No pending request.",
+			ctx->ctx_id, ctx->link_hdl);
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_EPOCH, NULL, NULL);
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+		goto end;
+	}
+
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
+		list);
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	req_isp->bubble_detected = true;
+	CAM_INFO_RATE_LIMIT(CAM_ISP, "Ctx:%u link: 0x%x Report Bubble flag %d req id:%lld",
+		ctx->ctx_id, ctx->link_hdl, req_isp->bubble_report, req->request_id);
+	req_isp->reapply_type = CAM_CONFIG_REAPPLY_IO;
+	req_isp->cdm_reset_before_apply = false;
+
+	if (req_isp->bubble_report) {
+		__cam_isp_ctx_notify_error_util(CAM_TRIGGER_POINT_SOF, CRM_KMD_ERR_BUBBLE,
+			req->request_id, ctx_isp);
+		atomic_set(&ctx_isp->process_bubble, 1);
+	} else {
+		req_isp->bubble_report = 0;
+		CAM_DBG(CAM_ISP, "Skip bubble recovery for req %lld ctx %u link: 0x%x",
+			req->request_id, ctx->ctx_id, ctx->link_hdl);
+		if (ctx_isp->active_req_cnt <= 1)
+			__cam_isp_ctx_notify_trigger_util(CAM_TRIGGER_POINT_SOF, ctx_isp);
+
+		atomic_set(&ctx_isp->process_bubble, 1);
+	}
+
+	/*
+	 * Always move the request to active list. Let buf done
+	 * function handles the rest.
+	 */
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->active_req_list);
+	ctx_isp->active_req_cnt++;
+	CAM_DBG(CAM_ISP, "move request %lld to active list(cnt = %d) ctx %u, link: 0x%x",
+		req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+
+	/*
+	 * Handle the deferred buf done after moving
+	 * the bubble req to active req list.
+	 */
+	__cam_isp_ctx_handle_deferred_buf_done_in_bubble(
+		ctx_isp, req);
+
+	if (!req_isp->bubble_detected) {
+		req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+			list);
+		req_isp->bubble_detected = true;
+		req_isp->reapply_type = CAM_CONFIG_REAPPLY_IO;
+		req_isp->cdm_reset_before_apply = false;
+		atomic_set(&ctx_isp->process_bubble, 1);
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+	}
+
+	if (!req_isp->bubble_report) {
+		if (req->request_id > ctx_isp->reported_req_id) {
+			request_id = req->request_id;
+			ctx_isp->reported_req_id = request_id;
+			__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+				CAM_REQ_MGR_SOF_EVENT_ERROR);
+			__cam_isp_ctx_update_event_record(ctx_isp,
+				CAM_ISP_CTX_EVENT_EPOCH, req, NULL);
+		} else {
+			__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+				CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+			__cam_isp_ctx_update_event_record(ctx_isp,
+				CAM_ISP_CTX_EVENT_EPOCH, NULL, NULL);
+		}
+	} else {
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_EPOCH, NULL, NULL);
+	}
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+	CAM_DBG(CAM_ISP, "next Substate[%s], ctx_idx: %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+
+	cam_req_mgr_debug_delay_detect();
+	trace_cam_delay_detect("ISP",
+		"bubble epoch_in_bubble_applied",
+		req->request_id, ctx->ctx_id, ctx->link_hdl,
+		ctx->session_hdl,
+		CAM_DEFAULT_VALUE);
+end:
+	req = list_last_entry(&ctx->active_req_list, struct cam_ctx_request,
+		list);
+	if (req)
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, req->request_id);
+	return 0;
+}
+
+static int __cam_isp_ctx_buf_done_in_bubble_applied(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 1);
+
+	return rc;
+}
+
+static void __cam_isp_get_notification_evt_params(
+	uint32_t hw_error, uint32_t *fence_evt_cause,
+	uint32_t *req_mgr_err_code, uint32_t *recovery_type)
+{
+	uint32_t err_type, err_code = 0, recovery_type_temp;
+
+	err_type = CAM_SYNC_ISP_EVENT_UNKNOWN;
+	recovery_type_temp = CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+
+	if (hw_error & CAM_ISP_HW_ERROR_OVERFLOW) {
+		err_code |= CAM_REQ_MGR_ISP_UNREPORTED_ERROR;
+		err_type = CAM_SYNC_ISP_EVENT_OVERFLOW;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW) {
+		err_code |= CAM_REQ_MGR_CSID_FIFO_OVERFLOW_ERROR;
+		err_type = CAM_SYNC_ISP_EVENT_CSID_OUTPUT_FIFO_OVERFLOW;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW) {
+		err_code |= CAM_REQ_MGR_CSID_RECOVERY_OVERFLOW_ERROR;
+		err_type = CAM_SYNC_ISP_EVENT_RECOVERY_OVERFLOW;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_P2I_ERROR) {
+		err_code |= CAM_REQ_MGR_ISP_UNREPORTED_ERROR;
+		err_type = CAM_SYNC_ISP_EVENT_P2I_ERROR;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_VIOLATION) {
+		err_code |= CAM_REQ_MGR_ISP_UNREPORTED_ERROR;
+		err_type = CAM_SYNC_ISP_EVENT_VIOLATION;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_HWPD_VIOLATION) {
+		err_code |= CAM_REQ_MGR_ISP_ERR_HWPD_VIOLATION;
+		err_type = CAM_SYNC_ISP_EVENT_VIOLATION;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_BUSIF_OVERFLOW) {
+		err_code |= CAM_REQ_MGR_ISP_UNREPORTED_ERROR;
+		err_type = CAM_SYNC_ISP_EVENT_BUSIF_OVERFLOW;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_CSID_SENSOR_SWITCH_ERROR) {
+		err_code |= CAM_REQ_MGR_CSID_ERR_ON_SENSOR_SWITCHING;
+		err_type = CAM_SYNC_ISP_EVENT_CSID_SENSOR_SWITCH_ERROR;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_CSID_LANE_FIFO_OVERFLOW) {
+		err_code |= CAM_REQ_MGR_CSID_LANE_FIFO_OVERFLOW_ERROR;
+		err_type = CAM_SYNC_ISP_EVENT_CSID_RX_ERROR;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_CSID_PKT_HDR_CORRUPTED) {
+		err_code |= CAM_REQ_MGR_CSID_RX_PKT_HDR_CORRUPTION;
+		err_type = CAM_SYNC_ISP_EVENT_CSID_RX_ERROR;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_CSID_MISSING_PKT_HDR_DATA) {
+		err_code |= CAM_REQ_MGR_CSID_MISSING_PKT_HDR_DATA;
+		err_type = CAM_SYNC_ISP_EVENT_CSID_RX_ERROR;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_CSID_UNBOUNDED_FRAME) {
+		err_code |= CAM_REQ_MGR_CSID_UNBOUNDED_FRAME;
+		err_type = CAM_SYNC_ISP_EVENT_CSID_RX_ERROR;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_CSID_FRAME_SIZE) {
+		err_code |= CAM_REQ_MGR_CSID_PIXEL_COUNT_MISMATCH;
+		err_type = CAM_SYNC_ISP_EVENT_CSID_RX_ERROR;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_CSID_MISSING_EOT) {
+		err_code |= CAM_REQ_MGR_CSID_MISSING_EOT;
+		err_type = CAM_SYNC_ISP_EVENT_CSID_RX_ERROR;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY;
+	}
+	if (hw_error & CAM_ISP_HW_ERROR_CSID_PKT_PAYLOAD_CORRUPTED) {
+		err_code |= CAM_REQ_MGR_CSID_RX_PKT_PAYLOAD_CORRUPTION;
+		err_type = CAM_SYNC_ISP_EVENT_CSID_RX_ERROR;
+		recovery_type_temp |= CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY;
+	}
+
+	if (recovery_type_temp == (CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY |
+		CAM_REQ_MGR_ERROR_TYPE_RECOVERY))
+		recovery_type_temp = CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY;
+
+	if (!err_code)
+		err_code = CAM_REQ_MGR_ISP_UNREPORTED_ERROR;
+
+	*req_mgr_err_code = err_code;
+	*fence_evt_cause = err_type;
+	*recovery_type = recovery_type_temp;
+}
+
+static bool __cam_isp_ctx_request_can_reapply(
+	struct cam_isp_ctx_req *req_isp)
+{
+	int i;
+
+	for (i = 0; i < req_isp->num_fence_map_out; i++)
+		if (req_isp->fence_map_out[i].sync_id == -1)
+			return false;
+
+	return true;
+}
+
+static int __cam_isp_ctx_validate_for_req_reapply_util(
+	struct cam_isp_context *ctx_isp)
+{
+	int rc = 0;
+	struct cam_ctx_request *req_temp;
+	struct cam_ctx_request *req = NULL;
+	struct cam_isp_ctx_req *req_isp = NULL;
+	struct cam_context *ctx = ctx_isp->base;
+
+	if (in_task())
+		spin_lock_bh(&ctx->lock);
+
+	/* Check for req in active/wait lists */
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_DBG(CAM_ISP,
+			"Active request list empty for ctx: %u on link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+		if (list_empty(&ctx->wait_req_list)) {
+			CAM_WARN(CAM_ISP,
+				"No active/wait req for ctx: %u on link: 0x%x start from pending",
+				ctx->ctx_id, ctx->link_hdl);
+			rc = 0;
+			goto end;
+		}
+	}
+
+	/* Validate if all fences for active requests are not signaled */
+	if (!list_empty(&ctx->active_req_list)) {
+		list_for_each_entry_safe_reverse(req, req_temp,
+			&ctx->active_req_list, list) {
+			/*
+			 * If some fences of the active request are already
+			 * signaled, we should not do recovery for the buffer
+			 * and timestamp consistency.
+			 */
+			req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+			if (!__cam_isp_ctx_request_can_reapply(req_isp)) {
+				CAM_WARN(CAM_ISP,
+					"Req: %llu in ctx:%u on link: 0x%x fence has partially signaled, cannot do recovery",
+					req->request_id, ctx->ctx_id, ctx->link_hdl);
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+	}
+
+	/* Move active requests to pending list */
+	if (!list_empty(&ctx->active_req_list)) {
+		list_for_each_entry_safe_reverse(req, req_temp,
+			&ctx->active_req_list, list) {
+			list_del_init(&req->list);
+			__cam_isp_ctx_enqueue_request_in_order(ctx, req, false);
+			ctx_isp->active_req_cnt--;
+			CAM_DBG(CAM_ISP, "ctx:%u link:0x%x move active req %llu to pending",
+				ctx->ctx_id, ctx->link_hdl, req->request_id);
+		}
+	}
+
+	/* Move wait requests to pending list */
+	if (!list_empty(&ctx->wait_req_list)) {
+		list_for_each_entry_safe_reverse(req, req_temp, &ctx->wait_req_list, list) {
+			list_del_init(&req->list);
+			__cam_isp_ctx_enqueue_request_in_order(ctx, req, false);
+			CAM_DBG(CAM_ISP, "ctx:%u link:0x%x move wait req %llu to pending",
+				ctx->ctx_id, ctx->link_hdl, req->request_id);
+		}
+	}
+
+end:
+	if (in_task())
+		spin_unlock_bh(&ctx->lock);
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_recovery_req_util(
+	struct cam_isp_context *ctx_isp)
+{
+	int rc = 0;
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_ctx_request *req_to_reapply = NULL;
+
+	if (list_empty(&ctx->pending_req_list)) {
+		CAM_WARN(CAM_ISP,
+			"No pending request to recover from on ctx: %u", ctx->ctx_id);
+		return -EINVAL;
+	}
+
+	req_to_reapply = list_first_entry(&ctx->pending_req_list,
+		struct cam_ctx_request, list);
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
+	ctx_isp->recovery_req_id = req_to_reapply->request_id;
+	atomic_set(&ctx_isp->internal_recovery_set, 1);
+
+	CAM_INFO(CAM_ISP, "Notify CRM to reapply req:%llu for ctx:%u link:0x%x",
+		req_to_reapply->request_id, ctx->ctx_id, ctx->link_hdl);
+
+	rc = __cam_isp_ctx_notify_error_util(CAM_TRIGGER_POINT_SOF,
+		CRM_KMD_WARN_INTERNAL_RECOVERY, req_to_reapply->request_id,
+			ctx_isp);
+	if (rc) {
+		/* Unable to notify CRM to do reapply back to normal */
+		CAM_WARN(CAM_ISP,
+			"ctx:%u link:0x%x unable to notify CRM for req %llu",
+			ctx->ctx_id, ctx->link_hdl, ctx_isp->recovery_req_id);
+		ctx_isp->recovery_req_id = 0;
+		atomic_set(&ctx_isp->internal_recovery_set, 0);
+	}
+
+	return rc;
+}
+
+static int __cam_isp_ctx_trigger_error_req_reapply(
+	uint32_t err_type, struct cam_isp_context *ctx_isp)
+{
+	int rc = 0;
+	struct cam_context *ctx = ctx_isp->base;
+
+	if ((err_type & CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW) &&
+		(isp_ctx_debug.disable_internal_recovery_mask &
+		CAM_ISP_CTX_DISABLE_RECOVERY_BUS_OVERFLOW))
+		return -EINVAL;
+
+	/*
+	 * For errors that can be recoverable within kmd, we
+	 * try to do internal hw stop, restart and notify CRM
+	 * to do reapply with the help of bubble control flow.
+	 */
+
+	rc = __cam_isp_ctx_validate_for_req_reapply_util(ctx_isp);
+	if (rc)
+		goto end;
+
+	rc = __cam_isp_ctx_handle_recovery_req_util(ctx_isp);
+	if (rc)
+		goto end;
+
+	CAM_DBG(CAM_ISP, "Triggered internal recovery for req:%llu ctx:%u on link 0x%x",
+		ctx_isp->recovery_req_id, ctx->ctx_id, ctx->link_hdl);
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_error(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int                              rc = 0;
+	enum cam_req_mgr_device_error    error;
+	uint32_t                         i = 0;
+	bool                             found = 0;
+	struct cam_ctx_request          *req = NULL;
+	struct cam_ctx_request          *req_to_report = NULL;
+	struct cam_ctx_request          *req_to_dump = NULL;
+	struct cam_ctx_request          *req_temp;
+	struct cam_isp_ctx_req          *req_isp = NULL;
+	struct cam_isp_ctx_req          *req_isp_to_report = NULL;
+	uint64_t                         error_request_id;
+	struct cam_hw_fence_map_entry   *fence_map_out = NULL;
+	uint32_t                         recovery_type, fence_evt_cause;
+	uint32_t                         req_mgr_err_code;
+
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_isp_hw_error_event_data  *error_event_data =
+			(struct cam_isp_hw_error_event_data *)evt_data;
+
+	CAM_DBG(CAM_ISP, "Enter HW error_type = %d, ctx:%u on link 0x%x",
+		error_event_data->error_type, ctx->ctx_id, ctx->link_hdl);
+
+	if (error_event_data->try_internal_recovery) {
+		rc = __cam_isp_ctx_trigger_error_req_reapply(error_event_data->error_type, ctx_isp);
+		if (!rc)
+			goto exit;
+	}
+
+	if (!ctx_isp->offline_context)
+		__cam_isp_ctx_pause_crm_timer(ctx);
+
+	__cam_isp_ctx_dump_frame_timing_record(ctx_isp);
+
+	__cam_isp_ctx_trigger_reg_dump(CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR, ctx);
+
+	__cam_isp_get_notification_evt_params(error_event_data->error_type,
+		&fence_evt_cause, &req_mgr_err_code, &recovery_type);
+	/*
+	 * The error is likely caused by first request on the active list.
+	 * If active list is empty check wait list (maybe error hit as soon
+	 * as RUP and we handle error before RUP.
+	 */
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_DBG(CAM_ISP,
+			"handling error with no active request, ctx:%u on link 0x%x",
+			 ctx->ctx_id, ctx->link_hdl);
+		if (list_empty(&ctx->wait_req_list)) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"Error with no active/wait request, ctx:%u on link 0x%x",
+				ctx->ctx_id, ctx->link_hdl);
+			goto end;
+		} else {
+			req_to_dump = list_first_entry(&ctx->wait_req_list,
+				struct cam_ctx_request, list);
+		}
+	} else {
+		req_to_dump = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+	}
+
+	req_isp = (struct cam_isp_ctx_req *) req_to_dump->req_priv;
+
+	if (error_event_data->enable_req_dump)
+		rc = cam_isp_ctx_dump_req(req_isp, 0, 0, NULL, false);
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_ERROR, req_to_dump->request_id);
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->active_req_list, list) {
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if (!req_isp->bubble_report) {
+			CAM_ERR(CAM_ISP, "signalled error for req %llu, ctx:%u on link 0x%x",
+				req->request_id, ctx->ctx_id, ctx->link_hdl);
+			for (i = 0; i < req_isp->num_fence_map_out; i++) {
+				fence_map_out =
+					&req_isp->fence_map_out[i];
+				if (req_isp->fence_map_out[i].sync_id != -1) {
+					CAM_DBG(CAM_ISP,
+						"req %llu, Sync fd 0x%x ctx %u, link 0x%x",
+						req->request_id,
+						req_isp->fence_map_out[i].sync_id,
+						ctx->ctx_id, ctx->link_hdl);
+					rc = cam_sync_signal(
+						fence_map_out->sync_id,
+						CAM_SYNC_STATE_SIGNALED_ERROR,
+						fence_evt_cause);
+					fence_map_out->sync_id = -1;
+				}
+			}
+			list_del_init(&req->list);
+			__cam_isp_ctx_move_req_to_free_list(ctx, req);
+			ctx_isp->active_req_cnt--;
+		} else {
+			found = 1;
+			break;
+		}
+	}
+
+	if (found)
+		goto move_to_pending;
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->wait_req_list, list) {
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if (!req_isp->bubble_report) {
+			CAM_ERR(CAM_ISP, "signalled error for req %llu, ctx %u, link 0x%x",
+				req->request_id, ctx->ctx_id, ctx->link_hdl);
+			for (i = 0; i < req_isp->num_fence_map_out; i++) {
+				fence_map_out =
+					&req_isp->fence_map_out[i];
+				if (req_isp->fence_map_out[i].sync_id != -1) {
+					CAM_DBG(CAM_ISP,
+						"req %llu, Sync fd 0x%x ctx %u link 0x%x",
+						req->request_id,
+						req_isp->fence_map_out[i].sync_id,
+						ctx->ctx_id, ctx->link_hdl);
+					rc = cam_sync_signal(
+						fence_map_out->sync_id,
+						CAM_SYNC_STATE_SIGNALED_ERROR,
+						fence_evt_cause);
+					fence_map_out->sync_id = -1;
+				}
+			}
+			list_del_init(&req->list);
+			__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		} else {
+			found = 1;
+			break;
+		}
+	}
+
+move_to_pending:
+	/*
+	 * If bubble recovery is enabled on any request we need to move that
+	 * request and all the subsequent requests to the pending list.
+	 * Note:
+	 * We need to traverse the active list in reverse order and add
+	 * to head of pending list.
+	 * e.g. pending current state: 10, 11 | active current state: 8, 9
+	 * intermittent for loop iteration- pending: 9, 10, 11 | active: 8
+	 * final state - pending: 8, 9, 10, 11 | active: NULL
+	 */
+	if (found) {
+		list_for_each_entry_safe_reverse(req, req_temp,
+			&ctx->active_req_list, list) {
+			list_del_init(&req->list);
+			list_add(&req->list, &ctx->pending_req_list);
+			ctx_isp->active_req_cnt--;
+		}
+		list_for_each_entry_safe_reverse(req, req_temp,
+			&ctx->wait_req_list, list) {
+			list_del_init(&req->list);
+			list_add(&req->list, &ctx->pending_req_list);
+		}
+	}
+
+end:
+	do {
+		if (list_empty(&ctx->pending_req_list)) {
+			error_request_id = ctx_isp->last_applied_req_id;
+			break;
+		}
+		req = list_first_entry(&ctx->pending_req_list,
+			struct cam_ctx_request, list);
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		error_request_id = ctx_isp->last_applied_req_id;
+
+		if (req_isp->bubble_report) {
+			req_to_report = req;
+			req_isp_to_report = req_to_report->req_priv;
+			break;
+		}
+
+		for (i = 0; i < req_isp->num_fence_map_out; i++) {
+			if (req_isp->fence_map_out[i].sync_id != -1)
+				rc = cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					fence_evt_cause);
+			req_isp->fence_map_out[i].sync_id = -1;
+		}
+		list_del_init(&req->list);
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+
+	} while (req->request_id < ctx_isp->last_applied_req_id);
+
+	if (ctx_isp->offline_context)
+		goto exit;
+
+	error = CRM_KMD_ERR_FATAL;
+	if (req_isp_to_report && req_isp_to_report->bubble_report)
+		if (error_event_data->recovery_enabled)
+			error = CRM_KMD_ERR_BUBBLE;
+
+	__cam_isp_ctx_notify_error_util(CAM_TRIGGER_POINT_SOF, error,
+		error_request_id, ctx_isp);
+
+	/*
+	 * Need to send error occurred in KMD
+	 * This will help UMD to take necessary action
+	 * and to dump relevant info
+	 */
+	if (error == CRM_KMD_ERR_FATAL)
+		__cam_isp_ctx_notify_v4l2_error_event(recovery_type,
+			req_mgr_err_code, error_request_id, ctx);
+
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_HW_ERROR;
+	CAM_DBG(CAM_ISP, "Handling error done on ctx: %u, link: 0x%x", ctx->ctx_id, ctx->link_hdl);
+
+exit:
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_sof_in_sof_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	struct cam_ctx_request *req;
+	struct cam_context *ctx = ctx_isp->base;
+	uint64_t  request_id  = 0;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data, ctx: %u, link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	__cam_isp_ctx_update_sof_ts_util(sof_event_data, ctx_isp);
+
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx, ctx: %u, link: 0x%x",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val, ctx->ctx_id, ctx->link_hdl);
+
+	if (!(list_empty(&ctx->wait_req_list)))
+		goto end;
+
+	if (ctx_isp->active_req_cnt <= 2) {
+		__cam_isp_ctx_notify_trigger_util(CAM_TRIGGER_POINT_SOF, ctx_isp);
+
+		list_for_each_entry(req, &ctx->active_req_list, list) {
+			if (req->request_id > ctx_isp->reported_req_id) {
+				request_id = req->request_id;
+				ctx_isp->reported_req_id = request_id;
+				break;
+			}
+		}
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	}
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_SOF, request_id);
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_buf_done(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+	struct cam_context *ctx = ctx_isp->base;
+	int prev_active_req_cnt = 0;
+	int curr_req_id = 0;
+	struct cam_ctx_request  *req;
+
+	prev_active_req_cnt = ctx_isp->active_req_cnt;
+	req = list_first_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+	if (req)
+		curr_req_id = req->request_id;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 0);
+
+	if (prev_active_req_cnt == ctx_isp->active_req_cnt + 1) {
+		if (list_empty(&ctx->wait_req_list) &&
+			list_empty(&ctx->active_req_list)) {
+			CAM_DBG(CAM_ISP, "No request, move to SOF, ctx_idx: %u, link: 0x%x",
+				 ctx->ctx_id, ctx->link_hdl);
+			ctx_isp->substate_activated =
+				CAM_ISP_CTX_ACTIVATED_SOF;
+			if (ctx_isp->reported_req_id < curr_req_id) {
+				ctx_isp->reported_req_id = curr_req_id;
+				__cam_isp_ctx_send_sof_timestamp(ctx_isp,
+					curr_req_id,
+					CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_buf_done_in_epoch(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+
+	rc =  __cam_isp_ctx_fs2_buf_done(ctx_isp, evt_data);
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_buf_done_in_applied(
+	struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+
+	rc =  __cam_isp_ctx_fs2_buf_done(ctx_isp, evt_data);
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_reg_upd_in_sof(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_ctx_request *req = NULL;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+
+	if (ctx->state != CAM_CTX_ACTIVATED && ctx_isp->frame_id > 1) {
+		CAM_DBG(CAM_ISP, "invalid RUP");
+		goto end;
+	}
+
+	/*
+	 * This is for the first update. The initial setting will
+	 * cause the reg_upd in the first frame.
+	 */
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if (req_isp->num_fence_map_out == req_isp->num_acked)
+			__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		else
+			CAM_ERR(CAM_ISP,
+				"receive rup in unexpected state, ctx_idx: %u, link: 0x%x",
+				 ctx->ctx_id, ctx->link_hdl);
+	}
+	if (req != NULL) {
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE,
+			req->request_id);
+	}
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_reg_upd_in_applied_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_ctx_request  *req = NULL;
+	struct cam_context      *ctx = ctx_isp->base;
+	struct cam_isp_ctx_req  *req_isp;
+	uint64_t  request_id  = 0;
+
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+	req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+	list_del_init(&req->list);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	if (req_isp->num_fence_map_out != 0) {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		CAM_DBG(CAM_REQ, "move request %lld to active list(cnt = %d), ctx:%u,link:0x%x",
+			 req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+	} else {
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		/* no io config, so the request is completed. */
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+	}
+
+	/*
+	 * This function only called directly from applied and bubble applied
+	 * state so change substate here.
+	 */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
+	if (req_isp->num_fence_map_out != 1)
+		goto end;
+
+	if (ctx_isp->active_req_cnt <= 2) {
+		list_for_each_entry(req, &ctx->active_req_list, list) {
+			if (req->request_id > ctx_isp->reported_req_id) {
+				request_id = req->request_id;
+				ctx_isp->reported_req_id = request_id;
+				break;
+			}
+		}
+
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+		__cam_isp_ctx_notify_trigger_util(CAM_TRIGGER_POINT_SOF, ctx_isp);
+	}
+
+	CAM_DBG(CAM_ISP, "next Substate[%s], ctx_idx: %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(ctx_isp->substate_activated),
+		ctx->ctx_id, ctx->link_hdl);
+
+end:
+	if (req != NULL && !rc) {
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE,
+			req->request_id);
+	}
+	return rc;
+}
+
+static void __cam_isp_ctx_notify_aeb_error_for_sec_event(
+	struct cam_isp_context *ctx_isp)
+{
+	struct cam_context *ctx = ctx_isp->base;
+
+	if ((++ctx_isp->aeb_error_cnt) <= CAM_ISP_CONTEXT_AEB_ERROR_CNT_MAX) {
+		CAM_WARN(CAM_ISP,
+			"AEB slave RDI's current request's SOF seen after next req is applied for ctx: %u on link: 0x%x last_applied_req: %llu err_cnt: %u",
+			ctx->ctx_id, ctx->link_hdl, ctx_isp->last_applied_req_id, ctx_isp->aeb_error_cnt);
+		return;
+	}
+
+	CAM_ERR(CAM_ISP,
+		"Fatal - AEB slave RDI's current request's SOF seen after next req is applied, EPOCH height need to be re-configured for ctx: %u on link: 0x%x err_cnt: %u",
+		ctx->ctx_id, ctx->link_hdl, ctx_isp->aeb_error_cnt);
+
+	/* Pause CRM timer */
+	if (!ctx_isp->offline_context)
+		__cam_isp_ctx_pause_crm_timer(ctx);
+
+	/* Trigger reg dump */
+	__cam_isp_ctx_trigger_reg_dump(CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR, ctx);
+
+	/* Notify CRM on fatal error */
+	__cam_isp_ctx_notify_error_util(CAM_TRIGGER_POINT_SOF, CRM_KMD_ERR_FATAL,
+		ctx_isp->last_applied_req_id, ctx_isp);
+
+	/* Notify userland on error */
+	__cam_isp_ctx_notify_v4l2_error_event(CAM_REQ_MGR_ERROR_TYPE_RECOVERY,
+		CAM_REQ_MGR_CSID_ERR_ON_SENSOR_SWITCHING, ctx_isp->last_applied_req_id, ctx);
+
+	/* Change state to HALT, stop further processing of HW events */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_HALT;
+
+	/* Dump AEB debug info */
+	__cam_isp_ctx_dump_frame_timing_record(ctx_isp);
+}
+
+static int __cam_isp_ctx_trigger_internal_recovery(
+	bool sync_frame_drop, struct cam_isp_context *ctx_isp)
+{
+	int                                 rc = 0;
+	bool                                do_recovery = true;
+	struct cam_context                 *ctx = ctx_isp->base;
+	struct cam_ctx_request             *req = NULL;
+	struct cam_isp_ctx_req             *req_isp = NULL;
+
+	if (list_empty(&ctx->wait_req_list)) {
+		/*
+		 * If the wait list is empty, and we encounter a "silent" frame drop
+		 * then the settings applied on the previous frame, did not reflect
+		 * at the next frame boundary, it's expected to latch a frame after.
+		 * No need to recover. If it's an out of sync drop use pending req
+		 */
+		if (sync_frame_drop && !list_empty(&ctx->pending_req_list))
+			req = list_first_entry(&ctx->pending_req_list,
+				struct cam_ctx_request, list);
+		else
+			do_recovery = false;
+	}
+
+	/* If both wait and pending list have no request to recover on */
+	if (!do_recovery) {
+		CAM_WARN(CAM_ISP,
+			"No request to perform recovery - ctx: %u on link: 0x%x last_applied: %lld last_buf_done: %lld",
+			ctx->ctx_id, ctx->link_hdl, ctx_isp->last_applied_req_id,
+			ctx_isp->req_info.last_bufdone_req_id);
+		goto end;
+	}
+
+	if (!req) {
+		req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request, list);
+		if (req->request_id != ctx_isp->last_applied_req_id)
+			CAM_WARN(CAM_ISP,
+				"Top of wait list req: %llu does not match with last applied: %llu in ctx: %u on link: 0x%x",
+				req->request_id, ctx_isp->last_applied_req_id,
+				ctx->ctx_id, ctx->link_hdl);
+	}
+
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	/*
+	 * Treat this as bubble, after recovery re-start from appropriate sub-state
+	 * This will block servicing any further apply calls from CRM
+	 */
+	atomic_set(&ctx_isp->internal_recovery_set, 1);
+	atomic_set(&ctx_isp->process_bubble, 1);
+	ctx_isp->recovery_req_id = req->request_id;
+
+	/* Wait for active request's to finish before issuing recovery */
+	if (ctx_isp->active_req_cnt) {
+		req_isp->bubble_detected = true;
+		CAM_WARN(CAM_ISP,
+			"Active req cnt: %u wait for all buf dones before kicking in recovery on req: %lld ctx: %u on link: 0x%x",
+			ctx_isp->active_req_cnt, ctx_isp->recovery_req_id,
+			ctx->ctx_id, ctx->link_hdl);
+	} else {
+		rc = __cam_isp_ctx_notify_error_util(CAM_TRIGGER_POINT_SOF,
+				CRM_KMD_WARN_INTERNAL_RECOVERY, ctx_isp->recovery_req_id, ctx_isp);
+		if (rc) {
+			/* Unable to do bubble recovery reset back to normal */
+			CAM_WARN(CAM_ISP,
+				"Unable to perform internal recovery [bubble reporting failed] for req: %llu in ctx: %u on link: 0x%x",
+				ctx_isp->recovery_req_id, ctx->ctx_id, ctx->link_hdl);
+			__cam_isp_context_reset_internal_recovery_params(ctx_isp);
+			goto end;
+		}
+
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+		list_del_init(&req->list);
+		list_add(&req->list, &ctx->pending_req_list);
+	}
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_secondary_events(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	bool recover = false, sync_frame_drop = false;
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_isp_hw_secondary_event_data *sec_evt_data =
+		(struct cam_isp_hw_secondary_event_data *)evt_data;
+
+	/* Current scheme to handle only for custom AEB */
+	if (!ctx_isp->aeb_enabled) {
+		CAM_WARN(CAM_ISP,
+			"Recovery not supported for non-AEB ctx: %u on link: 0x%x reject sec evt: %u",
+			ctx->ctx_id, ctx->link_hdl, sec_evt_data->evt_type);
+		goto end;
+	}
+
+	if (atomic_read(&ctx_isp->internal_recovery_set)) {
+		CAM_WARN(CAM_ISP,
+			"Internal recovery in progress in ctx: %u on link: 0x%x reject sec evt: %u",
+			ctx->ctx_id, ctx->link_hdl, sec_evt_data->evt_type);
+		goto end;
+	}
+
+	/*
+	 * In case of custom AEB ensure first exposure frame has
+	 * not moved forward with its settings without second/third
+	 * expoure frame coming in. Also track for bubble, in case of system
+	 * delays it's possible for the IFE settings to be not written to
+	 * HW on a given frame. If these scenarios occurs flag as error,
+	 * and recover.
+	 */
+	switch (sec_evt_data->evt_type) {
+	case CAM_ISP_HW_SEC_EVENT_SOF:
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_SEC_EVT_SOF,
+			ctx_isp->last_applied_req_id);
+
+		__cam_isp_ctx_update_frame_timing_record(CAM_ISP_HW_SECONDARY_EVENT, ctx_isp);
+
+		/* Slave RDI's frame starting post IFE EPOCH - Fatal */
+		if ((ctx_isp->substate_activated ==
+			CAM_ISP_CTX_ACTIVATED_APPLIED) ||
+			(ctx_isp->substate_activated ==
+			CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED))
+			__cam_isp_ctx_notify_aeb_error_for_sec_event(ctx_isp);
+		else
+			/* Reset error count */
+			ctx_isp->aeb_error_cnt = 0;
+		break;
+	case CAM_ISP_HW_SEC_EVENT_EPOCH:
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_SEC_EVT_EPOCH,
+			ctx_isp->last_applied_req_id);
+		ctx_isp->out_of_sync_cnt = 0;
+
+		/*
+		 * Master RDI frame dropped in CSID, due to programming delay no RUP/AUP
+		 * On such occasions use CSID CAMIF EPOCH for bubble detection, flag
+		 * on detection and perform necessary bubble recovery
+		 */
+		if ((ctx_isp->substate_activated ==
+			CAM_ISP_CTX_ACTIVATED_APPLIED) ||
+			(ctx_isp->substate_activated ==
+			CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED)) {
+			recover = true;
+			CAM_WARN(CAM_ISP,
+				"Programming delay input frame dropped ctx: %u on link: 0x%x last_applied_req: %llu, kicking in internal recovery....",
+				ctx->ctx_id, ctx->link_hdl, ctx_isp->last_applied_req_id);
+		}
+		break;
+	case CAM_ISP_HW_SEC_EVENT_OUT_OF_SYNC_FRAME_DROP:
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_FRAME_DROP,
+			ctx_isp->last_applied_req_id);
+
+		/* Avoid recovery loop if frame is dropped at stream on */
+		if (!ctx_isp->frame_id) {
+			CAM_ERR(CAM_ISP,
+				"Sensor sync [vc mismatch] frame dropped at stream on ctx: %u link: 0x%x frame_id: %u last_applied_req: %lld",
+				ctx->ctx_id, ctx->link_hdl,
+				ctx_isp->frame_id, ctx_isp->last_applied_req_id);
+			rc = -EPERM;
+			break;
+		}
+
+		if (!(ctx_isp->out_of_sync_cnt++) &&
+			(ctx_isp->recovery_req_id == ctx_isp->last_applied_req_id)) {
+			CAM_WARN(CAM_ISP,
+				"Sensor sync [vc mismatch] frame dropped ctx: %u on link: 0x%x last_applied_req: %llu last_recovered_req: %llu out_of_sync_cnt: %u, recovery maybe in progress...",
+				ctx->ctx_id, ctx->link_hdl, ctx_isp->last_applied_req_id,
+				ctx_isp->recovery_req_id, ctx_isp->out_of_sync_cnt);
+			break;
+		}
+
+		recover = true;
+		sync_frame_drop = true;
+		ctx_isp->out_of_sync_cnt = 0;
+		CAM_WARN(CAM_ISP,
+			"Sensor sync [vc mismatch] frame dropped ctx: %u on link: 0x%x last_applied_req: %llu last_recovered_req: %llu out_of_sync_cnt: %u, kicking in internal recovery....",
+			ctx->ctx_id, ctx->link_hdl, ctx_isp->last_applied_req_id,
+			ctx_isp->recovery_req_id, ctx_isp->out_of_sync_cnt);
+		break;
+	default:
+		break;
+	}
+
+	if (recover &&
+		!(isp_ctx_debug.disable_internal_recovery_mask & CAM_ISP_CTX_DISABLE_RECOVERY_AEB))
+		rc = __cam_isp_ctx_trigger_internal_recovery(sync_frame_drop, ctx_isp);
+
+end:
+	return rc;
+}
+
+static struct cam_isp_ctx_irq_ops
+	cam_isp_ctx_activated_state_machine_irq[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_sof,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_sof,
+			__cam_isp_ctx_handle_secondary_events,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_applied_state,
+			__cam_isp_ctx_epoch_in_applied,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_applied,
+			__cam_isp_ctx_handle_secondary_events,
+		},
+	},
+	/* EPOCH */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_epoch,
+			__cam_isp_ctx_reg_upd_in_epoch_bubble_state,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_epoch,
+			__cam_isp_ctx_handle_secondary_events,
+		},
+	},
+	/* BUBBLE */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_epoch_bubble_state,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_bubble,
+			__cam_isp_ctx_handle_secondary_events,
+		},
+	},
+	/* Bubble Applied */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_applied_state,
+			__cam_isp_ctx_epoch_in_bubble_applied,
+			NULL,
+			__cam_isp_ctx_buf_done_in_bubble_applied,
+			__cam_isp_ctx_handle_secondary_events,
+		},
+	},
+	/* HW ERROR */
+	{
+		.irq_ops = {
+			NULL,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_hw_error,
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* HALT */
+	{
+	},
+};
+
+static struct cam_isp_ctx_irq_ops
+	cam_isp_ctx_fs2_state_machine_irq[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_fs2_sof_in_sof_state,
+			__cam_isp_ctx_fs2_reg_upd_in_sof,
+			__cam_isp_ctx_fs2_sof_in_sof_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			NULL,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_fs2_reg_upd_in_applied_state,
+			__cam_isp_ctx_epoch_in_applied,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_fs2_buf_done_in_applied,
+		},
+	},
+	/* EPOCH */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_epoch,
+			__cam_isp_ctx_reg_upd_in_epoch_bubble_state,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_fs2_buf_done_in_epoch,
+		},
+	},
+	/* BUBBLE */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_epoch_bubble_state,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_bubble,
+		},
+	},
+	/* Bubble Applied */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_applied_state,
+			__cam_isp_ctx_epoch_in_bubble_applied,
+			NULL,
+			__cam_isp_ctx_buf_done_in_bubble_applied,
+		},
+	},
+	/* HW ERROR */
+	{
+		.irq_ops = {
+			NULL,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_hw_error,
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* HALT */
+	{
+	},
+};
+
+static struct cam_isp_ctx_irq_ops
+	cam_isp_ctx_offline_state_machine_irq[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_applied_state,
+			__cam_isp_ctx_offline_epoch_in_bubble_state,
+			NULL,
+			__cam_isp_ctx_buf_done_in_applied,
+		},
+	},
+	/* EPOCH */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			NULL,
+			NULL,
+			__cam_isp_ctx_offline_epoch_in_activated_state,
+			__cam_isp_ctx_offline_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_epoch,
+		},
+	},
+	/* BUBBLE */
+	{
+	},
+	/* Bubble Applied */
+	{
+	},
+	/* HW ERROR */
+	{
+		.irq_ops = {
+			NULL,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_hw_error,
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* HALT */
+	{
+	},
+};
+
+static inline int cam_isp_context_apply_evt_injection(struct cam_context *ctx)
+{
+	struct cam_isp_context *ctx_isp = ctx->ctx_priv;
+	struct cam_hw_inject_evt_param *evt_inject_params = &ctx_isp->evt_inject_params;
+	struct cam_common_evt_inject_data inject_evt = {0};
+	int rc;
+
+	inject_evt.evt_params = evt_inject_params;
+	rc = cam_context_apply_evt_injection(ctx, &inject_evt);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Fail to apply event injection ctx_id: %u link: 0x%x req_id: %u",
+			ctx->ctx_id, ctx->link_hdl, evt_inject_params->req_id);
+
+	evt_inject_params->is_valid = false;
+
+	return rc;
+}
+
+static inline void __cam_isp_ctx_update_fcg_prediction_idx(
+	struct cam_context                      *ctx,
+	uint64_t                                 request_id,
+	struct cam_isp_fcg_prediction_tracker   *fcg_tracker,
+	struct cam_isp_fcg_config_info          *fcg_info)
+{
+	struct cam_isp_context *ctx_isp = ctx->ctx_priv;
+
+	if ((fcg_tracker->sum_skipped == 0) ||
+		(fcg_tracker->sum_skipped > CAM_ISP_MAX_FCG_PREDICTIONS)) {
+		fcg_info->use_current_cfg = true;
+		CAM_DBG(CAM_ISP,
+			"Apply req: %llu, Use current FCG value, frame_id: %llu, ctx_id: %u",
+			request_id, ctx_isp->frame_id, ctx->ctx_id);
+	} else {
+		fcg_info->prediction_idx = fcg_tracker->sum_skipped;
+		CAM_DBG(CAM_ISP,
+			"Apply req: %llu, FCG prediction: %u, frame_id: %llu, ctx_id: %u",
+			request_id, fcg_tracker->sum_skipped,
+			ctx_isp->frame_id, ctx->ctx_id);
+	}
+}
+
+static inline void __cam_isp_ctx_print_fcg_tracker(
+	struct cam_isp_fcg_prediction_tracker *fcg_tracker)
+{
+	uint32_t skipped_list[CAM_ISP_AFD_PIPELINE_DELAY];
+	struct cam_isp_skip_frame_info *skip_info;
+	int i = 0;
+
+	list_for_each_entry(skip_info,
+		&fcg_tracker->skipped_list, list) {
+		skipped_list[i] = skip_info->num_frame_skipped;
+		i += 1;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"FCG tracker num_skipped: %u, sum_skipped: %u, skipped list: [%u, %u, %u]",
+		fcg_tracker->num_skipped, fcg_tracker->sum_skipped,
+		skipped_list[0], skipped_list[1], skipped_list[2]);
+}
+
+static int __cam_isp_ctx_apply_req_in_activated_state(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply,
+	enum cam_isp_ctx_activated_substate next_state)
+{
+	int rc = 0;
+	struct cam_ctx_request                  *req;
+	struct cam_ctx_request                  *active_req = NULL;
+	struct cam_isp_ctx_req                  *req_isp;
+	struct cam_isp_ctx_req                  *active_req_isp;
+	struct cam_isp_context                  *ctx_isp = NULL;
+	struct cam_hw_config_args                cfg = {0};
+	struct cam_isp_skip_frame_info          *skip_info;
+	struct cam_isp_fcg_prediction_tracker   *fcg_tracker;
+	struct cam_isp_fcg_config_info          *fcg_info;
+
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+
+	/* Reset mswitch ref cnt */
+	atomic_set(&ctx_isp->mswitch_default_apply_delay_ref_cnt,
+		ctx_isp->mswitch_default_apply_delay_max_cnt);
+
+	if (apply->re_apply)
+		if (apply->request_id <= ctx_isp->last_applied_req_id) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"ctx_id:%u link: 0x%x Trying to reapply the same request %llu again",
+				ctx->ctx_id, ctx->link_hdl,
+				apply->request_id);
+			return 0;
+		}
+
+	if (list_empty(&ctx->pending_req_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%u link: 0x%x No available request for Apply id %lld",
+			ctx->ctx_id, ctx->link_hdl,
+			apply->request_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	/*
+	 * When the pipeline has issue, the requests can be queued up in the
+	 * pipeline. In this case, we should reject the additional request.
+	 * The maximum number of request allowed to be outstanding is 2.
+	 *
+	 */
+	if (atomic_read(&ctx_isp->process_bubble)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%u link: 0x%x Processing bubble cannot apply Request Id %llu",
+			ctx->ctx_id, ctx->link_hdl,
+			apply->request_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	/*
+	 * When isp processing internal recovery, the crm may still apply
+	 * req to isp ctx. In this case, we should reject this req apply.
+	 */
+	if (atomic_read(&ctx_isp->internal_recovery_set)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%u link: 0x%x Processing recovery cannot apply Request Id %lld",
+			ctx->ctx_id, ctx->link_hdl,
+			apply->request_id);
+		rc = -EAGAIN;
+		goto end;
+	}
+
+	spin_lock_bh(&ctx->lock);
+	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+		list);
+	spin_unlock_bh(&ctx->lock);
+
+	/*
+	 * Check whether the request id is matching the tip, if not, this means
+	 * we are in the middle of the error handling. Need to reject this apply
+	 */
+	if (req->request_id != apply->request_id) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%u link: 0x%x Invalid Request Id asking %llu existing %llu",
+			ctx->ctx_id, ctx->link_hdl,
+			apply->request_id, req->request_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_REQ, "Apply request %lld in Substate[%s] ctx %u, link: 0x%x",
+		req->request_id,
+		__cam_isp_ctx_substate_val_to_type(ctx_isp->substate_activated),
+		ctx->ctx_id, ctx->link_hdl);
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	if (ctx_isp->active_req_cnt >=  2) {
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Reject apply request (id %lld) due to congestion(cnt = %d) ctx %u, link: 0x%x",
+			req->request_id,
+			ctx_isp->active_req_cnt,
+			ctx->ctx_id, ctx->link_hdl);
+
+		spin_lock_bh(&ctx->lock);
+		if (!list_empty(&ctx->active_req_list))
+			active_req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		else
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"WARNING: should not happen (cnt = %d) but active_list empty, ctx %u, link: 0x%x",
+				ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+		spin_unlock_bh(&ctx->lock);
+
+		if (active_req) {
+			active_req_isp =
+				(struct cam_isp_ctx_req *) active_req->req_priv;
+			__cam_isp_ctx_handle_buf_done_fail_log(ctx_isp,
+				active_req->request_id, active_req_isp);
+		}
+
+		rc = -EFAULT;
+		goto end;
+	}
+
+	/* Reset congestion counter */
+	ctx_isp->congestion_cnt = 0;
+
+	req_isp->bubble_report = apply->report_if_bubble;
+
+	/*
+	 * Reset all buf done/bubble flags for the req being applied
+	 * If internal recovery has led to re-apply of same
+	 * request, clear all stale entities
+	 */
+	req_isp->num_acked = 0;
+	req_isp->num_deferred_acks = 0;
+	req_isp->cdm_reset_before_apply = false;
+	req_isp->bubble_detected = false;
+
+	cfg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	cfg.request_id = req->request_id;
+	cfg.hw_update_entries = req_isp->cfg;
+	cfg.num_hw_update_entries = req_isp->num_cfg;
+	cfg.priv  = &req_isp->hw_update_data;
+	cfg.init_packet = 0;
+	cfg.reapply_type = req_isp->reapply_type;
+	cfg.cdm_reset_before_apply = req_isp->cdm_reset_before_apply;
+
+	if ((ctx_isp->evt_inject_params.is_valid) &&
+		(req->request_id == ctx_isp->evt_inject_params.req_id)) {
+		rc = cam_isp_context_apply_evt_injection(ctx_isp->base);
+		if (!rc)
+			goto end;
+	}
+
+	/* Decide the exact FCG prediction */
+	fcg_tracker = &ctx_isp->fcg_tracker;
+	fcg_info = &req_isp->hw_update_data.fcg_info;
+	if (!list_empty(&fcg_tracker->skipped_list)) {
+		__cam_isp_ctx_print_fcg_tracker(fcg_tracker);
+		skip_info = list_first_entry(&fcg_tracker->skipped_list,
+			struct cam_isp_skip_frame_info, list);
+		fcg_tracker->sum_skipped -= skip_info->num_frame_skipped;
+		if (unlikely((uint32_t)UINT_MAX - fcg_tracker->sum_skipped <
+			fcg_tracker->num_skipped))
+			fcg_tracker->num_skipped =
+				(uint32_t)UINT_MAX - fcg_tracker->sum_skipped;
+		fcg_tracker->sum_skipped += fcg_tracker->num_skipped;
+		skip_info->num_frame_skipped = fcg_tracker->num_skipped;
+		fcg_tracker->num_skipped = 0;
+		list_rotate_left(&fcg_tracker->skipped_list);
+
+		__cam_isp_ctx_print_fcg_tracker(fcg_tracker);
+		__cam_isp_ctx_update_fcg_prediction_idx(ctx,
+			apply->request_id, fcg_tracker, fcg_info);
+	}
+
+	atomic_set(&ctx_isp->apply_in_progress, 1);
+
+	rc = ctx->hw_mgr_intf->hw_config(ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (!rc) {
+		spin_lock_bh(&ctx->lock);
+		ctx_isp->substate_activated = next_state;
+		ctx_isp->last_applied_req_id = apply->request_id;
+		ctx_isp->last_applied_jiffies = jiffies;
+
+		if (ctx_isp->is_tfe_shdr) {
+			if (ctx_isp->is_shdr_master && req_isp->hw_update_data.mup_en)
+				apply->dual_trigger_status = req_isp->hw_update_data.num_exp;
+			else
+				apply->dual_trigger_status = CAM_REQ_DUAL_TRIGGER_NONE;
+		} else {
+			apply->dual_trigger_status = CAM_REQ_DUAL_TRIGGER_NONE;
+		}
+
+		list_del_init(&req->list);
+		if (atomic_read(&ctx_isp->internal_recovery_set))
+			__cam_isp_ctx_enqueue_request_in_order(ctx, req, false);
+		else
+			list_add_tail(&req->list, &ctx->wait_req_list);
+		CAM_DBG(CAM_ISP, "new Substate[%s], applied req %lld, ctx_idx: %u, link: 0x%x",
+			__cam_isp_ctx_substate_val_to_type(next_state),
+			ctx_isp->last_applied_req_id, ctx->ctx_id, ctx->link_hdl);
+		spin_unlock_bh(&ctx->lock);
+
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_APPLIED,
+			req->request_id);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_APPLY, req, NULL);
+	} else if (rc == -EALREADY) {
+		spin_lock_bh(&ctx->lock);
+		req_isp->bubble_detected = true;
+		req_isp->cdm_reset_before_apply = false;
+		atomic_set(&ctx_isp->process_bubble, 1);
+		list_del_init(&req->list);
+		list_add(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		spin_unlock_bh(&ctx->lock);
+		CAM_DBG(CAM_REQ,
+			"move request %lld to active list(cnt = %d), ctx %u, link: 0x%x",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%u link: 0x%x,Can not apply (req %lld) the configuration, rc %d",
+			ctx->ctx_id, ctx->link_hdl, apply->request_id, rc);
+	}
+
+	atomic_set(&ctx_isp->apply_in_progress, 0);
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_req_in_sof(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "current Substate[%s], ctx %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+	rc = __cam_isp_ctx_apply_req_in_activated_state(ctx, apply,
+		CAM_ISP_CTX_ACTIVATED_APPLIED);
+	CAM_DBG(CAM_ISP, "new Substate[%s], ctx %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+
+	if (rc)
+		CAM_DBG(CAM_ISP, "Apply failed in Substate[%s], rc %d, ctx %u, link: 0x%x",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_req_in_epoch(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "current Substate[%s], ctx %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+	rc = __cam_isp_ctx_apply_req_in_activated_state(ctx, apply,
+		CAM_ISP_CTX_ACTIVATED_APPLIED);
+	CAM_DBG(CAM_ISP, "new Substate[%s], ctx %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+
+	if (rc)
+		CAM_DBG(CAM_ISP, "Apply failed in Substate[%s], rc %d, ctx %u, link: 0x%x",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_req_in_bubble(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "current Substate[%s], ctx %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+	rc = __cam_isp_ctx_apply_req_in_activated_state(ctx, apply,
+		CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED);
+	CAM_DBG(CAM_ISP, "new Substate[%s], ctx %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+
+	if (rc)
+		CAM_DBG(CAM_ISP, "Apply failed in Substate[%s], rc %d, ctx %u, link: 0x%x",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static void __cam_isp_ctx_find_mup_for_default_settings(
+	int64_t req_id, struct cam_context *ctx,
+	struct cam_ctx_request **switch_req)
+{
+	struct cam_ctx_request *req, *temp_req;
+
+	if (list_empty(&ctx->pending_req_list)) {
+		CAM_DBG(CAM_ISP,
+			"Pending list empty, unable to find mup for req: %lld ctx: %u",
+			req_id, ctx->ctx_id);
+		return;
+	}
+
+	list_for_each_entry_safe(
+		req, temp_req, &ctx->pending_req_list, list) {
+		if (req->request_id == req_id) {
+			struct cam_isp_ctx_req *req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+
+			if (req_isp->hw_update_data.mup_en) {
+				*switch_req = req;
+				CAM_DBG(CAM_ISP,
+					"Found mup for last applied max pd req: %lld in ctx: %u",
+					req_id, ctx->ctx_id);
+			}
+		}
+	}
+}
+
+static int __cam_isp_ctx_apply_default_req_settings(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	bool skip_rup_aup = false;
+	struct cam_ctx_request *req = NULL;
+	struct cam_isp_ctx_req *req_isp = NULL;
+	struct cam_isp_context *isp_ctx =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args hw_cmd_args;
+	struct cam_isp_hw_cmd_args isp_hw_cmd_args;
+	struct cam_hw_config_args cfg = {0};
+
+	if (isp_ctx->mode_switch_en && isp_ctx->handle_mswitch) {
+		if ((apply->last_applied_max_pd_req > 0) &&
+			(atomic_dec_and_test(&isp_ctx->mswitch_default_apply_delay_ref_cnt))) {
+			__cam_isp_ctx_find_mup_for_default_settings(
+				apply->last_applied_max_pd_req, ctx, &req);
+		}
+
+		if (req) {
+			req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+
+			CAM_DBG(CAM_ISP,
+				"Applying IQ for mode switch req: %lld ctx: %u",
+				req->request_id, ctx->ctx_id);
+			cfg.ctxt_to_hw_map = isp_ctx->hw_ctx;
+			cfg.request_id = req->request_id;
+			cfg.hw_update_entries = req_isp->cfg;
+			cfg.num_hw_update_entries = req_isp->num_cfg;
+			cfg.priv  = &req_isp->hw_update_data;
+			cfg.init_packet = 0;
+			cfg.reapply_type = CAM_CONFIG_REAPPLY_IQ;
+			cfg.cdm_reset_before_apply = req_isp->cdm_reset_before_apply;
+
+			rc = ctx->hw_mgr_intf->hw_config(ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed to apply req: %lld IQ settings in ctx: %u",
+					req->request_id, ctx->ctx_id);
+				goto end;
+			}
+			skip_rup_aup = true;
+		}
+	}
+
+	if (isp_ctx->use_default_apply) {
+		hw_cmd_args.ctxt_to_hw_map = isp_ctx->hw_ctx;
+		hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+		isp_hw_cmd_args.cmd_type =
+			CAM_ISP_HW_MGR_CMD_PROG_DEFAULT_CFG;
+
+		isp_hw_cmd_args.cmd_data = (void *)&skip_rup_aup;
+		hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+
+		rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&hw_cmd_args);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Failed to apply default settings rc %d ctx %u, link: 0x%x",
+				rc, ctx->ctx_id, ctx->link_hdl);
+		else
+			CAM_DBG(CAM_ISP, "Applied default settings rc %d ctx: %u link: 0x%x",
+				rc, ctx->ctx_id, ctx->link_hdl);
+	}
+
+end:
+	return rc;
+}
+
+static void *cam_isp_ctx_user_dump_req_list(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct list_head        *head = NULL;
+	uint64_t                *addr;
+	struct cam_ctx_request  *req, *req_temp;
+
+	head = (struct list_head *)dump_struct;
+
+	addr = (uint64_t *)addr_ptr;
+
+	if (!list_empty(head)) {
+		list_for_each_entry_safe(req, req_temp, head, list) {
+			*addr++ = req->request_id;
+		}
+	}
+
+	return addr;
+}
+
+static void *cam_isp_ctx_user_dump_active_requests(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	uint64_t                *addr;
+	struct cam_ctx_request  *req;
+
+	req = (struct cam_ctx_request *)dump_struct;
+
+	addr = (uint64_t *)addr_ptr;
+	*addr++ = req->request_id;
+	return addr;
+}
+
+static int __cam_isp_ctx_dump_req_info(
+	struct cam_context     *ctx,
+	struct cam_ctx_request *req,
+	struct cam_common_hw_dump_args *dump_args)
+{
+	int                                 i, rc = 0;
+	uint32_t                            min_len;
+	size_t                              remain_len;
+	struct cam_isp_ctx_req             *req_isp;
+	struct cam_ctx_request             *req_temp;
+
+	if (!req || !ctx || !dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid parameters %pK %pK %pK",
+			req, ctx, dump_args);
+		return -EINVAL;
+	}
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ISP,
+			"Dump buffer overshoot len %zu offset %zu, ctx_idx: %u, link: 0x%x",
+			dump_args->buf_len, dump_args->offset, ctx->ctx_id, ctx->link_hdl);
+		return -ENOSPC;
+	}
+
+	remain_len = dump_args->buf_len - dump_args->offset;
+	min_len = sizeof(struct cam_isp_context_dump_header) +
+		(CAM_ISP_CTX_DUMP_REQUEST_NUM_WORDS *
+			req_isp->num_fence_map_out *
+			sizeof(uint64_t));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu min %u, ctx_idx: %u, link: 0x%x",
+			remain_len, min_len, ctx->ctx_id, ctx->link_hdl);
+		return -ENOSPC;
+	}
+
+	/* Dump pending request list */
+	rc = cam_common_user_dump_helper(dump_args, cam_isp_ctx_user_dump_req_list,
+		&ctx->pending_req_list, sizeof(uint64_t), "ISP_OUT_FENCE_PENDING_REQUESTS:");
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"CAM_ISP_CONTEXT:Pending request dump failed, rc:%d, ctx:%u, link:0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+		return rc;
+	}
+
+	/* Dump applied request list */
+	rc = cam_common_user_dump_helper(dump_args, cam_isp_ctx_user_dump_req_list,
+		&ctx->wait_req_list, sizeof(uint64_t), "ISP_OUT_FENCE_APPLIED_REQUESTS:");
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"CAM_ISP_CONTEXT: Applied request dump failed, rc:%d, ctx:%u, link:0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+		return rc;
+	}
+
+	/* Dump active request list */
+	rc = cam_common_user_dump_helper(dump_args, cam_isp_ctx_user_dump_req_list,
+		&ctx->active_req_list, sizeof(uint64_t), "ISP_OUT_FENCE_ACTIVE_REQUESTS:");
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"CAM_ISP_CONTEXT: Active request dump failed, rc:%d, ctx:%u, link:0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+		return rc;
+	}
+
+	/* Dump active request fences */
+	if (!list_empty(&ctx->active_req_list)) {
+		list_for_each_entry_safe(req, req_temp, &ctx->active_req_list, list) {
+			req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+			for (i = 0; i < req_isp->num_fence_map_out; i++) {
+				rc = cam_common_user_dump_helper(dump_args,
+					cam_isp_ctx_user_dump_active_requests,
+					req, sizeof(uint64_t),
+					"ISP_OUT_FENCE_REQUEST_ACTIVE.%s.%u.%d:",
+					__cam_isp_ife_sfe_resource_handle_id_to_type(
+						req_isp->fence_map_out[i].resource_handle),
+					req_isp->fence_map_out[i].image_buf_addr[0],
+					req_isp->fence_map_out[i].sync_id);
+
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"CAM_ISP_CONTEXT DUMP_REQ_INFO: Dump failed, rc: %d, ctx_idx: %u, link: 0x%x",
+						rc, ctx->ctx_id, ctx->link_hdl);
+					return rc;
+				}
+			}
+		}
+	}
+
+	return rc;
+}
+
+static void *cam_isp_ctx_user_dump_timer(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_ctx_request  *req = NULL;
+	struct cam_isp_ctx_req  *req_isp = NULL;
+	uint64_t                *addr;
+	ktime_t                  cur_time;
+
+	req = (struct cam_ctx_request *)dump_struct;
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	cur_time = ktime_get();
+
+	addr = (uint64_t *)addr_ptr;
+
+	*addr++ = req->request_id;
+	*addr++ = ktime_to_timespec64(
+		req_isp->event_timestamp[CAM_ISP_CTX_EVENT_APPLY]).tv_sec;
+	*addr++ = ktime_to_timespec64(
+		req_isp->event_timestamp[CAM_ISP_CTX_EVENT_APPLY]).tv_nsec / NSEC_PER_USEC;
+	*addr++ = ktime_to_timespec64(cur_time).tv_sec;
+	*addr++ = ktime_to_timespec64(cur_time).tv_nsec / NSEC_PER_USEC;
+	return addr;
+}
+
+static void *cam_isp_ctx_user_dump_stream_info(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_context           *ctx = NULL;
+	int32_t                      *addr;
+
+	ctx = (struct cam_context *)dump_struct;
+
+	addr = (int32_t *)addr_ptr;
+
+	*addr++ = ctx->ctx_id;
+	*addr++ = ctx->dev_hdl;
+	*addr++ = ctx->link_hdl;
+
+	return addr;
+}
+
+static int __cam_isp_ctx_dump_in_top_state(
+	struct cam_context           *ctx,
+	struct cam_req_mgr_dump_info *dump_info)
+{
+	int                                 rc = 0;
+	bool                                dump_only_event_record = false;
+	size_t                              buf_len;
+	size_t                              remain_len;
+	ktime_t                             cur_time;
+	uint32_t                            min_len;
+	uint64_t                            diff;
+	uintptr_t                           cpu_addr;
+	uint8_t                             req_type;
+	struct cam_isp_context             *ctx_isp;
+	struct cam_ctx_request             *req = NULL;
+	struct cam_isp_ctx_req             *req_isp;
+	struct cam_ctx_request             *req_temp;
+	struct cam_hw_dump_args             ife_dump_args;
+	struct cam_common_hw_dump_args      dump_args;
+	struct cam_hw_cmd_args              hw_cmd_args;
+	struct cam_isp_hw_cmd_args          isp_hw_cmd_args;
+
+	rc  = cam_mem_get_cpu_buf(dump_info->buf_handle,
+		&cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Invalid handle %u rc %d, ctx_idx: %u, link: 0x%x",
+			dump_info->buf_handle, rc, ctx->ctx_id, ctx->link_hdl);
+		return rc;
+	}
+
+	spin_lock_bh(&ctx->lock);
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->active_req_list, list) {
+		if (req->request_id == dump_info->req_id) {
+			CAM_INFO(CAM_ISP, "isp dump active list req: %lld, ctx_idx: %u, link: 0x%x",
+			    dump_info->req_id, ctx->ctx_id, ctx->link_hdl);
+			req_type = 'a';
+			goto hw_dump;
+		}
+	}
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->wait_req_list, list) {
+		if (req->request_id == dump_info->req_id) {
+			CAM_INFO(CAM_ISP, "isp dump wait list req: %lld, ctx_idx: %u, link: 0x%x",
+			    dump_info->req_id, ctx->ctx_id, ctx->link_hdl);
+			req_type = 'w';
+			goto hw_dump;
+		}
+	}
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->pending_req_list, list) {
+		if (req->request_id == dump_info->req_id) {
+			CAM_INFO(CAM_ISP,
+			    "isp dump pending list req: %lld, ctx_idx: %u, link: 0x%x",
+			    dump_info->req_id, ctx->ctx_id, ctx->link_hdl);
+			req_type = 'p';
+			goto hw_dump;
+		}
+	}
+	spin_unlock_bh(&ctx->lock);
+	cam_mem_put_cpu_buf(dump_info->buf_handle);
+	return rc;
+
+hw_dump:
+	if (buf_len <= dump_info->offset) {
+		spin_unlock_bh(&ctx->lock);
+		CAM_WARN(CAM_ISP,
+		    "Dump buffer overshoot len %zu offset %zu, ctx_idx: %u, link: 0x%x",
+		    buf_len, dump_info->offset, ctx->ctx_id, ctx->link_hdl);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return -ENOSPC;
+	}
+
+	remain_len = buf_len - dump_info->offset;
+	min_len = sizeof(struct cam_isp_context_dump_header) +
+		(CAM_ISP_CTX_DUMP_NUM_WORDS * sizeof(uint64_t));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP,
+		    "Dump buffer exhaust remain %zu min %u, ctx_idx: %u, link: 0x%x",
+		    remain_len, min_len, ctx->ctx_id, ctx->link_hdl);
+		spin_unlock_bh(&ctx->lock);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return -ENOSPC;
+	}
+
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	cur_time = ktime_get();
+	diff = ktime_us_delta(
+		req_isp->event_timestamp[CAM_ISP_CTX_EVENT_APPLY],
+		cur_time);
+	__cam_isp_ctx_print_event_record(ctx_isp);
+	if (diff < CAM_ISP_CTX_RESPONSE_TIME_THRESHOLD) {
+		CAM_INFO(CAM_ISP, "req %lld found no error, ctx_idx: %u, link: 0x%x",
+			req->request_id, ctx->ctx_id, ctx->link_hdl);
+		dump_only_event_record = true;
+	}
+
+	dump_args.req_id = dump_info->req_id;
+	dump_args.cpu_addr = cpu_addr;
+	dump_args.buf_len = buf_len;
+	dump_args.offset = dump_info->offset;
+	dump_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+
+	/* Dump time info */
+	rc = cam_common_user_dump_helper(&dump_args, cam_isp_ctx_user_dump_timer,
+		req, sizeof(uint64_t), "ISP_CTX_DUMP.%c:", req_type);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Time dump fail %lld, rc: %d, ctx_idx: %u, link: 0x%x",
+			req->request_id, rc, ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+	dump_info->offset = dump_args.offset;
+
+	min_len = sizeof(struct cam_isp_context_dump_header) +
+		(CAM_ISP_CTX_DUMP_NUM_WORDS * sizeof(int32_t));
+	remain_len = buf_len - dump_info->offset;
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP,
+		    "Dump buffer exhaust remain %zu min %u, ctx_idx: %u, link: 0x%x",
+		    remain_len, min_len, ctx->ctx_id, ctx->link_hdl);
+		spin_unlock_bh(&ctx->lock);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return -ENOSPC;
+	}
+
+	/* Dump stream info */
+	ctx->ctxt_to_hw_map = ctx_isp->hw_ctx;
+	if (ctx->hw_mgr_intf->hw_dump) {
+		/* Dump first part of stream info from isp context */
+		rc = cam_common_user_dump_helper(&dump_args,
+			cam_isp_ctx_user_dump_stream_info, ctx,
+			sizeof(int32_t), "ISP_STREAM_INFO_FROM_CTX:");
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+			    "ISP CTX stream info dump fail %lld, rc: %d, ctx: %u, link: 0x%x",
+			    req->request_id, rc, ctx->ctx_id, ctx->link_hdl);
+			goto end;
+		}
+
+		dump_info->offset = dump_args.offset;
+		remain_len = buf_len - dump_info->offset;
+		if (remain_len < min_len) {
+			CAM_WARN(CAM_ISP,
+				"Dump buffer exhaust remain %zu min %u, ctx_idx: %u, link: 0x%x",
+				remain_len, min_len, ctx->ctx_id, ctx->link_hdl);
+			spin_unlock_bh(&ctx->lock);
+			cam_mem_put_cpu_buf(dump_info->buf_handle);
+			return -ENOSPC;
+		}
+
+		/* Dump second part of stream info from ife hw manager */
+		hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+		isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_DUMP_STREAM_INFO;
+		isp_hw_cmd_args.cmd_data = &dump_args;
+		hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+
+		rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv, &hw_cmd_args);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+			    "IFE HW MGR stream info dump fail %lld, rc: %d, ctx: %u, link: 0x%x",
+			    req->request_id, rc, ctx->ctx_id, ctx->link_hdl);
+			goto end;
+		}
+
+		dump_info->offset = dump_args.offset;
+	}
+
+	/* Dump event record */
+	rc = __cam_isp_ctx_dump_event_record(ctx_isp, &dump_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Event record dump fail %lld, rc: %d, ctx_idx: %u, link: 0x%x",
+			req->request_id, rc, ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+	dump_info->offset = dump_args.offset;
+	if (dump_only_event_record) {
+		goto end;
+	}
+
+	/* Dump state monitor array */
+	rc = __cam_isp_ctx_user_dump_state_monitor_array(ctx_isp, &dump_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Dump event fail %lld, rc: %d, ctx_idx: %u, link: 0x%x",
+			req->request_id, rc, ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+
+	/* Dump request info */
+	rc = __cam_isp_ctx_dump_req_info(ctx, req, &dump_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Dump Req info fail %lld, rc: %d, ctx_idx: %u, link: 0x%x",
+			req->request_id, rc, ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+	spin_unlock_bh(&ctx->lock);
+
+	/* Dump CSID, VFE, and SFE info */
+	dump_info->offset = dump_args.offset;
+	if (ctx->hw_mgr_intf->hw_dump) {
+		ife_dump_args.offset = dump_args.offset;
+		ife_dump_args.request_id = dump_info->req_id;
+		ife_dump_args.buf_handle = dump_info->buf_handle;
+		ife_dump_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		rc = ctx->hw_mgr_intf->hw_dump(
+			ctx->hw_mgr_intf->hw_mgr_priv,
+			&ife_dump_args);
+		dump_info->offset = ife_dump_args.offset;
+	}
+	cam_mem_put_cpu_buf(dump_info->buf_handle);
+	return rc;
+
+end:
+	spin_unlock_bh(&ctx->lock);
+	cam_mem_put_cpu_buf(dump_info->buf_handle);
+	return rc;
+}
+
+static int __cam_isp_ctx_flush_req_in_flushed_state(
+	struct cam_context               *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	CAM_INFO(CAM_ISP, "Flush (type %d) in flushed state req id %lld ctx_id:%u link: 0x%x",
+		flush_req->type, flush_req->req_id, ctx->ctx_id, ctx->link_hdl);
+	if (flush_req->req_id > ctx->last_flush_req)
+		ctx->last_flush_req = flush_req->req_id;
+
+	return 0;
+}
+
+static int __cam_isp_ctx_flush_req(struct cam_context *ctx,
+	struct list_head *req_list, struct cam_req_mgr_flush_request *flush_req)
+{
+	int i, rc, tmp = 0;
+	struct cam_ctx_request           *req;
+	struct cam_ctx_request           *req_temp;
+	struct cam_isp_ctx_req           *req_isp;
+	struct list_head                  flush_list;
+	struct cam_isp_context           *ctx_isp = NULL;
+
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+
+	INIT_LIST_HEAD(&flush_list);
+	if (list_empty(req_list)) {
+		CAM_DBG(CAM_ISP, "request list is empty, ctx_id:%u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			CAM_INFO(CAM_ISP,
+			    "no request to cancel(lastapplied:%lld cancel:%lld),ctx:%u link:0x%x",
+			    ctx_isp->last_applied_req_id, flush_req->req_id,
+			    ctx->ctx_id, ctx->link_hdl);
+			return -EINVAL;
+		} else
+			return 0;
+	}
+
+	CAM_DBG(CAM_REQ, "Flush [%u] in progress for req_id %llu, ctx_id:%u link: 0x%x",
+		flush_req->type, flush_req->req_id, ctx->ctx_id, ctx->link_hdl);
+	list_for_each_entry_safe(req, req_temp, req_list, list) {
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			if (req->request_id != flush_req->req_id) {
+				continue;
+			} else {
+				list_del_init(&req->list);
+				list_add_tail(&req->list, &flush_list);
+				__cam_isp_ctx_update_state_monitor_array(
+					ctx_isp,
+					CAM_ISP_STATE_CHANGE_TRIGGER_FLUSH,
+					req->request_id);
+				break;
+			}
+		}
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &flush_list);
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_FLUSH, req->request_id);
+	}
+
+	if (list_empty(&flush_list)) {
+		/*
+		 * Maybe the req isn't sent to KMD since UMD already skip
+		 * req in CSL layer.
+		 */
+		CAM_INFO(CAM_ISP,
+			"flush list is empty, flush type %d for req %llu, ctx_id:%u link: 0x%x",
+			flush_req->type, flush_req->req_id, ctx->ctx_id, ctx->link_hdl);
+		return 0;
+	}
+
+	list_for_each_entry_safe(req, req_temp, &flush_list, list) {
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		for (i = 0; i < req_isp->num_fence_map_out; i++) {
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				CAM_DBG(CAM_ISP,
+					"Flush req 0x%llx, fence %d, ctx_id:%u link: 0x%x",
+					req->request_id,
+					req_isp->fence_map_out[i].sync_id,
+					ctx->ctx_id, ctx->link_hdl);
+				rc = cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_ISP_EVENT_FLUSH);
+				if (rc) {
+					tmp = req_isp->fence_map_out[i].sync_id;
+					CAM_ERR_RATE_LIMIT(CAM_ISP,
+						"signal fence %d failed, ctx_id:%u link: 0x%x",
+						tmp, ctx->ctx_id, ctx->link_hdl);
+				}
+				req_isp->fence_map_out[i].sync_id = -1;
+			}
+		}
+		req_isp->reapply_type = CAM_CONFIG_REAPPLY_NONE;
+		req_isp->cdm_reset_before_apply = false;
+		list_del_init(&req->list);
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+	}
+
+	return 0;
+}
+
+static int __cam_isp_ctx_flush_offline_req_in_top_state (
+	struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	struct cam_isp_context           *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_req_mgr_flush_request  flush_req;
+	struct cam_hw_cmd_args            hw_cmd_args;
+	struct cam_isp_hw_cmd_args        isp_hw_cmd_args;
+	int                               rc = 0;
+
+	memset(&hw_cmd_args, 0, sizeof(hw_cmd_args));
+	memset(&flush_req, 0, sizeof(flush_req));
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_FLUSH_OFFLINE;
+	switch (cmd->flush_type) {
+	case CAM_FLUSH_TYPE_REQ:
+		flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ;
+		isp_hw_cmd_args.u.req_id = cmd->req_id;
+		break;
+	case CAM_FLUSH_TYPE_ALL:
+		flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_ALL;
+		isp_hw_cmd_args.u.req_id = -1;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid flush command");
+		return -EINVAL;
+	}
+
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed");
+		return rc;
+	}
+
+	flush_req.req_id = cmd->req_id;
+	spin_lock_bh(&ctx->lock);
+	if (__cam_isp_ctx_flush_req(ctx, &ctx->wait_req_list, &flush_req))
+		CAM_ERR(CAM_ISP, "Flushing wait list failed!");
+	if (__cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, &flush_req))
+		CAM_ERR(CAM_ISP, "Flushing pending list failed!");
+	if (__cam_isp_ctx_flush_req(ctx, &ctx->active_req_list, &flush_req))
+		CAM_ERR(CAM_ISP, "Flushing active list failed!");
+	spin_unlock_bh(&ctx->lock);
+	return rc;
+}
+
+static int cam_isp_ctx_flush_affected_ctx_req_list(
+	struct cam_context               *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	int rc;
+	struct cam_isp_context           *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_ctx_request            *req;
+	struct cam_req_mgr_timer_notify   timer;
+
+	CAM_DBG(CAM_ISP, "Flush pending list");
+	mutex_lock(&ctx_isp->isp_mutex);
+	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
+
+	__cam_isp_ctx_trigger_reg_dump(CAM_HW_MGR_CMD_REG_DUMP_ON_FLUSH, ctx);
+
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_timer) {
+		timer.link_hdl = ctx->link_hdl;
+		timer.dev_hdl = ctx->dev_hdl;
+		timer.state = false;
+		ctx->ctx_crm_intf->notify_timer(&timer);
+	}
+
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request, list);
+		ctx->last_flush_req = req->request_id;
+		rc = __cam_isp_ctx_flush_req(ctx, &ctx->wait_req_list,
+			flush_req);
+	}
+
+	if (!list_empty(&ctx->active_req_list)) {
+		if (!ctx->last_flush_req) {
+			req = list_last_entry(&ctx->active_req_list, struct cam_ctx_request, list);
+			ctx->last_flush_req = req->request_id;
+		}
+		rc = __cam_isp_ctx_flush_req(ctx, &ctx->active_req_list,
+			flush_req);
+	}
+
+	CAM_DBG(CAM_ISP, "Last request id to flush is %lld, ctx_id: %d",
+		flush_req->req_id, ctx->ctx_id);
+
+	ctx_isp->active_req_cnt = 0;
+	ctx_isp->bubble_frame_cnt = 0;
+	mutex_unlock(&ctx_isp->isp_mutex);
+
+	atomic_set(&ctx_isp->process_bubble, 0);
+	atomic_set(&ctx_isp->internal_recovery_set, 0);
+	atomic_set(&ctx_isp->flush_in_progress, 0);
+
+	return rc;
+}
+
+static int cam_isp_ctx_flush_all_affected_ctx_stream_grp(
+	struct cam_context               *ctx,
+	struct cam_req_mgr_flush_request *flush_req,
+	enum cam_isp_ctx_flush_event      cmd_type)
+{
+	uint32_t                          rc = 0;
+	struct cam_context               *active_ctx = NULL;
+	struct cam_isp_context           *ctx_isp = NULL;
+	struct cam_hw_cmd_args            hw_cmd_args;
+	struct cam_isp_hw_cmd_args        isp_hw_cmd_args;
+	int                               stream_grp_cfg_index;
+	struct cam_isp_hw_active_hw_ctx   active_hw_ctx;
+	int active_hw_ctx_cnt;
+	int i;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_GET_ACTIVE_HW_CTX_CNT;
+	isp_hw_cmd_args.u.active_hw_ctx.hw_ctx_cnt = 0;
+
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+
+	active_hw_ctx_cnt = isp_hw_cmd_args.u.active_hw_ctx.hw_ctx_cnt;
+	stream_grp_cfg_index = isp_hw_cmd_args.u.active_hw_ctx.stream_grp_cfg_index;
+	CAM_DBG(CAM_ISP, "active hw context count :%d stream_grp_cfg_index :%u",
+		active_hw_ctx_cnt, stream_grp_cfg_index);
+
+	active_hw_ctx.stream_grp_cfg_index = stream_grp_cfg_index;
+	active_hw_ctx.index = 0;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_GET_HW_CTX;
+	isp_hw_cmd_args.cmd_data = &active_hw_ctx;
+
+	for (i = 0; i < active_hw_ctx_cnt; i++) {
+		hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+		ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&hw_cmd_args);
+
+		active_ctx = (struct cam_context *)isp_hw_cmd_args.u.ptr;
+
+		if (active_ctx->ctx_id == ctx->ctx_id)
+			continue;
+
+		ctx_isp = (struct cam_isp_context *)active_ctx->ctx_priv;
+
+		switch (cmd_type) {
+		case CAM_ISP_CTX_FLUSH_AFFECTED_CTX_SET_FLUSH_IN_PROGRESS:
+			atomic_set(&ctx_isp->flush_in_progress, 1);
+			break;
+		case CAM_ISP_CTX_FLUSH_AFFECTED_CTX_REQ_LIST:
+			rc = cam_isp_ctx_flush_affected_ctx_req_list(active_ctx, flush_req);
+			if (rc)
+				return rc;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "invalid flush event cmd type: %d", cmd_type);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static inline void __cam_isp_ctx_reset_fcg_tracker(
+	struct cam_context *ctx)
+{
+	struct cam_isp_context         *ctx_isp;
+	struct cam_isp_skip_frame_info *skip_info;
+
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+
+	/* Reset skipped_list for FCG config */
+	ctx_isp->fcg_tracker.sum_skipped = 0;
+	ctx_isp->fcg_tracker.num_skipped = 0;
+	list_for_each_entry(skip_info, &ctx_isp->fcg_tracker.skipped_list, list)
+		skip_info->num_frame_skipped = 0;
+	CAM_DBG(CAM_ISP, "Reset FCG skip info on ctx %u link: %x",
+		ctx->ctx_id, ctx->link_hdl);
+}
+
+static int __cam_isp_ctx_flush_req_in_top_state(
+	struct cam_context               *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	int                               rc = 0;
+	struct cam_isp_context           *ctx_isp;
+	struct cam_isp_stop_args          stop_isp;
+	struct cam_hw_stop_args           stop_args;
+	struct cam_hw_reset_args          reset_args;
+	struct cam_req_mgr_timer_notify   timer;
+
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+
+	/* Reset skipped_list for FCG config */
+	__cam_isp_ctx_reset_fcg_tracker(ctx);
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		if (ctx->state <= CAM_CTX_READY) {
+			ctx->state = CAM_CTX_ACQUIRED;
+			goto end;
+		}
+
+		spin_lock_bh(&ctx->lock);
+		ctx->state = CAM_CTX_FLUSHED;
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_HALT;
+		spin_unlock_bh(&ctx->lock);
+
+		atomic_set(&ctx_isp->flush_in_progress, 1);
+		cam_isp_ctx_flush_all_affected_ctx_stream_grp(ctx, flush_req,
+			CAM_ISP_CTX_FLUSH_AFFECTED_CTX_SET_FLUSH_IN_PROGRESS);
+
+		CAM_INFO(CAM_ISP, "Last request id to flush is %lld, ctx_id:%u link: 0x%x",
+			flush_req->req_id, ctx->ctx_id, ctx->link_hdl);
+		ctx->last_flush_req = flush_req->req_id;
+
+		__cam_isp_ctx_trigger_reg_dump(CAM_HW_MGR_CMD_REG_DUMP_ON_FLUSH, ctx);
+
+		stop_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		stop_isp.hw_stop_cmd = CAM_ISP_HW_STOP_IMMEDIATELY;
+		stop_isp.stop_only = true;
+		stop_isp.is_internal_stop = false;
+		stop_args.args = (void *)&stop_isp;
+		rc = ctx->hw_mgr_intf->hw_stop(ctx->hw_mgr_intf->hw_mgr_priv,
+			&stop_args);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to stop HW in Flush rc: %d, ctx_id:%u link: 0x%x",
+				rc, ctx->ctx_id, ctx->link_hdl);
+
+		CAM_INFO(CAM_ISP, "Stop HW complete. Reset HW next.Ctx_id:%u link: 0x%x",
+			 ctx->ctx_id, ctx->link_hdl);
+		CAM_DBG(CAM_ISP, "Flush wait and active lists, ctx_id:%u link: 0x%x",
+			 ctx->ctx_id, ctx->link_hdl);
+
+		if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_timer) {
+			timer.link_hdl = ctx->link_hdl;
+			timer.dev_hdl = ctx->dev_hdl;
+			timer.state = false;
+			ctx->ctx_crm_intf->notify_timer(&timer);
+		}
+
+		spin_lock_bh(&ctx->lock);
+		if (!list_empty(&ctx->wait_req_list))
+			__cam_isp_ctx_flush_req(ctx, &ctx->wait_req_list,
+				flush_req);
+
+		if (!list_empty(&ctx->active_req_list))
+			__cam_isp_ctx_flush_req(ctx, &ctx->active_req_list,
+				flush_req);
+
+		ctx_isp->active_req_cnt = 0;
+		spin_unlock_bh(&ctx->lock);
+
+		rc = cam_isp_ctx_flush_all_affected_ctx_stream_grp(ctx, flush_req,
+			CAM_ISP_CTX_FLUSH_AFFECTED_CTX_REQ_LIST);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to flush other active HW ctx rc: %d", rc);
+
+		reset_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		rc = ctx->hw_mgr_intf->hw_reset(ctx->hw_mgr_intf->hw_mgr_priv,
+			&reset_args);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to reset HW rc: %d, ctx_id:%u link: 0x%x",
+				 rc, ctx->ctx_id, ctx->link_hdl);
+
+		ctx_isp->init_received = false;
+	}
+
+	CAM_DBG(CAM_ISP, "Flush pending list, ctx_idx: %u, link: 0x%x", ctx->ctx_id, ctx->link_hdl);
+	/*
+	 * On occasions when we are doing a flush all, HW would get reset
+	 * shutting down any th/bh in the pipeline. If internal recovery
+	 * is triggered prior to flush, by clearing the pending list post
+	 * HW reset will ensure no stale request entities are left behind
+	 */
+	spin_lock_bh(&ctx->lock);
+	__cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
+	spin_unlock_bh(&ctx->lock);
+
+end:
+	ctx_isp->bubble_frame_cnt = 0;
+	ctx_isp->congestion_cnt = 0;
+	ctx_isp->sof_dbg_irq_en = false;
+	atomic_set(&ctx_isp->process_bubble, 0);
+	atomic_set(&ctx_isp->internal_recovery_set, 0);
+	atomic_set(&ctx_isp->flush_in_progress, 0);
+	return rc;
+}
+
+static int __cam_isp_ctx_flush_req_in_ready(
+	struct cam_context *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "try to flush pending list, ctx_id:%u link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
+
+	/* if nothing is in pending req list, change state to acquire */
+	if (list_empty(&ctx->pending_req_list))
+		ctx->state = CAM_CTX_ACQUIRED;
+	spin_unlock_bh(&ctx->lock);
+
+	trace_cam_context_state("ISP", ctx);
+
+	CAM_DBG(CAM_ISP, "Flush request in ready state. next state %d, ctx_id:%u link: 0x%x",
+		 ctx->state, ctx->ctx_id, ctx->link_hdl);
+	return rc;
+}
+
+static struct cam_ctx_ops
+	cam_isp_ctx_activated_state_machine[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_sof,
+			.notify_frame_skip =
+				__cam_isp_ctx_apply_default_req_settings,
+		},
+		.irq_ops = NULL,
+	},
+	/* APPLIED */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* EPOCH */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_epoch,
+			.notify_frame_skip =
+				__cam_isp_ctx_apply_default_req_settings,
+		},
+		.irq_ops = NULL,
+	},
+	/* BUBBLE */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_bubble,
+			.notify_frame_skip =
+				__cam_isp_ctx_apply_default_req_settings,
+		},
+		.irq_ops = NULL,
+	},
+	/* Bubble Applied */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.notify_frame_skip =
+				__cam_isp_ctx_apply_default_req_settings,
+		},
+		.irq_ops = NULL,
+	},
+	/* HW ERROR */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HALT */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+};
+
+static struct cam_ctx_ops
+	cam_isp_ctx_fs2_state_machine[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_sof,
+		},
+		.irq_ops = NULL,
+	},
+	/* APPLIED */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* EPOCH */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_epoch,
+		},
+		.irq_ops = NULL,
+	},
+	/* BUBBLE */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_bubble,
+		},
+		.irq_ops = NULL,
+	},
+	/* Bubble Applied */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HW ERROR */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HALT */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+};
+
+static int __cam_isp_ctx_rdi_only_sof_in_top_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_context                    *ctx = ctx_isp->base;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	uint64_t                               request_id  = 0;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data, ctx_idx: %u, link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	__cam_isp_ctx_update_sof_ts_util(sof_event_data, ctx_isp);
+
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx, ctx_idx: %u, link: 0x%x",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val, ctx->ctx_id, ctx->link_hdl);
+
+	/*
+	 * notify reqmgr with sof signal. Note, due to scheduling delay
+	 * we can run into situation that two active requests has already
+	 * be in the active queue while we try to do the notification.
+	 * In this case, we need to skip the current notification. This
+	 * helps the state machine to catch up the delay.
+	 */
+	if (ctx_isp->active_req_cnt <= 2) {
+		__cam_isp_ctx_notify_trigger_util(CAM_TRIGGER_POINT_SOF, ctx_isp);
+
+		/*
+		 * It's possible for rup done to be processed before
+		 * SOF, check for first active request shutter here
+		 */
+		if (!list_empty(&ctx->active_req_list)) {
+			struct cam_ctx_request  *req = NULL;
+
+			req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+			if (req->request_id > ctx_isp->reported_req_id) {
+				request_id = req->request_id;
+				ctx_isp->reported_req_id = request_id;
+			}
+		}
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Can not notify SOF to CRM, ctx_idx: %u, link: 0x%x",
+				 ctx->ctx_id, ctx->link_hdl);
+	}
+
+	if (list_empty(&ctx->active_req_list))
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+	else
+		CAM_DBG(CAM_ISP, "Still need to wait for the buf done, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+	CAM_DBG(CAM_ISP, "next Substate[%s], ctx_idx: %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+	return rc;
+}
+
+static int __cam_isp_ctx_rdi_only_sof_in_applied_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	struct cam_context                    *ctx = ctx_isp->base;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data");
+		return -EINVAL;
+	}
+
+	__cam_isp_ctx_update_sof_ts_util(sof_event_data, ctx_isp);
+
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx ctx:%d",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val, ctx->ctx_id);
+
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED;
+	CAM_DBG(CAM_ISP, "next Substate[%s] ctx:%d",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id);
+
+	return 0;
+}
+
+static int __cam_isp_ctx_rdi_only_sof_in_bubble_applied(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_ctx_request    *req;
+	struct cam_isp_ctx_req    *req_isp;
+	struct cam_context        *ctx = ctx_isp->base;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	uint64_t  request_id = 0;
+
+	/*
+	 * Sof in bubble applied state means, reg update not received.
+	 * before increment frame id and override time stamp value, send
+	 * the previous sof time stamp that got captured in the
+	 * sof in applied state.
+	 */
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx, ctx_idx: %u, link: 0x%x",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val, ctx->ctx_id, ctx->link_hdl);
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+	__cam_isp_ctx_update_sof_ts_util(sof_event_data, ctx_isp);
+
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx, ctx_idx: %u, link: 0x%x",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val, ctx->ctx_id, ctx->link_hdl);
+
+	if (list_empty(&ctx->wait_req_list)) {
+		/*
+		 * If no pending req in epoch, this is an error case.
+		 * The recovery is to go back to sof state
+		 */
+		CAM_ERR(CAM_ISP, "No wait request, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+
+		/* Send SOF event as empty frame*/
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+		goto end;
+	}
+
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
+		list);
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	req_isp->bubble_detected = true;
+	CAM_INFO_RATE_LIMIT(CAM_ISP, "Ctx:%u link: 0x%x Report Bubble flag %d req id:%lld",
+		ctx->ctx_id, ctx->link_hdl, req_isp->bubble_report, req->request_id);
+	req_isp->reapply_type = CAM_CONFIG_REAPPLY_IO;
+	req_isp->cdm_reset_before_apply = false;
+
+	if (req_isp->bubble_report) {
+		__cam_isp_ctx_notify_error_util(CAM_TRIGGER_POINT_SOF, CRM_KMD_ERR_BUBBLE,
+			req->request_id, ctx_isp);
+		atomic_set(&ctx_isp->process_bubble, 1);
+	} else {
+		req_isp->bubble_report = 0;
+	}
+
+	/*
+	 * Always move the request to active list. Let buf done
+	 * function handles the rest.
+	 */
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->active_req_list);
+	ctx_isp->active_req_cnt++;
+	CAM_DBG(CAM_ISP, "move request %lld to active list(cnt = %d), ctx_idx: %u, link: 0x%x",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+
+	if (!req_isp->bubble_report) {
+		if (req->request_id > ctx_isp->reported_req_id) {
+			request_id = req->request_id;
+			ctx_isp->reported_req_id = request_id;
+			__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+				CAM_REQ_MGR_SOF_EVENT_ERROR);
+		} else
+			__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+				CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	} else
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+	/* change the state to bubble, as reg update has not come */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+	CAM_DBG(CAM_ISP, "next Substate[%s], ctx_idx: %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+end:
+	return 0;
+}
+
+static int __cam_isp_ctx_rdi_only_sof_in_bubble_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	uint32_t i;
+	struct cam_ctx_request                *req;
+	struct cam_context                    *ctx = ctx_isp->base;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	struct cam_isp_ctx_req                *req_isp;
+	struct cam_hw_cmd_args                 hw_cmd_args;
+	struct cam_isp_hw_cmd_args             isp_hw_cmd_args;
+	uint64_t                               request_id  = 0;
+	uint64_t                               last_cdm_done_req = 0;
+	int                                    rc = 0;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	__cam_isp_ctx_update_sof_ts_util(sof_event_data, ctx_isp);
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx, ctx_idx: %u, link: 0x%x",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val, ctx->ctx_id, ctx->link_hdl);
+
+
+	if (atomic_read(&ctx_isp->process_bubble)) {
+		if (list_empty(&ctx->active_req_list)) {
+			CAM_ERR(CAM_ISP, "No available active req in bubble, ctx: %u, link: 0x%x",
+				ctx->ctx_id, ctx->link_hdl);
+			atomic_set(&ctx_isp->process_bubble, 0);
+			return -EINVAL;
+		}
+
+		if (ctx_isp->last_sof_timestamp ==
+			ctx_isp->sof_timestamp_val) {
+			CAM_DBG(CAM_ISP,
+				"Tasklet delay detected! Bubble frame: %lld check skipped, sof_timestamp: %lld, ctx_id: %u, link: 0x%x",
+				ctx_isp->frame_id,
+				ctx_isp->sof_timestamp_val,
+				ctx->ctx_id, ctx->link_hdl);
+			goto end;
+		}
+
+		req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+		if (req_isp->bubble_detected) {
+			hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+			hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+			isp_hw_cmd_args.cmd_type =
+				CAM_ISP_HW_MGR_GET_LAST_CDM_DONE;
+			hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+			rc = ctx->hw_mgr_intf->hw_cmd(
+				ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "HW command failed, ctx_id: %u, link: 0x%x",
+					ctx->ctx_id, ctx->link_hdl);
+				return rc;
+			}
+
+			last_cdm_done_req = isp_hw_cmd_args.u.last_cdm_done;
+			CAM_DBG(CAM_ISP, "last_cdm_done req: %d ctx_id: %u, link: 0x%x",
+				last_cdm_done_req, ctx->ctx_id, ctx->link_hdl);
+
+			if (last_cdm_done_req >= req->request_id) {
+				CAM_DBG(CAM_ISP,
+					"CDM callback detected for req: %lld, possible buf_done delay, waiting for buf_done, ctx_id: %u, link: 0x%x",
+					req->request_id, ctx->ctx_id, ctx->link_hdl);
+				if (req_isp->num_fence_map_out ==
+					req_isp->num_deferred_acks) {
+					__cam_isp_handle_deferred_buf_done(ctx_isp, req,
+						true,
+						CAM_SYNC_STATE_SIGNALED_ERROR,
+						CAM_SYNC_ISP_EVENT_BUBBLE);
+
+					__cam_isp_ctx_handle_buf_done_for_req_list(
+						ctx_isp, req);
+				}
+				goto end;
+			} else {
+				CAM_WARN(CAM_ISP,
+					"CDM callback not happened for req: %lld, possible CDM stuck or workqueue delay, ctx_id: %u, link: 0x%x",
+					req->request_id, ctx->ctx_id, ctx->link_hdl);
+				req_isp->num_acked = 0;
+				req_isp->num_deferred_acks = 0;
+				req_isp->bubble_detected = false;
+				req_isp->cdm_reset_before_apply = true;
+				list_del_init(&req->list);
+				list_add(&req->list, &ctx->pending_req_list);
+				atomic_set(&ctx_isp->process_bubble, 0);
+				ctx_isp->active_req_cnt--;
+				CAM_DBG(CAM_REQ,
+					"Move active req: %lld to pending list(cnt = %d) [bubble re-apply],ctx %u link: 0x%x",
+					req->request_id,
+					ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+			}
+			goto end;
+		}
+	}
+
+	/*
+	 * Signal all active requests with error and move the  all the active
+	 * requests to free list
+	 */
+	while (!list_empty(&ctx->active_req_list)) {
+		req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_ISP, "signal fence in active list. fence num %d, ctx %u link: 0x%x",
+			req_isp->num_fence_map_out, ctx->ctx_id, ctx->link_hdl);
+		for (i = 0; i < req_isp->num_fence_map_out; i++)
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+			}
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		ctx_isp->active_req_cnt--;
+	}
+
+end:
+	/* notify reqmgr with sof signal */
+	__cam_isp_ctx_notify_trigger_util(CAM_TRIGGER_POINT_SOF, ctx_isp);
+
+	/*
+	 * It is idle frame with out any applied request id, send
+	 * request id as zero
+	 */
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+	/*
+	 * Can't move the substate to SOF if we are processing bubble,
+	 * since the SOF substate can't receive REG_UPD and buf done,
+	 * then the processing of bubble req can't be finished
+	 */
+	if (!atomic_read(&ctx_isp->process_bubble))
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+
+	CAM_DBG(CAM_ISP, "next Substate[%s], ctx %u link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+
+	ctx_isp->last_sof_timestamp = ctx_isp->sof_timestamp_val;
+	return 0;
+}
+
+
+static int __cam_isp_ctx_rdi_only_reg_upd_in_bubble_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_ctx_request  *req = NULL;
+	struct cam_context      *ctx = ctx_isp->base;
+
+	req = list_first_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+
+	CAM_INFO(CAM_ISP, "Received RUP for Bubble Request, ctx %u link: 0x%x",
+		req->request_id, ctx->ctx_id, ctx->link_hdl);
+
+	return 0;
+}
+
+static int __cam_isp_ctx_rdi_only_reg_upd_in_bubble_applied_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_ctx_request  *req = NULL;
+	struct cam_context      *ctx = ctx_isp->base;
+	struct cam_isp_ctx_req  *req_isp;
+	uint64_t  request_id  = 0;
+
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
+	/* notify reqmgr with sof signal*/
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request, ctx %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto error;
+	}
+
+	req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+	list_del_init(&req->list);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	request_id =
+		(req_isp->hw_update_data.packet_opcode_type ==
+		CAM_ISP_PACKET_INIT_DEV) ? 0 : req->request_id;
+
+	if (req_isp->num_fence_map_out != 0) {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		CAM_DBG(CAM_ISP,
+			"move request %lld to active list(cnt = %d), ctx %u link: 0x%x",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+		/* if packet has buffers, set correct request id */
+		request_id = req->request_id;
+	} else {
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		/* no io config, so the request is completed. */
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		CAM_DBG(CAM_ISP,
+			"move active req %lld to free list(cnt=%d), ctx %u link: 0x%x",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+	}
+
+	__cam_isp_ctx_notify_trigger_util(CAM_TRIGGER_POINT_SOF, ctx_isp);
+
+	if (request_id)
+		ctx_isp->reported_req_id = request_id;
+
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	CAM_DBG(CAM_ISP, "next Substate[%s], ctx %u link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_RUP, req, NULL);
+	return 0;
+error:
+	/* Send SOF event as idle frame*/
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_RUP, NULL, NULL);
+
+	/*
+	 * There is no request in the pending list, move the sub state machine
+	 * to SOF sub state
+	 */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+
+	return 0;
+}
+
+static struct cam_isp_ctx_irq_ops
+	cam_isp_ctx_rdi_only_activated_state_machine_irq
+			[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			NULL,
+			__cam_isp_ctx_rdi_only_sof_in_top_state,
+			__cam_isp_ctx_reg_upd_in_sof,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			NULL,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_rdi_only_sof_in_applied_state,
+			__cam_isp_ctx_reg_upd_in_applied_state,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_applied,
+		},
+	},
+	/* EPOCH */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_rdi_only_sof_in_top_state,
+			NULL,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_epoch,
+		},
+	},
+	/* BUBBLE*/
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_rdi_only_sof_in_bubble_state,
+			__cam_isp_ctx_rdi_only_reg_upd_in_bubble_state,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_bubble,
+		},
+	},
+	/* BUBBLE APPLIED ie PRE_BUBBLE */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_rdi_only_sof_in_bubble_applied,
+			__cam_isp_ctx_rdi_only_reg_upd_in_bubble_applied_state,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_bubble_applied,
+		},
+	},
+	/* HW ERROR */
+	{
+	},
+	/* HALT */
+	{
+	},
+};
+
+static int __cam_isp_ctx_rdi_only_apply_req_top_state(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "current Substate[%s], ctx_idx: %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+	rc = __cam_isp_ctx_apply_req_in_activated_state(ctx, apply,
+		CAM_ISP_CTX_ACTIVATED_APPLIED);
+	CAM_DBG(CAM_ISP, "new Substate[%s], ctx_idx: %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%u link: 0x%x Apply failed in Substate[%s], rc %d",
+			ctx->ctx_id, ctx->link_hdl,
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc);
+
+	return rc;
+}
+
+static struct cam_ctx_ops
+	cam_isp_ctx_rdi_only_activated_state_machine
+		[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_rdi_only_apply_req_top_state,
+		},
+		.irq_ops = NULL,
+	},
+	/* APPLIED */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* EPOCH */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_rdi_only_apply_req_top_state,
+		},
+		.irq_ops = NULL,
+	},
+	/* PRE BUBBLE */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* BUBBLE */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HW ERROR */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HALT */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+};
+
+static int __cam_isp_ctx_flush_dev_in_top_state(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	struct cam_isp_context *ctx_isp = ctx->ctx_priv;
+	struct cam_req_mgr_flush_request flush_req;
+
+	if (!ctx_isp->offline_context) {
+		CAM_ERR(CAM_ISP, "flush dev only supported in offline context,ctx: %u, link:0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	flush_req.type = (cmd->flush_type == CAM_FLUSH_TYPE_ALL) ? CAM_REQ_MGR_FLUSH_TYPE_ALL :
+			CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ;
+	flush_req.req_id = cmd->req_id;
+
+	CAM_DBG(CAM_ISP, "offline flush (type:%u, req:%lu), ctx_idx: %u, link: 0x%x",
+		flush_req.type, flush_req.req_id, ctx->ctx_id, ctx->link_hdl);
+
+	CAM_DBG(CAM_ISP, "cam ctx id %d offline ctx %d rdi only ctx %d state %d",
+			ctx->ctx_id,
+			ctx_isp->offline_context,
+			ctx_isp->rdi_only_context,
+			ctx->state);
+
+	switch (ctx->state) {
+	case CAM_CTX_ACQUIRED:
+	case CAM_CTX_ACTIVATED:
+		return __cam_isp_ctx_flush_offline_req_in_top_state(ctx, cmd);
+	case CAM_CTX_READY:
+		return __cam_isp_ctx_flush_req_in_ready(ctx, &flush_req);
+	default:
+		CAM_ERR(CAM_ISP, "flush dev in wrong state: %d, ctx_idx: %u, link: 0x%x",
+			ctx->state, ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	if (cmd->flush_type == CAM_FLUSH_TYPE_ALL)
+		cam_req_mgr_workq_flush(ctx_isp->workq);
+}
+
+static void __cam_isp_ctx_free_mem_hw_entries(struct cam_context *ctx)
+{
+	int  i;
+
+	if (ctx->out_map_entries) {
+		for (i = 0; i < CAM_ISP_CTX_REQ_MAX; i++) {
+			kfree(ctx->out_map_entries[i]);
+			ctx->out_map_entries[i] = NULL;
+		}
+
+		kfree(ctx->out_map_entries);
+		ctx->out_map_entries = NULL;
+	}
+
+	if (ctx->in_map_entries) {
+		for (i = 0; i < CAM_ISP_CTX_REQ_MAX; i++) {
+			kfree(ctx->in_map_entries[i]);
+			ctx->in_map_entries[i] = NULL;
+		}
+
+		kfree(ctx->in_map_entries);
+		ctx->in_map_entries = NULL;
+	}
+
+	if (ctx->hw_update_entry) {
+		for (i = 0; i < CAM_ISP_CTX_REQ_MAX; i++) {
+			kfree(ctx->hw_update_entry[i]);
+			ctx->hw_update_entry[i] = NULL;
+		}
+
+		kfree(ctx->hw_update_entry);
+		ctx->hw_update_entry = NULL;
+	}
+
+	ctx->max_out_map_entries = 0;
+	ctx->max_in_map_entries = 0;
+	ctx->max_hw_update_entries = 0;
+}
+
+static int __cam_isp_ctx_release_hw_in_top_state(struct cam_context *ctx,
+	void *cmd)
+{
+	int rc = 0;
+	struct cam_hw_release_args       rel_arg;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_req_mgr_flush_request flush_req;
+	int i;
+
+	if (ctx_isp->hw_ctx) {
+		rel_arg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv,
+			&rel_arg);
+		ctx_isp->hw_ctx = NULL;
+	} else {
+		CAM_ERR(CAM_ISP, "No hw resources acquired for ctx[%u], link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+	}
+
+	ctx->last_flush_req = 0;
+	ctx_isp->custom_enabled = false;
+	ctx_isp->use_frame_header_ts = false;
+	ctx_isp->use_default_apply = false;
+	ctx_isp->frame_id = 0;
+	ctx_isp->active_req_cnt = 0;
+	ctx_isp->reported_req_id = 0;
+	ctx_isp->reported_frame_id = 0;
+	ctx_isp->hw_acquired = false;
+	ctx_isp->init_received = false;
+	ctx_isp->support_consumed_addr = false;
+	ctx_isp->aeb_enabled = false;
+	ctx_isp->req_info.last_bufdone_req_id = 0;
+	kfree(ctx_isp->vfe_bus_comp_grp);
+	kfree(ctx_isp->sfe_bus_comp_grp);
+	ctx_isp->vfe_bus_comp_grp = NULL;
+	ctx_isp->sfe_bus_comp_grp = NULL;
+
+	atomic64_set(&ctx_isp->dbg_monitors.state_monitor_head, -1);
+	atomic64_set(&ctx_isp->dbg_monitors.frame_monitor_head, -1);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->dbg_monitors.event_record_head[i], -1);
+	/*
+	 * Ideally, we should never have any active request here.
+	 * But we still add some sanity check code here to help the debug
+	 */
+	if (!list_empty(&ctx->active_req_list))
+		CAM_WARN(CAM_ISP, "Active list is not empty, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+	/* Flush all the pending request list  */
+	flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_ALL;
+	flush_req.link_hdl = ctx->link_hdl;
+	flush_req.dev_hdl = ctx->dev_hdl;
+	flush_req.req_id = 0;
+
+	CAM_DBG(CAM_ISP, "try to flush pending list, ctx_idx: %u, link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, &flush_req);
+	spin_unlock_bh(&ctx->lock);
+	__cam_isp_ctx_free_mem_hw_entries(ctx);
+	cam_req_mgr_workq_destroy(&ctx_isp->workq);
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_DBG(CAM_ISP, "Release device success[%u] link: 0x%x next state %d",
+		ctx->ctx_id, ctx->link_hdl, ctx->state);
+	return rc;
+}
+
+/* top level state machine */
+static int __cam_isp_ctx_release_dev_in_top_state(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_release_args       rel_arg;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_req_mgr_flush_request flush_req;
+
+	if (cmd && ctx_isp->hw_ctx) {
+		CAM_ERR(CAM_ISP, "releasing hw, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		__cam_isp_ctx_release_hw_in_top_state(ctx, NULL);
+	}
+
+	if (ctx_isp->hw_ctx) {
+		rel_arg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv,
+			&rel_arg);
+		ctx_isp->hw_ctx = NULL;
+	}
+
+	cam_common_release_evt_params(ctx->dev_hdl);
+	memset(&ctx_isp->evt_inject_params, 0, sizeof(struct cam_hw_inject_evt_param));
+
+	ctx->session_hdl = -1;
+	ctx->dev_hdl = -1;
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+	ctx->last_flush_req = 0;
+	ctx_isp->frame_id = 0;
+	ctx_isp->active_req_cnt = 0;
+	ctx_isp->reported_req_id = 0;
+	ctx_isp->reported_frame_id = 0;
+	ctx_isp->hw_acquired = false;
+	ctx_isp->init_received = false;
+	ctx_isp->offline_context = false;
+	ctx_isp->vfps_aux_context = false;
+	ctx_isp->rdi_only_context = false;
+	ctx_isp->req_info.last_bufdone_req_id = 0;
+	ctx_isp->v4l2_event_sub_ids = 0;
+	ctx_isp->resume_hw_in_flushed = false;
+
+	atomic64_set(&ctx_isp->dbg_monitors.state_monitor_head, -1);
+	atomic64_set(&ctx_isp->dbg_monitors.frame_monitor_head, -1);
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->dbg_monitors.event_record_head[i], -1);
+	/*
+	 * Ideally, we should never have any active request here.
+	 * But we still add some sanity check code here to help the debug
+	 */
+	if (!list_empty(&ctx->active_req_list))
+		CAM_ERR(CAM_ISP, "Active list is not empty, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+	/* Flush all the pending request list  */
+	flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_ALL;
+	flush_req.link_hdl = ctx->link_hdl;
+	flush_req.dev_hdl = ctx->dev_hdl;
+	flush_req.req_id = 0;
+
+	CAM_DBG(CAM_ISP, "try to flush pending list, ctx_idx: %u, link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, &flush_req);
+	spin_unlock_bh(&ctx->lock);
+	__cam_isp_ctx_free_mem_hw_entries(ctx);
+
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_DBG(CAM_ISP, "Release device success[%u] link: 0x%x next state %d",
+		ctx->ctx_id, ctx->link_hdl, ctx->state);
+	return rc;
+}
+
+static void cam_isp_ctx_sync_callback(int32_t sync_obj, int status, void *data)
+{
+
+	struct cam_ctx_request *req = data;
+	struct cam_context *ctx = NULL;
+	struct cam_isp_context *ctx_isp = NULL;
+	struct cam_req_mgr_flush_request  flush_req;
+	struct cam_ctx_request *req_f;
+	struct cam_ctx_request *req_temp;
+	struct cam_isp_ctx_req *req_isp;
+	int i;
+	int rc;
+
+	if (!req) {
+		CAM_ERR(CAM_CTXT, "Invalid input param");
+		return;
+	}
+
+	ctx = req->ctx;
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid ctx for req %llu", req->request_id);
+		return;
+	}
+
+	ctx_isp = (struct cam_isp_context *)ctx->ctx_priv;
+	if (!ctx_isp) {
+		CAM_ERR(CAM_CTXT, "Invalid ctx_isp for req %llu",
+				req->request_id);
+		return;
+	}
+
+	if (status != CAM_SYNC_STATE_SIGNALED_SUCCESS) {
+		CAM_DBG(CAM_CTXT,
+			"Input sync for req id %llu signalled with error %d. Drop the request",
+			req->request_id, status);
+		memset(&flush_req, 0, sizeof(flush_req));
+		flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ;
+		flush_req.req_id = req->request_id;
+		spin_lock_bh(&ctx->lock);
+		if (__cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list,
+					&flush_req)) {
+			CAM_ERR(CAM_CTXT, "Error while flush req %llu",
+				req->request_id);
+		}
+		spin_unlock_bh(&ctx->lock);
+	}
+
+	if (ctx_isp->offline_context &&
+		(atomic_inc_return(&req->num_in_acked) ==
+			req->num_in_map_entries)) {
+		__cam_isp_ctx_schedule_apply_req_offline(ctx_isp);
+		if (ctx_isp->offline_context)
+			__cam_isp_ctx_schedule_start_offline(ctx_isp);
+	}
+}
+
+static int __cam_isp_ctx_config_dev_in_top_state(
+	struct cam_context *ctx, struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0, i, j;
+	struct cam_ctx_request           *req = NULL;
+	struct cam_isp_ctx_req           *req_isp;
+	struct cam_packet                *packet;
+	size_t                            remain_len = 0;
+	struct cam_hw_prepare_update_args cfg = {0};
+	struct cam_isp_prepare_hw_update_data *hw_update_data;
+	struct cam_req_mgr_add_request    add_req;
+	struct cam_isp_context           *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args           hw_cmd_args;
+	struct cam_isp_hw_cmd_args       isp_hw_cmd_args;
+	uint32_t                         packet_opcode = 0;
+	uint32_t                         hw_mgr_ctx_id;
+	int32_t s_id = 0;
+
+	CAM_DBG(CAM_ISP, "get free request object......ctx_idx: %u, link: 0x%x is_offline isp:%d",
+		ctx->ctx_id, ctx->link_hdl, ctx_isp->offline_context);
+
+	/* get free request */
+	spin_lock_bh(&ctx->lock);
+	if (!list_empty(&ctx->free_req_list)) {
+		req = list_first_entry(&ctx->free_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+	}
+	spin_unlock_bh(&ctx->lock);
+
+	if (!req) {
+		CAM_ERR(CAM_ISP, "No more request obj free, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		return -ENOMEM;
+	}
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	remain_len = cam_context_parse_config_cmd(ctx, cmd, &packet);
+	if (IS_ERR(packet)) {
+		rc = PTR_ERR(packet);
+		goto free_req;
+	}
+
+	/* Query the packet opcode */
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_GET_PACKET_OPCODE;
+	isp_hw_cmd_args.cmd_data = (void *)packet;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_req;
+	}
+
+	packet_opcode = isp_hw_cmd_args.u.packet_info.packet_op_code;
+	hw_mgr_ctx_id = isp_hw_cmd_args.u.packet_info.hw_mgr_ctx_id;
+	if ((packet_opcode == CAM_ISP_PACKET_UPDATE_DEV)
+		&& (packet->header.request_id <= ctx->last_flush_req)) {
+		CAM_INFO(CAM_ISP,
+			"request %lld has been flushed, reject packet, ctx_idx: %u hw_mgr_ctx_id: %u, link: 0x%x",
+			packet->header.request_id, ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+		rc = -EBADR;
+		goto free_req;
+	} else if ((packet_opcode == CAM_ISP_PACKET_INIT_DEV)
+		&& (packet->header.request_id <= ctx->last_flush_req)
+		&& ctx->last_flush_req && packet->header.request_id) {
+		CAM_WARN(CAM_ISP,
+			"last flushed req is %lld, config dev(init) for req %lld, ctx_idx: %u, hw_mgr_ctx_id:%u, link: 0x%x",
+			ctx->last_flush_req, packet->header.request_id, ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+		rc = -EBADR;
+		goto free_req;
+	}
+
+	cfg.packet = packet;
+	cfg.remain_len = remain_len;
+	cfg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	cfg.max_hw_update_entries = ctx->max_hw_update_entries;
+	cfg.hw_update_entries = req_isp->cfg;
+	cfg.max_out_map_entries = ctx->max_out_map_entries;
+	cfg.max_in_map_entries = ctx->max_in_map_entries;
+	cfg.out_map_entries = req_isp->fence_map_out;
+	cfg.in_map_entries = req_isp->fence_map_in;
+	cfg.priv  = &req_isp->hw_update_data;
+	cfg.pf_data = &(req->pf_data);
+	cfg.num_out_map_entries = 0;
+	cfg.num_in_map_entries = 0;
+	cfg.buf_tracker = &req->buf_tracker;
+	memset(&req_isp->hw_update_data, 0, sizeof(req_isp->hw_update_data));
+	memset(req_isp->fence_map_out, 0, sizeof(struct cam_hw_fence_map_entry)
+		* ctx->max_out_map_entries);
+
+	INIT_LIST_HEAD(cfg.buf_tracker);
+
+	rc = ctx->hw_mgr_intf->hw_prepare_update(
+		ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Prepare config packet failed in HW layer, ctx: %u, hw_mgr_ctx_id:%u, link: 0x%x",
+			ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+		goto free_req_and_buf_tracker_list;
+	}
+
+	hw_update_data = cfg.priv;
+	req_isp->num_cfg = cfg.num_hw_update_entries;
+	req_isp->num_fence_map_out = cfg.num_out_map_entries;
+	req_isp->num_fence_map_in = cfg.num_in_map_entries;
+	req_isp->num_acked = 0;
+	req_isp->num_deferred_acks = 0;
+	req_isp->bubble_detected = false;
+	req_isp->cdm_reset_before_apply = false;
+	req_isp->hw_update_data.packet = packet;
+	req_isp->hw_update_data.num_exp = hw_update_data->num_exp;
+	req_isp->hw_update_data.mup_en = hw_update_data->mup_en;
+	req->pf_data.packet_handle = cmd->packet_handle;
+	req->pf_data.packet_offset = cmd->offset;
+	req->pf_data.req = req;
+
+	req->num_out_map_entries = cfg.num_out_map_entries;
+	req->num_in_map_entries = cfg.num_in_map_entries;
+	atomic_set(&req->num_in_acked, 0);
+
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		rc = cam_sync_get_obj_ref(req_isp->fence_map_out[i].sync_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can't get ref for fence %d, ctx_idx: %u, hw_mgr_ctx_id: %u, link: 0x%x",
+				req_isp->fence_map_out[i].sync_id, ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+			goto put_ref;
+		}
+	}
+
+	CAM_DBG(CAM_ISP,
+		"packet req-id:%lld, opcode:%d, num_entry:%d, num_fence_out: %d, num_fence_in: %d, ctx: %u, link: 0x%x hw_mgr_ctx_id :%d",
+		packet->header.request_id, req_isp->hw_update_data.packet_opcode_type,
+		req_isp->num_cfg, req_isp->num_fence_map_out, req_isp->num_fence_map_in,
+		ctx->ctx_id, ctx->link_hdl, hw_mgr_ctx_id);
+
+	req->request_id = packet->header.request_id;
+	req->status = 1;
+
+	if (req_isp->hw_update_data.packet_opcode_type ==
+		CAM_ISP_PACKET_INIT_DEV && (!ctx_isp->offline_context)) {
+		if (ctx->state < CAM_CTX_ACTIVATED) {
+			rc = __cam_isp_ctx_enqueue_init_request(ctx, req);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Enqueue INIT pkt failed, ctx: %u, hw_mgr_ctx_id: %u, link: 0x%x",
+					ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+			ctx_isp->init_received = true;
+
+			if ((ctx_isp->vfps_aux_context) && (req->request_id > 0))
+				ctx_isp->resume_hw_in_flushed = true;
+			else
+				ctx_isp->resume_hw_in_flushed = false;
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_ISP, "Received INIT pkt in wrong state:%d, ctx:%u, hw_mgr_ctx_id: %u, link:0x%x",
+				ctx->state, ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+		}
+	} else {
+
+		if ((ctx_isp->offline_context) || (ctx_isp->vfps_aux_context)) {
+			if (req->num_in_map_entries > 0) {
+				for (j = 0; j < req->num_in_map_entries; j++) {
+					s_id = req_isp->fence_map_in[j].sync_id;
+					rc = cam_sync_check_valid(s_id);
+					if (rc) {
+						spin_lock(&ctx->lock);
+						list_del_init(&req->list);
+						spin_unlock(&ctx->lock);
+						CAM_ERR(CAM_ISP,
+							"invalid in map sync object %d",
+							s_id);
+						goto put_ref;
+					}
+				}
+
+				for (j = 0; j < req->num_in_map_entries; j++) {
+					s_id = req_isp->fence_map_in[j].sync_id;
+					rc = cam_sync_register_callback(
+						cam_isp_ctx_sync_callback,
+						(void *)req, s_id);
+					if (rc) {
+						CAM_ERR(CAM_ISP,
+							"[%s][%d] Failed register fence cb: %d ret = %d",
+							ctx->dev_name,
+							ctx->ctx_id,
+							s_id, rc);
+						spin_lock(&ctx->lock);
+						list_del_init(&req->list);
+						spin_unlock(&ctx->lock);
+						goto put_ref;
+					}
+					CAM_DBG(CAM_CTXT,
+						"register in fence cb: %d ret = %d",
+						s_id, rc);
+				}
+			}
+			__cam_isp_ctx_enqueue_request_in_order(ctx, req, true);
+		} else if (ctx->ctx_crm_intf->add_req) {
+			if ((ctx->state == CAM_CTX_FLUSHED) || (ctx->state < CAM_CTX_READY)) {
+				rc = -EINVAL;
+				CAM_ERR(CAM_ISP,
+					"Received update req %lld in wrong state:%d, ctx_idx: %u, hw_mgr_ctx_id: %u, link: 0x%x",
+					req->request_id, ctx->state, ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+				goto put_ref;
+			}
+			memset(&add_req, 0, sizeof(add_req));
+			add_req.link_hdl = ctx->link_hdl;
+			add_req.dev_hdl  = ctx->dev_hdl;
+			add_req.req_id   = req->request_id;
+			add_req.num_exp = ctx_isp->last_num_exp;
+
+			if (req_isp->hw_update_data.mup_en) {
+				add_req.num_exp = req_isp->hw_update_data.num_exp;
+				ctx_isp->last_num_exp = add_req.num_exp;
+			}
+			rc = ctx->ctx_crm_intf->add_req(&add_req);
+			if (rc) {
+				if (rc == -EBADR)
+					CAM_INFO(CAM_ISP,
+						"Add req failed: req id=%llu, it has been flushed on link 0x%x ctx %u hw_mgr_ctx_id: %u",
+						req->request_id, ctx->link_hdl, ctx->ctx_id, hw_mgr_ctx_id);
+				else
+					CAM_ERR(CAM_ISP,
+						"Add req failed: req id=%llu on link 0x%x ctx %u",
+						req->request_id, ctx->link_hdl, ctx->ctx_id);
+			} else {
+				__cam_isp_ctx_enqueue_request_in_order(ctx, req, true);
+			}
+		} else {
+			CAM_ERR(CAM_ISP, "Unable to add request: req id=%llu,ctx: %u, hw_mgr_ctx_id: %u, link: 0x%x",
+				req->request_id, ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+			rc = -ENODEV;
+		}
+	}
+	if (rc)
+		goto put_ref;
+
+	CAM_DBG(CAM_REQ,
+		"Preprocessing Config req_id %lld successful on ctx %u, hw_mgr_ctx_id: %u, link: 0x%x",
+		req->request_id, ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+
+	if (ctx_isp->vfps_aux_context &&
+		(req_isp->hw_update_data.packet_opcode_type != CAM_ISP_PACKET_INIT_DEV)) {
+		__cam_isp_ctx_schedule_apply_req_offline(ctx_isp);
+	}
+	return rc;
+
+put_ref:
+	for (--i; i >= 0; i--) {
+		if (cam_sync_put_obj_ref(req_isp->fence_map_out[i].sync_id))
+			CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d, ctx_idx: %u, hw_mgr_ctx_id: %u link: 0x%x",
+				req_isp->fence_map_out[i].sync_id, ctx->ctx_id, hw_mgr_ctx_id, ctx->link_hdl);
+	}
+free_req_and_buf_tracker_list:
+	cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+free_req:
+	spin_lock_bh(&ctx->lock);
+	__cam_isp_ctx_move_req_to_free_list(ctx, req);
+	spin_unlock_bh(&ctx->lock);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_allocate_mem_hw_entries(
+	struct cam_context *ctx,
+	struct cam_hw_acquire_args *param)
+{
+	int rc = 0, i;
+	uint32_t max_res = 0;
+	uint32_t max_hw_upd_entries = CAM_ISP_CTX_CFG_MAX;
+	struct cam_ctx_request          *req;
+	struct cam_ctx_request          *temp_req;
+	struct cam_isp_ctx_req          *req_isp;
+
+	if (!param->op_params.param_list[0])
+		max_res = CAM_ISP_CTX_RES_MAX;
+	else {
+		max_res = param->op_params.param_list[0];
+		if (param->op_flags & CAM_IFE_CTX_SFE_EN) {
+			max_res += param->op_params.param_list[1];
+			max_hw_upd_entries = CAM_ISP_SFE_CTX_CFG_MAX;
+		}
+	}
+
+	ctx->max_in_map_entries    = max_res;
+	ctx->max_out_map_entries   = max_res;
+	ctx->max_hw_update_entries = max_hw_upd_entries;
+
+	CAM_DBG(CAM_ISP,
+		"Allocate max_entries: 0x%x max_res: 0x%x is_sfe_en: %d, ctx: %u, link: 0x%x",
+		max_hw_upd_entries, max_res, (param->op_flags & CAM_IFE_CTX_SFE_EN),
+		ctx->ctx_id, ctx->link_hdl);
+
+	ctx->hw_update_entry = kcalloc(CAM_ISP_CTX_REQ_MAX, sizeof(struct cam_hw_update_entry *),
+		GFP_KERNEL);
+
+	if (!ctx->hw_update_entry) {
+		CAM_ERR(CAM_CTXT, "%s[%u] no memory, link: 0x%x",
+			ctx->dev_name, ctx->ctx_id, ctx->link_hdl);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < CAM_ISP_CTX_REQ_MAX; i++) {
+		ctx->hw_update_entry[i] = kcalloc(ctx->max_hw_update_entries,
+			sizeof(struct cam_hw_update_entry), GFP_KERNEL);
+		if (!ctx->hw_update_entry[i]) {
+			CAM_ERR(CAM_CTXT, "%s[%u] no memory for hw_update_entry: %u, link: 0x%x",
+				ctx->dev_name, ctx->ctx_id, i, ctx->link_hdl);
+			return -ENOMEM;
+		}
+	}
+
+	ctx->in_map_entries = kcalloc(CAM_ISP_CTX_REQ_MAX, sizeof(struct cam_hw_fence_map_entry *),
+		GFP_KERNEL);
+
+	if (!ctx->in_map_entries) {
+		CAM_ERR(CAM_CTXT, "%s[%u] no memory for in_map_entries, link: 0x%x",
+			ctx->dev_name, ctx->ctx_id, ctx->link_hdl);
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	for (i = 0; i < CAM_ISP_CTX_REQ_MAX; i++) {
+		ctx->in_map_entries[i] = kcalloc(ctx->max_in_map_entries,
+			sizeof(struct cam_hw_fence_map_entry),
+			GFP_KERNEL);
+
+		if (!ctx->in_map_entries[i]) {
+			CAM_ERR(CAM_CTXT, "%s[%u] no memory for in_map_entries: %u, link: 0x%x",
+				ctx->dev_name, ctx->ctx_id, i, ctx->link_hdl);
+			rc = -ENOMEM;
+			goto end;
+		}
+	}
+
+	ctx->out_map_entries = kcalloc(CAM_ISP_CTX_REQ_MAX, sizeof(struct cam_hw_fence_map_entry *),
+			GFP_KERNEL);
+
+	if (!ctx->out_map_entries) {
+		CAM_ERR(CAM_CTXT, "%s[%u] no memory for out_map_entries, link: 0x%x",
+			ctx->dev_name, ctx->ctx_id, ctx->link_hdl);
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	for (i = 0; i < CAM_ISP_CTX_REQ_MAX; i++) {
+		ctx->out_map_entries[i] = kcalloc(ctx->max_out_map_entries,
+			sizeof(struct cam_hw_fence_map_entry),
+			GFP_KERNEL);
+
+		if (!ctx->out_map_entries[i]) {
+			CAM_ERR(CAM_CTXT, "%s[%u] no memory for out_map_entries: %u, link: 0x%x",
+				ctx->dev_name, ctx->ctx_id, i, ctx->link_hdl);
+			rc = -ENOMEM;
+			goto end;
+		}
+	}
+
+	list_for_each_entry_safe(req, temp_req,
+		&ctx->free_req_list, list) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+		req_isp->cfg = ctx->hw_update_entry[req->index];
+		req_isp->fence_map_in = ctx->in_map_entries[req->index];
+		req_isp->fence_map_out = ctx->out_map_entries[req->index];
+	}
+
+	return rc;
+
+end:
+	__cam_isp_ctx_free_mem_hw_entries(ctx);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_acquire_args       param;
+	struct cam_isp_resource         *isp_res = NULL;
+	struct cam_create_dev_hdl        req_hdl_param;
+	struct cam_hw_release_args       release;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args           hw_cmd_args;
+	struct cam_isp_hw_cmd_args       isp_hw_cmd_args;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_ISP, "HW interface is not ready, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"session_hdl 0x%x, num_resources %d, hdl type %d, res %lld, ctx_idx: %u, link: 0x%x",
+		cmd->session_handle, cmd->num_resources,
+		cmd->handle_type, cmd->resource_hdl, ctx->ctx_id, ctx->link_hdl);
+
+	ctx_isp->v4l2_event_sub_ids = cam_req_mgr_get_id_subscribed();
+
+	if (cmd->num_resources == CAM_API_COMPAT_CONSTANT) {
+		ctx_isp->split_acquire = true;
+		CAM_DBG(CAM_ISP, "Acquire dev handle, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto get_dev_handle;
+	}
+
+	if (cmd->num_resources > CAM_ISP_CTX_RES_MAX) {
+		CAM_ERR(CAM_ISP, "Too much resources in the acquire, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	/* for now we only support user pointer */
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_ISP, "Only user pointer is supported, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	isp_res = kzalloc(
+		sizeof(*isp_res)*cmd->num_resources, GFP_KERNEL);
+	if (!isp_res) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "start copy %d resources from user, ctx_idx: %u, link: 0x%x",
+		 cmd->num_resources, ctx->ctx_id, ctx->link_hdl);
+
+	if (copy_from_user(isp_res, u64_to_user_ptr(cmd->resource_hdl),
+		sizeof(*isp_res)*cmd->num_resources)) {
+		rc = -EFAULT;
+		goto free_res;
+	}
+
+	memset(&param, 0, sizeof(param));
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.sec_pf_evt_cb = cam_context_dump_pf_info;
+	param.num_acq = cmd->num_resources;
+	param.acquire_info = (uintptr_t) isp_res;
+
+	rc = __cam_isp_ctx_allocate_mem_hw_entries(ctx, &param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Ctx[%u] link: 0x%x allocate hw entry fail",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_res;
+	}
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Acquire device failed, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_res;
+	}
+
+	/* Query the context has rdi only resource */
+	hw_cmd_args.ctxt_to_hw_map = param.ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_CTX_TYPE;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_hw;
+	}
+
+	if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_RDI) {
+		/*
+		 * this context has rdi only resource assign rdi only
+		 * state machine
+		 */
+		CAM_DBG(CAM_ISP, "RDI only session Context, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_rdi_only_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_rdi_only_activated_state_machine;
+		ctx_isp->rdi_only_context = true;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_FS2) {
+		CAM_DBG(CAM_ISP, "FS2 Session has PIX, RD and RDI, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_fs2_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_fs2_state_machine;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_OFFLINE) {
+		CAM_DBG(CAM_ISP,
+			"offline Session has PIX and RD resources, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_offline_state_machine_irq;
+	} else {
+		CAM_DBG(CAM_ISP,
+			"Session has PIX or PIX and RDI resources, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_activated_state_machine;
+	}
+
+	ctx_isp->hw_ctx = param.ctxt_to_hw_map;
+	ctx_isp->hw_acquired = true;
+	ctx_isp->split_acquire = false;
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+	atomic64_set(&ctx_isp->dbg_monitors.state_monitor_head, -1);
+	atomic64_set(&ctx_isp->dbg_monitors.frame_monitor_head, -1);
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->dbg_monitors.event_record_head[i], -1);
+
+	CAM_INFO(CAM_ISP, "Ctx_type: %u, ctx_id: %u, hw_mgr_ctx: %u", isp_hw_cmd_args.u.ctx_type,
+		ctx->ctx_id, param.hw_mgr_ctx_id);
+	kfree(isp_res);
+	isp_res = NULL;
+
+get_dev_handle:
+
+	req_hdl_param.session_hdl = cmd->session_handle;
+	/* bridge is not ready for these flags. so false for now */
+	req_hdl_param.v4l2_sub_dev_flag = 0;
+	req_hdl_param.media_entity_flag = 0;
+	req_hdl_param.ops = ctx->crm_ctx_intf;
+	req_hdl_param.priv = ctx;
+	req_hdl_param.dev_id = CAM_ISP;
+	CAM_DBG(CAM_ISP, "get device handle form bridge, ctx_idx: %u, link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+	ctx->dev_hdl = cam_create_device_hdl(&req_hdl_param);
+	if (ctx->dev_hdl <= 0) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_ISP, "Can not create device handle, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_hw;
+	}
+	cmd->dev_handle = ctx->dev_hdl;
+
+	/* store session information */
+	ctx->session_hdl = cmd->session_handle;
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_INFO(CAM_ISP,
+		"Acquire success: session_hdl 0x%x num_rsrces %d ctx %u link: 0x%x",
+		cmd->session_handle, cmd->num_resources, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+
+free_hw:
+	release.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	if (ctx_isp->hw_acquired)
+		ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv,
+			&release);
+	ctx_isp->hw_ctx = NULL;
+	ctx_isp->hw_acquired = false;
+free_res:
+	kfree(isp_res);
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_acquire_hw_v1(struct cam_context *ctx,
+	void *args)
+{
+	int rc = 0;
+	int i;
+	struct cam_acquire_hw_cmd_v1 *cmd =
+		(struct cam_acquire_hw_cmd_v1 *)args;
+	struct cam_hw_acquire_args        param;
+	struct cam_hw_release_args        release;
+	struct cam_isp_context           *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args            hw_cmd_args;
+	struct cam_isp_hw_cmd_args        isp_hw_cmd_args;
+	struct cam_isp_acquire_hw_info   *acquire_hw_info = NULL;
+	struct cam_isp_comp_record_query  query_cmd;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_ISP, "HW interface is not ready, ctx %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"session_hdl 0x%x, hdl type %d, res %lld ctx %u link: 0x%x",
+		cmd->session_handle, cmd->handle_type, cmd->resource_hdl,
+		ctx->ctx_id, ctx->link_hdl);
+
+	/* for now we only support user pointer */
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_ISP, "Only user pointer is supported, ctx %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cmd->data_size < sizeof(*acquire_hw_info)) {
+		CAM_ERR(CAM_ISP, "data_size is not a valid value, ctx %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+
+	acquire_hw_info = kzalloc(cmd->data_size, GFP_KERNEL);
+	if (!acquire_hw_info) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "start copy resources from user, ctx_idx: %u, link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+
+	if (copy_from_user(acquire_hw_info, (void __user *)cmd->resource_hdl,
+		cmd->data_size)) {
+		rc = -EFAULT;
+		goto free_res;
+	}
+
+	memset(&param, 0, sizeof(param));
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.sec_pf_evt_cb = cam_context_dump_pf_info;
+	param.num_acq = CAM_API_COMPAT_CONSTANT;
+	param.acquire_info_size = cmd->data_size;
+	param.acquire_info = (uint64_t) acquire_hw_info;
+	param.mini_dump_cb = __cam_isp_ctx_minidump_cb;
+	param.link_hdl = ctx->link_hdl;
+
+	rc = __cam_isp_ctx_allocate_mem_hw_entries(ctx,
+		&param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Ctx[%u] link: 0x%x allocate hw entry fail",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_res;
+	}
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Acquire device failed, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_res;
+	}
+
+	ctx_isp->last_num_exp = 0;
+	ctx_isp->support_consumed_addr =
+		(param.op_flags & CAM_IFE_CTX_CONSUME_ADDR_EN);
+	ctx_isp->is_tfe_shdr = (param.op_flags & CAM_IFE_CTX_SHDR_EN);
+	ctx_isp->is_shdr_master = (param.op_flags & CAM_IFE_CTX_SHDR_IS_MASTER);
+
+	/* Query the context bus comp group information */
+	ctx_isp->vfe_bus_comp_grp = kcalloc(CAM_IFE_BUS_COMP_NUM_MAX,
+			sizeof(struct cam_isp_context_comp_record), GFP_KERNEL);
+	if (!ctx_isp->vfe_bus_comp_grp) {
+		CAM_ERR(CAM_CTXT, "%s[%d] no memory for vfe_bus_comp_grp",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -ENOMEM;
+		goto free_hw;
+	}
+
+	query_cmd.vfe_bus_comp_grp = ctx_isp->vfe_bus_comp_grp;
+	hw_cmd_args.ctxt_to_hw_map = param.ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_GET_BUS_COMP_GROUP;
+	isp_hw_cmd_args.cmd_data = &query_cmd;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Bus Comp HW command failed, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_hw;
+	}
+
+	/* Query the context has rdi only resource */
+	hw_cmd_args.ctxt_to_hw_map = param.ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_CTX_TYPE;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_hw;
+	}
+
+	if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_RDI) {
+		/*
+		 * this context has rdi only resource assign rdi only
+		 * state machine
+		 */
+		CAM_DBG(CAM_ISP, "RDI only session Context, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_rdi_only_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_rdi_only_activated_state_machine;
+		ctx_isp->rdi_only_context = true;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_FS2) {
+		CAM_DBG(CAM_ISP, "FS2 Session has PIX, RD and RDI, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_fs2_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_fs2_state_machine;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_OFFLINE) {
+		CAM_DBG(CAM_ISP, "Offline session has PIX and RD resources, ctx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_offline_state_machine_irq;
+		ctx_isp->substate_machine = NULL;
+	} else {
+		CAM_DBG(CAM_ISP, "Session has PIX or PIX and RDI resources, ctx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_activated_state_machine;
+	}
+
+	ctx_isp->hw_ctx = param.ctxt_to_hw_map;
+	ctx_isp->hw_acquired = true;
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+
+	atomic64_set(&ctx_isp->dbg_monitors.state_monitor_head, -1);
+	atomic64_set(&ctx_isp->dbg_monitors.frame_monitor_head, -1);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->dbg_monitors.event_record_head[i], -1);
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_INFO(CAM_ISP,
+		"Acquire success:session_hdl 0x%xs ctx_type %d ctx %u link: 0x%x hw_mgr_ctx: %u is_shdr %d is_shdr_master %d",
+		ctx->session_hdl, isp_hw_cmd_args.u.ctx_type, ctx->ctx_id, ctx->link_hdl,
+		param.hw_mgr_ctx_id, ctx_isp->is_tfe_shdr, ctx_isp->is_shdr_master);
+	kfree(acquire_hw_info);
+	return rc;
+
+free_hw:
+	release.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv, &release);
+	ctx_isp->hw_ctx = NULL;
+	ctx_isp->hw_acquired = false;
+free_res:
+	kfree(acquire_hw_info);
+end:
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_apply_req_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int __cam_isp_ctx_acquire_hw_v2(struct cam_context *ctx,
+	void *args)
+{
+	int rc = 0, i, j;
+	struct cam_acquire_hw_cmd_v2 *cmd =
+		(struct cam_acquire_hw_cmd_v2 *)args;
+	struct cam_hw_acquire_args       param;
+	struct cam_hw_release_args       release;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args           hw_cmd_args;
+	struct cam_isp_hw_cmd_args       isp_hw_cmd_args;
+	struct cam_isp_acquire_hw_info  *acquire_hw_info = NULL;
+	struct cam_isp_comp_record_query query_cmd;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_ISP, "HW interface is not ready, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"session_hdl 0x%x, hdl type %d, res %lld, ctx_id %u link: 0x%x",
+		cmd->session_handle, cmd->handle_type, cmd->resource_hdl,
+		ctx->ctx_id, ctx->link_hdl);
+
+	/* for now we only support user pointer */
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_ISP, "Only user pointer is supported, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cmd->data_size < sizeof(*acquire_hw_info)) {
+		CAM_ERR(CAM_ISP, "data_size is not a valid value, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+
+	acquire_hw_info = kzalloc(cmd->data_size, GFP_KERNEL);
+	if (!acquire_hw_info) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "start copy resources from user, ctx_id %u link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+
+	if (copy_from_user(acquire_hw_info, (void __user *)cmd->resource_hdl,
+		cmd->data_size)) {
+		rc = -EFAULT;
+		goto free_res;
+	}
+
+	memset(&param, 0, sizeof(param));
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.sec_pf_evt_cb = cam_context_dump_pf_info;
+	param.num_acq = CAM_API_COMPAT_CONSTANT;
+	param.acquire_info_size = cmd->data_size;
+	param.acquire_info = (uint64_t) acquire_hw_info;
+	param.mini_dump_cb = __cam_isp_ctx_minidump_cb;
+	param.link_hdl = ctx->link_hdl;
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Acquire device failed, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_res;
+	}
+
+	rc = __cam_isp_ctx_allocate_mem_hw_entries(ctx, &param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Ctx[%u] link: 0x%x allocate hw entry fail",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_hw;
+	}
+
+	/*
+	 * Set feature flag if applicable
+	 * custom hw is supported only on v2
+	 */
+	ctx_isp->last_num_exp = 0;
+	ctx_isp->custom_enabled =
+		(param.op_flags & CAM_IFE_CTX_CUSTOM_EN);
+	ctx_isp->use_frame_header_ts =
+		(param.op_flags & CAM_IFE_CTX_FRAME_HEADER_EN);
+	ctx_isp->use_default_apply =
+		(param.op_flags & CAM_IFE_CTX_APPLY_DEFAULT_CFG);
+	ctx_isp->support_consumed_addr =
+		(param.op_flags & CAM_IFE_CTX_CONSUME_ADDR_EN);
+	ctx_isp->aeb_enabled =
+		(param.op_flags & CAM_IFE_CTX_AEB_EN);
+	ctx_isp->mode_switch_en =
+		(param.op_flags & CAM_IFE_CTX_DYNAMIC_SWITCH_EN);
+	ctx_isp->is_tfe_shdr = (param.op_flags & CAM_IFE_CTX_SHDR_EN);
+	ctx_isp->is_shdr_master = (param.op_flags & CAM_IFE_CTX_SHDR_IS_MASTER);
+	ctx_isp->offline_context = false;
+
+	/* Query the context bus comp group information */
+	ctx_isp->vfe_bus_comp_grp = kcalloc(CAM_IFE_BUS_COMP_NUM_MAX,
+		sizeof(struct cam_isp_context_comp_record), GFP_KERNEL);
+	if (!ctx_isp->vfe_bus_comp_grp) {
+		CAM_ERR(CAM_CTXT, "%s[%d] no memory for vfe_bus_comp_grp",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	if (param.op_flags & CAM_IFE_CTX_SFE_EN) {
+		ctx_isp->sfe_bus_comp_grp = kcalloc(CAM_SFE_BUS_COMP_NUM_MAX,
+			sizeof(struct cam_isp_context_comp_record), GFP_KERNEL);
+		if (!ctx_isp->sfe_bus_comp_grp) {
+			CAM_ERR(CAM_CTXT, "%s[%d] no memory for sfe_bus_comp_grp",
+				ctx->dev_name, ctx->ctx_id);
+			rc = -ENOMEM;
+			goto end;
+		}
+	}
+
+	query_cmd.vfe_bus_comp_grp = ctx_isp->vfe_bus_comp_grp;
+	if (ctx_isp->sfe_bus_comp_grp)
+		query_cmd.sfe_bus_comp_grp = ctx_isp->sfe_bus_comp_grp;
+	hw_cmd_args.ctxt_to_hw_map = param.ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_GET_BUS_COMP_GROUP;
+	isp_hw_cmd_args.cmd_data = &query_cmd;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed");
+		goto free_hw;
+	}
+
+	/* Query the context has rdi only resource */
+	hw_cmd_args.ctxt_to_hw_map = param.ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_CTX_TYPE;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto free_hw;
+	}
+
+	if (param.valid_acquired_hw) {
+		for (i = 0; i < CAM_MAX_ACQ_RES; i++)
+			cmd->hw_info.acquired_hw_id[i] =
+				param.acquired_hw_id[i];
+
+		for (i = 0; i < CAM_MAX_ACQ_RES; i++)
+			for (j = 0; j < CAM_MAX_HW_SPLIT; j++)
+				cmd->hw_info.acquired_hw_path[i][j] =
+					param.acquired_hw_path[i][j];
+
+		ctx_isp->hw_idx = param.acquired_hw_id[0];
+	}
+	cmd->hw_info.valid_acquired_hw =
+		param.valid_acquired_hw;
+
+	cmd->hw_info.valid_acquired_hw = param.valid_acquired_hw;
+
+	if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_RDI) {
+		/*
+		 * this context has rdi only resource assign rdi only
+		 * state machine
+		 */
+		CAM_DBG(CAM_ISP, "RDI only session Context, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_rdi_only_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_rdi_only_activated_state_machine;
+		ctx_isp->rdi_only_context = true;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_FS2) {
+		CAM_DBG(CAM_ISP, "FS2 Session has PIX, RD and RDI, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_fs2_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_fs2_state_machine;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_OFFLINE) {
+		CAM_DBG(CAM_ISP, "Offline Session has PIX and RD resources, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_offline_state_machine_irq;
+		ctx_isp->substate_machine = NULL;
+		ctx_isp->offline_context = true;
+	} else {
+		CAM_DBG(CAM_ISP, "Session has PIX or PIX and RDI resources, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_activated_state_machine;
+	}
+
+	if (ctx_isp->offline_context || ctx_isp->vfps_aux_context) {
+		rc = cam_req_mgr_workq_create("ife_apply_req", 20,
+			&ctx_isp->workq, CRM_WORKQ_USAGE_IRQ, 0,
+			cam_req_mgr_process_workq_apply_req_worker);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Failed to create workq for IFE rc:%d offline: %s vfps: %s ctx_id %u link: 0x%x",
+				rc, CAM_BOOL_TO_YESNO(ctx_isp->offline_context),
+				CAM_BOOL_TO_YESNO(ctx_isp->vfps_aux_context),
+				ctx->ctx_id, ctx->link_hdl);
+	}
+
+	ctx_isp->hw_ctx = param.ctxt_to_hw_map;
+	ctx_isp->hw_acquired = true;
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+	ctx->hw_mgr_ctx_id = param.hw_mgr_ctx_id;
+
+	snprintf(ctx->ctx_id_string, sizeof(ctx->ctx_id_string),
+		"%s_ctx[%d]_hwmgrctx[%d]_hwidx[0x%x]",
+		ctx->dev_name,
+		ctx->ctx_id,
+		ctx->hw_mgr_ctx_id,
+		ctx_isp->hw_idx);
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_INFO(CAM_ISP,
+		"Acquire success: session_hdl 0x%xs ctx_type %d ctx %u link 0x%x hw_mgr_ctx %u is_shdr %d is_shdr_master %d offline_isp :%d",
+		ctx->session_hdl, isp_hw_cmd_args.u.ctx_type, ctx->ctx_id, ctx->link_hdl,
+		param.hw_mgr_ctx_id, ctx_isp->is_tfe_shdr, ctx_isp->is_shdr_master,
+		ctx_isp->offline_context);
+	kfree(acquire_hw_info);
+	return rc;
+
+free_hw:
+	release.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv, &release);
+	ctx_isp->hw_ctx = NULL;
+	ctx_isp->hw_acquired = false;
+free_res:
+	kfree(acquire_hw_info);
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_acquire_hw_in_acquired(struct cam_context *ctx,
+	void *args)
+{
+	int rc = -EINVAL;
+	uint32_t api_version;
+
+	if (!ctx || !args) {
+		CAM_ERR(CAM_ISP, "Invalid input pointer");
+		return rc;
+	}
+
+	api_version = *((uint32_t *)args);
+	if (api_version == 1)
+		rc = __cam_isp_ctx_acquire_hw_v1(ctx, args);
+	else if (api_version == 2)
+		rc = __cam_isp_ctx_acquire_hw_v2(ctx, args);
+	else
+		CAM_ERR(CAM_ISP, "Unsupported api version %d, ctx_id %u link: 0x%x",
+			api_version, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_config_dev_in_acquired(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	if (!ctx_isp->hw_acquired) {
+		CAM_ERR(CAM_ISP, "HW is not acquired, reject packet, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	rc = __cam_isp_ctx_config_dev_in_top_state(ctx, cmd);
+
+	if (!rc && ((ctx->link_hdl >= 0) || ctx_isp->offline_context)) {
+		ctx->state = CAM_CTX_READY;
+		trace_cam_context_state("ISP", ctx);
+	}
+
+	CAM_DBG(CAM_ISP, "next state %d, ctx %u link: 0x%x",
+		ctx->state, ctx->ctx_id, ctx->link_hdl);
+	return rc;
+}
+
+static int __cam_isp_ctx_config_dev_in_flushed(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_start_stop_dev_cmd start_cmd;
+	struct cam_hw_cmd_args hw_cmd_args;
+	struct cam_isp_hw_cmd_args isp_hw_cmd_args;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	if (!ctx_isp->hw_acquired) {
+		CAM_ERR(CAM_ISP, "HW is not acquired, reject packet, ctx_id %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = __cam_isp_ctx_config_dev_in_top_state(ctx, cmd);
+	if (rc)
+		goto end;
+
+	if (!ctx_isp->init_received) {
+		CAM_WARN(CAM_ISP,
+			"Received update pckt in flushed state, skip start, ctx %u link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "vfps_ctx:%s resume_hw_in_flushed:%d ctx:%u link: 0x%x",
+		CAM_BOOL_TO_YESNO(ctx_isp->vfps_aux_context),
+		ctx_isp->resume_hw_in_flushed,
+		ctx->ctx_id, ctx->link_hdl);
+
+	if (ctx_isp->vfps_aux_context) {
+		/* Resume the HW only when we get first valid req */
+		if (!ctx_isp->resume_hw_in_flushed)
+			goto end;
+		else
+			ctx_isp->resume_hw_in_flushed = false;
+	}
+
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_RESUME_HW;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to resume HW rc: %d, ctx_id %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+
+	start_cmd.dev_handle = cmd->dev_handle;
+	start_cmd.session_handle = cmd->session_handle;
+	rc = __cam_isp_ctx_start_dev_in_ready(ctx, &start_cmd);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Failed to re-start HW after flush rc: %d, ctx_id %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+	else
+		CAM_INFO(CAM_ISP,
+			"Received init after flush. Re-start HW complete in ctx:%d, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+end:
+	CAM_DBG(CAM_ISP, "next state %d sub_state:%d ctx_id %u link: 0x%x", ctx->state,
+		ctx_isp->substate_activated, ctx->ctx_id, ctx->link_hdl);
+	return rc;
+}
+
+static int __cam_isp_ctx_link_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *link)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	if (!link) {
+		CAM_ERR(CAM_ISP, "setup link info is null: %pK ctx: %u link: 0x%x",
+			link, ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	if (!link->crm_cb) {
+		CAM_ERR(CAM_ISP, "crm cb is null: %pK ctx: %u, link: 0x%x",
+			link->crm_cb, ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter.........ctx: %u, link: 0x%x", ctx->ctx_id, ctx->link_hdl);
+
+	ctx->link_hdl = link->link_hdl;
+	ctx->ctx_crm_intf = link->crm_cb;
+	ctx_isp->subscribe_event =
+		CAM_TRIGGER_POINT_SOF | CAM_TRIGGER_POINT_EOF;
+	ctx_isp->trigger_id = link->trigger_id;
+	ctx_isp->mswitch_default_apply_delay_max_cnt = 0;
+	atomic_set(&ctx_isp->mswitch_default_apply_delay_ref_cnt, 0);
+
+	if ((link->mode_switch_max_delay - CAM_MODESWITCH_DELAY_1) > 0) {
+		ctx_isp->handle_mswitch = true;
+		ctx_isp->mswitch_default_apply_delay_max_cnt =
+			link->mode_switch_max_delay - CAM_MODESWITCH_DELAY_1;
+		CAM_DBG(CAM_ISP,
+			"Enabled mode switch handling on ctx: %u max delay cnt: %u",
+			ctx->ctx_id, ctx_isp->mswitch_default_apply_delay_max_cnt);
+		atomic_set(&ctx_isp->mswitch_default_apply_delay_ref_cnt,
+			ctx_isp->mswitch_default_apply_delay_max_cnt);
+	}
+
+	/* change state only if we had the init config */
+	if (ctx_isp->init_received) {
+		ctx->state = CAM_CTX_READY;
+		trace_cam_context_state("ISP", ctx);
+	}
+
+	CAM_DBG(CAM_ISP, "next state %d, ctx: %u, link: 0x%x",
+		ctx->state, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_unlink_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+	ctx_isp->trigger_id = -1;
+	ctx_isp->mswitch_default_apply_delay_max_cnt = 0;
+	atomic_set(&ctx_isp->mswitch_default_apply_delay_ref_cnt, 0);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_get_dev_info(struct cam_context *ctx,
+	struct cam_req_mgr_device_info *dev_info)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	dev_info->dev_hdl = ctx->dev_hdl;
+	strscpy(dev_info->name, CAM_ISP_DEV_NAME, sizeof(dev_info->name));
+	dev_info->dev_id = CAM_REQ_MGR_DEVICE_IFE;
+	dev_info->p_delay = CAM_PIPELINE_DELAY_1;
+	dev_info->m_delay = CAM_MODESWITCH_DELAY_1;
+	dev_info->trigger = CAM_TRIGGER_POINT_SOF;
+	dev_info->trigger_on = true;
+	dev_info->is_shdr = ctx_isp->is_tfe_shdr;
+	dev_info->is_shdr_master = ctx_isp->is_shdr_master;
+
+	return rc;
+}
+
+static inline void __cam_isp_context_reset_ctx_params(
+	struct cam_isp_context    *ctx_isp)
+{
+	atomic_set(&ctx_isp->process_bubble, 0);
+	atomic_set(&ctx_isp->internal_recovery_set, 0);
+	atomic_set(&ctx_isp->flush_in_progress, 0);
+	ctx_isp->frame_id = 0;
+	ctx_isp->sof_timestamp_val = 0;
+	ctx_isp->boot_timestamp = 0;
+	ctx_isp->active_req_cnt = 0;
+	ctx_isp->reported_req_id = 0;
+	ctx_isp->reported_frame_id = 0;
+	ctx_isp->bubble_frame_cnt = 0;
+	ctx_isp->congestion_cnt = 0;
+	ctx_isp->recovery_req_id = 0;
+	ctx_isp->aeb_error_cnt = 0;
+	ctx_isp->out_of_sync_cnt = 0;
+	ctx_isp->sof_dbg_irq_en = false;
+	ctx_isp->last_sof_jiffies = 0;
+	ctx_isp->last_applied_jiffies = 0;
+}
+
+static int __cam_isp_ctx_start_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+	int i;
+	struct cam_isp_start_args        start_isp;
+	struct cam_ctx_request          *req;
+	struct cam_isp_ctx_req          *req_isp;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	if (cmd->session_handle != ctx->session_hdl ||
+		cmd->dev_handle != ctx->dev_hdl) {
+		rc = -EPERM;
+		goto end;
+	}
+
+	if (list_empty(&ctx->pending_req_list)) {
+		/* should never happen */
+		CAM_ERR(CAM_ISP, "Start device with empty configuration, ctx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+		goto end;
+	} else {
+		req = list_first_entry(&ctx->pending_req_list,
+			struct cam_ctx_request, list);
+	}
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	if (!ctx_isp->hw_ctx) {
+		CAM_ERR(CAM_ISP, "Wrong hw context pointer.ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	start_isp.hw_config.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	start_isp.hw_config.request_id = req->request_id;
+	start_isp.hw_config.hw_update_entries = req_isp->cfg;
+	start_isp.hw_config.num_hw_update_entries = req_isp->num_cfg;
+	start_isp.hw_config.priv  = &req_isp->hw_update_data;
+	start_isp.hw_config.init_packet = 1;
+	start_isp.hw_config.reapply_type = CAM_CONFIG_REAPPLY_NONE;
+	start_isp.hw_config.cdm_reset_before_apply = false;
+	start_isp.is_internal_start = false;
+
+	ctx_isp->last_applied_req_id = req->request_id;
+
+	if (ctx->state == CAM_CTX_FLUSHED)
+		start_isp.start_only = true;
+	else
+		start_isp.start_only = false;
+
+	__cam_isp_context_reset_ctx_params(ctx_isp);
+
+	ctx_isp->substate_activated = ctx_isp->rdi_only_context ?
+		CAM_ISP_CTX_ACTIVATED_APPLIED :
+		(req_isp->num_fence_map_out) ? CAM_ISP_CTX_ACTIVATED_EPOCH :
+		CAM_ISP_CTX_ACTIVATED_SOF;
+
+	atomic64_set(&ctx_isp->dbg_monitors.state_monitor_head, -1);
+	atomic64_set(&ctx_isp->dbg_monitors.frame_monitor_head, -1);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->dbg_monitors.event_record_head[i], -1);
+
+	/*
+	 * In case of CSID TPG we might receive SOF and RUP IRQs
+	 * before hw_mgr_intf->hw_start has returned. So move
+	 * req out of pending list before hw_start and add it
+	 * back to pending list if hw_start fails.
+	 */
+	list_del_init(&req->list);
+
+	if (ctx_isp->offline_context) {
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+		CAM_DBG(CAM_REQ,
+			"Move pending req: %lld to free list(cnt: %d) offline ctx %u link: 0x%x",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+	} else if (ctx_isp->rdi_only_context || !req_isp->num_fence_map_out) {
+		list_add_tail(&req->list, &ctx->wait_req_list);
+		CAM_DBG(CAM_REQ,
+			"Move pending req: %lld to wait list(cnt: %d) ctx %u link: 0x%x",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl);
+	} else {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		CAM_DBG(CAM_REQ,
+			"Move pending req: %lld to active list(cnt: %d) ctx %u link: 0x%x offline %d",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id, ctx->link_hdl,
+			ctx_isp->offline_context);
+	}
+
+	/*
+	 * Only place to change state before calling the hw due to
+	 * hardware tasklet has higher priority that can cause the
+	 * irq handling comes early
+	 */
+	ctx->state = CAM_CTX_ACTIVATED;
+	trace_cam_context_state("ISP", ctx);
+	rc = ctx->hw_mgr_intf->hw_start(ctx->hw_mgr_intf->hw_mgr_priv,
+		&start_isp);
+	if (rc) {
+		/* HW failure. user need to clean up the resource */
+		CAM_ERR(CAM_ISP, "Start HW failed, ctx %u link: 0x%x", ctx->ctx_id, ctx->link_hdl);
+		ctx->state = CAM_CTX_READY;
+		if ((rc == -ETIMEDOUT) &&
+			(isp_ctx_debug.enable_cdm_cmd_buff_dump))
+			rc = cam_isp_ctx_dump_req(req_isp, 0, 0, NULL, false);
+
+		trace_cam_context_state("ISP", ctx);
+		list_del_init(&req->list);
+		list_add(&req->list, &ctx->pending_req_list);
+		goto end;
+	}
+	CAM_DBG(CAM_ISP, "start device success ctx %u link: 0x%x", ctx->ctx_id, ctx->link_hdl);
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_unlink_in_ready(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc = 0;
+
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("ISP", ctx);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_stop_dev_in_activated_unlock(
+	struct cam_context *ctx, struct cam_start_stop_dev_cmd *stop_cmd)
+{
+	int rc = 0;
+	uint32_t i;
+	struct cam_hw_stop_args          stop;
+	struct cam_ctx_request          *req;
+	struct cam_isp_ctx_req          *req_isp;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_isp_stop_args         stop_isp;
+
+	/* Mask off all the incoming hardware events */
+	spin_lock_bh(&ctx->lock);
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_HALT;
+	spin_unlock_bh(&ctx->lock);
+
+	CAM_DBG(CAM_ISP, "cam ctx id %d offline ctx %d rdi only ctx %d",
+			ctx->ctx_id, ctx_isp->offline_context,
+			ctx_isp->rdi_only_context);
+
+	/* stop hw first */
+	if (ctx_isp->hw_ctx) {
+		stop.ctxt_to_hw_map = ctx_isp->hw_ctx;
+
+		stop_isp.hw_stop_cmd = CAM_ISP_HW_STOP_IMMEDIATELY;
+		stop_isp.stop_only = false;
+		stop_isp.is_internal_stop = false;
+
+		stop.args = (void *) &stop_isp;
+		ctx->hw_mgr_intf->hw_stop(ctx->hw_mgr_intf->hw_mgr_priv,
+			&stop);
+	}
+
+	CAM_DBG(CAM_ISP, "next Substate[%s], ctx_idx: %u, link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+
+	if (ctx->ctx_crm_intf &&
+		ctx->ctx_crm_intf->notify_stop) {
+		struct cam_req_mgr_notify_stop notify;
+
+		notify.link_hdl = ctx->link_hdl;
+		CAM_DBG(CAM_ISP,
+			"Notify CRM about device stop ctx %u link 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx->ctx_crm_intf->notify_stop(&notify);
+	} else if (!ctx_isp->offline_context)
+		CAM_ERR(CAM_ISP, "cb not present, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+	while (!list_empty(&ctx->pending_req_list)) {
+		req = list_first_entry(&ctx->pending_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_ISP, "signal fence in pending list. fence num %d ctx:%u, link: 0x%x",
+			 req_isp->num_fence_map_out, ctx->ctx_id, ctx->link_hdl);
+		for (i = 0; i < req_isp->num_fence_map_out; i++)
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_ISP_EVENT_HW_STOP);
+			}
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+	}
+
+	while (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_ISP, "signal fence in wait list. fence num %d ctx: %u, link: 0x%x",
+			 req_isp->num_fence_map_out, ctx->ctx_id, ctx->link_hdl);
+		for (i = 0; i < req_isp->num_fence_map_out; i++)
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_ISP_EVENT_HW_STOP);
+			}
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+	}
+
+	while (!list_empty(&ctx->active_req_list)) {
+		req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_ISP, "signal fence in active list. fence num %d ctx: %u, link: 0x%x",
+			 req_isp->num_fence_map_out, ctx->ctx_id, ctx->link_hdl);
+		for (i = 0; i < req_isp->num_fence_map_out; i++)
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_ISP_EVENT_HW_STOP);
+			}
+		__cam_isp_ctx_move_req_to_free_list(ctx, req);
+	}
+
+	ctx_isp->frame_id = 0;
+	ctx_isp->active_req_cnt = 0;
+	ctx_isp->reported_req_id = 0;
+	ctx_isp->reported_frame_id = 0;
+	ctx_isp->last_applied_req_id = 0;
+	ctx_isp->req_info.last_bufdone_req_id = 0;
+	ctx_isp->bubble_frame_cnt = 0;
+	ctx_isp->congestion_cnt = 0;
+	ctx_isp->sof_dbg_irq_en = false;
+	atomic_set(&ctx_isp->process_bubble, 0);
+	atomic_set(&ctx_isp->internal_recovery_set, 0);
+	atomic64_set(&ctx_isp->dbg_monitors.state_monitor_head, -1);
+	atomic64_set(&ctx_isp->dbg_monitors.frame_monitor_head, -1);
+
+	/* Reset skipped_list for FCG config */
+	__cam_isp_ctx_reset_fcg_tracker(ctx);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->dbg_monitors.event_record_head[i], -1);
+
+	CAM_DBG(CAM_ISP, "Stop device success next state %d on ctx %u link: 0x%x",
+		ctx->state, ctx->ctx_id, ctx->link_hdl);
+
+	if (!stop_cmd) {
+		rc = __cam_isp_ctx_unlink_in_ready(ctx, NULL);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Unlink failed rc=%d, ctx %u link: 0x%x",
+				rc, ctx->ctx_id, ctx->link_hdl);
+	}
+	return rc;
+}
+
+static int __cam_isp_ctx_stop_dev_in_activated(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *)ctx->ctx_priv;
+
+	__cam_isp_ctx_stop_dev_in_activated_unlock(ctx, cmd);
+	ctx_isp->init_received = false;
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	CAM_DBG(CAM_ISP, "cam ctx id %d offline ctx %d rdi only ctx %d state %d",
+			ctx->ctx_id,
+			ctx_isp->offline_context,
+			ctx_isp->rdi_only_context,
+			ctx->state);
+
+	trace_cam_context_state("ISP", ctx);
+	return rc;
+}
+
+static int __cam_isp_ctx_release_dev_in_activated(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	rc = __cam_isp_ctx_stop_dev_in_activated_unlock(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Stop device failed rc=%d, ctx %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+
+	rc = __cam_isp_ctx_release_dev_in_top_state(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Release device failed rc=%d ctx %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_release_hw_in_activated(struct cam_context *ctx,
+	void *cmd)
+{
+	int rc = 0;
+
+	rc = __cam_isp_ctx_stop_dev_in_activated_unlock(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Stop device failed rc=%d, ctx %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+
+	rc = __cam_isp_ctx_release_hw_in_top_state(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Release hw failed rc=%d, ctx %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_link_pause(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args       hw_cmd_args;
+	struct cam_isp_hw_cmd_args   isp_hw_cmd_args;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_PAUSE_HW;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_link_resume(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args       hw_cmd_args;
+	struct cam_isp_hw_cmd_args   isp_hw_cmd_args;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_RESUME_HW;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_reset_and_recover(
+	bool skip_resume, struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *)ctx->ctx_priv;
+	struct cam_isp_stop_args              stop_isp;
+	struct cam_hw_stop_args               stop_args;
+	struct cam_isp_start_args             start_isp;
+	struct cam_hw_cmd_args                hw_cmd_args;
+	struct cam_isp_hw_cmd_args            isp_hw_cmd_args;
+	struct cam_ctx_request               *req;
+	struct cam_isp_ctx_req               *req_isp;
+
+	spin_lock_bh(&ctx->lock);
+	if (ctx_isp->active_req_cnt) {
+		spin_unlock_bh(&ctx->lock);
+		CAM_WARN(CAM_ISP,
+			"Active list not empty: %u in ctx: %u on link: 0x%x, retry recovery for req: %lld after buf_done",
+			ctx_isp->active_req_cnt, ctx->ctx_id,
+			ctx->link_hdl, ctx_isp->recovery_req_id);
+		goto end;
+	}
+
+	if (ctx->state != CAM_CTX_ACTIVATED) {
+		spin_unlock_bh(&ctx->lock);
+		CAM_ERR(CAM_ISP,
+			"In wrong state %d, for recovery ctx: %u in link: 0x%x recovery req: %lld",
+			ctx->state, ctx->ctx_id,
+			ctx->link_hdl, ctx_isp->recovery_req_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (list_empty(&ctx->pending_req_list)) {
+		/* Cannot start with no request */
+		spin_unlock_bh(&ctx->lock);
+		CAM_ERR(CAM_ISP,
+			"Failed to reset and recover last_applied_req: %llu in ctx: %u on link: 0x%x",
+			ctx_isp->last_applied_req_id, ctx->ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (!ctx_isp->hw_ctx) {
+		spin_unlock_bh(&ctx->lock);
+		CAM_ERR(CAM_ISP,
+			"Invalid hw context pointer ctx: %u on link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	/* Block all events till HW is resumed */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_HALT;
+
+	req = list_first_entry(&ctx->pending_req_list,
+		struct cam_ctx_request, list);
+	spin_unlock_bh(&ctx->lock);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	CAM_INFO(CAM_ISP,
+		"Trigger Halt, Reset & Resume for req: %llu ctx: %u in state: %d link: 0x%x",
+		req->request_id, ctx->ctx_id, ctx->state, ctx->link_hdl);
+
+	stop_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	stop_isp.hw_stop_cmd = CAM_ISP_HW_STOP_IMMEDIATELY;
+	stop_isp.stop_only = true;
+	stop_isp.is_internal_stop = true;
+	stop_args.args = (void *)&stop_isp;
+	rc = ctx->hw_mgr_intf->hw_stop(ctx->hw_mgr_intf->hw_mgr_priv,
+		&stop_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to stop HW rc: %d ctx: %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+	CAM_DBG(CAM_ISP, "Stop HW success ctx: %u link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+
+	/* API provides provision to stream off and not resume as well in case of fatal errors */
+	if (skip_resume) {
+		atomic_set(&ctx_isp->internal_recovery_set, 0);
+		CAM_INFO(CAM_ISP,
+			"Halting streaming off IFE/SFE ctx: %u last_applied_req: %lld [recovery_req: %lld] on link: 0x%x",
+			ctx->ctx_id, ctx_isp->last_applied_req_id,
+			ctx_isp->recovery_req_id, ctx->link_hdl);
+		goto end;
+	}
+
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_RESUME_HW;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to resume HW rc: %d ctx: %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+		goto end;
+	}
+	CAM_DBG(CAM_ISP, "Resume call success ctx: %u on link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+
+	start_isp.hw_config.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	start_isp.hw_config.request_id = req->request_id;
+	start_isp.hw_config.hw_update_entries = req_isp->cfg;
+	start_isp.hw_config.num_hw_update_entries = req_isp->num_cfg;
+	start_isp.hw_config.priv  = &req_isp->hw_update_data;
+	start_isp.hw_config.init_packet = 1;
+	start_isp.hw_config.reapply_type = CAM_CONFIG_REAPPLY_IQ;
+	start_isp.hw_config.cdm_reset_before_apply = false;
+	start_isp.start_only = true;
+	start_isp.is_internal_start = true;
+
+	__cam_isp_context_reset_internal_recovery_params(ctx_isp);
+
+	ctx_isp->substate_activated = ctx_isp->rdi_only_context ?
+		CAM_ISP_CTX_ACTIVATED_APPLIED : CAM_ISP_CTX_ACTIVATED_SOF;
+
+	rc = ctx->hw_mgr_intf->hw_start(ctx->hw_mgr_intf->hw_mgr_priv,
+		&start_isp);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Start HW failed, ctx: %u link: 0x%x", ctx->ctx_id, ctx->link_hdl);
+		ctx->state = CAM_CTX_READY;
+		goto end;
+	}
+
+	/* IQ applied for this request, on next trigger skip IQ cfg */
+	req_isp->reapply_type = CAM_CONFIG_REAPPLY_IO;
+
+	/* Notify userland that KMD has done internal recovery */
+	__cam_isp_ctx_notify_v4l2_error_event(CAM_REQ_MGR_WARN_TYPE_KMD_RECOVERY,
+		0, req->request_id, ctx);
+
+	CAM_INFO(CAM_ISP, "Internal Start HW success ctx %u on link: 0x%x for req: %llu",
+		ctx->ctx_id, ctx->link_hdl, req->request_id);
+
+end:
+	return rc;
+}
+
+static bool __cam_isp_ctx_try_internal_recovery_for_bubble(
+	int64_t error_req_id, struct cam_context *ctx)
+{
+	int rc;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *)ctx->ctx_priv;
+
+	if (isp_ctx_debug.disable_internal_recovery_mask &
+		CAM_ISP_CTX_DISABLE_RECOVERY_BUBBLE)
+		return false;
+
+	/* Perform recovery if bubble recovery is stalled */
+	if (!atomic_read(&ctx_isp->process_bubble))
+		return false;
+
+	/* Validate if errored request has been applied */
+	if (ctx_isp->last_applied_req_id < error_req_id) {
+		CAM_WARN(CAM_ISP,
+			"Skip trying for internal recovery last applied: %lld error_req: %lld for ctx: %u on link: 0x%x",
+			ctx_isp->last_applied_req_id, error_req_id,
+			ctx->ctx_id, ctx->link_hdl);
+		return false;
+	}
+
+	if (__cam_isp_ctx_validate_for_req_reapply_util(ctx_isp)) {
+		CAM_WARN(CAM_ISP,
+			"Internal recovery not possible for ctx: %u on link: 0x%x req: %lld [last_applied: %lld]",
+			ctx->ctx_id, ctx->link_hdl, error_req_id, ctx_isp->last_applied_req_id);
+		return false;
+	}
+
+	/* Trigger reset and recover */
+	atomic_set(&ctx_isp->internal_recovery_set, 1);
+	rc = __cam_isp_ctx_reset_and_recover(false, ctx);
+	if (rc) {
+		CAM_WARN(CAM_ISP,
+			"Internal recovery failed in ctx: %u on link: 0x%x req: %lld [last_applied: %lld]",
+			ctx->ctx_id, ctx->link_hdl, error_req_id, ctx_isp->last_applied_req_id);
+		atomic_set(&ctx_isp->internal_recovery_set, 0);
+		goto error;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Internal recovery done in ctx: %u on link: 0x%x req: %lld [last_applied: %lld]",
+		ctx->ctx_id, ctx->link_hdl, error_req_id, ctx_isp->last_applied_req_id);
+
+	return true;
+
+error:
+	return false;
+}
+
+static int __cam_isp_ctx_process_evt(struct cam_context *ctx,
+	struct cam_req_mgr_link_evt_data *link_evt_data)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	if ((ctx->state == CAM_CTX_ACQUIRED) &&
+		(link_evt_data->evt_type != CAM_REQ_MGR_LINK_EVT_UPDATE_PROPERTIES)) {
+		CAM_WARN(CAM_ISP,
+			"Get unexpect evt:%d in acquired state, ctx: %u on link: 0x%x",
+			link_evt_data->evt_type, ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+	switch (link_evt_data->evt_type) {
+	case CAM_REQ_MGR_LINK_EVT_ERR:
+	case CAM_REQ_MGR_LINK_EVT_EOF:
+		/* No handling */
+		break;
+	case CAM_REQ_MGR_LINK_EVT_PAUSE:
+		rc = __cam_isp_ctx_link_pause(ctx);
+		break;
+	case CAM_REQ_MGR_LINK_EVT_RESUME:
+		rc =  __cam_isp_ctx_link_resume(ctx);
+		break;
+	case CAM_REQ_MGR_LINK_EVT_SOF_FREEZE:
+		rc = __cam_isp_ctx_handle_sof_freeze_evt(ctx);
+		break;
+	case CAM_REQ_MGR_LINK_EVT_STALLED: {
+		bool internal_recovery_skipped = false;
+
+		if (ctx->state == CAM_CTX_ACTIVATED) {
+			if (link_evt_data->try_for_recovery)
+				internal_recovery_skipped =
+					__cam_isp_ctx_try_internal_recovery_for_bubble(
+						link_evt_data->req_id, ctx);
+
+			if (!internal_recovery_skipped)
+				rc = __cam_isp_ctx_trigger_reg_dump(
+					CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR, ctx);
+		}
+		link_evt_data->try_for_recovery = internal_recovery_skipped;
+	}
+		break;
+	case CAM_REQ_MGR_LINK_EVT_UPDATE_PROPERTIES:
+		if (link_evt_data->u.properties_mask &
+			CAM_LINK_PROPERTY_SENSOR_STANDBY_AFTER_EOF)
+			ctx_isp->vfps_aux_context = true;
+		else
+			ctx_isp->vfps_aux_context = false;
+		CAM_DBG(CAM_ISP, "vfps_aux_context:%s on ctx: %u link: 0x%x",
+			CAM_BOOL_TO_YESNO(ctx_isp->vfps_aux_context), ctx->ctx_id, ctx->link_hdl);
+		break;
+	default:
+		CAM_WARN(CAM_ISP,
+			"Unsupported event type: 0x%x on ctx: %u link: 0x%x",
+			link_evt_data->evt_type, ctx->ctx_id, ctx->link_hdl);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int __cam_isp_ctx_unlink_in_activated(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc = 0;
+
+	CAM_WARN(CAM_ISP,
+		"Received unlink in activated state. It's unexpected, ctx: %u link: 0x%x",
+		ctx->ctx_id, ctx->link_hdl);
+
+	rc = __cam_isp_ctx_stop_dev_in_activated_unlock(ctx, NULL);
+	if (rc)
+		CAM_WARN(CAM_ISP, "Stop device failed rc=%d, ctx: %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+
+	rc = __cam_isp_ctx_unlink_in_ready(ctx, unlink);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Unlink failed rc=%d, ctx: %u link: 0x%x",
+			rc, ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_req(struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_ctx_ops *ctx_ops = NULL;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	trace_cam_apply_req("ISP", ctx->ctx_id, apply->request_id, apply->link_hdl);
+	CAM_DBG(CAM_ISP, "Enter: apply req in Substate[%s] request_id:%lld, ctx: %u link: 0x%x",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), apply->request_id, ctx->ctx_id, ctx->link_hdl);
+	ctx_ops = &ctx_isp->substate_machine[ctx_isp->substate_activated];
+	if (ctx_ops->crm_ops.apply_req) {
+		rc = ctx_ops->crm_ops.apply_req(ctx, apply);
+	} else {
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"No handle function in activated Substate[%s], ctx: %u link: 0x%x",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+		rc = -EFAULT;
+	}
+
+	if (rc)
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Apply failed in active Substate[%s] rc %d, ctx: %u link: 0x%x",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc, ctx->ctx_id, ctx->link_hdl);
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_default_settings(
+	struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_ctx_ops *ctx_ops = NULL;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_isp_fcg_prediction_tracker *fcg_tracker;
+
+	if (!(apply->trigger_point & ctx_isp->subscribe_event)) {
+		CAM_WARN(CAM_ISP,
+			"Trigger: %u not subscribed for: %u, ctx: %u link: 0x%x",
+			apply->trigger_point, ctx_isp->subscribe_event, ctx->ctx_id,
+			ctx->link_hdl);
+		return 0;
+	}
+
+	/* Allow apply default settings for IFE only at SOF */
+	if (apply->trigger_point != CAM_TRIGGER_POINT_SOF)
+		return 0;
+
+	if (atomic_read(&ctx_isp->internal_recovery_set))
+		return __cam_isp_ctx_reset_and_recover(false, ctx);
+
+	/* FCG handling */
+	fcg_tracker = &ctx_isp->fcg_tracker;
+	if (ctx_isp->frame_id != 1)
+		fcg_tracker->num_skipped += 1;
+	CAM_DBG(CAM_ISP,
+		"Apply default settings, number of previous continuous skipped frames: %d, ctx_id: %d",
+		fcg_tracker->num_skipped, ctx->ctx_id);
+
+	/*
+	 * Call notify frame skip for static offline cases or
+	 * mode switch cases where IFE mode switch delay differs
+	 * from other devices on the link
+	 */
+	if ((ctx_isp->use_default_apply) ||
+		(ctx_isp->mode_switch_en && ctx_isp->handle_mswitch)) {
+		CAM_DBG(CAM_ISP,
+			"Enter: apply req in Substate:%d request _id:%lld ctx:%u on link:0x%x",
+			ctx_isp->substate_activated, apply->request_id,
+			ctx->ctx_id, ctx->link_hdl);
+
+		ctx_ops = &ctx_isp->substate_machine[
+			ctx_isp->substate_activated];
+		if (ctx_ops->crm_ops.notify_frame_skip) {
+			rc = ctx_ops->crm_ops.notify_frame_skip(ctx, apply);
+		} else {
+			CAM_WARN_RATE_LIMIT(CAM_ISP,
+				"No handle function in activated substate %d, ctx:%u on link:0x%x",
+				ctx_isp->substate_activated, ctx->ctx_id, ctx->link_hdl);
+			rc = -EFAULT;
+		}
+
+		if (rc)
+			CAM_WARN_RATE_LIMIT(CAM_ISP,
+				"Apply default failed in active substate %d rc %d ctx: %u link: 0x%x",
+				ctx_isp->substate_activated, rc, ctx->ctx_id, ctx->link_hdl);
+	}
+
+	return rc;
+}
+
+void __cam_isp_ctx_notify_cpas(struct cam_context *ctx, uint32_t evt_id)
+{
+	uint64_t request_id = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *)ctx->ctx_priv;
+	struct cam_ctx_request *req = NULL;
+	char ctx_evt_id_string[128];
+
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_SOF:
+		if (!list_empty(&ctx->wait_req_list)) {
+			req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request, list);
+			request_id = req->request_id;
+		} else
+			request_id = 0;
+		if (ctx_isp->substate_activated == CAM_ISP_CTX_ACTIVATED_EPOCH &&
+			!list_empty(&ctx->active_req_list)) {
+			req = list_last_entry(&ctx->active_req_list, struct cam_ctx_request, list);
+			request_id = req->request_id;
+			CAM_DBG(CAM_ISP, "EPCR notify cpas");
+		}
+		break;
+	case CAM_ISP_HW_EVENT_EOF:
+		if (!list_empty(&ctx->active_req_list)) {
+			req = list_first_entry(&ctx->active_req_list, struct cam_ctx_request, list);
+			request_id = req->request_id;
+		} else
+			request_id = 0;
+		break;
+	case CAM_ISP_HW_EVENT_EPOCH:
+		if (list_empty(&ctx->wait_req_list)) {
+			if (!list_empty(&ctx->active_req_list)) {
+				req = list_last_entry(&ctx->active_req_list,
+					struct cam_ctx_request, list);
+				request_id = req->request_id;
+			} else
+				request_id = 0;
+		} else {
+			req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request, list);
+			request_id = req->request_id;
+		}
+		break;
+	default:
+		return;
+	}
+
+	snprintf(ctx_evt_id_string, sizeof(ctx_evt_id_string),
+		"%s_frame[%llu]_%s",
+		ctx->ctx_id_string,
+		ctx_isp->frame_id,
+		cam_isp_hw_evt_type_to_string(evt_id));
+	CAM_DBG(CAM_ISP, "Substate[%s] ctx: %s frame: %llu evt: %s req: %llu",
+		__cam_isp_ctx_substate_val_to_type(ctx_isp->substate_activated),
+		ctx->ctx_id_string,
+		ctx_isp->frame_id,
+		cam_isp_hw_evt_type_to_string(evt_id),
+		request_id);
+	cam_cpas_notify_event(ctx_evt_id_string, request_id);
+}
+
+static int __cam_isp_ctx_handle_irq_in_activated(void *context,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_ctx_irq_ops *irq_ops = NULL;
+	struct cam_context *ctx = (struct cam_context *)context;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *)ctx->ctx_priv;
+
+	spin_lock(&ctx->lock);
+	trace_cam_isp_activated_irq(ctx, ctx_isp->substate_activated, evt_id,
+		__cam_isp_ctx_get_event_ts(evt_id, evt_data));
+
+	CAM_DBG(CAM_ISP, "Enter: State %d, Substate[%s], evt id %d, ctx:%u link: 0x%x",
+		ctx->state, __cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), evt_id,
+		ctx->ctx_id, ctx->link_hdl);
+	irq_ops = &ctx_isp->substate_machine_irq[ctx_isp->substate_activated];
+	if (irq_ops->irq_ops[evt_id]) {
+		rc = irq_ops->irq_ops[evt_id](ctx_isp, evt_data);
+	} else {
+		CAM_DBG(CAM_ISP,
+			"No handle function for Substate[%s], evt id %d, ctx:%u link: 0x%x",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), evt_id,
+			ctx->ctx_id, ctx->link_hdl);
+		if (isp_ctx_debug.enable_state_monitor_dump)
+			__cam_isp_ctx_dump_state_monitor_array(ctx_isp);
+	}
+
+	if ((evt_id == CAM_ISP_HW_EVENT_SOF) ||
+		(evt_id == CAM_ISP_HW_EVENT_EOF) ||
+		(evt_id == CAM_ISP_HW_EVENT_EPOCH))
+		__cam_isp_ctx_update_frame_timing_record(evt_id, ctx_isp);
+
+	__cam_isp_ctx_notify_cpas(ctx, evt_id);
+	CAM_DBG(CAM_ISP, "Exit: State %d Substate[%s], ctx: %u link: 0x%x",
+		ctx->state, __cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), ctx->ctx_id, ctx->link_hdl);
+
+	spin_unlock(&ctx->lock);
+	return rc;
+}
+
+static int cam_isp_context_validate_event_notify_injection(struct cam_context *ctx,
+	struct cam_hw_inject_evt_param *evt_params)
+{
+	int rc = 0;
+	uint32_t evt_type;
+	uint64_t req_id;
+
+	req_id   = evt_params->req_id;
+	evt_type = evt_params->u.evt_notify.evt_notify_type;
+
+	switch (evt_type) {
+	case V4L_EVENT_CAM_REQ_MGR_ERROR: {
+		struct cam_hw_inject_err_evt_param *err_evt_params =
+			&evt_params->u.evt_notify.u.err_evt_params;
+
+		switch (err_evt_params->err_type) {
+		case CAM_REQ_MGR_ERROR_TYPE_RECOVERY:
+		case CAM_REQ_MGR_ERROR_TYPE_SOF_FREEZE:
+		case CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY:
+		case CAM_REQ_MGR_WARN_TYPE_KMD_RECOVERY:
+			break;
+		default:
+			CAM_ERR(CAM_ISP,
+				"Invalid error type: %u for error event injection err type: %u req id: %llu ctx id: %u link: 0x%x dev hdl: %d",
+				err_evt_params->err_type, err_evt_params->err_code,
+				req_id, ctx->ctx_id, ctx->link_hdl, ctx->dev_hdl);
+			return -EINVAL;
+		}
+
+		CAM_INFO(CAM_ISP,
+			"Inject ERR evt: err code: %u err type: %u req id: %llu ctx id: %u link: 0x%x dev hdl: %d",
+			err_evt_params->err_code, err_evt_params->err_type,
+			req_id, ctx->ctx_id, ctx->link_hdl, ctx->dev_hdl);
+		break;
+	}
+	case V4L_EVENT_CAM_REQ_MGR_PF_ERROR: {
+		struct cam_hw_inject_pf_evt_param *pf_evt_params =
+			&evt_params->u.evt_notify.u.pf_evt_params;
+		bool non_fatal_en;
+
+		rc = cam_smmu_is_cb_non_fatal_fault_en(ctx->img_iommu_hdl, &non_fatal_en);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Fail to query whether device's cb has non-fatal enabled rc:%d, ctx id: %u link: 0x%x",
+				rc, ctx->ctx_id, ctx->link_hdl);
+			return rc;
+		}
+
+		if (!non_fatal_en) {
+			CAM_ERR(CAM_ISP,
+				"Fail to inject pagefault event notif. Pagefault fatal for ISP,ctx:%u link:0x%x",
+				ctx->ctx_id, ctx->link_hdl);
+			return -EINVAL;
+		}
+
+		CAM_INFO(CAM_ISP,
+			"Inject PF evt: req_id:%llu ctx:%u link:0x%x dev hdl:%d ctx found:%hhu",
+			req_id, ctx->ctx_id, ctx->link_hdl, ctx->dev_hdl,
+			pf_evt_params->ctx_found);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_ISP, "Event notification type not supported: %u, ctx: %u link: 0x%x",
+			evt_type, ctx->ctx_id, ctx->link_hdl);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_isp_context_inject_evt(void *context, void *evt_args)
+{
+	struct cam_context *ctx = context;
+	struct cam_isp_context *ctx_isp = NULL;
+	struct cam_hw_inject_evt_param *evt_params = evt_args;
+	int rc = 0;
+
+	if (!ctx || !evt_args) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params ctx %s event args %s",
+			CAM_IS_NULL_TO_STR(ctx), CAM_IS_NULL_TO_STR(evt_args));
+		return -EINVAL;
+	}
+
+	ctx_isp = ctx->ctx_priv;
+	if (evt_params->inject_id == CAM_COMMON_EVT_INJECT_NOTIFY_EVENT_TYPE) {
+		rc = cam_isp_context_validate_event_notify_injection(ctx, evt_params);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Event notif injection failed validation rc:%d, ctx:%u link:0x%x",
+				rc, ctx->ctx_id, ctx->link_hdl);
+			return rc;
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "Bufdone err injection %u not supported by ISP,ctx:%u link:0x%x",
+			evt_params->inject_id, ctx->ctx_id, ctx->link_hdl);
+		return -EINVAL;
+	}
+
+
+	memcpy(&ctx_isp->evt_inject_params, evt_params,
+		sizeof(struct cam_hw_inject_evt_param));
+
+	ctx_isp->evt_inject_params.is_valid = true;
+
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_isp_ctx_top_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_isp_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.acquire_hw = __cam_isp_ctx_acquire_hw_in_acquired,
+			.release_dev = __cam_isp_ctx_release_dev_in_top_state,
+			.config_dev = __cam_isp_ctx_config_dev_in_acquired,
+			.flush_dev = __cam_isp_ctx_flush_dev_in_top_state,
+			.release_hw = __cam_isp_ctx_release_hw_in_top_state,
+		},
+		.crm_ops = {
+			.link = __cam_isp_ctx_link_in_acquired,
+			.unlink = __cam_isp_ctx_unlink_in_acquired,
+			.get_dev_info = __cam_isp_ctx_get_dev_info,
+			.process_evt = __cam_isp_ctx_process_evt,
+			.flush_req = __cam_isp_ctx_flush_req_in_top_state,
+			.dump_req = __cam_isp_ctx_dump_in_top_state,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_isp_context_dump_requests,
+		.dumpinfo_ops = cam_isp_context_info_dump,
+		.evt_inject_ops = cam_isp_context_inject_evt,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {
+			.start_dev = __cam_isp_ctx_start_dev_in_ready,
+			.release_dev = __cam_isp_ctx_release_dev_in_top_state,
+			.config_dev = __cam_isp_ctx_config_dev_in_top_state,
+			.flush_dev = __cam_isp_ctx_flush_dev_in_top_state,
+			.release_hw = __cam_isp_ctx_release_hw_in_top_state,
+		},
+		.crm_ops = {
+			.unlink = __cam_isp_ctx_unlink_in_ready,
+			.get_dev_info = __cam_isp_ctx_get_dev_info,
+			.flush_req = __cam_isp_ctx_flush_req_in_ready,
+			.dump_req = __cam_isp_ctx_dump_in_top_state,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_isp_context_dump_requests,
+		.dumpinfo_ops = cam_isp_context_info_dump,
+		.evt_inject_ops = cam_isp_context_inject_evt,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_isp_ctx_stop_dev_in_activated,
+			.release_dev = __cam_isp_ctx_release_dev_in_activated,
+			.config_dev = __cam_isp_ctx_config_dev_in_flushed,
+			.release_hw = __cam_isp_ctx_release_hw_in_activated,
+		},
+		.crm_ops = {
+			.unlink = __cam_isp_ctx_unlink_in_ready,
+			.process_evt = __cam_isp_ctx_process_evt,
+			.flush_req = __cam_isp_ctx_flush_req_in_flushed_state,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_isp_context_dump_requests,
+		.dumpinfo_ops = cam_isp_context_info_dump,
+		.evt_inject_ops = cam_isp_context_inject_evt,
+		.msg_cb_ops = cam_isp_context_handle_message,
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_isp_ctx_stop_dev_in_activated,
+			.release_dev = __cam_isp_ctx_release_dev_in_activated,
+			.config_dev = __cam_isp_ctx_config_dev_in_top_state,
+			.flush_dev = __cam_isp_ctx_flush_dev_in_top_state,
+			.release_hw = __cam_isp_ctx_release_hw_in_activated,
+		},
+		.crm_ops = {
+			.unlink = __cam_isp_ctx_unlink_in_activated,
+			.apply_req = __cam_isp_ctx_apply_req,
+			.notify_frame_skip =
+				__cam_isp_ctx_apply_default_settings,
+			.flush_req = __cam_isp_ctx_flush_req_in_top_state,
+			.process_evt = __cam_isp_ctx_process_evt,
+			.dump_req = __cam_isp_ctx_dump_in_top_state,
+		},
+		.irq_ops = __cam_isp_ctx_handle_irq_in_activated,
+		.pagefault_ops = cam_isp_context_dump_requests,
+		.dumpinfo_ops = cam_isp_context_info_dump,
+		.recovery_ops = cam_isp_context_hw_recovery,
+		.evt_inject_ops = cam_isp_context_inject_evt,
+		.msg_cb_ops = cam_isp_context_handle_message,
+	},
+};
+
+static int cam_isp_context_hw_recovery(void *priv, void *data)
+{
+	struct cam_context *ctx = priv;
+	int rc = -EPERM;
+
+	if (ctx->hw_mgr_intf->hw_recovery)
+		rc = ctx->hw_mgr_intf->hw_recovery(ctx->hw_mgr_intf->hw_mgr_priv, data);
+	else
+		CAM_ERR(CAM_ISP, "hw mgr doesn't support recovery, ctx_idx: %u, link: 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static void cam_isp_context_find_faulted_context(struct cam_context *ctx,
+	struct list_head *req_list, struct cam_hw_dump_pf_args *pf_args, bool *found)
+{
+	struct cam_ctx_request *req = NULL;
+	struct cam_ctx_request *req_temp = NULL;
+	int rc;
+
+	*found = false;
+	list_for_each_entry_safe(req, req_temp, req_list, list) {
+		CAM_INFO(CAM_ISP, "List req_id: %llu ctx id: %u link: 0x%x",
+			req->request_id, ctx->ctx_id, ctx->link_hdl);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_args, &req->pf_data);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to dump pf info, ctx_idx: %u, link: 0x%x",
+				ctx->ctx_id, ctx->link_hdl);
+		/*
+		 * Found faulted buffer. Even if faulted ctx is found, but
+		 * continue to search for faulted buffer
+		 */
+		if (pf_args->pf_context_info.mem_type != CAM_FAULT_BUF_NOT_FOUND) {
+			*found = true;
+			break;
+		}
+	}
+}
+
+static int cam_isp_context_dump_requests(void *data, void *args)
+{
+	struct cam_context         *ctx = (struct cam_context *)data;
+	struct cam_isp_context     *ctx_isp;
+	struct cam_hw_dump_pf_args *pf_args = (struct cam_hw_dump_pf_args *)args;
+	int rc = 0;
+	bool found;
+
+	if (!ctx || !pf_args) {
+		CAM_ERR(CAM_ISP, "Invalid ctx %pK or pf args %pK",
+			ctx, pf_args);
+		return -EINVAL;
+	}
+
+	ctx_isp = (struct cam_isp_context *)ctx->ctx_priv;
+	if (!ctx_isp) {
+		CAM_ERR(CAM_ISP, "Invalid isp ctx");
+		return -EINVAL;
+	}
+
+	if (pf_args->handle_sec_pf)
+		goto end;
+
+	CAM_INFO(CAM_ISP,
+		"Iterating over active list for isp ctx %u link: 0x%x state %d",
+		ctx->ctx_id, ctx->link_hdl, ctx->state);
+	cam_isp_context_find_faulted_context(ctx, &ctx->active_req_list,
+		pf_args, &found);
+	if (found)
+		goto end;
+
+	CAM_INFO(CAM_ISP,
+		"Iterating over waiting list of isp ctx %u link: 0x%x state %d",
+		ctx->ctx_id, ctx->link_hdl, ctx->state);
+	cam_isp_context_find_faulted_context(ctx, &ctx->wait_req_list,
+		pf_args, &found);
+	if (found)
+		goto end;
+
+	/*
+	 * In certain scenarios we observe both overflow and SMMU pagefault
+	 * for a particular request. If overflow is handled before page fault
+	 * we need to traverse through pending request list because if
+	 * bubble recovery is enabled on any request we move that request
+	 * and all the subsequent requests to the pending list while handling
+	 * overflow error.
+	 */
+	CAM_INFO(CAM_ISP,
+		"Iterating over pending req list of isp ctx %u link: 0x%x state %d",
+		ctx->ctx_id, ctx->link_hdl, ctx->state);
+	cam_isp_context_find_faulted_context(ctx, &ctx->pending_req_list,
+		pf_args, &found);
+	if (found)
+		goto end;
+
+end:
+	if (pf_args->pf_context_info.resource_type) {
+		ctx_isp = (struct cam_isp_context *)ctx->ctx_priv;
+		CAM_INFO(CAM_ISP,
+			"Page fault on resource:%s (0x%x) ctx id:%u link: 0x%x frame id:%d reported id:%lld applied id:%lld",
+			__cam_isp_resource_handle_id_to_type(ctx_isp->isp_device_type,
+			pf_args->pf_context_info.resource_type),
+			pf_args->pf_context_info.resource_type,
+			ctx->ctx_id, ctx->link_hdl, ctx_isp->frame_id,
+			ctx_isp->reported_req_id, ctx_isp->last_applied_req_id);
+	}
+
+	/*
+	 * Send PF notification to UMD if PF found on current CTX
+	 * or it is forced to send PF notification to UMD even if no
+	 * faulted context found
+	 */
+	if (pf_args->pf_context_info.ctx_found ||
+			pf_args->pf_context_info.force_send_pf_evt)
+		rc = cam_context_send_pf_evt(ctx, pf_args);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Failed to notify PF event to userspace rc: %d, ctx id:%u link: 0x%x",
+			rc,  ctx->ctx_id, ctx->link_hdl);
+
+	return rc;
+}
+
+static int cam_isp_context_handle_message(void *context,
+	uint32_t msg_type, void *data)
+{
+	int                            rc = -EINVAL;
+	struct cam_hw_cmd_args         hw_cmd_args = {0};
+	struct cam_isp_hw_cmd_args     isp_hw_cmd_args = {0};
+	struct cam_context            *ctx = (struct cam_context *)context;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+
+	switch (msg_type) {
+	case CAM_SUBDEV_MESSAGE_CLOCK_UPDATE:
+		hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+		isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_UPDATE_CLOCK;
+		isp_hw_cmd_args.cmd_data = data;
+		hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+		rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&hw_cmd_args);
+
+		if (rc)
+			CAM_ERR(CAM_ISP, "Update clock rate failed rc: %d", rc);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid message type %d", msg_type);
+	}
+	return rc;
+}
+
+static int cam_isp_context_debug_register(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("isp_ctx", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "DebugFS could not create directory!");
+		return rc;
+	}
+
+	/* Store parent inode for cleanup in caller */
+	isp_ctx_debug.dentry = dbgfileptr;
+
+	debugfs_create_u32("enable_state_monitor_dump", 0644,
+		isp_ctx_debug.dentry, &isp_ctx_debug.enable_state_monitor_dump);
+	debugfs_create_u8("enable_cdm_cmd_buffer_dump", 0644,
+		isp_ctx_debug.dentry, &isp_ctx_debug.enable_cdm_cmd_buff_dump);
+	debugfs_create_u32("disable_internal_recovery_mask", 0644,
+		isp_ctx_debug.dentry, &isp_ctx_debug.disable_internal_recovery_mask);
+
+	return 0;
+}
+
+int cam_isp_context_init(struct cam_isp_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_req_mgr_kmd_ops *crm_node_intf,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id,
+	uint32_t isp_device_type,
+	int img_iommu_hdl)
+{
+	int rc = -1;
+	int i;
+	struct cam_isp_skip_frame_info *skip_info, *temp;
+
+	if (!ctx || !ctx_base) {
+		CAM_ERR(CAM_ISP, "Invalid Context");
+		goto err;
+	}
+
+	/* ISP context setup */
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->base = ctx_base;
+	ctx->frame_id = 0;
+	ctx->custom_enabled = false;
+	ctx->use_frame_header_ts = false;
+	ctx->use_default_apply = false;
+	ctx->active_req_cnt = 0;
+	ctx->reported_req_id = 0;
+	ctx->bubble_frame_cnt = 0;
+	ctx->congestion_cnt = 0;
+	ctx->req_info.last_bufdone_req_id = 0;
+	ctx->v4l2_event_sub_ids = 0;
+
+	ctx->hw_ctx = NULL;
+	ctx->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+	ctx->substate_machine = cam_isp_ctx_activated_state_machine;
+	ctx->substate_machine_irq = cam_isp_ctx_activated_state_machine_irq;
+	ctx->init_timestamp = jiffies_to_msecs(jiffies);
+	ctx->isp_device_type = isp_device_type;
+
+	for (i = 0; i < CAM_ISP_CTX_REQ_MAX; i++) {
+		ctx->req_base[i].req_priv = &ctx->req_isp[i];
+		ctx->req_isp[i].base = &ctx->req_base[i];
+	}
+
+	/* camera context setup */
+	rc = cam_context_init(ctx_base, isp_dev_name, CAM_ISP, ctx_id,
+		crm_node_intf, hw_intf, ctx->req_base, CAM_ISP_CTX_REQ_MAX, img_iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Camera Context Base init failed, ctx_idx: %u, link: 0x%x",
+			ctx_base->ctx_id, ctx_base->link_hdl);
+		goto free_mem;
+	}
+
+	/* FCG related struct setup */
+	INIT_LIST_HEAD(&ctx->fcg_tracker.skipped_list);
+	for (i = 0; i < CAM_ISP_AFD_PIPELINE_DELAY; i++) {
+		skip_info = kzalloc(sizeof(struct cam_isp_skip_frame_info), GFP_KERNEL);
+		if (!skip_info) {
+			CAM_ERR(CAM_ISP,
+				"Failed to allocate memory for FCG struct, ctx_idx: %u, link: %x",
+				ctx_base->ctx_id, ctx_base->link_hdl);
+			rc = -ENOMEM;
+			goto free_mem;
+		}
+
+		list_add_tail(&skip_info->list, &ctx->fcg_tracker.skipped_list);
+	}
+
+	/* link camera context with isp context */
+	ctx_base->state_machine = cam_isp_ctx_top_state_machine;
+	ctx_base->ctx_priv = ctx;
+
+	/* initializing current state for error logging */
+	for (i = 0; i < CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES; i++) {
+		ctx->dbg_monitors.state_monitor[i].curr_state =
+		CAM_ISP_CTX_ACTIVATED_MAX;
+	}
+	atomic64_set(&ctx->dbg_monitors.state_monitor_head, -1);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx->dbg_monitors.event_record_head[i], -1);
+
+	atomic64_set(&ctx->dbg_monitors.frame_monitor_head, -1);
+
+	if (!isp_ctx_debug.dentry)
+		cam_isp_context_debug_register();
+
+	return rc;
+
+free_mem:
+	list_for_each_entry_safe(skip_info, temp,
+		&ctx->fcg_tracker.skipped_list, list) {
+		list_del(&skip_info->list);
+		kfree(skip_info);
+		skip_info = NULL;
+	}
+err:
+	return rc;
+}
+
+int cam_isp_context_deinit(struct cam_isp_context *ctx)
+{
+	struct cam_isp_skip_frame_info *skip_info, *temp;
+
+	list_for_each_entry_safe(skip_info, temp,
+		&ctx->fcg_tracker.skipped_list, list) {
+		list_del(&skip_info->list);
+		kfree(skip_info);
+		skip_info = NULL;
+	}
+
+	if (ctx->base)
+		cam_context_deinit(ctx->base);
+
+	if (ctx->substate_activated != CAM_ISP_CTX_ACTIVATED_SOF)
+		CAM_ERR(CAM_ISP, "ISP context Substate[%s] is invalid",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx->substate_activated));
+
+	isp_ctx_debug.dentry = NULL;
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/cam_isp_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/cam_isp_context.h
@@ -0,0 +1,665 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_CONTEXT_H_
+#define _CAM_ISP_CONTEXT_H_
+
+
+#include <linux/spinlock_types.h>
+#include <media/cam_isp.h>
+#include <media/cam_defs.h>
+#include <media/cam_tfe.h>
+
+#include "cam_context.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_req_mgr_workq.h"
+
+#define CAM_IFE_QTIMER_MUL_FACTOR        10000
+#define CAM_IFE_QTIMER_DIV_FACTOR        192
+
+/*
+ * Maximum hw resource - This number is based on the maximum
+ * output port resource. The current maximum resource number
+ * is 24.
+ */
+#define CAM_ISP_CTX_RES_MAX                     24
+
+/* max requests per ctx for isp */
+#define CAM_ISP_CTX_REQ_MAX                     8
+
+/*
+ * Maximum entries in state monitoring array for error logging
+ */
+#define CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES   84
+
+/*
+ * Threshold response time in us beyond which a request is not expected
+ * to be with IFE hw
+ */
+#define CAM_ISP_CTX_RESPONSE_TIME_THRESHOLD   100000
+
+/* Number of words for dumping isp context */
+#define CAM_ISP_CTX_DUMP_NUM_WORDS  5
+
+/* Number of words for dumping isp context events*/
+#define CAM_ISP_CTX_DUMP_EVENT_NUM_WORDS  3
+
+/* Number of words for dumping request info*/
+#define CAM_ISP_CTX_DUMP_REQUEST_NUM_WORDS  2
+
+/* Maximum entries in event record */
+#define CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES   8
+
+/* Maximum length of tag while dumping */
+#define CAM_ISP_CONTEXT_DUMP_TAG_MAX_LEN 128
+
+/* AEB error count threshold */
+#define CAM_ISP_CONTEXT_AEB_ERROR_CNT_MAX 6
+
+/* Debug Buffer length*/
+#define CAM_ISP_CONTEXT_DBG_BUF_LEN 1000
+
+/* AFD pipeline delay for FCG configuration */
+#define CAM_ISP_AFD_PIPELINE_DELAY 3
+
+/* Maximum entries in frame record */
+#define CAM_ISP_CTX_MAX_FRAME_RECORDS  5
+
+/* Congestion count threshold */
+#define CAM_ISP_CONTEXT_CONGESTION_CNT_MAX 3
+
+/* forward declaration */
+struct cam_isp_context;
+
+/* cam isp context irq handling function type */
+typedef int (*cam_isp_hw_event_cb_func)(struct cam_isp_context *ctx_isp,
+	void *evt_data);
+
+/**
+ * enum cam_isp_ctx_activated_substate - sub states for activated
+ *
+ */
+enum cam_isp_ctx_activated_substate {
+	CAM_ISP_CTX_ACTIVATED_SOF,
+	CAM_ISP_CTX_ACTIVATED_APPLIED,
+	CAM_ISP_CTX_ACTIVATED_EPOCH,
+	CAM_ISP_CTX_ACTIVATED_BUBBLE,
+	CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED,
+	CAM_ISP_CTX_ACTIVATED_HW_ERROR,
+	CAM_ISP_CTX_ACTIVATED_HALT,
+	CAM_ISP_CTX_ACTIVATED_MAX,
+};
+
+/**
+ * enum cam_isp_ctx_event_type - events for a request
+ *
+ */
+enum cam_isp_ctx_event {
+	CAM_ISP_CTX_EVENT_SUBMIT,
+	CAM_ISP_CTX_EVENT_APPLY,
+	CAM_ISP_CTX_EVENT_EPOCH,
+	CAM_ISP_CTX_EVENT_RUP,
+	CAM_ISP_CTX_EVENT_BUFDONE,
+	CAM_ISP_CTX_EVENT_SHUTTER,
+	CAM_ISP_CTX_EVENT_MAX
+};
+
+/**
+ * enum cam_isp_state_change_trigger - Different types of ISP events
+ *
+ */
+enum cam_isp_state_change_trigger {
+	CAM_ISP_STATE_CHANGE_TRIGGER_ERROR,
+	CAM_ISP_STATE_CHANGE_TRIGGER_APPLIED,
+	CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE,
+	CAM_ISP_STATE_CHANGE_TRIGGER_SOF,
+	CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH,
+	CAM_ISP_STATE_CHANGE_TRIGGER_DONE,
+	CAM_ISP_STATE_CHANGE_TRIGGER_EOF,
+	CAM_ISP_STATE_CHANGE_TRIGGER_FLUSH,
+	CAM_ISP_STATE_CHANGE_TRIGGER_SEC_EVT_SOF,
+	CAM_ISP_STATE_CHANGE_TRIGGER_SEC_EVT_EPOCH,
+	CAM_ISP_STATE_CHANGE_TRIGGER_FRAME_DROP,
+	CAM_ISP_STATE_CHANGE_TRIGGER_CDM_DONE,
+	CAM_ISP_STATE_CHANGE_TRIGGER_MAX
+};
+
+/**
+ * enum cam_isp_ctx_flush_event - Different types of Flush event for affected ctx
+ * in case of group stream configurations
+ *
+ */
+enum cam_isp_ctx_flush_event {
+	CAM_ISP_CTX_FLUSH_AFFECTED_CTX_REQ_LIST,
+	CAM_ISP_CTX_FLUSH_AFFECTED_CTX_SET_FLUSH_IN_PROGRESS,
+	CAM_ISP_CTX_FLUSH_EVENT_MAX
+};
+
+#define CAM_ISP_CTX_DISABLE_RECOVERY_AEB           BIT(0)
+#define CAM_ISP_CTX_DISABLE_RECOVERY_BUS_OVERFLOW  BIT(1)
+#define CAM_ISP_CTX_DISABLE_RECOVERY_BUBBLE        BIT(2)
+
+/**
+ * struct cam_isp_ctx_debug -  Contains debug parameters
+ *
+ * @dentry:                     Debugfs entry
+ * @enable_state_monitor_dump:  Enable isp state monitor dump
+ * @enable_cdm_cmd_buff_dump:   Enable CDM Command buffer dump
+ * @disable_internal_recovery:  Disable internal kernel recovery mask
+ *
+ */
+struct cam_isp_ctx_debug {
+	struct dentry  *dentry;
+	uint32_t        enable_state_monitor_dump;
+	uint8_t         enable_cdm_cmd_buff_dump;
+	uint32_t        disable_internal_recovery_mask;
+};
+
+/**
+ * struct cam_isp_ctx_irq_ops - Function table for handling IRQ callbacks
+ *
+ * @irq_ops:               Array of handle function pointers.
+ *
+ */
+struct cam_isp_ctx_irq_ops {
+	cam_isp_hw_event_cb_func         irq_ops[CAM_ISP_HW_EVENT_MAX];
+};
+
+/**
+ * struct cam_isp_ctx_req - ISP context request object
+ *
+ * @base:                      Common request object ponter
+ * @cfg:                       ISP hardware configuration array
+ * @num_cfg:                   Number of ISP hardware configuration entries
+ * @fence_map_out:             Output fence mapping array
+ * @num_fence_map_out:         Number of the output fence map
+ * @fence_map_in:              Input fence mapping array
+ * @num_fence_map_in:          Number of input fence map
+ * @num_acked:                 Count to track acked entried for output.
+ *                             If count equals the number of fence out, it means
+ *                             the request has been completed.
+ * @num_deferred_acks:         Number of buf_dones/acks that are deferred to
+ *                             handle or signalled in special scenarios.
+ *                             Increment this count instead of num_acked and
+ *                             handle the events later where eventually
+ *                             increment num_acked.
+ * @deferred_fence_map_index   Saves the indices of fence_map_out for which
+ *                             handling of buf_done is deferred.
+ * @bubble_report:             Flag to track if bubble report is active on
+ *                             current request
+ * @hw_update_data:            HW update data for this request
+ * @reapply_type:              Determines type of settings to be re-applied
+ * @event_timestamp:           Timestamp for different stage of request
+ * @cdm_reset_before_apply:    For bubble re-apply when buf done not coming set
+ *                             to True
+ *
+ */
+struct cam_isp_ctx_req {
+	struct cam_ctx_request               *base;
+	struct cam_hw_update_entry           *cfg;
+	uint32_t                              num_cfg;
+	struct cam_hw_fence_map_entry        *fence_map_out;
+	uint32_t                              num_fence_map_out;
+	struct cam_hw_fence_map_entry        *fence_map_in;
+	uint32_t                              num_fence_map_in;
+	uint32_t                              num_acked;
+	uint32_t                              num_deferred_acks;
+	uint32_t                  deferred_fence_map_index[CAM_ISP_CTX_RES_MAX];
+	int32_t                               bubble_report;
+	struct cam_isp_prepare_hw_update_data hw_update_data;
+	enum cam_hw_config_reapply_type       reapply_type;
+	ktime_t                               event_timestamp
+		[CAM_ISP_CTX_EVENT_MAX];
+	bool                                  bubble_detected;
+	bool                                  cdm_reset_before_apply;
+};
+
+/**
+ * struct cam_isp_context_state_monitor - ISP context state
+ *                                        monitoring for
+ *                                        debug purposes
+ *
+ * @curr_state:          Current sub state that received req
+ * @trigger:             Event type of incoming req
+ * @req_id:              Request id
+ * @frame_id:            Frame id based on SOFs
+ * @evt_time_stamp       Current time stamp
+ *
+ */
+struct cam_isp_context_state_monitor {
+	enum cam_isp_ctx_activated_substate  curr_state;
+	enum cam_isp_state_change_trigger    trigger;
+	uint64_t                             req_id;
+	int64_t                              frame_id;
+	struct timespec64                    evt_time_stamp;
+};
+
+/**
+ * struct cam_isp_context_req_id_info - ISP context request id
+ *                     information for bufdone.
+ *
+ *@last_bufdone_req_id:   Last bufdone request id
+ *
+ */
+
+struct cam_isp_context_req_id_info {
+	int64_t                          last_bufdone_req_id;
+};
+
+struct shutter_event {
+	uint64_t frame_id;
+	uint64_t req_id;
+	uint32_t status;
+	ktime_t  boot_ts;
+	ktime_t  sof_ts;
+};
+
+/**
+ *
+ *
+ * struct cam_isp_context_event_record - Information for last 20 Events
+ *  for a request; Submit, Apply, EPOCH, RUP, Buf done.
+ *
+ * @req_id:    Last applied request id
+ * @timestamp: Timestamp for the event
+ *
+ */
+struct cam_isp_context_event_record {
+	uint64_t req_id;
+	ktime_t  timestamp;
+	int event_type;
+	union event {
+		struct shutter_event shutter_event;
+	} event;
+};
+
+/**
+ *
+ *
+ * struct cam_isp_context_frame_timing_record - Frame timing events
+ *
+ * @sof_ts:           SOF timestamp
+ * @eof_ts:           EOF ts
+ * @epoch_ts:         EPOCH ts
+ * @secondary_sof_ts: Secondary SOF ts
+ *
+ */
+struct cam_isp_context_frame_timing_record {
+	struct timespec64 sof_ts;
+	struct timespec64 eof_ts;
+	struct timespec64 epoch_ts;
+	struct timespec64 secondary_sof_ts;
+};
+
+
+/**
+ *
+ *
+ * struct cam_isp_context_debug_monitors - ISP context debug monitors
+ *
+ * @state_monitor_head:        State machine monitor head
+ * @state_monitor:             State machine monitor info
+ * @event_record_head:         Request Event monitor head
+ * @event_record:              Request event monitor info
+ * @frame_monitor_head:        Frame timing monitor head
+ * @frame_monitor:             Frame timing event monitor
+ *
+ */
+struct cam_isp_context_debug_monitors {
+	/* State machine monitoring */
+	atomic64_t                           state_monitor_head;
+	struct cam_isp_context_state_monitor state_monitor[
+		CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES];
+
+	/* Req event monitor */
+	atomic64_t                            event_record_head[
+		CAM_ISP_CTX_EVENT_MAX];
+	struct cam_isp_context_event_record   event_record[
+		CAM_ISP_CTX_EVENT_MAX][CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES];
+
+	/* Frame timing monitor */
+	atomic64_t                            frame_monitor_head;
+	struct cam_isp_context_frame_timing_record frame_monitor[
+		CAM_ISP_CTX_MAX_FRAME_RECORDS];
+};
+
+/**
+ * struct cam_isp_skip_frame_info - FIFO Queue for number of skipped frames for
+ *                                  the decision of FCG prediction
+ * @num_frame_skipped:              Keep track of the number of skipped frames in between
+ *                                  of the normal frames
+ * @list:                           List member used to append this node to a linked list
+ */
+struct cam_isp_skip_frame_info {
+	uint32_t                         num_frame_skipped;
+	struct list_head                 list;
+};
+
+/**
+ * struct cam_isp_fcg_prediction_tracker - Track the number of skipped frames before and
+ *                                         indicate which FCG prediction should be applied
+ *
+ * @num_skipped:               Number of skipped frames from previous normally applied frame
+ *                             to this normally applied frame
+ * @sum_skipped:               Sum of the number of frames from req generation to req apply
+ * @skipped_list:              Keep track of the number of skipped frames in between from two
+ *                             normal frames
+ */
+struct cam_isp_fcg_prediction_tracker {
+	uint32_t                              num_skipped;
+	uint32_t                              sum_skipped;
+	struct list_head                      skipped_list;
+};
+
+/**
+ * struct cam_isp_context   -  ISP context object
+ *
+ * @base:                      Common context object pointer
+ * @frame_id:                  Frame id tracking for the isp context
+ * @frame_id_meta:             Frame id read every epoch for the ctx
+ *                             meta from the sensor
+ * @substate_actiavted:        Current substate for the activated state.
+ * @process_bubble:            Atomic variable to check if ctx is still
+ *                             processing bubble.
+ * @substate_machine:          ISP substate machine for external interface
+ * @substate_machine_irq:      ISP substate machine for irq handling
+ * @req_base:                  Common request object storage
+ * @req_isp:                   ISP private request object storage
+ * @hw_ctx:                    HW object returned by the acquire device command
+ * @sof_timestamp_val:         Captured time stamp value at sof hw event
+ * @boot_timestamp:            Boot time stamp for a given req_id
+ * @active_req_cnt:            Counter for the active request
+ * @reported_req_id:           Last reported request id
+ * @subscribe_event:           The irq event mask that CRM subscribes to, IFE
+ *                             will invoke CRM cb at those event.
+ * @last_applied_req_id:       Last applied request id
+ * @recovery_req_id:           Req ID flagged for internal recovery
+ * @last_sof_timestamp:        SOF timestamp of the last frame
+ * @bubble_frame_cnt:          Count of the frame after bubble
+ * @aeb_error_cnt:             Count number of times a specific AEB error scenario is
+ *                             enountered
+ * @out_of_sync_cnt:           Out of sync error count for AEB
+ * @congestion_cnt:            Count number of times congestion was encountered
+ *                             consecutively
+ * @state_monitor_head:        Write index to the state monitoring array
+ * @req_info                   Request id information about last buf done
+ * @dbg_monitors:              Debug monitors for ISP context
+ * @rdi_only_context:          Get context type information.
+ *                             true, if context is rdi only context
+ * @offline_context:           Indicate whether context is for offline IFE
+ * @vfps_aux_context:          Indicate whether context is for VFPS aux link
+ * @resume_hw_in_flushed:      Indicate whether resume hw in flushed state in vfps case
+ * @hw_acquired:               Indicate whether HW resources are acquired
+ * @init_received:             Indicate whether init config packet is received
+ * @split_acquire:             Indicate whether a separate acquire is expected
+ * @custom_enabled:            Custom HW enabled for this ctx
+ * @use_frame_header_ts:       Use frame header for qtimer ts
+ * @support_consumed_addr:     Indicate whether HW has last consumed addr reg
+ * @sof_dbg_irq_en:            Indicates whether ISP context has enabled debug irqs
+ * @apply_in_progress          Whether request apply is in progress
+ * @use_default_apply:         Use default settings in case of frame skip
+ * @init_timestamp:            Timestamp at which this context is initialized
+ * @isp_device_type:           ISP device type
+ * @workq:                     Worker thread for offline ife
+ * @trigger_id:                ID provided by CRM for each ctx on the link
+ * @last_bufdone_err_apply_req_id:  last bufdone error apply request id
+ * @v4l2_event_sub_ids         contains individual bits representing subscribed v4l2 ids
+ * @evt_inject_params:         event injection parameters
+ * @aeb_enabled:               Indicate if stream is for AEB
+ * @last_sof_jiffies:          Record the jiffies of last sof
+ * @last_applied_jiffies:      Record the jiffiest of last applied req
+ * @vfe_bus_comp_grp:          Vfe bus comp group record
+ * @sfe_bus_comp_grp:          Sfe bus comp group record
+ * @mswitch_default_apply_delay_max_cnt: Max mode switch delay among all devices connected
+ *                                       on the same link as this ISP context
+ * @mswitch_default_apply_delay_ref_cnt: Ref cnt for this context to decide when to apply
+ *                                       mode switch settings
+ * @handle_mswitch:            Indicates if IFE needs to explicitly handle mode switch
+ *                             on frame skip callback from request manager.
+ *                             This is decided based on the max mode switch delay published
+ *                             by other devices on the link as part of link setup
+ * @mode_switch_en:            Indicates if mode switch is enabled
+ * @hw_idx:                    Hardware ID
+ * @fcg_tracker:               FCG prediction tracker containing number of previously skipped
+ *                             frames and indicates which prediction should be used
+ * @is_shdr:                   true, if usecase is sdhr
+ * @is_shdr_master:            Flag to indicate master context in shdr usecase
+ * @last_num_exp:              Last num of exposure
+ * @flush_in_progress          indicates whether flush is in progress
+ *
+ */
+struct cam_isp_context {
+	struct cam_context              *base;
+
+	uint64_t                         frame_id;
+	uint32_t                         frame_id_meta;
+	uint32_t                         substate_activated;
+	atomic_t                         process_bubble;
+	struct cam_ctx_ops              *substate_machine;
+	struct cam_isp_ctx_irq_ops      *substate_machine_irq;
+
+	struct cam_ctx_request           req_base[CAM_ISP_CTX_REQ_MAX];
+	struct cam_isp_ctx_req           req_isp[CAM_ISP_CTX_REQ_MAX];
+
+	void                            *hw_ctx;
+	uint64_t                         sof_timestamp_val;
+	uint64_t                         boot_timestamp;
+	int32_t                          active_req_cnt;
+	int64_t                          reported_req_id;
+	uint64_t                         reported_frame_id;
+	uint32_t                         subscribe_event;
+	int64_t                          last_applied_req_id;
+	uint64_t                         recovery_req_id;
+	uint64_t                         last_sof_timestamp;
+	uint32_t                         bubble_frame_cnt;
+	uint32_t                         aeb_error_cnt;
+	uint32_t                         out_of_sync_cnt;
+	uint32_t                         congestion_cnt;
+	struct cam_isp_context_req_id_info    req_info;
+	struct cam_isp_context_debug_monitors dbg_monitors;
+	bool                                  rdi_only_context;
+	bool                                  offline_context;
+	bool                                  vfps_aux_context;
+	bool                                  resume_hw_in_flushed;
+	bool                                  hw_acquired;
+	bool                                  init_received;
+	bool                                  split_acquire;
+	bool                                  custom_enabled;
+	bool                                  use_frame_header_ts;
+	bool                                  support_consumed_addr;
+	bool                                  sof_dbg_irq_en;
+	atomic_t                              apply_in_progress;
+	atomic_t                              internal_recovery_set;
+	bool                                  use_default_apply;
+	unsigned int                          init_timestamp;
+	uint32_t                              isp_device_type;
+	struct cam_req_mgr_core_workq        *workq;
+	int32_t                               trigger_id;
+	int64_t                               last_bufdone_err_apply_req_id;
+	uint32_t                              v4l2_event_sub_ids;
+	struct cam_hw_inject_evt_param        evt_inject_params;
+	bool                                  aeb_enabled;
+	uint64_t                              last_sof_jiffies;
+	uint64_t                              last_applied_jiffies;
+	struct cam_isp_context_comp_record   *vfe_bus_comp_grp;
+	struct cam_isp_context_comp_record   *sfe_bus_comp_grp;
+	int32_t                               mswitch_default_apply_delay_max_cnt;
+	atomic_t                              mswitch_default_apply_delay_ref_cnt;
+	bool                                  handle_mswitch;
+	bool                                  mode_switch_en;
+	uint32_t                              hw_idx;
+	struct cam_isp_fcg_prediction_tracker fcg_tracker;
+	bool                                  is_tfe_shdr;
+	bool                                  is_shdr_master;
+	uint32_t                              last_num_exp;
+	atomic_t                              flush_in_progress;
+	struct mutex                          isp_mutex;
+};
+
+/**
+ * struct cam_isp_context_dump_header - ISP context dump header
+ * @tag:       Tag name for the header
+ * @word_size: Size of word
+ * @size:      Size of data
+ *
+ */
+struct cam_isp_context_dump_header {
+	uint8_t   tag[CAM_ISP_CONTEXT_DUMP_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/** * struct cam_isp_ctx_req_mini_dump - ISP mini dumprequest
+ *
+ * @map_out:                   Output fence mapping
+ * @map_in:                    Input fence mapping
+ * @io_cfg:                    IO buffer configuration
+ * @reapply_type:              Determines type of settings to be re-applied
+ * @request_id:                Request ID
+ * @num_fence_map_out:         Number of the output fence map
+ * @num_fence_map_in:          Number of input fence map
+ * @num_io_cfg:                Number of ISP hardware configuration entries
+ * @num_acked:                 Count to track acked entried for output.
+ * @num_deferred_acks:         Number of buf_dones/acks that are deferred to
+ *                             handle or signalled in special scenarios.
+ *                             Increment this count instead of num_acked and
+ *                             handle the events later where eventually
+ *                             increment num_acked.
+ * @bubble_report:             Flag to track if bubble report is active on
+ *                             current request
+ * @bubble_detected:           Flag to track if bubble is detected
+ * @cdm_reset_before_apply:    For bubble re-apply when buf done not coming set
+ *                             to True
+ *
+ */
+struct cam_isp_ctx_req_mini_dump {
+	struct cam_hw_fence_map_entry   *map_out;
+	struct cam_hw_fence_map_entry   *map_in;
+	struct cam_buf_io_cfg           *io_cfg;
+	enum cam_hw_config_reapply_type  reapply_type;
+	uint64_t                         request_id;
+	uint8_t                          num_fence_map_in;
+	uint8_t                          num_fence_map_out;
+	uint8_t                          num_io_cfg;
+	uint8_t                          num_acked;
+	uint8_t                          num_deferred_acks;
+	bool                             bubble_report;
+	bool                             bubble_detected;
+	bool                             cdm_reset_before_apply;
+};
+
+/**
+ * struct cam_isp_ctx_mini_dump_info - Isp context mini dump data
+ *
+ * @active_list:               Active Req list
+ * @pending_list:              Pending req list
+ * @wait_list:                 Wait Req List
+ * @event_record:              Event record
+ * @sof_timestamp_val:         Captured time stamp value at sof hw event
+ * @boot_timestamp:            Boot time stamp for a given req_id
+ * @last_sof_timestamp:        SOF timestamp of the last frame
+ * @init_timestamp:            Timestamp at which this context is initialized
+ * @frame_id:                  Frame id read every epoch for the ctx
+ * @reported_req_id:           Last reported request id
+ * @last_applied_req_id:       Last applied request id
+ * @frame_id_meta:             Frame id for meta
+ * @ctx_id:                    Context id
+ * @subscribe_event:           The irq event mask that CRM subscribes to, IFE
+ *                             will invoke CRM cb at those event.
+ * @bubble_frame_cnt:          Count of the frame after bubble
+ * @isp_device_type:           ISP device type
+ * @active_req_cnt:            Counter for the active request
+ * @trigger_id:                ID provided by CRM for each ctx on the link
+ * @substate_actiavted:        Current substate for the activated state.
+ * @rxd_epoch:                 Indicate whether epoch has been received. Used to
+ *                             decide whether to apply request in offline ctx
+ * @process_bubble:            Atomic variable to check if ctx is still
+ *                             processing bubble.
+ * @apply_in_progress          Whether request apply is in progress
+ * @rdi_only_context:          Get context type information.
+ *                             true, if context is rdi only context
+ * @offline_context:           Indicate whether context is for offline IFE
+ * @hw_acquired:               Indicate whether HW resources are acquired
+ * @init_received:             Indicate whether init config packet is received
+ *                             meta from the sensor
+ * @split_acquire:             Indicate whether a separate acquire is expected
+ * @custom_enabled:            Custom HW enabled for this ctx
+ * @use_frame_header_ts:       Use frame header for qtimer ts
+ * @support_consumed_addr:     Indicate whether HW has last consumed addr reg
+ * @use_default_apply:         Use default settings in case of frame skip
+ *
+ */
+struct cam_isp_ctx_mini_dump_info {
+	struct cam_isp_ctx_req_mini_dump      *active_list;
+	struct cam_isp_ctx_req_mini_dump      *pending_list;
+	struct cam_isp_ctx_req_mini_dump      *wait_list;
+	struct cam_isp_context_event_record    event_record[
+		CAM_ISP_CTX_EVENT_MAX][CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES];
+	uint64_t                               sof_timestamp_val;
+	uint64_t                               boot_timestamp;
+	uint64_t                               last_sof_timestamp;
+	uint64_t                               init_timestamp;
+	int64_t                                frame_id;
+	int64_t                                reported_req_id;
+	int64_t                                last_applied_req_id;
+	int64_t                                last_bufdone_err_apply_req_id;
+	uint32_t                               frame_id_meta;
+	uint8_t                                ctx_id;
+	uint8_t                                subscribe_event;
+	uint8_t                                bubble_frame_cnt;
+	uint8_t                                isp_device_type;
+	uint8_t                                active_req_cnt;
+	uint8_t                                trigger_id;
+	uint8_t                                substate_activated;
+	uint8_t                                rxd_epoch;
+	uint8_t                                process_bubble;
+	uint8_t                                active_cnt;
+	uint8_t                                pending_cnt;
+	uint8_t                                wait_cnt;
+	bool                                   apply_in_progress;
+	bool                                   rdi_only_context;
+	bool                                   offline_context;
+	bool                                   hw_acquired;
+	bool                                   init_received;
+	bool                                   split_acquire;
+	bool                                   custom_enabled;
+	bool                                   use_frame_header_ts;
+	bool                                   support_consumed_addr;
+	bool                                   use_default_apply;
+};
+
+/**
+ * cam_isp_context_init()
+ *
+ * @brief:              Initialization function for the ISP context
+ *
+ * @ctx:                ISP context obj to be initialized
+ * @bridge_ops:         Bridge call back funciton
+ * @hw_intf:            ISP hw manager interface
+ * @ctx_id:             ID for this context
+ * @isp_device_type     Isp device type
+ * @img_iommu_hdl       IOMMU HDL for image buffers
+ *
+ */
+int cam_isp_context_init(struct cam_isp_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_req_mgr_kmd_ops *bridge_ops,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id,
+	uint32_t isp_device_type,
+	int img_iommu_hdl);
+
+/**
+ * cam_isp_context_deinit()
+ *
+ * @brief:               Deinitialize function for the ISP context
+ *
+ * @ctx:                 ISP context obj to be deinitialized
+ *
+ */
+int cam_isp_context_deinit(struct cam_isp_context *ctx);
+
+#endif  /* __CAM_ISP_CONTEXT_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/cam_isp_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/cam_isp_dev.c
@@ -0,0 +1,369 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include <media/cam_req_mgr.h>
+#include "cam_isp_dev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_node.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+#include "cam_common_util.h"
+#include "cam_context_utils.h"
+
+static struct cam_isp_dev g_isp_dev;
+
+static int cam_isp_dev_evt_inject_cb(void *inject_args)
+{
+	struct cam_common_inject_evt_param *inject_params = inject_args;
+	int i;
+
+	for (i = 0; i < g_isp_dev.max_context; i++) {
+		if (g_isp_dev.ctx[i].dev_hdl == inject_params->dev_hdl) {
+			cam_context_add_evt_inject(&g_isp_dev.ctx[i],
+				&inject_params->evt_params);
+			return 0;
+		}
+	}
+
+	CAM_ERR(CAM_ISP, "No dev hdl found %d", inject_params->dev_hdl);
+	return -ENODEV;
+}
+
+static void cam_isp_dev_iommu_fault_handler(struct cam_smmu_pf_info *pf_smmu_info)
+{
+	int i, rc;
+	struct cam_node *node = NULL;
+	struct cam_hw_dump_pf_args pf_args = {0};
+
+	if (!pf_smmu_info || !pf_smmu_info->token) {
+		CAM_ERR(CAM_ISP, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_smmu_info->token;
+
+	pf_args.pf_smmu_info = pf_smmu_info;
+
+	for (i = 0; i < node->ctx_size; i++) {
+		cam_context_dump_pf_info(&(node->ctx_list[i]), &pf_args);
+		if (pf_args.pf_context_info.ctx_found)
+			/* Faulted ctx found */
+			break;
+	}
+
+	if (i == node->ctx_size) {
+		/* Faulted ctx not found. Report PF to userspace */
+		rc = cam_context_send_pf_evt(NULL, &pf_args);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Failed to notify PF event to userspace rc: %d", rc);
+	}
+}
+
+static void cam_isp_subdev_handle_message(
+		struct v4l2_subdev *sd,
+		enum cam_subdev_message_type_t message_type,
+		void *data)
+{
+	int i, rc = 0;
+	struct cam_node  *node = v4l2_get_subdevdata(sd);
+
+	CAM_DBG(CAM_ISP, "node name %s", node->name);
+	for (i = 0; i < node->ctx_size; i++) {
+		rc = cam_context_handle_message(&(node->ctx_list[i]), message_type, data);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to handle message for %s", node->name);
+	}
+}
+
+static const struct of_device_id cam_isp_dt_match[] = {
+	{
+		.compatible = "qcom,cam-isp"
+	},
+	{}
+};
+
+static int cam_isp_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+	mutex_lock(&g_isp_dev.isp_mutex);
+	if (g_isp_dev.open_cnt >= 1) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "ISP subdev is already opened");
+		rc = -EALREADY;
+		goto end;
+	}
+	g_isp_dev.open_cnt++;
+end:
+	mutex_unlock(&g_isp_dev.isp_mutex);
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
+	return rc;
+}
+
+static int cam_isp_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&g_isp_dev.isp_mutex);
+	if (g_isp_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_ISP, "ISP subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	g_isp_dev.open_cnt--;
+	if (!node) {
+		CAM_ERR(CAM_ISP, "Node ptr is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (g_isp_dev.open_cnt == 0)
+		cam_node_shutdown(node);
+
+end:
+	mutex_unlock(&g_isp_dev.isp_mutex);
+	return rc;
+}
+
+static int cam_isp_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_ISP, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+	return cam_isp_subdev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_isp_subdev_internal_ops = {
+	.close = cam_isp_subdev_close,
+	.open = cam_isp_subdev_open,
+};
+
+static int cam_isp_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = -1;
+	int i;
+	struct cam_hw_mgr_intf         hw_mgr_intf;
+	struct cam_node               *node;
+	const char                    *compat_str = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	int iommu_hdl = -1;
+
+	of_property_read_string_index(pdev->dev.of_node, "arch-compat", 0,
+		(const char **)&compat_str);
+
+	g_isp_dev.sd.internal_ops = &cam_isp_subdev_internal_ops;
+	g_isp_dev.sd.close_seq_prior = CAM_SD_CLOSE_HIGH_PRIORITY;
+	/* Initialize the v4l2 subdevice first. (create cam_node) */
+	if (strnstr(compat_str, "ife", strlen(compat_str))) {
+		rc = cam_subdev_probe(&g_isp_dev.sd, pdev, CAM_ISP_DEV_NAME,
+		CAM_IFE_DEVICE_TYPE);
+		g_isp_dev.isp_device_type = CAM_IFE_DEVICE_TYPE;
+		g_isp_dev.max_context = CAM_CTX_MAX;
+	} else if (strnstr(compat_str, "mc_tfe", strlen(compat_str))) {
+		rc  = cam_subdev_probe(&g_isp_dev.sd, pdev, CAM_ISP_DEV_NAME,
+		CAM_TFE_MC_DEVICE_TYPE);
+		g_isp_dev.isp_device_type = CAM_TFE_MC_DEVICE_TYPE;
+		g_isp_dev.max_context = CAM_CTX_MAX;
+	} else if (strnstr(compat_str, "tfe", strlen(compat_str))) {
+		rc = cam_subdev_probe(&g_isp_dev.sd, pdev, CAM_ISP_DEV_NAME,
+		CAM_TFE_DEVICE_TYPE);
+		g_isp_dev.sd.msg_cb = cam_isp_subdev_handle_message;
+		g_isp_dev.isp_device_type = CAM_TFE_DEVICE_TYPE;
+		g_isp_dev.max_context = CAM_TFE_CTX_MAX;
+	} else  {
+		CAM_ERR(CAM_ISP, "Invalid ISP hw type %s", compat_str);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "ISP cam_subdev_probe failed!");
+		goto err;
+	}
+	node = (struct cam_node *) g_isp_dev.sd.token;
+
+	memset(&hw_mgr_intf, 0, sizeof(hw_mgr_intf));
+	g_isp_dev.ctx = kcalloc(g_isp_dev.max_context,
+		sizeof(struct cam_context),
+		GFP_KERNEL);
+	if (!g_isp_dev.ctx) {
+		CAM_ERR(CAM_ISP,
+			"Mem Allocation failed for ISP base context");
+		goto unregister;
+	}
+
+	g_isp_dev.ctx_isp = kcalloc(g_isp_dev.max_context,
+		sizeof(struct cam_isp_context),
+		GFP_KERNEL);
+	if (!g_isp_dev.ctx_isp) {
+		CAM_ERR(CAM_ISP,
+			"Mem Allocation failed for Isp private context");
+		kfree(g_isp_dev.ctx);
+		g_isp_dev.ctx = NULL;
+		goto unregister;
+	}
+
+	rc = cam_isp_hw_mgr_init(compat_str, &hw_mgr_intf, &iommu_hdl,
+		g_isp_dev.isp_device_type);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Can not initialized ISP HW manager!");
+		goto free_mem;
+	}
+
+	for (i = 0; i < g_isp_dev.max_context; i++) {
+		rc = cam_isp_context_init(&g_isp_dev.ctx_isp[i],
+			&g_isp_dev.ctx[i],
+			&node->crm_node_intf,
+			&node->hw_mgr_intf,
+			i,
+			g_isp_dev.isp_device_type, iommu_hdl);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "ISP context init failed!");
+			goto free_mem;
+		}
+	}
+
+	if (g_isp_dev.isp_device_type == CAM_IFE_DEVICE_TYPE)
+		cam_common_register_evt_inject_cb(cam_isp_dev_evt_inject_cb,
+			CAM_COMMON_EVT_INJECT_HW_IFE);
+	else
+		cam_common_register_evt_inject_cb(cam_isp_dev_evt_inject_cb,
+			CAM_COMMON_EVT_INJECT_HW_TFE);
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_isp_dev.ctx,
+			g_isp_dev.max_context, CAM_ISP_DEV_NAME);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "ISP node init failed!");
+		goto free_mem;
+	}
+
+	node->sd_handler = cam_isp_subdev_close_internal;
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_isp_dev_iommu_fault_handler, node);
+
+	mutex_init(&g_isp_dev.isp_mutex);
+
+	rc = cam_subdev_register(&g_isp_dev.sd, pdev);
+	CAM_DBG(CAM_ISP, "Component bound successfully");
+
+	return rc;
+
+free_mem:
+	kfree(g_isp_dev.ctx);
+	g_isp_dev.ctx = NULL;
+	kfree(g_isp_dev.ctx_isp);
+	g_isp_dev.ctx_isp = NULL;
+
+unregister:
+	rc = cam_subdev_remove(&g_isp_dev.sd);
+err:
+	return rc;
+}
+
+static void cam_isp_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	int i;
+	const char *compat_str = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	of_property_read_string_index(pdev->dev.of_node, "arch-compat", 0,
+		(const char **)&compat_str);
+
+	cam_isp_hw_mgr_deinit(compat_str);
+	/* clean up resources */
+	for (i = 0; i < g_isp_dev.max_context; i++) {
+		rc = cam_isp_context_deinit(&g_isp_dev.ctx_isp[i]);
+		if (rc)
+			CAM_ERR(CAM_ISP, "ISP context %d deinit failed",
+				 i);
+	}
+
+	kfree(g_isp_dev.ctx);
+	g_isp_dev.ctx = NULL;
+	kfree(g_isp_dev.ctx_isp);
+	g_isp_dev.ctx_isp = NULL;
+
+	rc = cam_unregister_subdev(&g_isp_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Unregister failed rc: %d", rc);
+
+	rc = cam_subdev_remove(&g_isp_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Subdev remove rc: %d", rc);
+
+	memset(&g_isp_dev, 0, sizeof(g_isp_dev));
+}
+
+const static struct component_ops cam_isp_dev_component_ops = {
+	.bind = cam_isp_dev_component_bind,
+	.unbind = cam_isp_dev_component_unbind,
+};
+
+static int cam_isp_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_isp_dev_component_ops);
+	return 0;
+}
+
+static int cam_isp_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Adding ISP dev component");
+	rc = component_add(&pdev->dev, &cam_isp_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+struct platform_driver isp_driver = {
+	.probe = cam_isp_dev_probe,
+	.remove = cam_isp_dev_remove,
+	.driver = {
+		.name = "cam_isp",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_isp_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_isp_dev_init_module(void)
+{
+	return platform_driver_register(&isp_driver);
+}
+
+void cam_isp_dev_exit_module(void)
+{
+	platform_driver_unregister(&isp_driver);
+}
+
+MODULE_DESCRIPTION("MSM ISP driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/cam_isp_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/cam_isp_dev.h
@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_DEV_H_
+#define _CAM_ISP_DEV_H_
+
+#include "cam_subdev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_context.h"
+#include "cam_isp_context.h"
+
+/**
+ * struct cam_isp_dev - Camera ISP V4l2 device node
+ *
+ * @sd:                    Commone camera subdevice node
+ * @ctx:                   Isp base context storage
+ * @ctx_isp:               Isp private context storage
+ * @isp_mutex:             ISP dev mutex
+ * @open_cnt:              Open device count
+ * @isp_device_type        ISP device type
+ * @max_context            maximum contexts for TFE is 4 and for IFE is 8
+ */
+struct cam_isp_dev {
+	struct cam_subdev          sd;
+	struct cam_context         *ctx;
+	struct cam_isp_context     *ctx_isp;
+	struct mutex               isp_mutex;
+	int32_t                    open_cnt;
+	uint32_t                   isp_device_type;
+	int32_t                    max_context;
+};
+
+/**
+ * @brief : API to register ISP Dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_isp_dev_init_module(void);
+
+/**
+ * @brief : API to remove ISP Dev from platform framework.
+ */
+void cam_isp_dev_exit_module(void);
+#endif /* __CAM_ISP_DEV_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
@@ -0,0 +1,19415 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_compat.h"
+#include "cam_smmu_api.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_isp_packet_parser.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_ife_hw_mgr_addons.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm_util.h"
+#include "cam_packet_util.h"
+#include "cam_debug_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_common_util.h"
+#include "cam_presil_hw_access.h"
+
+#define CAM_IFE_SAFE_DISABLE 0
+#define CAM_IFE_SAFE_ENABLE 1
+#define SMMU_SE_IFE 0
+
+#define CAM_FRAME_HEADER_BUFFER_SIZE      64
+#define CAM_FRAME_HEADER_ADDR_ALIGNMENT   256
+
+#define CAM_ISP_PACKET_META_MAX                     \
+	(CAM_ISP_PACKET_META_GENERIC_BLOB_COMMON + 1)
+
+#define CAM_ISP_GENERIC_BLOB_TYPE_MAX               \
+	(CAM_ISP_GENERIC_BLOB_TYPE_CSID_QCFA_CONFIG + 1)
+
+#define MAX_INTERNAL_RECOVERY_ATTEMPTS    1
+
+#define MAX_PARAMS_FOR_IRQ_INJECT     5
+#define IRQ_INJECT_DISPLAY_BUF_LEN    4096
+
+typedef int (*cam_isp_irq_inject_cmd_parse_handler)(
+	struct cam_isp_irq_inject_param *irq_inject_param,
+	uint32_t param_index, char *token, bool *is_query);
+
+#define IRQ_INJECT_USAGE_STRING                                                         \
+	"######################################################\n"                          \
+	"Usage:\n"                                                                          \
+	"$INJECT_NODE : /sys/kernel/debug/camera/ife/isp_irq_inject\n\n"                    \
+	"  - cat $INJECT_NODE\n"                                                            \
+	"    print Usage, injected params and current active HW info.\n"                    \
+	"    Also we need to cat the node to get output info after echo params to node.\n\n"\
+	"  - echo ?:?:?:? > $INJECT_NODE\n"                                                 \
+	"    print query info, entering '?' to any param besides req_id to query.\n\n"      \
+	"  - echo hw_type:hw_idx:res_id:irq_mask:req_id > $INJECT_NODE\n"                   \
+	"    hw_type  : Hw to inject IRQ\n"                                                 \
+	"    hw_idx   : Index of the selected hw\n"                                         \
+	"    reg_unit : Register to set irq\n"                                              \
+	"    irq_mask : IRQ to be triggered\n"                                              \
+	"    req_id   : Req to trigger the IRQ, entering 'now' to this param will trigger " \
+	"irq immediately\n\n"                                                               \
+	"Up to 10 sets of inject params are supported.\n"                                   \
+	"######################################################\n"
+
+#define CAM_ISP_NON_RECOVERABLE_CSID_ERRORS          \
+	(CAM_ISP_HW_ERROR_CSID_LANE_FIFO_OVERFLOW    |   \
+	 CAM_ISP_HW_ERROR_CSID_PKT_HDR_CORRUPTED     |   \
+	 CAM_ISP_HW_ERROR_CSID_MISSING_PKT_HDR_DATA  |   \
+	 CAM_ISP_HW_ERROR_CSID_FATAL                 |   \
+	 CAM_ISP_HW_ERROR_CSID_UNBOUNDED_FRAME       |   \
+	 CAM_ISP_HW_ERROR_CSID_MISSING_EOT           |   \
+	 CAM_ISP_HW_ERROR_CSID_PKT_PAYLOAD_CORRUPTED)
+
+#define CAM_ISP_RECOVERABLE_CSID_ERRORS              \
+	(CAM_ISP_HW_ERROR_CSID_SENSOR_SWITCH_ERROR   |   \
+	 CAM_ISP_HW_ERROR_CSID_SENSOR_FRAME_DROP)
+
+static int cam_ife_mgr_v_config_hw(void *hw_mgr_priv, void *config_hw_args);
+
+static uint32_t blob_type_hw_cmd_map[CAM_ISP_GENERIC_BLOB_TYPE_MAX] = {
+	CAM_ISP_HW_CMD_GET_HFR_UPDATE,
+	CAM_ISP_HW_CMD_CLOCK_UPDATE,
+	CAM_ISP_HW_CMD_BW_UPDATE,
+	CAM_ISP_HW_CMD_UBWC_UPDATE,
+	CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE,
+	CAM_ISP_GENERIC_BLOB_TYPE_FE_CONFIG,
+	CAM_ISP_HW_CMD_UBWC_UPDATE_V2,
+	CAM_ISP_HW_CMD_CORE_CONFIG,
+	CAM_ISP_HW_CMD_WM_CONFIG_UPDATE,
+	CAM_ISP_HW_CMD_BW_UPDATE_V2,
+	CAM_ISP_HW_CMD_BLANKING_UPDATE,
+};
+
+struct cam_ife_hw_mgr g_ife_hw_mgr;
+struct cam_ife_hw_mgr_sensor_grp_cfg  g_ife_sns_grp_cfg;
+static uint32_t g_num_ife_available, g_num_ife_lite_available, g_num_sfe_available;
+static uint32_t g_num_ife_functional, g_num_ife_lite_functional, g_num_sfe_functional;
+static uint32_t max_sfe_out_res;
+static char irq_inject_display_buf[IRQ_INJECT_DISPLAY_BUF_LEN];
+uint32_t max_ife_out_res;
+
+static int cam_ife_mgr_find_core_idx(int split_id, struct cam_ife_hw_mgr_ctx *ctx,
+	enum cam_isp_hw_type hw_type, uint32_t *core_idx);
+
+static int cam_isp_blob_ife_clock_update(
+	struct cam_isp_clock_config           *clock_config,
+	struct cam_ife_hw_mgr_ctx             *ctx);
+
+static int cam_isp_blob_sfe_clock_update(
+	struct cam_isp_clock_config           *clock_config,
+	struct cam_ife_hw_mgr_ctx             *ctx);
+
+static int cam_ife_hw_mgr_event_handler_offline(
+	void                                *priv,
+	uint32_t                             evt_id,
+	void                                *evt_info);
+
+static int cam_ife_mgr_prog_default_settings(
+	bool is_streamon, struct cam_ife_hw_mgr_ctx *ctx);
+
+static int cam_ife_mgr_cmd_get_sof_timestamp(struct cam_ife_hw_mgr_ctx *ife_ctx,
+	uint64_t *time_stamp, uint64_t *boot_time_stamp, uint64_t *prev_time_stamp,
+	struct timespec64 *boot_ts, bool get_curr_timestamp);
+
+static int cam_ife_mgr_get_src_hw_ctxt_from_csid_path(uint32_t path_id)
+{
+	switch (path_id) {
+	case CAM_ISP_PXL_PATH:
+		return CAM_ISP_MULTI_CTXT_0;
+	case CAM_ISP_PXL1_PATH:
+		return CAM_ISP_MULTI_CTXT_1;
+	case CAM_ISP_PXL2_PATH:
+		return CAM_ISP_MULTI_CTXT_2;
+	default:
+		return -1;
+	}
+}
+
+static void *cam_ife_hw_mgr_get_hw_intf(
+	struct cam_isp_ctx_base_info *base)
+{
+	if (base->hw_type == CAM_ISP_HW_TYPE_CSID)
+		return g_ife_hw_mgr.csid_devices[base->idx];
+	else if (base->hw_type == CAM_ISP_HW_TYPE_SFE)
+		return g_ife_hw_mgr.sfe_devices[base->idx]->hw_intf;
+	else if (base->hw_type == CAM_ISP_HW_TYPE_VFE)
+		return g_ife_hw_mgr.ife_devices[base->idx]->hw_intf;
+	else
+		return NULL;
+}
+
+static int cam_ife_mgr_update_core_info_to_cpas(struct cam_ife_hw_mgr_ctx           *ctx,
+	bool set_port)
+{
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	int i, sfe_core_idx, csid_core_idx, rc = 0;
+	struct cam_ife_hw_concrete_ctx  *c_ctx = ctx->concr_ctx;
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rc = cam_ife_mgr_find_core_idx(i, ctx, CAM_ISP_HW_TYPE_CSID,
+				&csid_core_idx);
+			if (rc)
+				return rc;
+
+			rc = cam_ife_mgr_find_core_idx(i, ctx, CAM_ISP_HW_TYPE_SFE, &sfe_core_idx);
+			if (rc)
+				return rc;
+
+			rc = cam_cpas_csid_input_core_info_update(csid_core_idx, sfe_core_idx,
+				set_port);
+			if (rc) {
+				CAM_ERR(CAM_PERF,
+					"Failed to update core info to cpas rc:%d,ctx:%u",
+					rc, c_ctx->ctx_index);
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_drv_config(struct cam_ife_hw_mgr_ctx         *ctx,
+	uint64_t request_id, struct cam_isp_prepare_hw_update_data *prepare_hw_data)
+{
+	struct cam_ife_hw_mgr                  *ife_hw_mgr;
+	struct cam_ife_hw_concrete_ctx         *c_ctx = ctx->concr_ctx;
+	struct cam_hw_intf                     *hw_intf;
+	struct cam_isp_drv_config              *drv_config;
+	struct cam_ife_csid_drv_config_args     drv_config_args = {0};
+	int i, rc = 0;
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+	drv_config = &prepare_hw_data->isp_drv_config;
+
+	if (debug_drv)
+		CAM_INFO(CAM_PERF,
+			"DRV config blob opcode:%u req_id:%llu disable_drv_override:%s ctx_idx:%u drv_en:%s path_idle_en:0x%x timeout_val:%u",
+			prepare_hw_data->packet_opcode_type, request_id,
+			CAM_BOOL_TO_YESNO(g_ife_hw_mgr.debug_cfg.disable_isp_drv),
+			c_ctx->ctx_index, CAM_BOOL_TO_YESNO(drv_config->drv_en),
+			drv_config->path_idle_en, drv_config->timeout_val);
+
+	CAM_DBG(CAM_PERF,
+		"DRV config blob opcode:%u req_id:%llu disable_drv_override:%s ctx_idx:%u drv_en:%u path_idle_en:0x%x timeout_val:%u",
+		prepare_hw_data->packet_opcode_type, request_id,
+		CAM_BOOL_TO_YESNO(g_ife_hw_mgr.debug_cfg.disable_isp_drv),
+		c_ctx->ctx_index, drv_config->drv_en, drv_config->path_idle_en,
+		drv_config->timeout_val);
+
+	if (!g_ife_hw_mgr.cam_ddr_drv_support || g_ife_hw_mgr.debug_cfg.disable_isp_drv)
+		return rc;
+
+	if (prepare_hw_data->packet_opcode_type == CAM_ISP_PACKET_INIT_DEV)
+		drv_config_args.is_init_config = true;
+
+	drv_config_args.drv_en = drv_config->drv_en;
+	drv_config_args.path_idle_en = drv_config->path_idle_en;
+	drv_config_args.timeout_val = drv_config->timeout_val;
+
+	if (drv_config->drv_en)
+		c_ctx->drv_path_idle_en = drv_config->path_idle_en;
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].hw_type != CAM_ISP_HW_TYPE_CSID)
+			continue;
+
+		hw_intf = ife_hw_mgr->csid_devices[c_ctx->base[i].idx];
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_DRV_CONFIG, &drv_config_args,
+				sizeof(struct cam_ife_csid_drv_config_args));
+			if (rc) {
+				CAM_ERR(CAM_PERF,
+					"DRV config failed req_id:%d i:%d hw_idx=%d rc:%d ctx_idx: %u",
+					request_id, i, c_ctx->base[i].idx, rc, c_ctx->ctx_index);
+				break;
+			}
+		}
+	}
+
+	return rc;
+}
+
+bool cam_isp_is_ctx_primary_rdi(struct cam_ife_hw_mgr_ctx  *ctx)
+{
+	struct cam_ife_hw_concrete_ctx  *c_ctx = ctx->concr_ctx;
+
+	/* check for RDI only and RDI PD context*/
+	if (c_ctx->flags.is_rdi_only_context || c_ctx->flags.rdi_pd_context)
+		return true;
+
+	return false;
+}
+
+int cam_ife_mgr_finish_clk_bw_update(
+	struct cam_ife_hw_mgr_ctx *ctx,
+	uint64_t request_id, bool skip_clk_data_rst)
+{
+	int i, rc = 0;
+	struct cam_ife_hw_concrete_ctx  *c_ctx = ctx->concr_ctx;
+	struct cam_isp_apply_clk_bw_args clk_bw_args;
+	bool cesta_idx_updated[CAM_CESTA_MAX_CLIENTS] = {0};
+
+	clk_bw_args.request_id = request_id;
+	clk_bw_args.skip_clk_data_rst = skip_clk_data_rst;
+	clk_bw_args.is_drv_config_en = (bool) (c_ctx->drv_path_idle_en & CAM_ISP_PXL_PATH);
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+		clk_bw_args.hw_intf = NULL;
+		clk_bw_args.clock_updated = false;
+		CAM_DBG(CAM_PERF,
+			"Clock/BW Update for ctx:%u req_id:%u i:%d num_vfe_out:%d num_sfe_out:%d in_rd:%d",
+			c_ctx->ctx_index,request_id, i, c_ctx->num_acq_vfe_out,
+			c_ctx->num_acq_sfe_out, !list_empty(&c_ctx->res_list_ife_in_rd));
+		if ((c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_VFE) &&
+			(c_ctx->num_acq_vfe_out || (!list_empty(&c_ctx->res_list_ife_in_rd))))
+			clk_bw_args.hw_intf = g_ife_hw_mgr.ife_devices[c_ctx->base[i].idx]->hw_intf;
+		else if ((c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_SFE) &&
+			(c_ctx->num_acq_sfe_out || (!list_empty(&c_ctx->res_list_ife_in_rd))))
+			clk_bw_args.hw_intf = g_ife_hw_mgr.sfe_devices[c_ctx->base[i].idx]->hw_intf;
+		else
+			continue;
+
+		CAM_DBG(CAM_PERF,
+			"Apply Clock/BW for ctx:%u req:%d i:%d hw_idx=%d hw_type:%d inline:%s num_vfe_out:%d num_sfe_out:%d in_rd:%d",
+			c_ctx->ctx_index, request_id, i, clk_bw_args.hw_intf->hw_idx,
+			clk_bw_args.hw_intf->hw_type,
+			CAM_BOOL_TO_YESNO(clk_bw_args.is_drv_config_en),
+			c_ctx->num_acq_vfe_out, c_ctx->num_acq_sfe_out,
+			!list_empty(&c_ctx->res_list_ife_in_rd));
+		rc = clk_bw_args.hw_intf->hw_ops.process_cmd(clk_bw_args.hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE, &clk_bw_args,
+			sizeof(struct cam_isp_apply_clk_bw_args));
+		if (rc) {
+			CAM_ERR(CAM_PERF,
+				"Finish Clock/BW Update failed ctx:%u req:%d i:%d hw_id=%d hw_type:%d rc:%d",
+				c_ctx->ctx_index, request_id, i, c_ctx->base[i].idx,
+				c_ctx->base[i].hw_type, rc);
+			break;
+		}
+
+		CAM_DBG(CAM_ISP, "clock_updated=%d, hw_idx=%d",
+			clk_bw_args.clock_updated, clk_bw_args.hw_intf->hw_idx);
+
+		if ((clk_bw_args.clock_updated) &&
+			(clk_bw_args.hw_intf->hw_idx < CAM_CESTA_MAX_CLIENTS))
+			cesta_idx_updated[clk_bw_args.hw_intf->hw_idx] = true;
+	}
+
+	if (g_ife_hw_mgr.cam_clk_drv_support) {
+		CAM_DBG(CAM_ISP, "Channel switch for [0]=%s, [1]=%s, [2]=%s",
+			CAM_BOOL_TO_YESNO(cesta_idx_updated[0]),
+			CAM_BOOL_TO_YESNO(cesta_idx_updated[1]),
+			CAM_BOOL_TO_YESNO(cesta_idx_updated[2]));
+
+		for (i = 0; i < CAM_CESTA_MAX_CLIENTS; i++) {
+			if (!cesta_idx_updated[i])
+				continue;
+
+			rc = cam_soc_util_cesta_channel_switch(i, "ife_hw_mgr_update");
+			if (rc) {
+				CAM_ERR(CAM_CSIPHY,
+					"Failed to apply power states for cesta client:%d rc:%d",
+					i, rc);
+				return rc;
+			}
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Clk, BW update done for Req=%lld, skip_clk_data_rst=%d",
+		request_id, skip_clk_data_rst);
+
+	return rc;
+}
+
+static inline int __cam_ife_mgr_get_hw_soc_info(
+	struct list_head          *res_list,
+	enum cam_isp_hw_split_id   split_id,
+	enum cam_isp_hw_type       hw_type,
+	struct cam_hw_soc_info   **soc_info_ptr)
+{
+	int rc  = -EINVAL;
+	struct cam_hw_soc_info    *soc_info = NULL;
+	struct cam_hw_intf        *hw_intf = NULL;
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	struct cam_isp_hw_mgr_res *hw_mgr_res_temp;
+
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		res_list, list) {
+		if (!hw_mgr_res->hw_res[split_id])
+			continue;
+
+		hw_intf = hw_mgr_res->hw_res[split_id]->hw_intf;
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA, &soc_info,
+				sizeof(void *));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in %d regspace data query res_id: %u split idx: %d rc : %d",
+					hw_type, hw_mgr_res->res_id, split_id, rc);
+				return rc;
+			}
+
+			*soc_info_ptr = soc_info;
+			CAM_DBG(CAM_ISP,
+				"Obtained soc info for split %d for hw_type %d",
+				split_id, hw_type);
+			break;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_regspace_data_cb(uint32_t reg_base_type,
+	void *hw_mgr_ctx, struct cam_hw_soc_info **soc_info_ptr,
+	uint32_t *reg_base_idx)
+{
+	int rc = -EINVAL;
+	struct cam_ife_hw_concrete_ctx *c_ctx =
+		((struct cam_ife_hw_mgr_ctx *)hw_mgr_ctx)->concr_ctx;
+
+	*soc_info_ptr = NULL;
+	switch (reg_base_type) {
+	case CAM_REG_DUMP_BASE_TYPE_CAMNOC:
+	case CAM_REG_DUMP_BASE_TYPE_ISP_LEFT:
+		rc = __cam_ife_mgr_get_hw_soc_info(
+			&c_ctx->res_list_ife_src,
+			CAM_ISP_HW_SPLIT_LEFT, CAM_ISP_HW_TYPE_VFE,
+			soc_info_ptr);
+		if (rc)
+			return rc;
+
+		if (reg_base_type == CAM_REG_DUMP_BASE_TYPE_ISP_LEFT)
+			*reg_base_idx = 0;
+		else
+			*reg_base_idx = 1;
+
+		break;
+	case CAM_REG_DUMP_BASE_TYPE_ISP_RIGHT:
+		rc = __cam_ife_mgr_get_hw_soc_info(
+			&c_ctx->res_list_ife_src,
+			CAM_ISP_HW_SPLIT_RIGHT, CAM_ISP_HW_TYPE_VFE,
+			soc_info_ptr);
+		if (rc)
+			return rc;
+
+		*reg_base_idx = 0;
+		break;
+	case CAM_REG_DUMP_BASE_TYPE_CSID_WRAPPER:
+	case CAM_REG_DUMP_BASE_TYPE_CSID_LEFT:
+		rc = __cam_ife_mgr_get_hw_soc_info(
+			&c_ctx->res_list_ife_csid,
+			CAM_ISP_HW_SPLIT_LEFT, CAM_ISP_HW_TYPE_CSID,
+			soc_info_ptr);
+		if (rc)
+			return rc;
+
+		if (reg_base_type == CAM_REG_DUMP_BASE_TYPE_CSID_LEFT)
+			*reg_base_idx = 0;
+		else
+			*reg_base_idx = 1;
+
+		break;
+	case CAM_REG_DUMP_BASE_TYPE_CSID_RIGHT:
+		rc = __cam_ife_mgr_get_hw_soc_info(
+			&c_ctx->res_list_ife_csid,
+			CAM_ISP_HW_SPLIT_RIGHT, CAM_ISP_HW_TYPE_CSID,
+			soc_info_ptr);
+		if (rc)
+			return rc;
+
+		*reg_base_idx = 0;
+		break;
+	case CAM_REG_DUMP_BASE_TYPE_SFE_LEFT:
+		rc = __cam_ife_mgr_get_hw_soc_info(
+			&c_ctx->res_list_sfe_src,
+			CAM_ISP_HW_SPLIT_LEFT, CAM_ISP_HW_TYPE_SFE,
+			soc_info_ptr);
+		if (rc)
+			return rc;
+
+		*reg_base_idx = 0;
+		break;
+	case CAM_REG_DUMP_BASE_TYPE_SFE_RIGHT:
+		rc = __cam_ife_mgr_get_hw_soc_info(
+			&c_ctx->res_list_sfe_src,
+			CAM_ISP_HW_SPLIT_RIGHT, CAM_ISP_HW_TYPE_SFE,
+			soc_info_ptr);
+		if (rc)
+			return rc;
+
+		*reg_base_idx = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"Unrecognized reg base type: %u, ctx_idx: %u",
+			reg_base_type, c_ctx->ctx_index);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_handle_reg_dump(struct cam_ife_hw_mgr_ctx *ctx,
+	struct cam_cmd_buf_desc *reg_dump_buf_desc, uint32_t num_reg_dump_buf,
+	uint32_t meta_type,
+	void *soc_dump_args,
+	bool user_triggered_dump)
+{
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	int rc = 0, i;
+
+	if (!c_ctx->flags.init_done) {
+		CAM_WARN(CAM_ISP, "Cannot dump register as HW not initialized, ctx_idx: %u",
+			c_ctx->ctx_index);
+		return 0;
+	}
+
+	if (cam_presil_mode_enabled()) {
+		if (g_ife_hw_mgr.debug_cfg.enable_presil_reg_dump) {
+			CAM_WARN(CAM_ISP, "regdump enabled for presil mode, ctx_idx: %u",
+				c_ctx->ctx_index);
+		} else {
+			CAM_ERR(CAM_ISP, "regdump disabled by default for presil mode, ctx: %u",
+				c_ctx->ctx_index);
+			return 0;
+		}
+	}
+
+	if (!num_reg_dump_buf || !reg_dump_buf_desc) {
+		CAM_DBG(CAM_ISP,
+			"Invalid args for reg dump req_id: [%llu] ctx idx: [%u] meta_type: [%u] num_reg_dump_buf: [%u] reg_dump_buf_desc: [%pK]",
+			c_ctx->applied_req_id, c_ctx->ctx_index, meta_type,
+			num_reg_dump_buf, reg_dump_buf_desc);
+		return rc;
+	}
+
+	if (!atomic_read(&c_ctx->cdm_done))
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Reg dump values might be from more than one request, ctx_idx: %u",
+			c_ctx->ctx_index);
+
+	for (i = 0; i < num_reg_dump_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&reg_dump_buf_desc[i]);
+		if (rc)
+			return rc;
+
+		CAM_DBG(CAM_ISP, "Reg dump cmd meta data: %u req_type: %u ctx_idx: %u",
+			reg_dump_buf_desc[i].meta_data, meta_type, c_ctx->ctx_index);
+		if (reg_dump_buf_desc[i].meta_data == meta_type) {
+			rc = cam_soc_util_reg_dump_to_cmd_buf(ctx,
+				&reg_dump_buf_desc[i],
+				c_ctx->applied_req_id,
+				cam_ife_mgr_regspace_data_cb,
+				soc_dump_args,
+				user_triggered_dump);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Reg dump failed at idx: %d, rc: %d req_id: %llu meta type: %u ctx_idx: %u",
+					i, rc, c_ctx->applied_req_id, meta_type, c_ctx->ctx_index);
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static inline void cam_ife_mgr_update_hw_entries_util(
+	enum cam_isp_cdm_bl_type               cdm_bl_type,
+	uint32_t                               total_used_bytes,
+	struct cam_kmd_buf_info               *kmd_buf_info,
+	struct cam_hw_prepare_update_args     *prepare,
+	bool                                   precheck_combine)
+{
+	bool combine;
+	uint32_t num_ent;
+	struct cam_hw_update_entry *prev_hw_update_entry;
+
+	/*
+	 * Combine with prev entry only when a new entry was created
+	 * by previus handler and this entry has the same bl type
+	 * as the previous entry, if not, a new entry will be generated
+	 * later
+	 */
+	combine = precheck_combine;
+	if (combine) {
+		num_ent = prepare->num_hw_update_entries;
+		prev_hw_update_entry = &(prepare->hw_update_entries[num_ent - 1]);
+		if (prev_hw_update_entry->flags != cdm_bl_type)
+			combine = false;
+	}
+	cam_isp_update_hw_entry(cdm_bl_type, prepare,
+		kmd_buf_info, total_used_bytes, combine);
+}
+
+static inline int cam_ife_mgr_allocate_cdm_cmd(
+	bool is_sfe_en,
+	struct cam_cdm_bl_request **cdm_cmd)
+{
+	int rc = 0;
+	uint32_t cfg_max = CAM_ISP_CTX_CFG_MAX;
+
+	if (is_sfe_en)
+		cfg_max = CAM_ISP_SFE_CTX_CFG_MAX;
+
+	*cdm_cmd = kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+		((cfg_max - 1) *
+		sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+
+	if (!(*cdm_cmd)) {
+		CAM_ERR(CAM_ISP, "Failed to allocate cdm bl memory");
+		rc = -ENOMEM;
+	}
+
+	return rc;
+}
+
+static inline void cam_ife_mgr_free_cdm_cmd(
+	struct cam_cdm_bl_request **cdm_cmd)
+{
+	kfree(*cdm_cmd);
+	*cdm_cmd = NULL;
+}
+
+static int cam_ife_mgr_get_hw_caps(void *hw_mgr_priv, void *hw_caps_args)
+{
+	int rc = 0;
+	int i;
+	struct cam_ife_hw_mgr             *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd          *query = hw_caps_args;
+	struct cam_isp_query_cap_cmd       query_isp;
+	struct cam_isp_dev_cap_info       *ife_full_hw_info = NULL;
+	struct cam_isp_dev_cap_info       *ife_lite_hw_info = NULL;
+	struct cam_isp_dev_cap_info       *csid_full_hw_info = NULL;
+	struct cam_isp_dev_cap_info       *csid_lite_hw_info = NULL;
+	struct cam_ife_csid_hw_caps       *ife_csid_caps = {0};
+
+	CAM_DBG(CAM_ISP, "enter");
+
+	if (sizeof(struct cam_isp_query_cap_cmd) != query->size) {
+		CAM_ERR(CAM_ISP,
+			"Input query cap size:%u does not match expected query cap size: %u",
+			query->size, sizeof(struct cam_isp_query_cap_cmd));
+		return -EFAULT;
+	}
+
+	if (copy_from_user(&query_isp,
+		u64_to_user_ptr(query->caps_handle),
+		sizeof(struct cam_isp_query_cap_cmd))) {
+		rc = -EFAULT;
+		return rc;
+	}
+
+	query_isp.device_iommu.non_secure = hw_mgr->mgr_common.img_iommu_hdl;
+	query_isp.device_iommu.secure = hw_mgr->mgr_common.img_iommu_hdl_secure;
+	query_isp.cdm_iommu.non_secure = hw_mgr->mgr_common.cmd_iommu_hdl;
+	query_isp.cdm_iommu.secure = hw_mgr->mgr_common.cmd_iommu_hdl_secure;
+	query_isp.num_dev = 0;
+
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (!hw_mgr->ife_devices[i])
+			continue;
+
+		if (hw_mgr->ife_dev_caps[i].is_lite) {
+			if (ife_lite_hw_info == NULL) {
+				ife_lite_hw_info =
+					&query_isp.dev_caps[query_isp.num_dev];
+				query_isp.num_dev++;
+
+				ife_lite_hw_info->hw_type = CAM_ISP_HW_IFE_LITE;
+				ife_lite_hw_info->hw_version.major =
+					hw_mgr->ife_dev_caps[i].major;
+				ife_lite_hw_info->hw_version.minor =
+					hw_mgr->ife_dev_caps[i].minor;
+				ife_lite_hw_info->hw_version.incr =
+					hw_mgr->ife_dev_caps[i].incr;
+				ife_lite_hw_info->hw_version.reserved = 0;
+				ife_lite_hw_info->num_hw = 0;
+			}
+
+			ife_lite_hw_info->num_hw++;
+
+		} else {
+			if (ife_full_hw_info == NULL) {
+				ife_full_hw_info =
+					&query_isp.dev_caps[query_isp.num_dev];
+				query_isp.num_dev++;
+
+				ife_full_hw_info->hw_type = (hw_mgr->isp_device_type
+					== CAM_TFE_MC_DEVICE_TYPE) ?
+					CAM_ISP_HW_MC_TFE : CAM_ISP_HW_IFE;
+				ife_full_hw_info->hw_version.major =
+					hw_mgr->ife_dev_caps[i].major;
+				ife_full_hw_info->hw_version.minor =
+					hw_mgr->ife_dev_caps[i].minor;
+				ife_full_hw_info->hw_version.incr =
+					hw_mgr->ife_dev_caps[i].incr;
+				ife_full_hw_info->hw_version.reserved = 0;
+				ife_full_hw_info->num_hw = 0;
+			}
+
+			ife_full_hw_info->num_hw++;
+		}
+	}
+
+	for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		if (!hw_mgr->csid_devices[i])
+			continue;
+
+		ife_csid_caps = (struct cam_ife_csid_hw_caps *)
+			&hw_mgr->csid_hw_caps[i];
+
+		if (ife_csid_caps->is_lite) {
+			if (csid_lite_hw_info == NULL) {
+				csid_lite_hw_info =
+					&query_isp.dev_caps[query_isp.num_dev];
+				query_isp.num_dev++;
+
+				csid_lite_hw_info->hw_type =
+					CAM_ISP_HW_CSID_LITE;
+				csid_lite_hw_info->hw_version.major =
+					ife_csid_caps->major_version;
+				csid_lite_hw_info->hw_version.minor =
+					ife_csid_caps->minor_version;
+				csid_lite_hw_info->hw_version.incr =
+					ife_csid_caps->version_incr;
+				csid_lite_hw_info->hw_version.reserved = 0;
+				csid_lite_hw_info->num_hw = 0;
+			}
+
+			csid_lite_hw_info->num_hw++;
+
+		} else {
+			if (csid_full_hw_info == NULL) {
+				csid_full_hw_info =
+					&query_isp.dev_caps[query_isp.num_dev];
+				query_isp.num_dev++;
+
+				csid_full_hw_info->hw_type = CAM_ISP_HW_CSID;
+				csid_full_hw_info->hw_version.major =
+					ife_csid_caps->major_version;
+				csid_full_hw_info->hw_version.minor =
+					ife_csid_caps->minor_version;
+				csid_full_hw_info->hw_version.incr =
+					ife_csid_caps->version_incr;
+				csid_full_hw_info->hw_version.reserved = 0;
+				csid_full_hw_info->num_hw = 0;
+			}
+
+			csid_full_hw_info->num_hw++;
+		}
+	}
+
+	if (copy_to_user(u64_to_user_ptr(query->caps_handle),
+		&query_isp, sizeof(struct cam_isp_query_cap_cmd)))
+		rc = -EFAULT;
+
+	CAM_DBG(CAM_ISP, "exit rc :%d", rc);
+
+	return rc;
+}
+
+static inline int cam_ife_hw_mgr_is_sfe_rdi_for_fetch(
+	uint32_t res_id)
+{
+	int rc = 0;
+
+	switch (res_id) {
+	case CAM_ISP_SFE_OUT_RES_RDI_0:
+	case CAM_ISP_SFE_OUT_RES_RDI_1:
+	case CAM_ISP_SFE_OUT_RES_RDI_2:
+		rc = 1;
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static inline int cam_ife_hw_mgr_is_shdr_fs_rdi_res(
+	uint32_t res_id, bool is_sfe_shdr, bool is_sfe_fs)
+{
+	return (cam_ife_hw_mgr_is_sfe_rdi_for_fetch(res_id) &&
+		(is_sfe_shdr || is_sfe_fs));
+}
+
+static int cam_ife_hw_mgr_is_sfe_rdi_res(uint32_t res_id)
+{
+	int rc = 0;
+
+	switch (res_id) {
+	case CAM_ISP_SFE_OUT_RES_RDI_0:
+	case CAM_ISP_SFE_OUT_RES_RDI_1:
+	case CAM_ISP_SFE_OUT_RES_RDI_2:
+	case CAM_ISP_SFE_OUT_RES_RDI_3:
+	case CAM_ISP_SFE_OUT_RES_RDI_4:
+		rc = 1;
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+int cam_ife_hw_mgr_is_rdi_res(uint32_t res_id)
+{
+	int rc = 0;
+
+	switch (res_id) {
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+	case CAM_ISP_IFE_OUT_RES_RDI_4:
+	case CAM_ISP_IFE_OUT_RES_RDI_5:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI0:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI1:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI2:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI3:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI4:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI5:
+		rc = 1;
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+bool cam_ife_hw_mgr_is_ife_out_port(uint32_t res_id)
+{
+	bool is_ife_out = false;
+
+	if ((res_id >= CAM_ISP_IFE_OUT_RES_BASE) &&
+		(res_id < (CAM_ISP_IFE_OUT_RES_BASE +
+		max_ife_out_res)))
+		is_ife_out = true;
+
+	return is_ife_out;
+}
+
+static inline bool cam_ife_hw_mgr_is_sfe_out_port(uint32_t res_id)
+{
+	bool is_sfe_out = false;
+
+	if ((res_id >= CAM_ISP_SFE_OUT_RES_BASE) &&
+		(res_id < (CAM_ISP_SFE_OUT_RES_BASE +
+		max_sfe_out_res)))
+		is_sfe_out = true;
+
+	return is_sfe_out;
+}
+
+static int cam_ife_hw_mgr_check_and_notify_overflow(
+	struct cam_isp_hw_event_info    *evt,
+	void                            *ctx,
+	bool                            *is_bus_overflow)
+{
+	int                             i;
+	int                             res_id;
+	int                             ife_res_id = -1;
+	int                             sfe_res_id = -1;
+	struct cam_hw_intf             *hw_if = NULL;
+	struct cam_ife_hw_mgr_ctx      *hw_mgr_ctx = ctx;
+	struct cam_isp_hw_overflow_info overflow_info;
+	struct cam_ife_hw_concrete_ctx *c_ctx = hw_mgr_ctx->concr_ctx;
+
+	switch(evt->res_id) {
+	case  CAM_IFE_PIX_PATH_RES_IPP:
+		ife_res_id = CAM_ISP_HW_VFE_IN_CAMIF;
+		sfe_res_id = CAM_ISP_HW_SFE_IN_PIX;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+		ife_res_id = CAM_ISP_HW_VFE_IN_RDI0;
+		sfe_res_id = CAM_ISP_HW_SFE_IN_RDI0;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+		ife_res_id = CAM_ISP_HW_VFE_IN_RDI1;
+		sfe_res_id = CAM_ISP_HW_SFE_IN_RDI1;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+		ife_res_id = CAM_ISP_HW_VFE_IN_RDI2;
+		sfe_res_id = CAM_ISP_HW_SFE_IN_RDI2;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+		ife_res_id = CAM_ISP_HW_VFE_IN_RDI3;
+		sfe_res_id = CAM_ISP_HW_SFE_IN_RDI3;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+		ife_res_id = CAM_ISP_HW_VFE_IN_RDI4;
+		sfe_res_id = CAM_ISP_HW_SFE_IN_RDI4;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_5:
+		ife_res_id = CAM_ISP_HW_VFE_IN_RDI5;
+		break;
+	default:
+		break;
+	}
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+
+		if (c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_VFE) {
+			if (c_ctx->base[i].idx != evt->hw_idx)
+				continue;
+
+			hw_if = g_ife_hw_mgr.ife_devices[evt->hw_idx]->hw_intf;
+			res_id = ife_res_id;
+		} else if (c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_SFE) {
+			if (c_ctx->base[i].idx != evt->in_core_idx)
+			continue;
+
+			hw_if = g_ife_hw_mgr.sfe_devices[evt->in_core_idx]->hw_intf;
+			res_id = sfe_res_id;
+		} else {
+			continue;
+		}
+
+		if (!hw_if) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP, "hw_intf is null, ctx_idx: %u",
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (hw_if->hw_ops.process_cmd) {
+			overflow_info.res_id = res_id;
+			hw_if->hw_ops.process_cmd(hw_if->hw_priv,
+				CAM_ISP_HW_NOTIFY_OVERFLOW,
+				&overflow_info,
+				sizeof(struct cam_isp_hw_overflow_info));
+
+			CAM_DBG(CAM_ISP,
+				"check and notify hw idx %d type %d bus overflow happened %d ctx_idx: %u",
+				c_ctx->base[i].idx,
+				c_ctx->base[i].hw_type,
+				overflow_info.is_bus_overflow, c_ctx->ctx_index);
+
+			if (overflow_info.is_bus_overflow)
+				*is_bus_overflow = true;
+		}
+	}
+
+	return 0;
+}
+
+static enum cam_ife_pix_path_res_id
+	cam_ife_hw_mgr_get_csid_rdi_type_for_offline(
+	uint32_t                 rd_res_type)
+{
+	enum cam_ife_pix_path_res_id path_id;
+
+	/* Allow only RD0 for offline */
+	switch (rd_res_type) {
+	case CAM_ISP_SFE_IN_RD_0:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_0;
+		break;
+	default:
+		path_id = CAM_IFE_PIX_PATH_RES_MAX;
+		CAM_ERR(CAM_ISP,
+			"maximum rdi output type exceeded 0x%x",
+			rd_res_type);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "out_port: %x path_id: %d",
+		rd_res_type, path_id);
+
+	return path_id;
+}
+
+static bool cam_ife_hw_mgr_is_sfe_rd_res(
+	uint32_t sfe_in_path_type)
+{
+	switch (sfe_in_path_type) {
+	case CAM_ISP_SFE_IN_RD_0:
+	case CAM_ISP_SFE_IN_RD_1:
+	case CAM_ISP_SFE_IN_RD_2:
+		return true;
+	default:
+		return false;
+	}
+}
+
+static int cam_ife_hw_mgr_reset_csid(
+	struct cam_ife_hw_mgr_ctx  *ctx,
+	int reset_type)
+{
+	int i;
+	int rc = 0;
+	struct cam_hw_intf             *hw_intf;
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_ife_hw_mgr          *hw_mgr;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	struct cam_csid_reset_cfg_args  reset_args;
+	bool hw_idx_map[CAM_IFE_CSID_HW_NUM_MAX] = {0};
+
+	hw_mgr = c_ctx->hw_mgr;
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+
+			if ((hw_mgr->csid_global_reset_en) &&
+				(hw_idx_map[hw_intf->hw_idx]))
+				continue;
+
+			reset_args.reset_type = reset_type;
+			reset_args.node_res = hw_mgr_res->hw_res[i];
+			rc  = hw_intf->hw_ops.reset(hw_intf->hw_priv,
+				&reset_args, sizeof(reset_args));
+			if (rc)
+				goto err;
+			hw_idx_map[hw_intf->hw_idx] = true;
+		}
+	}
+
+	return rc;
+err:
+	CAM_ERR(CAM_ISP, "RESET HW res failed: (ctx_idx: %u type:%d, id:%d)",
+		c_ctx->ctx_index, hw_mgr_res->res_type, hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_init_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	int rc = -1;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		CAM_DBG(CAM_ISP, "enabled vfe hardware %u",
+			hw_intf->hw_idx);
+		if (hw_intf->hw_ops.init) {
+			rc = hw_intf->hw_ops.init(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc)
+				goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "INIT HW res failed: (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static int cam_ife_mgr_csid_start_hw(
+	struct   cam_ife_hw_mgr_ctx *ctx,
+	uint32_t primary_rdi_csid_res,
+	bool     is_internal_start,
+	bool     start_only)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	struct cam_isp_resource_node   *isp_res;
+	struct cam_isp_resource_node   *res[CAM_IFE_PIX_PATH_RES_MAX - 1];
+	struct cam_isp_resource_node   *primary_rdi_res = NULL;
+	struct cam_csid_hw_start_args   start_args;
+	struct cam_hw_intf             *hw_intf;
+	uint32_t  cnt;
+	int j;
+	bool ipp_available = false, is_secure;
+
+	for (j = c_ctx->num_base - 1 ; j >= 0; j--) {
+
+		cnt = 0;
+		is_secure = false;
+
+		if (c_ctx->base[j].hw_type != CAM_ISP_HW_TYPE_CSID)
+			continue;
+
+		list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+			isp_res = hw_mgr_res->hw_res[c_ctx->base[j].split_id];
+
+			if (!isp_res || c_ctx->base[j].idx != isp_res->hw_intf->hw_idx)
+				continue;
+
+			if ((primary_rdi_csid_res == hw_mgr_res->res_id) ||
+				(c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE &&
+				 isp_res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0))
+				primary_rdi_res = isp_res;
+
+			if (hw_mgr_res->res_id == CAM_IFE_PIX_PATH_RES_IPP)
+				ipp_available = true;
+
+			if (hw_mgr_res->is_secure)
+				is_secure = true;
+
+			CAM_DBG(CAM_ISP,
+				"csid[%u] ctx_idx: %u res:%s res_id %d cnt %u, is_secure: %s",
+				isp_res->hw_intf->hw_idx, c_ctx->ctx_index,
+				isp_res->res_name, isp_res->res_id, cnt,
+				CAM_BOOL_TO_YESNO(is_secure));
+			res[cnt] = isp_res;
+			cnt++;
+		}
+
+		if (!ipp_available && primary_rdi_res)
+			primary_rdi_res->is_rdi_primary_res = true;
+
+		if (cnt) {
+			hw_intf =  res[0]->hw_intf;
+			start_args.num_res = cnt;
+			start_args.node_res = res;
+
+			if (c_ctx->cdm_hw_idx < 0) {
+				CAM_ERR(CAM_ISP,
+					"CSID[%u], physical CDM hw_idx is invalid: %d on ctx: %u",
+					hw_intf->hw_idx, c_ctx->cdm_hw_idx, c_ctx->ctx_index);
+				return -EINVAL;
+			}
+
+			start_args.cdm_hw_idx = c_ctx->cdm_hw_idx;
+			start_args.is_secure = is_secure;
+			start_args.is_internal_start = is_internal_start;
+			start_args.start_only = start_only;
+			start_args.is_drv_config_en = (bool) c_ctx->drv_path_idle_en;
+			hw_intf->hw_ops.start(hw_intf->hw_priv, &start_args,
+			    sizeof(start_args));
+		}
+	}
+
+	return 0;
+}
+
+int cam_ife_hw_mgr_start_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res,
+	struct cam_ife_hw_mgr_ctx   *ctx)
+{
+	int i;
+	int rc = -1;
+	struct cam_hw_intf             *hw_intf;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+
+	/* Start slave (which is right split) first */
+	for (i = CAM_ISP_HW_SPLIT_MAX - 1; i >= 0; i--) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.start) {
+			rc = hw_intf->hw_ops.start(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not start HW:%d resources, ctx_idx: %u",
+					hw_intf->hw_idx, c_ctx->ctx_index);
+				goto err;
+			}
+		} else {
+			CAM_ERR(CAM_ISP, "function null, ctx_idx: %u", c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "Start hw res failed (ctx_idx: %u type:%d, id:%d)",
+		c_ctx->ctx_index, isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+void cam_ife_hw_mgr_stop_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	struct cam_hw_intf      *hw_intf;
+	uint32_t dummy_args;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+
+		if (isp_hw_res->hw_res[i]->res_state !=
+			CAM_ISP_RESOURCE_STATE_STREAMING)
+			continue;
+
+		if (hw_intf->hw_ops.stop) {
+			hw_intf->hw_ops.stop(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+		}
+		else
+			CAM_ERR(CAM_ISP, "stop null");
+		if (hw_intf->hw_ops.process_cmd &&
+			isp_hw_res->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+			hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ,
+				&dummy_args, sizeof(dummy_args));
+		}
+		isp_hw_res->hw_res[i]->is_rdi_primary_res = false;
+	}
+}
+
+static void cam_ife_hw_mgr_deinit_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.deinit)
+			hw_intf->hw_ops.deinit(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+	}
+}
+
+static void cam_ife_hw_mgr_deinit_hw(
+	struct cam_ife_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	struct cam_ife_hw_mgr          *hw_mgr;
+	int i = 0, j, rc;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+
+	if (!c_ctx->flags.init_done) {
+		CAM_WARN(CAM_ISP, "ctx is not in init state, ctx_idx: %u", c_ctx->ctx_index);
+		return;
+	}
+
+	hw_mgr = c_ctx->hw_mgr;
+
+	if (hw_mgr->csid_global_reset_en)
+		cam_ife_hw_mgr_reset_csid(ctx, CAM_IFE_CSID_RESET_GLOBAL);
+
+	/* Deinit IFE CSID */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		CAM_DBG(CAM_ISP, "%s: Going to DeInit IFE CSID\n ctx_idx: %u", __func__,
+			c_ctx->ctx_index);
+		cam_ife_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		/* Deint SFE RSRC */
+		list_for_each_entry(hw_mgr_res, &c_ctx->res_list_sfe_src, list) {
+			CAM_DBG(CAM_ISP, "Going to DeInit SFE SRC %u, ctx_idx: %u",
+				hw_mgr_res->res_id, c_ctx->ctx_index);
+			cam_ife_hw_mgr_deinit_hw_res(hw_mgr_res);
+		}
+
+		/* Deinit SFE OUT */
+		for (i = 0; i < c_ctx->num_acq_sfe_out; i++)
+			cam_ife_hw_mgr_deinit_hw_res(&c_ctx->res_list_sfe_out[i]);
+	}
+
+	/* Deint BUS RD */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_in_rd, list) {
+		CAM_DBG(CAM_ISP, "Going to DeInit BUS RD %u, ctx_idx: %u",
+			hw_mgr_res->res_id, c_ctx->ctx_index);
+		cam_ife_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	/* Deint IFE MUX(SRC) */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		CAM_DBG(CAM_ISP, "Going to DeInit IFE SRC %u, ctx_idx: %u",
+			hw_mgr_res->res_id, c_ctx->ctx_index);
+		cam_ife_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	/* Deinit IFE OUT */
+	for (i = 0; i < c_ctx->num_acq_vfe_out; i++)
+		cam_ife_hw_mgr_deinit_hw_res(&c_ctx->res_list_ife_out[i]);
+
+	/*
+	 * Do not reset the curr_idx, it can be only be changed only it new SCID is reserved
+	 * for a particular exposure. Check if any cache needs to be de-activated
+	 */
+	for (i = CAM_LLCC_SMALL_1; i < CAM_LLCC_MAX; i++) {
+		if (c_ctx->flags.sys_cache_usage[i]) {
+			if (cam_cpas_is_notif_staling_supported() &&
+				hw_mgr->sys_cache_info[i].llcc_staling_support) {
+				rc = cam_cpas_notif_increment_staling_counter(i);
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"llcc cache notif increment staling failed %d", i);
+			}
+			cam_cpas_deactivate_llcc(i);
+		}
+		c_ctx->flags.sys_cache_usage[i] = false;
+	}
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_SFE)
+			for (j = 0; j < CAM_ISP_EXPOSURE_MAX; j++)
+				hw_mgr->sfe_cache_info[c_ctx->base[i].idx].activated[j] = false;
+	}
+
+	c_ctx->flags.init_done = false;
+}
+
+static int cam_ife_hw_mgr_init_hw(
+	struct cam_ife_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	int rc = 0, i;
+
+	/* INIT IFE SRC */
+	CAM_DBG(CAM_ISP, "INIT IFE SRC in ctx id:%u",
+		c_ctx->ctx_index);
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		rc = cam_ife_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT IFE SRC (%d), ctx_idx:%u",
+				 hw_mgr_res->res_id, c_ctx->ctx_index);
+			goto deinit;
+		}
+	}
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		/* INIT SFE RSRC */
+		CAM_DBG(CAM_ISP, "INIT SFE Resource in ctx id:%d",
+			c_ctx->ctx_index);
+		list_for_each_entry(hw_mgr_res, &c_ctx->res_list_sfe_src, list) {
+			rc = cam_ife_hw_mgr_init_hw_res(hw_mgr_res);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not INIT SFE SRC res (%d), ctx_idx:%u",
+					hw_mgr_res->res_id, c_ctx->ctx_index);
+				goto deinit;
+			}
+		}
+
+		CAM_DBG(CAM_ISP, "INIT SFE OUT RESOURCES in ctx id:%u",
+			c_ctx->ctx_index);
+		for (i = 0; i < c_ctx->num_acq_sfe_out; i++) {
+			rc = cam_ife_hw_mgr_init_hw_res(
+				&c_ctx->res_list_sfe_out[i]);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Can not INIT SFE OUT (%d), ctx_idx:%u",
+					c_ctx->res_list_sfe_out[i].res_id, c_ctx->ctx_index);
+				goto deinit;
+			}
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "INIT IFE csid ... in ctx id:%u",
+	c_ctx->ctx_index);
+
+	/* INIT IFE BUS RD */
+	CAM_DBG(CAM_ISP, "INIT IFE BUS RD in ctx id:%u",
+		c_ctx->ctx_index);
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_in_rd, list) {
+		rc = cam_ife_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not IFE BUS RD (%d), ctx_idx:%u",
+				 hw_mgr_res->res_id, c_ctx->ctx_index);
+			return rc;
+		}
+	}
+
+	/* INIT IFE OUT */
+	CAM_DBG(CAM_ISP, "INIT IFE OUT RESOURCES in ctx id:%u num_acq_vfe_out :%d",
+		c_ctx->ctx_index, c_ctx->num_acq_vfe_out);
+
+	for (i = 0; i < c_ctx->num_acq_vfe_out; i++) {
+		rc = cam_ife_hw_mgr_init_hw_res(&c_ctx->res_list_ife_out[i]);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT IFE OUT (%d), ctx_idx:%u",
+				c_ctx->res_list_ife_out[i].res_id, c_ctx->ctx_index);
+			goto deinit;
+		}
+	}
+
+	/* INIT IFE csid */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		rc = cam_ife_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT IFE CSID(id :%d), ctx_idx:%u",
+				 hw_mgr_res->res_id, c_ctx->ctx_index);
+			goto deinit;
+		}
+	}
+
+	/* Check if any cache needs to be activated */
+	for (i = CAM_LLCC_SMALL_1; i < CAM_LLCC_MAX; i++) {
+		if (c_ctx->flags.sys_cache_usage[i]) {
+			rc = cam_cpas_activate_llcc(i);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+				"Failed to activate cache: %d, ctx_idx:%u", i, c_ctx->ctx_index);
+				goto deinit;
+			}
+		}
+	}
+
+	return rc;
+deinit:
+	c_ctx->flags.init_done = true;
+	cam_ife_hw_mgr_deinit_hw(ctx);
+	return rc;
+}
+
+int cam_ife_hw_mgr_put_res(
+	struct list_head                *src_list,
+	struct cam_isp_hw_mgr_res      **res)
+{
+	int rc                              = 0;
+	struct cam_isp_hw_mgr_res *res_ptr  = NULL;
+
+	res_ptr = *res;
+	if (res_ptr)
+		list_add_tail(&res_ptr->list, src_list);
+
+	return rc;
+}
+
+int cam_ife_hw_mgr_get_res(
+	struct list_head                *src_list,
+	struct cam_isp_hw_mgr_res      **res)
+{
+	int rc = 0;
+	struct cam_isp_hw_mgr_res *res_ptr  = NULL;
+
+	if (!list_empty(src_list)) {
+		res_ptr = list_first_entry(src_list,
+			struct cam_isp_hw_mgr_res, list);
+		list_del_init(&res_ptr->list);
+	} else {
+		CAM_ERR(CAM_ISP, "No more free ife hw mgr ctx");
+		rc = -1;
+	}
+	*res = res_ptr;
+
+	return rc;
+}
+
+int cam_ife_hw_mgr_free_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res, bool del_list)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.release) {
+			rc = hw_intf->hw_ops.release(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Release HW:%d Res: %s resource id %d failed",
+					hw_intf->hw_idx,
+					isp_hw_res->hw_res[i]->res_name,
+					isp_hw_res->res_id);
+			isp_hw_res->hw_res[i] = NULL;
+		} else
+			CAM_ERR(CAM_ISP, "Release null");
+	}
+	/* caller should make sure the resource is in a list */
+	if (del_list) {
+		list_del_init(&isp_hw_res->list);
+		memset(isp_hw_res, 0, sizeof(*isp_hw_res));
+		INIT_LIST_HEAD(&isp_hw_res->list);
+	} else {
+		memset(isp_hw_res, 0, sizeof(*isp_hw_res));
+	}
+
+	return 0;
+}
+
+static const char *cam_ife_hw_mgr_get_res_state(
+	uint32_t res_state)
+{
+	switch (res_state) {
+	case CAM_ISP_RESOURCE_STATE_UNAVAILABLE:
+		return "UNAVAILABLE";
+	case CAM_ISP_RESOURCE_STATE_AVAILABLE:
+		return "AVAILABLE";
+	case CAM_ISP_RESOURCE_STATE_RESERVED:
+		return "RESERVED";
+	case CAM_ISP_RESOURCE_STATE_INIT_HW:
+		return "HW INIT DONE";
+	case CAM_ISP_RESOURCE_STATE_STREAMING:
+		return "STREAMING";
+	default:
+		return "INVALID STATE";
+	}
+}
+
+bool cam_ife_hw_mgr_check_path_port_compat(
+	uint32_t in_type, uint32_t out_type)
+{
+	int i;
+	const struct cam_isp_hw_path_port_map *map = &g_ife_hw_mgr.path_port_map;
+
+	for (i = 0; i < map->num_entries; i++) {
+		if (map->entry[i][1] == out_type)
+			return (map->entry[i][0] == in_type);
+	}
+
+	return (in_type == CAM_ISP_HW_VFE_IN_CAMIF);
+}
+
+static void cam_ife_hw_mgr_dump_acquire_resources(
+	struct cam_ife_hw_mgr_ctx    *hwr_mgr_ctx)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res = NULL;
+	struct cam_isp_hw_mgr_res      *hw_mgr_res_temp = NULL;
+	struct cam_isp_resource_node   *hw_res = NULL;
+	struct cam_ife_hw_concrete_ctx *c_ctx = hwr_mgr_ctx->concr_ctx;
+	uint64_t ms, hrs, min, sec;
+	int i = 0, j = 0;
+
+	CAM_CONVERT_TIMESTAMP_FORMAT(c_ctx->ts, hrs, min, sec, ms);
+
+	CAM_INFO(CAM_ISP,
+		"**** %llu:%llu:%llu.%llu ctx_idx: %u rdi_only: %s is_dual: %s acquired ****",
+		hrs, min, sec, ms,
+		c_ctx->ctx_index,
+		(c_ctx->flags.is_rdi_only_context ? "true" : "false"),
+		(c_ctx->flags.is_dual ? "true" : "false"));
+
+	/* Iterate over CSID resources */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"CSID split_id:%d ctx_idx:%u hw_idx:%u res:%s type:%d res_id:%d state:%s",
+					i, c_ctx->ctx_index,
+					hw_res->hw_intf->hw_idx,
+					hw_res->res_name,
+					hw_res->res_type,
+					hw_res->res_id,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+
+	/* Iterate over IFE IN resources */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"IFE src split_id:%d ctx_idx:%u hw_idx:%u res:%s type:%d res_id:%d state:%s",
+					i, c_ctx->ctx_index,
+					hw_res->hw_intf->hw_idx,
+					hw_res->res_name,
+					hw_res->res_type,
+					hw_res->res_id,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+
+	/* Iterate over SFE IN resources */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&c_ctx->res_list_sfe_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"SFE src split_id:%d ctx_idx:%u hw_idx:%u res:%s type:%d res_id:%d state:%s",
+					i, c_ctx->ctx_index,
+					hw_res->hw_intf->hw_idx,
+					hw_res->res_name,
+					hw_res->res_type,
+					hw_res->res_id,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+
+	/* Iterate over IFE/SFE RD resources */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&c_ctx->res_list_ife_in_rd, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"src_rd split_id:%d ctx_idx:%u hw_idx:%u res:%s type:%d res_id:%d state:%s",
+					i, c_ctx->ctx_index,
+					hw_res->hw_intf->hw_idx,
+					hw_res->res_name,
+					hw_res->res_type,
+					hw_res->res_id,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+
+	/* Iterate over IFE OUT resources */
+	for (i = 0; i < c_ctx->num_acq_vfe_out; i++) {
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			hw_mgr_res = &c_ctx->res_list_ife_out[i];
+			hw_res = hw_mgr_res->hw_res[j];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"IFE out split_id:%d ctx_idx:%u hw_idx:%u res:%s type:%d res_id:%d state:%s",
+					j, c_ctx->ctx_index,
+					hw_res->hw_intf->hw_idx,
+					hw_res->res_name,
+					hw_res->res_type,
+					hw_res->res_id,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+
+	/* Iterate over SFE OUT resources */
+	for (i = 0; i < c_ctx->num_acq_sfe_out; i++) {
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			hw_mgr_res = &c_ctx->res_list_sfe_out[i];
+			hw_res = hw_mgr_res->hw_res[j];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"SFE out split_id:%d ctx_idx:%u hw_idx:%u res:%s type:%d res_id:%d state:%s",
+					j, c_ctx->ctx_index,
+					hw_res->hw_intf->hw_idx,
+					hw_res->res_name,
+					hw_res->res_type,
+					hw_res->res_id,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+}
+
+static void cam_ife_hw_mgr_dump_acq_rsrc_for_all_ctx(
+		struct cam_ife_hw_mgr_ctx *hw_mgr_ctx)
+{
+	struct cam_ife_hw_concrete_ctx  *c_ctx;
+	struct cam_ife_hw_concrete_ctx  *ctx_temp;
+
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	if (list_empty(&g_ife_hw_mgr.used_ctx_list)) {
+		CAM_INFO(CAM_ISP, "Currently no ctx in use");
+		mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+		return;
+	}
+
+	list_for_each_entry_safe(c_ctx, ctx_temp,
+		&g_ife_hw_mgr.used_ctx_list, list) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"ctx id:%u is_dual:%d num_base:%d rdi only:%d",
+			c_ctx->ctx_index, c_ctx->flags.is_dual,
+			c_ctx->num_base, c_ctx->flags.is_rdi_only_context);
+
+		cam_ife_hw_mgr_dump_acquire_resources(hw_mgr_ctx);
+	}
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+}
+
+static void cam_ife_hw_mgr_print_acquire_info(
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx, uint32_t num_pix_port,
+	uint32_t num_pd_port, uint32_t num_rdi_port, int acquire_failed)
+{
+	struct cam_ife_hw_concrete_ctx *c_ctx = hw_mgr_ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res      *hw_mgr_res = NULL;
+	struct cam_isp_resource_node   *hw_res = NULL;
+	char log_info[128];
+	int hw_idx[CAM_ISP_HW_SPLIT_MAX] = {-1, -1};
+	int sfe_hw_idx[CAM_ISP_HW_SPLIT_MAX] = {-1, -1};
+	int i, len = 0;
+	uint64_t ms, sec, min, hrs;
+
+	if (!list_empty(&c_ctx->res_list_ife_src)) {
+		hw_mgr_res = list_first_entry(&c_ctx->res_list_ife_src,
+			struct cam_isp_hw_mgr_res, list);
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				hw_idx[i] = hw_res->hw_intf->hw_idx;
+		}
+	}
+
+	if (!list_empty(&c_ctx->res_list_sfe_src)) {
+		hw_mgr_res = list_first_entry(&c_ctx->res_list_sfe_src,
+			struct cam_isp_hw_mgr_res, list);
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				sfe_hw_idx[i] = hw_res->hw_intf->hw_idx;
+		}
+	}
+
+	if (acquire_failed)
+		goto fail;
+
+	/* 128 char in log_info */
+	if (c_ctx->flags.is_dual) {
+		len += scnprintf(log_info + len, (128 - len), "Dual IFE[%d: %d]",
+			hw_idx[CAM_ISP_HW_SPLIT_LEFT],
+			hw_idx[CAM_ISP_HW_SPLIT_RIGHT]);
+		if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE)
+			len += scnprintf(log_info + len, (128 - len), " SFE[%d: %d]",
+				sfe_hw_idx[CAM_ISP_HW_SPLIT_LEFT],
+				sfe_hw_idx[CAM_ISP_HW_SPLIT_RIGHT]);
+	} else {
+		len += scnprintf(log_info + len, (128 - len), "Single IFE[%d]",
+			hw_idx[CAM_ISP_HW_SPLIT_LEFT]);
+		if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE)
+			len += scnprintf(log_info + len, (128 - len), " SFE[%d]",
+				sfe_hw_idx[CAM_ISP_HW_SPLIT_LEFT]);
+	}
+
+	if (c_ctx->flags.is_sfe_shdr)
+		len += scnprintf(log_info + len, (128 - len), " sHDR: Y");
+
+	if (c_ctx->flags.is_sfe_fs)
+		len += scnprintf(log_info + len, (128 - len), " SFE_FS: Y");
+
+	if (c_ctx->flags.dsp_enabled)
+		len += scnprintf(log_info + len, (128 - len), " DSP: Y");
+
+	if (c_ctx->flags.is_offline)
+		len += scnprintf(log_info + len, (128 - len), " OFFLINE: Y");
+
+	if (c_ctx->is_hw_ctx_acq) {
+		len += scnprintf(log_info + len, (128 - len), " HW_CTXT [SRC:DST_MASK]");
+
+		for (i = 0; i < CAM_ISP_MULTI_CTXT_MAX; i++) {
+			if (!c_ctx->acq_hw_ctxt_src_dst_map[i])
+				continue;
+
+			len += scnprintf(log_info + len, (128 - len), " [%d:0x%x]",
+				i, c_ctx->acq_hw_ctxt_src_dst_map[i]);
+		}
+	}
+
+
+	CAM_GET_TIMESTAMP(c_ctx->ts);
+	CAM_CONVERT_TIMESTAMP_FORMAT(c_ctx->ts, hrs, min, sec, ms);
+
+	CAM_INFO(CAM_ISP,
+		"%llu:%llu:%llu.%llu Acquired %s with [%u pix] [%u pd] [%u rdi] ports for ctx:%u per_port_enabled :%d",
+		hrs, min, sec, ms,
+		log_info,
+		num_pix_port, num_pd_port, num_rdi_port,
+		c_ctx->ctx_index, c_ctx->flags.per_port_en);
+
+	return;
+
+fail:
+	CAM_ERR(CAM_ISP,
+		"Failed to acquire %s-IFE/SFE with [%u pix] [%u pd] [%u rdi] ports for ctx_idx:%u per_port_enabled :%d",
+		(c_ctx->flags.is_dual) ? "dual" : "single",
+		num_pix_port, num_pd_port, num_rdi_port, c_ctx->ctx_index,
+		c_ctx->flags.per_port_en);
+	CAM_INFO(CAM_ISP, "Previously acquired IFEs[%d %d] SFEs[%d %d], ctx_idx: %u",
+		hw_idx[CAM_ISP_HW_SPLIT_LEFT], hw_idx[CAM_ISP_HW_SPLIT_RIGHT],
+		sfe_hw_idx[CAM_ISP_HW_SPLIT_LEFT], sfe_hw_idx[CAM_ISP_HW_SPLIT_RIGHT],
+		c_ctx->ctx_index);
+
+	if (c_ctx->is_hw_ctx_acq)
+		CAM_INFO(CAM_ISP, "HW_CTXT [SRC:DST_MASK] [%d:0x%x] [%d:0x%x] [%d:0x%x]",
+			CAM_ISP_MULTI_CTXT_0,
+			c_ctx->acq_hw_ctxt_src_dst_map[CAM_ISP_MULTI_CTXT_0],
+			CAM_ISP_MULTI_CTXT_1,
+			c_ctx->acq_hw_ctxt_src_dst_map[CAM_ISP_MULTI_CTXT_1],
+			CAM_ISP_MULTI_CTXT_2,
+			c_ctx->acq_hw_ctxt_src_dst_map[CAM_ISP_MULTI_CTXT_2]);
+
+	cam_ife_hw_mgr_dump_acq_rsrc_for_all_ctx(hw_mgr_ctx);
+}
+
+static int cam_ife_mgr_csid_change_halt_mode(struct cam_ife_hw_mgr_ctx *ctx,
+	enum cam_ife_csid_halt_mode halt_mode)
+{
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_resource_node     *isp_res;
+	struct cam_ife_csid_hw_halt_args halt;
+	struct cam_hw_intf               *hw_intf;
+	uint32_t i;
+	int rc = 0;
+
+	if (!c_ctx->flags.is_dual)
+		return 0;
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (i == CAM_ISP_HW_SPLIT_LEFT)
+				continue;
+
+			if (!hw_mgr_res->hw_res[i] ||
+				(hw_mgr_res->hw_res[i]->res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING))
+				continue;
+
+			isp_res = hw_mgr_res->hw_res[i];
+
+			if ((isp_res->res_type == CAM_ISP_RESOURCE_PIX_PATH) &&
+				(isp_res->res_id == CAM_IFE_PIX_PATH_RES_IPP)) {
+				hw_intf         = isp_res->hw_intf;
+				halt.node_res   = isp_res;
+				halt.halt_mode  = halt_mode;
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE,
+					&halt,
+					sizeof(
+					struct cam_ife_csid_hw_halt_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Halt update failed, ctx_idx: %u",
+						c_ctx->ctx_index);
+				break;
+			}
+		}
+	}
+
+	return rc;
+}
+
+int cam_ife_mgr_csid_stop_hw(
+	struct cam_ife_hw_mgr_ctx *ctx, struct list_head  *stop_list,
+		uint32_t  base_idx, uint32_t stop_cmd)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ctx->concr_ctx;
+	struct cam_isp_resource_node     *isp_res;
+	struct cam_isp_resource_node     *stop_res[CAM_IFE_PIX_PATH_RES_MAX - 1];
+	struct cam_hw_intf               *hw_intf;
+	struct cam_csid_hw_stop_args      stop;
+	uint32_t i, cnt;
+
+	cnt = 0;
+	list_for_each_entry(hw_mgr_res, stop_list, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i] ||
+				(hw_mgr_res->hw_res[i]->res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING && !c_ctx->flags.per_port_en))
+				continue;
+
+			isp_res = hw_mgr_res->hw_res[i];
+			if (isp_res->hw_intf->hw_idx != base_idx)
+				continue;
+			CAM_DBG(CAM_ISP, "base_idx %d ctx_idx: %u res:%s res_id %d cnt %u",
+				base_idx, c_ctx->ctx_index, isp_res->res_name,
+				isp_res->res_id, cnt);
+			stop_res[cnt] = isp_res;
+			cnt++;
+		}
+	}
+
+	if (cnt) {
+		hw_intf =  stop_res[0]->hw_intf;
+		stop.num_res = cnt;
+		stop.node_res = stop_res;
+		stop.stop_cmd = stop_cmd;
+		hw_intf->hw_ops.stop(hw_intf->hw_priv, &stop, sizeof(stop));
+		for (i = 0; i < cnt; i++)
+			stop_res[i]->is_rdi_primary_res = false;
+	}
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_release_hw_for_ctx(
+	struct cam_ife_hw_mgr_ctx  *ife_ctx,
+	int index)
+{
+	uint32_t                          i;
+	uint32_t                          num_out = 0;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res_temp;
+	struct list_head                 *ife_src_list_head;
+	struct list_head                 *csid_res_list_head;
+	struct list_head                 *free_res_list_head;
+
+	if (c_ctx->flags.per_port_en && (index != CAM_IFE_STREAM_GRP_INDEX_NONE)) {
+		ife_src_list_head =
+			&g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_src_list;
+		csid_res_list_head =
+			&g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_csid_list;
+		free_res_list_head =
+			&g_ife_sns_grp_cfg.grp_cfg[index]->free_res_list;
+		num_out = max_ife_out_res;
+		CAM_DBG(CAM_ISP, "entered per_port CTX:%d", c_ctx->ctx_index);
+	} else {
+		ife_src_list_head = &c_ctx->res_list_ife_src;
+		csid_res_list_head = &c_ctx->res_list_ife_csid;
+		free_res_list_head = &c_ctx->free_res_list;
+		num_out = c_ctx->num_acq_vfe_out;
+		CAM_DBG(CAM_ISP, "entered per_port disable CTX:%d", c_ctx->ctx_index);
+	}
+
+	/* ife leaf resource */
+	for (i = 0; i < num_out; i++) {
+		if (c_ctx->flags.per_port_en && (index != CAM_IFE_STREAM_GRP_INDEX_NONE))
+			cam_ife_hw_mgr_free_hw_res(
+				&g_ife_sns_grp_cfg.grp_cfg[index]->res_list_ife_out[i], false);
+		else {
+			cam_ife_hw_mgr_free_hw_res(&c_ctx->res_list_ife_out[i],
+			false);
+			c_ctx->num_acq_vfe_out--;
+		}
+	}
+
+	/* fetch rd resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&c_ctx->res_list_ife_in_rd, list) {
+		cam_ife_hw_mgr_free_hw_res(hw_mgr_res, true);
+		cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* ife source resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		ife_src_list_head, list) {
+		cam_ife_hw_mgr_free_hw_res(hw_mgr_res, true);
+		cam_ife_hw_mgr_put_res(free_res_list_head, &hw_mgr_res);
+	}
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		/* sfe leaf resource */
+		num_out = c_ctx->num_acq_sfe_out;
+		for (i = 0; i < num_out; i++) {
+			cam_ife_hw_mgr_free_hw_res(
+				&c_ctx->res_list_sfe_out[i], false);
+			c_ctx->num_acq_sfe_out--;
+		}
+
+		/* sfe source resource */
+		list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+			&c_ctx->res_list_sfe_src, list) {
+			cam_ife_hw_mgr_free_hw_res(hw_mgr_res, true);
+			cam_ife_hw_mgr_put_res(&c_ctx->free_res_list,
+				&hw_mgr_res);
+		}
+	}
+
+	/* ife csid resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		csid_res_list_head, list) {
+		cam_ife_hw_mgr_free_hw_res(hw_mgr_res, true);
+		cam_ife_hw_mgr_put_res(free_res_list_head, &hw_mgr_res);
+	}
+
+	/* ife root node */
+	if (c_ctx->flags.per_port_en && (index != CAM_IFE_STREAM_GRP_INDEX_NONE)) {
+		g_ife_sns_grp_cfg.grp_cfg[index]->acquire_cnt = 0;
+		g_ife_sns_grp_cfg.grp_cfg[index]->acquired_hw_idx = 0;
+	} else {
+		if (c_ctx->res_list_ife_in.res_type != CAM_ISP_RESOURCE_UNINT)
+			cam_ife_hw_mgr_free_hw_res(&c_ctx->res_list_ife_in, true);
+
+		/* clean up the callback function */
+		c_ctx->common.cb_priv = NULL;
+		c_ctx->common.event_cb = NULL;
+
+		c_ctx->flags.need_csid_top_cfg = false;
+	}
+
+	CAM_DBG(CAM_ISP, "release context completed ctx id:%u",
+		c_ctx->ctx_index);
+
+	return 0;
+}
+
+
+static int cam_ife_hw_mgr_put_ctx(
+	struct list_head                 *src_list,
+	struct cam_ife_hw_mgr_ctx       **ife_ctx)
+{
+	int rc                              = 0;
+	struct cam_ife_hw_concrete_ctx *ctx_ptr  = NULL;
+
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	ctx_ptr = (*ife_ctx)->concr_ctx;
+	if (ctx_ptr)
+		list_add_tail(&ctx_ptr->list, src_list);
+	*ife_ctx = NULL;
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_get_ctx(
+	struct list_head                *src_list,
+	struct cam_ife_hw_mgr_ctx       **ife_ctx)
+{
+	int rc                              = 0;
+	struct cam_ife_hw_concrete_ctx *ctx_ptr  = NULL;
+
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	if (!list_empty(src_list)) {
+		ctx_ptr = list_first_entry(src_list,
+			struct cam_ife_hw_concrete_ctx, list);
+		list_del_init(&ctx_ptr->list);
+	} else {
+		CAM_ERR(CAM_ISP, "No more free ife hw mgr ctx");
+		rc = -1;
+	}
+	(*ife_ctx)->concr_ctx = ctx_ptr;
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+
+	return rc;
+}
+
+static void cam_ife_mgr_add_base_info(
+	struct cam_ife_hw_mgr_ctx       *ctx,
+	enum cam_isp_hw_split_id         split_id,
+	uint32_t                         base_idx,
+	enum cam_isp_hw_type             hw_type)
+{
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	uint32_t    i;
+
+	if (!c_ctx->num_base) {
+		c_ctx->base[0].split_id = split_id;
+		c_ctx->base[0].idx      = base_idx;
+		c_ctx->base[0].hw_type = hw_type;
+		c_ctx->num_base++;
+		CAM_DBG(CAM_ISP,
+			"Add split id = %d ctx_idx: %u for base idx = %d num_base=%d hw_type=%d",
+			split_id, c_ctx->ctx_index, base_idx, c_ctx->num_base, hw_type);
+	} else {
+		/*Check if base index already exists in the list */
+		for (i = 0; i < c_ctx->num_base; i++) {
+			if ((c_ctx->base[i].idx == base_idx) &&
+				(c_ctx->base[i].hw_type == hw_type)) {
+				if (split_id != CAM_ISP_HW_SPLIT_MAX &&
+					c_ctx->base[i].split_id ==
+						CAM_ISP_HW_SPLIT_MAX)
+					c_ctx->base[i].split_id = split_id;
+
+				break;
+			}
+		}
+
+		if (i == c_ctx->num_base) {
+			c_ctx->base[c_ctx->num_base].split_id = split_id;
+			c_ctx->base[c_ctx->num_base].idx      = base_idx;
+			c_ctx->base[c_ctx->num_base].hw_type = hw_type;
+			c_ctx->num_base++;
+			CAM_DBG(CAM_ISP,
+				"Add split_id=%d ctx_idx: %u for base idx=%d num_base=%d hw_type=%d",
+				 split_id, c_ctx->ctx_index, base_idx, c_ctx->num_base, hw_type);
+		}
+	}
+}
+
+/* Update base info for IFE & SFE HWs */
+static int cam_ife_mgr_process_base_info(
+	struct cam_ife_hw_mgr_ctx        *ctx)
+{
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_resource_node     *res = NULL;
+	uint32_t i;
+	bool   hw_idx_map[CAM_IFE_CSID_HW_NUM_MAX] = {0};
+
+	if (list_empty(&c_ctx->res_list_ife_src) &&
+		list_empty(&c_ctx->res_list_sfe_src)) {
+		CAM_ERR(CAM_ISP, "Mux List empty");
+		return -ENODEV;
+	}
+
+	/* IFE mux in resources */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			cam_ife_mgr_add_base_info(ctx, i,
+				res->hw_intf->hw_idx,
+				CAM_ISP_HW_TYPE_VFE);
+			CAM_DBG(CAM_ISP, "add IFE base info for hw %d ctx_idx: %u",
+				res->hw_intf->hw_idx, c_ctx->ctx_index);
+		}
+	}
+
+	/*CSID resources */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+
+			if (hw_idx_map[res->hw_intf->hw_idx])
+				continue;
+
+			cam_ife_mgr_add_base_info(ctx, i,
+				res->hw_intf->hw_idx,
+				CAM_ISP_HW_TYPE_CSID);
+			hw_idx_map[res->hw_intf->hw_idx] = true;
+			CAM_DBG(CAM_ISP, "add CSID base info for hw %d, ctx_idx: %u",
+				res->hw_intf->hw_idx, c_ctx->ctx_index);
+		}
+	}
+
+	/* SFE in resources */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_sfe_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			cam_ife_mgr_add_base_info(ctx, i,
+				res->hw_intf->hw_idx,
+				CAM_ISP_HW_TYPE_SFE);
+			CAM_DBG(CAM_ISP, "add SFE base info for hw %d, ctx_idx: %u",
+				res->hw_intf->hw_idx, c_ctx->ctx_index);
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "ctx base num = %d, ctx_idx: %u", c_ctx->num_base, c_ctx->ctx_index);
+
+	return 0;
+}
+
+static int cam_ife_mgr_share_sof_qtimer_addr(struct cam_ife_hw_mgr_ctx *ctx)
+{
+	/**
+	 * The objective is to obtain the qtimer timestamp from
+	 * the CSID path that drives the state machine's interrupts
+	 * to ensure the events are aligned in time. IPP is selected
+	 * for pixel pipelines; for SFE fetch use cases,
+	 * RDI0 is specified; for RDI-only/ RDI-PD streams,
+	 * any active RDI starting from RDI0 is picked. If none of
+	 * the above criteria are met, the first CSID path acquired
+	 * is used to fetch the timestamp.
+	 */
+	struct cam_ife_hw_concrete_ctx         *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res              *hw_mgr_res;
+	struct cam_isp_hw_mgr_res              *csid_res;
+	struct cam_isp_hw_mgr_res              *ife_src_res;
+	struct cam_hw_intf                     *hw_intf;
+	struct cam_ife_csid_ts_reg_addr         sof_ts_addr;
+	uint32_t                                primary_rdi_csid_res;
+	uint32_t                                primary_rdi_out_res;
+	int rc, i;
+	bool res_rdi_context_set = false, is_found = false;
+
+	primary_rdi_csid_res = CAM_IFE_PIX_PATH_RES_MAX;
+	primary_rdi_out_res = g_ife_hw_mgr.isp_caps.max_vfe_out_res_type;
+
+	if (cam_isp_is_ctx_primary_rdi(ctx)) {
+		for (i = 0; i < c_ctx->num_acq_vfe_out && !res_rdi_context_set; i++) {
+			hw_mgr_res = &c_ctx->res_list_ife_out[i];
+			switch (hw_mgr_res->res_id) {
+			case CAM_ISP_IFE_OUT_RES_RDI_0:
+			case CAM_ISP_IFE_OUT_RES_RDI_1:
+			case CAM_ISP_IFE_OUT_RES_RDI_2:
+			case CAM_ISP_IFE_OUT_RES_RDI_3:
+				hw_mgr_res->hw_res[0]->is_rdi_primary_res = true;
+				res_rdi_context_set = true;
+				primary_rdi_out_res = hw_mgr_res->res_id;
+				break;
+			default:
+				break;
+			}
+		}
+		if (res_rdi_context_set)
+			primary_rdi_csid_res = cam_ife_hw_mgr_get_ife_csid_rdi_res_type(
+				primary_rdi_out_res);
+	}
+
+	list_for_each_entry(csid_res, &c_ctx->res_list_ife_csid, list) {
+		if (csid_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		if (csid_res->res_id == CAM_IFE_PIX_PATH_RES_IPP ||
+			csid_res->res_id == primary_rdi_csid_res ||
+			(c_ctx->flags.is_fe_enabled &&
+			csid_res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0)) {
+			is_found = true;
+			break;
+		}
+	}
+
+	if (!is_found)
+		csid_res = list_first_entry(&c_ctx->res_list_ife_csid,
+			struct cam_isp_hw_mgr_res, list);
+
+	ife_src_res = list_first_entry(&c_ctx->res_list_ife_src,
+		struct cam_isp_hw_mgr_res, list);
+
+	/* Left resource is always the master */
+	hw_intf = csid_res->hw_res[0]->hw_intf;
+	sof_ts_addr.res_id = csid_res->res_id;
+	sof_ts_addr.get_addr = true;
+	rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+		CAM_ISP_HW_CMD_GET_SET_PRIM_SOF_TS_ADDR,
+		&sof_ts_addr, sizeof(struct cam_ife_csid_ts_reg_addr));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Get CSID[%u] SOF ts addr failed",
+			hw_intf->hw_idx);
+		return rc;
+	}
+
+	sof_ts_addr.get_addr = false;
+	hw_intf = ife_src_res->hw_res[0]->hw_intf;
+	rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+		CAM_ISP_HW_CMD_GET_SET_PRIM_SOF_TS_ADDR,
+		&sof_ts_addr, sizeof(struct cam_ife_csid_ts_reg_addr));
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Share SOF ts addr with IFE[%u] res id %u failed",
+			hw_intf->hw_idx, ife_src_res->res_id);
+		return rc;
+	}
+
+	return 0;
+}
+
+int cam_ife_hw_mgr_acquire_res_ife_out_rdi(
+	struct cam_ife_hw_mgr_ctx       *ife_ctx,
+	struct cam_isp_hw_mgr_res       *ife_src_res,
+	struct cam_isp_in_port_generic_info     *in_port,
+	int  grp_index)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_acquire_args               vfe_acquire;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_out_port_generic_info     *out_port = NULL;
+	struct cam_isp_hw_mgr_res                *ife_out_res;
+	struct cam_hw_intf                       *hw_intf;
+	bool                                      per_port_acquire;
+	struct cam_isp_context_comp_record       *comp_grp = NULL;
+	uint32_t                                  index;
+	uint32_t  i, vfe_out_res_id, vfe_in_res_id;
+	uint32_t  res_id = max_ife_out_res, num_out_res;
+
+	if (in_port->per_port_en && (grp_index != CAM_IFE_STREAM_GRP_INDEX_NONE)) {
+		per_port_acquire = true;
+		num_out_res = 1;
+	} else {
+		per_port_acquire = false;
+		num_out_res = in_port->num_out_res;
+	}
+
+	/* take left resource */
+	vfe_in_res_id = ife_src_res->hw_res[0]->res_id;
+
+	switch (vfe_in_res_id) {
+	case CAM_ISP_HW_VFE_IN_RDI0:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_0;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI1:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_1;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI2:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_2;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI3:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_3;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI4:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_4;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI5:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_5;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "invalid resource type");
+		goto err;
+	}
+	CAM_DBG(CAM_ISP,
+		"vfe_in_res_id = %d num_out_res:%d per_port_acquire:%d",
+		vfe_in_res_id, num_out_res, per_port_acquire);
+
+	vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_OUT;
+	vfe_acquire.tasklet = c_ctx->common.tasklet_info;
+
+	for (i = 0; i < num_out_res; i++) {
+		out_port = &in_port->data[i];
+
+		CAM_DBG(CAM_ISP, "i = %d, vfe_out_res_id = %d num_out_res %d",
+			i, vfe_out_res_id, num_out_res);
+
+		if (!out_port) {
+			CAM_ERR(CAM_ISP, "out port data is NULL");
+			rc = -EINVAL;
+			goto err;
+		}
+		if (!per_port_acquire) {
+			if (vfe_out_res_id != out_port->res_type) {
+				CAM_DBG(CAM_ISP,
+					"ctx_idx: %u i = %d, vfe_out_res_id = %d, out_port: %d",
+					c_ctx->ctx_index, i, vfe_out_res_id, out_port->res_type);
+				continue;
+			} else
+				res_id = out_port->res_type & 0xFF;
+		}
+
+		vfe_acquire.vfe_out.cdm_ops = c_ctx->cdm_ops;
+		vfe_acquire.priv = c_ctx;
+		vfe_acquire.vfe_out.out_port_info = out_port;
+		vfe_acquire.vfe_out.split_id = CAM_ISP_HW_SPLIT_LEFT;
+		vfe_acquire.vfe_out.unique_id = c_ctx->ctx_index;
+		vfe_acquire.vfe_out.is_dual = 0;
+		vfe_acquire.vfe_out.disable_ubwc_comp =
+			g_ife_hw_mgr.debug_cfg.disable_ubwc_comp;
+		if (ife_ctx->is_offline) {
+			vfe_acquire.priv = c_ctx->hw_mgr;
+			vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler_offline;
+		} else {
+			vfe_acquire.priv = ife_ctx;
+			vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		}
+		vfe_acquire.buf_done_controller = c_ctx->buf_done_controller;
+		hw_intf = ife_src_res->hw_res[0]->hw_intf;
+		vfe_acquire.vfe_out.use_wm_pack = ife_src_res->use_wm_pack;
+		vfe_acquire.per_port_acquire = per_port_acquire;
+		vfe_acquire.vfe_out.vfe_res_out_id = vfe_out_res_id;
+
+		CAM_DBG(CAM_ISP, "reserve call for res_id: %d  out_id :%d",
+			ife_src_res->hw_res[0]->res_id,
+			vfe_acquire.vfe_out.vfe_res_out_id);
+
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&vfe_acquire,
+			sizeof(struct cam_vfe_acquire_args));
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not acquire out resource 0x%x, ctx_idx: %u",
+				 vfe_out_res_id, c_ctx->ctx_index);
+			goto err;
+		}
+
+		if (!per_port_acquire) {
+			index = vfe_acquire.vfe_out.comp_grp_id;
+			comp_grp = &c_ctx->vfe_bus_comp_grp[index];
+			comp_grp->res_id[comp_grp->num_res] = vfe_out_res_id;
+			comp_grp->num_res++;
+		}
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "ctx: %d out_res_id = %d, in_res_id: %d",
+		c_ctx->ctx_index, vfe_out_res_id, vfe_in_res_id);
+
+	if (i == in_port->num_out_res) {
+		CAM_ERR(CAM_ISP,
+			"Cannot acquire out resource, i=%d, num_out_res=%d, ctx_idx: %u vfe_out_res_id:%d max_ife_out_res :%d",
+			i, in_port->num_out_res, c_ctx->ctx_index, vfe_out_res_id, max_ife_out_res);
+		goto err;
+	}
+
+	if (per_port_acquire)
+		ife_out_res =
+		&g_ife_sns_grp_cfg.grp_cfg[grp_index]->res_list_ife_out[vfe_out_res_id & 0xFF];
+	else
+		ife_out_res = &c_ctx->res_list_ife_out[c_ctx->num_acq_vfe_out];
+	ife_out_res->hw_res[0] = vfe_acquire.vfe_out.rsrc_node;
+	ife_out_res->is_dual_isp = 0;
+	ife_out_res->use_wm_pack = ife_src_res->use_wm_pack;
+	ife_out_res->res_id = vfe_out_res_id;
+	ife_out_res->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	if (per_port_acquire) {
+		ife_out_res->linked = false;
+	} else {
+		c_ctx->vfe_out_map[res_id] = c_ctx->num_acq_vfe_out;
+		ife_src_res->num_children++;
+		c_ctx->num_acq_vfe_out++;
+	}
+
+	return 0;
+err:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_ife_out_pixel(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_hw_mgr_res           *ife_src_res,
+	struct cam_isp_in_port_generic_info *in_port,
+	int                                  grp_index,
+	bool                                 update_only)
+{
+	int rc = -1;
+	uint32_t  i, j, k;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	struct cam_vfe_acquire_args               vfe_acquire;
+	struct cam_isp_out_port_generic_info     *out_port;
+	struct cam_isp_hw_mgr_res                *ife_out_res;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_isp_context_comp_record       *comp_grp = NULL;
+	uint32_t                                  index;
+	bool                                      is_ife_out_in_list = false;
+	uint32_t                                  num_out_res;
+	uint32_t                                  res_type;
+	bool                                      per_port_acquire;
+
+	if (update_only)
+		c_ctx->num_acq_vfe_out = 0;
+
+	if (in_port->per_port_en && (grp_index != CAM_IFE_STREAM_GRP_INDEX_NONE)) {
+		if (in_port->ipp_count)
+			num_out_res = in_port->num_out_res;
+		else
+			num_out_res = max_ife_out_res;
+		per_port_acquire = true;
+	} else {
+		num_out_res = in_port->num_out_res;
+		per_port_acquire = false;
+	}
+
+	for (i = 0; i < num_out_res; i++) {
+		if (!in_port->ipp_count) {
+			out_port = &in_port->data[0];
+			res_type = CAM_ISP_IFE_OUT_RES_BASE + i;
+		} else {
+			out_port = &in_port->data[i];
+			res_type = out_port->res_type;
+		}
+		/* Skip output ports for SFE */
+		if (!cam_ife_hw_mgr_is_ife_out_port(res_type))
+			continue;
+
+		if (cam_ife_hw_mgr_is_rdi_res(res_type))
+			continue;
+
+		if (!cam_ife_hw_mgr_check_path_port_compat(ife_src_res->res_id,
+			res_type))
+			continue;
+
+		CAM_DBG(CAM_ISP, "res_type 0x%x per_port_acquire: %d",
+				res_type, per_port_acquire);
+
+		k = res_type & 0xFF;
+
+		if ((in_port->major_ver == 3) && (ife_src_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF)) {
+			ife_out_res = &c_ctx->res_list_ife_out[c_ctx->vfe_out_map[k]];
+			if (ife_out_res) {
+				vfe_acquire.vfe_out.use_hw_ctxt = true;
+				is_ife_out_in_list = true;
+				goto skip_get_ife_out_res;
+			}
+		}
+
+		c_ctx->vfe_out_map[k] = c_ctx->num_acq_vfe_out;
+		if (per_port_acquire)
+			ife_out_res =
+				&g_ife_sns_grp_cfg.grp_cfg[grp_index]->res_list_ife_out[k];
+		else
+			ife_out_res = &c_ctx->res_list_ife_out[c_ctx->num_acq_vfe_out];
+
+skip_get_ife_out_res:
+		ife_out_res->is_dual_isp = in_port->usage_type;
+		vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_OUT;
+		vfe_acquire.tasklet = c_ctx->common.tasklet_info;
+		vfe_acquire.vfe_out.cdm_ops = c_ctx->cdm_ops;
+		vfe_acquire.priv = c_ctx;
+		vfe_acquire.vfe_out.out_port_info =  out_port;
+		vfe_acquire.vfe_out.is_dual       = ife_src_res->is_dual_isp;
+		vfe_acquire.vfe_out.unique_id     = c_ctx->ctx_index;
+		vfe_acquire.vfe_out.disable_ubwc_comp =
+			g_ife_hw_mgr.debug_cfg.disable_ubwc_comp;
+		if (ife_ctx->is_offline) {
+			vfe_acquire.priv = c_ctx->hw_mgr;
+			vfe_acquire.event_cb =
+				cam_ife_hw_mgr_event_handler_offline;
+		} else {
+			vfe_acquire.priv = ife_ctx;
+			vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+
+		}
+		vfe_acquire.buf_done_controller = c_ctx->buf_done_controller;
+		vfe_acquire.per_port_acquire = per_port_acquire;
+		vfe_acquire.vfe_out.vfe_res_out_id = res_type;
+
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!ife_src_res->hw_res[j])
+				continue;
+
+			hw_intf = ife_src_res->hw_res[j]->hw_intf;
+
+			if (j == CAM_ISP_HW_SPLIT_LEFT) {
+				vfe_acquire.vfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_LEFT;
+				if (ife_src_res->is_dual_isp) {
+					/*TBD */
+					vfe_acquire.vfe_out.is_master     = 1;
+					vfe_acquire.vfe_out.dual_slave_core =
+						c_ctx->right_hw_idx;
+				} else {
+					vfe_acquire.vfe_out.is_master   = 0;
+					vfe_acquire.vfe_out.dual_slave_core =
+						0;
+				}
+			} else {
+				vfe_acquire.vfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_RIGHT;
+				vfe_acquire.vfe_out.is_master       = 0;
+				vfe_acquire.vfe_out.dual_slave_core =
+					c_ctx->left_hw_idx;
+			}
+
+			if (update_only) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_WM_UPDATE,
+					&vfe_acquire,
+					sizeof(struct cam_vfe_acquire_args));
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Can not update out resource 0x%x",
+						out_port->res_type);
+					goto err;
+				}
+			} else {
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&vfe_acquire,
+					sizeof(struct cam_vfe_acquire_args));
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Can not acquire out resource 0x%x",
+						out_port->res_type);
+					goto err;
+				}
+			}
+
+			ife_out_res->hw_res[j] =
+				vfe_acquire.vfe_out.rsrc_node;
+
+			if (!per_port_acquire) {
+				if (j == CAM_ISP_HW_SPLIT_LEFT && !update_only) {
+					index = vfe_acquire.vfe_out.comp_grp_id;
+					comp_grp = &c_ctx->vfe_bus_comp_grp[index];
+					comp_grp->res_id[comp_grp->num_res] =
+						ife_out_res->hw_res[j]->res_id;
+					comp_grp->num_res++;
+				}
+			}
+
+			CAM_DBG(CAM_ISP, "resource type:0x%x res id:0x%x comp grp id:%d ctx:%u",
+				ife_out_res->hw_res[j]->res_type,
+				ife_out_res->hw_res[j]->res_id,
+				vfe_acquire.vfe_out.comp_grp_id, c_ctx->ctx_index);
+		}
+
+		if (!update_only) {
+			ife_out_res->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+			ife_out_res->res_id = res_type;
+			ife_out_res->hw_ctxt_id_mask |=
+				vfe_acquire.vfe_out.out_port_info->hw_context_id;
+			if (!per_port_acquire && !is_ife_out_in_list) {
+				ife_src_res->num_children++;
+				c_ctx->num_acq_vfe_out++;
+				CAM_DBG(CAM_ISP, "IFE SRC num_children = %d acq vfe out %d",
+					ife_src_res->num_children,c_ctx->num_acq_vfe_out);
+			}
+		}
+	}
+
+	return 0;
+err:
+	/* release resource at the entry function */
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_sfe_out_rdi(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_hw_mgr_res           *sfe_src_res,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	int rc = -EINVAL;
+	uint32_t  i, sfe_out_res_id, sfe_in_res_id;
+	struct cam_sfe_acquire_args               sfe_acquire;
+	struct cam_isp_out_port_generic_info     *out_port = NULL;
+	struct cam_isp_hw_mgr_res                *sfe_out_res;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_isp_context_comp_record       *comp_grp = NULL;
+	uint32_t                                  index;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+
+	/* take left resource */
+	sfe_in_res_id = sfe_src_res->hw_res[0]->res_id;
+
+	switch (sfe_in_res_id) {
+	case CAM_ISP_HW_SFE_IN_RDI0:
+		sfe_out_res_id = CAM_ISP_SFE_OUT_RES_RDI_0;
+		break;
+	case CAM_ISP_HW_SFE_IN_RDI1:
+		sfe_out_res_id = CAM_ISP_SFE_OUT_RES_RDI_1;
+		break;
+	case CAM_ISP_HW_SFE_IN_RDI2:
+		sfe_out_res_id = CAM_ISP_SFE_OUT_RES_RDI_2;
+		break;
+	case CAM_ISP_HW_SFE_IN_RDI3:
+		sfe_out_res_id = CAM_ISP_SFE_OUT_RES_RDI_3;
+		break;
+	case CAM_ISP_HW_SFE_IN_RDI4:
+		sfe_out_res_id = CAM_ISP_SFE_OUT_RES_RDI_4;
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"invalid SFE RDI resource type 0x%x, ctx_idx: %u",
+			sfe_in_res_id, c_ctx->ctx_index);
+		goto err;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"sfe_in_res_id: 0x%x sfe_out_res_id: 0x%x ctx_idx: %u",
+		sfe_in_res_id, sfe_out_res_id, c_ctx->ctx_index);
+
+	sfe_acquire.rsrc_type = CAM_ISP_RESOURCE_SFE_OUT;
+	sfe_acquire.tasklet = c_ctx->common.tasklet_info;
+	c_ctx->sfe_out_map[sfe_out_res_id & 0xFF] = c_ctx->num_acq_sfe_out;
+	sfe_out_res = &c_ctx->res_list_sfe_out[c_ctx->num_acq_sfe_out];
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		CAM_DBG(CAM_ISP,
+			"i: %d sfe_out_res_id: 0x%x out_port: 0x%x ctx_idx: %u",
+			i, sfe_out_res_id, out_port->res_type, c_ctx->ctx_index);
+
+		if (sfe_out_res_id != out_port->res_type)
+			continue;
+
+		sfe_acquire.sfe_out.cdm_ops = c_ctx->cdm_ops;
+		sfe_acquire.sfe_out.out_port_info = out_port;
+		sfe_acquire.sfe_out.split_id = CAM_ISP_HW_SPLIT_LEFT;
+		sfe_acquire.sfe_out.unique_id = c_ctx->ctx_index;
+		sfe_acquire.sfe_out.is_dual = 0;
+		sfe_acquire.buf_done_controller = c_ctx->buf_done_controller;
+		sfe_acquire.sfe_out.use_wm_pack = sfe_src_res->use_wm_pack;
+		if (ife_ctx->is_offline) {
+			sfe_acquire.priv = c_ctx->hw_mgr;
+			sfe_acquire.event_cb =
+				cam_ife_hw_mgr_event_handler_offline;
+		} else {
+			sfe_acquire.priv = ife_ctx;
+			sfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		}
+		hw_intf = sfe_src_res->hw_res[0]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&sfe_acquire,
+			sizeof(struct cam_sfe_acquire_args));
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Can not acquire out resource: 0x%x ctx_idx: %u",
+				 out_port->res_type, c_ctx->ctx_index);
+			goto err;
+		}
+
+		index = sfe_acquire.sfe_out.comp_grp_id;
+		comp_grp = &c_ctx->sfe_bus_comp_grp[index];
+		comp_grp->res_id[comp_grp->num_res] = sfe_out_res_id;
+		comp_grp->num_res++;
+		break;
+	}
+
+	if (i == in_port->num_out_res) {
+		CAM_ERR(CAM_ISP,
+			"Cannot acquire out resource i: %d, num_out_res: %u ctx_idx: %u",
+			i, in_port->num_out_res, c_ctx->ctx_index);
+		goto err;
+	}
+
+	sfe_out_res->hw_res[0] = sfe_acquire.sfe_out.rsrc_node;
+	sfe_out_res->is_dual_isp = 0;
+	sfe_out_res->use_wm_pack = sfe_src_res->use_wm_pack;
+	sfe_out_res->res_id = sfe_out_res_id;
+	sfe_out_res->res_type = CAM_ISP_RESOURCE_SFE_OUT;
+	sfe_src_res->num_children++;
+	c_ctx->num_acq_sfe_out++;
+	return 0;
+
+err:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_sfe_out_pix(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_hw_mgr_res           *sfe_src_res,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	int rc = -1, k;
+	uint32_t  i, j;
+	struct cam_sfe_acquire_args               sfe_acquire;
+	struct cam_isp_out_port_generic_info     *out_port;
+	struct cam_isp_hw_mgr_res                *sfe_out_res;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_isp_context_comp_record       *comp_grp = NULL;
+	uint32_t                                  index;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+
+		/* Skip IFE ports */
+		if (!cam_ife_hw_mgr_is_sfe_out_port(out_port->res_type))
+			continue;
+
+		if (cam_ife_hw_mgr_is_sfe_rdi_res(out_port->res_type))
+			continue;
+
+		k = out_port->res_type & 0xFF;
+		CAM_DBG(CAM_ISP, "ctx_idx: %u res_type: 0x%x",
+			c_ctx->ctx_index, out_port->res_type);
+
+		c_ctx->sfe_out_map[k] = c_ctx->num_acq_sfe_out;
+		sfe_out_res = &c_ctx->res_list_sfe_out[c_ctx->num_acq_sfe_out];
+		sfe_out_res->is_dual_isp = in_port->usage_type;
+		sfe_acquire.rsrc_type = CAM_ISP_RESOURCE_SFE_OUT;
+		sfe_acquire.tasklet = c_ctx->common.tasklet_info;
+		sfe_acquire.sfe_out.cdm_ops = c_ctx->cdm_ops;
+		sfe_acquire.sfe_out.out_port_info =  out_port;
+		sfe_acquire.sfe_out.is_dual       = sfe_src_res->is_dual_isp;
+		sfe_acquire.sfe_out.unique_id     = c_ctx->ctx_index;
+		sfe_acquire.buf_done_controller = c_ctx->buf_done_controller;
+		if (ife_ctx->is_offline) {
+			sfe_acquire.priv = c_ctx->hw_mgr;
+			sfe_acquire.event_cb =
+				cam_ife_hw_mgr_event_handler_offline;
+		} else {
+			sfe_acquire.priv = ife_ctx;
+			sfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		}
+
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!sfe_src_res->hw_res[j])
+				continue;
+
+			hw_intf = sfe_src_res->hw_res[j]->hw_intf;
+
+			if (j == CAM_ISP_HW_SPLIT_LEFT) {
+				sfe_acquire.sfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_LEFT;
+				if (sfe_src_res->is_dual_isp)
+					sfe_acquire.sfe_out.is_master = 1;
+				else
+					sfe_acquire.sfe_out.is_master = 0;
+			} else {
+				sfe_acquire.sfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_RIGHT;
+				sfe_acquire.sfe_out.is_master       = 0;
+			}
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&sfe_acquire,
+				sizeof(struct cam_sfe_acquire_args));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire out resource 0x%x ctx_idx: %u",
+					out_port->res_type, c_ctx->ctx_index);
+				goto err;
+			}
+
+			sfe_out_res->hw_res[j] =
+				sfe_acquire.sfe_out.rsrc_node;
+			if (j == CAM_ISP_HW_SPLIT_LEFT) {
+				index = sfe_acquire.sfe_out.comp_grp_id;
+				comp_grp = &c_ctx->sfe_bus_comp_grp[index];
+				comp_grp->res_id[comp_grp->num_res] =
+					sfe_out_res->hw_res[j]->res_id;
+				comp_grp->num_res++;
+			}
+
+			CAM_DBG(CAM_ISP,
+				"ctx:%u res_type:0x%x res: %s res id:0x%x comp grp id:%d",
+				c_ctx->ctx_index, sfe_out_res->hw_res[j]->res_type,
+				sfe_out_res->hw_res[j]->res_name,
+				sfe_out_res->hw_res[j]->res_id,
+				sfe_acquire.sfe_out.comp_grp_id);
+		}
+		sfe_out_res->res_type = CAM_ISP_RESOURCE_SFE_OUT;
+		sfe_out_res->res_id = out_port->res_type;
+		sfe_src_res->num_children++;
+		c_ctx->num_acq_sfe_out++;
+	}
+
+	return 0;
+err:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_sfe_out(
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res         *sfe_res_iterator;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = ife_ctx->concr_ctx;
+
+	if (list_empty(&c_ctx->res_list_sfe_src)) {
+		CAM_WARN(CAM_ISP, "SFE src list empty");
+		return 0;
+	}
+
+	list_for_each_entry(sfe_res_iterator,
+		&c_ctx->res_list_sfe_src, list) {
+		if (sfe_res_iterator->num_children)
+			continue;
+
+		switch (sfe_res_iterator->res_id) {
+		case CAM_ISP_HW_SFE_IN_PIX:
+		case CAM_ISP_HW_SFE_IN_RD:
+			rc = cam_ife_hw_mgr_acquire_res_sfe_out_pix(ife_ctx,
+				sfe_res_iterator, in_port);
+			break;
+		case CAM_ISP_HW_SFE_IN_RDI0:
+		case CAM_ISP_HW_SFE_IN_RDI1:
+		case CAM_ISP_HW_SFE_IN_RDI2:
+			/* for FE use-cases  acquire both RDI and PIX ports */
+			rc = cam_ife_hw_mgr_acquire_res_sfe_out_rdi(ife_ctx,
+				sfe_res_iterator, in_port);
+			if (rc)
+				goto err;
+
+			if (c_ctx->flags.is_fe_enabled)
+				rc = cam_ife_hw_mgr_acquire_res_sfe_out_pix(ife_ctx,
+					sfe_res_iterator, in_port);
+			break;
+		case CAM_ISP_HW_SFE_IN_RDI3:
+		case CAM_ISP_HW_SFE_IN_RDI4:
+			rc = cam_ife_hw_mgr_acquire_res_sfe_out_rdi(ife_ctx,
+				sfe_res_iterator, in_port);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unknown SFE IN resource: %d, ctx_idx: %u",
+				sfe_res_iterator->res_id, c_ctx->ctx_index);
+			rc = -EINVAL;
+			break;
+		}
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+err:
+	return rc;
+}
+
+int cam_ife_hw_mgr_acquire_res_ife_out(
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	int   index)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res       *ife_src_res;
+	struct list_head                *ife_src_list_head;
+	struct cam_ife_hw_concrete_ctx  *c_ctx = ife_ctx->concr_ctx;
+
+
+	if (in_port->per_port_en && (index != CAM_IFE_STREAM_GRP_INDEX_NONE))
+		ife_src_list_head = &g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_src_list;
+	else
+		ife_src_list_head = &c_ctx->res_list_ife_src;
+
+	if (list_empty(ife_src_list_head)) {
+		CAM_WARN(CAM_ISP, "IFE src list empty, ctx_idx: %u", c_ctx->ctx_index);
+		return 0;
+	}
+
+	list_for_each_entry(ife_src_res, ife_src_list_head, list) {
+		if (ife_src_res->num_children)
+			continue;
+
+		switch (ife_src_res->res_id) {
+		case CAM_ISP_HW_VFE_IN_CAMIF:
+		case CAM_ISP_HW_VFE_IN_PDLIB:
+		case CAM_ISP_HW_VFE_IN_RD:
+		case CAM_ISP_HW_VFE_IN_LCR:
+			rc = cam_ife_hw_mgr_acquire_res_ife_out_pixel(ife_ctx,
+				ife_src_res, in_port, index, false);
+			break;
+		case CAM_ISP_HW_VFE_IN_RDI0:
+		case CAM_ISP_HW_VFE_IN_RDI1:
+		case CAM_ISP_HW_VFE_IN_RDI2:
+		case CAM_ISP_HW_VFE_IN_RDI3:
+		case CAM_ISP_HW_VFE_IN_RDI4:
+		case CAM_ISP_HW_VFE_IN_RDI5:
+			rc = cam_ife_hw_mgr_acquire_res_ife_out_rdi(ife_ctx,
+				ife_src_res, in_port, index);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unknown IFE SRC resource: %d, ctx_idx: %u",
+				ife_src_res->res_id, c_ctx->ctx_index);
+			break;
+		}
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+err:
+	/* release resource on entry function */
+	return rc;
+}
+
+static inline void cam_ife_mgr_count_functional_sfe(void)
+{
+	int i;
+
+	g_num_sfe_functional = 0;
+
+	for (i = 0; i < CAM_SFE_HW_NUM_MAX; i++) {
+		if (g_ife_hw_mgr.sfe_devices[i])
+			g_num_sfe_functional++;
+	}
+
+	CAM_DBG(CAM_ISP, "counted %u functional SFEs", g_num_sfe_functional);
+}
+
+static inline void cam_ife_mgr_count_functional_ife(void)
+{
+	int i;
+
+	g_num_ife_functional = 0;
+	g_num_ife_lite_functional = 0;
+
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (g_ife_hw_mgr.ife_devices[i]) {
+			if (g_ife_hw_mgr.ife_dev_caps[i].is_lite)
+				g_num_ife_lite_functional++;
+			else
+				g_num_ife_functional++;
+		}
+	}
+	CAM_DBG(CAM_ISP, "counted functional %d IFE and %d IFE lite", g_num_ife_functional,
+		g_num_ife_lite_functional);
+}
+
+static int cam_convert_hw_idx_to_sfe_hw_num(int hw_idx)
+{
+	if (hw_idx < g_num_sfe_available) {
+		switch (hw_idx) {
+		case 0: return CAM_ISP_SFE0_HW;
+		case 1: return CAM_ISP_SFE1_HW;
+		case 2: return CAM_ISP_SFE2_HW;
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "SFE hw idx %d out-of-bounds max available %u",
+			hw_idx, g_num_sfe_available);
+	}
+
+	return 0;
+}
+
+int cam_convert_rdi_out_res_id_to_src(int res_id)
+{
+	if (res_id == CAM_ISP_IFE_OUT_RES_RDI_0)
+		return CAM_ISP_HW_VFE_IN_RDI0;
+	else if (res_id == CAM_ISP_IFE_OUT_RES_RDI_1)
+		return CAM_ISP_HW_VFE_IN_RDI1;
+	else if (res_id == CAM_ISP_IFE_OUT_RES_RDI_2)
+		return CAM_ISP_HW_VFE_IN_RDI2;
+	else if (res_id == CAM_ISP_IFE_OUT_RES_RDI_3)
+		return CAM_ISP_HW_VFE_IN_RDI3;
+	else if (res_id == CAM_ISP_IFE_OUT_RES_RDI_4)
+		return CAM_ISP_HW_VFE_IN_RDI4;
+	else if (res_id == CAM_ISP_IFE_OUT_RES_RDI_5)
+		return CAM_ISP_HW_VFE_IN_RDI5;
+	return CAM_ISP_HW_VFE_IN_MAX;
+}
+
+static int cam_convert_csid_rdi_res_to_ife_src(int res_id)
+{
+	enum cam_isp_hw_vfe_in_mux src_id;
+
+	switch (res_id) {
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+		src_id = CAM_ISP_HW_VFE_IN_RDI0;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+		src_id = CAM_ISP_HW_VFE_IN_RDI1;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+		src_id = CAM_ISP_HW_VFE_IN_RDI2;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+		src_id = CAM_ISP_HW_VFE_IN_RDI3;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+		src_id = CAM_ISP_HW_VFE_IN_RDI4;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_5:
+		src_id = CAM_ISP_HW_VFE_IN_RDI5;
+		break;
+	default:
+		src_id = CAM_ISP_HW_VFE_IN_MAX;
+		break;
+	}
+
+	return src_id;
+}
+
+static int cam_convert_sfe_res_to_path(int res_id)
+{
+	switch (res_id) {
+	case CAM_ISP_HW_SFE_IN_PIX:
+		return CAM_ISP_PXL_PATH;
+	case CAM_ISP_HW_SFE_IN_RDI0:
+		return CAM_ISP_RDI0_PATH;
+	case CAM_ISP_HW_SFE_IN_RDI1:
+		return CAM_ISP_RDI1_PATH;
+	case CAM_ISP_HW_SFE_IN_RDI2:
+		return CAM_ISP_RDI2_PATH;
+	case CAM_ISP_HW_SFE_IN_RDI3:
+		return CAM_ISP_RDI3_PATH;
+	case CAM_ISP_HW_SFE_IN_RDI4:
+		return CAM_ISP_RDI4_PATH;
+	default:
+		CAM_ERR(CAM_ISP, "SFE res path invalid res_id: 0x%x",
+			res_id);
+	}
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_acquire_sfe_hw(
+	bool                          is_right_hw,
+	struct cam_ife_hw_mgr_ctx    *ife_ctx,
+	struct cam_sfe_acquire_args  *sfe_acquire)
+{
+	int rc = -EINVAL;
+	uint32_t hw_idx;
+	struct cam_hw_intf                  *hw_intf = NULL;
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ife_ctx->concr_ctx;
+	struct cam_ife_hw_mgr               *ife_hw_mgr = c_ctx->hw_mgr;
+
+	if (is_right_hw)
+		hw_idx = c_ctx->right_hw_idx;
+	else
+		hw_idx = c_ctx->left_hw_idx;
+
+	if ((hw_idx >= CAM_SFE_HW_NUM_MAX) || !ife_hw_mgr->sfe_devices[hw_idx]) {
+		CAM_ERR(CAM_ISP, "the hw index:%d is wrong");
+		return -EINVAL;
+	}
+
+	hw_intf = ife_hw_mgr->sfe_devices[hw_idx]->hw_intf;
+	rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+		sfe_acquire,
+		sizeof(struct cam_sfe_acquire_args));
+	if (rc) {
+		CAM_DBG(CAM_ISP,
+			"Can not acquire SFE HW: %d for res: %d ctx_idx: %u",
+			hw_idx, sfe_acquire->sfe_in.res_id, c_ctx->ctx_index);
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_sfe_src_util(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	struct cam_isp_hw_mgr_res           *csid_res,
+	struct cam_sfe_acquire_args         *sfe_acquire,
+	uint32_t                            *acquired_hw_id,
+	uint32_t                            *acquired_hw_path)
+{
+	int                                  rc = -1, i;
+	struct cam_isp_hw_mgr_res           *sfe_src_res;
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ife_ctx->concr_ctx;
+
+	rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list,
+		&sfe_src_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Ctx : %d failed to get res", c_ctx->ctx_index);
+		return rc;
+	}
+
+	sfe_acquire->rsrc_type = CAM_ISP_RESOURCE_SFE_IN;
+	sfe_acquire->sfe_in.is_dual = csid_res->is_dual_isp;
+	sfe_acquire->tasklet = c_ctx->common.tasklet_info;
+	sfe_acquire->sfe_in.cdm_ops = c_ctx->cdm_ops;
+	sfe_acquire->sfe_in.in_port = in_port;
+	sfe_acquire->sfe_in.is_offline = c_ctx->flags.is_offline;
+	if (ife_ctx->is_offline) {
+		sfe_acquire->priv = c_ctx->hw_mgr;
+		sfe_acquire->event_cb =
+			cam_ife_hw_mgr_event_handler_offline;
+	} else {
+		sfe_acquire->priv = ife_ctx;
+		sfe_acquire->event_cb = cam_ife_hw_mgr_event_handler;
+	}
+
+	cam_ife_hw_mgr_put_res(&c_ctx->res_list_sfe_src,
+		&sfe_src_res);
+
+	sfe_src_res->res_type = sfe_acquire->rsrc_type;
+	sfe_src_res->res_id = sfe_acquire->sfe_in.res_id;
+	sfe_src_res->is_dual_isp = csid_res->is_dual_isp;
+	sfe_src_res->use_wm_pack = csid_res->use_wm_pack;
+
+	for (i = sfe_src_res->is_dual_isp; i >= 0; i--) {
+		rc = cam_ife_hw_mgr_acquire_sfe_hw(i,
+			ife_ctx, sfe_acquire);
+
+		if (rc || !sfe_acquire->sfe_in.rsrc_node) {
+			CAM_ERR(CAM_ISP,
+				"Failed to acquire split_id: %d SFE for res_type: %u id: %u ctx_idx: %u",
+				i, sfe_src_res->res_type, sfe_src_res->res_id, c_ctx->ctx_index);
+			goto err;
+		}
+
+		sfe_src_res->hw_res[i] =
+			sfe_acquire->sfe_in.rsrc_node;
+
+		*acquired_hw_id |=
+			cam_convert_hw_idx_to_sfe_hw_num(
+				sfe_src_res->hw_res[i]->hw_intf->hw_idx);
+		acquired_hw_path[i] |= cam_convert_sfe_res_to_path(
+			sfe_src_res->hw_res[i]->res_id);
+
+		CAM_DBG(CAM_ISP,
+			"acquire success %s SFE: %u res_name: %s res_type: %u res_id: %u ctx_idx: %u",
+			((i == CAM_ISP_HW_SPLIT_LEFT) ? "LEFT" : "RIGHT"),
+			sfe_src_res->hw_res[i]->hw_intf->hw_idx,
+			sfe_src_res->hw_res[i]->res_name,
+			sfe_src_res->hw_res[i]->res_type,
+			sfe_src_res->hw_res[i]->res_id, c_ctx->ctx_index);
+	}
+	csid_res->num_children++;
+err:
+	return rc;
+}
+
+static bool cam_ife_hw_mgr_is_csid_rdi_sfe_rdi_out(
+	struct cam_isp_in_port_generic_info  *in_port,
+	uint32_t                              res_id)
+{
+	struct cam_isp_out_port_generic_info *out_port;
+	uint32_t                              i = 0;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		if (res_id == cam_ife_hw_mgr_get_ife_csid_rdi_res_type(
+			out_port->res_type))
+			return true;
+	}
+	return false;
+}
+
+static int cam_ife_hw_mgr_acquire_res_sfe_src(
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t *acquired_hw_id, uint32_t *acquired_hw_path)
+{
+	int                                  rc = -1;
+	struct cam_sfe_acquire_args          sfe_acquire;
+	struct cam_isp_hw_mgr_res           *csid_res;
+	long                                 sfe_required_res = 0;
+	uint32_t                             sfe_acquired_res = 0;
+	uint32_t                             sfe_res_id = 0;
+	struct cam_ife_hw_mgr               *hw_mgr;
+	struct cam_isp_hw_mgr_res           *csid_res_map[CAM_ISP_HW_SFE_IN_MAX];
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ife_ctx->concr_ctx;
+
+	hw_mgr = c_ctx->hw_mgr;
+	list_for_each_entry(csid_res, &c_ctx->res_list_ife_csid, list) {
+
+		if (csid_res->num_children)
+			continue;
+
+		if (csid_res->res_id == CAM_IFE_PIX_PATH_RES_PPP)
+			continue;
+
+		switch (csid_res->res_id) {
+		case CAM_IFE_PIX_PATH_RES_IPP:
+			sfe_required_res |= BIT(CAM_ISP_HW_SFE_IN_PIX);
+			sfe_res_id = CAM_ISP_HW_SFE_IN_PIX;
+			csid_res_map[sfe_res_id] = csid_res;
+			continue;
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+			sfe_res_id = CAM_ISP_HW_SFE_IN_RDI0;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+			sfe_res_id = CAM_ISP_HW_SFE_IN_RDI1;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+			sfe_res_id = CAM_ISP_HW_SFE_IN_RDI2;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+			sfe_res_id = CAM_ISP_HW_SFE_IN_RDI3;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_4:
+			sfe_res_id = CAM_ISP_HW_SFE_IN_RDI4;
+			break;
+		}
+
+		/*
+		 * We acquire RDI only if RDI out is available, this will take
+		 * care of cases where CSID RDI goes to SFE PIX
+		 */
+		if (cam_ife_hw_mgr_is_csid_rdi_sfe_rdi_out(in_port, csid_res->res_id)) {
+			sfe_required_res |= BIT(sfe_res_id);
+			csid_res_map[sfe_res_id] = csid_res;
+		}
+
+		/*
+		 * We need PIX resource without CSID IPP for following cases:
+		 * 1. No read count
+		 * 2. Dynamic switch from SHDR-->HDR and HDR-->SHDR is possible
+		 */
+		if ((!(sfe_required_res & BIT(CAM_ISP_HW_SFE_IN_PIX))) &&
+			(!in_port->ife_rd_count || in_port->dynamic_hdr_switch_en) &&
+			(BIT(csid_res->res_id) == hw_mgr->csid_hw_caps[0].sfe_ipp_input_rdi_res)) {
+			sfe_required_res |= BIT(CAM_ISP_HW_SFE_IN_PIX);
+			csid_res_map[CAM_ISP_HW_SFE_IN_PIX] = csid_res;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "ctx: %u Required SFE in resources: 0x%x", c_ctx->ctx_index,
+		sfe_required_res);
+
+	while (sfe_required_res) {
+		sfe_res_id = ffs(sfe_required_res) - 1;
+		clear_bit(sfe_res_id, &sfe_required_res);
+
+		sfe_acquire.sfe_in.res_id = sfe_res_id;
+		rc = cam_ife_hw_mgr_acquire_res_sfe_src_util(ife_ctx, in_port,
+			csid_res_map[sfe_res_id], &sfe_acquire,
+			acquired_hw_id, acquired_hw_path);
+		if (rc)
+			goto err;
+		sfe_acquired_res |= sfe_res_id;
+	}
+
+	CAM_DBG(CAM_ISP, "ctx: %u Acquired SFE in resources: 0x%x", c_ctx->ctx_index,
+		sfe_acquired_res);
+	return 0;
+
+err:
+	CAM_ERR(CAM_ISP, "Acquire SFE failed ctx: %u acquired_res 0x%x sfe_res %u ctx_idx: %u",
+		c_ctx->ctx_index, sfe_acquired_res, sfe_res_id, c_ctx->ctx_index);
+
+	return rc;
+}
+
+static bool cam_ife_mgr_check_can_use_lite(
+	struct cam_csid_hw_reserve_resource_args  *csid_acquire,
+	struct cam_ife_hw_mgr_ctx                 *ife_ctx)
+{
+	bool can_use_lite = false;
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ife_ctx->concr_ctx;
+
+	if (c_ctx->flags.is_rdi_only_context ||
+		csid_acquire->in_port->can_use_lite) {
+		can_use_lite = true;
+		goto end;
+	}
+
+	switch (csid_acquire->res_id) {
+
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+		can_use_lite = true;
+		break;
+	default:
+		can_use_lite = false;
+		goto end;
+	}
+
+	if (c_ctx->flags.is_fe_enabled || c_ctx->flags.dsp_enabled)
+		can_use_lite = false;
+
+	CAM_DBG(CAM_ISP,
+		"in_port lite hint %d, rdi_only: %d can_use_lite: %d res_id: %u ctx_idx: %u",
+		csid_acquire->in_port->can_use_lite,
+		c_ctx->flags.is_rdi_only_context,
+		can_use_lite, csid_acquire->res_id, c_ctx->ctx_index);
+
+end:
+	return can_use_lite;
+}
+
+static int cam_ife_hw_mgr_acquire_res_ife_bus_rd(
+	struct cam_ife_hw_mgr_ctx                  *ife_ctx,
+	struct cam_isp_in_port_generic_info        *in_port)
+{
+	int                                         i, rc = -EINVAL;
+	struct cam_vfe_acquire_args                 vfe_acquire;
+	struct cam_isp_hw_mgr_res                  *ife_bus_rd_res;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_ife_hw_mgr                      *ife_hw_mgr;
+	struct cam_ife_hw_concrete_ctx             *c_ctx = ife_ctx->concr_ctx;
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	if (!ife_hw_mgr->ife_devices[c_ctx->left_hw_idx]) {
+		CAM_ERR(CAM_ISP, "ife_devices[%d] is NULL", c_ctx->left_hw_idx);
+		return -ENODEV;
+	}
+
+	rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list, &ife_bus_rd_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource, ctx_idx: %u", c_ctx->ctx_index);
+		return -ENODEV;
+	}
+
+	vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_BUS_RD;
+	vfe_acquire.tasklet = c_ctx->common.tasklet_info;
+
+	if (ife_ctx->is_offline) {
+                vfe_acquire.priv = c_ctx->hw_mgr;
+                vfe_acquire.event_cb =
+                        cam_ife_hw_mgr_event_handler_offline;
+        } else {
+                vfe_acquire.priv = ife_ctx;
+                vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+        }
+
+	vfe_acquire.vfe_bus_rd.cdm_ops = c_ctx->cdm_ops;
+	vfe_acquire.vfe_bus_rd.is_dual = (uint32_t)c_ctx->flags.is_dual;
+	vfe_acquire.vfe_bus_rd.is_offline = c_ctx->flags.is_offline;
+	vfe_acquire.vfe_bus_rd.res_id = CAM_ISP_HW_VFE_IN_RD;
+	vfe_acquire.vfe_bus_rd.unpacker_fmt = in_port->fe_unpacker_fmt;
+
+	if (c_ctx->left_hw_idx >= CAM_IFE_HW_NUM_MAX) {
+		if (in_port->ife_rd_count) {
+			for (i = CAM_IFE_HW_NUM_MAX - 1; i >= 0; i--) {
+				if (!ife_hw_mgr->ife_devices[i])
+					continue;
+
+				hw_intf = ife_hw_mgr->ife_devices[i]->hw_intf;
+				if (ife_hw_mgr->ife_dev_caps[hw_intf->hw_idx].is_lite)
+					continue;
+
+				vfe_acquire.vfe_bus_rd.rsrc_node = NULL;
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&vfe_acquire, sizeof(struct cam_vfe_acquire_args));
+				if (!rc && vfe_acquire.vfe_bus_rd.rsrc_node)
+					goto acquire_successful;
+				else
+					CAM_ERR(CAM_ISP,
+						"IFE[%d] acquire failed (rc=%d), ctx_idx: %u",
+						i, rc, c_ctx->ctx_index);
+			}
+			CAM_ERR(CAM_ISP, "Can't find free IFE for ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto put_res;
+		} else {
+			rc = -ENODEV;
+			CAM_ERR(CAM_ISP,
+				"The acquired hw idx %d is invalid and it isn't FE usecase",
+				c_ctx->left_hw_idx);
+			goto put_res;
+		}
+	}
+
+	if (!ife_hw_mgr->ife_devices[c_ctx->left_hw_idx]) {
+		CAM_ERR(CAM_ISP, "IFE device %d is NULL.",
+			c_ctx->left_hw_idx);
+		goto put_res;
+	}
+
+	hw_intf = ife_hw_mgr->ife_devices[c_ctx->left_hw_idx]->hw_intf;
+	rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+		&vfe_acquire, sizeof(struct cam_vfe_acquire_args));
+
+	if (rc || !vfe_acquire.vfe_bus_rd.rsrc_node) {
+		rc = -ENODEV;
+		CAM_ERR(CAM_ISP, "Failed to acquire VFE:%d BUS RD for LEFT, ctx_idx: %u",
+			c_ctx->left_hw_idx, c_ctx->ctx_index);
+		goto put_res;
+	}
+
+acquire_successful:
+	ife_bus_rd_res->hw_res[CAM_ISP_HW_SPLIT_LEFT] =
+		vfe_acquire.vfe_bus_rd.rsrc_node;
+
+	CAM_DBG(CAM_ISP, "Acquired VFE:%d BUS RD for LEFT, ctx_idx: %u",
+		c_ctx->left_hw_idx, c_ctx->ctx_index);
+
+	c_ctx->left_hw_idx = hw_intf->hw_idx;
+	ife_bus_rd_res->res_type = vfe_acquire.rsrc_type;
+	ife_bus_rd_res->res_id = vfe_acquire.vfe_in.res_id;
+	ife_bus_rd_res->is_dual_isp = (uint32_t)c_ctx->flags.is_dual;
+	cam_ife_hw_mgr_put_res(&c_ctx->res_list_ife_in_rd, &ife_bus_rd_res);
+
+	if (c_ctx->flags.is_dual) {
+		if (!ife_hw_mgr->ife_devices[c_ctx->right_hw_idx]) {
+			CAM_ERR(CAM_ISP, "ife_devices[%d] is NULL", c_ctx->right_hw_idx);
+			goto put_res;
+		}
+
+		hw_intf = ife_hw_mgr->ife_devices[c_ctx->right_hw_idx]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&vfe_acquire,
+			sizeof(struct cam_vfe_acquire_args));
+
+		if (!rc && vfe_acquire.vfe_bus_rd.rsrc_node) {
+			ife_bus_rd_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT] =
+				vfe_acquire.vfe_bus_rd.rsrc_node;
+			c_ctx->right_hw_idx = hw_intf->hw_idx;
+
+			CAM_DBG(CAM_ISP,
+				"Acquired VFE:%d BUS RD for RIGHT, ctx: %u",
+				c_ctx->right_hw_idx, c_ctx->ctx_index);
+		}
+	}
+
+	return 0;
+
+put_res:
+	cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &ife_bus_rd_res);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_sfe_bus_rd(
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	int rc = -1, i;
+	struct cam_sfe_acquire_args           sfe_acquire;
+	struct cam_ife_hw_mgr                *ife_hw_mgr;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_isp_hw_mgr_res            *sfe_rd_res;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ife_ctx->concr_ctx;
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list, &sfe_rd_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource, ctx_idx: %u", c_ctx->ctx_index);
+		return rc;
+	}
+
+	if (!cam_ife_hw_mgr_is_sfe_rd_res(in_port->sfe_in_path_type)) {
+		CAM_ERR(CAM_ISP, "Invalid sfe rd type: 0x%x ctx_idx: %u",
+			in_port->sfe_in_path_type, c_ctx->ctx_index);
+		rc = -EINVAL;
+		goto put_res;
+	}
+
+	if (in_port->usage_type)
+		CAM_WARN(CAM_ISP, "DUAL mode not supported for BUS RD [RDIs], ctx_idx: %u",
+			c_ctx->ctx_index);
+
+	sfe_acquire.rsrc_type = CAM_ISP_RESOURCE_SFE_RD;
+	sfe_acquire.tasklet = c_ctx->common.tasklet_info;
+	sfe_acquire.sfe_rd.cdm_ops = c_ctx->cdm_ops;
+	sfe_acquire.sfe_rd.is_offline = c_ctx->flags.is_offline;
+	sfe_acquire.sfe_rd.unpacker_fmt = in_port->fe_unpacker_fmt;
+	sfe_acquire.sfe_rd.res_id = in_port->sfe_in_path_type;
+	sfe_acquire.sfe_rd.secure_mode = in_port->secure_mode;
+
+	 if (ife_ctx->is_offline) {
+                sfe_acquire.priv = c_ctx->hw_mgr;
+                sfe_acquire.event_cb =
+                        cam_ife_hw_mgr_event_handler_offline;
+        } else {
+                sfe_acquire.priv = ife_ctx;
+                sfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+        }
+
+	if (c_ctx->left_hw_idx >= CAM_SFE_HW_NUM_MAX) {
+		if (in_port->ife_rd_count) {
+			for (i = 0; i < CAM_SFE_HW_NUM_MAX; i++) {
+				if (!ife_hw_mgr->sfe_devices[i])
+					continue;
+
+				hw_intf = ife_hw_mgr->sfe_devices[i]->hw_intf;
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&sfe_acquire, sizeof(struct cam_sfe_acquire_args));
+				if (rc)
+					continue;
+				else
+					break;
+			}
+		} else {
+			rc = -ENODEV;
+			CAM_ERR(CAM_ISP,
+				"The acquired hw idx %d is invalid and it isn't FE usecase",
+				c_ctx->left_hw_idx);
+			goto put_res;
+		}
+	} else {
+		if (!ife_hw_mgr->sfe_devices[c_ctx->left_hw_idx]) {
+			rc = -ENODEV;
+			CAM_ERR(CAM_ISP, "No valid sfe devices for idx:%d",
+				c_ctx->left_hw_idx);
+			goto put_res;
+		}
+
+		hw_intf = ife_hw_mgr->sfe_devices[c_ctx->left_hw_idx]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&sfe_acquire, sizeof(struct cam_sfe_acquire_args));
+	}
+
+	if (!sfe_acquire.sfe_rd.rsrc_node || rc) {
+		rc = -ENODEV;
+		CAM_ERR(CAM_ISP,
+			"Failed to acquire SFE RD: 0x%x, ctx_idx: %u",
+			in_port->sfe_in_path_type, c_ctx->ctx_index);
+		goto put_res;
+	}
+
+	sfe_rd_res->hw_res[CAM_ISP_HW_SPLIT_LEFT] = sfe_acquire.sfe_rd.rsrc_node;
+	c_ctx->left_hw_idx = hw_intf->hw_idx;
+	c_ctx->sfe_rd_only = sfe_acquire.sfe_rd.sfe_rd_only;
+
+	CAM_DBG(CAM_ISP,
+		"SFE RD left [%u] acquired success for path: %u is_dual: %d res: %s res_id: 0x%x ctx_idx: %u",
+		sfe_rd_res->hw_res[0]->hw_intf->hw_idx, in_port->sfe_in_path_type,
+		in_port->usage_type, sfe_rd_res->hw_res[0]->res_name,
+		sfe_rd_res->hw_res[0]->res_id, c_ctx->ctx_index);
+
+	sfe_rd_res->res_id = in_port->sfe_in_path_type;
+	sfe_rd_res->res_type = sfe_acquire.rsrc_type;
+	sfe_rd_res->is_dual_isp = in_port->usage_type;
+	sfe_rd_res->is_secure = in_port->secure_mode;
+	cam_ife_hw_mgr_put_res(&c_ctx->res_list_ife_in_rd, &sfe_rd_res);
+
+	return 0;
+put_res:
+	cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &sfe_rd_res);
+	return rc;
+}
+
+int cam_convert_hw_idx_to_ife_hw_num(int hw_idx)
+{
+	if (hw_idx < g_num_ife_available) {
+		switch (hw_idx) {
+		case 0: return CAM_ISP_IFE0_HW;
+		case 1: return CAM_ISP_IFE1_HW;
+		case 2: return CAM_ISP_IFE2_HW;
+		}
+	} else if (hw_idx < g_num_ife_available + g_num_ife_lite_available) {
+		switch (hw_idx - g_num_ife_available) {
+		case 0: return CAM_ISP_IFE0_LITE_HW;
+		case 1: return CAM_ISP_IFE1_LITE_HW;
+		case 2: return CAM_ISP_IFE2_LITE_HW;
+		case 3: return CAM_ISP_IFE3_LITE_HW;
+		case 4: return CAM_ISP_IFE4_LITE_HW;
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "hw idx %d out-of-bounds", hw_idx);
+	}
+	return 0;
+}
+
+static int cam_ife_hw_mgr_acquire_ife_src_for_sfe(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool acquire_lcr, uint32_t *acquired_hw_id,
+	uint32_t *acquired_hw_path)
+{
+	int rc = -1;
+	struct cam_vfe_acquire_args                 vfe_acquire;
+	struct cam_isp_hw_mgr_res                  *ife_src_res;
+	struct cam_hw_intf                         *hw_intf = NULL;
+	struct cam_ife_hw_mgr                      *ife_hw_mgr;
+	struct cam_ife_hw_concrete_ctx             *c_ctx = ife_ctx->concr_ctx;
+
+	if ((c_ctx->left_hw_idx >= CAM_SFE_HW_NUM_MAX) ||
+		(c_ctx->flags.is_dual && (c_ctx->right_hw_idx >= CAM_SFE_HW_NUM_MAX))) {
+		CAM_ERR(CAM_ISP, "the hw index:[%d - %d] is wrong",
+			c_ctx->left_hw_idx, c_ctx->right_hw_idx);
+		goto end;
+	}
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+	rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list,
+		&ife_src_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource, ctx_idx: %u",
+			c_ctx->ctx_index);
+		goto end;
+	}
+
+	vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_IN;
+	vfe_acquire.tasklet = c_ctx->common.tasklet_info;
+	vfe_acquire.vfe_in.cdm_ops = c_ctx->cdm_ops;
+	vfe_acquire.vfe_in.in_port = in_port;
+	vfe_acquire.vfe_in.is_fe_enabled = c_ctx->flags.is_fe_enabled;
+	vfe_acquire.vfe_in.is_offline = c_ctx->flags.is_offline;
+	vfe_acquire.vfe_in.handle_camif_irq = true;
+
+	if (ife_hw_mgr->csid_camif_irq_support && c_ctx->ctx_type !=
+		CAM_IFE_CTX_TYPE_SFE)
+		vfe_acquire.vfe_in.handle_camif_irq = false;
+
+	if (ife_ctx->is_offline) {
+		vfe_acquire.priv = c_ctx->hw_mgr;
+		vfe_acquire.event_cb =
+				 cam_ife_hw_mgr_event_handler_offline;
+	} else {
+		vfe_acquire.priv = ife_ctx;
+		vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+
+	}
+
+	if (!acquire_lcr)
+		vfe_acquire.vfe_in.res_id =
+			CAM_ISP_HW_VFE_IN_CAMIF;
+	else
+		vfe_acquire.vfe_in.res_id =
+			CAM_ISP_HW_VFE_IN_LCR;
+
+	if (c_ctx->flags.is_dual) {
+		vfe_acquire.vfe_in.sync_mode =
+			CAM_ISP_HW_SYNC_MASTER;
+		vfe_acquire.vfe_in.dual_hw_idx =
+			c_ctx->right_hw_idx;
+	} else
+		vfe_acquire.vfe_in.sync_mode =
+			CAM_ISP_HW_SYNC_NONE;
+
+	vfe_acquire.vfe_in.is_dual =
+		(uint32_t)c_ctx->flags.is_dual;
+
+	ife_src_res->res_type = vfe_acquire.rsrc_type;
+	ife_src_res->res_id = vfe_acquire.vfe_in.res_id;
+	ife_src_res->is_dual_isp = (uint32_t)c_ctx->flags.is_dual;
+
+	hw_intf = ife_hw_mgr->ife_devices[c_ctx->left_hw_idx]->hw_intf;
+	rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+		&vfe_acquire,
+		sizeof(struct cam_vfe_acquire_args));
+
+	if (rc || !vfe_acquire.vfe_in.rsrc_node) {
+		CAM_ERR(CAM_ISP, "Unable to acquire LEFT IFE res: %d ctx_idx: %u",
+			vfe_acquire.vfe_in.res_id, c_ctx->ctx_index);
+		rc = -EINVAL;
+		goto put_res;
+	}
+
+	ife_src_res->hw_res[CAM_ISP_HW_SPLIT_LEFT] = vfe_acquire.vfe_in.rsrc_node;
+	cam_ife_hw_mgr_put_res(&c_ctx->res_list_ife_src,
+		&ife_src_res);
+
+	*acquired_hw_id |= cam_convert_hw_idx_to_ife_hw_num(hw_intf->hw_idx);
+	acquired_hw_path[0] |= cam_convert_res_id_to_hw_path(
+		ife_src_res->hw_res[CAM_ISP_HW_SPLIT_LEFT]->res_id, -1);
+
+	CAM_DBG(CAM_ISP,
+		"acquire success LEFT IFE: %d res type: 0x%x res: %s res id: 0x%x ctx_idx: %u",
+		hw_intf->hw_idx,
+		ife_src_res->hw_res[0]->res_type,
+		ife_src_res->hw_res[0]->res_name,
+		ife_src_res->hw_res[0]->res_id, c_ctx->ctx_index);
+
+	if (c_ctx->flags.is_dual) {
+		vfe_acquire.vfe_in.rsrc_node = NULL;
+		vfe_acquire.vfe_in.sync_mode =
+			CAM_ISP_HW_SYNC_SLAVE;
+		vfe_acquire.vfe_in.dual_hw_idx =
+			c_ctx->left_hw_idx;
+
+		hw_intf = ife_hw_mgr->ife_devices[c_ctx->right_hw_idx]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&vfe_acquire,
+			sizeof(struct cam_vfe_acquire_args));
+
+		if (rc || !vfe_acquire.vfe_in.rsrc_node) {
+			CAM_ERR(CAM_ISP, "Unable to acquire right IFE res: %u, ctx_idx: %u",
+				vfe_acquire.vfe_in.res_id, c_ctx->ctx_index);
+			rc = -EINVAL;
+			goto put_res;
+		}
+
+		ife_src_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT] = vfe_acquire.vfe_in.rsrc_node;
+		*acquired_hw_id |=
+			cam_convert_hw_idx_to_ife_hw_num(hw_intf->hw_idx);
+		acquired_hw_path[1] |= cam_convert_res_id_to_hw_path(
+			ife_src_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT]->res_id, -1);
+		CAM_DBG(CAM_ISP,
+			"acquire success RIGHT IFE: %u res type: 0x%x res: %s res id: 0x%x ctx_idx: %u",
+			hw_intf->hw_idx,
+			ife_src_res->hw_res[1]->res_type,
+			ife_src_res->hw_res[1]->res_name,
+			ife_src_res->hw_res[1]->res_id, c_ctx->ctx_index);
+	}
+
+	return 0;
+
+put_res:
+	cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &ife_src_res);
+end:
+	/* release resource at the entry function */
+	return rc;
+}
+
+int cam_ife_hw_mgr_acquire_res_ife_src(
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool acquire_lcr, bool acquire_ppp, bool is_rdi_res,
+	uint32_t *acquired_hw_id,
+	uint32_t *acquired_hw_path,
+	uint32_t res_path_id,
+	int   index)
+{
+	int rc                = -1;
+	int i;
+	struct cam_isp_hw_mgr_res                  *csid_res;
+	struct cam_isp_hw_mgr_res                  *ife_src_res;
+	struct cam_vfe_acquire_args                 vfe_acquire;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_ife_hw_mgr                      *ife_hw_mgr;
+	struct cam_ife_hw_concrete_ctx             *c_ctx = ife_ctx->concr_ctx;
+	struct list_head                           *free_res_list_head;
+	struct list_head                           *csid_res_list_head;
+	struct list_head                           *ife_src_list_head;
+	bool     per_port_acquire, acquire_lcr_stream_grp = false;
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	if (in_port->per_port_en && (index != CAM_IFE_STREAM_GRP_INDEX_NONE)) {
+		per_port_acquire = true;
+		free_res_list_head = &g_ife_sns_grp_cfg.grp_cfg[index]->free_res_list;
+		csid_res_list_head = &g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_csid_list;
+		ife_src_list_head = &g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_src_list;
+	} else {
+		per_port_acquire = false;
+		free_res_list_head = &c_ctx->free_res_list;
+		csid_res_list_head = &c_ctx->res_list_ife_csid;
+		ife_src_list_head = &c_ctx->res_list_ife_src;
+	}
+
+	list_for_each_entry(csid_res, csid_res_list_head, list) {
+		if (!per_port_acquire) {
+			if (csid_res->num_children && !acquire_lcr)
+				continue;
+			} else {
+				if ((csid_res->res_id != res_path_id) && !(is_rdi_res &&
+					(csid_res->res_id >= CAM_IFE_PIX_PATH_RES_RDI_0 &&
+					csid_res->res_id <= CAM_IFE_PIX_PATH_RES_RDI_5)))
+					continue;
+			}
+
+			if (acquire_lcr && csid_res->res_id != CAM_IFE_PIX_PATH_RES_IPP)
+				continue;
+
+			if (csid_res->res_id == CAM_IFE_PIX_PATH_RES_PPP && !acquire_ppp)
+				continue;
+
+			if ((in_port->major_ver == 3) &&
+				((csid_res->res_id == CAM_IFE_PIX_PATH_RES_IPP) ||
+				(csid_res->res_id == CAM_IFE_PIX_PATH_RES_IPP_1) ||
+				(csid_res->res_id == CAM_IFE_PIX_PATH_RES_IPP_2))) {
+				list_for_each_entry(ife_src_res, &c_ctx->res_list_ife_src, list) {
+					if (ife_src_res->hw_res[CAM_ISP_HW_SPLIT_LEFT] &&
+						ife_src_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF)
+						goto skip_get_ife_src_res;
+				}
+			}
+		rc = cam_ife_hw_mgr_get_res(free_res_list_head,
+			&ife_src_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "No more free hw mgr resource, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+
+		cam_ife_hw_mgr_put_res(ife_src_list_head,
+			&ife_src_res);
+
+skip_get_ife_src_res:
+		vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_IN;
+		vfe_acquire.tasklet = c_ctx->common.tasklet_info;
+		vfe_acquire.vfe_in.cdm_ops = c_ctx->cdm_ops;
+		vfe_acquire.vfe_in.in_port = in_port;
+
+		vfe_acquire.vfe_in.is_fe_enabled = c_ctx->flags.is_fe_enabled;
+		vfe_acquire.vfe_in.is_offline = c_ctx->flags.is_offline;
+		vfe_acquire.vfe_in.handle_camif_irq = true;
+		vfe_acquire.per_port_acquire = per_port_acquire;
+
+		if (ife_hw_mgr->csid_camif_irq_support && c_ctx->ctx_type !=
+			CAM_IFE_CTX_TYPE_SFE)
+			vfe_acquire.vfe_in.handle_camif_irq = false;
+
+		if (ife_ctx->is_offline) {
+			vfe_acquire.priv = c_ctx->hw_mgr;
+			vfe_acquire.event_cb =
+				 cam_ife_hw_mgr_event_handler_offline;
+		} else {
+			vfe_acquire.priv = ife_ctx;
+			vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+
+		}
+
+		switch (csid_res->res_id) {
+		case CAM_IFE_PIX_PATH_RES_IPP:
+		case CAM_IFE_PIX_PATH_RES_IPP_1:
+		case CAM_IFE_PIX_PATH_RES_IPP_2:
+			if (!acquire_lcr) {
+				vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_CAMIF;
+				vfe_acquire.vfe_in.hw_ctxt_mask = in_port->ipp_dst_hw_ctxt_mask;
+			} else {
+				vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_LCR;
+			}
+
+			if (csid_res->is_dual_isp)
+				vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_MASTER;
+			else
+				vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+			vfe_acquire.vfe_in.is_dual = csid_res->is_dual_isp;
+
+			break;
+		case CAM_IFE_PIX_PATH_RES_PPP:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_PDLIB;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI0;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI1;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI2;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI3;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_4:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI4;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_5:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI5;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Wrong IFE CSID Path Resource ID : %d, ctx_idx: %u",
+				csid_res->res_id, c_ctx->ctx_index);
+			goto err;
+		}
+
+		if (csid_res->res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+			if (per_port_acquire && !csid_res->is_dual_isp)
+				acquire_lcr_stream_grp = true;
+
+			if (csid_res->is_dual_isp)
+				vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_MASTER;
+		}
+
+		ife_src_res->res_type = vfe_acquire.rsrc_type;
+		ife_src_res->res_id = vfe_acquire.vfe_in.res_id;
+		ife_src_res->is_dual_isp = csid_res->is_dual_isp;
+		ife_src_res->use_wm_pack = csid_res->use_wm_pack;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!csid_res->hw_res[i])
+				continue;
+
+			hw_intf = ife_hw_mgr->ife_devices[
+				csid_res->hw_res[i]->hw_intf->hw_idx]->hw_intf;
+
+			if (i == CAM_ISP_HW_SPLIT_LEFT &&
+				ife_src_res->is_dual_isp) {
+				vfe_acquire.vfe_in.dual_hw_idx =
+					c_ctx->right_hw_idx;
+			}
+
+			/* fill in more acquire information as needed */
+			/* slave Camif resource, */
+			if (i == CAM_ISP_HW_SPLIT_RIGHT && ife_src_res->is_dual_isp) {
+				vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_SLAVE;
+				vfe_acquire.vfe_in.dual_hw_idx = c_ctx->left_hw_idx;
+			}
+
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv, &vfe_acquire,
+					sizeof(struct cam_vfe_acquire_args));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire IFE HW res %d, ctx_idx: %u",
+					csid_res->res_id, c_ctx->ctx_index);
+				goto err;
+			}
+
+			ife_src_res->hw_res[i] = vfe_acquire.vfe_in.rsrc_node;
+			ife_src_res->hw_ctxt_id_mask |= vfe_acquire.vfe_in.hw_ctxt_mask;
+
+			if (per_port_acquire)
+				ife_src_res->linked = false;
+			else {
+				*acquired_hw_id |=
+					cam_convert_hw_idx_to_ife_hw_num(
+					hw_intf->hw_idx);
+
+			if (i >= CAM_MAX_HW_SPLIT) {
+				CAM_ERR(CAM_ISP, "HW split is invalid: %d ctx_idx: %u",
+					i, c_ctx->ctx_index);
+				return -EINVAL;
+			}
+
+			acquired_hw_path[i] |= cam_convert_res_id_to_hw_path(
+					ife_src_res->hw_res[i]->res_id, csid_res->res_id);
+			}
+
+			if (acquire_lcr_stream_grp) {
+				rc = cam_ife_hw_mgr_get_res(free_res_list_head, &ife_src_res);
+				if (rc) {
+					CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+					goto err;
+				}
+				cam_ife_hw_mgr_put_res(ife_src_list_head, &ife_src_res);
+
+				vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_LCR;
+
+				ife_src_res->res_type = vfe_acquire.rsrc_type;
+				ife_src_res->res_id = vfe_acquire.vfe_in.res_id;
+				ife_src_res->is_dual_isp = csid_res->is_dual_isp;
+				ife_src_res->use_wm_pack = csid_res->use_wm_pack;
+
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+						&vfe_acquire,
+						sizeof(struct cam_vfe_acquire_args));
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Can not acquire IFE HW res %d",
+						csid_res->res_id);
+					goto err;
+				}
+				ife_src_res->hw_res[0] = vfe_acquire.vfe_in.rsrc_node;
+				ife_src_res->linked = false;
+
+			CAM_DBG(CAM_ISP,
+				"acquire success IFE:%d ctx_idx: %u res type :0x%x res: %s res id:0x%x",
+				hw_intf->hw_idx, c_ctx->ctx_index,
+				ife_src_res->hw_res[i]->res_type,
+				ife_src_res->hw_res[i]->res_name,
+				ife_src_res->hw_res[i]->res_id);
+
+		}
+
+	}
+
+		if (!per_port_acquire)
+			csid_res->num_children++;
+	}
+
+	return 0;
+err:
+	/* release resource at the entry function */
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_csid_hw(
+	struct cam_ife_hw_mgr_ctx          *ife_ctx,
+	struct cam_csid_hw_reserve_resource_args  *csid_acquire,
+	struct cam_isp_in_port_generic_info *in_port,
+	int  index)
+{
+	int i;
+	int rc = -EINVAL;
+	struct cam_hw_intf  *hw_intf;
+	struct cam_ife_hw_mgr *ife_hw_mgr;
+	bool is_start_lower_idx = false;
+	struct cam_isp_hw_mgr_res *csid_res_iterator;
+	struct cam_isp_out_port_generic_info *out_port = NULL;
+	struct cam_ife_csid_hw_caps *csid_caps = NULL;
+	bool can_use_lite = false;
+	int busy_count = 0, compat_count = 0;
+	struct cam_ife_hw_concrete_ctx  *c_ctx = ife_ctx->concr_ctx;
+	struct list_head  *csid_res_list_head;
+
+
+	if (!c_ctx || !csid_acquire) {
+		CAM_ERR(CAM_ISP,
+			"Invalid args ife hw ctx %pK csid_acquire %pK",
+			c_ctx, csid_acquire);
+		return -EINVAL;
+	}
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE)
+		is_start_lower_idx =  true;
+
+	if (in_port->num_out_res)
+		out_port = &(in_port->data[0]);
+
+	c_ctx->flags.is_dual = (bool)in_port->usage_type;
+
+	if (c_ctx->ctx_type != CAM_IFE_CTX_TYPE_SFE)
+		can_use_lite = cam_ife_mgr_check_can_use_lite(
+			csid_acquire, ife_ctx);
+
+	if (ife_hw_mgr->csid_camif_irq_support && c_ctx->ctx_type != CAM_IFE_CTX_TYPE_SFE)
+		csid_acquire->handle_camif_irq = true;
+
+	if (in_port->per_port_en && (index != CAM_IFE_STREAM_GRP_INDEX_NONE)) {
+		csid_res_list_head = &g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_csid_list;
+		csid_acquire->per_port_grp_index = index;
+	} else {
+		csid_res_list_head = &c_ctx->res_list_ife_csid;
+		csid_acquire->per_port_grp_index = -1;
+	}
+
+	/* Try acquiring CSID from previously acquired HW */
+	list_for_each_entry(csid_res_iterator, csid_res_list_head,
+		list) {
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!csid_res_iterator->hw_res[i])
+				continue;
+			if (in_port->num_out_res &&
+				((csid_res_iterator->is_secure == 1 &&
+				out_port->secure_mode == 0) ||
+				(csid_res_iterator->is_secure == 0 &&
+				out_port->secure_mode == 1)))
+				continue;
+			if (!in_port->num_out_res &&
+				csid_res_iterator->is_secure == 1)
+				continue;
+
+			hw_intf = csid_res_iterator->hw_res[i]->hw_intf;
+			csid_caps =
+				&ife_hw_mgr->csid_hw_caps[hw_intf->hw_idx];
+
+			if (csid_caps->is_lite && !can_use_lite) {
+				CAM_DBG(CAM_ISP, "CSID[%u] cannot use lite, ctx_idx: %u",
+					hw_intf->hw_idx, c_ctx->ctx_index);
+				continue;
+			}
+
+			if (csid_caps->is_ife_sfe_mapped &&
+				(c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) &&
+				!ife_hw_mgr->sfe_devices[hw_intf->hw_idx]) {
+				CAM_DBG(CAM_ISP, "No sfe_device with idx: %d, ctx_idx: %u",
+					hw_intf->hw_idx, c_ctx->ctx_index);
+				continue;
+			}
+
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				csid_acquire, sizeof(*csid_acquire));
+			if (rc) {
+				CAM_DBG(CAM_ISP,
+					"No ife resource from hw %d, ctx_idx: %u",
+					hw_intf->hw_idx, c_ctx->ctx_index);
+				continue;
+			}
+			CAM_DBG(CAM_ISP,
+				"acquired from old csid(%s)=%d successfully, is_secure: %s, ctx_idx: %u",
+				(i == 0) ? "left" : "right",
+				hw_intf->hw_idx,
+				CAM_BOOL_TO_YESNO(csid_res_iterator->is_secure),
+				c_ctx->ctx_index);
+			goto acquire_successful;
+		}
+	}
+
+	for (i = (is_start_lower_idx) ? 0 : (CAM_IFE_CSID_HW_NUM_MAX - 1);
+		(is_start_lower_idx) ? (i < CAM_IFE_CSID_HW_NUM_MAX) : (i >= 0);
+		(is_start_lower_idx) ? i++ : i--) {
+		if (!ife_hw_mgr->csid_devices[i])
+			continue;
+		hw_intf = ife_hw_mgr->csid_devices[i];
+
+		if (ife_hw_mgr->csid_hw_caps[hw_intf->hw_idx].is_lite &&
+			!can_use_lite) {
+			CAM_DBG(CAM_ISP, "CSID[%u] cannot use lite, ctx_idx: %u",
+				hw_intf->hw_idx, c_ctx->ctx_index);
+			continue;
+		}
+
+		compat_count++;
+
+		if (ife_hw_mgr->csid_hw_caps[hw_intf->hw_idx].is_ife_sfe_mapped &&
+			(c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) &&
+			!ife_hw_mgr->sfe_devices[hw_intf->hw_idx]) {
+			CAM_DBG(CAM_ISP, "No sfe_device with idx: %d, ctx_idx: %u",
+				hw_intf->hw_idx, c_ctx->ctx_index);
+			continue;
+		}
+
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv, csid_acquire,
+			sizeof(struct cam_csid_hw_reserve_resource_args));
+		if (!rc)
+			return rc;
+
+		if (rc == -EBUSY)
+			busy_count++;
+		else
+			CAM_ERR(CAM_ISP, "CSID[%d] acquire failed (rc=%d), ctx_idx: %u",
+				i, rc, c_ctx->ctx_index);
+	}
+
+	if (compat_count == busy_count)
+		CAM_ERR(CAM_ISP, "all compatible CSIDs are busy, ctx_idx: %u", c_ctx->ctx_index);
+
+acquire_successful:
+	return rc;
+}
+
+static bool cam_ife_hw_mgr_is_need_csid_ipp(
+	struct cam_ife_hw_mgr_ctx            *ife_ctx,
+	struct cam_isp_in_port_generic_info  *in_port)
+{
+	struct cam_ife_hw_mgr           *hw_mgr;
+	struct cam_ife_hw_concrete_ctx  *c_ctx = ife_ctx->concr_ctx;
+	bool                     need = true;
+
+	hw_mgr = c_ctx->hw_mgr;
+
+	if (!(in_port->ipp_count || in_port->lcr_count))
+		need =  false;
+	else if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE &&
+		((hw_mgr->csid_hw_caps[0].sfe_ipp_input_rdi_res && !in_port->usage_type) ||
+		in_port->ife_rd_count))
+		need =  false;
+
+	CAM_DBG(CAM_ISP, "Need CSID PIX %u, Ctx_type: %u, ctx_idx: %u",
+		need, c_ctx->ctx_type, c_ctx->ctx_index);
+	return need;
+}
+
+static int cam_ife_mgr_util_process_csid_path_res(
+	struct cam_isp_in_port_generic_info *in_port,
+	enum cam_ife_pix_path_res_id        *path_res_id)
+{
+	if (!in_port) {
+		CAM_ERR(CAM_ISP, "Invalid in_port info");
+		return -EINVAL;
+	}
+
+	switch (in_port->path_id) {
+	case CAM_ISP_PXL_PATH:
+		*path_res_id = CAM_IFE_PIX_PATH_RES_IPP;
+		break;
+	case CAM_ISP_PXL1_PATH:
+		*path_res_id = CAM_IFE_PIX_PATH_RES_IPP_1;
+		break;
+	case CAM_ISP_PXL2_PATH:
+		*path_res_id = CAM_IFE_PIX_PATH_RES_IPP_2;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid csid path ID: 0x%x", in_port->path_id);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_ife_hw_mgr_acquire_res_ife_csid_pxl(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool                                 is_ipp,
+	bool                                 crop_enable,
+	int                                  index)
+{
+	int rc = 0, i;
+	struct cam_isp_out_port_generic_info     *out_port = NULL;
+	struct cam_isp_hw_mgr_res                *csid_res;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_csid_hw_reserve_resource_args  csid_acquire = {0};
+	enum cam_ife_pix_path_res_id              path_res_id;
+	struct cam_ife_csid_dual_sync_args        dual_sync_args = {0};
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	bool                                      per_port_acquire = false;
+	struct list_head                          *free_res_list_head;
+	struct list_head                          *csid_res_list_head;
+
+	if (is_ipp) {
+		if (in_port->major_ver == 3) {
+			rc = cam_ife_mgr_util_process_csid_path_res(in_port, &path_res_id);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Error in processing csid path resource rc:%d",
+					rc);
+				goto end;
+			}
+		} else {
+			path_res_id = CAM_IFE_PIX_PATH_RES_IPP;
+		}
+	} else {
+		path_res_id = CAM_IFE_PIX_PATH_RES_PPP;
+	}
+
+	if (in_port->per_port_en && (index != CAM_IFE_STREAM_GRP_INDEX_NONE)) {
+		per_port_acquire = true;
+		csid_res_list_head = &g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_csid_list;
+		free_res_list_head = &g_ife_sns_grp_cfg.grp_cfg[index]->free_res_list;
+
+	} else {
+		per_port_acquire = false;
+		free_res_list_head = &c_ctx->free_res_list;
+		csid_res_list_head = &c_ctx->res_list_ife_csid;
+	}
+
+	rc = cam_ife_hw_mgr_get_res(free_res_list_head, &csid_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource, ctx_idx: %u", c_ctx->ctx_index);
+		goto end;
+	}
+
+	csid_res->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+
+	csid_res->res_id = path_res_id;
+	c_ctx->flags.is_dual = (bool)in_port->usage_type;
+
+	if (in_port->usage_type && is_ipp)
+		csid_res->is_dual_isp = 1;
+	else {
+		csid_res->is_dual_isp = 0;
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+	}
+
+	if (in_port->num_out_res) {
+		out_port = &(in_port->data[0]);
+		csid_res->is_secure = out_port->secure_mode;
+	}
+
+	if (per_port_acquire) {
+		if (cam_ife_hw_mgr_update_vc_dt_stream_grp(csid_res, index, path_res_id, false))
+			return -EINVAL;
+		if ((!csid_res->vc) && (!csid_res->dt)) {
+			CAM_DBG(CAM_ISP, "no pixel path configurations");
+			rc = 0;
+			goto end;
+		}
+	}
+	CAM_DBG(CAM_ISP, "CSID Acq: Enter, ctx_idx: %u", c_ctx->ctx_index);
+	cam_ife_hw_mgr_put_res(csid_res_list_head, &csid_res);
+
+	/* for dual ife, acquire the right ife first */
+	for (i = csid_res->is_dual_isp; i >= 0 ; i--) {
+		CAM_DBG(CAM_ISP, "ctx_idx: %u i %d is_dual %d",
+			c_ctx->ctx_index, i, csid_res->is_dual_isp);
+
+		csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_acquire.res_id = path_res_id;
+		csid_acquire.in_port = in_port;
+		csid_acquire.out_port = in_port->data;
+		csid_acquire.node_res = NULL;
+		csid_acquire.cb_priv = ife_ctx;
+		csid_acquire.crop_enable = crop_enable;
+		csid_acquire.drop_enable = false;
+		csid_acquire.per_port_acquire = per_port_acquire;
+		if (per_port_acquire) {
+			csid_acquire.vc = csid_res->vc;
+			csid_acquire.dt = csid_res->dt;
+			csid_acquire.decode_format = csid_res->decode_format;
+		}
+
+		if (csid_res->is_dual_isp)
+			csid_acquire.sync_mode = i == CAM_ISP_HW_SPLIT_LEFT ?
+				CAM_ISP_HW_SYNC_MASTER : CAM_ISP_HW_SYNC_SLAVE;
+
+		csid_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		csid_acquire.tasklet = c_ctx->common.tasklet_info;
+		csid_acquire.cb_priv = ife_ctx;
+		csid_acquire.cdm_ops = c_ctx->cdm_ops;
+
+		rc = cam_ife_hw_mgr_acquire_csid_hw(ife_ctx,
+			&csid_acquire,
+			in_port, index);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Cannot acquire ife csid pxl path rsrc %s, ctx_idx: %u",
+				(is_ipp) ? "IPP" : "PPP", c_ctx->ctx_index);
+			goto end;
+		}
+		if (per_port_acquire)
+			csid_res->linked = false;
+
+		csid_res->hw_res[i] = csid_acquire.node_res;
+		hw_intf = csid_res->hw_res[i]->hw_intf;
+
+		if (!per_port_acquire) {
+			if (i == CAM_ISP_HW_SPLIT_LEFT) {
+				c_ctx->left_hw_idx = hw_intf->hw_idx;
+				c_ctx->buf_done_controller =
+				csid_acquire.buf_done_controller;
+			} else
+				c_ctx->right_hw_idx = hw_intf->hw_idx;
+		} else
+			c_ctx->right_hw_idx = hw_intf->hw_idx;
+
+		c_ctx->flags.need_csid_top_cfg = csid_acquire.need_top_cfg;
+
+		CAM_DBG(CAM_ISP,
+			"acquired csid(%s)=%d ctx_idx: %u pxl path rsrc %s successfully, is_secure: %s",
+			(i == 0) ? "left" : "right", hw_intf->hw_idx, c_ctx->ctx_index,
+			(is_ipp) ? "IPP" : "PPP",
+			CAM_BOOL_TO_YESNO(csid_res->is_secure));
+	}
+
+	if (!is_ipp)
+		goto end;
+
+	if (csid_res->is_dual_isp && c_ctx->flags.need_csid_top_cfg) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+
+			if (!csid_res->hw_res[i])
+				continue;
+
+			hw_intf = csid_res->hw_res[i]->hw_intf;
+
+			if (i == CAM_ISP_HW_SPLIT_LEFT) {
+				dual_sync_args.sync_mode =
+					CAM_ISP_HW_SYNC_MASTER;
+				dual_sync_args.dual_core_id =
+					c_ctx->right_hw_idx;
+
+			} else if (i == CAM_ISP_HW_SPLIT_RIGHT) {
+				dual_sync_args.sync_mode =
+					CAM_ISP_HW_SYNC_SLAVE;
+				dual_sync_args.dual_core_id =
+					c_ctx->left_hw_idx;
+			}
+
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_IFE_CSID_SET_DUAL_SYNC_CONFIG,
+				&dual_sync_args,
+				sizeof(
+				struct cam_ife_csid_dual_sync_args));
+		}
+	}
+
+end:
+	return rc;
+}
+
+enum cam_ife_pix_path_res_id
+	cam_ife_hw_mgr_get_ife_csid_rdi_res_type(
+	uint32_t                 out_port_type)
+{
+	enum cam_ife_pix_path_res_id path_id;
+
+	switch (out_port_type) {
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+	case CAM_ISP_SFE_OUT_RES_RDI_0:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI0:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_0;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+	case CAM_ISP_SFE_OUT_RES_RDI_1:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI1:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_1;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+	case CAM_ISP_SFE_OUT_RES_RDI_2:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI2:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_2;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+	case CAM_ISP_SFE_OUT_RES_RDI_3:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI3:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_3;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_4:
+	case CAM_ISP_SFE_OUT_RES_RDI_4:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI4:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_4;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_5:
+	case CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI5:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_5;
+		break;
+	default:
+		path_id = CAM_IFE_PIX_PATH_RES_MAX;
+		CAM_DBG(CAM_ISP, "maximum rdi output type exceeded");
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "out_port: 0x%x path_id: 0x%x",
+		out_port_type, path_id);
+
+	return path_id;
+}
+
+static int cam_ife_hw_mgr_acquire_csid_rdi_util(
+	struct cam_ife_hw_mgr_ctx            *ife_ctx,
+	struct cam_isp_in_port_generic_info  *in_port,
+	uint32_t                              path_res_id,
+	struct cam_isp_out_port_generic_info *out_port,
+	int                                   index)
+{
+	struct cam_isp_hw_mgr_res                *csid_res;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	struct cam_csid_hw_reserve_resource_args  csid_acquire;
+	int                                   out_res_count = 0;
+	bool                                  per_port_acquire;
+	struct list_head                      *free_res_list_head;
+	struct list_head                      *csid_res_list_head;
+	int                                       rc  = 0;
+
+	if (in_port->per_port_en && (index != CAM_IFE_STREAM_GRP_INDEX_NONE)) {
+		per_port_acquire = true;
+		free_res_list_head = &g_ife_sns_grp_cfg.grp_cfg[index]->free_res_list;
+		csid_res_list_head = &g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_csid_list;
+	} else {
+		per_port_acquire = false;
+		free_res_list_head = &c_ctx->free_res_list;
+		csid_res_list_head = &c_ctx->res_list_ife_csid;
+	}
+
+	rc = cam_ife_hw_mgr_get_res(free_res_list_head,
+		&csid_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource, ctx_idx: %u", c_ctx->ctx_index);
+		goto end;
+	}
+
+	if (per_port_acquire) {
+		if (cam_ife_hw_mgr_update_vc_dt_stream_grp(csid_res, index, path_res_id, true))
+			return -EINVAL;
+	}
+
+	memset(&csid_acquire, 0, sizeof(csid_acquire));
+	csid_acquire.res_id = path_res_id;
+	csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	csid_acquire.in_port = in_port;
+	csid_acquire.out_port = out_port;
+	csid_acquire.node_res = NULL;
+	csid_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+	csid_acquire.tasklet = c_ctx->common.tasklet_info;
+	csid_acquire.cb_priv = ife_ctx;
+	csid_acquire.cdm_ops = c_ctx->cdm_ops;
+	csid_acquire.per_port_acquire = per_port_acquire;
+	if (per_port_acquire) {
+		csid_acquire.vc = csid_res->vc;
+		csid_acquire.dt = csid_res->dt;
+		csid_acquire.decode_format = csid_res->decode_format;
+	}
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE)
+		csid_acquire.sfe_en = true;
+
+	if (out_port) {
+		if (cam_ife_hw_mgr_is_shdr_fs_rdi_res(out_port->res_type,
+			c_ctx->flags.is_sfe_shdr, c_ctx->flags.is_sfe_fs)) {
+			CAM_DBG(CAM_ISP, "setting inline shdr mode for res: 0x%x, ctx_idx: %u",
+					out_port->res_type, c_ctx->ctx_index);
+			csid_acquire.sfe_inline_shdr = true;
+			/*
+			 * Merged output will only be from the first n RDIs
+			 * starting from RDI0. Any other RDI[1:2] resource
+			 * if only being dumped will be considered as a
+			 * no merge resource
+			 */
+			if (c_ctx->flags.is_aeb_mode) {
+				if ((out_port->res_type - CAM_ISP_SFE_OUT_RES_RDI_0) >=
+					c_ctx->scratch_buf_info.num_fetches) {
+					csid_acquire.sec_evt_config.en_secondary_evt = true;
+					csid_acquire.sec_evt_config.evt_type = CAM_IFE_CSID_EVT_SOF;
+					CAM_DBG(CAM_ISP,
+						"Secondary SOF evt enabled for path: 0x%x, ctx_idx: %u",
+						out_port->res_type, c_ctx->ctx_index);
+				}
+
+				/* Enable EPOCH/SYNC frame drop for error monitoring on master */
+				if (out_port->res_type == CAM_ISP_SFE_OUT_RES_RDI_0) {
+					csid_acquire.sec_evt_config.en_secondary_evt = true;
+					csid_acquire.sec_evt_config.evt_type =
+						CAM_IFE_CSID_EVT_EPOCH |
+						CAM_IFE_CSID_EVT_SENSOR_SYNC_FRAME_DROP;
+					CAM_DBG(CAM_ISP,
+						"Secondary EPOCH & frame drop evt enabled for path: 0x%x, ctx_idx: %u",
+						out_port->res_type, c_ctx->ctx_index);
+				}
+			}
+		}
+		csid_res->is_secure = out_port->secure_mode;
+	}
+
+	if (in_port->usage_type)
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_MASTER;
+	else
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+	/*
+	 * Enable RDI pixel drop by default. CSID will enable only for
+	 * ver 480 HW to allow userspace to control pixel drop pattern.
+	 */
+	csid_acquire.drop_enable = true;
+	csid_acquire.crop_enable = true;
+	rc = cam_ife_hw_mgr_acquire_csid_hw(ife_ctx,
+		&csid_acquire, in_port, index);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"CSID Path reserve failed  rc=%d res_id=%d ctx_idx: %u",
+			rc, path_res_id, c_ctx->ctx_index);
+		goto put_res;
+	}
+
+	if (csid_acquire.node_res == NULL) {
+		CAM_ERR(CAM_ISP, "Acquire CSID RDI rsrc failed, ctx_idx: %u", c_ctx->ctx_index);
+
+		goto put_res;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"acquired csid[%u] rdi path rsrc %u successfully, is_secure: %s, ctx_idx: %u",
+		csid_acquire.node_res->hw_intf->hw_idx,
+		csid_acquire.node_res->res_id,
+		CAM_BOOL_TO_YESNO(csid_res->is_secure), c_ctx->ctx_index);
+
+	c_ctx->flags.need_csid_top_cfg = csid_acquire.need_top_cfg;
+	csid_res->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	csid_res->res_id = csid_acquire.res_id;
+	csid_res->is_dual_isp = 0;
+	csid_res->hw_res[0] = csid_acquire.node_res;
+	csid_res->hw_res[1] = NULL;
+	csid_res->use_wm_pack = csid_acquire.use_wm_pack;
+	if (per_port_acquire)
+		csid_res->linked = false;
+	if (c_ctx->left_hw_idx == CAM_IFE_CSID_HW_NUM_MAX)
+		c_ctx->left_hw_idx = csid_res->hw_res[0]->hw_intf->hw_idx;
+
+	if (!c_ctx->buf_done_controller && csid_acquire.buf_done_controller
+		&& !per_port_acquire)
+		c_ctx->buf_done_controller = csid_acquire.buf_done_controller;
+
+	cam_ife_hw_mgr_put_res(csid_res_list_head, &csid_res);
+
+	return 0;
+put_res:
+	cam_ife_hw_mgr_put_res(free_res_list_head, &csid_res);
+end:
+	return rc;
+
+}
+
+static int cam_ife_hw_mgr_get_csid_rdi_for_sfe_ipp_input(
+	struct cam_ife_hw_mgr_ctx            *ife_ctx,
+	struct cam_isp_in_port_generic_info  *in_port,
+	uint32_t                             *acquired_rdi_res)
+{
+	struct cam_ife_hw_mgr          *hw_mgr;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ife_ctx->concr_ctx;
+	uint32_t                        res_id = CAM_IFE_PIX_PATH_RES_MAX;
+	int                             rc = 0;
+
+	hw_mgr = c_ctx->hw_mgr;
+
+	if (hw_mgr->csid_hw_caps[0].sfe_ipp_input_rdi_res && !in_port->usage_type)
+		res_id = ffs(hw_mgr->csid_hw_caps[0].sfe_ipp_input_rdi_res) - 1;
+
+	if ((res_id != CAM_IFE_PIX_PATH_RES_MAX) && (!(BIT(res_id) & (*acquired_rdi_res)))) {
+		rc  = cam_ife_hw_mgr_acquire_csid_rdi_util(ife_ctx,
+			in_port, res_id, NULL, CAM_IFE_STREAM_GRP_INDEX_NONE);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire RDI Ctx: %u rdi:%d rc %d",
+				c_ctx->ctx_index, res_id, rc);
+			goto end;
+		}
+		*acquired_rdi_res |= BIT(res_id);
+	}
+
+	CAM_DBG(CAM_ISP, "Ctx: %u rdi_res:%d ctx_type %d rc %d", c_ctx->ctx_index,
+		res_id, c_ctx->ctx_type, rc);
+end:
+	return rc;
+}
+
+int cam_ife_hw_mgr_acquire_res_ife_csid_rdi(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t                            *acquired_rdi_res,
+	int                                  index,
+	bool                                 per_port_acquire)
+{
+	int                                    rc = 0;
+	int                                    i, j;
+	struct cam_isp_out_port_generic_info  *out_port = NULL;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ife_ctx->concr_ctx;
+	enum cam_ife_pix_path_res_id           res_id = CAM_IFE_PIX_PATH_RES_MAX;
+	uint32_t                               out_res_count = 0;
+	uint32_t                               rdi_yuv_conversion_stream_cnt = 0;
+	struct cam_ife_hw_mgr_stream_grp_config *grp_cfg;
+
+	if (in_port->per_port_en && (index != CAM_IFE_STREAM_GRP_INDEX_NONE)) {
+		out_res_count = (g_ife_sns_grp_cfg.grp_cfg[index]->rdi_stream_cfg_cnt -
+			g_ife_sns_grp_cfg.grp_cfg[index]->rdi_yuv_conversion_stream_cnt);
+
+		rdi_yuv_conversion_stream_cnt =
+			g_ife_sns_grp_cfg.grp_cfg[index]->rdi_yuv_conversion_stream_cnt;
+
+		grp_cfg = g_ife_sns_grp_cfg.grp_cfg[index];
+
+		CAM_DBG(CAM_ISP, "rdi_yuv_conversion_stream_cnt:%d out_res_count:%d",
+			rdi_yuv_conversion_stream_cnt, out_res_count);
+	} else {
+		out_res_count = in_port->num_out_res;
+	}
+
+	for (i = 0; i < out_res_count; i++) {
+		out_port = &in_port->data[i];
+		if (!per_port_acquire) {
+			res_id = cam_ife_hw_mgr_get_ife_csid_rdi_res_type(
+				out_port->res_type);
+
+		if (res_id == CAM_IFE_PIX_PATH_RES_MAX)
+			continue;
+		} else {
+			res_id = CAM_IFE_PIX_PATH_RES_RDI_0 + i;
+			if (res_id >= CAM_IFE_PIX_PATH_RES_RDI_3 &&
+				res_id <= CAM_IFE_PIX_PATH_RES_RDI_5) {
+				res_id = CAM_IFE_PIX_PATH_RES_RDI_1 + i;
+
+				if (res_id == CAM_IFE_PIX_PATH_RES_RDI_5) {
+					CAM_ERR(CAM_ISP, "Unsupported Usecase");
+					rc = -EINVAL;
+					break;
+				}
+			}
+		}
+
+		CAM_DBG(CAM_ISP, "Acquire Ctx: %u Res %d", c_ctx->ctx_index, res_id);
+		rc  = cam_ife_hw_mgr_acquire_csid_rdi_util(ife_ctx,
+				in_port, res_id, out_port,
+				index);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Ctx: %u Res %d acquire failed rc %d",
+				c_ctx->ctx_index, res_id, rc);
+			break;
+		}
+		*acquired_rdi_res |= BIT(res_id);
+	}
+
+	if (per_port_acquire) {
+		if (rdi_yuv_conversion_stream_cnt) {
+			for (i = 0; i < rdi_yuv_conversion_stream_cnt; i++) {
+				res_id = CAM_IFE_PIX_PATH_RES_RDI_3 + i;
+				if (res_id > CAM_IFE_PIX_PATH_RES_RDI_3)
+					res_id = CAM_IFE_PIX_PATH_RES_RDI_5;
+
+				CAM_DBG(CAM_ISP, "Acquire Ctx: %u Res %d",
+					c_ctx->ctx_index, res_id);
+				rc  = cam_ife_hw_mgr_acquire_csid_rdi_util(ife_ctx,
+						in_port, res_id, out_port,
+						index);
+				if (rc) {
+					CAM_ERR(CAM_ISP, "Ctx: %u Res %d acquire failed rc %d",
+						c_ctx->ctx_index, res_id, rc);
+					break;
+				}
+				*acquired_rdi_res |= BIT(res_id);
+			}
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Ctx: %u  rdi: %d", c_ctx->ctx_index, res_id);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_root(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	int rc = -1;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ife_ctx->concr_ctx;
+
+	if (c_ctx->res_list_ife_in.res_type == CAM_ISP_RESOURCE_UNINT) {
+		/* first acquire */
+		c_ctx->res_list_ife_in.res_type = CAM_ISP_RESOURCE_SRC;
+		c_ctx->res_list_ife_in.res_id = in_port->res_type;
+		c_ctx->res_list_ife_in.is_dual_isp = in_port->usage_type;
+	} else if ((c_ctx->res_list_ife_in.res_id !=
+		in_port->res_type) && (!c_ctx->flags.is_fe_enabled))  {
+		CAM_ERR(CAM_ISP, "No Free resource for this context, ctx_idx: %u",
+			c_ctx->ctx_index);
+		goto err;
+	} else {
+		/* else do nothing */
+	}
+	return 0;
+err:
+	/* release resource in entry function */
+	return rc;
+}
+
+static int cam_ife_mgr_check_and_update_fe_v0(
+	struct cam_ife_hw_mgr_ctx         *ife_ctx,
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size)
+{
+	int i;
+	struct cam_isp_in_port_info       *in_port = NULL;
+	uint32_t                           in_port_length = 0;
+	uint32_t                           total_in_port_length = 0;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = ife_ctx->concr_ctx;
+
+	if (acquire_hw_info->input_info_offset >=
+		acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP,
+			"Invalid size offset 0x%x is greater then size 0x%x, ctx_idx: %u",
+			acquire_hw_info->input_info_offset,
+			acquire_hw_info->input_info_size, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	in_port = (struct cam_isp_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+
+		if (((uint8_t *)in_port +
+			sizeof(struct cam_isp_in_port_info)) >
+			((uint8_t *)acquire_hw_info +
+			acquire_info_size)) {
+			CAM_ERR(CAM_ISP, "Invalid size, ctx_idx: %u", c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if ((in_port->num_out_res > max_ife_out_res) ||
+			(in_port->num_out_res <= 0)) {
+			CAM_ERR(CAM_ISP, "Invalid num output res %u ctx_idx: %u",
+				in_port->num_out_res, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		in_port_length = sizeof(struct cam_isp_in_port_info) +
+			(in_port->num_out_res - 1) *
+			sizeof(struct cam_isp_out_port_info);
+		total_in_port_length += in_port_length;
+
+		if (total_in_port_length > acquire_hw_info->input_info_size) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough, ctx_idx: %u",
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ISP, "in_port%d res_type %d ctx_idx: %u", i,
+			in_port->res_type, c_ctx->ctx_index);
+		if (in_port->res_type == CAM_ISP_IFE_IN_RES_RD) {
+			ife_ctx->concr_ctx->flags.is_fe_enabled = true;
+			break;
+		}
+
+		in_port = (struct cam_isp_in_port_info *)((uint8_t *)in_port +
+			in_port_length);
+	}
+	CAM_DBG(CAM_ISP, "is_fe_enabled %d, ctx_idx: %u",
+		ife_ctx->concr_ctx->flags.is_fe_enabled, c_ctx->ctx_index);
+
+	return 0;
+}
+
+static bool cam_ife_mgr_check_for_sfe_rd(
+	uint32_t sfe_in_path_type)
+{
+	if (((sfe_in_path_type & 0xFFFF) == CAM_ISP_SFE_IN_RD_0) ||
+		((sfe_in_path_type & 0xFFFF) == CAM_ISP_SFE_IN_RD_1) ||
+		((sfe_in_path_type & 0xFFFF) == CAM_ISP_SFE_IN_RD_2))
+		return true;
+	else
+		return false;
+}
+
+static int cam_ife_mgr_check_and_update_fe_v2(
+	struct cam_ife_hw_mgr_ctx         *ife_ctx,
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size,
+	struct cam_ife_mgr_bw_data        *bw_data)
+{
+	int i;
+	bool is_sfe_rd = false, fetch_cfg = false;
+	struct cam_isp_in_port_info_v2    *in_port = NULL;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = ife_ctx->concr_ctx;
+	uint32_t                           in_port_length = 0;
+	uint32_t                           total_in_port_length = 0;
+
+	if (acquire_hw_info->input_info_offset >=
+		acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP,
+			"Invalid size offset 0x%x is greater then size 0x%x ctx_idx: %u",
+			acquire_hw_info->input_info_offset,
+			acquire_hw_info->input_info_size, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+	in_port = (struct cam_isp_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+
+		if (((uint8_t *)in_port +
+			sizeof(struct cam_isp_in_port_info_v2)) >
+			((uint8_t *)acquire_hw_info +
+			acquire_info_size)) {
+			CAM_ERR(CAM_ISP, "Invalid size, ctx_idx: %u", c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if ((in_port->num_out_res > (max_ife_out_res +
+			max_sfe_out_res)) ||
+			(in_port->num_out_res <= 0)) {
+			CAM_ERR(CAM_ISP, "Invalid num output res %u, ctx_idx: %u",
+				in_port->num_out_res, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		in_port_length = sizeof(struct cam_isp_in_port_info_v2) +
+			(in_port->num_out_res - 1) *
+			sizeof(struct cam_isp_out_port_info_v2);
+		total_in_port_length += in_port_length;
+
+		if (total_in_port_length > acquire_hw_info->input_info_size) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough, ctx_idx: %u",
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ISP, "in_port%d res_type 0x%x ctx_idx: %u", i,
+			in_port->res_type, c_ctx->ctx_index);
+		is_sfe_rd = cam_ife_mgr_check_for_sfe_rd(in_port->sfe_in_path_type);
+		if (is_sfe_rd)
+			c_ctx->scratch_buf_info.num_fetches++;
+
+		if ((!fetch_cfg) && ((in_port->res_type == CAM_ISP_IFE_IN_RES_RD) ||
+			(is_sfe_rd))) {
+			c_ctx->flags.is_fe_enabled = true;
+
+			/* Check for offline */
+			if (in_port->offline_mode) {
+				c_ctx->flags.is_offline = true;
+				bw_data->format = in_port->format;
+				bw_data->width = in_port->left_width;
+				bw_data->height = in_port->height;
+				bw_data->framerate = in_port->ife_res_1;
+			}
+			/* Check for inline fetch modes */
+			if ((is_sfe_rd) && (!c_ctx->flags.is_offline)) {
+			/* Check for SFE FS mode - SFE PP bypass */
+				if (in_port->feature_flag & CAM_ISP_SFE_FS_MODE_EN)
+					c_ctx->flags.is_sfe_fs = true;
+				else
+					c_ctx->flags.is_sfe_shdr = true;
+			}
+
+			/* If once configured skip these checks thereafter */
+			fetch_cfg = true;
+		}
+
+		in_port = (struct cam_isp_in_port_info_v2 *)
+			((uint8_t *)in_port + in_port_length);
+	}
+
+	CAM_DBG(CAM_ISP,
+		"fe_enabled %d offline %d sfe_fs %d sfe_shdr: %d num_sfe_fetches: %u ctx_idx: %u",
+		c_ctx->flags.is_fe_enabled,
+		c_ctx->flags.is_offline,
+		c_ctx->flags.is_sfe_fs,
+		c_ctx->flags.is_sfe_shdr,
+		c_ctx->scratch_buf_info.num_fetches,
+		c_ctx->ctx_index);
+	return 0;
+}
+
+static int cam_ife_mgr_check_and_update_fe(
+	struct cam_ife_hw_mgr_ctx         *ife_ctx,
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size,
+	struct cam_ife_mgr_bw_data        *bw_data)
+{
+	uint32_t major_ver = 0, minor_ver = 0;
+
+	if (acquire_hw_info == NULL || ife_ctx == NULL)
+		return -EINVAL;
+
+	major_ver = (acquire_hw_info->common_info_version >> 12) & 0xF;
+	minor_ver = (acquire_hw_info->common_info_version) & 0xFFF;
+
+	switch (major_ver) {
+	case 1:
+		return cam_ife_mgr_check_and_update_fe_v0(
+			ife_ctx, acquire_hw_info,
+			acquire_info_size);
+	case 2:
+		return cam_ife_mgr_check_and_update_fe_v2(
+			ife_ctx, acquire_hw_info, acquire_info_size,
+			bw_data);
+	case 3:
+		CAM_DBG(CAM_ISP, "FE updates not applicable");
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid ver of user common info:  minor %u major %u",
+			minor_ver, major_ver);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_convert_out_port_to_csid_path(uint32_t port_id)
+{
+	uint32_t path_id = CAM_IFE_PIX_PATH_RES_MAX;
+
+	if (port_id >= (CAM_ISP_IFE_OUT_RES_BASE + max_ife_out_res))
+		goto end;
+
+	path_id = cam_ife_hw_mgr_get_ife_csid_rdi_res_type(port_id);
+	if (path_id >= CAM_IFE_PIX_PATH_RES_RDI_0 && path_id <= CAM_IFE_PIX_PATH_RES_RDI_4)
+		return path_id;
+	else if (cam_ife_hw_mgr_check_path_port_compat(CAM_ISP_HW_VFE_IN_PDLIB,
+		port_id))
+		path_id =  CAM_IFE_PIX_PATH_RES_PPP;
+	else
+		path_id = CAM_IFE_PIX_PATH_RES_IPP;
+
+end:
+		return path_id;
+}
+
+static int cam_ife_hw_mgr_preprocess_port(
+	struct cam_ife_hw_mgr_ctx   *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	uint32_t i;
+	struct cam_isp_out_port_generic_info *out_port;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ife_ctx->concr_ctx;
+
+	if (in_port->res_type == CAM_ISP_IFE_IN_RES_RD ||
+		in_port->sfe_in_path_type == CAM_ISP_SFE_IN_RD_0 ||
+		in_port->sfe_in_path_type == CAM_ISP_SFE_IN_RD_1 ||
+		in_port->sfe_in_path_type == CAM_ISP_SFE_IN_RD_2)
+		in_port->ife_rd_count++;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		if (cam_ife_hw_mgr_is_rdi_res(out_port->res_type)) {
+			in_port->rdi_count++;
+			in_port->lite_path_count++;
+		}
+		else if (cam_ife_hw_mgr_is_sfe_rdi_res(out_port->res_type))
+			in_port->rdi_count++;
+		else if (cam_ife_hw_mgr_check_path_port_compat(CAM_ISP_HW_VFE_IN_PDLIB,
+				out_port->res_type))
+			in_port->ppp_count++;
+		else if (cam_ife_hw_mgr_check_path_port_compat(CAM_ISP_HW_VFE_IN_LCR,
+				out_port->res_type))
+			in_port->lcr_count++;
+		else {
+			CAM_DBG(CAM_ISP, "out_res_type 0x%x, ife_ctx_idx: %u",
+				out_port->res_type, c_ctx->ctx_index);
+			if ((in_port->major_ver == 3) && (in_port->path_id &
+				(CAM_ISP_PXL_PATH | CAM_ISP_PXL1_PATH | CAM_ISP_PXL2_PATH))) {
+				CAM_DBG(CAM_ISP,
+					"preprocess csid path resource: 0x%x, ipp_dst_hw_ctxt_mask: 0x%x, outport ctxt_id: %d",
+					in_port->path_id, in_port->ipp_dst_hw_ctxt_mask,
+					out_port->hw_context_id);
+				in_port->ipp_dst_hw_ctxt_mask |= out_port->hw_context_id;
+			}
+
+			in_port->ipp_count++;
+
+			if (in_port->can_use_lite) {
+				switch(out_port->res_type) {
+				case CAM_ISP_IFE_LITE_OUT_RES_PREPROCESS_RAW:
+				case CAM_ISP_IFE_LITE_OUT_RES_STATS_BG:
+					in_port->lite_path_count++;
+				break;
+				default:
+					CAM_WARN(CAM_ISP,
+						"Output port 0x%x cannot use lite, ctx: %u",
+						out_port->res_type, c_ctx->ctx_index);
+				}
+			}
+		}
+
+		if ((out_port->res_type >=  CAM_ISP_SFE_OUT_RES_BASE) &&
+			(out_port->res_type < (CAM_ISP_SFE_OUT_RES_BASE + max_sfe_out_res)))
+			in_port->sfe_port_count++;
+	}
+
+	CAM_DBG(CAM_ISP, "ife_ctx_idx: %u rdi: %d ipp: %d ppp: %d ife_rd: %d lcr: %d",
+		c_ctx->ctx_index, in_port->rdi_count, in_port->ipp_count,
+		in_port->ppp_count, in_port->ife_rd_count,
+		in_port->lcr_count,
+		in_port->sfe_port_count);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_acquire_offline_res_ife_camif(
+	struct cam_ife_hw_mgr_ctx                  *ife_ctx,
+	struct cam_isp_in_port_generic_info        *in_port,
+	bool                                        acquire_lcr,
+	uint32_t                                   *acquired_hw_id,
+	uint32_t                                   *acquired_hw_path)
+{
+	int                                         rc = -1;
+	int                                         i;
+	struct cam_ife_hw_concrete_ctx             *c_ctx = ife_ctx->concr_ctx;
+	struct cam_vfe_acquire_args                 vfe_acquire;
+	struct cam_hw_intf                         *hw_intf = NULL;
+	struct cam_isp_hw_mgr_res                  *ife_src_res;
+	struct cam_isp_hw_mgr_res                  *isp_bus_rd_res;
+	struct cam_ife_hw_mgr                      *ife_hw_mgr;
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	isp_bus_rd_res = list_first_entry(&c_ctx->res_list_ife_in_rd,
+		struct cam_isp_hw_mgr_res, list);
+	if (!isp_bus_rd_res) {
+		CAM_ERR(CAM_ISP, "BUS RD resource has not been acquired, ctx_idx: %u",
+			c_ctx->ctx_index);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list, &ife_src_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No free resource, ctx_idx: %u", c_ctx->ctx_index);
+		goto end;
+	}
+
+	vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_IN;
+	vfe_acquire.tasklet = c_ctx->common.tasklet_info;
+	if (ife_ctx->is_offline) {
+		vfe_acquire.priv = ife_hw_mgr;
+		vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler_offline;
+	} else {
+		vfe_acquire.priv = ife_ctx;
+		vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+	}
+
+	vfe_acquire.vfe_in.cdm_ops = c_ctx->cdm_ops;
+	vfe_acquire.vfe_in.in_port = in_port;
+	vfe_acquire.vfe_in.is_fe_enabled = c_ctx->flags.is_fe_enabled;
+	vfe_acquire.vfe_in.is_offline = c_ctx->flags.is_offline;
+	vfe_acquire.vfe_in.handle_camif_irq = true;
+	if (ife_hw_mgr->csid_camif_irq_support && c_ctx->ctx_type !=
+		CAM_IFE_CTX_TYPE_SFE)
+		vfe_acquire.vfe_in.handle_camif_irq = false;
+
+	if (!acquire_lcr)
+		vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_CAMIF;
+	else
+		vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_LCR;
+
+	if (c_ctx->flags.is_dual)
+		vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_MASTER;
+	else
+		vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (!ife_hw_mgr->ife_devices[i])
+			continue;
+
+		hw_intf = ife_hw_mgr->ife_devices[i]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv, &vfe_acquire,
+			sizeof(struct cam_vfe_acquire_args));
+
+		if (rc)
+			continue;
+		else
+			break;
+	}
+
+	if (i == CAM_IFE_HW_NUM_MAX || rc ||
+			!vfe_acquire.vfe_in.rsrc_node) {
+		CAM_ERR(CAM_ISP, "Failed to acquire IFE LEFT rc: %d, ctx_idx: %u",
+			rc, c_ctx->ctx_index);
+		goto put_res;
+	}
+
+	ife_src_res->hw_res[0] = vfe_acquire.vfe_in.rsrc_node;
+	*acquired_hw_id |= cam_convert_hw_idx_to_ife_hw_num(
+		hw_intf->hw_idx);
+	acquired_hw_path[i] |= cam_convert_res_id_to_hw_path(
+		ife_src_res->hw_res[0]->res_id, -1);
+
+	CAM_DBG(CAM_ISP, "Acquired VFE:%d CAMIF for LEFT, ctx_idx: %u",
+		ife_src_res->hw_res[0]->hw_intf->hw_idx, c_ctx->ctx_index);
+
+	ife_src_res->res_type = vfe_acquire.rsrc_type;
+	ife_src_res->res_id = vfe_acquire.vfe_in.res_id;
+	ife_src_res->is_dual_isp = (uint32_t)c_ctx->flags.is_dual;
+	cam_ife_hw_mgr_put_res(&c_ctx->res_list_ife_src, &ife_src_res);
+	if (c_ctx->flags.is_dual) {
+		vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_SLAVE;
+		vfe_acquire.vfe_in.rsrc_node = NULL;
+		for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+			if (!ife_hw_mgr->ife_devices[i])
+				continue;
+
+			if (i == ife_src_res->hw_res[0]->hw_intf->hw_idx)
+				continue;
+
+			hw_intf = ife_hw_mgr->ife_devices[i]->hw_intf;
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&vfe_acquire,
+				sizeof(struct cam_vfe_acquire_args));
+
+			if (rc)
+				continue;
+			else
+				break;
+		}
+
+		if (rc || !vfe_acquire.vfe_in.rsrc_node) {
+			CAM_ERR(CAM_ISP, "Failed to acquire IFE RIGHT rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+			goto end;
+		}
+
+		ife_src_res->hw_res[1] = vfe_acquire.vfe_in.rsrc_node;
+
+		*acquired_hw_id |= cam_convert_hw_idx_to_ife_hw_num(
+			hw_intf->hw_idx);
+
+		acquired_hw_path[i] |= cam_convert_res_id_to_hw_path(
+			ife_src_res->hw_res[1]->res_id, -1);
+
+		CAM_DBG(CAM_ISP, "Acquired VFE:%d CAMIF for RIGHT, ctx_idx: %u",
+			ife_src_res->hw_res[1]->hw_intf->hw_idx, c_ctx->ctx_index);
+	}
+
+	return rc;
+
+put_res:
+	cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &ife_src_res);
+
+end:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_offline_res_sfe(
+	struct cam_ife_hw_mgr_ctx                  *ife_ctx,
+	struct cam_isp_in_port_generic_info        *in_port)
+{
+	int                                         rc = -1;
+	int                                         i = CAM_ISP_HW_SPLIT_LEFT;
+	struct cam_ife_hw_concrete_ctx             *c_ctx = ife_ctx->concr_ctx;
+	struct cam_sfe_acquire_args                 sfe_acquire;
+	struct cam_isp_hw_mgr_res                  *sfe_src_res;
+	struct cam_isp_hw_mgr_res                  *sfe_bus_rd_res;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_ife_hw_mgr                      *ife_hw_mgr;
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	sfe_bus_rd_res = list_first_entry(&c_ctx->res_list_ife_in_rd,
+		struct cam_isp_hw_mgr_res, list);
+
+	if (!sfe_bus_rd_res) {
+		CAM_ERR(CAM_ISP, "BUS RD resource has not been acquired, ctx_idx: %u",
+			c_ctx->ctx_index);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list, &sfe_src_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No free resource, ctx_idx: %u", c_ctx->ctx_index);
+		goto end;
+	}
+
+	sfe_acquire.rsrc_type = CAM_ISP_RESOURCE_SFE_IN;
+	sfe_acquire.tasklet = c_ctx->common.tasklet_info;
+	if (ife_ctx->is_offline) {
+		sfe_acquire.priv = ife_hw_mgr;
+		sfe_acquire.event_cb = cam_ife_hw_mgr_event_handler_offline;
+	} else {
+		sfe_acquire.priv = ife_ctx;
+		sfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+	}
+
+	sfe_acquire.sfe_in.cdm_ops = c_ctx->cdm_ops;
+	sfe_acquire.sfe_in.in_port = in_port;
+	sfe_acquire.sfe_in.is_offline = c_ctx->flags.is_offline;
+	if (c_ctx->sfe_rd_only)
+		sfe_acquire.sfe_in.res_id = CAM_ISP_HW_SFE_IN_RD;
+	else
+		sfe_acquire.sfe_in.res_id = CAM_ISP_HW_SFE_IN_PIX;
+
+	hw_intf = ife_hw_mgr->sfe_devices[
+		sfe_bus_rd_res->hw_res[i]->hw_intf->hw_idx]->hw_intf;
+
+	rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv, &sfe_acquire,
+		sizeof(struct cam_sfe_acquire_args));
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Failed to acquire SFE PIX for offline, ctx_idx: %u", c_ctx->ctx_index);
+		goto put_res;
+	}
+
+	sfe_src_res->hw_res[i] = sfe_acquire.sfe_in.rsrc_node;
+	CAM_DBG(CAM_ISP, "Acquired SFE: %u PIX LEFT for offline, ctx_idx: %u",
+		sfe_src_res->hw_res[i]->hw_intf->hw_idx, c_ctx->ctx_index);
+
+	sfe_src_res->res_type = sfe_acquire.rsrc_type;
+	sfe_src_res->res_id = sfe_acquire.sfe_in.res_id;
+	sfe_src_res->is_dual_isp = in_port->usage_type;
+	cam_ife_hw_mgr_put_res(&c_ctx->res_list_sfe_src, &sfe_src_res);
+
+	if (c_ctx->flags.is_dual) {
+		CAM_WARN(CAM_ISP,
+			"DUAL not supported for offline use-case, ctx_idx: %u", c_ctx->ctx_index);
+
+		sfe_acquire.sfe_in.rsrc_node = NULL;
+		hw_intf = ife_hw_mgr->sfe_devices[
+			sfe_bus_rd_res->hw_res[++i]->hw_intf->hw_idx]->hw_intf;
+
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv, &sfe_acquire,
+			sizeof(struct cam_sfe_acquire_args));
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed to acquire SFE PIX for RIGHT, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto end;
+		}
+
+		sfe_src_res->hw_res[i] = sfe_acquire.sfe_in.rsrc_node;
+		CAM_DBG(CAM_ISP, "Acquired SFE:%d PIX RIGHT for offline, ctx_idx: %u",
+			sfe_src_res->hw_res[i]->hw_intf->hw_idx, c_ctx->ctx_index);
+	}
+
+	sfe_bus_rd_res->num_children++;
+
+	return rc;
+
+put_res:
+	cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &sfe_src_res);
+end:
+	return rc;
+}
+
+/* Acquire CSID for offline SFE */
+static int cam_ife_hw_mgr_acquire_offline_res_csid(
+	struct cam_ife_hw_mgr_ctx                  *ife_ctx,
+	struct cam_isp_in_port_generic_info        *in_port)
+{
+	int                                         rc = -1;
+	uint32_t                                    path_res_id = 0;
+	struct cam_ife_hw_concrete_ctx             *c_ctx = ife_ctx->concr_ctx;
+	struct cam_csid_hw_reserve_resource_args    csid_acquire;
+	struct cam_isp_hw_mgr_res                  *sfe_bus_rd_res;
+	struct cam_isp_hw_mgr_res                  *csid_res;
+
+	sfe_bus_rd_res = list_first_entry(&c_ctx->res_list_ife_in_rd,
+		struct cam_isp_hw_mgr_res, list);
+
+	if (!sfe_bus_rd_res) {
+		CAM_ERR(CAM_ISP, "BUS RD resource has not been acquired, ctx_idx: %u",
+			c_ctx->ctx_index);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	path_res_id = cam_ife_hw_mgr_get_csid_rdi_type_for_offline(
+			sfe_bus_rd_res->res_id);
+
+	if (path_res_id == CAM_IFE_PIX_PATH_RES_MAX)
+		return -EINVAL;
+
+	rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list,
+			&csid_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource, ctx_idx: %u", c_ctx->ctx_index);
+		goto end;
+	}
+
+	memset(&csid_acquire, 0, sizeof(csid_acquire));
+	csid_acquire.res_id = path_res_id;
+	csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	csid_acquire.in_port = in_port;
+	csid_acquire.out_port = in_port->data;
+	csid_acquire.node_res = NULL;
+	csid_acquire.tasklet = c_ctx->common.tasklet_info;
+	csid_acquire.cdm_ops = c_ctx->cdm_ops;
+	csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+	csid_acquire.is_offline = true;
+	if (ife_ctx->is_offline) {
+		csid_acquire.cb_priv = c_ctx->hw_mgr;
+		csid_acquire.event_cb = cam_ife_hw_mgr_event_handler_offline;
+	} else {
+		csid_acquire.cb_priv = ife_ctx;
+		csid_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+	}
+
+	rc = cam_ife_hw_mgr_acquire_csid_hw(ife_ctx,
+		&csid_acquire, in_port,
+		CAM_IFE_STREAM_GRP_INDEX_NONE);
+
+	if (rc || (csid_acquire.node_res == NULL)) {
+		CAM_ERR(CAM_ISP,
+			"CSID Path reserve failed  rc=%d res_id=%d ctx_idx: %u",
+			rc, path_res_id, c_ctx->ctx_index);
+		goto put_res;
+	}
+
+	csid_res->hw_res[CAM_ISP_HW_SPLIT_LEFT] = csid_acquire.node_res;
+
+	if (!c_ctx->buf_done_controller && csid_acquire.buf_done_controller)
+		c_ctx->buf_done_controller = csid_acquire.buf_done_controller;
+
+	c_ctx->flags.need_csid_top_cfg = csid_acquire.need_top_cfg;
+	csid_res->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	csid_res->res_id = csid_acquire.res_id;
+	csid_res->is_dual_isp = 0;
+	csid_res->hw_res[0] = csid_acquire.node_res;
+	csid_res->hw_res[1] = NULL;
+	c_ctx->left_hw_idx  = csid_acquire.node_res->hw_intf->hw_idx;
+	cam_ife_hw_mgr_put_res(&c_ctx->res_list_ife_csid, &csid_res);
+
+	return 0;
+
+put_res:
+	cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &csid_res);
+
+end:
+	return rc;
+}
+
+/* Acquire CSID & SFE for offline */
+static int cam_ife_mgr_acquire_hw_sfe_offline(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t                            *acquired_hw_id,
+	uint32_t                            *acquired_hw_path)
+{
+	int rc;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ife_ctx->concr_ctx;
+
+	rc = cam_ife_hw_mgr_acquire_sfe_bus_rd(
+		ife_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire SFE BUS RD resource Failed, ctx_idx: %u",
+			c_ctx->ctx_index);
+		goto err;
+	}
+
+	rc = cam_ife_hw_mgr_acquire_offline_res_csid(ife_ctx,
+			in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Acquire IFE CSID RDI0 resource Failed, ctx_idx: %u", c_ctx->ctx_index);
+			goto err;
+	}
+
+	rc = cam_ife_hw_mgr_acquire_offline_res_sfe(
+		ife_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Acquire SFE PIX SRC resource Failed, ctx_idx: %u", c_ctx->ctx_index);
+		goto err;
+	}
+
+	if (in_port->sfe_ife_enable) {
+		if (in_port->ipp_count) {
+			rc = cam_ife_hw_mgr_acquire_offline_res_ife_camif(
+				ife_ctx, in_port, false,
+				acquired_hw_id, acquired_hw_path);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Acquire IFE IPP SRC resource Failed, ctx_idx: %u",
+					c_ctx->ctx_index);
+				goto err;
+			}
+		}
+
+		if (in_port->lcr_count) {
+			rc = cam_ife_hw_mgr_acquire_offline_res_ife_camif(
+					ife_ctx, in_port, true,
+					acquired_hw_id, acquired_hw_path);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Acquire IFE LCR SRC resource Failed, ctx_idx: %u",
+					c_ctx->ctx_index);
+				goto err;
+			}
+		}
+
+		rc = cam_ife_hw_mgr_acquire_res_ife_out(
+			ife_ctx, in_port,
+			CAM_IFE_STREAM_GRP_INDEX_NONE);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE OUT resource Failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	rc = cam_ife_hw_mgr_acquire_res_sfe_out(ife_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Acquire SFE OUT resource Failed, ctx_idx: %u", c_ctx->ctx_index);
+			goto err;
+	}
+
+	return 0;
+err:
+	return rc;
+}
+
+/* Acquire HWs for IFE fetch engine archs */
+static int cam_ife_mgr_acquire_hw_ife_offline(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t                            *acquired_hw_id,
+	uint32_t                            *acquired_hw_path)
+{
+	int                                  rc = -1;
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ife_ctx->concr_ctx;
+
+	c_ctx->flags.is_dual = (bool)in_port->usage_type;
+
+	rc = cam_ife_hw_mgr_acquire_res_ife_bus_rd(ife_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE BUS RD resource Failed, ctx_idx: %u",
+			c_ctx->ctx_index);
+		goto err;
+	}
+
+	if (in_port->ipp_count)
+		rc = cam_ife_hw_mgr_acquire_offline_res_ife_camif(ife_ctx,
+			in_port, false, acquired_hw_id, acquired_hw_path);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE IPP SRC resource Failed, ctx_idx: %u",
+			c_ctx->ctx_index);
+		goto err;
+	}
+
+	if (in_port->lcr_count)
+		rc = cam_ife_hw_mgr_acquire_offline_res_ife_camif(ife_ctx,
+			in_port, true, acquired_hw_id, acquired_hw_path);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE LCR SRC resource Failed, ctx_idx: %u",
+			c_ctx->ctx_index);
+		goto err;
+	}
+
+	rc = cam_ife_hw_mgr_acquire_res_ife_out(ife_ctx, in_port,
+			CAM_IFE_STREAM_GRP_INDEX_NONE);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE OUT resource Failed, ctx_idx: %u",
+			c_ctx->ctx_index);
+		goto err;
+	}
+
+	return 0;
+
+err:
+	return rc;
+}
+
+static int cam_ife_mgr_acquire_hw_for_offline_ctx(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t                            *acquired_hw_id,
+	uint32_t                            *acquired_hw_path)
+{
+	int rc = -EINVAL;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ife_ctx->concr_ctx;
+
+	c_ctx->flags.is_dual = (bool)in_port->usage_type;
+	if ((!in_port->ipp_count && !in_port->lcr_count) ||
+		!in_port->ife_rd_count) {
+		CAM_ERR(CAM_ISP,
+			"Invalid %d BUS RD %d PIX %d LCR ports for FE ctx: %u",
+			in_port->ife_rd_count, in_port->ipp_count, in_port->lcr_count,
+			c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	if (in_port->rdi_count || in_port->ppp_count) {
+		CAM_ERR(CAM_ISP,
+			"%d RDI %d PPP ports invalid for FE ctx_idx: %u",
+			in_port->rdi_count, in_port->ppp_count, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE)
+		rc = cam_ife_mgr_acquire_hw_sfe_offline(
+			ife_ctx, in_port, acquired_hw_id, acquired_hw_path);
+	else
+		rc = cam_ife_mgr_acquire_hw_ife_offline(
+			ife_ctx, in_port, acquired_hw_id, acquired_hw_path);
+
+	return rc;
+}
+
+
+static int cam_ife_mgr_acquire_hw_for_ctx(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t *acquired_hw_id,
+	uint32_t *acquired_hw_path,
+	uint32_t *acquired_rdi_res)
+{
+	int rc                                    = -1;
+	bool crop_enable                          = true;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+
+	c_ctx->flags.dsp_enabled = (bool)in_port->dsp_mode;
+	c_ctx->flags.is_dual = (bool)in_port->usage_type;
+
+	/* Update aeb mode for the given in_port once */
+	if ((in_port->aeb_mode) && (!c_ctx->flags.is_aeb_mode))
+		c_ctx->flags.is_aeb_mode = true;
+
+	/* get root node resource */
+	rc = cam_ife_hw_mgr_acquire_res_root(ife_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Can not acquire root resource, ctx_idx: %u", c_ctx->ctx_index);
+		goto err;
+	}
+
+	if (!in_port->ipp_count && !in_port->rdi_count &&
+		!in_port->ppp_count && !in_port->lcr_count) {
+
+		CAM_ERR(CAM_ISP,
+			"No PIX or RDI or PPP or LCR resource, ctx_idx: %u", c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	if (in_port->per_port_en && c_ctx->ctx_type == CAM_IFE_CTX_TYPE_NONE &&
+		!(bool)in_port->usage_type) {
+		rc = cam_ife_hw_mgr_acquire_res_stream_grp(ife_ctx, in_port,
+			acquired_hw_id, acquired_hw_path, acquired_rdi_res, crop_enable);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not support per port feature");
+			goto err;
+		}
+		goto virtual_hw_acquire;
+	} else {
+		CAM_DBG(CAM_ISP,
+			"No per port feature support: %d sensor_id: 0x%x ife-ctx-type: %d",
+			in_port->per_port_en, in_port->sensor_id, c_ctx->ctx_type);
+	}
+
+	/* get ife csid IPP resource */
+	if (cam_ife_hw_mgr_is_need_csid_ipp(ife_ctx, in_port)) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_csid_pxl(ife_ctx,
+			in_port, true, crop_enable,
+			CAM_IFE_STREAM_GRP_INDEX_NONE);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire IFE CSID IPP/LCR resource Failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	if (in_port->ppp_count) {
+		/* get ife csid PPP resource */
+
+		/* If both IPP and PPP paths are requested with the same vc dt
+		 * it is implied that the sensor is a type 3 PD sensor. Crop
+		 * must be enabled for this sensor on PPP path as well.
+		 */
+		if (!in_port->ipp_count)
+			crop_enable = false;
+
+		rc = cam_ife_hw_mgr_acquire_res_ife_csid_pxl(ife_ctx,
+			in_port, false, crop_enable,
+			CAM_IFE_STREAM_GRP_INDEX_NONE);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE CSID PPP resource Failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	if (in_port->rdi_count) {
+		/* get ife csid RDI resource */
+		rc = cam_ife_hw_mgr_acquire_res_ife_csid_rdi(ife_ctx, in_port,
+			acquired_rdi_res,
+			CAM_IFE_STREAM_GRP_INDEX_NONE, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE CSID RDI resource Failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Acquired CSID resource, is_dual:%s left_hw_idx:%d right_hw_idx:%d",
+		CAM_BOOL_TO_YESNO(c_ctx->flags.is_dual),
+		c_ctx->left_hw_idx, c_ctx->right_hw_idx);
+
+	if (in_port->ife_rd_count) {
+		if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE)
+			rc = cam_ife_hw_mgr_acquire_sfe_bus_rd(
+				ife_ctx, in_port);
+		else
+			rc = cam_ife_hw_mgr_acquire_res_ife_bus_rd(
+				ife_ctx, in_port);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire %s BUS RD resource Failed, ctx_idx: %u",
+				(c_ctx->ctx_type ==
+				CAM_IFE_CTX_TYPE_SFE) ? "SFE" : "IFE", c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	/* try acquire RDI for SFE cases without RDI out ports,
+	 * this is specifically for targets having RDI as input
+	 * to SFE IPP
+	 */
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		rc = cam_ife_hw_mgr_get_csid_rdi_for_sfe_ipp_input(ife_ctx, in_port,
+			acquired_rdi_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire RDI for SFE IPP failed Ctx: %d rc %d",
+				c_ctx->ctx_index, rc);
+			goto err;
+		}
+	}
+
+	/* acquire SFE input resource */
+	if ((c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) &&
+		(in_port->ipp_count || in_port->rdi_count)) {
+		rc = cam_ife_hw_mgr_acquire_res_sfe_src(ife_ctx,
+			in_port, acquired_hw_id, acquired_hw_path);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire SFE SRC resource failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	/* get ife IPP src resource */
+	if (in_port->ipp_count) {
+		if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+			if (in_port->sfe_ife_enable)
+				rc = cam_ife_hw_mgr_acquire_ife_src_for_sfe(
+					ife_ctx, in_port, false,
+					acquired_hw_id, acquired_hw_path);
+		} else {
+			rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx,
+				in_port, false, false, false,
+				acquired_hw_id, acquired_hw_path,
+				CAM_IFE_PIX_PATH_RES_IPP,
+				CAM_IFE_STREAM_GRP_INDEX_NONE);
+		}
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE IPP SRC resource Failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	/* get ife RDI src resource for non SFE streams */
+
+	/* in case of rdi_res, pix path is sent as rdi0 always.
+	 * This rdi0 path doesn't play any role for rdi res.
+	 * Just for compilation purpose PIX_PATH_RES_RDI_0 is added for rdi res.
+	 */
+	if (in_port->rdi_count) {
+		if (c_ctx->ctx_type != CAM_IFE_CTX_TYPE_SFE) {
+			rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx,
+				in_port, false, false, true,
+				acquired_hw_id, acquired_hw_path,
+				CAM_IFE_PIX_PATH_RES_RDI_0,
+				CAM_IFE_STREAM_GRP_INDEX_NONE);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Acquire IFE RDI SRC resource Failed, ctx_idx: %u",
+					c_ctx->ctx_index);
+				goto err;
+			}
+		}
+	}
+
+	if (in_port->lcr_count) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_src(
+			ife_ctx, in_port, true, false, false,
+			acquired_hw_id, acquired_hw_path,
+			CAM_IFE_PIX_PATH_RES_IPP,
+			CAM_IFE_STREAM_GRP_INDEX_NONE);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire IFE LCR SRC resource Failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	/* PPP path is from CSID->IFE bypassing SFE */
+	if (in_port->ppp_count) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx, in_port,
+				false, true, false,
+				acquired_hw_id, acquired_hw_path,
+				CAM_IFE_PIX_PATH_RES_PPP,
+				CAM_IFE_STREAM_GRP_INDEX_NONE);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire IFE PPP SRC resource Failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	rc = cam_ife_hw_mgr_acquire_res_ife_out(ife_ctx, in_port,
+			CAM_IFE_STREAM_GRP_INDEX_NONE);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE OUT resource Failed, ctx_idx: %u",
+			c_ctx->ctx_index);
+		goto err;
+	}
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		rc = cam_ife_hw_mgr_acquire_res_sfe_out(ife_ctx, in_port);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire SFE OUT resource Failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+virtual_hw_acquire:
+	if (in_port->dynamic_sensor_switch_en)
+		c_ctx->ctx_config |= CAM_IFE_CTX_CFG_DYNAMIC_SWITCH_ON;
+
+	return 0;
+err:
+	/* release resource at the acquire entry funciton */
+	return rc;
+}
+
+void cam_ife_cam_cdm_callback(uint32_t handle, void *userdata,
+	enum cam_cdm_cb_status status, void *cookie)
+{
+	struct cam_isp_prepare_hw_update_data   *hw_update_data = NULL;
+	struct cam_ife_hw_mgr_ctx               *ctx = NULL;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = NULL;
+	uint64_t                                 req_id;
+
+	if (!userdata) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return;
+	}
+
+	ctx = (struct cam_ife_hw_mgr_ctx *)userdata;
+	c_ctx = ctx->concr_ctx;
+	hw_update_data = c_ctx->cdm_userdata.hw_update_data;
+
+	if (status == CAM_CDM_CB_STATUS_BL_SUCCESS) {
+		req_id = *(uint64_t *)cookie;
+		complete_all(&c_ctx->config_done_complete);
+		atomic_set(&c_ctx->cdm_done, 1);
+		c_ctx->last_cdm_done_req = req_id;
+		if (g_ife_hw_mgr.debug_cfg.per_req_reg_dump) {
+			if (c_ctx->cdm_userdata.request_id == req_id) {
+				cam_ife_mgr_handle_reg_dump(ctx,
+					hw_update_data->reg_dump_buf_desc,
+					hw_update_data->num_reg_dump_buf,
+					CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST,
+					NULL, false);
+			} else {
+				CAM_INFO(CAM_ISP,
+				    "CDM delay, Skip dump req: %llu, cdm_req: %llu ctx_idx: %u",
+				    req_id, c_ctx->cdm_userdata.request_id, c_ctx->ctx_index);
+			}
+		}
+		CAM_DBG(CAM_ISP,
+			"CDM hdl=0x%x, udata=%pK, status=%d, cookie=%u ctx_index=%u cdm_req=%llu",
+			 handle, userdata, status, req_id, c_ctx->ctx_index,
+			 c_ctx->cdm_userdata.request_id);
+	} else if (status == CAM_CDM_CB_STATUS_PAGEFAULT) {
+		if (ctx->concr_ctx->common.sec_pf_evt_cb)
+			ctx->concr_ctx->common.sec_pf_evt_cb(ctx->concr_ctx->common.cb_priv, cookie);
+	} else {
+		CAM_WARN(CAM_ISP,
+			"Called by CDM hdl=0x%x, udata=%pK, status=%d, cdm_req=%llu ctx_idx: %u",
+			 handle, userdata, status,
+			 c_ctx->cdm_userdata.request_id, c_ctx->ctx_index);
+	}
+	ktime_get_clocktai_ts64(&c_ctx->cdm_done_ts);
+}
+
+static int cam_ife_mgr_acquire_get_unified_structure_v0(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	struct cam_isp_in_port_info *in = NULL;
+	uint32_t in_port_length = 0;
+	int32_t rc = 0, i;
+
+	in = (struct cam_isp_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset + *input_size);
+
+	in_port_length = sizeof(struct cam_isp_in_port_info) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_isp_out_port_info);
+
+	*input_size += in_port_length;
+
+	if (!in_port || ((*input_size) > acquire_hw_info->input_info_size)) {
+		CAM_ERR(CAM_ISP, "Input is not proper");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	in_port->major_ver       =
+		(acquire_hw_info->input_info_version >> 16) & 0xFFFF;
+	in_port->minor_ver       =
+		acquire_hw_info->input_info_version & 0xFFFF;
+	in_port->res_type        =  in->res_type;
+	in_port->lane_type       =  in->lane_type;
+	in_port->lane_num        =  in->lane_num;
+	in_port->lane_cfg        =  in->lane_cfg;
+	in_port->vc[0]           =  in->vc;
+	in_port->dt[0]           =  in->dt;
+	in_port->num_valid_vc_dt = 1;
+	in_port->format[0]       =  in->format;
+	in_port->test_pattern    =  in->test_pattern;
+	in_port->usage_type      =  in->usage_type;
+	in_port->left_start      =  in->left_start;
+	in_port->left_stop       =  in->left_stop;
+	in_port->left_width      =  in->left_width;
+	in_port->right_start     =  in->right_start;
+	in_port->right_stop      =  in->right_stop;
+	in_port->right_width     =  in->right_width;
+	in_port->line_start      =  in->line_start;
+	in_port->line_stop       =  in->line_stop;
+	in_port->height          =  in->height;
+	in_port->pixel_clk       =  in->pixel_clk;
+	in_port->batch_size      =  in->batch_size;
+	in_port->dsp_mode        =  in->dsp_mode;
+	in_port->hbi_cnt         =  in->hbi_cnt;
+	in_port->cust_node       =  0;
+	in_port->horizontal_bin  =  0;
+	in_port->qcfa_bin        =  0;
+	in_port->num_out_res     =  in->num_out_res;
+	in_port->sensor_id         = CAM_ISP_IN_SENSOR_ID_UNKNOWN;
+
+	in_port->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_out_port_generic_info),
+		GFP_KERNEL);
+	if (in_port->data == NULL) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < in->num_out_res; i++) {
+		in_port->data[i].res_type     = in->data_flex[i].res_type;
+		in_port->data[i].acquired_res_type = in->data_flex[i].res_type;
+		in_port->data[i].format       = in->data_flex[i].format;
+		in_port->data[i].width        = in->data_flex[i].width;
+		in_port->data[i].height       = in->data_flex[i].height;
+		in_port->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		in_port->data[i].split_point  = in->data_flex[i].split_point;
+		in_port->data[i].secure_mode  = in->data_flex[i].secure_mode;
+		in_port->data[i].reserved     = in->data_flex[i].reserved;
+	}
+
+	return 0;
+err:
+	return rc;
+}
+
+static inline int cam_ife_mgr_hw_check_in_res_type(
+	u32 res_type)
+{
+	switch (res_type) {
+	case CAM_ISP_IFE_IN_RES_RD:
+		return 0;
+	case CAM_ISP_SFE_IN_RD_0:
+		return 0;
+	case CAM_ISP_SFE_IN_RD_1:
+		return 0;
+	case CAM_ISP_SFE_IN_RD_2:
+		return 0;
+	default:
+		return -EINVAL;
+	}
+}
+
+static inline void cam_ife_mgr_acquire_get_feature_flag_params_v3(
+	struct cam_isp_in_port_info_v3      *in,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	in_port->dynamic_sensor_switch_en = in->feature_mask & CAM_ISP_DYNAMIC_SENOR_SWITCH_EN;
+	in_port->can_use_lite             = in->feature_mask & CAM_ISP_CAN_USE_LITE_MODE;
+	in_port->aeb_mode                 = in->feature_mask & CAM_ISP_AEB_MODE_EN;
+	in_port->dynamic_hdr_switch_en    = in->feature_mask & CAM_ISP_HDR_MODE_DYNAMIC_SWITCH_EN;
+}
+
+static inline void cam_ife_mgr_acquire_get_feature_flag_params(
+	struct cam_isp_in_port_info_v2      *in,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	in_port->secure_mode              = in->feature_flag & CAM_ISP_PARAM_FETCH_SECURITY_MODE;
+	in_port->dynamic_sensor_switch_en = in->feature_flag & CAM_ISP_DYNAMIC_SENOR_SWITCH_EN;
+	in_port->can_use_lite             = in->feature_flag & CAM_ISP_CAN_USE_LITE_MODE;
+	in_port->sfe_binned_epoch_cfg     = in->feature_flag & CAM_ISP_SFE_BINNED_EPOCH_CFG_ENABLE;
+	in_port->epd_supported            = in->feature_flag & CAM_ISP_EPD_SUPPORT;
+	in_port->aeb_mode                 = in->feature_flag & CAM_ISP_AEB_MODE_EN;
+	in_port->dynamic_hdr_switch_en    = in->feature_flag & CAM_ISP_HDR_MODE_DYNAMIC_SWITCH_EN;
+	in_port->yuv_chroma_conversion_en = in->feature_flag & CAM_ISP_YUV_CHROMA_CONVERSION_DS_EN;
+}
+
+static int cam_ife_mgr_acquire_get_unified_structure_v3(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	struct cam_isp_in_port_info_v3 *in = NULL;
+	uint32_t in_port_length = 0;
+	int32_t rc = 0, i;
+
+	in = (struct cam_isp_in_port_info_v3 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset + *input_size);
+
+	in_port_length = sizeof(struct cam_isp_in_port_info_v3) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_isp_out_port_info_v3);
+
+	*input_size += in_port_length;
+
+	if (!in_port || ((*input_size) > acquire_hw_info->input_info_size)) {
+		CAM_ERR(CAM_ISP, "Input is not proper");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	in_port->major_ver       = (acquire_hw_info->input_info_version >> 8) & 0xFFFF;
+	in_port->minor_ver       = acquire_hw_info->input_info_version & 0xFFFF;
+	in_port->res_type        =  in->phy_info.res_type;
+	in_port->lane_type       =  in->phy_info.lane_type;
+	in_port->lane_num        =  in->phy_info.lane_num;
+	in_port->lane_cfg        =  in->phy_info.lane_cfg;
+	in_port->num_valid_vc_dt =  in->csid_info.num_valid_vc_dt;
+	in_port->sensor_id       =  CAM_ISP_IN_SENSOR_ID_UNKNOWN;
+
+	if (in_port->num_valid_vc_dt == 0 || in_port->num_valid_vc_dt >= CAM_ISP_VC_DT_CFG) {
+		CAM_ERR(CAM_ISP, "Invalid i/p arg invalid vc-dt: %d", in_port->num_valid_vc_dt);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	for (i = 0; i < in_port->num_valid_vc_dt; i++) {
+		in_port->vc[i]        =  in->csid_info.vc[i];
+		in_port->dt[i]        =  in->csid_info.dt[i];
+	}
+
+	for (i = 0; i < in_port->num_valid_vc_dt; i++) {
+		in_port->format[i] = (in->csid_info.format >> (i * CAM_IFE_DECODE_FORMAT_SHIFT_VAL))
+			& CAM_IFE_DECODE_FORMAT_MASK;
+	}
+
+	in_port->path_id                  =  in->csid_info.path_id;
+	in_port->left_width               =  in->csid_info.width;
+	in_port->height                   =  in->csid_info.height;
+	in_port->num_out_res              =  in->num_out_res;
+
+	cam_ife_mgr_acquire_get_feature_flag_params_v3(in, in_port);
+
+	in_port->data = kcalloc(in->num_out_res, sizeof(struct cam_isp_out_port_generic_info),
+		GFP_KERNEL);
+	if (in_port->data == NULL) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		in_port->data[i].res_type     = in->data_flex[i].res_type;
+		in_port->data[i].acquired_res_type = in->data_flex[i].res_type;
+		in_port->data[i].format       = in->data_flex[i].format;
+		in_port->data[i].width        = in->data_flex[i].width;
+		in_port->data[i].height       = in->data_flex[i].height;
+		in_port->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		in_port->data[i].split_point  = in->data_flex[i].split_point;
+		in_port->data[i].secure_mode  = in->data_flex[i].secure_mode;
+		in_port->data[i].wm_mode      = in->data_flex[i].wm_mode;
+		in_port->data[i].hw_context_id   = in->data_flex[i].context_id;
+	}
+
+	return 0;
+
+err:
+	return rc;
+}
+
+static int cam_ife_mgr_acquire_get_unified_structure_v2(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	struct cam_isp_in_port_info_v2 *in = NULL;
+	uint32_t in_port_length = 0;
+	uint32_t num_out_res;
+	int32_t rc = 0, i, j;
+
+	in = (struct cam_isp_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset + *input_size);
+
+	in_port_length = sizeof(struct cam_isp_in_port_info_v2) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_isp_out_port_info_v2);
+
+	*input_size += in_port_length;
+
+	if (!in_port || ((*input_size) > acquire_hw_info->input_info_size)) {
+		CAM_ERR(CAM_ISP, "Input is not proper");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	in_port->major_ver       =
+		(acquire_hw_info->input_info_version >> 16) & 0xFFFF;
+	in_port->minor_ver       =
+		acquire_hw_info->input_info_version & 0xFFFF;
+	in_port->res_type        =  in->res_type;
+	in_port->lane_type       =  in->lane_type;
+	in_port->lane_num        =  in->lane_num;
+	in_port->lane_cfg        =  in->lane_cfg;
+	in_port->num_valid_vc_dt =  in->num_valid_vc_dt;
+
+	if (in_port->num_valid_vc_dt == 0 ||
+		in_port->num_valid_vc_dt >= CAM_ISP_VC_DT_CFG) {
+		if (cam_ife_mgr_hw_check_in_res_type(in->res_type)) {
+			CAM_ERR(CAM_ISP, "Invalid i/p arg invalid vc-dt: %d",
+				in->num_valid_vc_dt);
+			rc = -EINVAL;
+			goto err;
+		}
+	}
+
+	for (i = 0; i < in_port->num_valid_vc_dt; i++) {
+		in_port->vc[i]        =  in->vc[i];
+		in_port->dt[i]        =  in->dt[i];
+	}
+
+	for (i = 0; i < in_port->num_valid_vc_dt; i++) {
+		in_port->format[i] = (in->format >> (i * CAM_IFE_DECODE_FORMAT_SHIFT_VAL)) &
+			CAM_IFE_DECODE_FORMAT_MASK;
+	}
+
+	in_port->test_pattern             =  in->test_pattern;
+	in_port->usage_type               =  in->usage_type;
+	in_port->left_start               =  in->left_start;
+	in_port->left_stop                =  in->left_stop;
+	in_port->left_width               =  in->left_width;
+	in_port->right_start              =  in->right_start;
+	in_port->right_stop               =  in->right_stop;
+	in_port->right_width              =  in->right_width;
+	in_port->line_start               =  in->line_start;
+	in_port->line_stop                =  in->line_stop;
+	in_port->height                   =  in->height;
+	in_port->pixel_clk                =  in->pixel_clk;
+	in_port->batch_size               =  in->batch_size;
+	in_port->dsp_mode                 =  in->dsp_mode;
+	in_port->hbi_cnt                  =  in->hbi_cnt;
+	in_port->cust_node                =  in->cust_node;
+	in_port->horizontal_bin           =  (in->bidirectional_bin & 0xFFFF);
+	in_port->vertical_bin             =  (in->bidirectional_bin >> 16);
+	in_port->qcfa_bin                 =  in->qcfa_bin;
+	in_port->num_out_res              =  in->num_out_res;
+	in_port->sfe_in_path_type         =  (in->sfe_in_path_type & 0xFFFF);
+	in_port->sfe_ife_enable           =  in->sfe_in_path_type >> 16;
+	in_port->sensor_id                =  in->sensor_id;
+	/*
+	 * Different formats are not supported for fetch engine use-cases
+	 * Use vc0 format [LSB 8 bits], if the input formats are different for each VC
+	 * fail the acquire
+	 */
+	in_port->fe_unpacker_fmt          =  in->format & CAM_IFE_DECODE_FORMAT_MASK;
+
+	cam_ife_mgr_acquire_get_feature_flag_params(in, in_port);
+	cam_ife_mgr_check_per_port_enable(in_port);
+	if (in_port->per_port_en && !in_port->is_offline) {
+		for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+			if (!g_ife_sns_grp_cfg.grp_cfg[i])
+				continue;
+			for (j = 0; j < g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg_cnt; j++) {
+				if (in_port->sensor_id ==
+					g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].sensor_id) {
+					num_out_res = max_t(uint32_t,
+						g_ife_hw_mgr.max_ife_lite_out_res,
+						in->num_out_res);
+					break;
+				}
+			}
+		}
+	} else {
+		num_out_res = in->num_out_res;
+	}
+
+	in_port->data = kcalloc(num_out_res,
+		sizeof(struct cam_isp_out_port_generic_info),
+		GFP_KERNEL);
+	if (in_port->data == NULL) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < num_out_res; i++) {
+		in_port->data[i].res_type     = in->data_flex[i].res_type;
+		in_port->data[i].acquired_res_type = in->data_flex[i].res_type;
+		in_port->data[i].format       = in->data_flex[i].format;
+		in_port->data[i].width        = in->data_flex[i].width;
+		in_port->data[i].height       = in->data_flex[i].height;
+		in_port->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		in_port->data[i].split_point  = in->data_flex[i].split_point;
+		in_port->data[i].secure_mode  = in->data_flex[i].secure_mode;
+	}
+
+	return 0;
+
+err:
+	return rc;
+}
+
+static int cam_ife_mgr_acquire_get_unified_structure(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	uint32_t major_ver = 0, minor_ver = 0;
+
+	if (acquire_hw_info == NULL || input_size == NULL)
+		return -EINVAL;
+
+	major_ver = (acquire_hw_info->common_info_version >> 12) & 0xF;
+	minor_ver = (acquire_hw_info->common_info_version) & 0xFFF;
+
+	switch (major_ver) {
+	case 1:
+		return cam_ife_mgr_acquire_get_unified_structure_v0(
+			acquire_hw_info, offset, input_size, in_port);
+	case 2:
+		return cam_ife_mgr_acquire_get_unified_structure_v2(
+			acquire_hw_info, offset, input_size, in_port);
+	case 3:
+		return cam_ife_mgr_acquire_get_unified_structure_v3(
+			acquire_hw_info, offset, input_size, in_port);
+	default:
+		CAM_ERR(CAM_ISP, "Invalid ver of i/p port info from user. minor %u, major %u",
+			minor_ver, major_ver);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static inline void cam_ife_mgr_reset_streamon_scratch_cfg(
+	struct cam_ife_hw_mgr_ctx *ctx)
+{
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ctx->concr_ctx;
+
+	c_ctx->scratch_buf_info.ife_scratch_config->skip_scratch_cfg_streamon = false;
+	c_ctx->scratch_buf_info.sfe_scratch_config->skip_scratch_cfg_streamon = false;
+	c_ctx->scratch_buf_info.ife_scratch_config->streamon_buf_mask = 0;
+	c_ctx->scratch_buf_info.sfe_scratch_config->streamon_buf_mask = 0;
+}
+
+static void cam_ife_mgr_populate_hw_ctxt_map(struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	int src_hw_ctxt_id;
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ife_ctx->concr_ctx;
+
+	src_hw_ctxt_id = cam_ife_mgr_get_src_hw_ctxt_from_csid_path(in_port->path_id);
+	if (src_hw_ctxt_id == -1)
+		return;
+
+	c_ctx->acq_hw_ctxt_src_dst_map[src_hw_ctxt_id] = in_port->ipp_dst_hw_ctxt_mask;
+}
+
+int cam_ife_mgr_update_offline_ife_out(
+	struct cam_ife_hw_mgr_ctx *ife_ctx)
+{
+	struct cam_isp_hw_mgr_res       *ife_src_res;
+	int i;
+	int rc;
+
+	for (i = 0; i < ife_ctx->num_in_ports; i++) {
+		list_for_each_entry(ife_src_res,
+				&ife_ctx->concr_ctx->res_list_ife_src, list) {
+			if (ife_src_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF) {
+				rc = cam_ife_hw_mgr_acquire_res_ife_out_pixel(
+					ife_ctx, ife_src_res,
+					&ife_ctx->in_ports[i],
+					CAM_IFE_STREAM_GRP_INDEX_NONE,
+					true);
+			}
+		}
+	}
+	return rc;
+}
+
+static int cam_ife_mgr_acquire_offline_out(
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_hw_acquire_args *acquire_args)
+{
+	struct cam_isp_acquire_hw_info      *acquire_hw_info;
+	uint32_t                             input_size = 0;
+	int i;
+	int rc;
+
+	acquire_hw_info =
+		(struct cam_isp_acquire_hw_info *)acquire_args->acquire_info;
+	ife_ctx->num_in_ports = acquire_hw_info->num_inputs;
+	ife_ctx->in_ports = kcalloc(ife_ctx->num_in_ports,
+			sizeof(struct cam_isp_in_port_generic_info),
+			GFP_KERNEL);
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		rc = cam_ife_mgr_acquire_get_unified_structure(acquire_hw_info,
+			i, &input_size, &ife_ctx->in_ports[i]);
+	}
+	return rc;
+}
+
+/* entry function: acquire_hw */
+static int cam_ife_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	struct cam_ife_hw_mgr *ife_hw_mgr            = hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -1;
+	int i, j;
+	struct cam_ife_hw_mgr_ctx           *ife_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx      *c_ctx;
+	struct cam_isp_in_port_generic_info *in_port = NULL;
+	struct cam_cdm_acquire_data        cdm_acquire;
+	uint32_t                           total_pix_port = 0;
+	uint32_t                           total_rdi_port = 0;
+	uint32_t                           total_pd_port = 0;
+	uint32_t                           total_lite_port = 0;
+	uint32_t                           total_ports = 0;
+	uint32_t                           total_sfe_ports = 0;
+	struct cam_isp_acquire_hw_info    *acquire_hw_info = NULL;
+	uint32_t                           input_size = 0;
+	uint32_t                           acquired_rdi_res = 0;
+	uint32_t                           input_format_checker = 0;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	ife_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)acquire_args->ctxt_to_hw_map;
+
+	/* get the ife ctx */
+	rc = cam_ife_hw_mgr_get_ctx(&ife_hw_mgr->free_ctx_list, &ife_mgr_ctx);
+	c_ctx = ife_mgr_ctx->concr_ctx;
+	if (rc || !c_ctx) {
+		CAM_ERR(CAM_ISP, "Get ife hw context failed rc %d", rc);
+		goto err;
+	}
+
+	cam_cpas_get_cpas_hw_version(&c_ctx->hw_version);
+	c_ctx->ctx_config = 0;
+	c_ctx->cdm_handle = 0;
+	c_ctx->ctx_type = CAM_IFE_CTX_TYPE_NONE;
+	c_ctx->num_acq_vfe_out = 0;
+	c_ctx->num_acq_sfe_out = 0;
+
+	c_ctx->common.cb_priv = acquire_args->context_data;
+	c_ctx->common.mini_dump_cb = acquire_args->mini_dump_cb;
+	c_ctx->flags.internal_cdm = false;
+	c_ctx->left_hw_idx = CAM_IFE_CSID_HW_NUM_MAX;
+	c_ctx->right_hw_idx = CAM_IFE_CSID_HW_NUM_MAX;
+	c_ctx->buf_done_controller = NULL;
+	c_ctx->common.event_cb = acquire_args->event_cb;
+	c_ctx->hw_mgr = ife_hw_mgr;
+	c_ctx->cdm_ops =  cam_cdm_publish_ops();
+	c_ctx->common.sec_pf_evt_cb = acquire_args->sec_pf_evt_cb;
+	c_ctx->try_recovery_cnt = 0;
+	c_ctx->recovery_req_id = 0;
+	c_ctx->drv_path_idle_en = 0;
+	c_ctx->res_list_ife_out = NULL;
+	c_ctx->res_list_sfe_out = NULL;
+	c_ctx->left_hw_idx = CAM_IFE_CSID_HW_NUM_MAX;
+	c_ctx->right_hw_idx = CAM_IFE_CSID_HW_NUM_MAX;
+
+	acquire_hw_info =
+		(struct cam_isp_acquire_hw_info *) acquire_args->acquire_info;
+
+	rc = cam_ife_mgr_check_and_update_fe(ife_mgr_ctx, acquire_hw_info,
+		acquire_args->acquire_info_size,
+		&ife_mgr_ctx->bw_data);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "buffer size is not enough");
+		goto free_ctx;
+	}
+
+	c_ctx->is_offline = c_ctx->flags.is_offline;
+	ife_mgr_ctx->num_in_ports = acquire_hw_info->num_inputs;
+	ife_mgr_ctx->in_ports = kcalloc(acquire_hw_info->num_inputs,
+			sizeof(struct cam_isp_in_port_generic_info),
+			GFP_KERNEL);
+
+	if (!ife_mgr_ctx->in_ports) {
+		CAM_ERR(CAM_ISP, "No memory available, ctx_idx: %u", c_ctx->ctx_index);
+		rc = -ENOMEM;
+		goto free_ctx;
+	}
+
+	c_ctx->vfe_bus_comp_grp = kcalloc(CAM_IFE_BUS_COMP_NUM_MAX,
+		sizeof(struct cam_isp_context_comp_record), GFP_KERNEL);
+	if (!c_ctx->vfe_bus_comp_grp) {
+		CAM_ERR(CAM_CTXT, "No memory for vfe_bus_comp_grp");
+		rc = -ENOMEM;
+		goto free_mem;
+	}
+
+	c_ctx->sfe_bus_comp_grp = kcalloc(CAM_SFE_BUS_COMP_NUM_MAX,
+		sizeof(struct cam_isp_context_comp_record), GFP_KERNEL);
+	if (!c_ctx->sfe_bus_comp_grp) {
+		CAM_ERR(CAM_CTXT, "No memory for sfe_bus_comp_grp");
+		rc = -ENOMEM;
+		goto free_mem;
+	}
+
+	/* Update in_port structure */
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		ife_mgr_ctx->in_ports[i].is_offline = c_ctx->is_offline;
+		rc = cam_ife_mgr_acquire_get_unified_structure(acquire_hw_info,
+			i, &input_size,  &ife_mgr_ctx->in_ports[i]);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Failed in parsing: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+			goto free_mem;
+		}
+
+		CAM_DBG(CAM_ISP, "in_res_type %x",
+				ife_mgr_ctx->in_ports[i].res_type);
+
+		/* Check for formats in multi vc-dt FE use-cases */
+		if (c_ctx->flags.is_fe_enabled) {
+			input_format_checker = ife_mgr_ctx->in_ports[i].format[0];
+			for (j = 1; j < ife_mgr_ctx->in_ports[i].num_valid_vc_dt; j++) {
+				if (ife_mgr_ctx->in_ports[i].format[j] !=
+					input_format_checker) {
+					CAM_ERR(CAM_ISP,
+						"Different input formats for FE use-cases not supported - formats vc0: %u vc%d: %u ctx_idx: %u",
+						input_format_checker, j,
+						ife_mgr_ctx->in_ports[i].format[j],
+						c_ctx->ctx_index);
+					rc = -EINVAL;
+					goto free_mem;
+				}
+			}
+		}
+
+		if (ife_mgr_ctx->in_ports[i].usage_type &&
+			ife_mgr_ctx->in_ports[i].secure_mode) {
+			CAM_ERR(CAM_ISP,
+				"Dual IFE mode is not supported in secure camera usecases");
+			rc = -EINVAL;
+			goto free_mem;
+		}
+
+		cam_ife_hw_mgr_preprocess_port(ife_mgr_ctx, &ife_mgr_ctx->in_ports[i]);
+		total_pix_port += ife_mgr_ctx->in_ports[i].ipp_count +
+			ife_mgr_ctx->in_ports[i].ife_rd_count +
+			ife_mgr_ctx->in_ports[i].lcr_count;
+		total_rdi_port += ife_mgr_ctx->in_ports[i].rdi_count;
+		total_pd_port += ife_mgr_ctx->in_ports[i].ppp_count;
+		total_lite_port += ife_mgr_ctx->in_ports[i].lite_path_count;
+		total_sfe_ports += ife_mgr_ctx->in_ports[i].sfe_port_count;
+
+		if ((ife_mgr_ctx->in_ports[i].major_ver == 3) &&
+			ife_mgr_ctx->in_ports[i].ipp_count)
+			c_ctx->is_hw_ctx_acq = true;
+	}
+
+	total_ports = total_pix_port + total_rdi_port + total_pd_port;
+
+	in_port = &ife_mgr_ctx->in_ports[0];
+	for (i = 0; i < in_port->num_valid_vc_dt; i++) {
+		if (cam_ife_mgr_hw_validate_vc_dt_stream_grp(in_port,
+				in_port->vc[i], in_port->dt[i])) {
+			CAM_ERR(CAM_ISP, "Invalid vc[%d]-dt[%d] args range: %d | %d",
+				in_port->vc[i], in_port->dt[i], i,
+				in_port->num_valid_vc_dt);
+			rc = -EINVAL;
+			goto err;
+		}
+	}
+
+	c_ctx->sensor_id = in_port[0].sensor_id;
+	c_ctx->flags.per_port_en = in_port->per_port_en;
+	ife_mgr_ctx->virtual_rdi_mapping_cb =
+		cam_ife_hw_mgr_get_virtual_mapping_out_port;
+
+	c_ctx->res_list_ife_out = kcalloc(total_ports,
+		sizeof(struct cam_isp_hw_mgr_res), GFP_KERNEL);
+	if (!c_ctx->res_list_ife_out) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_ISP, "Alloc failed for ife out map");
+		goto free_mem;
+	}
+	/* Check whether context has only RDI resource */
+	if (!total_pix_port && !total_pd_port) {
+		c_ctx->flags.is_rdi_only_context = true;
+		CAM_DBG(CAM_ISP, "RDI only context, ctx_idx: %u", c_ctx->ctx_index);
+	}
+
+	/* Check whether context has only RDI and PD resource */
+	if (!total_pix_port &&
+		(total_pd_port && total_rdi_port)) {
+		c_ctx->flags.rdi_pd_context = true;
+		CAM_DBG(CAM_ISP, "RDI and PD context with [%u pd] [%u rdi], ctx_idx: %u",
+			total_pd_port, total_rdi_port, c_ctx->ctx_index);
+	}
+
+	/* Check if all output ports are of lite  */
+	if (total_lite_port == total_pix_port + total_rdi_port)
+		c_ctx->flags.is_lite_context = true;
+
+	if (total_sfe_ports) {
+		c_ctx->res_list_sfe_out = kcalloc(total_sfe_ports,
+			sizeof(struct cam_isp_hw_mgr_res), GFP_KERNEL);
+		memset(c_ctx->sfe_out_map, 0xff, sizeof(uint8_t) * max_sfe_out_res);
+		if (!c_ctx->res_list_sfe_out) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_ISP, "Alloc failed for sfe out map");
+			goto free_mem;
+		}
+	}
+
+	/* acquire HW resources */
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		CAM_DBG(CAM_ISP, "ctx_idx: %u in_res_type %x",
+			c_ctx->ctx_index, ife_mgr_ctx->in_ports[i].res_type);
+		if (!c_ctx->ctx_type) {
+			if (ife_mgr_ctx->in_ports[i].cust_node) {
+				c_ctx->ctx_type = CAM_IFE_CTX_TYPE_CUSTOM;
+				/* These can be obtained from uapi */
+				c_ctx->ctx_config |=
+					CAM_IFE_CTX_CFG_FRAME_HEADER_TS;
+				c_ctx->ctx_config |=
+					CAM_IFE_CTX_CFG_SW_SYNC_ON;
+			} else if (ife_mgr_ctx->in_ports[i].sfe_in_path_type) {
+				c_ctx->ctx_type = CAM_IFE_CTX_TYPE_SFE;
+			}
+		}
+
+		CAM_DBG(CAM_ISP,
+			"in_res_type: 0x%x ctx_idx: %u sfe_in_path_type: 0x%x sfe_ife_enable: 0x%x per_port_en :%d",
+			in_port[i].res_type, c_ctx->ctx_index,  in_port[i].sfe_in_path_type,
+			in_port[i].sfe_ife_enable, c_ctx->flags.per_port_en);
+
+		/* For multi-context acquire cases*/
+		if ((ife_mgr_ctx->in_ports[i].major_ver == 3) &&
+			ife_mgr_ctx->in_ports[i].ipp_count)
+			cam_ife_mgr_populate_hw_ctxt_map(ife_mgr_ctx, &ife_mgr_ctx->in_ports[i]);
+
+		if (c_ctx->flags.is_offline)
+			rc = cam_ife_mgr_acquire_hw_for_offline_ctx(
+				ife_mgr_ctx, &ife_mgr_ctx->in_ports[i],
+				&acquire_args->acquired_hw_id[i],
+				acquire_args->acquired_hw_path[i]);
+		else
+			rc = cam_ife_mgr_acquire_hw_for_ctx(
+				ife_mgr_ctx, &ife_mgr_ctx->in_ports[i],
+				&acquire_args->acquired_hw_id[i],
+				acquire_args->acquired_hw_path[i],
+				&acquired_rdi_res);
+
+		if (rc) {
+			cam_ife_hw_mgr_print_acquire_info(
+				ife_mgr_ctx,
+				(ife_mgr_ctx->in_ports[i].ipp_count +
+				ife_mgr_ctx->in_ports[i].ife_rd_count +
+				ife_mgr_ctx->in_ports[i].lcr_count),
+				ife_mgr_ctx->in_ports[i].ppp_count,
+				ife_mgr_ctx->in_ports[i].rdi_count, rc);
+			goto free_res;
+		}
+
+	}
+
+	ife_mgr_ctx->concr_ctx->acquired_hw_id =
+		acquire_args->acquired_hw_id[0];
+
+	/* Process base info */
+	rc = cam_ife_mgr_process_base_info(ife_mgr_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Process base info failed, ctx_idx: %u", c_ctx->ctx_index);
+		goto free_res;
+	}
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		rc = cam_ife_mgr_update_core_info_to_cpas(ife_mgr_ctx, true);
+		if (rc)
+			goto free_res;
+	}
+
+	if (!ife_hw_mgr->csid_camif_irq_support || (ife_hw_mgr->csid_camif_irq_support &&
+		c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE)) {
+		rc = cam_ife_mgr_share_sof_qtimer_addr(ife_mgr_ctx);
+		if (rc)
+			goto free_res;
+	}
+
+	rc = cam_ife_mgr_allocate_cdm_cmd(
+		(c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE ? true : false), &c_ctx->cdm_cmd);
+	if (rc)
+		goto free_res;
+
+	if (c_ctx->flags.is_dual)
+		memcpy(cdm_acquire.identifier, "dualife", sizeof("dualife"));
+	else
+		memcpy(cdm_acquire.identifier, "ife", sizeof("ife"));
+
+	if (c_ctx->flags.is_dual)
+		cdm_acquire.cell_index = c_ctx->left_hw_idx;
+	else
+		cdm_acquire.cell_index = c_ctx->base[0].idx;
+
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = ife_mgr_ctx;
+	cdm_acquire.base_array_cnt = CAM_IFE_HW_NUM_MAX;
+	for (i = 0, j = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (ife_hw_mgr->cdm_reg_map[i])
+			cdm_acquire.base_array[j++] =
+				ife_hw_mgr->cdm_reg_map[i];
+	}
+	cdm_acquire.base_array_cnt = j;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.cam_cdm_callback = cam_ife_cam_cdm_callback;
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to acquire the CDM HW, ctx_idx: %u", c_ctx->ctx_index);
+		goto free_cdm_cmd;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Successfully acquired ctx_idx: %u CDM Id: %d, CDM HW hdl=%x, is_dual=%d",
+		c_ctx->ctx_index, cdm_acquire.id, cdm_acquire.handle, c_ctx->flags.is_dual);
+	c_ctx->cdm_handle = cdm_acquire.handle;
+	c_ctx->cdm_id = cdm_acquire.id;
+	c_ctx->cdm_hw_idx = cdm_acquire.hw_idx;
+	if (cdm_acquire.id == CAM_CDM_IFE)
+		c_ctx->flags.internal_cdm = true;
+	atomic_set(&c_ctx->cdm_done, 1);
+	atomic_set(&c_ctx->ctx_state, CAM_IFE_HW_STATE_STOPPED);
+
+	c_ctx->last_cdm_done_req = 0;
+
+	if (g_ife_hw_mgr.isp_caps.support_consumed_addr)
+		acquire_args->op_flags |=
+			CAM_IFE_CTX_CONSUME_ADDR_EN;
+
+	if ((c_ctx->flags.is_sfe_shdr) ||
+		(c_ctx->flags.is_sfe_fs)) {
+		acquire_args->op_flags |=
+			CAM_IFE_CTX_APPLY_DEFAULT_CFG;
+		c_ctx->scratch_buf_info.sfe_scratch_config =
+			kzalloc(sizeof(struct cam_sfe_scratch_buf_cfg), GFP_KERNEL);
+		if (!c_ctx->scratch_buf_info.sfe_scratch_config) {
+			CAM_ERR(CAM_ISP, "Failed to allocate SFE scratch config, ctx_idx: %u",
+				c_ctx->ctx_index);
+			rc = -ENOMEM;
+			goto free_cdm_cmd;
+		}
+
+		c_ctx->scratch_buf_info.ife_scratch_config =
+			kzalloc(sizeof(struct cam_ife_scratch_buf_cfg), GFP_KERNEL);
+		if (!c_ctx->scratch_buf_info.ife_scratch_config) {
+			CAM_ERR(CAM_ISP, "Failed to allocate IFE scratch config, ctx_idx: %u",
+				c_ctx->ctx_index);
+			rc = -ENOMEM;
+			kfree(c_ctx->scratch_buf_info.sfe_scratch_config);
+			goto free_cdm_cmd;
+		}
+
+		/* Set scratch by default at stream on */
+		cam_ife_mgr_reset_streamon_scratch_cfg(ife_mgr_ctx);
+	}
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_CUSTOM)
+		acquire_args->op_flags |= CAM_IFE_CTX_CUSTOM_EN;
+
+	if (c_ctx->ctx_config & CAM_IFE_CTX_CFG_FRAME_HEADER_TS)
+		acquire_args->op_flags |=
+			CAM_IFE_CTX_FRAME_HEADER_EN;
+
+	if (c_ctx->ctx_config & CAM_IFE_CTX_CFG_DYNAMIC_SWITCH_ON)
+		acquire_args->op_flags |=
+			CAM_IFE_CTX_DYNAMIC_SWITCH_EN;
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE)
+		acquire_args->op_flags |=
+			CAM_IFE_CTX_SFE_EN;
+
+	if (c_ctx->flags.is_aeb_mode)
+		acquire_args->op_flags |= CAM_IFE_CTX_AEB_EN;
+
+	c_ctx->flags.ctx_in_use = true;
+	c_ctx->num_reg_dump_buf = 0;
+
+	acquire_args->valid_acquired_hw =
+		acquire_hw_info->num_inputs;
+	acquire_args->op_params.num_valid_params = 2;
+	acquire_args->op_params.param_list[0] = max_ife_out_res;
+	acquire_args->op_params.param_list[1] = max_sfe_out_res;
+	acquire_args->hw_mgr_ctx_id = c_ctx->ctx_index;
+
+	cam_ife_hw_mgr_print_acquire_info(ife_mgr_ctx, total_pix_port,
+		total_pd_port, total_rdi_port, rc);
+
+	cam_ife_hw_mgr_put_ctx(&ife_hw_mgr->used_ctx_list, &ife_mgr_ctx);
+
+	return 0;
+
+free_cdm_cmd:
+	cam_ife_mgr_free_cdm_cmd(&c_ctx->cdm_cmd);
+free_res:
+	cam_ife_hw_mgr_release_hw_for_ctx(ife_mgr_ctx,
+		CAM_IFE_STREAM_GRP_INDEX_NONE);
+free_mem:
+	if (ife_mgr_ctx->in_ports) {
+		for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+			kfree(ife_mgr_ctx->in_ports[i].data);
+			ife_mgr_ctx->in_ports[i].data = NULL;
+		}
+
+		kfree(ife_mgr_ctx->in_ports);
+		ife_mgr_ctx->in_ports = NULL;
+	}
+
+	kfree(c_ctx->vfe_bus_comp_grp);
+	kfree(c_ctx->sfe_bus_comp_grp);
+	c_ctx->vfe_bus_comp_grp = NULL;
+	c_ctx->sfe_bus_comp_grp = NULL;
+
+	kfree(c_ctx->res_list_sfe_out);
+	c_ctx->res_list_sfe_out = NULL;
+	kfree(c_ctx->res_list_ife_out);
+	c_ctx->res_list_ife_out = NULL;
+free_ctx:
+	cam_ife_hw_mgr_put_ctx(&ife_hw_mgr->free_ctx_list, &ife_mgr_ctx);
+err:
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+void cam_ife_mgr_acquire_get_unified_dev_str(struct cam_isp_in_port_info *in,
+	struct cam_isp_in_port_generic_info *gen_port_info)
+{
+	int i;
+
+	gen_port_info->res_type        =  in->res_type;
+	gen_port_info->lane_type       =  in->lane_type;
+	gen_port_info->lane_num        =  in->lane_num;
+	gen_port_info->lane_cfg        =  in->lane_cfg;
+	gen_port_info->vc[0]           =  in->vc;
+	gen_port_info->dt[0]           =  in->dt;
+	gen_port_info->num_valid_vc_dt = 1;
+	gen_port_info->format[0]       =  in->format;
+	gen_port_info->test_pattern    =  in->test_pattern;
+	gen_port_info->usage_type      =  in->usage_type;
+	gen_port_info->left_start      =  in->left_start;
+	gen_port_info->left_stop       =  in->left_stop;
+	gen_port_info->left_width      =  in->left_width;
+	gen_port_info->right_start     =  in->right_start;
+	gen_port_info->right_stop      =  in->right_stop;
+	gen_port_info->right_width     =  in->right_width;
+	gen_port_info->line_start      =  in->line_start;
+	gen_port_info->line_stop       =  in->line_stop;
+	gen_port_info->height          =  in->height;
+	gen_port_info->pixel_clk       =  in->pixel_clk;
+	gen_port_info->batch_size      =  in->batch_size;
+	gen_port_info->dsp_mode        =  in->dsp_mode;
+	gen_port_info->hbi_cnt         =  in->hbi_cnt;
+	gen_port_info->fe_unpacker_fmt =  in->format;
+	gen_port_info->cust_node       =  0;
+	gen_port_info->num_out_res     =  in->num_out_res;
+
+	for (i = 0; i < in->num_out_res; i++) {
+		gen_port_info->data[i].res_type     = in->data_flex[i].res_type;
+		gen_port_info->data[i].format       = in->data_flex[i].format;
+		gen_port_info->data[i].width        = in->data_flex[i].width;
+		gen_port_info->data[i].height       = in->data_flex[i].height;
+		gen_port_info->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		gen_port_info->data[i].split_point  = in->data_flex[i].split_point;
+		gen_port_info->data[i].secure_mode  = in->data_flex[i].secure_mode;
+	}
+}
+
+/* entry function: acquire_hw */
+static int cam_ife_mgr_acquire_dev(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	struct cam_ife_hw_mgr *ife_hw_mgr            = hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -1;
+	int i, j;
+	struct cam_ife_hw_mgr_ctx             *ife_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx        *c_ctx;
+	struct cam_isp_in_port_info           *in_port = NULL;
+	struct cam_isp_resource               *isp_resource = NULL;
+	struct cam_cdm_acquire_data            cdm_acquire;
+	struct cam_isp_in_port_generic_info   *gen_port_info = NULL;
+	uint32_t                               total_pd_port = 0;
+	uint32_t                               total_pix_port = 0;
+	uint32_t                               total_rdi_port = 0;
+	uint32_t                               in_port_length = 0;
+	uint32_t                               acquired_rdi_res = 0;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	ife_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)acquire_args->ctxt_to_hw_map;
+
+	/* get the ife ctx */
+	rc = cam_ife_hw_mgr_get_ctx(&ife_hw_mgr->free_ctx_list, &ife_mgr_ctx);
+	c_ctx = ife_mgr_ctx->concr_ctx;
+	if (rc || !c_ctx) {
+		CAM_ERR(CAM_ISP, "Get ife hw context failed rc %d", rc);
+		goto err;
+	}
+
+	c_ctx->cdm_handle = 0;
+	c_ctx->common.cb_priv = acquire_args->context_data;
+	c_ctx->common.event_cb = acquire_args->event_cb;
+	c_ctx->hw_mgr = ife_hw_mgr;
+	c_ctx->cdm_ops = cam_cdm_publish_ops();
+
+	isp_resource = (struct cam_isp_resource *)acquire_args->acquire_info;
+
+	gen_port_info = kcalloc(acquire_args->num_acq,
+			    sizeof(struct cam_isp_in_port_generic_info),
+			    GFP_KERNEL);
+
+	if (!gen_port_info) {
+		CAM_ERR(CAM_ISP, "No memory available, ctx_idx: %u", c_ctx->ctx_index);
+		rc = -ENOMEM;
+		goto free_ctx;
+	}
+
+	for (i = 0; i < acquire_args->num_acq; i++) {
+		if (isp_resource[i].resource_id != CAM_ISP_RES_ID_PORT)
+			continue;
+
+		CAM_DBG(CAM_ISP, "ctx_idx: %u acquire no = %d total = %d", c_ctx->ctx_index, i,
+			acquire_args->num_acq);
+		CAM_DBG(CAM_ISP,
+			"ctx_idx: %u start copy from user handle %lld with len = %d",
+			c_ctx->ctx_index, isp_resource[i].res_hdl,
+			isp_resource[i].length);
+
+		in_port_length = sizeof(struct cam_isp_in_port_info);
+
+		if (in_port_length > isp_resource[i].length) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough, ctx_idx: %u",
+				c_ctx->ctx_index);
+			rc = -EINVAL;
+			goto free_res;
+		}
+
+		in_port = memdup_user(
+			u64_to_user_ptr(isp_resource[i].res_hdl),
+			isp_resource[i].length);
+		if (!IS_ERR(in_port)) {
+			if (in_port->num_out_res > max_ife_out_res) {
+				CAM_ERR(CAM_ISP, "too many output res %d, ctx_idx: %u",
+					in_port->num_out_res, c_ctx->ctx_index);
+				rc = -EINVAL;
+				kfree(in_port);
+				goto free_res;
+			}
+
+			in_port_length = sizeof(struct cam_isp_in_port_info) +
+				(in_port->num_out_res - 1) *
+				sizeof(struct cam_isp_out_port_info);
+			if (in_port_length > isp_resource[i].length) {
+				CAM_ERR(CAM_ISP, "buffer size is not enough, ctx_idx: %u",
+					c_ctx->ctx_index);
+				rc = -EINVAL;
+				kfree(in_port);
+				goto free_res;
+			}
+
+			gen_port_info[i].data = kcalloc(
+				in_port->num_out_res,
+				sizeof(struct cam_isp_out_port_generic_info),
+				GFP_KERNEL);
+			if (gen_port_info[i].data == NULL) {
+				rc = -ENOMEM;
+				goto free_res;
+			}
+
+			cam_ife_mgr_acquire_get_unified_dev_str(in_port,
+				&gen_port_info[i]);
+			cam_ife_hw_mgr_preprocess_port(ife_mgr_ctx,
+				&gen_port_info[i]);
+
+			total_pix_port += gen_port_info[i].ipp_count +
+						gen_port_info[i].ife_rd_count +
+						gen_port_info[i].lcr_count;
+			total_rdi_port += gen_port_info[i].rdi_count;
+			total_pd_port += gen_port_info[i].ppp_count;
+
+			kfree(in_port);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"Copy from user failed with in_port = %pK, ctx_idx: %u",
+				in_port, c_ctx->ctx_index);
+			rc = -EFAULT;
+			goto free_mem;
+		}
+	}
+
+	/* Check whether context has only RDI resource */
+	if (!total_pix_port || !total_pd_port) {
+		c_ctx->flags.is_rdi_only_context = true;
+		CAM_DBG(CAM_ISP, "RDI only context, ctx_idx: %u", c_ctx->ctx_index);
+	}
+
+	/* Check whether context has only RDI and PD resource */
+	if (!total_pix_port &&
+		(total_pd_port && total_rdi_port)) {
+		c_ctx->flags.rdi_pd_context = true;
+		CAM_DBG(CAM_ISP, "RDI and PD context with [%u pd] [%u rdi] ctx_idx: %u",
+			total_pd_port, total_rdi_port, c_ctx->ctx_index);
+	}
+
+	/* acquire HW resources */
+	for (i = 0; i < acquire_args->num_acq; i++) {
+		if (isp_resource[i].resource_id != CAM_ISP_RES_ID_PORT)
+			continue;
+
+		rc = cam_ife_mgr_acquire_hw_for_ctx(ife_mgr_ctx,
+			&gen_port_info[i],
+			&acquire_args->acquired_hw_id[i],
+			acquire_args->acquired_hw_path[i],
+			&acquired_rdi_res);
+
+		if (rc) {
+			cam_ife_hw_mgr_print_acquire_info(ife_mgr_ctx,
+				total_pix_port, total_pd_port,
+				total_rdi_port, rc);
+			goto free_res;
+		}
+
+		kfree(gen_port_info[i].data);
+		gen_port_info[i].data = NULL;
+	}
+
+	kfree(gen_port_info);
+	gen_port_info = NULL;
+
+	/* Process base info */
+	rc = cam_ife_mgr_process_base_info(ife_mgr_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Process base info failed, ctx_idx: %u", c_ctx->ctx_index);
+		goto free_res;
+	}
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		rc = cam_ife_mgr_update_core_info_to_cpas(ife_mgr_ctx, true);
+		if (rc)
+			goto free_res;
+	}
+
+	rc = cam_ife_mgr_allocate_cdm_cmd(false,
+		&c_ctx->cdm_cmd);
+	if (rc)
+		goto free_res;
+
+	cam_cpas_get_cpas_hw_version(&c_ctx->hw_version);
+	c_ctx->flags.internal_cdm = false;
+
+	if (c_ctx->flags.is_dual)
+		memcpy(cdm_acquire.identifier, "dualife", sizeof("dualife"));
+	else
+		memcpy(cdm_acquire.identifier, "ife", sizeof("ife"));
+	cdm_acquire.cell_index = c_ctx->base[0].idx;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = ife_mgr_ctx;
+	cdm_acquire.base_array_cnt = CAM_IFE_HW_NUM_MAX;
+	for (i = 0, j = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (ife_hw_mgr->cdm_reg_map[i])
+			cdm_acquire.base_array[j++] =
+				ife_hw_mgr->cdm_reg_map[i];
+	}
+	cdm_acquire.base_array_cnt = j;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.cam_cdm_callback = cam_ife_cam_cdm_callback;
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to acquire the CDM HW, ctx_idx: %u", c_ctx->ctx_index);
+		goto free_cdm_cmd;
+	}
+
+	CAM_DBG(CAM_ISP, "Successfully acquired CDM ID:%d, CDM HW hdl=%x ctx_idx: %u",
+		cdm_acquire.id, cdm_acquire.handle, c_ctx->ctx_index);
+
+	if (cdm_acquire.id == CAM_CDM_IFE)
+		c_ctx->flags.internal_cdm = true;
+	c_ctx->cdm_handle = cdm_acquire.handle;
+	c_ctx->cdm_id = cdm_acquire.id;
+	atomic_set(&c_ctx->cdm_done, 1);
+	atomic_set(&c_ctx->ctx_state, CAM_IFE_HW_STATE_STOPPED);
+	c_ctx->last_cdm_done_req = 0;
+
+	c_ctx->flags.ctx_in_use = true;
+	c_ctx->num_reg_dump_buf = 0;
+
+	cam_ife_hw_mgr_print_acquire_info(ife_mgr_ctx, total_pix_port,
+		total_pd_port, total_rdi_port, rc);
+
+	cam_ife_hw_mgr_put_ctx(&ife_hw_mgr->used_ctx_list, &ife_mgr_ctx);
+
+	return 0;
+
+free_cdm_cmd:
+	cam_ife_mgr_free_cdm_cmd(&c_ctx->cdm_cmd);
+free_res:
+	cam_ife_hw_mgr_release_hw_for_ctx(ife_mgr_ctx,
+		CAM_IFE_STREAM_GRP_INDEX_NONE);
+free_mem:
+	if (gen_port_info) {
+		for (i = 0; i < acquire_args->num_acq; i++) {
+			kfree(gen_port_info[i].data);
+			gen_port_info[i].data = NULL;
+		}
+		kfree(gen_port_info);
+		gen_port_info = NULL;
+	}
+free_ctx:
+	cam_ife_hw_mgr_put_ctx(&ife_hw_mgr->free_ctx_list, &ife_mgr_ctx);
+err:
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+/* entry function: acquire_hw */
+static int cam_ife_mgr_acquire(void *hw_mgr_priv,
+					void *acquire_hw_args)
+{
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -1;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+
+	if (acquire_args->num_acq == CAM_API_COMPAT_CONSTANT)
+		rc = cam_ife_mgr_acquire_hw(hw_mgr_priv, acquire_hw_args);
+	else
+		rc = cam_ife_mgr_acquire_dev(hw_mgr_priv, acquire_hw_args);
+
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static const char *cam_isp_util_usage_data_to_string(
+	uint32_t usage_data)
+{
+	switch (usage_data) {
+	case CAM_ISP_USAGE_LEFT_PX:
+		return "LEFT_PX";
+	case CAM_ISP_USAGE_RIGHT_PX:
+		return "RIGHT_PX";
+	case CAM_ISP_USAGE_RDI:
+		return "RDI";
+	case CAM_ISP_USAGE_SFE_LEFT:
+		return "SFE_LEFT_PX";
+	case CAM_ISP_USAGE_SFE_RIGHT:
+		return "SFE_RIGHT_PX";
+	case CAM_ISP_USAGE_SFE_RDI:
+		return "SFE_RDI";
+	default:
+		return "USAGE_INVALID";
+	}
+}
+
+static void cam_ife_mgr_print_blob_info(struct cam_ife_hw_mgr_ctx *ctx, uint64_t request_id,
+	struct cam_isp_prepare_hw_update_data *hw_update_data)
+{
+	int i;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ctx->concr_ctx;
+	struct cam_isp_bw_config_internal_v2 *bw_config =
+		(struct cam_isp_bw_config_internal_v2 *)
+		&hw_update_data->bw_clk_config.bw_config_v2;
+	struct cam_isp_clock_config *ife_clock_config =
+		(struct cam_isp_clock_config *) &hw_update_data->bw_clk_config.ife_clock_config;
+	struct cam_isp_clock_config *sfe_clock_config =
+		(struct cam_isp_clock_config *) &hw_update_data->bw_clk_config.sfe_clock_config;
+
+	CAM_INFO(CAM_ISP, "ctx: %u req_id:%llu config_valid[BW VFE_CLK SFE_CLK]:[%d %d %d]",
+		c_ctx->ctx_index, request_id, hw_update_data->bw_clk_config.bw_config_valid,
+		hw_update_data->bw_clk_config.ife_clock_config_valid,
+		hw_update_data->bw_clk_config.sfe_clock_config_valid);
+
+	if (!hw_update_data->bw_clk_config.bw_config_valid)
+		goto ife_clk;
+
+	for (i = 0; i < bw_config->num_paths; i++) {
+		CAM_INFO(CAM_PERF,
+			"ctx_idx: %u ISP_BLOB usage_type=%u [%s] [%s] [%s] [%llu] [%llu] [%llu]",
+			c_ctx->ctx_index, bw_config->usage_type,
+			cam_isp_util_usage_data_to_string(
+			bw_config->axi_path[i].usage_data),
+			cam_cpas_axi_util_path_type_to_string(
+			bw_config->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			bw_config->axi_path[i].transac_type),
+			bw_config->axi_path[i].camnoc_bw,
+			bw_config->axi_path[i].mnoc_ab_bw,
+			bw_config->axi_path[i].mnoc_ib_bw);
+	}
+
+ife_clk:
+	if (!hw_update_data->bw_clk_config.ife_clock_config_valid)
+		goto sfe_clk;
+
+	CAM_INFO(CAM_PERF, "IFE ctx_idx: %u clk update usage=%u left_clk= %lu right_clk=%lu",
+		c_ctx->ctx_index, ife_clock_config->usage_type, ife_clock_config->left_pix_hz,
+		ife_clock_config->right_pix_hz);
+
+sfe_clk:
+	if (!hw_update_data->bw_clk_config.sfe_clock_config_valid)
+		goto end;
+
+	CAM_INFO(CAM_PERF, "SFE ctx_idx: %u clk update usage: %u left_clk: %lu right_clk: %lu",
+		c_ctx->ctx_index, sfe_clock_config->usage_type, sfe_clock_config->left_pix_hz,
+		sfe_clock_config->right_pix_hz);
+
+end:
+	return;
+}
+
+static int cam_isp_classify_vote_info(
+	struct cam_isp_hw_mgr_res              *hw_mgr_res,
+	struct cam_isp_bw_config_internal_v2   *bw_config,
+	struct cam_axi_vote                    *isp_vote,
+	uint32_t                                hw_type,
+	uint32_t                                split_idx,
+	bool                                   *nrdi_l_bw_updated,
+	bool                                   *nrdi_r_bw_updated,
+	bool                                    is_sfe_shdr)
+{
+	int                                   rc = 0, i, j = 0;
+
+	if (hw_type == CAM_ISP_HW_TYPE_VFE) {
+		if ((hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF)
+			|| (hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_RD) ||
+			(hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_PDLIB) ||
+			(hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_LCR)) {
+			if (split_idx == CAM_ISP_HW_SPLIT_LEFT) {
+				if (*nrdi_l_bw_updated)
+					return rc;
+
+				for (i = 0; i < bw_config->num_paths; i++) {
+					if (bw_config->axi_path[i].usage_data ==
+						CAM_ISP_USAGE_LEFT_PX) {
+						memcpy(&isp_vote->axi_path[j],
+							&bw_config->axi_path[i],
+							sizeof(struct
+							cam_cpas_axi_per_path_bw_vote));
+						j++;
+					}
+				}
+				isp_vote->num_paths = j;
+
+				*nrdi_l_bw_updated = true;
+			} else {
+				if (*nrdi_r_bw_updated)
+					return rc;
+
+				for (i = 0; i < bw_config->num_paths; i++) {
+					if (bw_config->axi_path[i].usage_data ==
+						CAM_ISP_USAGE_RIGHT_PX) {
+						memcpy(&isp_vote->axi_path[j],
+							&bw_config->axi_path[i],
+							sizeof(struct
+							cam_cpas_axi_per_path_bw_vote));
+						j++;
+					}
+				}
+				isp_vote->num_paths = j;
+
+				*nrdi_r_bw_updated = true;
+			}
+		} else if ((hw_mgr_res->res_id >= CAM_ISP_HW_VFE_IN_RDI0)
+			&& (hw_mgr_res->res_id <=
+			CAM_ISP_HW_VFE_IN_RDI5)) {
+			for (i = 0; i < bw_config->num_paths; i++) {
+				if ((bw_config->axi_path[i].usage_data ==
+					CAM_ISP_USAGE_RDI) &&
+					((bw_config->axi_path[i].path_data_type -
+					CAM_AXI_PATH_DATA_IFE_RDI0) ==
+					(hw_mgr_res->res_id -
+					CAM_ISP_HW_VFE_IN_RDI0))) {
+					memcpy(&isp_vote->axi_path[j],
+						&bw_config->axi_path[i],
+						sizeof(struct
+						cam_cpas_axi_per_path_bw_vote));
+					j++;
+				}
+			}
+			isp_vote->num_paths = j;
+
+		} else {
+			if (hw_mgr_res->hw_res[split_idx]) {
+				CAM_ERR(CAM_ISP, "Invalid res_id %u, split_idx: %u",
+					hw_mgr_res->res_id, split_idx);
+				rc = -EINVAL;
+				return rc;
+			}
+		}
+	} else {
+		if (is_sfe_shdr ||
+			(hw_mgr_res->res_id == CAM_ISP_HW_SFE_IN_PIX) ||
+			(hw_mgr_res->res_id == CAM_ISP_HW_SFE_IN_RD)) {
+			if ((split_idx == CAM_ISP_HW_SPLIT_LEFT) &&
+				(!(*nrdi_l_bw_updated))) {
+				for (i = 0; i < bw_config->num_paths; i++) {
+					if (bw_config->axi_path[i].usage_data ==
+						CAM_ISP_USAGE_SFE_LEFT) {
+						memcpy(&isp_vote->axi_path[j],
+							&bw_config->axi_path[i],
+							sizeof(struct
+							cam_cpas_axi_per_path_bw_vote));
+						j++;
+					}
+				}
+				isp_vote->num_paths = j;
+
+				*nrdi_l_bw_updated = true;
+			} else if (!(*nrdi_r_bw_updated)) {
+				for (i = 0; i < bw_config->num_paths; i++) {
+					if (bw_config->axi_path[i].usage_data ==
+						CAM_ISP_USAGE_SFE_RIGHT) {
+						memcpy(&isp_vote->axi_path[j],
+							&bw_config->axi_path[i],
+							sizeof(struct
+							cam_cpas_axi_per_path_bw_vote));
+						j++;
+					}
+				}
+				isp_vote->num_paths = j;
+
+				*nrdi_r_bw_updated = true;
+			}
+		}
+
+		if ((hw_mgr_res->res_id >= CAM_ISP_HW_SFE_IN_RDI0)
+			&& (hw_mgr_res->res_id <=
+			CAM_ISP_HW_SFE_IN_RDI4)) {
+			for (i = 0; i < bw_config->num_paths; i++) {
+				if ((bw_config->axi_path[i].usage_data ==
+					CAM_ISP_USAGE_SFE_RDI) &&
+					((bw_config->axi_path[i].path_data_type -
+					CAM_AXI_PATH_DATA_SFE_RDI0) ==
+					(hw_mgr_res->res_id -
+					CAM_ISP_HW_SFE_IN_RDI0))) {
+					memcpy(&isp_vote->axi_path[j],
+						&bw_config->axi_path[i],
+						sizeof(struct
+						cam_cpas_axi_per_path_bw_vote));
+					j++;
+				}
+			}
+			isp_vote->num_paths = j;
+		}
+	}
+
+	for (i = 0; i < isp_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"CLASSIFY_VOTE [%s] [%s] [%s] [%s] [%llu] [%llu] [%llu]",
+			cam_isp_util_usage_data_to_string(
+			isp_vote->axi_path[i].usage_data),
+			cam_cpas_axi_util_path_type_to_string(
+			isp_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			isp_vote->axi_path[i].transac_type),
+			cam_cpas_axi_util_drv_vote_lvl_to_string(
+			isp_vote->axi_path[i].vote_level),
+			isp_vote->axi_path[i].camnoc_bw,
+			isp_vote->axi_path[i].mnoc_ab_bw,
+			isp_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_bw_update_v2(
+	struct cam_isp_bw_config_internal_v2   *bw_config,
+	struct cam_ife_hw_mgr_ctx              *ctx)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_vfe_bw_update_args_v2       bw_upd_args;
+	struct cam_sfe_bw_update_args          sfe_bw_update_args;
+	int                                    rc = -EINVAL;
+	uint32_t                               i, split_idx = INT_MIN;
+	bool                                   nrdi_l_bw_updated = false;
+	bool                                   nrdi_r_bw_updated = false;
+	bool                                   is_sfe_shdr = false;
+
+	for (i = 0; i < bw_config->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"ctx_idx: %u ISP_BLOB usage_type=%u [%s] [%s] [%s] [%s] [%llu] [%llu] [%llu]",
+			c_ctx->ctx_index, bw_config->usage_type,
+			cam_isp_util_usage_data_to_string(
+			bw_config->axi_path[i].usage_data),
+			cam_cpas_axi_util_path_type_to_string(
+			bw_config->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			bw_config->axi_path[i].transac_type),
+			cam_cpas_axi_util_drv_vote_lvl_to_string(
+			bw_config->axi_path[i].vote_level),
+			bw_config->axi_path[i].camnoc_bw,
+			bw_config->axi_path[i].mnoc_ab_bw,
+			bw_config->axi_path[i].mnoc_ib_bw);
+	}
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		for (split_idx = 0; split_idx < CAM_ISP_HW_SPLIT_MAX;
+			split_idx++) {
+			if (!hw_mgr_res->hw_res[split_idx])
+				continue;
+
+			memset(&bw_upd_args.isp_vote, 0,
+				sizeof(struct cam_axi_vote));
+			rc = cam_isp_classify_vote_info(hw_mgr_res, bw_config,
+				&bw_upd_args.isp_vote, CAM_ISP_HW_TYPE_VFE,
+				split_idx, &nrdi_l_bw_updated, &nrdi_r_bw_updated,
+				false);
+			if (rc)
+				return rc;
+
+			if (!bw_upd_args.isp_vote.num_paths)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[split_idx]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_upd_args.node_res =
+					hw_mgr_res->hw_res[split_idx];
+
+				/*
+				 * Update BW values to top, actual apply to hw will happen when
+				 * CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE is called
+				 */
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_UPDATE_V2,
+					&bw_upd_args,
+					sizeof(
+					struct cam_vfe_bw_update_args_v2));
+				if (rc)
+					CAM_ERR(CAM_PERF,
+						"BW Update failed rc: %d, ctx_idx: %u",
+						rc, c_ctx->ctx_index);
+			} else {
+				CAM_WARN(CAM_ISP, "NULL hw_intf!, ctx_idx: %u", c_ctx->ctx_index);
+			}
+		}
+	}
+
+	nrdi_l_bw_updated = false;
+	nrdi_r_bw_updated = false;
+
+	if ((c_ctx->flags.is_sfe_fs) || (c_ctx->flags.is_sfe_shdr))
+		is_sfe_shdr = true;
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_sfe_src, list) {
+		for (split_idx = 0; split_idx < CAM_ISP_HW_SPLIT_MAX;
+			split_idx++) {
+			if (!hw_mgr_res->hw_res[split_idx])
+				continue;
+
+			memset(&sfe_bw_update_args.sfe_vote, 0,
+				sizeof(struct cam_axi_vote));
+			rc = cam_isp_classify_vote_info(hw_mgr_res, bw_config,
+				&sfe_bw_update_args.sfe_vote, CAM_ISP_HW_TYPE_SFE,
+				split_idx, &nrdi_l_bw_updated, &nrdi_r_bw_updated,
+				is_sfe_shdr);
+			if (rc)
+				return rc;
+
+			if (!sfe_bw_update_args.sfe_vote.num_paths)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[split_idx]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				sfe_bw_update_args.node_res =
+					hw_mgr_res->hw_res[split_idx];
+
+				/*
+				 * Update BW values to top, actual apply to hw will happen when
+				 * CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE is called
+				 */
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_UPDATE_V2,
+					&sfe_bw_update_args,
+					sizeof(
+					struct cam_sfe_bw_update_args));
+				if (rc)
+					CAM_ERR(CAM_PERF,
+						"BW Update failed rc: %d, ctx_idx: %u",
+						rc, c_ctx->ctx_index);
+			} else {
+				CAM_WARN(CAM_ISP, "NULL hw_intf!, ctx_idx: %u", c_ctx->ctx_index);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_bw_update(
+	struct cam_isp_bw_config              *bw_config,
+	struct cam_ife_hw_mgr_ctx             *ctx)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_vfe_bw_update_args          bw_upd_args;
+	uint64_t                               cam_bw_bps = 0;
+	uint64_t                               ext_bw_bps = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+	bool                                   camif_l_bw_updated = false;
+	bool                                   camif_r_bw_updated = false;
+
+	CAM_DBG(CAM_PERF,
+		"ctx_idx: %u ISP_BLOB usage=%u left cam_bw_bps=%llu ext_bw_bps=%llu, right cam_bw_bps=%llu ext_bw_bps=%llu",
+		c_ctx->ctx_index, bw_config->usage_type,
+		bw_config->left_pix_vote.cam_bw_bps,
+		bw_config->left_pix_vote.ext_bw_bps,
+		bw_config->right_pix_vote.cam_bw_bps,
+		bw_config->right_pix_vote.ext_bw_bps);
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if ((hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF) ||
+				(hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_RD) ||
+				(hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_PDLIB)
+				|| (hw_mgr_res->res_id ==
+				CAM_ISP_HW_VFE_IN_LCR))
+				if (i == CAM_ISP_HW_SPLIT_LEFT) {
+					if (camif_l_bw_updated)
+						continue;
+
+					cam_bw_bps =
+					bw_config->left_pix_vote.cam_bw_bps;
+					ext_bw_bps =
+					bw_config->left_pix_vote.ext_bw_bps;
+
+					camif_l_bw_updated = true;
+				} else {
+					if (camif_r_bw_updated)
+						continue;
+
+					cam_bw_bps =
+					bw_config->right_pix_vote.cam_bw_bps;
+					ext_bw_bps =
+					bw_config->right_pix_vote.ext_bw_bps;
+
+					camif_r_bw_updated = true;
+				}
+			else if ((hw_mgr_res->res_id >= CAM_ISP_HW_VFE_IN_RDI0)
+					&& (hw_mgr_res->res_id <=
+					CAM_ISP_HW_VFE_IN_RDI5)) {
+				uint32_t idx = hw_mgr_res->res_id -
+						CAM_ISP_HW_VFE_IN_RDI0;
+				if (idx >= bw_config->num_rdi)
+					continue;
+
+				cam_bw_bps =
+					bw_config->rdi_vote_flex[idx].cam_bw_bps;
+				ext_bw_bps =
+					bw_config->rdi_vote_flex[idx].ext_bw_bps;
+			} else {
+				if (hw_mgr_res->hw_res[i]) {
+					CAM_ERR(CAM_ISP, "Invalid ctx_idx: %u res_id %u",
+						c_ctx->ctx_index, hw_mgr_res->res_id);
+					rc = -EINVAL;
+					return rc;
+				}
+			}
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+				bw_upd_args.camnoc_bw_bytes = cam_bw_bps;
+				bw_upd_args.external_bw_bytes = ext_bw_bps;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_UPDATE,
+					&bw_upd_args,
+					sizeof(struct cam_vfe_bw_update_args));
+				if (rc)
+					CAM_ERR(CAM_PERF, "BW Update failed, ctx_idx: %u",
+						c_ctx->ctx_index);
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!ctx_idx: %u", c_ctx->ctx_index);
+		}
+	}
+
+	return rc;
+}
+
+static void cam_ife_mgr_send_frame_event(uint64_t request_id, uint32_t ctx_index)
+{
+	if (cam_presil_mode_enabled()) {
+		CAM_DBG(CAM_PRESIL, "PRESIL FRAME req_id=%llu ctx_index %u",
+			request_id, ctx_index);
+		cam_presil_send_event(CAM_PRESIL_EVENT_IFE_FRAME_RUN, request_id);
+	}
+}
+
+static void cam_isp_irq_inject_clear_params(
+	struct cam_isp_irq_inject_param *param)
+{
+	param->hw_type  = -1;
+	param->hw_idx   = -1;
+	param->reg_unit = -1;
+	param->irq_mask = -1;
+	param->req_id   = 0;
+	param->is_valid = false;
+	memset(param->line_buf, '\0', LINE_BUFFER_LEN);
+}
+
+static int cam_ife_hw_mgr_sfe_irq_inject_or_dump_desc(
+	struct cam_ife_hw_mgr *hw_mgr,
+	struct cam_isp_irq_inject_param *params,
+	bool dump_irq_desc)
+{
+	int i, rc = 0;
+	char *line_buf = NULL;
+	struct cam_hw_intf *hw_intf = NULL;
+
+	line_buf = kzalloc(sizeof(char) * LINE_BUFFER_LEN, GFP_KERNEL);
+	if (!line_buf)
+		return -ENOMEM;
+
+	for (i = 0; i < CAM_SFE_HW_NUM_MAX; i++) {
+		if ((!hw_mgr->sfe_devices[i]) ||
+			(hw_mgr->sfe_devices[i]->hw_intf->hw_idx != params->hw_idx))
+			continue;
+
+		hw_intf = hw_mgr->sfe_devices[i]->hw_intf;
+
+		if (dump_irq_desc) {
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION, params,
+				sizeof(struct cam_isp_irq_inject_param));
+			goto clear_param;
+		}
+
+		rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_IRQ_INJECTION, params,
+			sizeof(struct cam_isp_irq_inject_param));
+		if (rc)
+			scnprintf(line_buf, LINE_BUFFER_LEN,
+				"Injecting IRQ %x failed for SFE at req: %d\n",
+				params->irq_mask, params->req_id);
+		else
+			scnprintf(line_buf, LINE_BUFFER_LEN,
+				"IRQ %#x injected for SFE at req: %d\n",
+				params->irq_mask, params->req_id);
+		break;
+	}
+
+clear_param:
+	strlcat(irq_inject_display_buf, params->line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+	strlcat(irq_inject_display_buf, line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+
+	/* Clear the param injected */
+	cam_isp_irq_inject_clear_params(params);
+	kfree(line_buf);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_vfe_irq_inject_or_dump_desc(
+	struct cam_ife_hw_mgr *hw_mgr,
+	struct cam_isp_irq_inject_param *params,
+	bool dump_irq_desc)
+{
+	int i, rc = 0;
+	char *line_buf = NULL;
+	struct cam_hw_intf *hw_intf = NULL;
+
+	line_buf = kzalloc(sizeof(char) * LINE_BUFFER_LEN, GFP_KERNEL);
+	if (!line_buf)
+		return -ENOMEM;
+
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if ((!hw_mgr->ife_devices[i]) ||
+			(hw_mgr->ife_devices[i]->hw_intf->hw_idx != params->hw_idx))
+			continue;
+
+		hw_intf = hw_mgr->ife_devices[i]->hw_intf;
+
+		if (dump_irq_desc) {
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION, params,
+				sizeof(struct cam_isp_irq_inject_param));
+			goto clear_param;
+		}
+
+		rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_IRQ_INJECTION, params,
+			sizeof(struct cam_isp_irq_inject_param));
+		if (rc)
+			scnprintf(line_buf, LINE_BUFFER_LEN,
+				"Injecting IRQ %x failed for IFE at req: %d\n",
+				params->irq_mask, params->req_id);
+		else
+			scnprintf(line_buf, LINE_BUFFER_LEN,
+				"IRQ %#x injected for IFE at req: %d\n",
+				params->irq_mask, params->req_id);
+		break;
+	}
+
+clear_param:
+	strlcat(irq_inject_display_buf, params->line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+	strlcat(irq_inject_display_buf, line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+
+	/* Clear the param injected */
+	cam_isp_irq_inject_clear_params(params);
+	kfree(line_buf);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_csid_irq_inject_or_dump_desc(
+	struct cam_ife_hw_mgr *hw_mgr,
+	struct cam_isp_irq_inject_param *params,
+	bool dump_irq_desc)
+{
+	int i, rc = 0;
+	char *line_buf = NULL;
+	struct cam_hw_intf *hw_intf = NULL;
+
+	line_buf = kzalloc(sizeof(char) * LINE_BUFFER_LEN, GFP_KERNEL);
+	if (!line_buf)
+		return -ENOMEM;
+
+	for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		if ((!hw_mgr->csid_devices[i]) ||
+			(hw_mgr->csid_devices[i]->hw_idx != params->hw_idx))
+			continue;
+
+		hw_intf = hw_mgr->csid_devices[i];
+
+		if (dump_irq_desc) {
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION, params,
+				sizeof(struct cam_isp_irq_inject_param));
+			goto clear_param;
+		}
+
+		rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_IRQ_INJECTION, params,
+			sizeof(struct cam_isp_irq_inject_param));
+		if (rc)
+			scnprintf(line_buf, LINE_BUFFER_LEN,
+				"Injecting IRQ %x failed for CSID at req: %d\n",
+				params->irq_mask, params->req_id);
+		else
+			scnprintf(line_buf, LINE_BUFFER_LEN,
+				"IRQ %#x injected for CSID at req: %d\n",
+				params->irq_mask, params->req_id);
+		break;
+	}
+
+clear_param:
+	strlcat(irq_inject_display_buf, params->line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+	strlcat(irq_inject_display_buf, line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+
+	/* Clear the param injected */
+	cam_isp_irq_inject_clear_params(params);
+	kfree(line_buf);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_irq_injection(struct cam_ife_hw_mgr *hw_mgr,
+	uint64_t request_id)
+{
+	int i, rc = 0;
+
+	for (i = 0; i < MAX_INJECT_SET; i++) {
+		if ((!hw_mgr->irq_inject_param[i].is_valid) ||
+			((hw_mgr->irq_inject_param[i].req_id != request_id) &&
+			(hw_mgr->irq_inject_param[i].req_id != 0xFFFFFFFF)))
+			continue;
+
+		switch (hw_mgr->irq_inject_param[i].hw_type) {
+		case CAM_ISP_HW_TYPE_CSID:
+			rc = cam_ife_hw_mgr_csid_irq_inject_or_dump_desc(
+				hw_mgr, &hw_mgr->irq_inject_param[i], false);
+			break;
+		case CAM_ISP_HW_TYPE_VFE:
+			rc = cam_ife_hw_mgr_vfe_irq_inject_or_dump_desc(
+				hw_mgr, &hw_mgr->irq_inject_param[i], false);
+			break;
+		case CAM_ISP_HW_TYPE_SFE:
+			rc = cam_ife_hw_mgr_sfe_irq_inject_or_dump_desc(
+				hw_mgr, &hw_mgr->irq_inject_param[i], false);
+			break;
+		default:
+			strlcat(irq_inject_display_buf, "No matched HW_TYPE\n",
+				IRQ_INJECT_DISPLAY_BUF_LEN);
+			rc = -EINVAL;
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_fcg_update(
+	struct cam_isp_fcg_config_internal *fcg_config_internal,
+	uint32_t                            entry_idx,
+	uint32_t                            prediction_idx,
+	struct list_head                   *res_list_isp_src,
+	struct cam_hw_config_args          *cfg)
+{
+	struct cam_isp_resource_node                *res;
+	struct cam_isp_hw_mgr_res                   *hw_mgr_res;
+	struct cam_isp_hw_fcg_cmd                    fcg_cmd;
+	struct cam_hw_update_entry                  *hw_entry;
+	uint32_t                                     i;
+	int                                          rc = -EINVAL;
+
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if (entry_idx >= cfg->num_hw_update_entries) {
+				CAM_ERR(CAM_ISP,
+					"Entry index %d exceed number of hw update entries %u, request id %llu",
+					entry_idx, cfg->num_hw_update_entries, cfg->request_id);
+				return -EINVAL;
+			}
+
+			hw_entry = &cfg->hw_update_entries[entry_idx];
+			res = hw_mgr_res->hw_res[i];
+
+			fcg_cmd.res = res;
+			fcg_cmd.cmd_type = CAM_ISP_HW_CMD_FCG_CONFIG;
+			fcg_cmd.get_size_flag = false;
+			fcg_cmd.u.fcg_update.cmd_size = hw_entry->len;
+			fcg_cmd.u.fcg_update.cmd_buf_addr = hw_entry->addr;
+			fcg_cmd.u.fcg_update.data = (void *)fcg_config_internal;
+
+			/* This prediction sent from userspace is insufficient */
+			if (prediction_idx > fcg_config_internal->num_predictions)
+				prediction_idx = fcg_config_internal->num_predictions;
+			fcg_cmd.u.fcg_update.prediction_idx = prediction_idx;
+
+			CAM_DBG(CAM_ISP,
+				"Replace FCG config with predicted ones, prediction idx: %d, request id: %llu",
+				prediction_idx, cfg->request_id);
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_FCG_CONFIG,
+				&fcg_cmd, (uint32_t)sizeof(struct cam_isp_hw_fcg_cmd));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in writing FCG values to the hw update entry, rc: %d, request id: %llu",
+					rc, cfg->request_id);
+				return rc;
+			}
+			return 0;
+		}
+	}
+
+	CAM_DBG(CAM_ISP,
+		"No matching ISP resources when filling FCG hw update entry, request id: %llu",
+		cfg->request_id);
+	return rc;
+}
+
+static inline int cam_ife_mgr_apply_fcg_update(
+	struct cam_ife_hw_mgr_ctx             *ctx,
+	struct cam_isp_prepare_hw_update_data *hw_update_data,
+	struct cam_hw_config_args             *cfg)
+{
+	int rc = 0;
+	struct cam_isp_fcg_config_internal *fcg_configs;
+	struct cam_ife_hw_concrete_ctx     *c_ctx = ctx->concr_ctx;
+
+	if (hw_update_data->fcg_info.ife_fcg_online &&
+		!hw_update_data->fcg_info.use_current_cfg) {
+		CAM_DBG(CAM_ISP, "Start writing IFE/MC_TFE FCG configs to kmd buffer on ctx: %d",
+			c_ctx->ctx_index);
+
+		fcg_configs = &hw_update_data->fcg_info.ife_fcg_config;
+		rc = cam_isp_blob_fcg_update(fcg_configs,
+			hw_update_data->fcg_info.ife_fcg_entry_idx,
+			hw_update_data->fcg_info.prediction_idx,
+			&c_ctx->res_list_ife_src, cfg);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in applying IFE/MC_TFE FCG configurations, ctx_idx: %u",
+				c_ctx->ctx_index);
+			return rc;
+		}
+	}
+
+	if (hw_update_data->fcg_info.sfe_fcg_online &&
+		!hw_update_data->fcg_info.use_current_cfg) {
+		CAM_DBG(CAM_ISP, "Start writing SFE FCG configs to kmd buffer on ctx: %d",
+			c_ctx->ctx_index);
+
+		fcg_configs = &hw_update_data->fcg_info.sfe_fcg_config;
+		rc = cam_isp_blob_fcg_update(fcg_configs,
+			hw_update_data->fcg_info.sfe_fcg_entry_idx,
+			hw_update_data->fcg_info.prediction_idx,
+			&c_ctx->res_list_sfe_src, cfg);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in applying SFE FCG configurations, ctx_idx: %u",
+				c_ctx->ctx_index);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+/* entry function: config_hw */
+int cam_ife_mgr_config_hw(
+	void *hw_mgr_priv,
+	void *config_hw_args)
+{
+	int rc, i, skip = 0;
+	struct cam_hw_config_args *cfg;
+	struct cam_hw_update_entry *cmd;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx *c_ctx;
+	struct cam_isp_prepare_hw_update_data *hw_update_data;
+	struct cam_ife_hw_mgr *ife_hw_mgr;
+	unsigned long rem_jiffies = 0;
+	bool is_cdm_hung = false;
+	size_t len = 0;
+	uint32_t *buf_addr = NULL, *buf_start = NULL, *buf_end = NULL;
+	uint32_t cmd_type = 0;
+
+	if (!hw_mgr_priv || !config_hw_args) {
+		CAM_ERR(CAM_ISP,
+			"Invalid arguments, hw_mgr_priv=%pK, config_hw_args=%pK",
+			hw_mgr_priv, config_hw_args);
+		return -EINVAL;
+	}
+	ife_hw_mgr = (struct cam_ife_hw_mgr *)hw_mgr_priv;
+
+	cfg = config_hw_args;
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)cfg->ctxt_to_hw_map;
+	if (!hw_mgr_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EINVAL;
+	}
+	c_ctx = hw_mgr_ctx->concr_ctx;
+	if (!c_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+
+	}
+
+	if (!c_ctx->flags.ctx_in_use || !c_ctx->cdm_cmd) {
+		CAM_ERR(CAM_ISP,
+			"Invalid context parameters : ctx_index %u, ctx_in_use=%d, cdm_cmd=%pK",
+			c_ctx->ctx_index, c_ctx->flags.ctx_in_use, c_ctx->cdm_cmd);
+		return -EPERM;
+	}
+
+	if (atomic_read(&c_ctx->overflow_pending)) {
+		CAM_DBG(CAM_ISP,
+			"Ctx[%pK][%u] Overflow pending, cannot apply req %llu",
+			c_ctx, c_ctx->ctx_index, cfg->request_id);
+		return -EPERM;
+	}
+
+	/*
+	 * Assuming overflow recovery happens on req N, and we may
+	 * haven't got all the result for req N while apply N + 1,
+	 * so we reset try_recovery_cnt while apply N + 2.
+	 */
+	if (c_ctx->try_recovery_cnt &&
+		(cfg->request_id > (c_ctx->recovery_req_id + 1))) {
+		c_ctx->try_recovery_cnt = 0;
+		c_ctx->recovery_req_id = 0;
+		CAM_DBG(CAM_ISP,
+			"Ctx[%pK][%u] Reset overflow recovery count for req %llu",
+			c_ctx, c_ctx->ctx_index, cfg->request_id);
+	}
+
+	rc = cam_ife_hw_mgr_irq_injection(ife_hw_mgr, cfg->request_id);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to inject IRQ at req %d",
+			cfg->request_id);
+
+	hw_update_data = (struct cam_isp_prepare_hw_update_data  *) cfg->priv;
+	hw_update_data->isp_mgr_ctx = hw_mgr_ctx;
+	c_ctx->cdm_userdata.request_id = cfg->request_id;
+	c_ctx->cdm_userdata.hw_update_data = hw_update_data;
+
+	CAM_DBG(CAM_ISP, "Ctx[%pK][%u] : Applying Req %lld, init_packet=%d",
+		c_ctx, c_ctx->ctx_index, cfg->request_id, cfg->init_packet);
+
+	if (cfg->reapply_type && cfg->cdm_reset_before_apply) {
+		if (c_ctx->last_cdm_done_req < cfg->request_id) {
+			is_cdm_hung = !cam_cdm_detect_hang_error(c_ctx->cdm_handle);
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"ctx_idx: %u CDM callback not received for req: %lld, last_cdm_done_req: %lld, is_cdm_hung: %d",
+				c_ctx->ctx_index, cfg->request_id, c_ctx->last_cdm_done_req,
+				is_cdm_hung);
+
+			if (!is_cdm_hung)
+				cam_cdm_dump_debug_registers(c_ctx->cdm_handle);
+
+			rc = cam_cdm_reset_hw(c_ctx->cdm_handle);
+			if (rc) {
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"CDM reset unsuccessful for req: %lld. ctx: %u, rc: %d",
+					cfg->request_id, c_ctx->ctx_index, rc);
+				c_ctx->last_cdm_done_req = 0;
+				return rc;
+			}
+		} else {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CDM callback received, should wait for buf done for req: %lld, ctx_idx: %u",
+				cfg->request_id, c_ctx->ctx_index);
+			return -EALREADY;
+		}
+		c_ctx->last_cdm_done_req = 0;
+	}
+
+	if (cam_presil_mode_enabled()) {
+		CAM_INFO(CAM_ISP, "Presil Mode - Skipping CLK BW Update");
+		goto skip_bw_clk_update;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"ctx_idx=%u, bw_config_version=%d config_valid[BW VFE_CLK SFE_CLK]:[%d %d %d]",
+		c_ctx->ctx_index, c_ctx->bw_config_version,
+		hw_update_data->bw_clk_config.bw_config_valid,
+		hw_update_data->bw_clk_config.ife_clock_config_valid,
+		hw_update_data->bw_clk_config.sfe_clock_config_valid);
+
+	if (hw_update_data->drv_config_valid) {
+		rc = cam_isp_blob_drv_config(hw_mgr_ctx, cfg->request_id, hw_update_data);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "DRV config failed for req: %llu rc:%d ctx_idx=%u",
+				cfg->request_id,
+				rc, c_ctx->ctx_index);
+		}
+	}
+
+	/*
+	 * Update clock and bw values to top layer, the actual application of these
+	 * votes to hw will happen for all relevant hw indices at once, in a separate
+	 * finish update call
+	 */
+	if (hw_update_data->bw_clk_config.ife_clock_config_valid) {
+		rc = cam_isp_blob_ife_clock_update((struct cam_isp_clock_config *)
+			&hw_update_data->bw_clk_config.ife_clock_config, hw_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_PERF, "Clock Update Failed, rc=%d, ctx_idx=%u",
+				rc, c_ctx->ctx_index);
+			return rc;
+		}
+	}
+
+	if (hw_update_data->bw_clk_config.sfe_clock_config_valid) {
+		rc = cam_isp_blob_sfe_clock_update((struct cam_isp_clock_config *)
+			&hw_update_data->bw_clk_config.sfe_clock_config, hw_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_PERF, "Clock Update Failed, rc=%d, ctx_idx=%u",
+				rc, c_ctx->ctx_index);
+			return rc;
+		}
+	}
+
+	if (hw_update_data->bw_clk_config.bw_config_valid) {
+		if (c_ctx->bw_config_version == CAM_ISP_BW_CONFIG_V1) {
+			rc = cam_isp_blob_bw_update(
+				(struct cam_isp_bw_config *)
+				&hw_update_data->bw_clk_config.bw_config, hw_mgr_ctx);
+			if (rc) {
+				CAM_ERR(CAM_PERF, "Bandwidth Update Failed rc: %d, ctx_idx=%u",
+					rc, c_ctx->ctx_index);
+				return rc;
+			}
+		} else if ((c_ctx->bw_config_version == CAM_ISP_BW_CONFIG_V2) ||
+			(c_ctx->bw_config_version == CAM_ISP_BW_CONFIG_V3)) {
+			rc = cam_isp_blob_bw_update_v2(&hw_update_data->bw_clk_config.bw_config_v2,
+					hw_mgr_ctx);
+			if (rc) {
+				CAM_ERR(CAM_PERF, "Bandwidth Update Failed rc: %d, ctx_idx=%u",
+					rc, c_ctx->ctx_index);
+				return rc;
+			}
+		} else {
+			CAM_ERR(CAM_PERF, "Invalid bw config version: %d, ctx_idx=%u",
+				c_ctx->bw_config_version, c_ctx->ctx_index);
+		}
+	}
+
+	/* Apply the updated values in top layer to the HW*/
+	rc = cam_ife_mgr_finish_clk_bw_update(hw_mgr_ctx, cfg->request_id, false);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed in finishing clk/bw update rc: %d, ctx_idx=%u",
+			rc, c_ctx->ctx_index);
+		cam_ife_mgr_print_blob_info(hw_mgr_ctx, cfg->request_id, hw_update_data);
+		return rc;
+	}
+
+skip_bw_clk_update:
+	rc = cam_ife_mgr_apply_fcg_update(hw_mgr_ctx, hw_update_data, cfg);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed in updating FCG values %u", c_ctx->ctx_index);
+		return rc;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Enter ctx id:%u num_hw_upd_entries %d request id: %llu",
+		c_ctx->ctx_index, cfg->num_hw_update_entries, cfg->request_id);
+
+	if (cfg->num_hw_update_entries > 0) {
+		cdm_cmd                    = c_ctx->cdm_cmd;
+		if (!cdm_cmd) {
+			CAM_ERR(CAM_ISP, "ctx_cmd is NULL");
+			return -EPERM;
+		}
+
+		cdm_cmd->type              = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+		cdm_cmd->flag              = true;
+		cdm_cmd->userdata          = hw_mgr_ctx;
+		cdm_cmd->cookie            = cfg->request_id;
+		cdm_cmd->gen_irq_arb       = false;
+		cdm_cmd->genirq_buff       = &hw_update_data->kmd_cmd_buff_info;
+
+		for (i = 0 ; i < cfg->num_hw_update_entries; i++) {
+			cmd = (cfg->hw_update_entries + i);
+			if (!cmd) {
+				CAM_ERR(CAM_ISP, "cmd[%d] is NULL", i);
+				return -EPERM;
+			}
+
+			if ((cfg->reapply_type == CAM_CONFIG_REAPPLY_IO) &&
+				(cmd->flags == CAM_ISP_IQ_BL)) {
+				skip++;
+				continue;
+			}
+
+			if ((cfg->reapply_type == CAM_CONFIG_REAPPLY_IQ) &&
+				(cmd->flags == CAM_ISP_IOCFG_BL)) {
+				skip++;
+				continue;
+			}
+
+			if (cmd->flags == CAM_ISP_UNUSED_BL ||
+				cmd->flags >= CAM_ISP_BL_MAX)
+				CAM_ERR(CAM_ISP, "Unexpected BL type %d, ctx_idx=%u",
+					cmd->flags, c_ctx->ctx_index);
+
+			if (hw_update_data->fcg_info.ife_fcg_online &&
+				(hw_update_data->fcg_info.ife_fcg_entry_idx == i)) {
+				CAM_DBG(CAM_ISP,
+					"IFE/MC_TFE FCG hw entry is detected, num_ent: %d, ctx_idx: %u, request id: %llu, use current cfg: %d",
+					i, c_ctx->ctx_index, cfg->request_id,
+					hw_update_data->fcg_info.use_current_cfg);
+				if (hw_update_data->fcg_info.use_current_cfg) {
+					skip++;
+					continue;
+				}
+			}
+
+			if (hw_update_data->fcg_info.sfe_fcg_online &&
+				(hw_update_data->fcg_info.sfe_fcg_entry_idx == i)) {
+				CAM_DBG(CAM_ISP,
+					"SFE FCG hw entry is detected, num_ent: %d, ctx_idx: %u, request id: %llu, use current cfg: %d",
+					i, c_ctx->ctx_index, cfg->request_id,
+					hw_update_data->fcg_info.use_current_cfg);
+				if (hw_update_data->fcg_info.use_current_cfg) {
+					skip++;
+					continue;
+				}
+			}
+
+			cdm_cmd->cmd_flex[i - skip].bl_addr.mem_handle = cmd->handle;
+			cdm_cmd->cmd_flex[i - skip].offset = cmd->offset;
+			cdm_cmd->cmd_flex[i - skip].len = cmd->len;
+			cdm_cmd->cmd_flex[i - skip].arbitrate = false;
+
+			if (g_ife_hw_mgr.debug_cfg.enable_cdm_cmd_check) {
+				CAM_INFO_RATE_LIMIT(CAM_ISP, "Enter cdm cmd_buf validation");
+				rc = cam_packet_util_get_cmd_mem_addr(
+					cdm_cmd->cmd_flex[i - skip].bl_addr.mem_handle,
+					&buf_addr, &len);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed to get buf_addr and len for mem_handle: %d ctx id: %u request id: %llu",
+						cdm_cmd->cmd_flex[i - skip].bl_addr.mem_handle,
+						c_ctx->ctx_index, cfg->request_id);
+					continue;
+				}
+
+				buf_start = (uint32_t *)((uint8_t *) buf_addr +
+					cdm_cmd->cmd_flex[i - skip].offset);
+				buf_end = (uint32_t *)((uint8_t *) buf_start +
+					cdm_cmd->cmd_flex[i - skip].len - 1);
+				cmd_type = ((uint32_t)(*buf_start) >> CAM_CDM_COMMAND_OFFSET);
+				if ((i == 0) && (cmd_type != CAM_CDM_CMD_CHANGE_BASE)) {
+					CAM_ERR(CAM_ISP,
+						"first cmd in cmd_buf is not change_base, cmd_type: %u ctx id: %u request id: %llu",
+						cmd_type, c_ctx->ctx_index, cfg->request_id);
+					cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
+					return -EINVAL;
+				}
+
+				if (cam_cdm_util_validate_cmd_buf(buf_start, buf_end)) {
+					CAM_ERR(CAM_ISP,
+						"found invalid cmd in cmd_buf, ctx id: %u request id: %llu",
+						c_ctx->ctx_index, cfg->request_id);
+					cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
+					return -EINVAL;
+				}
+			}
+		}
+		cdm_cmd->cmd_arrary_count = cfg->num_hw_update_entries - skip;
+
+		if (cam_presil_mode_enabled()) {
+			CAM_INFO(CAM_ISP,
+				"Sending relevant buffers for request:%llu to presil, ctx_idx=%u",
+				cfg->request_id, c_ctx->ctx_index);
+			rc = cam_presil_send_buffers_from_packet(hw_update_data->packet,
+				g_ife_hw_mgr.mgr_common.img_iommu_hdl,
+				g_ife_hw_mgr.mgr_common.cmd_iommu_hdl);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+				    "Error sending buffers for request:%llu to presil, ctx=%u",
+				    cfg->request_id, c_ctx->ctx_index);
+				return rc;
+			}
+		}
+
+		reinit_completion(&c_ctx->config_done_complete);
+		c_ctx->applied_req_id = cfg->request_id;
+
+		CAM_DBG(CAM_ISP, "Submit to CDM, ctx_idx=%u", c_ctx->ctx_index);
+		atomic_set(&c_ctx->cdm_done, 0);
+		rc = cam_cdm_submit_bls(c_ctx->cdm_handle, cdm_cmd);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed to apply the configs for req %llu, rc %d ctx_idx=%u",
+				cfg->request_id, rc, c_ctx->ctx_index);
+			return rc;
+		}
+
+		if (cam_presil_mode_enabled() || cfg->init_packet || hw_update_data->mup_en ||
+			(c_ctx->ctx_config & CAM_IFE_CTX_CFG_SW_SYNC_ON)) {
+			rem_jiffies = cam_common_wait_for_completion_timeout(
+				&c_ctx->config_done_complete,
+				msecs_to_jiffies(60));
+			if (rem_jiffies == 0) {
+				CAM_ERR(CAM_ISP,
+					"config done completion timeout for req_id=%llu ctx_index %u",
+					cfg->request_id, c_ctx->ctx_index);
+				rc = cam_cdm_detect_hang_error(c_ctx->cdm_handle);
+				if (rc < 0) {
+					cam_cdm_dump_debug_registers(
+						c_ctx->cdm_handle);
+					rc = -ETIMEDOUT;
+				} else {
+					CAM_DBG(CAM_ISP,
+						"Wq delayed but IRQ CDM done, ctx_index %u",
+						c_ctx->ctx_index);
+				}
+			} else {
+				CAM_DBG(CAM_ISP,
+					"config done Success for req_id=%llu ctx_index %u",
+					cfg->request_id, c_ctx->ctx_index);
+				/* Update last applied MUP */
+				if (hw_update_data->mup_en) {
+					c_ctx->current_mup = hw_update_data->mup_val;
+					c_ctx->curr_num_exp = hw_update_data->num_exp;
+				}
+				hw_update_data->mup_en = false;
+
+				/* Try for INIT packet reg dump by default - no debugfs set */
+				if (cfg->init_packet && !g_ife_hw_mgr.debug_cfg.per_req_reg_dump)
+					cam_ife_mgr_handle_reg_dump(hw_mgr_ctx,
+						hw_update_data->reg_dump_buf_desc,
+						hw_update_data->num_reg_dump_buf,
+						CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST,
+						NULL, false);
+			}
+		}
+
+		cam_ife_mgr_send_frame_event(cfg->request_id, c_ctx->ctx_index);
+	} else {
+		CAM_ERR(CAM_ISP, "No commands to config, ctx_index %u", c_ctx->ctx_index);
+	}
+
+	CAM_DBG(CAM_ISP, "Exit: Config Done: %llu, ctx_index %u",
+				cfg->request_id, c_ctx->ctx_index);
+	return rc;
+}
+
+static int cam_ife_mgr_stop_hw_in_overflow(void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_ife_hw_mgr_ctx        *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx   *c_ctx;
+	uint32_t                          i, master_base_idx = 0;
+
+	if (!stop_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)stop_args->ctxt_to_hw_map;
+	if (!hw_mgr_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+	c_ctx = hw_mgr_ctx->concr_ctx;
+	if (!c_ctx || !c_ctx->flags.ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%u",
+		c_ctx->ctx_index);
+
+	if (!c_ctx->num_base) {
+		CAM_ERR(CAM_ISP, "Number of bases are zero, ctx_index %u", c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	/* get master base index first */
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
+			master_base_idx = c_ctx->base[i].idx;
+			break;
+		}
+	}
+
+	if (i == c_ctx->num_base)
+		master_base_idx = c_ctx->base[0].idx;
+
+	/* stop the master CSID path first */
+	cam_ife_mgr_csid_stop_hw(hw_mgr_ctx, &c_ctx->res_list_ife_csid,
+		master_base_idx, CAM_CSID_HALT_IMMEDIATELY);
+
+	/* Stop rest of the CSID paths  */
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (i == master_base_idx)
+			continue;
+
+		cam_ife_mgr_csid_stop_hw(hw_mgr_ctx, &c_ctx->res_list_ife_csid,
+			c_ctx->base[i].idx, CAM_CSID_HALT_IMMEDIATELY);
+	}
+
+	/* IFE mux in resources */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	/* IFE bus rd resources */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_in_rd, list) {
+		cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	/* IFE out resources */
+	for (i = 0; i < c_ctx->num_acq_vfe_out; i++)
+		cam_ife_hw_mgr_stop_hw_res(&c_ctx->res_list_ife_out[i]);
+
+	/* Stop tasklet for context */
+	cam_tasklet_stop(c_ctx->common.tasklet_info);
+	CAM_DBG(CAM_ISP, "Exit...ctx id:%u rc :%d",
+		c_ctx->ctx_index, rc);
+
+	return rc;
+}
+
+static int cam_ife_mgr_bw_control(struct cam_ife_hw_mgr_ctx *ctx,
+	enum cam_isp_bw_control_action action)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_isp_bw_control_args         bw_ctrl_args;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d", c_ctx->ctx_index);
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_ctrl_args.node_res =
+					hw_mgr_res->hw_res[i];
+				bw_ctrl_args.action = action;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_CONTROL,
+					&bw_ctrl_args,
+					sizeof(struct cam_isp_bw_control_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "BW Update failed, ctx id:%u",
+						c_ctx->ctx_index);
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!, ctx id:%u", c_ctx->ctx_index);
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_sfe_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_ctrl_args.node_res =
+					hw_mgr_res->hw_res[i];
+				bw_ctrl_args.action = action;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_CONTROL,
+					&bw_ctrl_args,
+					sizeof(struct cam_isp_bw_control_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "BW Update failed, ctx id:%u",
+						c_ctx->ctx_index);
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf! ctx id:%u", c_ctx->ctx_index);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_pause_hw(struct cam_ife_hw_mgr_ctx *ctx)
+{
+	return cam_ife_mgr_bw_control(ctx, CAM_ISP_BW_CONTROL_EXCLUDE);
+}
+
+/* entry function: stop_hw */
+static int cam_ife_mgr_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_isp_stop_args         *stop_isp;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_ife_hw_mgr_ctx        *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx   *c_ctx;
+	enum cam_ife_csid_halt_cmd        csid_halt_type;
+	uint32_t                          i, master_base_idx = 0;
+	unsigned long                     rem_jiffies = 0;
+	bool                              skip_hw_deinit = false, per_port_feature_enable = false;
+
+	if (!hw_mgr_priv || !stop_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)stop_args->ctxt_to_hw_map;
+	if (!hw_mgr_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+	c_ctx = hw_mgr_ctx->concr_ctx;
+
+	if (!c_ctx || !c_ctx->flags.ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	if (!c_ctx->num_base) {
+		CAM_ERR(CAM_ISP, "number of bases are zero, ctx id:%u", c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	/* Cancel all scheduled recoveries without affecting future recoveries */
+	atomic_inc(&c_ctx->recovery_id);
+
+	CAM_DBG(CAM_ISP, " Enter...ctx id:%d", c_ctx->ctx_index);
+	stop_isp = (struct cam_isp_stop_args    *)stop_args->args;
+
+	/* Set the csid halt command */
+	if ((stop_isp->hw_stop_cmd == CAM_ISP_HW_STOP_AT_FRAME_BOUNDARY) ||
+		c_ctx->flags.dsp_enabled)
+		csid_halt_type = CAM_CSID_HALT_AT_FRAME_BOUNDARY;
+	else
+		csid_halt_type = CAM_CSID_HALT_IMMEDIATELY;
+
+	if (c_ctx->flags.per_port_en && !c_ctx->flags.is_dual && !c_ctx->flags.is_offline) {
+		rc = cam_ife_hw_mgr_res_stream_on_off_grp_cfg(hw_mgr_ctx,
+				stop_isp, csid_halt_type, false,
+				&per_port_feature_enable,
+				&skip_hw_deinit);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "failed to stop Hw for ctx:%d sensor:%d",
+				c_ctx->ctx_index, c_ctx->sensor_id);
+			return -EINVAL;
+		}
+	}
+
+	if (per_port_feature_enable)
+		goto reset_scratch_buffers;
+
+	/* Note:stop resource will remove the irq mask from the hardware */
+
+	CAM_DBG(CAM_ISP, "Halting CSIDs, ctx id:%u", c_ctx->ctx_index);
+
+	/* get master base index first */
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
+			master_base_idx = c_ctx->base[i].idx;
+			break;
+		}
+	}
+
+	/*
+	 * If Context does not have PIX resources and has only RDI resource
+	 * then take the first base index.
+	 */
+	if (i == c_ctx->num_base)
+		master_base_idx = c_ctx->base[0].idx;
+
+	/*Change slave mode*/
+	if (csid_halt_type == CAM_CSID_HALT_IMMEDIATELY)
+		cam_ife_mgr_csid_change_halt_mode(hw_mgr_ctx,
+			CAM_CSID_HALT_MODE_INTERNAL);
+
+
+	CAM_DBG(CAM_ISP, "Stopping master CSID idx %d, ctx id:%u",
+			master_base_idx, c_ctx->ctx_index);
+
+
+	/* Stop the master CSID path first */
+	cam_ife_mgr_csid_stop_hw(hw_mgr_ctx, &c_ctx->res_list_ife_csid,
+		master_base_idx, csid_halt_type);
+
+	/* stop rest of the CSID paths  */
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].idx == master_base_idx)
+			continue;
+		CAM_DBG(CAM_ISP, "Stopping CSID idx %d i %d master %d ctx id:%u",
+			c_ctx->base[i].idx, i, master_base_idx, c_ctx->ctx_index);
+
+		cam_ife_mgr_csid_stop_hw(hw_mgr_ctx, &c_ctx->res_list_ife_csid,
+			c_ctx->base[i].idx, csid_halt_type);
+	}
+
+	/* Ensure HW layer does not reset any clk data since it's
+	 * internal stream off/resume
+	 */
+	if (stop_isp->is_internal_stop)
+		cam_ife_mgr_finish_clk_bw_update(hw_mgr_ctx, 0, true);
+
+	/* check to avoid iterating loop */
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		CAM_DBG(CAM_ISP, "Going to stop SFE Out, ctx id:%u", c_ctx->ctx_index);
+
+		/* SFE out resources */
+		for (i = 0; i < c_ctx->num_acq_sfe_out; i++)
+			cam_ife_hw_mgr_stop_hw_res(&c_ctx->res_list_sfe_out[i]);
+
+		CAM_DBG(CAM_ISP, "Going to stop SFE SRC resources, ctx id:%u", c_ctx->ctx_index);
+
+		/* SFE in resources */
+		list_for_each_entry(hw_mgr_res, &c_ctx->res_list_sfe_src, list)
+			cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	CAM_DBG(CAM_ISP, "Going to stop IFE out resources, ctx id:%u", c_ctx->ctx_index);
+
+	/* IFE out resources */
+	for (i = 0; i < c_ctx->num_acq_vfe_out; i++)
+		cam_ife_hw_mgr_stop_hw_res(&c_ctx->res_list_ife_out[i]);
+
+	CAM_DBG(CAM_ISP, "Going to stop IFE Mux, ctx id:%u", c_ctx->ctx_index);
+
+	/* IFE mux in resources */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	/* bus rd resources */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_in_rd, list) {
+		cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+reset_scratch_buffers:
+	cam_tasklet_stop(c_ctx->common.tasklet_info);
+
+	/* reset scratch buffer/mup expect INIT again for UMD triggered stop/flush */
+	if (!stop_isp->is_internal_stop) {
+		c_ctx->current_mup = 0;
+		if (c_ctx->scratch_buf_info.sfe_scratch_config)
+			memset(c_ctx->scratch_buf_info.sfe_scratch_config, 0,
+				sizeof(struct cam_sfe_scratch_buf_cfg));
+
+		if (c_ctx->scratch_buf_info.ife_scratch_config)
+			memset(c_ctx->scratch_buf_info.ife_scratch_config, 0,
+				sizeof(struct cam_ife_scratch_buf_cfg));
+	}
+
+	if (!skip_hw_deinit)
+		cam_ife_mgr_pause_hw(hw_mgr_ctx);
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(
+		&c_ctx->config_done_complete,
+		msecs_to_jiffies(10));
+	if (rem_jiffies == 0)
+		CAM_WARN(CAM_ISP,
+			"config done completion timeout for last applied req_id=%llu ctx_index %u",
+			c_ctx->applied_req_id, c_ctx->ctx_index);
+
+	/* Reset CDM for KMD internal stop */
+	if (stop_isp->is_internal_stop) {
+		rc = cam_cdm_reset_hw(c_ctx->cdm_handle);
+		if (rc) {
+			CAM_WARN(CAM_ISP, "CDM: %u reset failed rc: %d in ctx: %u",
+				c_ctx->cdm_id, rc, c_ctx->ctx_index);
+			rc = 0;
+		}
+	}
+
+	if (stop_isp->stop_only)
+		goto end;
+
+	if (cam_cdm_stream_off(c_ctx->cdm_handle))
+		CAM_ERR(CAM_ISP, "CDM stream off failed %d, ctx_id: %u",
+			c_ctx->cdm_handle, c_ctx->ctx_index);
+
+	if (!skip_hw_deinit)
+		cam_ife_hw_mgr_deinit_hw(hw_mgr_ctx);
+
+	CAM_DBG(CAM_ISP,
+		"Stop success for ctx id:%d rc :%d", c_ctx->ctx_index, rc);
+
+#ifdef CONFIG_SPECTRA_SECURE
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	if (!atomic_dec_return(&g_ife_hw_mgr.active_ctx_cnt)) {
+		rc = cam_ife_notify_safe_lut_scm(CAM_IFE_SAFE_DISABLE);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"SAFE SCM call failed:Check TZ/HYP dependency, ctx_id: %u",
+				c_ctx->ctx_index);
+			rc = 0;
+		}
+	}
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+#endif /* ifdef CONFIG_SPECTRA_SECURE */
+
+end:
+	c_ctx->flags.dump_on_error = false;
+	c_ctx->flags.dump_on_flush = false;
+	return rc;
+}
+
+static int cam_ife_mgr_reset_vfe_hw(struct cam_ife_hw_mgr *hw_mgr,
+	uint32_t hw_idx)
+{
+	uint32_t i = 0;
+	struct cam_hw_intf             *vfe_hw_intf;
+	uint32_t vfe_reset_type;
+
+	if (!hw_mgr) {
+		CAM_DBG(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+	/* Reset VFE HW*/
+	vfe_reset_type = CAM_VFE_HW_RESET_HW;
+
+	for (i = 0; i < CAM_VFE_HW_NUM_MAX; i++) {
+		if (!hw_mgr->ife_devices[i])
+			continue;
+
+		if (hw_idx != hw_mgr->ife_devices[i]->hw_intf->hw_idx)
+			continue;
+		CAM_DBG(CAM_ISP, "VFE (id = %d) reset", hw_idx);
+		vfe_hw_intf = hw_mgr->ife_devices[i]->hw_intf;
+		vfe_hw_intf->hw_ops.reset(vfe_hw_intf->hw_priv,
+			&vfe_reset_type, sizeof(vfe_reset_type));
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "Exit Successfully");
+	return 0;
+}
+
+static int cam_ife_mgr_unmask_bus_wr_irq(struct cam_ife_hw_mgr *hw_mgr,
+	uint32_t hw_idx)
+{
+	uint32_t i = 0, dummy_args = 0;
+	struct cam_hw_intf *vfe_hw_intf;
+
+	if (!hw_mgr) {
+		CAM_DBG(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_VFE_HW_NUM_MAX; i++) {
+		if (!hw_mgr->ife_devices[i])
+			continue;
+
+		if (hw_idx != hw_mgr->ife_devices[i]->hw_intf->hw_idx)
+			continue;
+
+		CAM_DBG(CAM_ISP, "Unmask VFE:%d BUS_WR IRQ", hw_idx);
+
+		vfe_hw_intf = hw_mgr->ife_devices[i]->hw_intf;
+
+		vfe_hw_intf->hw_ops.process_cmd(vfe_hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ,
+			&dummy_args,
+			sizeof(dummy_args));
+
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_ife_mgr_restart_hw(void *start_hw_args)
+{
+	int                               rc = -1;
+	struct cam_hw_start_args         *start_args = start_hw_args;
+	struct cam_ife_hw_mgr_ctx        *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx  *c_ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	uint32_t                          i;
+
+	if (!start_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)start_args->ctxt_to_hw_map;
+	c_ctx = hw_mgr_ctx->concr_ctx;
+	if (!c_ctx || !c_ctx->flags.ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "START IFE OUT ... in ctx id:%u", c_ctx->ctx_index);
+
+	cam_tasklet_start(c_ctx->common.tasklet_info);
+
+	/* start the IFE out devices */
+	for (i = 0; i < c_ctx->num_acq_vfe_out; i++) {
+		rc = cam_ife_hw_mgr_start_hw_res(
+			&c_ctx->res_list_ife_out[i], hw_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE OUT (%d), ctx_idx: %u",
+				i, c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START IFE SRC ... in ctx id:%u", c_ctx->ctx_index);
+
+	/* Start IFE BUS RD device */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_in_rd, list) {
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, hw_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE BUS RD (%d), ctx_idx: %u",
+				 hw_mgr_res->res_id, c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	/* Start the IFE mux in devices */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, hw_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE MUX (%d), ctx_idx: %u",
+				 hw_mgr_res->res_id, c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START CSID HW ... in ctx id:%u", c_ctx->ctx_index);
+
+	/* Start the IFE CSID HW devices */
+	rc = cam_ife_mgr_csid_start_hw(hw_mgr_ctx, CAM_IFE_PIX_PATH_RES_MAX, false, false);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error in starting CSID HW in ctx id:%u", c_ctx->ctx_index);
+		goto err;
+	}
+
+	/* Start IFE root node: do nothing */
+	CAM_DBG(CAM_ISP, "Exit...(success), ctx_idx: %u", c_ctx->ctx_index);
+	return 0;
+
+err:
+	cam_ife_mgr_stop_hw_in_overflow(start_hw_args);
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d), ctx_idx: %u", rc, c_ctx->ctx_index);
+	return rc;
+}
+
+static int cam_ife_mgr_find_core_idx(
+	int split_id,
+	struct cam_ife_hw_mgr_ctx *ctx,
+	enum cam_isp_hw_type hw_type,
+	uint32_t *core_idx)
+{
+	int i;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].hw_type != hw_type)
+			continue;
+
+		if (c_ctx->base[i].split_id == split_id) {
+			CAM_DBG(CAM_ISP, "Found core: %u for split_id: %d hw_type: %d ctx_idx: %u",
+				c_ctx->base[i].idx, split_id, hw_type, c_ctx->ctx_index);
+			*core_idx = c_ctx->base[i].idx;
+			goto end;
+		}
+	}
+
+	CAM_ERR(CAM_ISP, "Failed to find core idx for hw_type: %d split_id %d ctx_idx: %u",
+		hw_type, split_id, c_ctx->ctx_index);
+	return -EINVAL;
+
+end:
+	return 0;
+}
+
+static void cam_ife_hw_mgr_set_hw_debug_config(
+	struct cam_ife_hw_mgr_ctx *ctx)
+{
+	int i, rc;
+	uint32_t hw_idx = 0;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	struct cam_ife_hw_mgr *hw_mgr = c_ctx->hw_mgr;
+	struct cam_ife_csid_debug_cfg_args csid_debug_args;
+	struct cam_sfe_debug_cfg_params sfe_debug_args = {0};
+	struct cam_vfe_generic_debug_config vfe_debug_args = {0};
+
+	/* Set CSID debug args */
+	csid_debug_args.csid_debug = hw_mgr->debug_cfg.csid_debug;
+	csid_debug_args.csid_rx_capture_debug = hw_mgr->debug_cfg.rx_capture_debug;
+	csid_debug_args.rx_capture_debug_set = hw_mgr->debug_cfg.rx_capture_debug_set;
+	csid_debug_args.csid_testbus_debug = hw_mgr->debug_cfg.csid_test_bus;
+
+	/* Set SFE debug args */
+	sfe_debug_args.cache_config = false;
+	sfe_debug_args.u.dbg_cfg.sfe_debug_cfg = hw_mgr->debug_cfg.sfe_debug;
+	sfe_debug_args.u.dbg_cfg.sfe_sensor_sel = hw_mgr->debug_cfg.sfe_sensor_diag_cfg;
+	sfe_debug_args.u.dbg_cfg.num_counters = hw_mgr->isp_caps.num_sfe_perf_counters;
+	for (i = 0; i < hw_mgr->isp_caps.num_sfe_perf_counters; i++)
+		sfe_debug_args.u.dbg_cfg.sfe_perf_counter_val[i] =
+			hw_mgr->debug_cfg.sfe_perf_counter_val[i];
+
+	/* Set IFE bus debug args */
+	vfe_debug_args.disable_ife_mmu_prefetch = hw_mgr->debug_cfg.disable_ife_mmu_prefetch;
+	vfe_debug_args.enable_ife_frame_irqs = hw_mgr->debug_cfg.enable_ife_frame_irqs;
+	vfe_debug_args.num_counters = hw_mgr->isp_caps.num_ife_perf_counters;
+	for (i = 0; i < hw_mgr->isp_caps.num_ife_perf_counters; i++)
+		vfe_debug_args.vfe_perf_counter_val[i] =
+			hw_mgr->debug_cfg.ife_perf_counter_val[i];
+
+	/* Iterate over HW acquired for this stream and update debug config */
+	for (i = 0; i < c_ctx->num_base; i++) {
+		hw_idx = c_ctx->base[i].idx;
+
+		switch (c_ctx->base[i].hw_type) {
+		case CAM_ISP_HW_TYPE_VFE:
+			if (hw_mgr->ife_devices[hw_idx]) {
+				rc = hw_mgr->ife_devices[hw_idx]->hw_intf->hw_ops.process_cmd(
+					hw_mgr->ife_devices[hw_idx]->hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_IFE_DEBUG_CFG,
+					&vfe_debug_args, sizeof(vfe_debug_args));
+				if (rc)
+					CAM_DBG(CAM_ISP,
+						"Failed to set IFE_%u bus wr debug cfg rc: %d, ctx_idx: %u",
+						hw_idx, rc, c_ctx->ctx_index);
+			}
+			break;
+		case CAM_ISP_HW_TYPE_SFE:
+			if (hw_mgr->sfe_devices[hw_idx]) {
+				rc = hw_mgr->sfe_devices[hw_idx]->hw_intf->hw_ops.process_cmd(
+					hw_mgr->sfe_devices[hw_idx]->hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_SET_SFE_DEBUG_CFG,
+					&sfe_debug_args, sizeof(sfe_debug_args));
+				if (rc)
+					CAM_DBG(CAM_ISP,
+						"Failed to set SFE_%u debug cfg rc: %d, ctx_idx: %u",
+						hw_idx, rc, c_ctx->ctx_index);
+			}
+			break;
+		case CAM_ISP_HW_TYPE_CSID:
+			if (hw_mgr->csid_devices[hw_idx]) {
+				rc = hw_mgr->csid_devices[hw_idx]->hw_ops.process_cmd(
+					hw_mgr->csid_devices[hw_idx]->hw_priv,
+					CAM_IFE_CSID_SET_CSID_DEBUG,
+					&csid_debug_args, sizeof(csid_debug_args));
+				if (rc)
+					CAM_DBG(CAM_ISP,
+						"Failed to set CSID_%u debug cfg rc: %d, ctx_idx: %u",
+						hw_idx, rc, c_ctx->ctx_index);
+			}
+			break;
+		default:
+			break;
+		}
+	}
+}
+
+static int cam_ife_mgr_start_hw(void *hw_mgr_priv, void *start_hw_args)
+{
+	int                                  rc = -1;
+	struct cam_isp_start_args           *start_isp = start_hw_args;
+	struct cam_hw_stop_args              stop_args;
+	struct cam_isp_stop_args             stop_isp;
+	struct cam_ife_hw_mgr_ctx           *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx      *c_ctx;
+	struct cam_isp_hw_mgr_res           *hw_mgr_res;
+	struct cam_isp_resource_node        *rsrc_node = NULL;
+	uint32_t                             i;
+	uint32_t                             camif_debug;
+	bool                                 res_rdi_context_set = false;
+	uint32_t                             primary_rdi_src_res;
+	uint32_t                             primary_rdi_out_res;
+	uint32_t                             primary_rdi_csid_res;
+	struct cam_ife_csid_top_config_args  csid_top_args = {0};
+	struct cam_hw_intf                  *hw_intf;
+	bool                                 per_port_feature_enable = false;
+
+	primary_rdi_src_res = CAM_ISP_HW_VFE_IN_MAX;
+	primary_rdi_out_res = g_ife_hw_mgr.isp_caps.max_vfe_out_res_type;
+	primary_rdi_csid_res = CAM_IFE_PIX_PATH_RES_MAX;
+
+	if (!hw_mgr_priv || !start_isp) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)
+		start_isp->hw_config.ctxt_to_hw_map;
+	c_ctx = hw_mgr_ctx->concr_ctx;
+	if (!c_ctx || !c_ctx->flags.ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	if ((!c_ctx->flags.init_done) && start_isp->start_only) {
+		CAM_ERR(CAM_ISP, "Invalid args init_done %d start_only %d, ctx_idx: %u",
+			c_ctx->flags.init_done, start_isp->start_only, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter... ctx id:%u c_ctx->flags.need_csid_top_cfg:%d",
+		c_ctx->ctx_index, c_ctx->flags.need_csid_top_cfg);
+
+	rc = cam_cpas_query_drv_enable(&g_ife_hw_mgr.cam_ddr_drv_support,
+		&g_ife_hw_mgr.cam_clk_drv_support);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to query DRV enable rc: %d", rc);
+		return -EINVAL;
+	}
+
+	/* update Bandwidth should be done at the hw layer */
+
+	cam_tasklet_start(c_ctx->common.tasklet_info);
+
+	if (c_ctx->flags.init_done && start_isp->start_only) {
+		/* Unmask BUS_WR bit in VFE top */
+		for (i = 0; i < c_ctx->num_base; i++) {
+			rc = cam_ife_mgr_unmask_bus_wr_irq(hw_mgr_priv,
+				c_ctx->base[i].idx);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Failed to unmask VFE:%d BUS_WR IRQ rc:%d ctx_idx: %u",
+					c_ctx->base[i].idx, rc, c_ctx->ctx_index);
+		}
+		goto start_only;
+	}
+
+	/* Update debug config for acquired HW */
+	cam_ife_hw_mgr_set_hw_debug_config(hw_mgr_ctx);
+
+	if (c_ctx->flags.need_csid_top_cfg) {
+		list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid,
+				list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				/* Updated based on sfe context */
+				if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+					csid_top_args.input_core_type =
+						CAM_IFE_CSID_INPUT_CORE_SFE_IFE;
+					rc = cam_ife_mgr_find_core_idx(
+						i, hw_mgr_ctx, CAM_ISP_HW_TYPE_SFE,
+						&csid_top_args.core_idx);
+					if (rc)
+						goto tasklet_stop;
+				} else {
+					csid_top_args.input_core_type =
+						CAM_IFE_CSID_INPUT_CORE_IFE;
+				}
+
+				if (c_ctx->flags.is_offline)
+					csid_top_args.is_sfe_offline = true;
+
+				if (c_ctx->flags.is_sfe_fs)
+					csid_top_args.is_sfe_fs = true;
+
+				hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_IFE_CSID_TOP_CONFIG,
+					&csid_top_args,
+					sizeof(csid_top_args));
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"CSID: %u top config cmd failed, rc:%d",
+						hw_intf->hw_idx, rc);
+					goto tasklet_stop;
+				}
+				CAM_DBG(CAM_ISP,
+					"CSID: %u split_id: %d core_idx: %u core_type: %u is_sfe_offline: %d ctx_idx: %u",
+					hw_intf->hw_idx, i, csid_top_args.core_idx,
+					csid_top_args.input_core_type,
+					csid_top_args.is_sfe_offline, c_ctx->ctx_index);
+			}
+		}
+	}
+
+	camif_debug = g_ife_hw_mgr.debug_cfg.camif_debug;
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rsrc_node = hw_mgr_res->hw_res[i];
+			if (rsrc_node->process_cmd && (rsrc_node->res_id ==
+				CAM_ISP_HW_VFE_IN_CAMIF)) {
+				rc = hw_mgr_res->hw_res[i]->process_cmd(
+					hw_mgr_res->hw_res[i],
+					CAM_ISP_HW_CMD_SET_CAMIF_DEBUG,
+					&camif_debug,
+					sizeof(camif_debug));
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"VFE process cmd failed for rsrc_id:%d, rc:%d",
+						rsrc_node->res_id, rc);
+				}
+			}
+		}
+	}
+
+	rc = cam_ife_hw_mgr_init_hw(hw_mgr_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Init failed, ctx_idx: %u", c_ctx->ctx_index);
+		goto tasklet_stop;
+	}
+
+	c_ctx->flags.init_done = true;
+
+#ifdef CONFIG_SPECTRA_SECURE
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	if (!atomic_fetch_inc(&g_ife_hw_mgr.active_ctx_cnt)) {
+		rc = cam_ife_notify_safe_lut_scm(CAM_IFE_SAFE_ENABLE);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"SAFE SCM call failed:Check TZ/HYP dependency, ctx_idx: %u",
+				c_ctx->ctx_index);
+			rc = -EFAULT;
+			mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+			goto deinit_hw;
+		}
+	}
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+#endif /* ifdef  CONFIG_SPECTRA_SECURE */
+
+	rc = cam_cdm_stream_on(c_ctx->cdm_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Can not start cdm (%d), ctx_idx: %u",
+			c_ctx->cdm_handle, c_ctx->ctx_index);
+		goto safe_disable;
+	}
+
+start_only:
+
+	atomic_set(&c_ctx->overflow_pending, 0);
+
+	/* Apply initial configuration */
+	CAM_DBG(CAM_ISP, "Config HW, ctx_idx: %u", c_ctx->ctx_index);
+	rc = cam_ife_mgr_v_config_hw(hw_mgr_priv, &start_isp->hw_config);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Config HW failed, start_only=%d, rc=%d ctx_idx: %u",
+			start_isp->start_only, rc, c_ctx->ctx_index);
+		goto cdm_streamoff;
+	}
+
+	if (c_ctx->flags.per_port_en && !c_ctx->flags.is_dual && !c_ctx->flags.is_offline) {
+		rc = cam_ife_hw_mgr_res_stream_on_off_grp_cfg(hw_mgr_ctx,
+				start_isp, 0, true, &per_port_feature_enable, NULL);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "failed to start Hw for ctx:%d sensor:%d",
+				c_ctx->ctx_index, c_ctx->sensor_id);
+			goto err;
+		}
+	}
+
+	if (per_port_feature_enable)
+		goto end;
+
+	CAM_DBG(CAM_ISP, "START IFE OUT ... in ctx id:%d",
+		c_ctx->ctx_index);
+	/* start the IFE out devices */
+	for (i = 0; i < c_ctx->num_acq_vfe_out; i++) {
+		hw_mgr_res = &c_ctx->res_list_ife_out[i];
+		switch (hw_mgr_res->res_id) {
+		case CAM_ISP_IFE_OUT_RES_RDI_0:
+		case CAM_ISP_IFE_OUT_RES_RDI_1:
+		case CAM_ISP_IFE_OUT_RES_RDI_2:
+		case CAM_ISP_IFE_OUT_RES_RDI_3:
+		case CAM_ISP_IFE_OUT_RES_RDI_4:
+		case CAM_ISP_IFE_OUT_RES_RDI_5:
+			if (!res_rdi_context_set && cam_isp_is_ctx_primary_rdi(hw_mgr_ctx)) {
+				hw_mgr_res->hw_res[0]->is_rdi_primary_res =
+					cam_isp_is_ctx_primary_rdi(hw_mgr_ctx);
+				res_rdi_context_set = true;
+				primary_rdi_out_res = hw_mgr_res->res_id;
+			}
+			break;
+		default:
+			break;
+		}
+		rc = cam_ife_hw_mgr_start_hw_res(
+			&c_ctx->res_list_ife_out[i], hw_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE OUT (%d), ctx_idx: %u",
+				 i, c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	if (primary_rdi_out_res < g_ife_hw_mgr.isp_caps.max_vfe_out_res_type) {
+		primary_rdi_src_res =
+			cam_convert_rdi_out_res_id_to_src(primary_rdi_out_res);
+		primary_rdi_csid_res =
+			cam_ife_hw_mgr_get_ife_csid_rdi_res_type(
+			primary_rdi_out_res);
+	}
+
+	CAM_DBG(CAM_ISP, "START IFE SRC ... in ctx id:%d",
+		c_ctx->ctx_index);
+	/* Start the IFE mux in devices */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		if (primary_rdi_src_res == hw_mgr_res->res_id) {
+			hw_mgr_res->hw_res[0]->is_rdi_primary_res =
+			cam_isp_is_ctx_primary_rdi(hw_mgr_ctx);
+		}
+
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, hw_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE Mux (%d), ctx_idx: %u",
+				 hw_mgr_res->res_id, c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		CAM_DBG(CAM_ISP, "START SFE OUT ... in ctx id:%u",
+			c_ctx->ctx_index);
+		for (i = 0; i < c_ctx->num_acq_sfe_out; i++) {
+			hw_mgr_res = &c_ctx->res_list_sfe_out[i];
+			rc = cam_ife_hw_mgr_start_hw_res(
+				hw_mgr_res, hw_mgr_ctx);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Can not start SFE OUT (%d), ctx_idx: %u",
+					i, c_ctx->ctx_index);
+				goto err;
+			}
+		}
+
+		CAM_DBG(CAM_ISP, "START SFE SRC RSRC ... in ctx id:%u",
+			c_ctx->ctx_index);
+		list_for_each_entry(hw_mgr_res, &c_ctx->res_list_sfe_src, list) {
+			rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, hw_mgr_ctx);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Can not start SFE SRC (%d), ctx_idx: %u",
+					hw_mgr_res->res_id, c_ctx->ctx_index);
+				goto err;
+			}
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START BUS RD ... in ctx id:%u",
+		c_ctx->ctx_index);
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_in_rd, list) {
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, hw_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start BUS RD (%d), ctx_idx: %u",
+				hw_mgr_res->res_id, c_ctx->ctx_index);
+			goto err;
+		}
+	}
+
+	if ((c_ctx->flags.is_sfe_fs) || (c_ctx->flags.is_sfe_shdr)) {
+		rc = cam_ife_mgr_prog_default_settings(true, hw_mgr_ctx);
+		if (rc)
+			goto err;
+
+		/* Reset streamon related scratch buffer config */
+		cam_ife_mgr_reset_streamon_scratch_cfg(hw_mgr_ctx);
+	}
+
+	CAM_DBG(CAM_ISP, "START CSID HW ... in ctx id:%d",
+		c_ctx->ctx_index);
+	/* Start the IFE CSID HW devices */
+	rc = cam_ife_mgr_csid_start_hw(hw_mgr_ctx, primary_rdi_csid_res,
+		start_isp->is_internal_start, start_isp->start_only);
+	if (rc)
+		goto err;
+
+end:
+	/* Start IFE root node: do nothing */
+	CAM_DBG(CAM_ISP, "Start success for ctx id:%d", c_ctx->ctx_index);
+
+	return 0;
+
+err:
+	stop_isp.stop_only = false;
+	stop_isp.hw_stop_cmd = CAM_ISP_HW_STOP_IMMEDIATELY;
+	stop_args.ctxt_to_hw_map = start_isp->hw_config.ctxt_to_hw_map;
+	stop_args.args = (void *)(&stop_isp);
+
+	cam_ife_mgr_stop_hw(hw_mgr_priv, &stop_args);
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d), ctx_idx: %u", rc, c_ctx->ctx_index);
+	return rc;
+
+cdm_streamoff:
+	cam_cdm_stream_off(c_ctx->cdm_handle);
+safe_disable:
+#ifdef CONFIG_SPECTRA_SECURE
+	cam_ife_notify_safe_lut_scm(CAM_IFE_SAFE_DISABLE);
+
+deinit_hw:
+#endif /* ifdef CONFIG_SPECTRA_SECURE */
+	cam_ife_hw_mgr_deinit_hw(hw_mgr_ctx);
+
+tasklet_stop:
+	cam_tasklet_stop(c_ctx->common.tasklet_info);
+
+	return rc;
+}
+
+static int cam_ife_mgr_read(void *hw_mgr_priv, void *read_args)
+{
+	return -EPERM;
+}
+
+static int cam_ife_mgr_write(void *hw_mgr_priv, void *write_args)
+{
+	return -EPERM;
+}
+
+static int cam_ife_mgr_reset(void *hw_mgr_priv, void *hw_reset_args)
+{
+	struct cam_ife_hw_mgr            *hw_mgr = hw_mgr_priv;
+	struct cam_hw_reset_args         *reset_args = hw_reset_args;
+	struct cam_ife_hw_mgr_ctx        *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx   *c_ctx;
+	int                               rc = 0, i = 0;
+
+	if (!hw_mgr_priv || !hw_reset_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)reset_args->ctxt_to_hw_map;
+	if (!hw_mgr_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+	c_ctx = hw_mgr_ctx->concr_ctx;
+	if (!c_ctx || !c_ctx->flags.ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	if (hw_mgr->csid_global_reset_en) {
+		CAM_DBG(CAM_ISP, "Path reset not supported, ctx_idx: %u", c_ctx->ctx_index);
+		return 0;
+	}
+
+	CAM_DBG(CAM_ISP, "Reset CSID and VFE, ctx_idx: %u", c_ctx->ctx_index);
+
+	rc = cam_ife_hw_mgr_reset_csid(hw_mgr_ctx, CAM_IFE_CSID_RESET_PATH);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to reset CSID:%d rc: %d ctx_idx: %u",
+			rc, c_ctx->ctx_index);
+		goto end;
+	}
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+		rc = cam_ife_mgr_reset_vfe_hw(hw_mgr, c_ctx->base[i].idx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to reset VFE:%d rc: %d ctx_idx: %u",
+				c_ctx->base[i].idx, rc, c_ctx->ctx_index);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_release_hw(void *hw_mgr_priv,
+					void *release_hw_args)
+{
+	int                               rc           = 0;
+	struct cam_hw_release_args       *release_args = release_hw_args;
+	struct cam_ife_hw_mgr            *hw_mgr       = hw_mgr_priv;
+	struct cam_ife_hw_mgr_ctx        *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx   *c_ctx;
+	uint32_t                          i, j;
+	uint64_t                          ms, sec, min, hrs;
+	bool                              skip_deinit_hw = false;
+	bool                              per_port_feature_enable = false;
+
+	if (!hw_mgr_priv || !release_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)release_args->ctxt_to_hw_map;
+	c_ctx = hw_mgr_ctx->concr_ctx;
+	if (!c_ctx || !c_ctx->flags.ctx_in_use) {
+		if (!hw_mgr_ctx->is_offline) {
+			CAM_ERR(CAM_ISP, "Invalid context is used");
+			return -EPERM;
+		} else
+			return 0;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d",
+		c_ctx->ctx_index);
+
+	if (c_ctx->flags.per_port_en && !c_ctx->flags.is_dual) {
+		for (i = 0; i < g_ife_sns_grp_cfg.num_grp_cfg; i++) {
+			for (j = 0; j <
+				g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg_cnt; j++) {
+				if (c_ctx->sensor_id ==
+					g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].sensor_id) {
+					mutex_lock(&g_ife_sns_grp_cfg.grp_cfg[i]->lock);
+					skip_deinit_hw = true;
+					if (g_ife_sns_grp_cfg.grp_cfg[i]->stream_on_cnt ==
+						0) {
+						rc =
+						cam_ife_hw_mgr_release_hw_for_ctx(hw_mgr_ctx, i);
+						skip_deinit_hw = false;
+						g_ife_sns_grp_cfg.grp_cfg[i]->hw_ctx_cnt--;
+					}
+					cam_ife_hw_mgr_free_hw_ctx(hw_mgr_ctx);
+					per_port_feature_enable = true;
+					mutex_unlock(&g_ife_sns_grp_cfg.grp_cfg[i]->lock);
+					if (!g_ife_sns_grp_cfg.grp_cfg[i]->hw_ctx_cnt)
+						cam_ife_mgr_clear_sensor_stream_cfg_grp(i);
+					break;
+				}
+			}
+		}
+	}
+
+	if (c_ctx->flags.init_done && !skip_deinit_hw)
+		cam_ife_hw_mgr_deinit_hw(hw_mgr_ctx);
+
+	/* we should called the stop hw before this already */
+	if (!per_port_feature_enable)
+		cam_ife_hw_mgr_release_hw_for_ctx(hw_mgr_ctx, CAM_IFE_STREAM_GRP_INDEX_NONE);
+
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		rc = cam_ife_mgr_update_core_info_to_cpas(hw_mgr_ctx, false);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to update core info to cpas rc:%d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+
+	/* reset base info */
+	c_ctx->num_base = 0;
+	memset(c_ctx->base, 0, sizeof(c_ctx->base));
+
+	/* release cdm handle */
+	cam_cdm_release(c_ctx->cdm_handle);
+
+	/* clean context */
+	list_del_init(&c_ctx->list);
+	c_ctx->cdm_handle = 0;
+	c_ctx->cdm_hw_idx = -1;
+	c_ctx->cdm_ops = NULL;
+	c_ctx->num_reg_dump_buf = 0;
+	c_ctx->ctx_type = CAM_IFE_CTX_TYPE_NONE;
+	c_ctx->ctx_config = 0;
+	c_ctx->num_reg_dump_buf = 0;
+	c_ctx->last_cdm_done_req = 0;
+	c_ctx->left_hw_idx = CAM_IFE_CSID_HW_NUM_MAX;
+	c_ctx->right_hw_idx = CAM_IFE_CSID_HW_NUM_MAX;
+	c_ctx->scratch_buf_info.num_fetches = 0;
+	c_ctx->num_acq_vfe_out = 0;
+	c_ctx->num_acq_sfe_out = 0;
+	c_ctx->mapping_table.rdi_path_count = 0;
+	for (i = 0; i < CAM_ISP_STREAM_CFG_MAX; i++) {
+		c_ctx->mapping_table.virtual_rdi[i] = 0;
+		c_ctx->mapping_table.acquired_rdi[i] = 0;
+	}
+
+	kfree(c_ctx->res_list_ife_out);
+	memset(c_ctx->vfe_out_map, 0, sizeof(uint8_t) * max_ife_out_res);
+	c_ctx->res_list_ife_out = NULL;
+	if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE) {
+		kfree(c_ctx->res_list_sfe_out);
+		c_ctx->res_list_sfe_out = NULL;
+		memset(c_ctx->sfe_out_map, 0xff, sizeof(uint8_t) * max_sfe_out_res);
+	}
+	c_ctx->ctx_type = CAM_IFE_CTX_TYPE_NONE;
+	c_ctx->buf_done_controller = NULL;
+	kfree(c_ctx->scratch_buf_info.sfe_scratch_config);
+	kfree(c_ctx->scratch_buf_info.ife_scratch_config);
+	c_ctx->scratch_buf_info.sfe_scratch_config = NULL;
+	c_ctx->scratch_buf_info.ife_scratch_config = NULL;
+	c_ctx->try_recovery_cnt = 0;
+	c_ctx->recovery_req_id = 0;
+	c_ctx->drv_path_idle_en = 0;
+	kfree(c_ctx->vfe_bus_comp_grp);
+	kfree(c_ctx->sfe_bus_comp_grp);
+	c_ctx->vfe_bus_comp_grp = NULL;
+	c_ctx->sfe_bus_comp_grp = NULL;
+
+	memset(&c_ctx->flags, 0, sizeof(struct cam_ife_hw_mgr_ctx_flags));
+	atomic_set(&c_ctx->overflow_pending, 0);
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		c_ctx->sof_cnt[i] = 0;
+		c_ctx->eof_cnt[i] = 0;
+		c_ctx->epoch_cnt[i] = 0;
+	}
+
+	cam_ife_mgr_free_cdm_cmd(&c_ctx->cdm_cmd);
+
+	CAM_GET_TIMESTAMP(c_ctx->ts);
+	CAM_CONVERT_TIMESTAMP_FORMAT(c_ctx->ts, hrs, min, sec, ms);
+
+	CAM_INFO(CAM_ISP, "%llu:%llu:%llu.%llu Release HW success ctx id: %u",
+		hrs, min, sec, ms,
+		c_ctx->ctx_index);
+
+	memset(&c_ctx->ts, 0, sizeof(struct timespec64));
+	cam_ife_hw_mgr_put_ctx(&hw_mgr->free_ctx_list, &hw_mgr_ctx);
+	return rc;
+}
+
+static int cam_isp_blob_fe_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_fe_config                  *fe_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+	struct cam_vfe_fe_update_args          fe_upd_args;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_in_rd, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				fe_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+
+			memcpy(&fe_upd_args.fe_config, fe_config,
+				sizeof(struct cam_fe_config));
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD,
+					&fe_upd_args,
+					sizeof(
+					struct cam_fe_config));
+				if (rc)
+					CAM_ERR(CAM_ISP, "fs Update failed, ctx_idx: %u",
+						c_ctx->ctx_index);
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf! ctx_idx: %u", c_ctx->ctx_index);
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if (hw_mgr_res->res_id != CAM_ISP_HW_VFE_IN_RD)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				fe_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+
+				memcpy(&fe_upd_args.fe_config, fe_config,
+					sizeof(struct cam_fe_config));
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_FE_UPDATE_IN_RD,
+					&fe_upd_args,
+					sizeof(
+					struct cam_vfe_fe_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "fe Update failed, ctx_idx: %u",
+						c_ctx->ctx_index);
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf! ctx_idx: %u", c_ctx->ctx_index);
+		}
+	}
+	return rc;
+}
+
+static int cam_isp_blob_ubwc_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_ubwc_config                *ubwc_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ubwc_plane_cfg_v1          *ubwc_plane_cfg;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf = NULL;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    rc = 0;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+	if (!c_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid ctx");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((prepare->num_hw_update_entries + 1) >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries :%d max:%d ctx_idx: %u",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries, c_ctx->ctx_index);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	switch (ubwc_config->api_version) {
+	case CAM_UBWC_CFG_VERSION_1:
+		CAM_DBG(CAM_ISP, "ctx_idx: %u num_ports= %d",
+			c_ctx->ctx_index, ubwc_config->num_ports);
+
+		kmd_buf_info = blob_info->kmd_buf_info;
+		for (i = 0; i < ubwc_config->num_ports; i++) {
+			ubwc_plane_cfg = &ubwc_config->ubwc_plane_cfg_array_flex[i][0];
+			res_id_out = ubwc_plane_cfg->port_type & 0xFF;
+
+			CAM_DBG(CAM_ISP, "UBWC config idx %d, port_type=%d ctx_idx: %u", i,
+				ubwc_plane_cfg->port_type, c_ctx->ctx_index);
+
+			if (res_id_out >= max_ife_out_res) {
+				CAM_ERR(CAM_ISP, "Invalid port type:%x, ctx_idx: %u",
+					ubwc_plane_cfg->port_type, c_ctx->ctx_index);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			if ((kmd_buf_info->used_bytes
+				+ total_used_bytes) < kmd_buf_info->size) {
+				kmd_buf_remain_size = kmd_buf_info->size -
+					(kmd_buf_info->used_bytes
+					+ total_used_bytes);
+			} else {
+				CAM_ERR(CAM_ISP,
+				"no free kmd memory for base=%d bytes_used=%u buf_size=%u ctx_idx: %u",
+					blob_info->base_info->idx, bytes_used,
+					kmd_buf_info->size, c_ctx->ctx_index);
+				rc = -ENOMEM;
+				goto end;
+			}
+
+			cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4 +
+				total_used_bytes/4;
+			hw_mgr_res = &c_ctx->res_list_ife_out[c_ctx->vfe_out_map[res_id_out]];
+
+			if (!hw_mgr_res) {
+				CAM_ERR(CAM_ISP, "Invalid hw_mgr_res, ctx_idx: %u", c_ctx->ctx_index);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			hw_intf = cam_ife_hw_mgr_get_hw_intf(blob_info->base_info);
+
+			if (!hw_intf || blob_info->base_info->split_id >= CAM_ISP_HW_SPLIT_MAX) {
+				CAM_ERR(CAM_ISP,
+					"Invalid base %u type %u", blob_info->base_info->idx,
+					blob_info->base_info->hw_type);
+				return rc;
+			}
+			if (!hw_mgr_res->hw_res[blob_info->base_info->split_id])
+				continue;
+
+			rc = cam_isp_add_cmd_buf_update(
+				hw_mgr_res->hw_res[blob_info->base_info->split_id], hw_intf,
+				blob_type,
+				blob_type_hw_cmd_map[blob_type],
+				(void *)cmd_buf_addr,
+				kmd_buf_remain_size,
+				(void *)ubwc_plane_cfg,
+				&bytes_used);
+			if (rc < 0) {
+				CAM_ERR(CAM_ISP,
+					"Failed cmd_update, base_idx=%d, bytes_used=%u, res_id_out=0x%X ctx_idx: %u",
+					blob_info->base_info->idx,
+					bytes_used,
+					ubwc_plane_cfg->port_type, c_ctx->ctx_index);
+				goto end;
+			}
+
+			total_used_bytes += bytes_used;
+		}
+
+		if (total_used_bytes) {
+			cam_ife_mgr_update_hw_entries_util(CAM_ISP_IQ_BL,
+				total_used_bytes, kmd_buf_info,
+				prepare, blob_info->entry_added);
+			blob_info->entry_added = true;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid UBWC API Version %d ctx_idx: %u",
+			ubwc_config->api_version, c_ctx->ctx_index);
+		rc = -EINVAL;
+		break;
+	}
+end:
+	return rc;
+}
+
+static int cam_isp_get_generic_ubwc_data_v2(
+	struct cam_ubwc_plane_cfg_v2       *ubwc_cfg,
+	uint32_t                            version,
+	struct cam_vfe_generic_ubwc_config *generic_ubwc_cfg)
+{
+	int i = 0;
+
+	generic_ubwc_cfg->api_version = version;
+	for (i = 0; i < CAM_PACKET_MAX_PLANES - 1; i++) {
+		generic_ubwc_cfg->ubwc_plane_cfg[i].port_type             =
+			ubwc_cfg[i].port_type;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].meta_stride           =
+			ubwc_cfg[i].meta_stride;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].meta_size             =
+			ubwc_cfg[i].meta_size;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].meta_offset           =
+			ubwc_cfg[i].meta_offset;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].packer_config         =
+			ubwc_cfg[i].packer_config;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].mode_config_0         =
+			ubwc_cfg[i].mode_config_0;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].mode_config_1         =
+			ubwc_cfg[i].mode_config_1;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].tile_config           =
+			ubwc_cfg[i].tile_config;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].h_init                =
+			ubwc_cfg[i].h_init;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].v_init                =
+			ubwc_cfg[i].v_init;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].static_ctrl           =
+			ubwc_cfg[i].static_ctrl;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].ctrl_2                =
+			ubwc_cfg[i].ctrl_2;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].stats_ctrl_2          =
+			ubwc_cfg[i].stats_ctrl_2;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].lossy_threshold_0     =
+			ubwc_cfg[i].lossy_threshold_0;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].lossy_threshold_1     =
+			ubwc_cfg[i].lossy_threshold_1;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].lossy_var_offset =
+			ubwc_cfg[i].lossy_var_offset;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].bandwidth_limit       =
+			ubwc_cfg[i].bandwidth_limit;
+	}
+
+	return 0;
+}
+
+static int cam_isp_blob_ubwc_update_v2(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_ubwc_config_v2             *ubwc_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ubwc_plane_cfg_v2          *ubwc_plane_cfg;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf = NULL;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    rc = 0;
+	struct cam_vfe_generic_ubwc_config     generic_ubwc_cfg;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+	if (!c_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid ctx");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries :%d max:%d, ctx_idx: %u",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries, c_ctx->ctx_index);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "ctx_idx: %u num_ports= %d", c_ctx->ctx_index, ubwc_config->num_ports);
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < ubwc_config->num_ports; i++) {
+		ubwc_plane_cfg = &ubwc_config->ubwc_plane_cfg_array_flex[i][0];
+		res_id_out = ubwc_plane_cfg->port_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "UBWC config idx %d, port_type=%d ctx_idx: %u", i,
+			ubwc_plane_cfg->port_type, c_ctx->ctx_index);
+
+		if (res_id_out >= max_ife_out_res) {
+			CAM_ERR(CAM_ISP, "Invalid port type:%x ctx_idx: %u",
+				ubwc_plane_cfg->port_type, c_ctx->ctx_index);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		hw_mgr_res = &c_ctx->res_list_ife_out[c_ctx->vfe_out_map[res_id_out]];
+		if (!hw_mgr_res) {
+			CAM_ERR(CAM_ISP, "Invalid hw_mgr_res");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		hw_intf = cam_ife_hw_mgr_get_hw_intf(blob_info->base_info);
+
+		if (!hw_intf || blob_info->base_info->split_id >= CAM_ISP_HW_SPLIT_MAX) {
+			CAM_ERR(CAM_ISP,
+				"Invalid base %u type %u", blob_info->base_info->idx,
+				blob_info->base_info->hw_type);
+			return rc;
+		}
+
+		if (!hw_mgr_res->hw_res[blob_info->base_info->split_id])
+			continue;
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+				(kmd_buf_info->used_bytes
+				+ total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"no free kmd memory for base=%d bytes_used=%u buf_size=%u ctx_idx: %u",
+				blob_info->base_info->idx, bytes_used,
+				kmd_buf_info->size, c_ctx->ctx_index);
+			rc = -ENOMEM;
+			goto end;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			kmd_buf_info->used_bytes/4 +
+			total_used_bytes/4;
+
+		(void) cam_isp_get_generic_ubwc_data_v2(ubwc_plane_cfg,
+			ubwc_config->api_version, &generic_ubwc_cfg);
+
+		rc = cam_isp_add_cmd_buf_update(
+			hw_mgr_res->hw_res[blob_info->base_info->split_id], hw_intf,
+			blob_type,
+			blob_type_hw_cmd_map[blob_type],
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)&generic_ubwc_cfg,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed cmd_update, base_idx=%d, bytes_used=%u, res_id_out=0x%X, ctx_idx: %u",
+				blob_info->base_info->idx,
+				bytes_used,
+				ubwc_plane_cfg->port_type, c_ctx->ctx_index);
+			goto end;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		cam_ife_mgr_update_hw_entries_util(
+			CAM_ISP_IQ_BL, total_used_bytes,
+			kmd_buf_info, prepare, blob_info->entry_added);
+		blob_info->entry_added = true;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_isp_scratch_buf_update_util(
+	struct cam_isp_sfe_scratch_buf_info   *buffer_info,
+	struct cam_ife_sfe_scratch_buf_info   *port_info)
+{
+	int                   rc = 0;
+	int                   mmu_hdl;
+	size_t                size;
+	dma_addr_t            io_addr;
+	bool                  is_buf_secure;
+
+	is_buf_secure = cam_mem_is_secure_buf(buffer_info->mem_handle);
+	if (is_buf_secure) {
+		port_info->is_secure = true;
+		mmu_hdl = g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure;
+	} else {
+		port_info->is_secure = false;
+		mmu_hdl = g_ife_hw_mgr.mgr_common.img_iommu_hdl;
+	}
+
+	rc = cam_mem_get_io_buf(buffer_info->mem_handle,
+		mmu_hdl, &io_addr, &size, NULL, NULL);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"no scratch buf addr for res: 0x%x",
+			buffer_info->resource_type);
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	port_info->res_id = buffer_info->resource_type;
+	port_info->io_addr = io_addr + buffer_info->offset;
+	port_info->width = buffer_info->width;
+	port_info->height = buffer_info->height;
+	port_info->stride = buffer_info->stride;
+	port_info->slice_height = buffer_info->slice_height;
+	port_info->offset = 0;
+	port_info->config_done = true;
+
+	CAM_DBG(CAM_ISP,
+		"res_id: 0x%x w: 0x%x h: 0x%x s: 0x%x sh: 0x%x addr: 0x%x",
+		port_info->res_id, port_info->width,
+		port_info->height, port_info->stride,
+		port_info->slice_height, port_info->io_addr);
+
+	return rc;
+}
+
+static int cam_isp_blob_ife_scratch_buf_update(
+	struct cam_isp_sfe_init_scratch_buf_config  *scratch_config,
+	struct cam_hw_prepare_update_args           *prepare)
+{
+	int rc = 0, i;
+	uint32_t                               res_id_out;
+	struct cam_ife_hw_concrete_ctx        *c_ctx;
+	struct cam_isp_sfe_scratch_buf_info   *buffer_info;
+	struct cam_ife_sfe_scratch_buf_info   *port_info;
+	struct cam_isp_hw_mgr_res             *ife_out_res;
+	struct cam_ife_scratch_buf_cfg        *ife_scratch_config;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+	ife_scratch_config = c_ctx->scratch_buf_info.ife_scratch_config;
+
+	for (i = 0; i < scratch_config->num_ports; i++) {
+		buffer_info = &scratch_config->port_scratch_cfg_flex[i];
+		if (!cam_ife_hw_mgr_is_ife_out_port(buffer_info->resource_type))
+			continue;
+
+		res_id_out = buffer_info->resource_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "scratch config idx: %d res: 0x%x ctx_idx: %u",
+			i, buffer_info->resource_type, c_ctx->ctx_index);
+
+		ife_out_res = &c_ctx->res_list_ife_out[c_ctx->vfe_out_map[res_id_out]];
+		if (!ife_out_res->hw_res[0]) {
+			CAM_ERR(CAM_ISP,
+				"IFE rsrc_type: 0x%x not acquired, failing scratch config, ctx_idx: %u",
+				buffer_info->resource_type, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (ife_scratch_config->num_config >= CAM_IFE_SCRATCH_NUM_MAX) {
+			CAM_ERR(CAM_ISP,
+				"Incoming num of scratch buffers: %u exceeds max: %u, ctx_idx: %u",
+				ife_scratch_config->num_config, CAM_IFE_SCRATCH_NUM_MAX,
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		port_info = &ife_scratch_config->buf_info[ife_scratch_config->num_config++];
+		rc = cam_isp_scratch_buf_update_util(buffer_info, port_info);
+		if (rc)
+			goto end;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_isp_blob_sfe_scratch_buf_update(
+	struct cam_isp_sfe_init_scratch_buf_config  *scratch_config,
+	struct cam_hw_prepare_update_args           *prepare)
+{
+	int rc = 0, i;
+	uint32_t                               res_id_out;
+	struct cam_ife_hw_concrete_ctx        *c_ctx;
+	struct cam_isp_sfe_scratch_buf_info   *buffer_info;
+	struct cam_ife_sfe_scratch_buf_info   *port_info;
+	struct cam_isp_hw_mgr_res             *sfe_out_res;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	for (i = 0; i < scratch_config->num_ports; i++) {
+		buffer_info = &scratch_config->port_scratch_cfg_flex[i];
+		if (!cam_ife_hw_mgr_is_sfe_out_port(buffer_info->resource_type))
+			continue;
+
+		res_id_out = buffer_info->resource_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "scratch config idx: %d res: 0x%x, ctx_idx: %u",
+			i, buffer_info->resource_type, c_ctx->ctx_index);
+
+		if (res_id_out >= CAM_SFE_FE_RDI_NUM_MAX) {
+			CAM_ERR(CAM_ISP, "invalid out res type: 0x%x, ctx_idx: %u",
+				buffer_info->resource_type, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		sfe_out_res = &c_ctx->res_list_sfe_out[c_ctx->sfe_out_map[res_id_out]];
+		if (!sfe_out_res->hw_res[0]) {
+			CAM_ERR(CAM_ISP,
+				"SFE rsrc_type: 0x%x not acquired, failing scratch config, ctx_idx: %u",
+				buffer_info->resource_type, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		port_info = &c_ctx->scratch_buf_info.sfe_scratch_config->buf_info[res_id_out];
+		rc = cam_isp_scratch_buf_update_util(buffer_info, port_info);
+		if (rc)
+			goto end;
+
+		c_ctx->scratch_buf_info.sfe_scratch_config->num_config++;
+	}
+
+	if (c_ctx->scratch_buf_info.sfe_scratch_config->num_config !=
+		c_ctx->scratch_buf_info.num_fetches) {
+		CAM_ERR(CAM_ISP,
+			"Mismatch in number of scratch buffers provided: %u expected: %u ctx_idx: %u",
+			c_ctx->scratch_buf_info.sfe_scratch_config->num_config,
+			c_ctx->scratch_buf_info.num_fetches, c_ctx->ctx_index);
+		rc = -EINVAL;
+	}
+
+end:
+	return rc;
+}
+
+static inline int __cam_isp_sfe_send_cache_config(
+	int32_t                                   cmd_type,
+	struct cam_isp_sfe_bus_sys_cache_config  *wm_rm_cache_cfg)
+{
+	int rc = 0;
+	struct cam_isp_resource_node *hw_res = wm_rm_cache_cfg->res;
+
+	rc = hw_res->hw_intf->hw_ops.process_cmd(
+		hw_res->hw_intf->hw_priv,
+		cmd_type, wm_rm_cache_cfg,
+		sizeof(struct cam_isp_sfe_bus_sys_cache_config));
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Failed in sending cache config for: %u",
+			hw_res->res_id);
+	}
+
+	return rc;
+}
+
+static uint32_t cam_ife_hw_mgr_get_sfe_sys_cache_id(uint32_t exp_type,
+	struct cam_ife_hw_mgr_ctx  *ctx, uint32_t hw_idx)
+{
+	uint32_t               scid_idx = CAM_LLCC_MAX;
+	unsigned long          supported_sc_idx;
+	struct                 cam_ife_hw_mgr *hw_mgr;
+	struct                 cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	bool                   use_large;
+	int                    rc;
+
+	hw_mgr = c_ctx->hw_mgr;
+	supported_sc_idx = hw_mgr->sfe_cache_info[hw_idx].supported_scid_idx;
+	if (!supported_sc_idx) {
+		CAM_DBG(CAM_ISP, "Unsupported SCID for SFE %u exp_type %u ctx_idx: %u",
+			hw_idx, exp_type, c_ctx->ctx_index);
+		goto end;
+	}
+
+	if (exp_type >= CAM_ISP_EXPOSURE_MAX) {
+		CAM_INFO(CAM_ISP, "Invalid Exposure Type for SFE %u exp_type %u ctx_idx: %u",
+			hw_idx, exp_type, c_ctx->ctx_index);
+		goto end;
+	}
+
+	scid_idx = ffs(supported_sc_idx) - 1;
+	clear_bit(scid_idx, &supported_sc_idx);
+	use_large = (exp_type != CAM_ISP_LAST_EXPOSURE) ? true : false;
+
+	if (use_large) {
+		while (supported_sc_idx) {
+			scid_idx = ffs(supported_sc_idx) - 1;
+			clear_bit(scid_idx, &supported_sc_idx);
+			if ((scid_idx < CAM_LLCC_LARGE_1) || (scid_idx >= CAM_LLCC_MAX))
+				continue;
+
+			/*
+			 * In case of scenarios like, 1exp-->2exp-->1exp, we want to
+			 * retaing the earlier allocated SCID. Below check takes care
+			 * if the SCID is already activated, we do not need to reallocate
+			 */
+			if (hw_mgr->sfe_cache_info[hw_idx].activated[exp_type])
+				break;
+
+			/*
+			 * Curr_idx should not be reset in its lifetime. We need to preserve
+			 * it for next session/hw-open/hw-close cases to toggle with next
+			 * available SCID.
+			 */
+			if (hw_mgr->sfe_cache_info[hw_idx].curr_idx[exp_type] != scid_idx)
+				break;
+		}
+	}
+
+	if (use_large && (scid_idx < CAM_LLCC_LARGE_1))
+		scid_idx = CAM_LLCC_MAX;
+
+	if (scid_idx >= CAM_LLCC_MAX) {
+		CAM_DBG(CAM_ISP, "Cannot find scid for SFE %u exp_type %u ctx_idx: %u",
+			hw_idx, exp_type, c_ctx->ctx_index);
+	} else {
+		hw_mgr->sfe_cache_info[hw_idx].curr_idx[exp_type] = scid_idx;
+
+		if (!hw_mgr->sfe_cache_info[hw_idx].activated[exp_type] &&
+			c_ctx->flags.init_done)
+			cam_cpas_activate_llcc(scid_idx);
+
+		hw_mgr->sfe_cache_info[hw_idx].activated[exp_type] = true;
+		if (cam_cpas_is_notif_staling_supported()
+			&& hw_mgr->sys_cache_info[scid_idx].llcc_staling_support) {
+			rc = cam_cpas_notif_increment_staling_counter(scid_idx);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"llcc cache notif increment staling failed %d", scid_idx);
+		}
+
+		CAM_DBG(CAM_ISP, "SFE %u Exp type %u SCID index %d use_large %d ctx_idx: %u",
+			hw_idx, exp_type, scid_idx, use_large, c_ctx->ctx_index);
+	}
+
+end:
+	return scid_idx;
+}
+
+static int cam_isp_blob_sfe_exp_order_update(
+	uint32_t                             base_idx,
+	struct cam_isp_sfe_exp_config       *exp_config,
+	struct cam_hw_prepare_update_args   *prepare)
+{
+	int rc = 0, i, j;
+	bool send_config;
+	uint32_t exp_order_max = 0;
+	uint32_t res_id_out, res_id_in, sc_idx, exp_type;
+	struct cam_ife_hw_mgr_ctx               *ctx;
+	struct cam_ife_hw_concrete_ctx          *c_ctx;
+	struct cam_isp_hw_mgr_res               *hw_mgr_res;
+	struct cam_isp_hw_mgr_res               *tmp;
+	struct cam_isp_sfe_wm_exp_order_config  *order_cfg;
+	struct cam_ife_hw_mgr                   *hw_mgr;
+	struct cam_isp_sfe_bus_sys_cache_config  wm_rm_cache_cfg;
+
+	ctx = (struct cam_ife_hw_mgr_ctx *)prepare->ctxt_to_hw_map;
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+	hw_mgr = c_ctx->hw_mgr;
+	memset(c_ctx->flags.sys_cache_usage, false, sizeof(c_ctx->flags.sys_cache_usage));
+
+	if (!hw_mgr->num_caches_found) {
+		CAM_DBG(CAM_ISP, "No caches found during probe, ctx_idx: %u", c_ctx->ctx_index);
+		return 0;
+	}
+
+	if (!exp_config->num_ports) {
+		CAM_ERR(CAM_ISP, "Invalid number of ports: %d ctx_idx: %u",
+			exp_config->num_ports, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	/*
+	 *  The last resource in the array will be considered as
+	 *  last exposure
+	 */
+	exp_order_max = exp_config->num_ports - 1;
+	for (i = 0; i < exp_config->num_ports; i++) {
+		order_cfg = &exp_config->wm_config_flex[i];
+
+		rc = cam_ife_hw_mgr_is_sfe_rdi_for_fetch(
+			order_cfg->res_type);
+		if (!rc) {
+			CAM_ERR(CAM_ISP,
+				"Not a SFE fetch RDI: 0x%x ctx_idx: %u",
+				order_cfg->res_type, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if ((order_cfg->res_type - CAM_ISP_SFE_OUT_RES_RDI_0) >=
+			c_ctx->scratch_buf_info.num_fetches) {
+			CAM_DBG(CAM_ISP,
+				"Skip cache config for resource: 0x%x, active fetches: %u [exp_order: %d %d] in %u ctx",
+				order_cfg->res_type, c_ctx->scratch_buf_info.num_fetches,
+				i, exp_order_max, c_ctx->ctx_index);
+			continue;
+		}
+
+		/* Add more params if needed */
+		wm_rm_cache_cfg.wr_cfg_done = false;
+		wm_rm_cache_cfg.rd_cfg_done = false;
+		wm_rm_cache_cfg.scid = 0;
+		wm_rm_cache_cfg.use_cache = false;
+		send_config = false;
+		exp_type = CAM_ISP_EXPOSURE_MAX;
+
+		if (i == exp_order_max)
+			exp_type = CAM_ISP_LAST_EXPOSURE;
+		else if (i == exp_order_max - 1)
+			exp_type = CAM_ISP_LAST_1_EXPOSURE;
+		else if (i == exp_order_max - 2)
+			exp_type = CAM_ISP_LAST_2_EXPOSURE;
+
+		sc_idx = cam_ife_hw_mgr_get_sfe_sys_cache_id(exp_type,
+			ctx, base_idx);
+
+		if (sc_idx < CAM_LLCC_MAX)
+			wm_rm_cache_cfg.use_cache = true;
+
+		if (wm_rm_cache_cfg.use_cache) {
+			wm_rm_cache_cfg.scid = hw_mgr->sys_cache_info[sc_idx].scid;
+			if (wm_rm_cache_cfg.scid <= 0)
+				goto end;
+			c_ctx->flags.sys_cache_usage[sc_idx] = true;
+		}
+
+		/* Configure cache config for WM */
+		res_id_out = order_cfg->res_type & 0xFF;
+		if (res_id_out >= max_sfe_out_res) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"res_id_out: %d exceeds max size: %d ctx_idx: %u",
+				res_id_out, max_sfe_out_res, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		hw_mgr_res = &c_ctx->res_list_sfe_out[c_ctx->sfe_out_map[res_id_out]];
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			wm_rm_cache_cfg.res = hw_mgr_res->hw_res[j];
+			rc = __cam_isp_sfe_send_cache_config(
+				CAM_ISP_HW_SFE_SYS_CACHE_WM_CONFIG,
+				&wm_rm_cache_cfg);
+			send_config = true;
+			break;
+		}
+
+		if (rc || !send_config) {
+			CAM_ERR(CAM_ISP,
+				"Failed to send cache config for WR res: 0x%x base_idx: %u send_config: %d rc: %d ctx_idx: %u",
+				order_cfg->res_type, base_idx, send_config, rc, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		send_config = false;
+		/* RDI WMs have been validated find corresponding RM */
+		if (order_cfg->res_type == CAM_ISP_SFE_OUT_RES_RDI_0)
+			res_id_in = CAM_ISP_SFE_IN_RD_0;
+		else if (order_cfg->res_type == CAM_ISP_SFE_OUT_RES_RDI_1)
+			res_id_in = CAM_ISP_SFE_IN_RD_1;
+		else
+			res_id_in = CAM_ISP_SFE_IN_RD_2;
+
+		/* Configure cache config for RM */
+		list_for_each_entry_safe(hw_mgr_res,
+				tmp, &c_ctx->res_list_ife_in_rd, list) {
+			for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+				if (!hw_mgr_res->hw_res[j])
+					continue;
+
+				if (hw_mgr_res->hw_res[j]->res_id != res_id_in)
+					continue;
+
+				if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+					continue;
+
+				wm_rm_cache_cfg.res = hw_mgr_res->hw_res[j];
+				rc = __cam_isp_sfe_send_cache_config(
+					CAM_ISP_HW_SFE_SYS_CACHE_RM_CONFIG,
+					&wm_rm_cache_cfg);
+				send_config = true;
+				break;
+			}
+		}
+
+		if (rc || !send_config) {
+			CAM_ERR(CAM_ISP,
+				"Failed to send cache config for RD res: 0x%x base_idx: %u send_config: %d rc: %d ctx_idx: %u",
+				res_id_in, base_idx, send_config, rc, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (!wm_rm_cache_cfg.rd_cfg_done && !wm_rm_cache_cfg.wr_cfg_done) {
+			wm_rm_cache_cfg.use_cache = false;
+			if (sc_idx < CAM_LLCC_MAX)
+				c_ctx->flags.sys_cache_usage[sc_idx] = false;
+		}
+
+		CAM_DBG(CAM_ISP,
+			"cache %s on exp order: %u [max: %u] for out: 0x%x ctx_idx: %u",
+			(wm_rm_cache_cfg.use_cache ? "enabled" : "not enabled"),
+			i, exp_order_max, order_cfg->res_type, c_ctx->ctx_index);
+	}
+
+	return rc;
+
+end:
+	return 0;
+}
+
+static int cam_isp_blob_sfe_update_fetch_core_cfg(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	int                                rc;
+	uint32_t                           used_bytes = 0, total_used_bytes = 0;
+	uint32_t                           remain_size, res_id;
+	uint32_t                          *cpu_addr = NULL;
+	bool                               enable = true;
+	struct cam_isp_hw_mgr_res         *hw_mgr_res;
+	struct cam_kmd_buf_info           *kmd_buf_info;
+	struct cam_hw_intf                *hw_intf = NULL;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = NULL;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries :%d, ctx_idx: %u",
+			prepare->num_hw_update_entries, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	list_for_each_entry(hw_mgr_res,  &c_ctx->res_list_ife_in_rd, list) {
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			remain_size = kmd_buf_info->size -
+				(kmd_buf_info->used_bytes +
+				total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"No free kmd memory for base idx: %d, ctx_idx: %u",
+				blob_info->base_info->idx, c_ctx->ctx_index);
+				rc = -ENOMEM;
+				return rc;
+		}
+
+		hw_intf = cam_ife_hw_mgr_get_hw_intf(blob_info->base_info);
+
+		if (!hw_intf || blob_info->base_info->split_id >= CAM_ISP_HW_SPLIT_MAX) {
+			CAM_ERR(CAM_ISP,
+				"Invalid base %u type %u", blob_info->base_info->idx,
+				blob_info->base_info->hw_type);
+			return -EINVAL;
+		}
+
+		if (!hw_mgr_res->hw_res[blob_info->base_info->split_id])
+			continue;
+
+		res_id = hw_mgr_res->res_id;
+
+		/* check for active fetches */
+		if ((c_ctx->ctx_config &
+			CAM_IFE_CTX_CFG_DYNAMIC_SWITCH_ON) &&
+			((res_id - CAM_ISP_SFE_IN_RD_0) >=
+			c_ctx->scratch_buf_info.sfe_scratch_config->updated_num_exp))
+			enable = false;
+		else
+			enable = true;
+
+		cpu_addr = kmd_buf_info->cpu_addr +
+			kmd_buf_info->used_bytes  / 4 +
+			total_used_bytes / 4;
+
+		CAM_DBG(CAM_ISP,
+			"SFE:%u RM: %u res_id: 0x%x enable: %u num_exp: %u ctx_idx: %u",
+			blob_info->base_info->idx,
+			(res_id - CAM_ISP_SFE_IN_RD_0), res_id, enable,
+			c_ctx->scratch_buf_info.sfe_scratch_config->updated_num_exp,
+			c_ctx->ctx_index);
+
+		rc = cam_isp_add_cmd_buf_update(
+			hw_mgr_res->hw_res[blob_info->base_info->split_id], hw_intf,
+			blob_type,
+			CAM_ISP_HW_CMD_RM_ENABLE_DISABLE,
+			(void *)cpu_addr, remain_size,
+			(void *)&enable, &used_bytes);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed to dynamically %s SFE: %u RM: %u bytes_used: %u rc: %d ctx_idx: %u",
+				(enable ? "enable" : "disable"),
+				blob_info->base_info->idx, res_id,
+				used_bytes, rc, c_ctx->ctx_index);
+			return rc;
+		}
+
+		total_used_bytes += used_bytes;
+	}
+
+	if (total_used_bytes) {
+		cam_ife_mgr_update_hw_entries_util(
+			CAM_ISP_IQ_BL, total_used_bytes,
+			kmd_buf_info, prepare, blob_info->entry_added);
+		blob_info->entry_added = true;
+	}
+
+	return 0;
+}
+
+static int cam_isp_blob_hfr_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_resource_hfr_config    *hfr_config,
+	struct cam_hw_prepare_update_args     *prepare,
+	uint32_t                               out_max,
+	enum cam_isp_hw_type                   hw_type)
+{
+	struct cam_isp_port_hfr_config        *port_hfr_config;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf = NULL;
+	uint32_t                               res_id_out, out_port_res_type, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    rc = 0;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	CAM_DBG(CAM_ISP, "ctx_idx: %u num_ports= %d",
+		c_ctx->ctx_index, hfr_config->num_ports);
+
+	/* Max one hw entries required for hfr config update */
+	if (prepare->num_hw_update_entries + 1 >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d ctx_idx: %u",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < hfr_config->num_ports; i++) {
+		port_hfr_config = &hfr_config->port_hfr_config_flex[i];
+
+		if (c_ctx->flags.per_port_en) {
+			out_port_res_type =
+				cam_ife_hw_mgr_get_virtual_mapping_out_port(prepare->ctxt_to_hw_map,
+				port_hfr_config->resource_type, true);
+			res_id_out = out_port_res_type & 0xFF;
+		} else {
+			res_id_out = port_hfr_config->resource_type & 0xFF;
+		}
+
+		CAM_DBG(CAM_ISP, "type %d hfr config idx %d, type=%d ctx_idx: %u",
+			hw_type, i, res_id_out, c_ctx->ctx_index);
+
+		if (res_id_out >= out_max) {
+			CAM_ERR(CAM_ISP, "invalid out restype:%x, ctx_idx: %u out_max:%x",
+				port_hfr_config->resource_type, c_ctx->ctx_index, out_max);
+			return -EINVAL;
+		}
+
+		if (hw_type == CAM_ISP_HW_TYPE_SFE)
+			hw_mgr_res = &c_ctx->res_list_sfe_out[c_ctx->sfe_out_map[res_id_out]];
+		else
+			hw_mgr_res = &c_ctx->res_list_ife_out[c_ctx->vfe_out_map[res_id_out]];
+
+		hw_intf = cam_ife_hw_mgr_get_hw_intf(blob_info->base_info);
+		if (!hw_intf || blob_info->base_info->split_id >= CAM_ISP_HW_SPLIT_MAX) {
+			CAM_ERR(CAM_ISP,
+				"Invalid base %u type %u", blob_info->base_info->idx,
+				blob_info->base_info->hw_type);
+			return rc;
+		}
+
+		if (!hw_mgr_res->hw_res[blob_info->base_info->split_id])
+			continue;
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+			"no free kmd memory for base %d, ctx_idx: %u",
+			blob_info->base_info->idx, c_ctx->ctx_index);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			kmd_buf_info->used_bytes/4 +
+			total_used_bytes/4;
+		rc = cam_isp_add_cmd_buf_update(
+			hw_mgr_res->hw_res[blob_info->base_info->split_id], hw_intf,
+			blob_type,
+			CAM_ISP_HW_CMD_GET_HFR_UPDATE,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)port_hfr_config,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed cmd_update, base_idx=%d, rc=%d, res_id_out=0x%X hw_type=%d, ctx_idx: %u",
+				blob_info->base_info->idx, bytes_used,
+				port_hfr_config->resource_type, hw_type, c_ctx->ctx_index);
+			return rc;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		cam_ife_mgr_update_hw_entries_util(
+			CAM_ISP_IQ_BL, total_used_bytes,
+			kmd_buf_info, prepare, blob_info->entry_added);
+		blob_info->entry_added = true;
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_csid_discard_init_frame_update(
+	struct cam_isp_generic_blob_info       *blob_info,
+	struct cam_isp_discard_initial_frames  *discard_config,
+	struct cam_hw_prepare_update_args      *prepare)
+{
+	struct cam_ife_hw_concrete_ctx              *c_ctx = NULL;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_isp_hw_mgr_res                   *hw_mgr_res;
+	struct cam_isp_resource_node                *res;
+	struct cam_ife_csid_discard_init_frame_args discard_args;
+	int rc = -EINVAL, i;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+	discard_args.num_frames = discard_config->num_frames;
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			res = hw_mgr_res->hw_res[i];
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				if (hw_intf->hw_idx != blob_info->base_info->idx)
+					continue;
+
+				discard_args.res = res;
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_DISCARD_INIT_FRAMES,
+					&discard_args,
+					sizeof(struct cam_ife_csid_discard_init_frame_args));
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed to update discard frame cfg for res: %s on CSID[%u] ctx:%u",
+						res->res_name, blob_info->base_info->idx,
+						c_ctx->ctx_index);
+					break;
+				}
+			}
+		}
+	}
+
+	return rc;
+}
+
+
+static int cam_isp_blob_csid_dynamic_switch_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_mode_switch_info       *mup_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_concrete_ctx             *c_ctx = NULL;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_ife_csid_mode_switch_update_args csid_mup_upd_args = {0};
+	struct cam_ife_hw_mgr                      *ife_hw_mgr;
+	struct cam_isp_prepare_hw_update_data      *prepare_hw_data;
+	int                                         i, rc = -EINVAL;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	CAM_INFO(CAM_ISP,
+		"csid mup value=%u, ctx_idx: %u", mup_config->mup, c_ctx->ctx_index);
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+	prepare_hw_data->mup_en = true;
+	prepare_hw_data->mup_val = mup_config->mup;
+
+	/*
+	 * Send MUP to CSID for INIT packets only to be used at stream on and after.
+	 * For update packets with MUP, append the config to the cdm packet
+	 */
+	if (prepare_hw_data->packet_opcode_type == CAM_ISP_PACKET_INIT_DEV) {
+		csid_mup_upd_args.mup_args.mup_val = mup_config->mup;
+		csid_mup_upd_args.mup_args.use_mup = true;
+	}
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].hw_type != CAM_ISP_HW_TYPE_CSID)
+			continue;
+
+		if (c_ctx->base[i].split_id != CAM_ISP_HW_SPLIT_LEFT)
+			continue;
+
+		/* For sHDR dynamic switch update num starting exposures to CSID for INIT */
+		if ((prepare_hw_data->packet_opcode_type == CAM_ISP_PACKET_INIT_DEV) &&
+			(c_ctx->flags.is_sfe_shdr)) {
+			csid_mup_upd_args.exp_update_args.reset_discard_cfg = true;
+			csid_mup_upd_args.exp_update_args.num_exposures =
+				mup_config->num_expoures;
+		}
+
+		hw_intf = ife_hw_mgr->csid_devices[c_ctx->base[i].idx];
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_CSID_DYNAMIC_SWITCH_UPDATE,
+				&csid_mup_upd_args,
+				sizeof(struct cam_ife_csid_mode_switch_update_args));
+			if (rc)
+				CAM_ERR(CAM_ISP, "Dynamic switch update failed, ctx_idx: %u",
+					c_ctx->ctx_index);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_csid_clock_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_csid_clock_config      *clock_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_ife_csid_clock_update_args  csid_clock_upd_args;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	CAM_DBG(CAM_ISP,
+		"csid clk=%llu, ctx_idx: %u", clock_config->csid_clock, c_ctx->ctx_index);
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			clk_rate = clock_config->csid_clock;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				csid_clock_upd_args.clk_rate = clk_rate;
+				CAM_DBG(CAM_ISP, "i= %d clk=%llu\n",
+				i, csid_clock_upd_args.clk_rate);
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					blob_type_hw_cmd_map[blob_type],
+					&csid_clock_upd_args,
+					sizeof(
+					struct cam_ife_csid_clock_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Clock Update failed, ctx_idx: %u",
+						c_ctx->ctx_index);
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf! ctx_idx: %u", c_ctx->ctx_index);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_csid_qcfa_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_csid_qcfa_config       *qcfa_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_ife_csid_qcfa_update_args   csid_qcfa_upd_args;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	CAM_DBG(CAM_ISP,
+		"csid binning=%d, ctx_idx: %u", qcfa_config->csid_binning, c_ctx->ctx_index);
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+
+			if (!hw_mgr_res->hw_res[i] ||
+				hw_mgr_res->res_id != CAM_IFE_PIX_PATH_RES_IPP)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				csid_qcfa_upd_args.qcfa_binning =
+						qcfa_config->csid_binning;
+				csid_qcfa_upd_args.res =
+					hw_mgr_res->hw_res[i];
+
+				CAM_DBG(CAM_ISP, "i= %d QCFA binning=%d\n ctx_idx: %u",
+					i, csid_qcfa_upd_args.qcfa_binning, c_ctx->ctx_index);
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_QCFA_SUPPORTED,
+					&csid_qcfa_upd_args,
+					sizeof(
+					struct cam_ife_csid_qcfa_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "QCFA Update failed, ctx_idx: %u",
+						c_ctx->ctx_index);
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf! ctx_idx: %u", c_ctx->ctx_index);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_core_cfg_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_core_config            *core_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	int                                    rc = 0, i;
+	struct cam_vfe_core_config_args        vfe_core_config;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if ((hw_mgr_res->res_id ==
+				CAM_ISP_HW_VFE_IN_CAMIF) ||
+				(hw_mgr_res->res_id ==
+				CAM_ISP_HW_VFE_IN_PDLIB)) {
+				hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+				if (hw_intf && hw_intf->hw_ops.process_cmd) {
+					vfe_core_config.node_res =
+						hw_mgr_res->hw_res[i];
+
+					memcpy(&vfe_core_config.core_config,
+						core_config,
+						sizeof(
+						struct cam_isp_core_config));
+
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_CORE_CONFIG,
+						&vfe_core_config,
+						sizeof(
+						struct cam_vfe_core_config_args)
+						);
+					if (rc)
+						CAM_ERR(CAM_ISP,
+						"Core cfg parse fail, ctx_idx: %u",
+						c_ctx->ctx_index);
+				} else {
+					CAM_WARN(CAM_ISP, "NULL hw_intf! ctx_idx: %u",
+						c_ctx->ctx_index);
+				}
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_sfe_core_cfg_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_sfe_core_config        *core_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	int                                   rc = -EINVAL, i, idx;
+	struct cam_sfe_core_config_args       sfe_core_config;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = NULL;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_ife_hw_mgr                *ife_hw_mgr;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].hw_type != CAM_ISP_HW_TYPE_SFE)
+			continue;
+
+		idx = c_ctx->base[i].idx;
+		if (idx >= CAM_SFE_HW_NUM_MAX ||
+			!ife_hw_mgr->sfe_devices[idx])
+			continue;
+
+		hw_intf = ife_hw_mgr->sfe_devices[idx]->hw_intf;
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			memcpy(&sfe_core_config.core_config,
+				core_config,
+				sizeof(struct cam_isp_sfe_core_config));
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_CORE_CONFIG,
+				&sfe_core_config,
+				sizeof(struct cam_sfe_core_config_args));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"SFE core cfg parse fail, ctx_idx: %u",
+						c_ctx->ctx_index);
+		} else {
+			CAM_WARN(CAM_ISP, "NULL hw_intf! ctx_idx: %u", c_ctx->ctx_index);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_ife_clock_update(
+	struct cam_isp_clock_config           *clock_config,
+	struct cam_ife_hw_mgr_ctx             *ctx)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_vfe_clock_update_args       clock_upd_args;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i, j;
+	bool                                   camif_l_clk_updated = false;
+	bool                                   camif_r_clk_updated = false;
+
+	CAM_DBG(CAM_PERF,
+		"IFE clk update usage=%u left_clk= %lu right_clk=%lu ctx_idx: %u",
+		clock_config->usage_type, clock_config->left_pix_hz,
+		clock_config->right_pix_hz, c_ctx->ctx_index);
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			clk_rate = 0;
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if ((hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF) ||
+				(hw_mgr_res->res_id ==
+				CAM_ISP_HW_VFE_IN_PDLIB)) {
+				if (i == CAM_ISP_HW_SPLIT_LEFT) {
+					if (camif_l_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->left_pix_hz;
+
+					camif_l_clk_updated = true;
+				} else {
+					if (camif_r_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->right_pix_hz;
+
+					camif_r_clk_updated = true;
+				}
+			} else if ((hw_mgr_res->res_id >= CAM_ISP_HW_VFE_IN_RD) &&
+				(hw_mgr_res->res_id <= CAM_ISP_HW_VFE_IN_RDI5)) {
+				for (j = 0; j < clock_config->num_rdi; j++)
+					clk_rate = max(clock_config->rdi_hz_flex[j], clk_rate);
+			} else {
+				if (hw_mgr_res->res_id != CAM_ISP_HW_VFE_IN_LCR
+					&& hw_mgr_res->hw_res[i]) {
+					CAM_ERR(CAM_ISP, "Invalid res_id %u, ctx_idx: %u",
+						hw_mgr_res->res_id, c_ctx->ctx_index);
+					rc = -EINVAL;
+					return rc;
+				}
+			}
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				clock_upd_args.node_res = hw_mgr_res->hw_res[i];
+				CAM_DBG(CAM_PERF,
+					"Update Clock value res_id=%u i= %d clk=%llu ctx_idx: %u",
+					hw_mgr_res->res_id, i, clk_rate, c_ctx->ctx_index);
+
+				clock_upd_args.clk_rate = clk_rate;
+
+				/*
+				 * Update clock values to top, actual apply to hw will happen when
+				 * CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE is called
+				 */
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CLOCK_UPDATE,
+					&clock_upd_args,
+					sizeof(
+					struct cam_vfe_clock_update_args));
+				if (rc) {
+					CAM_ERR(CAM_PERF,
+						"IFE:%d Clock Update failed clk_rate:%llu rc:%d ctx_idx: %u",
+						hw_intf->hw_idx, clk_rate, rc, c_ctx->ctx_index);
+					goto end;
+				}
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf! ctx_idx: %u", c_ctx->ctx_index);
+		}
+	}
+
+end:
+	return rc;
+}
+
+
+static int cam_isp_blob_sfe_clock_update(
+	struct cam_isp_clock_config           *clock_config,
+	struct cam_ife_hw_mgr_ctx             *ctx)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_sfe_clock_update_args       clock_upd_args;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i, j;
+	bool                                   l_clk_updated = false;
+	bool                                   r_clk_updated = false;
+
+	CAM_DBG(CAM_PERF,
+		"SFE clk update usage: %u left_clk: %lu right_clk: %lu ctx_idx: %u",
+		clock_config->usage_type, clock_config->left_pix_hz, clock_config->right_pix_hz,
+		c_ctx->ctx_index);
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_sfe_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			clk_rate = 0;
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if ((hw_mgr_res->res_id == CAM_ISP_HW_SFE_IN_PIX) ||
+				(hw_mgr_res->res_id == CAM_ISP_HW_SFE_IN_RD)) {
+				if (i == CAM_ISP_HW_SPLIT_LEFT) {
+					if (l_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->left_pix_hz;
+					l_clk_updated = true;
+				} else {
+					if (r_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->right_pix_hz;
+					r_clk_updated = true;
+				}
+			} else {
+				for (j = 0; j < clock_config->num_rdi; j++)
+					clk_rate = max(clock_config->rdi_hz_flex[j],
+						clk_rate);
+			}
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				clock_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+				CAM_DBG(CAM_PERF,
+				"SFE res_id: %u i: %d clk: %llu ctx_idx: %u",
+				hw_mgr_res->res_id, i, clk_rate, c_ctx->ctx_index);
+
+				clock_upd_args.clk_rate = clk_rate;
+				/*
+				 * Update clock values to top, actual apply to hw will happen when
+				 * CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE is called
+				 */
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CLOCK_UPDATE,
+					&clock_upd_args,
+					sizeof(
+					struct cam_sfe_clock_update_args));
+				if (rc)
+					CAM_ERR(CAM_PERF,
+						"SFE clock update failed, ctx_idx: %u",
+						c_ctx->ctx_index);
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf! ctx_idx: %u", c_ctx->ctx_index);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_sfe_rd_update(
+	uint32_t                               blob_type,
+	uint32_t                               kmd_buf_remain_size,
+	uint32_t                              *cmd_buf_addr,
+	uint32_t                              *total_used_bytes,
+	struct cam_ife_hw_mgr_ctx             *ctx,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_vfe_wm_config          *wm_config)
+{
+	int                                   rc;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ctx->concr_ctx;
+	uint32_t                              bytes_used = 0;
+	bool                                  found = false;
+	struct cam_isp_hw_mgr_res            *sfe_rd_res;
+	struct cam_hw_intf                   *hw_intf = NULL;
+
+	list_for_each_entry(sfe_rd_res, &c_ctx->res_list_ife_in_rd,
+		list) {
+		if (sfe_rd_res->res_id == wm_config->port_type) {
+			found = true;
+			break;
+		}
+	}
+
+	if (!found) {
+		CAM_ERR(CAM_ISP,
+			"Failed to find SFE rd resource: %u, check if rsrc is acquired, ctx_idx: %u",
+			wm_config->port_type, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "SFE RM config for port: 0x%x, ctx_idx: %u",
+		wm_config->port_type, c_ctx->ctx_index);
+
+	hw_intf = cam_ife_hw_mgr_get_hw_intf(blob_info->base_info);
+	if (!hw_intf || blob_info->base_info->split_id >= CAM_ISP_HW_SPLIT_MAX) {
+		CAM_ERR(CAM_ISP,
+			"Invalid base %u type %u", blob_info->base_info->idx,
+			blob_info->base_info->hw_type);
+		return -EINVAL;
+	}
+
+	if (!sfe_rd_res->hw_res[blob_info->base_info->split_id])
+		return 0;
+
+	rc = cam_isp_add_cmd_buf_update(
+		sfe_rd_res->hw_res[blob_info->base_info->split_id], hw_intf,
+		blob_type,
+		CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD,
+		(void *)cmd_buf_addr,
+		kmd_buf_remain_size,
+		(void *)wm_config,
+		&bytes_used);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Failed to update SFE RM config out_type:0x%X base_idx:%d bytes_used:%u rc:%d ctx_idx: %u",
+			wm_config->port_type, blob_info->base_info->idx,
+			bytes_used, rc, c_ctx->ctx_index);
+		return rc;
+	}
+
+	*total_used_bytes += bytes_used;
+	return rc;
+}
+
+static int cam_ife_hw_mgr_update_scratch_offset(
+	struct cam_ife_hw_mgr_ctx             *ctx,
+	struct cam_isp_vfe_wm_config          *wm_config)
+{
+	uint32_t res_id;
+	struct cam_ife_sfe_scratch_buf_info       *port_info;
+	struct cam_ife_hw_concrete_ctx            *c_ctx = ctx->concr_ctx;
+
+	if ((wm_config->port_type - CAM_ISP_SFE_OUT_RES_RDI_0) >=
+		c_ctx->scratch_buf_info.num_fetches)
+		return 0;
+
+	res_id = wm_config->port_type & 0xFF;
+
+	if (res_id >= CAM_SFE_FE_RDI_NUM_MAX) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "res_id: %d exceeds max size: %d ctx_idx: %u",
+			res_id, CAM_SFE_FE_RDI_NUM_MAX, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	if (!c_ctx->scratch_buf_info.sfe_scratch_config->buf_info[res_id].config_done) {
+		CAM_ERR(CAM_ISP,
+			"Scratch buffer not configured on ctx: %u for res: %u ctx_idx: %u",
+			c_ctx->ctx_index, res_id, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	port_info = &c_ctx->scratch_buf_info.sfe_scratch_config->buf_info[res_id];
+	port_info->offset = wm_config->offset;
+
+	CAM_DBG(CAM_ISP, "Scratch addr: 0x%x offset: %u updated for: 0x%x ctx_idx: %u",
+		port_info->io_addr, port_info->offset, wm_config->port_type, c_ctx->ctx_index);
+
+	return 0;
+}
+
+static int cam_isp_blob_vfe_out_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_vfe_out_config         *vfe_out_config,
+	struct cam_hw_prepare_update_args     *prepare,
+	uint32_t                               size_isp_out,
+	enum cam_isp_hw_type                   hw_type)
+{
+	struct cam_isp_vfe_wm_config          *wm_config;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res             *isp_out_res;
+	struct cam_hw_intf                    *hw_intf = NULL;
+	bool                                   is_sfe_rd = false;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    rc = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+	c_ctx = ctx->concr_ctx;
+
+	if (prepare->num_hw_update_entries + 1 >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries :%d, ctx_idx: %u",
+			prepare->num_hw_update_entries, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < vfe_out_config->num_ports; i++) {
+		wm_config = &vfe_out_config->wm_config_flex[i];
+		if ((hw_type == CAM_ISP_HW_TYPE_VFE) &&
+			(!cam_ife_hw_mgr_is_ife_out_port(wm_config->port_type)))
+			continue;
+
+		if (hw_type == CAM_ISP_HW_TYPE_SFE) {
+			is_sfe_rd = cam_ife_hw_mgr_is_sfe_rd_res(wm_config->port_type);
+			if ((!cam_ife_hw_mgr_is_sfe_out_port(wm_config->port_type)) &&
+				(!is_sfe_rd))
+				continue;
+		}
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+			"No free kmd memory for base idx: %d, ctx_idx: %u",
+			blob_info->base_info->idx, c_ctx->ctx_index);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			(kmd_buf_info->used_bytes / 4) +
+			(total_used_bytes / 4);
+
+		if (is_sfe_rd) {
+			rc = cam_isp_blob_sfe_rd_update(blob_type,
+				kmd_buf_remain_size, cmd_buf_addr,
+				&total_used_bytes, ctx, blob_info, wm_config);
+			if (rc)
+				return rc;
+
+			is_sfe_rd = false;
+			continue;
+		}
+
+		res_id_out = wm_config->port_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "%s out config idx: %d port: 0x%x, ctx_idx: %u",
+			(hw_type == CAM_ISP_HW_TYPE_SFE ? "SFE" : "VFE"),
+			i, wm_config->port_type, c_ctx->ctx_index);
+
+		if (res_id_out >= size_isp_out) {
+			CAM_ERR(CAM_ISP, "Invalid out port:0x%x, ctx_idx: %u",
+				wm_config->port_type, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (hw_type == CAM_ISP_HW_TYPE_SFE) {
+			/* Update offset for scratch to compare for buf done */
+			if ((c_ctx->flags.is_sfe_shdr) &&
+				(cam_ife_hw_mgr_is_sfe_rdi_for_fetch(wm_config->port_type))) {
+				rc = cam_ife_hw_mgr_update_scratch_offset(ctx, wm_config);
+				if (rc)
+					return rc;
+			}
+
+			isp_out_res = &c_ctx->res_list_sfe_out[c_ctx->sfe_out_map[res_id_out]];
+		} else {
+			isp_out_res = &c_ctx->res_list_ife_out[c_ctx->vfe_out_map[res_id_out]];
+		}
+
+		hw_intf = cam_ife_hw_mgr_get_hw_intf(blob_info->base_info);
+		if (!hw_intf || blob_info->base_info->split_id >= CAM_ISP_HW_SPLIT_MAX) {
+			CAM_ERR(CAM_ISP,
+				"Invalid base %u type %u", blob_info->base_info->idx,
+				blob_info->base_info->hw_type);
+			return rc;
+		}
+
+		if (!isp_out_res->hw_res[blob_info->base_info->split_id])
+			continue;
+
+		rc = cam_isp_add_cmd_buf_update(
+			isp_out_res->hw_res[blob_info->base_info->split_id], hw_intf,
+			blob_type,
+			CAM_ISP_HW_CMD_WM_CONFIG_UPDATE,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)wm_config,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed to update %s Out out_type:0x%X base_idx:%d bytes_used:%u rc:%d ctx_idx: %u",
+				((hw_type == CAM_ISP_HW_TYPE_SFE) ?
+				"SFE" : "VFE"),
+				wm_config->port_type, blob_info->base_info->idx,
+				bytes_used, rc, c_ctx->ctx_index);
+			return rc;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		cam_ife_mgr_update_hw_entries_util(
+			CAM_ISP_IQ_BL, total_used_bytes,
+			kmd_buf_info, prepare, blob_info->entry_added);
+		blob_info->entry_added = true;
+	}
+	return rc;
+}
+
+static int cam_isp_blob_sensor_blanking_config(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_sensor_blanking_config *sensor_blanking_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_concrete_ctx  *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+	struct cam_hw_intf              *hw_intf;
+	struct cam_isp_blanking_config  blanking_config;
+	int                             rc = 0, i;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	if (list_empty(&c_ctx->res_list_ife_src)) {
+		CAM_ERR(CAM_ISP, "Mux List empty, ctx_idx: %u", c_ctx->ctx_index);
+		return -ENODEV;
+	}
+
+	list_for_each_entry(hw_mgr_res,
+		&c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			blanking_config.node_res = hw_mgr_res->hw_res[i];
+			blanking_config.vbi = sensor_blanking_config->vbi;
+			blanking_config.hbi = sensor_blanking_config->hbi;
+
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BLANKING_UPDATE,
+					&blanking_config,
+					sizeof(
+					struct cam_isp_blanking_config));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+					"blanking update failed, ctx_idx: %u", c_ctx->ctx_index);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_bw_limit_update(
+	uint32_t                                   blob_type,
+	struct cam_isp_generic_blob_info          *blob_info,
+	struct cam_isp_out_rsrc_bw_limiter_config *bw_limit_cfg,
+	struct cam_hw_prepare_update_args         *prepare,
+	enum cam_isp_hw_type                       hw_type)
+{
+	struct cam_isp_wm_bw_limiter_config   *wm_bw_limit_cfg;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res             *isp_out_res;
+	struct cam_hw_intf                    *hw_intf = NULL;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    rc = 0;
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	if ((prepare->num_hw_update_entries + 1) >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries: %d max: %d ctx_idx: %u",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < bw_limit_cfg->num_ports; i++) {
+		wm_bw_limit_cfg = &bw_limit_cfg->bw_limiter_config_flex[i];
+		res_id_out = wm_bw_limit_cfg->res_type & 0xFF;
+
+		if ((hw_type == CAM_ISP_HW_TYPE_SFE) &&
+			!((wm_bw_limit_cfg->res_type >=
+			CAM_ISP_SFE_OUT_RES_BASE) &&
+			(wm_bw_limit_cfg->res_type <
+			(CAM_ISP_SFE_OUT_RES_BASE + max_sfe_out_res))))
+			continue;
+
+		if ((hw_type == CAM_ISP_HW_TYPE_VFE) &&
+			!((wm_bw_limit_cfg->res_type >=
+			CAM_ISP_IFE_OUT_RES_BASE) &&
+			(wm_bw_limit_cfg->res_type <
+			(CAM_ISP_IFE_OUT_RES_BASE + max_ife_out_res))))
+			continue;
+
+		CAM_DBG(CAM_ISP,
+			"%s BW limit config idx: %d port: 0x%x enable: %d [0x%x:0x%x] ctx: %u",
+			(hw_type == CAM_ISP_HW_TYPE_SFE ? "SFE" : "VFE"),
+			i, wm_bw_limit_cfg->res_type,
+			wm_bw_limit_cfg->enable_limiter,
+			wm_bw_limit_cfg->counter_limit[0],
+			wm_bw_limit_cfg->counter_limit[1], c_ctx->ctx_index);
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"No free kmd memory for base idx: %d, ctx_idx: %u",
+				blob_info->base_info->idx, c_ctx->ctx_index);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			(kmd_buf_info->used_bytes / 4) +
+			(total_used_bytes / 4);
+
+		if (hw_type == CAM_ISP_HW_TYPE_SFE)
+			isp_out_res = &c_ctx->res_list_sfe_out[c_ctx->sfe_out_map[res_id_out]];
+		else
+			isp_out_res = &c_ctx->res_list_ife_out[c_ctx->vfe_out_map[res_id_out]];
+
+		hw_intf = cam_ife_hw_mgr_get_hw_intf(blob_info->base_info);
+		if (!hw_intf || blob_info->base_info->split_id >= CAM_ISP_HW_SPLIT_MAX) {
+			CAM_ERR(CAM_ISP,
+				"Invalid base %u type %u", blob_info->base_info->idx,
+				blob_info->base_info->hw_type);
+			return rc;
+		}
+
+		if (!isp_out_res->hw_res[blob_info->base_info->split_id])
+			continue;
+
+		rc = cam_isp_add_cmd_buf_update(
+			isp_out_res->hw_res[blob_info->base_info->split_id], hw_intf,
+			blob_type,
+			CAM_ISP_HW_CMD_WM_BW_LIMIT_CONFIG,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)wm_bw_limit_cfg,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed to update %s BW limiter config for res:0x%x enable:%d [0x%x:0x%x] base_idx:%d bytes_used:%u rc:%d ctx_idx: %u",
+				((hw_type == CAM_ISP_HW_TYPE_SFE) ?
+				"SFE" : "VFE"),
+				wm_bw_limit_cfg->res_type,
+				wm_bw_limit_cfg->enable_limiter,
+				wm_bw_limit_cfg->counter_limit[0],
+				wm_bw_limit_cfg->counter_limit[1],
+				blob_info->base_info->idx, bytes_used, rc, c_ctx->ctx_index);
+			return rc;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		cam_ife_mgr_update_hw_entries_util(
+			CAM_ISP_IQ_BL, total_used_bytes,
+			kmd_buf_info, prepare, blob_info->entry_added);
+		blob_info->entry_added = true;
+	}
+
+	return rc;
+}
+
+static int cam_isp_hw_mgr_add_cmd_buf_util(
+	struct cam_isp_hw_mgr_res         *hw_mgr_res,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_isp_generic_blob_info  *blob_info,
+	void                              *data,
+	uint32_t                           hw_cmd_type,
+	uint32_t                           blob_type)
+{
+	uint32_t                       total_used_bytes = 0;
+	uint32_t                       kmd_buf_remain_size;
+	struct cam_kmd_buf_info       *kmd_buf_info;
+	struct cam_hw_intf            *hw_intf = NULL;
+	uint32_t                      *cmd_buf_addr;
+	int                            rc = 0;
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	if (kmd_buf_info->used_bytes < kmd_buf_info->size) {
+		kmd_buf_remain_size = kmd_buf_info->size - kmd_buf_info->used_bytes;
+	} else {
+		CAM_ERR(CAM_ISP, "No free kmd memory for base idx: %d used_bytes %u buf_size %u",
+			blob_info->base_info->idx, kmd_buf_info->used_bytes, kmd_buf_info->size);
+		return -ENOMEM;
+	}
+
+	cmd_buf_addr = kmd_buf_info->cpu_addr + (kmd_buf_info->used_bytes / 4);
+	hw_intf = cam_ife_hw_mgr_get_hw_intf(blob_info->base_info);
+
+	if (!hw_intf || blob_info->base_info->split_id >= CAM_ISP_HW_SPLIT_MAX) {
+		CAM_ERR(CAM_ISP,
+		"Invalid base %u type %u", blob_info->base_info->idx,
+			blob_info->base_info->hw_type);
+		return rc;
+	}
+
+	if (!hw_mgr_res->hw_res[blob_info->base_info->split_id])
+		return 0;
+
+	rc = cam_isp_add_cmd_buf_update(
+		hw_mgr_res->hw_res[blob_info->base_info->split_id], hw_intf, blob_type,
+		hw_cmd_type, (void *)cmd_buf_addr,
+		kmd_buf_remain_size, data, &total_used_bytes);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Add cmd buffer failed idx: %d",
+			blob_info->base_info->idx);
+		return -EINVAL;
+	}
+
+	if (total_used_bytes) {
+		cam_ife_mgr_update_hw_entries_util(
+			CAM_ISP_IQ_BL, total_used_bytes,
+			kmd_buf_info, prepare, blob_info->entry_added);
+		blob_info->entry_added = true;
+	}
+	return rc;
+}
+
+static int cam_isp_update_ife_pdaf_cfg(
+	struct cam_ife_hw_mgr_ctx         *ctx,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_isp_generic_blob_info  *blob_info,
+	struct cam_isp_lcr_rdi_cfg_args   *isp_lcr_cfg,
+	uint32_t                           blob_type)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	uint32_t                               i;
+	uint32_t                               ife_res_id;
+	enum cam_ife_pix_path_res_id           csid_path_id;
+	struct cam_isp_resource_node          *res;
+	int                                    rc = -EINVAL;
+
+	/*
+	 * For SFE cases, ife_res_id will contain corresponding input resource for vfe,
+	 * since input config is done in vfe.
+	 */
+	csid_path_id = cam_ife_hw_mgr_get_ife_csid_rdi_res_type(isp_lcr_cfg->rdi_lcr_cfg->res_id);
+	if (csid_path_id == CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid res_id %u, ctx_idx: %u",
+			isp_lcr_cfg->rdi_lcr_cfg->res_id, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	ife_res_id = cam_convert_csid_rdi_res_to_ife_src(csid_path_id);
+	if (ife_res_id == CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid res_id %u, ctx_idx: %u",
+			isp_lcr_cfg->rdi_lcr_cfg->res_id, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	isp_lcr_cfg->ife_src_res_id = ife_res_id;
+	CAM_DBG(CAM_ISP, "Ctx %d res: %u lcr %u id %u ctx_type %u", c_ctx->ctx_index, ife_res_id,
+		isp_lcr_cfg->rdi_lcr_cfg->res_id, blob_info->base_info->idx, c_ctx->ctx_type);
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			/*
+			 * for SFE cases, only CAMIF resource is
+			 * acquired. We need any res to go to vfe drivers
+			 * to update the buffer. For non-sfe case, we match
+			 * with the incoming res_id
+			 */
+			if ((c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE &&
+				res->res_id == CAM_ISP_HW_VFE_IN_CAMIF) ||
+				res->res_id == ife_res_id) {
+
+				rc = cam_isp_hw_mgr_add_cmd_buf_util(hw_mgr_res, prepare,
+					blob_info, (void *)isp_lcr_cfg,
+					CAM_ISP_HW_CMD_RDI_LCR_CFG, blob_type);
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"Ctx %u res: %u lcr %u id %u ctx_type %u rc %u",
+						c_ctx->ctx_index, ife_res_id,
+						isp_lcr_cfg->rdi_lcr_cfg->res_id,
+						blob_info->base_info->idx, c_ctx->ctx_type, rc);
+				goto end;
+			}
+		}
+	}
+end:
+	return rc;
+}
+
+static int  cam_isp_config_rdi_lcr_csid_init_params(
+	struct cam_ife_hw_mgr_ctx         *ctx,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_isp_generic_blob_info  *blob_info,
+	struct cam_isp_lcr_rdi_config     *rdi_lcr_cfg,
+	uint32_t                           blob_type)
+{
+	struct cam_isp_hw_mgr_res         *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = ctx->concr_ctx;
+	struct cam_isp_resource_node      *res;
+	int                                rc = -EINVAL;
+	uint32_t                           csid_res_id = 0;
+	uint32_t                           acquired_res_id_mask = 0;
+
+	csid_res_id = cam_ife_hw_mgr_get_ife_csid_rdi_res_type(
+			rdi_lcr_cfg->res_id);
+	CAM_DBG(CAM_ISP,
+		"Ctx: %u csid_res_id: %u rdi_lcr: %u sfe_shdr %u ctx_ctype %u", c_ctx->ctx_index,
+		csid_res_id, rdi_lcr_cfg->res_id, c_ctx->flags.is_sfe_shdr, c_ctx->ctx_type);
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		if (!hw_mgr_res->hw_res[0])
+			continue;
+
+		if (hw_mgr_res->res_id < CAM_IFE_PIX_PATH_RES_RDI_0 ||
+			hw_mgr_res->res_id > CAM_IFE_PIX_PATH_RES_RDI_2)
+			continue;
+
+		if (!c_ctx->flags.is_sfe_shdr && hw_mgr_res->res_id != csid_res_id)
+			continue;
+
+		res = hw_mgr_res->hw_res[0];
+		rc = res->hw_intf->hw_ops.process_cmd(res->hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_RDI_LCR_CFG, res, sizeof(*res));
+		acquired_res_id_mask |= BIT(res->res_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Ctx: %u csid_res_id: %u rdi_lcr: %u sfe_shdr %u ctx_ctype %u",
+				c_ctx->ctx_index, csid_res_id, rdi_lcr_cfg->res_id,
+				c_ctx->flags.is_sfe_shdr, c_ctx->ctx_type);
+			break;
+		}
+	}
+
+	if (!(acquired_res_id_mask & BIT(csid_res_id))) {
+		CAM_ERR(CAM_ISP,
+			"Ctx: %u Unacquired csid_res_id: %u rdi_lcr: %u sfe_shdr %u ctx_ctype %u",
+			c_ctx->ctx_index, csid_res_id, rdi_lcr_cfg->res_id,
+			c_ctx->flags.is_sfe_shdr, c_ctx->ctx_type);
+		rc = -EINVAL;
+	}
+	return rc;
+}
+
+static int cam_isp_blob_ife_rdi_lcr_config(
+	struct cam_ife_hw_mgr_ctx         *ctx,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_isp_generic_blob_info  *blob_info,
+	struct cam_isp_lcr_rdi_config     *rdi_lcr_cfg,
+	uint32_t                           blob_type)
+{
+	struct cam_isp_prepare_hw_update_data  *prepare_hw_data;
+	struct cam_ife_hw_concrete_ctx         *c_ctx = ctx->concr_ctx;
+	struct cam_isp_lcr_rdi_cfg_args         isp_cfg_args = {0};
+	int                                     rc = -EINVAL;
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)prepare->priv;
+	CAM_DBG(CAM_ISP,
+		"Blob opcode %u res %u ctx_type %u shdr %u rdi_lcr %u ctx_idx: %u",
+		prepare_hw_data->packet_opcode_type, rdi_lcr_cfg->res_id, c_ctx->ctx_type,
+		c_ctx->flags.is_sfe_shdr, c_ctx->flags.rdi_lcr_en, c_ctx->ctx_index);
+
+	if (prepare_hw_data->packet_opcode_type == CAM_ISP_PACKET_INIT_DEV) {
+		rc = cam_isp_config_rdi_lcr_csid_init_params(ctx,
+			prepare, blob_info, rdi_lcr_cfg, blob_type);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"CSID param failed Ctx: %d rdi_lcr: %u ctx_type: %u ctx_idx: %u",
+				c_ctx->ctx_index, rdi_lcr_cfg->res_id,
+				c_ctx->ctx_type, c_ctx->ctx_index);
+			return rc;
+		}
+
+		isp_cfg_args.is_init = true;
+		c_ctx->flags.rdi_lcr_en = true;
+	} else if (!c_ctx->flags.rdi_lcr_en || !c_ctx->flags.is_sfe_shdr) {
+		/*
+		 * we don't expect blob for non-shdr cases other than Init Packet,
+		 * as the RDI input would remain same for the session.
+		 */
+		CAM_ERR(CAM_ISP,
+			"Unexpected Blob opcode %u res %u ctx_type %u shdr %u rdi_lcr %u ctx_idx: %u",
+			prepare_hw_data->packet_opcode_type, rdi_lcr_cfg->res_id, c_ctx->ctx_type,
+			c_ctx->flags.is_sfe_shdr, c_ctx->flags.rdi_lcr_en, c_ctx->ctx_index);
+		return rc;
+	}
+
+	isp_cfg_args.rdi_lcr_cfg = rdi_lcr_cfg;
+	rc = cam_isp_update_ife_pdaf_cfg(ctx, prepare, blob_info,
+		&isp_cfg_args, blob_type);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"IFE param failed %u res %u ctx_type %u shdr %u rdi_lcr %u ctx_idx: %u",
+			prepare_hw_data->packet_opcode_type, rdi_lcr_cfg->res_id, c_ctx->ctx_type,
+			c_ctx->flags.is_sfe_shdr, c_ctx->flags.rdi_lcr_en, c_ctx->ctx_index);
+		return rc;
+	}
+
+	return rc;
+}
+
+static inline int cam_isp_validate_bw_limiter_blob(
+	uint32_t blob_size,
+	struct cam_isp_out_rsrc_bw_limiter_config *bw_limit_config)
+{
+	if ((bw_limit_config->num_ports > (max_ife_out_res +
+		max_sfe_out_res)) ||
+		(bw_limit_config->num_ports == 0)) {
+		CAM_ERR(CAM_ISP,
+			"Invalid num_ports:%u in bw limit config",
+			bw_limit_config->num_ports);
+			return -EINVAL;
+	}
+
+	/* Check for integer overflow */
+	if (bw_limit_config->num_ports != 1) {
+		if (sizeof(struct cam_isp_wm_bw_limiter_config) > ((UINT_MAX -
+			sizeof(struct cam_isp_out_rsrc_bw_limiter_config)) /
+			(bw_limit_config->num_ports - 1))) {
+			CAM_ERR(CAM_ISP,
+				"Max size exceeded in bw limit config num_ports:%u size per port:%lu",
+				bw_limit_config->num_ports,
+				sizeof(struct cam_isp_wm_bw_limiter_config));
+			return -EINVAL;
+		}
+	}
+
+	if (blob_size < (sizeof(struct cam_isp_out_rsrc_bw_limiter_config) +
+		(bw_limit_config->num_ports - 1) *
+		sizeof(struct cam_isp_wm_bw_limiter_config))) {
+		CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+			blob_size, sizeof(struct cam_isp_out_rsrc_bw_limiter_config)
+			+ (bw_limit_config->num_ports - 1) *
+			sizeof(struct cam_isp_wm_bw_limiter_config));
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_isp_blob_csid_init_config_update(
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_isp_init_config        *init_config)
+{
+	int i, rc = -EINVAL;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_isp_hw_init_config_update   init_cfg_update;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+
+	ctx = prepare->ctxt_to_hw_map;
+	c_ctx = ctx->concr_ctx;
+
+	/* Assign init config */
+	init_cfg_update.init_config = init_config;
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				init_cfg_update.node_res =
+					hw_mgr_res->hw_res[i];
+				CAM_DBG(CAM_ISP, "Init config update for res_id: %u, ctx_idx: %u",
+					hw_mgr_res->res_id, c_ctx->ctx_index);
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_INIT_CONFIG_UPDATE,
+					&init_cfg_update,
+					sizeof(
+					struct cam_isp_hw_init_config_update));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"Init cfg update failed rc: %d, ctx_idx: %u",
+						rc, c_ctx->ctx_index);
+			}
+		}
+	}
+
+	return rc;
+}
+static int cam_isp_blob_ife_init_config_update(
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_isp_init_config        *init_config)
+{
+	int i, rc = -EINVAL;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_isp_hw_init_config_update   init_cfg_update;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+
+	ctx = prepare->ctxt_to_hw_map;
+	c_ctx = ctx->concr_ctx;
+
+	/* Assign init config */
+	init_cfg_update.init_config = init_config;
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if (hw_mgr_res->res_id != CAM_ISP_HW_VFE_IN_CAMIF)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				init_cfg_update.node_res =
+					hw_mgr_res->hw_res[i];
+				CAM_DBG(CAM_ISP, "Init config update for res_id: %u ctx_idx: %u",
+					hw_mgr_res->res_id, c_ctx->ctx_index);
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_INIT_CONFIG_UPDATE,
+					&init_cfg_update,
+					sizeof(
+					struct cam_isp_hw_init_config_update));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Init cfg update failed rc: %d ctx: %u",
+						rc, c_ctx->ctx_index);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_validate_scratch_buffer_blob(
+	uint32_t blob_size,
+	struct cam_ife_hw_mgr_ctx *ife_mgr_ctx,
+	struct cam_isp_sfe_init_scratch_buf_config *scratch_config)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ife_mgr_ctx->concr_ctx;
+
+	if (!(c_ctx->flags.is_sfe_fs ||
+		c_ctx->flags.is_sfe_shdr)) {
+		CAM_ERR(CAM_ISP,
+			"Not SFE sHDR/FS context: %u scratch buf blob not supported, ctx_idx: %u",
+			c_ctx->ctx_index, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	if (blob_size <
+		sizeof(struct cam_isp_sfe_init_scratch_buf_config)) {
+		CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+			blob_size, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	if ((scratch_config->num_ports >
+		(CAM_SFE_FE_RDI_NUM_MAX + CAM_IFE_SCRATCH_NUM_MAX)) ||
+		(scratch_config->num_ports == 0)) {
+		CAM_ERR(CAM_ISP,
+			"Invalid num_ports %u in scratch buf config, ctx_idx: %u",
+			scratch_config->num_ports, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	/* Check for integer overflow */
+	if (scratch_config->num_ports != 1) {
+		if (sizeof(struct cam_isp_sfe_scratch_buf_info) >
+			((UINT_MAX -
+			sizeof(struct cam_isp_sfe_init_scratch_buf_config)) /
+			(scratch_config->num_ports - 1))) {
+			CAM_ERR(CAM_ISP,
+				"Max size exceeded in scratch config num_ports: %u size per port: %lu ctx: %u",
+				scratch_config->num_ports,
+				sizeof(struct cam_isp_sfe_scratch_buf_info),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+	}
+
+	if (blob_size <
+		(sizeof(struct cam_isp_sfe_init_scratch_buf_config) +
+		(scratch_config->num_ports - 1) *
+		sizeof(struct cam_isp_sfe_scratch_buf_info))) {
+		CAM_ERR(CAM_ISP, "Invalid blob size: %u expected: %lu ctx_idx: %u",
+			blob_size,
+			sizeof(struct cam_isp_sfe_init_scratch_buf_config) +
+			(scratch_config->num_ports - 1) *
+			sizeof(struct cam_isp_sfe_scratch_buf_info), c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static void cam_isp_copy_fcg_config(
+	struct cam_isp_fcg_config_internal    *fcg_args_internal,
+	struct cam_isp_generic_fcg_config     *fcg_args)
+{
+	struct cam_isp_ch_ctx_fcg_config_internal    *fcg_ch_ctx_internal;
+	struct cam_isp_ch_ctx_fcg_config             *fcg_ch_ctx;
+	struct cam_isp_predict_fcg_config_internal   *fcg_predict_internal;
+	struct cam_isp_predict_fcg_config            *fcg_predict;
+	uint32_t fcg_ch_ctx_size, num_types = 0;
+	int i, j;
+
+	/* Copy generic FCG config */
+	fcg_args_internal->num_ch_ctx = fcg_args->num_ch_ctx;
+	fcg_args_internal->num_predictions = fcg_args->num_predictions;
+	fcg_ch_ctx_size = sizeof(struct cam_isp_ch_ctx_fcg_config) +
+		(fcg_args->num_predictions - 1) *
+		sizeof(struct cam_isp_predict_fcg_config);
+
+	/* Copy channel/context FCG config */
+	for (i = 0; i < fcg_args->num_ch_ctx; i++) {
+		fcg_ch_ctx_internal = &fcg_args_internal->ch_ctx_fcg_configs[i];
+		fcg_ch_ctx = (struct cam_isp_ch_ctx_fcg_config *)
+			((void *)(fcg_args->ch_ctx_fcg_configs_flex) +
+			i * fcg_ch_ctx_size);
+
+		fcg_ch_ctx_internal->fcg_ch_ctx_id =
+			fcg_ch_ctx->fcg_ch_ctx_id;
+		fcg_ch_ctx_internal->fcg_enable_mask =
+			fcg_ch_ctx->fcg_enable_mask;
+		if (fcg_ch_ctx->fcg_enable_mask & CAM_ISP_FCG_ENABLE_PHASE) {
+			for (j = 0; j < fcg_args->num_predictions; j++) {
+				fcg_predict_internal =
+					&fcg_ch_ctx_internal->predicted_fcg_configs[j];
+				fcg_predict = &fcg_ch_ctx->predicted_fcg_configs_flex[j];
+
+				/* Copy 3 PHASE related values for R/G/B channel */
+				fcg_predict_internal->phase_index_b =
+					fcg_predict->phase_index_b;
+				fcg_predict_internal->phase_index_r =
+					fcg_predict->phase_index_r;
+				fcg_predict_internal->phase_index_g =
+					fcg_predict->phase_index_g;
+				CAM_DBG(CAM_ISP,
+					"Copy FCG PHASE config on ch 0x%x, prediction idx %d, phase_index_g: %u, phase_index_r: %u, phase_index_b: %u",
+					fcg_ch_ctx_internal->fcg_ch_ctx_id, j,
+					fcg_predict_internal->phase_index_g,
+					fcg_predict_internal->phase_index_r,
+					fcg_predict_internal->phase_index_b);
+			}
+			num_types += 1;
+		}
+		if (fcg_ch_ctx->fcg_enable_mask & CAM_ISP_FCG_ENABLE_STATS) {
+			for (j = 0; j < fcg_args->num_predictions; j++) {
+				fcg_predict_internal =
+					&fcg_ch_ctx_internal->predicted_fcg_configs[j];
+				fcg_predict = &fcg_ch_ctx->predicted_fcg_configs_flex[j];
+
+				/* Copy 3 STATS related values for R/G/B channel */
+				fcg_predict_internal->stats_index_b =
+					fcg_predict->stats_index_b;
+				fcg_predict_internal->stats_index_r =
+					fcg_predict->stats_index_r;
+				fcg_predict_internal->stats_index_g =
+					fcg_predict->stats_index_g;
+				CAM_DBG(CAM_ISP,
+					"Copy FCG STATS config on ch 0x%x, prediction idx %d, stats_index_g: %u, stats_index_r: %u, stats_index_b: %u",
+					fcg_ch_ctx_internal->fcg_ch_ctx_id, j,
+					fcg_predict_internal->stats_index_g,
+					fcg_predict_internal->stats_index_r,
+					fcg_predict_internal->stats_index_b);
+			}
+			num_types += 1;
+		}
+	}
+	fcg_args_internal->num_types = num_types;
+	CAM_DBG(CAM_ISP,
+		"Inspect on copied FCG config, num_types: %u, num_ch_ctx: %u, num_predictions: %u",
+		num_types, fcg_args_internal->num_ch_ctx,
+		fcg_args_internal->num_predictions);
+}
+
+static int cam_isp_blob_fcg_config_prepare(
+	struct cam_isp_generic_fcg_config     *fcg_config_args,
+	struct cam_hw_prepare_update_args     *prepare,
+	enum cam_isp_hw_type                   hw_type)
+{
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_isp_prepare_hw_update_data *prepare_hw_data;
+	struct cam_isp_fcg_config_info        *fcg_info;
+	uint32_t                               fcg_size;
+	uint64_t                               request_id;
+
+	ctx = prepare->ctxt_to_hw_map;
+	c_ctx = ctx->concr_ctx;
+	request_id = prepare->packet->header.request_id;
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data *) prepare->priv;
+	fcg_info = &(prepare_hw_data->fcg_info);
+
+	if ((hw_type == CAM_ISP_HW_TYPE_SFE) &&
+		fcg_info->sfe_fcg_online) {
+		CAM_ERR(CAM_ISP,
+			"SFE FCG config is sent more than once, ctx_id: %u, request_id: %llu",
+			c_ctx->ctx_index, request_id);
+		return -EINVAL;
+	}
+
+	if ((hw_type == CAM_ISP_HW_TYPE_VFE) &&
+		fcg_info->ife_fcg_online) {
+		CAM_ERR(CAM_ISP,
+			"IFE/MC_TFE FCG config is sent more than once, ctx_id: %u, request_id: %llu",
+			c_ctx->ctx_index, request_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Start storing FCG config in req_isp on ctx_idx: %u, hw_type: %d, request_id: %llu",
+		c_ctx->ctx_index, hw_type, request_id);
+
+	fcg_size = (uint32_t)sizeof(struct cam_isp_generic_fcg_config);
+	fcg_size += (fcg_config_args->num_ch_ctx - 1) *
+		sizeof(struct cam_isp_ch_ctx_fcg_config);
+	fcg_size += fcg_config_args->num_ch_ctx *
+		(fcg_config_args->num_predictions - 1) *
+		sizeof(struct cam_isp_predict_fcg_config);
+
+	if (fcg_size != fcg_config_args->size) {
+		CAM_ERR(CAM_ISP,
+			"Mismatched size between userspace provides and real comsumption %u - %u, ctx_idx: %u, request_id: %llu",
+			fcg_config_args->size, fcg_size,
+			c_ctx->ctx_index, request_id);
+		return -EINVAL;
+	}
+
+	switch (hw_type) {
+	case CAM_ISP_HW_TYPE_SFE:
+		fcg_info->sfe_fcg_online = true;
+		cam_isp_copy_fcg_config(&fcg_info->sfe_fcg_config,
+			fcg_config_args);
+		break;
+	case CAM_ISP_HW_TYPE_VFE:
+		fcg_info->ife_fcg_online = true;
+		cam_isp_copy_fcg_config(&fcg_info->ife_fcg_config,
+			fcg_config_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"Failed in parsing FCG configuration for hw_type: %u, ctx_idx: %u, request_id: %llu",
+			hw_type, c_ctx->ctx_index, request_id);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_isp_validate_fcg_configs(
+	struct cam_isp_generic_fcg_config *fcg_config_args,
+	uint32_t                           max_fcg_ch_ctx,
+	uint32_t                           max_fcg_predictions,
+	struct cam_ife_hw_mgr_ctx         *ife_mgr_ctx)
+{
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ife_mgr_ctx->concr_ctx;
+
+	if ((fcg_config_args->num_ch_ctx > max_fcg_ch_ctx) ||
+		(fcg_config_args->num_ch_ctx == 0)) {
+		CAM_ERR(CAM_ISP, "Invalid num of channels/contexts %u in FCG config, ctx_idx: %u",
+			fcg_config_args->num_ch_ctx, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	if ((fcg_config_args->num_predictions > max_fcg_predictions) ||
+		(fcg_config_args->num_predictions == 0)) {
+		CAM_ERR(CAM_ISP, "Invalid num of predictions %u in FCG config, ctx_idx: %u",
+			fcg_config_args->num_predictions, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_isp_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	int rc = 0, i;
+	struct cam_isp_generic_blob_info      *blob_info = user_data;
+	struct cam_ife_hw_mgr_ctx             *ife_mgr_ctx = NULL;
+	struct cam_ife_hw_concrete_ctx        *c_ctx;
+	struct cam_hw_prepare_update_args     *prepare = NULL;
+	struct cam_ife_hw_mgr                 *ife_hw_mgr;
+
+	if (!blob_data || (blob_size == 0) || !blob_info) {
+		CAM_ERR(CAM_ISP, "Invalid args data %pK size %d info %pK",
+			blob_data, blob_size, blob_info);
+		return -EINVAL;
+	}
+
+	prepare = blob_info->prepare;
+	if (!prepare || !prepare->ctxt_to_hw_map) {
+		CAM_ERR(CAM_ISP, "Failed. prepare is NULL, blob_type %d",
+			blob_type);
+		return -EINVAL;
+	}
+
+	ife_mgr_ctx = prepare->ctxt_to_hw_map;
+
+	if (!ife_mgr_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid ctx");
+		return -EINVAL;
+	}
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+
+	if (!c_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid ctx");
+		return -EINVAL;
+	}
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	CAM_DBG(CAM_ISP, "Context[%pK][%u] blob_type=%d, blob_size=%d",
+		c_ctx, c_ctx->ctx_index, blob_type, blob_size);
+
+	switch (blob_type) {
+	case CAM_ISP_GENERIC_BLOB_TYPE_HFR_CONFIG: {
+		struct cam_isp_resource_hfr_config    *hfr_config;
+
+		if (blob_size < sizeof(struct cam_isp_resource_hfr_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+				blob_size, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		hfr_config = (struct cam_isp_resource_hfr_config *)blob_data;
+
+		if (hfr_config->num_ports > g_ife_hw_mgr.isp_caps.max_vfe_out_res_type ||
+			hfr_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in HFR config, ctx_idx: %u",
+				hfr_config->num_ports, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (hfr_config->num_ports != 1) {
+			if (sizeof(struct cam_isp_port_hfr_config) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_resource_hfr_config)) /
+				(hfr_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in hfr config num_ports:%u size per port:%lu ctx_idx: %u",
+					hfr_config->num_ports,
+					sizeof(struct cam_isp_port_hfr_config),
+					c_ctx->ctx_index);
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_isp_resource_hfr_config) +
+			(hfr_config->num_ports - 1) *
+			sizeof(struct cam_isp_port_hfr_config))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_resource_hfr_config) +
+				(hfr_config->num_ports - 1) *
+				sizeof(struct cam_isp_port_hfr_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_hfr_update(blob_type, blob_info,
+			hfr_config, prepare, max_ife_out_res,
+			CAM_ISP_HW_TYPE_VFE);
+		if (rc)
+			CAM_ERR(CAM_ISP, "HFR Update Failed, ctx_idx: %u", c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_CLOCK_CONFIG: {
+		size_t clock_config_size = 0;
+		struct cam_isp_clock_config    *clock_config;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+
+		/* Override clock for offline IFE */
+		if (c_ctx->is_offline)
+			break;
+
+		if (blob_size < sizeof(struct cam_isp_clock_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+				blob_size, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		clock_config = (struct cam_isp_clock_config *)blob_data;
+
+		if (clock_config->num_rdi > CAM_IFE_RDI_NUM_MAX) {
+			CAM_ERR(CAM_ISP, "Invalid num_rdi %u in clock config, ctx_idx: %u",
+				clock_config->num_rdi, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (clock_config->num_rdi > 1) {
+			if (sizeof(uint64_t) > ((UINT_MAX -
+				sizeof(struct cam_isp_clock_config)) /
+				(clock_config->num_rdi - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in clock config num_rdi:%u size per port:%lu ctx_idx: %u",
+					clock_config->num_rdi,
+					sizeof(uint64_t), c_ctx->ctx_index);
+				return -EINVAL;
+			}
+		}
+
+		if ((clock_config->num_rdi != 0) && (blob_size <
+			(sizeof(struct cam_isp_clock_config) +
+			sizeof(uint64_t) * (clock_config->num_rdi - 1)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size,
+				sizeof(uint32_t) * 2 + sizeof(uint64_t) *
+				(clock_config->num_rdi + 2), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+		clock_config_size = sizeof(struct cam_isp_clock_config) +
+			((clock_config->num_rdi - 1) *
+			sizeof(clock_config->rdi_hz));
+		memcpy(&prepare_hw_data->bw_clk_config.ife_clock_config, clock_config,
+			clock_config_size);
+		prepare_hw_data->bw_clk_config.ife_clock_config_valid = true;
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG: {
+		struct cam_isp_bw_config    *bw_config;
+		struct cam_isp_bw_config    *bw_config_u;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+		size_t bw_config_size;
+
+		CAM_WARN_RATE_LIMIT_CUSTOM(CAM_PERF, 300, 1,
+			"Deprecated Blob TYPE_BW_CONFIG");
+		if (blob_size < sizeof(struct cam_isp_bw_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+				blob_size, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		bw_config_u = (struct cam_isp_bw_config *)blob_data;
+
+		if (bw_config_u->num_rdi > CAM_IFE_RDI_NUM_MAX || !bw_config_u->num_rdi) {
+			CAM_ERR(CAM_ISP, "Invalid num_rdi %u in bw config, ctx_idx: %u",
+				bw_config_u->num_rdi, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		bw_config_size = sizeof(struct cam_isp_bw_config) + ((bw_config_u->num_rdi-1)*
+					sizeof(struct cam_isp_bw_vote));
+
+		rc = cam_common_mem_kdup((void **)&bw_config, bw_config_u, bw_config_size);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Alloc and copy request bw_config failed");
+			return rc;
+		}
+		if (bw_config_u->num_rdi != bw_config->num_rdi) {
+			CAM_ERR(CAM_ISP, "num_rdi changed,userspace:%d, kernel:%d", bw_config_u->num_rdi,
+				bw_config->num_rdi);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (bw_config->num_rdi > 1) {
+			if (sizeof(struct cam_isp_bw_vote) > ((UINT_MAX -
+				sizeof(struct cam_isp_bw_config)) /
+				(bw_config->num_rdi - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in bw config num_rdi:%u size per port:%lu ctx_idx: %u",
+					bw_config->num_rdi,
+					sizeof(struct cam_isp_bw_vote), c_ctx->ctx_index);
+				cam_common_mem_free(bw_config);
+				return -EINVAL;
+			}
+		}
+
+		if ((bw_config->num_rdi != 0) && (blob_size <
+			(sizeof(struct cam_isp_bw_config) +
+			(bw_config->num_rdi - 1) *
+			sizeof(struct cam_isp_bw_vote)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size, sizeof(struct cam_isp_bw_config) +
+				(bw_config->num_rdi - 1) *
+				sizeof(struct cam_isp_bw_vote), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (!prepare || !prepare->priv ||
+			(bw_config->usage_type >= CAM_ISP_HW_USAGE_TYPE_MAX)) {
+			CAM_ERR(CAM_ISP, "Invalid inputs usage type %d, ctx_idx: %u",
+				bw_config->usage_type, c_ctx->ctx_index);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+
+		memcpy(&prepare_hw_data->bw_clk_config.bw_config, bw_config,
+			sizeof(prepare_hw_data->bw_clk_config.bw_config));
+		c_ctx->bw_config_version = CAM_ISP_BW_CONFIG_V1;
+		prepare_hw_data->bw_clk_config.bw_config_valid = true;
+		cam_common_mem_free(bw_config);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V2: {
+		struct cam_isp_bw_config_v2    *bw_config;
+		struct cam_isp_bw_config_v2    *bw_config_u;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+		struct cam_cpas_axi_per_path_bw_vote *path_vote;
+		size_t bw_config_size;
+
+		if (blob_size < sizeof(struct cam_isp_bw_config_v2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u ctx_idx: %u", blob_size,
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		bw_config_u = (struct cam_isp_bw_config_v2 *)blob_data;
+
+		if (bw_config_u->num_paths > CAM_ISP_MAX_PER_PATH_VOTES ||
+			!bw_config_u->num_paths) {
+			CAM_ERR(CAM_ISP, "Invalid num paths %d ctx_idx: %u",
+				bw_config_u->num_paths, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		bw_config_size = sizeof(struct cam_isp_bw_config_v2) + ((bw_config_u->num_paths-1)*
+					sizeof(struct cam_axi_per_path_bw_vote));
+
+		rc = cam_common_mem_kdup((void **)&bw_config, bw_config_u, bw_config_size);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Alloc and copy request bw_config failed");
+			return rc;
+		}
+
+		if (bw_config_u->num_paths != bw_config->num_paths) {
+			CAM_ERR(CAM_ISP, "num_paths changed,userspace:%d, kernel:%d", bw_config_u->num_paths,
+					bw_config->num_paths);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (bw_config->num_paths > 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_bw_config_v2)) /
+				(bw_config->num_paths - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Size exceeds limit paths:%u size per path:%lu ctx_idx: %u",
+					bw_config->num_paths - 1,
+					sizeof(
+					struct cam_axi_per_path_bw_vote), c_ctx->ctx_index);
+				cam_common_mem_free(bw_config);
+				return -EINVAL;
+			}
+		}
+
+		if ((bw_config->num_paths != 0) && (blob_size <
+			(sizeof(struct cam_isp_bw_config_v2) +
+			(bw_config->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote)))) {
+			CAM_ERR(CAM_ISP,
+				"Invalid blob size: %u, num_paths: %u, bw_config size: %lu, per_path_vote size: %lu, ctx_idx: %u",
+				blob_size, bw_config->num_paths,
+				sizeof(struct cam_isp_bw_config_v2),
+				sizeof(struct cam_axi_per_path_bw_vote), c_ctx->ctx_index);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		if (!prepare || !prepare->priv ||
+			(bw_config->usage_type >= CAM_ISP_HW_USAGE_TYPE_MAX)) {
+			CAM_ERR(CAM_ISP, "Invalid inputs usage type %d ctx_idx: %u",
+				bw_config->usage_type, c_ctx->ctx_index);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *) prepare->priv;
+
+		prepare_hw_data->bw_clk_config.bw_config_v2.usage_type = bw_config->usage_type;
+		prepare_hw_data->bw_clk_config.bw_config_v2.num_paths = bw_config->num_paths;
+
+		for (i = 0; i < bw_config->num_paths; i++) {
+			path_vote = &prepare_hw_data->bw_clk_config.bw_config_v2.axi_path[i];
+			path_vote->usage_data = bw_config->axi_path_flex[i].usage_data;
+			path_vote->transac_type = bw_config->axi_path_flex[i].transac_type;
+			path_vote->path_data_type = bw_config->axi_path_flex[i].path_data_type;
+			path_vote->vote_level = 0;
+			path_vote->camnoc_bw = bw_config->axi_path_flex[i].camnoc_bw;
+			path_vote->mnoc_ab_bw = bw_config->axi_path_flex[i].mnoc_ab_bw;
+			path_vote->mnoc_ib_bw = bw_config->axi_path_flex[i].mnoc_ib_bw;
+		}
+
+		c_ctx->bw_config_version = CAM_ISP_BW_CONFIG_V2;
+		prepare_hw_data->bw_clk_config.bw_config_valid = true;
+		cam_common_mem_free(bw_config);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V3: {
+		struct cam_isp_bw_config_v3    *bw_config;
+		struct cam_isp_bw_config_v3    *bw_config_u;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+		struct cam_cpas_axi_per_path_bw_vote *path_vote;
+		size_t bw_config_size;
+
+		if (blob_size < sizeof(struct cam_isp_bw_config_v3)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u ctx_idx: %u", blob_size,
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		bw_config_u = (struct cam_isp_bw_config_v3 *)blob_data;
+
+		if (bw_config_u->num_paths > CAM_ISP_MAX_PER_PATH_VOTES ||
+			!bw_config_u->num_paths) {
+			CAM_ERR(CAM_ISP, "Invalid num paths %d, ctx_idx: %u",
+				bw_config_u->num_paths, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		bw_config_size = sizeof(struct cam_isp_bw_config_v3) + ((bw_config_u->num_paths-1) *
+					 sizeof(struct cam_axi_per_path_bw_vote_v2));
+
+		rc = cam_common_mem_kdup((void **)&bw_config, bw_config_u, bw_config_size);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Alloc and copy request bw_config failed");
+			return rc;
+		}
+
+		if (bw_config_u->num_paths != bw_config->num_paths) {
+			CAM_ERR(CAM_ISP, "num_paths changed,userspace:%d, kernel:%d", bw_config_u->num_paths,
+					bw_config->num_paths);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (bw_config->num_paths > 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote_v2) > ((UINT_MAX -
+				sizeof(struct cam_isp_bw_config_v3)) /
+				(bw_config->num_paths - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Size exceeds limit paths:%u size per path:%lu ctx_idx: %u",
+					bw_config->num_paths - 1,
+					sizeof(struct cam_axi_per_path_bw_vote_v2),
+					c_ctx->ctx_index);
+				cam_common_mem_free(bw_config);
+				return -EINVAL;
+			}
+		}
+
+		if ((bw_config->num_paths != 0) && (blob_size <
+			(sizeof(struct cam_isp_bw_config_v3) +
+			(bw_config->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote_v2)))) {
+			CAM_ERR(CAM_ISP,
+				"Invalid blob size: %u, num_paths: %u, bw_config size: %lu, per_path_vote size: %lu ctx_idx: %u",
+				blob_size, bw_config->num_paths,
+				sizeof(struct cam_isp_bw_config_v3),
+				sizeof(struct cam_axi_per_path_bw_vote_v2), c_ctx->ctx_index);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		if (!prepare || !prepare->priv ||
+			(bw_config->usage_type >= CAM_ISP_HW_USAGE_TYPE_MAX)) {
+			CAM_ERR(CAM_ISP, "Invalid inputs usage type %d, ctx_idx: %u",
+				bw_config->usage_type, c_ctx->ctx_index);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *) prepare->priv;
+
+		prepare_hw_data->bw_clk_config.bw_config_v2.usage_type = bw_config->usage_type;
+		prepare_hw_data->bw_clk_config.bw_config_v2.num_paths = bw_config->num_paths;
+
+		for (i = 0; i < bw_config->num_paths; i++) {
+			path_vote = &prepare_hw_data->bw_clk_config.bw_config_v2.axi_path[i];
+			path_vote->usage_data = bw_config->axi_path_flex[i].usage_data;
+			path_vote->transac_type = bw_config->axi_path_flex[i].transac_type;
+			path_vote->path_data_type = bw_config->axi_path_flex[i].path_data_type;
+			path_vote->vote_level = bw_config->axi_path_flex[i].vote_level;
+			path_vote->camnoc_bw = bw_config->axi_path_flex[i].camnoc_bw;
+			path_vote->mnoc_ab_bw = bw_config->axi_path_flex[i].mnoc_ab_bw;
+			path_vote->mnoc_ib_bw = bw_config->axi_path_flex[i].mnoc_ib_bw;
+		}
+
+		c_ctx->bw_config_version = CAM_ISP_BW_CONFIG_V3;
+		prepare_hw_data->bw_clk_config.bw_config_valid = true;
+		cam_common_mem_free(bw_config);
+	}
+		break;
+
+	case CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG: {
+		struct cam_ubwc_config *ubwc_config;
+
+		if (blob_size < sizeof(struct cam_ubwc_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob_size %u ctx_idx: %u",
+				blob_size, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		ubwc_config = (struct cam_ubwc_config *)blob_data;
+
+		if (ubwc_config->num_ports > CAM_VFE_MAX_UBWC_PORTS ||
+			ubwc_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in ubwc config, ctx_idx: %u",
+				ubwc_config->num_ports, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (ubwc_config->num_ports != 1) {
+			if (sizeof(struct cam_ubwc_plane_cfg_v1) >
+				((UINT_MAX - sizeof(struct cam_ubwc_config)) /
+				((ubwc_config->num_ports - 1) * 2))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in ubwc config num_ports:%u size per port:%lu ctx_idx: %u",
+					ubwc_config->num_ports,
+					sizeof(struct cam_ubwc_plane_cfg_v1) *
+					2, c_ctx->ctx_index);
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_ubwc_config) +
+			(ubwc_config->num_ports - 1) *
+			sizeof(struct cam_ubwc_plane_cfg_v1) * 2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob_size %u expected %lu ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_ubwc_config) +
+				(ubwc_config->num_ports - 1) *
+				sizeof(struct cam_ubwc_plane_cfg_v1) * 2, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_ubwc_update(blob_type, blob_info,
+			ubwc_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "UBWC Update Failed rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+
+	case CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG_V2: {
+		struct cam_ubwc_config_v2 *ubwc_config;
+
+		if (blob_size < sizeof(struct cam_ubwc_config_v2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob_size %u, ctx_idx: %u",
+				blob_size, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		ubwc_config = (struct cam_ubwc_config_v2 *)blob_data;
+
+		if (ubwc_config->num_ports > CAM_VFE_MAX_UBWC_PORTS ||
+			ubwc_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in ubwc config, ctx_idx: %u",
+				ubwc_config->num_ports, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (ubwc_config->num_ports != 1) {
+			if (sizeof(struct cam_ubwc_plane_cfg_v2) >
+				((UINT_MAX - sizeof(struct cam_ubwc_config_v2))
+				/ ((ubwc_config->num_ports - 1) * 2))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in ubwc config num_ports:%u size per port:%lu ctx_idx: %u",
+					ubwc_config->num_ports,
+					sizeof(struct cam_ubwc_plane_cfg_v2) *
+					2, c_ctx->ctx_index);
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_ubwc_config_v2) +
+			(ubwc_config->num_ports - 1) *
+			sizeof(struct cam_ubwc_plane_cfg_v2) * 2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob_size %u expected %lu ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_ubwc_config_v2) +
+				(ubwc_config->num_ports - 1) *
+				sizeof(struct cam_ubwc_plane_cfg_v2) * 2, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_ubwc_update_v2(blob_type, blob_info,
+			ubwc_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "UBWC Update Failed rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG: {
+		struct cam_isp_csid_clock_config    *clock_config;
+
+		if (blob_size < sizeof(struct cam_isp_csid_clock_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_csid_clock_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		clock_config = (struct cam_isp_csid_clock_config *)blob_data;
+
+		rc = cam_isp_blob_csid_clock_update(blob_type, blob_info,
+			clock_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Clock Update Failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_CSID_QCFA_CONFIG: {
+		struct cam_isp_csid_qcfa_config *qcfa_config;
+
+		if (blob_size < sizeof(struct cam_isp_csid_qcfa_config)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid qcfa blob size %u expected %u, ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_csid_qcfa_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		qcfa_config = (struct cam_isp_csid_qcfa_config *)blob_data;
+
+		rc = cam_isp_blob_csid_qcfa_update(blob_type, blob_info,
+				qcfa_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "QCFA Update Failed rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_FE_CONFIG: {
+		struct cam_fe_config *fe_config;
+
+		if (blob_size < sizeof(struct cam_fe_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu, ctx_idx: %u",
+				blob_size, sizeof(struct cam_fe_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		fe_config = (struct cam_fe_config *)blob_data;
+
+		rc = cam_isp_blob_fe_update(blob_type, blob_info,
+			fe_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "FS Update Failed rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_IFE_CORE_CONFIG: {
+		struct cam_isp_core_config *core_config;
+
+		if (blob_size < sizeof(struct cam_isp_core_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size, sizeof(struct cam_isp_core_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		core_config = (struct cam_isp_core_config *)blob_data;
+
+		rc = cam_isp_blob_core_cfg_update(blob_type, blob_info,
+			core_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Core cfg update fail: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_VFE_OUT_CONFIG: {
+		struct cam_isp_vfe_out_config *vfe_out_config;
+
+		if (blob_size < sizeof(struct cam_isp_vfe_out_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_vfe_out_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		vfe_out_config = (struct cam_isp_vfe_out_config *)blob_data;
+
+		if (vfe_out_config->num_ports >  max_ife_out_res ||
+			vfe_out_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP,
+				"Invalid num_ports:%u in vfe out config, ctx_idx: %u",
+				vfe_out_config->num_ports, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (vfe_out_config->num_ports != 1) {
+			if (sizeof(struct cam_isp_vfe_wm_config) > ((UINT_MAX -
+				sizeof(struct cam_isp_vfe_out_config)) /
+				(vfe_out_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in vfe out config num_ports:%u size per port:%lu, ctx_idx: %u",
+					vfe_out_config->num_ports,
+					sizeof(struct cam_isp_vfe_wm_config),
+					c_ctx->ctx_index);
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_isp_vfe_out_config) +
+			(vfe_out_config->num_ports - 1) *
+			sizeof(struct cam_isp_vfe_wm_config))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size, sizeof(struct cam_isp_vfe_out_config)
+				+ (vfe_out_config->num_ports - 1) *
+				sizeof(struct cam_isp_vfe_wm_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_vfe_out_update(blob_type, blob_info,
+			vfe_out_config, prepare, max_ife_out_res,
+			CAM_ISP_HW_TYPE_VFE);
+		if (rc)
+			CAM_ERR(CAM_ISP, "VFE out update failed rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SENSOR_BLANKING_CONFIG: {
+		struct cam_isp_sensor_blanking_config  *sensor_blanking_config;
+
+		if (blob_size < sizeof(struct cam_isp_sensor_blanking_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %zu expected %zu ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_sensor_blanking_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+		sensor_blanking_config =
+			(struct cam_isp_sensor_blanking_config *)blob_data;
+
+		rc = cam_isp_blob_sensor_blanking_config(blob_type, blob_info,
+			sensor_blanking_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Epoch Configuration Update Failed rc:%d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_DISCARD_INITIAL_FRAMES: {
+		struct cam_isp_discard_initial_frames *discard_config;
+
+		if (blob_size < sizeof(struct cam_isp_discard_initial_frames)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid discard frames blob size %u expected %u ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_discard_initial_frames),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		discard_config = (struct cam_isp_discard_initial_frames *)blob_data;
+
+		rc = cam_isp_blob_csid_discard_init_frame_update(
+			blob_info, discard_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Discard initial frames update failed rc: %d ctx: %u",
+				rc, c_ctx->ctx_index);
+
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_SCRATCH_BUF_CFG: {
+		struct cam_isp_sfe_init_scratch_buf_config *scratch_config;
+
+		scratch_config =
+			(struct cam_isp_sfe_init_scratch_buf_config *)blob_data;
+
+		rc = cam_isp_validate_scratch_buffer_blob(blob_size,
+			ife_mgr_ctx, scratch_config);
+		if (rc)
+			return rc;
+
+		rc = cam_isp_blob_ife_scratch_buf_update(
+			scratch_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "IFE scratch buffer update failed rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_IFE_FCG_CFG: {
+		struct cam_isp_generic_fcg_config *fcg_config_args;
+
+		if (blob_size <
+			sizeof(struct cam_isp_generic_fcg_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, fcg config size: %u, ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_generic_fcg_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		fcg_config_args =
+			(struct cam_isp_generic_fcg_config *)blob_data;
+
+		rc = cam_isp_validate_fcg_configs(fcg_config_args,
+			CAM_ISP_IFE_MAX_FCG_CH_CTXS,
+			CAM_ISP_IFE_MAX_FCG_PREDICTIONS,
+			ife_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed in validating FCG configs, ctx_idx: %u",
+				c_ctx->ctx_index);
+			return rc;
+		}
+
+		rc = cam_isp_blob_fcg_config_prepare(fcg_config_args,
+			prepare, CAM_ISP_HW_TYPE_VFE);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"FCG configuration preparation failed, rc: %d, ctx_idx: %d",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_CLOCK_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_CORE_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_OUT_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_HFR_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_FE_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_EXP_ORDER_CFG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_FCG_CFG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_FPS_CONFIG:
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_IRQ_COMP_CFG:
+		{
+			struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+
+			prepare_hw_data = (struct cam_isp_prepare_hw_update_data *)
+				prepare->priv;
+
+			prepare_hw_data->irq_comp_cfg_valid = true;
+		}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_DYNAMIC_MODE_SWITCH: {
+		struct cam_isp_mode_switch_info    *mup_config;
+
+		if (blob_size < sizeof(struct cam_isp_mode_switch_info)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_mode_switch_info), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		mup_config = (struct cam_isp_mode_switch_info *)blob_data;
+
+		rc = cam_isp_blob_csid_dynamic_switch_update(
+			blob_type, blob_info, mup_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "MUP Update Failed, ctx_idx: %u", c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_LIMITER_CFG: {
+		struct cam_isp_out_rsrc_bw_limiter_config *bw_limit_config;
+
+		if (blob_size <
+			sizeof(struct cam_isp_out_rsrc_bw_limiter_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_out_rsrc_bw_limiter_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		bw_limit_config =
+			(struct cam_isp_out_rsrc_bw_limiter_config *)blob_data;
+
+		rc = cam_isp_validate_bw_limiter_blob(blob_size,
+			bw_limit_config);
+		if (rc)
+			return rc;
+
+		rc = cam_isp_blob_bw_limit_update(blob_type, blob_info,
+			bw_limit_config, prepare, CAM_ISP_HW_TYPE_VFE);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"BW limit update failed for IFE rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_INIT_CONFIG: {
+		struct cam_isp_init_config            *init_config;
+		struct cam_isp_prepare_hw_update_data *prepare_hw_data;
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data *)
+			prepare->priv;
+
+		if (prepare_hw_data->packet_opcode_type !=
+			CAM_ISP_PACKET_INIT_DEV) {
+			CAM_ERR(CAM_ISP,
+				"Init config blob not supported for packet type: %u req: %llu ctx_idx: %u",
+				prepare_hw_data->packet_opcode_type,
+				 prepare->packet->header.request_id, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (blob_size < sizeof(struct cam_isp_init_config)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid init config blob size %u expected %u, ctx_idx: %u",
+				blob_size, sizeof(struct cam_isp_init_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		init_config = (struct cam_isp_init_config *)blob_data;
+
+		rc = cam_isp_blob_csid_init_config_update(prepare, init_config);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"CSID Init config failed for req: %llu rc: %d ctx_idx: %u",
+				 prepare->packet->header.request_id, rc, c_ctx->ctx_index);
+			break;
+		}
+
+		rc = cam_isp_blob_ife_init_config_update(prepare, init_config);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"IFE Init config failed for req: %llu rc: %d ctx_idx: %u",
+				 prepare->packet->header.request_id, rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_RDI_LCR_CONFIG: {
+		struct cam_isp_lcr_rdi_config *lcr_rdi_config;
+
+		if (blob_size < sizeof(struct cam_isp_lcr_rdi_config)) {
+			CAM_ERR(CAM_ISP, "Invalid lcr blob size %u expected %u ctx_idx: %u",
+				blob_size, sizeof(struct cam_isp_lcr_rdi_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		lcr_rdi_config = (struct cam_isp_lcr_rdi_config *)blob_data;
+		rc = cam_isp_blob_ife_rdi_lcr_config(ife_mgr_ctx, prepare,
+			blob_info, lcr_rdi_config, blob_type);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"RDI LCR config failed for res %u, ctx_idx: %u",
+				 lcr_rdi_config->res_id, c_ctx->ctx_index);
+
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_DRV_CONFIG: {
+		struct cam_isp_drv_config *drv_config;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+
+		if (blob_size < sizeof(struct cam_isp_drv_config)) {
+			CAM_ERR(CAM_ISP, "Invalid DRV blob size %u expected %u ctx_idx: %u",
+				blob_size, sizeof(struct cam_isp_drv_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+		drv_config = (struct cam_isp_drv_config *)blob_data;
+		memcpy(&prepare_hw_data->isp_drv_config, drv_config,
+			sizeof(prepare_hw_data->isp_drv_config));
+
+		CAM_DBG(CAM_ISP,
+			"DRV config blob en:%d timeout_val:%u path_idle_en: 0x%x ctx: %u",
+			drv_config->drv_en, drv_config->timeout_val, drv_config->path_idle_en,
+			c_ctx->ctx_index);
+		prepare_hw_data->drv_config_valid = true;
+	}
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "Invalid blob type %d, ctx_idx: %u",
+			blob_type, c_ctx->ctx_index);
+		break;
+	}
+
+	if (c_ctx->is_offline && c_ctx->offline_clk !=
+					ife_hw_mgr->offline_clk) {
+		size_t clock_config_size = 0;
+		struct cam_isp_clock_config    *offline_clk_cfg;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+		offline_clk_cfg = (struct cam_isp_clock_config *)blob_data;
+
+		c_ctx->offline_clk = ife_hw_mgr->offline_clk;
+		offline_clk_cfg->left_pix_hz = ife_hw_mgr->offline_clk;
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+		clock_config_size = sizeof(struct cam_isp_clock_config);
+
+		if (offline_clk_cfg->num_rdi >= 1)
+				clock_config_size += (offline_clk_cfg->num_rdi - 1) *
+					sizeof(offline_clk_cfg->rdi_hz);
+
+		CAM_DBG(CAM_ISP, "Override offline IFE clk to %u, vote rdi num %d size %d",
+				offline_clk_cfg->left_pix_hz,offline_clk_cfg->num_rdi,clock_config_size);
+		memcpy(&prepare_hw_data->bw_clk_config.ife_clock_config, offline_clk_cfg,
+			clock_config_size);
+		prepare_hw_data->bw_clk_config.ife_clock_config_valid = true;
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_util_insert_frame_header(
+	struct cam_kmd_buf_info *kmd_buf,
+	struct cam_isp_prepare_hw_update_data *prepare_hw_data,
+	struct list_head *buf_tracker)
+{
+	int mmu_hdl = -1, rc = 0;
+	dma_addr_t iova_addr;
+	uint32_t frame_header_iova, padded_bytes = 0;
+	size_t len;
+	struct cam_ife_hw_mgr *hw_mgr = &g_ife_hw_mgr;
+
+	mmu_hdl = cam_mem_is_secure_buf(
+			kmd_buf->handle) ?
+			hw_mgr->mgr_common.img_iommu_hdl_secure :
+			hw_mgr->mgr_common.img_iommu_hdl;
+
+	rc = cam_mem_get_io_buf(kmd_buf->handle, mmu_hdl,
+		&iova_addr, &len, NULL, buf_tracker);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Failed to get io addr for handle = %d for mmu_hdl = %u",
+			kmd_buf->handle, mmu_hdl);
+		return rc;
+	}
+
+	/* CDM buffer is within 32-bit address space */
+	frame_header_iova = (uint32_t)iova_addr;
+	frame_header_iova += kmd_buf->offset;
+
+	/* frame header address needs to be 256 byte aligned */
+	if (frame_header_iova % CAM_FRAME_HEADER_ADDR_ALIGNMENT) {
+		padded_bytes = (uint32_t)(CAM_FRAME_HEADER_ADDR_ALIGNMENT -
+			(frame_header_iova % CAM_FRAME_HEADER_ADDR_ALIGNMENT));
+		frame_header_iova += padded_bytes;
+	}
+
+	prepare_hw_data->frame_header_iova = frame_header_iova;
+
+	/* update the padding if any for the cpu addr as well */
+	prepare_hw_data->frame_header_cpu_addr = kmd_buf->cpu_addr +
+			(padded_bytes / 4);
+
+	CAM_DBG(CAM_ISP,
+		"Frame Header iova_addr: %pK cpu_addr: %pK padded_bytes: %llu",
+		prepare_hw_data->frame_header_iova,
+		prepare_hw_data->frame_header_cpu_addr,
+		padded_bytes);
+
+	/* Reserve memory for frame header */
+	kmd_buf->used_bytes += (padded_bytes + CAM_FRAME_HEADER_BUFFER_SIZE);
+	kmd_buf->offset += kmd_buf->used_bytes;
+
+	return rc;
+}
+
+static int cam_isp_blob_csid_irq_comp_cfg(
+	struct cam_ife_hw_mgr_ctx         *ctx,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_isp_generic_blob_info  *blob_info,
+	struct cam_isp_irq_comp_cfg       *comp_cfg,
+	uint32_t                           blob_type)
+
+{
+	int rc = 0;
+	struct cam_isp_hw_mgr_res         *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = ctx->concr_ctx;
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		if (!hw_mgr_res->hw_res[0])
+			continue;
+		break;
+	}
+
+	if (!hw_mgr_res) {
+		CAM_ERR(CAM_ISP, "Ctx:%d invalid res", c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	rc = cam_isp_hw_mgr_add_cmd_buf_util(hw_mgr_res, prepare,
+		blob_info, (void *)comp_cfg,
+		CAM_ISP_HW_CMD_IRQ_COMP_CFG, blob_type);
+
+	CAM_DBG(CAM_ISP, "Ctx:%d IPP SRC mask 0x%x IPP DST mask 0x%x", c_ctx->ctx_index,
+		comp_cfg->ipp_src_ctxt_mask, comp_cfg->ipp_dst_comp_mask);
+
+	return rc;
+}
+
+static int cam_csid_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	int rc = 0;
+	struct cam_isp_generic_blob_info *blob_info = user_data;
+	struct cam_ife_hw_mgr_ctx *ife_mgr_ctx = NULL;
+	struct cam_hw_prepare_update_args *prepare = NULL;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = NULL;
+
+	if (!blob_data || (blob_size == 0) || !blob_info) {
+		CAM_ERR(CAM_ISP, "Invalid args data %pK size %d info %pK",
+			blob_data, blob_size, blob_info);
+		return -EINVAL;
+	}
+
+	prepare = blob_info->prepare;
+	if (!prepare || !prepare->ctxt_to_hw_map) {
+		CAM_ERR(CAM_ISP, "Failed. prepare is NULL, blob_type %d",
+			blob_type);
+		return -EINVAL;
+	}
+
+	ife_mgr_ctx = prepare->ctxt_to_hw_map;
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+	CAM_DBG(CAM_ISP, "Context[%pK][%u] blob_type=%d, blob_size=%d",
+		ife_mgr_ctx, c_ctx->ctx_index, blob_type, blob_size);
+
+	switch (blob_type) {
+	case CAM_ISP_GENERIC_BLOB_TYPE_HFR_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_CLOCK_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V2:
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V3:
+	case CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG_V2:
+	case CAM_ISP_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_CSID_QCFA_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_FE_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_IFE_CORE_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_VFE_OUT_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SENSOR_BLANKING_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_DISCARD_INITIAL_FRAMES:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_SCRATCH_BUF_CFG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_CLOCK_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_CORE_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_OUT_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_HFR_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_FE_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_EXP_ORDER_CFG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_FPS_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_DYNAMIC_MODE_SWITCH:
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_LIMITER_CFG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_INIT_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_RDI_LCR_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_DRV_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_FCG_CFG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_IFE_FCG_CFG:
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_IRQ_COMP_CFG: {
+		struct cam_isp_irq_comp_cfg *irq_comp_cfg;
+
+		if (blob_size < sizeof(struct cam_isp_irq_comp_cfg)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid IPP IRQ comp cfg blob size, %u, expected %u",
+				blob_size, sizeof(struct cam_isp_irq_comp_cfg));
+			return -EINVAL;
+		}
+
+		irq_comp_cfg = (struct cam_isp_irq_comp_cfg *)blob_data;
+		rc = cam_isp_blob_csid_irq_comp_cfg(ife_mgr_ctx, prepare,
+			blob_info, irq_comp_cfg, blob_type);
+
+		CAM_DBG(CAM_ISP,
+			"IRQ comp cfg blob, ipp_src_ctxt_mask: 0x%x, ipp_dest_ctxt_mask: 0x%x",
+			irq_comp_cfg->ipp_src_ctxt_mask, irq_comp_cfg->ipp_dst_comp_mask);
+	}
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "Invalid blob type %d, ctx_idx: %u",
+			blob_type, c_ctx->ctx_index);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_sfe_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	int rc = 0;
+	struct cam_isp_generic_blob_info      *blob_info = user_data;
+	struct cam_ife_hw_mgr_ctx             *ife_mgr_ctx = NULL;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	struct cam_hw_prepare_update_args     *prepare = NULL;
+	struct cam_ife_hw_mgr                 *ife_hw_mgr = NULL;
+
+	if (!blob_data || (blob_size == 0) || !blob_info) {
+		CAM_ERR(CAM_ISP, "Invalid args data %pK size %d info %pK",
+			blob_data, blob_size, blob_info);
+		return -EINVAL;
+	}
+
+	prepare = blob_info->prepare;
+	if (!prepare || !prepare->ctxt_to_hw_map) {
+		CAM_ERR(CAM_ISP, "Failed. prepare is NULL, blob_type %d",
+			blob_type);
+		return -EINVAL;
+	}
+
+	ife_mgr_ctx = prepare->ctxt_to_hw_map;
+	if (!ife_mgr_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid ctx");
+		return -EINVAL;
+	}
+
+	c_ctx = ((struct cam_ife_hw_mgr_ctx *)
+			prepare->ctxt_to_hw_map)->concr_ctx;
+	if (!c_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid ctx");
+		return -EINVAL;
+	}
+
+	ife_hw_mgr = c_ctx->hw_mgr;
+
+	CAM_DBG(CAM_ISP, "Context[%pK][%u] blob_type: %d, blob_size: %d",
+		c_ctx, c_ctx->ctx_index, blob_type, blob_size);
+
+	switch (blob_type) {
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_CLOCK_CONFIG: {
+		size_t clock_config_size = 0;
+		struct cam_isp_clock_config    *clock_config;
+		struct cam_isp_prepare_hw_update_data *prepare_hw_data;
+
+		if (blob_size < sizeof(struct cam_isp_clock_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+				blob_size, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		clock_config = (struct cam_isp_clock_config *)blob_data;
+
+		if (clock_config->num_rdi > CAM_SFE_RDI_NUM_MAX) {
+			CAM_ERR(CAM_ISP, "Invalid num_rdi %u in clock config, ctx_idx: %u",
+				clock_config->num_rdi, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (clock_config->num_rdi > 1) {
+			if (sizeof(uint64_t) > ((UINT_MAX -
+				sizeof(struct cam_isp_clock_config)) /
+				(clock_config->num_rdi - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in clock config num_rdi:%u size per port:%lu ctx_idx: %u",
+					clock_config->num_rdi,
+					sizeof(uint64_t), c_ctx->ctx_index);
+				return -EINVAL;
+			}
+		}
+
+		if ((clock_config->num_rdi != 0) && (blob_size <
+			(sizeof(struct cam_isp_clock_config) +
+			sizeof(uint64_t) * (clock_config->num_rdi - 1)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size,
+				sizeof(uint32_t) * 2 + sizeof(uint64_t) *
+				(clock_config->num_rdi + 2), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+		clock_config_size = sizeof(struct cam_isp_clock_config) +
+			((clock_config->num_rdi - 1) *
+			sizeof(clock_config->rdi_hz));
+		memcpy(&prepare_hw_data->bw_clk_config.sfe_clock_config, clock_config,
+			clock_config_size);
+		prepare_hw_data->bw_clk_config.sfe_clock_config_valid = true;
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_OUT_CONFIG: {
+		struct cam_isp_vfe_out_config *vfe_out_config;
+
+		if (blob_size < sizeof(struct cam_isp_vfe_out_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_vfe_out_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		vfe_out_config = (struct cam_isp_vfe_out_config *)blob_data;
+
+
+		if (vfe_out_config->num_ports > max_sfe_out_res ||
+			vfe_out_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP,
+				"Invalid num_ports:%u in sfe out config, ctx_idx: %u",
+				vfe_out_config->num_ports,
+				max_sfe_out_res, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (vfe_out_config->num_ports != 1) {
+			if (sizeof(struct cam_isp_vfe_wm_config) > ((UINT_MAX -
+				sizeof(struct cam_isp_vfe_out_config)) /
+				(vfe_out_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in sfe out config num_ports:%u size per port:%lu ctx_idx: %u",
+					vfe_out_config->num_ports,
+					sizeof(struct cam_isp_vfe_wm_config),
+					c_ctx->ctx_index);
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_isp_vfe_out_config) +
+			(vfe_out_config->num_ports - 1) *
+			sizeof(struct cam_isp_vfe_wm_config))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size, sizeof(struct cam_isp_vfe_out_config)
+				+ (vfe_out_config->num_ports - 1) *
+				sizeof(struct cam_isp_vfe_wm_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_vfe_out_update(blob_type, blob_info,
+			vfe_out_config, prepare, max_sfe_out_res,
+			CAM_ISP_HW_TYPE_SFE);
+		if (rc)
+			CAM_ERR(CAM_ISP, "SFE out update failed rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_HFR_CONFIG: {
+		struct cam_isp_resource_hfr_config    *hfr_config;
+
+		if (blob_size < sizeof(struct cam_isp_resource_hfr_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+				blob_size, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		hfr_config = (struct cam_isp_resource_hfr_config *)blob_data;
+
+		if (hfr_config->num_ports > max_sfe_out_res
+			|| hfr_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in HFR config, ctx_idx: %u",
+				hfr_config->num_ports, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (hfr_config->num_ports != 1) {
+			if (sizeof(struct cam_isp_port_hfr_config) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_resource_hfr_config)) /
+				(hfr_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in hfr config num_ports:%u size per port:%lu ctx_idx: %u",
+					hfr_config->num_ports,
+					sizeof(struct cam_isp_port_hfr_config),
+					c_ctx->ctx_index);
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_isp_resource_hfr_config) +
+			(hfr_config->num_ports - 1) *
+			sizeof(struct cam_isp_port_hfr_config))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu, ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_resource_hfr_config) +
+				(hfr_config->num_ports - 1) *
+				sizeof(struct cam_isp_port_hfr_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_hfr_update(blob_type, blob_info,
+			hfr_config, prepare, max_sfe_out_res,
+			CAM_ISP_HW_TYPE_SFE);
+		if (rc)
+			CAM_ERR(CAM_ISP, "HFR Update Failed, ctx_idx: %u", c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_CORE_CONFIG: {
+		struct cam_isp_sfe_core_config *core_cfg;
+
+		if (blob_size < sizeof(struct cam_isp_sfe_core_config)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid blob size: %u expected: %u ctx_idx: %u", blob_size,
+				sizeof(struct cam_isp_sfe_core_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		core_cfg = (struct cam_isp_sfe_core_config *)blob_data;
+		rc = cam_isp_blob_sfe_core_cfg_update(blob_type, blob_info,
+			core_cfg, prepare);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_SCRATCH_BUF_CFG: {
+		struct cam_isp_sfe_init_scratch_buf_config *scratch_config;
+
+		scratch_config =
+			(struct cam_isp_sfe_init_scratch_buf_config *)blob_data;
+
+		rc = cam_isp_validate_scratch_buffer_blob(blob_size,
+			ife_mgr_ctx, scratch_config);
+		if (rc)
+			return rc;
+
+		rc = cam_isp_blob_sfe_scratch_buf_update(
+			scratch_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "SFE scratch buffer update failed rc: %d ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_FE_CONFIG: {
+		struct cam_fe_config *fe_config;
+
+		if (blob_size < sizeof(struct cam_fe_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size, sizeof(struct cam_fe_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		fe_config = (struct cam_fe_config *)blob_data;
+
+		rc = cam_isp_blob_fe_update(blob_type, blob_info,
+			fe_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "FS Update Failed rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_DYNAMIC_MODE_SWITCH: {
+		struct cam_isp_mode_switch_info       *mup_config;
+		struct cam_isp_prepare_hw_update_data *prepare_hw_data;
+
+		if (blob_size < sizeof(struct cam_isp_mode_switch_info)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_mode_switch_info), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+		mup_config = (struct cam_isp_mode_switch_info *)blob_data;
+		if (c_ctx->flags.is_sfe_shdr) {
+			c_ctx->scratch_buf_info.sfe_scratch_config->updated_num_exp =
+				mup_config->num_expoures;
+			prepare_hw_data->num_exp = mup_config->num_expoures;
+
+			rc = cam_isp_blob_sfe_update_fetch_core_cfg(
+				blob_type, blob_info, prepare);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"SFE dynamic enable/disable for fetch failed, ctx_idx: %u",
+					c_ctx->ctx_index);
+		}
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_EXP_ORDER_CFG: {
+		struct cam_isp_sfe_exp_config *exp_config;
+
+		if (!c_ctx->flags.is_sfe_shdr) {
+			CAM_ERR(CAM_ISP,
+				"Blob %u supported only for sHDR streams,  ctx_idx: %u",
+				blob_type, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (blob_size <
+			sizeof(struct cam_isp_sfe_exp_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+				blob_size, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		exp_config =
+			(struct cam_isp_sfe_exp_config *)blob_data;
+
+		if ((exp_config->num_ports > CAM_SFE_FE_RDI_NUM_MAX) ||
+			(exp_config->num_ports == 0)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid num_ports %u in exp order config, ctx_idx: %u",
+				exp_config->num_ports, c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (exp_config->num_ports != 1) {
+			if (sizeof(struct cam_isp_sfe_wm_exp_order_config) >
+				((UINT_MAX -
+				sizeof(
+				struct cam_isp_sfe_exp_config)) /
+				(exp_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in exp order config num_ports: %u size per port: %lu ctx_idx: %u",
+					exp_config->num_ports,
+					sizeof(
+					struct cam_isp_sfe_wm_exp_order_config),
+					c_ctx->ctx_index);
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size <
+			(sizeof(struct cam_isp_sfe_exp_config) +
+			(exp_config->num_ports - 1) *
+			sizeof(struct cam_isp_sfe_wm_exp_order_config))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size: %u expected: %lu ctx_idx: %u",
+				blob_size,
+				sizeof(
+				struct cam_isp_sfe_exp_config) +
+				(exp_config->num_ports - 1) *
+				sizeof(
+				struct cam_isp_sfe_wm_exp_order_config), c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_sfe_exp_order_update(
+			blob_info->base_info->idx, exp_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "SFE exp order update failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_LIMITER_CFG: {
+		struct cam_isp_out_rsrc_bw_limiter_config *bw_limit_config;
+
+		if (blob_size <
+			sizeof(struct cam_isp_out_rsrc_bw_limiter_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_out_rsrc_bw_limiter_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		bw_limit_config =
+			(struct cam_isp_out_rsrc_bw_limiter_config *)blob_data;
+
+		rc = cam_isp_validate_bw_limiter_blob(blob_size,
+			bw_limit_config);
+		if (rc)
+			return rc;
+
+		rc = cam_isp_blob_bw_limit_update(blob_type, blob_info,
+			bw_limit_config, prepare, CAM_ISP_HW_TYPE_SFE);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"BW limit update failed for SFE rc: %d, ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SFE_FCG_CFG: {
+		struct cam_isp_generic_fcg_config *fcg_config_args;
+
+		if (blob_size <
+			sizeof(struct cam_isp_generic_fcg_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, fcg config size: %u, ctx_idx: %u",
+				blob_size,
+				sizeof(struct cam_isp_generic_fcg_config),
+				c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		fcg_config_args =
+			(struct cam_isp_generic_fcg_config *)blob_data;
+
+		rc = cam_isp_validate_fcg_configs(fcg_config_args,
+			CAM_ISP_SFE_MAX_FCG_CHANNELS,
+			CAM_ISP_SFE_MAX_FCG_PREDICTIONS,
+			ife_mgr_ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed in validating FCG configs, ctx_idx: %u",
+				c_ctx->ctx_index);
+			return rc;
+		}
+
+		rc = cam_isp_blob_fcg_config_prepare(fcg_config_args,
+			prepare, CAM_ISP_HW_TYPE_SFE);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"FCG configuration preparation failed, rc: %d, ctx_idx: %d",
+				rc, c_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_IFE_FCG_CFG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_HFR_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_CLOCK_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_FE_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG_V2:
+	case CAM_ISP_GENERIC_BLOB_TYPE_IFE_CORE_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_VFE_OUT_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V2:
+	case CAM_ISP_GENERIC_BLOB_TYPE_CSID_QCFA_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_SENSOR_BLANKING_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_DISCARD_INITIAL_FRAMES:
+	case CAM_ISP_GENERIC_BLOB_TYPE_INIT_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_FPS_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_RDI_LCR_CONFIG:
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V3:
+	case CAM_ISP_GENERIC_BLOB_TYPE_DRV_CONFIG:
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "Invalid blob type: %u, ctx_idx: %u",
+			blob_type, c_ctx->ctx_index);
+		break;
+	}
+
+	if (c_ctx->is_offline && (c_ctx->offline_sfe_clk !=
+		ife_hw_mgr->offline_sfe_clk)) {
+		size_t clock_config_size = 0;
+		struct cam_isp_clock_config    *offline_clk_cfg;
+		struct cam_isp_prepare_hw_update_data	*prepare_hw_data;
+		offline_clk_cfg = (struct cam_isp_clock_config *)blob_data;
+
+		c_ctx->offline_sfe_clk = ife_hw_mgr->offline_sfe_clk;
+		offline_clk_cfg->left_pix_hz = ife_hw_mgr->offline_sfe_clk;
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+		clock_config_size = sizeof(struct cam_isp_clock_config);
+
+		if (offline_clk_cfg->num_rdi >= 1)
+			clock_config_size += (offline_clk_cfg->num_rdi - 1) *
+				sizeof(offline_clk_cfg->rdi_hz);
+
+		CAM_DBG(CAM_ISP, "Override offline SFE clk to %u, vote rdi num %d size %d",
+			offline_clk_cfg->left_pix_hz,
+			offline_clk_cfg->num_rdi,clock_config_size);
+		memcpy(&prepare_hw_data->bw_clk_config.sfe_clock_config, offline_clk_cfg,
+			clock_config_size);
+		prepare_hw_data->bw_clk_config.sfe_clock_config_valid = true;
+	}
+
+	return rc;
+}
+
+static inline bool cam_ife_mgr_validate_for_io_buffers(
+	uint32_t port_id, uint32_t scratch_cfg_mask)
+{
+	if (BIT(port_id) & scratch_cfg_mask)
+		return true;
+
+	return false;
+}
+
+static inline bool cam_isp_sfe_validate_for_scratch_buf_config(
+	uint32_t res_idx, struct cam_ife_hw_mgr_ctx  *ctx,
+	bool default_settings)
+{
+	uint32_t curr_num_exp;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = ctx->concr_ctx;
+
+	/* check for num exposures for static mode but using RDI1-2 without RD1-2 */
+	if (res_idx >= c_ctx->scratch_buf_info.num_fetches)
+		return true;
+
+	if (default_settings)
+		curr_num_exp = c_ctx->curr_num_exp;
+	else
+		curr_num_exp = c_ctx->scratch_buf_info.sfe_scratch_config->updated_num_exp;
+
+	/* check for num exposures for dynamic mode */
+	if ((c_ctx->ctx_config &
+		CAM_IFE_CTX_CFG_DYNAMIC_SWITCH_ON) &&
+		(res_idx >= curr_num_exp))
+		return true;
+
+	return false;
+}
+
+static int cam_isp_sfe_send_scratch_buf_upd(
+	uint32_t                             remaining_size,
+	enum cam_isp_hw_cmd_type             cmd_type,
+	struct cam_isp_resource_node        *hw_res,
+	struct cam_ife_sfe_scratch_buf_info *buf_info,
+	uint32_t                            *cpu_addr,
+	uint32_t                            *used_bytes)
+{
+	int rc, i;
+	struct cam_isp_hw_get_cmd_update   update_buf;
+	struct cam_isp_hw_get_wm_update    wm_update;
+	dma_addr_t                         io_addr[CAM_PACKET_MAX_PLANES];
+
+	update_buf.res = hw_res;
+	update_buf.cmd_type = cmd_type;
+	update_buf.cmd.cmd_buf_addr = cpu_addr;
+	update_buf.use_scratch_cfg = true;
+
+	wm_update.num_buf = 1;
+	/*
+	 * Update same scratch buffer for different planes,
+	 * when used for IFE clients, same scratch buffer
+	 * is configured to both per plane clients
+	 */
+	for (i = 0; i < CAM_PACKET_MAX_PLANES; i++)
+		io_addr[i] = buf_info->io_addr;
+
+	wm_update.image_buf = io_addr;
+	wm_update.width = buf_info->width;
+	wm_update.height = buf_info->height;
+	wm_update.stride = buf_info->stride;
+	wm_update.slice_height = buf_info->slice_height;
+	wm_update.io_cfg = NULL;
+
+	update_buf.wm_update = &wm_update;
+	update_buf.cmd.size = remaining_size;
+
+	rc = hw_res->hw_intf->hw_ops.process_cmd(
+		hw_res->hw_intf->hw_priv,
+		cmd_type, &update_buf,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to send cmd: %u res: %u rc: %d",
+			cmd_type, hw_res->res_id, rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_ISP, "Scratch buf configured for res: 0x%x",
+		hw_res->res_id);
+
+	/* Update used bytes if update is via CDM */
+	if ((cmd_type == CAM_ISP_HW_CMD_GET_BUF_UPDATE) ||
+		(cmd_type == CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM))
+		*used_bytes = update_buf.cmd.used_bytes;
+
+	return rc;
+}
+
+static int cam_isp_sfe_add_scratch_buffer_cfg(
+	uint32_t                              base_idx,
+	uint32_t                              sfe_rdi_cfg_mask,
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	struct cam_isp_hw_mgr_res            *res_list_isp_out,
+	struct list_head                     *res_list_in_rd,
+	struct cam_ife_hw_mgr_ctx            *ctx)
+{
+	int i, j, res_id, rc = 0;
+	uint32_t used_bytes = 0, remain_size = 0;
+	uint32_t io_cfg_used_bytes;
+	uint32_t *cpu_addr = NULL;
+	struct cam_ife_sfe_scratch_buf_info *buf_info;
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = ctx->concr_ctx;
+
+	if (prepare->num_hw_update_entries + 1 >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d, ctx_idx: %u",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	io_cfg_used_bytes = 0;
+	CAM_DBG(CAM_ISP, "ctx_idx: %u num_ports: %u",
+		c_ctx->ctx_index, c_ctx->scratch_buf_info.sfe_scratch_config->num_config);
+
+	/* Update RDI WMs */
+	for (i = 0; i < CAM_SFE_FE_RDI_NUM_MAX; i++) {
+		if (c_ctx->sfe_out_map[i] == 0xff)
+			continue;
+		hw_mgr_res = &res_list_isp_out[c_ctx->sfe_out_map[i]];
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			if ((kmd_buf_info->used_bytes + io_cfg_used_bytes) <
+				kmd_buf_info->size) {
+				remain_size = kmd_buf_info->size -
+					(kmd_buf_info->used_bytes +
+					io_cfg_used_bytes);
+			} else {
+				CAM_ERR(CAM_ISP,
+					"no free kmd memory for base %d, ctx_idx: %u",
+					base_idx, c_ctx->ctx_index);
+				rc = -ENOMEM;
+				return rc;
+			}
+
+			res_id = hw_mgr_res->hw_res[j]->res_id;
+
+			if (cam_isp_sfe_validate_for_scratch_buf_config(
+				(res_id - CAM_ISP_SFE_OUT_RES_RDI_0), ctx, false))
+				continue;
+
+			/* check if buffer provided for this RDI is from userspace */
+			if (cam_ife_mgr_validate_for_io_buffers(
+				(res_id - CAM_ISP_SFE_OUT_RES_RDI_0), sfe_rdi_cfg_mask))
+				continue;
+
+			cpu_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes / 4 + io_cfg_used_bytes / 4;
+			buf_info = &c_ctx->scratch_buf_info.sfe_scratch_config->buf_info[
+				res_id - CAM_ISP_SFE_OUT_RES_RDI_0];
+
+			/* Check if scratch available for this resource */
+			if (!buf_info->config_done) {
+				CAM_ERR(CAM_ISP,
+					"No scratch buffer config found for res: %u on ctx: %u",
+					res_id, c_ctx->ctx_index);
+				return -EFAULT;
+			}
+
+			CAM_DBG(CAM_ISP, "WM res_id: 0x%x idx: %u io_addr: %pK, ctx_idx: %u",
+				hw_mgr_res->hw_res[j]->res_id,
+				(res_id - CAM_ISP_SFE_OUT_RES_RDI_0),
+				buf_info->io_addr, c_ctx->ctx_index);
+
+			rc = cam_isp_sfe_send_scratch_buf_upd(
+				remain_size,
+				CAM_ISP_HW_CMD_GET_BUF_UPDATE,
+				hw_mgr_res->hw_res[j], buf_info,
+				cpu_addr, &used_bytes);
+			if (rc)
+				return rc;
+
+			io_cfg_used_bytes += used_bytes;
+		}
+	}
+
+	/* Update RDI RMs */
+	list_for_each_entry(hw_mgr_res, res_list_in_rd, list) {
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			if ((kmd_buf_info->used_bytes + io_cfg_used_bytes) <
+				kmd_buf_info->size) {
+				remain_size = kmd_buf_info->size -
+					(kmd_buf_info->used_bytes +
+					io_cfg_used_bytes);
+			} else {
+				CAM_ERR(CAM_ISP,
+					"no free kmd memory for base %d, ctx_idx: %u",
+					base_idx, c_ctx->ctx_index);
+				rc = -ENOMEM;
+				return rc;
+			}
+
+			res_id = hw_mgr_res->hw_res[j]->res_id;
+
+			if (cam_isp_sfe_validate_for_scratch_buf_config(
+				(res_id - CAM_ISP_SFE_IN_RD_0), ctx, false))
+				continue;
+
+			/* check if buffer provided for this RM is from userspace */
+			if (cam_ife_mgr_validate_for_io_buffers(
+				(res_id - CAM_ISP_SFE_IN_RD_0), sfe_rdi_cfg_mask))
+				continue;
+
+			cpu_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes  / 4 +
+				io_cfg_used_bytes / 4;
+			buf_info = &c_ctx->scratch_buf_info.sfe_scratch_config->buf_info[
+				res_id - CAM_ISP_SFE_IN_RD_0];
+
+			CAM_DBG(CAM_ISP, "RM res_id: 0x%x idx: %u io_addr: %pK, ctx_idx: %u",
+				hw_mgr_res->hw_res[j]->res_id,
+				(res_id - CAM_ISP_SFE_IN_RD_0),
+				buf_info->io_addr, c_ctx->ctx_index);
+
+			rc = cam_isp_sfe_send_scratch_buf_upd(remain_size,
+				CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM,
+				hw_mgr_res->hw_res[j], buf_info,
+				cpu_addr, &used_bytes);
+			if (rc)
+				return rc;
+
+			io_cfg_used_bytes += used_bytes;
+		}
+	}
+
+	if (io_cfg_used_bytes)
+		cam_ife_mgr_update_hw_entries_util(
+			CAM_ISP_IOCFG_BL, io_cfg_used_bytes,
+			kmd_buf_info, prepare, false);
+
+	return rc;
+}
+
+static int cam_isp_ife_add_scratch_buffer_cfg(
+	uint32_t                              base_idx,
+	uint32_t                              scratch_cfg_mask,
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	struct cam_ife_hw_mgr_ctx            *ctx)
+{
+	int i, j, res_id, rc = 0;
+	uint32_t used_bytes = 0, remain_size = 0, io_cfg_used_bytes;
+	uint32_t *cpu_addr = NULL;
+	struct cam_ife_sfe_scratch_buf_info *buf_info;
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d, ctx_idx: %u",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	io_cfg_used_bytes = 0;
+
+	/* Update scratch buffer for IFE WMs */
+	for (i = 0; i < c_ctx->scratch_buf_info.ife_scratch_config->num_config; i++) {
+		/*
+		 * Configure scratch only if the bit mask is not set for the given port,
+		 * this is determined after parsing all the IO config buffers
+		 */
+		if (cam_ife_mgr_validate_for_io_buffers(i, scratch_cfg_mask))
+			continue;
+
+		res_id = c_ctx->scratch_buf_info.ife_scratch_config->buf_info[i].res_id & 0xFF;
+
+		hw_mgr_res = &c_ctx->res_list_ife_out[c_ctx->vfe_out_map[res_id]];
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			if ((kmd_buf_info->used_bytes + io_cfg_used_bytes) <
+				kmd_buf_info->size) {
+				remain_size = kmd_buf_info->size -
+				(kmd_buf_info->used_bytes +
+					io_cfg_used_bytes);
+			} else {
+				CAM_ERR(CAM_ISP,
+					"no free kmd memory for base %u, ctx_idx: %u",
+					base_idx, c_ctx->ctx_index);
+				rc = -ENOMEM;
+				return rc;
+			}
+
+			cpu_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes / 4 + io_cfg_used_bytes / 4;
+			buf_info = &c_ctx->scratch_buf_info.ife_scratch_config->buf_info[i];
+			CAM_DBG(CAM_ISP, "WM res_id: 0x%x io_addr: %pK, ctx_idx: %u",
+				hw_mgr_res->hw_res[j]->res_id, buf_info->io_addr, c_ctx->ctx_index);
+
+			rc = cam_isp_sfe_send_scratch_buf_upd(
+				remain_size,
+				CAM_ISP_HW_CMD_GET_BUF_UPDATE,
+				hw_mgr_res->hw_res[j], buf_info,
+				cpu_addr, &used_bytes);
+			if (rc)
+				return rc;
+
+			io_cfg_used_bytes += used_bytes;
+		}
+	}
+
+	if (io_cfg_used_bytes)
+		cam_ife_mgr_update_hw_entries_util(
+			CAM_ISP_IOCFG_BL, io_cfg_used_bytes,
+			kmd_buf_info, prepare, false);
+
+	return rc;
+}
+
+static int cam_ife_mgr_csid_add_reg_update(struct cam_ife_hw_mgr_ctx *ctx,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_kmd_buf_info *kmd_buf)
+{
+	int                                     i;
+	int                                     rc = 0;
+	uint32_t                                hw_idx;
+	struct cam_ife_hw_concrete_ctx         *c_ctx = ctx->concr_ctx;
+	struct cam_ife_hw_mgr                  *hw_mgr;
+	struct cam_isp_hw_mgr_res              *hw_mgr_res;
+	struct cam_ife_csid_hw_caps            *csid_caps;
+	struct cam_isp_resource_node           *res;
+	struct cam_isp_prepare_hw_update_data  *prepare_hw_data = NULL;
+	struct cam_isp_change_base_args         change_base_info = {0};
+	struct cam_isp_csid_reg_update_args
+			rup_args[CAM_IFE_CSID_HW_NUM_MAX]  = {0};
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+		prepare->priv;
+
+	hw_mgr = c_ctx->hw_mgr;
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			hw_idx = res->hw_intf->hw_idx;
+			csid_caps = &hw_mgr->csid_hw_caps[hw_idx];
+
+			if (i == CAM_ISP_HW_SPLIT_RIGHT &&
+				csid_caps->only_master_rup)
+				continue;
+
+			rup_args[hw_idx].res[rup_args[hw_idx].num_res] = res;
+			rup_args[hw_idx].num_res++;
+			rup_args[hw_idx].mup_en = prepare_hw_data->mup_en;
+			rup_args[hw_idx].mup_val = prepare_hw_data->mup_val;
+
+			CAM_DBG(CAM_ISP,
+				"Reg update queued for res %d hw_id %d, ctx_idx: %u",
+				res->res_id, res->hw_intf->hw_idx, c_ctx->ctx_index);
+		}
+	}
+
+	for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		if (!rup_args[i].num_res)
+			continue;
+
+		change_base_info.base_idx = i;
+		change_base_info.cdm_id = c_ctx->cdm_id;
+		rc = cam_isp_add_change_base(prepare,
+			&c_ctx->res_list_ife_csid,
+			&change_base_info, kmd_buf);
+
+		CAM_DBG(CAM_ISP, "Ctx:%u Change base added for num_res %d",
+			c_ctx->ctx_index, rup_args[i].num_res);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Change base Failed Ctx:%u hw_idx=%d, rc=%d",
+				c_ctx->ctx_index, i, rc);
+			break;
+		}
+
+		rc = cam_isp_add_csid_reg_update(prepare, kmd_buf,
+			&rup_args[i], true);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Ctx:%u Reg Update failed idx:%u",
+				c_ctx->ctx_index, i);
+			break;
+		}
+
+		CAM_DBG(CAM_ISP, "Ctx:%u Reg update added id:%d num_res %d",
+			c_ctx->ctx_index, i, rup_args[i].num_res);
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_isp_add_reg_update(struct cam_ife_hw_mgr_ctx *ctx,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_kmd_buf_info *kmd_buf)
+{
+	int i;
+	int rc = 0;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ctx->concr_ctx;
+	struct cam_isp_change_base_args   change_base_info = {0};
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+
+		change_base_info.base_idx = c_ctx->base[i].idx;
+		change_base_info.cdm_id = c_ctx->cdm_id;
+
+		/* Add change base */
+		if (!c_ctx->flags.internal_cdm) {
+			rc = cam_isp_add_change_base(prepare,
+				&c_ctx->res_list_ife_src,
+				&change_base_info, kmd_buf);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Add Change base cmd Failed i=%d, idx=%d, rc=%d ctx_idx: %u",
+					i, c_ctx->base[i].idx, rc, c_ctx->ctx_index);
+				break;
+			}
+
+			CAM_DBG(CAM_ISP,
+				"Add Change base cmd i=%d, idx=%d, rc=%d ctx_idx: %u",
+				i, c_ctx->base[i].idx, rc, c_ctx->ctx_index);
+		}
+
+		rc = cam_isp_add_reg_update(prepare,
+			&c_ctx->res_list_ife_src,
+			c_ctx->base[i].idx, kmd_buf,
+			!c_ctx->flags.internal_cdm, NULL);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Add Reg Update cmd Failed i=%d, idx=%d, rc=%d ctx_idx: %u",
+				i, c_ctx->base[i].idx, rc, c_ctx->ctx_index);
+			break;
+		}
+
+		CAM_DBG(CAM_ISP,
+			"Add Reg Update cmd i=%d, idx=%d, rc=%d ctx_idx: %u",
+			i, c_ctx->base[i].idx, rc, c_ctx->ctx_index);
+	}
+	return rc;
+}
+
+static int cam_ife_hw_mgr_add_csid_go_cmd(
+	struct cam_ife_hw_mgr_ctx            *ctx,
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_kmd_buf_info              *kmd_buf_info)
+{
+	int rc = -EINVAL, i;
+	bool is_found = false;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_change_base_args   change_base_info = {0};
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ctx->concr_ctx;
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if (i == CAM_ISP_HW_SPLIT_RIGHT) {
+				CAM_ERR(CAM_ISP,
+					"Offline with right rsrc [%u] not supported ctx: %u",
+					hw_mgr_res->hw_res[i]->res_id, c_ctx->ctx_index);
+				return -EINVAL;
+			}
+
+			is_found = true;
+			goto add_cmds;
+		}
+	}
+
+add_cmds:
+
+	if (is_found) {
+		change_base_info.base_idx = hw_mgr_res->hw_res[i]->hw_intf->hw_idx;
+		change_base_info.cdm_id = c_ctx->cdm_id;
+
+		rc = cam_isp_add_change_base(prepare,
+			&c_ctx->res_list_ife_csid,
+			&change_base_info, kmd_buf_info);
+		if (rc)
+			return rc;
+
+		rc = cam_isp_add_csid_offline_cmd(prepare,
+			hw_mgr_res->hw_res[i], kmd_buf_info, true);
+		if (rc)
+			return rc;
+
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_add_vfe_go_cmd(
+	struct cam_ife_hw_mgr_ctx            *ctx,
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_kmd_buf_info              *kmd_buf_info)
+{
+	int rc = -EINVAL, i;
+	bool is_found = false;
+	struct cam_isp_hw_mgr_res         *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx    *c_ctx = ctx->concr_ctx;
+	struct cam_isp_change_base_args    change_base_info = {0};
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_in_rd, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if (i == CAM_ISP_HW_SPLIT_RIGHT) {
+				CAM_ERR(CAM_ISP,
+					"Offline with right rsrc [%u] not supported ctx: %u",
+					hw_mgr_res->hw_res[i]->res_id, c_ctx->ctx_index);
+				return -EINVAL;
+			}
+
+			is_found = true;
+			goto add_cmds;
+		}
+	}
+
+add_cmds:
+
+	if (is_found) {
+		change_base_info.base_idx = hw_mgr_res->hw_res[i]->hw_intf->hw_idx;
+		change_base_info.cdm_id = c_ctx->cdm_id;
+
+		rc = cam_isp_add_change_base(prepare, &c_ctx->res_list_ife_src,
+			&change_base_info, kmd_buf_info);
+		if (rc)
+			return rc;
+
+		rc = cam_isp_add_go_cmd(prepare, hw_mgr_res->hw_res[i], kmd_buf_info, true);
+		if (rc)
+			return rc;
+
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_add_fcg_update(
+	struct cam_hw_prepare_update_args       *prepare,
+	struct cam_kmd_buf_info                 *kmd_buf_info,
+	struct cam_isp_fcg_config_internal      *fcg_args_internal,
+	bool                                    *fcg_online,
+	uint32_t                                *fcg_entry_idx,
+	struct list_head                        *res_list_isp_src)
+{
+	uint32_t                                 fcg_kmd_size, num_ent, i;
+	struct cam_isp_hw_mgr_res               *hw_mgr_res;
+	struct cam_isp_resource_node            *res;
+	struct cam_isp_hw_fcg_cmd                fcg_cmd;
+	int                                      rc;
+
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+
+			fcg_cmd.res = res;
+			fcg_cmd.cmd_type = CAM_ISP_HW_CMD_FCG_CONFIG;
+			fcg_cmd.get_size_flag = true;
+			fcg_cmd.u.fcg_get_size.num_types = fcg_args_internal->num_types;
+			fcg_cmd.u.fcg_get_size.num_ctxs = fcg_args_internal->num_ch_ctx;
+			fcg_cmd.u.fcg_get_size.kmd_size = 0;
+
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_FCG_CONFIG, &fcg_cmd,
+				(uint32_t)sizeof(struct cam_isp_hw_fcg_cmd));
+			if (rc || (fcg_cmd.u.fcg_get_size.kmd_size == 0)) {
+				CAM_ERR(CAM_ISP,
+					"Failed in retrieving KMD buf size requirement, rc: %d",
+					rc);
+				return rc;
+			}
+		}
+		break;
+	}
+
+	if (!fcg_cmd.u.fcg_get_size.fcg_supported) {
+		*fcg_online = false;
+		CAM_WARN(CAM_ISP, "FCG is sent from userspace but not supported by the hardware");
+		return 0;
+	}
+
+	fcg_kmd_size = fcg_cmd.u.fcg_get_size.kmd_size * sizeof(uint32_t);
+	CAM_DBG(CAM_ISP, "KMD buf usage for FCG config is %u", fcg_kmd_size);
+
+	num_ent = prepare->num_hw_update_entries;
+	if (num_ent + 1 >= prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries: %u, %u",
+			num_ent, prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	if (fcg_kmd_size + kmd_buf_info->used_bytes >
+		kmd_buf_info->size) {
+		CAM_ERR(CAM_ISP, "Insufficient space in kmd buffer, used_bytes: %u, buf size: %u",
+			kmd_buf_info->used_bytes, kmd_buf_info->size);
+		return -ENOMEM;
+	}
+
+	*fcg_entry_idx = num_ent;
+	cam_ife_mgr_update_hw_entries_util(CAM_ISP_IQ_BL, fcg_kmd_size,
+		kmd_buf_info, prepare, false);
+
+	CAM_DBG(CAM_ISP, "FCG dummy entry, num_ent: %u, entry_size: %u",
+		num_ent, fcg_kmd_size);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_update_cmd_buffer(
+	struct cam_ife_hw_mgr_ctx               *ctx,
+	struct cam_hw_prepare_update_args       *prepare,
+	struct cam_kmd_buf_info                 *kmd_buf,
+	struct cam_isp_cmd_buf_count            *cmd_buf_count,
+	uint32_t                                 base_idx)
+{
+	struct list_head                      *res_list = NULL;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+	struct cam_isp_change_base_args       change_base_info = {0};
+	struct cam_isp_prepare_hw_update_data *prepare_hw_data;
+	struct cam_isp_fcg_config_info        *fcg_info;
+	int                                   rc = 0;
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data *)prepare->priv;
+
+	if (c_ctx->base[base_idx].hw_type == CAM_ISP_HW_TYPE_SFE) {
+		res_list = &c_ctx->res_list_sfe_src;
+	} else if (c_ctx->base[base_idx].hw_type == CAM_ISP_HW_TYPE_VFE) {
+		res_list = &c_ctx->res_list_ife_src;
+	} else if (c_ctx->base[base_idx].hw_type == CAM_ISP_HW_TYPE_CSID) {
+		if (!cmd_buf_count->csid_cnt && !prepare_hw_data->irq_comp_cfg_valid)
+			return rc;
+		res_list = &c_ctx->res_list_ife_csid;
+	} else {
+		CAM_ERR(CAM_ISP,
+			"Invalid hw_type=%d, ctx_idx: %u",
+			c_ctx->base[base_idx].hw_type, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	if (!c_ctx->flags.internal_cdm) {
+		change_base_info.base_idx = c_ctx->base[base_idx].idx;
+		change_base_info.cdm_id = c_ctx->cdm_id;
+		rc = cam_isp_add_change_base(prepare,
+			res_list,
+			&change_base_info, kmd_buf);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed change base, i=%d, split_id=%d, hw_type=%d ctx_idx: %u",
+				base_idx, c_ctx->base[base_idx].split_id,
+				c_ctx->base[base_idx].hw_type, c_ctx->ctx_index);
+			return rc;
+		}
+
+		CAM_DBG(CAM_ISP,
+			"changing the base hw_type: %u core_id: %u CDM ID: %d ctx_idx: %u",
+			c_ctx->base[base_idx].hw_type, c_ctx->base[base_idx].idx,
+			c_ctx->cdm_id, c_ctx->ctx_index);
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Add cmdbuf, i=%d, split_id=%d, hw_type=%d ctx_idx: %u",
+		base_idx, c_ctx->base[base_idx].split_id,
+		c_ctx->base[base_idx].hw_type, c_ctx->ctx_index);
+
+	fcg_info = &(prepare_hw_data->fcg_info);
+
+	if (c_ctx->base[base_idx].hw_type == CAM_ISP_HW_TYPE_SFE) {
+		rc = cam_sfe_add_command_buffers(
+			prepare, kmd_buf, &c_ctx->base[base_idx],
+			cam_sfe_packet_generic_blob_handler,
+			c_ctx->res_list_sfe_out,
+			c_ctx->sfe_out_map,
+			CAM_ISP_SFE_OUT_RES_BASE,
+			(CAM_ISP_SFE_OUT_RES_BASE +
+			max_sfe_out_res));
+		if (rc)
+			goto add_cmd_err;
+
+		/* No need to handle FCG entry if no valid fcg config from userspace */
+		if (!fcg_info->sfe_fcg_online)
+			goto end;
+
+		rc = cam_ife_hw_mgr_add_fcg_update(
+			prepare, kmd_buf,
+			&fcg_info->sfe_fcg_config,
+			&fcg_info->sfe_fcg_online,
+			&fcg_info->sfe_fcg_entry_idx,
+			res_list);
+		if (rc)
+			goto add_cmd_err;
+	} else if (c_ctx->base[base_idx].hw_type == CAM_ISP_HW_TYPE_VFE) {
+		rc = cam_isp_add_command_buffers(
+			prepare, kmd_buf, &c_ctx->base[base_idx],
+			cam_isp_packet_generic_blob_handler,
+			c_ctx->res_list_ife_out,
+			c_ctx->vfe_out_map,
+			CAM_ISP_IFE_OUT_RES_BASE,
+			(CAM_ISP_IFE_OUT_RES_BASE +
+			max_ife_out_res));
+		if (rc)
+			goto add_cmd_err;
+
+		/* No need to handle FCG entry if no valid fcg config from userspace */
+		if (!fcg_info->ife_fcg_online)
+			goto end;
+
+		rc = cam_ife_hw_mgr_add_fcg_update(
+			prepare, kmd_buf,
+			&fcg_info->ife_fcg_config,
+			&fcg_info->ife_fcg_online,
+			&fcg_info->ife_fcg_entry_idx,
+			res_list);
+		if (rc)
+			goto add_cmd_err;
+	} else if (c_ctx->base[base_idx].hw_type == CAM_ISP_HW_TYPE_CSID) {
+		rc = cam_isp_add_csid_command_buffers(prepare,
+			kmd_buf, cam_csid_packet_generic_blob_handler,
+			&c_ctx->base[base_idx]);
+		if (rc)
+			goto add_cmd_err;
+	}
+
+	return rc;
+
+add_cmd_err:
+	CAM_ERR(CAM_ISP,
+		"Failed in add cmdbuf, i=%d, split_id=%d, rc=%d hw_type=%d ctx_idx: %u",
+		base_idx, c_ctx->base[base_idx].split_id, rc,
+		c_ctx->base[base_idx].hw_type, c_ctx->ctx_index);
+end:
+	return rc;
+}
+
+static void cam_ife_hw_mgr_check_if_scratch_is_needed(
+	struct cam_ife_hw_mgr_ctx               *ctx,
+	struct cam_isp_check_io_cfg_for_scratch *check_for_scratch)
+{
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ctx->concr_ctx;
+
+	/* Validate for scratch buffer use-cases sHDR/FS */
+	if (!((c_ctx->flags.is_sfe_fs) || (c_ctx->flags.is_sfe_shdr)))
+		return;
+
+	/* For SFE use number of fetches = number of scratch buffers needed */
+	check_for_scratch->sfe_scratch_res_info.num_active_fe_rdis =
+		c_ctx->scratch_buf_info.num_fetches;
+	check_for_scratch->validate_for_sfe = true;
+
+	/* Check if IFE has any scratch buffer */
+	if (c_ctx->scratch_buf_info.ife_scratch_config->num_config) {
+		int i;
+
+		check_for_scratch->validate_for_ife = true;
+		for (i = 0; i < c_ctx->scratch_buf_info.ife_scratch_config->num_config; i++) {
+			check_for_scratch->ife_scratch_res_info.ife_scratch_resources[i] =
+				c_ctx->scratch_buf_info.ife_scratch_config->buf_info[i].res_id;
+			check_for_scratch->ife_scratch_res_info.num_ports++;
+		}
+	}
+}
+
+static int cam_ife_hw_mgr_sfe_scratch_buf_update(
+	int32_t                                  opcode_type,
+	uint32_t                                 base_idx,
+	struct cam_kmd_buf_info                 *kmd_buf,
+	struct cam_hw_prepare_update_args       *prepare,
+	struct cam_ife_hw_mgr_ctx               *ctx,
+	struct cam_isp_sfe_scratch_buf_res_info *sfe_res_info)
+{
+	int rc = 0;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ctx->concr_ctx;
+
+	/* If there are no output provided buffers */
+	if ((sfe_res_info->sfe_rdi_cfg_mask) !=
+		((1 << c_ctx->scratch_buf_info.num_fetches) - 1)) {
+		/* For update packets add scratch buffer */
+		if (opcode_type == CAM_ISP_PACKET_UPDATE_DEV) {
+			CAM_DBG(CAM_ISP,
+				"Adding SFE scratch buffer cfg_mask expected: 0x%x actual: 0x%x ctx_idx: %u",
+				((1 << c_ctx->scratch_buf_info.num_fetches) - 1),
+				sfe_res_info->sfe_rdi_cfg_mask, c_ctx->ctx_index);
+			rc = cam_isp_sfe_add_scratch_buffer_cfg(
+				c_ctx->base[base_idx].idx, sfe_res_info->sfe_rdi_cfg_mask,
+				prepare, kmd_buf, c_ctx->res_list_sfe_out,
+				&c_ctx->res_list_ife_in_rd, ctx);
+			if (rc)
+				goto end;
+		} else if (opcode_type == CAM_ISP_PACKET_INIT_DEV) {
+			/* For INIT packets update mask which is applied at streamon */
+			c_ctx->scratch_buf_info.sfe_scratch_config->streamon_buf_mask =
+				sfe_res_info->sfe_rdi_cfg_mask;
+		}
+	} else {
+		/* If buffers are provided for ePCR skip scratch buffer at stream on */
+		if (opcode_type == CAM_ISP_PACKET_INIT_DEV)
+			c_ctx->scratch_buf_info.sfe_scratch_config->skip_scratch_cfg_streamon
+				= true;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_ife_scratch_buf_update(
+	int32_t                                  opcode_type,
+	uint32_t                                 base_idx,
+	struct cam_kmd_buf_info                 *kmd_buf,
+	struct cam_hw_prepare_update_args       *prepare,
+	struct cam_ife_hw_mgr_ctx               *ctx,
+	struct cam_isp_ife_scratch_buf_res_info *ife_res_info)
+{
+	int rc = 0;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ctx->concr_ctx;
+
+	if ((ife_res_info->ife_scratch_cfg_mask) !=
+		((1 << ife_res_info->num_ports) - 1)) {
+		if (opcode_type == CAM_ISP_PACKET_UPDATE_DEV) {
+			CAM_DBG(CAM_ISP,
+				"Adding IFE scratch buffer cfg_mask expected: 0x%x actual: 0x%x ctx_idx: %u",
+				((1 << ife_res_info->num_ports) - 1),
+				ife_res_info->ife_scratch_cfg_mask, c_ctx->ctx_index);
+			rc = cam_isp_ife_add_scratch_buffer_cfg(
+				c_ctx->base[base_idx].idx,
+				ife_res_info->ife_scratch_cfg_mask, prepare,
+				kmd_buf, ctx);
+			if (rc)
+				goto end;
+		} else if (opcode_type == CAM_ISP_PACKET_INIT_DEV) {
+			c_ctx->scratch_buf_info.ife_scratch_config->streamon_buf_mask =
+				ife_res_info->ife_scratch_cfg_mask;
+		}
+	} else {
+		if (opcode_type == CAM_ISP_PACKET_INIT_DEV)
+			c_ctx->scratch_buf_info.ife_scratch_config->skip_scratch_cfg_streamon
+				= true;
+	}
+
+end:
+	return rc;
+}
+
+static void cam_ife_mgr_check_for_per_request_reg_dump(
+	struct cam_hw_prepare_update_args       *prepare,
+	struct cam_isp_prepare_hw_update_data   *prepare_hw_data)
+{
+	int i;
+
+	if ((!prepare->num_reg_dump_buf) || (prepare->num_reg_dump_buf >
+		CAM_REG_DUMP_MAX_BUF_ENTRIES)) {
+		CAM_DBG(CAM_ISP, "Invalid num of reg dump desc: %u for req: %llu",
+			prepare->num_reg_dump_buf, prepare->packet->header.request_id);
+		return;
+	}
+
+	for (i = 0; i < prepare->num_reg_dump_buf; i++) {
+		if (prepare->reg_dump_buf_desc[i].meta_data !=
+			CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST)
+			continue;
+
+		memcpy(&prepare_hw_data->reg_dump_buf_desc[
+			prepare_hw_data->num_reg_dump_buf],
+			&prepare->reg_dump_buf_desc[i],
+			sizeof(struct cam_cmd_buf_desc));
+		prepare_hw_data->num_reg_dump_buf++;
+		CAM_DBG(CAM_ISP, "Updated per request reg dump for req: %llu",
+			prepare->packet->header.request_id);
+		return;
+	}
+}
+
+int cam_ife_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int rc = 0;
+	struct cam_hw_prepare_update_args *prepare =
+		(struct cam_hw_prepare_update_args *) prepare_hw_update_args;
+
+	struct cam_ife_hw_concrete_ctx          *c_ctx;
+	struct cam_ife_hw_mgr_ctx               *ife_mgr_ctx;
+	struct cam_ife_hw_mgr                   *hw_mgr;
+	uint32_t                                 i;
+	bool                                     fill_ife_fence = true;
+	bool                                     fill_sfe_fence = true;
+	bool                                     frame_header_enable = false;
+	struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+	struct cam_isp_frame_header_info         frame_header_info;
+	struct list_head                        *res_list_ife_rd_tmp = NULL;
+	struct cam_isp_cmd_buf_count             cmd_buf_count = {0};
+	struct cam_isp_check_io_cfg_for_scratch  check_for_scratch = {0};
+	struct cam_isp_io_buf_info               io_buf_info = {0};
+
+	if (!hw_mgr_priv || !prepare_hw_update_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)prepare->priv;
+
+	ife_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)prepare->ctxt_to_hw_map;
+	c_ctx = ife_mgr_ctx->concr_ctx;
+
+	hw_mgr = (struct cam_ife_hw_mgr *)hw_mgr_priv;
+
+	CAM_DBG(CAM_REQ, "ctx[%pK][%u] Enter for req_id %lld",
+		c_ctx, c_ctx->ctx_index, prepare->packet->header.request_id);
+
+	rc = cam_packet_util_validate_packet(prepare->packet, prepare->remain_len);
+	if (rc)
+		return rc;
+
+	/* Pre parse the packet*/
+	rc = cam_packet_util_get_kmd_buffer(prepare->packet, &prepare_hw_data->kmd_cmd_buff_info);
+	if (rc)
+		return rc;
+
+	if (c_ctx->ctx_config & CAM_IFE_CTX_CFG_FRAME_HEADER_TS) {
+		rc = cam_ife_mgr_util_insert_frame_header(&prepare_hw_data->kmd_cmd_buff_info,
+			prepare_hw_data, prepare->buf_tracker);
+		if (rc)
+			return rc;
+
+		frame_header_enable = true;
+		prepare_hw_data->frame_header_res_id = 0x0;
+	}
+
+	if (c_ctx->flags.internal_cdm)
+		rc = cam_packet_util_process_patches(prepare->packet,
+			prepare->buf_tracker, hw_mgr->mgr_common.img_iommu_hdl,
+			hw_mgr->mgr_common.img_iommu_hdl_secure, true);
+	else
+		rc = cam_packet_util_process_patches(prepare->packet,
+			prepare->buf_tracker, hw_mgr->mgr_common.cmd_iommu_hdl,
+			hw_mgr->mgr_common.cmd_iommu_hdl_secure, true);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Patch ISP packet failed. ctx_idx: %u", c_ctx->ctx_index);
+		return rc;
+	}
+
+	prepare->num_hw_update_entries = 0;
+	prepare->num_in_map_entries = 0;
+	prepare->num_out_map_entries = 0;
+	prepare->num_reg_dump_buf = 0;
+	prepare_hw_data->per_port_enable = c_ctx->flags.per_port_en;
+
+	if (ife_mgr_ctx->virtual_rdi_mapping_cb) {
+		prepare_hw_data->virtual_rdi_mapping_cb =
+			ife_mgr_ctx->virtual_rdi_mapping_cb;
+	}
+
+	/* Assign IFE RD for non SFE targets */
+	if (c_ctx->ctx_type != CAM_IFE_CTX_TYPE_SFE)
+		res_list_ife_rd_tmp = &c_ctx->res_list_ife_in_rd;
+
+	rc = cam_isp_get_cmd_buf_count(prepare, &cmd_buf_count);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Invalid cmd buffers, ctx_idx: %u", c_ctx->ctx_index);
+		return rc;
+	}
+
+	if (((prepare->packet->header.op_code + 1) & 0xF) ==
+		CAM_ISP_PACKET_INIT_DEV)
+		prepare_hw_data->packet_opcode_type = CAM_ISP_PACKET_INIT_DEV;
+	else
+		prepare_hw_data->packet_opcode_type = CAM_ISP_PACKET_UPDATE_DEV;
+
+	cam_ife_hw_mgr_check_if_scratch_is_needed(ife_mgr_ctx, &check_for_scratch);
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+
+		memset(&frame_header_info, 0,
+			sizeof(struct cam_isp_frame_header_info));
+		if (frame_header_enable) {
+			frame_header_info.frame_header_enable = true;
+			frame_header_info.frame_header_iova_addr =
+				prepare_hw_data->frame_header_iova;
+		}
+
+		rc = cam_ife_hw_mgr_update_cmd_buffer(ife_mgr_ctx, prepare,
+			&prepare_hw_data->kmd_cmd_buff_info, &cmd_buf_count, i);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Add cmd buffer failed base_idx: %d hw_type %d ctx_idx: %u",
+				i, c_ctx->base[i].hw_type, c_ctx->ctx_index);
+			goto end;
+		}
+
+		/* get IO buffers */
+		io_buf_info.frame_hdr = &frame_header_info;
+		io_buf_info.scratch_check_cfg = &check_for_scratch;
+		io_buf_info.prepare = prepare;
+		io_buf_info.kmd_buf_info = &prepare_hw_data->kmd_cmd_buff_info;
+		io_buf_info.iommu_hdl = hw_mgr->mgr_common.img_iommu_hdl;
+		io_buf_info.sec_iommu_hdl = hw_mgr->mgr_common.img_iommu_hdl_secure;
+		io_buf_info.base = &c_ctx->base[i];
+		io_buf_info.hw_intf = cam_ife_hw_mgr_get_hw_intf(&c_ctx->base[i]);
+		io_buf_info.unpacker_fmt = ife_mgr_ctx->unpacker_fmt;
+		io_buf_info.major_version  = c_ctx->major_version;
+
+		if (c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_VFE) {
+			io_buf_info.fill_fence = fill_ife_fence;
+			io_buf_info.out_base = CAM_ISP_IFE_OUT_RES_BASE;
+			io_buf_info.out_max = (CAM_ISP_IFE_OUT_RES_BASE + max_ife_out_res);
+			io_buf_info.res_list_isp_out = c_ctx->res_list_ife_out;
+			io_buf_info.out_map = c_ctx->vfe_out_map;
+			io_buf_info.res_list_in_rd = res_list_ife_rd_tmp;
+			rc = cam_isp_add_io_buffers(&io_buf_info);
+		} else if (c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_SFE) {
+			io_buf_info.fill_fence = fill_sfe_fence;
+			io_buf_info.out_base = CAM_ISP_SFE_OUT_RES_BASE;
+			io_buf_info.out_max = (CAM_ISP_SFE_OUT_RES_BASE + max_sfe_out_res);
+			io_buf_info.res_list_in_rd = &c_ctx->res_list_ife_in_rd;
+			io_buf_info.res_list_isp_out = c_ctx->res_list_sfe_out;
+			io_buf_info.out_map = c_ctx->sfe_out_map;
+			rc = cam_isp_add_io_buffers(&io_buf_info);
+		}
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in io buffers, i=%d, rc=%d hw_type=%s ctx_idx: %u",
+				i, rc,
+				(c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_SFE ? "SFE" : "IFE"),
+				c_ctx->ctx_index);
+			goto end;
+		}
+
+		/*
+		 * Add scratch buffer if there no output buffer for SFE/IFE clients
+		 * only for UPDATE packets. For INIT we could have ePCR enabled
+		 * based on that decide to configure scratch via AHB at
+		 * stream on or not. It's possible that in ePCR one HW could
+		 * have buffers and the other might not. Handle different
+		 * combinations for different HWs
+		 */
+		if ((check_for_scratch.validate_for_sfe) &&
+			(c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_SFE) && (fill_sfe_fence)) {
+			struct cam_isp_sfe_scratch_buf_res_info *sfe_res_info =
+				&check_for_scratch.sfe_scratch_res_info;
+
+			rc = cam_ife_hw_mgr_sfe_scratch_buf_update(
+				prepare_hw_data->packet_opcode_type,
+				i, &prepare_hw_data->kmd_cmd_buff_info, prepare,
+				ife_mgr_ctx, sfe_res_info);
+			if (rc)
+				goto end;
+		}
+
+		if ((check_for_scratch.validate_for_ife) &&
+			(c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_VFE) && (fill_ife_fence)) {
+			struct cam_isp_ife_scratch_buf_res_info *ife_res_info =
+				&check_for_scratch.ife_scratch_res_info;
+
+			rc = cam_ife_hw_mgr_ife_scratch_buf_update(
+				prepare_hw_data->packet_opcode_type,
+				i, &prepare_hw_data->kmd_cmd_buff_info, prepare,
+				ife_mgr_ctx, ife_res_info);
+			if (rc)
+				goto end;
+		}
+
+		/* fence map table entries need to fill only once in the loop */
+		if ((c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_SFE) && fill_sfe_fence)
+			fill_sfe_fence = false;
+		else if ((c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_VFE) && fill_ife_fence)
+			fill_ife_fence = false;
+
+		if (frame_header_info.frame_header_res_id &&
+			frame_header_enable) {
+			frame_header_enable = false;
+			prepare_hw_data->frame_header_res_id =
+				frame_header_info.frame_header_res_id;
+
+			CAM_DBG(CAM_ISP,
+				"Frame header enabled for res_id 0x%x cpu_addr %pK ctx_idx: %u",
+				prepare_hw_data->frame_header_res_id,
+				prepare_hw_data->frame_header_cpu_addr, c_ctx->ctx_index);
+		}
+	}
+
+	/* Check if frame header was enabled for any WM */
+	if ((c_ctx->ctx_config & CAM_IFE_CTX_CFG_FRAME_HEADER_TS) &&
+		(prepare->num_out_map_entries) &&
+		(!prepare_hw_data->frame_header_res_id)) {
+		CAM_ERR(CAM_ISP, "Failed to configure frame header, ctx_idx: %u", c_ctx->ctx_index);
+		goto end;
+	}
+
+	/*
+	 * reg update will be done later for the initial configure.
+	 * need to plus one to the op_code and only take the lower
+	 * bits to get the type of operation since UMD definition
+	 * of op_code has some difference from KMD.
+	 */
+	if ((prepare_hw_data->packet_opcode_type ==
+		CAM_ISP_PACKET_INIT_DEV) && (!c_ctx->flags.is_offline ||
+		atomic_read(&c_ctx->ctx_state) == CAM_IFE_HW_STATE_STARTING)) {
+
+		if ((!prepare->num_reg_dump_buf) || (prepare->num_reg_dump_buf >
+			CAM_REG_DUMP_MAX_BUF_ENTRIES))
+			goto offline;
+
+		/* Copy reg dump buf desc for error/flush cases */
+		if (!c_ctx->num_reg_dump_buf) {
+			c_ctx->num_reg_dump_buf = prepare->num_reg_dump_buf;
+
+			memcpy(c_ctx->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare->num_reg_dump_buf);
+		}
+
+		/* Per req reg dump */
+		cam_ife_mgr_check_for_per_request_reg_dump(prepare, prepare_hw_data);
+		goto offline;
+	} else {
+		cam_ife_mgr_check_for_per_request_reg_dump(prepare, prepare_hw_data);
+	}
+
+	/* add reg update commands */
+	if (hw_mgr->csid_rup_en)
+		rc = cam_ife_mgr_csid_add_reg_update(ife_mgr_ctx,
+			prepare, &prepare_hw_data->kmd_cmd_buff_info);
+
+	else
+		rc = cam_ife_mgr_isp_add_reg_update(ife_mgr_ctx,
+			prepare, &prepare_hw_data->kmd_cmd_buff_info);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Add RUP fail csid_rup_en %d, ctx_idx: %u",
+			hw_mgr->csid_rup_en, c_ctx->ctx_index);
+		goto end;
+	}
+
+offline:
+	/* add go_cmd for offline context */
+	if (prepare->num_out_map_entries &&
+		prepare->num_in_map_entries &&
+		c_ctx->flags.is_offline) {
+		if (c_ctx->ctx_type != CAM_IFE_CTX_TYPE_SFE)
+			rc = cam_ife_hw_mgr_add_vfe_go_cmd(ife_mgr_ctx, prepare,
+				&prepare_hw_data->kmd_cmd_buff_info);
+		else
+			rc = cam_ife_hw_mgr_add_csid_go_cmd(ife_mgr_ctx, prepare,
+				&prepare_hw_data->kmd_cmd_buff_info);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Add %s GO_CMD faled i: %d, idx: %d, rc: %d",
+				(c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE ?
+				"CSID" : "IFE RD"),
+				c_ctx->ctx_index, rc);
+	}
+
+	if (prepare_hw_data->kmd_cmd_buff_info.size <=
+		prepare_hw_data->kmd_cmd_buff_info.used_bytes) {
+		CAM_ERR(CAM_ISP, "No Sufficient memory for the Gen IRQ command, ctx_idx: %u",
+			c_ctx->ctx_index);
+		rc = -ENOMEM;
+	}
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_resume_hw(struct cam_ife_hw_mgr_ctx *ctx)
+{
+	return cam_ife_mgr_bw_control(ctx, CAM_ISP_BW_CONTROL_INCLUDE);
+}
+
+static int cam_ife_mgr_sof_irq_debug(
+	struct cam_ife_hw_mgr_ctx *ctx,
+	uint32_t sof_irq_enable)
+{
+	int rc = 0;
+	uint32_t i = 0, hw_idx;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res      *hw_mgr_res = NULL;
+	struct cam_isp_resource_node   *rsrc_node = NULL;
+	struct cam_ife_hw_mgr          *hw_mgr = c_ctx->hw_mgr;
+
+	/* Per CSID enablement will enable for all paths */
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].hw_type != CAM_ISP_HW_TYPE_CSID)
+			continue;
+
+		hw_idx = c_ctx->base[i].idx;
+		if (hw_mgr->csid_devices[hw_idx]) {
+			rc |= hw_mgr->csid_devices[hw_idx]->hw_ops.process_cmd(
+				hw_mgr->csid_devices[hw_idx]->hw_priv,
+				CAM_IFE_CSID_SOF_IRQ_DEBUG,
+				&sof_irq_enable, sizeof(sof_irq_enable));
+			if (rc)
+				CAM_DBG(CAM_ISP,
+					"Failed to set CSID_%u sof irq debug cfg rc: %d",
+					hw_idx, rc);
+		}
+	}
+
+	/* legacy IFE CAMIF */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rsrc_node = hw_mgr_res->hw_res[i];
+			if (rsrc_node->process_cmd && (rsrc_node->res_id ==
+				CAM_ISP_HW_VFE_IN_CAMIF)) {
+				rc |= hw_mgr_res->hw_res[i]->process_cmd(
+					hw_mgr_res->hw_res[i],
+					CAM_ISP_HW_CMD_SOF_IRQ_DEBUG,
+					&sof_irq_enable,
+					sizeof(sof_irq_enable));
+			}
+		}
+	}
+
+	return rc;
+}
+
+static inline void cam_ife_hw_mgr_stop_bus_rd_for_res(struct cam_ife_hw_mgr_ctx *ctx,
+	uint32_t res_id)
+{
+	struct cam_isp_hw_mgr_res      *isp_hw_res;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+
+	list_for_each_entry(isp_hw_res, &c_ctx->res_list_ife_in_rd, list) {
+		if (isp_hw_res->res_id == res_id) {
+			CAM_ERR(CAM_ISP, "Stopping IFE/SFE bus rd res id 0x%x, ctx_idx: %u",
+				res_id, c_ctx->ctx_index);
+			cam_ife_hw_mgr_stop_hw_res(isp_hw_res);
+			break;
+		}
+	}
+}
+
+static void cam_ife_hw_mgr_stop_pf_hw_res(struct cam_ife_hw_mgr_ctx *ctx,
+	uint32_t res_id, uint32_t hw_type)
+{
+	struct cam_isp_hw_mgr_res      *isp_hw_res;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+
+	if (hw_type == CAM_ISP_HW_TYPE_VFE) {
+		if (cam_ife_hw_mgr_is_ife_out_port(res_id)) {
+			isp_hw_res = &c_ctx->res_list_ife_out[c_ctx->vfe_out_map[res_id & 0xFF]];
+			CAM_ERR(CAM_ISP, "Stopping IFE out resource res id 0x%x ctx_idx: %u",
+				res_id, c_ctx->ctx_index);
+			cam_ife_hw_mgr_stop_hw_res(isp_hw_res);
+		} else
+			cam_ife_hw_mgr_stop_bus_rd_for_res(ctx, res_id);
+	} else if (hw_type == CAM_ISP_HW_TYPE_SFE) {
+		if (cam_ife_hw_mgr_is_sfe_out_port(res_id)) {
+			isp_hw_res = &c_ctx->res_list_sfe_out[c_ctx->sfe_out_map[res_id & 0xFF]];
+			CAM_ERR(CAM_ISP, "Stopping SFE out resource res id 0x%x ctx_idx: %u",
+				res_id, c_ctx->ctx_index);
+			cam_ife_hw_mgr_stop_hw_res(isp_hw_res);
+		} else
+			cam_ife_hw_mgr_stop_bus_rd_for_res(ctx, res_id);
+	}
+}
+
+static int cam_ife_hw_mgr_dump_bus_info(
+	uint32_t res_id,
+	struct cam_isp_hw_intf_data *hw_intf_data)
+{
+	struct cam_isp_hw_event_info event_info;
+
+	event_info.res_id = res_id;
+
+	return hw_intf_data->hw_intf->hw_ops.process_cmd(
+		hw_intf_data->hw_intf->hw_priv,
+		CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+		&event_info, sizeof(struct cam_isp_hw_event_info));
+}
+
+static void cam_ife_mgr_pf_dump(struct cam_ife_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	struct cam_hw_intf             *hw_intf;
+	int  i, rc = 0;
+
+	/* dump the registers  */
+	rc = cam_ife_mgr_handle_reg_dump(ctx, c_ctx->reg_dump_buf_desc,
+		c_ctx->num_reg_dump_buf,
+		CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR, NULL, false);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Reg dump on pf failed req id: %llu rc: %d ctx_idx: %u",
+			c_ctx->applied_req_id, rc, c_ctx->ctx_index);
+
+	/* dump the acquire data */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_IFE_CSID_LOG_ACQUIRE_DATA,
+					hw_mgr_res->hw_res[i],
+					sizeof(void *));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"csid acquire data dump failed, ctx_idx: %u",
+						c_ctx->ctx_index);
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf! ctx_idx: %u", c_ctx->ctx_index);
+		}
+	}
+}
+
+static void cam_ife_mgr_pf_dump_mid_info(
+	struct cam_ife_hw_mgr_ctx    *ctx,
+	struct cam_hw_cmd_args       *hw_cmd_args,
+	struct cam_isp_hw_intf_data  *hw_intf_data,
+	struct cam_packet            *packet)
+{
+	struct cam_isp_hw_get_cmd_update    cmd_update;
+	struct cam_isp_hw_get_res_for_mid   get_res;
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ctx->concr_ctx;
+	int                                 rc = 0;
+
+	get_res.mid = hw_cmd_args->u.pf_cmd_args->pf_args->pf_smmu_info->mid;
+	get_res.pid = hw_cmd_args->u.pf_cmd_args->pf_args->pf_smmu_info->pid;
+	cmd_update.cmd_type = CAM_ISP_HW_CMD_GET_RES_FOR_MID;
+	cmd_update.data = (void *) &get_res;
+
+	/* get resource id for given mid */
+	rc = hw_intf_data->hw_intf->hw_ops.process_cmd(hw_intf_data->hw_intf->hw_priv,
+		cmd_update.cmd_type, &cmd_update, sizeof(struct cam_isp_hw_get_cmd_update));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"getting mid port resource id failed ctx id:%u req id:%lld",
+			c_ctx->ctx_index, packet->header.request_id);
+		return;
+	}
+
+	hw_cmd_args->u.pf_cmd_args->pf_args->pf_context_info.resource_type = get_res.out_res_id;
+	c_ctx->flags.pf_mid_found = true;
+	c_ctx->pf_info.mid = get_res.mid;
+	c_ctx->pf_info.out_port_id = get_res.out_res_id;
+	CAM_ERR(CAM_ISP,
+		"Page fault on resource id:(0x%x) ctx id:%u req id:%lld",
+		get_res.out_res_id, c_ctx->ctx_index, packet->header.request_id);
+}
+
+static void cam_ife_mgr_dump_pf_data(
+	struct cam_ife_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args *hw_cmd_args)
+{
+	struct cam_ife_hw_mgr_ctx          *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx     *c_ctx;
+	struct cam_packet                  *packet;
+	struct cam_isp_hw_intf_data        *hw_intf_data;
+	struct cam_hw_dump_pf_args         *pf_args;
+	struct cam_hw_mgr_pf_request_info  *pf_req_info;
+	bool                               *ctx_found;
+	int                                 i, j, rc;
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)hw_cmd_args->ctxt_to_hw_map;
+	c_ctx = hw_mgr_ctx->concr_ctx;
+	pf_req_info = hw_cmd_args->u.pf_cmd_args->pf_req_info;
+	rc = cam_packet_util_get_packet_addr(&packet, pf_req_info->packet_handle,
+		pf_req_info->packet_offset);
+	if (rc)
+		return;
+
+	pf_args = hw_cmd_args->u.pf_cmd_args->pf_args;
+	ctx_found = &(pf_args->pf_context_info.ctx_found);
+
+	if ((*ctx_found) && (c_ctx->flags.pf_mid_found))
+		goto outportlog;
+
+	/* Determine if the current context is the faulted context based on pid */
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_VFE)
+			hw_intf_data = g_ife_hw_mgr.ife_devices[c_ctx->base[i].idx];
+		else if (c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_SFE)
+			hw_intf_data = g_ife_hw_mgr.sfe_devices[c_ctx->base[i].idx];
+		else
+			continue;
+
+		/*
+		 * Few old targets do not have support for PID, for such targets,
+		 * we need to print mid for all the bases, SFE enabled targets
+		 * are expected to have PID support.
+		 */
+		if (!g_ife_hw_mgr.hw_pid_support) {
+			if (c_ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT)
+				cam_ife_mgr_pf_dump_mid_info(hw_mgr_ctx, hw_cmd_args, hw_intf_data,
+					packet);
+			continue;
+		}
+
+		for (j = 0; j < hw_intf_data->num_hw_pid; j++) {
+			if (hw_intf_data->hw_pid[j] == pf_args->pf_smmu_info->pid) {
+				*ctx_found = true;
+				CAM_ERR(CAM_ISP, "PF found for %s%d pid: %u ctx_idx: %u",
+					c_ctx->base[i].hw_type == CAM_ISP_HW_TYPE_VFE ? "VFE" : "SFE",
+					c_ctx->base[i].idx, pf_args->pf_smmu_info->pid,
+					c_ctx->ctx_index);
+				cam_ife_mgr_pf_dump_mid_info(hw_mgr_ctx, hw_cmd_args, hw_intf_data,
+					packet);
+
+				/* If MID found - stop hw res and dump client info */
+				if (c_ctx->flags.pf_mid_found) {
+					cam_ife_hw_mgr_stop_pf_hw_res(hw_mgr_ctx,
+						c_ctx->pf_info.out_port_id, c_ctx->base[i].hw_type);
+					cam_ife_hw_mgr_dump_bus_info(c_ctx->pf_info.out_port_id,
+						hw_intf_data);
+				}
+				break;
+			}
+		}
+
+		if (*ctx_found)
+			break;
+	}
+
+	if (g_ife_hw_mgr.hw_pid_support && (i == c_ctx->num_base || !*ctx_found))
+		CAM_INFO(CAM_ISP,
+			"This context does not cause pf:pid:%d ctx_id:%u",
+			pf_args->pf_smmu_info->pid, c_ctx->ctx_index);
+
+	cam_ife_mgr_pf_dump(hw_mgr_ctx);
+
+outportlog:
+	cam_packet_util_dump_io_bufs(packet, hw_mgr->mgr_common.img_iommu_hdl,
+		hw_mgr->mgr_common.img_iommu_hdl_secure, pf_args, true);
+	cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
+}
+
+static int cam_ife_mgr_flush_ctx(void *hw_mgr_priv,
+		struct cam_ife_hw_mgr_ctx *hw_mgr_ctx, int64_t req_id)
+{
+	struct cam_ife_hw_mgr *ife_hw_mgr        = hw_mgr_priv;
+	mutex_lock(&ife_hw_mgr->ctx_mutex);
+	cam_ife_mgr_flush_in_queue(ife_hw_mgr,
+		hw_mgr_ctx->ctx_idx, false, req_id);
+	mutex_unlock(&ife_hw_mgr->ctx_mutex);
+	return 0;
+}
+
+int cam_isp_config_csid_rup_aup(
+	struct cam_ife_hw_mgr_ctx *ctx)
+{
+	int rc = 0, i, j, hw_idx;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx  *c_ctx = ctx->concr_ctx;
+	struct list_head                *res_list;
+	struct cam_isp_resource_node    *res;
+	struct cam_isp_csid_reg_update_args
+		rup_args[CAM_IFE_CSID_HW_NUM_MAX] = {0};
+
+	res_list = &c_ctx->res_list_ife_csid;
+	for (j = 0; j < c_ctx->num_base; j++) {
+		if (c_ctx->base[j].hw_type != CAM_ISP_HW_TYPE_CSID)
+			continue;
+
+		list_for_each_entry(hw_mgr_res, res_list, list) {
+			if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+				continue;
+
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				res = hw_mgr_res->hw_res[i];
+				if (res->hw_intf->hw_idx != c_ctx->base[j].idx)
+					continue;
+
+				hw_idx = res->hw_intf->hw_idx;
+				rup_args[hw_idx].res[rup_args[hw_idx].num_res] = res;
+				rup_args[hw_idx].num_res++;
+
+				CAM_DBG(CAM_ISP,
+					"Reg update for res %d hw_id %d cdm_idx %d ctx_idx: %u",
+					res->res_id, res->hw_intf->hw_idx, c_ctx->base[j].idx,
+					c_ctx->ctx_index);
+			}
+		}
+	}
+
+	for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		if (!rup_args[i].num_res)
+			continue;
+
+		rup_args[i].cmd.cmd_buf_addr = NULL;
+		rup_args[i].cmd.size = 0;
+		rup_args[i].reg_write = true;
+		rup_args[i].last_applied_mup = c_ctx->current_mup;
+		res = rup_args[i].res[0];
+
+		rc = res->hw_intf->hw_ops.process_cmd(
+			res->hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_GET_REG_UPDATE, &rup_args[i],
+			sizeof(struct cam_isp_csid_reg_update_args));
+		if (rc)
+			return rc;
+
+		CAM_DBG(CAM_ISP,
+			"Reg update for CSID: %u mup: %u ctx_idx: %u",
+			res->hw_intf->hw_idx, c_ctx->current_mup, c_ctx->ctx_index);
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_configure_scratch_for_ife(
+	bool is_streamon,
+	struct cam_ife_hw_mgr_ctx *ctx)
+{
+	int i, j, rc = 0;
+	uint32_t res_id;
+	struct cam_isp_hw_mgr_res           *hw_mgr_res;
+	struct cam_ife_sfe_scratch_buf_info *port_info;
+	struct cam_ife_scratch_buf_cfg      *ife_buf_info;
+	struct cam_isp_hw_mgr_res           *res_list_ife_out = NULL;
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ctx->concr_ctx;
+
+	ife_buf_info = c_ctx->scratch_buf_info.ife_scratch_config;
+	res_list_ife_out = c_ctx->res_list_ife_out;
+
+	if (c_ctx->scratch_buf_info.ife_scratch_config->skip_scratch_cfg_streamon)
+		goto end;
+
+	for (i = 0; i < ife_buf_info->num_config; i++) {
+		res_id = ife_buf_info->buf_info[i].res_id & 0xFF;
+		port_info = &ife_buf_info->buf_info[i];
+		hw_mgr_res = &res_list_ife_out[c_ctx->vfe_out_map[res_id]];
+
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			/* j = 1 is not valid for this use-case */
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if ((is_streamon) &&
+				cam_ife_mgr_validate_for_io_buffers(
+				i, c_ctx->scratch_buf_info.ife_scratch_config->streamon_buf_mask))
+				continue;
+
+			CAM_DBG(CAM_ISP,
+				"Configure scratch for IFE res: 0x%x io_addr %pK ctx_idx: %u",
+				ife_buf_info->buf_info[i].res_id, port_info->io_addr,
+				c_ctx->ctx_index);
+
+			rc = cam_isp_sfe_send_scratch_buf_upd(0x0,
+				CAM_ISP_HW_CMD_BUF_UPDATE,
+				hw_mgr_res->hw_res[j], port_info,
+				NULL, NULL);
+			if (rc)
+				goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_configure_scratch_for_sfe(
+	bool is_streamon, struct cam_ife_hw_mgr_ctx *ctx)
+{
+	int i, j, res_id, rc = 0;
+	struct cam_isp_hw_mgr_res           *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ctx->concr_ctx;
+	struct cam_ife_sfe_scratch_buf_info *buf_info;
+	struct cam_sfe_scratch_buf_cfg      *sfe_scratch_config;
+	struct list_head                    *res_list_in_rd = NULL;
+	struct cam_isp_hw_mgr_res           *res_list_sfe_out = NULL;
+
+	res_list_in_rd = &c_ctx->res_list_ife_in_rd;
+	res_list_sfe_out = c_ctx->res_list_sfe_out;
+	sfe_scratch_config = c_ctx->scratch_buf_info.sfe_scratch_config;
+
+	if (sfe_scratch_config->skip_scratch_cfg_streamon)
+		goto end;
+
+	for (i = 0; i < CAM_SFE_FE_RDI_NUM_MAX; i++) {
+		if (c_ctx->sfe_out_map[i] == 0xff)
+			continue;
+		hw_mgr_res = &res_list_sfe_out[c_ctx->sfe_out_map[i]];
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			/* j = 1 is not valid for this use-case */
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			res_id = hw_mgr_res->hw_res[j]->res_id;
+
+			if (cam_isp_sfe_validate_for_scratch_buf_config(
+				(res_id - CAM_ISP_SFE_OUT_RES_RDI_0), ctx, true))
+				continue;
+
+			if ((is_streamon) &&
+				cam_ife_mgr_validate_for_io_buffers(
+				(res_id - CAM_ISP_SFE_OUT_RES_RDI_0),
+				sfe_scratch_config->streamon_buf_mask))
+				continue;
+
+			buf_info = &sfe_scratch_config->buf_info[
+				res_id - CAM_ISP_SFE_OUT_RES_RDI_0];
+
+			/* Check if scratch available for this resource */
+			if (!buf_info->config_done) {
+				CAM_ERR(CAM_ISP,
+					"No scratch buffer config found for res: %u on ctx: %u",
+					res_id, c_ctx->ctx_index);
+				rc = -EFAULT;
+				goto end;
+			}
+
+			CAM_DBG(CAM_ISP,
+				"RDI%d res_id 0x%x idx %u io_addr %pK ctx_idx: %u",
+				i,
+				hw_mgr_res->hw_res[j]->res_id,
+				(res_id - CAM_ISP_SFE_OUT_RES_RDI_0),
+				buf_info->io_addr, c_ctx->ctx_index);
+
+			rc = cam_isp_sfe_send_scratch_buf_upd(0x0,
+				CAM_ISP_HW_CMD_BUF_UPDATE,
+				hw_mgr_res->hw_res[j], buf_info,
+				NULL, NULL);
+			if (rc)
+				goto end;
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, res_list_in_rd, list) {
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			res_id = hw_mgr_res->hw_res[j]->res_id;
+
+			if (cam_isp_sfe_validate_for_scratch_buf_config(
+				(res_id - CAM_ISP_SFE_IN_RD_0), ctx, true))
+				continue;
+
+			if ((is_streamon) &&
+				cam_ife_mgr_validate_for_io_buffers(
+				(res_id - CAM_ISP_SFE_IN_RD_0),
+				sfe_scratch_config->streamon_buf_mask))
+				continue;
+
+			buf_info = &c_ctx->scratch_buf_info.sfe_scratch_config->buf_info
+				[res_id - CAM_ISP_SFE_IN_RD_0];
+			CAM_DBG(CAM_ISP,
+				"RD res_id 0x%x idx %u io_addr %pK ctx_idx: %u",
+				hw_mgr_res->hw_res[j]->res_id,
+				(res_id - CAM_ISP_SFE_IN_RD_0),
+				buf_info->io_addr, c_ctx->ctx_index);
+			rc = cam_isp_sfe_send_scratch_buf_upd(0x0,
+				CAM_ISP_HW_CMD_BUF_UPDATE_RM,
+				hw_mgr_res->hw_res[j], buf_info,
+				NULL, NULL);
+			if (rc)
+				goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+/*
+ * Scratch buffer is for sHDR/FS usescases involing SFE RDI0-2
+ * There is no possibility of dual in this case, hence
+ * using the scratch buffer provided during INIT corresponding
+ * to each left RDIs
+ */
+static int cam_ife_mgr_prog_default_settings(
+	bool is_streamon, struct cam_ife_hw_mgr_ctx *ctx)
+{
+	struct cam_ife_hw_concrete_ctx      *c_ctx = ctx->concr_ctx;
+	int rc = 0;
+
+	/* Check for SFE scratch buffers */
+	rc = cam_ife_mgr_configure_scratch_for_sfe(is_streamon, ctx);
+	if (rc)
+		goto end;
+
+	/* Check for IFE scratch buffers */
+	if (c_ctx->scratch_buf_info.ife_scratch_config->num_config) {
+		rc = cam_ife_mgr_configure_scratch_for_ife(is_streamon, ctx);
+		if (rc)
+			goto end;
+	}
+
+	/* Program rup & aup only at run time */
+	if (!is_streamon) {
+		rc = cam_isp_config_csid_rup_aup(ctx);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"RUP/AUP update failed for scratch buffers in ctx: %u",
+				c_ctx->ctx_index);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_hw_mgr_reset_out_of_sync_cnt(
+	struct cam_ife_hw_mgr_ctx *ife_ctx)
+{
+	int                                           rc = -EINVAL;
+	uint32_t                                      i;
+	struct cam_isp_hw_mgr_res                    *hw_mgr_res;
+	struct cam_hw_intf                           *hw_intf;
+	struct cam_ife_hw_concrete_ctx               *c_ctx = ife_ctx->concr_ctx;
+	struct cam_csid_reset_out_of_sync_count_args  args;
+
+	list_for_each_entry(hw_mgr_res,
+		&c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				args.node_res =
+					hw_mgr_res->hw_res[i];
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_IFE_CSID_RESET_OUT_OF_SYNC_CNT,
+					&args,
+					sizeof(args));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"Failed to reset out of sync cnt");
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_cmd_get_last_consumed_addr(
+	struct cam_ife_hw_mgr_ctx         *ife_ctx,
+	struct cam_isp_hw_done_event_data *done)
+{
+	int                           i, rc = -EINVAL;
+	struct cam_isp_resource_node *res;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res;
+	struct list_head              *res_list_isp_src;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ife_ctx->concr_ctx;
+
+	if (done->hw_type == CAM_ISP_HW_TYPE_VFE)
+		res_list_isp_src = &c_ctx->res_list_ife_src;
+	else if (done->hw_type == CAM_ISP_HW_TYPE_SFE)
+		res_list_isp_src = &c_ctx->res_list_sfe_src;
+	else {
+		CAM_ERR(CAM_ISP, "invalid hw_type:%d", done->hw_type);
+		return rc;
+	}
+
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_LAST_CONSUMED_ADDR,
+				done, sizeof(struct cam_isp_hw_done_event_data));
+
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static void *cam_ife_mgr_user_dump_stream_info(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_ife_hw_mgr_ctx        *hw_mgr_ctx = NULL;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = NULL;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res = NULL;
+	struct cam_isp_resource_node     *hw_res = NULL;
+	int32_t                          *addr;
+	int                              i;
+	int hw_idx[CAM_ISP_HW_SPLIT_MAX] = { -1, -1 };
+	int sfe_hw_idx[CAM_ISP_HW_SPLIT_MAX] = { -1, -1 };
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)dump_struct;
+	c_ctx = hw_mgr_ctx->concr_ctx;
+
+	if (!list_empty(&c_ctx->res_list_ife_src)) {
+		hw_mgr_res = list_first_entry(&c_ctx->res_list_ife_src,
+			struct cam_isp_hw_mgr_res, list);
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				hw_idx[i] = hw_res->hw_intf->hw_idx;
+		}
+	}
+
+	if (!list_empty(&c_ctx->res_list_sfe_src)) {
+		hw_mgr_res = list_first_entry(&c_ctx->res_list_sfe_src,
+			struct cam_isp_hw_mgr_res, list);
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				sfe_hw_idx[i] = hw_res->hw_intf->hw_idx;
+		}
+	}
+
+	addr = (int32_t *)addr_ptr;
+
+	*addr++ = c_ctx->flags.is_dual;
+	*addr++ = c_ctx->ctx_type;
+
+	*addr++ = hw_idx[CAM_ISP_HW_SPLIT_LEFT];
+	*addr++ = hw_idx[CAM_ISP_HW_SPLIT_RIGHT];
+	*addr++ = sfe_hw_idx[CAM_ISP_HW_SPLIT_LEFT];
+	*addr++ = sfe_hw_idx[CAM_ISP_HW_SPLIT_RIGHT];
+
+	*addr++ = c_ctx->flags.is_sfe_shdr;
+	*addr++ = c_ctx->flags.is_sfe_fs;
+	*addr++ = c_ctx->flags.dsp_enabled;
+	*addr++ = c_ctx->flags.is_offline;
+
+	return addr;
+}
+
+static int cam_ife_mgr_int_cmd(void                        *hw_mgr_priv,
+				struct cam_ife_hw_mgr_ctx  *hw_mgr_ctx,
+				struct cam_isp_hw_cmd_args *isp_hw_cmd_args)
+{
+	struct cam_ife_hw_concrete_ctx   *c_ctx = hw_mgr_ctx->concr_ctx;
+	struct cam_isp_comp_record_query *query_cmd;
+	struct cam_packet                *packet;
+	int rc = 0;
+
+	switch (isp_hw_cmd_args->cmd_type) {
+	case CAM_ISP_HW_MGR_CMD_CHECK_START_OFFLINE:
+		if (!hw_mgr_ctx->concr_ctx) {
+			CAM_ERR(CAM_ISP, "Invalid context");
+			rc = -EINVAL;
+			return rc;
+		}
+		cam_ife_mgr_check_start_processing(hw_mgr_priv,
+			hw_mgr_ctx);
+		break;
+	case CAM_ISP_HW_MGR_CMD_FLUSH_OFFLINE:
+		cam_ife_mgr_flush_ctx(hw_mgr_priv, hw_mgr_ctx,
+			isp_hw_cmd_args->u.req_id);
+		break;
+	case CAM_ISP_HW_MGR_CMD_PAUSE_HW:
+		cam_ife_mgr_pause_hw(hw_mgr_ctx);
+		break;
+	case CAM_ISP_HW_MGR_CMD_RESUME_HW:
+		cam_ife_mgr_resume_hw(hw_mgr_ctx);
+		break;
+	case CAM_ISP_HW_MGR_CMD_SOF_DEBUG:
+		cam_ife_mgr_sof_irq_debug(hw_mgr_ctx,
+			isp_hw_cmd_args->u.sof_irq_enable);
+		break;
+	case CAM_ISP_HW_MGR_CMD_CTX_TYPE:
+		if (c_ctx->flags.is_fe_enabled && c_ctx->flags.is_offline)
+			isp_hw_cmd_args->u.ctx_type =
+				CAM_ISP_CTX_OFFLINE;
+		else if (c_ctx->flags.is_fe_enabled && !c_ctx->flags.is_offline &&
+				c_ctx->ctx_type != CAM_IFE_CTX_TYPE_SFE)
+			isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_FS2;
+		else if (c_ctx->flags.is_rdi_only_context ||
+				c_ctx->flags.is_lite_context)
+			isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_RDI;
+		else
+			isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_PIX;
+		break;
+	case CAM_ISP_HW_MGR_GET_PACKET_OPCODE:
+		packet = (struct cam_packet *)
+			isp_hw_cmd_args->cmd_data;
+		if (((packet->header.op_code + 1) & 0xF) ==
+			CAM_ISP_PACKET_INIT_DEV)
+			isp_hw_cmd_args->u.packet_info.packet_op_code =
+			CAM_ISP_PACKET_INIT_DEV;
+		else
+			isp_hw_cmd_args->u.packet_info.packet_op_code =
+			CAM_ISP_PACKET_UPDATE_DEV;
+		isp_hw_cmd_args->u.packet_info.hw_mgr_ctx_id = c_ctx->ctx_index;
+		break;
+	case CAM_ISP_HW_MGR_GET_LAST_CDM_DONE:
+		isp_hw_cmd_args->u.last_cdm_done =
+				c_ctx->last_cdm_done_req;
+		break;
+	case CAM_ISP_HW_MGR_CMD_PROG_DEFAULT_CFG: {
+		bool skip_rup_aup = false;
+
+		if (!isp_hw_cmd_args->cmd_data) {
+			CAM_ERR(CAM_ISP, "Invalid cmd data");
+			rc = -EINVAL;
+			break;
+		}
+
+		skip_rup_aup = *((bool *)isp_hw_cmd_args->cmd_data);
+		rc = cam_ife_mgr_prog_default_settings((false || skip_rup_aup), hw_mgr_ctx);
+	}
+		break;
+	case CAM_ISP_HW_MGR_GET_SOF_TS:
+		rc = cam_ife_mgr_cmd_get_sof_timestamp(hw_mgr_ctx,
+			&isp_hw_cmd_args->u.sof_ts.curr,
+			&isp_hw_cmd_args->u.sof_ts.boot,
+			&isp_hw_cmd_args->u.sof_ts.prev,  NULL, true);
+		break;
+	case CAM_ISP_HW_MGR_DUMP_STREAM_INFO:
+		rc = cam_common_user_dump_helper(
+			(void *)(isp_hw_cmd_args->cmd_data),
+			cam_ife_mgr_user_dump_stream_info, hw_mgr_ctx,
+			sizeof(int32_t), "ISP_STREAM_INFO_FROM_IFE_HW_MGR:");
+		break;
+	case CAM_ISP_HW_MGR_GET_BUS_COMP_GROUP:
+		query_cmd = (struct cam_isp_comp_record_query *)
+			isp_hw_cmd_args->cmd_data;
+		memcpy(query_cmd->vfe_bus_comp_grp, c_ctx->vfe_bus_comp_grp,
+			sizeof(struct cam_isp_context_comp_record) *
+			CAM_IFE_BUS_COMP_NUM_MAX);
+		if (c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE && !(c_ctx->flags.is_offline))
+			memcpy(query_cmd->sfe_bus_comp_grp, c_ctx->sfe_bus_comp_grp,
+				sizeof(struct cam_isp_context_comp_record) *
+				CAM_SFE_BUS_COMP_NUM_MAX);
+		break;
+	case CAM_ISP_HW_MGR_GET_LAST_CONSUMED_ADDR:
+		rc = cam_ife_mgr_cmd_get_last_consumed_addr(hw_mgr_ctx,
+			(struct cam_isp_hw_done_event_data *)(isp_hw_cmd_args->cmd_data));
+		break;
+
+	case CAM_ISP_HW_MGR_GET_ACTIVE_HW_CTX_CNT:
+		rc = cam_ife_mgr_get_active_hw_ctx_cnt(hw_mgr_ctx, isp_hw_cmd_args);
+		break;
+
+	case CAM_ISP_HW_MGR_GET_HW_CTX:
+		rc = cam_ife_mgr_get_active_hw_ctx(hw_mgr_ctx, isp_hw_cmd_args);
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Invalid HW mgr command:0x%x, ctx_idx: %u",
+			isp_hw_cmd_args->cmd_type, c_ctx->ctx_index);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+
+static int cam_ife_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_ife_hw_mgr  *hw_mgr = hw_mgr_priv;
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx = NULL;
+	struct cam_ife_hw_concrete_ctx *c_ctx = NULL;
+	struct cam_isp_hw_cmd_args *isp_hw_cmd_args = NULL;
+	unsigned long rem_jiffies = 0;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)hw_cmd_args->ctxt_to_hw_map;
+	if (!hw_mgr_ctx) {
+		CAM_ERR(CAM_ISP, "Fatal: Invalid context is used");
+		return -EPERM;
+	}
+
+	c_ctx = hw_mgr_ctx->concr_ctx;
+	if (!hw_mgr_ctx->is_offline) {
+		if (!c_ctx || !c_ctx->flags.ctx_in_use) {
+			CAM_ERR(CAM_ISP, "Fatal: Invalid context is used");
+			return -EPERM;
+		}
+	}
+
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_INTERNAL:
+		if (!hw_cmd_args->u.internal_args) {
+			CAM_ERR(CAM_ISP, "Invalid cmd arguments, ctx_idx: %u", c_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		isp_hw_cmd_args = (struct cam_isp_hw_cmd_args *)
+			hw_cmd_args->u.internal_args;
+		rc = cam_ife_mgr_int_cmd(hw_mgr_priv, hw_mgr_ctx,
+					isp_hw_cmd_args);
+		break;
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_ife_mgr_dump_pf_data(hw_mgr, hw_cmd_args);
+
+		break;
+	case CAM_HW_MGR_CMD_REG_DUMP_ON_FLUSH:
+		if (c_ctx->flags.dump_on_flush)
+			return 0;
+		if (hw_mgr_ctx->is_offline)
+			return 0;
+
+		c_ctx->flags.dump_on_flush = true;
+
+		rem_jiffies = cam_common_wait_for_completion_timeout(
+			&c_ctx->config_done_complete, msecs_to_jiffies(30));
+		if (rem_jiffies == 0)
+			CAM_ERR(CAM_ISP,
+				"config done completion timeout, Reg dump will be unreliable rc=%d ctx_index %u",
+				rc, c_ctx->ctx_index);
+
+		rc = cam_ife_mgr_handle_reg_dump(hw_mgr_ctx,
+			c_ctx->reg_dump_buf_desc,
+			c_ctx->num_reg_dump_buf,
+			CAM_ISP_PACKET_META_REG_DUMP_ON_FLUSH, NULL, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Reg dump on flush failed req id: %llu rc: %d ctx_idx: %u",
+				c_ctx->applied_req_id, rc, c_ctx->ctx_index);
+			return rc;
+		}
+		break;
+	case CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR:
+		if (c_ctx->flags.dump_on_error)
+			return 0;
+
+		if (hw_mgr_ctx->is_offline)
+			return 0;
+
+		c_ctx->flags.dump_on_error = true;
+		rc = cam_ife_mgr_handle_reg_dump(hw_mgr_ctx, c_ctx->reg_dump_buf_desc,
+			c_ctx->num_reg_dump_buf,
+			CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR, NULL, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Reg dump on error failed req id: %llu rc: %d ctx_idx: %u",
+				c_ctx->applied_req_id, rc, c_ctx->ctx_index);
+			return rc;
+		}
+		break;
+	case CAM_HW_MGR_CMD_DUMP_ACQ_INFO:
+		cam_ife_hw_mgr_dump_acquire_resources(hw_mgr_ctx);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid cmd, ctx_idx: %u", c_ctx->ctx_index);
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_user_dump_hw(
+		struct cam_ife_hw_mgr_ctx *ife_ctx,
+		struct cam_hw_dump_args *dump_args)
+{
+	struct cam_ife_hw_concrete_ctx *c_ctx = ife_ctx->concr_ctx;
+	int rc = 0;
+
+	if (!c_ctx || !dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid parameters %pK %pK",
+			c_ctx, dump_args);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_ife_mgr_handle_reg_dump(ife_ctx,
+		ife_ctx->concr_ctx->reg_dump_buf_desc,
+		ife_ctx->concr_ctx->num_reg_dump_buf,
+		CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR,
+		NULL,
+		false);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Dump failed req: %lld handle %u offset %u ctx_idx: %u",
+			dump_args->request_id,
+			dump_args->buf_handle,
+			dump_args->offset, c_ctx->ctx_index);
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_dump(void *hw_mgr_priv, void *args)
+{
+	struct cam_isp_hw_dump_args isp_hw_dump_args;
+	struct cam_hw_dump_args *dump_args = (struct cam_hw_dump_args *)args;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)
+						dump_args->ctxt_to_hw_map;
+	struct cam_ife_hw_concrete_ctx *c_ctx = hw_mgr_ctx->concr_ctx;
+	int i;
+	int rc = 0;
+	uint32_t hw_idx = 0;
+
+	if (!c_ctx) {
+		CAM_ERR(CAM_ISP, "ISP CTX null");
+		return -EINVAL;
+	} else if (!c_ctx->num_base) {
+		CAM_ERR(CAM_ISP, "ISP CTX num_base null, ctx_idx: %u", c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	/* for some targets, information about the IFE registers to be dumped
+	 * is already submitted with the hw manager. In this case, we
+	 * can dump just the related registers and skip going to core files.
+	 */
+	if (!c_ctx->flags.dump_on_error) {
+		cam_ife_mgr_user_dump_hw(hw_mgr_ctx, dump_args);
+		c_ctx->flags.dump_on_error = true;
+	}
+
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&isp_hw_dump_args.cpu_addr,
+		&isp_hw_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Invalid handle %u rc %d ctx_idx: %u",
+			dump_args->buf_handle, rc, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	isp_hw_dump_args.offset = dump_args->offset;
+	isp_hw_dump_args.req_id = dump_args->request_id;
+
+	if (isp_hw_dump_args.buf_len <= isp_hw_dump_args.offset) {
+		CAM_ERR(CAM_ISP,
+			"Dump offset overshoot offset %zu buf_len %zu ctx_idx: %u",
+			isp_hw_dump_args.offset, isp_hw_dump_args.buf_len, c_ctx->ctx_index);
+		rc = -EINVAL;
+		goto put_cpu_buf;
+	}
+
+	for (i = 0; i < c_ctx->num_base; i++) {
+		hw_idx = c_ctx->base[i].idx;
+
+		switch (c_ctx->base[i].hw_type) {
+		case CAM_ISP_HW_TYPE_CSID:
+			hw_intf = c_ctx->hw_mgr->csid_devices[hw_idx];
+			if (!hw_intf) {
+				CAM_ERR(CAM_ISP, "hw_intf null, returning rc...ctx_idx: %u",
+					c_ctx->ctx_index);
+				rc = -EINVAL;
+				goto put_cpu_buf;
+			}
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_USER_DUMP, &isp_hw_dump_args,
+				sizeof(struct cam_isp_hw_dump_args));
+			if (rc) {
+				rc = -EINVAL;
+				goto put_cpu_buf;
+			}
+			break;
+		case CAM_ISP_HW_TYPE_VFE:
+			hw_intf = c_ctx->hw_mgr->ife_devices[hw_idx]->hw_intf;
+			if (!hw_intf || !hw_intf->hw_priv) {
+				CAM_ERR(CAM_ISP, "hw_intf null, returning rc...ctx_idx: %u",
+					c_ctx->ctx_index);
+				rc = -EINVAL;
+				goto put_cpu_buf;
+			}
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_USER_DUMP, &isp_hw_dump_args,
+				sizeof(struct cam_isp_hw_dump_args));
+			if (rc) {
+				rc = -EINVAL;
+				goto put_cpu_buf;
+			}
+			break;
+		case CAM_ISP_HW_TYPE_SFE:
+			hw_intf = c_ctx->hw_mgr->sfe_devices[hw_idx]->hw_intf;
+			if (!hw_intf || !hw_intf->hw_priv) {
+				CAM_ERR(CAM_ISP, "hw_intf null, returning rc...ctx_idx: %u",
+					c_ctx->ctx_index);
+				rc = -EINVAL;
+				goto put_cpu_buf;
+			}
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_USER_DUMP, &isp_hw_dump_args,
+				sizeof(struct cam_isp_hw_dump_args));
+			if (rc) {
+				rc = -EINVAL;
+				goto put_cpu_buf;
+			}
+			break;
+		default:
+			break;
+		}
+
+	}
+
+	dump_args->offset = isp_hw_dump_args.offset;
+
+put_cpu_buf:
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static inline void cam_ife_hw_mgr_get_offline_sof_timestamp(
+	uint64_t                             *timestamp,
+	uint64_t                             *boot_time)
+{
+	struct timespec64                     ts;
+
+	ktime_get_boottime_ts64(&ts);
+	*timestamp = (uint64_t)((ts.tv_sec * 1000000000) + ts.tv_nsec);
+	*boot_time = *timestamp;
+}
+
+static int cam_ife_mgr_cmd_get_sof_timestamp(
+	struct cam_ife_hw_mgr_ctx            *ife_ctx,
+	uint64_t                             *time_stamp,
+	uint64_t                             *boot_time_stamp,
+	uint64_t                             *prev_time_stamp,
+	struct timespec64                    *raw_boot_ts,
+	bool                                  get_curr_timestamp)
+{
+	int                                   rc = -EINVAL;
+	uint32_t                              i;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_csid_get_time_stamp_args   csid_get_time;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ife_ctx->concr_ctx;
+
+	hw_mgr_res = list_first_entry(&c_ctx->res_list_ife_csid,
+		struct cam_isp_hw_mgr_res, list);
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+
+		/*
+		 * Get the SOF time stamp from left resource only.
+		 * Left resource is master for dual vfe case and
+		 * Rdi only context case left resource only hold
+		 * the RDI resource
+		 */
+
+		hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.process_cmd) {
+			/*
+			 * Single VFE case, Get the time stamp from
+			 * available one csid hw in the context
+			 * Dual VFE case, get the time stamp from
+			 * master(left) would be sufficient
+			 */
+
+			csid_get_time.node_res =
+				hw_mgr_res->hw_res[i];
+			csid_get_time.get_prev_timestamp = (prev_time_stamp != NULL);
+			csid_get_time.get_curr_timestamp = get_curr_timestamp;
+			csid_get_time.time_stamp_val = *time_stamp;
+			csid_get_time.raw_boot_time = raw_boot_ts;
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_IFE_CSID_CMD_GET_TIME_STAMP,
+				&csid_get_time,
+				sizeof(
+				struct cam_csid_get_time_stamp_args));
+			if (!rc && (i == CAM_ISP_HW_SPLIT_LEFT)) {
+				*time_stamp =
+					csid_get_time.time_stamp_val;
+				*boot_time_stamp =
+					csid_get_time.boot_timestamp;
+				if (prev_time_stamp)
+					*prev_time_stamp =
+						csid_get_time.prev_time_stamp_val;
+			}
+		}
+	}
+
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Getting sof time stamp failed, ctx_idx: %u",
+				c_ctx->ctx_index);
+
+	return rc;
+}
+
+static int cam_ife_mgr_recover_hw(void *priv, void *data)
+{
+	int32_t rc = 0;
+	struct cam_ife_hw_event_recovery_data   *recovery_data = data;
+	struct cam_hw_start_args                 start_args;
+	struct cam_hw_stop_args                  stop_args;
+	struct cam_ife_hw_mgr                   *ife_hw_mgr = priv;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = NULL;
+	struct cam_ife_hw_mgr_ctx               *ife_ctx = NULL;
+	struct cam_ife_hw_mgr                   *ife_hwr_mgr = &g_ife_hw_mgr;
+	uint32_t                                 i = 0, idx;
+	bool cancel = false;
+	uint32_t error_type = recovery_data->error_type;
+
+	for (i = 0; i < recovery_data->no_of_context; i++) {
+		c_ctx = recovery_data->affected_ctx[i];
+		if (recovery_data->id[i] != atomic_read(&c_ctx->recovery_id)) {
+			CAM_INFO(CAM_ISP, "recovery for ctx:%u error-type:%d cancelled",
+				c_ctx->ctx_index, error_type);
+			cancel = true;
+		}
+	}
+	if (cancel)
+		goto end;
+
+	/* Here recovery is performed */
+	CAM_DBG(CAM_ISP, "ErrorType = %d", error_type);
+
+	switch (error_type) {
+	case CAM_ISP_HW_ERROR_OVERFLOW:
+	case CAM_ISP_HW_ERROR_CSID_LANE_FIFO_OVERFLOW:
+	case CAM_ISP_HW_ERROR_CSID_PKT_HDR_CORRUPTED:
+	case CAM_ISP_HW_ERROR_CSID_MISSING_PKT_HDR_DATA:
+	case CAM_ISP_HW_ERROR_CSID_SENSOR_SWITCH_ERROR:
+	case CAM_ISP_HW_ERROR_CSID_FATAL:
+	case CAM_ISP_HW_ERROR_CSID_UNBOUNDED_FRAME:
+	case CAM_ISP_HW_ERROR_CSID_MISSING_EOT:
+	case CAM_ISP_HW_ERROR_CSID_PKT_PAYLOAD_CORRUPTED:
+	case CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW:
+	case CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW:
+	case CAM_ISP_HW_ERROR_CSID_FRAME_SIZE:
+	case CAM_ISP_HW_ERROR_BUSIF_OVERFLOW:
+	case CAM_ISP_HW_ERROR_VIOLATION:
+		if (!recovery_data->affected_ctx[0]) {
+			CAM_ERR(CAM_ISP,
+				"No context is affected but recovery called");
+			kfree(recovery_data);
+			return 0;
+		}
+		/* stop resources here */
+		CAM_DBG(CAM_ISP, "STOP: Number of affected context: %d",
+			recovery_data->no_of_context);
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			c_ctx = recovery_data->affected_ctx[i];
+			idx = c_ctx->served_ctx_id[c_ctx->served_ctx_w];
+			if (!ife_hwr_mgr->virt_ctx_pool[idx].ctx_in_use) {
+				CAM_ERR(CAM_ISP, "Context[%d] is Not in use", idx);
+				goto end;
+			}
+			ife_ctx = &ife_hwr_mgr->virt_ctx_pool[idx];
+			stop_args.ctxt_to_hw_map = ife_ctx;
+			rc = cam_ife_mgr_stop_hw_in_overflow(&stop_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "CTX stop failed(%d) ctx_idx: %u",
+					rc, c_ctx->ctx_index);
+				return rc;
+			}
+		}
+
+		if (!g_ife_hw_mgr.debug_cfg.enable_recovery)
+			break;
+
+		CAM_DBG(CAM_ISP, "RESET: CSID PATH");
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			c_ctx = recovery_data->affected_ctx[i];
+			((struct cam_ife_hw_mgr_ctx *)
+				start_args.ctxt_to_hw_map)->concr_ctx = c_ctx;
+			rc = cam_ife_hw_mgr_reset_csid(
+				(struct cam_ife_hw_mgr_ctx *)
+					 start_args.ctxt_to_hw_map,
+				CAM_IFE_CSID_RESET_PATH);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Failed RESET, ctx_idx: %u", c_ctx->ctx_index);
+				return rc;
+			}
+		}
+
+		CAM_DBG(CAM_ISP, "RESET: Calling VFE reset");
+
+		for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+			if (recovery_data->affected_core[i])
+				cam_ife_mgr_reset_vfe_hw(ife_hw_mgr, i);
+		}
+
+		CAM_DBG(CAM_ISP, "START: Number of affected context: %d",
+			recovery_data->no_of_context);
+
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			c_ctx =  recovery_data->affected_ctx[i];
+			idx = c_ctx->served_ctx_id[c_ctx->served_ctx_w];
+			if (!ife_hwr_mgr->virt_ctx_pool[idx].ctx_in_use) {
+				CAM_ERR(CAM_ISP, "Context[%d] is Not in use", idx);
+				goto end;
+			}
+			ife_ctx = &ife_hwr_mgr->virt_ctx_pool[idx];
+			start_args.ctxt_to_hw_map = ife_ctx;
+
+			rc = cam_ife_mgr_restart_hw(&start_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "CTX start failed(%d) ctx_idx: %u",
+					rc, c_ctx->ctx_index);
+				return rc;
+			}
+			CAM_DBG(CAM_ISP, "Started resources rc (%d) ctx_idx: %u",
+				rc, c_ctx->ctx_index);
+		}
+
+		atomic_set(&c_ctx->overflow_pending, 0);
+		CAM_DBG(CAM_ISP, "Recovery Done rc (%d)", rc);
+
+		break;
+
+	case CAM_ISP_HW_ERROR_P2I_ERROR:
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Invalid Error");
+	}
+	CAM_DBG(CAM_ISP, "Exit: ErrorType = %d", error_type);
+
+end:
+	kfree(recovery_data);
+	return rc;
+}
+
+static void cam_ife_hw_mgr_trigger_crop_reg_dump(
+	struct cam_hw_intf                      *hw_intf,
+	struct cam_isp_hw_event_info            *event_info)
+{
+	int rc = 0, path_id = 0;
+
+	path_id = cam_ife_hw_mgr_convert_out_port_to_csid_path(
+		event_info->res_id);
+
+	if (hw_intf->hw_ops.process_cmd) {
+		rc = hw_intf->hw_ops.process_cmd(
+			hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_CSID_DUMP_CROP_REG,
+			&path_id,
+			sizeof(path_id));
+		if (rc)
+			CAM_ERR(CAM_ISP, "CSID:%d Reg Dump failed for path=%u",
+				event_info->hw_idx, path_id);
+	}
+}
+
+static int cam_ife_hw_mgr_do_error_recovery(
+	struct cam_ife_hw_event_recovery_data  *ife_mgr_recovery_data)
+{
+	int32_t                                 rc, i;
+	struct crm_workq_task                  *task = NULL;
+	struct cam_ife_hw_event_recovery_data  *recovery_data = NULL;
+	struct cam_ife_hw_concrete_ctx         *c_ctx;
+
+	recovery_data = kmemdup(ife_mgr_recovery_data,
+		sizeof(struct cam_ife_hw_event_recovery_data), GFP_ATOMIC);
+	if (!recovery_data)
+		return -ENOMEM;
+
+	CAM_DBG(CAM_ISP, "Enter: error_type (%d)", recovery_data->error_type);
+
+	task = cam_req_mgr_workq_get_task(g_ife_hw_mgr.workq);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No empty task frame");
+		kfree(recovery_data);
+		return -ENOMEM;
+	}
+
+	task->process_cb = &cam_context_handle_hw_recovery;
+	task->payload = recovery_data;
+	for (i = 0; i < recovery_data->no_of_context; i++) {
+		c_ctx = recovery_data->affected_ctx[i];
+		recovery_data->id[i] = atomic_inc_return(&c_ctx->recovery_id);
+	}
+
+	rc = cam_req_mgr_workq_enqueue_task(task,
+		recovery_data->affected_ctx[0]->common.cb_priv,
+		CRM_TASK_PRIORITY_0);
+	return rc;
+}
+
+/*
+ * This function checks if any of the valid entry in affected_core[]
+ * is associated with this context. if YES
+ *  a. It fills the other cores associated with this context.in
+ *      affected_core[]
+ *  b. Return true
+ */
+static bool cam_ife_hw_mgr_is_ctx_affected(
+	struct cam_ife_hw_concrete_ctx   *c_ctx,
+	uint32_t                         *affected_core,
+	uint32_t                          size)
+{
+
+	bool                  rc = false;
+	uint32_t              i = 0, j = 0;
+	uint32_t              max_idx =  c_ctx->num_base;
+	uint32_t              ctx_affected_core_idx[CAM_IFE_HW_NUM_MAX] = {0};
+
+	CAM_DBG(CAM_ISP, "Enter:max_idx = %d, ctx_idx: %u", max_idx, c_ctx->ctx_index);
+
+	if ((max_idx >= CAM_IFE_HW_NUM_MAX) || (size > CAM_IFE_HW_NUM_MAX)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "invalid parameter = %d, ctx_idx: %u",
+				max_idx, c_ctx->ctx_index);
+		return rc;
+	}
+
+	for (i = 0; i < max_idx; i++) {
+		if (affected_core[c_ctx->base[i].idx])
+			rc = true;
+		else {
+			ctx_affected_core_idx[j] = c_ctx->base[i].idx;
+			j = j + 1;
+		}
+	}
+
+	if (rc) {
+		while (j) {
+			if (affected_core[ctx_affected_core_idx[j-1]] != 1)
+				affected_core[ctx_affected_core_idx[j-1]] = 1;
+			j = j - 1;
+		}
+	}
+	CAM_DBG(CAM_ISP, "Exit, ctx_idx: %u", c_ctx->ctx_index);
+	return rc;
+}
+
+/*
+ * For any dual VFE context, if non-affected VFE is also serving
+ * another context, then that context should also be notified with fatal error
+ * So Loop through each context and -
+ *   a. match core_idx
+ *   b. Notify CTX with fatal error
+ */
+static int  cam_ife_hw_mgr_find_affected_ctx(
+	struct cam_isp_hw_error_event_data        *error_event_data,
+	uint32_t                                   curr_core_idx,
+	struct cam_ife_hw_event_recovery_data     *recovery_data)
+{
+	uint32_t                     affected_core[CAM_IFE_HW_NUM_MAX] = {0};
+	struct cam_ife_hw_concrete_ctx *c_ctx = NULL;
+	struct cam_ife_hw_mgr_ctx   *ife_ctx = NULL;
+	cam_hw_event_cb_func         notify_err_cb;
+	struct cam_ife_hw_mgr       *ife_hwr_mgr = NULL;
+	enum cam_isp_hw_event_type   event_type = CAM_ISP_HW_EVENT_ERROR;
+	uint32_t i = 0;
+	uint32_t idx;
+
+	if (!recovery_data) {
+		CAM_ERR(CAM_ISP, "recovery_data parameter is NULL");
+		return -EINVAL;
+	}
+
+	recovery_data->no_of_context = 0;
+	affected_core[curr_core_idx] = 1;
+	ife_hwr_mgr = &g_ife_hw_mgr;
+
+	list_for_each_entry(c_ctx,
+		&ife_hwr_mgr->used_ctx_list, list) {
+		/*
+		 * Check if current core_idx matches the HW associated
+		 * with this context
+		 */
+		if (!cam_ife_hw_mgr_is_ctx_affected(c_ctx,
+			affected_core, CAM_IFE_HW_NUM_MAX))
+			continue;
+
+		if (atomic_read(&c_ctx->overflow_pending)) {
+			CAM_INFO(CAM_ISP, "CTX:%u already error reported",
+				c_ctx->ctx_index);
+			continue;
+		}
+
+		atomic_set(&c_ctx->overflow_pending, 1);
+		idx = c_ctx->served_ctx_id[
+					c_ctx->served_ctx_w];
+		if (!ife_hwr_mgr->virt_ctx_pool[idx].ctx_in_use) {
+			CAM_ERR(CAM_ISP, "Invalid context");
+			return -EINVAL;
+		}
+		ife_ctx = &ife_hwr_mgr->virt_ctx_pool[idx];
+		notify_err_cb = ife_ctx->event_cb[event_type];
+
+		/* Add affected_context in list of recovery data */
+		CAM_DBG(CAM_ISP, "Add affected ctx %c to list",
+			c_ctx->ctx_index);
+		if (recovery_data->no_of_context < CAM_CTX_MAX)
+			recovery_data->affected_ctx[
+				recovery_data->no_of_context++] = c_ctx;
+
+		/*
+		 * In the call back function corresponding ISP context
+		 * will update CRM about fatal Error
+		 */
+		if (notify_err_cb)
+			notify_err_cb(c_ctx->common.cb_priv,
+				CAM_ISP_HW_EVENT_ERROR,
+				((void *)error_event_data));
+		else {
+			CAM_WARN(CAM_ISP, "Error call back is not set, ctx_idx: %u",
+				c_ctx->ctx_index);
+			goto end;
+		}
+	}
+
+	/* fill the affected_core in recovery data */
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		recovery_data->affected_core[i] = affected_core[i];
+		CAM_DBG(CAM_ISP, "Vfe core %d is affected (%d)",
+			i, recovery_data->affected_core[i]);
+	}
+end:
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_csid_secondary_err_evts(
+	uint32_t                              err_type,
+	struct cam_isp_hw_event_info         *event_info,
+	struct cam_ife_hw_mgr_ctx            *ctx)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_secondary_event_data sec_evt_data = {0};
+	struct cam_ife_hw_concrete_ctx *c_ctx = ctx->concr_ctx;
+	cam_hw_event_cb_func ife_hw_irq_cb =
+		ctx->event_cb[CAM_ISP_HW_SECONDARY_EVENT];
+
+	/*
+	 * Support frame drop as secondary event
+	 */
+	if (err_type & CAM_ISP_HW_ERROR_CSID_SENSOR_FRAME_DROP) {
+		sec_evt_data.evt_type = CAM_ISP_HW_SEC_EVENT_OUT_OF_SYNC_FRAME_DROP;
+
+		CAM_DBG(CAM_ISP,
+			"Received CSID[%u] sensor sync frame drop res: %d as secondary evt on ctx: %u",
+			event_info->hw_idx, event_info->res_id, c_ctx->ctx_index);
+
+		rc = ife_hw_irq_cb(ctx->cb_priv,
+			CAM_ISP_HW_SECONDARY_EVENT, (void *)&sec_evt_data);
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_csid_error(
+	struct cam_ife_hw_mgr_ctx      *ctx,
+	struct cam_isp_hw_event_info   *event_info)
+{
+	int                                      rc = -EINVAL;
+	bool                                     recoverable = true;
+	uint32_t                                 err_type;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = ctx->concr_ctx;
+	struct cam_isp_hw_error_event_info      *err_evt_info;
+	struct cam_isp_hw_error_event_data       error_event_data = {0};
+	struct cam_ife_hw_event_recovery_data    recovery_data = {0};
+	bool                                     is_bus_overflow = false;
+
+	if (!event_info->event_data) {
+		CAM_ERR(CAM_ISP,
+			"No additional error event data failed to process for CSID[%u] ctx: %u",
+			event_info->hw_idx, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	err_evt_info = (struct cam_isp_hw_error_event_info *)event_info->event_data;
+	err_type = err_evt_info->err_type;
+	CAM_DBG(CAM_ISP, "Entry CSID[%u] error %d ctx_idx: %u",
+		event_info->hw_idx, err_type, c_ctx->ctx_index);
+
+	spin_lock(&g_ife_hw_mgr.ctx_lock);
+
+	/* Secondary event handling */
+	if (event_info->is_secondary_evt) {
+		rc = cam_ife_hw_mgr_handle_csid_secondary_err_evts(err_type, event_info, ctx);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Failed to handle CSID[%u] sec event for res: %d err: 0x%x on ctx: %u",
+				event_info->hw_idx, event_info->res_id, err_type, c_ctx->ctx_index);
+		spin_unlock(&g_ife_hw_mgr.ctx_lock);
+		return rc;
+	}
+
+	/* Default error types */
+	recovery_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+	error_event_data.error_type = CAM_ISP_HW_ERROR_CSID_FATAL;
+	error_event_data.error_type |= err_type;
+
+	/* Notify IFE/SFE devices, determine bus overflow */
+	if (err_type & (CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW |
+		CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW |
+		CAM_ISP_HW_ERROR_CSID_FRAME_SIZE |
+		CAM_ISP_HW_ERROR_CSID_CAMIF_FRAME_DROP))
+		cam_ife_hw_mgr_check_and_notify_overflow(event_info,
+			ctx, &is_bus_overflow);
+
+	if (err_type & CAM_ISP_NON_RECOVERABLE_CSID_ERRORS) {
+		recovery_data.error_type = err_type;
+		recoverable = false;
+	}
+
+	if (recoverable && (is_bus_overflow ||
+		(err_type & CAM_ISP_RECOVERABLE_CSID_ERRORS))) {
+		if (c_ctx->try_recovery_cnt < MAX_INTERNAL_RECOVERY_ATTEMPTS) {
+			error_event_data.try_internal_recovery = true;
+
+			if (!atomic_read(&c_ctx->overflow_pending))
+				c_ctx->try_recovery_cnt++;
+
+			if (!c_ctx->recovery_req_id)
+				c_ctx->recovery_req_id = c_ctx->applied_req_id;
+		}
+
+		CAM_DBG(CAM_ISP,
+			"CSID[%u] error: %u current_recovery_cnt: %u  recovery_req: %llu on ctx: %u",
+			event_info->hw_idx, err_type, c_ctx->try_recovery_cnt,
+			c_ctx->recovery_req_id, c_ctx->ctx_index);
+
+		recovery_data.error_type = err_type;
+	}
+
+	rc = cam_ife_hw_mgr_find_affected_ctx(&error_event_data,
+			event_info->hw_idx, &recovery_data);
+	if (rc || !recovery_data.no_of_context)
+		goto end;
+
+	if (!error_event_data.try_internal_recovery)
+		cam_ife_hw_mgr_do_error_recovery(&recovery_data);
+
+	CAM_DBG(CAM_ISP, "Exit CSID[%u] error %d ctx_idx: %u",
+		event_info->hw_idx, err_type, c_ctx->ctx_index);
+
+end:
+	spin_unlock(&g_ife_hw_mgr.ctx_lock);
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_csid_rup(
+	struct cam_ife_hw_mgr_ctx        *ctx,
+	struct cam_isp_hw_event_info     *event_info)
+{
+	struct cam_ife_hw_mgr_ctx               *ife_ctx = ctx;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = ife_ctx->concr_ctx;
+	cam_hw_event_cb_func                     ife_hwr_irq_rup_cb;
+	struct cam_isp_hw_reg_update_event_data  rup_event_data;
+
+	ife_hwr_irq_rup_cb =
+		ife_ctx->event_cb[CAM_ISP_HW_EVENT_REG_UPDATE];
+
+	switch (event_info->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+		ife_hwr_irq_rup_cb(ife_ctx->cb_priv,
+			CAM_ISP_HW_EVENT_REG_UPDATE, &rup_event_data);
+		CAM_DBG(CAM_ISP, "RUP done for CSID:%d source %d ctx_idx: %u", event_info->hw_idx,
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d, ctx_idx: %u",
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_csid_eof(
+	struct cam_ife_hw_mgr_ctx        *ctx,
+	struct cam_isp_hw_event_info     *event_info)
+{
+	struct cam_ife_hw_concrete_ctx          *c_ctx = ctx->concr_ctx;
+	cam_hw_event_cb_func                     ife_hwr_irq_rup_cb;
+	struct cam_isp_hw_eof_event_data         eof_done_event_data;
+
+	ife_hwr_irq_rup_cb =
+		ctx->event_cb[CAM_ISP_HW_EVENT_EOF];
+
+	switch (event_info->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+		ife_hwr_irq_rup_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_EOF, &eof_done_event_data);
+		CAM_DBG(CAM_ISP,
+			"Received CSID[%u] CAMIF EOF res: %d ctx_idx: %u", event_info->hw_idx,
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d ctx_idx: %u",
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	}
+
+	return 0;
+}
+static int cam_ife_hw_mgr_handle_csid_camif_sof(
+	struct cam_ife_hw_mgr_ctx            *ctx,
+	struct cam_isp_hw_event_info         *event_info)
+{
+	int                                    rc = 0;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = ctx->concr_ctx;
+	cam_hw_event_cb_func ife_hw_irq_sof_cb
+		= ctx->event_cb[CAM_ISP_HW_EVENT_SOF];
+	struct cam_isp_hw_sof_event_data       sof_done_event_data = {0};
+	struct timespec64                      ts;
+	struct cam_isp_sof_ts_data            *sof_and_boot_time;
+
+	if (event_info->is_secondary_evt) {
+		struct cam_isp_hw_secondary_event_data sec_evt_data;
+
+		CAM_DBG(CAM_ISP,
+			"Received CSID[%u] CAMIF SOF res: %d as secondary evt, ctx_idx: %u",
+			event_info->hw_idx, event_info->res_id, c_ctx->ctx_index);
+
+		sec_evt_data.evt_type = CAM_ISP_HW_SEC_EVENT_SOF;
+		rc = ife_hw_irq_sof_cb(ctx->cb_priv,
+			CAM_ISP_HW_SECONDARY_EVENT, (void *)&sec_evt_data);
+		goto end;
+	}
+
+	switch (event_info->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+		if (c_ctx->ctx_config &
+			CAM_IFE_CTX_CFG_FRAME_HEADER_TS) {
+			sof_done_event_data.timestamp = 0x0;
+			ktime_get_boottime_ts64(&ts);
+			sof_done_event_data.boot_time =
+			(uint64_t)((ts.tv_sec * 1000000000) +
+			ts.tv_nsec);
+			CAM_DBG(CAM_ISP, "boot_time 0x%llx, ctx_idx: %u",
+				sof_done_event_data.boot_time, c_ctx->ctx_index);
+		} else {
+			if (c_ctx->flags.is_offline)
+				cam_ife_hw_mgr_get_offline_sof_timestamp(
+				&sof_done_event_data.timestamp,
+				&sof_done_event_data.boot_time);
+			else {
+				if (!event_info->event_data) {
+					CAM_ERR(CAM_ISP, "SOF timestamp data is null: %s",
+						CAM_IS_NULL_TO_STR(event_info->event_data));
+					break;
+				}
+				sof_and_boot_time =
+					(struct cam_isp_sof_ts_data *)event_info->event_data;
+				sof_done_event_data.timestamp =
+					sof_and_boot_time->sof_ts;
+				cam_ife_mgr_cmd_get_sof_timestamp(
+					ctx, &sof_done_event_data.timestamp,
+					&sof_done_event_data.boot_time, NULL,
+					&sof_and_boot_time->boot_time, false);
+			}
+		}
+
+		ife_hw_irq_sof_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_SOF, (void *)&sof_done_event_data);
+
+		CAM_DBG(CAM_ISP,
+			"Received CSID[%u] CAMIF SOF res: %d, ctx_idx: %u", event_info->hw_idx,
+			event_info->res_id, c_ctx->ctx_index);
+
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d, ctx_idx: %u",
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	}
+end:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_csid_camif_epoch(
+	struct cam_ife_hw_mgr_ctx            *ctx,
+	struct cam_isp_hw_event_info         *event_info)
+{
+	int rc = 0;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = ctx->concr_ctx;
+	cam_hw_event_cb_func ife_hw_irq_epoch_cb =
+		ctx->event_cb[CAM_ISP_HW_EVENT_EPOCH];
+	struct cam_isp_hw_epoch_event_data    epoch_done_event_data  = {0};
+
+	if (event_info->is_secondary_evt) {
+		struct cam_isp_hw_secondary_event_data sec_evt_data;
+
+		CAM_DBG(CAM_ISP,
+			"Received CSID[%u] CAMIF EPOCH res: %d as secondary evt, ctx_idx: %u",
+			event_info->hw_idx, event_info->res_id, c_ctx->ctx_index);
+
+		sec_evt_data.evt_type = CAM_ISP_HW_SEC_EVENT_EPOCH;
+		rc = ife_hw_irq_epoch_cb(ctx->cb_priv,
+			CAM_ISP_HW_SECONDARY_EVENT, (void *)&sec_evt_data);
+		goto end;
+	}
+
+	switch (event_info->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+		epoch_done_event_data.frame_id_meta = event_info->reg_val;
+		ife_hw_irq_epoch_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_EPOCH, (void *)&epoch_done_event_data);
+
+		CAM_DBG(CAM_ISP,
+			"Received CSID[%u] CAMIF Epoch res: %d, ctx_idx: %u", event_info->hw_idx,
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d ctx_idx: %u",
+				event_info->res_id, c_ctx->ctx_index);
+		break;
+	}
+end:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_sfe_hw_dump_info(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_ife_hw_mgr_ctx     *ife_ctx =
+		(struct cam_ife_hw_mgr_ctx *)ctx;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_hw_event_info  *event_info =
+		(struct cam_isp_hw_event_info *)evt_info;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res = NULL;
+	struct cam_isp_resource_node  *rsrc_node = NULL;
+	struct cam_hw_intf            *hw_intf;
+	uint32_t i, out_port;
+	int rc = 0;
+
+	/* SFE in rd resources */
+	list_for_each_entry(hw_mgr_res,
+		&c_ctx->res_list_ife_in_rd, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			rsrc_node = hw_mgr_res->hw_res[i];
+			if ((event_info->res_type == CAM_ISP_RESOURCE_SFE_RD) &&
+				(rsrc_node->res_type == CAM_ISP_RESOURCE_SFE_RD) &&
+				(event_info->res_id == rsrc_node->res_id)) {
+				hw_intf = rsrc_node->hw_intf;
+				if (hw_intf && hw_intf->hw_ops.process_cmd)
+					rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_BUS_INFO, (void *)event_info,
+						sizeof(struct cam_isp_hw_event_info));
+			}
+		}
+	}
+
+	/* SFE out resources */
+	if (event_info->res_type == CAM_ISP_RESOURCE_SFE_OUT) {
+		out_port = event_info->res_id & 0xFF;
+		hw_mgr_res =
+			&c_ctx->res_list_sfe_out[c_ctx->sfe_out_map[out_port]];
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_DUMP_BUS_INFO, (void *)event_info,
+					sizeof(struct cam_isp_hw_event_info));
+			}
+		}
+	}
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_hw_dump_info(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_ife_hw_mgr_ctx        *ife_ctx =
+		(struct cam_ife_hw_mgr_ctx *)ctx;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_hw_event_info  *event_info =
+		(struct cam_isp_hw_event_info *)evt_info;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res = NULL;
+	struct cam_isp_resource_node  *rsrc_node = NULL;
+	struct cam_hw_intf            *hw_intf;
+	uint32_t i, out_port;
+	uint64_t dummy_args;
+	int rc = 0;
+
+	list_for_each_entry(hw_mgr_res,
+		&c_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rsrc_node = hw_mgr_res->hw_res[i];
+			if (rsrc_node->res_id ==
+				CAM_ISP_HW_VFE_IN_CAMIF) {
+				hw_intf = rsrc_node->hw_intf;
+				if (hw_intf &&
+					hw_intf->hw_ops.process_cmd)
+					rc =
+					hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CAMIF_DATA,
+					rsrc_node,
+					sizeof(
+					struct
+					cam_isp_resource_node));
+			}
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res,
+		&c_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_CLOCK_DUMP,
+					&dummy_args,
+					sizeof(uint64_t));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"CSID Clock Dump failed, ctx_idx: %u",
+						c_ctx->ctx_index);
+			}
+		}
+	}
+
+	if (event_info->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		out_port = event_info->res_id & 0xFF;
+		hw_mgr_res =
+			&c_ctx->res_list_ife_out[c_ctx->vfe_out_map[out_port]];
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+					(void *)event_info,
+					sizeof(struct cam_isp_hw_event_info));
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_sfe_hw_err(
+	struct cam_ife_hw_mgr_ctx       *ctx,
+	struct cam_isp_hw_event_info    *event_info)
+{
+	struct cam_ife_hw_mgr_ctx        *ife_ctx =
+		(struct cam_ife_hw_mgr_ctx *)ctx;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_hw_error_event_info     *err_evt_info;
+	struct cam_isp_hw_error_event_data      error_event_data = {0};
+	struct cam_ife_hw_event_recovery_data   recovery_data = {0};
+
+	if (!event_info->event_data) {
+		CAM_ERR(CAM_ISP,
+			"No additional error event data failed to process for SFE[%u] ctx: %u",
+			event_info->hw_idx, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	err_evt_info = (struct cam_isp_hw_error_event_info *)event_info->event_data;
+
+	CAM_DBG(CAM_ISP, "SFE[%u] error [%u] on res_type %u ctx: %u",
+		event_info->hw_idx, err_evt_info->err_type,
+		event_info->res_type, c_ctx->ctx_index);
+
+	spin_lock(&g_ife_hw_mgr.ctx_lock);
+
+	cam_ife_hw_mgr_handle_sfe_hw_dump_info(ctx, event_info);
+
+	/* Only report error to userspace */
+	if (err_evt_info->err_type & CAM_SFE_IRQ_STATUS_VIOLATION) {
+		error_event_data.error_type = CAM_ISP_HW_ERROR_VIOLATION;
+		CAM_DBG(CAM_ISP, "Notify context for SFE error, ctx_idx: %u", c_ctx->ctx_index);
+		cam_ife_hw_mgr_find_affected_ctx(&error_event_data,
+			event_info->hw_idx, &recovery_data);
+	}
+	spin_unlock(&g_ife_hw_mgr.ctx_lock);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_err(
+	struct cam_ife_hw_mgr_ctx         *ife_hw_mgr_ctx,
+	struct cam_isp_hw_event_info      *event_info)
+{
+	uint32_t                                 core_idx, err_type;
+	struct cam_isp_hw_error_event_info      *err_evt_info;
+	struct cam_ife_hw_mgr_ctx               *ife_ctx =
+			(struct cam_ife_hw_mgr_ctx *)ife_hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_hw_error_event_data       error_event_data = {0};
+	struct cam_ife_hw_event_recovery_data    recovery_data = {0};
+	struct cam_hw_intf                      *hw_intf;
+	int                                      rc = -EINVAL;
+
+	if (!event_info->event_data) {
+		CAM_ERR(CAM_ISP,
+			"No additional error event data failed to process for IFE[%u] ctx: %u",
+			event_info->hw_idx, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	err_evt_info = (struct cam_isp_hw_error_event_info *)event_info->event_data;
+	err_type =  err_evt_info->err_type;
+
+	spin_lock(&g_ife_hw_mgr.ctx_lock);
+	if (event_info->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		hw_intf = g_ife_hw_mgr.csid_devices[event_info->hw_idx];
+		cam_ife_hw_mgr_trigger_crop_reg_dump(hw_intf, event_info);
+	}
+
+	if (event_info->res_type ==
+		CAM_ISP_RESOURCE_VFE_IN &&
+		!c_ctx->flags.is_rdi_only_context &&
+		event_info->res_id !=
+		CAM_ISP_HW_VFE_IN_CAMIF)
+		cam_ife_hw_mgr_handle_hw_dump_info(ife_ctx, event_info);
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION) {
+		error_event_data.error_type = CAM_ISP_HW_ERROR_VIOLATION;
+
+		if (err_evt_info->err_mask & CAM_VFE_IRQ_ERR_MASK_HWPD_VIOLATION)
+			error_event_data.error_type |= CAM_ISP_HW_ERROR_HWPD_VIOLATION;
+	} else if (event_info->res_type == CAM_ISP_RESOURCE_VFE_IN)
+		error_event_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+	else if (event_info->res_type == CAM_ISP_RESOURCE_VFE_OUT)
+		error_event_data.error_type = CAM_ISP_HW_ERROR_BUSIF_OVERFLOW;
+
+	core_idx = event_info->hw_idx;
+
+	if (g_ife_hw_mgr.debug_cfg.enable_recovery)
+		error_event_data.recovery_enabled = true;
+
+	if (g_ife_hw_mgr.debug_cfg.enable_req_dump)
+		error_event_data.enable_req_dump = true;
+
+	rc = cam_ife_hw_mgr_find_affected_ctx(&error_event_data,
+		core_idx, &recovery_data);
+
+	if (rc || !recovery_data.no_of_context)
+		goto end;
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION)
+		recovery_data.error_type = CAM_ISP_HW_ERROR_VIOLATION;
+	else
+		recovery_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+
+	cam_ife_hw_mgr_do_error_recovery(&recovery_data);
+end:
+	spin_unlock(&g_ife_hw_mgr.ctx_lock);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_hw_rup(
+	struct cam_ife_hw_mgr_ctx               *ife_hw_mgr_ctx,
+	struct cam_isp_hw_event_info            *event_info)
+{
+	struct cam_ife_hw_mgr_ctx               *ctx = ife_hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = ctx->concr_ctx;
+	cam_hw_event_cb_func                     ife_hwr_irq_rup_cb;
+	struct cam_isp_hw_reg_update_event_data  rup_event_data;
+
+	ife_hwr_irq_rup_cb =
+		ctx->event_cb[CAM_ISP_HW_EVENT_REG_UPDATE];
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_VFE_IN_CAMIF:
+		if ((c_ctx->flags.is_dual) &&
+			(event_info->hw_idx !=
+			c_ctx->left_hw_idx))
+			break;
+
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+		ife_hwr_irq_rup_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&rup_event_data);
+		break;
+
+	case CAM_ISP_HW_VFE_IN_RDI0:
+	case CAM_ISP_HW_VFE_IN_RDI1:
+	case CAM_ISP_HW_VFE_IN_RDI2:
+	case CAM_ISP_HW_VFE_IN_RDI3:
+	case CAM_ISP_HW_VFE_IN_RDI4:
+	case CAM_ISP_HW_VFE_IN_RDI5:
+		if (!cam_isp_is_ctx_primary_rdi(ctx))
+			break;
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+		ife_hwr_irq_rup_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&rup_event_data);
+		break;
+
+	case CAM_ISP_HW_VFE_IN_PDLIB:
+	case CAM_ISP_HW_VFE_IN_LCR:
+	case CAM_ISP_HW_VFE_IN_RD:
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d, ctx_idx: %u",
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "RUP done for VFE:%d source %d, ctx_idx: %u", event_info->hw_idx,
+		event_info->res_id, c_ctx->ctx_index);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_epoch(
+	struct cam_ife_hw_mgr_ctx            *ife_hw_mgr_ctx,
+	struct cam_isp_hw_event_info         *event_info)
+{
+	struct cam_ife_hw_mgr_ctx            *ctx = ife_hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ctx->concr_ctx;
+	cam_hw_event_cb_func                  ife_hw_irq_epoch_cb;
+	struct cam_isp_hw_epoch_event_data    epoch_done_event_data;
+
+	ife_hw_irq_epoch_cb =
+		ctx->event_cb[CAM_ISP_HW_EVENT_EPOCH];
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_VFE_IN_CAMIF:
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+
+		epoch_done_event_data.frame_id_meta = event_info->reg_val;
+		ife_hw_irq_epoch_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_EPOCH, (void *)&epoch_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_VFE_IN_RDI0:
+	case CAM_ISP_HW_VFE_IN_RDI1:
+	case CAM_ISP_HW_VFE_IN_RDI2:
+	case CAM_ISP_HW_VFE_IN_RDI3:
+	case CAM_ISP_HW_VFE_IN_RDI4:
+	case CAM_ISP_HW_VFE_IN_RDI5:
+	case CAM_ISP_HW_VFE_IN_PDLIB:
+	case CAM_ISP_HW_VFE_IN_LCR:
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d, ctx_idx: %u",
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "Epoch for VFE:%d source %d ctx_idx: %u", event_info->hw_idx,
+		event_info->res_id, c_ctx->ctx_index);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_sof(
+	struct cam_ife_hw_mgr_ctx            *ife_hw_mgr_ctx,
+	struct cam_isp_hw_event_info         *event_info)
+{
+	struct cam_ife_hw_mgr_ctx            *ctx = ife_hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ctx->concr_ctx;
+	cam_hw_event_cb_func                  ife_hw_irq_sof_cb;
+	struct cam_isp_hw_sof_event_data      sof_done_event_data;
+	struct cam_isp_sof_ts_data           *sof_and_boot_time;
+	struct timespec64 ts;
+
+	memset(&sof_done_event_data, 0, sizeof(sof_done_event_data));
+
+	ife_hw_irq_sof_cb = ctx->event_cb[CAM_ISP_HW_EVENT_SOF];
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_VFE_IN_CAMIF:
+	case CAM_ISP_HW_VFE_IN_RD:
+		/* if frame header is enabled reset qtimer ts */
+		if (c_ctx->ctx_config &
+			CAM_IFE_CTX_CFG_FRAME_HEADER_TS) {
+			sof_done_event_data.timestamp = 0x0;
+			ktime_get_boottime_ts64(&ts);
+			sof_done_event_data.boot_time =
+			(uint64_t)((ts.tv_sec * 1000000000) +
+			ts.tv_nsec);
+			CAM_DBG(CAM_ISP, "boot_time 0x%llx, ctx_idx: %u",
+				sof_done_event_data.boot_time, c_ctx->ctx_index);
+		} else {
+			if (c_ctx->flags.is_offline)
+				cam_ife_hw_mgr_get_offline_sof_timestamp(
+				&sof_done_event_data.timestamp,
+				&sof_done_event_data.boot_time);
+			else {
+				if (!event_info->event_data) {
+					CAM_ERR(CAM_ISP, "SOF timestamp data is null: %s",
+						CAM_IS_NULL_TO_STR(event_info->event_data));
+					break;
+				}
+				sof_and_boot_time =
+					(struct cam_isp_sof_ts_data *)event_info->event_data;
+				sof_done_event_data.timestamp = sof_and_boot_time->sof_ts;
+				cam_ife_mgr_cmd_get_sof_timestamp(
+					ctx, &sof_done_event_data.timestamp,
+					&sof_done_event_data.boot_time, NULL,
+					&sof_and_boot_time->boot_time, false);
+			}
+		}
+
+		cam_hw_mgr_reset_out_of_sync_cnt(ctx);
+
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+
+		ife_hw_irq_sof_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_SOF, (void *)&sof_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_VFE_IN_RDI0:
+	case CAM_ISP_HW_VFE_IN_RDI1:
+	case CAM_ISP_HW_VFE_IN_RDI2:
+	case CAM_ISP_HW_VFE_IN_RDI3:
+	case CAM_ISP_HW_VFE_IN_RDI4:
+	case CAM_ISP_HW_VFE_IN_RDI5:
+		if (!cam_isp_is_ctx_primary_rdi(ctx))
+			break;
+
+		if (!event_info->event_data) {
+			CAM_ERR(CAM_ISP, "SOF timestamp data is null: %s",
+				CAM_IS_NULL_TO_STR(event_info->event_data));
+			break;
+		}
+		sof_and_boot_time =
+			(struct cam_isp_sof_ts_data *)event_info->event_data;
+		sof_done_event_data.timestamp = sof_and_boot_time->sof_ts;
+		cam_ife_mgr_cmd_get_sof_timestamp(
+			ctx, &sof_done_event_data.timestamp,
+			&sof_done_event_data.boot_time, NULL,
+			&sof_and_boot_time->boot_time, false);
+
+		cam_hw_mgr_reset_out_of_sync_cnt(ctx);
+
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+
+		ife_hw_irq_sof_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_SOF, (void *)&sof_done_event_data);
+		break;
+
+	case CAM_ISP_HW_VFE_IN_PDLIB:
+	case CAM_ISP_HW_VFE_IN_LCR:
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d, ctx_idx: %u",
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "SOF for VFE:%d source %d ctx_idx: %u", event_info->hw_idx,
+		event_info->res_id, c_ctx->ctx_index);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_eof(
+	struct cam_ife_hw_mgr_ctx            *ife_hw_mgr_ctx,
+	struct cam_isp_hw_event_info         *event_info)
+{
+	struct cam_ife_hw_mgr_ctx            *ctx = ife_hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ctx->concr_ctx;
+	cam_hw_event_cb_func                  ife_hw_irq_eof_cb;
+	struct cam_isp_hw_eof_event_data      eof_done_event_data;
+
+	ife_hw_irq_eof_cb =
+		ctx->event_cb[CAM_ISP_HW_EVENT_EOF];
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_VFE_IN_CAMIF:
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+
+		ife_hw_irq_eof_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_EOF, (void *)&eof_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_VFE_IN_RDI0:
+	case CAM_ISP_HW_VFE_IN_RDI1:
+	case CAM_ISP_HW_VFE_IN_RDI2:
+	case CAM_ISP_HW_VFE_IN_RDI3:
+	case CAM_ISP_HW_VFE_IN_RDI4:
+	case CAM_ISP_HW_VFE_IN_RDI5:
+		if (!c_ctx->flags.is_rdi_only_context)
+			break;
+		if (atomic_read(&c_ctx->overflow_pending))
+			break;
+		ife_hw_irq_eof_cb(ctx->cb_priv,
+			CAM_ISP_HW_EVENT_EOF, (void *)&eof_done_event_data);
+		break;
+
+	case CAM_ISP_HW_VFE_IN_PDLIB:
+	case CAM_ISP_HW_VFE_IN_LCR:
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d, ctx_idx: %u",
+			event_info->res_id, c_ctx->ctx_index);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "EOF for VFE:%d source %d ctx_idx: %u", event_info->hw_idx,
+		event_info->res_id, c_ctx->ctx_index);
+
+	return 0;
+}
+
+static bool cam_ife_hw_mgr_last_consumed_addr_check(
+	uint32_t last_consumed_addr, struct cam_ife_sfe_scratch_buf_info *buf_info)
+{
+	dma_addr_t final_addr;
+	uint32_t cmp_addr = 0;
+
+	final_addr = buf_info->io_addr + buf_info->offset;
+	cmp_addr = cam_smmu_is_expanded_memory() ?
+		CAM_36BIT_INTF_GET_IOVA_BASE(final_addr) : final_addr;
+	if (cmp_addr == last_consumed_addr)
+		return true;
+
+	return false;
+}
+
+static int cam_ife_hw_mgr_check_ife_scratch_buf_done(
+	struct cam_ife_scratch_buf_cfg *scratch_cfg,
+	uint32_t res_id, uint32_t last_consumed_addr)
+{
+	int rc = 0, i;
+	struct cam_ife_sfe_scratch_buf_info *buf_info;
+
+	for (i = 0; i < scratch_cfg->num_config; i++) {
+		if (scratch_cfg->buf_info[i].res_id == res_id) {
+			buf_info = &scratch_cfg->buf_info[i];
+
+			if (cam_ife_hw_mgr_last_consumed_addr_check(last_consumed_addr, buf_info)) {
+				CAM_DBG(CAM_ISP,
+					"IFE res:0x%x buf done for scratch - skip ctx notify",
+					buf_info->res_id);
+				rc = -EAGAIN;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_check_sfe_scratch_buf_done(
+	struct cam_sfe_scratch_buf_cfg *scratch_cfg,
+	uint32_t res_id, uint32_t last_consumed_addr)
+{
+	int rc = 0;
+	struct cam_ife_sfe_scratch_buf_info *buf_info;
+
+	switch (res_id) {
+	case CAM_ISP_SFE_OUT_RES_RDI_0:
+	case CAM_ISP_SFE_OUT_RES_RDI_1:
+	case CAM_ISP_SFE_OUT_RES_RDI_2:
+		buf_info = &scratch_cfg->buf_info[res_id - CAM_ISP_SFE_OUT_RES_RDI_0];
+		if (!buf_info->config_done)
+			return 0;
+
+		if (cam_ife_hw_mgr_last_consumed_addr_check(last_consumed_addr, buf_info)) {
+			CAM_DBG(CAM_ISP,
+				"SFE RDI: 0x%x buf done for scratch - skip ctx notify",
+				buf_info->res_id);
+			rc = -EAGAIN;
+		}
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_check_for_scratch_buf_done(
+	struct cam_ife_hw_mgr_ctx *ife_hw_mgr_ctx,
+	enum cam_isp_hw_type hw_type,
+	uint32_t res_id, uint32_t last_consumed_addr)
+{
+	int rc = 0;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ife_hw_mgr_ctx->concr_ctx;
+
+	switch (hw_type) {
+	case CAM_ISP_HW_TYPE_VFE:
+		if (c_ctx->scratch_buf_info.ife_scratch_config->num_config)
+			rc = cam_ife_hw_mgr_check_ife_scratch_buf_done(
+				c_ctx->scratch_buf_info.ife_scratch_config,
+				res_id, last_consumed_addr);
+		break;
+	case CAM_ISP_HW_TYPE_SFE:
+		rc = cam_ife_hw_mgr_check_sfe_scratch_buf_done(
+			c_ctx->scratch_buf_info.sfe_scratch_config,
+			res_id, last_consumed_addr);
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_hw_buf_done(
+	struct cam_ife_hw_mgr_ctx        *ife_hw_mgr_ctx,
+	struct cam_isp_hw_event_info     *event_info)
+{
+	cam_hw_event_cb_func                   ife_hwr_irq_wm_done_cb;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ife_hw_mgr_ctx->concr_ctx;
+	struct cam_isp_hw_done_event_data      buf_done_event_data = {0};
+	struct cam_isp_hw_bufdone_event_info  *bufdone_evt_info = NULL;
+	int32_t                                rc = 0;
+
+	if (!event_info->event_data) {
+		CAM_ERR(CAM_ISP,
+			"No additional buf done data failed to process for HW: %u, ctx_idx: %u",
+			event_info->hw_type, c_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	ife_hwr_irq_wm_done_cb =
+		ife_hw_mgr_ctx->event_cb[CAM_ISP_HW_EVENT_DONE];
+	bufdone_evt_info = (struct cam_isp_hw_bufdone_event_info *)event_info->event_data;
+	buf_done_event_data.resource_handle = 0;
+
+	CAM_DBG(CAM_ISP,
+		"Buf done for %s: %d res_id: 0x%x last consumed addr: 0x%x ctx: %u",
+		((event_info->hw_type == CAM_ISP_HW_TYPE_SFE) ? "SFE" : "IFE"),
+		event_info->hw_idx, event_info->res_id,
+		bufdone_evt_info->last_consumed_addr, c_ctx->ctx_index);
+
+	/* Check scratch for sHDR/FS use-cases */
+	if (c_ctx->flags.is_sfe_fs || c_ctx->flags.is_sfe_shdr) {
+		rc = cam_ife_hw_mgr_check_for_scratch_buf_done(ife_hw_mgr_ctx,
+			event_info->hw_type, event_info->res_id,
+			bufdone_evt_info->last_consumed_addr);
+		if (rc)
+			return 0;
+	}
+
+	buf_done_event_data.hw_type = event_info->hw_type;
+	buf_done_event_data.resource_handle = event_info->res_id;
+	buf_done_event_data.last_consumed_addr = bufdone_evt_info->last_consumed_addr;
+	buf_done_event_data.comp_group_id = bufdone_evt_info->comp_grp_id;
+
+	if (atomic_read(&c_ctx->overflow_pending))
+		return 0;
+
+	if (buf_done_event_data.resource_handle > 0 && ife_hwr_irq_wm_done_cb) {
+		CAM_DBG(CAM_ISP,
+			"Notify ISP context for %u handles in ctx: %u",
+			buf_done_event_data.resource_handle, c_ctx->ctx_index);
+		ife_hwr_irq_wm_done_cb(ife_hw_mgr_ctx->cb_priv,
+			CAM_ISP_HW_EVENT_DONE, (void *)&buf_done_event_data);
+	}
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_ife_event(
+	struct cam_ife_hw_mgr_ctx           *ctx,
+	uint32_t                             evt_id,
+	struct cam_isp_hw_event_info        *event_info)
+{
+	int rc = 0;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+
+	CAM_DBG(CAM_ISP, "Handle IFE[%u] %s event in ctx: %u",
+		event_info->hw_idx,
+		cam_isp_hw_evt_type_to_string(evt_id),
+		c_ctx->ctx_index);
+
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_SOF:
+		rc = cam_ife_hw_mgr_handle_hw_sof(ctx, event_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		rc = cam_ife_hw_mgr_handle_hw_rup(ctx, event_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_EPOCH:
+		rc = cam_ife_hw_mgr_handle_hw_epoch(ctx, event_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_EOF:
+		rc = cam_ife_hw_mgr_handle_hw_eof(ctx, event_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_DONE:
+		rc = cam_ife_hw_mgr_handle_hw_buf_done(ctx, event_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_ERROR:
+		rc = cam_ife_hw_mgr_handle_hw_err(ctx, event_info);
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Event: %u not handled for IFE, ctx_idx: %u",
+			evt_id, c_ctx->ctx_index);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_csid_event(
+	struct cam_ife_hw_mgr_ctx       *ctx,
+	uint32_t                         evt_id,
+	struct cam_isp_hw_event_info    *event_info)
+{
+	int rc = 0;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+
+	CAM_DBG(CAM_ISP, "Handle CSID[%u] %s event in ctx: %u",
+		event_info->hw_idx,
+		cam_isp_hw_evt_type_to_string(evt_id),
+		c_ctx->ctx_index);
+
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		rc = cam_ife_hw_mgr_handle_csid_rup(ctx, event_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_ERROR:
+		rc = cam_ife_hw_mgr_handle_csid_error(ctx, event_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_SOF:
+		rc = cam_ife_hw_mgr_handle_csid_camif_sof(ctx, event_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_EPOCH:
+		rc = cam_ife_hw_mgr_handle_csid_camif_epoch(ctx, event_info);
+		break;
+	case CAM_ISP_HW_EVENT_EOF:
+		rc = cam_ife_hw_mgr_handle_csid_eof(ctx, event_info);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Event: %u not handled for CSID, ctx_idx: %u",
+			evt_id, c_ctx->ctx_index);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_sfe_event(
+	struct cam_ife_hw_mgr_ctx       *ctx,
+	uint32_t                         evt_id,
+	struct cam_isp_hw_event_info    *event_info)
+{
+	int rc = 0;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = ctx->concr_ctx;
+
+	CAM_DBG(CAM_ISP, "Handle SFE[%u] %s event in ctx: %u",
+		event_info->hw_idx,
+		cam_isp_hw_evt_type_to_string(evt_id),
+		c_ctx->ctx_index);
+
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_ERROR:
+		rc = cam_ife_hw_mgr_handle_sfe_hw_err(ctx, event_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_DONE:
+		rc = cam_ife_hw_mgr_handle_hw_buf_done(ctx, event_info);
+		break;
+
+	default:
+		CAM_WARN(CAM_ISP, "Event: %u not handled for SFE, ctx_idx: %u",
+			evt_id, c_ctx->ctx_index);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int cam_ife_hw_mgr_event_handler(
+	void                                *priv,
+	uint32_t                             evt_id,
+	void                                *evt_info)
+{
+	int rc = -EINVAL;
+	struct cam_ife_hw_mgr_ctx           *ctx;
+	struct cam_isp_hw_event_info        *event_info;
+	struct cam_ife_hw_concrete_ctx      *c_ctx;
+
+	if (!evt_info || !priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid data evt_info: %pK priv: %pK",
+			evt_info, priv);
+		return rc;
+	}
+
+	ctx = (struct cam_ife_hw_mgr_ctx *)priv;
+	c_ctx = ctx->concr_ctx;
+	event_info = (struct cam_isp_hw_event_info *)evt_info;
+
+	switch (event_info->hw_type) {
+	case CAM_ISP_HW_TYPE_CSID:
+		rc = cam_ife_hw_mgr_handle_csid_event(ctx, evt_id, event_info);
+		break;
+
+	case CAM_ISP_HW_TYPE_SFE:
+		rc = cam_ife_hw_mgr_handle_sfe_event(ctx, evt_id, event_info);
+		break;
+
+	case CAM_ISP_HW_TYPE_VFE:
+		rc = cam_ife_hw_mgr_handle_ife_event(ctx, evt_id, event_info);
+		break;
+
+	default:
+		break;
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to handle %s [%u] event from hw %u in ctx %u rc %d",
+			cam_isp_hw_evt_type_to_string(evt_id),
+			evt_id, event_info->hw_type, c_ctx->ctx_index, rc);
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_event_handler_offline(
+	void                                *priv,
+	uint32_t                             evt_id,
+	void                                *evt_info)
+{
+
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_ife_hw_mgr                *ife_hw_mgr = priv;
+	struct cam_ife_hw_mgr_ctx            *hw_mgr_ctx = NULL;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = NULL;
+	int idx, ctx_idx_rd;
+	int hw_num;
+	int                                   rc = 0;
+
+	if (!ife_hw_mgr) {
+		CAM_ERR(CAM_ISP, "Invalid HW mgr!");
+		return -EINVAL;
+	}
+
+	if (!event_info) {
+		CAM_ERR(CAM_ISP, "Invalid event info");
+		return -EINVAL;
+	}
+
+	hw_num = cam_convert_hw_idx_to_ife_hw_num(event_info->hw_idx);
+	list_for_each_entry(c_ctx, &ife_hw_mgr->used_ctx_list, list) {
+		if (c_ctx->acquired_hw_id == hw_num)
+			break;
+	}
+
+	if (!c_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid ife_ctx!");
+		return -EINVAL;
+	}
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_EPOCH:
+		c_ctx->served_ctx_r = c_ctx->served_ctx_w;
+		ctx_idx_rd = c_ctx->served_ctx_w;
+		break;
+	case CAM_ISP_HW_EVENT_SOF:
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		ctx_idx_rd = c_ctx->served_ctx_w;
+		break;
+	case CAM_ISP_HW_EVENT_EOF:
+		ctx_idx_rd = c_ctx->served_ctx_r;
+		atomic_set(&c_ctx->ctx_state, CAM_IFE_HW_STATE_STARTED);
+		break;
+	default:
+		ctx_idx_rd = c_ctx->served_ctx_r;
+		break;
+	}
+
+	idx = c_ctx->served_ctx_id[ctx_idx_rd];
+	if (!ife_hw_mgr->virt_ctx_pool[idx].ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context");
+		return -EINVAL;
+	}
+	hw_mgr_ctx = &ife_hw_mgr->virt_ctx_pool[idx];
+	CAM_DBG(CAM_ISP, "get hw mgr ctx %p ctx id %d evt_id %d ctx_idx_rd %d idx %d",
+		hw_mgr_ctx, hw_mgr_ctx->ctx_idx, evt_id, ctx_idx_rd, idx);
+
+
+	rc = cam_ife_hw_mgr_event_handler((void *)hw_mgr_ctx, evt_id, evt_info);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_sort_dev_with_caps(
+	struct cam_ife_hw_mgr *ife_hw_mgr)
+{
+	int i;
+
+	/* get caps for csid devices */
+	for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		if (!ife_hw_mgr->csid_devices[i])
+			continue;
+
+		if (!ife_hw_mgr->csid_devices[i]->hw_ops.get_hw_caps)
+			continue;
+
+		ife_hw_mgr->csid_devices[i]->hw_ops.get_hw_caps(
+			ife_hw_mgr->csid_devices[i]->hw_priv,
+			&ife_hw_mgr->csid_hw_caps[i],
+			sizeof(ife_hw_mgr->csid_hw_caps[i]));
+
+		ife_hw_mgr->csid_global_reset_en =
+			ife_hw_mgr->csid_hw_caps[i].global_reset_en;
+		ife_hw_mgr->csid_rup_en =
+			ife_hw_mgr->csid_hw_caps[i].rup_en;
+		ife_hw_mgr->csid_camif_irq_support =
+			ife_hw_mgr->csid_hw_caps[i].camif_irq_support;
+	}
+
+	/* get caps for ife devices */
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (!ife_hw_mgr->ife_devices[i])
+			continue;
+		if (ife_hw_mgr->ife_devices[i]->hw_intf->hw_ops.get_hw_caps) {
+			ife_hw_mgr->ife_devices[i]->hw_intf->hw_ops.get_hw_caps(
+				ife_hw_mgr->ife_devices[i]->hw_intf->hw_priv,
+				&ife_hw_mgr->ife_dev_caps[i],
+				sizeof(ife_hw_mgr->ife_dev_caps[i]));
+		}
+		if (ife_hw_mgr->ife_dev_caps[i].is_lite && !ife_hw_mgr->max_ife_lite_out_res) {
+			if (ife_hw_mgr->ife_devices[i]->hw_intf->hw_ops.process_cmd) {
+				ife_hw_mgr->ife_devices[i]->hw_intf->hw_ops.process_cmd(
+					ife_hw_mgr->ife_devices[i]->hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_GET_NUM_OUT_RES,
+					&ife_hw_mgr->max_ife_lite_out_res,
+					sizeof(uint32_t));
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int cam_ife_set_sfe_cache_debug(void *data, u64 val)
+{
+	int i, rc = -EINVAL;
+	uint32_t hw_idx = 0;
+	struct cam_sfe_debug_cfg_params debug_cfg;
+	struct cam_hw_intf *hw_intf = NULL;
+
+	debug_cfg.cache_config = true;
+
+	/* BITS [0:3] is for hw_idx */
+	hw_idx = val & 0xF;
+	for (i = 0; i < CAM_SFE_HW_NUM_MAX; i++) {
+		if ((g_ife_hw_mgr.sfe_devices[i]) && (i == hw_idx)) {
+			hw_intf = g_ife_hw_mgr.sfe_devices[i]->hw_intf;
+
+			debug_cfg.u.cache_cfg.sfe_cache_dbg = (val >> 4);
+			g_ife_hw_mgr.debug_cfg.sfe_cache_debug[i] =
+				debug_cfg.u.cache_cfg.sfe_cache_dbg;
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_SET_SFE_DEBUG_CFG,
+				&debug_cfg,
+				sizeof(struct cam_sfe_debug_cfg_params));
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Set SFE cache debug value: 0x%llx", val);
+	return rc;
+}
+
+static int cam_ife_get_sfe_cache_debug(void *data, u64 *val)
+{
+	*val = g_ife_hw_mgr.debug_cfg.sfe_cache_debug[CAM_SFE_CORE_1];
+	*val = *val << 32;
+	*val |=  g_ife_hw_mgr.debug_cfg.sfe_cache_debug[CAM_SFE_CORE_0];
+	CAM_DBG(CAM_ISP, "Get SFE cace debug value: 0x%llx", *val);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_ife_sfe_cache_debug,
+	cam_ife_get_sfe_cache_debug,
+	cam_ife_set_sfe_cache_debug, "%16llu");
+
+static int cam_ife_set_csid_debug(void *data, u64 val)
+{
+	g_ife_hw_mgr.debug_cfg.csid_debug = val;
+	CAM_INFO(CAM_ISP, "Set CSID Debug value :%lld", val);
+	return 0;
+}
+
+static int cam_ife_get_csid_debug(void *data, u64 *val)
+{
+	*val = g_ife_hw_mgr.debug_cfg.csid_debug;
+	CAM_INFO(CAM_ISP, "Get CSID Debug value :%lld",
+		g_ife_hw_mgr.debug_cfg.csid_debug);
+
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_ife_csid_debug,
+	cam_ife_get_csid_debug,
+	cam_ife_set_csid_debug, "%16llu");
+
+static int cam_ife_set_camif_debug(void *data, u64 val)
+{
+	g_ife_hw_mgr.debug_cfg.camif_debug = val;
+	CAM_DBG(CAM_ISP,
+		"Set camif enable_diag_sensor_status value :%lld", val);
+	return 0;
+}
+
+static int cam_ife_get_camif_debug(void *data, u64 *val)
+{
+	*val = g_ife_hw_mgr.debug_cfg.camif_debug;
+	CAM_DBG(CAM_ISP,
+		"Set camif enable_diag_sensor_status value :%lld",
+		g_ife_hw_mgr.debug_cfg.csid_debug);
+
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_ife_camif_debug,
+	cam_ife_get_camif_debug,
+	cam_ife_set_camif_debug, "%16llu");
+
+static int cam_ife_set_sfe_debug(void *data, u64 val)
+{
+	g_ife_hw_mgr.debug_cfg.sfe_debug = (uint32_t)val;
+	CAM_DBG(CAM_ISP, "Set SFE Debug value :%u",
+		g_ife_hw_mgr.debug_cfg.sfe_debug);
+	return 0;
+}
+
+static int cam_ife_get_sfe_debug(void *data, u64 *val)
+{
+	*val = (uint64_t)g_ife_hw_mgr.debug_cfg.sfe_debug;
+	CAM_DBG(CAM_ISP, "Get SFE Debug value :%u",
+		g_ife_hw_mgr.debug_cfg.sfe_debug);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_ife_sfe_debug,
+	cam_ife_get_sfe_debug,
+	cam_ife_set_sfe_debug, "%16llu");
+
+static int cam_ife_set_sfe_sensor_diag_debug(void *data, u64 val)
+{
+	g_ife_hw_mgr.debug_cfg.sfe_sensor_diag_cfg = (uint32_t)val;
+	CAM_DBG(CAM_ISP, "Set SFE Sensor diag value :%u",
+		g_ife_hw_mgr.debug_cfg.sfe_sensor_diag_cfg);
+	return 0;
+}
+
+static int cam_ife_get_sfe_sensor_diag_debug(void *data, u64 *val)
+{
+	*val = (uint64_t)g_ife_hw_mgr.debug_cfg.sfe_sensor_diag_cfg;
+	CAM_DBG(CAM_ISP, "Get SFE Sensor diag value :%u",
+		g_ife_hw_mgr.debug_cfg.sfe_sensor_diag_cfg);
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_ife_sfe_sensor_diag_debug,
+	cam_ife_get_sfe_sensor_diag_debug,
+	cam_ife_set_sfe_sensor_diag_debug, "%16llu");
+
+static int cam_ife_set_csid_rx_pkt_capture_debug(void *data, u64 val)
+{
+	if (val >= 0xFFFFF) {
+		g_ife_hw_mgr.debug_cfg.rx_capture_debug_set = false;
+		g_ife_hw_mgr.debug_cfg.rx_capture_debug = 0;
+	} else {
+		g_ife_hw_mgr.debug_cfg.rx_capture_debug_set = true;
+		g_ife_hw_mgr.debug_cfg.rx_capture_debug = val;
+	}
+
+	CAM_DBG(CAM_ISP, "Set CSID RX capture Debug value :%lld", val);
+	return 0;
+}
+
+static int cam_ife_get_csid_rx_pkt_capture_debug(void *data, u64 *val)
+{
+	*val = g_ife_hw_mgr.debug_cfg.rx_capture_debug;
+	CAM_DBG(CAM_ISP, "Get CSID RX capture Debug value :%lld",
+		g_ife_hw_mgr.debug_cfg.rx_capture_debug);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_ife_csid_rx_capture_debug,
+	cam_ife_get_csid_rx_pkt_capture_debug,
+	cam_ife_set_csid_rx_pkt_capture_debug, "%16llu");
+
+#ifdef CONFIG_CAM_TEST_IRQ_LINE
+static int __cam_ife_mgr_test_irq_line(struct cam_hw_intf *hw_intf, int *n_intf, int *n_success,
+	const char *hw_name, int idx)
+{
+	int rc = -EINVAL;
+
+	if (!hw_intf) {
+		CAM_ERR(CAM_ISP, "%s:%d hw-intf is null", hw_name, idx);
+		return -EINVAL;
+	}
+
+	(*n_intf)++;
+
+	if (hw_intf->hw_ops.test_irq_line)
+		rc = hw_intf->hw_ops.test_irq_line(hw_intf->hw_priv);
+
+	if (!rc) {
+		(*n_success)++;
+		CAM_INFO(CAM_ISP, "%s:%u IRQ line verified successfully", hw_name, hw_intf->hw_idx);
+	} else {
+		CAM_ERR(CAM_ISP, "%s:%u failed to verify IRQ line", hw_name, hw_intf->hw_idx);
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_test_irq_lines(struct cam_ife_hw_mgr *hw_mgr)
+{
+	int i, rc, n_intf = 0, n_success = 0;
+
+	for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		if (hw_mgr->csid_devices[i]) {
+			rc = __cam_ife_mgr_test_irq_line(hw_mgr->csid_devices[i], &n_intf,
+				&n_success, "CSID", i);
+		}
+	}
+
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (hw_mgr->ife_devices[i] && hw_mgr->ife_devices[i]->hw_intf) {
+			rc = __cam_ife_mgr_test_irq_line(hw_mgr->ife_devices[i]->hw_intf, &n_intf,
+				&n_success, "IFE", i);
+		}
+	}
+
+	for (i = 0; i < CAM_SFE_HW_NUM_MAX; i++) {
+		if (hw_mgr->sfe_devices[i] && hw_mgr->sfe_devices[i]->hw_intf) {
+			rc = __cam_ife_mgr_test_irq_line(hw_mgr->sfe_devices[i]->hw_intf, &n_intf,
+				&n_success, "SFE", i);
+		}
+	}
+
+	if (n_intf) {
+		if (n_intf == n_success)
+			CAM_INFO(CAM_ISP, "verified IRQ lines for all %d hw-intf", n_intf);
+		else
+			CAM_ERR(CAM_ISP, "verified %d/%d IRQ lines", n_success, n_intf);
+	} else {
+		CAM_ERR(CAM_ISP, "no valid hw-intf to test IRQ lines");
+	}
+
+	return 0;
+}
+#else
+static int cam_ife_mgr_test_irq_lines(struct cam_ife_hw_mgr *hw_mgr)
+{
+	return 0;
+}
+#endif
+
+#if (defined(CONFIG_CAM_TEST_IRQ_LINE) && defined(CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE))
+static int cam_ife_mgr_test_irq_lines_at_probe(struct cam_ife_hw_mgr *hw_mgr)
+{
+	return cam_ife_mgr_test_irq_lines(hw_mgr);
+}
+#else
+static int cam_ife_mgr_test_irq_lines_at_probe(struct cam_ife_hw_mgr *hw_mgr)
+{
+	return 0;
+}
+#endif
+
+static int cam_isp_set_test_irq_line(void *data, u64 val)
+{
+	cam_ife_mgr_test_irq_lines(&g_ife_hw_mgr);
+	return 0;
+}
+
+static int cam_isp_get_test_irq_line(void *data, u64 *val)
+{
+	*val = 0;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_isp_test_irq_line, cam_isp_get_test_irq_line,
+	cam_isp_set_test_irq_line, "%16llu");
+
+static ssize_t cam_ife_hw_mgr_perfcnt_write(
+	struct file *file, const char __user *ubuf,
+	size_t size, loff_t *loff_t)
+{
+	char *delimiter1, *delimiter2;
+	char input_buf[16] = {'\0'};
+	uint32_t counter_idx = 0, counter_val = 0;
+	struct cam_ife_hw_mgr_debug *debug_cfg = &g_ife_hw_mgr.debug_cfg;
+
+	if (size >= 16)
+		return -EINVAL;
+
+	if (copy_from_user(input_buf, ubuf, size))
+		return -EFAULT;
+
+	input_buf[size] = '\0';
+
+	if ((!g_ife_hw_mgr.isp_caps.num_ife_perf_counters) &&
+		(!g_ife_hw_mgr.isp_caps.num_sfe_perf_counters))
+		return -EBADF;
+
+	delimiter1 = strnchr(input_buf, size, '_');
+	if (!delimiter1)
+		goto end;
+
+	delimiter2 = strnchr(delimiter1 + 1, size, '_');
+	if (!delimiter2)
+		goto end;
+
+	/* separate the strings */
+	*delimiter1 = '\0';
+	*delimiter2 = '\0';
+
+	/* Find the counter index after the first delimiter */
+	if (kstrtou32(delimiter1 + 1, 0, &counter_idx))
+		goto end;
+
+	/* Find the counter value after the second delimiter */
+	if (kstrtou32(delimiter2 + 1, 0, &counter_val))
+		goto end;
+
+	/* Check for supported HWs */
+	if (strcmp(input_buf, "ife") == 0) {
+		/* check if counter is available for given target */
+		if ((counter_idx) && (counter_idx <= g_ife_hw_mgr.isp_caps.num_ife_perf_counters))
+			debug_cfg->ife_perf_counter_val[counter_idx - 1] =
+				counter_val;
+		else
+			goto end;
+	} else if (strcmp(input_buf, "sfe") == 0) {
+		if ((counter_idx) && (counter_idx <= g_ife_hw_mgr.isp_caps.num_sfe_perf_counters))
+			debug_cfg->sfe_perf_counter_val[counter_idx - 1] =
+				counter_val;
+		else
+			goto end;
+	} else {
+		goto end;
+	}
+
+	return size;
+
+end:
+	CAM_INFO(CAM_ISP,
+		"Failed to set perf counter debug setting - invalid input format [input: %s counter: %u counter_val: %u]",
+		input_buf, counter_idx, counter_val);
+	return -EINVAL;
+}
+
+static ssize_t cam_ife_hw_mgr_perfcnt_read(
+	struct file *file, char __user *ubuf,
+	size_t size, loff_t *loff_t)
+{
+	char display_string[256];
+	int len = 0;
+
+	len += scnprintf(display_string + len, (256 - len),
+		"\n***** ISP PERF COUNTERS *****\n\n");
+
+	if ((!g_ife_hw_mgr.isp_caps.num_ife_perf_counters) &&
+		(!g_ife_hw_mgr.isp_caps.num_sfe_perf_counters)) {
+		len += scnprintf(display_string + len, (256 - len), "NOT SUPPORTED\n\n");
+	} else {
+		len += scnprintf(display_string + len, (256 - len),
+			"Available counters IFE: %u SFE: %u\n\n",
+			g_ife_hw_mgr.isp_caps.num_ife_perf_counters,
+			g_ife_hw_mgr.isp_caps.num_sfe_perf_counters);
+		len += scnprintf(display_string + len, (256 - len),
+			"To choose counter write to same file - \"<hw>_<counter_index>_<reg_val>\"\nEx. \"ife_1_6619140\"\n\n");
+	}
+
+	scnprintf(display_string + len, (256 - len),
+		"*****************************\n");
+
+	return simple_read_from_buffer(ubuf, size, loff_t, display_string,
+		strlen(display_string));
+}
+
+static const struct file_operations cam_ife_hw_mgr_perfcnter_debug = {
+	.owner = THIS_MODULE,
+	.open  = simple_open,
+	.read  = cam_ife_hw_mgr_perfcnt_read,
+	.write = cam_ife_hw_mgr_perfcnt_write,
+};
+
+static int cam_ife_set_csid_testbus_debug(void *data, u64 val)
+{
+	g_ife_hw_mgr.debug_cfg.csid_test_bus = val;
+	CAM_DBG(CAM_ISP, "Set CSID test bus value :%lld", val);
+	return 0;
+}
+
+static int cam_ife_get_csid_testbus_debug(void *data, u64 *val)
+{
+	*val = g_ife_hw_mgr.debug_cfg.csid_test_bus;
+	CAM_DBG(CAM_ISP, "Get CSID test bus value :%u",
+		g_ife_hw_mgr.debug_cfg.csid_test_bus);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_ife_csid_testbus_debug,
+	cam_ife_get_csid_testbus_debug,
+	cam_ife_set_csid_testbus_debug, "%16llu");
+
+static int cam_ife_hw_mgr_dump_irq_desc(struct cam_ife_hw_mgr *hw_mgr,
+	struct cam_isp_irq_inject_param *param)
+{
+	int rc = 0;
+
+	switch (param->hw_type) {
+	case CAM_ISP_HW_TYPE_CSID:
+		rc = cam_ife_hw_mgr_csid_irq_inject_or_dump_desc(
+			hw_mgr, param, true);
+		break;
+	case CAM_ISP_HW_TYPE_VFE:
+		rc = cam_ife_hw_mgr_vfe_irq_inject_or_dump_desc(
+			hw_mgr, param, true);
+		break;
+	case CAM_ISP_HW_TYPE_SFE:
+		rc = cam_ife_hw_mgr_sfe_irq_inject_or_dump_desc(
+			hw_mgr, param, true);
+		break;
+	default:
+		strlcat(irq_inject_display_buf, "No matched HW_TYPE\n", IRQ_INJECT_DISPLAY_BUF_LEN);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	return rc;
+}
+
+static void cam_ife_hw_mgr_dump_active_hw(char *buffer, int *offset)
+{
+	uint32_t i;
+	struct cam_ife_hw_concrete_ctx  *c_ctx;
+	struct cam_ife_hw_concrete_ctx  *c_ctx_temp;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res_temp;
+
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	if (list_empty(&g_ife_hw_mgr.used_ctx_list)) {
+		*offset += scnprintf(buffer + *offset, LINE_BUFFER_LEN - *offset,
+			"Currently no ctx in use\n");
+		mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+		return;
+	}
+
+	list_for_each_entry_safe(c_ctx, c_ctx_temp,
+		&g_ife_hw_mgr.used_ctx_list, list) {
+		list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+			&c_ctx->res_list_ife_csid, list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				*offset += scnprintf(buffer + *offset,
+					LINE_BUFFER_LEN - *offset,
+					"hw_type:CSID hw_idx:%d ctx id:%u res: %s\n",
+					hw_mgr_res->hw_res[i]->hw_intf->hw_idx, c_ctx->ctx_index,
+					hw_mgr_res->hw_res[i]->res_name);
+			}
+		}
+
+		list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+			&c_ctx->res_list_ife_src, list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				*offset += scnprintf(buffer + *offset,
+					LINE_BUFFER_LEN - *offset,
+					"hw_type:IFE hw_idx:%d ctx id:%u res: %s\n",
+					hw_mgr_res->hw_res[i]->hw_intf->hw_idx, c_ctx->ctx_index,
+					hw_mgr_res->hw_res[i]->res_name);
+			}
+		}
+
+		list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+			&c_ctx->res_list_sfe_src, list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				*offset += scnprintf(buffer + *offset,
+					LINE_BUFFER_LEN - *offset,
+					"hw_type:SFE hw_idx:%d ctx id:%u res: %s\n",
+					hw_mgr_res->hw_res[i]->hw_intf->hw_idx, c_ctx->ctx_index,
+					hw_mgr_res->hw_res[i]->res_name);
+			}
+		}
+	}
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+}
+
+static inline char *__cam_isp_irq_inject_reg_unit_to_name(int32_t reg_unit)
+{
+	switch (reg_unit) {
+	case CAM_ISP_CSID_TOP_REG:
+		return "CAM_ISP_CSID_TOP_REG";
+	case CAM_ISP_CSID_RX_REG:
+		return "CAM_ISP_CSID_RX_REG";
+	case CAM_ISP_CSID_PATH_IPP_REG:
+		return "CAM_ISP_CSID_PATH_IPP_REG";
+	case CAM_ISP_CSID_PATH_PPP_REG:
+		return "CAM_ISP_CSID_PATH_PPP_REG";
+	case CAM_ISP_CSID_PATH_RDI0_REG:
+		return "CAM_ISP_CSID_PATH_RDI0_REG";
+	case CAM_ISP_CSID_PATH_RDI1_REG:
+		return "CAM_ISP_CSID_PATH_RDI1_REG";
+	case CAM_ISP_CSID_PATH_RDI2_REG:
+		return "CAM_ISP_CSID_PATH_RDI2_REG";
+	case CAM_ISP_CSID_PATH_RDI3_REG:
+		return "CAM_ISP_CSID_PATH_RDI3_REG";
+	case CAM_ISP_CSID_PATH_RDI4_REG:
+		return "CAM_ISP_CSID_PATH_RDI4_REG";
+	case CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG:
+		return "CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG";
+	case CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_1_REG:
+		return "CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_1_REG";
+	case CAM_ISP_SFE_0_BUS_RD_INPUT_IF_IRQ_SET_REG:
+		return "CAM_ISP_SFE_0_BUS_RD_INPUT_IF_IRQ_SET_REG";
+	case CAM_ISP_SFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG:
+		return "CAM_ISP_SFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG";
+	default:
+		return "Invalid reg_unit";
+	}
+}
+
+static inline char *__cam_isp_irq_inject_hw_type_to_name(int32_t hw_type)
+{
+	switch (hw_type) {
+	case CAM_ISP_HW_TYPE_CSID:
+		return "CSID";
+	case CAM_ISP_HW_TYPE_VFE:
+		return "VFE";
+	case CAM_ISP_HW_TYPE_SFE:
+		return "SFE";
+	default:
+		return "Invalid hw_type";
+	}
+}
+
+static inline int cam_isp_irq_inject_get_hw_type(
+	int32_t *hw_type, char *token)
+{
+	if (strcmp(token, "CSID") == 0)
+		*hw_type = CAM_ISP_HW_TYPE_CSID;
+	else if (strcmp(token, "VFE") == 0)
+		*hw_type = CAM_ISP_HW_TYPE_VFE;
+	else if (strcmp(token, "SFE") == 0)
+		*hw_type = CAM_ISP_HW_TYPE_SFE;
+	else
+		return -EINVAL;
+
+	return 0;
+}
+
+static int cam_isp_irq_inject_parse_common_params(
+	struct cam_isp_irq_inject_param  *irq_inject_param,
+	uint32_t param_index, char *token, bool *is_query)
+{
+	int i, rc = 0, offset = 0;
+	char *line_buf = NULL;
+
+	line_buf = kzalloc(sizeof(char) * LINE_BUFFER_LEN, GFP_KERNEL);
+	if (!line_buf)
+		return -ENOMEM;
+
+	switch (param_index) {
+	case HW_TYPE:
+		if (strnstr(token, "?", 1)) {
+			*is_query = true;
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Interruptable HW : CSID | IFE | SFE\n");
+			break;
+		}
+		rc = cam_isp_irq_inject_get_hw_type(&irq_inject_param->hw_type, token);
+		if (rc) {
+			irq_inject_param->hw_type = -1;
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Invalid camera hardware [ %s ]\n", token);
+		}
+		break;
+	case HW_IDX:
+		if (strnstr(token, "?", 1)) {
+			*is_query = true;
+			if (irq_inject_param->hw_type == -1) {
+				offset += scnprintf(line_buf + offset,
+					LINE_BUFFER_LEN - offset,
+					"HW_IDX : Enter hw_type first\n");
+				break;
+			}
+			switch (irq_inject_param->hw_type) {
+			case CAM_ISP_HW_TYPE_CSID:
+				for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+					if (!g_ife_hw_mgr.csid_devices[i])
+						break;
+				}
+				offset += scnprintf(line_buf + offset,
+					LINE_BUFFER_LEN - offset,
+					"Max index of CSID : %d\n", i - 1);
+				break;
+			case CAM_ISP_HW_TYPE_VFE:
+				for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+					if (!g_ife_hw_mgr.ife_devices[i])
+						break;
+				}
+				offset += scnprintf(line_buf + offset,
+					LINE_BUFFER_LEN - offset,
+					"Max index of VFE : %d\n", i - 1);
+				break;
+			case CAM_ISP_HW_TYPE_SFE:
+				for (i = 0; i < CAM_SFE_HW_NUM_MAX; i++) {
+					if (!g_ife_hw_mgr.sfe_devices[i])
+						break;
+				}
+				offset += scnprintf(line_buf + offset,
+					LINE_BUFFER_LEN - offset,
+					"Max index of SFE : %d\n", i - 1);
+				break;
+			default:
+				break;
+			}
+		} else if (kstrtou32(token, 0, &irq_inject_param->hw_idx)) {
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Invalid hw index %s\n", token);
+			rc = -EINVAL;
+		}
+		break;
+	case REG_UNIT:
+		if (strnstr(token, "?", 1)) {
+			*is_query = true;
+			if (irq_inject_param->hw_type == -1) {
+				offset += scnprintf(line_buf + offset,
+					LINE_BUFFER_LEN - offset,
+					"REG_UNIT : Enter hw_type first\n");
+				break;
+			}
+
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Printing available res for hw_type: %s\n",
+				__cam_isp_irq_inject_hw_type_to_name(
+					irq_inject_param->hw_type));
+			for (i = 0; i < CAM_ISP_REG_UNIT_MAX; i++) {
+				if ((irq_inject_param->hw_type == CAM_ISP_HW_TYPE_CSID) &&
+					i > CAM_ISP_CSID_PATH_RDI4_REG)
+					continue;
+				else if ((irq_inject_param->hw_type == CAM_ISP_HW_TYPE_VFE) &&
+					((i < CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG) ||
+					(i > CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_1_REG)))
+					continue;
+				else if ((irq_inject_param->hw_type == CAM_ISP_HW_TYPE_SFE) &&
+					((i < CAM_ISP_SFE_0_BUS_RD_INPUT_IF_IRQ_SET_REG) ||
+					(i > CAM_ISP_SFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG)))
+					continue;
+
+				offset += scnprintf(line_buf + offset,
+					LINE_BUFFER_LEN - offset, "%d : %s\n", i,
+					__cam_isp_irq_inject_reg_unit_to_name(i));
+			}
+
+		} else if (kstrtou32(token, 0, &irq_inject_param->reg_unit)) {
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Invalid register %s\n", token);
+			rc = -EINVAL;
+		}
+		break;
+	case IRQ_MASK:
+		if (strnstr(token, "?", 1)) {
+			*is_query = true;
+			if ((irq_inject_param->hw_type == -1) ||
+				(irq_inject_param->reg_unit == -1)) {
+				offset += scnprintf(line_buf + offset,
+					LINE_BUFFER_LEN - offset,
+					"IRQ_MASK : Enter hw_type and reg_unit first\n");
+				break;
+			}
+			if (cam_ife_hw_mgr_dump_irq_desc(&g_ife_hw_mgr,
+				irq_inject_param)) {
+				offset += scnprintf(line_buf + offset,
+					LINE_BUFFER_LEN - offset,
+					"Dump irq description failed\n");
+				rc = -EINVAL;
+			}
+		} else if (kstrtou32(token, 0, &irq_inject_param->irq_mask)) {
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Invalid irq mask %s\n", token);
+			rc = -EINVAL;
+		}
+		break;
+	case INJECT_REQ:
+		if (strnstr(token, "now", 3)) {
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Trigger IRQ now\n");
+			irq_inject_param->req_id = 0xFFFFFFFF;
+		} else if (kstrtou64(token, 0, &irq_inject_param->req_id)) {
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Invalid request id %s\n", token);
+			rc = -EINVAL;
+		}
+		break;
+	default:
+		offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+			"Invalid extra parameter: %s\n", token);
+		 rc = -EINVAL;
+	}
+
+	if (offset <= LINE_BUFFER_LEN)
+		strlcat(irq_inject_display_buf, line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+
+	kfree(line_buf);
+	return rc;
+}
+
+static int cam_isp_irq_inject_command_parser(
+	struct cam_isp_irq_inject_param  *irq_inject_param,
+	char **msg, uint32_t max_params,
+	cam_isp_irq_inject_cmd_parse_handler cmd_parse_cb,
+	bool *is_query)
+{
+	char *token = NULL;
+	char *line_buf = NULL;
+	int rc, param_index = 0, offset = 0;
+
+	line_buf = kzalloc(sizeof(char) * LINE_BUFFER_LEN, GFP_KERNEL);
+	if (!line_buf)
+		return -ENOMEM;
+
+	token = strsep(msg, ":");
+	while (token != NULL) {
+		rc = cmd_parse_cb(irq_inject_param, param_index, token, is_query);
+		if (rc) {
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Parsed Command failed rc: %d\n", rc);
+			goto end;
+		}
+
+		param_index++;
+		if (param_index == max_params)
+			break;
+		token = strsep(msg, ":");
+	}
+
+	if ((param_index < max_params) && !(*is_query)) {
+		offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+			"Insufficient parameters passed for total parameters: %u\n",
+			param_index);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (offset <= LINE_BUFFER_LEN)
+		strlcat(irq_inject_display_buf, line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+
+	rc = param_index;
+end:
+	kfree(line_buf);
+	return rc;
+}
+
+static ssize_t cam_isp_irq_injection_read(struct file *file,
+	char __user *ubuf,
+	size_t size, loff_t *ppos)
+{
+	int i, offset = 0;
+	int count = 0;
+	uint32_t hw_type = 0;
+	char *line_buf = NULL;
+
+	line_buf = kzalloc(sizeof(char) * LINE_BUFFER_LEN, GFP_KERNEL);
+	if (!line_buf)
+		return -ENOMEM;
+
+	if (!(*ppos) && strlen(irq_inject_display_buf))
+		goto end;
+	else if ((*ppos) && (strlen(irq_inject_display_buf) == 0)) {
+		kfree(line_buf);
+		return 0;
+	}
+
+	strlcat(irq_inject_display_buf, IRQ_INJECT_USAGE_STRING, IRQ_INJECT_DISPLAY_BUF_LEN);
+
+	for (i = 0; i < MAX_INJECT_SET; i++) {
+		if (!g_ife_hw_mgr.irq_inject_param[i].is_valid)
+			continue;
+
+		hw_type = g_ife_hw_mgr.irq_inject_param[i].hw_type;
+		offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+			"injected param[%d] : hw_type:%s hw_idx:%d reg_unit:%d irq_mask:%#x req_id:%d\n",
+			i, __cam_isp_irq_inject_hw_type_to_name(hw_type),
+			g_ife_hw_mgr.irq_inject_param[i].hw_idx,
+			g_ife_hw_mgr.irq_inject_param[i].reg_unit,
+			g_ife_hw_mgr.irq_inject_param[i].irq_mask,
+			g_ife_hw_mgr.irq_inject_param[i].req_id);
+	}
+
+	cam_ife_hw_mgr_dump_active_hw(line_buf, &offset);
+
+	strlcat(irq_inject_display_buf, line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+
+end:
+	if (clear_user(ubuf, size)) {
+		kfree(line_buf);
+		return -EIO;
+	}
+	count = simple_read_from_buffer(ubuf, size, ppos, irq_inject_display_buf,
+		strlen(irq_inject_display_buf));
+
+	memset(irq_inject_display_buf, '\0', IRQ_INJECT_DISPLAY_BUF_LEN);
+	kfree(line_buf);
+	return count;
+}
+
+static ssize_t cam_isp_irq_injection_write(struct file *file,
+	const char __user *ubuf, size_t size, loff_t *ppos)
+{
+	bool is_query = false;
+	int i, rc = 0;
+	int offset = 0;
+	uint32_t hw_type = 0;
+	char *msg = NULL;
+	char *line_buf = NULL;
+	char input_buf[LINE_BUFFER_LEN] = {'\0'};
+
+	line_buf = kzalloc(sizeof(char) * LINE_BUFFER_LEN, GFP_KERNEL);
+	if (!line_buf)
+		return -ENOMEM;
+
+	memset(irq_inject_display_buf, '\0', IRQ_INJECT_DISPLAY_BUF_LEN);
+
+	if (copy_from_user(input_buf, ubuf, sizeof(input_buf))) {
+		rc = -EFAULT;
+		goto end;
+	}
+
+	msg = input_buf;
+
+	for (i = 0; i < MAX_INJECT_SET; i++) {
+		if (g_ife_hw_mgr.irq_inject_param[i].is_valid)
+			continue;
+
+		rc = cam_isp_irq_inject_command_parser(
+			&g_ife_hw_mgr.irq_inject_param[i], &msg,
+			MAX_PARAMS_FOR_IRQ_INJECT,
+			cam_isp_irq_inject_parse_common_params, &is_query);
+		if ((rc != MAX_PARAMS_FOR_IRQ_INJECT) || is_query) {
+			cam_isp_irq_inject_clear_params(&g_ife_hw_mgr.irq_inject_param[i]);
+			if (!is_query)
+				offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+					"Parsed Command failed, param_index = %d\n", rc);
+		} else {
+			g_ife_hw_mgr.irq_inject_param[i].is_valid = true;
+			hw_type = g_ife_hw_mgr.irq_inject_param[i].hw_type;
+			offset += scnprintf(line_buf + offset, LINE_BUFFER_LEN - offset,
+				"Setting param[%d] : hw_type:%s hw_idx:%d reg_unit:%d irq_mask:%#x req_id:%d\n",
+				i, __cam_isp_irq_inject_hw_type_to_name(hw_type),
+				g_ife_hw_mgr.irq_inject_param[i].hw_idx,
+				g_ife_hw_mgr.irq_inject_param[i].reg_unit,
+				g_ife_hw_mgr.irq_inject_param[i].irq_mask,
+				g_ife_hw_mgr.irq_inject_param[i].req_id);
+		}
+		break;
+	}
+
+	if (offset <= LINE_BUFFER_LEN)
+		strlcat(irq_inject_display_buf, line_buf, IRQ_INJECT_DISPLAY_BUF_LEN);
+
+	rc = size;
+end:
+	kfree(line_buf);
+	return rc;
+}
+
+static const struct file_operations cam_isp_irq_injection = {
+	.owner = THIS_MODULE,
+	.open  = simple_open,
+	.read  = cam_isp_irq_injection_read,
+	.write = cam_isp_irq_injection_write,
+};
+
+static int cam_ife_hw_mgr_debug_register(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("ife", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_ISP,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	g_ife_hw_mgr.debug_cfg.dentry = dbgfileptr;
+
+	debugfs_create_file("ife_csid_debug", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_csid_debug);
+	debugfs_create_file("ife_csid_rx_capture_debug", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_csid_rx_capture_debug);
+	debugfs_create_u32("enable_recovery", 0644, g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.enable_recovery);
+	debugfs_create_bool("enable_req_dump", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.enable_req_dump);
+	debugfs_create_u32("enable_csid_recovery", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.enable_csid_recovery);
+	debugfs_create_file("ife_camif_debug", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_camif_debug);
+	debugfs_create_bool("per_req_reg_dump", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.per_req_reg_dump);
+	debugfs_create_bool("disable_ubwc_comp", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.disable_ubwc_comp);
+	debugfs_create_file("sfe_debug", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_sfe_debug);
+	debugfs_create_file("sfe_sensor_diag_sel", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_sfe_sensor_diag_debug);
+	debugfs_create_bool("disable_ife_mmu_prefetch", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.disable_ife_mmu_prefetch);
+	debugfs_create_bool("enable_ife_frame_irqs", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.enable_ife_frame_irqs);
+	debugfs_create_file("sfe_cache_debug", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_sfe_cache_debug);
+	debugfs_create_file("test_irq_line", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_isp_test_irq_line);
+	debugfs_create_file("isp_perf_counters", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_hw_mgr_perfcnter_debug);
+	debugfs_create_file("ife_csid_testbus", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_csid_testbus_debug);
+	debugfs_create_bool("disable_isp_drv", 0644, g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.disable_isp_drv);	debugfs_create_bool("enable_presil_reg_dump", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.enable_presil_reg_dump);
+	debugfs_create_file("isp_irq_inject", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_isp_irq_injection);
+	debugfs_create_bool("enable_cdm_cmd_check", 0644, g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.enable_cdm_cmd_check);
+end:
+	g_ife_hw_mgr.debug_cfg.enable_csid_recovery = 1;
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_cam_ife_worker(struct work_struct *w)
+{
+
+	cam_req_mgr_process_workq(w);
+}
+
+static unsigned long cam_ife_hw_mgr_mini_dump_cb(void *dst, unsigned long len,
+	void *priv_data)
+{
+	struct cam_ife_hw_mini_dump_data   *mgr_md;
+	struct cam_ife_hw_mini_dump_ctx    *ctx_md;
+	struct cam_ife_hw_concrete_ctx     *c_ctx_temp;
+	struct cam_ife_hw_concrete_ctx     *c_ctx;
+	uint32_t                            j;
+	uint32_t                            hw_idx = 0;
+	struct cam_hw_intf                 *hw_intf = NULL;
+	struct cam_ife_hw_mgr              *hw_mgr;
+	struct cam_hw_mini_dump_args        hw_dump_args;
+	unsigned long                       remain_len = len;
+	unsigned long                       dumped_len = 0;
+	uint32_t                            i = 0;
+	int                                 rc = 0;
+
+	if (len < sizeof(*mgr_md)) {
+		CAM_ERR(CAM_ISP, "Insufficent received length: %u",
+			len);
+		return 0;
+	}
+
+	mgr_md = (struct cam_ife_hw_mini_dump_data *)dst;
+	mgr_md->num_ctx = 0;
+	hw_mgr = &g_ife_hw_mgr;
+	dumped_len += sizeof(*mgr_md);
+	remain_len -= dumped_len;
+
+	list_for_each_entry_safe(c_ctx, c_ctx_temp,
+		&hw_mgr->used_ctx_list, list) {
+
+		if (remain_len < sizeof(*ctx_md)) {
+			CAM_ERR(CAM_ISP,
+			"Insufficent received length: %u, dumped_len %u",
+			len, dumped_len);
+			goto end;
+		}
+
+		ctx_md = (struct cam_ife_hw_mini_dump_ctx *)
+				((uint8_t *)dst + dumped_len);
+		mgr_md->ctx[i] = ctx_md;
+		ctx_md->ctx_index = c_ctx->ctx_index;
+		ctx_md->left_hw_idx = c_ctx->left_hw_idx;
+		ctx_md->right_hw_idx = c_ctx->right_hw_idx;
+		ctx_md->cdm_handle = c_ctx->cdm_handle;
+		ctx_md->num_base = c_ctx->num_base;
+		ctx_md->cdm_id = c_ctx->cdm_id;
+		ctx_md->last_cdm_done_req = c_ctx->last_cdm_done_req;
+		ctx_md->applied_req_id = c_ctx->applied_req_id;
+		ctx_md->ctx_type = c_ctx->ctx_type;
+		ctx_md->overflow_pending =
+			atomic_read(&c_ctx->overflow_pending);
+		ctx_md->cdm_done = atomic_read(&c_ctx->cdm_done);
+		memcpy(&ctx_md->pf_info, &c_ctx->pf_info,
+			sizeof(struct cam_ife_hw_mgr_ctx_pf_info));
+		memcpy(&ctx_md->flags, &c_ctx->flags,
+			sizeof(struct cam_ife_hw_mgr_ctx_flags));
+
+		dumped_len += sizeof(*ctx_md);
+
+		for (j = 0; j < c_ctx->num_base; j++) {
+			memcpy(&ctx_md->base[j], &c_ctx->base[j],
+				sizeof(struct cam_isp_ctx_base_info));
+			hw_idx = c_ctx->base[j].idx;
+			if (c_ctx->base[j].hw_type == CAM_ISP_HW_TYPE_CSID) {
+				hw_intf = hw_mgr->csid_devices[hw_idx];
+				ctx_md->csid_md[hw_idx] = (void *)((uint8_t *)dst + dumped_len);
+				memset(&hw_dump_args, 0, sizeof(hw_dump_args));
+				hw_dump_args.start_addr = ctx_md->csid_md[hw_idx];
+				hw_dump_args.len = remain_len;
+				hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+					CAM_ISP_HW_CSID_MINI_DUMP, &hw_dump_args,
+					sizeof(hw_dump_args));
+				if (hw_dump_args.bytes_written == 0)
+					goto end;
+				dumped_len += hw_dump_args.bytes_written;
+				remain_len = len - dumped_len;
+			} else if (c_ctx->base[j].hw_type ==
+				CAM_ISP_HW_TYPE_VFE) {
+				hw_intf = hw_mgr->ife_devices[hw_idx]->hw_intf;
+				ctx_md->vfe_md[hw_idx] = (void *)((uint8_t *)dst + dumped_len);
+				memset(&hw_dump_args, 0, sizeof(hw_dump_args));
+				hw_dump_args.start_addr = ctx_md->vfe_md[hw_idx];
+				hw_dump_args.len = remain_len;
+				hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+					CAM_ISP_HW_IFE_BUS_MINI_DUMP, &hw_dump_args,
+					sizeof(hw_dump_args));
+				if (hw_dump_args.bytes_written == 0)
+					goto end;
+				dumped_len += hw_dump_args.bytes_written;
+				remain_len = len - dumped_len;
+			} else if (c_ctx->base[j].hw_type ==
+				CAM_ISP_HW_TYPE_SFE) {
+				hw_intf = hw_mgr->sfe_devices[hw_idx]->hw_intf;
+				ctx_md->sfe_md[hw_idx] = (void *)((uint8_t *)dst + dumped_len);
+				memset(&hw_dump_args, 0, sizeof(hw_dump_args));
+				hw_dump_args.start_addr = ctx_md->sfe_md[hw_idx];
+				hw_dump_args.len = remain_len;
+				hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+					CAM_ISP_HW_SFE_BUS_MINI_DUMP, &hw_dump_args,
+					sizeof(hw_dump_args));
+				if (hw_dump_args.bytes_written == 0)
+					goto end;
+				dumped_len += hw_dump_args.bytes_written;
+				remain_len = len - dumped_len;
+			}
+		}
+
+		if (c_ctx->common.mini_dump_cb) {
+			hw_dump_args.start_addr = (void *)((uint8_t *)dst + dumped_len);
+			hw_dump_args.len = remain_len;
+			hw_dump_args.bytes_written = 0;
+			rc = c_ctx->common.mini_dump_cb(c_ctx->common.cb_priv, &hw_dump_args);
+			if (rc || (hw_dump_args.bytes_written + dumped_len > len))
+				goto end;
+
+			ctx_md->ctx_priv = hw_dump_args.start_addr;
+			dumped_len += hw_dump_args.bytes_written;
+			remain_len = len - dumped_len;
+		}
+
+		i++;
+	}
+end:
+	mgr_md->num_ctx = i;
+	return dumped_len;
+}
+
+static void cam_ife_hw_mgr_attach_sfe_sys_cache_id(
+	bool shared, uint32_t type, uint32_t *hw_id, uint32_t num_sfe)
+{
+	int i;
+
+	if (shared) {
+		for (i = 0; i < num_sfe; i++) {
+			g_ife_hw_mgr.sfe_cache_info[i].supported_scid_idx |= BIT(type);
+			CAM_DBG(CAM_ISP, "SFE[%u] shared scid %d type %u", i,
+				g_ife_hw_mgr.sys_cache_info[type].scid, type);
+		}
+	} else {
+		g_ife_hw_mgr.sfe_cache_info[*hw_id].supported_scid_idx |= BIT(type);
+		CAM_DBG(CAM_ISP, "SFE[%u] non-shared cache_type %d, type %u", *hw_id,
+			g_ife_hw_mgr.sys_cache_info[type].scid, type);
+		*hw_id = (*hw_id + 1) % num_sfe;
+	}
+}
+
+static int cam_ife_mgr_populate_sys_cache_id(void)
+{
+	int                             i, scid, j;
+	uint32_t                        hw_id = 0;
+	uint32_t                        num_small_scid = 0;
+	uint32_t                        num_large_scid = 0;
+	uint32_t                        num_sfe = 0;
+	bool                            shared;
+	int rc = 0;
+
+	/* Populate sys cache info */
+	g_ife_hw_mgr.num_caches_found = 0;
+	for (i = 0; i < CAM_SFE_HW_NUM_MAX && g_ife_hw_mgr.sfe_devices[i]; i++) {
+		g_ife_hw_mgr.sfe_cache_info[i].supported_scid_idx = 0;
+		num_sfe++;
+		for (j = 0; j < CAM_ISP_EXPOSURE_MAX; j++) {
+			g_ife_hw_mgr.sfe_cache_info[i].activated[j] = false;
+			g_ife_hw_mgr.sfe_cache_info[i].curr_idx[j] = -1;
+		}
+	}
+
+	if (!num_sfe)
+		return rc;
+
+	for (i = CAM_LLCC_SMALL_1; i < CAM_LLCC_MAX; i++) {
+		scid = cam_cpas_get_scid(i);
+		g_ife_hw_mgr.sys_cache_info[i].scid = scid;
+		g_ife_hw_mgr.sys_cache_info[i].type = i;
+		if (scid < 0)
+			continue;
+
+		switch (i) {
+		case CAM_LLCC_SMALL_1:
+		case CAM_LLCC_SMALL_2:
+			num_small_scid++;
+			break;
+		case CAM_LLCC_LARGE_1:
+		case CAM_LLCC_LARGE_2:
+		case CAM_LLCC_LARGE_3:
+		case CAM_LLCC_LARGE_4:
+			num_large_scid++;
+			break;
+		default:
+			break;
+		}
+		g_ife_hw_mgr.num_caches_found++;
+	}
+
+	/* Distribute the smaller cache-ids */
+	shared = (bool)(num_small_scid % num_sfe);
+	for (i = 0; i < num_small_scid; i++) {
+		if (g_ife_hw_mgr.sys_cache_info[i].scid < 0)
+			continue;
+		cam_ife_hw_mgr_attach_sfe_sys_cache_id(shared,
+			g_ife_hw_mgr.sys_cache_info[i].type, &hw_id, num_sfe);
+	}
+
+	/* Distribute the large cache-ids */
+	shared = (bool)(num_large_scid % num_sfe);
+	hw_id = 0;
+	for (i = CAM_LLCC_LARGE_1; i < CAM_LLCC_MAX; i++) {
+		if (g_ife_hw_mgr.sys_cache_info[i].scid < 0)
+			continue;
+		cam_ife_hw_mgr_attach_sfe_sys_cache_id(shared,
+			g_ife_hw_mgr.sys_cache_info[i].type, &hw_id, num_sfe);
+		g_ife_hw_mgr.sys_cache_info[i].llcc_staling_support = false;
+		rc = cam_cpas_configure_staling_llcc(i,
+				CAM_LLCC_STALING_MODE_NOTIFY,
+				CAM_LLCC_NOTIFY_STALING_EVICT,
+				1);
+		if ((num_large_scid == 1) && (num_large_scid < num_sfe) &&
+			(rc == -EOPNOTSUPP)) {
+			CAM_ERR(CAM_ISP,
+			"Fatal error llcc staling feature is not supported cache: %d", i);
+			rc = -EFAULT;
+		} else if (!rc && num_large_scid > 1) {
+			CAM_ERR(CAM_ISP,
+			"Fatal error llcc staling feature is supported more large cache %d", i);
+			rc = -EFAULT;
+		} else if (rc == -EOPNOTSUPP) {
+			CAM_ERR(CAM_ISP,
+			"llcc staling feature is not supported cache: %d", i);
+		} else if (rc) {
+			CAM_ERR(CAM_ISP,
+			"llcc staling feature enabling failing cache: %d", i);
+		} else {
+			CAM_INFO(CAM_ISP,
+			"llcc staling feature supported: %d rc = %d", i, rc);
+			g_ife_hw_mgr.sys_cache_info[i].llcc_staling_support = true;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Num SCIDs Small:%u Large: %u", num_small_scid, num_large_scid);
+	for (i = 0; i < num_sfe; i++)
+		CAM_DBG(CAM_ISP, "SFE[%u] available SCIDs 0x%x", i,
+			g_ife_hw_mgr.sfe_cache_info[i].supported_scid_idx);
+	return rc;
+
+}
+
+static int cam_ife_mgr_v_get_hw_caps(void *hw_mgr_priv, void *hw_caps_args)
+{
+	return cam_ife_mgr_get_hw_caps(hw_mgr_priv, hw_caps_args);
+}
+
+static int cam_ife_mgr_check_fe_v0(
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size,
+	bool *is_fe_enabled)
+{
+	int i;
+	struct cam_isp_in_port_info       *in_port = NULL;
+	uint32_t                           in_port_length = 0;
+	uint32_t                           total_in_port_length = 0;
+
+	*is_fe_enabled = false;
+	if (acquire_hw_info->input_info_offset >=
+		acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP,
+			"Invalid size offset 0x%x is greater then size 0x%x",
+			acquire_hw_info->input_info_offset,
+			acquire_hw_info->input_info_size);
+		return -EINVAL;
+	}
+
+	in_port = (struct cam_isp_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+
+		if (((uint8_t *)in_port +
+			sizeof(struct cam_isp_in_port_info)) >
+			((uint8_t *)acquire_hw_info +
+			acquire_info_size)) {
+			CAM_ERR(CAM_ISP, "Invalid size");
+			return -EINVAL;
+		}
+
+		if ((in_port->num_out_res > (max_ife_out_res +
+			max_sfe_out_res)) ||
+			(in_port->num_out_res <= 0)) {
+			CAM_ERR(CAM_ISP, "Invalid num output res %u",
+				in_port->num_out_res);
+			return -EINVAL;
+		}
+
+		in_port_length = sizeof(struct cam_isp_in_port_info) +
+			(in_port->num_out_res - 1) *
+			sizeof(struct cam_isp_out_port_info);
+		total_in_port_length += in_port_length;
+
+		if (total_in_port_length > acquire_hw_info->input_info_size) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough");
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ISP, "in_port%d res_type %d", i,
+			in_port->res_type);
+		if (in_port->res_type == CAM_ISP_IFE_IN_RES_RD) {
+			*is_fe_enabled = true;
+			break;
+		}
+
+		in_port = (struct cam_isp_in_port_info *)((uint8_t *)in_port +
+			in_port_length);
+	}
+	CAM_DBG(CAM_ISP, "is_fe_enabled %d", *is_fe_enabled);
+
+	return 0;
+}
+
+static int cam_ife_mgr_check_fe_v2(
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size,
+	bool                              *is_fe_enabled,
+	bool                              *is_offline,
+	struct cam_ife_mgr_bw_data        *bw_data)
+{
+	int i;
+	bool is_sfe_rd = false, fetch_cfg = false;
+	struct cam_isp_in_port_info_v2    *in_port = NULL;
+	uint32_t                           in_port_length = 0;
+	uint32_t                           total_in_port_length = 0;
+
+	if (acquire_hw_info->input_info_offset >=
+		acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP,
+			"Invalid size offset 0x%x is greater then size 0x%x",
+			acquire_hw_info->input_info_offset,
+			acquire_hw_info->input_info_size);
+		return -EINVAL;
+	}
+
+	*is_fe_enabled = false;
+	*is_offline = false;
+	in_port = (struct cam_isp_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+
+		if (((uint8_t *)in_port +
+			sizeof(struct cam_isp_in_port_info)) >
+			((uint8_t *)acquire_hw_info +
+			acquire_info_size)) {
+			CAM_ERR(CAM_ISP, "Invalid size");
+			return -EINVAL;
+		}
+
+		if ((in_port->num_out_res > (max_ife_out_res +
+			max_sfe_out_res)) ||
+			(in_port->num_out_res <= 0)) {
+			CAM_ERR(CAM_ISP, "Invalid num output res %u",
+				in_port->num_out_res);
+			return -EINVAL;
+		}
+
+		in_port_length = sizeof(struct cam_isp_in_port_info_v2) +
+			(in_port->num_out_res - 1) *
+			sizeof(struct cam_isp_out_port_info_v2);
+		total_in_port_length += in_port_length;
+
+		if (total_in_port_length > acquire_hw_info->input_info_size) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough");
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ISP, "in_port%d res_type %d", i,
+			in_port->res_type);
+		is_sfe_rd = cam_ife_mgr_check_for_sfe_rd(in_port->sfe_in_path_type);
+		if ((!fetch_cfg) && ((in_port->res_type == CAM_ISP_IFE_IN_RES_RD) ||
+			(is_sfe_rd))) {
+
+			*is_fe_enabled = true;
+			if (in_port->offline_mode) {
+				*is_offline = true;
+				bw_data->format = in_port->format;
+				bw_data->width = in_port->left_width;
+				bw_data->height = in_port->height;
+				bw_data->framerate = in_port->ife_res_1;
+			}
+
+			/* If once configured skip these checks thereafter */
+			fetch_cfg = true;
+			break;
+		}
+
+		in_port = (struct cam_isp_in_port_info_v2 *)
+			((uint8_t *)in_port + in_port_length);
+	}
+	CAM_DBG(CAM_ISP, "is_fe_enabled %d is_offline %d",
+		*is_fe_enabled, *is_offline);
+
+	return 0;
+}
+
+static int cam_ife_mgr_check_fe(
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size,
+	bool                              *is_fe_enabled,
+	bool                              *is_offline,
+	struct cam_ife_mgr_bw_data        *bw_data)
+{
+	uint32_t major_ver = 0, minor_ver = 0;
+
+	if (acquire_hw_info == NULL)
+		return -EINVAL;
+
+	major_ver = (acquire_hw_info->common_info_version >> 12) & 0xF;
+	minor_ver = (acquire_hw_info->common_info_version) & 0xFFF;
+
+	switch (major_ver) {
+	case 1:
+		*is_offline = false;
+		return cam_ife_mgr_check_fe_v0(
+			acquire_hw_info, acquire_info_size,
+			is_fe_enabled);
+	case 2:
+		return cam_ife_mgr_check_fe_v2(
+			acquire_hw_info, acquire_info_size,
+			is_fe_enabled,
+			is_offline,
+			bw_data);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid ver of common info from user");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_ife_mgr_v_acquire(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	struct cam_hw_acquire_args     *acq_args_ptr =
+		(struct cam_hw_acquire_args *)acquire_hw_args;
+	struct cam_ife_hw_mgr_ctx      *ife_mgr_ctx = NULL;
+	struct cam_isp_acquire_hw_info *acquire_hw_info =
+		(struct cam_isp_acquire_hw_info *)acq_args_ptr->acquire_info;
+	struct cam_ife_hw_mgr          *ife_hw_mgr = hw_mgr_priv;
+	struct cam_ife_offline_hw      *acquired_hw_data;
+	bool is_fe, is_offline, allocated;
+	int i;
+	int rc = -1;
+	int ctx_idx;
+
+	if (!ife_hw_mgr) {
+		CAM_ERR(CAM_ISP, "ife hw mgr is NULL");
+		return -EINVAL;
+	}
+
+	if (!acquire_hw_info) {
+		CAM_ERR(CAM_ISP, "hw acquire info is NULL");
+		return -EINVAL;
+	}
+
+	ife_mgr_ctx = NULL;
+
+	if (!acq_args_ptr || acq_args_ptr->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ife_hw_mgr->ctx_mutex);
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		if (!ife_hw_mgr->virt_ctx_pool[i].ctx_in_use) {
+			ife_mgr_ctx = &ife_hw_mgr->virt_ctx_pool[i];
+			ife_mgr_ctx->ctx_in_use = true;
+			ife_mgr_ctx->ctx_idx = i;
+			ife_mgr_ctx->is_offline = false;
+			break;
+		}
+	}
+	mutex_unlock(&ife_hw_mgr->ctx_mutex);
+
+	if (i == CAM_CTX_MAX) {
+		CAM_ERR(CAM_ISP, "No free context!");
+		return -EINVAL;
+	}
+
+	rc = cam_ife_mgr_check_fe(acquire_hw_info,
+		acq_args_ptr->acquire_info_size, &is_fe, &is_offline,
+		&ife_mgr_ctx->bw_data);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error checking FE");
+		return rc;
+	}
+
+	ife_mgr_ctx->is_offline = is_offline;
+	CAM_INFO(CAM_ISP, "is FE %d Offline %d ctx id %d", is_fe, is_offline, ife_mgr_ctx->ctx_idx);
+
+	ife_mgr_ctx->cb_priv = acq_args_ptr->context_data;
+	for (i = 0; i < CAM_ISP_HW_EVENT_MAX; i++)
+		ife_mgr_ctx->event_cb[i] = acq_args_ptr->event_cb;
+
+	acq_args_ptr->ctxt_to_hw_map = ife_mgr_ctx;
+
+	if (is_offline) {
+		ife_mgr_ctx->unpacker_fmt = ife_mgr_ctx->bw_data.format &
+			CAM_IFE_DECODE_FORMAT_MASK;
+		allocated = false;
+		mutex_lock(&ife_hw_mgr->ctx_mutex);
+		ife_hw_mgr->offline_reconfig =
+			cam_ife_find_reconfig_required(hw_mgr_priv, ife_mgr_ctx);
+		ctx_idx =
+			atomic_read(&ife_hw_mgr->num_acquired_offline_ctx);
+		/* TODO: update the condition for allocating additional HWs */
+		if (ctx_idx <
+			cam_ife_mgr_required_hw(hw_mgr_priv, false)) {
+			mutex_unlock(&ife_hw_mgr->ctx_mutex);
+			rc =  cam_ife_mgr_acquire(hw_mgr_priv, acq_args_ptr);
+			if (rc) {
+				if (!ctx_idx) {
+					/* There is no available HW to use */
+					ife_mgr_ctx->ctx_in_use = true;
+					return rc;
+				}
+				ctx_idx--;
+
+			} else {
+				atomic_inc(
+					&ife_hw_mgr->num_acquired_offline_ctx);
+				allocated = true;
+			}
+		} else {
+			mutex_unlock(&ife_hw_mgr->ctx_mutex);
+		}
+
+		CAM_DBG(CAM_ISP, "total IFEs used %d ife instances for offline",
+				atomic_read(&ife_hw_mgr->num_acquired_offline_ctx));
+		if (allocated) {
+
+			acquired_hw_data =
+				&ife_hw_mgr->acquired_hw_pool[ctx_idx];
+			acquired_hw_data->ife_ctx =
+				ife_mgr_ctx->concr_ctx;
+			acquired_hw_data->ife_ctx->flags.is_offline = true;
+			acquired_hw_data->ife_ctx->offline_clk = 0;
+			acquired_hw_data->ife_ctx->offline_sfe_clk = 0;
+			acquired_hw_data->ife_ctx->waiting_start = false;
+			ife_mgr_ctx->hw_mgr = ife_mgr_ctx->concr_ctx->hw_mgr;
+
+			acquired_hw_data->valid_acquired_hw =
+				acq_args_ptr->valid_acquired_hw;
+			memcpy(&acquired_hw_data->acquired_hw_id,
+				acq_args_ptr->acquired_hw_id,
+				sizeof(acq_args_ptr->acquired_hw_id));
+			memcpy(
+			    ife_hw_mgr->acquired_hw_pool[0].acquired_hw_path,
+			    acq_args_ptr->acquired_hw_path,
+			    sizeof(acq_args_ptr->acquired_hw_path));
+
+			ife_hw_mgr->starting_offline_cnt++;
+		} else {
+			/* Offline multi camera currently supports only contexts
+			 * with same capabilities. because it forced to use the first
+			 * acquired hardware instance's struct as the other instance's
+			 * struct.
+			 */
+			acquired_hw_data = &ife_hw_mgr->acquired_hw_pool[0];
+			ife_mgr_ctx->concr_ctx = acquired_hw_data->ife_ctx;
+			ife_mgr_ctx->hw_mgr = acquired_hw_data->ife_ctx->hw_mgr;
+			ife_mgr_ctx->concr_ctx->hw_mgr =
+				acquired_hw_data->ife_ctx->hw_mgr;
+			cam_ife_mgr_acquire_offline_out(ife_mgr_ctx,
+				acq_args_ptr);
+			acq_args_ptr->valid_acquired_hw =
+				acquired_hw_data->valid_acquired_hw;
+			/* Should not be used for offline */
+			memcpy(acq_args_ptr->acquired_hw_id,
+				&acquired_hw_data->acquired_hw_id,
+				sizeof(acq_args_ptr->acquired_hw_id));
+			memcpy(
+				acq_args_ptr->acquired_hw_path,
+				acquired_hw_data->acquired_hw_path,
+				sizeof(acq_args_ptr->acquired_hw_path));
+		}
+	} else {
+		rc =  cam_ife_mgr_acquire(hw_mgr_priv, acquire_hw_args);
+		ife_mgr_ctx->is_offline = false;
+		ife_mgr_ctx->concr_ctx->flags.is_offline = false;
+		ife_mgr_ctx->concr_ctx->served_ctx_w = 0;
+		ife_mgr_ctx->concr_ctx->served_ctx_id[0] =
+			ife_mgr_ctx->ctx_idx;
+	}
+	return rc;
+}
+
+static int cam_ife_mgr_v_start_hw(void *hw_mgr_priv, void *start_hw_args)
+{
+	struct cam_isp_start_args        *start_isp = start_hw_args;
+	struct cam_ife_hw_mgr            *ife_hw_mgr = hw_mgr_priv;
+	struct cam_ife_hw_mgr_ctx        *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx   *c_ctx;
+	uint32_t i, num_ctx;
+
+	if (!hw_mgr_priv || !start_isp) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)
+		start_isp->hw_config.ctxt_to_hw_map;
+
+	mutex_lock(&ife_hw_mgr->ctx_mutex);
+
+	if (hw_mgr_ctx->is_offline) {
+		num_ctx = atomic_read(&ife_hw_mgr->num_acquired_offline_ctx);
+		for (i = 0; i < num_ctx; i++) {
+			c_ctx = ife_hw_mgr->acquired_hw_pool[i].ife_ctx;
+			if (c_ctx && atomic_read(&c_ctx->ctx_state) ==
+						CAM_IFE_HW_STATE_STOPPED) {
+				hw_mgr_ctx->concr_ctx = c_ctx;
+				atomic_set(&hw_mgr_ctx->concr_ctx->ctx_state,
+						CAM_IFE_HW_STATE_STARTING);
+				break;
+			}
+		}
+		/* All acquired offline hw concrete contexts are started, no more hw concrete context
+		* All contexts are started - no op
+		*/
+		if (i == num_ctx) {
+			mutex_unlock(&ife_hw_mgr->ctx_mutex);
+			return 0;
+		}
+	}
+
+	mutex_unlock(&ife_hw_mgr->ctx_mutex);
+
+	return cam_ife_mgr_start_hw(hw_mgr_priv, start_hw_args);
+}
+
+static int cam_ife_mgr_v_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
+{
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_ife_hw_mgr            *ife_hw_mgr = hw_mgr_priv;
+	struct cam_ife_hw_mgr_ctx        *hw_mgr_ctx;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = NULL;
+	uint32_t                          num_ctx;
+
+	if (!hw_mgr_priv || !stop_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)stop_args->ctxt_to_hw_map;
+
+	if (hw_mgr_ctx->is_offline) {
+
+		/* For multiple offline camera, stop HW only if there are no
+		 * other contexts that can use it. Need to enhance for more
+		 * complex HW allocation.
+		 */
+		mutex_lock(&ife_hw_mgr->ctx_mutex);
+		cam_ife_mgr_flush_in_queue(ife_hw_mgr,
+			hw_mgr_ctx->ctx_idx, false, -1);
+
+		num_ctx = atomic_read(&ife_hw_mgr->num_acquired_offline_ctx);
+		if (num_ctx <=
+			cam_ife_mgr_required_hw(hw_mgr_priv, true)) {
+			c_ctx = NULL;
+		} else {
+			c_ctx =
+				ife_hw_mgr->acquired_hw_pool[num_ctx-1].ife_ctx;
+			if (atomic_read(&c_ctx->ctx_state) ==
+						CAM_IFE_HW_STATE_BUSY)
+				CAM_ERR(CAM_ISP, "Offline IFE busy on stop!");
+		}
+
+		hw_mgr_ctx->concr_ctx = c_ctx;
+		if (c_ctx) {
+			atomic_set(&c_ctx->ctx_state,
+						CAM_IFE_HW_STATE_STOPPING);
+			atomic_dec(&ife_hw_mgr->num_acquired_offline_ctx);
+			mutex_unlock(&ife_hw_mgr->ctx_mutex);
+		} else {
+			mutex_unlock(&ife_hw_mgr->ctx_mutex);
+			return 0;
+		}
+
+	}
+	return cam_ife_mgr_stop_hw(hw_mgr_priv, stop_hw_args);
+}
+
+static int cam_ife_mgr_v_release_hw(void *hw_mgr_priv, void *release_hw_args)
+{
+	struct cam_ife_hw_mgr_ctx   *hw_mgr_ctx;
+	struct cam_ife_hw_mgr       *ife_hw_mgr = hw_mgr_priv;
+	struct cam_hw_release_args  *release_args = release_hw_args;
+	uint32_t ife_idx;
+	int rc;
+
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *)release_args->ctxt_to_hw_map;
+	if (hw_mgr_ctx->is_offline) {
+		ife_idx = atomic_read(&ife_hw_mgr->num_acquired_offline_ctx);
+		if (ife_idx < CAM_CTX_MAX &&
+				ife_hw_mgr->acquired_hw_pool[ife_idx].ife_ctx) {
+			/* HW is stopped - so we release it */
+			hw_mgr_ctx->concr_ctx =
+				ife_hw_mgr->acquired_hw_pool[ife_idx].ife_ctx;
+		} else {
+			mutex_lock(&ife_hw_mgr->ctx_mutex);
+			cam_ife_mgr_flush_in_queue(ife_hw_mgr,
+				hw_mgr_ctx->ctx_idx, false, -1);
+			mutex_unlock(&ife_hw_mgr->ctx_mutex);
+			/* No hw is stopped - just release sw context */
+			hw_mgr_ctx->concr_ctx = NULL;
+		}
+	}
+	rc = cam_ife_mgr_release_hw(hw_mgr_priv, release_hw_args);
+	hw_mgr_ctx->ctx_in_use = false;
+	return rc;
+}
+
+static int cam_ife_mgr_v_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	struct cam_hw_prepare_update_args *prepare =
+		(struct cam_hw_prepare_update_args *) prepare_hw_update_args;
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx;
+	int rc = 0;
+
+	if (!prepare || !prepare->ctxt_to_hw_map)
+		return -EINVAL;
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *) prepare->ctxt_to_hw_map;
+	if (!hw_mgr_ctx->is_offline)
+		return cam_ife_mgr_prepare_hw_update(hw_mgr_priv,
+				prepare_hw_update_args);
+	else {
+		rc = cam_ife_mgr_enqueue_offline_update(hw_mgr_priv,
+				prepare_hw_update_args);
+		rc = cam_isp_count_hw_entries(prepare);
+	}
+	return rc;
+}
+
+static int cam_ife_mgr_v_config_hw(void *hw_mgr_priv, void *config_hw_args)
+{
+	struct cam_hw_config_args *cfg;
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx;
+	int rc = 0;
+
+	cfg = (struct cam_hw_config_args *)config_hw_args;
+	if (!cfg || !cfg->ctxt_to_hw_map)
+		return -EINVAL;
+	hw_mgr_ctx = (struct cam_ife_hw_mgr_ctx *) cfg->ctxt_to_hw_map;
+	if (!hw_mgr_ctx->is_offline)
+		return cam_ife_mgr_config_hw(hw_mgr_priv, config_hw_args);
+
+	rc = cam_ife_mgr_enqueue_offline_config(hw_mgr_priv,
+		config_hw_args);
+	if (!rc) {
+		rc = cam_ife_mgr_check_start_processing(hw_mgr_priv,
+			hw_mgr_ctx);
+	} else {
+		CAM_ERR(CAM_ISP, "offline config enqueue failed! ");
+	}
+	return rc;
+}
+
+static int cam_ife_mgr_v_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	return cam_ife_mgr_cmd(hw_mgr_priv, cmd_args);
+}
+
+static int cam_ife_mgr_v_reset(void *hw_mgr_priv, void *hw_reset_args)
+{
+	return cam_ife_mgr_reset(hw_mgr_priv, hw_reset_args);
+}
+
+static int cam_ife_mgr_v_dump(void *hw_mgr_priv, void *args)
+{
+	return cam_ife_mgr_dump(hw_mgr_priv, args);
+}
+
+static int cam_ife_mgr_v_recover_hw(void *priv, void *data)
+{
+	return cam_ife_mgr_recover_hw(priv, data);
+}
+
+int cam_ife_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl,
+	uint32_t isp_device_type)
+{
+	int rc = -EFAULT;
+	int i, j;
+	struct cam_iommu_handle cdm_handles;
+	struct cam_ife_hw_concrete_ctx *ctx_pool;
+	struct cam_isp_hw_cap isp_cap = {0};
+	struct cam_isp_hw_path_port_map path_port_map;
+	struct cam_isp_hw_get_off_clk_thr  off_clk_thr;
+
+	memset(&g_ife_hw_mgr, 0, sizeof(g_ife_hw_mgr));
+	memset(&path_port_map, 0, sizeof(path_port_map));
+	memset(&g_ife_sns_grp_cfg, 0, sizeof(g_ife_sns_grp_cfg));
+
+	for (i = 0; i < MAX_INJECT_SET; i++)
+		cam_isp_irq_inject_clear_params(&g_ife_hw_mgr.irq_inject_param[i]);
+
+	mutex_init(&g_ife_hw_mgr.ctx_mutex);
+	spin_lock_init(&g_ife_hw_mgr.ctx_lock);
+
+	if (CAM_IFE_HW_NUM_MAX != CAM_IFE_CSID_HW_NUM_MAX) {
+		CAM_ERR(CAM_ISP, "CSID num is different then IFE num");
+		return -EINVAL;
+	}
+
+	/* fill ife hw intf information */
+	for (i = 0, j = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		rc = cam_vfe_hw_init(&g_ife_hw_mgr.ife_devices[i], i);
+		if (!rc) {
+			struct cam_hw_intf *ife_device =
+				g_ife_hw_mgr.ife_devices[i]->hw_intf;
+			struct cam_hw_info *vfe_hw =
+				(struct cam_hw_info *)
+				ife_device->hw_priv;
+			struct cam_hw_soc_info *soc_info = &vfe_hw->soc_info;
+
+			if (j == 0) {
+				ife_device->hw_ops.process_cmd(
+					vfe_hw,
+					CAM_ISP_HW_CMD_QUERY_CAP,
+					&isp_cap,
+					sizeof(struct cam_isp_hw_cap));
+				CAM_DBG(CAM_ISP,
+					"max VFE out resources: 0x%x num perf counters: 0x%x",
+					isp_cap.max_out_res_type, isp_cap.num_perf_counters);
+
+				ife_device->hw_ops.process_cmd(
+					vfe_hw,
+					CAM_ISP_HW_CMD_GET_PATH_PORT_MAP,
+					&path_port_map,
+					sizeof(struct cam_isp_hw_path_port_map));
+				CAM_DBG(CAM_ISP, "received %d path-port mappings",
+					path_port_map.num_entries);
+			}
+
+			j++;
+			g_ife_hw_mgr.cdm_reg_map[i] = &soc_info->reg_map[0];
+			CAM_DBG(CAM_ISP,
+				"reg_map: mem base = %pK cam_base = 0x%llx",
+				(void __iomem *)soc_info->reg_map[0].mem_base,
+				(uint64_t) soc_info->reg_map[0].mem_cam_base);
+
+			if (g_ife_hw_mgr.ife_devices[i]->num_hw_pid)
+				g_ife_hw_mgr.hw_pid_support = true;
+
+		} else {
+			g_ife_hw_mgr.cdm_reg_map[i] = NULL;
+		}
+	}
+	if (j == 0) {
+		CAM_ERR(CAM_ISP, "no valid IFE HW");
+		return -EINVAL;
+	}
+
+	g_ife_hw_mgr.isp_caps.support_consumed_addr =
+		isp_cap.support_consumed_addr;
+	g_ife_hw_mgr.isp_caps.max_vfe_out_res_type =
+		isp_cap.max_out_res_type;
+	g_ife_hw_mgr.isp_caps.num_ife_perf_counters =
+		isp_cap.num_perf_counters;
+	max_ife_out_res =
+		g_ife_hw_mgr.isp_caps.max_vfe_out_res_type & 0xFF;
+	memset(&isp_cap, 0x0, sizeof(struct cam_isp_hw_cap));
+
+	for (i = 0; i < path_port_map.num_entries; i++) {
+		g_ife_hw_mgr.path_port_map.entry[i][0] = path_port_map.entry[i][0];
+		g_ife_hw_mgr.path_port_map.entry[i][1] = path_port_map.entry[i][1];
+	}
+	g_ife_hw_mgr.path_port_map.num_entries = path_port_map.num_entries;
+
+	g_ife_hw_mgr.isp_device_type = isp_device_type;
+
+	/* fill csid hw intf information */
+	for (i = 0, j = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		rc = cam_ife_csid_hw_init(&g_ife_hw_mgr.csid_devices[i], i);
+		if (!rc)
+			j++;
+	}
+	if (!j) {
+		CAM_ERR(CAM_ISP, "no valid IFE CSID HW");
+		return -EINVAL;
+	}
+
+	/* fill sfe hw intf info */
+	for (i = 0, j = 0; i < CAM_SFE_HW_NUM_MAX; i++) {
+		rc = cam_sfe_hw_init(&g_ife_hw_mgr.sfe_devices[i], i);
+		if (!rc) {
+			if (j == 0) {
+				struct cam_hw_intf *sfe_device =
+					g_ife_hw_mgr.sfe_devices[i]->hw_intf;
+				struct cam_hw_info *sfe_hw =
+					(struct cam_hw_info *)
+					sfe_device->hw_priv;
+
+				if (!sfe_device->hw_ops.process_cmd(
+						sfe_hw,
+						CAM_ISP_HW_CMD_GET_CLK_THRESHOLDS,
+						&off_clk_thr,
+						sizeof(off_clk_thr))) {
+					g_ife_hw_mgr.max_clk_threshold =
+						off_clk_thr.max_clk_threshold;
+					g_ife_hw_mgr.nom_clk_threshold =
+						off_clk_thr.nom_clk_threshold;
+					g_ife_hw_mgr.min_clk_threshold =
+						off_clk_thr.min_clk_threshold;
+					g_ife_hw_mgr.bytes_per_clk =
+						off_clk_thr.bytes_per_clk;
+					CAM_DBG(CAM_ISP,
+						"Offline SFE thresholds max %d nom %d  min%d",
+						off_clk_thr.max_clk_threshold,
+						off_clk_thr.nom_clk_threshold,
+						off_clk_thr.min_clk_threshold,
+						off_clk_thr.bytes_per_clk);
+				}
+
+				rc = sfe_device->hw_ops.process_cmd(
+					sfe_hw,
+					CAM_ISP_HW_CMD_QUERY_CAP,
+					&isp_cap,
+					sizeof(struct cam_isp_hw_cap));
+				CAM_DBG(CAM_ISP,
+					"max SFE out resources: 0x%x num_perf_counters: 0x%x",
+					isp_cap.max_out_res_type, isp_cap.num_perf_counters);
+				if (!rc) {
+					g_ife_hw_mgr.isp_caps.max_sfe_out_res_type =
+						isp_cap.max_out_res_type;
+					g_ife_hw_mgr.isp_caps.num_sfe_perf_counters =
+						isp_cap.num_perf_counters;
+					max_sfe_out_res =
+						g_ife_hw_mgr.isp_caps.max_sfe_out_res_type & 0xFF;
+				}
+
+				if (g_ife_hw_mgr.sfe_devices[i]->num_hw_pid)
+					g_ife_hw_mgr.hw_pid_support = true;
+			}
+			j++;
+		}
+	}
+	if (!j)
+		CAM_ERR(CAM_ISP, "no valid SFE HW devices");
+
+	cam_ife_hw_mgr_sort_dev_with_caps(&g_ife_hw_mgr);
+
+	/* setup ife context list */
+	INIT_LIST_HEAD(&g_ife_hw_mgr.free_ctx_list);
+	INIT_LIST_HEAD(&g_ife_hw_mgr.used_ctx_list);
+
+	/*
+	 *  for now, we only support one iommu handle. later
+	 *  we will need to setup more iommu handle for other
+	 *  use cases.
+	 *  Also, we have to release them once we have the
+	 *  deinit support
+	 */
+	rc = cam_smmu_get_handle("ife",
+		&g_ife_hw_mgr.mgr_common.img_iommu_hdl);
+
+	if (rc && rc != -EALREADY) {
+		CAM_ERR(CAM_ISP, "Can not get iommu handle");
+		return -EINVAL;
+	}
+
+	if (cam_smmu_get_handle("cam-secure",
+		&g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure)) {
+		CAM_ERR(CAM_ISP, "Failed to get secure iommu handle");
+		goto secure_fail;
+	}
+
+	CAM_DBG(CAM_ISP, "iommu_handles: non-secure[0x%x], secure[0x%x]",
+		g_ife_hw_mgr.mgr_common.img_iommu_hdl,
+		g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure);
+
+	if (!cam_cdm_get_iommu_handle("ife3", &cdm_handles)) {
+		CAM_DBG(CAM_ISP,
+			"Successfully acquired CDM iommu handles 0x%x, 0x%x",
+			cdm_handles.non_secure, cdm_handles.secure);
+		g_ife_hw_mgr.mgr_common.cmd_iommu_hdl = cdm_handles.non_secure;
+		g_ife_hw_mgr.mgr_common.cmd_iommu_hdl_secure =
+			cdm_handles.secure;
+	} else {
+		CAM_ERR(CAM_ISP, "Failed to acquire CDM iommu handle");
+		g_ife_hw_mgr.mgr_common.cmd_iommu_hdl = -1;
+		g_ife_hw_mgr.mgr_common.cmd_iommu_hdl_secure = -1;
+	}
+
+	INIT_LIST_HEAD(&g_ife_hw_mgr.input_queue.list);
+	INIT_LIST_HEAD(&g_ife_hw_mgr.in_proc_queue.list);
+	atomic_set(&g_ife_hw_mgr.active_ctx_cnt, 0);
+	atomic_set(&g_ife_hw_mgr.num_acquired_offline_ctx, 0);
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		memset(&g_ife_hw_mgr.virt_ctx_pool[i], 0,
+			sizeof(g_ife_hw_mgr.virt_ctx_pool[i]));
+	}
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		memset(&g_ife_hw_mgr.acquired_hw_pool[i], 0,
+			sizeof(g_ife_hw_mgr.acquired_hw_pool[i]));
+		g_ife_hw_mgr.acquired_hw_pool[i].ctx_idx = i;
+		memset(&g_ife_hw_mgr.ctx_pool[i], 0,
+			sizeof(g_ife_hw_mgr.ctx_pool[i]));
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].list);
+
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_ife_in.list);
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_ife_csid);
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_ife_src);
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_sfe_src);
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_ife_in_rd);
+		ctx_pool = &g_ife_hw_mgr.ctx_pool[i];
+
+		ctx_pool->vfe_out_map = kzalloc((max_ife_out_res *
+			sizeof(uint8_t)), GFP_KERNEL);
+		if (!ctx_pool->vfe_out_map) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_ISP, "Alloc failed for ife out res list, ctx_idx: %u",
+				ctx_pool->ctx_index);
+			goto end;
+		}
+
+		if (max_sfe_out_res) {
+			ctx_pool->sfe_out_map = kzalloc((max_sfe_out_res *
+				sizeof(uint8_t)), GFP_KERNEL);
+			if (!ctx_pool->sfe_out_map) {
+				rc = -ENOMEM;
+				CAM_ERR(CAM_ISP, "Alloc failed for SFE out res list, ctx_idx: %u",
+					ctx_pool->ctx_index);
+				goto end;
+			}
+			memset(ctx_pool->sfe_out_map, 0xff, max_sfe_out_res * sizeof(uint8_t));
+		}
+
+		/* init context pool */
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].free_res_list);
+		for (j = 0; j < CAM_IFE_HW_RES_POOL_MAX; j++) {
+			INIT_LIST_HEAD(
+				&g_ife_hw_mgr.ctx_pool[i].res_pool[j].list);
+			list_add_tail(
+				&g_ife_hw_mgr.ctx_pool[i].res_pool[j].list,
+				&g_ife_hw_mgr.ctx_pool[i].free_res_list);
+		}
+
+		g_ife_hw_mgr.ctx_pool[i].ctx_index = i;
+		g_ife_hw_mgr.ctx_pool[i].hw_mgr = &g_ife_hw_mgr;
+
+		cam_tasklet_init(&g_ife_hw_mgr.mgr_common.tasklet_pool[i],
+			&g_ife_hw_mgr.ctx_pool[i], i);
+		g_ife_hw_mgr.ctx_pool[i].common.tasklet_info =
+			g_ife_hw_mgr.mgr_common.tasklet_pool[i];
+
+		init_completion(&g_ife_hw_mgr.ctx_pool[i].config_done_complete);
+		list_add_tail(&g_ife_hw_mgr.ctx_pool[i].list,
+			&g_ife_hw_mgr.free_ctx_list);
+	}
+
+	/* Create Worker for ife_hw_mgr with 10 tasks */
+	rc = cam_req_mgr_workq_create("cam_ife_worker", 10,
+			&g_ife_hw_mgr.workq, CRM_WORKQ_USAGE_NON_IRQ, 0,
+			cam_req_mgr_process_workq_cam_ife_worker);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Unable to create worker, ctx_idx: %u", ctx_pool->ctx_index);
+		goto end;
+	}
+
+	/* Populate sys cache info */
+	rc = cam_ife_mgr_populate_sys_cache_id();
+	if (rc == -EFAULT) {
+		CAM_ERR(CAM_ISP, "LLCC stall notif enable fault");
+		goto end;
+	}
+
+	/* fill return structure */
+	hw_mgr_intf->hw_mgr_priv = &g_ife_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_ife_mgr_v_get_hw_caps;
+	hw_mgr_intf->hw_acquire = cam_ife_mgr_v_acquire;
+	hw_mgr_intf->hw_start = cam_ife_mgr_v_start_hw;
+	hw_mgr_intf->hw_stop = cam_ife_mgr_v_stop_hw;
+	hw_mgr_intf->hw_read = cam_ife_mgr_read;
+	hw_mgr_intf->hw_write = cam_ife_mgr_write;
+	hw_mgr_intf->hw_release = cam_ife_mgr_v_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_ife_mgr_v_prepare_hw_update;
+	hw_mgr_intf->hw_config = cam_ife_mgr_v_config_hw;
+	hw_mgr_intf->hw_cmd = cam_ife_mgr_v_cmd;
+	hw_mgr_intf->hw_reset = cam_ife_mgr_v_reset;
+	hw_mgr_intf->hw_dump = cam_ife_mgr_v_dump;
+	hw_mgr_intf->hw_recovery = cam_ife_mgr_v_recover_hw;
+	hw_mgr_intf->hw_update_sensor_grp_stream_cfg = cam_ife_mgr_update_sensor_grp_stream_cfg;
+
+	if (iommu_hdl)
+		*iommu_hdl = g_ife_hw_mgr.mgr_common.img_iommu_hdl;
+
+	cam_ife_hw_mgr_debug_register();
+	cam_ife_mgr_count_functional_ife();
+	cam_ife_mgr_count_functional_sfe();
+
+	cam_vfe_get_num_ifes(&g_num_ife_available);
+	rc = cam_cpas_prepare_subpart_info(CAM_IFE_HW_IDX, g_num_ife_available,
+		g_num_ife_functional);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to populate num_ifes, rc: %d", rc);
+
+	cam_vfe_get_num_ife_lites(&g_num_ife_lite_available);
+	rc = cam_cpas_prepare_subpart_info(CAM_IFE_LITE_HW_IDX, g_num_ife_lite_available,
+		g_num_ife_lite_functional);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to populate num_ife_lites, rc: %d", rc);
+
+	cam_sfe_get_num_hws(&g_num_sfe_available);
+	rc = cam_cpas_prepare_subpart_info(CAM_SFE_HW_IDX, g_num_sfe_available,
+		g_num_sfe_functional);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to populate num_sfes, rc: %d", rc);
+
+	cam_common_register_mini_dump_cb(cam_ife_hw_mgr_mini_dump_cb,
+		"CAM_ISP", NULL);
+	cam_ife_mgr_test_irq_lines_at_probe(&g_ife_hw_mgr);
+
+	/* Allocate memory for perf counters */
+	if (g_ife_hw_mgr.isp_caps.num_ife_perf_counters) {
+		g_ife_hw_mgr.debug_cfg.ife_perf_counter_val = kcalloc(
+			g_ife_hw_mgr.isp_caps.num_ife_perf_counters,
+			sizeof(uint32_t), GFP_KERNEL);
+	}
+
+	if (g_ife_hw_mgr.isp_caps.num_sfe_perf_counters) {
+		g_ife_hw_mgr.debug_cfg.sfe_perf_counter_val = kcalloc(
+			g_ife_hw_mgr.isp_caps.num_sfe_perf_counters,
+			sizeof(uint32_t), GFP_KERNEL);
+	}
+
+	CAM_DBG(CAM_ISP, "Exit");
+
+	return 0;
+end:
+	if (rc) {
+		for (i = 0; i < CAM_CTX_MAX; i++) {
+			cam_tasklet_deinit(
+				&g_ife_hw_mgr.mgr_common.tasklet_pool[i]);
+			g_ife_hw_mgr.ctx_pool[i].cdm_cmd = NULL;
+			kfree(g_ife_hw_mgr.ctx_pool[i].vfe_out_map);
+			kfree(g_ife_hw_mgr.ctx_pool[i].sfe_out_map);
+			g_ife_hw_mgr.ctx_pool[i].vfe_out_map = NULL;
+			g_ife_hw_mgr.ctx_pool[i].sfe_out_map = NULL;
+			g_ife_hw_mgr.ctx_pool[i].common.tasklet_info = NULL;
+		}
+	}
+	cam_smmu_destroy_handle(
+		g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure);
+	g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure = -1;
+secure_fail:
+	cam_smmu_destroy_handle(g_ife_hw_mgr.mgr_common.img_iommu_hdl);
+	g_ife_hw_mgr.mgr_common.img_iommu_hdl = -1;
+	return rc;
+}
+
+void cam_ife_hw_mgr_deinit(void)
+{
+	int i = 0;
+
+	cam_req_mgr_workq_destroy(&g_ife_hw_mgr.workq);
+	g_ife_hw_mgr.debug_cfg.dentry = NULL;
+	kfree(g_ife_hw_mgr.debug_cfg.sfe_perf_counter_val);
+	kfree(g_ife_hw_mgr.debug_cfg.ife_perf_counter_val);
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		cam_tasklet_deinit(
+			&g_ife_hw_mgr.mgr_common.tasklet_pool[i]);
+		g_ife_hw_mgr.ctx_pool[i].cdm_cmd = NULL;
+		kfree(g_ife_hw_mgr.ctx_pool[i].vfe_out_map);
+		kfree(g_ife_hw_mgr.ctx_pool[i].sfe_out_map);
+		g_ife_hw_mgr.ctx_pool[i].vfe_out_map = NULL;
+		g_ife_hw_mgr.ctx_pool[i].sfe_out_map = NULL;
+		g_ife_hw_mgr.ctx_pool[i].common.tasklet_info = NULL;
+	}
+
+	cam_smmu_destroy_handle(
+		g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure);
+	g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure = -1;
+
+	cam_smmu_destroy_handle(g_ife_hw_mgr.mgr_common.img_iommu_hdl);
+	g_ife_hw_mgr.mgr_common.img_iommu_hdl = -1;
+	g_ife_hw_mgr.num_caches_found = 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.h
@@ -0,0 +1,972 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_HW_MGR_H_
+#define _CAM_IFE_HW_MGR_H_
+
+#include <linux/completion.h>
+#include <linux/time.h>
+#include "cam_isp_hw_mgr.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cpas_api.h"
+
+/*
+ * enum cam_ife_ctx_master_type - HW master type
+ * CAM_IFE_CTX_TYPE_NONE: IFE ctx/stream directly connected to CSID
+ * CAM_IFE_CTX_TYPE_CUSTOM: IFE ctx/stream connected to custom HW
+ * CAM_IFE_CTX_TYPE_SFE: IFE ctx/stream connected to SFE
+ */
+enum cam_ife_ctx_master_type {
+	CAM_IFE_CTX_TYPE_NONE,
+	CAM_IFE_CTX_TYPE_CUSTOM,
+	CAM_IFE_CTX_TYPE_SFE,
+	CAM_IFE_CTX_TYPE_MAX,
+};
+
+/* IFE resource constants */
+#define CAM_IFE_HW_IN_RES_MAX                 (CAM_ISP_IFE_IN_RES_MAX & 0xFF)
+#define CAM_IFE_HW_RES_POOL_MAX               64
+#define CAM_IFE_HW_STREAM_GRP_RES_POOL_MAX    32
+
+/* IFE_HW_MGR ctx config */
+#define CAM_IFE_CTX_CFG_FRAME_HEADER_TS   BIT(0)
+#define CAM_IFE_CTX_CFG_SW_SYNC_ON        BIT(1)
+#define CAM_IFE_CTX_CFG_DYNAMIC_SWITCH_ON BIT(2)
+
+/* Maximum set for irq injection*/
+#define MAX_INJECT_SET 10
+
+/**
+ * struct cam_ife_hw_mgr_debug - contain the debug information
+ *
+ * @dentry:                    Debugfs entry
+ * @csid_debug:                csid debug information
+ * @rx_capture_debug:          rx capture debug info
+ * @enable_recovery:           enable recovery
+ * @camif_debug:               camif debug info
+ * @enable_csid_recovery:      enable csid recovery
+ * @sfe_debug:                 sfe debug config
+ * @sfe_sensor_diag_cfg:       sfe sensor diag config
+ * @csid_test_bus:             csid test bus config
+ * @sfe_cache_debug:           sfe cache debug info
+ * @ife_perf_counter_val:      ife perf counter values
+ * @sfe_perf_counter_val:      sfe perf counter values
+ * @enable_req_dump:           Enable request dump on HW errors
+ * @per_req_reg_dump:          Enable per request reg dump
+ * @disable_ubwc_comp:         Disable UBWC compression
+ * @disable_ife_mmu_prefetch:  Disable MMU prefetch for IFE bus WR
+ * @enable_ife_frame_irqs:     Enable Frame timing IRQs for IFE/MCTFE
+ * @rx_capture_debug_set:      If rx capture debug is set by user
+ * @disable_isp_drv:           Disable ISP DRV config
+ * @enable_presil_reg_dump:    Enable per req regdump in presil
+ * @enable_cdm_cmd_check:      Enable invalid command check in cmd_buf
+ * @disable_line_based_mode:   Disable line based mode for per port
+ *                             feature with duplicate sensors
+ */
+struct cam_ife_hw_mgr_debug {
+	struct dentry  *dentry;
+	uint64_t       csid_debug;
+	uint32_t       rx_capture_debug;
+	uint32_t       enable_recovery;
+	uint32_t       camif_debug;
+	uint32_t       enable_csid_recovery;
+	uint32_t       sfe_debug;
+	uint32_t       sfe_sensor_diag_cfg;
+	uint32_t       csid_test_bus;
+	uint32_t       sfe_cache_debug[CAM_SFE_HW_NUM_MAX];
+	uint32_t      *ife_perf_counter_val;
+	uint32_t      *sfe_perf_counter_val;
+	bool           enable_req_dump;
+	bool           per_req_reg_dump;
+	bool           disable_ubwc_comp;
+	bool           disable_ife_mmu_prefetch;
+	bool           enable_ife_frame_irqs;
+	bool           rx_capture_debug_set;
+	bool           disable_isp_drv;
+	bool           enable_presil_reg_dump;
+	bool           enable_cdm_cmd_check;
+	bool           disable_line_based_mode;
+};
+
+/**
+ * struct cam_ife_hw_mgr_ctx_pf_info - pf buf info
+ *
+ * @out_port_id: Out port id
+ * @mid: MID value
+ */
+struct cam_ife_hw_mgr_ctx_pf_info {
+	uint32_t       out_port_id;
+	uint32_t       mid;
+};
+
+/**
+ * struct cam_ife_sfe_scratch_buf_info - Scratch buf info
+ *
+ * @width: Width in pixels
+ * @height: Height in pixels
+ * @stride: Stride in pixels
+ * @slice_height: Height in lines
+ * @io_addr: Buffer address
+ * @res_id: Resource type
+ * @offset: Buffer offset
+ * @config_done: To indicate if RDIx received scratch cfg
+ * @is_secure: secure scratch buffer
+ */
+struct cam_ife_sfe_scratch_buf_info {
+	uint32_t   width;
+	uint32_t   height;
+	uint32_t   stride;
+	uint32_t   slice_height;
+	dma_addr_t io_addr;
+	uint32_t   res_id;
+	uint32_t   offset;
+	bool       config_done;
+	bool       is_secure;
+};
+
+/**
+ * struct cam_sfe_scratch_buf_cfg - Scratch buf info
+ *
+ * @num_configs: Total Number of scratch buffers provided
+ * @streamon_buf_mask: Mask to indicate which ports have received buffer
+ *                     from userspace, apply scratch for other ports
+ * @updated_num_exp: Current num of exposures
+ * @buf_info: Info on each of the buffers
+ * @skip_scratch_cfg_streamon: Determine if scratch cfg needs to be programmed at stream on
+ *
+ */
+struct cam_sfe_scratch_buf_cfg {
+	uint32_t                            num_config;
+	uint32_t                            streamon_buf_mask;
+	uint32_t                            updated_num_exp;
+	struct cam_ife_sfe_scratch_buf_info buf_info[
+		CAM_SFE_FE_RDI_NUM_MAX];
+	bool                                skip_scratch_cfg_streamon;
+};
+
+/**
+ * struct cam_ife_scratch_buf_cfg - Scratch buf info
+ *
+ * @num_config: Total Number of scratch buffers provided
+ * @streamon_buf_mask: Mask to indicate which ports have received buffer
+ *                     from userspace, apply scratch for other ports
+ * @buf_info: Info on each of the buffers
+ * @skip_scratch_cfg_streamon: Determine if scratch cfg needs to be programmed at stream on
+ *
+ */
+struct cam_ife_scratch_buf_cfg {
+	uint32_t                            num_config;
+	uint32_t                            streamon_buf_mask;
+	struct cam_ife_sfe_scratch_buf_info buf_info[
+		CAM_IFE_SCRATCH_NUM_MAX];
+	bool                                skip_scratch_cfg_streamon;
+};
+
+/**
+ * struct cam_ife_hw_mgr_ctx_scratch_buf_info - Scratch buffer info
+ *
+ * @num_fetches:               Indicate number of SFE fetches for this stream
+ * @sfe_scratch_config:        Scratch buffer config if any for SFE ports
+ * @ife_scratch_config:        Scratch buffer config if any for IFE ports
+ */
+struct cam_ife_hw_mgr_ctx_scratch_buf_info {
+	uint32_t                        num_fetches;
+	struct cam_sfe_scratch_buf_cfg *sfe_scratch_config;
+	struct cam_ife_scratch_buf_cfg *ife_scratch_config;
+};
+
+/**
+ * struct cam_ife_hw_mgr_ctx_flags - IFE HW mgr ctx flags
+ *
+ * @ctx_in_use:          flag to tell whether context is active
+ * @init_done:           indicate whether init hw is done
+ * @is_fe_enabled:       indicate whether fetch engine\read path is enabled
+ * @is_dual:             indicate whether context is in dual VFE mode
+ * @is_offline:          indicate whether context is for offline IFE
+ * @dsp_enabled:         indicate whether dsp is enabled in this context
+ * @internal_cdm:        indicate whether context uses internal CDM
+ * @pf_mid_found:        in page fault, mid found for this ctx.
+ * @need_csid_top_cfg:   Flag to indicate if CSID top cfg is needed.
+ * @is_rdi_only_context: flag to specify the context has only rdi resource
+ * @is_lite_context:     flag to specify the context has only uses lite
+ *                       resources
+ * @is_sfe_shdr:         indicate if stream is for SFE sHDR
+ * @is_sfe_fs:           indicate if stream is for inline SFE FS
+ * @dump_on_flush:       Set if reg dump triggered on flush
+ * @dump_on_error:       Set if reg dump triggered on error
+ * @custom_aeb_mode:     Set if custom AEB stream
+ * @rdi_lcr_en:          To indicate if RDI LCR is enabled
+ * @sys_cache_usage:     Per context sys cache usage
+ *                       The corresponding index will be set
+ *                       for the cache type
+ * @rdi_pd_context:      Flag to specify the context has
+ *                       only rdi and PD resource without PIX port.
+ * @per_port_en:         Indicates if per port feature is enabled or not
+
+ */
+struct cam_ife_hw_mgr_ctx_flags {
+	bool   ctx_in_use;
+	bool   init_done;
+	bool   is_fe_enabled;
+	bool   is_dual;
+	bool   is_offline;
+	bool   dsp_enabled;
+	bool   internal_cdm;
+	bool   pf_mid_found;
+	bool   need_csid_top_cfg;
+	bool   is_rdi_only_context;
+	bool   is_lite_context;
+	bool   is_sfe_shdr;
+	bool   is_sfe_fs;
+	bool   dump_on_flush;
+	bool   dump_on_error;
+	bool   is_aeb_mode;
+	bool   rdi_lcr_en;
+	bool   sys_cache_usage[CAM_LLCC_MAX];
+	bool   rdi_pd_context;
+	bool   per_port_en;
+};
+
+/**
+ * struct cam_ife_cdm_user_data - IFE HW user data with CDM
+ *
+ * @prepare:                   hw_update_data
+ * @request_id:                Request id
+ */
+struct cam_ife_cdm_user_data {
+	struct cam_isp_prepare_hw_update_data    *hw_update_data;
+	uint64_t                                  request_id;
+};
+
+/**
+ * struct cam_ife_mgr_bw_data - contain data to calc bandwidth for context
+ *
+ * @format:                    image format
+ * @width:                     image width
+ * @height:                    image height
+ * @framerate:                 framerate
+ *
+ */
+struct cam_ife_mgr_bw_data {
+	uint32_t format;
+	uint32_t width;
+	uint32_t height;
+	uint32_t framerate;
+};
+
+/* struct cam_ife_hw_mgr_ctx - IFE HW manager Context object
+ *
+ * concr_ctx:             HW Context currently used from this manager context
+ * hw_mgr:                IFE hw mgr which owns this context
+ * event_cb:              event callbacks
+ * cb_priv:               event callbacks data
+ * ctx_in_use:            indicates if context is active
+ * ctx_idx:               index of this context
+ * bw_data:               contains data for BW usage calculation
+ * num_in_ports:          number of context input ports
+ * in_ports:              context input ports
+ * unpacker_fmt:          IFE input unpacker for offline isp
+ * is_offline:            indicates if context is used for offline processing
+ * stop_done_complete:    completion signaled when context is ceased operation
+ * is_stopping:           if context is about to cease operation
+ * @virtual_rdi_mapping_cb Callback query for virtual rdi mapping
+ *
+ */
+struct cam_ife_hw_mgr_ctx {
+	struct cam_ife_hw_concrete_ctx         *concr_ctx;
+	struct cam_ife_hw_mgr                  *hw_mgr;
+	cam_hw_event_cb_func                    event_cb[CAM_ISP_HW_EVENT_MAX];
+	void                                   *cb_priv;
+	uint32_t                                ctx_in_use;
+	uint32_t                                ctx_idx;
+	struct cam_ife_mgr_bw_data              bw_data;
+	uint32_t                                num_in_ports;
+	struct cam_isp_in_port_generic_info    *in_ports;
+	uint32_t                                unpacker_fmt;
+	bool                                    is_offline;
+	cam_hw_get_virtual_rdi_mapping_cb_func  virtual_rdi_mapping_cb;
+};
+
+
+/**
+ * struct cam_isp_context_comp_record:
+ *
+ * @brief:              Structure record the res id reserved on a comp group
+ *
+ * @num_res:            Number of valid resource IDs in this record
+ * @res_id:             Resource IDs to report buf dones
+ * @last_consumed_addr: Last consumed addr for resource ID at that index
+ *
+ */
+struct cam_isp_context_comp_record {
+	uint32_t num_res;
+	uint32_t res_id[CAM_NUM_OUT_PER_COMP_IRQ_MAX];
+};
+
+/**
+ * struct cam_isp_comp_record_query:
+ *
+ * @brief:              Structure record the bus comp group pointer information
+ *
+ * @vfe_bus_comp_grp:   Vfe bus comp group pointer
+ * @vfe_bus_comp_grp:   Sfe bus comp group pointer
+ *
+ */
+struct cam_isp_comp_record_query {
+	struct cam_isp_context_comp_record        *vfe_bus_comp_grp;
+	struct cam_isp_context_comp_record        *sfe_bus_comp_grp;
+};
+
+/** struct cam_ife_virtual_rdi_mapping - mapping table between UMd and KMD RDI resources
+ *
+ * @rdi_path_count           : indicates how many rdi paths are acquired for this sensor
+ * @virtual_rdi              : requested virtual RDI port by UMD
+ * @acquired_rdi             : acquired RDI port by KMD
+ */
+struct cam_ife_virtual_rdi_mapping {
+	uint32_t   rdi_path_count;
+	uint32_t   virtual_rdi[CAM_ISP_STREAM_CFG_MAX];
+	uint32_t   acquired_rdi[CAM_ISP_STREAM_CFG_MAX];
+};
+
+/**
+ * struct cam_ife_hw_concrete_ctx - IFE HW Context object that contains
+ *                                  HW specific data
+ *
+ * @list:                   used by the ctx list.
+ * @common:                 common acquired context data
+ * @sensor_id:              Sensor id for context
+ * @ctx_index:              acquired context id.
+ * @left_hw_idx:            hw index for master core [left]
+ * @right_hw_idx:           hw index for slave core [right]
+ * @acquired_hw_id:         hw id that this context acquired
+ * @served_ctx_id:          contains currently and next served context ids
+ * @served_ctx_r:           index pointing to currently served context id
+ * @served_ctx_w:           index pointing to next served context id
+ * @hw_mgr:                 IFE hw mgr which owns this context
+ * @res_list_csid:          CSID resource list
+ * @res_list_ife_src:       IFE input resource list
+ * @res_list_sfe_src        SFE input resource list
+ * @res_list_ife_in_rd      IFE/SFE input resource list for read path
+ * @res_list_ife_out:       IFE output resoruces array
+ * @res_list_sfe_out:       SFE output resources array
+ * @vfe_out_map:            Map for VFE out ports
+ * @sfe_out_map:            Map for SFE out ports
+ * @num_acq_vfe_out:        Number of acquired VFE out resources
+ * @num_acq_sfe_out:        Number of acquired SFE out resources
+ * @free_res_list:          Free resources list for the branch node
+ * @res_pool:               memory storage for the free resource list
+ * @irq_status0_mask:       irq_status0_mask for the context
+ * @irq_status1_mask:       irq_status1_mask for the context
+ * @base                    device base index array contain the all IFE HW
+ *                          instance associated with this context.
+ * @num_base                number of valid base data in the base array
+ * @cdm_handle              cdm hw acquire handle
+ * @cdm_hw_idx:             Physical CDM in use
+ * @cdm_ops                 cdm util operation pointer for building
+ *                          cdm commands
+ * @cdm_cmd                 cdm base and length request pointer
+ * @cdm_id                  cdm id of the acquired cdm
+ * @sof_cnt                 sof count value per core, used for dual VFE
+ * @epoch_cnt               epoch count value per core, used for dual VFE
+ * @eof_cnt                 eof count value per core, used for dual VFE
+ * @overflow_pending        flat to specify the overflow is pending for the
+ *                          context
+ * @cdm_done                flag to indicate cdm has finished writing shadow
+ *                          registers
+ * @last_cdm_done_req:      Last cdm done request
+ * @config_done_complete    indicator for configuration complete
+ * @reg_dump_buf_desc:      cmd buffer descriptors for reg dump
+ * @num_reg_dump_buf:       Count of descriptors in reg_dump_buf_desc
+ * @applied_req_id:         Last request id to be applied
+ * @ctx_type                Type of IFE ctx [CUSTOM/SFE etc.]
+ * @ctx_config              ife ctx config  [bit field]
+ * @ts                      captured timestamp when the ctx is acquired
+ * @hw_enabled              Array to indicate active HW
+ * @buf_done_controller     Buf done controller.
+ * @scratch_buf_info        Scratch buf [SFE/IFE] info pertaining to this stream
+ * @flags                   Flags pertainting to this ctx
+ * @bw_config_version       BW Config version
+ * @recovery_id:            Unique ID of the current valid scheduled recovery
+ * @current_mup:            Current MUP val, scratch will then apply the same as previously
+ *                          applied request
+ * @curr_num_exp:           Current num of exposures
+ * @try_recovery_cnt:       Retry count for overflow recovery
+ * @recovery_req_id:        The request id on which overflow recovery happens
+ * @drv_path_idle_en:       Path idle enable value for DRV
+ * @major_version:          Major version for acquire
+ * @vfe_bus_comp_grp:       VFE composite group placeholder
+ * @sfe_bus_comp_grp:       SFE composite group placeholder
+ * @cdm_done_ts:            CDM callback done timestamp
+ * @is_hw_ctx_acq:          If acquire for ife ctx is having hw ctx acquired
+ * @acq_hw_ctxt_src_dst_map: Src to dst hw ctxt map for acquired pixel paths
+ * @ctx_state               Indicates context state
+ * @offline_clk             IFE Clock value to be configured for offline processing
+ * @offline_sfe_clk         SFE Clock value to be configured for offline processing
+ * @mapping_table:          mapping between virtual rdi and acquired rdi
+ *
+ */
+
+struct cam_ife_hw_concrete_ctx {
+	struct list_head                     list;
+	struct cam_isp_hw_mgr_ctx            common;
+	void                                *tasklet_info;
+	uint32_t                             sensor_id;
+	uint32_t                             ctx_index;
+	uint32_t                             left_hw_idx;
+	uint32_t                             right_hw_idx;
+	uint32_t                             acquired_hw_id;
+	uint32_t                             served_ctx_id[2];
+	uint32_t                             served_ctx_r;
+	uint32_t                             served_ctx_w;
+	struct cam_ife_hw_mgr               *hw_mgr;
+
+	struct cam_isp_hw_mgr_res            res_list_ife_in;
+	struct list_head                     res_list_ife_csid;
+	struct list_head                     res_list_ife_src;
+	struct list_head                     res_list_sfe_src;
+	struct list_head                     res_list_ife_in_rd;
+	struct cam_isp_hw_mgr_res           *res_list_ife_out;
+	struct cam_isp_hw_mgr_res           *res_list_sfe_out;
+	struct list_head                     free_res_list;
+	struct cam_isp_hw_mgr_res            res_pool[CAM_IFE_HW_RES_POOL_MAX];
+	uint8_t                              *vfe_out_map;
+	uint8_t                              *sfe_out_map;
+	uint32_t                             num_acq_vfe_out;
+	uint32_t                             num_acq_sfe_out;
+
+	uint32_t                             irq_status0_mask[CAM_IFE_HW_NUM_MAX];
+	uint32_t                             irq_status1_mask[CAM_IFE_HW_NUM_MAX];
+	struct cam_isp_ctx_base_info         base[CAM_IFE_HW_NUM_MAX +
+							CAM_SFE_HW_NUM_MAX];
+	uint32_t                             num_base;
+	uint32_t                             cdm_handle;
+	int32_t                              cdm_hw_idx;
+	struct cam_cdm_utils_ops            *cdm_ops;
+	struct cam_cdm_bl_request           *cdm_cmd;
+	enum cam_cdm_id                      cdm_id;
+	uint32_t                             sof_cnt[CAM_IFE_HW_NUM_MAX];
+	uint32_t                             epoch_cnt[CAM_IFE_HW_NUM_MAX];
+	uint32_t                             eof_cnt[CAM_IFE_HW_NUM_MAX];
+	atomic_t                             overflow_pending;
+	atomic_t                             cdm_done;
+	uint64_t                             last_cdm_done_req;
+	struct completion                    config_done_complete;
+	uint32_t                             hw_version;
+	struct cam_cmd_buf_desc              reg_dump_buf_desc[
+					CAM_REG_DUMP_MAX_BUF_ENTRIES];
+	uint32_t                             num_reg_dump_buf;
+	uint64_t                             applied_req_id;
+	enum cam_ife_ctx_master_type         ctx_type;
+	uint32_t                             ctx_config;
+	struct timespec64                    ts;
+	void                                *buf_done_controller;
+	struct cam_ife_hw_mgr_ctx_scratch_buf_info scratch_buf_info;
+	struct cam_ife_hw_mgr_ctx_flags      flags;
+	struct cam_ife_hw_mgr_ctx_pf_info    pf_info;
+	struct cam_ife_cdm_user_data         cdm_userdata;
+	uint32_t                             bw_config_version;
+	atomic_t                             recovery_id;
+	uint32_t                             current_mup;
+	uint32_t                             curr_num_exp;
+	uint32_t                             try_recovery_cnt;
+	uint64_t                             recovery_req_id;
+	uint32_t                             drv_path_idle_en;
+	uint32_t                             major_version;
+	struct cam_isp_context_comp_record  *vfe_bus_comp_grp;
+	struct cam_isp_context_comp_record  *sfe_bus_comp_grp;
+	struct timespec64                    cdm_done_ts;
+	bool                                 is_hw_ctx_acq;
+	uint32_t                             acq_hw_ctxt_src_dst_map[CAM_ISP_MULTI_CTXT_MAX];
+	atomic_t                             ctx_state;
+	bool                                 is_offline;
+	bool                                 waiting_start;
+	uint32_t                             start_ctx_idx;
+	bool                                 sfe_rd_only;
+	uint32_t                             offline_clk;
+	uint32_t                             offline_sfe_clk;
+	struct cam_ife_virtual_rdi_mapping   mapping_table;
+};
+
+/**
+ * struct cam_ife_offline_hw - Offline ife context allocation information
+ *
+ * @ctx_idx:                context index
+ * @custom_enabled:         update the flag if context is connected to custom HW
+ * @use_frame_header_ts     obtain qtimer ts using frame header
+ * @acquired_hw_id:         Acquired hardware mask
+ * @acquired_hw_path:       Acquired path mask for an input
+ *                          if input splits into multiple paths,
+ *                          its updated per hardware
+ * valid_acquired_hw:       Valid num of acquired hardware
+ * @ife_ctx:                HW context connected to that HW
+ *
+ */
+struct cam_ife_offline_hw {
+	uint32_t                        ctx_idx;
+	bool                            custom_enabled;
+	bool                            use_frame_header_ts;
+	uint32_t                        acquired_hw_id[CAM_MAX_ACQ_RES];
+	uint32_t                        acquired_hw_path[CAM_MAX_ACQ_RES][
+						CAM_MAX_HW_SPLIT];
+	uint32_t                        valid_acquired_hw;
+	struct cam_ife_hw_concrete_ctx *ife_ctx;
+};
+
+/**
+ * struct cam_ife_mgr_offline_in_queue - Offline IFE input request queue element
+ *
+ * @list:                   list private data;
+ * @request_id:             request id
+ * @ctx_idx:                context owning this request
+ * @hw_id:                  ID of hardware core servicing this request
+ * @prepare:                prepare requset data
+ * @cfg:                    config request data
+ * @ready:                  indicates if request is ready to be processed
+ *
+ */
+struct cam_ife_mgr_offline_in_queue {
+	struct list_head                  list;
+	uint64_t                          request_id;
+	uint32_t                          ctx_idx;
+	uint32_t                          hw_id;
+	struct cam_hw_prepare_update_args prepare;
+	struct cam_hw_config_args         cfg;
+	bool                              ready;
+};
+
+/**
+ * struct cam_isp_bus_hw_caps - BUS capabilities
+ *
+ * @max_vfe_out_res_type  :  max ife out res type value from hw
+ * @max_sfe_out_res_type  :  max sfe out res type value from hw
+ * @num_ife_perf_counters :  max ife perf counters supported
+ * @num_sfe_perf_counters :  max sfe perf counters supported
+ * @support_consumed_addr :  indicate whether hw supports last consumed address
+ */
+struct cam_isp_ife_sfe_hw_caps {
+	uint32_t     max_vfe_out_res_type;
+	uint32_t     max_sfe_out_res_type;
+	uint32_t     num_ife_perf_counters;
+	uint32_t     num_sfe_perf_counters;
+	bool         support_consumed_addr;
+};
+
+/*
+ * struct cam_isp_sys_cache_info:
+ *
+ * @Brief:                   ISP Bus sys cache info. Placeholder for all cache ids and their
+ *                           types
+ *
+ * @type:                    Cache type
+ * @scid:                    Cache slice ID
+ * @llcc_staling_support     to check llcc sys cache stalling mode supported or not
+ */
+struct cam_isp_sys_cache_info {
+	enum cam_sys_cache_config_types type;
+	int32_t                         scid;
+	bool            llcc_staling_support;
+};
+
+/*
+ * struct cam_isp_sfe_cache_info:
+ *
+ * @Brief:                   SFE cache info. Placeholder for:
+ *                           1. Supported cache IDs which are populated during
+ *                           probe based on large and small.
+ *                           2. keeps track for the current cache id used for a
+ *                           particular exposure type
+ *                           3. keeps track of acvitated exposures.
+ *                           Based on this data, we can toggle the SCIDs for a particular
+ *                           hw whenever there is a hw halt. Also we don't change
+ *                           the SCID in case of dynamic exposure switches.
+ *
+ * @supported_scid_idx:      Bit mask for IDs supported for each exposure type
+ * @curr_idx:                Index of Cache ID in use for each exposure
+ * @activated:               Maintains if the cache is activated for a particular exposure
+ */
+struct cam_isp_sfe_cache_info {
+	int      supported_scid_idx;
+	int      curr_idx[CAM_ISP_EXPOSURE_MAX];
+	bool     activated[CAM_ISP_EXPOSURE_MAX];
+};
+
+/*
+ * struct cam_isp_irq_inject_irq_desc: Structure to hold IRQ description
+ *
+ * @bitmask : Bitmask of the IRQ
+ * @desc    : String to describe the IRQ bit
+ */
+struct cam_isp_irq_inject_irq_desc {
+	uint32_t    bitmask;
+	char       *desc;
+};
+
+/*
+ * enum cam_isp_irq_inject_common_param_pos - Irq injection param
+ *
+ * HW_TYPE         : hw to inject IRQ
+ * HW_IDX          : index of the selected hw
+ * RES_ID          : register to set irq
+ * IRQ_MASK        : IRQ to be triggered
+ * INJECT_REQ      : req to trigger the IRQ
+ * INJECT_PARAM_MAX: max allowed num of injected param
+ */
+enum cam_isp_irq_inject_common_param_pos {
+	HW_TYPE,
+	HW_IDX,
+	REG_UNIT,
+	IRQ_MASK,
+	INJECT_REQ,
+	INJECT_PARAM_MAX
+};
+
+/**
+ * struct cam_ife_hw_mgr - IFE HW Manager
+ *
+ * @mgr_common:            common data for all HW managers
+ * @csid_devices;          csid device instances array. This will be filled by
+ *                         HW manager during the initialization.
+ * @ife_devices:           IFE device instances array. This will be filled by
+ *                         HW layer during initialization
+ * @sfe_devices:           SFE device instance array
+ * @ctx_mutex:             mutex for the hw context pool
+ * @free_ctx_list:         free hw context list
+ * @used_ctx_list:         used hw context list
+ * @ctx_pool:              context storage
+ * @virt_ctx_pool:         HW manager context storage
+ * @csid_hw_caps           csid hw capability stored per core
+ * @ife_dev_caps           ife device capability per core
+ * @work q                 work queue for IFE hw manager
+ * @debug_cfg              debug configuration
+ * @ctx_lock               context lock
+ * @hw_pid_support         hw pid support for this target
+ * @csid_rup_en            Reg update at CSID side
+ * @csid_global_reset_en   CSID global reset enable
+ * @csid_camif_irq_support CSID camif IRQ support
+ * @cam_ddr_drv_support    DDR DRV support
+ * @cam_clk_drv_support    CLK DRV support
+ * @isp_caps               Capability of underlying SFE/IFE HW
+ * @path_port_map          Mapping of outport to IFE mux
+ * @num_caches_found       Number of caches supported
+ * @sys_cache_info         Sys cache info
+ * @sfe_cache_info         SFE Cache Info
+ * @isp_device_type:       If device supports single-context(ife) or multi-
+ *                         context(mc_tfe)
+ * @irq_inject_param       Param for isp irq injection
+ * @num_acquired_offline_ctx:  number of acquired offline contexts
+ * @acquired_hw_pool:      offline contexts acquire data
+ * @input_queue:           input request queue for offline processing
+ * @in_proc_queue:         currently processed requests queuse
+ * @starting_offline_cnt:  number of offline HWs that are currently starting
+ * @offline_clk:           offline ife clock
+ * @offline_sfe_clk:       offline sfe clock
+ * @max_clk_threshold:     Peak sfe clock
+ * @nom_clk_threshold:     nominal sfe clock
+ * @min_clk_threshold:     Min sfe clock
+ * @offline_reconfig:      offline ISP need to reconfigure or not
+ */
+struct cam_ife_hw_mgr {
+	struct cam_isp_hw_mgr          mgr_common;
+	struct cam_hw_intf            *csid_devices[CAM_IFE_CSID_HW_NUM_MAX];
+	struct cam_isp_hw_intf_data   *ife_devices[CAM_IFE_HW_NUM_MAX];
+	struct cam_isp_hw_intf_data   *sfe_devices[CAM_SFE_HW_NUM_MAX];
+	struct cam_soc_reg_map        *cdm_reg_map[CAM_IFE_HW_NUM_MAX];
+
+	struct mutex                   ctx_mutex;
+	atomic_t                       active_ctx_cnt;
+	struct list_head               free_ctx_list;
+	struct list_head               used_ctx_list;
+	struct cam_ife_hw_concrete_ctx ctx_pool[CAM_CTX_MAX];
+	struct cam_ife_hw_mgr_ctx      virt_ctx_pool[CAM_CTX_MAX];
+	struct cam_ife_csid_hw_caps      csid_hw_caps[
+						CAM_IFE_CSID_HW_NUM_MAX];
+	struct cam_vfe_hw_get_hw_cap     ife_dev_caps[CAM_IFE_HW_NUM_MAX];
+	struct cam_req_mgr_core_workq   *workq;
+	struct cam_ife_hw_mgr_debug      debug_cfg;
+	spinlock_t                       ctx_lock;
+	bool                             hw_pid_support;
+	bool                             csid_rup_en;
+	bool                             csid_global_reset_en;
+	bool                             csid_camif_irq_support;
+	bool                             cam_ddr_drv_support;
+	bool                             cam_clk_drv_support;
+	struct cam_isp_ife_sfe_hw_caps   isp_caps;
+	struct cam_isp_hw_path_port_map  path_port_map;
+	uint32_t                         num_caches_found;
+	struct cam_isp_sys_cache_info    sys_cache_info[CAM_LLCC_MAX];
+	struct cam_isp_sfe_cache_info    sfe_cache_info[CAM_SFE_HW_NUM_MAX];
+	uint32_t                         isp_device_type;
+	struct cam_isp_irq_inject_param  irq_inject_param[MAX_INJECT_SET];
+	atomic_t                         num_acquired_offline_ctx;
+	struct cam_ife_offline_hw        acquired_hw_pool[CAM_CTX_MAX];
+	struct cam_ife_mgr_offline_in_queue   input_queue;
+	struct cam_ife_mgr_offline_in_queue   in_proc_queue;
+	uint32_t                         starting_offline_cnt;
+	uint32_t                         max_ife_lite_out_res;
+	uint32_t                         offline_clk;
+	uint32_t                         offline_sfe_clk;
+	uint32_t                         max_clk_threshold;
+	uint32_t                         nom_clk_threshold;
+	uint32_t                         min_clk_threshold;
+	uint32_t                         bytes_per_clk;
+	bool                             offline_reconfig;
+};
+
+/**
+ * struct cam_ife_hw_mgr_sensor_stream_config  -  camera sensor stream configurations
+ *
+ * @priv                        : Context data
+ * @sensor_id                   : camera sensor unique index
+ * @contextId                   : sensor context id to which this vc/dt belongs to
+ * @color_filter_arrangement    : indicates YUV CHROMA Downscale conversion enabled
+ * @num_valid_vc_dt_pxl         : valid vc and dt for pxl path
+ * @num_valid_vc_dt_rdi         : valid vc and dt in array for rdi path
+ * @pxl_vc                      : input virtual channel number for pxl path
+ * @pxl_dt                      : input data type number for pxl path
+ * @ppp_vc                      : input virtual channel number for ppp path
+ * @ppp_dt                      : input data type number for ppp path
+ * @lcr_vc                      : input virtual channel number for lcr path
+ * @lcr_dt                      : input data type number for lcr path
+ * @rdi_vc                      : input virtual channel number for rdi path
+ * @rdi_dt                      : input data type number for rdi path
+ * @error_threshold             : Error Threshold
+ * @sync_id                     : if sensors are in sync then it indicates which
+ *                                all sensors are in sync, sharing same sync id.
+ *                                syncid = -1 indicates sensor is not in sync mode
+ * @frame_freeze_count          : if calculated CRC value is same for consecutive
+ *                                frames then it is frame freeze.
+ *                                frame freeze count indicates tolerable rate for
+ *                                consecutive frame freezes
+ * @decode_format               : input data format
+ * @rdi_vc_dt_updated           : Indicates count of rdi vc-dt associated to any hw res
+ * @yuv_rdi_vc_dt_updated       : Indicates vc dt is updated for rdi path with yuv conversion
+ * @pxl_vc_dt_updated           : Indicates if pxl vc-dt is associated to any hw res
+ * @lcr_vc_dt_updated           : Indicates if lcr vc-dt associated to any hw res
+ * @ppp_vc_dt_updated           : Indicates if ppp vc-dt is associated to any hw res
+ * @acquired                    : indicates whether acquire is done for this sensor id
+ * @is_streamon                 : indicates whether streamon is done for this sensor id
+ */
+struct cam_ife_hw_mgr_sensor_stream_config {
+	void                                      *priv;
+	uint32_t                                   sensor_id;
+	uint32_t                                   context_id;
+	uint32_t                                   color_filter_arrangement;
+	uint32_t                                   num_valid_vc_dt_pxl;
+	uint32_t                                   num_valid_vc_dt_rdi;
+	uint32_t                                   num_valid_vc_dt_ppp;
+	uint32_t                                   num_valid_vc_dt_lcr;
+	uint32_t                                   pxl_vc;
+	uint32_t                                   pxl_dt;
+	uint32_t                                   ppp_vc;
+	uint32_t                                   ppp_dt;
+	uint32_t                                   lcr_vc;
+	uint32_t                                   lcr_dt;
+	uint32_t                                   rdi_vc[CAM_ISP_VC_DT_CFG];
+	uint32_t                                   rdi_dt[CAM_ISP_VC_DT_CFG];
+	uint32_t                                   error_threshold;
+	uint32_t                                   sync_id;
+	uint32_t                                   frame_freeze_count;
+	uint32_t                                   decode_format;
+	uint32_t                                   rdi_vc_dt_updated;
+	bool                                       yuv_rdi_vc_dt_updated;
+	bool                                       pxl_vc_dt_updated;
+	bool                                       lcr_vc_dt_updated;
+	bool                                       ppp_vc_dt_updated;
+	bool                                       acquired;
+	bool                                       is_streamon;
+};
+
+/**
+ * struct cam_ife_hw_mgr_stream_grp_config  -  camera sensor stream group configurations
+ *
+ * @res_type                      : input resource type
+ * @lane_type                     : lane type: c-phy or d-phy.
+ * @lane_num                      : active lane number
+ * @lane_cfg                      : lane configurations: 4 bits per lane
+ * @feature_mask                  : feature flag
+ * @acquire_cnt                   : count of number of acquire calls
+ * @stream_cfg_cnt                : number of sensor configurations for pxl and rdi paths
+ * @rdi_stream_cfg_cnt            : number of sensor configurations for only rdi path
+ * @rdi_yuv_conversion_stream_cnt : Indicates how many yuv sensors need yuv 420 conversions
+ * @hw_ctx_cnt                    : count of number of hw ctx
+ * @stream_on_cnt                 : count of number of streamon calls for this ife device
+ * @enable_error_recovery         : indicates error recovery is enabled/disabled
+ * @recovery_threshold            : indicates recovery threshold
+ * @res_ife_csid_list             : CSID resource list
+ * @res_ife_src_list              : IFE input resource list
+ * @res_list_ife_out              : IFE output resources array
+ * @lock                          : mutex lock
+ * @free_res_list                 : Free resources list for the branch node
+ * @acquired_hw_idx               : Index of acquired HW
+ * @res_pool                      : memory storage for the free resource list
+ * @mapping_table                 : mapping table between UMd and KMD RDI resources
+ * @stream_cfg                    : stream config data
+ * @recovery_in_progress          : Indicates if ife is process of frame drop recovery
+ */
+struct cam_ife_hw_mgr_stream_grp_config {
+	uint32_t                                      res_type;
+	uint32_t                                      lane_type;
+	uint32_t                                      lane_num;
+	uint32_t                                      lane_cfg;
+	uint32_t                                      feature_mask;
+	uint32_t                                      acquire_cnt;
+	uint32_t                                      stream_cfg_cnt;
+	uint32_t                                      rdi_stream_cfg_cnt;
+	uint32_t                                      rdi_yuv_conversion_stream_cnt;
+	uint32_t                                      hw_ctx_cnt;
+	bool                                          enable_error_recovery;
+	uint32_t                                      recovery_threshold;
+	int32_t                                       stream_on_cnt;
+	struct list_head                              res_ife_csid_list;
+	struct list_head                              res_ife_src_list;
+	struct cam_isp_hw_mgr_res                    *res_list_ife_out;
+	struct mutex                                  lock;
+	struct list_head                              free_res_list;
+	uint32_t                                      acquired_hw_idx;
+	struct cam_isp_hw_mgr_res                     res_pool[CAM_IFE_HW_STREAM_GRP_RES_POOL_MAX];
+	struct cam_ife_hw_mgr_sensor_stream_config    stream_cfg[CAM_ISP_STREAM_CFG_MAX];
+	bool                                          recovery_in_progress;
+};
+
+/**
+ * struct cam_ife_hw_mgr_sensor_grp_cfg  -  sensor group configurations
+ *
+ * @num_grp_cfg                 : count of total active group configs
+ * @grp_cfg                     : stream group data
+ */
+struct cam_ife_hw_mgr_sensor_grp_cfg {
+	uint32_t                                  num_grp_cfg;
+	struct cam_ife_hw_mgr_stream_grp_config  *grp_cfg[CAM_ISP_STREAM_GROUP_CFG_MAX];
+};
+
+/**
+ * struct cam_ife_hw_event_recovery_data - Payload for the recovery procedure
+ *
+ * @error_type:               Error type that causes the recovery
+ * @affected_core:            Array of the hardware cores that are affected
+ * @affected_ctx:             Array of the hardware contexts that are affected
+ * @no_of_context:            Actual number of the affected context
+ * @id:                       Unique ID associated with this recovery data (per HW context)
+ *
+ */
+struct cam_ife_hw_event_recovery_data {
+	uint32_t                        error_type;
+	uint32_t                        affected_core[CAM_ISP_HW_NUM_MAX];
+	struct cam_ife_hw_concrete_ctx *affected_ctx[CAM_CTX_MAX];
+	uint32_t                        no_of_context;
+	uint32_t                        id[CAM_CTX_MAX];
+};
+
+/**
+ * struct cam_ife_hw_mini_dump_ctx - Mini dump data
+ *
+ * @base:                   device base index array contain the all IFE HW
+ * @pf_info:                Page Fault Info
+ * @csid_md:                CSID mini dump data
+ * @vfe_md:                 VFE mini dump data
+ * @sfe_md:                 SFE mini dump data
+ * @flags:                  Flags pertainting to this ctx
+ * @ctx_priv:               Array of the hardware contexts that are affected
+ * @last_cdm_done_req:      Last cdm done request
+ * @applied_req_id:         Last request id to be applied
+ * @cdm_handle:             cdm hw acquire handle
+ * @ctx_index:              acquired context id.
+ * @left_hw_idx:            hw index for master core [left]
+ * @right_hw_idx:           hw index for slave core [right]
+ * @num_base:               number of valid base data in the base array
+ * @cdm_id:                 cdm id of the acquired cdm
+ * @ctx_type:               Type of IFE ctx [CUSTOM/SFE etc.]
+ * @overflow_pending:       flat to specify the overflow is pending for the
+ * @cdm_done:               flag to indicate cdm has finished writing shadow
+ *                          registers
+ */
+struct cam_ife_hw_mini_dump_ctx {
+	struct cam_isp_ctx_base_info          base[CAM_IFE_HW_NUM_MAX +
+				         	CAM_SFE_HW_NUM_MAX];
+	struct cam_ife_hw_mgr_ctx_pf_info     pf_info;
+	void                                 *csid_md[CAM_IFE_HW_NUM_MAX];
+	void                                 *vfe_md[CAM_IFE_HW_NUM_MAX];
+	void                                 *sfe_md[CAM_SFE_HW_NUM_MAX];
+	struct cam_ife_hw_mgr_ctx_flags       flags;
+	void                                 *ctx_priv;
+	uint64_t                              last_cdm_done_req;
+	uint64_t                              applied_req_id;
+	uint32_t                              cdm_handle;
+	uint8_t                               ctx_index;
+	uint8_t                               left_hw_idx;
+	uint8_t                               right_hw_idx;
+	uint8_t                               num_base;
+	enum cam_cdm_id                       cdm_id;
+	enum cam_ife_ctx_master_type          ctx_type;
+	bool                                  overflow_pending;
+	bool                                  cdm_done;
+};
+
+/**
+ * struct cam_ife_hw_mini_dump_data - Mini dump data
+ *
+ * @num_ctx:                  Number of context dumped
+ * @ctx:                      Array of context
+ *
+ */
+struct cam_ife_hw_mini_dump_data {
+	uint32_t                            num_ctx;
+	struct cam_ife_hw_mini_dump_ctx    *ctx[CAM_IFE_CTX_MAX];
+};
+
+/**
+ * cam_ife_hw_mgr_init()
+ *
+ * @brief:              Initialize the IFE hardware manger. This is the
+ *                      etnry functinon for the IFE HW manager.
+ *
+ * @hw_mgr_intf:        IFE hardware manager object returned
+ * @iommu_hdl:          Iommu handle to be returned
+ * @isp_device_type:    If device supports single-context(ife) or multi-
+ *                      context(mc_tfe)
+ *
+ */
+int cam_ife_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl,
+	uint32_t isp_device_type);
+void cam_ife_hw_mgr_deinit(void);
+int cam_ife_mgr_config_hw(void *hw_mgr_priv, void *config_hw_args);
+int cam_ife_mgr_prepare_hw_update(void *hw_mgr_priv, void *prepare_hw_update_args);
+int cam_ife_mgr_update_offline_ife_out(struct cam_ife_hw_mgr_ctx *ife_ctx);
+int cam_convert_hw_idx_to_ife_hw_num(int hw_idx);
+int cam_ife_hw_mgr_get_res(struct list_head *src_list, struct cam_isp_hw_mgr_res **res);
+int cam_ife_hw_mgr_event_handler(void *priv, uint32_t evt_id, void *evt_info);
+int cam_ife_hw_mgr_put_res(struct list_head *src_list, struct cam_isp_hw_mgr_res  **res);
+int cam_ife_hw_mgr_is_rdi_res(uint32_t res_id);
+bool cam_isp_is_ctx_primary_rdi(struct cam_ife_hw_mgr_ctx  *ctx);
+bool cam_ife_hw_mgr_is_ife_out_port(uint32_t res_id);
+bool cam_ife_hw_mgr_check_path_port_compat(uint32_t in_type, uint32_t out_type);
+int cam_convert_rdi_out_res_id_to_src(int res_id);
+enum cam_ife_pix_path_res_id cam_ife_hw_mgr_get_ife_csid_rdi_res_type(uint32_t out_port_type);
+int cam_ife_hw_mgr_acquire_res_ife_csid_pxl(struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port, bool is_ipp, bool crop_enable,
+	int index);
+int cam_ife_hw_mgr_acquire_res_ife_csid_rdi(struct cam_ife_hw_mgr_ctx  *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t *acquired_rdi_res, int index, bool per_port_acquire);
+int cam_ife_hw_mgr_acquire_res_ife_src(struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port, bool acquire_lcr, bool acquire_ppp,
+	bool is_rdi_res, uint32_t *acquired_hw_id, uint32_t *acquired_hw_path,
+	uint32_t res_path_id, int index);
+int cam_ife_hw_mgr_acquire_res_ife_out(struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port, int index);
+int cam_ife_mgr_csid_stop_hw(struct cam_ife_hw_mgr_ctx *ctx, struct list_head  *stop_list,
+		uint32_t  base_idx, uint32_t stop_cmd);
+int cam_ife_mgr_finish_clk_bw_update(struct cam_ife_hw_mgr_ctx *ctx,
+	uint64_t request_id, bool skip_clk_data_rst);
+void cam_ife_hw_mgr_stop_hw_res(struct cam_isp_hw_mgr_res *isp_hw_res);
+int cam_ife_hw_mgr_start_hw_res(struct cam_isp_hw_mgr_res *isp_hw_res,
+	struct cam_ife_hw_mgr_ctx *ctx);
+int cam_ife_hw_mgr_free_hw_res(struct cam_isp_hw_mgr_res *isp_hw_res, bool del_list);
+#endif /* _CAM_IFE_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr_addons.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr_addons.c
@@ -0,0 +1,3153 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+
+
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_isp_packet_parser.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_ife_hw_mgr_addons.h"
+#include "cam_packet_util.h"
+
+extern struct cam_ife_hw_mgr_sensor_grp_cfg  g_ife_sns_grp_cfg;
+extern struct cam_ife_hw_mgr g_ife_hw_mgr;
+extern uint32_t max_ife_out_res;
+
+int cam_ife_mgr_free_in_proc_req(struct cam_ife_hw_mgr *ife_hw_mgr,
+					uint32_t hw_id)
+{
+	struct cam_ife_mgr_offline_in_queue *c_elem;
+	struct cam_ife_mgr_offline_in_queue *c_elem_temp;
+
+	list_for_each_entry_safe(c_elem, c_elem_temp,
+			&ife_hw_mgr->in_proc_queue.list, list) {
+		if (c_elem->hw_id == hw_id) {
+			if (c_elem->request_id == 1 &&
+					ife_hw_mgr->starting_offline_cnt) {
+				ife_hw_mgr->starting_offline_cnt--;
+			}
+			list_del_init(&c_elem->list);
+			kfree(c_elem);
+		}
+	}
+	return 0;
+}
+
+unsigned int cam_ife_mgr_flush_in_queue(
+	struct cam_ife_hw_mgr *ife_hw_mgr,
+	uint32_t ctx_idx,
+	bool just_incomplete,
+	int64_t req_id)
+{
+	struct cam_ife_mgr_offline_in_queue *c_elem;
+	struct cam_ife_mgr_offline_in_queue *c_elem_temp;
+	int left = 0;
+
+	list_for_each_entry_safe(c_elem, c_elem_temp,
+			&ife_hw_mgr->input_queue.list, list) {
+		if (req_id >= 0 && req_id != c_elem->request_id)
+			continue;
+		if (c_elem->ctx_idx == ctx_idx) {
+			if (!(c_elem->ready && just_incomplete)) {
+				CAM_DBG(CAM_ISP, "flush req %d %llu",
+					c_elem->ctx_idx, c_elem->request_id);
+				c_elem->prepare.packet = NULL;
+				list_del_init(&c_elem->list);
+				kfree(c_elem);
+			} else {
+				left++;
+				CAM_DBG(CAM_ISP, "leave req %d %llu",
+					c_elem->ctx_idx, c_elem->request_id);
+			}
+		}
+	}
+	return left;
+}
+
+int cam_ife_mgr_enqueue_offline_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	struct cam_ife_hw_mgr *ife_hw_mgr        = hw_mgr_priv;
+	struct cam_hw_prepare_update_args *prepare =
+		(struct cam_hw_prepare_update_args *) prepare_hw_update_args;
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx =
+		(struct cam_ife_hw_mgr_ctx *) prepare->ctxt_to_hw_map;
+	struct cam_ife_mgr_offline_in_queue *c_elem;
+
+	c_elem = kzalloc(sizeof(struct cam_ife_mgr_offline_in_queue),
+			GFP_KERNEL);
+
+	memcpy(&c_elem->prepare, prepare,
+		sizeof(struct cam_hw_prepare_update_args));
+	c_elem->request_id = prepare->packet->header.request_id;
+	c_elem->ctx_idx = hw_mgr_ctx->ctx_idx;
+	c_elem->ready = false;
+	INIT_LIST_HEAD(&c_elem->list);
+
+	mutex_lock(&ife_hw_mgr->ctx_mutex);
+	list_add_tail(&c_elem->list, &ife_hw_mgr->input_queue.list);
+	mutex_unlock(&ife_hw_mgr->ctx_mutex);
+	return 0;
+}
+
+int cam_ife_mgr_enqueue_offline_config(void *hw_mgr_priv,
+	void *config_hw_args)
+{
+	int rc = -EINVAL;
+	int found = 0;
+	struct cam_ife_mgr_offline_in_queue *c_elem, *print_elem;
+	struct cam_ife_hw_mgr         *ife_hw_mgr = hw_mgr_priv;
+	struct cam_hw_config_args     *cfg =
+			(struct cam_hw_config_args *)config_hw_args;
+	struct cam_ife_hw_mgr_ctx     *hw_mgr_ctx =
+			(struct cam_ife_hw_mgr_ctx *) cfg->ctxt_to_hw_map;
+
+	mutex_lock(&ife_hw_mgr->ctx_mutex);
+	list_for_each_entry(c_elem, &ife_hw_mgr->input_queue.list, list) {
+		if (c_elem->prepare.packet->header.request_id != cfg->request_id ||
+			c_elem->ctx_idx != hw_mgr_ctx->ctx_idx) {
+			CAM_DBG(CAM_ISP, "#INVALID# input queue# c_elem %p %p %llu %d cfg %llu %d",
+				c_elem, hw_mgr_ctx->concr_ctx, c_elem->prepare.packet->header.request_id,
+				c_elem->ctx_idx, cfg->request_id, hw_mgr_ctx->ctx_idx);
+			continue;
+		}
+		rc = 0;
+		memcpy(&c_elem->cfg, cfg,
+				sizeof(struct cam_hw_config_args));
+		c_elem->ready = true;
+		found = 1;
+		break;
+	}
+
+	//add log to scan input queue list
+	if (found == 0) {
+		list_for_each_entry(print_elem, &ife_hw_mgr->input_queue.list, list) {
+			CAM_DBG(CAM_ISP,
+				"#PRINT QUEUE# ife mgr ctx %p c_elem %p req id %llu ctx id %d",
+				hw_mgr_ctx, print_elem, c_elem->prepare.packet->header.request_id,
+				c_elem->ctx_idx);
+		}
+	}
+	mutex_unlock(&ife_hw_mgr->ctx_mutex);
+	return rc;
+}
+
+int cam_ife_mgr_check_start_processing(void *hw_mgr_priv,
+		struct cam_ife_hw_mgr_ctx *hw_mgr_ctx)
+{
+	struct cam_ife_mgr_offline_in_queue   *c_elem;
+	struct cam_ife_mgr_offline_in_queue   *c_elem_temp;
+	struct cam_ife_hw_mgr_ctx             *run_hw_mgr_ctx;
+	struct cam_ife_hw_mgr                 *ife_hw_mgr        = hw_mgr_priv;
+	struct cam_ife_hw_concrete_ctx        *c_ctx = NULL;
+	int rc = 0;
+	uint32_t state;
+	bool found = false;
+	bool is_init_pkt;
+
+
+	mutex_lock(&ife_hw_mgr->ctx_mutex);
+
+	if (list_empty(&ife_hw_mgr->used_ctx_list)) {
+		CAM_INFO(CAM_ISP, "Currently no ctx in use");
+		mutex_unlock(&ife_hw_mgr->ctx_mutex);
+		return rc;
+	}
+
+	list_for_each_entry(c_ctx, &ife_hw_mgr->used_ctx_list, list) {
+		state = atomic_read(&c_ctx->ctx_state);
+		if (!c_ctx->flags.is_offline ||
+			(state != CAM_IFE_HW_STATE_STARTED &&
+			state != CAM_IFE_HW_STATE_STARTING)) {
+			CAM_DBG(CAM_ISP,
+				"#REJECT# FAILED to get ife, current concr_ctx : ctx id %p : %d offline %d acquired_hw_id %d state %d",
+				c_ctx, c_ctx->ctx_index,
+				c_ctx->flags.is_offline,
+				c_ctx->acquired_hw_id, state);
+			continue;
+		}
+
+		cam_ife_mgr_free_in_proc_req(ife_hw_mgr,
+						c_ctx->acquired_hw_id);
+
+		found = false;
+		list_for_each_entry_safe(c_elem, c_elem_temp,
+				&ife_hw_mgr->input_queue.list, list) {
+			is_init_pkt =
+				((c_elem->prepare.packet->header.op_code + 1) &
+					0xF) == CAM_ISP_PACKET_INIT_DEV;
+			if (c_ctx->waiting_start &&
+				c_elem->ctx_idx != c_ctx->start_ctx_idx) {
+				CAM_DBG(CAM_ISP,
+					"#REJECT#: WAITING start %d input queue elem ctx idx %d start cxt idx %d req id %llu",
+					c_ctx->waiting_start,
+					c_elem->ctx_idx,
+					c_ctx->start_ctx_idx,
+					c_elem->request_id);
+				continue;
+			}
+			if (!c_elem->ready) {
+				CAM_DBG(CAM_ISP, "#REJECT#: input queue elem ctx idx %d req id %llu NOT ready",
+						c_elem->ctx_idx, c_elem->request_id);
+				continue;
+			}
+			if (ife_hw_mgr->starting_offline_cnt == 0 &&
+				c_elem->request_id == 0) {
+				c_elem->hw_id = c_ctx->acquired_hw_id;
+				list_del_init(&c_elem->list);
+				list_add_tail(&c_elem->list,
+					&ife_hw_mgr->in_proc_queue.list);
+				CAM_DBG(CAM_ISP,
+					"Skip init config for already started HW");
+				continue;
+			}
+			if (c_elem->request_id !=
+				c_elem->prepare.packet->header.request_id)
+				CAM_ERR(CAM_ISP,
+					"Request id mismatch. Packet recycled before use!");
+
+			run_hw_mgr_ctx =
+				&ife_hw_mgr->virt_ctx_pool[c_elem->ctx_idx];
+			if (!run_hw_mgr_ctx->ctx_in_use)
+				CAM_ERR(CAM_ISP, "UNUSED CONTEXT %d",
+						c_elem->ctx_idx);
+			run_hw_mgr_ctx->concr_ctx = c_ctx;
+			c_elem->prepare.ctxt_to_hw_map = run_hw_mgr_ctx;
+			c_elem->cfg.ctxt_to_hw_map = run_hw_mgr_ctx;
+			found = true;
+			list_del_init(&c_elem->list);
+			c_elem->hw_id = c_ctx->acquired_hw_id;
+			list_add_tail(&c_elem->list,
+				&ife_hw_mgr->in_proc_queue.list);
+			break;
+		}
+		CAM_DBG(CAM_ISP, "found %d offline inqueue elem %p ctx %d",
+					found, c_elem, c_elem->ctx_idx);
+		if (found) {
+			/* For the zero request we do not get event,
+			 * so restore state
+			 */
+			if (c_elem->cfg.request_id != 0) {
+				c_ctx->waiting_start = false;
+				atomic_set(&c_ctx->ctx_state,
+						CAM_IFE_HW_STATE_BUSY);
+			} else {
+				c_ctx->waiting_start = true;
+				c_ctx->start_ctx_idx = c_elem->ctx_idx;
+			}
+
+			c_ctx->served_ctx_w = 1 - c_ctx->served_ctx_w;
+			c_ctx->served_ctx_id[c_ctx->served_ctx_w] =
+							run_hw_mgr_ctx->ctx_idx;
+			if (ife_hw_mgr->offline_reconfig)
+				cam_ife_mgr_update_offline_ife_out(run_hw_mgr_ctx);
+
+			rc = cam_ife_mgr_prepare_hw_update(hw_mgr_priv,
+					&c_elem->prepare);
+			c_elem->cfg.num_hw_update_entries =
+				c_elem->prepare.num_hw_update_entries;
+			rc = cam_ife_mgr_config_hw(hw_mgr_priv, &c_elem->cfg);
+		}
+	}
+
+	mutex_unlock(&ife_hw_mgr->ctx_mutex);
+	return rc;
+}
+
+static uint32_t cam_ife_mgr_clk_to_bw(uint32_t clk, uint32_t bpc)
+{
+	return clk * bpc;
+}
+
+static uint32_t cam_ife_mgr_bw_to_clk(uint32_t bw, uint32_t bpc)
+{
+	return bw / bpc;
+}
+
+static uint32_t cam_ife_mgr_calc_bw(struct cam_ife_mgr_bw_data *bw_data)
+{
+	uint32_t bw;
+
+	bw = bw_data->width * bw_data->height * bw_data->framerate;
+	switch (bw_data->format) {
+	case CAM_FORMAT_MIPI_RAW_8:
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		bw = 5 * (bw / 4);
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+		bw = 3 * (bw / 2);
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		bw = 5 * (bw / 2);
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_12:
+	case CAM_FORMAT_PLAIN16_14:
+	case CAM_FORMAT_PLAIN16_16:
+		bw *= 2;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported format %d", bw_data->format);
+		break;
+	}
+	return bw;
+}
+
+int cam_ife_validate_config(
+	struct cam_isp_in_port_generic_info   *curr_in_port,
+	struct cam_isp_in_port_generic_info   *prev_in_port)
+{
+	struct cam_isp_out_port_generic_info  *curr_out_port;
+	struct cam_isp_out_port_generic_info  *prev_out_port;
+	bool reconfig = false;
+	int i;
+
+	for (i = 0; i < curr_in_port->num_out_res; i++) {
+		curr_out_port = &curr_in_port->data[i];
+		prev_out_port = &prev_in_port->data[i];
+		if (curr_out_port->res_type == prev_out_port->res_type) {
+			if ((curr_out_port->width != prev_out_port->width) &&
+				(curr_out_port->height != prev_out_port->height)) {
+				reconfig = true;
+				break;
+			}
+		} else {
+			reconfig = true;
+			break;
+		}
+	}
+	return reconfig;
+}
+
+int cam_ife_find_reconfig_required(void *hw_mgr_priv,
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx)
+{
+	struct cam_ife_hw_mgr_ctx             *offline_hw_mgr_ctx;
+	struct cam_ife_hw_mgr                 *ife_hw_mgr = hw_mgr_priv;
+	bool reconfig = false;
+	int i, j;
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		if (ife_hw_mgr->virt_ctx_pool[i].is_offline &&
+			ife_hw_mgr->virt_ctx_pool[i].ctx_in_use) {
+			offline_hw_mgr_ctx = &ife_hw_mgr->virt_ctx_pool[i];
+			for (j = 0; j < hw_mgr_ctx->num_in_ports; j++) {
+				if (cam_ife_validate_config(&hw_mgr_ctx->in_ports[j],
+					&offline_hw_mgr_ctx->in_ports[j])) {
+					CAM_DBG(CAM_ISP,"Offline ISP reconfig required ctx %d",
+						offline_hw_mgr_ctx->ctx_idx);
+					return true;
+				}
+			}
+		}
+	}
+	return reconfig;
+}
+
+int cam_ife_mgr_required_hw(void *hw_mgr_priv, bool stop)
+{
+	struct cam_ife_hw_mgr          *ife_hw_mgr = hw_mgr_priv;
+	uint32_t                        max_bw, current_bw;
+	uint64_t                        total_bw;
+	uint64_t                        nom_bw_per_hw;
+	uint64_t                        max_bw_per_hw;
+
+	int i, cnt, req_hw;
+
+	nom_bw_per_hw = cam_ife_mgr_clk_to_bw(ife_hw_mgr->nom_clk_threshold,
+				ife_hw_mgr->bytes_per_clk);
+	max_bw_per_hw = cam_ife_mgr_clk_to_bw(ife_hw_mgr->max_clk_threshold,
+				ife_hw_mgr->bytes_per_clk);
+
+	total_bw = 0;
+	max_bw = 0;
+	cnt = 0;
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		if (ife_hw_mgr->virt_ctx_pool[i].ctx_in_use &&
+				ife_hw_mgr->virt_ctx_pool[i].is_offline) {
+			current_bw = cam_ife_mgr_calc_bw(
+				&ife_hw_mgr->virt_ctx_pool[i].bw_data);
+			if (current_bw > max_bw)
+				max_bw = current_bw;
+			total_bw += current_bw;
+			cnt++;
+	}
+	}
+
+	/* If only one context presents - we need to stop all HW*/
+	if ((stop) && (cnt == 1))
+		return 0;
+
+	if (max_bw < nom_bw_per_hw)
+		req_hw = (uint32_t)((total_bw + nom_bw_per_hw - 1) /
+				nom_bw_per_hw);
+	else {
+		req_hw = (uint32_t)((total_bw + max_bw_per_hw - 1) /
+				max_bw_per_hw);
+	}
+
+	if (req_hw > CAM_MAX_OFFLINE_HW)
+		req_hw = CAM_MAX_OFFLINE_HW;
+
+	if (total_bw / req_hw > max_bw)
+		ife_hw_mgr->offline_clk =
+			cam_ife_mgr_bw_to_clk(total_bw / req_hw,
+				ife_hw_mgr->bytes_per_clk);
+	else
+		ife_hw_mgr->offline_clk =
+			cam_ife_mgr_bw_to_clk(max_bw,
+				ife_hw_mgr->bytes_per_clk);
+
+	if (ife_hw_mgr->offline_clk > ife_hw_mgr->max_clk_threshold)
+		ife_hw_mgr->offline_clk = ife_hw_mgr->max_clk_threshold;
+	else if (ife_hw_mgr->offline_clk < ife_hw_mgr->min_clk_threshold)
+		ife_hw_mgr->offline_clk = ife_hw_mgr->min_clk_threshold;
+
+		/*
+	 * make the offline SFE clock rate follow offline IFE clock
+		 */
+	ife_hw_mgr->offline_sfe_clk  = ife_hw_mgr->offline_clk;
+
+	CAM_DBG(CAM_ISP,
+			"Offline starting %d, CTXs %d, BW: %u needed %d IFEs @ :clk %d sfe clk %d",
+			stop, cnt, total_bw,
+			req_hw, ife_hw_mgr->offline_clk,
+			ife_hw_mgr->offline_sfe_clk);
+
+	return req_hw;
+}
+
+int cam_ife_mgr_get_rdi_stream_cfg_cnt(
+	struct cam_isp_sensor_group_config   *sensor_grp_config,
+	int                                   index)
+{
+	uint32_t cnt = 0;
+	int i;
+
+	for (i = 0; i < sensor_grp_config->stream_grp_cfg[index].stream_cfg_cnt; i++) {
+		switch (sensor_grp_config->stream_grp_cfg[index].stream_cfg[i].path_id) {
+		case CAM_ISP_VIRTUAL_RDI0_PATH:
+		case CAM_ISP_VIRTUAL_RDI1_PATH:
+		case CAM_ISP_VIRTUAL_RDI2_PATH:
+		case CAM_ISP_VIRTUAL_RDI3_PATH:
+		case CAM_ISP_VIRTUAL_RDI4_PATH:
+		case CAM_ISP_VIRTUAL_RDI5_PATH:
+			cnt++;
+			CAM_DBG(CAM_ISP, "path_id: %d",
+				sensor_grp_config->stream_grp_cfg[index].stream_cfg[i].path_id);
+			break;
+		default:
+			CAM_DBG(CAM_ISP, "Not rdi path_id: %d",
+				sensor_grp_config->stream_grp_cfg[index].stream_cfg[i].path_id);
+		}
+	}
+	return cnt;
+}
+
+int cam_ife_mgr_update_vc_dt_sensor_stream_cfg(
+	uint32_t                 path_id,
+	uint32_t                 vc,
+	uint32_t                 dt,
+	int                      idx,
+	int                      stream_idx)
+{
+	int   rc = -EINVAL;
+	int   j;
+	struct cam_ife_hw_mgr_stream_grp_config  *grp_cfg;
+
+	grp_cfg = g_ife_sns_grp_cfg.grp_cfg[idx];
+
+	switch (path_id) {
+	case CAM_ISP_PXL_PATH:
+		if (grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_pxl) {
+			CAM_ERR(CAM_ISP,
+				"only 1 valid pxl vc-dt is accepted for given sensor:%d",
+				grp_cfg->stream_cfg[stream_idx].sensor_id);
+			return -EINVAL;
+		}
+
+		grp_cfg->stream_cfg[stream_idx].pxl_vc = vc;
+		grp_cfg->stream_cfg[stream_idx].pxl_dt = dt;
+		grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_pxl++;
+		CAM_DBG(CAM_ISP,
+			"Incrementing for g_ife_sns_grp_cfg.grp_cfg[%d]->stream_cfg[%d].num_valid_vc_dt_pxl: %d",
+			idx, stream_idx, grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_pxl);
+		rc = 0;
+		break;
+	case CAM_ISP_PPP_PATH:
+		if (grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_ppp) {
+			CAM_ERR(CAM_ISP,
+				"only 1 valid ppp vc-dt is accepted for given sensor:%d",
+				grp_cfg->stream_cfg[stream_idx].sensor_id);
+			return -EINVAL;
+		}
+
+		grp_cfg->stream_cfg[stream_idx].ppp_vc = vc;
+		grp_cfg->stream_cfg[stream_idx].ppp_dt = dt;
+		grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_ppp++;
+		CAM_DBG(CAM_ISP,
+			"Incrementing for g_ife_sns_grp_cfg.grp_cfg[%d]->stream_cfg[%d].num_valid_vc_dt_ppp: %d",
+			idx, stream_idx, grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_ppp);
+		rc = 0;
+		break;
+	case CAM_ISP_LCR_PATH:
+		if (grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_lcr) {
+			CAM_ERR(CAM_ISP,
+				"only 1 valid lcr vc-dt is accepted for given sensor:%d",
+				grp_cfg->stream_cfg[stream_idx].sensor_id);
+			return -EINVAL;
+		}
+
+		grp_cfg->stream_cfg[stream_idx].lcr_vc = vc;
+		grp_cfg->stream_cfg[stream_idx].lcr_dt = dt;
+		grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_lcr++;
+		CAM_DBG(CAM_ISP,
+			"Incrementing for g_ife_sns_grp_cfg.grp_cfg[%d]->stream_cfg[%d].num_valid_vc_dt_lcr: %d",
+			idx, stream_idx, grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_lcr);
+		rc = 0;
+		break;
+	case CAM_ISP_VIRTUAL_RDI0_PATH:
+	case CAM_ISP_VIRTUAL_RDI1_PATH:
+	case CAM_ISP_VIRTUAL_RDI2_PATH:
+	case CAM_ISP_VIRTUAL_RDI3_PATH:
+	case CAM_ISP_VIRTUAL_RDI4_PATH:
+	case CAM_ISP_VIRTUAL_RDI5_PATH:
+		for (j = 0; j < CAM_ISP_VC_DT_CFG; j++) {
+			if ((!grp_cfg->stream_cfg[stream_idx].rdi_vc[j]) &&
+				(!grp_cfg->stream_cfg[stream_idx].rdi_dt[j])) {
+				grp_cfg->stream_cfg[stream_idx].rdi_vc[j] = vc;
+				grp_cfg->stream_cfg[stream_idx].rdi_dt[j] = dt;
+				grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_rdi++;
+				CAM_DBG(CAM_ISP,
+					"Incrementing for g_ife_sns_grp_cfg.grp_cfg[%d]->stream_cfg[%d].num_valid_vc_dt_rdi: %d",
+					idx, stream_idx,
+					grp_cfg->stream_cfg[stream_idx].num_valid_vc_dt_rdi);
+				rc = 0;
+				break;
+			}
+		}
+		if (j == CAM_ISP_VC_DT_CFG) {
+			CAM_ERR(CAM_ISP, "no free vc-dt available to update");
+			rc = -EFAULT;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "invalid path_id :%d for sensor_id :%d",
+			path_id,
+			grp_cfg->stream_cfg[stream_idx].sensor_id);
+		rc = -EFAULT;
+		break;
+	}
+
+	return rc;
+}
+
+int cam_ife_mgr_check_for_previous_sensor_cfg(
+	struct cam_isp_sensor_group_config   *sensor_grp_config,
+	int                                   grp_idx,
+	int                                   sensor_grp_stream_idx,
+	int                                   stream_idx)
+{
+	int   rc = -EINVAL;
+	int   i;
+	struct cam_ife_hw_mgr_stream_grp_config  *grp_cfg;
+	struct cam_isp_stream_grp_config         *stream_grp_cfg;
+
+	grp_cfg = g_ife_sns_grp_cfg.grp_cfg[grp_idx];
+	stream_grp_cfg = &sensor_grp_config->stream_grp_cfg[sensor_grp_stream_idx];
+
+	for (i = 0; i < grp_cfg->stream_cfg_cnt; i++) {
+		if (grp_cfg->stream_cfg[i].sensor_id ==
+			stream_grp_cfg->stream_cfg[stream_idx].sensor_id) {
+			grp_cfg->stream_cfg[i].color_filter_arrangement +=
+				stream_grp_cfg->stream_cfg[stream_idx].color_filter_arrangement;
+			if (stream_grp_cfg->stream_cfg[stream_idx].color_filter_arrangement)
+				grp_cfg->rdi_yuv_conversion_stream_cnt +=
+				stream_grp_cfg->stream_cfg[stream_idx].color_filter_arrangement;
+			rc = cam_ife_mgr_update_vc_dt_sensor_stream_cfg(
+					stream_grp_cfg->stream_cfg[stream_idx].path_id,
+					stream_grp_cfg->stream_cfg[stream_idx].vc,
+					stream_grp_cfg->stream_cfg[stream_idx].dt, grp_idx, i);
+			break;
+		}
+	}
+	return rc;
+}
+
+int cam_ife_mgr_dump_sensor_grp_stream_cfg(void)
+{
+	int i, j, k;
+	struct cam_ife_hw_mgr_stream_grp_config  *grp_cfg;
+
+	CAM_DBG(CAM_ISP, "num_grp_cfg :%d",
+		g_ife_sns_grp_cfg.num_grp_cfg);
+
+	for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+		if (!g_ife_sns_grp_cfg.grp_cfg[i])
+			continue;
+
+		grp_cfg = g_ife_sns_grp_cfg.grp_cfg[i];
+		CAM_DBG(CAM_ISP, "stream_cfg_cnt: %d", grp_cfg->stream_cfg_cnt);
+
+		for (j = 0; j < grp_cfg->stream_cfg_cnt; j++) {
+			CAM_DBG(CAM_ISP,
+				"i:%d sensor_id:%d pxl :%d rdi :%d lcr:%d ppp:%d decode_fmt:%d color_filter_arrangement:%d",
+				i, grp_cfg->stream_cfg[j].sensor_id,
+				grp_cfg->stream_cfg[j].num_valid_vc_dt_pxl,
+				grp_cfg->stream_cfg[j].num_valid_vc_dt_rdi,
+				grp_cfg->stream_cfg[j].num_valid_vc_dt_lcr,
+				grp_cfg->stream_cfg[j].num_valid_vc_dt_ppp,
+				grp_cfg->stream_cfg[j].decode_format,
+				grp_cfg->stream_cfg[j].color_filter_arrangement);
+
+			if (grp_cfg->stream_cfg[j].num_valid_vc_dt_rdi) {
+				for (k = 0; k < grp_cfg->stream_cfg[j].num_valid_vc_dt_rdi;
+					k++) {
+					CAM_DBG(CAM_ISP, "RDI VC_DT k: %d vc:%d dt: %d", k,
+						grp_cfg->stream_cfg[j].rdi_vc[k],
+						grp_cfg->stream_cfg[j].rdi_dt[k]);
+				}
+			}
+
+			if (grp_cfg->stream_cfg[j].num_valid_vc_dt_pxl) {
+				CAM_DBG(CAM_ISP, "PXL VC_DT vc:%d dt: %d",
+					grp_cfg->stream_cfg[j].pxl_vc,
+					grp_cfg->stream_cfg[j].pxl_dt);
+			}
+			if (grp_cfg->stream_cfg[j].num_valid_vc_dt_ppp) {
+				CAM_DBG(CAM_ISP, "PPP VC_DT vc:%d dt: %d",
+					grp_cfg->stream_cfg[j].ppp_vc,
+					grp_cfg->stream_cfg[j].ppp_dt);
+			}
+			if (grp_cfg->stream_cfg[j].num_valid_vc_dt_lcr) {
+				CAM_DBG(CAM_ISP, "LCR VC_DT vc:%d dt: %d",
+					grp_cfg->stream_cfg[j].lcr_vc,
+					grp_cfg->stream_cfg[j].lcr_dt);
+			}
+		}
+	}
+	return 0;
+}
+
+int cam_ife_mgr_clear_sensor_stream_cfg_grp(uint32_t grp_cfg_idx)
+{
+	kfree(g_ife_sns_grp_cfg.grp_cfg[grp_cfg_idx]->res_list_ife_out);
+	g_ife_sns_grp_cfg.grp_cfg[grp_cfg_idx]->res_list_ife_out = NULL;
+	kfree(g_ife_sns_grp_cfg.grp_cfg[grp_cfg_idx]);
+	g_ife_sns_grp_cfg.grp_cfg[grp_cfg_idx] = NULL;
+	g_ife_sns_grp_cfg.num_grp_cfg--;
+	return 0;
+}
+
+struct cam_ife_hw_mgr_stream_grp_config *cam_ife_mgr_get_free_grp_cfg(uint32_t *grp_idx)
+{
+	int i;
+
+	for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+		if (g_ife_sns_grp_cfg.grp_cfg[i])
+			continue;
+		g_ife_sns_grp_cfg.grp_cfg[i] = kcalloc(CAM_ISP_STREAM_GROUP_CFG_MAX,
+			sizeof(struct cam_ife_hw_mgr_stream_grp_config), GFP_KERNEL);
+		if (!g_ife_sns_grp_cfg.grp_cfg[i]) {
+			CAM_ERR(CAM_ISP, "Alloc failed for grp_cfg[%d]", i);
+			return ERR_PTR(-ENOMEM);
+		}
+		break;
+	}
+
+	if (i == CAM_ISP_STREAM_GROUP_CFG_MAX) {
+		CAM_ERR(CAM_ISP, "No uninitialized g_ife_sns_grp_cfg.grp_cfg found");
+		return ERR_PTR(-ENOENT);
+	}
+
+	*grp_idx = i;
+	return g_ife_sns_grp_cfg.grp_cfg[i];
+}
+
+static bool cam_ife_hw_mgr_check_grp_cfg(
+	struct cam_isp_stream_grp_config *stream_grp_cfg)
+{
+	int i;
+	struct cam_ife_hw_mgr_stream_grp_config  *grp_cfg;
+	bool rc = false;
+
+	for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+		if (!g_ife_sns_grp_cfg.grp_cfg[i])
+			continue;
+		grp_cfg = g_ife_sns_grp_cfg.grp_cfg[i];
+		if ((stream_grp_cfg->res_type == grp_cfg->res_type) &&
+			(stream_grp_cfg->lane_type == grp_cfg->lane_type) &&
+			(stream_grp_cfg->lane_num == grp_cfg->lane_num) &&
+			(stream_grp_cfg->lane_cfg == grp_cfg->lane_cfg) &&
+			(stream_grp_cfg->feature_mask == grp_cfg->feature_mask)) {
+			rc = true;
+			break;
+		}
+	}
+	return rc;
+}
+
+static bool cam_ife_hw_mgr_check_sensor_id(uint32_t sensor_id, uint32_t *grp_idx)
+{
+	int i, j;
+	bool rc = false;
+	struct cam_ife_hw_mgr_stream_grp_config *grp_cfg;
+
+	for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+		if (!g_ife_sns_grp_cfg.grp_cfg[i])
+			continue;
+
+		grp_cfg = g_ife_sns_grp_cfg.grp_cfg[i];
+		for (j = 0; j < grp_cfg->stream_cfg_cnt; j++) {
+			if (sensor_id == grp_cfg->stream_cfg[j].sensor_id) {
+				rc = true;
+				*grp_idx = i;
+				break;
+			}
+		}
+		if (rc)
+			break;
+	}
+	return rc;
+}
+
+static int cam_ife_hw_mgr_check_for_duplicate_grp_info(
+	struct cam_isp_stream_grp_config *stream_grp_cfg)
+{
+	int i;
+	uint32_t grp_idx;
+	bool found = false;
+
+	for (i = 0; i < stream_grp_cfg->stream_cfg_cnt; i++) {
+		found = cam_ife_hw_mgr_check_sensor_id(stream_grp_cfg->stream_cfg[i].sensor_id,
+				&grp_idx);
+		if (found) {
+			if (g_ife_sns_grp_cfg.grp_cfg[grp_idx]->acquire_cnt) {
+				CAM_ERR(CAM_ISP,
+					"grp_cfg[%d] is already updated with sensor_id:%d and acquired with acquire_cnt:%d",
+					grp_idx, stream_grp_cfg->stream_cfg[i].sensor_id,
+					g_ife_sns_grp_cfg.grp_cfg[grp_idx]->acquire_cnt);
+				return -EINVAL;
+			}
+			cam_ife_mgr_clear_sensor_stream_cfg_grp(grp_idx);
+		}
+	}
+	return 0;
+}
+
+static void cam_ife_mgr_handle_sensor_grp_cfg_update_fail(
+	struct cam_isp_sensor_group_config *sensor_grp_config, int sensor_grp_stream_idx)
+{
+	int i, j;
+	uint32_t grp_idx;
+	struct cam_isp_stream_grp_config *stream_grp_cfg;
+
+	for (i = sensor_grp_stream_idx; i >= 0; i--) {
+		stream_grp_cfg = &sensor_grp_config->stream_grp_cfg[i];
+		for (j = 0; j < stream_grp_cfg->stream_cfg_cnt; j++) {
+			if (cam_ife_hw_mgr_check_sensor_id(stream_grp_cfg->stream_cfg[i].sensor_id,
+				&grp_idx))
+				cam_ife_mgr_clear_sensor_stream_cfg_grp(grp_idx);
+		}
+	}
+}
+
+int cam_ife_mgr_update_sensor_grp_stream_cfg(void *hw_mgr_priv,
+	void *hw_cfg_args)
+{
+	int rc = -EFAULT;
+	int i, j;
+	uint32_t grp_idx = 0;
+	bool grp_found;
+	struct cam_update_sensor_stream_cfg_cmd  *cfg_cmd = hw_cfg_args;
+	struct cam_ife_hw_mgr_stream_grp_config  *grp_cfg;
+	struct cam_isp_hw_mgr_res                *res_list_ife_out;
+	struct cam_isp_sensor_group_config       *sensor_grp_config = NULL;
+	struct cam_isp_stream_grp_config         *stream_grp_cfg;
+
+	sensor_grp_config = memdup_user(u64_to_user_ptr(cfg_cmd->cfg_handle),
+		sizeof(struct cam_isp_sensor_group_config));
+	if (IS_ERR(sensor_grp_config)) {
+		CAM_ERR(CAM_ISP, "failed to copy sensor group config data from user, rc:%d",
+		PTR_ERR(sensor_grp_config));
+		return PTR_ERR(sensor_grp_config);
+	}
+
+	if (g_ife_sns_grp_cfg.num_grp_cfg > CAM_ISP_STREAM_GROUP_CFG_MAX ||
+		sensor_grp_config->num_grp_cfg == 0 ||
+		sensor_grp_config->num_grp_cfg > CAM_ISP_STREAM_GROUP_CFG_MAX) {
+		CAM_ERR(CAM_ISP,
+			"invalid g_ife_sns_grp_cfg.num_grp_cfg:%d or sensor_grp_config->num_grp_cfg:%d",
+			g_ife_sns_grp_cfg.num_grp_cfg, sensor_grp_config->num_grp_cfg);
+		kfree(sensor_grp_config);
+		return rc;
+	}
+
+	for (i = 0; i < sensor_grp_config->num_grp_cfg; i++) {
+		stream_grp_cfg = &sensor_grp_config->stream_grp_cfg[i];
+		if (stream_grp_cfg->stream_cfg_cnt > CAM_ISP_STREAM_CFG_MAX) {
+			CAM_ERR(CAM_ISP,
+				"stream config count %d exceed max supported value %d for stream_grp_cfg idx:%d",
+				stream_grp_cfg->stream_cfg_cnt, CAM_ISP_STREAM_CFG_MAX, i);
+			return -EINVAL;
+		}
+
+		grp_found = cam_ife_hw_mgr_check_grp_cfg(stream_grp_cfg);
+		if (grp_found) {
+			rc = cam_ife_hw_mgr_check_for_duplicate_grp_info(stream_grp_cfg);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Invalid sensor group config data update request for stream_grp_cfg[%d]",
+					i);
+				kfree(sensor_grp_config);
+				return rc;
+			}
+		}
+		grp_cfg = cam_ife_mgr_get_free_grp_cfg(&grp_idx);
+		if (IS_ERR(grp_cfg)) {
+			CAM_ERR(CAM_ISP,
+				"Failed to get free grp cfg for grp:%d sensor_grp_config->num_grp_cfg:%d g_ife_sns_grp_cfg.num_grp_cfg:%d",
+				i, sensor_grp_config->num_grp_cfg, g_ife_sns_grp_cfg.num_grp_cfg);
+			kfree(sensor_grp_config);
+			return PTR_ERR(grp_cfg);
+		}
+
+		/*init res_list pool */
+		INIT_LIST_HEAD(&grp_cfg->free_res_list);
+		INIT_LIST_HEAD(&grp_cfg->res_ife_csid_list);
+		INIT_LIST_HEAD(&grp_cfg->res_ife_src_list);
+		mutex_init(&grp_cfg->lock);
+
+		for (j = 0; j < CAM_IFE_HW_STREAM_GRP_RES_POOL_MAX; j++) {
+			INIT_LIST_HEAD(
+				&grp_cfg->res_pool[j].list);
+			list_add_tail(
+				&grp_cfg->res_pool[j].list,
+				&grp_cfg->free_res_list);
+		}
+
+		grp_cfg->res_type     = stream_grp_cfg->res_type;
+		grp_cfg->lane_type    = stream_grp_cfg->lane_type;
+		grp_cfg->lane_num     = stream_grp_cfg->lane_num;
+		grp_cfg->lane_cfg     = stream_grp_cfg->lane_cfg;
+		grp_cfg->feature_mask = stream_grp_cfg->feature_mask;
+
+		for (j = 0; j < stream_grp_cfg->stream_cfg_cnt; j++) {
+			/*check if configuration is for previous sensor id */
+			rc = cam_ife_mgr_check_for_previous_sensor_cfg(sensor_grp_config,
+				grp_idx, i, j);
+			if (!rc)
+				continue;
+			if (rc == -EFAULT)
+				goto err;
+
+			grp_cfg->stream_cfg[grp_cfg->stream_cfg_cnt].sensor_id =
+				stream_grp_cfg->stream_cfg[j].sensor_id;
+			grp_cfg->stream_cfg[grp_cfg->stream_cfg_cnt].decode_format =
+				stream_grp_cfg->stream_cfg[j].decode_format;
+			grp_cfg->stream_cfg[grp_cfg->stream_cfg_cnt].color_filter_arrangement =
+				stream_grp_cfg->stream_cfg[j].color_filter_arrangement;
+
+			if (stream_grp_cfg->stream_cfg[j].color_filter_arrangement)
+				grp_cfg->rdi_yuv_conversion_stream_cnt +=
+					stream_grp_cfg->stream_cfg[j].color_filter_arrangement;
+
+			rc = cam_ife_mgr_update_vc_dt_sensor_stream_cfg(
+					stream_grp_cfg->stream_cfg[j].path_id,
+					stream_grp_cfg->stream_cfg[j].vc,
+					stream_grp_cfg->stream_cfg[j].dt, grp_idx,
+					grp_cfg->stream_cfg_cnt);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Invalid path_id :%d sensor_id:%d valid_vc_dt [%d %d %d %d]",
+					stream_grp_cfg->stream_cfg[j].path_id,
+					stream_grp_cfg->stream_cfg[j].sensor_id,
+					grp_cfg->stream_cfg[grp_cfg->stream_cfg_cnt].num_valid_vc_dt_pxl,
+					grp_cfg->stream_cfg[grp_cfg->stream_cfg_cnt].num_valid_vc_dt_ppp,
+					grp_cfg->stream_cfg[grp_cfg->stream_cfg_cnt].num_valid_vc_dt_lcr,
+					grp_cfg->stream_cfg[grp_cfg->stream_cfg_cnt].num_valid_vc_dt_rdi);
+					rc = -EFAULT;
+					goto err;
+			}
+			grp_cfg->stream_cfg_cnt++;
+			if (grp_cfg->stream_cfg_cnt > CAM_ISP_STREAM_CFG_MAX) {
+				CAM_ERR(CAM_ISP,
+					"stream config count exceed max supported value");
+				rc = -EFAULT;
+				goto err;
+			}
+		}
+
+		grp_cfg->rdi_stream_cfg_cnt =
+				cam_ife_mgr_get_rdi_stream_cfg_cnt(sensor_grp_config, i);
+
+		CAM_DBG(CAM_ISP,
+			"rdi_stream_cfg_cnt : %d stream_cfg_cnt:%d rdi_yuv_conversion_stream_cnt:%d",
+			grp_cfg->rdi_stream_cfg_cnt, grp_cfg->stream_cfg_cnt,
+			grp_cfg->rdi_yuv_conversion_stream_cnt);
+
+		grp_cfg->res_list_ife_out = kcalloc(max_ife_out_res,
+			sizeof(struct cam_isp_hw_mgr_res), GFP_KERNEL);
+		if (!grp_cfg->res_list_ife_out) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_ISP, "Alloc failed for ife out res list");
+			goto err;
+		}
+
+		for (j = 0; j < max_ife_out_res; j++) {
+			res_list_ife_out = &grp_cfg->res_list_ife_out[j];
+			INIT_LIST_HEAD(&res_list_ife_out->list);
+		}
+		g_ife_sns_grp_cfg.num_grp_cfg++;
+	}
+	cam_ife_mgr_dump_sensor_grp_stream_cfg();
+
+	kfree(sensor_grp_config);
+	return rc;
+err:
+	cam_ife_mgr_handle_sensor_grp_cfg_update_fail(sensor_grp_config, i);
+	kfree(sensor_grp_config);
+	return rc;
+}
+
+bool cam_ife_hw_mgr_check_outport_supported_for_lite(
+	uint32_t res_type)
+{
+	bool vfe_out_supported_lite = false;
+
+	switch (res_type) {
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+	case CAM_ISP_IFE_LITE_OUT_RES_PREPROCESS_RAW:
+	case CAM_ISP_IFE_LITE_OUT_RES_STATS_BG:
+		vfe_out_supported_lite = true;
+		break;
+	default:
+		vfe_out_supported_lite = false;
+		CAM_DBG(CAM_ISP, "Invalid isp res id: %d not supported for lite target",
+			res_type);
+		break;
+	}
+
+	return vfe_out_supported_lite;
+}
+
+static int cam_ife_hw_mgr_update_vfe_res_data(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_hw_mgr_res           *hw_mgr_res,
+	struct cam_vfe_acquire_args         *vfe_acquire,
+	uint32_t cmd_type)
+{
+	uint32_t rc;
+	struct cam_hw_intf		*hw_intf = NULL;
+	struct cam_vfe_resource_update   res_update;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ife_ctx->concr_ctx;
+
+	hw_intf = hw_mgr_res->hw_res[0]->hw_intf;
+
+	res_update.priv = c_ctx;
+	res_update.res = hw_mgr_res;
+	res_update.vfe_acquire = vfe_acquire;
+
+	CAM_DBG(CAM_ISP, "ctx:%d res:%d", c_ctx->ctx_index, hw_mgr_res->hw_res[0]->res_id);
+	rc = hw_intf->hw_ops.process_cmd(
+			hw_intf->hw_priv,
+			cmd_type,
+			&res_update,
+			sizeof(struct cam_vfe_resource_update));
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to update resource data for ife-ctx: %d sensor_id :%d",
+			c_ctx->ctx_index, c_ctx->sensor_id);
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_update_csid_res_data(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_hw_mgr_res           *hw_mgr_res,
+	struct cam_csid_hw_reserve_resource_args  *csid_acquire)
+{
+	int rc = 0;
+	struct cam_hw_intf               *hw_intf = NULL;
+	struct cam_csid_resource_update   res_update;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ife_ctx->concr_ctx;
+	struct cam_ife_hw_mgr            *ife_hw_mgr = c_ctx->hw_mgr;
+
+	hw_intf = hw_mgr_res->hw_res[0]->hw_intf;
+
+	res_update.priv = c_ctx;
+	res_update.res = hw_mgr_res;
+	res_update.csid_acquire = csid_acquire;
+
+	if (ife_hw_mgr->csid_camif_irq_support && c_ctx->ctx_type != CAM_IFE_CTX_TYPE_SFE)
+		csid_acquire->handle_camif_irq = true;
+
+	CAM_DBG(CAM_ISP, "ife_ctx :%d res_:%d", c_ctx->ctx_index, csid_acquire->res_id);
+
+	if (hw_intf && hw_intf->hw_ops.process_cmd) {
+		rc = hw_intf->hw_ops.process_cmd(
+			hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_UPDATE_CSID_RES_DATA,
+			&res_update,
+			sizeof(struct cam_csid_resource_update));
+
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Failed to update resource data for ife-ctx: %d sensor_id :%d",
+				c_ctx->ctx_index, c_ctx->sensor_id);
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_update_res_virtual_mapping_table(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_hw_mgr_res           *hw_mgr_res,
+	uint32_t out_port_res_id)
+{
+	int i;
+	uint32_t vfe_out_res_id = 0;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ife_ctx->concr_ctx;
+
+	for (i = 0; i < CAM_ISP_STREAM_CFG_MAX; i++) {
+		if (c_ctx->mapping_table.virtual_rdi[i])
+			continue;
+
+		c_ctx->mapping_table.virtual_rdi[i] = out_port_res_id;
+
+		switch (hw_mgr_res->res_id) {
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+			vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_0;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+			vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_1;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+			vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_2;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+			vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_3;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_4:
+			vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_4;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_5:
+			vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_5;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "invalid resource type :%d",
+				hw_mgr_res->res_id);
+			return -EINVAL;
+		}
+		c_ctx->mapping_table.acquired_rdi[i] = vfe_out_res_id;
+		c_ctx->mapping_table.rdi_path_count++;
+
+		CAM_DBG(CAM_ISP,
+			"ctx:%u sensor_id:0x%x virtual_rdi :0x%x acquired_rdi :0x%x rdi_path-count:%d",
+			c_ctx->ctx_index, c_ctx->sensor_id, out_port_res_id,
+			vfe_out_res_id, c_ctx->mapping_table.rdi_path_count);
+
+		break;
+	}
+	return 0;
+}
+
+static int cam_ife_hw_mgr_link_csid_pxl_resources(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool                                 crop_enable,
+	bool                                 is_pxl_path,
+	int  index)
+{
+	struct cam_isp_hw_mgr_res                *hw_mgr_res, *hw_mgr_res_tmp;
+	struct cam_isp_hw_mgr_res                *csid_res;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_isp_out_port_generic_info     *out_port = NULL;
+	struct cam_csid_hw_reserve_resource_args  csid_acquire = {0};
+	enum cam_ife_pix_path_res_id              path_res_id;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	int i;
+	bool per_port_feature_enable = false;
+	int rc;
+
+	if (is_pxl_path)
+		path_res_id = CAM_IFE_PIX_PATH_RES_IPP;
+	else
+		path_res_id = CAM_IFE_PIX_PATH_RES_PPP;
+
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_tmp,
+		&g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_csid_list,
+		list) {
+		if (hw_mgr_res == NULL) {
+			CAM_DBG(CAM_ISP, "skipping hw_res index:%d", index);
+			continue;
+		}
+
+		if ((hw_mgr_res->res_id == path_res_id) &&
+			(!hw_mgr_res->linked)) {
+			for (i = 0; i < in_port->num_valid_vc_dt; i++) {
+				if ((in_port->vc[i] == hw_mgr_res->vc) &&
+					(in_port->dt[i] == hw_mgr_res->dt)) {
+					hw_mgr_res->linked = true;
+					per_port_feature_enable = true;
+					break;
+				}
+			}
+			if (i != in_port->num_valid_vc_dt)
+				break;
+		}
+	}
+	if (!per_port_feature_enable) {
+		CAM_ERR(CAM_ISP,
+			"No free csid resources available for %s path, ife-ctx: %d sensor_id: %d",
+			is_pxl_path ? "ipp" : "ppp",
+			c_ctx->ctx_index, c_ctx->sensor_id);
+		return -ENODEV;
+	}
+
+	rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list, &csid_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+		return -ENODEV;
+	}
+
+	if (in_port->num_out_res) {
+		out_port = &(in_port->data[0]);
+		hw_mgr_res->is_secure = out_port->secure_mode;
+	}
+	hw_mgr_res->is_dual_isp = 0;
+
+	csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+	csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	csid_acquire.res_id = path_res_id;
+	csid_acquire.in_port = in_port;
+	csid_acquire.out_port = in_port->data;
+	csid_acquire.node_res = hw_mgr_res->hw_res[0];
+	csid_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+	csid_acquire.cb_priv = ife_ctx;
+	csid_acquire.crop_enable = crop_enable;
+	csid_acquire.drop_enable = false;
+	csid_acquire.per_port_acquire = false;
+
+	csid_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+	csid_acquire.tasklet = c_ctx->common.tasklet_info;
+	csid_acquire.cb_priv = ife_ctx;
+	csid_acquire.cdm_ops = c_ctx->cdm_ops;
+	csid_acquire.vc = hw_mgr_res->vc;
+	csid_acquire.dt = hw_mgr_res->dt;
+	csid_acquire.decode_format = hw_mgr_res->decode_format;
+
+	rc = cam_ife_hw_mgr_update_csid_res_data(ife_ctx, hw_mgr_res, &csid_acquire);
+	if (rc)
+		goto end;
+
+	hw_intf = hw_mgr_res->hw_res[0]->hw_intf;
+
+	c_ctx->left_hw_idx = hw_intf->hw_idx;
+	c_ctx->right_hw_idx = 0;
+	c_ctx->buf_done_controller = csid_acquire.buf_done_controller;
+	c_ctx->flags.need_csid_top_cfg = csid_acquire.need_top_cfg;
+
+	*csid_res = *hw_mgr_res;
+	cam_ife_hw_mgr_put_res(&c_ctx->res_list_ife_csid, &csid_res);
+end:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_link_csid_rdi_resources(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool                                 crop_enable,
+	int  index)
+{
+	struct cam_isp_hw_mgr_res                *hw_mgr_res, *hw_mgr_res_tmp;
+	struct cam_isp_hw_mgr_res                *csid_res;
+	struct cam_isp_out_port_generic_info     *out_port = NULL;
+	struct cam_csid_hw_reserve_resource_args  rdi_csid_acquire;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	int i, j;
+	bool per_port_feature_enable = false;
+	int rc = -EINVAL;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		per_port_feature_enable = false;
+		out_port = &in_port->data[i];
+		if (!cam_ife_hw_mgr_is_rdi_res(out_port->res_type))
+			continue;
+
+		list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_tmp,
+			&g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_csid_list,
+			list) {
+			if (((hw_mgr_res->hw_res[0]->res_id >=
+				CAM_IFE_PIX_PATH_RES_RDI_0) &&
+				(hw_mgr_res->hw_res[0]->res_id <=
+				CAM_IFE_PIX_PATH_RES_RDI_5)) &&
+				(!hw_mgr_res->linked)) {
+				for (j = 0; j < in_port->num_valid_vc_dt; j++) {
+					if ((in_port->vc[j] == hw_mgr_res->vc) &&
+						(in_port->dt[j] == hw_mgr_res->dt)) {
+						hw_mgr_res->linked = true;
+						per_port_feature_enable = true;
+						CAM_DBG(CAM_ISP, "res_id: %d ctx:%d",
+							hw_mgr_res->hw_res[0]->res_id,
+							c_ctx->ctx_index);
+						break;
+					}
+				}
+				if (j != in_port->num_valid_vc_dt)
+					break;
+			}
+		}
+		if (!per_port_feature_enable) {
+			CAM_ERR(CAM_ISP,
+				"No free csid resources available for rdi path, ife-ctx: %d sensor_id: %d",
+				c_ctx->ctx_index, c_ctx->sensor_id);
+			return -ENODEV;
+		}
+
+		CAM_DBG(CAM_ISP, "res_id:%d hw_res_id :%d", hw_mgr_res->res_id,
+			hw_mgr_res->hw_res[0]->res_id);
+
+		rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list, &csid_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+			return -ENODEV;
+		}
+
+		hw_mgr_res->is_secure = out_port->secure_mode;
+		memset(&rdi_csid_acquire, 0, sizeof(rdi_csid_acquire));
+		rdi_csid_acquire.res_id = hw_mgr_res->hw_res[0]->res_id;
+		rdi_csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		rdi_csid_acquire.in_port = in_port;
+		rdi_csid_acquire.out_port = out_port;
+		rdi_csid_acquire.node_res = hw_mgr_res->hw_res[0];
+		rdi_csid_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		rdi_csid_acquire.tasklet = c_ctx->common.tasklet_info;
+		rdi_csid_acquire.cb_priv = ife_ctx;
+		rdi_csid_acquire.cdm_ops = c_ctx->cdm_ops;
+		rdi_csid_acquire.per_port_acquire = false;
+		rdi_csid_acquire.vc = hw_mgr_res->vc;
+		rdi_csid_acquire.dt = hw_mgr_res->dt;
+		rdi_csid_acquire.decode_format = hw_mgr_res->decode_format;
+
+		/*
+		 * Enable RDI pixel drop by default. CSID will enable only for
+		 * ver 480 HW to allow userspace to control pixel drop pattern.
+		 */
+		rdi_csid_acquire.drop_enable = true;
+		rdi_csid_acquire.crop_enable = true;
+		rdi_csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+		rc = cam_ife_hw_mgr_update_csid_res_data(ife_ctx, hw_mgr_res,
+			&rdi_csid_acquire);
+		if (rc)
+			goto end;
+
+		cam_ife_hw_mgr_update_res_virtual_mapping_table(ife_ctx, hw_mgr_res,
+			out_port->res_type);
+
+		c_ctx->flags.need_csid_top_cfg = rdi_csid_acquire.need_top_cfg;
+		hw_mgr_res->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		hw_mgr_res->res_id = rdi_csid_acquire.res_id;
+		hw_mgr_res->is_dual_isp = 0;
+		hw_mgr_res->hw_res[1] = NULL;
+		hw_mgr_res->use_wm_pack = rdi_csid_acquire.use_wm_pack;
+
+		if (c_ctx->flags.is_rdi_only_context) {
+			c_ctx->buf_done_controller =
+				rdi_csid_acquire.buf_done_controller;
+			c_ctx->left_hw_idx =
+				hw_mgr_res->hw_res[0]->hw_intf->hw_idx;
+			c_ctx->right_hw_idx = 0;
+		}
+
+		*csid_res = *hw_mgr_res;
+		cam_ife_hw_mgr_put_res(&c_ctx->res_list_ife_csid, &csid_res);
+	}
+end:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_link_csid_resources(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool                                 crop_enable,
+	int  index)
+{
+	int rc = -EINVAL;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+
+	if (in_port->ipp_count || in_port->lcr_count) {
+		rc = cam_ife_hw_mgr_link_csid_pxl_resources(ife_ctx,
+			in_port, crop_enable, true, index);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"failed to link pxl resources for ife_ctx:%d sensor_id :%d",
+				c_ctx->ctx_index, c_ctx->sensor_id);
+			goto end;
+		}
+	}
+
+	if (in_port->rdi_count) {
+		rc = cam_ife_hw_mgr_link_csid_rdi_resources(ife_ctx, in_port, crop_enable, index);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"failed to link rdi resources for ife_ctx:%d sensor_id :%d",
+				c_ctx->ctx_index, c_ctx->sensor_id);
+			goto end;
+		}
+	}
+
+	if (in_port->ppp_count) {
+		if (!in_port->ipp_count)
+			crop_enable = false;
+
+		rc = cam_ife_hw_mgr_link_csid_pxl_resources(ife_ctx,
+			in_port, crop_enable, false, index);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"failed to link pxl resources for ife_ctx:%d sensor_id :%d",
+				c_ctx->ctx_index, c_ctx->sensor_id);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+int cam_convert_res_id_to_hw_path(int res_id, int csid_res_id)
+{
+	if (res_id == CAM_ISP_HW_VFE_IN_LCR) {
+		return CAM_ISP_LCR_PATH;
+	} else if (res_id == CAM_ISP_HW_VFE_IN_PDLIB) {
+		return CAM_ISP_PPP_PATH;
+	} else if (res_id == CAM_ISP_HW_VFE_IN_CAMIF) {
+		if (csid_res_id == CAM_IFE_PIX_PATH_RES_IPP_1)
+			return CAM_ISP_PXL1_PATH;
+		else if (csid_res_id == CAM_IFE_PIX_PATH_RES_IPP_2)
+			return CAM_ISP_PXL2_PATH;
+		else
+			return CAM_ISP_PXL_PATH;
+	} else if (res_id == CAM_ISP_HW_VFE_IN_RDI0) {
+		return CAM_ISP_RDI0_PATH;
+	} else if (res_id == CAM_ISP_HW_VFE_IN_RDI1) {
+		return CAM_ISP_RDI1_PATH;
+	} else if (res_id == CAM_ISP_HW_VFE_IN_RDI2) {
+		return CAM_ISP_RDI2_PATH;
+	} else if (res_id == CAM_ISP_HW_VFE_IN_RDI3) {
+		return CAM_ISP_RDI3_PATH;
+	} else if (res_id == CAM_ISP_HW_VFE_IN_RDI4) {
+		return CAM_ISP_RDI4_PATH;
+	} else if (res_id == CAM_ISP_HW_VFE_IN_RDI5) {
+		return CAM_ISP_RDI5_PATH;
+	}
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_link_ife_src_resources(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	int  index, uint32_t *acquired_hw_id,
+	uint32_t *acquired_hw_path)
+{
+	struct cam_isp_hw_mgr_res   *hw_mgr_res, *hw_mgr_res_tmp;
+	struct cam_isp_hw_mgr_res   *csid_res;
+	struct cam_isp_hw_mgr_res   *ife_src_res;
+	struct cam_hw_intf          *hw_intf;
+	struct cam_ife_hw_mgr       *ife_hw_mgr;
+	struct cam_hw_info           *hw_info;
+	struct cam_vfe_acquire_args  vfe_acquire;
+	bool                         per_port_feature_enable = false;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	int rc = -EINVAL;
+
+	list_for_each_entry(csid_res, &c_ctx->res_list_ife_csid, list) {
+		if (csid_res->num_children && !in_port->lcr_count)
+			continue;
+
+		if (in_port->lcr_count && csid_res->res_id != CAM_IFE_PIX_PATH_RES_IPP)
+			continue;
+
+		if (csid_res->res_id == CAM_IFE_PIX_PATH_RES_PPP && !in_port->ppp_count)
+			continue;
+
+		ife_hw_mgr = c_ctx->hw_mgr;
+		hw_intf = ife_hw_mgr->ife_devices[
+			csid_res->hw_res[0]->hw_intf->hw_idx]->hw_intf;
+		hw_info = hw_intf->hw_priv;
+
+		vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_IN;
+		vfe_acquire.tasklet = c_ctx->common.tasklet_info;
+		vfe_acquire.vfe_in.cdm_ops = c_ctx->cdm_ops;
+		vfe_acquire.vfe_in.in_port = in_port;
+		vfe_acquire.vfe_in.is_fe_enabled = c_ctx->flags.is_fe_enabled;
+		vfe_acquire.vfe_in.is_offline = c_ctx->flags.is_offline;
+		vfe_acquire.priv = ife_ctx;
+		vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+		vfe_acquire.vfe_in.is_dual = csid_res->is_dual_isp;
+
+		vfe_acquire.vfe_in.handle_camif_irq = true;
+
+		if (ife_hw_mgr->csid_camif_irq_support && c_ctx->ctx_type !=
+			CAM_IFE_CTX_TYPE_SFE)
+			vfe_acquire.vfe_in.handle_camif_irq = false;
+
+		switch (csid_res->res_id) {
+		case CAM_IFE_PIX_PATH_RES_IPP:
+			if (!in_port->lcr_count)
+				vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_CAMIF;
+			else
+				vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_LCR;
+			break;
+		case CAM_IFE_PIX_PATH_RES_PPP:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_PDLIB;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI0;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI1;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI2;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI3;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_4:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI4;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_5:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI5;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Wrong IFE CSID Path Resource ID : %d",
+				csid_res->res_id);
+			goto err;
+		}
+
+		list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_tmp,
+			&g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_src_list, list) {
+			if ((hw_mgr_res->res_id == vfe_acquire.vfe_in.res_id) &&
+				(!hw_mgr_res->linked)) {
+				hw_mgr_res->linked = true;
+				per_port_feature_enable = true;
+				break;
+			}
+		}
+
+		if (!per_port_feature_enable) {
+			CAM_ERR(CAM_ISP,
+				"No free ife_src resources available, ife-ctx: %d sensor_id: %d res_id: %d",
+				c_ctx->ctx_index, c_ctx->sensor_id, vfe_acquire.vfe_in.res_id);
+			return -ENODEV;
+		}
+
+		rc = cam_ife_hw_mgr_get_res(&c_ctx->free_res_list,
+			&ife_src_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+			goto err;
+		}
+
+		hw_mgr_res->res_type = vfe_acquire.rsrc_type;
+		hw_mgr_res->is_dual_isp = csid_res->is_dual_isp;
+		hw_mgr_res->use_wm_pack = csid_res->use_wm_pack;
+
+		rc = cam_ife_hw_mgr_update_vfe_res_data(ife_ctx, hw_mgr_res, &vfe_acquire,
+				CAM_ISP_HW_CMD_UPDATE_VFE_SRC_RES_DATA);
+		if (rc)
+			goto err;
+
+		ife_hw_mgr = c_ctx->hw_mgr;
+		hw_intf = ife_hw_mgr->ife_devices[csid_res->hw_res[0]->hw_intf->hw_idx]->hw_intf;
+		*acquired_hw_id |= cam_convert_hw_idx_to_ife_hw_num(hw_intf->hw_idx);
+		acquired_hw_path[0] |= cam_convert_res_id_to_hw_path(hw_mgr_res->hw_res[0]->res_id,
+			csid_res->res_id);
+
+		*ife_src_res = *hw_mgr_res;
+		cam_ife_hw_mgr_put_res(&c_ctx->res_list_ife_src, &ife_src_res);
+		csid_res->num_children++;
+	}
+err:
+	return rc;
+}
+
+int cam_ife_hw_mgr_get_virtual_mapping_out_port(
+	void                             *priv,
+	uint32_t                         out_port_id,
+	bool                             is_virtual_rdi)
+{
+	int i;
+	int out_port = -1;
+	struct cam_ife_hw_mgr_ctx        *ife_ctx;
+
+	ife_ctx = (struct cam_ife_hw_mgr_ctx *)priv;
+
+	if (!cam_ife_hw_mgr_is_rdi_res(out_port_id))
+		return out_port_id;
+
+	for (i = 0; i < ife_ctx->concr_ctx->mapping_table.rdi_path_count; i++) {
+		if (is_virtual_rdi) {
+			if (ife_ctx->concr_ctx->mapping_table.virtual_rdi[i] == out_port_id) {
+				out_port = ife_ctx->concr_ctx->mapping_table.acquired_rdi[i];
+				break;
+			}
+		} else {
+			if (ife_ctx->concr_ctx->mapping_table.acquired_rdi[i] == out_port_id) {
+				out_port = ife_ctx->concr_ctx->mapping_table.virtual_rdi[i];
+				break;
+			}
+		}
+	}
+
+	if (out_port < 0) {
+		CAM_ERR(CAM_ISP,
+			"No match found, ife_ctx : %d sensor_id :%d rdi_path_cnt:%d %s_out_port 0x%x",
+			ife_ctx->concr_ctx->ctx_index, ife_ctx->concr_ctx->sensor_id,
+			ife_ctx->concr_ctx->mapping_table.rdi_path_count,
+			is_virtual_rdi ? "Virtual" : "Acquired", out_port_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"ctx: %d, sensor_id: %d rdi_path_cnt:%d virtual_rdi: 0x%x acquired_rdi :0x%x",
+		ife_ctx->concr_ctx->ctx_index, ife_ctx->concr_ctx->sensor_id,
+		ife_ctx->concr_ctx->mapping_table.rdi_path_count,
+		is_virtual_rdi ? out_port_id : out_port,
+		is_virtual_rdi ? out_port : out_port_id);
+
+	return out_port;
+}
+
+static int cam_ife_hw_mgr_link_res_ife_out_rdi(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_hw_mgr_res           *ife_src_res,
+	struct cam_isp_in_port_generic_info *in_port,
+	int    index)
+{
+	int rc = -EINVAL;
+	struct cam_isp_out_port_generic_info     *out_port = NULL;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res                *ife_out_res_tmp, *ife_out_res;
+	struct cam_vfe_acquire_args               vfe_acquire;
+	struct cam_isp_context_comp_record       *comp_grp = NULL;
+	uint32_t                                  comp_index;
+	uint32_t  i, vfe_out_res_id, vfe_in_res_id;
+	int out_port_res_type = -EINVAL;
+
+	/* take left resource */
+	vfe_in_res_id = ife_src_res->hw_res[0]->res_id;
+
+	switch (vfe_in_res_id) {
+	case CAM_ISP_HW_VFE_IN_RDI0:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_0;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI1:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_1;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI2:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_2;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI3:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_3;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI4:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_4;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI5:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_5;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "invalid resource type");
+		goto err;
+	}
+	CAM_DBG(CAM_ISP, "vfe_in_res_id = %d, vfe_out_red_id = %d",
+		vfe_in_res_id, vfe_out_res_id);
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+
+		if (!cam_ife_hw_mgr_is_rdi_res(out_port->res_type)) {
+			CAM_INFO(CAM_ISP, "out_res: %d", out_port->res_type);
+			continue;
+		}
+
+		out_port_res_type = cam_ife_hw_mgr_get_virtual_mapping_out_port(ife_ctx,
+			out_port->res_type, true);
+
+		if (out_port_res_type < 0)
+			goto err;
+
+		if (vfe_out_res_id != out_port_res_type)
+			continue;
+		else {
+			CAM_DBG(CAM_ISP, "Matched 0x%x", vfe_out_res_id);
+			break;
+		}
+	}
+
+	if (i == in_port->num_out_res || (out_port_res_type < 0)) {
+		CAM_ERR(CAM_ISP,
+			"Cannot acquire out resource, i=%d, num_out_res=%d out_port_res_type:%d",
+			i, in_port->num_out_res, out_port_res_type);
+		goto err;
+	}
+
+	ife_out_res_tmp =
+		&g_ife_sns_grp_cfg.grp_cfg[index]->res_list_ife_out[vfe_out_res_id & 0xFF];
+
+	ife_out_res = &c_ctx->res_list_ife_out[c_ctx->num_acq_vfe_out];
+
+	if (ife_out_res_tmp->hw_res[0] == NULL || ife_out_res_tmp->linked) {
+		CAM_ERR(CAM_ISP,
+			"no free ife_out RDI resource available ife_ctx: %d sensor_id: %d linked:%d",
+			c_ctx->ctx_index, c_ctx->sensor_id, ife_out_res_tmp->linked);
+		rc = -ENODEV;
+		goto err;
+	}
+
+	vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_OUT;
+	vfe_acquire.tasklet = c_ctx->common.tasklet_info;
+	vfe_acquire.vfe_out.cdm_ops = c_ctx->cdm_ops;
+	vfe_acquire.priv = ife_ctx;
+	vfe_acquire.vfe_out.out_port_info = out_port;
+	vfe_acquire.vfe_out.out_port_info->acquired_res_type = out_port_res_type;
+	vfe_acquire.vfe_out.split_id = CAM_ISP_HW_SPLIT_LEFT;
+	vfe_acquire.vfe_out.unique_id = c_ctx->ctx_index;
+	vfe_acquire.vfe_out.is_dual = 0;
+	vfe_acquire.vfe_out.disable_ubwc_comp =
+		g_ife_hw_mgr.debug_cfg.disable_ubwc_comp;
+	vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+	vfe_acquire.buf_done_controller = c_ctx->buf_done_controller;
+	vfe_acquire.vfe_out.use_wm_pack = ife_src_res->use_wm_pack;
+
+	rc = cam_ife_hw_mgr_update_vfe_res_data(ife_ctx, ife_out_res_tmp, &vfe_acquire,
+			CAM_ISP_HW_CMD_UPDATE_VFE_OUT_RES_DATA);
+	if (rc)
+		goto err;
+
+	ife_out_res_tmp->res_id = out_port_res_type;
+	ife_out_res_tmp->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	ife_out_res_tmp->linked = true;
+
+	if (out_port->secure_mode)
+		ife_out_res->is_secure = true;
+	ife_out_res->hw_res[0] = ife_out_res_tmp->hw_res[0];
+	ife_out_res->is_dual_isp = 0;
+	ife_out_res->use_wm_pack = ife_src_res->use_wm_pack;
+	ife_out_res->res_id = out_port_res_type;
+	ife_out_res->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	ife_out_res->linked = true;
+
+	comp_index = vfe_acquire.vfe_out.comp_grp_id;
+	comp_grp = &c_ctx->vfe_bus_comp_grp[comp_index];
+	comp_grp->res_id[comp_grp->num_res] = ife_out_res->res_id;
+	comp_grp->num_res++;
+
+	c_ctx->vfe_out_map[vfe_out_res_id & 0xFF] = c_ctx->num_acq_vfe_out;
+	ife_src_res->num_children++;
+	c_ctx->num_acq_vfe_out++;
+
+	return 0;
+err:
+	return rc;
+
+}
+
+static int cam_ife_hw_mgr_link_res_ife_out_pixel(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_hw_mgr_res           *ife_src_res,
+	struct cam_isp_in_port_generic_info *in_port,
+	int                                  index)
+{
+	int rc = -1;
+	uint32_t  i, k;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_out_port_generic_info     *out_port;
+	struct cam_isp_hw_mgr_res                *ife_out_res_tmp, *ife_out_res;
+	struct cam_vfe_acquire_args               vfe_acquire;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		/* Skip output ports for SFE */
+		if (!cam_ife_hw_mgr_is_ife_out_port(out_port->res_type))
+			continue;
+
+		if (cam_ife_hw_mgr_is_rdi_res(out_port->res_type))
+			continue;
+
+		if (!cam_ife_hw_mgr_check_path_port_compat(ife_src_res->res_id,
+			out_port->res_type))
+			continue;
+
+		CAM_DBG(CAM_ISP, "res_type 0x%x", out_port->res_type);
+
+		k = out_port->res_type & 0xFF;
+		ife_out_res_tmp = &g_ife_sns_grp_cfg.grp_cfg[index]->res_list_ife_out[k];
+
+		ife_out_res = &c_ctx->res_list_ife_out[k];
+
+		if (ife_out_res_tmp->hw_res[0] == NULL || ife_out_res_tmp->linked) {
+			CAM_ERR(CAM_ISP,
+				"no free ife_out res_type:0x%x resource available ife_ctx: %d sensor_id: %d",
+				out_port->res_type, c_ctx->ctx_index, c_ctx->sensor_id);
+			rc = -ENODEV;
+			goto err;
+		}
+
+		vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_OUT;
+		vfe_acquire.tasklet = c_ctx->common.tasklet_info;
+		vfe_acquire.vfe_out.cdm_ops = c_ctx->cdm_ops;
+		vfe_acquire.priv = ife_ctx;
+		vfe_acquire.vfe_out.out_port_info =  out_port;
+		vfe_acquire.vfe_out.is_dual       = ife_src_res->is_dual_isp;
+		vfe_acquire.vfe_out.unique_id     = c_ctx->ctx_index;
+		vfe_acquire.vfe_out.disable_ubwc_comp =
+			g_ife_hw_mgr.debug_cfg.disable_ubwc_comp;
+		vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		vfe_acquire.buf_done_controller = c_ctx->buf_done_controller;
+		vfe_acquire.vfe_out.split_id  = CAM_ISP_HW_SPLIT_LEFT;
+		vfe_acquire.vfe_out.is_master = 0;
+		vfe_acquire.vfe_out.dual_slave_core = 0;
+
+		CAM_DBG(CAM_ISP, "resource type :0x%x res id:0x%x",
+				ife_out_res_tmp->hw_res[0]->res_type,
+				ife_out_res_tmp->hw_res[0]->res_id);
+
+		rc = cam_ife_hw_mgr_update_vfe_res_data(ife_ctx, ife_out_res_tmp, &vfe_acquire,
+				CAM_ISP_HW_CMD_UPDATE_VFE_OUT_RES_DATA);
+		if (rc)
+			goto err;
+
+		ife_out_res_tmp->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+		ife_out_res_tmp->is_dual_isp = in_port->usage_type;
+		ife_out_res_tmp->res_id = out_port->res_type;
+		ife_out_res_tmp->linked = true;
+
+		ife_out_res->hw_res[0] = ife_out_res_tmp->hw_res[0];
+		ife_out_res->is_dual_isp = 0;
+		ife_out_res->use_wm_pack = ife_src_res->use_wm_pack;
+		ife_out_res->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+		ife_out_res->is_dual_isp = in_port->usage_type;
+		ife_out_res->res_id = out_port->res_type;
+		ife_out_res->linked = true;
+
+		ife_src_res->num_children++;
+		c_ctx->num_acq_vfe_out++;
+		if (out_port->secure_mode)
+			ife_out_res->is_secure = true;
+	}
+
+	return 0;
+err:
+	/* release resource at the entry function */
+	return rc;
+
+}
+
+static int cam_ife_hw_mgr_link_ife_out_resources(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	int  index)
+{
+	struct cam_isp_hw_mgr_res                *ife_src_res;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+	int rc = -EINVAL;
+
+	list_for_each_entry(ife_src_res, &c_ctx->res_list_ife_src, list) {
+		if (ife_src_res->num_children)
+			continue;
+
+		switch (ife_src_res->res_id) {
+		case CAM_ISP_HW_VFE_IN_CAMIF:
+		case CAM_ISP_HW_VFE_IN_PDLIB:
+		case CAM_ISP_HW_VFE_IN_RD:
+		case CAM_ISP_HW_VFE_IN_LCR:
+			rc = cam_ife_hw_mgr_link_res_ife_out_pixel(ife_ctx,
+				ife_src_res, in_port, index);
+			break;
+		case CAM_ISP_HW_VFE_IN_RDI0:
+		case CAM_ISP_HW_VFE_IN_RDI1:
+		case CAM_ISP_HW_VFE_IN_RDI2:
+		case CAM_ISP_HW_VFE_IN_RDI3:
+		case CAM_ISP_HW_VFE_IN_RDI4:
+		case CAM_ISP_HW_VFE_IN_RDI5:
+			rc = cam_ife_hw_mgr_link_res_ife_out_rdi(ife_ctx,
+				ife_src_res, in_port, index);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unknown IFE SRC resource: %d",
+				ife_src_res->res_id);
+			break;
+		}
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+err:
+	/* release resource on entry function */
+	return rc;
+}
+
+static int cam_ife_hw_mgr_link_hw_res(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	int    index, uint32_t *acquired_hw_id,
+	uint32_t *acquired_hw_path,
+	bool      crop_enable)
+{
+	int  rc;
+
+	/* link csid resource pointer */
+	if (list_empty(&g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_csid_list)) {
+		CAM_ERR(CAM_ISP, "No CSID resources available");
+		return -EIO;
+	}
+	rc = cam_ife_hw_mgr_link_csid_resources(ife_ctx, in_port, crop_enable, index);
+	if (rc)
+		goto end;
+
+	/* link ife_src  resource pointer */
+	if (list_empty(&g_ife_sns_grp_cfg.grp_cfg[index]->res_ife_src_list)) {
+		CAM_ERR(CAM_ISP, "No IFE_SRC resources available");
+		return -EIO;
+	}
+	rc = cam_ife_hw_mgr_link_ife_src_resources(ife_ctx, in_port, index,
+		acquired_hw_id, acquired_hw_path);
+	if (rc)
+		goto end;
+
+	/* link ife_out  resource pointer */
+	rc = cam_ife_hw_mgr_link_ife_out_resources(ife_ctx, in_port, index);
+	if (rc)
+		goto end;
+end:
+	return rc;
+
+}
+
+static int cam_ife_hw_mgr_update_vc_dt_pxl_path(
+	struct cam_isp_hw_mgr_res      *isp_res,
+	enum cam_ife_pix_path_res_id   path_res_id,
+	int                            index,
+	int                            stream_index,
+	bool                           *found)
+{
+	struct cam_ife_hw_mgr_stream_grp_config  *grp_cfg = g_ife_sns_grp_cfg.grp_cfg[index];
+
+	switch (path_res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		if (grp_cfg->stream_cfg[stream_index].num_valid_vc_dt_pxl) {
+			if (!grp_cfg->stream_cfg[stream_index].pxl_vc_dt_updated) {
+				isp_res->vc =
+					grp_cfg->stream_cfg[stream_index].pxl_vc;
+				isp_res->dt =
+					grp_cfg->stream_cfg[stream_index].pxl_dt;
+				isp_res->decode_format =
+					grp_cfg->stream_cfg[stream_index].decode_format;
+				grp_cfg->stream_cfg[stream_index].pxl_vc_dt_updated =
+					true;
+				*found = true;
+			} else {
+				CAM_ERR(CAM_ISP, "No free pxl vc-dt available");
+				return -EINVAL;
+			}
+		} else if (grp_cfg->stream_cfg[stream_index].num_valid_vc_dt_lcr) {
+			if (!grp_cfg->stream_cfg[stream_index].lcr_vc_dt_updated) {
+				isp_res->vc =
+					grp_cfg->stream_cfg[stream_index].lcr_vc;
+				isp_res->dt =
+					grp_cfg->stream_cfg[stream_index].lcr_dt;
+				isp_res->decode_format =
+					grp_cfg->stream_cfg[stream_index].decode_format;
+				grp_cfg->stream_cfg[stream_index].lcr_vc_dt_updated =
+					true;
+				*found = true;
+			} else {
+				CAM_ERR(CAM_ISP, "No free lcr vc-dt available");
+				return -EINVAL;
+			}
+		}
+		break;
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		if (grp_cfg->stream_cfg[stream_index].num_valid_vc_dt_ppp) {
+			if (!grp_cfg->stream_cfg[stream_index].ppp_vc_dt_updated) {
+				isp_res->vc =
+					grp_cfg->stream_cfg[stream_index].ppp_vc;
+				isp_res->dt =
+					grp_cfg->stream_cfg[stream_index].ppp_dt;
+				isp_res->decode_format =
+					grp_cfg->stream_cfg[stream_index].decode_format;
+				grp_cfg->stream_cfg[stream_index].ppp_vc_dt_updated =
+					true;
+				*found = true;
+			} else {
+				CAM_ERR(CAM_ISP,
+					"No free ppp vc-dt available");
+				return -EINVAL;
+			}
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invlaid res_path_id:%d", path_res_id);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_ife_hw_mgr_update_vc_dt_stream_grp(
+	struct cam_isp_hw_mgr_res           *isp_res,
+	int                                  index,
+	enum cam_ife_pix_path_res_id         path_res_id,
+	bool                                 is_rdi_path)
+{
+	int i, j, rc;
+	bool   found = false;
+	struct cam_ife_hw_mgr_stream_grp_config  *grp_cfg;
+
+	if (index != CAM_IFE_STREAM_GRP_INDEX_NONE) {
+		grp_cfg = g_ife_sns_grp_cfg.grp_cfg[index];
+		for (i = 0; i < grp_cfg->stream_cfg_cnt; i++) {
+			if (is_rdi_path) {
+				if ((path_res_id == CAM_IFE_PIX_PATH_RES_RDI_3 ||
+					path_res_id == CAM_IFE_PIX_PATH_RES_RDI_5)) {
+					if (grp_cfg->stream_cfg[i].color_filter_arrangement &&
+						!grp_cfg->stream_cfg[i].yuv_rdi_vc_dt_updated) {
+						for (j = grp_cfg->stream_cfg[i].rdi_vc_dt_updated;
+							j < grp_cfg->stream_cfg[i].num_valid_vc_dt_rdi;
+							j++) {
+							isp_res->vc =
+								grp_cfg->stream_cfg[i].rdi_vc[j];
+							isp_res->dt =
+								grp_cfg->stream_cfg[i].rdi_dt[j];
+							isp_res->decode_format =
+								grp_cfg->stream_cfg[i].decode_format;
+							CAM_DBG(CAM_ISP,
+								"[i:%d] [j:%d] vc: %d dt :%d decode_format :%d path_id: %d",
+								i, j, isp_res->vc, isp_res->dt,
+								isp_res->decode_format,
+								path_res_id);
+							grp_cfg->stream_cfg[i].rdi_vc_dt_updated++;
+							grp_cfg->stream_cfg[i].yuv_rdi_vc_dt_updated =
+								TRUE;
+							found = true;
+							break;
+						}
+					}
+
+				} else {
+					for (j = grp_cfg->stream_cfg[i].rdi_vc_dt_updated;
+						j < (grp_cfg->stream_cfg[i].num_valid_vc_dt_rdi -
+						grp_cfg->stream_cfg[i].color_filter_arrangement);
+						j++) {
+						isp_res->vc = grp_cfg->stream_cfg[i].rdi_vc[j];
+						isp_res->dt = grp_cfg->stream_cfg[i].rdi_dt[j];
+						isp_res->decode_format =
+							grp_cfg->stream_cfg[i].decode_format;
+						CAM_DBG(CAM_ISP,
+							"[i:%d] [j:%d] vc: %d dt :%d decode_format :%d path_id: %d",
+							i, j, isp_res->vc, isp_res->dt,
+							isp_res->decode_format, path_res_id);
+						grp_cfg->stream_cfg[i].rdi_vc_dt_updated++;
+						found = true;
+						break;
+					}
+				}
+				if (found)
+					break;
+			} else {
+				rc = cam_ife_hw_mgr_update_vc_dt_pxl_path(
+					isp_res, path_res_id, index, i, &found);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"couldnt update vc-dt index:%d path_id:%d",
+						index, path_res_id);
+					return rc;
+				}
+				if (found)
+					break;
+			}
+		}
+
+		if (i == grp_cfg->stream_cfg_cnt) {
+			CAM_ERR(CAM_ISP,
+				"no valid vc-dt available, stream_grp_index :%d", index);
+			return -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "invalid stream_grp_index :%d", index);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static bool cam_ife_mgr_check_res_path_enabled(
+	uint32_t     path_id,
+	int          index)
+{
+	int i;
+	bool res_path_enable = false;
+
+	for (i = 0; i < g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg_cnt; i++) {
+		switch (path_id) {
+		case CAM_ISP_PXL_PATH:
+			if (g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg[i].num_valid_vc_dt_pxl) {
+				res_path_enable = true;
+				break;
+			}
+			break;
+		case CAM_ISP_PPP_PATH:
+			if (g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg[i].num_valid_vc_dt_ppp) {
+				res_path_enable = true;
+				break;
+			}
+			break;
+		case CAM_ISP_LCR_PATH:
+			if (g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg[i].num_valid_vc_dt_lcr) {
+				res_path_enable = true;
+				break;
+			}
+			break;
+		}
+		if (res_path_enable)
+			break;
+	}
+
+	return res_path_enable;
+}
+
+static int cam_ife_hw_mgr_acquire_csid_res_stream_grp(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool                                 crop_enable,
+	uint32_t                            *acquired_hw_path,
+	int                                  index)
+{
+	int rc = 0;
+
+	if (cam_ife_mgr_check_res_path_enabled(CAM_ISP_PXL_PATH, index) ||
+		cam_ife_mgr_check_res_path_enabled(CAM_ISP_LCR_PATH, index)) {
+		/* get ife CSID ipp resource */
+		rc = cam_ife_hw_mgr_acquire_res_ife_csid_pxl(ife_ctx,
+			in_port, true, crop_enable, index);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE CSID IPP resource Failed");
+			goto err;
+		}
+	}
+
+	if (g_ife_sns_grp_cfg.grp_cfg[index]->rdi_stream_cfg_cnt) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_csid_rdi(ife_ctx, in_port,
+			acquired_hw_path, index, true);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE CSID RDI resource Failed");
+			goto err;
+		}
+	}
+
+	/* get ife csid PPP resource */
+	/* If both IPP and PPP paths are requested with the same vc dt
+	 * it is implied that the sensor is a type 3 PD sensor. Crop
+	 * must be enabled for this sensor on PPP path as well.
+	 */
+	if (cam_ife_mgr_check_res_path_enabled(CAM_ISP_PPP_PATH, index)) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_csid_pxl(ife_ctx,
+			in_port, false, crop_enable, index);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE CSID PPP resource Failed");
+			goto err;
+		}
+	}
+err:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_ife_src_stream_grp(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t                            *acquired_hw_id,
+	uint32_t                            *acquired_hw_path,
+	int                                  index)
+{
+	int rc = -EINVAL;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+
+	if (cam_ife_mgr_check_res_path_enabled(CAM_ISP_PXL_PATH, index)) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx,
+			in_port, false, false, false,
+			acquired_hw_id, acquired_hw_path,
+			CAM_IFE_PIX_PATH_RES_IPP, index);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE IPP SRC resource Failed");
+			goto err;
+		}
+	}
+
+	/* in case of rdi_res, pix path is sent as rdi0 always.
+	 * This rdi0 path doesn't play any role for rdi res.
+	 * Just for compilation purpose PIX_PATH_RES_RDI_0 is added for rdi res.
+	 */
+	if (g_ife_sns_grp_cfg.grp_cfg[index]->rdi_stream_cfg_cnt) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx,
+			in_port, false, false, true,
+			acquired_hw_id, acquired_hw_path,
+			CAM_IFE_PIX_PATH_RES_RDI_0, index);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE RDI SRC resource Failed");
+			goto err;
+		}
+	}
+
+	if (cam_ife_mgr_check_res_path_enabled(CAM_ISP_LCR_PATH, index)) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_src(
+			ife_ctx, in_port, true, false, false,
+			acquired_hw_id, acquired_hw_path,
+			CAM_IFE_PIX_PATH_RES_IPP, index);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire IFE LCR SRC resource Failed");
+			goto err;
+		}
+	}
+
+
+	if (cam_ife_mgr_check_res_path_enabled(CAM_ISP_PPP_PATH, index)) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx, in_port,
+				false, true, false,
+				acquired_hw_id, acquired_hw_path,
+				CAM_IFE_PIX_PATH_RES_PPP, index);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire IFE PPP SRC resource Failed");
+			goto err;
+		}
+	}
+
+	return 0;
+
+err:
+	return rc;
+}
+
+int cam_ife_hw_mgr_acquire_res_stream_grp(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t                            *acquired_hw_id,
+	uint32_t                            *acquired_hw_path,
+	uint32_t                            *acquired_rdi_res,
+	bool                                 crop_enable)
+{
+	int rc = 0;
+	bool found = false;
+	int i, j;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ife_ctx->concr_ctx;
+
+	for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+		if (!g_ife_sns_grp_cfg.grp_cfg[i])
+			continue;
+		for (j = 0; j < g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg_cnt; j++) {
+			if (in_port->sensor_id ==
+					g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].sensor_id) {
+				mutex_lock(&g_ife_sns_grp_cfg.grp_cfg[i]->lock);
+				if (g_ife_sns_grp_cfg.grp_cfg[i]->acquire_cnt) {
+					CAM_DBG(CAM_ISP,
+						"hw devices are already acquired for sensor:0x%x ife-ctx:%d",
+						in_port[i].sensor_id, c_ctx->ctx_index);
+
+					/* assign resource pointers to ife hw ctx */
+					rc = cam_ife_hw_mgr_link_hw_res(ife_ctx, in_port,
+							i, acquired_hw_id, acquired_hw_path,
+							crop_enable);
+					if (rc) {
+						CAM_ERR(CAM_ISP,
+							"Can not link HW resources for sensor:0x%x ife-ctx:%d",
+							in_port[i].sensor_id, c_ctx->ctx_index);
+						goto end;
+					}
+				} else {
+					/*acquire csid resources*/
+					rc = cam_ife_hw_mgr_acquire_csid_res_stream_grp(ife_ctx,
+						in_port, crop_enable, acquired_rdi_res, i);
+					if (rc) {
+						CAM_ERR(CAM_ISP,
+							"Cannot acquire csid resources for sensor:0x%x ife-ctx:%d",
+							in_port[i].sensor_id, c_ctx->ctx_index);
+						goto end;
+					}
+
+					/*acquire ife_src resources*/
+					rc = cam_ife_hw_mgr_acquire_ife_src_stream_grp(ife_ctx,
+							in_port, acquired_hw_id,
+							acquired_hw_path, i);
+					if (rc) {
+						CAM_ERR(CAM_ISP,
+							"Cannot acquire ife_src resources for sensor:0x%x ife-ctx:%d",
+							in_port[i].sensor_id, c_ctx->ctx_index);
+						goto end;
+					}
+					/*acquire ife_out resources*/
+					rc = cam_ife_hw_mgr_acquire_res_ife_out(ife_ctx,
+						in_port, i);
+					if (rc) {
+						CAM_ERR(CAM_ISP,
+							"Cannot acquire ife_out resources for sensor:0x%x ife-ctx:%d",
+							in_port[i].sensor_id, c_ctx->ctx_index);
+						goto end;
+					}
+
+					/* link resource pointers to ife hw ctx */
+					rc = cam_ife_hw_mgr_link_hw_res(ife_ctx, in_port, i,
+							acquired_hw_id, acquired_hw_path,
+							crop_enable);
+					if (rc) {
+						CAM_ERR(CAM_ISP,
+							"Can not link HW resources for sensor:0x%x ife-ctx:%d",
+							in_port[i].sensor_id, c_ctx->ctx_index);
+						goto end;
+					}
+					g_ife_sns_grp_cfg.grp_cfg[i]->acquired_hw_idx =
+						*acquired_hw_id;
+				}
+
+				g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].acquired = true;
+				g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].priv = ife_ctx;
+				g_ife_sns_grp_cfg.grp_cfg[i]->acquire_cnt++;
+				g_ife_sns_grp_cfg.grp_cfg[i]->hw_ctx_cnt++;
+				mutex_unlock(&g_ife_sns_grp_cfg.grp_cfg[i]->lock);
+
+				found = true;
+				break;
+			}
+		}
+		if (found)
+			break;
+	}
+	return 0;
+end:
+	mutex_unlock(&g_ife_sns_grp_cfg.grp_cfg[i]->lock);
+	return rc;
+}
+
+int cam_ife_mgr_check_per_port_enable(
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	int i, j;
+	bool   found = false;
+
+	in_port->per_port_en = false;
+
+	if (in_port->is_offline) {
+		CAM_INFO(CAM_ISP, "NOT A PER PORT CTX");
+		return 0;
+	}
+
+	if (!g_ife_sns_grp_cfg.num_grp_cfg)
+		goto end;
+
+	for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+		if (!g_ife_sns_grp_cfg.grp_cfg[i])
+			continue;
+		for (j = 0; j < g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg_cnt; j++) {
+			if (in_port->sensor_id ==
+				g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].sensor_id) {
+				in_port->per_port_en = true;
+				found = true;
+				CAM_DBG(CAM_ISP, "PER PORT ENABLE , sensor_id:%d per_port:%d",
+					in_port->sensor_id, in_port->per_port_en);
+				break;
+			}
+		}
+		if (found)
+			break;
+	}
+
+	if (!found)
+		CAM_DBG(CAM_ISP, "PER PORT DISABLED, sensor_id:%d per_port:%d",
+			in_port->sensor_id, in_port->per_port_en);
+end:
+	return 0;
+}
+
+static bool cam_ife_mgr_hw_validate_vc_dt_pxl_path(
+	struct cam_ife_hw_mgr_sensor_stream_config  *stream_cfg,
+	uint32_t vc, uint32_t dt)
+{
+	bool found = false;
+
+	if (stream_cfg->num_valid_vc_dt_pxl) {
+		if ((stream_cfg->pxl_vc == vc) &&
+			(stream_cfg->pxl_dt == dt))
+			found = true;
+	} else if (stream_cfg->num_valid_vc_dt_ppp) {
+		if ((stream_cfg->ppp_vc == vc) &&
+			(stream_cfg->ppp_dt == dt))
+			found = true;
+	} else if (stream_cfg->num_valid_vc_dt_lcr) {
+		if ((stream_cfg->lcr_vc == vc) &&
+			(stream_cfg->lcr_dt == dt))
+			found = true;
+	} else {
+		CAM_ERR(CAM_ISP, "valid vc-dt not found");
+		found = false;
+	}
+
+	return found;
+}
+
+int cam_ife_mgr_hw_validate_vc_dt_stream_grp(
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t vc, uint32_t dt)
+{
+	struct cam_ife_hw_mgr_sensor_stream_config  *stream_cfg;
+	bool                                         found = false;
+	int i, j, k, rc = 0;
+
+	if (!in_port->per_port_en)
+		return 0;
+
+	for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+		if (!g_ife_sns_grp_cfg.grp_cfg[i])
+			continue;
+		for (j = 0; j < g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg_cnt; j++) {
+			stream_cfg = &g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j];
+			if (in_port->sensor_id == stream_cfg->sensor_id) {
+				/*
+				 * pxl vc-dt will match with one of the rdi vc-dt
+				 * hence check wrt to rdi vc-dt
+				 */
+				for (k = 0; k < stream_cfg->num_valid_vc_dt_rdi; k++) {
+					if ((stream_cfg->rdi_vc[k] == vc) &&
+						(stream_cfg->rdi_dt[k] == dt)) {
+						found = true;
+						break;
+					}
+				}
+				if (!found)
+					found = cam_ife_mgr_hw_validate_vc_dt_pxl_path(stream_cfg,
+						vc, dt);
+			}
+			if (found)
+				break;
+		}
+		if (found)
+			break;
+	}
+
+	if (!found) {
+		CAM_ERR(CAM_ISP,
+		"vc-dt[%d:%d] match not found in sensor stream group configurations",
+			vc, dt);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_stop_hw_res_stream_grp(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	int                        grp_cfg_index,
+	uint32_t                   stop_cmd,
+	bool                       is_internal_stop)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ife_ctx->concr_ctx;
+	uint32_t                        i, master_base_idx = 0;
+
+	/* get master base index first */
+	for (i = 0; i < c_ctx->num_base; i++) {
+		if (c_ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
+			master_base_idx = c_ctx->base[i].idx;
+			break;
+		}
+	}
+
+	/* stop csid resources */
+	cam_ife_mgr_csid_stop_hw(ife_ctx,
+		&g_ife_sns_grp_cfg.grp_cfg[grp_cfg_index]->res_ife_csid_list,
+		master_base_idx, stop_cmd);
+
+	/* Ensure HW layer does not reset any clk data since it's
+	 * internal stream off/resume
+	 */
+	if (is_internal_stop)
+		cam_ife_mgr_finish_clk_bw_update(ife_ctx, 0, true);
+
+	/* Ensure HW layer does not reset any clk data since it's
+	 * internal stream off/resume
+	 */
+	if (is_internal_stop)
+		cam_ife_mgr_finish_clk_bw_update(ife_ctx, 0, true);
+
+	/* stop ife out resources */
+	for (i = 0; i < max_ife_out_res; i++) {
+		hw_mgr_res =
+			&g_ife_sns_grp_cfg.grp_cfg[grp_cfg_index]->res_list_ife_out[i];
+
+		/*hw_mgr_res can be NULL for virtual_rdi ports*/
+		if (!hw_mgr_res)
+			continue;
+
+		CAM_INFO(CAM_ISP, "i:%d", i);
+		cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	/* stop ife src resources */
+	if (!list_empty(&g_ife_sns_grp_cfg.grp_cfg[grp_cfg_index]->res_ife_src_list)) {
+		list_for_each_entry(hw_mgr_res,
+			&g_ife_sns_grp_cfg.grp_cfg[grp_cfg_index]->res_ife_src_list,
+			list) {
+			cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+		}
+	}
+	return 0;
+}
+
+static int cam_ife_mgr_start_hw_res_stream_grp(
+	int          grp_cfg_index,
+	bool          is_internal_start,
+	struct cam_ife_hw_mgr_ctx  *ife_ctx)
+{
+	int rc = 0;
+
+	rc = cam_ife_hw_mgr_start_ife_out_res_stream_grp(grp_cfg_index, ife_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Can not start IFE OUT RES");
+		goto end;
+	}
+
+	rc = cam_ife_hw_mgr_ife_src_start_hw_stream_grp(grp_cfg_index, ife_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Can not start IFE SRC RES");
+		goto end;
+	}
+
+	/* Start the IFE CSID HW devices */
+	rc = cam_ife_mgr_csid_start_hw_stream_grp(ife_ctx, grp_cfg_index, is_internal_start);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Can not start CSID RES");
+		goto end;
+	}
+end:
+	return rc;
+}
+
+int cam_ife_hw_mgr_res_stream_on_off_grp_cfg(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	void                      *hw_args,
+	enum cam_ife_csid_halt_cmd csid_halt_type,
+	bool                       is_start_hw,
+	bool                      *per_port_feature_enable,
+	bool                      *skip_hw_deinit)
+{
+	int i, j = 0, k = 0;
+	int rc = -EINVAL;
+	struct cam_ife_hw_mgr_stream_grp_config *grp_cfg = NULL;
+	struct cam_ife_hw_concrete_ctx          *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res *hw_mgr_res = NULL;
+
+
+	for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+		if (!g_ife_sns_grp_cfg.grp_cfg[i])
+			continue;
+		for (j = 0; j < g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg_cnt; j++) {
+			if (c_ctx->sensor_id ==
+				g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].sensor_id) {
+				grp_cfg = g_ife_sns_grp_cfg.grp_cfg[i];
+				*per_port_feature_enable = true;
+				break;
+			}
+		}
+		if (grp_cfg)
+			break;
+	}
+
+	if (!grp_cfg || !*per_port_feature_enable) {
+		CAM_ERR(CAM_ISP, "cannot find stream config grp for sensor: %d ctx :%d",
+			c_ctx->sensor_id, c_ctx->ctx_index);
+		return rc;
+	}
+
+	mutex_lock(&grp_cfg->lock);
+
+	if (is_start_hw) {
+		struct cam_isp_start_args  *start_isp = hw_args;
+
+		if (!grp_cfg->stream_on_cnt ||
+			start_isp->start_only) {
+			rc = cam_ife_mgr_start_hw_res_stream_grp(i,
+				start_isp->is_internal_start, ife_ctx);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not start HW res stream grp");
+				mutex_unlock(&grp_cfg->lock);
+				goto err;
+			}
+		}
+		if (start_isp->start_only) {
+			rc =
+			cam_ife_mgr_update_irq_mask_affected_ctx_stream_grp(
+				ife_ctx, i, true,
+				start_isp->is_internal_start);
+		} else {
+			rc = cam_ife_mgr_enable_irq(ife_ctx,
+				start_isp->is_internal_start);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"failed to enable irqs for ife_ctx: %d, sensor_id: 0x%x",
+					c_ctx->ctx_index, c_ctx->sensor_id);
+				mutex_unlock(&grp_cfg->lock);
+				goto err;
+			}
+
+			grp_cfg->stream_cfg[j].is_streamon =
+				true;
+			grp_cfg->stream_on_cnt++;
+		}
+	} else {
+		struct cam_isp_stop_args   *stop_isp = hw_args;
+		*skip_hw_deinit = true;
+
+		if (!grp_cfg->stream_cfg[j].is_streamon)
+			rc = 0;
+
+		if (stop_isp->stop_only) {
+			rc =
+			cam_ife_mgr_update_irq_mask_affected_ctx_stream_grp(
+				ife_ctx, i, false, false);
+		} else if (grp_cfg->stream_cfg[j].is_streamon) {
+			rc = cam_ife_mgr_disable_irq(ife_ctx);
+			if (rc) {
+				CAM_WARN(CAM_ISP,
+					"failed to disable irqs for ife_ctx: %d, sensor_id:0x%x",
+					c_ctx->ctx_index, c_ctx->sensor_id);
+			}
+			grp_cfg->stream_cfg[j].is_streamon =
+				false;
+
+			if (grp_cfg->stream_on_cnt > 0)
+				grp_cfg->stream_on_cnt--;
+		}
+
+		/* Stop IFE out resources */
+		for (k = 0; k < c_ctx->num_acq_vfe_out; k++) {
+			hw_mgr_res = &c_ctx->res_list_ife_out[k];
+			if (hw_mgr_res && hw_mgr_res->hw_res[0])
+				cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+		}
+
+		if (grp_cfg->stream_on_cnt == 0) {
+			if (!stop_isp->stop_only)
+				*skip_hw_deinit = false;
+			cam_ife_mgr_stop_hw_res_stream_grp(ife_ctx, i,
+				csid_halt_type, stop_isp->is_internal_stop);
+		}
+	}
+	mutex_unlock(&grp_cfg->lock);
+
+err:
+	return rc;
+}
+
+int cam_ife_hw_mgr_start_ife_out_res_stream_grp(
+	int    grp_cfg_index,
+	struct cam_ife_hw_mgr_ctx           *ife_ctx)
+{
+	int rc;
+	struct cam_isp_hw_mgr_res           *hw_mgr_res;
+	uint32_t i;
+
+	/* Start all IFE out devices on first start call*/
+	for (i = 0; i < max_ife_out_res; i++) {
+		hw_mgr_res = &g_ife_sns_grp_cfg.grp_cfg[grp_cfg_index]->res_list_ife_out[i];
+
+		/*hw_mgr_res can be NULL for virtual_rdi ports*/
+		if (!hw_mgr_res->hw_res[0])
+			continue;
+
+		hw_mgr_res->hw_res[0]->is_per_port_start = true;
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, ife_ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE OUT (%d) ", i);
+			goto end;
+		}
+	}
+end:
+	return rc;
+}
+
+int cam_ife_hw_mgr_ife_src_start_hw_stream_grp(
+	int                            grp_cfg_index,
+	struct cam_ife_hw_mgr_ctx      *ife_ctx)
+{
+	int                                  rc = -1;
+	struct cam_isp_hw_mgr_res           *hw_mgr_res;
+
+	if (!list_empty(&g_ife_sns_grp_cfg.grp_cfg[grp_cfg_index]->res_ife_src_list)) {
+		list_for_each_entry(hw_mgr_res,
+			&g_ife_sns_grp_cfg.grp_cfg[grp_cfg_index]->res_ife_src_list, list) {
+			hw_mgr_res->hw_res[0]->is_per_port_start = true;
+
+			rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, ife_ctx);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Can not start IFE Mux (%d)",
+					 hw_mgr_res->res_id);
+				goto err;
+			}
+		}
+	}
+
+err:
+	return rc;
+}
+
+int cam_ife_mgr_csid_start_hw_stream_grp(
+	struct cam_ife_hw_mgr_ctx       *ife_ctx,
+	int           grp_cfg_index,
+	bool          is_internal_start)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_isp_resource_node   *isp_res;
+	struct cam_isp_resource_node   *res[CAM_IFE_PIX_PATH_RES_MAX - 1];
+	struct cam_csid_hw_start_args  start_args;
+	struct cam_hw_intf             *hw_intf;
+	uint32_t  cnt;
+	int rc = 0;
+
+	/*check if any resources are not acquired, start them also */
+	if (list_empty(&g_ife_sns_grp_cfg.grp_cfg[grp_cfg_index]->res_ife_csid_list)) {
+		CAM_ERR(CAM_ISP, "csid res list empty for grp_cfg_index:%d", grp_cfg_index);
+		rc = -EINVAL;
+	} else {
+		cnt = 0;
+		list_for_each_entry(hw_mgr_res,
+			&g_ife_sns_grp_cfg.grp_cfg[grp_cfg_index]->res_ife_csid_list, list) {
+			isp_res = hw_mgr_res->hw_res[0];
+
+			if (!isp_res)
+				return -EINVAL;
+
+			isp_res->is_per_port_start = true;
+			CAM_DBG(CAM_ISP, "csid[%u] res:%s res_id %d cnt %u",
+				isp_res->hw_intf->hw_idx,
+				isp_res->res_name, isp_res->res_id, cnt);
+			res[cnt] = isp_res;
+			cnt++;
+		}
+
+		if (cnt) {
+			hw_intf =  res[0]->hw_intf;
+			start_args.num_res = cnt;
+			start_args.node_res = res;
+			start_args.is_internal_start = is_internal_start;
+			start_args.is_per_port_start = true;
+			rc = hw_intf->hw_ops.start(hw_intf->hw_priv, &start_args,
+					sizeof(start_args));
+			if (rc)
+				CAM_ERR(CAM_ISP, "Can not start CSID for non_acquired res");
+		}
+	}
+	return rc;
+}
+
+
+static int cam_ife_mgr_update_vfe_irq_mask(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	bool                         is_vfe_src,
+	bool                         enable_irq)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_isp_resource_node   *isp_res;
+	struct cam_ife_hw_concrete_ctx *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_resource_node   *res[CAM_IFE_PIX_PATH_RES_MAX - 1];
+	struct cam_hw_intf             *hw_intf = NULL;
+	struct cam_vfe_res_irq_info     res_irq_mask;
+	enum cam_isp_hw_cmd_type        cdm_type;
+	uint32_t  cnt = 0;
+	int i, rc = 0;
+
+	if (is_vfe_src) {
+		list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+			isp_res = hw_mgr_res->hw_res[0];
+			if (!isp_res) {
+				CAM_ERR(CAM_ISP, "invalid param");
+				goto end;
+			}
+			if (enable_irq)
+				isp_res->is_per_port_start = false;
+
+			CAM_DBG(CAM_ISP, "ife_src[%u] res:%s res_id %d cnt %u",
+					isp_res->hw_intf->hw_idx,
+					isp_res->res_name, isp_res->res_id, cnt);
+			res[cnt] = isp_res;
+			cnt++;
+		}
+
+		if (cnt) {
+			hw_intf =  res[0]->hw_intf;
+			res_irq_mask.num_res = cnt;
+			res_irq_mask.node_res = res;
+			res_irq_mask.priv = ife_ctx;
+			res_irq_mask.enable_irq = enable_irq;
+
+			cdm_type = CAM_ISP_HW_CMD_UPDATE_VFE_SRC_RES_IRQ_MASK;
+		}
+	} else {
+		for (i = 0; i < c_ctx->num_acq_vfe_out; i++) {
+			hw_mgr_res = &c_ctx->res_list_ife_out[i];
+			isp_res = hw_mgr_res->hw_res[0];
+
+			if (!isp_res)
+				continue;
+
+			if (enable_irq)
+				isp_res->is_per_port_start = false;
+
+			CAM_DBG(CAM_ISP, "ife_out[%u] res:%s res_id %d cnt %u",
+					isp_res->hw_intf->hw_idx,
+					isp_res->res_name, isp_res->res_id, cnt);
+			res[cnt] = isp_res;
+			cnt++;
+		}
+
+		if (cnt) {
+			hw_intf =  res[0]->hw_intf;
+			res_irq_mask.num_res = cnt;
+			res_irq_mask.node_res = res;
+			res_irq_mask.priv = ife_ctx;
+			res_irq_mask.enable_irq = enable_irq;
+
+			cdm_type = CAM_ISP_HW_CMD_UPDATE_VFE_OUT_RES_IRQ_MASK;
+		}
+	}
+
+	if (hw_intf && hw_intf->hw_ops.process_cmd)
+		rc = hw_intf->hw_ops.process_cmd(
+			hw_intf->hw_priv,
+			cdm_type,
+			&res_irq_mask,
+			sizeof(struct cam_vfe_res_irq_info));
+
+	if (rc) {
+		CAM_WARN(CAM_ISP, "%s %s hw res irq failed ctx: %d sensor_id: 0x%x",
+			enable_irq ? "ENABLE" : "DISABLE",
+			is_vfe_src ? "IFE_SRC" : "IFE_OUT",
+			c_ctx->ctx_index, c_ctx->sensor_id);
+	} else {
+		CAM_DBG(CAM_ISP, "%s %s hw res irq success ctx: %d sensor_id: 0x%x",
+			enable_irq ? "ENABLE" : "DISABLE",
+			is_vfe_src ? "IFE_SRC" : "IFE_OUT",
+			c_ctx->ctx_index, c_ctx->sensor_id);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_update_csid_irq_mask(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	bool     is_internal_start,
+	bool     enable_irq)
+{
+	struct cam_ife_hw_concrete_ctx *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_isp_resource_node   *isp_res;
+	struct cam_isp_resource_node   *res[CAM_IFE_PIX_PATH_RES_MAX - 1];
+	struct cam_csid_res_irq_info    res_irq_mask;
+	struct cam_hw_intf             *hw_intf;
+	uint32_t  cnt = 0;
+	int rc = 0;
+
+
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		isp_res = hw_mgr_res->hw_res[0];
+
+		if (enable_irq)
+			hw_mgr_res->hw_res[0]->is_per_port_start = false;
+
+		CAM_DBG(CAM_ISP, "csid[%u] res:%s res_id %d cnt %u",
+				isp_res->hw_intf->hw_idx,
+				isp_res->res_name, isp_res->res_id, cnt);
+		res[cnt] = isp_res;
+		cnt++;
+	}
+
+	if (cnt) {
+		hw_intf =  res[0]->hw_intf;
+		res_irq_mask.num_res = cnt;
+		res_irq_mask.node_res = res;
+		res_irq_mask.priv = ife_ctx;
+		res_irq_mask.enable_irq = enable_irq;
+		res_irq_mask.is_internal_start = is_internal_start;
+
+		if (hw_intf && hw_intf->hw_ops.process_cmd)
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_UPDATE_CSID_RES_IRQ_MASK,
+				&res_irq_mask,
+				sizeof(struct cam_csid_res_irq_info));
+	}
+	return 0;
+}
+
+int cam_ife_mgr_disable_irq(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx)
+{
+	/*disable csid irqs*/
+	cam_ife_mgr_update_csid_irq_mask(ife_ctx, false, false);
+
+	/*disable ife_out irqs*/
+	cam_ife_mgr_update_vfe_irq_mask(ife_ctx, false, false);
+
+	/*disable ife src irqs*/
+	cam_ife_mgr_update_vfe_irq_mask(ife_ctx, true, false);
+
+	return 0;
+}
+int cam_ife_mgr_enable_irq(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	bool                                 is_internal_start)
+{
+	struct cam_isp_hw_mgr_res           *hw_mgr_res = NULL;
+	bool                                 res_rdi_context_set = false;
+	uint32_t                             primary_rdi_out_res = 0;
+	uint32_t                             primary_rdi_csid_res = 0;
+	uint32_t                             primary_rdi_src_res = 0;
+	struct cam_ife_hw_concrete_ctx       *c_ctx = ife_ctx->concr_ctx;
+	struct cam_isp_resource_node         *isp_res;
+	struct cam_isp_resource_node   *primary_rdi_res = NULL;
+	uint32_t i;
+
+	primary_rdi_src_res = CAM_ISP_HW_VFE_IN_MAX;
+	primary_rdi_out_res = g_ife_hw_mgr.isp_caps.max_vfe_out_res_type;
+	primary_rdi_csid_res = CAM_IFE_PIX_PATH_RES_MAX;
+
+	for (i = 0; i < c_ctx->num_acq_vfe_out; i++) {
+		hw_mgr_res = &c_ctx->res_list_ife_out[i];
+		switch (hw_mgr_res->res_id) {
+		case CAM_ISP_IFE_OUT_RES_RDI_0:
+		case CAM_ISP_IFE_OUT_RES_RDI_1:
+		case CAM_ISP_IFE_OUT_RES_RDI_2:
+		case CAM_ISP_IFE_OUT_RES_RDI_3:
+		case CAM_ISP_IFE_OUT_RES_RDI_4:
+		case CAM_ISP_IFE_OUT_RES_RDI_5:
+			if (!res_rdi_context_set && cam_isp_is_ctx_primary_rdi(ife_ctx)) {
+				hw_mgr_res->hw_res[0]->is_rdi_primary_res =
+					cam_isp_is_ctx_primary_rdi(ife_ctx);
+				res_rdi_context_set = true;
+				primary_rdi_out_res = hw_mgr_res->res_id;
+			}
+			break;
+		default:
+			break;
+		}
+	}
+
+	/*enable ife_out irqs*/
+	cam_ife_mgr_update_vfe_irq_mask(ife_ctx, false, true);
+
+	if (primary_rdi_out_res < g_ife_hw_mgr.isp_caps.max_vfe_out_res_type) {
+		primary_rdi_src_res =
+			cam_convert_rdi_out_res_id_to_src(primary_rdi_out_res);
+		primary_rdi_csid_res =
+			cam_ife_hw_mgr_get_ife_csid_rdi_res_type(
+			primary_rdi_out_res);
+	}
+
+	/* Start the IFE mux in devices */
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_src, list) {
+		if (primary_rdi_src_res == hw_mgr_res->res_id) {
+			hw_mgr_res->hw_res[0]->is_rdi_primary_res =
+			cam_isp_is_ctx_primary_rdi(ife_ctx);
+		}
+	}
+
+	/*enable ife_src irqs*/
+	cam_ife_mgr_update_vfe_irq_mask(ife_ctx, true, true);
+
+	/*enable csid irqs*/
+	list_for_each_entry(hw_mgr_res, &c_ctx->res_list_ife_csid, list) {
+		isp_res = hw_mgr_res->hw_res[0];
+		if (!isp_res)
+			continue;
+		if ((primary_rdi_csid_res == hw_mgr_res->res_id) ||
+			(c_ctx->ctx_type == CAM_IFE_CTX_TYPE_SFE &&
+			 isp_res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0))
+			primary_rdi_res = isp_res;
+
+		CAM_DBG(CAM_ISP,
+			"csid[%u] ctx_idx: %u res:%s res_id %d",
+			isp_res->hw_intf->hw_idx, c_ctx->ctx_index,
+			isp_res->res_name, isp_res->res_id);
+	}
+
+	if (!(hw_mgr_res->res_id == CAM_IFE_PIX_PATH_RES_IPP) && primary_rdi_res)
+		primary_rdi_res->is_rdi_primary_res = true;
+
+	/*enable csid irqs*/
+	cam_ife_mgr_update_csid_irq_mask(ife_ctx, is_internal_start, true);
+
+	return 0;
+}
+
+int cam_ife_mgr_update_irq_mask_affected_ctx_stream_grp(
+	struct cam_ife_hw_mgr_ctx           *ctx,
+	int                                 index,
+	bool                                enable_irq,
+	bool                                is_internal_start)
+{
+	int i, rc = 0;
+	struct cam_ife_hw_mgr_ctx               *ife_ctx;
+	struct cam_ife_hw_concrete_ctx           *c_ctx = ctx->concr_ctx;
+
+	for (i = 0; i < g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg_cnt; i++) {
+		if (g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg[i].acquired &&
+			g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg[i].priv !=
+			NULL) {
+			ife_ctx =
+				g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg[i].priv;
+
+			if (c_ctx->ctx_index != ife_ctx->concr_ctx->ctx_index)
+				continue;
+
+			if (enable_irq) {
+				rc = cam_ife_mgr_enable_irq(ife_ctx, is_internal_start);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed to enable irq for ctx: %u sensor_id: 0x%x",
+						ife_ctx->concr_ctx->ctx_index,
+						ife_ctx->concr_ctx->sensor_id);
+					goto end;
+				}
+				g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg[i].is_streamon =
+					true;
+				g_ife_sns_grp_cfg.grp_cfg[index]->stream_on_cnt++;
+			} else {
+				rc = cam_ife_mgr_disable_irq(ife_ctx);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed to disable irq for ctx: %u sensor_id: 0x%x",
+						ife_ctx->concr_ctx->ctx_index,
+						ife_ctx->concr_ctx->sensor_id);
+					goto end;
+				}
+				g_ife_sns_grp_cfg.grp_cfg[index]->stream_cfg[i].is_streamon =
+					false;
+
+				if (g_ife_sns_grp_cfg.grp_cfg[index]->stream_on_cnt > 0)
+					g_ife_sns_grp_cfg.grp_cfg[index]->stream_on_cnt--;
+			}
+		}
+	}
+end:
+	return rc;
+}
+
+int cam_ife_hw_mgr_free_hw_ctx(
+	struct cam_ife_hw_mgr_ctx        *ife_ctx)
+{
+	uint32_t                          i, j;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res_temp;
+	struct cam_ife_hw_mgr_stream_grp_config *grp_cfg;
+	bool                              found = false;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ife_ctx->concr_ctx;
+
+	/* ife leaf resource */
+	for (i = 0; i < c_ctx->num_acq_vfe_out; i++) {
+		/* caller should make sure the resource is in a list */
+		hw_mgr_res = &c_ctx->res_list_ife_out[i];
+
+		if (!hw_mgr_res->hw_res[0])
+			continue;
+		hw_mgr_res->linked = false;
+		memset(hw_mgr_res, 0, sizeof(*hw_mgr_res));
+		c_ctx->num_acq_vfe_out--;
+	}
+
+	/* fetch rd resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&c_ctx->res_list_ife_in_rd, list) {
+		hw_mgr_res->linked = false;
+		list_del_init(&hw_mgr_res->list);
+		memset(hw_mgr_res, 0, sizeof(*hw_mgr_res));
+		INIT_LIST_HEAD(&hw_mgr_res->list);
+
+		cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* ife source resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&c_ctx->res_list_ife_src, list) {
+		hw_mgr_res->linked = false;
+		list_del_init(&hw_mgr_res->list);
+		memset(hw_mgr_res, 0, sizeof(*hw_mgr_res));
+		INIT_LIST_HEAD(&hw_mgr_res->list);
+
+		cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* ife csid resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&c_ctx->res_list_ife_csid, list) {
+		hw_mgr_res->linked = false;
+		list_del_init(&hw_mgr_res->list);
+		memset(hw_mgr_res, 0, sizeof(*hw_mgr_res));
+		INIT_LIST_HEAD(&hw_mgr_res->list);
+
+		cam_ife_hw_mgr_put_res(&c_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* ife root node */
+	if (c_ctx->res_list_ife_in.res_type != CAM_ISP_RESOURCE_UNINT)
+		cam_ife_hw_mgr_free_hw_res(&c_ctx->res_list_ife_in, true);
+
+	/* clean up the callback function */
+	c_ctx->common.cb_priv = NULL;
+	c_ctx->common.event_cb = NULL;
+
+	c_ctx->flags.need_csid_top_cfg = false;
+
+	if (c_ctx->flags.per_port_en) {
+		for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+			if (!g_ife_sns_grp_cfg.grp_cfg[i])
+				continue;
+			grp_cfg = g_ife_sns_grp_cfg.grp_cfg[i];
+			for (j = 0; j < grp_cfg->stream_cfg_cnt; j++) {
+				if (grp_cfg->stream_cfg[j].sensor_id ==
+					c_ctx->sensor_id) {
+					grp_cfg->stream_cfg[j].acquired = false;
+					grp_cfg->stream_cfg[j].priv = NULL;
+					grp_cfg->stream_cfg[j].lcr_vc_dt_updated = false;
+					grp_cfg->stream_cfg[j].pxl_vc_dt_updated = false;
+					grp_cfg->stream_cfg[j].ppp_vc_dt_updated = false;
+					if (grp_cfg->stream_cfg[j].rdi_vc_dt_updated > 0)
+						grp_cfg->stream_cfg[j].rdi_vc_dt_updated--;
+					if (grp_cfg->acquire_cnt > 0)
+						grp_cfg->acquire_cnt--;
+					found = true;
+					break;
+				}
+			}
+			if (found)
+				break;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "release context completed ctx id:%d",
+		c_ctx->ctx_index);
+
+	return 0;
+}
+
+int cam_ife_mgr_get_active_hw_ctx_cnt(
+	struct cam_ife_hw_mgr_ctx  *ife_ctx,
+	struct cam_isp_hw_cmd_args *isp_hw_cmd_args)
+{
+	int i, j, rc = 0;
+	bool found = false;
+	struct cam_ife_hw_concrete_ctx  *c_ctx = ife_ctx->concr_ctx;
+
+	if (c_ctx->flags.per_port_en && !c_ctx->flags.is_dual) {
+		for (i = 0; i < CAM_ISP_STREAM_GROUP_CFG_MAX; i++) {
+			if (!g_ife_sns_grp_cfg.grp_cfg[i])
+				continue;
+			for (j = 0; j <
+				g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg_cnt; j++) {
+				if (c_ctx->sensor_id ==
+					g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].sensor_id) {
+					found = true;
+					break;
+				}
+			}
+			if (found)
+				break;
+		}
+
+		if (i == CAM_ISP_STREAM_GROUP_CFG_MAX) {
+			isp_hw_cmd_args->u.active_hw_ctx.hw_ctx_cnt = 0;
+			isp_hw_cmd_args->u.active_hw_ctx.stream_grp_cfg_index = -1;
+			CAM_ERR(CAM_ISP, "cannot find stream grp cfg for ctx:%d sensor_id:%d",
+				c_ctx->ctx_index, c_ctx->sensor_id);
+			rc = -EINVAL;
+			goto end;
+		} else {
+			mutex_lock(&g_ife_sns_grp_cfg.grp_cfg[i]->lock);
+			isp_hw_cmd_args->u.active_hw_ctx.hw_ctx_cnt =
+				g_ife_sns_grp_cfg.grp_cfg[i]->acquire_cnt;
+			isp_hw_cmd_args->u.active_hw_ctx.stream_grp_cfg_index = i;
+			mutex_unlock(&g_ife_sns_grp_cfg.grp_cfg[i]->lock);
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "ctx :%u sensor_id: 0x%x hw_ctx_cnt %d grp_cfg_index :%d",
+		c_ctx->ctx_index, c_ctx->sensor_id,
+		isp_hw_cmd_args->u.active_hw_ctx.hw_ctx_cnt,
+		isp_hw_cmd_args->u.active_hw_ctx.stream_grp_cfg_index);
+
+end:
+	return rc;
+}
+
+int cam_ife_mgr_get_active_hw_ctx(
+	struct cam_ife_hw_mgr_ctx           *ctx,
+	struct cam_isp_hw_cmd_args *isp_hw_cmd_args)
+{
+	struct cam_ife_hw_mgr_ctx        *ife_ctx;
+	struct cam_isp_hw_active_hw_ctx  *active_hw_ctx_info;
+	struct cam_ife_hw_concrete_ctx   *c_ctx = ctx->concr_ctx;
+	int i, j;
+
+	active_hw_ctx_info = (struct cam_isp_hw_active_hw_ctx  *)isp_hw_cmd_args->cmd_data;
+	i = active_hw_ctx_info->stream_grp_cfg_index;
+
+	if (c_ctx->flags.per_port_en && !c_ctx->flags.is_dual) {
+		mutex_lock(&g_ife_sns_grp_cfg.grp_cfg[i]->lock);
+		for (j = active_hw_ctx_info->index; j <
+			g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg_cnt; j++) {
+			if (g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].acquired &&
+				g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].priv != NULL) {
+				ife_ctx =
+					g_ife_sns_grp_cfg.grp_cfg[i]->stream_cfg[j].priv;
+				isp_hw_cmd_args->u.ptr = (void *)ife_ctx->cb_priv;
+				active_hw_ctx_info->index = ++j;
+				break;
+			}
+		}
+		mutex_unlock(&g_ife_sns_grp_cfg.grp_cfg[i]->lock);
+	}
+
+	CAM_DBG(CAM_ISP,
+		"ctx :%u sensor_id: 0x%x grp_cfg_index :%d next_active_hw_index: %d",
+		c_ctx->ctx_index, c_ctx->sensor_id,
+		active_hw_ctx_info->stream_grp_cfg_index,
+		active_hw_ctx_info->index);
+
+	return 0;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr_addons.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr_addons.h
@@ -0,0 +1,84 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_OFFLINE_IFE_HW_MGR_H_
+#define _CAM_OFFLINE_IFE_HW_MGR_H_
+
+
+#define CAM_IFE_HW_STATE_STOPPED  0
+#define CAM_IFE_HW_STATE_STARTING 1
+#define CAM_IFE_HW_STATE_STARTED  2
+#define CAM_IFE_HW_STATE_BUSY     3
+#define CAM_IFE_HW_STATE_STOPPING 4
+
+int cam_ife_mgr_free_in_proc_req(struct cam_ife_hw_mgr *ife_hw_mgr,
+	uint32_t hw_id);
+unsigned int cam_ife_mgr_flush_in_queue(struct cam_ife_hw_mgr *ife_hw_mgr,
+	uint32_t ctx_idx,
+	bool just_incomplete,
+	int64_t req_id);
+int cam_ife_mgr_enqueue_offline_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args);
+int cam_ife_mgr_enqueue_offline_config(void *hw_mgr_priv,
+	void *config_hw_args);
+int cam_ife_mgr_required_hw(void *hw_mgr_priv, bool stop);
+int cam_ife_mgr_check_start_processing(void *hw_mgr_priv,
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx);
+int cam_ife_find_reconfig_required(void *hw_mgr_priv,
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx);
+int cam_ife_mgr_update_irq_mask_affected_ctx_stream_grp(
+	struct cam_ife_hw_mgr_ctx *ctx, int index, bool enable_irq, bool is_internal_start);
+
+int cam_ife_mgr_disable_irq(struct cam_ife_hw_mgr_ctx *ctx);
+
+int cam_ife_hw_mgr_start_ife_out_res_stream_grp(int grp_cfg_index,
+	struct cam_ife_hw_mgr_ctx  *ife_ctx);
+
+int cam_ife_hw_mgr_ife_src_start_hw_stream_grp(int grp_cfg_index,
+	struct cam_ife_hw_mgr_ctx      *ife_ctx);
+
+int cam_ife_mgr_csid_start_hw_stream_grp(struct cam_ife_hw_mgr_ctx *ife_ctx,
+	int grp_cfg_index, bool is_internal_start);
+
+int cam_ife_mgr_enable_irq(struct cam_ife_hw_mgr_ctx *ctx, bool is_internal_start);
+
+bool cam_ife_hw_mgr_check_outport_supported_for_lite(uint32_t res_type);
+
+int cam_convert_res_id_to_hw_path(int res_id, int csid_res_id);
+
+int cam_ife_hw_mgr_update_vc_dt_stream_grp(struct cam_isp_hw_mgr_res *isp_res, int index,
+		enum cam_ife_pix_path_res_id path_res_id, bool is_rdi_path);
+
+int cam_ife_hw_mgr_acquire_res_stream_grp(struct cam_ife_hw_mgr_ctx *ife_ctx,
+		struct cam_isp_in_port_generic_info *in_port, uint32_t *acquired_hw_id,
+		uint32_t *acquired_hw_path, uint32_t *acquired_rdi_res, bool crop_enable);
+
+int cam_ife_mgr_hw_validate_vc_dt_stream_grp(struct cam_isp_in_port_generic_info *in_port,
+		uint32_t vc, uint32_t dt);
+
+int cam_ife_hw_mgr_get_virtual_mapping_out_port(void *priv,
+		uint32_t out_port_id, bool is_virtual_rdi);
+
+int cam_ife_hw_mgr_res_stream_on_off_grp_cfg(struct cam_ife_hw_mgr_ctx *ife_ctx,
+		void *hw_args, enum cam_ife_csid_halt_cmd csid_halt_type, bool is_start_hw,
+		bool *per_port_feature_enable, bool *skip_hw_deinit);
+
+int cam_ife_hw_mgr_free_hw_ctx(struct cam_ife_hw_mgr_ctx *ife_ctx);
+
+int cam_ife_mgr_clear_sensor_stream_cfg_grp(uint32_t grp_cfg_idx);
+
+int cam_ife_hw_mgr_get_virtual_mapping_out_port(void *priv,
+		uint32_t out_port_id, bool is_virtual_rdi);
+
+int cam_ife_mgr_get_active_hw_ctx_cnt(struct cam_ife_hw_mgr_ctx  *ife_ctx,
+		struct cam_isp_hw_cmd_args *isp_hw_cmd_args);
+
+int cam_ife_mgr_get_active_hw_ctx(struct cam_ife_hw_mgr_ctx *ctx,
+		struct cam_isp_hw_cmd_args *isp_hw_cmd_args);
+
+int cam_ife_mgr_update_sensor_grp_stream_cfg(void *hw_mgr_priv, void *hw_cfg_args);
+
+int cam_ife_mgr_check_per_port_enable(struct cam_isp_in_port_generic_info *in_port);
+#endif /* _CAM_OFFLINE_IFE_HW_MGR_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.c
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_debug_util.h"
+#include "cam_tfe_hw_mgr.h"
+
+
+int cam_isp_hw_mgr_init(const char   *device_name_str,
+	struct cam_hw_mgr_intf *hw_mgr, int *iommu_hdl, uint32_t isp_device_type)
+{
+	int rc = 0;
+
+	if (strnstr(device_name_str, "ife", strlen(device_name_str)) ||
+		strnstr(device_name_str, "mc_tfe", strlen(device_name_str)))
+		rc = cam_ife_hw_mgr_init(hw_mgr, iommu_hdl, isp_device_type);
+	else if (strnstr(device_name_str, "tfe", strlen(device_name_str)))
+		rc = cam_tfe_hw_mgr_init(hw_mgr, iommu_hdl);
+	else {
+		CAM_ERR(CAM_ISP, "Invalid ISP hw type :%s", device_name_str);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+void cam_isp_hw_mgr_deinit(const char *device_name_str)
+{
+	if (strnstr(device_name_str, "ife", strlen(device_name_str)))
+		cam_ife_hw_mgr_deinit();
+	else if (strnstr(device_name_str, "tfe", strlen(device_name_str)))
+		cam_tfe_hw_mgr_deinit();
+	else
+		CAM_ERR(CAM_ISP, "Invalid ISP hw type :%s", device_name_str);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.h
@@ -0,0 +1,117 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_HW_MGR_H_
+#define _CAM_ISP_HW_MGR_H_
+
+#include <media/cam_defs.h>
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_isp_hw.h"
+
+#define CAM_ISP_HW_NUM_MAX                       8
+#define CAM_ISP_IN_SENSOR_ID_UNKNOWN             0xdeadbeef
+#define CAM_IFE_STREAM_GRP_INDEX_NONE            0xdeadbeef
+/**
+ * struct cam_isp_hw_mgr_ctx - common acquired context for managers
+ *
+ * @takslet_info:          assciated tasklet
+ * @event_cb:              call back interface to ISP context. Set during
+ *                         acquire device
+ * @cb_priv:               first argument for the call back function
+ *                         set during acquire device
+ * @mini_dump_cb:          Callback for mini dump
+ * @sec_pf_evt_cb:         Callback interface to ISP context for CDM page fault
+ *                         set during device acquire
+ * @virtual_rdi_mapping_cb Callback query for virtual rdi mapping
+ *
+ */
+struct cam_isp_hw_mgr_ctx {
+	void                           *tasklet_info;
+	cam_hw_event_cb_func            event_cb;
+	void                           *cb_priv;
+	cam_ctx_mini_dump_cb_func       mini_dump_cb;
+	cam_hw_pagefault_cb_func        sec_pf_evt_cb;
+	cam_hw_get_virtual_rdi_mapping_cb_func virtual_rdi_mapping_cb;
+};
+
+/**
+ * struct cam_isp_hw_mgr - ISP HW Manager common object
+ *
+ * @tasklet_pool:             Tasklet pool
+ * @img_iommu_hdl:            iommu memory handle for regular image buffer
+ * @img_iommu_hdl_secure:     iommu memory handle for secure image buffer
+ * @cmd_iommu_hdl:            iommu memory handle for regular command buffer
+ * @cmd_iommu_hdl:            iommu memory handle for secure command buffer
+ * @scratch_buf_range:        scratch buffer range (not for IFE)
+ * @scratch_buf_addr:         scratch buffer address (not for IFE)
+ *
+ */
+struct cam_isp_hw_mgr {
+	void                           *tasklet_pool[CAM_CTX_MAX];
+	int                             img_iommu_hdl;
+	int                             img_iommu_hdl_secure;
+	int                             cmd_iommu_hdl;
+	int                             cmd_iommu_hdl_secure;
+	uint32_t                        scratch_buf_range;
+	dma_addr_t                      scratch_buf_addr;
+};
+
+/**
+ * struct cam_isp_hw_mgr_res- HW resources for the ISP hw manager
+ *
+ * @list:                used by the resource list
+ * @res_type:            ISP manager resource type
+ * @res_id:              resource id based on the resource type for root or
+ *                       leaf resource, it matches the KMD interface port id.
+ *                       For branch resource, it is defined by the ISP HW
+ *                       layer
+ * @is_dual_isp          is dual isp hw resource
+ * @hw_res:              hw layer resource array. For single ISP, only one ISP
+ *                       hw resource will be acquired. For dual ISP, two hw
+ *                       resources from different ISP HW device will be
+ *                       acquired
+ * @is_secure            informs whether the resource is in secure mode or not
+ * @num_children:        number of the child resource node.
+ * @vc:                  input virtual channel number
+ * @dt:                  input data type number
+ * @use_wm_pack:         Flag to indicate if WM is to be used for packing
+ * @hw_ctxt_id:          HW context ID mask corresponding to this resource
+ * @linked:              Indicates if this hw res to linked to any ife context
+ * @decode_format        input data format
+ *
+ */
+struct cam_isp_hw_mgr_res {
+	struct list_head                 list;
+	enum cam_isp_resource_type       res_type;
+	uint32_t                         res_id;
+	uint32_t                         is_dual_isp;
+	struct cam_isp_resource_node    *hw_res[CAM_ISP_HW_SPLIT_MAX];
+	uint32_t                         is_secure;
+	uint32_t                         num_children;
+	uint32_t                         vc;
+	uint32_t                         dt;
+	bool                             use_wm_pack;
+	uint32_t                         hw_ctxt_id_mask;
+	bool                             linked;
+	uint32_t                         decode_format;
+};
+
+
+/**
+ * struct cam_isp_ctx_base_info - Base hardware information for the context
+ *
+ * @idx:                 Base resource index
+ * @split_id:            Split info for the base resource
+ * @hw_type:             HW type [IFE/SFE/..] for the base resource
+ *
+ */
+struct cam_isp_ctx_base_info {
+	uint32_t                       idx;
+	enum cam_isp_hw_split_id       split_id;
+	enum cam_isp_hw_type           hw_type;
+};
+#endif /* _CAM_ISP_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c
@@ -0,0 +1,7510 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+#include <media/cam_tfe.h>
+
+#include "cam_smmu_api.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_tfe_csid_hw_intf.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_tfe_soc.h"
+#include "cam_isp_packet_parser.h"
+#include "cam_tfe_hw_mgr.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm_util.h"
+#include "cam_packet_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+#include "cam_req_mgr_debug.h"
+#include "cam_trace.h"
+#include "cam_compat.h"
+
+#define CAM_TFE_HW_CONFIG_TIMEOUT 60
+#define CAM_TFE_HW_CONFIG_WAIT_MAX_TRY  3
+#define MAX_TFE_INTERNAL_RECOVERY_ATTEMPTS    1
+
+#define TZ_SVC_SMMU_PROGRAM 0x15
+#define TZ_SAFE_SYSCALL_ID  0x3
+#define CAM_TFE_SAFE_DISABLE 0
+#define CAM_TFE_SAFE_ENABLE 1
+#define SMMU_SE_TFE 0
+
+#define CAM_TFE_HW_MGR_STATE_INACTIVE  0
+#define CAM_TFE_HW_MGR_STATE_ACTIVE    1
+
+static struct cam_tfe_hw_mgr g_tfe_hw_mgr;
+static uint32_t g_num_tfe_available, g_num_tfe_functional;
+static uint32_t g_num_tfe_lite_available, g_num_tfe_lite_functional;
+
+static int cam_tfe_hw_mgr_event_handler(
+	void                                *priv,
+	uint32_t                             evt_id,
+	void                                *evt_info);
+
+static void *cam_tfe_hw_mgr_get_hw_intf(
+	struct cam_isp_ctx_base_info *base,
+	struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	struct cam_tfe_hw_mgr  *hw_mgr;
+
+	hw_mgr = ctx->hw_mgr;
+
+	return hw_mgr->tfe_devices[base->idx]->hw_intf;
+}
+
+static int cam_tfe_mgr_cmd_get_sof_timestamp(struct cam_tfe_hw_mgr_ctx *tfe_ctx,
+	uint64_t *time_stamp, uint64_t *boot_time_stamp, uint64_t *prev_time_stamp);
+
+static int cam_tfe_mgr_regspace_data_cb(uint32_t reg_base_type,
+	void *hw_mgr_ctx, struct cam_hw_soc_info **soc_info_ptr,
+	uint32_t *reg_base_idx)
+{
+	int rc = 0;
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	struct cam_hw_soc_info    *soc_info = NULL;
+	struct cam_isp_resource_node       *res;
+	struct cam_tfe_hw_mgr_ctx *ctx =
+		(struct cam_tfe_hw_mgr_ctx *) hw_mgr_ctx;
+
+	*soc_info_ptr = NULL;
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		if ((hw_mgr_res->res_id != CAM_ISP_HW_TFE_IN_CAMIF) &&
+			!ctx->is_rdi_only_context)
+			continue;
+
+		switch (reg_base_type) {
+		case CAM_REG_DUMP_BASE_TYPE_CAMNOC:
+		case CAM_REG_DUMP_BASE_TYPE_ISP_LEFT:
+			if (!hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT])
+				continue;
+
+			res = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT];
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA,
+				&soc_info, sizeof(void *));
+
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in regspace data query split idx: %d rc : %d",
+					CAM_ISP_HW_SPLIT_LEFT, rc);
+				return rc;
+			}
+
+			if (reg_base_type == CAM_REG_DUMP_BASE_TYPE_ISP_LEFT)
+				*reg_base_idx = 0;
+			else
+				*reg_base_idx = 1;
+
+			*soc_info_ptr = soc_info;
+			break;
+		case CAM_REG_DUMP_BASE_TYPE_ISP_RIGHT:
+			if (!hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT])
+				continue;
+
+
+			res = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT];
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA,
+				&soc_info, sizeof(void *));
+
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in regspace data query split idx: %d rc : %d",
+					CAM_ISP_HW_SPLIT_RIGHT, rc);
+				return rc;
+			}
+
+			*reg_base_idx = 0;
+			*soc_info_ptr = soc_info;
+			break;
+		default:
+			CAM_ERR(CAM_ISP,
+				"Unrecognized reg base type: %d",
+				reg_base_type);
+			return -EINVAL;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_handle_reg_dump(struct cam_tfe_hw_mgr_ctx *ctx,
+	struct cam_cmd_buf_desc *reg_dump_buf_desc, uint32_t num_reg_dump_buf,
+	uint32_t meta_type,
+	void *soc_dump_args,
+	bool user_triggered_dump)
+{
+	int rc = -EINVAL, i;
+
+	if (!num_reg_dump_buf || !reg_dump_buf_desc) {
+		CAM_DBG(CAM_ISP,
+			"Invalid args for reg dump req_id: [%llu] ctx idx: [%u] meta_type: [%u] num_reg_dump_buf: [%u] reg_dump_buf_desc: [%pK]",
+			ctx->applied_req_id, ctx->ctx_index, meta_type,
+			num_reg_dump_buf, reg_dump_buf_desc);
+		return rc;
+	}
+
+	if (!atomic_read(&ctx->cdm_done))
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Reg dump values might be from more than one request");
+
+	for (i = 0; i < num_reg_dump_buf; i++) {
+		CAM_DBG(CAM_ISP, "Reg dump cmd meta data: %u req_type: %u",
+			reg_dump_buf_desc[i].meta_data, meta_type);
+		if (reg_dump_buf_desc[i].meta_data == meta_type) {
+			rc = cam_soc_util_reg_dump_to_cmd_buf(ctx,
+				&reg_dump_buf_desc[i],
+				ctx->applied_req_id,
+				cam_tfe_mgr_regspace_data_cb,
+				soc_dump_args,
+				user_triggered_dump);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Reg dump failed at idx: %d, rc: %d req_id: %llu meta type: %u",
+					i, rc, ctx->applied_req_id, meta_type);
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_get_hw_caps_internal(void *hw_mgr_priv,
+	struct cam_isp_tfe_query_cap_cmd_v2     *query_isp)
+{
+	int i, rc = 0;
+	uint32_t num_dev = 0;
+	struct cam_tfe_hw_mgr                  *hw_mgr = hw_mgr_priv;
+
+	query_isp->device_iommu.non_secure = hw_mgr->mgr_common.img_iommu_hdl;
+	query_isp->device_iommu.secure = hw_mgr->mgr_common.img_iommu_hdl_secure;
+	query_isp->cdm_iommu.non_secure = hw_mgr->mgr_common.cmd_iommu_hdl;
+	query_isp->cdm_iommu.secure = hw_mgr->mgr_common.cmd_iommu_hdl_secure;
+
+	for (i = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+		if (!hw_mgr->csid_devices[i])
+			break;
+		if (i >= query_isp->num_dev)
+			return -EINVAL;
+
+		query_isp->dev_caps[i].hw_type = CAM_ISP_TFE_HW_TFE;
+		query_isp->dev_caps[i].hw_version.major = 7;
+		query_isp->dev_caps[i].hw_version.minor = 7;
+		query_isp->dev_caps[i].hw_version.incr = 0;
+
+		/*
+		 * device number is based on number of full tfe
+		 * if pix is not supported, set reserve to 1
+		 */
+		if (hw_mgr->tfe_csid_dev_caps[i].num_pix) {
+			query_isp->dev_caps[i].hw_version.reserved = 0;
+			num_dev++;
+		} else {
+			query_isp->dev_caps[i].hw_version.reserved = 1;
+		}
+	}
+
+	query_isp->num_dev = num_dev;
+	return rc;
+}
+
+static int cam_tfe_mgr_get_hw_caps(void *hw_mgr_priv,
+	void *hw_caps_args)
+{
+	int rc = 0;
+	int i, query_size;
+	uint32_t version = 0;
+	struct cam_query_cap_cmd               *query = hw_caps_args;
+	struct cam_tfe_hw_mgr                  *hw_mgr = hw_mgr_priv;
+	struct cam_isp_tfe_query_cap_cmd        query_isp = {0};
+	struct cam_isp_tfe_query_cap_cmd_v2    *query_isp_v2;
+
+	query_size = sizeof(struct cam_isp_tfe_query_cap_cmd_v2) +
+		((CAM_TFE_CSID_HW_NUM_MAX - 1) * sizeof(struct cam_isp_tfe_dev_cap_info));
+
+	query_isp_v2 = kzalloc(query_size, GFP_KERNEL);
+
+	if (!query_isp_v2) {
+		CAM_ERR(CAM_ISP, "Mem alloc failed");
+		return -ENOMEM;
+	}
+
+	query_isp_v2->num_dev = CAM_TFE_CSID_HW_NUM_MAX;
+	rc = cam_tfe_mgr_get_hw_caps_internal(hw_mgr_priv, query_isp_v2);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Invalid num devs");
+		kfree(query_isp_v2);
+		return rc;
+	}
+
+	query_isp.device_iommu.non_secure = query_isp_v2->device_iommu.non_secure;
+	query_isp.device_iommu.secure = query_isp_v2->device_iommu.secure;
+	query_isp.cdm_iommu.non_secure = query_isp_v2->cdm_iommu.non_secure;
+	query_isp.cdm_iommu.secure = query_isp_v2->cdm_iommu.secure;
+
+	for (i = 0; i < CAM_ISP_TFE_HW_MAX; i++) {
+		if (!hw_mgr->csid_devices[i])
+			continue;
+		query_isp.dev_caps[i] = query_isp_v2->dev_caps[i];
+	}
+
+	query_isp.num_dev = query_isp_v2->num_dev;
+
+	if (copy_to_user(u64_to_user_ptr(query->caps_handle),
+		&query_isp, sizeof(struct cam_isp_tfe_query_cap_cmd))) {
+		CAM_ERR(CAM_ISP, "copy to user failed, query cap version %d", version);
+		kfree(query_isp_v2);
+		return -EFAULT;
+	}
+
+	kfree(query_isp_v2);
+	return rc;
+}
+
+static int cam_tfe_mgr_get_hw_caps_v2(void *hw_mgr_priv,
+	void *hw_caps_args)
+{
+	int query_size, rc = 0;
+	struct cam_query_cap_cmd                *query = hw_caps_args;
+	struct cam_isp_tfe_query_cap_cmd_v2      tmp_query_isp_v2;
+	struct cam_isp_tfe_query_cap_cmd_v2     *query_isp_v2;
+
+	if (copy_from_user(&tmp_query_isp_v2, u64_to_user_ptr(query->caps_handle),
+		sizeof(tmp_query_isp_v2))) {
+		rc = -EFAULT;
+		return rc;
+	}
+
+	if (tmp_query_isp_v2.version != CAM_QUERY_CAP_V2) {
+		CAM_ERR(CAM_ISP, "Query cap Version %d invalid", tmp_query_isp_v2.version);
+		return -EINVAL;
+	}
+
+	if (!tmp_query_isp_v2.num_dev ||
+			tmp_query_isp_v2.num_dev > CAM_TFE_CSID_HW_NUM_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid Num of dev is %d query cap version %d",
+			tmp_query_isp_v2.num_dev, tmp_query_isp_v2.version);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	query_size = sizeof(struct cam_isp_tfe_query_cap_cmd_v2) +
+		((tmp_query_isp_v2.num_dev - 1) * sizeof(struct cam_isp_tfe_dev_cap_info));
+
+	query_isp_v2 = kzalloc(query_size, GFP_KERNEL);
+
+	if (!query_isp_v2) {
+		CAM_ERR(CAM_ISP, "Mem alloc failed");
+		return -ENOMEM;
+	}
+
+	query_isp_v2->version = tmp_query_isp_v2.version;
+	query_isp_v2->num_dev = tmp_query_isp_v2.num_dev;
+
+	rc = cam_tfe_mgr_get_hw_caps_internal(hw_mgr_priv, query_isp_v2);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Invalid Num of dev is %d query cap version %d",
+			tmp_query_isp_v2.num_dev, tmp_query_isp_v2.version);
+		kfree(query_isp_v2);
+		return -EINVAL;
+	}
+
+	if (copy_to_user(u64_to_user_ptr(query->caps_handle), query_isp_v2,
+		(sizeof(struct cam_isp_tfe_query_cap_cmd_v2) + ((query_isp_v2->num_dev - 1)
+		* sizeof(struct cam_isp_tfe_dev_cap_info))))) {
+		CAM_ERR(CAM_ISP, "copy to user failed, query cap version %d",
+			tmp_query_isp_v2.version);
+		kfree(query_isp_v2);
+		return -EFAULT;
+	}
+
+	kfree(query_isp_v2);
+	return rc;
+}
+
+static inline bool cam_tfe_hw_mgr_check_path_port_compat(
+	uint32_t in_type, uint32_t out_type)
+{
+	int i;
+	const struct cam_isp_hw_path_port_map *map = &g_tfe_hw_mgr.path_port_map;
+
+	for (i = 0; i < map->num_entries; i++) {
+		if (map->entry[i][1] == out_type)
+			return (map->entry[i][0] == in_type);
+	}
+
+	return (in_type == CAM_ISP_HW_TFE_IN_CAMIF);
+}
+
+static int cam_tfe_hw_mgr_is_rdi_res(uint32_t res_id)
+{
+	int rc = 0;
+
+	switch (res_id) {
+	case CAM_ISP_TFE_OUT_RES_RDI_0:
+	case CAM_ISP_TFE_OUT_RES_RDI_1:
+	case CAM_ISP_TFE_OUT_RES_RDI_2:
+		rc = 1;
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_convert_rdi_out_res_id_to_in_res(int res_id)
+{
+	if (res_id == CAM_ISP_TFE_OUT_RES_RDI_0)
+		return CAM_ISP_HW_TFE_IN_RDI0;
+	else if (res_id == CAM_ISP_TFE_OUT_RES_RDI_1)
+		return CAM_ISP_HW_TFE_IN_RDI1;
+	else if (res_id == CAM_ISP_TFE_OUT_RES_RDI_2)
+		return CAM_ISP_HW_TFE_IN_RDI1;
+
+	return CAM_ISP_HW_TFE_IN_MAX;
+}
+
+static int cam_tfe_hw_mgr_reset_csid_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	int rc = 0;
+	struct cam_hw_intf      *hw_intf;
+	struct cam_tfe_csid_reset_cfg_args  csid_reset_args;
+
+	csid_reset_args.reset_type = CAM_TFE_CSID_RESET_PATH;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		csid_reset_args.node_res = isp_hw_res->hw_res[i];
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		CAM_DBG(CAM_ISP, "Resetting csid hardware %d",
+			hw_intf->hw_idx);
+		if (hw_intf->hw_ops.reset) {
+			rc = hw_intf->hw_ops.reset(hw_intf->hw_priv,
+				&csid_reset_args,
+				sizeof(struct cam_tfe_csid_reset_cfg_args));
+			if (rc <= 0)
+				goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "RESET HW res failed: (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_init_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	int rc = -EINVAL;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		CAM_DBG(CAM_ISP, "hw type %d hw index:%d",
+			hw_intf->hw_type, hw_intf->hw_idx);
+		if (hw_intf->hw_ops.init) {
+			rc = hw_intf->hw_ops.init(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc)
+				goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "INIT HW res failed: (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_start_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res,
+	struct cam_tfe_hw_mgr_ctx   *ctx)
+{
+	int i;
+	int rc = -EINVAL;
+	struct cam_hw_intf      *hw_intf;
+
+	/* Start slave (which is right split) first */
+	for (i = CAM_ISP_HW_SPLIT_MAX - 1; i >= 0; i--) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.start) {
+			rc = hw_intf->hw_ops.start(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Can not start HW resources");
+				goto err;
+			}
+			CAM_DBG(CAM_ISP, "Start hw type:%d HW idx %d Res %d",
+				hw_intf->hw_type,
+				hw_intf->hw_idx,
+				isp_hw_res->hw_res[i]->res_id);
+		} else {
+			CAM_ERR(CAM_ISP, "function null");
+			goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "Start hw res failed (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static void cam_tfe_hw_mgr_stop_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	struct cam_hw_intf      *hw_intf;
+	uint32_t dummy_args;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+
+		if (isp_hw_res->hw_res[i]->res_state !=
+			CAM_ISP_RESOURCE_STATE_STREAMING)
+			continue;
+
+		if (hw_intf->hw_ops.stop)
+			hw_intf->hw_ops.stop(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+		else
+			CAM_ERR(CAM_ISP, "stop null");
+		if (hw_intf->hw_ops.process_cmd &&
+			isp_hw_res->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+			hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ,
+				&dummy_args, sizeof(dummy_args));
+		}
+		isp_hw_res->hw_res[i]->is_rdi_primary_res = false;
+	}
+}
+
+static void cam_tfe_hw_mgr_deinit_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.deinit)
+			hw_intf->hw_ops.deinit(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+	}
+}
+
+static void cam_tfe_hw_mgr_deinit_hw(
+	struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+
+	if (!ctx->init_done) {
+		CAM_WARN(CAM_ISP, "ctx is not in init state");
+		return;
+	}
+
+	/* Deinit TFE CSID hw */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		CAM_DBG(CAM_ISP, "Going to DeInit TFE CSID");
+		cam_tfe_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	/* Deint TFE HW */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		cam_tfe_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	ctx->init_done = false;
+}
+
+static inline void cam_tfe_mgr_count_functional_tfe(void)
+{
+	int i;
+	struct cam_hw_info *tfe_hw;
+	struct cam_tfe_soc_private *soc_private;
+
+	g_num_tfe_functional = 0;
+	g_num_tfe_lite_functional = 0;
+
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (g_tfe_hw_mgr.tfe_devices[i]) {
+			tfe_hw = (struct cam_hw_info *)
+				g_tfe_hw_mgr.tfe_devices[i]->hw_intf->hw_priv;
+			soc_private = tfe_hw->soc_info.soc_private;
+
+			if (soc_private->is_tfe_lite)
+				g_num_tfe_lite_functional++;
+			else
+				g_num_tfe_functional++;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "counted functional %u TFEs and %u TFE-LITEs", g_num_tfe_functional,
+		g_num_tfe_lite_functional);
+}
+
+static int cam_tfe_hw_mgr_init_hw(
+	struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "INIT TFE csid ... in ctx id:%d",
+		ctx->ctx_index);
+	/* INIT TFE csid */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		rc = cam_tfe_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT TFE CSID(id :%d)",
+				 hw_mgr_res->res_id);
+			goto deinit;
+		}
+	}
+
+	/* INIT TFE IN */
+	CAM_DBG(CAM_ISP, "INIT TFE in resource ctx id:%d",
+		ctx->ctx_index);
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		rc = cam_tfe_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT TFE SRC (%d)",
+				 hw_mgr_res->res_id);
+			goto deinit;
+		}
+	}
+
+	return rc;
+deinit:
+	ctx->init_done = true;
+	cam_tfe_hw_mgr_deinit_hw(ctx);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_put_res(
+	struct list_head                *src_list,
+	struct cam_isp_hw_mgr_res      **res)
+{
+	struct cam_isp_hw_mgr_res *res_ptr  = NULL;
+
+	res_ptr = *res;
+	if (res_ptr)
+		list_add_tail(&res_ptr->list, src_list);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_get_res(
+	struct list_head                *src_list,
+	struct cam_isp_hw_mgr_res      **res)
+{
+	int rc = 0;
+	struct cam_isp_hw_mgr_res *res_ptr  = NULL;
+
+	if (!list_empty(src_list)) {
+		res_ptr = list_first_entry(src_list,
+			struct cam_isp_hw_mgr_res, list);
+		list_del_init(&res_ptr->list);
+	} else {
+		CAM_ERR(CAM_ISP, "No more free tfe hw mgr ctx");
+		rc = -EINVAL;
+	}
+	*res = res_ptr;
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_free_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res, bool del_list)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.release) {
+			rc = hw_intf->hw_ops.release(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Release hw resource id %d failed",
+					isp_hw_res->res_id);
+			isp_hw_res->hw_res[i] = NULL;
+		} else
+			CAM_ERR(CAM_ISP, "Release null");
+	}
+	/* caller should make sure the resource is in a list */
+	if (del_list) {
+		list_del_init(&isp_hw_res->list);
+		memset(isp_hw_res, 0, sizeof(*isp_hw_res));
+		INIT_LIST_HEAD(&isp_hw_res->list);
+	} else {
+		memset(isp_hw_res, 0, sizeof(*isp_hw_res));
+	}
+
+	return 0;
+}
+
+static int cam_tfe_mgr_csid_change_halt_mode(struct cam_tfe_hw_mgr_ctx *ctx,
+	enum cam_tfe_csid_halt_mode halt_mode)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_resource_node     *isp_res;
+	struct cam_tfe_csid_hw_halt_args halt;
+	struct cam_hw_intf               *hw_intf;
+	uint32_t i;
+	int rc = 0;
+
+	if (!ctx->is_dual)
+		return 0;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (i == CAM_ISP_HW_SPLIT_LEFT)
+				continue;
+
+			if (!hw_mgr_res->hw_res[i] ||
+				(hw_mgr_res->hw_res[i]->res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING))
+				continue;
+
+			isp_res = hw_mgr_res->hw_res[i];
+
+			if ((isp_res->res_type == CAM_ISP_RESOURCE_PIX_PATH) &&
+				(isp_res->res_id ==
+					CAM_TFE_CSID_PATH_RES_IPP)) {
+				hw_intf         = isp_res->hw_intf;
+				halt.node_res   = isp_res;
+				halt.halt_mode  = halt_mode;
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE,
+					&halt,
+					sizeof(
+					struct cam_tfe_csid_hw_halt_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Halt update failed");
+				break;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_csid_stop_hw(
+	struct cam_tfe_hw_mgr_ctx *ctx, struct list_head  *stop_list,
+		uint32_t  base_idx, uint32_t stop_cmd)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_isp_resource_node   *isp_res;
+	struct cam_isp_resource_node   *stop_res[CAM_TFE_CSID_PATH_RES_MAX];
+	struct cam_tfe_csid_hw_stop_args    stop;
+	struct cam_hw_intf             *hw_intf;
+	uint32_t i, cnt;
+
+	cnt = 0;
+	list_for_each_entry(hw_mgr_res, stop_list, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i] ||
+				(hw_mgr_res->hw_res[i]->res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING))
+				continue;
+
+			isp_res = hw_mgr_res->hw_res[i];
+			if (isp_res->hw_intf->hw_idx != base_idx)
+				continue;
+			CAM_DBG(CAM_ISP, "base_idx %d res_id %d cnt %u",
+				base_idx, isp_res->res_id, cnt);
+			stop_res[cnt] = isp_res;
+			cnt++;
+		}
+	}
+
+	if (cnt) {
+		hw_intf =  stop_res[0]->hw_intf;
+		stop.num_res = cnt;
+		stop.node_res = stop_res;
+		stop.stop_cmd = stop_cmd;
+		hw_intf->hw_ops.stop(hw_intf->hw_priv, &stop, sizeof(stop));
+
+		for (i = 0; i < cnt; i++)
+			stop_res[i]->is_rdi_primary_res = false;
+	}
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_release_hw_for_ctx(
+	struct cam_tfe_hw_mgr_ctx  *tfe_ctx)
+{
+	uint32_t                          i;
+	uint32_t                          num_out = 0;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res_temp;
+
+	/* tfe out resource */
+	num_out = tfe_ctx->num_acq_tfe_out;
+	for (i = 0; i < num_out; i++) {
+		cam_tfe_hw_mgr_free_hw_res(&tfe_ctx->res_list_tfe_out[i],
+				false);
+		tfe_ctx->num_acq_tfe_out--;
+	}
+
+	/* tfe in resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&tfe_ctx->res_list_tfe_in, list) {
+		cam_tfe_hw_mgr_free_hw_res(hw_mgr_res, true);
+		cam_tfe_hw_mgr_put_res(&tfe_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* tfe csid resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&tfe_ctx->res_list_tfe_csid, list) {
+		cam_tfe_hw_mgr_free_hw_res(hw_mgr_res, true);
+		cam_tfe_hw_mgr_put_res(&tfe_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* clean up the callback function */
+	tfe_ctx->common.cb_priv = NULL;
+	tfe_ctx->common.event_cb = NULL;
+
+	CAM_DBG(CAM_ISP, "release context completed ctx id:%d",
+		tfe_ctx->ctx_index);
+
+	return 0;
+}
+
+
+static int cam_tfe_hw_mgr_put_ctx(
+	struct list_head                 *src_list,
+	struct cam_tfe_hw_mgr_ctx       **tfe_ctx)
+{
+	struct cam_tfe_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	ctx_ptr = *tfe_ctx;
+	if (ctx_ptr)
+		list_add_tail(&ctx_ptr->list, src_list);
+	*tfe_ctx = NULL;
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_get_ctx(
+	struct list_head                *src_list,
+	struct cam_tfe_hw_mgr_ctx       **tfe_ctx)
+{
+	int rc                              = 0;
+	struct cam_tfe_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	if (!list_empty(src_list)) {
+		ctx_ptr = list_first_entry(src_list,
+			struct cam_tfe_hw_mgr_ctx, list);
+		list_del_init(&ctx_ptr->list);
+	} else {
+		CAM_ERR(CAM_ISP, "No more free tfe hw mgr ctx");
+		rc = -EINVAL;
+	}
+	*tfe_ctx = ctx_ptr;
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+
+	return rc;
+}
+
+static void cam_tfe_hw_mgr_dump_all_ctx(void)
+{
+	uint32_t i;
+	struct cam_tfe_hw_mgr_ctx       *ctx;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	list_for_each_entry(ctx, &g_tfe_hw_mgr.used_ctx_list, list) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"ctx id:%d is_dual:%d num_base:%d rdi only:%d",
+			ctx->ctx_index, ctx->is_dual,
+			ctx->num_base, ctx->is_rdi_only_context);
+
+		list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid,
+			list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"csid:%d res_type:%d res_id:%d res_state:%d",
+					hw_mgr_res->hw_res[i]->hw_intf->hw_idx,
+					hw_mgr_res->hw_res[i]->res_type,
+					hw_mgr_res->hw_res[i]->res_id,
+					hw_mgr_res->hw_res[i]->res_state);
+			}
+		}
+
+		list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in,
+			list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"TFE IN:%d res_type:%d res_id:%d res_state:%d",
+					hw_mgr_res->hw_res[i]->hw_intf->hw_idx,
+					hw_mgr_res->hw_res[i]->res_type,
+					hw_mgr_res->hw_res[i]->res_id,
+					hw_mgr_res->hw_res[i]->res_state);
+			}
+		}
+	}
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+
+}
+
+static void cam_tfe_mgr_add_base_info(
+	struct cam_tfe_hw_mgr_ctx       *ctx,
+	enum cam_isp_hw_split_id         split_id,
+	uint32_t                         base_idx,
+	enum cam_isp_hw_type             hw_type)
+{
+	uint32_t    i;
+
+	if (!ctx->num_base) {
+		ctx->base[0].split_id = split_id;
+		ctx->base[0].idx      = base_idx;
+		ctx->base[0].hw_type  = hw_type;
+		ctx->num_base++;
+		CAM_DBG(CAM_ISP,
+			"Add split id = %d for base idx = %d num_base=%d hw_type=%d",
+			split_id, base_idx, ctx->num_base, hw_type);
+	} else {
+		/*Check if base index already exists in the list */
+		for (i = 0; i < ctx->num_base; i++) {
+			if (ctx->base[i].idx == base_idx) {
+				if (split_id != CAM_ISP_HW_SPLIT_MAX &&
+					ctx->base[i].split_id ==
+						CAM_ISP_HW_SPLIT_MAX)
+					ctx->base[i].split_id = split_id;
+
+				break;
+			}
+		}
+
+		if (i == ctx->num_base) {
+			ctx->base[ctx->num_base].split_id = split_id;
+			ctx->base[ctx->num_base].idx      = base_idx;
+			ctx->base[ctx->num_base].hw_type  = hw_type;
+			ctx->num_base++;
+			CAM_DBG(CAM_ISP,
+				"Add split_id=%d for base idx=%d num_base=%d hw_type=%d",
+				 split_id, base_idx, ctx->num_base, hw_type);
+		}
+	}
+}
+
+static int cam_tfe_mgr_process_base_info(
+	struct cam_tfe_hw_mgr_ctx        *ctx)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_resource_node     *res = NULL;
+	uint32_t i;
+
+	if (list_empty(&ctx->res_list_tfe_in)) {
+		CAM_ERR(CAM_ISP, "tfe in list empty");
+		return -ENODEV;
+	}
+
+	/* TFE in resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			cam_tfe_mgr_add_base_info(ctx, i,
+					res->hw_intf->hw_idx,
+					CAM_ISP_HW_TYPE_TFE);
+			CAM_DBG(CAM_ISP, "add base info for hw %d ctx_idx: %u",
+				res->hw_intf->hw_idx, ctx->ctx_index);
+		}
+	}
+	CAM_DBG(CAM_ISP, "ctx base num = %d, ctx_idx: %u", ctx->num_base, ctx->ctx_index);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_out_rdi(
+	struct cam_tfe_hw_mgr_ctx               *tfe_ctx,
+	struct cam_isp_hw_mgr_res               *tfe_in_res,
+	struct cam_isp_tfe_in_port_generic_info *in_port)
+{
+	int rc = -EINVAL;
+	struct cam_tfe_acquire_args               tfe_acquire;
+	struct cam_isp_tfe_out_port_generic_info *out_port = NULL;
+	struct cam_isp_hw_mgr_res                *tfe_out_res;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_tfe_hw_comp_record            *comp_grp = NULL;
+	uint32_t  i, tfe_out_res_id, tfe_in_res_id, index;
+
+	/* take left resource */
+	tfe_in_res_id = tfe_in_res->hw_res[0]->res_id;
+
+	switch (tfe_in_res_id) {
+	case CAM_ISP_HW_TFE_IN_RDI0:
+		tfe_out_res_id = CAM_ISP_TFE_OUT_RES_RDI_0;
+		break;
+	case CAM_ISP_HW_TFE_IN_RDI1:
+		tfe_out_res_id = CAM_ISP_TFE_OUT_RES_RDI_1;
+		break;
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		tfe_out_res_id = CAM_ISP_TFE_OUT_RES_RDI_2;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "invalid resource type");
+		goto err;
+	}
+	CAM_DBG(CAM_ISP, "ctx: %d tfe_in_res_id = %d, tfe_out_red_id = %d",
+		tfe_ctx->ctx_index, tfe_in_res_id, tfe_out_res_id);
+
+	tfe_acquire.rsrc_type = CAM_ISP_RESOURCE_TFE_OUT;
+	tfe_acquire.tasklet = tfe_ctx->common.tasklet_info;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+
+		CAM_DBG(CAM_ISP, "i = %d, ctx: %d tfe_out_res_id = %d, out_port: %d",
+			i, tfe_ctx->ctx_index, tfe_out_res_id, out_port->res_id);
+
+		if (tfe_out_res_id != out_port->res_id)
+			continue;
+
+		tfe_acquire.tfe_out.cdm_ops = tfe_ctx->cdm_ops;
+		tfe_acquire.priv = tfe_ctx;
+		tfe_acquire.tfe_out.out_port_info = out_port;
+		tfe_acquire.tfe_out.split_id = CAM_ISP_HW_SPLIT_LEFT;
+		tfe_acquire.tfe_out.unique_id = tfe_ctx->ctx_index;
+		tfe_acquire.tfe_out.is_dual = 0;
+		tfe_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+		hw_intf = tfe_in_res->hw_res[0]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&tfe_acquire,
+			sizeof(struct cam_tfe_acquire_args));
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not acquire out resource 0x%x",
+				 out_port->res_id);
+			goto err;
+		}
+
+		index = tfe_acquire.tfe_out.comp_grp_id;
+		comp_grp = &tfe_ctx->tfe_bus_comp_grp[index];
+		comp_grp->res_id[comp_grp->num_res] = tfe_out_res_id;
+		comp_grp->num_res++;
+		break;
+	}
+
+	if (i == in_port->num_out_res) {
+		CAM_ERR(CAM_ISP,
+			"Cannot acquire out resource, i=%d, num_out_res=%d",
+			i, in_port->num_out_res);
+		goto err;
+	}
+
+	tfe_ctx->tfe_out_map[tfe_out_res_id & 0xFF] = tfe_ctx->num_acq_tfe_out;
+	tfe_out_res = &tfe_ctx->res_list_tfe_out[tfe_ctx->num_acq_tfe_out];
+	tfe_out_res->hw_res[0] = tfe_acquire.tfe_out.rsrc_node;
+	tfe_out_res->is_dual_isp = 0;
+	tfe_out_res->res_id = tfe_out_res_id;
+	tfe_out_res->res_type = CAM_ISP_RESOURCE_TFE_OUT;
+	tfe_in_res->num_children++;
+	tfe_ctx->acquired_wm_mask |= (1 << out_port->res_id);
+	tfe_ctx->num_acq_tfe_out++;
+
+	return 0;
+err:
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_out_pixel(
+	struct cam_tfe_hw_mgr_ctx               *tfe_ctx,
+	struct cam_isp_hw_mgr_res               *tfe_in_res,
+	struct cam_isp_tfe_in_port_generic_info *in_port)
+{
+	int rc = -EINVAL;
+	uint32_t  i, j, k;
+	struct cam_tfe_acquire_args               tfe_acquire;
+	struct cam_isp_tfe_out_port_generic_info *out_port;
+	struct cam_isp_hw_mgr_res                *tfe_out_res;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_tfe_hw_comp_record            *comp_grp = NULL;
+	uint32_t                                  index;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		k = out_port->res_id & 0xFF;
+		if (k >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_ERR(CAM_ISP, "invalid output resource type 0x%x",
+				 out_port->res_id);
+			continue;
+		}
+
+		if (cam_tfe_hw_mgr_is_rdi_res(out_port->res_id))
+			continue;
+
+		if (!cam_tfe_hw_mgr_check_path_port_compat(tfe_in_res->res_id,
+			out_port->res_id))
+			continue;
+
+		CAM_DBG(CAM_ISP, "res_type 0x%x", out_port->res_id);
+
+		tfe_ctx->tfe_out_map[k] = tfe_ctx->num_acq_tfe_out;
+		tfe_out_res = &tfe_ctx->res_list_tfe_out[tfe_ctx->num_acq_tfe_out];
+		tfe_out_res->is_dual_isp = in_port->usage_type;
+
+		tfe_acquire.rsrc_type = CAM_ISP_RESOURCE_TFE_OUT;
+		tfe_acquire.tasklet = tfe_ctx->common.tasklet_info;
+		tfe_acquire.tfe_out.cdm_ops = tfe_ctx->cdm_ops;
+		tfe_acquire.priv = tfe_ctx;
+		tfe_acquire.tfe_out.out_port_info =  out_port;
+		tfe_acquire.tfe_out.is_dual       = tfe_in_res->is_dual_isp;
+		tfe_acquire.tfe_out.unique_id     = tfe_ctx->ctx_index;
+		tfe_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!tfe_in_res->hw_res[j])
+				continue;
+
+			hw_intf = tfe_in_res->hw_res[j]->hw_intf;
+
+			if (j == CAM_ISP_HW_SPLIT_LEFT) {
+				tfe_acquire.tfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_LEFT;
+				if (tfe_in_res->is_dual_isp)
+					tfe_acquire.tfe_out.is_master   = 1;
+				else
+					tfe_acquire.tfe_out.is_master   = 0;
+			} else {
+				tfe_acquire.tfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_RIGHT;
+				tfe_acquire.tfe_out.is_master       = 0;
+			}
+
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&tfe_acquire,
+				sizeof(struct cam_tfe_acquire_args));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire out resource 0x%x",
+					out_port->res_id);
+				goto err;
+			}
+
+			tfe_out_res->hw_res[j] =
+				tfe_acquire.tfe_out.rsrc_node;
+
+			index = tfe_acquire.tfe_out.comp_grp_id;
+			comp_grp = &tfe_ctx->tfe_bus_comp_grp[index];
+			comp_grp->res_id[comp_grp->num_res] =
+				tfe_out_res->hw_res[j]->res_id;
+			comp_grp->num_res++;
+
+			CAM_DBG(CAM_ISP, "resource type :0x%x res id:0x%x comp grp id:%d",
+				tfe_out_res->hw_res[j]->res_type,
+				tfe_out_res->hw_res[j]->res_id,
+				tfe_acquire.tfe_out.comp_grp_id);
+
+		}
+		tfe_out_res->res_type = CAM_ISP_RESOURCE_TFE_OUT;
+		tfe_out_res->res_id = out_port->res_id;
+		tfe_in_res->num_children++;
+		tfe_ctx->acquired_wm_mask |= (1 << out_port->res_id);
+		tfe_ctx->num_acq_tfe_out++;
+	}
+
+	return 0;
+err:
+	/* release resource at the entry function */
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_out(
+	struct cam_tfe_hw_mgr_ctx               *tfe_ctx,
+	struct cam_isp_tfe_in_port_generic_info *in_port)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res       *tfe_in_res;
+
+	list_for_each_entry(tfe_in_res, &tfe_ctx->res_list_tfe_in, list) {
+		if (tfe_in_res->num_children)
+			continue;
+
+		switch (tfe_in_res->res_id) {
+		case CAM_ISP_HW_TFE_IN_CAMIF:
+		case CAM_ISP_HW_TFE_IN_PDLIB:
+			rc = cam_tfe_hw_mgr_acquire_res_tfe_out_pixel(tfe_ctx,
+				tfe_in_res, in_port);
+			break;
+		case CAM_ISP_HW_TFE_IN_RDI0:
+		case CAM_ISP_HW_TFE_IN_RDI1:
+		case CAM_ISP_HW_TFE_IN_RDI2:
+			rc = cam_tfe_hw_mgr_acquire_res_tfe_out_rdi(tfe_ctx,
+				tfe_in_res, in_port);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unknown TFE SRC resource: %d",
+				tfe_in_res->res_id);
+			break;
+		}
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+err:
+	/* release resource on entry function */
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_in(
+	struct cam_tfe_hw_mgr_ctx               *tfe_ctx,
+	struct cam_isp_tfe_in_port_generic_info *in_port,
+	uint32_t                          *pdaf_enable,
+	bool                              lcr_enable)
+{
+	int rc                = -EINVAL;
+	int i;
+	struct cam_isp_hw_mgr_res                  *csid_res;
+	struct cam_isp_hw_mgr_res                  *tfe_src_res;
+	struct cam_tfe_acquire_args                 tfe_acquire;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_tfe_hw_mgr                      *tfe_hw_mgr;
+
+	tfe_hw_mgr = tfe_ctx->hw_mgr;
+
+	list_for_each_entry(csid_res, &tfe_ctx->res_list_tfe_csid, list) {
+		if (csid_res->num_children)
+			continue;
+
+		rc = cam_tfe_hw_mgr_get_res(&tfe_ctx->free_res_list,
+			&tfe_src_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+			goto err;
+		}
+		cam_tfe_hw_mgr_put_res(&tfe_ctx->res_list_tfe_in,
+			&tfe_src_res);
+		tfe_src_res->hw_res[0] = NULL;
+		tfe_src_res->hw_res[1] = NULL;
+
+		tfe_acquire.rsrc_type = CAM_ISP_RESOURCE_TFE_IN;
+		tfe_acquire.tasklet = tfe_ctx->common.tasklet_info;
+		tfe_acquire.tfe_in.cdm_ops = tfe_ctx->cdm_ops;
+		tfe_acquire.tfe_in.in_port = in_port;
+		tfe_acquire.tfe_in.camif_pd_enable = *pdaf_enable;
+		tfe_acquire.priv = tfe_ctx;
+		tfe_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+		tfe_acquire.tfe_in.lcr_enable = lcr_enable;
+
+		switch (csid_res->res_id) {
+		case CAM_TFE_CSID_PATH_RES_IPP:
+			tfe_acquire.tfe_in.res_id =
+				CAM_ISP_HW_TFE_IN_CAMIF;
+
+			if (csid_res->is_dual_isp)
+				tfe_acquire.tfe_in.sync_mode =
+				CAM_ISP_HW_SYNC_MASTER;
+			else
+				tfe_acquire.tfe_in.sync_mode =
+				CAM_ISP_HW_SYNC_NONE;
+
+			break;
+		case CAM_TFE_CSID_PATH_RES_PPP:
+			tfe_acquire.tfe_in.res_id =
+				CAM_ISP_HW_TFE_IN_PDLIB;
+
+			if (csid_res->is_dual_isp)
+				tfe_acquire.tfe_in.sync_mode =
+					CAM_ISP_HW_SYNC_MASTER;
+			else
+				tfe_acquire.tfe_in.sync_mode =
+					CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_TFE_CSID_PATH_RES_RDI_0:
+			tfe_acquire.tfe_in.res_id = CAM_ISP_HW_TFE_IN_RDI0;
+			tfe_acquire.tfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_TFE_CSID_PATH_RES_RDI_1:
+			tfe_acquire.tfe_in.res_id = CAM_ISP_HW_TFE_IN_RDI1;
+			tfe_acquire.tfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_TFE_CSID_PATH_RES_RDI_2:
+			tfe_acquire.tfe_in.res_id = CAM_ISP_HW_TFE_IN_RDI2;
+			tfe_acquire.tfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Wrong TFE CSID Resource Node");
+			goto err;
+		}
+		tfe_src_res->res_type = tfe_acquire.rsrc_type;
+		tfe_src_res->res_id = tfe_acquire.tfe_in.res_id;
+		tfe_src_res->is_dual_isp = csid_res->is_dual_isp;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!csid_res->hw_res[i])
+				continue;
+
+			hw_intf = tfe_hw_mgr->tfe_devices[
+				csid_res->hw_res[i]->hw_intf->hw_idx]->hw_intf;
+
+			/* fill in more acquire information as needed */
+			/* slave Camif resource, */
+			if (i == CAM_ISP_HW_SPLIT_RIGHT &&
+				tfe_src_res->is_dual_isp) {
+				tfe_acquire.tfe_in.sync_mode =
+				CAM_ISP_HW_SYNC_SLAVE;
+				tfe_acquire.tfe_in.dual_tfe_sync_sel_idx =
+					csid_res->hw_res[0]->hw_intf->hw_idx;
+			} else if (i == CAM_ISP_HW_SPLIT_LEFT &&
+				tfe_src_res->is_dual_isp)
+				tfe_acquire.tfe_in.dual_tfe_sync_sel_idx =
+					csid_res->hw_res[1]->hw_intf->hw_idx;
+
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&tfe_acquire,
+					sizeof(struct cam_tfe_acquire_args));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire TFE HW res %d",
+					csid_res->res_id);
+				goto err;
+			}
+			tfe_src_res->hw_res[i] = tfe_acquire.tfe_in.rsrc_node;
+			CAM_DBG(CAM_ISP,
+				"acquire success TFE:%d  res type :0x%x res id:0x%x",
+				hw_intf->hw_idx,
+				tfe_src_res->hw_res[i]->res_type,
+				tfe_src_res->hw_res[i]->res_id);
+
+		}
+		csid_res->num_children++;
+	}
+
+	return 0;
+err:
+	/* release resource at the entry function */
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_csid_pxl(
+	struct cam_tfe_hw_mgr_ctx               *tfe_ctx,
+	struct cam_isp_tfe_in_port_generic_info *in_port,
+	bool                                is_ipp,
+	bool                                crop_enable)
+{
+	int rc = -EINVAL;
+	int i, j;
+	uint32_t acquired_cnt = 0;
+	struct cam_tfe_hw_mgr                        *tfe_hw_mgr;
+	struct cam_isp_hw_mgr_res                    *csid_res;
+	struct cam_hw_intf                           *hw_intf;
+	struct cam_tfe_csid_hw_reserve_resource_args  csid_acquire = {0};
+	enum cam_tfe_csid_path_res_id                 path_res_id;
+	struct cam_isp_hw_mgr_res        *csid_res_temp, *csid_res_iterator;
+	struct cam_isp_tfe_out_port_generic_info     *out_port = NULL;
+
+	tfe_hw_mgr = tfe_ctx->hw_mgr;
+	/* get csid resource */
+	if (is_ipp)
+		path_res_id = CAM_TFE_CSID_PATH_RES_IPP;
+	else
+		path_res_id = CAM_TFE_CSID_PATH_RES_PPP;
+
+	rc = cam_tfe_hw_mgr_get_res(&tfe_ctx->free_res_list, &csid_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+		goto end;
+	}
+
+	csid_res_temp = csid_res;
+
+	csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	csid_acquire.res_id = path_res_id;
+	csid_acquire.in_port = in_port;
+	csid_acquire.out_port = in_port->data;
+	csid_acquire.node_res = NULL;
+	csid_acquire.event_cb_prv = tfe_ctx;
+	csid_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+	csid_acquire.crop_enable = crop_enable;
+	if (in_port->num_out_res)
+		out_port = &(in_port->data[0]);
+
+	if (in_port->usage_type)
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_MASTER;
+	else
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+	/* Try acquiring CSID resource from previously acquired HW */
+	list_for_each_entry(csid_res_iterator, &tfe_ctx->res_list_tfe_csid,
+		list) {
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!csid_res_iterator->hw_res[i])
+				continue;
+
+			if (csid_res_iterator->is_secure == 1 ||
+				(csid_res_iterator->is_secure == 0 &&
+				in_port->num_out_res &&
+				out_port->secure_mode == 1))
+				continue;
+
+			csid_acquire.sync_mode = ((i == CAM_ISP_HW_SPLIT_LEFT) ?
+				CAM_ISP_HW_SYNC_MASTER : CAM_ISP_HW_SYNC_SLAVE);
+
+			hw_intf = csid_res_iterator->hw_res[i]->hw_intf;
+			csid_acquire.master_idx = hw_intf->hw_idx;
+
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+			if (rc) {
+				CAM_DBG(CAM_ISP,
+					"No tfe csid resource from hw %d",
+					hw_intf->hw_idx);
+				continue;
+			}
+
+			csid_res_temp->hw_res[acquired_cnt++] =
+				csid_acquire.node_res;
+
+			CAM_DBG(CAM_ISP,
+				"acquired from old csid(%s)=%d CSID rsrc %s successfully",
+				(i == 0) ? "left" : "right",
+				hw_intf->hw_idx,
+				(is_ipp) ? "IPP" : "PPP");
+
+			if (in_port->usage_type && acquired_cnt == 1 &&
+				((path_res_id == CAM_TFE_CSID_PATH_RES_IPP) ||
+				(path_res_id == CAM_TFE_CSID_PATH_RES_PPP)))
+				/*
+				 * Continue to acquire Right for IPP.
+				 * Dual TFE for RDI is not currently
+				 * supported.
+				 */
+				continue;
+
+			if (acquired_cnt)
+				/*
+				 * If successfully acquired CSID from
+				 * previously acquired HW, skip the next
+				 * part
+				 */
+				goto acquire_successful;
+		}
+	}
+
+	/*
+	 * If successfully acquired CSID from
+	 * previously acquired HW, skip the next
+	 * part
+	 */
+	if (acquired_cnt)
+		goto acquire_successful;
+
+	/* Acquire Left if not already acquired */
+	if (in_port->usage_type || in_port->is_shdr_master) {
+		for (i = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+			if (!tfe_hw_mgr->csid_devices[i])
+				continue;
+
+			hw_intf = tfe_hw_mgr->csid_devices[i];
+			csid_acquire.master_idx = hw_intf->hw_idx;
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+			if (rc)
+				continue;
+			else {
+				csid_res_temp->hw_res[acquired_cnt++] =
+					csid_acquire.node_res;
+				break;
+			}
+		}
+
+		if (i == CAM_TFE_CSID_HW_NUM_MAX || !csid_acquire.node_res) {
+			CAM_ERR(CAM_ISP,
+				"Can not acquire left tfe csid path resource %d (%s)",
+				path_res_id,
+				(is_ipp) ? "IPP" : "PPP");
+			goto put_res;
+		}
+	} else {
+		for (i = (CAM_TFE_CSID_HW_NUM_MAX - 1); i >= 0; i--) {
+			if (!tfe_hw_mgr->csid_devices[i])
+				continue;
+
+			hw_intf = tfe_hw_mgr->csid_devices[i];
+			csid_acquire.master_idx = hw_intf->hw_idx;
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+			if (rc)
+				continue;
+			else {
+				csid_res_temp->hw_res[acquired_cnt++] =
+					csid_acquire.node_res;
+				break;
+			}
+		}
+
+		if (i == -1 || !csid_acquire.node_res) {
+			CAM_ERR(CAM_ISP,
+				"Can not acquire tfe csid path resource %d(%s)",
+				path_res_id,
+				(is_ipp) ? "IPP" : "PPP");
+			goto put_res;
+		}
+	}
+acquire_successful:
+	CAM_DBG(CAM_ISP, "CSID path left acquired success. is_dual %d res %s",
+		in_port->usage_type,
+		(is_ipp) ? "IPP" : "PPP");
+
+	csid_res_temp->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	csid_res_temp->res_id = path_res_id;
+
+	if (in_port->usage_type) {
+		csid_res_temp->is_dual_isp = 1;
+		tfe_ctx->is_dual = true;
+		tfe_ctx->master_hw_idx =
+			csid_res_temp->hw_res[0]->hw_intf->hw_idx;
+	} else
+		csid_res_temp->is_dual_isp = 0;
+
+	if (in_port->num_out_res)
+		csid_res_temp->is_secure = out_port->secure_mode;
+
+	cam_tfe_hw_mgr_put_res(&tfe_ctx->res_list_tfe_csid, &csid_res);
+
+	/*
+	 * Acquire Right if not already acquired.
+	 * Dual TFE for RDI is not currently supported.
+	 */
+	if (in_port->usage_type && ((path_res_id == CAM_TFE_CSID_PATH_RES_IPP)
+		|| (path_res_id == CAM_TFE_CSID_PATH_RES_PPP))
+		&& (acquired_cnt == 1)) {
+		memset(&csid_acquire, 0, sizeof(csid_acquire));
+		csid_acquire.node_res = NULL;
+		csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_acquire.res_id = path_res_id;
+		csid_acquire.in_port = in_port;
+		csid_acquire.master_idx =
+			csid_res_temp->hw_res[0]->hw_intf->hw_idx;
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_SLAVE;
+		csid_acquire.node_res = NULL;
+		csid_acquire.out_port = in_port->data;
+		csid_acquire.crop_enable = crop_enable;
+		csid_acquire.event_cb_prv = tfe_ctx;
+		csid_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+
+		for (j = 0; j < CAM_TFE_CSID_HW_NUM_MAX; j++) {
+			if (!tfe_hw_mgr->csid_devices[j])
+				continue;
+
+			if (j == csid_res_temp->hw_res[0]->hw_intf->hw_idx)
+				continue;
+
+			hw_intf = tfe_hw_mgr->csid_devices[j];
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+			if (rc)
+				continue;
+			else
+				break;
+		}
+
+		if (j == CAM_TFE_CSID_HW_NUM_MAX) {
+			CAM_ERR(CAM_ISP,
+				"Can not acquire tfe csid pixel resource %s",
+				(is_ipp) ? "IPP" : "PPP");
+			goto end;
+		}
+		csid_res_temp->hw_res[1] = csid_acquire.node_res;
+		tfe_ctx->slave_hw_idx =
+			csid_res_temp->hw_res[1]->hw_intf->hw_idx;
+		CAM_DBG(CAM_ISP, "CSID right acquired success is_dual %d res %s",
+			in_port->usage_type,
+			(is_ipp) ? "IPP" : "PPP");
+	}
+
+	return 0;
+put_res:
+	cam_tfe_hw_mgr_put_res(&tfe_ctx->free_res_list, &csid_res);
+end:
+	return rc;
+}
+
+static enum cam_tfe_csid_path_res_id
+	cam_tfe_hw_mgr_get_tfe_csid_rdi_res_type(
+	uint32_t                 out_port_type)
+{
+	enum cam_tfe_csid_path_res_id path_id;
+
+	CAM_DBG(CAM_ISP, "out_port_type %x", out_port_type);
+	switch (out_port_type) {
+	case CAM_ISP_TFE_OUT_RES_RDI_0:
+		path_id = CAM_TFE_CSID_PATH_RES_RDI_0;
+		break;
+	case CAM_ISP_TFE_OUT_RES_RDI_1:
+		path_id = CAM_TFE_CSID_PATH_RES_RDI_1;
+		break;
+	case CAM_ISP_TFE_OUT_RES_RDI_2:
+		path_id = CAM_TFE_CSID_PATH_RES_RDI_2;
+		break;
+	default:
+		path_id = CAM_TFE_CSID_PATH_RES_MAX;
+		CAM_DBG(CAM_ISP, "maximum rdi type exceeded out_port_type:%d ",
+			out_port_type);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "out_port %x path_id %d", out_port_type, path_id);
+
+	return path_id;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_csid_rdi(
+	struct cam_tfe_hw_mgr_ctx               *tfe_ctx,
+	struct cam_isp_tfe_in_port_generic_info *in_port)
+{
+	int rc = -EINVAL;
+	int i, j;
+
+	struct cam_tfe_hw_mgr                       *tfe_hw_mgr;
+	struct cam_isp_hw_mgr_res                   *csid_res;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_isp_tfe_out_port_generic_info    *out_port;
+	struct cam_tfe_csid_hw_reserve_resource_args csid_acquire = {0};
+	struct cam_isp_hw_mgr_res                   *csid_res_iterator;
+	enum cam_tfe_csid_path_res_id                path_res_id;
+
+	tfe_hw_mgr = tfe_ctx->hw_mgr;
+
+	for (j = 0; j < in_port->num_out_res; j++) {
+		out_port = &in_port->data[j];
+		path_res_id = cam_tfe_hw_mgr_get_tfe_csid_rdi_res_type(
+			out_port->res_id);
+
+		if (path_res_id == CAM_TFE_CSID_PATH_RES_MAX)
+			continue;
+
+		rc = cam_tfe_hw_mgr_get_res(&tfe_ctx->free_res_list, &csid_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+			goto end;
+		}
+
+		memset(&csid_acquire, 0, sizeof(csid_acquire));
+		csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_acquire.res_id = path_res_id;
+		csid_acquire.in_port = in_port;
+		csid_acquire.out_port = out_port;
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+		csid_acquire.node_res = NULL;
+		csid_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+		csid_acquire.event_cb_prv = tfe_ctx;
+
+		/* Try acquiring CSID resource from previously acquired HW */
+		list_for_each_entry(csid_res_iterator,
+			&tfe_ctx->res_list_tfe_csid, list) {
+
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!csid_res_iterator->hw_res[i])
+					continue;
+
+				if (csid_res_iterator->is_secure == 1 ||
+					(csid_res_iterator->is_secure == 0 &&
+					in_port->num_out_res &&
+					out_port->secure_mode == 1))
+					continue;
+
+				hw_intf = csid_res_iterator->hw_res[i]->hw_intf;
+
+				if (tfe_hw_mgr->tfe_csid_dev_caps[hw_intf->hw_idx].is_lite
+					&& !tfe_ctx->is_rdi_only_context) {
+					CAM_DBG(CAM_ISP, "Ctx id %d CSID[%u] cannot use lite",
+						tfe_ctx->ctx_index, hw_intf->hw_idx);
+					continue;
+				}
+
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&csid_acquire, sizeof(csid_acquire));
+				if (rc) {
+					CAM_DBG(CAM_ISP,
+						"No tfe csid resource from hw %d",
+						hw_intf->hw_idx);
+					continue;
+				}
+
+				if (csid_acquire.node_res == NULL) {
+					CAM_ERR(CAM_ISP,
+						"Acquire RDI:%d rsrc failed",
+						path_res_id);
+					goto put_res;
+				}
+
+				csid_res->hw_res[0] = csid_acquire.node_res;
+
+				CAM_DBG(CAM_ISP,
+					"acquired from old csid(%s)=%d CSID rsrc successfully",
+					(i == 0) ? "left" : "right",
+					hw_intf->hw_idx);
+				/*
+				 * If successfully acquired CSID from
+				 * previously acquired HW, skip the next
+				 * part
+				 */
+				goto acquire_successful;
+			}
+		}
+
+		/* Acquire if not already acquired */
+		if (tfe_ctx->is_dual || in_port->is_shdr_master) {
+			for (i = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+				if (!tfe_hw_mgr->csid_devices[i])
+					continue;
+
+				hw_intf = tfe_hw_mgr->csid_devices[i];
+
+				if (tfe_hw_mgr->tfe_csid_dev_caps[hw_intf->hw_idx].is_lite &&
+					!tfe_ctx->is_rdi_only_context) {
+					CAM_DBG(CAM_ISP, "Ctx id %d CSID[%u] cannot use lite",
+						tfe_ctx->ctx_index, hw_intf->hw_idx);
+					continue;
+				}
+
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&csid_acquire, sizeof(csid_acquire));
+				if (rc)
+					continue;
+				else {
+					csid_res->hw_res[0] =
+						csid_acquire.node_res;
+					break;
+				}
+			}
+
+			if (i == CAM_TFE_CSID_HW_NUM_MAX ||
+				!csid_acquire.node_res) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire tfe csid rdi path%d",
+					path_res_id);
+
+				rc = -EINVAL;
+				goto put_res;
+			}
+		} else {
+			for (i = CAM_TFE_CSID_HW_NUM_MAX - 1; i >= 0; i--) {
+				if (!tfe_hw_mgr->csid_devices[i])
+					continue;
+
+				hw_intf = tfe_hw_mgr->csid_devices[i];
+
+				if (tfe_hw_mgr->tfe_csid_dev_caps[hw_intf->hw_idx].is_lite &&
+					!tfe_ctx->is_rdi_only_context) {
+					CAM_DBG(CAM_ISP, "Ctx id %d CSID[%u] cannot use lite",
+						tfe_ctx->ctx_index, hw_intf->hw_idx);
+					continue;
+				}
+
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&csid_acquire, sizeof(csid_acquire));
+				if (rc)
+					continue;
+				else {
+					csid_res->hw_res[0] =
+						csid_acquire.node_res;
+					break;
+				}
+			}
+
+			if (i == -1 || !csid_acquire.node_res) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire tfe csid rdi path %d",
+					path_res_id);
+
+				rc = -EINVAL;
+				goto put_res;
+			}
+		}
+
+acquire_successful:
+		CAM_DBG(CAM_ISP, "CSID path :%d acquired success", path_res_id);
+		csid_res->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_res->res_id = path_res_id;
+		csid_res->hw_res[1] = NULL;
+		csid_res->is_dual_isp = 0;
+
+		if (in_port->num_out_res)
+			csid_res->is_secure = out_port->secure_mode;
+
+		cam_tfe_hw_mgr_put_res(&tfe_ctx->res_list_tfe_csid, &csid_res);
+	}
+
+	return 0;
+put_res:
+	cam_tfe_hw_mgr_put_res(&tfe_ctx->free_res_list, &csid_res);
+end:
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_preprocess_port(
+	struct cam_tfe_hw_mgr_ctx               *tfe_ctx,
+	struct cam_isp_tfe_in_port_generic_info *in_port,
+	int                             *ipp_count,
+	int                             *rdi_count,
+	int                             *ppp_count,
+	int                             *pdaf_enable,
+	bool                            *lcr_enable)
+{
+	int ipp_num        = 0;
+	int rdi_num        = 0;
+	int pd_num         = 0;
+	bool rdi2_enable   = false;
+	uint32_t i;
+	struct cam_isp_tfe_out_port_generic_info *out_port;
+	struct cam_tfe_hw_mgr                    *tfe_hw_mgr;
+	struct cam_hw_intf                       *tfe_device;
+	bool pdaf_rdi2_mux_en = false;
+
+	tfe_hw_mgr = tfe_ctx->hw_mgr;
+	tfe_device = tfe_hw_mgr->tfe_devices[0]->hw_intf;
+
+	tfe_device->hw_ops.process_cmd(tfe_device->hw_priv,
+		CAM_ISP_HW_CMD_IS_PDAF_RDI2_MUX_EN,
+		&pdaf_rdi2_mux_en,
+		sizeof(pdaf_rdi2_mux_en));
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		CAM_DBG(CAM_ISP, "out_res id %d", out_port->res_id);
+
+		if (cam_tfe_hw_mgr_is_rdi_res(out_port->res_id)) {
+			rdi_num++;
+			if (out_port->res_id == CAM_ISP_TFE_OUT_RES_RDI_2)
+				rdi2_enable = true;
+		} else if (cam_tfe_hw_mgr_check_path_port_compat(CAM_ISP_HW_TFE_IN_PDLIB,
+					out_port->res_id)) {
+			pd_num++;
+
+			if (out_port->res_id == CAM_ISP_TFE_OUT_RES_PD_LCR_STATS)
+				*lcr_enable = true;
+		} else {
+			ipp_num++;
+			if (out_port->res_id == CAM_ISP_TFE_OUT_RES_PDAF)
+				*pdaf_enable = 1;
+		}
+	}
+
+	if (pdaf_rdi2_mux_en && *pdaf_enable && rdi2_enable) {
+		CAM_ERR(CAM_ISP,
+			"invalid outports both RDI2 and PDAF enabled");
+		return -EINVAL;
+	}
+
+	*ipp_count = ipp_num;
+	*rdi_count = rdi_num;
+	*ppp_count = pd_num;
+
+	CAM_DBG(CAM_ISP, "rdi: %d ipp: %d ppp: %d pdaf:%d", rdi_num, ipp_num,
+		*ppp_count, *pdaf_enable);
+
+	return 0;
+}
+
+static int cam_tfe_mgr_acquire_hw_for_ctx(
+	struct cam_tfe_hw_mgr_ctx               *tfe_ctx,
+	struct cam_isp_tfe_in_port_generic_info *in_port,
+	uint32_t *num_pix_port, uint32_t  *num_rdi_port,
+	uint32_t  *num_pd_port, uint32_t *pdaf_enable)
+{
+	int rc                                    = -EINVAL;
+	int is_dual_isp                           = 0;
+	int ipp_count                             = 0;
+	int rdi_count                             = 0;
+	int ppp_count                             = 0;
+	bool lcr_enable                           = false;
+	bool crop_enable                          = true;
+
+	is_dual_isp = in_port->usage_type;
+
+	cam_tfe_hw_mgr_preprocess_port(tfe_ctx, in_port, &ipp_count,
+		&rdi_count, &ppp_count, pdaf_enable, &lcr_enable);
+
+	if (!ipp_count && !rdi_count && !ppp_count) {
+		CAM_ERR(CAM_ISP,
+			"Invalid path count : Ipp %d ppp %d rdi %d",
+			ipp_count, ppp_count, rdi_count);
+		return -EINVAL;
+	}
+
+	if (ipp_count) {
+		/* get tfe csid IPP resource */
+		rc = cam_tfe_hw_mgr_acquire_res_tfe_csid_pxl(tfe_ctx,
+			in_port, true, crop_enable);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire TFE CSID IPP resource Failed dual:%d",
+				in_port->usage_type);
+			goto err;
+		}
+	}
+
+	if (ppp_count || lcr_enable) {
+		/* get ife csid PPP resource */
+		/* If both IPP and PPP paths are requested with the same vc dt
+		 * it is implied that the sensor is a type 3 PD sensor. Crop
+		 * must be enabled for this sensor on PPP path as well.
+		 */
+		if (!ipp_count)
+			crop_enable = false;
+
+		/* get tfe csid IPP resource */
+		rc = cam_tfe_hw_mgr_acquire_res_tfe_csid_pxl(tfe_ctx,
+				in_port, false, crop_enable);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire TFE CSID IPP resource Failed dual:%d",
+				in_port->usage_type);
+			goto err;
+		}
+	}
+
+	if (rdi_count) {
+		/* get tfe csid rdi resource */
+		rc = cam_tfe_hw_mgr_acquire_res_tfe_csid_rdi(tfe_ctx, in_port);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire TFE CSID RDI resource Failed dual:%d",
+				in_port->usage_type);
+			goto err;
+		}
+	}
+
+	rc = cam_tfe_hw_mgr_acquire_res_tfe_in(tfe_ctx, in_port, pdaf_enable, lcr_enable);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+		"Acquire TFE IN resource Failed dual:%d", in_port->usage_type);
+		goto err;
+	}
+
+	CAM_DBG(CAM_ISP, "Acquiring TFE OUT resource...");
+	rc = cam_tfe_hw_mgr_acquire_res_tfe_out(tfe_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire TFE OUT resource Failed dual:%d",
+			in_port->usage_type);
+		goto err;
+	}
+
+	*num_pix_port += ipp_count;
+	*num_rdi_port += rdi_count;
+	*num_pd_port  += ppp_count;
+
+	return 0;
+err:
+	/* release resource at the acquire entry funciton */
+	return rc;
+}
+
+void cam_tfe_cam_cdm_callback(uint32_t handle, void *userdata,
+	enum cam_cdm_cb_status status, void *cookie)
+{
+	struct cam_isp_prepare_hw_update_data *hw_update_data = NULL;
+	struct cam_tfe_hw_mgr_ctx *ctx = NULL;
+	uint32_t *buf_start, *buf_end;
+	int i, rc = 0;
+	size_t len = 0;
+	uint32_t *buf_addr;
+
+	if (!userdata) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)userdata;
+	hw_update_data = ctx->cdm_userdata.hw_update_data;
+
+	if (status == CAM_CDM_CB_STATUS_BL_SUCCESS) {
+		complete_all(&ctx->config_done_complete);
+		atomic_set(&ctx->cdm_done, 1);
+		ctx->last_cdm_done_req = *(uint64_t *)cookie;
+		if (g_tfe_hw_mgr.debug_cfg.per_req_reg_dump) {
+			if (ctx->cdm_userdata.request_id == *(uint64_t *)cookie) {
+				cam_tfe_mgr_handle_reg_dump(ctx,
+					hw_update_data->reg_dump_buf_desc,
+					hw_update_data->num_reg_dump_buf,
+					CAM_ISP_TFE_PACKET_META_REG_DUMP_PER_REQUEST,
+					NULL, false);
+			} else {
+				CAM_INFO(CAM_ISP, "CDM delay, Skip dump req: %llu, cdm_req: %llu",
+					*(uint64_t *)cookie, ctx->cdm_userdata.request_id);
+			}
+		}
+		CAM_DBG(CAM_ISP,
+			"CDM hdl=%x, udata=%pK, status=%d, cookie=%llu ctx_index=%d cdm_req=%llu",
+			 handle, userdata, status, *(uint64_t *)cookie, ctx->ctx_index,
+			 ctx->cdm_userdata.request_id);
+	} else if (status == CAM_CDM_CB_STATUS_PAGEFAULT ||
+		status == CAM_CDM_CB_STATUS_INVALID_BL_CMD ||
+		status == CAM_CDM_CB_STATUS_HW_ERROR) {
+		CAM_INFO(CAM_ISP,
+			"req_id =%d ctx_id =%d Bl_cmd_count =%d status=%d",
+			ctx->applied_req_id, ctx->ctx_index,
+			ctx->last_submit_bl_cmd.bl_count, status);
+
+		for (i = 0; i < ctx->last_submit_bl_cmd.bl_count; i++) {
+			CAM_INFO(CAM_ISP,
+				"BL(%d) hdl=0x%x addr=0x%x len=%d input_len =%d offset=0x%x type=%d",
+				i, ctx->last_submit_bl_cmd.cmd[i].mem_handle,
+				ctx->last_submit_bl_cmd.cmd[i].hw_addr,
+				ctx->last_submit_bl_cmd.cmd[i].len,
+				ctx->last_submit_bl_cmd.cmd[i].input_len,
+				ctx->last_submit_bl_cmd.cmd[i].offset,
+				ctx->last_submit_bl_cmd.cmd[i].type);
+
+			rc = cam_packet_util_get_cmd_mem_addr(
+				ctx->last_submit_bl_cmd.cmd[i].mem_handle,
+				&buf_addr, &len);
+
+			buf_start = (uint32_t *)((uint8_t *) buf_addr +
+				ctx->last_submit_bl_cmd.cmd[i].offset);
+			buf_end = (uint32_t *)((uint8_t *) buf_start +
+				ctx->last_submit_bl_cmd.cmd[i].input_len - 1);
+
+			cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
+			cam_mem_put_cpu_buf(ctx->last_submit_bl_cmd.cmd[i].mem_handle);
+		}
+		if (ctx->packet != NULL)
+			cam_packet_util_dump_patch_info(ctx->packet,
+				g_tfe_hw_mgr.mgr_common.img_iommu_hdl,
+				g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure,
+				NULL);
+
+	} else {
+		CAM_WARN(CAM_ISP,
+			"CDM hdl=%x, udata=%pK, status=%d, cookie=%llu cdm_req=%llu",
+			 handle, userdata, status, *(uint64_t *)cookie,
+			 ctx->cdm_userdata.request_id);
+	}
+}
+
+static int cam_tfe_mgr_acquire_get_unified_structure_v1(
+	struct cam_isp_tfe_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_tfe_in_port_generic_info *in_port)
+{
+	struct cam_isp_tfe_in_port_info *in = NULL;
+	uint32_t in_port_length = 0;
+	int32_t rc = 0, i;
+
+	in = (struct cam_isp_tfe_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset + *input_size);
+
+	in_port_length = sizeof(struct cam_isp_tfe_in_port_info) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_isp_tfe_out_port_info);
+
+	*input_size += in_port_length;
+
+	if (!in_port || ((*input_size) > acquire_hw_info->input_info_size)) {
+		CAM_ERR(CAM_ISP, "Input is not proper");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	in_port->major_ver       =
+		(acquire_hw_info->input_info_version >> 16) & 0xFFFF;
+	in_port->minor_ver       =
+		acquire_hw_info->input_info_version & 0xFFFF;
+	in_port->res_id          =  in->res_id;
+	in_port->lane_type       =  in->lane_type;
+	in_port->lane_num        =  in->lane_num;
+	in_port->lane_cfg        =  in->lane_cfg;
+	in_port->vc[0]           =  in->vc;
+	in_port->dt[0]           =  in->dt;
+	in_port->num_valid_vc_dt = 1;
+	in_port->format          =  in->format;
+	in_port->pix_pattern     =  in->pix_pattern;
+	in_port->usage_type      =  in->usage_type;
+	in_port->left_start      =  in->left_start;
+	in_port->left_end        =  in->left_end;
+	in_port->left_width      =  in->left_width;
+	in_port->right_start     =  in->right_start;
+	in_port->right_end       =  in->right_end;
+	in_port->right_width     =  in->right_width;
+	in_port->line_start      =  in->line_start;
+	in_port->line_end        =  in->line_end;
+	in_port->height          =  in->height;
+	in_port->batch_size      =  in->batch_size;
+	in_port->dsp_mode        =  in->dsp_mode;
+	in_port->sensor_width    =  in->sensor_width;
+	in_port->sensor_height   =  in->sensor_height;
+	in_port->sensor_hbi      =  in->sensor_hbi;
+	in_port->sensor_vbi      =  in->sensor_vbi;
+	in_port->sensor_fps      =  in->sensor_fps;
+	in_port->init_frame_drop =  in->init_frame_drop;
+	in_port->num_out_res     =  in->num_out_res;
+
+	in_port->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_tfe_out_port_generic_info),
+		GFP_KERNEL);
+
+	if (in_port->data == NULL) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < in->num_out_res; i++) {
+		in_port->data[i].res_id       = in->data_flex[i].res_id;
+		in_port->data[i].format       = in->data_flex[i].format;
+		in_port->data[i].width        = in->data_flex[i].width;
+		in_port->data[i].height       = in->data_flex[i].height;
+		in_port->data[i].stride       = in->data_flex[i].stride;
+		in_port->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		in_port->data[i].secure_mode  = in->data_flex[i].secure_mode;
+		in_port->data[i].wm_mode      = in->data_flex[i].wm_mode;
+		in_port->data[i].reserved     = in->data_flex[i].reserved;
+	}
+
+	return 0;
+err:
+	return rc;
+}
+
+static int cam_tfe_mgr_acquire_get_unified_structure_v2(
+	struct cam_isp_tfe_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_tfe_in_port_generic_info *in_port)
+{
+	struct cam_isp_tfe_in_port_info_v2 *in = NULL;
+	uint32_t in_port_length = 0;
+	int32_t rc = 0, i;
+
+	in = (struct cam_isp_tfe_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset + *input_size);
+
+	in_port_length = sizeof(struct cam_isp_tfe_in_port_info_v2) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_isp_tfe_out_port_info);
+
+	*input_size += in_port_length;
+
+	if (!in_port || ((*input_size) > acquire_hw_info->input_info_size)) {
+		CAM_ERR(CAM_ISP, "Input is not proper");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	in_port->major_ver       =
+		(acquire_hw_info->input_info_version >> 16) & 0xFFFF;
+	in_port->minor_ver       =
+		acquire_hw_info->input_info_version & 0xFFFF;
+	in_port->res_id          =  in->res_id;
+	in_port->lane_type       =  in->lane_type;
+	in_port->lane_num        =  in->lane_num;
+	in_port->lane_cfg        =  in->lane_cfg;
+	in_port->num_valid_vc_dt =  in->num_valid_vc_dt;
+
+	if (in_port->num_valid_vc_dt == 0) {
+		CAM_ERR(CAM_ISP, "Invalid i/p arg invalid vc-dt: %d",
+			in->num_valid_vc_dt);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	for (i = 0; i < in_port->num_valid_vc_dt; i++) {
+		in_port->vc[i]        =  in->vc[i];
+		in_port->dt[i]        =  in->dt[i];
+	}
+
+	in_port->format          =  in->format;
+	in_port->pix_pattern     =  in->pix_pattern;
+	in_port->usage_type      =  in->usage_type;
+	in_port->left_start      =  in->left_start;
+	in_port->left_end        =  in->left_end;
+	in_port->left_width      =  in->left_width;
+	in_port->right_start     =  in->right_start;
+	in_port->right_end       =  in->right_end;
+	in_port->right_width     =  in->right_width;
+	in_port->line_start      =  in->line_start;
+	in_port->line_end        =  in->line_end;
+	in_port->height          =  in->height;
+	in_port->batch_size      =  in->batch_size;
+	in_port->dsp_mode        =  in->dsp_mode;
+	in_port->sensor_width    =  in->sensor_width;
+	in_port->sensor_height   =  in->sensor_height;
+	in_port->sensor_hbi      =  in->sensor_hbi;
+	in_port->sensor_vbi      =  in->sensor_vbi;
+	in_port->sensor_fps      =  in->sensor_fps;
+	in_port->init_frame_drop =  in->init_frame_drop;
+	in_port->bayer_bin       =  in->feature_flag &
+					CAM_ISP_TFE_FLAG_BAYER_BIN;
+	in_port->qcfa_bin        =  in->feature_flag &
+					CAM_ISP_TFE_FLAG_QCFA_BIN;
+	in_port->shdr_en         =  in->feature_flag &
+					CAM_ISP_TFE_FLAG_SHDR_MASTER_EN;
+	in_port->shdr_en        |=  in->feature_flag &
+					CAM_ISP_TFE_FLAG_SHDR_SLAVE_EN;
+	in_port->is_shdr_master  =  in->feature_flag &
+					CAM_ISP_TFE_FLAG_SHDR_MASTER_EN;
+	in_port->epd_supported  =  in->feature_flag &
+					CAM_ISP_TFE_FLAG_EPD_SUPPORT;
+
+
+	if (in_port->bayer_bin && in_port->qcfa_bin) {
+		CAM_ERR(CAM_ISP,
+			"Bayer and QCFA binning not supported together!");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	in_port->core_cfg        =  in->core_cfg;
+	in_port->num_out_res     =  in->num_out_res;
+
+	in_port->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_tfe_out_port_generic_info),
+		GFP_KERNEL);
+
+	if (in_port->data == NULL) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < in->num_out_res; i++) {
+		in_port->data[i].res_id       = in->data_flex[i].res_id;
+		in_port->data[i].format       = in->data_flex[i].format;
+		in_port->data[i].width        = in->data_flex[i].width;
+		in_port->data[i].height       = in->data_flex[i].height;
+		in_port->data[i].stride       = in->data_flex[i].stride;
+		in_port->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		in_port->data[i].secure_mode  = in->data_flex[i].secure_mode;
+		in_port->data[i].wm_mode      = in->data_flex[i].wm_mode;
+		in_port->data[i].reserved     = in->data_flex[i].reserved;
+	}
+
+	return 0;
+err:
+	return rc;
+}
+static int cam_tfe_mgr_acquire_get_unified_structure(
+	struct cam_isp_tfe_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_tfe_in_port_generic_info *in_port)
+{
+	uint32_t major_ver = 0, minor_ver = 0;
+
+	if (acquire_hw_info == NULL || input_size == NULL)
+		return -EINVAL;
+
+	major_ver = (acquire_hw_info->common_info_version >> 12) & 0xF;
+	minor_ver = (acquire_hw_info->common_info_version) & 0xFFF;
+
+	switch (major_ver) {
+	case 1:
+		return cam_tfe_mgr_acquire_get_unified_structure_v1(
+			acquire_hw_info, offset, input_size, in_port);
+	case 2:
+		return cam_tfe_mgr_acquire_get_unified_structure_v2(
+			acquire_hw_info, offset, input_size, in_port);
+	default:
+		CAM_ERR(CAM_ISP, "Invalid ver of i/p port info from user");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int cam_tfe_hw_mgr_csiphy_clk_sync(
+	struct cam_tfe_hw_mgr_ctx *ctx, void *cmd_args)
+{
+	int                          rc = -EINVAL;
+	unsigned long                phy_clock_rate = 0;
+	unsigned long                csid_clk_rate = 0, tfe_clk_rate = 0, temp_clk_rate = 0;
+	struct cam_hw_intf           *hw_intf;
+	int                          i;
+
+	if (!ctx || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	phy_clock_rate = (*((unsigned long *)cmd_args));
+	for (i = 0; i < ctx->num_base; i++) {
+		if (!ctx->hw_mgr->tfe_csid_dev_caps[ctx->base[i].idx].sync_clk)
+			continue;
+
+		hw_intf = g_tfe_hw_mgr.csid_devices[ctx->base[i].idx];
+
+		temp_clk_rate = phy_clock_rate;
+		rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_DYNAMIC_CLOCK_UPDATE,
+			&temp_clk_rate, sizeof(unsigned long));
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to set CSID Clock rate");
+			return rc;
+		}
+		csid_clk_rate = temp_clk_rate;
+
+		hw_intf = g_tfe_hw_mgr.tfe_devices[hw_intf->hw_idx]->hw_intf;
+		rc = hw_intf->hw_ops.process_cmd(
+			hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_DYNAMIC_CLOCK_UPDATE,
+			&temp_clk_rate, sizeof(unsigned long));
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to set TFE Clock rate");
+			return rc;
+		}
+		tfe_clk_rate = temp_clk_rate;
+	}
+
+	CAM_DBG(CAM_ISP, "Clock rates: phy:%llu csid:%llu tfe:%llu",
+		phy_clock_rate, csid_clk_rate, tfe_clk_rate);
+
+	if ((phy_clock_rate > csid_clk_rate) || (csid_clk_rate > tfe_clk_rate) ||
+		(phy_clock_rate > tfe_clk_rate)) {
+		CAM_ERR(CAM_ISP,
+			"Invalid clock rates, phy:%llu csid:%llu tfe:%llu",
+			phy_clock_rate, csid_clk_rate, tfe_clk_rate);
+
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/* entry function: acquire_hw */
+static int cam_tfe_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	struct cam_tfe_hw_mgr *tfe_hw_mgr            = hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -EINVAL;
+	int i, j;
+	struct cam_tfe_hw_mgr_ctx          *tfe_ctx;
+	struct cam_isp_tfe_in_port_generic_info *in_port = NULL;
+	struct cam_cdm_acquire_data         cdm_acquire;
+	uint32_t                            num_pix_port_per_in = 0;
+	uint32_t                            num_rdi_port_per_in = 0;
+	uint32_t                            num_pd_port_per_in = 0;
+	uint32_t                            pdaf_enable = 0;
+	uint32_t                            total_pix_port = 0;
+	uint32_t                            total_rdi_port = 0;
+	uint32_t                            total_pd_port = 0;
+	struct cam_isp_tfe_acquire_hw_info *acquire_hw_info = NULL;
+	uint32_t                            input_size = 0;
+	bool                                lcr_enable = false;
+	bool                                is_shdr_en = false;
+	bool                                is_shdr_master = false;
+	uint32_t                            total_ports = 0;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	/* get the tfe ctx */
+	rc = cam_tfe_hw_mgr_get_ctx(&tfe_hw_mgr->free_ctx_list, &tfe_ctx);
+	if (rc || !tfe_ctx) {
+		CAM_ERR(CAM_ISP, "Get tfe hw context failed");
+		goto err;
+	}
+
+	tfe_ctx->common.cb_priv = acquire_args->context_data;
+	tfe_ctx->common.event_cb = acquire_args->event_cb;
+
+	tfe_ctx->hw_mgr = tfe_hw_mgr;
+
+	memcpy(cdm_acquire.identifier, "tfe", sizeof("tfe"));
+	cdm_acquire.cell_index = 0;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = tfe_ctx;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	cdm_acquire.base_array_cnt = CAM_TFE_HW_NUM_MAX;
+	for (i = 0, j = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (tfe_hw_mgr->cdm_reg_map[i])
+			cdm_acquire.base_array[j++] =
+				tfe_hw_mgr->cdm_reg_map[i];
+	}
+	cdm_acquire.base_array_cnt = j;
+
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.cam_cdm_callback = cam_tfe_cam_cdm_callback;
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to acquire the CDM HW");
+		goto free_ctx;
+	}
+
+	CAM_DBG(CAM_ISP, "Successfully acquired the CDM HW hdl=%x",
+		cdm_acquire.handle);
+	tfe_ctx->cdm_handle = cdm_acquire.handle;
+	tfe_ctx->cdm_ops = cdm_acquire.ops;
+	atomic_set(&tfe_ctx->cdm_done, 1);
+	tfe_ctx->last_cdm_done_req = 0;
+	tfe_ctx->cdm_id = cdm_acquire.id;
+	tfe_ctx->current_mup = 0;
+	tfe_ctx->try_recovery_cnt = 0;
+	tfe_ctx->recovery_req_id = 0;
+	tfe_ctx->num_acq_tfe_out = 0;
+	tfe_ctx->res_list_tfe_out = NULL;
+
+	acquire_hw_info = (struct cam_isp_tfe_acquire_hw_info *)
+		acquire_args->acquire_info;
+	in_port = kcalloc(acquire_hw_info->num_inputs,
+			sizeof(struct cam_isp_tfe_in_port_generic_info),
+			GFP_KERNEL);
+
+	if (!in_port) {
+		CAM_ERR(CAM_ISP, "No memory available");
+		rc = -ENOMEM;
+		goto free_cdm;
+	}
+
+	tfe_ctx->tfe_bus_comp_grp = kcalloc(CAM_TFE_BUS_COMP_NUM_MAX,
+		sizeof(struct cam_tfe_hw_comp_record), GFP_KERNEL);
+
+	if (!tfe_ctx->tfe_bus_comp_grp) {
+		CAM_ERR(CAM_CTXT, "No memory for tfe_bus_comp_grp");
+		rc = -ENOMEM;
+		goto free_ctx;
+	}
+	/* Update in_port structure */
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		rc = cam_tfe_mgr_acquire_get_unified_structure(acquire_hw_info,
+			i, &input_size, &in_port[i]);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Failed in parsing: %d", rc);
+			goto free_cdm;
+		}
+	}
+
+	/* Check any inport has dual tfe usage  */
+	tfe_ctx->is_dual = false;
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		if (in_port[i].usage_type)
+			tfe_ctx->is_dual = true;
+		if (in_port[i].shdr_en) {
+			is_shdr_en = true;
+			tfe_ctx->is_shdr = true;
+		}
+		if (in_port[i].is_shdr_master)
+			is_shdr_master = true;
+	}
+
+	if (is_shdr_en && !is_shdr_master)
+		tfe_ctx->is_shdr_slave = true;
+
+	CAM_INFO(CAM_ISP, "ctx %d TFE index %d is_dual=%d is_shdr=%d shdr_master=%d",
+		tfe_ctx->ctx_index, tfe_ctx->base[0].idx, tfe_ctx->is_dual,
+		is_shdr_en, is_shdr_master);
+
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		cam_tfe_hw_mgr_preprocess_port(tfe_ctx, &in_port[i], &num_pix_port_per_in,
+			&num_rdi_port_per_in, &num_pd_port_per_in, &pdaf_enable, &lcr_enable);
+		total_pix_port += num_pix_port_per_in;
+		total_rdi_port += num_rdi_port_per_in;
+		total_pd_port  += num_pd_port_per_in;
+	}
+
+	total_ports = total_pix_port + total_rdi_port + total_pd_port;
+	tfe_ctx->res_list_tfe_out = kcalloc(total_ports,
+		sizeof(struct cam_isp_hw_mgr_res), GFP_KERNEL);
+	if (!tfe_ctx->res_list_tfe_out) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_ISP, "Alloc failed for tfe out map");
+		goto free_cdm;
+	}
+
+	/* Check whether context has only RDI resource */
+	if (!total_pix_port) {
+		tfe_ctx->is_rdi_only_context = 1;
+		CAM_DBG(CAM_ISP, "RDI only context");
+	} else {
+		tfe_ctx->is_rdi_only_context = 0;
+	}
+
+	/* acquire HW resources */
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+
+		if (in_port[i].num_out_res > g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_ERR(CAM_ISP, "too many output res %d",
+				in_port[i].num_out_res);
+			rc = -EINVAL;
+			goto free_res;
+		}
+
+		num_pix_port_per_in = 0;
+		num_rdi_port_per_in = 0;
+		num_pd_port_per_in  = 0;
+
+		CAM_DBG(CAM_ISP, "in_res_id %x", in_port[i].res_id);
+		rc = cam_tfe_mgr_acquire_hw_for_ctx(tfe_ctx, &in_port[i],
+			&num_pix_port_per_in, &num_rdi_port_per_in, &num_pd_port_per_in,
+			&pdaf_enable);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "can not acquire resource");
+			goto free_res;
+		}
+	}
+
+	/* Process base info */
+	rc = cam_tfe_mgr_process_base_info(tfe_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Process base info failed");
+		goto free_res;
+	}
+
+	acquire_args->ctxt_to_hw_map = tfe_ctx;
+	tfe_ctx->ctx_in_use = 1;
+	tfe_ctx->num_reg_dump_buf = 0;
+
+	if (in_port) {
+		for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+			kfree(in_port[i].data);
+			in_port[i].data = NULL;
+		}
+
+		kfree(in_port);
+		in_port = NULL;
+	}
+
+	if (g_tfe_hw_mgr.isp_caps.support_consumed_addr)
+		acquire_args->op_flags |=
+			 CAM_IFE_CTX_CONSUME_ADDR_EN;
+
+	if (is_shdr_en) {
+		acquire_args->op_flags |= CAM_IFE_CTX_SHDR_EN;
+		if (is_shdr_master)
+			acquire_args->op_flags |= CAM_IFE_CTX_SHDR_IS_MASTER;
+		g_tfe_hw_mgr.session_data[tfe_ctx->base[0].idx].is_shdr = true;
+
+		CAM_DBG(CAM_ISP, "ctx %d TFE index %d link hdl %x",
+			tfe_ctx->ctx_index, tfe_ctx->base[0].idx, acquire_args->link_hdl);
+	}
+
+	g_tfe_hw_mgr.session_data[tfe_ctx->base[0].idx].link_hdl = acquire_args->link_hdl;
+
+	cam_tfe_hw_mgr_put_ctx(&tfe_hw_mgr->used_ctx_list, &tfe_ctx);
+
+	CAM_DBG(CAM_ISP, "Exit...(success)");
+
+	return 0;
+free_res:
+	cam_tfe_hw_mgr_release_hw_for_ctx(tfe_ctx);
+	tfe_ctx->ctx_in_use = 0;
+	tfe_ctx->is_rdi_only_context = 0;
+	tfe_ctx->init_done = false;
+	tfe_ctx->is_dual = false;
+	kfree(tfe_ctx->res_list_tfe_out);
+	tfe_ctx->res_list_tfe_out = NULL;
+free_cdm:
+	cam_cdm_release(tfe_ctx->cdm_handle);
+	tfe_ctx->cdm_handle = 0;
+	tfe_ctx->cdm_ops = NULL;
+free_ctx:
+	kfree(tfe_ctx->tfe_bus_comp_grp);
+	tfe_ctx->tfe_bus_comp_grp = NULL;
+	cam_tfe_hw_mgr_put_ctx(&tfe_hw_mgr->free_ctx_list, &tfe_ctx);
+	if (in_port) {
+		for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+			kfree(in_port[i].data);
+			in_port[i].data = NULL;
+		}
+
+		kfree(in_port);
+		in_port = NULL;
+	}
+err:
+	/* Dump all the current acquired HW */
+	cam_tfe_hw_mgr_dump_all_ctx();
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+int cam_tfe_mgr_acquire_get_unified_dev_str(
+	struct cam_isp_tfe_in_port_info   *in,
+	struct cam_isp_tfe_in_port_generic_info *in_port)
+{
+	int i, rc = 0;
+
+	in_port->res_id          =  in->res_id;
+	in_port->lane_type       =  in->lane_type;
+	in_port->lane_num        =  in->lane_num;
+	in_port->lane_cfg        =  in->lane_cfg;
+	in_port->vc[0]           =  in->vc;
+	in_port->dt[0]           =  in->dt;
+	in_port->num_valid_vc_dt = 1;
+	in_port->format          =  in->format;
+	in_port->pix_pattern     =  in->pix_pattern;
+	in_port->usage_type      =  in->usage_type;
+	in_port->left_start      =  in->left_start;
+	in_port->left_end        =  in->left_end;
+	in_port->left_width      =  in->left_width;
+	in_port->right_start     =  in->right_start;
+	in_port->right_end       =  in->right_end;
+	in_port->right_width     =  in->right_width;
+	in_port->line_start      =  in->line_start;
+	in_port->line_end        =  in->line_end;
+	in_port->height          =  in->height;
+	in_port->batch_size      =  in->batch_size;
+	in_port->dsp_mode        =  in->dsp_mode;
+	in_port->sensor_width    =  in->sensor_width;
+	in_port->sensor_height   =  in->sensor_height;
+	in_port->sensor_hbi      =  in->sensor_hbi;
+	in_port->sensor_vbi      =  in->sensor_vbi;
+	in_port->sensor_fps      =  in->sensor_fps;
+	in_port->init_frame_drop =  in->init_frame_drop;
+	in_port->num_out_res     =  in->num_out_res;
+
+	in_port->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_tfe_out_port_generic_info),
+		GFP_KERNEL);
+
+	if (in_port->data == NULL) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < in->num_out_res; i++) {
+		in_port->data[i].res_id       = in->data_flex[i].res_id;
+		in_port->data[i].format       = in->data_flex[i].format;
+		in_port->data[i].width        = in->data_flex[i].width;
+		in_port->data[i].height       = in->data_flex[i].height;
+		in_port->data[i].stride       = in->data_flex[i].stride;
+		in_port->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		in_port->data[i].secure_mode  = in->data_flex[i].secure_mode;
+		in_port->data[i].wm_mode      = in->data_flex[i].wm_mode;
+		in_port->data[i].reserved     = in->data_flex[i].reserved;
+	}
+
+	return 0;
+err:
+	return rc;
+}
+
+/* entry function: acquire_hw */
+static int cam_tfe_mgr_acquire_dev(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	struct cam_tfe_hw_mgr *tfe_hw_mgr            = hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -EINVAL;
+	int i, j;
+	struct cam_tfe_hw_mgr_ctx         *tfe_ctx;
+	struct cam_isp_tfe_in_port_info   *in_port = NULL;
+	struct cam_isp_tfe_in_port_generic_info *gen_in_port = NULL;
+	struct cam_isp_resource           *isp_resource = NULL;
+	struct cam_cdm_acquire_data        cdm_acquire;
+	uint32_t                           num_pix_port_per_in = 0;
+	uint32_t                           num_rdi_port_per_in = 0;
+	uint32_t                           num_pd_port_per_in = 0;
+	uint32_t                           pdad_enable         = 0;
+	uint32_t                           total_pix_port = 0;
+	uint32_t                           total_rdi_port = 0;
+	uint32_t                           in_port_length = 0;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	/* get the tfe ctx */
+	rc = cam_tfe_hw_mgr_get_ctx(&tfe_hw_mgr->free_ctx_list, &tfe_ctx);
+	if (rc || !tfe_ctx) {
+		CAM_ERR(CAM_ISP, "Get tfe hw context failed");
+		goto err;
+	}
+
+	tfe_ctx->common.cb_priv = acquire_args->context_data;
+	tfe_ctx->common.event_cb = acquire_args->event_cb;
+
+	tfe_ctx->hw_mgr = tfe_hw_mgr;
+
+	memcpy(cdm_acquire.identifier, "tfe", sizeof("tfe"));
+	cdm_acquire.cell_index = 0;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = tfe_ctx;
+	cdm_acquire.base_array_cnt = CAM_TFE_HW_NUM_MAX;
+	for (i = 0, j = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (tfe_hw_mgr->cdm_reg_map[i])
+			cdm_acquire.base_array[j++] =
+				tfe_hw_mgr->cdm_reg_map[i];
+	}
+	cdm_acquire.base_array_cnt = j;
+
+
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.cam_cdm_callback = cam_tfe_cam_cdm_callback;
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to acquire the CDM HW");
+		goto free_ctx;
+	}
+
+	CAM_DBG(CAM_ISP, "Successfully acquired the CDM HW hdl=%x",
+		cdm_acquire.handle);
+	tfe_ctx->cdm_handle = cdm_acquire.handle;
+	tfe_ctx->cdm_ops = cdm_acquire.ops;
+	atomic_set(&tfe_ctx->cdm_done, 1);
+	tfe_ctx->last_cdm_done_req = 0;
+	tfe_ctx->cdm_id = cdm_acquire.id;
+	tfe_ctx->current_mup = 0;
+
+	isp_resource = (struct cam_isp_resource *)acquire_args->acquire_info;
+
+	gen_in_port = kcalloc(acquire_args->num_acq,
+			sizeof(struct cam_isp_tfe_in_port_generic_info),
+			GFP_KERNEL);
+
+	if (!gen_in_port) {
+		CAM_ERR(CAM_ISP, "No memory available");
+		rc = -ENOMEM;
+		goto free_cdm;
+	}
+
+	/* acquire HW resources */
+	for (i = 0; i < acquire_args->num_acq; i++) {
+		if (isp_resource[i].resource_id != CAM_ISP_RES_ID_PORT)
+			continue;
+
+		CAM_DBG(CAM_ISP, "acquire no = %d total = %d", i,
+			acquire_args->num_acq);
+		CAM_DBG(CAM_ISP,
+			"start copy from user handle %lld with len = %d",
+			isp_resource[i].res_hdl,
+			isp_resource[i].length);
+
+		in_port_length = sizeof(struct cam_isp_tfe_in_port_info);
+
+		if (in_port_length > isp_resource[i].length) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough");
+			rc = -EINVAL;
+			goto free_res;
+		}
+
+		in_port = memdup_user(
+			u64_to_user_ptr(isp_resource[i].res_hdl),
+			isp_resource[i].length);
+		if (!IS_ERR(in_port)) {
+			if (in_port->num_out_res > g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+				CAM_ERR(CAM_ISP, "too many output res %d",
+					in_port->num_out_res);
+				rc = -EINVAL;
+				kfree(in_port);
+				goto free_res;
+			}
+
+			in_port_length =
+				sizeof(struct cam_isp_tfe_in_port_info) +
+				(in_port->num_out_res - 1) *
+				sizeof(struct cam_isp_tfe_out_port_info);
+			if (in_port_length > isp_resource[i].length) {
+				CAM_ERR(CAM_ISP, "buffer size is not enough");
+				rc = -EINVAL;
+				kfree(in_port);
+				goto free_res;
+			}
+
+			rc = cam_tfe_mgr_acquire_get_unified_dev_str(in_port,
+				&gen_in_port[i]);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Cannot get in_port structure, rc: %d",
+					rc);
+				goto free_res;
+			}
+
+			num_pix_port_per_in = 0;
+			num_rdi_port_per_in = 0;
+
+			rc = cam_tfe_mgr_acquire_hw_for_ctx(tfe_ctx,
+				&gen_in_port[i],
+				&num_pix_port_per_in, &num_rdi_port_per_in, &num_pd_port_per_in,
+				&pdad_enable);
+			total_pix_port += num_pix_port_per_in;
+			total_rdi_port += num_rdi_port_per_in;
+
+			kfree(in_port);
+			in_port = NULL;
+			if (rc) {
+				CAM_ERR(CAM_ISP, "can not acquire resource");
+				goto free_res;
+			}
+		} else {
+			CAM_ERR(CAM_ISP,
+				"Copy from user failed with in_port = %pK",
+				in_port);
+			rc = -EFAULT;
+			goto free_res;
+		}
+	}
+
+	/* Check whether context has only RDI resource */
+	if (!total_pix_port) {
+		tfe_ctx->is_rdi_only_context = 1;
+		CAM_DBG(CAM_ISP, "RDI only context");
+	} else
+		tfe_ctx->is_rdi_only_context = 0;
+
+	/* Process base info */
+	rc = cam_tfe_mgr_process_base_info(tfe_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Process base info failed");
+		goto free_res;
+	}
+
+	if (gen_in_port) {
+		for (i = 0; i < acquire_args->num_acq; i++) {
+			kfree(gen_in_port[i].data);
+			gen_in_port[i].data = NULL;
+		}
+		kfree(gen_in_port);
+		gen_in_port = NULL;
+	}
+
+	acquire_args->ctxt_to_hw_map = tfe_ctx;
+	tfe_ctx->ctx_in_use = 1;
+
+	cam_tfe_hw_mgr_put_ctx(&tfe_hw_mgr->used_ctx_list, &tfe_ctx);
+
+	CAM_DBG(CAM_ISP, "Exit...(success)");
+
+	return 0;
+free_res:
+	cam_tfe_hw_mgr_release_hw_for_ctx(tfe_ctx);
+free_cdm:
+	cam_cdm_release(tfe_ctx->cdm_handle);
+	if (gen_in_port) {
+		for (i = 0; i < acquire_args->num_acq; i++)
+			kfree(gen_in_port[i].data);
+		kfree(gen_in_port);
+	}
+free_ctx:
+	cam_tfe_hw_mgr_put_ctx(&tfe_hw_mgr->free_ctx_list, &tfe_ctx);
+err:
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+/* entry function: acquire_hw */
+static int cam_tfe_mgr_acquire(void *hw_mgr_priv,
+	void *acquire_hw_args)
+{
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -EINVAL;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	if (acquire_args->num_acq == CAM_API_COMPAT_CONSTANT)
+		rc = cam_tfe_mgr_acquire_hw(hw_mgr_priv, acquire_hw_args);
+	else
+		rc = cam_tfe_mgr_acquire_dev(hw_mgr_priv, acquire_hw_args);
+
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static const char *cam_tfe_util_usage_data_to_string(
+	uint32_t usage_data)
+{
+	switch (usage_data) {
+	case CAM_ISP_TFE_USAGE_LEFT_PX:
+		return "LEFT_PX";
+	case CAM_ISP_TFE_USAGE_RIGHT_PX:
+		return "RIGHT_PX";
+	case CAM_ISP_TFE_USAGE_RDI:
+		return "RDI";
+	default:
+		return "USAGE_INVALID";
+	}
+}
+
+static int cam_tfe_classify_vote_info(
+	struct cam_isp_hw_mgr_res            *hw_mgr_res,
+	struct cam_isp_bw_config_internal_v2 *bw_config,
+	struct cam_axi_vote                  *isp_vote,
+	uint32_t                              split_idx,
+	bool                                 *camif_l_bw_updated,
+	bool                                 *camif_r_bw_updated)
+{
+	int                                   rc = 0, i, j = 0;
+
+	if ((hw_mgr_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) ||
+		(hw_mgr_res->res_id == CAM_ISP_HW_TFE_IN_PDLIB)) {
+		if (split_idx == CAM_ISP_HW_SPLIT_LEFT) {
+			if (*camif_l_bw_updated)
+				return rc;
+
+			for (i = 0; i < bw_config->num_paths; i++) {
+				if (bw_config->axi_path[i].usage_data ==
+					CAM_ISP_TFE_USAGE_LEFT_PX) {
+					memcpy(&isp_vote->axi_path[j],
+						&bw_config->axi_path[i],
+						sizeof(struct
+						cam_cpas_axi_per_path_bw_vote));
+					j++;
+				}
+			}
+			isp_vote->num_paths = j;
+
+			*camif_l_bw_updated = true;
+		} else {
+			if (*camif_r_bw_updated)
+				return rc;
+
+			for (i = 0; i < bw_config->num_paths; i++) {
+				if (bw_config->axi_path[i].usage_data ==
+					CAM_ISP_TFE_USAGE_RIGHT_PX) {
+					memcpy(&isp_vote->axi_path[j],
+						&bw_config->axi_path[i],
+						sizeof(struct
+						cam_cpas_axi_per_path_bw_vote));
+					j++;
+				}
+			}
+			isp_vote->num_paths = j;
+
+			*camif_r_bw_updated = true;
+		}
+	} else if ((hw_mgr_res->res_id >= CAM_ISP_HW_TFE_IN_RDI0)
+		&& (hw_mgr_res->res_id <=
+		CAM_ISP_HW_TFE_IN_RDI2)) {
+		for (i = 0; i < bw_config->num_paths; i++) {
+			if ((bw_config->axi_path[i].usage_data ==
+				CAM_ISP_TFE_USAGE_RDI) &&
+				((bw_config->axi_path[i].path_data_type -
+				CAM_AXI_PATH_DATA_IFE_RDI0) ==
+				(hw_mgr_res->res_id -
+				CAM_ISP_HW_TFE_IN_RDI0))) {
+				memcpy(&isp_vote->axi_path[j],
+					&bw_config->axi_path[i],
+					sizeof(struct
+					cam_cpas_axi_per_path_bw_vote));
+				j++;
+			}
+		}
+		isp_vote->num_paths = j;
+
+	} else {
+		if (hw_mgr_res->hw_res[split_idx]) {
+			CAM_ERR(CAM_ISP, "Invalid res_id %u, split_idx: %u",
+				hw_mgr_res->res_id, split_idx);
+			rc = -EINVAL;
+			return rc;
+		}
+	}
+
+	for (i = 0; i < isp_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"CLASSIFY_VOTE [%s] [%s] [%s] [%llu] [%llu] [%llu]",
+			cam_tfe_util_usage_data_to_string(
+			isp_vote->axi_path[i].usage_data),
+			cam_cpas_axi_util_path_type_to_string(
+			isp_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			isp_vote->axi_path[i].transac_type),
+			isp_vote->axi_path[i].camnoc_bw,
+			isp_vote->axi_path[i].mnoc_ab_bw,
+			isp_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_blob_bw_update(
+	struct cam_isp_bw_config_internal_v2  *bw_config,
+	struct cam_tfe_hw_mgr_ctx             *ctx)
+{
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_tfe_bw_update_args          *bw_upd_args = NULL;
+	int                                    rc = -EINVAL;
+	uint32_t                               i, split_idx;
+	bool                                   camif_l_bw_updated = false;
+	bool                                   camif_r_bw_updated = false;
+
+	for (i = 0; i < bw_config->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"ISP_BLOB usage_type=%u [%s] [%s] [%s] [%llu] [%llu] [%llu]",
+			bw_config->usage_type,
+			cam_tfe_util_usage_data_to_string(
+			bw_config->axi_path[i].usage_data),
+			cam_cpas_axi_util_path_type_to_string(
+			bw_config->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			bw_config->axi_path[i].transac_type),
+			bw_config->axi_path[i].camnoc_bw,
+			bw_config->axi_path[i].mnoc_ab_bw,
+			bw_config->axi_path[i].mnoc_ib_bw);
+	}
+
+	bw_upd_args = kzalloc(sizeof(struct cam_tfe_bw_update_args),
+		GFP_KERNEL);
+	if (!bw_upd_args) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		return -ENOMEM;
+	}
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (split_idx = 0; split_idx < CAM_ISP_HW_SPLIT_MAX;
+			split_idx++) {
+			if (!hw_mgr_res->hw_res[split_idx])
+				continue;
+
+			memset(&bw_upd_args->isp_vote, 0,
+				sizeof(struct cam_axi_vote));
+			rc = cam_tfe_classify_vote_info(hw_mgr_res, bw_config,
+				&bw_upd_args->isp_vote, split_idx,
+				&camif_l_bw_updated, &camif_r_bw_updated);
+			if (rc)
+				goto end;
+
+			if (!bw_upd_args->isp_vote.num_paths)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[split_idx]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_upd_args->node_res =
+					hw_mgr_res->hw_res[split_idx];
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_UPDATE_V2,
+					bw_upd_args,
+					sizeof(
+					struct cam_tfe_bw_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"BW Update failed rc: %d", rc);
+			} else {
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+			}
+		}
+	}
+
+end:
+	cam_free_clear((void *)bw_upd_args);
+	bw_upd_args = NULL;
+	return rc;
+}
+
+/* entry function: config_hw */
+static int cam_tfe_mgr_config_hw(void *hw_mgr_priv,
+	void *config_hw_args)
+{
+	int rc = -EINVAL, i, skip = 0;
+	struct cam_hw_config_args *cfg;
+	struct cam_hw_update_entry *cmd;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_tfe_hw_mgr_ctx *ctx;
+	struct cam_isp_prepare_hw_update_data *hw_update_data;
+	bool is_cdm_hung = false;
+	size_t len = 0;
+	uint32_t *buf_addr = NULL, *buf_start = NULL, *buf_end = NULL;
+	uint32_t cmd_type = 0;
+	unsigned long rem_jiffies = 0;
+
+	if (!hw_mgr_priv || !config_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	cfg = config_hw_args;
+	ctx = (struct cam_tfe_hw_mgr_ctx *)cfg->ctxt_to_hw_map;
+	if (!ctx) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	if (!ctx->ctx_in_use || !ctx->cdm_cmd) {
+		CAM_ERR(CAM_ISP, "Invalid context parameters");
+		return -EPERM;
+	}
+	if (atomic_read(&ctx->overflow_pending)) {
+		CAM_DBG(CAM_ISP,
+			"Ctx[%pK][%d] Overflow pending, cannot apply req %llu",
+			ctx, ctx->ctx_index, cfg->request_id);
+		return -EINVAL;
+	}
+
+
+	/*
+	 * Assuming overflow recovery happens on req N, and we may
+	 * haven't got all the result for req N while apply N + 1,
+	 * so we reset try_recovery_cnt while apply N + 2.
+	 */
+	if (ctx->try_recovery_cnt &&
+		(cfg->request_id > (ctx->recovery_req_id + 1))) {
+		ctx->try_recovery_cnt = 0;
+		ctx->recovery_req_id = 0;
+		CAM_DBG(CAM_ISP,
+			"Ctx[%pK][%d] Reset try_recovery count for req %llu",
+			ctx, ctx->ctx_index, cfg->request_id);
+	}
+
+	hw_update_data = (struct cam_isp_prepare_hw_update_data  *) cfg->priv;
+	hw_update_data->isp_mgr_ctx = ctx;
+	ctx->cdm_userdata.request_id = cfg->request_id;
+	ctx->cdm_userdata.hw_update_data = hw_update_data;
+
+	if (cfg->reapply_type && cfg->cdm_reset_before_apply) {
+		if (ctx->last_cdm_done_req < cfg->request_id) {
+			is_cdm_hung = !cam_cdm_detect_hang_error(ctx->cdm_handle);
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CDM callback not received for req: %lld, last_cdm_done_req: %lld, is_cdm_hung: %d",
+				cfg->request_id, ctx->last_cdm_done_req,
+				is_cdm_hung);
+
+			if (!is_cdm_hung)
+				cam_cdm_dump_debug_registers(ctx->cdm_handle);
+
+			rc = cam_cdm_reset_hw(ctx->cdm_handle);
+			if (rc) {
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"CDM reset unsuccessful for req: %lld, ctx: %d, rc: %d",
+					cfg->request_id, ctx->ctx_index, rc);
+				ctx->last_cdm_done_req = 0;
+				return rc;
+			}
+		} else {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CDM callback received, should wait for buf done for req: %lld",
+				cfg->request_id);
+			return -EALREADY;
+		}
+		ctx->last_cdm_done_req = 0;
+	}
+
+	if (hw_update_data->bw_clk_config.bw_config_valid) {
+		CAM_DBG(CAM_ISP, "idx=%d, bw_config_version=%d", ctx->ctx_index,
+			ctx->bw_config_version);
+		if (ctx->bw_config_version ==
+			CAM_ISP_BW_CONFIG_V2) {
+			rc = cam_isp_tfe_blob_bw_update(
+				&hw_update_data->bw_clk_config.bw_config_v2, ctx);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+				"Bandwidth Update Failed rc: %d", rc);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"Invalid bw config version: %d",
+				ctx->bw_config_version);
+		}
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Enter ctx id:%d num_hw_upd_entries %d request id: %llu",
+		ctx->ctx_index, cfg->num_hw_update_entries, cfg->request_id);
+
+	if (cfg->num_hw_update_entries <= 0) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"Enter ctx id:%d no valid hw entries:%d request id: %llu",
+			ctx->ctx_index, cfg->num_hw_update_entries,
+			cfg->request_id);
+		goto end;
+	}
+
+	cdm_cmd                       = ctx->cdm_cmd;
+	cdm_cmd->cmd_arrary_count     = cfg->num_hw_update_entries;
+	cdm_cmd->type                 = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+	cdm_cmd->flag                 = true;
+	cdm_cmd->userdata             = ctx;
+	cdm_cmd->cookie               = cfg->request_id;
+	cdm_cmd->gen_irq_arb          = false;
+	cdm_cmd->genirq_buff          = &hw_update_data->kmd_cmd_buff_info;
+
+	for (i = 0; i < cfg->num_hw_update_entries; i++) {
+		cmd = (cfg->hw_update_entries + i);
+		if ((cfg->reapply_type == CAM_CONFIG_REAPPLY_IO) && (cmd->flags == CAM_ISP_IQ_BL)) {
+			skip++;
+			continue;
+		}
+
+		if (cmd->flags == CAM_ISP_UNUSED_BL || cmd->flags >= CAM_ISP_BL_MAX)
+			CAM_ERR(CAM_ISP, "Unexpected BL type %d", cmd->flags);
+
+		cdm_cmd->cmd_flex[i - skip].bl_addr.mem_handle = cmd->handle;
+		cdm_cmd->cmd_flex[i - skip].offset = cmd->offset;
+		cdm_cmd->cmd_flex[i - skip].len = cmd->len;
+		cdm_cmd->cmd_flex[i - skip].arbitrate = false;
+
+		if (g_tfe_hw_mgr.debug_cfg.enable_cdm_cmd_check) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "Enter cdm cmd_buf validation");
+			rc = cam_packet_util_get_cmd_mem_addr(
+				cdm_cmd->cmd_flex[i - skip].bl_addr.mem_handle, &buf_addr, &len);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed to get buf_addr and len for mem_handle: %d ctx id: %u request id: %llu",
+					cdm_cmd->cmd_flex[i - skip].bl_addr.mem_handle,
+					ctx->ctx_index, cfg->request_id);
+				continue;
+			}
+
+			buf_start = (uint32_t *)((uint8_t *) buf_addr +
+				cdm_cmd->cmd_flex[i - skip].offset);
+			buf_end = (uint32_t *)((uint8_t *) buf_start +
+				cdm_cmd->cmd_flex[i - skip].len - 1);
+			cmd_type = ((uint32_t)(*buf_start) >> CAM_CDM_COMMAND_OFFSET);
+			if ((i == 0) && (cmd_type != CAM_CDM_CMD_CHANGE_BASE)) {
+				CAM_ERR(CAM_ISP,
+					"first cmd in cmd_buf is not change_base, cmd_type: %u ctx id: %u request id: %llu",
+					cmd_type, ctx->ctx_index, cfg->request_id);
+				cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
+				return -EINVAL;
+			}
+
+			if (cam_cdm_util_validate_cmd_buf(buf_start, buf_end)) {
+				CAM_ERR(CAM_ISP,
+					"found invalid cmd in cmd_buf, ctx id: %u request id: %llu",
+					ctx->ctx_index, cfg->request_id);
+				cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
+				return -EINVAL;
+			}
+		}
+	}
+
+	cdm_cmd->cmd_arrary_count = cfg->num_hw_update_entries - skip;
+	reinit_completion(&ctx->config_done_complete);
+	ctx->applied_req_id = cfg->request_id;
+	CAM_DBG(CAM_ISP, "Submit to CDM");
+
+	atomic_set(&ctx->cdm_done, 0);
+
+	rc = cam_cdm_submit_bls(ctx->cdm_handle, cdm_cmd);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Failed to apply the configs for req %llu, rc %d",
+			cfg->request_id, rc);
+		return rc;
+	}
+
+	ctx->packet = (struct cam_packet *)hw_update_data->packet;
+	ctx->last_submit_bl_cmd.bl_count = cdm_cmd->cmd_arrary_count;
+
+	for (i = 0; i < cdm_cmd->cmd_arrary_count; i++) {
+		if (cdm_cmd->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE) {
+			ctx->last_submit_bl_cmd.cmd[i].mem_handle =
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle;
+
+			rc = cam_mem_get_io_buf(
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle,
+				g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl,
+				&ctx->last_submit_bl_cmd.cmd[i].hw_addr,
+				&ctx->last_submit_bl_cmd.cmd[i].len, NULL, NULL);
+		} else if (cdm_cmd->type == CAM_CDM_BL_CMD_TYPE_HW_IOVA) {
+			if (!cdm_cmd->cmd_flex[i].bl_addr.hw_iova) {
+				CAM_ERR(CAM_CDM, "Submitted Hw bl hw_iova is invalid %d:%d",
+					i, cdm_cmd->cmd_arrary_count);
+				rc = -EINVAL;
+				break;
+			}
+			rc = 0;
+			ctx->last_submit_bl_cmd.cmd[i].hw_addr =
+				(uint64_t)cdm_cmd->cmd_flex[i].bl_addr.hw_iova;
+			ctx->last_submit_bl_cmd.cmd[i].len =
+				cdm_cmd->cmd_flex[i].len + cdm_cmd->cmd_flex[i].offset;
+			ctx->last_submit_bl_cmd.cmd[i].mem_handle = 0;
+		} else
+			CAM_INFO(CAM_ISP, "submitted invalid bl cmd addr type :%d for Bl(%d)",
+				cdm_cmd->type, i);
+
+		ctx->last_submit_bl_cmd.cmd[i].offset = cdm_cmd->cmd_flex[i].offset;
+		ctx->last_submit_bl_cmd.cmd[i].type = cdm_cmd->type;
+		ctx->last_submit_bl_cmd.cmd[i].input_len = cdm_cmd->cmd_flex[i].len;
+	}
+
+	if (!cfg->init_packet && !hw_update_data->mup_en)
+		goto end;
+
+	for (i = 0; i < CAM_TFE_HW_CONFIG_WAIT_MAX_TRY; i++) {
+		rem_jiffies = cam_common_wait_for_completion_timeout(
+			&ctx->config_done_complete,
+			msecs_to_jiffies(
+			CAM_TFE_HW_CONFIG_TIMEOUT));
+		if (rem_jiffies <= 0) {
+			rc = cam_cdm_detect_hang_error(ctx->cdm_handle);
+			if (rc == 0) {
+				CAM_ERR(CAM_ISP,
+					"CDM workqueue delay detected, wait for some more time req_id=%llu rc=%d ctx_index %d",
+					cfg->request_id, rc,
+					ctx->ctx_index);
+				cam_req_mgr_debug_delay_detect();
+				trace_cam_delay_detect("CDM",
+					"CDM workqueue delay detected",
+					cfg->request_id, ctx->ctx_index,
+					CAM_DEFAULT_VALUE,
+					CAM_DEFAULT_VALUE, rc);
+				continue;
+			} else {
+				CAM_ERR(CAM_ISP,
+					"cfg_done completn timeout cdm_hang=%d req=%llu ctx_idx=%d",
+					cfg->request_id, rc,
+					ctx->ctx_index);
+				cam_req_mgr_debug_delay_detect();
+				trace_cam_delay_detect("ISP",
+					"config done completion timeout",
+					cfg->request_id, ctx->ctx_index,
+					CAM_DEFAULT_VALUE, CAM_DEFAULT_VALUE,
+					rc);
+
+				rc = -ETIMEDOUT;
+				break;
+			}
+		} else {
+			rc = 0;
+			if (hw_update_data->mup_en)
+				ctx->current_mup = hw_update_data->mup_val;
+			CAM_DBG(CAM_ISP,
+				"config done Success for req_id=%llu ctx_index %d",
+				cfg->request_id, ctx->ctx_index);
+			break;
+		}
+	}
+
+	if ((i == CAM_TFE_HW_CONFIG_WAIT_MAX_TRY) && (rc == 0))
+		CAM_DBG(CAM_ISP, "Wq delayed but IRQ CDM done");
+end:
+	CAM_DBG(CAM_ISP, "Exit: Config Done: %llu",  cfg->request_id);
+
+	return rc;
+}
+
+static int cam_tfe_mgr_stop_hw_in_overflow(void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	uint32_t                          i, master_base_idx = 0;
+
+	if (!stop_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+	ctx = (struct cam_tfe_hw_mgr_ctx *)stop_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d",
+		ctx->ctx_index);
+
+	if (!ctx->num_base) {
+		CAM_ERR(CAM_ISP, "Number of bases are zero");
+		return -EINVAL;
+	}
+
+	/* get master base index first */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
+			master_base_idx = ctx->base[i].idx;
+			break;
+		}
+	}
+
+	if (i == ctx->num_base)
+		master_base_idx = ctx->base[0].idx;
+
+	ctx->ctx_state = CAM_TFE_HW_MGR_STATE_INACTIVE;
+
+	/* stop the master CSID path first */
+	cam_tfe_mgr_csid_stop_hw(ctx, &ctx->res_list_tfe_csid,
+		master_base_idx, CAM_TFE_CSID_HALT_IMMEDIATELY);
+
+	/* Stop rest of the CSID paths  */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (i == master_base_idx)
+			continue;
+
+		cam_tfe_mgr_csid_stop_hw(ctx, &ctx->res_list_tfe_csid,
+			ctx->base[i].idx, CAM_TFE_CSID_HALT_IMMEDIATELY);
+	}
+
+	/* TFE in resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		cam_tfe_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	/* TFE out resources */
+	for (i = 0; i < ctx->num_acq_tfe_out; i++)
+		cam_tfe_hw_mgr_stop_hw_res(&ctx->res_list_tfe_out[i]);
+
+	/* Stop tasklet for context */
+	cam_tasklet_stop(ctx->common.tasklet_info);
+	CAM_DBG(CAM_ISP, "Exit...ctx id:%d rc :%d",
+		ctx->ctx_index, rc);
+
+	return rc;
+}
+
+static int cam_tfe_mgr_bw_control(struct cam_tfe_hw_mgr_ctx *ctx,
+	enum cam_tfe_bw_control_action action)
+{
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_tfe_bw_control_args         bw_ctrl_args;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d", ctx->ctx_index);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_ctrl_args.node_res =
+					hw_mgr_res->hw_res[i];
+				bw_ctrl_args.action = action;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_CONTROL,
+					&bw_ctrl_args,
+					sizeof(struct cam_tfe_bw_control_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "BW Update failed");
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_pause_hw(struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	return cam_tfe_mgr_bw_control(ctx, CAM_TFE_BW_CONTROL_EXCLUDE);
+}
+
+/* entry function: stop_hw */
+static int cam_tfe_mgr_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_isp_stop_args         *stop_isp;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	enum cam_tfe_csid_halt_cmd        csid_halt_type;
+	uint32_t                          i, master_base_idx = 0;
+
+	if (!hw_mgr_priv || !stop_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)stop_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, " Enter...ctx id:%d", ctx->ctx_index);
+	stop_isp = (struct cam_isp_stop_args    *)stop_args->args;
+
+	/* Set the csid halt command */
+	if (stop_isp->hw_stop_cmd == CAM_ISP_HW_STOP_AT_FRAME_BOUNDARY)
+		csid_halt_type = CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY;
+	else
+		csid_halt_type = CAM_TFE_CSID_HALT_IMMEDIATELY;
+
+	/* Note:stop resource will remove the irq mask from the hardware */
+
+	if (!ctx->num_base) {
+		CAM_ERR(CAM_ISP, "number of bases are zero");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Halting CSIDs");
+
+	/* get master base index first */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
+			master_base_idx = ctx->base[i].idx;
+			break;
+		}
+	}
+
+	/*
+	 * If Context does not have PIX resources and has only RDI resource
+	 * then take the first base index.
+	 */
+	if (i == ctx->num_base)
+		master_base_idx = ctx->base[0].idx;
+
+	ctx->ctx_state = CAM_TFE_HW_MGR_STATE_INACTIVE;
+
+	/*Change slave mode*/
+	if (csid_halt_type == CAM_TFE_CSID_HALT_IMMEDIATELY)
+		cam_tfe_mgr_csid_change_halt_mode(ctx,
+			CAM_TFE_CSID_HALT_MODE_INTERNAL);
+
+	/* Stop the master CSID path first */
+	cam_tfe_mgr_csid_stop_hw(ctx, &ctx->res_list_tfe_csid,
+		master_base_idx, csid_halt_type);
+
+	/* stop rest of the CSID paths  */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].idx == master_base_idx)
+			continue;
+		CAM_DBG(CAM_ISP, "Stopping CSID idx %d i %d master %d",
+			ctx->base[i].idx, i, master_base_idx);
+
+		cam_tfe_mgr_csid_stop_hw(ctx, &ctx->res_list_tfe_csid,
+			ctx->base[i].idx, csid_halt_type);
+	}
+
+	CAM_DBG(CAM_ISP, "Going to stop TFE Out");
+
+	/* TFE out resources */
+	for (i = 0; i < ctx->num_acq_tfe_out; i++)
+		cam_tfe_hw_mgr_stop_hw_res(&ctx->res_list_tfe_out[i]);
+
+	CAM_DBG(CAM_ISP, "Going to stop TFE IN");
+
+	/* TFE in resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		cam_tfe_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	cam_tasklet_stop(ctx->common.tasklet_info);
+
+	cam_tfe_mgr_pause_hw(ctx);
+
+	cam_common_wait_for_completion_timeout(&ctx->config_done_complete,
+		msecs_to_jiffies(5));
+
+	ctx->current_mup = 0;
+
+	if (stop_isp->stop_only)
+		goto end;
+
+	if (cam_cdm_stream_off(ctx->cdm_handle))
+		CAM_ERR(CAM_ISP, "CDM stream off failed %d", ctx->cdm_handle);
+
+	cam_tfe_hw_mgr_deinit_hw(ctx);
+
+	CAM_DBG(CAM_ISP,
+		"Stop success for ctx id:%d rc :%d", ctx->ctx_index, rc);
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	atomic_dec_return(&g_tfe_hw_mgr.active_ctx_cnt);
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+
+	for (i = 0; i < ctx->last_submit_bl_cmd.bl_count; i++) {
+		ctx->last_submit_bl_cmd.cmd[i].mem_handle = 0;
+		ctx->last_submit_bl_cmd.cmd[i].hw_addr = 0;
+		ctx->last_submit_bl_cmd.cmd[i].len = 0;
+		ctx->last_submit_bl_cmd.cmd[i].offset = 0;
+		ctx->last_submit_bl_cmd.cmd[i].type = 0;
+		ctx->last_submit_bl_cmd.cmd[i].input_len = 0;
+	}
+	ctx->last_submit_bl_cmd.bl_count = 0;
+	ctx->packet = NULL;
+
+end:
+	return rc;
+}
+
+static int cam_tfe_mgr_reset_tfe_hw(struct cam_tfe_hw_mgr *hw_mgr,
+	uint32_t hw_idx)
+{
+	uint32_t i = 0;
+	struct cam_hw_intf             *tfe_hw_intf;
+	uint32_t tfe_reset_type;
+
+	if (!hw_mgr) {
+		CAM_DBG(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+	/* Reset TFE HW*/
+	tfe_reset_type = CAM_TFE_HW_RESET_HW;
+
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (!hw_mgr->tfe_devices[i])
+			continue;
+
+		if (hw_idx != hw_mgr->tfe_devices[i]->hw_intf->hw_idx)
+			continue;
+		CAM_DBG(CAM_ISP, "TFE (id = %d) reset", hw_idx);
+		tfe_hw_intf = hw_mgr->tfe_devices[i]->hw_intf;
+		tfe_hw_intf->hw_ops.reset(tfe_hw_intf->hw_priv,
+			&tfe_reset_type, sizeof(tfe_reset_type));
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "Exit Successfully");
+	return 0;
+}
+
+static int cam_tfe_mgr_restart_hw(void *start_hw_args)
+{
+	int                               rc = -EINVAL;
+	struct cam_hw_start_args         *start_args = start_hw_args;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	uint32_t                          i;
+
+	if (!start_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)start_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "START TFE OUT ... in ctx id:%d", ctx->ctx_index);
+
+	cam_tasklet_start(ctx->common.tasklet_info);
+
+	/* start the TFE out devices */
+	for (i = 0; i < ctx->num_acq_tfe_out; i++) {
+		rc = cam_tfe_hw_mgr_start_hw_res(
+			&ctx->res_list_tfe_out[i], ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE OUT (%d)", i);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START TFE SRC ... in ctx id:%d", ctx->ctx_index);
+
+	/* Start the TFE in devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		rc = cam_tfe_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE IN (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START CSID HW ... in ctx id:%d", ctx->ctx_index);
+	/* Start the TFE CSID HW devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		rc = cam_tfe_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE CSID (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	ctx->ctx_state = CAM_TFE_HW_MGR_STATE_ACTIVE;
+
+	CAM_DBG(CAM_ISP, "Exit...(success)");
+	return 0;
+
+err:
+	cam_tfe_mgr_stop_hw_in_overflow(start_hw_args);
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static int cam_tfe_mgr_start_hw(void *hw_mgr_priv, void *start_hw_args)
+{
+	int                               rc = -EINVAL;
+	struct cam_isp_start_args        *start_isp = start_hw_args;
+	struct cam_hw_stop_args           stop_args;
+	struct cam_isp_stop_args          stop_isp;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_hw_intf               *hw_intf;
+	uint32_t                          i, j, hw_index = 0;
+	bool                              res_rdi_context_set = false;
+	uint32_t                          primary_rdi_in_res;
+	uint32_t                          primary_rdi_out_res;
+	bool                              hw_id[CAM_TFE_HW_NUM_MAX] = {0};
+
+	primary_rdi_in_res = CAM_ISP_HW_TFE_IN_MAX;
+	primary_rdi_out_res = g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type;
+
+	if (!hw_mgr_priv || !start_isp) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)
+		start_isp->hw_config.ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	if ((!ctx->init_done) && start_isp->start_only) {
+		CAM_ERR(CAM_ISP, "Invalid args init_done %d start_only %d",
+			ctx->init_done, start_isp->start_only);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter... ctx id:%d",
+		ctx->ctx_index);
+
+	/* update Bandwidth should be done at the hw layer */
+
+	cam_tasklet_start(ctx->common.tasklet_info);
+
+	if (ctx->init_done && start_isp->start_only)
+		goto start_only;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_id[hw_intf->hw_idx])
+				continue;
+
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_TFE_CSID_SET_CSID_DEBUG,
+				&g_tfe_hw_mgr.debug_cfg.csid_debug,
+				sizeof(g_tfe_hw_mgr.debug_cfg.csid_debug));
+			hw_id[hw_intf->hw_idx] = true;
+		}
+	}
+
+	memset(&hw_id[0], 0, sizeof(hw_id));
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_id[hw_intf->hw_idx])
+				continue;
+
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_SET_CAMIF_DEBUG,
+				&g_tfe_hw_mgr.debug_cfg.camif_debug,
+				sizeof(g_tfe_hw_mgr.debug_cfg.camif_debug));
+			hw_id[hw_intf->hw_idx] = true;
+
+			if (ctx->is_shdr) {
+				for (j = 0; j < CAM_TFE_HW_NUM_MAX; j++) {
+					if (g_tfe_hw_mgr.session_data[j].link_hdl ==
+						g_tfe_hw_mgr.session_data[ctx->base[0].idx].link_hdl
+						&& (j != ctx->base[0].idx) &&
+						g_tfe_hw_mgr.session_data[j].is_shdr) {
+						hw_index = j;
+						break;
+					}
+				}
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_SET_SYNC_HW_IDX,
+					&hw_index,
+					sizeof(hw_index));
+				CAM_DBG(CAM_ISP, "TFE: %d sync idx %d", ctx->base[0].idx, hw_index);
+			}
+		}
+	}
+
+	rc = cam_tfe_hw_mgr_init_hw(ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Init failed");
+		goto tasklet_stop;
+	}
+
+	ctx->init_done = true;
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	atomic_fetch_inc(&g_tfe_hw_mgr.active_ctx_cnt);
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+
+	CAM_DBG(CAM_ISP, "start cdm interface");
+	rc = cam_cdm_stream_on(ctx->cdm_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Can not start cdm (%d)",
+			 ctx->cdm_handle);
+		goto deinit_hw;
+	}
+
+start_only:
+	/* Apply initial configuration */
+	CAM_DBG(CAM_ISP, "Config HW");
+	rc = cam_tfe_mgr_config_hw(hw_mgr_priv, &start_isp->hw_config);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Config HW failed");
+		goto cdm_streamoff;
+	}
+
+	CAM_DBG(CAM_ISP, "START TFE OUT ... in ctx id:%d",
+		ctx->ctx_index);
+	/* start the TFE out devices */
+	for (i = 0; i < ctx->num_acq_tfe_out; i++) {
+		hw_mgr_res = &ctx->res_list_tfe_out[i];
+		switch (hw_mgr_res->res_id) {
+		case CAM_ISP_TFE_OUT_RES_RDI_0:
+		case CAM_ISP_TFE_OUT_RES_RDI_1:
+		case CAM_ISP_TFE_OUT_RES_RDI_2:
+			if (!res_rdi_context_set && ctx->is_rdi_only_context) {
+				hw_mgr_res->hw_res[0]->is_rdi_primary_res =
+					ctx->is_rdi_only_context;
+				res_rdi_context_set = true;
+				primary_rdi_out_res = hw_mgr_res->res_id;
+			}
+		}
+
+		rc = cam_tfe_hw_mgr_start_hw_res(
+			&ctx->res_list_tfe_out[i], ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE OUT (%d)",
+				 i);
+			goto err;
+		}
+	}
+
+	if (primary_rdi_out_res < g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type)
+		primary_rdi_in_res =
+			cam_tfe_hw_mgr_convert_rdi_out_res_id_to_in_res(
+			primary_rdi_out_res);
+
+	CAM_DBG(CAM_ISP, "START TFE IN ... in ctx id:%d",
+		ctx->ctx_index);
+	/* Start the TFE in resources devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		/*
+		 * if rdi only context has two rdi resources then only one irq
+		 * subscription should be sufficient
+		 */
+		if (primary_rdi_in_res == hw_mgr_res->res_id)
+			hw_mgr_res->hw_res[0]->is_rdi_primary_res =
+				ctx->is_rdi_only_context;
+
+		rc = cam_tfe_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE in resource (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START CSID HW ... in ctx id:%d",
+		ctx->ctx_index);
+	/* Start the TFE CSID HW devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		rc = cam_tfe_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE CSID (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	ctx->ctx_state = CAM_TFE_HW_MGR_STATE_ACTIVE;
+	ctx->last_dump_flush_req_id = U64_MAX;
+	ctx->last_dump_err_req_id = U64_MAX;
+	return 0;
+
+err:
+	stop_isp.stop_only = false;
+	stop_isp.hw_stop_cmd = CAM_ISP_HW_STOP_IMMEDIATELY;
+	stop_args.ctxt_to_hw_map = start_isp->hw_config.ctxt_to_hw_map;
+	stop_args.args = (void *)(&stop_isp);
+
+	cam_tfe_mgr_stop_hw(hw_mgr_priv, &stop_args);
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+
+cdm_streamoff:
+	cam_cdm_stream_off(ctx->cdm_handle);
+
+deinit_hw:
+	cam_tfe_hw_mgr_deinit_hw(ctx);
+
+tasklet_stop:
+	cam_tasklet_stop(ctx->common.tasklet_info);
+
+	return rc;
+}
+
+static int cam_tfe_mgr_read(void *hw_mgr_priv, void *read_args)
+{
+	return -EPERM;
+}
+
+static int cam_tfe_mgr_write(void *hw_mgr_priv, void *write_args)
+{
+	return -EPERM;
+}
+
+static int cam_tfe_mgr_user_dump_hw(
+		struct cam_tfe_hw_mgr_ctx *tfe_ctx,
+		struct cam_hw_dump_args *dump_args)
+{
+	int rc = 0;
+	struct cam_hw_soc_dump_args soc_dump_args;
+
+	if (!tfe_ctx || !dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid parameters %pK %pK",
+			tfe_ctx, dump_args);
+		return -EINVAL;
+	}
+	soc_dump_args.buf_handle = dump_args->buf_handle;
+	soc_dump_args.request_id = dump_args->request_id;
+	soc_dump_args.offset = dump_args->offset;
+
+	rc = cam_tfe_mgr_handle_reg_dump(tfe_ctx,
+		tfe_ctx->reg_dump_buf_desc,
+		tfe_ctx->num_reg_dump_buf,
+		CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR,
+		&soc_dump_args,
+		true);
+	if (rc) {
+		CAM_DBG(CAM_ISP,
+			"Dump failed req: %lld handle %u offset %u rc %d",
+			dump_args->request_id,
+			dump_args->buf_handle,
+			dump_args->offset,
+			rc);
+		return rc;
+	}
+	dump_args->offset = soc_dump_args.offset;
+	return rc;
+}
+
+static int cam_tfe_mgr_dump(void *hw_mgr_priv, void *args)
+{
+
+	struct cam_isp_hw_dump_args isp_hw_dump_args;
+	struct cam_hw_dump_args *dump_args = (struct cam_hw_dump_args *)args;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_tfe_hw_mgr_ctx *tfe_ctx = (struct cam_tfe_hw_mgr_ctx *)
+						dump_args->ctxt_to_hw_map;
+	int i;
+	int rc = 0;
+
+	/* for some targets, information about the TFE registers to be dumped
+	 * is already submitted with the hw manager. In this case, we
+	 * can dump just the related registers and skip going to core files.
+	 * If dump to this buffer falis due to any reason, fallback to dump
+	 * to the LDAR buffer
+	 */
+	isp_hw_dump_args.is_dump_all = true;
+	if (tfe_ctx->num_reg_dump_buf) {
+		rc = cam_tfe_mgr_user_dump_hw(tfe_ctx, dump_args);
+		if (!rc)
+			isp_hw_dump_args.is_dump_all = false;
+	}
+
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&isp_hw_dump_args.cpu_addr,
+		&isp_hw_dump_args.buf_len);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+
+	isp_hw_dump_args.offset = dump_args->offset;
+	isp_hw_dump_args.req_id = dump_args->request_id;
+
+	list_for_each_entry(hw_mgr_res, &tfe_ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			switch (hw_mgr_res->hw_res[i]->res_id) {
+			case CAM_TFE_CSID_PATH_RES_RDI_0:
+			case CAM_TFE_CSID_PATH_RES_RDI_1:
+			case CAM_TFE_CSID_PATH_RES_RDI_2:
+				if (tfe_ctx->is_rdi_only_context &&
+					hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+
+			case CAM_TFE_CSID_PATH_RES_IPP:
+			case CAM_TFE_CSID_PATH_RES_PPP:
+				if (hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+			default:
+				CAM_DBG(CAM_ISP, "not a valid res %d",
+				hw_mgr_res->res_id);
+				break;
+			}
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &tfe_ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			switch (hw_mgr_res->hw_res[i]->res_id) {
+			case CAM_ISP_HW_TFE_IN_RDI0:
+			case CAM_ISP_HW_TFE_IN_RDI1:
+			case CAM_ISP_HW_TFE_IN_RDI2:
+				if (tfe_ctx->is_rdi_only_context &&
+					hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+
+			case CAM_ISP_HW_TFE_IN_CAMIF:
+			case CAM_ISP_HW_TFE_IN_PDLIB:
+				if (hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+			default:
+				CAM_DBG(CAM_ISP, "not a valid res %d",
+				hw_mgr_res->res_id);
+				break;
+			}
+		}
+	}
+	dump_args->offset = isp_hw_dump_args.offset;
+	CAM_DBG(CAM_ISP, "offset %u", dump_args->offset);
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_tfe_mgr_reset(void *hw_mgr_priv, void *hw_reset_args)
+{
+	struct cam_tfe_hw_mgr            *hw_mgr = hw_mgr_priv;
+	struct cam_hw_reset_args         *reset_args = hw_reset_args;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	int                               rc = 0, i = 0;
+
+	if (!hw_mgr_priv || !hw_reset_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)reset_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Reset CSID and TFE");
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		rc = cam_tfe_hw_mgr_reset_csid_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to reset CSID:%d rc: %d",
+				hw_mgr_res->res_id, rc);
+			goto end;
+		}
+	}
+
+	for (i = 0; i < ctx->num_base; i++) {
+		rc = cam_tfe_mgr_reset_tfe_hw(hw_mgr, ctx->base[i].idx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to reset TFE:%d rc: %d",
+				ctx->base[i].idx, rc);
+			goto end;
+		}
+	}
+
+	atomic_set(&ctx->overflow_pending, 0);
+end:
+	return rc;
+}
+
+static int cam_tfe_mgr_release_hw(void *hw_mgr_priv,
+					void *release_hw_args)
+{
+	int                               rc           = 0;
+	struct cam_hw_release_args       *release_args = release_hw_args;
+	struct cam_tfe_hw_mgr            *hw_mgr       = hw_mgr_priv;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	uint32_t                          i;
+
+	if (!hw_mgr_priv || !release_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)release_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d",
+		ctx->ctx_index);
+
+	if (ctx->is_shdr) {
+		g_tfe_hw_mgr.session_data[ctx->base[0].idx].link_hdl = 0;
+		g_tfe_hw_mgr.session_data[ctx->base[0].idx].is_shdr = false;
+	}
+
+	if (ctx->init_done)
+		cam_tfe_hw_mgr_deinit_hw(ctx);
+
+	/* we should called the stop hw before this already */
+	cam_tfe_hw_mgr_release_hw_for_ctx(ctx);
+
+	/* reset base info */
+	ctx->num_base = 0;
+	memset(ctx->base, 0, sizeof(ctx->base));
+
+	/* release cdm handle */
+	cam_cdm_release(ctx->cdm_handle);
+
+	/* clean context */
+	list_del_init(&ctx->list);
+	ctx->ctx_in_use = 0;
+	ctx->is_rdi_only_context = 0;
+	ctx->cdm_handle = 0;
+	ctx->cdm_ops = NULL;
+	ctx->init_done = false;
+	ctx->is_dual = false;
+	ctx->num_reg_dump_buf = 0;
+	ctx->last_cdm_done_req = 0;
+	kfree(ctx->tfe_bus_comp_grp);
+	ctx->tfe_bus_comp_grp = NULL;
+	ctx->is_shdr = false;
+	ctx->is_shdr_slave = false;
+	ctx->acquired_wm_mask = 0;
+	atomic_set(&ctx->overflow_pending, 0);
+
+	for (i = 0; i < ctx->last_submit_bl_cmd.bl_count; i++) {
+		ctx->last_submit_bl_cmd.cmd[i].mem_handle = 0;
+		ctx->last_submit_bl_cmd.cmd[i].hw_addr = 0;
+		ctx->last_submit_bl_cmd.cmd[i].len = 0;
+		ctx->last_submit_bl_cmd.cmd[i].offset = 0;
+		ctx->last_submit_bl_cmd.cmd[i].type = 0;
+		ctx->last_submit_bl_cmd.cmd[i].input_len = 0;
+	}
+	ctx->last_submit_bl_cmd.bl_count = 0;
+	ctx->packet = NULL;
+	ctx->current_mup = 0;
+	ctx->try_recovery_cnt = 0;
+	ctx->recovery_req_id = 0;
+	ctx->num_acq_tfe_out = 0;
+	kfree(ctx->res_list_tfe_out);
+	ctx->res_list_tfe_out = NULL;
+
+	memset(ctx->tfe_out_map, 0, sizeof(uint8_t) * g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type);
+
+	CAM_DBG(CAM_ISP, "Exit...ctx id:%d",
+		ctx->ctx_index);
+	cam_tfe_hw_mgr_put_ctx(&hw_mgr->free_ctx_list, &ctx);
+	return rc;
+}
+
+static int cam_isp_tfe_blob_buffer_alignment_update(
+	uint32_t                                      blob_type,
+	struct cam_isp_generic_blob_info             *blob_info,
+	struct cam_isp_tfe_alignment_resource_info   *alignment_info,
+	struct cam_hw_prepare_update_args            *prepare)
+{
+	struct cam_isp_tfe_alignment_offset_config   *alignment_port_cfg;
+	struct cam_isp_resource_node                 *res;
+	struct cam_isp_hw_get_cmd_update              cmd_update;
+	struct cam_tfe_hw_mgr_ctx                    *ctx = NULL;
+	struct cam_isp_hw_mgr_res                    *hw_mgr_res;
+	struct cam_hw_intf                           *hw_intf;
+	uint32_t                                      res_id_out, i;
+	int                                           rc = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+	for (i = 0; i < alignment_info->num_ports; i++) {
+		alignment_port_cfg = &alignment_info->port_alignment_cfg[i];
+		res_id_out = alignment_port_cfg->resource_type & 0xFF;
+
+		if (res_id_out >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_ERR(CAM_ISP, "invalid out restype:%x ctx %d",
+				alignment_port_cfg->resource_type, ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		hw_mgr_res = &ctx->res_list_tfe_out[ctx->tfe_out_map[res_id_out]];
+		res = hw_mgr_res->hw_res[0];
+		hw_intf = res->hw_intf;
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			cmd_update.res = res;
+			cmd_update.data = alignment_port_cfg;
+			cmd_update.cmd_type = CAM_ISP_HW_CMD_BUFFER_ALIGNMENT_UPDATE;
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_BUFFER_ALIGNMENT_UPDATE,
+				&cmd_update,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+			if (rc)
+				CAM_ERR(CAM_ISP, "Ctx %d Buffer alignment Update failed",
+					ctx->ctx_index);
+		} else {
+			CAM_ERR(CAM_ISP, "NULL hw_intf! ctx %d", ctx->ctx_index);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_blob_update_out_resource_config(
+	uint32_t                                      blob_type,
+	struct cam_isp_generic_blob_info             *blob_info,
+	struct cam_isp_tfe_out_resource_config       *update_out_cfg,
+	struct cam_hw_prepare_update_args            *prepare)
+{
+	struct cam_isp_tfe_wm_dimension_config       *wm_dim_config;
+	struct cam_kmd_buf_info                      *kmd_buf_info;
+	struct cam_tfe_hw_mgr_ctx                    *ctx = NULL;
+	struct cam_isp_hw_mgr_res                    *hw_mgr_res;
+	struct cam_hw_intf                           *hw_intf;
+	uint32_t                                      res_id_out, i;
+	uint32_t                                      total_used_bytes = 0;
+	uint32_t                                      kmd_buf_remain_size;
+	uint32_t                                     *cmd_buf_addr;
+	uint32_t                                      bytes_used = 0;
+	int                                           num_ent, rc = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries :%d",
+			prepare->num_hw_update_entries);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+
+	for (i = 0; i < update_out_cfg->num_ports; i++) {
+		wm_dim_config = &update_out_cfg->dimension_config[i];
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP, "No free kmd memory for base idx: %d",
+				blob_info->base_info->idx);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			(kmd_buf_info->used_bytes / 4) +
+			(total_used_bytes / 4);
+
+		res_id_out = wm_dim_config->res_id & 0xFF;
+		if (res_id_out >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_ERR(CAM_ISP, "invalid out restype:%x", res_id_out);
+			return -EINVAL;
+		}
+
+		hw_mgr_res = &ctx->res_list_tfe_out[ctx->tfe_out_map[res_id_out]];
+
+		hw_intf = cam_tfe_hw_mgr_get_hw_intf(blob_info->base_info, ctx);
+		rc = cam_isp_add_cmd_buf_update(
+			hw_mgr_res->hw_res[blob_info->base_info->split_id], hw_intf,
+			blob_type, CAM_ISP_HW_CMD_WM_CONFIG_UPDATE,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)wm_dim_config,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed to update %s Out out_type:0x%X base_idx:%d bytes_used:%u rc:%d",
+				"TFE", blob_info->base_info->idx, bytes_used, rc);
+			return rc;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle = kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = total_used_bytes;
+		prepare->hw_update_entries[num_ent].offset = kmd_buf_info->offset;
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IOCFG_BL;
+		num_ent++;
+		kmd_buf_info->used_bytes += total_used_bytes;
+		kmd_buf_info->offset     += total_used_bytes;
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_blob_hfr_update(
+	uint32_t                                  blob_type,
+	struct cam_isp_generic_blob_info         *blob_info,
+	struct cam_isp_tfe_resource_hfr_config   *hfr_config,
+	struct cam_hw_prepare_update_args        *prepare)
+{
+	struct cam_isp_tfe_port_hfr_config    *port_hfr_config;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_tfe_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    num_ent, rc = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+	CAM_DBG(CAM_ISP, "num_ports= %d", hfr_config->num_ports);
+
+	/* Max one hw entries required for hfr config update */
+	if (prepare->num_hw_update_entries + 1 >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < hfr_config->num_ports; i++) {
+		port_hfr_config = &hfr_config->port_hfr_config_flex[i];
+		res_id_out = port_hfr_config->resource_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "hfr config idx %d, type=%d", i,
+			res_id_out);
+
+		if (res_id_out >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_ERR(CAM_ISP, "invalid out restype:%x",
+				port_hfr_config->resource_type);
+			return -EINVAL;
+		}
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+			"no free kmd memory for base %d",
+			blob_info->base_info->idx);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			kmd_buf_info->used_bytes/4 +
+			total_used_bytes/4;
+		hw_mgr_res = &ctx->res_list_tfe_out[ctx->tfe_out_map[res_id_out]];
+
+		if (!hw_mgr_res->hw_res[blob_info->base_info->split_id])
+			return 0;
+
+		hw_intf = cam_tfe_hw_mgr_get_hw_intf(blob_info->base_info, ctx);
+		rc = cam_isp_add_cmd_buf_update(
+			hw_mgr_res->hw_res[blob_info->base_info->split_id], hw_intf,
+			blob_type, CAM_ISP_HW_CMD_GET_HFR_UPDATE,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)port_hfr_config,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed cmd_update, base_idx=%d, rc=%d",
+				blob_info->base_info->idx, bytes_used);
+			return rc;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = total_used_bytes;
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IQ_BL;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		num_ent++;
+		kmd_buf_info->used_bytes += total_used_bytes;
+		kmd_buf_info->offset     += total_used_bytes;
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_blob_csid_clock_update(
+	uint32_t                                   blob_type,
+	struct cam_isp_generic_blob_info          *blob_info,
+	struct cam_isp_tfe_csid_clock_config      *clock_config,
+	struct cam_hw_prepare_update_args         *prepare)
+{
+	struct cam_tfe_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_tfe_csid_clock_update_args  csid_clock_upd_args;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	CAM_DBG(CAM_ISP, "csid clk=%llu", clock_config->csid_clock);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			clk_rate = 0;
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			clk_rate = clock_config->csid_clock;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				csid_clock_upd_args.clk_rate = clk_rate;
+				CAM_DBG(CAM_ISP, "i= %d csid clk=%llu",
+				i, csid_clock_upd_args.clk_rate);
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE,
+					&csid_clock_upd_args,
+					sizeof(
+					struct cam_tfe_csid_clock_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Clock Update failed");
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_tfe_init_config_update(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_isp_init_config           *init_config)
+{
+	int i, rc = 0;
+	struct cam_tfe_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_init_config_update   init_cfg_update;
+	struct cam_hw_intf                    *hw_intf;
+
+	ctx = prepare->ctxt_to_hw_map;
+	init_cfg_update.init_config = init_config;
+
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].hw_type != CAM_ISP_HW_TYPE_TFE)
+			continue;
+
+		hw_intf = g_tfe_hw_mgr.tfe_devices[ctx->base[i].idx]->hw_intf;
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			CAM_DBG(CAM_ISP, "Epoch/init config update for ctx %d",
+				ctx->ctx_index);
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_INIT_CONFIG_UPDATE,
+				&init_cfg_update,
+				sizeof(struct cam_isp_hw_init_config_update));
+			if (rc)
+				CAM_ERR(CAM_ISP, "Epoch/init config failed rc %d ctx %d",
+					rc, ctx->ctx_index);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_blob_clock_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_tfe_clock_config       *clock_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_tfe_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_tfe_clock_update_args       clock_upd_args;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+	uint32_t                               j;
+	bool                                   camif_l_clk_updated = false;
+	bool                                   camif_r_clk_updated = false;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	CAM_DBG(CAM_PERF,
+		"usage=%u left_clk= %lu right_clk=%lu",
+		clock_config->usage_type,
+		clock_config->left_pix_hz,
+		clock_config->right_pix_hz);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			clk_rate = 0;
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if ((hw_mgr_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) ||
+				(hw_mgr_res->res_id == CAM_ISP_HW_TFE_IN_PDLIB)) {
+				if (i == CAM_ISP_HW_SPLIT_LEFT) {
+					if (camif_l_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->left_pix_hz;
+
+					camif_l_clk_updated = true;
+				} else {
+					if (camif_r_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->right_pix_hz;
+
+					camif_r_clk_updated = true;
+				}
+			} else if ((hw_mgr_res->res_id >=
+				CAM_ISP_HW_TFE_IN_RDI0) && (hw_mgr_res->res_id
+				<= CAM_ISP_HW_TFE_IN_RDI2)) {
+				for (j = 0; j < clock_config->num_rdi; j++)
+					clk_rate = max(clock_config->rdi_hz_flex[j],
+						clk_rate);
+			} else {
+				CAM_ERR(CAM_ISP, "Invalid res_id %u",
+					hw_mgr_res->res_id);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				clock_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+				CAM_DBG(CAM_ISP,
+				"res_id=%u i= %d clk=%llu",
+				hw_mgr_res->res_id, i, clk_rate);
+
+				clock_upd_args.clk_rate = clk_rate;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CLOCK_UPDATE,
+					&clock_upd_args,
+					sizeof(
+					struct cam_tfe_clock_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Clock Update failed");
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_blob_bw_limit_update(
+	uint32_t                                   blob_type,
+	struct cam_isp_generic_blob_info          *blob_info,
+	struct cam_isp_tfe_out_rsrc_bw_limiter_config *bw_limit_cfg,
+	struct cam_hw_prepare_update_args         *prepare,
+	enum cam_isp_hw_type                       hw_type)
+{
+	struct cam_isp_tfe_wm_bw_limiter_config   *wm_bw_limit_cfg;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_tfe_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf = NULL;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    num_ent, rc = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	if ((prepare->num_hw_update_entries + 1) >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries: %d max: %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < bw_limit_cfg->num_ports; i++) {
+		wm_bw_limit_cfg = &bw_limit_cfg->bw_limiter_config_flex[i];
+		res_id_out = wm_bw_limit_cfg->res_type & 0xFF;
+
+		if (res_id_out >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_DBG(CAM_ISP, "Invalid out resource id :%x",
+				res_id_out);
+			continue;
+		}
+
+		CAM_DBG(CAM_ISP, "%s BW limit config idx: %d port: 0x%x enable: %d [0x%x:0x%x]",
+			"TFE", i, wm_bw_limit_cfg->res_type, wm_bw_limit_cfg->enable_limiter,
+			wm_bw_limit_cfg->counter_limit[0], wm_bw_limit_cfg->counter_limit[1]);
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"No free kmd memory for base idx: %d",
+				blob_info->base_info->idx);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			(kmd_buf_info->used_bytes / 4) +
+			(total_used_bytes / 4);
+
+		hw_mgr_res = &ctx->res_list_tfe_out[ctx->tfe_out_map[res_id_out]];
+		if (!hw_mgr_res->hw_res[blob_info->base_info->split_id])
+			continue;
+
+		hw_intf = cam_tfe_hw_mgr_get_hw_intf(blob_info->base_info, ctx);
+		rc = cam_isp_add_cmd_buf_update(
+			hw_mgr_res->hw_res[blob_info->base_info->split_id],
+			hw_intf,
+			blob_type,
+			CAM_ISP_HW_CMD_WM_BW_LIMIT_CONFIG,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)wm_bw_limit_cfg,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed to update %s BW limiter config for res:0x%x enable:%d [0x%x:0x%x] base_idx:%d bytes_used:%u rc:%d",
+				"VFE", wm_bw_limit_cfg->res_type, wm_bw_limit_cfg->enable_limiter,
+				wm_bw_limit_cfg->counter_limit[0],
+				wm_bw_limit_cfg->counter_limit[1],
+				blob_info->base_info->idx, bytes_used, rc);
+			return rc;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = total_used_bytes;
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IOCFG_BL;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		num_ent++;
+		kmd_buf_info->used_bytes += total_used_bytes;
+		kmd_buf_info->offset     += total_used_bytes;
+		prepare->num_hw_update_entries = num_ent;
+	}
+	return rc;
+}
+
+static inline int cam_isp_tfe_validate_bw_limiter_blob(
+	uint32_t blob_size,
+	struct cam_isp_tfe_out_rsrc_bw_limiter_config *bw_limit_config)
+{
+	/* Check for blob version */
+	if (bw_limit_config->version != CAM_TFE_BW_LIMITER_CONFIG_V1) {
+		CAM_ERR(CAM_ISP, "Invalid Blob config version:%d", bw_limit_config->version);
+		return -EINVAL;
+	}
+	/* Check for number of out ports*/
+	if (bw_limit_config->num_ports > g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+		CAM_ERR(CAM_ISP, "Invalid num_ports:%u", bw_limit_config->num_ports);
+		return -EINVAL;
+	}
+	/* Check for integer overflow */
+	if (bw_limit_config->num_ports != 1) {
+		if (sizeof(struct cam_isp_tfe_wm_bw_limiter_config) > ((UINT_MAX -
+			sizeof(struct cam_isp_tfe_out_rsrc_bw_limiter_config)) /
+			(bw_limit_config->num_ports - 1))) {
+			CAM_ERR(CAM_ISP,
+				"Max size exceeded in bw limit config num_ports:%u size per port:%lu",
+				bw_limit_config->num_ports,
+				sizeof(struct cam_isp_tfe_wm_bw_limiter_config));
+			return -EINVAL;
+		}
+	}
+	if (blob_size < (sizeof(struct cam_isp_tfe_out_rsrc_bw_limiter_config) +
+		(bw_limit_config->num_ports - 1) *
+		sizeof(struct cam_isp_tfe_wm_bw_limiter_config))) {
+		CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+			blob_size, sizeof(struct cam_isp_tfe_out_rsrc_bw_limiter_config)
+			+ (bw_limit_config->num_ports - 1) *
+			sizeof(struct cam_isp_tfe_wm_bw_limiter_config));
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int cam_isp_tfe_blob_csid_discard_init_frame_update(
+	struct cam_isp_generic_blob_info       *blob_info,
+	struct cam_isp_discard_initial_frames  *discard_config,
+	struct cam_hw_prepare_update_args      *prepare)
+{
+	struct cam_tfe_hw_mgr_ctx                   *ctx = NULL;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_isp_hw_mgr_res                   *hw_mgr_res;
+	struct cam_isp_resource_node                *res;
+	struct cam_tfe_csid_discard_init_frame_args discard_args;
+	int rc = 0, i;
+
+	ctx = prepare->ctxt_to_hw_map;
+	discard_args.num_frames = discard_config->num_frames;
+
+	if (discard_args.num_frames <= 0) {
+		CAM_DBG(CAM_ISP, "Invalid num of frames %d CSID[%u]",
+			discard_args.num_frames, blob_info->base_info->idx);
+		return rc;
+	}
+
+	CAM_DBG(CAM_ISP, "Num of frame to be drop %d on CSID[%u]", discard_args.num_frames,
+		blob_info->base_info->idx);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			res = hw_mgr_res->hw_res[i];
+			if (!(hw_intf && hw_intf->hw_ops.process_cmd))
+				continue;
+
+			if (hw_intf->hw_idx != blob_info->base_info->idx)
+				continue;
+
+			discard_args.res = res;
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_CSID_DISCARD_INIT_FRAMES,
+				&discard_args,
+				sizeof(struct cam_tfe_csid_discard_init_frame_args));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed to update discard frame cfg for res: %s on CSID[%u]",
+					res->res_name, blob_info->base_info->idx);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	int rc = 0, i;
+	struct cam_isp_generic_blob_info  *blob_info = user_data;
+	struct cam_hw_prepare_update_args *prepare = NULL;
+	struct cam_tfe_hw_mgr_ctx *tfe_mgr_ctx = NULL;
+
+	if (!blob_data || (blob_size == 0) || !blob_info) {
+		CAM_ERR(CAM_ISP, "Invalid args data %pK size %d info %pK",
+			blob_data, blob_size, blob_info);
+		return -EINVAL;
+	}
+
+	prepare = blob_info->prepare;
+	if (!prepare) {
+		CAM_ERR(CAM_ISP, "Failed. prepare is NULL, blob_type %d",
+			blob_type);
+		return -EINVAL;
+	}
+
+	tfe_mgr_ctx = prepare->ctxt_to_hw_map;
+	CAM_DBG(CAM_ISP, "BLOB Type: %d", blob_type);
+	switch (blob_type) {
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_HFR_CONFIG: {
+		struct cam_isp_tfe_resource_hfr_config    *hfr_config =
+			(struct cam_isp_tfe_resource_hfr_config *)blob_data;
+
+		if (blob_size <
+			sizeof(struct cam_isp_tfe_resource_hfr_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		if (hfr_config->num_ports > g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in hfr config",
+				hfr_config->num_ports);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (hfr_config->num_ports > 1) {
+			if (sizeof(struct cam_isp_tfe_resource_hfr_config) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_tfe_resource_hfr_config))
+				/ (hfr_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in hfr config num_ports:%u size per port:%lu",
+					hfr_config->num_ports,
+					sizeof(struct
+					cam_isp_tfe_resource_hfr_config));
+				return -EINVAL;
+			}
+		}
+
+		if ((hfr_config->num_ports != 0) && (blob_size <
+			(sizeof(struct cam_isp_tfe_resource_hfr_config) +
+			(hfr_config->num_ports - 1) *
+			sizeof(struct cam_isp_tfe_port_hfr_config)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_isp_tfe_resource_hfr_config) +
+				(hfr_config->num_ports - 1) *
+				sizeof(struct cam_isp_tfe_resource_hfr_config));
+			return -EINVAL;
+		}
+
+		rc = cam_isp_tfe_blob_hfr_update(blob_type, blob_info,
+			hfr_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "HFR Update Failed");
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_CLOCK_CONFIG: {
+		struct cam_isp_tfe_clock_config    *clock_config =
+			(struct cam_isp_tfe_clock_config *)blob_data;
+
+		if (blob_size < sizeof(struct cam_isp_tfe_clock_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		if (clock_config->num_rdi > CAM_TFE_RDI_NUM_MAX) {
+			CAM_ERR(CAM_ISP, "Invalid num_rdi %u in clock config",
+				clock_config->num_rdi);
+			return -EINVAL;
+		}
+		/* Check integer overflow */
+		if (clock_config->num_rdi > 1) {
+			if (sizeof(uint64_t) > ((UINT_MAX-
+				sizeof(struct cam_isp_tfe_clock_config))/
+				(clock_config->num_rdi - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in clock config num_rdi:%u size per port:%lu",
+					clock_config->num_rdi,
+					sizeof(uint64_t));
+				return -EINVAL;
+			}
+		}
+
+		if ((clock_config->num_rdi != 0) && (blob_size <
+			(sizeof(struct cam_isp_tfe_clock_config) +
+			sizeof(uint64_t) * (clock_config->num_rdi - 1)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(uint32_t) * 2 + sizeof(uint64_t) *
+				(clock_config->num_rdi + 2));
+			return -EINVAL;
+		}
+
+		rc = cam_isp_tfe_blob_clock_update(blob_type, blob_info,
+			clock_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Clock Update Failed");
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_BW_CONFIG_V2: {
+		struct cam_isp_tfe_bw_config_v2    *bw_config =
+			(struct cam_isp_tfe_bw_config_v2 *)blob_data;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+		struct cam_cpas_axi_per_path_bw_vote *path_vote;
+
+		if (blob_size < sizeof(struct cam_isp_tfe_bw_config_v2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		if ((bw_config->num_paths > CAM_ISP_MAX_PER_PATH_VOTES) ||
+			!bw_config->num_paths) {
+			CAM_ERR(CAM_ISP, "Invalid num paths %d",
+				bw_config->num_paths);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (bw_config->num_paths > 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_tfe_bw_config_v2)) /
+				(bw_config->num_paths - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Size exceeds limit paths:%u size per path:%lu",
+					bw_config->num_paths - 1,
+					sizeof(
+					struct cam_axi_per_path_bw_vote));
+				return -EINVAL;
+			}
+		}
+
+		if ((bw_config->num_paths != 0) && (blob_size <
+			(sizeof(struct cam_isp_tfe_bw_config_v2) +
+			((bw_config->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote))))) {
+			CAM_ERR(CAM_ISP,
+				"Invalid blob size: %u, num_paths: %u, bw_config size: %lu, per_path_vote size: %lu",
+				blob_size, bw_config->num_paths,
+				sizeof(struct cam_isp_tfe_bw_config_v2),
+				sizeof(struct cam_axi_per_path_bw_vote));
+			return -EINVAL;
+		}
+
+		if (!prepare || !prepare->priv ||
+			(bw_config->usage_type >= CAM_TFE_HW_NUM_MAX)) {
+			CAM_ERR(CAM_ISP, "Invalid inputs");
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *) prepare->priv;
+		memset(&prepare_hw_data->bw_clk_config.bw_config_v2,
+			0, sizeof(prepare_hw_data->bw_clk_config.bw_config_v2));
+		prepare_hw_data->bw_clk_config.bw_config_v2.usage_type = bw_config->usage_type;
+		prepare_hw_data->bw_clk_config.bw_config_v2.num_paths = bw_config->num_paths;
+
+		for (i = 0; i < bw_config->num_paths; i++) {
+			path_vote = &prepare_hw_data->bw_clk_config.bw_config_v2.axi_path[i];
+			path_vote->usage_data = bw_config->axi_path_flex[i].usage_data;
+			path_vote->transac_type = bw_config->axi_path_flex[i].transac_type;
+			path_vote->path_data_type = bw_config->axi_path_flex[i].path_data_type;
+			path_vote->vote_level = 0;
+			path_vote->camnoc_bw = bw_config->axi_path_flex[i].camnoc_bw;
+			path_vote->mnoc_ab_bw = bw_config->axi_path_flex[i].mnoc_ab_bw;
+			path_vote->mnoc_ib_bw = bw_config->axi_path_flex[i].mnoc_ib_bw;
+		}
+
+		tfe_mgr_ctx->bw_config_version = CAM_ISP_BW_CONFIG_V2;
+		prepare_hw_data->bw_clk_config.bw_config_valid = true;
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG: {
+		struct cam_isp_tfe_csid_clock_config    *clock_config =
+			(struct cam_isp_tfe_csid_clock_config *)blob_data;
+
+		if (blob_size < sizeof(struct cam_isp_tfe_csid_clock_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %u",
+				blob_size,
+				sizeof(struct cam_isp_tfe_csid_clock_config));
+			return -EINVAL;
+		}
+		rc = cam_isp_tfe_blob_csid_clock_update(blob_type, blob_info,
+			clock_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Clock Update Failed");
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_BW_LIMITER_CFG: {
+		struct cam_isp_tfe_out_rsrc_bw_limiter_config *bw_limit_config;
+
+		if (blob_size <
+			sizeof(struct cam_isp_tfe_out_rsrc_bw_limiter_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_isp_tfe_out_rsrc_bw_limiter_config));
+			return -EINVAL;
+		}
+
+		bw_limit_config = (struct cam_isp_tfe_out_rsrc_bw_limiter_config *)blob_data;
+		rc = cam_isp_tfe_validate_bw_limiter_blob(blob_size, bw_limit_config);
+		if (rc)
+			return rc;
+
+		rc = cam_isp_tfe_blob_bw_limit_update(blob_type, blob_info,
+			bw_limit_config, prepare, CAM_ISP_HW_TYPE_TFE);
+		if (rc)
+			CAM_ERR(CAM_ISP, "BW limit update failed for TFE rc: %d", rc);
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_DYNAMIC_MODE_SWITCH: {
+		struct cam_isp_mode_switch_info         *mup_config;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+
+		if (blob_size < sizeof(struct cam_isp_mode_switch_info)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_isp_mode_switch_info));
+			return -EINVAL;
+		}
+
+		mup_config = (struct cam_isp_mode_switch_info *)blob_data;
+		CAM_DBG(CAM_ISP,
+			"Ctx id %d request id %lld csid mup value=%u num_exposures=%d",
+			tfe_mgr_ctx->ctx_index, prepare->packet->header.request_id,
+			mup_config->mup, mup_config->num_expoures);
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data *)prepare->priv;
+
+		prepare_hw_data->mup_en = true;
+		prepare_hw_data->mup_val = mup_config->mup;
+		prepare_hw_data->num_exp = mup_config->num_expoures;
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_INIT_CONFIG: {
+		struct cam_isp_init_config            *init_config;
+		struct cam_isp_prepare_hw_update_data *prepare_hw_data;
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data *)prepare->priv;
+
+		if (prepare_hw_data->packet_opcode_type != CAM_ISP_PACKET_INIT_DEV) {
+			CAM_ERR(CAM_ISP,
+				"Epoch config blob not supported packet type: %u req: %llu Ctx %d",
+				prepare_hw_data->packet_opcode_type,
+				prepare->packet->header.request_id,
+				tfe_mgr_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (blob_size != sizeof(struct cam_isp_init_config)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid init config blob size %u expected %u ctx %d",
+				blob_size, sizeof(struct cam_isp_init_config),
+				tfe_mgr_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		init_config = (struct cam_isp_init_config *)blob_data;
+		rc = cam_isp_blob_tfe_init_config_update(prepare, init_config);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Init config failed for req: %llu rc: %d ctx %d",
+				prepare->packet->header.request_id, rc, tfe_mgr_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_ALIGNMENT_OFFSET_INFO: {
+		struct cam_isp_tfe_alignment_resource_info   *alignment_info =
+			(struct cam_isp_tfe_alignment_resource_info *)blob_data;
+
+		if (tfe_mgr_ctx->is_dual || !tfe_mgr_ctx->is_shdr) {
+			CAM_ERR(CAM_ISP, "Alignment blob can't be use in dual mode ctx %d",
+				tfe_mgr_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (blob_size < sizeof(struct cam_isp_tfe_alignment_resource_info)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid alignment blob size %u expected %u ctx %d",
+				blob_size, sizeof(struct cam_isp_tfe_alignment_resource_info),
+				tfe_mgr_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		if (alignment_info->num_ports > g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in alignment config",
+				alignment_info->num_ports);
+			return -EINVAL;
+		}
+
+		if ((alignment_info->num_ports != 0) && (blob_size <
+			(sizeof(struct cam_isp_tfe_alignment_resource_info) +
+			(alignment_info->num_ports - 1) *
+			sizeof(struct cam_isp_tfe_alignment_offset_config)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_isp_tfe_alignment_resource_info) +
+				(alignment_info->num_ports - 1) *
+				sizeof(struct cam_isp_tfe_alignment_offset_config));
+			return -EINVAL;
+		}
+
+		rc = cam_isp_tfe_blob_buffer_alignment_update(blob_type, blob_info,
+			alignment_info, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Alignment buffer update failed for req %lld rc %d ctx %d",
+				 prepare->packet->header.request_id, rc, tfe_mgr_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_UPDATE_OUT_RES: {
+		struct cam_isp_tfe_out_resource_config        *update_out_config =
+			(struct cam_isp_tfe_out_resource_config *)blob_data;
+
+		if (update_out_config->num_ports > g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in update out config",
+				update_out_config->num_ports);
+			return -EINVAL;
+		}
+
+		if (update_out_config->num_ports > 1) {
+			if (sizeof(struct cam_isp_tfe_out_resource_config) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_tfe_out_resource_config))
+				/ (update_out_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in hfr config num_ports:%u size per port:%lu",
+					update_out_config->num_ports,
+					sizeof(struct cam_isp_tfe_out_resource_config));
+				return -EINVAL;
+			}
+		}
+
+		if ((update_out_config->num_ports != 0) && (blob_size <
+			(sizeof(struct cam_isp_tfe_out_resource_config) +
+			(update_out_config->num_ports - 1) *
+			sizeof(struct cam_isp_tfe_wm_dimension_config)))) {
+
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_isp_tfe_out_resource_config) +
+				(update_out_config->num_ports - 1) *
+				sizeof(struct cam_isp_tfe_wm_dimension_config));
+			return -EINVAL;
+		}
+
+		rc = cam_isp_tfe_blob_update_out_resource_config(blob_type, blob_info,
+			update_out_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Update out resource failed for req %lld rc %d ctx %d",
+				prepare->packet->header.request_id, rc, tfe_mgr_ctx->ctx_index);
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_DISCARD_INITIAL_FRAMES: {
+		struct cam_isp_discard_initial_frames *discard_config;
+
+		if (blob_size < sizeof(struct cam_isp_tfe_discard_initial_frames)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid discard frames blob size %u expected %u",
+				blob_size, sizeof(struct cam_isp_discard_initial_frames));
+			return -EINVAL;
+		}
+
+		discard_config = (struct cam_isp_discard_initial_frames *)blob_data;
+
+		rc = cam_isp_tfe_blob_csid_discard_init_frame_update(
+			blob_info, discard_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Discard init frames update failed rc %d req %lld",
+				rc, prepare->packet->header.request_id);
+	}
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "Invalid blob type %d ctx %d", blob_type,
+			tfe_mgr_ctx->ctx_index);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_update_dual_config(
+	struct cam_cmd_buf_desc            *cmd_desc,
+	uint32_t                            split_id,
+	uint32_t                            base_idx,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint8_t                            *out_map,
+	uint32_t                            size_isp_out)
+{
+	int rc = -EINVAL;
+	struct cam_isp_tfe_dual_config             *dual_config;
+	struct cam_isp_hw_mgr_res                  *hw_mgr_res;
+	struct cam_isp_resource_node               *res;
+	struct cam_tfe_dual_update_args             dual_isp_update_args;
+	uint32_t                                    outport_id;
+	size_t                                      len = 0, remain_len = 0;
+	uint32_t                                   *cpu_addr;
+	uint32_t                                    i, j, stp_index;
+
+	CAM_DBG(CAM_ISP, "cmd des size %d, length: %d",
+		cmd_desc->size, cmd_desc->length);
+
+	rc = cam_packet_util_get_cmd_mem_addr(
+		cmd_desc->mem_handle, &cpu_addr, &len);
+	if (rc) {
+		CAM_DBG(CAM_ISP, "unable to get cmd mem addr handle:0x%x",
+			cmd_desc->mem_handle);
+		return rc;
+	}
+
+	if ((len < sizeof(struct cam_isp_tfe_dual_config)) ||
+		(cmd_desc->offset >=
+			(len - sizeof(struct cam_isp_tfe_dual_config)))) {
+		CAM_ERR(CAM_ISP, "not enough buffer provided");
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+
+	remain_len = len - cmd_desc->offset;
+	cpu_addr += (cmd_desc->offset / 4);
+	dual_config = (struct cam_isp_tfe_dual_config *)cpu_addr;
+
+	if ((dual_config->num_ports *
+		sizeof(struct cam_isp_tfe_dual_stripe_config)) >
+		(remain_len -
+			offsetof(struct cam_isp_tfe_dual_config, stripes))) {
+		CAM_ERR(CAM_ISP, "not enough buffer for all the dual configs");
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "num_ports:%d", dual_config->num_ports);
+	if (dual_config->num_ports >= size_isp_out) {
+		CAM_ERR(CAM_UTIL,
+			"inval num ports %d max num tfe ports:%d",
+			dual_config->num_ports, size_isp_out);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	for (i = 0; i < dual_config->num_ports; i++) {
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			stp_index = (i * CAM_PACKET_MAX_PLANES) +
+				(j * (CAM_PACKET_MAX_PLANES *
+				dual_config->num_ports));
+
+			if (!dual_config->stripes_flex[stp_index].port_id)
+				continue;
+
+			outport_id = dual_config->stripes_flex[stp_index].port_id;
+			if (outport_id >= size_isp_out) {
+				CAM_ERR(CAM_UTIL,
+					"inval outport id:%d i:%d j:%d num ports:%d ",
+					outport_id, i, j,
+					dual_config->num_ports);
+					rc = -EINVAL;
+					goto end;
+			}
+
+			hw_mgr_res = &res_list_isp_out[out_map[outport_id & 0xFF]];
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			res = hw_mgr_res->hw_res[j];
+
+			if (res->res_id < CAM_ISP_TFE_OUT_RES_BASE ||
+				res->res_id >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+				CAM_DBG(CAM_ISP, "res id :%d", res->res_id);
+				continue;
+			}
+
+			dual_isp_update_args.split_id = j;
+			dual_isp_update_args.res      = res;
+			dual_isp_update_args.stripe_config =
+				&dual_config->stripes_flex[stp_index];
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_STRIPE_UPDATE,
+				&dual_isp_update_args,
+				sizeof(struct cam_tfe_dual_update_args));
+			if (rc)
+				goto end;
+		}
+	}
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+int cam_tfe_add_command_buffers(
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	struct cam_isp_ctx_base_info       *base_info,
+	cam_packet_generic_blob_handler     blob_handler_cb,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint8_t                            *out_map,
+	uint32_t                            size_isp_out)
+{
+	int rc = 0;
+	uint32_t                           cmd_meta_data, num_ent, i;
+	uint32_t                           base_idx;
+	enum cam_isp_hw_split_id           split_id;
+	struct cam_cmd_buf_desc           *cmd_desc = NULL;
+	struct cam_hw_update_entry        *hw_entry = NULL;
+
+	split_id = base_info->split_id;
+	base_idx = base_info->idx;
+	hw_entry = prepare->hw_update_entries;
+	/*
+	 * set the cmd_desc to point the first command descriptor in the
+	 * packet
+	 */
+	cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint8_t *)&prepare->packet->payload_flex +
+			prepare->packet->cmd_buf_offset);
+
+	CAM_DBG(CAM_ISP, "split id = %d, number of command buffers:%d",
+		split_id, prepare->packet->num_cmd_buf);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		num_ent = prepare->num_hw_update_entries;
+		if (!cmd_desc[i].length)
+			continue;
+
+		/* One hw entry space required for left or right or common */
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		cmd_meta_data = cmd_desc[i].meta_data;
+
+		CAM_DBG(CAM_ISP, "meta type: %d, split_id: %d",
+			cmd_meta_data, split_id);
+
+		switch (cmd_meta_data) {
+		case CAM_ISP_TFE_PACKET_META_BASE:
+		case CAM_ISP_TFE_PACKET_META_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle =
+					cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				CAM_DBG(CAM_ISP,
+					"Meta_Left num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_TFE_PACKET_META_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle =
+					cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				CAM_DBG(CAM_ISP,
+					"Meta_Right num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_TFE_PACKET_META_COMMON:
+			hw_entry[num_ent].len = cmd_desc[i].length;
+			hw_entry[num_ent].handle =
+				cmd_desc[i].mem_handle;
+			hw_entry[num_ent].offset = cmd_desc[i].offset;
+			hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+			CAM_DBG(CAM_ISP,
+				"Meta_Common num_ent=%d handle=0x%x, len=%u, offset=%u",
+				num_ent,
+				hw_entry[num_ent].handle,
+				hw_entry[num_ent].len,
+				hw_entry[num_ent].offset);
+			if (cmd_meta_data == CAM_ISP_PACKET_META_DMI_COMMON)
+				hw_entry[num_ent].flags = 0x1;
+
+			num_ent++;
+			break;
+		case CAM_ISP_TFE_PACKET_META_DUAL_CONFIG:
+
+			rc = cam_tfe_update_dual_config(&cmd_desc[i], split_id,
+				base_idx, res_list_isp_out, out_map, size_isp_out);
+
+			if (rc)
+				return rc;
+			break;
+		case CAM_ISP_TFE_PACKET_META_GENERIC_BLOB_LEFT:
+		case CAM_ISP_TFE_PACKET_META_GENERIC_BLOB_RIGHT:
+		case CAM_ISP_TFE_PACKET_META_GENERIC_BLOB_COMMON: {
+			struct cam_isp_generic_blob_info   blob_info;
+
+			prepare->num_hw_update_entries = num_ent;
+			blob_info.prepare = prepare;
+			blob_info.base_info = base_info;
+			blob_info.kmd_buf_info = kmd_buf_info;
+
+			rc = cam_packet_util_process_generic_cmd_buffer(
+				&cmd_desc[i],
+				blob_handler_cb,
+				&blob_info);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in processing blobs %d", rc);
+				return rc;
+			}
+			hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+			num_ent = prepare->num_hw_update_entries;
+		}
+			break;
+		case CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_FLUSH:
+		case CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR:
+		case CAM_ISP_TFE_PACKET_META_REG_DUMP_PER_REQUEST:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				if (prepare->num_reg_dump_buf >=
+					CAM_REG_DUMP_MAX_BUF_ENTRIES) {
+					CAM_ERR(CAM_ISP,
+					"Descriptor count out of bounds: %d",
+					prepare->num_reg_dump_buf);
+					return -EINVAL;
+				}
+				prepare->reg_dump_buf_desc[
+					prepare->num_reg_dump_buf] =
+					cmd_desc[i];
+				prepare->num_reg_dump_buf++;
+				CAM_DBG(CAM_ISP,
+					"Added command buffer: %d desc_count: %d",
+					cmd_desc[i].meta_data,
+					prepare->num_reg_dump_buf);
+			}
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "invalid cdm command meta data %d",
+				cmd_meta_data);
+			return -EINVAL;
+		}
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int rc = 0;
+	struct cam_hw_prepare_update_args       *prepare =
+		(struct cam_hw_prepare_update_args *) prepare_hw_update_args;
+	struct cam_tfe_hw_mgr_ctx               *ctx;
+	struct cam_tfe_hw_mgr                   *hw_mgr;
+	uint32_t                                 i;
+	bool                                     fill_fence = true;
+	struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+	struct cam_isp_frame_header_info         frame_header_info;
+	struct cam_isp_change_base_args          change_base_info = {0};
+	struct cam_isp_check_io_cfg_for_scratch  check_for_scratch = {0};
+	struct cam_isp_io_buf_info               io_buf_info = {0};
+	struct cam_isp_mode_switch_data          mup_config;
+
+	if (!hw_mgr_priv || !prepare_hw_update_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_REQ, "Enter for req_id %lld",
+		prepare->packet->header.request_id);
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+		prepare->priv;
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *) prepare->ctxt_to_hw_map;
+	hw_mgr = (struct cam_tfe_hw_mgr *)hw_mgr_priv;
+
+	rc = cam_packet_util_validate_packet(prepare->packet,
+		prepare->remain_len);
+	if (rc)
+		return rc;
+
+	/* Pre parse the packet*/
+	rc = cam_packet_util_get_kmd_buffer(prepare->packet, &prepare_hw_data->kmd_cmd_buff_info);
+	if (rc)
+		return rc;
+
+	rc = cam_packet_util_process_patches(prepare->packet,
+		prepare->buf_tracker, hw_mgr->mgr_common.cmd_iommu_hdl,
+		hw_mgr->mgr_common.cmd_iommu_hdl_secure, false);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Patch ISP packet failed.");
+		return rc;
+	}
+
+	prepare->num_hw_update_entries = 0;
+	prepare->num_in_map_entries = 0;
+	prepare->num_out_map_entries = 0;
+	prepare->num_reg_dump_buf = 0;
+
+	for (i = 0; i < ctx->num_base; i++) {
+		CAM_DBG(CAM_ISP, "process cmd buffer for device %d", i);
+
+		CAM_DBG(CAM_ISP,
+			"change base i=%d, idx=%d",
+			i, ctx->base[i].idx);
+
+		change_base_info.base_idx = ctx->base[i].idx;
+		change_base_info.cdm_id = ctx->cdm_id;
+
+		/* Add change base */
+		rc = cam_isp_add_change_base(prepare, &ctx->res_list_tfe_in,
+			&change_base_info, &prepare_hw_data->kmd_cmd_buff_info);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in change base i=%d, idx=%d, rc=%d",
+				i, ctx->base[i].idx, rc);
+			goto end;
+		}
+
+		/* get command buffers */
+		if (ctx->base[i].split_id != CAM_ISP_HW_SPLIT_MAX) {
+			rc = cam_tfe_add_command_buffers(prepare,
+				&prepare_hw_data->kmd_cmd_buff_info,
+				&ctx->base[i],
+				cam_isp_tfe_packet_generic_blob_handler,
+				ctx->res_list_tfe_out,
+				ctx->tfe_out_map,
+				g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in add cmdbuf, i=%d, split_id=%d, rc=%d",
+					i, ctx->base[i].split_id, rc);
+				goto end;
+			}
+		}
+
+		memset(&frame_header_info, 0,
+			sizeof(struct cam_isp_frame_header_info));
+		frame_header_info.frame_header_enable = false;
+
+		prepare_hw_data->wm_bitmask = ctx->acquired_wm_mask;
+
+		/* get IO buffers */
+		io_buf_info.frame_hdr = &frame_header_info;
+		io_buf_info.scratch_check_cfg = &check_for_scratch;
+		io_buf_info.prepare = prepare;
+		io_buf_info.kmd_buf_info = &prepare_hw_data->kmd_cmd_buff_info;
+		io_buf_info.res_list_in_rd = NULL;
+		io_buf_info.iommu_hdl = hw_mgr->mgr_common.img_iommu_hdl;
+		io_buf_info.sec_iommu_hdl = hw_mgr->mgr_common.img_iommu_hdl_secure;
+		io_buf_info.base = &ctx->base[i];
+		io_buf_info.fill_fence = fill_fence;
+		io_buf_info.out_base = CAM_ISP_TFE_OUT_RES_BASE;
+		io_buf_info.out_max = g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type;
+		io_buf_info.res_list_isp_out = ctx->res_list_tfe_out;
+		io_buf_info.out_map = ctx->tfe_out_map;
+		rc = cam_isp_add_io_buffers(&io_buf_info);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in io buffers, i=%d, rc=%d",
+				i, rc);
+			goto end;
+		}
+
+		/* fence map table entries need to fill only once in the loop */
+		if (fill_fence)
+			fill_fence = false;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"num_reg_dump_buf=%d ope code:%d",
+		prepare->num_reg_dump_buf, prepare->packet->header.op_code);
+
+	/* reg update will be done later for the initial configure */
+	if (((prepare->packet->header.op_code) & 0xF) ==
+		CAM_ISP_PACKET_INIT_DEV) {
+		prepare_hw_data->packet_opcode_type =
+			CAM_ISP_TFE_PACKET_INIT_DEV;
+
+		if ((!prepare->num_reg_dump_buf) || (prepare->num_reg_dump_buf >
+			CAM_REG_DUMP_MAX_BUF_ENTRIES))
+			goto end;
+
+		if (!ctx->num_reg_dump_buf) {
+			ctx->num_reg_dump_buf =
+				prepare->num_reg_dump_buf;
+			memcpy(ctx->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare->num_reg_dump_buf);
+		} else {
+			prepare_hw_data->num_reg_dump_buf =
+				prepare->num_reg_dump_buf;
+			memcpy(prepare_hw_data->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare_hw_data->num_reg_dump_buf);
+		}
+
+		goto end;
+	} else  {
+		prepare_hw_data->packet_opcode_type = CAM_ISP_TFE_PACKET_CONFIG_DEV;
+		prepare_hw_data->num_reg_dump_buf = prepare->num_reg_dump_buf;
+		if ((prepare_hw_data->num_reg_dump_buf) &&
+			(prepare_hw_data->num_reg_dump_buf < CAM_REG_DUMP_MAX_BUF_ENTRIES)) {
+			memcpy(prepare_hw_data->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare_hw_data->num_reg_dump_buf);
+		}
+	}
+
+	/* add reg update commands */
+	for (i = 0; i < ctx->num_base; i++) {
+		change_base_info.base_idx = ctx->base[i].idx;
+		change_base_info.cdm_id = ctx->cdm_id;
+		/* Add change base */
+		rc = cam_isp_add_change_base(prepare, &ctx->res_list_tfe_in,
+			&change_base_info, &prepare_hw_data->kmd_cmd_buff_info);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in change base adding reg_update cmd i=%d, idx=%d, rc=%d",
+				i, ctx->base[i].idx, rc);
+			goto end;
+		}
+
+		mup_config.mup = prepare_hw_data->mup_val;
+		mup_config.num_expoures = prepare_hw_data->num_exp;
+		mup_config.mup_en = prepare_hw_data->mup_en;
+
+		if (ctx->is_shdr_slave)
+			continue;
+
+		/*Add reg update */
+		rc = cam_isp_add_reg_update(prepare, &ctx->res_list_tfe_in,
+			ctx->base[i].idx, &prepare_hw_data->kmd_cmd_buff_info, false, &mup_config);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Add Reg_update cmd Failed i=%d, idx=%d, rc=%d",
+				i, ctx->base[i].idx, rc);
+			goto end;
+		}
+	}
+
+	if (prepare_hw_data->kmd_cmd_buff_info.size <=
+		prepare_hw_data->kmd_cmd_buff_info.used_bytes) {
+		CAM_ERR(CAM_ISP, "No Sufficient memory for the Gen IRQ command");
+		rc = -ENOMEM;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_tfe_mgr_resume_hw(struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	return cam_tfe_mgr_bw_control(ctx, CAM_TFE_BW_CONTROL_INCLUDE);
+}
+
+static int cam_tfe_mgr_cmd_get_last_consumed_addr(
+	struct cam_tfe_hw_mgr_ctx         *ctx,
+	struct cam_isp_hw_done_event_data *done)
+{
+	int                           i, rc = -EINVAL;
+	uint32_t                      res_id_out;
+	struct cam_isp_resource_node *res;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res;
+
+	res_id_out = done->resource_handle & 0xFF;
+
+	if (res_id_out >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+		CAM_ERR(CAM_ISP, "Invalid out resource id :%x",
+			res_id_out);
+		return rc;
+	}
+
+	hw_mgr_res =
+		&ctx->res_list_tfe_out[ctx->tfe_out_map[res_id_out]];
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+
+		res = hw_mgr_res->hw_res[i];
+		rc = res->hw_intf->hw_ops.process_cmd(
+			res->hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_GET_LAST_CONSUMED_ADDR,
+			done, sizeof(struct cam_isp_hw_done_event_data));
+
+		return rc;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_sof_irq_debug(
+	struct cam_tfe_hw_mgr_ctx *ctx,
+	uint32_t sof_irq_enable)
+{
+	int rc = 0;
+	uint32_t i = 0;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res = NULL;
+	struct cam_hw_intf            *hw_intf = NULL;
+	struct cam_isp_resource_node  *rsrc_node = NULL;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc |= hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_TFE_CSID_SOF_IRQ_DEBUG,
+					&sof_irq_enable,
+					sizeof(sof_irq_enable));
+			}
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rsrc_node = hw_mgr_res->hw_res[i];
+			if (rsrc_node->process_cmd && (rsrc_node->res_id ==
+				CAM_ISP_HW_TFE_IN_CAMIF)) {
+				rc |= hw_mgr_res->hw_res[i]->process_cmd(
+					hw_mgr_res->hw_res[i],
+					CAM_ISP_HW_CMD_SOF_IRQ_DEBUG,
+					&sof_irq_enable,
+					sizeof(sof_irq_enable));
+			}
+		}
+	}
+
+	return rc;
+}
+
+static void cam_tfe_mgr_pf_dump(uint32_t res_id,
+	struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_hw_intf               *hw_intf;
+	struct cam_isp_hw_get_cmd_update  cmd_update;
+	uint32_t                          res_id_out;
+	int  i, rc = 0;
+
+	/* dump the registers  */
+	rc = cam_tfe_mgr_handle_reg_dump(ctx, ctx->reg_dump_buf_desc,
+		ctx->num_reg_dump_buf,
+		CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR, NULL, false);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Reg dump on pf failed req id: %llu rc: %d",
+			ctx->applied_req_id, rc);
+	}
+
+	/* dump the acquire data */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_TFE_CSID_LOG_ACQUIRE_DATA,
+					hw_mgr_res->hw_res[i],
+					sizeof(void *));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"acquire dump data failed");
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	res_id_out = res_id & 0xFF;
+
+	if (res_id_out >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+		CAM_ERR(CAM_ISP, "Invalid out resource id :%x",
+			res_id);
+		return;
+	}
+
+	hw_mgr_res =
+		&ctx->res_list_tfe_out[res_id_out];
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+
+		cmd_update.cmd_type = CAM_ISP_HW_CMD_DUMP_BUS_INFO;
+		cmd_update.res = hw_mgr_res->hw_res[i];
+		hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.process_cmd) {
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+				(void *)&cmd_update,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+		}
+	}
+}
+
+static int cam_tfe_mgr_prog_default_settings(struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	int rc = 0, i;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+	struct cam_isp_resource_node    *res;
+	struct list_head                *res_list;
+	struct cam_isp_hw_get_cmd_update    rup_args;
+	struct cam_isp_mode_switch_data     mup_config;
+
+
+	res_list = &ctx->res_list_tfe_in;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		if (hw_mgr_res->res_type != CAM_ISP_RESOURCE_TFE_IN)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rup_args.res = hw_mgr_res->hw_res[i];
+			rup_args.cmd.cmd_buf_addr = NULL;
+			rup_args.cmd.size = 0;
+			rup_args.cmd_type = CAM_ISP_HW_CMD_GET_REG_UPDATE;
+			rup_args.reg_write = true;
+
+			mup_config.mup = ctx->current_mup;
+
+			rup_args.data = &mup_config;
+
+			res = rup_args.res;
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_REG_UPDATE, &rup_args,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "failed for TFE: %d mup: %d ctx id:%d",
+					res->hw_intf->hw_idx, ctx->current_mup, ctx->ctx_index);
+				return rc;
+			}
+
+			CAM_DBG(CAM_ISP,
+				"Reg update for TFE: %d mup: %d ctx id:%d",
+				res->hw_intf->hw_idx, ctx->current_mup, ctx->ctx_index);
+		}
+
+	}
+
+	return rc;
+}
+
+static void cam_tfe_mgr_dump_pf_data(
+	struct cam_tfe_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args *hw_cmd_args)
+{
+	struct cam_tfe_hw_mgr_ctx           *ctx;
+	struct cam_isp_hw_mgr_res           *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update     cmd_update;
+	struct cam_isp_hw_get_res_for_mid    get_res;
+	struct cam_packet                   *packet = NULL;
+	struct cam_hw_cmd_pf_args           *pf_cmd_args;
+	uint32_t  *resource_type;
+	uint32_t   hw_id;
+	bool      *ctx_found, hw_id_found = false;
+	int        i, j, rc = 0;
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)hw_cmd_args->ctxt_to_hw_map;
+
+	pf_cmd_args = hw_cmd_args->u.pf_cmd_args;
+	rc = cam_packet_util_get_packet_addr(&packet,
+		pf_cmd_args->pf_req_info->packet_handle,
+		pf_cmd_args->pf_req_info->packet_offset);
+	if (rc)
+		return;
+	ctx_found = &pf_cmd_args->pf_args->pf_context_info.ctx_found;
+	resource_type = &pf_cmd_args->pf_args->pf_context_info.resource_type;
+
+	if ((*ctx_found) && (*resource_type))
+		goto outportlog;
+
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (!g_tfe_hw_mgr.tfe_devices[i])
+			continue;
+
+		for (j = 0; j < g_tfe_hw_mgr.tfe_devices[i]->num_hw_pid; j++) {
+			if (g_tfe_hw_mgr.tfe_devices[i]->hw_pid[j] ==
+				pf_cmd_args->pf_args->pf_smmu_info->pid) {
+				hw_id_found = true;
+				hw_id = i;
+				break;
+			}
+		}
+		if (hw_id_found)
+			break;
+	}
+
+	if (i == CAM_TFE_HW_NUM_MAX) {
+		CAM_INFO(CAM_ISP,
+			"PID:%d  is not matching with any TFE HW PIDs ctx id:%d",
+			pf_cmd_args->pf_args->pf_smmu_info->pid,  ctx->ctx_index);
+		cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
+		return;
+	}
+
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].idx == hw_id) {
+			*ctx_found = true;
+			break;
+		}
+	}
+
+	if (!(*ctx_found)) {
+		CAM_INFO(CAM_ISP,
+			"This context does not cause pf:pid:%d hw id:%d ctx_id:%d",
+			pf_cmd_args->pf_args->pf_smmu_info->pid, hw_id, ctx->ctx_index);
+		cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
+		return;
+	}
+
+	for (i = 0; i < ctx->num_acq_tfe_out; i++) {
+		hw_mgr_res = &ctx->res_list_tfe_out[i];
+		if (!hw_mgr_res->hw_res[0])
+			continue;
+		break;
+	}
+
+	if (i >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+		CAM_ERR(CAM_ISP,
+			"NO valid outport resources ctx id:%d req id:%lld",
+			ctx->ctx_index, packet->header.request_id);
+		cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
+		return;
+	}
+
+	get_res.mid = pf_cmd_args->pf_args->pf_smmu_info->mid;
+	get_res.pid = pf_cmd_args->pf_args->pf_smmu_info->pid;
+	cmd_update.res = hw_mgr_res->hw_res[0];
+	cmd_update.cmd_type = CAM_ISP_HW_CMD_GET_RES_FOR_MID;
+	cmd_update.data = (void *) &get_res;
+
+	/* get resource id for given mid */
+	rc = hw_mgr_res->hw_res[0]->hw_intf->hw_ops.process_cmd(
+		hw_mgr_res->hw_res[0]->hw_intf->hw_priv,
+		cmd_update.cmd_type, &cmd_update,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"getting mid port resource id failed ctx id:%d req id:%lld",
+			ctx->ctx_index, packet->header.request_id);
+		cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
+		return;
+	}
+	CAM_ERR(CAM_ISP,
+		"Page fault on resource id:0x%x ctx id:%d req id:%lld",
+		get_res.out_res_id, ctx->ctx_index, packet->header.request_id);
+	*resource_type = get_res.out_res_id;
+
+	cam_tfe_mgr_pf_dump(get_res.out_res_id, ctx);
+
+outportlog:
+	cam_packet_util_dump_io_bufs(packet, hw_mgr->mgr_common.img_iommu_hdl,
+		hw_mgr->mgr_common.img_iommu_hdl_secure, pf_cmd_args->pf_args, true);
+	cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
+
+}
+
+static void *cam_tfe_mgr_user_dump_stream_info(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_tfe_hw_mgr_ctx    *ctx = NULL;
+	struct cam_isp_hw_mgr_res    *hw_mgr_res = NULL;
+	struct cam_isp_resource_node *hw_res = NULL;
+	int32_t                      *addr;
+	int                           i;
+	int hw_idx[CAM_ISP_HW_SPLIT_MAX] = { -1, -1 };
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)dump_struct;
+
+	if (!list_empty(&ctx->res_list_tfe_in)) {
+		hw_mgr_res = list_first_entry(&ctx->res_list_tfe_in,
+			struct cam_isp_hw_mgr_res, list);
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				hw_idx[i] = hw_res->hw_intf->hw_idx;
+		}
+	}
+
+	addr = (int32_t *)addr_ptr;
+
+	*addr++ = ctx->is_dual;
+	*addr++ = hw_idx[CAM_ISP_HW_SPLIT_LEFT];
+	*addr++ = hw_idx[CAM_ISP_HW_SPLIT_RIGHT];
+
+	return addr;
+}
+
+static int cam_tfe_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_tfe_hw_mgr  *hw_mgr = hw_mgr_priv;
+	struct cam_tfe_hw_mgr_ctx *ctx = (struct cam_tfe_hw_mgr_ctx *)
+		hw_cmd_args->ctxt_to_hw_map;
+	struct cam_isp_hw_cmd_args *isp_hw_cmd_args = NULL;
+	struct cam_packet          *packet;
+	struct cam_tfe_comp_record_query *query_cmd;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Fatal: Invalid context is used");
+		return -EPERM;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_INTERNAL:
+		if (!hw_cmd_args->u.internal_args) {
+			CAM_ERR(CAM_ISP, "Invalid cmd arguments");
+			return -EINVAL;
+		}
+
+		isp_hw_cmd_args = (struct cam_isp_hw_cmd_args *)
+			hw_cmd_args->u.internal_args;
+
+		switch (isp_hw_cmd_args->cmd_type) {
+		case CAM_ISP_HW_MGR_CMD_PAUSE_HW:
+			cam_tfe_mgr_pause_hw(ctx);
+			break;
+		case CAM_ISP_HW_MGR_CMD_RESUME_HW:
+			cam_tfe_mgr_resume_hw(ctx);
+			break;
+		case CAM_ISP_HW_MGR_CMD_SOF_DEBUG:
+			cam_tfe_mgr_sof_irq_debug(ctx,
+				isp_hw_cmd_args->u.sof_irq_enable);
+			break;
+		case CAM_ISP_HW_MGR_CMD_CTX_TYPE:
+			if (ctx->is_rdi_only_context)
+				isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_RDI;
+			else
+				isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_PIX;
+			break;
+		case CAM_ISP_HW_MGR_GET_PACKET_OPCODE:
+			packet = (struct cam_packet *)
+				isp_hw_cmd_args->cmd_data;
+			if ((packet->header.op_code & 0xF) ==
+				CAM_ISP_TFE_PACKET_INIT_DEV)
+				isp_hw_cmd_args->u.packet_info.packet_op_code =
+				CAM_ISP_TFE_PACKET_INIT_DEV;
+			else
+				isp_hw_cmd_args->u.packet_info.packet_op_code =
+				CAM_ISP_TFE_PACKET_CONFIG_DEV;
+			isp_hw_cmd_args->u.packet_info.hw_mgr_ctx_id = ctx->ctx_index;
+			break;
+		case CAM_ISP_HW_MGR_GET_LAST_CDM_DONE:
+			isp_hw_cmd_args->u.last_cdm_done =
+				ctx->last_cdm_done_req;
+			break;
+		case CAM_ISP_HW_MGR_GET_BUS_COMP_GROUP:
+			query_cmd = (struct cam_tfe_comp_record_query *)
+				isp_hw_cmd_args->cmd_data;
+			memcpy(query_cmd->tfe_bus_comp_grp, ctx->tfe_bus_comp_grp,
+				sizeof(struct cam_tfe_hw_comp_record) *
+				CAM_TFE_BUS_COMP_NUM_MAX);
+			break;
+		case CAM_ISP_HW_MGR_CMD_PROG_DEFAULT_CFG:
+			rc = cam_tfe_mgr_prog_default_settings(ctx);
+			break;
+		case CAM_ISP_HW_MGR_GET_SOF_TS:
+			rc = cam_tfe_mgr_cmd_get_sof_timestamp(ctx,
+				&isp_hw_cmd_args->u.sof_ts.curr,
+				&isp_hw_cmd_args->u.sof_ts.boot,
+				&isp_hw_cmd_args->u.sof_ts.prev);
+			break;
+		case CAM_ISP_HW_MGR_CMD_UPDATE_CLOCK:
+			rc = cam_tfe_hw_mgr_csiphy_clk_sync(ctx, isp_hw_cmd_args->cmd_data);
+			break;
+		case CAM_ISP_HW_MGR_DUMP_STREAM_INFO:
+			rc = cam_common_user_dump_helper(
+					(void *)(isp_hw_cmd_args->cmd_data),
+					cam_tfe_mgr_user_dump_stream_info, ctx,
+					sizeof(int32_t), "ISP_STREAM_INFO_FROM_TFE_HW_MGR:");
+			break;
+		case CAM_ISP_HW_MGR_GET_LAST_CONSUMED_ADDR:
+			rc = cam_tfe_mgr_cmd_get_last_consumed_addr(ctx,
+				(struct cam_isp_hw_done_event_data *)(isp_hw_cmd_args->cmd_data));
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid HW mgr command:0x%x, ISP HW mgr cmd:0x%x",
+				hw_cmd_args->cmd_type, isp_hw_cmd_args->cmd_type);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_tfe_mgr_dump_pf_data(hw_mgr, hw_cmd_args);
+		break;
+	case CAM_HW_MGR_CMD_REG_DUMP_ON_FLUSH:
+		if (ctx->last_dump_flush_req_id == ctx->applied_req_id)
+			return 0;
+
+		ctx->last_dump_flush_req_id = ctx->applied_req_id;
+
+		rc = cam_tfe_mgr_handle_reg_dump(ctx, ctx->reg_dump_buf_desc,
+			ctx->num_reg_dump_buf,
+			CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_FLUSH,
+			NULL, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Reg dump on flush failed req id: %llu num_reg_dump:0x%x rc: %d",
+				ctx->applied_req_id, ctx->num_reg_dump_buf, rc);
+			return rc;
+		}
+
+		break;
+	case CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR:
+		if (ctx->last_dump_err_req_id == ctx->applied_req_id)
+			return 0;
+
+		ctx->last_dump_err_req_id = ctx->applied_req_id;
+		rc = cam_tfe_mgr_handle_reg_dump(ctx, ctx->reg_dump_buf_desc,
+			ctx->num_reg_dump_buf,
+			CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR,
+			NULL, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Reg dump on error failed req id:%llu num_reg_dump:0x%x rc: %d",
+				ctx->applied_req_id, ctx->num_reg_dump_buf, rc);
+			return rc;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid cmd");
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_cmd_get_sof_timestamp(
+	struct cam_tfe_hw_mgr_ctx            *tfe_ctx,
+	uint64_t                             *time_stamp,
+	uint64_t                             *boot_time_stamp,
+	uint64_t                             *prev_time_stamp)
+{
+	int                                        rc = -EINVAL;
+	uint32_t                                   i;
+	struct cam_isp_hw_mgr_res                 *hw_mgr_res;
+	struct cam_hw_intf                        *hw_intf;
+	struct cam_tfe_csid_get_time_stamp_args    csid_get_time;
+
+	hw_mgr_res = list_first_entry(&tfe_ctx->res_list_tfe_csid,
+		struct cam_isp_hw_mgr_res, list);
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+
+		/*
+		 * Get the SOF time stamp from left resource only.
+		 * Left resource is master for dual tfe case and
+		 * Rdi only context case left resource only hold
+		 * the RDI resource
+		 */
+
+		hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.process_cmd) {
+			/*
+			 * Single TFE case, Get the time stamp from
+			 * available one csid hw in the context
+			 * Dual TFE case, get the time stamp from
+			 * master(left) would be sufficient
+			 */
+
+			csid_get_time.node_res =
+				hw_mgr_res->hw_res[i];
+			csid_get_time.get_prev_timestamp = (prev_time_stamp != NULL);
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_TFE_CSID_CMD_GET_TIME_STAMP,
+				&csid_get_time,
+				sizeof(struct
+				cam_tfe_csid_get_time_stamp_args));
+			if (!rc && (i == CAM_ISP_HW_SPLIT_LEFT)) {
+				*time_stamp =
+					csid_get_time.time_stamp_val;
+				*boot_time_stamp =
+					csid_get_time.boot_timestamp;
+				if (prev_time_stamp)
+					*prev_time_stamp =
+						csid_get_time.prev_time_stamp_val;
+				break;
+			}
+		}
+	}
+
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Getting sof time stamp failed");
+
+	return rc;
+}
+
+static void cam_tfe_mgr_ctx_reg_dump(struct cam_tfe_hw_mgr_ctx  *ctx)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_hw_intf               *hw_intf;
+	struct cam_isp_hw_get_cmd_update  cmd_update;
+	int i = 0;
+
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in,
+		list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			switch (hw_mgr_res->hw_res[i]->res_id) {
+			case CAM_ISP_HW_TFE_IN_CAMIF:
+				hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+				cmd_update.res = hw_mgr_res->hw_res[i];
+				cmd_update.cmd_type =
+					CAM_ISP_HW_CMD_GET_REG_DUMP;
+				hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_GET_REG_DUMP,
+					&cmd_update, sizeof(cmd_update));
+				break;
+			default:
+				break;
+			}
+		}
+	}
+
+	/* Dump the TFE CSID registers */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid,
+		list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_TFE_CSID_CMD_GET_REG_DUMP,
+					hw_mgr_res->hw_res[i],
+					sizeof(struct cam_isp_resource_node));
+			}
+		}
+	}
+}
+
+static int cam_tfe_mgr_process_recovery_cb(void *priv, void *data)
+{
+	int32_t rc = 0;
+	struct cam_tfe_hw_event_recovery_data   *recovery_data = data;
+	struct cam_hw_start_args             start_args;
+	struct cam_hw_stop_args              stop_args;
+	struct cam_tfe_hw_mgr               *tfe_hw_mgr = priv;
+	struct cam_isp_hw_mgr_res           *hw_mgr_res;
+	struct cam_tfe_hw_mgr_ctx           *tfe_hw_mgr_ctx;
+	uint32_t                             i = 0;
+
+	uint32_t error_type = recovery_data->error_type;
+	struct cam_tfe_hw_mgr_ctx        *ctx = NULL;
+
+	/* Here recovery is performed */
+	CAM_DBG(CAM_ISP, "ErrorType = %d", error_type);
+
+	switch (error_type) {
+	case CAM_ISP_HW_ERROR_OVERFLOW:
+	case CAM_ISP_HW_ERROR_BUSIF_OVERFLOW:
+		if (!recovery_data->affected_ctx[0]) {
+			CAM_ERR(CAM_ISP,
+				"No context is affected but recovery called");
+			kfree(recovery_data);
+			return 0;
+		}
+
+		/* stop resources here */
+		CAM_DBG(CAM_ISP, "STOP: Number of affected context: %d",
+			recovery_data->no_of_context);
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			stop_args.ctxt_to_hw_map =
+				recovery_data->affected_ctx[i];
+			tfe_hw_mgr_ctx = recovery_data->affected_ctx[i];
+
+			if (g_tfe_hw_mgr.debug_cfg.enable_reg_dump)
+				cam_tfe_mgr_ctx_reg_dump(tfe_hw_mgr_ctx);
+
+			if (g_tfe_hw_mgr.debug_cfg.enable_recovery) {
+				rc = cam_tfe_mgr_stop_hw_in_overflow(
+					&stop_args);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"CTX stop failed(%d)", rc);
+					return rc;
+				}
+			}
+		}
+
+		if (!g_tfe_hw_mgr.debug_cfg.enable_recovery) {
+			CAM_INFO(CAM_ISP, "reg dumping is done ");
+			return 0;
+		}
+
+		CAM_DBG(CAM_ISP, "RESET: CSID PATH");
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			ctx = recovery_data->affected_ctx[i];
+			list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid,
+				list) {
+				rc = cam_tfe_hw_mgr_reset_csid_res(hw_mgr_res);
+				if (rc) {
+					CAM_ERR(CAM_ISP, "Failed RESET (%d)",
+						hw_mgr_res->res_id);
+					return rc;
+				}
+			}
+		}
+
+		CAM_DBG(CAM_ISP, "RESET: Calling TFE reset");
+
+		for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+			if (recovery_data->affected_core[i])
+				cam_tfe_mgr_reset_tfe_hw(tfe_hw_mgr, i);
+		}
+
+		CAM_DBG(CAM_ISP, "START: Number of affected context: %d",
+			recovery_data->no_of_context);
+
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			ctx =  recovery_data->affected_ctx[i];
+			start_args.ctxt_to_hw_map = ctx;
+
+			atomic_set(&ctx->overflow_pending, 0);
+
+			rc = cam_tfe_mgr_restart_hw(&start_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "CTX start failed(%d)", rc);
+				return rc;
+			}
+			CAM_DBG(CAM_ISP, "Started resources rc (%d)", rc);
+		}
+		CAM_DBG(CAM_ISP, "Recovery Done rc (%d)", rc);
+
+		break;
+
+	case CAM_ISP_HW_ERROR_P2I_ERROR:
+		break;
+
+	case CAM_ISP_HW_ERROR_VIOLATION:
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Invalid Error");
+	}
+	CAM_DBG(CAM_ISP, "Exit: ErrorType = %d", error_type);
+
+	kfree(recovery_data);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_do_error_recovery(
+	struct cam_tfe_hw_event_recovery_data  *tfe_mgr_recovery_data)
+{
+	int32_t                             rc = 0;
+	struct crm_workq_task              *task = NULL;
+	struct cam_tfe_hw_event_recovery_data  *recovery_data = NULL;
+
+	recovery_data = kmemdup(tfe_mgr_recovery_data,
+		sizeof(struct cam_tfe_hw_event_recovery_data), GFP_ATOMIC);
+
+	if (!recovery_data)
+		return -ENOMEM;
+
+	CAM_DBG(CAM_ISP, "Enter: error_type (%d)", recovery_data->error_type);
+
+	task = cam_req_mgr_workq_get_task(g_tfe_hw_mgr.workq);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No empty task frame");
+		kfree(recovery_data);
+		return -ENOMEM;
+	}
+
+	task->process_cb = &cam_tfe_mgr_process_recovery_cb;
+	task->payload = recovery_data;
+	rc = cam_req_mgr_workq_enqueue_task(task,
+		recovery_data->affected_ctx[0]->hw_mgr,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+/*
+ * This function checks if any of the valid entry in affected_core[]
+ * is associated with this context. if YES
+ *  a. It fills the other cores associated with this context.in
+ *      affected_core[]
+ *  b. Return true
+ */
+static bool cam_tfe_hw_mgr_is_ctx_affected(
+	struct cam_tfe_hw_mgr_ctx   *tfe_hwr_mgr_ctx,
+	uint32_t                    *affected_core,
+	uint32_t                     size)
+{
+
+	bool                  rc = false;
+	uint32_t              i = 0, j = 0;
+	uint32_t              max_idx =  tfe_hwr_mgr_ctx->num_base;
+	uint32_t              ctx_affected_core_idx[CAM_TFE_HW_NUM_MAX] = {0};
+
+	CAM_DBG(CAM_ISP, "Enter:max_idx = %d", max_idx);
+
+	if ((max_idx >= CAM_TFE_HW_NUM_MAX) || (size > CAM_TFE_HW_NUM_MAX)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "invalid parameter = %d", max_idx);
+		return rc;
+	}
+
+	for (i = 0; i < max_idx; i++) {
+		if (affected_core[tfe_hwr_mgr_ctx->base[i].idx])
+			rc = true;
+		else {
+			ctx_affected_core_idx[j] = tfe_hwr_mgr_ctx->base[i].idx;
+			j = j + 1;
+		}
+	}
+
+	if (rc) {
+		while (j) {
+			if (affected_core[ctx_affected_core_idx[j-1]] != 1)
+				affected_core[ctx_affected_core_idx[j-1]] = 1;
+			j = j - 1;
+		}
+	}
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+/*
+ * For any dual TFE context, if non-affected TFE is also serving
+ * another context, then that context should also be notified with fatal error
+ * So Loop through each context and -
+ *   a. match core_idx
+ *   b. Notify CTX with fatal error
+ */
+static int  cam_tfe_hw_mgr_find_affected_ctx(
+	struct cam_isp_hw_error_event_data    *error_event_data,
+	uint32_t                               curr_core_idx,
+	struct cam_tfe_hw_event_recovery_data *recovery_data)
+{
+	uint32_t affected_core[CAM_TFE_HW_NUM_MAX] = {0};
+	struct cam_tfe_hw_mgr_ctx   *tfe_hwr_mgr_ctx = NULL;
+	cam_hw_event_cb_func         notify_err_cb;
+	struct cam_tfe_hw_mgr       *tfe_hwr_mgr = NULL;
+	uint32_t i = 0;
+
+	if (!recovery_data) {
+		CAM_ERR(CAM_ISP, "recovery_data parameter is NULL");
+		return -EINVAL;
+	}
+
+	recovery_data->no_of_context = 0;
+	affected_core[curr_core_idx] = 1;
+	tfe_hwr_mgr = &g_tfe_hw_mgr;
+
+	list_for_each_entry(tfe_hwr_mgr_ctx,
+		&tfe_hwr_mgr->used_ctx_list, list) {
+		/*
+		 * Check if current core_idx matches the HW associated
+		 * with this context
+		 */
+		if (!cam_tfe_hw_mgr_is_ctx_affected(tfe_hwr_mgr_ctx,
+			affected_core, CAM_TFE_HW_NUM_MAX))
+			continue;
+
+		if (atomic_read(&tfe_hwr_mgr_ctx->overflow_pending)) {
+			CAM_INFO(CAM_ISP, "CTX:%d already error reported",
+				tfe_hwr_mgr_ctx->ctx_index);
+			continue;
+		}
+
+		atomic_set(&tfe_hwr_mgr_ctx->overflow_pending, 1);
+		notify_err_cb = tfe_hwr_mgr_ctx->common.event_cb;
+
+		/* Add affected_context in list of recovery data */
+		CAM_DBG(CAM_ISP, "Add affected ctx %d to list",
+			tfe_hwr_mgr_ctx->ctx_index);
+		if (recovery_data->no_of_context < CAM_TFE_CTX_MAX)
+			recovery_data->affected_ctx[
+				recovery_data->no_of_context++] =
+				tfe_hwr_mgr_ctx;
+
+		/*
+		 * In the call back function corresponding ISP context
+		 * will update CRM about fatal Error
+		 */
+		if (notify_err_cb) {
+			notify_err_cb(tfe_hwr_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_ERROR,
+			(void *)error_event_data);
+		} else {
+			CAM_WARN(CAM_ISP, "Error call back is not set");
+			goto end;
+		}
+	}
+
+	/* fill the affected_core in recovery data */
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		recovery_data->affected_core[i] = affected_core[i];
+		CAM_DBG(CAM_ISP, "tfe core %d is affected (%d)",
+			 i, recovery_data->affected_core[i]);
+	}
+end:
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_dump_info(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_tfe_hw_mgr_ctx     *tfe_hw_mgr_ctx =
+		(struct cam_tfe_hw_mgr_ctx *)ctx;
+	struct cam_isp_hw_event_info  *event_info =
+		(struct cam_isp_hw_event_info *)evt_info;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res = NULL;
+	struct cam_hw_intf            *hw_intf;
+	uint32_t                      i = 0, out_port_id = 0;
+	uint64_t                      dummy_args = 0;
+	int                           rc = 0;
+
+	for (i = 0; i < tfe_hw_mgr_ctx->num_base; i++) {
+		hw_intf = g_tfe_hw_mgr.csid_devices[tfe_hw_mgr_ctx->base[i].idx];
+		if (hw_intf->hw_ops.process_cmd) {
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_CSID_CLOCK_DUMP,
+				&dummy_args,
+				sizeof(uint64_t));
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"CSID Clock Dump failed");
+		}
+	}
+
+	if (event_info->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		out_port_id = event_info->res_id & 0xFF;
+		if (out_port_id >= g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type) {
+			CAM_ERR(CAM_ISP,
+				"Resource out of range");
+			goto end;
+		}
+		hw_mgr_res =
+			&tfe_hw_mgr_ctx->res_list_tfe_out[tfe_hw_mgr_ctx->tfe_out_map[out_port_id]];
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+					(void *)event_info,
+					sizeof(struct cam_isp_hw_event_info));
+			}
+		}
+	}
+end:
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_check_and_notify_overflow(
+	struct cam_isp_hw_event_info    *evt,
+	struct cam_tfe_hw_mgr_ctx       *hw_mgr_ctx,
+	bool                            *is_bus_overflow)
+{
+	int                             i;
+	struct cam_hw_intf             *hw_if = NULL;
+	struct cam_isp_hw_overflow_info overflow_info;
+
+	for (i = 0; i < hw_mgr_ctx->num_base; i++) {
+		if (hw_mgr_ctx->base[i].idx != evt->hw_idx)
+			continue;
+
+		hw_if = g_tfe_hw_mgr.tfe_devices[evt->hw_idx]->hw_intf;
+		if (!hw_if) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP, "hw_intf is null");
+			return -EINVAL;
+		}
+
+		if (hw_if->hw_ops.process_cmd) {
+			overflow_info.res_id = evt->res_id;
+			hw_if->hw_ops.process_cmd(hw_if->hw_priv,
+				CAM_ISP_HW_NOTIFY_OVERFLOW,
+				&overflow_info,
+				sizeof(struct cam_isp_hw_overflow_info));
+
+			CAM_DBG(CAM_ISP,
+				"check and notify hw idx %d type %d bus overflow happened %d",
+				hw_mgr_ctx->base[i].idx, hw_mgr_ctx->base[i].hw_type,
+				overflow_info.is_bus_overflow);
+
+			if (overflow_info.is_bus_overflow)
+				*is_bus_overflow = true;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_tfe_err(
+	uint32_t                      err_type,
+	struct cam_isp_hw_event_info *event_info,
+	struct cam_tfe_hw_mgr_ctx    *ctx)
+{
+	struct cam_isp_hw_error_event_data       error_event_data = {0};
+	struct cam_tfe_hw_event_recovery_data    recovery_data = {0};
+	uint32_t core_idx;
+	int rc = -EINVAL;
+
+	switch (err_type) {
+	case CAM_TFE_IRQ_STATUS_VIOLATION:
+		error_event_data.error_type = CAM_ISP_HW_ERROR_VIOLATION;
+		break;
+	case CAM_TFE_IRQ_STATUS_OUT_OF_SYNC:
+		error_event_data.error_type = CAM_ISP_HW_ERROR_CSID_SENSOR_FRAME_DROP;
+		if (ctx->try_recovery_cnt < MAX_TFE_INTERNAL_RECOVERY_ATTEMPTS) {
+			error_event_data.try_internal_recovery = true;
+			if (!atomic_read(&ctx->overflow_pending))
+				ctx->try_recovery_cnt++;
+
+			if (!ctx->recovery_req_id)
+				ctx->recovery_req_id = ctx->applied_req_id;
+		}
+		CAM_INFO(CAM_ISP,
+			"TFE: %u error: %u current_recovery_cnt: %u  recovery_req: %llu on ctx: %u",
+			event_info->hw_idx, error_event_data.error_type,
+			ctx->try_recovery_cnt, ctx->recovery_req_id,
+			ctx->ctx_index);
+		break;
+	default:
+		error_event_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+		break;
+	}
+
+	cam_tfe_hw_mgr_handle_hw_dump_info(ctx, event_info);
+
+	core_idx = event_info->hw_idx;
+
+	if (g_tfe_hw_mgr.debug_cfg.enable_recovery)
+		error_event_data.recovery_enabled = true;
+	else
+		error_event_data.recovery_enabled = false;
+
+	rc = cam_tfe_hw_mgr_find_affected_ctx(&error_event_data,
+		core_idx, &recovery_data);
+
+	if (rc || !(recovery_data.no_of_context))
+		return rc;
+
+	if (event_info->res_type == CAM_ISP_RESOURCE_TFE_OUT)
+		return rc;
+
+	if (!error_event_data.try_internal_recovery && g_tfe_hw_mgr.debug_cfg.enable_recovery) {
+		/* Trigger for recovery */
+		if (err_type == CAM_TFE_IRQ_STATUS_VIOLATION)
+			recovery_data.error_type = CAM_ISP_HW_ERROR_VIOLATION;
+		else
+			recovery_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+		cam_tfe_hw_mgr_do_error_recovery(&recovery_data);
+	} else {
+		CAM_DBG(CAM_ISP, "recovery enabled: %d, internal_recovery: %d, ctx: %d",
+			error_event_data.try_internal_recovery,
+			g_tfe_hw_mgr.debug_cfg.enable_recovery,
+			ctx->ctx_index);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_handle_csid_event(
+	uint32_t                      err_type,
+	struct cam_isp_hw_event_info *event_info,
+	void                         *ctx)
+{
+	struct cam_isp_hw_error_event_data  error_event_data = {0};
+	struct cam_tfe_hw_event_recovery_data     recovery_data = {0};
+	bool                                is_bus_overflow = false;
+	struct cam_tfe_hw_mgr_ctx           *tfe_hw_mgr_ctx = ctx;
+
+	/* Default error types */
+	error_event_data.error_type = CAM_ISP_HW_ERROR_CSID_FATAL;
+	recovery_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+
+	/* this can be extended based on the types of error
+	 * received from CSID
+	 */
+	switch (err_type) {
+	case CAM_ISP_HW_ERROR_CSID_FRAME_SIZE:
+	case CAM_ISP_HW_ERROR_CSID_FATAL: {
+
+		if (!g_tfe_hw_mgr.debug_cfg.enable_csid_recovery) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%d err: %d not handled, csid_recovery_enable: %d",
+				event_info->hw_idx, err_type,
+				g_tfe_hw_mgr.debug_cfg.enable_csid_recovery);
+			return 0;
+		}
+		break;
+	}
+	case CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW: {
+		cam_tfe_hw_mgr_check_and_notify_overflow(event_info,
+			tfe_hw_mgr_ctx, &is_bus_overflow);
+
+		if (is_bus_overflow) {
+			if (tfe_hw_mgr_ctx->try_recovery_cnt <
+				MAX_TFE_INTERNAL_RECOVERY_ATTEMPTS) {
+
+				error_event_data.try_internal_recovery = true;
+				if (!atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+					tfe_hw_mgr_ctx->try_recovery_cnt++;
+
+				if (!tfe_hw_mgr_ctx->recovery_req_id)
+					tfe_hw_mgr_ctx->recovery_req_id =
+						tfe_hw_mgr_ctx->applied_req_id;
+
+				error_event_data.error_type = err_type;
+			}
+
+			CAM_DBG(CAM_ISP,
+				"CSID[%u] error: %u current_recovery_cnt: %u  recovery_req: %llu",
+				event_info->hw_idx, err_type, tfe_hw_mgr_ctx->try_recovery_cnt,
+				tfe_hw_mgr_ctx->recovery_req_id);
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d, unahandled error: %d",
+			event_info->hw_idx, err_type);
+		return 0;
+	}
+
+	CAM_ERR(CAM_ISP, "CSID:[%u] error: %u on ctx: %u", event_info->hw_idx,
+		error_event_data.error_type, tfe_hw_mgr_ctx->ctx_index);
+
+	cam_tfe_hw_mgr_find_affected_ctx(&error_event_data, event_info->hw_idx,
+		&recovery_data);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_err(
+	void                                *ctx,
+	void                                *evt_info)
+{
+	struct cam_isp_hw_error_event_info      *err_evt_info;
+	struct cam_tfe_hw_mgr_ctx               *tfe_hw_mgr_ctx;
+	struct cam_isp_hw_event_info            *event_info = evt_info;
+	int    rc = -EINVAL;
+
+	if (!event_info->event_data) {
+		CAM_ERR(CAM_ISP, "No error event data failed to process");
+		return rc;
+	}
+
+	if (ctx)
+		tfe_hw_mgr_ctx = (struct cam_tfe_hw_mgr_ctx *)ctx;
+	else {
+		CAM_ERR(CAM_ISP, "tfe hw mgr ctx NULL");
+		return rc;
+	}
+
+	if (!tfe_hw_mgr_ctx->ctx_state) {
+		CAM_INFO(CAM_ISP, "TFE Hw mgr ctx is not in active state ctx %d",
+			tfe_hw_mgr_ctx->ctx_index);
+		return rc;
+	}
+
+	err_evt_info = (struct cam_isp_hw_error_event_info *)event_info->event_data;
+
+	spin_lock(&g_tfe_hw_mgr.ctx_lock);
+	switch (event_info->hw_type) {
+	case CAM_ISP_HW_TYPE_TFE_CSID:
+		rc = cam_tfe_hw_mgr_handle_csid_event(err_evt_info->err_type, event_info,
+			tfe_hw_mgr_ctx);
+		break;
+
+	case CAM_ISP_HW_TYPE_TFE:
+		rc = cam_tfe_hw_mgr_handle_tfe_err(err_evt_info->err_type, event_info,
+			tfe_hw_mgr_ctx);
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Error unhandled for hw_type: %d", event_info->hw_type);
+	}
+	spin_unlock(&g_tfe_hw_mgr.ctx_lock);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_rup(
+	void                                    *ctx,
+	void                                    *evt_info)
+{
+	struct cam_isp_hw_event_info            *event_info = evt_info;
+	struct cam_tfe_hw_mgr_ctx               *tfe_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                     tfe_hwr_irq_rup_cb;
+	struct cam_isp_hw_reg_update_event_data  rup_event_data;
+
+	tfe_hwr_irq_rup_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		if (tfe_hw_mgr_ctx->is_dual)
+			if (event_info->hw_idx != tfe_hw_mgr_ctx->master_hw_idx)
+				break;
+
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+
+		tfe_hwr_irq_rup_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_REG_UPDATE, &rup_event_data);
+		break;
+
+	case CAM_ISP_HW_TFE_IN_RDI0:
+	case CAM_ISP_HW_TFE_IN_RDI1:
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		if (!tfe_hw_mgr_ctx->is_rdi_only_context)
+			break;
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hwr_irq_rup_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&rup_event_data);
+		break;
+
+	case CAM_ISP_HW_TFE_IN_PDLIB:
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "RUP done for TFE source %d",
+		event_info->res_id);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_epoch(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_tfe_hw_mgr_ctx            *tfe_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                  tfe_hw_irq_epoch_cb;
+	struct cam_isp_hw_epoch_event_data    epoch_done_event_data;
+
+	tfe_hw_irq_epoch_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hw_irq_epoch_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_EPOCH,
+			(void *)&epoch_done_event_data);
+		break;
+
+	case CAM_ISP_HW_TFE_IN_RDI0:
+	case CAM_ISP_HW_TFE_IN_RDI1:
+	case CAM_ISP_HW_TFE_IN_RDI2:
+	case CAM_ISP_HW_TFE_IN_PDLIB:
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "Epoch for TFE source %d", event_info->res_id);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_sof(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_tfe_hw_mgr_ctx            *tfe_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                  tfe_hw_irq_sof_cb;
+	struct cam_isp_hw_sof_event_data      sof_done_event_data;
+
+	tfe_hw_irq_sof_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		cam_tfe_mgr_cmd_get_sof_timestamp(tfe_hw_mgr_ctx,
+			&sof_done_event_data.timestamp,
+			&sof_done_event_data.boot_time, NULL);
+
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+
+		tfe_hw_irq_sof_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_SOF, (void *)&sof_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_TFE_IN_RDI0:
+	case CAM_ISP_HW_TFE_IN_RDI1:
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		if (!tfe_hw_mgr_ctx->is_rdi_only_context)
+			break;
+		cam_tfe_mgr_cmd_get_sof_timestamp(tfe_hw_mgr_ctx,
+			&sof_done_event_data.timestamp,
+			&sof_done_event_data.boot_time, NULL);
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hw_irq_sof_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_SOF, (void *)&sof_done_event_data);
+		break;
+
+	case CAM_ISP_HW_TFE_IN_PDLIB:
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "SOF for TFE source %d", event_info->res_id);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_eof(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_tfe_hw_mgr_ctx            *tfe_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                  tfe_hw_irq_eof_cb;
+	struct cam_isp_hw_eof_event_data      eof_done_event_data;
+
+	tfe_hw_irq_eof_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hw_irq_eof_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_EOF, (void *)&eof_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_TFE_IN_RDI0:
+	case CAM_ISP_HW_TFE_IN_RDI1:
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		if (!tfe_hw_mgr_ctx->is_rdi_only_context)
+			break;
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hw_irq_eof_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_EOF, (void *)&eof_done_event_data);
+		break;
+
+	case CAM_ISP_HW_TFE_IN_PDLIB:
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "EOF for out_res->res_id: 0x%x",
+		event_info->res_id);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_buf_done(
+	void                                *ctx,
+	void                                *evt_info)
+{
+	cam_hw_event_cb_func                 tfe_hwr_irq_wm_done_cb;
+	struct cam_tfe_hw_mgr_ctx            *tfe_hw_mgr_ctx = ctx;
+	struct cam_isp_hw_done_event_data    buf_done_event_data = {0};
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_isp_hw_bufdone_event_info *bufdone_evt_info = NULL;
+
+
+	if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+		return 0;
+
+	event_info = (struct cam_isp_hw_event_info *)evt_info;
+	if (!event_info->event_data) {
+		CAM_ERR(CAM_ISP,
+			"No additional buf done data failed to process for HW: %u",
+			event_info->hw_type);
+		return -EINVAL;
+	}
+
+	tfe_hwr_irq_wm_done_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	bufdone_evt_info = (struct cam_isp_hw_bufdone_event_info *)
+				event_info->event_data;
+	buf_done_event_data.resource_handle = 0;
+
+	CAM_DBG(CAM_ISP,
+		"Buf done for TFE: %d res_id: 0x%x last consumed addr: 0x%x ctx: %u",
+		event_info->hw_idx, event_info->res_id,
+		bufdone_evt_info->last_consumed_addr, tfe_hw_mgr_ctx->ctx_index);
+
+	buf_done_event_data.hw_type = event_info->hw_type;
+	buf_done_event_data.resource_handle = event_info->res_id;
+	buf_done_event_data.last_consumed_addr = bufdone_evt_info->last_consumed_addr;
+	buf_done_event_data.comp_group_id = bufdone_evt_info->comp_grp_id;
+
+	if (buf_done_event_data.resource_handle > 0 && tfe_hwr_irq_wm_done_cb) {
+		CAM_DBG(CAM_ISP, "Buf done for out_res->res_id: 0x%x in ctx: %u",
+			event_info->res_id, tfe_hw_mgr_ctx->ctx_index);
+		tfe_hwr_irq_wm_done_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_DONE, (void *)&buf_done_event_data);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_event_handler(
+	void                                *priv,
+	uint32_t                             evt_id,
+	void                                *evt_info)
+{
+	int                                  rc = 0;
+
+	if (!evt_info)
+		return -EINVAL;
+
+	if (!priv)
+		if (evt_id != CAM_ISP_HW_EVENT_ERROR)
+			return -EINVAL;
+
+	CAM_DBG(CAM_ISP, "Event ID 0x%x", evt_id);
+
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_SOF:
+		rc = cam_tfe_hw_mgr_handle_hw_sof(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		rc = cam_tfe_hw_mgr_handle_hw_rup(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_EPOCH:
+		rc = cam_tfe_hw_mgr_handle_hw_epoch(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_EOF:
+		rc = cam_tfe_hw_mgr_handle_hw_eof(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_DONE:
+		rc = cam_tfe_hw_mgr_handle_hw_buf_done(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_ERROR:
+		rc = cam_tfe_hw_mgr_handle_hw_err(priv, evt_info);
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Invalid event ID %d", evt_id);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_sort_dev_with_caps(
+	struct cam_tfe_hw_mgr *tfe_hw_mgr)
+{
+	int i;
+
+	/* get caps for csid devices */
+	for (i = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+		if (!tfe_hw_mgr->csid_devices[i])
+			continue;
+		if (tfe_hw_mgr->csid_devices[i]->hw_ops.get_hw_caps) {
+			tfe_hw_mgr->csid_devices[i]->hw_ops.get_hw_caps(
+				tfe_hw_mgr->csid_devices[i]->hw_priv,
+				&tfe_hw_mgr->tfe_csid_dev_caps[i],
+				sizeof(tfe_hw_mgr->tfe_csid_dev_caps[i]));
+		}
+	}
+
+	/* get caps for tfe devices */
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (!tfe_hw_mgr->tfe_devices[i])
+			continue;
+
+		if (tfe_hw_mgr->tfe_devices[i]->hw_intf->hw_ops.get_hw_caps) {
+			tfe_hw_mgr->tfe_devices[i]->hw_intf->hw_ops.get_hw_caps(
+				tfe_hw_mgr->tfe_devices[i]->hw_intf->hw_priv,
+				&tfe_hw_mgr->tfe_dev_caps[i],
+				sizeof(tfe_hw_mgr->tfe_dev_caps[i]));
+		}
+	}
+
+	return 0;
+}
+
+static int cam_tfe_set_csid_debug(void *data, u64 val)
+{
+	g_tfe_hw_mgr.debug_cfg.csid_debug = val;
+	CAM_DBG(CAM_ISP, "Set CSID Debug value :%lld", val);
+	return 0;
+}
+
+static int cam_tfe_get_csid_debug(void *data, u64 *val)
+{
+	*val = g_tfe_hw_mgr.debug_cfg.csid_debug;
+	CAM_DBG(CAM_ISP, "Get CSID Debug value :%lld",
+		g_tfe_hw_mgr.debug_cfg.csid_debug);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_tfe_csid_debug,
+	cam_tfe_get_csid_debug,
+	cam_tfe_set_csid_debug, "%16llu");
+
+static int cam_tfe_set_camif_debug(void *data, u64 val)
+{
+	g_tfe_hw_mgr.debug_cfg.camif_debug = val;
+	CAM_DBG(CAM_ISP,
+		"Set camif enable_diag_sensor_status value :%lld", val);
+	return 0;
+}
+
+static int cam_tfe_get_camif_debug(void *data, u64 *val)
+{
+	*val = g_tfe_hw_mgr.debug_cfg.camif_debug;
+	CAM_DBG(CAM_ISP,
+		"Set camif enable_diag_sensor_status value :%lld",
+		g_tfe_hw_mgr.debug_cfg.csid_debug);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_tfe_camif_debug,
+	cam_tfe_get_camif_debug,
+	cam_tfe_set_camif_debug, "%16llu");
+
+static int cam_tfe_hw_mgr_debug_register(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		goto end;
+
+	rc = cam_debugfs_create_subdir("tfe", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	g_tfe_hw_mgr.debug_cfg.dentry = dbgfileptr;
+
+	dbgfileptr = debugfs_create_file("tfe_csid_debug", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry, NULL, &cam_tfe_csid_debug);
+	debugfs_create_u32("enable_recovery", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.enable_recovery);
+	debugfs_create_u32("enable_reg_dump", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.enable_reg_dump);
+	debugfs_create_u32("enable_csid_recovery", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.enable_csid_recovery);
+	dbgfileptr = debugfs_create_file("tfe_camif_debug", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry, NULL, &cam_tfe_camif_debug);
+	debugfs_create_u32("per_req_reg_dump", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.per_req_reg_dump);
+	debugfs_create_bool("enable_cdm_cmd_check", 0644, g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.enable_cdm_cmd_check);
+	if (IS_ERR(dbgfileptr)) {
+		if (PTR_ERR(dbgfileptr) == -ENODEV)
+			CAM_WARN(CAM_ISP, "DebugFS not enabled in kernel!");
+		else
+			rc = PTR_ERR(dbgfileptr);
+	}
+end:
+	g_tfe_hw_mgr.debug_cfg.enable_recovery = 0;
+	return rc;
+}
+
+static void cam_req_mgr_process_tfe_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+int cam_tfe_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl)
+{
+	int rc = -EFAULT;
+	int i, j;
+	struct cam_iommu_handle cdm_handles;
+	struct cam_tfe_hw_mgr_ctx *ctx_pool;
+	struct cam_isp_hw_path_port_map path_port_map;
+	struct cam_isp_hw_cap isp_cap = {0};
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	memset(&g_tfe_hw_mgr, 0, sizeof(g_tfe_hw_mgr));
+	memset(&path_port_map, 0, sizeof(path_port_map));
+
+	mutex_init(&g_tfe_hw_mgr.ctx_mutex);
+	spin_lock_init(&g_tfe_hw_mgr.ctx_lock);
+
+	if (CAM_TFE_HW_NUM_MAX != CAM_TFE_CSID_HW_NUM_MAX) {
+		CAM_ERR(CAM_ISP, "CSID num is different then TFE num");
+		return -EINVAL;
+	}
+
+	/* fill tfe hw intf information */
+	for (i = 0, j = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		rc = cam_tfe_hw_init(&g_tfe_hw_mgr.tfe_devices[i], i);
+		if (!rc) {
+			struct cam_hw_intf *tfe_device =
+				g_tfe_hw_mgr.tfe_devices[i]->hw_intf;
+			struct cam_hw_info *tfe_hw = (struct cam_hw_info *)
+				g_tfe_hw_mgr.tfe_devices[i]->hw_intf->hw_priv;
+			struct cam_hw_soc_info *soc_info = &tfe_hw->soc_info;
+
+			if (j == 0) {
+				tfe_device->hw_ops.process_cmd(
+					tfe_hw,
+					CAM_ISP_HW_CMD_QUERY_CAP,
+					&isp_cap,
+					sizeof(struct cam_isp_hw_cap));
+				CAM_DBG(CAM_ISP,
+					"max TFE out resources: 0x%x supported consume add: 0x%x",
+					isp_cap.max_out_res_type, isp_cap.support_consumed_addr);
+
+				tfe_device->hw_ops.process_cmd(
+					tfe_hw,
+					CAM_ISP_HW_CMD_GET_PATH_PORT_MAP,
+					&path_port_map,
+					sizeof(struct cam_isp_hw_path_port_map));
+				CAM_DBG(CAM_ISP, "received %d path-port mappings",
+					path_port_map.num_entries);
+			}
+
+			j++;
+
+			g_tfe_hw_mgr.cdm_reg_map[i] = &soc_info->reg_map[0];
+			g_tfe_hw_mgr.session_data[i].link_hdl = 0;
+			g_tfe_hw_mgr.session_data[i].is_shdr = false;
+			CAM_DBG(CAM_ISP,
+				"reg_map: mem base = %pK cam_base = 0x%llx",
+				(void __iomem *)soc_info->reg_map[0].mem_base,
+				(uint64_t) soc_info->reg_map[0].mem_cam_base);
+		} else {
+			g_tfe_hw_mgr.cdm_reg_map[i] = NULL;
+		}
+	}
+	if (j == 0) {
+		CAM_ERR(CAM_ISP, "no valid TFE HW");
+		return -EINVAL;
+	}
+
+	g_tfe_hw_mgr.isp_caps.support_consumed_addr =
+		isp_cap.support_consumed_addr;
+	g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type =
+		isp_cap.max_out_res_type;
+	memset(&isp_cap, 0x0, sizeof(struct cam_isp_hw_cap));
+
+	for (i = 0; i < path_port_map.num_entries; i++) {
+		g_tfe_hw_mgr.path_port_map.entry[i][0] = path_port_map.entry[i][0];
+		g_tfe_hw_mgr.path_port_map.entry[i][1] = path_port_map.entry[i][1];
+	}
+	g_tfe_hw_mgr.path_port_map.num_entries = path_port_map.num_entries;
+
+	/* fill csid hw intf information */
+	for (i = 0, j = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+		rc = cam_tfe_csid_hw_init(&g_tfe_hw_mgr.csid_devices[i], i);
+		if (!rc)
+			j++;
+	}
+	if (!j) {
+		CAM_ERR(CAM_ISP, "no valid TFE CSID HW");
+		return -EINVAL;
+	}
+
+	cam_tfe_hw_mgr_sort_dev_with_caps(&g_tfe_hw_mgr);
+
+	/* setup tfe context list */
+	INIT_LIST_HEAD(&g_tfe_hw_mgr.free_ctx_list);
+	INIT_LIST_HEAD(&g_tfe_hw_mgr.used_ctx_list);
+
+	/*
+	 *  for now, we only support one iommu handle. later
+	 *  we will need to setup more iommu handle for other
+	 *  use cases.
+	 *  Also, we have to release them once we have the
+	 *  deinit support
+	 */
+	if (cam_smmu_get_handle("tfe",
+		&g_tfe_hw_mgr.mgr_common.img_iommu_hdl)) {
+		CAM_ERR(CAM_ISP, "Can not get iommu handle");
+		return -EINVAL;
+	}
+
+	if (cam_smmu_get_handle("cam-secure",
+		&g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure)) {
+		CAM_ERR(CAM_ISP, "Failed to get secure iommu handle");
+		goto secure_fail;
+	}
+
+	CAM_DBG(CAM_ISP, "iommu_handles: non-secure[0x%x], secure[0x%x]",
+		g_tfe_hw_mgr.mgr_common.img_iommu_hdl,
+		g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure);
+
+	if (!cam_cdm_get_iommu_handle("tfe0", &cdm_handles)) {
+		CAM_DBG(CAM_ISP, "Successfully acquired the CDM iommu handles");
+		g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl = cdm_handles.non_secure;
+		g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl_secure =
+			cdm_handles.secure;
+	} else {
+		CAM_DBG(CAM_ISP, "Failed to acquire the CDM iommu handles");
+		g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl = -1;
+		g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl_secure = -1;
+	}
+
+	atomic_set(&g_tfe_hw_mgr.active_ctx_cnt, 0);
+	for (i = 0; i < CAM_TFE_CTX_MAX; i++) {
+		memset(&g_tfe_hw_mgr.ctx_pool[i], 0,
+			sizeof(g_tfe_hw_mgr.ctx_pool[i]));
+		INIT_LIST_HEAD(&g_tfe_hw_mgr.ctx_pool[i].list);
+		INIT_LIST_HEAD(&g_tfe_hw_mgr.ctx_pool[i].res_list_tfe_csid);
+		INIT_LIST_HEAD(&g_tfe_hw_mgr.ctx_pool[i].res_list_tfe_in);
+		ctx_pool = &g_tfe_hw_mgr.ctx_pool[i];
+
+		g_tfe_hw_mgr.ctx_pool[i].tfe_out_map =
+			kzalloc((g_tfe_hw_mgr.isp_caps.max_tfe_out_res_type * sizeof(uint8_t)),
+				GFP_KERNEL);
+		if (!g_tfe_hw_mgr.ctx_pool[i].tfe_out_map) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_ISP, "Alloc failed for tfe_out_map, ctx_idx: %u",
+				g_tfe_hw_mgr.ctx_pool[i].ctx_index);
+			goto end;
+		}
+
+		/* init context pool */
+		INIT_LIST_HEAD(&g_tfe_hw_mgr.ctx_pool[i].free_res_list);
+		for (j = 0; j < CAM_TFE_HW_RES_POOL_MAX; j++) {
+			INIT_LIST_HEAD(
+				&g_tfe_hw_mgr.ctx_pool[i].res_pool[j].list);
+			list_add_tail(
+				&g_tfe_hw_mgr.ctx_pool[i].res_pool[j].list,
+				&g_tfe_hw_mgr.ctx_pool[i].free_res_list);
+		}
+
+		g_tfe_hw_mgr.ctx_pool[i].cdm_cmd =
+			kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+				((CAM_ISP_CTX_CFG_MAX - 1) *
+				 sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+		if (!g_tfe_hw_mgr.ctx_pool[i].cdm_cmd) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_ISP, "Allocation Failed for cdm command");
+			goto end;
+		}
+
+		g_tfe_hw_mgr.ctx_pool[i].ctx_index = i;
+		g_tfe_hw_mgr.ctx_pool[i].hw_mgr = &g_tfe_hw_mgr;
+
+		cam_tasklet_init(&g_tfe_hw_mgr.mgr_common.tasklet_pool[i],
+			&g_tfe_hw_mgr.ctx_pool[i], i);
+		g_tfe_hw_mgr.ctx_pool[i].common.tasklet_info =
+			g_tfe_hw_mgr.mgr_common.tasklet_pool[i];
+
+
+		init_completion(&g_tfe_hw_mgr.ctx_pool[i].config_done_complete);
+		list_add_tail(&g_tfe_hw_mgr.ctx_pool[i].list,
+			&g_tfe_hw_mgr.free_ctx_list);
+	}
+
+	/* Create Worker for tfe_hw_mgr with 10 tasks */
+	rc = cam_req_mgr_workq_create("cam_tfe_worker", 10,
+		&g_tfe_hw_mgr.workq, CRM_WORKQ_USAGE_NON_IRQ, 0,
+		cam_req_mgr_process_tfe_worker);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Unable to create worker");
+		goto end;
+	}
+
+	/* fill return structure */
+	hw_mgr_intf->hw_mgr_priv = &g_tfe_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_tfe_mgr_get_hw_caps;
+	hw_mgr_intf->hw_get_caps_v2 = cam_tfe_mgr_get_hw_caps_v2;
+	hw_mgr_intf->hw_acquire = cam_tfe_mgr_acquire;
+	hw_mgr_intf->hw_start = cam_tfe_mgr_start_hw;
+	hw_mgr_intf->hw_stop = cam_tfe_mgr_stop_hw;
+	hw_mgr_intf->hw_read = cam_tfe_mgr_read;
+	hw_mgr_intf->hw_write = cam_tfe_mgr_write;
+	hw_mgr_intf->hw_release = cam_tfe_mgr_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_tfe_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config = cam_tfe_mgr_config_hw;
+	hw_mgr_intf->hw_cmd = cam_tfe_mgr_cmd;
+	hw_mgr_intf->hw_reset = cam_tfe_mgr_reset;
+	hw_mgr_intf->hw_dump = cam_tfe_mgr_dump;
+
+	if (iommu_hdl)
+		*iommu_hdl = g_tfe_hw_mgr.mgr_common.img_iommu_hdl;
+
+	cam_tfe_hw_mgr_debug_register();
+	cam_tfe_mgr_count_functional_tfe();
+
+	cam_tfe_get_num_tfe_hws(&g_num_tfe_available);
+	rc = cam_cpas_prepare_subpart_info(CAM_IFE_HW_IDX, g_num_tfe_available,
+		g_num_tfe_functional);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to populate num_ifes, rc: %d", rc);
+
+	cam_tfe_get_num_tfe_lite_hws(&g_num_tfe_lite_available);
+	rc = cam_cpas_prepare_subpart_info(CAM_IFE_LITE_HW_IDX, g_num_tfe_lite_available,
+		g_num_tfe_lite_functional);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to populate num_ife_lites, rc: %d", rc);
+
+	CAM_DBG(CAM_ISP, "Exit");
+
+	return 0;
+end:
+	if (rc) {
+		for (i = 0; i < CAM_TFE_CTX_MAX; i++) {
+			cam_tasklet_deinit(
+				&g_tfe_hw_mgr.mgr_common.tasklet_pool[i]);
+			kfree(g_tfe_hw_mgr.ctx_pool[i].cdm_cmd);
+			g_tfe_hw_mgr.ctx_pool[i].cdm_cmd = NULL;
+			kfree(g_tfe_hw_mgr.ctx_pool[i].tfe_out_map);
+			g_tfe_hw_mgr.ctx_pool[i].tfe_out_map = NULL;
+			g_tfe_hw_mgr.ctx_pool[i].common.tasklet_info = NULL;
+		}
+	}
+	cam_smmu_destroy_handle(
+		g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure);
+	g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure = -1;
+secure_fail:
+	cam_smmu_destroy_handle(g_tfe_hw_mgr.mgr_common.img_iommu_hdl);
+	g_tfe_hw_mgr.mgr_common.img_iommu_hdl = -1;
+	return rc;
+}
+
+void cam_tfe_hw_mgr_deinit(void)
+{
+	int i = 0;
+
+	cam_req_mgr_workq_destroy(&g_tfe_hw_mgr.workq);
+	g_tfe_hw_mgr.debug_cfg.dentry = NULL;
+
+	for (i = 0; i < CAM_TFE_CTX_MAX; i++) {
+		cam_tasklet_deinit(
+			&g_tfe_hw_mgr.mgr_common.tasklet_pool[i]);
+		kfree(g_tfe_hw_mgr.ctx_pool[i].cdm_cmd);
+		g_tfe_hw_mgr.ctx_pool[i].cdm_cmd = NULL;
+		kfree(g_tfe_hw_mgr.ctx_pool[i].tfe_out_map);
+		g_tfe_hw_mgr.ctx_pool[i].tfe_out_map = NULL;
+		g_tfe_hw_mgr.ctx_pool[i].common.tasklet_info = NULL;
+	}
+
+	cam_smmu_destroy_handle(
+		g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure);
+	g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure = -1;
+
+	cam_smmu_destroy_handle(g_tfe_hw_mgr.mgr_common.img_iommu_hdl);
+	g_tfe_hw_mgr.mgr_common.img_iommu_hdl = -1;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.h
@@ -0,0 +1,289 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_HW_MGR_H_
+#define _CAM_TFE_HW_MGR_H_
+
+#include <linux/completion.h>
+#include <media/cam_isp_tfe.h>
+#include "cam_isp_hw_mgr.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_tfe_csid_hw_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_cdm_intf_api.h"
+
+
+
+/* TFE resource constants */
+#define CAM_TFE_HW_IN_RES_MAX            (CAM_ISP_TFE_IN_RES_MAX & 0xFF)
+#define CAM_TFE_HW_RES_POOL_MAX          64
+
+/**
+ * struct cam_tfe_hw_mgr_debug - contain the debug information
+ *
+ * @dentry:                    Debugfs entry
+ * @csid_debug:                csid debug information
+ * @enable_recovery:           enable recovery
+ * @enable_csid_recovery:      enable csid recovery
+ * @camif_debug:               enable sensor diagnosis status
+ * @enable_reg_dump:           enable reg dump on error;
+ * @per_req_reg_dump:          Enable per request reg dump
+ * @enable_cdm_cmd_check:      Enable invalid command check in cmd_buf
+ */
+struct cam_tfe_hw_mgr_debug {
+	struct dentry  *dentry;
+	uint64_t       csid_debug;
+	uint32_t       enable_recovery;
+	uint32_t       enable_csid_recovery;
+	uint32_t       camif_debug;
+	uint32_t       enable_reg_dump;
+	uint32_t       per_req_reg_dump;
+	bool           enable_cdm_cmd_check;
+};
+
+/**
+ * struct cam_tfe_hw_comp_record
+ *
+ * @brief:              Structure record the res id reserved on a comp group
+ *
+ * @num_res:            Number of valid resource IDs in this record
+ * @res_id:             Resource IDs to report buf dones
+ *
+ */
+struct cam_tfe_hw_comp_record {
+	uint32_t num_res;
+	uint32_t res_id[CAM_NUM_OUT_PER_COMP_IRQ_MAX];
+};
+
+/**
+ * struct cam_tfe_comp_record_query
+ *
+ * @brief:              Structure record the bus comp group pointer information
+ * @tfe_bus_comp_grp:   Tfe bus comp group pointer
+ * @reserved:           used to make parent compatible with struct cam_isp_comp_record_query
+ *
+ */
+struct cam_tfe_comp_record_query {
+	struct cam_tfe_hw_comp_record        *tfe_bus_comp_grp;
+	void *reserved;
+};
+
+/**
+ * struct cam_tfe_cdm_user_data - TFE HW user data with CDM
+ *
+ * @prepare:                   hw_update_data
+ * @request_id:                Request id
+ */
+struct cam_tfe_cdm_user_data {
+	struct cam_isp_prepare_hw_update_data    *hw_update_data;
+	uint64_t                                  request_id;
+};
+
+/**
+ * struct cam_isp_tfe_hw_caps - BUS capabilities
+ *
+ * @max_tfe_out_res_type  :  max tfe out res type value from hw
+ * @support_consumed_addr :  indicate whether hw supports last consumed address
+ */
+struct cam_isp_tfe_hw_caps {
+	uint32_t     max_tfe_out_res_type;
+	bool         support_consumed_addr;
+};
+
+/**
+ * struct cam_tfe_hw_mgr_ctx - TFE HW manager Context object
+ *
+ * @list:                     used by the ctx list.
+ * @common:                   common acquired context data
+ * @ctx_index:                acquired context id.
+ * @hw_mgr:                   tfe hw mgr which owns this context
+ * @ctx_in_use:               flag to tell whether context is active
+ * @res_list_csid:            csid resource list
+ * @res_list_tfe_in:          tfe input resource list
+ * @res_list_tfe_out:         tfe output resoruces array
+ * @num_acq_tfe_out:          Number of acquired TFE out resources
+ * @free_res_list:            free resources list for the branch node
+ * @tfe_out_map:              Map for TFE out ports
+ * @res_pool:                 memory storage for the free resource list
+ * @base                      device base index array contain the all TFE HW
+ *                            instance associated with this context.
+ * @num_base                  number of valid base data in the base array
+ * @cdm_handle                cdm hw acquire handle
+ * @cdm_ops                   cdm util operation pointer for building
+ *                            cdm commands
+ * @cdm_cmd                   cdm base and length request pointer
+ * @last_submit_bl_cmd        last submiited CDM BL command data
+ * @config_done_complete      indicator for configuration complete
+ * @overflow_pending          flat to specify the overflow is pending for the
+ *                            context
+ * @cdm_done                  flag to indicate cdm has finished writing shadow
+ *                            registers
+ * @last_cdm_done_req:        Last CDM done request
+ * @is_rdi_only_context       flag to specify the context has only rdi resource
+ * @reg_dump_buf_desc:        cmd buffer descriptors for reg dump
+ * @num_reg_dump_buf:         count of descriptors in reg_dump_buf_desc
+ * @applied_req_id:           last request id to be applied
+ * @last_dump_flush_req_id    last req id for which reg dump on flush was called
+ * @last_dump_err_req_id      last req id for which reg dump on error was called
+ * @init_done                 indicate whether init hw is done
+ * @is_dual                   indicate whether context is in dual TFE mode
+ * @master_hw_idx             master hardware index in dual tfe case
+ * @slave_hw_idx              slave hardware index in dual tfe case
+ * @dual_tfe_irq_mismatch_cnt irq mismatch count value per core, used for
+ *                              dual TFE
+ * @packet                     CSL packet from user mode driver
+ * @bw_config_version          BW Config version
+ * @tfe_bus_comp_grp          pointer to tfe comp group info
+ * @cdm_userdata               CDM user data
+ * @try_recovery_cnt          Retry count for overflow recovery
+ * @current_mup               Current MUP val
+ * @recovery_req_id           The request id on which overflow recovery happens
+ * @acquired_wm_mask          Bitmask of acquired out resource
+ * @is_shdr                   Indicate if the usecase is SHDR
+ * @is_shdr_slave             Indicate whether context is slave in shdr usecase
+ * @ctx_state                 Indicate if ctx is active or paused
+ */
+struct cam_tfe_hw_mgr_ctx {
+	struct list_head                list;
+	struct cam_isp_hw_mgr_ctx       common;
+
+	uint32_t                        ctx_index;
+	struct cam_tfe_hw_mgr          *hw_mgr;
+	uint32_t                        ctx_in_use;
+
+	struct list_head                res_list_tfe_csid;
+	struct list_head                res_list_tfe_in;
+	struct cam_isp_hw_mgr_res       *res_list_tfe_out;
+	uint32_t                        num_acq_tfe_out;
+
+	struct list_head                free_res_list;
+	uint8_t                         *tfe_out_map;
+	struct cam_isp_hw_mgr_res       res_pool[CAM_TFE_HW_RES_POOL_MAX];
+
+	struct cam_isp_ctx_base_info    base[CAM_TFE_HW_NUM_MAX];
+	uint32_t                        num_base;
+	uint32_t                        cdm_handle;
+	struct cam_cdm_utils_ops       *cdm_ops;
+	struct cam_cdm_bl_request      *cdm_cmd;
+	struct cam_cdm_bl_info          last_submit_bl_cmd;
+	struct completion               config_done_complete;
+
+	atomic_t                        overflow_pending;
+	atomic_t                        cdm_done;
+	uint64_t                        last_cdm_done_req;
+	uint32_t                        is_rdi_only_context;
+	struct cam_cmd_buf_desc         reg_dump_buf_desc[
+						CAM_REG_DUMP_MAX_BUF_ENTRIES];
+	uint32_t                        num_reg_dump_buf;
+	uint64_t                        applied_req_id;
+	uint64_t                        last_dump_flush_req_id;
+	uint64_t                        last_dump_err_req_id;
+	bool                            init_done;
+	bool                            is_dual;
+	uint32_t                        master_hw_idx;
+	uint32_t                        slave_hw_idx;
+	uint32_t                        dual_tfe_irq_mismatch_cnt;
+	struct cam_packet              *packet;
+	uint32_t                        bw_config_version;
+	struct cam_tfe_hw_comp_record  *tfe_bus_comp_grp;
+	struct cam_tfe_cdm_user_data    cdm_userdata;
+	uint32_t                        current_mup;
+	uint32_t                        try_recovery_cnt;
+	uint64_t                        recovery_req_id;
+	uint64_t                        acquired_wm_mask;
+	enum cam_cdm_id                 cdm_id;
+	bool                            is_shdr;
+	bool                            is_shdr_slave;
+	uint32_t                        ctx_state;
+};
+
+/**
+ * struct cam_tfe_hw_mgr - TFE HW Manager
+ *
+ * @mgr_common:            common data for all HW managers
+ * @csid_devices:          csid device instances array. This will be filled by
+ *                         HW manager during the initialization.
+ * @tfe_devices:           TFE device instances array. This will be filled by
+ *                         HW layer during initialization
+ * @cdm_reg_map            commands for register dump
+ * @ctx_mutex:             mutex for the hw context pool
+ * @active_ctx_cnt         active context count number
+ * @free_ctx_list:         free hw context list
+ * @used_ctx_list:         used hw context list
+ * @ctx_pool:              context storage
+ * @session_data:          Data related to current session
+ * @tfe_csid_dev_caps      csid device capability stored per core
+ * @tfe_dev_caps           tfe device capability per core
+ * @work q                 work queue for TFE hw manager
+ * @debug_cfg              debug configuration
+ * @path_port_map          Mapping of outport to TFE mux
+ * @ctx_lock               Spinlock for HW manager
+ * @isp_caps               Capability of underlying TFE HW
+ */
+struct cam_tfe_hw_mgr {
+	struct cam_isp_hw_mgr            mgr_common;
+	struct cam_hw_intf              *csid_devices[CAM_TFE_CSID_HW_NUM_MAX];
+	struct cam_isp_hw_intf_data     *tfe_devices[CAM_TFE_HW_NUM_MAX];
+	struct cam_soc_reg_map          *cdm_reg_map[CAM_TFE_HW_NUM_MAX];
+	struct mutex                     ctx_mutex;
+	atomic_t                         active_ctx_cnt;
+	struct list_head                 free_ctx_list;
+	struct list_head                 used_ctx_list;
+	struct cam_tfe_hw_mgr_ctx        ctx_pool[CAM_TFE_CTX_MAX];
+	struct cam_isp_session_data      session_data[CAM_TFE_HW_NUM_MAX];
+
+	struct cam_tfe_csid_hw_caps      tfe_csid_dev_caps[
+						CAM_TFE_CSID_HW_NUM_MAX];
+	struct cam_tfe_hw_get_hw_cap     tfe_dev_caps[CAM_TFE_HW_NUM_MAX];
+	struct cam_req_mgr_core_workq   *workq;
+	struct cam_tfe_hw_mgr_debug      debug_cfg;
+	struct cam_isp_hw_path_port_map  path_port_map;
+	spinlock_t                       ctx_lock;
+	struct cam_isp_tfe_hw_caps       isp_caps;
+};
+
+/**
+ * struct cam_tfe_hw_event_recovery_data - Payload for the recovery procedure
+ *
+ * @error_type:               Error type that causes the recovery
+ * @affected_core:            Array of the hardware cores that are affected
+ * @affected_ctx:             Array of the hardware contexts that are affected
+ * @no_of_context:            Actual number of the affected context
+ *
+ */
+struct cam_tfe_hw_event_recovery_data {
+	uint32_t                   error_type;
+	uint32_t                   affected_core[CAM_TFE_HW_NUM_MAX];
+	struct cam_tfe_hw_mgr_ctx *affected_ctx[CAM_TFE_CTX_MAX];
+	uint32_t                   no_of_context;
+};
+
+/**
+ * cam_tfe_hw_mgr_init()
+ *
+ * @brief:              Initialize the TFE hardware manger. This is the
+ *                      etnry functinon for the TFE HW manager.
+ *
+ * @hw_mgr_intf:        TFE hardware manager object returned
+ * @iommu_hdl:          Iommu handle to be returned
+ *
+ */
+#ifdef CONFIG_SPECTRA_TFE
+int cam_tfe_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl);
+void cam_tfe_hw_mgr_deinit(void);
+#else
+static inline int cam_tfe_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf,
+	int *iommu_hdl)
+{
+	return -EINVAL;
+}
+
+static inline void cam_tfe_hw_mgr_deinit(void)
+{
+}
+#endif
+
+#endif /* _CAM_TFE_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
@@ -0,0 +1,2163 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <media/cam_defs.h>
+#include <media/cam_isp.h>
+#include "cam_mem_mgr.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_isp_packet_parser.h"
+#include "cam_debug_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+int cam_isp_count_hw_entries(struct cam_hw_prepare_update_args *prepare)
+{
+	uint32_t                            i, num_in_buf, num_out_buf;
+	struct cam_buf_io_cfg              *io_cfg;
+	struct cam_hw_fence_map_entry      *out_map_entries;
+	struct cam_hw_fence_map_entry      *in_map_entries;
+
+	io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+			&prepare->packet->payload +
+			prepare->packet->io_configs_offset);
+	num_out_buf = 0;
+	num_in_buf = 0;
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		if (io_cfg[i].direction == CAM_BUF_OUTPUT) {
+			out_map_entries =
+				&prepare->out_map_entries[num_out_buf];
+			if (num_out_buf <
+				prepare->max_out_map_entries) {
+				out_map_entries->resource_handle =
+					io_cfg[i].resource_type;
+				out_map_entries->sync_id =
+					io_cfg[i].fence;
+				num_out_buf++;
+			} else {
+				CAM_ERR(CAM_ISP, "ln_out:%d max_ln:%d",
+					num_out_buf,
+					prepare->max_out_map_entries);
+				return -EINVAL;
+			}
+		} else if (io_cfg[i].direction == CAM_BUF_INPUT) {
+			in_map_entries =
+				&prepare->in_map_entries[num_in_buf];
+			if (num_in_buf < prepare->max_in_map_entries) {
+				in_map_entries->resource_handle =
+					io_cfg[i].resource_type;
+				in_map_entries->sync_id =
+					io_cfg[i].fence;
+				num_in_buf++;
+			} else {
+				CAM_ERR(CAM_ISP, "ln_in:%d imax_ln:%d",
+					num_in_buf,
+					prepare->max_in_map_entries);
+				return -EINVAL;
+			}
+		} else {
+			CAM_ERR(CAM_ISP, "Invalid buf direction");
+			return -EINVAL;
+		}
+	}
+	prepare->num_out_map_entries = num_out_buf;
+	prepare->num_in_map_entries  = num_in_buf;
+	return 0;
+}
+
+static void cam_isp_add_update_entry(
+	enum cam_isp_cdm_bl_type            cdm_bl_type,
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	uint32_t                            update_size)
+{
+	/* Validation is done from the caller */
+	uint32_t num_ent;
+	struct cam_hw_update_entry *curr_update_entry;
+
+	num_ent = prepare->num_hw_update_entries;
+	curr_update_entry = &(prepare->hw_update_entries[num_ent]);
+	curr_update_entry->handle = kmd_buf_info->handle;
+	curr_update_entry->len = update_size;
+	curr_update_entry->offset = kmd_buf_info->offset;
+	curr_update_entry->flags = cdm_bl_type;
+	curr_update_entry->addr = (uintptr_t) (kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes/4);
+
+	num_ent++;
+	kmd_buf_info->used_bytes += update_size;
+	kmd_buf_info->offset     += update_size;
+	prepare->num_hw_update_entries = num_ent;
+
+	CAM_DBG(CAM_ISP,
+		"Add new entry: num_ent=%d handle=0x%x, len=%u, offset=%u",
+		num_ent - 1, curr_update_entry->handle,
+		curr_update_entry->len, curr_update_entry->offset);
+}
+
+static void cam_isp_combine_update_entry(
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	uint32_t                            update_size)
+{
+	/* Validation is done from the caller */
+	uint32_t num_ent;
+	struct cam_hw_update_entry *prev_update_entry;
+
+	num_ent = prepare->num_hw_update_entries;
+	prev_update_entry = &(prepare->hw_update_entries[num_ent - 1]);
+	prev_update_entry->len += update_size;
+
+	CAM_DBG(CAM_ISP,
+		"Combined with prev entry: num_ent=%d handle=0x%x, len=%u, offset=%u",
+		num_ent - 1, prev_update_entry->handle,
+		prev_update_entry->len, prev_update_entry->offset);
+
+	kmd_buf_info->used_bytes += update_size;
+	kmd_buf_info->offset += update_size;
+}
+
+void cam_isp_update_hw_entry(
+	enum cam_isp_cdm_bl_type            cdm_bl_type,
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	uint32_t                            update_size,
+	bool                                combine)
+{
+	if (combine)
+		cam_isp_combine_update_entry(prepare,
+			kmd_buf_info, update_size);
+	else
+		cam_isp_add_update_entry(cdm_bl_type, prepare,
+			kmd_buf_info, update_size);
+}
+
+int cam_isp_add_change_base(
+	struct cam_hw_prepare_update_args      *prepare,
+	struct list_head                       *res_list_isp_src,
+	struct cam_isp_change_base_args        *change_base_args,
+	struct cam_kmd_buf_info                *kmd_buf_info)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+	struct cam_isp_resource_node    *res;
+	struct cam_isp_hw_get_cmd_update get_base;
+	uint32_t                         num_ent, i;
+
+	num_ent = prepare->num_hw_update_entries;
+
+	/* Max one hw entries required for each base */
+	if (num_ent + 1 >= prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			num_ent, prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			if (res->hw_intf->hw_idx != change_base_args->base_idx)
+				continue;
+
+			get_base.res  = res;
+			get_base.cdm_id = change_base_args->cdm_id;
+			get_base.cmd_type = CAM_ISP_HW_CMD_GET_CHANGE_BASE;
+			get_base.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4;
+			get_base.cmd.size  = kmd_buf_info->size -
+					kmd_buf_info->used_bytes;
+
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_CHANGE_BASE, &get_base,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+			if (rc)
+				return rc;
+
+			cam_isp_add_update_entry(CAM_ISP_COMMON_CFG_BL, prepare,
+				kmd_buf_info, get_base.cmd.used_bytes);
+
+			/* return success */
+			return 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_update_dual_config(
+	struct cam_cmd_buf_desc            *cmd_desc,
+	uint32_t                            split_id,
+	uint32_t                            base_idx,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint8_t                            *out_map,
+	uint32_t                            out_base,
+	uint32_t                            out_max)
+{
+	int rc = -EINVAL;
+	struct cam_isp_dual_config                 *dual_config;
+	struct cam_isp_hw_mgr_res                  *hw_mgr_res;
+	struct cam_isp_resource_node               *res;
+	struct cam_isp_hw_dual_isp_update_args      dual_isp_update_args;
+	uint32_t                                    port_id = 0;
+	uint32_t                                    ports_plane_idx;
+	size_t                                      len = 0, remain_len = 0;
+	uint32_t                                   *cpu_addr;
+	uint32_t                                    i, j;
+
+	CAM_DBG(CAM_ISP, "cmd des size %d, length: %d",
+		cmd_desc->size, cmd_desc->length);
+
+	rc = cam_packet_util_get_cmd_mem_addr(
+		cmd_desc->mem_handle, &cpu_addr, &len);
+	if (rc)
+		return rc;
+
+	if ((len < sizeof(struct cam_isp_dual_config)) ||
+		(cmd_desc->offset >=
+		(len - sizeof(struct cam_isp_dual_config)))) {
+		CAM_ERR(CAM_ISP, "not enough buffer provided");
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+	remain_len = len - cmd_desc->offset;
+	cpu_addr += (cmd_desc->offset / 4);
+	dual_config = (struct cam_isp_dual_config *)cpu_addr;
+
+	if ((dual_config->num_ports *
+		sizeof(struct cam_isp_dual_stripe_config)) >
+		(remain_len - offsetof(struct cam_isp_dual_config, stripes))) {
+		CAM_ERR(CAM_ISP, "not enough buffer for all the dual configs");
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+	for (i = 0; i < dual_config->num_ports; i++) {
+
+		if (i >= (out_max & 0xFF)) {
+			CAM_ERR(CAM_ISP,
+				"failed update for i:%d > size_isp_out:%d",
+				i, (out_max & 0xFF));
+			rc = -EINVAL;
+			goto end;
+		}
+
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			ports_plane_idx = (j * (dual_config->num_ports *
+				CAM_PACKET_MAX_PLANES)) +
+				(i * CAM_PACKET_MAX_PLANES);
+
+			if (dual_config->stripes_flex[ports_plane_idx].port_id == 0)
+				continue;
+			port_id = dual_config->stripes_flex[ports_plane_idx].port_id;
+			hw_mgr_res = &res_list_isp_out[out_map[port_id & 0xFF]];
+			if (!hw_mgr_res) {
+				CAM_ERR(CAM_ISP,
+					"Invalid isp out resource i %d num_out_res %d",
+					i, dual_config->num_ports);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			res = hw_mgr_res->hw_res[j];
+
+			if (res->res_id < out_base ||
+				res->res_id >= out_max)
+				continue;
+
+			dual_isp_update_args.split_id = j;
+			dual_isp_update_args.res      = res;
+			dual_isp_update_args.dual_cfg = dual_config;
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_STRIPE_UPDATE,
+				&dual_isp_update_args,
+				sizeof(struct cam_isp_hw_dual_isp_update_args));
+			if (rc)
+				goto end;
+		}
+	}
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+int cam_isp_add_cmd_buf_update(
+	struct cam_isp_resource_node         *res,
+	struct cam_hw_intf                   *hw_intf,
+	uint32_t                              cmd_type,
+	uint32_t                              hw_cmd_type,
+	uint32_t                             *cmd_buf_addr,
+	uint32_t                              kmd_buf_remain_size,
+	void                                 *cmd_update_data,
+	uint32_t                             *bytes_used)
+{
+	int rc = 0;
+	struct cam_isp_hw_get_cmd_update    cmd_update;
+	uint32_t                            total_used_bytes = 0;
+
+	cmd_update.cmd_type = hw_cmd_type;
+	cmd_update.cmd.cmd_buf_addr = cmd_buf_addr;
+	cmd_update.cmd.size = kmd_buf_remain_size;
+	cmd_update.cmd.used_bytes = 0;
+	cmd_update.data = cmd_update_data;
+	CAM_DBG(CAM_ISP, "cmd_type %u cmd buffer 0x%pK, size %d",
+		cmd_update.cmd_type,
+		cmd_update.cmd.cmd_buf_addr,
+		cmd_update.cmd.size);
+
+	cmd_update.res = res;
+	rc = hw_intf->hw_ops.process_cmd(
+		hw_intf->hw_priv,
+		cmd_update.cmd_type, &cmd_update,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "get buf cmd error:%d cmd %d", hw_intf->hw_idx,
+		cmd_update.cmd_type);
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	total_used_bytes += cmd_update.cmd.used_bytes;
+	*bytes_used = total_used_bytes;
+	CAM_DBG(CAM_ISP, "total_used_bytes %u", total_used_bytes);
+	return rc;
+}
+
+int cam_isp_add_command_buffers(
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	struct cam_isp_ctx_base_info       *base_info,
+	cam_packet_generic_blob_handler     blob_handler_cb,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint8_t                            *out_map,
+	uint32_t                            out_base,
+	uint32_t                            out_max)
+{
+	int rc = 0;
+	uint32_t                           cmd_meta_data, num_ent, i;
+	uint32_t                           base_idx;
+	enum cam_isp_hw_split_id           split_id;
+	struct cam_cmd_buf_desc           *cmd_desc = NULL;
+	struct cam_hw_update_entry        *hw_entry = NULL;
+
+	split_id = base_info->split_id;
+	base_idx = base_info->idx;
+	hw_entry = prepare->hw_update_entries;
+
+	/*
+	 * set the cmd_desc to point the first command descriptor in the
+	 * packet
+	 */
+	cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint8_t *)&prepare->packet->payload_flex +
+			prepare->packet->cmd_buf_offset);
+
+	CAM_DBG(CAM_ISP, "split id = %d, number of command buffers:%d",
+		split_id, prepare->packet->num_cmd_buf);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		num_ent = prepare->num_hw_update_entries;
+		if (!cmd_desc[i].length)
+			continue;
+
+		/* One hw entry space required for left or right or common */
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		cmd_meta_data = cmd_desc[i].meta_data;
+
+		CAM_DBG(CAM_ISP, "meta type: %d, split_id: %d",
+			cmd_meta_data, split_id);
+
+		switch (cmd_meta_data) {
+		case CAM_ISP_PACKET_META_BASE:
+		case CAM_ISP_PACKET_META_LEFT:
+		case CAM_ISP_PACKET_META_DMI_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				CAM_DBG(CAM_ISP,
+					"Meta_Left num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_PACKET_META_RIGHT:
+		case CAM_ISP_PACKET_META_DMI_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				CAM_DBG(CAM_ISP,
+					"Meta_Right num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_PACKET_META_COMMON:
+		case CAM_ISP_PACKET_META_DMI_COMMON:
+			hw_entry[num_ent].len = cmd_desc[i].length;
+			hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+			hw_entry[num_ent].offset = cmd_desc[i].offset;
+			CAM_DBG(CAM_ISP,
+				"Meta_Common num_ent=%d handle=0x%x, len=%u, offset=%u",
+				num_ent,
+				hw_entry[num_ent].handle,
+				hw_entry[num_ent].len,
+				hw_entry[num_ent].offset);
+			hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+			num_ent++;
+			break;
+		case CAM_ISP_PACKET_META_DUAL_CONFIG:
+			rc = cam_isp_update_dual_config(&cmd_desc[i],
+				split_id, base_idx, res_list_isp_out,
+				out_map, out_base, out_max);
+			if (rc)
+				return rc;
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				struct cam_isp_generic_blob_info   blob_info;
+
+				blob_info.prepare = prepare;
+				blob_info.base_info = base_info;
+				blob_info.kmd_buf_info = kmd_buf_info;
+				blob_info.entry_added = false;
+
+				rc = cam_packet_util_process_generic_cmd_buffer(
+					&cmd_desc[i],
+					blob_handler_cb,
+					&blob_info);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed in processing blobs %d",
+						rc);
+					return rc;
+				}
+				num_ent = prepare->num_hw_update_entries;
+			}
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				struct cam_isp_generic_blob_info   blob_info;
+
+				blob_info.prepare = prepare;
+				blob_info.base_info = base_info;
+				blob_info.kmd_buf_info = kmd_buf_info;
+				blob_info.entry_added = false;
+
+				rc = cam_packet_util_process_generic_cmd_buffer(
+					&cmd_desc[i],
+					blob_handler_cb,
+					&blob_info);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed in processing blobs %d",
+						rc);
+					return rc;
+				}
+				num_ent = prepare->num_hw_update_entries;
+			}
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_COMMON: {
+			struct cam_isp_generic_blob_info   blob_info;
+
+			blob_info.prepare = prepare;
+			blob_info.base_info = base_info;
+			blob_info.kmd_buf_info = kmd_buf_info;
+			blob_info.entry_added = false;
+
+			rc = cam_packet_util_process_generic_cmd_buffer(
+				&cmd_desc[i],
+				blob_handler_cb,
+				&blob_info);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in processing blobs %d", rc);
+				return rc;
+			}
+			num_ent = prepare->num_hw_update_entries;
+		}
+			break;
+		case CAM_ISP_PACKET_META_REG_DUMP_ON_FLUSH:
+		case CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR:
+		case CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				if (prepare->num_reg_dump_buf >=
+					CAM_REG_DUMP_MAX_BUF_ENTRIES) {
+					CAM_ERR(CAM_ISP,
+					"Descriptor count out of bounds: %d",
+					prepare->num_reg_dump_buf);
+					return -EINVAL;
+				}
+
+				prepare->reg_dump_buf_desc[
+					prepare->num_reg_dump_buf] =
+					cmd_desc[i];
+				prepare->num_reg_dump_buf++;
+				CAM_DBG(CAM_ISP,
+					"Added command buffer: %d desc_count: %d",
+					cmd_desc[i].meta_data,
+					prepare->num_reg_dump_buf);
+			}
+			break;
+		case CAM_ISP_SFE_PACKET_META_LEFT:
+		case CAM_ISP_SFE_PACKET_META_RIGHT:
+		case CAM_ISP_SFE_PACKET_META_COMMON:
+		case CAM_ISP_SFE_PACKET_META_DUAL_CONFIG:
+			break;
+		case CAM_ISP_PACKET_META_CSID_LEFT:
+		case CAM_ISP_PACKET_META_CSID_RIGHT:
+		case CAM_ISP_PACKET_META_CSID_COMMON:
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "invalid cdm command meta data %d",
+				cmd_meta_data);
+			return -EINVAL;
+		}
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+int cam_sfe_add_command_buffers(
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	struct cam_isp_ctx_base_info       *base_info,
+	cam_packet_generic_blob_handler     blob_handler_cb,
+	struct cam_isp_hw_mgr_res          *res_list_sfe_out,
+	uint8_t                            *out_map,
+	uint32_t                            out_base,
+	uint32_t                            out_max)
+{
+	int rc = 0;
+	uint32_t                             cmd_meta_data, num_ent, i;
+	enum cam_isp_hw_split_id             split_id;
+	struct cam_cmd_buf_desc             *cmd_desc = NULL;
+	struct cam_hw_update_entry          *hw_entry = NULL;
+
+	split_id = base_info->split_id;
+	hw_entry = prepare->hw_update_entries;
+
+	/*
+	 * set the cmd_desc to point the first command descriptor in the
+	 * packet
+	 */
+	cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint8_t *)&prepare->packet->payload_flex +
+			prepare->packet->cmd_buf_offset);
+
+	CAM_DBG(CAM_ISP, "split id = %d, number of command buffers:%d",
+		split_id, prepare->packet->num_cmd_buf);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		num_ent = prepare->num_hw_update_entries;
+		if (!cmd_desc[i].length)
+			continue;
+
+		/* One hw entry space required for left or right or common */
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		cmd_meta_data = cmd_desc[i].meta_data;
+
+		CAM_DBG(CAM_ISP, "meta type: %d, split_id: %d",
+			cmd_meta_data, split_id);
+
+		switch (cmd_meta_data) {
+		case CAM_ISP_SFE_PACKET_META_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				CAM_DBG(CAM_ISP,
+					"Meta_Left num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_SFE_PACKET_META_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				CAM_DBG(CAM_ISP,
+					"Meta_Right num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_SFE_PACKET_META_COMMON:
+			hw_entry[num_ent].len = cmd_desc[i].length;
+			hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+			hw_entry[num_ent].offset = cmd_desc[i].offset;
+			CAM_DBG(CAM_ISP,
+				"Meta_Common num_ent=%d handle=0x%x, len=%u, offset=%u",
+				num_ent,
+				hw_entry[num_ent].handle,
+				hw_entry[num_ent].len,
+				hw_entry[num_ent].offset);
+			hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+			num_ent++;
+			break;
+		case CAM_ISP_SFE_PACKET_META_DUAL_CONFIG:
+			rc = cam_isp_update_dual_config(&cmd_desc[i],
+				split_id, base_info->idx,
+				res_list_sfe_out, out_map, out_base, out_max);
+			if (rc)
+				return rc;
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				struct cam_isp_generic_blob_info   blob_info;
+
+				blob_info.prepare = prepare;
+				blob_info.base_info = base_info;
+				blob_info.kmd_buf_info = kmd_buf_info;
+				blob_info.entry_added = false;
+
+				rc = cam_packet_util_process_generic_cmd_buffer(
+					&cmd_desc[i],
+					blob_handler_cb,
+					&blob_info);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed in processing blobs %d",
+						rc);
+					return rc;
+				}
+				num_ent = prepare->num_hw_update_entries;
+			}
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				struct cam_isp_generic_blob_info   blob_info;
+
+				blob_info.prepare = prepare;
+				blob_info.base_info = base_info;
+				blob_info.kmd_buf_info = kmd_buf_info;
+				blob_info.entry_added = false;
+
+				rc = cam_packet_util_process_generic_cmd_buffer(
+					&cmd_desc[i],
+					blob_handler_cb,
+					&blob_info);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed in processing blobs %d",
+						rc);
+					return rc;
+				}
+				num_ent = prepare->num_hw_update_entries;
+			}
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_COMMON: {
+			struct cam_isp_generic_blob_info   blob_info;
+
+			blob_info.prepare = prepare;
+			blob_info.base_info = base_info;
+			blob_info.kmd_buf_info = kmd_buf_info;
+			blob_info.entry_added = false;
+
+			rc = cam_packet_util_process_generic_cmd_buffer(
+				&cmd_desc[i],
+				blob_handler_cb,
+				&blob_info);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in processing blobs %d", rc);
+				return rc;
+			}
+			num_ent = prepare->num_hw_update_entries;
+		}
+			break;
+		case CAM_ISP_PACKET_META_BASE:
+		case CAM_ISP_PACKET_META_LEFT:
+		case CAM_ISP_PACKET_META_RIGHT:
+		case CAM_ISP_PACKET_META_COMMON:
+		case CAM_ISP_PACKET_META_DMI_LEFT:
+		case CAM_ISP_PACKET_META_DMI_RIGHT:
+		case CAM_ISP_PACKET_META_DMI_COMMON:
+		case CAM_ISP_PACKET_META_CLOCK:
+		case CAM_ISP_PACKET_META_CSID:
+		case CAM_ISP_PACKET_META_DUAL_CONFIG:
+		case CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST:
+		case CAM_ISP_PACKET_META_REG_DUMP_ON_FLUSH:
+		case CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR:
+		case CAM_ISP_PACKET_META_CSID_LEFT:
+		case CAM_ISP_PACKET_META_CSID_RIGHT:
+		case CAM_ISP_PACKET_META_CSID_COMMON:
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "invalid cdm command meta data %d",
+				cmd_meta_data);
+			return -EINVAL;
+		}
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+static void cam_isp_validate_for_sfe_scratch(
+	struct cam_isp_sfe_scratch_buf_res_info *sfe_res_info,
+	uint32_t res_type, uint32_t out_base)
+{
+	uint32_t res_id_out = res_type & 0xFF;
+
+	if ((res_id_out) < ((out_base & 0xFF) +
+		sfe_res_info->num_active_fe_rdis)) {
+		CAM_DBG(CAM_ISP,
+			"Buffer found for SFE port: 0x%x - skip scratch buffer",
+			res_type);
+		sfe_res_info->sfe_rdi_cfg_mask |= (1 << res_id_out);
+	}
+}
+
+static void cam_isp_validate_for_ife_scratch(
+	struct cam_isp_ife_scratch_buf_res_info *ife_res_info,
+	uint32_t res_type)
+{
+	int i;
+
+	for (i = 0; i < ife_res_info->num_ports; i++) {
+		if (res_type == ife_res_info->ife_scratch_resources[i]) {
+			CAM_DBG(CAM_ISP,
+				"Buffer found for IFE port: 0x%x - skip scratch buffer",
+				res_type);
+			ife_res_info->ife_scratch_cfg_mask |= (1 << i);
+		}
+	}
+}
+
+static int cam_isp_get_outport_res_id(
+	void                               *priv,
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_buf_io_cfg              *io_cfg,
+	uint32_t                           *res_type,
+	uint32_t                           *res_id)
+{
+	int         rc = 0;
+	uint32_t    out_port;
+	struct cam_isp_prepare_hw_update_data *prepare_hw_data = NULL;
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+
+	if ((io_cfg->resource_type >= CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI0 &&
+		io_cfg->resource_type <= CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI5) &&
+		prepare_hw_data->per_port_enable) {
+		if (prepare_hw_data->virtual_rdi_mapping_cb) {
+			out_port = prepare_hw_data->virtual_rdi_mapping_cb(priv,
+				io_cfg->resource_type, true);
+
+			if (out_port < 0) {
+				CAM_ERR(CAM_ISP,
+					"Failed to get virtual rdi port mapping for out_res: %d req:%d",
+					io_cfg->resource_type, prepare->packet->header.request_id);
+				return -EINVAL;
+			}
+			*res_id = out_port & 0xFF;
+			*res_type = out_port;
+		} else {
+			CAM_ERR(CAM_ISP,
+				"invalid params: no virtual rdi mapping cb for out_res: %d req:%d",
+				io_cfg->resource_type, prepare->packet->header.request_id);
+			return -EINVAL;
+		}
+	} else {
+		*res_id = io_cfg->resource_type & 0xFF;
+		*res_type = io_cfg->resource_type;
+	}
+	CAM_DBG(CAM_ISP,
+		"out_res_type: %d req:%d res_id:%d",
+		*res_type, prepare->packet->header.request_id, *res_id);
+	return rc;
+}
+
+static int cam_isp_io_buf_get_entries_util(
+	struct cam_isp_io_buf_info              *buf_info,
+	struct cam_buf_io_cfg                   *io_cfg,
+	struct cam_isp_hw_mgr_res              **hw_mgr_res)
+{
+	uint32_t                                res_id;
+	uint32_t                                num_entries;
+	struct cam_hw_fence_map_entry          *map_entries  =  NULL;
+	struct cam_isp_hw_mgr_res              *hw_mgr_res_temp;
+	bool                                    found = false;
+	uint32_t                                res_type;
+	int rc = -EINVAL;
+
+	CAM_DBG(CAM_REQ,
+		"req_id %llu resource_type:%d fence:%d direction %d format %d",
+		buf_info->prepare->packet->header.request_id,
+		io_cfg->resource_type, io_cfg->fence,
+		io_cfg->direction, io_cfg->format);
+
+	if (io_cfg->direction == CAM_BUF_OUTPUT) {
+		rc = cam_isp_get_outport_res_id(buf_info->prepare->ctxt_to_hw_map,
+			buf_info->prepare,
+			io_cfg, &res_type, &res_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"failed to get outport res_id\n"
+				"req_id %llu resource_type:%d fence:%d direction %d",
+				buf_info->prepare->packet->header.request_id,
+				io_cfg->resource_type, io_cfg->fence,
+				io_cfg->direction);
+		}
+
+		if (res_type < buf_info->out_base ||
+			res_type >= buf_info->out_max)
+			return -ENOMSG;
+
+		if ((buf_info->base->hw_type == CAM_ISP_HW_TYPE_SFE)  &&
+				(buf_info->scratch_check_cfg->validate_for_sfe)) {
+			cam_isp_validate_for_sfe_scratch(
+				&buf_info->scratch_check_cfg->sfe_scratch_res_info,
+				res_type, buf_info->out_base);
+		} else if ((buf_info->base->hw_type == CAM_ISP_HW_TYPE_VFE) &&
+				(buf_info->scratch_check_cfg->validate_for_ife)) {
+			cam_isp_validate_for_ife_scratch(
+				&buf_info->scratch_check_cfg->ife_scratch_res_info,
+				res_type);
+		}
+		*hw_mgr_res = &buf_info->res_list_isp_out[buf_info->out_map[res_id]];
+
+		if ((*hw_mgr_res)->res_type == CAM_ISP_RESOURCE_UNINT) {
+			CAM_ERR(CAM_ISP, "io res id:%d not valid",
+				res_type);
+			return -EINVAL;
+		}
+	} else if (io_cfg->direction == CAM_BUF_INPUT) {
+		found = false;
+		res_id = io_cfg->resource_type;
+		if (!buf_info->res_list_in_rd) {
+			CAM_DBG(CAM_ISP,
+				"No BUS Read supported hw_type %d io_cfg %d req:%d type:%d fence:%d",
+				buf_info->base->hw_type,
+				buf_info->prepare->packet->num_io_configs,
+				buf_info->prepare->packet->header.request_id,
+				io_cfg->resource_type, io_cfg->fence);
+			return -ENOMSG;
+		}
+		if (buf_info->base->hw_type != CAM_ISP_HW_TYPE_SFE)
+			res_id = CAM_ISP_HW_VFE_IN_RD;
+
+		list_for_each_entry_safe((*hw_mgr_res), hw_mgr_res_temp,
+			buf_info->res_list_in_rd, list) {
+			if ((*hw_mgr_res)->res_id == res_id) {
+				found = true;
+				break;
+			}
+		}
+
+		if (!found) {
+			CAM_ERR(CAM_ISP, "No Read resource");
+			return -EINVAL;
+		}
+
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid io config direction :%d",
+				io_cfg->direction);
+		return -EINVAL;
+	}
+
+	if (buf_info->fill_fence) {
+		if (io_cfg->direction == CAM_BUF_OUTPUT &&
+			(buf_info->prepare->num_out_map_entries <
+				 buf_info->prepare->max_out_map_entries)) {
+			num_entries = buf_info->prepare->num_out_map_entries;
+			map_entries = &buf_info->prepare->out_map_entries[num_entries];
+			buf_info->prepare->num_out_map_entries++;
+			map_entries->resource_handle = res_type;
+		} else if (io_cfg->direction == CAM_BUF_INPUT &&
+			(buf_info->prepare->num_in_map_entries <
+				 buf_info->prepare->max_in_map_entries)) {
+			num_entries = buf_info->prepare->num_in_map_entries;
+			map_entries = &buf_info->prepare->in_map_entries[num_entries];
+			buf_info->prepare->num_in_map_entries++;
+			map_entries->resource_handle = io_cfg->resource_type;
+		} else {
+			CAM_ERR(CAM_ISP, "dir: %d max_ln:%d max_out: %u in: %u out %u",
+				io_cfg->direction,
+				buf_info->prepare->max_in_map_entries,
+				buf_info->prepare->max_out_map_entries,
+				buf_info->prepare->num_in_map_entries,
+				buf_info->prepare->num_out_map_entries);
+			return -EINVAL;
+		}
+		map_entries->sync_id = io_cfg->fence;
+	}
+
+	return 0;
+}
+
+static int cam_isp_add_io_buffers_util(
+	struct cam_isp_io_buf_info       *buf_info,
+	struct cam_buf_io_cfg            *io_cfg,
+	struct cam_isp_resource_node     *res)
+{
+	uint32_t                            secure_mode_cmd;
+	uint32_t                            bus_update_cmd;
+	int                                 rc = 0;
+	dma_addr_t                          io_addr[CAM_PACKET_MAX_PLANES];
+	struct cam_isp_hw_get_cmd_update    update_buf;
+	struct cam_isp_hw_get_wm_update     bus_port_update;
+	struct cam_hw_fence_map_entry      *out_map_entry = NULL;
+	struct cam_smmu_buffer_tracker     *old_head_entry, *new_head_entry;
+	uint32_t                            kmd_buf_remain_size;
+	uint32_t                            plane_id;
+	int                                 num_entries;
+	dma_addr_t                         *image_buf_addr;
+	uint32_t                           *image_buf_offset;
+	size_t                              size;
+	int                                 mmu_hdl;
+	bool                                is_buf_secure;
+	struct cam_isp_hw_get_cmd_update    secure_mode;
+	uint32_t                            mode = 0;
+	uint32_t                            res_id, res_type;
+
+	if (io_cfg->direction == CAM_BUF_OUTPUT) {
+		secure_mode_cmd = CAM_ISP_HW_CMD_GET_WM_SECURE_MODE;
+		bus_update_cmd = CAM_ISP_HW_CMD_GET_BUF_UPDATE;
+		rc = cam_isp_get_outport_res_id(buf_info->prepare->ctxt_to_hw_map,
+			buf_info->prepare,
+			io_cfg, &res_type, &res_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"failed to get outport res_id\n"
+				"req_id %llu resource_type:%d fence:%d direction %d",
+				buf_info->prepare->packet->header.request_id,
+				io_cfg->resource_type, io_cfg->fence,
+				io_cfg->direction);
+	}
+	} else if (io_cfg->direction == CAM_BUF_INPUT) {
+		secure_mode_cmd = CAM_ISP_HW_CMD_GET_RM_SECURE_MODE;
+		bus_update_cmd = CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM;
+		res_type = io_cfg->resource_type;
+
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid dir %d", io_cfg->direction);
+		return -EINVAL;
+	}
+
+	if (!res) {
+		CAM_ERR(CAM_ISP, "invalid res, io res id:%d split_id :%d",
+			io_cfg->resource_type, buf_info->base->split_id);
+		return -EINVAL;
+	}
+
+	if (res->res_id != res_type) {
+		CAM_ERR(CAM_ISP, "err res id:%d io res id:%d",
+			res->res_id, res_type);
+		return -EINVAL;
+	}
+
+	old_head_entry = list_first_entry_or_null(buf_info->prepare->buf_tracker,
+		struct cam_smmu_buffer_tracker, list);
+
+	memset(io_addr, 0, sizeof(io_addr));
+	for (plane_id = 0; plane_id < CAM_PACKET_MAX_PLANES; plane_id++) {
+		if (!io_cfg->mem_handle[plane_id])
+			break;
+		secure_mode.cmd_type = secure_mode_cmd;
+		secure_mode.res = res;
+		secure_mode.data = (void *)&mode;
+		rc = res->hw_intf->hw_ops.process_cmd(
+			res->hw_intf->hw_priv, secure_mode_cmd,
+			&secure_mode, (uint32_t)sizeof(struct cam_isp_hw_get_cmd_update));
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Get secure mode failed cmd_type %d res_id %d",
+				secure_mode_cmd, res->res_id);
+			return -EINVAL;
+		}
+
+		is_buf_secure = cam_mem_is_secure_buf(io_cfg->mem_handle[plane_id]);
+
+		if ((mode  == CAM_SECURE_MODE_SECURE) &&
+			is_buf_secure) {
+			mmu_hdl = buf_info->sec_iommu_hdl;
+		} else if ((mode == CAM_SECURE_MODE_NON_SECURE) &&
+			!is_buf_secure) {
+			mmu_hdl = buf_info->iommu_hdl;
+		} else {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"Invalid hdl: port mode[%u], buf mode[%u]",
+				mode, is_buf_secure);
+			return -EINVAL;
+		}
+
+		rc = cam_mem_get_io_buf(io_cfg->mem_handle[plane_id],
+			mmu_hdl, &io_addr[plane_id], &size, NULL,
+			(!plane_id && (io_cfg->direction == CAM_BUF_OUTPUT)) ?
+			buf_info->prepare->buf_tracker : NULL);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "no io addr for plane%d", plane_id);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		/* need to update with offset */
+		io_addr[plane_id] += io_cfg->offsets[plane_id];
+		CAM_DBG(CAM_ISP, "get io_addr for plane %d: 0x%llx, mem_hdl=0x%x",
+			plane_id, io_addr[plane_id], io_cfg->mem_handle[plane_id]);
+
+		CAM_DBG(CAM_ISP, "mmu_hdl=0x%x, size=%zu, end=0x%llx",
+			mmu_hdl, size, io_addr[plane_id]+size);
+	}
+
+	if (!plane_id) {
+		CAM_ERR(CAM_ISP, "No valid planes for res%d", res->res_id);
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	if ((buf_info->kmd_buf_info->used_bytes) <
+		buf_info->kmd_buf_info->size) {
+		kmd_buf_remain_size = buf_info->kmd_buf_info->size -
+			(buf_info->kmd_buf_info->used_bytes);
+	} else {
+		CAM_ERR(CAM_ISP, "no free kmd memory for base %d", buf_info->base->idx);
+		rc = -ENOMEM;
+		return rc;
+	}
+	update_buf.res = res;
+	update_buf.cmd_type = bus_update_cmd;
+	update_buf.cmd.cmd_buf_addr = buf_info->kmd_buf_info->cpu_addr +
+		buf_info->kmd_buf_info->used_bytes/4;
+	bus_port_update.image_buf = io_addr;
+	bus_port_update.num_buf   = plane_id;
+	bus_port_update.io_cfg    = io_cfg;
+	bus_port_update.frame_header = 0;
+	bus_port_update.fh_enabled = false;
+	bus_port_update.unpacker_fmt =  buf_info->unpacker_fmt;
+
+	for (plane_id = 0; plane_id < CAM_PACKET_MAX_PLANES; plane_id++)
+		bus_port_update.image_buf_offset[plane_id] = 0;
+
+	if ((buf_info->frame_hdr->frame_header_enable) &&
+			!(buf_info->frame_hdr->frame_header_res_id)) {
+		bus_port_update.frame_header =
+			buf_info->frame_hdr->frame_header_iova_addr;
+		bus_port_update.local_id =
+			buf_info->prepare->packet->header.request_id;
+	}
+
+	update_buf.cmd.size = kmd_buf_remain_size;
+	if (io_cfg->direction == CAM_BUF_OUTPUT)
+		update_buf.wm_update = &bus_port_update;
+	else if (io_cfg->direction == CAM_BUF_INPUT)
+		update_buf.rm_update = &bus_port_update;
+
+	update_buf.use_scratch_cfg = false;
+
+	CAM_DBG(CAM_ISP, "cmd buffer 0x%pK, size %d",
+		update_buf.cmd.cmd_buf_addr, update_buf.cmd.size);
+	rc = res->hw_intf->hw_ops.process_cmd(
+		res->hw_intf->hw_priv,
+		bus_update_cmd, &update_buf,
+		(uint32_t)sizeof(struct cam_isp_hw_get_cmd_update));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "get buf cmd error:%d",
+				res->res_id);
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	if (bus_port_update.fh_enabled) {
+		buf_info->frame_hdr->frame_header_res_id = res->res_id;
+		CAM_DBG(CAM_ISP,
+			"Frame header enabled for res: 0x%x iova: %pK",
+			buf_info->frame_hdr->frame_header_res_id,
+			bus_port_update.frame_header);
+	}
+
+	buf_info->kmd_buf_info->used_bytes += update_buf.cmd.used_bytes;
+	buf_info->kmd_buf_info->offset += update_buf.cmd.used_bytes;
+
+	if (io_cfg->direction == CAM_BUF_OUTPUT) {
+		if (buf_info->fill_fence) {
+			num_entries = buf_info->prepare->num_out_map_entries - 1;
+			out_map_entry =
+				&buf_info->prepare->out_map_entries[num_entries];
+			if (!out_map_entry) {
+				CAM_ERR(CAM_ISP, "out_map_entry is NULL");
+				rc = -EINVAL;
+				return rc;
+			}
+
+			image_buf_addr = out_map_entry->image_buf_addr;
+			image_buf_offset = bus_port_update.image_buf_offset;
+			if (buf_info->base->split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				for (plane_id = 0; plane_id < CAM_PACKET_MAX_PLANES;
+					plane_id++)
+					image_buf_addr[plane_id] = io_addr[plane_id] +
+						image_buf_offset[plane_id];
+			}
+
+			new_head_entry =
+				list_first_entry_or_null(buf_info->prepare->buf_tracker,
+					struct cam_smmu_buffer_tracker, list);
+			if (new_head_entry && old_head_entry != new_head_entry) {
+				out_map_entry->buffer_tracker = new_head_entry;
+				CAM_DBG(CAM_ISP,
+					"[SMMU_BT] Tracking io_buf, buf_handle: 0x%x, fd: 0x%x, res_id: %d",
+					io_cfg->mem_handle[0],
+					out_map_entry->buffer_tracker->ion_fd, res->res_id);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_add_io_buffers_mc(
+	uint64_t                   *mc_io_cfg,
+	struct cam_isp_io_buf_info *io_info,
+	uint8_t                     num_ports,
+	uint32_t                    ctxt_id)
+{
+	uint32_t                        bytes_used;
+	uint32_t                        kmd_buf_remain_size;
+	uint32_t                       *cmd_buf_addr;
+	struct cam_isp_hw_mgr_res      *hw_mgr_res = NULL;
+	struct cam_isp_resource_node   *res = NULL;
+	uint8_t                         max_out = 0;
+	int                             rc = 0;
+	int                             i;
+
+	if (io_info->kmd_buf_info->used_bytes < io_info->kmd_buf_info->size) {
+		kmd_buf_remain_size = io_info->kmd_buf_info->size -
+			io_info->kmd_buf_info->used_bytes;
+	} else {
+		CAM_ERR(CAM_ISP,
+			"no free kmd memory for base=%d bytes_used=%u buf_size=%u",
+			io_info->base->idx, io_info->kmd_buf_info->used_bytes,
+			io_info->kmd_buf_info->size);
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	cmd_buf_addr = io_info->kmd_buf_info->cpu_addr +
+		io_info->kmd_buf_info->used_bytes/4;
+	rc = cam_isp_add_cmd_buf_update(
+		NULL, io_info->hw_intf,
+		CAM_ISP_HW_CMD_MC_CTXT_SEL,
+		CAM_ISP_HW_CMD_MC_CTXT_SEL,
+		(void *)cmd_buf_addr,
+		kmd_buf_remain_size,
+		(void *)(&ctxt_id),
+		&bytes_used);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Adding MC context[%u] failed for base[%d]",
+			ctxt_id, io_info->base->idx);
+		return rc;
+	}
+
+	io_info->kmd_buf_info->used_bytes += bytes_used;
+	io_info->kmd_buf_info->offset += bytes_used;
+
+	max_out = io_info->out_max;
+	for (i = 0; i < num_ports; i++) {
+		rc = cam_isp_io_buf_get_entries_util(io_info,
+			(struct cam_buf_io_cfg *)mc_io_cfg[(max_out * ctxt_id) + i], &hw_mgr_res);
+
+		if (!hw_mgr_res) {
+			CAM_ERR(CAM_ISP, "hw_mgr res is NULL");
+			return -EINVAL;
+		}
+
+		res = hw_mgr_res->hw_res[io_info->base->split_id];
+
+		if (!res)
+			continue;
+
+		rc = cam_isp_add_io_buffers_util(io_info,
+			(struct cam_buf_io_cfg *)mc_io_cfg[(max_out * ctxt_id) + i], res);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "ctxt[%d] io_cfg[%d] add buf failed rc %d",
+				ctxt_id, i, rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+int cam_isp_add_io_buffers(struct cam_isp_io_buf_info   *io_info)
+{
+	int                                 rc = 0;
+	struct cam_buf_io_cfg              *io_cfg = NULL;
+	struct cam_isp_hw_mgr_res          *hw_mgr_res = NULL;
+	uint32_t                            i, j;
+	uint32_t                            curr_used_bytes = 0;
+	uint32_t                            bytes_updated = 0;
+	struct cam_isp_resource_node       *res = NULL;
+	int                                 ctxt_id = 0;
+	uint8_t                             num_ports[CAM_ISP_MULTI_CTXT_MAX] = {0};
+	uint8_t                             max_out_res = 0;
+	uint64_t                           *mc_cfg = NULL;
+	uint32_t                            major_version = 0;
+	struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+	uint64_t                                 cfg_io_mask = 0, disabled_wm_mask = 0;
+
+	io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+			&io_info->prepare->packet->payload_flex +
+			io_info->prepare->packet->io_configs_offset);
+	curr_used_bytes = io_info->kmd_buf_info->used_bytes;
+
+	/* Max one hw entries required for each base */
+	if (io_info->prepare->num_hw_update_entries + 1 >=
+			io_info->prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			io_info->prepare->num_hw_update_entries,
+			io_info->prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	max_out_res = io_info->out_max & 0xFF;
+	major_version = io_info->major_version;
+
+	if (major_version == 3) {
+		mc_cfg = vzalloc(sizeof(uint64_t) * CAM_ISP_MULTI_CTXT_MAX * (max_out_res));
+		if (!mc_cfg) {
+			CAM_ERR(CAM_ISP, "Memory allocation failed for MC cases");
+			return -ENOMEM;
+		}
+	}
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *) io_info->prepare->priv;
+	for (i = 0; i < io_info->prepare->packet->num_io_configs; i++) {
+
+		if (major_version == 3) {
+			ctxt_id = ffs(io_cfg[i].flag) - 1;
+			if (ctxt_id < 0) {
+				CAM_ERR(CAM_ISP,
+					"Invalid ctxt_id %d req_id %llu resource_type:%d",
+					ctxt_id, io_info->prepare->packet->header.request_id,
+					io_cfg[i].resource_type);
+				rc = -EINVAL;
+				goto err;
+			}
+
+			mc_cfg[(max_out_res * ctxt_id) + num_ports[ctxt_id]] = (uint64_t)&io_cfg[i];
+			num_ports[ctxt_id]++;
+		} else {
+			rc = cam_isp_io_buf_get_entries_util(io_info, &io_cfg[i], &hw_mgr_res);
+			if (rc == -ENOMSG) {
+				rc = 0;
+				continue;
+			} else if (rc) {
+				CAM_ERR(CAM_ISP, "io_cfg[%d] failed rc %d", i, rc);
+				return rc;
+			}
+
+			if (!hw_mgr_res) {
+				CAM_ERR(CAM_ISP, "hw_mgr res is NULL");
+				return -EINVAL;
+			}
+
+			res = hw_mgr_res->hw_res[io_info->base->split_id];
+			if (!res)
+				continue;
+
+			cfg_io_mask |= (1 << (res->res_id & 0xFF));
+
+			rc = cam_isp_add_io_buffers_util(io_info, &io_cfg[i], res);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "io_cfg[%d] add buf failed rc %d", i, rc);
+				return rc;
+			}
+		}
+	}
+
+	if (major_version == 3) {
+		for (i = 0; i < CAM_ISP_MULTI_CTXT_MAX; i++) {
+			if (!num_ports[i])
+				continue;
+			rc = cam_isp_add_io_buffers_mc(mc_cfg, io_info, num_ports[i], i);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "MC context[%u] failed for base[%d]",
+					i, io_info->base->idx);
+				goto err;
+			}
+		}
+		vfree(mc_cfg);
+	}
+
+	disabled_wm_mask = (prepare_hw_data->wm_bitmask ^ cfg_io_mask);
+
+	if ((io_info->base->hw_type == CAM_ISP_HW_TYPE_TFE) && disabled_wm_mask) {
+		for (j = 0; j < io_info->out_max; j++) {
+			rc = cam_isp_add_disable_wm_update(io_info->prepare,
+					&io_info->res_list_isp_out[io_info->out_map[j]],
+					io_info->base->idx, io_info->kmd_buf_info,
+					&disabled_wm_mask,
+					io_info);
+			if (rc) {
+				CAM_ERR_RATE_LIMIT(CAM_ISP, "Disable out res %d failed",
+						j, rc);
+				return rc;
+			}
+		}
+	}
+
+	bytes_updated = io_info->kmd_buf_info->used_bytes - curr_used_bytes;
+	CAM_DBG(CAM_ISP, "io_cfg_used_bytes %d, fill_fence %d  acuired mask %x cfg mask %x",
+		bytes_updated, io_info->fill_fence, prepare_hw_data->wm_bitmask, cfg_io_mask);
+
+	if (bytes_updated) {
+		/**
+		 * Offset and used_bytes are already updated in the previous
+		 * add_io_buffers_util function and now points to next empty
+		 * block in kmd buffer, reset it here to align with generic
+		 * update hw entry function
+		 */
+		io_info->kmd_buf_info->offset -= bytes_updated;
+		io_info->kmd_buf_info->used_bytes -= bytes_updated;
+		cam_isp_update_hw_entry(CAM_ISP_IOCFG_BL, io_info->prepare,
+			io_info->kmd_buf_info, bytes_updated, false);
+	}
+
+	return rc;
+err:
+	vfree(mc_cfg);
+	return rc;
+}
+
+int cam_isp_add_disable_wm_update(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_isp_hw_mgr_res            *isp_hw_res,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	uint64_t                              *wm_mask,
+	struct cam_isp_io_buf_info *io_info)
+{
+	int rc = 0;
+	struct cam_hw_intf                 *hw_intf;
+	struct cam_isp_resource_node       *res;
+	struct cam_isp_hw_get_cmd_update    wm_update;
+	uint32_t kmd_buf_remain_size, i;
+
+	if (prepare->packet->header.request_id == 0)
+		return 0;
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		res = isp_hw_res->hw_res[i];
+		if (res->hw_intf->hw_idx != base_idx)
+			continue;
+		if (!(*wm_mask & (1 << res->res_id))) {
+			CAM_DBG(CAM_ISP, "No need to disable out res %d", res->res_id);
+			continue;
+		}
+
+		*wm_mask &= ~BIT(res->res_id);
+
+		if (kmd_buf_info->used_bytes < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size - kmd_buf_info->used_bytes;
+		} else {
+			CAM_ERR(CAM_ISP,
+				"no free kmd memory for base=%d bytes_used=%u buf_size=%u",
+				base_idx, kmd_buf_info->used_bytes, kmd_buf_info->size);
+				rc = -EINVAL;
+				return rc;
+		}
+
+		wm_update.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+			kmd_buf_info->used_bytes/4;
+		wm_update.cmd.size = kmd_buf_remain_size;
+		wm_update.cmd_type = CAM_ISP_HW_CMD_BUS_WM_DISABLE;
+		wm_update.res = res;
+		rc = res->hw_intf->hw_ops.process_cmd(
+			res->hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_BUS_WM_DISABLE, &wm_update,
+			sizeof(struct cam_isp_hw_get_cmd_update));
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Diaable res %d failed split %d",
+				res->res_id, i);
+			return rc;
+		}
+		CAM_DBG(CAM_ISP,
+			"Out res %d disable update added hw_id %d cdm_idx %d split id: %d",
+			res->res_id, res->hw_intf->hw_idx, base_idx, i);
+
+		io_info->kmd_buf_info->used_bytes += wm_update.cmd.used_bytes;
+		io_info->kmd_buf_info->offset += wm_update.cmd.used_bytes;
+	}
+	return rc;
+}
+
+int cam_isp_add_reg_update(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  combine,
+	void                                 *priv_data)
+{
+	int rc = -EINVAL;
+	struct cam_isp_resource_node            *res;
+	struct cam_isp_hw_mgr_res               *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update         get_regup;
+	uint32_t kmd_buf_remain_size, i, reg_update_size;
+
+	/* Max one hw entries required for each base */
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	reg_update_size = 0;
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			if (res->hw_intf->hw_idx != base_idx)
+				continue;
+
+			if (kmd_buf_info->size > (kmd_buf_info->used_bytes +
+				reg_update_size)) {
+				kmd_buf_remain_size =  kmd_buf_info->size -
+					(kmd_buf_info->used_bytes +
+					reg_update_size);
+			} else {
+				CAM_ERR(CAM_ISP, "no free mem %d %d %d",
+					base_idx, kmd_buf_info->size,
+					kmd_buf_info->used_bytes +
+					reg_update_size);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			get_regup.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4 +
+				reg_update_size/4;
+			get_regup.cmd.size = kmd_buf_remain_size;
+			get_regup.cmd_type = CAM_ISP_HW_CMD_GET_REG_UPDATE;
+			get_regup.res = res;
+
+			get_regup.data = priv_data;
+
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_REG_UPDATE, &get_regup,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+			if (rc)
+				return rc;
+
+			CAM_DBG(CAM_ISP,
+				"Reg update added for res %d hw_id %d cdm_idx %d",
+				res->res_id, res->hw_intf->hw_idx, base_idx);
+			reg_update_size += get_regup.cmd.used_bytes;
+		}
+	}
+
+	if (reg_update_size) {
+		cam_isp_update_hw_entry(CAM_ISP_COMMON_CFG_BL, prepare,
+			kmd_buf_info, reg_update_size, combine);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_go_cmd(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_isp_resource_node         *res,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  combine)
+{
+	int rc;
+	struct cam_isp_hw_get_cmd_update      get_regup;
+	uint32_t kmd_buf_remain_size, reg_update_size;
+
+	/* Max one hw entries required for each base */
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	reg_update_size = 0;
+	if (kmd_buf_info->size > (kmd_buf_info->used_bytes +
+		reg_update_size)) {
+		kmd_buf_remain_size =  kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			reg_update_size);
+	} else {
+		CAM_ERR(CAM_ISP, "no free mem %d %d",
+			kmd_buf_info->size,
+			kmd_buf_info->used_bytes +
+			reg_update_size);
+		return -EINVAL;
+	}
+
+	get_regup.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes/4 +
+		reg_update_size/4;
+	get_regup.cmd.size = kmd_buf_remain_size;
+	get_regup.cmd_type = CAM_ISP_HW_CMD_FE_TRIGGER_CMD;
+	get_regup.res = res;
+
+	rc = res->process_cmd(res->res_priv,
+		CAM_ISP_HW_CMD_FE_TRIGGER_CMD, &get_regup,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+	if (rc)
+		return rc;
+
+	CAM_DBG(CAM_ISP, "GO_CMD added for RD res %d hw_id %d",
+		res->res_type, res->hw_intf->hw_idx);
+	reg_update_size += get_regup.cmd.used_bytes;
+
+	/* Update HW entries */
+	if (reg_update_size)
+		cam_isp_update_hw_entry(CAM_ISP_COMMON_CFG_BL,
+			prepare, kmd_buf_info, reg_update_size,
+			combine);
+	return 0;
+}
+
+int cam_isp_add_comp_wait(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update      add_wait;
+	struct cam_hw_intf                   *hw_intf;
+	bool                                  hw_res_valid = false;
+	uint32_t kmd_buf_remain_size, num_ent, add_wait_size;
+
+	/* Max one hw entries required for each base */
+	if (prepare->num_hw_update_entries >= prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries");
+		return -EINVAL;
+	}
+
+	add_wait_size = 0;
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+		if (hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT] &&
+			hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT]) {
+			hw_res_valid = true;
+			break;
+		}
+	}
+
+	if (!hw_mgr_res || !hw_res_valid) {
+		CAM_ERR(CAM_ISP, "No src with multi_vfe config");
+		return -EINVAL;
+	}
+
+	hw_intf = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT]->hw_intf;
+
+	if (kmd_buf_info->size > (kmd_buf_info->used_bytes +
+			add_wait_size)) {
+		kmd_buf_remain_size =  kmd_buf_info->size -
+			(kmd_buf_info->used_bytes + add_wait_size);
+	} else {
+		CAM_ERR(CAM_ISP, "no free mem %d %d %d",
+			base_idx, kmd_buf_info->size,
+			kmd_buf_info->used_bytes +
+			add_wait_size);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	add_wait.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes/4 +
+		add_wait_size/4;
+	add_wait.cmd.size = kmd_buf_remain_size;
+	add_wait.cmd_type = CAM_ISP_HW_CMD_ADD_WAIT;
+	add_wait.res = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT];
+
+	rc = hw_intf->hw_ops.process_cmd(
+		hw_intf->hw_priv,
+		CAM_ISP_HW_CMD_ADD_WAIT,
+		&add_wait,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"wait_comp_event addition failed for dual vfe");
+		return rc;
+	}
+
+	add_wait_size += add_wait.cmd.used_bytes;
+	if (add_wait_size) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = add_wait_size;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IOCFG_BL;
+		CAM_DBG(CAM_ISP,
+			"num_ent=%d handle=0x%x, len=%u, offset=%u",
+			num_ent,
+			prepare->hw_update_entries[num_ent].handle,
+			prepare->hw_update_entries[num_ent].len,
+			prepare->hw_update_entries[num_ent].offset);
+		num_ent++;
+
+		kmd_buf_info->used_bytes += add_wait_size;
+		kmd_buf_info->offset     += add_wait_size;
+		prepare->num_hw_update_entries = num_ent;
+		/* add wait_comp_event is success return status 0 */
+		rc = 0;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_wait_trigger(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  trigger_cdm_en)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update      add_trigger;
+	struct cam_hw_intf                   *hw_intf;
+	bool                                  hw_res_valid = false;
+	uint32_t kmd_buf_remain_size, num_ent, add_trigger_size;
+
+	/* Max one hw entries required for each base */
+	if (prepare->num_hw_update_entries + 1 >=
+				prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries");
+		return -EINVAL;
+	}
+
+	add_trigger_size = 0;
+
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+		if (hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT] &&
+			hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT]) {
+			hw_res_valid = true;
+			break;
+		}
+	}
+
+	if (!hw_mgr_res || !hw_res_valid) {
+		CAM_ERR(CAM_ISP, "No src with multi_vfe config");
+		return -EINVAL;
+	}
+
+	hw_intf = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT]->hw_intf;
+
+	if (kmd_buf_info->size > (kmd_buf_info->used_bytes +
+			add_trigger_size)) {
+		kmd_buf_remain_size =  kmd_buf_info->size -
+			(kmd_buf_info->used_bytes + add_trigger_size);
+	} else {
+		CAM_ERR(CAM_ISP, "no free mem %d %d %d",
+			base_idx, kmd_buf_info->size,
+			kmd_buf_info->used_bytes +
+			add_trigger_size);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	add_trigger.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes/4 +
+		add_trigger_size/4;
+	add_trigger.cmd.size = kmd_buf_remain_size;
+	add_trigger.cmd_type = CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER;
+	add_trigger.res = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT];
+
+	rc = hw_intf->hw_ops.process_cmd(
+		hw_intf->hw_priv,
+		CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER,
+		&add_trigger,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"wait_trigger_event addition failed for dual vfe");
+		return rc;
+	}
+
+	add_trigger_size += add_trigger.cmd.used_bytes;
+
+	if (add_trigger_size) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = add_trigger_size;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IOCFG_BL;
+		CAM_DBG(CAM_ISP,
+			"num_ent=%d handle=0x%x, len=%u, offset=%u",
+			num_ent,
+			prepare->hw_update_entries[num_ent].handle,
+			prepare->hw_update_entries[num_ent].len,
+			prepare->hw_update_entries[num_ent].offset);
+		num_ent++;
+
+		kmd_buf_info->used_bytes += add_trigger_size;
+		kmd_buf_info->offset     += add_trigger_size;
+		prepare->num_hw_update_entries = num_ent;
+		/* add wait trigger is success return status 0 */
+		rc = 0;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_csid_command_buffers(
+	struct cam_hw_prepare_update_args   *prepare,
+	struct cam_kmd_buf_info             *kmd_buf_info,
+	cam_packet_generic_blob_handler     blob_handler_cb,
+	struct cam_isp_ctx_base_info        *base_info)
+{
+	int rc = 0;
+	uint32_t                           cmd_meta_data, num_ent, i;
+	enum cam_isp_hw_split_id           split_id;
+	struct cam_cmd_buf_desc           *cmd_desc = NULL;
+	struct cam_hw_update_entry        *hw_entry = NULL;
+
+	split_id = base_info->split_id;
+	hw_entry = prepare->hw_update_entries;
+
+	/*
+	 * set the cmd_desc to point the first command descriptor in the
+	 * packet
+	 */
+	cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint8_t *)&prepare->packet->payload_flex +
+			prepare->packet->cmd_buf_offset);
+
+	CAM_DBG(CAM_ISP, "split id = %d, number of command buffers:%d",
+		split_id, prepare->packet->num_cmd_buf);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		num_ent = prepare->num_hw_update_entries;
+		if (!cmd_desc[i].length)
+			continue;
+
+		/* One hw entry space required for left or right or common */
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		cmd_meta_data = cmd_desc[i].meta_data;
+
+		CAM_DBG(CAM_ISP, "meta type: %d, split_id: %d",
+			cmd_meta_data, split_id);
+
+		switch (cmd_meta_data) {
+		case CAM_ISP_PACKET_META_BASE:
+		case CAM_ISP_PACKET_META_LEFT:
+		case CAM_ISP_PACKET_META_DMI_LEFT:
+		case CAM_ISP_PACKET_META_RIGHT:
+		case CAM_ISP_PACKET_META_DMI_RIGHT:
+		case CAM_ISP_PACKET_META_COMMON:
+		case CAM_ISP_PACKET_META_DMI_COMMON:
+		case CAM_ISP_PACKET_META_DUAL_CONFIG:
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				struct cam_isp_generic_blob_info   blob_info;
+
+				prepare->num_hw_update_entries = num_ent;
+				blob_info.prepare = prepare;
+				blob_info.base_info = base_info;
+				blob_info.kmd_buf_info = kmd_buf_info;
+
+				rc = cam_packet_util_process_generic_cmd_buffer(
+					&cmd_desc[i],
+					blob_handler_cb,
+					&blob_info);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed in processing blobs %d",
+						rc);
+					return rc;
+				}
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent = prepare->num_hw_update_entries;
+			}
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				struct cam_isp_generic_blob_info   blob_info;
+
+				prepare->num_hw_update_entries = num_ent;
+				blob_info.prepare = prepare;
+				blob_info.base_info = base_info;
+				blob_info.kmd_buf_info = kmd_buf_info;
+
+				rc = cam_packet_util_process_generic_cmd_buffer(
+					&cmd_desc[i],
+					blob_handler_cb,
+					&blob_info);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed in processing blobs %d",
+						rc);
+					return rc;
+				}
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent = prepare->num_hw_update_entries;
+			}
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_COMMON: {
+			struct cam_isp_generic_blob_info   blob_info;
+
+			prepare->num_hw_update_entries = num_ent;
+			blob_info.prepare = prepare;
+			blob_info.base_info = base_info;
+			blob_info.kmd_buf_info = kmd_buf_info;
+
+			rc = cam_packet_util_process_generic_cmd_buffer(
+				&cmd_desc[i],
+				blob_handler_cb,
+				&blob_info);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in processing blobs %d", rc);
+				return rc;
+			}
+			hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+			num_ent = prepare->num_hw_update_entries;
+		}
+			break;
+		case CAM_ISP_PACKET_META_REG_DUMP_ON_FLUSH:
+		case CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR:
+		case CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST:
+		case CAM_ISP_SFE_PACKET_META_LEFT:
+		case CAM_ISP_SFE_PACKET_META_RIGHT:
+		case CAM_ISP_SFE_PACKET_META_COMMON:
+		case CAM_ISP_SFE_PACKET_META_DUAL_CONFIG:
+			break;
+		case CAM_ISP_PACKET_META_CSID_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				CAM_DBG(CAM_ISP,
+					"Meta_Left num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_PACKET_META_CSID_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				CAM_DBG(CAM_ISP,
+					"Meta_Right num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_PACKET_META_CSID_COMMON:
+			hw_entry[num_ent].len = cmd_desc[i].length;
+			hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+			hw_entry[num_ent].offset = cmd_desc[i].offset;
+			CAM_DBG(CAM_ISP,
+				"Meta_Common num_ent=%d handle=0x%x, len=%u, offset=%u",
+				num_ent,
+				hw_entry[num_ent].handle,
+				hw_entry[num_ent].len,
+				hw_entry[num_ent].offset);
+			hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+			num_ent++;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "invalid cdm command meta data %d",
+				cmd_meta_data);
+			return -EINVAL;
+		}
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_csid_reg_update(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	void                                 *args,
+	bool                                  combine)
+{
+	int rc;
+	struct cam_isp_resource_node         *res;
+	uint32_t kmd_buf_remain_size, reg_update_size = 0;
+	struct cam_isp_csid_reg_update_args *rup_args = NULL;
+
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	rup_args = (struct cam_isp_csid_reg_update_args *)args;
+
+	if (!rup_args->num_res) {
+		CAM_ERR(CAM_ISP, "No Res for Reg Update");
+		return -EINVAL;
+	}
+
+	if (kmd_buf_info->size <=(kmd_buf_info->used_bytes +
+		reg_update_size)) {
+		CAM_ERR(CAM_ISP, "no free mem %u %u %u",
+			kmd_buf_info->size,
+			kmd_buf_info->used_bytes +
+			reg_update_size);
+		return -EINVAL;
+	}
+
+	kmd_buf_remain_size = kmd_buf_info->size -
+		(kmd_buf_info->used_bytes +
+		reg_update_size);
+
+	rup_args->cmd.used_bytes = 0;
+	rup_args->cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes/4 +
+		reg_update_size/4;
+	rup_args->cmd.size = kmd_buf_remain_size;
+	rup_args->reg_write = false;
+	res = rup_args->res[0];
+
+	rc = res->hw_intf->hw_ops.process_cmd(
+		res->hw_intf->hw_priv,
+		CAM_ISP_HW_CMD_GET_REG_UPDATE, rup_args,
+		sizeof(struct cam_isp_csid_reg_update_args));
+	if (rc)
+		return rc;
+
+	CAM_DBG(CAM_ISP,
+		"Reg update added for res %d hw_id %d",
+		res->res_id, res->hw_intf->hw_idx);
+	reg_update_size += rup_args->cmd.used_bytes;
+
+	/* Update hw entries */
+	if (reg_update_size)
+		cam_isp_update_hw_entry(CAM_ISP_COMMON_CFG_BL,
+			prepare, kmd_buf_info, reg_update_size,
+			combine);
+	return 0;
+}
+
+int cam_isp_add_csid_offline_cmd(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_isp_resource_node         *res,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  combine)
+{
+	int rc;
+	uint32_t kmd_buf_remain_size, go_cmd_size;
+	struct cam_ife_csid_offline_cmd_update_args go_args;
+
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	go_cmd_size = 0;
+	if (kmd_buf_info->size > (kmd_buf_info->used_bytes +
+		go_cmd_size)) {
+		kmd_buf_remain_size =  kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			go_cmd_size);
+	} else {
+		CAM_ERR(CAM_ISP, "no free mem %d %d",
+			kmd_buf_info->size,
+			kmd_buf_info->used_bytes +
+			go_cmd_size);
+		return -EINVAL;
+	}
+
+	go_args.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes / 4 +
+		go_cmd_size / 4;
+	go_args.cmd.size = kmd_buf_remain_size;
+	go_args.res = res;
+
+	rc = res->hw_intf->hw_ops.process_cmd(
+			res->hw_intf->hw_priv,
+			CAM_IFE_CSID_PROGRAM_OFFLINE_CMD, &go_args,
+			sizeof(go_args));
+	if (rc)
+		return rc;
+
+	CAM_DBG(CAM_ISP,
+		"offline cmd update added for CSID: %u res: %d",
+		res->hw_intf->hw_idx, res->res_id);
+	go_cmd_size += go_args.cmd.used_bytes;
+
+	/* Update HW entries */
+	if (go_cmd_size)
+		cam_isp_update_hw_entry(CAM_ISP_COMMON_CFG_BL,
+			prepare, kmd_buf_info, go_cmd_size,
+			combine);
+	return 0;
+}
+
+int cam_isp_get_cmd_buf_count(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_isp_cmd_buf_count         *cmd_buf_count)
+{
+	struct cam_cmd_buf_desc        *cmd_desc = NULL;
+	uint32_t                        cmd_meta_data = 0;
+	int                             i;
+	int                             rc = 0;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint8_t *)&prepare->packet->payload_flex +
+			prepare->packet->cmd_buf_offset);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+
+		if (rc)
+			return rc;
+
+		cmd_meta_data = cmd_desc[i].meta_data;
+
+		switch (cmd_meta_data) {
+
+		case CAM_ISP_PACKET_META_BASE:
+		case CAM_ISP_PACKET_META_LEFT:
+		case CAM_ISP_PACKET_META_DMI_LEFT:
+		case CAM_ISP_PACKET_META_RIGHT:
+		case CAM_ISP_PACKET_META_DMI_RIGHT:
+		case CAM_ISP_PACKET_META_COMMON:
+		case CAM_ISP_PACKET_META_DMI_COMMON:
+			cmd_buf_count->isp_cnt++;
+			break;
+		case CAM_ISP_PACKET_META_CSID_LEFT:
+		case CAM_ISP_PACKET_META_CSID_RIGHT:
+		case CAM_ISP_PACKET_META_CSID_COMMON:
+			cmd_buf_count->csid_cnt++;
+			break;
+		case CAM_ISP_SFE_PACKET_META_LEFT:
+		case CAM_ISP_SFE_PACKET_META_RIGHT:
+		case CAM_ISP_SFE_PACKET_META_COMMON:
+			cmd_buf_count->sfe_cnt++;
+			break;
+		default:
+			break;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Number of cmd buffers: isp:%u csid:%u sfe:%u",
+		 cmd_buf_count->isp_cnt, cmd_buf_count->csid_cnt,
+		 cmd_buf_count->sfe_cnt);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_tasklet_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_tasklet_util.c
@@ -0,0 +1,358 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/spinlock_types.h>
+#include <linux/interrupt.h>
+#include <linux/list.h>
+#include <linux/ratelimit.h>
+#include "cam_tasklet_util.h"
+#include "cam_irq_controller.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+
+
+/* Threshold for scheduling delay in ms */
+#define CAM_TASKLET_SCHED_TIME_THRESHOLD        5
+
+/* Threshold for execution delay in ms */
+#define CAM_TASKLET_EXE_TIME_THRESHOLD          10
+
+#define CAM_TASKLETQ_SIZE                          256
+
+static void cam_tasklet_action(unsigned long data);
+
+/**
+ * struct cam_tasklet_queue_cmd:
+ * @Brief:                  Structure associated with each slot in the
+ *                          tasklet queue
+ *
+ * @list:                   list_head member for each entry in queue
+ * @payload:                Payload structure for the event. This will be
+ *                          passed to the handler function
+ * @handler_priv:           Private data passed at event subscribe
+ * @bottom_half_handler:    Function pointer for event handler in bottom
+ *                          half context
+ * @tasklet_enqueue_ts:     enqueue time of tasklet
+ *
+ */
+struct cam_tasklet_queue_cmd {
+	struct list_head                   list;
+	void                              *payload;
+	void                              *handler_priv;
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler;
+	ktime_t                            tasklet_enqueue_ts;
+};
+
+/**
+ * struct cam_tasklet_info:
+ * @Brief:                  Tasklet private structure
+ *
+ * @list:                   list_head member for each tasklet
+ * @index:                  Instance id for the tasklet
+ * @tasklet_lock:           Spin lock
+ * @tasklet_active:         Atomic variable to control tasklet state
+ * @tasklet:                Tasklet structure used to schedule bottom half
+ * @free_cmd_list:          List of free tasklet queue cmd for use
+ * @used_cmd_list:          List of used tasklet queue cmd
+ * @cmd_queue:              Array of tasklet cmd for storage
+ * @ctx_priv:               Private data passed to the handling function
+ *
+ */
+struct cam_tasklet_info {
+	struct list_head                   list;
+	uint32_t                           index;
+	spinlock_t                         tasklet_lock;
+	atomic_t                           tasklet_active;
+	struct tasklet_struct              tasklet;
+
+	struct list_head                   free_cmd_list;
+	struct list_head                   used_cmd_list;
+	struct cam_tasklet_queue_cmd       cmd_queue[CAM_TASKLETQ_SIZE];
+
+	void                              *ctx_priv;
+};
+
+struct cam_irq_bh_api tasklet_bh_api = {
+	.bottom_half_enqueue_func = cam_tasklet_enqueue_cmd,
+	.get_bh_payload_func = cam_tasklet_get_cmd,
+	.put_bh_payload_func = cam_tasklet_put_cmd,
+};
+
+int cam_tasklet_get_cmd(
+	void                         *bottom_half,
+	void                        **bh_cmd)
+{
+	int           rc = 0;
+	unsigned long flags;
+	struct cam_tasklet_info        *tasklet = bottom_half;
+	struct cam_tasklet_queue_cmd   *tasklet_cmd = NULL;
+
+	*bh_cmd = NULL;
+
+	if (tasklet == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "tasklet is NULL");
+		return -EINVAL;
+	}
+
+	if (!atomic_read(&tasklet->tasklet_active)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Tasklet idx:%d is not active",
+			tasklet->index);
+		rc = -EPIPE;
+		return rc;
+	}
+
+	spin_lock_irqsave(&tasklet->tasklet_lock, flags);
+	if (list_empty(&tasklet->free_cmd_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No more free tasklet cmd idx:%d",
+			tasklet->index);
+		rc = -ENODEV;
+		goto spin_unlock;
+	} else {
+		tasklet_cmd = list_first_entry(&tasklet->free_cmd_list,
+			struct cam_tasklet_queue_cmd, list);
+		list_del_init(&(tasklet_cmd)->list);
+		*bh_cmd = tasklet_cmd;
+	}
+
+spin_unlock:
+	spin_unlock_irqrestore(&tasklet->tasklet_lock, flags);
+	return rc;
+}
+
+void cam_tasklet_put_cmd(
+	void                         *bottom_half,
+	void                        **bh_cmd)
+{
+	unsigned long flags;
+	struct cam_tasklet_info        *tasklet = bottom_half;
+	struct cam_tasklet_queue_cmd   *tasklet_cmd = *bh_cmd;
+
+	if (tasklet == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "tasklet is NULL");
+		return;
+	}
+
+	if (tasklet_cmd == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid tasklet_cmd");
+		return;
+	}
+
+	spin_lock_irqsave(&tasklet->tasklet_lock, flags);
+	list_del_init(&tasklet_cmd->list);
+	list_add_tail(&tasklet_cmd->list, &tasklet->free_cmd_list);
+	*bh_cmd = NULL;
+	spin_unlock_irqrestore(&tasklet->tasklet_lock, flags);
+}
+
+/**
+ * cam_tasklet_dequeue_cmd()
+ *
+ * @brief:              Initialize the tasklet info structure
+ *
+ * @hw_mgr_ctx:         Private Ctx data that will be passed to the handler
+ *                      function
+ * @idx:                Index of tasklet used as identity
+ * @tasklet_action:     Tasklet callback function that will be called
+ *                      when tasklet runs on CPU
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+static int cam_tasklet_dequeue_cmd(
+	struct cam_tasklet_info        *tasklet,
+	struct cam_tasklet_queue_cmd  **tasklet_cmd)
+{
+	int rc = 0;
+	unsigned long flags;
+
+	*tasklet_cmd = NULL;
+
+	CAM_DBG(CAM_ISP, "Dequeue before lock tasklet idx:%d", tasklet->index);
+	spin_lock_irqsave(&tasklet->tasklet_lock, flags);
+	if (list_empty(&tasklet->used_cmd_list)) {
+		CAM_DBG(CAM_ISP, "End of list reached. Exit");
+		rc = -ENODEV;
+		goto spin_unlock;
+	} else {
+		*tasklet_cmd = list_first_entry(&tasklet->used_cmd_list,
+			struct cam_tasklet_queue_cmd, list);
+		list_del_init(&(*tasklet_cmd)->list);
+		CAM_DBG(CAM_ISP, "Dequeue Successful");
+	}
+
+spin_unlock:
+	spin_unlock_irqrestore(&tasklet->tasklet_lock, flags);
+	return rc;
+}
+
+void cam_tasklet_enqueue_cmd(
+	void                              *bottom_half,
+	void                              *bh_cmd,
+	void                              *handler_priv,
+	void                              *evt_payload_priv,
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler)
+{
+	unsigned long                  flags;
+	struct cam_tasklet_queue_cmd  *tasklet_cmd = bh_cmd;
+	struct cam_tasklet_info       *tasklet = bottom_half;
+
+	if (!bottom_half) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "NULL bottom half");
+		return;
+	}
+
+	if (!bh_cmd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "NULL bh cmd");
+		return;
+	}
+
+	if (!atomic_read(&tasklet->tasklet_active)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Tasklet is not active idx:%d",
+			tasklet->index);
+		return;
+	}
+
+	CAM_DBG(CAM_ISP, "Enqueue tasklet cmd idx:%d", tasklet->index);
+	tasklet_cmd->bottom_half_handler = bottom_half_handler;
+	tasklet_cmd->payload = evt_payload_priv;
+	tasklet_cmd->handler_priv = handler_priv;
+	tasklet_cmd->tasklet_enqueue_ts = ktime_get();
+	spin_lock_irqsave(&tasklet->tasklet_lock, flags);
+	list_add_tail(&tasklet_cmd->list,
+		&tasklet->used_cmd_list);
+	spin_unlock_irqrestore(&tasklet->tasklet_lock, flags);
+	tasklet_hi_schedule(&tasklet->tasklet);
+}
+
+int cam_tasklet_init(
+	void                    **tasklet_info,
+	void                     *hw_mgr_ctx,
+	uint32_t                  idx)
+{
+	int i;
+	struct cam_tasklet_info  *tasklet = NULL;
+
+	tasklet = kzalloc(sizeof(struct cam_tasklet_info), GFP_KERNEL);
+	if (!tasklet) {
+		CAM_ERR(CAM_ISP,
+			"Error! Unable to allocate memory for tasklet");
+		*tasklet_info = NULL;
+		return -ENOMEM;
+	}
+
+	tasklet->ctx_priv = hw_mgr_ctx;
+	tasklet->index = idx;
+	spin_lock_init(&tasklet->tasklet_lock);
+	memset(tasklet->cmd_queue, 0, sizeof(tasklet->cmd_queue));
+	INIT_LIST_HEAD(&tasklet->free_cmd_list);
+	INIT_LIST_HEAD(&tasklet->used_cmd_list);
+	for (i = 0; i < CAM_TASKLETQ_SIZE; i++) {
+		INIT_LIST_HEAD(&tasklet->cmd_queue[i].list);
+		list_add_tail(&tasklet->cmd_queue[i].list,
+			&tasklet->free_cmd_list);
+	}
+	tasklet_init(&tasklet->tasklet, cam_tasklet_action,
+		(unsigned long)tasklet);
+	tasklet_disable(&tasklet->tasklet);
+
+	*tasklet_info = tasklet;
+
+	return 0;
+}
+
+void cam_tasklet_deinit(void    **tasklet_info)
+{
+	struct cam_tasklet_info *tasklet = *tasklet_info;
+
+	if (atomic_read(&tasklet->tasklet_active)) {
+		atomic_set(&tasklet->tasklet_active, 0);
+		tasklet_kill(&tasklet->tasklet);
+		tasklet_disable(&tasklet->tasklet);
+	}
+	kfree(tasklet);
+	*tasklet_info = NULL;
+}
+
+static inline void cam_tasklet_flush(struct cam_tasklet_info *tasklet_info)
+{
+	cam_tasklet_action((unsigned long) tasklet_info);
+}
+
+int cam_tasklet_start(void  *tasklet_info)
+{
+	struct cam_tasklet_info       *tasklet = tasklet_info;
+	int i = 0;
+
+	if (atomic_read(&tasklet->tasklet_active)) {
+		CAM_ERR(CAM_ISP, "Tasklet already active idx:%d",
+			tasklet->index);
+		return -EBUSY;
+	}
+
+	/* clean up the command queue first */
+	for (i = 0; i < CAM_TASKLETQ_SIZE; i++) {
+		list_del_init(&tasklet->cmd_queue[i].list);
+		list_add_tail(&tasklet->cmd_queue[i].list,
+			&tasklet->free_cmd_list);
+	}
+
+	atomic_set(&tasklet->tasklet_active, 1);
+
+	tasklet_enable(&tasklet->tasklet);
+
+	return 0;
+}
+
+void cam_tasklet_stop(void  *tasklet_info)
+{
+	struct cam_tasklet_info  *tasklet = tasklet_info;
+
+	if (!atomic_read(&tasklet->tasklet_active))
+		return;
+
+	atomic_set(&tasklet->tasklet_active, 0);
+	tasklet_kill(&tasklet->tasklet);
+	tasklet_disable(&tasklet->tasklet);
+	cam_tasklet_flush(tasklet);
+}
+
+/*
+ * cam_tasklet_action()
+ *
+ * @brief:              Process function that will be called  when tasklet runs
+ *                      on CPU
+ *
+ * @data:               Tasklet Info structure that is passed in tasklet_init
+ *
+ * @return:             Void
+ */
+static void cam_tasklet_action(unsigned long data)
+{
+	struct cam_tasklet_info          *tasklet_info = NULL;
+	struct cam_tasklet_queue_cmd     *tasklet_cmd = NULL;
+	ktime_t                           tasklet_exec_start_time;
+	void                             *cb = NULL;
+	tasklet_info = (struct cam_tasklet_info *)data;
+
+	while (!cam_tasklet_dequeue_cmd(tasklet_info, &tasklet_cmd)) {
+		cb = (void *)tasklet_cmd->bottom_half_handler;
+		cam_common_util_thread_switch_delay_detect(
+			"ISP Tasklet", "schedule", cb,
+			tasklet_cmd->tasklet_enqueue_ts,
+			CAM_TASKLET_SCHED_TIME_THRESHOLD);
+		tasklet_exec_start_time = ktime_get();
+
+		tasklet_cmd->bottom_half_handler(tasklet_cmd->handler_priv,
+			tasklet_cmd->payload);
+
+		cam_common_util_thread_switch_delay_detect(
+			"ISP Tasklet", "execution", cb,
+			tasklet_exec_start_time,
+			CAM_TASKLET_SCHED_TIME_THRESHOLD);
+		cam_tasklet_put_cmd(tasklet_info, (void **)(&tasklet_cmd));
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/include/cam_isp_packet_parser.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/include/cam_isp_packet_parser.h
@@ -0,0 +1,482 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_HW_PARSER_H_
+#define _CAM_ISP_HW_PARSER_H_
+
+#include <linux/types.h>
+#include <media/cam_isp.h>
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw_mgr.h"
+#include "cam_hw_intf.h"
+#include "cam_packet_util.h"
+#include "cam_cdm_intf_api.h"
+
+/* enum cam_isp_cdm_bl_type - isp cdm packet type */
+enum cam_isp_cdm_bl_type {
+	CAM_ISP_UNUSED_BL,
+	CAM_ISP_COMMON_CFG_BL,
+	CAM_ISP_IQ_BL,
+	CAM_ISP_IOCFG_BL,
+	CAM_ISP_BL_MAX,
+};
+
+/*
+ * struct cam_isp_generic_blob_info
+ *
+ * @prepare:            Payload for prepare command
+ * @base_info:          Base hardware information for the context
+ * @kmd_buf_info:       Kmd buffer to store the custom cmd data
+ * @entry_added:        Indicate whether the entry is previously
+ *                      added when handling the blob before
+ */
+struct cam_isp_generic_blob_info {
+	struct cam_hw_prepare_update_args     *prepare;
+	struct cam_isp_ctx_base_info          *base_info;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	bool                                   entry_added;
+};
+
+/*
+ * struct cam_isp_frame_header_info
+ *
+ * @frame_header_enable:    Enable frame header
+ * @frame_header_iova_addr: frame header iova
+ * @frame_header_res_id:    res id for which frame header is enabled
+ */
+struct cam_isp_frame_header_info {
+	bool                     frame_header_enable;
+	uint64_t                 frame_header_iova_addr;
+	uint32_t                 frame_header_res_id;
+};
+
+/*
+ * struct cam_isp_sfe_scratch_buf_res_info
+ *
+ * @num_active_fe_rdis    : To indicate active RMs/RDIs
+ * @sfe_rdi_cfg_mask      : Output mask to mark if the given RDI res has been
+ *                          provided with IO cfg buffer
+ */
+struct cam_isp_sfe_scratch_buf_res_info {
+	uint32_t                 num_active_fe_rdis;
+	uint32_t                 sfe_rdi_cfg_mask;
+};
+
+/*
+ * struct cam_isp_ife_scratch_buf_res_info
+ *
+ * @num_ports             : Number of ports for which scratch buffer is provided
+ * @ife_scratch_resources : IFE resources that have been provided a scratch buffer
+ * @ife_scratch_cfg_mask  : Output mask to mark if the given client has been
+ *                          provided with IO cfg buffer
+ */
+struct cam_isp_ife_scratch_buf_res_info {
+	uint32_t                 num_ports;
+	uint32_t                 ife_scratch_resources[CAM_IFE_SCRATCH_NUM_MAX];
+	uint32_t                 ife_scratch_cfg_mask;
+};
+
+/*
+ * struct cam_isp_check_io_cfg_for_scratch
+ *
+ * @sfe_scratch_res_info  : SFE scratch buffer validation info
+ * @ife_scratch_res_info  : IFE scratch buffer validation info
+ * @validate_for_sfe      : Validate for SFE clients, check if scratch is needed
+ * @validate_for_ife      : Validate for IFE clients, check if scratch is needed
+ */
+struct cam_isp_check_io_cfg_for_scratch {
+	struct cam_isp_sfe_scratch_buf_res_info sfe_scratch_res_info;
+	struct cam_isp_ife_scratch_buf_res_info ife_scratch_res_info;
+	bool                                    validate_for_sfe;
+	bool                                    validate_for_ife;
+};
+
+/*
+ * struct cam_isp_change_base_args
+ *
+ * @cdm_id:       CDM id
+ * @base_idx:     Base index
+ */
+struct cam_isp_change_base_args {
+	enum cam_cdm_id  cdm_id;
+	uint32_t         base_idx;
+};
+
+/*
+ * struct cam_isp_cmd_buf_count
+ *
+ * @csid_cnt:       CSID cmd buffer cnt
+ * @vfe_cnt:        ISP cmd buffer cnt
+ * @sfe_cnt:        SFE cmd buffer cnt
+ */
+struct cam_isp_cmd_buf_count {
+	uint32_t         csid_cnt;
+	uint32_t         isp_cnt;
+	uint32_t         sfe_cnt;
+};
+
+/*
+ * struct cam_isp_io_buf_info
+ *
+ * @frame_hdr:             Frame header related params
+ * @scratch_check_cfg:     Validate info for IFE/SFE scratch buffers
+ * @prepare:               Contain the  packet and HW update variables
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @res_list_isp_out:      IFE/SFE out resource list
+ * @res_list_ife_in_rd:    IFE/SFE in rd resource list
+ * @base:                  Base info for IFE/SFE
+ * @out_map:               Outport map
+ * @hw_intf:               HW intf
+ * @iommu_hdl:             Iommu handle to get the IO buf from memory manager
+ * @sec_iommu_hdl:         Secure iommu handle to get the IO buf from
+ *                         memory manager
+ * @out_base:              Base value of ISP resource (IFE/SFE)
+ * @out_max:               Max of supported ISP resources(IFE/SFE)
+ * @major_version:         Major version
+ * @fill_fence:            If true, Fence map table will be filled
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+
+struct cam_isp_io_buf_info {
+	struct cam_isp_frame_header_info        *frame_hdr;
+	struct cam_isp_check_io_cfg_for_scratch *scratch_check_cfg;
+	struct cam_hw_prepare_update_args       *prepare;
+	struct cam_kmd_buf_info                 *kmd_buf_info;
+	struct cam_isp_hw_mgr_res               *res_list_isp_out;
+	struct list_head                        *res_list_in_rd;
+	struct cam_isp_ctx_base_info            *base;
+	uint8_t                                 *out_map;
+	struct cam_hw_intf                      *hw_intf;
+	int                                      iommu_hdl;
+	int                                      sec_iommu_hdl;
+	uint32_t                                 out_base;
+	uint32_t                                 out_max;
+	uint32_t                                 major_version;
+	uint32_t                                 unpacker_fmt;
+	bool                                     fill_fence;
+};
+
+/*
+ * cam_isp_add_change_base()
+ *
+ * @brief                  Add change base in the hw entries list
+ *                         processe the isp source list get the change base from
+ *                         ISP HW instance
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @res_list_isp_src:      Resource list for IFE/VFE source
+ * @change_base_args:      Arguments for Change base function
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_change_base(
+	struct cam_hw_prepare_update_args     *prepare,
+	struct list_head                      *res_list_isp_src,
+	struct cam_isp_change_base_args       *change_base_args,
+	struct cam_kmd_buf_info               *kmd_buf_info);
+
+/*
+ * cam_isp_add_cmd_buf_update()
+ *
+ * @brief                  Add command buffer in the HW entries list for given
+ *                         Blob Data.
+ *
+ * @res:                   ISP HW resource to get the update from
+ * @cmd_type:              Cmd type to get update for
+ * @hw_cmd_type:           HW Cmd type corresponding to cmd_type
+ * @base_idx:              Base hardware index
+ * @cmd_buf_addr:          Cpu buf addr of kmd scratch buffer
+ * @kmd_buf_remain_size:   Remaining size left for cmd buffer update
+ * @cmd_update_data:       Data needed by HW to process the cmd and provide
+ *                         cmd buffer
+ * @bytes_used:            Address of the field to be populated with
+ *                         total bytes used as output to caller
+ *
+ * @return:                Negative for Failure
+ *                         otherwise returns bytes used
+ */
+int cam_isp_add_cmd_buf_update(
+	struct cam_isp_resource_node         *res,
+	struct cam_hw_intf                   *hw_intf,
+	uint32_t                              cmd_type,
+	uint32_t                              hw_cmd_type,
+	uint32_t                             *cmd_buf_addr,
+	uint32_t                              kmd_buf_remain_size,
+	void                                 *cmd_update_data,
+	uint32_t                             *bytes_used);
+
+/*
+ * cam_sfe_add_command_buffers()
+ *
+ * @brief                  Add command buffer in the HW entries list for given
+ *                         left or right SFE instance.
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @kmd_buf_info:          KMD buffer to store the custom cmd data
+ * @base_info:             base hardware information
+ * @blob_handler_cb:       Call_back_function for Meta handling
+ * @res_list_isp_out:      SFE out resource list
+ * @out_map:               SFE /VFE out port map
+ * @out_base:              Base value of ISP resource (SFE)
+ * @out_max:               Max of supported ISP resources(SFE)
+ *
+ * @return:                0 for success
+ *                         Negative for Failure
+ */
+int cam_sfe_add_command_buffers(
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	struct cam_isp_ctx_base_info       *base_info,
+	cam_packet_generic_blob_handler     blob_handler_cb,
+	struct cam_isp_hw_mgr_res          *res_list_sfe_out,
+	uint8_t                            *out_map,
+	uint32_t                            out_base,
+	uint32_t                            out_max);
+
+/*
+ * cam_isp_add_command_buffers()
+ *
+ * @brief                  Add command buffer in the HW entries list for given
+ *                         left or right VFE/IFE instance.
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @kmd_buf_info:          KMD buffer to store the custom cmd data
+ * @base_info:             base hardware information
+ * @blob_handler_cb:       Call_back_function for Meta handling
+ * @res_list_isp_out:      IFE /VFE out resource list
+ * @out_map:               SFE /VFE out port map
+ * @out_base:              Base value of ISP resource (IFE)
+ * @out_max:               Max of supported ISP resources(IFE)
+ *
+ * @return:                0 for success
+ *                         Negative for Failure
+ */
+int cam_isp_add_command_buffers(
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	struct cam_isp_ctx_base_info       *base_info,
+	cam_packet_generic_blob_handler     blob_handler_cb,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint8_t                            *out_map,
+	uint32_t                            out_base,
+	uint32_t                            out_max);
+
+/*
+ * cam_isp_add_io_buffers()
+ *
+ * @brief                  Add io buffer configurations in the HW entries list
+ *                         processe the io configurations based on the base
+ *                         index and update the HW entries list
+ *
+ * @io_info:               Io buffer information
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_io_buffers(struct cam_isp_io_buf_info   *io_info);
+
+/*
+ * cam_isp_add_disable_wm_update()
+ *
+ * @brief                  Add disable wm command
+ *
+ * @prepare:               Contain the  packet and HW update variables
+ * @isp_hw_res:            Resource list for IFE/VFE out resource
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @wm_mask                Bit mask of unconfigured resource
+ * @io_info                IO buf info
+ *
+ */
+int cam_isp_add_disable_wm_update(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_isp_hw_mgr_res            *isp_hw_res,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	uint64_t                              *wm_mask,
+	struct cam_isp_io_buf_info *io_info);
+
+/*
+ * cam_isp_add_reg_update()
+ *
+ * @brief                  Add reg update in the hw entries list
+ *                         processe the isp source list get the reg update from
+ *                         ISP HW instance
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @res_list_isp_src:      Resource list for IFE/VFE source
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @combine:               Indicate whether combine with prev update entry
+ * @priv_data:             private data for HW driver
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_reg_update(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  combine,
+	void                                 *priv_data);
+
+/*
+ * cam_isp_add_comp_wait()
+ *
+ * @brief                  Add reg update in the hw entries list
+ *                         processe the isp source list get the reg update from
+ *                         ISP HW instance
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @res_list_isp_src:      Resource list for IFE/VFE source
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_comp_wait(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info);
+
+/*
+ * cam_isp_add_wait_trigger()
+ *
+ * @brief                  Add reg update in the hw entries list
+ *                         processe the isp source list get the reg update from
+ *                         ISP HW instance
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @res_list_isp_src:      Resource list for IFE/VFE source
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @trigger_cdm_en         Used to reset and set trigger_cdm_events register
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_wait_trigger(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  trigger_cdm_en);
+
+
+/*
+ * cam_isp_add_go_cmd()
+ *
+ * @brief                  Add go_cmd in the hw entries list for each rd source
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @res:                   go_cmd added for this resource
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @combine:               Indicate whether combine with prev update entry
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_go_cmd(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_isp_resource_node         *res,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  combine);
+
+/* cam_isp_csid_add_reg_update()
+ *
+ * @brief                  Add csid reg update in the hw entries list
+ *                         processe the isp source list get the reg update from
+ *                         ISP HW instance
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @rup_args:              Reg Update args
+ * @combine:               Indicate whether combine with prev update entry
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_csid_reg_update(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	void                                 *args,
+	bool                                  combine);
+
+
+/* cam_isp_add_csid_offline_cmd()
+ *
+ * @brief                  Add csid go cmd for offline mode
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @res:                   go_cmd added for this resource
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @combine:               Indicate whether combine with prev update entry
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_csid_offline_cmd(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_isp_resource_node         *res,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  combine);
+
+/*
+ * cam_isp_add_csid_command_buffers()
+ *
+ * @brief                  Add command buffer in the HW entries list for given
+ *                         left or right CSID instance.
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @kmd_buf_info:          KMD buffer to store the custom cmd data
+ * @blob_handler_cb:       Blob handler callback
+ * @base_info:             base hardware information
+ *
+ * @return:                0 for success
+ *                         Negative for Failure
+ */
+int cam_isp_add_csid_command_buffers(
+	struct cam_hw_prepare_update_args   *prepare,
+	struct cam_kmd_buf_info             *kmd_buf_info,
+	cam_packet_generic_blob_handler      blob_handler_cb,
+	struct cam_isp_ctx_base_info        *base_info);
+
+/*
+ * cam_isp_get_cmd_buf_count()
+ *
+ * @brief                  Counts the number of command buffers
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @cmd_buf_count:         Cmd buffer count container
+ *
+ * @return:                0 for success
+ *                         Negative for Failure
+ */
+int cam_isp_get_cmd_buf_count(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct cam_isp_cmd_buf_count         *cmd_buf_count);
+
+/*
+ * cam_isp_update_hw_entry()
+ *
+ * @brief                  Add a new update hw entry or combine with
+ *                         prev update hw entry
+ *
+ * @cdm_bl_type:           CDM BL type for the current updated entry
+ * @prepare:               Contain the packet and HW update variables
+ * @kmd_buf_info:          Kmd buffer to store register value pair changes
+ * @update_size:           Update size for cmd data in kmd buffer
+ * @combine:               Indicate whether combine with prev update entry
+ */
+void cam_isp_update_hw_entry(
+	enum cam_isp_cdm_bl_type            cdm_bl_type,
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	uint32_t                            update_size,
+	bool                                combine);
+
+int cam_isp_count_hw_entries(struct cam_hw_prepare_update_args *prepare);
+#endif /*_CAM_ISP_HW_PARSER_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/include/cam_tasklet_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/include/cam_tasklet_util.h
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TASKLET_UTIL_H_
+#define _CAM_TASKLET_UTIL_H_
+
+#include "cam_irq_controller.h"
+
+/*
+ * cam_tasklet_init()
+ *
+ * @brief:              Initialize the tasklet info structure
+ *
+ * @tasklet:            Tasklet to initialize
+ * @hw_mgr_ctx:         Private Ctx data that will be passed to the handler
+ *                      function
+ * @idx:                Index of tasklet used as identity
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_tasklet_init(
+	void                   **tasklet,
+	void                    *hw_mgr_ctx,
+	uint32_t                 idx);
+
+/*
+ * cam_tasklet_deinit()
+ *
+ * @brief:              Deinitialize the tasklet info structure
+ *
+ * @tasklet:            Tasklet to deinitialize
+ *
+ * @return:             Void
+ */
+void cam_tasklet_deinit(void   **tasklet);
+
+/*
+ * cam_tasklet_start()
+ *
+ * @brief:              Enable the tasklet to be scheduled and run.
+ *                      Caller should make sure this function is called
+ *                      before trying to enqueue.
+ *
+ * @tasklet:            Tasklet to start
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_tasklet_start(void    *tasklet);
+
+/*
+ * cam_tasklet_stop()
+ *
+ * @brief:              Disable the tasklet so it can no longer be scheduled.
+ *                      Need to enable again to run.
+ *
+ * @tasklet:            Tasklet to stop
+ *
+ * @return:             Void
+ */
+void cam_tasklet_stop(void    *tasklet);
+
+/*
+ * cam_tasklet_enqueue_cmd()
+ *
+ * @brief:               Enqueue the tasklet_cmd to used list
+ *
+ * @bottom_half:         Tasklet info to enqueue onto
+ * @bh_cmd:              Tasklet cmd used to enqueue task
+ * @handler_priv:        Private Handler data that will be passed to the
+ *                       handler function
+ * @evt_payload_priv:    Event payload that will be passed to the handler
+ *                       function
+ * @bottom_half_handler: Callback function that will be called by tasklet
+ *                       for handling event
+ *
+ * @return:              Void
+ */
+void cam_tasklet_enqueue_cmd(
+	void                              *bottom_half,
+	void                              *bh_cmd,
+	void                              *handler_priv,
+	void                              *evt_payload_priv,
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler);
+
+/**
+ * cam_tasklet_get_cmd()
+ *
+ * @brief:              Get free cmd from tasklet
+ *
+ * @bottom_half:        Tasklet Info structure to get cmd from
+ * @bh_cmd:             Return tasklet_cmd pointer if successful
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_tasklet_get_cmd(void *bottom_half, void **bh_cmd);
+
+/**
+ * cam_tasklet_put_cmd()
+ *
+ * @brief:              Put back cmd to free list
+ *
+ * @bottom_half:        Tasklet Info structure to put cmd into
+ * @bh_cmd:             tasklet_cmd pointer that needs to be put back
+ *
+ * @return:             Void
+ */
+void cam_tasklet_put_cmd(void *bottom_half, void **bh_cmd);
+
+extern struct cam_irq_bh_api tasklet_bh_api;
+
+#endif /* _CAM_TASKLET_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.c
@@ -0,0 +1,1251 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/spinlock_types.h>
+#include <linux/list.h>
+#include <linux/ratelimit.h>
+
+#include "cam_io_util.h"
+#include "cam_irq_controller.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+
+#define CAM_IRQ_LINE_TEST_TIMEOUT_MS 1000
+#define CAM_IRQ_MAX_DEPENDENTS 9
+#define CAM_IRQ_CTRL_NAME_LEN 16
+
+/**
+ * struct cam_irq_evt_handler:
+ * @Brief:                  Event handler information
+ *
+ * @priority:               Priority level of this event
+ * @evt_bit_mask_arr:       evt_bit_mask that has the bits set for IRQs to
+ *                          subscribe for
+ * @handler_priv:           Private data that will be passed to the Top/Bottom
+ *                          Half handler function
+ * @top_half_handler:       Top half Handler callback function
+ * @bottom_half_handler:    Bottom half Handler callback function
+ * @bottom_half:            Pointer to bottom_half implementation on which to
+ *                          enqueue the event for further handling
+ * @bottom_half_enqueue_func:
+ *                          Function used to enqueue the bottom_half event
+ * @list_node:              list_head struct used for overall handler List
+ * @th_list_node:           list_head struct used for top half handler List
+ * @index:                  Unique id of the event
+ * @group:                  Group to which the event belongs
+ */
+struct cam_irq_evt_handler {
+	enum cam_irq_priority_level        priority;
+	uint32_t                          *evt_bit_mask_arr;
+	void                              *handler_priv;
+	CAM_IRQ_HANDLER_TOP_HALF           top_half_handler;
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler;
+	void                              *bottom_half;
+	struct cam_irq_bh_api              irq_bh_api;
+	struct list_head                   list_node;
+	struct list_head                   th_list_node;
+	int                                index;
+	int                                group;
+};
+
+/**
+ * struct cam_irq_register_obj:
+ * @Brief:                  Structure containing information related to
+ *                          a particular register Set
+ *
+ * @index:                  Index of set in Array
+ * @mask_reg_offset:        Offset of IRQ MASK register
+ * @clear_reg_offset:       Offset of IRQ CLEAR register
+ * @status_reg_offset:      Offset of IRQ STATUS register
+ * @set_reg_offset:         Offset of IRQ SET register
+ * @test_set_val:           Value to write to IRQ SET register to trigger IRQ
+ * @test_sub_val:           Value to write to IRQ MASK register to receive test IRQ
+ * @top_half_enable_mask:   Array of enabled bit_mask sorted by priority
+ * @aggr_mask:              Aggregate mask to keep track of the overall mask
+ *                          after subscribe/unsubscribe calls
+ * @dependent_read_mask:    Mask to check if any dependent controllers' read needs to triggered
+ *                          from independent controller
+ * @dirty_clear:            Flag to identify if clear register contains non-zero value
+ */
+struct cam_irq_register_obj {
+	uint32_t                     index;
+	uint32_t                     mask_reg_offset;
+	uint32_t                     clear_reg_offset;
+	uint32_t                     status_reg_offset;
+	uint32_t                     set_reg_offset;
+	uint32_t                     test_set_val;
+	uint32_t                     test_sub_val;
+	uint32_t                     top_half_enable_mask[CAM_IRQ_PRIORITY_MAX];
+	uint32_t                     aggr_mask;
+	uint32_t                     dependent_read_mask[CAM_IRQ_MAX_DEPENDENTS];
+	bool                         dirty_clear;
+};
+
+/**
+ * struct cam_irq_controller:
+ *
+ * @brief:                  IRQ Controller structure.
+ *
+ * @name:                   Name of IRQ Controller block
+ * @mem_base:               Mapped base address of register space to which
+ *                          register offsets are added to access registers
+ * @num_registers:          Number of sets(mask/clear/status) of IRQ registers
+ * @irq_register_arr:       Array of Register object associated with this
+ *                          Controller
+ * @irq_status_arr:         Array of IRQ Status values
+ * @global_irq_cmd_offset:  Offset of Global IRQ Clear register. This register
+ *                          contains the BIT that needs to be set for the CLEAR
+ *                          to take effect
+ * @global_clear_bitmask:   Bitmask needed to be used in Global IRQ command register
+ *                          for Clear IRQ cmd to take effect
+ * @global_set_bitmask:     Bitmask needed to be used in Global IRQ command register
+ *                          for Set IRQ cmd to take effect
+ * @clear_all_bitmask:      Bitmask that specifies which bits should be written to clear register
+ *                          when it is to be cleared forcefully
+ * @evt_handler_list_head:  List of all event handlers
+ * @th_list_head:           List of handlers sorted by priority
+ * @hdl_idx:                Unique identity of handler assigned on Subscribe.
+ *                          Used to Unsubscribe.
+ * @th_payload:             Payload structure to be passed to top half handler
+ * @is_dependent:           Flag to indicate is this controller is dependent on another controller
+ * @dependent_controller:   Array of controllers that depend on this controller
+ * @delayed_global_clear:   Flag to indicate if this controller issues global clear after dependent
+ *                          controllers are handled
+ * @lock:                   Lock to be used by controller, Use mutex lock in presil mode,
+ *                          and spinlock in regular case
+ */
+struct cam_irq_controller {
+	char                            name[CAM_IRQ_CTRL_NAME_LEN];
+	void __iomem                   *mem_base;
+	uint32_t                        num_registers;
+	struct cam_irq_register_obj    *irq_register_arr;
+	uint32_t                       *irq_status_arr;
+	uint32_t                        global_irq_cmd_offset;
+	uint32_t                        global_clear_bitmask;
+	uint32_t                        global_set_bitmask;
+	uint32_t                        clear_all_bitmask;
+	struct list_head                evt_handler_list_head;
+	struct list_head                th_list_head[CAM_IRQ_PRIORITY_MAX];
+	uint32_t                        hdl_idx;
+	struct cam_irq_th_payload       th_payload;
+	bool                            is_dependent;
+	struct cam_irq_controller      *dependent_controller[CAM_IRQ_MAX_DEPENDENTS];
+	bool                            delayed_global_clear;
+
+#ifdef CONFIG_CAM_PRESIL
+	struct mutex                    lock;
+#else
+	spinlock_t                      lock;
+#endif
+};
+
+#ifdef CONFIG_CAM_PRESIL
+static inline void cam_irq_controller_lock_init(struct cam_irq_controller *controller)
+{
+	mutex_init(&controller->lock);
+}
+
+static inline unsigned long cam_irq_controller_lock_irqsave(
+	struct cam_irq_controller *controller)
+{
+	mutex_lock(&controller->lock);
+
+	return 0;
+}
+
+static inline void cam_irq_controller_unlock_irqrestore(
+	struct cam_irq_controller *controller, unsigned long flags)
+{
+	mutex_unlock(&controller->lock);
+}
+
+static inline void cam_irq_controller_lock(struct cam_irq_controller *controller)
+{
+	mutex_lock(&controller->lock);
+}
+
+static inline void cam_irq_controller_unlock(struct cam_irq_controller *controller)
+{
+	mutex_unlock(&controller->lock);
+}
+#else
+static inline void cam_irq_controller_lock_init(struct cam_irq_controller *controller)
+{
+	spin_lock_init(&controller->lock);
+}
+
+static inline unsigned long cam_irq_controller_lock_irqsave(
+	struct cam_irq_controller *controller)
+{
+	unsigned long flags = 0;
+
+	if (!in_irq())
+		spin_lock_irqsave(&controller->lock, flags);
+
+	return flags;
+}
+
+static inline void cam_irq_controller_unlock_irqrestore(
+	struct cam_irq_controller *controller, unsigned long flags)
+{
+	if (!in_irq())
+		spin_unlock_irqrestore(&controller->lock, flags);
+}
+
+static inline void cam_irq_controller_lock(struct cam_irq_controller *controller)
+{
+	spin_lock(&controller->lock);
+}
+
+static inline void cam_irq_controller_unlock(struct cam_irq_controller *controller)
+{
+	spin_unlock(&controller->lock);
+}
+#endif
+
+
+
+int cam_irq_controller_unregister_dependent(void *primary_controller, void *secondary_controller)
+{
+	struct cam_irq_controller *ctrl_primary, *ctrl_secondary;
+	int i, dep_idx;
+
+	if (!primary_controller || !secondary_controller) {
+		CAM_ERR(CAM_IRQ_CTRL, "invalid args: %pK, %pK", primary_controller,
+			secondary_controller);
+		return -EINVAL;
+	}
+
+	ctrl_primary = primary_controller;
+	ctrl_secondary = secondary_controller;
+
+	for (i = 0; i < CAM_IRQ_MAX_DEPENDENTS; i++) {
+		if (ctrl_primary->dependent_controller[i] == ctrl_secondary)
+			break;
+	}
+	if (i == CAM_IRQ_MAX_DEPENDENTS) {
+		CAM_ERR(CAM_IRQ_CTRL, "could not find %s as a dependent of %s)",
+			ctrl_secondary->name, ctrl_primary->name);
+		return -EINVAL;
+	}
+	dep_idx = i;
+
+	ctrl_primary->dependent_controller[dep_idx] = NULL;
+	for (i = 0; i < ctrl_primary->num_registers; i++)
+		ctrl_primary->irq_register_arr[i].dependent_read_mask[dep_idx] = 0;
+	ctrl_secondary->is_dependent = false;
+	ctrl_primary->delayed_global_clear = false;
+
+	CAM_DBG(CAM_IRQ_CTRL, "successfully unregistered %s as dependent of %s",
+		ctrl_secondary->name, ctrl_primary->name);
+
+	return 0;
+}
+
+int cam_irq_controller_register_dependent(void *primary_controller, void *secondary_controller,
+	uint32_t *mask)
+{
+	struct cam_irq_controller *ctrl_primary, *ctrl_secondary;
+	int i, dep_idx;
+
+	if (!primary_controller || !secondary_controller) {
+		CAM_ERR(CAM_IRQ_CTRL, "invalid args: %pK, %pK", primary_controller,
+			secondary_controller);
+		return -EINVAL;
+	}
+
+	ctrl_primary = primary_controller;
+	ctrl_secondary = secondary_controller;
+
+	for (i = 0; i < CAM_IRQ_MAX_DEPENDENTS; i++) {
+		if (!ctrl_primary->dependent_controller[i])
+			break;
+	}
+	if (i == CAM_IRQ_MAX_DEPENDENTS) {
+		CAM_ERR(CAM_IRQ_CTRL, "reached maximum dependents (%s - %s)",
+			ctrl_primary->name, ctrl_secondary->name);
+		return -ENOMEM;
+	}
+	dep_idx = i;
+
+	ctrl_primary->dependent_controller[dep_idx] = secondary_controller;
+	for (i = 0; i < ctrl_primary->num_registers; i++)
+		ctrl_primary->irq_register_arr[i].dependent_read_mask[dep_idx] = mask[i];
+	ctrl_secondary->is_dependent = true;
+
+	/**
+	 * NOTE: For dependent controllers that should not issue global clear command,
+	 * set their global_irq_cmd_offset to 0
+	 */
+	if (!ctrl_secondary->global_irq_cmd_offset)
+		ctrl_primary->delayed_global_clear = true;
+
+	CAM_DBG(CAM_IRQ_CTRL, "successfully registered %s as dependent of %s", ctrl_secondary->name,
+		ctrl_primary->name);
+	return 0;
+}
+
+static inline void cam_irq_controller_clear_irq(
+	struct cam_irq_controller  *controller,
+	struct cam_irq_evt_handler *evt_handler)
+{
+	struct cam_irq_register_obj *irq_register;
+	int i;
+
+	/* Don't clear in IRQ context since global clear will be issued after
+	 * top half processing
+	 */
+	if (in_irq())
+		return;
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		cam_io_w_mb(evt_handler->evt_bit_mask_arr[i],
+				controller->mem_base +
+				irq_register->clear_reg_offset);
+	}
+
+	if (controller->global_irq_cmd_offset)
+		cam_io_w_mb(controller->global_clear_bitmask,
+				controller->mem_base +
+				controller->global_irq_cmd_offset);
+}
+
+int cam_irq_controller_deinit(void **irq_controller)
+{
+	struct cam_irq_controller *controller = *irq_controller;
+	struct cam_irq_evt_handler *evt_handler = NULL;
+
+	if (!controller) {
+		CAM_ERR(CAM_IRQ_CTRL, "Null Pointer");
+		return -EINVAL;
+	}
+
+	while (!list_empty(&controller->evt_handler_list_head)) {
+		evt_handler = list_first_entry(
+			&controller->evt_handler_list_head,
+			struct cam_irq_evt_handler, list_node);
+		list_del_init(&evt_handler->list_node);
+		kfree(evt_handler->evt_bit_mask_arr);
+		kfree(evt_handler);
+	}
+
+	kfree(controller->th_payload.evt_status_arr);
+	kfree(controller->irq_status_arr);
+	kfree(controller->irq_register_arr);
+	kfree(controller);
+	*irq_controller = NULL;
+	return 0;
+}
+
+int cam_irq_controller_init(const char       *name,
+	void __iomem                         *mem_base,
+	struct cam_irq_controller_reg_info   *register_info,
+	void                                **irq_controller)
+{
+	struct cam_irq_controller *controller = NULL;
+	int i, rc = 0;
+
+	*irq_controller = NULL;
+
+	if (!register_info->num_registers || !register_info->irq_reg_set ||
+		!name || !mem_base) {
+		CAM_ERR(CAM_IRQ_CTRL, "Invalid parameters");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	controller = kzalloc(sizeof(struct cam_irq_controller), GFP_KERNEL);
+	if (!controller) {
+		CAM_DBG(CAM_IRQ_CTRL, "Failed to allocate IRQ Controller");
+		return -ENOMEM;
+	}
+
+	controller->irq_register_arr = kzalloc(register_info->num_registers *
+		sizeof(struct cam_irq_register_obj), GFP_KERNEL);
+	if (!controller->irq_register_arr) {
+		CAM_DBG(CAM_IRQ_CTRL, "Failed to allocate IRQ register Arr");
+		rc = -ENOMEM;
+		goto reg_alloc_error;
+	}
+
+	controller->irq_status_arr = kzalloc(register_info->num_registers *
+		sizeof(uint32_t), GFP_KERNEL);
+	if (!controller->irq_status_arr) {
+		CAM_DBG(CAM_IRQ_CTRL, "Failed to allocate IRQ status Arr");
+		rc = -ENOMEM;
+		goto status_alloc_error;
+	}
+
+	controller->th_payload.evt_status_arr =
+		kzalloc(register_info->num_registers * sizeof(uint32_t),
+		GFP_KERNEL);
+	if (!controller->th_payload.evt_status_arr) {
+		CAM_DBG(CAM_IRQ_CTRL,
+			"Failed to allocate BH payload bit mask Arr");
+		rc = -ENOMEM;
+		goto evt_mask_alloc_error;
+	}
+
+	strscpy(controller->name, name, CAM_IRQ_CTRL_NAME_LEN);
+
+	CAM_DBG(CAM_IRQ_CTRL, "num_registers: %d",
+		register_info->num_registers);
+	for (i = 0; i < register_info->num_registers; i++) {
+		controller->irq_register_arr[i].index = i;
+		controller->irq_register_arr[i].mask_reg_offset =
+			register_info->irq_reg_set[i].mask_reg_offset;
+		controller->irq_register_arr[i].clear_reg_offset =
+			register_info->irq_reg_set[i].clear_reg_offset;
+		controller->irq_register_arr[i].status_reg_offset =
+			register_info->irq_reg_set[i].status_reg_offset;
+		controller->irq_register_arr[i].set_reg_offset =
+			register_info->irq_reg_set[i].set_reg_offset;
+		controller->irq_register_arr[i].test_set_val =
+			register_info->irq_reg_set[i].test_set_val;
+		controller->irq_register_arr[i].test_sub_val =
+			register_info->irq_reg_set[i].test_sub_val;
+		controller->irq_register_arr[i].dirty_clear = true;
+		CAM_DBG(CAM_IRQ_CTRL, "i %d mask_reg_offset: 0x%x", i,
+			controller->irq_register_arr[i].mask_reg_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "i %d clear_reg_offset: 0x%x", i,
+			controller->irq_register_arr[i].clear_reg_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "i %d status_reg_offset: 0x%x", i,
+			controller->irq_register_arr[i].status_reg_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "i %d set_reg_offset: 0x%x", i,
+			controller->irq_register_arr[i].set_reg_offset);
+	}
+	controller->num_registers        = register_info->num_registers;
+	controller->global_clear_bitmask = register_info->global_clear_bitmask;
+	controller->global_irq_cmd_offset  = register_info->global_irq_cmd_offset;
+	controller->global_set_bitmask   = register_info->global_set_bitmask;
+	controller->clear_all_bitmask    = register_info->clear_all_bitmask;
+	controller->mem_base             = mem_base;
+	controller->is_dependent         = false;
+
+	CAM_DBG(CAM_IRQ_CTRL, "global_clear_bitmask: 0x%x",
+		controller->global_clear_bitmask);
+	CAM_DBG(CAM_IRQ_CTRL, "global_irq_cmd_offset: 0x%x",
+		controller->global_irq_cmd_offset);
+	CAM_DBG(CAM_IRQ_CTRL, "mem_base: %pK",
+		(void __iomem *)controller->mem_base);
+
+	INIT_LIST_HEAD(&controller->evt_handler_list_head);
+	for (i = 0; i < CAM_IRQ_PRIORITY_MAX; i++)
+		INIT_LIST_HEAD(&controller->th_list_head[i]);
+
+	cam_irq_controller_lock_init(controller);
+
+	controller->hdl_idx = 1;
+	*irq_controller = controller;
+
+	return rc;
+
+evt_mask_alloc_error:
+	kfree(controller->irq_status_arr);
+status_alloc_error:
+	kfree(controller->irq_register_arr);
+reg_alloc_error:
+	kfree(controller);
+
+	return rc;
+}
+
+static inline void __cam_irq_controller_disable_irq(
+	struct cam_irq_controller  *controller,
+	struct cam_irq_evt_handler *evt_handler)
+{
+	struct cam_irq_register_obj *irq_register;
+	uint32_t *update_mask;
+	int i, priority = 0;
+
+	update_mask = evt_handler->evt_bit_mask_arr;
+	priority    = evt_handler->priority;
+
+	if (unlikely(priority >= CAM_IRQ_PRIORITY_MAX))
+		return;
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		irq_register->top_half_enable_mask[priority] &= ~update_mask[i];
+		irq_register->aggr_mask &= ~update_mask[i];
+		cam_io_w_mb(irq_register->aggr_mask, controller->mem_base +
+			irq_register->mask_reg_offset);
+	}
+}
+
+static inline void __cam_irq_controller_disable_irq_evt(
+	struct cam_irq_controller  *controller,
+	struct cam_irq_evt_handler *evt_handler)
+{
+	struct cam_irq_register_obj *irq_register;
+	uint32_t *update_mask;
+	int i, priority = 0;
+
+	update_mask = evt_handler->evt_bit_mask_arr;
+	priority    = evt_handler->priority;
+
+	if (unlikely(priority >= CAM_IRQ_PRIORITY_MAX))
+		return;
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		irq_register->top_half_enable_mask[priority] &= ~update_mask[i];
+		irq_register->aggr_mask &= ~update_mask[i];
+	}
+}
+
+static inline void __cam_irq_controller_enable_irq(
+	struct cam_irq_controller  *controller,
+	struct cam_irq_evt_handler *evt_handler)
+{
+	struct cam_irq_register_obj *irq_register;
+	uint32_t *update_mask;
+	int i, priority = 0;
+
+	update_mask = evt_handler->evt_bit_mask_arr;
+	priority    = evt_handler->priority;
+
+	if (unlikely(priority >= CAM_IRQ_PRIORITY_MAX))
+		return;
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		irq_register->top_half_enable_mask[priority] |= update_mask[i];
+		irq_register->aggr_mask |= update_mask[i];
+		irq_register->dirty_clear = true;
+		cam_io_w_mb(irq_register->aggr_mask, controller->mem_base +
+			irq_register->mask_reg_offset);
+	}
+}
+
+int cam_irq_controller_subscribe_irq(void *irq_controller,
+	enum cam_irq_priority_level        priority,
+	uint32_t                          *evt_bit_mask_arr,
+	void                              *handler_priv,
+	CAM_IRQ_HANDLER_TOP_HALF           top_half_handler,
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler,
+	void                              *bottom_half,
+	struct cam_irq_bh_api             *irq_bh_api,
+	enum cam_irq_event_group           evt_grp)
+{
+	struct cam_irq_controller  *controller  = irq_controller;
+	struct cam_irq_evt_handler *evt_handler = NULL;
+	int                         i;
+	int                         rc = 0;
+	unsigned long               flags = 0;
+
+	if (!controller || !handler_priv || !evt_bit_mask_arr) {
+		CAM_ERR(CAM_IRQ_CTRL,
+			"Inval params: ctlr=%pK hdl_priv=%pK bit_mask_arr=%pK",
+			controller, handler_priv, evt_bit_mask_arr);
+		return -EINVAL;
+	}
+
+	if (!top_half_handler) {
+		CAM_ERR(CAM_IRQ_CTRL, "Missing top half handler");
+		return -EINVAL;
+	}
+
+	if (bottom_half_handler &&
+		(!bottom_half || !irq_bh_api)) {
+		CAM_ERR(CAM_IRQ_CTRL,
+			"Invalid params: bh_handler=%pK bh=%pK bh_enq_f=%pK",
+			bottom_half_handler,
+			bottom_half,
+			irq_bh_api);
+		return -EINVAL;
+	}
+
+	if (irq_bh_api &&
+		(!irq_bh_api->bottom_half_enqueue_func ||
+		!irq_bh_api->get_bh_payload_func ||
+		!irq_bh_api->put_bh_payload_func)) {
+		CAM_ERR(CAM_IRQ_CTRL,
+			"Invalid: enqueue_func=%pK get_bh=%pK put_bh=%pK",
+			irq_bh_api->bottom_half_enqueue_func,
+			irq_bh_api->get_bh_payload_func,
+			irq_bh_api->put_bh_payload_func);
+		return -EINVAL;
+	}
+
+	if (priority >= CAM_IRQ_PRIORITY_MAX) {
+		CAM_ERR(CAM_IRQ_CTRL, "Invalid priority=%u, max=%u", priority,
+			CAM_IRQ_PRIORITY_MAX);
+		return -EINVAL;
+	}
+
+	evt_handler = kzalloc(sizeof(struct cam_irq_evt_handler), GFP_KERNEL);
+	if (!evt_handler) {
+		CAM_DBG(CAM_IRQ_CTRL, "Error allocating hlist_node");
+		return -ENOMEM;
+	}
+
+	evt_handler->evt_bit_mask_arr = kzalloc(sizeof(uint32_t) *
+		controller->num_registers, GFP_KERNEL);
+	if (!evt_handler->evt_bit_mask_arr) {
+		CAM_DBG(CAM_IRQ_CTRL, "Error allocating hlist_node");
+		rc = -ENOMEM;
+		goto free_evt_handler;
+	}
+
+	INIT_LIST_HEAD(&evt_handler->list_node);
+	INIT_LIST_HEAD(&evt_handler->th_list_node);
+
+	for (i = 0; i < controller->num_registers; i++)
+		evt_handler->evt_bit_mask_arr[i] = evt_bit_mask_arr[i];
+
+	evt_handler->priority                 = priority;
+	evt_handler->handler_priv             = handler_priv;
+	evt_handler->top_half_handler         = top_half_handler;
+	evt_handler->bottom_half_handler      = bottom_half_handler;
+	evt_handler->bottom_half              = bottom_half;
+	evt_handler->index                    = controller->hdl_idx++;
+	evt_handler->group                    = evt_grp;
+
+	if (irq_bh_api)
+		evt_handler->irq_bh_api       = *irq_bh_api;
+
+	/* Avoid rollover to negative values */
+	if (controller->hdl_idx > 0x3FFFFFFF)
+		controller->hdl_idx = 1;
+
+	flags = cam_irq_controller_lock_irqsave(controller);
+
+	__cam_irq_controller_enable_irq(controller, evt_handler);
+
+	list_add_tail(&evt_handler->list_node,
+		&controller->evt_handler_list_head);
+	list_add_tail(&evt_handler->th_list_node,
+		&controller->th_list_head[priority]);
+
+	cam_irq_controller_unlock_irqrestore(controller, flags);
+
+	return evt_handler->index;
+
+free_evt_handler:
+	kfree(evt_handler);
+	evt_handler = NULL;
+
+	return rc;
+}
+
+static inline int cam_irq_controller_find_event_handle(struct cam_irq_controller *controller,
+	uint32_t handle, struct cam_irq_evt_handler **found_evt_handler)
+{
+	struct cam_irq_evt_handler  *evt_handler, *evt_handler_temp;
+	int rc = -EINVAL;
+
+	list_for_each_entry_safe(evt_handler, evt_handler_temp,
+		&controller->evt_handler_list_head, list_node) {
+		if (evt_handler->index == handle) {
+			rc = 0;
+			*found_evt_handler = evt_handler;
+			break;
+		}
+	}
+
+	return rc;
+}
+
+int cam_irq_controller_enable_irq(void *irq_controller, uint32_t handle)
+{
+	struct cam_irq_controller   *controller  = irq_controller;
+	struct cam_irq_evt_handler  *evt_handler = NULL;
+	unsigned long               flags = 0;
+	int                         rc = 0;
+
+	if (!controller)
+		return rc;
+
+	flags = cam_irq_controller_lock_irqsave(controller);
+
+	rc = cam_irq_controller_find_event_handle(controller, handle,
+		&evt_handler);
+	if (rc)
+		goto end;
+
+	CAM_DBG(CAM_IRQ_CTRL, "enable event %d", handle);
+	__cam_irq_controller_enable_irq(controller, evt_handler);
+
+end:
+	cam_irq_controller_unlock_irqrestore(controller, flags);
+
+	return rc;
+}
+
+int cam_irq_controller_disable_irq(void *irq_controller, uint32_t handle)
+{
+	struct cam_irq_controller   *controller  = irq_controller;
+	struct cam_irq_evt_handler  *evt_handler = NULL;
+	unsigned long               flags = 0;
+	int                         rc = 0;
+
+	if (!controller)
+		return rc;
+
+	flags = cam_irq_controller_lock_irqsave(controller);
+
+	rc = cam_irq_controller_find_event_handle(controller, handle,
+		&evt_handler);
+	if (rc)
+		goto end;
+
+	CAM_DBG(CAM_IRQ_CTRL, "disable event %d", handle);
+	__cam_irq_controller_disable_irq(controller, evt_handler);
+	cam_irq_controller_clear_irq(controller, evt_handler);
+
+end:
+	cam_irq_controller_unlock_irqrestore(controller, flags);
+
+	return rc;
+}
+
+int cam_irq_controller_unsubscribe_irq(void *irq_controller,
+	uint32_t handle)
+{
+	struct cam_irq_controller   *controller  = irq_controller;
+	struct cam_irq_evt_handler  *evt_handler = NULL;
+	unsigned long               flags = 0;
+	int                         rc = 0;
+
+	flags = cam_irq_controller_lock_irqsave(controller);
+
+
+	rc = cam_irq_controller_find_event_handle(controller, handle,
+		&evt_handler);
+	if (rc)
+		goto end;
+
+	list_del_init(&evt_handler->list_node);
+	list_del_init(&evt_handler->th_list_node);
+
+	__cam_irq_controller_disable_irq(controller, evt_handler);
+	cam_irq_controller_clear_irq(controller, evt_handler);
+
+	kfree(evt_handler->evt_bit_mask_arr);
+	kfree(evt_handler);
+
+end:
+	cam_irq_controller_unlock_irqrestore(controller, flags);
+
+	return rc;
+}
+
+int cam_irq_controller_unsubscribe_irq_evt(void *irq_controller,
+	uint32_t handle)
+{
+	struct cam_irq_controller   *controller  = irq_controller;
+	struct cam_irq_evt_handler  *evt_handler = NULL;
+	unsigned long               flags = 0;
+	int                         rc = 0;
+
+	flags = cam_irq_controller_lock_irqsave(controller);
+
+
+	rc = cam_irq_controller_find_event_handle(controller, handle,
+		&evt_handler);
+	if (rc)
+		goto end;
+
+	list_del_init(&evt_handler->list_node);
+	list_del_init(&evt_handler->th_list_node);
+
+	__cam_irq_controller_disable_irq_evt(controller, evt_handler);
+	cam_irq_controller_clear_irq(controller, evt_handler);
+
+	kfree(evt_handler->evt_bit_mask_arr);
+	kfree(evt_handler);
+
+end:
+	cam_irq_controller_unlock_irqrestore(controller, flags);
+
+	return rc;
+}
+
+/**
+ * cam_irq_controller_match_bit_mask()
+ *
+ * @Brief:                This function checks if any of the enabled IRQ bits
+ *                        for a certain handler is Set in the Status values
+ *                        of the controller.
+ *
+ * @controller:           IRQ Controller structure
+ * @evt_handler:          Event handler structure
+ *
+ * @Return:               True: If any interested IRQ Bit is Set
+ *                        False: Otherwise
+ */
+static bool cam_irq_controller_match_bit_mask(
+	struct cam_irq_controller   *controller,
+	struct cam_irq_evt_handler  *evt_handler,
+	int                          evt_grp)
+{
+	int i;
+
+	if (evt_handler->group != evt_grp)
+		return false;
+
+	for (i = 0; i < controller->num_registers; i++) {
+		if (evt_handler->evt_bit_mask_arr[i] &
+			controller->irq_status_arr[i])
+			return true;
+	}
+
+	return false;
+}
+
+static void __cam_irq_controller_th_processing(
+	struct cam_irq_controller      *controller,
+	struct list_head               *th_list_head,
+	int                             evt_grp)
+{
+	struct cam_irq_evt_handler     *evt_handler = NULL;
+	struct cam_irq_evt_handler     *evt_handler_tmp = NULL;
+	struct cam_irq_th_payload      *th_payload = &controller->th_payload;
+	bool                            is_irq_match;
+	int                             rc = -EINVAL;
+	int                             i;
+	void                           *bh_cmd = NULL;
+	struct cam_irq_bh_api          *irq_bh_api = NULL;
+
+	CAM_DBG(CAM_IRQ_CTRL, "Enter");
+
+	if (list_empty(th_list_head))
+		return;
+
+	list_for_each_entry_safe(evt_handler, evt_handler_tmp, th_list_head, th_list_node) {
+		is_irq_match = cam_irq_controller_match_bit_mask(controller, evt_handler, evt_grp);
+
+		if (!is_irq_match)
+			continue;
+
+		CAM_DBG(CAM_IRQ_CTRL, "match found");
+
+		cam_irq_th_payload_init(th_payload);
+		th_payload->handler_priv  = evt_handler->handler_priv;
+		th_payload->num_registers = controller->num_registers;
+		for (i = 0; i < controller->num_registers; i++) {
+			th_payload->evt_status_arr[i] =
+				controller->irq_status_arr[i] &
+				evt_handler->evt_bit_mask_arr[i];
+		}
+
+		irq_bh_api = &evt_handler->irq_bh_api;
+		bh_cmd = NULL;
+
+		if (evt_handler->bottom_half_handler) {
+			rc = irq_bh_api->get_bh_payload_func(
+				evt_handler->bottom_half, &bh_cmd);
+			if (rc || !bh_cmd) {
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"No payload, IRQ handling frozen for %s",
+					controller->name);
+				continue;
+			}
+		}
+
+		/*
+		 * irq_status_arr[0] is dummy argument passed. the entire
+		 * status array is passed in th_payload.
+		 */
+		if (evt_handler->top_half_handler)
+			rc = evt_handler->top_half_handler(
+				controller->irq_status_arr[0],
+				(void *)th_payload);
+
+		if (rc && bh_cmd) {
+			irq_bh_api->put_bh_payload_func(
+				evt_handler->bottom_half, &bh_cmd);
+			continue;
+		}
+
+		if (evt_handler->bottom_half_handler) {
+			CAM_DBG(CAM_IRQ_CTRL, "Enqueuing bottom half for %s",
+				controller->name);
+			irq_bh_api->bottom_half_enqueue_func(
+				evt_handler->bottom_half,
+				bh_cmd,
+				evt_handler->handler_priv,
+				th_payload->evt_payload_priv,
+				evt_handler->bottom_half_handler);
+		}
+	}
+
+	CAM_DBG(CAM_IRQ_CTRL, "Exit");
+}
+
+void cam_irq_controller_disable_all(void *priv)
+{
+	struct cam_irq_controller  *controller  = priv;
+	struct cam_irq_register_obj *irq_register;
+
+	uint32_t i = 0;
+
+	if (!controller)
+		return;
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		memset(irq_register->top_half_enable_mask, 0,
+			 sizeof(irq_register->top_half_enable_mask));
+		irq_register->aggr_mask = 0;
+		cam_io_w_mb(0x0, controller->mem_base + irq_register->mask_reg_offset);
+		cam_io_w_mb(controller->clear_all_bitmask, controller->mem_base +
+			irq_register->clear_reg_offset);
+	}
+
+	if (controller->global_irq_cmd_offset && !controller->delayed_global_clear) {
+		cam_io_w_mb(controller->global_clear_bitmask,
+			controller->mem_base + controller->global_irq_cmd_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "Global Clear done from %s",
+			controller->name);
+	}
+}
+
+static void __cam_irq_controller_read_registers(struct cam_irq_controller *controller)
+{
+	struct cam_irq_register_obj *irq_register;
+	int i;
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+
+		/* Skip register read if we are not going to process it */
+		if (!irq_register->aggr_mask) {
+			controller->irq_status_arr[i] = 0;
+			continue;
+		}
+
+		controller->irq_status_arr[i] = cam_io_r(controller->mem_base +
+			irq_register->status_reg_offset);
+
+		CAM_DBG(CAM_IRQ_CTRL, "(%s) Read irq status%d (0x%x) = 0x%x", controller->name, i,
+			controller->irq_register_arr[i].status_reg_offset,
+			controller->irq_status_arr[i]);
+
+		/**
+		 * If this status register has not caused the interrupt to be
+		 * triggered, we can skip writing to the clear register as long
+		 * as no previous writes have been made to it that will cause
+		 * bits of interest to be cleared (i.e. clear register is
+		 * dirty).
+		 *
+		 * The dirty clear flag will never cause false negatives (i.e.
+		 * valid writes to be missed) since hardware cannot set any bits
+		 * in the clear register to 1 and will only clear the entire
+		 * register upon resetting the hardware.
+		 */
+		if (!(controller->irq_status_arr[i] & irq_register->aggr_mask)) {
+			if (!irq_register->dirty_clear)
+				continue;
+			else
+				irq_register->dirty_clear = false;
+		} else {
+			irq_register->dirty_clear = true;
+		}
+
+		CAM_DBG(CAM_IRQ_CTRL, "(%s) Write irq clear%d (0x%x) = 0x%x (dirty=%s)",
+			controller->name, i, controller->irq_register_arr[i].clear_reg_offset,
+			controller->irq_status_arr[i],
+			CAM_BOOL_TO_YESNO(irq_register->dirty_clear));
+
+		cam_io_w(controller->irq_status_arr[i],
+			controller->mem_base + irq_register->clear_reg_offset);
+	}
+
+	if (controller->global_irq_cmd_offset && !controller->delayed_global_clear) {
+		cam_io_w_mb(controller->global_clear_bitmask,
+			controller->mem_base + controller->global_irq_cmd_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "Global Clear done from %s",
+			controller->name);
+	}
+}
+
+static void __cam_irq_controller_sanitize_clear_registers(struct cam_irq_controller *controller)
+{
+	struct cam_irq_register_obj *irq_register;
+	int i;
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		if (!irq_register->dirty_clear)
+			continue;
+
+		irq_register->dirty_clear = false;
+
+		CAM_DBG(CAM_IRQ_CTRL, "(%s) Write irq clear%d (0x%x) = 0x%x (dirty=%s)",
+			controller->name, i, controller->irq_register_arr[i].clear_reg_offset,
+			0x0, CAM_BOOL_TO_YESNO(irq_register->dirty_clear));
+
+		cam_io_w(0x0, controller->mem_base + irq_register->clear_reg_offset);
+	}
+}
+
+static void cam_irq_controller_read_registers(struct cam_irq_controller *controller)
+{
+	struct cam_irq_register_obj *irq_register;
+	struct cam_irq_controller *dep_controller;
+	bool need_reg_read[CAM_IRQ_MAX_DEPENDENTS] = {false};
+	int i, j;
+
+	__cam_irq_controller_read_registers(controller);
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		for (j = 0; j < CAM_IRQ_MAX_DEPENDENTS; j++) {
+			if (irq_register->dependent_read_mask[j] & controller->irq_status_arr[i])
+				need_reg_read[j] = true;
+			CAM_DBG(CAM_IRQ_CTRL, "(%s) reg:%d dep:%d need_reg_read = %d",
+				controller->name, i, j, need_reg_read[j]);
+		}
+	}
+
+	for (j = 0; j < CAM_IRQ_MAX_DEPENDENTS; j++) {
+		dep_controller = controller->dependent_controller[j];
+		if (!dep_controller)
+			continue;
+
+		cam_irq_controller_lock(dep_controller);
+		if (need_reg_read[j]) {
+			CAM_DBG(CAM_IRQ_CTRL, "Reading dependent registers for %s",
+				dep_controller->name);
+			__cam_irq_controller_read_registers(dep_controller);
+		} else {
+			CAM_DBG(CAM_IRQ_CTRL, "Sanitize registers for %s",
+				dep_controller->name);
+			__cam_irq_controller_sanitize_clear_registers(dep_controller);
+		}
+		cam_irq_controller_unlock(dep_controller);
+	}
+
+	if (controller->global_irq_cmd_offset && controller->delayed_global_clear) {
+		cam_io_w_mb(controller->global_clear_bitmask,
+			controller->mem_base + controller->global_irq_cmd_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "Delayed Global Clear done from %s",
+			controller->name);
+	}
+}
+
+static void cam_irq_controller_process_th(struct cam_irq_controller *controller, int evt_grp)
+{
+	struct cam_irq_register_obj *irq_register;
+	bool need_th_processing[CAM_IRQ_PRIORITY_MAX] = {false};
+	int i, j;
+
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		for (j = 0; j < CAM_IRQ_PRIORITY_MAX; j++) {
+			if (irq_register->top_half_enable_mask[j] & controller->irq_status_arr[i])
+				need_th_processing[j] = true;
+			CAM_DBG(CAM_IRQ_CTRL, "reg:%d priority:%d need_th_processing = %d",
+				i, j, need_th_processing[j]);
+		}
+	}
+
+	for (i = 0; i < CAM_IRQ_PRIORITY_MAX; i++) {
+		if (need_th_processing[i]) {
+			CAM_DBG(CAM_IRQ_CTRL, "(%s) Invoke TH processing priority:%d",
+				controller->name, i);
+			__cam_irq_controller_th_processing(controller, &controller->th_list_head[i],
+				evt_grp);
+		}
+	}
+}
+
+irqreturn_t cam_irq_controller_handle_irq(int irq_num, void *priv, int evt_grp)
+{
+	struct cam_irq_controller *controller  = priv;
+
+	if (unlikely(!controller))
+		return IRQ_NONE;
+
+	CAM_DBG(CAM_IRQ_CTRL,
+		"Locking: %s IRQ Controller: [%pK], lock handle: %pK",
+		controller->name, controller, &controller->lock);
+	cam_irq_controller_lock(controller);
+
+	if (!controller->is_dependent)
+		cam_irq_controller_read_registers(controller);
+
+	cam_irq_controller_process_th(controller, evt_grp);
+
+	cam_irq_controller_unlock(controller);
+	CAM_DBG(CAM_IRQ_CTRL,
+		"Unlocked: %s IRQ Controller: %pK, lock handle: %pK",
+		controller->name, controller, &controller->lock);
+
+	return IRQ_HANDLED;
+}
+
+int cam_irq_controller_update_irq(void *irq_controller, uint32_t handle,
+	bool enable, uint32_t *irq_mask)
+{
+	struct cam_irq_controller   *controller  = irq_controller;
+	struct cam_irq_evt_handler  *evt_handler = NULL;
+	unsigned long               flags = 0;
+	unsigned int                i;
+	int                         rc = 0;
+
+	if (!controller)
+		return rc;
+
+	flags = cam_irq_controller_lock_irqsave(controller);
+
+	rc = cam_irq_controller_find_event_handle(controller, handle,
+		&evt_handler);
+	if (rc)
+		goto end;
+
+	__cam_irq_controller_disable_irq(controller, evt_handler);
+	for (i = 0; i < controller->num_registers; i++) {
+		if (enable) {
+			evt_handler->evt_bit_mask_arr[i] |= irq_mask[i];
+		} else {
+			evt_handler->evt_bit_mask_arr[i] &= ~irq_mask[i];
+		}
+	}
+	__cam_irq_controller_enable_irq(controller, evt_handler);
+	cam_irq_controller_clear_irq(controller, evt_handler);
+
+end:
+	cam_irq_controller_unlock_irqrestore(controller, flags);
+
+	return rc;
+}
+
+#ifdef CONFIG_CAM_TEST_IRQ_LINE
+
+struct cam_irq_line_test_priv {
+	char msg[256];
+	struct completion complete;
+};
+
+static int cam_irq_controller_test_irq_line_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	struct cam_irq_line_test_priv *test_priv;
+
+	if (!th_payload || !th_payload->handler_priv) {
+		CAM_ERR(CAM_IRQ_CTRL, "invalid payload");
+		return -EINVAL;
+	}
+
+	test_priv = th_payload->handler_priv;
+	complete(&test_priv->complete);
+	CAM_INFO(CAM_IRQ_CTRL, "%s IRQ line verified", test_priv->msg);
+
+	return 0;
+}
+
+
+int cam_irq_controller_test_irq_line(void *irq_controller, const char *fmt, ...)
+{
+	struct cam_irq_controller *controller = irq_controller;
+	struct cam_irq_register_obj *irq_reg;
+	struct cam_irq_line_test_priv *test_priv;
+	uint32_t *mask = NULL;
+	va_list args;
+	bool can_test = false;
+	int rc = 0, i, handle;
+
+	if (!irq_controller) {
+		CAM_ERR(CAM_IRQ_CTRL, "invalid argument");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_reg = &controller->irq_register_arr[i];
+		if (irq_reg->set_reg_offset != 0 && irq_reg->test_set_val != 0 &&
+			irq_reg->test_sub_val)
+			can_test = true;
+		CAM_DBG(CAM_IRQ_CTRL, "[%d] offset:0x%x val:0x%x can-test:%s",
+			i, irq_reg->set_reg_offset, irq_reg->test_set_val,
+			CAM_BOOL_TO_YESNO(can_test));
+	}
+
+	if (controller->global_irq_cmd_offset == 0 || controller->global_set_bitmask == 0)
+		can_test = false;
+
+	CAM_DBG(CAM_IRQ_CTRL, "global offset:0x%x mask:0x%x",
+			controller->global_irq_cmd_offset,
+			controller->global_set_bitmask);
+
+	if (!can_test) {
+		CAM_ERR(CAM_IRQ_CTRL, "%s not configured properly for testing",
+			controller->name);
+		return -EINVAL;
+	}
+
+	mask = kcalloc(controller->num_registers, sizeof(uint32_t), GFP_KERNEL);
+	if (!mask) {
+		CAM_ERR(CAM_IRQ_CTRL, "%s: cannot allocate mask array of length %d",
+			controller->name, controller->num_registers);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < controller->num_registers; i++)
+		mask[i] = controller->irq_register_arr[i].test_sub_val;
+
+	test_priv = kzalloc(sizeof(struct cam_irq_line_test_priv), GFP_KERNEL);
+	if (!test_priv) {
+		CAM_ERR(CAM_IRQ_CTRL, "%s: cannot allocate test-priv", controller->name);
+		rc = -ENOMEM;
+		goto kfree_exit;
+	}
+
+	va_start(args, fmt);
+	vscnprintf(test_priv->msg, 256, fmt, args);
+	va_end(args);
+
+	init_completion(&test_priv->complete);
+
+	handle = cam_irq_controller_subscribe_irq(controller, CAM_IRQ_PRIORITY_0,
+		mask, test_priv, cam_irq_controller_test_irq_line_top_half,
+		NULL, NULL, NULL, CAM_IRQ_EVT_GROUP_0);
+	if (handle < 0) {
+		CAM_ERR(CAM_IRQ_CTRL, "%s: failed to subscribe to test irq line",
+			controller->name);
+		rc = -EINVAL;
+		goto kfree_exit;
+	}
+
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_reg = &controller->irq_register_arr[i];
+		if (irq_reg->test_set_val && irq_reg->set_reg_offset) {
+			cam_io_w_mb(irq_reg->test_set_val,
+				controller->mem_base + irq_reg->set_reg_offset);
+			CAM_DBG(CAM_IRQ_CTRL, "%s[%d] offset:0x%08x val:0x%08x", controller->name,
+				i, irq_reg->set_reg_offset, irq_reg->test_set_val);
+		}
+	}
+
+	cam_io_w_mb(controller->global_set_bitmask,
+		controller->mem_base + controller->global_irq_cmd_offset);
+	CAM_DBG(CAM_IRQ_CTRL, "%s[SET-CMD] addr:0x%08x value:0x%08x", controller->name,
+		controller->mem_base + controller->global_irq_cmd_offset,
+		controller->global_set_bitmask);
+
+	if (!cam_common_wait_for_completion_timeout(&test_priv->complete,
+		msecs_to_jiffies(CAM_IRQ_LINE_TEST_TIMEOUT_MS))) {
+		CAM_ERR(CAM_IRQ_CTRL, "%s: IRQ line verification timed out", controller->name);
+		rc = -ETIMEDOUT;
+		goto unsub_exit;
+	}
+
+	CAM_DBG(CAM_IRQ_CTRL, "%s: verified IRQ line successfully", controller->name);
+
+unsub_exit:
+	cam_irq_controller_unsubscribe_irq(controller, handle);
+kfree_exit:
+	kfree(mask);
+	kfree(test_priv);
+	return rc;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.h
@@ -0,0 +1,379 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IRQ_CONTROLLER_H_
+#define _CAM_IRQ_CONTROLLER_H_
+
+#include <linux/interrupt.h>
+
+#define CAM_IRQ_BITS_PER_REGISTER      32
+
+/*
+ * enum cam_irq_priority_level:
+ * @Brief:                  Priority levels for IRQ events.
+ *                          Priority_0 events will be serviced before
+ *                          Priority_1 if they these bits are set in the same
+ *                          Status Read. And so on upto Priority_4.
+ *
+ *                          Default Priority is Priority_4.
+ */
+enum cam_irq_priority_level {
+	CAM_IRQ_PRIORITY_0,
+	CAM_IRQ_PRIORITY_1,
+	CAM_IRQ_PRIORITY_2,
+	CAM_IRQ_PRIORITY_3,
+	CAM_IRQ_PRIORITY_4,
+	CAM_IRQ_PRIORITY_MAX,
+};
+
+/**
+ * enum cam_irq_event_group:
+ * @brief: Event groups to filter out events while handling. Use group 0 as default.
+ */
+enum cam_irq_event_group {
+	CAM_IRQ_EVT_GROUP_0,
+	CAM_IRQ_EVT_GROUP_1,
+	CAM_IRQ_EVT_GROUP_2,
+};
+
+/*
+ * struct cam_irq_register_set:
+ * @Brief:                  Structure containing offsets of IRQ related
+ *                          registers belonging to a Set
+ *
+ * @mask_reg_offset:        Offset of IRQ MASK register
+ * @clear_reg_offset:       Offset of IRQ CLEAR register
+ * @status_reg_offset:      Offset of IRQ STATUS register
+ * @set_reg_offset:         Offset of IRQ SET register
+ * @test_set_val:           Value to write to IRQ SET register to trigger IRQ
+ * @test_sub_val:           Value to write to IRQ MASK register to receive test IRQ
+ */
+struct cam_irq_register_set {
+	uint32_t                       mask_reg_offset;
+	uint32_t                       clear_reg_offset;
+	uint32_t                       status_reg_offset;
+	uint32_t                       set_reg_offset;
+	uint32_t                       test_set_val;
+	uint32_t                       test_sub_val;
+};
+
+/*
+ * struct cam_irq_controller_reg_info:
+ * @Brief:                  Structure describing the IRQ registers
+ *
+ * @num_registers:          Number of sets(mask/clear/status) of IRQ registers
+ * @irq_reg_set:            Array of Register Set Offsets.
+ *                          Length of array = num_registers
+ * @global_irq_cmd_offset:  Offset of Global IRQ Clear register. This register
+ *                          contains the BIT that needs to be set for the CLEAR
+ *                          to take effect
+ * @global_clear_bitmask:   Bitmask needed to be used in Global Clear register
+ *                          for Clear IRQ cmd to take effect
+ * @global_set_bitmask:     Bitmask needed to be used in Global IRQ command register
+ *                          for Set IRQ cmd to take effect
+ * @clear_all_bitmask:      Bitmask that specifies which bits should be written
+ *                          to clear register when it is to be cleared forcefully
+ */
+struct cam_irq_controller_reg_info {
+	uint32_t                      num_registers;
+	struct cam_irq_register_set  *irq_reg_set;
+	uint32_t                      global_irq_cmd_offset;
+	uint32_t                      global_clear_bitmask;
+	uint32_t                      global_set_bitmask;
+	uint32_t                      clear_all_bitmask;
+};
+
+/*
+ * struct cam_irq_th_payload:
+ * @Brief:                  Event payload structure. This structure will be
+ *                          passed to the Top Half handler functions.
+ *
+ * @handler_priv:           Private Data of handling object set when
+ *                          subscribing to IRQ event.
+ * @num_registers:          Length of evt_bit_mask Array below
+ * @evt_status_arr:         Array of Status bitmask read from registers.
+ *                          Length of array = num_registers
+ * @evt_payload_priv:       Private payload pointer which can be set by Top
+ *                          Half handler for use in Bottom Half.
+ */
+struct cam_irq_th_payload {
+	void       *handler_priv;
+	uint32_t    num_registers;
+	uint32_t   *evt_status_arr;
+	void       *evt_payload_priv;
+};
+
+/*
+ * cam_irq_th_payload_init()
+ *
+ * @brief:              Initialize the top half payload structure
+ *
+ * @th_payload:         Top Half payload structure to Initialize
+ *
+ * @return:             Void
+ */
+static inline void cam_irq_th_payload_init(
+	struct cam_irq_th_payload *th_payload) {
+	th_payload->handler_priv = NULL;
+	th_payload->evt_payload_priv = NULL;
+}
+
+typedef int (*CAM_IRQ_HANDLER_TOP_HALF)(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload);
+
+typedef int (*CAM_IRQ_HANDLER_BOTTOM_HALF)(void *handler_priv,
+	void *evt_payload_priv);
+
+typedef void (*CAM_IRQ_BOTTOM_HALF_ENQUEUE_FUNC)(void *bottom_half,
+	void *bh_cmd, void *handler_priv, void *evt_payload_priv,
+	CAM_IRQ_HANDLER_BOTTOM_HALF);
+
+typedef int (*CAM_IRQ_GET_TASKLET_PAYLOAD_FUNC)(void *bottom_half,
+	void **bh_cmd);
+
+typedef void (*CAM_IRQ_PUT_TASKLET_PAYLOAD_FUNC)(void *bottom_half,
+	void **bh_cmd);
+
+struct cam_irq_bh_api {
+	CAM_IRQ_BOTTOM_HALF_ENQUEUE_FUNC bottom_half_enqueue_func;
+	CAM_IRQ_GET_TASKLET_PAYLOAD_FUNC get_bh_payload_func;
+	CAM_IRQ_PUT_TASKLET_PAYLOAD_FUNC put_bh_payload_func;
+};
+
+/*
+ * cam_irq_controller_init()
+ *
+ * @brief:              Create and Initialize IRQ Controller.
+ *
+ * @name:               Name of IRQ Controller block
+ * @mem_base:           Mapped base address of register space to which
+ *                      register offsets are added to access registers
+ * @register_info:      Register Info structure associated with this Controller
+ * @irq_controller:     Pointer to IRQ Controller that will be filled if
+ *                      initialization is successful
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_irq_controller_init(const char       *name,
+	void __iomem                         *mem_base,
+	struct cam_irq_controller_reg_info   *register_info,
+	void                                **irq_controller);
+
+/*
+ * cam_irq_controller_subscribe_irq()
+ *
+ * @brief:               Subscribe to certain IRQ events.
+ *
+ * @irq_controller:      Pointer to IRQ Controller that controls this event IRQ
+ * @priority:            Priority level of these events used if multiple events
+ *                       are SET in the Status Register
+ * @evt_bit_mask_arr:    evt_bit_mask that has the bits set for IRQs to
+ *                       subscribe for
+ * @handler_priv:        Private data that will be passed to the Top/Bottom Half
+ *                       handler function
+ * @top_half_handler:    Top half Handler callback function
+ * @bottom_half_handler: Bottom half Handler callback function
+ * @bottom_half:         Pointer to bottom_half implementation on which to
+ *                       enqueue the event for further handling
+ * @bottom_half_enqueue_func:
+ *                       Function used to enqueue the bottom_half event
+ * @evt_grp:             Event group to which this event must belong to (use group 0 as default)
+ *
+ * @return:              Positive: Success. Value represents handle which is
+ *                                 to be used to unsubscribe
+ *                       Negative: Failure
+ */
+int cam_irq_controller_subscribe_irq(void *irq_controller,
+	enum cam_irq_priority_level        priority,
+	uint32_t                          *evt_bit_mask_arr,
+	void                              *handler_priv,
+	CAM_IRQ_HANDLER_TOP_HALF           top_half_handler,
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler,
+	void                              *bottom_half,
+	struct cam_irq_bh_api             *irq_bh_api,
+	enum cam_irq_event_group           evt_grp);
+
+/*
+ * cam_irq_controller_unsubscribe_irq()
+ *
+ * @brief:               Unsubscribe to IRQ events previously subscribed to.
+ *                       Masks out the correspondings events from source
+ *
+ * @irq_controller:      Pointer to IRQ Controller that controls this event IRQ
+ * @handle:              Handle returned on successful subscribe used to
+ *                       identify the handler object
+ *
+ * @return:              0: Success
+ *                       Negative: Failure
+ */
+int cam_irq_controller_unsubscribe_irq(void *irq_controller,
+	uint32_t handle);
+
+/*
+ * cam_irq_controller_unsubscribe_irq_evt()
+ *
+ * @brief:               Unsubscribe to IRQ event payloads previously subscribed to
+ *
+ * @irq_controller:      Pointer to IRQ Controller that controls this event IRQ
+ * @handle:              Handle returned on successful subscribe used to
+ *                       identify the handler object
+ *
+ * @return:              0: Success
+ *                       Negative: Failure
+ */
+int cam_irq_controller_unsubscribe_irq_evt(void *irq_controller,
+	uint32_t handle);
+
+/*
+ * cam_irq_controller_deinit()
+ *
+ * @brief:              Deinitialize IRQ Controller.
+ *
+ * @irq_controller:     Pointer to IRQ Controller that needs to be
+ *                      deinitialized
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_irq_controller_deinit(void **irq_controller);
+
+/*
+ * cam_irq_controller_handle_irq()
+ *
+ * @brief:              Function that should be registered with the IRQ line.
+ *                      This is the first function to be called when the IRQ
+ *                      is fired. It will read the Status register and Clear
+ *                      the IRQ bits. It will then call the top_half handlers
+ *                      and enqueue the result to bottom_half.
+ *
+ * @irq_num:            Number of IRQ line that was set that lead to this
+ *                      function being called
+ * @priv:               Private data registered with request_irq is passed back
+ *                      here. This private data should be the irq_controller
+ *                      structure.
+ *
+ * @return:             IRQ_HANDLED/IRQ_NONE
+ */
+irqreturn_t cam_irq_controller_handle_irq(int irq_num, void *priv, int evt_grp);
+
+/*
+ * cam_irq_controller_disable_irq()
+ *
+ * @brief:              Disable the interrupts on given controller.
+ *                      Unsubscribe will disable the IRQ by default, so this is
+ *                      only needed if between subscribe/unsubscribe there is
+ *                      need to disable IRQ again
+ *
+ * @irq_controller:     Pointer to IRQ Controller that controls the registered
+ *                      events to it.
+ * @handle:             Handle returned on successful subscribe, used to
+ *                      identify the handler object
+ *
+ * @return:             0: events found and disabled
+ *                      Negative: events not registered on this controller
+ */
+int cam_irq_controller_disable_irq(void *irq_controller, uint32_t handle);
+
+/*
+ * cam_irq_controller_enable_irq()
+ *
+ * @brief:              Enable the interrupts on given controller.
+ *                      Subscribe will enable the IRQ by default, so this is
+ *                      only needed if between subscribe/unsubscribe there is
+ *                      need to enable IRQ again
+ *
+ * @irq_controller:     Pointer to IRQ Controller that controls the registered
+ *                      events to it.
+ * @handle:             Handle returned on successful subscribe, used to
+ *                      identify the handler object
+ *
+ * @return:             0: events found and enabled
+ *                      Negative: events not registered on this controller
+ */
+int cam_irq_controller_enable_irq(void *irq_controller, uint32_t handle);
+
+/*
+ * cam_irq_controller_disable_all()
+ *
+ * @brief:              This function clears and masks all the irq bits
+ *
+ * @priv:               Private data registered with request_irq is passed back
+ *                      here. This private data should be the irq_controller
+ *                      structure.
+ */
+void cam_irq_controller_disable_all(void *priv);
+
+/*
+ * cam_irq_controller_update_irq()
+ *
+ * @brief:              Enable/Disable the interrupts on given controller.
+ *                      Dynamically any irq can be disabled or enabled.
+ *
+ * @irq_controller:     Pointer to IRQ Controller that controls the registered
+ *                      events to it.
+ * @handle:             Handle returned on successful subscribe, used to
+ *                      identify the handler object
+ *
+ * @enable:             Flag to indicate if disable or enable the irq.
+ *
+ * @irq_mask:           IRQ mask to be enabled or disabled.
+ *
+ * @return:             0: events found and enabled
+ *                      Negative: events not registered on this controller
+ */
+int cam_irq_controller_update_irq(void *irq_controller, uint32_t handle,
+	bool enable, uint32_t *irq_mask);
+
+/**
+ * cam_irq_controller_register_dependent
+ * @brief:                 Register one IRQ controller as dependent for another IRQ controller
+ *
+ * @primary_controller:    Controller whose top half will invoke handle_irq function of secondary
+ *                         controller
+ * @secondary_controller:  Controller whose handle_irq function that will be invoked from primary
+ *                         controller
+ *
+ * @return:                0: successfully registered
+ *                         Negative: failed to register as dependent
+ */
+int cam_irq_controller_register_dependent(void *primary_controller, void *secondary_controller,
+	uint32_t *mask);
+
+/**
+ * cam_irq_controller_unregister_dependent
+ * @brief:                 Unregister previously registered dependent IRQ controller
+ *
+ * @primary_controller:    Controller whose top half will invoke handle_irq function of secondary
+ *                         controller
+ * @secondary_controller:  Controller whose handle_irq function that will be invoked from primary
+ *                         controller
+ *
+ * @return:                0: successfully unregistered
+ *                         Negative: failed to unregister dependent
+ */
+int cam_irq_controller_unregister_dependent(void *primary_controller, void *secondary_controller);
+
+/**
+ * cam_irq_controller_test_irq_line()
+ * @brief: Test IRQ line corresponding to IRQ controller
+ *
+ * @irq_controller: IRQ controller under test
+ * @fmt:            Format of the debug message to be printed
+ * @args:           Arguments for the format specifiers corresponding to @fmt
+ *
+ * @return:         0: success, negative: failure
+ */
+#ifdef CONFIG_CAM_TEST_IRQ_LINE
+int cam_irq_controller_test_irq_line(void *irq_controller, const char *fmt, ...);
+#else
+static inline int cam_irq_controller_test_irq_line(void *irq_controller, const char *fmt, ...)
+{
+	return -EPERM;
+}
+#endif
+
+#endif /* _CAM_IRQ_CONTROLLER_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/include/cam_isp_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/include/cam_isp_hw_mgr_intf.h
@@ -0,0 +1,625 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_HW_MGR_INTF_H_
+#define _CAM_ISP_HW_MGR_INTF_H_
+
+#include <linux/of.h>
+#include <linux/time.h>
+#include <linux/list.h>
+#include <media/cam_isp.h>
+#include "cam_hw_mgr_intf.h"
+#include "cam_packet_util.h"
+#include "cam_cpas_api.h"
+
+/* MAX IFE instance */
+#define CAM_IFE_HW_NUM_MAX               8
+#define CAM_SFE_HW_NUM_MAX               3
+#define CAM_IFE_RDI_NUM_MAX              4
+#define CAM_SFE_RDI_NUM_MAX              5
+#define CAM_SFE_FE_RDI_NUM_MAX           3
+#define CAM_ISP_BW_CONFIG_V1             1
+#define CAM_ISP_BW_CONFIG_V2             2
+#define CAM_ISP_BW_CONFIG_V3             3
+#define CAM_TFE_HW_NUM_MAX               4
+#define CAM_TFE_RDI_NUM_MAX              3
+#define CAM_IFE_SCRATCH_NUM_MAX          2
+#define CAM_IFE_BUS_COMP_NUM_MAX         18
+#define CAM_SFE_BUS_COMP_NUM_MAX         12
+#define CAM_TFE_BW_LIMITER_CONFIG_V1     1
+#define CAM_TFE_BUS_COMP_NUM_MAX         18
+
+/* maximum context numbers for TFE */
+#define CAM_TFE_CTX_MAX      6
+
+/* maximum context numbers for IFE */
+#define CAM_IFE_CTX_MAX      8
+
+/* Appliacble vote paths for dual ife, based on no. of UAPI definitions */
+#define CAM_ISP_MAX_PER_PATH_VOTES 40
+
+/* Output params for acquire from hw_mgr to ctx */
+#define CAM_IFE_CTX_CUSTOM_EN          BIT(0)
+#define CAM_IFE_CTX_FRAME_HEADER_EN    BIT(1)
+#define CAM_IFE_CTX_CONSUME_ADDR_EN    BIT(2)
+#define CAM_IFE_CTX_APPLY_DEFAULT_CFG  BIT(3)
+#define CAM_IFE_CTX_SFE_EN             BIT(4)
+#define CAM_IFE_CTX_AEB_EN             BIT(5)
+#define CAM_IFE_CTX_DYNAMIC_SWITCH_EN  BIT(6)
+#define CAM_IFE_CTX_SHDR_EN            BIT(7)
+#define CAM_IFE_CTX_SHDR_IS_MASTER     BIT(8)
+
+/*
+ * Maximum configuration entry size  - This is based on the
+ * worst case DUAL IFE use case plus some margin.
+ */
+#define CAM_ISP_CTX_CFG_MAX                     30
+
+/*
+ * Maximum configuration entry size including SFE & CSID - This is based on the
+ * worst case DUAL IFE/SFE use case plus some margin.
+ */
+#define CAM_ISP_SFE_CTX_CFG_MAX                 40
+
+/* Maximum number of channels/contexts for FCG modules */
+#define CAM_ISP_MAX_FCG_CH_CTXS        3
+#define CAM_ISP_IFE_MAX_FCG_CH_CTXS    3
+#define CAM_ISP_SFE_MAX_FCG_CHANNELS   2
+
+/* Maximum number of predicitons for FCG config */
+#define CAM_ISP_MAX_FCG_PREDICTIONS       3
+#define CAM_ISP_IFE_MAX_FCG_PREDICTIONS   CAM_ISP_MAX_FCG_PREDICTIONS
+#define CAM_ISP_SFE_MAX_FCG_PREDICTIONS   CAM_ISP_MAX_FCG_PREDICTIONS
+
+/* ctx get virtual rdi mapping callback function type */
+typedef int (*cam_hw_get_virtual_rdi_mapping_cb_func)(void *context,
+	uint32_t out_port, bool is_virtual_rdi);
+/**
+ *  enum cam_isp_hw_event_type - Collection of the ISP hardware events
+ */
+enum cam_isp_hw_event_type {
+	CAM_ISP_HW_EVENT_ERROR,
+	CAM_ISP_HW_EVENT_SOF,
+	CAM_ISP_HW_EVENT_REG_UPDATE,
+	CAM_ISP_HW_EVENT_EPOCH,
+	CAM_ISP_HW_EVENT_EOF,
+	CAM_ISP_HW_EVENT_DONE,
+	CAM_ISP_HW_SECONDARY_EVENT,
+	CAM_ISP_HW_EVENT_MAX
+};
+
+/**
+ * cam_isp_hw_evt_type_to_string() - convert cam_isp_hw_event_type to string for printing logs
+ */
+static inline const char *cam_isp_hw_evt_type_to_string(
+	enum cam_isp_hw_event_type evt_type)
+{
+	switch (evt_type) {
+	case CAM_ISP_HW_EVENT_ERROR:
+		return "ERROR";
+	case CAM_ISP_HW_EVENT_SOF:
+		return "SOF";
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		return "REG_UPDATE";
+	case CAM_ISP_HW_EVENT_EPOCH:
+		return "EPOCH";
+	case CAM_ISP_HW_EVENT_EOF:
+		return "EOF";
+	case CAM_ISP_HW_EVENT_DONE:
+		return "BUF_DONE";
+	default:
+		return "INVALID_EVT";
+	}
+}
+
+/**
+ *  enum cam_isp_hw_secondary-event_type - Collection of the ISP hardware secondary events
+ */
+enum cam_isp_hw_secondary_event_type {
+	CAM_ISP_HW_SEC_EVENT_SOF,
+	CAM_ISP_HW_SEC_EVENT_EPOCH,
+	CAM_ISP_HW_SEC_EVENT_OUT_OF_SYNC_FRAME_DROP,
+	CAM_ISP_HW_SEC_EVENT_EVENT_MAX,
+};
+
+/**
+ * enum cam_isp_hw_err_type - Collection of the ISP error types for
+ *                         ISP hardware event CAM_ISP_HW_EVENT_ERROR
+ */
+enum cam_isp_hw_err_type {
+	CAM_ISP_HW_ERROR_NONE                         = 0x00000001,
+	CAM_ISP_HW_ERROR_OVERFLOW                     = 0x00000002,
+	CAM_ISP_HW_ERROR_P2I_ERROR                    = 0x00000004,
+	CAM_ISP_HW_ERROR_VIOLATION                    = 0x00000008,
+	CAM_ISP_HW_ERROR_BUSIF_OVERFLOW               = 0x00000010,
+	CAM_ISP_HW_ERROR_CSID_FATAL                   = 0x00000020,
+	CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW    = 0x00000040,
+	CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW            = 0x00000080,
+	CAM_ISP_HW_ERROR_CSID_FRAME_SIZE              = 0x00000100,
+	CAM_ISP_HW_ERROR_CSID_LANE_FIFO_OVERFLOW      = 0x00000200,
+	CAM_ISP_HW_ERROR_CSID_PKT_HDR_CORRUPTED       = 0x00000400,
+	CAM_ISP_HW_ERROR_CSID_MISSING_PKT_HDR_DATA    = 0x00000800,
+	CAM_ISP_HW_ERROR_CSID_SENSOR_SWITCH_ERROR     = 0x00001000,
+	CAM_ISP_HW_ERROR_CSID_UNBOUNDED_FRAME         = 0x00002000,
+	CAM_ISP_HW_ERROR_CSID_SENSOR_FRAME_DROP       = 0x00004000,
+	CAM_ISP_HW_ERROR_CSID_MISSING_EOT             = 0x00008000,
+	CAM_ISP_HW_ERROR_CSID_PKT_PAYLOAD_CORRUPTED   = 0x00010000,
+	CAM_ISP_HW_ERROR_CSID_CAMIF_FRAME_DROP        = 0x00020000,
+	CAM_ISP_HW_ERROR_HWPD_VIOLATION               = 0x00040000,
+};
+
+/**
+ *  enum cam_isp_hw_stop_cmd - Specify the stop command type
+ */
+enum cam_isp_hw_stop_cmd {
+	CAM_ISP_HW_STOP_AT_FRAME_BOUNDARY,
+	CAM_ISP_HW_STOP_IMMEDIATELY,
+	CAM_ISP_HW_STOP_MAX,
+};
+
+/**
+ * struct cam_isp_stop_args - hardware stop arguments
+ *
+ * @hw_stop_cmd:               Hardware stop command type information
+ * @is_internal_stop:          Stop triggered internally for reset & recovery
+ * @stop_only:                 Send stop only to hw drivers. No Deinit to be
+ *                             done.
+ *
+ */
+struct cam_isp_stop_args {
+	enum cam_isp_hw_stop_cmd      hw_stop_cmd;
+	bool                          is_internal_stop;
+	bool                          stop_only;
+};
+
+/**
+ * struct cam_isp_clock_config_internal - Clock configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_rdi:                    Number of RDI votes
+ * @left_pix_hz:                Pixel Clock for Left ISP
+ * @right_pix_hz:               Pixel Clock for Right ISP, valid only if Dual
+ * @rdi_hz:                     RDI Clock. ISP clock will be max of RDI and
+ *                              PIX clocks. For a particular context which ISP
+ *                              HW the RDI is allocated to is not known to UMD.
+ *                              Hence pass the clock and let KMD decide.
+ */
+struct cam_isp_clock_config_internal {
+	uint64_t                       usage_type;
+	uint64_t                       num_rdi;
+	uint64_t                       left_pix_hz;
+	uint64_t                       right_pix_hz;
+	uint64_t                       rdi_hz[CAM_IFE_RDI_NUM_MAX];
+};
+
+/**
+ * struct cam_isp_bw_config_internal_v2 - Bandwidth configuration
+ *
+ * @usage_type:                 ife hw index
+ * @num_paths:                  Number of data paths
+ * @axi_path:                   per path vote info
+ */
+struct cam_isp_bw_config_internal_v2 {
+	uint32_t                               usage_type;
+	uint32_t                               num_paths;
+	struct cam_cpas_axi_per_path_bw_vote   axi_path[CAM_ISP_MAX_PER_PATH_VOTES];
+};
+
+/**
+ * struct cam_isp_bw_config_internal - Internal Bandwidth configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_rdi:                    Number of RDI votes
+ * @left_pix_vote:              Bandwidth vote for left ISP
+ * @right_pix_vote:             Bandwidth vote for right ISP
+ * @rdi_vote:                   RDI bandwidth requirements
+ */
+struct cam_isp_bw_config_internal {
+	uint32_t                       usage_type;
+	uint32_t                       num_rdi;
+	struct cam_isp_bw_vote         left_pix_vote;
+	struct cam_isp_bw_vote         right_pix_vote;
+	struct cam_isp_bw_vote         rdi_vote[CAM_IFE_RDI_NUM_MAX];
+};
+
+/**
+ * struct cam_isp_bw_clk_config_info - Bw/Clk config info
+ *
+ * @bw_config  :            BW vote info for current request V1
+ * @bw_config_v2:           BW vote info for current request V2
+ * @bw_config_valid:        Flag indicating if BW vote is valid for current request
+ * @ife_clock_config:       Clock config information for ife
+ * @ife_clock_config_valid: Flag indicating whether clock config is valid for
+ *                          current request for ife
+ * @sfe_clock_config:       Clock config information for sfe
+ * @sfe_clock_config_valid: Flag indicating whether clock config is valid for
+ *                          current request for sfe
+ */
+struct cam_isp_bw_clk_config_info {
+	struct cam_isp_bw_config_internal     bw_config;
+	struct cam_isp_bw_config_internal_v2  bw_config_v2;
+	bool                                  bw_config_valid;
+	struct cam_isp_clock_config_internal  ife_clock_config;
+	bool                                  ife_clock_config_valid;
+	struct cam_isp_clock_config_internal  sfe_clock_config;
+	bool                                  sfe_clock_config_valid;
+
+};
+
+/**
+ * struct cam_isp_predict_fcg_config_internal - Internal FCG config in a single prediction
+ *
+ * @phase_index_g:              Starting index of LUT for G channel in phase
+ * @phase_index_r:              Starting index of LUT for R channel in phase
+ * @phase_index_b:              Starting index of LUT for B channel in phase
+ * @stats_index_g:              Starting index of LUT for G channel in stats
+ * @stats_index_r:              Starting index of LUT for R channel in stats
+ * @stats_index_b:              Starting index of LUT for B channel in stats
+ */
+struct cam_isp_predict_fcg_config_internal {
+	uint32_t                                phase_index_g;
+	uint32_t                                phase_index_r;
+	uint32_t                                phase_index_b;
+	uint32_t                                stats_index_g;
+	uint32_t                                stats_index_r;
+	uint32_t                                stats_index_b;
+};
+
+/**
+ * struct cam_isp_ch_ctx_fcg_config_internal - Internal FCG config in a single channel or context
+ *
+ * @fcg_ch_ctx_id:              Index of the channel in SFE/IFE or context in TFE
+ *                              to be configured that FCG blocks reside on.
+ *                              For example, if one wants to config FCG block
+ *                              for IFE in ctx 0, this value will be CAM_ISP_FCG_MASK_CH0
+ * @fcg_enable_mask:            Indicate which module will be enabled for
+ *                              FCG. For example, if one wants to config
+ *                              SFE FCG STATS module, CAM_ISP_FCG_ENABLE_STATS
+ *                              will be set in mask
+ * @predicted_fcg_configs:      FCG config for each prediction of the channel
+ *                              in serial order
+ */
+struct cam_isp_ch_ctx_fcg_config_internal {
+	uint32_t                                      fcg_ch_ctx_id;
+	uint32_t                                      fcg_enable_mask;
+	struct cam_isp_predict_fcg_config_internal    predicted_fcg_configs[
+							CAM_ISP_MAX_FCG_PREDICTIONS];
+};
+
+/**
+ * struct cam_isp_fcg_config_internal - Internal FCG config for a frame
+ *
+ * @num_ch_ctx:                 Number of channels for FCG config for SFE/IFE or
+ *                              number of contexts for FCG config for TFE
+ * @num_predictions:            Number of predictions for each channel
+ * @num_types:                  Number of types(STATS/PHASE) for FCG config
+ * @ch_ctx_fcg_configs:         FCG config for each channel or context
+ */
+struct cam_isp_fcg_config_internal {
+	uint32_t                                      num_ch_ctx;
+	uint32_t                                      num_predictions;
+	uint32_t                                      num_types;
+	struct cam_isp_ch_ctx_fcg_config_internal     ch_ctx_fcg_configs[
+							CAM_ISP_MAX_FCG_CH_CTXS];
+};
+
+/**
+ * struct cam_isp_fcg_config_info - Track FCG config for further usage in config stage
+ *
+ * @prediction_idx:            Indicate which exact prediction to be used, decided
+ *                             during trying to apply the request
+ * @sfe_fcg_entry_idx:         Index for SFE FCG config in hw update entries
+ * @sfe_fcg_config:            Internal storage of SFE FCG configurations
+ * @ife_fcg_entry_idx:         Index for IFE/MC_TFE FCG config in hw update entries
+ * @ife_fcg_config:            Internal storage of IFE/MC_TFE FCG configurations
+ * @use_current_cfg:           Indicate whether use current configuration or replace
+ *                             the value with FCG predicted ones.
+ * @sfe_fcg_online:            Indicate whether SFE FCG handling is online or not
+ * @ife_fcg_online:            Indicate whether IFE/MC_TFE FCG handling is online or not
+ */
+struct cam_isp_fcg_config_info {
+	uint32_t                                 prediction_idx;
+	uint32_t                                 sfe_fcg_entry_idx;
+	struct cam_isp_fcg_config_internal       sfe_fcg_config;
+	uint32_t                                 ife_fcg_entry_idx;
+	struct cam_isp_fcg_config_internal       ife_fcg_config;
+	bool                                     use_current_cfg;
+	bool                                     sfe_fcg_online;
+	bool                                     ife_fcg_online;
+};
+
+/**
+ * struct cam_isp_prepare_hw_update_data - hw prepare data
+ *
+ * @isp_mgr_ctx:            ISP HW manager Context for current request
+ * @packet_opcode_type:     Packet header opcode in the packet header
+ *                          this opcode defines, packet is init packet or
+ *                          update packet
+ * @frame_header_cpu_addr:  Frame header cpu addr
+ * @frame_header_iova:      Frame header iova
+ * @frame_header_res_id:    Out port res_id corresponding to frame header
+ * @bw_clk_config:          BW and clock config info
+ * @isp_drv_config:         DRV config info
+ * @bw_config_valid:        Flag indicating if DRV config is valid for current request
+ * @isp_irq_comp_cfg:       IRQ comp configuration for MC-based TFEs
+ * @irq_comp_cfg_valid:     Flag indicating if IRQ comp cfg is valid for current request
+ * @reg_dump_buf_desc:     cmd buffer descriptors for reg dump
+ * @num_reg_dump_buf:      Count of descriptors in reg_dump_buf_desc
+ * @packet:                CSL packet from user mode driver
+ * @mup_val:               MUP value if configured
+ * @num_exp:               Num of exposures
+ * @wm_bitmask:            Bitmask of acquired out resource
+ * @mup_en:                Flag if dynamic sensor switch is enabled
+ * @fcg_info:              Track FCG config for further usage in config stage
+ * @virtual_rdi_mapping_cb:  virtual rdi mapping cb function for
+ *                           respective sensor via ife_ctx
+ * @per_port_enable:         Indicates if perport feature is enabled or not
+ *
+ */
+struct cam_isp_prepare_hw_update_data {
+	void                                 *isp_mgr_ctx;
+	uint32_t                              packet_opcode_type;
+	uint32_t                             *frame_header_cpu_addr;
+	uint64_t                              frame_header_iova;
+	uint32_t                              frame_header_res_id;
+	struct cam_isp_bw_clk_config_info     bw_clk_config;
+	struct cam_isp_drv_config             isp_drv_config;
+	bool                                  drv_config_valid;
+	struct cam_isp_irq_comp_cfg           isp_irq_comp_cfg;
+	bool                                  irq_comp_cfg_valid;
+	struct cam_cmd_buf_desc               reg_dump_buf_desc[
+						CAM_REG_DUMP_MAX_BUF_ENTRIES];
+	uint32_t                              num_reg_dump_buf;
+	struct cam_packet                    *packet;
+	struct cam_kmd_buf_info               kmd_cmd_buff_info;
+	uint32_t                              mup_val;
+	uint32_t                              num_exp;
+	uint64_t                              wm_bitmask;
+	bool                                  mup_en;
+	struct cam_isp_fcg_config_info        fcg_info;
+	cam_hw_get_virtual_rdi_mapping_cb_func virtual_rdi_mapping_cb;
+	bool                                  per_port_enable;
+};
+
+
+/**
+ * struct cam_isp_hw_sof_event_data - Event payload for CAM_HW_EVENT_SOF
+ *
+ * @timestamp           : Time stamp for the sof event
+ * @boot_time           : Boot time stamp for the sof event
+ *
+ */
+struct cam_isp_hw_sof_event_data {
+	uint64_t       timestamp;
+	uint64_t       boot_time;
+};
+
+/**
+ * struct cam_isp_hw_reg_update_event_data - Event payload for
+ *                         CAM_HW_EVENT_REG_UPDATE
+ *
+ * @timestamp:     Time stamp for the reg update event
+ *
+ */
+struct cam_isp_hw_reg_update_event_data {
+	uint64_t       timestamp;
+};
+
+/**
+ * struct cam_isp_hw_epoch_event_data - Event payload for CAM_HW_EVENT_EPOCH
+ *
+ * @timestamp:     Time stamp for the epoch event
+ * @frame_id_meta: Frame id value corresponding to this frame
+ */
+struct cam_isp_hw_epoch_event_data {
+	uint64_t       timestamp;
+	uint32_t       frame_id_meta;
+};
+
+/**
+ * struct cam_isp_hw_done_event_data - Event payload for CAM_HW_EVENT_DONE
+ *
+ * @hw_type:             Hw type sending the event
+ * @resource_handle:     Resource handle
+ * @comp_group_id:       Bus comp group id
+ * @last_consumed_addr:  Last consumed addr
+ * @timestamp:           Timestamp for the buf done event
+ *
+ */
+struct cam_isp_hw_done_event_data {
+	uint32_t             hw_type;
+	uint32_t             resource_handle;
+	uint32_t             comp_group_id;
+	uint32_t             last_consumed_addr;
+	uint64_t             timestamp;
+};
+
+/**
+ * struct cam_isp_hw_eof_event_data - Event payload for CAM_HW_EVENT_EOF
+ *
+ * @timestamp:             Timestamp for the eof event
+ *
+ */
+struct cam_isp_hw_eof_event_data {
+	uint64_t       timestamp;
+};
+
+/**
+ * struct cam_isp_hw_error_event_data - Event payload for CAM_HW_EVENT_ERROR
+ *
+ * @error_type:            HW error type for the error event
+ * @timestamp:             Timestamp for the error event
+ * @recovery_enabled:      Identifies if the context needs to recover & reapply
+ *                         this request
+ * @enable_req_dump:       Enable request dump on HW errors
+ * @try_internal_recovery: Enable internal recovery on HW errors
+ */
+struct cam_isp_hw_error_event_data {
+	uint32_t             error_type;
+	uint64_t             timestamp;
+	bool                 recovery_enabled;
+	bool                 enable_req_dump;
+	bool                 try_internal_recovery;
+};
+
+/**
+ * struct cam_isp_hw_secondary_event_data - Event payload for secondary events
+ *
+ * @evt_type     : Event notified as secondary
+ *
+ */
+struct cam_isp_hw_secondary_event_data {
+	enum cam_isp_hw_secondary_event_type  evt_type;
+};
+
+/* enum cam_isp_hw_mgr_command - Hardware manager command type */
+enum cam_isp_hw_mgr_command {
+	CAM_ISP_HW_MGR_CMD_IS_RDI_ONLY_CONTEXT,
+	CAM_ISP_HW_MGR_CMD_PAUSE_HW,
+	CAM_ISP_HW_MGR_CMD_RESUME_HW,
+	CAM_ISP_HW_MGR_CMD_SOF_DEBUG,
+	CAM_ISP_HW_MGR_CMD_CTX_TYPE,
+	CAM_ISP_HW_MGR_GET_PACKET_OPCODE,
+	CAM_ISP_HW_MGR_GET_LAST_CDM_DONE,
+	CAM_ISP_HW_MGR_CMD_PROG_DEFAULT_CFG,
+	CAM_ISP_HW_MGR_GET_SOF_TS,
+	CAM_ISP_HW_MGR_DUMP_STREAM_INFO,
+	CAM_ISP_HW_MGR_GET_BUS_COMP_GROUP,
+	CAM_ISP_HW_MGR_CMD_UPDATE_CLOCK,
+	CAM_ISP_HW_MGR_GET_LAST_CONSUMED_ADDR,
+	CAM_ISP_HW_MGR_CMD_CHECK_START_OFFLINE,
+	CAM_ISP_HW_MGR_CMD_FLUSH_OFFLINE,
+	CAM_ISP_HW_MGR_GET_ACTIVE_HW_CTX_CNT,
+	CAM_ISP_HW_MGR_UPDATE_FLUSH_IN_PROGRESS,
+	CAM_ISP_HW_MGR_GET_HW_CTX,
+	CAM_ISP_HW_MGR_CMD_MAX,
+};
+
+enum cam_isp_ctx_type {
+	CAM_ISP_CTX_FS2 = 1,
+	CAM_ISP_CTX_RDI,
+	CAM_ISP_CTX_PIX,
+	CAM_ISP_CTX_OFFLINE,
+	CAM_ISP_CTX_MAX,
+};
+/**
+ * struct cam_isp_hw_cmd_args - Payload for hw manager command
+ *
+ * @cmd_type:              HW command type
+ * @cmd_data:              Command data
+ * @sof_irq_enable:        To debug if SOF irq is enabled
+ * @ctx_type:              RDI_ONLY, PIX and RDI, or FS2
+ * @packet_op_code:        Packet opcode
+ * @last_cdm_done:         Last cdm done request
+ * @sof_ts:                SOF timestamps (current, boot and previous)
+ * @cdm_done_ts:           CDM callback done timestamp
+ * @hw_ctx_cnt:            count of active ife ctxs
+ * @stream_grp_cfg_index:  index of sensor group stream configuration
+ * @acquire_type:          indicates whether it is  virtual/hybrid/real acquire
+ * @sensor_id:             unique sensor id
+ * @out_port_id:           out resource id
+ * @ptr:                   void pointer out param
+ */
+struct cam_isp_hw_cmd_args {
+	uint32_t                          cmd_type;
+	void                             *cmd_data;
+	union {
+		uint32_t                         sof_irq_enable;
+		uint32_t                         ctx_type;
+		uint64_t                         last_cdm_done;
+		int64_t                          req_id;
+		struct {
+			uint32_t                     packet_op_code;
+			uint32_t                     hw_mgr_ctx_id;
+		}packet_info;
+		struct {
+			uint64_t                      curr;
+			uint64_t                      prev;
+			uint64_t                      boot;
+		} sof_ts;
+		struct {
+			uint32_t                  hw_ctx_cnt;
+			int                       stream_grp_cfg_index;
+		} active_hw_ctx;
+		uint32_t                      out_port_id;
+		void                         *ptr;
+	} u;
+	struct timespec64 cdm_done_ts;
+};
+
+/**
+ * struct cam_isp_hw_active_hw_ctx
+ *
+ * @index:                 index of active hw ctx
+ * @stream_grp_cfg_index:  sensor group configuration index
+ *
+ */
+struct cam_isp_hw_active_hw_ctx {
+	int         index;
+	int         stream_grp_cfg_index;
+};
+
+/**
+ * struct cam_isp_start_args - isp hardware start arguments
+ *
+ * @config_args:               Hardware configuration commands.
+ * @is_internal_start:         Start triggered internally for reset & recovery
+ * @start_only                 Send start only to hw drivers. No init to
+ *                             be done.
+ *
+ */
+struct cam_isp_start_args {
+	struct cam_hw_config_args hw_config;
+	bool                      is_internal_start;
+	bool                      start_only;
+};
+
+/**
+ * struct cam_isp_lcr_rdi_cfg_args - isp hardware start arguments
+ *
+ * @rdi_lcr_cfg:            RDI LCR cfg received from User space.
+ * @ife_src_res_id:         IFE SRC res id to be used in sfe context
+ * @is_init:                Flag to indicate if init packet.
+ *
+ */
+struct cam_isp_lcr_rdi_cfg_args {
+	struct cam_isp_lcr_rdi_config *rdi_lcr_cfg;
+	uint32_t                       ife_src_res_id;
+	bool                           is_init;
+};
+
+
+/**
+ * struct cam_isp_mode_switch_data - isp hardware mode update arguments
+ *
+ * @mup                 Mup value
+ * @num_expoures        Number of exposures
+ * @mup_en              Flag to indicate if mup is enable
+ *
+ */
+struct cam_isp_mode_switch_data {
+	uint32_t                      mup;
+	uint32_t                      num_expoures;
+	bool                          mup_en;
+};
+
+/**
+ * cam_isp_hw_mgr_init()
+ *
+ * @brief:              Initialization function for the ISP hardware manager
+ *
+ * @device_name_str:    Device name string
+ * @hw_mgr:             Input/output structure for the ISP hardware manager
+ *                          initialization
+ * @iommu_hdl:          Iommu handle to be returned
+ * @isp_device_type:    ISP device type
+ */
+int cam_isp_hw_mgr_init(const char    *device_name_str,
+	struct cam_hw_mgr_intf *hw_mgr, int *iommu_hdl, uint32_t isp_device_type);
+
+void cam_isp_hw_mgr_deinit(const char *device_name_str);
+
+#endif /* __CAM_ISP_HW_MGR_INTF_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid170.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid170.h
@@ -0,0 +1,409 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_IFE_CSID_170_H_
+#define _CAM_IFE_CSID_170_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+
+#define CAM_CSID_VERSION_V170                 0x10070000
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_170_ipp_reg_info = {
+	.irq_status_addr                = 0x30,
+	.irq_mask_addr                  = 0x34,
+	.irq_clear_addr                 = 0x38,
+	.irq_set_addr                   = 0x3c,
+	.cfg0_addr                      = 0x200,
+	.cfg1_addr                      = 0x204,
+	.ctrl_addr                      = 0x208,
+	.frm_drop_pattern_addr          = 0x20c,
+	.frm_drop_period_addr           = 0x210,
+	.irq_subsample_pattern_addr     = 0x214,
+	.irq_subsample_period_addr      = 0x218,
+	.hcrop_addr                     = 0x21c,
+	.vcrop_addr                     = 0x220,
+	.pix_drop_pattern_addr          = 0x224,
+	.pix_drop_period_addr           = 0x228,
+	.line_drop_pattern_addr         = 0x22c,
+	.line_drop_period_addr          = 0x230,
+	.rst_strobes_addr               = 0x240,
+	.status_addr                    = 0x254,
+	.misr_val_addr                  = 0x258,
+	.format_measure_cfg0_addr       = 0x270,
+	.format_measure_cfg1_addr       = 0x274,
+	.format_measure0_addr           = 0x278,
+	.format_measure1_addr           = 0x27c,
+	.format_measure2_addr           = 0x280,
+	.timestamp_curr0_sof_addr       = 0x290,
+	.timestamp_curr1_sof_addr       = 0x294,
+	.timestamp_prev0_sof_addr       = 0x298,
+	.timestamp_prev1_sof_addr       = 0x29c,
+	.timestamp_curr0_eof_addr       = 0x2a0,
+	.timestamp_curr1_eof_addr       = 0x2a4,
+	.timestamp_prev0_eof_addr       = 0x2a8,
+	.timestamp_prev1_eof_addr       = 0x2ac,
+	/* configurations */
+	.crop_v_en_shift_val            = 6,
+	.crop_h_en_shift_val            = 5,
+	.pix_store_en_shift_val         = 7,
+	.halt_master_sel_master_val     = 0,
+	.halt_master_sel_shift          = 4,
+	.halt_mode_internal             = 0,
+	.halt_mode_global               = 1,
+	.halt_mode_master               = 2,
+	.halt_mode_slave                = 3,
+	.halt_mode_shift                = 2,
+	.halt_frame_boundary            = 0,
+	.resume_frame_boundary          = 1,
+	.halt_immediate                 = 2,
+	.halt_cmd_shift                 = 0,
+	.early_eof_en_shift_val         = 29,
+	.timestamp_en_shift_val         = 2,
+	.format_measure_en_shift_val    = 0,
+	.fatal_err_mask                 = 0x4,
+	.non_fatal_err_mask             = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_170_rdi_0_reg_info = {
+	.irq_status_addr                 = 0x40,
+	.irq_mask_addr                   = 0x44,
+	.irq_clear_addr                  = 0x48,
+	.irq_set_addr                    = 0x4c,
+	.cfg0_addr                       = 0x300,
+	.cfg1_addr                       = 0x304,
+	.ctrl_addr                       = 0x308,
+	.frm_drop_pattern_addr           = 0x30c,
+	.frm_drop_period_addr            = 0x310,
+	.irq_subsample_pattern_addr      = 0x314,
+	.irq_subsample_period_addr       = 0x318,
+	.hcrop_addr                      = 0x31c,
+	.vcrop_addr                      = 0x320,
+	.pix_drop_pattern_addr           = 0x324,
+	.pix_drop_period_addr            = 0x328,
+	.line_drop_pattern_addr          = 0x32c,
+	.line_drop_period_addr           = 0x330,
+	.rst_strobes_addr                = 0x340,
+	.status_addr                     = 0x350,
+	.misr_val0_addr                  = 0x354,
+	.misr_val1_addr                  = 0x358,
+	.misr_val2_addr                  = 0x35c,
+	.misr_val3_addr                  = 0x360,
+	.format_measure_cfg0_addr        = 0x370,
+	.format_measure_cfg1_addr        = 0x374,
+	.format_measure0_addr            = 0x378,
+	.format_measure1_addr            = 0x37c,
+	.format_measure2_addr            = 0x380,
+	.timestamp_curr0_sof_addr        = 0x390,
+	.timestamp_curr1_sof_addr        = 0x394,
+	.timestamp_prev0_sof_addr        = 0x398,
+	.timestamp_prev1_sof_addr        = 0x39c,
+	.timestamp_curr0_eof_addr        = 0x3a0,
+	.timestamp_curr1_eof_addr        = 0x3a4,
+	.timestamp_prev0_eof_addr        = 0x3a8,
+	.timestamp_prev1_eof_addr        = 0x3ac,
+	.byte_cntr_ping_addr             = 0x3e0,
+	.byte_cntr_pong_addr             = 0x3e4,
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.plain_fmt_shift_val             = 10,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.timestamp_en_shift_val          = 1,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x4,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_170_rdi_1_reg_info = {
+	.irq_status_addr                 = 0x50,
+	.irq_mask_addr                   = 0x54,
+	.irq_clear_addr                  = 0x58,
+	.irq_set_addr                    = 0x5c,
+	.cfg0_addr                       = 0x400,
+	.cfg1_addr                       = 0x404,
+	.ctrl_addr                       = 0x408,
+	.frm_drop_pattern_addr           = 0x40c,
+	.frm_drop_period_addr            = 0x410,
+	.irq_subsample_pattern_addr      = 0x414,
+	.irq_subsample_period_addr       = 0x418,
+	.hcrop_addr                      = 0x41c,
+	.vcrop_addr                      = 0x420,
+	.pix_drop_pattern_addr           = 0x424,
+	.pix_drop_period_addr            = 0x428,
+	.line_drop_pattern_addr          = 0x42c,
+	.line_drop_period_addr           = 0x430,
+	.rst_strobes_addr                = 0x440,
+	.status_addr                     = 0x450,
+	.misr_val0_addr                  = 0x454,
+	.misr_val1_addr                  = 0x458,
+	.misr_val2_addr                  = 0x45c,
+	.misr_val3_addr                  = 0x460,
+	.format_measure_cfg0_addr        = 0x470,
+	.format_measure_cfg1_addr        = 0x474,
+	.format_measure0_addr            = 0x478,
+	.format_measure1_addr            = 0x47c,
+	.format_measure2_addr            = 0x480,
+	.timestamp_curr0_sof_addr        = 0x490,
+	.timestamp_curr1_sof_addr        = 0x494,
+	.timestamp_prev0_sof_addr        = 0x498,
+	.timestamp_prev1_sof_addr        = 0x49c,
+	.timestamp_curr0_eof_addr        = 0x4a0,
+	.timestamp_curr1_eof_addr        = 0x4a4,
+	.timestamp_prev0_eof_addr        = 0x4a8,
+	.timestamp_prev1_eof_addr        = 0x4ac,
+	.byte_cntr_ping_addr             = 0x4e0,
+	.byte_cntr_pong_addr             = 0x4e4,
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.plain_fmt_shift_val             = 10,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.timestamp_en_shift_val          = 1,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x4,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_170_rdi_2_reg_info = {
+	.irq_status_addr                 = 0x60,
+	.irq_mask_addr                   = 0x64,
+	.irq_clear_addr                  = 0x68,
+	.irq_set_addr                    = 0x6c,
+	.cfg0_addr                       = 0x500,
+	.cfg1_addr                       = 0x504,
+	.ctrl_addr                       = 0x508,
+	.frm_drop_pattern_addr           = 0x50c,
+	.frm_drop_period_addr            = 0x510,
+	.irq_subsample_pattern_addr      = 0x514,
+	.irq_subsample_period_addr       = 0x518,
+	.hcrop_addr                      = 0x51c,
+	.vcrop_addr                      = 0x520,
+	.pix_drop_pattern_addr           = 0x524,
+	.pix_drop_period_addr            = 0x528,
+	.line_drop_pattern_addr          = 0x52c,
+	.line_drop_period_addr           = 0x530,
+	.yuv_chroma_conversion_addr      = 0x534,
+	.rst_strobes_addr                = 0x540,
+	.status_addr                     = 0x550,
+	.misr_val0_addr                  = 0x554,
+	.misr_val1_addr                  = 0x558,
+	.misr_val2_addr                  = 0x55c,
+	.misr_val3_addr                  = 0x560,
+	.format_measure_cfg0_addr        = 0x570,
+	.format_measure_cfg1_addr        = 0x574,
+	.format_measure0_addr            = 0x578,
+	.format_measure1_addr            = 0x57c,
+	.format_measure2_addr            = 0x580,
+	.timestamp_curr0_sof_addr        = 0x590,
+	.timestamp_curr1_sof_addr        = 0x594,
+	.timestamp_prev0_sof_addr        = 0x598,
+	.timestamp_prev1_sof_addr        = 0x59c,
+	.timestamp_curr0_eof_addr        = 0x5a0,
+	.timestamp_curr1_eof_addr        = 0x5a4,
+	.timestamp_prev0_eof_addr        = 0x5a8,
+	.timestamp_prev1_eof_addr        = 0x5ac,
+	.byte_cntr_ping_addr             = 0x5e0,
+	.byte_cntr_pong_addr             = 0x5e4,
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.plain_fmt_shift_val             = 10,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.timestamp_en_shift_val          = 1,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x4,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_info
+			cam_ife_csid_170_csi2_reg_info = {
+	.irq_status_addr                 = 0x20,
+	.irq_mask_addr                   = 0x24,
+	.irq_clear_addr                  = 0x28,
+	.irq_set_addr                    = 0x2c,
+	/*CSI2 rx control */
+	.cfg0_addr                       = 0x100,
+	.cfg1_addr                       = 0x104,
+	.capture_ctrl_addr               = 0x108,
+	.rst_strobes_addr                = 0x110,
+	.de_scramble_cfg0_addr           = 0x114,
+	.de_scramble_cfg1_addr           = 0x118,
+	.cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.captured_short_pkt_0_addr       = 0x128,
+	.captured_short_pkt_1_addr       = 0x12c,
+	.captured_long_pkt_0_addr        = 0x130,
+	.captured_long_pkt_1_addr        = 0x134,
+	.captured_long_pkt_ftr_addr      = 0x138,
+	.captured_cphy_pkt_hdr_addr      = 0x13c,
+	.lane0_misr_addr                 = 0x150,
+	.lane1_misr_addr                 = 0x154,
+	.lane2_misr_addr                 = 0x158,
+	.lane3_misr_addr                 = 0x15c,
+	.total_pkts_rcvd_addr            = 0x160,
+	.stats_ecc_addr                  = 0x164,
+	.total_crc_err_addr              = 0x168,
+
+	.rst_srb_all                     = 0x3FFF,
+	.rst_done_shift_val              = 27,
+	.irq_mask_all                    = 0xFFFFFFF,
+	.misr_enable_shift_val           = 6,
+	.vc_mode_shift_val               = 2,
+	.capture_long_pkt_en_shift       = 0,
+	.capture_short_pkt_en_shift      = 1,
+	.capture_cphy_pkt_en_shift       = 2,
+	.capture_long_pkt_dt_shift       = 4,
+	.capture_long_pkt_vc_shift       = 10,
+	.capture_short_pkt_vc_shift      = 15,
+	.capture_cphy_pkt_dt_shift       = 20,
+	.capture_cphy_pkt_vc_shift       = 26,
+	.phy_num_mask                    = 0x3,
+	.vc_mask                         = 0x7C00000,
+	.dt_mask                         = 0x3f0000,
+	.wc_mask                         = 0xffff,
+	.calc_crc_mask                   = 0xffff,
+	.expected_crc_mask               = 0xffff,
+	.ecc_correction_shift_en         = 0,
+	.lane_num_shift                  = 0,
+	.lane_cfg_shift                  = 4,
+	.phy_type_shift                  = 24,
+	.phy_num_shift                   = 20,
+	.fatal_err_mask                  = 0x78000,
+	.part_fatal_err_mask             = 0x1801800,
+	.non_fatal_err_mask              = 0x380000,
+};
+
+static struct cam_ife_csid_ver1_tpg_reg_info
+			cam_ife_csid_170_tpg_reg_info = {
+	/*CSID TPG control */
+	.ctrl_addr                       = 0x600,
+	.vc_cfg0_addr                    = 0x604,
+	.vc_cfg1_addr                    = 0x608,
+	.lfsr_seed_addr                  = 0x60c,
+	.dt_n_cfg_0_addr                 = 0x610,
+	.dt_n_cfg_1_addr                 = 0x614,
+	.dt_n_cfg_2_addr                 = 0x618,
+	.color_bars_cfg_addr             = 0x640,
+	.color_box_cfg_addr              = 0x644,
+	.common_gen_cfg_addr             = 0x648,
+	.cgen_n_cfg_addr                 = 0x650,
+	.cgen_n_x0_addr                  = 0x654,
+	.cgen_n_x1_addr                  = 0x658,
+	.cgen_n_x2_addr                  = 0x65c,
+	.cgen_n_xy_addr                  = 0x660,
+	.cgen_n_y1_addr                  = 0x664,
+	.cgen_n_y2_addr                  = 0x668,
+
+	/* configurations */
+	.dtn_cfg_offset                  = 0xc,
+	.cgen_cfg_offset                 = 0x20,
+	.cpas_ife_reg_offset             = 0x28,
+	.hbi                             = 0x740,
+	.vbi                             = 0x3FF,
+	.lfsr_seed                       = 0x12345678,
+	.ctrl_cfg                        = 0x408007,
+	.line_interleave_mode            = 0x1,
+	.color_bar                       = 1,
+	.num_frames                      = 0,
+	.num_active_dt                   = 0,
+	.payload_mode                    = 0x8,
+	.num_active_lanes_mask           = 0x30,
+	.fmt_shift                       = 16,
+	.num_frame_shift                 = 16,
+	.width_shift                     = 16,
+	.vbi_shift                       = 12,
+	.line_interleave_shift           = 10,
+	.num_active_dt_shift             = 8,
+	.color_bar_shift                 = 5,
+	.height_shift                    = 0,
+	.hbi_shift                       = 0,
+};
+
+static struct cam_ife_csid_ver1_common_reg_info
+			cam_ife_csid_170_cmn_reg_info = {
+	.hw_version_addr                 = 0x0,
+	.cfg0_addr                       = 0x4,
+	.ctrl_addr                       = 0x8,
+	.reset_addr                      = 0xc,
+	.rst_strobes_addr                = 0x10,
+
+	.test_bus_ctrl_addr              = 0x14,
+	.top_irq_status_addr             = 0x70,
+	.top_irq_mask_addr               = 0x74,
+	.top_irq_clear_addr              = 0x78,
+	.top_irq_set_addr                = 0x7c,
+	.irq_cmd_addr                    = 0x80,
+
+	/*configurations */
+	.major_version                   = 1,
+	.minor_version                   = 7,
+	.version_incr                    = 0,
+	.num_rdis                        = 3,
+	.num_pix                         = 1,
+	.num_ppp                         = 0,
+	.rst_sw_reg_stb                  = 1,
+	.rst_hw_reg_stb                  = 0x1e,
+	.rst_sw_hw_reg_stb               = 0x1f,
+	.path_rst_stb_all                = 0x7f,
+	.rst_done_shift_val              = 1,
+	.path_en_shift_val               = 31,
+	.dt_id_shift_val                 = 27,
+	.vc_shift_val                    = 22,
+	.dt_shift_val                    = 16,
+	.fmt_shift_val                   = 12,
+	.crop_shift_val                  = 16,
+	.decode_format_shift_val         = 12,
+	.crop_pix_start_mask             = 0x3fff,
+	.crop_pix_end_mask               = 0xffff,
+	.crop_line_start_mask            = 0x3fff,
+	.crop_line_end_mask              = 0xffff,
+	.ipp_irq_mask_all                = 0x7FFF,
+	.rdi_irq_mask_all                = 0x7FFF,
+	.ppp_irq_mask_all                = 0x0,
+	.measure_en_hbi_vbi_cnt_mask     = 0xC,
+	.timestamp_strobe_val            = 0x2,
+	.timestamp_stb_sel_shift_val     = 0,
+	.format_measure_height_mask_val  = 0xFFFF,
+	.format_measure_height_shift_val = 0x10,
+	.format_measure_width_mask_val   = 0xFFFF,
+	.format_measure_width_shift_val  = 0x0,
+};
+
+static struct cam_ife_csid_ver1_reg_info cam_ife_csid_170_reg_info = {
+	.cmn_reg          = &cam_ife_csid_170_cmn_reg_info,
+	.csi2_reg         = &cam_ife_csid_170_csi2_reg_info,
+	.ipp_reg          = &cam_ife_csid_170_ipp_reg_info,
+	.ppp_reg          = NULL,
+	.rdi_reg = {
+		&cam_ife_csid_170_rdi_0_reg_info,
+		&cam_ife_csid_170_rdi_1_reg_info,
+		&cam_ife_csid_170_rdi_2_reg_info,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_170_tpg_reg_info,
+};
+#endif /*_CAM_IFE_CSID_170_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid170_200.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid170_200.h
@@ -0,0 +1,489 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_170_200_H_
+#define _CAM_IFE_CSID_170_200_H_
+
+#include <linux/module.h>
+#include "camera_main.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+
+#define CAM_CSID_VERSION_V170                 0x10070000
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_170_200_ipp_reg_info = {
+	.irq_status_addr               = 0x30,
+	.irq_mask_addr                 = 0x34,
+	.irq_clear_addr                = 0x38,
+	.irq_set_addr                  = 0x3c,
+	.cfg0_addr                     = 0x200,
+	.cfg1_addr                     = 0x204,
+	.ctrl_addr                     = 0x208,
+	.frm_drop_pattern_addr         = 0x20c,
+	.frm_drop_period_addr          = 0x210,
+	.irq_subsample_pattern_addr    = 0x214,
+	.irq_subsample_period_addr     = 0x218,
+	.hcrop_addr                    = 0x21c,
+	.vcrop_addr                    = 0x220,
+	.pix_drop_pattern_addr         = 0x224,
+	.pix_drop_period_addr          = 0x228,
+	.line_drop_pattern_addr        = 0x22c,
+	.line_drop_period_addr         = 0x230,
+	.rst_strobes_addr              = 0x240,
+	.status_addr                   = 0x254,
+	.misr_val_addr                 = 0x258,
+	.format_measure_cfg0_addr      = 0x270,
+	.format_measure_cfg1_addr      = 0x274,
+	.format_measure0_addr          = 0x278,
+	.format_measure1_addr          = 0x27c,
+	.format_measure2_addr          = 0x280,
+	.timestamp_curr0_sof_addr      = 0x290,
+	.timestamp_curr1_sof_addr      = 0x294,
+	.timestamp_prev0_sof_addr      = 0x298,
+	.timestamp_prev1_sof_addr      = 0x29c,
+	.timestamp_curr0_eof_addr      = 0x2a0,
+	.timestamp_curr1_eof_addr      = 0x2a4,
+	.timestamp_prev0_eof_addr      = 0x2a8,
+	.timestamp_prev1_eof_addr      = 0x2ac,
+	/* configurations */
+	.pix_store_en_shift_val        = 7,
+	.early_eof_en_shift_val        = 29,
+	.bin_qcfa_en_shift_val         = 30,
+	.bin_h_en_shift_val            = 2,
+	.bin_en_shift_val              = 2,
+	.binning_supported             = 0x3,
+	.halt_master_sel_master_val    = 0,
+	.halt_master_sel_shift         = 4,
+	.halt_mode_internal            = 0,
+	.halt_mode_global              = 1,
+	.halt_mode_master              = 2,
+	.halt_mode_slave               = 3,
+	.halt_mode_shift               = 2,
+	.halt_frame_boundary           = 0,
+	.resume_frame_boundary         = 1,
+	.halt_immediate                = 2,
+	.halt_cmd_shift                = 0,
+	.crop_v_en_shift_val           = 6,
+	.crop_h_en_shift_val           = 5,
+	.drop_v_en_shift_val           = 4,
+	.drop_h_en_shift_val           = 3,
+	.timestamp_en_shift_val        = 2,
+	.format_measure_en_shift_val   = 0,
+	.fatal_err_mask                = 0x4,
+	.non_fatal_err_mask            = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_170_200_ppp_reg_info = {
+	.irq_status_addr                = 0xa0,
+	.irq_mask_addr                  = 0xa4,
+	.irq_clear_addr                 = 0xa8,
+	.irq_set_addr                   = 0xac,
+	.cfg0_addr                      = 0x700,
+	.cfg1_addr                      = 0x704,
+	.ctrl_addr                      = 0x708,
+	.frm_drop_pattern_addr          = 0x70c,
+	.frm_drop_period_addr           = 0x710,
+	.irq_subsample_pattern_addr     = 0x714,
+	.irq_subsample_period_addr      = 0x718,
+	.hcrop_addr                     = 0x71c,
+	.vcrop_addr                     = 0x720,
+	.pix_drop_pattern_addr          = 0x724,
+	.pix_drop_period_addr           = 0x728,
+	.line_drop_pattern_addr         = 0x72c,
+	.line_drop_period_addr          = 0x730,
+	.rst_strobes_addr               = 0x740,
+	.status_addr                    = 0x754,
+	.misr_val_addr                  = 0x758,
+	.format_measure_cfg0_addr       = 0x770,
+	.format_measure_cfg1_addr       = 0x774,
+	.format_measure0_addr           = 0x778,
+	.format_measure1_addr           = 0x77c,
+	.format_measure2_addr           = 0x780,
+	.timestamp_curr0_sof_addr       = 0x790,
+	.timestamp_curr1_sof_addr       = 0x794,
+	.timestamp_prev0_sof_addr       = 0x798,
+	.timestamp_prev1_sof_addr       = 0x79c,
+	.timestamp_curr0_eof_addr       = 0x7a0,
+	.timestamp_curr1_eof_addr       = 0x7a4,
+	.timestamp_prev0_eof_addr       = 0x7a8,
+	.timestamp_prev1_eof_addr       = 0x7ac,
+	/* configurations */
+	.halt_master_sel_master_val     = 3,
+	.halt_master_sel_shift          = 4,
+	.halt_mode_internal             = 0,
+	.halt_mode_global               = 1,
+	.halt_mode_master               = 2,
+	.halt_mode_slave                = 3,
+	.halt_mode_shift                = 2,
+	.halt_frame_boundary            = 0,
+	.resume_frame_boundary          = 1,
+	.halt_immediate                 = 2,
+	.halt_cmd_shift                 = 0,
+	.pix_store_en_shift_val         = 7,
+	.early_eof_en_shift_val         = 29,
+	.crop_v_en_shift_val            = 6,
+	.crop_h_en_shift_val            = 5,
+	.drop_v_en_shift_val            = 4,
+	.drop_h_en_shift_val            = 3,
+	.timestamp_en_shift_val         = 2,
+	.format_measure_en_shift_val    = 0,
+	.fatal_err_mask                 = 0x4,
+	.non_fatal_err_mask             = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_170_200_rdi_0_reg_info = {
+	.irq_status_addr                 = 0x40,
+	.irq_mask_addr                   = 0x44,
+	.irq_clear_addr                  = 0x48,
+	.irq_set_addr                    = 0x4c,
+	.cfg0_addr                       = 0x300,
+	.cfg1_addr                       = 0x304,
+	.ctrl_addr                       = 0x308,
+	.frm_drop_pattern_addr           = 0x30c,
+	.frm_drop_period_addr            = 0x310,
+	.irq_subsample_pattern_addr      = 0x314,
+	.irq_subsample_period_addr       = 0x318,
+	.hcrop_addr                      = 0x31c,
+	.vcrop_addr                      = 0x320,
+	.pix_drop_pattern_addr           = 0x324,
+	.pix_drop_period_addr            = 0x328,
+	.line_drop_pattern_addr          = 0x32c,
+	.line_drop_period_addr           = 0x330,
+	.rst_strobes_addr                = 0x340,
+	.status_addr                     = 0x350,
+	.misr_val0_addr                  = 0x354,
+	.misr_val1_addr                  = 0x358,
+	.misr_val2_addr                  = 0x35c,
+	.misr_val3_addr                  = 0x360,
+	.format_measure_cfg0_addr        = 0x370,
+	.format_measure_cfg1_addr        = 0x374,
+	.format_measure0_addr            = 0x378,
+	.format_measure1_addr            = 0x37c,
+	.format_measure2_addr            = 0x380,
+	.timestamp_curr0_sof_addr        = 0x390,
+	.timestamp_curr1_sof_addr        = 0x394,
+	.timestamp_prev0_sof_addr        = 0x398,
+	.timestamp_prev1_sof_addr        = 0x39c,
+	.timestamp_curr0_eof_addr        = 0x3a0,
+	.timestamp_curr1_eof_addr        = 0x3a4,
+	.timestamp_prev0_eof_addr        = 0x3a8,
+	.timestamp_prev1_eof_addr        = 0x3ac,
+	.byte_cntr_ping_addr             = 0x3e0,
+	.byte_cntr_pong_addr             = 0x3e4,
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.ccif_violation_en               = 1,
+	.plain_fmt_shift_val             = 10,
+	.mipi_pack_supported             = 1,
+	.packing_fmt_shift_val           = 30,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.timestamp_en_shift_val          = 1,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x4,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_170_200_rdi_1_reg_info = {
+	.irq_status_addr                 = 0x50,
+	.irq_mask_addr                   = 0x54,
+	.irq_clear_addr                  = 0x58,
+	.irq_set_addr                    = 0x5c,
+	.cfg0_addr                       = 0x400,
+	.cfg1_addr                       = 0x404,
+	.ctrl_addr                       = 0x408,
+	.frm_drop_pattern_addr           = 0x40c,
+	.frm_drop_period_addr            = 0x410,
+	.irq_subsample_pattern_addr      = 0x414,
+	.irq_subsample_period_addr       = 0x418,
+	.hcrop_addr                      = 0x41c,
+	.vcrop_addr                      = 0x420,
+	.pix_drop_pattern_addr           = 0x424,
+	.pix_drop_period_addr            = 0x428,
+	.line_drop_pattern_addr          = 0x42c,
+	.line_drop_period_addr           = 0x430,
+	.rst_strobes_addr                = 0x440,
+	.status_addr                     = 0x450,
+	.misr_val0_addr                  = 0x454,
+	.misr_val1_addr                  = 0x458,
+	.misr_val2_addr                  = 0x45c,
+	.misr_val3_addr                  = 0x460,
+	.format_measure_cfg0_addr        = 0x470,
+	.format_measure_cfg1_addr        = 0x474,
+	.format_measure0_addr            = 0x478,
+	.format_measure1_addr            = 0x47c,
+	.format_measure2_addr            = 0x480,
+	.timestamp_curr0_sof_addr        = 0x490,
+	.timestamp_curr1_sof_addr        = 0x494,
+	.timestamp_prev0_sof_addr        = 0x498,
+	.timestamp_prev1_sof_addr        = 0x49c,
+	.timestamp_curr0_eof_addr        = 0x4a0,
+	.timestamp_curr1_eof_addr        = 0x4a4,
+	.timestamp_prev0_eof_addr        = 0x4a8,
+	.timestamp_prev1_eof_addr        = 0x4ac,
+	.byte_cntr_ping_addr             = 0x4e0,
+	.byte_cntr_pong_addr             = 0x4e4,
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.ccif_violation_en               = 1,
+	.plain_fmt_shift_val             = 10,
+	.packing_fmt_shift_val           = 30,
+	.mipi_pack_supported             = 1,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.timestamp_en_shift_val          = 1,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x4,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_170_200_rdi_2_reg_info = {
+	.irq_status_addr                 = 0x60,
+	.irq_mask_addr                   = 0x64,
+	.irq_clear_addr                  = 0x68,
+	.irq_set_addr                    = 0x6c,
+	.cfg0_addr                       = 0x500,
+	.cfg1_addr                       = 0x504,
+	.ctrl_addr                       = 0x508,
+	.frm_drop_pattern_addr           = 0x50c,
+	.frm_drop_period_addr            = 0x510,
+	.irq_subsample_pattern_addr      = 0x514,
+	.irq_subsample_period_addr       = 0x518,
+	.hcrop_addr                      = 0x51c,
+	.vcrop_addr                      = 0x520,
+	.pix_drop_pattern_addr           = 0x524,
+	.pix_drop_period_addr            = 0x528,
+	.line_drop_pattern_addr          = 0x52c,
+	.line_drop_period_addr           = 0x530,
+	.yuv_chroma_conversion_addr      = 0x534,
+	.rst_strobes_addr                = 0x540,
+	.status_addr                     = 0x550,
+	.misr_val0_addr                  = 0x554,
+	.misr_val1_addr                  = 0x558,
+	.misr_val2_addr                  = 0x55c,
+	.misr_val3_addr                  = 0x560,
+	.format_measure_cfg0_addr        = 0x570,
+	.format_measure_cfg1_addr        = 0x574,
+	.format_measure0_addr            = 0x578,
+	.format_measure1_addr            = 0x57c,
+	.format_measure2_addr            = 0x580,
+	.timestamp_curr0_sof_addr        = 0x590,
+	.timestamp_curr1_sof_addr        = 0x594,
+	.timestamp_prev0_sof_addr        = 0x598,
+	.timestamp_prev1_sof_addr        = 0x59c,
+	.timestamp_curr0_eof_addr        = 0x5a0,
+	.timestamp_curr1_eof_addr        = 0x5a4,
+	.timestamp_prev0_eof_addr        = 0x5a8,
+	.timestamp_prev1_eof_addr        = 0x5ac,
+	.byte_cntr_ping_addr             = 0x5e0,
+	.byte_cntr_pong_addr             = 0x5e4,
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.ccif_violation_en               = 1,
+	.plain_fmt_shift_val             = 10,
+	.packing_fmt_shift_val           = 30,
+	.mipi_pack_supported             = 1,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.timestamp_en_shift_val          = 1,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x4,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_info
+			cam_ife_csid_170_200_csi2_reg_info = {
+	.irq_status_addr                 = 0x20,
+	.irq_mask_addr                   = 0x24,
+	.irq_clear_addr                  = 0x28,
+	.irq_set_addr                    = 0x2c,
+	/*CSI2 rx control */
+	.cfg0_addr                       = 0x100,
+	.cfg1_addr                       = 0x104,
+	.capture_ctrl_addr               = 0x108,
+	.rst_strobes_addr                = 0x110,
+	.cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.captured_short_pkt_0_addr       = 0x128,
+	.captured_short_pkt_1_addr       = 0x12c,
+	.captured_long_pkt_0_addr        = 0x130,
+	.captured_long_pkt_1_addr        = 0x134,
+	.captured_long_pkt_ftr_addr      = 0x138,
+	.captured_cphy_pkt_hdr_addr      = 0x13c,
+	.lane0_misr_addr                 = 0x150,
+	.lane1_misr_addr                 = 0x154,
+	.lane2_misr_addr                 = 0x158,
+	.lane3_misr_addr                 = 0x15c,
+	.total_pkts_rcvd_addr            = 0x160,
+	.stats_ecc_addr                  = 0x164,
+	.total_crc_err_addr              = 0x168,
+	.de_scramble_type3_cfg0_addr     = 0x170,
+	.de_scramble_type3_cfg1_addr     = 0x174,
+	.de_scramble_type2_cfg0_addr     = 0x178,
+	.de_scramble_type2_cfg1_addr     = 0x17c,
+	.de_scramble_type1_cfg0_addr     = 0x180,
+	.de_scramble_type1_cfg1_addr     = 0x184,
+	.de_scramble_type0_cfg0_addr     = 0x188,
+	.de_scramble_type0_cfg1_addr     = 0x18c,
+
+	.rst_srb_all                     = 0x3FFF,
+	.rst_done_shift_val              = 27,
+	.irq_mask_all                    = 0xFFFFFFF,
+	.misr_enable_shift_val           = 6,
+	.vc_mode_shift_val               = 2,
+	.capture_long_pkt_en_shift       = 0,
+	.capture_short_pkt_en_shift      = 1,
+	.capture_cphy_pkt_en_shift       = 2,
+	.capture_long_pkt_dt_shift       = 4,
+	.capture_long_pkt_vc_shift       = 10,
+	.capture_short_pkt_vc_shift      = 15,
+	.capture_cphy_pkt_dt_shift       = 20,
+	.capture_cphy_pkt_vc_shift       = 26,
+	.phy_num_mask                    = 0x7,
+	.vc_mask                         = 0x7C00000,
+	.dt_mask                         = 0x3f0000,
+	.wc_mask                         = 0xffff,
+	.calc_crc_mask                   = 0xffff,
+	.expected_crc_mask               = 0xffff,
+	.ecc_correction_shift_en         = 0,
+	.lane_num_shift                  = 0,
+	.lane_cfg_shift                  = 4,
+	.phy_type_shift                  = 24,
+	.phy_num_shift                   = 20,
+	.fatal_err_mask                  = 0x78000,
+	.part_fatal_err_mask             = 0x1801800,
+	.non_fatal_err_mask              = 0x380000,
+};
+
+static struct cam_ife_csid_ver1_tpg_reg_info
+			cam_ife_csid_170_200_tpg_reg_info = {
+	/*CSID TPG control */
+	.ctrl_addr                       = 0x600,
+	.vc_cfg0_addr                    = 0x604,
+	.vc_cfg1_addr                    = 0x608,
+	.lfsr_seed_addr                  = 0x60c,
+	.dt_n_cfg_0_addr                 = 0x610,
+	.dt_n_cfg_1_addr                 = 0x614,
+	.dt_n_cfg_2_addr                 = 0x618,
+	.color_bars_cfg_addr             = 0x640,
+	.color_box_cfg_addr              = 0x644,
+	.common_gen_cfg_addr             = 0x648,
+	.cgen_n_cfg_addr                 = 0x650,
+	.cgen_n_x0_addr                  = 0x654,
+	.cgen_n_x1_addr                  = 0x658,
+	.cgen_n_x2_addr                  = 0x65c,
+	.cgen_n_xy_addr                  = 0x660,
+	.cgen_n_y1_addr                  = 0x664,
+	.cgen_n_y2_addr                  = 0x668,
+
+	/* configurations */
+	.dtn_cfg_offset                  = 0xc,
+	.cgen_cfg_offset                 = 0x20,
+	.cpas_ife_reg_offset             = 0x28,
+	.hbi                             = 0x740,
+	.vbi                             = 0x3FF,
+	.lfsr_seed                       = 0x12345678,
+	.ctrl_cfg                        = 0x408007,
+	.color_bar                       = 1,
+	.line_interleave_mode            = 0x1,
+	.num_frames                      = 0,
+	.num_active_lanes_mask           = 0x30,
+	.num_active_dt                   = 0,
+	.payload_mode                    = 0x8,
+	.fmt_shift                       = 16,
+	.num_frame_shift                 = 16,
+	.width_shift                     = 16,
+	.vbi_shift                       = 12,
+	.line_interleave_shift           = 10,
+	.num_active_dt_shift             = 8,
+	.color_bar_shift                 = 5,
+	.height_shift                    = 0,
+	.hbi_shift                       = 0,
+};
+
+static struct cam_ife_csid_ver1_common_reg_info
+			cam_ife_csid_170_200_cmn_reg_info = {
+	.hw_version_addr                 = 0x0,
+	.cfg0_addr                       = 0x4,
+	.ctrl_addr                       = 0x8,
+	.reset_addr                      = 0xc,
+	.rst_strobes_addr                = 0x10,
+	.test_bus_ctrl_addr              = 0x14,
+	.top_irq_status_addr             = 0x70,
+	.top_irq_mask_addr               = 0x74,
+	.top_irq_clear_addr              = 0x78,
+	.top_irq_set_addr                = 0x7c,
+	.irq_cmd_addr                    = 0x80,
+
+	/*configurations */
+	.major_version                   = 1,
+	.minor_version                   = 7,
+	.version_incr                    = 0,
+	.num_rdis                        = 3,
+	.num_pix                         = 1,
+	.num_ppp                         = 1,
+	.rst_sw_reg_stb                  = 1,
+	.rst_hw_reg_stb                  = 0x1e,
+	.rst_sw_hw_reg_stb               = 0x1f,
+	.path_rst_stb_all                = 0x7f,
+	.rst_done_shift_val              = 1,
+	.path_en_shift_val               = 31,
+	.dt_id_shift_val                 = 27,
+	.vc_shift_val                    = 22,
+	.dt_shift_val                    = 16,
+	.fmt_shift_val                   = 12,
+	.crop_shift_val                  = 16,
+	.crop_pix_start_mask             = 0x3fff,
+	.crop_pix_end_mask               = 0xffff,
+	.crop_line_start_mask            = 0x3fff,
+	.crop_line_end_mask              = 0xffff,
+	.decode_format_shift_val         = 12,
+	.ipp_irq_mask_all                = 0xFFFF,
+	.rdi_irq_mask_all                = 0xFFFF,
+	.ppp_irq_mask_all                = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask     = 0xC,
+	.timestamp_strobe_val            = 0x2,
+	.timestamp_stb_sel_shift_val     = 0,
+	.format_measure_height_mask_val  = 0xFFFF,
+	.format_measure_height_shift_val = 0x10,
+	.format_measure_width_mask_val   = 0xFFFF,
+	.format_measure_width_shift_val  = 0x0,
+};
+
+static struct cam_ife_csid_ver1_reg_info cam_ife_csid_170_200_reg_info = {
+	.cmn_reg          = &cam_ife_csid_170_200_cmn_reg_info,
+	.csi2_reg         = &cam_ife_csid_170_200_csi2_reg_info,
+	.ipp_reg          = &cam_ife_csid_170_200_ipp_reg_info,
+	.ppp_reg          = &cam_ife_csid_170_200_ppp_reg_info,
+	.rdi_reg = {
+		&cam_ife_csid_170_200_rdi_0_reg_info,
+		&cam_ife_csid_170_200_rdi_1_reg_info,
+		&cam_ife_csid_170_200_rdi_2_reg_info,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_170_200_tpg_reg_info,
+};
+#endif /*_CAM_IFE_CSID_170_200_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid175.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid175.h
@@ -0,0 +1,472 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_175_H_
+#define _CAM_IFE_CSID_175_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+
+#define CAM_CSID_VERSION_V175                 0x10070050
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_175_ipp_reg_info = {
+	.irq_status_addr                  = 0x30,
+	.irq_mask_addr                    = 0x34,
+	.irq_clear_addr                   = 0x38,
+	.irq_set_addr                     = 0x3c,
+	.cfg0_addr                        = 0x200,
+	.cfg1_addr                        = 0x204,
+	.ctrl_addr                        = 0x208,
+	.frm_drop_pattern_addr            = 0x20c,
+	.frm_drop_period_addr             = 0x210,
+	.irq_subsample_pattern_addr       = 0x214,
+	.irq_subsample_period_addr        = 0x218,
+	.hcrop_addr                       = 0x21c,
+	.vcrop_addr                       = 0x220,
+	.pix_drop_pattern_addr            = 0x224,
+	.pix_drop_period_addr             = 0x228,
+	.line_drop_pattern_addr           = 0x22c,
+	.line_drop_period_addr            = 0x230,
+	.rst_strobes_addr                 = 0x240,
+	.status_addr                      = 0x254,
+	.misr_val_addr                    = 0x258,
+	.format_measure_cfg0_addr         = 0x270,
+	.format_measure_cfg1_addr         = 0x274,
+	.format_measure0_addr             = 0x278,
+	.format_measure1_addr             = 0x27c,
+	.format_measure2_addr             = 0x280,
+	.timestamp_curr0_sof_addr         = 0x290,
+	.timestamp_curr1_sof_addr         = 0x294,
+	.timestamp_prev0_sof_addr         = 0x298,
+	.timestamp_prev1_sof_addr         = 0x29c,
+	.timestamp_curr0_eof_addr         = 0x2a0,
+	.timestamp_curr1_eof_addr         = 0x2a4,
+	.timestamp_prev0_eof_addr         = 0x2a8,
+	.timestamp_prev1_eof_addr         = 0x2ac,
+	/* configurations */
+	.halt_master_sel_master_val       = 0,
+	.halt_master_sel_shift            = 4,
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_master                 = 2,
+	.halt_mode_slave                  = 3,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.pix_store_en_shift_val           = 7,
+	.early_eof_en_shift_val           = 29,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.drop_v_en_shift_val              = 4,
+	.drop_h_en_shift_val              = 3,
+	.timestamp_en_shift_val           = 1,
+	.format_measure_en_shift_val      = 0,
+	.fatal_err_mask                   = 0x4,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_175_ppp_reg_info = {
+	.irq_status_addr                  = 0xa0,
+	.irq_mask_addr                    = 0xa4,
+	.irq_clear_addr                   = 0xa8,
+	.irq_set_addr                     = 0xac,
+	.cfg0_addr                        = 0x700,
+	.cfg1_addr                        = 0x704,
+	.ctrl_addr                        = 0x708,
+	.frm_drop_pattern_addr            = 0x70c,
+	.frm_drop_period_addr             = 0x710,
+	.irq_subsample_pattern_addr       = 0x714,
+	.irq_subsample_period_addr        = 0x718,
+	.hcrop_addr                       = 0x71c,
+	.vcrop_addr                       = 0x720,
+	.pix_drop_pattern_addr            = 0x724,
+	.pix_drop_period_addr             = 0x728,
+	.line_drop_pattern_addr           = 0x72c,
+	.line_drop_period_addr            = 0x730,
+	.rst_strobes_addr                 = 0x740,
+	.status_addr                      = 0x754,
+	.misr_val_addr                    = 0x758,
+	.format_measure_cfg0_addr         = 0x770,
+	.format_measure_cfg1_addr         = 0x774,
+	.format_measure0_addr             = 0x778,
+	.format_measure1_addr             = 0x77c,
+	.format_measure2_addr             = 0x780,
+	.timestamp_curr0_sof_addr         = 0x790,
+	.timestamp_curr1_sof_addr         = 0x794,
+	.timestamp_prev0_sof_addr         = 0x798,
+	.timestamp_prev1_sof_addr         = 0x79c,
+	.timestamp_curr0_eof_addr         = 0x7a0,
+	.timestamp_curr1_eof_addr         = 0x7a4,
+	.timestamp_prev0_eof_addr         = 0x7a8,
+	.timestamp_prev1_eof_addr         = 0x7ac,
+	/* configurations */
+	.halt_master_sel_master_val       = 3,
+	.halt_master_sel_shift            = 4,
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_master                 = 2,
+	.halt_mode_slave                  = 3,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.drop_v_en_shift_val              = 4,
+	.drop_h_en_shift_val              = 3,
+	.pix_store_en_shift_val           = 7,
+	.early_eof_en_shift_val           = 29,
+	.timestamp_en_shift_val           = 1,
+	.format_measure_en_shift_val      = 0,
+	.fatal_err_mask                   = 0x4,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_175_rdi_0_reg_info = {
+	.irq_status_addr                 = 0x40,
+	.irq_mask_addr                   = 0x44,
+	.irq_clear_addr                  = 0x48,
+	.irq_set_addr                    = 0x4c,
+	.cfg0_addr                       = 0x300,
+	.cfg1_addr                       = 0x304,
+	.ctrl_addr                       = 0x308,
+	.frm_drop_pattern_addr           = 0x30c,
+	.frm_drop_period_addr            = 0x310,
+	.irq_subsample_pattern_addr      = 0x314,
+	.irq_subsample_period_addr       = 0x318,
+	.hcrop_addr                      = 0x31c,
+	.vcrop_addr                      = 0x320,
+	.pix_drop_pattern_addr           = 0x324,
+	.pix_drop_period_addr            = 0x328,
+	.line_drop_pattern_addr          = 0x32c,
+	.line_drop_period_addr           = 0x330,
+	.rst_strobes_addr                = 0x340,
+	.status_addr                     = 0x350,
+	.misr_val0_addr                  = 0x354,
+	.misr_val1_addr                  = 0x358,
+	.misr_val2_addr                  = 0x35c,
+	.misr_val3_addr                  = 0x360,
+	.format_measure_cfg0_addr        = 0x370,
+	.format_measure_cfg1_addr        = 0x374,
+	.format_measure0_addr            = 0x378,
+	.format_measure1_addr            = 0x37c,
+	.format_measure2_addr            = 0x380,
+	.timestamp_curr0_sof_addr        = 0x390,
+	.timestamp_curr1_sof_addr        = 0x394,
+	.timestamp_prev0_sof_addr        = 0x398,
+	.timestamp_prev1_sof_addr        = 0x39c,
+	.timestamp_curr0_eof_addr        = 0x3a0,
+	.timestamp_curr1_eof_addr        = 0x3a4,
+	.timestamp_prev0_eof_addr        = 0x3a8,
+	.timestamp_prev1_eof_addr        = 0x3ac,
+	.byte_cntr_ping_addr             = 0x3e0,
+	.byte_cntr_pong_addr             = 0x3e4,
+	.plain_fmt_shift_val             = 10,
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.drop_v_en_shift_val             = 4,
+	.drop_h_en_shift_val             = 3,
+	.timestamp_en_shift_val          = 2,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x4,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_175_rdi_1_reg_info = {
+	.irq_status_addr                 = 0x50,
+	.irq_mask_addr                   = 0x54,
+	.irq_clear_addr                  = 0x58,
+	.irq_set_addr                    = 0x5c,
+	.cfg0_addr                       = 0x400,
+	.cfg1_addr                       = 0x404,
+	.ctrl_addr                       = 0x408,
+	.frm_drop_pattern_addr           = 0x40c,
+	.frm_drop_period_addr            = 0x410,
+	.irq_subsample_pattern_addr      = 0x414,
+	.irq_subsample_period_addr       = 0x418,
+	.hcrop_addr                      = 0x41c,
+	.vcrop_addr                      = 0x420,
+	.pix_drop_pattern_addr           = 0x424,
+	.pix_drop_period_addr            = 0x428,
+	.line_drop_pattern_addr          = 0x42c,
+	.line_drop_period_addr           = 0x430,
+	.rst_strobes_addr                = 0x440,
+	.status_addr                     = 0x450,
+	.misr_val0_addr                  = 0x454,
+	.misr_val1_addr                  = 0x458,
+	.misr_val2_addr                  = 0x45c,
+	.misr_val3_addr                  = 0x460,
+	.format_measure_cfg0_addr        = 0x470,
+	.format_measure_cfg1_addr        = 0x474,
+	.format_measure0_addr            = 0x478,
+	.format_measure1_addr            = 0x47c,
+	.format_measure2_addr            = 0x480,
+	.timestamp_curr0_sof_addr        = 0x490,
+	.timestamp_curr1_sof_addr        = 0x494,
+	.timestamp_prev0_sof_addr        = 0x498,
+	.timestamp_prev1_sof_addr        = 0x49c,
+	.timestamp_curr0_eof_addr        = 0x4a0,
+	.timestamp_curr1_eof_addr        = 0x4a4,
+	.timestamp_prev0_eof_addr        = 0x4a8,
+	.timestamp_prev1_eof_addr        = 0x4ac,
+	.byte_cntr_ping_addr             = 0x4e0,
+	.byte_cntr_pong_addr             = 0x4e4,
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.plain_fmt_shift_val             = 10,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.timestamp_en_shift_val          = 2,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x4,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_175_rdi_2_reg_info = {
+	.irq_status_addr                 = 0x60,
+	.irq_mask_addr                   = 0x64,
+	.irq_clear_addr                  = 0x68,
+	.irq_set_addr                    = 0x6c,
+	.cfg0_addr                       = 0x500,
+	.cfg1_addr                       = 0x504,
+	.ctrl_addr                       = 0x508,
+	.frm_drop_pattern_addr           = 0x50c,
+	.frm_drop_period_addr            = 0x510,
+	.irq_subsample_pattern_addr      = 0x514,
+	.irq_subsample_period_addr       = 0x518,
+	.hcrop_addr                      = 0x51c,
+	.vcrop_addr                      = 0x520,
+	.pix_drop_pattern_addr           = 0x524,
+	.pix_drop_period_addr            = 0x528,
+	.line_drop_pattern_addr          = 0x52c,
+	.line_drop_period_addr           = 0x530,
+	.yuv_chroma_conversion_addr      = 0x534,
+	.rst_strobes_addr                = 0x540,
+	.status_addr                     = 0x550,
+	.misr_val0_addr                  = 0x554,
+	.misr_val1_addr                  = 0x558,
+	.misr_val2_addr                  = 0x55c,
+	.misr_val3_addr                  = 0x560,
+	.format_measure_cfg0_addr        = 0x570,
+	.format_measure_cfg1_addr        = 0x574,
+	.format_measure0_addr            = 0x578,
+	.format_measure1_addr            = 0x57c,
+	.format_measure2_addr            = 0x580,
+	.timestamp_curr0_sof_addr        = 0x590,
+	.timestamp_curr1_sof_addr        = 0x594,
+	.timestamp_prev0_sof_addr        = 0x598,
+	.timestamp_prev1_sof_addr        = 0x59c,
+	.timestamp_curr0_eof_addr        = 0x5a0,
+	.timestamp_curr1_eof_addr        = 0x5a4,
+	.timestamp_prev0_eof_addr        = 0x5a8,
+	.timestamp_prev1_eof_addr        = 0x5ac,
+	.byte_cntr_ping_addr             = 0x5e0,
+	.byte_cntr_pong_addr             = 0x5e4,
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.plain_fmt_shift_val             = 10,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.timestamp_en_shift_val          = 2,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x4,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_info
+			cam_ife_csid_175_csi2_reg_info = {
+	.irq_status_addr                 = 0x20,
+	.irq_mask_addr                   = 0x24,
+	.irq_clear_addr                  = 0x28,
+	.irq_set_addr                    = 0x2c,
+	/*CSI2 rx control */
+	.cfg0_addr                       = 0x100,
+	.cfg1_addr                       = 0x104,
+	.capture_ctrl_addr               = 0x108,
+	.rst_strobes_addr                = 0x110,
+	.de_scramble_cfg0_addr           = 0x114,
+	.de_scramble_cfg1_addr           = 0x118,
+	.cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.captured_short_pkt_0_addr       = 0x128,
+	.captured_short_pkt_1_addr       = 0x12c,
+	.captured_long_pkt_0_addr        = 0x130,
+	.captured_long_pkt_1_addr        = 0x134,
+	.captured_long_pkt_ftr_addr      = 0x138,
+	.captured_cphy_pkt_hdr_addr      = 0x13c,
+	.lane0_misr_addr                 = 0x150,
+	.lane1_misr_addr                 = 0x154,
+	.lane2_misr_addr                 = 0x158,
+	.lane3_misr_addr                 = 0x15c,
+	.total_pkts_rcvd_addr            = 0x160,
+	.stats_ecc_addr                  = 0x164,
+	.total_crc_err_addr              = 0x168,
+
+	.rst_srb_all                     = 0x3FFF,
+	.rst_done_shift_val              = 27,
+	.irq_mask_all                    = 0xFFFFFFF,
+	.misr_enable_shift_val           = 6,
+	.vc_mode_shift_val               = 2,
+	.capture_long_pkt_en_shift       = 0,
+	.capture_short_pkt_en_shift      = 1,
+	.capture_cphy_pkt_en_shift       = 2,
+	.capture_long_pkt_dt_shift       = 4,
+	.capture_long_pkt_vc_shift       = 10,
+	.capture_short_pkt_vc_shift      = 15,
+	.capture_cphy_pkt_dt_shift       = 20,
+	.capture_cphy_pkt_vc_shift       = 26,
+	.phy_num_mask                    = 0x3,
+	.vc_mask                         = 0x7C00000,
+	.dt_mask                         = 0x3f0000,
+	.wc_mask                         = 0xffff,
+	.calc_crc_mask                   = 0xffff,
+	.expected_crc_mask               = 0xffff,
+	.ecc_correction_shift_en         = 0,
+	.lane_num_shift                  = 0,
+	.lane_cfg_shift                  = 4,
+	.phy_type_shift                  = 24,
+	.phy_num_shift                   = 20,
+	.fatal_err_mask                  = 0x78000,
+	.part_fatal_err_mask             = 0x1801800,
+	.non_fatal_err_mask              = 0x380000,
+};
+
+static struct cam_ife_csid_ver1_tpg_reg_info
+			cam_ife_csid_175_tpg_reg_info = {
+	/*CSID TPG control */
+	.ctrl_addr                       = 0x600,
+	.vc_cfg0_addr                    = 0x604,
+	.vc_cfg1_addr                    = 0x608,
+	.lfsr_seed_addr                  = 0x60c,
+	.dt_n_cfg_0_addr                 = 0x610,
+	.dt_n_cfg_1_addr                 = 0x614,
+	.dt_n_cfg_2_addr                 = 0x618,
+	.color_bars_cfg_addr             = 0x640,
+	.color_box_cfg_addr              = 0x644,
+	.common_gen_cfg_addr             = 0x648,
+	.cgen_n_cfg_addr                 = 0x650,
+	.cgen_n_x0_addr                  = 0x654,
+	.cgen_n_x1_addr                  = 0x658,
+	.cgen_n_x2_addr                  = 0x65c,
+	.cgen_n_xy_addr                  = 0x660,
+	.cgen_n_y1_addr                  = 0x664,
+	.cgen_n_y2_addr                  = 0x668,
+
+	/* configurations */
+	.dtn_cfg_offset                  = 0xc,
+	.cgen_cfg_offset                 = 0x20,
+	.cpas_ife_reg_offset             = 0x28,
+	.hbi                             = 0x740,
+	.vbi                             = 0x3FF,
+	.lfsr_seed                       = 0x12345678,
+	.ctrl_cfg                        = 0x408007,
+	.color_bar                       = 1,
+	.num_frames                      = 0,
+	.line_interleave_mode            = 0x1,
+	.payload_mode                    = 0x8,
+	.num_active_lanes_mask           = 0x30,
+	.num_active_dt                   = 0,
+	.fmt_shift                       = 16,
+	.num_frame_shift                 = 16,
+	.width_shift                     = 16,
+	.vbi_shift                       = 12,
+	.line_interleave_shift           = 10,
+	.num_active_dt_shift             = 8,
+	.color_bar_shift                 = 5,
+	.height_shift                    = 0,
+	.hbi_shift                       = 0,
+};
+
+static struct cam_ife_csid_ver1_common_reg_info
+			cam_ife_csid_175_cmn_reg_info = {
+	.hw_version_addr                 = 0x0,
+	.cfg0_addr                       = 0x4,
+	.ctrl_addr                       = 0x8,
+	.reset_addr                      = 0xc,
+	.rst_strobes_addr                = 0x10,
+	.test_bus_ctrl_addr              = 0x14,
+	.top_irq_status_addr             = 0x70,
+	.top_irq_mask_addr               = 0x74,
+	.top_irq_clear_addr              = 0x78,
+	.top_irq_set_addr                = 0x7c,
+	.irq_cmd_addr                    = 0x80,
+
+	/*configurations */
+	.major_version                   = 1,
+	.minor_version                   = 7,
+	.version_incr                    = 0,
+	.num_rdis                        = 3,
+	.num_pix                         = 1,
+	.num_ppp                         = 1,
+	.rst_sw_reg_stb                  = 1,
+	.rst_hw_reg_stb                  = 0x1e,
+	.rst_sw_hw_reg_stb               = 0x1f,
+	.path_rst_stb_all                = 0x7f,
+	.rst_done_shift_val              = 1,
+	.path_en_shift_val               = 31,
+	.dt_id_shift_val                 = 27,
+	.vc_shift_val                    = 22,
+	.dt_shift_val                    = 16,
+	.fmt_shift_val                   = 12,
+	.crop_shift_val                  = 16,
+	.decode_format_shift_val         = 12,
+	.crop_pix_start_mask             = 0x3fff,
+	.crop_pix_end_mask               = 0xffff,
+	.crop_line_start_mask            = 0x3fff,
+	.crop_line_end_mask              = 0xffff,
+	.ipp_irq_mask_all                = 0x7FFF,
+	.rdi_irq_mask_all                = 0x7FFF,
+	.ppp_irq_mask_all                = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask     = 0xC,
+	.timestamp_stb_sel_shift_val     = 0,
+	.timestamp_strobe_val            = 0x2,
+	.format_measure_height_mask_val  = 0xFFFF,
+	.format_measure_height_shift_val = 0x10,
+	.format_measure_width_mask_val   = 0xFFFF,
+	.format_measure_width_shift_val  = 0x0,
+};
+
+static struct cam_ife_csid_ver1_reg_info cam_ife_csid_175_reg_info = {
+	.cmn_reg          = &cam_ife_csid_175_cmn_reg_info,
+	.csi2_reg         = &cam_ife_csid_175_csi2_reg_info,
+	.ipp_reg          = &cam_ife_csid_175_ipp_reg_info,
+	.ppp_reg          = &cam_ife_csid_175_ppp_reg_info,
+	.rdi_reg = {
+		&cam_ife_csid_175_rdi_0_reg_info,
+		&cam_ife_csid_175_rdi_1_reg_info,
+		&cam_ife_csid_175_rdi_2_reg_info,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_175_tpg_reg_info,
+};
+#endif /*_CAM_IFE_CSID_175_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid175_200.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid175_200.h
@@ -0,0 +1,490 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_175_200_H_
+#define _CAM_IFE_CSID_175_200_H_
+
+#include <linux/module.h>
+#include "camera_main.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+
+#define CAM_CSID_DRV_NAME                    "csid"
+#define CAM_CSID_VERSION_V175                 0x10070050
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_175_200_ipp_reg_info = {
+	.irq_status_addr                  = 0x30,
+	.irq_mask_addr                    = 0x34,
+	.irq_clear_addr                   = 0x38,
+	.irq_set_addr                     = 0x3c,
+	.cfg0_addr                        = 0x200,
+	.cfg1_addr                        = 0x204,
+	.ctrl_addr                        = 0x208,
+	.frm_drop_pattern_addr            = 0x20c,
+	.frm_drop_period_addr             = 0x210,
+	.irq_subsample_pattern_addr       = 0x214,
+	.irq_subsample_period_addr        = 0x218,
+	.hcrop_addr                       = 0x21c,
+	.vcrop_addr                       = 0x220,
+	.pix_drop_pattern_addr            = 0x224,
+	.pix_drop_period_addr             = 0x228,
+	.line_drop_pattern_addr           = 0x22c,
+	.line_drop_period_addr            = 0x230,
+	.rst_strobes_addr                 = 0x240,
+	.status_addr                      = 0x254,
+	.misr_val_addr                    = 0x258,
+	.format_measure_cfg0_addr         = 0x270,
+	.format_measure_cfg1_addr         = 0x274,
+	.format_measure0_addr             = 0x278,
+	.format_measure1_addr             = 0x27c,
+	.format_measure2_addr             = 0x280,
+	.timestamp_curr0_sof_addr         = 0x290,
+	.timestamp_curr1_sof_addr         = 0x294,
+	.timestamp_prev0_sof_addr         = 0x298,
+	.timestamp_prev1_sof_addr         = 0x29c,
+	.timestamp_curr0_eof_addr         = 0x2a0,
+	.timestamp_curr1_eof_addr         = 0x2a4,
+	.timestamp_prev0_eof_addr         = 0x2a8,
+	.timestamp_prev1_eof_addr         = 0x2ac,
+	/* configurations */
+	.halt_master_sel_master_val       = 0,
+	.halt_master_sel_shift            = 4,
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_master                 = 2,
+	.halt_mode_slave                  = 3,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.pix_store_en_shift_val           = 7,
+	.early_eof_en_shift_val           = 29,
+	.bin_qcfa_en_shift_val            = 30,
+	.bin_h_en_shift_val               = 2,
+	.bin_en_shift_val                 = 2,
+	.binning_supported                = 0x3,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.drop_v_en_shift_val              = 4,
+	.drop_h_en_shift_val              = 3,
+	.timestamp_en_shift_val           = 1,
+	.format_measure_en_shift_val      = 0,
+	.fatal_err_mask                   = 0x4,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_175_200_ppp_reg_info = {
+	.irq_status_addr                  = 0xa0,
+	.irq_mask_addr                    = 0xa4,
+	.irq_clear_addr                   = 0xa8,
+	.irq_set_addr                     = 0xac,
+	.cfg0_addr                        = 0x700,
+	.cfg1_addr                        = 0x704,
+	.ctrl_addr                        = 0x708,
+	.frm_drop_pattern_addr            = 0x70c,
+	.frm_drop_period_addr             = 0x710,
+	.irq_subsample_pattern_addr       = 0x714,
+	.irq_subsample_period_addr        = 0x718,
+	.hcrop_addr                       = 0x71c,
+	.vcrop_addr                       = 0x720,
+	.pix_drop_pattern_addr            = 0x724,
+	.pix_drop_period_addr             = 0x728,
+	.line_drop_pattern_addr           = 0x72c,
+	.line_drop_period_addr            = 0x730,
+	.rst_strobes_addr                 = 0x740,
+	.status_addr                      = 0x754,
+	.misr_val_addr                    = 0x758,
+	.format_measure_cfg0_addr         = 0x770,
+	.format_measure_cfg1_addr         = 0x774,
+	.format_measure0_addr             = 0x778,
+	.format_measure1_addr             = 0x77c,
+	.format_measure2_addr             = 0x780,
+	.timestamp_curr0_sof_addr         = 0x790,
+	.timestamp_curr1_sof_addr         = 0x794,
+	.timestamp_prev0_sof_addr         = 0x798,
+	.timestamp_prev1_sof_addr         = 0x79c,
+	.timestamp_curr0_eof_addr         = 0x7a0,
+	.timestamp_curr1_eof_addr         = 0x7a4,
+	.timestamp_prev0_eof_addr         = 0x7a8,
+	.timestamp_prev1_eof_addr         = 0x7ac,
+	/* configurations */
+	.halt_master_sel_master_val       = 3,
+	.halt_master_sel_shift            = 4,
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_master                 = 2,
+	.halt_mode_slave                  = 3,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.pix_store_en_shift_val           = 7,
+	.early_eof_en_shift_val           = 29,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.drop_v_en_shift_val              = 4,
+	.drop_h_en_shift_val              = 3,
+	.timestamp_en_shift_val           = 1,
+	.format_measure_en_shift_val      = 0,
+	.fatal_err_mask                   = 0x4,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_175_200_rdi_0_reg_info = {
+	.irq_status_addr                  = 0x40,
+	.irq_mask_addr                    = 0x44,
+	.irq_clear_addr                   = 0x48,
+	.irq_set_addr                     = 0x4c,
+	.cfg0_addr                        = 0x300,
+	.cfg1_addr                        = 0x304,
+	.ctrl_addr                        = 0x308,
+	.frm_drop_pattern_addr            = 0x30c,
+	.frm_drop_period_addr             = 0x310,
+	.irq_subsample_pattern_addr       = 0x314,
+	.irq_subsample_period_addr        = 0x318,
+	.hcrop_addr                       = 0x31c,
+	.vcrop_addr                       = 0x320,
+	.pix_drop_pattern_addr            = 0x324,
+	.pix_drop_period_addr             = 0x328,
+	.line_drop_pattern_addr           = 0x32c,
+	.line_drop_period_addr            = 0x330,
+	.rst_strobes_addr                 = 0x340,
+	.status_addr                      = 0x350,
+	.misr_val0_addr                   = 0x354,
+	.misr_val1_addr                   = 0x358,
+	.misr_val2_addr                   = 0x35c,
+	.misr_val3_addr                   = 0x360,
+	.format_measure_cfg0_addr         = 0x370,
+	.format_measure_cfg1_addr         = 0x374,
+	.format_measure0_addr             = 0x378,
+	.format_measure1_addr             = 0x37c,
+	.format_measure2_addr             = 0x380,
+	.timestamp_curr0_sof_addr         = 0x390,
+	.timestamp_curr1_sof_addr         = 0x394,
+	.timestamp_prev0_sof_addr         = 0x398,
+	.timestamp_prev1_sof_addr         = 0x39c,
+	.timestamp_curr0_eof_addr         = 0x3a0,
+	.timestamp_curr1_eof_addr         = 0x3a4,
+	.timestamp_prev0_eof_addr         = 0x3a8,
+	.timestamp_prev1_eof_addr         = 0x3ac,
+	.byte_cntr_ping_addr              = 0x3e0,
+	.byte_cntr_pong_addr              = 0x3e4,
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.ccif_violation_en                = 1,
+	.plain_fmt_shift_val              = 10,
+	.packing_fmt_shift_val            = 30,
+	.mipi_pack_supported              = 1,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.timestamp_en_shift_val           = 2,
+	.format_measure_en_shift_val      = 1,
+	.fatal_err_mask                   = 0x4,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_175_200_rdi_1_reg_info = {
+	.irq_status_addr                  = 0x50,
+	.irq_mask_addr                    = 0x54,
+	.irq_clear_addr                   = 0x58,
+	.irq_set_addr                     = 0x5c,
+	.cfg0_addr                        = 0x400,
+	.cfg1_addr                        = 0x404,
+	.ctrl_addr                        = 0x408,
+	.frm_drop_pattern_addr            = 0x40c,
+	.frm_drop_period_addr             = 0x410,
+	.irq_subsample_pattern_addr       = 0x414,
+	.irq_subsample_period_addr        = 0x418,
+	.hcrop_addr                       = 0x41c,
+	.vcrop_addr                       = 0x420,
+	.pix_drop_pattern_addr            = 0x424,
+	.pix_drop_period_addr             = 0x428,
+	.line_drop_pattern_addr           = 0x42c,
+	.line_drop_period_addr            = 0x430,
+	.rst_strobes_addr                 = 0x440,
+	.status_addr                      = 0x450,
+	.misr_val0_addr                   = 0x454,
+	.misr_val1_addr                   = 0x458,
+	.misr_val2_addr                   = 0x45c,
+	.misr_val3_addr                   = 0x460,
+	.format_measure_cfg0_addr         = 0x470,
+	.format_measure_cfg1_addr         = 0x474,
+	.format_measure0_addr             = 0x478,
+	.format_measure1_addr             = 0x47c,
+	.format_measure2_addr             = 0x480,
+	.timestamp_curr0_sof_addr         = 0x490,
+	.timestamp_curr1_sof_addr         = 0x494,
+	.timestamp_prev0_sof_addr         = 0x498,
+	.timestamp_prev1_sof_addr         = 0x49c,
+	.timestamp_curr0_eof_addr         = 0x4a0,
+	.timestamp_curr1_eof_addr         = 0x4a4,
+	.timestamp_prev0_eof_addr         = 0x4a8,
+	.timestamp_prev1_eof_addr         = 0x4ac,
+	.byte_cntr_ping_addr              = 0x4e0,
+	.byte_cntr_pong_addr              = 0x4e4,
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.ccif_violation_en                = 1,
+	.plain_fmt_shift_val              = 10,
+	.packing_fmt_shift_val            = 30,
+	.mipi_pack_supported              = 1,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.timestamp_en_shift_val           = 2,
+	.format_measure_en_shift_val      = 1,
+	.fatal_err_mask                   = 0x4,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_175_200_rdi_2_reg_info = {
+	.irq_status_addr                  = 0x60,
+	.irq_mask_addr                    = 0x64,
+	.irq_clear_addr                   = 0x68,
+	.irq_set_addr                     = 0x6c,
+	.cfg0_addr                        = 0x500,
+	.cfg1_addr                        = 0x504,
+	.ctrl_addr                        = 0x508,
+	.frm_drop_pattern_addr            = 0x50c,
+	.frm_drop_period_addr             = 0x510,
+	.irq_subsample_pattern_addr       = 0x514,
+	.irq_subsample_period_addr        = 0x518,
+	.hcrop_addr                       = 0x51c,
+	.vcrop_addr                       = 0x520,
+	.pix_drop_pattern_addr            = 0x524,
+	.pix_drop_period_addr             = 0x528,
+	.line_drop_pattern_addr           = 0x52c,
+	.line_drop_period_addr            = 0x530,
+	.yuv_chroma_conversion_addr       = 0x534,
+	.rst_strobes_addr                 = 0x540,
+	.status_addr                      = 0x550,
+	.misr_val0_addr                   = 0x554,
+	.misr_val1_addr                   = 0x558,
+	.misr_val2_addr                   = 0x55c,
+	.misr_val3_addr                   = 0x560,
+	.format_measure_cfg0_addr         = 0x570,
+	.format_measure_cfg1_addr         = 0x574,
+	.format_measure0_addr             = 0x578,
+	.format_measure1_addr             = 0x57c,
+	.format_measure2_addr             = 0x580,
+	.timestamp_curr0_sof_addr         = 0x590,
+	.timestamp_curr1_sof_addr         = 0x594,
+	.timestamp_prev0_sof_addr         = 0x598,
+	.timestamp_prev1_sof_addr         = 0x59c,
+	.timestamp_curr0_eof_addr         = 0x5a0,
+	.timestamp_curr1_eof_addr         = 0x5a4,
+	.timestamp_prev0_eof_addr         = 0x5a8,
+	.timestamp_prev1_eof_addr         = 0x5ac,
+	.byte_cntr_ping_addr              = 0x5e0,
+	.byte_cntr_pong_addr              = 0x5e4,
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.ccif_violation_en                = 1,
+	.plain_fmt_shift_val              = 10,
+	.mipi_pack_supported              = 1,
+	.packing_fmt_shift_val            = 30,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.timestamp_en_shift_val           = 2,
+	.format_measure_en_shift_val      = 1,
+	.fatal_err_mask                   = 0x4,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_info
+			cam_ife_csid_175_200_csi2_reg_info = {
+	.irq_status_addr                  = 0x20,
+	.irq_mask_addr                    = 0x24,
+	.irq_clear_addr                   = 0x28,
+	.irq_set_addr                     = 0x2c,
+	/*CSI2 rx control */
+	.cfg0_addr                       = 0x100,
+	.cfg1_addr                       = 0x104,
+	.capture_ctrl_addr               = 0x108,
+	.rst_strobes_addr                = 0x110,
+	.cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.captured_short_pkt_0_addr       = 0x128,
+	.captured_short_pkt_1_addr       = 0x12c,
+	.captured_long_pkt_0_addr        = 0x130,
+	.captured_long_pkt_1_addr        = 0x134,
+	.captured_long_pkt_ftr_addr      = 0x138,
+	.captured_cphy_pkt_hdr_addr      = 0x13c,
+	.lane0_misr_addr                 = 0x150,
+	.lane1_misr_addr                 = 0x154,
+	.lane2_misr_addr                 = 0x158,
+	.lane3_misr_addr                 = 0x15c,
+	.total_pkts_rcvd_addr            = 0x160,
+	.stats_ecc_addr                  = 0x164,
+	.total_crc_err_addr              = 0x168,
+	.de_scramble_type3_cfg0_addr     = 0x170,
+	.de_scramble_type3_cfg1_addr     = 0x174,
+	.de_scramble_type2_cfg0_addr     = 0x178,
+	.de_scramble_type2_cfg1_addr     = 0x17c,
+	.de_scramble_type1_cfg0_addr     = 0x180,
+	.de_scramble_type1_cfg1_addr     = 0x184,
+	.de_scramble_type0_cfg0_addr     = 0x188,
+	.de_scramble_type0_cfg1_addr     = 0x18c,
+
+	.rst_srb_all                     = 0x3FFF,
+	.rst_done_shift_val              = 27,
+	.irq_mask_all                    = 0xFFFFFFF,
+	.misr_enable_shift_val           = 6,
+	.vc_mode_shift_val               = 2,
+	.capture_long_pkt_en_shift       = 0,
+	.capture_short_pkt_en_shift      = 1,
+	.capture_cphy_pkt_en_shift       = 2,
+	.capture_long_pkt_dt_shift       = 4,
+	.capture_long_pkt_vc_shift       = 10,
+	.capture_short_pkt_vc_shift      = 15,
+	.capture_cphy_pkt_dt_shift       = 20,
+	.capture_cphy_pkt_vc_shift       = 26,
+	.phy_num_mask                    = 0x7,
+	.vc_mask                         = 0x7C00000,
+	.dt_mask                         = 0x3f0000,
+	.wc_mask                         = 0xffff,
+	.calc_crc_mask                   = 0xffff,
+	.expected_crc_mask               = 0xffff,
+	.ecc_correction_shift_en         = 0,
+	.lane_num_shift                  = 0,
+	.lane_cfg_shift                  = 4,
+	.phy_type_shift                  = 24,
+	.phy_num_shift                   = 20,
+	.fatal_err_mask                  = 0x78000,
+	.part_fatal_err_mask             = 0x1801800,
+	.non_fatal_err_mask              = 0x380000,
+};
+
+static struct cam_ife_csid_ver1_tpg_reg_info
+			cam_ife_csid_175_200_tpg_reg_info = {
+	/*CSID TPG control */
+	.ctrl_addr                       = 0x600,
+	.vc_cfg0_addr                    = 0x604,
+	.vc_cfg1_addr                    = 0x608,
+	.lfsr_seed_addr                  = 0x60c,
+	.dt_n_cfg_0_addr                 = 0x610,
+	.dt_n_cfg_1_addr                 = 0x614,
+	.dt_n_cfg_2_addr                 = 0x618,
+	.color_bars_cfg_addr             = 0x640,
+	.color_box_cfg_addr              = 0x644,
+	.common_gen_cfg_addr             = 0x648,
+	.cgen_n_cfg_addr                 = 0x650,
+	.cgen_n_x0_addr                  = 0x654,
+	.cgen_n_x1_addr                  = 0x658,
+	.cgen_n_x2_addr                  = 0x65c,
+	.cgen_n_xy_addr                  = 0x660,
+	.cgen_n_y1_addr                  = 0x664,
+	.cgen_n_y2_addr                  = 0x668,
+	/* configurations */
+	.dtn_cfg_offset                  = 0xc,
+	.cgen_cfg_offset                 = 0x20,
+	.cpas_ife_reg_offset             = 0x28,
+	.hbi                             = 0x740,
+	.vbi                             = 0x3FF,
+	.ctrl_cfg                        = 0x408007,
+	.lfsr_seed                       = 0x12345678,
+	.color_bar                       = 1,
+	.num_frames                      = 0,
+	.line_interleave_mode            = 0x1,
+	.payload_mode                    = 0x8,
+	.num_active_lanes_mask           = 0x30,
+	.num_active_dt                   = 0,
+	.fmt_shift                       = 16,
+	.num_frame_shift                 = 16,
+	.width_shift                     = 16,
+	.vbi_shift                       = 12,
+	.line_interleave_shift           = 10,
+	.num_active_dt_shift             = 8,
+	.color_bar_shift                 = 5,
+	.height_shift                    = 0,
+	.hbi_shift                       = 0,
+};
+
+static struct cam_ife_csid_ver1_common_reg_info
+			cam_ife_csid_175_200_cmn_reg_info = {
+	.hw_version_addr                 = 0x0,
+	.cfg0_addr                       = 0x4,
+	.ctrl_addr                       = 0x8,
+	.reset_addr                      = 0xc,
+	.rst_strobes_addr                = 0x10,
+	.test_bus_ctrl_addr              = 0x14,
+	.top_irq_status_addr             = 0x70,
+	.top_irq_mask_addr               = 0x74,
+	.top_irq_clear_addr              = 0x78,
+	.top_irq_set_addr                = 0x7c,
+	.irq_cmd_addr                    = 0x80,
+
+	/*configurations */
+	.major_version                   = 1,
+	.minor_version                   = 7,
+	.version_incr                    = 5,
+	.num_rdis                        = 3,
+	.num_pix                         = 1,
+	.num_ppp                         = 1,
+	.rst_sw_reg_stb                  = 1,
+	.rst_hw_reg_stb                  = 0x1e,
+	.rst_sw_hw_reg_stb               = 0x1f,
+	.path_rst_stb_all                = 0x7f,
+	.rst_done_shift_val              = 1,
+	.path_en_shift_val               = 31,
+	.dt_id_shift_val                 = 27,
+	.vc_shift_val                    = 22,
+	.dt_shift_val                    = 16,
+	.fmt_shift_val                   = 12,
+	.crop_shift_val                  = 16,
+	.decode_format_shift_val         = 12,
+	.crop_pix_start_mask             = 0x3fff,
+	.crop_pix_end_mask               = 0xffff,
+	.crop_line_start_mask            = 0x3fff,
+	.crop_line_end_mask              = 0xffff,
+	.ipp_irq_mask_all                = 0xFFFF,
+	.rdi_irq_mask_all                = 0xFFFF,
+	.ppp_irq_mask_all                = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask     = 0xC,
+	.timestamp_strobe_val            = 0x2,
+	.timestamp_stb_sel_shift_val     = 0,
+	.format_measure_height_mask_val  = 0xFFFF,
+	.format_measure_height_shift_val = 0x10,
+	.format_measure_width_mask_val   = 0xFFFF,
+	.format_measure_width_shift_val  = 0x0,
+};
+
+static struct cam_ife_csid_ver1_reg_info cam_ife_csid_175_200_reg_info = {
+	.cmn_reg          = &cam_ife_csid_175_200_cmn_reg_info,
+	.csi2_reg         = &cam_ife_csid_175_200_csi2_reg_info,
+	.ipp_reg          = &cam_ife_csid_175_200_ipp_reg_info,
+	.ppp_reg          = &cam_ife_csid_175_200_ppp_reg_info,
+	.rdi_reg = {
+		&cam_ife_csid_175_200_rdi_0_reg_info,
+		&cam_ife_csid_175_200_rdi_1_reg_info,
+		&cam_ife_csid_175_200_rdi_2_reg_info,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_175_200_tpg_reg_info,
+};
+#endif /*_CAM_IFE_CSID_175_200_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid480.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid480.h
@@ -0,0 +1,535 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_480_H_
+#define _CAM_IFE_CSID_480_H_
+
+#include <linux/module.h>
+#include "camera_main.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+
+#define CAM_CSID_VERSION_V480                 0x40080000
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_480_ipp_reg_info = {
+	.irq_status_addr                  = 0x30,
+	.irq_mask_addr                    = 0x34,
+	.irq_clear_addr                   = 0x38,
+	.irq_set_addr                     = 0x3c,
+
+	.cfg0_addr                        = 0x200,
+	.cfg1_addr                        = 0x204,
+	.ctrl_addr                        = 0x208,
+	.frm_drop_pattern_addr            = 0x20c,
+	.frm_drop_period_addr             = 0x210,
+	.irq_subsample_pattern_addr       = 0x214,
+	.irq_subsample_period_addr        = 0x218,
+	.hcrop_addr                       = 0x21c,
+	.vcrop_addr                       = 0x220,
+	.pix_drop_pattern_addr            = 0x224,
+	.pix_drop_period_addr             = 0x228,
+	.line_drop_pattern_addr           = 0x22c,
+	.line_drop_period_addr            = 0x230,
+	.rst_strobes_addr                 = 0x240,
+	.status_addr                      = 0x254,
+	.misr_val_addr                    = 0x258,
+	.format_measure_cfg0_addr         = 0x270,
+	.format_measure_cfg1_addr         = 0x274,
+	.format_measure0_addr             = 0x278,
+	.format_measure1_addr             = 0x27c,
+	.format_measure2_addr             = 0x280,
+	.timestamp_curr0_sof_addr         = 0x290,
+	.timestamp_curr1_sof_addr         = 0x294,
+	.timestamp_prev0_sof_addr         = 0x298,
+	.timestamp_prev1_sof_addr         = 0x29c,
+	.timestamp_curr0_eof_addr         = 0x2a0,
+	.timestamp_curr1_eof_addr         = 0x2a4,
+	.timestamp_prev0_eof_addr         = 0x2a8,
+	.timestamp_prev1_eof_addr         = 0x2ac,
+	.err_recovery_cfg0_addr           = 0x2d0,
+	.err_recovery_cfg1_addr           = 0x2d4,
+	.err_recovery_cfg2_addr           = 0x2d8,
+	.multi_vcdt_cfg0_addr             = 0x2dc,
+	/* configurations */
+	.pix_store_en_shift_val           = 7,
+	.early_eof_en_shift_val           = 29,
+	.ccif_violation_en                = 1,
+	.overflow_ctrl_en                 = 1,
+	//.hblank_cfg_shift_val             = 4,
+	.halt_master_sel_master_val       = 0,
+	.halt_master_sel_shift            = 4,
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_master                 = 2,
+	.halt_mode_slave                  = 3,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.drop_v_en_shift_val              = 4,
+	.drop_h_en_shift_val              = 3,
+	.bin_h_en_shift_val               = 2,
+	.bin_en_shift_val                 = 2,
+	.bin_qcfa_en_shift_val            = 30,
+	.binning_supported                = 0x3,
+	.overflow_ctrl_mode_val           = 0x8,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.timestamp_en_shift_val           = 1,
+	.format_measure_en_shift_val      = 0,
+	.fatal_err_mask                   = 0x26004,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_480_ppp_reg_info = {
+	.irq_status_addr                  = 0xa0,
+	.irq_mask_addr                    = 0xa4,
+	.irq_clear_addr                   = 0xa8,
+	.irq_set_addr                     = 0xac,
+
+	.cfg0_addr                        = 0x700,
+	.cfg1_addr                        = 0x704,
+	.ctrl_addr                        = 0x708,
+	.frm_drop_pattern_addr            = 0x70c,
+	.frm_drop_period_addr             = 0x710,
+	.irq_subsample_pattern_addr       = 0x714,
+	.irq_subsample_period_addr        = 0x718,
+	.hcrop_addr                       = 0x71c,
+	.vcrop_addr                       = 0x720,
+	.pix_drop_pattern_addr            = 0x724,
+	.pix_drop_period_addr             = 0x728,
+	.line_drop_pattern_addr           = 0x72c,
+	.line_drop_period_addr            = 0x730,
+	.rst_strobes_addr                 = 0x740,
+	.status_addr                      = 0x754,
+	.misr_val_addr                    = 0x758,
+	.format_measure_cfg0_addr         = 0x770,
+	.format_measure_cfg1_addr         = 0x774,
+	.format_measure0_addr             = 0x778,
+	.format_measure1_addr             = 0x77c,
+	.format_measure2_addr             = 0x780,
+	.timestamp_curr0_sof_addr         = 0x790,
+	.timestamp_curr1_sof_addr         = 0x794,
+	.timestamp_prev0_sof_addr         = 0x798,
+	.timestamp_prev1_sof_addr         = 0x79c,
+	.timestamp_curr0_eof_addr         = 0x7a0,
+	.timestamp_curr1_eof_addr         = 0x7a4,
+	.timestamp_prev0_eof_addr         = 0x7a8,
+	.timestamp_prev1_eof_addr         = 0x7ac,
+	.err_recovery_cfg0_addr           = 0x7d0,
+	.err_recovery_cfg1_addr           = 0x7d4,
+	.err_recovery_cfg2_addr           = 0x7d8,
+	.multi_vcdt_cfg0_addr             = 0x7dc,
+	/* configurations */
+	.halt_master_sel_master_val       = 3,
+	.halt_master_sel_shift            = 4,
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_master                 = 2,
+	.halt_mode_slave                  = 3,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.drop_v_en_shift_val              = 4,
+	.drop_h_en_shift_val              = 3,
+	.pix_store_en_shift_val           = 7,
+	.early_eof_en_shift_val           = 29,
+	.ccif_violation_en                = 1,
+	.overflow_ctrl_en                 = 1,
+	.overflow_ctrl_mode_val           = 0x8,
+	.timestamp_en_shift_val           = 1,
+	.format_measure_en_shift_val      = 0,
+	.fatal_err_mask                   = 0x26004,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_480_rdi_0_reg_info = {
+	.irq_status_addr                  = 0x40,
+	.irq_mask_addr                    = 0x44,
+	.irq_clear_addr                   = 0x48,
+	.irq_set_addr                     = 0x4c,
+	.cfg0_addr                        = 0x300,
+	.cfg1_addr                        = 0x304,
+	.ctrl_addr                        = 0x308,
+	.frm_drop_pattern_addr            = 0x30c,
+	.frm_drop_period_addr             = 0x310,
+	.irq_subsample_pattern_addr       = 0x314,
+	.irq_subsample_period_addr        = 0x318,
+	.hcrop_addr                       = 0x31c,
+	.vcrop_addr                       = 0x320,
+	.pix_drop_pattern_addr            = 0x324,
+	.pix_drop_period_addr             = 0x328,
+	.line_drop_pattern_addr           = 0x32c,
+	.line_drop_period_addr            = 0x330,
+	.rst_strobes_addr                 = 0x340,
+	.status_addr                      = 0x350,
+	.misr_val0_addr                   = 0x354,
+	.misr_val1_addr                   = 0x358,
+	.misr_val2_addr                   = 0x35c,
+	.misr_val3_addr                   = 0x360,
+	.format_measure_cfg0_addr         = 0x370,
+	.format_measure_cfg1_addr         = 0x374,
+	.format_measure0_addr             = 0x378,
+	.format_measure1_addr             = 0x37c,
+	.format_measure2_addr             = 0x380,
+	.timestamp_curr0_sof_addr         = 0x390,
+	.timestamp_curr1_sof_addr         = 0x394,
+	.timestamp_prev0_sof_addr         = 0x398,
+	.timestamp_prev1_sof_addr         = 0x39c,
+	.timestamp_curr0_eof_addr         = 0x3a0,
+	.timestamp_curr1_eof_addr         = 0x3a4,
+	.timestamp_prev0_eof_addr         = 0x3a8,
+	.timestamp_prev1_eof_addr         = 0x3ac,
+	.err_recovery_cfg0_addr           = 0x3b0,
+	.err_recovery_cfg1_addr           = 0x3b4,
+	.err_recovery_cfg2_addr           = 0x3b8,
+	.multi_vcdt_cfg0_addr             = 0x3bc,
+	.byte_cntr_ping_addr              = 0x3e0,
+	.byte_cntr_pong_addr              = 0x3e4,
+	/* configurations */
+	.halt_mode_internal               = 0,
+	.halt_mode_global                 = 1,
+	.halt_mode_shift                  = 2,
+	.halt_frame_boundary              = 0,
+	.resume_frame_boundary            = 1,
+	.halt_immediate                   = 2,
+	.halt_cmd_shift                   = 0,
+	.crop_v_en_shift_val              = 6,
+	.crop_h_en_shift_val              = 5,
+	.drop_v_en_shift_val              = 4,
+	.drop_h_en_shift_val              = 3,
+	.plain_fmt_shift_val              = 10,
+	.ccif_violation_en                = 1,
+	.overflow_ctrl_en                 = 1,
+	.overflow_ctrl_mode_val           = 0x8,
+	.packing_fmt_shift_val            = 30,
+	.mipi_pack_supported              = 1,
+	.timestamp_en_shift_val           = 2,
+	.format_measure_en_shift_val      = 1,
+	.fatal_err_mask                   = 0x26004,
+	.non_fatal_err_mask               = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_480_rdi_1_reg_info = {
+	.irq_status_addr                 = 0x50,
+	.irq_mask_addr                   = 0x54,
+	.irq_clear_addr                  = 0x58,
+	.irq_set_addr                    = 0x5c,
+	.cfg0_addr                       = 0x400,
+	.cfg1_addr                       = 0x404,
+	.ctrl_addr                       = 0x408,
+	.frm_drop_pattern_addr           = 0x40c,
+	.frm_drop_period_addr            = 0x410,
+	.irq_subsample_pattern_addr      = 0x414,
+	.irq_subsample_period_addr       = 0x418,
+	.hcrop_addr                      = 0x41c,
+	.vcrop_addr                      = 0x420,
+	.pix_drop_pattern_addr           = 0x424,
+	.pix_drop_period_addr            = 0x428,
+	.line_drop_pattern_addr          = 0x42c,
+	.line_drop_period_addr           = 0x430,
+	.rst_strobes_addr                = 0x440,
+	.status_addr                     = 0x450,
+	.misr_val0_addr                  = 0x454,
+	.misr_val1_addr                  = 0x458,
+	.misr_val2_addr                  = 0x45c,
+	.misr_val3_addr                  = 0x460,
+	.format_measure_cfg0_addr        = 0x470,
+	.format_measure_cfg1_addr        = 0x474,
+	.format_measure0_addr            = 0x478,
+	.format_measure1_addr            = 0x47c,
+	.format_measure2_addr            = 0x480,
+	.timestamp_curr0_sof_addr        = 0x490,
+	.timestamp_curr1_sof_addr        = 0x494,
+	.timestamp_prev0_sof_addr        = 0x498,
+	.timestamp_prev1_sof_addr        = 0x49c,
+	.timestamp_curr0_eof_addr        = 0x4a0,
+	.timestamp_curr1_eof_addr        = 0x4a4,
+	.timestamp_prev0_eof_addr        = 0x4a8,
+	.timestamp_prev1_eof_addr        = 0x4ac,
+	.err_recovery_cfg0_addr          = 0x4b0,
+	.err_recovery_cfg1_addr          = 0x4b4,
+	.err_recovery_cfg2_addr          = 0x4b8,
+	.multi_vcdt_cfg0_addr            = 0x4bc,
+	.byte_cntr_ping_addr             = 0x4e0,
+	.byte_cntr_pong_addr             = 0x4e4,
+	/* configurations */
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.drop_v_en_shift_val             = 4,
+	.drop_h_en_shift_val             = 3,
+	.plain_fmt_shift_val             = 10,
+	.ccif_violation_en               = 1,
+	.overflow_ctrl_en                = 1,
+	.overflow_ctrl_mode_val          = 0x8,
+	.packing_fmt_shift_val           = 30,
+	.mipi_pack_supported             = 1,
+	.timestamp_en_shift_val          = 2,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x26004,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+			cam_ife_csid_480_rdi_2_reg_info = {
+	.irq_status_addr                 = 0x60,
+	.irq_mask_addr                   = 0x64,
+	.irq_clear_addr                  = 0x68,
+	.irq_set_addr                    = 0x6c,
+	.cfg0_addr                       = 0x500,
+	.cfg1_addr                       = 0x504,
+	.ctrl_addr                       = 0x508,
+	.frm_drop_pattern_addr           = 0x50c,
+	.frm_drop_period_addr            = 0x510,
+	.irq_subsample_pattern_addr      = 0x514,
+	.irq_subsample_period_addr       = 0x518,
+	.hcrop_addr                      = 0x51c,
+	.vcrop_addr                      = 0x520,
+	.pix_drop_pattern_addr           = 0x524,
+	.pix_drop_period_addr            = 0x528,
+	.line_drop_pattern_addr          = 0x52c,
+	.line_drop_period_addr           = 0x530,
+	.yuv_chroma_conversion_addr      = 0x534,
+	.rst_strobes_addr                = 0x540,
+	.status_addr                     = 0x550,
+	.misr_val0_addr                  = 0x554,
+	.misr_val1_addr                  = 0x558,
+	.misr_val2_addr                  = 0x55c,
+	.misr_val3_addr                  = 0x560,
+	.format_measure_cfg0_addr        = 0x570,
+	.format_measure_cfg1_addr        = 0x574,
+	.format_measure0_addr            = 0x578,
+	.format_measure1_addr            = 0x57c,
+	.format_measure2_addr            = 0x580,
+	.timestamp_curr0_sof_addr        = 0x590,
+	.timestamp_curr1_sof_addr        = 0x594,
+	.timestamp_prev0_sof_addr        = 0x598,
+	.timestamp_prev1_sof_addr        = 0x59c,
+	.timestamp_curr0_eof_addr        = 0x5a0,
+	.timestamp_curr1_eof_addr        = 0x5a4,
+	.timestamp_prev0_eof_addr        = 0x5a8,
+	.timestamp_prev1_eof_addr        = 0x5ac,
+	.err_recovery_cfg0_addr          = 0x5b0,
+	.err_recovery_cfg1_addr          = 0x5b4,
+	.err_recovery_cfg2_addr          = 0x5b8,
+	.multi_vcdt_cfg0_addr            = 0x5bc,
+	.byte_cntr_ping_addr             = 0x5e0,
+	.byte_cntr_pong_addr             = 0x5e4,
+	/* configurations */
+	.halt_mode_internal              = 0,
+	.halt_mode_global                = 1,
+	.halt_mode_shift                 = 2,
+	.halt_frame_boundary             = 0,
+	.resume_frame_boundary           = 1,
+	.halt_immediate                  = 2,
+	.halt_cmd_shift                  = 0,
+	.crop_v_en_shift_val             = 6,
+	.crop_h_en_shift_val             = 5,
+	.drop_v_en_shift_val             = 4,
+	.drop_h_en_shift_val             = 3,
+	.plain_fmt_shift_val             = 10,
+	.ccif_violation_en               = 1,
+	.overflow_ctrl_en                = 1,
+	.overflow_ctrl_mode_val          = 0x8,
+	.packing_fmt_shift_val           = 30,
+	.mipi_pack_supported             = 1,
+	.timestamp_en_shift_val          = 2,
+	.format_measure_en_shift_val     = 1,
+	.fatal_err_mask                  = 0x26004,
+	.non_fatal_err_mask              = 0xe000,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_info
+			cam_ife_csid_480_csi2_reg_info = {
+	.irq_status_addr                 = 0x20,
+	.irq_mask_addr                   = 0x24,
+	.irq_clear_addr                  = 0x28,
+	.irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.cfg0_addr                       = 0x100,
+	.cfg1_addr                       = 0x104,
+	.capture_ctrl_addr               = 0x108,
+	.rst_strobes_addr                = 0x110,
+	.de_scramble_cfg0_addr           = 0x114,
+	.de_scramble_cfg1_addr           = 0x118,
+	.cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.captured_short_pkt_0_addr       = 0x128,
+	.captured_short_pkt_1_addr       = 0x12c,
+	.captured_long_pkt_0_addr        = 0x130,
+	.captured_long_pkt_1_addr        = 0x134,
+	.captured_long_pkt_ftr_addr      = 0x138,
+	.captured_cphy_pkt_hdr_addr      = 0x13c,
+	.lane0_misr_addr                 = 0x150,
+	.lane1_misr_addr                 = 0x154,
+	.lane2_misr_addr                 = 0x158,
+	.lane3_misr_addr                 = 0x15c,
+	.total_pkts_rcvd_addr            = 0x160,
+	.stats_ecc_addr                  = 0x164,
+	.total_crc_err_addr              = 0x168,
+
+	.rst_srb_all                     = 0x3FFF,
+	.rst_done_shift_val              = 27,
+	.irq_mask_all                    = 0xFFFFFFF,
+	.misr_enable_shift_val           = 6,
+	.vc_mode_shift_val               = 2,
+	.capture_long_pkt_en_shift       = 0,
+	.capture_short_pkt_en_shift      = 1,
+	.capture_cphy_pkt_en_shift       = 2,
+	.capture_long_pkt_dt_shift       = 4,
+	.capture_long_pkt_vc_shift       = 10,
+	.capture_short_pkt_vc_shift      = 15,
+	.capture_cphy_pkt_dt_shift       = 20,
+	.capture_cphy_pkt_vc_shift       = 26,
+	.phy_num_mask                    = 0x7,
+	.vc_mask                         = 0x7C00000,
+	.dt_mask                         = 0x3f0000,
+	.wc_mask                         = 0xffff,
+	.calc_crc_mask                   = 0xffff,
+	.expected_crc_mask               = 0xffff,
+	.ecc_correction_shift_en         = 0,
+	.lane_num_shift                  = 0,
+	.lane_cfg_shift                  = 4,
+	.phy_type_shift                  = 24,
+	.phy_num_shift                   = 20,
+	.fatal_err_mask                  = 0x59FA800,
+	.part_fatal_err_mask             = 0x0001000,
+	.non_fatal_err_mask              = 0x0200000,
+};
+
+static struct cam_ife_csid_ver1_tpg_reg_info
+			cam_ife_csid_480_tpg_reg_info = {
+	/*CSID TPG control */
+	.ctrl_addr                       = 0x600,
+	.vc_cfg0_addr                    = 0x604,
+	.vc_cfg1_addr                    = 0x608,
+	.lfsr_seed_addr                  = 0x60c,
+	.dt_n_cfg_0_addr                 = 0x610,
+	.dt_n_cfg_1_addr                 = 0x614,
+	.dt_n_cfg_2_addr                 = 0x618,
+	.color_bars_cfg_addr             = 0x640,
+	.color_box_cfg_addr              = 0x644,
+	.common_gen_cfg_addr             = 0x648,
+	.cgen_n_cfg_addr                 = 0x650,
+	.cgen_n_x0_addr                  = 0x654,
+	.cgen_n_x1_addr                  = 0x658,
+	.cgen_n_x2_addr                  = 0x65c,
+	.cgen_n_xy_addr                  = 0x660,
+	.cgen_n_y1_addr                  = 0x664,
+	.cgen_n_y2_addr                  = 0x668,
+
+	/* configurations */
+	.dtn_cfg_offset                  = 0xc,
+	.cgen_cfg_offset                 = 0x20,
+	.cpas_ife_reg_offset             = 0x28,
+	.hbi                             = 0x740,
+	.vbi                             = 0x3FF,
+	.ctrl_cfg                        = 0x408007,
+	.lfsr_seed                       = 0x12345678,
+	.color_bar                       = 1,
+	.num_frames                      = 0,
+	.line_interleave_mode            = 0x1,
+	.payload_mode                    = 0x8,
+	.num_active_lanes_mask           = 0x30,
+	.num_active_dt                   = 0,
+	.fmt_shift                       = 16,
+	.num_frame_shift                 = 16,
+	.width_shift                     = 16,
+	.vbi_shift                       = 12,
+	.line_interleave_shift           = 10,
+	.num_active_dt_shift             = 8,
+	.color_bar_shift                 = 5,
+	.height_shift                    = 0,
+	.hbi_shift                       = 0,
+};
+
+static struct cam_ife_csid_ver1_common_reg_info
+			cam_ife_csid_480_cmn_reg_info = {
+	.hw_version_addr                 = 0x0,
+	.cfg0_addr                       = 0x4,
+	.ctrl_addr                       = 0x8,
+	.reset_addr                      = 0xc,
+	.rst_strobes_addr                = 0x10,
+
+	.test_bus_ctrl_addr              = 0x14,
+	.top_irq_status_addr             = 0x70,
+	.top_irq_mask_addr               = 0x74,
+	.top_irq_clear_addr              = 0x78,
+	.top_irq_set_addr                = 0x7c,
+	.irq_cmd_addr                    = 0x80,
+
+	/*configurations */
+	.major_version                   = 1,
+	.minor_version                   = 7,
+	.version_incr                    = 0,
+	.num_rdis                        = 3,
+	.num_pix                         = 1,
+	.num_ppp                         = 1,
+	.drop_supported                  = 1,
+	.early_eof_supported             = 1,
+	.rst_sw_reg_stb                  = 1,
+	.rst_hw_reg_stb                  = 0x1e,
+	.rst_sw_hw_reg_stb               = 0x1f,
+	.path_rst_stb_all                = 0x7f,
+	.rst_done_shift_val              = 1,
+	.path_en_shift_val               = 31,
+	.dt_id_shift_val                 = 27,
+	.vc_shift_val                    = 22,
+	.dt_shift_val                    = 16,
+	.fmt_shift_val                   = 12,
+	.crop_shift_val                  = 16,
+	.decode_format_shift_val         = 12,
+	.multi_vcdt_vc1_shift_val        = 2,
+	.multi_vcdt_dt1_shift_val        = 7,
+	.timestamp_strobe_val            = 0x2,
+	.timestamp_stb_sel_shift_val     = 0,
+	.multi_vcdt_en_shift_val         = 0,
+	.crop_pix_start_mask             = 0x3fff,
+	.crop_pix_end_mask               = 0xffff,
+	.crop_line_start_mask            = 0x3fff,
+	.crop_line_end_mask              = 0xffff,
+	.ipp_irq_mask_all                = 0x7FFF,
+	.rdi_irq_mask_all                = 0x7FFF,
+	.ppp_irq_mask_all                = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask     = 0xC,
+	.format_measure_height_mask_val  = 0xFFFF,
+	.format_measure_height_shift_val = 0x10,
+	.format_measure_width_mask_val   = 0xFFFF,
+	.format_measure_width_shift_val  = 0x0,
+};
+
+static struct cam_ife_csid_ver1_reg_info cam_ife_csid_480_reg_info = {
+	.cmn_reg          = &cam_ife_csid_480_cmn_reg_info,
+	.csi2_reg         = &cam_ife_csid_480_csi2_reg_info,
+	.ipp_reg          = &cam_ife_csid_480_ipp_reg_info,
+	.ppp_reg          = &cam_ife_csid_480_ppp_reg_info,
+	.rdi_reg = {
+		&cam_ife_csid_480_rdi_0_reg_info,
+		&cam_ife_csid_480_rdi_1_reg_info,
+		&cam_ife_csid_480_rdi_2_reg_info,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_480_tpg_reg_info,
+	.csid_cust_node_map = {0x2, 0x4},
+};
+#endif /*_CAM_IFE_CSID_480_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid570.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid570.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_570_H_
+#define _CAM_IFE_CSID_570_H_
+
+#include <linux/module.h>
+#include "camera_main.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+
+/* Settings for 570 CSID are leveraged from 480 */
+static struct cam_ife_csid_ver1_reg_info cam_ife_csid_570_reg_info = {
+	.cmn_reg          = &cam_ife_csid_480_cmn_reg_info,
+	.csi2_reg         = &cam_ife_csid_480_csi2_reg_info,
+	.ipp_reg          = &cam_ife_csid_480_ipp_reg_info,
+	.ppp_reg          = &cam_ife_csid_480_ppp_reg_info,
+	.rdi_reg = {
+		&cam_ife_csid_480_rdi_0_reg_info,
+		&cam_ife_csid_480_rdi_1_reg_info,
+		&cam_ife_csid_480_rdi_2_reg_info,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_480_tpg_reg_info,
+	.width_fuse_max_val = 3,
+	.fused_max_width = {5612, 6048, 7308, UINT_MAX},
+};
+#endif /*_CAM_IFE_CSID_570_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid580.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid580.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_580_H_
+#define _CAM_IFE_CSID_580_H_
+
+#include <linux/module.h>
+#include "camera_main.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+
+/* Settings for 580 CSID are leveraged from 480 */
+static struct cam_ife_csid_ver1_reg_info cam_ife_csid_580_reg_info = {
+	.cmn_reg          = &cam_ife_csid_480_cmn_reg_info,
+	.csi2_reg         = &cam_ife_csid_480_csi2_reg_info,
+	.ipp_reg          = &cam_ife_csid_480_ipp_reg_info,
+	.ppp_reg          = &cam_ife_csid_480_ppp_reg_info,
+	.rdi_reg = {
+		&cam_ife_csid_480_rdi_0_reg_info,
+		&cam_ife_csid_480_rdi_1_reg_info,
+		&cam_ife_csid_480_rdi_2_reg_info,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_480_tpg_reg_info,
+	.csid_cust_node_map = {0x2, 0x4},
+	.width_fuse_max_val = 3,
+	.fused_max_width = {5612, 6048, 7308, UINT_MAX},
+};
+#endif /*_CAM_IFE_CSID_580_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid680.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid680.h
@@ -0,0 +1,1351 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_680_H_
+#define _CAM_IFE_CSID_680_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+#define CAM_CSID_VERSION_V680                 0x60080000
+
+static uint32_t cam_ife_csid_680_num_top_regs[] = {0,};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_680_rx_irq_desc[][32] = {
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "DL0_EOT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "DL1_EOT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "DL2_EOT",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "DL3_EOT",
+		},
+		{
+			.bitmask = BIT(4),
+			.desc = "DL0_SOT",
+		},
+		{
+			.bitmask = BIT(5),
+			.desc = "DL1_SOT",
+		},
+		{
+			.bitmask = BIT(6),
+			.desc = "DL2_SOT",
+		},
+		{
+			.bitmask = BIT(7),
+			.desc = "DL3_SOT",
+		},
+		{
+			.bitmask = BIT(8),
+			.desc = "LONG_PKT",
+		},
+		{
+			.bitmask = BIT(9),
+			.desc = "SHORT_PKT",
+		},
+		{
+			.bitmask = BIT(10),
+			.desc = "CPHY_PKT_HDR",
+		},
+		{
+			.bitmask = BIT(11),
+			.desc = "ERROR_CPHY_EOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(12),
+			.desc = "ERROR_CPHY_SOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(13),
+			.desc = "ERROR_CPHY_PH_CRC",
+		},
+		{
+			.bitmask = BIT(14),
+			.desc = "WARNING_ECC",
+		},
+		{
+			.bitmask = BIT(15),
+			.desc = "ERROR_LANE0_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(16),
+			.desc = "ERROR_LANE1_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(17),
+			.desc = "ERROR_LANE2_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(18),
+			.desc = "ERROR_LANE3_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(19),
+			.desc = "ERROR_CRC",
+		},
+		{
+			.bitmask = BIT(20),
+			.desc = "ERROR_ECC",
+		},
+		{
+			.bitmask = BIT(21),
+			.desc = "ERROR_MMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(22),
+			.desc = "ERROR_UNMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(23),
+			.desc = "ERROR_STREAM_UNDERFLOW",
+		},
+		{
+			.bitmask = BIT(24),
+			.desc = "ERROR_UNBOUNDED_FRAME",
+		},
+	},
+};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_680_path_irq_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "ERROR_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "CAMIF_EOF",
+	},
+	{
+		.bitmask = BIT(4),
+		.desc = "CAMIF_SOF",
+	},
+	{
+		.bitmask = BIT(5),
+		.desc = "FRAME_DROP_EOF",
+	},
+	{
+		.bitmask = BIT(6),
+		.desc = "FRAME_DROP_EOL",
+	},
+	{
+		.bitmask = BIT(7),
+		.desc = "FRAME_DROP_SOL",
+	},
+	{
+		.bitmask = BIT(8),
+		.desc = "FRAME_DROP_SOF",
+	},
+	{
+		.bitmask = BIT(9),
+		.desc = "INFO_INPUT_EOF",
+	},
+	{
+		.bitmask = BIT(10),
+		.desc = "INFO_INPUT_EOL",
+	},
+	{
+		.bitmask = BIT(11),
+		.desc = "INFO_INPUT_SOL",
+	},
+	{
+		.bitmask = BIT(12),
+		.desc = "INFO_INPUT_SOF",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(14),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_LINE_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(15),
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.bitmask = BIT(16),
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.bitmask = BIT(17),
+		.desc = "VCDT_GRP_CHANGE",
+	},
+	{
+		.bitmask = BIT(18),
+		.desc = "FRAME_DROP",
+	},
+	{
+		.bitmask = BIT(19),
+		.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+		.desc = "OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.bitmask = BIT(20),
+		.desc = "ERROR_REC_CCIF_VIOLATION From Camif",
+	},
+	{
+		.bitmask = BIT(21),
+		.desc = "CAMIF_EPOCH0",
+	},
+	{
+		.bitmask = BIT(22),
+		.desc = "CAMIF_EPOCH1",
+	},
+	{
+		.bitmask = BIT(23),
+		.desc = "RUP_DONE",
+	},
+	{
+		.bitmask = BIT(24),
+		.desc = "ILLEGAL_BATCH_ID",
+	},
+	{
+		.bitmask = BIT(25),
+		.desc = "BATCH_END_MISSING_VIOLATION",
+	},
+	{
+		.bitmask = BIT(26),
+		.desc = "HEIGHT_VIOLATION",
+	},
+	{
+		.bitmask = BIT(27),
+		.desc = "WIDTH_VIOLATION",
+	},
+	{
+		.bitmask = BIT(28),
+		.desc = "SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP",
+		.err_handler = cam_ife_csid_hw_ver2_mup_mismatch_handler,
+	},
+	{
+		.bitmask = BIT(29),
+		.desc = "CCIF_VIOLATION: Bad frame timings",
+	},
+};
+
+static struct cam_irq_register_set cam_ife_csid_680_irq_reg_set[9] = {
+	/* Top */
+	{
+		.mask_reg_offset   = 0x00000080,
+		.clear_reg_offset  = 0x00000084,
+		.status_reg_offset = 0x0000007C,
+		.set_reg_offset    = 0x00000088,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	/* RX */
+	{
+		.mask_reg_offset   = 0x000000A0,
+		.clear_reg_offset  = 0x000000A4,
+		.status_reg_offset = 0x0000009C,
+	},
+	/* RDI0 */
+	{
+		.mask_reg_offset   = 0x000000F0,
+		.clear_reg_offset  = 0x000000F4,
+		.status_reg_offset = 0x000000EC,
+	},
+	/* RDI1 */
+	{
+		.mask_reg_offset   = 0x00000100,
+		.clear_reg_offset  = 0x00000104,
+		.status_reg_offset = 0x000000FC,
+	},
+	/* RDI2 */
+	{
+		.mask_reg_offset   = 0x00000110,
+		.clear_reg_offset  = 0x00000114,
+		.status_reg_offset = 0x0000010C,
+	},
+	/* RDI3 */
+	{
+		.mask_reg_offset   = 0x00000120,
+		.clear_reg_offset  = 0x00000124,
+		.status_reg_offset = 0x0000011C,
+	},
+	/* RDI4 */
+	{
+		.mask_reg_offset   = 0x00000130,
+		.clear_reg_offset  = 0x00000134,
+		.status_reg_offset = 0x0000012C,
+	},
+	/* IPP */
+	{
+		.mask_reg_offset   = 0x000000B0,
+		.clear_reg_offset  = 0x000000B4,
+		.status_reg_offset = 0x000000AC,
+	},
+	/* PPP */
+	{
+		.mask_reg_offset   = 0x000000D0,
+		.clear_reg_offset  = 0x000000D4,
+		.status_reg_offset = 0x000000CC,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_680_top_irq_reg_info[] = {
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP],
+	.global_irq_cmd_offset = 0x00000014,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_680_rx_irq_reg_info[] = {
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX],
+	.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_680_path_irq_reg_info[7] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_0],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_1],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_2],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_3],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_4],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_PPP],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+};
+
+static struct cam_irq_register_set cam_ife_csid_680_buf_done_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000090,
+		.clear_reg_offset  = 0x00000094,
+		.status_reg_offset = 0x0000008C,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_680_buf_done_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = cam_ife_csid_680_buf_done_irq_reg_set,
+	.global_irq_cmd_offset  = 0, /* intentionally set to zero */
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_680_ipp_reg_info = {
+		.irq_status_addr                  = 0xAC,
+		.irq_mask_addr                    = 0xB0,
+		.irq_clear_addr                   = 0xB4,
+		.irq_set_addr                     = 0xB8,
+		.cfg0_addr                        = 0x300,
+		.ctrl_addr                        = 0x304,
+		.debug_clr_cmd_addr               = 0x308,
+		.multi_vcdt_cfg0_addr             = 0x30c,
+		.cfg1_addr                        = 0x310,
+		.err_recovery_cfg0_addr           = 0x318,
+		.err_recovery_cfg1_addr           = 0x31C,
+		.err_recovery_cfg2_addr           = 0x320,
+		.bin_pd_detect_cfg0_addr          = 0x324,
+		.bin_pd_detect_cfg1_addr          = 0x328,
+		.bin_pd_detect_cfg2_addr          = 0x32C,
+		.camif_frame_cfg_addr             = 0x330,
+		.epoch_irq_cfg_addr               = 0x334,
+		.epoch0_subsample_ptrn_addr       = 0x338,
+		.epoch1_subsample_ptrn_addr       = 0x33C,
+		.debug_camif_1_addr               = 0x340,
+		.debug_camif_0_addr               = 0x344,
+		.debug_halt_status_addr           = 0x348,
+		.debug_misr_val0_addr             = 0x34C,
+		.debug_misr_val1_addr             = 0x350,
+		.debug_misr_val2_addr             = 0x354,
+		.debug_misr_val3_addr             = 0x358,
+		.hcrop_addr                       = 0x35c,
+		.vcrop_addr                       = 0x360,
+		.pix_drop_pattern_addr            = 0x364,
+		.pix_drop_period_addr             = 0x368,
+		.line_drop_pattern_addr           = 0x36C,
+		.line_drop_period_addr            = 0x370,
+		.frm_drop_pattern_addr            = 0x374,
+		.frm_drop_period_addr             = 0x378,
+		.irq_subsample_pattern_addr       = 0x37C,
+		.irq_subsample_period_addr        = 0x380,
+		.format_measure_cfg0_addr         = 0x384,
+		.format_measure_cfg1_addr         = 0x388,
+		.format_measure0_addr             = 0x38C,
+		.format_measure1_addr             = 0x390,
+		.format_measure2_addr             = 0x394,
+		.timestamp_curr0_sof_addr         = 0x398,
+		.timestamp_curr1_sof_addr         = 0x39C,
+		.timestamp_perv0_sof_addr         = 0x3A0,
+		.timestamp_perv1_sof_addr         = 0x3A4,
+		.timestamp_curr0_eof_addr         = 0x3A8,
+		.timestamp_curr1_eof_addr         = 0x3AC,
+		.timestamp_perv0_eof_addr         = 0x3B0,
+		.timestamp_perv1_eof_addr         = 0x3B4,
+		.lut_bank_cfg_addr                = 0x3B8,
+		.batch_id_cfg0_addr               = 0x3BC,
+		.batch_id_cfg1_addr               = 0x3C0,
+		.batch_period_cfg_addr            = 0x3C4,
+		.batch_stream_id_cfg_addr         = 0x3C8,
+		.epoch0_cfg_batch_id0_addr        = 0x3CC,
+		.epoch1_cfg_batch_id0_addr        = 0x3D0,
+		.epoch0_cfg_batch_id1_addr        = 0x3D4,
+		.epoch1_cfg_batch_id1_addr        = 0x3D8,
+		.epoch0_cfg_batch_id2_addr        = 0x3DC,
+		.epoch1_cfg_batch_id2_addr        = 0x3E0,
+		.epoch0_cfg_batch_id3_addr        = 0x3E4,
+		.epoch1_cfg_batch_id3_addr        = 0x3E8,
+		.epoch0_cfg_batch_id4_addr        = 0x3EC,
+		.epoch1_cfg_batch_id4_addr        = 0x3F0,
+		.epoch0_cfg_batch_id5_addr        = 0x3F4,
+		.epoch1_cfg_batch_id5_addr        = 0x3F8,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.binning_supported                = 0x7,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.start_mode_shift                 = 2,
+		.start_master_sel_val             = 0,
+		.start_master_sel_shift           = 4,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.pix_store_en_shift_val           = 14,
+		.early_eof_en_shift_val           = 16,
+		.bin_h_en_shift_val               = 20,
+		.bin_v_en_shift_val               = 21,
+		.bin_en_shift_val                 = 18,
+		.bin_qcfa_en_shift_val            = 19,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 9,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 4,
+		.start_master_sel_shift_val       = 4,
+		.bin_pd_en_shift_val              = 0,
+		.bin_pd_blk_w_shift_val           = 8,
+		.bin_pd_blk_h_shift_val           = 24,
+		.bin_pd_detect_x_offset_shift_val = 0,
+		.bin_pd_detect_x_end_shift_val    = 16,
+		.bin_pd_detect_y_offset_shift_val = 0,
+		.bin_pd_detect_y_end_shift_val    = 16,
+		.lut_bank_0_sel_val               = 0,
+		.lut_bank_1_sel_val               = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x10001,
+		.top_irq_mask                     = {0x10,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_680_ppp_reg_info = {
+		.irq_status_addr                  = 0xCC,
+		.irq_mask_addr                    = 0xD0,
+		.irq_clear_addr                   = 0xD4,
+		.irq_set_addr                     = 0xD8,
+		.cfg0_addr                        = 0xB00,
+		.ctrl_addr                        = 0xB04,
+		.debug_clr_cmd_addr               = 0xB08,
+		.multi_vcdt_cfg0_addr             = 0xB0c,
+		.cfg1_addr                        = 0xB10,
+		.sparse_pd_extractor_cfg_addr     = 0xB14,
+		.err_recovery_cfg0_addr           = 0xB18,
+		.err_recovery_cfg1_addr           = 0xB1C,
+		.err_recovery_cfg2_addr           = 0xB20,
+		.camif_frame_cfg_addr             = 0xB30,
+		.epoch_irq_cfg_addr               = 0xB34,
+		.epoch0_subsample_ptrn_addr       = 0xB38,
+		.epoch1_subsample_ptrn_addr       = 0xB3C,
+		.debug_camif_1_addr               = 0xB40,
+		.debug_camif_0_addr               = 0xB44,
+		.debug_halt_status_addr           = 0xB48,
+		.debug_misr_val0_addr             = 0xB4C,
+		.debug_misr_val1_addr             = 0xB50,
+		.debug_misr_val2_addr             = 0xB54,
+		.debug_misr_val3_addr             = 0xB58,
+		.hcrop_addr                       = 0xB5c,
+		.vcrop_addr                       = 0xB60,
+		.pix_drop_pattern_addr            = 0xB64,
+		.pix_drop_period_addr             = 0xB68,
+		.line_drop_pattern_addr           = 0xB6C,
+		.line_drop_period_addr            = 0xB70,
+		.frm_drop_pattern_addr            = 0xB74,
+		.frm_drop_period_addr             = 0xB78,
+		.irq_subsample_pattern_addr       = 0xB7C,
+		.irq_subsample_period_addr        = 0xB80,
+		.format_measure_cfg0_addr         = 0xB84,
+		.format_measure_cfg1_addr         = 0xB88,
+		.format_measure0_addr             = 0xB8C,
+		.format_measure1_addr             = 0xB90,
+		.format_measure2_addr             = 0xB94,
+		.timestamp_curr0_sof_addr         = 0xB98,
+		.timestamp_curr1_sof_addr         = 0xB9C,
+		.timestamp_perv0_sof_addr         = 0xBA0,
+		.timestamp_perv1_sof_addr         = 0xBA4,
+		.timestamp_curr0_eof_addr         = 0xBA8,
+		.timestamp_curr1_eof_addr         = 0xBAC,
+		.timestamp_perv0_eof_addr         = 0xBB0,
+		.timestamp_perv1_eof_addr         = 0xBB4,
+		.lut_bank_cfg_addr                = 0xBB8,
+		.batch_id_cfg0_addr               = 0xBBC,
+		.batch_id_cfg1_addr               = 0xBC0,
+		.batch_period_cfg_addr            = 0xBC4,
+		.batch_stream_id_cfg_addr         = 0xBC8,
+		.epoch0_cfg_batch_id0_addr        = 0xBCC,
+		.epoch1_cfg_batch_id0_addr        = 0xBD0,
+		.epoch0_cfg_batch_id1_addr        = 0xBD4,
+		.epoch1_cfg_batch_id1_addr        = 0xBD8,
+		.epoch0_cfg_batch_id2_addr        = 0xBDC,
+		.epoch1_cfg_batch_id2_addr        = 0xBE0,
+		.epoch0_cfg_batch_id3_addr        = 0xBE4,
+		.epoch1_cfg_batch_id3_addr        = 0xBE8,
+		.epoch0_cfg_batch_id4_addr        = 0xBEC,
+		.epoch1_cfg_batch_id4_addr        = 0xBF0,
+		.epoch0_cfg_batch_id5_addr        = 0xBF4,
+		.epoch1_cfg_batch_id5_addr        = 0xBF8,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.start_mode_shift                 = 2,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.start_master_sel_val             = 3,
+		.start_master_sel_shift           = 4,
+		.binning_supported                = 0x1,
+		.bin_h_en_shift_val               = 18,
+		.bin_en_shift_val                 = 18,
+		.early_eof_en_shift_val           = 16,
+		.pix_store_en_shift_val           = 14,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 9,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 4,
+		.start_master_sel_shift_val       = 4,
+		.lut_bank_0_sel_val               = 0,
+		.lut_bank_1_sel_val               = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.rup_aup_mask                     = 0x40004,
+		.top_irq_mask                     = {0x40,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.crop_drop_enable                 = false,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_680_rdi_0_reg_info = {
+		.irq_status_addr                  = 0xEC,
+		.irq_mask_addr                    = 0xF0,
+		.irq_clear_addr                   = 0xF4,
+		.irq_set_addr                     = 0xF8,
+		.cfg0_addr                        = 0x500,
+		.ctrl_addr                        = 0x504,
+		.debug_clr_cmd_addr               = 0x508,
+		.multi_vcdt_cfg0_addr             = 0x50c,
+		.cfg1_addr                        = 0x510,
+		.err_recovery_cfg0_addr           = 0x514,
+		.err_recovery_cfg1_addr           = 0x518,
+		.err_recovery_cfg2_addr           = 0x51C,
+		.debug_byte_cntr_ping_addr        = 0x520,
+		.debug_byte_cntr_pong_addr        = 0x524,
+		.camif_frame_cfg_addr             = 0x528,
+		.epoch_irq_cfg_addr               = 0x52C,
+		.epoch0_subsample_ptrn_addr       = 0x530,
+		.epoch1_subsample_ptrn_addr       = 0x534,
+		.debug_camif_1_addr               = 0x538,
+		.debug_camif_0_addr               = 0x53C,
+		.frm_drop_pattern_addr            = 0x540,
+		.frm_drop_period_addr             = 0x540,
+		.irq_subsample_pattern_addr       = 0x548,
+		.irq_subsample_period_addr        = 0x54C,
+		.hcrop_addr                       = 0x550,
+		.vcrop_addr                       = 0x554,
+		.pix_drop_pattern_addr            = 0x558,
+		.pix_drop_period_addr             = 0x55C,
+		.line_drop_pattern_addr           = 0x560,
+		.line_drop_period_addr            = 0x564,
+		.debug_halt_status_addr           = 0x568,
+		.debug_misr_val0_addr             = 0x570,
+		.debug_misr_val1_addr             = 0x574,
+		.debug_misr_val2_addr             = 0x578,
+		.debug_misr_val3_addr             = 0x57C,
+		.format_measure_cfg0_addr         = 0x580,
+		.format_measure_cfg1_addr         = 0x584,
+		.format_measure0_addr             = 0x588,
+		.format_measure1_addr             = 0x58C,
+		.format_measure2_addr             = 0x590,
+		.timestamp_curr0_sof_addr         = 0x594,
+		.timestamp_curr1_sof_addr         = 0x598,
+		.timestamp_perv0_sof_addr         = 0x59C,
+		.timestamp_perv1_sof_addr         = 0x5A0,
+		.timestamp_curr0_eof_addr         = 0x5A4,
+		.timestamp_curr1_eof_addr         = 0x5A8,
+		.timestamp_perv0_eof_addr         = 0x5AC,
+		.timestamp_perv1_eof_addr         = 0x5B0,
+		.batch_id_cfg0_addr               = 0x5B4,
+		.batch_id_cfg1_addr               = 0x5B8,
+		.batch_period_cfg_addr            = 0x5BC,
+		.batch_stream_id_cfg_addr         = 0x5C0,
+		.epoch0_cfg_batch_id0_addr        = 0x5C4,
+		.epoch1_cfg_batch_id0_addr        = 0x5C8,
+		.epoch0_cfg_batch_id1_addr        = 0x5CC,
+		.epoch1_cfg_batch_id1_addr        = 0x5D0,
+		.epoch0_cfg_batch_id2_addr        = 0x5D4,
+		.epoch1_cfg_batch_id2_addr        = 0x5D8,
+		.epoch0_cfg_batch_id3_addr        = 0x5DC,
+		.epoch1_cfg_batch_id3_addr        = 0x5E0,
+		.epoch0_cfg_batch_id4_addr        = 0x5E4,
+		.epoch1_cfg_batch_id4_addr        = 0x5E8,
+		.epoch0_cfg_batch_id5_addr        = 0x5EC,
+		.epoch1_cfg_batch_id5_addr        = 0x5F0,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 4,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x100010,
+		.top_irq_mask                     = {0x100,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_680_rdi_1_reg_info = {
+		.irq_status_addr                  = 0xFC,
+		.irq_mask_addr                    = 0x100,
+		.irq_clear_addr                   = 0x104,
+		.irq_set_addr                     = 0x108,
+		.cfg0_addr                        = 0x600,
+		.ctrl_addr                        = 0x604,
+		.debug_clr_cmd_addr               = 0x608,
+		.multi_vcdt_cfg0_addr             = 0x60c,
+		.cfg1_addr                        = 0x610,
+		.err_recovery_cfg0_addr           = 0x614,
+		.err_recovery_cfg1_addr           = 0x618,
+		.err_recovery_cfg2_addr           = 0x61C,
+		.debug_byte_cntr_ping_addr        = 0x620,
+		.debug_byte_cntr_pong_addr        = 0x624,
+		.camif_frame_cfg_addr             = 0x628,
+		.epoch_irq_cfg_addr               = 0x62C,
+		.epoch0_subsample_ptrn_addr       = 0x630,
+		.epoch1_subsample_ptrn_addr       = 0x634,
+		.debug_camif_1_addr               = 0x638,
+		.debug_camif_0_addr               = 0x63C,
+		.frm_drop_pattern_addr            = 0x640,
+		.frm_drop_period_addr             = 0x644,
+		.irq_subsample_pattern_addr       = 0x648,
+		.irq_subsample_period_addr        = 0x64C,
+		.hcrop_addr                       = 0x650,
+		.vcrop_addr                       = 0x654,
+		.pix_drop_pattern_addr            = 0x658,
+		.pix_drop_period_addr             = 0x65C,
+		.line_drop_pattern_addr           = 0x660,
+		.line_drop_period_addr            = 0x664,
+		.debug_halt_status_addr           = 0x66C,
+		.debug_misr_val0_addr             = 0x670,
+		.debug_misr_val1_addr             = 0x674,
+		.debug_misr_val2_addr             = 0x678,
+		.debug_misr_val3_addr             = 0x67C,
+		.format_measure_cfg0_addr         = 0x680,
+		.format_measure_cfg1_addr         = 0x684,
+		.format_measure0_addr             = 0x688,
+		.format_measure1_addr             = 0x68C,
+		.format_measure2_addr             = 0x690,
+		.timestamp_curr0_sof_addr         = 0x694,
+		.timestamp_curr1_sof_addr         = 0x698,
+		.timestamp_perv0_sof_addr         = 0x69C,
+		.timestamp_perv1_sof_addr         = 0x6A0,
+		.timestamp_curr0_eof_addr         = 0x6A4,
+		.timestamp_curr1_eof_addr         = 0x6A8,
+		.timestamp_perv0_eof_addr         = 0x6AC,
+		.timestamp_perv1_eof_addr         = 0x6B0,
+		.batch_id_cfg0_addr               = 0x6B4,
+		.batch_id_cfg1_addr               = 0x6B8,
+		.batch_period_cfg_addr            = 0x6BC,
+		.batch_stream_id_cfg_addr         = 0x6C0,
+		.epoch0_cfg_batch_id0_addr        = 0x6C4,
+		.epoch1_cfg_batch_id0_addr        = 0x6C8,
+		.epoch0_cfg_batch_id1_addr        = 0x6CC,
+		.epoch1_cfg_batch_id1_addr        = 0x6D0,
+		.epoch0_cfg_batch_id2_addr        = 0x6D4,
+		.epoch1_cfg_batch_id2_addr        = 0x6D8,
+		.epoch0_cfg_batch_id3_addr        = 0x6DC,
+		.epoch1_cfg_batch_id3_addr        = 0x6E0,
+		.epoch0_cfg_batch_id4_addr        = 0x6E4,
+		.epoch1_cfg_batch_id4_addr        = 0x6E8,
+		.epoch0_cfg_batch_id5_addr        = 0x6EC,
+		.epoch1_cfg_batch_id5_addr        = 0x6F0,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.mipi_pack_supported              = 1,
+		.offline_mode_supported           = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 4,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x200020,
+		.top_irq_mask                     = {0x200,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_680_rdi_2_reg_info = {
+		.irq_status_addr                  = 0x10C,
+		.irq_mask_addr                    = 0x110,
+		.irq_clear_addr                   = 0x114,
+		.irq_set_addr                     = 0x118,
+		.cfg0_addr                        = 0x700,
+		.ctrl_addr                        = 0x704,
+		.debug_clr_cmd_addr               = 0x708,
+		.multi_vcdt_cfg0_addr             = 0x70c,
+		.cfg1_addr                        = 0x710,
+		.err_recovery_cfg0_addr           = 0x714,
+		.err_recovery_cfg1_addr           = 0x718,
+		.err_recovery_cfg2_addr           = 0x71C,
+		.debug_byte_cntr_ping_addr        = 0x720,
+		.debug_byte_cntr_pong_addr        = 0x724,
+		.camif_frame_cfg_addr             = 0x728,
+		.epoch_irq_cfg_addr               = 0x72C,
+		.epoch0_subsample_ptrn_addr       = 0x730,
+		.epoch1_subsample_ptrn_addr       = 0x734,
+		.debug_camif_1_addr               = 0x738,
+		.debug_camif_0_addr               = 0x73C,
+		.frm_drop_pattern_addr            = 0x740,
+		.frm_drop_period_addr             = 0x744,
+		.irq_subsample_pattern_addr       = 0x748,
+		.irq_subsample_period_addr        = 0x74C,
+		.hcrop_addr                       = 0x750,
+		.vcrop_addr                       = 0x754,
+		.pix_drop_pattern_addr            = 0x758,
+		.pix_drop_period_addr             = 0x75C,
+		.line_drop_pattern_addr           = 0x760,
+		.line_drop_period_addr            = 0x764,
+		.debug_halt_status_addr           = 0x76C,
+		.debug_misr_val0_addr             = 0x770,
+		.debug_misr_val1_addr             = 0x774,
+		.debug_misr_val2_addr             = 0x778,
+		.debug_misr_val3_addr             = 0x77C,
+		.format_measure_cfg0_addr         = 0x780,
+		.format_measure_cfg1_addr         = 0x784,
+		.format_measure0_addr             = 0x788,
+		.format_measure1_addr             = 0x78C,
+		.format_measure2_addr             = 0x790,
+		.timestamp_curr0_sof_addr         = 0x794,
+		.timestamp_curr1_sof_addr         = 0x798,
+		.timestamp_perv0_sof_addr         = 0x79C,
+		.timestamp_perv1_sof_addr         = 0x7A0,
+		.timestamp_curr0_eof_addr         = 0x7A4,
+		.timestamp_curr1_eof_addr         = 0x7A8,
+		.timestamp_perv0_eof_addr         = 0x7AC,
+		.timestamp_perv1_eof_addr         = 0x7B0,
+		.batch_id_cfg0_addr               = 0x7B4,
+		.batch_id_cfg1_addr               = 0x7B8,
+		.batch_period_cfg_addr            = 0x7BC,
+		.batch_stream_id_cfg_addr         = 0x7C0,
+		.epoch0_cfg_batch_id0_addr        = 0x7C4,
+		.epoch1_cfg_batch_id0_addr        = 0x7C8,
+		.epoch0_cfg_batch_id1_addr        = 0x7CC,
+		.epoch1_cfg_batch_id1_addr        = 0x7D0,
+		.epoch0_cfg_batch_id2_addr        = 0x7D4,
+		.epoch1_cfg_batch_id2_addr        = 0x7D8,
+		.epoch0_cfg_batch_id3_addr        = 0x7DC,
+		.epoch1_cfg_batch_id3_addr        = 0x7E0,
+		.epoch0_cfg_batch_id4_addr        = 0x7E4,
+		.epoch1_cfg_batch_id4_addr        = 0x7E8,
+		.epoch0_cfg_batch_id5_addr        = 0x7EC,
+		.epoch1_cfg_batch_id5_addr        = 0x7F0,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.mipi_pack_supported              = 1,
+		.offline_mode_supported           = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 4,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x400040,
+		.top_irq_mask                     = {0x400,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_680_rdi_3_reg_info = {
+		.irq_status_addr                  = 0x11C,
+		.irq_mask_addr                    = 0x120,
+		.irq_clear_addr                   = 0x124,
+		.irq_set_addr                     = 0x128,
+		.cfg0_addr                        = 0x800,
+		.ctrl_addr                        = 0x804,
+		.debug_clr_cmd_addr               = 0x808,
+		.multi_vcdt_cfg0_addr             = 0x80c,
+		.cfg1_addr                        = 0x810,
+		.err_recovery_cfg0_addr           = 0x814,
+		.err_recovery_cfg1_addr           = 0x818,
+		.err_recovery_cfg2_addr           = 0x81C,
+		.debug_byte_cntr_ping_addr        = 0x820,
+		.debug_byte_cntr_pong_addr        = 0x824,
+		.camif_frame_cfg_addr             = 0x828,
+		.epoch_irq_cfg_addr               = 0x82C,
+		.epoch0_subsample_ptrn_addr       = 0x830,
+		.epoch1_subsample_ptrn_addr       = 0x834,
+		.debug_camif_1_addr               = 0x838,
+		.debug_camif_0_addr               = 0x83C,
+		.frm_drop_pattern_addr            = 0x840,
+		.frm_drop_period_addr             = 0x840,
+		.irq_subsample_pattern_addr       = 0x848,
+		.irq_subsample_period_addr        = 0x84C,
+		.hcrop_addr                       = 0x850,
+		.vcrop_addr                       = 0x854,
+		.pix_drop_pattern_addr            = 0x858,
+		.pix_drop_period_addr             = 0x85C,
+		.line_drop_pattern_addr           = 0x860,
+		.line_drop_period_addr            = 0x864,
+		.debug_halt_status_addr           = 0x868,
+		.debug_misr_val0_addr             = 0x870,
+		.debug_misr_val1_addr             = 0x874,
+		.debug_misr_val2_addr             = 0x878,
+		.debug_misr_val3_addr             = 0x87C,
+		.format_measure_cfg0_addr         = 0x880,
+		.format_measure_cfg1_addr         = 0x884,
+		.format_measure0_addr             = 0x888,
+		.format_measure1_addr             = 0x88C,
+		.format_measure2_addr             = 0x890,
+		.timestamp_curr0_sof_addr         = 0x894,
+		.timestamp_curr1_sof_addr         = 0x898,
+		.timestamp_perv0_sof_addr         = 0x89C,
+		.timestamp_perv1_sof_addr         = 0x8A0,
+		.timestamp_curr0_eof_addr         = 0x8A4,
+		.timestamp_curr1_eof_addr         = 0x8A8,
+		.timestamp_perv0_eof_addr         = 0x8AC,
+		.timestamp_perv1_eof_addr         = 0x8B0,
+		.batch_id_cfg0_addr               = 0x8B4,
+		.batch_id_cfg1_addr               = 0x8B8,
+		.batch_period_cfg_addr            = 0x8BC,
+		.batch_stream_id_cfg_addr         = 0x8C0,
+		.epoch0_cfg_batch_id0_addr        = 0x8C4,
+		.epoch1_cfg_batch_id0_addr        = 0x8C8,
+		.epoch0_cfg_batch_id1_addr        = 0x8CC,
+		.epoch1_cfg_batch_id1_addr        = 0x8D0,
+		.epoch0_cfg_batch_id2_addr        = 0x8D4,
+		.epoch1_cfg_batch_id2_addr        = 0x8D8,
+		.epoch0_cfg_batch_id3_addr        = 0x8DC,
+		.epoch1_cfg_batch_id3_addr        = 0x8E0,
+		.epoch0_cfg_batch_id4_addr        = 0x8E4,
+		.epoch1_cfg_batch_id4_addr        = 0x8E8,
+		.epoch0_cfg_batch_id5_addr        = 0x8EC,
+		.epoch1_cfg_batch_id5_addr        = 0x8F0,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 4,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x800080,
+		.top_irq_mask                     = {0x800,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_680_rdi_4_reg_info = {
+		.irq_status_addr                 = 0x12C,
+		.irq_mask_addr                   = 0x130,
+		.irq_clear_addr                  = 0x134,
+		.irq_set_addr                    = 0x138,
+		.cfg0_addr                       = 0x900,
+		.ctrl_addr                       = 0x904,
+		.debug_clr_cmd_addr              = 0x908,
+		.multi_vcdt_cfg0_addr            = 0x90c,
+		.cfg1_addr                       = 0x910,
+		.err_recovery_cfg0_addr          = 0x914,
+		.err_recovery_cfg1_addr          = 0x918,
+		.err_recovery_cfg2_addr          = 0x91C,
+		.debug_byte_cntr_ping_addr       = 0x920,
+		.debug_byte_cntr_pong_addr       = 0x924,
+		.camif_frame_cfg_addr            = 0x928,
+		.epoch_irq_cfg_addr              = 0x92C,
+		.epoch0_subsample_ptrn_addr      = 0x930,
+		.epoch1_subsample_ptrn_addr      = 0x934,
+		.debug_camif_1_addr              = 0x938,
+		.debug_camif_0_addr              = 0x93C,
+		.frm_drop_pattern_addr           = 0x940,
+		.frm_drop_period_addr            = 0x940,
+		.irq_subsample_pattern_addr      = 0x948,
+		.irq_subsample_period_addr       = 0x94C,
+		.hcrop_addr                      = 0x950,
+		.vcrop_addr                      = 0x954,
+		.pix_drop_pattern_addr           = 0x958,
+		.pix_drop_period_addr            = 0x95C,
+		.line_drop_pattern_addr          = 0x960,
+		.line_drop_period_addr           = 0x964,
+		.debug_halt_status_addr          = 0x968,
+		.debug_misr_val0_addr            = 0x970,
+		.debug_misr_val1_addr            = 0x974,
+		.debug_misr_val2_addr            = 0x978,
+		.debug_misr_val3_addr            = 0x97C,
+		.format_measure_cfg0_addr        = 0x980,
+		.format_measure_cfg1_addr        = 0x984,
+		.format_measure0_addr            = 0x988,
+		.format_measure1_addr            = 0x98C,
+		.format_measure2_addr            = 0x990,
+		.timestamp_curr0_sof_addr        = 0x994,
+		.timestamp_curr1_sof_addr        = 0x998,
+		.timestamp_perv0_sof_addr        = 0x99C,
+		.timestamp_perv1_sof_addr        = 0x9A0,
+		.timestamp_curr0_eof_addr        = 0x9A4,
+		.timestamp_curr1_eof_addr        = 0x9A8,
+		.timestamp_perv0_eof_addr        = 0x9AC,
+		.timestamp_perv1_eof_addr        = 0x9B0,
+		.batch_id_cfg0_addr              = 0x9B4,
+		.batch_id_cfg1_addr              = 0x9B8,
+		.batch_period_cfg_addr           = 0x9BC,
+		.batch_stream_id_cfg_addr        = 0x9C0,
+		.epoch0_cfg_batch_id0_addr       = 0x9C4,
+		.epoch1_cfg_batch_id0_addr       = 0x9C8,
+		.epoch0_cfg_batch_id1_addr       = 0x9CC,
+		.epoch1_cfg_batch_id1_addr       = 0x9D0,
+		.epoch0_cfg_batch_id2_addr       = 0x9D4,
+		.epoch1_cfg_batch_id2_addr       = 0x9D8,
+		.epoch0_cfg_batch_id3_addr       = 0x9DC,
+		.epoch1_cfg_batch_id3_addr       = 0x9E0,
+		.epoch0_cfg_batch_id4_addr       = 0x9E4,
+		.epoch1_cfg_batch_id4_addr       = 0x9E8,
+		.epoch0_cfg_batch_id5_addr       = 0x9EC,
+		.epoch1_cfg_batch_id5_addr       = 0x9F0,
+		/* configurations */
+		.resume_frame_boundary           = 1,
+		.overflow_ctrl_en                = 1,
+		.overflow_ctrl_mode_val          = 0x8,
+		.offline_mode_supported          = 1,
+		.mipi_pack_supported             = 1,
+		.packing_fmt_shift_val           = 15,
+		.early_eof_en_shift_val          = 14,
+		.plain_fmt_shift_val             = 12,
+		.plain_alignment_shift_val       = 11,
+		.crop_v_en_shift_val             = 8,
+		.crop_h_en_shift_val             = 7,
+		.drop_v_en_shift_val             = 6,
+		.drop_h_en_shift_val             = 5,
+		.timestamp_en_shift_val          = 4,
+		.format_measure_en_shift_val     = 4,
+		.debug_byte_cntr_rst_shift_val   = 2,
+		.offline_mode_en_shift_val       = 2,
+		.ccif_violation_en               = 1,
+		.fatal_err_mask                  = 0x186004,
+		.non_fatal_err_mask              = 0x10000000,
+		.sof_irq_mask                    = 0x10,
+		.rup_irq_mask                    = 0x800000,
+		.epoch0_irq_mask                 = 0x200000,
+		.epoch1_irq_mask                 = 0x400000,
+		.eof_irq_mask                    = 0x8,
+		.rup_aup_mask                    = 0x1000100,
+		.top_irq_mask                    = {0x1000,},
+		.epoch0_shift_val                = 16,
+		.epoch1_shift_val                = 0,
+};
+
+static struct cam_ife_csid_ver2_csi2_rx_reg_info
+	cam_ife_csid_680_csi2_reg_info = {
+		.irq_status_addr                 = {0x9C,},
+		.irq_mask_addr                   = {0xA0,},
+		.irq_clear_addr                  = {0xA4,},
+		.irq_set_addr                    = {0xA8,},
+		/*CSI2 rx control */
+		.cfg0_addr                       = 0x200,
+		.cfg1_addr                       = 0x204,
+		.capture_ctrl_addr               = 0x208,
+		.rst_strobes_addr                = 0x20C,
+		.cap_unmap_long_pkt_hdr_0_addr   = 0x210,
+		.cap_unmap_long_pkt_hdr_1_addr   = 0x214,
+		.captured_short_pkt_0_addr       = 0x218,
+		.captured_short_pkt_1_addr       = 0x21c,
+		.captured_long_pkt_0_addr        = 0x220,
+		.captured_long_pkt_1_addr        = 0x224,
+		.captured_long_pkt_ftr_addr      = 0x228,
+		.captured_cphy_pkt_hdr_addr      = 0x22c,
+		.lane0_misr_addr                 = 0x230,
+		.lane1_misr_addr                 = 0x234,
+		.lane2_misr_addr                 = 0x238,
+		.lane3_misr_addr                 = 0x23c,
+		.total_pkts_rcvd_addr            = 0x240,
+		.stats_ecc_addr                  = 0x244,
+		.total_crc_err_addr              = 0x248,
+		.de_scramble_type3_cfg0_addr     = 0x24C,
+		.de_scramble_type3_cfg1_addr     = 0x250,
+		.de_scramble_type2_cfg0_addr     = 0x254,
+		.de_scramble_type2_cfg1_addr     = 0x258,
+		.de_scramble_type1_cfg0_addr     = 0x25C,
+		.de_scramble_type1_cfg1_addr     = 0x260,
+		.de_scramble_type0_cfg0_addr     = 0x264,
+		.de_scramble_type0_cfg1_addr     = 0x268,
+
+		.rst_done_shift_val              = 27,
+		.irq_mask_all                    = 0xFFFFFFF,
+		.misr_enable_shift_val           = 6,
+		.vc_mode_shift_val               = 2,
+		.capture_long_pkt_en_shift       = 0,
+		.capture_short_pkt_en_shift      = 1,
+		.capture_cphy_pkt_en_shift       = 2,
+		.capture_long_pkt_dt_shift       = 4,
+		.capture_long_pkt_vc_shift       = 10,
+		.capture_short_pkt_vc_shift      = 15,
+		.capture_cphy_pkt_dt_shift       = 20,
+		.capture_cphy_pkt_vc_shift       = 26,
+		.phy_num_mask                    = 0xf,
+		.vc_mask                         = 0x7C00000,
+		.dt_mask                         = 0x3f0000,
+		.wc_mask                         = 0xffff,
+		.vc_shift                        = 0x16,
+		.dt_shift                        = 0x10,
+		.wc_shift                        = 0,
+		.calc_crc_mask                   = 0xffff,
+		.expected_crc_mask               = 0xffff,
+		.calc_crc_shift                  = 0x10,
+		.ecc_correction_shift_en         = 0,
+		.lane_num_shift                  = 0,
+		.lane_cfg_shift                  = 4,
+		.phy_type_shift                  = 24,
+		.phy_num_shift                   = 20,
+		.tpg_mux_en_shift                = 27,
+		.tpg_num_sel_shift               = 28,
+		.phy_bist_shift_en               = 7,
+		.epd_mode_shift_en               = 8,
+		.eotp_shift_en                   = 9,
+		.dyn_sensor_switch_shift_en      = 10,
+		.long_pkt_strobe_rst_shift       = 0,
+		.short_pkt_strobe_rst_shift      = 1,
+		.cphy_pkt_strobe_rst_shift       = 2,
+		.unmapped_pkt_strobe_rst_shift   = 3,
+		.fatal_err_mask                  = {0x19FA800,},
+		.part_fatal_err_mask             = {0x0001000,},
+		.non_fatal_err_mask              = {0x0200000,},
+		.top_irq_mask                    = {0x4,},
+};
+
+static struct cam_ife_csid_ver2_common_reg_info
+			cam_ife_csid_680_cmn_reg_info = {
+	.hw_version_addr                         = 0x0,
+	.cfg0_addr                               = 0x4,
+	.global_cmd_addr                         = 0x8,
+	.reset_cfg_addr                          = 0xc,
+	.reset_cmd_addr                          = 0x10,
+	.irq_cmd_addr                            = 0x14,
+	.rup_aup_cmd_addr                        = 0x18,
+	.offline_cmd_addr                        = 0x1C,
+	.shdr_master_slave_cfg_addr              = 0x20,
+	.top_irq_status_addr                     = {0x7C,},
+	.top_irq_mask_addr                       = {0x80,},
+	.top_irq_clear_addr                      = {0x84,},
+	.top_irq_set_addr                        = {0x88,},
+	.buf_done_irq_status_addr                = 0x8C,
+	.buf_done_irq_mask_addr                  = 0x90,
+	.buf_done_irq_clear_addr                 = 0x94,
+	.buf_done_irq_set_addr                   = 0x98,
+	.test_bus_ctrl                           = 0x1E8,
+	.test_bus_debug                          = 0x1EC,
+
+	/*configurations */
+	.major_version                           = 6,
+	.minor_version                           = 8,
+	.version_incr                            = 0,
+	.num_rdis                                = 5,
+	.num_pix                                 = 1,
+	.num_ppp                                 = 1,
+	.rst_done_shift_val                      = 1,
+	.path_en_shift_val                       = 31,
+	.dt_id_shift_val                         = 27,
+	.vc_shift_val                            = 22,
+	.dt_shift_val                            = 16,
+	.crop_shift_val                          = 16,
+	.decode_format_shift_val                 = 12,
+	.decode_format1_supported                = false,
+	.frame_id_decode_en_shift_val            = 1,
+	.multi_vcdt_vc1_shift_val                = 2,
+	.multi_vcdt_dt1_shift_val                = 7,
+	.multi_vcdt_ts_combo_en_shift_val        = 13,
+	.multi_vcdt_en_shift_val                 = 0,
+	.timestamp_stb_sel_shift_val             = 0,
+	.vfr_en_shift_val                        = 0,
+	.mup_shift_val                           = 28,
+	.shdr_slave_rdi2_shift                   = 22,
+	.shdr_slave_rdi1_shift                   = 21,
+	.shdr_master_rdi0_shift                  = 5,
+	.shdr_master_slave_en_shift              = 0,
+	.early_eof_supported                     = 1,
+	.vfr_supported                           = 1,
+	.multi_vcdt_supported                    = 1,
+	.ts_comb_vcdt_en                         = true,
+	.ts_comb_vcdt_mask                       = 3,
+	.frame_id_dec_supported                  = 1,
+	.measure_en_hbi_vbi_cnt_mask             = 0x1c,
+	.measure_pixel_line_en_mask              = 0x3,
+	.crop_pix_start_mask                     = 0x3fff,
+	.crop_pix_end_mask                       = 0xffff,
+	.crop_line_start_mask                    = 0x3fff,
+	.crop_line_end_mask                      = 0xffff,
+	.drop_supported                          = 1,
+	.ipp_irq_mask_all                        = 0x7FFF,
+	.rdi_irq_mask_all                        = 0x7FFF,
+	.ppp_irq_mask_all                        = 0xFFFF,
+	.top_err_irq_mask = {
+		0x0,
+	},
+	.rst_loc_path_only_val                   = 0x0,
+	.rst_loc_complete_csid_val               = 0x1,
+	.rst_mode_frame_boundary_val             = 0x0,
+	.rst_mode_immediate_val                  = 0x1,
+	.rst_cmd_hw_reset_complete_val           = 0x1,
+	.rst_cmd_sw_reset_complete_val           = 0x2,
+	.rst_cmd_irq_ctrl_only_val               = 0x4,
+	.timestamp_strobe_val                    = 0x2,
+	.rst_location_shift_val                  = 4,
+	.rst_mode_shift_val                      = 0,
+	.epoch_factor                            = 50,
+	.global_reset                            = 1,
+	.rup_supported                           = 1,
+	.only_master_rup                         = 1,
+	.format_measure_height_mask_val          = 0xFFFF,
+	.format_measure_height_shift_val         = 0x10,
+	.format_measure_width_mask_val           = 0xFFFF,
+	.format_measure_width_shift_val          = 0x0,
+	.top_reset_irq_mask  = {
+		0x1,
+	},
+	.top_buf_done_irq_mask                   = 0x2000,
+	.phy_sel_base_idx                        = 1,
+	.camif_irq_support                       = true,
+};
+
+static struct cam_ife_csid_ver2_top_reg_info
+			cam_ife_csid_680_top_reg_info = {
+	.io_path_cfg0_addr = {
+				    0x0,
+				    0x4,
+				    0x8,
+	},
+	.dual_csid_cfg0_addr =  {
+				    0xC,
+				    0x10,
+				    0x14,
+	},
+	.input_core_type_shift_val      = 0,
+	.sfe_offline_en_shift_val       = 12,
+	.out_ife_en_shift_val           = 8,
+	.dual_sync_sel_shift_val        = 8,
+	.dual_en_shift_val              = 0,
+	.master_slave_sel_shift_val     = 1,
+	.master_sel_val                 = 0,
+	.slave_sel_val                  = 1,
+	.io_path_cfg_rst_val            = 1,
+	.dual_cfg_rst_val               = 0,
+	.sfe_pipeline_bypassed          = true,
+};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_680_reg_info = {
+	.top_irq_reg_info      = cam_ife_csid_680_top_irq_reg_info,
+	.rx_irq_reg_info       = cam_ife_csid_680_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_4],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_PPP],
+	},
+	.buf_done_irq_reg_info = &cam_ife_csid_680_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_680_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_680_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_680_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = &cam_ife_csid_680_ppp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_680_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_680_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_680_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_680_rdi_3_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_4] = &cam_ife_csid_680_rdi_4_reg_info,
+	.top_reg                              = &cam_ife_csid_680_top_reg_info,
+	.input_core_sel = {
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			0x8,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			-1,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			-1,
+			0x9,
+			-1,
+		},
+	},
+	.need_top_cfg = 0x1,
+	.csid_cust_node_map = {0x1, 0x0, 0x2},
+	.rx_irq_desc        = &cam_ife_csid_680_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_680_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_680_num_top_regs,
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+};
+#endif /*_CAM_IFE_CSID_680_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid680_110.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid680_110.h
@@ -0,0 +1,79 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_680_110_H_
+#define _CAM_IFE_CSID_680_110_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+
+static uint32_t cam_ife_csid_680_110_num_top_regs[] = {0,};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_680_110_reg_info = {
+	.top_irq_reg_info      = cam_ife_csid_680_top_irq_reg_info,
+	.rx_irq_reg_info       = cam_ife_csid_680_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_4],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		&cam_ife_csid_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_PPP],
+	},
+	.buf_done_irq_reg_info = &cam_ife_csid_680_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_680_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_680_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_680_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = &cam_ife_csid_680_ppp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_680_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_680_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_680_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_680_rdi_3_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_4] = &cam_ife_csid_680_rdi_4_reg_info,
+	.top_reg                              = &cam_ife_csid_680_top_reg_info,
+	.input_core_sel = {
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			0x8,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			-1,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			-1,
+			0x9,
+			-1,
+		},
+	},
+	.need_top_cfg = 0x1,
+	.csid_cust_node_map = {0x1, 0x0, 0x2},
+	.rx_irq_desc        = &cam_ife_csid_680_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_680_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_680_110_num_top_regs,
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+};
+#endif /*_CAM_IFE_CSID_680_110_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid690.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid690.h
@@ -0,0 +1,1029 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_690_H_
+#define _CAM_IFE_CSID_690_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+#define CAM_CSID_VERSION_V690                 0x60090000
+
+static uint32_t cam_ife_csid_690_num_top_regs[] = {0,};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_690_rx_irq_desc[][32] = {
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "DL0_EOT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "DL1_EOT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "DL2_EOT",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "DL3_EOT",
+		},
+		{
+			.bitmask = BIT(4),
+			.desc = "DL0_SOT",
+		},
+		{
+			.bitmask = BIT(5),
+			.desc = "DL1_SOT",
+		},
+		{
+			.bitmask = BIT(6),
+			.desc = "DL2_SOT",
+		},
+		{
+			.bitmask = BIT(7),
+			.desc = "DL3_SOT",
+		},
+		{
+			.bitmask = BIT(8),
+			.desc = "LONG_PKT",
+		},
+		{
+			.bitmask = BIT(9),
+			.desc = "SHORT_PKT",
+		},
+		{
+			.bitmask = BIT(10),
+			.desc = "CPHY_PKT_HDR",
+		},
+		{
+			.bitmask = BIT(11),
+			.desc = "ERROR_CPHY_EOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(12),
+			.desc = "ERROR_CPHY_SOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(13),
+			.desc = "ERROR_CPHY_PH_CRC",
+		},
+		{
+			.bitmask = BIT(14),
+			.desc = "WARNING_ECC",
+		},
+		{
+			.bitmask = BIT(15),
+			.desc = "ERROR_LANE0_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(16),
+			.desc = "ERROR_LANE1_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(17),
+			.desc = "ERROR_LANE2_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(18),
+			.desc = "ERROR_LANE3_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(19),
+			.desc = "ERROR_CRC",
+		},
+		{
+			.bitmask = BIT(20),
+			.desc = "ERROR_ECC",
+		},
+		{
+			.bitmask = BIT(21),
+			.desc = "ERROR_MMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(22),
+			.desc = "ERROR_UNMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(23),
+			.desc = "ERROR_STREAM_UNDERFLOW",
+		},
+		{
+			.bitmask = BIT(24),
+			.desc = "ERROR_UNBOUNDED_FRAME",
+		},
+	},
+};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_690_path_irq_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.desc = "ERROR_FREEZE_FRAME: Number of frozen frame exceed threshold",
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "ERROR_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "CAMIF_EOF",
+	},
+	{
+		.bitmask = BIT(4),
+		.desc = "CAMIF_SOF",
+	},
+	{
+		.bitmask = BIT(5),
+		.desc = "FRAME_DROP_EOF",
+	},
+	{
+		.bitmask = BIT(6),
+		.desc = "FRAME_DROP_EOL",
+	},
+	{
+		.bitmask = BIT(7),
+		.desc = "FRAME_DROP_SOL",
+	},
+	{
+		.bitmask = BIT(8),
+		.desc = "FRAME_DROP_SOF",
+	},
+	{
+		.bitmask = BIT(9),
+		.desc = "INFO_INPUT_EOF",
+	},
+	{
+		.bitmask = BIT(10),
+		.desc = "INFO_INPUT_EOL",
+	},
+	{
+		.bitmask = BIT(11),
+		.desc = "INFO_INPUT_SOL",
+	},
+	{
+		.bitmask = BIT(12),
+		.desc = "INFO_INPUT_SOF",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(14),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_LINE_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(15),
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.bitmask = BIT(16),
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.bitmask = BIT(17),
+		.desc = "VCDT_GRP_CHANGE",
+	},
+	{
+		.bitmask = BIT(18),
+		.desc = "FRAME_DROP",
+	},
+	{
+		.bitmask = BIT(19),
+		.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+		.desc = "OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.bitmask = BIT(20),
+		.desc = "ERROR_REC_CCIF_VIOLATION From Camif",
+	},
+	{
+		.bitmask = BIT(21),
+		.desc = "CAMIF_EPOCH0",
+	},
+	{
+		.bitmask = BIT(22),
+		.desc = "CAMIF_EPOCH1",
+	},
+	{
+		.bitmask = BIT(23),
+		.desc = "RUP_DONE",
+	},
+	{
+		.bitmask = BIT(24),
+		.desc = "ILLEGAL_BATCH_ID",
+	},
+	{
+		.bitmask = BIT(25),
+		.desc = "BATCH_END_MISSING_VIOLATION",
+	},
+	{
+		.bitmask = BIT(26),
+		.desc = "HEIGHT_OVERFLOW_VIOLATION",
+	},
+	{
+		.bitmask = BIT(27),
+		.desc = "WIDTH_OVERFLOW_VIOLATION",
+	},
+	{
+		.bitmask = BIT(28),
+		.desc = "HEIGHT_UNDERFLOW_VIOLATION",
+	},
+	{
+		.bitmask = BIT(29),
+		.desc = "WIDTH_UNDERFLOW_VIOLATION",
+	},
+	{
+		.bitmask = BIT(30),
+		.desc = "SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP",
+		.err_handler = cam_ife_csid_hw_ver2_mup_mismatch_handler,
+	},
+	{
+		.bitmask = BIT(31),
+		.desc = "CCIF_VIOLATION: Bad frame timings",
+	},
+};
+
+static struct cam_irq_register_set cam_ife_csid_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_MAX] = {
+	/* Top */
+	{
+		.mask_reg_offset   = 0x00000080,
+		.clear_reg_offset  = 0x00000084,
+		.status_reg_offset = 0x0000007C,
+		.set_reg_offset    = 0x00000088,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	/* RX */
+	{
+		.mask_reg_offset   = 0x000000A0,
+		.clear_reg_offset  = 0x000000A4,
+		.status_reg_offset = 0x0000009C,
+	},
+	/* RDI0 */
+	{
+		.mask_reg_offset   = 0x000000F0,
+		.clear_reg_offset  = 0x000000F4,
+		.status_reg_offset = 0x000000EC,
+	},
+	/* RDI1 */
+	{
+		.mask_reg_offset   = 0x00000100,
+		.clear_reg_offset  = 0x00000104,
+		.status_reg_offset = 0x000000FC,
+	},
+	/* RDI2 */
+	{
+		.mask_reg_offset   = 0x00000110,
+		.clear_reg_offset  = 0x00000114,
+		.status_reg_offset = 0x0000010C,
+	},
+	/* RDI3 */
+	{0},
+	/* RDI4 */
+	{0},
+	/* RDI5 */
+	{0},
+	/* IPP */
+	{
+		.mask_reg_offset   = 0x000000E0,
+		.clear_reg_offset  = 0x000000E4,
+		.status_reg_offset = 0x000000DC,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_690_top_irq_reg_info[] = {
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP],
+	.global_irq_cmd_offset = 0x00000014,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_690_rx_irq_reg_info[] = {
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX],
+	.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+};
+
+static struct cam_irq_controller_reg_info
+		cam_ife_csid_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_MAX] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_0],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_1],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_2],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	/* No RDI3 */
+	{0},
+	/* No RDI4 */
+	{0},
+	/* No RDI5 */
+	{0},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+};
+
+static struct cam_irq_register_set cam_ife_csid_690_buf_done_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000090,
+		.clear_reg_offset  = 0x00000094,
+		.status_reg_offset = 0x0000008C,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_690_buf_done_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = cam_ife_csid_690_buf_done_irq_reg_set,
+	.global_irq_cmd_offset  = 0, /* intentionally set to zero */
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_690_ipp_reg_info = {
+		.irq_status_addr                  = 0xDC,
+		.irq_mask_addr                    = 0xE0,
+		.irq_clear_addr                   = 0xE4,
+		.irq_set_addr                     = 0xE8,
+		.cfg0_addr                        = 0x300,
+		.ctrl_addr                        = 0x304,
+		.debug_clr_cmd_addr               = 0x308,
+		.multi_vcdt_cfg0_addr             = 0x30C,
+		.cfg1_addr                        = 0x310,
+		.err_recovery_cfg0_addr           = 0x318,
+		.err_recovery_cfg1_addr           = 0x31C,
+		.err_recovery_cfg2_addr           = 0x320,
+		.camif_frame_cfg_addr             = 0x330,
+		.epoch_irq_cfg_addr               = 0x334,
+		.epoch0_subsample_ptrn_addr       = 0x338,
+		.epoch1_subsample_ptrn_addr       = 0x33C,
+		.debug_camif_1_addr               = 0x340,
+		.debug_camif_0_addr               = 0x344,
+		.debug_halt_status_addr           = 0x348,
+		.debug_misr_val0_addr             = 0x34C,
+		.debug_misr_val1_addr             = 0x350,
+		.debug_misr_val2_addr             = 0x354,
+		.debug_misr_val3_addr             = 0x358,
+		.hcrop_addr                       = 0x35C,
+		.vcrop_addr                       = 0x360,
+		.pix_drop_pattern_addr            = 0x364,
+		.pix_drop_period_addr             = 0x368,
+		.line_drop_pattern_addr           = 0x36C,
+		.line_drop_period_addr            = 0x370,
+		.frm_drop_pattern_addr            = 0x374,
+		.frm_drop_period_addr             = 0x378,
+		.irq_subsample_pattern_addr       = 0x37C,
+		.irq_subsample_period_addr        = 0x380,
+		.format_measure_cfg0_addr         = 0x384,
+		.format_measure_cfg1_addr         = 0x388,
+		.format_measure0_addr             = 0x38C,
+		.format_measure1_addr             = 0x390,
+		.format_measure2_addr             = 0x394,
+		.timestamp_curr0_sof_addr         = 0x398,
+		.timestamp_curr1_sof_addr         = 0x39C,
+		.timestamp_perv0_sof_addr         = 0x3A0,
+		.timestamp_perv1_sof_addr         = 0x3A4,
+		.timestamp_curr0_eof_addr         = 0x3A8,
+		.timestamp_curr1_eof_addr         = 0x3AC,
+		.timestamp_perv0_eof_addr         = 0x3B0,
+		.timestamp_perv1_eof_addr         = 0x3B4,
+		.lut_bank_cfg_addr                = 0,
+		.batch_id_cfg0_addr               = 0x3BC,
+		.batch_id_cfg1_addr               = 0x3C0,
+		.batch_period_cfg_addr            = 0x3C4,
+		.batch_stream_id_cfg_addr         = 0x3C8,
+		.epoch0_cfg_batch_id0_addr        = 0x3CC,
+		.epoch1_cfg_batch_id0_addr        = 0x3D0,
+		.epoch0_cfg_batch_id1_addr        = 0x3D4,
+		.epoch1_cfg_batch_id1_addr        = 0x3D8,
+		.epoch0_cfg_batch_id2_addr        = 0x3DC,
+		.epoch1_cfg_batch_id2_addr        = 0x3E0,
+		.epoch0_cfg_batch_id3_addr        = 0x3E4,
+		.epoch1_cfg_batch_id3_addr        = 0x3E8,
+		.epoch0_cfg_batch_id4_addr        = 0x3EC,
+		.epoch1_cfg_batch_id4_addr        = 0x3F0,
+		.epoch0_cfg_batch_id5_addr        = 0x3F4,
+		.epoch1_cfg_batch_id5_addr        = 0x3F8,
+		.frame_freeze_crc_cfg0            = 0x3FC,
+		.debug_frame_freeze_crc           = 0x400,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.binning_supported                = 0x7,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.start_mode_shift                 = 2,
+		.start_master_sel_val             = 0,
+		.start_master_sel_shift           = 4,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.pix_store_en_shift_val           = 14,
+		.early_eof_en_shift_val           = 16,
+		.bin_h_en_shift_val               = 20,
+		.bin_v_en_shift_val               = 21,
+		.bin_en_shift_val                 = 18,
+		.bin_qcfa_en_shift_val            = 19,
+		.format_measure_en_shift_val      = 8,
+		.timestamp_en_shift_val           = 9,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 4,
+		.start_master_sel_shift_val       = 4,
+		.bin_pd_en_shift_val              = 0,
+		.bin_pd_blk_w_shift_val           = 8,
+		.bin_pd_blk_h_shift_val           = 24,
+		.bin_pd_detect_x_offset_shift_val = 0,
+		.bin_pd_detect_x_end_shift_val    = 16,
+		.bin_pd_detect_y_offset_shift_val = 0,
+		.bin_pd_detect_y_end_shift_val    = 16,
+		.lut_bank_0_sel_val               = 0,
+		.lut_bank_1_sel_val               = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x10001,
+		.top_irq_mask                     = {0x10,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_690_rdi_0_reg_info = {
+		.irq_status_addr                  = 0xEC,
+		.irq_mask_addr                    = 0xF0,
+		.irq_clear_addr                   = 0xF4,
+		.irq_set_addr                     = 0xF8,
+		.cfg0_addr                        = 0x500,
+		.ctrl_addr                        = 0x504,
+		.debug_clr_cmd_addr               = 0x508,
+		.multi_vcdt_cfg0_addr             = 0x50c,
+		.cfg1_addr                        = 0x510,
+		.err_recovery_cfg0_addr           = 0x514,
+		.err_recovery_cfg1_addr           = 0x518,
+		.err_recovery_cfg2_addr           = 0x51C,
+		.debug_byte_cntr_ping_addr        = 0x520,
+		.debug_byte_cntr_pong_addr        = 0x524,
+		.camif_frame_cfg_addr             = 0x528,
+		.epoch_irq_cfg_addr               = 0x52C,
+		.epoch0_subsample_ptrn_addr       = 0x530,
+		.epoch1_subsample_ptrn_addr       = 0x534,
+		.debug_camif_1_addr               = 0x538,
+		.debug_camif_0_addr               = 0x53C,
+		.frm_drop_pattern_addr            = 0x540,
+		.frm_drop_period_addr             = 0x540,
+		.irq_subsample_pattern_addr       = 0x548,
+		.irq_subsample_period_addr        = 0x54C,
+		.hcrop_addr                       = 0x550,
+		.vcrop_addr                       = 0x554,
+		.pix_drop_pattern_addr            = 0x558,
+		.pix_drop_period_addr             = 0x55C,
+		.line_drop_pattern_addr           = 0x560,
+		.line_drop_period_addr            = 0x564,
+		.debug_halt_status_addr           = 0x56C,
+		.debug_misr_val0_addr             = 0x570,
+		.debug_misr_val1_addr             = 0x574,
+		.debug_misr_val2_addr             = 0x578,
+		.debug_misr_val3_addr             = 0x57C,
+		.format_measure_cfg0_addr         = 0x580,
+		.format_measure_cfg1_addr         = 0x584,
+		.format_measure0_addr             = 0x588,
+		.format_measure1_addr             = 0x58C,
+		.format_measure2_addr             = 0x590,
+		.timestamp_curr0_sof_addr         = 0x594,
+		.timestamp_curr1_sof_addr         = 0x598,
+		.timestamp_perv0_sof_addr         = 0x59C,
+		.timestamp_perv1_sof_addr         = 0x5A0,
+		.timestamp_curr0_eof_addr         = 0x5A4,
+		.timestamp_curr1_eof_addr         = 0x5A8,
+		.timestamp_perv0_eof_addr         = 0x5AC,
+		.timestamp_perv1_eof_addr         = 0x5B0,
+		.batch_id_cfg0_addr               = 0x5B4,
+		.batch_id_cfg1_addr               = 0x5B8,
+		.batch_period_cfg_addr            = 0x5BC,
+		.batch_stream_id_cfg_addr         = 0x5C0,
+		.epoch0_cfg_batch_id0_addr        = 0x5C4,
+		.epoch1_cfg_batch_id0_addr        = 0x5C8,
+		.epoch0_cfg_batch_id1_addr        = 0x5CC,
+		.epoch1_cfg_batch_id1_addr        = 0x5D0,
+		.epoch0_cfg_batch_id2_addr        = 0x5D4,
+		.epoch1_cfg_batch_id2_addr        = 0x5D8,
+		.epoch0_cfg_batch_id3_addr        = 0x5DC,
+		.epoch1_cfg_batch_id3_addr        = 0x5E0,
+		.epoch0_cfg_batch_id4_addr        = 0x5E4,
+		.epoch1_cfg_batch_id4_addr        = 0x5E8,
+		.epoch0_cfg_batch_id5_addr        = 0x5EC,
+		.epoch1_cfg_batch_id5_addr        = 0x5F0,
+		.frame_freeze_crc_cfg0            = 0x5F4,
+		.debug_frame_freeze_crc           = 0x5F8,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 4,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x100010,
+		.top_irq_mask                     = {0x100,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_690_rdi_1_reg_info = {
+		.irq_status_addr                  = 0xFC,
+		.irq_mask_addr                    = 0x100,
+		.irq_clear_addr                   = 0x104,
+		.irq_set_addr                     = 0x108,
+		.cfg0_addr                        = 0x600,
+		.ctrl_addr                        = 0x604,
+		.debug_clr_cmd_addr               = 0x608,
+		.multi_vcdt_cfg0_addr             = 0x60c,
+		.cfg1_addr                        = 0x610,
+		.err_recovery_cfg0_addr           = 0x614,
+		.err_recovery_cfg1_addr           = 0x618,
+		.err_recovery_cfg2_addr           = 0x61C,
+		.debug_byte_cntr_ping_addr        = 0x620,
+		.debug_byte_cntr_pong_addr        = 0x624,
+		.camif_frame_cfg_addr             = 0x628,
+		.epoch_irq_cfg_addr               = 0x62C,
+		.epoch0_subsample_ptrn_addr       = 0x630,
+		.epoch1_subsample_ptrn_addr       = 0x634,
+		.debug_camif_1_addr               = 0x638,
+		.debug_camif_0_addr               = 0x63C,
+		.frm_drop_pattern_addr            = 0x640,
+		.frm_drop_period_addr             = 0x644,
+		.irq_subsample_pattern_addr       = 0x648,
+		.irq_subsample_period_addr        = 0x64C,
+		.hcrop_addr                       = 0x650,
+		.vcrop_addr                       = 0x654,
+		.pix_drop_pattern_addr            = 0x658,
+		.pix_drop_period_addr             = 0x65C,
+		.line_drop_pattern_addr           = 0x660,
+		.line_drop_period_addr            = 0x664,
+		.debug_halt_status_addr           = 0x66C,
+		.debug_misr_val0_addr             = 0x670,
+		.debug_misr_val1_addr             = 0x674,
+		.debug_misr_val2_addr             = 0x678,
+		.debug_misr_val3_addr             = 0x67C,
+		.format_measure_cfg0_addr         = 0x690,
+		.format_measure_cfg1_addr         = 0x684,
+		.format_measure0_addr             = 0x688,
+		.format_measure1_addr             = 0x68C,
+		.format_measure2_addr             = 0x690,
+		.timestamp_curr0_sof_addr         = 0x694,
+		.timestamp_curr1_sof_addr         = 0x698,
+		.timestamp_perv0_sof_addr         = 0x69C,
+		.timestamp_perv1_sof_addr         = 0x6A0,
+		.timestamp_curr0_eof_addr         = 0x6A4,
+		.timestamp_curr1_eof_addr         = 0x6A8,
+		.timestamp_perv0_eof_addr         = 0x6AC,
+		.timestamp_perv1_eof_addr         = 0x6B0,
+		.batch_id_cfg0_addr               = 0x6B4,
+		.batch_id_cfg1_addr               = 0x6B8,
+		.batch_period_cfg_addr            = 0x6BC,
+		.batch_stream_id_cfg_addr         = 0x6C0,
+		.epoch0_cfg_batch_id0_addr        = 0x6C4,
+		.epoch1_cfg_batch_id0_addr        = 0x6C8,
+		.epoch0_cfg_batch_id1_addr        = 0x6CC,
+		.epoch1_cfg_batch_id1_addr        = 0x6D0,
+		.epoch0_cfg_batch_id2_addr        = 0x6D4,
+		.epoch1_cfg_batch_id2_addr        = 0x6D8,
+		.epoch0_cfg_batch_id3_addr        = 0x6DC,
+		.epoch1_cfg_batch_id3_addr        = 0x6E0,
+		.epoch0_cfg_batch_id4_addr        = 0x6E4,
+		.epoch1_cfg_batch_id4_addr        = 0x6E8,
+		.epoch0_cfg_batch_id5_addr        = 0x6EC,
+		.epoch1_cfg_batch_id5_addr        = 0x6F0,
+		.frame_freeze_crc_cfg0            = 0x6F4,
+		.debug_frame_freeze_crc           = 0x6F8,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.mipi_pack_supported              = 1,
+		.offline_mode_supported           = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 4,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x200020,
+		.top_irq_mask                     = {0x200,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_690_rdi_2_reg_info = {
+		.irq_status_addr                  = 0x10C,
+		.irq_mask_addr                    = 0x110,
+		.irq_clear_addr                   = 0x114,
+		.irq_set_addr                     = 0x118,
+		.cfg0_addr                        = 0x700,
+		.ctrl_addr                        = 0x704,
+		.debug_clr_cmd_addr               = 0x708,
+		.multi_vcdt_cfg0_addr             = 0x70c,
+		.cfg1_addr                        = 0x710,
+		.err_recovery_cfg0_addr           = 0x714,
+		.err_recovery_cfg1_addr           = 0x718,
+		.err_recovery_cfg2_addr           = 0x71C,
+		.debug_byte_cntr_ping_addr        = 0x720,
+		.debug_byte_cntr_pong_addr        = 0x724,
+		.camif_frame_cfg_addr             = 0x728,
+		.epoch_irq_cfg_addr               = 0x72C,
+		.epoch0_subsample_ptrn_addr       = 0x730,
+		.epoch1_subsample_ptrn_addr       = 0x734,
+		.debug_camif_1_addr               = 0x738,
+		.debug_camif_0_addr               = 0x73C,
+		.frm_drop_pattern_addr            = 0x740,
+		.frm_drop_period_addr             = 0x744,
+		.irq_subsample_pattern_addr       = 0x748,
+		.irq_subsample_period_addr        = 0x74C,
+		.hcrop_addr                       = 0x750,
+		.vcrop_addr                       = 0x754,
+		.pix_drop_pattern_addr            = 0x758,
+		.pix_drop_period_addr             = 0x75C,
+		.line_drop_pattern_addr           = 0x760,
+		.line_drop_period_addr            = 0x764,
+		.debug_halt_status_addr           = 0x76C,
+		.debug_misr_val0_addr             = 0x770,
+		.debug_misr_val1_addr             = 0x774,
+		.debug_misr_val2_addr             = 0x778,
+		.debug_misr_val3_addr             = 0x77C,
+		.format_measure_cfg0_addr         = 0x780,
+		.format_measure_cfg1_addr         = 0x784,
+		.format_measure0_addr             = 0x788,
+		.format_measure1_addr             = 0x78C,
+		.format_measure2_addr             = 0x790,
+		.timestamp_curr0_sof_addr         = 0x794,
+		.timestamp_curr1_sof_addr         = 0x798,
+		.timestamp_perv0_sof_addr         = 0x79C,
+		.timestamp_perv1_sof_addr         = 0x7A0,
+		.timestamp_curr0_eof_addr         = 0x7A4,
+		.timestamp_curr1_eof_addr         = 0x7A8,
+		.timestamp_perv0_eof_addr         = 0x7AC,
+		.timestamp_perv1_eof_addr         = 0x7B0,
+		.batch_id_cfg0_addr               = 0x7B4,
+		.batch_id_cfg1_addr               = 0x7B8,
+		.batch_period_cfg_addr            = 0x7BC,
+		.batch_stream_id_cfg_addr         = 0x7C0,
+		.epoch0_cfg_batch_id0_addr        = 0x7C4,
+		.epoch1_cfg_batch_id0_addr        = 0x7C8,
+		.epoch0_cfg_batch_id1_addr        = 0x7CC,
+		.epoch1_cfg_batch_id1_addr        = 0x7D0,
+		.epoch0_cfg_batch_id2_addr        = 0x7D4,
+		.epoch1_cfg_batch_id2_addr        = 0x7D8,
+		.epoch0_cfg_batch_id3_addr        = 0x7DC,
+		.epoch1_cfg_batch_id3_addr        = 0x7E0,
+		.epoch0_cfg_batch_id4_addr        = 0x7E4,
+		.epoch1_cfg_batch_id4_addr        = 0x7E8,
+		.epoch0_cfg_batch_id5_addr        = 0x7EC,
+		.epoch1_cfg_batch_id5_addr        = 0x7F0,
+		.frame_freeze_crc_cfg0            = 0x7F4,
+		.debug_frame_freeze_crc           = 0x7F8,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.mipi_pack_supported              = 1,
+		.offline_mode_supported           = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 4,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x186004,
+		.non_fatal_err_mask               = 0x10000000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x400040,
+		.top_irq_mask                     = {0x400,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_csi2_rx_reg_info
+	cam_ife_csid_690_csi2_reg_info = {
+		.irq_status_addr                 = {0x9C,},
+		.irq_mask_addr                   = {0xA0,},
+		.irq_clear_addr                  = {0xA4,},
+		.irq_set_addr                    = {0xA8,},
+		/*CSI2 rx control */
+		.cfg0_addr                       = 0x200,
+		.cfg1_addr                       = 0x204,
+		.capture_ctrl_addr               = 0x208,
+		.rst_strobes_addr                = 0x20C,
+		.cap_unmap_long_pkt_hdr_0_addr   = 0x210,
+		.cap_unmap_long_pkt_hdr_1_addr   = 0x214,
+		.captured_short_pkt_0_addr       = 0x218,
+		.captured_short_pkt_1_addr       = 0x21C,
+		.captured_long_pkt_0_addr        = 0x220,
+		.captured_long_pkt_1_addr        = 0x224,
+		.captured_long_pkt_ftr_addr      = 0x228,
+		.captured_cphy_pkt_hdr_addr      = 0x22C,
+		.lane0_misr_addr                 = 0x230,
+		.lane1_misr_addr                 = 0x234,
+		.lane2_misr_addr                 = 0x238,
+		.lane3_misr_addr                 = 0x23C,
+		.total_pkts_rcvd_addr            = 0x240,
+		.stats_ecc_addr                  = 0x244,
+		.total_crc_err_addr              = 0x248,
+		.de_scramble_type3_cfg0_addr     = 0x24C,
+		.de_scramble_type3_cfg1_addr     = 0x250,
+		.de_scramble_type2_cfg0_addr     = 0x254,
+		.de_scramble_type2_cfg1_addr     = 0x258,
+		.de_scramble_type1_cfg0_addr     = 0x25C,
+		.de_scramble_type1_cfg1_addr     = 0x260,
+		.de_scramble_type0_cfg0_addr     = 0x264,
+		.de_scramble_type0_cfg1_addr     = 0x268,
+
+		.rst_done_shift_val              = 27,
+		.irq_mask_all                    = 0xFFFFFFF,
+		.misr_enable_shift_val           = 6,
+		.vc_mode_shift_val               = 2,
+		.capture_long_pkt_en_shift       = 0,
+		.capture_short_pkt_en_shift      = 1,
+		.capture_cphy_pkt_en_shift       = 2,
+		.capture_long_pkt_dt_shift       = 4,
+		.capture_long_pkt_vc_shift       = 10,
+		.capture_short_pkt_vc_shift      = 15,
+		.capture_cphy_pkt_dt_shift       = 20,
+		.capture_cphy_pkt_vc_shift       = 26,
+		.phy_num_mask                    = 0xf,
+		.vc_mask                         = 0x7C00000,
+		.dt_mask                         = 0x3f0000,
+		.wc_mask                         = 0xffff,
+		.vc_shift                        = 0x16,
+		.dt_shift                        = 0x10,
+		.wc_shift                        = 0,
+		.calc_crc_mask                   = 0xffff,
+		.expected_crc_mask               = 0xffff,
+		.calc_crc_shift                  = 0x10,
+		.ecc_correction_shift_en         = 0,
+		.lane_num_shift                  = 0,
+		.lane_cfg_shift                  = 4,
+		.phy_type_shift                  = 24,
+		.phy_num_shift                   = 20,
+		.tpg_mux_en_shift                = 27,
+		.tpg_num_sel_shift               = 28,
+		.phy_bist_shift_en               = 7,
+		.epd_mode_shift_en               = 8,
+		.eotp_shift_en                   = 9,
+		.dyn_sensor_switch_shift_en      = 10,
+		.long_pkt_strobe_rst_shift       = 0,
+		.short_pkt_strobe_rst_shift      = 1,
+		.cphy_pkt_strobe_rst_shift       = 2,
+		.unmapped_pkt_strobe_rst_shift   = 3,
+		.fatal_err_mask                  = {0x19FA800,},
+		.part_fatal_err_mask             = {0x0001000,},
+		.non_fatal_err_mask              = {0x0200000,},
+		.top_irq_mask                    = {0x4,},
+};
+
+static struct cam_ife_csid_ver2_common_reg_info
+			cam_ife_csid_690_cmn_reg_info = {
+	.hw_version_addr                         = 0x0,
+	.cfg0_addr                               = 0x4,
+	.global_cmd_addr                         = 0x8,
+	.reset_cfg_addr                          = 0xC,
+	.reset_cmd_addr                          = 0x10,
+	.irq_cmd_addr                            = 0x14,
+	.rup_aup_cmd_addr                        = 0x18,
+	.offline_cmd_addr                        = 0x1C,
+	.shdr_master_slave_cfg_addr              = 0x20,
+	.top_irq_status_addr                     = {0x7C,},
+	.top_irq_mask_addr                       = {0x80,},
+	.top_irq_clear_addr                      = {0x84,},
+	.top_irq_set_addr                        = {0x88,},
+	.buf_done_irq_status_addr                = 0x8C,
+	.buf_done_irq_mask_addr                  = 0x90,
+	.buf_done_irq_clear_addr                 = 0x94,
+	.buf_done_irq_set_addr                   = 0x98,
+	.test_bus_ctrl                           = 0x1F4,
+	.test_bus_debug                          = 0x1F8,
+
+	/*configurations */
+	.major_version                           = 6,
+	.minor_version                           = 9,
+	.version_incr                            = 0,
+	.num_rdis                                = 3,
+	.num_pix                                 = 1,
+	.num_ppp                                 = 0,
+	.rst_done_shift_val                      = 1,
+	.path_en_shift_val                       = 31,
+	.dt_id_shift_val                         = 27,
+	.vc_shift_val                            = 22,
+	.dt_shift_val                            = 16,
+	.crop_shift_val                          = 16,
+	.decode_format_shift_val                 = 12,
+	.decode_format1_supported                = false,
+	.frame_id_decode_en_shift_val            = 1,
+	.multi_vcdt_vc1_shift_val                = 2,
+	.multi_vcdt_dt1_shift_val                = 7,
+	.multi_vcdt_ts_combo_en_shift_val        = 13,
+	.multi_vcdt_en_shift_val                 = 0,
+	.timestamp_stb_sel_shift_val             = 0,
+	.vfr_en_shift_val                        = 0,
+	.mup_shift_val                           = 28,
+	.shdr_slave_rdi2_shift                   = 22,
+	.shdr_slave_rdi1_shift                   = 21,
+	.shdr_master_rdi0_shift                  = 5,
+	.shdr_master_slave_en_shift              = 0,
+	.early_eof_supported                     = 1,
+	.vfr_supported                           = 1,
+	.multi_vcdt_supported                    = 1,
+	.ts_comb_vcdt_en                         = true,
+	.ts_comb_vcdt_mask                       = 3,
+	.frame_id_dec_supported                  = 1,
+	.measure_en_hbi_vbi_cnt_mask             = 0x1c,
+	.measure_pixel_line_en_mask              = 0x3,
+	.crop_pix_start_mask                     = 0x3fff,
+	.crop_pix_end_mask                       = 0xffff,
+	.crop_line_start_mask                    = 0x3fff,
+	.crop_line_end_mask                      = 0xffff,
+	.drop_supported                          = 1,
+	.ipp_irq_mask_all                        = 0xFFFFFFFF,
+	.rdi_irq_mask_all                        = 0xFFFFFFFF,
+	.ppp_irq_mask_all                        = 0xFFFFFFFF,
+	.top_err_irq_mask = {
+		0x0,
+	},
+	.rst_loc_path_only_val                   = 0x0,
+	.rst_loc_complete_csid_val               = 0x1,
+	.rst_mode_frame_boundary_val             = 0x0,
+	.rst_mode_immediate_val                  = 0x1,
+	.rst_cmd_hw_reset_complete_val           = 0x1,
+	.rst_cmd_sw_reset_complete_val           = 0x2,
+	.rst_cmd_irq_ctrl_only_val               = 0x4,
+	.timestamp_strobe_val                    = 0x2,
+	.rst_location_shift_val                  = 4,
+	.rst_mode_shift_val                      = 0,
+	.epoch_factor                            = 50,
+	.global_reset                            = 1,
+	.rup_supported                           = 1,
+	.only_master_rup                         = 1,
+	.format_measure_height_mask_val          = 0xFFFF,
+	.format_measure_height_shift_val         = 0x10,
+	.format_measure_width_mask_val           = 0xFFFF,
+	.format_measure_width_shift_val          = 0x0,
+	.top_reset_irq_mask  = {
+		0x1,
+	},
+	.top_buf_done_irq_mask                   = 0x4000,
+	.phy_sel_base_idx                        = 1,
+	.camif_irq_support                       = true,
+};
+
+static struct cam_ife_csid_ver2_top_reg_info
+			cam_ife_csid_690_top_reg_info = {
+	.io_path_cfg0_addr = {
+				    0x0,
+				    0x4,
+	},
+	.dual_csid_cfg0_addr =  {
+				    0xC,
+				    0x10,
+	},
+	.input_core_type_shift_val      = 0,
+	.out_ife_en_shift_val           = 8,
+	.dual_sync_sel_shift_val        = 8,
+	.dual_en_shift_val              = 0,
+	.master_slave_sel_shift_val     = 1,
+	.master_sel_val                 = 0,
+	.slave_sel_val                  = 1,
+	.io_path_cfg_rst_val            = 1,
+	.dual_cfg_rst_val               = 0,
+	.sfe_pipeline_bypassed          = true,
+};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_690_reg_info = {
+	.top_irq_reg_info      = cam_ife_csid_690_top_irq_reg_info,
+	.rx_irq_reg_info       = cam_ife_csid_690_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		NULL,
+		NULL,
+		NULL,
+		&cam_ife_csid_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+	},
+	.buf_done_irq_reg_info = &cam_ife_csid_690_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_690_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_690_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_690_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_690_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_690_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_690_rdi_2_reg_info,
+	.top_reg                              = &cam_ife_csid_690_top_reg_info,
+	.input_core_sel = {
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+		},
+	},
+	.need_top_cfg = 0x1,
+	.csid_cust_node_map = {0x1, 0x0, 0x2},
+	.rx_irq_desc        = &cam_ife_csid_690_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_690_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_690_num_top_regs,
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+};
+#endif /*_CAM_IFE_CSID_690_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid692.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid692.h
@@ -0,0 +1,61 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_692_H_
+#define _CAM_IFE_CSID_692_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+#define CAM_CSID_VERSION_V692                 0x60090002
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_692_reg_info = {
+	.top_irq_reg_info      = cam_ife_csid_690_top_irq_reg_info,
+	.rx_irq_reg_info       = cam_ife_csid_690_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		NULL,
+		NULL,
+		NULL,
+		&cam_ife_csid_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+	},
+	.buf_done_irq_reg_info = &cam_ife_csid_690_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_690_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_690_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_690_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_690_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_690_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_690_rdi_2_reg_info,
+	.top_reg                              = &cam_ife_csid_690_top_reg_info,
+	.input_core_sel = {
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+		},
+	},
+	.need_top_cfg = 0x1,
+	.csid_cust_node_map = {0x1, 0x0, 0x2},
+	.rx_irq_desc        = &cam_ife_csid_690_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_690_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_690_num_top_regs,
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+};
+#endif /*_CAM_IFE_CSID_692_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid780.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid780.h
@@ -0,0 +1,1473 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_780_H_
+#define _CAM_IFE_CSID_780_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+#define CAM_CSID_VERSION_V780                 0x70080000
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_780_rx_irq_desc[][32] = {
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "DL0_EOT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "DL1_EOT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "DL2_EOT",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "DL3_EOT",
+		},
+		{
+			.bitmask = BIT(4),
+			.desc = "DL0_SOT",
+		},
+		{
+			.bitmask = BIT(5),
+			.desc = "DL1_SOT",
+		},
+		{
+			.bitmask = BIT(6),
+			.desc = "DL2_SOT",
+		},
+		{
+			.bitmask = BIT(7),
+			.desc = "DL3_SOT",
+		},
+		{
+			.bitmask = BIT(8),
+			.desc = "LONG_PKT",
+		},
+		{
+			.bitmask = BIT(9),
+			.desc = "SHORT_PKT",
+		},
+		{
+			.bitmask = BIT(10),
+			.desc = "CPHY_PKT_HDR",
+		},
+		{
+			.bitmask = BIT(11),
+			.desc = "ERROR_CPHY_EOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(12),
+			.desc = "ERROR_CPHY_SOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(13),
+			.desc = "ERROR_CPHY_PH_CRC",
+		},
+		{
+			.bitmask = BIT(14),
+			.desc = "WARNING_ECC",
+		},
+		{
+			.bitmask = BIT(15),
+			.desc = "ERROR_LANE0_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(16),
+			.desc = "ERROR_LANE1_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(17),
+			.desc = "ERROR_LANE2_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(18),
+			.desc = "ERROR_LANE3_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(19),
+			.desc = "ERROR_CRC",
+		},
+		{
+			.bitmask = BIT(20),
+			.desc = "ERROR_ECC",
+		},
+		{
+			.bitmask = BIT(21),
+			.desc = "ERROR_MMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(22),
+			.desc = "ERROR_UNMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(23),
+			.desc = "ERROR_STREAM_UNDERFLOW",
+		},
+		{
+			.bitmask = BIT(24),
+			.desc = "ERROR_UNBOUNDED_FRAME",
+		},
+	},
+};
+
+static const uint32_t cam_ife_csid_780_num_rx_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_780_rx_irq_desc[0]),
+};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_780_path_irq_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FATAL,
+		.desc = "ILLEGAL_PROGRAMMING",
+		.err_handler = cam_ife_csid_ver2_print_illegal_programming_irq_status,
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "EROOR_MSG_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "ERROR_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "CAMIF_EOF",
+	},
+	{
+		.bitmask = BIT(4),
+		.desc = "CAMIF_SOF",
+	},
+	{
+		.bitmask = BIT(5),
+		.desc = "FRAME_DROP_EOF",
+	},
+	{
+		.bitmask = BIT(6),
+		.desc = "FRAME_DROP_EOL",
+	},
+	{
+		.bitmask = BIT(7),
+		.desc = "FRAME_DROP_SOL",
+	},
+	{
+		.bitmask = BIT(8),
+		.desc = "FRAME_DROP_SOF",
+	},
+	{
+		.bitmask = BIT(9),
+		.desc = "INFO_INPUT_EOF",
+	},
+	{
+		.bitmask = BIT(10),
+		.desc = "INFO_INPUT_EOL",
+	},
+	{
+		.bitmask = BIT(11),
+		.desc = "INFO_INPUT_SOL",
+	},
+	{
+		.bitmask = BIT(12),
+		.desc = "INFO_INPUT_SOF",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(14),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_LINE_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(15),
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.bitmask = BIT(16),
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.bitmask = BIT(17),
+		.desc = "VCDT_GRP_CHANGE",
+	},
+	{
+		.bitmask = BIT(18),
+		.desc = "FRAME_DROP",
+	},
+	{
+		.bitmask = BIT(19),
+		.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+		.desc = "OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.bitmask = BIT(20),
+		.desc = "ERROR_REC_CCIF_VIOLATION From Camif",
+	},
+	{
+		.bitmask = BIT(21),
+		.desc = "CAMIF_EPOCH0",
+	},
+	{
+		.bitmask = BIT(22),
+		.desc = "CAMIF_EPOCH1",
+	},
+	{
+		.bitmask = BIT(23),
+		.desc = "RUP_DONE",
+	},
+	{
+		.bitmask = BIT(24),
+		.desc = "ILLEGAL_BATCH_ID",
+	},
+	{
+		.bitmask = BIT(25),
+		.desc = "BATCH_END_MISSING_VIOLATION",
+	},
+	{
+		.bitmask = BIT(26),
+		.desc = "HEIGHT_VIOLATION",
+	},
+	{
+		.bitmask = BIT(27),
+		.desc = "WIDTH_VIOLATION",
+	},
+	{
+		.bitmask = BIT(28),
+		.desc = "SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP",
+		.err_handler = cam_ife_csid_hw_ver2_mup_mismatch_handler,
+	},
+	{
+		.bitmask = BIT(29),
+		.desc = "CCIF_VIOLATION: Bad frame timings",
+	},
+};
+
+static const struct cam_ife_csid_top_irq_desc cam_ife_csid_780_top_irq_desc[][32] = {
+	{
+		{
+			.bitmask  = BIT(1),
+			.err_type = CAM_ISP_HW_ERROR_CSID_SENSOR_SWITCH_ERROR,
+			.err_name = "FATAL_SENSOR_SWITCHING_IRQ",
+			.desc = "Fatal Error during dynamically switching between 2 sensors",
+		},
+		{
+			.bitmask  = BIT(18),
+			.err_name = "ERROR_NO_VOTE_DN",
+			.desc = "vote_up is asserted before IDLE is encountered in a frame",
+		},
+		{
+			.bitmask  = BIT(19),
+			.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+			.err_name = "ERROR_VOTE_UP_LATE",
+			.desc = "vote_up is asserted at the same time as an SOF",
+			.err_handler = cam_ife_csid_hw_ver2_drv_err_handler,
+		},
+		{
+			.bitmask  = BIT(20),
+			.err_type = CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW,
+			.err_name = "ERROR_RDI_LINE_BUFFER_CONFLICT",
+			.desc = "Two or more RDIs programmed to access the shared line buffer",
+			.err_handler = cam_ife_csid_hw_ver2_rdi_line_buffer_conflict_handler,
+		},
+	},
+};
+
+static const uint32_t cam_ife_csid_780_num_top_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_780_top_irq_desc[0]),
+};
+
+static struct cam_irq_register_set cam_ife_csid_780_irq_reg_set[9] = {
+	/* Top */
+	{
+		.mask_reg_offset   = 0x00000080,
+		.clear_reg_offset  = 0x00000084,
+		.status_reg_offset = 0x0000007C,
+		.set_reg_offset    = 0x00000088,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	/* RX */
+	{
+		.mask_reg_offset   = 0x000000A0,
+		.clear_reg_offset  = 0x000000A4,
+		.status_reg_offset = 0x0000009C,
+	},
+	/* RDI0 */
+	{
+		.mask_reg_offset   = 0x000000F0,
+		.clear_reg_offset  = 0x000000F4,
+		.status_reg_offset = 0x000000EC,
+	},
+	/* RDI1 */
+	{
+		.mask_reg_offset   = 0x00000100,
+		.clear_reg_offset  = 0x00000104,
+		.status_reg_offset = 0x000000FC,
+	},
+	/* RDI2 */
+	{
+		.mask_reg_offset   = 0x00000110,
+		.clear_reg_offset  = 0x00000114,
+		.status_reg_offset = 0x0000010C,
+	},
+	/* RDI3 */
+	{
+		.mask_reg_offset   = 0x00000120,
+		.clear_reg_offset  = 0x00000124,
+		.status_reg_offset = 0x0000011C,
+	},
+	/* RDI4 */
+	{
+		.mask_reg_offset   = 0x00000130,
+		.clear_reg_offset  = 0x00000134,
+		.status_reg_offset = 0x0000012C,
+	},
+	/* IPP */
+	{
+		.mask_reg_offset   = 0x000000B0,
+		.clear_reg_offset  = 0x000000B4,
+		.status_reg_offset = 0x000000AC,
+	},
+	/* PPP */
+	{
+		.mask_reg_offset   = 0x000000D0,
+		.clear_reg_offset  = 0x000000D4,
+		.status_reg_offset = 0x000000CC,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_780_top_irq_reg_info[] = {
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP],
+	.global_irq_cmd_offset = 0x00000014,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_780_rx_irq_reg_info[] = {
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX],
+	.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_780_path_irq_reg_info[7] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_0],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_1],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_2],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_3],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_4],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_PPP],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+};
+
+static struct cam_irq_register_set cam_ife_csid_780_buf_done_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000090,
+		.clear_reg_offset  = 0x00000094,
+		.status_reg_offset = 0x0000008C,
+	},
+};
+
+static struct cam_irq_controller_reg_info
+	cam_ife_csid_780_buf_done_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = cam_ife_csid_780_buf_done_irq_reg_set,
+	.global_irq_cmd_offset  = 0, /* intentionally set to zero */
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_780_ipp_reg_info = {
+		.irq_status_addr                  = 0xAC,
+		.irq_mask_addr                    = 0xB0,
+		.irq_clear_addr                   = 0xB4,
+		.irq_set_addr                     = 0xB8,
+		.cfg0_addr                        = 0x300,
+		.ctrl_addr                        = 0x304,
+		.debug_clr_cmd_addr               = 0x308,
+		.multi_vcdt_cfg0_addr             = 0x30C,
+		.cfg1_addr                        = 0x310,
+		.err_recovery_cfg0_addr           = 0x318,
+		.err_recovery_cfg1_addr           = 0x31C,
+		.err_recovery_cfg2_addr           = 0x320,
+		.bin_pd_detect_cfg0_addr          = 0x324,
+		.bin_pd_detect_cfg1_addr          = 0x328,
+		.bin_pd_detect_cfg2_addr          = 0x32C,
+		.camif_frame_cfg_addr             = 0x330,
+		.epoch_irq_cfg_addr               = 0x334,
+		.epoch0_subsample_ptrn_addr       = 0x338,
+		.epoch1_subsample_ptrn_addr       = 0x33C,
+		.debug_camif_1_addr               = 0x340,
+		.debug_camif_0_addr               = 0x344,
+		.debug_halt_status_addr           = 0x348,
+		.debug_misr_val0_addr             = 0x34C,
+		.debug_misr_val1_addr             = 0x350,
+		.debug_misr_val2_addr             = 0x354,
+		.debug_misr_val3_addr             = 0x358,
+		.hcrop_addr                       = 0x35c,
+		.vcrop_addr                       = 0x360,
+		.pix_drop_pattern_addr            = 0x364,
+		.pix_drop_period_addr             = 0x368,
+		.line_drop_pattern_addr           = 0x36C,
+		.line_drop_period_addr            = 0x370,
+		.frm_drop_pattern_addr            = 0x374,
+		.frm_drop_period_addr             = 0x378,
+		.irq_subsample_pattern_addr       = 0x37C,
+		.irq_subsample_period_addr        = 0x380,
+		.format_measure_cfg0_addr         = 0x384,
+		.format_measure_cfg1_addr         = 0x388,
+		.format_measure0_addr             = 0x38C,
+		.format_measure1_addr             = 0x390,
+		.format_measure2_addr             = 0x394,
+		.timestamp_curr0_sof_addr         = 0x398,
+		.timestamp_curr1_sof_addr         = 0x39C,
+		.timestamp_perv0_sof_addr         = 0x3A0,
+		.timestamp_perv1_sof_addr         = 0x3A4,
+		.timestamp_curr0_eof_addr         = 0x3A8,
+		.timestamp_curr1_eof_addr         = 0x3AC,
+		.timestamp_perv0_eof_addr         = 0x3B0,
+		.timestamp_perv1_eof_addr         = 0x3B4,
+		.lut_bank_cfg_addr                = 0x3B8,
+		.batch_id_cfg0_addr               = 0x3BC,
+		.batch_id_cfg1_addr               = 0x3C0,
+		.batch_period_cfg_addr            = 0x3C4,
+		.batch_stream_id_cfg_addr         = 0x3C8,
+		.epoch0_cfg_batch_id0_addr        = 0x3CC,
+		.epoch1_cfg_batch_id0_addr        = 0x3D0,
+		.epoch0_cfg_batch_id1_addr        = 0x3D4,
+		.epoch1_cfg_batch_id1_addr        = 0x3D8,
+		.epoch0_cfg_batch_id2_addr        = 0x3DC,
+		.epoch1_cfg_batch_id2_addr        = 0x3E0,
+		.epoch0_cfg_batch_id3_addr        = 0x3E4,
+		.epoch1_cfg_batch_id3_addr        = 0x3E8,
+		.epoch0_cfg_batch_id4_addr        = 0x3EC,
+		.epoch1_cfg_batch_id4_addr        = 0x3F0,
+		.epoch0_cfg_batch_id5_addr        = 0x3F4,
+		.epoch1_cfg_batch_id5_addr        = 0x3F8,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.binning_supported                = 0x7,
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.sof_retiming_dis_shift           = 5,
+		.start_mode_shift                 = 2,
+		.start_master_sel_val             = 0,
+		.start_master_sel_shift           = 4,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.pix_store_en_shift_val           = 14,
+		.early_eof_en_shift_val           = 16,
+		.bin_h_en_shift_val               = 20,
+		.bin_v_en_shift_val               = 21,
+		.bin_en_shift_val                 = 18,
+		.bin_qcfa_en_shift_val            = 19,
+		.format_measure_en_shift_val      = 8,
+		.timestamp_en_shift_val           = 6,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 4,
+		.start_master_sel_shift_val       = 4,
+		.bin_pd_en_shift_val              = 0,
+		.bin_pd_blk_w_shift_val           = 8,
+		.bin_pd_blk_h_shift_val           = 24,
+		.bin_pd_detect_x_offset_shift_val = 0,
+		.bin_pd_detect_x_end_shift_val    = 16,
+		.bin_pd_detect_y_offset_shift_val = 0,
+		.bin_pd_detect_y_end_shift_val    = 16,
+		.lut_bank_0_sel_val               = 0,
+		.lut_bank_1_sel_val               = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000006,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x10001,
+		.top_irq_mask                     = {0x10,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_780_ppp_reg_info = {
+		.irq_status_addr                  = 0xCC,
+		.irq_mask_addr                    = 0xD0,
+		.irq_clear_addr                   = 0xD4,
+		.irq_set_addr                     = 0xD8,
+		.cfg0_addr                        = 0xB00,
+		.ctrl_addr                        = 0xB04,
+		.debug_clr_cmd_addr               = 0xB08,
+		.multi_vcdt_cfg0_addr             = 0xB0C,
+		.cfg1_addr                        = 0xB10,
+		.sparse_pd_extractor_cfg_addr     = 0xB14,
+		.err_recovery_cfg0_addr           = 0xB18,
+		.err_recovery_cfg1_addr           = 0xB1C,
+		.err_recovery_cfg2_addr           = 0xB20,
+		.camif_frame_cfg_addr             = 0xB30,
+		.epoch_irq_cfg_addr               = 0xB34,
+		.epoch0_subsample_ptrn_addr       = 0xB38,
+		.epoch1_subsample_ptrn_addr       = 0xB3C,
+		.debug_camif_1_addr               = 0xB40,
+		.debug_camif_0_addr               = 0xB44,
+		.debug_halt_status_addr           = 0xB48,
+		.debug_misr_val0_addr             = 0xB4C,
+		.debug_misr_val1_addr             = 0xB50,
+		.debug_misr_val2_addr             = 0xB54,
+		.debug_misr_val3_addr             = 0xB58,
+		.hcrop_addr                       = 0xB5c,
+		.vcrop_addr                       = 0xB60,
+		.pix_drop_pattern_addr            = 0xB64,
+		.pix_drop_period_addr             = 0xB68,
+		.line_drop_pattern_addr           = 0xB6C,
+		.line_drop_period_addr            = 0xB70,
+		.frm_drop_pattern_addr            = 0xB74,
+		.frm_drop_period_addr             = 0xB78,
+		.irq_subsample_pattern_addr       = 0xB7C,
+		.irq_subsample_period_addr        = 0xB80,
+		.format_measure_cfg0_addr         = 0xB84,
+		.format_measure_cfg1_addr         = 0xB88,
+		.format_measure0_addr             = 0xB8C,
+		.format_measure1_addr             = 0xB90,
+		.format_measure2_addr             = 0xB94,
+		.timestamp_curr0_sof_addr         = 0xB98,
+		.timestamp_curr1_sof_addr         = 0xB9C,
+		.timestamp_perv0_sof_addr         = 0xBA0,
+		.timestamp_perv1_sof_addr         = 0xBA4,
+		.timestamp_curr0_eof_addr         = 0xBA8,
+		.timestamp_curr1_eof_addr         = 0xBAC,
+		.timestamp_perv0_eof_addr         = 0xBB0,
+		.timestamp_perv1_eof_addr         = 0xBB4,
+		.lut_bank_cfg_addr                = 0xBB8,
+		.batch_id_cfg0_addr               = 0xBBC,
+		.batch_id_cfg1_addr               = 0xBC0,
+		.batch_period_cfg_addr            = 0xBC4,
+		.batch_stream_id_cfg_addr         = 0xBC8,
+		.epoch0_cfg_batch_id0_addr        = 0xBCC,
+		.epoch1_cfg_batch_id0_addr        = 0xBD0,
+		.epoch0_cfg_batch_id1_addr        = 0xBD4,
+		.epoch1_cfg_batch_id1_addr        = 0xBD8,
+		.epoch0_cfg_batch_id2_addr        = 0xBDC,
+		.epoch1_cfg_batch_id2_addr        = 0xBE0,
+		.epoch0_cfg_batch_id3_addr        = 0xBE4,
+		.epoch1_cfg_batch_id3_addr        = 0xBE8,
+		.epoch0_cfg_batch_id4_addr        = 0xBEC,
+		.epoch1_cfg_batch_id4_addr        = 0xBF0,
+		.epoch0_cfg_batch_id5_addr        = 0xBF4,
+		.epoch1_cfg_batch_id5_addr        = 0xBF8,
+		/* configurations */
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.resume_frame_boundary            = 1,
+		.start_mode_shift                 = 2,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.start_master_sel_val             = 3,
+		.start_master_sel_shift           = 4,
+		.binning_supported                = 0x1,
+		.bin_h_en_shift_val               = 18,
+		.bin_en_shift_val                 = 18,
+		.early_eof_en_shift_val           = 16,
+		.pix_store_en_shift_val           = 14,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.format_measure_en_shift_val      = 8,
+		.timestamp_en_shift_val           = 6,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 4,
+		.start_master_sel_shift_val       = 4,
+		.lut_bank_0_sel_val               = 0,
+		.lut_bank_1_sel_val               = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000006,
+		.rup_aup_mask                     = 0x40004,
+		.top_irq_mask                     = {0x40,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.sof_retiming_dis_shift           = 5,
+		.crop_drop_enable                 = false,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_780_rdi_0_reg_info = {
+		.irq_status_addr                  = 0xEC,
+		.irq_mask_addr                    = 0xF0,
+		.irq_clear_addr                   = 0xF4,
+		.irq_set_addr                     = 0xF8,
+		.cfg0_addr                        = 0x500,
+		.ctrl_addr                        = 0x504,
+		.debug_clr_cmd_addr               = 0x508,
+		.multi_vcdt_cfg0_addr             = 0x50C,
+		.cfg1_addr                        = 0x510,
+		.err_recovery_cfg0_addr           = 0x514,
+		.err_recovery_cfg1_addr           = 0x518,
+		.err_recovery_cfg2_addr           = 0x51C,
+		.debug_byte_cntr_ping_addr        = 0x520,
+		.debug_byte_cntr_pong_addr        = 0x524,
+		.camif_frame_cfg_addr             = 0x528,
+		.epoch_irq_cfg_addr               = 0x52C,
+		.epoch0_subsample_ptrn_addr       = 0x530,
+		.epoch1_subsample_ptrn_addr       = 0x534,
+		.debug_camif_1_addr               = 0x538,
+		.debug_camif_0_addr               = 0x53C,
+		.frm_drop_pattern_addr            = 0x540,
+		.frm_drop_period_addr             = 0x544,
+		.irq_subsample_pattern_addr       = 0x548,
+		.irq_subsample_period_addr        = 0x54C,
+		.hcrop_addr                       = 0x550,
+		.vcrop_addr                       = 0x554,
+		.pix_drop_pattern_addr            = 0x558,
+		.pix_drop_period_addr             = 0x55C,
+		.line_drop_pattern_addr           = 0x560,
+		.line_drop_period_addr            = 0x564,
+		.debug_halt_status_addr           = 0x568,
+		.debug_misr_val0_addr             = 0x570,
+		.debug_misr_val1_addr             = 0x574,
+		.debug_misr_val2_addr             = 0x578,
+		.debug_misr_val3_addr             = 0x57C,
+		.format_measure_cfg0_addr         = 0x580,
+		.format_measure_cfg1_addr         = 0x584,
+		.format_measure0_addr             = 0x588,
+		.format_measure1_addr             = 0x58C,
+		.format_measure2_addr             = 0x590,
+		.timestamp_curr0_sof_addr         = 0x594,
+		.timestamp_curr1_sof_addr         = 0x598,
+		.timestamp_perv0_sof_addr         = 0x59C,
+		.timestamp_perv1_sof_addr         = 0x5A0,
+		.timestamp_curr0_eof_addr         = 0x5A4,
+		.timestamp_curr1_eof_addr         = 0x5A8,
+		.timestamp_perv0_eof_addr         = 0x5AC,
+		.timestamp_perv1_eof_addr         = 0x5B0,
+		.batch_id_cfg0_addr               = 0x5B4,
+		.batch_id_cfg1_addr               = 0x5B8,
+		.batch_period_cfg_addr            = 0x5BC,
+		.batch_stream_id_cfg_addr         = 0x5C0,
+		.epoch0_cfg_batch_id0_addr        = 0x5C4,
+		.epoch1_cfg_batch_id0_addr        = 0x5C8,
+		.epoch0_cfg_batch_id1_addr        = 0x5CC,
+		.epoch1_cfg_batch_id1_addr        = 0x5D0,
+		.epoch0_cfg_batch_id2_addr        = 0x5D4,
+		.epoch1_cfg_batch_id2_addr        = 0x5D8,
+		.epoch0_cfg_batch_id3_addr        = 0x5DC,
+		.epoch1_cfg_batch_id3_addr        = 0x5E0,
+		.epoch0_cfg_batch_id4_addr        = 0x5E4,
+		.epoch1_cfg_batch_id4_addr        = 0x5E8,
+		.epoch0_cfg_batch_id5_addr        = 0x5EC,
+		.epoch1_cfg_batch_id5_addr        = 0x5F0,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x100010,
+		.top_irq_mask                     = {0x100,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+		.default_out_format               = CAM_FORMAT_PLAIN16_16,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_780_rdi_1_reg_info = {
+		.irq_status_addr                  = 0xFC,
+		.irq_mask_addr                    = 0x100,
+		.irq_clear_addr                   = 0x104,
+		.irq_set_addr                     = 0x108,
+		.cfg0_addr                        = 0x600,
+		.ctrl_addr                        = 0x604,
+		.debug_clr_cmd_addr               = 0x608,
+		.multi_vcdt_cfg0_addr             = 0x60C,
+		.cfg1_addr                        = 0x610,
+		.err_recovery_cfg0_addr           = 0x614,
+		.err_recovery_cfg1_addr           = 0x618,
+		.err_recovery_cfg2_addr           = 0x61C,
+		.debug_byte_cntr_ping_addr        = 0x620,
+		.debug_byte_cntr_pong_addr        = 0x624,
+		.camif_frame_cfg_addr             = 0x628,
+		.epoch_irq_cfg_addr               = 0x62C,
+		.epoch0_subsample_ptrn_addr       = 0x630,
+		.epoch1_subsample_ptrn_addr       = 0x634,
+		.debug_camif_1_addr               = 0x638,
+		.debug_camif_0_addr               = 0x63C,
+		.frm_drop_pattern_addr            = 0x640,
+		.frm_drop_period_addr             = 0x644,
+		.irq_subsample_pattern_addr       = 0x648,
+		.irq_subsample_period_addr        = 0x64C,
+		.hcrop_addr                       = 0x650,
+		.vcrop_addr                       = 0x654,
+		.pix_drop_pattern_addr            = 0x658,
+		.pix_drop_period_addr             = 0x65C,
+		.line_drop_pattern_addr           = 0x660,
+		.line_drop_period_addr            = 0x664,
+		.debug_halt_status_addr           = 0x66C,
+		.debug_misr_val0_addr             = 0x670,
+		.debug_misr_val1_addr             = 0x674,
+		.debug_misr_val2_addr             = 0x678,
+		.debug_misr_val3_addr             = 0x67C,
+		.format_measure_cfg0_addr         = 0x680,
+		.format_measure_cfg1_addr         = 0x684,
+		.format_measure0_addr             = 0x688,
+		.format_measure1_addr             = 0x68C,
+		.format_measure2_addr             = 0x690,
+		.timestamp_curr0_sof_addr         = 0x694,
+		.timestamp_curr1_sof_addr         = 0x698,
+		.timestamp_perv0_sof_addr         = 0x69C,
+		.timestamp_perv1_sof_addr         = 0x6A0,
+		.timestamp_curr0_eof_addr         = 0x6A4,
+		.timestamp_curr1_eof_addr         = 0x6A8,
+		.timestamp_perv0_eof_addr         = 0x6AC,
+		.timestamp_perv1_eof_addr         = 0x6B0,
+		.batch_id_cfg0_addr               = 0x6B4,
+		.batch_id_cfg1_addr               = 0x6B8,
+		.batch_period_cfg_addr            = 0x6BC,
+		.batch_stream_id_cfg_addr         = 0x6C0,
+		.epoch0_cfg_batch_id0_addr        = 0x6C4,
+		.epoch1_cfg_batch_id0_addr        = 0x6C8,
+		.epoch0_cfg_batch_id1_addr        = 0x6CC,
+		.epoch1_cfg_batch_id1_addr        = 0x6D0,
+		.epoch0_cfg_batch_id2_addr        = 0x6D4,
+		.epoch1_cfg_batch_id2_addr        = 0x6D8,
+		.epoch0_cfg_batch_id3_addr        = 0x6DC,
+		.epoch1_cfg_batch_id3_addr        = 0x6E0,
+		.epoch0_cfg_batch_id4_addr        = 0x6E4,
+		.epoch1_cfg_batch_id4_addr        = 0x6E8,
+		.epoch0_cfg_batch_id5_addr        = 0x6EC,
+		.epoch1_cfg_batch_id5_addr        = 0x6F0,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.mipi_pack_supported              = 1,
+		.offline_mode_supported           = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x200020,
+		.top_irq_mask                     = {0x200,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_780_rdi_2_reg_info = {
+		.irq_status_addr                  = 0x10C,
+		.irq_mask_addr                    = 0x110,
+		.irq_clear_addr                   = 0x114,
+		.irq_set_addr                     = 0x118,
+		.cfg0_addr                        = 0x700,
+		.ctrl_addr                        = 0x704,
+		.debug_clr_cmd_addr               = 0x708,
+		.multi_vcdt_cfg0_addr             = 0x70C,
+		.cfg1_addr                        = 0x710,
+		.err_recovery_cfg0_addr           = 0x714,
+		.err_recovery_cfg1_addr           = 0x718,
+		.err_recovery_cfg2_addr           = 0x71C,
+		.debug_byte_cntr_ping_addr        = 0x720,
+		.debug_byte_cntr_pong_addr        = 0x724,
+		.camif_frame_cfg_addr             = 0x728,
+		.epoch_irq_cfg_addr               = 0x72C,
+		.epoch0_subsample_ptrn_addr       = 0x730,
+		.epoch1_subsample_ptrn_addr       = 0x734,
+		.debug_camif_1_addr               = 0x738,
+		.debug_camif_0_addr               = 0x73C,
+		.frm_drop_pattern_addr            = 0x740,
+		.frm_drop_period_addr             = 0x744,
+		.irq_subsample_pattern_addr       = 0x748,
+		.irq_subsample_period_addr        = 0x74C,
+		.hcrop_addr                       = 0x750,
+		.vcrop_addr                       = 0x754,
+		.pix_drop_pattern_addr            = 0x758,
+		.pix_drop_period_addr             = 0x75C,
+		.line_drop_pattern_addr           = 0x760,
+		.line_drop_period_addr            = 0x764,
+		.debug_halt_status_addr           = 0x76C,
+		.debug_misr_val0_addr             = 0x770,
+		.debug_misr_val1_addr             = 0x774,
+		.debug_misr_val2_addr             = 0x778,
+		.debug_misr_val3_addr             = 0x77C,
+		.format_measure_cfg0_addr         = 0x780,
+		.format_measure_cfg1_addr         = 0x784,
+		.format_measure0_addr             = 0x788,
+		.format_measure1_addr             = 0x78C,
+		.format_measure2_addr             = 0x790,
+		.timestamp_curr0_sof_addr         = 0x794,
+		.timestamp_curr1_sof_addr         = 0x798,
+		.timestamp_perv0_sof_addr         = 0x79C,
+		.timestamp_perv1_sof_addr         = 0x7A0,
+		.timestamp_curr0_eof_addr         = 0x7A4,
+		.timestamp_curr1_eof_addr         = 0x7A8,
+		.timestamp_perv0_eof_addr         = 0x7AC,
+		.timestamp_perv1_eof_addr         = 0x7B0,
+		.batch_id_cfg0_addr               = 0x7B4,
+		.batch_id_cfg1_addr               = 0x7B8,
+		.batch_period_cfg_addr            = 0x7BC,
+		.batch_stream_id_cfg_addr         = 0x7C0,
+		.epoch0_cfg_batch_id0_addr        = 0x7C4,
+		.epoch1_cfg_batch_id0_addr        = 0x7C8,
+		.epoch0_cfg_batch_id1_addr        = 0x7CC,
+		.epoch1_cfg_batch_id1_addr        = 0x7D0,
+		.epoch0_cfg_batch_id2_addr        = 0x7D4,
+		.epoch1_cfg_batch_id2_addr        = 0x7D8,
+		.epoch0_cfg_batch_id3_addr        = 0x7DC,
+		.epoch1_cfg_batch_id3_addr        = 0x7E0,
+		.epoch0_cfg_batch_id4_addr        = 0x7E4,
+		.epoch1_cfg_batch_id4_addr        = 0x7E8,
+		.epoch0_cfg_batch_id5_addr        = 0x7EC,
+		.epoch1_cfg_batch_id5_addr        = 0x7F0,
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.mipi_pack_supported              = 1,
+		.offline_mode_supported           = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x400040,
+		.top_irq_mask                     = {0x400,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_780_rdi_3_reg_info = {
+		.irq_status_addr                  = 0x11C,
+		.irq_mask_addr                    = 0x120,
+		.irq_clear_addr                   = 0x124,
+		.irq_set_addr                     = 0x128,
+		.cfg0_addr                        = 0x800,
+		.ctrl_addr                        = 0x804,
+		.debug_clr_cmd_addr               = 0x808,
+		.multi_vcdt_cfg0_addr             = 0x80C,
+		.cfg1_addr                        = 0x810,
+		.err_recovery_cfg0_addr           = 0x814,
+		.err_recovery_cfg1_addr           = 0x818,
+		.err_recovery_cfg2_addr           = 0x81C,
+		.debug_byte_cntr_ping_addr        = 0x820,
+		.debug_byte_cntr_pong_addr        = 0x824,
+		.camif_frame_cfg_addr             = 0x828,
+		.epoch_irq_cfg_addr               = 0x82C,
+		.epoch0_subsample_ptrn_addr       = 0x830,
+		.epoch1_subsample_ptrn_addr       = 0x834,
+		.debug_camif_1_addr               = 0x838,
+		.debug_camif_0_addr               = 0x83C,
+		.frm_drop_pattern_addr            = 0x840,
+		.frm_drop_period_addr             = 0x840,
+		.irq_subsample_pattern_addr       = 0x848,
+		.irq_subsample_period_addr        = 0x84C,
+		.hcrop_addr                       = 0x850,
+		.vcrop_addr                       = 0x854,
+		.pix_drop_pattern_addr            = 0x858,
+		.pix_drop_period_addr             = 0x85C,
+		.line_drop_pattern_addr           = 0x860,
+		.line_drop_period_addr            = 0x864,
+		.debug_halt_status_addr           = 0x868,
+		.debug_misr_val0_addr             = 0x870,
+		.debug_misr_val1_addr             = 0x874,
+		.debug_misr_val2_addr             = 0x878,
+		.debug_misr_val3_addr             = 0x87C,
+		.format_measure_cfg0_addr         = 0x880,
+		.format_measure_cfg1_addr         = 0x884,
+		.format_measure0_addr             = 0x888,
+		.format_measure1_addr             = 0x88C,
+		.format_measure2_addr             = 0x890,
+		.timestamp_curr0_sof_addr         = 0x894,
+		.timestamp_curr1_sof_addr         = 0x898,
+		.timestamp_perv0_sof_addr         = 0x89C,
+		.timestamp_perv1_sof_addr         = 0x8A0,
+		.timestamp_curr0_eof_addr         = 0x8A4,
+		.timestamp_curr1_eof_addr         = 0x8A8,
+		.timestamp_perv0_eof_addr         = 0x8AC,
+		.timestamp_perv1_eof_addr         = 0x8B0,
+		.batch_id_cfg0_addr               = 0x8B4,
+		.batch_id_cfg1_addr               = 0x8B8,
+		.batch_period_cfg_addr            = 0x8BC,
+		.batch_stream_id_cfg_addr         = 0x8C0,
+		.epoch0_cfg_batch_id0_addr        = 0x8C4,
+		.epoch1_cfg_batch_id0_addr        = 0x8C8,
+		.epoch0_cfg_batch_id1_addr        = 0x8CC,
+		.epoch1_cfg_batch_id1_addr        = 0x8D0,
+		.epoch0_cfg_batch_id2_addr        = 0x8D4,
+		.epoch1_cfg_batch_id2_addr        = 0x8D8,
+		.epoch0_cfg_batch_id3_addr        = 0x8DC,
+		.epoch1_cfg_batch_id3_addr        = 0x8E0,
+		.epoch0_cfg_batch_id4_addr        = 0x8E4,
+		.epoch1_cfg_batch_id4_addr        = 0x8E8,
+		.epoch0_cfg_batch_id5_addr        = 0x8EC,
+		.epoch1_cfg_batch_id5_addr        = 0x8F0,
+		/* configurations */
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.resume_frame_boundary            = 1,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = 0,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x800080,
+		.top_irq_mask                     = {0x800,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_780_rdi_4_reg_info = {
+		.irq_status_addr                 = 0x12C,
+		.irq_mask_addr                   = 0x130,
+		.irq_clear_addr                  = 0x134,
+		.irq_set_addr                    = 0x138,
+		.cfg0_addr                       = 0x900,
+		.ctrl_addr                       = 0x904,
+		.debug_clr_cmd_addr              = 0x908,
+		.multi_vcdt_cfg0_addr            = 0x90C,
+		.cfg1_addr                       = 0x910,
+		.err_recovery_cfg0_addr          = 0x914,
+		.err_recovery_cfg1_addr          = 0x918,
+		.err_recovery_cfg2_addr          = 0x91C,
+		.debug_byte_cntr_ping_addr       = 0x920,
+		.debug_byte_cntr_pong_addr       = 0x924,
+		.camif_frame_cfg_addr            = 0x928,
+		.epoch_irq_cfg_addr              = 0x92C,
+		.epoch0_subsample_ptrn_addr      = 0x930,
+		.epoch1_subsample_ptrn_addr      = 0x934,
+		.debug_camif_1_addr              = 0x938,
+		.debug_camif_0_addr              = 0x93C,
+		.frm_drop_pattern_addr           = 0x940,
+		.frm_drop_period_addr            = 0x944,
+		.irq_subsample_pattern_addr      = 0x948,
+		.irq_subsample_period_addr       = 0x94C,
+		.hcrop_addr                      = 0x950,
+		.vcrop_addr                      = 0x954,
+		.pix_drop_pattern_addr           = 0x958,
+		.pix_drop_period_addr            = 0x95C,
+		.line_drop_pattern_addr          = 0x960,
+		.line_drop_period_addr           = 0x964,
+		.debug_halt_status_addr          = 0x968,
+		.debug_misr_val0_addr            = 0x970,
+		.debug_misr_val1_addr            = 0x974,
+		.debug_misr_val2_addr            = 0x978,
+		.debug_misr_val3_addr            = 0x97C,
+		.format_measure_cfg0_addr        = 0x980,
+		.format_measure_cfg1_addr        = 0x984,
+		.format_measure0_addr            = 0x988,
+		.format_measure1_addr            = 0x98C,
+		.format_measure2_addr            = 0x990,
+		.timestamp_curr0_sof_addr        = 0x994,
+		.timestamp_curr1_sof_addr        = 0x998,
+		.timestamp_perv0_sof_addr        = 0x99C,
+		.timestamp_perv1_sof_addr        = 0x9A0,
+		.timestamp_curr0_eof_addr        = 0x9A4,
+		.timestamp_curr1_eof_addr        = 0x9A8,
+		.timestamp_perv0_eof_addr        = 0x9AC,
+		.timestamp_perv1_eof_addr        = 0x9B0,
+		.batch_id_cfg0_addr              = 0x9B4,
+		.batch_id_cfg1_addr              = 0x9B8,
+		.batch_period_cfg_addr           = 0x9BC,
+		.batch_stream_id_cfg_addr        = 0x9C0,
+		.epoch0_cfg_batch_id0_addr       = 0x9C4,
+		.epoch1_cfg_batch_id0_addr       = 0x9C8,
+		.epoch0_cfg_batch_id1_addr       = 0x9CC,
+		.epoch1_cfg_batch_id1_addr       = 0x9D0,
+		.epoch0_cfg_batch_id2_addr       = 0x9D4,
+		.epoch1_cfg_batch_id2_addr       = 0x9D8,
+		.epoch0_cfg_batch_id3_addr       = 0x9DC,
+		.epoch1_cfg_batch_id3_addr       = 0x9E0,
+		.epoch0_cfg_batch_id4_addr       = 0x9E4,
+		.epoch1_cfg_batch_id4_addr       = 0x9E8,
+		.epoch0_cfg_batch_id5_addr       = 0x9EC,
+		.epoch1_cfg_batch_id5_addr       = 0x9F0,
+		/* configurations */
+		.capabilities                    = CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.resume_frame_boundary           = 1,
+		.start_mode_internal             = 0x0,
+		.start_mode_global               = 0x1,
+		.start_mode_shift                = 2,
+		.overflow_ctrl_en                = 1,
+		.capabilities                    = 0,
+		.overflow_ctrl_mode_val          = 0x8,
+		.offline_mode_supported          = 1,
+		.mipi_pack_supported             = 1,
+		.packing_fmt_shift_val           = 15,
+		.early_eof_en_shift_val          = 14,
+		.plain_fmt_shift_val             = 12,
+		.plain_alignment_shift_val       = 11,
+		.crop_v_en_shift_val             = 8,
+		.crop_h_en_shift_val             = 7,
+		.drop_v_en_shift_val             = 6,
+		.drop_h_en_shift_val             = 5,
+		.timestamp_en_shift_val          = 6,
+		.format_measure_en_shift_val     = 3,
+		.debug_byte_cntr_rst_shift_val   = 2,
+		.offline_mode_en_shift_val       = 2,
+		.ccif_violation_en               = 1,
+		.fatal_err_mask                  = 0x20186001,
+		.non_fatal_err_mask              = 0x12000004,
+		.sof_irq_mask                    = 0x10,
+		.rup_irq_mask                    = 0x800000,
+		.epoch0_irq_mask                 = 0x200000,
+		.epoch1_irq_mask                 = 0x400000,
+		.eof_irq_mask                    = 0x8,
+		.rup_aup_mask                    = 0x1000100,
+		.top_irq_mask                    = {0x1000,},
+		.epoch0_shift_val                = 16,
+		.epoch1_shift_val                = 0,
+		.sof_retiming_dis_shift          = 5,
+};
+
+static struct cam_ife_csid_ver2_csi2_rx_reg_info
+	cam_ife_csid_780_csi2_reg_info = {
+		.irq_status_addr                 = {0x9C,},
+		.irq_mask_addr                   = {0xA0,},
+		.irq_clear_addr                  = {0xA4,},
+		.irq_set_addr                    = {0xA8,},
+		/*CSI2 rx control */
+		.cfg0_addr                       = 0x200,
+		.cfg1_addr                       = 0x204,
+		.capture_ctrl_addr               = 0x208,
+		.rst_strobes_addr                = 0x20C,
+		.cap_unmap_long_pkt_hdr_0_addr   = 0x210,
+		.cap_unmap_long_pkt_hdr_1_addr   = 0x214,
+		.captured_short_pkt_0_addr       = 0x218,
+		.captured_short_pkt_1_addr       = 0x21c,
+		.captured_long_pkt_0_addr        = 0x220,
+		.captured_long_pkt_1_addr        = 0x224,
+		.captured_long_pkt_ftr_addr      = 0x228,
+		.captured_cphy_pkt_hdr_addr      = 0x22c,
+		.lane0_misr_addr                 = 0x230,
+		.lane1_misr_addr                 = 0x234,
+		.lane2_misr_addr                 = 0x238,
+		.lane3_misr_addr                 = 0x23c,
+		.total_pkts_rcvd_addr            = 0x240,
+		.stats_ecc_addr                  = 0x244,
+		.total_crc_err_addr              = 0x248,
+		.de_scramble_type3_cfg0_addr     = 0x24C,
+		.de_scramble_type3_cfg1_addr     = 0x250,
+		.de_scramble_type2_cfg0_addr     = 0x254,
+		.de_scramble_type2_cfg1_addr     = 0x258,
+		.de_scramble_type1_cfg0_addr     = 0x25C,
+		.de_scramble_type1_cfg1_addr     = 0x260,
+		.de_scramble_type0_cfg0_addr     = 0x264,
+		.de_scramble_type0_cfg1_addr     = 0x268,
+
+		.rst_done_shift_val              = 27,
+		.irq_mask_all                    = 0xFFFFFFF,
+		.misr_enable_shift_val           = 6,
+		.vc_mode_shift_val               = 2,
+		.capture_long_pkt_en_shift       = 0,
+		.capture_short_pkt_en_shift      = 1,
+		.capture_cphy_pkt_en_shift       = 2,
+		.capture_long_pkt_dt_shift       = 4,
+		.capture_long_pkt_vc_shift       = 10,
+		.capture_short_pkt_vc_shift      = 15,
+		.capture_cphy_pkt_dt_shift       = 20,
+		.capture_cphy_pkt_vc_shift       = 26,
+		.phy_num_mask                    = 0xf,
+		.vc_mask                         = 0x7C00000,
+		.dt_mask                         = 0x3f0000,
+		.wc_mask                         = 0xffff,
+		.vc_shift                        = 0x16,
+		.dt_shift                        = 0x10,
+		.wc_shift                        = 0,
+		.calc_crc_mask                   = 0xffff,
+		.expected_crc_mask               = 0xffff,
+		.calc_crc_shift                  = 0x10,
+		.ecc_correction_shift_en         = 0,
+		.lane_num_shift                  = 0,
+		.lane_cfg_shift                  = 4,
+		.phy_type_shift                  = 24,
+		.phy_num_shift                   = 20,
+		.tpg_mux_en_shift                = 27,
+		.tpg_num_sel_shift               = 28,
+		.phy_bist_shift_en               = 7,
+		.epd_mode_shift_en               = 8,
+		.eotp_shift_en                   = 9,
+		.dyn_sensor_switch_shift_en      = 10,
+		.rup_aup_latch_shift             = 11,
+		.rup_aup_latch_supported         = true,
+		.long_pkt_strobe_rst_shift       = 0,
+		.short_pkt_strobe_rst_shift      = 1,
+		.cphy_pkt_strobe_rst_shift       = 2,
+		.unmapped_pkt_strobe_rst_shift   = 3,
+		.fatal_err_mask                  = {0x19FA800,},
+		.part_fatal_err_mask             = {0x0001000,},
+		.non_fatal_err_mask              = {0x0200000,},
+		.top_irq_mask                    = {0x4,},
+};
+
+static struct cam_ife_csid_ver2_common_reg_info
+			cam_ife_csid_780_cmn_reg_info = {
+	.hw_version_addr                         = 0x0,
+	.cfg0_addr                               = 0x4,
+	.global_cmd_addr                         = 0x8,
+	.reset_cfg_addr                          = 0xc,
+	.reset_cmd_addr                          = 0x10,
+	.irq_cmd_addr                            = 0x14,
+	.rup_aup_cmd_addr                        = 0x18,
+	.offline_cmd_addr                        = 0x1C,
+	.shdr_master_slave_cfg_addr              = 0x20,
+	.top_irq_status_addr                     = {0x7C,},
+	.top_irq_mask_addr                       = {0x80,},
+	.top_irq_clear_addr                      = {0x84,},
+	.top_irq_set_addr                        = {0x88,},
+	.buf_done_irq_status_addr                = 0x8C,
+	.buf_done_irq_mask_addr                  = 0x90,
+	.buf_done_irq_clear_addr                 = 0x94,
+	.buf_done_irq_set_addr                   = 0x98,
+	.test_bus_ctrl                           = 0x1E8,
+	.test_bus_debug                          = 0x1EC,
+	.drv_cfg0_addr                           = 0x13c,
+	.drv_cfg1_addr                           = 0x140,
+	.drv_cfg2_addr                           = 0x144,
+	.debug_drv_0_addr                        = 0x148,
+	.debug_drv_1_addr                        = 0x14C,
+
+	/*configurations */
+	.major_version                           = 6,
+	.minor_version                           = 8,
+	.version_incr                            = 0,
+	.num_rdis                                = 5,
+	.num_pix                                 = 1,
+	.num_ppp                                 = 1,
+	.rst_done_shift_val                      = 1,
+	.path_en_shift_val                       = 31,
+	.dt_id_shift_val                         = 27,
+	.vc_shift_val                            = 22,
+	.vc_mask                                 = 0x1F,
+	.dt_shift_val                            = 16,
+	.dt_mask                                 = 0x3F,
+	.crop_shift_val                          = 16,
+	.decode_format_shift_val                 = 12,
+	.decode_format1_shift_val                = 16,
+	.decode_format1_supported                = true,
+	.decode_format_mask                      = 0xF,
+	.frame_id_decode_en_shift_val            = 1,
+	.multi_vcdt_vc1_shift_val                = 2,
+	.multi_vcdt_dt1_shift_val                = 7,
+	.multi_vcdt_ts_combo_en_shift_val        = 13,
+	.multi_vcdt_en_shift_val                 = 0,
+	.timestamp_stb_sel_shift_val             = 8,
+	.vfr_en_shift_val                        = 0,
+	.mup_shift_val                           = 28,
+	.shdr_slave_ppp_shift                    = 20,
+	.shdr_slave_rdi2_shift                   = 22,
+	.shdr_slave_rdi1_shift                   = 21,
+	.shdr_master_rdi0_shift                  = 5,
+	.shdr_master_slave_en_shift              = 0,
+	.drv_en_shift                            = 0,
+	.drv_rup_en_shift                        = 0,
+	.early_eof_supported                     = 1,
+	.vfr_supported                           = 1,
+	.multi_vcdt_supported                    = 1,
+	.ts_comb_vcdt_en                         = true,
+	.ts_comb_vcdt_mask                       = 3,
+	.frame_id_dec_supported                  = 1,
+	.measure_en_hbi_vbi_cnt_mask             = 0xc,
+	.measure_pixel_line_en_mask              = 0x3,
+	.crop_pix_start_mask                     = 0x3fff,
+	.crop_pix_end_mask                       = 0xffff,
+	.crop_line_start_mask                    = 0x3fff,
+	.crop_line_end_mask                      = 0xffff,
+	.drop_supported                          = 1,
+	.ipp_irq_mask_all                        = 0x7FFF,
+	.rdi_irq_mask_all                        = 0x7FFF,
+	.ppp_irq_mask_all                        = 0xFFFF,
+	.top_err_irq_mask                        = {0x180002,},
+	.rst_loc_path_only_val                   = 0x0,
+	.rst_loc_complete_csid_val               = 0x1,
+	.rst_mode_frame_boundary_val             = 0x0,
+	.rst_mode_immediate_val                  = 0x1,
+	.rst_cmd_hw_reset_complete_val           = 0x1,
+	.rst_cmd_sw_reset_complete_val           = 0x2,
+	.rst_cmd_irq_ctrl_only_val               = 0x4,
+	.timestamp_strobe_val                    = 0x2,
+	.top_reset_irq_mask                      = {0x1,},
+	.rst_location_shift_val                  = 4,
+	.rst_mode_shift_val                      = 0,
+	.epoch_factor                            = 50,
+	.global_reset                            = 1,
+	.rup_supported                           = 1,
+	.only_master_rup                         = 1,
+	.format_measure_height_mask_val          = 0xFFFF,
+	.format_measure_height_shift_val         = 0x10,
+	.format_measure_width_mask_val           = 0xFFFF,
+	.format_measure_width_shift_val          = 0x0,
+	.top_buf_done_irq_mask                   = 0x2000,
+	.decode_format_payload_only              = 0xF,
+	.phy_sel_base_idx                        = 1,
+	.timestamp_enabled_in_cfg0               = true,
+	.camif_irq_support                       = true,
+	.sfe_ipp_input_rdi_res                   = BIT(CAM_IFE_PIX_PATH_RES_RDI_0),
+	.drv_rup_en_val_map = {
+		2, //RDI0
+		3, //RDI1
+		4, //RDI2
+		5, //RDI3
+		6, //RDI4
+		0, //IPP
+		1, //PPP
+		0, //UDI0
+		0, //UDI1
+		0, //UDI2
+	},
+	.drv_path_idle_en_val_map = {
+		BIT(4), //CAM_ISP_PXL_PATH
+		BIT(5), //CAM_ISP_PPP_PATH
+		0,      // LCR not applicable
+		BIT(6), //CAM_ISP_RDI0_PATH
+		BIT(7), //CAM_ISP_RDI1_PATH
+		BIT(8), //CAM_ISP_RDI2_PATH
+		BIT(9), //CAM_ISP_RDI3_PATH
+		BIT(10), //CAM_ISP_RDI4_PATH
+	},
+};
+
+static struct cam_ife_csid_ver2_top_reg_info
+			cam_ife_csid_780_top_reg_info = {
+	.io_path_cfg0_addr = {
+				    0x0,
+				    0x4,
+				    0x8,
+	},
+	.dual_csid_cfg0_addr =  {
+				    0xC,
+				    0x10,
+				    0x14,
+	},
+	.input_core_type_shift_val      = 0,
+	.sfe_offline_en_shift_val       = 12,
+	.out_ife_en_shift_val           = 8,
+	.dual_sync_sel_shift_val        = 8,
+	.dual_en_shift_val              = 0,
+	.master_slave_sel_shift_val     = 1,
+	.rdi_lcr_shift_val              = 16,
+	.master_sel_val                 = 0,
+	.slave_sel_val                  = 1,
+	.io_path_cfg_rst_val            = 1,
+	.dual_cfg_rst_val               = 0,
+	.sfe_pipeline_bypassed          = true,
+};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_780_reg_info = {
+	.top_irq_reg_info      = cam_ife_csid_780_top_irq_reg_info,
+	.rx_irq_reg_info       = cam_ife_csid_780_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		&cam_ife_csid_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_4],
+		&cam_ife_csid_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		&cam_ife_csid_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_PPP],
+	},
+	.buf_done_irq_reg_info = &cam_ife_csid_780_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_780_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_780_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_780_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = &cam_ife_csid_780_ppp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_780_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_780_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_780_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_780_rdi_3_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_4] = &cam_ife_csid_780_rdi_4_reg_info,
+	.top_reg                              = &cam_ife_csid_780_top_reg_info,
+	.input_core_sel = {
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			0x8,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			-1,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			-1,
+			0x9,
+			-1,
+		},
+	},
+	.need_top_cfg = 0x1,
+	.csid_cust_node_map = {0x1, 0x0, 0x2},
+	.rx_irq_desc        = &cam_ife_csid_780_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_780_path_irq_desc,
+	.top_irq_desc       = &cam_ife_csid_780_top_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_780_num_top_irq_desc,
+	.num_rx_err_irqs    = cam_ife_csid_780_num_rx_irq_desc,
+	.num_path_err_irqs  = ARRAY_SIZE(cam_ife_csid_780_path_irq_desc),
+	.num_top_regs       = 1,
+	.num_rx_regs       = 1,
+};
+#endif /*_CAM_IFE_CSID_780_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid860.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid860.h
@@ -0,0 +1,90 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_860_H_
+#define _CAM_IFE_CSID_860_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_ife_csid880.h"
+
+#define CAM_CSID_VERSION_V860                 0x80060000
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_860_reg_info = {
+	.top_irq_reg_info      = cam_ife_csid_880_top_irq_reg_info,
+	.rx_irq_reg_info       = cam_ife_csid_880_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_4],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_PPP],
+	},
+	.buf_done_irq_reg_info = &cam_ife_csid_880_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_880_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_880_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_880_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = &cam_ife_csid_880_ppp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_880_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_880_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_880_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_880_rdi_3_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_4] = &cam_ife_csid_880_rdi_4_reg_info,
+	.top_reg                              = &cam_ife_csid_880_top_reg_info,
+	.input_core_sel = {
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			-1,
+			-1,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			-1,
+			-1,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			-1,
+			-1,
+			-1,
+			-1,
+		},
+	},
+	.need_top_cfg = 0x1,
+	.top_irq_desc       = &cam_ife_csid_880_top_irq_desc,
+	.rx_irq_desc        = &cam_ife_csid_880_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_880_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_880_num_top_irq_desc,
+	.num_rx_err_irqs    = cam_ife_csid_880_num_rx_irq_desc,
+	.num_path_err_irqs  = ARRAY_SIZE(cam_ife_csid_880_path_irq_desc),
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+	.width_fuse_max_val = 1,
+	.fused_max_dualife_width = {7296, 5344, UINT_MAX},
+	.fused_max_width = {7296, 7296, UINT_MAX},
+	.is_ife_sfe_mapped = true,
+};
+
+#endif /*_CAM_IFE_CSID_860_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid880.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid880.h
@@ -0,0 +1,1513 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_880_H_
+#define _CAM_IFE_CSID_880_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+#define CAM_CSID_VERSION_V880                 0x80080000
+
+/* Offsets might not match due to csid secure regs at beginning of reg space */
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_880_rx_irq_desc[][32] = {
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "DL0_EOT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "DL1_EOT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "DL2_EOT",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "DL3_EOT",
+		},
+		{
+			.bitmask = BIT(4),
+			.desc = "DL0_SOT",
+		},
+		{
+			.bitmask = BIT(5),
+			.desc = "DL1_SOT",
+		},
+		{
+			.bitmask = BIT(6),
+			.desc = "DL2_SOT",
+		},
+		{
+			.bitmask = BIT(7),
+			.desc = "DL3_SOT",
+		},
+		{
+			.bitmask = BIT(8),
+			.desc = "LONG_PKT",
+		},
+		{
+			.bitmask = BIT(9),
+			.desc = "SHORT_PKT",
+		},
+		{
+			.bitmask = BIT(10),
+			.desc = "CPHY_PKT_HDR",
+		},
+		{
+			.bitmask = BIT(11),
+			.desc = "ERROR_CPHY_EOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(12),
+			.desc = "ERROR_CPHY_SOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(13),
+			.desc = "ERROR_CPHY_PH_CRC",
+		},
+		{
+			.bitmask = BIT(14),
+			.desc = "WARNING_ECC",
+		},
+		{
+			.bitmask = BIT(15),
+			.desc = "ERROR_LANE0_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(16),
+			.desc = "ERROR_LANE1_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(17),
+			.desc = "ERROR_LANE2_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(18),
+			.desc = "ERROR_LANE3_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(19),
+			.desc = "ERROR_CRC",
+		},
+		{
+			.bitmask = BIT(20),
+			.desc = "ERROR_ECC",
+		},
+		{
+			.bitmask = BIT(21),
+			.desc = "ERROR_MMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(22),
+			.desc = "ERROR_UNMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(23),
+			.desc = "ERROR_STREAM_UNDERFLOW",
+		},
+		{
+			.bitmask = BIT(24),
+			.desc = "ERROR_UNBOUNDED_FRAME",
+		},
+		{
+			.bitmask = BIT(25),
+			.desc = "ERROR_ILLEGAL_PROGRAMMING_IRQ",
+		},
+		{
+			.bitmask = BIT(26),
+			.desc = "INFO_SENSOR_MODE_ID_CHANGE_IRQ",
+		},
+	},
+};
+
+static const uint32_t cam_ife_csid_880_num_rx_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_880_rx_irq_desc[0]),
+};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_880_path_irq_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FATAL,
+		.desc = "ILLEGAL_PROGRAMMING",
+		.err_handler = cam_ife_csid_ver2_print_illegal_programming_irq_status,
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "EROOR_MSG_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "ERROR_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "CAMIF_EOF",
+	},
+	{
+		.bitmask = BIT(4),
+		.desc = "CAMIF_SOF",
+	},
+	{
+		.bitmask = BIT(5),
+		.desc = "FRAME_DROP_EOF",
+	},
+	{
+		.bitmask = BIT(6),
+		.desc = "FRAME_DROP_EOL",
+	},
+	{
+		.bitmask = BIT(7),
+		.desc = "FRAME_DROP_SOL",
+	},
+	{
+		.bitmask = BIT(8),
+		.desc = "FRAME_DROP_SOF",
+	},
+	{
+		.bitmask = BIT(9),
+		.desc = "INFO_INPUT_EOF",
+	},
+	{
+		.bitmask = BIT(10),
+		.desc = "INFO_INPUT_EOL",
+	},
+	{
+		.bitmask = BIT(11),
+		.desc = "INFO_INPUT_SOL",
+	},
+	{
+		.bitmask = BIT(12),
+		.desc = "INFO_INPUT_SOF",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(14),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_LINE_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(15),
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.bitmask = BIT(16),
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.bitmask = BIT(17),
+		.desc = "VCDT_GRP_CHANGE",
+	},
+	{
+		.bitmask = BIT(18),
+		.desc = "FRAME_DROP",
+	},
+	{
+		.bitmask = BIT(19),
+		.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+		.desc = "OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.bitmask = BIT(20),
+		.desc = "ERROR_REC_CCIF_VIOLATION From Camif",
+	},
+	{
+		.bitmask = BIT(21),
+		.desc = "CAMIF_EPOCH0",
+	},
+	{
+		.bitmask = BIT(22),
+		.desc = "CAMIF_EPOCH1",
+	},
+	{
+		.bitmask = BIT(23),
+		.desc = "RUP_DONE",
+	},
+	{
+		.bitmask = BIT(24),
+		.desc = "ILLEGAL_BATCH_ID",
+	},
+	{
+		.bitmask = BIT(25),
+		.desc = "BATCH_END_MISSING_VIOLATION",
+	},
+	{
+		.bitmask = BIT(26),
+		.desc = "HEIGHT_VIOLATION",
+	},
+	{
+		.bitmask = BIT(27),
+		.desc = "WIDTH_VIOLATION",
+	},
+	{
+		.bitmask = BIT(28),
+		.desc = "SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP",
+		.err_handler = cam_ife_csid_hw_ver2_mup_mismatch_handler,
+	},
+	{
+		.bitmask = BIT(29),
+		.desc = "CCIF_VIOLATION: Bad frame timings",
+	},
+};
+
+static const struct cam_ife_csid_top_irq_desc cam_ife_csid_880_top_irq_desc[][32] = {
+	{
+		{
+			.bitmask  = BIT(1),
+			.err_type = CAM_ISP_HW_ERROR_CSID_SENSOR_SWITCH_ERROR,
+			.err_name = "FATAL_SENSOR_SWITCHING_IRQ",
+			.desc = "Fatal Error during dynamically switching between 2 sensors",
+		},
+		{
+			.bitmask  = BIT(18),
+			.err_name = "ERROR_NO_VOTE_DN",
+			.desc = "vote_up is asserted before IDLE is encountered in a frame",
+		},
+		{
+			.bitmask  = BIT(19),
+			.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+			.err_name = "ERROR_VOTE_UP_LATE",
+			.desc = "vote_up is asserted at the same time as an SOF",
+			.err_handler = cam_ife_csid_hw_ver2_drv_err_handler,
+		},
+		{
+			.bitmask  = BIT(20),
+			.err_type = CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW,
+			.err_name = "ERROR_RDI_LINE_BUFFER_CONFLICT",
+			.desc = "Two or more RDIs programmed to access the shared line buffer",
+			.err_handler = cam_ife_csid_hw_ver2_rdi_line_buffer_conflict_handler,
+		},
+	},
+};
+
+static const uint32_t cam_ife_csid_880_num_top_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_880_top_irq_desc[0]),
+};
+
+static struct cam_irq_register_set cam_ife_csid_880_irq_reg_set[9] = {
+	/* Top */
+	{
+		.mask_reg_offset   = 0x00000080,
+		.clear_reg_offset  = 0x00000084,
+		.status_reg_offset = 0x0000007C,
+		.set_reg_offset    = 0x00000088,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	/* RX */
+	{
+		.mask_reg_offset   = 0x000000A0,
+		.clear_reg_offset  = 0x000000A4,
+		.status_reg_offset = 0x0000009C,
+	},
+	/* RDI0 */
+	{
+		.mask_reg_offset   = 0x000000F0,
+		.clear_reg_offset  = 0x000000F4,
+		.status_reg_offset = 0x000000EC,
+	},
+	/* RDI1 */
+	{
+		.mask_reg_offset   = 0x00000100,
+		.clear_reg_offset  = 0x00000104,
+		.status_reg_offset = 0x000000FC,
+	},
+	/* RDI2 */
+	{
+		.mask_reg_offset   = 0x00000110,
+		.clear_reg_offset  = 0x00000114,
+		.status_reg_offset = 0x0000010C,
+	},
+	/* RDI3 */
+	{
+		.mask_reg_offset   = 0x00000120,
+		.clear_reg_offset  = 0x00000124,
+		.status_reg_offset = 0x0000011C,
+	},
+	/* RDI4 */
+	{
+		.mask_reg_offset   = 0x00000130,
+		.clear_reg_offset  = 0x00000134,
+		.status_reg_offset = 0x0000012C,
+	},
+	/* IPP */
+	{
+		.mask_reg_offset   = 0x000000B0,
+		.clear_reg_offset  = 0x000000B4,
+		.status_reg_offset = 0x000000AC,
+	},
+	/* PPP */
+	{
+		.mask_reg_offset   = 0x000000D0,
+		.clear_reg_offset  = 0x000000D4,
+		.status_reg_offset = 0x000000CC,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_880_top_irq_reg_info[] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP],
+		.global_irq_cmd_offset = 0x00000014,
+		.global_clear_bitmask  = 0x00000001,
+		.global_set_bitmask    = 0x00000010,
+		.clear_all_bitmask     = 0xFFFFFFFF,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_880_rx_irq_reg_info[] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_880_path_irq_reg_info[7] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_0],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_1],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_2],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_3],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_4],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_PPP],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+};
+
+static struct cam_irq_register_set cam_ife_csid_880_buf_done_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000090,
+		.clear_reg_offset  = 0x00000094,
+		.status_reg_offset = 0x0000008C,
+	},
+};
+
+static struct cam_irq_controller_reg_info
+	cam_ife_csid_880_buf_done_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = cam_ife_csid_880_buf_done_irq_reg_set,
+	.global_irq_cmd_offset  = 0, /* intentionally set to zero */
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_880_ipp_reg_info = {
+		.irq_status_addr                  = 0x00AC,
+		.irq_mask_addr                    = 0x00B0,
+		.irq_clear_addr                   = 0x00B4,
+		.irq_set_addr                     = 0x00B8,
+		.cfg0_addr                        = 0x0300,
+		.ctrl_addr                        = 0x0304,
+		.debug_clr_cmd_addr               = 0x0308,
+		.multi_vcdt_cfg0_addr             = 0x030C,
+		.cfg1_addr                        = 0x0310,
+		.err_recovery_cfg0_addr           = 0x0318,
+		.err_recovery_cfg1_addr           = 0x031C,
+		.err_recovery_cfg2_addr           = 0x0320,
+		.bin_pd_detect_cfg0_addr          = 0x0324,
+		.bin_pd_detect_cfg1_addr          = 0x0328,
+		.bin_pd_detect_cfg2_addr          = 0x032C,
+		.camif_frame_cfg_addr             = 0x0330,
+		.epoch_irq_cfg_addr               = 0x0334,
+		.epoch0_subsample_ptrn_addr       = 0x0338,
+		.epoch1_subsample_ptrn_addr       = 0x033C,
+		.debug_camif_1_addr               = 0x0340,
+		.debug_camif_0_addr               = 0x0344,
+		.debug_halt_status_addr           = 0x0348,
+		.debug_misr_val0_addr             = 0x034C,
+		.debug_misr_val1_addr             = 0x0350,
+		.debug_misr_val2_addr             = 0x0354,
+		.debug_misr_val3_addr             = 0x0358,
+		.hcrop_addr                       = 0x035c,
+		.vcrop_addr                       = 0x0360,
+		.pix_drop_pattern_addr            = 0x0364,
+		.pix_drop_period_addr             = 0x0368,
+		.line_drop_pattern_addr           = 0x036C,
+		.line_drop_period_addr            = 0x0370,
+		.frm_drop_pattern_addr            = 0x0374,
+		.frm_drop_period_addr             = 0x0378,
+		.irq_subsample_pattern_addr       = 0x037C,
+		.irq_subsample_period_addr        = 0x0380,
+		.format_measure_cfg0_addr         = 0x0384,
+		.format_measure_cfg1_addr         = 0x0388,
+		.format_measure0_addr             = 0x038C,
+		.format_measure1_addr             = 0x0390,
+		.format_measure2_addr             = 0x0394,
+		.timestamp_curr0_sof_addr         = 0x0398,
+		.timestamp_curr1_sof_addr         = 0x039C,
+		.timestamp_perv0_sof_addr         = 0x03A0,
+		.timestamp_perv1_sof_addr         = 0x03A4,
+		.timestamp_curr0_eof_addr         = 0x03A8,
+		.timestamp_curr1_eof_addr         = 0x03AC,
+		.timestamp_perv0_eof_addr         = 0x03B0,
+		.timestamp_perv1_eof_addr         = 0x03B4,
+		.lut_bank_cfg_addr                = 0x03B8,
+		.batch_id_cfg0_addr               = 0x03BC,
+		.batch_id_cfg1_addr               = 0x03C0,
+		.batch_period_cfg_addr            = 0x03C4,
+		.batch_stream_id_cfg_addr         = 0x03C8,
+		.epoch0_cfg_batch_id0_addr        = 0x03CC,
+		.epoch1_cfg_batch_id0_addr        = 0x03D0,
+		.epoch0_cfg_batch_id1_addr        = 0x03D4,
+		.epoch1_cfg_batch_id1_addr        = 0x03D8,
+		.epoch0_cfg_batch_id2_addr        = 0x03DC,
+		.epoch1_cfg_batch_id2_addr        = 0x03E0,
+		.epoch0_cfg_batch_id3_addr        = 0x03E4,
+		.epoch1_cfg_batch_id3_addr        = 0x03E8,
+		.epoch0_cfg_batch_id4_addr        = 0x03EC,
+		.epoch1_cfg_batch_id4_addr        = 0x03F0,
+		.epoch0_cfg_batch_id5_addr        = 0x03F4,
+		.epoch1_cfg_batch_id5_addr        = 0x03F8,
+		.path_batch_status                = 0x03FC,
+		.path_frame_id                    = 0x0400,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.binning_supported                = 0x7,
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.sof_retiming_dis_shift           = 5,
+		.start_mode_shift                 = 2,
+		.start_master_sel_val             = 0,
+		.start_master_sel_shift           = 4,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.pix_store_en_shift_val           = 14,
+		.early_eof_en_shift_val           = 16,
+		.bin_h_en_shift_val               = 20,
+		.bin_v_en_shift_val               = 21,
+		.bin_en_shift_val                 = 18,
+		.bin_qcfa_en_shift_val            = 19,
+		.format_measure_en_shift_val      = 8,
+		.timestamp_en_shift_val           = 6,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 4,
+		.start_master_sel_shift_val       = 4,
+		.bin_pd_en_shift_val              = 0,
+		.bin_pd_blk_w_shift_val           = 8,
+		.bin_pd_blk_h_shift_val           = 24,
+		.bin_pd_detect_x_offset_shift_val = 0,
+		.bin_pd_detect_x_end_shift_val    = 16,
+		.bin_pd_detect_y_offset_shift_val = 0,
+		.bin_pd_detect_y_end_shift_val    = 16,
+		.lut_bank_0_sel_val               = 0,
+		.lut_bank_1_sel_val               = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x10001,
+		.top_irq_mask                     = {0x10,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_880_ppp_reg_info = {
+		.irq_status_addr                  = 0x00CC,
+		.irq_mask_addr                    = 0x00D0,
+		.irq_clear_addr                   = 0x00D4,
+		.irq_set_addr                     = 0x00D8,
+		.cfg0_addr                        = 0x0B00,
+		.ctrl_addr                        = 0x0B04,
+		.debug_clr_cmd_addr               = 0x0B08,
+		.multi_vcdt_cfg0_addr             = 0x0B0C,
+		.cfg1_addr                        = 0x0B10,
+		.sparse_pd_extractor_cfg_addr     = 0x0B14,
+		.err_recovery_cfg0_addr           = 0x0B18,
+		.err_recovery_cfg1_addr           = 0x0B1C,
+		.err_recovery_cfg2_addr           = 0x0B20,
+		.camif_frame_cfg_addr             = 0x0B30,
+		.epoch_irq_cfg_addr               = 0x0B34,
+		.epoch0_subsample_ptrn_addr       = 0x0B38,
+		.epoch1_subsample_ptrn_addr       = 0x0B3C,
+		.debug_camif_1_addr               = 0x0B40,
+		.debug_camif_0_addr               = 0x0B44,
+		.debug_halt_status_addr           = 0x0B48,
+		.debug_misr_val0_addr             = 0x0B4C,
+		.debug_misr_val1_addr             = 0x0B50,
+		.debug_misr_val2_addr             = 0x0B54,
+		.debug_misr_val3_addr             = 0x0B58,
+		.hcrop_addr                       = 0x0B5c,
+		.vcrop_addr                       = 0x0B60,
+		.pix_drop_pattern_addr            = 0x0B64,
+		.pix_drop_period_addr             = 0x0B68,
+		.line_drop_pattern_addr           = 0x0B6C,
+		.line_drop_period_addr            = 0x0B70,
+		.frm_drop_pattern_addr            = 0x0B74,
+		.frm_drop_period_addr             = 0x0B78,
+		.irq_subsample_pattern_addr       = 0x0B7C,
+		.irq_subsample_period_addr        = 0x0B80,
+		.format_measure_cfg0_addr         = 0x0B84,
+		.format_measure_cfg1_addr         = 0x0B88,
+		.format_measure0_addr             = 0x0B8C,
+		.format_measure1_addr             = 0x0B90,
+		.format_measure2_addr             = 0x0B94,
+		.timestamp_curr0_sof_addr         = 0x0B98,
+		.timestamp_curr1_sof_addr         = 0x0B9C,
+		.timestamp_perv0_sof_addr         = 0x0BA0,
+		.timestamp_perv1_sof_addr         = 0x0BA4,
+		.timestamp_curr0_eof_addr         = 0x0BA8,
+		.timestamp_curr1_eof_addr         = 0x0BAC,
+		.timestamp_perv0_eof_addr         = 0x0BB0,
+		.timestamp_perv1_eof_addr         = 0x0BB4,
+		.lut_bank_cfg_addr                = 0x0BB8,
+		.batch_id_cfg0_addr               = 0x0BBC,
+		.batch_id_cfg1_addr               = 0x0BC0,
+		.batch_period_cfg_addr            = 0x0BC4,
+		.batch_stream_id_cfg_addr         = 0x0BC8,
+		.epoch0_cfg_batch_id0_addr        = 0x0BCC,
+		.epoch1_cfg_batch_id0_addr        = 0x0BD0,
+		.epoch0_cfg_batch_id1_addr        = 0x0BD4,
+		.epoch1_cfg_batch_id1_addr        = 0x0BD8,
+		.epoch0_cfg_batch_id2_addr        = 0x0BDC,
+		.epoch1_cfg_batch_id2_addr        = 0x0BE0,
+		.epoch0_cfg_batch_id3_addr        = 0x0BE4,
+		.epoch1_cfg_batch_id3_addr        = 0x0BE8,
+		.epoch0_cfg_batch_id4_addr        = 0x0BEC,
+		.epoch1_cfg_batch_id4_addr        = 0x0BF0,
+		.epoch0_cfg_batch_id5_addr        = 0x0BF4,
+		.epoch1_cfg_batch_id5_addr        = 0x0BF8,
+		.path_batch_status                = 0x0BFC,
+		.path_frame_id                    = 0x0C00,
+
+		/* configurations */
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.resume_frame_boundary            = 1,
+		.start_mode_shift                 = 2,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.start_master_sel_val             = 3,
+		.start_master_sel_shift           = 4,
+		.binning_supported                = 0x1,
+		.bin_h_en_shift_val               = 18,
+		.bin_en_shift_val                 = 18,
+		.early_eof_en_shift_val           = 16,
+		.pix_store_en_shift_val           = 14,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.format_measure_en_shift_val      = 8,
+		.timestamp_en_shift_val           = 6,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 4,
+		.start_master_sel_shift_val       = 4,
+		.lut_bank_0_sel_val               = 0,
+		.lut_bank_1_sel_val               = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.rup_aup_mask                     = 0x40004,
+		.top_irq_mask                     = {0x40,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.sof_retiming_dis_shift           = 5,
+		.crop_drop_enable                 = true,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_880_rdi_0_reg_info = {
+		.irq_status_addr                  = 0x00EC,
+		.irq_mask_addr                    = 0x00F0,
+		.irq_clear_addr                   = 0x00F4,
+		.irq_set_addr                     = 0x00F8,
+		.cfg0_addr                        = 0x0500,
+		.ctrl_addr                        = 0x0504,
+		.debug_clr_cmd_addr               = 0x0508,
+		.multi_vcdt_cfg0_addr             = 0x050C,
+		.cfg1_addr                        = 0x0510,
+		.err_recovery_cfg0_addr           = 0x0514,
+		.err_recovery_cfg1_addr           = 0x0518,
+		.err_recovery_cfg2_addr           = 0x051C,
+		.debug_byte_cntr_ping_addr        = 0x0520,
+		.debug_byte_cntr_pong_addr        = 0x0524,
+		.camif_frame_cfg_addr             = 0x0528,
+		.epoch_irq_cfg_addr               = 0x052C,
+		.epoch0_subsample_ptrn_addr       = 0x0530,
+		.epoch1_subsample_ptrn_addr       = 0x0534,
+		.debug_camif_1_addr               = 0x0538,
+		.debug_camif_0_addr               = 0x053C,
+		.frm_drop_pattern_addr            = 0x0540,
+		.frm_drop_period_addr             = 0x0544,
+		.irq_subsample_pattern_addr       = 0x0548,
+		.irq_subsample_period_addr        = 0x054C,
+		.hcrop_addr                       = 0x0550,
+		.vcrop_addr                       = 0x0554,
+		.pix_drop_pattern_addr            = 0x0558,
+		.pix_drop_period_addr             = 0x055C,
+		.line_drop_pattern_addr           = 0x0560,
+		.line_drop_period_addr            = 0x0564,
+		.debug_halt_status_addr           = 0x0568,
+		.debug_misr_val0_addr             = 0x0570,
+		.debug_misr_val1_addr             = 0x0574,
+		.debug_misr_val2_addr             = 0x0578,
+		.debug_misr_val3_addr             = 0x057C,
+		.format_measure_cfg0_addr         = 0x0580,
+		.format_measure_cfg1_addr         = 0x0584,
+		.format_measure0_addr             = 0x0588,
+		.format_measure1_addr             = 0x058C,
+		.format_measure2_addr             = 0x0590,
+		.timestamp_curr0_sof_addr         = 0x0594,
+		.timestamp_curr1_sof_addr         = 0x0598,
+		.timestamp_perv0_sof_addr         = 0x059C,
+		.timestamp_perv1_sof_addr         = 0x05A0,
+		.timestamp_curr0_eof_addr         = 0x05A4,
+		.timestamp_curr1_eof_addr         = 0x05A8,
+		.timestamp_perv0_eof_addr         = 0x05AC,
+		.timestamp_perv1_eof_addr         = 0x05B0,
+		.batch_id_cfg0_addr               = 0x05B4,
+		.batch_id_cfg1_addr               = 0x05B8,
+		.batch_period_cfg_addr            = 0x05BC,
+		.batch_stream_id_cfg_addr         = 0x05C0,
+		.epoch0_cfg_batch_id0_addr        = 0x05C4,
+		.epoch1_cfg_batch_id0_addr        = 0x05C8,
+		.epoch0_cfg_batch_id1_addr        = 0x05CC,
+		.epoch1_cfg_batch_id1_addr        = 0x05D0,
+		.epoch0_cfg_batch_id2_addr        = 0x05D4,
+		.epoch1_cfg_batch_id2_addr        = 0x05D8,
+		.epoch0_cfg_batch_id3_addr        = 0x05DC,
+		.epoch1_cfg_batch_id3_addr        = 0x05E0,
+		.epoch0_cfg_batch_id4_addr        = 0x05E4,
+		.epoch1_cfg_batch_id4_addr        = 0x05E8,
+		.epoch0_cfg_batch_id5_addr        = 0x05EC,
+		.epoch1_cfg_batch_id5_addr        = 0x05F0,
+		.path_batch_status                = 0x05F4,
+		.path_frame_id                    = 0x05F8,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x100010,
+		.top_irq_mask                     = {0x100,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+		.default_out_format               = CAM_FORMAT_PLAIN16_16,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_880_rdi_1_reg_info = {
+		.irq_status_addr                  = 0x00FC,
+		.irq_mask_addr                    = 0x0100,
+		.irq_clear_addr                   = 0x0104,
+		.irq_set_addr                     = 0x0108,
+		.cfg0_addr                        = 0x0600,
+		.ctrl_addr                        = 0x0604,
+		.debug_clr_cmd_addr               = 0x0608,
+		.multi_vcdt_cfg0_addr             = 0x060C,
+		.cfg1_addr                        = 0x0610,
+		.err_recovery_cfg0_addr           = 0x0614,
+		.err_recovery_cfg1_addr           = 0x0618,
+		.err_recovery_cfg2_addr           = 0x061C,
+		.debug_byte_cntr_ping_addr        = 0x0620,
+		.debug_byte_cntr_pong_addr        = 0x0624,
+		.camif_frame_cfg_addr             = 0x0628,
+		.epoch_irq_cfg_addr               = 0x062C,
+		.epoch0_subsample_ptrn_addr       = 0x0630,
+		.epoch1_subsample_ptrn_addr       = 0x0634,
+		.debug_camif_1_addr               = 0x0638,
+		.debug_camif_0_addr               = 0x063C,
+		.frm_drop_pattern_addr            = 0x0640,
+		.frm_drop_period_addr             = 0x0644,
+		.irq_subsample_pattern_addr       = 0x0648,
+		.irq_subsample_period_addr        = 0x064C,
+		.hcrop_addr                       = 0x0650,
+		.vcrop_addr                       = 0x0654,
+		.pix_drop_pattern_addr            = 0x0658,
+		.pix_drop_period_addr             = 0x065C,
+		.line_drop_pattern_addr           = 0x0660,
+		.line_drop_period_addr            = 0x0664,
+		.debug_halt_status_addr           = 0x066C,
+		.debug_misr_val0_addr             = 0x0670,
+		.debug_misr_val1_addr             = 0x0674,
+		.debug_misr_val2_addr             = 0x0678,
+		.debug_misr_val3_addr             = 0x067C,
+		.format_measure_cfg0_addr         = 0x0680,
+		.format_measure_cfg1_addr         = 0x0684,
+		.format_measure0_addr             = 0x0688,
+		.format_measure1_addr             = 0x068C,
+		.format_measure2_addr             = 0x0690,
+		.timestamp_curr0_sof_addr         = 0x0694,
+		.timestamp_curr1_sof_addr         = 0x0698,
+		.timestamp_perv0_sof_addr         = 0x069C,
+		.timestamp_perv1_sof_addr         = 0x06A0,
+		.timestamp_curr0_eof_addr         = 0x06A4,
+		.timestamp_curr1_eof_addr         = 0x06A8,
+		.timestamp_perv0_eof_addr         = 0x06AC,
+		.timestamp_perv1_eof_addr         = 0x06B0,
+		.batch_id_cfg0_addr               = 0x06B4,
+		.batch_id_cfg1_addr               = 0x06B8,
+		.batch_period_cfg_addr            = 0x06BC,
+		.batch_stream_id_cfg_addr         = 0x06C0,
+		.epoch0_cfg_batch_id0_addr        = 0x06C4,
+		.epoch1_cfg_batch_id0_addr        = 0x06C8,
+		.epoch0_cfg_batch_id1_addr        = 0x06CC,
+		.epoch1_cfg_batch_id1_addr        = 0x06D0,
+		.epoch0_cfg_batch_id2_addr        = 0x06D4,
+		.epoch1_cfg_batch_id2_addr        = 0x06D8,
+		.epoch0_cfg_batch_id3_addr        = 0x06DC,
+		.epoch1_cfg_batch_id3_addr        = 0x06E0,
+		.epoch0_cfg_batch_id4_addr        = 0x06E4,
+		.epoch1_cfg_batch_id4_addr        = 0x06E8,
+		.epoch0_cfg_batch_id5_addr        = 0x06EC,
+		.epoch1_cfg_batch_id5_addr        = 0x06F0,
+		.path_batch_status                = 0x06F4,
+		.path_frame_id                    = 0x06F8,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.mipi_pack_supported              = 1,
+		.offline_mode_supported           = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x200020,
+		.top_irq_mask                     = {0x200,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_880_rdi_2_reg_info = {
+		.irq_status_addr                  = 0x010C,
+		.irq_mask_addr                    = 0x0110,
+		.irq_clear_addr                   = 0x0114,
+		.irq_set_addr                     = 0x0118,
+		.cfg0_addr                        = 0x0700,
+		.ctrl_addr                        = 0x0704,
+		.debug_clr_cmd_addr               = 0x0708,
+		.multi_vcdt_cfg0_addr             = 0x070C,
+		.cfg1_addr                        = 0x0710,
+		.err_recovery_cfg0_addr           = 0x0714,
+		.err_recovery_cfg1_addr           = 0x0718,
+		.err_recovery_cfg2_addr           = 0x071C,
+		.debug_byte_cntr_ping_addr        = 0x0720,
+		.debug_byte_cntr_pong_addr        = 0x0724,
+		.camif_frame_cfg_addr             = 0x0728,
+		.epoch_irq_cfg_addr               = 0x072C,
+		.epoch0_subsample_ptrn_addr       = 0x0730,
+		.epoch1_subsample_ptrn_addr       = 0x0734,
+		.debug_camif_1_addr               = 0x0738,
+		.debug_camif_0_addr               = 0x073C,
+		.frm_drop_pattern_addr            = 0x0740,
+		.frm_drop_period_addr             = 0x0744,
+		.irq_subsample_pattern_addr       = 0x0748,
+		.irq_subsample_period_addr        = 0x074C,
+		.hcrop_addr                       = 0x0750,
+		.vcrop_addr                       = 0x0754,
+		.pix_drop_pattern_addr            = 0x0758,
+		.pix_drop_period_addr             = 0x075C,
+		.line_drop_pattern_addr           = 0x0760,
+		.line_drop_period_addr            = 0x0764,
+		.debug_halt_status_addr           = 0x076C,
+		.debug_misr_val0_addr             = 0x0770,
+		.debug_misr_val1_addr             = 0x0774,
+		.debug_misr_val2_addr             = 0x0778,
+		.debug_misr_val3_addr             = 0x077C,
+		.format_measure_cfg0_addr         = 0x0780,
+		.format_measure_cfg1_addr         = 0x0784,
+		.format_measure0_addr             = 0x0788,
+		.format_measure1_addr             = 0x078C,
+		.format_measure2_addr             = 0x0790,
+		.timestamp_curr0_sof_addr         = 0x0794,
+		.timestamp_curr1_sof_addr         = 0x0798,
+		.timestamp_perv0_sof_addr         = 0x079C,
+		.timestamp_perv1_sof_addr         = 0x07A0,
+		.timestamp_curr0_eof_addr         = 0x07A4,
+		.timestamp_curr1_eof_addr         = 0x07A8,
+		.timestamp_perv0_eof_addr         = 0x07AC,
+		.timestamp_perv1_eof_addr         = 0x07B0,
+		.batch_id_cfg0_addr               = 0x07B4,
+		.batch_id_cfg1_addr               = 0x07B8,
+		.batch_period_cfg_addr            = 0x07BC,
+		.batch_stream_id_cfg_addr         = 0x07C0,
+		.epoch0_cfg_batch_id0_addr        = 0x07C4,
+		.epoch1_cfg_batch_id0_addr        = 0x07C8,
+		.epoch0_cfg_batch_id1_addr        = 0x07CC,
+		.epoch1_cfg_batch_id1_addr        = 0x07D0,
+		.epoch0_cfg_batch_id2_addr        = 0x07D4,
+		.epoch1_cfg_batch_id2_addr        = 0x07D8,
+		.epoch0_cfg_batch_id3_addr        = 0x07DC,
+		.epoch1_cfg_batch_id3_addr        = 0x07E0,
+		.epoch0_cfg_batch_id4_addr        = 0x07E4,
+		.epoch1_cfg_batch_id4_addr        = 0x07E8,
+		.epoch0_cfg_batch_id5_addr        = 0x07EC,
+		.epoch1_cfg_batch_id5_addr        = 0x07F0,
+		.path_batch_status                = 0x07F4,
+		.path_frame_id                    = 0x07F8,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.mipi_pack_supported              = 1,
+		.offline_mode_supported           = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x400040,
+		.top_irq_mask                     = {0x400,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_880_rdi_3_reg_info = {
+		.irq_status_addr                  = 0x011C,
+		.irq_mask_addr                    = 0x0120,
+		.irq_clear_addr                   = 0x0124,
+		.irq_set_addr                     = 0x0128,
+		.cfg0_addr                        = 0x0800,
+		.ctrl_addr                        = 0x0804,
+		.debug_clr_cmd_addr               = 0x0808,
+		.multi_vcdt_cfg0_addr             = 0x080C,
+		.cfg1_addr                        = 0x0810,
+		.err_recovery_cfg0_addr           = 0x0814,
+		.err_recovery_cfg1_addr           = 0x0818,
+		.err_recovery_cfg2_addr           = 0x081C,
+		.debug_byte_cntr_ping_addr        = 0x0820,
+		.debug_byte_cntr_pong_addr        = 0x0824,
+		.camif_frame_cfg_addr             = 0x0828,
+		.epoch_irq_cfg_addr               = 0x082C,
+		.epoch0_subsample_ptrn_addr       = 0x0830,
+		.epoch1_subsample_ptrn_addr       = 0x0834,
+		.debug_camif_1_addr               = 0x0838,
+		.debug_camif_0_addr               = 0x083C,
+		.frm_drop_pattern_addr            = 0x0840,
+		.frm_drop_period_addr             = 0x0840,
+		.irq_subsample_pattern_addr       = 0x0848,
+		.irq_subsample_period_addr        = 0x084C,
+		.hcrop_addr                       = 0x0850,
+		.vcrop_addr                       = 0x0854,
+		.pix_drop_pattern_addr            = 0x0858,
+		.pix_drop_period_addr             = 0x085C,
+		.line_drop_pattern_addr           = 0x0860,
+		.line_drop_period_addr            = 0x0864,
+		.debug_halt_status_addr           = 0x0868,
+		.debug_misr_val0_addr             = 0x0870,
+		.debug_misr_val1_addr             = 0x0874,
+		.debug_misr_val2_addr             = 0x0878,
+		.debug_misr_val3_addr             = 0x087C,
+		.format_measure_cfg0_addr         = 0x0880,
+		.format_measure_cfg1_addr         = 0x0884,
+		.format_measure0_addr             = 0x0888,
+		.format_measure1_addr             = 0x088C,
+		.format_measure2_addr             = 0x0890,
+		.timestamp_curr0_sof_addr         = 0x0894,
+		.timestamp_curr1_sof_addr         = 0x0898,
+		.timestamp_perv0_sof_addr         = 0x089C,
+		.timestamp_perv1_sof_addr         = 0x08A0,
+		.timestamp_curr0_eof_addr         = 0x08A4,
+		.timestamp_curr1_eof_addr         = 0x08A8,
+		.timestamp_perv0_eof_addr         = 0x08AC,
+		.timestamp_perv1_eof_addr         = 0x08B0,
+		.batch_id_cfg0_addr               = 0x08B4,
+		.batch_id_cfg1_addr               = 0x08B8,
+		.batch_period_cfg_addr            = 0x08BC,
+		.batch_stream_id_cfg_addr         = 0x08C0,
+		.epoch0_cfg_batch_id0_addr        = 0x08C4,
+		.epoch1_cfg_batch_id0_addr        = 0x08C8,
+		.epoch0_cfg_batch_id1_addr        = 0x08CC,
+		.epoch1_cfg_batch_id1_addr        = 0x08D0,
+		.epoch0_cfg_batch_id2_addr        = 0x08D4,
+		.epoch1_cfg_batch_id2_addr        = 0x08D8,
+		.epoch0_cfg_batch_id3_addr        = 0x08DC,
+		.epoch1_cfg_batch_id3_addr        = 0x08E0,
+		.epoch0_cfg_batch_id4_addr        = 0x08E4,
+		.epoch1_cfg_batch_id4_addr        = 0x08E8,
+		.epoch0_cfg_batch_id5_addr        = 0x08EC,
+		.epoch1_cfg_batch_id5_addr        = 0x08F0,
+		.path_batch_status                = 0x08F4,
+		.path_frame_id                    = 0x08F8,
+
+		/* configurations */
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.resume_frame_boundary            = 1,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = 0,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 3,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 2,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x20186001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x800080,
+		.top_irq_mask                     = {0x800,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_880_rdi_4_reg_info = {
+		.irq_status_addr                 = 0x012C,
+		.irq_mask_addr                   = 0x0130,
+		.irq_clear_addr                  = 0x0134,
+		.irq_set_addr                    = 0x0138,
+		.cfg0_addr                       = 0x0900,
+		.ctrl_addr                       = 0x0904,
+		.debug_clr_cmd_addr              = 0x0908,
+		.multi_vcdt_cfg0_addr            = 0x090C,
+		.cfg1_addr                       = 0x0910,
+		.err_recovery_cfg0_addr          = 0x0914,
+		.err_recovery_cfg1_addr          = 0x0918,
+		.err_recovery_cfg2_addr          = 0x091C,
+		.debug_byte_cntr_ping_addr       = 0x0920,
+		.debug_byte_cntr_pong_addr       = 0x0924,
+		.camif_frame_cfg_addr            = 0x0928,
+		.epoch_irq_cfg_addr              = 0x092C,
+		.epoch0_subsample_ptrn_addr      = 0x0930,
+		.epoch1_subsample_ptrn_addr      = 0x0934,
+		.debug_camif_1_addr              = 0x0938,
+		.debug_camif_0_addr              = 0x093C,
+		.frm_drop_pattern_addr           = 0x0940,
+		.frm_drop_period_addr            = 0x0944,
+		.irq_subsample_pattern_addr      = 0x0948,
+		.irq_subsample_period_addr       = 0x094C,
+		.hcrop_addr                      = 0x0950,
+		.vcrop_addr                      = 0x0954,
+		.pix_drop_pattern_addr           = 0x0958,
+		.pix_drop_period_addr            = 0x095C,
+		.line_drop_pattern_addr          = 0x0960,
+		.line_drop_period_addr           = 0x0964,
+		.debug_halt_status_addr          = 0x0968,
+		.debug_misr_val0_addr            = 0x0970,
+		.debug_misr_val1_addr            = 0x0974,
+		.debug_misr_val2_addr            = 0x0978,
+		.debug_misr_val3_addr            = 0x097C,
+		.format_measure_cfg0_addr        = 0x0980,
+		.format_measure_cfg1_addr        = 0x0984,
+		.format_measure0_addr            = 0x0988,
+		.format_measure1_addr            = 0x098C,
+		.format_measure2_addr            = 0x0990,
+		.timestamp_curr0_sof_addr        = 0x0994,
+		.timestamp_curr1_sof_addr        = 0x0998,
+		.timestamp_perv0_sof_addr        = 0x099C,
+		.timestamp_perv1_sof_addr        = 0x09A0,
+		.timestamp_curr0_eof_addr        = 0x09A4,
+		.timestamp_curr1_eof_addr        = 0x09A8,
+		.timestamp_perv0_eof_addr        = 0x09AC,
+		.timestamp_perv1_eof_addr        = 0x09B0,
+		.batch_id_cfg0_addr              = 0x09B4,
+		.batch_id_cfg1_addr              = 0x09B8,
+		.batch_period_cfg_addr           = 0x09BC,
+		.batch_stream_id_cfg_addr        = 0x09C0,
+		.epoch0_cfg_batch_id0_addr       = 0x09C4,
+		.epoch1_cfg_batch_id0_addr       = 0x09C8,
+		.epoch0_cfg_batch_id1_addr       = 0x09CC,
+		.epoch1_cfg_batch_id1_addr       = 0x09D0,
+		.epoch0_cfg_batch_id2_addr       = 0x09D4,
+		.epoch1_cfg_batch_id2_addr       = 0x09D8,
+		.epoch0_cfg_batch_id3_addr       = 0x09DC,
+		.epoch1_cfg_batch_id3_addr       = 0x09E0,
+		.epoch0_cfg_batch_id4_addr       = 0x09E4,
+		.epoch1_cfg_batch_id4_addr       = 0x09E8,
+		.epoch0_cfg_batch_id5_addr       = 0x09EC,
+		.epoch1_cfg_batch_id5_addr       = 0x09F0,
+		.path_batch_status               = 0x09F4,
+		.path_frame_id                   = 0x09F8,
+
+		/* configurations */
+		.capabilities                    = CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.resume_frame_boundary           = 1,
+		.start_mode_internal             = 0x0,
+		.start_mode_global               = 0x1,
+		.start_mode_shift                = 2,
+		.overflow_ctrl_en                = 1,
+		.capabilities                    = 0,
+		.overflow_ctrl_mode_val          = 0x8,
+		.offline_mode_supported          = 1,
+		.mipi_pack_supported             = 1,
+		.packing_fmt_shift_val           = 15,
+		.early_eof_en_shift_val          = 14,
+		.plain_fmt_shift_val             = 12,
+		.plain_alignment_shift_val       = 11,
+		.crop_v_en_shift_val             = 8,
+		.crop_h_en_shift_val             = 7,
+		.drop_v_en_shift_val             = 6,
+		.drop_h_en_shift_val             = 5,
+		.timestamp_en_shift_val          = 6,
+		.format_measure_en_shift_val     = 3,
+		.debug_byte_cntr_rst_shift_val   = 2,
+		.offline_mode_en_shift_val       = 2,
+		.ccif_violation_en               = 1,
+		.fatal_err_mask                  = 0x20186001,
+		.non_fatal_err_mask              = 0x12000004,
+		.sof_irq_mask                    = 0x10,
+		.rup_irq_mask                    = 0x800000,
+		.epoch0_irq_mask                 = 0x200000,
+		.epoch1_irq_mask                 = 0x400000,
+		.eof_irq_mask                    = 0x8,
+		.rup_aup_mask                    = 0x1000100,
+		.top_irq_mask                    = {0x1000,},
+		.epoch0_shift_val                = 16,
+		.epoch1_shift_val                = 0,
+		.sof_retiming_dis_shift          = 5,
+};
+
+static struct cam_ife_csid_ver2_csi2_rx_reg_info
+	cam_ife_csid_880_csi2_reg_info = {
+		.irq_status_addr                 = {0x009C,},
+		.irq_mask_addr                   = {0x00A0,},
+		.irq_clear_addr                  = {0x00A4,},
+		.irq_set_addr                    = {0x00A8,},
+		/*CSI2 rx control */
+		.cfg0_addr                       = 0x0200,
+		.cfg1_addr                       = 0x0204,
+		.capture_ctrl_addr               = 0x0208,
+		.rst_strobes_addr                = 0x020C,
+		.cap_unmap_long_pkt_hdr_0_addr   = 0x0210,
+		.cap_unmap_long_pkt_hdr_1_addr   = 0x0214,
+		.captured_short_pkt_0_addr       = 0x0218,
+		.captured_short_pkt_1_addr       = 0x021c,
+		.captured_long_pkt_0_addr        = 0x0220,
+		.captured_long_pkt_1_addr        = 0x0224,
+		.captured_long_pkt_ftr_addr      = 0x0228,
+		.captured_cphy_pkt_hdr_addr      = 0x022c,
+		.lane0_misr_addr                 = 0x0230,
+		.lane1_misr_addr                 = 0x0234,
+		.lane2_misr_addr                 = 0x0238,
+		.lane3_misr_addr                 = 0x023c,
+		.total_pkts_rcvd_addr            = 0x0240,
+		.stats_ecc_addr                  = 0x0244,
+		.total_crc_err_addr              = 0x0248,
+		.de_scramble_type3_cfg0_addr     = 0x024C,
+		.de_scramble_type3_cfg1_addr     = 0x0250,
+		.de_scramble_type2_cfg0_addr     = 0x0254,
+		.de_scramble_type2_cfg1_addr     = 0x0258,
+		.de_scramble_type1_cfg0_addr     = 0x025C,
+		.de_scramble_type1_cfg1_addr     = 0x0260,
+		.de_scramble_type0_cfg0_addr     = 0x0264,
+		.de_scramble_type0_cfg1_addr     = 0x0268,
+
+		.rst_done_shift_val              = 27,
+		.irq_mask_all                    = 0xFFFFFFF,
+		.misr_enable_shift_val           = 6,
+		.vc_mode_shift_val               = 2,
+		.capture_long_pkt_en_shift       = 0,
+		.capture_short_pkt_en_shift      = 1,
+		.capture_cphy_pkt_en_shift       = 2,
+		.capture_long_pkt_dt_shift       = 4,
+		.capture_long_pkt_vc_shift       = 10,
+		.capture_short_pkt_vc_shift      = 15,
+		.capture_cphy_pkt_dt_shift       = 20,
+		.capture_cphy_pkt_vc_shift       = 26,
+		.phy_num_mask                    = 0xf,
+		.vc_mask                         = 0x7C00000,
+		.dt_mask                         = 0x3f0000,
+		.wc_mask                         = 0xffff,
+		.vc_shift                        = 0x16,
+		.dt_shift                        = 0x10,
+		.wc_shift                        = 0,
+		.calc_crc_mask                   = 0xffff,
+		.expected_crc_mask               = 0xffff,
+		.calc_crc_shift                  = 0x10,
+		.ecc_correction_shift_en         = 0,
+		.lane_num_shift                  = 0,
+		.lane_cfg_shift                  = 4,
+		.phy_type_shift                  = 24,
+		.phy_num_shift                   = 20,
+		.tpg_mux_en_shift                = 27,
+		.tpg_num_sel_shift               = 28,
+		.phy_bist_shift_en               = 7,
+		.epd_mode_shift_en               = 8,
+		.eotp_shift_en                   = 9,
+		.dyn_sensor_switch_shift_en      = 10,
+		.rup_aup_latch_shift             = 13,
+		.rup_aup_latch_supported         = true,
+		.long_pkt_strobe_rst_shift       = 0,
+		.short_pkt_strobe_rst_shift      = 1,
+		.cphy_pkt_strobe_rst_shift       = 2,
+		.unmapped_pkt_strobe_rst_shift   = 3,
+		.fatal_err_mask                  = {0x19FA800,},
+		.part_fatal_err_mask             = {0x0001000,},
+		.non_fatal_err_mask              = {0x0200000,},
+		.top_irq_mask                    = {0x4,},
+};
+
+static struct cam_ife_csid_ver2_common_reg_info
+			cam_ife_csid_880_cmn_reg_info = {
+	.hw_version_addr                         = 0x0000,
+	.cfg0_addr                               = 0x0004,
+	.global_cmd_addr                         = 0x0008,
+	.reset_cfg_addr                          = 0x000c,
+	.reset_cmd_addr                          = 0x0010,
+	.irq_cmd_addr                            = 0x0014,
+	.rup_aup_cmd_addr                        = 0x0018,
+	.offline_cmd_addr                        = 0x001C,
+	.shdr_master_slave_cfg_addr              = 0x0020,
+	.top_irq_status_addr                     = {0x007C,},
+	.top_irq_mask_addr                       = {0x0080,},
+	.top_irq_clear_addr                      = {0x0084,},
+	.top_irq_set_addr                        = {0x0088,},
+	.buf_done_irq_status_addr                = 0x008C,
+	.buf_done_irq_mask_addr                  = 0x0090,
+	.buf_done_irq_clear_addr                 = 0x0094,
+	.buf_done_irq_set_addr                   = 0x0098,
+	.test_bus_ctrl                           = 0x01E8,
+	.test_bus_debug                          = 0x01EC,
+	.drv_cfg0_addr                           = 0x13c,
+	.drv_cfg1_addr                           = 0x140,
+	.drv_cfg2_addr                           = 0x144,
+	.debug_drv_0_addr                        = 0x148,
+	.debug_drv_1_addr                        = 0x14C,
+
+	/*configurations */
+	.major_version                           = 6,
+	.minor_version                           = 8,
+	.version_incr                            = 0,
+	.num_rdis                                = 5,
+	.num_pix                                 = 1,
+	.num_ppp                                 = 1,
+	.rst_done_shift_val                      = 1,
+	.path_en_shift_val                       = 31,
+	.dt_id_shift_val                         = 27,
+	.vc_shift_val                            = 22,
+	.vc_mask                                 = 0x1F,
+	.dt_shift_val                            = 16,
+	.dt_mask                                 = 0x3F,
+	.crop_shift_val                          = 16,
+	.decode_format_shift_val                 = 12,
+	.decode_format1_shift_val                = 16,
+	.decode_format1_supported                = true,
+	.decode_format_mask                      = 0xF,
+	.frame_id_decode_en_shift_val            = 1,
+	.multi_vcdt_vc1_shift_val                = 2,
+	.multi_vcdt_dt1_shift_val                = 7,
+	.multi_vcdt_ts_combo_en_shift_val        = 13,
+	.multi_vcdt_en_shift_val                 = 0,
+	.timestamp_stb_sel_shift_val             = 8,
+	.vfr_en_shift_val                        = 0,
+	.mup_shift_val                           = 28,
+	.shdr_slave_ppp_shift                    = 20,
+	.shdr_slave_rdi2_shift                   = 22,
+	.shdr_slave_rdi1_shift                   = 21,
+	.shdr_master_rdi0_shift                  = 5,
+	.shdr_master_slave_en_shift              = 0,
+	.drv_en_shift                            = 0,
+	.drv_rup_en_shift                        = 0,
+	.early_eof_supported                     = 1,
+	.vfr_supported                           = 1,
+	.multi_vcdt_supported                    = 1,
+	.ts_comb_vcdt_en                         = true,
+	.ts_comb_vcdt_mask                       = 3,
+	.frame_id_dec_supported                  = 1,
+	.measure_en_hbi_vbi_cnt_mask             = 0xc,
+	.measure_pixel_line_en_mask              = 0x3,
+	.crop_pix_start_mask                     = 0x3fff,
+	.crop_pix_end_mask                       = 0xffff,
+	.crop_line_start_mask                    = 0x3fff,
+	.crop_line_end_mask                      = 0xffff,
+	.drop_supported                          = 1,
+	.ipp_irq_mask_all                        = 0x7FFF,
+	.rdi_irq_mask_all                        = 0x7FFF,
+	.ppp_irq_mask_all                        = 0xFFFF,
+	.sync_reset_ctrl_testbus_val             = 0x1000C101,
+	.top_err_irq_mask = {
+		0x180002,
+	},
+	.rst_loc_path_only_val                   = 0x0,
+	.rst_loc_complete_csid_val               = 0x1,
+	.rst_mode_frame_boundary_val             = 0x0,
+	.rst_mode_immediate_val                  = 0x1,
+	.rst_cmd_hw_reset_complete_val           = 0x1,
+	.rst_cmd_sw_reset_complete_val           = 0x2,
+	.rst_cmd_irq_ctrl_only_val               = 0x4,
+	.timestamp_strobe_val                    = 0x2,
+	.top_reset_irq_mask = {
+		0x1,
+	},
+	.rst_location_shift_val                  = 4,
+	.rst_mode_shift_val                      = 0,
+	.epoch_factor                            = 50,
+	.global_reset                            = 1,
+	.rup_supported                           = 1,
+	.only_master_rup                         = 1,
+	.format_measure_height_mask_val          = 0xFFFF,
+	.format_measure_height_shift_val         = 0x10,
+	.format_measure_width_mask_val           = 0xFFFF,
+	.format_measure_width_shift_val          = 0x0,
+	.top_buf_done_irq_mask                   = 0x2000,
+	.phy_sel_base_idx                        = 1,
+	.decode_format_payload_only              = 0xF,
+	.timestamp_enabled_in_cfg0               = true,
+	.sfe_ipp_input_rdi_res                   = BIT(CAM_IFE_PIX_PATH_RES_RDI_0),
+	.camif_irq_support                       = true,
+	.drv_rup_en_val_map = {
+		2, //RDI0
+		3, //RDI1
+		4, //RDI2
+		5, //RDI3
+		6, //RDI4
+		0, //IPP
+		1, //PPP
+		0, //UDI0
+		0, //UDI1
+		0, //UDI2
+	},
+	.drv_path_idle_en_val_map = {
+		BIT(4), //CAM_ISP_PXL_PATH
+		BIT(5), //CAM_ISP_PPP_PATH
+		0,      // LCR not applicable
+		BIT(6), //CAM_ISP_RDI0_PATH
+		BIT(7), //CAM_ISP_RDI1_PATH
+		BIT(8), //CAM_ISP_RDI2_PATH
+		BIT(9), //CAM_ISP_RDI3_PATH
+		BIT(10), //CAM_ISP_RDI4_PATH
+	},
+};
+
+static struct cam_ife_csid_ver2_top_reg_info
+			cam_ife_csid_880_top_reg_info = {
+	.io_path_cfg0_addr = {
+				    0x0,
+				    0x4,
+				    0x8,
+	},
+	.dual_csid_cfg0_addr =  {
+				    0xC,
+				    0x10,
+				    0x14,
+	},
+	.input_core_type_shift_val      = 0,
+	.sfe_offline_en_shift_val       = 12,
+	.out_ife_en_shift_val           = 8,
+	.dual_sync_sel_shift_val        = 8,
+	.dual_en_shift_val              = 0,
+	.master_slave_sel_shift_val     = 1,
+	.rdi_lcr_shift_val              = 16,
+	.master_sel_val                 = 0,
+	.slave_sel_val                  = 1,
+	.io_path_cfg_rst_val            = 1,
+	.dual_cfg_rst_val               = 0,
+	.sfe_pipeline_bypassed          = false,
+};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_880_reg_info = {
+	.top_irq_reg_info      = cam_ife_csid_880_top_irq_reg_info,
+	.rx_irq_reg_info       = cam_ife_csid_880_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_4],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		&cam_ife_csid_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_PPP],
+	},
+	.buf_done_irq_reg_info = &cam_ife_csid_880_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_880_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_880_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_880_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = &cam_ife_csid_880_ppp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_880_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_880_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_880_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_880_rdi_3_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_4] = &cam_ife_csid_880_rdi_4_reg_info,
+	.top_reg                              = &cam_ife_csid_880_top_reg_info,
+	.input_core_sel = {
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			0x4,
+			0x8,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			0x4,
+			-1,
+			-1,
+			-1,
+		},
+		{
+			0x0,
+			0x1,
+			0x2,
+			0x3,
+			0x4,
+			-1,
+			0x9,
+			-1,
+		},
+	},
+	.need_top_cfg = 0x1,
+	.csid_cust_node_map = {0x1, 0x0, 0x2},
+	.top_irq_desc       = &cam_ife_csid_880_top_irq_desc,
+	.rx_irq_desc        = &cam_ife_csid_880_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_880_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_880_num_top_irq_desc,
+	.num_rx_err_irqs    = cam_ife_csid_880_num_rx_irq_desc,
+	.num_path_err_irqs  = ARRAY_SIZE(cam_ife_csid_880_path_irq_desc),
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+	.is_ife_sfe_mapped  = true,
+};
+#endif /*_CAM_IFE_CSID_880_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid980.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid980.h
@@ -0,0 +1,1807 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_980_H_
+#define _CAM_IFE_CSID_980_H_
+
+#include <linux/module.h>
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+#define CAM_CSID_VERSION_V980                 0x90080000
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_980_rx_irq_desc[][32] = {
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "DL0_EOT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "DL1_EOT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "DL2_EOT",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "DL3_EOT",
+		},
+		{
+			.bitmask = BIT(4),
+			.desc = "DL0_SOT",
+		},
+		{
+			.bitmask = BIT(5),
+			.desc = "DL1_SOT",
+		},
+		{
+			.bitmask = BIT(6),
+			.desc = "DL2_SOT",
+		},
+		{
+			.bitmask = BIT(7),
+			.desc = "DL3_SOT",
+		},
+		{
+			.bitmask = BIT(8),
+			.desc = "DPHY_PH_ECC_SEC",
+		},
+		{
+			.bitmask = BIT(9),
+			.desc = "SENSOR_MODE_ID_CHANGE",
+		},
+		{
+			.bitmask = BIT(12),
+			.desc = "ERROR_DL0_EOT_LOST",
+		},
+		{
+			.bitmask = BIT(13),
+			.desc = "ERROR_DL1_EOT_LOST",
+		},
+		{
+			.bitmask = BIT(14),
+			.desc = "ERROR_DL2_EOT_LOST",
+		},
+		{
+			.bitmask = BIT(15),
+			.desc = "ERROR_DL3_EOT_LOST",
+		},
+		{
+			.bitmask = BIT(16),
+			.desc = "ERROR_DL0_SOT_LOST",
+		},
+		{
+			.bitmask = BIT(17),
+			.desc = "ERROR_DL1_SOT_LOST",
+		},
+		{
+			.bitmask = BIT(18),
+			.desc = "ERROR_DL2_SOT_LOST",
+		},
+		{
+			.bitmask = BIT(19),
+			.desc = "ERROR_DL3_SOT_LOST",
+		},
+		{
+			.bitmask = BIT(20),
+			.desc = "ERROR_DL0_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(21),
+			.desc = "ERROR_DL1_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(22),
+			.desc = "ERROR_DL2_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(23),
+			.desc = "ERROR_DL3_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(24),
+			.desc = "ERROR_CPHY_PH_CRC",
+		},
+		{
+			.bitmask = BIT(25),
+			.desc = "ERROR_PAYLOAD_CRC",
+		},
+		{
+			.bitmask = BIT(26),
+			.desc = "ERROR_DPHY_PH_ECC_DED",
+		},
+		{
+			.bitmask = BIT(27),
+			.desc = "ERROR_MMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(28),
+			.desc = "ERROR_UNMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(29),
+			.desc = "ERROR_STREAM_UNDERFLOW",
+		},
+		{
+			.bitmask = BIT(31),
+			.desc = "CSI2_RX_IRQ_STATUS_2",
+		},
+	},
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "LONG_PKT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "SHORT_PKT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "CPHY_PKT_HDR",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "ERROR_ILLEGAL_PROGRAMMING_IRQ",
+		},
+	},
+};
+
+static const uint32_t cam_ife_csid_980_num_rx_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_980_rx_irq_desc[0]),
+	ARRAY_SIZE(cam_ife_csid_980_rx_irq_desc[1]),
+};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_980_path_irq_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FATAL,
+		.desc = "ILLEGAL_PROGRAMMING",
+		.err_handler = cam_ife_csid_ver2_print_illegal_programming_irq_status,
+	},
+	{0},
+	{
+		.bitmask = BIT(2),
+		.desc = "ERROR_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "CAMIF_EOF",
+	},
+	{
+		.bitmask = BIT(4),
+		.desc = "CAMIF_SOF",
+	},
+	{0},
+	{0},
+	{0},
+	{0},
+	{
+		.bitmask = BIT(9),
+		.desc = "INFO_INPUT_EOF",
+	},
+	{
+		.bitmask = BIT(10),
+		.desc = "INFO_INPUT_EOL",
+	},
+	{
+		.bitmask = BIT(11),
+		.desc = "INFO_INPUT_SOL",
+	},
+	{
+		.bitmask = BIT(12),
+		.desc = "INFO_INPUT_SOF",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(14),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_LINE_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(15),
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.bitmask = BIT(16),
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.bitmask = BIT(17),
+		.desc = "VCDT_GRP_CHANGE",
+	},
+	{
+		.bitmask = BIT(18),
+		.err_type = CAM_ISP_HW_ERROR_CSID_CAMIF_FRAME_DROP,
+		.desc = "CAMIF_FRAME_DROP",
+	},
+	{
+		.bitmask = BIT(19),
+		.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+		.desc = "OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.bitmask = BIT(20),
+		.desc = "ERROR_REC_CCIF_VIOLATION From Camif",
+	},
+	{
+		.bitmask = BIT(21),
+		.desc = "CAMIF_EPOCH0",
+	},
+	{
+		.bitmask = BIT(22),
+		.desc = "CAMIF_EPOCH1",
+	},
+	{
+		.bitmask = BIT(23),
+		.desc = "RUP_DONE",
+	},
+	{
+		.bitmask = BIT(24),
+		.desc = "ILLEGAL_BATCH_ID",
+	},
+	{
+		.bitmask = BIT(25),
+		.desc = "BATCH_END_MISSING_VIOLATION",
+	},
+	{
+		.bitmask = BIT(26),
+		.desc = "UNBOUNDED_FRAME",
+	},
+	{
+		.bitmask = BIT(28),
+		.desc = "SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP",
+		.err_handler = cam_ife_csid_hw_ver2_mup_mismatch_handler,
+	},
+	{
+		.bitmask = BIT(29),
+		.desc = "CCIF_VIOLATION: Bad frame timings",
+	},
+};
+
+static const struct cam_ife_csid_top_irq_desc cam_ife_csid_980_top_irq_desc[][32] = {
+	{
+		{
+			.bitmask  = BIT(1),
+			.err_type = CAM_ISP_HW_ERROR_CSID_SENSOR_SWITCH_ERROR,
+			.err_name = "FATAL_SENSOR_SWITCHING_IRQ",
+			.desc = "Fatal Error during dynamically switching between 2 sensors",
+		},
+	},
+	{
+		{
+			.bitmask  = BIT(2),
+			.err_name = "ERROR_NO_VOTE_DN",
+			.desc = "vote_up is asserted before IDLE is encountered in a frame",
+		},
+		{
+			.bitmask  = BIT(3),
+			.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+			.err_name = "ERROR_VOTE_UP_LATE",
+			.desc = "vote_up is asserted at the same time as an SOF",
+			.err_handler = cam_ife_csid_hw_ver2_drv_err_handler,
+		},
+		{
+			.bitmask  = BIT(4),
+			.err_type = CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW,
+			.err_name = "ERROR_RDI_LINE_BUFFER_CONFLICT",
+			.desc = "Two or more RDIs programmed to access the shared line buffer",
+			.err_handler = cam_ife_csid_hw_ver2_rdi_line_buffer_conflict_handler,
+		},
+	},
+};
+
+static const uint32_t cam_ife_csid_980_num_top_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_980_top_irq_desc[0]),
+	ARRAY_SIZE(cam_ife_csid_980_top_irq_desc[1]),
+};
+
+static struct cam_irq_register_set cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_MAX] = {
+	/* Top_1 */
+	{
+		.mask_reg_offset   = 0x00000088,
+		.clear_reg_offset  = 0x0000008C,
+		.status_reg_offset = 0x00000084,
+		.set_reg_offset    = 0x00000090,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	/* RX_1 */
+	{
+		.mask_reg_offset   = 0x000000B8,
+		.clear_reg_offset  = 0x000000BC,
+		.status_reg_offset = 0x000000B4,
+	},
+	/* RDI0 */
+	{
+		.mask_reg_offset   = 0x00000118,
+		.clear_reg_offset  = 0x0000011C,
+		.status_reg_offset = 0x00000114,
+	},
+	/* RDI1 */
+	{
+		.mask_reg_offset   = 0x00000128,
+		.clear_reg_offset  = 0x0000012C,
+		.status_reg_offset = 0x00000124,
+	},
+	/* RDI2 */
+	{
+		.mask_reg_offset   = 0x00000138,
+		.clear_reg_offset  = 0x0000013C,
+		.status_reg_offset = 0x00000134,
+	},
+	/* RDI3 */
+	{
+		.mask_reg_offset   = 0x00000148,
+		.clear_reg_offset  = 0x0000014C,
+		.status_reg_offset = 0x00000144,
+	},
+	/* RDI4 */
+	{
+		.mask_reg_offset   = 0x00000158,
+		.clear_reg_offset  = 0x0000015C,
+		.status_reg_offset = 0x00000154,
+	},
+	/* IPP_0 */
+	{
+		.mask_reg_offset   = 0x000000D8,
+		.clear_reg_offset  = 0x000000DC,
+		.status_reg_offset = 0x000000D4,
+	},
+	/* PPP */
+	{
+		.mask_reg_offset   = 0x00000108,
+		.clear_reg_offset  = 0x0000010C,
+		.status_reg_offset = 0x00000104,
+	},
+	/* UDI_0 */
+	{0},
+	/* UDI_1 */
+	{0},
+	/* UDI_2 */
+	{0},
+
+	/* Top_2 */
+	{
+		.mask_reg_offset   = 0x00000098,
+		.clear_reg_offset  = 0x0000009C,
+		.status_reg_offset = 0x00000094,
+		.set_reg_offset    = 0x00000090,
+	},
+	/* RX_2 */
+	{
+		.mask_reg_offset   = 0x000000C8,
+		.clear_reg_offset  = 0x000000CC,
+		.status_reg_offset = 0x000000C4,
+	},
+	/* IPP_1 */
+	{
+		.mask_reg_offset   = 0x000000E8,
+		.clear_reg_offset  = 0x000000EC,
+		.status_reg_offset = 0x000000E4,
+	},
+	/* IPP_2 */
+	{
+		.mask_reg_offset   = 0x000000F8,
+		.clear_reg_offset  = 0x000000FC,
+		.status_reg_offset = 0x000000F4,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_980_top_irq_reg_info[] = {
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP],
+	.global_irq_cmd_offset = 0x00000014,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+	},
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP_2],
+	.global_irq_cmd_offset = 0,
+	},
+
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_980_rx_irq_reg_info[] = {
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX],
+	.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX_2],
+	.global_irq_cmd_offset = 0, /* intentionally set to zero */
+
+	},
+};
+
+static struct cam_irq_controller_reg_info
+	cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_MAX] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_0],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_1],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_2],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_3],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_4],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_PPP],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	/* UDI_0 */
+	{0},
+	/* UDI_1 */
+	{0},
+	/* UDI_2 */
+	{0},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP_1],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_980_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP_2],
+		.global_irq_cmd_offset = 0, /* intentionally set to zero */
+	},
+
+};
+
+static struct cam_irq_register_set cam_ife_csid_980_buf_done_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x000000A8,
+		.clear_reg_offset  = 0x000000AC,
+		.status_reg_offset = 0x000000A4,
+	},
+};
+
+static struct cam_irq_controller_reg_info
+	cam_ife_csid_980_buf_done_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = cam_ife_csid_980_buf_done_irq_reg_set,
+	.global_irq_cmd_offset  = 0, /* intentionally set to zero */
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_980_ipp_reg_info = {
+		.irq_status_addr                  = 0x00D4,
+		.irq_mask_addr                    = 0x00D8,
+		.irq_clear_addr                   = 0x00DC,
+		.irq_set_addr                     = 0x00E0,
+		.cfg0_addr                        = 0x0600,
+		.ctrl_addr                        = 0x0604,
+		.debug_clr_cmd_addr               = 0x0608,
+		.multi_vcdt_cfg0_addr             = 0x060C,
+		.cfg1_addr                        = 0,
+		.sparse_pd_extractor_cfg_addr     = 0,
+		.err_recovery_cfg0_addr           = 0,
+		.err_recovery_cfg1_addr           = 0,
+		.err_recovery_cfg2_addr           = 0,
+		.bin_pd_detect_cfg0_addr          = 0,
+		.bin_pd_detect_cfg1_addr          = 0,
+		.bin_pd_detect_cfg2_addr	      = 0,
+		.camif_frame_cfg_addr             = 0x0638,
+		.epoch_irq_cfg_addr               = 0,
+		.epoch0_subsample_ptrn_addr       = 0,
+		.epoch1_subsample_ptrn_addr       = 0,
+		.debug_rup_aup_status             = 0x0648,
+		.debug_camif_1_addr               = 0x064C,
+		.debug_camif_0_addr               = 0x0650,
+		.frm_drop_pattern_addr            = 0x0680,
+		.frm_drop_period_addr             = 0x0684,
+		.irq_subsample_pattern_addr       = 0x0688,
+		.irq_subsample_period_addr        = 0x068C,
+		.hcrop_addr                       = 0,
+		.vcrop_addr                       = 0,
+		.pix_drop_pattern_addr            = 0,
+		.pix_drop_period_addr             = 0,
+		.line_drop_pattern_addr           = 0,
+		.line_drop_period_addr            = 0,
+		.debug_halt_status_addr           = 0x0654,
+		.debug_misr_val0_addr             = 0x0658,
+		.debug_misr_val1_addr             = 0x065C,
+		.debug_misr_val2_addr             = 0x0660,
+		.debug_misr_val3_addr             = 0x0664,
+		.format_measure_cfg0_addr         = 0x0690,
+		.format_measure_cfg1_addr         = 0x0694,
+		.format_measure_cfg2_addr         = 0x0698,
+		.format_measure0_addr             = 0x069C,
+		.format_measure1_addr             = 0x06A0,
+		.format_measure2_addr             = 0x06A4,
+		.timestamp_curr0_sof_addr         = 0x06A8,
+		.timestamp_curr1_sof_addr         = 0x06AC,
+		.timestamp_perv0_sof_addr         = 0x06B0,
+		.timestamp_perv1_sof_addr         = 0x06B4,
+		.timestamp_curr0_eof_addr         = 0x06B8,
+		.timestamp_curr1_eof_addr         = 0x06BC,
+		.timestamp_perv0_eof_addr         = 0x06C0,
+		.timestamp_perv1_eof_addr         = 0x06C4,
+		.lut_bank_cfg_addr                = 0,
+		.batch_id_cfg0_addr               = 0x06CC,
+		.batch_id_cfg1_addr               = 0x06D0,
+		.batch_period_cfg_addr            = 0x06D4,
+		.batch_stream_id_cfg_addr         = 0x06D8,
+		.epoch0_cfg_batch_id0_addr        = 0x06DC,
+		.epoch1_cfg_batch_id0_addr        = 0x06E0,
+		.epoch0_cfg_batch_id1_addr        = 0x06E4,
+		.epoch1_cfg_batch_id1_addr        = 0x06E8,
+		.epoch0_cfg_batch_id2_addr        = 0x06EC,
+		.epoch1_cfg_batch_id2_addr        = 0x06F0,
+		.epoch0_cfg_batch_id3_addr        = 0x06F4,
+		.epoch1_cfg_batch_id3_addr        = 0x06F8,
+		.epoch0_cfg_batch_id4_addr        = 0x06FC,
+		.epoch1_cfg_batch_id4_addr        = 0x0700,
+		.epoch0_cfg_batch_id5_addr        = 0x0704,
+		.epoch1_cfg_batch_id5_addr        = 0x0708,
+		.secure_mask_cfg0                 = 0,
+		.path_batch_status                = 0x070C,
+		.path_frame_id                    = 0x0710,
+		.cfg2_addr                        = 0x0714,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.binning_supported                = 0x7,
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS |
+							CAM_IFE_CSID_CAP_MULTI_CTXT,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.sof_retiming_dis_shift           = 5,
+		.start_mode_shift                 = 2,
+		.start_master_sel_val             = 0,
+		.start_master_sel_shift           = 4,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.pix_store_en_shift_val           = 0,
+		.early_eof_en_shift_val           = 16,
+		.bin_h_en_shift_val               = 20,
+		.bin_v_en_shift_val               = 21,
+		.bin_en_shift_val                 = 18,
+		.bin_qcfa_en_shift_val            = 19,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 6,
+		.overflow_ctrl_en                 = 0,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 4,
+		.start_master_sel_shift_val       = 4,
+		.bin_pd_en_shift_val              = 0,
+		.bin_pd_blk_w_shift_val           = 8,
+		.bin_pd_blk_h_shift_val           = 24,
+		.bin_pd_detect_x_offset_shift_val = 0,
+		.bin_pd_detect_x_end_shift_val    = 16,
+		.bin_pd_detect_y_offset_shift_val = 0,
+		.bin_pd_detect_y_end_shift_val    = 16,
+		.lut_bank_0_sel_val               = 0,
+		.lut_bank_1_sel_val               = 1,
+		.fatal_err_mask                   = 0x241c6001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_mask                         = 0x1,
+		.aup_mask                         = 0x1,
+		.rup_aup_set_mask                 = 0x1,
+		.top_irq_mask                     = {0x100,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_980_ipp_1_reg_info = {
+		.irq_status_addr                  = 0x00E4,
+		.irq_mask_addr                    = 0x00E8,
+		.irq_clear_addr                   = 0x00EC,
+		.irq_set_addr                     = 0x00F0,
+		.cfg0_addr                        = 0x0800,
+		.ctrl_addr                        = 0x0804,
+		.debug_clr_cmd_addr               = 0x0808,
+		.multi_vcdt_cfg0_addr             = 0x080C,
+		.cfg1_addr                        = 0,
+		.sparse_pd_extractor_cfg_addr     = 0,
+		.err_recovery_cfg0_addr           = 0,
+		.err_recovery_cfg1_addr           = 0,
+		.err_recovery_cfg2_addr           = 0,
+		.bin_pd_detect_cfg0_addr          = 0,
+		.bin_pd_detect_cfg1_addr          = 0,
+		.bin_pd_detect_cfg2_addr	      = 0,
+		.camif_frame_cfg_addr             = 0x0838,
+		.epoch_irq_cfg_addr               = 0,
+		.epoch0_subsample_ptrn_addr       = 0,
+		.epoch1_subsample_ptrn_addr       = 0,
+		.debug_rup_aup_status             = 0x0848,
+		.debug_camif_1_addr               = 0x084C,
+		.debug_camif_0_addr               = 0x0850,
+		.frm_drop_pattern_addr            = 0x0880,
+		.frm_drop_period_addr             = 0x0884,
+		.irq_subsample_pattern_addr       = 0x0888,
+		.irq_subsample_period_addr        = 0x088C,
+		.hcrop_addr                       = 0,
+		.vcrop_addr                       = 0,
+		.pix_drop_pattern_addr            = 0,
+		.pix_drop_period_addr             = 0,
+		.line_drop_pattern_addr           = 0,
+		.line_drop_period_addr            = 0,
+		.debug_halt_status_addr           = 0x0854,
+		.debug_misr_val0_addr             = 0x0858,
+		.debug_misr_val1_addr             = 0x085C,
+		.debug_misr_val2_addr             = 0x0860,
+		.debug_misr_val3_addr             = 0x0864,
+		.format_measure_cfg0_addr         = 0x0890,
+		.format_measure_cfg1_addr         = 0x0894,
+		.format_measure_cfg2_addr         = 0x0898,
+		.format_measure0_addr             = 0x089C,
+		.format_measure1_addr             = 0x08A0,
+		.format_measure2_addr             = 0x08A4,
+		.timestamp_curr0_sof_addr         = 0x08A8,
+		.timestamp_curr1_sof_addr         = 0x08AC,
+		.timestamp_perv0_sof_addr         = 0x08B0,
+		.timestamp_perv1_sof_addr         = 0x08B4,
+		.timestamp_curr0_eof_addr         = 0x08B8,
+		.timestamp_curr1_eof_addr         = 0x08BC,
+		.timestamp_perv0_eof_addr         = 0x08C0,
+		.timestamp_perv1_eof_addr         = 0x08C4,
+		.lut_bank_cfg_addr                = 0,
+		.batch_id_cfg0_addr               = 0x08CC,
+		.batch_id_cfg1_addr               = 0x08D0,
+		.batch_period_cfg_addr            = 0x08D4,
+		.batch_stream_id_cfg_addr         = 0x08D8,
+		.epoch0_cfg_batch_id0_addr        = 0x08DC,
+		.epoch1_cfg_batch_id0_addr        = 0x08E0,
+		.epoch0_cfg_batch_id1_addr        = 0x08E4,
+		.epoch1_cfg_batch_id1_addr        = 0x08E8,
+		.epoch0_cfg_batch_id2_addr        = 0x08EC,
+		.epoch1_cfg_batch_id2_addr        = 0x08F0,
+		.epoch0_cfg_batch_id3_addr        = 0x08F4,
+		.epoch1_cfg_batch_id3_addr        = 0x08F8,
+		.epoch0_cfg_batch_id4_addr        = 0x08FC,
+		.epoch1_cfg_batch_id4_addr        = 0x0900,
+		.epoch0_cfg_batch_id5_addr        = 0x0904,
+		.epoch1_cfg_batch_id5_addr        = 0x0908,
+		.secure_mask_cfg0                 = 0,
+		.path_batch_status                = 0x090C,
+		.path_frame_id                    = 0x0910,
+		.cfg2_addr                        = 0x0914,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.binning_supported                = 0x7,
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS |
+							CAM_IFE_CSID_CAP_MULTI_CTXT,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.sof_retiming_dis_shift           = 5,
+		.start_mode_shift                 = 2,
+		.start_master_sel_val             = 0,
+		.start_master_sel_shift           = 4,
+		.timestamp_en_shift_val           = 6,
+		.start_master_sel_shift_val       = 4,
+		.fatal_err_mask                   = 0x241c6001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_mask                         = 0x2,
+		.aup_mask                         = 0x2,
+		.rup_aup_set_mask                 = 0x1,
+		.top_irq_mask                     = {0x100,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_980_ipp_2_reg_info = {
+		.irq_status_addr                  = 0x00F4,
+		.irq_mask_addr                    = 0x00F8,
+		.irq_clear_addr                   = 0x00FC,
+		.irq_set_addr                     = 0x0100,
+		.cfg0_addr                        = 0x0A00,
+		.ctrl_addr                        = 0x0A04,
+		.debug_clr_cmd_addr               = 0x0A08,
+		.multi_vcdt_cfg0_addr             = 0x0A0C,
+		.cfg1_addr                        = 0,
+		.sparse_pd_extractor_cfg_addr     = 0,
+		.err_recovery_cfg0_addr           = 0,
+		.err_recovery_cfg1_addr           = 0,
+		.err_recovery_cfg2_addr           = 0,
+		.bin_pd_detect_cfg0_addr          = 0,
+		.bin_pd_detect_cfg1_addr          = 0,
+		.bin_pd_detect_cfg2_addr	      = 0,
+		.camif_frame_cfg_addr             = 0x0A38,
+		.epoch_irq_cfg_addr               = 0,
+		.epoch0_subsample_ptrn_addr       = 0,
+		.epoch1_subsample_ptrn_addr       = 0,
+		.debug_rup_aup_status             = 0x0A48,
+		.debug_camif_1_addr               = 0x0A4C,
+		.debug_camif_0_addr               = 0x0A50,
+		.frm_drop_pattern_addr            = 0x0A80,
+		.frm_drop_period_addr             = 0x0A84,
+		.irq_subsample_pattern_addr       = 0x0A88,
+		.irq_subsample_period_addr        = 0x0A8C,
+		.hcrop_addr                       = 0,
+		.vcrop_addr                       = 0,
+		.pix_drop_pattern_addr            = 0,
+		.pix_drop_period_addr             = 0,
+		.line_drop_pattern_addr           = 0,
+		.line_drop_period_addr            = 0,
+		.debug_halt_status_addr           = 0x0A54,
+		.debug_misr_val0_addr             = 0x0A58,
+		.debug_misr_val1_addr             = 0x0A5C,
+		.debug_misr_val2_addr             = 0x0A60,
+		.debug_misr_val3_addr             = 0x0A64,
+		.format_measure_cfg0_addr         = 0x0A90,
+		.format_measure_cfg1_addr         = 0x0A94,
+		.format_measure_cfg2_addr         = 0x0A98,
+		.format_measure0_addr             = 0x0A9C,
+		.format_measure1_addr             = 0x0AA0,
+		.format_measure2_addr             = 0x0AA4,
+		.timestamp_curr0_sof_addr         = 0x0AA8,
+		.timestamp_curr1_sof_addr         = 0x0AAC,
+		.timestamp_perv0_sof_addr         = 0x0AB0,
+		.timestamp_perv1_sof_addr         = 0x0AB4,
+		.timestamp_curr0_eof_addr         = 0x0AB8,
+		.timestamp_curr1_eof_addr         = 0x0ABC,
+		.timestamp_perv0_eof_addr         = 0x0AC0,
+		.timestamp_perv1_eof_addr         = 0x0AC4,
+		.lut_bank_cfg_addr                = 0,
+		.batch_id_cfg0_addr               = 0x0ACC,
+		.batch_id_cfg1_addr               = 0x0AD0,
+		.batch_period_cfg_addr            = 0x0AD4,
+		.batch_stream_id_cfg_addr         = 0x0AD8,
+		.epoch0_cfg_batch_id0_addr        = 0x0ADC,
+		.epoch1_cfg_batch_id0_addr        = 0x0AE0,
+		.epoch0_cfg_batch_id1_addr        = 0x0AE4,
+		.epoch1_cfg_batch_id1_addr        = 0x0AE8,
+		.epoch0_cfg_batch_id2_addr        = 0x0AEC,
+		.epoch1_cfg_batch_id2_addr        = 0x0AF0,
+		.epoch0_cfg_batch_id3_addr        = 0x0AF4,
+		.epoch1_cfg_batch_id3_addr        = 0x0AF8,
+		.epoch0_cfg_batch_id4_addr        = 0x0AFC,
+		.epoch1_cfg_batch_id4_addr        = 0x0B00,
+		.epoch0_cfg_batch_id5_addr        = 0x0B04,
+		.epoch1_cfg_batch_id5_addr        = 0x0B08,
+		.secure_mask_cfg0                 = 0,
+		.path_batch_status                = 0x0B0C,
+		.path_frame_id                    = 0x0B10,
+		.cfg2_addr                        = 0x0B14,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.binning_supported                = 0x7,
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS |
+							CAM_IFE_CSID_CAP_MULTI_CTXT,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.sof_retiming_dis_shift           = 5,
+		.start_mode_shift                 = 2,
+		.start_master_sel_val             = 0,
+		.start_master_sel_shift           = 4,
+		.timestamp_en_shift_val           = 6,
+		.start_master_sel_shift_val       = 4,
+		.fatal_err_mask                   = 0x241c6001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_mask                         = 0x4,
+		.aup_mask                         = 0x4,
+		.rup_aup_set_mask                 = 0x1,
+		.top_irq_mask                     = {0x100,},
+};
+
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_980_ppp_reg_info = {
+		.irq_status_addr                  = 0x0104,
+		.irq_mask_addr                    = 0x0108,
+		.irq_clear_addr                   = 0x010C,
+		.irq_set_addr                     = 0x0110,
+		.cfg0_addr                        = 0x0C00,
+		.ctrl_addr                        = 0x0C04,
+		.debug_clr_cmd_addr               = 0x0C08,
+		.multi_vcdt_cfg0_addr             = 0x0C0C,
+		.cfg1_addr                        = 0x0C10,
+		.bin_cfg0_addr                    = 0x0C14,
+		.pix_store_cfg0_addr              = 0x0C18,
+		.sparse_pd_extractor_cfg_addr     = 0x0C1C,
+		.err_recovery_cfg0_addr           = 0,
+		.err_recovery_cfg1_addr           = 0,
+		.err_recovery_cfg2_addr           = 0,
+		.bin_pd_detect_cfg0_addr          = 0,
+		.bin_pd_detect_cfg1_addr          = 0,
+		.bin_pd_detect_cfg2_addr	      = 0,
+		.camif_frame_cfg_addr             = 0x0C38,
+		.epoch_irq_cfg_addr               = 0x0C3C,
+		.epoch0_subsample_ptrn_addr       = 0x0C40,
+		.epoch1_subsample_ptrn_addr       = 0x0C44,
+		.debug_rup_aup_status             = 0x0C48,
+		.debug_camif_1_addr               = 0x0C4C,
+		.debug_camif_0_addr               = 0x0C50,
+		.frm_drop_pattern_addr            = 0x0C80,
+		.frm_drop_period_addr             = 0x0C84,
+		.irq_subsample_pattern_addr       = 0x0C88,
+		.irq_subsample_period_addr        = 0x0C8C,
+		.hcrop_addr                       = 0x0C68,
+		.vcrop_addr                       = 0x0C6C,
+		.pix_drop_pattern_addr            = 0x0C70,
+		.pix_drop_period_addr             = 0x0C74,
+		.line_drop_pattern_addr           = 0x0C78,
+		.line_drop_period_addr            = 0x0C7C,
+		.debug_halt_status_addr           = 0x0C54,
+		.debug_misr_val0_addr             = 0x0C58,
+		.debug_misr_val1_addr             = 0x0C5C,
+		.debug_misr_val2_addr             = 0x0C60,
+		.debug_misr_val3_addr             = 0x0C64,
+		.format_measure_cfg0_addr         = 0x0C90,
+		.format_measure_cfg1_addr         = 0x0C94,
+		.format_measure_cfg2_addr         = 0x0C98,
+		.format_measure0_addr             = 0x0C9C,
+		.format_measure1_addr             = 0x0CA0,
+		.format_measure2_addr             = 0x0CA4,
+		.timestamp_curr0_sof_addr         = 0x0CA8,
+		.timestamp_curr1_sof_addr         = 0x0CAC,
+		.timestamp_perv0_sof_addr         = 0x0CB0,
+		.timestamp_perv1_sof_addr         = 0x0CB4,
+		.timestamp_curr0_eof_addr         = 0x0CB8,
+		.timestamp_curr1_eof_addr         = 0x0CBC,
+		.timestamp_perv0_eof_addr         = 0x0CC0,
+		.timestamp_perv1_eof_addr         = 0x0CC4,
+		.lut_bank_cfg_addr                = 0x0CC8,
+		.batch_id_cfg0_addr               = 0x0CCC,
+		.batch_id_cfg1_addr               = 0x0CD0,
+		.batch_period_cfg_addr            = 0x0CD4,
+		.batch_stream_id_cfg_addr         = 0x0CD8,
+		.epoch0_cfg_batch_id0_addr        = 0x0CDC,
+		.epoch1_cfg_batch_id0_addr        = 0x0CE0,
+		.epoch0_cfg_batch_id1_addr        = 0x0CE4,
+		.epoch1_cfg_batch_id1_addr        = 0x0CE8,
+		.epoch0_cfg_batch_id2_addr        = 0x0CEC,
+		.epoch1_cfg_batch_id2_addr        = 0x0CF0,
+		.epoch0_cfg_batch_id3_addr        = 0x0CF4,
+		.epoch1_cfg_batch_id3_addr        = 0x0CF8,
+		.epoch0_cfg_batch_id4_addr        = 0x0CFC,
+		.epoch1_cfg_batch_id4_addr        = 0x0D00,
+		.epoch0_cfg_batch_id5_addr        = 0x0D04,
+		.epoch1_cfg_batch_id5_addr        = 0x0D08,
+		.secure_mask_cfg0                 = 0,
+		.path_batch_status                = 0x0D0C,
+		.path_frame_id                    = 0x0D10,
+		.debug_sim_monitor                = 0x0D14,
+
+		/* configurations */
+		.capabilities                     = CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.resume_frame_boundary            = 1,
+		.start_mode_shift                 = 2,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.start_master_sel_val             = 3,
+		.start_master_sel_shift           = 4,
+		.binning_supported                = 0x1,
+		.bin_h_en_shift_val               = 18,
+		.bin_en_shift_val                 = 18,
+		.early_eof_en_shift_val           = 16,
+		.pix_store_en_shift_val           = 0,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 6,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 1,
+		.start_master_sel_shift_val       = 4,
+		.lut_bank_0_sel_val               = 0,
+		.lut_bank_1_sel_val               = 1,
+		.fatal_err_mask                   = 0x241c6001,
+		.non_fatal_err_mask               = 0x12000004,
+		.rup_mask                         = 0x10000,
+		.aup_mask                         = 0x10000,
+		.rup_aup_set_mask                 = 0x1,
+		.top_irq_mask                     = {0x10,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_980_rdi_0_reg_info = {
+		.irq_status_addr                  = 0x0114,
+		.irq_mask_addr                    = 0x0118,
+		.irq_clear_addr                   = 0x011C,
+		.irq_set_addr                     = 0x0120,
+		.cfg0_addr                        = 0x0E00,
+		.ctrl_addr                        = 0x0E04,
+		.debug_clr_cmd_addr               = 0x0E08,
+		.multi_vcdt_cfg0_addr             = 0x0E0C,
+		.cfg1_addr                        = 0x0E10,
+		.pix_store_cfg0_addr              = 0x0E14,
+		.err_recovery_cfg0_addr           = 0,
+		.err_recovery_cfg1_addr           = 0,
+		.err_recovery_cfg2_addr           = 0,
+		.debug_byte_cntr_ping_addr        = 0x0E24,
+		.debug_byte_cntr_pong_addr        = 0x0E28,
+		.camif_frame_cfg_addr             = 0x0E2C,
+		.epoch_irq_cfg_addr               = 0x0E30,
+		.epoch0_subsample_ptrn_addr       = 0x0E34,
+		.epoch1_subsample_ptrn_addr       = 0x0E38,
+		.debug_rup_aup_status             = 0x0E3C,
+		.debug_camif_1_addr               = 0x0E40,
+		.debug_camif_0_addr               = 0x0E44,
+		.frm_drop_pattern_addr            = 0x0E48,
+		.frm_drop_period_addr             = 0x0E4C,
+		.irq_subsample_pattern_addr       = 0x0E50,
+		.irq_subsample_period_addr        = 0x0E54,
+		.hcrop_addr                       = 0x0E58,
+		.vcrop_addr                       = 0x0E5C,
+		.pix_drop_pattern_addr            = 0x0E60,
+		.pix_drop_period_addr             = 0x0E64,
+		.line_drop_pattern_addr           = 0x0E68,
+		.line_drop_period_addr            = 0x0E6C,
+		.debug_halt_status_addr           = 0x0E74,
+		.debug_misr_val0_addr             = 0x0E78,
+		.debug_misr_val1_addr             = 0x0E7C,
+		.debug_misr_val2_addr             = 0x0E80,
+		.debug_misr_val3_addr             = 0x0E84,
+		.format_measure_cfg0_addr         = 0x0E88,
+		.format_measure_cfg1_addr         = 0x0E8C,
+		.format_measure_cfg2_addr         = 0x0E90,
+		.format_measure0_addr             = 0x0E94,
+		.format_measure1_addr             = 0x0E98,
+		.format_measure2_addr             = 0x0E9C,
+		.timestamp_curr0_sof_addr         = 0x0EA0,
+		.timestamp_curr1_sof_addr         = 0x0EA4,
+		.timestamp_perv0_sof_addr         = 0x0EA8,
+		.timestamp_perv1_sof_addr         = 0x0EAC,
+		.timestamp_curr0_eof_addr         = 0x0EB0,
+		.timestamp_curr1_eof_addr         = 0x0EB4,
+		.timestamp_perv0_eof_addr         = 0x0EB8,
+		.timestamp_perv1_eof_addr         = 0x0EBC,
+		.batch_id_cfg0_addr               = 0x0EC0,
+		.batch_id_cfg1_addr               = 0x0EC4,
+		.batch_period_cfg_addr            = 0x0EC8,
+		.batch_stream_id_cfg_addr         = 0x0ECC,
+		.epoch0_cfg_batch_id0_addr        = 0x0ED0,
+		.epoch1_cfg_batch_id0_addr        = 0x0ED4,
+		.epoch0_cfg_batch_id1_addr        = 0x0ED8,
+		.epoch1_cfg_batch_id1_addr        = 0x0EDC,
+		.epoch0_cfg_batch_id2_addr        = 0x0EE0,
+		.epoch1_cfg_batch_id2_addr        = 0x0EE4,
+		.epoch0_cfg_batch_id3_addr        = 0x0EE8,
+		.epoch1_cfg_batch_id3_addr        = 0x0EEC,
+		.epoch0_cfg_batch_id4_addr        = 0x0EF0,
+		.epoch1_cfg_batch_id4_addr        = 0x0EF4,
+		.epoch0_cfg_batch_id5_addr        = 0x0EF8,
+		.epoch1_cfg_batch_id5_addr        = 0x0EFC,
+		.secure_mask_cfg0                 = 0,
+		.path_batch_status                = 0x0F00,
+		.path_frame_id                    = 0x0F04,
+		.cfg2_addr                        = 0x0F08,
+		.debug_sim_monitor                = 0x0F0C,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 7,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x241c6001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_mask                         = 0x100,
+		.aup_mask                         = 0x100,
+		.rup_aup_set_mask                 = 0x1,
+		.top_irq_mask                     = {0x10000,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+		.default_out_format               = CAM_FORMAT_PLAIN16_16,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_980_rdi_1_reg_info = {
+		.irq_status_addr                  = 0x0124,
+		.irq_mask_addr                    = 0x0128,
+		.irq_clear_addr                   = 0x012C,
+		.irq_set_addr                     = 0x0130,
+		.cfg0_addr                        = 0x1000,
+		.ctrl_addr                        = 0x1004,
+		.debug_clr_cmd_addr               = 0x1008,
+		.multi_vcdt_cfg0_addr             = 0x100C,
+		.cfg1_addr                        = 0x1010,
+		.pix_store_cfg0_addr              = 0x1014,
+		.err_recovery_cfg0_addr           = 0,
+		.err_recovery_cfg1_addr           = 0,
+		.err_recovery_cfg2_addr           = 0,
+		.debug_byte_cntr_ping_addr        = 0x1024,
+		.debug_byte_cntr_pong_addr        = 0x1028,
+		.camif_frame_cfg_addr             = 0x102C,
+		.epoch_irq_cfg_addr               = 0x1030,
+		.epoch0_subsample_ptrn_addr       = 0x1034,
+		.epoch1_subsample_ptrn_addr       = 0x1038,
+		.debug_rup_aup_status             = 0x103C,
+		.debug_camif_1_addr               = 0x1040,
+		.debug_camif_0_addr               = 0x1044,
+		.frm_drop_pattern_addr            = 0x1048,
+		.frm_drop_period_addr             = 0x104C,
+		.irq_subsample_pattern_addr       = 0x1050,
+		.irq_subsample_period_addr        = 0x1054,
+		.hcrop_addr                       = 0x1058,
+		.vcrop_addr                       = 0x105C,
+		.pix_drop_pattern_addr            = 0x1060,
+		.pix_drop_period_addr             = 0x1064,
+		.line_drop_pattern_addr           = 0x1068,
+		.line_drop_period_addr            = 0x106C,
+		.debug_halt_status_addr           = 0x1074,
+		.debug_misr_val0_addr             = 0x1078,
+		.debug_misr_val1_addr             = 0x107C,
+		.debug_misr_val2_addr             = 0x1080,
+		.debug_misr_val3_addr             = 0x1084,
+		.format_measure_cfg0_addr         = 0x1088,
+		.format_measure_cfg1_addr         = 0x108C,
+		.format_measure_cfg2_addr         = 0x1090,
+		.format_measure0_addr             = 0x1094,
+		.format_measure1_addr             = 0x1098,
+		.format_measure2_addr             = 0x109C,
+		.timestamp_curr0_sof_addr         = 0x10A0,
+		.timestamp_curr1_sof_addr         = 0x10A4,
+		.timestamp_perv0_sof_addr         = 0x10A8,
+		.timestamp_perv1_sof_addr         = 0x10AC,
+		.timestamp_curr0_eof_addr         = 0x10B0,
+		.timestamp_curr1_eof_addr         = 0x10B4,
+		.timestamp_perv0_eof_addr         = 0x10B8,
+		.timestamp_perv1_eof_addr         = 0x10BC,
+		.batch_id_cfg0_addr               = 0x10C0,
+		.batch_id_cfg1_addr               = 0x10C4,
+		.batch_period_cfg_addr            = 0x10C8,
+		.batch_stream_id_cfg_addr         = 0x10CC,
+		.epoch0_cfg_batch_id0_addr        = 0x10D0,
+		.epoch1_cfg_batch_id0_addr        = 0x10D4,
+		.epoch0_cfg_batch_id1_addr        = 0x10D8,
+		.epoch1_cfg_batch_id1_addr        = 0x10DC,
+		.epoch0_cfg_batch_id2_addr        = 0x10E0,
+		.epoch1_cfg_batch_id2_addr        = 0x10E4,
+		.epoch0_cfg_batch_id3_addr        = 0x10E8,
+		.epoch1_cfg_batch_id3_addr        = 0x10EC,
+		.epoch0_cfg_batch_id4_addr        = 0x10F0,
+		.epoch1_cfg_batch_id4_addr        = 0x10F4,
+		.epoch0_cfg_batch_id5_addr        = 0x10F8,
+		.epoch1_cfg_batch_id5_addr        = 0x10FC,
+		.secure_mask_cfg0                 = 0,
+		.path_batch_status                = 0x1100,
+		.path_frame_id                    = 0x1104,
+		.cfg2_addr                        = 0x1108,
+		.debug_sim_monitor                = 0x110C,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 7,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x241c6001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_mask                         = 0x200,
+		.aup_mask                         = 0x200,
+		.rup_aup_set_mask                 = 0x1,
+		.top_irq_mask                     = {0x20000,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_980_rdi_2_reg_info = {
+		.irq_status_addr                  = 0x0134,
+		.irq_mask_addr                    = 0x0138,
+		.irq_clear_addr                   = 0x013C,
+		.irq_set_addr                     = 0x0140,
+		.cfg0_addr                        = 0x1200,
+		.ctrl_addr                        = 0x1204,
+		.debug_clr_cmd_addr               = 0x1208,
+		.multi_vcdt_cfg0_addr             = 0x120C,
+		.cfg1_addr                        = 0x1210,
+		.pix_store_cfg0_addr              = 0x1214,
+		.err_recovery_cfg0_addr           = 0,
+		.err_recovery_cfg1_addr           = 0,
+		.err_recovery_cfg2_addr           = 0,
+		.debug_byte_cntr_ping_addr        = 0x1224,
+		.debug_byte_cntr_pong_addr        = 0x1228,
+		.camif_frame_cfg_addr             = 0x122C,
+		.epoch_irq_cfg_addr               = 0x1230,
+		.epoch0_subsample_ptrn_addr       = 0x1234,
+		.epoch1_subsample_ptrn_addr       = 0x1238,
+		.debug_rup_aup_status             = 0x123C,
+		.debug_camif_1_addr               = 0x1240,
+		.debug_camif_0_addr               = 0x1244,
+		.frm_drop_pattern_addr            = 0x1248,
+		.frm_drop_period_addr             = 0x124C,
+		.irq_subsample_pattern_addr       = 0x1250,
+		.irq_subsample_period_addr        = 0x1254,
+		.hcrop_addr                       = 0x1258,
+		.vcrop_addr                       = 0x125C,
+		.pix_drop_pattern_addr            = 0x1260,
+		.pix_drop_period_addr             = 0x1264,
+		.line_drop_pattern_addr           = 0x1268,
+		.line_drop_period_addr            = 0x126C,
+		.debug_halt_status_addr           = 0x1274,
+		.debug_misr_val0_addr             = 0x1278,
+		.debug_misr_val1_addr             = 0x127C,
+		.debug_misr_val2_addr             = 0x1280,
+		.debug_misr_val3_addr             = 0x1284,
+		.format_measure_cfg0_addr         = 0x1288,
+		.format_measure_cfg1_addr         = 0x128C,
+		.format_measure_cfg2_addr         = 0x1290,
+		.format_measure0_addr             = 0x1294,
+		.format_measure1_addr             = 0x1298,
+		.format_measure2_addr             = 0x129C,
+		.timestamp_curr0_sof_addr         = 0x12A0,
+		.timestamp_curr1_sof_addr         = 0x12A4,
+		.timestamp_perv0_sof_addr         = 0x12A8,
+		.timestamp_perv1_sof_addr         = 0x12AC,
+		.timestamp_curr0_eof_addr         = 0x12B0,
+		.timestamp_curr1_eof_addr         = 0x12B4,
+		.timestamp_perv0_eof_addr         = 0x12B8,
+		.timestamp_perv1_eof_addr         = 0x12BC,
+		.batch_id_cfg0_addr               = 0x12C0,
+		.batch_id_cfg1_addr               = 0x12C4,
+		.batch_period_cfg_addr            = 0x12C8,
+		.batch_stream_id_cfg_addr         = 0x12CC,
+		.epoch0_cfg_batch_id0_addr        = 0x12D0,
+		.epoch1_cfg_batch_id0_addr        = 0x12D4,
+		.epoch0_cfg_batch_id1_addr        = 0x12D8,
+		.epoch1_cfg_batch_id1_addr        = 0x12DC,
+		.epoch0_cfg_batch_id2_addr        = 0x12E0,
+		.epoch1_cfg_batch_id2_addr        = 0x12E4,
+		.epoch0_cfg_batch_id3_addr        = 0x12E8,
+		.epoch1_cfg_batch_id3_addr        = 0x12EC,
+		.epoch0_cfg_batch_id4_addr        = 0x12F0,
+		.epoch1_cfg_batch_id4_addr        = 0x12F4,
+		.epoch0_cfg_batch_id5_addr        = 0x12F8,
+		.epoch1_cfg_batch_id5_addr        = 0x12FC,
+		.secure_mask_cfg0                 = 0,
+		.path_batch_status                = 0x1300,
+		.path_frame_id                    = 0x1304,
+		.cfg2_addr                        = 0x1308,
+		.debug_sim_monitor                = 0x130C,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 7,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x241c6001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_mask                         = 0x400,
+		.aup_mask                         = 0x400,
+		.rup_aup_set_mask                 = 0x1,
+		.top_irq_mask                     = {0x40000,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_980_rdi_3_reg_info = {
+		.irq_status_addr                  = 0x0144,
+		.irq_mask_addr                    = 0x0148,
+		.irq_clear_addr                   = 0x014C,
+		.irq_set_addr                     = 0x0150,
+		.cfg0_addr                        = 0x1400,
+		.ctrl_addr                        = 0x1404,
+		.debug_clr_cmd_addr               = 0x1408,
+		.multi_vcdt_cfg0_addr             = 0x140C,
+		.cfg1_addr                        = 0x1410,
+		.debug_byte_cntr_ping_addr        = 0x1424,
+		.debug_byte_cntr_pong_addr        = 0x1428,
+		.camif_frame_cfg_addr             = 0x142C,
+		.epoch_irq_cfg_addr               = 0x1430,
+		.epoch0_subsample_ptrn_addr       = 0x1434,
+		.epoch1_subsample_ptrn_addr       = 0x1438,
+		.debug_rup_aup_status             = 0x143C,
+		.debug_camif_1_addr               = 0x1440,
+		.debug_camif_0_addr               = 0x1444,
+		.frm_drop_pattern_addr            = 0x1448,
+		.frm_drop_period_addr             = 0x144C,
+		.irq_subsample_pattern_addr       = 0x1450,
+		.irq_subsample_period_addr        = 0x1454,
+		.hcrop_addr                       = 0x1458,
+		.vcrop_addr                       = 0x145C,
+		.pix_drop_pattern_addr            = 0x1460,
+		.pix_drop_period_addr             = 0x1464,
+		.line_drop_pattern_addr           = 0x1468,
+		.line_drop_period_addr            = 0x146C,
+		.debug_halt_status_addr           = 0x1474,
+		.debug_misr_val0_addr             = 0x1478,
+		.debug_misr_val1_addr             = 0x147C,
+		.debug_misr_val2_addr             = 0x1480,
+		.debug_misr_val3_addr             = 0x1484,
+		.format_measure_cfg0_addr         = 0x1488,
+		.format_measure_cfg1_addr         = 0x148C,
+		.format_measure_cfg2_addr         = 0x1490,
+		.format_measure0_addr             = 0x1494,
+		.format_measure1_addr             = 0x1498,
+		.format_measure2_addr             = 0x149C,
+		.timestamp_curr0_sof_addr         = 0x14A0,
+		.timestamp_curr1_sof_addr         = 0x14A4,
+		.timestamp_perv0_sof_addr         = 0x14A8,
+		.timestamp_perv1_sof_addr         = 0x14AC,
+		.timestamp_curr0_eof_addr         = 0x14B0,
+		.timestamp_curr1_eof_addr         = 0x14B4,
+		.timestamp_perv0_eof_addr         = 0x14B8,
+		.timestamp_perv1_eof_addr         = 0x14BC,
+		.batch_id_cfg0_addr               = 0x14C0,
+		.batch_id_cfg1_addr               = 0x14C4,
+		.batch_period_cfg_addr            = 0x14C8,
+		.batch_stream_id_cfg_addr         = 0x14CC,
+		.epoch0_cfg_batch_id0_addr        = 0x14D0,
+		.epoch1_cfg_batch_id0_addr        = 0x14D4,
+		.epoch0_cfg_batch_id1_addr        = 0x14D8,
+		.epoch1_cfg_batch_id1_addr        = 0x14DC,
+		.epoch0_cfg_batch_id2_addr        = 0x14E0,
+		.epoch1_cfg_batch_id2_addr        = 0x14E4,
+		.epoch0_cfg_batch_id3_addr        = 0x14E8,
+		.epoch1_cfg_batch_id3_addr        = 0x14EC,
+		.epoch0_cfg_batch_id4_addr        = 0x14F0,
+		.epoch1_cfg_batch_id4_addr        = 0x14F4,
+		.epoch0_cfg_batch_id5_addr        = 0x14F8,
+		.epoch1_cfg_batch_id5_addr        = 0x14FC,
+		.secure_mask_cfg0                 = 0,
+		.path_batch_status                = 0x1500,
+		.path_frame_id                    = 0x1504,
+		.cfg2_addr                        = 0x1508,
+		.debug_sim_monitor                = 0x150C,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 7,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x241c6001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_mask                         = 0x800,
+		.aup_mask                         = 0x800,
+		.rup_aup_set_mask                 = 0x1,
+		.top_irq_mask                     = {0x80000,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_980_rdi_4_reg_info = {
+		.irq_status_addr                  = 0x0154,
+		.irq_mask_addr                    = 0x0158,
+		.irq_clear_addr                   = 0x015C,
+		.irq_set_addr                     = 0x0160,
+		.cfg0_addr                        = 0x1600,
+		.ctrl_addr                        = 0x1604,
+		.debug_clr_cmd_addr               = 0x1608,
+		.multi_vcdt_cfg0_addr             = 0x160C,
+		.cfg1_addr                        = 0x1610,
+		.debug_byte_cntr_ping_addr        = 0x1624,
+		.debug_byte_cntr_pong_addr        = 0x1628,
+		.camif_frame_cfg_addr             = 0x162C,
+		.epoch_irq_cfg_addr               = 0x1630,
+		.epoch0_subsample_ptrn_addr       = 0x1634,
+		.epoch1_subsample_ptrn_addr       = 0x1638,
+		.debug_rup_aup_status             = 0x163C,
+		.debug_camif_1_addr               = 0x1640,
+		.debug_camif_0_addr               = 0x1644,
+		.frm_drop_pattern_addr            = 0x1648,
+		.frm_drop_period_addr             = 0x164C,
+		.irq_subsample_pattern_addr       = 0x1650,
+		.irq_subsample_period_addr        = 0x1654,
+		.hcrop_addr                       = 0x1658,
+		.vcrop_addr                       = 0x165C,
+		.pix_drop_pattern_addr            = 0x1660,
+		.pix_drop_period_addr             = 0x1664,
+		.line_drop_pattern_addr           = 0x1668,
+		.line_drop_period_addr            = 0x166C,
+		.debug_halt_status_addr           = 0x1674,
+		.debug_misr_val0_addr             = 0x1678,
+		.debug_misr_val1_addr             = 0x167C,
+		.debug_misr_val2_addr             = 0x1680,
+		.debug_misr_val3_addr             = 0x1684,
+		.format_measure_cfg0_addr         = 0x1688,
+		.format_measure_cfg1_addr         = 0x168C,
+		.format_measure_cfg2_addr         = 0x1690,
+		.format_measure0_addr             = 0x1694,
+		.format_measure1_addr             = 0x1698,
+		.format_measure2_addr             = 0x169C,
+		.timestamp_curr0_sof_addr         = 0x16A0,
+		.timestamp_curr1_sof_addr         = 0x16A4,
+		.timestamp_perv0_sof_addr         = 0x16A8,
+		.timestamp_perv1_sof_addr         = 0x16AC,
+		.timestamp_curr0_eof_addr         = 0x16B0,
+		.timestamp_curr1_eof_addr         = 0x16B4,
+		.timestamp_perv0_eof_addr         = 0x16B8,
+		.timestamp_perv1_eof_addr         = 0x16BC,
+		.batch_id_cfg0_addr               = 0x16C0,
+		.batch_id_cfg1_addr               = 0x16C4,
+		.batch_period_cfg_addr            = 0x16C8,
+		.batch_stream_id_cfg_addr         = 0x16CC,
+		.epoch0_cfg_batch_id0_addr        = 0x16D0,
+		.epoch1_cfg_batch_id0_addr        = 0x16D4,
+		.epoch0_cfg_batch_id1_addr        = 0x16D8,
+		.epoch1_cfg_batch_id1_addr        = 0x16DC,
+		.epoch0_cfg_batch_id2_addr        = 0x16E0,
+		.epoch1_cfg_batch_id2_addr        = 0x16E4,
+		.epoch0_cfg_batch_id3_addr        = 0x16E8,
+		.epoch1_cfg_batch_id3_addr        = 0x16EC,
+		.epoch0_cfg_batch_id4_addr        = 0x16F0,
+		.epoch1_cfg_batch_id4_addr        = 0x16F4,
+		.epoch0_cfg_batch_id5_addr        = 0x16F8,
+		.epoch1_cfg_batch_id5_addr        = 0x16FC,
+		.secure_mask_cfg0                 = 0,
+		.path_batch_status                = 0x1700,
+		.path_frame_id                    = 0x1704,
+		.cfg2_addr                        = 0x1708,
+		.debug_sim_monitor                = 0x170C,
+
+		/* configurations */
+		.resume_frame_boundary            = 1,
+		.overflow_ctrl_en                 = 1,
+		.capabilities                     = CAM_IFE_CSID_CAP_INPUT_LCR |
+							CAM_IFE_CSID_CAP_RDI_UNPACK_MSB |
+							CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI |
+							CAM_IFE_CSID_CAP_SOF_RETIME_DIS,
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_shift                 = 2,
+		.overflow_ctrl_mode_val           = 0x8,
+		.offline_mode_supported           = 1,
+		.mipi_pack_supported              = 1,
+		.packing_fmt_shift_val            = 15,
+		.plain_alignment_shift_val        = 11,
+		.plain_fmt_shift_val              = 12,
+		.crop_v_en_shift_val              = 8,
+		.crop_h_en_shift_val              = 7,
+		.drop_v_en_shift_val              = 6,
+		.drop_h_en_shift_val              = 5,
+		.early_eof_en_shift_val           = 14,
+		.format_measure_en_shift_val      = 4,
+		.timestamp_en_shift_val           = 6,
+		.debug_byte_cntr_rst_shift_val    = 7,
+		.offline_mode_en_shift_val        = 2,
+		.ccif_violation_en                = 1,
+		.fatal_err_mask                   = 0x241c6001,
+		.non_fatal_err_mask               = 0x12000004,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_mask                         = 0x1000,
+		.aup_mask                         = 0x1000,
+		.rup_aup_set_mask                 = 0x1,
+		.top_irq_mask                     = {0x100000,},
+		.epoch0_shift_val                 = 16,
+		.epoch1_shift_val                 = 0,
+		.pix_store_en_shift_val           = 10,
+		.sof_retiming_dis_shift           = 5,
+};
+
+static struct cam_ife_csid_ver2_csi2_rx_reg_info
+	cam_ife_csid_980_csi2_reg_info = {
+		.irq_status_addr                 = {0x00B4, 0x00C4},
+		.irq_mask_addr                   = {0x00B8, 0x00C8},
+		.irq_clear_addr                  = {0x00BC, 0x00CC},
+		.irq_set_addr                    = {0x00C0, 0x00D0},
+		/*CSI2 rx control */
+		.cfg0_addr                       = 0x0400,
+		.cfg1_addr                       = 0x0404,
+		.capture_ctrl_addr               = 0x0408,
+		.rst_strobes_addr                = 0x040C,
+		.cap_unmap_long_pkt_hdr_0_addr   = 0x0410,
+		.cap_unmap_long_pkt_hdr_1_addr   = 0x0414,
+		.captured_short_pkt_0_addr       = 0x0418,
+		.captured_short_pkt_1_addr       = 0x041c,
+		.captured_long_pkt_0_addr        = 0x0420,
+		.captured_long_pkt_1_addr        = 0x0424,
+		.captured_long_pkt_ftr_addr      = 0x0428,
+		.captured_cphy_pkt_hdr_addr      = 0x042c,
+		.lane0_misr_addr                 = 0x0430,
+		.lane1_misr_addr                 = 0x0434,
+		.lane2_misr_addr                 = 0x0438,
+		.lane3_misr_addr                 = 0x043c,
+		.total_pkts_rcvd_addr            = 0x0440,
+		.stats_ecc_addr                  = 0x0444,
+		.total_crc_err_addr              = 0x0448,
+		.de_scramble_type3_cfg0_addr     = 0x044C,
+		.de_scramble_type3_cfg1_addr     = 0x0450,
+		.de_scramble_type2_cfg0_addr     = 0x0454,
+		.de_scramble_type2_cfg1_addr     = 0x0458,
+		.de_scramble_type1_cfg0_addr     = 0x045C,
+		.de_scramble_type1_cfg1_addr     = 0x0460,
+		.de_scramble_type0_cfg0_addr     = 0x0464,
+		.de_scramble_type0_cfg1_addr     = 0x0468,
+
+		.rst_done_shift_val              = 27,
+		.irq_mask_all                    = 0xFFFFFFF,
+		.misr_enable_shift_val           = 6,
+		.vc_mode_shift_val               = 2,
+		.capture_long_pkt_en_shift       = 0,
+		.capture_short_pkt_en_shift      = 1,
+		.capture_cphy_pkt_en_shift       = 2,
+		.capture_long_pkt_dt_shift       = 4,
+		.capture_long_pkt_vc_shift       = 10,
+		.capture_short_pkt_vc_shift      = 15,
+		.capture_cphy_pkt_dt_shift       = 20,
+		.capture_cphy_pkt_vc_shift       = 26,
+		.phy_num_mask                    = 0xf,
+		.vc_mask                         = 0x7C00000,
+		.dt_mask                         = 0x3f0000,
+		.wc_mask                         = 0xffff,
+		.vc_shift                        = 0x16,
+		.dt_shift                        = 0x10,
+		.wc_shift                        = 0,
+		.calc_crc_mask                   = 0xffff0000,
+		.expected_crc_mask               = 0xffff,
+		.calc_crc_shift                  = 0x10,
+		.ecc_correction_shift_en         = 0,
+		.lane_num_shift                  = 0,
+		.lane_cfg_shift                  = 4,
+		.phy_type_shift                  = 24,
+		.phy_num_shift                   = 20,
+		.tpg_mux_en_shift                = 27,
+		.tpg_num_sel_shift               = 28,
+		.phy_bist_shift_en               = 7,
+		.epd_mode_shift_en               = 8,
+		.eotp_shift_en                   = 9,
+		.dyn_sensor_switch_shift_en      = 10,
+		.rup_aup_latch_shift             = 11,
+		.rup_aup_latch_supported         = true,
+		.long_pkt_strobe_rst_shift       = 0,
+		.short_pkt_strobe_rst_shift      = 1,
+		.cphy_pkt_strobe_rst_shift       = 2,
+		.unmapped_pkt_strobe_rst_shift   = 3,
+		.fatal_err_mask                  = {0x38f00000,},
+		.part_fatal_err_mask             = {0xF0000,},
+		.non_fatal_err_mask              = {0x08000000,},
+		.top_irq_mask                    = {0x4,},
+};
+
+static struct cam_ife_csid_ver2_common_reg_info
+			cam_ife_csid_980_cmn_reg_info = {
+	.hw_version_addr                         = 0x0000,
+	.cfg0_addr                               = 0x0004,
+	.global_cmd_addr                         = 0x0008,
+	.reset_cfg_addr                          = 0x000C,
+	.reset_cmd_addr                          = 0x0010,
+	.irq_cmd_addr                            = 0x0014,
+	.rup_cmd_addr                            = 0x0018,
+	.aup_cmd_addr                            = 0x001C,
+	.rup_aup_cmd_addr                        = 0x0020,
+	.offline_cmd_addr                        = 0x0024,
+	.shdr_master_slave_cfg_addr              = 0x0028,
+	.multi_sensor_mode_addr                  = 0x002C,
+	.top_irq_status_addr                     = {0x0084,},
+	.top_irq_mask_addr                       = {0x0088,},
+	.top_irq_clear_addr                      = {0x008C,},
+	.top_irq_set_addr                        = {0x0090,},
+	.buf_done_irq_status_addr                = 0x00A4,
+	.buf_done_irq_mask_addr                  = 0x00A8,
+	.buf_done_irq_clear_addr                 = 0x00AC,
+	.buf_done_irq_set_addr                   = 0x00B0,
+	.test_bus_ctrl                           = 0x03F4,
+	.test_bus_debug                          = 0x03F8,
+	.drv_cfg0_addr                           = 0x0164,
+	.drv_cfg1_addr                           = 0x0168,
+	.drv_cfg2_addr                           = 0x016C,
+	.debug_drv_0_addr                        = 0x0170,
+	.debug_drv_1_addr                        = 0x0174,
+	.debug_sensor_hbi_irq_vcdt_addr          = 0x0180,
+	.debug_violation_addr                    = 0x03D4,
+	.debug_cfg_addr                          = 0x03E0,
+
+	/*configurations */
+	.major_version                           = 6,
+	.minor_version                           = 8,
+	.version_incr                            = 0,
+	.num_rdis                                = 5,
+	.num_pix                                 = 1,
+	.num_ppp                                 = 1,
+	.rst_done_shift_val                      = 1,
+	.path_en_shift_val                       = 31,
+	.dt_id_shift_val                         = 27,
+	.vc_shift_val                            = 22,
+	.vc_mask                                 = 0x1F,
+	.dt_shift_val                            = 16,
+	.dt_mask                                 = 0x3F,
+	.crop_shift_val                          = 16,
+	.decode_format_shift_val                 = 12,
+	.decode_format1_shift_val                = 16,
+	.decode_format1_supported                = true,
+	.decode_format_mask                      = 0xF,
+	.frame_id_decode_en_shift_val            = 1,
+	.multi_vcdt_vc1_shift_val                = 2,
+	.multi_vcdt_dt1_shift_val                = 7,
+	.multi_vcdt_en_shift_val                 = 0,
+	.timestamp_stb_sel_shift_val             = 8,
+	.vfr_en_shift_val                        = 0,
+	.mup_shift_val                           = 4,
+	.shdr_slave_ppp_shift                    = 16,
+	.shdr_slave_rdi2_shift                   = 18,
+	.shdr_slave_rdi1_shift                   = 17,
+	.shdr_master_rdi0_shift                  = 4,
+	.shdr_master_slave_en_shift              = 0,
+	.drv_en_shift                            = 0,
+	.drv_rup_en_shift                        = 0,
+	.early_eof_supported                     = 1,
+	.vfr_supported                           = 1,
+	.multi_vcdt_supported                    = 1,
+	.frame_id_dec_supported                  = 1,
+	.measure_en_hbi_vbi_cnt_mask             = 0xc,
+	.measure_pixel_line_en_mask              = 0x3,
+	.crop_pix_start_mask                     = 0x3fff,
+	.crop_pix_end_mask                       = 0xffff,
+	.crop_line_start_mask                    = 0x3fff,
+	.crop_line_end_mask                      = 0xffff,
+	.drop_supported                          = 1,
+	.ipp_irq_mask_all                        = 0x7FFF,
+	.rdi_irq_mask_all                        = 0x7FFF,
+	.ppp_irq_mask_all                        = 0xFFFF,
+	.top_err_irq_mask                        = {0x00000002,},
+	.rst_loc_path_only_val                   = 0x0,
+	.rst_loc_complete_csid_val               = 0x1,
+	.rst_mode_frame_boundary_val             = 0x0,
+	.rst_mode_immediate_val                  = 0x1,
+	.rst_cmd_hw_reset_complete_val           = 0x1,
+	.rst_cmd_sw_reset_complete_val           = 0x2,
+	.rst_cmd_irq_ctrl_only_val               = 0x4,
+	.timestamp_strobe_val                    = 0x2,
+	.top_reset_irq_mask                      = {0x1,},
+	.rst_location_shift_val                  = 4,
+	.rst_mode_shift_val                      = 0,
+	.epoch_factor                            = 50,
+	.global_reset                            = 1,
+	.rup_supported                           = 1,
+	.only_master_rup                         = 1,
+	.format_measure_height_mask_val          = 0xFFFF,
+	.format_measure_height_shift_val         = 0x10,
+	.format_measure_width_mask_val           = 0xFFFF,
+	.format_measure_width_shift_val          = 0x0,
+	.top_buf_done_irq_mask                   = 0x8,
+	.decode_format_payload_only              = 0xF,
+	.timestamp_enabled_in_cfg0               = true,
+	.camif_irq_support                       = true,
+	.capabilities                            = CAM_IFE_CSID_CAP_SPLIT_RUP_AUP,
+	.drv_rup_en_val_map = {
+		2, /*RDI0 */
+		3, /*RDI1 */
+		4, /*RDI2 */
+		5, /*RDI3 */
+		6, /*RDI4 */
+		0, /*IPP */
+		1, /*PPP */
+		0, /*UDI0 */
+		0, /*UDI1 */
+		0, /*UDI2 */
+	},
+	.drv_path_idle_en_val_map = {
+		BIT(4), /*CAM_ISP_PXL_PATH */
+		BIT(5), /*CAM_ISP_PPP_PATH */
+		0,      /* LCR not applicable */
+		BIT(6), /*CAM_ISP_RDI0_PATH */
+		BIT(7), /*CAM_ISP_RDI1_PATH */
+		BIT(8), /*CAM_ISP_RDI2_PATH */
+		BIT(9), /*CAM_ISP_RDI3_PATH */
+		BIT(10), /*CAM_ISP_RDI4_PATH */
+	},
+};
+
+struct cam_ife_csid_ver2_mc_reg_info
+	cam_ife_csid_980_ipp_mc_reg_info = {
+	.irq_comp_cfg0_addr                = 0x0178,
+	.ipp_src_ctxt_mask_shift           = 4,
+	.ipp_dst_ctxt_mask_shift           = 0,
+	.comp_rup_mask                     = 0x4000000,
+	.comp_epoch0_mask                  = 0x8000000,
+	.comp_eof_mask                     = 0x20000000,
+	.comp_sof_mask                     = 0x40000000,
+	.comp_subgrp0_mask                 = 0x1000000,
+	.comp_subgrp2_mask                 = 0x2000000,
+};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_980_reg_info = {
+	.top_irq_reg_info      = cam_ife_csid_980_top_irq_reg_info,
+	.rx_irq_reg_info       = cam_ife_csid_980_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		&cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_4],
+		&cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		&cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_PPP],
+		NULL,
+		NULL,
+		NULL,
+		&cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP_1],
+		&cam_ife_csid_980_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP_2],
+	},
+	.buf_done_irq_reg_info = &cam_ife_csid_980_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_980_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_980_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_980_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP_1] = &cam_ife_csid_980_ipp_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP_2] = &cam_ife_csid_980_ipp_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = &cam_ife_csid_980_ppp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_980_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_980_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_980_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_980_rdi_3_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_4] = &cam_ife_csid_980_rdi_4_reg_info,
+	.ipp_mc_reg                           = &cam_ife_csid_980_ipp_mc_reg_info,
+	.need_top_cfg = 0x0,
+	.top_irq_desc        = &cam_ife_csid_980_top_irq_desc,
+	.rx_irq_desc         = &cam_ife_csid_980_rx_irq_desc,
+	.path_irq_desc       = cam_ife_csid_980_path_irq_desc,
+	.num_top_err_irqs    = cam_ife_csid_980_num_top_irq_desc,
+	.num_rx_err_irqs     = cam_ife_csid_980_num_rx_irq_desc,
+	.num_path_err_irqs   = ARRAY_SIZE(cam_ife_csid_980_path_irq_desc),
+	.num_top_regs        = 1,
+	.num_rx_regs         = 1,
+};
+#endif /*_CAM_IFE_CSID_980_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_common.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_common.c
@@ -0,0 +1,707 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+#include <media/cam_defs.h>
+
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_hw.h"
+#include "cam_cdm_util.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_ife_csid_soc.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_cdm_intf_api.h"
+
+/* factor to conver qtime to boottime */
+int64_t qtime_to_boottime;
+
+const uint8_t *cam_ife_csid_irq_reg_tag[CAM_IFE_CSID_IRQ_REG_MAX] = {
+	"TOP",
+	"RX",
+	"RDI0",
+	"RDI1",
+	"RDI2",
+	"RDI3",
+	"RDI4",
+	"RDI5",
+	"IPP",
+	"PPP",
+	"UDI0",
+	"UDI1",
+	"UDI2",
+};
+
+static int cam_ife_csid_get_cid(struct cam_ife_csid_cid_data *cid_data,
+	struct cam_csid_hw_reserve_resource_args  *reserve)
+{
+	uint32_t  i;
+
+	/*currently only signal vc/dt is supported with per-port en */
+	if (reserve->in_port->per_port_en && reserve->per_port_acquire) {
+		if (cid_data->cid_cnt == 0) {
+			cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc = reserve->vc;
+			cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt = reserve->dt;
+			cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].valid = true;
+			cid_data->num_vc_dt = 1;
+			return 0;
+		}
+		if ((cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc == reserve->vc) &&
+			(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt == reserve->dt)) {
+			return 0;
+		}
+		return -EINVAL;
+	}
+
+	if (cid_data->cid_cnt == 0) {
+		for (i = 0; i < reserve->in_port->num_valid_vc_dt; i++) {
+			cid_data->vc_dt[i].vc = reserve->in_port->vc[i];
+			cid_data->vc_dt[i].dt = reserve->in_port->dt[i];
+			cid_data->vc_dt[i].valid = true;
+		}
+
+		cid_data->num_vc_dt = reserve->in_port->num_valid_vc_dt;
+		return 0;
+	}
+
+	for (i = 0; i < reserve->in_port->num_valid_vc_dt; i++) {
+		if (cid_data->vc_dt[i].vc == reserve->in_port->vc[i] &&
+			cid_data->vc_dt[i].dt == reserve->in_port->dt[i])
+			return 0;
+	}
+
+	return -EINVAL;
+}
+
+int cam_ife_csid_is_pix_res_format_supported(
+	uint32_t in_format)
+{
+	int rc = -EINVAL;
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_MIPI_RAW_20:
+	case CAM_FORMAT_DPCM_10_6_10:
+	case CAM_FORMAT_DPCM_10_8_10:
+	case CAM_FORMAT_DPCM_12_6_12:
+	case CAM_FORMAT_DPCM_12_8_12:
+	case CAM_FORMAT_DPCM_14_8_14:
+	case CAM_FORMAT_DPCM_14_10_14:
+	case CAM_FORMAT_DPCM_12_10_12:
+	case CAM_FORMAT_YUV422:
+	case CAM_FORMAT_YUV422_10:
+		rc = 0;
+		break;
+	default:
+		break;
+	}
+	return rc;
+}
+
+static int cam_ife_csid_validate_rdi_format(uint32_t in_format,
+	uint32_t out_format)
+{
+	int rc = 0;
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_6:
+		case CAM_FORMAT_PLAIN8:
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_PLAIN128:
+		case CAM_FORMAT_PLAIN8:
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_MIPI_RAW_14:
+		case CAM_FORMAT_PLAIN128:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_16:
+		case CAM_FORMAT_PLAIN16_16:
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_20:
+		case CAM_FORMAT_PLAIN32_20:
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_YUV422:
+		switch (out_format) {
+		case CAM_FORMAT_YUV422:
+		case CAM_FORMAT_PLAIN128:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_16:
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_YUV422_10:
+		switch (out_format) {
+		case CAM_FORMAT_YUV422_10:
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	default:
+		rc = -EINVAL;
+		break;
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Unsupported format pair in %d out %d",
+			in_format, out_format);
+	return rc;
+}
+
+int cam_ife_csid_get_format_rdi(
+	uint32_t in_format, uint32_t out_format,
+	struct cam_ife_csid_path_format *path_format, bool mipi_pack_supported,
+	bool mipi_unpacked)
+{
+	int rc = 0;
+
+	rc = cam_ife_csid_validate_rdi_format(in_format, out_format);
+	if (rc)
+		goto err;
+
+	memset(path_format, 0, sizeof(*path_format));
+	/* if no packing supported and input is same as output dump the raw payload */
+	if (!mipi_pack_supported && (in_format == out_format)) {
+		path_format->decode_fmt = 0xf;
+		goto end;
+	}
+
+	/* Configure the incoming stream format types */
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		path_format->decode_fmt = 0x0;
+		path_format->bits_per_pxl = 6;
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_YUV422:
+		path_format->decode_fmt = 0x1;
+		path_format->bits_per_pxl = 8;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_YUV422_10:
+		path_format->decode_fmt = 0x2;
+		path_format->bits_per_pxl = 10;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		path_format->decode_fmt = 0x3;
+		path_format->bits_per_pxl = 12;
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		path_format->decode_fmt = 0x4;
+		path_format->bits_per_pxl = 14;
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		path_format->decode_fmt = 0x5;
+		path_format->bits_per_pxl = 16;
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		path_format->decode_fmt = 0x6;
+		path_format->bits_per_pxl = 20;
+		break;
+	default:
+		rc = -EINVAL;
+		goto err;
+	}
+
+	/* Configure the out stream format types */
+	switch (out_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_YUV422:
+	case CAM_FORMAT_PLAIN128:
+		if (mipi_unpacked)
+			path_format->plain_fmt = 0x0;
+		else
+			path_format->packing_fmt = 0x1;
+		break;
+	case CAM_FORMAT_PLAIN8:
+		path_format->plain_fmt = 0x0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_YUV422_10:
+		if (mipi_unpacked)
+			path_format->plain_fmt = 0x1;
+		else
+			path_format->packing_fmt = 0x1;
+		break;
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_12:
+	case CAM_FORMAT_PLAIN16_14:
+	case CAM_FORMAT_PLAIN16_16:
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		if (mipi_unpacked)
+			path_format->plain_fmt = 0x2;
+		else
+			path_format->packing_fmt = 0x1;
+		break;
+	case CAM_FORMAT_PLAIN32_20:
+		path_format->plain_fmt = 0x2;
+		break;
+	default:
+		rc = -EINVAL;
+		goto err;
+	}
+
+end:
+	CAM_DBG(CAM_ISP,
+		"in %u out %u plain_fmt %u packing %u decode %u bpp %u unpack %u pack supported %u",
+		in_format, out_format, path_format->plain_fmt, path_format->packing_fmt,
+		path_format->decode_fmt, path_format->bits_per_pxl, mipi_unpacked,
+		mipi_pack_supported);
+	return rc;
+
+err:
+	CAM_ERR(CAM_ISP, "Unsupported format pair in %d out %d",
+		in_format, out_format);
+	return rc;
+}
+
+int cam_ife_csid_get_format_ipp_ppp(
+	uint32_t in_format,
+	struct cam_ife_csid_path_format *path_format)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "input format:%d",
+		 in_format);
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		path_format->decode_fmt  = 0;
+		path_format->plain_fmt = 0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		path_format->decode_fmt  = 0x1;
+		path_format->plain_fmt = 0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		path_format->decode_fmt  = 0x2;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		path_format->decode_fmt  = 0x3;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		path_format->decode_fmt  = 0x4;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		path_format->decode_fmt  = 0x5;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		path_format->decode_fmt  = 0x6;
+		path_format->plain_fmt = 0x2;
+		break;
+	case CAM_FORMAT_DPCM_10_6_10:
+		path_format->decode_fmt  = 0x7;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_10_8_10:
+		path_format->decode_fmt  = 0x8;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_12_6_12:
+		path_format->decode_fmt  = 0x9;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_12_8_12:
+		path_format->decode_fmt  = 0xA;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_14_8_14:
+		path_format->decode_fmt  = 0xB;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_14_10_14:
+		path_format->decode_fmt  = 0xC;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_12_10_12:
+		path_format->decode_fmt  = 0xD;
+		path_format->plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_YUV422:
+		path_format->decode_fmt  = 0x1;
+		path_format->plain_fmt = 0x0;
+		break;
+	case CAM_FORMAT_YUV422_10:
+		path_format->decode_fmt  = 0x2;
+		path_format->plain_fmt = 0x0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported format %d",
+			in_format);
+		rc = -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "decode_fmt:%d plain_fmt:%d",
+		 path_format->decode_fmt,
+		 path_format->plain_fmt);
+
+	return rc;
+}
+
+int cam_ife_csid_hw_probe_init(struct cam_hw_intf *hw_intf,
+	struct cam_ife_csid_core_info *core_info, bool is_custom)
+{
+
+	int rc = -EINVAL;
+
+	if (core_info->sw_version == CAM_IFE_CSID_VER_1_0) {
+		rc = cam_ife_csid_hw_ver1_init(hw_intf,
+			core_info, is_custom);
+	} else if (core_info->sw_version == CAM_IFE_CSID_VER_2_0) {
+		rc = cam_ife_csid_hw_ver2_init(hw_intf,
+			core_info, is_custom);
+	}
+
+	return rc;
+}
+
+int cam_ife_csid_hw_deinit(struct cam_hw_intf *hw_intf,
+	struct cam_ife_csid_core_info *core_info)
+{
+	int rc = -EINVAL;
+
+	if (core_info->sw_version == CAM_IFE_CSID_VER_1_0)
+		rc = cam_ife_csid_hw_ver1_deinit(hw_intf->hw_priv);
+	else if (core_info->sw_version == CAM_IFE_CSID_VER_2_0)
+		rc = cam_ife_csid_hw_ver2_deinit(
+			hw_intf->hw_priv);
+
+	return rc;
+}
+
+int cam_ife_csid_is_vc_full_width(struct cam_ife_csid_cid_data *cid_data)
+{
+	int i, j;
+	int rc = 0;
+	struct cam_ife_csid_cid_data *p_cid;
+
+	for (i = 0; i < CAM_IFE_CSID_CID_MAX; i++) {
+		p_cid = &cid_data[i];
+
+		if (!p_cid->cid_cnt)
+			continue;
+
+		if (p_cid->num_vc_dt > CAM_IFE_CSID_MULTI_VC_DT_GRP_MAX) {
+			CAM_ERR(CAM_ISP, "Invalid num_vc_dt:%d cid: %d",
+				p_cid->num_vc_dt, i);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		for (j = 0; j < p_cid->num_vc_dt; j++) {
+			if (p_cid->vc_dt[j].valid &&
+				p_cid->vc_dt[j].vc > 3) {
+				rc = 1;
+				goto end;
+			}
+		}
+	}
+
+end:
+	return rc;
+}
+
+int cam_ife_csid_cid_reserve(struct cam_ife_csid_cid_data *cid_data,
+	uint32_t *cid_value,
+	uint32_t hw_idx,
+	struct cam_csid_hw_reserve_resource_args  *reserve)
+{
+	int i, j, rc = 0;
+
+	for (i = 0; i < CAM_IFE_CSID_CID_MAX; i++) {
+		rc = cam_ife_csid_get_cid(&cid_data[i], reserve);
+		if (!rc)
+			break;
+	}
+
+	if (i == CAM_IFE_CSID_CID_MAX) {
+		for (j = 0; j < reserve->in_port->num_valid_vc_dt; j++)
+			CAM_ERR(CAM_ISP,
+				"CSID[%d] reserve fail vc[%d] dt[%d]",
+				hw_idx, reserve->in_port->vc[j],
+				reserve->in_port->dt[j]);
+
+		return -EINVAL;
+	}
+
+	cid_data[i].cid_cnt++;
+	*cid_value = i;
+
+	for (j = 0; j < cid_data->num_vc_dt; j++) {
+		CAM_DBG(CAM_ISP,
+			"CSID[%d] cid_value:%d cid_cnt:%d num_vc_dt:%d vc:%d dt:%d per_port_acquire:%d",
+			hw_idx, *cid_value, cid_data[i].cid_cnt, cid_data->num_vc_dt,
+			cid_data->vc_dt[j].vc, cid_data->vc_dt[j].dt,
+			reserve->per_port_acquire);
+	}
+
+	return 0;
+}
+
+int cam_ife_csid_cid_release(
+	struct cam_ife_csid_cid_data *cid_data,
+	uint32_t hw_idx,
+	uint32_t cid)
+{
+	int i;
+
+	if (!cid_data->cid_cnt) {
+		CAM_WARN(CAM_ISP, "CSID[%d] unbalanced cid:%d release",
+			hw_idx, cid);
+		return 0;
+	}
+
+	cid_data->cid_cnt--;
+
+	if (cid_data->cid_cnt == 0) {
+
+		for (i = 0; i < cid_data->num_vc_dt; i++)
+			cid_data->vc_dt[i].valid = false;
+
+		cid_data->num_vc_dt = 0;
+	}
+
+	return 0;
+}
+
+int cam_ife_csid_check_in_port_args(
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	uint32_t hw_idx)
+{
+
+	if (reserve->in_port->res_type >= CAM_ISP_IFE_IN_RES_MAX) {
+
+		CAM_ERR(CAM_ISP, "CSID:%d  Invalid phy sel %d",
+			hw_idx, reserve->in_port->res_type);
+		return -EINVAL;
+	}
+
+	if (reserve->in_port->lane_type >= CAM_ISP_LANE_TYPE_MAX &&
+		reserve->in_port->res_type != CAM_ISP_IFE_IN_RES_TPG) {
+
+		CAM_ERR(CAM_ISP, "CSID:%d  Invalid lane type %d",
+			hw_idx, reserve->in_port->lane_type);
+		return -EINVAL;
+	}
+
+	if ((reserve->in_port->lane_type ==  CAM_ISP_LANE_TYPE_DPHY &&
+		reserve->in_port->lane_num > 4) &&
+		reserve->in_port->res_type != CAM_ISP_IFE_IN_RES_TPG) {
+
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid lane num %d",
+			hw_idx, reserve->in_port->lane_num);
+		return -EINVAL;
+	}
+
+	if ((reserve->in_port->lane_type == CAM_ISP_LANE_TYPE_CPHY &&
+		reserve->in_port->lane_num > 3) &&
+		reserve->in_port->res_type != CAM_ISP_IFE_IN_RES_TPG) {
+
+		CAM_ERR(CAM_ISP, " CSID:%d Invalid lane type %d & num %d",
+			hw_idx,
+			reserve->in_port->lane_type,
+			reserve->in_port->lane_num);
+		return -EINVAL;
+	}
+
+	if ((reserve->res_id ==  CAM_IFE_PIX_PATH_RES_IPP ||
+		reserve->res_id == CAM_IFE_PIX_PATH_RES_PPP) &&
+		(cam_ife_csid_is_pix_res_format_supported(
+			reserve->in_port->format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0]))) {
+		CAM_ERR(CAM_ISP, "CSID %d, res_id %d, unsupported format %d",
+			hw_idx,
+			reserve->res_id,
+			reserve->in_port->format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0]);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_ife_csid_convert_res_to_irq_reg(uint32_t res_id)
+{
+	switch (res_id) {
+
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+		return CAM_IFE_CSID_IRQ_REG_RDI_0;
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+		return CAM_IFE_CSID_IRQ_REG_RDI_1;
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+		return CAM_IFE_CSID_IRQ_REG_RDI_2;
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+		return CAM_IFE_CSID_IRQ_REG_RDI_3;
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+		return CAM_IFE_CSID_IRQ_REG_RDI_4;
+	case CAM_IFE_PIX_PATH_RES_RDI_5:
+		return CAM_IFE_CSID_IRQ_REG_RDI_5;
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		return CAM_IFE_CSID_IRQ_REG_IPP;
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		return CAM_IFE_CSID_IRQ_REG_PPP;
+	case CAM_IFE_PIX_PATH_RES_UDI_0:
+		return CAM_IFE_CSID_IRQ_REG_UDI_0;
+	case CAM_IFE_PIX_PATH_RES_UDI_1:
+		return CAM_IFE_CSID_IRQ_REG_UDI_1;
+	case CAM_IFE_PIX_PATH_RES_UDI_2:
+		return CAM_IFE_CSID_IRQ_REG_UDI_2;
+	default:
+		return CAM_IFE_CSID_IRQ_REG_MAX;
+	}
+}
+
+const char *cam_ife_csid_reset_type_to_string(enum cam_ife_csid_reset_type reset_type)
+{
+	switch (reset_type) {
+	case CAM_IFE_CSID_RESET_GLOBAL: return "global";
+	case CAM_IFE_CSID_RESET_PATH: return "path";
+	default: return "invalid";
+	}
+}
+
+int cam_ife_csid_get_base(struct cam_hw_soc_info *soc_info,
+	uint32_t base_id, void *cmd_args, size_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	size_t                           size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_csid_soc_private      *soc_private;
+
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error, Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !soc_info) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "soc_private is null");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(soc_info, base_id);
+	if (mem_base == -1) {
+		CAM_ERR(CAM_ISP, "failed to get mem_base, index: %d num_reg_map: %u",
+				base_id, soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	if (cdm_args->cdm_id == CAM_CDM_RT) {
+		if (!soc_private->rt_wrapper_base) {
+			CAM_ERR(CAM_ISP, "rt_wrapper_base_addr is null");
+			return -EINVAL;
+		}
+
+		mem_base -= soc_private->rt_wrapper_base;
+	}
+
+	CAM_DBG(CAM_ISP, "core %d mem_base 0x%x, cdm_id:%u",
+		soc_info->index, mem_base, cdm_args->cdm_id);
+
+	cdm_util_ops->cdm_write_changebase(cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+const uint8_t **cam_ife_csid_get_irq_reg_tag_ptr(void)
+{
+	return cam_ife_csid_irq_reg_tag;
+}
+
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_common.h
@@ -0,0 +1,457 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_COMMON_H_
+#define _CAM_IFE_CSID_COMMON_H_
+
+#include "cam_hw.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_ife_csid_soc.h"
+
+#define CAM_IFE_CSID_VER_1_0  0x100
+#define CAM_IFE_CSID_VER_2_0  0x200
+#define CAM_IFE_CSID_MAX_ERR_COUNT  100
+
+#define CAM_IFE_CSID_HW_CAP_IPP                           0x1
+#define CAM_IFE_CSID_HW_CAP_RDI                           0x2
+#define CAM_IFE_CSID_HW_CAP_PPP                           0x4
+#define CAM_IFE_CSID_HW_CAP_TOP                           0x8
+
+#define CAM_IFE_CSID_TPG_ENCODE_RAW8                      0x1
+#define CAM_IFE_CSID_TPG_ENCODE_RAW10                     0x2
+#define CAM_IFE_CSID_TPG_ENCODE_RAW12                     0x3
+#define CAM_IFE_CSID_TPG_ENCODE_RAW14                     0x4
+#define CAM_IFE_CSID_TPG_ENCODE_RAW16                     0x5
+
+#define CAM_IFE_CSID_TPG_TEST_PATTERN_YUV                 0x4
+
+#define CAM_IFE_CSID_HW_IDX_0                             0x1
+#define CAM_IFE_CSID_HW_IDX_1                             0x2
+#define CAM_IFE_CSID_HW_IDX_2                             0x4
+
+#define CAM_IFE_CSID_LOG_BUF_LEN                          512
+
+#define CAM_IFE_CSID_CAP_INPUT_LCR                        BIT(0)
+#define CAM_IFE_CSID_CAP_RDI_UNPACK_MSB                   BIT(1)
+#define CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI            BIT(2)
+#define CAM_IFE_CSID_CAP_SOF_RETIME_DIS                   BIT(3)
+#define CAM_IFE_CSID_CAP_SPLIT_RUP_AUP                    BIT(4)
+#define CAM_IFE_CSID_CAP_SKIP_PATH_CFG1                   BIT(5)
+#define CAM_IFE_CSID_CAP_SKIP_EPOCH_CFG                   BIT(6)
+#define CAM_IFE_CSID_CAP_MULTI_CTXT                       BIT(7)
+#define CAM_IFE_CSID_CAP_YUV_CHROMA_CONVERSION            BIT(8)
+
+/*
+ * CSID RX debug vc-dt capture
+ */
+#define CAM_IFE_CSID_DEBUGFS_RST_STROBE_MASK              0xF
+#define CAM_IFE_CSID_DEBUGFS_VC_DT_MASK                   0xFF
+#define CAM_IFE_CSID_DEBUGFS_VC_SHIFT_MASK                0x4
+#define CAM_IFE_CSID_DEBUGFS_DT_SHIFT_MASK                0xC
+
+/*
+ * Debug values enable the corresponding interrupts and debug logs provide
+ * necessary information
+ */
+#define CAM_IFE_CSID_DEBUG_ENABLE_SOF_IRQ                 BIT(0)
+#define CAM_IFE_CSID_DEBUG_ENABLE_EOF_IRQ                 BIT(1)
+#define CAM_IFE_CSID_DEBUG_ENABLE_SOT_IRQ                 BIT(2)
+#define CAM_IFE_CSID_DEBUG_ENABLE_EOT_IRQ                 BIT(3)
+#define CAM_IFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE       BIT(4)
+#define CAM_IFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE        BIT(5)
+#define CAM_IFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE        BIT(6)
+#define CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO            BIT(7)
+#define CAM_IFE_CSID_DEBUG_DISABLE_EARLY_EOF              BIT(8)
+#define CAM_IFE_DEBUG_ENABLE_UNMAPPED_VC_DT_IRQ           BIT(9)
+#define CAM_IFE_CSID_DEBUG_ENABLE_VOTE_UP_IRQ             BIT(10)
+#define CAM_IFE_CSID_DEBUG_ENABLE_VOTE_DN_IRQ             BIT(11)
+#define CAM_IFE_CSID_DEBUG_ENABLE_ERR_NO_VOTE_DN_IRQ      BIT(12)
+
+/* Binning supported masks. Binning support changes for specific paths
+ * and also for targets. With the mask, we handle the supported features
+ * in reg files and handle in code accordingly.
+ */
+
+#define CAM_IFE_CSID_BIN_HORIZONTAL                       BIT(0)
+#define CAM_IFE_CSID_BIN_QCFA                             BIT(1)
+#define CAM_IFE_CSID_BIN_VERTICAL                         BIT(2)
+
+#define CAM_IFE_CSID_WIDTH_FUSE_VAL_MAX			  4
+
+#define CAM_IFE_CSID_RUP_AUP_SET_VAL                      BIT(0)
+
+/* factor to conver qtime to boottime */
+extern int64_t qtime_to_boottime;
+
+/* enum for multiple mem base in some of the targets */
+enum cam_ife_csid_mem_base_id {
+	CAM_IFE_CSID_CLC_MEM_BASE_ID,
+	CAM_IFE_CSID_TOP_MEM_BASE_ID,
+};
+
+/* enum cam_ife_csid_path_multi_vc_dt_grp: for multi vc dt suppot */
+enum cam_ife_csid_path_multi_vc_dt_grp {
+	CAM_IFE_CSID_MULTI_VC_DT_GRP_0,
+	CAM_IFE_CSID_MULTI_VC_DT_GRP_1,
+	CAM_IFE_CSID_MULTI_VC_DT_GRP_MAX,
+};
+
+/**
+ * enum cam_ife_csid_irq_reg - Specify the csid irq reg
+ */
+enum cam_ife_csid_irq_reg {
+	CAM_IFE_CSID_IRQ_REG_TOP,
+	CAM_IFE_CSID_IRQ_REG_RX,
+	CAM_IFE_CSID_IRQ_REG_RDI_0,
+	CAM_IFE_CSID_IRQ_REG_RDI_1,
+	CAM_IFE_CSID_IRQ_REG_RDI_2,
+	CAM_IFE_CSID_IRQ_REG_RDI_3,
+	CAM_IFE_CSID_IRQ_REG_RDI_4,
+	CAM_IFE_CSID_IRQ_REG_RDI_5,
+	CAM_IFE_CSID_IRQ_REG_IPP,
+	CAM_IFE_CSID_IRQ_REG_PPP,
+	CAM_IFE_CSID_IRQ_REG_UDI_0,
+	CAM_IFE_CSID_IRQ_REG_UDI_1,
+	CAM_IFE_CSID_IRQ_REG_UDI_2,
+	CAM_IFE_CSID_IRQ_REG_TOP_2,
+	CAM_IFE_CSID_IRQ_REG_RX_2,
+	CAM_IFE_CSID_IRQ_REG_IPP_1,
+	CAM_IFE_CSID_IRQ_REG_IPP_2,
+	CAM_IFE_CSID_IRQ_REG_MAX,
+};
+
+/*
+ * struct cam_ife_csid_irq_desc: Structure to hold IRQ description
+ *
+ * @bitmask    :     Bitmask of the IRQ
+ * @err_type   :     Error type for ISP hardware event
+ * @irq_desc   :     String to describe the IRQ bit
+ * @err_handler:     Error handler which gets invoked if error IRQ bit set
+ */
+struct cam_ife_csid_irq_desc {
+	uint32_t    bitmask;
+	uint32_t    err_type;
+	uint8_t    *desc;
+	void       (*err_handler)(void *csid_hw, void *res);
+};
+
+/*
+ * struct cam_ife_csid_top_irq_desc: Structure to hold IRQ bitmask and description
+ *
+ * @bitmask    :        Bitmask of the IRQ
+ * @err_type   :        Error type for ISP hardware event
+ * @err_name   :        IRQ name
+ * @desc       :        String to describe about the IRQ
+ * @err_handler:        Error handler which gets invoked if error IRQ bit set
+ */
+struct cam_ife_csid_top_irq_desc {
+	uint32_t    bitmask;
+	uint32_t    err_type;
+	char       *err_name;
+	char       *desc;
+	void       (*err_handler)(void *csid_hw);
+};
+
+/*
+ * struct cam_ife_csid_vc_dt: Structure to hold vc dt combination
+ *
+ * @vc:              Virtual channel number
+ * @dt:              Data type of incoming data
+ * @valid:           flag to indicate if combimation is valid
+ */
+
+struct cam_ife_csid_vc_dt {
+	uint32_t vc;
+	uint32_t dt;
+	bool valid;
+};
+
+/*
+ * struct cam_ife_csid_path_format: Structure format info
+ *
+ * @decode_fmt:       Decode format
+ * @packing_fmt:      Packing format
+ * @plain_fmt:        Plain format
+ * @bits_per_pixel:   Bits per pixel
+ */
+struct cam_ife_csid_path_format {
+	uint32_t decode_fmt;
+	uint32_t packing_fmt;
+	uint32_t plain_fmt;
+	uint32_t bits_per_pxl;
+};
+
+/*
+ * struct cam_ife_csid_csi2_rx_reg_info: Structure to hold Rx reg offset
+ * holds register address offsets
+ * shift values
+ * masks
+ */
+struct cam_ife_csid_csi2_rx_reg_info {
+	uint32_t irq_status_addr;
+	uint32_t irq_mask_addr;
+	uint32_t irq_clear_addr;
+	uint32_t irq_set_addr;
+	uint32_t cfg0_addr;
+	uint32_t cfg1_addr;
+	uint32_t capture_ctrl_addr;
+	uint32_t rst_strobes_addr;
+	uint32_t de_scramble_cfg0_addr;
+	uint32_t de_scramble_cfg1_addr;
+	uint32_t cap_unmap_long_pkt_hdr_0_addr;
+	uint32_t cap_unmap_long_pkt_hdr_1_addr;
+	uint32_t captured_short_pkt_0_addr;
+	uint32_t captured_short_pkt_1_addr;
+	uint32_t captured_long_pkt_0_addr;
+	uint32_t captured_long_pkt_1_addr;
+	uint32_t captured_long_pkt_ftr_addr;
+	uint32_t captured_cphy_pkt_hdr_addr;
+	uint32_t lane0_misr_addr;
+	uint32_t lane1_misr_addr;
+	uint32_t lane2_misr_addr;
+	uint32_t lane3_misr_addr;
+	uint32_t total_pkts_rcvd_addr;
+	uint32_t stats_ecc_addr;
+	uint32_t total_crc_err_addr;
+	uint32_t de_scramble_type3_cfg0_addr;
+	uint32_t de_scramble_type3_cfg1_addr;
+	uint32_t de_scramble_type2_cfg0_addr;
+	uint32_t de_scramble_type2_cfg1_addr;
+	uint32_t de_scramble_type1_cfg0_addr;
+	uint32_t de_scramble_type1_cfg1_addr;
+	uint32_t de_scramble_type0_cfg0_addr;
+	uint32_t de_scramble_type0_cfg1_addr;
+
+	/*configurations */
+	uint32_t rst_srb_all;
+	uint32_t rst_done_shift_val;
+	uint32_t irq_mask_all;
+	uint32_t misr_enable_shift_val;
+	uint32_t vc_mode_shift_val;
+	uint32_t capture_long_pkt_en_shift;
+	uint32_t capture_short_pkt_en_shift;
+	uint32_t capture_cphy_pkt_en_shift;
+	uint32_t capture_long_pkt_dt_shift;
+	uint32_t capture_long_pkt_vc_shift;
+	uint32_t capture_short_pkt_vc_shift;
+	uint32_t capture_cphy_pkt_dt_shift;
+	uint32_t capture_cphy_pkt_vc_shift;
+	uint32_t ecc_correction_shift_en;
+	uint32_t phy_bist_shift_en;
+	uint32_t epd_mode_shift_en;
+	uint32_t eotp_shift_en;
+	uint32_t dyn_sensor_switch_shift_en;
+	uint32_t rup_aup_latch_shift;
+	bool     rup_aup_latch_supported;
+	uint32_t phy_num_mask;
+	uint32_t vc_mask;
+	uint32_t wc_mask;
+	uint32_t dt_mask;
+	uint32_t vc_shift;
+	uint32_t dt_shift;
+	uint32_t wc_shift;
+	uint32_t calc_crc_mask;
+	uint32_t expected_crc_mask;
+	uint32_t calc_crc_shift;
+	uint32_t lane_num_shift;
+	uint32_t lane_cfg_shift;
+	uint32_t phy_type_shift;
+	uint32_t phy_num_shift;
+	uint32_t tpg_mux_en_shift;
+	uint32_t tpg_num_sel_shift;
+	uint32_t long_pkt_strobe_rst_shift;
+	uint32_t short_pkt_strobe_rst_shift;
+	uint32_t cphy_pkt_strobe_rst_shift;
+	uint32_t unmapped_pkt_strobe_rst_shift;
+	uint32_t fatal_err_mask;
+	uint32_t part_fatal_err_mask;
+	uint32_t non_fatal_err_mask;
+	uint32_t debug_irq_mask;
+	uint32_t top_irq_mask;
+};
+
+/*
+ * struct cam_ife_csid_timestamp: place holder for csid core info
+ *
+ * @prev_boot_timestamp:      Previous frame boot timestamp
+ * @prev_sof_timestamp:       Previous frame SOF timetamp
+ */
+struct cam_ife_csid_timestamp {
+	uint64_t                prev_boot_ts;
+	uint64_t                prev_sof_ts;
+};
+
+/*
+ * struct cam_ife_csid_core_info: place holder for csid core info
+ *
+ * @csid_reg:             Pointer to csid reg info
+ * @sw_version:           sw version based on targets
+ */
+struct cam_ife_csid_core_info {
+	void                     *csid_reg;
+	uint32_t                  sw_version;
+};
+
+/*
+ * struct cam_ife_csid_hw_counters: place holder for csid counters
+ *
+ * @csi2_reserve_cnt:       Reserve count for csi2
+ * @irq_debug_cnt:          irq debug counter
+ * @error_irq_count:        error irq counter
+ */
+struct cam_ife_csid_hw_counters {
+	uint32_t                          csi2_reserve_cnt;
+	uint32_t                          irq_debug_cnt;
+	uint32_t                          error_irq_count;
+};
+
+/*
+ * struct cam_ife_csid_debug_info: place holder for csid debug
+ *
+ * @debug_val:             Debug val for enabled features
+ * @rx_capture_vc:         rx packet vc capture
+ * @rx_capture_dt:         rx packet dt capture
+ * @rst_capture_strobes:   rx packet capture rst strobes
+ * @top_mask:              Debug mask for top irq
+ * @rx_mask:               Debug mask for rx irq
+ * @path_mask:             Debug mask for path irq
+ * @test_bus_val:          CSID test bus value
+ * @rx_capture_debug_set:  rx pkt capture debug set
+ * @test_bus_enabled:      test bus enabled
+ */
+struct cam_ife_csid_debug_info {
+	uint32_t                          debug_val;
+	uint32_t                          rx_capture_vc;
+	uint32_t                          rx_capture_dt;
+	uint32_t                          rst_capture_strobes;
+	uint32_t                          top_mask;
+	uint32_t                          rx_mask;
+	uint32_t                          path_mask;
+	uint32_t                          test_bus_val;
+	bool                              rx_capture_debug_set;
+	bool                              test_bus_enabled;
+};
+
+/*
+ * struct cam_ife_csid_hw_flags: place holder for flags
+ *
+ * @device_enabled:         flag to indicate if device enabled
+ * @binning_enabled:        flag to indicate if binning enabled
+ * @sof_irq_triggered:      flag to indicate if sof irq triggered
+ * @fatal_err_detected:     flag to indicate if fatal err detected
+ * @rx_enabled:             flag to indicate if rx is enabled
+ * @tpg_configured:         flag to indicate if internal_tpg is configured
+ * @reset_awaited:          flag to indicate if reset is awaited
+ * @offline_mode:           flag to indicate if csid in offline mode
+ * @rdi_lcr_en:             flag to indicate if RDI to lcr is enabled
+ * @sfe_en:                 flag to indicate if SFE is enabled
+ * @pf_err_detected:        flag to indicate if camnoc has encountered
+ *                          error - page fault
+ * @domain_id_security      Flag to determine if target has domain-id based security
+ */
+struct cam_ife_csid_hw_flags {
+	bool                  device_enabled;
+	bool                  binning_enabled;
+	bool                  sof_irq_triggered;
+	bool                  process_reset;
+	bool                  fatal_err_detected;
+	bool                  rx_enabled;
+	bool                  tpg_enabled;
+	bool                  tpg_configured;
+	bool                  reset_awaited;
+	bool                  offline_mode;
+	bool                  rdi_lcr_en;
+	bool                  sfe_en;
+	bool                  pf_err_detected;
+	bool                  domain_id_security;
+};
+
+/*
+ * struct am_ife_csid_cid_data: place holder for cid data
+ *
+ * @vc_dt:        vc_dt structure
+ * @cid_cnt:      count of cid acquired
+ * @num_vc_dt:    num of vc dt combinaton for this cid in multi vcdt case
+ */
+struct cam_ife_csid_cid_data {
+	struct cam_ife_csid_vc_dt vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_MAX];
+	uint32_t cid_cnt;
+	uint32_t num_vc_dt;
+};
+
+/*
+ * struct cam_ife_csid_rx_cfg: place holder for rx cfg
+ *
+ * @phy_sel:                  Selected phy
+ * @lane_type:                type of lane selected
+ * @lane_num:                 number of lanes
+ * @lane_cfg:                 lane configuration
+ * @tpg_mux_sel:              TPG mux sel
+ * @tpg_num_sel:              TPG num sel
+ * @mup:                      Mode Update bit. 0 for odd vc, 1 for even VC
+ * @epd_supported:            Flag to check if epd supported
+ * @irq_handle:               IRQ Handle
+ * @err_irq_handle:           Error IRQ Handle
+ * @dynamic_sensor_switch_en: Flag if dynamic sensor switch is enabled
+ */
+struct cam_ife_csid_rx_cfg  {
+	uint32_t                        phy_sel;
+	uint32_t                        lane_type;
+	uint32_t                        lane_num;
+	uint32_t                        lane_cfg;
+	uint32_t                        tpg_mux_sel;
+	uint32_t                        tpg_num_sel;
+	uint32_t                        mup;
+	uint32_t                        epd_supported;
+	uint32_t                        top_irq_handle;
+	uint32_t                        irq_handle;
+	uint32_t                        err_irq_handle;
+	bool                            dynamic_sensor_switch_en;
+};
+
+int cam_ife_csid_is_pix_res_format_supported(
+	uint32_t in_format);
+
+int cam_ife_csid_get_format_rdi(
+	uint32_t in_format, uint32_t out_format,
+	struct cam_ife_csid_path_format *path_format, bool mipi_pack_supported,
+	bool mipi_unpacked);
+
+int cam_ife_csid_get_format_ipp_ppp(
+	uint32_t in_format,
+	struct cam_ife_csid_path_format *path_format);
+
+int cam_ife_csid_hw_probe_init(struct cam_hw_intf  *hw_intf,
+	struct cam_ife_csid_core_info *core_info, bool is_custom);
+
+int cam_ife_csid_hw_deinit(struct cam_hw_intf *hw_intf,
+	struct cam_ife_csid_core_info *core_info);
+
+int cam_ife_csid_cid_reserve(struct cam_ife_csid_cid_data *cid_data,
+	uint32_t *cid_value,
+	uint32_t hw_idx,
+	struct cam_csid_hw_reserve_resource_args  *reserve);
+
+int cam_ife_csid_cid_release(
+	struct cam_ife_csid_cid_data *cid_data,
+	uint32_t hw_idx,
+	uint32_t cid);
+
+int cam_ife_csid_check_in_port_args(
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	uint32_t hw_idx);
+
+int cam_ife_csid_is_vc_full_width(struct cam_ife_csid_cid_data *cid_data);
+
+int cam_ife_csid_convert_res_to_irq_reg(uint32_t res_id);
+
+int cam_ife_csid_get_base(struct cam_hw_soc_info *soc_info,
+	uint32_t base_id, void *cmd_args, size_t arg_size);
+
+const char *cam_ife_csid_reset_type_to_string(enum cam_ife_csid_reset_type reset_type);
+
+const uint8_t **cam_ife_csid_get_irq_reg_tag_ptr(void);
+#endif /*_CAM_IFE_CSID_COMMON_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.c
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_cpas_api.h"
+#include <dt-bindings/msm-camera.h>
+
+static struct cam_hw_intf *cam_ife_csid_hw_list[CAM_IFE_CSID_HW_NUM_MAX] = {
+	0, 0, 0, 0};
+
+static int cam_ife_csid_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf             *hw_intf;
+	struct cam_hw_info             *hw_info;
+	const struct of_device_id      *match_dev = NULL;
+	struct cam_ife_csid_core_info  *csid_core_info = NULL;
+	uint32_t                        csid_dev_idx;
+	int                             rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ISP, "Binding IFE CSID component");
+
+	/* get ife csid hw index */
+	rc = of_property_read_u32(pdev->dev.of_node, "cell-index", &csid_dev_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to read cell-index of IFE CSID HW, rc: %d", rc);
+		goto err;
+	}
+
+	if (!cam_cpas_is_feature_supported(CAM_CPAS_ISP_FUSE, BIT(csid_dev_idx), NULL) ||
+		!cam_cpas_is_feature_supported(CAM_CPAS_ISP_LITE_FUSE,
+		BIT(csid_dev_idx), NULL)) {
+		CAM_DBG(CAM_ISP, "CSID[%d] not supported based on fuse", csid_dev_idx);
+		goto err;
+	}
+
+	hw_intf = kzalloc(sizeof(*hw_intf), GFP_KERNEL);
+	if (!hw_intf) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	hw_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!hw_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	/* get ife csid hw information */
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "No matching table for the IFE CSID HW!");
+		rc = -EINVAL;
+		goto free_hw_info;
+	}
+
+	hw_intf->hw_idx = csid_dev_idx;
+	hw_intf->hw_type = CAM_ISP_HW_TYPE_IFE_CSID;
+	hw_intf->hw_priv = hw_info;
+
+	hw_info->soc_info.pdev = pdev;
+	hw_info->soc_info.dev = &pdev->dev;
+	hw_info->soc_info.dev_name = pdev->name;
+	hw_info->soc_info.index = csid_dev_idx;
+
+	csid_core_info = (struct cam_ife_csid_core_info  *)match_dev->data;
+
+	/* call the driver init and fill csid_hw_info->core_info */
+	rc = cam_ife_csid_hw_probe_init(hw_intf, csid_core_info, false);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%d] probe init failed",
+		    csid_dev_idx);
+		goto free_hw_info;
+	}
+
+	platform_set_drvdata(pdev, hw_intf);
+	CAM_DBG(CAM_ISP, "CSID:%d component bound successfully",
+		hw_intf->hw_idx);
+
+
+	if (hw_intf->hw_idx < CAM_IFE_CSID_HW_NUM_MAX)
+		cam_ife_csid_hw_list[hw_intf->hw_idx] = hw_intf;
+	else
+		goto free_hw_info;
+
+	return 0;
+
+free_hw_info:
+	kfree(hw_info);
+free_hw_intf:
+	kfree(hw_intf);
+err:
+	return rc;
+}
+
+static void cam_ife_csid_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf             *hw_intf;
+	struct cam_hw_info             *hw_info;
+	struct cam_ife_csid_core_info  *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+	const struct of_device_id      *match_dev = NULL;
+
+	hw_intf = (struct cam_hw_intf *)platform_get_drvdata(pdev);
+
+	if (!hw_intf) {
+		CAM_ERR(CAM_ISP, "Error No data in hw_intf");
+		return;
+	}
+
+	hw_info = hw_intf->hw_priv;
+
+	CAM_DBG(CAM_ISP, "CSID:%d component unbind",
+		hw_intf->hw_idx);
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "No matching table for the IFE CSID HW!");
+		goto free_mem;
+	}
+
+	core_info = (struct cam_ife_csid_core_info *)match_dev->data;
+
+	cam_ife_csid_hw_deinit(hw_intf, core_info);
+
+free_mem:
+	/*release the csid device memory */
+	kfree(hw_info);
+	kfree(hw_intf);
+}
+
+const static struct component_ops cam_ife_csid_component_ops = {
+	.bind = cam_ife_csid_component_bind,
+	.unbind = cam_ife_csid_component_unbind,
+};
+
+int cam_ife_csid_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Adding IFE CSID component");
+	rc = component_add(&pdev->dev, &cam_ife_csid_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_ife_csid_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ife_csid_component_ops);
+	return 0;
+}
+
+int cam_ife_csid_hw_init(struct cam_hw_intf **ife_csid_hw,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (hw_idx >= CAM_IFE_CSID_HW_NUM_MAX) {
+		*ife_csid_hw = NULL;
+		return -EINVAL;
+	}
+
+	if (cam_ife_csid_hw_list[hw_idx]) {
+		*ife_csid_hw = cam_ife_csid_hw_list[hw_idx];
+	} else {
+		*ife_csid_hw = NULL;
+		rc = -1;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.h
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_DEV_H_
+#define _CAM_IFE_CSID_DEV_H_
+
+#include "cam_isp_hw.h"
+
+irqreturn_t cam_ife_csid_irq(int irq_num, void *data);
+
+int cam_ife_csid_probe(struct platform_device *pdev);
+int cam_ife_csid_remove(struct platform_device *pdev);
+
+/**
+ * @brief : API to register CSID hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_ife_csid_init_module(void);
+
+/**
+ * @brief : API to register CSID Lite hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_ife_csid_lite_init_module(void);
+
+/**
+ * @brief : API to remove CSID Hw from platform framework.
+ */
+void cam_ife_csid_exit_module(void);
+
+/**
+ * @brief : API to remove CSID Lite Hw from platform framework.
+ */
+void cam_ife_csid_lite_exit_module(void);
+
+#endif /*_CAM_IFE_CSID_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver1.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver1.c
@@ -0,0 +1,4851 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+#include <media/cam_defs.h>
+#include <media/cam_req_mgr.h>
+
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+#include "cam_isp_hw.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_common_util.h"
+#include "cam_subdev.h"
+
+#define IFE_CSID_TIMEOUT                               1000
+
+/* Timeout values in usec */
+#define CAM_IFE_CSID_TIMEOUT_SLEEP_US                  1000
+#define CAM_IFE_CSID_TIMEOUT_ALL_US                    100000
+
+#define CAM_IFE_CSID_RESET_TIMEOUT_MS                  100
+
+/*
+ * Constant Factors needed to change QTimer ticks to nanoseconds
+ * QTimer Freq = 19.2 MHz
+ * Time(us) = ticks/19.2
+ * Time(ns) = ticks/19.2 * 1000
+ */
+#define CAM_IFE_CSID_QTIMER_MUL_FACTOR                 10000
+#define CAM_IFE_CSID_QTIMER_DIV_FACTOR                 192
+
+/* Max number of sof irq's triggered in case of SOF freeze */
+#define CAM_CSID_IRQ_SOF_DEBUG_CNT_MAX 12
+
+#define CAM_IFE_CSID_VER1_STATUS_MAX_NUM               32
+
+static const struct cam_ife_csid_irq_desc ver1_rx_irq_desc[] = {
+	{
+		.desc = "PHY_DL0_EOT_CAPTURED",
+	},
+	{
+		.desc = "PHY_DL1_EOT_CAPTURED",
+	},
+	{
+		.desc = "PHY_DL2_EOT_CAPTURED",
+	},
+	{
+		.desc = "PHY_DL3_EOT_CAPTURED",
+	},
+	{
+		.desc = "PHY_DL0_SOT_CAPTURED",
+	},
+	{
+		.desc = "PHY_DL1_SOT_CAPTURED",
+	},
+	{
+		.desc = "PHY_DL2_SOT_CAPTURED",
+	},
+	{
+		.desc = "PHY_DL3_SOT_CAPTURED",
+	},
+	{
+		.desc = "LONG_PKT",
+	},
+	{
+		.desc = "SHORT_PKT",
+	},
+	{
+		.desc = "CPHY_PKT_HDR",
+	},
+	{
+		.desc = "CPHY_EOT_RECEPTION: No EOT on lane/s",
+	},
+	{
+		.desc = "CPHY_SOT_RECEPTION: Less SOTs on lane/s",
+	},
+	{
+		.desc = "CSID:%d CPHY_PH_CRC CPHY: Pkt Hdr CRC mismatch",
+	},
+	{
+		.desc = "WARNING_ECC",
+	},
+	{
+		.desc = "ERROR_LANE0_FIFO_OVERFLOW",
+	},
+	{
+		.desc = "ERROR_LANE1_FIFO_OVERFLOW",
+	},
+	{
+		.desc = "ERROR_LANE2_FIFO_OVERFLOW",
+	},
+	{
+		.desc = "ERROR_LANE3_FIFO_OVERFLOW",
+	},
+	{
+		.desc = "ERROR_CRC",
+	},
+	{
+		.desc = "ERROR_ECC",
+	},
+	{
+		.desc = "ERROR_MMAPPED_VC_DT",
+	},
+	{
+		.desc = "ERROR_UNMAPPED_VC_DT",
+	},
+	{
+		.desc = "ERROR_STREAM_UNDERFLOW",
+	},
+	{
+		.desc = "ERROR_UNBOUNDED_FRAME",
+	},
+	{
+		.desc = "RST_DONE",
+	},
+};
+
+static const struct cam_ife_csid_irq_desc ver1_path_irq_desc[] = {
+	{
+		.desc = "",
+	},
+	{
+		.desc = "Reset_Done",
+	},
+	{
+		.desc = "PATH_ERROR_O/P_FIFO_OVERFLOW: Slow IFE read",
+	},
+	{
+		.desc = "SUBSAMPLED_EOF",
+	},
+	{
+		.desc = "SUBSAMPLED_SOF",
+	},
+	{
+		.desc = "FRAME_DROP_EOF",
+	},
+	{
+		.desc = "FRAME_DROP_EOL",
+	},
+	{
+		.desc = "FRAME_DROP_SOL",
+	},
+	{
+		.desc = "FRAME_DROP_SOF",
+	},
+	{
+		.desc = "INPUT_EOF",
+	},
+	{
+		.desc = "INPUT_EOL",
+	},
+	{
+		.desc = "INPUT_SOL",
+	},
+	{
+		.desc = "INPUT_SOF",
+	},
+	{
+		.desc = "ERROR_PIX_COUNT",
+	},
+	{
+		.desc = "ERROR_LINE_COUNT",
+	},
+	{
+		.desc = "PATH_ERROR_CCIF_VIOLATION: Bad frame timings",
+	},
+	{
+		.desc = "FRAME_DROP",
+	},
+	{
+		.desc =
+			"PATH_OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.desc = "ERROR_REC_CCIF_VIOLATION",
+	},
+	{
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.desc = "VCDT_GRP_CHANGE",
+	},
+};
+
+static int cam_ife_csid_ver1_set_debug(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	uint32_t debug_val)
+{
+	int bit_pos = 0;
+	uint32_t val;
+
+	memset(&csid_hw->debug_info, 0,
+		sizeof(struct cam_ife_csid_debug_info));
+	csid_hw->debug_info.debug_val = debug_val;
+
+	while (debug_val) {
+
+		if (!(debug_val & 0x1)) {
+			debug_val >>= 1;
+			bit_pos++;
+			continue;
+		}
+
+		val = BIT(bit_pos);
+
+		switch (val) {
+		case CAM_IFE_CSID_DEBUG_ENABLE_SOF_IRQ:
+			csid_hw->debug_info.path_mask |=
+				IFE_CSID_VER1_PATH_INFO_INPUT_SOF;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_EOF_IRQ:
+			csid_hw->debug_info.path_mask |=
+				IFE_CSID_VER1_PATH_INFO_INPUT_EOF;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_SOT_IRQ:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER1_RX_DL0_SOT_CAPTURED |
+				IFE_CSID_VER1_RX_DL1_SOT_CAPTURED |
+				IFE_CSID_VER1_RX_DL2_SOT_CAPTURED;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_EOT_IRQ:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER1_RX_DL0_EOT_CAPTURED |
+				IFE_CSID_VER1_RX_DL1_EOT_CAPTURED |
+				IFE_CSID_VER1_RX_DL2_EOT_CAPTURED;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER1_RX_SHORT_PKT_CAPTURED;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER1_RX_LONG_PKT_CAPTURED;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER1_RX_CPHY_PKT_HDR_CAPTURED;
+			break;
+		case CAM_IFE_DEBUG_ENABLE_UNMAPPED_VC_DT_IRQ:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER1_RX_UNMAPPED_VC_DT;
+			break;
+		default:
+			break;
+		}
+
+		debug_val >>= 1;
+		bit_pos++;
+	}
+
+	return 0;
+}
+
+int cam_ife_csid_ver1_get_hw_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw_caps           *hw_caps;
+	struct cam_ife_csid_ver1_hw           *csid_hw;
+	struct cam_hw_info                    *hw_info;
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_csid_soc_private *soc_private = NULL;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info  *)hw_priv;
+
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_info->core_info;
+	hw_caps = (struct cam_ife_csid_hw_caps *) get_hw_cap_args;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_private = (struct cam_csid_soc_private *)
+			csid_hw->hw_info->soc_info.soc_private;
+
+	hw_caps->num_rdis = csid_reg->cmn_reg->num_rdis;
+	hw_caps->num_pix = csid_reg->cmn_reg->num_pix;
+	hw_caps->num_ppp = csid_reg->cmn_reg->num_ppp;
+	hw_caps->major_version = csid_reg->cmn_reg->major_version;
+	hw_caps->minor_version = csid_reg->cmn_reg->minor_version;
+	hw_caps->version_incr = csid_reg->cmn_reg->version_incr;
+	hw_caps->global_reset_en = csid_reg->cmn_reg->global_reset;
+	hw_caps->rup_en = csid_reg->cmn_reg->rup_supported;
+	hw_caps->is_lite = soc_private->is_ife_csid_lite;
+
+	CAM_DBG(CAM_ISP,
+		"CSID:%d No rdis:%d, no pix:%d, major:%d minor:%d ver :%d",
+		csid_hw->hw_intf->hw_idx, hw_caps->num_rdis,
+		hw_caps->num_pix, hw_caps->major_version,
+		hw_caps->minor_version, hw_caps->version_incr);
+
+	return rc;
+}
+
+static int cam_ife_csid_ver1_prepare_reset(
+	struct cam_ife_csid_ver1_hw     *csid_hw)
+{
+	struct cam_hw_soc_info                *soc_info;
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+	uint32_t i;
+	unsigned long flags;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid HW State:%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d Csid reset",
+		csid_hw->hw_intf->hw_idx);
+
+	spin_lock_irqsave(&csid_hw->hw_info->hw_lock, flags);
+
+	/* Mask all interrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->irq_mask_addr);
+
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->irq_mask_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->irq_mask_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->irq_mask_addr);
+
+	/* clear all interrupts */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_clear_addr);
+
+	cam_io_w_mb(csid_reg->csi2_reg->irq_mask_all,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(csid_reg->cmn_reg->ppp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->irq_clear_addr);
+
+	for (i = 0 ; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->rdi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->irq_clear_addr);
+
+	for (i = 0 ; i < csid_reg->cmn_reg->num_udis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->udi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[i]->irq_clear_addr);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->irq_cmd_addr);
+
+	spin_unlock_irqrestore(&csid_hw->hw_info->hw_lock, flags);
+
+	cam_io_w_mb(0x80, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->cfg1_addr);
+
+	/* enable the IPP and RDI format measure */
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->cfg0_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->cfg0_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(0x2, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->cfg0_addr);
+	return 0;
+}
+
+static int cam_ife_csid_ver1_hw_reset(
+	struct cam_ife_csid_ver1_hw     *csid_hw)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info          *soc_info;
+	uint32_t val = 0;
+	unsigned long flags, rem_jiffies = 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	reinit_completion(
+		&csid_hw->irq_complete[CAM_IFE_CSID_IRQ_REG_TOP]);
+
+	spin_lock_irqsave(&csid_hw->hw_info->hw_lock, flags);
+
+	csid_hw->flags.process_reset = true;
+
+	/* clear the top interrupt first */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_clear_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->irq_cmd_addr);
+
+	/* enable top reset complete IRQ */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_mask_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->irq_cmd_addr);
+
+	/* perform the top CSID registers reset */
+	val = csid_reg->cmn_reg->rst_hw_reg_stb;
+
+	cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->rst_strobes_addr);
+
+	spin_unlock_irqrestore(&csid_hw->hw_info->hw_lock, flags);
+	CAM_DBG(CAM_ISP, "CSID reset start");
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(
+			&csid_hw->irq_complete[CAM_IFE_CSID_IRQ_REG_TOP],
+			msecs_to_jiffies(CAM_IFE_CSID_RESET_TIMEOUT_MS));
+
+	if (rem_jiffies == 0) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->top_irq_status_addr);
+		if (val & 0x1) {
+			/* clear top reset IRQ */
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->cmn_reg->top_irq_clear_addr);
+			cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+				csid_reg->cmn_reg->irq_cmd_addr);
+			CAM_DBG(CAM_ISP, "CSID:%d HW reset completed %d",
+				csid_hw->hw_intf->hw_idx,
+				rem_jiffies);
+			goto end;
+		}
+		CAM_ERR(CAM_ISP, "CSID:%d hw csid_reset fail rc = %d",
+			rem_jiffies);
+		rc = -ETIMEDOUT;
+	} else {
+		CAM_DBG(CAM_ISP, "CSID:%d hw reset completed %d",
+			csid_hw->hw_intf->hw_idx,
+			rem_jiffies);
+	}
+end:
+	csid_hw->flags.process_reset = false;
+	return rc;
+}
+
+static int cam_ife_csid_ver1_sw_reset(
+	struct cam_ife_csid_ver1_hw  *csid_hw)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info          *soc_info;
+	uint32_t val = 0;
+	unsigned long flags, rem_jiffies = 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	reinit_completion(
+		&csid_hw->irq_complete[CAM_IFE_CSID_IRQ_REG_TOP]);
+
+	spin_lock_irqsave(&csid_hw->hw_info->hw_lock, flags);
+
+	csid_hw->flags.process_reset = true;
+
+	/* clear the top interrupt first */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_clear_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->irq_cmd_addr);
+
+	/* perform the top CSID registers reset */
+	val = csid_reg->cmn_reg->rst_sw_reg_stb;
+	cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->rst_strobes_addr);
+
+	/*
+	 * for SW reset, we enable the IRQ after since the mask
+	 * register has been reset
+	 */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_mask_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->irq_cmd_addr);
+
+	spin_unlock_irqrestore(&csid_hw->hw_info->hw_lock, flags);
+	CAM_DBG(CAM_ISP, "CSID[%d] top reset start",
+		csid_hw->hw_intf->hw_idx);
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(
+			&csid_hw->irq_complete[CAM_IFE_CSID_IRQ_REG_TOP],
+			msecs_to_jiffies(CAM_IFE_CSID_RESET_TIMEOUT_MS));
+
+	if (rem_jiffies == 0) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->top_irq_status_addr);
+		if (val & 0x1) {
+			/* clear top reset IRQ */
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->cmn_reg->top_irq_clear_addr);
+			cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+				csid_reg->cmn_reg->irq_cmd_addr);
+			CAM_DBG(CAM_ISP, "CSID:%d sw reset completed %d",
+				csid_hw->hw_intf->hw_idx,
+				rem_jiffies);
+			goto end;
+		}
+		CAM_ERR(CAM_ISP, "CSID:%d sw csid_reset fail rc = %d",
+			csid_hw->hw_intf->hw_idx,
+			rem_jiffies);
+		rc = -ETIMEDOUT;
+	} else {
+		CAM_DBG(CAM_ISP, "CSID:%d sw reset completed %d",
+			csid_hw->hw_intf->hw_idx,
+			rem_jiffies);
+	}
+end:
+	csid_hw->flags.process_reset = false;
+	return rc;
+}
+
+static int cam_ife_csid_ver1_global_reset(
+		struct cam_ife_csid_ver1_hw *csid_hw)
+{
+	int rc = 0;
+
+	rc = cam_ife_csid_ver1_prepare_reset(csid_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%d] prepare reset failed");
+		goto end;
+	}
+
+	rc = cam_ife_csid_ver1_hw_reset(csid_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%d] hw reset failed");
+		goto end;
+	}
+
+	rc = cam_ife_csid_ver1_sw_reset(csid_hw);
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CSID[%d] sw reset failed");
+end:
+	return rc;
+}
+
+static int cam_ife_csid_path_reset(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_csid_reset_cfg_args  *reset)
+{
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg = NULL;
+	const struct cam_ife_csid_ver1_reg_info      *csid_reg;
+	struct cam_isp_resource_node                 *res;
+	struct cam_hw_soc_info                       *soc_info;
+	unsigned long                                 rem_jiffies;
+	uint32_t                                      val;
+	int                                           rc = 0;
+	int                                           irq_reg = 0;
+	int                                           id = 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	res = reset->node_res;
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid hw state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d reset Resource[id:%d name:%s]",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_name);
+
+	switch (res->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		path_reg = csid_reg->ipp_reg;
+		break;
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		path_reg = csid_reg->ppp_reg;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+		path_reg = csid_reg->rdi_reg[res->res_id];
+		break;
+	case CAM_IFE_PIX_PATH_RES_UDI_0:
+	case CAM_IFE_PIX_PATH_RES_UDI_1:
+	case CAM_IFE_PIX_PATH_RES_UDI_2:
+		id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+		path_reg = csid_reg->udi_reg[id];
+		break;
+	default:
+		break;
+	}
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "Invalid res %d", res->res_id);
+		return -EINVAL;
+	}
+
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		path_reg->irq_mask_addr);
+	val |= 1 << csid_reg->cmn_reg->rst_done_shift_val;
+	irq_reg = cam_ife_csid_convert_res_to_irq_reg(res->res_id);
+	reinit_completion(&csid_hw->irq_complete[irq_reg]);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		path_reg->irq_mask_addr);
+	cam_io_w_mb(csid_reg->cmn_reg->path_rst_stb_all,
+		soc_info->reg_map[0].mem_base + path_reg->rst_strobes_addr);
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(
+			&csid_hw->irq_complete[irq_reg],
+			msecs_to_jiffies(IFE_CSID_TIMEOUT));
+
+	CAM_DBG(CAM_ISP, "CSID:%d resource[id:%d  name:%s] reset done",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_name);
+
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_ISP, "CSID:%d Res id %d fail rc = %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id, rc);
+	}
+
+	return rc;
+}
+
+int cam_ife_csid_ver1_reset(void *hw_priv,
+	void *reset_args, uint32_t arg_size)
+{
+	struct cam_hw_info *hw_info;
+	struct cam_ife_csid_ver1_hw *csid_hw;
+	struct cam_csid_reset_cfg_args  *reset;
+	int rc = 0;
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_info->core_info;
+	reset   = (struct cam_csid_reset_cfg_args  *)reset_args;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+
+	switch (reset->reset_type) {
+	case CAM_IFE_CSID_RESET_GLOBAL:
+		rc = cam_ife_csid_ver1_global_reset(csid_hw);
+		break;
+	case CAM_IFE_CSID_RESET_PATH:
+		rc = cam_ife_csid_path_reset(csid_hw, reset);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:Invalid reset type :%d",
+			reset->reset_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID[%d] reset type :%d",
+		csid_hw->hw_intf->hw_idx,
+		reset->reset_type);
+
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_ver1_deinit_rdi_path(
+	struct cam_ife_csid_ver1_hw     *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg;
+	const struct cam_ife_csid_ver1_reg_info      *csid_reg;
+	struct cam_ife_csid_core_info                *core_info;
+	struct cam_hw_soc_info                       *soc_info;
+	void __iomem                                 *mem_base;
+	int                                           rc = 0;
+	uint32_t                                      val;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW ||
+			res->res_id > CAM_IFE_PIX_PATH_RES_RDI_4) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res_type:%d res_id:%d Invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	core_info = csid_hw->core_info;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)core_info->csid_reg;
+
+	path_reg = csid_reg->rdi_reg[res->res_id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	if (path_reg->overflow_ctrl_en)
+		cam_io_w_mb(0, mem_base +
+			path_reg->err_recovery_cfg0_addr);
+
+	val = cam_io_r_mb(mem_base + path_reg->cfg0_addr);
+
+	if (val & path_reg->format_measure_en_shift_val) {
+		val &= ~path_reg->format_measure_en_shift_val;
+		cam_io_w_mb(val, mem_base +
+			path_reg->cfg0_addr);
+
+		/* Disable the HBI/VBI counter */
+		val = cam_io_r_mb(mem_base +
+			path_reg->format_measure_cfg0_addr);
+		val &= ~csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val, mem_base +
+			path_reg->format_measure_cfg0_addr);
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return rc;
+}
+
+static int cam_ife_csid_ver1_deinit_udi_path(
+	struct cam_ife_csid_ver1_hw     *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg;
+	const struct cam_ife_csid_ver1_reg_info      *csid_reg;
+	struct cam_ife_csid_core_info                *core_info;
+	struct cam_hw_soc_info                       *soc_info;
+	void __iomem                                 *mem_base;
+	uint32_t                                      val, id;
+	int                                           rc = 0;
+
+	if ((res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) ||
+			(res->res_id < CAM_IFE_PIX_PATH_RES_UDI_0 ||
+			 res->res_id > CAM_IFE_PIX_PATH_RES_UDI_2)) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res_type:%d res_id:%d Invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	core_info = csid_hw->core_info;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)core_info->csid_reg;
+
+	id =  res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+	path_reg = csid_reg->udi_reg[id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	if (path_reg->overflow_ctrl_en)
+		cam_io_w_mb(0, mem_base +
+			path_reg->err_recovery_cfg0_addr);
+
+	val = cam_io_r_mb(mem_base + path_reg->cfg0_addr);
+
+	if (val & BIT(path_reg->format_measure_en_shift_val)) {
+		val &= ~BIT(path_reg->format_measure_en_shift_val);
+		cam_io_w_mb(val, mem_base +
+			path_reg->cfg0_addr);
+
+		/* Disable the HBI/VBI counter */
+		val = cam_io_r_mb(mem_base +
+			path_reg->format_measure_cfg0_addr);
+		val &= ~csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val, mem_base +
+			path_reg->format_measure_cfg0_addr);
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return rc;
+}
+static int cam_ife_csid_ver1_deinit_pxl_path(
+	struct cam_ife_csid_ver1_hw     *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	void __iomem *mem_base;
+	uint32_t  val;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg = NULL;
+	struct cam_ife_csid_core_info  *core_info;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res_type:%d res_id:%d Invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	core_info = csid_hw->core_info;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)core_info->csid_reg;
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP)
+		path_reg = csid_reg->ipp_reg;
+	else if (res->res_id == CAM_IFE_PIX_PATH_RES_PPP)
+		path_reg = csid_reg->ppp_reg;
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d PIX:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	if (path_reg->overflow_ctrl_en)
+		cam_io_w_mb(0, mem_base +
+			path_reg->err_recovery_cfg0_addr);
+
+	val = cam_io_r_mb(mem_base + path_reg->cfg0_addr);
+
+	if (val & path_reg->format_measure_en_shift_val) {
+		val &= ~path_reg->format_measure_en_shift_val;
+		cam_io_w_mb(val, mem_base +
+			path_reg->cfg0_addr);
+
+		/* Disable the HBI/VBI counter */
+		val = cam_io_r_mb(mem_base +
+			path_reg->format_measure_cfg0_addr);
+		val &= ~csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val, mem_base +
+			path_reg->format_measure_cfg0_addr);
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_ife_csid_ver1_stop_pxl_path(
+	struct cam_ife_csid_ver1_hw     *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_ife_csid_halt_cmd       stop_cmd)
+{
+	int rc = 0;
+	uint32_t  val;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg = NULL;
+	struct cam_ife_csid_ver1_path_cfg *path_cfg;
+	uint32_t halt_cmd = 0;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res_type:%d res_id:%d Invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP)
+		path_reg = csid_reg->ipp_reg;
+	else if (res->res_id == CAM_IFE_PIX_PATH_RES_PPP)
+		path_reg = csid_reg->ppp_reg;
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d PIX:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	path_cfg  = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv;
+
+	if (stop_cmd == CAM_CSID_HALT_IMMEDIATELY) {
+		halt_cmd = path_reg->halt_immediate;
+	} else if (stop_cmd == CAM_CSID_HALT_AT_FRAME_BOUNDARY) {
+		halt_cmd = path_reg->halt_frame_boundary;
+	} else {
+		CAM_ERR(CAM_ISP, "CSID:%d un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		path_reg->irq_mask_addr);
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		path_reg->ctrl_addr);
+
+	if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		path_cfg->sync_mode == CAM_ISP_HW_SYNC_NONE) {
+		/* configure Halt for master */
+		val &= ~0x3;
+		val |= halt_cmd;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			path_reg->ctrl_addr);
+	}
+
+	if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_SLAVE &&
+		stop_cmd == CAM_CSID_HALT_IMMEDIATELY) {
+		/* configure Halt for slave */
+		val &= ~0xF;
+		val |= halt_cmd;
+		val |= (path_reg->halt_mode_master <<
+			path_reg->halt_mode_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			path_reg->ctrl_addr);
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_ver1_stop_rdi_path(
+	struct cam_ife_csid_ver1_hw     *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_ife_csid_halt_cmd       stop_cmd)
+{
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg;
+	struct cam_ife_csid_ver1_reg_info            *csid_reg;
+	struct cam_ife_csid_core_info                *core_info;
+	struct cam_hw_soc_info                       *soc_info;
+	void __iomem                                 *mem_base;
+	uint32_t                                      val;
+	int                                           rc = 0;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res_type:%d res_id:%d Invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id >= CAM_IFE_CSID_RDI_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	core_info = csid_hw->core_info;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)core_info->csid_reg;
+	path_reg = csid_reg->rdi_reg[res->res_id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d PIX:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	if (stop_cmd != CAM_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP, "CSID:%d un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	cam_io_w_mb(0, mem_base + path_reg->irq_mask_addr);
+
+	val = cam_io_r_mb(mem_base + path_reg->ctrl_addr);
+	val &= ~0x3;
+	val |= stop_cmd;
+	cam_io_w_mb(val, mem_base + path_reg->ctrl_addr);
+
+	return rc;
+}
+
+static int cam_ife_csid_ver1_stop_udi_path(
+	struct cam_ife_csid_ver1_hw     *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_ife_csid_halt_cmd       stop_cmd)
+{
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg;
+	struct cam_ife_csid_ver1_reg_info            *csid_reg;
+	struct cam_ife_csid_core_info                *core_info;
+	struct cam_hw_soc_info                       *soc_info;
+	void __iomem                                 *mem_base;
+	uint32_t                                      val, id;
+	int                                           rc = 0;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res_type:%d res_id:%d Invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id < CAM_IFE_PIX_PATH_RES_UDI_0 ||
+			res->res_id > CAM_IFE_PIX_PATH_RES_UDI_2) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+	core_info = csid_hw->core_info;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)core_info->csid_reg;
+	path_reg = csid_reg->udi_reg[id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	if (stop_cmd != CAM_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP, "CSID:%d un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	cam_io_w_mb(0, mem_base + path_reg->irq_mask_addr);
+
+	val = cam_io_r_mb(mem_base + path_reg->ctrl_addr);
+	val &= ~0x3;
+	val |= stop_cmd;
+	cam_io_w_mb(val, mem_base + path_reg->ctrl_addr);
+
+	return rc;
+}
+
+static int cam_ife_csid_hw_ver1_path_cfg(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_ife_csid_ver1_path_cfg *path_cfg,
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	uint32_t cid)
+{
+
+	path_cfg->cid = cid;
+	path_cfg->in_format = reserve->in_port->format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0];
+	path_cfg->out_format = reserve->out_port->format;
+	path_cfg->sync_mode = reserve->sync_mode;
+	path_cfg->height  = reserve->in_port->height;
+	path_cfg->start_line = reserve->in_port->line_start;
+	path_cfg->end_line = reserve->in_port->line_stop;
+	path_cfg->crop_enable = reserve->crop_enable;
+	path_cfg->drop_enable = reserve->drop_enable;
+	path_cfg->horizontal_bin = reserve->in_port->horizontal_bin;
+	path_cfg->qcfa_bin = reserve->in_port->qcfa_bin;
+	path_cfg->num_bytes_out = reserve->in_port->num_bytes_out;
+
+	if (reserve->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+		path_cfg->start_pixel = reserve->in_port->left_start;
+		path_cfg->end_pixel = reserve->in_port->left_stop;
+		path_cfg->width  = reserve->in_port->left_width;
+
+		if (reserve->res_id >= CAM_IFE_PIX_PATH_RES_RDI_0 &&
+			reserve->res_id <= (CAM_IFE_PIX_PATH_RES_RDI_0 +
+			CAM_IFE_CSID_RDI_MAX - 1)) {
+			path_cfg->end_pixel = reserve->in_port->right_stop;
+			path_cfg->width = path_cfg->end_pixel -
+				path_cfg->start_pixel + 1;
+		}
+
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d master:startpixel 0x%x endpixel:0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_cfg->start_pixel, path_cfg->end_pixel);
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d master:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_cfg->start_line, path_cfg->end_line);
+	} else if (reserve->sync_mode == CAM_ISP_HW_SYNC_SLAVE) {
+		path_cfg->start_pixel = reserve->in_port->right_start;
+		path_cfg->end_pixel = reserve->in_port->right_stop;
+		path_cfg->width  = reserve->in_port->right_width;
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d slave:start:0x%x end:0x%x width 0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_cfg->start_pixel, path_cfg->end_pixel,
+			path_cfg->width);
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d slave:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_cfg->start_line, path_cfg->end_line);
+	} else {
+		path_cfg->width  = reserve->in_port->left_width;
+		path_cfg->start_pixel = reserve->in_port->left_start;
+		path_cfg->end_pixel = reserve->in_port->left_stop;
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d left width %d start: %d stop:%d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			reserve->in_port->left_width,
+			reserve->in_port->left_start,
+			reserve->in_port->left_stop);
+	}
+	return 0;
+}
+
+static int cam_ife_csid_ver1_rx_capture_config(
+	struct cam_ife_csid_ver1_hw *csid_hw)
+{
+	const struct cam_ife_csid_ver1_reg_info   *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_ife_csid_rx_cfg                *rx_cfg;
+	uint32_t vc, dt, i;
+	uint32_t val = 0;
+
+	for (i = 0; i < CAM_IFE_CSID_CID_MAX; i++)
+		if (csid_hw->cid_data[i].cid_cnt)
+			break;
+
+	if (i == CAM_IFE_CSID_CID_MAX) {
+		CAM_WARN(CAM_ISP, "CSID[%d] no valid cid",
+			csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+	rx_cfg = &csid_hw->rx_cfg;
+
+	vc  = csid_hw->cid_data[i].vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc;
+	dt  = csid_hw->cid_data[i].vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (csid_hw->debug_info.debug_val &
+			CAM_IFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val = ((1 << csid_reg->csi2_reg->capture_short_pkt_en_shift) |
+			(vc << csid_reg->csi2_reg->capture_short_pkt_vc_shift));
+
+	/* CAM_IFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE */
+	val |= ((1 << csid_reg->csi2_reg->capture_long_pkt_en_shift) |
+		(dt << csid_reg->csi2_reg->capture_long_pkt_dt_shift) |
+		(vc << csid_reg->csi2_reg->capture_long_pkt_vc_shift));
+
+	/* CAM_IFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE*/
+	if (rx_cfg->lane_type == CAM_ISP_LANE_TYPE_CPHY) {
+		val |= ((1 << csid_reg->csi2_reg->capture_cphy_pkt_en_shift) |
+			(dt << csid_reg->csi2_reg->capture_cphy_pkt_dt_shift) |
+			(vc << csid_reg->csi2_reg->capture_cphy_pkt_vc_shift));
+	}
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->capture_ctrl_addr);
+	return 0;
+}
+
+static int cam_ife_csid_ver1_tpg_config(
+	struct cam_ife_csid_ver1_hw    *csid_hw,
+	struct cam_csid_hw_reserve_resource_args  *reserve)
+{
+
+	if (csid_hw->flags.tpg_configured)
+		return 0;
+
+	switch (reserve->in_port->test_pattern) {
+	case CAM_ISP_PATTERN_BAYER_RGRGRG:
+	case CAM_ISP_PATTERN_BAYER_GRGRGR:
+	case CAM_ISP_PATTERN_BAYER_BGBGBG:
+	case CAM_ISP_PATTERN_BAYER_GBGBGB:
+		csid_hw->tpg_cfg.test_pattern = reserve->in_port->test_pattern;
+		break;
+	case CAM_ISP_PATTERN_YUV_YCBYCR:
+	case CAM_ISP_PATTERN_YUV_YCRYCB:
+	case CAM_ISP_PATTERN_YUV_CBYCRY:
+	case CAM_ISP_PATTERN_YUV_CRYCBY:
+		csid_hw->tpg_cfg.test_pattern =
+			CAM_IFE_CSID_TPG_TEST_PATTERN_YUV;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID[%d] invalid test_pattern %d",
+			csid_hw->hw_intf->hw_idx,
+			reserve->in_port->test_pattern);
+		return -EINVAL;
+	}
+
+	switch (reserve->in_port->format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0]) {
+	case CAM_FORMAT_MIPI_RAW_8:
+		csid_hw->tpg_cfg.encode_format = CAM_IFE_CSID_TPG_ENCODE_RAW8;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		csid_hw->tpg_cfg.encode_format = CAM_IFE_CSID_TPG_ENCODE_RAW10;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		csid_hw->tpg_cfg.encode_format = CAM_IFE_CSID_TPG_ENCODE_RAW12;
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		csid_hw->tpg_cfg.encode_format = CAM_IFE_CSID_TPG_ENCODE_RAW14;
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		csid_hw->tpg_cfg.encode_format = CAM_IFE_CSID_TPG_ENCODE_RAW16;
+		break;
+	case CAM_FORMAT_YUV422:
+		csid_hw->tpg_cfg.encode_format = CAM_IFE_CSID_TPG_ENCODE_RAW8;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID[%d] invalid input format %d",
+			csid_hw->hw_intf->hw_idx,
+			reserve->in_port->format);
+		return -EINVAL;
+	}
+
+	if (reserve->in_port->usage_type)
+		csid_hw->tpg_cfg.width = reserve->in_port->right_stop + 1;
+	else
+		csid_hw->tpg_cfg.width = reserve->in_port->left_width;
+	csid_hw->tpg_cfg.height = reserve->in_port->height;
+	csid_hw->flags.tpg_configured = true;
+	csid_hw->tpg_cfg.vc =  reserve->in_port->vc[0];
+	csid_hw->tpg_cfg.dt =  reserve->in_port->dt[0];
+	return 0;
+}
+
+static int cam_ife_csid_ver1_tpg_start(
+	struct cam_ife_csid_ver1_hw *csid_hw)
+{
+	int rc = 0;
+	uint32_t  val = 0;
+	uint32_t i;
+	uint32_t base;
+	struct cam_hw_soc_info    *soc_info;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg = NULL;
+
+	if (csid_hw->flags.tpg_enabled)
+		return 0;
+
+	/*Enable the TPG */
+	CAM_DBG(CAM_ISP, "CSID:%d start CSID TPG",
+		csid_hw->hw_intf->hw_idx);
+
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	CAM_DBG(CAM_ISP, "================ TPG ============");
+	base = 0x600;
+
+	for (i = 0; i < 16; i++) {
+		val = cam_io_r_mb(
+			soc_info->reg_map[0].mem_base +
+			base + i * 4);
+		CAM_DBG(CAM_ISP, "reg 0x%x = 0x%x",
+			(base + i*4), val);
+	}
+
+	CAM_DBG(CAM_ISP, "================ IPP =============");
+	base = 0x200;
+	for (i = 0; i < 10; i++) {
+		val = cam_io_r_mb(
+			soc_info->reg_map[0].mem_base +
+			base + i * 4);
+		CAM_DBG(CAM_ISP, "reg 0x%x = 0x%x",
+			(base + i*4), val);
+	}
+
+	CAM_DBG(CAM_ISP, "================ RX =============");
+	base = 0x100;
+	for (i = 0; i < 5; i++) {
+		val = cam_io_r_mb(
+			soc_info->reg_map[0].mem_base +
+			base + i * 4);
+		CAM_DBG(CAM_ISP, "reg 0x%x = 0x%x",
+			(base + i*4), val);
+	}
+
+	/* Enable the IFE force clock on for dual isp case */
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (csid_hw->tpg_cfg.usage_type) {
+		rc = cam_ife_csid_enable_ife_force_clock_on(soc_info,
+			csid_reg->tpg_reg->cpas_ife_reg_offset);
+		if (rc)
+			return rc;
+	}
+
+	CAM_DBG(CAM_ISP, "============ TPG control ============");
+	val = csid_reg->tpg_reg->ctrl_cfg |
+		    ((csid_hw->rx_cfg.lane_num - 1) &
+		    csid_reg->tpg_reg->num_active_lanes_mask);
+
+	csid_hw->flags.tpg_enabled = true;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->tpg_reg->ctrl_addr);
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base + 0x600);
+	CAM_DBG(CAM_ISP, "reg 0x%x = 0x%x", 0x600, val);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_tpg_stop(struct cam_ife_csid_ver1_hw   *csid_hw)
+{
+	int rc = 0;
+	struct cam_hw_soc_info                 *soc_info;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg = NULL;
+
+	if (!csid_hw->flags.tpg_enabled)
+		return 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	/* disable the TPG */
+	CAM_DBG(CAM_ISP, "CSID:%d stop CSID TPG",
+		csid_hw->hw_intf->hw_idx);
+
+	/* Disable the IFE force clock on for dual isp case */
+	if (csid_hw->tpg_cfg.usage_type) {
+		rc = cam_ife_csid_disable_ife_force_clock_on(soc_info,
+			csid_reg->tpg_reg->cpas_ife_reg_offset);
+		CAM_DBG(CAM_ISP, "Dual isp case: Disable IFE force clk. rc %d", rc);
+	}
+
+	/*stop the TPG */
+	cam_io_w_mb(0,  soc_info->reg_map[0].mem_base +
+		csid_reg->tpg_reg->ctrl_addr);
+	csid_hw->flags.tpg_enabled = false;
+	csid_hw->flags.tpg_configured = false;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_init_tpg_hw(
+	struct cam_ife_csid_ver1_hw *csid_hw)
+{
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_ife_csid_ver1_tpg_reg_info       *tpg_reg;
+	struct cam_hw_soc_info               *soc_info;
+	uint32_t val = 0;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	tpg_reg =  csid_reg->tpg_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	CAM_DBG(CAM_ISP, "CSID:%d TPG config",
+		csid_hw->hw_intf->hw_idx);
+
+	/* configure one DT, infinite frames */
+	val = (tpg_reg->num_frames << tpg_reg->num_frame_shift) |
+		    csid_hw->tpg_cfg.vc;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		tpg_reg->vc_cfg0_addr);
+
+	/* vertical blanking count = 0x3FF, horzontal blanking count = 0x740*/
+	val = (tpg_reg->vbi << tpg_reg->vbi_shift) |
+		    (tpg_reg->hbi << tpg_reg->hbi_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		tpg_reg->vc_cfg1_addr);
+
+	cam_io_w_mb(tpg_reg->lfsr_seed, soc_info->reg_map[0].mem_base +
+		tpg_reg->lfsr_seed_addr);
+
+	val = csid_hw->tpg_cfg.width << tpg_reg->width_shift |
+		csid_hw->tpg_cfg.height;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		tpg_reg->dt_n_cfg_0_addr);
+
+	cam_io_w_mb(csid_hw->tpg_cfg.dt, soc_info->reg_map[0].mem_base +
+		csid_reg->tpg_reg->dt_n_cfg_1_addr);
+
+	/*
+	 * in_format is the same as the input resource format.
+	 * it is one larger than the register spec format.
+	 */
+	val = ((csid_hw->tpg_cfg.encode_format) << tpg_reg->fmt_shift) |
+		    tpg_reg->payload_mode;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->tpg_reg->dt_n_cfg_2_addr);
+
+	/* static frame with split color bar */
+	val =  tpg_reg->color_bar << tpg_reg->color_bar_shift;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		tpg_reg->color_bars_cfg_addr);
+	/* config pix pattern */
+	cam_io_w_mb(csid_hw->tpg_cfg.test_pattern,
+		soc_info->reg_map[0].mem_base +
+		tpg_reg->common_gen_cfg_addr);
+
+	return 0;
+}
+
+static int cam_ife_csid_hw_ver1_rx_cfg(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_csid_hw_reserve_resource_args  *reserve)
+{
+
+	if (csid_hw->counters.csi2_reserve_cnt) {
+		csid_hw->counters.csi2_reserve_cnt++;
+		CAM_DBG(CAM_ISP, "CSID %u Rx already reserved cnt %u",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->counters.csi2_reserve_cnt);
+		return 0;
+	}
+
+	csid_hw->rx_cfg.lane_cfg =
+		reserve->in_port->lane_cfg;
+	csid_hw->rx_cfg.lane_type =
+		reserve->in_port->lane_type;
+	csid_hw->rx_cfg.lane_num =
+		reserve->in_port->lane_num;
+	csid_hw->res_type = reserve->in_port->res_type;
+	csid_hw->rx_cfg.epd_supported =
+		reserve->in_port->epd_supported;
+
+	switch (reserve->in_port->res_type) {
+	case CAM_ISP_IFE_IN_RES_TPG:
+		csid_hw->rx_cfg.phy_sel = 0;
+		break;
+	case CAM_ISP_IFE_IN_RES_CPHY_TPG_0:
+		csid_hw->rx_cfg.phy_sel = 0;
+		break;
+	case CAM_ISP_IFE_IN_RES_CPHY_TPG_1:
+		csid_hw->rx_cfg.phy_sel = 1;
+		break;
+	case CAM_ISP_IFE_IN_RES_CPHY_TPG_2:
+		csid_hw->rx_cfg.phy_sel = 2;
+		break;
+	default:
+		csid_hw->rx_cfg.phy_sel =
+			(reserve->in_port->res_type & 0xFF) - 1;
+		break;
+	}
+
+	csid_hw->counters.csi2_reserve_cnt++;
+	CAM_DBG(CAM_ISP,
+		"CSID:%u Lane cfg:0x%x type:%u num:%u res:0x%x, res_cnt %u",
+		csid_hw->hw_intf->hw_idx,
+		reserve->in_port->lane_cfg, reserve->in_port->lane_type,
+		reserve->in_port->lane_num, reserve->in_port->res_type,
+		csid_hw->counters.csi2_reserve_cnt);
+
+	return 0;
+
+}
+
+int cam_ife_csid_hw_ver1_hw_cfg(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_ife_csid_ver1_path_cfg *path_cfg,
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	uint32_t cid)
+{
+	int rc = 0;
+
+	cam_ife_csid_hw_ver1_rx_cfg(csid_hw, reserve);
+	cam_ife_csid_hw_ver1_path_cfg(csid_hw, path_cfg,
+		reserve, cid);
+
+	if (reserve->res_type == CAM_ISP_IFE_IN_RES_TPG) {
+		rc = cam_ife_csid_ver1_tpg_config(csid_hw, reserve);
+
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"CSID[%d] Res_id %d tpg config fail",
+				csid_hw->hw_intf->hw_idx, reserve->res_id);
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_check_cust_node(
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	struct cam_ife_csid_ver1_hw *csid_hw)
+{
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+
+	if (!reserve->in_port->cust_node)
+		return 0;
+
+	if (reserve->in_port->usage_type == CAM_ISP_RES_USAGE_DUAL) {
+		CAM_ERR(CAM_ISP,
+			"Dual IFE is not supported for cust_node %u",
+			reserve->in_port->cust_node);
+		return -EINVAL;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (!(csid_reg->csid_cust_node_map[csid_hw->hw_intf->hw_idx] &
+		BIT(reserve->in_port->cust_node))) {
+		CAM_ERR(CAM_ISP,
+			"Invalid CSID:%u cust_node %u",
+			csid_hw->hw_intf->hw_idx,
+			reserve->in_port->cust_node);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static bool cam_ife_csid_ver1_is_width_valid_by_fuse(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	uint32_t width)
+{
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+	uint32_t fuse_val                 = UINT_MAX;
+
+	cam_cpas_is_feature_supported(CAM_CPAS_MP_LIMIT_FUSE,
+		CAM_CPAS_HW_IDX_ANY, &fuse_val);
+
+	if (fuse_val == UINT_MAX) {
+		CAM_DBG(CAM_ISP, "CSID[%u] Fuse not present",
+			csid_hw->hw_intf->hw_idx);
+		return true;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (fuse_val > csid_reg->width_fuse_max_val) {
+		CAM_ERR(CAM_ISP, "Invalid fuse value %u", fuse_val);
+		return false;
+	}
+
+	if (width > csid_reg->fused_max_width[fuse_val]) {
+		CAM_ERR(CAM_ISP,
+			"CSID[%u] Resolution not supported required_width: %d max_supported_width: %d",
+			csid_hw->hw_intf->hw_idx,
+			width, csid_reg->fused_max_width[fuse_val]);
+		return false;
+	}
+
+	return true;
+}
+
+static bool cam_ife_csid_ver1_is_width_valid_by_dt(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	uint32_t  width)
+{
+	struct cam_csid_soc_private *soc_private = NULL;
+
+	soc_private = (struct cam_csid_soc_private *)
+			csid_hw->hw_info->soc_info.soc_private;
+
+	if (!soc_private->max_width_enabled)
+		return true;
+
+	if (width > soc_private->max_width) {
+		CAM_ERR(CAM_ISP,
+			"CSID[%u] Resolution not supported required_width: %d max_supported_width: %d",
+			csid_hw->hw_intf->hw_idx,
+			width, soc_private->max_width);
+		return false;
+	}
+
+	return true;
+}
+
+bool cam_ife_csid_ver1_is_width_valid(
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	struct cam_ife_csid_ver1_hw *csid_hw)
+{
+	uint32_t width = 0;
+
+	if (reserve->res_id != CAM_IFE_PIX_PATH_RES_IPP)
+		return true;
+
+	if (reserve->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		reserve->sync_mode == CAM_ISP_HW_SYNC_NONE)
+		width = reserve->in_port->left_stop -
+			reserve->in_port->left_start + 1;
+	else if (reserve->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		width = reserve->in_port->right_stop -
+			reserve->in_port->right_start + 1;
+
+	if (!cam_ife_csid_ver1_is_width_valid_by_fuse(csid_hw, width)) {
+		CAM_ERR(CAM_ISP, "CSID[%u] width limited by fuse",
+			csid_hw->hw_intf->hw_idx);
+		return false;
+	}
+
+	if (!cam_ife_csid_ver1_is_width_valid_by_dt(csid_hw, width)) {
+		CAM_ERR(CAM_ISP, "CSID[%u] width limited by dt",
+			csid_hw->hw_intf->hw_idx);
+		return false;
+	}
+
+	return true;
+}
+
+static int cam_ife_csid_ver1_in_port_validate(
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	struct cam_ife_csid_ver1_hw     *csid_hw)
+{
+	int rc = 0;
+
+	/* check in port args */
+	rc  = cam_ife_csid_check_in_port_args(reserve,
+		csid_hw->hw_intf->hw_idx);
+	if (rc)
+		goto err;
+
+	if (!cam_ife_csid_ver1_is_width_valid(reserve, csid_hw))
+		goto err;
+
+	if (reserve->in_port->cust_node) {
+		rc = cam_ife_csid_check_cust_node(reserve, csid_hw);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Custom node config error");
+			goto err;
+		}
+	}
+
+	if (csid_hw->counters.csi2_reserve_cnt) {
+
+		if (csid_hw->res_type != reserve->in_port->res_type) {
+			CAM_ERR(CAM_ISP,
+				"CSID[%d ]Invalid res[%x] in_res_type[%x]",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->res_type,
+				reserve->in_port->res_type);
+			rc = -EINVAL;
+			goto err;
+		}
+
+		if (csid_hw->rx_cfg.lane_cfg !=
+			reserve->in_port->lane_cfg  ||
+			csid_hw->rx_cfg.lane_type !=
+			reserve->in_port->lane_type ||
+			csid_hw->rx_cfg.lane_num !=
+			reserve->in_port->lane_num) {
+			CAM_ERR(CAM_ISP,
+				"[%d] lane: num[%d %d] type[%d %d] cfg[%d %d]",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->rx_cfg.lane_num,
+				reserve->in_port->lane_num,
+				csid_hw->rx_cfg.lane_type,
+				reserve->in_port->lane_type,
+				csid_hw->rx_cfg.lane_cfg,
+				reserve->in_port->lane_cfg);
+			rc = -EINVAL;
+			goto err;
+		}
+	}
+
+	return rc;
+err:
+	CAM_ERR(CAM_ISP, "Invalid args csid[%d] rc %d",
+		csid_hw->hw_intf->hw_idx, rc);
+	return rc;
+}
+
+
+int cam_ife_csid_ver1_reserve(void *hw_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+
+	struct cam_ife_csid_ver1_hw     *csid_hw;
+	struct cam_hw_info              *hw_info;
+	struct cam_isp_resource_node    *res = NULL;
+	struct cam_csid_hw_reserve_resource_args  *reserve;
+	struct cam_ife_csid_ver1_path_cfg    *path_cfg;
+	uint32_t cid;
+	int rc = 0;
+
+	reserve = (struct cam_csid_hw_reserve_resource_args  *)reserve_args;
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_info->core_info;
+
+	if (reserve->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID %d invalid Res_id %d",
+				csid_hw->hw_intf->hw_idx, reserve->res_id);
+		return -EINVAL;
+	}
+	res = &csid_hw->path_res[reserve->res_id];
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_DBG(CAM_ISP, "CSID %d Res_id %d state %d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	rc = cam_ife_csid_ver1_in_port_validate(reserve, csid_hw);
+
+	CAM_DBG(CAM_ISP, "CSID[%d] res_id %d",
+		csid_hw->hw_intf->hw_idx, reserve->res_id);
+
+	if (rc) {
+		CAM_DBG(CAM_ISP, "CSID %d Res_id %d port validation failed",
+			csid_hw->hw_intf->hw_idx, reserve->res_id);
+		return rc;
+	}
+
+	path_cfg = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv;
+
+	if (!path_cfg) {
+		CAM_ERR(CAM_ISP,
+			"CSID %d Unallocated Res_id %d state %d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	rc = cam_ife_csid_cid_reserve(csid_hw->cid_data, &cid,
+		csid_hw->hw_intf->hw_idx, reserve);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID %d Res_id %d state %d invalid cid %d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			res->res_state, cid);
+		return rc;
+	}
+
+	rc = cam_ife_csid_hw_ver1_hw_cfg(csid_hw, path_cfg,
+		reserve, cid);
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	reserve->node_res = res;
+	csid_hw->event_cb = reserve->event_cb;
+	csid_hw->token = reserve->cb_priv;
+
+	CAM_DBG(CAM_ISP, "CSID %d Resource[id:%d name:%s] state %d cid %d rc %d",
+		csid_hw->hw_intf->hw_idx, reserve->res_id,
+		res->res_name, res->res_state, cid, rc);
+
+	return 0;
+}
+
+int cam_ife_csid_ver1_release(void *hw_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_ver1_hw     *csid_hw;
+	struct cam_hw_info              *hw_info;
+	struct cam_isp_resource_node    *res = NULL;
+	struct cam_ife_csid_ver1_path_cfg    *path_cfg;
+	int rc = 0;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_info->core_info;
+	res = (struct cam_isp_resource_node *)release_args;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+
+	if ((res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE) ||
+		(res->res_state >= CAM_ISP_RESOURCE_STATE_STREAMING)) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%d res type:%d Res %d in state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id,
+			res->res_state);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res type :%d Resource id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	path_cfg = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv;
+
+	if (path_cfg->cid >= CAM_IFE_CSID_CID_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid cid:%d",
+				csid_hw->hw_intf->hw_idx, path_cfg->cid);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cam_ife_csid_cid_release(&csid_hw->cid_data[path_cfg->cid],
+		csid_hw->hw_intf->hw_idx,
+		path_cfg->cid);
+	memset(path_cfg, 0, sizeof(*path_cfg));
+
+	if (csid_hw->counters.csi2_reserve_cnt)
+		csid_hw->counters.csi2_reserve_cnt--;
+	if (!csid_hw->counters.csi2_reserve_cnt) {
+		memset(&csid_hw->rx_cfg, 0,
+			sizeof(struct cam_ife_csid_rx_cfg));
+		memset(&csid_hw->debug_info, 0,
+			sizeof(struct cam_ife_csid_debug_info));
+		csid_hw->event_cb = NULL;
+		csid_hw->token = NULL;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"CSID:%d res type :%d Resource[id:%d name:%s] csi2_reserve_cnt:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id,
+		res->res_name, csid_hw->counters.csi2_reserve_cnt);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_ver1_start_rdi_path(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg;
+	struct cam_ife_csid_core_info  *core_info;
+	void __iomem *mem_base;
+	uint32_t val;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_id > CAM_IFE_PIX_PATH_RES_RDI_4) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res_type:%d res_id:%d Invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	core_info = csid_hw->core_info;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)core_info->csid_reg;
+
+	path_reg = csid_reg->rdi_reg[res->res_id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[0].mem_base;
+	 /* Resume at frame boundary */
+	cam_io_w_mb(CAM_CSID_RESUME_AT_FRAME_BOUNDARY,
+		mem_base + path_reg->ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d start: %s",
+		csid_hw->hw_intf->hw_idx, res->res_name);
+
+	val = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask |
+		csid_hw->debug_info.path_mask |
+		IFE_CSID_VER1_PATH_INFO_RST_DONE;
+	cam_io_w_mb(val, mem_base + path_reg->irq_mask_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_ife_csid_ver1_start_udi_path(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg;
+	struct cam_ife_csid_core_info  *core_info;
+	void __iomem *mem_base;
+	uint32_t val, id;
+
+	if ((res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) ||
+		(res->res_id < CAM_IFE_PIX_PATH_RES_UDI_0 ||
+		 res->res_id > CAM_IFE_PIX_PATH_RES_UDI_2)) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res_type:%d res_id:%d Invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	core_info = csid_hw->core_info;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)core_info->csid_reg;
+
+	id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+
+	path_reg = csid_reg->udi_reg[id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d UDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[0].mem_base;
+	 /* Resume at frame boundary */
+	cam_io_w_mb(CAM_CSID_RESUME_AT_FRAME_BOUNDARY,
+		mem_base + path_reg->ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d Start:%s",
+		csid_hw->hw_intf->hw_idx, res->res_name);
+
+	val = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask |
+		csid_hw->debug_info.path_mask |
+		IFE_CSID_VER1_PATH_INFO_RST_DONE;
+	cam_io_w_mb(val, mem_base + path_reg->irq_mask_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_ife_csid_ver1_start_pix_path(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+
+	int rc = 0;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg = NULL;
+	uint32_t  val = 0;
+	struct cam_ife_csid_ver1_path_cfg *path_cfg;
+	struct cam_ife_csid_ver1_path_cfg *ipp_path_cfg;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res_type:%d res_id:%d Invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP)
+		path_reg = csid_reg->ipp_reg;
+	else if (res->res_id == CAM_IFE_PIX_PATH_RES_PPP)
+		path_reg = csid_reg->ppp_reg;
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d PIX:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	path_cfg = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv;
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+
+		path_reg = csid_reg->ipp_reg;
+		val = path_reg->halt_master_sel_master_val <<
+			path_reg->halt_master_sel_shift;
+
+		if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+			/* Set start mode as master */
+			val |= path_reg->halt_mode_master  <<
+				path_reg->halt_mode_shift;
+		} else if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_SLAVE) {
+			/* Set start mode as slave */
+			val |= path_reg->halt_mode_slave <<
+				path_reg->halt_mode_shift;
+		} else {
+			/* Default is internal halt mode */
+			val = 0;
+		}
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+
+		path_reg = csid_reg->ppp_reg;
+
+		/* for dual case
+		 * set ppp as slave
+		 * if current csid is set as master set
+		 * start_master_sel_val as 3
+		 */
+
+		if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_NONE) {
+			val = 0;
+		} else {
+			val = path_reg->halt_mode_slave <<
+				path_reg->halt_mode_shift;
+			/* Set halt mode as master */
+
+			ipp_path_cfg = (struct cam_ife_csid_ver1_path_cfg *)
+					csid_hw->path_res
+					[CAM_IFE_PIX_PATH_RES_IPP].res_priv;
+
+			if (ipp_path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER)
+				val |= path_reg->halt_master_sel_master_val <<
+					path_reg->halt_master_sel_shift;
+		}
+	}
+
+	/*
+	 * Resume at frame boundary if Master or No Sync.
+	 * Slave will get resume command from Master.
+	 */
+	if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		path_cfg->sync_mode == CAM_ISP_HW_SYNC_NONE)
+		val |= path_reg->resume_frame_boundary;
+
+	cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + path_reg->ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d Resource[id:%d name:%s]ctrl val: 0x%x",
+		csid_hw->hw_intf->hw_idx,
+		res->res_id, res->res_name, val);
+
+	val = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask |
+		csid_hw->debug_info.path_mask |
+		IFE_CSID_VER1_PATH_INFO_RST_DONE;
+	cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + path_reg->irq_mask_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_ife_csid_ver1_enable_csi2(struct cam_ife_csid_ver1_hw *csid_hw)
+{
+	int rc = 0;
+	struct cam_hw_soc_info              *soc_info;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	const struct cam_ife_csid_csi2_rx_reg_info  *csi2_reg;
+	uint32_t val = 0;
+	struct cam_ife_csid_rx_cfg        *rx_cfg;
+	int vc_full_width;
+
+	if (csid_hw->flags.rx_enabled)
+		return 0;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csi2_reg  = csid_reg->csi2_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	rx_cfg  = &csid_hw->rx_cfg;
+
+	/*Configure Rx cfg0 */
+
+	val = (rx_cfg->lane_cfg << csi2_reg->lane_cfg_shift) |
+		((rx_cfg->lane_num - 1) << csi2_reg->lane_num_shift) |
+		(rx_cfg->lane_type << csi2_reg->phy_type_shift) |
+		(rx_cfg->phy_sel  << csi2_reg->phy_num_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csi2_reg->cfg0_addr);
+
+	/*Configure Rx cfg1*/
+	val = 1 << csi2_reg->misr_enable_shift_val;
+	val |= 1 << csi2_reg->ecc_correction_shift_en;
+
+	vc_full_width = cam_ife_csid_is_vc_full_width(csid_hw->cid_data);
+
+	if (vc_full_width == 1) {
+		val |= 1 <<  csi2_reg->vc_mode_shift_val;
+	} else if (vc_full_width < 0) {
+		CAM_ERR(CAM_ISP, "Error VC DT");
+		return -EINVAL;
+	}
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csi2_reg->cfg1_addr);
+	rc = cam_ife_csid_ver1_hw_reset(csid_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%d] hw reset fail",
+			csid_hw->hw_intf->hw_idx);
+		return rc;
+	}
+
+	csid_hw->flags.rx_enabled = true;
+
+	if (csid_hw->res_type == CAM_ISP_IFE_IN_RES_TPG)
+		cam_ife_csid_ver1_init_tpg_hw(csid_hw);
+
+	/* Enable the interrupt based on csid debug info set
+	 * Fatal error mask
+	 * Partly fatal error mask
+	 * Rx reset done irq
+	 */
+	val = csi2_reg->fatal_err_mask | csi2_reg->part_fatal_err_mask |
+		csid_hw->debug_info.rx_mask | IFE_CSID_VER1_RX_RST_DONE;
+
+	/*EPD supported sensors do not send EOT, error will be generated
+	 * if this irq is enabled
+	 */
+	if (csid_hw->rx_cfg.epd_supported)
+		val &= ~IFE_CSID_VER1_RX_CPHY_EOT_RECEPTION;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csi2_reg->irq_mask_addr);
+	cam_ife_csid_ver1_rx_capture_config(csid_hw);
+
+	return rc;
+}
+
+static int cam_ife_csid_ver1_init_config_rdi_path(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg = NULL;
+	const struct cam_ife_csid_ver1_common_reg_info *cmn_reg = NULL;
+	uint32_t  val;
+	struct cam_ife_csid_ver1_path_cfg *path_cfg;
+	struct cam_ife_csid_cid_data *cid_data;
+	void __iomem *mem_base;
+	struct cam_ife_csid_path_format path_format = {0};
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (!csid_reg->rdi_reg[res->res_id]) {
+		CAM_ERR(CAM_ISP, "CSID:%d RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	cmn_reg = csid_reg->cmn_reg;
+	path_reg = csid_reg->rdi_reg[res->res_id];
+	path_cfg = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv;
+	cid_data = &csid_hw->cid_data[path_cfg->cid];
+	mem_base = soc_info->reg_map[0].mem_base;
+	rc = cam_ife_csid_get_format_rdi(path_cfg->in_format,
+		path_cfg->out_format, &path_format, path_reg->mipi_pack_supported, false);
+	if (rc)
+		return rc;
+
+	/*Configure cfg0:
+	 * Timestamp enable
+	 * VC
+	 * DT
+	 * DT_ID cobination
+	 * Decode Format
+	 * Crop/Drop parameters
+	 * Plain format
+	 * Packing format
+	 */
+	val = (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc <<
+			cmn_reg->vc_shift_val) |
+		(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt <<
+			cmn_reg->dt_shift_val) |
+		(path_cfg->cid << cmn_reg->dt_id_shift_val) |
+		(path_format.decode_fmt <<
+			cmn_reg->decode_format_shift_val);
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO)
+		val |= 1 << path_reg->format_measure_en_shift_val;
+
+	val |= (path_cfg->crop_enable << path_reg->crop_h_en_shift_val) |
+		(path_cfg->crop_enable <<
+		 path_reg->crop_v_en_shift_val);
+
+	if (cmn_reg->drop_supported)
+		val |= (path_cfg->drop_enable <<
+				path_reg->drop_v_en_shift_val) |
+			(path_cfg->drop_enable <<
+				path_reg->drop_h_en_shift_val);
+
+	if (path_reg->mipi_pack_supported)
+		val |= path_format.packing_fmt <<
+			path_reg->packing_fmt_shift_val;
+
+	val |= path_format.plain_fmt << path_reg->plain_fmt_shift_val;
+	val |= 1 << path_reg->timestamp_en_shift_val;
+
+	cam_io_w_mb(val, mem_base + path_reg->cfg0_addr);
+
+	/*Configure Multi VC DT combo */
+	if (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid) {
+		val = (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].vc <<
+				cmn_reg->multi_vcdt_vc1_shift_val) |
+			(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].dt <<
+				cmn_reg->multi_vcdt_dt1_shift_val) |
+			(1 << cmn_reg->multi_vcdt_en_shift_val);
+
+		cam_io_w_mb(val, mem_base + path_reg->multi_vcdt_cfg0_addr);
+	}
+
+	val = 0;
+	/*configure cfg1 addr
+	 * Timestamp strobe selection
+	 */
+	val |= cmn_reg->timestamp_strobe_val <<
+			cmn_reg->timestamp_stb_sel_shift_val;
+
+	cam_io_w_mb(val, mem_base + path_reg->cfg1_addr);
+
+	if (path_cfg->crop_enable) {
+		val = (((path_cfg->end_pixel & cmn_reg->crop_pix_start_mask) <<
+			cmn_reg->crop_shift_val) |
+			(path_cfg->start_pixel & cmn_reg->crop_pix_end_mask));
+		cam_io_w_mb(val, mem_base + path_reg->hcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Horizontal crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		val = (((path_cfg->end_line & cmn_reg->crop_line_start_mask) <<
+			csid_reg->cmn_reg->crop_shift_val) |
+			(path_cfg->start_line & cmn_reg->crop_line_end_mask));
+		cam_io_w_mb(val, mem_base + path_reg->vcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Vertical Crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+	}
+
+	/* set frame drop pattern to 0 and period to 1 */
+	cam_io_w_mb(1, mem_base + path_reg->frm_drop_period_addr);
+	cam_io_w_mb(0, mem_base + path_reg->frm_drop_pattern_addr);
+	/* set irq sub sample pattern to 0 and period to 1 */
+	cam_io_w_mb(1, mem_base + path_reg->irq_subsample_period_addr);
+	cam_io_w_mb(0, mem_base + path_reg->irq_subsample_pattern_addr);
+
+	/*TODO Need to check for any hw errata like 480 and 580*/
+	/* set pxl drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, mem_base + path_reg->pix_drop_pattern_addr);
+	cam_io_w_mb(1, mem_base + path_reg->pix_drop_period_addr);
+
+	/* set line drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, mem_base + path_reg->line_drop_pattern_addr);
+	cam_io_w_mb(1, mem_base + path_reg->line_drop_period_addr);
+
+	if (path_reg->overflow_ctrl_en) {
+		val = path_reg->overflow_ctrl_en |
+			path_reg->overflow_ctrl_mode_val;
+		cam_io_w_mb(val, mem_base + path_reg->err_recovery_cfg0_addr);
+	}
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(mem_base +
+			path_reg->format_measure_cfg0_addr);
+		val |= csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val, mem_base +
+			path_reg->format_measure_cfg0_addr);
+	}
+
+	/* Enable the RDI path */
+	val = cam_io_r_mb(mem_base + path_reg->cfg0_addr);
+	val |= (1 << cmn_reg->path_en_shift_val);
+	cam_io_w_mb(val, mem_base + path_reg->cfg0_addr);
+	CAM_DBG(CAM_ISP, "%s cfg0 0x%x", res->res_name, val);
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	return rc;
+}
+
+static int cam_ife_csid_ver1_init_config_udi_path(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg = NULL;
+	const struct cam_ife_csid_ver1_common_reg_info *cmn_reg = NULL;
+	uint32_t  val;
+	struct cam_ife_csid_ver1_path_cfg *path_cfg;
+	struct cam_ife_csid_cid_data *cid_data;
+	void __iomem *mem_base;
+	struct cam_ife_csid_path_format path_format = {0};
+	uint32_t id;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (res->res_id < CAM_IFE_PIX_PATH_RES_UDI_0 ||
+			res->res_id > CAM_IFE_PIX_PATH_RES_UDI_2) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+	if (!csid_reg->udi_reg[id]) {
+		CAM_ERR(CAM_ISP, "CSID:%d UDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	cmn_reg = csid_reg->cmn_reg;
+	path_reg = csid_reg->udi_reg[id];
+	path_cfg = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv;
+	cid_data = &csid_hw->cid_data[path_cfg->cid];
+	mem_base = soc_info->reg_map[0].mem_base;
+	rc = cam_ife_csid_get_format_rdi(path_cfg->in_format,
+		path_cfg->out_format, &path_format, path_reg->mipi_pack_supported, false);
+	if (rc)
+		return rc;
+
+	/*Configure cfg0:
+	 * Timestamp enable
+	 * VC
+	 * DT
+	 * DT_ID cobination
+	 * Decode Format
+	 * Crop/Drop parameters
+	 * Plain format
+	 * Packing format
+	 */
+	val = (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc <<
+			cmn_reg->vc_shift_val) |
+		(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt <<
+			cmn_reg->dt_shift_val) |
+		(path_cfg->cid << cmn_reg->dt_id_shift_val) |
+		(path_format.decode_fmt << cmn_reg->decode_format_shift_val);
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO)
+		val |= 1 << path_reg->format_measure_en_shift_val;
+
+	val |= (path_cfg->crop_enable << path_reg->crop_h_en_shift_val) |
+		(path_cfg->crop_enable <<
+		 path_reg->crop_v_en_shift_val);
+
+	if (cmn_reg->drop_supported)
+		val |= (path_cfg->drop_enable <<
+				path_reg->drop_v_en_shift_val) |
+			(path_cfg->drop_enable <<
+				path_reg->drop_h_en_shift_val);
+
+	if (path_reg->mipi_pack_supported)
+		val |= path_format.packing_fmt <<
+			path_reg->packing_fmt_shift_val;
+
+	val |= path_format.plain_fmt << path_reg->plain_fmt_shift_val;
+
+	cam_io_w_mb(val, mem_base + path_reg->cfg0_addr);
+
+	val = 0;
+	/*configure cfg1 addr
+	 * Timestamp strobe selection
+	 */
+	val |= (1 << path_reg->timestamp_en_shift_val) |
+		(cmn_reg->timestamp_strobe_val <<
+			cmn_reg->timestamp_stb_sel_shift_val);
+
+	cam_io_w_mb(val, mem_base + path_reg->cfg1_addr);
+
+	if (path_cfg->crop_enable) {
+		val = (((path_cfg->end_pixel & cmn_reg->crop_pix_start_mask) <<
+			cmn_reg->crop_shift_val) |
+			(path_cfg->start_pixel & cmn_reg->crop_pix_end_mask));
+		cam_io_w_mb(val, mem_base + path_reg->hcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Horizontal crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		val = (((path_cfg->end_line & cmn_reg->crop_line_start_mask) <<
+			csid_reg->cmn_reg->crop_shift_val) |
+			(path_cfg->start_line & cmn_reg->crop_line_end_mask));
+		cam_io_w_mb(val, mem_base + path_reg->vcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Vertical Crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+	}
+
+	/* set frame drop pattern to 0 and period to 1 */
+	cam_io_w_mb(1, mem_base + path_reg->frm_drop_period_addr);
+	cam_io_w_mb(0, mem_base + path_reg->frm_drop_pattern_addr);
+	/* set irq sub sample pattern to 0 and period to 1 */
+	cam_io_w_mb(1, mem_base + path_reg->irq_subsample_period_addr);
+	cam_io_w_mb(0, mem_base + path_reg->irq_subsample_pattern_addr);
+
+	/*TODO Need to check for any hw errata like 480 and 580*/
+	/* set pxl drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, mem_base + path_reg->pix_drop_pattern_addr);
+	cam_io_w_mb(1, mem_base + path_reg->pix_drop_period_addr);
+
+	/* set line drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, mem_base + path_reg->line_drop_pattern_addr);
+	cam_io_w_mb(1, mem_base + path_reg->line_drop_period_addr);
+
+	/* Enable the UDI path */
+	val = cam_io_r_mb(mem_base + path_reg->cfg0_addr);
+	val |= (1 << cmn_reg->path_en_shift_val);
+	cam_io_w_mb(val, mem_base + path_reg->cfg0_addr);
+	CAM_DBG(CAM_ISP, "%s cfg0 0x%x", res->res_name, val);
+
+	if (path_reg->overflow_ctrl_en) {
+		val = path_reg->overflow_ctrl_en |
+			path_reg->overflow_ctrl_mode_val;
+		cam_io_w_mb(val, mem_base + path_reg->err_recovery_cfg0_addr);
+	}
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(mem_base +
+			path_reg->format_measure_cfg0_addr);
+		val |= csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val, mem_base +
+			path_reg->format_measure_cfg0_addr);
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+	return rc;
+}
+
+static int cam_ife_csid_ver1_init_config_pxl_path(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver1_path_reg_info *path_reg = NULL;
+	const struct cam_ife_csid_ver1_common_reg_info *cmn_reg = NULL;
+	uint32_t val = 0;
+	struct cam_ife_csid_ver1_path_cfg *path_cfg;
+	struct cam_ife_csid_cid_data *cid_data;
+	void __iomem *mem_base;
+	struct cam_ife_csid_path_format path_format = {0};
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (res->res_id ==  CAM_IFE_PIX_PATH_RES_IPP)
+		path_reg = csid_reg->ipp_reg;
+	else if (res->res_id ==  CAM_IFE_PIX_PATH_RES_PPP)
+		path_reg = csid_reg->ppp_reg;
+
+	if (!path_reg)
+		return -EINVAL;
+
+	cmn_reg = csid_reg->cmn_reg;
+
+	path_cfg = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv;
+	cid_data = &csid_hw->cid_data[path_cfg->cid];
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	rc = cam_ife_csid_get_format_ipp_ppp(path_cfg->in_format,
+		&path_format);
+
+	/*Configure:
+	 * VC
+	 * DT
+	 * DT_ID cobination
+	 * Decode Format
+	 * Early eof
+	 * timestamp enable
+	 * crop/drop enable
+	 * Binning
+	 */
+	val = (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc <<
+			cmn_reg->vc_shift_val) |
+		(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt <<
+			cmn_reg->dt_shift_val) |
+		(path_cfg->cid << cmn_reg->dt_id_shift_val) |
+		(path_format.decode_fmt <<
+			cmn_reg->decode_format_shift_val);
+
+	/*enable early eof based on crop enable */
+	if (!(csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_DISABLE_EARLY_EOF) &&
+		cmn_reg->early_eof_supported &&
+		path_cfg->crop_enable)
+		val |= (1 << path_reg->early_eof_en_shift_val);
+
+	if (cmn_reg->drop_supported)
+		val |= (path_cfg->drop_enable <<
+				path_reg->drop_v_en_shift_val) |
+			(path_cfg->drop_enable <<
+				path_reg->drop_h_en_shift_val);
+
+	val |= (1 << path_reg->pix_store_en_shift_val) |
+		(1 << path_reg->timestamp_en_shift_val);
+
+	val |= (path_cfg->crop_enable << path_reg->crop_h_en_shift_val) |
+		(path_cfg->crop_enable <<
+		 path_reg->crop_v_en_shift_val);
+
+	if ((path_reg->binning_supported & CAM_IFE_CSID_BIN_HORIZONTAL) &&
+		path_cfg->horizontal_bin)
+		val |= 1 << path_reg->bin_h_en_shift_val;
+
+	if ((path_reg->binning_supported & CAM_IFE_CSID_BIN_VERTICAL) &&
+		path_cfg->vertical_bin)
+		val |= 1 << path_reg->bin_v_en_shift_val;
+
+	if ((path_reg->binning_supported & CAM_IFE_CSID_BIN_QCFA) &&
+		path_cfg->qcfa_bin)
+		val |=  1 << path_reg->bin_qcfa_en_shift_val;
+
+	if ((path_cfg->qcfa_bin || path_cfg->vertical_bin ||
+		path_cfg->horizontal_bin) && path_reg->binning_supported)
+		val |= 1 << path_reg->bin_en_shift_val;
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO)
+		val |= 1 << path_reg->format_measure_en_shift_val;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] cfg0_addr val %x",
+		csid_hw->hw_intf->hw_idx, val);
+
+	cam_io_w_mb(val, mem_base + path_reg->cfg0_addr);
+
+	/*Configure Multi VC DT combo */
+	if (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid) {
+		val = (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].vc <<
+				cmn_reg->multi_vcdt_vc1_shift_val) |
+			(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].dt <<
+				 cmn_reg->multi_vcdt_dt1_shift_val) |
+			(1 << cmn_reg->multi_vcdt_en_shift_val);
+		cam_io_w_mb(val, mem_base + path_reg->multi_vcdt_cfg0_addr);
+	}
+
+	/*configure cfg1 addr
+	 * timestamp strobe selection
+	 */
+
+	val = cmn_reg->timestamp_strobe_val <<
+		cmn_reg->timestamp_stb_sel_shift_val;
+
+	cam_io_w_mb(val, mem_base + path_reg->cfg1_addr);
+
+	if (path_cfg->crop_enable) {
+		val = (((path_cfg->end_pixel & cmn_reg->crop_pix_start_mask) <<
+			cmn_reg->crop_shift_val) |
+			(path_cfg->start_pixel & cmn_reg->crop_pix_end_mask));
+		cam_io_w_mb(val, mem_base + path_reg->hcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Horizontal crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		val = (((path_cfg->end_line & cmn_reg->crop_line_start_mask) <<
+			csid_reg->cmn_reg->crop_shift_val) |
+			(path_cfg->start_line & cmn_reg->crop_line_end_mask));
+		cam_io_w_mb(val, mem_base + path_reg->vcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Vertical Crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+	}
+
+	/* set frame drop pattern to 0 and period to 1 */
+	cam_io_w_mb(1, mem_base + path_reg->frm_drop_period_addr);
+	cam_io_w_mb(0, mem_base + path_reg->frm_drop_pattern_addr);
+	/* set irq sub sample pattern to 0 and period to 1 */
+	cam_io_w_mb(1, mem_base + path_reg->irq_subsample_period_addr);
+	cam_io_w_mb(0, mem_base + path_reg->irq_subsample_pattern_addr);
+	/* set pxl drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, mem_base + path_reg->pix_drop_pattern_addr);
+	cam_io_w_mb(1, mem_base + path_reg->pix_drop_period_addr);
+	/* set line drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, mem_base + path_reg->line_drop_pattern_addr);
+	cam_io_w_mb(1, mem_base + path_reg->line_drop_period_addr);
+
+	if (path_reg->overflow_ctrl_en) {
+		val = path_reg->overflow_ctrl_en |
+			path_reg->overflow_ctrl_mode_val;
+		cam_io_w_mb(val, mem_base + path_reg->err_recovery_cfg0_addr);
+	}
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(mem_base +
+			path_reg->format_measure_cfg0_addr);
+		val |= csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val,
+			mem_base + path_reg->format_measure_cfg0_addr);
+	}
+
+	/* Enable the Pxl path */
+	val = cam_io_r_mb(mem_base + path_reg->cfg0_addr);
+	val |= (1 << cmn_reg->path_en_shift_val);
+	cam_io_w_mb(val, mem_base + path_reg->cfg0_addr);
+	CAM_DBG(CAM_ISP, "%s cfg0 0x%x", res->res_name, val);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	return rc;
+}
+
+static int cam_ife_csid_ver1_enable_hw(struct cam_ife_csid_ver1_hw *csid_hw)
+{
+	int rc = 0;
+	struct cam_hw_soc_info              *soc_info;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	uint32_t clk_lvl, i, val;
+	unsigned long flags;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+
+	/* overflow check before increment */
+	if (csid_hw->hw_info->open_count == UINT_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Open count reached max",
+			csid_hw->hw_intf->hw_idx);
+			mutex_unlock(&csid_hw->hw_info->hw_mutex);
+		return -EINVAL;
+	}
+
+	/* Increment ref Count */
+	csid_hw->hw_info->open_count++;
+
+	if (csid_hw->hw_info->open_count > 1) {
+		CAM_DBG(CAM_ISP, "CSID hw has already been enabled");
+		mutex_unlock(&csid_hw->hw_info->hw_mutex);
+		return rc;
+	}
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+
+	rc = cam_soc_util_get_clk_level(soc_info, csid_hw->clk_rate,
+		soc_info->src_clk_idx, &clk_lvl);
+
+	CAM_DBG(CAM_ISP,
+		"CSID[%d] clk lvl %u received clk_rate %u applied clk_rate %lu rc %d",
+		csid_hw->hw_intf->hw_idx, clk_lvl, csid_hw->clk_rate,
+		soc_info->applied_src_clk_rates.sw_client, rc);
+
+	rc = cam_ife_csid_enable_soc_resources(soc_info, clk_lvl);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d Enable SOC failed",
+			csid_hw->hw_intf->hw_idx);
+		goto err;
+	}
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_UP;
+
+	rc = cam_ife_csid_ver1_global_reset(csid_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%d] global reset failed");
+		goto disable_soc;
+	}
+
+
+	/* Clear IRQs */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_clear_addr);
+
+	cam_io_w_mb(csid_reg->csi2_reg->irq_mask_all,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(csid_reg->cmn_reg->ppp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->irq_clear_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->rdi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->irq_clear_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_udis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->udi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[i]->irq_clear_addr);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->irq_cmd_addr);
+
+	/* Read hw version */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->hw_version_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d Enabled CSID HW version: 0x%x",
+		csid_hw->hw_intf->hw_idx, val);
+	memset(&csid_hw->timestamp, 0, sizeof(struct cam_ife_csid_timestamp));
+	spin_lock_irqsave(&csid_hw->lock_state, flags);
+	csid_hw->flags.fatal_err_detected = false;
+	csid_hw->flags.device_enabled = true;
+	spin_unlock_irqrestore(&csid_hw->lock_state, flags);
+	cam_tasklet_start(csid_hw->tasklet);
+
+	return rc;
+
+disable_soc:
+	cam_ife_csid_disable_soc_resources(soc_info);
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+err:
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	csid_hw->hw_info->open_count--;
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+int cam_ife_csid_ver1_init_hw(void *hw_priv,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_ver1_hw *csid_hw  = NULL;
+	struct cam_isp_resource_node           *res;
+	struct cam_hw_info *hw_info;
+	int rc = 0;
+
+	if (!hw_priv || !init_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_info->core_info;
+
+	rc = cam_ife_csid_ver1_enable_hw(csid_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d Enable hw fail",
+			csid_hw->hw_intf->hw_idx);
+		return rc;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	res = (struct cam_isp_resource_node *)init_args;
+	if (res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res tpe:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((res->res_type == CAM_ISP_RESOURCE_PIX_PATH) &&
+		(res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED)) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d res type:%d res_id:%dInvalid state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res type :%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+	res  = (struct cam_isp_resource_node *)init_args;
+
+	switch (res->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		rc = cam_ife_csid_ver1_init_config_pxl_path(
+			csid_hw, res);
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+		rc = cam_ife_csid_ver1_init_config_rdi_path(
+			csid_hw, res);
+		break;
+	case CAM_IFE_PIX_PATH_RES_UDI_0:
+	case CAM_IFE_PIX_PATH_RES_UDI_1:
+	case CAM_IFE_PIX_PATH_RES_UDI_2:
+		rc = cam_ife_csid_ver1_init_config_udi_path(
+			csid_hw, res);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid Res id %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		rc = -EINVAL;
+		break;
+	}
+
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d res_id:%d path init configuration failed with rc: %d",
+			csid_hw->hw_intf->hw_idx, res->res_id, rc);
+		goto end;
+	}
+
+	rc = cam_ife_csid_ver1_hw_reset(csid_hw);
+
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "CSID:%d Failed in HW reset",
+			csid_hw->hw_intf->hw_idx);
+
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+
+	return 0;
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_ver1_disable_csi2(
+	struct cam_ife_csid_ver1_hw  *csid_hw)
+{
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (!csid_hw->flags.rx_enabled)	{
+		CAM_DBG(CAM_ISP, "CSID:%d Rx already disabled",
+			csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	/* Disable the CSI2 rx inerrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->irq_mask_addr);
+
+	/* Reset the Rx CFG registers */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->cfg0_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->cfg1_addr);
+	csid_hw->flags.rx_enabled = false;
+
+	CAM_DBG(CAM_ISP, "CSID:%d Disable csi2 rx",
+		csid_hw->hw_intf->hw_idx);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_disable_hw(
+	struct cam_ife_csid_ver1_hw *csid_hw)
+{
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	int rc = 0;
+	unsigned long                             flags;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	/* Check for refcount */
+	if (!csid_hw->hw_info->open_count) {
+		CAM_WARN(CAM_ISP, "Unbalanced disable_hw");
+		mutex_unlock(&csid_hw->hw_info->hw_mutex);
+		return rc;
+	}
+
+	/* Decrement ref Count */
+	csid_hw->hw_info->open_count--;
+
+	if (csid_hw->hw_info->open_count) {
+		mutex_unlock(&csid_hw->hw_info->hw_mutex);
+		return rc;
+	}
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	cam_ife_csid_ver1_disable_csi2(csid_hw);
+	cam_ife_csid_ver1_global_reset(csid_hw);
+	/* Disable the top IRQ interrupt */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_mask_addr);
+
+	cam_tasklet_stop(csid_hw->tasklet);
+	rc = cam_ife_csid_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CSID:%d Disable CSID SOC failed",
+			csid_hw->hw_intf->hw_idx);
+
+	spin_lock_irqsave(&csid_hw->lock_state, flags);
+	csid_hw->flags.device_enabled = false;
+	spin_unlock_irqrestore(&csid_hw->lock_state, flags);
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	csid_hw->counters.error_irq_count = 0;
+
+	return rc;
+}
+
+int cam_ife_csid_ver1_deinit_hw(void *hw_priv,
+	void *deinit_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_ver1_hw *csid_hw  = NULL;
+	struct cam_isp_resource_node           *res;
+	struct cam_hw_info *hw_info;
+	int rc = 0;
+
+	if (!hw_priv || !deinit_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID:Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_info->core_info;
+	res = (struct cam_isp_resource_node *)deinit_args;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid Res type %d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "CSID:%d Res:%d already in De-init state",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	switch (res->res_id) {
+	case  CAM_IFE_PIX_PATH_RES_IPP:
+	case  CAM_IFE_PIX_PATH_RES_PPP:
+		rc = cam_ife_csid_ver1_deinit_pxl_path(csid_hw, res);
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+		rc = cam_ife_csid_ver1_deinit_rdi_path(csid_hw, res);
+		break;
+	case CAM_IFE_PIX_PATH_RES_UDI_0:
+	case CAM_IFE_PIX_PATH_RES_UDI_1:
+	case CAM_IFE_PIX_PATH_RES_UDI_2:
+		rc = cam_ife_csid_ver1_deinit_udi_path(csid_hw, res);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type%d",
+			csid_hw->hw_intf->hw_idx, res->res_type);
+		break;
+	}
+
+	/* Disable CSID HW */
+	cam_ife_csid_ver1_disable_hw(csid_hw);
+	CAM_DBG(CAM_ISP, "De-Init CSID %d Path: %d",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	return rc;
+}
+
+int cam_ife_csid_ver1_start(void *hw_priv, void *args,
+			uint32_t arg_size)
+{
+	struct cam_ife_csid_ver1_hw *csid_hw  = NULL;
+	struct cam_isp_resource_node           *res;
+	struct cam_hw_info *hw_info;
+	struct cam_csid_hw_start_args         *start_args;
+	int rc = 0;
+	uint32_t i = 0;
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_info->core_info;
+	start_args = (struct cam_csid_hw_start_args *)args;
+
+	csid_hw->flags.sof_irq_triggered = false;
+	csid_hw->counters.irq_debug_cnt = 0;
+
+	CAM_DBG(CAM_ISP, "CSID:%d num_res %u",
+		csid_hw->hw_intf->hw_idx, start_args->num_res);
+
+	cam_ife_csid_ver1_enable_csi2(csid_hw);
+
+	if (csid_hw->res_type == CAM_ISP_IFE_IN_RES_TPG)
+		cam_ife_csid_ver1_tpg_start(csid_hw);
+
+	for (i = 0; i < start_args->num_res; i++) {
+
+		res = start_args->node_res[i];
+		if (!res || res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+			CAM_ERR(CAM_ISP, "CSID:%d: res: %p, res type: %d",
+				csid_hw->hw_intf->hw_idx, res, (res) ? res->res_type : -1);
+			rc = -EINVAL;
+			goto end;
+		}
+		CAM_DBG(CAM_ISP, "CSID:%d res_type :%d res: %s",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_name);
+
+		switch (res->res_id) {
+		case  CAM_IFE_PIX_PATH_RES_IPP:
+		case  CAM_IFE_PIX_PATH_RES_PPP:
+			rc = cam_ife_csid_ver1_start_pix_path(csid_hw, res);
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+		case CAM_IFE_PIX_PATH_RES_RDI_4:
+			rc = cam_ife_csid_ver1_start_rdi_path(csid_hw, res);
+			break;
+		case CAM_IFE_PIX_PATH_RES_UDI_0:
+		case CAM_IFE_PIX_PATH_RES_UDI_1:
+		case CAM_IFE_PIX_PATH_RES_UDI_2:
+			rc = cam_ife_csid_ver1_start_udi_path(csid_hw, res);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid res type%d",
+					csid_hw->hw_intf->hw_idx, res->res_type);
+			rc = -EINVAL;
+			break;
+		}
+	}
+
+	if (rc && res)
+		CAM_ERR(CAM_ISP, "CSID:%d start fail res type:%d res id:%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+	if (!rc)
+		csid_hw->flags.reset_awaited = false;
+end:
+	return rc;
+}
+
+static int cam_ife_csid_poll_stop_status(
+	struct cam_ife_csid_ver1_hw          *csid_hw,
+	uint32_t                         res_mask)
+{
+	int rc = 0, id;
+	uint32_t status_addr = 0, val = 0, res_id = 0;
+	const struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	for (; res_id < CAM_IFE_PIX_PATH_RES_MAX; res_id++, res_mask >>= 1) {
+		if ((res_mask & 0x1) == 0)
+			continue;
+		val = 0;
+
+		if (res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+			status_addr =
+			csid_reg->ipp_reg->status_addr;
+		} else if (res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+			status_addr =
+				csid_reg->ppp_reg->status_addr;
+		} else if (res_id == CAM_IFE_PIX_PATH_RES_RDI_0 ||
+			res_id == CAM_IFE_PIX_PATH_RES_RDI_1 ||
+			res_id == CAM_IFE_PIX_PATH_RES_RDI_2 ||
+			res_id == CAM_IFE_PIX_PATH_RES_RDI_3 ||
+			res_id == CAM_IFE_PIX_PATH_RES_RDI_4) {
+			status_addr =
+				csid_reg->rdi_reg[res_id]->status_addr;
+		} else if (res_id == CAM_IFE_PIX_PATH_RES_UDI_0 ||
+			res_id == CAM_IFE_PIX_PATH_RES_UDI_1 ||
+			res_id == CAM_IFE_PIX_PATH_RES_UDI_2) {
+			id = res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+			status_addr =
+				csid_reg->udi_reg[id]->status_addr;
+		} else {
+			CAM_ERR(CAM_ISP, "Invalid res_id: %u", res_id);
+			rc = -EINVAL;
+			break;
+		}
+
+		CAM_DBG(CAM_ISP, "start polling CSID:%d res_id:%d",
+			csid_hw->hw_intf->hw_idx, res_id);
+
+		rc = cam_common_read_poll_timeout(
+			    soc_info->reg_map[0].mem_base +
+			    status_addr,
+			    CAM_IFE_CSID_TIMEOUT_SLEEP_US,
+			    CAM_IFE_CSID_TIMEOUT_ALL_US,
+			    0x1, 0x1, &val);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "CSID:%d res:%d halt failed rc %d",
+				csid_hw->hw_intf->hw_idx, res_id, rc);
+			rc = -ETIMEDOUT;
+			break;
+		}
+
+		CAM_DBG(CAM_ISP, "End polling CSID:%d res_id:%d",
+			csid_hw->hw_intf->hw_idx, res_id);
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_change_pxl_halt_mode(
+	struct cam_ife_csid_ver1_hw       *csid_hw,
+	struct cam_ife_csid_hw_halt_args  *csid_halt)
+{
+	uint32_t val = 0;
+	const struct cam_ife_csid_ver1_reg_info    *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_isp_resource_node               *res;
+
+	res = csid_halt->node_res;
+
+	csid_reg = csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id != CAM_IFE_PIX_PATH_RES_IPP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "CSID:%d Res:%d in invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->ipp_reg->irq_mask_addr);
+
+	/* configure Halt for slave */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->ipp_reg->ctrl_addr);
+	val &= ~0xC;
+	val |= (csid_halt->halt_mode << 2);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->ipp_reg->ctrl_addr);
+	CAM_DBG(CAM_ISP, "CSID:%d IPP path Res halt mode:%d configured:%x",
+		csid_hw->hw_intf->hw_idx, csid_halt->halt_mode, val);
+
+	return 0;
+}
+
+int cam_ife_csid_halt(struct cam_ife_csid_ver1_hw *csid_hw,
+		void *halt_args)
+{
+	struct cam_isp_resource_node         *res;
+	struct cam_ife_csid_hw_halt_args     *csid_halt;
+	int rc = 0;
+
+	if (!csid_hw || !halt_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_halt = (struct cam_ife_csid_hw_halt_args *)halt_args;
+
+	/* Change the halt mode */
+	res = csid_halt->node_res;
+	CAM_DBG(CAM_ISP, "CSID:%d res_type %d res_id %d",
+		csid_hw->hw_intf->hw_idx,
+		res->res_type, res->res_id);
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	switch (res->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		rc = cam_ife_csid_change_pxl_halt_mode(csid_hw, csid_halt);
+		break;
+	default:
+		CAM_DBG(CAM_ISP, "CSID:%d res_id %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_ife_csid_ver1_stop(void *hw_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_ver1_hw *csid_hw  = NULL;
+	struct cam_isp_resource_node           *res;
+	struct cam_hw_info *hw_info;
+	int rc = 0;
+	uint32_t i;
+	struct cam_csid_hw_stop_args         *csid_stop;
+	uint32_t res_mask = 0;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_csid_hw_stop_args))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_stop = (struct cam_csid_hw_stop_args  *) stop_args;
+
+	if (!csid_stop->num_res) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_info->core_info;
+	CAM_DBG(CAM_ISP, "CSID:%d num_res %d",
+		csid_hw->hw_intf->hw_idx,
+		csid_stop->num_res);
+	cam_ife_csid_ver1_tpg_stop(csid_hw);
+	/* Stop the resource first */
+	for (i = 0; i < csid_stop->num_res; i++) {
+
+		res = csid_stop->node_res[i];
+		res_mask |= (1 << res->res_id);
+		CAM_DBG(CAM_ISP, "CSID:%d res_type %d Resource[id:%d name:%s]",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_name);
+
+		switch (res->res_id) {
+		case CAM_IFE_PIX_PATH_RES_IPP:
+		case CAM_IFE_PIX_PATH_RES_PPP:
+			rc = cam_ife_csid_ver1_stop_pxl_path(csid_hw,
+				res, csid_stop->stop_cmd);
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+		case CAM_IFE_PIX_PATH_RES_RDI_4:
+			rc = cam_ife_csid_ver1_stop_rdi_path(csid_hw,
+				res, csid_stop->stop_cmd);
+			break;
+		case CAM_IFE_PIX_PATH_RES_UDI_0:
+		case CAM_IFE_PIX_PATH_RES_UDI_1:
+		case CAM_IFE_PIX_PATH_RES_UDI_2:
+			rc = cam_ife_csid_ver1_stop_udi_path(csid_hw,
+				res, csid_stop->stop_cmd);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid res_id: %u",
+				res->res_id);
+			break;
+		}
+	}
+
+	if (res_mask)
+		rc = cam_ife_csid_poll_stop_status(csid_hw, res_mask);
+
+	for (i = 0; i < csid_stop->num_res; i++) {
+		res = csid_stop->node_res[i];
+		res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+	}
+
+	csid_hw->counters.error_irq_count = 0;
+
+	return rc;
+}
+
+int cam_ife_csid_ver1_read(void *hw_priv,
+	void *read_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+
+	return -EINVAL;
+}
+
+int cam_ife_csid_ver1_write(void *hw_priv,
+	void *write_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+	return -EINVAL;
+}
+
+static int cam_ife_csid_ver1_sof_irq_debug(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	void *cmd_args)
+{
+	int i = 0;
+	uint32_t val = 0;
+	bool sof_irq_enable = false;
+	struct cam_hw_soc_info                  *soc_info;
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+	uint32_t data_idx;
+
+	if (*((uint32_t *)cmd_args) == 1)
+		sof_irq_enable = true;
+
+	if (csid_hw->hw_info->hw_state ==
+		CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP,
+			"CSID powered down unable to %s sof irq",
+			(sof_irq_enable) ? "enable" : "disable");
+		return 0;
+	}
+
+	data_idx = csid_hw->rx_cfg.phy_sel;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	for (i = 0; i < csid_reg->cmn_reg->num_pix; i++) {
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->irq_mask_addr);
+
+		if (sof_irq_enable)
+			val |= IFE_CSID_VER1_PATH_INFO_INPUT_SOF;
+		else
+			val &= ~IFE_CSID_VER1_PATH_INFO_INPUT_SOF;
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->irq_mask_addr);
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->irq_mask_addr);
+
+		if (sof_irq_enable)
+			val |= IFE_CSID_VER1_PATH_INFO_INPUT_SOF;
+		else
+			val &= ~IFE_CSID_VER1_PATH_INFO_INPUT_SOF;
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->irq_mask_addr);
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_udis; i++) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[i]->irq_mask_addr);
+
+		if (sof_irq_enable)
+			val |= IFE_CSID_VER1_PATH_INFO_INPUT_SOF;
+		else
+			val &= ~IFE_CSID_VER1_PATH_INFO_INPUT_SOF;
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[i]->irq_mask_addr);
+	}
+
+	if (sof_irq_enable) {
+		csid_hw->debug_info.path_mask |=
+			IFE_CSID_VER1_PATH_INFO_INPUT_SOF;
+		csid_hw->debug_info.debug_val |=
+			CAM_IFE_CSID_DEBUG_ENABLE_SOF_IRQ;
+		csid_hw->flags.sof_irq_triggered = true;
+	} else {
+		csid_hw->debug_info.path_mask &=
+			~IFE_CSID_VER1_PATH_INFO_INPUT_SOF;
+		csid_hw->debug_info.debug_val &=
+			~CAM_IFE_CSID_DEBUG_ENABLE_SOF_IRQ;
+		csid_hw->flags.sof_irq_triggered = false;
+	}
+
+	CAM_INFO(CAM_ISP, "SOF freeze: CSID SOF irq %s",
+		(sof_irq_enable) ? "enabled" : "disabled");
+
+	CAM_INFO(CAM_ISP, "Notify CSIPHY: %d",
+			csid_hw->rx_cfg.phy_sel);
+
+	cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+		CAM_SUBDEV_MESSAGE_REG_DUMP, (void *)&data_idx);
+
+	return 0;
+}
+
+
+static int cam_ife_csid_ver1_print_hbi_vbi(
+	struct cam_ife_csid_ver1_hw  *csid_hw,
+	struct cam_isp_resource_node *res)
+{
+	struct cam_ife_csid_ver1_path_reg_info      *path_reg = NULL;
+	struct cam_ife_csid_ver1_reg_info           *csid_reg;
+	struct cam_hw_soc_info                      *soc_info;
+	uint32_t                                     hbi, vbi;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID[%u] Invalid res_type:%d res [id: %d name: %s]",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id, res->res_name);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	switch (res->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		path_reg = csid_reg->ipp_reg;
+		break;
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		path_reg = csid_reg->ppp_reg;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+		path_reg = csid_reg->rdi_reg[res->res_id];
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID[%u] invalid res %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID[%u] invalid res: %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	hbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		path_reg->format_measure1_addr);
+	vbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		path_reg->format_measure2_addr);
+	CAM_INFO_RATE_LIMIT(CAM_ISP,
+		"CSID[%u] res[id: %d name: %s] hbi 0x%x vbi 0x%x",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_name,
+		hbi, vbi);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_get_time_stamp(
+	struct cam_ife_csid_ver1_hw  *csid_hw, void *cmd_args)
+{
+	struct cam_isp_resource_node         *res = NULL;
+	uint64_t time_lo, time_hi;
+	struct cam_hw_soc_info              *soc_info;
+	struct cam_csid_get_time_stamp_args *timestamp_args;
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct timespec64 ts;
+	uint32_t curr_0_sof_addr, curr_1_sof_addr;
+
+	timestamp_args = (struct cam_csid_get_time_stamp_args *)cmd_args;
+	res = timestamp_args->node_res;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	switch (res->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		curr_0_sof_addr = csid_reg->ipp_reg->timestamp_curr0_sof_addr;
+		curr_1_sof_addr = csid_reg->ipp_reg->timestamp_curr1_sof_addr;
+		break;
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		curr_0_sof_addr = csid_reg->ppp_reg->timestamp_curr0_sof_addr;
+		curr_1_sof_addr = csid_reg->ppp_reg->timestamp_curr1_sof_addr;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+		curr_0_sof_addr =
+			csid_reg->rdi_reg
+			[res->res_id]->timestamp_curr0_sof_addr;
+		curr_1_sof_addr =
+			csid_reg->rdi_reg
+			[res->res_id]->timestamp_curr1_sof_addr;
+	break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d invalid res %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	time_hi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			curr_1_sof_addr);
+	time_lo = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			curr_0_sof_addr);
+	timestamp_args->time_stamp_val = (time_hi << 32) | time_lo;
+
+	timestamp_args->time_stamp_val = mul_u64_u32_div(
+		timestamp_args->time_stamp_val,
+		CAM_IFE_CSID_QTIMER_MUL_FACTOR,
+		CAM_IFE_CSID_QTIMER_DIV_FACTOR);
+
+	if (qtime_to_boottime == 0) {
+		ktime_get_boottime_ts64(&ts);
+		qtime_to_boottime =
+			(uint64_t)((ts.tv_sec * 1000000000) +
+			ts.tv_nsec) - (int64_t)timestamp_args->time_stamp_val;
+	}
+
+	timestamp_args->boot_timestamp = timestamp_args->time_stamp_val +
+		qtime_to_boottime;
+	CAM_DBG(CAM_ISP, "timestamp:%lld",
+		timestamp_args->boot_timestamp);
+	csid_hw->timestamp.prev_sof_ts = timestamp_args->time_stamp_val;
+	csid_hw->timestamp.prev_boot_ts = timestamp_args->boot_timestamp;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_set_csid_clock(
+	struct cam_ife_csid_ver1_hw          *csid_hw,
+	void *cmd_args)
+{
+	struct cam_ife_csid_clock_update_args *clk_update = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	clk_update =
+		(struct cam_ife_csid_clock_update_args *)cmd_args;
+
+	csid_hw->clk_rate = clk_update->clk_rate;
+
+	return 0;
+}
+
+int cam_ife_csid_ver1_set_csid_qcfa(
+	struct cam_ife_csid_ver1_hw  *csid_hw,
+	void *cmd_args)
+{
+	struct  cam_ife_csid_ver1_path_cfg *path_cfg = NULL;
+	struct cam_ife_csid_qcfa_update_args *qcfa_update = NULL;
+	struct cam_isp_resource_node *res = NULL;
+
+	if (!csid_hw || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid param %pK %pK",
+			csid_hw, cmd_args);
+		return -EINVAL;
+	}
+
+	qcfa_update =
+		(struct cam_ife_csid_qcfa_update_args *)cmd_args;
+	res = qcfa_update->res;
+
+	if (!res) {
+		CAM_ERR(CAM_ISP, "CSID[%u] NULL res",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	path_cfg = (struct  cam_ife_csid_ver1_path_cfg *)res->res_priv;
+
+	if (!path_cfg) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid res_id %u",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	path_cfg->qcfa_bin = qcfa_update->qcfa_binning;
+
+	CAM_DBG(CAM_ISP, "CSID %u QCFA binning %d",
+		csid_hw->hw_intf->hw_idx,
+		path_cfg->qcfa_bin);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_dump_hw(
+	struct cam_ife_csid_ver1_hw *csid_hw, void *cmd_args)
+{
+	int                             i;
+	uint8_t                        *dst;
+	uint32_t                       *addr, *start;
+	uint32_t                        min_len;
+	uint32_t                        num_reg;
+	size_t                          remain_len;
+	struct cam_isp_hw_dump_header  *hdr;
+	struct cam_isp_hw_dump_args    *dump_args =
+		(struct cam_isp_hw_dump_args *)cmd_args;
+	struct cam_hw_soc_info         *soc_info;
+
+	if (!dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+	if (!dump_args->cpu_addr || !dump_args->buf_len) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params %pK %zu",
+			(void *)dump_args->cpu_addr,
+			dump_args->buf_len);
+		return -EINVAL;
+	}
+	soc_info = &csid_hw->hw_info->soc_info;
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ISP,
+			"Dump offset overshoot offset %zu buf_len %zu",
+			dump_args->offset, dump_args->buf_len);
+		return -ENOSPC;
+	}
+	min_len = soc_info->reg_map[0].size +
+		sizeof(struct cam_isp_hw_dump_header) +
+		sizeof(uint32_t);
+	remain_len = dump_args->buf_len - dump_args->offset;
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu, min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "CSID_REG:");
+	addr = (uint32_t *)(dst + sizeof(struct cam_isp_hw_dump_header));
+
+	start = addr;
+	num_reg = soc_info->reg_map[0].size/4;
+	hdr->word_size = sizeof(uint32_t);
+	*addr = soc_info->index;
+	addr++;
+	for (i = 0; i < num_reg; i++) {
+		addr[0] = soc_info->mem_block[0]->start + (i*4);
+		addr[1] = cam_io_r(soc_info->reg_map[0].mem_base
+			+ (i*4));
+		addr += 2;
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+	CAM_DBG(CAM_ISP, "offset %zu", dump_args->offset);
+	return 0;
+}
+
+static int cam_ife_csid_log_acquire_data(
+	struct cam_ife_csid_ver1_hw *csid_hw, void *cmd_args)
+{
+	struct cam_isp_resource_node          *res = NULL;
+	struct cam_hw_soc_info                *soc_info;
+	struct cam_ife_csid_ver1_reg_info     *csid_reg;
+	struct cam_ife_csid_ver1_path_cfg     *path_cfg = NULL;
+	struct cam_ife_csid_ver1_path_reg_info *rdi_reg = NULL;
+	uint32_t byte_cnt_ping, byte_cnt_pong;
+
+	res = (struct cam_isp_resource_node *)cmd_args;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d invalid res id:%d res type: %d state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_type,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	path_cfg = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv;
+	/* Dump all the acquire data for this hardware */
+	CAM_INFO(CAM_ISP,
+		"CSID:%d res id:%d type:%d state:%d in f:%d out f:%d st pix:%d end pix:%d st line:%d end line:%d h bin:%d qcfa bin:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_type,
+		res->res_type, path_cfg->in_format, path_cfg->out_format,
+		path_cfg->start_pixel, path_cfg->end_pixel,
+		path_cfg->start_line, path_cfg->end_line,
+		path_cfg->horizontal_bin, path_cfg->qcfa_bin);
+
+	if (res->res_id >= CAM_IFE_PIX_PATH_RES_RDI_0  &&
+		res->res_id <= CAM_IFE_PIX_PATH_RES_RDI_3) {
+		rdi_reg = csid_reg->rdi_reg[res->res_id];
+		/* read total number of bytes transmitted through RDI */
+		byte_cnt_ping = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->byte_cntr_ping_addr);
+		byte_cnt_pong = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->byte_cntr_pong_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID:%d res id:%d byte cnt val ping:%d pong:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			byte_cnt_ping, byte_cnt_pong);
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_dump_csid_clock(
+	struct cam_ife_csid_ver1_hw *csid_hw, void *cmd_args)
+{
+	if (!csid_hw)
+		return -EINVAL;
+
+	CAM_INFO(CAM_ISP, "CSID:%d clock rate %llu",
+		csid_hw->hw_intf->hw_idx,
+		csid_hw->clk_rate);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_process_cmd(void *hw_priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_ver1_hw          *csid_hw;
+	struct cam_hw_info                   *hw_info;
+	struct cam_isp_resource_node         *res = NULL;
+
+	if (!hw_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_info->core_info;
+
+	switch (cmd_type) {
+	case CAM_IFE_CSID_CMD_GET_TIME_STAMP:
+		rc = cam_ife_csid_ver1_get_time_stamp(csid_hw, cmd_args);
+
+		if (csid_hw->debug_info.debug_val &
+				CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+			res = ((struct cam_csid_get_time_stamp_args *)
+				cmd_args)->node_res;
+			cam_ife_csid_ver1_print_hbi_vbi(csid_hw, res);
+		}
+
+		break;
+	case CAM_IFE_CSID_SET_CSID_DEBUG:
+		rc = cam_ife_csid_ver1_set_debug(csid_hw,
+			*((uint32_t *)cmd_args));
+		break;
+	case CAM_IFE_CSID_SOF_IRQ_DEBUG:
+		rc = cam_ife_csid_ver1_sof_irq_debug(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE:
+		rc = cam_ife_csid_ver1_set_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_QCFA_SUPPORTED:
+		rc = cam_ife_csid_ver1_set_csid_qcfa(csid_hw,
+			cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_HW:
+		rc = cam_ife_csid_ver1_dump_hw(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CLOCK_DUMP:
+		rc = cam_ife_csid_ver1_dump_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_IFE_CSID_TOP_CONFIG:
+		break;
+	case CAM_IFE_CSID_SET_DUAL_SYNC_CONFIG:
+		break;
+	case CAM_IFE_CSID_LOG_ACQUIRE_DATA:
+		cam_ife_csid_log_acquire_data(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE:
+		rc = cam_ife_csid_halt(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_DISCARD_INIT_FRAMES:
+		/* Not supported for V1 */
+		rc = 0;
+		break;
+	case CAM_ISP_HW_CMD_DRV_CONFIG:
+		/* Not supported for V1 */
+		rc = 0;
+		break;
+	case CAM_IFE_CSID_RESET_OUT_OF_SYNC_CNT:
+		/* Not supported for V1 */
+		rc = 0;
+		break;
+	case CAM_ISP_HW_CMD_CSID_DUMP_CROP_REG:
+		/* Not supported in V1*/
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d unsupported cmd:%d",
+			csid_hw->hw_intf->hw_idx, cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+
+}
+
+static int cam_ife_csid_ver1_handle_rx_debug_event(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	uint32_t bit_pos)
+{
+	struct cam_hw_soc_info              *soc_info;
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+	const struct cam_ife_csid_csi2_rx_reg_info *csi2_reg;
+	uint32_t mask, val;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csi2_reg = csid_reg->csi2_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	mask  = BIT(bit_pos);
+
+	switch (mask) {
+	case IFE_CSID_VER1_RX_LONG_PKT_CAPTURED:
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_long_pkt_0_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"Csid :%d Long pkt VC: %d DT: %d WC: %d",
+			csid_hw->hw_intf->hw_idx,
+			(val & csi2_reg->vc_mask) >> 22,
+			(val & csi2_reg->dt_mask) >> 16,
+			val & csi2_reg->wc_mask);
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_long_pkt_1_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"Csid :%d Long pkt ECC: %d",
+			csid_hw->hw_intf->hw_idx, val);
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_long_pkt_ftr_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"Csid :%d Long pkt cal CRC: %d expected CRC: %d",
+			csid_hw->hw_intf->hw_idx,
+			val & csi2_reg->calc_crc_mask,
+			val & csi2_reg->expected_crc_mask);
+		break;
+
+	case IFE_CSID_VER1_RX_SHORT_PKT_CAPTURED:
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_short_pkt_0_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"Csid :%d Short pkt VC: %d DT: %d LC: %d",
+			csid_hw->hw_intf->hw_idx,
+			(val & csi2_reg->vc_mask) >> 22,
+			(val & csi2_reg->dt_mask) >> 16,
+			val & csi2_reg->wc_mask);
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_short_pkt_1_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"Csid :%d Short pkt ECC: %d",
+			csid_hw->hw_intf->hw_idx, val);
+		break;
+	case IFE_CSID_VER1_RX_CPHY_PKT_HDR_CAPTURED:
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_cphy_pkt_hdr_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"Csid :%d CPHY pkt VC: %d DT: %d LC: %d",
+			csid_hw->hw_intf->hw_idx,
+			(val & csi2_reg->vc_mask) >> 22,
+			(val & csi2_reg->dt_mask) >> 16,
+			val & csi2_reg->wc_mask);
+		break;
+	case IFE_CSID_VER1_RX_UNMAPPED_VC_DT:
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->cap_unmap_long_pkt_hdr_0_addr);
+
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID:%d UNMAPPED_VC_DT: VC:%d DT:%d WC:%d not mapped to any csid paths",
+			csid_hw->hw_intf->hw_idx, (val >> 22),
+			((val >> 16) & 0x3F), (val & 0xFFFF));
+
+		csid_hw->counters.error_irq_count++;
+
+		CAM_DBG(CAM_ISP, "CSID[%u] Recoverable Error Count:%u",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->counters.error_irq_count);
+		break;
+	default:
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID[%d] RX_IRQ: %s",
+			csid_hw->hw_intf->hw_idx,
+			ver1_rx_irq_desc[bit_pos].desc);
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_handle_event_err(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_ife_csid_ver1_evt_payload *evt_payload,
+	uint32_t err_type)
+{
+	struct cam_isp_hw_error_event_info err_evt_info;
+	struct cam_isp_hw_event_info event_info = {0};
+	int rc = 0;
+
+	event_info.hw_idx = evt_payload->hw_idx;
+	err_evt_info.err_type = err_type;
+	event_info.hw_type = CAM_ISP_HW_TYPE_CSID;
+	event_info.event_data = (void *)&err_evt_info;
+
+	CAM_DBG(CAM_ISP, "CSID[%d] Error type %d",
+		csid_hw->hw_intf->hw_idx, err_type);
+
+	rc = csid_hw->event_cb(csid_hw->token,
+		CAM_ISP_HW_EVENT_ERROR, (void *)&event_info);
+
+	return rc;
+}
+
+static int cam_ife_csid_ver1_put_evt_payload(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_ife_csid_ver1_evt_payload **evt_payload,
+	struct list_head    *payload_list)
+{
+	unsigned long flags;
+
+	if (*evt_payload == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+	spin_lock_irqsave(&csid_hw->lock_state, flags);
+	list_add_tail(&(*evt_payload)->list,
+		payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&csid_hw->lock_state, flags);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_get_evt_payload(
+	struct cam_ife_csid_ver1_hw *csid_hw,
+	struct cam_ife_csid_ver1_evt_payload **evt_payload,
+	struct list_head    *payload_list)
+{
+
+	spin_lock(&csid_hw->lock_state);
+
+	if (list_empty(payload_list)) {
+		*evt_payload = NULL;
+		spin_unlock(&csid_hw->lock_state);
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -ENOMEM;
+	}
+
+	*evt_payload = list_first_entry(payload_list,
+			struct cam_ife_csid_ver1_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	spin_unlock(&csid_hw->lock_state);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_rx_bottom_half_handler(
+		struct cam_ife_csid_ver1_hw *csid_hw,
+		struct cam_ife_csid_ver1_evt_payload *evt_payload)
+{
+	const struct cam_ife_csid_csi2_rx_reg_info *csi2_reg;
+	struct cam_ife_csid_ver1_reg_info          *csid_reg;
+	uint8_t                                    *log_buf = NULL;
+	uint32_t                                    irq_status;
+	uint32_t                                    val;
+	uint32_t                                    event_type = 0;
+	size_t                                      len = 0;
+	struct cam_hw_soc_info                     *soc_info;
+	uint32_t                                    data_idx;
+
+	if (!csid_hw || !evt_payload) {
+		CAM_ERR(CAM_ISP,
+			"Invalid Param handler_priv %pK evt_payload_priv %pK",
+			csid_hw, evt_payload);
+		return -EINVAL;
+	}
+
+	data_idx = csid_hw->rx_cfg.phy_sel;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csi2_reg = csid_reg->csi2_reg;
+
+	irq_status = evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RX]
+			& csi2_reg->fatal_err_mask;
+	log_buf = csid_hw->log_buf;
+	memset(log_buf, 0, sizeof(csid_hw->log_buf));
+
+	CAM_INFO(CAM_ISP, "IRQ_Status: 0x%x",
+		evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RX]);
+
+	if (irq_status) {
+		CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len, "Fatal Errors:\n");
+
+		if (irq_status & IFE_CSID_VER1_RX_LANE0_FIFO_OVERFLOW) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_LANE_FIFO_OVERFLOW;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"RX_ERROR_LANE0_FIFO_OVERFLOW: Skew/Less Data on lanes/ Slow csid clock:%luHz\n",
+				soc_info->applied_src_clk_rates.sw_client);
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_LANE1_FIFO_OVERFLOW) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_LANE_FIFO_OVERFLOW;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"RX_ERROR_LANE1_FIFO_OVERFLOW: Skew/Less Data on lanes/ Slow csid clock:%luHz\n",
+				soc_info->applied_src_clk_rates.sw_client);
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_LANE2_FIFO_OVERFLOW) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_LANE_FIFO_OVERFLOW;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"RX_ERROR_LANE2_FIFO_OVERFLOW: Skew/Less Data on lanes/ Slow csid clock:%luHz\n",
+				soc_info->applied_src_clk_rates.sw_client);
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_LANE3_FIFO_OVERFLOW) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_LANE_FIFO_OVERFLOW;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"RX_ERROR_LANE3_FIFO_OVERFLOW: Skew/Less Data on lanes/ Slow csid clock:%luHz\n",
+				soc_info->applied_src_clk_rates.sw_client);
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_TG_FIFO_OVERFLOW) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"RX_ERROR_TPG_FIFO_OVERFLOW: Backpressure from IFE\n");
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_CPHY_PH_CRC) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_PKT_HDR_CORRUPTED;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"CPHY_PH_CRC: Pkt Hdr CRC mismatch\n");
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_STREAM_UNDERFLOW) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_MISSING_PKT_HDR_DATA;
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csi2_reg->captured_long_pkt_0_addr);
+
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"ERROR_STREAM_UNDERFLOW: Fewer bytes rcvd than WC:%d in pkt hdr\n",
+				val & 0xFFFF);
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_ERROR_ECC) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_PKT_HDR_CORRUPTED;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"DPHY_ERROR_ECC: Pkt hdr errors unrecoverable\n");
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_UNBOUNDED_FRAME) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_UNBOUNDED_FRAME;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"UNBOUNDED_FRAME: Frame started with EOF or No EOF\n");
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_CPHY_EOT_RECEPTION) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_MISSING_EOT;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"CPHY_EOT_RECEPTION: No EOT on lane/s, is_EPD: %d, PHY_Type: %s(%u)\n",
+				csid_hw->rx_cfg.epd_supported,
+				(csid_hw->rx_cfg.lane_type) ? "cphy" : "dphy",
+				csid_hw->rx_cfg.lane_type);
+		}
+
+		if (irq_status & IFE_CSID_VER1_RX_ERROR_CRC) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_PKT_PAYLOAD_CORRUPTED;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"CPHY_ERROR_CRC: Long pkt payload CRC mismatch\n");
+		}
+	}
+
+	irq_status = evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+		csi2_reg->part_fatal_err_mask;
+
+	if (irq_status) {
+		CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+			"Recoverable-errors:\n");
+
+		if (irq_status & IFE_CSID_VER1_RX_CPHY_SOT_RECEPTION) {
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"CPHY_SOT_RECEPTION: Less SOTs on lane/s\n");
+		}
+	}
+
+	irq_status = evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+		csi2_reg->non_fatal_err_mask;
+
+	if (irq_status) {
+		CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+			"Non-fatal errors:\n");
+		if (irq_status & IFE_CSID_VER1_RX_MMAPPED_VC_DT) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csi2_reg->captured_long_pkt_0_addr);
+
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"MMAPPED_VC_DT: VC:%d DT:%d mapped to more than 1 csid paths\n",
+				(val >> 22), ((val >> 16) & 0x3F));
+		}
+	}
+
+	if (len)
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID[%u] %s",
+			csid_hw->hw_intf->hw_idx, log_buf);
+
+	if ((!csid_hw->flags.reset_awaited) && csid_hw->flags.fatal_err_detected) {
+		if (!event_type)
+			event_type |= CAM_ISP_HW_ERROR_CSID_FATAL;
+
+		cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+			CAM_SUBDEV_MESSAGE_REG_DUMP,
+			(void *)&data_idx);
+
+		cam_ife_csid_ver1_handle_event_err(csid_hw, evt_payload, event_type);
+		csid_hw->flags.reset_awaited = true;
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int cam_ife_csid_ver1_path_bottom_half_handler(
+	const struct cam_ife_csid_ver1_path_reg_info  *path_reg,
+	struct cam_ife_csid_ver1_evt_payload          *evt_payload,
+	struct cam_ife_csid_ver1_hw                   *csid_hw,
+	uint32_t                                       index)
+{
+	const uint8_t                               **irq_reg_tag;
+	uint8_t                                     *log_buf = NULL;
+	uint32_t                                     bit_pos = 0;
+	uint32_t                                     irq_status;
+	size_t                                       len = 0;
+
+	if (!csid_hw || !evt_payload) {
+		CAM_ERR(CAM_ISP,
+			"Invalid Param csid_hw %pK evt_payload %pK",
+			csid_hw, evt_payload);
+		return 0;
+	}
+
+	irq_status = evt_payload->irq_status[index] & path_reg->fatal_err_mask;
+	bit_pos = 0;
+	log_buf = csid_hw->log_buf;
+	memset(log_buf, 0, sizeof(csid_hw->log_buf));
+	irq_reg_tag = cam_ife_csid_get_irq_reg_tag_ptr();
+
+	while (irq_status) {
+		if ((irq_status & 0x1))
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"%s\n", ver1_path_irq_desc[bit_pos]);
+		bit_pos++;
+		irq_status >>= 1;
+	}
+
+	if (len)
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID[%u] %s: %s",
+			csid_hw->hw_intf->hw_idx,
+			irq_reg_tag[index],
+			log_buf);
+
+	if (evt_payload->irq_status[index] &
+		IFE_CSID_VER1_PATH_ERROR_FIFO_OVERFLOW)
+		cam_ife_csid_ver1_handle_event_err(csid_hw,
+			evt_payload, CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_bottom_half_handler(
+		void *handler_priv,
+		void *evt_payload_priv)
+{
+	const struct cam_ife_csid_ver1_path_reg_info  *path_reg;
+	struct cam_ife_csid_ver1_evt_payload          *evt_payload;
+	struct cam_ife_csid_ver1_reg_info             *csid_reg;
+	struct cam_ife_csid_ver1_hw                   *csid_hw;
+	int                                            i;
+	int                                            id = 0;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid Param handler_priv %pK evt_payload_priv %pK",
+			handler_priv, evt_payload_priv);
+		return -EINVAL;
+	}
+
+	csid_hw = (struct cam_ife_csid_ver1_hw *)handler_priv;
+	evt_payload = (struct cam_ife_csid_ver1_evt_payload *)evt_payload_priv;
+
+	if (evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RX])
+		cam_ife_csid_ver1_rx_bottom_half_handler(
+			csid_hw, evt_payload);
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	for (i = CAM_IFE_CSID_IRQ_REG_RDI_0; i < CAM_IFE_CSID_IRQ_REG_MAX;
+		i++) {
+
+		if (!evt_payload->irq_status[i])
+			continue;
+
+		switch (i) {
+		case  CAM_IFE_CSID_IRQ_REG_IPP:
+			path_reg = csid_reg->ipp_reg;
+			break;
+		case  CAM_IFE_CSID_IRQ_REG_PPP:
+			path_reg = csid_reg->ppp_reg;
+			break;
+		case  CAM_IFE_CSID_IRQ_REG_RDI_0:
+		case  CAM_IFE_CSID_IRQ_REG_RDI_1:
+		case  CAM_IFE_CSID_IRQ_REG_RDI_2:
+		case  CAM_IFE_CSID_IRQ_REG_RDI_3:
+		case  CAM_IFE_CSID_IRQ_REG_RDI_4:
+			id = i - CAM_IFE_CSID_IRQ_REG_RDI_0;
+			path_reg = csid_reg->rdi_reg[id];
+			break;
+		case  CAM_IFE_CSID_IRQ_REG_UDI_0:
+		case  CAM_IFE_CSID_IRQ_REG_UDI_1:
+		case  CAM_IFE_CSID_IRQ_REG_UDI_2:
+			id = i - CAM_IFE_CSID_IRQ_REG_UDI_0;
+			path_reg = csid_reg->udi_reg[id];
+			break;
+		default:
+			path_reg = NULL;
+			break;
+		}
+
+		if (!path_reg)
+			continue;
+
+		cam_ife_csid_ver1_path_bottom_half_handler(
+			path_reg, evt_payload, csid_hw, i);
+	}
+
+	cam_ife_csid_ver1_put_evt_payload(csid_hw, &evt_payload,
+		&csid_hw->free_payload_list);
+
+	return IRQ_HANDLED;
+}
+
+static int cam_ife_csid_ver1_rx_top_half(
+	uint32_t                             *irq_status,
+	struct cam_ife_csid_ver1_hw          *csid_hw,
+	uint32_t                             *need_bh_sched)
+{
+	const struct cam_ife_csid_csi2_rx_reg_info *csi2_reg;
+	struct cam_ife_csid_ver1_reg_info          *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	uint32_t                                    status = 0;
+	uint32_t                                    debug_bits;
+	uint32_t                                    bit_pos = 0;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csi2_reg = csid_reg->csi2_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->irq_status_addr);
+
+	if (csid_hw->rx_cfg.epd_supported)
+		status = status & (~IFE_CSID_VER1_RX_CPHY_EOT_RECEPTION);
+
+	irq_status[CAM_IFE_CSID_IRQ_REG_RX] = status;
+
+	if (!status)
+		return IRQ_HANDLED;
+
+	cam_io_w_mb(status,
+		soc_info->reg_map[0].mem_base +
+		csi2_reg->irq_clear_addr);
+
+	if (csid_hw->flags.process_reset)
+		return 0;
+
+	if (status & BIT(csi2_reg->rst_done_shift_val)) {
+		CAM_DBG(CAM_ISP, "CSID[%d] rx_reset done",
+			csid_hw->hw_intf->hw_idx);
+		complete(&csid_hw->irq_complete
+			[CAM_IFE_CSID_IRQ_REG_RX]);
+		return IRQ_HANDLED;
+	}
+
+	if (csid_hw->flags.fatal_err_detected) {
+		CAM_DBG(CAM_ISP, "CSID[%u] already handling fatal error",
+			csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	if (status & csi2_reg->fatal_err_mask) {
+		csid_hw->flags.fatal_err_detected = true;
+		cam_ife_csid_ver1_disable_csi2(csid_hw);
+	}
+
+	if (status & csi2_reg->part_fatal_err_mask) {
+		if (status & IFE_CSID_VER1_RX_CPHY_SOT_RECEPTION)
+			csid_hw->counters.error_irq_count++;
+
+		CAM_DBG(CAM_ISP, "CSID[%u] Recoverable Error Count:%u",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->counters.error_irq_count);
+
+		if (csid_hw->counters.error_irq_count > CAM_IFE_CSID_MAX_ERR_COUNT) {
+			csid_hw->flags.fatal_err_detected = true;
+			cam_ife_csid_ver1_disable_csi2(csid_hw);
+		}
+	}
+
+	debug_bits = status & csid_hw->debug_info.rx_mask;
+
+	while (debug_bits) {
+
+		if (debug_bits & 0x1)
+			cam_ife_csid_ver1_handle_rx_debug_event(csid_hw,
+				bit_pos);
+		bit_pos++;
+		debug_bits >>= 1;
+	}
+
+	*need_bh_sched = status & (csi2_reg->fatal_err_mask |
+				csi2_reg->part_fatal_err_mask |
+				csi2_reg->non_fatal_err_mask);
+
+	return IRQ_HANDLED;
+}
+
+static int cam_ife_csid_ver1_path_top_half(
+	uint32_t                             *irq_status,
+	struct cam_ife_csid_ver1_hw          *csid_hw,
+	uint32_t                             *need_bh,
+	uint32_t                              index)
+{
+	struct cam_ife_csid_ver1_path_reg_info *path_reg = NULL;
+	struct cam_ife_csid_ver1_reg_info      *csid_reg;
+	struct cam_hw_soc_info                 *soc_info;
+	const uint8_t                         **irq_reg_tag;
+	uint32_t                                status = 0;
+	uint32_t                                debug_bits;
+	uint32_t                                bit_pos = 0;
+	int                                     id = 0;
+	uint32_t                                sof_irq_debug_en = 0;
+	uint32_t                                val , val1;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	switch (index) {
+	case CAM_IFE_CSID_IRQ_REG_IPP:
+		path_reg = csid_reg->ipp_reg;
+		break;
+	case CAM_IFE_CSID_IRQ_REG_PPP:
+		path_reg = csid_reg->ppp_reg;
+		break;
+	case CAM_IFE_CSID_IRQ_REG_RDI_0:
+	case CAM_IFE_CSID_IRQ_REG_RDI_1:
+	case CAM_IFE_CSID_IRQ_REG_RDI_2:
+	case CAM_IFE_CSID_IRQ_REG_RDI_3:
+	case CAM_IFE_CSID_IRQ_REG_RDI_4:
+		id = index - CAM_IFE_CSID_IRQ_REG_RDI_0;
+		path_reg = csid_reg->rdi_reg[id];
+		break;
+	case CAM_IFE_CSID_IRQ_REG_UDI_0:
+	case CAM_IFE_CSID_IRQ_REG_UDI_1:
+	case CAM_IFE_CSID_IRQ_REG_UDI_2:
+		id = index - CAM_IFE_CSID_IRQ_REG_UDI_0;
+		path_reg = csid_reg->udi_reg[id];
+		break;
+	default:
+		break;
+	}
+
+	if (!path_reg)
+		return 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			path_reg->irq_status_addr);
+	cam_io_w_mb(status,
+		soc_info->reg_map[0].mem_base +
+		path_reg->irq_clear_addr);
+
+	irq_status[index] = status;
+
+	if (csid_hw->flags.process_reset)
+		return 0;
+
+	if (status & BIT(csid_reg->cmn_reg->rst_done_shift_val)) {
+		CAM_DBG(CAM_ISP, "irq_reg:%d  reset done", index);
+		complete(&csid_hw->irq_complete[index]);
+		return 0;
+	}
+
+	if (csid_hw->flags.sof_irq_triggered &&
+		(status & IFE_CSID_VER1_PATH_INFO_INPUT_SOF)) {
+		csid_hw->counters.irq_debug_cnt++;
+	}
+
+	if ((status & IFE_CSID_VER1_PATH_ERROR_PIX_COUNT ) ||
+		(status & IFE_CSID_VER1_PATH_ERROR_LINE_COUNT)) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				path_reg->format_measure0_addr);
+		val1 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				path_reg->format_measure_cfg1_addr);
+		CAM_ERR(CAM_ISP,
+			"Expected:: h:  0x%x w: 0x%x actual:: h: 0x%x w: 0x%x [format_measure0: 0x%x]",
+			((val1 >>
+			csid_reg->cmn_reg->format_measure_height_shift_val) &
+			csid_reg->cmn_reg->format_measure_height_mask_val),
+			val1 &
+			csid_reg->cmn_reg->format_measure_width_mask_val,
+			((val >>
+			csid_reg->cmn_reg->format_measure_height_shift_val) &
+			csid_reg->cmn_reg->format_measure_height_mask_val),
+			val &
+			csid_reg->cmn_reg->format_measure_width_mask_val,
+			val);
+	}
+
+	if (status & path_reg->fatal_err_mask)
+		cam_io_w_mb(CAM_CSID_HALT_IMMEDIATELY,
+			soc_info->reg_map[0].mem_base +
+			path_reg->ctrl_addr);
+
+	debug_bits = status & csid_hw->debug_info.path_mask;
+	irq_reg_tag = cam_ife_csid_get_irq_reg_tag_ptr();
+
+	while (debug_bits) {
+		if ((debug_bits & 0x1))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID[%d] IRQ %s %s ",
+				csid_hw->hw_intf->hw_idx,
+				irq_reg_tag[index],
+				ver1_path_irq_desc[bit_pos]);
+
+		bit_pos++;
+		debug_bits >>= 1;
+	}
+
+	*need_bh = status & (path_reg->fatal_err_mask |
+			path_reg->non_fatal_err_mask);
+
+	if (csid_hw->counters.irq_debug_cnt >= CAM_CSID_IRQ_SOF_DEBUG_CNT_MAX) {
+		cam_ife_csid_ver1_sof_irq_debug(csid_hw, &sof_irq_debug_en);
+		csid_hw->counters.irq_debug_cnt = 0;
+	}
+
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t cam_ife_csid_irq(int irq_num, void *data)
+{
+	struct cam_ife_csid_ver1_evt_payload  *evt_payload = NULL;
+	struct cam_ife_csid_ver1_reg_info     *csid_reg;
+	struct cam_ife_csid_ver1_hw           *csid_hw;
+	struct cam_hw_soc_info                *soc_info;
+	void                                  *bh_cmd = NULL;
+	unsigned long                          flags;
+	uint32_t                               status[CAM_IFE_CSID_IRQ_REG_MAX];
+	uint32_t                               need_rx_bh = 0;
+	uint32_t                               need_path_bh = 0;
+	uint32_t                               need_bh_sched = 0;
+	int                                    i;
+	int                                    rc = 0;
+
+	csid_hw = (struct cam_ife_csid_ver1_hw *)data;
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	memset(status, 0, sizeof(status));
+
+	spin_lock_irqsave(&csid_hw->hw_info->hw_lock, flags);
+
+	status[CAM_IFE_CSID_IRQ_REG_TOP] =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_status_addr);
+	cam_io_w_mb(status[CAM_IFE_CSID_IRQ_REG_TOP],
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_clear_addr);
+
+	for (i = CAM_IFE_CSID_IRQ_REG_RX; i < CAM_IFE_CSID_IRQ_REG_MAX; i++) {
+
+		switch (i) {
+		case CAM_IFE_CSID_IRQ_REG_RX:
+			cam_ife_csid_ver1_rx_top_half(
+				status, csid_hw, &need_rx_bh);
+			break;
+		case  CAM_IFE_CSID_IRQ_REG_IPP:
+		case  CAM_IFE_CSID_IRQ_REG_PPP:
+		case  CAM_IFE_CSID_IRQ_REG_RDI_0:
+		case  CAM_IFE_CSID_IRQ_REG_RDI_1:
+		case  CAM_IFE_CSID_IRQ_REG_RDI_2:
+		case  CAM_IFE_CSID_IRQ_REG_RDI_3:
+		case  CAM_IFE_CSID_IRQ_REG_RDI_4:
+		case  CAM_IFE_CSID_IRQ_REG_UDI_0:
+		case  CAM_IFE_CSID_IRQ_REG_UDI_1:
+		case  CAM_IFE_CSID_IRQ_REG_UDI_2:
+			cam_ife_csid_ver1_path_top_half(
+				status, csid_hw, &need_path_bh, i);
+			break;
+		default:
+			break;
+		}
+		need_bh_sched |= (need_rx_bh | need_path_bh);
+	}
+
+	if (status[CAM_IFE_CSID_IRQ_REG_TOP] & IFE_CSID_VER1_TOP_IRQ_DONE) {
+		csid_hw->flags.process_reset = false;
+		goto handle_top_reset;
+	}
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->irq_cmd_addr);
+	spin_unlock_irqrestore(
+		&csid_hw->hw_info->hw_lock, flags);
+
+	if (!need_bh_sched)
+		return IRQ_HANDLED;
+
+	rc = cam_ife_csid_ver1_get_evt_payload(csid_hw, &evt_payload,
+		&csid_hw->free_payload_list);
+
+	if (!evt_payload) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID[%u], no free tasklet rc %d",
+			csid_hw->hw_intf->hw_idx, rc);
+		return IRQ_HANDLED;
+	}
+
+
+	rc = tasklet_bh_api.get_bh_payload_func(csid_hw->tasklet, &bh_cmd);
+
+	if (rc || !bh_cmd) {
+		cam_ife_csid_ver1_put_evt_payload(csid_hw, &evt_payload,
+			&csid_hw->free_payload_list);
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID[%d] Can not get cmd for tasklet, status %x",
+			csid_hw->hw_intf->hw_idx,
+			status[CAM_IFE_CSID_IRQ_REG_TOP]);
+		return IRQ_HANDLED;
+	}
+
+	evt_payload->priv = csid_hw->token;
+	evt_payload->hw_idx = csid_hw->hw_intf->hw_idx;
+
+	for (i = 0; i < CAM_IFE_CSID_IRQ_REG_MAX; i++)
+		evt_payload->irq_status[i] = status[i];
+
+	tasklet_bh_api.bottom_half_enqueue_func(csid_hw->tasklet,
+		bh_cmd,
+		csid_hw,
+		evt_payload,
+		cam_ife_csid_ver1_bottom_half_handler);
+
+	return IRQ_HANDLED;
+
+handle_top_reset:
+	CAM_DBG(CAM_ISP, "csid top reset complete");
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->irq_cmd_addr);
+	spin_unlock_irqrestore(
+		&csid_hw->hw_info->hw_lock, flags);
+	complete(&csid_hw->irq_complete[CAM_IFE_CSID_IRQ_REG_TOP]);
+	return IRQ_HANDLED;
+}
+
+static void cam_ife_csid_ver1_free_res(struct cam_ife_csid_ver1_hw *ife_csid_hw)
+{
+	struct cam_isp_resource_node *res;
+	uint32_t num_paths;
+	int i;
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			ife_csid_hw->core_info->csid_reg;
+	num_paths = csid_reg->cmn_reg->num_udis;
+
+	for (i = 0; i < num_paths; i++) {
+		res = &ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_UDI_0 + i];
+		kfree(res->res_priv);
+		res->res_priv = NULL;
+	}
+
+	num_paths = csid_reg->cmn_reg->num_rdis;
+
+	for (i = 0; i < num_paths; i++) {
+		res = &ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_RDI_0 + i];
+		kfree(res->res_priv);
+		res->res_priv = NULL;
+	}
+
+	kfree(ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_IPP].res_priv);
+	ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_IPP].res_priv = NULL;
+	kfree(ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_PPP].res_priv);
+	ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_PPP].res_priv = NULL;
+}
+
+static int cam_ife_ver1_hw_alloc_res(
+	struct cam_isp_resource_node *res,
+	uint32_t res_type,
+	struct cam_hw_intf   *hw_intf,
+	uint32_t res_id)
+
+{
+	struct cam_ife_csid_ver1_path_cfg *path_cfg = NULL;
+
+	path_cfg = kzalloc(sizeof(*path_cfg), GFP_KERNEL);
+
+	if (!path_cfg)
+		return -ENOMEM;
+
+	res->res_id = res_id;
+	res->res_type = res_type;
+	res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	res->hw_intf = hw_intf;
+	res->res_priv = path_cfg;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver1_hw_init_path_res(
+	struct cam_ife_csid_ver1_hw   *ife_csid_hw)
+{
+	int rc = 0;
+	int i;
+	struct cam_ife_csid_ver1_reg_info *csid_reg;
+	struct cam_isp_resource_node *res;
+
+	csid_reg = (struct cam_ife_csid_ver1_reg_info *)
+			ife_csid_hw->core_info->csid_reg;
+
+	/* Initialize the IPP resources */
+	if (csid_reg->cmn_reg->num_pix) {
+		res = &ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_IPP];
+		rc = cam_ife_ver1_hw_alloc_res(
+			res,
+			CAM_ISP_RESOURCE_PIX_PATH,
+			ife_csid_hw->hw_intf,
+			CAM_IFE_PIX_PATH_RES_IPP);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID: %d IPP res init fail",
+				ife_csid_hw->hw_intf->hw_idx);
+			goto free_res;
+		}
+		scnprintf(res->res_name, CAM_ISP_RES_NAME_LEN, "IPP");
+	}
+
+	/* Initialize PPP resource */
+	if (csid_reg->cmn_reg->num_ppp) {
+		res = &ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_PPP];
+		rc = cam_ife_ver1_hw_alloc_res(
+			res,
+			CAM_ISP_RESOURCE_PIX_PATH,
+			ife_csid_hw->hw_intf,
+			CAM_IFE_PIX_PATH_RES_PPP);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID: %d PPP res init fail",
+				ife_csid_hw->hw_intf->hw_idx);
+			goto free_res;
+		}
+		scnprintf(res->res_name,
+				CAM_ISP_RES_NAME_LEN, "PPP");
+	}
+
+	/* Initialize the RDI resource */
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		/* res type is from RDI 0 to RDI3 */
+		res = &ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_RDI_0 + i];
+		rc = cam_ife_ver1_hw_alloc_res(
+			res,
+			CAM_ISP_RESOURCE_PIX_PATH,
+			ife_csid_hw->hw_intf,
+			CAM_IFE_PIX_PATH_RES_RDI_0 + i);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID: %d RDI[%d] res init fail",
+				ife_csid_hw->hw_intf->hw_idx, i);
+			goto free_res;
+		}
+		scnprintf(res->res_name, CAM_ISP_RES_NAME_LEN, "RDI_%d", i);
+	}
+
+	/* Initialize the UDI resource */
+	for (i = 0; i < csid_reg->cmn_reg->num_udis; i++) {
+		/* res type is from UDI0 to UDI3 */
+		res = &ife_csid_hw->path_res[CAM_IFE_PIX_PATH_RES_UDI_0 + i];
+		rc = cam_ife_ver1_hw_alloc_res(
+			res,
+			CAM_ISP_RESOURCE_PIX_PATH,
+			ife_csid_hw->hw_intf,
+			CAM_IFE_PIX_PATH_RES_UDI_0 + i);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID: %d UDI[%d] res init fail",
+				ife_csid_hw->hw_intf->hw_idx, i);
+			goto free_res;
+		}
+		scnprintf(res->res_name, CAM_ISP_RES_NAME_LEN, "UDI_%d", i);
+	}
+
+	return rc;
+
+free_res:
+	cam_ife_csid_ver1_free_res(ife_csid_hw);
+	return rc;
+}
+
+int cam_ife_csid_hw_ver1_init(struct cam_hw_intf  *hw_intf,
+	struct cam_ife_csid_core_info *csid_core_info,
+	bool is_custom)
+{
+	int                             rc = -EINVAL;
+	uint32_t                        i;
+	struct cam_hw_info             *hw_info;
+	struct cam_ife_csid_ver1_hw    *ife_csid_hw = NULL;
+
+	if (!hw_intf || !csid_core_info) {
+		CAM_ERR(CAM_ISP, "Invalid parameters intf: %pK hw_info: %pK",
+			hw_intf, csid_core_info);
+		return rc;
+	}
+
+	hw_info = (struct cam_hw_info  *)hw_intf->hw_priv;
+
+	ife_csid_hw = kzalloc(sizeof(struct cam_ife_csid_ver1_hw), GFP_KERNEL);
+
+	if (!ife_csid_hw) {
+		CAM_ERR(CAM_ISP, "Csid core %d hw allocation fails",
+			hw_intf->hw_idx);
+		return -ENOMEM;
+	}
+
+	ife_csid_hw->hw_intf = hw_intf;
+	ife_csid_hw->hw_info = hw_info;
+	ife_csid_hw->core_info = csid_core_info;
+	hw_info->core_info = ife_csid_hw;
+
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		hw_intf->hw_type,
+		hw_intf->hw_idx);
+
+	ife_csid_hw->flags.device_enabled = false;
+	ife_csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&ife_csid_hw->hw_info->hw_mutex);
+	spin_lock_init(&ife_csid_hw->hw_info->hw_lock);
+	spin_lock_init(&ife_csid_hw->lock_state);
+	init_completion(&ife_csid_hw->hw_info->hw_complete);
+
+	for (i = 0; i < CAM_IFE_CSID_IRQ_REG_MAX; i++)
+		init_completion(&ife_csid_hw->irq_complete[i]);
+
+	rc = cam_ife_csid_init_soc_resources(&ife_csid_hw->hw_info->soc_info,
+			cam_ife_csid_irq, NULL, ife_csid_hw, is_custom);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d Failed to init_soc",
+			hw_intf->hw_idx);
+		return rc;
+	}
+
+	if (cam_cpas_is_feature_supported(CAM_CPAS_QCFA_BINNING_ENABLE,
+		CAM_CPAS_HW_IDX_ANY, NULL))
+		ife_csid_hw->flags.binning_enabled = true;
+
+	ife_csid_hw->hw_intf->hw_ops.get_hw_caps =
+						cam_ife_csid_ver1_get_hw_caps;
+	ife_csid_hw->hw_intf->hw_ops.init        = cam_ife_csid_ver1_init_hw;
+	ife_csid_hw->hw_intf->hw_ops.deinit      = cam_ife_csid_ver1_deinit_hw;
+	ife_csid_hw->hw_intf->hw_ops.reset       = cam_ife_csid_ver1_reset;
+	ife_csid_hw->hw_intf->hw_ops.reserve     = cam_ife_csid_ver1_reserve;
+	ife_csid_hw->hw_intf->hw_ops.release     = cam_ife_csid_ver1_release;
+	ife_csid_hw->hw_intf->hw_ops.start       = cam_ife_csid_ver1_start;
+	ife_csid_hw->hw_intf->hw_ops.stop        = cam_ife_csid_ver1_stop;
+	ife_csid_hw->hw_intf->hw_ops.read        = cam_ife_csid_ver1_read;
+	ife_csid_hw->hw_intf->hw_ops.write       = cam_ife_csid_ver1_write;
+	ife_csid_hw->hw_intf->hw_ops.process_cmd =
+						cam_ife_csid_ver1_process_cmd;
+
+	rc = cam_ife_csid_ver1_hw_init_path_res(ife_csid_hw);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%d] Probe Init failed",
+			hw_intf->hw_idx);
+		return rc;
+	}
+
+	rc  = cam_tasklet_init(&ife_csid_hw->tasklet, ife_csid_hw,
+			hw_intf->hw_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%d] init tasklet failed",
+			hw_intf->hw_idx);
+		goto err;
+	}
+
+	INIT_LIST_HEAD(&ife_csid_hw->free_payload_list);
+	for (i = 0; i < CAM_IFE_CSID_VER1_EVT_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&ife_csid_hw->evt_payload[i].list);
+		list_add_tail(&ife_csid_hw->evt_payload[i].list,
+			&ife_csid_hw->free_payload_list);
+	}
+
+	ife_csid_hw->debug_info.debug_val = 0;
+	ife_csid_hw->counters.error_irq_count = 0;
+
+	return 0;
+err:
+	cam_ife_csid_ver1_free_res(ife_csid_hw);
+	return rc;
+}
+EXPORT_SYMBOL(cam_ife_csid_hw_ver1_init);
+
+int cam_ife_csid_hw_ver1_deinit(struct cam_hw_info *hw_priv)
+{
+	struct cam_ife_csid_ver1_hw   *csid_hw;
+	int rc = -EINVAL;
+
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param");
+		return rc;
+	}
+
+	csid_hw = (struct cam_ife_csid_ver1_hw *)hw_priv->core_info;
+
+	/* release the privdate data memory from resources */
+	cam_ife_csid_ver1_free_res(csid_hw);
+
+	cam_ife_csid_deinit_soc_resources(&csid_hw->hw_info->soc_info);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_ife_csid_hw_ver1_deinit);
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver1.h
@@ -0,0 +1,457 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_HW_VER1_H_
+#define _CAM_IFE_CSID_HW_VER1_H_
+
+#define IFE_CSID_VER1_RX_DL0_EOT_CAPTURED                  BIT(0)
+#define IFE_CSID_VER1_RX_DL1_EOT_CAPTURED                  BIT(1)
+#define IFE_CSID_VER1_RX_DL2_EOT_CAPTURED                  BIT(2)
+#define IFE_CSID_VER1_RX_DL3_EOT_CAPTURED                  BIT(3)
+#define IFE_CSID_VER1_RX_DL0_SOT_CAPTURED                  BIT(4)
+#define IFE_CSID_VER1_RX_DL1_SOT_CAPTURED                  BIT(5)
+#define IFE_CSID_VER1_RX_DL2_SOT_CAPTURED                  BIT(6)
+#define IFE_CSID_VER1_RX_DL3_SOT_CAPTURED                  BIT(7)
+#define IFE_CSID_VER1_RX_LONG_PKT_CAPTURED                 BIT(8)
+#define IFE_CSID_VER1_RX_SHORT_PKT_CAPTURED                BIT(9)
+#define IFE_CSID_VER1_RX_CPHY_PKT_HDR_CAPTURED             BIT(10)
+#define IFE_CSID_VER1_RX_CPHY_EOT_RECEPTION                BIT(11)
+#define IFE_CSID_VER1_RX_CPHY_SOT_RECEPTION                BIT(12)
+#define IFE_CSID_VER1_RX_CPHY_PH_CRC                       BIT(13)
+#define IFE_CSID_VER1_RX_WARNING_ECC                       BIT(14)
+#define IFE_CSID_VER1_RX_LANE0_FIFO_OVERFLOW               BIT(15)
+#define IFE_CSID_VER1_RX_LANE1_FIFO_OVERFLOW               BIT(16)
+#define IFE_CSID_VER1_RX_LANE2_FIFO_OVERFLOW               BIT(17)
+#define IFE_CSID_VER1_RX_LANE3_FIFO_OVERFLOW               BIT(18)
+#define IFE_CSID_VER1_RX_ERROR_CRC                         BIT(19)
+#define IFE_CSID_VER1_RX_ERROR_ECC                         BIT(20)
+#define IFE_CSID_VER1_RX_MMAPPED_VC_DT                     BIT(21)
+#define IFE_CSID_VER1_RX_UNMAPPED_VC_DT                    BIT(22)
+#define IFE_CSID_VER1_RX_STREAM_UNDERFLOW                  BIT(23)
+#define IFE_CSID_VER1_RX_UNBOUNDED_FRAME                   BIT(24)
+#define IFE_CSID_VER1_RX_TG_DONE                           BIT(25)
+#define IFE_CSID_VER1_RX_TG_FIFO_OVERFLOW                  BIT(26)
+#define IFE_CSID_VER1_RX_RST_DONE                          BIT(27)
+
+#define IFE_CSID_VER1_TOP_IRQ_DONE                         BIT(0)
+#define IFE_CSID_VER1_PATH_INFO_RST_DONE                   BIT(1)
+#define IFE_CSID_VER1_PATH_ERROR_FIFO_OVERFLOW             BIT(2)
+#define IFE_CSID_VER1_PATH_INFO_SUBSAMPLED_EOF             BIT(3)
+#define IFE_CSID_VER1_PATH_INFO_SUBSAMPLED_SOF             BIT(4)
+#define IFE_CSID_VER1_PATH_INFO_FRAME_DROP_EOF             BIT(5)
+#define IFE_CSID_VER1_PATH_INFO_FRAME_DROP_EOL             BIT(6)
+#define IFE_CSID_VER1_PATH_INFO_FRAME_DROP_SOL             BIT(7)
+#define IFE_CSID_VER1_PATH_INFO_FRAME_DROP_SOF             BIT(8)
+#define IFE_CSID_VER1_PATH_INFO_INPUT_EOF                  BIT(9)
+#define IFE_CSID_VER1_PATH_INFO_INPUT_EOL                  BIT(10)
+#define IFE_CSID_VER1_PATH_INFO_INPUT_SOL                  BIT(11)
+#define IFE_CSID_VER1_PATH_INFO_INPUT_SOF                  BIT(12)
+#define IFE_CSID_VER1_PATH_ERROR_PIX_COUNT                 BIT(13)
+#define IFE_CSID_VER1_PATH_ERROR_LINE_COUNT                BIT(14)
+#define IFE_CSID_VER1_PATH_ERROR_CCIF_VIOLATION            BIT(15)
+#define IFE_CSID_VER1_PATH_OVERFLOW_RECOVERY               BIT(17)
+
+#define CAM_IFE_CSID_VER1_EVT_PAYLOAD_MAX  256
+
+/*
+ * struct cam_ife_csid_ver1_common_reg_info: Structure to hold Common info
+ * holds register address offsets
+ * shift values
+ * masks
+ */
+struct cam_ife_csid_ver1_common_reg_info {
+	/* MIPI CSID registers */
+	uint32_t hw_version_addr;
+	uint32_t cfg0_addr;
+	uint32_t ctrl_addr;
+	uint32_t reset_addr;
+	uint32_t rst_strobes_addr;
+	uint32_t test_bus_ctrl_addr;
+	uint32_t top_irq_status_addr;
+	uint32_t top_irq_mask_addr;
+	uint32_t top_irq_clear_addr;
+	uint32_t top_irq_set_addr;
+	uint32_t irq_cmd_addr;
+
+	/*Shift Bit Configurations*/
+	uint32_t rst_done_shift_val;
+	uint32_t timestamp_stb_sel_shift_val;
+	uint32_t decode_format_shift_val;
+	uint32_t path_en_shift_val;
+	uint32_t dt_id_shift_val;
+	uint32_t vc_shift_val;
+	uint32_t dt_shift_val;
+	uint32_t fmt_shift_val;
+	uint32_t num_bytes_out_shift_val;
+	uint32_t crop_shift_val;
+	uint32_t debug_frm_drop_rst_shift_val;
+	uint32_t debug_timestamp_rst_shift_val;
+	uint32_t debug_format_measure_rst_shift_val;
+	uint32_t debug_misr_rst_shift_val;
+	uint32_t num_padding_pixels_shift_val;
+	uint32_t num_padding_rows_shift_val;
+	uint32_t fmt_measure_num_lines_shift_val;
+	uint32_t num_vbi_lines_shift_val;
+	uint32_t num_hbi_cycles_shift_val;
+	uint32_t multi_vcdt_vc1_shift_val;
+	uint32_t multi_vcdt_dt1_shift_val;
+	uint32_t multi_vcdt_ts_combo_en_shift_val;
+	uint32_t multi_vcdt_en_shift_val;
+
+	/* config Values */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t num_udis;
+	uint32_t num_rdis;
+	uint32_t num_pix;
+	uint32_t num_ppp;
+	uint32_t rst_sw_reg_stb;
+	uint32_t rst_hw_reg_stb;
+	uint32_t rst_sw_hw_reg_stb;
+	uint32_t path_rst_stb_all;
+	uint32_t drop_supported;
+	uint32_t multi_vcdt_supported;
+	uint32_t timestamp_strobe_val;
+	uint32_t early_eof_supported;
+	uint32_t global_reset;
+	uint32_t rup_supported;
+
+	/* Masks */
+	uint32_t ipp_irq_mask_all;
+	uint32_t rdi_irq_mask_all;
+	uint32_t ppp_irq_mask_all;
+	uint32_t udi_irq_mask_all;
+	uint32_t measure_en_hbi_vbi_cnt_mask;
+	uint32_t measure_pixel_line_en_mask;
+	uint32_t fmt_measure_num_line_mask;
+	uint32_t fmt_measure_num_pxl_mask;
+	uint32_t hblank_max_mask;
+	uint32_t hblank_min_mask;
+	uint32_t crop_pix_start_mask;
+	uint32_t crop_pix_end_mask;
+	uint32_t crop_line_start_mask;
+	uint32_t crop_line_end_mask;
+	uint32_t format_measure_height_mask_val;
+	uint32_t format_measure_height_shift_val;
+	uint32_t format_measure_width_mask_val;
+	uint32_t format_measure_width_shift_val;
+};
+
+/*
+ * struct cam_ife_csid_ver1_path_reg_info: Structure to hold PXL reg info
+ * holds register address offsets
+ * shift values
+ * masks
+ */
+struct cam_ife_csid_ver1_path_reg_info {
+	/* Pxl path register offsets*/
+	uint32_t irq_status_addr;
+	uint32_t irq_mask_addr;
+	uint32_t irq_clear_addr;
+	uint32_t irq_set_addr;
+
+	uint32_t cfg0_addr;
+	uint32_t cfg1_addr;
+	uint32_t ctrl_addr;
+	uint32_t frm_drop_pattern_addr;
+	uint32_t frm_drop_period_addr;
+	uint32_t irq_subsample_pattern_addr;
+	uint32_t irq_subsample_period_addr;
+	uint32_t hcrop_addr;
+	uint32_t vcrop_addr;
+	uint32_t pix_drop_pattern_addr;
+	uint32_t pix_drop_period_addr;
+	uint32_t line_drop_pattern_addr;
+	uint32_t line_drop_period_addr;
+	uint32_t rst_strobes_addr;
+	uint32_t status_addr;
+	uint32_t misr_val_addr;
+	uint32_t misr_val0_addr;
+	uint32_t misr_val1_addr;
+	uint32_t misr_val2_addr;
+	uint32_t misr_val3_addr;
+	uint32_t format_measure_cfg0_addr;
+	uint32_t format_measure_cfg1_addr;
+	uint32_t format_measure0_addr;
+	uint32_t format_measure1_addr;
+	uint32_t format_measure2_addr;
+	uint32_t yuv_chroma_conversion_addr;
+	uint32_t timestamp_curr0_sof_addr;
+	uint32_t timestamp_curr1_sof_addr;
+	uint32_t timestamp_prev0_sof_addr;
+	uint32_t timestamp_prev1_sof_addr;
+	uint32_t timestamp_curr0_eof_addr;
+	uint32_t timestamp_curr1_eof_addr;
+	uint32_t timestamp_prev0_eof_addr;
+	uint32_t timestamp_prev1_eof_addr;
+	uint32_t err_recovery_cfg0_addr;
+	uint32_t err_recovery_cfg1_addr;
+	uint32_t err_recovery_cfg2_addr;
+	uint32_t multi_vcdt_cfg0_addr;
+	uint32_t byte_cntr_ping_addr;
+	uint32_t byte_cntr_pong_addr;
+	/* shift bit configuration */
+	uint32_t timestamp_en_shift_val;
+	uint32_t crop_v_en_shift_val;
+	uint32_t crop_h_en_shift_val;
+	uint32_t drop_v_en_shift_val;
+	uint32_t drop_h_en_shift_val;
+	uint32_t bin_h_en_shift_val;
+	uint32_t bin_v_en_shift_val;
+	uint32_t bin_en_shift_val;
+	uint32_t bin_qcfa_en_shift_val;
+	uint32_t halt_mode_master;
+	uint32_t halt_mode_internal;
+	uint32_t halt_mode_global;
+	uint32_t halt_mode_slave;
+	uint32_t halt_mode_shift;
+	uint32_t halt_master_sel_master_val;
+	uint32_t halt_master_sel_shift;
+	uint32_t halt_frame_boundary;
+	uint32_t resume_frame_boundary;
+	uint32_t halt_immediate;
+	uint32_t halt_cmd_shift;
+	uint32_t mipi_pack_supported;
+	uint32_t packing_fmt_shift_val;
+	uint32_t format_measure_en_shift_val;
+	uint32_t plain_fmt_shift_val;
+	uint32_t packing_format;
+	uint32_t pix_store_en_shift_val;
+	uint32_t early_eof_en_shift_val;
+	/* config Values */
+	uint32_t ccif_violation_en;
+	uint32_t binning_supported;
+	uint32_t overflow_ctrl_mode_val;
+	uint32_t overflow_ctrl_en;
+	uint32_t fatal_err_mask;
+	uint32_t non_fatal_err_mask;
+};
+
+/*
+ * struct struct cam_ife_csid_ver1_tpg_reg_info: Structure to hold TPG reg info
+ * holds register address offsets
+ * shift values
+ * masks
+ */
+struct cam_ife_csid_ver1_tpg_reg_info {
+	uint32_t ctrl_addr;
+	uint32_t vc_cfg0_addr;
+	uint32_t vc_cfg1_addr;
+	uint32_t lfsr_seed_addr;
+	uint32_t dt_n_cfg_0_addr;
+	uint32_t dt_n_cfg_1_addr;
+	uint32_t dt_n_cfg_2_addr;
+	uint32_t color_bars_cfg_addr;
+	uint32_t color_box_cfg_addr;
+	uint32_t common_gen_cfg_addr;
+	uint32_t cgen_n_cfg_addr;
+	uint32_t cgen_n_x0_addr;
+	uint32_t cgen_n_x1_addr;
+	uint32_t cgen_n_x2_addr;
+	uint32_t cgen_n_xy_addr;
+	uint32_t cgen_n_y1_addr;
+	uint32_t cgen_n_y2_addr;
+
+	/*configurations */
+	uint32_t dtn_cfg_offset;
+	uint32_t cgen_cfg_offset;
+	uint32_t cpas_ife_reg_offset;
+	uint32_t hbi;
+	uint32_t vbi;
+	uint32_t lfsr_seed;
+	uint32_t width_shift;
+	uint32_t height_shift;
+	uint32_t fmt_shift;
+	uint32_t color_bar;
+	uint32_t line_interleave_mode;
+	uint32_t payload_mode;
+	uint32_t num_frames;
+	uint32_t num_active_dt;
+	uint32_t ctrl_cfg;
+	uint32_t phy_sel;
+	uint32_t num_frame_shift;
+	uint32_t line_interleave_shift;
+	uint32_t num_active_dt_shift;
+	uint32_t vbi_shift;
+	uint32_t hbi_shift;
+	uint32_t color_bar_shift;
+	uint32_t num_active_lanes_mask;
+};
+
+/*
+ * struct cam_ife_csid_ver1_reg_info: Structure for Reg info
+ *
+ * @csi2_reg:            csi2 reg info
+ * @ipp_reg:             IPP reg
+ * @ppp_reg:             PPP reg
+ * @rdi_reg:             RDI reg
+ * @udi_reg:             UDI reg
+ * @start_pixel:         start pixel for horizontal crop
+ * @tpg_reg:             TPG reg
+ * @cmn_reg:             Common reg info
+ * @csid_cust_node_map:  Customer node map
+ * @fused_max_width:     Max width based on fuse registers
+ * @width_fuse_max_val:  Max value of width fuse
+ * @used_hw_capabilities Hw capabilities
+ */
+struct cam_ife_csid_ver1_reg_info {
+	struct cam_ife_csid_csi2_rx_reg_info        *csi2_reg;
+	struct cam_ife_csid_ver1_path_reg_info      *ipp_reg;
+	struct cam_ife_csid_ver1_path_reg_info      *ppp_reg;
+	struct cam_ife_csid_ver1_path_reg_info      *rdi_reg
+		[CAM_IFE_CSID_RDI_MAX];
+	struct cam_ife_csid_ver1_path_reg_info      *udi_reg
+		[CAM_IFE_CSID_UDI_MAX];
+	struct cam_ife_csid_ver1_tpg_reg_info       *tpg_reg;
+	struct cam_ife_csid_ver1_common_reg_info    *cmn_reg;
+	const uint32_t                               csid_cust_node_map[
+		CAM_IFE_CSID_HW_NUM_MAX];
+	const uint32_t                               fused_max_width[
+		CAM_IFE_CSID_WIDTH_FUSE_VAL_MAX];
+	const uint32_t                               width_fuse_max_val;
+};
+
+/*
+ * struct cam_ife_csid_ver1_path_cfg: place holder for path parameters
+ *
+ * @cid:                 cid value for path
+ * @in_format:           input format
+ * @out_format:          output format
+ * @start_pixel:         start pixel for horizontal crop
+ * @end_pixel:           end pixel for horizontal  crop
+ * @start_line:          start line for vertical crop
+ * @end_line:            end line for vertical crop
+ * @width:               width of incoming data
+ * @height:              height of incoming data
+ * @master_idx:          master idx
+ * @horizontal_bin:      horizontal binning enable/disable on path
+ * @vertical_bin:        vertical binning enable/disable on path
+ * @qcfa_bin    :        qcfa binning enable/disable on path
+ * @hor_ver_bin :        horizontal vertical binning enable/disable on path
+ * @num_bytes_out:       Number of bytes out
+ * @sync_mode   :        Sync mode--> master/slave/none
+ * @crop_enable:         flag to indicate crop enable
+ * @drop_enable:         flag to indicate drop enable
+ *
+ */
+struct cam_ife_csid_ver1_path_cfg {
+	uint32_t                        cid;
+	uint32_t                        in_format;
+	uint32_t                        out_format;
+	uint32_t                        start_pixel;
+	uint32_t                        end_pixel;
+	uint32_t                        width;
+	uint32_t                        start_line;
+	uint32_t                        end_line;
+	uint32_t                        height;
+	uint32_t                        master_idx;
+	uint32_t                        horizontal_bin;
+	uint32_t                        vertical_bin;
+	uint32_t                        qcfa_bin;
+	uint32_t                        hor_ver_bin;
+	uint32_t                        num_bytes_out;
+	enum cam_isp_hw_sync_mode       sync_mode;
+	bool                            crop_enable;
+	bool                            drop_enable;
+};
+
+/**
+ * struct cam_csid_evt_payload- payload for csid hw event
+ * @list       : list head
+ * @irq_status : IRQ Status register
+ * @priv       : Private data of payload
+ * @evt_type   : Event type from CSID
+ * @hw_idx     : Hw index
+ */
+struct cam_ife_csid_ver1_evt_payload {
+	struct list_head   list;
+	uint32_t           irq_status[CAM_IFE_CSID_IRQ_REG_MAX];
+	void              *priv;
+	uint32_t           evt_type;
+	uint32_t           hw_idx;
+};
+
+/**
+ * struct             cam_ife_csid_tpg_cfg- csid tpg configuration data
+ * @width:            width
+ * @height:           height
+ * @test_pattern :    pattern
+ * @encode_format:    decode format
+ * @usage_type:       whether dual isp is required
+ * @vc:               virtual channel
+ * @dt:               data type
+ *
+ */
+struct cam_ife_csid_ver1_tpg_cfg  {
+	uint32_t                        width;
+	uint32_t                        height;
+	uint32_t                        test_pattern;
+	uint32_t                        encode_format;
+	uint32_t                        usage_type;
+	uint32_t                        vc;
+	uint32_t                        dt;
+};
+
+/*
+ * struct cam_ife_csid_ver1_hw: place holder for csid hw
+ *
+ * @hw_intf:              hw intf
+ * @hw_info:              hw info
+ * @core_info:            csid core info
+ * @tasklet:              tasklet to handle csid errors
+ * @token:                private data to be sent with callback
+ * @counters:             counters used in csid hw
+ * @path_res:             array of path resources
+ * @cid_data:             cid data
+ * @log_buf:              Log Buffer to dump info
+ * @rx_cfg:               rx configuration
+ * @flags:                flags
+ * @irq_complete:         complete variable for reset irq
+ * @debug_info:           Debug info to capture debug info
+ * @timestamp:            Timestamp to maintain evt timestamps
+ * @free_payload_list:    List of free payload list
+ * @evt_payload:          Event payload
+ * @clk_rate:             clk rate for csid hw
+ * @res_type:             cur res type for active hw
+ * @lock_state :          spin lock
+ *
+ */
+struct cam_ife_csid_ver1_hw {
+	struct cam_hw_intf                            *hw_intf;
+	struct cam_hw_info                            *hw_info;
+	struct cam_ife_csid_core_info                 *core_info;
+	void                                          *tasklet;
+	void                                          *token;
+	struct cam_ife_csid_hw_counters                counters;
+	struct cam_ife_csid_ver1_tpg_cfg               tpg_cfg;
+	struct cam_isp_resource_node                   path_res
+		[CAM_IFE_PIX_PATH_RES_MAX];
+	struct list_head                               free_payload_list;
+	struct cam_ife_csid_ver1_evt_payload           evt_payload
+		[CAM_IFE_CSID_VER1_EVT_PAYLOAD_MAX];
+	struct completion                              irq_complete
+		[CAM_IFE_CSID_IRQ_REG_MAX];
+	struct cam_ife_csid_cid_data                   cid_data
+		[CAM_IFE_CSID_CID_MAX];
+	uint8_t                                        log_buf
+		[CAM_IFE_CSID_LOG_BUF_LEN];
+	struct cam_ife_csid_rx_cfg                     rx_cfg;
+	struct cam_ife_csid_hw_flags                   flags;
+	struct cam_ife_csid_debug_info                 debug_info;
+	struct cam_ife_csid_timestamp                  timestamp;
+	uint64_t                                       clk_rate;
+	uint32_t                                       res_type;
+	spinlock_t                                     lock_state;
+	cam_hw_mgr_event_cb_func                       event_cb;
+};
+
+int cam_ife_csid_hw_ver1_init(struct cam_hw_intf  *csid_hw_intf,
+	struct cam_ife_csid_core_info *csid_core_info,
+	bool is_custom);
+
+int cam_ife_csid_hw_ver1_deinit(struct cam_hw_info *hw_priv);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver2.c
@@ -0,0 +1,8192 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+#include <media/cam_defs.h>
+#include <media/cam_req_mgr.h>
+
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_isp_hw.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_cdm_util.h"
+#include "cam_common_util.h"
+#include "cam_subdev.h"
+#include "cam_compat.h"
+
+/* CSIPHY TPG VC/DT values */
+#define CAM_IFE_CPHY_TPG_VC_VAL                         0x0
+#define CAM_IFE_CPHY_TPG_DT_VAL                         0x2B
+
+/* Timeout values in usec */
+#define CAM_IFE_CSID_TIMEOUT_SLEEP_US                  1000
+#define CAM_IFE_CSID_TIMEOUT_ALL_US                    100000
+
+#define CAM_IFE_CSID_RESET_TIMEOUT_MS                  100
+
+/*
+ * Constant Factors needed to change QTimer ticks to nanoseconds
+ * QTimer Freq = 19.2 MHz
+ * Time(us) = ticks/19.2
+ * Time(ns) = ticks/19.2 * 1000
+ */
+#define CAM_IFE_CSID_QTIMER_MUL_FACTOR                 10000
+#define CAM_IFE_CSID_QTIMER_DIV_FACTOR                 192
+
+/* Max number of sof irq's triggered in case of SOF freeze */
+#define CAM_CSID_IRQ_SOF_DEBUG_CNT_MAX 12
+
+/* Max CSI Rx irq error count threshold value */
+#define CAM_IFE_CSID_MAX_IRQ_ERROR_COUNT               100
+
+/* Max sensor switch out of sync threshold */
+#define CAM_IFE_CSID_MAX_OUT_OF_SYNC_ERR_COUNT         3
+
+#define CAM_CSID_IRQ_CTRL_NAME_LEN                     10
+
+static void cam_ife_csid_ver2_print_debug_reg_status(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_isp_resource_node    *res);
+
+static int cam_ife_csid_ver2_print_hbi_vbi(
+	struct cam_ife_csid_ver2_hw  *csid_hw,
+	struct cam_isp_resource_node *res);
+
+static bool cam_ife_csid_ver2_cpas_cb(
+	uint32_t handle, void *user_data, struct cam_cpas_irq_data *irq_data)
+{
+	bool handled = false;
+	struct cam_ife_csid_ver2_hw *csid_hw = (struct cam_ife_csid_ver2_hw *)user_data;
+
+	if (!csid_hw || !irq_data)
+		return false;
+
+	switch (irq_data->irq_type) {
+	case CAM_CAMNOC_IRQ_SLAVE_ERROR:
+		if (irq_data->u.slave_err.errlog0_low.err_code == CAM_CAMNOC_ADDRESS_DECODE_ERROR) {
+			csid_hw->flags.pf_err_detected = true;
+			CAM_DBG(CAM_ISP, "CPAS address decode error rxved for CSID[%u]",
+				csid_hw->hw_intf->hw_idx);
+		}
+		handled = true;
+		break;
+	default:
+		break;
+	}
+
+	return handled;
+}
+
+static bool cam_ife_csid_ver2_disable_sof_retime(
+	struct cam_ife_csid_ver2_hw     *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	struct cam_ife_csid_ver2_reg_info  *csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+							    csid_hw->core_info->csid_reg;
+	struct cam_ife_csid_ver2_path_cfg  *path_cfg = (struct cam_ife_csid_ver2_path_cfg *)
+							    res->res_priv;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = csid_reg->path_reg[res->res_id];
+
+	if (!(path_reg->capabilities & CAM_IFE_CSID_CAP_SOF_RETIME_DIS))
+		return false;
+
+	if (path_cfg->sfe_shdr || path_cfg->lcr_en)
+		return true;
+
+	if (csid_hw->flags.rdi_lcr_en && res->res_id == CAM_IFE_PIX_PATH_RES_PPP)
+		return true;
+
+	return false;
+}
+
+static uint64_t __cam_ife_csid_ver2_get_time_stamp(void __iomem *mem_base,
+	uint32_t timestamp0_addr, uint32_t timestamp1_addr,
+	bool ts_comb_vcdt_en, uint32_t ts_comb_vcdt_mask)
+{
+	uint64_t timestamp_val, time_hi, time_lo, mask;
+
+	time_hi = cam_io_r_mb(mem_base + timestamp1_addr);
+	time_lo = cam_io_r_mb(mem_base + timestamp0_addr);
+	mask = (uint64_t)ts_comb_vcdt_mask;
+	if (ts_comb_vcdt_en)
+		time_lo &= ~mask;
+
+	timestamp_val = (time_hi << 32) | time_lo;
+
+	return mul_u64_u32_div(timestamp_val,
+		CAM_IFE_CSID_QTIMER_MUL_FACTOR,
+		CAM_IFE_CSID_QTIMER_DIV_FACTOR);
+}
+
+static void cam_ife_csid_ver2_print_camif_timestamps(
+	struct cam_ife_csid_ver2_hw  *csid_hw)
+{
+	struct   cam_ife_csid_ver2_path_cfg    *path_cfg;
+	struct   cam_isp_resource_node         *res;
+	bool                                    found = false;
+	int                                     i;
+	struct cam_hw_soc_info                 *soc_info = &csid_hw->hw_info->soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+	struct cam_ife_csid_ver2_reg_info *csid_reg =
+		(struct cam_ife_csid_ver2_reg_info *)csid_hw->core_info->csid_reg;
+
+	for (i = CAM_IFE_PIX_PATH_RES_RDI_0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+		res = &csid_hw->path_res[i];
+		path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+		if (!path_cfg || !path_cfg->irq_handle)
+			continue;
+
+		switch (res->res_id) {
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+		case CAM_IFE_PIX_PATH_RES_RDI_4:
+		case CAM_IFE_PIX_PATH_RES_RDI_5:
+			if (path_cfg->handle_camif_irq &&
+				res->is_rdi_primary_res)
+				found = true;
+			break;
+		case CAM_IFE_PIX_PATH_RES_IPP:
+			if (path_cfg->handle_camif_irq)
+				found = true;
+			break;
+		default:
+			break;
+		}
+		if (found)
+			break;
+	}
+
+
+	if (found && path_cfg) {
+		path_reg = csid_reg->path_reg[res->res_id];
+
+		CAM_INFO(CAM_ISP,
+			"CSID[%u] %s SOF[%lld:%lld] EPOCH[%lld:%lld] EOF[%lld:%lld]",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			path_cfg->sof_ts.tv_sec, path_cfg->sof_ts.tv_nsec,
+			path_cfg->epoch_ts.tv_sec, path_cfg->epoch_ts.tv_nsec,
+			path_cfg->eof_ts.tv_sec, path_cfg->eof_ts.tv_nsec);
+
+		if (!path_reg) {
+			CAM_ERR(CAM_ISP, "CSID:%d no path registers for res :%d",
+				csid_hw->hw_intf->hw_idx, res->res_id);
+			return;
+		}
+
+		CAM_INFO(CAM_ISP,
+			"qtimer current [SOF: 0x%llx EOF: 0x%llx] prev [SOF: 0x%llx EOF: 0x%llx]",
+			__cam_ife_csid_ver2_get_time_stamp(
+				soc_info->reg_map[0].mem_base,
+				path_reg->timestamp_curr0_sof_addr,
+				path_reg->timestamp_curr1_sof_addr,
+				path_cfg->ts_comb_vcdt_en,
+				csid_reg->cmn_reg->ts_comb_vcdt_mask),
+			__cam_ife_csid_ver2_get_time_stamp(
+				soc_info->reg_map[0].mem_base,
+				path_reg->timestamp_curr0_eof_addr,
+				path_reg->timestamp_curr1_eof_addr,
+				path_cfg->ts_comb_vcdt_en,
+				csid_reg->cmn_reg->ts_comb_vcdt_mask),
+			__cam_ife_csid_ver2_get_time_stamp(
+				soc_info->reg_map[0].mem_base,
+				path_reg->timestamp_perv0_sof_addr,
+				path_reg->timestamp_perv1_sof_addr,
+				path_cfg->ts_comb_vcdt_en,
+				csid_reg->cmn_reg->ts_comb_vcdt_mask),
+			__cam_ife_csid_ver2_get_time_stamp(
+				soc_info->reg_map[0].mem_base,
+				path_reg->timestamp_perv0_eof_addr,
+				path_reg->timestamp_perv1_eof_addr,
+				path_cfg->ts_comb_vcdt_en,
+				csid_reg->cmn_reg->ts_comb_vcdt_mask));
+	}
+}
+
+static void cam_ife_csid_ver2_update_event_ts(
+	struct timespec64 *dst_ts, struct timespec64 *src_ts)
+{
+	dst_ts->tv_sec = src_ts->tv_sec;
+	dst_ts->tv_nsec = src_ts->tv_nsec;
+}
+
+static int cam_ife_csid_ver2_set_debug(
+	struct cam_ife_csid_ver2_hw        *csid_hw,
+	struct cam_ife_csid_debug_cfg_args *debug_args)
+{
+	int bit_pos = 0;
+	uint32_t val, debug_val;
+
+	memset(&csid_hw->debug_info, 0,
+		sizeof(struct cam_ife_csid_debug_info));
+	csid_hw->debug_info.debug_val = debug_args->csid_debug;
+	csid_hw->debug_info.test_bus_val = debug_args->csid_testbus_debug;
+
+	/*
+	 * RX capture debug
+	 * [0:3]   = rst strobes
+	 * [4:11]  = vc for capture
+	 * [12:19] = dt for capture
+	 */
+	csid_hw->debug_info.rst_capture_strobes = (debug_args->csid_rx_capture_debug &
+		CAM_IFE_CSID_DEBUGFS_RST_STROBE_MASK);
+	csid_hw->debug_info.rx_capture_vc = ((debug_args->csid_rx_capture_debug >>
+		CAM_IFE_CSID_DEBUGFS_VC_SHIFT_MASK) & CAM_IFE_CSID_DEBUGFS_VC_DT_MASK);
+	csid_hw->debug_info.rx_capture_dt = ((debug_args->csid_rx_capture_debug >>
+		CAM_IFE_CSID_DEBUGFS_DT_SHIFT_MASK) & CAM_IFE_CSID_DEBUGFS_VC_DT_MASK);
+	csid_hw->debug_info.rx_capture_debug_set = debug_args->rx_capture_debug_set;
+
+	debug_val = csid_hw->debug_info.debug_val;
+	while (debug_val) {
+
+		if (!(debug_val & 0x1)) {
+			debug_val >>= 1;
+			bit_pos++;
+			continue;
+		}
+
+		val = BIT(bit_pos);
+
+		switch (val) {
+		case CAM_IFE_CSID_DEBUG_ENABLE_SOF_IRQ:
+			csid_hw->debug_info.path_mask |=
+				IFE_CSID_VER2_PATH_INFO_INPUT_SOF;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_EOF_IRQ:
+			csid_hw->debug_info.path_mask |=
+				IFE_CSID_VER2_PATH_INFO_INPUT_EOF;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_SOT_IRQ:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER2_RX_DL0_SOT_CAPTURED |
+				IFE_CSID_VER2_RX_DL1_SOT_CAPTURED |
+				IFE_CSID_VER2_RX_DL2_SOT_CAPTURED;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_EOT_IRQ:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER2_RX_DL0_EOT_CAPTURED |
+				IFE_CSID_VER2_RX_DL1_EOT_CAPTURED |
+				IFE_CSID_VER2_RX_DL2_EOT_CAPTURED;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER2_RX_SHORT_PKT_CAPTURED;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER2_RX_LONG_PKT_CAPTURED;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER2_RX_CPHY_PKT_HDR_CAPTURED;
+			break;
+		case CAM_IFE_DEBUG_ENABLE_UNMAPPED_VC_DT_IRQ:
+			csid_hw->debug_info.rx_mask |=
+				IFE_CSID_VER2_RX_UNMAPPED_VC_DT;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_VOTE_UP_IRQ:
+			csid_hw->debug_info.top_mask |=
+				IFE_CSID_VER2_TOP_INFO_VOTE_UP;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_VOTE_DN_IRQ:
+			csid_hw->debug_info.top_mask |=
+				IFE_CSID_VER2_TOP_INFO_VOTE_DN;
+			break;
+		case CAM_IFE_CSID_DEBUG_ENABLE_ERR_NO_VOTE_DN_IRQ:
+			csid_hw->debug_info.top_mask |=
+				IFE_CSID_VER2_TOP_ERR_NO_VOTE_DN;
+			break;
+		default:
+			break;
+		}
+
+		debug_val >>= 1;
+		bit_pos++;
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_sof_irq_debug(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	void *cmd_args)
+{
+	int      i = 0;
+	int      data_idx = 0;
+	bool     sof_irq_enable = false;
+	struct   cam_ife_csid_ver2_reg_info    *csid_reg;
+	struct   cam_ife_csid_ver2_path_cfg    *path_cfg;
+	struct   cam_isp_resource_node         *res;
+	uint32_t irq_mask = 0;
+
+	if (*((uint32_t *)cmd_args) == 1)
+		sof_irq_enable = true;
+
+	if (csid_hw->hw_info->hw_state ==
+		CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%u powered down unable to %s sof irq",
+			csid_hw->hw_intf->hw_idx,
+			(sof_irq_enable) ? "enable" : "disable");
+		return 0;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	for (i = CAM_IFE_PIX_PATH_RES_RDI_0; i < CAM_IFE_PIX_PATH_RES_MAX;
+		i++) {
+
+		res = &csid_hw->path_res[i];
+		path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+		if (!path_cfg || !path_cfg->irq_handle)
+			continue;
+
+		/* Assuming controller has only 1 register set */
+		irq_mask = IFE_CSID_VER2_PATH_INFO_INPUT_SOF;
+		cam_irq_controller_update_irq(
+			csid_hw->path_irq_controller[res->res_id],
+			path_cfg->irq_handle,
+			sof_irq_enable, &irq_mask);
+	}
+
+	if (sof_irq_enable) {
+		csid_hw->debug_info.path_mask |=
+			IFE_CSID_VER2_PATH_INFO_INPUT_SOF;
+		csid_hw->flags.sof_irq_triggered = true;
+	} else {
+		csid_hw->debug_info.path_mask &=
+			~IFE_CSID_VER2_PATH_INFO_INPUT_SOF;
+		csid_hw->flags.sof_irq_triggered = false;
+	}
+
+	CAM_INFO(CAM_ISP, "SOF freeze: CSID:%u SOF irq %s, Notify CSIPHY: %d",
+		csid_hw->hw_intf->hw_idx,
+		(sof_irq_enable) ? "enabled" : "disabled", csid_hw->rx_cfg.phy_sel - 1);
+
+	data_idx = (int)(csid_hw->rx_cfg.phy_sel - csid_reg->cmn_reg->phy_sel_base_idx);
+	if (sof_irq_enable) {
+		if (data_idx < 0)
+			CAM_WARN(CAM_ISP, "CSID:%u Can't notify csiphy, incorrect phy selected=%d",
+			csid_hw->hw_intf->hw_idx, data_idx);
+		else {
+			CAM_INFO(CAM_ISP, "CSID:%u Notify CSIPHY: %d", csid_hw->hw_intf->hw_idx,
+				data_idx);
+			cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+				CAM_SUBDEV_MESSAGE_REG_DUMP, (void *)&data_idx);
+		}
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_get_evt_payload(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_ife_csid_ver2_evt_payload **evt_payload,
+	struct list_head    *payload_list,
+	spinlock_t          *lock)
+{
+
+	spin_lock(lock);
+
+	if (list_empty(payload_list)) {
+		*evt_payload = NULL;
+		spin_unlock(lock);
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -ENOMEM;
+	}
+
+	*evt_payload = list_first_entry(payload_list,
+			struct cam_ife_csid_ver2_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	spin_unlock(lock);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_put_evt_payload(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_ife_csid_ver2_evt_payload **evt_payload,
+	struct list_head    *payload_list,
+	spinlock_t          *lock)
+{
+	unsigned long flags;
+
+	if (*evt_payload == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+	spin_lock_irqsave(lock, flags);
+	list_add_tail(&(*evt_payload)->list,
+		payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(lock, flags);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_top_info_irq_top_half(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	int rc = 0;
+	struct cam_ife_csid_ver2_hw               *csid_hw = NULL;
+	struct cam_ife_csid_ver2_evt_payload      *evt_payload;
+
+	csid_hw = th_payload->handler_priv;
+
+	rc  = cam_ife_csid_ver2_get_evt_payload(csid_hw, &evt_payload,
+			&csid_hw->path_free_payload_list,
+			&csid_hw->path_payload_lock);
+	if (rc) {
+		CAM_WARN_RATE_LIMIT(CAM_ISP, "CSID:%u get payload failed, TOP info status: 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			th_payload->evt_status_arr[0]);
+		return rc;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%u TOP info status: 0x%x", csid_hw->hw_intf->hw_idx,
+		th_payload->evt_status_arr[0]);
+
+	evt_payload->irq_reg_val = th_payload->evt_status_arr[0];
+	ktime_get_boottime_ts64(&evt_payload->timestamp);
+	th_payload->evt_payload_priv = evt_payload;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_top_err_irq_top_half(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	int rc = 0;
+	struct cam_ife_csid_ver2_hw               *csid_hw = NULL;
+	struct cam_ife_csid_ver2_evt_payload      *evt_payload;
+
+	csid_hw = th_payload->handler_priv;
+
+	rc  = cam_ife_csid_ver2_get_evt_payload(csid_hw, &evt_payload,
+			&csid_hw->path_free_payload_list,
+			&csid_hw->path_payload_lock);
+
+	CAM_DBG(CAM_ISP, "CSID:%u TOP status: 0x%x", csid_hw->hw_intf->hw_idx,
+		th_payload->evt_status_arr[0]);
+
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%u TOP status: 0x%x",
+			csid_hw->hw_intf->hw_idx, th_payload->evt_status_arr[0]);
+		return rc;
+	}
+
+	evt_payload->irq_reg_val = th_payload->evt_status_arr[0];
+	ktime_get_boottime_ts64(&evt_payload->timestamp);
+	th_payload->evt_payload_priv = evt_payload;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_handle_buf_done_irq(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_ife_csid_ver2_hw               *csid_hw = NULL;
+	int rc = 0;
+
+	csid_hw = th_payload->handler_priv;
+
+	CAM_DBG(CAM_ISP, "CSID:%u Enter", csid_hw->hw_intf->hw_idx);
+	rc = cam_irq_controller_handle_irq(evt_id,
+		csid_hw->buf_done_irq_controller, CAM_IRQ_EVT_GROUP_0);
+	CAM_DBG(CAM_ISP, "CSID:%u Exit (rc=%d)", csid_hw->hw_intf->hw_idx, rc);
+
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_ife_csid_ver2_handle_rx_irq(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_ife_csid_ver2_hw               *csid_hw = NULL;
+	int rc = 0;
+
+	csid_hw = th_payload->handler_priv;
+
+	CAM_DBG(CAM_ISP, "CSID:%u Enter", csid_hw->hw_intf->hw_idx);
+	rc = cam_irq_controller_handle_irq(evt_id,
+		csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0], CAM_IRQ_EVT_GROUP_0);
+	CAM_DBG(CAM_ISP, "CSID:%u Exit (rc=%d)", csid_hw->hw_intf->hw_idx, rc);
+
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_ife_csid_ver2_handle_path_irq(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_isp_resource_node      *res = th_payload->handler_priv;
+	struct cam_ife_csid_ver2_hw       *csid_hw = cam_isp_res_core_info(res);
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "CSID:%u %s Enter", csid_hw->hw_intf->hw_idx, res->res_name);
+	rc = cam_irq_controller_handle_irq(evt_id,
+		csid_hw->path_irq_controller[res->res_id], CAM_IRQ_EVT_GROUP_0);
+	CAM_DBG(CAM_ISP, "CSID:%u %s Exit (rc=%d)", csid_hw->hw_intf->hw_idx, res->res_name, rc);
+
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_ife_csid_ver2_path_err_top_half(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	int32_t                                    rc;
+	struct cam_hw_info                        *hw_info;
+	struct cam_ife_csid_ver2_hw               *csid_hw = NULL;
+	struct cam_ife_csid_ver2_evt_payload      *evt_payload;
+	struct cam_isp_resource_node              *res;
+	const uint8_t                            **irq_reg_tag;
+	struct cam_ife_csid_ver2_path_cfg         *path_cfg;
+
+	res  = th_payload->handler_priv;
+
+	if (!res) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No private returned");
+		return -ENODEV;
+	}
+
+	hw_info = (struct cam_hw_info *)res->hw_intf->hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	rc  = cam_ife_csid_ver2_get_evt_payload(csid_hw, &evt_payload,
+			&csid_hw->path_free_payload_list,
+			&csid_hw->path_payload_lock);
+	irq_reg_tag = cam_ife_csid_get_irq_reg_tag_ptr();
+
+	CAM_DBG(CAM_ISP, "CSID:%u %s status: 0x%x",
+		csid_hw->hw_intf->hw_idx,
+		irq_reg_tag[path_cfg->irq_reg_idx],
+		th_payload->evt_status_arr[0]);
+
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%u %s status: 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			irq_reg_tag[path_cfg->irq_reg_idx],
+			th_payload->evt_status_arr[0]);
+		return rc;
+	}
+
+	evt_payload->irq_reg_val = th_payload->evt_status_arr[0];
+
+	ktime_get_boottime_ts64(&path_cfg->error_ts);
+	th_payload->evt_payload_priv = evt_payload;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_path_top_half(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	int32_t                                       rc;
+	struct cam_hw_info                           *hw_info;
+	struct cam_ife_csid_ver2_hw                  *csid_hw = NULL;
+	struct cam_ife_csid_ver2_evt_payload         *evt_payload;
+	struct cam_isp_resource_node                 *res;
+	const uint8_t                                **irq_reg_tag;
+	struct cam_ife_csid_ver2_path_cfg            *path_cfg;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg = NULL;
+	struct cam_hw_soc_info                       *soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+
+	res  = th_payload->handler_priv;
+
+	if (!res) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No private returned");
+		return -ENODEV;
+	}
+
+	hw_info = (struct cam_hw_info *)res->hw_intf->hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_reg = csid_reg->path_reg[res->res_id];
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	rc  = cam_ife_csid_ver2_get_evt_payload(csid_hw, &evt_payload,
+			&csid_hw->path_free_payload_list,
+			&csid_hw->path_payload_lock);
+	irq_reg_tag = cam_ife_csid_get_irq_reg_tag_ptr();
+
+	CAM_DBG(CAM_ISP, "CSID:%u %s status: 0x%x",
+		csid_hw->hw_intf->hw_idx,
+		irq_reg_tag[path_cfg->irq_reg_idx],
+		th_payload->evt_status_arr[0]);
+
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%u %s status: 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			irq_reg_tag[path_cfg->irq_reg_idx],
+			th_payload->evt_status_arr[0]);
+		return rc;
+	}
+
+	evt_payload->irq_reg_val = th_payload->evt_status_arr[0];
+
+	if ((evt_payload->irq_reg_val & path_reg->sof_irq_mask)
+		&& path_cfg->handle_camif_irq) {
+		evt_payload->sof_ts_reg_val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			path_reg->timestamp_curr1_sof_addr);
+		evt_payload->sof_ts_reg_val = (evt_payload->sof_ts_reg_val << 32) |
+			cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			path_reg->timestamp_curr0_sof_addr);
+	}
+	ktime_get_boottime_ts64(&evt_payload->timestamp);
+	th_payload->evt_payload_priv = evt_payload;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_mc_top_half(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	int32_t                                    rc;
+	struct cam_ife_csid_ver2_evt_payload      *evt_payload;
+	struct cam_isp_resource_node              *res;
+
+	res  = th_payload->handler_priv;
+
+	if (!res) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No private returned");
+		return -ENODEV;
+	}
+
+	rc = cam_ife_csid_ver2_path_top_half(evt_id, th_payload);
+	evt_payload = (struct cam_ife_csid_ver2_evt_payload *)th_payload->evt_payload_priv;
+	evt_payload->is_mc = true;
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Multi context top half fail");
+		return rc;
+	}
+
+	return 0;
+}
+
+static inline void cam_ife_csid_ver2_reset_discard_frame_cfg(
+	struct cam_isp_resource_node                *res,
+	struct cam_ife_csid_ver2_hw                 *csid_hw,
+	struct cam_ife_csid_ver2_path_cfg           *path_cfg)
+{
+	int rc;
+
+	/* Reset discard config params */
+	path_cfg->discard_init_frames = false;
+	path_cfg->skip_discard_frame_cfg = false;
+	path_cfg->num_frames_discard = 0;
+	path_cfg->sof_cnt = 0;
+
+	/* Decrement discard frame ref cnt for this path */
+	atomic_dec(&csid_hw->discard_frame_per_path);
+
+	/* If input SOF irq is enabled explicitly - unsubscribe in th*/
+	if (path_cfg->discard_irq_handle > 0) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			csid_hw->path_irq_controller[res->res_id],
+			path_cfg->discard_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"CSID[%u] Failed to unsubscribe input SOF for res: %s",
+				csid_hw->hw_intf->hw_idx, res->res_name);
+
+		path_cfg->discard_irq_handle = 0;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID[%u] Reset discard frame config for res: %s discard_ref_cnt: %u",
+		csid_hw->hw_intf->hw_idx, res->res_name,
+		atomic_read(&csid_hw->discard_frame_per_path));
+}
+
+static int cam_ife_csid_ver2_discard_sof_top_half(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_hw_info                        *hw_info;
+	struct cam_ife_csid_ver2_hw               *csid_hw = NULL;
+	struct cam_isp_resource_node              *res;
+	struct cam_ife_csid_ver2_path_cfg         *path_cfg;
+
+	res  = th_payload->handler_priv;
+
+	if (!res) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No private returned");
+		return -ENODEV;
+	}
+
+	hw_info = (struct cam_hw_info *)res->hw_intf->hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	CAM_DBG(CAM_ISP, "CSID: %u status: 0x%x for res: %s",
+		csid_hw->hw_intf->hw_idx,
+		th_payload->evt_status_arr[path_cfg->irq_reg_idx],
+		res->res_name);
+
+	/* No need of payload since it's an exclusive th & bh */
+	th_payload->evt_payload_priv = NULL;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_discard_sof_pix_bottom_half(
+	void              *handler_priv,
+	void              *evt_payload_priv)
+{
+	struct cam_hw_info                           *hw_info;
+	struct cam_ife_csid_ver2_hw                  *csid_hw = NULL;
+	struct cam_isp_resource_node                 *res;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg = NULL;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	struct cam_ife_csid_ver2_path_cfg            *path_cfg;
+	struct cam_hw_soc_info                       *soc_info;
+	void    __iomem                              *base;
+	uint32_t                                      val;
+
+	if (!handler_priv) {
+		CAM_ERR(CAM_ISP, "Invalid handler_priv");
+		return -EINVAL;
+	}
+
+	res   =  handler_priv;
+	hw_info = (struct cam_hw_info *)res->hw_intf->hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	soc_info = &csid_hw->hw_info->soc_info;
+	base  = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	/* Count SOFs */
+	path_cfg->sof_cnt++;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] Discard frame on %s path, num SOFs: %u",
+		csid_hw->hw_intf->hw_idx, res->res_name, path_cfg->sof_cnt);
+
+	spin_lock(&csid_hw->lock_state);
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID[%u] powered down state",
+			csid_hw->hw_intf->hw_idx);
+		goto end;
+	}
+
+	/* Check with requested number of frames to be dropped */
+	if (path_cfg->sof_cnt == path_cfg->num_frames_discard) {
+		if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+			path_cfg->sync_mode == CAM_ISP_HW_SYNC_NONE) {
+			val = cam_io_r_mb(base + path_reg->ctrl_addr);
+			val |= path_reg->resume_frame_boundary;
+			cam_io_w_mb(val, base + path_reg->ctrl_addr);
+			CAM_DBG(CAM_ISP,
+				"CSID[%u] start cmd programmed for %s sof_cnt %u",
+				csid_hw->hw_intf->hw_idx,
+				res->res_name,
+				path_cfg->sof_cnt);
+		}
+		cam_ife_csid_ver2_reset_discard_frame_cfg(res, csid_hw, path_cfg);
+	}
+end:
+	spin_unlock(&csid_hw->lock_state);
+	return 0;
+}
+
+static int cam_ife_csid_ver2_discard_sof_rdi_bottom_half(
+	void              *handler_priv,
+	void              *evt_payload_priv)
+{
+	struct cam_hw_info                           *hw_info;
+	struct cam_ife_csid_ver2_hw                  *csid_hw = NULL;
+	struct cam_isp_resource_node                 *res;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg = NULL;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	struct cam_ife_csid_ver2_path_cfg            *path_cfg;
+	struct cam_hw_soc_info                       *soc_info;
+	void    __iomem                              *base;
+	uint32_t                                      val;
+
+	if (!handler_priv) {
+		CAM_ERR(CAM_ISP, "Invalid handler_priv");
+		return -EINVAL;
+	}
+
+	res   =  handler_priv;
+	hw_info = (struct cam_hw_info *)res->hw_intf->hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	soc_info = &csid_hw->hw_info->soc_info;
+	base  = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	/* Count SOFs */
+	path_cfg->sof_cnt++;
+	CAM_DBG(CAM_ISP, "CSID[%u] Discard frame on %s path, num SOFs: %u",
+		csid_hw->hw_intf->hw_idx, res->res_name, path_cfg->sof_cnt);
+
+	spin_lock(&csid_hw->lock_state);
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID[%u] powered down state",
+			csid_hw->hw_intf->hw_idx);
+		goto end;
+	}
+
+	/* Check with requested number of frames to be dropped */
+	if (path_cfg->sof_cnt == path_cfg->num_frames_discard) {
+		val = cam_io_r_mb(base + path_reg->ctrl_addr);
+		val |= path_reg->resume_frame_boundary;
+		cam_io_w_mb(val, base + path_reg->ctrl_addr);
+		CAM_DBG(CAM_ISP,
+			"CSID[%u] start cmd programmed for %s sof_cnt %u val: %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_name, path_cfg->sof_cnt, val);
+
+		cam_ife_csid_ver2_reset_discard_frame_cfg(res, csid_hw, path_cfg);
+	}
+end:
+	spin_unlock(&csid_hw->lock_state);
+	return 0;
+}
+
+static int cam_ife_csid_ver2_stop_csi2_in_err(
+	struct cam_ife_csid_ver2_hw  *csid_hw)
+{
+	CAM_DBG(CAM_ISP, "CSID:%u Stop csi2 rx",
+		csid_hw->hw_intf->hw_idx);
+
+	if (csid_hw->rx_cfg.top_irq_handle)
+		cam_irq_controller_disable_irq(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->rx_cfg.top_irq_handle);
+
+	if (csid_hw->rx_cfg.irq_handle)
+		cam_irq_controller_disable_irq(
+			csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+			csid_hw->rx_cfg.irq_handle);
+
+	if (csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0])
+		cam_irq_controller_disable_irq(
+			csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+			csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+
+	return 0;
+}
+
+static inline void cam_ife_csid_ver2_maskout_rx_irqs(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	int rc;
+
+	if (csid_hw->rx_cfg.irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+			csid_hw->rx_cfg.irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe rx info irq for CSID:%u rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		csid_hw->rx_cfg.irq_handle = 0;
+	}
+
+	if (csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+			csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe rx err irq for CSID:%u rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+		csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0] = 0;
+	}
+
+	if (csid_hw->rx_cfg.top_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->rx_cfg.top_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe rx irq in top for CSID:%u rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		csid_hw->rx_cfg.irq_handle = 0;
+		cam_irq_controller_unregister_dependent(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+	}
+}
+
+static inline void cam_ife_csid_ver2_disable_rx_evts(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	int rc;
+
+	if (csid_hw->rx_cfg.irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+			csid_hw->rx_cfg.irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe rx info irq evt for CSID:%u rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		csid_hw->rx_cfg.irq_handle = 0;
+	}
+
+	if (csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+			csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe rx err irq evt for CSID:%u rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0] = 0;
+	}
+
+	if (csid_hw->rx_cfg.top_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->rx_cfg.top_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe rx irq evt in top for CSID:%u rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		csid_hw->rx_cfg.irq_handle = 0;
+		cam_irq_controller_unregister_dependent(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+	}
+}
+
+
+static int cam_ife_csid_ver2_disable_csi2(
+	bool maskout_irqs,
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	CAM_DBG(CAM_ISP, "CSID:%u Disable csi2 rx",
+		csid_hw->hw_intf->hw_idx);
+
+	if (!csid_hw->flags.rx_enabled) {
+		CAM_DBG(CAM_ISP, "CSID:%u Rx already disabled",
+			csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	if (maskout_irqs)
+		cam_ife_csid_ver2_maskout_rx_irqs(csid_hw);
+	else
+		cam_ife_csid_ver2_disable_rx_evts(csid_hw);
+
+	csid_hw->flags.rx_enabled = false;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_rx_err_top_half(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	int32_t                                               rc = 0;
+	uint32_t                                              status = 0;
+	struct cam_ife_csid_ver2_hw                          *csid_hw = NULL;
+	struct cam_ife_csid_ver2_reg_info                    *csid_reg;
+	struct cam_ife_csid_ver2_evt_payload                 *evt_payload;
+	const struct cam_ife_csid_ver2_csi2_rx_reg_info      *csi2_reg;
+	int                                                   discard_frame_count;
+
+	csid_hw = th_payload->handler_priv;
+	if (!csid_hw) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No private returned");
+		return -ENODEV;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+				csid_hw->core_info->csid_reg;
+	csi2_reg = csid_reg->csi2_reg;
+
+	discard_frame_count = atomic_read(&csid_hw->discard_frame_per_path);
+	if (discard_frame_count) {
+		CAM_DBG(CAM_ISP,
+			"CSID[%u] ignoring rx error (error:0x%x, remaining frames:%d)",
+			csid_hw->hw_intf->hw_idx,
+			th_payload->evt_status_arr[CAM_IFE_CSID_IRQ_REG_RX],
+			discard_frame_count);
+		return -ENODEV;
+	}
+
+	if (csid_hw->flags.fatal_err_detected) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID[%u] already handling fatal error",
+			csid_hw->hw_intf->hw_idx);
+		return -ENODEV;
+	}
+
+	status = th_payload->evt_status_arr[0];
+
+	if (csid_hw->rx_cfg.epd_supported) {
+		if (status == IFE_CSID_VER2_RX_CPHY_EOT_RECEPTION) {
+			CAM_DBG(CAM_ISP, "CSID[%u] Rcvd Only ERROR_EOT for EPD sensor",
+				csid_hw->hw_intf->hw_idx);
+			return -ENODEV;
+		}
+
+		status &= (~IFE_CSID_VER2_RX_CPHY_EOT_RECEPTION);
+	}
+
+	if (status & csi2_reg->fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]) {
+		csid_hw->flags.fatal_err_detected = true;
+		cam_ife_csid_ver2_stop_csi2_in_err(csid_hw);
+		goto end;
+	}
+
+	if (status & csi2_reg->part_fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]) {
+		if (status & IFE_CSID_VER2_RX_CPHY_SOT_RECEPTION)
+			csid_hw->counters.error_irq_count++;
+
+		CAM_DBG(CAM_ISP, "CSID[%u] Recoverable Error Count:%u",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->counters.error_irq_count);
+
+		if (csid_hw->counters.error_irq_count > CAM_IFE_CSID_MAX_ERR_COUNT) {
+			csid_hw->flags.fatal_err_detected = true;
+			cam_ife_csid_ver2_stop_csi2_in_err(csid_hw);
+		}
+	}
+end:
+	rc  = cam_ife_csid_ver2_get_evt_payload(csid_hw, &evt_payload,
+			&csid_hw->rx_free_payload_list,
+			&csid_hw->rx_payload_lock);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%u status: 0x%X",
+			csid_hw->hw_intf->hw_idx,
+			th_payload->evt_status_arr[0]);
+	} else {
+		evt_payload->irq_reg_val = status;
+		th_payload->evt_payload_priv = evt_payload;
+	}
+	return rc;
+}
+
+static int cam_ife_csid_ver2_handle_rx_debug_event(
+	struct cam_ife_csid_ver2_hw   *csid_hw,
+	enum cam_ife_csid_rx_irq_regs  rx_index,
+	uint32_t                       bit_pos,
+	uint32_t                      *rst_strobe_val)
+{
+	struct cam_hw_soc_info              *soc_info;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	const struct cam_ife_csid_ver2_csi2_rx_reg_info *csi2_reg;
+	uint32_t mask, val;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csi2_reg = csid_reg->csi2_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	mask  = BIT(bit_pos);
+
+	switch (mask) {
+	case IFE_CSID_VER2_RX_LONG_PKT_CAPTURED:
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_long_pkt_0_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID :%u Long pkt VC: %u DT: %u WC: %u",
+			csid_hw->hw_intf->hw_idx,
+			((val & csi2_reg->vc_mask) >> csi2_reg->vc_shift),
+			((val & csi2_reg->dt_mask) >> csi2_reg->dt_shift),
+			((val & csi2_reg->wc_mask) >> csi2_reg->wc_shift));
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_long_pkt_1_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID :%u Long pkt ECC: %u",
+			csid_hw->hw_intf->hw_idx, val);
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_long_pkt_ftr_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID :%u Long pkt cal CRC: %u expected CRC: %u",
+			csid_hw->hw_intf->hw_idx,
+			((val >> csi2_reg->calc_crc_shift) & csi2_reg->calc_crc_mask),
+			(val & csi2_reg->expected_crc_mask));
+
+		/* Update reset long pkt strobe */
+		*rst_strobe_val |= (1 << csi2_reg->long_pkt_strobe_rst_shift);
+		break;
+
+	case IFE_CSID_VER2_RX_SHORT_PKT_CAPTURED:
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_short_pkt_0_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID :%u Short pkt VC: %u DT: %u LC: %u",
+			csid_hw->hw_intf->hw_idx,
+			((val & csi2_reg->vc_mask) >> csi2_reg->vc_shift),
+			((val & csi2_reg->dt_mask) >> csi2_reg->dt_shift),
+			((val & csi2_reg->wc_mask) >> csi2_reg->wc_shift));
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_short_pkt_1_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID :%u Short pkt ECC: %u",
+			csid_hw->hw_intf->hw_idx, val);
+
+		/* Update reset short pkt strobe */
+		*rst_strobe_val |= (1 << csi2_reg->short_pkt_strobe_rst_shift);
+		break;
+	case IFE_CSID_VER2_RX_CPHY_PKT_HDR_CAPTURED:
+
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->captured_cphy_pkt_hdr_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID :%u CPHY pkt VC: %u DT: %u WC: %u",
+			csid_hw->hw_intf->hw_idx,
+			((val & csi2_reg->vc_mask) >> csi2_reg->vc_shift),
+			((val & csi2_reg->dt_mask) >> csi2_reg->dt_shift),
+			((val & csi2_reg->wc_mask) >> csi2_reg->wc_shift));
+
+		/* Update reset phy pkt strobe */
+		*rst_strobe_val |= (1 << csi2_reg->cphy_pkt_strobe_rst_shift);
+		break;
+	case IFE_CSID_VER2_RX_UNMAPPED_VC_DT:
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->cap_unmap_long_pkt_hdr_0_addr);
+
+		CAM_ERR(CAM_ISP,
+			"CSID:%u UNMAPPED_VC_DT: VC: %u DT: %u WC: %u not mapped to any csid paths",
+			csid_hw->hw_intf->hw_idx,
+			((val & csi2_reg->vc_mask) >> csi2_reg->vc_shift),
+			((val & csi2_reg->dt_mask) >> csi2_reg->dt_shift),
+			((val & csi2_reg->wc_mask) >> csi2_reg->wc_shift));
+
+		csid_hw->counters.error_irq_count++;
+
+		CAM_DBG(CAM_ISP, "CSID[%u] Recoverable Error Count:%u",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->counters.error_irq_count);
+
+		/* Update reset unmapped long pkt strobe */
+		*rst_strobe_val |= (1 << csi2_reg->unmapped_pkt_strobe_rst_shift);
+		break;
+	default:
+		CAM_DBG(CAM_ISP,
+			"CSID[%u] RX_IRQ: %s",
+			csid_hw->hw_intf->hw_idx,
+			(*csid_reg->rx_irq_desc)[rx_index][bit_pos].desc);
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_rx_top_half(
+	uint32_t                                   evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_ife_csid_ver2_hw                *csid_hw = NULL;
+	const struct cam_ife_csid_ver2_csi2_rx_reg_info *csi2_reg;
+	struct cam_ife_csid_ver2_reg_info          *csid_reg;
+	uint32_t                                    irq_status;
+	uint32_t                                    rst_strobe_val = 0;
+	uint32_t                                    bit_pos = 0, bit_set = 0;
+
+	csid_hw = th_payload->handler_priv;
+
+	if (!csid_hw) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No private returned");
+		return -ENODEV;
+	}
+
+	irq_status = th_payload->evt_status_arr[0];
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csi2_reg = csid_reg->csi2_reg;
+
+	while (irq_status) {
+		bit_set = irq_status & 1;
+		if ((bit_set) && (BIT(bit_pos) & csid_hw->debug_info.rx_mask))
+			cam_ife_csid_ver2_handle_rx_debug_event(csid_hw,
+				CAM_IFE_CSID_RX_IRQ_STATUS_REG0, bit_pos, &rst_strobe_val);
+		bit_pos++;
+		irq_status >>= 1;
+	}
+
+	/* Reset strobes for next set of pkts */
+	if (rst_strobe_val && csid_hw->debug_info.rst_capture_strobes) {
+		struct cam_hw_soc_info *soc_info = &csid_hw->hw_info->soc_info;
+
+		cam_io_w_mb(rst_strobe_val, soc_info->reg_map[0].mem_base +
+			csi2_reg->rst_strobes_addr);
+	}
+	return 0;
+}
+
+static inline uint32_t cam_ife_csid_ver2_input_core_to_hw_idx(int core_sel)
+{
+	switch (core_sel) {
+	case CAM_IFE_CSID_INPUT_CORE_SEL_SFE_0: return 0;
+	case CAM_IFE_CSID_INPUT_CORE_SEL_SFE_1: return 1;
+	case CAM_IFE_CSID_INPUT_CORE_SEL_SFE_2: return 2;
+	/**
+	 * For all invalid cases, return a very large value
+	 * that can never be a valid hw idx.
+	 */
+	default: return 0xFFFF;
+	}
+}
+
+static int cam_ife_csid_ver2_handle_event_err(
+	struct cam_ife_csid_ver2_hw  *csid_hw,
+	uint32_t                      irq_status,
+	uint32_t                      err_type,
+	bool                          is_secondary,
+	struct cam_isp_resource_node *res)
+{
+	struct cam_isp_hw_error_event_info   err_evt_info;
+	struct cam_isp_hw_event_info         evt = {0};
+	struct cam_ife_csid_ver2_path_cfg   *path_cfg;
+	int i;
+	void *token = NULL;
+
+	if (!csid_hw->event_cb) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID[%u] event cb not registered",
+			csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	/*
+	 * If PF is encountered skip notifying error to ctx, PF
+	 * handler will do the necessary notifications
+	 */
+	if (csid_hw->flags.pf_err_detected)
+		return 0;
+
+	evt.hw_idx   = csid_hw->hw_intf->hw_idx;
+	evt.reg_val  = irq_status;
+	evt.hw_type  = CAM_ISP_HW_TYPE_CSID;
+	evt.is_secondary_evt = is_secondary;
+	err_evt_info.err_type = err_type;
+	evt.event_data = (void *)&err_evt_info;
+
+	for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+		if (csid_hw->token_data[i].res_id == res->res_id) {
+			token = csid_hw->token_data[i].token;
+			break;
+		}
+	}
+
+	if (!token) {
+		CAM_ERR(CAM_ISP, "cannot find token data for res :%d ", res->res_id);
+		goto end;
+	}
+
+	if (!is_secondary) {
+		if (res) {
+			cam_ife_csid_ver2_print_debug_reg_status(csid_hw, res);
+			path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+			evt.res_id   = res->res_id;
+			CAM_ERR(CAM_ISP,
+				"csid[%u] Res:%s Err 0x%x status 0x%x time_stamp: %lld.%09lld",
+				csid_hw->hw_intf->hw_idx, res->res_name, err_type,
+				irq_status, path_cfg->error_ts.tv_sec,
+				path_cfg->error_ts.tv_nsec);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"csid[%u] Rx Err: 0x%x status 0x%x",
+				csid_hw->hw_intf->hw_idx, err_type, irq_status);
+		}
+	}
+
+	evt.in_core_idx =
+		cam_ife_csid_ver2_input_core_to_hw_idx(csid_hw->top_cfg.input_core_type);
+
+	cam_ife_csid_ver2_print_camif_timestamps(csid_hw);
+
+	csid_hw->event_cb(token, CAM_ISP_HW_EVENT_ERROR, (void *)&evt);
+end:
+	return 0;
+}
+
+static int cam_ife_csid_ver2_rx_err_bottom_half(
+	void                                      *handler_priv,
+	void                                      *evt_payload_priv)
+{
+	const struct cam_ife_csid_ver2_csi2_rx_reg_info *csi2_reg;
+	struct cam_ife_csid_ver2_evt_payload       *payload;
+	struct cam_ife_csid_ver2_hw                *csid_hw = NULL;
+	struct cam_ife_csid_ver2_reg_info          *csid_reg;
+	struct cam_hw_soc_info                     *soc_info = NULL;
+	uint8_t                                    *log_buf = NULL;
+	uint32_t                                    irq_status;
+	uint32_t                                    rx_irq_status = 0;
+	size_t                                      len = 0, i;
+	uint32_t                                    val = 0;
+	uint32_t                                    event_type = 0;
+	uint32_t                                    long_pkt_ftr_val;
+	uint32_t                                    total_crc;
+	int                                         data_idx = 0;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	payload = evt_payload_priv;
+	csid_hw = handler_priv;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	log_buf = csid_hw->log_buf;
+	log_buf[0] = '\0';
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csi2_reg = csid_reg->csi2_reg;
+
+	irq_status = payload->irq_reg_val &
+			csi2_reg->fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG0];
+
+	if (!csid_hw->flags.device_enabled) {
+		CAM_DBG(CAM_ISP, "CSID[%u] bottom-half after stop [0x%x]",
+			csid_hw->hw_intf->hw_idx, irq_status);
+		goto end;
+	}
+
+	spin_lock(&csid_hw->lock_state);
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID[%u] powered down state",
+			csid_hw->hw_intf->hw_idx);
+		goto unlock;
+	}
+
+	if (irq_status) {
+		bool lane_overflow = false;
+		char tmp_buf[10];
+		int tmp_len = 0;
+
+		for (i = 0; i < 4; i++) {
+			/* NOTE: Hardware specific bits */
+			if (irq_status & (IFE_CSID_VER2_RX_LANE0_FIFO_OVERFLOW << i)) {
+				tmp_len += scnprintf(tmp_buf + tmp_len, 10 - tmp_len, " %d", i);
+				lane_overflow = true;
+			}
+		}
+
+		if (lane_overflow) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_LANE_FIFO_OVERFLOW;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"INPUT_FIFO_OVERFLOW [Lanes:%s]: Skew/Less Data on lanes/ Slow csid clock:%luHz",
+				tmp_buf, cam_soc_util_get_applied_src_clk(soc_info, true));
+		}
+
+		if (irq_status & IFE_CSID_VER2_RX_ERROR_CPHY_PH_CRC) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_PKT_HDR_CORRUPTED;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"CPHY_PH_CRC: Pkt Hdr CRC mismatch");
+		}
+
+		if (irq_status & IFE_CSID_VER2_RX_STREAM_UNDERFLOW) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_MISSING_PKT_HDR_DATA;
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csi2_reg->captured_long_pkt_0_addr);
+
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"STREAM_UNDERFLOW: Fewer bytes rcvd than WC:%d in pkt hdr",
+				val & 0xFFFF);
+		}
+
+		if (irq_status & IFE_CSID_VER2_RX_ERROR_ECC) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_PKT_HDR_CORRUPTED;
+			CAM_ERR_BUF(CAM_ISP, log_buf,
+				CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"DPHY_ERROR_ECC: Pkt hdr errors unrecoverable. ECC: 0x%x",
+				 cam_io_r_mb(soc_info->reg_map[0].mem_base +
+					csi2_reg->captured_long_pkt_1_addr));
+		}
+
+		if (irq_status & IFE_CSID_VER2_RX_UNBOUNDED_FRAME) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_UNBOUNDED_FRAME;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"UNBOUNDED_FRAME: Frame started with EOF or No EOF");
+		}
+
+		if (irq_status & IFE_CSID_VER2_RX_CPHY_EOT_RECEPTION) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_MISSING_EOT;
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"CPHY_EOT_RECEPTION: No EOT on lane/s, is_EPD: %c, PHY_Type: %s(%u)",
+				(csid_hw->rx_cfg.epd_supported & CAM_ISP_EPD_SUPPORT) ? 'Y' : 'N',
+				(csid_hw->rx_cfg.lane_type) ? "cphy" : "dphy",
+				csid_hw->rx_cfg.lane_type);
+		}
+
+		if (irq_status & IFE_CSID_VER2_RX_ERROR_CRC) {
+			event_type |= CAM_ISP_HW_ERROR_CSID_PKT_PAYLOAD_CORRUPTED;
+			long_pkt_ftr_val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csi2_reg->captured_long_pkt_ftr_addr);
+			total_crc = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csi2_reg->total_crc_err_addr);
+
+			if (csid_hw->rx_cfg.lane_type == CAM_ISP_LANE_TYPE_CPHY) {
+				val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+					csi2_reg->captured_cphy_pkt_hdr_addr);
+
+				CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+					"PHY_CRC_ERROR: Long pkt payload CRC mismatch. Totl CRC Errs: %u, Rcvd CRC: 0x%x Caltd CRC: 0x%x, VC:%d DT:%d WC:%d",
+					total_crc, long_pkt_ftr_val & 0xffff,
+					long_pkt_ftr_val >> 16, val >> 22,
+					(val >> 16) & 0x3F, val & 0xFFFF);
+			} else {
+				CAM_ERR_BUF(CAM_ISP, log_buf,
+					CAM_IFE_CSID_LOG_BUF_LEN, &len,
+					"PHY_CRC_ERROR: Long pkt payload CRC mismatch. Totl CRC Errs: %u, Rcvd CRC: 0x%x Caltd CRC: 0x%x",
+					total_crc, long_pkt_ftr_val & 0xffff,
+					long_pkt_ftr_val >> 16);
+			}
+		}
+
+		CAM_ERR(CAM_ISP, "CSID[%u] Fatal Errors: %s", csid_hw->hw_intf->hw_idx, log_buf);
+
+		rx_irq_status |= irq_status;
+		csid_hw->flags.fatal_err_detected = true;
+	}
+
+	irq_status = payload->irq_reg_val &
+			csi2_reg->part_fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG0];
+
+	if (irq_status) {
+		len = 0;
+		if (irq_status & IFE_CSID_VER2_RX_CPHY_SOT_RECEPTION) {
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"CPHY_SOT_RECEPTION: Less SOTs on lane/s");
+		}
+
+		CAM_ERR(CAM_ISP, "CSID[%u] Partly fatal errors: %s",
+			csid_hw->hw_intf->hw_idx, log_buf);
+		rx_irq_status |= irq_status;
+	}
+
+	irq_status = payload->irq_reg_val &
+			csi2_reg->non_fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG0];
+
+	if (irq_status) {
+		len = 0;
+		if (irq_status & IFE_CSID_VER2_RX_MMAPPED_VC_DT) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csi2_reg->captured_long_pkt_0_addr);
+
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"MMAPPED_VC_DT: VC:%d DT:%d mapped to more than 1 csid paths",
+				(val >> 22), ((val >> 16) & 0x3F));
+		}
+
+		CAM_ERR(CAM_ISP, "CSID[%u] Non-fatal-errors: %s",
+			csid_hw->hw_intf->hw_idx, log_buf);
+	}
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID[%u] Rx Status 0x%x",
+		csid_hw->hw_intf->hw_idx,
+		payload->irq_reg_val);
+
+	data_idx = (int)(csid_hw->rx_cfg.phy_sel - csid_reg->cmn_reg->phy_sel_base_idx);
+	if ((!csid_hw->flags.reset_awaited) && csid_hw->flags.fatal_err_detected) {
+		if (!event_type)
+			event_type |= CAM_ISP_HW_ERROR_CSID_FATAL;
+
+		if (data_idx < 0)
+			CAM_WARN(CAM_ISP, "Can't notify csiphy, incorrect phy selected=%d",
+				data_idx);
+		else
+			cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+				CAM_SUBDEV_MESSAGE_APPLY_CSIPHY_AUX, (void *)&data_idx);
+
+		cam_ife_csid_ver2_handle_event_err(csid_hw,
+			rx_irq_status, event_type, false, NULL);
+		csid_hw->flags.reset_awaited = true;
+	}
+unlock:
+	spin_unlock(&csid_hw->lock_state);
+end:
+	cam_ife_csid_ver2_put_evt_payload(csid_hw, &payload,
+		&csid_hw->rx_free_payload_list,
+		&csid_hw->rx_payload_lock);
+
+	return 0;
+}
+
+void cam_ife_csid_hw_ver2_rdi_line_buffer_conflict_handler(
+	void *csid)
+{
+	struct cam_ife_csid_ver2_hw       *csid_hw  = csid;
+	struct cam_ife_csid_ver2_reg_info *csid_reg = csid_hw->core_info->csid_reg;
+	struct cam_hw_soc_info            *soc_info = &csid_hw->hw_info->soc_info;
+	void __iomem                      *base =
+		soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+	uint32_t i = 0, rdi_cfg = 0;
+	uint8_t *log_buf = csid_hw->log_buf;
+	size_t len = 0;
+
+	memset(log_buf, 0x0, sizeof(uint8_t) * CAM_IFE_CSID_LOG_BUF_LEN);
+
+	for (i = CAM_IFE_PIX_PATH_RES_RDI_0; i <= CAM_IFE_PIX_PATH_RES_RDI_5;
+		i++) {
+		path_reg = csid_reg->path_reg[i - CAM_IFE_PIX_PATH_RES_RDI_0];
+
+		if (!(path_reg->capabilities &
+			CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI))
+			continue;
+
+		rdi_cfg = cam_io_r_mb(base + path_reg->cfg1_addr);
+
+		if (rdi_cfg & path_reg->pix_store_en_shift_val)
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len,
+				"LINE BUFFER ENABLED for RDI%d", (i - CAM_IFE_PIX_PATH_RES_RDI_0));
+	}
+
+	if (len)
+		CAM_ERR(CAM_ISP, "CSID[%u] %s", csid_hw->hw_intf->hw_idx, log_buf);
+
+}
+
+void cam_ife_csid_hw_ver2_drv_err_handler(void *csid)
+{
+	struct cam_ife_csid_ver2_hw       *csid_hw  = csid;
+	struct cam_ife_csid_ver2_reg_info *csid_reg = csid_hw->core_info->csid_reg;
+	struct cam_hw_soc_info            *soc_info = &csid_hw->hw_info->soc_info;
+	void __iomem                      *base =
+		soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	uint32_t cfg0_val = 0, cfg1_val = 0, cfg2_val = 0, debug_drv_0_val = 0, debug_drv_1_val = 0;
+
+	cfg0_val = cam_io_r_mb(base + csid_reg->cmn_reg->drv_cfg0_addr);
+	cfg1_val = cam_io_r_mb(base + csid_reg->cmn_reg->drv_cfg1_addr);
+	cfg2_val = cam_io_r_mb(base + csid_reg->cmn_reg->drv_cfg2_addr);
+	debug_drv_0_val = cam_io_r_mb(base + csid_reg->cmn_reg->debug_drv_0_addr);
+	debug_drv_1_val = cam_io_r_mb(base + csid_reg->cmn_reg->debug_drv_1_addr);
+
+	CAM_INFO(CAM_ISP,
+		"CSID[%u] DRV cfg0:0x%x cfg1:0x%x cfg2:0x%x qtimer_val [start:end] [0x%x : 0x%x]",
+		csid_hw->hw_intf->hw_idx, cfg0_val, cfg1_val, cfg2_val, debug_drv_0_val,
+		debug_drv_1_val);
+}
+
+void cam_ife_csid_hw_ver2_mup_mismatch_handler(
+	void *csid, void *resource)
+{
+	uint32_t                           idx = 0;
+	struct timespec64                  current_ts;
+	struct cam_ife_csid_ver2_hw       *csid_hw = csid;
+	struct cam_isp_resource_node      *res = resource;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg =
+		(struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	struct cam_ife_csid_cid_data      *cid_data = &csid_hw->cid_data[path_cfg->cid];
+	struct cam_hw_soc_info            *soc_info = &csid_hw->hw_info->soc_info;
+	struct cam_ife_csid_ver2_reg_info *csid_reg = NULL;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+
+	CAM_INFO(CAM_ISP, "CSID:%u Last MUP value 0x%x programmed for res [id: %d name: %s]",
+		csid_hw->hw_intf->hw_idx, csid_hw->rx_cfg.mup, res->res_id, res->res_name);
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	if (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid) {
+		CAM_INFO(CAM_ISP, "CSID:%u vc0 %d vc1 %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc,
+			cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].vc);
+
+		if (path_cfg->ts_comb_vcdt_en) {
+			ktime_get_boottime_ts64(&current_ts);
+
+			idx = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				path_reg->timestamp_curr0_sof_addr) &
+				csid_reg->cmn_reg->ts_comb_vcdt_mask;
+
+			if (idx < CAM_IFE_CSID_MULTI_VC_DT_GRP_MAX)
+				CAM_INFO(CAM_ISP,
+					"CSID:%d Received frame with vc:%d on [id: %d name: %s] timestamp: %lld.%09lld",
+					csid_hw->hw_intf->hw_idx, cid_data->vc_dt[idx].vc,
+					res->res_id, res->res_name, current_ts.tv_sec,
+					current_ts.tv_nsec);
+			else
+				CAM_ERR(CAM_ISP,
+					"CSID:%d Get invalid vc index: %d on [id: %d name: %s] timestamp: %lld.%09lld",
+					csid_hw->hw_intf->hw_idx, idx, res->res_id,
+					res->res_name, current_ts.tv_sec, current_ts.tv_nsec);
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "CSID:%u Multi-VCDT is not enabled, vc0 %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc);
+	}
+}
+
+void cam_ife_csid_ver2_print_illegal_programming_irq_status(
+	void *csid, void *resource)
+{
+	struct cam_ife_csid_ver2_hw                        *csid_hw = csid;
+	struct cam_isp_resource_node                       *res = resource;
+	struct cam_ife_csid_ver2_reg_info                  *csid_reg;
+	struct cam_ife_csid_ver2_path_cfg                  *path_cfg;
+	struct cam_ife_csid_cid_data                       *cid_data;
+	struct cam_hw_soc_info                             *soc_info;
+	void __iomem                                       *base;
+	const struct cam_ife_csid_ver2_path_reg_info       *path_reg;
+	uint32_t vcdt_cfg0 = 0, cfg0 = 0, cfg1 = 0;
+	uint32_t decode_fmt = 0, decode_fmt1 = 0;
+	uint32_t vc, dt, vc1, dt1;
+
+	csid_reg = csid_hw->core_info->csid_reg;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	if (!path_cfg || (path_cfg->cid >= CAM_IFE_CSID_CID_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid params: path_cfg: %pK, num_cids: %d",
+			 csid_hw->hw_intf->hw_idx, path_cfg, (path_cfg ? (path_cfg->cid) : -1));
+		return;
+	}
+
+	cid_data = &csid_hw->cid_data[path_cfg->cid];
+	soc_info = &csid_hw->hw_info->soc_info;
+	base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	cfg0 = cam_io_r_mb(base + path_reg->cfg0_addr);
+	cfg1 = cam_io_r_mb(base + path_reg->cfg1_addr);
+	vcdt_cfg0 = cam_io_r_mb(base + path_reg->multi_vcdt_cfg0_addr);
+
+	CAM_INFO(CAM_ISP, "cfg0 = %x cfg1 = %x vcdt_cfg0 = %x vcrop %x", cfg0, cfg1, vcdt_cfg0,
+		cam_io_r_mb(base + path_reg->vcrop_addr));
+
+	if (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid) {
+		decode_fmt = ((cfg0 >>
+			csid_reg->cmn_reg->decode_format_shift_val) &
+			csid_reg->cmn_reg->decode_format_mask);
+		decode_fmt1 = ((vcdt_cfg0 >>
+			csid_reg->cmn_reg->decode_format1_shift_val) &
+			csid_reg->cmn_reg->decode_format_mask);
+		vc = ((cfg0 >> csid_reg->cmn_reg->vc_shift_val) &
+			csid_reg->cmn_reg->vc_mask);
+		dt = ((cfg0 >> csid_reg->cmn_reg->dt_shift_val) &
+			csid_reg->cmn_reg->dt_mask);
+		vc1 = ((vcdt_cfg0 >> csid_reg->cmn_reg->multi_vcdt_vc1_shift_val) &
+			csid_reg->cmn_reg->vc_mask);
+		dt1 = ((vcdt_cfg0 >> csid_reg->cmn_reg->multi_vcdt_dt1_shift_val) &
+			csid_reg->cmn_reg->dt_mask);
+
+		if ((decode_fmt == csid_reg->cmn_reg->decode_format_payload_only) ||
+			(decode_fmt1 == csid_reg->cmn_reg->decode_format_payload_only)) {
+			if (decode_fmt1 != decode_fmt) {
+				CAM_ERR(CAM_ISP,
+					"CSID:%u decode_fmt %d decode_fmt1 %d mismatch",
+					csid_hw->hw_intf->hw_idx,
+					decode_fmt,
+					decode_fmt1);
+			}
+		}
+
+		if ((vc == vc1) && (dt == dt1)) {
+			if (decode_fmt != decode_fmt1) {
+				CAM_ERR(CAM_ISP,
+					"CSID:%u Wrong multi VC-DT configuration",
+					csid_hw->hw_intf->hw_idx);
+				CAM_ERR(CAM_ISP,
+					"CSID:%u fmt %d fmt1 %d vc %d vc1 %d dt %d dt1 %d",
+					csid_hw->hw_intf->hw_idx, decode_fmt,
+					decode_fmt, vc, vc1, dt, dt1);
+
+			}
+		}
+	}
+
+	if (!(csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_DISABLE_EARLY_EOF) &&
+		csid_reg->cmn_reg->early_eof_supported) {
+		if ((cfg1 & BIT(path_reg->early_eof_en_shift_val)) &&
+			!(cfg1 & BIT(path_reg->crop_v_en_shift_val))) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%u Early EOF %d enabled without VCROP %d",
+				csid_hw->hw_intf->hw_idx,
+				cfg1 & path_reg->early_eof_en_shift_val,
+				cfg1 & path_reg->crop_v_en_shift_val);
+
+		}
+	}
+
+	CAM_INFO(CAM_ISP, "CSID:%u Illegal Programming for res [id: %d name: %s]",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_name);
+}
+
+static void cam_ife_csid_ver2_print_debug_reg_status(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	void __iomem *mem_base;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	uint32_t val0 = 0, val1 = 0, val2 = 0, val3 = 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		csid_hw->core_info->csid_reg;
+
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	val0 = cam_io_r_mb(mem_base +
+		path_reg->debug_camif_0_addr);
+	val1 = cam_io_r_mb(mem_base +
+		path_reg->debug_camif_1_addr);
+	val2 = cam_io_r_mb(mem_base +
+		path_reg->debug_halt_status_addr);
+
+	/* Read test bus if enabled */
+	if (csid_hw->debug_info.test_bus_enabled)
+		val3 = cam_io_r_mb(mem_base +
+			csid_reg->cmn_reg->test_bus_debug);
+
+	CAM_INFO(CAM_ISP,
+		"CSID:%u debug_camif_0: 0x%x debug_camif_1: 0x%x halt_status: 0x%x test_bus: %s test_bus_val: 0x%x for res: %s ",
+		csid_hw->hw_intf->hw_idx, val0, val1, val2,
+		CAM_BOOL_TO_YESNO(csid_hw->debug_info.test_bus_enabled),
+		val3, res->res_name);
+}
+
+static int cam_ife_csid_ver2_parse_path_irq_status(
+	struct cam_ife_csid_ver2_hw  *csid_hw,
+	struct cam_isp_resource_node *res,
+	uint32_t                     index,
+	uint32_t                     err_mask,
+	uint32_t                     irq_status,
+	struct cam_ife_csid_ver2_evt_payload *evt_payload)
+{
+	const uint8_t                          **irq_reg_tag;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	uint32_t                                 bit_pos = 0;
+	uint32_t                                 status, err_type = 0;
+	uint32_t                                 sof_irq_debug_en = 0;
+	size_t                                   len = 0;
+	uint8_t                                 *log_buf = NULL;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		csid_hw->core_info->csid_reg;
+
+	log_buf = csid_hw->log_buf;
+
+	irq_reg_tag = cam_ife_csid_get_irq_reg_tag_ptr();
+
+	status = irq_status & err_mask;
+	while (status) {
+		if ((csid_reg->path_irq_desc[bit_pos].bitmask != 0) && (status & 0x1)) {
+			CAM_ERR_BUF(CAM_ISP, log_buf, CAM_IFE_CSID_LOG_BUF_LEN, &len, "%s",
+				csid_reg->path_irq_desc[bit_pos].desc);
+			if (csid_reg->path_irq_desc[bit_pos].err_type)
+				err_type |=  csid_reg->path_irq_desc[bit_pos].err_type;
+			if (csid_reg->path_irq_desc[bit_pos].err_handler)
+				csid_reg->path_irq_desc[bit_pos].err_handler(csid_hw, res);
+		}
+		bit_pos++;
+		status >>= 1;
+	}
+
+	if (len)
+		CAM_ERR(CAM_ISP, "CSID[%u] %s status: 0x%x Errors:%s",
+			csid_hw->hw_intf->hw_idx, irq_reg_tag[index],
+			irq_status, log_buf);
+
+	status = irq_status & csid_hw->debug_info.path_mask;
+	bit_pos = 0;
+	while (status) {
+		if ((csid_reg->path_irq_desc[bit_pos].bitmask != 0) && (status & 0x1))
+			CAM_INFO(CAM_ISP, "CSID[%u] IRQ %s %s timestamp:[%lld.%09lld]",
+				csid_hw->hw_intf->hw_idx, irq_reg_tag[index],
+				csid_reg->path_irq_desc[bit_pos].desc,
+				evt_payload->timestamp.tv_sec,
+				evt_payload->timestamp.tv_nsec);
+
+		bit_pos++;
+		status >>= 1;
+	}
+
+	if (csid_hw->flags.sof_irq_triggered) {
+		if ((irq_status & IFE_CSID_VER2_PATH_INFO_INPUT_SOF))
+			csid_hw->counters.irq_debug_cnt++;
+
+		if (csid_hw->counters.irq_debug_cnt >=
+			CAM_CSID_IRQ_SOF_DEBUG_CNT_MAX) {
+			cam_ife_csid_ver2_sof_irq_debug(csid_hw,
+				&sof_irq_debug_en);
+			csid_hw->counters.irq_debug_cnt = 0;
+		}
+	}
+
+	return err_type;
+}
+
+static int cam_ife_csid_ver2_top_info_irq_bottom_half(
+	void                                      *handler_priv,
+	void                                      *evt_payload_priv)
+{
+	struct cam_ife_csid_ver2_evt_payload       *payload;
+	struct cam_ife_csid_ver2_hw                *csid_hw = NULL;
+	uint32_t                                    irq_status;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	payload = evt_payload_priv;
+	csid_hw = handler_priv;
+
+	irq_status = payload->irq_reg_val & csid_hw->debug_info.top_mask;
+	if (!irq_status) {
+		CAM_ERR(CAM_ISP, "CSID:%u Unexpected Scenario", csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	if (irq_status & IFE_CSID_VER2_TOP_INFO_VOTE_UP) {
+		cam_cpas_log_votes(true);
+		CAM_INFO(CAM_ISP, "CSID:%u INFO_VOTE_UP timestamp:[%lld.%09lld]",
+			csid_hw->hw_intf->hw_idx, payload->timestamp.tv_sec,
+			payload->timestamp.tv_nsec);
+	}
+
+	if (irq_status & IFE_CSID_VER2_TOP_INFO_VOTE_DN) {
+		cam_cpas_log_votes(true);
+		CAM_INFO(CAM_ISP, "CSID:%u INFO_VOTE_DN timestamp:[%lld.%09lld]",
+			csid_hw->hw_intf->hw_idx, payload->timestamp.tv_sec,
+			payload->timestamp.tv_nsec);
+	}
+
+	if (irq_status & IFE_CSID_VER2_TOP_ERR_NO_VOTE_DN) {
+		CAM_INFO(CAM_ISP, "CSID:%u ERR_NO_VOTE_DN timestamp:[%lld.%09lld]",
+			csid_hw->hw_intf->hw_idx, payload->timestamp.tv_sec,
+			payload->timestamp.tv_nsec);
+
+		cam_ife_csid_hw_ver2_drv_err_handler(csid_hw);
+	}
+
+	cam_ife_csid_ver2_put_evt_payload(csid_hw, &payload,
+		&csid_hw->path_free_payload_list,
+		&csid_hw->path_payload_lock);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_top_err_irq_bottom_half(
+	void                                      *handler_priv,
+	void                                      *evt_payload_priv)
+{
+	struct cam_ife_csid_ver2_evt_payload       *payload;
+	struct cam_ife_csid_ver2_hw                *csid_hw = NULL;
+	struct cam_ife_csid_ver2_reg_info          *csid_reg;
+	uint32_t                                    irq_status;
+	uint32_t                                    event_type = 0;
+	uint32_t                                    i = 0;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	payload = evt_payload_priv;
+	csid_hw = handler_priv;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	irq_status = payload->irq_reg_val &
+		csid_reg->cmn_reg->top_err_irq_mask[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0];
+
+	if (!irq_status) {
+		CAM_ERR(CAM_ISP, "CSID:%u Unexpected Scenario", csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	if (!csid_reg->num_top_err_irqs) {
+		CAM_WARN_RATE_LIMIT_CUSTOM(CAM_ISP, 100, 1,
+			"CSID:%u Unexpected Scenario no top error irqs", csid_hw->hw_intf->hw_idx);
+		cam_ife_csid_ver2_put_evt_payload(csid_hw, &payload,
+			&csid_hw->path_free_payload_list, &csid_hw->path_payload_lock);
+		return 0;
+	}
+
+	for (i = 0; i < csid_reg->num_top_err_irqs[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]; i++) {
+		if (!csid_reg->top_irq_desc) {
+			CAM_ERR(CAM_ISP, "CSID:%u Unexpected Scenario top irq descriptor empty",
+				csid_hw->hw_intf->hw_idx);
+			break;
+		}
+
+		if ((*csid_reg->top_irq_desc)[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i].bitmask &
+				irq_status) {
+			CAM_ERR(CAM_ISP, "%s %s",
+					(*csid_reg->top_irq_desc)
+					[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i].err_name,
+					(*csid_reg->top_irq_desc)
+					[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i].desc);
+			if ((*csid_reg->top_irq_desc)[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i]
+				.err_handler)
+				(*csid_reg->top_irq_desc)[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i]
+					.err_handler(csid_hw);
+
+			event_type |= (*csid_reg->top_irq_desc)
+				[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i].err_type;
+		}
+	}
+
+	if (event_type)
+		cam_ife_csid_ver2_handle_event_err(csid_hw,
+				irq_status, event_type, false, NULL);
+
+	cam_ife_csid_ver2_put_evt_payload(csid_hw, &payload,
+		&csid_hw->path_free_payload_list,
+		&csid_hw->path_payload_lock);
+
+	return 0;
+}
+
+void cam_ife_csid_ver2_print_format_measure_info(
+	void *csid, void *resource)
+{
+	struct cam_ife_csid_ver2_hw       *csid_hw = csid;
+	struct cam_isp_resource_node      *res = resource;
+	struct cam_ife_csid_ver2_reg_info *csid_reg = csid_hw->core_info->csid_reg;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg =
+		csid_reg->path_reg[res->res_id];
+	struct cam_hw_soc_info *soc_info = &csid_hw->hw_info->soc_info;
+	void __iomem *base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	uint32_t expected_frame = 0, actual_frame = 0, format_measure_cfg0 = 0;
+	int data_idx = 0;
+
+	actual_frame = cam_io_r_mb(base + path_reg->format_measure0_addr);
+	expected_frame = cam_io_r_mb(base + path_reg->format_measure_cfg1_addr);
+	format_measure_cfg0 = cam_io_r_mb(base + path_reg->format_measure_cfg0_addr);
+
+	CAM_INFO(CAM_ISP, "CSID[%u] res [id :%d name : %s] format_measure_cfg0:0x%x",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_name,
+		format_measure_cfg0);
+	CAM_ERR(CAM_ISP, "CSID[%u] Frame Size Error Expected[h: %u w: %u] Actual[h: %u w: %u]",
+		csid_hw->hw_intf->hw_idx, ((expected_frame >>
+		csid_reg->cmn_reg->format_measure_height_shift_val) &
+		csid_reg->cmn_reg->format_measure_height_mask_val),
+		expected_frame &
+		csid_reg->cmn_reg->format_measure_width_mask_val,
+		((actual_frame >>
+		csid_reg->cmn_reg->format_measure_height_shift_val) &
+		csid_reg->cmn_reg->format_measure_height_mask_val),
+		actual_frame &
+		csid_reg->cmn_reg->format_measure_width_mask_val);
+
+	cam_ife_csid_ver2_print_hbi_vbi(csid_hw, res);
+
+	/* AUX settings update to phy for pix and line count errors */
+	data_idx = (int)(csid_hw->rx_cfg.phy_sel - csid_reg->cmn_reg->phy_sel_base_idx);
+	if (data_idx < 0)
+		CAM_WARN(CAM_ISP, "Can't notify csiphy, incorrect phy selected=%d",
+			data_idx);
+	else
+		cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+			CAM_SUBDEV_MESSAGE_APPLY_CSIPHY_AUX, (void *)&data_idx);
+
+}
+
+static int cam_ife_csid_ver2_ipp_bottom_half(
+	void                                      *handler_priv,
+	void                                      *evt_payload_priv)
+{
+	struct cam_ife_csid_ver2_evt_payload         *payload;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg;
+	struct cam_isp_resource_node                 *res;
+	struct cam_ife_csid_ver2_hw                  *csid_hw = NULL;
+	struct cam_isp_hw_event_info                  evt_info = {0};
+	struct cam_hw_info                           *hw_info;
+	struct cam_ife_csid_ver2_path_cfg            *path_cfg;
+	struct cam_isp_sof_ts_data                    sof_and_boot_time;
+	uint32_t                                      irq_status_ipp;
+	uint32_t                                      err_mask;
+	uint32_t                                      err_type = 0;
+	uint32_t                                      sof_irq_mask = 0;
+	uint32_t                                      eof_irq_mask = 0;
+	uint32_t                                      epoch0_irq_mask = 0;
+	uint32_t                                      rup_irq_mask = 0;
+	int                                           i, rc = 0;
+	bool                                          out_of_sync_fatal = false;
+	void                                         *token = NULL;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params. evt_payload_priv: %s, handler_priv: %s",
+			CAM_IS_NULL_TO_STR(evt_payload_priv),
+			CAM_IS_NULL_TO_STR(handler_priv));
+		return -EINVAL;
+	}
+
+	payload = evt_payload_priv;
+	res   =  handler_priv;
+	hw_info = (struct cam_hw_info *)res->hw_intf->hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	csid_reg = csid_hw->core_info->csid_reg;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	if (!path_cfg || (path_cfg->irq_reg_idx >= CAM_IFE_CSID_IRQ_REG_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid params: path_cfg: %pK, irq_reg_idx: %d",
+			csid_hw->hw_intf->hw_idx, path_cfg,
+			(path_cfg ? (path_cfg->irq_reg_idx) : -1));
+		rc = -EINVAL;
+		goto end;
+	}
+
+	irq_status_ipp = payload->irq_reg_val;
+	sof_and_boot_time.boot_time = payload->timestamp;
+	sof_and_boot_time.sof_ts = payload->sof_ts_reg_val;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] multi_ctxt_en %d IPP status:0x%x", csid_hw->hw_intf->hw_idx,
+		payload->is_mc, irq_status_ipp);
+
+	if (!csid_hw->flags.device_enabled) {
+		CAM_DBG(CAM_ISP, "CSID[%u] bottom-half after stop [0x%x]",
+			csid_hw->hw_intf->hw_idx, irq_status_ipp);
+		goto end;
+	}
+
+	evt_info.hw_type  = CAM_ISP_HW_TYPE_CSID;
+	evt_info.hw_idx   = csid_hw->hw_intf->hw_idx;
+	evt_info.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	evt_info.reg_val  = irq_status_ipp;
+	evt_info.event_data = &sof_and_boot_time;
+	evt_info.is_secondary_evt = false;
+
+	for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+		if (csid_hw->token_data[i].res_id == res->res_id) {
+			token = csid_hw->token_data[i].token;
+			break;
+		}
+	}
+
+	if (!token) {
+		CAM_ERR(CAM_ISP, "cannot find token data for CSID[%u] res :%d ",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		goto end;
+	}
+
+	if (!csid_hw->event_cb) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID[%u] event cb not registered res :%d ",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		goto end;
+	}
+
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	if (payload->is_mc) {
+		sof_irq_mask = csid_reg->ipp_mc_reg->comp_sof_mask;
+		eof_irq_mask = csid_reg->ipp_mc_reg->comp_eof_mask;
+		rup_irq_mask = csid_reg->ipp_mc_reg->comp_rup_mask;
+		epoch0_irq_mask = csid_reg->ipp_mc_reg->comp_epoch0_mask;
+		evt_info.res_id   = CAM_IFE_PIX_PATH_RES_IPP;
+	} else {
+		sof_irq_mask = path_reg->sof_irq_mask;
+		eof_irq_mask = path_reg->eof_irq_mask;
+		rup_irq_mask = path_reg->rup_irq_mask;
+		epoch0_irq_mask = path_reg->epoch0_irq_mask;
+		evt_info.res_id   = res->res_id;
+	}
+
+	if (irq_status_ipp & eof_irq_mask) {
+		cam_ife_csid_ver2_update_event_ts(&path_cfg->eof_ts, &payload->timestamp);
+		csid_hw->event_cb(token, CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+	}
+
+	if (irq_status_ipp & sof_irq_mask) {
+		cam_ife_csid_ver2_update_event_ts(&path_cfg->sof_ts, &payload->timestamp);
+		csid_hw->event_cb(token, CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+	}
+
+	if (irq_status_ipp & rup_irq_mask)
+		csid_hw->event_cb(token, CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&evt_info);
+
+	if (irq_status_ipp & epoch0_irq_mask) {
+		cam_ife_csid_ver2_update_event_ts(&path_cfg->epoch_ts, &payload->timestamp);
+		csid_hw->event_cb(token, CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+	}
+
+	if (payload->is_mc)
+		goto end;
+
+	if (irq_status_ipp & IFE_CSID_VER2_PATH_SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP) {
+		atomic_inc(&path_cfg->switch_out_of_sync_cnt);
+		/* If threshold is seen, notify error */
+		if (atomic_read(&path_cfg->switch_out_of_sync_cnt) >=
+			CAM_IFE_CSID_MAX_OUT_OF_SYNC_ERR_COUNT)
+			out_of_sync_fatal = true;
+	}
+
+	err_mask = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask;
+	spin_lock(&csid_hw->lock_state);
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID[%u] powered down state",
+			csid_hw->hw_intf->hw_idx);
+		goto unlock;
+	}
+
+	err_type = cam_ife_csid_ver2_parse_path_irq_status(
+		csid_hw, res, CAM_IFE_CSID_IRQ_REG_IPP,
+		err_mask, irq_status_ipp, payload);
+
+	if (err_type || out_of_sync_fatal) {
+		if (out_of_sync_fatal)
+			err_type = CAM_ISP_HW_ERROR_CSID_SENSOR_FRAME_DROP;
+
+		cam_ife_csid_ver2_handle_event_err(csid_hw,
+			irq_status_ipp, err_type, false, res);
+	}
+
+unlock:
+	spin_unlock(&csid_hw->lock_state);
+end:
+	cam_ife_csid_ver2_put_evt_payload(csid_hw, &payload,
+			&csid_hw->path_free_payload_list,
+			&csid_hw->path_payload_lock);
+
+	return rc;
+}
+
+static int cam_ife_csid_ver2_ppp_bottom_half(
+	void                                      *handler_priv,
+	void                                      *evt_payload_priv)
+{
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	struct cam_ife_csid_ver2_evt_payload         *payload;
+	struct cam_ife_csid_ver2_path_cfg            *path_cfg;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg;
+	struct cam_isp_resource_node                 *res;
+	struct cam_ife_csid_ver2_hw                  *csid_hw = NULL;
+	struct cam_hw_info                           *hw_info;
+	uint32_t                                      irq_status_ppp;
+	uint32_t                                      err_mask;
+	uint32_t                                      err_type = 0;
+	int                                           rc = 0;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params. evt_payload_priv: %s, handler_priv: %s",
+			CAM_IS_NULL_TO_STR(evt_payload_priv),
+			CAM_IS_NULL_TO_STR(handler_priv));
+		return -EINVAL;
+	}
+
+	payload = evt_payload_priv;
+	res   =  handler_priv;
+	hw_info = (struct cam_hw_info *)res->hw_intf->hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	if (!path_cfg || (path_cfg->irq_reg_idx >= CAM_IFE_CSID_IRQ_REG_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid params: path_cfg: %pK, irq_reg_idx: %d",
+			csid_hw->hw_intf->hw_idx, path_cfg,
+			(path_cfg ? (path_cfg->irq_reg_idx) : -1));
+		rc = -EINVAL;
+		goto end;
+	}
+
+	irq_status_ppp = payload->irq_reg_val;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		csid_hw->core_info->csid_reg;
+
+	path_reg = csid_reg->path_reg[res->res_id];
+	err_mask = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] PPP status:0x%x", csid_hw->hw_intf->hw_idx,
+		irq_status_ppp);
+
+	if (!csid_hw->flags.device_enabled) {
+		CAM_DBG(CAM_ISP, "CSID[%u] bottom-half after stop [0x%x]",
+			csid_hw->hw_intf->hw_idx, irq_status_ppp);
+		goto end;
+	}
+
+	spin_lock(&csid_hw->lock_state);
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID[%u] powered down state",
+			csid_hw->hw_intf->hw_idx);
+		goto unlock;
+	}
+
+	err_type = cam_ife_csid_ver2_parse_path_irq_status(
+		csid_hw, res, CAM_IFE_CSID_IRQ_REG_PPP,
+		err_mask, irq_status_ppp, payload);
+
+	if (err_type)
+		cam_ife_csid_ver2_handle_event_err(csid_hw,
+			irq_status_ppp,
+			err_type,
+			false,
+			res);
+unlock:
+	spin_unlock(&csid_hw->lock_state);
+end:
+	cam_ife_csid_ver2_put_evt_payload(csid_hw, &payload,
+			&csid_hw->path_free_payload_list,
+			&csid_hw->path_payload_lock);
+
+	return rc;
+}
+
+static int cam_ife_csid_ver2_rdi_bottom_half(
+	void                                      *handler_priv,
+	void                                      *evt_payload_priv)
+{
+	struct cam_ife_csid_ver2_evt_payload         *payload;
+	struct cam_ife_csid_ver2_hw                  *csid_hw = NULL;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg;
+	struct cam_ife_csid_ver2_path_cfg            *path_cfg;
+	struct cam_isp_resource_node                 *res;
+	const struct cam_ife_csid_ver2_path_reg_info *rdi_reg;
+	struct cam_hw_info                           *hw_info;
+	uint32_t                                      irq_status_rdi;
+	uint32_t                                      err_mask;
+	uint32_t                                      err_type = 0;
+	struct cam_isp_hw_event_info                  evt_info = {0};
+	struct cam_isp_sof_ts_data                    sof_and_boot_time;
+	int                                           i, rc = 0;
+	void                                          *token = NULL;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params. evt_payload_priv: %s, handler_priv: %s",
+			CAM_IS_NULL_TO_STR(evt_payload_priv),
+			CAM_IS_NULL_TO_STR(handler_priv));
+		return -EINVAL;
+	}
+
+	payload = evt_payload_priv;
+	res   =  handler_priv;
+	hw_info = (struct cam_hw_info *)res->hw_intf->hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	if (!path_cfg || (path_cfg->irq_reg_idx >= CAM_IFE_CSID_IRQ_REG_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid params: path_cfg: %pK, irq_reg_idx: %d",
+			csid_hw->hw_intf->hw_idx, path_cfg,
+			(path_cfg ? (path_cfg->irq_reg_idx) : -1));
+		rc = -EINVAL;
+		goto end;
+	}
+
+	sof_and_boot_time.boot_time = payload->timestamp;
+	sof_and_boot_time.sof_ts = payload->sof_ts_reg_val;
+
+	evt_info.hw_idx   = csid_hw->hw_intf->hw_idx;
+	evt_info.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	evt_info.event_data = &sof_and_boot_time;
+	evt_info.is_secondary_evt = false;
+
+
+	for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+		if (csid_hw->token_data[i].res_id == res->res_id) {
+			token = csid_hw->token_data[i].token;
+			break;
+		}
+	}
+
+	if (!token) {
+		CAM_ERR(CAM_ISP, "cannot find token data for CSID[%u] res :%d ",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		goto end;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		csid_hw->core_info->csid_reg;
+
+	irq_status_rdi = payload->irq_reg_val;
+	rdi_reg = csid_reg->path_reg[res->res_id];
+
+	if (!rdi_reg)
+		goto end;
+
+	if (!csid_hw->flags.device_enabled) {
+		CAM_DBG(CAM_ISP, "CSID:%u bottom-half after stop [0x%x]",
+			csid_hw->hw_intf->hw_idx, irq_status_rdi);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID[%u] RDI:%d status:0x%x",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id, irq_status_rdi);
+	err_mask = rdi_reg->non_fatal_err_mask |
+		rdi_reg->fatal_err_mask;
+
+	spin_lock(&csid_hw->lock_state);
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID[%u] powered down state",
+			csid_hw->hw_intf->hw_idx);
+		spin_unlock(&csid_hw->lock_state);
+		goto end;
+	}
+
+	err_type = cam_ife_csid_ver2_parse_path_irq_status(csid_hw, res,
+		path_cfg->irq_reg_idx,
+		err_mask, irq_status_rdi, payload);
+
+	spin_unlock(&csid_hw->lock_state);
+	if (err_type) {
+		cam_ife_csid_ver2_handle_event_err(csid_hw,
+			irq_status_rdi, err_type, false, res);
+		goto end;
+	}
+
+	if (!csid_hw->event_cb) {
+		CAM_DBG(CAM_ISP, "CSID[%u] no cb registered",
+				csid_hw->hw_intf->hw_idx);
+		goto end;
+	}
+
+	evt_info.res_id = res->res_id;
+	evt_info.reg_val = irq_status_rdi;
+	evt_info.hw_type = CAM_ISP_HW_TYPE_CSID;
+
+	if (irq_status_rdi & IFE_CSID_VER2_PATH_SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP) {
+		bool is_secondary = true;
+		bool do_notify = false;
+
+		/* Only notify if secondary event is subscribed for */
+		if ((path_cfg->sec_evt_config.en_secondary_evt) &&
+			(path_cfg->sec_evt_config.evt_type &
+			CAM_IFE_CSID_EVT_SENSOR_SYNC_FRAME_DROP))
+			do_notify = true;
+
+		/* Validate error threshold for primary RDI (master) */
+		if (res->is_rdi_primary_res) {
+			atomic_inc(&path_cfg->switch_out_of_sync_cnt);
+			if (atomic_read(&path_cfg->switch_out_of_sync_cnt) >=
+				CAM_IFE_CSID_MAX_OUT_OF_SYNC_ERR_COUNT) {
+				do_notify = true;
+				is_secondary = false;
+			}
+		}
+
+		if (do_notify)
+			cam_ife_csid_ver2_handle_event_err(csid_hw, irq_status_rdi,
+				CAM_ISP_HW_ERROR_CSID_SENSOR_FRAME_DROP, is_secondary, res);
+	}
+
+	if (irq_status_rdi & rdi_reg->eof_irq_mask) {
+		cam_ife_csid_ver2_update_event_ts(&path_cfg->eof_ts, &payload->timestamp);
+		csid_hw->event_cb(token, CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+	}
+
+	if ((irq_status_rdi & rdi_reg->sof_irq_mask)) {
+		if (path_cfg->sec_evt_config.en_secondary_evt &&
+			(path_cfg->sec_evt_config.evt_type & CAM_IFE_CSID_EVT_SOF)) {
+			evt_info.is_secondary_evt = true;
+		}
+		cam_ife_csid_ver2_update_event_ts(&path_cfg->sof_ts, &payload->timestamp);
+		csid_hw->event_cb(token, CAM_ISP_HW_EVENT_SOF,	(void *)&evt_info);
+	}
+
+	if (irq_status_rdi & rdi_reg->rup_irq_mask)
+		csid_hw->event_cb(token, CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&evt_info);
+
+	if ((irq_status_rdi & rdi_reg->epoch0_irq_mask)) {
+		if (path_cfg->sec_evt_config.en_secondary_evt &&
+			(path_cfg->sec_evt_config.evt_type & CAM_IFE_CSID_EVT_EPOCH)) {
+			evt_info.is_secondary_evt = true;
+		}
+		cam_ife_csid_ver2_update_event_ts(&path_cfg->epoch_ts, &payload->timestamp);
+		csid_hw->event_cb(token, CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+	}
+end:
+	cam_ife_csid_ver2_put_evt_payload(csid_hw, &payload,
+		&csid_hw->path_free_payload_list, &csid_hw->path_payload_lock);
+
+	return rc;
+}
+
+int cam_ife_csid_ver2_get_hw_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw_caps           *hw_caps;
+	struct cam_ife_csid_ver2_hw           *csid_hw;
+	struct cam_hw_info                    *hw_info;
+	struct cam_csid_soc_private           *soc_private = NULL;
+	struct cam_ife_csid_ver2_reg_info     *csid_reg;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info  *)hw_priv;
+
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	hw_caps = (struct cam_ife_csid_hw_caps *) get_hw_cap_args;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_private = (struct cam_csid_soc_private *)
+			csid_hw->hw_info->soc_info.soc_private;
+
+	hw_caps->num_rdis = csid_reg->cmn_reg->num_rdis;
+	hw_caps->num_pix = csid_reg->cmn_reg->num_pix;
+	hw_caps->num_ppp = csid_reg->cmn_reg->num_ppp;
+	hw_caps->major_version = csid_reg->cmn_reg->major_version;
+	hw_caps->minor_version = csid_reg->cmn_reg->minor_version;
+	hw_caps->version_incr = csid_reg->cmn_reg->version_incr;
+	hw_caps->global_reset_en = csid_reg->cmn_reg->global_reset;
+	hw_caps->rup_en = csid_reg->cmn_reg->rup_supported;
+	hw_caps->only_master_rup = csid_reg->cmn_reg->only_master_rup;
+	hw_caps->is_lite = soc_private->is_ife_csid_lite;
+	hw_caps->sfe_ipp_input_rdi_res = csid_reg->cmn_reg->sfe_ipp_input_rdi_res;
+	hw_caps->camif_irq_support = csid_reg->cmn_reg->camif_irq_support;
+	hw_caps->is_ife_sfe_mapped = csid_reg->is_ife_sfe_mapped;
+
+	CAM_DBG(CAM_ISP,
+		"CSID:%u num-rdis:%d, num-pix:%d, major:%d minor:%d ver:%d",
+		csid_hw->hw_intf->hw_idx, hw_caps->num_rdis,
+		hw_caps->num_pix, hw_caps->major_version,
+		hw_caps->minor_version, hw_caps->version_incr);
+
+	return rc;
+}
+
+static void cam_ife_csid_ver2_dump_imp_regs(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	void __iomem *mem_base;
+	int top_irq_val[4] = {0};
+	int reset_cfg = 0;
+	int dual_csid_cfg = 0;
+	uint32_t clk_lvl;
+	uint32_t hw_idx;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_hw_soc_info            *soc_info;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	hw_idx = csid_hw->hw_intf->hw_idx;
+
+	/* Dumping CSID top irq registers */
+	top_irq_val[0] = cam_io_r_mb(mem_base +
+		csid_reg->cmn_reg->top_irq_status_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+	top_irq_val[1] = cam_io_r_mb(mem_base +
+		csid_reg->cmn_reg->top_irq_mask_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+	top_irq_val[2] = cam_io_r_mb(mem_base +
+		csid_reg->cmn_reg->top_irq_clear_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+	top_irq_val[3] = cam_io_r_mb(mem_base +
+		csid_reg->cmn_reg->top_irq_set_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+	CAM_INFO(CAM_ISP,
+		"CSID[%d] csid top status 0x%x, mask 0x%x, clr 0x%x, set 0x%x",
+		hw_idx, top_irq_val[0], top_irq_val[1],
+		top_irq_val[2], top_irq_val[3]);
+
+	/* Dumping CSID reset cfg and dual csid cfg */
+	reset_cfg = cam_io_r_mb(mem_base + csid_reg->cmn_reg->reset_cfg_addr);
+	dual_csid_cfg = cam_io_r_mb(
+		soc_info->reg_map[CAM_IFE_CSID_TOP_MEM_BASE_ID].mem_base +
+		csid_reg->top_reg->dual_csid_cfg0_addr[hw_idx]);
+	CAM_INFO(CAM_ISP,
+		"CSID[%d] csid reset_cfg 0x%x, dual_csid_cfg 0x%x, is_dual_en %d",
+		hw_idx, reset_cfg, dual_csid_cfg, csid_hw->top_cfg.dual_en);
+
+	/* Dumping CSID Clock */
+	cam_soc_util_get_clk_level(soc_info, csid_hw->clk_rate,
+		soc_info->src_clk_idx, &clk_lvl);
+
+	CAM_INFO(CAM_ISP,
+		"CSID[%d] clk lvl %u received clk_rate %u applied clk_rate sw_client:%lu hw_client:[%lu %lu]",
+		hw_idx, clk_lvl, csid_hw->clk_rate,
+		soc_info->applied_src_clk_rates.sw_client,
+		soc_info->applied_src_clk_rates.hw_client[hw_idx].high,
+		soc_info->applied_src_clk_rates.hw_client[hw_idx].low);
+}
+
+static int cam_ife_csid_ver2_wait_for_reset(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	unsigned long rem_jiffies = 0;
+	int rc = 0;
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(
+		&csid_hw->hw_info->hw_complete,
+		msecs_to_jiffies(CAM_IFE_CSID_RESET_TIMEOUT_MS));
+
+	if (rem_jiffies == 0) {
+		rc = -ETIMEDOUT;
+		if (csid_hw->debug_info.test_bus_enabled) {
+			struct cam_hw_soc_info *soc_info = &csid_hw->hw_info->soc_info;
+			struct cam_ife_csid_ver2_reg_info *csid_reg =
+				(struct cam_ife_csid_ver2_reg_info *) csid_hw->core_info->csid_reg;
+
+			CAM_ERR(CAM_ISP,
+				"CSID[%u], sync-mode[%d] test_bus: 0x%x reset timed out",
+				csid_hw->hw_intf->hw_idx, csid_hw->sync_mode,
+				cam_io_r_mb(
+					soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base +
+					csid_reg->cmn_reg->test_bus_debug));
+		} else
+			CAM_ERR(CAM_ISP, "CSID[%u], sync-mode[%d] reset timed out",
+				csid_hw->hw_intf->hw_idx, csid_hw->sync_mode);
+
+		cam_ife_csid_ver2_dump_imp_regs(csid_hw);
+	} else
+		CAM_DBG(CAM_ISP,
+			"CSID[%u], sync-mode[%d] reset success",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->sync_mode);
+
+	return rc;
+}
+
+static int cam_ife_csid_ver2_reset_irq_top_half(uint32_t    evt_id,
+	struct cam_irq_th_payload         *th_payload)
+{
+	struct cam_ife_csid_ver2_hw *csid_hw;
+
+	csid_hw = th_payload->handler_priv;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] TOP_IRQ_STATUS_0 = 0x%x", csid_hw->hw_intf->hw_idx,
+		th_payload->evt_status_arr[0]);
+
+	complete(&csid_hw->hw_info->hw_complete);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_internal_reset(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	uint32_t rst_cmd, uint32_t rst_location, uint32_t rst_mode)
+{
+	uint32_t val = 0;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_hw_soc_info                *soc_info;
+	const struct cam_ife_csid_ver2_csi2_rx_reg_info *csi2_reg;
+	void __iomem *mem_base;
+	int rc = 0;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csi2_reg = csid_reg->csi2_reg;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID[%u] powered down state",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	/* Input cut off prior to SW reset */
+	if (rst_cmd == CAM_IFE_CSID_RESET_CMD_SW_RST) {
+		cam_io_w_mb(0x0, mem_base + csi2_reg->cfg0_addr);
+		cam_io_w_mb(0x0, mem_base + csi2_reg->cfg1_addr);
+	}
+
+	if (csid_hw->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		goto wait_only;
+
+	reinit_completion(&csid_hw->hw_info->hw_complete);
+
+	/* Program the reset location */
+	if (rst_location == CAM_IFE_CSID_RESET_LOC_PATH_ONLY)
+		val |= (csid_reg->cmn_reg->rst_loc_path_only_val <<
+		       csid_reg->cmn_reg->rst_location_shift_val);
+	else if (rst_location == CAM_IFE_CSID_RESET_LOC_COMPLETE)
+		val |= (csid_reg->cmn_reg->rst_loc_complete_csid_val <<
+		       csid_reg->cmn_reg->rst_location_shift_val);
+
+	/*Program the mode */
+	if (rst_mode == CAM_CSID_HALT_AT_FRAME_BOUNDARY)
+		val |= (csid_reg->cmn_reg->rst_mode_frame_boundary_val <<
+			csid_reg->cmn_reg->rst_mode_shift_val);
+	else if (rst_mode == CAM_CSID_HALT_IMMEDIATELY)
+		val |= (csid_reg->cmn_reg->rst_mode_immediate_val <<
+			csid_reg->cmn_reg->rst_mode_shift_val);
+
+	cam_io_w_mb(val, mem_base + csid_reg->cmn_reg->reset_cfg_addr);
+	val = 0;
+
+	/*Program the cmd */
+	if (rst_cmd == CAM_IFE_CSID_RESET_CMD_IRQ_CTRL)
+		val = csid_reg->cmn_reg->rst_cmd_irq_ctrl_only_val;
+	else if (rst_cmd == CAM_IFE_CSID_RESET_CMD_HW_RST)
+		val = csid_reg->cmn_reg->rst_cmd_hw_reset_complete_val;
+	else if (rst_cmd == CAM_IFE_CSID_RESET_CMD_SW_RST)
+		val = csid_reg->cmn_reg->rst_cmd_sw_reset_complete_val;
+
+	cam_io_w_mb(val, mem_base + csid_reg->cmn_reg->reset_cmd_addr);
+
+wait_only:
+
+	rc = cam_ife_csid_ver2_wait_for_reset(csid_hw);
+
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"CSID[%u] Reset failed mode %d cmd %d loc %d",
+			csid_hw->hw_intf->hw_idx,
+			rst_mode, rst_cmd, rst_location);
+	reinit_completion(&csid_hw->hw_info->hw_complete);
+	return rc;
+}
+
+int cam_ife_csid_ver2_reset(void *hw_priv,
+	void *reset_args, uint32_t arg_size)
+{
+	struct cam_hw_info *hw_info;
+	struct cam_ife_csid_ver2_hw *csid_hw;
+	struct cam_csid_reset_cfg_args  *reset;
+	int rc = 0;
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	reset   = (struct cam_csid_reset_cfg_args  *)reset_args;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if (atomic_read(&csid_hw->init_global_reset_cnt))
+		goto skip_reset;
+
+	switch (reset->reset_type) {
+	case CAM_IFE_CSID_RESET_GLOBAL:
+		rc = cam_ife_csid_ver2_internal_reset(csid_hw,
+			CAM_IFE_CSID_RESET_CMD_SW_RST,
+			CAM_IFE_CSID_RESET_LOC_COMPLETE,
+			CAM_CSID_HALT_IMMEDIATELY);
+		break;
+
+	case CAM_IFE_CSID_RESET_PATH:
+		rc = cam_ife_csid_ver2_internal_reset(csid_hw,
+			CAM_IFE_CSID_RESET_CMD_HW_RST,
+			CAM_IFE_CSID_RESET_LOC_PATH_ONLY,
+			CAM_CSID_HALT_IMMEDIATELY);
+		break;
+
+	default:
+		rc = -EINVAL;
+		break;
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CSID[%u] reset type: %s failed",
+			csid_hw->hw_intf->hw_idx,
+			cam_ife_csid_reset_type_to_string(reset->reset_type));
+	else
+		CAM_DBG(CAM_ISP, "CSID[%u] reset type: %s",
+			csid_hw->hw_intf->hw_idx,
+			cam_ife_csid_reset_type_to_string(reset->reset_type));
+skip_reset:
+	atomic_inc(&csid_hw->init_global_reset_cnt);
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static inline void cam_ife_csid_ver2_maskout_path_irqs(
+	int32_t res_id,
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_ife_csid_ver2_path_cfg *path_cfg)
+{
+	int rc;
+
+	if (path_cfg->err_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			csid_hw->path_irq_controller[res_id],
+				path_cfg->err_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe path err irq CSID:%u rc: %d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		path_cfg->err_irq_handle = 0;
+	}
+
+	if (path_cfg->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			csid_hw->path_irq_controller[res_id],
+			path_cfg->irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe path info irq CSID:%u rc: %d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		path_cfg->irq_handle = 0;
+	}
+
+	if (path_cfg->discard_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			csid_hw->path_irq_controller[res_id],
+			path_cfg->discard_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe path discard irq CSID:%u rc: %d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		path_cfg->discard_irq_handle = 0;
+	}
+
+	if (path_cfg->top_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			path_cfg->top_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe path irq in top CSID:%u rc: %d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		path_cfg->top_irq_handle = 0;
+
+		(void) cam_irq_controller_unregister_dependent(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->path_irq_controller[res_id]);
+	}
+}
+
+static inline void cam_ife_csid_ver2_disable_path_irqs_evts(
+	int32_t res_id,
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_ife_csid_ver2_path_cfg *path_cfg)
+{
+	int rc;
+
+	if (path_cfg->err_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->path_irq_controller[res_id],
+				path_cfg->err_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe path err irq evt CSID:%u rc: %d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		path_cfg->err_irq_handle = 0;
+	}
+
+	if (path_cfg->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->path_irq_controller[res_id],
+			path_cfg->irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe path info irq evt CSID:%u rc: %d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		path_cfg->irq_handle = 0;
+	}
+
+	if (path_cfg->discard_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->path_irq_controller[res_id],
+			path_cfg->discard_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe path discard irq evt CSID:%u rc: %d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		path_cfg->discard_irq_handle = 0;
+	}
+
+	if (path_cfg->top_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			path_cfg->top_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"Failed to unsubscribe path irq in top evt CSID:%u rc: %d",
+				csid_hw->hw_intf->hw_idx, rc);
+
+		path_cfg->top_irq_handle = 0;
+
+		(void) cam_irq_controller_unregister_dependent(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->path_irq_controller[res_id]);
+	}
+}
+
+static int cam_ife_csid_ver2_disable_path(
+	bool                             maskout_irqs,
+	struct cam_ife_csid_ver2_hw     *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	struct cam_ife_csid_ver2_path_cfg       *path_cfg;
+	int                                      rc = 0;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		/* possible reason can be irqs are already disabled in case per port feature*/
+		CAM_DBG(CAM_ISP,
+			"CSID:%u path res type:%d res_id:%d Invalid state:%d possible reason:per port enabled",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+	}
+
+	if (res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%u Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	if (maskout_irqs)
+		cam_ife_csid_ver2_maskout_path_irqs(res->res_id,
+			csid_hw, path_cfg);
+	else
+		cam_ife_csid_ver2_disable_path_irqs_evts(res->res_id,
+			csid_hw, path_cfg);
+
+	/* Reset frame drop fields at stream off */
+	path_cfg->discard_init_frames = false;
+	path_cfg->skip_discard_frame_cfg = false;
+	path_cfg->num_frames_discard = 0;
+	path_cfg->sof_cnt = 0;
+	atomic_set(&path_cfg->switch_out_of_sync_cnt, 0);
+	return rc;
+}
+
+static int cam_ife_csid_ver2_decode_format1_validate(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg =
+		(struct cam_ife_csid_ver2_reg_info *)csid_hw->core_info->csid_reg;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg =
+		(struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	struct cam_ife_csid_cid_data *cid_data = &csid_hw->cid_data[path_cfg->cid];
+
+	/* Validation is only required  for multi vc dt use case */
+	if (!cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid)
+		return rc;
+
+	if ((path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt ==
+		csid_reg->cmn_reg->decode_format_payload_only) ||
+		(path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].decode_fmt  ==
+		 csid_reg->cmn_reg->decode_format_payload_only)) {
+		if (path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt !=
+			path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].decode_fmt) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%u decode_fmt %d decode_fmt1 %d mismatch",
+				csid_hw->hw_intf->hw_idx,
+				path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt,
+				path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].decode_fmt);
+			rc = -EINVAL;
+			goto err;
+		}
+	}
+
+	if ((cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].vc ==
+		cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc) &&
+		(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].dt ==
+		cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt)) {
+		if (path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt !=
+			path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].decode_fmt) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%u Wrong multi VC-DT configuration",
+					csid_hw->hw_intf->hw_idx);
+			CAM_ERR(CAM_ISP,
+				"CSID:%u fmt %d fmt1 %d vc %d vc1 %d dt %d dt1 %d",
+				csid_hw->hw_intf->hw_idx,
+				path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt,
+				path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].decode_fmt,
+				cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc,
+				cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].vc,
+				cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt,
+				cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].dt);
+			rc = -EINVAL;
+			goto err;
+		}
+	}
+
+	return rc;
+err:
+	CAM_ERR(CAM_ISP, "Invalid decode fmt1 cfg CSID[%u] res [id %d name %s] rc %d",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_name, rc);
+	return rc;
+}
+
+static bool cam_ife_csid_hw_ver2_need_unpack_mipi(
+	struct cam_ife_csid_ver2_hw                  *csid_hw,
+	struct cam_csid_hw_reserve_resource_args     *reserve,
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg,
+	uint32_t                                      format)
+{
+	bool  need_unpack = false;
+
+	switch(format) {
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	 /*
+	  * CAM_FORMAT_PLAIN16_16 : can be removed? double check why default_out_format has it.
+	  * default_out_format is used in xCFA usecases without real RDI0 out buffer.
+	  * We still need to set need_unpack here so that we unpack incoming data (say MIPI10)
+	  * into MSB. If default_out_format can be set to 16_10/16_12/16_14 - then we can remove
+	  */
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_12:
+	case CAM_FORMAT_PLAIN16_14:
+	case CAM_FORMAT_PLAIN16_16:
+		need_unpack = (bool)(path_reg->capabilities & CAM_IFE_CSID_CAP_RDI_UNPACK_MSB);
+		break;
+	default:
+		need_unpack = false;
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID[%u], RDI_%u format %u need_unpack %u sfe_shdr %u",
+		csid_hw->hw_intf->hw_idx, reserve->res_id, format, need_unpack,
+		reserve->sfe_inline_shdr);
+
+	return need_unpack;
+}
+
+static int cam_ife_csid_hw_ver2_config_path_data(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_ife_csid_ver2_path_cfg *path_cfg,
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	uint32_t cid)
+{
+	int rc = 0, i = 0;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg =
+		(struct cam_ife_csid_ver2_reg_info *)csid_hw->core_info->csid_reg;
+	struct cam_ife_csid_cid_data *cid_data = &csid_hw->cid_data[cid];
+	struct cam_isp_resource_node *res = &csid_hw->path_res[reserve->res_id];
+	const struct cam_ife_csid_ver2_path_reg_info  *path_reg = NULL;
+
+	for(i = 0; i < reserve->in_port->num_valid_vc_dt; i++)
+		path_cfg->in_format[i] = reserve->in_port->format[i];
+
+	path_cfg->cid = cid;
+	path_cfg->sync_mode = reserve->sync_mode;
+	path_cfg->height  = reserve->in_port->height;
+	path_cfg->start_line = reserve->in_port->line_start;
+	path_cfg->end_line = reserve->in_port->line_stop;
+	path_cfg->crop_enable = reserve->crop_enable;
+	path_cfg->drop_enable = reserve->drop_enable;
+	path_cfg->horizontal_bin = reserve->in_port->horizontal_bin;
+	path_cfg->vertical_bin = reserve->in_port->vertical_bin;
+	path_cfg->qcfa_bin = reserve->in_port->qcfa_bin;
+	path_cfg->num_bytes_out = reserve->in_port->num_bytes_out;
+	path_cfg->sec_evt_config.en_secondary_evt = reserve->sec_evt_config.en_secondary_evt;
+	path_cfg->sec_evt_config.evt_type = reserve->sec_evt_config.evt_type;
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	if (reserve->out_port)
+		path_cfg->out_format = reserve->out_port->format;
+	else
+		path_cfg->out_format = path_reg->default_out_format;
+
+	if (reserve->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+		path_cfg->start_pixel = reserve->in_port->left_start;
+		path_cfg->end_pixel = reserve->in_port->left_stop;
+		path_cfg->width  = reserve->in_port->left_width;
+
+		if (reserve->res_id >= CAM_IFE_PIX_PATH_RES_RDI_0 &&
+			reserve->res_id <= (CAM_IFE_PIX_PATH_RES_RDI_0 +
+			CAM_IFE_CSID_RDI_MAX - 1)) {
+			path_cfg->end_pixel = reserve->in_port->right_stop;
+			path_cfg->width = path_cfg->end_pixel -
+				path_cfg->start_pixel + 1;
+		}
+		CAM_DBG(CAM_ISP,
+			"CSID:%u res:%d master:startpixel 0x%x endpixel:0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_cfg->start_pixel, path_cfg->end_pixel);
+		CAM_DBG(CAM_ISP,
+			"CSID:%u res:%d master:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_cfg->start_line, path_cfg->end_line);
+	} else if (reserve->sync_mode == CAM_ISP_HW_SYNC_SLAVE) {
+		path_cfg->start_pixel = reserve->in_port->right_start;
+		path_cfg->end_pixel = reserve->in_port->right_stop;
+		path_cfg->width  = reserve->in_port->right_width;
+		CAM_DBG(CAM_ISP,
+			"CSID:%u res:%d slave:start:0x%x end:0x%x width 0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_cfg->start_pixel, path_cfg->end_pixel,
+			path_cfg->width);
+		CAM_DBG(CAM_ISP,
+			"CSID:%u res:%d slave:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_cfg->start_line, path_cfg->end_line);
+	} else {
+		path_cfg->width  = reserve->in_port->left_width;
+		path_cfg->start_pixel = reserve->in_port->left_start;
+		path_cfg->end_pixel = reserve->in_port->left_stop;
+		CAM_DBG(CAM_ISP,
+			"CSID:%u res:%d left width %d start: %d stop:%d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			reserve->in_port->left_width,
+			reserve->in_port->left_start,
+			reserve->in_port->left_stop);
+	}
+
+	if (!reserve->per_port_acquire) {
+		switch (reserve->res_id) {
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+		case CAM_IFE_PIX_PATH_RES_RDI_4:
+		case CAM_IFE_PIX_PATH_RES_RDI_5:
+			path_cfg->csid_out_unpack_msb = cam_ife_csid_hw_ver2_need_unpack_mipi(csid_hw,
+				reserve, path_reg, path_cfg->out_format);
+
+			if (csid_reg->path_reg[res->res_id]->capabilities &
+				CAM_IFE_CSID_CAP_YUV_CHROMA_CONVERSION)
+				path_cfg->yuv_chroma_conversion_en =
+					reserve->in_port->yuv_chroma_conversion_en;
+			/*
+			 * if csid gives unpacked msb out, packing needs to be done at
+			 * WM side if needed, based on the format the decision is
+			 * taken at WM side
+			 */
+			reserve->use_wm_pack = path_cfg->csid_out_unpack_msb;
+
+			rc = cam_ife_csid_get_format_rdi(
+				path_cfg->in_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0],
+				path_cfg->out_format,
+				&path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0],
+				path_reg->mipi_pack_supported, path_cfg->csid_out_unpack_msb);
+			if (rc)
+				goto end;
+
+			if (csid_reg->cmn_reg->decode_format1_supported &&
+				(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid)) {
+
+				rc = cam_ife_csid_get_format_rdi(
+					path_cfg->in_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1],
+					path_cfg->out_format,
+					&path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1],
+					path_reg->mipi_pack_supported, path_cfg->csid_out_unpack_msb);
+				if (rc)
+					goto end;
+			}
+			break;
+		case CAM_IFE_PIX_PATH_RES_IPP:
+		case CAM_IFE_PIX_PATH_RES_PPP:
+			rc = cam_ife_csid_get_format_ipp_ppp(
+				path_cfg->in_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0],
+				&path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0]);
+			if (rc)
+				goto end;
+
+			if (csid_reg->cmn_reg->decode_format1_supported &&
+				(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid)) {
+
+				rc = cam_ife_csid_get_format_ipp_ppp(
+					path_cfg->in_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1],
+					&path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1]);
+				if (rc)
+					goto end;
+			}
+			break;
+		default:
+			rc = -EINVAL;
+			CAM_ERR(CAM_ISP, "CSID[%u] Invalid Res id %u",
+				csid_hw->hw_intf->hw_idx, reserve->res_id);
+			break;
+		}
+
+		if (csid_reg->cmn_reg->decode_format1_supported &&
+			(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid)) {
+			rc = cam_ife_csid_ver2_decode_format1_validate(csid_hw, res);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "CSID[%u] res %d decode fmt1 validation failed",
+					csid_hw->hw_intf->hw_idx, res);
+				goto end;
+			}
+		}
+
+		if (reserve->in_port->per_port_en) {
+			if (path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt !=
+				reserve->decode_format) {
+				CAM_ERR(CAM_ISP, "decode_fmt MISMATCH: expected : %d actual %d",
+				reserve->decode_format,
+				path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt);
+				return -EINVAL;
+			}
+		}
+	} else {
+		path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt =
+			reserve->decode_format;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ife_csid_hw_ver2_config_rx(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_csid_hw_reserve_resource_args  *reserve)
+{
+
+	/*Before calling this function we already validated the
+	 * sancitity of in port args. If this function is called
+	 * from somewhere else as well, please make sure  to validate the
+	 * in_port args before coming here.
+	 */
+	if (csid_hw->counters.csi2_reserve_cnt) {
+		CAM_DBG(CAM_ISP, "CSID %d Rx already reserved cnt %d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->counters.csi2_reserve_cnt);
+		csid_hw->counters.csi2_reserve_cnt++;
+		return 0;
+	}
+
+	csid_hw->rx_cfg.lane_cfg =
+		reserve->in_port->lane_cfg;
+	csid_hw->rx_cfg.lane_type =
+		reserve->in_port->lane_type;
+	csid_hw->rx_cfg.lane_num =
+		reserve->in_port->lane_num;
+	csid_hw->res_type = reserve->in_port->res_type;
+	csid_hw->rx_cfg.dynamic_sensor_switch_en =
+		reserve->in_port->dynamic_sensor_switch_en;
+	if (reserve->in_port->epd_supported)
+		csid_hw->rx_cfg.epd_supported = 1;
+
+	switch (reserve->in_port->res_type) {
+	case CAM_ISP_IFE_IN_RES_TPG:
+		csid_hw->rx_cfg.phy_sel = 0;
+		csid_hw->rx_cfg.tpg_mux_sel = 0;
+		break;
+	case CAM_ISP_IFE_IN_RES_CPHY_TPG_0:
+		csid_hw->rx_cfg.tpg_mux_sel = 1;
+		csid_hw->rx_cfg.tpg_num_sel = 1;
+		break;
+	case CAM_ISP_IFE_IN_RES_CPHY_TPG_1:
+		csid_hw->rx_cfg.tpg_mux_sel = 1;
+		csid_hw->rx_cfg.tpg_num_sel = 2;
+		break;
+	case CAM_ISP_IFE_IN_RES_CPHY_TPG_2:
+		csid_hw->rx_cfg.tpg_mux_sel = 1;
+		csid_hw->rx_cfg.tpg_num_sel = 3;
+		break;
+	default:
+		csid_hw->rx_cfg.tpg_mux_sel = 0;
+		csid_hw->rx_cfg.phy_sel =
+			(reserve->in_port->res_type & 0xFF);
+		break;
+	}
+
+	csid_hw->counters.csi2_reserve_cnt++;
+	CAM_DBG(CAM_ISP,
+		"CSID:%u Rx lane param: cfg:%u type:%u num:%u res:%u",
+		csid_hw->hw_intf->hw_idx,
+		reserve->in_port->lane_cfg, reserve->in_port->lane_type,
+		reserve->in_port->lane_num, reserve->in_port->res_type);
+
+	return 0;
+
+}
+
+static int cam_ife_csid_ver_config_camif(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	struct cam_ife_csid_ver2_path_cfg *path_cfg)
+{
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		csid_hw->core_info->csid_reg;
+
+	switch (reserve->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+	case CAM_IFE_PIX_PATH_RES_RDI_5:
+		path_cfg->epoch_cfg = (path_cfg->end_line  - path_cfg->start_line) *
+			csid_reg->cmn_reg->epoch_factor / 100;
+
+		if (path_cfg->epoch_cfg > path_cfg->end_line)
+			path_cfg->epoch_cfg = path_cfg->end_line;
+
+		if (path_cfg->horizontal_bin || path_cfg->qcfa_bin)
+			path_cfg->epoch_cfg >>= 1;
+
+		CAM_DBG(CAM_ISP, "CSID[%u] res_id: %u epoch factor: 0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id, path_cfg->epoch_cfg);
+		break;
+	default:
+		CAM_DBG(CAM_ISP, "CSID[%u] No CAMIF epoch update for res: %u",
+			csid_hw->hw_intf->hw_idx, reserve->res_id);
+		break;
+	}
+
+	return 0;
+}
+
+int cam_ife_csid_hw_ver2_hw_cfg(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_ife_csid_ver2_path_cfg *path_cfg,
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	uint32_t cid)
+{
+	int rc = 0;
+
+	rc = cam_ife_csid_hw_ver2_config_rx(csid_hw, reserve);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%u] rx config failed",
+			csid_hw->hw_intf->hw_idx);
+		return rc;
+	}
+
+	rc = cam_ife_csid_hw_ver2_config_path_data(csid_hw, path_cfg,
+		reserve, cid);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%u] path data config failed",
+			csid_hw->hw_intf->hw_idx);
+		goto end;
+	}
+
+	rc = cam_ife_csid_ver_config_camif(csid_hw, reserve, path_cfg);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CSID[%u] camif config failed",
+			csid_hw->hw_intf->hw_idx);
+
+end:
+	return rc;
+}
+
+static bool cam_ife_csid_ver2_is_width_valid_by_fuse(
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	uint32_t width)
+{
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	uint32_t fuse_val = UINT_MAX;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		csid_hw->core_info->csid_reg;
+
+	cam_cpas_is_feature_supported(CAM_CPAS_MP_LIMIT_FUSE, CAM_CPAS_HW_IDX_ANY, &fuse_val);
+	if (fuse_val == UINT_MAX) {
+		CAM_DBG(CAM_ISP, "CSID[%u] MP limit fuse not present",
+			csid_hw->hw_intf->hw_idx);
+		return true;
+	}
+
+	if ((fuse_val > csid_reg->width_fuse_max_val) ||
+		(fuse_val >= CAM_IFE_CSID_WIDTH_FUSE_VAL_MAX)) {
+		CAM_ERR(CAM_ISP, "Invalid fuse value %u", fuse_val);
+		return false;
+	}
+
+	if (((reserve->sync_mode == CAM_ISP_HW_SYNC_SLAVE) ||
+		(reserve->sync_mode == CAM_ISP_HW_SYNC_MASTER)) &&
+		(width > csid_reg->fused_max_dualife_width[fuse_val])) {
+		CAM_ERR(CAM_ISP,
+			"CSID[%u] Resolution not supported required_width dualife: %d max_supported_width: %d",
+			csid_hw->hw_intf->hw_idx,
+			width, csid_reg->fused_max_dualife_width[fuse_val]);
+		return false;
+
+	} else if (width > csid_reg->fused_max_width[fuse_val]) {
+		CAM_ERR(CAM_ISP,
+			"CSID[%u] Resolution not supported required_width: %d max_supported_width: %d",
+			csid_hw->hw_intf->hw_idx,
+			width, csid_reg->fused_max_width[fuse_val]);
+		return false;
+	}
+
+	return true;
+}
+
+bool cam_ife_csid_ver2_is_width_valid(
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	uint32_t width = 0;
+	struct cam_csid_soc_private *soc_private;
+
+	soc_private = (struct cam_csid_soc_private *)csid_hw->hw_info->soc_info.soc_private;
+
+	if ((reserve->res_id != CAM_IFE_PIX_PATH_RES_IPP) || soc_private->is_ife_csid_lite)
+		return true;
+
+	if (reserve->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		reserve->sync_mode == CAM_ISP_HW_SYNC_NONE)
+		width = reserve->in_port->left_stop -
+			reserve->in_port->left_start + 1;
+	else if (reserve->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		width = reserve->in_port->right_stop -
+			reserve->in_port->right_start + 1;
+
+	if (reserve->in_port->horizontal_bin || reserve->in_port->qcfa_bin)
+		width /= 2;
+
+	if (!cam_ife_csid_ver2_is_width_valid_by_fuse(reserve, csid_hw, width)) {
+		CAM_ERR(CAM_ISP, "CSID[%u] width limited by fuse",
+			csid_hw->hw_intf->hw_idx);
+		return false;
+	}
+
+	return true;
+}
+
+static int cam_ife_csid_ver2_in_port_validate(
+	struct cam_csid_hw_reserve_resource_args  *reserve,
+	struct cam_ife_csid_ver2_hw     *csid_hw,
+	bool is_per_port_acquire)
+{
+	int i, rc = 0;
+	void *token = NULL;
+
+	/* check in port args for RT streams*/
+	if (!reserve->is_offline) {
+		rc  = cam_ife_csid_check_in_port_args(reserve,
+			csid_hw->hw_intf->hw_idx);
+		if (rc)
+			goto err;
+	}
+
+	if (!cam_ife_csid_ver2_is_width_valid(reserve, csid_hw))
+		goto err;
+
+	if (!is_per_port_acquire) {
+		for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+			if (csid_hw->token_data[i].res_id == reserve->res_id) {
+				token = csid_hw->token_data[i].token;
+				break;
+			}
+		}
+
+		if (!token) {
+			CAM_ERR(CAM_ISP, "cannot find token data for CSID[%u] res :%d ",
+				csid_hw->hw_intf->hw_idx, reserve->res_id);
+			goto err;
+		}
+	}
+
+	if (csid_hw->counters.csi2_reserve_cnt) {
+
+		if (token != reserve->cb_priv && !is_per_port_acquire) {
+			CAM_ERR(CAM_ISP,
+				"CSID[%u] different Context for res %d",
+				csid_hw->hw_intf->hw_idx,
+				reserve->res_id);
+			rc = -EINVAL;
+			goto err;
+		}
+
+		if (csid_hw->res_type != reserve->in_port->res_type) {
+			CAM_ERR(CAM_ISP,
+				"CSID[%u] Invalid res[%d] in_res_type[%d]",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->res_type,
+				reserve->in_port->res_type);
+			rc = -EINVAL;
+			goto err;
+		}
+
+		if (csid_hw->rx_cfg.lane_cfg !=
+			reserve->in_port->lane_cfg  ||
+			csid_hw->rx_cfg.lane_type !=
+			reserve->in_port->lane_type ||
+			csid_hw->rx_cfg.lane_num !=
+			reserve->in_port->lane_num) {
+			CAM_ERR(CAM_ISP,
+				"CSID[%u] lane: num[%d %d] type[%d %d] cfg[%d %d]",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->rx_cfg.lane_num,
+				reserve->in_port->lane_num,
+				csid_hw->rx_cfg.lane_type,
+				reserve->in_port->lane_type,
+				csid_hw->rx_cfg.lane_cfg,
+				reserve->in_port->lane_cfg);
+			rc = -EINVAL;
+			goto err;
+		}
+	}
+
+	return rc;
+err:
+	CAM_ERR(CAM_ISP, "Invalid args CSID[%u] rc %d",
+		csid_hw->hw_intf->hw_idx, rc);
+	return rc;
+}
+
+int cam_ife_csid_ver2_reserve(void *hw_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+
+	struct cam_ife_csid_ver2_hw     *csid_hw;
+	struct cam_hw_info              *hw_info;
+	struct cam_isp_resource_node    *res = NULL;
+	struct cam_csid_hw_reserve_resource_args  *reserve;
+	struct cam_ife_csid_ver2_path_cfg    *path_cfg;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	uint32_t cid;
+	int i, rc = 0;
+	bool is_per_port_acquire = false, found = false;
+	bool token_data_empty = true;
+
+	reserve = (struct cam_csid_hw_reserve_resource_args  *)reserve_args;
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	res = &csid_hw->path_res[reserve->res_id];
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		/**
+		 * intentionally set as DBG log to since this log gets printed when hw manager
+		 * checks if resource is available
+		 */
+		CAM_DBG(CAM_ISP, "CSID %d Res_id %d state %d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			res->res_state);
+		return -EBUSY;
+	}
+
+	if (reserve->in_port->per_port_en && reserve->per_port_acquire)
+		is_per_port_acquire = true;
+
+	if (!is_per_port_acquire) {
+		for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+			if (csid_hw->token_data[i].token) {
+				token_data_empty = false;
+				if (csid_hw->token_data[i].token == reserve->cb_priv) {
+					found = true;
+					break;
+				}
+			}
+		}
+	}
+
+	if (!token_data_empty && !found) {
+		CAM_DBG(CAM_ISP, "CSID %d already acquired in another context",
+			csid_hw->hw_intf->hw_idx);
+		return -EBUSY;
+	}
+
+	if (reserve->res_id < CAM_IFE_PIX_PATH_RES_MAX) {
+		csid_hw->token_data[reserve->res_id].token = reserve->cb_priv;
+		csid_hw->token_data[reserve->res_id].res_id = reserve->res_id;
+	} else {
+		CAM_ERR(CAM_ISP,
+			"exceeded max expected resource path CSID[%u] res_id :%d",
+				csid_hw->hw_intf->hw_idx, reserve->res_id);
+		return -EINVAL;
+	}
+
+	rc = cam_ife_csid_ver2_in_port_validate(reserve, csid_hw,  is_per_port_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID %d Res_id %d port validation failed",
+			csid_hw->hw_intf->hw_idx, reserve->res_id);
+		return rc;
+	}
+
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	if (!path_cfg) {
+		CAM_ERR(CAM_ISP,
+			"CSID %d Unallocated Res_id %d state %d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	rc = cam_ife_csid_cid_reserve(csid_hw->cid_data, &cid,
+		csid_hw->hw_intf->hw_idx, reserve);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID %d Res_id %d state %d invalid cid %d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			res->res_state, cid);
+		return rc;
+	}
+
+	/* Skip rx and csid cfg for offline */
+	if (!reserve->is_offline) {
+		rc = cam_ife_csid_hw_ver2_hw_cfg(csid_hw, path_cfg,
+			reserve, cid);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID[%u] res %d hw_cfg fail",
+				csid_hw->hw_intf->hw_idx, reserve->res_id);
+			goto release;
+		}
+	}
+
+	reserve->node_res = res;
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	res->is_per_port_acquire = is_per_port_acquire;
+	csid_hw->event_cb = reserve->event_cb;
+	csid_hw->tasklet  = reserve->tasklet;
+	res->tasklet_info  = reserve->tasklet;
+	reserve->buf_done_controller = csid_hw->buf_done_irq_controller;
+	res->cdm_ops = reserve->cdm_ops;
+	csid_hw->flags.sfe_en = reserve->sfe_en;
+	path_cfg->sfe_shdr = reserve->sfe_inline_shdr;
+	path_cfg->handle_camif_irq = reserve->handle_camif_irq;
+	csid_hw->flags.offline_mode = reserve->is_offline;
+	reserve->need_top_cfg = csid_reg->need_top_cfg;
+
+	CAM_DBG(CAM_ISP,
+		"CSID[%u] Resource[id: %d name:%s] state %d cid %d is_per_port_acquire:%d ",
+		csid_hw->hw_intf->hw_idx, reserve->res_id, res->res_name,
+		res->res_state, cid, is_per_port_acquire);
+
+	return rc;
+
+release:
+	cam_ife_csid_cid_release(&csid_hw->cid_data[cid],
+		csid_hw->hw_intf->hw_idx,
+		path_cfg->cid);
+	return rc;
+}
+
+int cam_ife_csid_ver2_release(void *hw_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_ver2_hw     *csid_hw;
+	struct cam_hw_info              *hw_info;
+	struct cam_isp_resource_node    *res = NULL;
+	struct cam_ife_csid_ver2_path_cfg    *path_cfg;
+	int i, rc = 0;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	res = (struct cam_isp_resource_node *)release_args;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+
+	if ((res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE) ||
+		(res->res_state >= CAM_ISP_RESOURCE_STATE_STREAMING)) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%u res type:%d Res %d in state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id,
+			res->res_state);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%u res type :%d Resource [id:%d name:%s]",
+		csid_hw->hw_intf->hw_idx, res->res_type,
+		res->res_id, res->res_name);
+
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	if (path_cfg->cid >= CAM_IFE_CSID_CID_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid cid:%d",
+			csid_hw->hw_intf->hw_idx, path_cfg->cid);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cam_ife_csid_cid_release(&csid_hw->cid_data[path_cfg->cid],
+		csid_hw->hw_intf->hw_idx,
+		path_cfg->cid);
+
+	memset(path_cfg, 0, sizeof(*path_cfg));
+
+	csid_hw->sync_mode = CAM_ISP_HW_SYNC_NONE;
+	csid_hw->rup_aup_mask = 0;
+
+	if (csid_hw->counters.csi2_reserve_cnt)
+		csid_hw->counters.csi2_reserve_cnt--;
+
+	if (!csid_hw->counters.csi2_reserve_cnt) {
+		memset(&csid_hw->rx_cfg, 0,
+			sizeof(struct cam_ife_csid_ver2_rx_cfg));
+		memset(&csid_hw->top_cfg, 0,
+			sizeof(struct cam_ife_csid_ver2_top_cfg));
+		memset(&csid_hw->debug_info, 0,
+			sizeof(struct cam_ife_csid_debug_info));
+		csid_hw->flags.pf_err_detected = false;
+		for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+			csid_hw->token_data[i].token = NULL;
+			csid_hw->token_data[i].res_id = -1;
+		}
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_ver2_res_master_slave_cfg(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	uint32_t res_id)
+{
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	uint32_t val;
+	void __iomem                      *mem_base;
+	struct cam_hw_soc_info            *soc_info;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	val = cam_io_r_mb(mem_base +
+		csid_reg->cmn_reg->shdr_master_slave_cfg_addr);
+
+	switch (res_id) {
+
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+		val |= BIT(csid_reg->cmn_reg->shdr_master_rdi0_shift);
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+		val |= BIT(csid_reg->cmn_reg->shdr_slave_rdi1_shift);
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+		val |= BIT(csid_reg->cmn_reg->shdr_slave_rdi2_shift);
+		break;
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		val |= BIT(csid_reg->cmn_reg->shdr_slave_ppp_shift);
+		break;
+	default:
+		break;
+	}
+
+	val |= BIT(csid_reg->cmn_reg->shdr_master_slave_en_shift);
+
+	cam_io_w_mb(val, mem_base +
+		csid_reg->cmn_reg->shdr_master_slave_cfg_addr);
+
+	CAM_DBG(CAM_ISP, "CSID %d shdr cfg 0x%x", csid_hw->hw_intf->hw_idx,
+		val);
+
+	return 0;
+}
+
+static int  cam_ife_csid_ver2_program_init_cfg1_pxl_path(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_isp_resource_node *res)
+{
+	const struct cam_ife_csid_ver2_reg_info        *csid_reg;
+	struct cam_hw_soc_info                         *soc_info;
+	struct cam_ife_csid_ver2_path_cfg              *path_cfg;
+	struct cam_csid_soc_private                    *soc_private;
+	const struct cam_ife_csid_ver2_path_reg_info   *path_reg = NULL;
+	const struct cam_ife_csid_ver2_common_reg_info *cmn_reg = NULL;
+	void __iomem *mem_base;
+	uint32_t cfg1 = 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_reg = csid_reg->path_reg[res->res_id];
+	soc_private = (struct cam_csid_soc_private *)
+		soc_info->soc_private;
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d path res type:%d res_id:%d res state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	cmn_reg = csid_reg->cmn_reg;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	/*configure cfg1 addr
+	 * Binning
+	 * Crop/Drop parameters
+	 * Early Eof
+	 * Timestamp enable and strobe selection
+	 * Pix store enable
+	 */
+
+	if (csid_hw->flags.binning_enabled) {
+		if (path_reg->binning_supported & CAM_IFE_CSID_BIN_HORIZONTAL)
+			cfg1 |= path_cfg->horizontal_bin <<
+				path_reg->bin_h_en_shift_val;
+
+		if (path_reg->binning_supported & CAM_IFE_CSID_BIN_VERTICAL)
+			cfg1 |= path_cfg->vertical_bin <<
+				path_reg->bin_v_en_shift_val;
+
+		if (path_reg->binning_supported & CAM_IFE_CSID_BIN_QCFA)
+			cfg1 |= path_cfg->qcfa_bin <<
+				path_reg->bin_qcfa_en_shift_val;
+
+		if (path_cfg->qcfa_bin || path_cfg->vertical_bin ||
+				path_cfg->horizontal_bin)
+			cfg1 |= 1  << path_reg->bin_en_shift_val;
+	}
+
+	cfg1 |= (path_cfg->crop_enable << path_reg->crop_h_en_shift_val) |
+		(path_cfg->crop_enable <<
+		 path_reg->crop_v_en_shift_val);
+
+	if (cmn_reg->drop_supported)
+		cfg1 |= (path_cfg->drop_enable <<
+				path_reg->drop_v_en_shift_val) |
+			(path_cfg->drop_enable <<
+				path_reg->drop_h_en_shift_val);
+
+	cfg1 |= 1 << path_reg->pix_store_en_shift_val;
+
+	/*enable early eof based on crop enable */
+	if (!(csid_hw->debug_info.debug_val &
+		    CAM_IFE_CSID_DEBUG_DISABLE_EARLY_EOF) &&
+		cmn_reg->early_eof_supported && path_cfg->crop_enable &&
+		!(csid_hw->flags.rdi_lcr_en && res->res_id == CAM_IFE_PIX_PATH_RES_PPP))
+		cfg1 |= (1 << path_reg->early_eof_en_shift_val);
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO)
+		cfg1 |= 1 << path_reg->format_measure_en_shift_val;
+
+	if (!cmn_reg->timestamp_enabled_in_cfg0)
+		cfg1 |= (1 << path_reg->timestamp_en_shift_val) |
+			(cmn_reg->timestamp_strobe_val <<
+				cmn_reg->timestamp_stb_sel_shift_val);
+
+	CAM_DBG(CAM_ISP, "CSID[%u] res:%d cfg1_addr 0x%x",
+		csid_hw->hw_intf->hw_idx, res->res_id, cfg1);
+
+	cam_io_w_mb(cfg1, mem_base + path_reg->cfg1_addr);
+
+	return 0;
+}
+
+static int  cam_ife_csid_ver2_program_init_cfg1_rdi_path(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_isp_resource_node *res)
+{
+	const struct cam_ife_csid_ver2_reg_info        *csid_reg;
+	struct cam_hw_soc_info                         *soc_info;
+	struct cam_ife_csid_ver2_path_cfg              *path_cfg;
+	struct cam_csid_soc_private                    *soc_private;
+	const struct cam_ife_csid_ver2_path_reg_info   *path_reg = NULL;
+	const struct cam_ife_csid_ver2_common_reg_info *cmn_reg = NULL;
+	void __iomem *mem_base;
+	uint32_t cfg1 = 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_reg = csid_reg->path_reg[res->res_id];
+	soc_private = (struct cam_csid_soc_private *)
+		soc_info->soc_private;
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d path res type:%d res_id:%d res state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	cmn_reg = csid_reg->cmn_reg;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	/*configure cfg1 addr
+	 * Crop/Drop parameters
+	 * Timestamp enable and strobe selection
+	 * Plain format
+	 * Packing format
+	 */
+	cfg1 = (path_cfg->crop_enable << path_reg->crop_h_en_shift_val) |
+		(path_cfg->crop_enable <<
+		 path_reg->crop_v_en_shift_val);
+
+	if (cmn_reg->drop_supported)
+		cfg1 |= (path_cfg->drop_enable <<
+				path_reg->drop_v_en_shift_val) |
+			(path_cfg->drop_enable <<
+				path_reg->drop_h_en_shift_val);
+
+	if (path_reg->mipi_pack_supported)
+		cfg1 |= path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].packing_fmt <<
+			path_reg->packing_fmt_shift_val;
+
+	cfg1 |= (path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].plain_fmt <<
+			path_reg->plain_fmt_shift_val);
+
+	/* Keep the data in MSB, IFE/SFE  pipeline, BUS expects data in MSB */
+	if (path_cfg->csid_out_unpack_msb &&
+		path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].plain_fmt)
+		cfg1 |= (1 << path_reg->plain_alignment_shift_val);
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO)
+		cfg1 |= 1 << path_reg->format_measure_en_shift_val;
+
+	if (!cmn_reg->timestamp_enabled_in_cfg0)
+		cfg1 |= (1 << path_reg->timestamp_en_shift_val) |
+			(cmn_reg->timestamp_strobe_val <<
+				cmn_reg->timestamp_stb_sel_shift_val);
+
+	/* We use line smoothting only on RDI_0 in all usecases */
+	if ((path_reg->capabilities &
+		CAM_IFE_CSID_CAP_LINE_SMOOTHING_IN_RDI) &&
+		(res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0))
+		cfg1 |= 1 << path_reg->pix_store_en_shift_val;
+
+	cam_io_w_mb(cfg1, mem_base + path_reg->cfg1_addr);
+
+	return 0;
+}
+
+
+static int cam_ife_csid_ver2_init_config_rdi_path(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	const struct cam_ife_csid_ver2_common_reg_info *cmn_reg = NULL;
+	uint32_t  val, cfg0 = 0;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg;
+	struct cam_ife_csid_cid_data *cid_data;
+	void __iomem *mem_base;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (!csid_reg->path_reg[res->res_id]) {
+		CAM_ERR(CAM_ISP, "CSID:%u RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	cmn_reg = csid_reg->cmn_reg;
+	path_reg = csid_reg->path_reg[res->res_id];
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	cid_data = &csid_hw->cid_data[path_cfg->cid];
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	/* Enable client & cfg offline mode */
+	if (csid_hw->flags.offline_mode) {
+		val = (1 <<
+			path_reg->offline_mode_en_shift_val);
+		val |= (1 << cmn_reg->path_en_shift_val);
+		cam_io_w_mb(val, mem_base + path_reg->cfg0_addr);
+		CAM_DBG(CAM_ISP, "CSID:%u RDI:%d cfg0: 0x%x for offline",
+			csid_hw->hw_intf->hw_idx, res->res_id, val);
+		return 0;
+	}
+
+	/*Configure cfg0:
+	 * VC
+	 * DT
+	 * Timestamp enable and strobe selection for v780
+	 * DT_ID cobination
+	 * Decode Format
+	 * Frame_id_dec_en
+	 * VFR en
+	 * offline mode
+	 */
+	cfg0 = (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc <<
+			cmn_reg->vc_shift_val) |
+		(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt <<
+			cmn_reg->dt_shift_val) |
+		(path_cfg->cid << cmn_reg->dt_id_shift_val) |
+		(path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt <<
+		 	cmn_reg->decode_format_shift_val);
+
+	if (csid_reg->cmn_reg->vfr_supported)
+		cfg0 |= path_cfg->vfr_en << cmn_reg->vfr_en_shift_val;
+
+	if (csid_reg->cmn_reg->frame_id_dec_supported)
+		cfg0 |= path_cfg->frame_id_dec_en <<
+			cmn_reg->frame_id_decode_en_shift_val;
+
+	if (cmn_reg->timestamp_enabled_in_cfg0)
+		cfg0 |= (1 << path_reg->timestamp_en_shift_val) |
+			(cmn_reg->timestamp_strobe_val <<
+				cmn_reg->timestamp_stb_sel_shift_val);
+
+	if (cam_ife_csid_ver2_disable_sof_retime(csid_hw, res))
+		cfg0 |= 1 << path_reg->sof_retiming_dis_shift;
+
+	cam_io_w_mb(cfg0, mem_base + path_reg->cfg0_addr);
+	CAM_DBG(CAM_ISP, "CSID[%u] %s cfg0_addr 0x%x",
+		csid_hw->hw_intf->hw_idx, res->res_name, cfg0);
+
+	path_cfg->ts_comb_vcdt_en = false;
+
+	/*Configure Multi VC DT combo */
+	if (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid) {
+		val = (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].vc <<
+				cmn_reg->multi_vcdt_vc1_shift_val) |
+			(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].dt <<
+				 cmn_reg->multi_vcdt_dt1_shift_val) |
+			(1 << cmn_reg->multi_vcdt_en_shift_val);
+
+		if (cmn_reg->ts_comb_vcdt_en) {
+			val |= (1 << cmn_reg->multi_vcdt_ts_combo_en_shift_val);
+			path_cfg->ts_comb_vcdt_en = true;
+		}
+
+		if (cmn_reg->decode_format1_supported)
+			val |= (path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].decode_fmt <<
+				cmn_reg->decode_format1_shift_val);
+
+		cam_io_w_mb(val, mem_base + path_reg->multi_vcdt_cfg0_addr);
+		CAM_DBG(CAM_ISP, "CSID:%u RDI:%u multi_vcdt_cfg0:0x%x",
+			csid_hw->hw_intf->hw_idx, res->res_id, val);
+	}
+
+	rc = cam_ife_csid_ver2_program_init_cfg1_rdi_path(csid_hw, res);
+
+	/* Enable the RDI path */
+	val = cam_io_r_mb(mem_base + path_reg->cfg0_addr);
+	val |= (1 << cmn_reg->path_en_shift_val);
+	cam_io_w_mb(val, mem_base + path_reg->cfg0_addr);
+
+	if (path_reg->overflow_ctrl_en) {
+		val = path_reg->overflow_ctrl_en |
+			path_reg->overflow_ctrl_mode_val;
+		cam_io_w_mb(val, mem_base +
+			path_reg->err_recovery_cfg0_addr);
+	}
+
+	/*Program the reg to  convert the chroma components from YUV422 to YUV420*/
+	if (path_cfg->yuv_chroma_conversion_en)
+		cam_io_w_mb(cmn_reg->yuv_chroma_conversion_enable_val, mem_base +
+			path_reg->yuv_chroma_conversion_addr);
+
+	if (path_cfg->sfe_shdr ||
+		(csid_hw->flags.rdi_lcr_en &&
+		 res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0))
+		cam_ife_csid_ver2_res_master_slave_cfg(csid_hw, res->res_id);
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(mem_base +
+			path_reg->format_measure_cfg0_addr);
+		val |= cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val, mem_base +
+			path_reg->format_measure_cfg0_addr);
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_ver2_init_config_pxl_path(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	const struct cam_ife_csid_ver2_common_reg_info *cmn_reg = NULL;
+	uint32_t val = 0, cfg0 = 0;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg;
+	struct cam_ife_csid_cid_data *cid_data;
+	void __iomem *mem_base;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%u path res type:%d res_id:%d res state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	cmn_reg = csid_reg->cmn_reg;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	cid_data = &csid_hw->cid_data[path_cfg->cid];
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	/*Configure:
+	 * VC
+	 * DT
+	 * Timestamp enable and strobe selection
+	 * DT_ID cobination
+	 * Decode Format
+	 * Frame_id_dec_en
+	 * VFR en
+	 */
+	cfg0 |= (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc <<
+			cmn_reg->vc_shift_val) |
+		(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt <<
+			cmn_reg->dt_shift_val) |
+		(path_cfg->cid << cmn_reg->dt_id_shift_val) |
+		(path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].decode_fmt <<
+		 	cmn_reg->decode_format_shift_val);
+
+	if (csid_reg->cmn_reg->vfr_supported)
+		cfg0 |= path_cfg->vfr_en << cmn_reg->vfr_en_shift_val;
+
+	if (csid_reg->cmn_reg->frame_id_dec_supported)
+		cfg0 |= path_cfg->frame_id_dec_en <<
+			cmn_reg->frame_id_decode_en_shift_val;
+
+	if (cmn_reg->timestamp_enabled_in_cfg0)
+		cfg0 |= (1 << path_reg->timestamp_en_shift_val) |
+			(cmn_reg->timestamp_strobe_val <<
+				cmn_reg->timestamp_stb_sel_shift_val);
+
+	if (cam_ife_csid_ver2_disable_sof_retime(csid_hw, res))
+		cfg0 |= 1 << path_reg->sof_retiming_dis_shift;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] res:%d cfg0_addr 0x%x",
+		csid_hw->hw_intf->hw_idx, res->res_id, cfg0);
+
+	cam_io_w_mb(cfg0, mem_base + path_reg->cfg0_addr);
+
+	path_cfg->ts_comb_vcdt_en = false;
+
+	/*Configure Multi VC DT combo */
+	if (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].valid) {
+		val = (cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].vc <<
+				cmn_reg->multi_vcdt_vc1_shift_val) |
+			(cid_data->vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].dt <<
+				 cmn_reg->multi_vcdt_dt1_shift_val) |
+			(1 << cmn_reg->multi_vcdt_en_shift_val);
+
+		if (cmn_reg->ts_comb_vcdt_en) {
+			val |= (1 << cmn_reg->multi_vcdt_ts_combo_en_shift_val);
+			path_cfg->ts_comb_vcdt_en = true;
+		}
+
+		if (cmn_reg->decode_format1_supported)
+			val |= (path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_1].decode_fmt <<
+				cmn_reg->decode_format1_shift_val);
+
+		cam_io_w_mb(val, mem_base + path_reg->multi_vcdt_cfg0_addr);
+	}
+
+	rc = cam_ife_csid_ver2_program_init_cfg1_pxl_path(csid_hw, res);
+
+	/* Enable the Pxl path */
+	val = cam_io_r_mb(mem_base + path_reg->cfg0_addr);
+	val |= (1 << cmn_reg->path_en_shift_val);
+	cam_io_w_mb(val, mem_base + path_reg->cfg0_addr);
+
+	if (path_reg->overflow_ctrl_en) {
+		val = path_reg->overflow_ctrl_en |
+			path_reg->overflow_ctrl_mode_val;
+		cam_io_w_mb(val, mem_base + path_reg->err_recovery_cfg0_addr);
+	}
+
+	if (csid_hw->debug_info.debug_val &
+		CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(mem_base +
+			path_reg->format_measure_cfg0_addr);
+		val |= csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val,
+			mem_base + path_reg->format_measure_cfg0_addr);
+	}
+
+	if (csid_hw->flags.rdi_lcr_en && res->res_id == CAM_IFE_PIX_PATH_RES_PPP)
+		cam_ife_csid_ver2_res_master_slave_cfg(csid_hw, res->res_id);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+	return rc;
+}
+
+static inline __attribute_const__ CAM_IRQ_HANDLER_BOTTOM_HALF
+cam_ife_csid_ver2_get_path_bh(int res_id)
+{
+	switch (res_id) {
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+	case CAM_IFE_PIX_PATH_RES_RDI_5:
+		return cam_ife_csid_ver2_rdi_bottom_half;
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		return cam_ife_csid_ver2_ipp_bottom_half;
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		return cam_ife_csid_ver2_ppp_bottom_half;
+	default:
+		return NULL;
+	}
+}
+
+static inline int cam_ife_csid_ver2_subscribe_sof_for_discard(
+	struct cam_ife_csid_ver2_path_cfg *path_cfg,
+	struct cam_ife_csid_ver2_hw       *csid_hw,
+	struct cam_isp_resource_node      *res,
+	CAM_IRQ_HANDLER_TOP_HALF           top_half_handler,
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler)
+{
+	int rc = 0;
+	uint32_t irq_mask = 0;
+
+	irq_mask = IFE_CSID_VER2_PATH_INFO_INPUT_SOF;
+
+	path_cfg->discard_irq_handle = cam_irq_controller_subscribe_irq(
+		csid_hw->path_irq_controller[res->res_id],
+		CAM_IRQ_PRIORITY_0,
+		&irq_mask,
+		res,
+		top_half_handler,
+		bottom_half_handler,
+		res->tasklet_info,
+		&tasklet_bh_api,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (path_cfg->discard_irq_handle < 1) {
+		CAM_ERR(CAM_ISP,
+			"CSID[%u] Subscribing input SOF failed for discarding %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		rc = -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"CSID[%u] Subscribing input SOF for discard done res: %s rc: %d",
+		csid_hw->hw_intf->hw_idx, res->res_name, rc);
+	return rc;
+}
+
+static int cam_ife_csid_ver2_mc_irq_subscribe(struct cam_ife_csid_ver2_hw  *csid_hw,
+	struct cam_isp_resource_node *res, uint32_t top_index)
+{
+	uint32_t tmp_mask;
+	struct cam_ife_csid_ver2_reg_info *csid_reg = csid_hw->core_info->csid_reg;
+
+	if (csid_hw->top_mc_irq_handle >= 1)
+		return 0;
+
+	tmp_mask = csid_reg->ipp_mc_reg->comp_sof_mask |
+		csid_reg->ipp_mc_reg->comp_eof_mask |
+		csid_reg->ipp_mc_reg->comp_rup_mask |
+		csid_reg->ipp_mc_reg->comp_epoch0_mask;
+
+	csid_hw->top_mc_irq_handle = cam_irq_controller_subscribe_irq(
+		csid_hw->top_irq_controller[top_index],
+		CAM_IRQ_PRIORITY_0,
+		&tmp_mask,
+		res,
+		cam_ife_csid_ver2_mc_top_half,
+		cam_ife_csid_ver2_get_path_bh(res->res_id),
+		csid_hw->tasklet,
+		&tasklet_bh_api,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (csid_hw->top_mc_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "csid[%d] MC subscribe top irq fail %s",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	return 0;
+
+}
+
+static int cam_ife_csid_ver2_path_irq_subscribe(
+	struct cam_ife_csid_ver2_hw  *csid_hw,
+	struct cam_isp_resource_node *res,
+	uint32_t irq_mask, uint32_t err_irq_mask)
+{
+	uint32_t num_register = 0;
+	uint32_t *top_irq_mask = NULL;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg = res->res_priv;
+	struct cam_ife_csid_ver2_reg_info *csid_reg = csid_hw->core_info->csid_reg;
+	int i, rc;
+	int top_index = -1;
+
+	for (i = CAM_IFE_CSID_TOP_IRQ_STATUS_REG0; i < csid_reg->num_top_regs; i++) {
+		if (csid_reg->path_reg[res->res_id]->top_irq_mask[i]) {
+			top_index = i;
+			break;
+		}
+	}
+
+	if (top_index < 0 || top_index >= CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX) {
+		CAM_ERR(CAM_ISP, "csid[%d] %s Invalid top index %s index %d",
+			csid_hw->hw_intf->hw_idx, res->res_name, top_index);
+		return -EINVAL;
+	}
+
+	num_register = csid_reg->top_irq_reg_info[top_index].num_registers;
+	top_irq_mask = vmalloc(sizeof(uint32_t) * num_register);
+	if (!top_irq_mask) {
+		CAM_ERR(CAM_ISP, "csid top_irq_mask allocation failed");
+		return -ENOMEM;
+	}
+
+	top_irq_mask[0] = csid_reg->path_reg[res->res_id]->top_irq_mask[top_index];
+
+	if (res->is_per_port_start) {
+		CAM_DBG(CAM_ISP, "Skipping irq subscribe for resources that are not updated");
+		goto skip_irq_subscribe;
+	}
+
+	/* TODO: per port for multi-context is not yet implemented */
+	if (csid_reg->path_reg[res->res_id]->capabilities & CAM_IFE_CSID_CAP_MULTI_CTXT) {
+		rc = cam_ife_csid_ver2_mc_irq_subscribe(csid_hw, res, top_index);
+		if (rc || csid_hw->top_mc_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "CSID[%u] Failed to subscribe MC top irq",
+				csid_hw->hw_intf->hw_idx);
+			goto end;
+		}
+	}
+
+	path_cfg->top_irq_handle = cam_irq_controller_subscribe_irq(
+		csid_hw->top_irq_controller[top_index],
+		CAM_IRQ_PRIORITY_0,
+		top_irq_mask,
+		res,
+		cam_ife_csid_ver2_handle_path_irq,
+		NULL, NULL, NULL, CAM_IRQ_EVT_GROUP_0);
+
+	if (path_cfg->top_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "CSID[%u] subscribe top irq fail %s",
+			csid_hw->hw_intf->hw_idx, res->res_name);
+		rc = -EINVAL;
+		goto unsub_mc;
+	}
+
+	rc = cam_irq_controller_register_dependent(csid_hw->top_irq_controller[top_index],
+		csid_hw->path_irq_controller[res->res_id], top_irq_mask);
+
+	if (rc)
+		goto unsub_top;
+
+	path_cfg->irq_handle = cam_irq_controller_subscribe_irq(
+		csid_hw->path_irq_controller[res->res_id],
+		CAM_IRQ_PRIORITY_1,
+		&irq_mask,
+		res,
+		cam_ife_csid_ver2_path_top_half,
+		cam_ife_csid_ver2_get_path_bh(res->res_id),
+		res->tasklet_info,
+		&tasklet_bh_api,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (path_cfg->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "CSID[%u] subscribe path irq fail %s",
+			csid_hw->hw_intf->hw_idx, res->res_name);
+		rc = -EINVAL;
+		goto unreg_path;
+	}
+
+	path_cfg->err_irq_handle = cam_irq_controller_subscribe_irq(
+			csid_hw->path_irq_controller[res->res_id],
+			CAM_IRQ_PRIORITY_0,
+			&err_irq_mask,
+			res,
+			cam_ife_csid_ver2_path_err_top_half,
+			cam_ife_csid_ver2_get_path_bh(res->res_id),
+			res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+	if (path_cfg->err_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "CSID[%u] subscribe error irq fail %s",
+			csid_hw->hw_intf->hw_idx, res->res_name);
+		rc = -EINVAL;
+		goto unsub_path;
+	}
+skip_irq_subscribe:
+	vfree(top_irq_mask);
+	return 0;
+
+unsub_path:
+	cam_irq_controller_unsubscribe_irq(csid_hw->path_irq_controller[res->res_id],
+			path_cfg->irq_handle);
+	path_cfg->irq_handle = 0;
+unreg_path:
+	cam_irq_controller_unregister_dependent(csid_hw->top_irq_controller[top_index],
+		csid_hw->path_irq_controller[res->res_id]);
+unsub_top:
+	cam_irq_controller_unsubscribe_irq(csid_hw->top_irq_controller[top_index],
+			path_cfg->top_irq_handle);
+	path_cfg->top_irq_handle = 0;
+unsub_mc:
+	cam_irq_controller_unsubscribe_irq(csid_hw->top_irq_controller,
+		csid_hw->top_mc_irq_handle);
+	csid_hw->top_mc_irq_handle = 0;
+end:
+	vfree(top_irq_mask);
+	return rc;
+}
+
+static void  cam_ife_csid_ver2_path_rup_aup(
+	struct cam_ife_csid_ver2_hw           *csid_hw,
+	struct cam_isp_resource_node          *res,
+	struct cam_ife_csid_ver2_rup_aup_mask *rup_aup_mask)
+{
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	if (csid_reg->cmn_reg->capabilities & CAM_IFE_CSID_CAP_SPLIT_RUP_AUP) {
+		rup_aup_mask->rup_mask |= path_reg->rup_mask;
+		rup_aup_mask->aup_mask |= path_reg->aup_mask;
+
+	} else {
+		rup_aup_mask->rup_mask |= path_reg->rup_aup_mask;
+	}
+
+}
+
+static int cam_ife_csid_ver2_program_rdi_path(
+	struct cam_ife_csid_ver2_hw           *csid_hw,
+	struct cam_isp_resource_node          *res,
+	struct cam_ife_csid_ver2_rup_aup_mask *rup_aup_mask)
+{
+	int rc = 0;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+	void __iomem *mem_base;
+	uint32_t val = 0;
+	uint32_t irq_mask = 0;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg;
+
+	rc = cam_ife_csid_ver2_init_config_rdi_path(
+		csid_hw, res);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%u %s path res type:%d res_id:%d %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return rc;
+	}
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		    csid_hw->core_info->csid_reg;
+
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%u RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	if (!csid_hw->flags.offline_mode) {
+		CAM_DBG(CAM_ISP, "CSID:%u Rdi res: %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+
+		/*Program the camif part */
+		cam_io_w_mb(path_cfg->epoch_cfg << path_reg->epoch0_shift_val,
+			mem_base + path_reg->epoch_irq_cfg_addr);
+	}
+
+	val = csid_hw->debug_info.path_mask;
+
+	if (res->is_rdi_primary_res) {
+		val |= path_reg->rup_irq_mask;
+		if (path_cfg->handle_camif_irq)
+			val |= path_reg->sof_irq_mask | path_reg->eof_irq_mask;
+	}
+
+	/* Enable secondary events dictated by HW mgr for RDI paths */
+	if (path_cfg->sec_evt_config.en_secondary_evt) {
+		if (path_cfg->sec_evt_config.evt_type & CAM_IFE_CSID_EVT_SOF)
+			val |= path_reg->sof_irq_mask;
+
+		if (path_cfg->sec_evt_config.evt_type & CAM_IFE_CSID_EVT_EPOCH)
+			val |= path_reg->epoch0_irq_mask;
+
+		CAM_DBG(CAM_ISP,
+			"CSID:%u Enable camif: %d evt irq for res: %s",
+			csid_hw->hw_intf->hw_idx, path_cfg->sec_evt_config.evt_type, res->res_name);
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	path_cfg->irq_reg_idx =  cam_ife_csid_convert_res_to_irq_reg(res->res_id);
+	if (path_cfg->discard_init_frames) {
+		rc = cam_ife_csid_ver2_subscribe_sof_for_discard(
+			path_cfg, csid_hw, res,
+			cam_ife_csid_ver2_discard_sof_top_half,
+			cam_ife_csid_ver2_discard_sof_rdi_bottom_half);
+		if (rc)
+			return rc;
+	}
+
+	irq_mask = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask;
+	rc = cam_ife_csid_ver2_path_irq_subscribe(csid_hw, res, val, irq_mask);
+	if (rc)
+		return rc;
+	cam_ife_csid_ver2_path_rup_aup(csid_hw, res, rup_aup_mask);
+	return rc;
+}
+
+
+static int cam_ife_csid_ver2_program_ipp_path(
+	struct cam_ife_csid_ver2_hw                 *csid_hw,
+	struct cam_isp_resource_node                *res,
+	struct cam_ife_csid_ver2_rup_aup_mask       *rup_aup_mask)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	uint32_t  val = 0;
+	void __iomem *mem_base;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg;
+	uint32_t irq_mask = 0;
+
+	rc = cam_ife_csid_ver2_init_config_pxl_path(
+		csid_hw, res);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%u %s path res type:%d res_id:%d %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return rc;
+	}
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_reg = csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_IPP];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%u IPP is not supported on HW",
+			 csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	cam_io_w_mb(path_cfg->epoch_cfg << path_reg->epoch0_shift_val,
+		mem_base + path_reg->epoch_irq_cfg_addr);
+
+	CAM_DBG(CAM_ISP, "CSID[%u] frame_cfg 0x%x epoch_cfg 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			val, path_cfg->epoch_cfg);
+
+	path_cfg->irq_reg_idx =  cam_ife_csid_convert_res_to_irq_reg(res->res_id);
+
+	val = csid_hw->debug_info.path_mask;
+
+	if (!(csid_reg->path_reg[res->res_id]->capabilities & CAM_IFE_CSID_CAP_MULTI_CTXT)) {
+		if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_NONE ||
+			path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+			val |= path_reg->rup_irq_mask;
+			if (path_cfg->handle_camif_irq)
+				val |= path_reg->sof_irq_mask | path_reg->epoch0_irq_mask |
+				path_reg->eof_irq_mask;
+		}
+	}
+
+	irq_mask = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask;
+
+	if (path_cfg->discard_init_frames) {
+		rc = cam_ife_csid_ver2_subscribe_sof_for_discard(
+			path_cfg, csid_hw, res,
+			cam_ife_csid_ver2_discard_sof_top_half,
+			cam_ife_csid_ver2_discard_sof_pix_bottom_half);
+		if (rc)
+			return rc;
+	}
+
+	rc = cam_ife_csid_ver2_path_irq_subscribe(csid_hw, res, val, irq_mask);
+	if (rc)
+		return rc;
+
+	val = path_reg->start_master_sel_val <<
+		path_reg->start_master_sel_shift;
+
+	if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+		/* Set start mode as master */
+		val |= path_reg->start_mode_master  <<
+			path_reg->start_mode_shift;
+	} else if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_SLAVE) {
+		/* Set start mode as slave */
+		val |= path_reg->start_mode_slave <<
+			path_reg->start_mode_shift;
+	} else {
+		/* Default is internal halt mode */
+		val = 0;
+	}
+
+	cam_io_w_mb(val, mem_base + path_reg->ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%u Pix res: %d ctrl val: 0x%x",
+		csid_hw->hw_intf->hw_idx,
+		res->res_id, val);
+
+	if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		path_cfg->sync_mode == CAM_ISP_HW_SYNC_NONE)
+		cam_ife_csid_ver2_path_rup_aup(csid_hw, res, rup_aup_mask);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_ife_csid_ver2_enable_path(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_ife_csid_ver2_reg_info      *csid_reg;
+	struct cam_hw_soc_info                       *soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	uint32_t val = 0;
+	uint32_t ctrl_addr = 0;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg;
+	void __iomem *mem_base;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	soc_info = &csid_hw->hw_info->soc_info;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	if (path_cfg->discard_init_frames) {
+		CAM_DBG(CAM_ISP, "CSID[%u] skip start cmd for res: %s",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		goto end;
+	}
+
+	path_reg = csid_reg->path_reg[res->res_id];
+	val = path_reg->resume_frame_boundary;
+	ctrl_addr = path_reg->ctrl_addr;
+
+	switch (res->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+			return 0;
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+	case CAM_IFE_PIX_PATH_RES_RDI_5:
+		if (csid_hw->flags.offline_mode)
+			return 0;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* For single CSID use-cases with lcr configure global resume */
+	if (csid_hw->flags.rdi_lcr_en && !csid_hw->top_cfg.dual_en)
+		val |= path_reg->start_mode_global << path_reg->start_mode_shift;
+	else
+		/* For dual preserve the master-slave config for IPP/PPP */
+		val |= cam_io_r_mb(mem_base + ctrl_addr);
+
+	cam_io_w_mb(val, mem_base + ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID[%u] start cmd: 0x%x programmed for res: %s",
+		csid_hw->hw_intf->hw_idx, val, res->res_name);
+end:
+	/* Change state even if we don't configure start cmd */
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return 0;
+}
+
+static int cam_ife_csid_ver2_program_ppp_path(
+	struct cam_ife_csid_ver2_hw              *csid_hw,
+	struct cam_isp_resource_node             *res,
+	struct cam_ife_csid_ver2_rup_aup_mask    *rup_aup_mask)
+{
+	int rc = 0;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	uint32_t  val = 0;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg;
+	uint32_t irq_mask = 0;
+	void __iomem *mem_base;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%u PPP is not supported on HW",
+			 csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	if (csid_hw->flags.rdi_lcr_en && path_reg->crop_drop_enable) {
+		path_cfg->drop_enable = true;
+		path_cfg->crop_enable = true;
+	}
+
+	rc = cam_ife_csid_ver2_init_config_pxl_path(
+		csid_hw, res);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%u %s path res type:%d res_id:%d %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return rc;
+	}
+
+	path_cfg->irq_reg_idx =  cam_ife_csid_convert_res_to_irq_reg(res->res_id);
+
+	/* for dual case
+	 * set ppp as slave
+	 * if current csid is set as master set
+	 * start_master_sel_val as 3
+	 */
+
+	if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_NONE) {
+		val = 0;
+	} else {
+		val = path_reg->start_mode_slave <<
+			path_reg->start_mode_shift;
+		/* Set halt mode as internal master */
+		if (csid_hw->sync_mode == CAM_ISP_HW_SYNC_MASTER)
+			val |= path_reg->start_master_sel_val <<
+				path_reg->start_master_sel_shift;
+	}
+
+	cam_io_w_mb(val, mem_base + path_reg->ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%u Pix res: %d ctrl val: 0x%x",
+		csid_hw->hw_intf->hw_idx, res->res_id, val);
+
+	if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		path_cfg->sync_mode == CAM_ISP_HW_SYNC_NONE)
+		cam_ife_csid_ver2_path_rup_aup(csid_hw, res, rup_aup_mask);
+
+	val = csid_hw->debug_info.path_mask;
+
+	if (path_cfg->discard_init_frames) {
+		rc = cam_ife_csid_ver2_subscribe_sof_for_discard(
+			path_cfg, csid_hw, res,
+			cam_ife_csid_ver2_discard_sof_top_half,
+			cam_ife_csid_ver2_discard_sof_pix_bottom_half);
+		if (rc)
+			return rc;
+	}
+
+	irq_mask = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask;
+	rc = cam_ife_csid_ver2_path_irq_subscribe(csid_hw, res, val, irq_mask);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int cam_ife_csid_ver2_rx_capture_config(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	const struct cam_ife_csid_ver2_reg_info   *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_ife_csid_ver2_rx_cfg                *rx_cfg;
+	uint32_t vc, dt, i;
+	uint32_t val = 0;
+
+	for (i = 0; i < CAM_IFE_CSID_CID_MAX; i++)
+		if (csid_hw->cid_data[i].cid_cnt)
+			break;
+
+	if (i == CAM_IFE_CSID_CID_MAX) {
+		CAM_WARN(CAM_ISP, "CSID[%u] no valid cid",
+			csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	rx_cfg = &csid_hw->rx_cfg;
+	if (csid_hw->debug_info.rx_capture_debug_set) {
+		vc = csid_hw->debug_info.rx_capture_vc;
+		dt = csid_hw->debug_info.rx_capture_dt;
+	} else {
+		vc  = csid_hw->cid_data[i].vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].vc;
+		dt  = csid_hw->cid_data[i].vc_dt[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].dt;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *) csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (csid_hw->debug_info.debug_val &
+			CAM_IFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val = ((1 << csid_reg->csi2_reg->capture_short_pkt_en_shift) |
+			(vc << csid_reg->csi2_reg->capture_short_pkt_vc_shift));
+
+	/* CAM_IFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE */
+	val |= ((1 << csid_reg->csi2_reg->capture_long_pkt_en_shift) |
+		(dt << csid_reg->csi2_reg->capture_long_pkt_dt_shift) |
+		(vc << csid_reg->csi2_reg->capture_long_pkt_vc_shift));
+
+	/* CAM_IFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE */
+	if (rx_cfg->lane_type == CAM_ISP_LANE_TYPE_CPHY) {
+		val |= ((1 << csid_reg->csi2_reg->capture_cphy_pkt_en_shift) |
+			(dt << csid_reg->csi2_reg->capture_cphy_pkt_dt_shift) |
+			(vc << csid_reg->csi2_reg->capture_cphy_pkt_vc_shift));
+	}
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + csid_reg->csi2_reg->capture_ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID[%u] rx capture_ctrl: 0x%x", csid_hw->hw_intf->hw_idx, val);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_csi2_irq_subscribe(struct cam_ife_csid_ver2_hw *csid_hw,
+	uint32_t irq_mask, uint32_t err_irq_mask)
+{
+	struct cam_ife_csid_ver2_reg_info *csid_reg = csid_hw->core_info->csid_reg;
+	uint32_t num_register = 0;
+	uint32_t *top_irq_mask = NULL;
+	int top_index = -1;
+	int i, rc;
+
+	for (i = CAM_IFE_CSID_TOP_IRQ_STATUS_REG0; i < csid_reg->num_top_regs; i++) {
+		if (csid_reg->csi2_reg->top_irq_mask[i]) {
+			top_index = i;
+			break;
+		}
+	}
+
+	if (top_index < 0) {
+		CAM_ERR(CAM_ISP, "CSID[%d] RX Subscribe Top Irq fail due to invalid mask",
+			csid_hw->hw_intf->hw_idx);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	num_register = csid_reg->top_irq_reg_info[top_index].num_registers;
+	top_irq_mask = vmalloc(sizeof(uint32_t) * num_register);
+	if (!top_irq_mask) {
+		CAM_ERR(CAM_ISP, "csid top_irq_mask allocation failed");
+		return -ENOMEM;
+	}
+
+	top_irq_mask[0] = csid_reg->csi2_reg->top_irq_mask[top_index];
+
+	csid_hw->rx_cfg.top_irq_handle = cam_irq_controller_subscribe_irq(
+		csid_hw->top_irq_controller[top_index],
+		CAM_IRQ_PRIORITY_0,
+		top_irq_mask,
+		csid_hw,
+		cam_ife_csid_ver2_handle_rx_irq,
+		NULL, NULL, NULL, CAM_IRQ_EVT_GROUP_0);
+
+	if (csid_hw->rx_cfg.top_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "CSID[%u] RX Subscribe Top Irq fail",
+			csid_hw->hw_intf->hw_idx);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	rc = cam_irq_controller_register_dependent(csid_hw->top_irq_controller[top_index],
+		csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+		top_irq_mask);
+
+	if (rc)
+		goto unsub_top;
+
+	if (irq_mask) {
+		csid_hw->rx_cfg.irq_handle = cam_irq_controller_subscribe_irq(
+						csid_hw->rx_irq_controller
+						[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+						CAM_IRQ_PRIORITY_4,
+						&irq_mask,
+						csid_hw,
+						cam_ife_csid_ver2_rx_top_half,
+						NULL,
+						NULL,
+						NULL,
+						CAM_IRQ_EVT_GROUP_0);
+
+		if (csid_hw->rx_cfg.irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "CSID[%u] RX debug irq register fail",
+				csid_hw->hw_intf->hw_idx);
+			rc = -EINVAL;
+			goto unreg_rx;
+		}
+	}
+
+	csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0] =
+					cam_irq_controller_subscribe_irq(
+						csid_hw->rx_irq_controller
+						[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+						CAM_IRQ_PRIORITY_0,
+						&err_irq_mask,
+						csid_hw,
+						cam_ife_csid_ver2_rx_err_top_half,
+						cam_ife_csid_ver2_rx_err_bottom_half,
+						csid_hw->tasklet,
+						&tasklet_bh_api,
+						CAM_IRQ_EVT_GROUP_0);
+
+	if (csid_hw->rx_cfg.err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG0] < 1) {
+		CAM_ERR(CAM_ISP, "CSID[%d] RX err irq register fail",
+			csid_hw->hw_intf->hw_idx);
+		rc = -EINVAL;
+		goto unsub_rx;
+	}
+	vfree(top_irq_mask);
+	return 0;
+
+unsub_rx:
+	if (csid_hw->rx_cfg.irq_handle)
+		cam_irq_controller_unsubscribe_irq(
+		csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0],
+		csid_hw->rx_cfg.irq_handle);
+	csid_hw->rx_cfg.irq_handle = 0;
+unreg_rx:
+	cam_irq_controller_unregister_dependent(csid_hw->top_irq_controller[top_index],
+		csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+unsub_top:
+	cam_irq_controller_unsubscribe_irq(csid_hw->top_irq_controller[top_index],
+			csid_hw->rx_cfg.top_irq_handle);
+	csid_hw->rx_cfg.top_irq_handle = 0;
+err:
+	vfree(top_irq_mask);
+	return rc;
+}
+
+static int cam_ife_csid_ver2_enable_csi2(struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	int                                             rc = 0;
+	struct cam_hw_soc_info                          *soc_info;
+	const struct cam_ife_csid_ver2_reg_info         *csid_reg;
+	const struct cam_ife_csid_ver2_csi2_rx_reg_info *csi2_reg;
+	uint32_t                                        val = 0;
+	void __iomem                                    *mem_base;
+	struct cam_ife_csid_ver2_rx_cfg                 *rx_cfg;
+	int                                             vc_full_width;
+
+	if (csid_hw->flags.rx_enabled)
+		return 0;
+
+	if (csid_hw->flags.offline_mode)
+		return 0;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csi2_reg = csid_reg->csi2_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	rx_cfg = &csid_hw->rx_cfg;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	/*Configure Rx cfg0 */
+	val |= ((rx_cfg->lane_cfg << csi2_reg->lane_cfg_shift) |
+		((rx_cfg->lane_num - 1) << csi2_reg->lane_num_shift) |
+		(rx_cfg->lane_type << csi2_reg->phy_type_shift));
+
+	if (rx_cfg->tpg_mux_sel) {
+		val |= ((rx_cfg->tpg_num_sel << csi2_reg->tpg_num_sel_shift) |
+			(rx_cfg->tpg_mux_sel << csi2_reg->tpg_mux_en_shift));
+	} else {
+		val |= rx_cfg->phy_sel << csi2_reg->phy_num_shift;
+	}
+
+	cam_io_w_mb(val, mem_base + csi2_reg->cfg0_addr);
+
+	CAM_DBG(CAM_ISP, "CSID[%u] rx_cfg0: 0x%x",
+		csid_hw->hw_intf->hw_idx, val);
+
+	/*Configure Rx cfg1*/
+	val = 1 << csi2_reg->misr_enable_shift_val;
+	val |= 1 << csi2_reg->ecc_correction_shift_en;
+	val |= (rx_cfg->epd_supported << csi2_reg->epd_mode_shift_en);
+	if (rx_cfg->dynamic_sensor_switch_en) {
+		val |= 1 << csi2_reg->dyn_sensor_switch_shift_en;
+		/* Disable rup_aup latch feature */
+		if (csi2_reg->rup_aup_latch_supported)
+			val |= 1 << csi2_reg->rup_aup_latch_shift;
+	}
+
+	vc_full_width = cam_ife_csid_is_vc_full_width(csid_hw->cid_data);
+
+	if (vc_full_width == 1) {
+		val |= 1 <<  csi2_reg->vc_mode_shift_val;
+	} else if (vc_full_width < 0) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Error VC DT", csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	cam_io_w_mb(val, mem_base + csi2_reg->cfg1_addr);
+	CAM_DBG(CAM_ISP, "CSID[%u] rx_cfg1: 0x%x",
+		csid_hw->hw_intf->hw_idx, val);
+
+	val = csi2_reg->fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG0] |
+		csi2_reg->part_fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG0] |
+		csi2_reg->non_fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG0];
+
+	if (csid_hw->rx_cfg.epd_supported &&
+		(csid_hw->rx_cfg.lane_type == CAM_ISP_LANE_TYPE_DPHY))
+		val &= ~IFE_CSID_VER2_RX_CPHY_EOT_RECEPTION;
+
+	rc = cam_ife_csid_ver2_csi2_irq_subscribe(csid_hw, csid_hw->debug_info.rx_mask, val);
+	if (rc)
+		return rc;
+
+	csid_hw->flags.rx_enabled = true;
+
+	cam_ife_csid_ver2_rx_capture_config(csid_hw);
+
+	return rc;
+}
+
+static int cam_ife_csid_ver2_program_top(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	const struct cam_ife_csid_ver2_top_reg_info *top_reg;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	uint32_t val;
+	struct cam_hw_soc_info              *soc_info;
+	int input_core_sel;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	if (!csid_reg->need_top_cfg) {
+		CAM_DBG(CAM_ISP, "CSID %d top not supported",
+			csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	top_reg  = csid_reg->top_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	/* Porgram top parameters */
+	input_core_sel = csid_reg->input_core_sel[csid_hw->hw_intf->hw_idx]
+				[csid_hw->top_cfg.input_core_type];
+
+	CAM_DBG(CAM_ISP, "CSID[%u] input_core_sel %d",
+		csid_hw->hw_intf->hw_idx, input_core_sel);
+
+	if (input_core_sel == -1) {
+		CAM_ERR(CAM_ISP, "CSID[%u] invalid top input_core_type %u",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->top_cfg.input_core_type);
+		return -EINVAL;
+	}
+
+	val = (uint32_t)input_core_sel << top_reg->input_core_type_shift_val;
+
+	if ((top_reg->sfe_offline_en_shift_val && csid_hw->top_cfg.offline_sfe_en) ||
+		(top_reg->sfe_pipeline_bypassed && csid_hw->top_cfg.sfe_fs))
+		val |= BIT(top_reg->sfe_offline_en_shift_val);
+
+	val |= csid_hw->top_cfg.out_ife_en <<
+			top_reg->out_ife_en_shift_val;
+
+	val |= csid_hw->top_cfg.rdi_lcr;
+
+	cam_io_w_mb(val,
+		soc_info->reg_map[CAM_IFE_CSID_TOP_MEM_BASE_ID].mem_base +
+		top_reg->io_path_cfg0_addr[csid_hw->hw_intf->hw_idx]);
+
+	/*Program dual csid regs */
+
+	if (csid_hw->sync_mode == CAM_ISP_HW_SYNC_NONE)
+		return 0;
+
+	val = csid_hw->top_cfg.dual_sync_core_sel <<
+		top_reg->dual_sync_sel_shift_val;
+	val |= csid_hw->top_cfg.dual_en <<
+		top_reg->dual_en_shift_val;
+	val |= csid_hw->top_cfg.master_slave_sel <<
+		top_reg->master_slave_sel_shift_val;
+
+	cam_io_w_mb(val,
+		soc_info->reg_map[CAM_IFE_CSID_TOP_MEM_BASE_ID].mem_base +
+		top_reg->dual_csid_cfg0_addr[csid_hw->hw_intf->hw_idx]);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_set_cesta_clk_rate(struct cam_ife_csid_ver2_hw *csid_hw,
+	bool force_channel_switch, const char *identifier)
+{
+	struct cam_hw_soc_info *soc_info = &csid_hw->hw_info->soc_info;
+	bool channel_switch = force_channel_switch;
+	uint32_t lowest_clk_lvl = soc_info->lowest_clk_level;
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "CSID:%d clk_rate=%llu, channel_switch=%d, identifier=%s",
+		csid_hw->hw_intf->hw_idx, csid_hw->clk_rate, channel_switch, identifier);
+
+	if (csid_hw->clk_rate) {
+		rc = cam_soc_util_set_src_clk_rate(soc_info, csid_hw->hw_intf->hw_idx,
+			csid_hw->clk_rate,
+			soc_info->clk_rate[lowest_clk_lvl][soc_info->src_clk_idx]);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in setting cesta clk rates[high low]:[%ld %ld] client_idx:%d rc:%d",
+				csid_hw->clk_rate,
+				soc_info->clk_rate[lowest_clk_lvl][soc_info->src_clk_idx],
+				csid_hw->hw_intf->hw_idx, rc);
+			return rc;
+		}
+		channel_switch = true;
+	}
+
+	if (channel_switch) {
+		rc = cam_soc_util_cesta_channel_switch(csid_hw->hw_intf->hw_idx, identifier);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY,
+				"Failed to apply power states for cesta client:%d rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_ver2_enable_core(struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	int rc = 0;
+	struct cam_hw_soc_info              *soc_info;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	uint32_t clk_lvl;
+	struct cam_csid_soc_private *soc_private;
+	uint32_t irq_mask = 0;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	soc_private = (struct cam_csid_soc_private *)soc_info->soc_private;
+
+	/* overflow check before increment */
+	if (csid_hw->hw_info->open_count == UINT_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%u Open count reached max",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	/* Increment ref Count */
+	csid_hw->hw_info->open_count++;
+
+	if (csid_hw->hw_info->open_count > 1) {
+		CAM_DBG(CAM_ISP, "CSID[%u] hw has already been enabled",
+			csid_hw->hw_intf->hw_idx);
+		return rc;
+	}
+
+	rc = cam_soc_util_get_clk_level(soc_info, csid_hw->clk_rate,
+		soc_info->src_clk_idx, &clk_lvl);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"CSID[%u] get clk level fail rate %u",
+			csid_hw->clk_rate);
+	}
+
+	if (soc_private->is_ife_csid_lite)
+		CAM_DBG(CAM_ISP,
+			"CSID[%u] clk lvl %u received clk_rate %u applied clk_rate :%lu",
+			csid_hw->hw_intf->hw_idx, clk_lvl, csid_hw->clk_rate,
+			soc_info->applied_src_clk_rates.sw_client);
+	else
+		CAM_DBG(CAM_ISP,
+			"CSID[%d] clk lvl %u received clk_rate %u applied clk_rate sw_client:%lu hw_client:[%lu %lu]",
+			csid_hw->hw_intf->hw_idx, clk_lvl, csid_hw->clk_rate,
+			soc_info->applied_src_clk_rates.sw_client,
+			soc_info->applied_src_clk_rates.hw_client[csid_hw->hw_intf->hw_idx].high,
+			soc_info->applied_src_clk_rates.hw_client[csid_hw->hw_intf->hw_idx].low);
+
+	rc = cam_ife_csid_enable_soc_resources(soc_info, clk_lvl);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%d] Enable soc failed", csid_hw->hw_intf->hw_idx);
+		goto err;
+	}
+
+	CAM_DBG(CAM_ISP, "csid %d is_clk_drv_en %d is_drv_config_en %d",
+		csid_hw->hw_intf->hw_idx, soc_info->is_clk_drv_en, csid_hw->is_drv_config_en);
+
+	/*
+	 * cam_ife_csid_enable_soc_resources sets clk_lvl for high, low values, if the usecase
+	 * enables drv config, i.e enabling csid DRV events, overwrite low value with LowSVS to get
+	 * power benefit.
+	 */
+	if (soc_info->is_clk_drv_en && csid_hw->is_drv_config_en) {
+		rc = cam_ife_csid_ver2_set_cesta_clk_rate(csid_hw, false, "csid_init");
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed in setting cesta clk rates, client_idx:%d rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+			return rc;
+		}
+	}
+
+	irq_mask = csid_reg->cmn_reg->top_reset_irq_mask[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0];
+
+	csid_hw->reset_irq_handle = cam_irq_controller_subscribe_irq(
+		csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		CAM_IRQ_PRIORITY_0,
+		&irq_mask,
+		csid_hw,
+		cam_ife_csid_ver2_reset_irq_top_half,
+		NULL,
+		NULL,
+		NULL,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (csid_hw->reset_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "CSID[%u] reset irq subscribe fail",
+			csid_hw->hw_intf->hw_idx);
+		goto disable_res;
+	}
+
+	reinit_completion(&csid_hw->hw_info->hw_complete);
+	cam_ife_csid_ver2_program_top(csid_hw);
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_UP;
+
+	return rc;
+
+disable_res:
+	cam_ife_csid_disable_soc_resources(soc_info);
+
+err:
+	CAM_ERR(CAM_ISP, "CSID[%u] init hw fail rc %d",
+		csid_hw->hw_intf->hw_idx, rc);
+	csid_hw->hw_info->open_count--;
+	return rc;
+}
+
+static int cam_ife_csid_ver2_enable_hw(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	struct cam_hw_soc_info              *soc_info;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg = NULL;
+	uint32_t  val;
+	int i, rc;
+	void __iomem *mem_base;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	uint32_t num_register = 0;
+	uint32_t top_err_irq_mask = 0;
+	uint32_t *buf_done_irq_mask = NULL;
+	uint32_t top_info_irq_mask = 0;
+
+	if (csid_hw->flags.device_enabled) {
+		CAM_DBG(CAM_ISP, "CSID[%u] hw has already been enabled",
+			csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	/* Clear IRQs */
+	cam_io_w_mb(1, mem_base +
+		csid_reg->cmn_reg->top_irq_clear_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+
+	cam_io_w_mb(csid_reg->csi2_reg->irq_mask_all,
+		mem_base + csid_reg->csi2_reg->irq_clear_addr[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+
+	path_reg = csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_IPP];
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			mem_base + path_reg->irq_clear_addr);
+
+	path_reg = csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_PPP];
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(csid_reg->cmn_reg->ppp_irq_mask_all,
+			mem_base + path_reg->irq_clear_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		path_reg = csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_RDI_0 + i];
+		cam_io_w_mb(csid_reg->cmn_reg->rdi_irq_mask_all,
+			mem_base + path_reg->irq_clear_addr);
+	}
+	cam_io_w_mb(1, mem_base + csid_reg->cmn_reg->irq_cmd_addr);
+
+	/* Read hw version */
+	val = cam_io_r_mb(mem_base + csid_reg->cmn_reg->hw_version_addr);
+
+	num_register = csid_reg->top_irq_reg_info[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0].num_registers;
+	buf_done_irq_mask = vmalloc(sizeof(uint32_t) * num_register);
+	if (!buf_done_irq_mask) {
+		CAM_ERR(CAM_ISP, "csid buf_done_irq_mask allocation failed");
+		return -ENOMEM;
+	}
+	buf_done_irq_mask[0] = csid_reg->cmn_reg->top_buf_done_irq_mask;
+
+	if (csid_reg->ipp_mc_reg)
+		buf_done_irq_mask[0] |= csid_reg->ipp_mc_reg->comp_subgrp0_mask |
+			csid_reg->ipp_mc_reg->comp_subgrp2_mask;
+
+	csid_hw->buf_done_irq_handle = cam_irq_controller_subscribe_irq(
+		csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		CAM_IRQ_PRIORITY_4,
+		buf_done_irq_mask,
+		csid_hw,
+		cam_ife_csid_ver2_handle_buf_done_irq,
+		NULL,
+		NULL,
+		NULL,
+		CAM_IRQ_EVT_GROUP_0);
+
+
+	if (csid_hw->buf_done_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "CSID[%u] buf done irq subscribe fail",
+			csid_hw->hw_intf->hw_idx);
+		rc = -EINVAL;
+		goto free_buf_done_mask;
+	}
+
+	top_err_irq_mask = csid_reg->cmn_reg->top_err_irq_mask[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0];
+	csid_hw->top_err_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0] =
+		cam_irq_controller_subscribe_irq(
+		csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		CAM_IRQ_PRIORITY_0,
+		&top_err_irq_mask,
+		csid_hw,
+		cam_ife_csid_ver2_top_err_irq_top_half,
+		cam_ife_csid_ver2_top_err_irq_bottom_half,
+		csid_hw->tasklet,
+		&tasklet_bh_api,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (csid_hw->top_err_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0] < 1) {
+		CAM_ERR(CAM_ISP, "csid[%u] top error irq subscribe fail",
+			csid_hw->hw_intf->hw_idx);
+		rc = -EINVAL;
+		goto unsubscribe_buf_done;
+	}
+
+	rc = cam_irq_controller_register_dependent(csid_hw->top_irq_controller
+		[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		csid_hw->buf_done_irq_controller, buf_done_irq_mask);
+
+	if (rc) {
+		cam_irq_controller_unsubscribe_irq(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->buf_done_irq_handle);
+		rc = -EINVAL;
+		goto unsubscribe_top_err;
+	}
+
+	if (csid_hw->debug_info.top_mask) {
+		top_info_irq_mask = csid_hw->debug_info.top_mask;
+		csid_hw->top_info_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0] =
+						cam_irq_controller_subscribe_irq(
+						csid_hw->top_irq_controller
+						[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+						CAM_IRQ_PRIORITY_1,
+						&top_info_irq_mask,
+						csid_hw,
+						cam_ife_csid_ver2_top_info_irq_top_half,
+						cam_ife_csid_ver2_top_info_irq_bottom_half,
+						csid_hw->tasklet,
+						&tasklet_bh_api,
+						CAM_IRQ_EVT_GROUP_0);
+
+		if (csid_hw->top_info_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0] < 1) {
+			CAM_ERR(CAM_ISP, "CSID[%u] Subscribe Top Info Irq fail",
+				csid_hw->hw_intf->hw_idx);
+			rc = -EINVAL;
+			goto unsubscribe_top_err;
+		}
+	}
+
+	csid_hw->flags.device_enabled = true;
+	csid_hw->flags.fatal_err_detected = false;
+	CAM_DBG(CAM_ISP, "CSID:%u CSID HW version: 0x%x",
+		csid_hw->hw_intf->hw_idx, val);
+	vfree(buf_done_irq_mask);
+	return 0;
+
+
+unsubscribe_top_err:
+	cam_irq_controller_unsubscribe_irq(
+		csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		csid_hw->top_err_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+	csid_hw->top_err_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0] = 0;
+
+unsubscribe_buf_done:
+	cam_irq_controller_unsubscribe_irq(
+		csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		csid_hw->buf_done_irq_handle);
+	csid_hw->buf_done_irq_handle = 0;
+free_buf_done_mask:
+	vfree(buf_done_irq_mask);
+	return rc;
+}
+
+int cam_ife_csid_ver2_init_hw(void *hw_priv,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_ver2_hw *csid_hw  = NULL;
+	struct cam_hw_info *hw_info;
+	int rc = 0;
+	struct cam_isp_resource_node *res;
+
+	if (!hw_priv || !init_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+
+	rc = cam_ife_csid_ver2_enable_core(csid_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%u] init hw fail",
+			csid_hw->hw_intf->hw_idx);
+		goto end;
+	}
+	res  = (struct cam_isp_resource_node *)init_args;
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] init hw",
+		csid_hw->hw_intf->hw_idx);
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_ver2_disable_core(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	const struct cam_ife_csid_ver2_top_reg_info *top_reg = NULL;
+	struct cam_hw_soc_info                   *soc_info;
+	struct cam_csid_soc_private              *soc_private;
+	int rc = 0;
+
+	/* Check for refcount */
+	if (!csid_hw->hw_info->open_count) {
+		CAM_WARN(CAM_ISP, "CSID[%u] Unbalanced disable_hw", csid_hw->hw_intf->hw_idx);
+		return rc;
+	}
+
+	/* Decrement ref Count */
+	csid_hw->hw_info->open_count--;
+
+	if (csid_hw->hw_info->open_count)
+		return rc;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	soc_private = (struct cam_csid_soc_private *)
+		soc_info->soc_private;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	top_reg = csid_reg->top_reg;
+	cam_ife_csid_ver2_disable_csi2(true, csid_hw);
+
+	/* Disable the top IRQ interrupt */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->top_irq_mask_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+
+	if (csid_hw->reset_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->reset_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP,
+				"CSID:%d Failed to unsubscribe reset irq",
+				csid_hw->hw_intf->hw_idx);
+		csid_hw->reset_irq_handle = 0;
+	}
+
+	/*
+	 * Wrapper config can be reset only by ares from
+	 * camera subsystem power up or CSR ares bit
+	 * in CSID clk branch both of which are not
+	 * gauranteed at the end of a given CSID stream.
+	 * Explicitly resetting the config for full CSIDs
+	 * via AHB to avoid conflict on consecutive sessions
+	 */
+	if ((top_reg) && (!soc_private->is_ife_csid_lite)) {
+		cam_io_w_mb(top_reg->io_path_cfg_rst_val,
+			soc_info->reg_map[CAM_IFE_CSID_TOP_MEM_BASE_ID].mem_base +
+			top_reg->io_path_cfg0_addr[csid_hw->hw_intf->hw_idx]);
+
+		cam_io_w_mb(top_reg->dual_cfg_rst_val,
+			soc_info->reg_map[CAM_IFE_CSID_TOP_MEM_BASE_ID].mem_base +
+			top_reg->dual_csid_cfg0_addr[csid_hw->hw_intf->hw_idx]);
+	}
+
+	spin_lock_bh(&csid_hw->lock_state);
+	csid_hw->flags.device_enabled = false;
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	csid_hw->flags.rdi_lcr_en = false;
+	spin_unlock_bh(&csid_hw->lock_state);
+	rc = cam_ife_csid_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CSID:%u Disable CSID SOC failed",
+			csid_hw->hw_intf->hw_idx);
+
+	csid_hw->counters.error_irq_count = 0;
+	return rc;
+}
+
+int cam_ife_csid_ver2_deinit_hw(void *hw_priv,
+	void *deinit_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_ver2_hw *csid_hw  = NULL;
+	struct cam_isp_resource_node           *res;
+	struct cam_hw_info *hw_info;
+	int rc = 0;
+
+	if (!hw_priv || !deinit_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID:Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	res = (struct cam_isp_resource_node *)deinit_args;
+
+	if (csid_hw->hw_info->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP, "CSID:%u already powered down",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid Res type %d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "CSID:%u Res:%d already in De-init state",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW)
+		goto disable_hw;
+
+	switch (res->res_id) {
+	case  CAM_IFE_PIX_PATH_RES_IPP:
+	case  CAM_IFE_PIX_PATH_RES_PPP:
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+	case CAM_IFE_PIX_PATH_RES_RDI_5:
+		rc = cam_ife_csid_ver2_disable_path(true, csid_hw, res);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid res type%d",
+			csid_hw->hw_intf->hw_idx, res->res_type);
+		break;
+	}
+
+disable_hw:
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	cam_ife_csid_ver2_disable_core(csid_hw);
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	CAM_DBG(CAM_ISP, "De-Init CSID %d Path: %d",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	return rc;
+}
+
+static void cam_ife_csid_ver2_testbus_config(
+	struct cam_ife_csid_ver2_hw *csid_hw, uint32_t val)
+{
+	struct cam_hw_soc_info *soc_info = &csid_hw->hw_info->soc_info;
+	struct cam_ife_csid_ver2_reg_info *csid_reg =
+		(struct cam_ife_csid_ver2_reg_info *) csid_hw->core_info->csid_reg;
+
+	cam_io_w_mb(val, soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base +
+		csid_reg->cmn_reg->test_bus_ctrl);
+	CAM_DBG(CAM_ISP, "CSID [%u] test_bus_ctrl: 0x%x", csid_hw->hw_intf->hw_idx, val);
+}
+
+static void cam_ife_csid_ver2_send_secure_info(
+	struct cam_csid_hw_start_args *start_args,
+	struct cam_ife_csid_ver2_hw    *csid_hw)
+{
+	struct cam_ife_csid_secure_info        secure_info;
+	struct cam_ife_csid_ver2_reg_info     *csid_reg;
+	int                                    phy_sel = 0;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	secure_info.lane_cfg = csid_hw->rx_cfg.lane_cfg;
+	secure_info.cdm_hw_idx_mask = BIT(start_args->cdm_hw_idx);
+	secure_info.vc_mask = 0;
+	secure_info.csid_hw_idx_mask = BIT(csid_hw->hw_intf->hw_idx);
+
+	CAM_DBG(CAM_ISP,
+		"PHY secure info for CSID[%u], lane_cfg: 0x%x, ife: 0x%x, cdm: 0x%x, vc_mask: 0x%llx",
+		csid_hw->hw_intf->hw_idx,
+		secure_info.lane_cfg, secure_info.csid_hw_idx_mask,
+		secure_info.cdm_hw_idx_mask, secure_info.vc_mask);
+
+	/* Issue one call to PHY for dual IFE cases */
+	phy_sel = (int)(csid_hw->rx_cfg.phy_sel - csid_reg->cmn_reg->phy_sel_base_idx);
+	if (phy_sel < 0) {
+		CAM_WARN(CAM_ISP, "Can't notify csiphy, incorrect phy selected=%d",
+			phy_sel);
+	} else {
+		secure_info.phy_sel = (uint32_t)phy_sel;
+		CAM_DBG(CAM_ISP, "Notify CSIPHY: %d", phy_sel);
+		cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+			CAM_SUBDEV_MESSAGE_DOMAIN_ID_SECURE_PARAMS, (void *)&secure_info);
+	}
+
+}
+
+int cam_ife_csid_ver2_start(void *hw_priv, void *args,
+			uint32_t arg_size)
+{
+	struct cam_ife_csid_ver2_hw                 *csid_hw  = NULL;
+	struct cam_isp_resource_node                *res;
+	struct cam_csid_hw_start_args               *start_args;
+	struct cam_ife_csid_ver2_reg_info           *csid_reg;
+	struct cam_hw_soc_info                      *soc_info;
+	struct cam_hw_info                          *hw_info;
+	struct cam_ife_csid_ver2_rup_aup_mask        rup_aup_mask = {0};
+	int                                          rc = 0, i;
+	bool                                         delay_rdi0_enable = false;
+	struct cam_subdev_msg_phy_conn_csid_info     conn_csid_info;
+	struct cam_subdev_msg_phy_drv_info           drv_info;
+	struct cam_subdev_msg_phy_halt_resume_info   halt_resume_info;
+	bool                                         cesta_enabled = false;
+	void __iomem                                *csid_clc_membase = NULL;
+
+	if (!hw_priv || !args) {
+		CAM_ERR(CAM_ISP, "CSID Invalid params");
+		return  -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	start_args = (struct cam_csid_hw_start_args *)args;
+	csid_clc_membase = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	if (csid_hw->hw_info->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP, "CSID:%u already powered down",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	csid_hw->flags.sof_irq_triggered = false;
+	csid_hw->counters.irq_debug_cnt = 0;
+	csid_hw->is_drv_config_en = start_args->is_drv_config_en;
+
+	CAM_DBG(CAM_ISP,
+		"csid %d is_drv_config_en %d start_only %d is_internal_start %d, clk_rate=%lld",
+		csid_hw->hw_intf->hw_idx, csid_hw->is_drv_config_en,
+		start_args->start_only, start_args->is_internal_start, csid_hw->clk_rate);
+
+	if (start_args->start_only) {
+		rc = cam_cpas_csid_process_resume(csid_hw->hw_intf->hw_idx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID:%u Failed to process resume rc: %d",
+				csid_hw->hw_intf->hw_idx, rc);
+			goto end;
+		}
+	}
+
+	if (soc_info->is_clk_drv_en && csid_hw->is_drv_config_en) {
+		/*
+		 * This will do 2 things :
+		 * 1. At the time of enable_core, we do not have drv info yet populated into
+		 *    csid layer, so we set high, low here will overwrite previously set high, low
+		 * 2. We trigger a channel switch so that we go to high clocks for all including
+		 *    csiphy before calling CSIPHY RESUME, so that we remove sw client vote from
+		 *    csiphy device
+		 */
+		rc = cam_ife_csid_ver2_set_cesta_clk_rate(csid_hw, true, "csid_start");
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed in setting cesta clk rates, client_idx:%d rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+			goto end;
+		}
+
+		if (csid_hw->sync_mode != CAM_ISP_HW_SYNC_SLAVE) {
+			halt_resume_info.phy_idx = (csid_hw->rx_cfg.phy_sel - 1);
+			halt_resume_info.lane_cfg = csid_hw->rx_cfg.lane_cfg;
+			halt_resume_info.csid_state = CAM_SUBDEV_PHY_CSID_RESUME;
+			cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+				CAM_SUBDEV_MESSAGE_NOTIFY_HALT_RESUME,
+					(void *)&halt_resume_info);
+		}
+	}
+
+	rc = cam_ife_csid_ver2_enable_hw(csid_hw);
+
+	for (i = 0; i < start_args->num_res; i++) {
+
+		res = start_args->node_res[i];
+		CAM_DBG(CAM_ISP, "CSID:%u res_type :%d res[id:%d name:%s]",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id, res->res_name);
+
+		if (res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+			CAM_ERR(CAM_ISP, "CSID:%u Invalid res tpe:%d res id:%d",
+				csid_hw->hw_intf->hw_idx, res->res_type,
+				res->res_id);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		switch (res->res_id) {
+		case  CAM_IFE_PIX_PATH_RES_IPP:
+			rc = cam_ife_csid_ver2_program_ipp_path(csid_hw, res, &rup_aup_mask);
+			if (rc)
+				goto end;
+
+			break;
+		case  CAM_IFE_PIX_PATH_RES_PPP:
+			rc = cam_ife_csid_ver2_program_ppp_path(csid_hw, res, &rup_aup_mask);
+			if (rc)
+				goto end;
+
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+		case CAM_IFE_PIX_PATH_RES_RDI_4:
+		case CAM_IFE_PIX_PATH_RES_RDI_5:
+			rc = cam_ife_csid_ver2_program_rdi_path(csid_hw, res, &rup_aup_mask);
+			if (rc)
+				goto end;
+
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "CSID:%u Invalid res type %d",
+					csid_hw->hw_intf->hw_idx, res->res_type);
+			break;
+		}
+	}
+
+	/*
+	 * For targets with domain-id support, hand over relevant parameters
+	 * to phy driver
+	 */
+	if ((csid_hw->sync_mode != CAM_ISP_HW_SYNC_SLAVE) &&
+		start_args->is_secure &&
+		csid_hw->flags.domain_id_security)
+		cam_ife_csid_ver2_send_secure_info(start_args, csid_hw);
+
+	/*
+	 * Configure RUP/AUP/MUP @ streamon for all enabled paths
+	 * For internal recovery - skip this, CDM packet corresponding
+	 * to the request being recovered will apply the appropriate RUP/AUP/MUP
+	 */
+	if (csid_reg->cmn_reg->capabilities & CAM_IFE_CSID_CAP_SPLIT_RUP_AUP) {
+		rup_aup_mask.rup_aup_set_mask |=
+			(csid_hw->rx_cfg.mup << csid_reg->cmn_reg->mup_shift_val) |
+			BIT(csid_reg->cmn_reg->rup_aup_set_shift_val);
+	} else {
+		rup_aup_mask.rup_mask |=
+			(csid_hw->rx_cfg.mup << csid_reg->cmn_reg->mup_shift_val);
+	}
+
+	if (!start_args->is_internal_start) {
+		if (csid_reg->cmn_reg->capabilities & CAM_IFE_CSID_CAP_SPLIT_RUP_AUP) {
+			cam_io_w_mb(rup_aup_mask.rup_mask,
+				csid_clc_membase + csid_reg->cmn_reg->rup_cmd_addr);
+			cam_io_w_mb(rup_aup_mask.aup_mask,
+				csid_clc_membase + csid_reg->cmn_reg->aup_cmd_addr);
+			cam_io_w_mb(rup_aup_mask.rup_aup_set_mask,
+				csid_clc_membase + csid_reg->cmn_reg->rup_aup_cmd_addr);
+		} else {
+			cam_io_w_mb(rup_aup_mask.rup_mask,
+				csid_clc_membase + csid_reg->cmn_reg->rup_aup_cmd_addr);
+
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%u res_id: %d RUP:0x%x AUP: 0x%x MUP:0x%x at start updated: %s",
+		csid_hw->hw_intf->hw_idx, res->res_id, rup_aup_mask.rup_mask, rup_aup_mask.aup_mask,
+		rup_aup_mask.rup_aup_set_mask, CAM_BOOL_TO_YESNO(!start_args->is_internal_start));
+
+
+	cam_ife_csid_ver2_enable_csi2(csid_hw);
+
+	if (csid_hw->sync_mode != CAM_ISP_HW_SYNC_SLAVE) {
+		struct cam_csid_soc_private *soc_private =
+			(struct cam_csid_soc_private *)soc_info->soc_private;
+
+		conn_csid_info.phy_idx = (csid_hw->rx_cfg.phy_sel - 1);
+		conn_csid_info.lane_cfg = csid_hw->rx_cfg.lane_cfg;
+		conn_csid_info.core_idx = csid_hw->hw_intf->hw_idx;
+		cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE, CAM_SUBDEV_MESSAGE_CONN_CSID_INFO,
+			(void *)&conn_csid_info);
+
+		if (!soc_private->is_ife_csid_lite)
+			cam_cpas_query_drv_enable(NULL, &cesta_enabled);
+
+		if (cesta_enabled) {
+			/* for ifelites, soc_info->is_clk_drv_en is false */
+			drv_info.use_hw_client_voting = soc_info->is_clk_drv_en;
+			drv_info.is_drv_config_en = csid_hw->is_drv_config_en;
+		} else {
+			drv_info.use_hw_client_voting = false;
+			drv_info.is_drv_config_en = false;
+		}
+
+		drv_info.phy_idx = (csid_hw->rx_cfg.phy_sel - 1);
+		drv_info.lane_cfg = csid_hw->rx_cfg.lane_cfg;
+
+		/*
+		 * send this even when cesta is not enabled - to support debugfs to switch between
+		 * cesta and non-cesta between runs. CSIPHY might have stale information if we
+		 * do not send this info everytime
+		 */
+		cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+			CAM_SUBDEV_MESSAGE_DRV_INFO, (void *)&drv_info);
+	}
+
+	for (i = 0; i < start_args->num_res; i++) {
+		res = start_args->node_res[i];
+
+		if ((csid_hw->flags.rdi_lcr_en) &&
+			(res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0)) {
+			delay_rdi0_enable = true;
+			continue;
+		}
+
+		cam_ife_csid_ver2_enable_path(csid_hw, res);
+		CAM_DBG(CAM_ISP,
+			"CSID[%u] res_type :%d res_id:%d enabled",
+			csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+	}
+
+	if (delay_rdi0_enable) {
+		res = &csid_hw->path_res[CAM_IFE_PIX_PATH_RES_RDI_0];
+		cam_ife_csid_ver2_enable_path(csid_hw, res);
+		CAM_DBG(CAM_ISP, "CSID[%u] Enabling RDI0 after all paths for LCR-PD cases",
+			csid_hw->hw_intf->hw_idx);
+	}
+
+	if (csid_hw->debug_info.test_bus_val) {
+		cam_ife_csid_ver2_testbus_config(csid_hw, csid_hw->debug_info.test_bus_val);
+		csid_hw->debug_info.test_bus_enabled = true;
+	} else {
+		cam_ife_csid_ver2_testbus_config(csid_hw,
+			csid_reg->cmn_reg->sync_reset_ctrl_testbus_val);
+		csid_hw->debug_info.test_bus_enabled = true;
+	}
+
+	/* Check for global resume */
+	if (csid_hw->flags.rdi_lcr_en && !csid_hw->top_cfg.dual_en) {
+		cam_io_w_mb(1,
+			soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base +
+			csid_reg->cmn_reg->global_cmd_addr);
+		CAM_DBG(CAM_ISP, "CSID[%u] global start set",
+			csid_hw->hw_intf->hw_idx);
+	}
+
+	csid_hw->flags.reset_awaited = false;
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static void cam_ife_csid_ver2_maskout_all_irqs(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_csid_hw_stop_args *csid_stop)
+{
+	int i;
+	struct cam_hw_soc_info *soc_info;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg;
+	const struct cam_ife_csid_ver2_csi2_rx_reg_info *csi2_reg;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	void __iomem *mem_base;
+	struct cam_isp_resource_node           *res;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		csid_hw->core_info->csid_reg;
+	csi2_reg  = csid_reg->csi2_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	/* Disable rx */
+	if (!csid_hw->flags.offline_mode)
+		cam_io_w_mb(0x0,
+			mem_base + csi2_reg->irq_mask_addr[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+
+	for (i = 0; i < csid_stop->num_res; i++) {
+		res = csid_stop->node_res[i];
+		path_reg = csid_reg->path_reg[res->res_id];
+
+		/* Disable path */
+		cam_io_w_mb(0x0,
+			mem_base + path_reg->irq_mask_addr);
+	}
+
+	/* Disable buf done */
+	cam_io_w_mb(0x0, mem_base +
+		csid_reg->cmn_reg->buf_done_irq_mask_addr);
+
+	/* Disable top except rst_done */
+	cam_io_w_mb(csid_reg->cmn_reg->top_reset_irq_mask[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		mem_base + csid_reg->cmn_reg->top_irq_mask_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+}
+
+int cam_ife_csid_ver2_stop(void *hw_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_ver2_hw *csid_hw  = NULL;
+	struct cam_isp_resource_node           *res;
+	struct cam_hw_info *hw_info;
+	int rc = 0;
+	uint32_t i;
+	struct cam_csid_hw_stop_args         *csid_stop;
+	struct cam_csid_reset_cfg_args       reset = {0};
+	struct cam_subdev_msg_phy_halt_resume_info halt_resume_info;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_csid_hw_stop_args))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+
+	if (csid_hw->hw_info->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP, "CSID:%u already powered down",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	csid_stop = (struct cam_csid_hw_stop_args  *) stop_args;
+
+	if (!csid_stop->num_res) {
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid args", csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%u num_res %d", csid_hw->hw_intf->hw_idx,
+		csid_stop->num_res);
+
+	csid_hw->flags.device_enabled = false;
+
+	if (csid_hw->hw_info->soc_info.is_clk_drv_en && csid_hw->is_drv_config_en) {
+		halt_resume_info.phy_idx = (csid_hw->rx_cfg.phy_sel - 1);
+		halt_resume_info.lane_cfg = csid_hw->rx_cfg.lane_cfg;
+		halt_resume_info.csid_state = CAM_SUBDEV_PHY_CSID_HALT;
+		cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+			CAM_SUBDEV_MESSAGE_NOTIFY_HALT_RESUME,
+				(void *)&halt_resume_info);
+	}
+
+	/* Issue a halt & reset to ensure there is no HW activity post the halt block */
+	reset.reset_type = CAM_IFE_CSID_RESET_PATH;
+	cam_ife_csid_ver2_reset(hw_priv, &reset,
+		sizeof(struct cam_csid_reset_cfg_args));
+
+	atomic_set(&csid_hw->discard_frame_per_path, 0);
+	atomic_set(&csid_hw->init_global_reset_cnt, 0);
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+
+	/* Mask out all irqs from HW */
+	cam_ife_csid_ver2_maskout_all_irqs(csid_hw, csid_stop);
+
+	for (i = 0; i < csid_stop->num_res; i++) {
+
+		res = csid_stop->node_res[i];
+		rc = cam_ife_csid_ver2_disable_path(false, csid_hw, res);
+		res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+		CAM_DBG(CAM_ISP, "CSID:%u res_type %d Resource[id:%d name:%s] state:%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id,
+			res->res_name, res->res_state);
+	}
+	if (csid_hw->buf_done_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->buf_done_irq_handle);
+		csid_hw->buf_done_irq_handle = 0;
+
+		cam_irq_controller_unregister_dependent(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->buf_done_irq_controller);
+	}
+
+	if (csid_hw->top_err_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->top_err_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+		csid_hw->top_err_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0] = 0;
+	}
+
+	if (csid_hw->top_mc_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->top_mc_irq_handle);
+		csid_hw->top_mc_irq_handle = 0;
+	}
+
+	if (csid_hw->debug_info.top_mask) {
+		cam_irq_controller_unsubscribe_irq_evt(
+			csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+			csid_hw->top_info_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+		csid_hw->top_info_irq_handle[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0] = 0;
+	}
+
+	cam_ife_csid_ver2_disable_csi2(false, csid_hw);
+	if (csid_hw->debug_info.test_bus_enabled)
+		cam_ife_csid_ver2_testbus_config(csid_hw, 0x0);
+
+	csid_hw->debug_info.test_bus_enabled = false;
+	csid_hw->flags.pf_err_detected = false;
+	csid_hw->flags.rdi_lcr_en = false;
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+
+	return rc;
+}
+
+int cam_ife_csid_ver2_read(void *hw_priv,
+	void *read_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+
+	return -EINVAL;
+}
+
+int cam_ife_csid_ver2_write(void *hw_priv,
+	void *write_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+	return -EINVAL;
+}
+
+static int cam_ife_csid_ver2_top_cfg(
+	struct cam_ife_csid_ver2_hw *csid_hw, void *cmd_args)
+{
+	struct cam_ife_csid_top_config_args *top_args;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	uint32_t hw_idx;
+	int rc = 0;
+
+	if ((!csid_hw) || (!cmd_args))
+		return -EINVAL;
+
+	top_args = (struct cam_ife_csid_top_config_args *)cmd_args;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	hw_idx = csid_hw->hw_intf->hw_idx;
+	csid_hw->top_cfg.out_ife_en = true;
+	csid_hw->rup_aup_mask = 0;
+
+	/* config out_core parameter*/
+
+	switch (top_args->input_core_type) {
+	case CAM_IFE_CSID_INPUT_CORE_NONE:
+		csid_hw->top_cfg.input_core_type =
+			CAM_IFE_CSID_INPUT_CORE_SEL_NONE;
+		csid_hw->top_cfg.out_ife_en = false;
+		break;
+
+	case CAM_IFE_CSID_INPUT_CORE_IFE:
+		csid_hw->top_cfg.input_core_type =
+			CAM_IFE_CSID_INPUT_CORE_SEL_INTERNAL;
+		break;
+
+	case CAM_IFE_CSID_INPUT_CORE_SFE:
+		csid_hw->top_cfg.out_ife_en = false;
+		fallthrough;
+	case CAM_IFE_CSID_INPUT_CORE_SFE_IFE:
+
+		if (top_args->core_idx == 0) {
+			csid_hw->top_cfg.input_core_type =
+				CAM_IFE_CSID_INPUT_CORE_SEL_SFE_0;
+		} else if (top_args->core_idx == 1) {
+			csid_hw->top_cfg.input_core_type =
+				CAM_IFE_CSID_INPUT_CORE_SEL_SFE_1;
+		} else if (top_args->core_idx == 2) {
+			csid_hw->top_cfg.input_core_type =
+				CAM_IFE_CSID_INPUT_CORE_SEL_SFE_2;
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_ISP,
+				"CSID: %u Invalid SFE node %d",
+				hw_idx, top_args->core_idx);
+		}
+
+		break;
+
+	case CAM_IFE_CSID_INPUT_CORE_CUST_IFE:
+
+		if (!(csid_reg->csid_cust_node_map[hw_idx] &
+			BIT(top_args->core_idx))) {
+			CAM_ERR(CAM_ISP,
+				"CSID: %u not supported for cust node %d",
+				hw_idx, top_args->core_idx);
+			rc = -EINVAL;
+			break;
+		}
+
+		if (top_args->core_idx == 0) {
+			csid_hw->top_cfg.input_core_type =
+				CAM_IFE_CSID_INPUT_CORE_SEL_CUST_NODE_0;
+		} else if (top_args->core_idx == 1) {
+			csid_hw->top_cfg.input_core_type =
+				CAM_IFE_CSID_INPUT_CORE_SEL_CUST_NODE_1;
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_ISP,
+				"CSID: %u Invalid Cust node %d",
+				hw_idx, top_args->core_idx);
+		}
+		break;
+	default:
+		break;
+	}
+
+	csid_hw->top_cfg.offline_sfe_en = top_args->is_sfe_offline;
+	csid_hw->top_cfg.sfe_fs = top_args->is_sfe_fs;
+	CAM_DBG(CAM_ISP,
+		"CSID[%u] input_core_type:%d ife_out:%d sfe_offline:%d sfe_fs:%d",
+		hw_idx, csid_hw->top_cfg.input_core_type,
+		csid_hw->top_cfg.out_ife_en,
+		csid_hw->top_cfg.offline_sfe_en,
+		csid_hw->top_cfg.sfe_fs);
+	CAM_DBG(CAM_ISP,
+		"CSID[%u] Top config received: input_core_type%d core_idx:%d",
+		hw_idx, top_args->input_core_type, top_args->core_idx);
+
+	/*config dual sync params */
+	if (csid_hw->sync_mode == CAM_ISP_HW_SYNC_NONE)
+		return rc;
+	else if (csid_hw->sync_mode == CAM_ISP_HW_SYNC_MASTER)
+		csid_hw->top_cfg.master_slave_sel =
+			csid_reg->top_reg->master_sel_val;
+	else
+		csid_hw->top_cfg.master_slave_sel =
+			csid_reg->top_reg->slave_sel_val;
+
+	csid_hw->top_cfg.dual_en = true;
+	csid_hw->top_cfg.dual_sync_core_sel = csid_hw->dual_core_idx + 1;
+	CAM_DBG(CAM_ISP,
+		"CSID[%u] Top dual sync config core_sel: %d sync_mode: %d",
+		hw_idx, csid_hw->sync_mode,
+		csid_hw->top_cfg.dual_sync_core_sel);
+
+	return rc;
+}
+
+static int cam_ife_csid_ver2_get_mc_reg_val_pair(
+	struct cam_ife_csid_ver2_hw                *csid_hw,
+	uint32_t                                   *reg_val_pair,
+	struct cam_isp_csid_reg_update_args        *rup_args)
+{
+	struct cam_ife_csid_ver2_reg_info            *csid_reg;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+	struct cam_ife_csid_ver2_rup_aup_mask         rup_aup_mask = {0};
+	int                                           rc = 0;
+	uint32_t                                      i = 0;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	for (i = 0; i < rup_args->num_res; i++) {
+		path_reg = csid_reg->path_reg[rup_args->res[i]->res_id];
+		if (!path_reg) {
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid Path Resource [id %d name %s]",
+				csid_hw->hw_intf->hw_idx,
+				rup_args->res[i]->res_id,
+				rup_args->res[i]->res_name);
+			return -EINVAL;
+		}
+		rup_aup_mask.rup_mask |= path_reg->rup_mask;
+		rup_aup_mask.aup_mask |= path_reg->aup_mask;
+		rup_aup_mask.rup_aup_set_mask |= path_reg->rup_aup_set_mask;
+	}
+
+	reg_val_pair[0] = csid_reg->cmn_reg->rup_cmd_addr;
+	reg_val_pair[1] = rup_aup_mask.rup_mask;
+	reg_val_pair[2] = csid_reg->cmn_reg->aup_cmd_addr;
+	reg_val_pair[3] = rup_aup_mask.aup_mask;
+	reg_val_pair[4] = csid_reg->cmn_reg->rup_aup_cmd_addr;
+	reg_val_pair[5] = rup_aup_mask.rup_aup_set_mask;
+
+	/**
+	 * If not an actual request, configure last applied MUP
+	 */
+	if (rup_args->reg_write)
+		reg_val_pair[5] |= (rup_args->last_applied_mup <<
+			csid_reg->cmn_reg->mup_shift_val);
+	else
+		reg_val_pair[5] |= (csid_hw->rx_cfg.mup <<
+			csid_reg->cmn_reg->mup_shift_val);
+
+	CAM_DBG(CAM_ISP, "CSID[%d] configure rup: 0x%x, offset: 0x%x, aup: 0x%x, offset: 0x%x",
+		csid_hw->hw_intf->hw_idx, reg_val_pair[1], reg_val_pair[0],
+		reg_val_pair[3], reg_val_pair[2]);
+	CAM_DBG(CAM_ISP, "CSID[%d] rup_aup_set reg: 0x%x, offset: 0x%x via %s",
+		csid_hw->hw_intf->hw_idx,reg_val_pair[5], reg_val_pair[4],
+		(rup_args->reg_write ? "AHB" : "CDM"));
+	return rc;
+}
+
+static int cam_ife_csid_ver2_get_sc_reg_val_pair(
+	struct cam_ife_csid_ver2_hw            *csid_hw,
+	uint32_t                               *reg_val_pair,
+	struct cam_isp_csid_reg_update_args    *rup_args)
+{
+	uint32_t                                      i = 0;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+	int                                           rc = 0;
+	struct cam_ife_csid_ver2_rup_aup_mask         rup_aup_mask = {0};
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	rup_aup_mask.rup_mask = csid_hw->rup_aup_mask;
+	CAM_DBG(CAM_ISP, "csid_hw:%d rup_aup_mask 0x%x",
+		csid_hw->hw_intf->hw_idx, csid_hw->rup_aup_mask);
+
+	for (i = 0; i < rup_args->num_res; i++) {
+		path_reg = csid_reg->path_reg[rup_args->res[i]->res_id];
+		if (!path_reg) {
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid Path Resource [id %d name %s]",
+				csid_hw->hw_intf->hw_idx,
+				rup_args->res[i]->res_id,
+				rup_args->res[i]->res_name);
+
+			return -EINVAL;
+		}
+		rup_aup_mask.rup_mask |= path_reg->rup_aup_mask;
+	}
+
+	reg_val_pair[0] = csid_reg->cmn_reg->rup_aup_cmd_addr;
+	reg_val_pair[1] = rup_aup_mask.rup_mask;
+
+	/**
+	 * If not an actual request, configure last applied MUP
+	 */
+	if (rup_args->reg_write)
+		reg_val_pair[1] |= (rup_args->last_applied_mup <<
+			csid_reg->cmn_reg->mup_shift_val);
+	else
+		reg_val_pair[1] |= (csid_hw->rx_cfg.mup <<
+			csid_reg->cmn_reg->mup_shift_val);
+
+	csid_hw->rup_aup_mask = reg_val_pair[1];
+
+	CAM_DBG(CAM_ISP, "CSID[%d] configure rup_aup_mup: 0x%x offset: 0x%x via %s",
+		csid_hw->hw_intf->hw_idx,
+		reg_val_pair[1], reg_val_pair[0],
+		(rup_args->reg_write ? "AHB" : "CDM"));
+	return rc;
+}
+
+static int cam_ife_csid_ver2_reg_update(
+	struct cam_ife_csid_ver2_hw   *csid_hw,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_csid_reg_update_args   *rup_args = cmd_args;
+	struct cam_ife_csid_ver2_reg_info     *csid_reg;
+	struct cam_hw_soc_info                *soc_info = &csid_hw->hw_info->soc_info;
+	struct cam_cdm_utils_ops              *cdm_util_ops;
+	uint32_t                               num_reg_val_pairs = 0;
+	uint32_t                               reg_val_pair[6] = {0};
+	int                                    rc = 0;
+	uint32_t                               size, i = 0;
+	void __iomem                          *csid_clc_membase = soc_info->reg_map
+						[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+		csid_hw->core_info->csid_reg;
+
+	if (arg_size != sizeof(struct cam_isp_csid_reg_update_args)) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid arg size: %d expected:%ld",
+			csid_hw->hw_intf->hw_idx, arg_size,
+			sizeof(struct cam_isp_csid_reg_update_args));
+		return -EINVAL;
+	}
+
+	if (!rup_args) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid args", csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	if (!rup_args->num_res ||
+		rup_args->num_res > CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid num_res %u",
+			csid_hw->hw_intf->hw_idx, rup_args->num_res);
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)rup_args->res[0]->cdm_ops;
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid CDM ops", csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	num_reg_val_pairs = (csid_reg->cmn_reg->capabilities & CAM_IFE_CSID_CAP_SPLIT_RUP_AUP) ?
+		3 : 1;
+
+	size = cdm_util_ops->cdm_required_size_reg_random(num_reg_val_pairs);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((!rup_args->reg_write) && ((size * 4) > rup_args->cmd.size)) {
+		CAM_ERR(CAM_ISP, "CSID[%u] buf size:%d is not sufficient, expected: %d",
+			csid_hw->hw_intf->hw_idx, rup_args->cmd.size, (size*4));
+		return -EINVAL;
+	}
+
+
+	if (rup_args->mup_en) {
+		csid_hw->rx_cfg.mup = rup_args->mup_val;
+		CAM_DBG(CAM_ISP, "CSID[%u] MUP %u",
+			csid_hw->hw_intf->hw_idx, csid_hw->rx_cfg.mup);
+	}
+
+	if (csid_reg->cmn_reg->capabilities & CAM_IFE_CSID_CAP_SPLIT_RUP_AUP)
+		cam_ife_csid_ver2_get_mc_reg_val_pair(csid_hw, reg_val_pair, rup_args);
+	else
+		cam_ife_csid_ver2_get_sc_reg_val_pair(csid_hw, reg_val_pair, rup_args);
+
+	if (rup_args->reg_write) {
+		for (i = 0; i < (2 * num_reg_val_pairs); i = i + 2)
+			cam_io_w_mb(reg_val_pair[i + 1], csid_clc_membase + reg_val_pair[i]);
+	} else {
+		cdm_util_ops->cdm_write_regrandom(rup_args->cmd.cmd_buf_addr,
+			num_reg_val_pairs, reg_val_pair);
+		rup_args->cmd.used_bytes = size * 4;
+	}
+	return rc;
+}
+
+static int cam_ife_csid_ver2_program_offline_go_cmd(
+	struct cam_ife_csid_ver2_hw   *csid_hw,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_offline_cmd_update_args *go_args = cmd_args;
+	struct cam_cdm_utils_ops                    *cdm_util_ops;
+	struct cam_ife_csid_ver2_reg_info           *csid_reg;
+	uint32_t                                     size;
+	uint32_t                                     reg_val_pair[2];
+
+	if (!go_args) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid args", csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	if (arg_size !=
+		sizeof(struct cam_ife_csid_offline_cmd_update_args)) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid arg size: %d expected:%ld",
+			csid_hw->hw_intf->hw_idx, arg_size,
+			sizeof(struct cam_ife_csid_offline_cmd_update_args));
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)go_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid CDM ops", csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > go_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "CSID[%u] buf size:%d is not sufficient, expected: %d",
+			csid_hw->hw_intf->hw_idx, go_args->cmd.size, (size*4));
+		return -EINVAL;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	reg_val_pair[0] = csid_reg->cmn_reg->offline_cmd_addr;
+	reg_val_pair[1] = 0x1;
+
+	CAM_DBG(CAM_ISP, "CSID:%u offline_cmd 0x%x offset 0x%X",
+		csid_hw->hw_intf->hw_idx,
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(go_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	go_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_get_time_stamp(
+	struct cam_ife_csid_ver2_hw  *csid_hw, void *cmd_args)
+{
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+	struct cam_isp_resource_node                 *res = NULL;
+	struct cam_ife_csid_ver2_path_cfg            *path_cfg = NULL;
+	struct cam_hw_soc_info                       *soc_info;
+	struct cam_csid_get_time_stamp_args          *timestamp_args;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg;
+	struct timespec64                             ts;
+
+	timestamp_args = (struct cam_csid_get_time_stamp_args *)cmd_args;
+	res = timestamp_args->node_res;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%u Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%u Invalid res :%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (timestamp_args->get_prev_timestamp) {
+		timestamp_args->prev_time_stamp_val = __cam_ife_csid_ver2_get_time_stamp(
+			soc_info->reg_map[0].mem_base,
+			path_reg->timestamp_perv0_sof_addr,
+			path_reg->timestamp_perv1_sof_addr,
+			path_cfg->ts_comb_vcdt_en,
+			csid_reg->cmn_reg->ts_comb_vcdt_mask);
+	}
+
+	if (timestamp_args->get_curr_timestamp) {
+		timestamp_args->time_stamp_val = __cam_ife_csid_ver2_get_time_stamp(
+			soc_info->reg_map[0].mem_base,
+			path_reg->timestamp_curr0_sof_addr,
+			path_reg->timestamp_curr1_sof_addr,
+			path_cfg->ts_comb_vcdt_en,
+			csid_reg->cmn_reg->ts_comb_vcdt_mask);
+	} else {
+		if (path_cfg->ts_comb_vcdt_en)
+			timestamp_args->time_stamp_val &=
+				 ~(uint64_t)csid_reg->cmn_reg->ts_comb_vcdt_mask;
+		timestamp_args->time_stamp_val = mul_u64_u32_div(timestamp_args->time_stamp_val,
+			CAM_IFE_CSID_QTIMER_MUL_FACTOR,
+			CAM_IFE_CSID_QTIMER_DIV_FACTOR);
+	}
+
+	if (qtime_to_boottime == 0) {
+		if (timestamp_args->raw_boot_time)
+			ts = *timestamp_args->raw_boot_time;
+		else
+			ktime_get_boottime_ts64(&ts);
+		qtime_to_boottime =
+			(uint64_t)((ts.tv_sec * 1000000000) +
+			ts.tv_nsec) - (int64_t)timestamp_args->time_stamp_val;
+	}
+
+	timestamp_args->boot_timestamp = timestamp_args->time_stamp_val +
+		qtime_to_boottime;
+	CAM_DBG(CAM_ISP, "CSID:%u Resource[id:%d name:%s timestamp:%lld]",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_name,
+		timestamp_args->boot_timestamp);
+	csid_hw->timestamp[res->res_id].prev_sof_ts = timestamp_args->time_stamp_val;
+	csid_hw->timestamp[res->res_id].prev_boot_ts = timestamp_args->boot_timestamp;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_print_hbi_vbi(
+	struct cam_ife_csid_ver2_hw  *csid_hw,
+	struct cam_isp_resource_node *res)
+{
+	struct cam_hw_soc_info              *soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg = NULL;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	uint32_t  hbi, vbi;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP,
+			"CSID[%u] Invalid res_type:%d res [id: %d name: %s]",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id, res->res_name);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	path_reg = csid_reg->path_reg[res->res_id];
+	if (!path_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%u invalid res %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	hbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		path_reg->format_measure1_addr);
+	vbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		path_reg->format_measure2_addr);
+
+	CAM_INFO_RATE_LIMIT(CAM_ISP,
+		"CSID[%u] Resource[id:%d name:%s hbi 0x%x vbi 0x%x]",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_name, hbi, vbi);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_set_dynamic_switch_config(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	void                        *cmd_args)
+{
+	struct cam_ife_csid_mode_switch_update_args *switch_update = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	switch_update =
+		(struct cam_ife_csid_mode_switch_update_args *)cmd_args;
+
+	if (switch_update->mup_args.use_mup) {
+		csid_hw->rx_cfg.mup = switch_update->mup_args.mup_val;
+		CAM_DBG(CAM_ISP, "CSID[%u] MUP %u",
+			csid_hw->hw_intf->hw_idx, csid_hw->rx_cfg.mup);
+	}
+
+	/* Handle number of frames to initially drop based on num starting exposures */
+	if (switch_update->exp_update_args.reset_discard_cfg) {
+		struct cam_ife_csid_discard_frame_cfg_update *exp_update_args;
+		struct cam_ife_csid_ver2_path_cfg            *path_cfg;
+		struct cam_isp_resource_node                 *res;
+		int i;
+
+		exp_update_args = &switch_update->exp_update_args;
+		for (i = CAM_IFE_PIX_PATH_RES_RDI_0; i <= CAM_IFE_PIX_PATH_RES_RDI_2; i++) {
+			res = &csid_hw->path_res[i];
+			path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+			/* Skip if path_cfg is NULL */
+			if (!path_cfg)
+				continue;
+
+			/* Skip if res is not acquired or powered on */
+			if ((res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+				(res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW)) {
+				if ((i - CAM_IFE_PIX_PATH_RES_RDI_0) >=
+					exp_update_args->num_exposures) {
+					path_cfg->skip_discard_frame_cfg = true;
+					if (path_cfg->discard_init_frames) {
+						path_cfg->discard_init_frames = false;
+						path_cfg->num_frames_discard = 0;
+						atomic_dec(&csid_hw->discard_frame_per_path);
+						CAM_DBG(CAM_ISP,
+							"CSID[%u] Reset discard config for %s",
+							csid_hw->hw_intf->hw_idx, res->res_name);
+					}
+				}
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_set_csid_clock(
+	struct cam_ife_csid_ver2_hw          *csid_hw,
+	void *cmd_args)
+{
+	struct cam_ife_csid_clock_update_args *clk_update = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	clk_update =
+		(struct cam_ife_csid_clock_update_args *)cmd_args;
+
+	csid_hw->clk_rate = clk_update->clk_rate;
+
+	CAM_DBG(CAM_ISP, "CSID:%d, clk_rate=%lld", csid_hw->hw_intf->hw_idx, csid_hw->clk_rate);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_mini_dump(
+	struct cam_ife_csid_ver2_hw  *csid_hw,
+	void *cmd_args)
+{
+	struct cam_ife_csid_ver2_mini_dump_data *md;
+	uint32_t                                 i  = 0;
+	struct cam_ife_csid_ver2_path_cfg       *path_cfg;
+	struct cam_ife_csid_ver2_res_mini_dump  *md_res;
+	struct cam_isp_resource_node            *res;
+	struct cam_hw_mini_dump_args            *md_args;
+
+	md_args = (struct cam_hw_mini_dump_args *)cmd_args;
+	if (md_args->len < sizeof(*md)) {
+		md_args->bytes_written = 0;
+		return 0;
+	}
+
+	md  = (struct cam_ife_csid_ver2_mini_dump_data *)
+		((uint8_t *)md_args->start_addr);
+	md->clk_rate = csid_hw->clk_rate;
+	md->hw_state = csid_hw->hw_info->hw_state;
+
+	for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+		res = &csid_hw->path_res[i];
+		path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+		if (!path_cfg)
+			continue;
+
+		md_res = &md->res[i];
+		md_res->res_id = res->res_id;
+		scnprintf(md_res->res_name, CAM_ISP_RES_NAME_LEN, res->res_name);
+		memcpy(&md_res->path_cfg, path_cfg, sizeof(*path_cfg));
+	}
+
+	memcpy(&md->rx_cfg, &csid_hw->rx_cfg, sizeof(struct cam_ife_csid_ver2_rx_cfg));
+	memcpy(&md->flags, &csid_hw->flags, sizeof(struct cam_ife_csid_hw_flags));
+	memcpy(md->cid_data, csid_hw->cid_data,
+		sizeof(struct cam_ife_csid_cid_data) * CAM_IFE_CSID_CID_MAX);
+	md_args->bytes_written = sizeof(*md);
+
+	return 0;
+}
+
+static void *cam_ife_csid_ver2_user_dump_info(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_isp_resource_node       *res = NULL;
+	struct cam_hw_info                 *hw_info = NULL;
+	struct cam_ife_csid_ver2_hw        *csid_hw = NULL;
+	struct cam_ife_csid_ver2_reg_info  *csid_reg = NULL;
+	struct cam_hw_soc_info             *soc_info = NULL;
+	uint32_t                           *addr;
+	uint32_t                            frame = 0;
+	uint32_t                            val0 = 0, val1 = 0, val2 = 0;
+
+	res = (struct cam_isp_resource_node *)dump_struct;
+	hw_info = (struct cam_hw_info *)res->hw_intf->hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+	csid_reg = csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	frame = cam_io_r_mb(soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base +
+	csid_reg->path_reg[res->res_id]->format_measure0_addr);
+
+	val0 = cam_io_r_mb(soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base +
+		csid_reg->path_reg[res->res_id]->debug_camif_0_addr);
+	val1 = cam_io_r_mb(soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base +
+		csid_reg->path_reg[res->res_id]->debug_camif_1_addr);
+	val2 = cam_io_r_mb(soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base +
+		csid_reg->path_reg[res->res_id]->debug_halt_status_addr);
+
+	addr = (uint32_t *)addr_ptr;
+
+	*addr++ = ((frame >> csid_reg->cmn_reg->format_measure_height_shift_val) &
+		csid_reg->cmn_reg->format_measure_height_mask_val);
+	*addr++ = frame & csid_reg->cmn_reg->format_measure_width_mask_val;
+	*addr++ = val0;
+	*addr++ = val1;
+	*addr++ = val2;
+
+	return addr;
+}
+
+static int cam_ife_csid_ver2_user_dump(
+	struct cam_ife_csid_ver2_hw  *csid_hw,
+	void *cmd_args)
+{
+	uint32_t                                    i = 0;
+	struct cam_ife_csid_ver2_path_cfg          *path_cfg;
+	struct cam_isp_resource_node               *res;
+	struct cam_isp_hw_dump_args                *dump_args;
+	int                                         rc = 0;
+
+	if (!csid_hw || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid bus private data");
+		return -EINVAL;
+	} else if (csid_hw->hw_info->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%u powered down",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	dump_args = (struct cam_isp_hw_dump_args *)cmd_args;
+
+	rc = cam_common_user_dump_helper(dump_args, cam_common_user_dump_clock,
+		csid_hw->hw_info, sizeof(uint64_t), "CLK_RATE_PRINT:");
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%u VER2: Clock dump failed, rc: %d",
+			csid_hw->hw_intf->hw_idx, rc);
+		return rc;
+	}
+
+	/* Loop through CSID items */
+	for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+		res = &csid_hw->path_res[i];
+
+		if (res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%u VER2: path inactive res ID: %d, continuing",
+				csid_hw->hw_intf->hw_idx, res->res_id);
+			continue;
+		}
+
+		path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+		if (!path_cfg)
+			continue;
+
+		rc = cam_common_user_dump_helper(dump_args, cam_ife_csid_ver2_user_dump_info,
+			res, sizeof(uint32_t), "CSID2_PATH.%s:", res->res_name);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID:%u VER2: Info dump failed, rc:%d",
+				csid_hw->hw_intf->hw_idx, rc);
+			return rc;
+		}
+
+	}
+	return 0;
+}
+
+static int cam_ife_csid_ver2_dual_sync_cfg(
+	struct cam_ife_csid_ver2_hw  *csid_hw,
+	void *cmd_args)
+{
+	struct cam_ife_csid_dual_sync_args  *dual_sync_args;
+
+	if (!csid_hw || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args %pK  %pK",
+			csid_hw, cmd_args);
+		return -EINVAL;
+	}
+
+	dual_sync_args = (struct cam_ife_csid_dual_sync_args *)cmd_args;
+	csid_hw->sync_mode = dual_sync_args->sync_mode;
+	csid_hw->dual_core_idx = dual_sync_args->dual_core_id;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] sync_mode %d dual_core_idx: %d",
+		csid_hw->hw_intf->hw_idx, csid_hw->sync_mode,
+		csid_hw->dual_core_idx);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_dump_crop_reg(
+	struct cam_hw_info  *hw_info, uint32_t *path_id)
+{
+	struct cam_ife_csid_ver2_hw                    *csid_hw;
+	const struct cam_ife_csid_ver2_reg_info        *csid_reg;
+	struct cam_hw_soc_info                         *soc_info;
+	const struct cam_ife_csid_ver2_path_reg_info   *path_reg;
+	struct cam_isp_resource_node                   *path_res;
+	struct cam_ife_csid_ver2_path_cfg              *path_cfg;
+	uint32_t hcrop = 0, vcrop = 0, cfg0 = 0, cfg1 = 0;
+	int rc = 0;
+	void __iomem *mem_base;
+
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+
+	spin_lock(&csid_hw->lock_state);
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP ||
+		*path_id >= CAM_IFE_PIX_PATH_RES_MAX || *path_id < 0) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid dev state :%d or path_id :%u",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		spin_unlock(&csid_hw->lock_state);
+		return -EINVAL;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	CAM_INFO(CAM_ISP, "CSID[%u] Clock Name=%s Clock Rate=%u",
+		csid_hw->hw_intf->hw_idx, soc_info->clk_name[soc_info->src_clk_idx],
+		cam_soc_util_get_applied_src_clk(soc_info, true));
+
+	path_res = &csid_hw->path_res[*path_id];
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)path_res->res_priv;
+	if (path_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING && path_cfg) {
+		path_reg = csid_reg->path_reg[*path_id];
+		hcrop = cam_io_r_mb(mem_base + path_reg->hcrop_addr);
+		vcrop = cam_io_r_mb(mem_base + path_reg->vcrop_addr);
+		cfg0 = cam_io_r_mb(mem_base + path_reg->cfg0_addr);
+		cfg1 = cam_io_r_mb(mem_base + path_reg->cfg1_addr);
+		CAM_INFO(CAM_ISP, "CSID[%u] %s HCROP=0x%x VCROP=0x%x, CFG0=0x%x CFG1=0x%x",
+			csid_hw->hw_intf->hw_idx, path_res->res_name, hcrop, vcrop, cfg0, cfg1);
+		CAM_INFO(CAM_ISP, "CSID[%u] %s width=%d height=%d start line:%d end line:%d",
+			csid_hw->hw_intf->hw_idx, path_res->res_name, path_cfg->width,
+			path_cfg->height, path_cfg->start_line, path_cfg->end_line);
+	}
+
+	spin_unlock(&csid_hw->lock_state);
+	return rc;
+}
+
+static int cam_ife_csid_ver2_set_discard_frame_cfg(
+	struct cam_ife_csid_ver2_hw    *csid_hw,
+	void                           *cmd_args)
+{
+	struct cam_isp_resource_node                 *res;
+	struct cam_ife_csid_ver2_path_cfg            *path_cfg;
+	struct cam_ife_csid_discard_init_frame_args  *discard_config = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	discard_config =
+		(struct cam_ife_csid_discard_init_frame_args *)cmd_args;
+
+	if (discard_config->num_frames == 0xffffffff) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid number of frames: 0x%x",
+			csid_hw->hw_intf->hw_idx, discard_config->num_frames);
+		return -EINVAL;
+	}
+
+	if (!discard_config->num_frames) {
+		CAM_DBG(CAM_ISP, "CSID[%u] No discard requested", csid_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	res = discard_config->res;
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid res_type: %d res id: %d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	/* Handle first stream on and consecutive streamons post flush */
+	if ((res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW)) {
+		/* Skip if already set or need to skip based on stream on exposures */
+		path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+		if (path_cfg->skip_discard_frame_cfg || path_cfg->discard_init_frames)
+			goto end;
+
+		path_cfg->discard_init_frames = true;
+		path_cfg->sof_cnt = 0;
+		path_cfg->num_frames_discard = discard_config->num_frames;
+		atomic_inc(&csid_hw->discard_frame_per_path);
+		CAM_DBG(CAM_ISP,
+			"CSID[%u] discard num of frames: %u for path: %s discard_ref_cnt: %u",
+			csid_hw->hw_intf->hw_idx, discard_config->num_frames, res->res_name,
+			atomic_read(&csid_hw->discard_frame_per_path));
+	}
+
+end:
+	return 0;
+}
+
+static int cam_ife_csid_ver2_rdi_lcr_cfg(
+	struct cam_ife_csid_ver2_hw  *csid_hw, void *cmd_args)
+{
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg;
+	struct cam_ife_csid_ver2_path_cfg            *path_cfg = NULL;
+	struct cam_isp_resource_node                 *res = cmd_args;
+
+	if (!csid_hw || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	path_reg = csid_reg->path_reg[res->res_id];
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	if (!path_cfg || !path_reg || !path_reg->capabilities ||
+		!(path_reg->capabilities & CAM_IFE_CSID_CAP_INPUT_LCR)) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid res %s",
+			csid_hw->hw_intf->hw_idx, res->res_name);
+		return -EINVAL;
+	}
+
+	if (!path_cfg->sfe_shdr && (res->res_id != CAM_IFE_PIX_PATH_RES_RDI_0)) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid res: %s, capabilities 0x%x sfe_shdr: %u",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			path_reg->capabilities, path_cfg->sfe_shdr);
+		return -EINVAL;
+	}
+
+	/*
+	 * LCR should not be on for a resource if CSID is giving packed data
+	 * this case would come for formats which are not supported.
+	 */
+	if (path_cfg->path_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0].packing_fmt) {
+		CAM_ERR(CAM_ISP, "CSID[%u] [%s] LCR not supported in_format %d out_format %d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			path_cfg->in_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0],
+			path_cfg->out_format);
+		return -EINVAL;
+	}
+
+	/* if CSID unpacked data is not in MSB, we loose few bits going into PDAF, warn for now */
+	if (!path_cfg->csid_out_unpack_msb)
+		CAM_WARN(CAM_ISP,
+			"CSID[%u] [%s] Input data to LCR is in LSB, in_format %d out_format %d",
+			csid_hw->hw_intf->hw_idx, res->res_name,
+			path_cfg->in_format[CAM_IFE_CSID_MULTI_VC_DT_GRP_0],
+			path_cfg->out_format);
+
+	if (csid_hw->flags.sfe_en)
+		csid_hw->top_cfg.rdi_lcr |= BIT(res->res_id) <<
+			csid_reg->top_reg->rdi_lcr_shift_val;
+
+	csid_hw->flags.rdi_lcr_en = true;
+	path_cfg->lcr_en = true;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] %s top_cfg %u",
+		csid_hw->hw_intf->hw_idx, res->res_name, csid_hw->top_cfg.rdi_lcr);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_update_res_data(struct cam_ife_csid_ver2_hw *csid_hw,
+	void *reserve_args)
+{
+
+	struct cam_isp_resource_node    *res = NULL;
+	struct cam_csid_hw_reserve_resource_args  *reserve;
+	struct cam_ife_csid_ver2_path_cfg    *path_cfg;
+	struct cam_csid_resource_update      *res_update;
+	int rc = 0;
+
+	res_update = (struct cam_csid_resource_update *)reserve_args;
+	reserve = (struct cam_csid_hw_reserve_resource_args  *)res_update->csid_acquire;
+
+	res = &csid_hw->path_res[reserve->res_id];
+	if (res->is_per_port_acquire != true) {
+		/**
+		 * intentionally set as DBG log to since this log gets printed when hw manager
+		 * checks if resource is available
+		 */
+		CAM_DBG(CAM_ISP, "CSID %d Res_id %d state %d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			res->res_state);
+		return -EBUSY;
+	}
+
+	if (reserve->res_id < CAM_IFE_PIX_PATH_RES_MAX) {
+		csid_hw->token_data[reserve->res_id].token = reserve->cb_priv;
+		csid_hw->token_data[reserve->res_id].res_id = reserve->res_id;
+	} else {
+		CAM_ERR(CAM_ISP,
+			"exceeded max expected resource path CSID[%u] res_id :%d ",
+				csid_hw->hw_intf->hw_idx, reserve->res_id);
+		return -EINVAL;
+	}
+
+	res->is_per_port_acquire = false;
+	rc = cam_ife_csid_ver2_in_port_validate(reserve, csid_hw, res->is_per_port_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID %d Res_id %d port validation failed",
+			csid_hw->hw_intf->hw_idx, reserve->res_id);
+		return rc;
+	}
+
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	if (!path_cfg) {
+		CAM_ERR(CAM_ISP,
+			"CSID %d Unallocated Res_id %d state %d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	/* Skip rx and csid cfg for offline */
+	if (!reserve->is_offline) {
+		cam_ife_csid_hw_ver2_config_path_data(csid_hw, path_cfg,
+			reserve, path_cfg->cid);
+		rc = cam_ife_csid_ver_config_camif(csid_hw, reserve, path_cfg);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID[%d] camif config failed",
+				csid_hw->hw_intf->hw_idx);
+			goto end;
+		}
+
+		if (res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+			switch (res->res_id) {
+			case CAM_IFE_PIX_PATH_RES_RDI_0:
+			case CAM_IFE_PIX_PATH_RES_RDI_1:
+			case CAM_IFE_PIX_PATH_RES_RDI_2:
+			case CAM_IFE_PIX_PATH_RES_RDI_3:
+			case CAM_IFE_PIX_PATH_RES_RDI_4:
+			case CAM_IFE_PIX_PATH_RES_RDI_5:
+				rc = cam_ife_csid_ver2_program_init_cfg1_rdi_path(csid_hw, res);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"failed to update cfg1 for CSID:%d res:%d %s",
+						csid_hw->hw_intf->hw_idx,
+						res->res_id, res->res_name);
+					goto end;
+				}
+				break;
+			case CAM_IFE_PIX_PATH_RES_IPP:
+			case CAM_IFE_PIX_PATH_RES_PPP:
+				rc = cam_ife_csid_ver2_program_init_cfg1_pxl_path(csid_hw, res);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"failed to update cfg1 for CSID:%d res:%d %s",
+						csid_hw->hw_intf->hw_idx,
+						res->res_id, res->res_name);
+					goto end;
+				}
+				break;
+			default:
+				rc = -EINVAL;
+				CAM_ERR(CAM_ISP, "Invalid res:%d %s for CSID:%d",
+					res->res_id, res->res_name,
+					csid_hw->hw_intf->hw_idx);
+				break;
+			}
+		}
+	}
+
+	csid_hw->tasklet  = reserve->tasklet;
+	res->tasklet_info  = reserve->tasklet;
+	csid_hw->event_cb = reserve->event_cb;
+	res->cdm_ops = reserve->cdm_ops;
+
+	reserve->buf_done_controller = csid_hw->buf_done_irq_controller;
+	csid_hw->flags.sfe_en = reserve->sfe_en;
+	path_cfg->sfe_shdr = reserve->sfe_inline_shdr;
+	csid_hw->flags.offline_mode = reserve->is_offline;
+	path_cfg->handle_camif_irq = reserve->handle_camif_irq;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] Resource[id: %d name:%s] state %d cid %d",
+		csid_hw->hw_intf->hw_idx, reserve->res_id, res->res_name,
+		res->res_state, path_cfg->cid);
+
+end:
+	return rc;
+}
+
+static int cam_ife_csid_ver2_update_path_irq(
+	struct cam_ife_csid_ver2_hw     *csid_hw,
+	struct cam_isp_resource_node    *res,
+	bool                             enable)
+{
+	int i, rc = 0;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+	struct cam_ife_csid_ver2_reg_info *csid_reg = csid_hw->core_info->csid_reg;
+	int top_index = -1;
+	uint32_t val = 0;
+	uint32_t irq_mask = 0;
+
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	path_reg = csid_reg->path_reg[res->res_id];
+
+	if (path_cfg->irq_reg_idx >= CAM_IFE_CSID_IRQ_REG_MAX) {
+		CAM_ERR(CAM_ISP, "CSID[%d] Invalid irq reg id %d",
+			csid_hw->hw_intf->hw_idx, path_cfg->irq_reg_idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	for (i = CAM_IFE_CSID_TOP_IRQ_STATUS_REG0; i < csid_reg->num_top_regs; i++) {
+		if (csid_reg->path_reg[res->res_id]->top_irq_mask[i]) {
+			top_index = i;
+			break;
+		}
+	}
+
+	if (top_index < 0 || top_index >= CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX) {
+		CAM_ERR(CAM_ISP, "csid[%d] %s Invalid top index %s index %d",
+			csid_hw->hw_intf->hw_idx, res->res_name, top_index);
+		return -EINVAL;
+	}
+
+	switch (res->res_id) {
+	case  CAM_IFE_PIX_PATH_RES_IPP:
+		irq_mask = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask;
+
+		val = csid_hw->debug_info.path_mask;
+
+		if (!(csid_reg->path_reg[res->res_id]->capabilities &
+			CAM_IFE_CSID_CAP_MULTI_CTXT)) {
+			if (path_cfg->sync_mode == CAM_ISP_HW_SYNC_NONE ||
+				path_cfg->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+				val |= path_reg->rup_irq_mask;
+				if (path_cfg->handle_camif_irq)
+					val |= path_reg->sof_irq_mask |
+					path_reg->epoch0_irq_mask |
+					path_reg->eof_irq_mask;
+			}
+		}
+		CAM_INFO(CAM_ISP, "val :%d irq_mask:%d", val, irq_mask);
+		break;
+	case  CAM_IFE_PIX_PATH_RES_PPP:
+		val = csid_hw->debug_info.path_mask;
+		irq_mask = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask;
+		CAM_INFO(CAM_ISP, "val :%d irq_mask:%d", val, irq_mask);
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+	case CAM_IFE_PIX_PATH_RES_RDI_4:
+	case CAM_IFE_PIX_PATH_RES_RDI_5:
+		val = csid_hw->debug_info.path_mask;
+
+		if (res->is_rdi_primary_res) {
+			val |= path_reg->rup_irq_mask;
+			if (path_cfg->handle_camif_irq)
+				val |= path_reg->sof_irq_mask | path_reg->eof_irq_mask;
+		}
+
+		/* Enable secondary events dictated by HW mgr for RDI paths */
+		if (path_cfg->sec_evt_config.en_secondary_evt) {
+			if (path_cfg->sec_evt_config.evt_type & CAM_IFE_CSID_EVT_SOF)
+				val |= path_reg->sof_irq_mask;
+
+			if (path_cfg->sec_evt_config.evt_type & CAM_IFE_CSID_EVT_EPOCH)
+				val |= path_reg->epoch0_irq_mask;
+
+			CAM_DBG(CAM_ISP,
+				"CSID:%u Enable camif: %d evt irq for res: %s",
+				csid_hw->hw_intf->hw_idx, path_cfg->sec_evt_config.evt_type,
+				res->res_name);
+		}
+
+		irq_mask = path_reg->fatal_err_mask | path_reg->non_fatal_err_mask;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type %d",
+			csid_hw->hw_intf->hw_idx, res->res_type);
+		break;
+	}
+
+	if (!res->is_per_port_acquire && !path_cfg->irq_handle && !res->is_per_port_start) {
+		rc = cam_ife_csid_ver2_path_irq_subscribe(csid_hw, res, val, irq_mask);
+		if (rc)
+			return rc;
+	} else {
+		if (path_cfg->irq_handle) {
+			rc = cam_irq_controller_update_irq(
+				csid_hw->path_irq_controller[res->res_id],
+				path_cfg->irq_handle,
+				enable,
+				&val);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "CSID[%d] Update Irq fail %d",
+					csid_hw->hw_intf->hw_idx, res->res_id);
+				rc = -EINVAL;
+				goto end;
+			}
+		} else {
+			CAM_ERR(CAM_ISP, "CSID[%d] path Irq handle not found for res:%d",
+				csid_hw->hw_intf->hw_idx, res->res_id);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (path_cfg->err_irq_handle) {
+			rc = cam_irq_controller_update_irq(
+				csid_hw->path_irq_controller[res->res_id],
+				path_cfg->err_irq_handle,
+					enable,
+				&irq_mask);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "CSID[%d] Update Err Irq fail %d",
+						csid_hw->hw_intf->hw_idx, res->res_id);
+					rc = -EINVAL;
+					goto end;
+			}
+		} else {
+			CAM_ERR(CAM_ISP, "CSID[%d] err irq handle not found for res:%d",
+					csid_hw->hw_intf->hw_idx, res->res_id);
+				rc = -EINVAL;
+				goto end;
+			}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ife_csid_ver2_update_irq_mask(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	void *res_irq_mask)
+{
+	struct cam_isp_resource_node          *res;
+	struct cam_csid_res_irq_info          *irq_args;
+	int                                    rc = 0, i;
+
+	if (!csid_hw || !res_irq_mask) {
+		CAM_ERR(CAM_ISP, "CSID Invalid params");
+		return  -EINVAL;
+	}
+
+	irq_args = (struct cam_csid_res_irq_info *)res_irq_mask;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+
+	for (i = 0; i < irq_args->num_res; i++) {
+		res = irq_args->node_res[i];
+		CAM_DBG(CAM_ISP, "CSID:%d res_type :%d res[id:%d name:%s]",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id, res->res_name);
+
+		if (res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid res tpe:%d res id:%d",
+				csid_hw->hw_intf->hw_idx, res->res_type,
+				res->res_id);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		rc = cam_ife_csid_ver2_update_path_irq(csid_hw, res, irq_args->enable_irq);
+		if (rc)
+			goto end;
+	}
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_init_config_update(
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_init_config_update *init_cfg = cmd_args;
+	struct cam_isp_resource_node *res = init_cfg->node_res;
+	struct cam_ife_csid_ver2_path_cfg *path_cfg = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_init_config_update)) {
+		CAM_ERR(CAM_ISP, "Invalid args size expected: %zu actual: %zu",
+			sizeof(struct cam_isp_hw_init_config_update),
+			arg_size);
+		return -EINVAL;
+	}
+
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+	/* Skip epoch update if resource does not handle camif IRQs */
+	if (!path_cfg->handle_camif_irq)
+		goto end;
+
+	path_cfg->epoch_cfg = (path_cfg->end_line - path_cfg->start_line) *
+		init_cfg->init_config->epoch_cfg.epoch_factor / 100;
+
+	if (path_cfg->epoch_cfg > path_cfg->end_line)
+		path_cfg->epoch_cfg = path_cfg->end_line;
+
+	if (path_cfg->horizontal_bin || path_cfg->qcfa_bin)
+		path_cfg->epoch_cfg >>= 1;
+
+	CAM_DBG(CAM_ISP,
+		"Init Update for res_name: %s epoch_factor: %x",
+		res->res_name, path_cfg->epoch_cfg);
+end:
+	return 0;
+}
+
+static int cam_ife_csid_ver2_dump_irq_desc(
+	struct cam_ife_csid_ver2_hw  *csid_hw, void *args)
+{
+	int                                     i, offset = 0;
+	struct cam_isp_irq_inject_param         *inject_params = NULL;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg = NULL;
+
+	if (!args) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	inject_params = (struct cam_isp_irq_inject_param *)args;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	offset += scnprintf(inject_params->line_buf + offset,
+		LINE_BUFFER_LEN - offset,
+		"Printing executable IRQ for hw_type: CSID reg_unit: %d\n",
+		inject_params->reg_unit);
+
+	switch (inject_params->reg_unit) {
+	case CAM_ISP_CSID_TOP_REG:
+		for (i = 0; i < csid_reg->num_top_err_irqs[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]; i++) {
+			if (!(*csid_reg->top_irq_desc)
+					[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i].bitmask)
+				break;
+
+			offset += scnprintf(inject_params->line_buf + offset,
+				LINE_BUFFER_LEN - offset, "%#12x : %s - %s\n",
+				(*csid_reg->top_irq_desc)
+					[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i].bitmask,
+				(*csid_reg->top_irq_desc)
+					[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i].err_name,
+				(*csid_reg->top_irq_desc)
+					[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0][i].desc);
+		}
+		break;
+	case CAM_ISP_CSID_RX_REG:
+		for (i = 0; i < csid_reg->num_rx_err_irqs[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]; i++) {
+			if (!(*csid_reg->rx_irq_desc)
+					[CAM_IFE_CSID_RX_IRQ_STATUS_REG0][i].bitmask)
+				break;
+
+			offset += scnprintf(inject_params->line_buf + offset,
+				LINE_BUFFER_LEN - offset, "%#12x : %s\n",
+				(*csid_reg->rx_irq_desc)
+					[CAM_IFE_CSID_RX_IRQ_STATUS_REG0][i].bitmask,
+				(*csid_reg->rx_irq_desc)
+					[CAM_IFE_CSID_RX_IRQ_STATUS_REG0][i].desc);
+		}
+		break;
+	case CAM_ISP_CSID_PATH_IPP_REG:
+	case CAM_ISP_CSID_PATH_PPP_REG:
+	case CAM_ISP_CSID_PATH_RDI0_REG:
+	case CAM_ISP_CSID_PATH_RDI1_REG:
+	case CAM_ISP_CSID_PATH_RDI2_REG:
+	case CAM_ISP_CSID_PATH_RDI3_REG:
+	case CAM_ISP_CSID_PATH_RDI4_REG:
+		for (i = 0; i < csid_reg->num_path_err_irqs; i++)
+			offset += scnprintf(inject_params->line_buf + offset,
+				LINE_BUFFER_LEN - offset, "%#12x : %s\n",
+				csid_reg->path_irq_desc[i].bitmask,
+				csid_reg->path_irq_desc[i].desc);
+		break;
+	default:
+		scnprintf(inject_params->line_buf + offset,
+			LINE_BUFFER_LEN - offset,
+			"No matched reg unit for injection\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_irq_inject(
+	struct cam_ife_csid_ver2_hw  *csid_hw, void *args)
+{
+	uint32_t                                irq_set_addr = 0;
+	struct cam_hw_soc_info                  *soc_info;
+	struct cam_isp_irq_inject_param         *inject_params = NULL;
+	const struct cam_ife_csid_ver2_reg_info *csid_reg = NULL;
+	void __iomem *mem_base;
+
+	if (!args) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	inject_params = (struct cam_isp_irq_inject_param *)args;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	switch (inject_params->reg_unit) {
+	case CAM_ISP_CSID_TOP_REG: {
+		irq_set_addr =
+			csid_reg->cmn_reg->top_irq_set_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0];
+		break;
+	}
+	case CAM_ISP_CSID_RX_REG: {
+		irq_set_addr =
+			csid_reg->csi2_reg->irq_set_addr[CAM_IFE_CSID_RX_IRQ_STATUS_REG0];
+		break;
+	}
+	case CAM_ISP_CSID_PATH_IPP_REG: {
+		irq_set_addr =
+			csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_IPP]->irq_set_addr;
+		break;
+	}
+	case CAM_ISP_CSID_PATH_PPP_REG: {
+		irq_set_addr =
+			csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_PPP]->irq_set_addr;
+		break;
+	}
+	case CAM_ISP_CSID_PATH_RDI0_REG: {
+		irq_set_addr =
+			csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_RDI_0]->irq_set_addr;
+		break;
+	}
+	case CAM_ISP_CSID_PATH_RDI1_REG: {
+		irq_set_addr =
+			csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_RDI_1]->irq_set_addr;
+		break;
+	}
+	case CAM_ISP_CSID_PATH_RDI2_REG: {
+		irq_set_addr =
+			csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_RDI_2]->irq_set_addr;
+		break;
+	}
+	case CAM_ISP_CSID_PATH_RDI3_REG: {
+		irq_set_addr =
+			csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_RDI_3]->irq_set_addr;
+		break;
+	}
+	case CAM_ISP_CSID_PATH_RDI4_REG: {
+		irq_set_addr =
+			csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_RDI_4]->irq_set_addr;
+		break;
+	}
+	case CAM_ISP_CSID_PATH_RDI5_REG: {
+		irq_set_addr =
+			csid_reg->path_reg[CAM_IFE_PIX_PATH_RES_RDI_5]->irq_set_addr;
+		break;
+	}
+	default:
+		CAM_INFO(CAM_ISP, "No matched reg unit for injection");
+		return -EINVAL;
+	}
+
+	cam_io_w_mb(inject_params->irq_mask, mem_base + irq_set_addr);
+	cam_io_w_mb(0x10, mem_base + csid_reg->cmn_reg->irq_cmd_addr);
+	CAM_INFO(CAM_ISP, "Injected : irq_mask %#x set_reg_offset %#x",
+		inject_params->irq_mask, irq_set_addr);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_reset_out_of_sync_cnt(
+	struct cam_ife_csid_ver2_hw  *csid_hw, void *args)
+{
+	struct cam_ife_csid_ver2_path_cfg  *path_cfg = NULL;
+	struct cam_isp_resource_node       *res = NULL;
+
+	res = ((struct cam_csid_reset_out_of_sync_count_args *)args)->node_res;
+	path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
+
+	if (!path_cfg) {
+		CAM_ERR(CAM_ISP, "Invalid res %s", res->res_name);
+		return -EINVAL;
+	}
+
+	atomic_set(&path_cfg->switch_out_of_sync_cnt, 0);
+
+	CAM_DBG(CAM_ISP,
+		"Reset out of sync cnt for res:%s",
+		res->res_name);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_drv_config(
+	struct cam_ife_csid_ver2_hw  *csid_hw, void *cmd_args)
+{
+	struct cam_hw_soc_info *soc_info;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_ife_csid_drv_config_args *drv_config;
+	uint32_t cfg0_val = 0, cfg1_val = 0;
+	void __iomem *mem_base;
+	int i;
+
+	if (!csid_hw || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	drv_config = (struct cam_ife_csid_drv_config_args *) cmd_args;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *) csid_hw->core_info->csid_reg;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	cfg0_val = drv_config->drv_en << csid_reg->cmn_reg->drv_en_shift;
+
+	/* Configure DRV RUP EN for init request, one time */
+	if (drv_config->is_init_config) {
+		if (csid_hw->path_res[CAM_IFE_PIX_PATH_RES_IPP].res_state >=
+			CAM_ISP_RESOURCE_STATE_RESERVED) {
+			cfg1_val = csid_reg->cmn_reg->drv_rup_en_val_map[CAM_IFE_PIX_PATH_RES_IPP];
+		} else if (csid_hw->path_res[CAM_IFE_PIX_PATH_RES_RDI_0].res_state >=
+			CAM_ISP_RESOURCE_STATE_RESERVED) {
+			cfg1_val =
+				csid_reg->cmn_reg->drv_rup_en_val_map[CAM_IFE_PIX_PATH_RES_RDI_0];
+		} else if (csid_hw->path_res[CAM_IFE_PIX_PATH_RES_PPP].res_state >=
+			CAM_ISP_RESOURCE_STATE_RESERVED) {
+			cfg1_val = csid_reg->cmn_reg->drv_rup_en_val_map[CAM_IFE_PIX_PATH_RES_PPP];
+		} else {
+			CAM_ERR(CAM_ISP, "CSID:%u Failed to configure rup_en for drv",
+				csid_hw->hw_intf->hw_idx);
+			return -EINVAL;
+		}
+
+		cam_io_w_mb(cfg1_val, mem_base + csid_reg->cmn_reg->drv_cfg1_addr);
+		csid_hw->drv_init_done = true;
+	}
+
+	if (!csid_hw->drv_init_done) {
+		CAM_ERR(CAM_ISP, "CSID:%u Failed to update drv config, init config not done",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_ISP_MAX_PATHS; i++)
+		cfg0_val |= ((drv_config->path_idle_en & BIT(i)) ?
+			csid_reg->cmn_reg->drv_path_idle_en_val_map[i] : 0);
+
+	cam_io_w_mb(cfg0_val, mem_base + csid_reg->cmn_reg->drv_cfg0_addr);
+
+	cam_io_w_mb(drv_config->timeout_val, mem_base + csid_reg->cmn_reg->drv_cfg2_addr);
+
+	if (debug_drv)
+		CAM_INFO(CAM_ISP,
+			"CSID[%u] sfe_en:%s DRV config init_req:%s cfg0_val:0x%x cfg1_val:0x%x cfg2_val:0x%x",
+			csid_hw->hw_intf->hw_idx, CAM_BOOL_TO_YESNO(csid_hw->flags.sfe_en),
+			CAM_BOOL_TO_YESNO(drv_config->is_init_config), cfg0_val, cfg1_val,
+			drv_config->timeout_val);
+
+	CAM_DBG(CAM_ISP,
+		"CSID[%u] sfe_en:%s DRV config init_req:%s cfg0_val:0x%x cfg1_val:0x%x cfg2_val:0x%x",
+		csid_hw->hw_intf->hw_idx, CAM_BOOL_TO_YESNO(csid_hw->flags.sfe_en),
+		CAM_BOOL_TO_YESNO(drv_config->is_init_config), cfg0_val, cfg1_val,
+		drv_config->timeout_val);
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_irq_comp_cfg(
+	struct cam_ife_csid_ver2_hw *csid_hw, void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                                    comp_cfg_mask = 0;
+	size_t                                      size = 0;
+	struct cam_isp_irq_comp_cfg                *comp_cfg;
+	const struct cam_ife_csid_ver2_mc_reg_info *reg_info = NULL;
+	struct cam_cdm_utils_ops                   *cdm_util_ops;
+	struct cam_isp_hw_get_cmd_update           *cdm_args = NULL;
+	uint32_t                                    reg_val_pair[2];
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "CSID %u Invalid args size expected: %zu actual: %zu",
+			csid_hw->hw_intf->hw_idx, sizeof(struct cam_isp_hw_get_cmd_update),
+			arg_size);
+		return -EINVAL;
+	}
+
+	cdm_args = (struct cam_isp_hw_get_cmd_update *)cmd_args;
+	if (!cdm_args) {
+		CAM_ERR(CAM_ISP, "CSID:%u Error, Invalid args", csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	comp_cfg = (struct cam_isp_irq_comp_cfg *)cdm_args->data;
+
+	reg_info = ((struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg)->ipp_mc_reg;
+
+	comp_cfg_mask = (comp_cfg->ipp_src_ctxt_mask << reg_info->ipp_src_ctxt_mask_shift) |
+		(comp_cfg->ipp_dst_comp_mask << reg_info->ipp_dst_ctxt_mask_shift);
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "CSID:%u buf size:%d is not sufficient, expected: %d",
+			csid_hw->hw_intf->hw_idx, cdm_args->cmd.size, (size*4));
+		return -EINVAL;
+	}
+
+	reg_val_pair[0] = reg_info->irq_comp_cfg0_addr;
+	reg_val_pair[1] = comp_cfg_mask;
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_get_primary_sof_timer_reg_addr(
+	struct cam_ife_csid_ver2_hw *csid_hw,
+	struct cam_ife_csid_ts_reg_addr *sof_addr)
+{
+	struct cam_hw_soc_info                       *soc_info;
+	struct cam_isp_resource_node                 *csid_res;
+	struct cam_ife_csid_ver2_reg_info            *csid_reg;
+	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
+
+	if (!csid_hw || sof_addr->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid params, csid_hw is null: %s, , res_id: %u",
+			CAM_IS_NULL_TO_STR(csid_hw), sof_addr->res_id);
+		return -EINVAL;
+	}
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	csid_res = &csid_hw->path_res[sof_addr->res_id];
+	path_reg = csid_reg->path_reg[sof_addr->res_id];
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	sof_addr->curr0_ts_addr = soc_info->reg_map[0].mem_base +
+		path_reg->timestamp_curr0_sof_addr;
+	sof_addr->curr1_ts_addr = soc_info->reg_map[0].mem_base +
+		path_reg->timestamp_curr1_sof_addr;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_process_cmd(void *hw_priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_ver2_hw          *csid_hw;
+	struct cam_hw_info                   *hw_info;
+	struct cam_isp_resource_node         *res = NULL;
+
+	if (!hw_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid arguments");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_info->core_info;
+
+	switch (cmd_type) {
+	case CAM_IFE_CSID_CMD_GET_TIME_STAMP:
+		rc = cam_ife_csid_ver2_get_time_stamp(csid_hw, cmd_args);
+
+		if (csid_hw->debug_info.debug_val &
+				CAM_IFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+			res = ((struct cam_csid_get_time_stamp_args *)
+				cmd_args)->node_res;
+			cam_ife_csid_ver2_print_hbi_vbi(csid_hw, res);
+		}
+		break;
+	case CAM_IFE_CSID_SET_CSID_DEBUG:
+		rc = cam_ife_csid_ver2_set_debug(csid_hw,
+			(struct cam_ife_csid_debug_cfg_args *)cmd_args);
+		break;
+	case CAM_IFE_CSID_SOF_IRQ_DEBUG:
+		rc = cam_ife_csid_ver2_sof_irq_debug(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE:
+		rc = cam_ife_csid_ver2_set_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_HW:
+		break;
+	case CAM_IFE_CSID_TOP_CONFIG:
+		rc = cam_ife_csid_ver2_top_cfg(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_ife_csid_get_base(&hw_info->soc_info,
+			CAM_IFE_CSID_CLC_MEM_BASE_ID,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_ife_csid_ver2_reg_update(csid_hw,
+			cmd_args, arg_size);
+		break;
+	case CAM_IFE_CSID_SET_DUAL_SYNC_CONFIG:
+		rc = cam_ife_csid_ver2_dual_sync_cfg(csid_hw,
+			cmd_args);
+		break;
+	case CAM_ISP_HW_CSID_MINI_DUMP:
+		rc  = cam_ife_csid_ver2_mini_dump(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_USER_DUMP:
+		rc = cam_ife_csid_ver2_user_dump(csid_hw, cmd_args);
+		break;
+	case CAM_IFE_CSID_PROGRAM_OFFLINE_CMD:
+		rc = cam_ife_csid_ver2_program_offline_go_cmd(
+			csid_hw, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CSID_DYNAMIC_SWITCH_UPDATE:
+		rc = cam_ife_csid_ver2_set_dynamic_switch_config(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE:
+		break;
+	case CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA: {
+		struct cam_hw_soc_info *soc_info;
+
+		soc_info = &csid_hw->hw_info->soc_info;
+		*((struct cam_hw_soc_info **)cmd_args) = soc_info;
+		break;
+	}
+	case CAM_ISP_HW_CMD_CSID_DISCARD_INIT_FRAMES:
+		rc = cam_ife_csid_ver2_set_discard_frame_cfg(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_RDI_LCR_CFG:
+		rc = cam_ife_csid_ver2_rdi_lcr_cfg(csid_hw, cmd_args);
+		break;
+	case CAM_IFE_CSID_LOG_ACQUIRE_DATA:
+		/* Not supported on ver2 */
+		rc = 0;
+		break;
+	case CAM_ISP_HW_CMD_INIT_CONFIG_UPDATE:
+		rc = cam_ife_csid_init_config_update(cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DRV_CONFIG:
+		rc = cam_ife_csid_ver2_drv_config(csid_hw, cmd_args);
+		break;
+	case CAM_IFE_CSID_RESET_OUT_OF_SYNC_CNT:
+		rc = cam_ife_csid_ver2_reset_out_of_sync_cnt(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_DUMP_CROP_REG:
+		rc = cam_ife_csid_ver2_dump_crop_reg(hw_info, (uint32_t *)cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_IRQ_COMP_CFG:
+		rc = cam_ife_csid_ver2_irq_comp_cfg(csid_hw, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_IRQ_INJECTION:
+		rc = cam_ife_csid_ver2_irq_inject(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION:
+		rc = cam_ife_csid_ver2_dump_irq_desc(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_GET_SET_PRIM_SOF_TS_ADDR: {
+		struct cam_ife_csid_ts_reg_addr  *sof_addr_args =
+			(struct cam_ife_csid_ts_reg_addr *)cmd_args;
+
+		if (!sof_addr_args->get_addr) {
+			CAM_ERR(CAM_ISP, "CSID does not support set of primary SOF ts addr");
+			rc = -EINVAL;
+		} else
+			rc = cam_ife_csid_ver2_get_primary_sof_timer_reg_addr(csid_hw,
+				sof_addr_args);
+	}
+		break;
+	case CAM_ISP_HW_CMD_UPDATE_CSID_RES_DATA:
+		rc = cam_ife_csid_ver2_update_res_data(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_UPDATE_CSID_RES_IRQ_MASK:
+		rc = cam_ife_csid_ver2_update_irq_mask(csid_hw, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%u unsupported cmd:%d",
+			csid_hw->hw_intf->hw_idx, cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+
+}
+
+static irqreturn_t cam_ife_csid_irq(int irq_num, void *data)
+{
+	struct cam_ife_csid_ver2_hw *csid_hw = data;
+
+	if (!csid_hw)
+		return IRQ_NONE;
+
+	return cam_irq_controller_handle_irq(irq_num,
+		csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		CAM_IRQ_EVT_GROUP_0);
+}
+
+static void cam_ife_csid_ver2_free_res(struct cam_ife_csid_ver2_hw *csid_hw)
+{
+
+	struct cam_isp_resource_node *res;
+	uint32_t num_paths;
+	int i;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+	num_paths = csid_reg->cmn_reg->num_udis;
+
+	for (i = 0; i < num_paths; i++) {
+		res = &csid_hw->path_res[CAM_IFE_PIX_PATH_RES_UDI_0 + i];
+		kfree(res->res_priv);
+		res->res_priv = NULL;
+	}
+
+	num_paths = csid_reg->cmn_reg->num_rdis;
+
+	for (i = 0; i < num_paths; i++) {
+		res = &csid_hw->path_res[CAM_IFE_PIX_PATH_RES_RDI_0 + i];
+		kfree(res->res_priv);
+		res->res_priv = NULL;
+	}
+
+	kfree(csid_hw->path_res[CAM_IFE_PIX_PATH_RES_IPP].res_priv);
+	csid_hw->path_res[CAM_IFE_PIX_PATH_RES_IPP].res_priv = NULL;
+	kfree(csid_hw->path_res[CAM_IFE_PIX_PATH_RES_PPP].res_priv);
+	csid_hw->path_res[CAM_IFE_PIX_PATH_RES_PPP].res_priv = NULL;
+}
+
+static int cam_ife_ver2_hw_alloc_res(
+	struct cam_isp_resource_node *res,
+	uint32_t res_type,
+	struct cam_hw_intf   *hw_intf,
+	uint32_t res_id)
+
+{
+	struct cam_ife_csid_ver2_path_cfg *path_cfg = NULL;
+
+	path_cfg = kzalloc(sizeof(*path_cfg), GFP_KERNEL);
+
+	if (!path_cfg)
+		return -ENOMEM;
+
+	res->res_id = res_id;
+	res->res_type = res_type;
+	res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	res->hw_intf = hw_intf;
+	res->res_priv = path_cfg;
+
+	return 0;
+}
+
+static int cam_ife_csid_ver2_hw_init_path_res(
+	struct cam_ife_csid_ver2_hw   *csid_hw)
+{
+	int rc = 0;
+	int i;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	struct cam_isp_resource_node *res;
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	/* Initialize the IPP resources */
+	if (csid_reg->cmn_reg->num_pix) {
+		res = &csid_hw->path_res[CAM_IFE_PIX_PATH_RES_IPP];
+		rc = cam_ife_ver2_hw_alloc_res(
+			res,
+			CAM_ISP_RESOURCE_PIX_PATH,
+			csid_hw->hw_intf,
+			CAM_IFE_PIX_PATH_RES_IPP);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID: %u IPP res init fail",
+				csid_hw->hw_intf->hw_idx);
+			goto free_res;
+		}
+		scnprintf(csid_hw->path_res[CAM_IFE_PIX_PATH_RES_IPP].res_name,
+			CAM_ISP_RES_NAME_LEN, "IPP");
+	}
+
+	/* Initialize PPP resource */
+	if (csid_reg->cmn_reg->num_ppp) {
+		res = &csid_hw->path_res[CAM_IFE_PIX_PATH_RES_PPP];
+		rc = cam_ife_ver2_hw_alloc_res(
+			res,
+			CAM_ISP_RESOURCE_PIX_PATH,
+			csid_hw->hw_intf,
+			CAM_IFE_PIX_PATH_RES_PPP);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID: %u PPP res init fail",
+				csid_hw->hw_intf->hw_idx);
+			goto free_res;
+		}
+		scnprintf(csid_hw->path_res[CAM_IFE_PIX_PATH_RES_PPP].res_name,
+			CAM_ISP_RES_NAME_LEN, "PPP");
+	}
+
+	/* Initialize the RDI resource */
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		/* res type is from RDI 0 to RDI3 */
+		res = &csid_hw->path_res[CAM_IFE_PIX_PATH_RES_RDI_0 + i];
+		rc = cam_ife_ver2_hw_alloc_res(
+			res,
+			CAM_ISP_RESOURCE_PIX_PATH,
+			csid_hw->hw_intf,
+			CAM_IFE_PIX_PATH_RES_RDI_0 + i);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID: %u RDI[%d] res init fail",
+				csid_hw->hw_intf->hw_idx, i);
+			goto free_res;
+		}
+		scnprintf(res->res_name, CAM_ISP_RES_NAME_LEN, "RDI_%d", i);
+	}
+
+	/* Initialize the UDI resource */
+	for (i = 0; i < csid_reg->cmn_reg->num_udis; i++) {
+		/* res type is from UDI0 to UDI3 */
+		res = &csid_hw->path_res[CAM_IFE_PIX_PATH_RES_UDI_0 + i];
+		rc = cam_ife_ver2_hw_alloc_res(
+			res,
+			CAM_ISP_RESOURCE_PIX_PATH,
+			csid_hw->hw_intf,
+			CAM_IFE_PIX_PATH_RES_UDI_0 + i);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID: %u UDI[%d] res init fail",
+				csid_hw->hw_intf->hw_idx, i);
+			goto free_res;
+		}
+		scnprintf(res->res_name, CAM_ISP_RES_NAME_LEN, "UDI_%d", i);
+	}
+
+	return rc;
+
+free_res:
+	cam_ife_csid_ver2_free_res(csid_hw);
+	return rc;
+}
+
+static void cam_ife_csid_hw_deinit_irq(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	unsigned long flags;
+	int i;
+
+	cam_irq_controller_deinit(&csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+	cam_irq_controller_deinit(&csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+	cam_irq_controller_deinit(&csid_hw->buf_done_irq_controller);
+
+	for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+		if (csid_hw->path_irq_controller[i])
+			cam_irq_controller_deinit(&csid_hw->path_irq_controller[i]);
+	}
+
+	spin_lock_irqsave(&csid_hw->path_payload_lock, flags);
+	INIT_LIST_HEAD(&csid_hw->path_free_payload_list);
+	for (i = 0; i < CAM_IFE_CSID_VER2_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&csid_hw->path_evt_payload[i].list);
+	spin_unlock_irqrestore(&csid_hw->path_payload_lock, flags);
+
+	spin_lock_irqsave(&csid_hw->rx_payload_lock, flags);
+	INIT_LIST_HEAD(&csid_hw->rx_free_payload_list);
+	for (i = 0; i < CAM_IFE_CSID_VER2_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&csid_hw->rx_evt_payload[i].list);
+	spin_unlock_irqrestore(&csid_hw->rx_payload_lock, flags);
+}
+
+static int cam_ife_csid_hw_init_irq(
+	struct cam_ife_csid_ver2_hw *csid_hw)
+{
+	int                                rc = 0;
+	int                                i;
+	struct cam_hw_soc_info            *soc_info;
+	void __iomem                      *mem_base;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+	char                               name[CAM_CSID_IRQ_CTRL_NAME_LEN];
+
+	csid_reg = (struct cam_ife_csid_ver2_reg_info *)
+			csid_hw->core_info->csid_reg;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	mem_base = soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+
+	snprintf(name, CAM_CSID_IRQ_CTRL_NAME_LEN, "csid%d_top", csid_hw->hw_intf->hw_idx);
+	rc = cam_irq_controller_init(name, mem_base,
+		&csid_reg->top_irq_reg_info[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		&csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0]);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%u Failed to init CSID top irq controller rc = %d",
+			csid_hw->hw_intf->hw_idx, rc);
+		return rc;
+	}
+
+	snprintf(name, CAM_CSID_IRQ_CTRL_NAME_LEN, "csid%d_rx", csid_hw->hw_intf->hw_idx);
+	rc = cam_irq_controller_init(name, mem_base,
+		&csid_reg->rx_irq_reg_info[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		&csid_hw->rx_irq_controller[CAM_IFE_CSID_RX_IRQ_STATUS_REG0]);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%u Failed to init CSID rx irq controller rc = %d",
+			csid_hw->hw_intf->hw_idx, rc);
+		goto deinit_controller;
+	}
+
+	snprintf(name, CAM_CSID_IRQ_CTRL_NAME_LEN, "csid%d_buf_done", csid_hw->hw_intf->hw_idx);
+	rc = cam_irq_controller_init(name, mem_base, csid_reg->buf_done_irq_reg_info,
+		&csid_hw->buf_done_irq_controller);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%u Failed to init CSID buf_done irq controller rc = %d",
+			csid_hw->hw_intf->hw_idx, rc);
+		goto deinit_controller;
+	}
+
+	if (csid_reg->cmn_reg->num_pix) {
+		snprintf(name, CAM_CSID_IRQ_CTRL_NAME_LEN, "csid%d_ipp", csid_hw->hw_intf->hw_idx);
+		rc = cam_irq_controller_init(name, mem_base,
+			csid_reg->path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+			&csid_hw->path_irq_controller[CAM_IFE_PIX_PATH_RES_IPP]);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "CSID:%u Failed to init CSID ipp irq controller rc = %d",
+				csid_hw->hw_intf->hw_idx, rc);
+			goto deinit_controller;
+		}
+	}
+
+	if (csid_reg->cmn_reg->num_ppp) {
+		snprintf(name, CAM_CSID_IRQ_CTRL_NAME_LEN, "csid%d_ppp", csid_hw->hw_intf->hw_idx);
+		rc = cam_irq_controller_init(name, mem_base,
+			csid_reg->path_irq_reg_info[CAM_IFE_PIX_PATH_RES_PPP],
+			&csid_hw->path_irq_controller[CAM_IFE_PIX_PATH_RES_PPP]);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%u Failed to init CSID ppp irq controller rc = %d",
+				csid_hw->hw_intf->hw_idx, rc);
+			goto deinit_controller;
+		}
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		snprintf(name, CAM_CSID_IRQ_CTRL_NAME_LEN, "csid%d_rdi%d",
+			csid_hw->hw_intf->hw_idx, i);
+		rc = cam_irq_controller_init(name, mem_base,
+			csid_reg->path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0 + i],
+			&csid_hw->path_irq_controller[CAM_IFE_PIX_PATH_RES_RDI_0 + i]);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%u Failed to init CSID rdi%d irq controller rc = %d",
+				csid_hw->hw_intf->hw_idx, i, rc);
+			goto deinit_controller;
+		}
+	}
+
+	spin_lock_init(&csid_hw->path_payload_lock);
+	INIT_LIST_HEAD(&csid_hw->path_free_payload_list);
+	for (i = 0; i < CAM_IFE_CSID_VER2_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&csid_hw->path_evt_payload[i].list);
+		list_add_tail(&csid_hw->path_evt_payload[i].list,
+			&csid_hw->path_free_payload_list);
+	}
+	spin_lock_init(&csid_hw->rx_payload_lock);
+	INIT_LIST_HEAD(&csid_hw->rx_free_payload_list);
+	for (i = 0; i < CAM_IFE_CSID_VER2_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&csid_hw->rx_evt_payload[i].list);
+		list_add_tail(&csid_hw->rx_evt_payload[i].list,
+			&csid_hw->rx_free_payload_list);
+	}
+
+	return 0;
+
+deinit_controller:
+	cam_ife_csid_hw_deinit_irq(csid_hw);
+	return rc;
+}
+
+int cam_ife_csid_ver2_irq_line_test(void *hw_priv)
+{
+	struct cam_ife_csid_ver2_hw *csid_hw;
+	struct cam_hw_soc_info *soc_info;
+	int rc = 0;
+	void __iomem *mem_base;
+	struct cam_ife_csid_ver2_reg_info *csid_reg;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw = ((struct cam_hw_info *)hw_priv)->core_info;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	mem_base = csid_hw->hw_info->soc_info.reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
+	csid_reg = csid_hw->core_info->csid_reg;
+	rc = cam_ife_csid_enable_soc_resources(soc_info, soc_info->lowest_clk_level);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Enable soc failed", csid_hw->hw_intf->hw_idx);
+		return rc;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID[%u] hw-version:0x%x",
+		csid_hw->hw_intf->hw_idx,
+		cam_io_r_mb(mem_base + csid_reg->cmn_reg->hw_version_addr));
+
+	rc = cam_irq_controller_test_irq_line(
+		csid_hw->top_irq_controller[CAM_IFE_CSID_TOP_IRQ_STATUS_REG0],
+		"CSID:%d", csid_hw->hw_intf->hw_idx);
+
+	cam_ife_csid_disable_soc_resources(soc_info);
+	return rc;
+}
+
+int cam_ife_csid_hw_ver2_init(struct cam_hw_intf *hw_intf,
+	struct cam_ife_csid_core_info *core_info,
+	bool is_custom)
+{
+	int rc = -EINVAL;
+	struct cam_hw_info                   *hw_info;
+	struct cam_ife_csid_ver2_hw          *csid_hw = NULL;
+	int i;
+
+	if (!hw_intf || !core_info) {
+		CAM_ERR(CAM_ISP, "Invalid parameters intf: %pK hw_info: %pK",
+			hw_intf, core_info);
+		return rc;
+	}
+
+	hw_info = (struct cam_hw_info  *)hw_intf->hw_priv;
+
+	csid_hw = kzalloc(sizeof(struct cam_ife_csid_ver2_hw), GFP_KERNEL);
+
+	if (!csid_hw) {
+		CAM_ERR(CAM_ISP, "Csid core %d hw allocation fails",
+			hw_intf->hw_idx);
+		return -ENOMEM;
+	}
+
+	hw_info->core_info = csid_hw;
+	csid_hw->hw_intf = hw_intf;
+	csid_hw->hw_info = hw_info;
+	csid_hw->core_info = core_info;
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		hw_intf->hw_type,
+		hw_intf->hw_idx);
+
+	csid_hw->flags.device_enabled = false;
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&csid_hw->hw_info->hw_mutex);
+	spin_lock_init(&csid_hw->hw_info->hw_lock);
+	spin_lock_init(&csid_hw->lock_state);
+	init_completion(&csid_hw->hw_info->hw_complete);
+	atomic_set(&csid_hw->discard_frame_per_path, 0);
+	atomic_set(&csid_hw->init_global_reset_cnt, 0);
+
+	rc = cam_ife_csid_init_soc_resources(&csid_hw->hw_info->soc_info,
+			cam_ife_csid_irq, cam_ife_csid_ver2_cpas_cb, csid_hw, is_custom);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%u Failed to init_soc",
+			hw_intf->hw_idx);
+		return rc;
+	}
+
+	if (cam_cpas_is_feature_supported(CAM_CPAS_QCFA_BINNING_ENABLE,
+		CAM_CPAS_HW_IDX_ANY, NULL))
+		csid_hw->flags.binning_enabled = true;
+
+	if (cam_cpas_query_domain_id_security_support())
+		csid_hw->flags.domain_id_security = true;
+
+	csid_hw->hw_intf->hw_ops.get_hw_caps   = cam_ife_csid_ver2_get_hw_caps;
+	csid_hw->hw_intf->hw_ops.init          = cam_ife_csid_ver2_init_hw;
+	csid_hw->hw_intf->hw_ops.deinit        = cam_ife_csid_ver2_deinit_hw;
+	csid_hw->hw_intf->hw_ops.reset         = cam_ife_csid_ver2_reset;
+	csid_hw->hw_intf->hw_ops.reserve       = cam_ife_csid_ver2_reserve;
+	csid_hw->hw_intf->hw_ops.release       = cam_ife_csid_ver2_release;
+	csid_hw->hw_intf->hw_ops.start         = cam_ife_csid_ver2_start;
+	csid_hw->hw_intf->hw_ops.stop          = cam_ife_csid_ver2_stop;
+	csid_hw->hw_intf->hw_ops.read          = cam_ife_csid_ver2_read;
+	csid_hw->hw_intf->hw_ops.write         = cam_ife_csid_ver2_write;
+	csid_hw->hw_intf->hw_ops.process_cmd   = cam_ife_csid_ver2_process_cmd;
+	csid_hw->hw_intf->hw_ops.test_irq_line = cam_ife_csid_ver2_irq_line_test;
+
+	for (i = 0; i < CAM_IFE_PIX_PATH_RES_MAX; i++) {
+		csid_hw->token_data[i].token = NULL;
+		csid_hw->token_data[i].res_id = -1;
+	}
+
+	rc = cam_ife_csid_hw_init_irq(csid_hw);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to init CSID irq");
+		return rc;
+	}
+
+	rc = cam_ife_csid_ver2_hw_init_path_res(csid_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Probe Init failed",
+			hw_intf->hw_idx);
+		return rc;
+	}
+	csid_hw->debug_info.debug_val = 0;
+	csid_hw->counters.error_irq_count = 0;
+
+	return 0;
+
+}
+EXPORT_SYMBOL(cam_ife_csid_hw_ver2_init);
+
+int cam_ife_csid_hw_ver2_deinit(struct cam_hw_info *hw_priv)
+{
+	struct cam_ife_csid_ver2_hw   *csid_hw;
+	int rc = -EINVAL;
+
+	csid_hw = (struct cam_ife_csid_ver2_hw *)hw_priv->core_info;
+
+	if (!csid_hw) {
+		CAM_ERR(CAM_ISP, "Invalid param");
+		return rc;
+	}
+
+	cam_ife_csid_hw_deinit_irq(csid_hw);
+
+	/* release the privdate data memory from resources */
+	cam_ife_csid_ver2_free_res(csid_hw);
+
+	cam_ife_csid_deinit_soc_resources(&csid_hw->hw_info->soc_info);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_ife_csid_hw_ver2_deinit);
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver2.h
@@ -0,0 +1,911 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_HW_VER2_H_
+#define _CAM_IFE_CSID_HW_VER2_H_
+
+#include "cam_hw.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_ife_csid_soc.h"
+#include "cam_ife_csid_common.h"
+
+#define IFE_CSID_VER2_TOP_INFO_VOTE_UP                BIT(16)
+#define IFE_CSID_VER2_TOP_INFO_VOTE_DN                BIT(17)
+#define IFE_CSID_VER2_TOP_ERR_NO_VOTE_DN              BIT(18)
+
+#define IFE_CSID_VER2_RX_DL0_EOT_CAPTURED             BIT(0)
+#define IFE_CSID_VER2_RX_DL1_EOT_CAPTURED             BIT(1)
+#define IFE_CSID_VER2_RX_DL2_EOT_CAPTURED             BIT(2)
+#define IFE_CSID_VER2_RX_DL3_EOT_CAPTURED             BIT(3)
+#define IFE_CSID_VER2_RX_DL0_SOT_CAPTURED             BIT(4)
+#define IFE_CSID_VER2_RX_DL1_SOT_CAPTURED             BIT(5)
+#define IFE_CSID_VER2_RX_DL2_SOT_CAPTURED             BIT(6)
+#define IFE_CSID_VER2_RX_DL3_SOT_CAPTURED             BIT(7)
+#define IFE_CSID_VER2_RX_LONG_PKT_CAPTURED            BIT(8)
+#define IFE_CSID_VER2_RX_SHORT_PKT_CAPTURED           BIT(9)
+#define IFE_CSID_VER2_RX_CPHY_PKT_HDR_CAPTURED        BIT(10)
+#define IFE_CSID_VER2_RX_CPHY_EOT_RECEPTION           BIT(11)
+#define IFE_CSID_VER2_RX_CPHY_SOT_RECEPTION           BIT(12)
+#define IFE_CSID_VER2_RX_ERROR_CPHY_PH_CRC            BIT(13)
+#define IFE_CSID_VER2_RX_WARNING_ECC                  BIT(14)
+#define IFE_CSID_VER2_RX_LANE0_FIFO_OVERFLOW          BIT(15)
+#define IFE_CSID_VER2_RX_LANE1_FIFO_OVERFLOW          BIT(16)
+#define IFE_CSID_VER2_RX_LANE2_FIFO_OVERFLOW          BIT(17)
+#define IFE_CSID_VER2_RX_LANE3_FIFO_OVERFLOW          BIT(18)
+#define IFE_CSID_VER2_RX_ERROR_CRC                    BIT(19)
+#define IFE_CSID_VER2_RX_ERROR_ECC                    BIT(20)
+#define IFE_CSID_VER2_RX_MMAPPED_VC_DT                BIT(21)
+#define IFE_CSID_VER2_RX_UNMAPPED_VC_DT               BIT(22)
+#define IFE_CSID_VER2_RX_STREAM_UNDERFLOW             BIT(23)
+#define IFE_CSID_VER2_RX_UNBOUNDED_FRAME              BIT(24)
+#define IFE_CSID_VER2_RX_RST_DONE                     BIT(27)
+
+#define CAM_IFE_CSID_VER2_PAYLOAD_MAX           256
+
+#define IFE_CSID_VER2_PATH_ERROR_ILLEGAL_PROGRAM                 BIT(0)
+#define IFE_CSID_VER2_PATH_ERROR_FIFO_OVERFLOW                   BIT(2)
+#define IFE_CSID_VER2_PATH_CAMIF_EOF                             BIT(3)
+#define IFE_CSID_VER2_PATH_CAMIF_SOF                             BIT(4)
+#define IFE_CSID_VER2_PATH_INFO_FRAME_DROP_EOF                   BIT(5)
+#define IFE_CSID_VER2_PATH_INFO_FRAME_DROP_EOL                   BIT(6)
+#define IFE_CSID_VER2_PATH_INFO_FRAME_DROP_SOL                   BIT(7)
+#define IFE_CSID_VER2_PATH_INFO_FRAME_DROP_SOF                   BIT(8)
+#define IFE_CSID_VER2_PATH_INFO_INPUT_EOF                        BIT(9)
+#define IFE_CSID_VER2_PATH_INFO_INPUT_EOL                        BIT(10)
+#define IFE_CSID_VER2_PATH_INFO_INPUT_SOL                        BIT(11)
+#define IFE_CSID_VER2_PATH_INFO_INPUT_SOF                        BIT(12)
+#define IFE_CSID_VER2_PATH_ERROR_PIX_COUNT                       BIT(13)
+#define IFE_CSID_VER2_PATH_ERROR_LINE_COUNT                      BIT(14)
+#define IFE_CSID_VER2_PATH_VCDT_GRP0_SEL                         BIT(15)
+#define IFE_CSID_VER2_PATH_VCDT_GRP1_SEL                         BIT(16)
+#define IFE_CSID_VER2_PATH_VCDT_GRP_CHANGE                       BIT(17)
+#define IFE_CSID_VER2_PATH_FRAME_DROP                            BIT(18)
+#define IFE_CSID_VER2_PATH_RECOVERY_OVERFLOW                     BIT(19)
+#define IFE_CSID_VER2_PATH_ERROR_REC_CCIF_VIOLATION              BIT(20)
+#define IFE_CSID_VER2_PATH_CAMIF_EPOCH0                          BIT(21)
+#define IFE_CSID_VER2_PATH_CAMIF_EPOCH1                          BIT(22)
+#define IFE_CSID_VER2_PATH_RUP_DONE                              BIT(23)
+#define IFE_CSID_VER2_PATH_ILLEGAL_BATCH_ID                      BIT(24)
+#define IFE_CSID_VER2_PATH_BATCH_END_MISSING_VIOLATION           BIT(25)
+#define IFE_CSID_VER2_PATH_HEIGHT_VIOLATION                      BIT(26)
+#define IFE_CSID_VER2_PATH_WIDTH_VIOLATION                       BIT(27)
+#define IFE_CSID_VER2_PATH_SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP  BIT(28)
+#define IFE_CSID_VER2_PATH_CCIF_VIOLATION                        BIT(29)
+
+/*Each Bit represents the index of cust node hw*/
+#define IFE_CSID_VER2_CUST_NODE_IDX_0                      0x1
+#define IFE_CSID_VER2_CUST_NODE_IDX_1                      0x2
+#define IFE_CSID_VER2_CUST_NODE_IDX_2                      0x4
+
+enum cam_ife_csid_ver2_input_core_sel {
+	CAM_IFE_CSID_INPUT_CORE_SEL_NONE,
+	CAM_IFE_CSID_INPUT_CORE_SEL_INTERNAL,
+	CAM_IFE_CSID_INPUT_CORE_SEL_SFE_0,
+	CAM_IFE_CSID_INPUT_CORE_SEL_SFE_1,
+	CAM_IFE_CSID_INPUT_CORE_SEL_SFE_2,
+	CAM_IFE_CSID_INPUT_CORE_SEL_CUST_NODE_0,
+	CAM_IFE_CSID_INPUT_CORE_SEL_CUST_NODE_1,
+	CAM_IFE_CSID_INPUT_CORE_SEL_CUST_NODE_2,
+	CAM_IFE_CSID_INPUT_CORE_SEL_MAX,
+};
+
+enum cam_ife_csid_ver2_csid_reset_loc {
+	CAM_IFE_CSID_RESET_LOC_PATH_ONLY,
+	CAM_IFE_CSID_RESET_LOC_COMPLETE,
+	CAM_IFE_CSID_RESET_LOC_MAX,
+};
+
+enum cam_ife_csid_ver2_csid_reset_cmd {
+	CAM_IFE_CSID_RESET_CMD_IRQ_CTRL,
+	CAM_IFE_CSID_RESET_CMD_SW_RST,
+	CAM_IFE_CSID_RESET_CMD_HW_RST,
+	CAM_IFE_CSID_RESET_CMD_HW_MAX,
+};
+
+struct cam_ife_csid_ver2_top_cfg {
+	uint32_t      input_core_type;
+	uint32_t      dual_sync_core_sel;
+	uint32_t      master_slave_sel;
+	uint32_t      rdi_lcr;
+	bool          dual_en;
+	bool          offline_sfe_en;
+	bool          out_ife_en;
+	bool          sfe_fs;
+};
+
+struct cam_ife_csid_ver2_evt_payload {
+	struct list_head            list;
+	uint32_t                    irq_reg_val;
+	struct timespec64           timestamp;
+	uint64_t                    sof_ts_reg_val;
+	bool                        is_mc;
+};
+
+/*
+ * struct cam_ife_csid_ver2_camif_data: place holder for camif parameters
+ *
+ * @epoch0_cfg:   Epoch 0 configuration value
+ * @epoch1_cfg:   Epoch 1 configuration value
+ */
+struct cam_ife_csid_ver2_camif_data {
+	uint32_t epoch0;
+	uint32_t epoch1;
+};
+
+struct cam_ife_csid_ver2_rx_cfg  {
+	uint32_t phy_sel;
+	uint32_t lane_type;
+	uint32_t lane_num;
+	uint32_t lane_cfg;
+	uint32_t tpg_mux_sel;
+	uint32_t tpg_num_sel;
+	uint32_t mup;
+	uint32_t epd_supported;
+	uint32_t top_irq_handle;
+	uint32_t rx2_irq_handle;
+	uint32_t irq_handle;
+	uint32_t err_irq_handle[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	bool     dynamic_sensor_switch_en;
+};
+
+struct cam_ife_csid_ver2_csi2_rx_reg_info {
+	uint32_t irq_status_addr[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	uint32_t irq_mask_addr[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	uint32_t irq_clear_addr[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	uint32_t irq_set_addr[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	uint32_t cfg0_addr;
+	uint32_t cfg1_addr;
+	uint32_t capture_ctrl_addr;
+	uint32_t rst_strobes_addr;
+	uint32_t de_scramble_cfg0_addr;
+	uint32_t de_scramble_cfg1_addr;
+	uint32_t cap_unmap_long_pkt_hdr_0_addr;
+	uint32_t cap_unmap_long_pkt_hdr_1_addr;
+	uint32_t captured_short_pkt_0_addr;
+	uint32_t captured_short_pkt_1_addr;
+	uint32_t captured_long_pkt_0_addr;
+	uint32_t captured_long_pkt_1_addr;
+	uint32_t captured_long_pkt_ftr_addr;
+	uint32_t captured_cphy_pkt_hdr_addr;
+	uint32_t lane0_misr_addr;
+	uint32_t lane1_misr_addr;
+	uint32_t lane2_misr_addr;
+	uint32_t lane3_misr_addr;
+	uint32_t total_pkts_rcvd_addr;
+	uint32_t stats_ecc_addr;
+	uint32_t total_crc_err_addr;
+	uint32_t de_scramble_type3_cfg0_addr;
+	uint32_t de_scramble_type3_cfg1_addr;
+	uint32_t de_scramble_type2_cfg0_addr;
+	uint32_t de_scramble_type2_cfg1_addr;
+	uint32_t de_scramble_type1_cfg0_addr;
+	uint32_t de_scramble_type1_cfg1_addr;
+	uint32_t de_scramble_type0_cfg0_addr;
+	uint32_t de_scramble_type0_cfg1_addr;
+
+	/*configurations */
+	uint32_t rst_srb_all;
+	uint32_t rst_done_shift_val;
+	uint32_t irq_mask_all;
+	uint32_t misr_enable_shift_val;
+	uint32_t vc_mode_shift_val;
+	uint32_t capture_long_pkt_en_shift;
+	uint32_t capture_short_pkt_en_shift;
+	uint32_t capture_cphy_pkt_en_shift;
+	uint32_t capture_long_pkt_dt_shift;
+	uint32_t capture_long_pkt_vc_shift;
+	uint32_t capture_short_pkt_vc_shift;
+	uint32_t capture_cphy_pkt_dt_shift;
+	uint32_t capture_cphy_pkt_vc_shift;
+	uint32_t ecc_correction_shift_en;
+	uint32_t phy_bist_shift_en;
+	uint32_t epd_mode_shift_en;
+	uint32_t eotp_shift_en;
+	uint32_t dyn_sensor_switch_shift_en;
+	uint32_t rup_aup_latch_shift;
+	bool     rup_aup_latch_supported;
+	uint32_t phy_num_mask;
+	uint32_t vc_mask;
+	uint32_t wc_mask;
+	uint32_t dt_mask;
+	uint32_t vc_shift;
+	uint32_t dt_shift;
+	uint32_t wc_shift;
+	uint32_t calc_crc_mask;
+	uint32_t expected_crc_mask;
+	uint32_t calc_crc_shift;
+	uint32_t lane_num_shift;
+	uint32_t lane_cfg_shift;
+	uint32_t phy_type_shift;
+	uint32_t phy_num_shift;
+	uint32_t tpg_mux_en_shift;
+	uint32_t tpg_num_sel_shift;
+	uint32_t long_pkt_strobe_rst_shift;
+	uint32_t short_pkt_strobe_rst_shift;
+	uint32_t cphy_pkt_strobe_rst_shift;
+	uint32_t unmapped_pkt_strobe_rst_shift;
+	uint32_t fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	uint32_t part_fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	uint32_t non_fatal_err_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	uint32_t debug_irq_mask[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	uint32_t top_irq_mask[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+};
+
+/*
+ *struct cam_ife_csid_ver2_rup_aup_mask: place holder for rup/aup mask parameter
+ *
+ * @rup_mask:                This stores value of rup mask  when rup and aup are split,
+ *                           else it store value of unified rup aup mask.
+ * @aup_mask:                This stores value of aup mask if rup and aup is split, else
+ *                           this is to be ignored.
+ * @rup_aup_set_mask:        This is used to store rup_aup_sync register mask when rup
+ *                           and aup are split,else this value is to be ignored.
+ */
+struct cam_ife_csid_ver2_rup_aup_mask {
+	uint32_t rup_mask;
+	uint32_t aup_mask;
+	uint32_t rup_aup_set_mask;
+};
+
+/*
+ * struct cam_ife_csid_ver2_path_cfg: place holder for path parameters
+ *
+ * @error_ts:                 Error timestamp
+ * @sof_ts:                   SOF timestamp
+ * @epoch_ts:                 Epoch timestamp
+ * @eof_ts:                   EOF timestamp
+ * @cid:                      cid value for path
+ * @path_format:              Array of Path format which contains format
+ *                            info i.e Decode format, Packing format etc
+ * @sec_evt_config:           Secondary event config from HW mgr for a given path
+ * @in_format:                Array of input format which contains format type
+ * @out_format:               output format
+ * @start_pixel:              start pixel for horizontal crop
+ * @end_pixel:                end pixel for horizontal  crop
+ * @start_line:               start line for vertical crop
+ * @end_line:                 end line for vertical crop
+ * @width:                    width of incoming data
+ * @height:                   height of incoming data
+ * @master_idx:               master idx
+ * @horizontal_bin:           horizontal binning enable/disable on path
+ * @vertical_bin:             vertical binning enable/disable on path
+ * @qcfa_bin    :             qcfa binning enable/disable on path
+ * @hor_ver_bin :             horizontal vertical binning enable/disable on path
+ * @num_bytes_out:            Number of bytes out
+ * @irq_handle:               IRQ handle
+ * @err_irq_handle:           Error IRQ handle
+ * @discard_irq_handle:       IRQ handle for SOF when discarding initial frames
+ * @irq_reg_idx:              IRQ Reg index
+ * @sof_cnt:                  SOF counter
+ * @num_frames_discard:       number of frames to discard
+ * @epoch_cfg:                Epoch configured value
+ * @switch_out_of_sync_cnt:   Sensor out of sync error cnt
+ * @sync_mode   :             Sync mode--> master/slave/none
+ * @vfr_en   :                flag to indicate if variable frame rate is enabled
+ * @frame_id_dec_en:          flag to indicate if frame id decoding is enabled
+ * @crop_enable:              flag to indicate crop enable
+ * @drop_enable:              flag to indicate drop enable
+ * @discard_init_frames:      discard initial frames
+ * @skip_discard_frame_cfg:   Skip handling discard config, the blob order between
+ *                            discard config and dynamic switch update cannot be gauranteed
+ *                            If we know the number of paths to avoid configuring discard
+ *                            for before processing discard config we can skip it for
+ *                            the corresponding paths
+ * @sfe_shdr:                 flag to indicate if sfe is inline shdr
+ * @lcr_en:                   Flag to indicate if path is part can be input to LCR
+ * @ts_comb_vcdt_en:          Indicates if Timestamp combined vcdt flag is enabled
+ * @yuv_chroma_conversion_en: Indicates if yuv chroma conversion is enabled
+ *
+ */
+struct cam_ife_csid_ver2_path_cfg {
+	struct timespec64                    error_ts;
+	struct timespec64                    sof_ts;
+	struct timespec64                    epoch_ts;
+	struct timespec64                    eof_ts;
+	struct cam_ife_csid_path_format      path_format[CAM_ISP_VC_DT_CFG];
+	struct cam_csid_secondary_evt_config sec_evt_config;
+	uint32_t                             cid;
+	uint32_t                             in_format[CAM_ISP_VC_DT_CFG];
+	uint32_t                             out_format;
+	uint32_t                             start_pixel;
+	uint32_t                             end_pixel;
+	uint32_t                             width;
+	uint32_t                             start_line;
+	uint32_t                             end_line;
+	uint32_t                             height;
+	uint32_t                             master_idx;
+	uint64_t                             clk_rate;
+	uint32_t                             horizontal_bin;
+	uint32_t                             vertical_bin;
+	uint32_t                             qcfa_bin;
+	uint32_t                             hor_ver_bin;
+	uint32_t                             num_bytes_out;
+	uint32_t                             top_irq_handle;
+	uint32_t                             irq_handle;
+	uint32_t                             err_irq_handle;
+	uint32_t                             discard_irq_handle;
+	uint32_t                             irq_reg_idx;
+	uint32_t                             sof_cnt;
+	uint32_t                             num_frames_discard;
+	uint32_t                             epoch_cfg;
+	atomic_t                             switch_out_of_sync_cnt;
+	enum cam_isp_hw_sync_mode            sync_mode;
+	bool                                 vfr_en;
+	bool                                 frame_id_dec_en;
+	bool                                 crop_enable;
+	bool                                 drop_enable;
+	bool                                 discard_init_frames;
+	bool                                 skip_discard_frame_cfg;
+	bool                                 sfe_shdr;
+	bool                                 lcr_en;
+	bool                                 csid_out_unpack_msb;
+	bool                                 handle_camif_irq;
+	bool                                 ts_comb_vcdt_en;
+	bool                                 yuv_chroma_conversion_en;
+};
+
+struct cam_ife_csid_ver2_top_reg_info {
+	uint32_t io_path_cfg0_addr[CAM_IFE_CSID_HW_NUM_MAX];
+	uint32_t dual_csid_cfg0_addr[CAM_IFE_CSID_HW_NUM_MAX];
+	uint32_t input_core_type_shift_val;
+	uint32_t sfe_offline_en_shift_val;
+	uint32_t out_ife_en_shift_val;
+	uint32_t dual_sync_sel_shift_val;
+	uint32_t dual_en_shift_val;
+	uint32_t master_slave_sel_shift_val;
+	uint32_t rdi_lcr_shift_val;
+	uint32_t master_sel_val;
+	uint32_t slave_sel_val;
+	uint32_t io_path_cfg_rst_val;
+	uint32_t dual_cfg_rst_val;
+	bool     sfe_pipeline_bypassed;
+};
+
+struct cam_ife_csid_ver2_mc_ctxt_reg_info {
+	uint32_t epoch_irq_cfg_addr;
+};
+
+struct cam_ife_csid_ver2_mc_bcast_reg_info {
+	uint32_t  pix_store_cfg_addr;
+};
+
+struct cam_ife_csid_ver2_mc_reg_info {
+	uint32_t           irq_comp_cfg0_addr;
+	uint32_t           ipp_src_ctxt_mask_shift;
+	uint32_t           ipp_dst_ctxt_mask_shift;
+	uint32_t           comp_sof_mask;
+	uint32_t           comp_eof_mask;
+	uint32_t           comp_epoch0_mask;
+	uint32_t           comp_rup_mask;
+	uint32_t           comp_subgrp0_mask;
+	uint32_t           comp_subgrp2_mask;
+};
+
+struct cam_ife_csid_ver2_path_reg_info {
+	uint32_t irq_status_addr;
+	uint32_t irq_mask_addr;
+	uint32_t irq_clear_addr;
+	uint32_t irq_set_addr;
+	uint32_t cfg0_addr;
+	uint32_t ctrl_addr;
+	uint32_t debug_clr_cmd_addr;
+	uint32_t multi_vcdt_cfg0_addr;
+	uint32_t cfg1_addr;
+	uint32_t bin_cfg0_addr;
+	uint32_t pix_store_cfg0_addr;
+	uint32_t sparse_pd_extractor_cfg_addr;
+	uint32_t err_recovery_cfg0_addr;
+	uint32_t err_recovery_cfg1_addr;
+	uint32_t err_recovery_cfg2_addr;
+	uint32_t bin_pd_detect_cfg0_addr;
+	uint32_t bin_pd_detect_cfg1_addr;
+	uint32_t bin_pd_detect_cfg2_addr;
+	uint32_t debug_byte_cntr_ping_addr;
+	uint32_t debug_byte_cntr_pong_addr;
+	uint32_t camif_frame_cfg_addr;
+	uint32_t epoch_irq_cfg_addr;
+	uint32_t epoch0_subsample_ptrn_addr;
+	uint32_t epoch1_subsample_ptrn_addr;
+	uint32_t debug_rup_aup_status;
+	uint32_t debug_camif_1_addr;
+	uint32_t debug_camif_0_addr;
+	uint32_t frm_drop_pattern_addr;
+	uint32_t frm_drop_period_addr;
+	uint32_t irq_subsample_pattern_addr;
+	uint32_t irq_subsample_period_addr;
+	uint32_t hcrop_addr;
+	uint32_t vcrop_addr;
+	uint32_t pix_drop_pattern_addr;
+	uint32_t pix_drop_period_addr;
+	uint32_t line_drop_pattern_addr;
+	uint32_t line_drop_period_addr;
+	uint32_t yuv_chroma_conversion_addr;
+	uint32_t debug_halt_status_addr;
+	uint32_t debug_misr_val0_addr;
+	uint32_t debug_misr_val1_addr;
+	uint32_t debug_misr_val2_addr;
+	uint32_t debug_misr_val3_addr;
+	uint32_t format_measure_cfg0_addr;
+	uint32_t format_measure_cfg1_addr;
+	uint32_t format_measure_cfg2_addr;
+	uint32_t format_measure0_addr;
+	uint32_t format_measure1_addr;
+	uint32_t format_measure2_addr;
+	uint32_t timestamp_curr0_sof_addr;
+	uint32_t timestamp_curr1_sof_addr;
+	uint32_t timestamp_perv0_sof_addr;
+	uint32_t timestamp_perv1_sof_addr;
+	uint32_t timestamp_curr0_eof_addr;
+	uint32_t timestamp_curr1_eof_addr;
+	uint32_t timestamp_perv0_eof_addr;
+	uint32_t timestamp_perv1_eof_addr;
+	uint32_t lut_bank_cfg_addr;
+	uint32_t batch_id_cfg0_addr;
+	uint32_t batch_id_cfg1_addr;
+	uint32_t batch_period_cfg_addr;
+	uint32_t batch_stream_id_cfg_addr;
+	uint32_t epoch0_cfg_batch_id0_addr;
+	uint32_t epoch1_cfg_batch_id0_addr;
+	uint32_t epoch0_cfg_batch_id1_addr;
+	uint32_t epoch1_cfg_batch_id1_addr;
+	uint32_t epoch0_cfg_batch_id2_addr;
+	uint32_t epoch1_cfg_batch_id2_addr;
+	uint32_t epoch0_cfg_batch_id3_addr;
+	uint32_t epoch1_cfg_batch_id3_addr;
+	uint32_t epoch0_cfg_batch_id4_addr;
+	uint32_t epoch1_cfg_batch_id4_addr;
+	uint32_t epoch0_cfg_batch_id5_addr;
+	uint32_t epoch1_cfg_batch_id5_addr;
+	uint32_t secure_mask_cfg0;
+	uint32_t path_batch_status;
+	uint32_t path_frame_id;
+	uint32_t cfg2_addr;
+	uint32_t debug_sim_monitor;
+	uint32_t frame_freeze_crc_cfg0;
+	uint32_t debug_frame_freeze_crc;
+
+	/*Shift Bit Configurations*/
+	uint32_t start_mode_master;
+	uint32_t start_mode_internal;
+	uint32_t start_mode_global;
+	uint32_t start_mode_slave;
+	uint32_t start_mode_shift;
+	uint32_t start_master_sel_val;
+	uint32_t start_master_sel_shift;
+	uint32_t resume_frame_boundary;
+	uint32_t offline_mode_supported;
+	uint32_t mipi_pack_supported;
+	uint32_t packing_fmt_shift_val;
+	uint32_t plain_fmt_shift_val;
+	uint32_t plain_alignment_shift_val;
+	uint32_t crop_v_en_shift_val;
+	uint32_t crop_h_en_shift_val;
+	uint32_t drop_v_en_shift_val;
+	uint32_t drop_h_en_shift_val;
+	uint32_t pix_store_en_shift_val;
+	uint32_t early_eof_en_shift_val;
+	uint32_t bin_h_en_shift_val;
+	uint32_t bin_v_en_shift_val;
+	uint32_t bin_en_shift_val;
+	uint32_t bin_qcfa_en_shift_val;
+	uint32_t format_measure_en_shift_val;
+	uint32_t timestamp_en_shift_val;
+	uint32_t min_hbi_shift_val;
+	uint32_t start_master_sel_shift_val;
+	uint32_t bin_pd_en_shift_val;
+	uint32_t bin_pd_blk_w_shift_val;
+	uint32_t bin_pd_blk_h_shift_val;
+	uint32_t bin_pd_detect_x_offset_shift_val;
+	uint32_t bin_pd_detect_x_end_shift_val;
+	uint32_t bin_pd_detect_y_offset_shift_val;
+	uint32_t bin_pd_detect_y_end_shift_val;
+	uint32_t byte_cntr_en_shift_val;
+	uint32_t offline_mode_en_shift_val;
+	uint32_t debug_byte_cntr_rst_shift_val;
+	uint32_t stripe_loc_shift_val;
+	uint32_t pix_pattern_shift_val;
+	uint32_t ccif_violation_en;
+	uint32_t overflow_ctrl_mode_val;
+	uint32_t overflow_ctrl_en;
+	uint32_t lut_bank_0_sel_val;
+	uint32_t lut_bank_1_sel_val;
+	uint32_t binning_supported;
+	uint32_t fatal_err_mask;
+	uint32_t non_fatal_err_mask;
+	uint32_t pix_pattern_shift;
+	uint32_t rup_irq_mask;
+	uint32_t sof_irq_mask;
+	uint32_t eof_irq_mask;
+	uint32_t epoch0_irq_mask;
+	uint32_t epoch1_irq_mask;
+	uint32_t rup_aup_mask;
+	uint32_t rup_mask;
+	uint32_t aup_mask;
+	uint32_t rup_aup_set_mask;
+	uint32_t top_irq_mask[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	uint32_t epoch0_cfg_val;
+	uint32_t epoch1_cfg_val;
+	uint32_t epoch0_shift_val;
+	uint32_t epoch1_shift_val;
+	uint32_t sof_retiming_dis_shift;
+	uint32_t capabilities;
+	uint32_t default_out_format;
+	bool     crop_drop_enable;
+};
+
+struct cam_ife_csid_ver2_common_reg_info {
+	uint32_t hw_version_addr;
+	uint32_t cfg0_addr;
+	uint32_t global_cmd_addr;
+	uint32_t reset_cfg_addr;
+	uint32_t reset_cmd_addr;
+	uint32_t rup_aup_cmd_addr;
+	uint32_t rup_cmd_addr;
+	uint32_t aup_cmd_addr;
+	uint32_t offline_cmd_addr;
+	uint32_t shdr_master_slave_cfg_addr;
+	uint32_t top_irq_status_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	uint32_t top_irq_mask_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	uint32_t top_irq_clear_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	uint32_t top_irq_set_addr[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	uint32_t multi_sensor_mode_addr;
+	uint32_t irq_cmd_addr;
+	uint32_t buf_done_irq_status_addr;
+	uint32_t buf_done_irq_mask_addr;
+	uint32_t buf_done_irq_clear_addr;
+	uint32_t buf_done_irq_set_addr;
+	uint32_t test_bus_ctrl;
+	uint32_t test_bus_debug;
+	uint32_t drv_cfg0_addr;
+	uint32_t drv_cfg1_addr;
+	uint32_t drv_cfg2_addr;
+	uint32_t debug_drv_0_addr;
+	uint32_t debug_drv_1_addr;
+	uint32_t debug_sensor_hbi_irq_vcdt_addr;
+	uint32_t debug_violation_addr;
+	uint32_t debug_cfg_addr;
+
+	/*Shift Bit Configurations*/
+	uint32_t rst_done_shift_val;
+	uint32_t rst_location_shift_val;
+	uint32_t rst_mode_shift_val;
+	uint32_t timestamp_stb_sel_shift_val;
+	uint32_t frame_id_decode_en_shift_val;
+	uint32_t vfr_en_shift_val;
+	uint32_t decode_format_shift_val;
+	uint32_t decode_format1_shift_val;
+	bool     decode_format1_supported;
+	uint32_t decode_format_mask;
+	uint32_t start_mode_shift_val;
+	uint32_t start_cmd_shift_val;
+	uint32_t path_en_shift_val;
+	uint32_t dt_id_shift_val;
+	uint32_t vc_shift_val;
+	uint32_t vc_mask;
+	uint32_t dt_shift_val;
+	uint32_t dt_mask;
+	uint32_t crop_shift_val;
+	uint32_t debug_frm_drop_rst_shift_val;
+	uint32_t debug_timestamp_rst_shift_val;
+	uint32_t debug_format_measure_rst_shift_val;
+	uint32_t debug_misr_rst_shift_val;
+	uint32_t num_padding_pixels_shift_val;
+	uint32_t num_padding_rows_shift_val;
+	uint32_t num_vbi_lines_shift_val;
+	uint32_t num_hbi_cycles_shift_val;
+	uint32_t epoch0_line_shift_val;
+	uint32_t epoch1_line_shift_val;
+	uint32_t camif_width_shift_val;
+	uint32_t camif_height_shift_val;
+	uint32_t batch_id0_shift_val;
+	uint32_t batch_id1_shift_val;
+	uint32_t batch_id2_shift_val;
+	uint32_t batch_id3_shift_val;
+	uint32_t batch_id4_shift_val;
+	uint32_t batch_id5_shift_val;
+	uint32_t batch_id0_period_shift_val;
+	uint32_t batch_id1_period_shift_val;
+	uint32_t batch_id2_period_shift_val;
+	uint32_t batch_id3_period_shift_val;
+	uint32_t batch_id4_period_shift_val;
+	uint32_t batch_id5_period_shift_val;
+	uint32_t stream_id_len_shift_val;
+	uint32_t stream_id_x_offset_shift_val;
+	uint32_t stream_id_y_offset_shift_val;
+	uint32_t multi_vcdt_vc1_shift_val;
+	uint32_t multi_vcdt_dt1_shift_val;
+	uint32_t multi_vcdt_ts_combo_en_shift_val;
+	uint32_t multi_vcdt_en_shift_val;
+	uint32_t mup_shift_val;
+	uint32_t rup_aup_set_shift_val;
+	uint32_t shdr_slave_ppp_shift;
+	uint32_t shdr_slave_rdi2_shift;
+	uint32_t shdr_slave_rdi1_shift;
+	uint32_t shdr_master_rdi0_shift;
+	uint32_t shdr_master_slave_en_shift;
+	uint32_t drv_en_shift;
+	uint32_t drv_rup_en_shift;
+	/* config Values */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t num_udis;
+	uint32_t num_rdis;
+	uint32_t num_pix;
+	uint32_t num_ppp;
+	uint32_t rst_loc_path_only_val;
+	uint32_t rst_loc_complete_csid_val;
+	uint32_t rst_mode_frame_boundary_val;
+	uint32_t rst_mode_immediate_val;
+	uint32_t rst_cmd_irq_ctrl_only_val;
+	uint32_t rst_cmd_sw_reset_complete_val;
+	uint32_t rst_cmd_hw_reset_complete_val;
+	uint32_t vfr_supported;
+	uint32_t frame_id_dec_supported;
+	uint32_t drop_supported;
+	uint32_t multi_vcdt_supported;
+	uint32_t timestamp_strobe_val;
+	uint32_t overflow_ctrl_mode_val;
+	uint32_t overflow_ctrl_en;
+	uint32_t early_eof_supported;
+	uint32_t global_reset;
+	uint32_t rup_supported;
+	uint32_t only_master_rup;
+	uint32_t sfe_ipp_input_rdi_res;
+	uint32_t phy_sel_base_idx;
+	bool     timestamp_enabled_in_cfg0;
+	bool     camif_irq_support;
+	bool     ts_comb_vcdt_en;
+	uint32_t drv_rup_en_val_map[CAM_IFE_PIX_PATH_RES_MAX];
+	uint32_t drv_path_idle_en_val_map[CAM_ISP_MAX_PATHS];
+	uint32_t yuv_chroma_conversion_enable_val;
+
+	/* Masks */
+	uint32_t ts_comb_vcdt_mask;
+	uint32_t pxl_cnt_mask;
+	uint32_t line_cnt_mask;
+	uint32_t hblank_max_mask;
+	uint32_t hblank_min_mask;
+	uint32_t epoch0_line_mask;
+	uint32_t epoch1_line_mask;
+	uint32_t camif_width_mask;
+	uint32_t camif_height_mask;
+	uint32_t crop_pix_start_mask;
+	uint32_t crop_pix_end_mask;
+	uint32_t crop_line_start_mask;
+	uint32_t crop_line_end_mask;
+	uint32_t format_measure_height_mask_val;
+	uint32_t format_measure_height_shift_val;
+	uint32_t format_measure_width_mask_val;
+	uint32_t format_measure_width_shift_val;
+	uint32_t measure_en_hbi_vbi_cnt_mask;
+	uint32_t measure_pixel_line_en_mask;
+	uint32_t ipp_irq_mask_all;
+	uint32_t rdi_irq_mask_all;
+	uint32_t ppp_irq_mask_all;
+	uint32_t udi_irq_mask_all;
+	uint32_t top_err_irq_mask[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	uint32_t top_reset_irq_mask[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	uint32_t top_buf_done_irq_mask;
+	uint32_t epoch_factor;
+	uint32_t decode_format_payload_only;
+	uint32_t capabilities;
+	uint32_t sync_reset_ctrl_testbus_val;
+};
+
+/**
+ * struct cam_ife_csid_secure_info: Contains all relevant info to be
+ *                                  programmed for targets supporting
+ *                                  this feature
+ * @phy_sel:          Intermediate value for this mask. CSID passes
+ *                    phy_sel.This variable's position at the top is to
+ *                    be left unchanged, to have it be used correctly
+ *                    in the cam_subdev_notify_message callback for
+ *                    csiphy
+ * @lane_cfg:         This value is similar to lane_assign in the PHY
+ *                    driver, and is used to identify the particular
+ *                    PHY instance with which this IFE session is
+ *                    connected to.
+ * @vc_mask:          Virtual channel masks (Unused for mobile usecase)
+ * @csid_hw_idx_mask: Bit position denoting CSID(s) in use for secure
+ *                    session
+ * @cdm_hw_idx_mask:  Bit position denoting CDM in use for secure
+ *                    session
+ */
+struct cam_ife_csid_secure_info {
+	uint32_t phy_sel;
+	uint32_t lane_cfg;
+	uint64_t vc_mask;
+	uint32_t csid_hw_idx_mask;
+	uint32_t cdm_hw_idx_mask;
+};
+
+struct cam_ife_csid_ver2_reg_info {
+	struct cam_irq_controller_reg_info               *top_irq_reg_info;
+	struct cam_irq_controller_reg_info               *rx_irq_reg_info;
+	struct cam_irq_controller_reg_info               *buf_done_irq_reg_info;
+	struct cam_irq_controller_reg_info               *path_irq_reg_info[
+		CAM_IFE_PIX_PATH_RES_MAX];
+	const struct cam_ife_csid_ver2_common_reg_info   *cmn_reg;
+	const struct cam_ife_csid_ver2_csi2_rx_reg_info  *csi2_reg;
+	const struct cam_ife_csid_ver2_path_reg_info     *path_reg[
+						    CAM_IFE_PIX_PATH_RES_MAX];
+	const struct cam_ife_csid_ver2_top_reg_info      *top_reg;
+	const struct cam_ife_csid_ver2_mc_reg_info       *ipp_mc_reg;
+	const uint32_t                                    need_top_cfg;
+	const uint32_t                                    csid_cust_node_map[
+		    CAM_IFE_CSID_HW_NUM_MAX];
+	const int                                         input_core_sel[
+		    CAM_IFE_CSID_HW_NUM_MAX][CAM_IFE_CSID_INPUT_CORE_SEL_MAX];
+	const struct cam_ife_csid_top_irq_desc           (*top_irq_desc)[][32];
+	const struct cam_ife_csid_irq_desc               (*rx_irq_desc)[][32];
+	const struct cam_ife_csid_irq_desc               *path_irq_desc;
+	const uint32_t                                   *num_top_err_irqs;
+	const uint32_t                                   *num_rx_err_irqs;
+	const uint32_t                                    num_path_err_irqs;
+	const uint32_t                                    num_top_regs;
+	const uint32_t                                    num_rx_regs;
+	const uint32_t                                    fused_max_dualife_width[
+		   CAM_IFE_CSID_WIDTH_FUSE_VAL_MAX];
+	const uint32_t                                    fused_max_width[
+		   CAM_IFE_CSID_WIDTH_FUSE_VAL_MAX];
+	const uint32_t                                    width_fuse_max_val;
+	bool                                              is_ife_sfe_mapped;
+};
+
+/*
+ * struct cam_ife_csid_token_info: place holder for csid res path context private data
+ *
+ * @token:        context private of ife hw manager
+ * @res_id:       Unique resource ID within res_type objects
+ *                for a particular HW
+ *
+ */
+struct cam_ife_csid_token_info {
+	void                    *token;
+	int                      res_id;
+};
+
+/*
+ * struct cam_ife_csid_ver2_hw: place holder for csid hw
+ *
+ * @path_res:                 array of path resources
+ * @cid_data:                 cid data
+ * @rx_cfg:                   rx configuration
+ * @flags:                    flags
+ * @irq_complete:             complete variable for reset irq
+ * @debug_info:               Debug info to capture debug info
+ * @timestamp:                Timestamp info
+ * @timestamp:                Timestamp info
+ * @rx_evt_payload            Payload for rx events
+ * @path_evt_payload               Payload for path events
+ * @rx_free_payload_list:     Free Payload list for rx events
+ * @free_payload_list:        Free Payload list for rx events
+ * @lock_state :              spin lock
+ * @payload_lock:             spin lock for path payload
+ * @rx_payload_lock:          spin lock for rx payload
+ * @csid_irq_controller:      common csid irq controller
+ * @buf_done_irq_controller:  buf done irq controller
+ * @hw_info:                  hw info
+ * @core_info:                csid core info
+ * @token_data:               array of context private of ife hw manager
+ * @event_cb:                 Event cb to ife hw manager
+ * @counters:                 counters used in csid hw
+ * @log_buf:                  Log Buffer to dump info
+ * @clk_rate:                 clk rate for csid hw
+ * @res_type:                 cur res type for active hw
+ * @dual_core_idx:            core idx in case of dual csid
+ * @tasklet:                  Tasklet for irq events
+ * @reset_irq_handle:         Reset irq handle
+ * @buf_done_irq_handle:      Buf done irq handle
+ * @top_err_irq_handle:       Top Err IRQ handle
+ * @top_info_irq_handle:      Top Info IRQ handle
+ * @top_mc_irq_handle:        Top multi context irq handle
+ * @sync_mode:                Master/Slave modes
+ * @mup:                      MUP for incoming VC of next frame
+ * @discard_frame_per_path:   Count of paths dropping initial frames
+ * @drv_init_done:            Indicates if drv init config is done
+ * @is_drv_config_en:         If drv config is enabled
+ * @init_global_reset_cnt:    Count of global reset called during init
+ * @rup_aup_mask:             rup aup mask enabled for particular HW
+ *
+ */
+struct cam_ife_csid_ver2_hw {
+	struct cam_isp_resource_node           path_res
+						    [CAM_IFE_PIX_PATH_RES_MAX];
+	struct cam_ife_csid_cid_data           cid_data[CAM_IFE_CSID_CID_MAX];
+	struct cam_ife_csid_ver2_top_cfg       top_cfg;
+	struct cam_ife_csid_ver2_rx_cfg        rx_cfg;
+	struct cam_ife_csid_hw_counters        counters;
+	struct cam_ife_csid_hw_flags           flags;
+	struct cam_ife_csid_debug_info         debug_info;
+	struct cam_ife_csid_timestamp          timestamp[CAM_IFE_PIX_PATH_RES_MAX];
+	struct cam_ife_csid_ver2_evt_payload   rx_evt_payload[
+						CAM_IFE_CSID_VER2_PAYLOAD_MAX];
+	struct cam_ife_csid_ver2_evt_payload   path_evt_payload[
+						CAM_IFE_CSID_VER2_PAYLOAD_MAX];
+	struct list_head                       rx_free_payload_list;
+	struct list_head                       path_free_payload_list;
+	spinlock_t                             lock_state;
+	spinlock_t                             path_payload_lock;
+	spinlock_t                             rx_payload_lock;
+	void                                  *top_irq_controller
+						[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	void                                  *rx_irq_controller
+						[CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX];
+	void                                  *path_irq_controller[CAM_IFE_PIX_PATH_RES_MAX];
+	void                                  *buf_done_irq_controller;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_hw_info                    *hw_info;
+	struct cam_ife_csid_core_info         *core_info;
+	struct cam_ife_csid_token_info         token_data[CAM_IFE_PIX_PATH_RES_MAX];
+	cam_hw_mgr_event_cb_func               event_cb;
+	uint8_t                                log_buf
+						[CAM_IFE_CSID_LOG_BUF_LEN];
+	uint64_t                               clk_rate;
+	uint32_t                               res_type;
+	uint32_t                               dual_core_idx;
+	void                                  *tasklet;
+	int                                    reset_irq_handle;
+	int                                    buf_done_irq_handle;
+	int                                    top_err_irq_handle
+						[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	int                                    top_info_irq_handle
+						[CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX];
+	int                                    top_mc_irq_handle;
+	enum cam_isp_hw_sync_mode              sync_mode;
+	uint32_t                               mup;
+	atomic_t                               discard_frame_per_path;
+	bool                                   drv_init_done;
+	bool                                   is_drv_config_en;
+	atomic_t                               init_global_reset_cnt;
+	uint32_t                               rup_aup_mask;
+};
+
+/*
+ * struct cam_ife_csid_res_mini_dump: CSID Res mini dump place holder
+ * @res_id:      Res id
+ * @res_name:    Res name
+ * @path_cfg:    path configuration
+ */
+struct cam_ife_csid_ver2_res_mini_dump {
+	uint32_t                           res_id;
+	uint8_t                            res_name[CAM_ISP_RES_NAME_LEN];
+	struct cam_ife_csid_ver2_path_cfg  path_cfg;
+};
+
+/*
+ * struct cam_ife_csid_mini_dump_data: CSID mini dump place holder
+ *
+ * @res:             Mini dump data for res
+ * @flags:           Flags
+ * @rx_cfg:          Rx configuration
+ * @cid_data:        CID data
+ * @clk_rate:        Clock Rate
+ * @hw_state:        hw state
+ */
+struct cam_ife_csid_ver2_mini_dump_data {
+	struct cam_ife_csid_ver2_res_mini_dump  res[CAM_IFE_PIX_PATH_RES_MAX];
+	struct cam_ife_csid_hw_flags            flags;
+	struct cam_ife_csid_ver2_rx_cfg         rx_cfg;
+	struct cam_ife_csid_cid_data            cid_data[CAM_IFE_CSID_CID_MAX];
+	uint64_t                                clk_rate;
+	uint8_t                                 hw_state;
+};
+
+int cam_ife_csid_hw_ver2_init(struct cam_hw_intf  *csid_hw_intf,
+	struct cam_ife_csid_core_info *csid_core_info,
+	bool is_custom);
+
+int cam_ife_csid_hw_ver2_deinit(struct cam_hw_info *hw_priv);
+void cam_ife_csid_ver2_print_illegal_programming_irq_status(void *csid_hw, void *res);
+void cam_ife_csid_ver2_print_format_measure_info(void *csid_hw, void *res);
+void cam_ife_csid_hw_ver2_mup_mismatch_handler(void *csid_hw, void *res);
+void cam_ife_csid_hw_ver2_rdi_line_buffer_conflict_handler(void *csid_hw);
+void cam_ife_csid_hw_ver2_drv_err_handler(void *csid);
+
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite17x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite17x.h
@@ -0,0 +1,402 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE17X_H_
+#define _CAM_IFE_CSID_LITE17X_H_
+
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+
+#define CAM_CSID_LITE_DRV_NAME                    "csid_lite"
+
+static  struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_lite_17x_rdi_0_reg_info = {
+
+	.irq_status_addr                       = 0x30,
+	.irq_mask_addr                         = 0x34,
+	.irq_clear_addr                        = 0x38,
+	.irq_set_addr                          = 0x3c,
+	.cfg0_addr                             = 0x200,
+	.cfg1_addr                             = 0x204,
+	.ctrl_addr                             = 0x208,
+	.frm_drop_pattern_addr                 = 0x20c,
+	.frm_drop_period_addr                  = 0x210,
+	.irq_subsample_pattern_addr            = 0x214,
+	.irq_subsample_period_addr             = 0x218,
+	.hcrop_addr                            = 0x21c,
+	.vcrop_addr                            = 0x220,
+	.pix_drop_pattern_addr                 = 0x224,
+	.pix_drop_period_addr                  = 0x228,
+	.line_drop_pattern_addr                = 0x22c,
+	.line_drop_period_addr                 = 0x230,
+	.rst_strobes_addr                      = 0x240,
+	.status_addr                           = 0x250,
+	.misr_val0_addr                        = 0x254,
+	.misr_val1_addr                        = 0x258,
+	.misr_val2_addr                        = 0x25c,
+	.misr_val3_addr                        = 0x260,
+	.format_measure_cfg0_addr              = 0x270,
+	.format_measure_cfg1_addr              = 0x274,
+	.format_measure0_addr                  = 0x278,
+	.format_measure1_addr                  = 0x27c,
+	.format_measure2_addr                  = 0x280,
+	.timestamp_curr0_sof_addr              = 0x290,
+	.timestamp_curr1_sof_addr              = 0x294,
+	.timestamp_prev0_sof_addr              = 0x298,
+	.timestamp_prev1_sof_addr              = 0x29c,
+	.timestamp_curr0_eof_addr              = 0x2a0,
+	.timestamp_curr1_eof_addr              = 0x2a4,
+	.timestamp_prev0_eof_addr              = 0x2a8,
+	.timestamp_prev1_eof_addr              = 0x2ac,
+	.byte_cntr_ping_addr                   = 0x2e0,
+	.byte_cntr_pong_addr                   = 0x2e4,
+	.halt_mode_internal                    = 0,
+	.halt_mode_global                      = 1,
+	.halt_mode_shift                       = 2,
+	.halt_frame_boundary                   = 0,
+	.resume_frame_boundary                 = 1,
+	.halt_immediate                        = 2,
+	.halt_cmd_shift                        = 0,
+	.packing_fmt_shift_val                 = 30,
+	.plain_fmt_shift_val                   = 10,
+	.crop_v_en_shift_val                   = 6,
+	.crop_h_en_shift_val                   = 5,
+	.timestamp_en_shift_val                = 2,
+	.format_measure_en_shift_val           = 1,
+	.fatal_err_mask                        = 0x4,
+	.non_fatal_err_mask                    = 0xe000,
+};
+
+static  struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_lite_17x_rdi_1_reg_info = {
+
+	.irq_status_addr                       = 0x40,
+	.irq_mask_addr                         = 0x44,
+	.irq_clear_addr                        = 0x48,
+	.irq_set_addr                          = 0x4c,
+	.cfg0_addr                             = 0x300,
+	.cfg1_addr                             = 0x304,
+	.ctrl_addr                             = 0x308,
+	.frm_drop_pattern_addr                 = 0x30c,
+	.frm_drop_period_addr                  = 0x310,
+	.irq_subsample_pattern_addr            = 0x314,
+	.irq_subsample_period_addr             = 0x318,
+	.hcrop_addr                            = 0x31c,
+	.vcrop_addr                            = 0x320,
+	.pix_drop_pattern_addr                 = 0x324,
+	.pix_drop_period_addr                  = 0x328,
+	.line_drop_pattern_addr                = 0x32c,
+	.line_drop_period_addr                 = 0x330,
+	.rst_strobes_addr                      = 0x340,
+	.status_addr                           = 0x350,
+	.misr_val0_addr                        = 0x354,
+	.misr_val1_addr                        = 0x358,
+	.misr_val2_addr                        = 0x35c,
+	.misr_val3_addr                        = 0x360,
+	.format_measure_cfg0_addr              = 0x370,
+	.format_measure_cfg1_addr              = 0x374,
+	.format_measure0_addr                  = 0x378,
+	.format_measure1_addr                  = 0x37c,
+	.format_measure2_addr                  = 0x380,
+	.timestamp_curr0_sof_addr              = 0x390,
+	.timestamp_curr1_sof_addr              = 0x394,
+	.timestamp_prev0_sof_addr              = 0x398,
+	.timestamp_prev1_sof_addr              = 0x39c,
+	.timestamp_curr0_eof_addr              = 0x3a0,
+	.timestamp_curr1_eof_addr              = 0x3a4,
+	.timestamp_prev0_eof_addr              = 0x3a8,
+	.timestamp_prev1_eof_addr              = 0x3ac,
+	.byte_cntr_ping_addr                   = 0x3e0,
+	.byte_cntr_pong_addr                   = 0x3e4,
+	.halt_mode_internal                    = 0,
+	.halt_mode_global                      = 1,
+	.halt_mode_shift                       = 2,
+	.halt_frame_boundary                   = 0,
+	.resume_frame_boundary                 = 1,
+	.halt_immediate                        = 2,
+	.halt_cmd_shift                        = 0,
+	.plain_fmt_shift_val                   = 10,
+	.packing_fmt_shift_val                 = 30,
+	.crop_v_en_shift_val                   = 6,
+	.crop_h_en_shift_val                   = 5,
+	.timestamp_en_shift_val                = 2,
+	.format_measure_en_shift_val           = 1,
+};
+
+static  struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_lite_17x_rdi_2_reg_info = {
+
+	.irq_status_addr                       = 0x50,
+	.irq_mask_addr                         = 0x54,
+	.irq_clear_addr                        = 0x58,
+	.irq_set_addr                          = 0x5c,
+	.cfg0_addr                             = 0x400,
+	.cfg1_addr                             = 0x404,
+	.ctrl_addr                             = 0x408,
+	.frm_drop_pattern_addr                 = 0x40c,
+	.frm_drop_period_addr                  = 0x410,
+	.irq_subsample_pattern_addr            = 0x414,
+	.irq_subsample_period_addr             = 0x418,
+	.hcrop_addr                            = 0x41c,
+	.vcrop_addr                            = 0x420,
+	.pix_drop_pattern_addr                 = 0x424,
+	.pix_drop_period_addr                  = 0x428,
+	.line_drop_pattern_addr                = 0x42c,
+	.line_drop_period_addr                 = 0x430,
+	.yuv_chroma_conversion_addr            = 0x434,
+	.rst_strobes_addr                      = 0x440,
+	.status_addr                           = 0x450,
+	.misr_val0_addr                        = 0x454,
+	.misr_val1_addr                        = 0x458,
+	.misr_val2_addr                        = 0x45c,
+	.misr_val3_addr                        = 0x460,
+	.format_measure_cfg0_addr              = 0x470,
+	.format_measure_cfg1_addr              = 0x474,
+	.format_measure0_addr                  = 0x478,
+	.format_measure1_addr                  = 0x47c,
+	.format_measure2_addr                  = 0x480,
+	.timestamp_curr0_sof_addr              = 0x490,
+	.timestamp_curr1_sof_addr              = 0x494,
+	.timestamp_prev0_sof_addr              = 0x498,
+	.timestamp_prev1_sof_addr              = 0x49c,
+	.timestamp_curr0_eof_addr              = 0x4a0,
+	.timestamp_curr1_eof_addr              = 0x4a4,
+	.timestamp_prev0_eof_addr              = 0x4a8,
+	.timestamp_prev1_eof_addr              = 0x4ac,
+	.byte_cntr_ping_addr                   = 0x4e0,
+	.byte_cntr_pong_addr                   = 0x4e4,
+	.halt_mode_internal                    = 0,
+	.halt_mode_global                      = 1,
+	.halt_mode_shift                       = 2,
+	.halt_frame_boundary                   = 0,
+	.resume_frame_boundary                 = 1,
+	.halt_immediate                        = 2,
+	.halt_cmd_shift                        = 0,
+	.plain_fmt_shift_val                   = 10,
+	.packing_fmt_shift_val                 = 30,
+	.crop_v_en_shift_val                   = 6,
+	.crop_h_en_shift_val                   = 5,
+	.timestamp_en_shift_val                = 2,
+	.format_measure_en_shift_val           = 1,
+};
+
+static  struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_lite_17x_rdi_3_reg_info = {
+
+	.irq_status_addr                       = 0x60,
+	.irq_mask_addr                         = 0x64,
+	.irq_clear_addr                        = 0x68,
+	.irq_set_addr                          = 0x6c,
+	.cfg0_addr                             = 0x500,
+	.cfg1_addr                             = 0x504,
+	.ctrl_addr                             = 0x508,
+	.frm_drop_pattern_addr                 = 0x50c,
+	.frm_drop_period_addr                  = 0x510,
+	.irq_subsample_pattern_addr            = 0x514,
+	.irq_subsample_period_addr             = 0x518,
+	.hcrop_addr                            = 0x51c,
+	.vcrop_addr                            = 0x520,
+	.pix_drop_pattern_addr                 = 0x524,
+	.pix_drop_period_addr                  = 0x528,
+	.line_drop_pattern_addr                = 0x52c,
+	.line_drop_period_addr                 = 0x530,
+	.yuv_chroma_conversion_addr            = 0x534,
+	.rst_strobes_addr                      = 0x540,
+	.status_addr                           = 0x550,
+	.misr_val0_addr                        = 0x554,
+	.misr_val1_addr                        = 0x558,
+	.misr_val2_addr                        = 0x55c,
+	.misr_val3_addr                        = 0x560,
+	.format_measure_cfg0_addr              = 0x570,
+	.format_measure_cfg1_addr              = 0x574,
+	.format_measure0_addr                  = 0x578,
+	.format_measure1_addr                  = 0x57c,
+	.format_measure2_addr                  = 0x580,
+	.timestamp_curr0_sof_addr              = 0x590,
+	.timestamp_curr1_sof_addr              = 0x594,
+	.timestamp_prev0_sof_addr              = 0x598,
+	.timestamp_prev1_sof_addr              = 0x59c,
+	.timestamp_curr0_eof_addr              = 0x5a0,
+	.timestamp_curr1_eof_addr              = 0x5a4,
+	.timestamp_prev0_eof_addr              = 0x5a8,
+	.timestamp_prev1_eof_addr              = 0x5ac,
+	.byte_cntr_ping_addr                   = 0x5e0,
+	.byte_cntr_pong_addr                   = 0x5e4,
+	.halt_mode_internal                    = 0,
+	.halt_mode_global                      = 1,
+	.halt_mode_shift                       = 2,
+	.halt_frame_boundary                   = 0,
+	.resume_frame_boundary                 = 1,
+	.halt_immediate                        = 2,
+	.halt_cmd_shift                        = 0,
+	.plain_fmt_shift_val                   = 10,
+	.packing_fmt_shift_val                 = 30,
+	.crop_v_en_shift_val                   = 6,
+	.crop_h_en_shift_val                   = 5,
+	.timestamp_en_shift_val                = 2,
+	.format_measure_en_shift_val           = 1,
+};
+
+static  struct cam_ife_csid_csi2_rx_reg_info
+	cam_ife_csid_lite_17x_csi2_reg_info = {
+
+	.irq_status_addr                       = 0x20,
+	.irq_mask_addr                         = 0x24,
+	.irq_clear_addr                        = 0x28,
+	.irq_set_addr                          = 0x2c,
+
+	/*CSI2 rx control */
+	.cfg0_addr                             = 0x100,
+	.cfg1_addr                             = 0x104,
+	.capture_ctrl_addr                     = 0x108,
+	.rst_strobes_addr                      = 0x110,
+	.de_scramble_cfg0_addr                 = 0x114,
+	.de_scramble_cfg1_addr                 = 0x118,
+	.cap_unmap_long_pkt_hdr_0_addr         = 0x120,
+	.cap_unmap_long_pkt_hdr_1_addr         = 0x124,
+	.captured_short_pkt_0_addr             = 0x128,
+	.captured_short_pkt_1_addr             = 0x12c,
+	.captured_long_pkt_0_addr              = 0x130,
+	.captured_long_pkt_1_addr              = 0x134,
+	.captured_long_pkt_ftr_addr            = 0x138,
+	.captured_cphy_pkt_hdr_addr            = 0x13c,
+	.lane0_misr_addr                       = 0x150,
+	.lane1_misr_addr                       = 0x154,
+	.lane2_misr_addr                       = 0x158,
+	.lane3_misr_addr                       = 0x15c,
+	.total_pkts_rcvd_addr                  = 0x160,
+	.stats_ecc_addr                        = 0x164,
+	.total_crc_err_addr                    = 0x168,
+
+	.rst_srb_all                           = 0x3FFF,
+	.rst_done_shift_val                    = 27,
+	.irq_mask_all                          = 0xFFFFFFF,
+	.misr_enable_shift_val                 = 6,
+	.vc_mode_shift_val                     = 2,
+	.capture_long_pkt_en_shift             = 0,
+	.capture_short_pkt_en_shift            = 1,
+	.capture_cphy_pkt_en_shift             = 2,
+	.capture_long_pkt_dt_shift             = 4,
+	.capture_long_pkt_vc_shift             = 10,
+	.capture_short_pkt_vc_shift            = 15,
+	.capture_cphy_pkt_dt_shift             = 20,
+	.capture_cphy_pkt_vc_shift             = 26,
+	.phy_num_mask                          = 0x3,
+	.fatal_err_mask                        = 0x78000,
+	.part_fatal_err_mask                   = 0x1801800,
+	.non_fatal_err_mask                    = 0x380000,
+};
+
+
+static struct cam_ife_csid_ver1_tpg_reg_info
+		cam_ife_csid_lite_17x_tpg_reg_info = {
+	/*CSID TPG control */
+	.ctrl_addr                             = 0x600,
+	.vc_cfg0_addr                          = 0x604,
+	.vc_cfg1_addr                          = 0x608,
+	.lfsr_seed_addr                        = 0x60c,
+	.dt_n_cfg_0_addr                       = 0x610,
+	.dt_n_cfg_1_addr                       = 0x614,
+	.dt_n_cfg_2_addr                       = 0x618,
+	.color_bars_cfg_addr                   = 0x640,
+	.color_box_cfg_addr                    = 0x644,
+	.common_gen_cfg_addr                   = 0x648,
+	.cgen_n_cfg_addr                       = 0x650,
+	.cgen_n_x0_addr                        = 0x654,
+	.cgen_n_x1_addr                        = 0x658,
+	.cgen_n_x2_addr                        = 0x65c,
+	.cgen_n_xy_addr                        = 0x660,
+	.cgen_n_y1_addr                        = 0x664,
+	.cgen_n_y2_addr                        = 0x668,
+
+	/* configurations */
+	.dtn_cfg_offset                        = 0xc,
+	.cgen_cfg_offset                       = 0x20,
+	.cpas_ife_reg_offset                   = 0x28,
+	.hbi                                   = 0x740,
+	.vbi                                   = 0x3FF,
+	.ctrl_cfg                              = 0x408007,
+	.lfsr_seed                             = 0x12345678,
+	.color_bar                             = 1,
+	.num_frames                            = 0,
+	.line_interleave_mode                  = 0x1,
+	.payload_mode                          = 0x8,
+	.num_active_lanes_mask                 = 0x30,
+	.num_active_dt                         = 0,
+	.fmt_shift                             = 16,
+	.num_frame_shift                       = 16,
+	.width_shift                           = 16,
+	.vbi_shift                             = 12,
+	.line_interleave_shift                 = 10,
+	.num_active_dt_shift                   = 8,
+	.color_bar_shift                       = 5,
+	.height_shift                          = 0,
+	.hbi_shift                             = 0,
+};
+
+
+static  struct cam_ife_csid_ver1_common_reg_info
+	cam_csid_lite_17x_cmn_reg_info = {
+
+	.hw_version_addr                       = 0x0,
+	.cfg0_addr                             = 0x4,
+	.ctrl_addr                             = 0x8,
+	.reset_addr                            = 0xc,
+	.rst_strobes_addr                      = 0x10,
+
+	.test_bus_ctrl_addr                    = 0x14,
+	.top_irq_status_addr                   = 0x70,
+	.top_irq_mask_addr                     = 0x74,
+	.top_irq_clear_addr                    = 0x78,
+	.top_irq_set_addr                      = 0x7c,
+	.irq_cmd_addr                          = 0x80,
+
+	/*configurations */
+	.major_version                         = 1,
+	.minor_version                         = 7,
+	.version_incr                          = 0,
+	.num_rdis                              = 4,
+	.num_pix                               = 0,
+	.timestamp_strobe_val                  = 0x2,
+	.timestamp_stb_sel_shift_val           = 0,
+	.rst_sw_reg_stb                        = 1,
+	.rst_hw_reg_stb                        = 0x1e,
+	.rst_sw_hw_reg_stb                     = 0x1f,
+	.path_rst_stb_all                      = 0x7f,
+	.rst_done_shift_val                    = 1,
+	.path_en_shift_val                     = 31,
+	.dt_id_shift_val                       = 27,
+	.vc_shift_val                          = 22,
+	.dt_shift_val                          = 16,
+	.fmt_shift_val                         = 12,
+	.crop_shift_val                        = 16,
+	.decode_format_shift_val               = 12,
+	.crop_pix_start_mask                   = 0x3fff,
+	.crop_pix_end_mask                     = 0xffff,
+	.crop_line_start_mask                  = 0x3fff,
+	.crop_line_end_mask                    = 0xffff,
+	.ipp_irq_mask_all                      = 0x7FFF,
+	.rdi_irq_mask_all                      = 0x7FFF,
+	.ppp_irq_mask_all                      = 0xFFFF,
+	.format_measure_height_mask_val        = 0xFFFF,
+	.format_measure_height_shift_val       = 0x10,
+	.format_measure_width_mask_val         = 0xFFFF,
+	.format_measure_width_shift_val        = 0x0,
+};
+
+static  struct cam_ife_csid_ver1_reg_info cam_ife_csid_lite_17x_reg_info = {
+	.cmn_reg          = &cam_csid_lite_17x_cmn_reg_info,
+	.csi2_reg         = &cam_ife_csid_lite_17x_csi2_reg_info,
+	.ipp_reg          = NULL,
+	.rdi_reg = {
+		&cam_ife_csid_lite_17x_rdi_0_reg_info,
+		&cam_ife_csid_lite_17x_rdi_1_reg_info,
+		&cam_ife_csid_lite_17x_rdi_2_reg_info,
+		&cam_ife_csid_lite_17x_rdi_3_reg_info,
+		},
+	.tpg_reg = &cam_ife_csid_lite_17x_tpg_reg_info,
+};
+#endif /*_CAM_IFE_CSID_LITE17X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite480.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite480.h
@@ -0,0 +1,442 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE_480_H_
+#define _CAM_IFE_CSID_LITE_480_H_
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_hw_ver1.h"
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_lite_480_rdi_0_reg_info = {
+	.irq_status_addr                      = 0x30,
+	.irq_mask_addr                        = 0x34,
+	.irq_clear_addr                       = 0x38,
+	.irq_set_addr                         = 0x3c,
+	.cfg0_addr                            = 0x200,
+	.cfg1_addr                            = 0x204,
+	.ctrl_addr                            = 0x208,
+	.frm_drop_pattern_addr                = 0x20c,
+	.frm_drop_period_addr                 = 0x210,
+	.irq_subsample_pattern_addr           = 0x214,
+	.irq_subsample_period_addr            = 0x218,
+	.hcrop_addr                           = 0x21c,
+	.vcrop_addr                           = 0x220,
+	.pix_drop_pattern_addr                = 0x224,
+	.pix_drop_period_addr                 = 0x228,
+	.line_drop_pattern_addr               = 0x22c,
+	.line_drop_period_addr                = 0x230,
+	.rst_strobes_addr                     = 0x240,
+	.status_addr                          = 0x250,
+	.misr_val0_addr                       = 0x254,
+	.misr_val1_addr                       = 0x258,
+	.misr_val2_addr                       = 0x25c,
+	.misr_val3_addr                       = 0x260,
+	.format_measure_cfg0_addr             = 0x270,
+	.format_measure_cfg1_addr             = 0x274,
+	.format_measure0_addr                 = 0x278,
+	.format_measure1_addr                 = 0x27c,
+	.format_measure2_addr                 = 0x280,
+	.timestamp_curr0_sof_addr             = 0x290,
+	.timestamp_curr1_sof_addr             = 0x294,
+	.timestamp_prev0_sof_addr             = 0x298,
+	.timestamp_prev1_sof_addr             = 0x29c,
+	.timestamp_curr0_eof_addr             = 0x2a0,
+	.timestamp_curr1_eof_addr             = 0x2a4,
+	.timestamp_prev0_eof_addr             = 0x2a8,
+	.timestamp_prev1_eof_addr             = 0x2ac,
+	.err_recovery_cfg0_addr               = 0x2b0,
+	.err_recovery_cfg1_addr               = 0x2b4,
+	.err_recovery_cfg2_addr               = 0x2b8,
+	.multi_vcdt_cfg0_addr                 = 0x2bc,
+	.byte_cntr_ping_addr                  = 0x2e0,
+	.byte_cntr_pong_addr                  = 0x2e4,
+	/* configurations */
+	.halt_mode_internal                   = 0,
+	.halt_mode_global                     = 1,
+	.halt_mode_shift                      = 2,
+	.halt_frame_boundary                  = 0,
+	.resume_frame_boundary                = 1,
+	.halt_immediate                       = 2,
+	.halt_cmd_shift                       = 0,
+	.crop_v_en_shift_val                  = 6,
+	.crop_h_en_shift_val                  = 5,
+	.drop_v_en_shift_val                  = 4,
+	.drop_h_en_shift_val                  = 3,
+	.plain_fmt_shift_val                  = 10,
+	.packing_fmt_shift_val                = 30,
+	.mipi_pack_supported                  = 1,
+	.ccif_violation_en                    = 1,
+	.overflow_ctrl_en                     = 1,
+	.timestamp_en_shift_val               = 2,
+	.format_measure_en_shift_val          = 1,
+	.overflow_ctrl_mode_val               = 0x8,
+	.fatal_err_mask                       = 0x4,
+	.non_fatal_err_mask                   = 0x2e000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_lite_480_rdi_1_reg_info = {
+	.irq_status_addr                      = 0x40,
+	.irq_mask_addr                        = 0x44,
+	.irq_clear_addr                       = 0x48,
+	.irq_set_addr                         = 0x4c,
+	.cfg0_addr                            = 0x300,
+	.cfg1_addr                            = 0x304,
+	.ctrl_addr                            = 0x308,
+	.frm_drop_pattern_addr                = 0x30c,
+	.frm_drop_period_addr                 = 0x310,
+	.irq_subsample_pattern_addr           = 0x314,
+	.irq_subsample_period_addr            = 0x318,
+	.hcrop_addr                           = 0x31c,
+	.vcrop_addr                           = 0x320,
+	.pix_drop_pattern_addr                = 0x324,
+	.pix_drop_period_addr                 = 0x328,
+	.line_drop_pattern_addr               = 0x32c,
+	.line_drop_period_addr                = 0x330,
+	.rst_strobes_addr                     = 0x340,
+	.status_addr                          = 0x350,
+	.misr_val0_addr                       = 0x354,
+	.misr_val1_addr                       = 0x358,
+	.misr_val2_addr                       = 0x35c,
+	.misr_val3_addr                       = 0x360,
+	.format_measure_cfg0_addr             = 0x370,
+	.format_measure_cfg1_addr             = 0x374,
+	.format_measure0_addr                 = 0x378,
+	.format_measure1_addr                 = 0x37c,
+	.format_measure2_addr                 = 0x380,
+	.timestamp_curr0_sof_addr             = 0x390,
+	.timestamp_curr1_sof_addr             = 0x394,
+	.timestamp_prev0_sof_addr             = 0x398,
+	.timestamp_prev1_sof_addr             = 0x39c,
+	.timestamp_curr0_eof_addr             = 0x3a0,
+	.timestamp_curr1_eof_addr             = 0x3a4,
+	.timestamp_prev0_eof_addr             = 0x3a8,
+	.timestamp_prev1_eof_addr             = 0x3ac,
+	.err_recovery_cfg0_addr               = 0x3b0,
+	.err_recovery_cfg1_addr               = 0x3b4,
+	.err_recovery_cfg2_addr               = 0x3b8,
+	.multi_vcdt_cfg0_addr                 = 0x3bc,
+	.byte_cntr_ping_addr                  = 0x3e0,
+	.byte_cntr_pong_addr                  = 0x3e4,
+	/* configurations */
+	.halt_mode_internal                   = 0,
+	.halt_mode_global                     = 1,
+	.halt_mode_shift                      = 2,
+	.halt_frame_boundary                  = 0,
+	.resume_frame_boundary                = 1,
+	.halt_immediate                       = 2,
+	.halt_cmd_shift                       = 0,
+	.crop_v_en_shift_val                  = 6,
+	.crop_h_en_shift_val                  = 5,
+	.drop_v_en_shift_val                  = 4,
+	.drop_h_en_shift_val                  = 3,
+	.packing_fmt_shift_val                = 30,
+	.plain_fmt_shift_val                  = 10,
+	.ccif_violation_en                    = 1,
+	.overflow_ctrl_en                     = 1,
+	.timestamp_en_shift_val               = 2,
+	.format_measure_en_shift_val          = 1,
+	.overflow_ctrl_mode_val               = 0x8,
+	.fatal_err_mask                       = 0x4,
+	.non_fatal_err_mask                   = 0x2e000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_lite_480_rdi_2_reg_info = {
+	.irq_status_addr                      = 0x50,
+	.irq_mask_addr                        = 0x54,
+	.irq_clear_addr                       = 0x58,
+	.irq_set_addr                         = 0x5c,
+	.cfg0_addr                            = 0x400,
+	.cfg1_addr                            = 0x404,
+	.ctrl_addr                            = 0x408,
+	.frm_drop_pattern_addr                = 0x40c,
+	.frm_drop_period_addr                 = 0x410,
+	.irq_subsample_pattern_addr           = 0x414,
+	.irq_subsample_period_addr            = 0x418,
+	.hcrop_addr                           = 0x41c,
+	.vcrop_addr                           = 0x420,
+	.pix_drop_pattern_addr                = 0x424,
+	.pix_drop_period_addr                 = 0x428,
+	.line_drop_pattern_addr               = 0x42c,
+	.line_drop_period_addr                = 0x430,
+	.rst_strobes_addr                     = 0x440,
+	.status_addr                          = 0x450,
+	.misr_val0_addr                       = 0x454,
+	.misr_val1_addr                       = 0x458,
+	.misr_val2_addr                       = 0x45c,
+	.misr_val3_addr                       = 0x460,
+	.format_measure_cfg0_addr             = 0x470,
+	.format_measure_cfg1_addr             = 0x474,
+	.format_measure0_addr                 = 0x478,
+	.format_measure1_addr                 = 0x47c,
+	.format_measure2_addr                 = 0x480,
+	.timestamp_curr0_sof_addr             = 0x490,
+	.timestamp_curr1_sof_addr             = 0x494,
+	.timestamp_prev0_sof_addr             = 0x498,
+	.timestamp_prev1_sof_addr             = 0x49c,
+	.timestamp_curr0_eof_addr             = 0x4a0,
+	.timestamp_curr1_eof_addr             = 0x4a4,
+	.timestamp_prev0_eof_addr             = 0x4a8,
+	.timestamp_prev1_eof_addr             = 0x4ac,
+	.err_recovery_cfg0_addr               = 0x4b0,
+	.err_recovery_cfg1_addr               = 0x4b4,
+	.err_recovery_cfg2_addr               = 0x4b8,
+	.multi_vcdt_cfg0_addr                 = 0x4bc,
+	.byte_cntr_ping_addr                  = 0x4e0,
+	.byte_cntr_pong_addr                  = 0x4e4,
+	/* configurations */
+	.halt_mode_internal                   = 0,
+	.halt_mode_global                     = 1,
+	.halt_mode_shift                      = 2,
+	.halt_frame_boundary                  = 0,
+	.resume_frame_boundary                = 1,
+	.halt_immediate                       = 2,
+	.halt_cmd_shift                       = 0,
+	.crop_v_en_shift_val                  = 6,
+	.crop_h_en_shift_val                  = 5,
+	.drop_v_en_shift_val                  = 4,
+	.drop_h_en_shift_val                  = 3,
+	.plain_fmt_shift_val                  = 10,
+	.packing_fmt_shift_val                = 30,
+	.ccif_violation_en                    = 1,
+	.overflow_ctrl_en                     = 1,
+	.overflow_ctrl_mode_val               = 0x8,
+	.timestamp_en_shift_val               = 2,
+	.format_measure_en_shift_val          = 1,
+	.fatal_err_mask                       = 0x4,
+	.non_fatal_err_mask                   = 0x2e000,
+};
+
+static struct cam_ife_csid_ver1_path_reg_info
+	cam_ife_csid_lite_480_rdi_3_reg_info = {
+	.irq_status_addr                      = 0x60,
+	.irq_mask_addr                        = 0x64,
+	.irq_clear_addr                       = 0x68,
+	.irq_set_addr                         = 0x6c,
+	.cfg0_addr                            = 0x500,
+	.cfg1_addr                            = 0x504,
+	.ctrl_addr                            = 0x508,
+	.frm_drop_pattern_addr                = 0x50c,
+	.frm_drop_period_addr                 = 0x510,
+	.irq_subsample_pattern_addr           = 0x514,
+	.irq_subsample_period_addr            = 0x518,
+	.hcrop_addr                           = 0x51c,
+	.vcrop_addr                           = 0x520,
+	.pix_drop_pattern_addr                = 0x524,
+	.pix_drop_period_addr                 = 0x528,
+	.line_drop_pattern_addr               = 0x52c,
+	.line_drop_period_addr                = 0x530,
+	.rst_strobes_addr                     = 0x540,
+	.status_addr                          = 0x550,
+	.misr_val0_addr                       = 0x554,
+	.misr_val1_addr                       = 0x558,
+	.misr_val2_addr                       = 0x55c,
+	.misr_val3_addr                       = 0x560,
+	.format_measure_cfg0_addr             = 0x570,
+	.format_measure_cfg1_addr             = 0x574,
+	.format_measure0_addr                 = 0x578,
+	.format_measure1_addr                 = 0x57c,
+	.format_measure2_addr                 = 0x580,
+	.timestamp_curr0_sof_addr             = 0x590,
+	.timestamp_curr1_sof_addr             = 0x594,
+	.timestamp_prev0_sof_addr             = 0x598,
+	.timestamp_prev1_sof_addr             = 0x59c,
+	.timestamp_curr0_eof_addr             = 0x5a0,
+	.timestamp_curr1_eof_addr             = 0x5a4,
+	.timestamp_prev0_eof_addr             = 0x5a8,
+	.timestamp_prev1_eof_addr             = 0x5ac,
+	.err_recovery_cfg0_addr               = 0x5b0,
+	.err_recovery_cfg1_addr               = 0x5b4,
+	.err_recovery_cfg2_addr               = 0x5b8,
+	.multi_vcdt_cfg0_addr                 = 0x5bc,
+	.byte_cntr_ping_addr                  = 0x5e0,
+	.byte_cntr_pong_addr                  = 0x5e4,
+	/* configurations */
+	.halt_mode_internal                   = 0,
+	.halt_mode_global                     = 1,
+	.halt_mode_shift                      = 2,
+	.halt_frame_boundary                  = 0,
+	.resume_frame_boundary                = 1,
+	.halt_immediate                       = 2,
+	.halt_cmd_shift                       = 0,
+	.crop_v_en_shift_val                  = 6,
+	.crop_h_en_shift_val                  = 5,
+	.drop_v_en_shift_val                  = 4,
+	.drop_h_en_shift_val                  = 3,
+	.plain_fmt_shift_val                  = 10,
+	.packing_fmt_shift_val                = 30,
+	.ccif_violation_en                    = 1,
+	.overflow_ctrl_en                     = 1,
+	.timestamp_en_shift_val               = 2,
+	.format_measure_en_shift_val          = 1,
+	.overflow_ctrl_mode_val               = 0x8,
+	.fatal_err_mask                       = 0x4,
+	.non_fatal_err_mask                   = 0x2e000,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_info
+	cam_ife_csid_lite_480_csi2_reg_info = {
+	.irq_status_addr                      = 0x20,
+	.irq_mask_addr                        = 0x24,
+	.irq_clear_addr                       = 0x28,
+	.irq_set_addr                         = 0x2c,
+
+	/*CSI2 rx control */
+	.cfg0_addr                            = 0x100,
+	.cfg1_addr                            = 0x104,
+	.capture_ctrl_addr                    = 0x108,
+	.rst_strobes_addr                     = 0x110,
+	.de_scramble_cfg0_addr                = 0x114,
+	.de_scramble_cfg1_addr                = 0x118,
+	.cap_unmap_long_pkt_hdr_0_addr        = 0x120,
+	.cap_unmap_long_pkt_hdr_1_addr        = 0x124,
+	.captured_short_pkt_0_addr            = 0x128,
+	.captured_short_pkt_1_addr            = 0x12c,
+	.captured_long_pkt_0_addr             = 0x130,
+	.captured_long_pkt_1_addr             = 0x134,
+	.captured_long_pkt_ftr_addr           = 0x138,
+	.captured_cphy_pkt_hdr_addr           = 0x13c,
+	.lane0_misr_addr                      = 0x150,
+	.lane1_misr_addr                      = 0x154,
+	.lane2_misr_addr                      = 0x158,
+	.lane3_misr_addr                      = 0x15c,
+	.total_pkts_rcvd_addr                 = 0x160,
+	.stats_ecc_addr                       = 0x164,
+	.total_crc_err_addr                   = 0x168,
+
+	.rst_srb_all                          = 0x3FFF,
+	.rst_done_shift_val                   = 27,
+	.irq_mask_all                         = 0xFFFFFFF,
+	.misr_enable_shift_val                = 6,
+	.vc_mode_shift_val                    = 2,
+	.capture_long_pkt_en_shift            = 0,
+	.capture_short_pkt_en_shift           = 1,
+	.capture_cphy_pkt_en_shift            = 2,
+	.capture_long_pkt_dt_shift            = 4,
+	.capture_long_pkt_vc_shift            = 10,
+	.capture_short_pkt_vc_shift           = 15,
+	.capture_cphy_pkt_dt_shift            = 20,
+	.capture_cphy_pkt_vc_shift            = 26,
+	.phy_num_mask                         = 0x7,
+	.fatal_err_mask                       = 0x59FA800,
+	.part_fatal_err_mask                  = 0x0001000,
+	.non_fatal_err_mask                   = 0x0200000,
+	.lane_num_shift                       = 0,
+	.lane_cfg_shift                       = 4,
+	.phy_type_shift                       = 24,
+	.phy_num_shift                        = 20,
+};
+
+static struct cam_ife_csid_ver1_tpg_reg_info
+		cam_ife_csid_lite_480_tpg_reg_info = {
+	/*CSID TPG control */
+	.ctrl_addr                            = 0x600,
+	.vc_cfg0_addr                         = 0x604,
+	.vc_cfg1_addr                         = 0x608,
+	.lfsr_seed_addr                       = 0x60c,
+	.dt_n_cfg_0_addr                      = 0x610,
+	.dt_n_cfg_1_addr                      = 0x614,
+	.dt_n_cfg_2_addr                      = 0x618,
+	.color_bars_cfg_addr                  = 0x640,
+	.color_box_cfg_addr                   = 0x644,
+	.common_gen_cfg_addr                  = 0x648,
+	.cgen_n_cfg_addr                      = 0x650,
+	.cgen_n_x0_addr                       = 0x654,
+	.cgen_n_x1_addr                       = 0x658,
+	.cgen_n_x2_addr                       = 0x65c,
+	.cgen_n_xy_addr                       = 0x660,
+	.cgen_n_y1_addr                       = 0x664,
+	.cgen_n_y2_addr                       = 0x668,
+
+	/* configurations */
+	.dtn_cfg_offset                       = 0xc,
+	.cgen_cfg_offset                      = 0x20,
+	.cpas_ife_reg_offset                  = 0x28,
+	.hbi                                  = 0x740,
+	.vbi                                  = 0x3FF,
+	.lfsr_seed                            = 0x12345678,
+	.ctrl_cfg                             = 0x408007,
+	.color_bar                            = 1,
+	.num_frames                           = 0,
+	.line_interleave_mode                 = 0x1,
+	.payload_mode                         = 0x8,
+	.num_active_lanes_mask                = 0x30,
+	.num_active_dt                        = 0,
+	.fmt_shift                            = 16,
+	.num_frame_shift                      = 16,
+	.width_shift                          = 16,
+	.vbi_shift                            = 12,
+	.line_interleave_shift                = 10,
+	.num_active_dt_shift                  = 8,
+	.color_bar_shift                      = 5,
+	.height_shift                         = 0,
+	.hbi_shift                            = 0,
+};
+
+static struct cam_ife_csid_ver1_common_reg_info
+	cam_ife_csid_lite_480_cmn_reg_info = {
+	.hw_version_addr                      = 0x0,
+	.cfg0_addr                            = 0x4,
+	.ctrl_addr                            = 0x8,
+	.reset_addr                           = 0xc,
+	.rst_strobes_addr                     = 0x10,
+	.test_bus_ctrl_addr                   = 0x14,
+	.top_irq_status_addr                  = 0x70,
+	.top_irq_mask_addr                    = 0x74,
+	.top_irq_clear_addr                   = 0x78,
+	.top_irq_set_addr                     = 0x7c,
+	.irq_cmd_addr                         = 0x80,
+	/*configurations */
+	.major_version                        = 4,
+	.minor_version                        = 8,
+	.version_incr                         = 0,
+	.num_rdis                             = 4,
+	.num_pix                              = 0,
+	.num_ppp                              = 0,
+	.rst_sw_reg_stb                       = 1,
+	.rst_hw_reg_stb                       = 0x1e,
+	.rst_sw_hw_reg_stb                    = 0x1f,
+	.path_rst_stb_all                     = 0x7f,
+	.rst_done_shift_val                   = 1,
+	.path_en_shift_val                    = 31,
+	.dt_id_shift_val                      = 27,
+	.vc_shift_val                         = 22,
+	.dt_shift_val                         = 16,
+	.fmt_shift_val                        = 12,
+	.crop_shift_val                       = 16,
+	.decode_format_shift_val              = 12,
+	.crop_pix_start_mask                  = 0x3fff,
+	.crop_pix_end_mask                    = 0xffff,
+	.crop_line_start_mask                 = 0x3fff,
+	.crop_line_end_mask                   = 0xffff,
+	.ipp_irq_mask_all                     = 0x7FFF,
+	.rdi_irq_mask_all                     = 0x7FFF,
+	.ppp_irq_mask_all                     = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask          = 0xC,
+	.timestamp_strobe_val                 = 0x2,
+	.timestamp_stb_sel_shift_val          = 0,
+	.format_measure_height_mask_val       = 0xFFFF,
+	.format_measure_height_shift_val      = 0x10,
+	.format_measure_width_mask_val        = 0xFFFF,
+	.format_measure_width_shift_val       = 0x0,
+};
+
+static struct cam_ife_csid_ver1_reg_info cam_ife_csid_lite_480_reg_info = {
+	.cmn_reg          = &cam_ife_csid_lite_480_cmn_reg_info,
+	.csi2_reg         = &cam_ife_csid_lite_480_csi2_reg_info,
+	.ipp_reg          = NULL,
+	.ppp_reg          = NULL,
+	.rdi_reg = {
+		&cam_ife_csid_lite_480_rdi_0_reg_info,
+		&cam_ife_csid_lite_480_rdi_1_reg_info,
+		&cam_ife_csid_lite_480_rdi_2_reg_info,
+		&cam_ife_csid_lite_480_rdi_3_reg_info,
+		},
+	.tpg_reg = &cam_ife_csid_lite_480_tpg_reg_info,
+};
+#endif /*_CAM_IFE_CSID_LITE_480_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite680.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite680.h
@@ -0,0 +1,1013 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE_680_H_
+#define _CAM_IFE_CSID_LITE_680_H_
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+static uint32_t cam_ife_csid_680_lite_num_top_regs[] = {0,};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_lite_680_rx_irq_desc[][32] = {
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "DL0_EOT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "DL1_EOT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "DL2_EOT",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "DL3_EOT",
+		},
+		{
+			.bitmask = BIT(4),
+			.desc = "DL0_SOT",
+		},
+		{
+			.bitmask = BIT(5),
+			.desc = "DL1_SOT",
+		},
+		{
+			.bitmask = BIT(6),
+			.desc = "DL2_SOT",
+		},
+		{
+			.bitmask = BIT(7),
+			.desc = "DL3_SOT",
+		},
+		{
+			.bitmask = BIT(8),
+			.desc = "LONG_PKT",
+		},
+		{
+			.bitmask = BIT(9),
+			.desc = "SHORT_PKT",
+		},
+		{
+			.bitmask = BIT(10),
+			.desc = "CPHY_PKT_HDR",
+		},
+		{
+			.bitmask = BIT(11),
+			.desc = "ERROR_CPHY_EOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(12),
+			.desc = "ERROR_CPHY_SOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(13),
+			.desc = "ERROR_CPHY_PH_CRC",
+		},
+		{
+			.bitmask = BIT(14),
+			.desc = "WARNING_ECC",
+		},
+		{
+			.bitmask = BIT(15),
+			.desc = "ERROR_LANE0_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(16),
+			.desc = "ERROR_LANE1_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(17),
+			.desc = "ERROR_LANE2_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(18),
+			.desc = "ERROR_LANE3_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(19),
+			.desc = "ERROR_CRC",
+		},
+		{
+			.bitmask = BIT(20),
+			.desc = "ERROR_ECC",
+		},
+		{
+			.bitmask = BIT(21),
+			.desc = "ERROR_MMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(22),
+			.desc = "ERROR_UNMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(23),
+			.desc = "ERROR_STREAM_UNDERFLOW",
+		},
+		{
+			.bitmask = BIT(24),
+			.desc = "ERROR_UNBOUNDED_FRAME",
+		},
+	},
+	{}
+};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_lite_680_path_irq_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "ERROR_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "CAMIF_EOF",
+	},
+	{
+		.bitmask = BIT(4),
+		.desc = "CAMIF_SOF",
+	},
+	{
+		.bitmask = BIT(5),
+		.desc = "FRAME_DROP_EOF",
+	},
+	{
+		.bitmask = BIT(6),
+		.desc = "FRAME_DROP_EOL",
+	},
+	{
+		.bitmask = BIT(7),
+		.desc = "FRAME_DROP_SOL",
+	},
+	{
+		.bitmask = BIT(8),
+		.desc = "FRAME_DROP_SOF",
+	},
+	{
+		.bitmask = BIT(9),
+		.desc = "INFO_INPUT_EOF",
+	},
+	{
+		.bitmask = BIT(10),
+		.desc = "INFO_INPUT_EOL",
+	},
+	{
+		.bitmask = BIT(11),
+		.desc = "INFO_INPUT_SOL",
+	},
+	{
+		.bitmask = BIT(12),
+		.desc = "INFO_INPUT_SOF",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(14),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(15),
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.bitmask = BIT(16),
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.bitmask = BIT(17),
+		.desc = "VCDT_GRP_CHANGE",
+	},
+	{
+		.bitmask = BIT(18),
+		.desc = "FRAME_DROP",
+	},
+	{
+		.bitmask = BIT(19),
+		.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+		.desc = "OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.bitmask = BIT(20),
+		.desc = "ERROR_REC_CCIF_VIOLATION From Camif",
+	},
+	{
+		.bitmask = BIT(21),
+		.desc = "CAMIF_EPOCH0",
+	},
+	{
+		.bitmask = BIT(22),
+		.desc = "CAMIF_EPOCH1",
+	},
+	{
+		.bitmask = BIT(23),
+		.desc = "RUP_DONE",
+	},
+	{
+		.bitmask = BIT(24),
+		.desc = "ILLEGAL_BATCH_ID",
+	},
+	{
+		.bitmask = BIT(25),
+		.desc = "BATCH_END_MISSING_VIOLATION",
+	},
+	{
+		.bitmask = BIT(26),
+		.desc = "HEIGHT_VIOLATION",
+	},
+	{
+		.bitmask = BIT(27),
+		.desc = "WIDTH_VIOLATION",
+	},
+	{
+		.bitmask = BIT(28),
+		.desc = "SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP",
+		.err_handler = cam_ife_csid_hw_ver2_mup_mismatch_handler,
+	},
+	{
+		.bitmask = BIT(29),
+		.desc = "CCIF_VIOLATION: Bad frame timings",
+	},
+};
+static struct cam_irq_register_set cam_ife_csid_lite_680_irq_reg_set[9] = {
+	/* Top */
+	{
+		.mask_reg_offset   = 0x00000080,
+		.clear_reg_offset  = 0x00000084,
+		.status_reg_offset = 0x0000007C,
+		.set_reg_offset    = 0x00000088,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	/* RX */
+	{
+		.mask_reg_offset   = 0x000000A0,
+		.clear_reg_offset  = 0x000000A4,
+		.status_reg_offset = 0x0000009C,
+	},
+	/* RDI0 */
+	{
+		.mask_reg_offset   = 0x000000F0,
+		.clear_reg_offset  = 0x000000F4,
+		.status_reg_offset = 0x000000EC,
+	},
+	/* RDI1 */
+	{
+		.mask_reg_offset   = 0x00000100,
+		.clear_reg_offset  = 0x00000104,
+		.status_reg_offset = 0x000000FC,
+	},
+	/* RDI2 */
+	{
+		.mask_reg_offset   = 0x00000110,
+		.clear_reg_offset  = 0x00000114,
+		.status_reg_offset = 0x0000010C,
+	},
+	/* RDI3 */
+	{
+		.mask_reg_offset   = 0x00000120,
+		.clear_reg_offset  = 0x00000124,
+		.status_reg_offset = 0x0000011C,
+	},
+	{}, /* no RDI4 */
+	/* IPP */
+	{
+		.mask_reg_offset   = 0x000000B0,
+		.clear_reg_offset  = 0x000000B4,
+		.status_reg_offset = 0x000000AC,
+	},
+	{}, /* no PPP */
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_680_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_lite_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP],
+	.global_irq_cmd_offset = 0x00000014,
+	.global_set_bitmask    = 0x00000010,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_680_rx_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_lite_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX], /* RX */
+	.global_irq_cmd_offset = 0,
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_680_path_irq_reg_info[6] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_0],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_1],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_2],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_3],
+		.global_irq_cmd_offset = 0,
+	},
+	{}, /* no RDI4 */
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_680_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP],
+		.global_irq_cmd_offset = 0,
+	},
+};
+
+static struct cam_irq_register_set cam_ife_csid_lite_680_buf_done_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000090,
+		.clear_reg_offset  = 0x00000094,
+		.status_reg_offset = 0x0000008C,
+	},
+};
+
+static struct cam_irq_controller_reg_info
+	cam_ife_csid_lite_680_buf_done_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = cam_ife_csid_lite_680_buf_done_irq_reg_set,
+	.global_irq_cmd_offset = 0, /* intentionally set to zero */
+};
+
+static struct cam_ife_csid_ver2_common_reg_info
+			cam_ife_csid_lite_680_cmn_reg_info = {
+	.hw_version_addr                         = 0x0,
+	.cfg0_addr                               = 0x4,
+	.global_cmd_addr                         = 0x8,
+	.reset_cfg_addr                          = 0xc,
+	.reset_cmd_addr                          = 0x10,
+	.irq_cmd_addr                            = 0x14,
+	.rup_aup_cmd_addr                        = 0x18,
+	.offline_cmd_addr                        = 0x1C,
+	.shdr_master_slave_cfg_addr              = 0x20,
+	.top_irq_status_addr                     = {0x7C,},
+	.top_irq_mask_addr                       = {0x80,},
+	.top_irq_clear_addr                      = {0x84,},
+	.top_irq_set_addr                        = {0x88,},
+	.buf_done_irq_status_addr                = 0x8C,
+	.buf_done_irq_mask_addr                  = 0x90,
+	.buf_done_irq_clear_addr                 = 0x94,
+	.buf_done_irq_set_addr                   = 0x98,
+
+	/*configurations */
+	.major_version                                = 6,
+	.minor_version                                = 8,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 4,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 0,
+	.rst_done_shift_val                           = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.crop_shift_val                               = 16,
+	.decode_format_shift_val                      = 12,
+	.decode_format1_supported                     = false,
+	.frame_id_decode_en_shift_val                 = 1,
+	.multi_vcdt_vc1_shift_val                     = 2,
+	.multi_vcdt_dt1_shift_val                     = 7,
+	.multi_vcdt_ts_combo_en_shift_val             = 13,
+	.multi_vcdt_en_shift_val                      = 0,
+	.timestamp_stb_sel_shift_val                  = 0,
+	.vfr_en_shift_val                             = 0,
+	.mup_shift_val                                = 28,
+	.early_eof_supported                          = 1,
+	.vfr_supported                                = 1,
+	.multi_vcdt_supported                         = 1,
+	.ts_comb_vcdt_en                              = true,
+	.ts_comb_vcdt_mask                            = 3,
+	.frame_id_dec_supported                       = 1,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xc,
+	.measure_pixel_line_en_mask                   = 0x3,
+	.crop_pix_start_mask                          = 0x3fff,
+	.crop_pix_end_mask                            = 0xffff,
+	.crop_line_start_mask                         = 0x3fff,
+	.crop_line_end_mask                           = 0xffff,
+	.drop_supported                               = 1,
+	.ipp_irq_mask_all                             = 0x7FFF,
+	.rdi_irq_mask_all                             = 0x7FFF,
+	.rst_loc_path_only_val                        = 0x0,
+	.rst_location_shift_val                       = 4,
+	.rst_loc_complete_csid_val                    = 0x1,
+	.rst_mode_frame_boundary_val                  = 0x0,
+	.rst_mode_immediate_val                       = 0x1,
+	.rst_cmd_hw_reset_complete_val                = 0x1,
+	.rst_cmd_sw_reset_complete_val                = 0x2,
+	.rst_cmd_irq_ctrl_only_val                    = 0x4,
+	.timestamp_strobe_val                         = 0x2,
+	.top_reset_irq_mask                           = {0x1,},
+	.top_buf_done_irq_mask                        = 0x2000,
+	.global_reset                                 = 1,
+	.rup_supported                                = 1,
+	.only_master_rup                              = 1,
+	.phy_sel_base_idx                             = 1,
+	.camif_irq_support                            = true,
+};
+
+static struct cam_ife_csid_ver2_csi2_rx_reg_info
+	cam_ife_csid_lite_680_csi2_reg_info = {
+		.irq_status_addr                      = {0x9C,},
+		.irq_mask_addr                        = {0xA0,},
+		.irq_clear_addr                       = {0xA4,},
+		.irq_set_addr                         = {0xA8,},
+		/*CSI2 rx control */
+		.cfg0_addr                            = 0x200,
+		.cfg1_addr                            = 0x204,
+		.capture_ctrl_addr                    = 0x208,
+		.rst_strobes_addr                     = 0x20C,
+		.cap_unmap_long_pkt_hdr_0_addr        = 0x210,
+		.cap_unmap_long_pkt_hdr_1_addr        = 0x214,
+		.captured_short_pkt_0_addr            = 0x218,
+		.captured_short_pkt_1_addr            = 0x21c,
+		.captured_long_pkt_0_addr             = 0x220,
+		.captured_long_pkt_1_addr             = 0x224,
+		.captured_long_pkt_ftr_addr           = 0x228,
+		.captured_cphy_pkt_hdr_addr           = 0x22c,
+		.lane0_misr_addr                      = 0x230,
+		.lane1_misr_addr                      = 0x234,
+		.lane2_misr_addr                      = 0x238,
+		.lane3_misr_addr                      = 0x23c,
+		.total_pkts_rcvd_addr                 = 0x240,
+		.stats_ecc_addr                       = 0x244,
+		.total_crc_err_addr                   = 0x248,
+		.de_scramble_type3_cfg0_addr          = 0x24C,
+		.de_scramble_type3_cfg1_addr          = 0x250,
+		.de_scramble_type2_cfg0_addr          = 0x254,
+		.de_scramble_type2_cfg1_addr          = 0x258,
+		.de_scramble_type1_cfg0_addr          = 0x25C,
+		.de_scramble_type1_cfg1_addr          = 0x260,
+		.de_scramble_type0_cfg0_addr          = 0x264,
+		.de_scramble_type0_cfg1_addr          = 0x268,
+
+		.rst_done_shift_val                   = 27,
+		.irq_mask_all                         = 0xFFFFFFF,
+		.misr_enable_shift_val                = 6,
+		.vc_mode_shift_val                    = 2,
+		.capture_long_pkt_en_shift            = 0,
+		.capture_short_pkt_en_shift           = 1,
+		.capture_cphy_pkt_en_shift            = 2,
+		.capture_long_pkt_dt_shift            = 4,
+		.capture_long_pkt_vc_shift            = 10,
+		.capture_short_pkt_vc_shift           = 15,
+		.capture_cphy_pkt_dt_shift            = 20,
+		.capture_cphy_pkt_vc_shift            = 26,
+		.phy_num_mask                         = 0xf,
+		.vc_mask                              = 0x7C00000,
+		.dt_mask                              = 0x3f0000,
+		.wc_mask                              = 0xffff,
+		.vc_shift                             = 0x16,
+		.dt_shift                             = 0x10,
+		.wc_shift                             = 0,
+		.calc_crc_mask                        = 0xffff,
+		.expected_crc_mask                    = 0xffff,
+		.calc_crc_shift                       = 0x10,
+		.ecc_correction_shift_en              = 0,
+		.lane_num_shift                       = 0,
+		.lane_cfg_shift                       = 4,
+		.phy_type_shift                       = 24,
+		.phy_num_shift                        = 20,
+		.tpg_mux_en_shift                     = 27,
+		.tpg_num_sel_shift                    = 28,
+		.phy_bist_shift_en                    = 7,
+		.epd_mode_shift_en                    = 8,
+		.eotp_shift_en                        = 9,
+		.dyn_sensor_switch_shift_en           = 10,
+		.long_pkt_strobe_rst_shift            = 0,
+		.short_pkt_strobe_rst_shift           = 1,
+		.cphy_pkt_strobe_rst_shift            = 2,
+		.unmapped_pkt_strobe_rst_shift        = 3,
+		.top_irq_mask                         = {0x4,},
+		.fatal_err_mask                       = {0x19FA800,},
+		.part_fatal_err_mask                  = {0x0001000,},
+		.non_fatal_err_mask                   = {0x0200000,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_680_ipp_reg_info = {
+		.irq_status_addr            = 0xAC,
+		.irq_mask_addr              = 0xB0,
+		.irq_clear_addr             = 0xB4,
+		.irq_set_addr               = 0xB8,
+		.cfg0_addr                  = 0x300,
+		.ctrl_addr                  = 0x304,
+		.debug_clr_cmd_addr         = 0x308,
+		.multi_vcdt_cfg0_addr       = 0x30c,
+		.cfg1_addr                  = 0x310,
+		.err_recovery_cfg0_addr     = 0x318,
+		.err_recovery_cfg1_addr     = 0x31C,
+		.err_recovery_cfg2_addr     = 0x320,
+		.camif_frame_cfg_addr       = 0x330,
+		.epoch_irq_cfg_addr         = 0x334,
+		.epoch0_subsample_ptrn_addr = 0x338,
+		.epoch1_subsample_ptrn_addr = 0x33C,
+		.debug_camif_1_addr         = 0x340,
+		.debug_camif_0_addr         = 0x344,
+		.debug_halt_status_addr     = 0x348,
+		.debug_misr_val0_addr       = 0x34C,
+		.debug_misr_val1_addr       = 0x350,
+		.debug_misr_val2_addr       = 0x354,
+		.debug_misr_val3_addr       = 0x358,
+		.hcrop_addr                 = 0x35c,
+		.vcrop_addr                 = 0x360,
+		.pix_drop_pattern_addr      = 0x364,
+		.pix_drop_period_addr       = 0x368,
+		.line_drop_pattern_addr     = 0x36C,
+		.line_drop_period_addr      = 0x370,
+		.frm_drop_pattern_addr      = 0x374,
+		.frm_drop_period_addr       = 0x378,
+		.irq_subsample_pattern_addr = 0x37C,
+		.irq_subsample_period_addr  = 0x380,
+		.format_measure_cfg0_addr   = 0x384,
+		.format_measure_cfg1_addr   = 0x388,
+		.format_measure0_addr       = 0x38C,
+		.format_measure1_addr       = 0x390,
+		.format_measure2_addr       = 0x394,
+		.timestamp_curr0_sof_addr   = 0x398,
+		.timestamp_curr1_sof_addr   = 0x39C,
+		.timestamp_perv0_sof_addr   = 0x3A0,
+		.timestamp_perv1_sof_addr   = 0x3A4,
+		.timestamp_curr0_eof_addr   = 0x3A8,
+		.timestamp_curr1_eof_addr   = 0x3AC,
+		.timestamp_perv0_eof_addr   = 0x3B0,
+		.timestamp_perv1_eof_addr   = 0x3B4,
+		.batch_period_cfg_addr      = 0x3C4,
+		.batch_stream_id_cfg_addr   = 0x3C8,
+		.epoch0_cfg_batch_id0_addr  = 0x3CC,
+		.epoch1_cfg_batch_id0_addr  = 0x3D0,
+		.epoch0_cfg_batch_id1_addr  = 0x3D4,
+		.epoch1_cfg_batch_id1_addr  = 0x3D8,
+		.epoch0_cfg_batch_id2_addr  = 0x3DC,
+		.epoch1_cfg_batch_id2_addr  = 0x3E0,
+		.epoch0_cfg_batch_id3_addr  = 0x3E4,
+		.epoch1_cfg_batch_id3_addr  = 0x3E8,
+		.epoch0_cfg_batch_id4_addr  = 0x3EC,
+		.epoch1_cfg_batch_id4_addr  = 0x3F0,
+		.epoch0_cfg_batch_id5_addr  = 0x3F4,
+		.epoch1_cfg_batch_id5_addr  = 0x3F8,
+
+		/* configurations */
+		.start_mode_internal              = 0x0,
+		.start_mode_global                = 0x1,
+		.start_mode_master                = 0x2,
+		.start_mode_slave                 = 0x3,
+		.start_mode_shift                 = 2,
+		.start_master_sel_val             = 0,
+		.start_master_sel_shift           = 4,
+		.resume_frame_boundary            = 1,
+		.crop_v_en_shift_val              = 13,
+		.crop_h_en_shift_val              = 12,
+		.drop_v_en_shift_val              = 11,
+		.drop_h_en_shift_val              = 10,
+		.pix_store_en_shift_val           = 14,
+		.early_eof_en_shift_val           = 16,
+		.format_measure_en_shift_val      = 8,
+		.timestamp_en_shift_val           = 9,
+		.overflow_ctrl_en                 = 1,
+		.overflow_ctrl_mode_val           = 0x8,
+		.min_hbi_shift_val                = 4,
+		.start_master_sel_shift_val       = 4,
+		.fatal_err_mask                   = 0x4,
+		.non_fatal_err_mask               = 0x10080000,
+		.sof_irq_mask                     = 0x10,
+		.rup_irq_mask                     = 0x800000,
+		.epoch0_irq_mask                  = 0x200000,
+		.epoch1_irq_mask                  = 0x400000,
+		.eof_irq_mask                     = 0x8,
+		.rup_aup_mask                     = 0x10001,
+		.top_irq_mask                     = {0x10,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_680_rdi_0_reg_info = {
+		.irq_status_addr            = 0xEC,
+		.irq_mask_addr              = 0xF0,
+		.irq_clear_addr             = 0xF4,
+		.irq_set_addr               = 0xF8,
+		.cfg0_addr                  = 0x500,
+		.ctrl_addr                  = 0x504,
+		.debug_clr_cmd_addr         = 0x508,
+		.multi_vcdt_cfg0_addr       = 0x50c,
+		.cfg1_addr                  = 0x510,
+		.err_recovery_cfg0_addr     = 0x514,
+		.err_recovery_cfg1_addr     = 0x518,
+		.err_recovery_cfg2_addr     = 0x51C,
+		.debug_byte_cntr_ping_addr  = 0x520,
+		.debug_byte_cntr_pong_addr  = 0x524,
+		.camif_frame_cfg_addr       = 0x528,
+		.epoch_irq_cfg_addr         = 0x52C,
+		.epoch0_subsample_ptrn_addr = 0x530,
+		.epoch1_subsample_ptrn_addr = 0x534,
+		.debug_camif_1_addr         = 0x538,
+		.debug_camif_0_addr         = 0x53C,
+		.frm_drop_pattern_addr      = 0x540,
+		.frm_drop_period_addr       = 0x540,
+		.irq_subsample_pattern_addr = 0x548,
+		.irq_subsample_period_addr  = 0x54C,
+		.hcrop_addr                 = 0x550,
+		.vcrop_addr                 = 0x554,
+		.pix_drop_pattern_addr      = 0x558,
+		.pix_drop_period_addr       = 0x55C,
+		.line_drop_pattern_addr     = 0x560,
+		.line_drop_period_addr      = 0x564,
+		.debug_halt_status_addr     = 0x568,
+		.debug_misr_val0_addr       = 0x570,
+		.debug_misr_val1_addr       = 0x574,
+		.debug_misr_val2_addr       = 0x578,
+		.debug_misr_val3_addr       = 0x57C,
+		.format_measure_cfg0_addr   = 0x580,
+		.format_measure_cfg1_addr   = 0x584,
+		.format_measure0_addr       = 0x588,
+		.format_measure1_addr       = 0x58C,
+		.format_measure2_addr       = 0x590,
+		.timestamp_curr0_sof_addr   = 0x594,
+		.timestamp_curr1_sof_addr   = 0x598,
+		.timestamp_perv0_sof_addr   = 0x59C,
+		.timestamp_perv1_sof_addr   = 0x5A0,
+		.timestamp_curr0_eof_addr   = 0x5A4,
+		.timestamp_curr1_eof_addr   = 0x5A8,
+		.timestamp_perv0_eof_addr   = 0x5AC,
+		.timestamp_perv1_eof_addr   = 0x5B0,
+		.batch_period_cfg_addr      = 0x5BC,
+		.batch_stream_id_cfg_addr   = 0x5C0,
+		.epoch0_cfg_batch_id0_addr  = 0x5C4,
+		.epoch1_cfg_batch_id0_addr  = 0x5C8,
+		.epoch0_cfg_batch_id1_addr  = 0x5CC,
+		.epoch1_cfg_batch_id1_addr  = 0x5D0,
+		.epoch0_cfg_batch_id2_addr  = 0x5D4,
+		.epoch1_cfg_batch_id2_addr  = 0x5D8,
+		.epoch0_cfg_batch_id3_addr  = 0x5DC,
+		.epoch1_cfg_batch_id3_addr  = 0x5E0,
+		.epoch0_cfg_batch_id4_addr  = 0x5E4,
+		.epoch1_cfg_batch_id4_addr  = 0x5E8,
+		.epoch0_cfg_batch_id5_addr  = 0x5EC,
+		.epoch1_cfg_batch_id5_addr  = 0x5F0,
+		/* configurations */
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 3,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x10080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x100010,
+		.top_irq_mask                   = {0x100,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_680_rdi_1_reg_info = {
+		.irq_status_addr            = 0xFC,
+		.irq_mask_addr              = 0x100,
+		.irq_clear_addr             = 0x104,
+		.irq_set_addr               = 0x108,
+		.cfg0_addr                  = 0x600,
+		.ctrl_addr                  = 0x604,
+		.debug_clr_cmd_addr         = 0x608,
+		.multi_vcdt_cfg0_addr       = 0x60c,
+		.cfg1_addr                  = 0x610,
+		.err_recovery_cfg0_addr     = 0x614,
+		.err_recovery_cfg1_addr     = 0x618,
+		.err_recovery_cfg2_addr     = 0x61C,
+		.debug_byte_cntr_ping_addr  = 0x620,
+		.debug_byte_cntr_pong_addr  = 0x624,
+		.camif_frame_cfg_addr       = 0x628,
+		.epoch_irq_cfg_addr         = 0x62C,
+		.epoch0_subsample_ptrn_addr = 0x630,
+		.epoch1_subsample_ptrn_addr = 0x634,
+		.debug_camif_1_addr         = 0x638,
+		.debug_camif_0_addr         = 0x63C,
+		.frm_drop_pattern_addr      = 0x640,
+		.frm_drop_period_addr       = 0x644,
+		.irq_subsample_pattern_addr = 0x648,
+		.irq_subsample_period_addr  = 0x64C,
+		.hcrop_addr                 = 0x650,
+		.vcrop_addr                 = 0x654,
+		.pix_drop_pattern_addr      = 0x658,
+		.pix_drop_period_addr       = 0x65C,
+		.line_drop_pattern_addr     = 0x660,
+		.line_drop_period_addr      = 0x664,
+		.debug_halt_status_addr     = 0x66C,
+		.debug_misr_val0_addr       = 0x670,
+		.debug_misr_val1_addr       = 0x674,
+		.debug_misr_val2_addr       = 0x678,
+		.debug_misr_val3_addr       = 0x67C,
+		.format_measure_cfg0_addr   = 0x680,
+		.format_measure_cfg1_addr   = 0x684,
+		.format_measure0_addr       = 0x688,
+		.format_measure1_addr       = 0x68C,
+		.format_measure2_addr       = 0x690,
+		.timestamp_curr0_sof_addr   = 0x694,
+		.timestamp_curr1_sof_addr   = 0x698,
+		.timestamp_perv0_sof_addr   = 0x69C,
+		.timestamp_perv1_sof_addr   = 0x6A0,
+		.timestamp_curr0_eof_addr   = 0x6A4,
+		.timestamp_curr1_eof_addr   = 0x6A8,
+		.timestamp_perv0_eof_addr   = 0x6AC,
+		.timestamp_perv1_eof_addr   = 0x6B0,
+		.batch_period_cfg_addr      = 0x6BC,
+		.batch_stream_id_cfg_addr   = 0x6C0,
+		.epoch0_cfg_batch_id0_addr  = 0x6C4,
+		.epoch1_cfg_batch_id0_addr  = 0x6C8,
+		.epoch0_cfg_batch_id1_addr  = 0x6CC,
+		.epoch1_cfg_batch_id1_addr  = 0x6D0,
+		.epoch0_cfg_batch_id2_addr  = 0x6D4,
+		.epoch1_cfg_batch_id2_addr  = 0x6D8,
+		.epoch0_cfg_batch_id3_addr  = 0x6DC,
+		.epoch1_cfg_batch_id3_addr  = 0x6E0,
+		.epoch0_cfg_batch_id4_addr  = 0x6E4,
+		.epoch1_cfg_batch_id4_addr  = 0x6E8,
+		.epoch0_cfg_batch_id5_addr  = 0x6EC,
+		.epoch1_cfg_batch_id5_addr  = 0x6F0,
+		/* configurations */
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 3,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x10080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x200020,
+		.top_irq_mask                   = {0x200,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_680_rdi_2_reg_info = {
+		.irq_status_addr            = 0x10C,
+		.irq_mask_addr              = 0x110,
+		.irq_clear_addr             = 0x114,
+		.irq_set_addr               = 0x118,
+		.cfg0_addr                  = 0x700,
+		.ctrl_addr                  = 0x704,
+		.debug_clr_cmd_addr         = 0x708,
+		.multi_vcdt_cfg0_addr       = 0x70c,
+		.cfg1_addr                  = 0x710,
+		.err_recovery_cfg0_addr     = 0x714,
+		.err_recovery_cfg1_addr     = 0x718,
+		.err_recovery_cfg2_addr     = 0x71C,
+		.debug_byte_cntr_ping_addr  = 0x720,
+		.debug_byte_cntr_pong_addr  = 0x724,
+		.camif_frame_cfg_addr       = 0x728,
+		.epoch_irq_cfg_addr         = 0x72C,
+		.epoch0_subsample_ptrn_addr = 0x730,
+		.epoch1_subsample_ptrn_addr = 0x734,
+		.debug_camif_1_addr         = 0x738,
+		.debug_camif_0_addr         = 0x73C,
+		.frm_drop_pattern_addr      = 0x740,
+		.frm_drop_period_addr       = 0x744,
+		.irq_subsample_pattern_addr = 0x748,
+		.irq_subsample_period_addr  = 0x74C,
+		.hcrop_addr                 = 0x750,
+		.vcrop_addr                 = 0x754,
+		.pix_drop_pattern_addr      = 0x758,
+		.pix_drop_period_addr       = 0x75C,
+		.line_drop_pattern_addr     = 0x760,
+		.line_drop_period_addr      = 0x764,
+		.debug_halt_status_addr     = 0x76C,
+		.debug_misr_val0_addr       = 0x770,
+		.debug_misr_val1_addr       = 0x774,
+		.debug_misr_val2_addr       = 0x778,
+		.debug_misr_val3_addr       = 0x77C,
+		.format_measure_cfg0_addr   = 0x780,
+		.format_measure_cfg1_addr   = 0x784,
+		.format_measure0_addr       = 0x788,
+		.format_measure1_addr       = 0x78C,
+		.format_measure2_addr       = 0x790,
+		.timestamp_curr0_sof_addr   = 0x794,
+		.timestamp_curr1_sof_addr   = 0x798,
+		.timestamp_perv0_sof_addr   = 0x79C,
+		.timestamp_perv1_sof_addr   = 0x7A0,
+		.timestamp_curr0_eof_addr   = 0x7A4,
+		.timestamp_curr1_eof_addr   = 0x7A8,
+		.timestamp_perv0_eof_addr   = 0x7AC,
+		.timestamp_perv1_eof_addr   = 0x7B0,
+		.batch_period_cfg_addr      = 0x7BC,
+		.batch_stream_id_cfg_addr   = 0x7C0,
+		.epoch0_cfg_batch_id0_addr  = 0x7C4,
+		.epoch1_cfg_batch_id0_addr  = 0x7C8,
+		.epoch0_cfg_batch_id1_addr  = 0x7CC,
+		.epoch1_cfg_batch_id1_addr  = 0x7D0,
+		.epoch0_cfg_batch_id2_addr  = 0x7D4,
+		.epoch1_cfg_batch_id2_addr  = 0x7D8,
+		.epoch0_cfg_batch_id3_addr  = 0x7DC,
+		.epoch1_cfg_batch_id3_addr  = 0x7E0,
+		.epoch0_cfg_batch_id4_addr  = 0x7E4,
+		.epoch1_cfg_batch_id4_addr  = 0x7E8,
+		.epoch0_cfg_batch_id5_addr  = 0x7EC,
+		.epoch1_cfg_batch_id5_addr  = 0x7F0,
+		/* configurations */
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 3,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x10080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x400040,
+		.top_irq_mask                   = {0x400,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_680_rdi_3_reg_info = {
+		.irq_status_addr            = 0x11C,
+		.irq_mask_addr              = 0x120,
+		.irq_clear_addr             = 0x124,
+		.irq_set_addr               = 0x128,
+		.cfg0_addr                  = 0x800,
+		.ctrl_addr                  = 0x804,
+		.debug_clr_cmd_addr         = 0x808,
+		.multi_vcdt_cfg0_addr       = 0x80c,
+		.cfg1_addr                  = 0x810,
+		.err_recovery_cfg0_addr     = 0x814,
+		.err_recovery_cfg1_addr     = 0x818,
+		.err_recovery_cfg2_addr     = 0x81C,
+		.debug_byte_cntr_ping_addr  = 0x820,
+		.debug_byte_cntr_pong_addr  = 0x824,
+		.camif_frame_cfg_addr       = 0x828,
+		.epoch_irq_cfg_addr         = 0x82C,
+		.epoch0_subsample_ptrn_addr = 0x830,
+		.epoch1_subsample_ptrn_addr = 0x834,
+		.debug_camif_1_addr         = 0x838,
+		.debug_camif_0_addr         = 0x83C,
+		.frm_drop_pattern_addr      = 0x840,
+		.frm_drop_period_addr       = 0x840,
+		.irq_subsample_pattern_addr = 0x848,
+		.irq_subsample_period_addr  = 0x84C,
+		.hcrop_addr                 = 0x850,
+		.vcrop_addr                 = 0x854,
+		.pix_drop_pattern_addr      = 0x858,
+		.pix_drop_period_addr       = 0x85C,
+		.line_drop_pattern_addr     = 0x860,
+		.line_drop_period_addr      = 0x864,
+		.debug_halt_status_addr     = 0x868,
+		.debug_misr_val0_addr       = 0x870,
+		.debug_misr_val1_addr       = 0x874,
+		.debug_misr_val2_addr       = 0x878,
+		.debug_misr_val3_addr       = 0x87C,
+		.format_measure_cfg0_addr   = 0x880,
+		.format_measure_cfg1_addr   = 0x884,
+		.format_measure0_addr       = 0x888,
+		.format_measure1_addr       = 0x88C,
+		.format_measure2_addr       = 0x890,
+		.timestamp_curr0_sof_addr   = 0x894,
+		.timestamp_curr1_sof_addr   = 0x898,
+		.timestamp_perv0_sof_addr   = 0x89C,
+		.timestamp_perv1_sof_addr   = 0x8A0,
+		.timestamp_curr0_eof_addr   = 0x8A4,
+		.timestamp_curr1_eof_addr   = 0x8A8,
+		.timestamp_perv0_eof_addr   = 0x8AC,
+		.timestamp_perv1_eof_addr   = 0x8B0,
+		.batch_period_cfg_addr      = 0x8BC,
+		.batch_stream_id_cfg_addr   = 0x8C0,
+		.epoch0_cfg_batch_id0_addr  = 0x8C4,
+		.epoch1_cfg_batch_id0_addr  = 0x8C8,
+		.epoch0_cfg_batch_id1_addr  = 0x8CC,
+		.epoch1_cfg_batch_id1_addr  = 0x8D0,
+		.epoch0_cfg_batch_id2_addr  = 0x8D4,
+		.epoch1_cfg_batch_id2_addr  = 0x8D8,
+		.epoch0_cfg_batch_id3_addr  = 0x8DC,
+		.epoch1_cfg_batch_id3_addr  = 0x8E0,
+		.epoch0_cfg_batch_id4_addr  = 0x8E4,
+		.epoch1_cfg_batch_id4_addr  = 0x8E8,
+		.epoch0_cfg_batch_id5_addr  = 0x8EC,
+		.epoch1_cfg_batch_id5_addr  = 0x8F0,
+		/* configurations */
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 3,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x10080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x800080,
+		.top_irq_mask                   = {0x800,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_lite_680_reg_info = {
+	.top_irq_reg_info      = &cam_ife_csid_lite_680_top_irq_reg_info,
+	.rx_irq_reg_info       = &cam_ife_csid_lite_680_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_lite_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_lite_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_lite_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_lite_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		NULL,
+		&cam_ife_csid_lite_680_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		},
+	.buf_done_irq_reg_info = &cam_ife_csid_lite_680_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_lite_680_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_lite_680_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_lite_680_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = NULL,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_lite_680_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_lite_680_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_lite_680_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_lite_680_rdi_3_reg_info,
+	.need_top_cfg = 0,
+	.rx_irq_desc        = &cam_ife_csid_lite_680_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_lite_680_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_680_lite_num_top_regs,
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+};
+#endif /* _CAM_IFE_CSID_LITE_680_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite690.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite690.h
@@ -0,0 +1,1147 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE_690_H_
+#define _CAM_IFE_CSID_LITE_690_H_
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+static uint32_t cam_ife_csid_690_lite_num_top_regs[] = {0,};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_lite_690_rx_irq_desc[][32] = {
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "DL0_EOT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "DL1_EOT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "DL2_EOT",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "DL3_EOT",
+		},
+		{
+			.bitmask = BIT(4),
+			.desc = "DL0_SOT",
+		},
+		{
+			.bitmask = BIT(5),
+			.desc = "DL1_SOT",
+		},
+		{
+			.bitmask = BIT(6),
+			.desc = "DL2_SOT",
+		},
+		{
+			.bitmask = BIT(7),
+			.desc = "DL3_SOT",
+		},
+		{
+			.bitmask = BIT(8),
+			.desc = "LONG_PKT",
+		},
+		{
+			.bitmask = BIT(9),
+			.desc = "SHORT_PKT",
+		},
+		{
+			.bitmask = BIT(10),
+			.desc = "CPHY_PKT_HDR",
+		},
+		{
+			.bitmask = BIT(11),
+			.desc = "ERROR_CPHY_EOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(12),
+			.desc = "ERROR_CPHY_SOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(13),
+			.desc = "ERROR_CPHY_PH_CRC",
+		},
+		{
+			.bitmask = BIT(14),
+			.desc = "WARNING_ECC",
+		},
+		{
+			.bitmask = BIT(15),
+			.desc = "ERROR_LANE0_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(16),
+			.desc = "ERROR_LANE1_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(17),
+			.desc = "ERROR_LANE2_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(18),
+			.desc = "ERROR_LANE3_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(19),
+			.desc = "ERROR_CRC",
+		},
+		{
+			.bitmask = BIT(20),
+			.desc = "ERROR_ECC",
+		},
+		{
+			.bitmask = BIT(21),
+			.desc = "ERROR_MMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(22),
+			.desc = "ERROR_UNMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(23),
+			.desc = "ERROR_STREAM_UNDERFLOW",
+		},
+		{
+			.bitmask = BIT(24),
+			.desc = "ERROR_UNBOUNDED_FRAME",
+		},
+	},
+	{}
+};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_lite_690_path_irq_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.desc = "ERROR_FREEZE_FRAME_IRQ",
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "ERROR_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "CAMIF_EOF",
+	},
+	{
+		.bitmask = BIT(4),
+		.desc = "CAMIF_SOF",
+	},
+	{
+		.bitmask = BIT(5),
+		.desc = "FRAME_DROP_EOF",
+	},
+	{
+		.bitmask = BIT(6),
+		.desc = "FRAME_DROP_EOL",
+	},
+	{
+		.bitmask = BIT(7),
+		.desc = "FRAME_DROP_SOL",
+	},
+	{
+		.bitmask = BIT(8),
+		.desc = "FRAME_DROP_SOF",
+	},
+	{
+		.bitmask = BIT(9),
+		.desc = "INFO_INPUT_EOF",
+	},
+	{
+		.bitmask = BIT(10),
+		.desc = "INFO_INPUT_EOL",
+	},
+	{
+		.bitmask = BIT(11),
+		.desc = "INFO_INPUT_SOL",
+	},
+	{
+		.bitmask = BIT(12),
+		.desc = "INFO_INPUT_SOF",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(14),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(15),
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.bitmask = BIT(16),
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.bitmask = BIT(17),
+		.desc = "VCDT_GRP_CHANGE",
+	},
+	{
+		.bitmask = BIT(18),
+		.desc = "FRAME_DROP",
+	},
+	{
+		.bitmask = BIT(19),
+		.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+		.desc = "OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.bitmask = BIT(20),
+		.desc = "ERROR_REC_CCIF_VIOLATION From Camif",
+	},
+	{
+		.bitmask = BIT(21),
+		.desc = "CAMIF_EPOCH0",
+	},
+	{
+		.bitmask = BIT(22),
+		.desc = "CAMIF_EPOCH1",
+	},
+	{
+		.bitmask = BIT(23),
+		.desc = "RUP_DONE",
+	},
+	{
+		.bitmask = BIT(24),
+		.desc = "ILLEGAL_BATCH_ID",
+	},
+	{
+		.bitmask = BIT(25),
+		.desc = "BATCH_END_MISSING_VIOLATION",
+	},
+	{
+		.bitmask = BIT(26),
+		.desc = "HEIGHT_OVERFLOW_VIOLATION",
+	},
+	{
+		.bitmask = BIT(27),
+		.desc = "WIDTH_OVERFLOW_VIOLATION",
+	},
+	{
+		.bitmask = BIT(28),
+		.desc = "HEIGHT_UNDERFLOW_VIOLATION",
+	},
+	{
+		.bitmask = BIT(29),
+		.desc = "WIDTH_UNDERFLOW_VIOLATION",
+	},
+	{
+		.bitmask = BIT(30),
+		.desc = "SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP",
+		.err_handler = cam_ife_csid_hw_ver2_mup_mismatch_handler,
+	},
+	{
+		.bitmask = BIT(31),
+		.desc = "CCIF_VIOLATION: Bad frame timings",
+	},
+};
+static struct cam_irq_register_set cam_ife_csid_lite_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_MAX] = {
+	/* Top */
+	{
+		.mask_reg_offset   = 0x00000080,
+		.clear_reg_offset  = 0x00000084,
+		.status_reg_offset = 0x0000007C,
+		.set_reg_offset    = 0x00000088,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	/* RX */
+	{
+		.mask_reg_offset   = 0x000000A0,
+		.clear_reg_offset  = 0x000000A4,
+		.status_reg_offset = 0x0000009C,
+	},
+	/* RDI0 */
+	{
+		.mask_reg_offset   = 0x000000F0,
+		.clear_reg_offset  = 0x000000F4,
+		.status_reg_offset = 0x000000EC,
+	},
+	/* RDI1 */
+	{
+		.mask_reg_offset   = 0x00000100,
+		.clear_reg_offset  = 0x00000104,
+		.status_reg_offset = 0x000000FC,
+	},
+	/* RDI2 */
+	{
+		.mask_reg_offset   = 0x00000110,
+		.clear_reg_offset  = 0x00000114,
+		.status_reg_offset = 0x0000010C,
+	},
+	/* RDI3 */
+	{
+		.mask_reg_offset   = 0x00000120,
+		.clear_reg_offset  = 0x00000124,
+		.status_reg_offset = 0x0000011C,
+	},
+	/* RDI4 */
+	{
+		.mask_reg_offset   = 0x00000130,
+		.clear_reg_offset  = 0x00000134,
+		.status_reg_offset = 0x0000012C,
+	},
+	/* RDI5 */
+	{
+		.mask_reg_offset   = 0x00000140,
+		.clear_reg_offset  = 0x00000144,
+		.status_reg_offset = 0x0000013C,
+	},
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_690_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_lite_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP],
+	.global_irq_cmd_offset = 0x00000014,
+	.global_set_bitmask    = 0x00000010,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_690_rx_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_lite_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX], /* RX */
+	.global_irq_cmd_offset = 0,
+};
+
+static struct cam_irq_controller_reg_info
+		cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_MAX] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_0],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_1],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_2],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_3],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_4],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_690_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_5],
+		.global_irq_cmd_offset = 0,
+	},
+};
+
+static struct cam_irq_register_set cam_ife_csid_lite_690_buf_done_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000090,
+		.clear_reg_offset  = 0x00000094,
+		.status_reg_offset = 0x0000008C,
+	},
+};
+
+static struct cam_irq_controller_reg_info
+	cam_ife_csid_lite_690_buf_done_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = cam_ife_csid_lite_690_buf_done_irq_reg_set,
+	.global_irq_cmd_offset = 0, /* intentionally set to zero */
+};
+
+static struct cam_ife_csid_ver2_common_reg_info
+			cam_ife_csid_lite_690_cmn_reg_info = {
+	.hw_version_addr                         = 0x0,
+	.cfg0_addr                               = 0x4,
+	.global_cmd_addr                         = 0x8,
+	.reset_cfg_addr                          = 0xC,
+	.reset_cmd_addr                          = 0x10,
+	.irq_cmd_addr                            = 0x14,
+	.rup_aup_cmd_addr                        = 0x18,
+	.offline_cmd_addr                        = 0x1C,
+	.shdr_master_slave_cfg_addr              = 0x20,
+	.top_irq_status_addr                     = {0x7C,},
+	.top_irq_mask_addr                       = {0x80,},
+	.top_irq_clear_addr                      = {0x84,},
+	.top_irq_set_addr                        = {0x88,},
+	.buf_done_irq_status_addr                = 0x8C,
+	.buf_done_irq_mask_addr                  = 0x90,
+	.buf_done_irq_clear_addr                 = 0x94,
+	.buf_done_irq_set_addr                   = 0x98,
+
+	/*configurations */
+	.major_version                                = 6,
+	.minor_version                                = 9,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 6,
+	.num_pix                                      = 0,
+	.num_ppp                                      = 0,
+	.rst_done_shift_val                           = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.crop_shift_val                               = 16,
+	.decode_format_shift_val                      = 12,
+	.decode_format1_supported                     = false,
+	.frame_id_decode_en_shift_val                 = 1,
+	.multi_vcdt_vc1_shift_val                     = 2,
+	.multi_vcdt_dt1_shift_val                     = 7,
+	.multi_vcdt_ts_combo_en_shift_val             = 13,
+	.multi_vcdt_en_shift_val                      = 0,
+	.timestamp_stb_sel_shift_val                  = 0,
+	.vfr_en_shift_val                             = 0,
+	.mup_shift_val                                = 28,
+	.early_eof_supported                          = 1,
+	.vfr_supported                                = 1,
+	.multi_vcdt_supported                         = 1,
+	.ts_comb_vcdt_en                              = true,
+	.ts_comb_vcdt_mask                            = 3,
+	.frame_id_dec_supported                       = 1,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xc,
+	.measure_pixel_line_en_mask                   = 0x3,
+	.crop_pix_start_mask                          = 0x3fff,
+	.crop_pix_end_mask                            = 0xffff,
+	.crop_line_start_mask                         = 0x3fff,
+	.crop_line_end_mask                           = 0xffff,
+	.drop_supported                               = 1,
+	.ipp_irq_mask_all                             = 0xFFFFFFFF,
+	.rdi_irq_mask_all                             = 0xFFFFFFFF,
+	.rst_loc_path_only_val                        = 0x0,
+	.rst_location_shift_val                       = 4,
+	.rst_loc_complete_csid_val                    = 0x1,
+	.rst_mode_frame_boundary_val                  = 0x0,
+	.rst_mode_immediate_val                       = 0x1,
+	.rst_cmd_hw_reset_complete_val                = 0x1,
+	.rst_cmd_sw_reset_complete_val                = 0x2,
+	.rst_cmd_irq_ctrl_only_val                    = 0x4,
+	.timestamp_strobe_val                         = 0x2,
+	.top_reset_irq_mask                           = {0x1,},
+	.top_buf_done_irq_mask                        = 0x4000,
+	.global_reset                                 = 1,
+	.rup_supported                                = 1,
+	.only_master_rup                              = 1,
+	.phy_sel_base_idx                             = 1,
+	.camif_irq_support                            = true,
+	.yuv_chroma_conversion_enable_val             = 0x8,
+};
+
+static struct cam_ife_csid_ver2_csi2_rx_reg_info
+	cam_ife_csid_lite_690_csi2_reg_info = {
+		.irq_status_addr                      = {0x9C,},
+		.irq_mask_addr                        = {0xA0,},
+		.irq_clear_addr                       = {0xA4,},
+		.irq_set_addr                         = {0xA8,},
+		/*CSI2 rx control */
+		.cfg0_addr                            = 0x200,
+		.cfg1_addr                            = 0x204,
+		.capture_ctrl_addr                    = 0x208,
+		.rst_strobes_addr                     = 0x20C,
+		.cap_unmap_long_pkt_hdr_0_addr        = 0x210,
+		.cap_unmap_long_pkt_hdr_1_addr        = 0x214,
+		.captured_short_pkt_0_addr            = 0x218,
+		.captured_short_pkt_1_addr            = 0x21C,
+		.captured_long_pkt_0_addr             = 0x220,
+		.captured_long_pkt_1_addr             = 0x224,
+		.captured_long_pkt_ftr_addr           = 0x228,
+		.captured_cphy_pkt_hdr_addr           = 0x22C,
+		.lane0_misr_addr                      = 0x230,
+		.lane1_misr_addr                      = 0x234,
+		.lane2_misr_addr                      = 0x238,
+		.lane3_misr_addr                      = 0x23C,
+		.total_pkts_rcvd_addr                 = 0x240,
+		.stats_ecc_addr                       = 0x244,
+		.total_crc_err_addr                   = 0x248,
+		.de_scramble_type3_cfg0_addr          = 0x24C,
+		.de_scramble_type3_cfg1_addr          = 0x250,
+		.de_scramble_type2_cfg0_addr          = 0x254,
+		.de_scramble_type2_cfg1_addr          = 0x258,
+		.de_scramble_type1_cfg0_addr          = 0x25C,
+		.de_scramble_type1_cfg1_addr          = 0x260,
+		.de_scramble_type0_cfg0_addr          = 0x264,
+		.de_scramble_type0_cfg1_addr          = 0x268,
+
+		.rst_done_shift_val                   = 27,
+		.irq_mask_all                         = 0xFFFFFFF,
+		.misr_enable_shift_val                = 6,
+		.vc_mode_shift_val                    = 2,
+		.capture_long_pkt_en_shift            = 0,
+		.capture_short_pkt_en_shift           = 1,
+		.capture_cphy_pkt_en_shift            = 2,
+		.capture_long_pkt_dt_shift            = 4,
+		.capture_long_pkt_vc_shift            = 10,
+		.capture_short_pkt_vc_shift           = 15,
+		.capture_cphy_pkt_dt_shift            = 20,
+		.capture_cphy_pkt_vc_shift            = 26,
+		.phy_num_mask                         = 0xf,
+		.vc_mask                              = 0x7C00000,
+		.dt_mask                              = 0x3f0000,
+		.wc_mask                              = 0xffff,
+		.vc_shift                             = 0x16,
+		.dt_shift                             = 0x10,
+		.wc_shift                             = 0,
+		.calc_crc_mask                        = 0xffff,
+		.expected_crc_mask                    = 0xffff,
+		.calc_crc_shift                       = 0x10,
+		.ecc_correction_shift_en              = 0,
+		.lane_num_shift                       = 0,
+		.lane_cfg_shift                       = 4,
+		.phy_type_shift                       = 24,
+		.phy_num_shift                        = 20,
+		.tpg_mux_en_shift                     = 27,
+		.tpg_num_sel_shift                    = 28,
+		.phy_bist_shift_en                    = 7,
+		.epd_mode_shift_en                    = 8,
+		.eotp_shift_en                        = 9,
+		.dyn_sensor_switch_shift_en           = 10,
+		.long_pkt_strobe_rst_shift            = 0,
+		.short_pkt_strobe_rst_shift           = 1,
+		.cphy_pkt_strobe_rst_shift            = 2,
+		.unmapped_pkt_strobe_rst_shift        = 3,
+		.top_irq_mask                         = {0x4,},
+		.fatal_err_mask                       = {0x19FA800,},
+		.part_fatal_err_mask                  = {0x0001000,},
+		.non_fatal_err_mask                   = {0x0200000,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_690_rdi_0_reg_info = {
+		.irq_status_addr            = 0xEC,
+		.irq_mask_addr              = 0xF0,
+		.irq_clear_addr             = 0xF4,
+		.irq_set_addr               = 0xF8,
+		.cfg0_addr                  = 0x300,
+		.ctrl_addr                  = 0x304,
+		.debug_clr_cmd_addr         = 0x308,
+		.multi_vcdt_cfg0_addr       = 0x30C,
+		.cfg1_addr                  = 0x310,
+		.err_recovery_cfg0_addr     = 0x314,
+		.err_recovery_cfg1_addr     = 0x318,
+		.err_recovery_cfg2_addr     = 0x31C,
+		.debug_byte_cntr_ping_addr  = 0x320,
+		.debug_byte_cntr_pong_addr  = 0x324,
+		.camif_frame_cfg_addr       = 0x328,
+		.epoch_irq_cfg_addr         = 0x32C,
+		.epoch0_subsample_ptrn_addr = 0x330,
+		.epoch1_subsample_ptrn_addr = 0x334,
+		.debug_camif_1_addr         = 0x338,
+		.debug_camif_0_addr         = 0x33C,
+		.frm_drop_pattern_addr      = 0x340,
+		.frm_drop_period_addr       = 0x344,
+		.irq_subsample_pattern_addr = 0x348,
+		.irq_subsample_period_addr  = 0x34C,
+		.hcrop_addr                 = 0x350,
+		.vcrop_addr                 = 0x354,
+		.pix_drop_pattern_addr      = 0x358,
+		.pix_drop_period_addr       = 0x35C,
+		.line_drop_pattern_addr     = 0x360,
+		.line_drop_period_addr      = 0x364,
+		.debug_halt_status_addr     = 0x36C,
+		.debug_misr_val0_addr       = 0x370,
+		.debug_misr_val1_addr       = 0x374,
+		.debug_misr_val2_addr       = 0x378,
+		.debug_misr_val3_addr       = 0x37C,
+		.format_measure_cfg0_addr   = 0x380,
+		.format_measure_cfg1_addr   = 0x384,
+		.format_measure0_addr       = 0x388,
+		.format_measure1_addr       = 0x38C,
+		.format_measure2_addr       = 0x390,
+		.timestamp_curr0_sof_addr   = 0x394,
+		.timestamp_curr1_sof_addr   = 0x398,
+		.timestamp_perv0_sof_addr   = 0x39C,
+		.timestamp_perv1_sof_addr   = 0x3A0,
+		.timestamp_curr0_eof_addr   = 0x3A4,
+		.timestamp_curr1_eof_addr   = 0x3A8,
+		.timestamp_perv0_eof_addr   = 0x3AC,
+		.timestamp_perv1_eof_addr   = 0x3B0,
+		.batch_period_cfg_addr      = 0x3BC,
+		.batch_stream_id_cfg_addr   = 0x3C0,
+		.epoch0_cfg_batch_id0_addr  = 0x3C4,
+		.epoch1_cfg_batch_id0_addr  = 0x3C8,
+		.epoch0_cfg_batch_id1_addr  = 0x3CC,
+		.epoch1_cfg_batch_id1_addr  = 0x3D0,
+		.epoch0_cfg_batch_id2_addr  = 0x3D4,
+		.epoch1_cfg_batch_id2_addr  = 0x3D8,
+		.epoch0_cfg_batch_id3_addr  = 0x3DC,
+		.epoch1_cfg_batch_id3_addr  = 0x3E0,
+		.epoch0_cfg_batch_id4_addr  = 0x3E4,
+		.epoch1_cfg_batch_id4_addr  = 0x3E8,
+		.epoch0_cfg_batch_id5_addr  = 0x3EC,
+		.epoch1_cfg_batch_id5_addr  = 0x3F0,
+		.frame_freeze_crc_cfg0      = 0x3F4,
+		.debug_frame_freeze_crc     = 0x3F8,
+
+		/* configurations */
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 4,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x40080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x100010,
+		.top_irq_mask                   = {0x100,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_690_rdi_1_reg_info = {
+		.irq_status_addr            = 0xFC,
+		.irq_mask_addr              = 0x100,
+		.irq_clear_addr             = 0x104,
+		.irq_set_addr               = 0x108,
+		.cfg0_addr                  = 0x400,
+		.ctrl_addr                  = 0x404,
+		.debug_clr_cmd_addr         = 0x408,
+		.multi_vcdt_cfg0_addr       = 0x40c,
+		.cfg1_addr                  = 0x410,
+		.err_recovery_cfg0_addr     = 0x414,
+		.err_recovery_cfg1_addr     = 0x418,
+		.err_recovery_cfg2_addr     = 0x41C,
+		.debug_byte_cntr_ping_addr  = 0x420,
+		.debug_byte_cntr_pong_addr  = 0x424,
+		.camif_frame_cfg_addr       = 0x428,
+		.epoch_irq_cfg_addr         = 0x42C,
+		.epoch0_subsample_ptrn_addr = 0x430,
+		.epoch1_subsample_ptrn_addr = 0x434,
+		.debug_camif_1_addr         = 0x438,
+		.debug_camif_0_addr         = 0x43C,
+		.frm_drop_pattern_addr      = 0x440,
+		.frm_drop_period_addr       = 0x444,
+		.irq_subsample_pattern_addr = 0x448,
+		.irq_subsample_period_addr  = 0x44C,
+		.hcrop_addr                 = 0x450,
+		.vcrop_addr                 = 0x454,
+		.pix_drop_pattern_addr      = 0x458,
+		.pix_drop_period_addr       = 0x45C,
+		.line_drop_pattern_addr     = 0x460,
+		.line_drop_period_addr      = 0x464,
+		.debug_halt_status_addr     = 0x46C,
+		.debug_misr_val0_addr       = 0x470,
+		.debug_misr_val1_addr       = 0x474,
+		.debug_misr_val2_addr       = 0x478,
+		.debug_misr_val3_addr       = 0x47C,
+		.format_measure_cfg0_addr   = 0x490,
+		.format_measure_cfg1_addr   = 0x484,
+		.format_measure0_addr       = 0x488,
+		.format_measure1_addr       = 0x48C,
+		.format_measure2_addr       = 0x490,
+		.timestamp_curr0_sof_addr   = 0x494,
+		.timestamp_curr1_sof_addr   = 0x498,
+		.timestamp_perv0_sof_addr   = 0x49C,
+		.timestamp_perv1_sof_addr   = 0x4A0,
+		.timestamp_curr0_eof_addr   = 0x4A4,
+		.timestamp_curr1_eof_addr   = 0x4A8,
+		.timestamp_perv0_eof_addr   = 0x4AC,
+		.timestamp_perv1_eof_addr   = 0x4B0,
+		.batch_period_cfg_addr      = 0x4BC,
+		.batch_stream_id_cfg_addr   = 0x4C0,
+		.epoch0_cfg_batch_id0_addr  = 0x4C4,
+		.epoch1_cfg_batch_id0_addr  = 0x4C8,
+		.epoch0_cfg_batch_id1_addr  = 0x4CC,
+		.epoch1_cfg_batch_id1_addr  = 0x4D0,
+		.epoch0_cfg_batch_id2_addr  = 0x4D4,
+		.epoch1_cfg_batch_id2_addr  = 0x4D8,
+		.epoch0_cfg_batch_id3_addr  = 0x4DC,
+		.epoch1_cfg_batch_id3_addr  = 0x4E0,
+		.epoch0_cfg_batch_id4_addr  = 0x4E4,
+		.epoch1_cfg_batch_id4_addr  = 0x4E8,
+		.epoch0_cfg_batch_id5_addr  = 0x4EC,
+		.epoch1_cfg_batch_id5_addr  = 0x4F0,
+		.frame_freeze_crc_cfg0      = 0x4F4,
+		.debug_frame_freeze_crc     = 0x4F8,
+
+		/* configurations */
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 4,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x40080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x200020,
+		.top_irq_mask                   = {0x200,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_690_rdi_2_reg_info = {
+		.irq_status_addr            = 0x10C,
+		.irq_mask_addr              = 0x110,
+		.irq_clear_addr             = 0x114,
+		.irq_set_addr               = 0x118,
+		.cfg0_addr                  = 0x500,
+		.ctrl_addr                  = 0x504,
+		.debug_clr_cmd_addr         = 0x508,
+		.multi_vcdt_cfg0_addr       = 0x50C,
+		.cfg1_addr                  = 0x510,
+		.err_recovery_cfg0_addr     = 0x514,
+		.err_recovery_cfg1_addr     = 0x518,
+		.err_recovery_cfg2_addr     = 0x51C,
+		.debug_byte_cntr_ping_addr  = 0x520,
+		.debug_byte_cntr_pong_addr  = 0x524,
+		.camif_frame_cfg_addr       = 0x528,
+		.epoch_irq_cfg_addr         = 0x52C,
+		.epoch0_subsample_ptrn_addr = 0x530,
+		.epoch1_subsample_ptrn_addr = 0x534,
+		.debug_camif_1_addr         = 0x538,
+		.debug_camif_0_addr         = 0x53C,
+		.frm_drop_pattern_addr      = 0x540,
+		.frm_drop_period_addr       = 0x544,
+		.irq_subsample_pattern_addr = 0x548,
+		.irq_subsample_period_addr  = 0x54C,
+		.hcrop_addr                 = 0x550,
+		.vcrop_addr                 = 0x554,
+		.pix_drop_pattern_addr      = 0x558,
+		.pix_drop_period_addr       = 0x55C,
+		.line_drop_pattern_addr     = 0x560,
+		.line_drop_period_addr      = 0x564,
+		.debug_halt_status_addr     = 0x56C,
+		.debug_misr_val0_addr       = 0x570,
+		.debug_misr_val1_addr       = 0x574,
+		.debug_misr_val2_addr       = 0x578,
+		.debug_misr_val3_addr       = 0x57C,
+		.format_measure_cfg0_addr   = 0x580,
+		.format_measure_cfg1_addr   = 0x584,
+		.format_measure0_addr       = 0x588,
+		.format_measure1_addr       = 0x58C,
+		.format_measure2_addr       = 0x590,
+		.timestamp_curr0_sof_addr   = 0x594,
+		.timestamp_curr1_sof_addr   = 0x598,
+		.timestamp_perv0_sof_addr   = 0x59C,
+		.timestamp_perv1_sof_addr   = 0x5A0,
+		.timestamp_curr0_eof_addr   = 0x5A4,
+		.timestamp_curr1_eof_addr   = 0x5A8,
+		.timestamp_perv0_eof_addr   = 0x5AC,
+		.timestamp_perv1_eof_addr   = 0x5B0,
+		.batch_period_cfg_addr      = 0x5BC,
+		.batch_stream_id_cfg_addr   = 0x5C0,
+		.epoch0_cfg_batch_id0_addr  = 0x5C4,
+		.epoch1_cfg_batch_id0_addr  = 0x5C8,
+		.epoch0_cfg_batch_id1_addr  = 0x5CC,
+		.epoch1_cfg_batch_id1_addr  = 0x5D0,
+		.epoch0_cfg_batch_id2_addr  = 0x5D4,
+		.epoch1_cfg_batch_id2_addr  = 0x5D8,
+		.epoch0_cfg_batch_id3_addr  = 0x5DC,
+		.epoch1_cfg_batch_id3_addr  = 0x5E0,
+		.epoch0_cfg_batch_id4_addr  = 0x5E4,
+		.epoch1_cfg_batch_id4_addr  = 0x5E8,
+		.epoch0_cfg_batch_id5_addr  = 0x5EC,
+		.epoch1_cfg_batch_id5_addr  = 0x5F0,
+		.frame_freeze_crc_cfg0      = 0x5F4,
+		.debug_frame_freeze_crc     = 0x5F8,
+
+		/* configurations */
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 4,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x40080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x400040,
+		.top_irq_mask                   = {0x400,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_690_rdi_3_reg_info = {
+		.irq_status_addr            = 0x11C,
+		.irq_mask_addr              = 0x120,
+		.irq_clear_addr             = 0x124,
+		.irq_set_addr               = 0x128,
+		.cfg0_addr                  = 0x600,
+		.ctrl_addr                  = 0x604,
+		.debug_clr_cmd_addr         = 0x608,
+		.multi_vcdt_cfg0_addr       = 0x60c,
+		.cfg1_addr                  = 0x610,
+		.err_recovery_cfg0_addr     = 0x614,
+		.err_recovery_cfg1_addr     = 0x618,
+		.err_recovery_cfg2_addr     = 0x61C,
+		.debug_byte_cntr_ping_addr  = 0x620,
+		.debug_byte_cntr_pong_addr  = 0x624,
+		.camif_frame_cfg_addr       = 0x628,
+		.epoch_irq_cfg_addr         = 0x62C,
+		.epoch0_subsample_ptrn_addr = 0x630,
+		.epoch1_subsample_ptrn_addr = 0x634,
+		.debug_camif_1_addr         = 0x638,
+		.debug_camif_0_addr         = 0x63C,
+		.frm_drop_pattern_addr      = 0x640,
+		.frm_drop_period_addr       = 0x644,
+		.irq_subsample_pattern_addr = 0x648,
+		.irq_subsample_period_addr  = 0x64C,
+		.hcrop_addr                 = 0x650,
+		.vcrop_addr                 = 0x654,
+		.pix_drop_pattern_addr      = 0x658,
+		.pix_drop_period_addr       = 0x65C,
+		.line_drop_pattern_addr     = 0x660,
+		.line_drop_period_addr      = 0x664,
+		.yuv_chroma_conversion_addr = 0x668,
+		.debug_halt_status_addr     = 0x66C,
+		.debug_misr_val0_addr       = 0x670,
+		.debug_misr_val1_addr       = 0x674,
+		.debug_misr_val2_addr       = 0x678,
+		.debug_misr_val3_addr       = 0x67C,
+		.format_measure_cfg0_addr   = 0x680,
+		.format_measure_cfg1_addr   = 0x684,
+		.format_measure0_addr       = 0x688,
+		.format_measure1_addr       = 0x68C,
+		.format_measure2_addr       = 0x690,
+		.timestamp_curr0_sof_addr   = 0x694,
+		.timestamp_curr1_sof_addr   = 0x698,
+		.timestamp_perv0_sof_addr   = 0x69C,
+		.timestamp_perv1_sof_addr   = 0x6A0,
+		.timestamp_curr0_eof_addr   = 0x6A4,
+		.timestamp_curr1_eof_addr   = 0x6A8,
+		.timestamp_perv0_eof_addr   = 0x6AC,
+		.timestamp_perv1_eof_addr   = 0x6B0,
+		.batch_period_cfg_addr      = 0x6BC,
+		.batch_stream_id_cfg_addr   = 0x6C0,
+		.epoch0_cfg_batch_id0_addr  = 0x6C4,
+		.epoch1_cfg_batch_id0_addr  = 0x6C8,
+		.epoch0_cfg_batch_id1_addr  = 0x6CC,
+		.epoch1_cfg_batch_id1_addr  = 0x6D0,
+		.epoch0_cfg_batch_id2_addr  = 0x6D4,
+		.epoch1_cfg_batch_id2_addr  = 0x6D8,
+		.epoch0_cfg_batch_id3_addr  = 0x6DC,
+		.epoch1_cfg_batch_id3_addr  = 0x6E0,
+		.epoch0_cfg_batch_id4_addr  = 0x6E4,
+		.epoch1_cfg_batch_id4_addr  = 0x6E8,
+		.epoch0_cfg_batch_id5_addr  = 0x6EC,
+		.epoch1_cfg_batch_id5_addr  = 0x6F0,
+		.frame_freeze_crc_cfg0      = 0x6F4,
+		.debug_frame_freeze_crc     = 0x6F8,
+
+		/* configurations */
+		.capabilities                   = CAM_IFE_CSID_CAP_YUV_CHROMA_CONVERSION,
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 4,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x40080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x800080,
+		.top_irq_mask                   = {0x800,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_690_rdi_4_reg_info = {
+		.irq_status_addr            = 0x12C,
+		.irq_mask_addr              = 0x130,
+		.irq_clear_addr             = 0x134,
+		.irq_set_addr               = 0x138,
+		.cfg0_addr                  = 0x700,
+		.ctrl_addr                  = 0x704,
+		.debug_clr_cmd_addr         = 0x708,
+		.multi_vcdt_cfg0_addr       = 0x70c,
+		.cfg1_addr                  = 0x710,
+		.err_recovery_cfg0_addr     = 0x714,
+		.err_recovery_cfg1_addr     = 0x718,
+		.err_recovery_cfg2_addr     = 0x71C,
+		.debug_byte_cntr_ping_addr  = 0x720,
+		.debug_byte_cntr_pong_addr  = 0x724,
+		.camif_frame_cfg_addr       = 0x728,
+		.epoch_irq_cfg_addr         = 0x72C,
+		.epoch0_subsample_ptrn_addr = 0x730,
+		.epoch1_subsample_ptrn_addr = 0x734,
+		.debug_camif_1_addr         = 0x738,
+		.debug_camif_0_addr         = 0x73C,
+		.frm_drop_pattern_addr      = 0x740,
+		.frm_drop_period_addr       = 0x744,
+		.irq_subsample_pattern_addr = 0x748,
+		.irq_subsample_period_addr  = 0x74C,
+		.hcrop_addr                 = 0x750,
+		.vcrop_addr                 = 0x754,
+		.pix_drop_pattern_addr      = 0x758,
+		.pix_drop_period_addr       = 0x75C,
+		.line_drop_pattern_addr     = 0x760,
+		.line_drop_period_addr      = 0x764,
+		.debug_halt_status_addr     = 0x76C,
+		.debug_misr_val0_addr       = 0x770,
+		.debug_misr_val1_addr       = 0x774,
+		.debug_misr_val2_addr       = 0x778,
+		.debug_misr_val3_addr       = 0x77C,
+		.format_measure_cfg0_addr   = 0x780,
+		.format_measure_cfg1_addr   = 0x784,
+		.format_measure0_addr       = 0x788,
+		.format_measure1_addr       = 0x78C,
+		.format_measure2_addr       = 0x790,
+		.timestamp_curr0_sof_addr   = 0x794,
+		.timestamp_curr1_sof_addr   = 0x798,
+		.timestamp_perv0_sof_addr   = 0x79C,
+		.timestamp_perv1_sof_addr   = 0x7A0,
+		.timestamp_curr0_eof_addr   = 0x7A4,
+		.timestamp_curr1_eof_addr   = 0x7A8,
+		.timestamp_perv0_eof_addr   = 0x7AC,
+		.timestamp_perv1_eof_addr   = 0x7B0,
+		.batch_period_cfg_addr      = 0x7BC,
+		.batch_stream_id_cfg_addr   = 0x7C0,
+		.epoch0_cfg_batch_id0_addr  = 0x7C4,
+		.epoch1_cfg_batch_id0_addr  = 0x7C8,
+		.epoch0_cfg_batch_id1_addr  = 0x7CC,
+		.epoch1_cfg_batch_id1_addr  = 0x7D0,
+		.epoch0_cfg_batch_id2_addr  = 0x7D4,
+		.epoch1_cfg_batch_id2_addr  = 0x7D8,
+		.epoch0_cfg_batch_id3_addr  = 0x7DC,
+		.epoch1_cfg_batch_id3_addr  = 0x7E0,
+		.epoch0_cfg_batch_id4_addr  = 0x7E4,
+		.epoch1_cfg_batch_id4_addr  = 0x7E8,
+		.epoch0_cfg_batch_id5_addr  = 0x7EC,
+		.epoch1_cfg_batch_id5_addr  = 0x7F0,
+		.frame_freeze_crc_cfg0      = 0x7F4,
+		.debug_frame_freeze_crc     = 0x7F8,
+
+		/* configurations */
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 4,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x40080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x1000100,
+		.top_irq_mask                   = {0x1000,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_690_rdi_5_reg_info = {
+		.irq_status_addr            = 0x13C,
+		.irq_mask_addr              = 0x130,
+		.irq_clear_addr             = 0x134,
+		.irq_set_addr               = 0x138,
+		.cfg0_addr                  = 0x800,
+		.ctrl_addr                  = 0x804,
+		.debug_clr_cmd_addr         = 0x808,
+		.multi_vcdt_cfg0_addr       = 0x80c,
+		.cfg1_addr                  = 0x810,
+		.err_recovery_cfg0_addr     = 0x814,
+		.err_recovery_cfg1_addr     = 0x818,
+		.err_recovery_cfg2_addr     = 0x81C,
+		.debug_byte_cntr_ping_addr  = 0x820,
+		.debug_byte_cntr_pong_addr  = 0x824,
+		.camif_frame_cfg_addr       = 0x828,
+		.epoch_irq_cfg_addr         = 0x82C,
+		.epoch0_subsample_ptrn_addr = 0x830,
+		.epoch1_subsample_ptrn_addr = 0x834,
+		.debug_camif_1_addr         = 0x838,
+		.debug_camif_0_addr         = 0x83C,
+		.frm_drop_pattern_addr      = 0x840,
+		.frm_drop_period_addr       = 0x844,
+		.irq_subsample_pattern_addr = 0x848,
+		.irq_subsample_period_addr  = 0x84C,
+		.hcrop_addr                 = 0x850,
+		.vcrop_addr                 = 0x854,
+		.pix_drop_pattern_addr      = 0x858,
+		.pix_drop_period_addr       = 0x85C,
+		.line_drop_pattern_addr     = 0x860,
+		.line_drop_period_addr      = 0x864,
+		.yuv_chroma_conversion_addr = 0x868,
+		.debug_halt_status_addr     = 0x86C,
+		.debug_misr_val0_addr       = 0x870,
+		.debug_misr_val1_addr       = 0x874,
+		.debug_misr_val2_addr       = 0x878,
+		.debug_misr_val3_addr       = 0x87C,
+		.format_measure_cfg0_addr   = 0x880,
+		.format_measure_cfg1_addr   = 0x884,
+		.format_measure0_addr       = 0x888,
+		.format_measure1_addr       = 0x88C,
+		.format_measure2_addr       = 0x890,
+		.timestamp_curr0_sof_addr   = 0x894,
+		.timestamp_curr1_sof_addr   = 0x898,
+		.timestamp_perv0_sof_addr   = 0x89C,
+		.timestamp_perv1_sof_addr   = 0x8A0,
+		.timestamp_curr0_eof_addr   = 0x8A4,
+		.timestamp_curr1_eof_addr   = 0x8A8,
+		.timestamp_perv0_eof_addr   = 0x8AC,
+		.timestamp_perv1_eof_addr   = 0x8B0,
+		.batch_period_cfg_addr      = 0x8BC,
+		.batch_stream_id_cfg_addr   = 0x8C0,
+		.epoch0_cfg_batch_id0_addr  = 0x8C4,
+		.epoch1_cfg_batch_id0_addr  = 0x8C8,
+		.epoch0_cfg_batch_id1_addr  = 0x8CC,
+		.epoch1_cfg_batch_id1_addr  = 0x8D0,
+		.epoch0_cfg_batch_id2_addr  = 0x8D4,
+		.epoch1_cfg_batch_id2_addr  = 0x8D8,
+		.epoch0_cfg_batch_id3_addr  = 0x8DC,
+		.epoch1_cfg_batch_id3_addr  = 0x8E0,
+		.epoch0_cfg_batch_id4_addr  = 0x8E4,
+		.epoch1_cfg_batch_id4_addr  = 0x8E8,
+		.epoch0_cfg_batch_id5_addr  = 0x8EC,
+		.epoch1_cfg_batch_id5_addr  = 0x8F0,
+		.frame_freeze_crc_cfg0      = 0x8F4,
+		.debug_frame_freeze_crc     = 0x8F8,
+
+		/* configurations */
+		.capabilities                   = CAM_IFE_CSID_CAP_YUV_CHROMA_CONVERSION,
+		.resume_frame_boundary          = 1,
+		.overflow_ctrl_en               = 1,
+		.overflow_ctrl_mode_val         = 0x8,
+		.mipi_pack_supported            = 1,
+		.packing_fmt_shift_val          = 15,
+		.plain_alignment_shift_val      = 11,
+		.plain_fmt_shift_val            = 12,
+		.crop_v_en_shift_val            = 8,
+		.crop_h_en_shift_val            = 7,
+		.drop_v_en_shift_val            = 6,
+		.drop_h_en_shift_val            = 5,
+		.early_eof_en_shift_val         = 14,
+		.format_measure_en_shift_val    = 4,
+		.timestamp_en_shift_val         = 4,
+		.debug_byte_cntr_rst_shift_val  = 2,
+		.ccif_violation_en              = 1,
+		.fatal_err_mask                 = 0x4,
+		.non_fatal_err_mask             = 0x40080000,
+		.sof_irq_mask                   = 0x10,
+		.rup_irq_mask                   = 0x800000,
+		.epoch0_irq_mask                = 0x200000,
+		.epoch1_irq_mask                = 0x400000,
+		.eof_irq_mask                   = 0x8,
+		.rup_aup_mask                   = 0x2000200,
+		.top_irq_mask                   = {0x2000,},
+		.epoch0_shift_val               = 16,
+		.epoch1_shift_val               = 0,
+};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_lite_690_reg_info = {
+	.top_irq_reg_info      = &cam_ife_csid_lite_690_top_irq_reg_info,
+	.rx_irq_reg_info       = &cam_ife_csid_lite_690_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_4],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_5],
+		},
+	.buf_done_irq_reg_info = &cam_ife_csid_lite_690_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_lite_690_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_lite_690_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = NULL,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = NULL,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_lite_690_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_lite_690_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_lite_690_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_lite_690_rdi_3_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_4] = &cam_ife_csid_lite_690_rdi_4_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_5] = &cam_ife_csid_lite_690_rdi_5_reg_info,
+	.need_top_cfg = 0,
+	.rx_irq_desc        = &cam_ife_csid_lite_690_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_lite_690_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_690_lite_num_top_regs,
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+};
+#endif /* _CAM_IFE_CSID_LITE_690_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite692.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite692.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE_692_H_
+#define _CAM_IFE_CSID_LITE_692_H_
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_lite_692_reg_info = {
+	.top_irq_reg_info      = &cam_ife_csid_lite_690_top_irq_reg_info,
+	.rx_irq_reg_info       = &cam_ife_csid_lite_690_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_4],
+		&cam_ife_csid_lite_690_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_5],
+		},
+	.buf_done_irq_reg_info = &cam_ife_csid_lite_690_buf_done_irq_reg_info,
+	.cmn_reg                              = &cam_ife_csid_lite_690_cmn_reg_info,
+	.csi2_reg                             = &cam_ife_csid_lite_690_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = NULL,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = NULL,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_lite_690_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_lite_690_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_lite_690_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_lite_690_rdi_3_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_4] = &cam_ife_csid_lite_690_rdi_4_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_5] = &cam_ife_csid_lite_690_rdi_5_reg_info,
+	.need_top_cfg = 0,
+	.rx_irq_desc        = &cam_ife_csid_lite_690_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_lite_690_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_690_lite_num_top_regs,
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+};
+#endif /* _CAM_IFE_CSID_LITE_692_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite780.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite780.h
@@ -0,0 +1,1062 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE_780_H_
+#define _CAM_IFE_CSID_LITE_780_H_
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_lite_780_rx_irq_desc[][32] = {
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "DL0_EOT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "DL1_EOT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "DL2_EOT",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "DL3_EOT",
+		},
+		{
+			.bitmask = BIT(4),
+			.desc = "DL0_SOT",
+		},
+		{
+			.bitmask = BIT(5),
+			.desc = "DL1_SOT",
+		},
+		{
+			.bitmask = BIT(6),
+			.desc = "DL2_SOT",
+		},
+		{
+			.bitmask = BIT(7),
+			.desc = "DL3_SOT",
+		},
+		{
+			.bitmask = BIT(8),
+			.desc = "LONG_PKT",
+		},
+		{
+			.bitmask = BIT(9),
+			.desc = "SHORT_PKT",
+		},
+		{
+			.bitmask = BIT(10),
+			.desc = "CPHY_PKT_HDR",
+		},
+		{
+			.bitmask = BIT(11),
+			.desc = "ERROR_CPHY_EOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(12),
+			.desc = "ERROR_CPHY_SOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(13),
+			.desc = "ERROR_CPHY_PH_CRC",
+		},
+		{
+			.bitmask = BIT(14),
+			.desc = "WARNING_ECC",
+		},
+		{
+			.bitmask = BIT(15),
+			.desc = "ERROR_LANE0_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(16),
+			.desc = "ERROR_LANE1_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(17),
+			.desc = "ERROR_LANE2_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(18),
+			.desc = "ERROR_LANE3_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(19),
+			.desc = "ERROR_CRC",
+		},
+		{
+			.bitmask = BIT(20),
+			.desc = "ERROR_ECC",
+		},
+		{
+			.bitmask = BIT(21),
+			.desc = "ERROR_MMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(22),
+			.desc = "ERROR_UNMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(23),
+			.desc = "ERROR_STREAM_UNDERFLOW",
+		},
+		{
+			.bitmask = BIT(24),
+			.desc = "ERROR_UNBOUNDED_FRAME",
+		},
+	},
+};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_lite_780_path_irq_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FATAL,
+		.desc = "ILLEGAL_PROGRAMMING",
+		.err_handler = cam_ife_csid_ver2_print_illegal_programming_irq_status,
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "EROOR_MSG_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "ERROR_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "CAMIF_EOF",
+	},
+	{
+		.bitmask = BIT(4),
+		.desc = "CAMIF_SOF",
+	},
+	{
+		.bitmask = BIT(5),
+		.desc = "FRAME_DROP_EOF",
+	},
+	{
+		.bitmask = BIT(6),
+		.desc = "FRAME_DROP_EOL",
+	},
+	{
+		.bitmask = BIT(7),
+		.desc = "FRAME_DROP_SOL",
+	},
+	{
+		.bitmask = BIT(8),
+		.desc = "FRAME_DROP_SOF",
+	},
+	{
+		.bitmask = BIT(9),
+		.desc = "INFO_INPUT_EOF",
+	},
+	{
+		.bitmask = BIT(10),
+		.desc = "INFO_INPUT_EOL",
+	},
+	{
+		.bitmask = BIT(11),
+		.desc = "INFO_INPUT_SOL",
+	},
+	{
+		.bitmask = BIT(12),
+		.desc = "INFO_INPUT_SOF",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(14),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_LINE_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(15),
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.bitmask = BIT(16),
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.bitmask = BIT(17),
+		.desc = "VCDT_GRP_CHANGE",
+	},
+	{
+		.bitmask = BIT(18),
+		.desc = "FRAME_DROP",
+	},
+	{
+		.bitmask = BIT(19),
+		.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+		.desc = "OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.bitmask = BIT(20),
+		.desc = "ERROR_REC_CCIF_VIOLATION From Camif",
+	},
+	{
+		.bitmask = BIT(21),
+		.desc = "CAMIF_EPOCH0",
+	},
+	{
+		.bitmask = BIT(22),
+		.desc = "CAMIF_EPOCH1",
+	},
+	{
+		.bitmask = BIT(23),
+		.desc = "RUP_DONE",
+	},
+	{
+		.bitmask = BIT(24),
+		.desc = "ILLEGAL_BATCH_ID",
+	},
+	{
+		.bitmask = BIT(25),
+		.desc = "BATCH_END_MISSING_VIOLATION",
+	},
+	{
+		.bitmask = BIT(26),
+		.desc = "HEIGHT_VIOLATION",
+	},
+	{
+		.bitmask = BIT(27),
+		.desc = "WIDTH_VIOLATION",
+	},
+	{
+		.bitmask = BIT(28),
+		.desc = "SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP",
+		.err_handler = cam_ife_csid_hw_ver2_mup_mismatch_handler,
+	},
+	{
+		.bitmask = BIT(29),
+		.desc = "CCIF_VIOLATION: Bad frame timings",
+	},
+};
+
+static const struct cam_ife_csid_top_irq_desc cam_ife_csid_lite_780_top_irq_desc[][32] = {
+	{
+		{
+			.bitmask  = BIT(1),
+			.err_type = CAM_ISP_HW_ERROR_CSID_SENSOR_SWITCH_ERROR,
+			.err_name = "FATAL_SENSOR_SWITCHING_IRQ",
+			.desc = "Fatal Error duirng dynamically switching between 2 sensors",
+		},
+		{
+			.bitmask  = BIT(18),
+			.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+			.err_name = "ERROR_NO_VOTE_DN",
+			.desc = "vote_up is asserted before IDLE is encountered in a frame",
+		},
+		{
+			.bitmask  = BIT(19),
+			.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+			.err_name = "ERROR_VOTE_UP_LATE",
+			.desc = "vote_up is asserted at the same time as an SOF",
+		},
+		{
+			.bitmask  = BIT(20),
+			.err_type = CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW,
+			.err_name = "ERROR_RDI_LINE_BUFFER_CONFLICT",
+			.desc = "Two or more RDIs programmed to access the shared line buffer",
+			.err_handler = cam_ife_csid_hw_ver2_rdi_line_buffer_conflict_handler,
+		},
+	},
+};
+
+static const uint32_t cam_ife_csid_lite_780_num_top_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_lite_780_top_irq_desc[0]),
+};
+static const uint32_t cam_ife_csid_lite_780_num_rx_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_lite_780_rx_irq_desc[0]),
+};
+
+static struct cam_irq_register_set cam_ife_csid_lite_780_irq_reg_set[9] = {
+	/* Top */
+	{
+		.mask_reg_offset   = 0x00000080,
+		.clear_reg_offset  = 0x00000084,
+		.status_reg_offset = 0x0000007C,
+		.set_reg_offset    = 0x00000088,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	/* RX */
+	{
+		.mask_reg_offset   = 0x000000A0,
+		.clear_reg_offset  = 0x000000A4,
+		.status_reg_offset = 0x0000009C,
+	},
+	/* RDI0 */
+	{
+		.mask_reg_offset   = 0x000000F0,
+		.clear_reg_offset  = 0x000000F4,
+		.status_reg_offset = 0x000000EC,
+	},
+	/* RDI1 */
+	{
+		.mask_reg_offset   = 0x00000100,
+		.clear_reg_offset  = 0x00000104,
+		.status_reg_offset = 0x000000FC,
+	},
+	/* RDI2 */
+	{
+		.mask_reg_offset   = 0x00000110,
+		.clear_reg_offset  = 0x00000114,
+		.status_reg_offset = 0x0000010C,
+	},
+	/* RDI3 */
+	{
+		.mask_reg_offset   = 0x00000120,
+		.clear_reg_offset  = 0x00000124,
+		.status_reg_offset = 0x0000011C,
+	},
+	{}, /* no RDI4 */
+	/* IPP */
+	{
+		.mask_reg_offset   = 0x000000B0,
+		.clear_reg_offset  = 0x000000B4,
+		.status_reg_offset = 0x000000AC,
+	},
+	{}, /* no PPP */
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_780_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_lite_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP],
+	.global_irq_cmd_offset = 0x00000014,
+	.global_set_bitmask    = 0x00000010,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_780_rx_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_lite_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX], /* RX */
+	.global_irq_cmd_offset = 0,
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_780_path_irq_reg_info[6] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_0],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_1],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_2],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_3],
+		.global_irq_cmd_offset = 0,
+	},
+	{}, /* no RDI4 */
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_780_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP],
+		.global_irq_cmd_offset = 0,
+	},
+};
+
+
+static struct cam_irq_register_set cam_ife_csid_lite_780_buf_done_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000090,
+		.clear_reg_offset  = 0x00000094,
+		.status_reg_offset = 0x0000008C,
+	},
+};
+
+static struct cam_irq_controller_reg_info
+	cam_ife_csid_lite_780_buf_done_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = cam_ife_csid_lite_780_buf_done_irq_reg_set,
+	.global_irq_cmd_offset  = 0, /* intentionally set to zero */
+};
+
+static struct cam_ife_csid_ver2_common_reg_info
+			cam_ife_csid_lite_780_cmn_reg_info = {
+	.hw_version_addr                              = 0x0,
+	.cfg0_addr                                    = 0x4,
+	.global_cmd_addr                              = 0x8,
+	.reset_cfg_addr                               = 0xc,
+	.reset_cmd_addr                               = 0x10,
+	.irq_cmd_addr                                 = 0x14,
+	.rup_aup_cmd_addr                             = 0x18,
+	.offline_cmd_addr                             = 0x1C,
+	.shdr_master_slave_cfg_addr                   = 0x20,
+	.top_irq_status_addr                          = {0x7C,},
+	.top_irq_mask_addr                            = {0x80,},
+	.top_irq_clear_addr                           = {0x84,},
+	.top_irq_set_addr                             = {0x88,},
+	.buf_done_irq_status_addr                     = 0x8C,
+	.buf_done_irq_mask_addr                       = 0x90,
+	.buf_done_irq_clear_addr                      = 0x94,
+	.buf_done_irq_set_addr                        = 0x98,
+
+	/*configurations */
+	.major_version                                = 6,
+	.minor_version                                = 8,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 4,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 0,
+	.rst_done_shift_val                           = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.vc_mask                                      = 0x1F,
+	.dt_shift_val                                 = 16,
+	.dt_mask                                      = 0x3F,
+	.crop_shift_val                               = 16,
+	.decode_format_shift_val                      = 12,
+	.decode_format1_shift_val                     = 16,
+	.decode_format_mask                           = 0xF,
+	.decode_format1_supported                     = true,
+	.frame_id_decode_en_shift_val                 = 1,
+	.multi_vcdt_vc1_shift_val                     = 2,
+	.multi_vcdt_dt1_shift_val                     = 7,
+	.multi_vcdt_ts_combo_en_shift_val             = 13,
+	.multi_vcdt_en_shift_val                      = 0,
+	.timestamp_stb_sel_shift_val                  = 8,
+	.vfr_en_shift_val                             = 0,
+	.early_eof_supported                          = 1,
+	.vfr_supported                                = 1,
+	.mup_shift_val                                = 28,
+	.multi_vcdt_supported                         = 1,
+	.ts_comb_vcdt_en                              = true,
+	.ts_comb_vcdt_mask                            = 3,
+	.frame_id_dec_supported                       = 1,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xc,
+	.measure_pixel_line_en_mask                   = 0x3,
+	.crop_pix_start_mask                          = 0x3fff,
+	.crop_pix_end_mask                            = 0xffff,
+	.crop_line_start_mask                         = 0x3fff,
+	.crop_line_end_mask                           = 0xffff,
+	.drop_supported                               = 1,
+	.ipp_irq_mask_all                             = 0x7FFF,
+	.rdi_irq_mask_all                             = 0x7FFF,
+	.rst_loc_path_only_val                        = 0x0,
+	.rst_location_shift_val                       = 4,
+	.rst_loc_complete_csid_val                    = 0x1,
+	.rst_mode_frame_boundary_val                  = 0x0,
+	.rst_mode_immediate_val                       = 0x1,
+	.rst_cmd_hw_reset_complete_val                = 0x1,
+	.rst_cmd_sw_reset_complete_val                = 0x2,
+	.rst_cmd_irq_ctrl_only_val                    = 0x4,
+	.timestamp_strobe_val                         = 0x2,
+	.global_reset                                 = 1,
+	.rup_supported                                = 1,
+	.only_master_rup                              = 1,
+	.format_measure_height_mask_val               = 0xFFFF,
+	.format_measure_height_shift_val              = 0x10,
+	.format_measure_width_mask_val                = 0xFFFF,
+	.format_measure_width_shift_val               = 0x0,
+	.top_reset_irq_mask = {
+		0x1,
+	},
+	.top_buf_done_irq_mask                        = 0x2000,
+	.decode_format_payload_only                   = 0xF,
+	.phy_sel_base_idx                             = 1,
+	.timestamp_enabled_in_cfg0                    = true,
+	.camif_irq_support                            = true,
+};
+
+static struct cam_ife_csid_ver2_csi2_rx_reg_info
+	cam_ife_csid_lite_780_csi2_reg_info = {
+		.irq_status_addr                      = {0x9C,},
+		.irq_mask_addr                        = {0xA0,},
+		.irq_clear_addr                       = {0xA4,},
+		.irq_set_addr                         = {0xA8,},
+		/*CSI2 rx control */
+		.cfg0_addr                            = 0x200,
+		.cfg1_addr                            = 0x204,
+		.capture_ctrl_addr                    = 0x208,
+		.rst_strobes_addr                     = 0x20C,
+		.cap_unmap_long_pkt_hdr_0_addr        = 0x210,
+		.cap_unmap_long_pkt_hdr_1_addr        = 0x214,
+		.captured_short_pkt_0_addr            = 0x218,
+		.captured_short_pkt_1_addr            = 0x21c,
+		.captured_long_pkt_0_addr             = 0x220,
+		.captured_long_pkt_1_addr             = 0x224,
+		.captured_long_pkt_ftr_addr           = 0x228,
+		.captured_cphy_pkt_hdr_addr           = 0x22c,
+		.lane0_misr_addr                      = 0x230,
+		.lane1_misr_addr                      = 0x234,
+		.lane2_misr_addr                      = 0x238,
+		.lane3_misr_addr                      = 0x23c,
+		.total_pkts_rcvd_addr                 = 0x240,
+		.stats_ecc_addr                       = 0x244,
+		.total_crc_err_addr                   = 0x248,
+		.de_scramble_type3_cfg0_addr          = 0x24C,
+		.de_scramble_type3_cfg1_addr          = 0x250,
+		.de_scramble_type2_cfg0_addr          = 0x254,
+		.de_scramble_type2_cfg1_addr          = 0x258,
+		.de_scramble_type1_cfg0_addr          = 0x25C,
+		.de_scramble_type1_cfg1_addr          = 0x260,
+		.de_scramble_type0_cfg0_addr          = 0x264,
+		.de_scramble_type0_cfg1_addr          = 0x268,
+
+		.rst_done_shift_val                   = 27,
+		.irq_mask_all                         = 0xFFFFFFF,
+		.misr_enable_shift_val                = 6,
+		.vc_mode_shift_val                    = 2,
+		.capture_long_pkt_en_shift            = 0,
+		.capture_short_pkt_en_shift           = 1,
+		.capture_cphy_pkt_en_shift            = 2,
+		.capture_long_pkt_dt_shift            = 4,
+		.capture_long_pkt_vc_shift            = 10,
+		.capture_short_pkt_vc_shift           = 15,
+		.capture_cphy_pkt_dt_shift            = 20,
+		.capture_cphy_pkt_vc_shift            = 26,
+		.phy_num_mask                         = 0xf,
+		.vc_mask                              = 0x7C00000,
+		.dt_mask                              = 0x3f0000,
+		.wc_mask                              = 0xffff,
+		.vc_shift                             = 0x16,
+		.dt_shift                             = 0x10,
+		.wc_shift                             = 0,
+		.calc_crc_mask                        = 0xffff,
+		.expected_crc_mask                    = 0xffff,
+		.calc_crc_shift                       = 0x10,
+		.ecc_correction_shift_en              = 0,
+		.lane_num_shift                       = 0,
+		.lane_cfg_shift                       = 4,
+		.phy_type_shift                       = 24,
+		.phy_num_shift                        = 20,
+		.tpg_mux_en_shift                     = 27,
+		.tpg_num_sel_shift                    = 28,
+		.phy_bist_shift_en                    = 7,
+		.epd_mode_shift_en                    = 8,
+		.eotp_shift_en                        = 9,
+		.dyn_sensor_switch_shift_en           = 10,
+		.rup_aup_latch_shift                  = 11,
+		.rup_aup_latch_supported              = true,
+		.long_pkt_strobe_rst_shift            = 0,
+		.short_pkt_strobe_rst_shift           = 1,
+		.cphy_pkt_strobe_rst_shift            = 2,
+		.unmapped_pkt_strobe_rst_shift        = 3,
+		.top_irq_mask                         = {0x4,},
+		.fatal_err_mask                       = {0x19FA800,},
+		.part_fatal_err_mask                  = {0x0001000,},
+		.non_fatal_err_mask                   = {0x0200000,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_780_ipp_reg_info = {
+		.irq_status_addr                      = 0xAC,
+		.irq_mask_addr                        = 0xB0,
+		.irq_clear_addr                       = 0xB4,
+		.irq_set_addr                         = 0xB8,
+		.cfg0_addr                            = 0x300,
+		.ctrl_addr                            = 0x304,
+		.debug_clr_cmd_addr                   = 0x308,
+		.multi_vcdt_cfg0_addr                 = 0x30c,
+		.cfg1_addr                            = 0x310,
+		.err_recovery_cfg0_addr               = 0x318,
+		.err_recovery_cfg1_addr               = 0x31C,
+		.err_recovery_cfg2_addr               = 0x320,
+		.camif_frame_cfg_addr                 = 0x330,
+		.epoch_irq_cfg_addr                   = 0x334,
+		.epoch0_subsample_ptrn_addr           = 0x338,
+		.epoch1_subsample_ptrn_addr           = 0x33C,
+		.debug_camif_1_addr                   = 0x340,
+		.debug_camif_0_addr                   = 0x344,
+		.debug_halt_status_addr               = 0x348,
+		.debug_misr_val0_addr                 = 0x34C,
+		.debug_misr_val1_addr                 = 0x350,
+		.debug_misr_val2_addr                 = 0x354,
+		.debug_misr_val3_addr                 = 0x358,
+		.hcrop_addr                           = 0x35c,
+		.vcrop_addr                           = 0x360,
+		.pix_drop_pattern_addr                = 0x364,
+		.pix_drop_period_addr                 = 0x368,
+		.line_drop_pattern_addr               = 0x36C,
+		.line_drop_period_addr                = 0x370,
+		.frm_drop_pattern_addr                = 0x374,
+		.frm_drop_period_addr                 = 0x378,
+		.irq_subsample_pattern_addr           = 0x37C,
+		.irq_subsample_period_addr            = 0x380,
+		.format_measure_cfg0_addr             = 0x384,
+		.format_measure_cfg1_addr             = 0x388,
+		.format_measure0_addr                 = 0x38C,
+		.format_measure1_addr                 = 0x390,
+		.format_measure2_addr                 = 0x394,
+		.timestamp_curr0_sof_addr             = 0x398,
+		.timestamp_curr1_sof_addr             = 0x39C,
+		.timestamp_perv0_sof_addr             = 0x3A0,
+		.timestamp_perv1_sof_addr             = 0x3A4,
+		.timestamp_curr0_eof_addr             = 0x3A8,
+		.timestamp_curr1_eof_addr             = 0x3AC,
+		.timestamp_perv0_eof_addr             = 0x3B0,
+		.timestamp_perv1_eof_addr             = 0x3B4,
+		.batch_period_cfg_addr                = 0x3C4,
+		.batch_stream_id_cfg_addr             = 0x3C8,
+		.epoch0_cfg_batch_id0_addr            = 0x3CC,
+		.epoch1_cfg_batch_id0_addr            = 0x3D0,
+		.epoch0_cfg_batch_id1_addr            = 0x3D4,
+		.epoch1_cfg_batch_id1_addr            = 0x3D8,
+		.epoch0_cfg_batch_id2_addr            = 0x3DC,
+		.epoch1_cfg_batch_id2_addr            = 0x3E0,
+		.epoch0_cfg_batch_id3_addr            = 0x3E4,
+		.epoch1_cfg_batch_id3_addr            = 0x3E8,
+		.epoch0_cfg_batch_id4_addr            = 0x3EC,
+		.epoch1_cfg_batch_id4_addr            = 0x3F0,
+		.epoch0_cfg_batch_id5_addr            = 0x3F4,
+		.epoch1_cfg_batch_id5_addr            = 0x3F8,
+
+		/* configurations */
+		.start_mode_internal                  = 0x0,
+		.start_mode_global                    = 0x1,
+		.start_mode_master                    = 0x2,
+		.start_mode_slave                     = 0x3,
+		.start_mode_shift                     = 2,
+		.start_master_sel_val                 = 0,
+		.start_master_sel_shift               = 4,
+		.resume_frame_boundary                = 1,
+		.crop_v_en_shift_val                  = 13,
+		.crop_h_en_shift_val                  = 12,
+		.drop_v_en_shift_val                  = 11,
+		.drop_h_en_shift_val                  = 10,
+		.pix_store_en_shift_val               = 14,
+		.early_eof_en_shift_val               = 16,
+		.format_measure_en_shift_val          = 8,
+		.timestamp_en_shift_val               = 6,
+		.overflow_ctrl_en                     = 1,
+		.overflow_ctrl_mode_val               = 0x8,
+		.min_hbi_shift_val                    = 4,
+		.start_master_sel_shift_val           = 4,
+		.fatal_err_mask                       = 0x20186001,
+		.non_fatal_err_mask                   = 0x12000006,
+		.sof_irq_mask                         = 0x10,
+		.rup_irq_mask                         = 0x800000,
+		.epoch0_irq_mask                      = 0x200000,
+		.epoch1_irq_mask                      = 0x400000,
+		.eof_irq_mask                         = 0x8,
+		.rup_aup_mask                         = 0x10001,
+		.top_irq_mask                         = {0x10,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_780_rdi_0_reg_info = {
+		.irq_status_addr                     = 0xEC,
+		.irq_mask_addr                       = 0xF0,
+		.irq_clear_addr                      = 0xF4,
+		.irq_set_addr                        = 0xF8,
+		.cfg0_addr                           = 0x500,
+		.ctrl_addr                           = 0x504,
+		.debug_clr_cmd_addr                  = 0x508,
+		.multi_vcdt_cfg0_addr                = 0x50c,
+		.cfg1_addr                           = 0x510,
+		.err_recovery_cfg0_addr              = 0x514,
+		.err_recovery_cfg1_addr              = 0x518,
+		.err_recovery_cfg2_addr              = 0x51C,
+		.debug_byte_cntr_ping_addr           = 0x520,
+		.debug_byte_cntr_pong_addr           = 0x524,
+		.camif_frame_cfg_addr                = 0x528,
+		.epoch_irq_cfg_addr                  = 0x52C,
+		.epoch0_subsample_ptrn_addr          = 0x530,
+		.epoch1_subsample_ptrn_addr          = 0x534,
+		.debug_camif_1_addr                  = 0x538,
+		.debug_camif_0_addr                  = 0x53C,
+		.frm_drop_pattern_addr               = 0x540,
+		.frm_drop_period_addr                = 0x540,
+		.irq_subsample_pattern_addr          = 0x548,
+		.irq_subsample_period_addr           = 0x54C,
+		.hcrop_addr                          = 0x550,
+		.vcrop_addr                          = 0x554,
+		.pix_drop_pattern_addr               = 0x558,
+		.pix_drop_period_addr                = 0x55C,
+		.line_drop_pattern_addr              = 0x560,
+		.line_drop_period_addr               = 0x564,
+		.debug_halt_status_addr              = 0x568,
+		.debug_misr_val0_addr                = 0x570,
+		.debug_misr_val1_addr                = 0x574,
+		.debug_misr_val2_addr                = 0x578,
+		.debug_misr_val3_addr                = 0x57C,
+		.format_measure_cfg0_addr            = 0x580,
+		.format_measure_cfg1_addr            = 0x584,
+		.format_measure0_addr                = 0x588,
+		.format_measure1_addr                = 0x58C,
+		.format_measure2_addr                = 0x590,
+		.timestamp_curr0_sof_addr            = 0x594,
+		.timestamp_curr1_sof_addr            = 0x598,
+		.timestamp_perv0_sof_addr            = 0x59C,
+		.timestamp_perv1_sof_addr            = 0x5A0,
+		.timestamp_curr0_eof_addr            = 0x5A4,
+		.timestamp_curr1_eof_addr            = 0x5A8,
+		.timestamp_perv0_eof_addr            = 0x5AC,
+		.timestamp_perv1_eof_addr            = 0x5B0,
+		.batch_period_cfg_addr               = 0x5BC,
+		.batch_stream_id_cfg_addr            = 0x5C0,
+		.epoch0_cfg_batch_id0_addr           = 0x5C4,
+		.epoch1_cfg_batch_id0_addr           = 0x5C8,
+		.epoch0_cfg_batch_id1_addr           = 0x5CC,
+		.epoch1_cfg_batch_id1_addr           = 0x5D0,
+		.epoch0_cfg_batch_id2_addr           = 0x5D4,
+		.epoch1_cfg_batch_id2_addr           = 0x5D8,
+		.epoch0_cfg_batch_id3_addr           = 0x5DC,
+		.epoch1_cfg_batch_id3_addr           = 0x5E0,
+		.epoch0_cfg_batch_id4_addr           = 0x5E4,
+		.epoch1_cfg_batch_id4_addr           = 0x5E8,
+		.epoch0_cfg_batch_id5_addr           = 0x5EC,
+		.epoch1_cfg_batch_id5_addr           = 0x5F0,
+		/* configurations */
+		.resume_frame_boundary               = 1,
+		.overflow_ctrl_en                    = 1,
+		.overflow_ctrl_mode_val              = 0x8,
+		.mipi_pack_supported                 = 1,
+		.packing_fmt_shift_val               = 15,
+		.plain_alignment_shift_val           = 11,
+		.plain_fmt_shift_val                 = 12,
+		.crop_v_en_shift_val                 = 8,
+		.crop_h_en_shift_val                 = 7,
+		.drop_v_en_shift_val                 = 6,
+		.drop_h_en_shift_val                 = 5,
+		.early_eof_en_shift_val              = 14,
+		.format_measure_en_shift_val         = 3,
+		.timestamp_en_shift_val              = 6,
+		.debug_byte_cntr_rst_shift_val       = 2,
+		.sof_retiming_dis_shift              = 5,
+		.ccif_violation_en                   = 1,
+		.fatal_err_mask                      = 0x20186001,
+		.non_fatal_err_mask                  = 0x12000004,
+		.sof_irq_mask                        = 0x10,
+		.rup_irq_mask                        = 0x800000,
+		.epoch0_irq_mask                     = 0x200000,
+		.epoch1_irq_mask                     = 0x400000,
+		.eof_irq_mask                        = 0x8,
+		.rup_aup_mask                        = 0x100010,
+		.top_irq_mask                        = {0x100,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_780_rdi_1_reg_info = {
+		.irq_status_addr                     = 0xFC,
+		.irq_mask_addr                       = 0x100,
+		.irq_clear_addr                      = 0x104,
+		.irq_set_addr                        = 0x108,
+		.cfg0_addr                           = 0x600,
+		.ctrl_addr                           = 0x604,
+		.debug_clr_cmd_addr                  = 0x608,
+		.multi_vcdt_cfg0_addr                = 0x60c,
+		.cfg1_addr                           = 0x610,
+		.err_recovery_cfg0_addr              = 0x614,
+		.err_recovery_cfg1_addr              = 0x618,
+		.err_recovery_cfg2_addr              = 0x61C,
+		.debug_byte_cntr_ping_addr           = 0x620,
+		.debug_byte_cntr_pong_addr           = 0x624,
+		.camif_frame_cfg_addr                = 0x628,
+		.epoch_irq_cfg_addr                  = 0x62C,
+		.epoch0_subsample_ptrn_addr          = 0x630,
+		.epoch1_subsample_ptrn_addr          = 0x634,
+		.debug_camif_1_addr                  = 0x638,
+		.debug_camif_0_addr                  = 0x63C,
+		.frm_drop_pattern_addr               = 0x640,
+		.frm_drop_period_addr                = 0x644,
+		.irq_subsample_pattern_addr          = 0x648,
+		.irq_subsample_period_addr           = 0x64C,
+		.hcrop_addr                          = 0x650,
+		.vcrop_addr                          = 0x654,
+		.pix_drop_pattern_addr               = 0x658,
+		.pix_drop_period_addr                = 0x65C,
+		.line_drop_pattern_addr              = 0x660,
+		.line_drop_period_addr               = 0x664,
+		.debug_halt_status_addr              = 0x66C,
+		.debug_misr_val0_addr                = 0x670,
+		.debug_misr_val1_addr                = 0x674,
+		.debug_misr_val2_addr                = 0x678,
+		.debug_misr_val3_addr                = 0x67C,
+		.format_measure_cfg0_addr            = 0x680,
+		.format_measure_cfg1_addr            = 0x684,
+		.format_measure0_addr                = 0x688,
+		.format_measure1_addr                = 0x68C,
+		.format_measure2_addr                = 0x690,
+		.timestamp_curr0_sof_addr            = 0x694,
+		.timestamp_curr1_sof_addr            = 0x698,
+		.timestamp_perv0_sof_addr            = 0x69C,
+		.timestamp_perv1_sof_addr            = 0x6A0,
+		.timestamp_curr0_eof_addr            = 0x6A4,
+		.timestamp_curr1_eof_addr            = 0x6A8,
+		.timestamp_perv0_eof_addr            = 0x6AC,
+		.timestamp_perv1_eof_addr            = 0x6B0,
+		.batch_period_cfg_addr               = 0x6BC,
+		.batch_stream_id_cfg_addr            = 0x6C0,
+		.epoch0_cfg_batch_id0_addr           = 0x6C4,
+		.epoch1_cfg_batch_id0_addr           = 0x6C8,
+		.epoch0_cfg_batch_id1_addr           = 0x6CC,
+		.epoch1_cfg_batch_id1_addr           = 0x6D0,
+		.epoch0_cfg_batch_id2_addr           = 0x6D4,
+		.epoch1_cfg_batch_id2_addr           = 0x6D8,
+		.epoch0_cfg_batch_id3_addr           = 0x6DC,
+		.epoch1_cfg_batch_id3_addr           = 0x6E0,
+		.epoch0_cfg_batch_id4_addr           = 0x6E4,
+		.epoch1_cfg_batch_id4_addr           = 0x6E8,
+		.epoch0_cfg_batch_id5_addr           = 0x6EC,
+		.epoch1_cfg_batch_id5_addr           = 0x6F0,
+		/* configurations */
+		.resume_frame_boundary               = 1,
+		.overflow_ctrl_en                    = 1,
+		.overflow_ctrl_mode_val              = 0x8,
+		.mipi_pack_supported                 = 1,
+		.packing_fmt_shift_val               = 15,
+		.plain_alignment_shift_val           = 11,
+		.plain_fmt_shift_val                 = 12,
+		.crop_v_en_shift_val                 = 8,
+		.crop_h_en_shift_val                 = 7,
+		.drop_v_en_shift_val                 = 6,
+		.drop_h_en_shift_val                 = 5,
+		.early_eof_en_shift_val              = 14,
+		.format_measure_en_shift_val         = 3,
+		.timestamp_en_shift_val              = 6,
+		.debug_byte_cntr_rst_shift_val       = 2,
+		.ccif_violation_en                   = 1,
+		.fatal_err_mask                      = 0x20186001,
+		.non_fatal_err_mask                  = 0x12000004,
+		.sof_irq_mask                        = 0x10,
+		.rup_irq_mask                        = 0x800000,
+		.epoch0_irq_mask                     = 0x200000,
+		.epoch1_irq_mask                     = 0x400000,
+		.eof_irq_mask                        = 0x8,
+		.rup_aup_mask                        = 0x200020,
+		.top_irq_mask                        = {0x200,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_780_rdi_2_reg_info = {
+		.irq_status_addr                     = 0x10C,
+		.irq_mask_addr                       = 0x110,
+		.irq_clear_addr                      = 0x114,
+		.irq_set_addr                        = 0x118,
+		.cfg0_addr                           = 0x700,
+		.ctrl_addr                           = 0x704,
+		.debug_clr_cmd_addr                  = 0x708,
+		.multi_vcdt_cfg0_addr                = 0x70c,
+		.cfg1_addr                           = 0x710,
+		.err_recovery_cfg0_addr              = 0x714,
+		.err_recovery_cfg1_addr              = 0x718,
+		.err_recovery_cfg2_addr              = 0x71C,
+		.debug_byte_cntr_ping_addr           = 0x720,
+		.debug_byte_cntr_pong_addr           = 0x724,
+		.camif_frame_cfg_addr                = 0x728,
+		.epoch_irq_cfg_addr                  = 0x72C,
+		.epoch0_subsample_ptrn_addr          = 0x730,
+		.epoch1_subsample_ptrn_addr          = 0x734,
+		.debug_camif_1_addr                  = 0x738,
+		.debug_camif_0_addr                  = 0x73C,
+		.frm_drop_pattern_addr               = 0x740,
+		.frm_drop_period_addr                = 0x744,
+		.irq_subsample_pattern_addr          = 0x748,
+		.irq_subsample_period_addr           = 0x74C,
+		.hcrop_addr                          = 0x750,
+		.vcrop_addr                          = 0x754,
+		.pix_drop_pattern_addr               = 0x758,
+		.pix_drop_period_addr                = 0x75C,
+		.line_drop_pattern_addr              = 0x760,
+		.line_drop_period_addr               = 0x764,
+		.debug_halt_status_addr              = 0x76C,
+		.debug_misr_val0_addr                = 0x770,
+		.debug_misr_val1_addr                = 0x774,
+		.debug_misr_val2_addr                = 0x778,
+		.debug_misr_val3_addr                = 0x77C,
+		.format_measure_cfg0_addr            = 0x780,
+		.format_measure_cfg1_addr            = 0x784,
+		.format_measure0_addr                = 0x788,
+		.format_measure1_addr                = 0x78C,
+		.format_measure2_addr                = 0x790,
+		.timestamp_curr0_sof_addr            = 0x794,
+		.timestamp_curr1_sof_addr            = 0x798,
+		.timestamp_perv0_sof_addr            = 0x79C,
+		.timestamp_perv1_sof_addr            = 0x7A0,
+		.timestamp_curr0_eof_addr            = 0x7A4,
+		.timestamp_curr1_eof_addr            = 0x7A8,
+		.timestamp_perv0_eof_addr            = 0x7AC,
+		.timestamp_perv1_eof_addr            = 0x7B0,
+		.batch_period_cfg_addr               = 0x7BC,
+		.batch_stream_id_cfg_addr            = 0x7C0,
+		.epoch0_cfg_batch_id0_addr           = 0x7C4,
+		.epoch1_cfg_batch_id0_addr           = 0x7C8,
+		.epoch0_cfg_batch_id1_addr           = 0x7CC,
+		.epoch1_cfg_batch_id1_addr           = 0x7D0,
+		.epoch0_cfg_batch_id2_addr           = 0x7D4,
+		.epoch1_cfg_batch_id2_addr           = 0x7D8,
+		.epoch0_cfg_batch_id3_addr           = 0x7DC,
+		.epoch1_cfg_batch_id3_addr           = 0x7E0,
+		.epoch0_cfg_batch_id4_addr           = 0x7E4,
+		.epoch1_cfg_batch_id4_addr           = 0x7E8,
+		.epoch0_cfg_batch_id5_addr           = 0x7EC,
+		.epoch1_cfg_batch_id5_addr           = 0x7F0,
+		/* configurations */
+		.resume_frame_boundary               = 1,
+		.overflow_ctrl_en                    = 1,
+		.overflow_ctrl_mode_val              = 0x8,
+		.mipi_pack_supported                 = 1,
+		.packing_fmt_shift_val               = 15,
+		.plain_alignment_shift_val           = 11,
+		.plain_fmt_shift_val                 = 12,
+		.crop_v_en_shift_val                 = 8,
+		.crop_h_en_shift_val                 = 7,
+		.drop_v_en_shift_val                 = 6,
+		.drop_h_en_shift_val                 = 5,
+		.early_eof_en_shift_val              = 14,
+		.format_measure_en_shift_val         = 3,
+		.timestamp_en_shift_val              = 6,
+		.debug_byte_cntr_rst_shift_val       = 2,
+		.ccif_violation_en                   = 1,
+		.fatal_err_mask                      = 0x20186001,
+		.non_fatal_err_mask                  = 0x12000004,
+		.sof_irq_mask                        = 0x10,
+		.rup_irq_mask                        = 0x800000,
+		.epoch0_irq_mask                     = 0x200000,
+		.epoch1_irq_mask                     = 0x400000,
+		.eof_irq_mask                        = 0x8,
+		.rup_aup_mask                        = 0x400040,
+		.top_irq_mask                        = {0x400,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_780_rdi_3_reg_info = {
+		.irq_status_addr                     = 0x11C,
+		.irq_mask_addr                       = 0x120,
+		.irq_clear_addr                      = 0x124,
+		.irq_set_addr                        = 0x128,
+		.cfg0_addr                           = 0x800,
+		.ctrl_addr                           = 0x804,
+		.debug_clr_cmd_addr                  = 0x808,
+		.multi_vcdt_cfg0_addr                = 0x80c,
+		.cfg1_addr                           = 0x810,
+		.err_recovery_cfg0_addr              = 0x814,
+		.err_recovery_cfg1_addr              = 0x818,
+		.err_recovery_cfg2_addr              = 0x81C,
+		.debug_byte_cntr_ping_addr           = 0x820,
+		.debug_byte_cntr_pong_addr           = 0x824,
+		.camif_frame_cfg_addr                = 0x828,
+		.epoch_irq_cfg_addr                  = 0x82C,
+		.epoch0_subsample_ptrn_addr          = 0x830,
+		.epoch1_subsample_ptrn_addr          = 0x834,
+		.debug_camif_1_addr                  = 0x838,
+		.debug_camif_0_addr                  = 0x83C,
+		.frm_drop_pattern_addr               = 0x840,
+		.frm_drop_period_addr                = 0x840,
+		.irq_subsample_pattern_addr          = 0x848,
+		.irq_subsample_period_addr           = 0x84C,
+		.hcrop_addr                          = 0x850,
+		.vcrop_addr                          = 0x854,
+		.pix_drop_pattern_addr               = 0x858,
+		.pix_drop_period_addr                = 0x85C,
+		.line_drop_pattern_addr              = 0x860,
+		.line_drop_period_addr               = 0x864,
+		.debug_halt_status_addr              = 0x868,
+		.debug_misr_val0_addr                = 0x870,
+		.debug_misr_val1_addr                = 0x874,
+		.debug_misr_val2_addr                = 0x878,
+		.debug_misr_val3_addr                = 0x87C,
+		.format_measure_cfg0_addr            = 0x880,
+		.format_measure_cfg1_addr            = 0x884,
+		.format_measure0_addr                = 0x888,
+		.format_measure1_addr                = 0x88C,
+		.format_measure2_addr                = 0x890,
+		.timestamp_curr0_sof_addr            = 0x894,
+		.timestamp_curr1_sof_addr            = 0x898,
+		.timestamp_perv0_sof_addr            = 0x89C,
+		.timestamp_perv1_sof_addr            = 0x8A0,
+		.timestamp_curr0_eof_addr            = 0x8A4,
+		.timestamp_curr1_eof_addr            = 0x8A8,
+		.timestamp_perv0_eof_addr            = 0x8AC,
+		.timestamp_perv1_eof_addr            = 0x8B0,
+		.batch_period_cfg_addr               = 0x8BC,
+		.batch_stream_id_cfg_addr            = 0x8C0,
+		.epoch0_cfg_batch_id0_addr           = 0x8C4,
+		.epoch1_cfg_batch_id0_addr           = 0x8C8,
+		.epoch0_cfg_batch_id1_addr           = 0x8CC,
+		.epoch1_cfg_batch_id1_addr           = 0x8D0,
+		.epoch0_cfg_batch_id2_addr           = 0x8D4,
+		.epoch1_cfg_batch_id2_addr           = 0x8D8,
+		.epoch0_cfg_batch_id3_addr           = 0x8DC,
+		.epoch1_cfg_batch_id3_addr           = 0x8E0,
+		.epoch0_cfg_batch_id4_addr           = 0x8E4,
+		.epoch1_cfg_batch_id4_addr           = 0x8E8,
+		.epoch0_cfg_batch_id5_addr           = 0x8EC,
+		.epoch1_cfg_batch_id5_addr           = 0x8F0,
+		/* configurations */
+		.resume_frame_boundary               = 1,
+		.overflow_ctrl_en                    = 1,
+		.overflow_ctrl_mode_val              = 0x8,
+		.mipi_pack_supported                 = 1,
+		.packing_fmt_shift_val               = 15,
+		.plain_alignment_shift_val           = 11,
+		.plain_fmt_shift_val                 = 12,
+		.crop_v_en_shift_val                 = 8,
+		.crop_h_en_shift_val                 = 7,
+		.drop_v_en_shift_val                 = 6,
+		.drop_h_en_shift_val                 = 5,
+		.early_eof_en_shift_val              = 14,
+		.format_measure_en_shift_val         = 3,
+		.timestamp_en_shift_val              = 6,
+		.debug_byte_cntr_rst_shift_val       = 2,
+		.ccif_violation_en                   = 1,
+		.fatal_err_mask                      = 0x20186001,
+		.non_fatal_err_mask                  = 0x12000004,
+		.sof_irq_mask                        = 0x10,
+		.rup_irq_mask                        = 0x800000,
+		.epoch0_irq_mask                     = 0x200000,
+		.epoch1_irq_mask                     = 0x400000,
+		.eof_irq_mask                        = 0x8,
+		.rup_aup_mask                        = 0x800080,
+		.top_irq_mask                        = {0x800,},
+};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_lite_780_reg_info = {
+	.top_irq_reg_info      = &cam_ife_csid_lite_780_top_irq_reg_info,
+	.rx_irq_reg_info       = &cam_ife_csid_lite_780_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_lite_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_lite_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_lite_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_lite_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		NULL,
+		&cam_ife_csid_lite_780_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		},
+	.buf_done_irq_reg_info = &cam_ife_csid_lite_780_buf_done_irq_reg_info,
+	.cmn_reg               = &cam_ife_csid_lite_780_cmn_reg_info,
+	.csi2_reg              = &cam_ife_csid_lite_780_csi2_reg_info,
+	.buf_done_irq_reg_info = &cam_ife_csid_lite_780_buf_done_irq_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_lite_780_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = NULL,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_lite_780_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_lite_780_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_lite_780_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_lite_780_rdi_3_reg_info,
+	.need_top_cfg = 0,
+	.top_irq_desc       = &cam_ife_csid_lite_780_top_irq_desc,
+	.rx_irq_desc        = &cam_ife_csid_lite_780_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_lite_780_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_lite_780_num_top_irq_desc,
+	.num_rx_err_irqs    = cam_ife_csid_lite_780_num_rx_irq_desc,
+	.num_path_err_irqs  = ARRAY_SIZE(cam_ife_csid_lite_780_path_irq_desc),
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+};
+#endif /* _CAM_IFE_CSID_LITE_780_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite860.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite860.h
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE_860_H_
+#define _CAM_IFE_CSID_LITE_860_H_
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_ife_csid_lite880.h"
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_lite_860_reg_info = {
+	.top_irq_reg_info      = &cam_ife_csid_lite_880_top_irq_reg_info,
+	.rx_irq_reg_info       = &cam_ife_csid_lite_880_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		NULL,
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		},
+	.buf_done_irq_reg_info = &cam_ife_csid_lite_880_buf_done_irq_reg_info,
+	.cmn_reg               = &cam_ife_csid_lite_880_cmn_reg_info,
+	.csi2_reg              = &cam_ife_csid_lite_880_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_lite_880_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = NULL,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_lite_880_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_lite_880_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_lite_880_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_lite_880_rdi_3_reg_info,
+	.need_top_cfg = 0,
+	.top_irq_desc       = &cam_ife_csid_lite_880_top_irq_desc,
+	.rx_irq_desc        = &cam_ife_csid_lite_880_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_lite_880_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_lite_880_num_top_irq_desc,
+	.num_rx_err_irqs    = cam_ife_csid_lite_880_num_rx_irq_desc,
+	.num_path_err_irqs  = ARRAY_SIZE(cam_ife_csid_lite_880_path_irq_desc),
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+	.is_ife_sfe_mapped  = true,
+};
+
+#endif /* _CAM_IFE_CSID_LITE_860_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite880.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite880.h
@@ -0,0 +1,1072 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE_880_H_
+#define _CAM_IFE_CSID_LITE_880_H_
+
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+/* Offsets might not match due to csid secure regs at beginning of reg space */
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_lite_880_rx_irq_desc[][32] = {
+	{
+		{
+			.bitmask = BIT(0),
+			.desc = "DL0_EOT",
+		},
+		{
+			.bitmask = BIT(1),
+			.desc = "DL1_EOT",
+		},
+		{
+			.bitmask = BIT(2),
+			.desc = "DL2_EOT",
+		},
+		{
+			.bitmask = BIT(3),
+			.desc = "DL3_EOT",
+		},
+		{
+			.bitmask = BIT(4),
+			.desc = "DL0_SOT",
+		},
+		{
+			.bitmask = BIT(5),
+			.desc = "DL1_SOT",
+		},
+		{
+			.bitmask = BIT(6),
+			.desc = "DL2_SOT",
+		},
+		{
+			.bitmask = BIT(7),
+			.desc = "DL3_SOT",
+		},
+		{
+			.bitmask = BIT(8),
+			.desc = "LONG_PKT",
+		},
+		{
+			.bitmask = BIT(9),
+			.desc = "SHORT_PKT",
+		},
+		{
+			.bitmask = BIT(10),
+			.desc = "CPHY_PKT_HDR",
+		},
+		{
+			.bitmask = BIT(11),
+			.desc = "ERROR_CPHY_EOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(12),
+			.desc = "ERROR_CPHY_SOT_RECEPTION",
+		},
+		{
+			.bitmask = BIT(13),
+			.desc = "ERROR_CPHY_PH_CRC",
+		},
+		{
+			.bitmask = BIT(14),
+			.desc = "WARNING_ECC",
+		},
+		{
+			.bitmask = BIT(15),
+			.desc = "ERROR_LANE0_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(16),
+			.desc = "ERROR_LANE1_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(17),
+			.desc = "ERROR_LANE2_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(18),
+			.desc = "ERROR_LANE3_FIFO_OVERFLOW",
+		},
+		{
+			.bitmask = BIT(19),
+			.desc = "ERROR_CRC",
+		},
+		{
+			.bitmask = BIT(20),
+			.desc = "ERROR_ECC",
+		},
+		{
+			.bitmask = BIT(21),
+			.desc = "ERROR_MMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(22),
+			.desc = "ERROR_UNMAPPED_VC_DT",
+		},
+		{
+			.bitmask = BIT(23),
+			.desc = "ERROR_STREAM_UNDERFLOW",
+		},
+		{
+			.bitmask = BIT(24),
+			.desc = "ERROR_UNBOUNDED_FRAME",
+		},
+		{
+			.bitmask = BIT(25),
+			.desc = "ERROR_ILLEGAL_PROGRAMMING_IRQ",
+		},
+		{
+			.bitmask = BIT(26),
+			.desc = "INFO_SENSOR_MODE_ID_CHANGE_IRQ",
+		},
+	},
+};
+
+static const struct cam_ife_csid_irq_desc cam_ife_csid_lite_880_path_irq_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FATAL,
+		.desc = "ILLEGAL_PROGRAMMING",
+		.err_handler = cam_ife_csid_ver2_print_illegal_programming_irq_status,
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "EROOR_MSG_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "ERROR_FIFO_OVERFLOW",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "CAMIF_EOF",
+	},
+	{
+		.bitmask = BIT(4),
+		.desc = "CAMIF_SOF",
+	},
+	{
+		.bitmask = BIT(5),
+		.desc = "FRAME_DROP_EOF",
+	},
+	{
+		.bitmask = BIT(6),
+		.desc = "FRAME_DROP_EOL",
+	},
+	{
+		.bitmask = BIT(7),
+		.desc = "FRAME_DROP_SOL",
+	},
+	{
+		.bitmask = BIT(8),
+		.desc = "FRAME_DROP_SOF",
+	},
+	{
+		.bitmask = BIT(9),
+		.desc = "INFO_INPUT_EOF",
+	},
+	{
+		.bitmask = BIT(10),
+		.desc = "INFO_INPUT_EOL",
+	},
+	{
+		.bitmask = BIT(11),
+		.desc = "INFO_INPUT_SOL",
+	},
+	{
+		.bitmask = BIT(12),
+		.desc = "INFO_INPUT_SOF",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_PIX_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(14),
+		.err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE,
+		.desc = "ERROR_LINE_COUNT",
+		.err_handler = cam_ife_csid_ver2_print_format_measure_info,
+	},
+	{
+		.bitmask = BIT(15),
+		.desc = "VCDT_GRP0_SEL",
+	},
+	{
+		.bitmask = BIT(16),
+		.desc = "VCDT_GRP1_SEL",
+	},
+	{
+		.bitmask = BIT(17),
+		.desc = "VCDT_GRP_CHANGE",
+	},
+	{
+		.bitmask = BIT(18),
+		.desc = "FRAME_DROP",
+	},
+	{
+		.bitmask = BIT(19),
+		.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+		.desc = "OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+	},
+	{
+		.bitmask = BIT(20),
+		.desc = "ERROR_REC_CCIF_VIOLATION From Camif",
+	},
+	{
+		.bitmask = BIT(21),
+		.desc = "CAMIF_EPOCH0",
+	},
+	{
+		.bitmask = BIT(22),
+		.desc = "CAMIF_EPOCH1",
+	},
+	{
+		.bitmask = BIT(23),
+		.desc = "RUP_DONE",
+	},
+	{
+		.bitmask = BIT(24),
+		.desc = "ILLEGAL_BATCH_ID",
+	},
+	{
+		.bitmask = BIT(25),
+		.desc = "BATCH_END_MISSING_VIOLATION",
+	},
+	{
+		.bitmask = BIT(26),
+		.desc = "HEIGHT_VIOLATION",
+	},
+	{
+		.bitmask = BIT(27),
+		.desc = "WIDTH_VIOLATION",
+	},
+	{
+		.bitmask = BIT(28),
+		.desc = "SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP",
+		.err_handler = cam_ife_csid_hw_ver2_mup_mismatch_handler,
+	},
+	{
+		.bitmask = BIT(29),
+		.desc = "CCIF_VIOLATION: Bad frame timings",
+	},
+};
+
+static const struct cam_ife_csid_top_irq_desc cam_ife_csid_lite_880_top_irq_desc[][32] = {
+	{
+		{
+			.bitmask  = BIT(1),
+			.err_type = CAM_ISP_HW_ERROR_CSID_SENSOR_SWITCH_ERROR,
+			.err_name = "FATAL_SENSOR_SWITCHING_IRQ",
+			.desc = "Fatal Error duirng dynamically switching between 2 sensors",
+		},
+		{
+			.bitmask  = BIT(18),
+			.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+			.err_name = "ERROR_NO_VOTE_DN",
+			.desc = "vote_up is asserted before IDLE is encountered in a frame",
+		},
+		{
+			.bitmask  = BIT(19),
+			.err_type = CAM_ISP_HW_ERROR_RECOVERY_OVERFLOW,
+			.err_name = "ERROR_VOTE_UP_LATE",
+			.desc = "vote_up is asserted at the same time as an SOF",
+		},
+		{
+			.bitmask  = BIT(20),
+			.err_type = CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW,
+			.err_name = "ERROR_RDI_LINE_BUFFER_CONFLICT",
+			.desc = "Two or more RDIs programmed to access the shared line buffer",
+			.err_handler = cam_ife_csid_hw_ver2_rdi_line_buffer_conflict_handler,
+		},
+	},
+};
+
+static const uint32_t cam_ife_csid_lite_880_num_top_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_lite_880_top_irq_desc[0]),
+};
+static const uint32_t cam_ife_csid_lite_880_num_rx_irq_desc[] = {
+	ARRAY_SIZE(cam_ife_csid_lite_880_rx_irq_desc[0]),
+};
+
+static struct cam_irq_register_set cam_ife_csid_lite_880_irq_reg_set[9] = {
+	/* Top */
+	{
+		.mask_reg_offset   = 0x00000080,
+		.clear_reg_offset  = 0x00000084,
+		.status_reg_offset = 0x0000007C,
+		.set_reg_offset    = 0x00000088,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	/* RX */
+	{
+		.mask_reg_offset   = 0x000000A0,
+		.clear_reg_offset  = 0x000000A4,
+		.status_reg_offset = 0x0000009C,
+	},
+	/* RDI0 */
+	{
+		.mask_reg_offset   = 0x000000F0,
+		.clear_reg_offset  = 0x000000F4,
+		.status_reg_offset = 0x000000EC,
+	},
+	/* RDI1 */
+	{
+		.mask_reg_offset   = 0x00000100,
+		.clear_reg_offset  = 0x00000104,
+		.status_reg_offset = 0x000000FC,
+	},
+	/* RDI2 */
+	{
+		.mask_reg_offset   = 0x00000110,
+		.clear_reg_offset  = 0x00000114,
+		.status_reg_offset = 0x0000010C,
+	},
+	/* RDI3 */
+	{
+		.mask_reg_offset   = 0x00000120,
+		.clear_reg_offset  = 0x00000124,
+		.status_reg_offset = 0x0000011C,
+	},
+	{}, /* no RDI4 */
+	/* IPP */
+	{
+		.mask_reg_offset   = 0x000000B0,
+		.clear_reg_offset  = 0x000000B4,
+		.status_reg_offset = 0x000000AC,
+	},
+	{}, /* no PPP */
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_880_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_lite_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_TOP],
+	.global_irq_cmd_offset = 0x00000014,
+	.global_set_bitmask    = 0x00000010,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_880_rx_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = &cam_ife_csid_lite_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RX], /* RX */
+	.global_irq_cmd_offset = 0,
+};
+
+static struct cam_irq_controller_reg_info cam_ife_csid_lite_880_path_irq_reg_info[6] = {
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_0],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_1],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_2],
+		.global_irq_cmd_offset = 0,
+	},
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_RDI_3],
+		.global_irq_cmd_offset = 0,
+	},
+	{}, /* no RDI4 */
+	{
+		.num_registers = 1,
+		.irq_reg_set = &cam_ife_csid_lite_880_irq_reg_set[CAM_IFE_CSID_IRQ_REG_IPP],
+		.global_irq_cmd_offset = 0,
+	},
+};
+
+static struct cam_irq_register_set cam_ife_csid_lite_880_buf_done_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000090,
+		.clear_reg_offset  = 0x00000094,
+		.status_reg_offset = 0x0000008C,
+	},
+};
+
+static struct cam_irq_controller_reg_info
+	cam_ife_csid_lite_880_buf_done_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = cam_ife_csid_lite_880_buf_done_irq_reg_set,
+	.global_irq_cmd_offset  = 0, /* intentionally set to zero */
+};
+
+static struct cam_ife_csid_ver2_common_reg_info
+			cam_ife_csid_lite_880_cmn_reg_info = {
+	.hw_version_addr                              = 0x0000,
+	.cfg0_addr                                    = 0x0004,
+	.global_cmd_addr                              = 0x0008,
+	.reset_cfg_addr                               = 0x000c,
+	.reset_cmd_addr                               = 0x0010,
+	.irq_cmd_addr                                 = 0x0014,
+	.rup_aup_cmd_addr                             = 0x0018,
+	.offline_cmd_addr                             = 0x001C,
+	.shdr_master_slave_cfg_addr                   = 0x0020,
+	.top_irq_status_addr                          = {0x007C,},
+	.top_irq_mask_addr                            = {0x0080,},
+	.top_irq_clear_addr                           = {0x0084,},
+	.top_irq_set_addr                             = {0x0088,},
+	.buf_done_irq_status_addr                     = 0x008C,
+	.buf_done_irq_mask_addr                       = 0x0090,
+	.buf_done_irq_clear_addr                      = 0x0094,
+	.buf_done_irq_set_addr                        = 0x0098,
+
+	/*configurations */
+	.major_version                                = 6,
+	.minor_version                                = 8,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 4,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 0,
+	.rst_done_shift_val                           = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.vc_mask                                      = 0x1F,
+	.dt_shift_val                                 = 16,
+	.dt_mask                                      = 0x3F,
+	.crop_shift_val                               = 16,
+	.decode_format_shift_val                      = 12,
+	.decode_format1_shift_val                     = 16,
+	.decode_format_mask                           = 0xF,
+	.decode_format1_supported                     = true,
+	.frame_id_decode_en_shift_val                 = 1,
+	.multi_vcdt_vc1_shift_val                     = 2,
+	.multi_vcdt_dt1_shift_val                     = 7,
+	.multi_vcdt_ts_combo_en_shift_val             = 13,
+	.multi_vcdt_en_shift_val                      = 0,
+	.timestamp_stb_sel_shift_val                  = 8,
+	.vfr_en_shift_val                             = 0,
+	.mup_shift_val                                = 28,
+	.early_eof_supported                          = 1,
+	.vfr_supported                                = 1,
+	.multi_vcdt_supported                         = 1,
+	.ts_comb_vcdt_en                              = true,
+	.ts_comb_vcdt_mask                            = 3,
+	.frame_id_dec_supported                       = 1,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xc,
+	.measure_pixel_line_en_mask                   = 0x3,
+	.crop_pix_start_mask                          = 0x3fff,
+	.crop_pix_end_mask                            = 0xffff,
+	.crop_line_start_mask                         = 0x3fff,
+	.crop_line_end_mask                           = 0xffff,
+	.drop_supported                               = 1,
+	.ipp_irq_mask_all                             = 0x7FFF,
+	.rdi_irq_mask_all                             = 0x7FFF,
+	.rst_loc_path_only_val                        = 0x0,
+	.rst_location_shift_val                       = 4,
+	.rst_loc_complete_csid_val                    = 0x1,
+	.rst_mode_frame_boundary_val                  = 0x0,
+	.rst_mode_immediate_val                       = 0x1,
+	.rst_cmd_hw_reset_complete_val                = 0x1,
+	.rst_cmd_sw_reset_complete_val                = 0x2,
+	.rst_cmd_irq_ctrl_only_val                    = 0x4,
+	.timestamp_strobe_val                         = 0x2,
+	.global_reset                                 = 1,
+	.rup_supported                                = 1,
+	.only_master_rup                              = 1,
+	.format_measure_height_mask_val               = 0xFFFF,
+	.format_measure_height_shift_val              = 0x10,
+	.format_measure_width_mask_val                = 0xFFFF,
+	.format_measure_width_shift_val               = 0x0,
+	.top_reset_irq_mask                           = {0x1,},
+	.top_buf_done_irq_mask                        = 0x2000,
+	.decode_format_payload_only                   = 0xF,
+	.phy_sel_base_idx                             = 1,
+	.timestamp_enabled_in_cfg0                    = true,
+	.camif_irq_support                            = true,
+};
+
+static struct cam_ife_csid_ver2_csi2_rx_reg_info
+	cam_ife_csid_lite_880_csi2_reg_info = {
+		.irq_status_addr                      = {0x009C,},
+		.irq_mask_addr                        = {0x00A0,},
+		.irq_clear_addr                       = {0x00A4,},
+		.irq_set_addr                         = {0x00A8,},
+		/*CSI2 rx control */
+		.cfg0_addr                            = 0x0200,
+		.cfg1_addr                            = 0x0204,
+		.capture_ctrl_addr                    = 0x0208,
+		.rst_strobes_addr                     = 0x020C,
+		.cap_unmap_long_pkt_hdr_0_addr        = 0x0210,
+		.cap_unmap_long_pkt_hdr_1_addr        = 0x0214,
+		.captured_short_pkt_0_addr            = 0x0218,
+		.captured_short_pkt_1_addr            = 0x021c,
+		.captured_long_pkt_0_addr             = 0x0220,
+		.captured_long_pkt_1_addr             = 0x0224,
+		.captured_long_pkt_ftr_addr           = 0x0228,
+		.captured_cphy_pkt_hdr_addr           = 0x022c,
+		.lane0_misr_addr                      = 0x0230,
+		.lane1_misr_addr                      = 0x0234,
+		.lane2_misr_addr                      = 0x0238,
+		.lane3_misr_addr                      = 0x023c,
+		.total_pkts_rcvd_addr                 = 0x0240,
+		.stats_ecc_addr                       = 0x0244,
+		.total_crc_err_addr                   = 0x0248,
+		.de_scramble_type3_cfg0_addr          = 0x024C,
+		.de_scramble_type3_cfg1_addr          = 0x0250,
+		.de_scramble_type2_cfg0_addr          = 0x0254,
+		.de_scramble_type2_cfg1_addr          = 0x0258,
+		.de_scramble_type1_cfg0_addr          = 0x025C,
+		.de_scramble_type1_cfg1_addr          = 0x0260,
+		.de_scramble_type0_cfg0_addr          = 0x0264,
+		.de_scramble_type0_cfg1_addr          = 0x0268,
+
+		.rst_done_shift_val                   = 27,
+		.irq_mask_all                         = 0xFFFFFFF,
+		.misr_enable_shift_val                = 6,
+		.vc_mode_shift_val                    = 2,
+		.capture_long_pkt_en_shift            = 0,
+		.capture_short_pkt_en_shift           = 1,
+		.capture_cphy_pkt_en_shift            = 2,
+		.capture_long_pkt_dt_shift            = 4,
+		.capture_long_pkt_vc_shift            = 10,
+		.capture_short_pkt_vc_shift           = 15,
+		.capture_cphy_pkt_dt_shift            = 20,
+		.capture_cphy_pkt_vc_shift            = 26,
+		.phy_num_mask                         = 0xf,
+		.vc_mask                              = 0x7C00000,
+		.dt_mask                              = 0x3f0000,
+		.wc_mask                              = 0xffff,
+		.vc_shift                             = 0x16,
+		.dt_shift                             = 0x10,
+		.wc_shift                             = 0,
+		.calc_crc_mask                        = 0xffff,
+		.expected_crc_mask                    = 0xffff,
+		.calc_crc_shift                       = 0x10,
+		.ecc_correction_shift_en              = 0,
+		.lane_num_shift                       = 0,
+		.lane_cfg_shift                       = 4,
+		.phy_type_shift                       = 24,
+		.phy_num_shift                        = 20,
+		.tpg_mux_en_shift                     = 27,
+		.tpg_num_sel_shift                    = 28,
+		.phy_bist_shift_en                    = 7,
+		.epd_mode_shift_en                    = 8,
+		.eotp_shift_en                        = 9,
+		.dyn_sensor_switch_shift_en           = 10,
+		.rup_aup_latch_shift                  = 13,
+		.rup_aup_latch_supported              = true,
+		.long_pkt_strobe_rst_shift            = 0,
+		.short_pkt_strobe_rst_shift           = 1,
+		.cphy_pkt_strobe_rst_shift            = 2,
+		.unmapped_pkt_strobe_rst_shift        = 3,
+		.top_irq_mask                         = {0x4,},
+		.fatal_err_mask                       = {0x19FA800,},
+		.part_fatal_err_mask                  = {0x0001000,},
+		.non_fatal_err_mask                   = {0x0200000,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_880_ipp_reg_info = {
+		.irq_status_addr                      = 0x00AC,
+		.irq_mask_addr                        = 0x00B0,
+		.irq_clear_addr                       = 0x00B4,
+		.irq_set_addr                         = 0x00B8,
+		.cfg0_addr                            = 0x0300,
+		.ctrl_addr                            = 0x0304,
+		.debug_clr_cmd_addr                   = 0x0308,
+		.multi_vcdt_cfg0_addr                 = 0x030c,
+		.cfg1_addr                            = 0x0310,
+		.err_recovery_cfg0_addr               = 0x0318,
+		.err_recovery_cfg1_addr               = 0x031C,
+		.err_recovery_cfg2_addr               = 0x0320,
+		.camif_frame_cfg_addr                 = 0x0330,
+		.epoch_irq_cfg_addr                   = 0x0334,
+		.epoch0_subsample_ptrn_addr           = 0x0338,
+		.epoch1_subsample_ptrn_addr           = 0x033C,
+		.debug_camif_1_addr                   = 0x0340,
+		.debug_camif_0_addr                   = 0x0344,
+		.debug_halt_status_addr               = 0x0348,
+		.debug_misr_val0_addr                 = 0x034C,
+		.debug_misr_val1_addr                 = 0x0350,
+		.debug_misr_val2_addr                 = 0x0354,
+		.debug_misr_val3_addr                 = 0x0358,
+		.hcrop_addr                           = 0x035c,
+		.vcrop_addr                           = 0x0360,
+		.pix_drop_pattern_addr                = 0x0364,
+		.pix_drop_period_addr                 = 0x0368,
+		.line_drop_pattern_addr               = 0x036C,
+		.line_drop_period_addr                = 0x0370,
+		.frm_drop_pattern_addr                = 0x0374,
+		.frm_drop_period_addr                 = 0x0378,
+		.irq_subsample_pattern_addr           = 0x037C,
+		.irq_subsample_period_addr            = 0x0380,
+		.format_measure_cfg0_addr             = 0x0384,
+		.format_measure_cfg1_addr             = 0x0388,
+		.format_measure0_addr                 = 0x038C,
+		.format_measure1_addr                 = 0x0390,
+		.format_measure2_addr                 = 0x0394,
+		.timestamp_curr0_sof_addr             = 0x0398,
+		.timestamp_curr1_sof_addr             = 0x039C,
+		.timestamp_perv0_sof_addr             = 0x03A0,
+		.timestamp_perv1_sof_addr             = 0x03A4,
+		.timestamp_curr0_eof_addr             = 0x03A8,
+		.timestamp_curr1_eof_addr             = 0x03AC,
+		.timestamp_perv0_eof_addr             = 0x03B0,
+		.timestamp_perv1_eof_addr             = 0x03B4,
+		.batch_period_cfg_addr                = 0x03C4,
+		.batch_stream_id_cfg_addr             = 0x03C8,
+		.epoch0_cfg_batch_id0_addr            = 0x03CC,
+		.epoch1_cfg_batch_id0_addr            = 0x03D0,
+		.epoch0_cfg_batch_id1_addr            = 0x03D4,
+		.epoch1_cfg_batch_id1_addr            = 0x03D8,
+		.epoch0_cfg_batch_id2_addr            = 0x03DC,
+		.epoch1_cfg_batch_id2_addr            = 0x03E0,
+		.epoch0_cfg_batch_id3_addr            = 0x03E4,
+		.epoch1_cfg_batch_id3_addr            = 0x03E8,
+		.epoch0_cfg_batch_id4_addr            = 0x03EC,
+		.epoch1_cfg_batch_id4_addr            = 0x03F0,
+		.epoch0_cfg_batch_id5_addr            = 0x03F4,
+		.epoch1_cfg_batch_id5_addr            = 0x03F8,
+
+		/* configurations */
+		.start_mode_internal                  = 0x0,
+		.start_mode_global                    = 0x1,
+		.start_mode_master                    = 0x2,
+		.start_mode_slave                     = 0x3,
+		.start_mode_shift                     = 2,
+		.start_master_sel_val                 = 0,
+		.start_master_sel_shift               = 4,
+		.resume_frame_boundary                = 1,
+		.crop_v_en_shift_val                  = 13,
+		.crop_h_en_shift_val                  = 12,
+		.drop_v_en_shift_val                  = 11,
+		.drop_h_en_shift_val                  = 10,
+		.pix_store_en_shift_val               = 14,
+		.early_eof_en_shift_val               = 16,
+		.format_measure_en_shift_val          = 8,
+		.timestamp_en_shift_val               = 6,
+		.overflow_ctrl_en                     = 1,
+		.overflow_ctrl_mode_val               = 0x8,
+		.min_hbi_shift_val                    = 4,
+		.start_master_sel_shift_val           = 4,
+		.fatal_err_mask                       = 0x20186001,
+		.non_fatal_err_mask                   = 0x12000004,
+		.sof_irq_mask                         = 0x10,
+		.rup_irq_mask                         = 0x800000,
+		.epoch0_irq_mask                      = 0x200000,
+		.epoch1_irq_mask                      = 0x400000,
+		.eof_irq_mask                         = 0x8,
+		.rup_aup_mask                         = 0x10001,
+		.top_irq_mask                         = {0x10,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_880_rdi_0_reg_info = {
+		.irq_status_addr                     = 0x00EC,
+		.irq_mask_addr                       = 0x00F0,
+		.irq_clear_addr                      = 0x00F4,
+		.irq_set_addr                        = 0x00F8,
+		.cfg0_addr                           = 0x0500,
+		.ctrl_addr                           = 0x0504,
+		.debug_clr_cmd_addr                  = 0x0508,
+		.multi_vcdt_cfg0_addr                = 0x050c,
+		.cfg1_addr                           = 0x0510,
+		.err_recovery_cfg0_addr              = 0x0514,
+		.err_recovery_cfg1_addr              = 0x0518,
+		.err_recovery_cfg2_addr              = 0x051C,
+		.debug_byte_cntr_ping_addr           = 0x0520,
+		.debug_byte_cntr_pong_addr           = 0x0524,
+		.camif_frame_cfg_addr                = 0x0528,
+		.epoch_irq_cfg_addr                  = 0x052C,
+		.epoch0_subsample_ptrn_addr          = 0x0530,
+		.epoch1_subsample_ptrn_addr          = 0x0534,
+		.debug_camif_1_addr                  = 0x0538,
+		.debug_camif_0_addr                  = 0x053C,
+		.frm_drop_pattern_addr               = 0x0540,
+		.frm_drop_period_addr                = 0x0540,
+		.irq_subsample_pattern_addr          = 0x0548,
+		.irq_subsample_period_addr           = 0x054C,
+		.hcrop_addr                          = 0x0550,
+		.vcrop_addr                          = 0x0554,
+		.pix_drop_pattern_addr               = 0x0558,
+		.pix_drop_period_addr                = 0x055C,
+		.line_drop_pattern_addr              = 0x0560,
+		.line_drop_period_addr               = 0x0564,
+		.debug_halt_status_addr              = 0x0568,
+		.debug_misr_val0_addr                = 0x0570,
+		.debug_misr_val1_addr                = 0x0574,
+		.debug_misr_val2_addr                = 0x0578,
+		.debug_misr_val3_addr                = 0x057C,
+		.format_measure_cfg0_addr            = 0x0580,
+		.format_measure_cfg1_addr            = 0x0584,
+		.format_measure0_addr                = 0x0588,
+		.format_measure1_addr                = 0x058C,
+		.format_measure2_addr                = 0x0590,
+		.timestamp_curr0_sof_addr            = 0x0594,
+		.timestamp_curr1_sof_addr            = 0x0598,
+		.timestamp_perv0_sof_addr            = 0x059C,
+		.timestamp_perv1_sof_addr            = 0x05A0,
+		.timestamp_curr0_eof_addr            = 0x05A4,
+		.timestamp_curr1_eof_addr            = 0x05A8,
+		.timestamp_perv0_eof_addr            = 0x05AC,
+		.timestamp_perv1_eof_addr            = 0x05B0,
+		.batch_period_cfg_addr               = 0x05BC,
+		.batch_stream_id_cfg_addr            = 0x05C0,
+		.epoch0_cfg_batch_id0_addr           = 0x05C4,
+		.epoch1_cfg_batch_id0_addr           = 0x05C8,
+		.epoch0_cfg_batch_id1_addr           = 0x05CC,
+		.epoch1_cfg_batch_id1_addr           = 0x05D0,
+		.epoch0_cfg_batch_id2_addr           = 0x05D4,
+		.epoch1_cfg_batch_id2_addr           = 0x05D8,
+		.epoch0_cfg_batch_id3_addr           = 0x05DC,
+		.epoch1_cfg_batch_id3_addr           = 0x05E0,
+		.epoch0_cfg_batch_id4_addr           = 0x05E4,
+		.epoch1_cfg_batch_id4_addr           = 0x05E8,
+		.epoch0_cfg_batch_id5_addr           = 0x05EC,
+		.epoch1_cfg_batch_id5_addr           = 0x05F0,
+
+		/* configurations */
+		.resume_frame_boundary               = 1,
+		.overflow_ctrl_en                    = 1,
+		.overflow_ctrl_mode_val              = 0x8,
+		.mipi_pack_supported                 = 1,
+		.packing_fmt_shift_val               = 15,
+		.plain_alignment_shift_val           = 11,
+		.plain_fmt_shift_val                 = 12,
+		.crop_v_en_shift_val                 = 8,
+		.crop_h_en_shift_val                 = 7,
+		.drop_v_en_shift_val                 = 6,
+		.drop_h_en_shift_val                 = 5,
+		.early_eof_en_shift_val              = 14,
+		.format_measure_en_shift_val         = 3,
+		.timestamp_en_shift_val              = 6,
+		.debug_byte_cntr_rst_shift_val       = 2,
+		.ccif_violation_en                   = 1,
+		.fatal_err_mask                      = 0x20186001,
+		.non_fatal_err_mask                  = 0x12000004,
+		.sof_irq_mask                        = 0x10,
+		.rup_irq_mask                        = 0x800000,
+		.epoch0_irq_mask                     = 0x200000,
+		.epoch1_irq_mask                     = 0x400000,
+		.eof_irq_mask                        = 0x8,
+		.rup_aup_mask                        = 0x100010,
+		.top_irq_mask                        = {0x100,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_880_rdi_1_reg_info = {
+		.irq_status_addr                     = 0x00FC,
+		.irq_mask_addr                       = 0x0100,
+		.irq_clear_addr                      = 0x0104,
+		.irq_set_addr                        = 0x0108,
+		.cfg0_addr                           = 0x0600,
+		.ctrl_addr                           = 0x0604,
+		.debug_clr_cmd_addr                  = 0x0608,
+		.multi_vcdt_cfg0_addr                = 0x060c,
+		.cfg1_addr                           = 0x0610,
+		.err_recovery_cfg0_addr              = 0x0614,
+		.err_recovery_cfg1_addr              = 0x0618,
+		.err_recovery_cfg2_addr              = 0x061C,
+		.debug_byte_cntr_ping_addr           = 0x0620,
+		.debug_byte_cntr_pong_addr           = 0x0624,
+		.camif_frame_cfg_addr                = 0x0628,
+		.epoch_irq_cfg_addr                  = 0x062C,
+		.epoch0_subsample_ptrn_addr          = 0x0630,
+		.epoch1_subsample_ptrn_addr          = 0x0634,
+		.debug_camif_1_addr                  = 0x0638,
+		.debug_camif_0_addr                  = 0x063C,
+		.frm_drop_pattern_addr               = 0x0640,
+		.frm_drop_period_addr                = 0x0644,
+		.irq_subsample_pattern_addr          = 0x0648,
+		.irq_subsample_period_addr           = 0x064C,
+		.hcrop_addr                          = 0x0650,
+		.vcrop_addr                          = 0x0654,
+		.pix_drop_pattern_addr               = 0x0658,
+		.pix_drop_period_addr                = 0x065C,
+		.line_drop_pattern_addr              = 0x0660,
+		.line_drop_period_addr               = 0x0664,
+		.debug_halt_status_addr              = 0x066C,
+		.debug_misr_val0_addr                = 0x0670,
+		.debug_misr_val1_addr                = 0x0674,
+		.debug_misr_val2_addr                = 0x0678,
+		.debug_misr_val3_addr                = 0x067C,
+		.format_measure_cfg0_addr            = 0x0680,
+		.format_measure_cfg1_addr            = 0x0684,
+		.format_measure0_addr                = 0x0688,
+		.format_measure1_addr                = 0x068C,
+		.format_measure2_addr                = 0x0690,
+		.timestamp_curr0_sof_addr            = 0x0694,
+		.timestamp_curr1_sof_addr            = 0x0698,
+		.timestamp_perv0_sof_addr            = 0x069C,
+		.timestamp_perv1_sof_addr            = 0x06A0,
+		.timestamp_curr0_eof_addr            = 0x06A4,
+		.timestamp_curr1_eof_addr            = 0x06A8,
+		.timestamp_perv0_eof_addr            = 0x06AC,
+		.timestamp_perv1_eof_addr            = 0x06B0,
+		.batch_period_cfg_addr               = 0x06BC,
+		.batch_stream_id_cfg_addr            = 0x06C0,
+		.epoch0_cfg_batch_id0_addr           = 0x06C4,
+		.epoch1_cfg_batch_id0_addr           = 0x06C8,
+		.epoch0_cfg_batch_id1_addr           = 0x06CC,
+		.epoch1_cfg_batch_id1_addr           = 0x06D0,
+		.epoch0_cfg_batch_id2_addr           = 0x06D4,
+		.epoch1_cfg_batch_id2_addr           = 0x06D8,
+		.epoch0_cfg_batch_id3_addr           = 0x06DC,
+		.epoch1_cfg_batch_id3_addr           = 0x06E0,
+		.epoch0_cfg_batch_id4_addr           = 0x06E4,
+		.epoch1_cfg_batch_id4_addr           = 0x06E8,
+		.epoch0_cfg_batch_id5_addr           = 0x06EC,
+		.epoch1_cfg_batch_id5_addr           = 0x06F0,
+
+		/* configurations */
+		.resume_frame_boundary               = 1,
+		.overflow_ctrl_en                    = 1,
+		.overflow_ctrl_mode_val              = 0x8,
+		.mipi_pack_supported                 = 1,
+		.packing_fmt_shift_val               = 15,
+		.plain_alignment_shift_val           = 11,
+		.plain_fmt_shift_val                 = 12,
+		.crop_v_en_shift_val                 = 8,
+		.crop_h_en_shift_val                 = 7,
+		.drop_v_en_shift_val                 = 6,
+		.drop_h_en_shift_val                 = 5,
+		.early_eof_en_shift_val              = 14,
+		.format_measure_en_shift_val         = 3,
+		.timestamp_en_shift_val              = 6,
+		.debug_byte_cntr_rst_shift_val       = 2,
+		.ccif_violation_en                   = 1,
+		.fatal_err_mask                      = 0x20186001,
+		.non_fatal_err_mask                  = 0x12000004,
+		.sof_irq_mask                        = 0x10,
+		.rup_irq_mask                        = 0x800000,
+		.epoch0_irq_mask                     = 0x200000,
+		.epoch1_irq_mask                     = 0x400000,
+		.eof_irq_mask                        = 0x8,
+		.rup_aup_mask                        = 0x200020,
+		.top_irq_mask                        = {0x200,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_880_rdi_2_reg_info = {
+		.irq_status_addr                     = 0x010C,
+		.irq_mask_addr                       = 0x0110,
+		.irq_clear_addr                      = 0x0114,
+		.irq_set_addr                        = 0x0118,
+		.cfg0_addr                           = 0x0700,
+		.ctrl_addr                           = 0x0704,
+		.debug_clr_cmd_addr                  = 0x0708,
+		.multi_vcdt_cfg0_addr                = 0x070c,
+		.cfg1_addr                           = 0x0710,
+		.err_recovery_cfg0_addr              = 0x0714,
+		.err_recovery_cfg1_addr              = 0x0718,
+		.err_recovery_cfg2_addr              = 0x071C,
+		.debug_byte_cntr_ping_addr           = 0x0720,
+		.debug_byte_cntr_pong_addr           = 0x0724,
+		.camif_frame_cfg_addr                = 0x0728,
+		.epoch_irq_cfg_addr                  = 0x072C,
+		.epoch0_subsample_ptrn_addr          = 0x0730,
+		.epoch1_subsample_ptrn_addr          = 0x0734,
+		.debug_camif_1_addr                  = 0x0738,
+		.debug_camif_0_addr                  = 0x073C,
+		.frm_drop_pattern_addr               = 0x0740,
+		.frm_drop_period_addr                = 0x0744,
+		.irq_subsample_pattern_addr          = 0x0748,
+		.irq_subsample_period_addr           = 0x074C,
+		.hcrop_addr                          = 0x0750,
+		.vcrop_addr                          = 0x0754,
+		.pix_drop_pattern_addr               = 0x0758,
+		.pix_drop_period_addr                = 0x075C,
+		.line_drop_pattern_addr              = 0x0760,
+		.line_drop_period_addr               = 0x0764,
+		.debug_halt_status_addr              = 0x076C,
+		.debug_misr_val0_addr                = 0x0770,
+		.debug_misr_val1_addr                = 0x0774,
+		.debug_misr_val2_addr                = 0x0778,
+		.debug_misr_val3_addr                = 0x077C,
+		.format_measure_cfg0_addr            = 0x0780,
+		.format_measure_cfg1_addr            = 0x0784,
+		.format_measure0_addr                = 0x0788,
+		.format_measure1_addr                = 0x078C,
+		.format_measure2_addr                = 0x0790,
+		.timestamp_curr0_sof_addr            = 0x0794,
+		.timestamp_curr1_sof_addr            = 0x0798,
+		.timestamp_perv0_sof_addr            = 0x079C,
+		.timestamp_perv1_sof_addr            = 0x07A0,
+		.timestamp_curr0_eof_addr            = 0x07A4,
+		.timestamp_curr1_eof_addr            = 0x07A8,
+		.timestamp_perv0_eof_addr            = 0x07AC,
+		.timestamp_perv1_eof_addr            = 0x07B0,
+		.batch_period_cfg_addr               = 0x07BC,
+		.batch_stream_id_cfg_addr            = 0x07C0,
+		.epoch0_cfg_batch_id0_addr           = 0x07C4,
+		.epoch1_cfg_batch_id0_addr           = 0x07C8,
+		.epoch0_cfg_batch_id1_addr           = 0x07CC,
+		.epoch1_cfg_batch_id1_addr           = 0x07D0,
+		.epoch0_cfg_batch_id2_addr           = 0x07D4,
+		.epoch1_cfg_batch_id2_addr           = 0x07D8,
+		.epoch0_cfg_batch_id3_addr           = 0x07DC,
+		.epoch1_cfg_batch_id3_addr           = 0x07E0,
+		.epoch0_cfg_batch_id4_addr           = 0x07E4,
+		.epoch1_cfg_batch_id4_addr           = 0x07E8,
+		.epoch0_cfg_batch_id5_addr           = 0x07EC,
+		.epoch1_cfg_batch_id5_addr           = 0x07F0,
+
+		/* configurations */
+		.resume_frame_boundary               = 1,
+		.overflow_ctrl_en                    = 1,
+		.overflow_ctrl_mode_val              = 0x8,
+		.mipi_pack_supported                 = 1,
+		.packing_fmt_shift_val               = 15,
+		.plain_alignment_shift_val           = 11,
+		.plain_fmt_shift_val                 = 12,
+		.crop_v_en_shift_val                 = 8,
+		.crop_h_en_shift_val                 = 7,
+		.drop_v_en_shift_val                 = 6,
+		.drop_h_en_shift_val                 = 5,
+		.early_eof_en_shift_val              = 14,
+		.format_measure_en_shift_val         = 3,
+		.timestamp_en_shift_val              = 6,
+		.debug_byte_cntr_rst_shift_val       = 2,
+		.ccif_violation_en                   = 1,
+		.fatal_err_mask                      = 0x20186001,
+		.non_fatal_err_mask                  = 0x12000004,
+		.sof_irq_mask                        = 0x10,
+		.rup_irq_mask                        = 0x800000,
+		.epoch0_irq_mask                     = 0x200000,
+		.epoch1_irq_mask                     = 0x400000,
+		.eof_irq_mask                        = 0x8,
+		.rup_aup_mask                        = 0x400040,
+		.top_irq_mask                        = {0x400,},
+};
+
+static struct cam_ife_csid_ver2_path_reg_info
+	cam_ife_csid_lite_880_rdi_3_reg_info = {
+		.irq_status_addr                     = 0x011C,
+		.irq_mask_addr                       = 0x0120,
+		.irq_clear_addr                      = 0x0124,
+		.irq_set_addr                        = 0x0128,
+		.cfg0_addr                           = 0x0800,
+		.ctrl_addr                           = 0x0804,
+		.debug_clr_cmd_addr                  = 0x0808,
+		.multi_vcdt_cfg0_addr                = 0x080c,
+		.cfg1_addr                           = 0x0810,
+		.err_recovery_cfg0_addr              = 0x0814,
+		.err_recovery_cfg1_addr              = 0x0818,
+		.err_recovery_cfg2_addr              = 0x081C,
+		.debug_byte_cntr_ping_addr           = 0x0820,
+		.debug_byte_cntr_pong_addr           = 0x0824,
+		.camif_frame_cfg_addr                = 0x0828,
+		.epoch_irq_cfg_addr                  = 0x082C,
+		.epoch0_subsample_ptrn_addr          = 0x0830,
+		.epoch1_subsample_ptrn_addr          = 0x0834,
+		.debug_camif_1_addr                  = 0x0838,
+		.debug_camif_0_addr                  = 0x083C,
+		.frm_drop_pattern_addr               = 0x0840,
+		.frm_drop_period_addr                = 0x0840,
+		.irq_subsample_pattern_addr          = 0x0848,
+		.irq_subsample_period_addr           = 0x084C,
+		.hcrop_addr                          = 0x0850,
+		.vcrop_addr                          = 0x0854,
+		.pix_drop_pattern_addr               = 0x0858,
+		.pix_drop_period_addr                = 0x085C,
+		.line_drop_pattern_addr              = 0x0860,
+		.line_drop_period_addr               = 0x0864,
+		.debug_halt_status_addr              = 0x0868,
+		.debug_misr_val0_addr                = 0x0870,
+		.debug_misr_val1_addr                = 0x0874,
+		.debug_misr_val2_addr                = 0x0878,
+		.debug_misr_val3_addr                = 0x087C,
+		.format_measure_cfg0_addr            = 0x0880,
+		.format_measure_cfg1_addr            = 0x0884,
+		.format_measure0_addr                = 0x0888,
+		.format_measure1_addr                = 0x088C,
+		.format_measure2_addr                = 0x0890,
+		.timestamp_curr0_sof_addr            = 0x0894,
+		.timestamp_curr1_sof_addr            = 0x0898,
+		.timestamp_perv0_sof_addr            = 0x089C,
+		.timestamp_perv1_sof_addr            = 0x08A0,
+		.timestamp_curr0_eof_addr            = 0x08A4,
+		.timestamp_curr1_eof_addr            = 0x08A8,
+		.timestamp_perv0_eof_addr            = 0x08AC,
+		.timestamp_perv1_eof_addr            = 0x08B0,
+		.batch_period_cfg_addr               = 0x08BC,
+		.batch_stream_id_cfg_addr            = 0x08C0,
+		.epoch0_cfg_batch_id0_addr           = 0x08C4,
+		.epoch1_cfg_batch_id0_addr           = 0x08C8,
+		.epoch0_cfg_batch_id1_addr           = 0x08CC,
+		.epoch1_cfg_batch_id1_addr           = 0x08D0,
+		.epoch0_cfg_batch_id2_addr           = 0x08D4,
+		.epoch1_cfg_batch_id2_addr           = 0x08D8,
+		.epoch0_cfg_batch_id3_addr           = 0x08DC,
+		.epoch1_cfg_batch_id3_addr           = 0x08E0,
+		.epoch0_cfg_batch_id4_addr           = 0x08E4,
+		.epoch1_cfg_batch_id4_addr           = 0x08E8,
+		.epoch0_cfg_batch_id5_addr           = 0x08EC,
+		.epoch1_cfg_batch_id5_addr           = 0x08F0,
+
+		/* configurations */
+		.resume_frame_boundary               = 1,
+		.overflow_ctrl_en                    = 1,
+		.overflow_ctrl_mode_val              = 0x8,
+		.mipi_pack_supported                 = 1,
+		.packing_fmt_shift_val               = 15,
+		.plain_alignment_shift_val           = 11,
+		.plain_fmt_shift_val                 = 12,
+		.crop_v_en_shift_val                 = 8,
+		.crop_h_en_shift_val                 = 7,
+		.drop_v_en_shift_val                 = 6,
+		.drop_h_en_shift_val                 = 5,
+		.early_eof_en_shift_val              = 14,
+		.format_measure_en_shift_val         = 3,
+		.timestamp_en_shift_val              = 6,
+		.debug_byte_cntr_rst_shift_val       = 2,
+		.ccif_violation_en                   = 1,
+		.fatal_err_mask                      = 0x20186001,
+		.non_fatal_err_mask                  = 0x12000004,
+		.sof_irq_mask                        = 0x10,
+		.rup_irq_mask                        = 0x800000,
+		.epoch0_irq_mask                     = 0x200000,
+		.epoch1_irq_mask                     = 0x400000,
+		.eof_irq_mask                        = 0x8,
+		.rup_aup_mask                        = 0x800080,
+		.top_irq_mask                        = {0x800,},
+};
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_lite_880_reg_info = {
+	.top_irq_reg_info      = &cam_ife_csid_lite_880_top_irq_reg_info,
+	.rx_irq_reg_info       = &cam_ife_csid_lite_880_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		NULL,
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		},
+	.buf_done_irq_reg_info = &cam_ife_csid_lite_880_buf_done_irq_reg_info,
+	.cmn_reg               = &cam_ife_csid_lite_880_cmn_reg_info,
+	.csi2_reg              = &cam_ife_csid_lite_880_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_lite_880_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = NULL,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_lite_880_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_lite_880_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_lite_880_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_lite_880_rdi_3_reg_info,
+	.need_top_cfg = 0,
+	.top_irq_desc       = &cam_ife_csid_lite_880_top_irq_desc,
+	.rx_irq_desc        = &cam_ife_csid_lite_880_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_lite_880_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_lite_880_num_top_irq_desc,
+	.num_rx_err_irqs    = cam_ife_csid_lite_880_num_rx_irq_desc,
+	.num_path_err_irqs  = ARRAY_SIZE(cam_ife_csid_lite_880_path_irq_desc),
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+	.is_ife_sfe_mapped  = true,
+};
+#endif /* _CAM_IFE_CSID_LITE_780_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite980.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite980.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE_980_H_
+#define _CAM_IFE_CSID_LITE_980_H_
+
+#include "cam_ife_csid_lite880.h"
+
+static struct cam_ife_csid_ver2_reg_info cam_ife_csid_lite_980_reg_info = {
+	.top_irq_reg_info      = &cam_ife_csid_lite_880_top_irq_reg_info,
+	.rx_irq_reg_info       = &cam_ife_csid_lite_880_rx_irq_reg_info,
+	.path_irq_reg_info     = {
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_0],
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_1],
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_2],
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_RDI_3],
+		NULL,
+		&cam_ife_csid_lite_880_path_irq_reg_info[CAM_IFE_PIX_PATH_RES_IPP],
+		},
+	.buf_done_irq_reg_info = &cam_ife_csid_lite_880_buf_done_irq_reg_info,
+	.cmn_reg               = &cam_ife_csid_lite_880_cmn_reg_info,
+	.csi2_reg              = &cam_ife_csid_lite_880_csi2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_IPP]   = &cam_ife_csid_lite_880_ipp_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_PPP]   = NULL,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_0] = &cam_ife_csid_lite_880_rdi_0_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_1] = &cam_ife_csid_lite_880_rdi_1_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_2] = &cam_ife_csid_lite_880_rdi_2_reg_info,
+	.path_reg[CAM_IFE_PIX_PATH_RES_RDI_3] = &cam_ife_csid_lite_880_rdi_3_reg_info,
+	.need_top_cfg = 0,
+	.top_irq_desc       = &cam_ife_csid_lite_880_top_irq_desc,
+	.rx_irq_desc        = &cam_ife_csid_lite_880_rx_irq_desc,
+	.path_irq_desc      = cam_ife_csid_lite_880_path_irq_desc,
+	.num_top_err_irqs   = cam_ife_csid_lite_880_num_top_irq_desc,
+	.num_rx_err_irqs    = cam_ife_csid_lite_880_num_rx_irq_desc,
+	.num_path_err_irqs  = ARRAY_SIZE(cam_ife_csid_lite_880_path_irq_desc),
+	.num_top_regs       = 1,
+	.num_rx_regs        = 1,
+};
+
+#endif /* _CAM_IFE_CSID_LITE_980_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite_mod.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite_mod.c
@@ -0,0 +1,143 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "camera_main.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+#include "cam_ife_csid_lite17x.h"
+#include "cam_ife_csid_lite480.h"
+#include "cam_ife_csid_lite680.h"
+#include "cam_ife_csid_lite690.h"
+#include "cam_ife_csid_lite692.h"
+#include "cam_ife_csid_lite780.h"
+#include "cam_ife_csid_lite860.h"
+#include "cam_ife_csid_lite880.h"
+
+#define CAM_CSID_LITE_DRV_NAME                    "csid_lite"
+
+static struct cam_ife_csid_core_info cam_ife_csid_lite_17x_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_17x_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid_lite_480_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_480_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid_lite_680_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_680_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid_lite_690_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_690_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid_lite_692_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_692_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid_lite_780_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_780_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid_lite_860_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_860_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid_lite_880_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_880_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static const struct of_device_id cam_ife_csid_lite_dt_match[] = {
+	{
+		.compatible = "qcom,csid-lite170",
+		.data = &cam_ife_csid_lite_17x_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite175",
+		.data = &cam_ife_csid_lite_17x_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite165",
+		.data = &cam_ife_csid_lite_17x_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite480",
+		.data = &cam_ife_csid_lite_480_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite570",
+		.data = &cam_ife_csid_lite_480_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite580",
+		.data = &cam_ife_csid_lite_480_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite680",
+		.data = &cam_ife_csid_lite_680_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite690",
+		.data = &cam_ife_csid_lite_690_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite692",
+		.data = &cam_ife_csid_lite_692_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite680_110",
+		.data = &cam_ife_csid_lite_680_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite780",
+		.data = &cam_ife_csid_lite_780_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite860",
+		.data = &cam_ife_csid_lite_860_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite880",
+		.data = &cam_ife_csid_lite_880_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_ife_csid_lite_dt_match);
+
+struct platform_driver cam_ife_csid_lite_driver = {
+	.probe = cam_ife_csid_probe,
+	.remove = cam_ife_csid_remove,
+	.driver = {
+		.name = CAM_CSID_LITE_DRV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ife_csid_lite_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ife_csid_lite_init_module(void)
+{
+	return platform_driver_register(&cam_ife_csid_lite_driver);
+}
+
+void cam_ife_csid_lite_exit_module(void)
+{
+	platform_driver_unregister(&cam_ife_csid_lite_driver);
+}
+
+MODULE_DESCRIPTION("CAM IFE_CSID_LITE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_mod.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_mod.c
@@ -0,0 +1,204 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+#include "cam_ife_csid_common.h"
+#include "cam_ife_csid_hw_ver1.h"
+#include "cam_ife_csid_hw_ver2.h"
+#include "cam_ife_csid170.h"
+#include "cam_ife_csid170_200.h"
+#include "cam_ife_csid175.h"
+#include "cam_ife_csid175_200.h"
+#include "cam_ife_csid480.h"
+#include "cam_ife_csid570.h"
+#include "cam_ife_csid580.h"
+#include "cam_ife_csid680.h"
+#include "cam_ife_csid690.h"
+#include "cam_ife_csid692.h"
+#include "cam_ife_csid680_110.h"
+#include "cam_ife_csid780.h"
+#include "cam_ife_csid860.h"
+#include "cam_ife_csid880.h"
+#include "cam_ife_csid980.h"
+
+#define CAM_CSID_DRV_NAME                    "csid"
+
+static struct cam_ife_csid_core_info cam_ife_csid170_hw_info = {
+	.csid_reg = &cam_ife_csid_170_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid170_200_hw_info = {
+	.csid_reg = &cam_ife_csid_170_200_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid175_hw_info = {
+	.csid_reg = &cam_ife_csid_175_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid175_200_hw_info = {
+	.csid_reg = &cam_ife_csid_175_200_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid165_204_hw_info = {
+	.csid_reg = &cam_ife_csid_175_200_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid480_hw_info = {
+	.csid_reg = &cam_ife_csid_480_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid570_hw_info = {
+	.csid_reg = &cam_ife_csid_570_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid580_hw_info = {
+	.csid_reg = &cam_ife_csid_580_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_1_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid680_hw_info = {
+	.csid_reg = &cam_ife_csid_680_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid680_110_hw_info = {
+	.csid_reg = &cam_ife_csid_680_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid780_hw_info = {
+	.csid_reg = &cam_ife_csid_780_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid860_hw_info = {
+	.csid_reg = &cam_ife_csid_860_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid880_hw_info = {
+	.csid_reg = &cam_ife_csid_880_reg_info,
+	.sw_version  = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid980_hw_info = {
+	.csid_reg = &cam_ife_csid_980_reg_info,
+	.sw_version = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid690_hw_info = {
+	.csid_reg = &cam_ife_csid_690_reg_info,
+	.sw_version = CAM_IFE_CSID_VER_2_0,
+};
+
+static struct cam_ife_csid_core_info cam_ife_csid692_hw_info = {
+	.csid_reg = &cam_ife_csid_692_reg_info,
+	.sw_version = CAM_IFE_CSID_VER_2_0,
+};
+
+static const struct of_device_id cam_ife_csid_dt_match[] = {
+
+	{
+		.compatible = "qcom,csid170",
+		.data = &cam_ife_csid170_hw_info,
+	},
+	{
+		.compatible = "qcom,csid170_200",
+		.data = &cam_ife_csid170_200_hw_info,
+	},
+	{
+		.compatible = "qcom,csid175",
+		.data = &cam_ife_csid175_hw_info,
+	},
+	{
+		.compatible = "qcom,csid175_200",
+		.data = &cam_ife_csid175_200_hw_info,
+	},
+	{
+		.compatible = "qcom,csid165_204",
+		.data = &cam_ife_csid165_204_hw_info,
+	},
+	{
+		.compatible = "qcom,csid480",
+		.data = &cam_ife_csid480_hw_info,
+	},
+	{
+		.compatible = "qcom,csid570",
+		.data = &cam_ife_csid570_hw_info,
+	},
+	{
+		.compatible = "qcom,csid580",
+		.data = &cam_ife_csid580_hw_info,
+	},
+	{
+		.compatible = "qcom,csid680",
+		.data = &cam_ife_csid680_hw_info,
+	},
+	{
+		.compatible = "qcom,csid680_110",
+		.data = &cam_ife_csid680_110_hw_info,
+	},
+	{
+		.compatible = "qcom,csid780",
+		.data = &cam_ife_csid780_hw_info,
+	},
+	{
+		.compatible = "qcom,csid860",
+		.data = &cam_ife_csid860_hw_info,
+	},
+	{
+		.compatible = "qcom,csid880",
+		.data = &cam_ife_csid880_hw_info,
+	},
+	{
+		.compatible = "qcom,csid980",
+		.data = &cam_ife_csid980_hw_info,
+	},
+	{
+		.compatible = "qcom,csid690",
+		.data = &cam_ife_csid690_hw_info,
+	},
+	{
+		.compatible = "qcom,csid692",
+		.data = &cam_ife_csid692_hw_info,
+	},
+	{},
+};
+
+MODULE_DEVICE_TABLE(of, cam_ife_csid_dt_match);
+
+struct platform_driver cam_ife_csid_driver = {
+	.probe = cam_ife_csid_probe,
+	.remove = cam_ife_csid_remove,
+	.driver = {
+		.name = CAM_CSID_DRV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ife_csid_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ife_csid_init_module(void)
+{
+	return platform_driver_register(&cam_ife_csid_driver);
+}
+
+void cam_ife_csid_exit_module(void)
+{
+	platform_driver_unregister(&cam_ife_csid_driver);
+}
+
+MODULE_DESCRIPTION("CAM IFE_CSID driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.c
@@ -0,0 +1,296 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/slab.h>
+#include "cam_ife_csid_soc.h"
+#include "cam_debug_util.h"
+
+static int cam_ife_csid_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	struct device_node *of_node = NULL;
+	struct cam_csid_soc_private *soc_private = NULL;
+	int rc = 0;
+
+	of_node = soc_info->pdev->dev.of_node;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc)
+		return rc;
+
+	soc_private = (struct cam_csid_soc_private *)soc_info->soc_private;
+
+	rc = of_property_read_u32(of_node, "max-width",
+		&soc_private->max_width);
+	if (rc) {
+		CAM_DBG(CAM_ISP, "No max-width declared");
+		soc_private->max_width_enabled = false;
+	} else {
+		soc_private->max_width_enabled = true;
+	}
+
+	soc_private->is_ife_csid_lite = false;
+	if (strnstr(soc_info->compatible, "lite",
+		strlen(soc_info->compatible)) != NULL) {
+		soc_private->is_ife_csid_lite = true;
+	}
+
+	rc = of_property_read_u32(of_node, "rt-wrapper-base", &soc_private->rt_wrapper_base);
+	if (rc) {
+		soc_private->rt_wrapper_base = 0;
+		CAM_DBG(CAM_ISP, "rc: %d Error reading rt_wrapper_base for core_idx: %u",
+			rc, soc_info->index);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler,
+	void *data)
+{
+	int rc = 0, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, csid_irq_handler, &(irq_data[0]));
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int cam_ife_csid_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler, cam_cpas_client_cb_func cpas_cb,
+	void *data, bool is_custom)
+{
+	int rc = 0;
+	struct cam_cpas_register_params   cpas_register_param;
+	struct cam_csid_soc_private      *soc_private;
+
+	soc_private = kzalloc(sizeof(struct cam_csid_soc_private), GFP_KERNEL);
+	if (!soc_private)
+		return -ENOMEM;
+
+	soc_info->soc_private = soc_private;
+
+	rc = cam_ife_csid_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Failed in get_dt_properties, rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	/* Need to see if we want post process the clock list */
+
+	if (!soc_private->is_ife_csid_lite) {
+		rc = cam_cpas_query_drv_enable(NULL, &soc_info->is_clk_drv_en);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to query DRV enable rc:%d", rc);
+			goto free_soc_private;
+		}
+	}
+
+	rc = cam_ife_csid_request_platform_resource(soc_info, csid_irq_handler,
+		data);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Error Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	if (is_custom)
+		strscpy(cpas_register_param.identifier, "csid-custom",
+			CAM_HW_IDENTIFIER_LENGTH);
+	else
+		strscpy(cpas_register_param.identifier, "csid",
+			CAM_HW_IDENTIFIER_LENGTH);
+
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	cpas_register_param.cam_cpas_client_cb = cpas_cb;
+	cpas_register_param.userdata = data;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	} else {
+		soc_private->cpas_handle = cpas_register_param.client_handle;
+	}
+
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_ife_csid_deinit_soc_resources(
+	struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPAS unregistration failed rc=%d", rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_WARN(CAM_ISP,
+			"soc release platform resource fail rc: %d", rc);
+
+	return rc;
+}
+
+int cam_ife_csid_enable_soc_resources(
+	struct cam_hw_soc_info *soc_info, enum cam_vote_level clk_level)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	CAM_DBG(CAM_ISP, "csid camnoc_bw:%lld mnoc_ab_bw:%lld mnoc_ib_bw:%lld ",
+		axi_vote.axi_path[0].camnoc_bw,
+		axi_vote.axi_path[0].mnoc_ab_bw,
+		axi_vote.axi_path[0].mnoc_ib_bw);
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS start failed");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (!soc_private->is_ife_csid_lite) {
+		/* query this everytime to support debugfs to disable clk drv */
+		rc = cam_cpas_query_drv_enable(NULL, &soc_info->is_clk_drv_en);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to query DRV enable rc:%d", rc);
+			goto stop_cpas;
+		}
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info,
+		(soc_info->is_clk_drv_en ? soc_info->index : CAM_CLK_SW_CLIENT_IDX), true,
+		clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "enable platform failed rc %d", rc);
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_ife_csid_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info,
+		((soc_info->is_clk_drv_en && (!soc_private->is_ife_csid_lite)) ?
+		soc_info->index : CAM_CLK_SW_CLIENT_IDX), true, true);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Disable platform failed");
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_ife_csid_enable_ife_force_clock_on(struct cam_hw_soc_info  *soc_info,
+	uint32_t cpas_ife_base_offset)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+	uint32_t                           cpass_ife_force_clk_offset;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+
+	soc_private = soc_info->soc_private;
+	cpass_ife_force_clk_offset =
+		cpas_ife_base_offset + (0x4 * soc_info->index);
+	rc = cam_cpas_reg_write(soc_private->cpas_handle, CAM_CPAS_REGBASE_CPASTOP,
+		cpass_ife_force_clk_offset, 1, 1);
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPASS set IFE:%d Force clock On failed",
+			soc_info->index);
+	else
+		CAM_DBG(CAM_ISP, "CPASS set IFE:%d Force clock On",
+		soc_info->index);
+
+	return rc;
+}
+
+int cam_ife_csid_disable_ife_force_clock_on(struct cam_hw_soc_info *soc_info,
+	uint32_t cpas_ife_base_offset)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+	uint32_t                           cpass_ife_force_clk_offset;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+
+	soc_private = soc_info->soc_private;
+	cpass_ife_force_clk_offset =
+		cpas_ife_base_offset + (0x4 * soc_info->index);
+	rc = cam_cpas_reg_write(soc_private->cpas_handle, CAM_CPAS_REGBASE_CPASTOP,
+		cpass_ife_force_clk_offset,  1, 0);
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPASS set IFE:%d Force clock Off failed",
+			soc_info->index);
+	else
+		CAM_DBG(CAM_ISP, "CPASS set IFE:%d Force clock off",
+		soc_info->index);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.h
@@ -0,0 +1,133 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_SOC_H_
+#define _CAM_IFE_CSID_SOC_H_
+
+#include "cam_isp_hw.h"
+#include "cam_cpas_api.h"
+
+
+/*
+ * struct cam_csid_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to CSID HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ * @rt_wrapper_base:         Base address of the RT-Wrapper if the hw is in rt-wrapper
+ * @max_width:               Maxinum allowed width
+ * @is_ife_csid_lite:        Flag to indicate Whether a full csid or a Lite csid
+ * @max_width_enabled:       Flag to enable max width restriction
+ */
+struct cam_csid_soc_private {
+	uint32_t cpas_handle;
+	uint32_t rt_wrapper_base;
+	uint32_t max_width;
+	bool     is_ife_csid_lite;
+	bool     max_width_enabled;
+};
+
+/**
+ * struct csid_device_soc_info - CSID SOC info object
+ *
+ * @csi_vdd_voltage:       csi vdd voltage value
+ *
+ */
+struct csid_device_soc_info {
+	int                             csi_vdd_voltage;
+};
+
+/**
+ * cam_ife_csid_init_soc_resources()
+ *
+ * @brief:                 csid initialization function for the soc info
+ *
+ * @soc_info:              soc info structure pointer
+ * @csid_irq_handler:      irq handler function to be registered
+ * @cpas_cb:               handler for cpas cb
+ * @data:                  data for the callback functions
+ * @is_custom:             for custom csid hw
+ *
+ */
+int cam_ife_csid_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler, cam_cpas_client_cb_func cpas_cb,
+	void *data, bool is_custom);
+
+
+/**
+ * cam_ife_csid_deinit_soc_resources()
+ *
+ * @brief:                 csid de initialization function for the soc info
+ *
+ * @soc_info:              soc info structure pointer
+ *
+ */
+int cam_ife_csid_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_ife_csid_enable_soc_resources()
+ *
+ * @brief:                 csid soc resource enable function
+ *
+ * @soc_info:              soc info structure pointer
+ * @clk_lvl:               vote level to start with
+ *
+ */
+int cam_ife_csid_enable_soc_resources(struct cam_hw_soc_info  *soc_info,
+	uint32_t clk_lvl);
+
+/**
+ * cam_ife_csid_disable_soc_resources()
+ *
+ * @brief:                 csid soc resource disable function
+ *
+ * @soc_info:              soc info structure pointer
+ *
+ */
+int cam_ife_csid_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_ife_csid_enable_ife_force_clock()
+ *
+ * @brief:                 if csid testgen used for dual isp case, before
+ *                         starting csid test gen, enable ife force clock on
+ *                         through cpas
+ *
+ * @soc_info:              soc info structure pointer
+ * @cpas_ife_base_offset:  cpas ife force clock base reg offset value
+ *
+ */
+int cam_ife_csid_enable_ife_force_clock_on(struct cam_hw_soc_info  *soc_info,
+	uint32_t cpas_ife_base_offset);
+
+/**
+ * cam_ife_csid_disable_ife_force_clock_on()
+ *
+ * @brief:                 disable the IFE force clock on after dual ISP
+ *                         CSID test gen stop
+ *
+ * @soc_info:              soc info structure pointer
+ * @cpas_ife_base_offset:  cpas ife force clock base reg offset value
+ *
+ */
+int cam_ife_csid_disable_ife_force_clock_on(struct cam_hw_soc_info *soc_info,
+	uint32_t cpas_ife_base_offset);
+
+/**
+ * cam_ife_csid_get_vote_level()
+ *
+ * @brief:                 get the vote level from clock rate
+ *
+ * @soc_info:              soc info structure pointer
+ * @clock_rate             clock rate
+ *
+ */
+uint32_t cam_ife_csid_get_vote_level(struct cam_hw_soc_info *soc_info,
+	uint64_t clock_rate);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_ife_csid_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_ife_csid_hw_intf.h
@@ -0,0 +1,638 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSID_HW_INTF_H_
+#define _CAM_CSID_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_hw_intf.h"
+
+/* MAX IFE CSID instance */
+#define CAM_IFE_CSID_HW_NUM_MAX                        8
+#define CAM_IFE_CSID_UDI_MAX                           3
+#define RT_BASE_IDX                                    2
+#define CAM_ISP_MAX_PATHS                              8
+
+/**
+ * enum cam_ife_csid_hw_irq_regs - Specify the top irq reg
+ */
+enum cam_ife_csid_hw_irq_regs {
+	CAM_IFE_CSID_IRQ_TOP_REG_STATUS0,
+	CAM_IFE_CSID_IRQ_REGISTERS_MAX,
+};
+
+/**
+ * enum cam_ife_csid_top_irq_regs - Specify the top irq reg
+ */
+enum cam_ife_csid_top_irq_regs {
+	CAM_IFE_CSID_TOP_IRQ_STATUS_REG0,
+	CAM_IFE_CSID_TOP2_IRQ_STATUS_REG1,
+	CAM_IFE_CSID_TOP_IRQ_STATUS_REG_MAX,
+};
+
+/**
+ * enum cam_ife_csid_rx_irq_regs - Specify the rx irq reg
+ */
+enum cam_ife_csid_rx_irq_regs {
+	CAM_IFE_CSID_RX_IRQ_STATUS_REG0,
+	CAM_IFE_CSID_RX2_IRQ_STATUS_REG1,
+	CAM_IFE_CSID_RX_IRQ_STATUS_REG_MAX,
+};
+
+/**
+ * enum cam_ife_csid_input_core_type - Specify the csid input core
+ */
+enum cam_ife_csid_input_core_type {
+	CAM_IFE_CSID_INPUT_CORE_NONE,
+	CAM_IFE_CSID_INPUT_CORE_IFE,
+	CAM_IFE_CSID_INPUT_CORE_SFE_IFE,
+	CAM_IFE_CSID_INPUT_CORE_SFE,
+	CAM_IFE_CSID_INPUT_CORE_CUST_IFE,
+};
+
+/**
+ * enum cam_ife_pix_path_res_id - Specify the csid patch
+ */
+enum cam_ife_pix_path_res_id {
+	CAM_IFE_PIX_PATH_RES_RDI_0,
+	CAM_IFE_PIX_PATH_RES_RDI_1,
+	CAM_IFE_PIX_PATH_RES_RDI_2,
+	CAM_IFE_PIX_PATH_RES_RDI_3,
+	CAM_IFE_PIX_PATH_RES_RDI_4,
+	CAM_IFE_PIX_PATH_RES_RDI_5,
+	CAM_IFE_PIX_PATH_RES_IPP,
+	CAM_IFE_PIX_PATH_RES_PPP,
+	CAM_IFE_PIX_PATH_RES_UDI_0,
+	CAM_IFE_PIX_PATH_RES_UDI_1,
+	CAM_IFE_PIX_PATH_RES_UDI_2,
+	CAM_IFE_PIX_PATH_RES_IPP_1,
+	CAM_IFE_PIX_PATH_RES_IPP_2,
+	CAM_IFE_PIX_PATH_RES_MAX,
+};
+
+/**
+ * enum cam_ife_cid_res_id - Specify the csid cid
+ */
+enum cam_ife_cid_res_id {
+	CAM_IFE_CSID_CID_0,
+	CAM_IFE_CSID_CID_1,
+	CAM_IFE_CSID_CID_2,
+	CAM_IFE_CSID_CID_3,
+	CAM_IFE_CSID_CID_MAX,
+};
+
+/**
+ * enum cam_ife_csid_secondary_evt_type - Specify the event type
+ */
+enum cam_ife_csid_secondary_evt_type {
+	CAM_IFE_CSID_EVT_SOF = 1,
+	CAM_IFE_CSID_EVT_EPOCH,
+	CAM_IFE_CSID_EVT_EOF,
+	CAM_IFE_CSID_EVT_SENSOR_SYNC_FRAME_DROP,
+	CAM_IFE_CSID_EVT_MAX,
+};
+
+/**
+ * struct cam_ife_csid_hw_caps- get the CSID hw capability
+ * @num_rdis:              number of rdis supported by CSID HW device
+ * @num_pix:               number of pxl paths supported by CSID HW device
+ * @num_ppp:               number of ppp paths supported by CSID HW device
+ * @major_version :        major version
+ * @minor_version:         minor version
+ * @version_incr:          version increment
+ * @sfe_ipp_input_rdi_res: RDI Res as an input to SFE
+ * @is_lite:               is the ife_csid lite
+ * @global_reset_en:       flag to indicate if global reset is enabled
+ * @rup_en:                flag to indicate if rup is on csid side
+ * @only_master_rup:       flag to indicate if only master RUP
+ * @camif_irq_support:     flag to indicate if CSID supports CAMIF irq
+ * @is_ife_sfe_mapped:     flag to indicate if IFE & SFE are one-one mapped
+ */
+struct cam_ife_csid_hw_caps {
+	uint32_t      num_rdis;
+	uint32_t      num_pix;
+	uint32_t      num_ppp;
+	uint32_t      major_version;
+	uint32_t      minor_version;
+	uint32_t      version_incr;
+	uint32_t      sfe_ipp_input_rdi_res;
+	bool          is_lite;
+	bool          global_reset_en;
+	bool          rup_en;
+	bool          only_master_rup;
+	bool          camif_irq_support;
+	bool          is_ife_sfe_mapped;
+};
+
+struct cam_isp_out_port_generic_info {
+	uint32_t                res_type;
+	uint32_t                format;
+	uint32_t                width;
+	uint32_t                height;
+	uint32_t                comp_grp_id;
+	uint32_t                split_point;
+	uint32_t                secure_mode;
+	uint32_t                reserved;
+	uint32_t                wm_mode;
+	uint32_t                hw_context_id;
+	uint32_t                acquired_res_type;
+};
+
+struct cam_isp_in_port_generic_info {
+	uint32_t                        major_ver;
+	uint32_t                        minor_ver;
+	uint32_t                        res_type;
+	uint32_t                        lane_type;
+	uint32_t                        lane_num;
+	uint32_t                        lane_cfg;
+	uint32_t                        vc[CAM_ISP_VC_DT_CFG];
+	uint32_t                        dt[CAM_ISP_VC_DT_CFG];
+	uint32_t                        num_valid_vc_dt;
+	uint32_t                        format[CAM_ISP_VC_DT_CFG];
+	uint32_t                        test_pattern;
+	uint32_t                        usage_type;
+	uint32_t                        left_start;
+	uint32_t                        left_stop;
+	uint32_t                        left_width;
+	uint32_t                        right_start;
+	uint32_t                        right_stop;
+	uint32_t                        right_width;
+	uint32_t                        line_start;
+	uint32_t                        line_stop;
+	uint32_t                        height;
+	uint32_t                        pixel_clk;
+	uint32_t                        batch_size;
+	uint32_t                        dsp_mode;
+	uint32_t                        hbi_cnt;
+	uint32_t                        fe_unpacker_fmt;
+	uint32_t                        cust_node;
+	uint32_t                        num_out_res;
+	uint32_t                        horizontal_bin;
+	uint32_t                        vertical_bin;
+	uint32_t                        qcfa_bin;
+	uint32_t                        num_bytes_out;
+	uint32_t                        ipp_count;
+	uint32_t                        ppp_count;
+	uint32_t                        rdi_count;
+	uint32_t                        udi_count;
+	uint32_t                        lcr_count;
+	uint32_t                        ife_rd_count;
+	uint32_t                        lite_path_count;
+	uint32_t                        sfe_port_count;
+	uint32_t                        sfe_in_path_type;
+	uint32_t                        sfe_ife_enable;
+	uint32_t                        epoch_factor;
+	uint32_t                        path_id;
+	uint32_t                        ipp_dst_hw_ctxt_mask;
+	bool                            secure_mode;
+	uint32_t                        sensor_id;
+	bool                            dynamic_sensor_switch_en;
+	bool                            can_use_lite;
+	bool                            sfe_binned_epoch_cfg;
+	bool                            epd_supported;
+	bool                            aeb_mode;
+	bool                            dynamic_hdr_switch_en;
+	bool                            yuv_chroma_conversion_en;
+	bool                            per_port_en;
+	bool                            is_offline;
+	struct cam_isp_out_port_generic_info    *data;
+};
+
+/**
+ * struct cam_csid_secondary_evt_config - secondary event enablement
+ * @evt_type:           Type of secondary event enabled [SOF/EPOCH/EOF...]
+ * @en_secondary_evt:   Enable secondary event
+ *
+ */
+struct cam_csid_secondary_evt_config {
+	enum cam_ife_csid_secondary_evt_type evt_type;
+	bool                                 en_secondary_evt;
+};
+
+/**
+ * struct cam_csid_hw_reserve_resource- hw reserve
+ * @res_type :           Reource type CID or PATH
+ *                       if type is CID, then res_id is not required,
+ *                       if type is path then res id need to be filled
+ * @res_id  :            Resource id to be reserved
+ * @in_port :            Input port resource info
+ * @out_port:            Output port resource info, used for RDI path only
+ * @sync_mode:           Sync mode
+ *                       Sync mode could be master, slave or none
+ * @master_idx:          Master device index to be configured in the
+ *                       slave path
+ *                       for master path, this value is not required.
+ *                       only slave need to configure the master index value
+ * @dual_core_id:        In case of dual csid, core id of another hw
+ *                       reserve
+ * @node_res :           Reserved resource structure pointer
+ * @sec_evt_config:      Config to enable secondary events for the given resource
+ *                       depending on the use-case
+ * @crop_enable :        Flag to indicate CSID crop enable
+ * @drop_enable :        Flag to indicate CSID drop enable
+ * @sfe_inline_shdr:     Flag to indicate if sfe is inline shdr
+ * @is_offline :         Flag to indicate offline
+ * @need_top_cfg:        Flag to indicate if top cfg is needed
+ * @tasklet:             Tasklet to schedule bottom halves
+ * @buf_done_controller: IRQ controller for buf done for version 680 hw
+ * @cdm_ops:             CDM Ops
+ * @event_cb:            Callback function to hw mgr in case of hw events
+ * @phy_sel:             Phy selection number if tpg is enabled from userspace
+ * @cb_priv:             Private pointer to return to callback
+ * @sfe_en:              Flag to indicate if SFE is enabled
+ * @use_wm_pack:         [OUT]Flag to indicate if WM packing is to be used for packing
+ * @handle_camif_irq:    Flag to indicate if CSID IRQ is enabled
+ * @per_port_acquire:    Indicates if acquire as real acquire or per port
+ *                       virtual acquire for current res path
+ * @vc:                  input virtual channel number
+ * @dt:                  input data type number
+ * @decode_format        input data format
+ * @per_port_group_index: Group index if per port is enabled
+ *
+ */
+struct cam_csid_hw_reserve_resource_args {
+	enum cam_isp_resource_type                res_type;
+	uint32_t                                  res_id;
+	struct cam_isp_in_port_generic_info      *in_port;
+	struct cam_isp_out_port_generic_info     *out_port;
+	enum cam_isp_hw_sync_mode                 sync_mode;
+	uint32_t                                  master_idx;
+	uint32_t                                  dual_core_id;
+	struct cam_isp_resource_node             *node_res;
+	struct cam_csid_secondary_evt_config      sec_evt_config;
+	bool                                      crop_enable;
+	bool                                      drop_enable;
+	bool                                      sfe_inline_shdr;
+	bool                                      is_offline;
+	bool                                      need_top_cfg;
+	void                                     *tasklet;
+	void                                     *buf_done_controller;
+	void                                     *cdm_ops;
+	cam_hw_mgr_event_cb_func                  event_cb;
+	uint32_t                                  phy_sel;
+	void                                     *cb_priv;
+	bool                                      sfe_en;
+	bool                                      use_wm_pack;
+	bool                                      handle_camif_irq;
+	bool                                      per_port_acquire;
+	uint32_t                                  vc;
+	uint32_t                                  dt;
+	uint32_t                                  decode_format;
+	int                                       per_port_grp_index;
+};
+
+/**
+ * struct cam_ife_mgr_csid_resource_update
+ * @priv:                  Context data
+ * @res:                   HW resource to get the update from
+ * @csid_acquire:          Csid hw reserve
+ *
+ */
+struct cam_csid_resource_update {
+	void                                     *priv;
+	struct cam_isp_hw_mgr_res                *res;
+	struct cam_csid_hw_reserve_resource_args *csid_acquire;
+};
+
+/**
+ * struct cam_csid_res_irq_info
+ * @priv:                  Context data
+ * @node_res:              reource pointer array( ie CSID/IFE_SRC/IFE_OUT)
+ * @num_res:               number of resources
+ * @enable_irq:            TRUE: enables irq for requested path
+ *                         FALSE: disables irq for requested path
+ * @is_internal_start:     Start triggered internally for reset & recovery
+ *
+ */
+struct cam_csid_res_irq_info {
+	void                                *priv;
+	struct cam_isp_resource_node        **node_res;
+	uint32_t                             num_res;
+	bool                                 enable_irq;
+	bool                                 is_internal_start;
+};
+
+/**
+ *  enum cam_ife_csid_halt_cmd - Specify the halt command type
+ */
+enum cam_ife_csid_halt_cmd {
+	CAM_CSID_HALT_AT_FRAME_BOUNDARY,
+	CAM_CSID_RESUME_AT_FRAME_BOUNDARY,
+	CAM_CSID_HALT_IMMEDIATELY,
+	CAM_CSID_HALT_MAX,
+};
+
+/**
+ *  enum cam_ife_csid_halt_mode - Specify the halt command type
+ */
+enum cam_ife_csid_halt_mode {
+	CAM_CSID_HALT_MODE_INTERNAL,
+	CAM_CSID_HALT_MODE_GLOBAL,
+	CAM_CSID_HALT_MODE_MASTER,
+	CAM_CSID_HALT_MODE_SLAVE,
+	CAM_CSID_HALT_MODE_MAX,
+};
+
+/**
+ * struct cam_ife_csid_hw_halt_args
+ * @halt_mode : Applicable only for PATH resources
+ *              0 Internal : The CSID responds to the HALT_CMD
+ *              1 Global   : The CSID responds to the GLOBAL_HALT_CMD
+ *              2 Master   : The CSID responds to the HALT_CMD
+ *              3 Slave    : The CSID responds to the external halt command
+ *                           and not the HALT_CMD register
+ * @node_res : reource pointer array( ie cid or CSID)
+ *
+ */
+struct cam_ife_csid_hw_halt_args {
+	enum cam_ife_csid_halt_mode     halt_mode;
+	struct cam_isp_resource_node   *node_res;
+};
+
+/**
+ * struct cam_csid_hw_stop- stop all resources
+ * @stop_cmd : Applicable only for PATH resources
+ *             if stop command set to Halt immediately,driver will stop
+ *             path immediately, manager need to reset the path after HI
+ *             if stop command set to halt at frame boundary, driver will set
+ *             halt at frame boundary and wait for frame boundary
+ * @node_res :  reource pointer array( ie cid or CSID)
+ * @num_res :   number of resources to be stopped
+ *
+ */
+struct cam_csid_hw_stop_args {
+	enum cam_ife_csid_halt_cmd                stop_cmd;
+	struct cam_isp_resource_node            **node_res;
+	uint32_t                                  num_res;
+};
+
+/**
+ * struct cam_csid_hw_start_args - Relevant info to pass from ife_hw_mgr layer
+ *                                 to start various resource nodes.
+ *
+ * @node_res:           Resource pointer array (cid or CSID)
+ * @num_res:            Number of resources in node_res
+ * @cdm_hw_idx:         Physical CDM in use together with these resources
+ * @is_secure:          If these resources are run in secure session
+ * @is_internal_start:  Start triggered internally for reset & recovery
+ * @start_only:         start only, no init required
+ * @is_drv_config_en:   If drv config is enabled
+ * @is_per_port_start:  Indicates if start Hw is called on real start call or
+ *                      on per port enabled start call.
+ */
+struct cam_csid_hw_start_args {
+	struct cam_isp_resource_node            **node_res;
+	uint32_t                                  num_res;
+	uint32_t                                  cdm_hw_idx;
+	bool                                      is_secure;
+	bool                                      is_internal_start;
+	bool                                      start_only;
+	bool                                      is_drv_config_en;
+	bool                                      is_per_port_start;
+};
+
+
+/**
+ * enum cam_ife_csid_reset_type - Specify the reset type
+ */
+enum cam_ife_csid_reset_type {
+	CAM_IFE_CSID_RESET_GLOBAL,
+	CAM_IFE_CSID_RESET_PATH,
+	CAM_IFE_CSID_RESET_MAX,
+};
+
+/**
+ * struct cam_ife_csid_reset_cfg-  csid reset configuration
+ * @ reset_type : Global reset or path reset
+ * @res_node :   resource need to be reset
+ *
+ */
+struct cam_csid_reset_cfg_args {
+	enum cam_ife_csid_reset_type   reset_type;
+	struct cam_isp_resource_node  *node_res;
+};
+
+/**
+ * struct cam_csid_reset_out_of_sync_count_args
+ * @res_node :   resource need to be reset
+ *
+ */
+struct cam_csid_reset_out_of_sync_count_args {
+	struct cam_isp_resource_node  *node_res;
+};
+
+/**
+ * struct cam_csid_get_time_stamp_args-  time stamp capture arguments
+ * @node_res            : resource to get the time stamp
+ * @raw_boot_time       : Pointer to raw boot ts captured from top-half, if available
+ * @time_stamp_val      : captured time stamp
+ * @boot_timestamp      : boot time stamp
+ * @prev_time_stamp_val : previous captured time stamp
+ * @get_prev_timestamp  : flag to fetch previous captured time stamp from hardware
+ * @get_curr_timestamp  : flag to skip CSID timestamp reg read if already read from top-half
+ */
+struct cam_csid_get_time_stamp_args {
+	struct cam_isp_resource_node      *node_res;
+	struct timespec64                 *raw_boot_time;
+	uint64_t                           time_stamp_val;
+	uint64_t                           boot_timestamp;
+	uint64_t                           prev_time_stamp_val;
+	bool                               get_prev_timestamp;
+	bool                               get_curr_timestamp;
+};
+
+/**
+ * cam_ife_csid_hw_init()
+ *
+ * @brief:               Initialize function for the CSID hardware
+ *
+ * @ife_csid_hw:         CSID hardware instance returned
+ * @hw_idex:             CSID hardware instance id
+ */
+int cam_ife_csid_hw_init(struct cam_hw_intf **ife_csid_hw,
+	uint32_t hw_idx);
+
+/*
+ * struct cam_ife_csid_clock_update_args:
+ *
+ * @clk_rate:                Clock rate requested
+ */
+struct cam_ife_csid_clock_update_args {
+	uint64_t                           clk_rate;
+};
+
+/*
+ * struct cam_ife_csid_qcfa_update_args:
+ *
+ * @res:                         Res node pointer
+ * @qcfa_binning:                QCFA binning supported
+ */
+struct cam_ife_csid_qcfa_update_args {
+	struct cam_isp_resource_node      *res;
+	uint32_t                           qcfa_binning;
+};
+
+/*
+ * struct cam_ife_sensor_dim_update_args:
+ *
+ * @res:                          Resource for which data is updated
+ * @sensor_data:                  expected path configuration
+ */
+struct cam_ife_sensor_dimension_update_args {
+	struct cam_isp_resource_node         *res;
+	struct cam_isp_sensor_dimension       sensor_data;
+};
+
+/* struct cam_ife_csid_top_config_args:
+ *
+ * @input_core_type:              Input core type for CSID
+ * @core_idx:                     Core idx for out core
+ * @is_sfe_offline:               flag to indicate if sfe is offline
+ * @is_sfe_fs:                    flag to indicate if use-case is Inline Bayer Fast Shutter (BRF)
+ */
+struct cam_ife_csid_top_config_args {
+	uint32_t   input_core_type;
+	uint32_t   core_idx;
+	bool       is_sfe_offline;
+	bool       is_sfe_fs;
+};
+
+/*
+ * struct cam_ife_csid_dual_sync_args:
+ *
+ * @sync_mode:                Sync mode for dual csid master/slave
+ * @dual_core_id:             Core idx for another core in case of dual isp
+ *
+ */
+struct cam_ife_csid_dual_sync_args {
+	enum cam_isp_hw_sync_mode   sync_mode;
+	uint32_t                    dual_core_id;
+};
+
+/*
+ * struct cam_isp_csid_reg_update_args:
+ *
+ * @cmd:              cmd buf update args
+ * @node_res:         Node res pointer
+ * @num_res:          Num of resources
+ * @last_applied_mup: last applied MUP
+ * @reg_write:        if set use AHB to config rup/aup
+ * @mup_val:          MUP value if configured
+ * @mup_en:           Flag if dynamic sensor switch is enabled
+ */
+struct cam_isp_csid_reg_update_args {
+	struct cam_isp_hw_cmd_buf_update  cmd;
+	struct cam_isp_resource_node     *res[CAM_IFE_PIX_PATH_RES_MAX];
+	uint32_t                          num_res;
+	uint32_t                          last_applied_mup;
+	bool                              reg_write;
+	uint32_t                          mup_val;
+	uint32_t                          mup_en;
+};
+
+/*
+ * struct cam_ife_csid_offline_cmd_update_args:
+ *
+ * @cmd:           cmd buf update args
+ * @node_res:      Node res pointer for offline RDI
+ */
+struct cam_ife_csid_offline_cmd_update_args {
+	struct cam_isp_hw_cmd_buf_update  cmd;
+	struct cam_isp_resource_node     *res;
+};
+
+/*
+ * struct cam_ife_csid_discard_frame_cfg_update:
+ *
+ * @reset_discard_cfg:  Set if discard config needs to be reset
+ * @num_exposures:      Number of current exposures for sHDR
+ */
+struct cam_ife_csid_discard_frame_cfg_update {
+	uint32_t num_exposures;
+	bool     reset_discard_cfg;
+};
+
+/*
+ * struct cam_ife_csid_ts_reg_addr:
+ *
+ * @curr0_ts_addr:      Reg addr of curr0_sof, input if set,
+ *                      output otherwise
+ * @curr1_ts_addr:      Reg addr of curr1_sof, input if set,
+ *                      output otherwise
+ * @res_id (input):     CSID path id, for get op
+ * @get:                If call is to get addr
+ */
+struct cam_ife_csid_ts_reg_addr {
+	void __iomem                     *curr0_ts_addr;
+	void __iomem                     *curr1_ts_addr;
+	uint32_t                          res_id;
+	bool                              get_addr;
+};
+
+/*
+ * struct cam_ife_csid_mup_update_args:
+ *
+ * @mup_val:  MUP for odd or even vc
+ * @use_mup:  To indicate if CSID needs to consume this MUP
+ */
+struct cam_ife_csid_mup_update_args {
+	uint32_t mup_val;
+	bool use_mup;
+};
+
+/*
+ * struct cam_ife_csid_mode_switch_update_args:
+ *
+ * @mup_args:         MUP related arguments
+ * @exp_update_args:  Exposure update arguments
+ */
+struct cam_ife_csid_mode_switch_update_args {
+	struct cam_ife_csid_mup_update_args mup_args;
+	struct cam_ife_csid_discard_frame_cfg_update exp_update_args;
+};
+
+/*
+ * struct cam_ife_csid_discard_init_frame_args:
+ *
+ * @num_frames: Num frames to discard
+ * @res: Node res for this path
+ */
+struct cam_ife_csid_discard_init_frame_args {
+	uint32_t                          num_frames;
+	struct cam_isp_resource_node     *res;
+};
+
+/*
+ * struct cam_ife_csid_debug_cfg_args:
+ *
+ * @csid_debug: CSID debug val
+ * @csid_rx_capture_debug: CSID rx capture debug val
+ * @csid_testbus_debug: CSID test bus val
+ * @rx_capture_debug_set: CSID rx capture debug set;
+ */
+struct cam_ife_csid_debug_cfg_args {
+	uint64_t                          csid_debug;
+	uint32_t                          csid_rx_capture_debug;
+	uint32_t                          csid_testbus_debug;
+	bool                              rx_capture_debug_set;
+};
+
+/*
+ * struct cam_ife_csid_drv_config_args:
+ *
+ * @is_init_config: Indicator for init config
+ * @drv_en:         Indicator for camera DRV enable
+ * @timeout_val:    Timeout value from SOF to trigger up vote, given in number of GC cycles
+ * @path_idle_en:   Mask for paths to be considered for consolidated IDLE
+ */
+struct cam_ife_csid_drv_config_args {
+	bool                               is_init_config;
+	bool                               drv_en;
+	uint32_t                           timeout_val;
+	uint32_t                           path_idle_en;
+};
+
+#endif /* _CAM_CSID_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
@@ -0,0 +1,771 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_HW_H_
+#define _CAM_ISP_HW_H_
+
+#include <linux/completion.h>
+#include <media/cam_isp.h>
+#include "cam_hw.h"
+#include "cam_soc_util.h"
+#include "cam_irq_controller.h"
+#include "cam_hw_intf.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_hw_mgr_intf.h"
+
+/* Maximum length of tag while dumping */
+#define CAM_ISP_HW_DUMP_TAG_MAX_LEN 128
+/* Max isp hw pid values number */
+#define CAM_ISP_HW_MAX_PID_VAL      4
+/* Maximum number of output ports that map to an architecture specific input path */
+#define CAM_ISP_HW_PATH_PORT_MAP_MAX    3
+
+/*
+ * MAX len of ISP Resource Name
+ */
+#define CAM_ISP_RES_NAME_LEN      16
+
+/*
+ * MAX len of line_buffer
+ */
+#define LINE_BUFFER_LEN      1500
+
+/* Access core_info of isp resource node */
+#define cam_isp_res_core_info(res) (((struct cam_hw_info *)res->hw_intf->hw_priv)->core_info)
+
+enum cam_isp_exposure_type {
+	CAM_ISP_LAST_EXPOSURE,
+	CAM_ISP_LAST_1_EXPOSURE,
+	CAM_ISP_LAST_2_EXPOSURE,
+	CAM_ISP_EXPOSURE_MAX
+};
+
+enum cam_isp_bw_control_action {
+	CAM_ISP_BW_CONTROL_EXCLUDE       = 0,
+	CAM_ISP_BW_CONTROL_INCLUDE       = 1
+};
+
+enum cam_isp_multi_ctxt_idx {
+	CAM_ISP_MULTI_CTXT_0,
+	CAM_ISP_MULTI_CTXT_1,
+	CAM_ISP_MULTI_CTXT_2,
+	CAM_ISP_MULTI_CTXT_MAX
+};
+
+/*
+ * struct cam_isp_bw_control_args:
+ *
+ * @node_res:             Resource node info
+ * @action:               Bandwidth control action
+ */
+struct cam_isp_bw_control_args {
+	struct cam_isp_resource_node      *node_res;
+	enum cam_isp_bw_control_action     action;
+};
+
+/*
+ * struct cam_isp_apply_clk_bw_args:
+ *
+ * @hw_intf:             Isp hw intf pointer
+ * @request_id:          Request Id
+ * @skip_clk_data_rst:   Skip resetting any clk info
+ * @is_drv_config_en:    Enable clk DRV while setting this clk rate
+ * @clock_updated:       If clock is updated for any of the cores
+ */
+struct cam_isp_apply_clk_bw_args {
+	struct cam_hw_intf                *hw_intf;
+	uint64_t                           request_id;
+	bool                               skip_clk_data_rst;
+	bool                               is_drv_config_en;
+	bool                               clock_updated;
+};
+
+/*
+ * struct cam_isp_sof_ts_data
+ *
+ * @boot_time           Raw monotonic boot time
+ * @sof_ts:             SOF reigster timestamp
+ */
+struct cam_isp_sof_ts_data {
+	struct timespec64     boot_time;
+	uint64_t              sof_ts;
+};
+
+/*
+ * struct cam_isp_timestamp:
+ *
+ * @mono_time:          Monotonic boot time
+ * @vt_time:            AV Timer time
+ * @ticks:              Qtimer ticks
+ * @sof_ts:             SOF reigster timestamp
+ */
+struct cam_isp_timestamp {
+	struct timespec64                mono_time;
+	struct timespec64                vt_time;
+	uint64_t                         ticks;
+	uint64_t                         sof_ts;
+};
+
+/*
+ * cam_isp_hw_get_timestamp()
+ *
+ * @Brief:              Get timestamp values
+ *
+ * @time_stamp:         Structure that holds different time values
+ *
+ * @Return:             Void
+ */
+void cam_isp_hw_get_timestamp(struct cam_isp_timestamp *time_stamp);
+
+enum cam_isp_hw_type {
+	CAM_ISP_HW_TYPE_CSID,
+	CAM_ISP_HW_TYPE_ISPIF,
+	CAM_ISP_HW_TYPE_VFE,
+	CAM_ISP_HW_TYPE_IFE_CSID,
+	CAM_ISP_HW_TYPE_TFE,
+	CAM_ISP_HW_TYPE_TFE_CSID,
+	CAM_ISP_HW_TYPE_TPG,
+	CAM_ISP_HW_TYPE_SFE,
+	CAM_ISP_HW_TYPE_MAX,
+};
+
+enum cam_isp_hw_split_id {
+	CAM_ISP_HW_SPLIT_LEFT       = 0,
+	CAM_ISP_HW_SPLIT_RIGHT,
+	CAM_ISP_HW_SPLIT_MAX,
+};
+
+enum cam_isp_hw_usage_type {
+	CAM_ISP_HW_USAGE_TYPE_SINGLE = 0,
+	CAM_ISP_HW_USAGE_TYPE_DUAL,
+	CAM_ISP_HW_USAGE_TYPE_MAX,
+};
+
+enum cam_isp_hw_sync_mode {
+	CAM_ISP_HW_SYNC_NONE,
+	CAM_ISP_HW_SYNC_MASTER,
+	CAM_ISP_HW_SYNC_SLAVE,
+	CAM_ISP_HW_SYNC_MAX,
+};
+
+enum cam_isp_resource_state {
+	CAM_ISP_RESOURCE_STATE_UNAVAILABLE   = 0,
+	CAM_ISP_RESOURCE_STATE_AVAILABLE     = 1,
+	CAM_ISP_RESOURCE_STATE_RESERVED      = 2,
+	CAM_ISP_RESOURCE_STATE_INIT_HW       = 3,
+	CAM_ISP_RESOURCE_STATE_STREAMING     = 4,
+};
+
+enum cam_isp_resource_type {
+	CAM_ISP_RESOURCE_UNINT,
+	CAM_ISP_RESOURCE_SRC,
+	CAM_ISP_RESOURCE_CID,
+	CAM_ISP_RESOURCE_PIX_PATH,
+	CAM_ISP_RESOURCE_VFE_IN,
+	CAM_ISP_RESOURCE_VFE_BUS_RD,
+	CAM_ISP_RESOURCE_VFE_OUT,
+	CAM_ISP_RESOURCE_TPG,
+	CAM_ISP_RESOURCE_TFE_IN,
+	CAM_ISP_RESOURCE_TFE_OUT,
+	CAM_ISP_RESOURCE_SFE_IN,
+	CAM_ISP_RESOURCE_SFE_RD,
+	CAM_ISP_RESOURCE_SFE_OUT,
+	CAM_ISP_RESOURCE_MAX,
+};
+
+enum cam_isp_hw_cmd_type {
+	CAM_ISP_HW_CMD_GET_CHANGE_BASE,
+	CAM_ISP_HW_CMD_GET_BUF_UPDATE,
+	CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM,
+	CAM_ISP_HW_CMD_GET_REG_UPDATE,
+	CAM_ISP_HW_CMD_GET_HFR_UPDATE,
+	CAM_ISP_HW_CMD_GET_HFR_UPDATE_RM,
+	CAM_ISP_HW_CMD_GET_WM_SECURE_MODE,
+	CAM_ISP_HW_CMD_GET_RM_SECURE_MODE,
+	CAM_ISP_HW_CMD_STRIPE_UPDATE,
+	CAM_ISP_HW_CMD_CLOCK_UPDATE,
+	CAM_ISP_HW_CMD_BW_UPDATE,
+	CAM_ISP_HW_CMD_BW_UPDATE_V2,
+	CAM_ISP_HW_CMD_BW_CONTROL,
+	CAM_ISP_HW_CMD_FCG_CONFIG,
+	CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ,
+	CAM_ISP_HW_CMD_GET_REG_DUMP,
+	CAM_ISP_HW_CMD_UBWC_UPDATE,
+	CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+	CAM_ISP_HW_CMD_SOF_IRQ_DEBUG,
+	CAM_ISP_HW_CMD_SET_CAMIF_DEBUG,
+	CAM_ISP_HW_CMD_CAMIF_DATA,
+	CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE,
+	CAM_ISP_HW_CMD_FE_UPDATE_IN_RD,
+	CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD,
+	CAM_ISP_HW_CMD_UBWC_UPDATE_V2,
+	CAM_ISP_HW_CMD_CORE_CONFIG,
+	CAM_ISP_HW_CMD_WM_CONFIG_UPDATE,
+	CAM_ISP_HW_CMD_CSID_QCFA_SUPPORTED,
+	CAM_ISP_HW_CMD_ADD_WAIT,
+	CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER,
+	CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA,
+	CAM_ISP_HW_CMD_TPG_PHY_CLOCK_UPDATE,
+	CAM_ISP_HW_CMD_GET_IRQ_REGISTER_DUMP,
+	CAM_ISP_HW_CMD_DUMP_HW,
+	CAM_ISP_HW_CMD_FE_TRIGGER_CMD,
+	CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ,
+	CAM_ISP_HW_CMD_IS_CONSUMED_ADDR_SUPPORT,
+	CAM_ISP_HW_CMD_GET_LAST_CONSUMED_ADDR,
+	CAM_ISP_HW_CMD_GET_RES_FOR_MID,
+	CAM_ISP_HW_CMD_BLANKING_UPDATE,
+	CAM_ISP_HW_CMD_CSID_CLOCK_DUMP,
+	CAM_ISP_HW_CMD_TPG_CORE_CFG_CMD,
+	CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE,
+	CAM_ISP_HW_CMD_SET_SFE_DEBUG_CFG,
+	CAM_ISP_HW_CMD_QUERY_CAP,
+	CAM_IFE_CSID_CMD_GET_TIME_STAMP,
+	CAM_IFE_CSID_SET_CSID_DEBUG,
+	CAM_IFE_CSID_SOF_IRQ_DEBUG,
+	CAM_IFE_CSID_LOG_ACQUIRE_DATA,
+	CAM_IFE_CSID_TOP_CONFIG,
+	CAM_IFE_CSID_PROGRAM_OFFLINE_CMD,
+	CAM_IFE_CSID_SET_DUAL_SYNC_CONFIG,
+	CAM_IFE_CSID_RESET_OUT_OF_SYNC_CNT,
+	CAM_ISP_HW_CMD_CSID_DYNAMIC_SWITCH_UPDATE,
+	CAM_ISP_HW_CMD_CSID_DISCARD_INIT_FRAMES,
+	CAM_ISP_HW_CMD_BUF_UPDATE,
+	CAM_ISP_HW_CMD_BUF_UPDATE_RM,
+	CAM_ISP_HW_NOTIFY_OVERFLOW,
+	CAM_ISP_HW_CMD_IS_PDAF_RDI2_MUX_EN,
+	CAM_ISP_HW_CMD_GET_PATH_PORT_MAP,
+	CAM_ISP_HW_CMD_IFE_DEBUG_CFG,
+	CAM_ISP_HW_SFE_SYS_CACHE_WM_CONFIG,
+	CAM_ISP_HW_SFE_SYS_CACHE_RM_CONFIG,
+	CAM_ISP_HW_CMD_WM_BW_LIMIT_CONFIG,
+	CAM_ISP_HW_CMD_RM_ENABLE_DISABLE,
+	CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE,
+	CAM_ISP_HW_CMD_INIT_CONFIG_UPDATE,
+	CAM_ISP_HW_CSID_MINI_DUMP,
+	CAM_ISP_HW_IFE_BUS_MINI_DUMP,
+	CAM_ISP_HW_SFE_BUS_MINI_DUMP,
+	CAM_ISP_HW_USER_DUMP,
+	CAM_ISP_HW_CMD_RDI_LCR_CFG,
+	CAM_ISP_HW_CMD_DRV_CONFIG,
+	CAM_ISP_HW_CMD_CSID_DUMP_CROP_REG,
+	CAM_ISP_HW_CMD_MC_CTXT_SEL,
+	CAM_ISP_HW_CMD_IRQ_COMP_CFG,
+	CAM_ISP_HW_CMD_IRQ_INJECTION,
+	CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION,
+	CAM_ISP_HW_CMD_GET_SET_PRIM_SOF_TS_ADDR,
+	CAM_ISP_HW_CMD_DYNAMIC_CLOCK_UPDATE,
+	CAM_ISP_HW_CMD_SET_SYNC_HW_IDX,
+	CAM_ISP_HW_CMD_BUS_WM_DISABLE,
+	CAM_ISP_HW_CMD_BUFFER_ALIGNMENT_UPDATE,
+	CAM_ISP_HW_CMD_GET_CLK_THRESHOLDS,
+	CAM_ISP_HW_CMD_WM_UPDATE,
+	CAM_ISP_HW_CMD_UPDATE_CSID_RES_DATA,
+	CAM_ISP_HW_CMD_UPDATE_VFE_SRC_RES_DATA,
+	CAM_ISP_HW_CMD_UPDATE_VFE_OUT_RES_DATA,
+	CAM_ISP_HW_CMD_UPDATE_CSID_RES_IRQ_MASK,
+	CAM_ISP_HW_CMD_UPDATE_VFE_SRC_RES_IRQ_MASK,
+	CAM_ISP_HW_CMD_UPDATE_VFE_OUT_RES_IRQ_MASK,
+	CAM_ISP_HW_CMD_GET_NUM_OUT_RES,
+	CAM_ISP_HW_CMD_MAX,
+};
+
+/*
+ * struct cam_isp_resource_node:
+ *
+ * @Brief:                        Structure representing HW resource object
+ *
+ * @res_type:                     Resource Type
+ * @res_id:                       Unique resource ID within res_type objects
+ *                                for a particular HW
+ * @res_state:                    State of the resource
+ * @hw_intf:                      HW Interface of HW to which this resource
+ *                                belongs
+ * @res_priv:                     Private data of the resource
+ * @list:                         list_head node for this resource
+ * @cdm_ops:                      CDM operation functions
+ * @tasklet_info:                 Tasklet structure that will be used to
+ *                                schedule IRQ events related to this resource
+ * @irq_handle:                   handle returned on subscribing for IRQ event
+ * @init:                         function pointer to init the HW resource
+ * @deinit:                       function pointer to deinit the HW resource
+ * @start:                        function pointer to start the HW resource
+ * @stop:                         function pointer to stop the HW resource
+ * @process_cmd:                  function pointer for processing commands
+ *                                specific to the resource
+ * @top_half_handler:             Top Half handler function
+ * @bottom_half_handler:          Bottom Half handler function
+ * @res_name:                     Name of resource
+ * @is_rdi_primary_res:           Indicates whether RDI is primiary resource or not.
+ *                                Based on this, We need to enable interrupts on RDI path only.
+ * @is_per_port_start:            Indicates start_hw is called on real streamon call or
+ *                                on per port streamon call
+ * @is_per_port_acquire:          Indicates if resource is yet to be really acquired
+ */
+struct cam_isp_resource_node {
+	enum cam_isp_resource_type     res_type;
+	uint32_t                       res_id;
+	enum cam_isp_resource_state    res_state;
+	struct cam_hw_intf            *hw_intf;
+	void                          *res_priv;
+	struct list_head               list;
+	void                          *cdm_ops;
+	void                          *tasklet_info;
+	int                            irq_handle;
+
+	int (*init)(struct cam_isp_resource_node *rsrc_node,
+		void *init_args, uint32_t arg_size);
+	int (*deinit)(struct cam_isp_resource_node *rsrc_node,
+		void *deinit_args, uint32_t arg_size);
+	int (*start)(struct cam_isp_resource_node *rsrc_node);
+	int (*stop)(struct cam_isp_resource_node *rsrc_node);
+	int (*process_cmd)(struct cam_isp_resource_node *rsrc_node,
+		uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+	CAM_IRQ_HANDLER_TOP_HALF       top_half_handler;
+	CAM_IRQ_HANDLER_BOTTOM_HALF    bottom_half_handler;
+	uint8_t                        res_name[CAM_ISP_RES_NAME_LEN];
+	bool                           is_rdi_primary_res;
+	bool                           is_per_port_start;
+	bool                           is_per_port_acquire;
+};
+
+/*
+ * struct cam_isp_blanking_config:
+ *
+ * @Brief:          Structure to pass blanking details
+ * @hbi:            HBI Value
+ * @vbi:            VBI Value
+ * node_res:        Pointer to Resource Node object
+ */
+struct cam_isp_blanking_config {
+	uint32_t                           hbi;
+	uint32_t                           vbi;
+	struct cam_isp_resource_node       *node_res;
+};
+
+/**
+ * struct cam_isp_hw_error_event_info:
+ *
+ * @brief:              Structure to pass error event details to hw mgr
+ *
+ * @err_type:           Type of error being reported
+ * @err_mask:           Exact error of the err_type
+ *
+ */
+struct cam_isp_hw_error_event_info {
+	uint32_t    err_type;
+	uint32_t    err_mask;
+};
+
+/**
+ * struct cam_isp_hw_bufdone_event_info:
+ *
+ * @brief:              Structure to pass bufdone event details to hw mgr
+ *
+ * @res_id:             Resource IDs to report buf dones
+ * @comp_grp_id:        Bus comp group id
+ * @last_consumed_addr: Last consumed addr for resource ID at that index
+ *
+ */
+struct cam_isp_hw_bufdone_event_info {
+	uint32_t res_id;
+	uint32_t comp_grp_id;
+	uint32_t last_consumed_addr;
+};
+
+/*
+ * struct cam_isp_hw_event_info:
+ *
+ * @Brief:             Structure to pass event details to hw mgr
+ *
+ * @res_type:          Type of IFE resource
+ * @is_secondary_evt:  Indicates if event was requested by hw mgr
+ * @res_id:            Unique resource ID
+ * @hw_idx:            IFE hw index
+ * @reg_val:           Any critical register value captured during irq handling
+ * @hw_type:           Hw Type sending the event
+ * @in_core_idx:       Input core type if CSID error evt
+ * @event_data:        Any additional data specific to this event
+ *
+ */
+struct cam_isp_hw_event_info {
+	enum cam_isp_resource_type     res_type;
+	bool                           is_secondary_evt;
+	uint32_t                       res_id;
+	uint32_t                       hw_idx;
+	uint32_t                       reg_val;
+	uint32_t                       hw_type;
+	uint32_t                       in_core_idx;
+	void                          *event_data;
+};
+
+/*
+ * struct cam_isp_hw_cmd_buf_update:
+ *
+ * @Brief:           Contain the new created command buffer information
+ *
+ * @cmd_buf_addr:    Command buffer to store the change base command
+ * @size:            Size of the buffer in bytes
+ * @used_bytes:      Consumed bytes in the command buffer
+ *
+ */
+struct cam_isp_hw_cmd_buf_update {
+	uint32_t                       *cmd_buf_addr;
+	uint32_t                        size;
+	uint32_t                        used_bytes;
+};
+
+/*
+ * struct cam_isp_hw_get_wm_update:
+ *
+ * @Brief:             Get cmd buffer for WM updates.
+ *
+ * @ image_buf:        image buffer address array
+ * @ image_buf_offset: image buffer address offset array
+ * @ num_buf:          Number of buffers in the image_buf array
+ * @ frame_header:     frame header iova
+ * @ fh_enabled:       flag to indicate if this WM enables frame header
+ * @ local_id:         local id for the wm
+ * @ width:            width of scratch buffer
+ * @ height:           height of scratch buffer
+ * @ stride:           stride of scratch buffer
+ * @ slice_height:     slice height of scratch buffer
+ * @ io_cfg:           IO buffer config information sent from UMD
+ * @ unpacker_fmt:     input unpacker format
+ *
+ */
+struct cam_isp_hw_get_wm_update {
+	dma_addr_t                     *image_buf;
+	uint32_t                        image_buf_offset[CAM_PACKET_MAX_PLANES];
+	uint32_t                        num_buf;
+	uint64_t                        frame_header;
+	bool                            fh_enabled;
+	uint32_t                        local_id;
+	uint32_t                        width;
+	uint32_t                        height;
+	uint32_t                        stride;
+	uint32_t                        slice_height;
+	struct cam_buf_io_cfg          *io_cfg;
+	uint32_t                        unpacker_fmt;
+};
+
+/*
+ * struct cam_isp_hw_get_res_for_mid:
+ *
+ * @Brief:           Get the out resource id for given mid
+ *
+ * @mid:             Mid number of hw outport numb
+ * @pid:             Pid number associated with mid
+ * @out_res_id:      Out resource id
+ *
+ */
+struct cam_isp_hw_get_res_for_mid {
+	uint32_t                       mid;
+	uint32_t                       pid;
+	uint32_t                       out_res_id;
+};
+
+/**
+ * struct cam_isp_hw_fcg_get_size:
+ *
+ * @Brief:            Get the size of KMD buf FCG config needs
+ *
+ * @num_types:        Num of types(STATS/PHASE) for each FCG config
+ * @num_ctxs:         Num of contexts for each FCG config in MC_TFE
+ * @kmd_size:         Size of KMD buffer that will be used for FCG
+ * @fcg_supported:    Indicate whether FCG is supported by the hardware
+ */
+struct cam_isp_hw_fcg_get_size {
+	uint32_t                                     num_types;
+	uint32_t                                     num_ctxs;
+	uint32_t                                     kmd_size;
+	bool                                         fcg_supported;
+};
+
+/**
+ * struct cam_isp_hw_fcg_update:
+ *
+ * @Brief:            Get FCG update and pass to lower level processing
+ *
+ * @cmd_addr:         Command buffer address that FCG configs are written into
+ * @cmd_size:         Size of the command
+ * @prediction_idx:   Indicate exact FCG predictions to be used
+ * @data:             Exact FCG configs
+ */
+struct cam_isp_hw_fcg_update {
+	uintptr_t                                    cmd_buf_addr;
+	uint32_t                                     cmd_size;
+	uint32_t                                     prediction_idx;
+	void                                        *data;
+};
+
+/**
+ * struct cam_isp_hw_fcg_cmd
+ *
+ * @Brief:            Union struct for fcg related cmd
+ *
+ * @res:              Resource node
+ * @cmd_type:         Command type
+ * @get_size_flag:    Indicate to get kmd size for FCG or apply FCG update
+ *                    True - Get the size of KMD buffer to carry reg/val pairs
+ *                    False - Apply FCG update and pass it to SFE/IFE/MC_TFE
+ */
+struct cam_isp_hw_fcg_cmd {
+	struct cam_isp_resource_node                *res;
+	enum cam_isp_hw_cmd_type                     cmd_type;
+	bool                                         get_size_flag;
+	union {
+		struct cam_isp_hw_fcg_update         fcg_update;
+		struct cam_isp_hw_fcg_get_size       fcg_get_size;
+	} u;
+};
+
+/*
+ * struct cam_isp_hw_get_cmd_update:
+ *
+ * @Brief:           Get cmd buffer update for different CMD types
+ *
+ * @res:             Resource node
+ * @cmd_type:        Command type for which to get update
+ * @cdm_id  :        CDM id
+ * @cmd:             Command buffer information
+ * @res:             Resource node
+ * @cmd_type:        Command type for which to get update
+ * @cmd:             Command buffer information
+ * @use_scratch_cfg: To indicate if it's scratch buffer config
+ * @trigger_cdm_en:  Flag to indicate if cdm is trigger
+ * @reg_write:        if set use AHB to config rup/aup
+ *
+ */
+struct cam_isp_hw_get_cmd_update {
+	struct cam_isp_resource_node     *res;
+	enum cam_isp_hw_cmd_type          cmd_type;
+	enum cam_cdm_id                   cdm_id;
+	struct cam_isp_hw_cmd_buf_update  cmd;
+	bool                              use_scratch_cfg;
+	union {
+		void                                 *data;
+		struct cam_isp_hw_get_wm_update      *wm_update;
+		struct cam_isp_hw_get_wm_update      *rm_update;
+	};
+	bool trigger_cdm_en;
+	bool reg_write;
+};
+
+/*
+ * struct cam_isp_hw_get_off_clk_thr:
+ *
+ * @Brief:         Get thresholds for offline HW
+ *
+ * @max_clk_threshold:      min clock threshold
+ * @nom_clk_threshold:      nom clock threshold
+ * @min_clk_threshold:      max clock threshold
+ * @bytes_per_clk:          bytes per clock processed
+ *
+ */
+struct cam_isp_hw_get_off_clk_thr {
+	uint32_t   max_clk_threshold;
+	uint32_t   nom_clk_threshold;
+	uint32_t   min_clk_threshold;
+	uint32_t   bytes_per_clk;
+};
+
+/*
+ * struct cam_isp_hw_dual_isp_update_args:
+ *
+ * @Brief:        update the dual isp striping configuration.
+ *
+ * @ split_id:    spilt id to inform left or rifht
+ * @ res:         resource node
+ * @ dual_cfg:    dual isp configuration
+ *
+ */
+struct cam_isp_hw_dual_isp_update_args {
+	enum cam_isp_hw_split_id         split_id;
+	struct cam_isp_resource_node    *res;
+	struct cam_isp_dual_config      *dual_cfg;
+};
+
+/*
+ * struct cam_isp_hw_dump_args:
+ *
+ * @Brief:        isp hw dump args
+ *
+ * @ req_id:         request id
+ * @ cpu_addr:       cpu address
+ * @ buf_len:        buf len
+ * @ offset:         offset of buffer
+ * @ ctxt_to_hw_map: ctx to hw map
+ * @ is_dump_all:    flag to indicate if all information or just bw/clk rate
+ */
+struct cam_isp_hw_dump_args {
+	uint64_t                req_id;
+	uintptr_t               cpu_addr;
+	size_t                  buf_len;
+	size_t                  offset;
+	void                   *ctxt_to_hw_map;
+	bool                    is_dump_all;
+};
+
+/**
+ * struct cam_isp_hw_dump_header - ISP context dump header
+ *
+ * @Brief:        isp hw dump header
+ *
+ * @tag:       Tag name for the header
+ * @word_size: Size of word
+ * @size:      Size of data
+ *
+ */
+struct cam_isp_hw_dump_header {
+	uint8_t   tag[CAM_ISP_HW_DUMP_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * struct cam_isp_session_data - Session data
+ *
+ * @Brief:          ISP session or usecase data
+ *
+ * @link_hdl:       Link handle
+ * @is_shdr:        Indicate is usecase is shdr
+ *
+ */
+struct cam_isp_session_data {
+	int32_t   link_hdl;
+	bool      is_shdr;
+};
+
+/**
+ * struct cam_isp_hw_intf_data - ISP hw intf data
+ *
+ * @Brief:        isp hw intf pointer and pid list data
+ *
+ * @isp_hw_intf:      Isp hw intf pointer
+ * @num_hw_pid:       Number of pids for this hw
+ * @isp_hw_pid:       Isp hw pid values
+ *
+ */
+struct cam_isp_hw_intf_data {
+	struct cam_hw_intf     *hw_intf;
+	uint32_t                num_hw_pid;
+	uint32_t                hw_pid[CAM_ISP_HW_MAX_PID_VAL];
+};
+/**
+ * struct cam_isp_hw_bus_cap:
+ *
+ * @Brief:         ISP hw bus capabilities
+ *
+ * @max_out_res_type:       Maximum value of out resource type supported by hw
+ * @num_perf_counters:      Number of perf counters supported
+ * @support_consumed_addr:  Indicate whether HW has last consumed addr reg
+ *
+ */
+struct cam_isp_hw_cap {
+	uint32_t                max_out_res_type;
+	uint32_t                num_perf_counters;
+	bool                    support_consumed_addr;
+};
+
+/**
+ * struct cam_isp_hw_path_port_map:
+ *
+ * @Brief:         ISP hw bus capabilities
+ *
+ * @num_entries:  Number of entries
+ * @entry:        Each row is an entry with the following structure:
+ *                col #1: VFE IN path type
+ *                col #2: ISP OUT resource type
+ */
+struct cam_isp_hw_path_port_map {
+	uint32_t                num_entries;
+	uint32_t                entry[CAM_ISP_HW_PATH_PORT_MAP_MAX][2];
+};
+
+
+/**
+ * struct cam_isp_hw_init_config_update:
+ *
+ * @Brief:         Init config params for CSID/SFE/IFE resources
+ *
+ * @node_res:      HW Resource
+ * @init_config:   Init config params from userspace
+ */
+struct cam_isp_hw_init_config_update {
+	struct cam_isp_resource_node   *node_res;
+	struct cam_isp_init_config     *init_config;
+};
+
+/*
+ * struct cam_isp_hw_overflow_info:
+ *
+ * @Brief:                  ISP hw bus overflow info
+ *
+ * @res_id:                 Resource type
+ * @is_bus_overflow:        Indicate whether bus overflow happened
+ */
+struct cam_isp_hw_overflow_info {
+	int                     res_id;
+	bool                    is_bus_overflow;
+};
+
+enum cam_isp_irq_inject_reg_unit_type {
+	CAM_ISP_CSID_TOP_REG,
+	CAM_ISP_CSID_RX_REG,
+	CAM_ISP_CSID_PATH_IPP_REG,
+	CAM_ISP_CSID_PATH_PPP_REG,
+	CAM_ISP_CSID_PATH_RDI0_REG,
+	CAM_ISP_CSID_PATH_RDI1_REG,
+	CAM_ISP_CSID_PATH_RDI2_REG,
+	CAM_ISP_CSID_PATH_RDI3_REG,
+	CAM_ISP_CSID_PATH_RDI4_REG,
+	CAM_ISP_CSID_PATH_RDI5_REG,
+	CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG,
+	CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_1_REG,
+	CAM_ISP_SFE_0_BUS_RD_INPUT_IF_IRQ_SET_REG,
+	CAM_ISP_SFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG,
+	CAM_ISP_REG_UNIT_MAX
+};
+
+/*
+ * struct cam_isp_irq_inject_param:
+ *
+ * @Brief: Params for isp irq injection
+ *
+ * @hw_type  :  Hw to inject IRQ
+ * @hw_idx   :  Index of the selected hw
+ * @reg_unit :  Register to set irq
+ * @irq_mask :  IRQ to be triggered
+ * @req_id   :  Req to trigger the IRQ
+ * @is_valid :  Flag to indicate current set of params is valid or not
+ * @line_buf :  Buffer to temporarily keep log
+ */
+struct cam_isp_irq_inject_param {
+	int32_t  hw_type;
+	int32_t  hw_idx;
+	int32_t  reg_unit;
+	int32_t  irq_mask;
+	uint64_t req_id;
+	bool     is_valid;
+	char     line_buf[LINE_BUFFER_LEN];
+};
+
+/*
+ * struct cam_isp_params_injection:
+ *
+ * @Brief: args for irq injection or irq desc dump
+ *
+ * @param        :  Params for isp irq injection
+ * @vfe_hw_info  :  Vfe hw info
+ * @sfe_hw_info  :  Sfe hw info
+ */
+struct cam_isp_params_injection {
+	struct cam_isp_irq_inject_param *param;
+	void                            *vfe_hw_info;
+	void                            *sfe_hw_info;
+};
+
+#endif /* _CAM_ISP_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_sfe_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_sfe_hw_intf.h
@@ -0,0 +1,383 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_HW_INTF_H_
+#define _CAM_SFE_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+
+#define SFE_CORE_BASE_IDX           0
+#define CAM_SFE_PERF_CNT_MAX        2
+
+enum cam_sfe_core_id {
+	CAM_SFE_CORE_0,
+	CAM_SFE_CORE_1,
+	CAM_SFE_CORE_MAX,
+};
+
+enum cam_isp_hw_sfe_in {
+	CAM_ISP_HW_SFE_IN_PIX,
+	CAM_ISP_HW_SFE_IN_RDI0,
+	CAM_ISP_HW_SFE_IN_RDI1,
+	CAM_ISP_HW_SFE_IN_RDI2,
+	CAM_ISP_HW_SFE_IN_RDI3,
+	CAM_ISP_HW_SFE_IN_RDI4,
+	CAM_ISP_HW_SFE_IN_RD,
+	CAM_ISP_HW_SFE_IN_MAX,
+};
+
+enum cam_sfe_hw_irq_status {
+	CAM_SFE_IRQ_STATUS_SUCCESS,
+	CAM_SFE_IRQ_STATUS_ERR,
+	CAM_SFE_IRQ_STATUS_OVERFLOW,
+	CAM_SFE_IRQ_STATUS_VIOLATION,
+	CAM_SFE_IRQ_STATUS_MAX,
+};
+
+enum cam_sfe_hw_irq_regs {
+	CAM_SFE_IRQ_TOP_REG_STATUS0,
+	CAM_SFE_IRQ_REGISTERS_MAX,
+};
+
+enum cam_sfe_bus_wr_irq_regs {
+	CAM_SFE_IRQ_BUS_WR_REG_STATUS0,
+	CAM_SFE_BUS_WR_IRQ_REGISTERS_MAX,
+};
+
+enum cam_sfe_bus_rd_irq_regs {
+	CAM_SFE_IRQ_BUS_RD_REG_STATUS0,
+	CAM_SFE_BUS_RD_IRQ_REGISTERS_MAX,
+};
+
+/*
+ * struct cam_sfe_generic_debug_config:
+ *
+ * @sfe_debug_cfg       : SFE debug cfg value
+ * @sfe_sensor_sel      : SFE sensor sel for diag data
+ * @num_counters        : Number of perf counters configured
+ * @sfe_perf_counter_val: SFE perf counter values
+ */
+struct cam_sfe_generic_debug_config {
+	uint32_t  sfe_debug_cfg;
+	uint32_t  sfe_sensor_sel;
+	uint32_t  num_counters;
+	uint32_t  sfe_perf_counter_val[CAM_SFE_PERF_CNT_MAX];
+};
+
+/*
+ * struct cam_sfe_sys_cache_debug_config:
+ *
+ * @sfe_cache_dbg:  SFE cache debug cfg
+ */
+
+struct cam_sfe_sys_cache_debug_config {
+	uint32_t sfe_cache_dbg;
+};
+
+
+/*
+ * struct cam_sfe_debug_cfg_params:
+ *
+ * @cache_config: If the config is for cache
+ */
+struct cam_sfe_debug_cfg_params {
+	union {
+		struct cam_sfe_generic_debug_config   dbg_cfg;
+		struct cam_sfe_sys_cache_debug_config cache_cfg;
+	} u;
+	bool cache_config;
+};
+
+/*
+ * struct cam_sfe_bw_update_args:
+ *
+ * @node_res:             Resource to get the BW
+ * @sfe_vote:             Vote info according to usage data (left/right/rdi)
+ */
+struct cam_sfe_bw_update_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_axi_vote                sfe_vote;
+};
+
+/*
+ * struct cam_sfe_fe_update_args:
+ *
+ * @node_res:             Resource to get fetch configuration
+ * @fe_config:            fetch engine configuration
+ *
+ */
+struct cam_sfe_fe_update_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_fe_config               fe_config;
+};
+
+/*
+ * struct cam_sfe_clock_update_args:
+ *
+ * @node_res:                ISP Resource
+ * @clk_rate:                Clock rate requested
+ * @vote_level:              DRV vote level corresponding to requested rate
+ */
+struct cam_sfe_clock_update_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           clk_rate;
+	uint32_t                           vote_level;
+};
+
+/*
+ * struct cam_sfe_core_config_args:
+ *
+ * @node_res:                ISP Resource
+ * @core_config:             Core config for SFE
+ */
+struct cam_sfe_core_config_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_isp_sfe_core_config     core_config;
+};
+
+/**
+ * struct cam_isp_sfe_bus_sys_cache_config:
+ *
+ * @Brief:         Based on exp order rxved from userland
+ *                 configure sys cache for SFE WMs & RMs
+ *
+ * @wr_cfg_done:   Output param to indicate if SFE
+ *                 bus WR accepted these settings
+ * @rd_cfg_done:   Output param to indicate if SFE
+ *                 bus RD accepted these settings
+ * @res:           SFE WM/RM Resource node
+ * @use_cache:     If set cache configured
+ * @type:          Dictates which slice ID to be used
+ *
+ */
+struct cam_isp_sfe_bus_sys_cache_config {
+	bool                                 wr_cfg_done;
+	bool                                 rd_cfg_done;
+	struct cam_isp_resource_node        *res;
+	bool                                 use_cache;
+	int                                  scid;
+};
+
+/*
+ * struct cam_sfe_top_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           related to SFE top resource
+ *
+ * @list:                    list_head node for the payload
+ * @core_index:              Index of SFE HW that generated this IRQ event
+ * @evt_id:                  IRQ event
+ * @irq_reg_val:             IRQ and Error register values, read when IRQ was
+ *                           handled
+ * @violation_status         ccif violation status
+ * @error_type:              Identify different errors
+ * @ts:                      Timestamp
+ */
+struct cam_sfe_top_irq_evt_payload {
+	struct list_head           list;
+	uint32_t                   core_index;
+	uint32_t                   evt_id;
+	uint32_t                   irq_reg_val[CAM_SFE_IRQ_REGISTERS_MAX];
+	uint32_t                   violation_status;
+	uint32_t                   error_type;
+	struct cam_isp_timestamp   ts;
+};
+
+/*
+ * struct cam_sfe_bus_wr_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           BUS related to SFE resources
+ *
+ * @list:                    list_head node for the payload
+ * @core_index:              Index of SFE HW that generated this IRQ event
+ * @irq_reg_val              Bus irq register status
+ * @ccif_violation_status    ccif violation status
+ * @overflow_status          bus overflow status
+ * @image_size_vio_sts       image size violations status
+ * @error_type:              Identify different errors
+ * @evt_id:                  IRQ event
+ * @ts:                      Timestamp
+ * @last_consumed_addr:      Last consumed addr for resource
+ */
+struct cam_sfe_bus_wr_irq_evt_payload {
+	struct list_head           list;
+	uint32_t                   core_index;
+	uint32_t                   irq_reg_val[CAM_SFE_BUS_WR_IRQ_REGISTERS_MAX];
+	uint32_t                   ccif_violation_status;
+	uint32_t                   overflow_status;
+	uint32_t                   image_size_violation_status;
+	uint32_t                   error_type;
+	uint32_t                   evt_id;
+	struct cam_isp_timestamp   ts;
+	uint32_t                   last_consumed_addr;
+};
+
+/*
+ * struct cam_sfe_bus_rd_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           BUS related to SFE resources
+ *
+ * @list:                    list_head node for the payload
+ * @core_index:              Index of SFE HW that generated this IRQ event
+ * @irq_reg_val              Bus irq register status
+ * @constraint_violation     constraint violation
+ * @ccif_violation:          CCIF violation
+ * @error_type:              Identify different errors
+ * @evt_id:                  IRQ event
+ * @ts:                      Timestamp
+ */
+struct cam_sfe_bus_rd_irq_evt_payload {
+	struct list_head           list;
+	uint32_t                   core_index;
+	uint32_t                   irq_reg_val[
+		CAM_SFE_BUS_RD_IRQ_REGISTERS_MAX];
+	uint32_t                   constraint_violation;
+	uint32_t                   ccif_violation;
+	uint32_t                   error_type;
+	uint32_t                   evt_id;
+	struct cam_isp_timestamp   ts;
+};
+
+/*
+ * struct cam_sfe_hw_get_hw_cap:
+ *
+ * @reserved_1: reserved
+ * @reserved_2: reserved
+ * @reserved_3: reserved
+ * @reserved_4: reserved
+ */
+struct cam_sfe_hw_get_hw_cap {
+	uint32_t reserved_1;
+	uint32_t reserved_2;
+	uint32_t reserved_3;
+	uint32_t reserved_4;
+};
+
+/*
+ * struct cam_sfe_hw_vfe_bus_rd_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Unique Identity of port to associate with this
+ *                           resource.
+ * @cdm_ops:                 CDM operations
+ * @unpacket_fmt:            Unpacker format for read engine
+ * @is_offline:              Flag to indicate offline usecase
+ * @secure_mode:             If fetch is from secure/non-secure buffer
+ * @sfe_rd_only:             This indicates whether sfe HW has read only capbality
+ */
+struct cam_sfe_hw_sfe_bus_rd_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	uint32_t                              res_id;
+	struct cam_cdm_utils_ops             *cdm_ops;
+	uint32_t                              unpacker_fmt;
+	bool                                  is_offline;
+	bool                                  secure_mode;
+	bool                                  sfe_rd_only;
+};
+
+/*
+ * struct cam_sfe_hw_sfe_bus_in_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Unique Identity of port to associate with this
+ *                           resource.
+ * @cdm_ops:                 CDM operations
+ * @is_dual:                 Dual mode usecase
+ * @in_port:                 in port info
+ * @is_offline:              Flag to indicate Offline IFE
+ */
+struct cam_sfe_hw_sfe_in_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	uint32_t                              res_id;
+	struct cam_cdm_utils_ops             *cdm_ops;
+	uint32_t                              is_dual;
+	struct cam_isp_in_port_generic_info  *in_port;
+	bool                                  is_offline;
+};
+
+/*
+ * struct cam_sfe_hw_sfe_out_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @out_port_info:           Output Port details to acquire
+ * @unique_id:               Unique Identity of Context to associate with this
+ *                           resource. Used for composite grouping of multiple
+ *                           resources in the same context
+ * @is_dual:                 Dual SFE or not
+ * @split_id:                In case of Dual SFE, this is Left or Right.
+ * @is_master:               In case of Dual SFE, this is Master or Slave.
+ * @cdm_ops:                 CDM operations
+ * @use_wm_pack:             Flag to indicalte packing at WM side
+ * @comp_grp_id:             SFE bus comp group id
+ */
+struct cam_sfe_hw_sfe_out_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	struct cam_isp_out_port_generic_info *out_port_info;
+	uint32_t                              unique_id;
+	uint32_t                              is_dual;
+	enum cam_isp_hw_split_id              split_id;
+	uint32_t                              is_master;
+	struct cam_cdm_utils_ops             *cdm_ops;
+	bool                                  use_wm_pack;
+	uint32_t                              comp_grp_id;
+};
+
+/*
+ * struct cam_sfe_acquire_args:
+ *
+ * @rsrc_type:               Type of Resource (OUT/IN) to acquire
+ * @tasklet:                 Tasklet to associate with this resource. This is
+ *                           used to schedule bottom of IRQ events associated
+ *                           with this resource.
+ * @priv:                    Context data
+ * @event_cb:                Callback function to hw mgr in case of hw events
+ * @buf_done_controller:     Buf done controller
+ * @sfe_out:                 Acquire args for SFE_OUT
+ * @sfe_bus_rd               Acquire args for SFE_BUS_READ
+ * @sfe_in:                  Acquire args for SFE_IN
+ */
+struct cam_sfe_acquire_args {
+	enum cam_isp_resource_type           rsrc_type;
+	void                                *tasklet;
+	void                                *priv;
+	cam_hw_mgr_event_cb_func             event_cb;
+	void                                *buf_done_controller;
+	union {
+		struct cam_sfe_hw_sfe_out_acquire_args     sfe_out;
+		struct cam_sfe_hw_sfe_in_acquire_args      sfe_in;
+		struct cam_sfe_hw_sfe_bus_rd_acquire_args  sfe_rd;
+	};
+};
+
+/*
+ * cam_sfe_get_num_hws()
+ *
+ * @brief : Populates number of SFEs.
+ *
+ * @num_sfes : Fills number of SFEs in the address passed.
+ */
+void cam_sfe_get_num_hws(uint32_t *num_sfes);
+
+/*
+ * cam_sfe_hw_init()
+ *
+ * @Brief:                  Initialize SFE HW device
+ *
+ * @sfe_hw:                 sfe_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of SFE HW
+ */
+int cam_sfe_hw_init(struct cam_isp_hw_intf_data **sfe_hw, uint32_t hw_idx);
+
+#endif /* _CAM_SFE_HW_INTF_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_tfe_csid_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_tfe_csid_hw_intf.h
@@ -0,0 +1,288 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_HW_INTF_H_
+#define _CAM_TFE_CSID_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_tfe.h"
+
+/* MAX TFE CSID instance */
+#define CAM_TFE_CSID_HW_NUM_MAX                        4
+#define CAM_TFE_CSID_RDI_MAX                           3
+
+/**
+ * enum cam_tfe_pix_path_res_id - Specify the csid patch
+ */
+enum cam_tfe_csid_path_res_id {
+	CAM_TFE_CSID_PATH_RES_RDI_0,
+	CAM_TFE_CSID_PATH_RES_RDI_1,
+	CAM_TFE_CSID_PATH_RES_RDI_2,
+	CAM_TFE_CSID_PATH_RES_IPP,
+	CAM_TFE_CSID_PATH_RES_PPP,
+	CAM_TFE_CSID_PATH_RES_MAX,
+};
+
+/**
+ * enum cam_tfe_csid_irq_reg
+ */
+enum cam_tfe_csid_irq_reg {
+	TFE_CSID_IRQ_REG_RDI0,
+	TFE_CSID_IRQ_REG_RDI1,
+	TFE_CSID_IRQ_REG_RDI2,
+	TFE_CSID_IRQ_REG_TOP,
+	TFE_CSID_IRQ_REG_RX,
+	TFE_CSID_IRQ_REG_IPP,
+	TFE_CSID_IRQ_REG_PPP,
+	TFE_CSID_IRQ_REG_MAX,
+};
+
+struct cam_isp_tfe_out_port_generic_info {
+	uint32_t                res_id;
+	uint32_t                format;
+	uint32_t                width;
+	uint32_t                height;
+	uint32_t                stride;
+	uint32_t                comp_grp_id;
+	uint32_t                secure_mode;
+	uint32_t                wm_mode;
+	uint32_t                reserved;
+};
+
+struct cam_isp_tfe_in_port_generic_info {
+	uint32_t                        major_ver;
+	uint32_t                        minor_ver;
+	uint32_t                        res_id;
+	uint32_t                        lane_type;
+	uint32_t                        lane_num;
+	uint32_t                        lane_cfg;
+	uint32_t                        vc[CAM_ISP_TFE_VC_DT_CFG];
+	uint32_t                        dt[CAM_ISP_TFE_VC_DT_CFG];
+	uint32_t                        num_valid_vc_dt;
+	uint32_t                        format;
+	uint32_t                        pix_pattern;
+	uint32_t                        usage_type;
+	uint32_t                        left_start;
+	uint32_t                        left_end;
+	uint32_t                        left_width;
+	uint32_t                        right_start;
+	uint32_t                        right_end;
+	uint32_t                        right_width;
+	uint32_t                        line_start;
+	uint32_t                        line_end;
+	uint32_t                        height;
+	uint32_t                        batch_size;
+	uint32_t                        dsp_mode;
+	uint32_t                        sensor_width;
+	uint32_t                        sensor_height;
+	uint32_t                        sensor_hbi;
+	uint32_t                        sensor_vbi;
+	uint32_t                        sensor_fps;
+	uint32_t                        init_frame_drop;
+	uint32_t                        num_out_res;
+	uint32_t                        bayer_bin;
+	uint32_t                        qcfa_bin;
+	uint32_t                        core_cfg;
+	uint32_t                        num_bytes_out;
+	uint32_t                        ipp_count;
+	uint32_t                        rdi_count;
+	uint32_t                        secure_mode;
+	bool                            shdr_en;
+	bool                            is_shdr_master;
+	bool                            epd_supported;
+	struct cam_isp_tfe_out_port_generic_info    *data;
+};
+
+/**
+ * struct cam_tfe_csid_hw_caps- get the CSID hw capability
+ * @num_rdis:       number of rdis supported by CSID HW device
+ * @num_pix:        number of pxl paths supported by CSID HW device
+ * @num_ppp:        number of ppp paths supported by CSID HW device
+ * @major_version : major version
+ * @minor_version:  minor version
+ * @version_incr:   version increment
+ * @sync_clk:       sync clocks such that freq(TFE)>freq(CSID)>freq(CSIPHY)
+ * @is_lite:        Indicate if it is CSID Lite
+ *
+ */
+struct cam_tfe_csid_hw_caps {
+	uint32_t      num_rdis;
+	uint32_t      num_pix;
+	uint32_t      num_ppp;
+	uint32_t      major_version;
+	uint32_t      minor_version;
+	uint32_t      version_incr;
+	bool          sync_clk;
+	bool          is_lite;
+};
+
+/**
+ * struct cam_tfe_csid_hw_reserve_resource_args- hw reserve
+ * @res_type :    Reource type ie PATH
+ * @res_id  :     Resource id to be reserved
+ * @in_port :     Input port resource info
+ * @out_port:     Output port resource info, used for RDI path only
+ * @sync_mode:    Sync mode
+ *                Sync mode could be master, slave or none
+ * @master_idx:   Master device index to be configured in the slave path
+ *                for master path, this value is not required.
+ *                only slave need to configure the master index value
+ * @phy_sel:      Phy selection number if tpg is enabled from userspace
+ * @event_cb_prv: Context data
+ * @event_cb:     Callback function to hw mgr in case of hw events
+ * @node_res :    Reserved resource structure pointer
+ * @crop_enable : Flag to indicate CSID crop enable
+ *
+ */
+struct cam_tfe_csid_hw_reserve_resource_args {
+	enum cam_isp_resource_type                res_type;
+	uint32_t                                  res_id;
+	struct cam_isp_tfe_in_port_generic_info  *in_port;
+	struct cam_isp_tfe_out_port_generic_info *out_port;
+	enum cam_isp_hw_sync_mode                 sync_mode;
+	uint32_t                                  master_idx;
+	uint32_t                                  phy_sel;
+	void                                     *event_cb_prv;
+	cam_hw_mgr_event_cb_func                  event_cb;
+	struct cam_isp_resource_node             *node_res;
+	bool                                      crop_enable;
+};
+
+/**
+ *  enum cam_tfe_csid_halt_cmd - Specify the halt command type
+ */
+enum cam_tfe_csid_halt_cmd {
+	CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY,
+	CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY,
+	CAM_TFE_CSID_HALT_IMMEDIATELY,
+	CAM_TFE_CSID_HALT_MAX,
+};
+
+/**
+ * enum cam_tfe_csid_halt_mode - Specify the halt command type
+ */
+enum cam_tfe_csid_halt_mode {
+	CAM_TFE_CSID_HALT_MODE_INTERNAL,
+	CAM_TFE_CSID_HALT_MODE_GLOBAL,
+	CAM_TFE_CSID_HALT_MODE_MASTER,
+	CAM_TFE_CSID_HALT_MODE_SLAVE,
+	CAM_TFE_CSID_HALT_MODE_MAX,
+};
+
+/**
+ * struct cam_tfe_csid_hw_halt_args
+ * @halt_mode : Applicable only for PATH resources
+ *              0 Internal : The CSID responds to the HALT_CMD
+ *              1 Global   : The CSID responds to the GLOBAL_HALT_CMD
+ *              2 Master   : The CSID responds to the HALT_CMD
+ *              3 Slave    : The CSID responds to the external halt command
+ *                           and not the HALT_CMD register
+ * @node_res : reource pointer array( ie cid or CSID)
+ *
+ */
+struct cam_tfe_csid_hw_halt_args {
+	enum cam_tfe_csid_halt_mode     halt_mode;
+	struct cam_isp_resource_node   *node_res;
+};
+
+/**
+ * struct cam_csid_hw_stop- stop all resources
+ * @stop_cmd : Applicable only for PATH resources
+ *             if stop command set to Halt immediately,driver will stop
+ *             path immediately, manager need to reset the path after HI
+ *             if stop command set to halt at frame boundary, driver will set
+ *             halt at frame boundary and wait for frame boundary
+ * @num_res :  Number of resources to be stopped
+ * @node_res : Reource pointer array( ie cid or CSID)
+ *
+ */
+struct cam_tfe_csid_hw_stop_args {
+	enum cam_tfe_csid_halt_cmd                stop_cmd;
+	uint32_t                                  num_res;
+	struct cam_isp_resource_node            **node_res;
+};
+
+/**
+ * enum cam_tfe_csid_reset_type - Specify the reset type
+ */
+enum cam_tfe_csid_reset_type {
+	CAM_TFE_CSID_RESET_GLOBAL,
+	CAM_TFE_CSID_RESET_PATH,
+	CAM_TFE_CSID_RESET_MAX,
+};
+
+/**
+ * struct cam_tfe_csid_reset_cfg-  Csid reset configuration
+ * @ reset_type :                  Global reset or path reset
+ * @res_node :                     Resource need to be reset
+ *
+ */
+struct cam_tfe_csid_reset_cfg_args {
+	enum cam_tfe_csid_reset_type   reset_type;
+	struct cam_isp_resource_node  *node_res;
+};
+
+/**
+ * struct cam_csid_get_time_stamp_args-  time stamp capture arguments
+ * @res_node :       Resource to get the time stamp
+ * @time_stamp_val      : Captured time stamp
+ * @boot_timestamp      : Boot time stamp
+ * @prev_time_stamp_val : previous captured time stamp
+ * @get_prev_timestamp  : flag to fetch previous captured time stamp from hardware
+ */
+struct cam_tfe_csid_get_time_stamp_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           time_stamp_val;
+	uint64_t                           boot_timestamp;
+	uint64_t                           prev_time_stamp_val;
+	bool                               get_prev_timestamp;
+};
+
+/**
+ * enum cam_tfe_csid_cmd_type - Specify the csid command
+ */
+enum cam_tfe_csid_cmd_type {
+	CAM_TFE_CSID_CMD_GET_TIME_STAMP,
+	CAM_TFE_CSID_SET_CSID_DEBUG,
+	CAM_TFE_CSID_SOF_IRQ_DEBUG,
+	CAM_TFE_CSID_CMD_GET_REG_DUMP,
+	CAM_TFE_CSID_LOG_ACQUIRE_DATA,
+	CAM_TFE_CSID_CMD_MAX,
+};
+
+/**
+ * cam_tfe_csid_hw_init()
+ *
+ * @brief:               Initialize function for the CSID hardware
+ *
+ * @tfe_csid_hw:         CSID hardware instance returned
+ * @hw_idex:             CSID hardware instance id
+ */
+int cam_tfe_csid_hw_init(struct cam_hw_intf **tfe_csid_hw,
+	uint32_t hw_idx);
+
+/*
+ * struct cam_tfe_csid_clock_update_args:
+ *
+ * @clk_rate:                Clock rate requested
+ */
+struct cam_tfe_csid_clock_update_args {
+	uint64_t                           clk_rate;
+};
+
+/*
+ * struct cam_tfe_csid_discard_init_frame_args:
+ *
+ * @num_frames: Num frames to discard
+ * @res: Node res for this path
+ */
+struct cam_tfe_csid_discard_init_frame_args {
+	uint32_t                          num_frames;
+	struct cam_isp_resource_node     *res;
+};
+
+#endif /* _CAM_TFE_CSID_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_tfe_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_tfe_hw_intf.h
@@ -0,0 +1,280 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_HW_INTF_H_
+#define _CAM_TFE_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_cpas_api.h"
+
+#define CAM_TFE_HW_NUM_MAX            4
+#define TFE_CORE_BASE_IDX             0
+
+
+enum cam_isp_hw_tfe_in {
+	CAM_ISP_HW_TFE_IN_CAMIF       = 0,
+	CAM_ISP_HW_TFE_IN_RDI0        = 1,
+	CAM_ISP_HW_TFE_IN_RDI1        = 2,
+	CAM_ISP_HW_TFE_IN_RDI2        = 3,
+	CAM_ISP_HW_TFE_IN_PDLIB       = 4,
+	CAM_ISP_HW_TFE_IN_MAX,
+};
+
+enum cam_isp_hw_tfe_core {
+	CAM_ISP_HW_TFE_CORE_0,
+	CAM_ISP_HW_TFE_CORE_1,
+	CAM_ISP_HW_TFE_CORE_2,
+	CAM_ISP_HW_TFE_CORE_MAX,
+};
+
+enum cam_tfe_hw_irq_status {
+	CAM_TFE_IRQ_STATUS_SUCCESS,
+	CAM_TFE_IRQ_STATUS_ERR,
+	CAM_TFE_IRQ_STATUS_OVERFLOW,
+	CAM_TFE_IRQ_STATUS_P2I_ERROR,
+	CAM_TFE_IRQ_STATUS_VIOLATION,
+	CAM_TFE_IRQ_STATUS_OUT_OF_SYNC,
+	CAM_TFE_IRQ_STATUS_MAX,
+};
+
+enum cam_tfe_hw_irq_regs {
+	CAM_TFE_IRQ_CAMIF_REG_STATUS0           = 0,
+	CAM_TFE_IRQ_CAMIF_REG_STATUS1           = 1,
+	CAM_TFE_IRQ_CAMIF_REG_STATUS2           = 2,
+	CAM_TFE_IRQ_REGISTERS_MAX,
+};
+
+enum cam_tfe_bus_irq_regs {
+	CAM_TFE_IRQ_BUS_REG_STATUS0             = 0,
+	CAM_TFE_IRQ_BUS_REG_STATUS1             = 1,
+	CAM_TFE_BUS_IRQ_REGISTERS_MAX,
+};
+
+enum cam_tfe_reset_type {
+	CAM_TFE_HW_RESET_HW_AND_REG,
+	CAM_TFE_HW_RESET_HW,
+	CAM_TFE_HW_RESET_MAX,
+};
+
+enum cam_tfe_bw_control_action {
+	CAM_TFE_BW_CONTROL_EXCLUDE       = 0,
+	CAM_TFE_BW_CONTROL_INCLUDE       = 1
+};
+
+/*
+ * struct cam_tfe_hw_get_hw_cap:
+ *
+ * @max_width:               Max width supported by HW
+ * @max_height:              Max height supported by HW
+ * @max_pixel_num:           Max Pixel channels available
+ * @max_rdi_num:             Max Raw channels available
+ */
+struct cam_tfe_hw_get_hw_cap {
+	uint32_t                max_width;
+	uint32_t                max_height;
+	uint32_t                max_pixel_num;
+	uint32_t                max_rdi_num;
+};
+
+/*
+ * struct cam_tfe_hw_tfe_out_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @out_port_info:           Output Port details to acquire
+ * @unique_id:               Unique Identity of Context to associate with this
+ *                           resource. Used for composite grouping of multiple
+ *                           resources in the same context
+ * @is_dual:                 Dual TFE or not
+ * @split_id:                In case of Dual TFE, this is Left or Right.
+ *                           (Default is Left if Single TFE)
+ * @is_master:               In case of Dual TFE, this is Master or Slave.
+ *                           (Default is Master in case of Single TFE)
+ * @cdm_ops:                 CDM operations
+ * @ctx:                     Context data
+ * @comp_grp_id:             TFE bus comp group id
+ */
+struct cam_tfe_hw_tfe_out_acquire_args {
+	struct cam_isp_resource_node             *rsrc_node;
+	struct cam_isp_tfe_out_port_generic_info *out_port_info;
+	uint32_t                                  unique_id;
+	uint32_t                                  is_dual;
+	enum cam_isp_hw_split_id                  split_id;
+	uint32_t                                  is_master;
+	struct cam_cdm_utils_ops                 *cdm_ops;
+	void                                     *ctx;
+	uint32_t                                 comp_grp_id;
+};
+
+/*
+ * struct cam_tfe_hw_tfe_in_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Resource ID of resource to acquire if specific,
+ *                           else CAM_ISP_HW_TFE_IN_MAX
+ * @cdm_ops:                 CDM operations
+ * @sync_mode:               In case of Dual TFE, this is Master or Slave.
+ *                           (Default is Master in case of Single TFE)
+ * @in_port:                 Input port details to acquire
+ * @camif_pd_enable          Camif pd enable or disable
+ * @dual_tfe_sync_sel_idx    Dual tfe master hardware index
+ * @lcr_enable               LCR enable field
+ */
+struct cam_tfe_hw_tfe_in_acquire_args {
+	struct cam_isp_resource_node            *rsrc_node;
+	struct cam_isp_tfe_in_port_generic_info *in_port;
+	uint32_t                                 res_id;
+	void                                    *cdm_ops;
+	enum cam_isp_hw_sync_mode                sync_mode;
+	bool                                     camif_pd_enable;
+	uint32_t                                 dual_tfe_sync_sel_idx;
+	bool                                     lcr_enable;
+};
+
+/*
+ * struct cam_tfe_acquire_args:
+ *
+ * @rsrc_type:               Type of Resource (OUT/IN) to acquire
+ * @tasklet:                 Tasklet to associate with this resource. This is
+ *                           used to schedule bottom of IRQ events associated
+ *                           with this resource.
+ * @priv:                    Context data
+ * @event_cb:                Callback function to hw mgr in case of hw events
+ * @tfe_out:                 Acquire args for TFE_OUT
+ * @tfe_in:                  Acquire args for TFE_IN
+ */
+struct cam_tfe_acquire_args {
+	enum cam_isp_resource_type           rsrc_type;
+	void                                *tasklet;
+	void                                *priv;
+	cam_hw_mgr_event_cb_func             event_cb;
+	union {
+		struct cam_tfe_hw_tfe_out_acquire_args  tfe_out;
+		struct cam_tfe_hw_tfe_in_acquire_args   tfe_in;
+	};
+};
+
+/*
+ * struct cam_tfe_clock_update_args:
+ *
+ * @node_res:                Resource to get the time stamp
+ * @clk_rate:                Clock rate requested
+ */
+struct cam_tfe_clock_update_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           clk_rate;
+};
+
+/*
+ * struct cam_tfe_bw_update_args:
+ *
+ * @node_res:             Resource to get the BW
+ * @isp_vote:             Vote info according to usage data (left/right/rdi)
+ */
+struct cam_tfe_bw_update_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_axi_vote                isp_vote;
+};
+
+/*
+ * struct cam_tfe_dual_update_args:
+ *
+ * @Brief:        update the dual isp striping configuration.
+ *
+ * @ split_id:        spilt id to inform left or rifht
+ * @ res:             resource node
+ * @ stripe_config:   stripe configuration for port
+ *
+ */
+struct cam_tfe_dual_update_args {
+	enum cam_isp_hw_split_id                  split_id;
+	struct cam_isp_resource_node             *res;
+	struct cam_isp_tfe_dual_stripe_config    *stripe_config;
+};
+
+/*
+ * struct cam_tfe_bw_control_args:
+ *
+ * @node_res:             Resource to get the time stamp
+ * @action:               Bandwidth control action
+ */
+struct cam_tfe_bw_control_args {
+	struct cam_isp_resource_node      *node_res;
+	enum cam_tfe_bw_control_action     action;
+};
+
+/*
+ * struct cam_tfe_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           related to TFE_TOP resources
+ *
+ * @list:                    list_head node for the payload
+ * @core_index:              Index of TFE HW that generated this IRQ event
+ * @core_info:               Private data of handler in bottom half context
+ * @evt_id:                  IRQ event
+ * @irq_reg_val:             IRQ and Error register values, read when IRQ was
+ *                           handled
+ * @bus_irq_val              Bus irq register status
+ * @debug_status_0:          Value of debug status_0 register at time of IRQ
+ * @ccif_violation_status    ccif violation status
+ * @overflow_status          bus overflow status
+ * @image_size_violation_status  image size violations status
+
+ * @error_type:              Identify different errors
+ * @enable_reg_dump:         enable register dump on error
+ * @ts:                      Timestamp
+ * @last_consumed_addr:      Last consumed addr for resource
+ */
+struct cam_tfe_irq_evt_payload {
+	struct list_head           list;
+	uint32_t                   core_index;
+	void                      *core_info;
+	uint32_t                   evt_id;
+	uint32_t                   irq_reg_val[CAM_TFE_IRQ_REGISTERS_MAX];
+	uint32_t                   bus_irq_val[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t                   ccif_violation_status;
+	uint32_t                   overflow_status;
+	uint32_t                   image_size_violation_status;
+	uint32_t                   debug_status_0;
+
+	uint32_t                   error_type;
+	bool                       enable_reg_dump;
+	struct cam_isp_timestamp   ts;
+	uint32_t                   last_consumed_addr;
+};
+
+/*
+ * cam_tfe_get_num_tfe_hws()
+ *
+ * @brief:         Gets number of TFEs
+ *
+ * @num_tfes:      Fills number of TFES in the address passed
+ */
+void cam_tfe_get_num_tfe_hws(uint32_t *num_tfes);
+
+/*
+ * cam_tfe_get_num_tfe_lite_hws()
+ *
+ * @brief:         Gets number of TFE-LITEs
+ *
+ * @num_tfe_lites: Fills number of TFE-LITEs in the address passed
+ */
+void cam_tfe_get_num_tfe_lite_hws(uint32_t *num_tfe_lites);
+
+/*
+ * cam_tfe_hw_init()
+ *
+ * @Brief:                  Initialize TFE HW device
+ *
+ * @tfe_hw:                 tfe_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of TFE HW
+ */
+int cam_tfe_hw_init(struct cam_isp_hw_intf_data **tfe_hw, uint32_t hw_idx);
+
+#endif /* _CAM_TFE_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
@@ -0,0 +1,487 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_HW_INTF_H_
+#define _CAM_VFE_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_cpas_api.h"
+
+#define CAM_VFE_HW_NUM_MAX            8
+
+#define VFE_CORE_BASE_IDX             0
+#define RT_BASE_IDX                   2
+/*
+ * VBIF and BUS do not exist on same HW.
+ * Hence both can be 1 below.
+ */
+#define VFE_VBIF_BASE_IDX             1
+#define VFE_BUS_BASE_IDX              1
+
+#define CAM_VFE_MAX_UBWC_PORTS        12
+
+#define CAM_VFE_PERF_CNT_MAX          8
+
+enum cam_isp_hw_vfe_in_mux {
+	CAM_ISP_HW_VFE_IN_CAMIF       = 0,
+	CAM_ISP_HW_VFE_IN_TESTGEN     = 1,
+	CAM_ISP_HW_VFE_IN_RD          = 2,
+	CAM_ISP_HW_VFE_IN_RDI0        = 3,
+	CAM_ISP_HW_VFE_IN_RDI1        = 4,
+	CAM_ISP_HW_VFE_IN_RDI2        = 5,
+	CAM_ISP_HW_VFE_IN_RDI3        = 6,
+	CAM_ISP_HW_VFE_IN_RDI4        = 7,
+	CAM_ISP_HW_VFE_IN_RDI5        = 8,
+	CAM_ISP_HW_VFE_IN_PDLIB       = 9,
+	CAM_ISP_HW_VFE_IN_LCR         = 10,
+	CAM_ISP_HW_VFE_IN_MAX,
+};
+
+enum cam_isp_hw_vfe_core {
+	CAM_ISP_HW_VFE_CORE_0,
+	CAM_ISP_HW_VFE_CORE_1,
+	CAM_ISP_HW_VFE_CORE_2,
+	CAM_ISP_HW_VFE_CORE_3,
+	CAM_ISP_HW_VFE_CORE_MAX,
+};
+
+enum cam_vfe_hw_irq_status {
+	CAM_VFE_IRQ_STATUS_ERR_COMP             = -3,
+	CAM_VFE_IRQ_STATUS_COMP_OWRT            = -2,
+	CAM_VFE_IRQ_STATUS_ERR                  = -1,
+	CAM_VFE_IRQ_STATUS_SUCCESS              = 0,
+	CAM_VFE_IRQ_STATUS_OVERFLOW             = 1,
+	CAM_VFE_IRQ_STATUS_P2I_ERROR            = 2,
+	CAM_VFE_IRQ_STATUS_VIOLATION            = 3,
+	CAM_VFE_IRQ_STATUS_MAX,
+};
+
+enum cam_vfe_irq_err_mask {
+	CAM_VFE_IRQ_ERR_MASK_HWPD_VIOLATION     = 0x00000001,
+};
+
+enum cam_vfe_hw_irq_regs {
+	CAM_IFE_IRQ_CAMIF_REG_STATUS0           = 0,
+	CAM_IFE_IRQ_CAMIF_REG_STATUS1           = 1,
+	CAM_IFE_IRQ_CAMIF_REG_STATUS2           = 2,
+	CAM_IFE_IRQ_VIOLATION_STATUS            = 3,
+	CAM_IFE_IRQ_BUS_OVERFLOW_STATUS         = 4,
+	CAM_IFE_IRQ_REGISTERS_MAX,
+};
+
+enum cam_vfe_bus_irq_regs {
+	CAM_IFE_IRQ_BUS_REG_STATUS0             = 0,
+	CAM_IFE_IRQ_BUS_REG_STATUS1             = 1,
+	CAM_IFE_IRQ_BUS_REG_STATUS2             = 2,
+	CAM_IFE_IRQ_BUS_REG_COMP_ERR            = 3,
+	CAM_IFE_IRQ_BUS_REG_COMP_OWRT           = 4,
+	CAM_IFE_IRQ_BUS_DUAL_COMP_ERR           = 5,
+	CAM_IFE_IRQ_BUS_DUAL_COMP_OWRT          = 6,
+	CAM_IFE_BUS_IRQ_REGISTERS_MAX,
+};
+
+enum cam_vfe_bus_ver3_irq_regs {
+	CAM_IFE_IRQ_BUS_VER3_REG_STATUS0             = 0,
+	CAM_IFE_IRQ_BUS_VER3_REG_STATUS1             = 1,
+	CAM_IFE_IRQ_BUS_VER3_REG_MAX,
+};
+
+enum cam_vfe_reset_type {
+	CAM_VFE_HW_RESET_HW_AND_REG,
+	CAM_VFE_HW_RESET_HW,
+	CAM_VFE_HW_RESET_MAX,
+};
+
+/*
+ * struct cam_vfe_hw_get_hw_cap:
+ *
+ * @Brief:     Argument type for fetching the hw information for Query caps
+ * @major:     Major revision number
+ * @minor:     Minor revision number
+ * @incr:      Increment revision number
+ * @is_lite:   Flag to indicate Whether a full vfe or a Lite vfe
+ */
+struct cam_vfe_hw_get_hw_cap {
+	uint32_t major;
+	uint32_t minor;
+	uint32_t incr;
+	bool     is_lite;
+};
+
+/*
+ * struct cam_vfe_hw_vfe_bus_rd_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Unique Identity of port to associate with this
+ *                           resource.
+ * @is_dual:                 Flag to indicate dual VFE usecase
+ * @cdm_ops:                 CDM operations
+ * @unpacket_fmt:            Unpacker format for read engine
+ * @is_offline:              Flag to indicate offline usecase
+ */
+struct cam_vfe_hw_vfe_bus_rd_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	uint32_t                              res_id;
+	uint32_t                              is_dual;
+	struct cam_cdm_utils_ops             *cdm_ops;
+	uint32_t                              unpacker_fmt;
+	bool                                  is_offline;
+};
+
+/*
+ * struct cam_vfe_hw_vfe_out_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @out_port_info:           Output Port details to acquire
+ * @unique_id:               Unique Identity of Context to associate with this
+ *                           resource. Used for composite grouping of multiple
+ *                           resources in the same context
+ * @is_dual:                 Dual VFE or not
+ * @split_id:                In case of Dual VFE, this is Left or Right.
+ *                           (Default is Left if Single VFE)
+ * @is_master:               In case of Dual VFE, this is Master or Slave.
+ *                           (Default is Master in case of Single VFE)
+ * @dual_slave_core:         If Master and Slave exists, HW Index of Slave
+ * @cdm_ops:                 CDM operations
+ * @disable_ubwc_comp:       Disable UBWC compression
+ * @use_wm_pack:             Use WM Packing
+ * @comp_grp_id:             VFE bus comp group id
+ * @use_hw_ctxt:             Use HW context id info
+ * @vfe_res_out_id:          Vfe out resource id used in case of per_port feature
+ *                           to acquire all supported out resources
+ */
+struct cam_vfe_hw_vfe_out_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	struct cam_isp_out_port_generic_info *out_port_info;
+	uint32_t                              unique_id;
+	uint32_t                              is_dual;
+	enum cam_isp_hw_split_id              split_id;
+	uint32_t                              is_master;
+	uint32_t                              dual_slave_core;
+	struct cam_cdm_utils_ops             *cdm_ops;
+	bool                                  disable_ubwc_comp;
+	bool                                  use_wm_pack;
+	uint32_t                              comp_grp_id;
+	bool                                  use_hw_ctxt;
+	uint32_t                              vfe_res_out_id;
+};
+
+/*
+ * struct cam_vfe_hw_vfe_in_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Resource ID of resource to acquire if specific,
+ *                           else CAM_ISP_HW_VFE_IN_MAX
+ * @dual_hw_idx:             Slave core for this master core if dual vfe case
+ * @is_dual:                 flag to indicate if dual vfe case
+ * @hw_ctxt_mask:            Mask to indicate destination hw contexts acquired corresponding to
+ *                           a particular CSID IPP path
+ * @cdm_ops:                 CDM operations
+ * @sync_mode:               In case of Dual VFE, this is Master or Slave.
+ *                           (Default is Master in case of Single VFE)
+ * @in_port:                 Input port details to acquire
+ * @is_fe_enabled:           Flag to indicate if FE is enabled
+ * @is_offline:              Flag to indicate Offline IFE
+ * @handle_camif_irq:        Flag to handle the cmaif irq in VFE
+ */
+struct cam_vfe_hw_vfe_in_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	uint32_t                              res_id;
+	uint32_t                              dual_hw_idx;
+	uint32_t                              is_dual;
+	uint32_t                              hw_ctxt_mask;
+	void                                 *cdm_ops;
+	enum cam_isp_hw_sync_mode             sync_mode;
+	struct cam_isp_in_port_generic_info  *in_port;
+	bool                                  is_fe_enabled;
+	bool                                  is_offline;
+	bool                                  handle_camif_irq;
+};
+
+/*
+ * struct cam_vfe_acquire_args:
+ *
+ * @rsrc_type:               Type of Resource (OUT/IN) to acquire
+ * @tasklet:                 Tasklet to associate with this resource. This is
+ *                           used to schedule bottom of IRQ events associated
+ *                           with this resource.
+ * @priv:                    Context data
+ * @event_cb:                Callback function to hw mgr in case of hw events
+ * @buf_done_controller:     Buf done controller for isp
+ * @per_port_acquire:        Indicates if acquire as real acquire or per port virual
+ *                           acquire for current res path
+ * @vfe_out:                 Acquire args for VFE_OUT
+ * @vfe_bus_rd               Acquire args for VFE_BUS_READ
+ * @vfe_in:                  Acquire args for VFE_IN
+ */
+struct cam_vfe_acquire_args {
+	enum cam_isp_resource_type           rsrc_type;
+	void                                *tasklet;
+	void                                *priv;
+	cam_hw_mgr_event_cb_func             event_cb;
+	void                                *buf_done_controller;
+	bool                                 per_port_acquire;
+	union {
+		struct cam_vfe_hw_vfe_out_acquire_args     vfe_out;
+		struct cam_vfe_hw_vfe_bus_rd_acquire_args  vfe_bus_rd;
+		struct cam_vfe_hw_vfe_in_acquire_args      vfe_in;
+	};
+};
+
+/**
+ * struct cam_vfe_resource_update
+ * @priv:                  Context data
+ * @res:                   HW resource to get the update from
+ * @vfe_acquire:           VFE acquire parameters
+ *
+ */
+struct cam_vfe_resource_update {
+	void                                *priv;
+	struct cam_isp_hw_mgr_res           *res;
+	struct cam_vfe_acquire_args         *vfe_acquire;
+};
+
+/**
+ * struct cam_vfe_res_irq_info
+ * @priv:                  Context data
+ * @node_res:              reource pointer array( ie CSID/IFE_SRC/IFE_OUT)
+ * @num_res:               number of resources
+ * @enable_irq:            TRUE: enables irq for requested path
+ *                         FALSE: disables irq for requested path
+ *
+ */
+struct cam_vfe_res_irq_info {
+	void                                *priv;
+	struct cam_isp_resource_node        **node_res;
+	uint32_t                             num_res;
+	bool                                 enable_irq;
+};
+
+/*
+ * struct cam_vfe_clock_update_args:
+ *
+ * @node_res:                Resource to get the time stamp
+ * @clk_rate:                Clock rate requested
+ * @vote_level:              DRV vote level corresponding to requested rate
+ */
+struct cam_vfe_clock_update_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           clk_rate;
+	uint32_t                           vote_level;
+};
+
+/*
+ * struct cam_vfe_core_config_args:
+ *
+ * @node_res:                Resource to get the time stamp
+ * @core_config:             Core config for IFE
+ */
+struct cam_vfe_core_config_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_isp_core_config         core_config;
+};
+
+/*
+ * struct cam_vfe_bw_update_args_v2:
+ *
+ * @node_res:             Resource to get the BW
+ * @isp_vote:             Vote info according to usage data (left/right/rdi)
+ */
+struct cam_vfe_bw_update_args_v2 {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_axi_vote                isp_vote;
+};
+
+/*
+ * struct cam_vfe_bw_update_args:
+ *
+ * @node_res:             Resource to get the BW
+ * @camnoc_bw_bytes:      Bandwidth vote request for CAMNOC
+ * @external_bw_bytes:    Bandwidth vote request from CAMNOC
+ *                        out to the rest of the path-to-DDR
+ */
+struct cam_vfe_bw_update_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           camnoc_bw_bytes;
+	uint64_t                           external_bw_bytes;
+};
+
+/*
+ * struct cam_vfe_fe_update_args:
+ *
+ * @node_res:             Resource to get fetch configuration
+ * @fe_config:            fetch engine configuration
+ *
+ */
+struct cam_vfe_fe_update_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_fe_config               fe_config;
+};
+
+/*
+ * struct cam_vfe_top_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           related to VFE_TOP resources
+ *
+ * @list:                    list_head node for the payload
+ * @irq_reg_val:             IRQ and Error register values, read when IRQ was
+ *                           handled
+ * @reg_val:                 Value of any critical register that needs to be
+ *                           read at during irq handling
+ *
+ * @ts:                      Timestamp
+ */
+struct cam_vfe_top_irq_evt_payload {
+	struct list_head            list;
+	uint32_t                    irq_reg_val[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                    reg_val;
+	struct cam_isp_timestamp    ts;
+};
+
+/*
+ * struct cam_vfe_bus_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           related to VFE_BUS resources
+ *
+ * @list:                    list_head node for the payload
+ * @core_index:              Index of VFE HW that generated this IRQ event
+ * @debug_status_0:          Value of debug status_0 register at time of IRQ
+ * @evt_id:                  IRQ event
+ * @irq_reg_val:             IRQ and Error register values, read when IRQ was
+ *                           handled
+ * @error_type:              Identify different errors
+ * @ts:                      Timestamp
+ * @last_consumed_addr:      Last consumed addr for resource
+ */
+struct cam_vfe_bus_irq_evt_payload {
+	struct list_head            list;
+	uint32_t                    core_index;
+	uint32_t                    debug_status_0;
+	uint32_t                    ccif_violation_status;
+	uint32_t                    overflow_status;
+	uint32_t                    image_size_violation_status;
+	uint32_t                    evt_id;
+	uint32_t                    irq_reg_val[CAM_IFE_BUS_IRQ_REGISTERS_MAX];
+	struct cam_isp_timestamp    ts;
+	uint32_t                    last_consumed_addr;
+};
+
+/**
+ * struct cam_ubwc_generic_plane_config - UBWC Plane configuration info
+ *
+ * @port_type:                  Port Type
+ * @meta_stride:                UBWC metadata stride
+ * @meta_size:                  UBWC metadata plane size
+ * @meta_offset:                UBWC metadata offset
+ * @packer_config:              UBWC packer config
+ * @mode_config:                UBWC mode config
+ * @static ctrl:                UBWC static ctrl
+ * @ctrl_2:                     UBWC ctrl 2
+ * @tile_config:                UBWC tile config
+ * @h_init:                     UBWC horizontal initial coordinate in pixels
+ * @v_init:                     UBWC vertical initial coordinate in lines
+ * @stats_ctrl_2:               UBWC stats control
+ * @lossy_threshold0            UBWC lossy threshold 0
+ * @lossy_threshold1            UBWC lossy threshold 1
+ * @lossy_var_offset            UBWC offset variance threshold
+ * @bandwidth limit             UBWC bandwidth limit
+ */
+struct cam_vfe_generic_ubwc_plane_config {
+	uint32_t                port_type;
+	uint32_t                meta_stride;
+	uint32_t                meta_size;
+	uint32_t                meta_offset;
+	uint32_t                packer_config;
+	uint32_t                mode_config_0;
+	uint32_t                mode_config_1;
+	uint32_t                tile_config;
+	uint32_t                h_init;
+	uint32_t                v_init;
+	uint32_t                static_ctrl;
+	uint32_t                ctrl_2;
+	uint32_t                stats_ctrl_2;
+	uint32_t                lossy_threshold_0;
+	uint32_t                lossy_threshold_1;
+	uint32_t                lossy_var_offset;
+	uint32_t                bandwidth_limit;
+};
+
+/**
+ * struct cam_ubwc_generic_config - UBWC Configuration Payload
+ *
+ * @api_version:         UBWC config api version
+ * @ubwc_plane_config:   Array of UBWC configurations per plane
+ */
+struct cam_vfe_generic_ubwc_config {
+	uint32_t   api_version;
+	struct cam_vfe_generic_ubwc_plane_config
+		ubwc_plane_cfg[CAM_PACKET_MAX_PLANES - 1];
+};
+
+
+/*
+ * struct cam_vfe_generic_debug_config:
+ *
+ * @num_counters            : Number of perf counters configured
+ * @vfe_perf_counter_val    : VFE perf counter values
+ * @disable_ife_mmu_prefetch: Disable IFE mmu prefetch
+ * @enable_ife_frame_irqs:    Enable IFE frame timing IRQs
+ */
+struct cam_vfe_generic_debug_config {
+	uint32_t  num_counters;
+	uint32_t  vfe_perf_counter_val[CAM_VFE_PERF_CNT_MAX];
+	bool      disable_ife_mmu_prefetch;
+	bool      enable_ife_frame_irqs;
+};
+
+/*
+ * cam_vfe_get_num_ifes()
+ *
+ * @brief:         Gets number of IFEs
+ *
+ * @num_ifes:      Fills number of IFES in the address passed
+ */
+void cam_vfe_get_num_ifes(uint32_t *num_ifes);
+
+/*
+ * cam_vfe_get_num_ife_lites()
+ *
+ * @brief:         Gets number of IFE-LITEs
+ *
+ * @num_ifes:      Fills number of IFE-LITES in the address passed
+ */
+void cam_vfe_get_num_ife_lites(uint32_t *num_ife_lites);
+
+/*
+ * cam_vfe_hw_init()
+ *
+ * @Brief:                  Initialize VFE HW device
+ *
+ * @vfe_hw:                 vfe_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of VFE HW
+ */
+int cam_vfe_hw_init(struct cam_isp_hw_intf_data **vfe_hw,
+	uint32_t hw_idx);
+
+/*
+ * cam_vfe_put_evt_payload()
+ *
+ * @Brief:                  Put the evt payload back to free list
+ *
+ * @core_info:              VFE HW core_info
+ * @evt_payload:            Event payload data
+ */
+int cam_vfe_put_evt_payload(void             *core_info,
+	struct cam_vfe_top_irq_evt_payload  **evt_payload);
+
+#endif /* _CAM_VFE_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.c
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_csid_ppi_core.h"
+#include "cam_csid_ppi100.h"
+#include "cam_csid_ppi_dev.h"
+
+#define CAM_PPI_DRV_NAME                    "ppi_100"
+#define CAM_PPI_VERSION_V100                 0x10000000
+
+static struct cam_csid_ppi_hw_info cam_csid_ppi100_hw_info = {
+	.ppi_reg = &cam_csid_ppi_100_reg_offset,
+};
+
+static const struct of_device_id cam_csid_ppi100_dt_match[] = {
+	{
+		.compatible = "qcom,ppi100",
+		.data = &cam_csid_ppi100_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_csid_ppi100_dt_match);
+
+struct platform_driver cam_csid_ppi100_driver = {
+	.probe  = cam_csid_ppi_probe,
+	.remove = cam_csid_ppi_remove,
+	.driver = {
+		.name = CAM_PPI_DRV_NAME,
+		.of_match_table = cam_csid_ppi100_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_csid_ppi100_init_module(void)
+{
+	return platform_driver_register(&cam_csid_ppi100_driver);
+}
+
+void cam_csid_ppi100_exit_module(void)
+{
+	platform_driver_unregister(&cam_csid_ppi100_driver);
+}
+
+MODULE_DESCRIPTION("CAM CSID_PPI100 driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSID_PPI_100_H_
+#define _CAM_CSID_PPI_100_H_
+
+#include "cam_csid_ppi_core.h"
+
+static struct cam_csid_ppi_reg_offset cam_csid_ppi_100_reg_offset = {
+	.ppi_hw_version_addr    = 0,
+	.ppi_module_cfg_addr    = 0x60,
+	.ppi_irq_status_addr    = 0x68,
+	.ppi_irq_mask_addr      = 0x6c,
+	.ppi_irq_set_addr       = 0x70,
+	.ppi_irq_clear_addr     = 0x74,
+	.ppi_irq_cmd_addr       = 0x78,
+	.ppi_rst_cmd_addr       = 0x7c,
+	.ppi_test_bus_ctrl_addr = 0x1f4,
+	.ppi_debug_addr         = 0x1f8,
+	.ppi_spare_addr         = 0x1fc,
+};
+
+/**
+ * @brief : API to register PPI Dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_csid_ppi100_init_module(void);
+
+/**
+ * @brief : API to remove PPI Dev from platform framework.
+ */
+void cam_csid_ppi100_exit_module(void);
+#endif /*_CAM_CSID_PPI_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.c
@@ -0,0 +1,376 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+#include <media/cam_defs.h>
+
+#include "cam_csid_ppi_core.h"
+#include "cam_csid_ppi_dev.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_io_util.h"
+#include "cam_common_util.h"
+
+static int cam_csid_ppi_reset(struct cam_csid_ppi_hw *ppi_hw)
+{
+	struct cam_hw_soc_info                *soc_info;
+	const struct cam_csid_ppi_reg_offset  *ppi_reg;
+	int rc = 0;
+	uint32_t status;
+
+	soc_info = &ppi_hw->hw_info->soc_info;
+	ppi_reg  = ppi_hw->ppi_info->ppi_reg;
+
+	CAM_DBG(CAM_ISP, "PPI:%d reset", ppi_hw->hw_intf->hw_idx);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_mask_addr);
+	cam_io_w_mb(PPI_RST_CONTROL, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_set_addr);
+	cam_io_w_mb(PPI_RST_CONTROL, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_rst_cmd_addr);
+	cam_io_w_mb(PPI_IRQ_CMD_SET, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_cmd_addr);
+
+	rc = cam_common_read_poll_timeout(soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_status_addr,
+		1000, 500000, 0x1, 0x1, &status);
+
+	CAM_DBG(CAM_ISP, "PPI:%d reset status %d", ppi_hw->hw_intf->hw_idx,
+		status);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "PPI:%d ppi_reset fail rc = %d status = %d",
+			ppi_hw->hw_intf->hw_idx, rc, status);
+		return rc;
+	}
+	cam_io_w_mb(PPI_RST_CONTROL, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_clear_addr);
+	cam_io_w_mb(PPI_IRQ_CMD_CLEAR, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_cmd_addr);
+
+	return 0;
+}
+
+static int cam_csid_ppi_enable_hw(struct cam_csid_ppi_hw  *ppi_hw)
+{
+	int rc = 0;
+	int32_t i;
+	uint64_t val;
+	const struct cam_csid_ppi_reg_offset *ppi_reg;
+	struct cam_hw_soc_info               *soc_info;
+	uint32_t err_irq_mask;
+
+	ppi_reg  = ppi_hw->ppi_info->ppi_reg;
+	soc_info = &ppi_hw->hw_info->soc_info;
+
+	CAM_DBG(CAM_ISP, "PPI:%d init PPI HW", ppi_hw->hw_intf->hw_idx);
+
+	ppi_hw->hw_info->open_count++;
+	if (ppi_hw->hw_info->open_count > 1) {
+		CAM_DBG(CAM_ISP, "PPI:%d dual vfe already enabled",
+			ppi_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		rc = cam_soc_util_clk_enable(soc_info, CAM_CLK_SW_CLIENT_IDX, false, i, -1);
+		if (rc)
+			goto clk_disable;
+	}
+
+	rc = cam_csid_ppi_reset(ppi_hw);
+	if (rc)
+		goto clk_disable;
+
+	err_irq_mask = PPI_IRQ_FIFO0_OVERFLOW | PPI_IRQ_FIFO1_OVERFLOW |
+		PPI_IRQ_FIFO2_OVERFLOW;
+	cam_io_w_mb(err_irq_mask, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_mask_addr);
+	rc  = cam_soc_util_irq_enable(soc_info);
+	if (rc)
+		goto clk_disable;
+
+	cam_io_w_mb(PPI_RST_CONTROL, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_clear_addr);
+	cam_io_w_mb(PPI_IRQ_CMD_CLEAR, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_cmd_addr);
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_hw_version_addr);
+	CAM_DBG(CAM_ISP, "PPI:%d PPI HW version: 0x%x",
+		ppi_hw->hw_intf->hw_idx, val);
+	ppi_hw->device_enabled = 1;
+
+	return 0;
+clk_disable:
+	for (--i; i >= 0; i--)
+		cam_soc_util_clk_disable(soc_info, CAM_CLK_SW_CLIENT_IDX, false, i);
+	ppi_hw->hw_info->open_count--;
+	return rc;
+}
+
+static int cam_csid_ppi_disable_hw(struct cam_csid_ppi_hw *ppi_hw)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_soc_info               *soc_info;
+	const struct cam_csid_ppi_reg_offset *ppi_reg;
+	uint64_t ppi_cfg_val = 0;
+
+	CAM_DBG(CAM_ISP, "PPI:%d De-init PPI HW",
+		ppi_hw->hw_intf->hw_idx);
+
+	if (!ppi_hw->hw_info->open_count) {
+		CAM_WARN(CAM_ISP, "ppi[%d] unbalanced disable hw",
+			ppi_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+	ppi_hw->hw_info->open_count--;
+
+	if (ppi_hw->hw_info->open_count)
+		return rc;
+
+	soc_info = &ppi_hw->hw_info->soc_info;
+	ppi_reg = ppi_hw->ppi_info->ppi_reg;
+
+	CAM_DBG(CAM_ISP, "Calling PPI Reset");
+	cam_csid_ppi_reset(ppi_hw);
+	CAM_DBG(CAM_ISP, "PPI Reset Done");
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_mask_addr);
+	cam_soc_util_irq_disable(soc_info);
+
+	for (i = 0; i < CAM_CSID_PPI_LANES_MAX; i++)
+		ppi_cfg_val &= ~PPI_CFG_CPHY_DLX_EN(i);
+
+	cam_io_w_mb(ppi_cfg_val, soc_info->reg_map[0].mem_base +
+			ppi_reg->ppi_module_cfg_addr);
+
+	ppi_hw->device_enabled = 0;
+
+	for (i = 0; i < soc_info->num_clk; i++)
+		cam_soc_util_clk_disable(soc_info, CAM_CLK_SW_CLIENT_IDX, false, i);
+
+	return rc;
+}
+
+static int cam_csid_ppi_init_hw(void *hw_priv, void *init_args,
+		uint32_t arg_size)
+{
+	int i, rc = 0;
+	uint32_t num_lanes;
+	uint32_t cphy;
+	uint32_t ppi_cfg_val = 0;
+	struct cam_csid_ppi_hw                *ppi_hw;
+	struct cam_hw_info                    *ppi_hw_info;
+	const struct cam_csid_ppi_reg_offset  *ppi_reg;
+	struct cam_hw_soc_info                *soc_info;
+	struct cam_csid_ppi_cfg                ppi_cfg;
+
+	if (!hw_priv || !init_args ||
+		(arg_size != sizeof(struct cam_csid_ppi_cfg))) {
+		CAM_ERR(CAM_ISP, "PPI: Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ppi_hw_info = (struct cam_hw_info *)hw_priv;
+	ppi_hw      = (struct cam_csid_ppi_hw *)ppi_hw_info->core_info;
+	ppi_reg     = ppi_hw->ppi_info->ppi_reg;
+	ppi_cfg     = *((struct cam_csid_ppi_cfg *)init_args);
+
+	rc = cam_csid_ppi_enable_hw(ppi_hw);
+	if (rc)
+		goto end;
+
+	num_lanes = ppi_cfg.lane_num;
+	cphy = ppi_cfg.lane_type;
+	CAM_DBG(CAM_ISP, "lane_cfg  0x%x | num_lanes  0x%x | lane_type 0x%x",
+		ppi_cfg.lane_cfg, num_lanes, cphy);
+
+	if (cphy) {
+		ppi_cfg_val |= PPI_CFG_CPHY_DLX_SEL(0);
+		ppi_cfg_val |= PPI_CFG_CPHY_DLX_SEL(1);
+	} else {
+		ppi_cfg_val = 0;
+	}
+
+	for (i = 0; i < CAM_CSID_PPI_LANES_MAX; i++)
+		ppi_cfg_val |= PPI_CFG_CPHY_DLX_EN(i);
+
+	CAM_DBG(CAM_ISP, "ppi_cfg_val 0x%x", ppi_cfg_val);
+	soc_info = &ppi_hw->hw_info->soc_info;
+	cam_io_w_mb(ppi_cfg_val, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_module_cfg_addr);
+
+	CAM_DBG(CAM_ISP, "ppi cfg 0x%x",
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_module_cfg_addr));
+end:
+	return rc;
+}
+
+static int cam_csid_ppi_deinit_hw(void *hw_priv, void *deinit_args,
+		uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_csid_ppi_hw  *ppi_hw;
+	struct cam_hw_info      *ppi_hw_info;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "PPI:Invalid arguments");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ppi_hw_info = (struct cam_hw_info  *)hw_priv;
+	ppi_hw      = (struct cam_csid_ppi_hw *)ppi_hw_info->core_info;
+
+	CAM_DBG(CAM_ISP, "Disabling PPI Hw");
+	rc = cam_csid_ppi_disable_hw(ppi_hw);
+	if (rc < 0)
+		CAM_DBG(CAM_ISP, "Exit with %d", rc);
+end:
+	return rc;
+}
+
+int cam_csid_ppi_hw_probe_init(struct cam_hw_intf  *ppi_hw_intf,
+	uint32_t ppi_idx)
+{
+	int rc = -EINVAL;
+	struct cam_hw_info        *ppi_hw_info;
+	struct cam_csid_ppi_hw    *csid_ppi_hw = NULL;
+
+	if (ppi_idx >= CAM_CSID_PPI_HW_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid ppi index:%d", ppi_idx);
+		goto err;
+	}
+
+	ppi_hw_info = (struct cam_hw_info  *) ppi_hw_intf->hw_priv;
+	csid_ppi_hw  = (struct cam_csid_ppi_hw  *) ppi_hw_info->core_info;
+
+	csid_ppi_hw->hw_intf = ppi_hw_intf;
+	csid_ppi_hw->hw_info = ppi_hw_info;
+
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		csid_ppi_hw->hw_intf->hw_type, ppi_idx);
+
+	rc = cam_csid_ppi_init_soc_resources(&csid_ppi_hw->hw_info->soc_info,
+		cam_csid_ppi_irq, csid_ppi_hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "PPI:%d Failed to init_soc", ppi_idx);
+		goto err;
+	}
+
+	csid_ppi_hw->hw_intf->hw_ops.init   = cam_csid_ppi_init_hw;
+	csid_ppi_hw->hw_intf->hw_ops.deinit = cam_csid_ppi_deinit_hw;
+	return 0;
+err:
+	return rc;
+}
+
+int cam_csid_ppi_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ppi_irq_handler, void *data)
+{
+	int rc = 0, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "PPI: Failed to get dt properties");
+		goto end;
+	}
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, ppi_irq_handler, &(irq_data[0]));
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"PPI: Error Request platform resources failed rc=%d",
+			rc);
+		goto err;
+	}
+end:
+	return rc;
+err:
+	cam_soc_util_release_platform_resource(soc_info);
+	return rc;
+}
+
+irqreturn_t cam_csid_ppi_irq(int irq_num, void *data)
+{
+	uint32_t      irq_status = 0;
+	uint32_t      i, ppi_cfg_val = 0;
+	bool          fatal_err_detected = false;
+
+	struct cam_csid_ppi_hw                *ppi_hw;
+	struct cam_hw_soc_info                *soc_info;
+	const struct cam_csid_ppi_reg_offset  *ppi_reg;
+
+	if (!data) {
+		CAM_ERR(CAM_ISP, "PPI: Invalid arguments");
+		return IRQ_HANDLED;
+	}
+
+	ppi_hw = (struct cam_csid_ppi_hw *)data;
+	ppi_reg = ppi_hw->ppi_info->ppi_reg;
+	soc_info = &ppi_hw->hw_info->soc_info;
+
+	if (ppi_hw->device_enabled != 1)
+		goto ret;
+
+	irq_status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_status_addr);
+
+	cam_io_w_mb(irq_status, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_clear_addr);
+
+	cam_io_w_mb(PPI_IRQ_CMD_CLEAR, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_cmd_addr);
+
+	CAM_DBG(CAM_ISP, "PPI %d irq status 0x%x", ppi_hw->hw_intf->hw_idx,
+			irq_status);
+
+	if (irq_status & PPI_IRQ_RST_DONE) {
+		CAM_DBG(CAM_ISP, "PPI Reset Done");
+		goto ret;
+	}
+	if ((irq_status & PPI_IRQ_FIFO0_OVERFLOW) ||
+		(irq_status & PPI_IRQ_FIFO1_OVERFLOW) ||
+		(irq_status & PPI_IRQ_FIFO2_OVERFLOW)) {
+		fatal_err_detected = true;
+		goto handle_fatal_error;
+	}
+
+handle_fatal_error:
+	if (fatal_err_detected) {
+		CAM_ERR(CAM_ISP, "PPI: %d irq_status:0x%x",
+			ppi_hw->hw_intf->hw_idx, irq_status);
+		for (i = 0; i < CAM_CSID_PPI_LANES_MAX; i++)
+			ppi_cfg_val &= ~PPI_CFG_CPHY_DLX_EN(i);
+
+		cam_io_w_mb(ppi_cfg_val, soc_info->reg_map[0].mem_base +
+			ppi_reg->ppi_module_cfg_addr);
+	}
+ret:
+	CAM_DBG(CAM_ISP, "IRQ Handling exit");
+	return IRQ_HANDLED;
+}
+
+int cam_csid_ppi_hw_deinit(struct cam_csid_ppi_hw *csid_ppi_hw)
+{
+	if (!csid_ppi_hw) {
+		CAM_ERR(CAM_ISP, "Invalid param");
+		return -EINVAL;
+	}
+	return cam_soc_util_release_platform_resource(
+		&csid_ppi_hw->hw_info->soc_info);
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.h
@@ -0,0 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSID_PPI_HW_H_
+#define _CAM_CSID_PPI_HW_H_
+
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+
+#define CAM_CSID_PPI_HW_MAX      6
+#define CAM_CSID_PPI_LANES_MAX   3
+
+#define PPI_IRQ_RST_DONE                   BIT(0)
+#define PPI_IRQ_FIFO0_OVERFLOW             BIT(1)
+#define PPI_IRQ_FIFO1_OVERFLOW             BIT(2)
+#define PPI_IRQ_FIFO2_OVERFLOW             BIT(3)
+
+#define PPI_IRQ_CMD_SET                    BIT(1)
+
+#define PPI_IRQ_CMD_CLEAR                  BIT(0)
+
+#define PPI_RST_CONTROL                    BIT(0)
+/*
+ * Select the PHY (CPHY set '1' or DPHY set '0')
+ */
+#define PPI_CFG_CPHY_DLX_SEL(X)            BIT(X)
+
+#define PPI_CFG_CPHY_DLX_EN(X)             BIT(4+X)
+
+struct cam_csid_ppi_reg_offset {
+	uint32_t ppi_hw_version_addr;
+	uint32_t ppi_module_cfg_addr;
+
+	uint32_t ppi_irq_status_addr;
+	uint32_t ppi_irq_mask_addr;
+	uint32_t ppi_irq_set_addr;
+	uint32_t ppi_irq_clear_addr;
+	uint32_t ppi_irq_cmd_addr;
+	uint32_t ppi_rst_cmd_addr;
+	uint32_t ppi_test_bus_ctrl_addr;
+	uint32_t ppi_debug_addr;
+	uint32_t ppi_spare_addr;
+};
+
+/**
+ * struct cam_csid_ppi_hw_info- ppi HW info
+ *
+ * @ppi_reg:         ppi register offsets
+ *
+ */
+struct cam_csid_ppi_hw_info {
+	const struct cam_csid_ppi_reg_offset *ppi_reg;
+};
+
+/**
+ * struct cam_csid_ppi_hw- ppi hw device resources data
+ *
+ * @hw_intf:                  contain the ppi hw interface information
+ * @hw_info:                  ppi hw device information
+ * @ppi_info:                 ppi hw specific information
+ * @device_enabled            Device enabled will set once ppi powered on and
+ *                            initial configuration are done.
+ *
+ */
+struct cam_csid_ppi_hw {
+	struct cam_hw_intf              *hw_intf;
+	struct cam_hw_info              *hw_info;
+	struct cam_csid_ppi_hw_info     *ppi_info;
+	uint32_t                         device_enabled;
+};
+
+/**
+ * struct cam_csid_ppi_cfg - ppi lane configuration data
+ * @lane_type:   lane type: c-phy or d-phy
+ * @lane_num :   active lane number
+ * @lane_cfg:    lane configurations: 4 bits per lane
+ *
+ */
+struct cam_csid_ppi_cfg {
+	uint32_t lane_type;
+	uint32_t lane_num;
+	uint32_t lane_cfg;
+};
+
+int cam_csid_ppi_hw_probe_init(struct cam_hw_intf  *ppi_hw_intf,
+	uint32_t ppi_idx);
+int cam_csid_ppi_hw_deinit(struct cam_csid_ppi_hw *csid_ppi_hw);
+int cam_csid_ppi_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ppi_irq_handler, void *irq_data);
+int cam_csid_ppi_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+int cam_csid_ppi_hw_init(struct cam_hw_intf **csid_ppi_hw,
+	uint32_t hw_idx);
+#endif /* _CAM_CSID_PPI_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.c
@@ -0,0 +1,167 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/component.h>
+
+#include "cam_isp_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_csid_ppi_core.h"
+#include "cam_csid_ppi_dev.h"
+#include "cam_debug_util.h"
+
+static struct cam_hw_intf *cam_csid_ppi_hw_list[CAM_CSID_PPI_HW_MAX] = {
+	NULL, NULL, NULL, NULL};
+
+static int cam_ppi_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf            *ppi_hw_intf;
+	struct cam_hw_info            *ppi_hw_info;
+	struct cam_csid_ppi_hw        *ppi_dev = NULL;
+	const struct of_device_id     *match_dev = NULL;
+	struct cam_csid_ppi_hw_info   *ppi_hw_data = NULL;
+	uint32_t                       ppi_dev_idx;
+	int                            rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ISP, "PPI probe called");
+
+	ppi_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!ppi_hw_intf) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	ppi_hw_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!ppi_hw_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	ppi_dev = kzalloc(sizeof(struct cam_csid_ppi_hw), GFP_KERNEL);
+	if (!ppi_dev) {
+		rc = -ENOMEM;
+		goto free_hw_info;
+	}
+
+	of_property_read_u32(pdev->dev.of_node, "cell-index", &ppi_dev_idx);
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "No matching table for the CSID PPI HW!");
+		rc = -EINVAL;
+		goto free_dev;
+	}
+
+	ppi_hw_intf->hw_idx  = ppi_dev_idx;
+	ppi_hw_intf->hw_priv = ppi_hw_info;
+
+	if (ppi_hw_intf->hw_idx < CAM_CSID_PPI_HW_MAX)
+		cam_csid_ppi_hw_list[ppi_hw_intf->hw_idx] = ppi_hw_intf;
+	else {
+		rc = -EINVAL;
+		goto free_dev;
+	}
+
+	ppi_hw_info->core_info         = ppi_dev;
+	ppi_hw_info->soc_info.pdev     = pdev;
+	ppi_hw_info->soc_info.dev      = &pdev->dev;
+	ppi_hw_info->soc_info.dev_name = pdev->name;
+	ppi_hw_info->soc_info.index    = ppi_dev_idx;
+
+	ppi_hw_data = (struct cam_csid_ppi_hw_info  *)match_dev->data;
+	ppi_dev->ppi_info = ppi_hw_data;
+
+	rc = cam_csid_ppi_hw_probe_init(ppi_hw_intf, ppi_dev_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "PPI: Probe init failed!");
+		goto free_dev;
+	}
+
+	platform_set_drvdata(pdev, ppi_dev);
+	CAM_DBG(CAM_ISP, "PPI:%d probe successful",
+		ppi_hw_intf->hw_idx);
+
+	return 0;
+free_dev:
+	kfree(ppi_dev);
+free_hw_info:
+	kfree(ppi_hw_info);
+free_hw_intf:
+	kfree(ppi_hw_intf);
+err:
+	return rc;
+}
+
+static void cam_ppi_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_csid_ppi_hw         *ppi_dev = NULL;
+	struct cam_hw_intf             *ppi_hw_intf;
+	struct cam_hw_info             *ppi_hw_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	ppi_dev = (struct cam_csid_ppi_hw *)platform_get_drvdata(pdev);
+
+	if (!ppi_dev) {
+		CAM_ERR(CAM_ISP, "Error No data in ppi_dev");
+		return;
+	}
+
+	ppi_hw_intf = ppi_dev->hw_intf;
+	ppi_hw_info = ppi_dev->hw_info;
+
+	CAM_DBG(CAM_ISP, "PPI:%d remove", ppi_dev->hw_intf->hw_idx);
+
+	cam_csid_ppi_hw_deinit(ppi_dev);
+
+	kfree(ppi_dev);
+	kfree(ppi_hw_info);
+	kfree(ppi_hw_intf);
+}
+
+int cam_csid_ppi_hw_init(struct cam_hw_intf **csid_ppi_hw,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_csid_ppi_hw_list[hw_idx]) {
+		*csid_ppi_hw = cam_csid_ppi_hw_list[hw_idx];
+	} else {
+		*csid_ppi_hw = NULL;
+		rc = -1;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_csid_ppi_hw_init);
+
+const static struct component_ops cam_ppi_component_ops = {
+	.bind = cam_ppi_component_bind,
+	.unbind = cam_ppi_component_unbind,
+};
+
+int cam_csid_ppi_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Adding PPI component");
+	rc = component_add(&pdev->dev, &cam_ppi_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_csid_ppi_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ppi_component_ops);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSID_PPI_DEV_H_
+#define _CAM_CSID_PPI_DEV_H_
+
+#include "cam_isp_hw.h"
+
+irqreturn_t cam_csid_ppi_irq(int irq_num, void *data);
+int cam_csid_ppi_probe(struct platform_device *pdev);
+int cam_csid_ppi_remove(struct platform_device *pdev);
+
+#endif /*_CAM_CSID_PPI_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe680.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe680.h
@@ -0,0 +1,1344 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE680_H_
+#define _CAM_SFE680_H_
+#include "cam_sfe_core.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+#include "cam_sfe_bus_wr.h"
+
+
+static struct cam_sfe_top_module_desc sfe_680_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CRC_ZSL",
+	},
+	{
+		.id = 1,
+		.desc = "COMP",
+	},
+	{
+		.id = 2,
+		.desc = "CRC_PREV",
+	},
+	{
+		.id = 3,
+		.desc = "HDRC",
+	},
+	{
+		.id = 4,
+		.desc = "DECOMP",
+	},
+	{
+		.id = 5,
+		.desc = "BPC_PDPC",
+	},
+	{
+		.id = 6,
+		.desc = "BHIST_CH0",
+	},
+	{
+		.id = 7,
+		.desc = "BG_CH0",
+	},
+	{
+		.id = 8,
+		.desc = "LSC_CH0",
+	},
+	{
+		.id = 9,
+		.desc = "CRC_CH0",
+	},
+	{
+		.id = 10,
+		.desc = "CCIF_2x2_2x1",
+	},
+	{
+		.id = 11,
+		.desc = "GAIN_CH0",
+	},
+	{
+		.id = 12,
+		.desc = "BHIST_CH1",
+	},
+	{
+		.id = 13,
+		.desc = "BG_CH1",
+	},
+	{
+		.id = 14,
+		.desc = "LSC_CH1",
+	},
+	{
+		.id = 15,
+		.desc = "CRC_CH1",
+	},
+	{
+		.id = 16,
+		.desc = "GAIN_CH1",
+	},
+	{
+		.id = 17,
+		.desc = "BHIST_CH2",
+	},
+	{
+		.id = 18,
+		.desc = "BG_CH2",
+	},
+	{
+		.id = 19,
+		.desc = "LSC_CH2",
+	},
+	{
+		.id = 20,
+		.desc = "CRC_CH2",
+	},
+	{
+		.id = 21,
+		.desc = "GAIN_CH2",
+	},
+	{
+		.id = 22,
+		.desc = "LCR",
+	},
+	{
+		.id = 23,
+		.desc = "QCFA_DEMUX",
+	},
+};
+
+static struct cam_sfe_wr_client_desc sfe_680_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "REMOSAIC",
+	},
+	{
+		.wm_id = 1,
+		.desc = "LCR",
+	},
+	{
+		.wm_id = 2,
+		.desc = "STATS_BE0",
+	},
+	{
+		.wm_id = 3,
+		.desc = "STATS_BHIST0",
+	},
+	{
+		.wm_id = 4,
+		.desc = "STATS_BE1",
+	},
+	{
+		.wm_id = 5,
+		.desc = "STATS_BHIST1",
+	},
+	{
+		.wm_id = 6,
+		.desc = "STATS_BE2",
+	},
+	{
+		.wm_id = 7,
+		.desc = "STATS_BHIST2",
+	},
+	{
+		.wm_id = 8,
+		.desc = "RDI_0",
+	},
+	{
+		.wm_id = 9,
+		.desc = "RDI_1",
+	},
+	{
+		.wm_id = 10,
+		.desc = "RDI_2",
+	},
+	{
+		.wm_id = 11,
+		.desc = "RDI_3",
+	},
+	{
+		.wm_id = 12,
+		.desc = "RDI_4",
+	},
+};
+
+static struct cam_sfe_mode sfe_680_mode[] = {
+	{
+		.value = 0x1,
+		.desc = "FS Mode",
+	},
+	{
+		.value = 0x3,
+		.desc = "Offline Mode",
+	},
+	{
+		.value = 0x4,
+		.desc = "sHDR mode",
+	},
+};
+
+static struct cam_sfe_top_err_irq_desc sfe_680_top_irq_err_desc[] = {
+	{
+		.bitmask = BIT(14),
+		.err_name = "PP_VIOLATION",
+		.desc = "CCIF protocol violation within any of the modules in pixel pipeline",
+	},
+	{
+		.bitmask = BIT(15),
+		.err_name = "DIAG_VIOLATION",
+		.desc = "HBI is less than the minimum required HBI",
+	},
+	{
+		.bitmask = BIT(16),
+		.err_name = "LINE_SMOOTH_VIOLATION",
+		.desc = "Line Smoothner IRQ fire",
+	},
+};
+
+static struct cam_sfe_top_debug_info sfe680_clc_dbg_module_info[CAM_SFE_TOP_DBG_REG_MAX][8] = {
+	SFE_DBG_INFO_ARRAY_4bit(
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"zsl_throttle",
+		"crc_zsl",
+		"comp_zsl",
+		"crc_prev",
+		"hdrc_ch2",
+		"hdrc_ch1",
+		"hdrc_ch0",
+		"stats_bhist_ch0"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"stats_bg_ch0",
+		"lsc_ch0",
+		"crc_ch0",
+		"ccif_2x2_to_2x1",
+		"decomp",
+		"msb_align_ch0",
+		"bpc_pdpc",
+		"ch0_gain"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"bhist_ch1",
+		"stats_bg_ch1",
+		"lsc_ch1",
+		"crc_ch1",
+		"msb_align_ch1",
+		"ch1_gain",
+		"bhist_ch2",
+		"stats_bg_ch2"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"lsc_ch2",
+		"crc_ch2",
+		"msb_align_ch2",
+		"ch2_gain",
+		"lcr_throttle",
+		"lcr",
+		"demux_fetch2",
+		"demux_fetch1"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"demux_fetch0",
+		"csid_ccif",
+		"RDI4",
+		"RDI3",
+		"RDI2",
+		"RDI1",
+		"RDI0",
+		"bhist2_bus_wr"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"bg2_bus_wr",
+		"bhist1_bus_wr",
+		"bg1_bus_wr",
+		"bhist0_bus_wr",
+		"bg0_bus_wr",
+		"lcr_bus_wr",
+		"zsl_bus_wr",
+		"sfe_op_throttle"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"line_smooth",
+		"pp",
+		"bus_conv_ch2",
+		"bus_conv_ch1",
+		"bus_conv_ch0",
+		"fe_ch2",
+		"fe_ch1",
+		"fe_ch0"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"rdi4",
+		"rdi3",
+		"rdi2",
+		"rdi1",
+		"rdi0",
+		"pixel",
+		"reserved",
+		"reserved"
+	),
+};
+
+static struct cam_sfe_top_common_reg_offset  sfe680_top_commong_reg  = {
+	.hw_version                    = 0x00000000,
+	.hw_capability                 = 0x00000004,
+	.stats_feature                 = 0x00000008,
+	.core_cgc_ctrl                 = 0x00000010,
+	.ahb_clk_ovd                   = 0x00000014,
+	.core_cfg                      = 0x00000018,
+	.ipp_violation_status          = 0x00000030,
+	.diag_config                   = 0x00000034,
+	.diag_sensor_status_0          = 0x00000038,
+	.diag_sensor_status_1          = 0x0000003C,
+	.diag_sensor_frame_cnt_status0 = 0x00000040,
+	.diag_sensor_frame_cnt_status1 = 0x00000044,
+	.stats_ch2_throttle_cfg        = 0x000000B0,
+	.stats_ch1_throttle_cfg        = 0x000000B4,
+	.stats_ch0_throttle_cfg        = 0x000000B8,
+	.lcr_throttle_cfg              = 0x000000BC,
+	.hdr_throttle_cfg              = 0x000000C0,
+	.sfe_op_throttle_cfg           = 0x000000C4,
+	.bus_overflow_status           = 0x00000868,
+	.num_perf_counters             = 2,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg        = 0x00000080,
+			.perf_pix_count        = 0x00000084,
+			.perf_line_count       = 0x00000088,
+			.perf_stall_count      = 0x0000008C,
+			.perf_always_count     = 0x00000090,
+			.perf_count_status     = 0x00000094,
+		},
+		{
+			.perf_count_cfg        = 0x00000098,
+			.perf_pix_count        = 0x0000009C,
+			.perf_line_count       = 0x000000A0,
+			.perf_stall_count      = 0x000000A4,
+			.perf_always_count     = 0x000000A8,
+			.perf_count_status     = 0x000000AC,
+		},
+	},
+	.top_debug_cfg                 = 0x0000007C,
+	.lcr_supported                 = true,
+	.ir_supported                  = false,
+	.qcfa_only                     = true,
+	.num_sfe_mode                  = ARRAY_SIZE(sfe_680_mode),
+	.sfe_mode                      = sfe_680_mode,
+	.ipp_violation_mask            = 0x4000,
+	.num_debug_registers           = 12,
+	.top_cc_test_bus_supported     = false,
+	.top_debug = {
+		0x0000004C,
+		0x00000050,
+		0x00000054,
+		0x00000058,
+		0x0000005C,
+		0x00000060,
+		0x00000064,
+		0x00000068,
+		0x0000006C,
+		0x00000070,
+		0x00000074,
+		0x00000078,
+	},
+};
+
+static struct cam_sfe_modules_common_reg_offset sfe680_modules_common_reg = {
+	.demux_module_cfg              = 0x00003060,
+	.demux_xcfa_cfg                = 0x00003064,
+	.demux_hdr_cfg                 = 0x00003074,
+	.demux_lcr_sel                 = 0x00003078,
+	.hdrc_remo_mod_cfg             = 0x00005860,
+	.hdrc_remo_xcfa_bin_cfg        = 0x00005A78,
+	.xcfa_hdrc_remo_out_mux_cfg    = 0x00005A74,
+};
+
+static struct cam_sfe_top_common_reg_data sfe_680_top_common_reg_data = {
+	.error_irq_mask                = 0x1C000,
+	.enable_diagnostic_hw          = 0x1,
+	.top_debug_cfg_en              = 0x3,
+	.sensor_sel_shift              = 0x1,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_pix_reg_data = {
+	.sof_irq_mask                  = 0x4,
+	.eof_irq_mask                  = 0x8,
+	.subscribe_irq_mask            = 0xC,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi0_reg_data = {
+	.sof_irq_mask                  = 0x10,
+	.eof_irq_mask                  = 0x20,
+	.subscribe_irq_mask            = 0x30,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi1_reg_data = {
+	.sof_irq_mask                  = 0x40,
+	.eof_irq_mask                  = 0x80,
+	.subscribe_irq_mask            = 0xC0,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi2_reg_data = {
+	.sof_irq_mask                  = 0x100,
+	.eof_irq_mask                  = 0x200,
+	.subscribe_irq_mask            = 0x300,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi3_reg_data = {
+	.sof_irq_mask                  = 0x400,
+	.eof_irq_mask                  = 0x800,
+	.subscribe_irq_mask            = 0xC00,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi4_reg_data = {
+	.sof_irq_mask                  = 0x1000,
+	.eof_irq_mask                  = 0x2000,
+	.subscribe_irq_mask            = 0x3000,
+};
+
+static struct cam_sfe_top_hw_info sfe680_top_hw_info = {
+	.common_reg = &sfe680_top_commong_reg,
+	.modules_hw_info = &sfe680_modules_common_reg,
+	.common_reg_data = &sfe_680_top_common_reg_data,
+	.ipp_module_desc =  sfe_680_mod_desc,
+	.wr_client_desc  =  sfe_680_wr_client_desc,
+	.pix_reg_data    = &sfe_680_pix_reg_data,
+	.rdi_reg_data[0] = &sfe_680_rdi0_reg_data,
+	.rdi_reg_data[1] = &sfe_680_rdi1_reg_data,
+	.rdi_reg_data[2] = &sfe_680_rdi2_reg_data,
+	.rdi_reg_data[3] = &sfe_680_rdi3_reg_data,
+	.rdi_reg_data[4] = &sfe_680_rdi4_reg_data,
+	.num_inputs = 6,
+	.input_type = {
+		CAM_SFE_PIX_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+	},
+	.num_top_errors  = ARRAY_SIZE(sfe_680_top_irq_err_desc),
+	.top_err_desc    = sfe_680_top_irq_err_desc,
+	.num_clc_module  = 9,
+	.clc_dbg_mod_info = &sfe680_clc_dbg_module_info,
+};
+
+static struct cam_irq_register_set sfe680_bus_rd_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00000404,
+		.clear_reg_offset  = 0x00000408,
+		.status_reg_offset = 0x00000410,
+		.set_reg_offset    = 0x00000418,
+	},
+};
+
+static struct cam_sfe_bus_rd_constraint_error_desc
+	sfe680_bus_rd_cons_error_desc[CAM_SFE_BUS_RD_CONS_ERR_MAX] = {
+	{
+		.bitmask    = BIT(0),
+		.error_desc = "Image Addr Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(1),
+		.error_desc = "Ubwc Addr Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(2),
+		.error_desc = "Stride Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(3),
+		.error_desc = "Y Unit Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(4),
+		.error_desc = "X Unit Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(5),
+		.error_desc = "Image width Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(6),
+		.error_desc = "Image height Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(7),
+		.error_desc = "Meta Stride Unalign Latch",
+	},
+};
+
+static struct cam_sfe_bus_rd_constraint_error_info sfe680_bus_rd_constraint_error_info = {
+	.constraint_error_list = sfe680_bus_rd_cons_error_desc,
+	.num_cons_err          = 8,
+};
+
+static struct cam_sfe_bus_rd_hw_info sfe680_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00000400,
+		.misr_reset                   = 0x0000041C,
+		.pwr_iso_cfg                  = 0x00000424,
+		.input_if_cmd                 = 0x00000414,
+		.test_bus_ctrl                = 0x0000042C,
+		.security_cfg                 = 0x00000420,
+		.cons_violation_status        = 0x00000434,
+		.irq_reg_info = {
+			.num_registers = 1,
+			.irq_reg_set = sfe680_bus_rd_irq_reg,
+			.global_irq_cmd_offset = 0x0000040C,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+	},
+	.num_client = 3,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x00000450,
+			.image_addr               = 0x00000458,
+			.buf_width                = 0x0000045C,
+			.buf_height               = 0x00000460,
+			.stride                   = 0x00000464,
+			.unpacker_cfg             = 0x00000468,
+			.latency_buf_allocation   = 0x0000047C,
+			.system_cache_cfg         = 0x0000049C,
+			.debug_status_cfg         = 0x00000490,
+			.debug_status_0           = 0x00000494,
+			.debug_status_1           = 0x00000498,
+			.name                     = "Fetch0",
+		},
+		/* BUS Client 1 */
+		{
+			.cfg                      = 0x000004F0,
+			.image_addr               = 0x000004F8,
+			.buf_width                = 0x000004FC,
+			.buf_height               = 0x00000500,
+			.stride                   = 0x00000504,
+			.unpacker_cfg             = 0x00000508,
+			.latency_buf_allocation   = 0x0000051C,
+			.system_cache_cfg         = 0x0000053C,
+			.debug_status_cfg         = 0x00000530,
+			.debug_status_0           = 0x00000534,
+			.debug_status_1           = 0x00000538,
+			.name                     = "Fetch1",
+		},
+		/* BUS Client 2 */
+		{
+			.cfg                      = 0x00000590,
+			.image_addr               = 0x00000598,
+			.buf_width                = 0x0000059C,
+			.buf_height               = 0x000005A0,
+			.stride                   = 0x000005A4,
+			.unpacker_cfg             = 0x000005A8,
+			.latency_buf_allocation   = 0x000005BC,
+			.system_cache_cfg         = 0x000005DC,
+			.debug_status_cfg         = 0x000005D0,
+			.debug_status_0           = 0x000005D4,
+			.debug_status_1           = 0x000005D8,
+			.name                     = "Fetch2",
+		},
+	},
+	.num_bus_rd_resc = 3,
+	.sfe_bus_rd_info = {
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI0,
+			.mid[0] = 0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI1,
+			.mid[0] = 1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI2,
+			.mid[0] = 2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 0x1,
+	/*
+	 * Refer to CAMNOC HPG for the updated value for a given target
+	 * 48 OTs, 2 SFEs each with 3 RDs, 48 / 6 = 8
+	 * We can allocate 256 * 8 = 2048 bytes. 256 bytes being
+	 * the minimum
+	 */
+	.latency_buf_allocation = 2048,
+	.sys_cache_default_val  = 0x20,
+	.irq_err_mask           = 0x1,
+	.fs_sync_shift          = 0x5,
+	.constraint_error_info  = &sfe680_bus_rd_constraint_error_info,
+};
+
+static struct cam_sfe_bus_wr_constraint_error_desc
+	sfe680_bus_wr_cons_error_desc[CAM_SFE_BUS_CONS_ERR_MAX] = {
+	{
+		.bitmask = BIT(0),
+		.error_description = "PPC 1x1 input not supported"
+	},
+	{
+		.bitmask = BIT(1),
+		.error_description = "PPC 1x2 input not supported"
+	},
+	{
+		.bitmask = BIT(2),
+		.error_description = "PPC 2x1 input not supported"
+	},
+	{
+		.bitmask = BIT(3),
+		.error_description = "PPC 2x2 input not supported"
+	},
+	{
+		.bitmask = BIT(4),
+		.error_description = "Pack 8 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(5),
+		.error_description = "Pack 16 format not supported"
+	},
+	{
+		.bitmask = BIT(6),
+		.error_description = "Pack 32 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(7),
+		.error_description = "Pack 64 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(8),
+		.error_description = "Pack MIPI 20 format not supported"
+	},
+	{
+		.bitmask = BIT(9),
+		.error_description = "Pack MIPI 14 format not supported"
+	},
+	{
+		.bitmask = BIT(10),
+		.error_description = "Pack MIPI 12 format not supported"
+	},
+	{
+		.bitmask = BIT(11),
+		.error_description = "Pack MIPI 10 format not supported"
+	},
+	{
+		.bitmask = BIT(12),
+		.error_description = "Pack 128 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(13),
+		.error_description = "UBWC NV12 format not supported"
+	},
+	{
+		.bitmask = BIT(14),
+		.error_description = "UBWC NV12 4R format not supported"
+	},
+	{
+		.bitmask = BIT(15),
+		.error_description = "UBWC TP10 format not supported"
+	},
+	{
+		.bitmask = BIT(16),
+		.error_description = "Frame based Mode not supported"
+	},
+	{
+		.bitmask = BIT(17),
+		.error_description = "Index based Mode not supported"
+	},
+	{
+		.bitmask = BIT(18),
+		.error_description = "FIFO image addr unalign"
+	},
+	{
+		.bitmask = BIT(19),
+		.error_description = "FIFO ubwc addr unalign"
+	},
+	{
+		.bitmask = BIT(20),
+		.error_description = "FIFO frmheader addr unalign"
+	},
+	{
+		.bitmask = BIT(21),
+		.error_description = "Image address unalign"
+	},
+	{
+		.bitmask = BIT(22),
+		.error_description = "UBWC address unalign"
+	},
+	{
+		.bitmask = BIT(23),
+		.error_description = "Frame Header address unalign"
+	},
+	{
+		.bitmask = BIT(24),
+		.error_description = "Stride unalign"
+	},
+	{
+		.bitmask = BIT(25),
+		.error_description = "X Initialization unalign"
+	},
+	{
+		.bitmask = BIT(26),
+		.error_description = "Image Width unalign"
+	},
+	{
+		.bitmask = BIT(27),
+		.error_description = "Image Height unalign"
+	},
+	{
+		.bitmask = BIT(28),
+		.error_description = "Meta Stride unalign"
+	},
+};
+
+static struct cam_sfe_bus_wr_constraint_error_info sfe680_bus_wr_constraint_error_info = {
+	.constraint_error_list   = sfe680_bus_wr_cons_error_desc,
+	.num_cons_err            = 29,
+	.img_addr_unalign_shift  = 21,
+	.img_width_unalign_shift = 26,
+};
+
+static struct cam_irq_register_set sfe680_bus_wr_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00000818,
+		.clear_reg_offset  = 0x00000820,
+		.status_reg_offset = 0x00000828,
+		.set_reg_offset    = 0x00000850,
+	},
+};
+
+static struct cam_sfe_bus_wr_hw_info sfe680_bus_wr_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000800,
+		.cgc_ovd                          = 0x00000808,
+		.if_frameheader_cfg               = {
+			0x00000834,
+			0x00000838,
+			0x0000083C,
+			0x00000840,
+			0x00000844,
+			0x00000848,
+		},
+		.pwr_iso_cfg                      = 0x0000085C,
+		.overflow_status_clear            = 0x00000860,
+		.ccif_violation_status            = 0x00000864,
+		.overflow_status                  = 0x00000868,
+		.image_size_violation_status      = 0x00000870,
+		.debug_status_top_cfg             = 0x000008D4,
+		.debug_status_top                 = 0x000008D8,
+		.test_bus_ctrl                    = 0x000008DC,
+		.top_irq_mask_0                   = 0x00000020,
+		.irq_reg_info = {
+			.num_registers = 1,
+			.irq_reg_set = sfe680_bus_wr_irq_reg,
+			.global_irq_cmd_offset = 0x00000830,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+	},
+	.num_client = 13,
+	.bus_client_reg = {
+		/* BUS Client 0 REMOSAIC */
+		{
+			.cfg                      = 0x00000A00,
+			.image_addr               = 0x00000A04,
+			.frame_incr               = 0x00000A08,
+			.image_cfg_0              = 0x00000A0C,
+			.image_cfg_1              = 0x00000A10,
+			.image_cfg_2              = 0x00000A14,
+			.packer_cfg               = 0x00000A18,
+			.frame_header_addr        = 0x00000A20,
+			.frame_header_incr        = 0x00000A24,
+			.frame_header_cfg         = 0x00000A28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000A30,
+			.irq_subsample_pattern    = 0x00000A34,
+			.framedrop_period         = 0x00000A38,
+			.framedrop_pattern        = 0x00000A3C,
+			.system_cache_cfg         = 0x00000A68,
+			.addr_status_0            = 0x00000A70,
+			.addr_status_1            = 0x00000A74,
+			.addr_status_2            = 0x00000A78,
+			.addr_status_3            = 0x00000A7C,
+			.debug_status_cfg         = 0x00000A80,
+			.debug_status_0           = 0x00000A84,
+			.debug_status_1           = 0x00000A88,
+			.mmu_prefetch_cfg         = 0x00000A60,
+			.mmu_prefetch_max_offset  = 0x00000A64,
+			.bw_limiter_addr          = 0x00000A1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_0,
+		},
+		/* BUS Client 1 LCR */
+		{
+			.cfg                      = 0x00000B00,
+			.image_addr               = 0x00000B04,
+			.frame_incr               = 0x00000B08,
+			.image_cfg_0              = 0x00000B0C,
+			.image_cfg_1              = 0x00000B10,
+			.image_cfg_2              = 0x00000B14,
+			.packer_cfg               = 0x00000B18,
+			.frame_header_addr        = 0x00000B20,
+			.frame_header_incr        = 0x00000B24,
+			.frame_header_cfg         = 0x00000B28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000B30,
+			.irq_subsample_pattern    = 0x00000B34,
+			.framedrop_period         = 0x00000B38,
+			.framedrop_pattern        = 0x00000B3C,
+			.system_cache_cfg         = 0x00000B68,
+			.addr_status_0            = 0x00000B70,
+			.addr_status_1            = 0x00000B74,
+			.addr_status_2            = 0x00000B78,
+			.addr_status_3            = 0x00000B7C,
+			.debug_status_cfg         = 0x00000B80,
+			.debug_status_0           = 0x00000B84,
+			.debug_status_1           = 0x00000B88,
+			.mmu_prefetch_cfg         = 0x00000B60,
+			.mmu_prefetch_max_offset  = 0x00000B64,
+			.bw_limiter_addr          = 0x00000B1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_1,
+		},
+		/* BUS Client 2 STATS_BE_0 */
+		{
+			.cfg                      = 0x00000C00,
+			.image_addr               = 0x00000C04,
+			.frame_incr               = 0x00000C08,
+			.image_cfg_0              = 0x00000C0C,
+			.image_cfg_1              = 0x00000C10,
+			.image_cfg_2              = 0x00000C14,
+			.packer_cfg               = 0x00000C18,
+			.frame_header_addr        = 0x00000C20,
+			.frame_header_incr        = 0x00000C24,
+			.frame_header_cfg         = 0x00000C28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000C30,
+			.irq_subsample_pattern    = 0x00000C34,
+			.framedrop_period         = 0x00000C38,
+			.framedrop_pattern        = 0x00000C3C,
+			.system_cache_cfg         = 0x00000C68,
+			.addr_status_0            = 0x00000C70,
+			.addr_status_1            = 0x00000C74,
+			.addr_status_2            = 0x00000C78,
+			.addr_status_3            = 0x00000C7C,
+			.debug_status_cfg         = 0x00000C80,
+			.debug_status_0           = 0x00000C84,
+			.debug_status_1           = 0x00000C88,
+			.mmu_prefetch_cfg         = 0x00000C60,
+			.mmu_prefetch_max_offset  = 0x00000C64,
+			.bw_limiter_addr          = 0x00000C1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 3 STATS_BHIST_0 */
+		{
+			.cfg                      = 0x00000D00,
+			.image_addr               = 0x00000D04,
+			.frame_incr               = 0x00000D08,
+			.image_cfg_0              = 0x00000D0C,
+			.image_cfg_1              = 0x00000D10,
+			.image_cfg_2              = 0x00000D14,
+			.packer_cfg               = 0x00000D18,
+			.frame_header_addr        = 0x00000D20,
+			.frame_header_incr        = 0x00000D24,
+			.frame_header_cfg         = 0x00000D28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000D30,
+			.irq_subsample_pattern    = 0x00000D34,
+			.framedrop_period         = 0x00000D38,
+			.framedrop_pattern        = 0x00000D3C,
+			.system_cache_cfg         = 0x00000D68,
+			.addr_status_0            = 0x00000D70,
+			.addr_status_1            = 0x00000D74,
+			.addr_status_2            = 0x00000D78,
+			.addr_status_3            = 0x00000D7C,
+			.debug_status_cfg         = 0x00000D80,
+			.debug_status_0           = 0x00000D84,
+			.debug_status_1           = 0x00000D88,
+			.mmu_prefetch_cfg         = 0x00000D60,
+			.mmu_prefetch_max_offset  = 0x00000D64,
+			.bw_limiter_addr          = 0x00000D1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 4 STATS_BE_1 */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.frame_header_addr        = 0x00000E20,
+			.frame_header_incr        = 0x00000E24,
+			.frame_header_cfg         = 0x00000E28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_status_0            = 0x00000E70,
+			.addr_status_1            = 0x00000E74,
+			.addr_status_2            = 0x00000E78,
+			.addr_status_3            = 0x00000E7C,
+			.debug_status_cfg         = 0x00000E80,
+			.debug_status_0           = 0x00000E84,
+			.debug_status_1           = 0x00000E88,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.bw_limiter_addr          = 0x00000E1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 5 STATS_BHIST_1 */
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_status_0            = 0x00000F70,
+			.addr_status_1            = 0x00000F74,
+			.addr_status_2            = 0x00000F78,
+			.addr_status_3            = 0x00000F7C,
+			.debug_status_cfg         = 0x00000F80,
+			.debug_status_0           = 0x00000F84,
+			.debug_status_1           = 0x00000F88,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.bw_limiter_addr          = 0x00000F1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 6 STATS_BE_2 */
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.frame_header_addr        = 0x00001020,
+			.frame_header_incr        = 0x00001024,
+			.frame_header_cfg         = 0x00001028,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.system_cache_cfg         = 0x00001068,
+			.addr_status_0            = 0x00001070,
+			.addr_status_1            = 0x00001074,
+			.addr_status_2            = 0x00001078,
+			.addr_status_3            = 0x0000107C,
+			.debug_status_cfg         = 0x00001080,
+			.debug_status_0           = 0x00001084,
+			.debug_status_1           = 0x00001088,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.bw_limiter_addr          = 0x0000101C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 7 STATS_BHIST_2 */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.frame_header_addr        = 0x00001120,
+			.frame_header_incr        = 0x00001124,
+			.frame_header_cfg         = 0x00001128,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.system_cache_cfg         = 0x00001168,
+			.addr_status_0            = 0x00001170,
+			.addr_status_1            = 0x00001174,
+			.addr_status_2            = 0x00001178,
+			.addr_status_3            = 0x0000117C,
+			.debug_status_cfg         = 0x00001180,
+			.debug_status_0           = 0x00001184,
+			.debug_status_1           = 0x00001188,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.bw_limiter_addr          = 0x0000111C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 8 RDI0 */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.line_done_cfg            = 0x0000122C,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.system_cache_cfg         = 0x00001268,
+			.addr_status_0            = 0x00001270,
+			.addr_status_1            = 0x00001274,
+			.addr_status_2            = 0x00001278,
+			.addr_status_3            = 0x0000127C,
+			.debug_status_cfg         = 0x00001280,
+			.debug_status_0           = 0x00001284,
+			.debug_status_1           = 0x00001288,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.bw_limiter_addr          = 0x0000121C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_5,
+		},
+		/* BUS Client 9 RDI1 */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.line_done_cfg            = 0x0000132C,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.system_cache_cfg         = 0x00001368,
+			.addr_status_0            = 0x00001370,
+			.addr_status_1            = 0x00001374,
+			.addr_status_2            = 0x00001378,
+			.addr_status_3            = 0x0000137C,
+			.debug_status_cfg         = 0x00001380,
+			.debug_status_0           = 0x00001384,
+			.debug_status_1           = 0x00001388,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.bw_limiter_addr          = 0x0000131C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_6,
+		},
+		/* BUS Client 10 RDI2 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.line_done_cfg            = 0x0000142C,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.system_cache_cfg         = 0x00001468,
+			.addr_status_0            = 0x00001470,
+			.addr_status_1            = 0x00001474,
+			.addr_status_2            = 0x00001478,
+			.addr_status_3            = 0x0000147C,
+			.debug_status_cfg         = 0x00001480,
+			.debug_status_0           = 0x00001484,
+			.debug_status_1           = 0x00001488,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.bw_limiter_addr          = 0x0000141C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_7,
+		},
+		/* BUS Client 11 RDI3 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.line_done_cfg            = 0x0000152C,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.system_cache_cfg         = 0x00001568,
+			.addr_status_0            = 0x00001570,
+			.addr_status_1            = 0x00001574,
+			.addr_status_2            = 0x00001578,
+			.addr_status_3            = 0x0000157C,
+			.debug_status_cfg         = 0x00001580,
+			.debug_status_0           = 0x00001584,
+			.debug_status_1           = 0x00001588,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.bw_limiter_addr          = 0x0000151C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_8,
+		},
+		/* BUS Client 12 RDI4 */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.line_done_cfg            = 0x0000162C,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.system_cache_cfg         = 0x00001668,
+			.addr_status_0            = 0x00001670,
+			.addr_status_1            = 0x00001674,
+			.addr_status_2            = 0x00001678,
+			.addr_status_3            = 0x0000167C,
+			.debug_status_cfg         = 0x00001680,
+			.debug_status_0           = 0x00001684,
+			.debug_status_1           = 0x00001688,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.bw_limiter_addr          = 0x0000161C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_9,
+		},
+	},
+	.num_out = 13,
+	.sfe_out_hw_info = {
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_1,
+			.mid[0]        = 25,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 8,
+			.en_line_done  = 1,
+			.name          = "RDI_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_2,
+			.mid[0]        = 26,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 9,
+			.en_line_done  = 1,
+			.name          = "RDI_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_3,
+			.mid[0]        = 27,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 10,
+			.en_line_done  = 1,
+			.name          = "RDI_2",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_4,
+			.mid[0]        = 28,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 11,
+			.name          = "RDI_3",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI4,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_4,
+			.mid[0]        = 29,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 12,
+			.name          = "RDI_4",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RAW_DUMP,
+			.max_width     = 9312,
+			.max_height    = 6992,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 16,
+			.mid[1]        = 17,
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = 0,
+			.name          = "REMOSIAC",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_LCR,
+			.max_width     = 9312,
+			.max_height    = 2048,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 18,
+			.num_wm        = 1,
+			.wm_idx        = 1,
+			.name          = "LCR",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 19,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 2,
+			.name          = "STATS_BE_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 20,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 3,
+			.name          = "STATS_BHIST_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 21,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 4,
+			.name          = "STATS_BE_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 22,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 5,
+			.name          = "STATS_BHIST_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 23,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 6,
+			.name          = "STATS_BE_2",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 24,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 7,
+			.name          = "STATS_BHIST_2",
+		},
+	},
+	.constraint_error_info = &sfe680_bus_wr_constraint_error_info,
+	.comp_done_mask = {
+		BIT(17), BIT(18), BIT(19), BIT(20), BIT(21), BIT(22), BIT(23),
+		BIT(24), BIT(25), BIT(26),
+	},
+	.num_comp_grp          = 10,
+	.line_done_cfg         = 0x11,
+	.top_irq_shift         = 0x0,
+	.max_out_res           = CAM_ISP_SFE_OUT_RES_BASE + 13,
+	.pack_align_shift      = 0x5,
+	.max_bw_counter_limit  = 0xFF,
+	.sys_cache_default_val = 0x20,
+	.irq_err_mask          = 0xD0000000,
+};
+
+static struct cam_irq_register_set sfe680_top_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000020,
+		.clear_reg_offset  = 0x00000024,
+		.status_reg_offset = 0x00000028,
+		.set_reg_offset    = 0x0000002C,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+};
+
+static struct cam_irq_controller_reg_info sfe680_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = sfe680_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x0000001C,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+struct cam_sfe_hw_info cam_sfe680_hw_info = {
+	.irq_reg_info                  = &sfe680_top_irq_reg_info,
+
+	.bus_wr_version                = CAM_SFE_BUS_WR_VER_1_0,
+	.bus_wr_hw_info                = &sfe680_bus_wr_hw_info,
+
+	.bus_rd_version                = CAM_SFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &sfe680_bus_rd_hw_info,
+
+	.top_version                   = CAM_SFE_TOP_VER_1_0,
+	.top_hw_info                   = &sfe680_top_hw_info,
+};
+
+#endif /* _CAM_SFE680_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe780.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe780.h
@@ -0,0 +1,1768 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE780_H_
+#define _CAM_SFE780_H_
+#include "cam_sfe_core.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+#include "cam_sfe_bus_wr.h"
+
+static struct cam_sfe_top_module_desc sfe_780_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CRC_IRC",
+	},
+	{
+		.id = 1,
+		.desc = "CRC_ZSL",
+	},
+	{
+		.id = 2,
+		.desc = "COMP",
+	},
+	{
+		.id = 3,
+		.desc = "LINE_SMOOTH",
+	},
+	{
+		.id = 4,
+		.desc = "CRC_PREV",
+	},
+	{
+		.id = 5,
+		.desc = "HDRC",
+	},
+	{
+		.id = 6,
+		.desc = "DECOMP",
+	},
+	{
+		.id = 7,
+		.desc = "BPC_PDPC",
+	},
+	{
+		.id = 8,
+		.desc = "PDPC_BPC_ID_CH0",
+	},
+	{
+		.id = 9,
+		.desc = "RS_CH0",
+	},
+	{
+		.id = 10,
+		.desc = "BHIST_CH0",
+	},
+	{
+		.id = 11,
+		.desc = "BG_CH0",
+	},
+	{
+		.id = 12,
+		.desc = "LSC_CH0",
+	},
+	{
+		.id = 13,
+		.desc = "CRC_CH0",
+	},
+	{
+		.id = 14,
+		.desc = "CCIF_2x2_2x1",
+	},
+	{
+		.id = 15,
+		.desc = "GAIN_CH0",
+	},
+	{
+		.id = 16,
+		.desc = "PDPC_BPC_ID_CH1",
+	},
+	{
+		.id = 17,
+		.desc = "RS_CH1",
+	},
+	{
+		.id = 18,
+		.desc = "BHIST_CH1",
+	},
+	{
+		.id = 19,
+		.desc = "BG_CH1",
+	},
+	{
+		.id = 20,
+		.desc = "LSC_CH1",
+	},
+	{
+		.id = 21,
+		.desc = "CRC_CH1",
+	},
+	{
+		.id = 22,
+		.desc = "GAIN_CH1",
+	},
+	{
+		.id = 23,
+		.desc = "PDPC_BPC_ID_CH2",
+	},
+	{
+		.id = 24,
+		.desc = "RS_CH2",
+	},
+	{
+		.id = 25,
+		.desc = "BHIST_CH2",
+	},
+	{
+		.id = 26,
+		.desc = "BG_CH2",
+	},
+	{
+		.id = 27,
+		.desc = "LSC_CH2",
+	},
+	{
+		.id = 28,
+		.desc = "CRC_CH2",
+	},
+	{
+		.id = 29,
+		.desc = "GAIN_CH2",
+	},
+	{
+		.id = 30,
+		.desc = "XCFA_DEMUX",
+	},
+};
+
+static struct cam_sfe_wr_client_desc sfe_780_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "REMOSAIC",
+	},
+	{
+		.wm_id = 1,
+		.desc = "IR_OUT",
+	},
+	{
+		.wm_id = 2,
+		.desc = "STATS_BE0",
+	},
+	{
+		.wm_id = 3,
+		.desc = "STATS_BHIST0",
+	},
+	{
+		.wm_id = 4,
+		.desc = "STATS_BE1",
+	},
+	{ 	.wm_id = 5,
+		.desc = "STATS_BHIST1",
+	},
+	{
+		.wm_id = 6,
+		.desc = "STATS_BE2",
+	},
+	{
+		.wm_id = 7,
+		.desc = "STATS_BHIST2",
+	},
+	{
+		.wm_id = 8,
+		.desc = "STATS_RS0",
+	},
+	{
+		.wm_id = 9,
+		.desc = "STATS_RS1",
+	},
+	{
+		.wm_id = 10,
+		.desc = "STATS_RS2",
+	},
+	{
+		.wm_id = 11,
+		.desc = "RDI_0",
+	},
+	{
+		.wm_id = 12,
+		.desc = "RDI_1",
+	},
+	{
+		.wm_id = 13,
+		.desc = "RDI_2",
+	},
+	{
+		.wm_id = 14,
+		.desc = "RDI_3",
+	},
+	{
+		.wm_id = 15,
+		.desc = "RDI_4",
+	},
+};
+
+static struct cam_sfe_top_cc_testbus_info
+		sfe780_testbus1_info[] = {
+	{
+		.mask = BIT(0),
+		.shift = 0,
+		.clc_name = "sw_xcfa_mode_sel",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 1,
+		.clc_name = "bus_rd_line_done_rdi2",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 2,
+		.clc_name = "bus_rd_line_done_rdi1",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 3,
+		.clc_name = "bus_rd_line_done_rdi0",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 4,
+		.clc_name = "down_count_flag",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 5,
+		.clc_name = "rdi2_upcount_flag",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 6,
+		.clc_name = "rdi1_upcount_flag",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 7,
+		.clc_name = "rdi0_upcount_flag",
+	},
+	{
+		.mask = BIT(0) | BIT(1),
+		.shift = 8,
+		.clc_name = "rdi2_meta_pkts",
+	},
+	{
+		.mask = BIT(0) | BIT(1),
+		.shift = 10,
+		.clc_name = "rdi1_meta_pkts",
+	},
+	{
+		.mask = BIT(0) | BIT(1),
+		.shift = 12,
+		.clc_name = "rdi0_meta_pkts",
+	},
+	{
+		.mask = BIT(1) | BIT(2) | BIT(3),
+		.shift = 14,
+		.clc_name = "i_rdi2_sample",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 18,
+		.clc_name = "i_rdi2_vld",
+	},
+	{
+		.mask = BIT(0) | BIT(1) | BIT(2) | BIT(3),
+		.shift = 19,
+		.clc_name = "i_rdi1_sample",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 23,
+		.clc_name = "i_rdi1_vld",
+	},
+	{
+		.mask = BIT(1) | BIT(2) | BIT(3),
+		.shift = 24,
+		.clc_name = "i_rdi0_sample",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 28,
+		.clc_name = "i_rdi0_vl",
+	},
+};
+
+static struct cam_sfe_top_cc_testbus_info
+		sfe780_testbus2_info[] = {
+	{
+		.mask = BIT(0),
+		.shift = 0,
+		.clc_name = "meta_consumed_ipp",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 1,
+		.clc_name = "meta_consumed_bus_rd",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 2,
+		.clc_name = "o_rdi0_overflow_rdy",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 3,
+		.clc_name = "sw_single_dual_en",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 4,
+		.clc_name = "rd_rup_cond",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 5,
+		.clc_name = "bus_rd_rdy",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 6,
+		.clc_name = "next_state",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 7,
+		.clc_name = "curr_state",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 8,
+		.clc_name = "xcfa_mode_cpy",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 9,
+		.clc_name = "rd_kick_off_cond",
+	},
+};
+
+static struct cam_sfe_mode sfe_780_mode[] = {
+	{
+		.value = 0x0,
+		.desc = "QCFA HDR/non-HDR mode",
+	},
+	{
+		.value = 0x1,
+		.desc = "sHDR 1exp mode",
+	},
+	{
+		.value = 0x2,
+		.desc = "sHDR 2exp mode",
+	},
+	{
+		.value = 0x3,
+		.desc = "sHDR 3exp mode",
+	},
+	{
+		.value = 0x4,
+		.desc = "Bayer offline mode",
+	},
+	{
+		.value = 0x5,
+		.desc = "Bayer FS mode",
+	},
+};
+
+static struct cam_sfe_top_err_irq_desc sfe_780_top_irq_err_desc[] = {
+	{
+		.bitmask = BIT(14),
+		.err_name = "PP_VIOLATION",
+		.desc = "CCIF protocol violation within any of the modules in pixel pipeline",
+	},
+	{
+		.bitmask = BIT(15),
+		.err_name = "DIAG_VIOLATION",
+		.desc = "HBI is less than the minimum required HBI",
+	},
+	{
+		.bitmask = BIT(17),
+		.err_name = "CONTEXT_CONTROLLER_VIOLATION",
+		.desc = "HW detects that there is third context entering SFE core",
+	},
+	{
+		.bitmask = BIT(18),
+		.err_name = "CONTEXT_CONTROLLER_SWITCH_VIOLATION",
+		.desc = "The old context is not completed processing inside SFE.",
+	},
+};
+
+static struct cam_sfe_top_debug_info
+	sfe780_clc_dbg_module_info[CAM_SFE_TOP_DBG_REG_MAX][8] = {
+	SFE_DBG_INFO_ARRAY_4bit(
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"irc_throttle",
+		"crc_irc",
+		"zsl_throttle",
+		"crc_zsl",
+		"comp",
+		"ls",
+		"crc_prev",
+		"hdrc_ch2"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"hdrc_ch1",
+		"hdrc_ch0",
+		"bayer_rs_0",
+		"stats_bhist_ch0",
+		"stats_bg_ch0",
+		"lsc_ch0",
+		"crc_ch0",
+		"bpc_pdpc_id"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"2x2_2x1_ch0",
+		"decomp_ch0",
+		"msb_align_ch0",
+		"bpc_pdpc_ch0",
+		"ch_gain_ch0",
+		"bayer_rs_ch1",
+		"stats_bhist_ch1",
+		"stats_bg_ch1"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"lsc_ch1",
+		"crc_ch1",
+		"msb_align_ch1",
+		"bpc_pdpc_1d_ch1",
+		"ch_gain_ch1",
+		"bayer_rs_ch2",
+		"stats_bhist_ch2",
+		"stats_bg_ch2"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"lsc_ch2",
+		"crc_ch2",
+		"msb_align_ch2",
+		"bpc_pdpc_1d_ch2",
+		"ch_gain_ch2",
+		"demux_ch2",
+		"demux_ch1",
+		"demux_ch0"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"sfe_demux_pp",
+		"sfe_rdi4",
+		"sfe_rdi3",
+		"sfe_rdi2",
+		"sfe_rdi1",
+		"sfe_rdi0",
+		"bayer_rs_ch2",
+		"stats_bhist_ch2"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"sfe_stats_bg_ch2",
+		"sfe_bayer_rs_ch1",
+		"sfe_stats_bhist_ch1",
+		"sfe_stats_bg_ch1",
+		"sfe_bayer_rs_ch0",
+		"sfe_stats_bhist_ch0",
+		"sfe_stats_bg_ch0",
+		"sfe_irc"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"sfe_zsl",
+		"sfe_throttle",
+		"sfe_pp_zsl",
+		"sfe_conv_ch12",
+		"sfe_conv_ch1",
+		"sfe_conv_ch0",
+		"sfe_fe_ch2",
+		"sfe_fe_ch1"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"sfe_fe_ch0",
+		"sfe_fe_ch0",
+		"sfe_fe_ch0",
+		"sfe_fe_ch0",
+		"sfe_fe_ch0",
+		"sfe_fe_ch0",
+		"sfe_fe_ch0",
+		"sfe_fe_ch0"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"rdi4",
+		"rdi3",
+		"rdi2",
+		"rdi1",
+		"rdi0",
+		"pixel",
+		"reserved",
+		"reserved"
+	),
+};
+
+static struct cam_sfe_top_common_reg_offset  sfe780_top_commong_reg  = {
+	.hw_version                    = 0x00000000,
+	.hw_capability                 = 0x00000004,
+	.stats_feature                 = 0x00000008,
+	.core_cgc_ctrl                 = 0x00000010,
+	.ahb_clk_ovd                   = 0x00000014,
+	.core_cfg                      = 0x000000CC,
+	.ipp_violation_status          = 0x00000030,
+	.diag_config                   = 0x00000034,
+	.diag_sensor_status_0          = 0x00000038,
+	.diag_sensor_status_1          = 0x0000003C,
+	.diag_sensor_frame_cnt_status0 = 0x00000040,
+	.diag_sensor_frame_cnt_status1 = 0x00000044,
+	.stats_ch2_throttle_cfg        = 0x000000B0,
+	.stats_ch1_throttle_cfg        = 0x000000B4,
+	.stats_ch0_throttle_cfg        = 0x000000B8,
+	.hdr_throttle_cfg              = 0x000000C0,
+	.sfe_op_throttle_cfg           = 0x000000C4,
+	.irc_throttle_cfg              = 0x000000C8,
+	.sfe_single_dual_cfg           = 0x000000D0,
+	.bus_overflow_status           = 0x00000868,
+	.num_perf_counters             = 2,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg        = 0x00000080,
+			.perf_pix_count        = 0x00000084,
+			.perf_line_count       = 0x00000088,
+			.perf_stall_count      = 0x0000008C,
+			.perf_always_count     = 0x00000090,
+			.perf_count_status     = 0x00000094,
+		},
+		{
+			.perf_count_cfg        = 0x00000098,
+			.perf_pix_count        = 0x0000009C,
+			.perf_line_count       = 0x000000A0,
+			.perf_stall_count      = 0x000000A4,
+			.perf_always_count     = 0x000000A8,
+			.perf_count_status     = 0x000000AC,
+		},
+	},
+	.top_debug_cfg                 = 0x0000007C,
+	.top_cc_test_bus_ctrl          = 0x000001F0,
+	.lcr_supported                 = false,
+	.ir_supported                  = true,
+	.qcfa_only                     = false,
+	.num_sfe_mode                  = ARRAY_SIZE(sfe_780_mode),
+	.sfe_mode                      = sfe_780_mode,
+	.ipp_violation_mask            = 0x4000,
+	.top_debug_testbus_reg         = 11,
+	.top_cc_test_bus_supported     = true,
+	.num_debug_registers           = 18,
+	.top_debug = {
+		0x0000004C,
+		0x00000050,
+		0x00000054,
+		0x00000058,
+		0x0000005C,
+		0x00000060,
+		0x00000064,
+		0x00000068,
+		0x0000006C,
+		0x00000070,
+		0x00000074,
+		0x00000078,
+		0x000000D4,
+		0x000000D8,
+		0x000000DC,
+		0x000000E0,
+		0x000000E4,
+		0x000000E8,
+	},
+};
+
+static struct cam_sfe_modules_common_reg_offset sfe780_modules_common_reg = {
+	.demux_module_cfg              = 0x00003060,
+	.demux_xcfa_cfg                = 0x00003064,
+	.demux_hdr_cfg                 = 0x00003074,
+	.hdrc_remo_mod_cfg             = 0x00005860,
+	.xcfa_hdrc_remo_out_mux_cfg    = 0x00005A74,
+	.hdrc_remo_xcfa_bin_cfg        = 0x00005A78,
+};
+
+static struct cam_sfe_top_common_reg_data sfe_780_top_common_reg_data = {
+	.error_irq_mask                = 0x6C000,
+	.enable_diagnostic_hw          = 0x1,
+	.top_debug_cfg_en              = 0x3,
+	.sensor_sel_shift              = 0x1,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_780_pix_reg_data = {
+	.sof_irq_mask                  = 0x4,
+	.eof_irq_mask                  = 0x8,
+	.subscribe_irq_mask            = 0xC,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_780_rdi0_reg_data = {
+	.sof_irq_mask                  = 0x10,
+	.eof_irq_mask                  = 0x20,
+	.subscribe_irq_mask            = 0x30,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_780_rdi1_reg_data = {
+	.sof_irq_mask                  = 0x40,
+	.eof_irq_mask                  = 0x80,
+	.subscribe_irq_mask            = 0xC0,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_780_rdi2_reg_data = {
+	.sof_irq_mask                  = 0x100,
+	.eof_irq_mask                  = 0x200,
+	.subscribe_irq_mask            = 0x300,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_780_rdi3_reg_data = {
+	.sof_irq_mask                  = 0x400,
+	.eof_irq_mask                  = 0x800,
+	.subscribe_irq_mask            = 0xC00,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_780_rdi4_reg_data = {
+	.sof_irq_mask                  = 0x1000,
+	.eof_irq_mask                  = 0x2000,
+	.subscribe_irq_mask            = 0x3000,
+};
+
+static struct cam_sfe_top_hw_info sfe780_top_hw_info = {
+	.common_reg = &sfe780_top_commong_reg,
+	.modules_hw_info = &sfe780_modules_common_reg,
+	.common_reg_data = &sfe_780_top_common_reg_data,
+	.ipp_module_desc =  sfe_780_mod_desc,
+	.wr_client_desc  =  sfe_780_wr_client_desc,
+	.pix_reg_data    = &sfe_780_pix_reg_data,
+	.rdi_reg_data[0] = &sfe_780_rdi0_reg_data,
+	.rdi_reg_data[1] = &sfe_780_rdi1_reg_data,
+	.rdi_reg_data[2] = &sfe_780_rdi2_reg_data,
+	.rdi_reg_data[3] = &sfe_780_rdi3_reg_data,
+	.rdi_reg_data[4] = &sfe_780_rdi4_reg_data,
+	.num_inputs = 6,
+	.input_type = {
+		CAM_SFE_PIX_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+	},
+	.num_top_errors  = ARRAY_SIZE(sfe_780_top_irq_err_desc),
+	.top_err_desc    = sfe_780_top_irq_err_desc,
+	.num_clc_module  = 11,
+	.clc_dbg_mod_info = &sfe780_clc_dbg_module_info,
+	.num_of_testbus = 2,
+	.test_bus_info = {
+		/* TEST BUS 1 INFO */
+		{
+			.debugfs_val  = SFE_DEBUG_ENABLE_TESTBUS1,
+			.enable       = false,
+			.value        = 0x1,
+			.size         = ARRAY_SIZE(sfe780_testbus1_info),
+			.testbus      = sfe780_testbus1_info,
+		},
+		/* TEST BUS 2 INFO */
+		{
+			.debugfs_val  = SFE_DEBUG_ENABLE_TESTBUS2,
+			.enable       = false,
+			.value        = 0x3,
+			.size         = ARRAY_SIZE(sfe780_testbus2_info),
+			.testbus      = sfe780_testbus2_info,
+		},
+	},
+};
+
+static struct cam_irq_register_set sfe780_bus_rd_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00000404,
+		.clear_reg_offset  = 0x00000408,
+		.status_reg_offset = 0x00000410,
+		.set_reg_offset    = 0x00000418,
+	},
+};
+
+static struct cam_sfe_bus_rd_err_irq_desc sfe780_bus_rd_irq_err_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.err_name = "INFO_CONS_VIOLATION",
+		.desc = "Clients have illegal programming, check CONS_VIOLATION_STATUS",
+	},
+	{
+		.bitmask = BIT(31),
+		.err_name = "INFO_CCIF_VIOLATION",
+	},
+};
+
+static struct cam_sfe_bus_rd_constraint_error_desc
+	sfe780_bus_rd_cons_error_desc[CAM_SFE_BUS_RD_CONS_ERR_MAX] = {
+	{
+		.bitmask    = BIT(0),
+		.error_desc = "Image Addr Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(1),
+		.error_desc = "Ubwc Addr Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(2),
+		.error_desc = "Stride Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(3),
+		.error_desc = "Y Unit Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(4),
+		.error_desc = "X Unit Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(5),
+		.error_desc = "Image width Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(6),
+		.error_desc = "Image height Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(7),
+		.error_desc = "Meta Stride Unalign Latch",
+	},
+};
+
+static struct cam_sfe_bus_rd_constraint_error_info sfe780_bus_rd_constraint_error_info = {
+	.constraint_error_list = sfe780_bus_rd_cons_error_desc,
+	.num_cons_err          = 8,
+};
+
+static struct cam_sfe_bus_rd_hw_info sfe780_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00000400,
+		.misr_reset                   = 0x0000041C,
+		.pwr_iso_cfg                  = 0x00000424,
+		.input_if_cmd                 = 0x00000414,
+		.test_bus_ctrl                = 0x0000042C,
+		.security_cfg                 = 0x00000420,
+		.cons_violation_status        = 0x00000434,
+		.irq_reg_info = {
+			.num_registers = 1,
+			.irq_reg_set = sfe780_bus_rd_irq_reg,
+			.global_irq_cmd_offset = 0x0000040C,
+			.global_clear_bitmask  = 0x00000001,
+		},
+	},
+	.num_client = 3,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x00000450,
+			.image_addr               = 0x00000458,
+			.buf_width                = 0x0000045C,
+			.buf_height               = 0x00000460,
+			.stride                   = 0x00000464,
+			.unpacker_cfg             = 0x00000468,
+			.latency_buf_allocation   = 0x0000047C,
+			.system_cache_cfg         = 0x0000049C,
+			.addr_cfg                 = 0x000004A4,
+			.debug_status_cfg         = 0x00000490,
+			.debug_status_0           = 0x00000494,
+			.debug_status_1           = 0x00000498,
+			.name                     = "Fetch0",
+		},
+		/* BUS Client 1 */
+		{
+			.cfg                      = 0x000004F0,
+			.image_addr               = 0x000004F8,
+			.buf_width                = 0x000004FC,
+			.buf_height               = 0x00000500,
+			.stride                   = 0x00000504,
+			.unpacker_cfg             = 0x00000508,
+			.latency_buf_allocation   = 0x0000051C,
+			.system_cache_cfg         = 0x0000053C,
+			.addr_cfg                 = 0x00000544,
+			.debug_status_cfg         = 0x00000530,
+			.debug_status_0           = 0x00000534,
+			.debug_status_1           = 0x00000538,
+			.name                     = "Fetch1",
+		},
+		/* BUS Client 2 */
+		{
+			.cfg                      = 0x00000590,
+			.image_addr               = 0x00000598,
+			.buf_width                = 0x0000059C,
+			.buf_height               = 0x000005A0,
+			.stride                   = 0x000005A4,
+			.unpacker_cfg             = 0x000005A8,
+			.latency_buf_allocation   = 0x000005BC,
+			.system_cache_cfg         = 0x000005DC,
+			.addr_cfg                 = 0x000005E4,
+			.debug_status_cfg         = 0x000005D0,
+			.debug_status_0           = 0x000005D4,
+			.debug_status_1           = 0x000005D8,
+			.name                     = "Fetch2",
+		},
+	},
+	.num_bus_rd_resc = 3,
+	.sfe_bus_rd_info = {
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI0,
+			.mid[0] = 0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI1,
+			.mid[0] = 1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI2,
+			.mid[0] = 2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.num_bus_rd_errors     = ARRAY_SIZE(sfe780_bus_rd_irq_err_desc),
+	.bus_rd_err_desc       = sfe780_bus_rd_irq_err_desc,
+	.top_irq_shift          = 0x1,
+	.latency_buf_allocation = 2048,
+	.sys_cache_default_val  = 0x20,
+	.irq_err_mask           = 0x1,
+	.fs_sync_shift          = 0x5,
+	.constraint_error_info  = &sfe780_bus_rd_constraint_error_info,
+};
+
+static struct cam_sfe_bus_wr_err_irq_desc sfe780_bus_wr_irq_err_desc[] = {
+	{
+		.bitmask = BIT(26),
+		.err_name = "IPCC_FENCE_DATA_ERR",
+		.desc = "IPCC or FENCE Data was not available in the Input Fifo",
+	},
+	{
+		.bitmask = BIT(27),
+		.err_name = "IPCC_FENCE_ADDR_ERR",
+		.desc = "IPCC or FENCE address fifo was empty and read was attempted",
+	},
+	{
+		.bitmask = BIT(28),
+		.err_name = "CONS_VIOLATION",
+		.desc = "Programming of software registers violated the constraints",
+	},
+	{
+		.bitmask = BIT(30),
+		.err_name = "VIOLATION",
+		.desc = "Client has a violation in ccif protocol at input",
+	},
+	{
+		.bitmask = BIT(31),
+		.err_name = "IMAGE_SIZE_VIOLATION",
+		.desc = "Programmed image size is not same as image size from the CCIF",
+	},
+};
+
+static struct cam_sfe_bus_wr_constraint_error_desc
+	sfe780_bus_wr_cons_error_desc[CAM_SFE_BUS_CONS_ERR_MAX] = {
+	{
+		.bitmask = BIT(0),
+		.error_description = "PPC 1x1 input not supported"
+	},
+	{
+		.bitmask = BIT(1),
+		.error_description = "PPC 1x2 input not supported"
+	},
+	{
+		.bitmask = BIT(2),
+		.error_description = "PPC 2x1 input not supported"
+	},
+	{
+		.bitmask = BIT(3),
+		.error_description = "PPC 2x2 input not supported"
+	},
+	{
+		.bitmask = BIT(4),
+		.error_description = "Pack 8 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(5),
+		.error_description = "Pack 16 format not supported"
+	},
+	{
+		.bitmask = BIT(6),
+		.error_description = "Pack 32 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(7),
+		.error_description = "Pack 64 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(8),
+		.error_description = "Pack MIPI 20 format not supported"
+	},
+	{
+		.bitmask = BIT(9),
+		.error_description = "Pack MIPI 14 format not supported"
+	},
+	{
+		.bitmask = BIT(10),
+		.error_description = "Pack MIPI 12 format not supported"
+	},
+	{
+		.bitmask = BIT(11),
+		.error_description = "Pack MIPI 10 format not supported"
+	},
+	{
+		.bitmask = BIT(12),
+		.error_description = "Pack 128 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(13),
+		.error_description = "UBWC NV12 format not supported"
+	},
+	{
+		.bitmask = BIT(14),
+		.error_description = "UBWC NV12 4R format not supported"
+	},
+	{
+		.bitmask = BIT(15),
+		.error_description = "UBWC TP10 format not supported"
+	},
+	{
+		.bitmask = BIT(16),
+		.error_description = "Frame based Mode not supported"
+	},
+	{
+		.bitmask = BIT(17),
+		.error_description = "Index based Mode not supported"
+	},
+	{
+		.bitmask = BIT(18),
+		.error_description = "FIFO image addr unalign"
+	},
+	{
+		.bitmask = BIT(19),
+		.error_description = "FIFO ubwc addr unalign"
+	},
+	{
+		.bitmask = BIT(20),
+		.error_description = "FIFO frmheader addr unalign"
+	},
+	{
+		.bitmask = BIT(21),
+		.error_description = "Image address unalign"
+	},
+	{
+		.bitmask = BIT(22),
+		.error_description = "UBWC address unalign"
+	},
+	{
+		.bitmask = BIT(23),
+		.error_description = "Frame Header address unalign"
+	},
+	{
+		.bitmask = BIT(24),
+		.error_description = "Stride unalign"
+	},
+	{
+		.bitmask = BIT(25),
+		.error_description = "X Initialization unalign"
+	},
+	{
+		.bitmask = BIT(26),
+		.error_description = "Image Width unalign"
+	},
+	{
+		.bitmask = BIT(27),
+		.error_description = "Image Height unalign"
+	},
+	{
+		.bitmask = BIT(28),
+		.error_description = "Meta Stride unalign"
+	},
+};
+
+static struct cam_sfe_bus_wr_constraint_error_info sfe780_bus_wr_constraint_error_info = {
+	.constraint_error_list   = sfe780_bus_wr_cons_error_desc,
+	.num_cons_err            = 29,
+	.img_addr_unalign_shift  = 21,
+	.img_width_unalign_shift = 26,
+};
+
+static struct cam_irq_register_set sfe780_bus_wr_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00000818,
+		.clear_reg_offset  = 0x00000820,
+		.status_reg_offset = 0x00000828,
+		.set_reg_offset    = 0x00000850,
+	},
+};
+
+static struct cam_sfe_bus_wr_hw_info sfe780_bus_wr_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000800,
+		.cgc_ovd                          = 0x00000808,
+		.if_frameheader_cfg               = {
+			0x00000834,
+			0x00000838,
+			0x0000083C,
+			0x00000840,
+			0x00000844,
+			0x00000848,
+		},
+		.pwr_iso_cfg                      = 0x0000085C,
+		.overflow_status_clear            = 0x00000860,
+		.ccif_violation_status            = 0x00000864,
+		.overflow_status                  = 0x00000868,
+		.image_size_violation_status      = 0x00000870,
+		.debug_status_top_cfg             = 0x000008D4,
+		.debug_status_top                 = 0x000008D8,
+		.test_bus_ctrl                    = 0x000008DC,
+		.top_irq_mask_0                   = 0x00000020,
+		.irq_reg_info = {
+			.num_registers = 1,
+			.irq_reg_set = sfe780_bus_wr_irq_reg,
+			.global_irq_cmd_offset = 0x00000830,
+			.global_clear_bitmask  = 0x00000001,
+		},
+	},
+	.num_client = 16,
+	.bus_client_reg = {
+		/* BUS Client 0 REMOSAIC */
+		{
+			.cfg                      = 0x00000A00,
+			.image_addr               = 0x00000A04,
+			.frame_incr               = 0x00000A08,
+			.image_cfg_0              = 0x00000A0C,
+			.image_cfg_1              = 0x00000A10,
+			.image_cfg_2              = 0x00000A14,
+			.packer_cfg               = 0x00000A18,
+			.frame_header_addr        = 0x00000A20,
+			.frame_header_incr        = 0x00000A24,
+			.frame_header_cfg         = 0x00000A28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000A30,
+			.irq_subsample_pattern    = 0x00000A34,
+			.framedrop_period         = 0x00000A38,
+			.framedrop_pattern        = 0x00000A3C,
+			.system_cache_cfg         = 0x00000A68,
+			.addr_cfg                 = 0x00000A70,
+			.addr_status_0            = 0x00000A74,
+			.addr_status_1            = 0x00000A78,
+			.addr_status_2            = 0x00000A7C,
+			.addr_status_3            = 0x00000A80,
+			.debug_status_cfg         = 0x00000A84,
+			.debug_status_0           = 0x00000A88,
+			.debug_status_1           = 0x00000A8C,
+			.mmu_prefetch_cfg         = 0x00000A60,
+			.mmu_prefetch_max_offset  = 0x00000A64,
+			.bw_limiter_addr          = 0x00000A1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_0,
+		},
+		/* BUS Client 1 IR OUT */
+		{
+			.cfg                      = 0x00000B00,
+			.image_addr               = 0x00000B04,
+			.frame_incr               = 0x00000B08,
+			.image_cfg_0              = 0x00000B0C,
+			.image_cfg_1              = 0x00000B10,
+			.image_cfg_2              = 0x00000B14,
+			.packer_cfg               = 0x00000B18,
+			.frame_header_addr        = 0x00000B20,
+			.frame_header_incr        = 0x00000B24,
+			.frame_header_cfg         = 0x00000B28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000B30,
+			.irq_subsample_pattern    = 0x00000B34,
+			.framedrop_period         = 0x00000B38,
+			.framedrop_pattern        = 0x00000B3C,
+			.system_cache_cfg         = 0x00000B68,
+			.addr_cfg                 = 0x00000B70,
+			.addr_status_0            = 0x00000B74,
+			.addr_status_1            = 0x00000B78,
+			.addr_status_2            = 0x00000B7C,
+			.addr_status_3            = 0x00000B80,
+			.debug_status_cfg         = 0x00000B84,
+			.debug_status_0           = 0x00000B88,
+			.debug_status_1           = 0x00000B8C,
+			.mmu_prefetch_cfg         = 0x00000B60,
+			.mmu_prefetch_max_offset  = 0x00000B64,
+			.bw_limiter_addr          = 0x00000B1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_1,
+		},
+		/* BUS Client 2 STATS_BE_0 */
+		{
+			.cfg                      = 0x00000C00,
+			.image_addr               = 0x00000C04,
+			.frame_incr               = 0x00000C08,
+			.image_cfg_0              = 0x00000C0C,
+			.image_cfg_1              = 0x00000C10,
+			.image_cfg_2              = 0x00000C14,
+			.packer_cfg               = 0x00000C18,
+			.frame_header_addr        = 0x00000C20,
+			.frame_header_incr        = 0x00000C24,
+			.frame_header_cfg         = 0x00000C28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000C30,
+			.irq_subsample_pattern    = 0x00000C34,
+			.framedrop_period         = 0x00000C38,
+			.framedrop_pattern        = 0x00000C3C,
+			.system_cache_cfg         = 0x00000C68,
+			.addr_cfg                 = 0x00000C70,
+			.addr_status_0            = 0x00000C74,
+			.addr_status_1            = 0x00000C78,
+			.addr_status_2            = 0x00000C7C,
+			.addr_status_3            = 0x00000C80,
+			.debug_status_cfg         = 0x00000C84,
+			.debug_status_0           = 0x00000C88,
+			.debug_status_1           = 0x00000C8C,
+			.mmu_prefetch_cfg         = 0x00000C60,
+			.mmu_prefetch_max_offset  = 0x00000C64,
+			.bw_limiter_addr          = 0x00000C1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 3 STATS_BHIST_0 */
+		{
+			.cfg                      = 0x00000D00,
+			.image_addr               = 0x00000D04,
+			.frame_incr               = 0x00000D08,
+			.image_cfg_0              = 0x00000D0C,
+			.image_cfg_1              = 0x00000D10,
+			.image_cfg_2              = 0x00000D14,
+			.packer_cfg               = 0x00000D18,
+			.frame_header_addr        = 0x00000D20,
+			.frame_header_incr        = 0x00000D24,
+			.frame_header_cfg         = 0x00000D28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000D30,
+			.irq_subsample_pattern    = 0x00000D34,
+			.framedrop_period         = 0x00000D38,
+			.framedrop_pattern        = 0x00000D3C,
+			.system_cache_cfg         = 0x00000D68,
+			.addr_cfg                 = 0x00000D70,
+			.addr_status_0            = 0x00000D74,
+			.addr_status_1            = 0x00000D78,
+			.addr_status_2            = 0x00000D7C,
+			.addr_status_3            = 0x00000D80,
+			.debug_status_cfg         = 0x00000D84,
+			.debug_status_0           = 0x00000D88,
+			.debug_status_1           = 0x00000D8C,
+			.mmu_prefetch_cfg         = 0x00000D60,
+			.mmu_prefetch_max_offset  = 0x00000D64,
+			.bw_limiter_addr          = 0x00000D1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 4 STATS_BE_1 */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.frame_header_addr        = 0x00000E20,
+			.frame_header_incr        = 0x00000E24,
+			.frame_header_cfg         = 0x00000E28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_cfg                 = 0x00000E70,
+			.addr_status_0            = 0x00000E74,
+			.addr_status_1            = 0x00000E78,
+			.addr_status_2            = 0x00000E7C,
+			.addr_status_3            = 0x00000E80,
+			.debug_status_cfg         = 0x00000E84,
+			.debug_status_0           = 0x00000E88,
+			.debug_status_1           = 0x00000E8C,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.bw_limiter_addr          = 0x00000E1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 5 STATS_BHIST_1 */
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_cfg                 = 0x00000F70,
+			.addr_status_0            = 0x00000F74,
+			.addr_status_1            = 0x00000F78,
+			.addr_status_2            = 0x00000F7C,
+			.addr_status_3            = 0x00000F80,
+			.debug_status_cfg         = 0x00000F84,
+			.debug_status_0           = 0x00000F88,
+			.debug_status_1           = 0x00000F8C,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.bw_limiter_addr          = 0x00000F1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 6 STATS_BE_2 */
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.frame_header_addr        = 0x00001020,
+			.frame_header_incr        = 0x00001024,
+			.frame_header_cfg         = 0x00001028,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.system_cache_cfg         = 0x00001068,
+			.addr_cfg                 = 0x00001070,
+			.addr_status_0            = 0x00001074,
+			.addr_status_1            = 0x00001078,
+			.addr_status_2            = 0x0000107C,
+			.addr_status_3            = 0x00001080,
+			.debug_status_cfg         = 0x00001084,
+			.debug_status_0           = 0x00001088,
+			.debug_status_1           = 0x0000108C,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.bw_limiter_addr          = 0x0000101C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 7 STATS_BHIST_2 */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.frame_header_addr        = 0x00001120,
+			.frame_header_incr        = 0x00001124,
+			.frame_header_cfg         = 0x00001128,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.system_cache_cfg         = 0x00001168,
+			.addr_cfg                 = 0x00001170,
+			.addr_status_0            = 0x00001174,
+			.addr_status_1            = 0x00001178,
+			.addr_status_2            = 0x0000117C,
+			.addr_status_3            = 0x00001180,
+			.debug_status_cfg         = 0x00001184,
+			.debug_status_0           = 0x00001188,
+			.debug_status_1           = 0x0000118C,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.bw_limiter_addr          = 0x0000111C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 8 STATS_RS_0 */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.system_cache_cfg         = 0x00001268,
+			.addr_cfg                 = 0x00001270,
+			.addr_status_0            = 0x00001274,
+			.addr_status_1            = 0x00001278,
+			.addr_status_2            = 0x0000127C,
+			.addr_status_3            = 0x00001280,
+			.debug_status_cfg         = 0x00001284,
+			.debug_status_0           = 0x00001288,
+			.debug_status_1           = 0x0000128C,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.bw_limiter_addr          = 0x0000121C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 9 STATS_RS_1 */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.system_cache_cfg         = 0x00001368,
+			.addr_cfg                 = 0x00001370,
+			.addr_status_0            = 0x00001374,
+			.addr_status_1            = 0x00001378,
+			.addr_status_2            = 0x0000137C,
+			.addr_status_3            = 0x00001380,
+			.debug_status_cfg         = 0x00001384,
+			.debug_status_0           = 0x00001388,
+			.debug_status_1           = 0x0000138C,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.bw_limiter_addr          = 0x0000131C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 10 STATS_RS_2 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.system_cache_cfg         = 0x00001468,
+			.addr_cfg                 = 0x00001470,
+			.addr_status_0            = 0x00001474,
+			.addr_status_1            = 0x00001478,
+			.addr_status_2            = 0x0000147C,
+			.addr_status_3            = 0x00001480,
+			.debug_status_cfg         = 0x00001484,
+			.debug_status_0           = 0x00001488,
+			.debug_status_1           = 0x0000148C,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.bw_limiter_addr          = 0x0000141C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 11 RDI0 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.line_done_cfg            = 0x0000152C,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.system_cache_cfg         = 0x00001568,
+			.addr_cfg                 = 0x00001570,
+			.addr_status_0            = 0x00001574,
+			.addr_status_1            = 0x00001578,
+			.addr_status_2            = 0x0000157C,
+			.addr_status_3            = 0x00001580,
+			.debug_status_cfg         = 0x00001584,
+			.debug_status_0           = 0x00001588,
+			.debug_status_1           = 0x0000158C,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.bw_limiter_addr          = 0x0000151C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_5,
+		},
+		/* BUS Client 12 RDI1 */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.line_done_cfg            = 0x0000162C,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.system_cache_cfg         = 0x00001668,
+			.addr_cfg                 = 0x00001670,
+			.addr_status_0            = 0x00001674,
+			.addr_status_1            = 0x00001678,
+			.addr_status_2            = 0x0000167C,
+			.addr_status_3            = 0x00001680,
+			.debug_status_cfg         = 0x00001684,
+			.debug_status_0           = 0x00001688,
+			.debug_status_1           = 0x0000168C,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.bw_limiter_addr          = 0x0000161C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_6,
+		},
+		/* BUS Client 13 RDI2 */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.frame_header_addr        = 0x00001720,
+			.frame_header_incr        = 0x00001724,
+			.frame_header_cfg         = 0x00001728,
+			.line_done_cfg            = 0x0000172C,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.system_cache_cfg         = 0x00001768,
+			.addr_cfg                 = 0x00001770,
+			.addr_status_0            = 0x00001774,
+			.addr_status_1            = 0x00001778,
+			.addr_status_2            = 0x0000177C,
+			.addr_status_3            = 0x00001780,
+			.debug_status_cfg         = 0x00001784,
+			.debug_status_0           = 0x00001788,
+			.debug_status_1           = 0x0000178C,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.bw_limiter_addr          = 0x0000171C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_7,
+		},
+		/* BUS Client 14 RDI3 */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.line_done_cfg            = 0x0000182C,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.framedrop_period         = 0x00001838,
+			.framedrop_pattern        = 0x0000183C,
+			.system_cache_cfg         = 0x00001868,
+			.addr_cfg                 = 0x00001870,
+			.addr_status_0            = 0x00001874,
+			.addr_status_1            = 0x00001878,
+			.addr_status_2            = 0x0000187C,
+			.addr_status_3            = 0x00001880,
+			.debug_status_cfg         = 0x00001884,
+			.debug_status_0           = 0x00001888,
+			.debug_status_1           = 0x0000188C,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.bw_limiter_addr          = 0x0000181C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_8,
+		},
+		/* BUS Client 15 RDI4 */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.line_done_cfg            = 0x0000192C,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.framedrop_period         = 0x00001938,
+			.framedrop_pattern        = 0x0000193C,
+			.system_cache_cfg         = 0x00001968,
+			.addr_cfg                 = 0x00001970,
+			.addr_status_0            = 0x00001974,
+			.addr_status_1            = 0x00001978,
+			.addr_status_2            = 0x0000197C,
+			.addr_status_3            = 0x00001980,
+			.debug_status_cfg         = 0x00001984,
+			.debug_status_0           = 0x00001988,
+			.debug_status_1           = 0x0000198C,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.bw_limiter_addr          = 0x0000191C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_9,
+		},
+	},
+	.num_out = 16,
+	.sfe_out_hw_info = {
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_1,
+			.mid[0]        = 45,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 11,
+			.en_line_done  = 1,
+			.name          = "RDI_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_2,
+			.mid[0]        = 46,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 12,
+			.en_line_done  = 1,
+			.name          = "RDI_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_3,
+			.mid[0]        = 47,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 13,
+			.en_line_done  = 1,
+			.name          = "RDI_2",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_4,
+			.mid[0]        = 48,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 14,
+			.name          = "RDI_3",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI4,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_5,
+			.mid[0]        = 49,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 15,
+			.name          = "RDI_4",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RAW_DUMP,
+			.max_width     = 9312,
+			.max_height    = 6992,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 32,
+			.mid[1]        = 33,
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = 0,
+			.name          = "REMOSIAC",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_IR,
+			.max_width     = 9312,
+			.max_height    = 6772,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 34,
+			.mid[1]        = 35,
+			.num_wm        = 1,
+			.wm_idx        = 1,
+			.name          = "IR_OUT",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 36,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 2,
+			.name          = "STATS_BE_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 37,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 3,
+			.name          = "STATS_BHIST_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 38,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 4,
+			.name          = "STATS_BE_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 39,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 5,
+			.name          = "STATS_BHIST_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 40,
+			.num_wm        = 1,
+			.wm_idx        = 6,
+			.name          = "STATS_BE_2",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 41,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 7,
+			.name          = "STATS_BHIST_2",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BAYER_RS_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 42,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 8,
+			.name          = "STATS_RS_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BAYER_RS_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 43,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 9,
+			.name          = "STATS_RS_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BAYER_RS_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 44,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 10,
+			.name          = "STATS_RS_2",
+		},
+	},
+	.constraint_error_info = &sfe780_bus_wr_constraint_error_info,
+	.num_bus_wr_errors     = ARRAY_SIZE(sfe780_bus_wr_irq_err_desc),
+	.bus_wr_err_desc       = sfe780_bus_wr_irq_err_desc,
+	.comp_done_mask = {
+		BIT(17), BIT(18), BIT(19), BIT(20), BIT(21), BIT(22), BIT(23),
+		BIT(24), BIT(25), BIT(26),
+	},
+	.num_comp_grp              = 10,
+	.line_done_cfg             = 0x11,
+	.top_irq_shift             = 0x0,
+	.max_out_res               = CAM_ISP_SFE_OUT_RES_BASE + 17,
+	.pack_align_shift          = 5,
+	.max_bw_counter_limit      = 0xFF,
+	.sys_cache_default_val     = 0x20,
+	.irq_err_mask              = 0xD0000000,
+};
+
+static struct cam_irq_register_set sfe780_top_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000020,
+		.clear_reg_offset  = 0x00000024,
+		.status_reg_offset = 0x00000028,
+		.set_reg_offset    = 0x0000002C,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+};
+
+static struct cam_irq_controller_reg_info sfe780_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = sfe780_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x0000001C,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+struct cam_sfe_hw_info cam_sfe780_hw_info = {
+	.irq_reg_info                  = &sfe780_top_irq_reg_info,
+
+	.bus_wr_version                = CAM_SFE_BUS_WR_VER_1_0,
+	.bus_wr_hw_info                = &sfe780_bus_wr_hw_info,
+
+	.bus_rd_version                = CAM_SFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &sfe780_bus_rd_hw_info,
+
+	.top_version                   = CAM_SFE_TOP_VER_1_0,
+	.top_hw_info                   = &sfe780_top_hw_info,
+};
+
+#endif /* _CAM_SFE780_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe860.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe860.h
@@ -0,0 +1,149 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE860_H_
+#define _CAM_SFE860_H_
+#include "cam_sfe_core.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+#include "cam_sfe_bus_wr.h"
+#include "cam_sfe880.h"
+
+static struct cam_sfe_top_common_reg_offset  sfe860_top_commong_reg  = {
+	.hw_version                    = 0x00000000,
+	.hw_capability                 = 0x00000004,
+	.stats_feature                 = 0x00000008,
+	.core_cgc_ctrl                 = 0x00000010,
+	.ahb_clk_ovd                   = 0x00000014,
+	.core_cfg                      = 0x000000CC,
+	.ipp_violation_status          = 0x00000030,
+	.diag_config                   = 0x00000034,
+	.diag_sensor_status_0          = 0x00000038,
+	.diag_sensor_status_1          = 0x0000003C,
+	.diag_sensor_frame_cnt_status0 = 0x00000040,
+	.diag_sensor_frame_cnt_status1 = 0x00000044,
+	.stats_ch2_throttle_cfg        = 0x000000B0,
+	.stats_ch1_throttle_cfg        = 0x000000B4,
+	.stats_ch0_throttle_cfg        = 0x000000B8,
+	.hdr_throttle_cfg              = 0x000000C0,
+	.sfe_op_throttle_cfg           = 0x000000C4,
+	.irc_throttle_cfg              = 0x000000C8,
+	.sfe_single_dual_cfg           = 0x000000D0,
+	.bus_overflow_status           = 0x00000868,
+	.num_perf_counters             = 2,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg        = 0x00000080,
+			.perf_pix_count        = 0x00000084,
+			.perf_line_count       = 0x00000088,
+			.perf_stall_count      = 0x0000008C,
+			.perf_always_count     = 0x00000090,
+			.perf_count_status     = 0x00000094,
+		},
+		{
+			.perf_count_cfg        = 0x00000098,
+			.perf_pix_count        = 0x0000009C,
+			.perf_line_count       = 0x000000A0,
+			.perf_stall_count      = 0x000000A4,
+			.perf_always_count     = 0x000000A8,
+			.perf_count_status     = 0x000000AC,
+		},
+	},
+	.top_debug_cfg                  = 0x0000007C,
+	.top_cc_test_bus_ctrl           = 0x000001F0,
+	.lcr_supported                  = false,
+	.ir_supported                   = true,
+	.qcfa_only                      = false,
+	.num_sfe_mode                   = ARRAY_SIZE(sfe_880_mode),
+	.sfe_mode                       = sfe_880_mode,
+	.ipp_violation_mask             = 0x4000,
+	.top_debug_testbus_reg          = 13,
+	.top_debug_nonccif_regstart_idx = 12,
+	.top_cc_test_bus_supported      = true,
+	.num_debug_registers            = 20,
+	.top_debug = {
+		0x0000004C,
+		0x00000050,
+		0x00000054,
+		0x00000058,
+		0x0000005C,
+		0x00000060,
+		0x00000064,
+		0x00000068,
+		0x0000006C,
+		0x00000070,
+		0x00000074,
+		0x00000078,
+		0x000000EC,
+		0x000000F0,
+		0x000000F4,
+		0x000000F8,
+		0x000000FC,
+		0x00000100,
+		0x00000104,
+		0x00000108,
+	},
+};
+
+static struct cam_sfe_top_hw_info sfe860_top_hw_info = {
+	.common_reg = &sfe860_top_commong_reg,
+	.modules_hw_info = &sfe880_modules_common_reg,
+	.common_reg_data = &sfe_880_top_common_reg_data,
+	.ipp_module_desc =  sfe_880_mod_desc,
+	.wr_client_desc  =  sfe_880_wr_client_desc,
+	.pix_reg_data    = &sfe_880_pix_reg_data,
+	.rdi_reg_data[0] = &sfe_880_rdi0_reg_data,
+	.rdi_reg_data[1] = &sfe_880_rdi1_reg_data,
+	.rdi_reg_data[2] = &sfe_880_rdi2_reg_data,
+	.rdi_reg_data[3] = &sfe_880_rdi3_reg_data,
+	.rdi_reg_data[4] = &sfe_880_rdi4_reg_data,
+	.num_inputs = 6,
+	.input_type = {
+		CAM_SFE_PIX_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+	},
+	.num_top_errors  = ARRAY_SIZE(sfe_880_top_irq_err_desc),
+	.top_err_desc    = sfe_880_top_irq_err_desc,
+	.num_clc_module  = 12,
+	.clc_dbg_mod_info = &sfe880_clc_dbg_module_info,
+	.num_of_testbus = 2,
+	.test_bus_info = {
+		/* TEST BUS 1 INFO */
+		{
+			.debugfs_val  = SFE_DEBUG_ENABLE_TESTBUS1,
+			.enable       = false,
+			.value        = 0x1,
+			.size         = ARRAY_SIZE(sfe880_testbus1_info),
+			.testbus      = sfe880_testbus1_info,
+		},
+		/* TEST BUS 2 INFO */
+		{
+			.debugfs_val  = SFE_DEBUG_ENABLE_TESTBUS2,
+			.enable       = false,
+			.value        = 0x3,
+			.size         = ARRAY_SIZE(sfe880_testbus2_info),
+			.testbus      = sfe880_testbus2_info,
+		},
+	},
+};
+
+struct cam_sfe_hw_info cam_sfe860_hw_info = {
+	.irq_reg_info                  = &sfe880_top_irq_reg_info,
+
+	.bus_wr_version                = CAM_SFE_BUS_WR_VER_1_0,
+	.bus_wr_hw_info                = &sfe880_bus_wr_hw_info,
+
+	.bus_rd_version                = CAM_SFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &sfe880_bus_rd_hw_info,
+
+	.top_version                   = CAM_SFE_TOP_VER_1_0,
+	.top_hw_info                   = &sfe860_top_hw_info,
+};
+
+#endif /* _CAM_SFE860_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe880.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe880.h
@@ -0,0 +1,1877 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE880_H_
+#define _CAM_SFE880_H_
+#include "cam_sfe_core.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+#include "cam_sfe_bus_wr.h"
+
+static struct cam_sfe_top_module_desc sfe_880_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CRC_IRC",
+	},
+	{
+		.id = 1,
+		.desc = "CRC_ZSL",
+	},
+	{
+		.id = 2,
+		.desc = "COMP",
+	},
+	{
+		.id = 3,
+		.desc = "LINE_SMOOTH",
+	},
+	{
+		.id = 4,
+		.desc = "CRC_PREV",
+	},
+	{
+		.id = 5,
+		.desc = "HDRC",
+	},
+	{
+		.id = 6,
+		.desc = "DECOMP",
+	},
+	{
+		.id = 7,
+		.desc = "BPC_PDPC",
+	},
+	{
+		.id = 8,
+		.desc = "PDPC_BPC_ID_CH0",
+	},
+	{
+		.id = 9,
+		.desc = "RS_CH0",
+	},
+	{
+		.id = 10,
+		.desc = "BHIST_CH0",
+	},
+	{
+		.id = 11,
+		.desc = "BG_CH0",
+	},
+	{
+		.id = 12,
+		.desc = "LSC_CH0",
+	},
+	{
+		.id = 13,
+		.desc = "CRC_CH0",
+	},
+	{
+		.id = 14,
+		.desc = "CCIF_2x2_2x1",
+	},
+	{
+		.id = 15,
+		.desc = "GAIN_CH0",
+	},
+	{
+		.id = 16,
+		.desc = "PDPC_BPC_ID_CH1",
+	},
+	{
+		.id = 17,
+		.desc = "RS_CH1",
+	},
+	{
+		.id = 18,
+		.desc = "BHIST_CH1",
+	},
+	{
+		.id = 19,
+		.desc = "BG_CH1",
+	},
+	{
+		.id = 20,
+		.desc = "LSC_CH1",
+	},
+	{
+		.id = 21,
+		.desc = "CRC_CH1",
+	},
+	{
+		.id = 22,
+		.desc = "GAIN_CH1",
+	},
+	{
+		.id = 23,
+		.desc = "PDPC_BPC_ID_CH2",
+	},
+	{
+		.id = 24,
+		.desc = "RS_CH2",
+	},
+	{
+		.id = 25,
+		.desc = "BHIST_CH2",
+	},
+	{
+		.id = 26,
+		.desc = "BG_CH2",
+	},
+	{
+		.id = 27,
+		.desc = "LSC_CH2",
+	},
+	{
+		.id = 28,
+		.desc = "CRC_CH2",
+	},
+	{
+		.id = 29,
+		.desc = "GAIN_CH2",
+	},
+	{
+		.id = 30,
+		.desc = "XCFA_DEMUX",
+	},
+	{
+		.id = 31,
+		.desc = "fcg_stats_ch2",
+	},
+	{
+		.id = 32,
+		.desc = "fcg_stats_ch1",
+	},
+	{
+		.id = 33,
+		.desc = "fcg_ch2",
+	},
+	{
+		.id = 34,
+		.desc = "fcg_ch1",
+	},
+	{
+		.id = 35,
+		.desc = "crc_hdr_stats",
+	},
+};
+
+static struct cam_sfe_wr_client_desc sfe_880_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "REMOSAIC",
+	},
+	{
+		.wm_id = 1,
+		.desc = "IR_OUT",
+	},
+	{
+		.wm_id = 2,
+		.desc = "STATS_BE0",
+	},
+	{
+		.wm_id = 3,
+		.desc = "STATS_BHIST0",
+	},
+	{
+		.wm_id = 4,
+		.desc = "STATS_BE1",
+	},
+	{	.wm_id = 5,
+		.desc = "STATS_BHIST1",
+	},
+	{
+		.wm_id = 6,
+		.desc = "STATS_BE2",
+	},
+	{
+		.wm_id = 7,
+		.desc = "STATS_BHIST2",
+	},
+	{
+		.wm_id = 8,
+		.desc = "STATS_RS0",
+	},
+	{
+		.wm_id = 9,
+		.desc = "STATS_RS1",
+	},
+	{
+		.wm_id = 10,
+		.desc = "STATS_RS2",
+	},
+	{
+		.wm_id = 11,
+		.desc = "RDI_0",
+	},
+	{
+		.wm_id = 12,
+		.desc = "RDI_1",
+	},
+	{
+		.wm_id = 13,
+		.desc = "RDI_2",
+	},
+	{
+		.wm_id = 14,
+		.desc = "RDI_3",
+	},
+	{
+		.wm_id = 15,
+		.desc = "RDI_4",
+	},
+	{
+		.wm_id = 16,
+		.desc = "HDR_STATS"
+	},
+};
+
+static struct cam_sfe_top_cc_testbus_info
+		sfe880_testbus1_info[] = {
+	{
+		.mask = BIT(0),
+		.shift = 0,
+		.clc_name = "sw_xcfa_mode_sel",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 1,
+		.clc_name = "bus_rd_line_done_rdi2",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 2,
+		.clc_name = "bus_rd_line_done_rdi1",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 3,
+		.clc_name = "bus_rd_line_done_rdi0",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 4,
+		.clc_name = "down_count_flag",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 5,
+		.clc_name = "rdi2_upcount_flag",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 6,
+		.clc_name = "rdi1_upcount_flag",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 7,
+		.clc_name = "rdi0_upcount_flag",
+	},
+	{
+		.mask = BIT(0) | BIT(1),
+		.shift = 8,
+		.clc_name = "rdi2_meta_pkts",
+	},
+	{
+		.mask = BIT(0) | BIT(1),
+		.shift = 10,
+		.clc_name = "rdi1_meta_pkts",
+	},
+	{
+		.mask = BIT(0) | BIT(1),
+		.shift = 12,
+		.clc_name = "rdi0_meta_pkts",
+	},
+	{
+		.mask = BIT(1) | BIT(2) | BIT(3),
+		.shift = 14,
+		.clc_name = "i_rdi2_sample",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 18,
+		.clc_name = "i_rdi2_vld",
+	},
+	{
+		.mask = BIT(0) | BIT(1) | BIT(2) | BIT(3),
+		.shift = 19,
+		.clc_name = "i_rdi1_sample",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 23,
+		.clc_name = "i_rdi1_vld",
+	},
+	{
+		.mask = BIT(1) | BIT(2) | BIT(3),
+		.shift = 24,
+		.clc_name = "i_rdi0_sample",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 28,
+		.clc_name = "i_rdi0_vld",
+	},
+};
+
+static struct cam_sfe_top_cc_testbus_info
+		sfe880_testbus2_info[] = {
+	{
+		.mask = BIT(0),
+		.shift = 0,
+		.clc_name = "meta_consumed_ipp",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 1,
+		.clc_name = "meta_consumed_bus_rd",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 2,
+		.clc_name = "o_rdi0_overflow_rdy",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 3,
+		.clc_name = "sw_single_dual_en",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 4,
+		.clc_name = "rd_rup_cond",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 5,
+		.clc_name = "bus_rd_rdy",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 6,
+		.clc_name = "next_state",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 7,
+		.clc_name = "curr_state",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 8,
+		.clc_name = "xcfa_mode_cpy",
+	},
+	{
+		.mask = BIT(0),
+		.shift = 9,
+		.clc_name = "rd_kick_off_cond",
+	},
+};
+
+static struct cam_sfe_mode sfe_880_mode[] = {
+	{
+		.value = 0x0,
+		.desc = "QCFA HDR/non-HDR mode",
+	},
+	{
+		.value = 0x1,
+		.desc = "sHDR 1exp mode",
+	},
+	{
+		.value = 0x2,
+		.desc = "sHDR 2exp mode",
+	},
+	{
+		.value = 0x3,
+		.desc = "sHDR 3exp mode",
+	},
+	{
+		.value = 0x4,
+		.desc = "Bayer offline mode",
+	},
+	{
+		.value = 0x5,
+		.desc = "Bayer FS mode",
+	},
+};
+
+static struct cam_sfe_top_err_irq_desc sfe_880_top_irq_err_desc[] = {
+	{
+		.bitmask = BIT(14),
+		.err_name = "PP_VIOLATION",
+		.desc = "CCIF protocol violation within any of the modules in pixel pipeline",
+	},
+	{
+		.bitmask = BIT(15),
+		.err_name = "DIAG_VIOLATION",
+		.desc = "HBI is less than the minimum required HBI",
+	},
+	{
+		.bitmask = BIT(17),
+		.err_name = "CONTEXT_CONTROLLER_VIOLATION",
+		.desc = "HW detects that there is third context entering SFE core",
+	},
+	{
+		.bitmask = BIT(18),
+		.err_name = "CONTEXT_CONTROLLER_SWITCH_VIOLATION",
+		.desc = "The old context is not completed processing inside SFE.",
+	},
+};
+
+static struct cam_sfe_top_debug_info
+	sfe880_clc_dbg_module_info[CAM_SFE_TOP_DBG_REG_MAX][8] = {
+	SFE_DBG_INFO_ARRAY_4bit(
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"irc_throttle",
+		"crop_rnd_clamp_ir",
+		"zsl_throttle",
+		"crop_rnd_clamp_zsl",
+		"compdecomp_zsl",
+		"line_smooth",
+		"crop_rnd_clamp_prev",
+		"xcfa_hdrc_remo_ip2"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"xcfa_hdrc_remo_ip1",
+		"xcfa_hdrc_remo_ip0",
+		"stats_rs_ch0",
+		"stats_bhist_ch0",
+		"stats_awb_bg_ch0",
+		"lsc_ch0",
+		"crop_rnd_clamp_ch0",
+		"1d_pdpc_ch0"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"clc_2x2_2x1",
+		"compdecomp_prev",
+		"msb_align_ch0",
+		"xcfa_bpc_pdpc",
+		"channel_gains_ch0",
+		"stats_rs_ch1",
+		"stats_bhist_ch1",
+		"stats_awb_bg_ch1"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"lsc_ch1",
+		"crop_rnd_clamp_ch1",
+		"msb_align_ch1",
+		"1d_pdpc_ch1",
+		"channel_gains_ch1",
+		"stats_rs_ch2",
+		"stats_bhist_ch2",
+		"stats_awb_bg_ch2"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"lsc_ch2",
+		"crop_rnd_clamp_ch2",
+		"msb_align_ch2",
+		"1d_pdpc_ch2",
+		"channel_gains_ch2",
+		"xcfa_demux_fetch2",
+		"xcfa_demux_fetch1",
+		"xcfa_demux_fetch0"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"xcfa_demux_csid",
+		"sfe_hdr_stats_throttle",
+		"fcg_stats_ch2",
+		"fcg_stats_ch1",
+		"fcg_ch2",
+		"fcg_ch1",
+		"crop_rnd_clamp_hdr_stats",
+		"stats_rs_ch0_throttler"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"stats_bhist_ch0_throttler",
+		"stats_bg_ch0_throttler",
+		"stats_rs_ch1_throttler",
+		"stats_bhist_ch1_throttler",
+		"stats_bg_ch1_throttler",
+		"stats_rs_ch2_throttler",
+		"stats_bhist_ch2_throttler",
+		"stats_bg_ch2_throttler"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"sfe_rdi4",
+		"sfe_rdi3",
+		"sfe_rdi2",
+		"sfe_rdi1",
+		"sfe_rdi0",
+		"stats_rs2",
+		"stats_bhist2",
+		"stats_be2"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"stats_rs1",
+		"stats_bhist1",
+		"stats_be1",
+		"stats_rs0",
+		"stats_bhist0",
+		"stats_be0",
+		"ir_out",
+		"remosaic"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"hdr_stats",
+		"sfe_op_throttler",
+		"sfe_pp_zsl",
+		"ccif_sample_width_conv_hdr_remo",
+		"ccif_converter_ch2",
+		"ccif_converter_ch1",
+		"ccif_converter_ch0",
+		"fetch2"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"fetch1",
+		"fetch0",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved"
+	),
+};
+
+static struct cam_sfe_top_common_reg_offset  sfe880_top_commong_reg  = {
+	.hw_version                    = 0x00000000,
+	.hw_capability                 = 0x00000004,
+	.stats_feature                 = 0x00000008,
+	.core_cgc_ctrl                 = 0x00000010,
+	.ahb_clk_ovd                   = 0x00000014,
+	.core_cfg                      = 0x000000CC,
+	.ipp_violation_status          = 0x00000030,
+	.diag_config                   = 0x00000034,
+	.diag_sensor_status_0          = 0x00000038,
+	.diag_sensor_status_1          = 0x0000003C,
+	.diag_sensor_frame_cnt_status0 = 0x00000040,
+	.diag_sensor_frame_cnt_status1 = 0x00000044,
+	.stats_ch2_throttle_cfg        = 0x000000B0,
+	.stats_ch1_throttle_cfg        = 0x000000B4,
+	.stats_ch0_throttle_cfg        = 0x000000B8,
+	.hdr_throttle_cfg              = 0x000000C0,
+	.sfe_op_throttle_cfg           = 0x000000C4,
+	.irc_throttle_cfg              = 0x000000C8,
+	.sfe_single_dual_cfg           = 0x000000D0,
+	.bus_overflow_status           = 0x00000868,
+	.num_perf_counters             = 2,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg        = 0x00000080,
+			.perf_pix_count        = 0x00000084,
+			.perf_line_count       = 0x00000088,
+			.perf_stall_count      = 0x0000008C,
+			.perf_always_count     = 0x00000090,
+			.perf_count_status     = 0x00000094,
+		},
+		{
+			.perf_count_cfg        = 0x00000098,
+			.perf_pix_count        = 0x0000009C,
+			.perf_line_count       = 0x000000A0,
+			.perf_stall_count      = 0x000000A4,
+			.perf_always_count     = 0x000000A8,
+			.perf_count_status     = 0x000000AC,
+		},
+	},
+	.top_debug_cfg                  = 0x0000007C,
+	.top_cc_test_bus_ctrl           = 0x000001F0,
+	.lcr_supported                  = false,
+	.ir_supported                   = true,
+	.qcfa_only                      = false,
+	.num_sfe_mode                   = ARRAY_SIZE(sfe_880_mode),
+	.sfe_mode                       = sfe_880_mode,
+	.ipp_violation_mask             = 0x4000,
+	.top_debug_testbus_reg          = 13,
+	.top_debug_nonccif_regstart_idx = 12,
+	.top_cc_test_bus_supported      = true,
+	.num_debug_registers            = 20,
+	.top_debug = {
+		0x0000004C,
+		0x00000050,
+		0x00000054,
+		0x00000058,
+		0x0000005C,
+		0x00000060,
+		0x00000064,
+		0x00000068,
+		0x0000006C,
+		0x00000070,
+		0x00000074,
+		0x00000078,
+		0x000000EC,
+		0x000000F0,
+		0x000000F4,
+		0x000000F8,
+		0x000000FC,
+		0x00000100,
+		0x00000104,
+		0x00000108,
+	},
+};
+
+static struct cam_sfe_fcg_module_info sfe880_fcg_module_info = {
+	.fcg_index_shift                     = 16,
+	.max_reg_val_pair_size               = 16,
+	.fcg_type_size                       = 2,
+	.fcg_ch1_phase_index_cfg_0           = 0x00007270,
+	.fcg_ch1_phase_index_cfg_1           = 0x00007274,
+	.fcg_ch2_phase_index_cfg_0           = 0x00007470,
+	.fcg_ch2_phase_index_cfg_1           = 0x00007474,
+	.fcg_ch1_stats_phase_index_cfg_0     = 0x00007670,
+	.fcg_ch1_stats_phase_index_cfg_1     = 0x00007674,
+	.fcg_ch2_stats_phase_index_cfg_0     = 0x00007870,
+	.fcg_ch2_stats_phase_index_cfg_1     = 0x00007874,
+};
+
+static struct cam_sfe_modules_common_reg_offset sfe880_modules_common_reg = {
+	.demux_module_cfg                    = 0x00003060,
+	.demux_xcfa_cfg                      = 0x00003064,
+	.demux_hdr_cfg                       = 0x00003074,
+	.hdrc_remo_mod_cfg                   = 0x00005860,
+	.xcfa_hdrc_remo_out_mux_cfg          = 0x00005A74,
+	.hdrc_remo_xcfa_bin_cfg              = 0x00005A78,
+	.fcg_module_info                     = &sfe880_fcg_module_info,
+	.fcg_supported                       = true,
+};
+
+static struct cam_sfe_top_common_reg_data sfe_880_top_common_reg_data = {
+	.error_irq_mask                = 0x6C000,
+	.enable_diagnostic_hw          = 0x1,
+	.top_debug_cfg_en              = 0x3,
+	.sensor_sel_shift              = 0x1,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_880_pix_reg_data = {
+	.sof_irq_mask                  = 0x4,
+	.eof_irq_mask                  = 0x8,
+	.subscribe_irq_mask            = 0xC,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_880_rdi0_reg_data = {
+	.sof_irq_mask                  = 0x10,
+	.eof_irq_mask                  = 0x20,
+	.subscribe_irq_mask            = 0x30,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_880_rdi1_reg_data = {
+	.sof_irq_mask                  = 0x40,
+	.eof_irq_mask                  = 0x80,
+	.subscribe_irq_mask            = 0xC0,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_880_rdi2_reg_data = {
+	.sof_irq_mask                  = 0x100,
+	.eof_irq_mask                  = 0x200,
+	.subscribe_irq_mask            = 0x300,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_880_rdi3_reg_data = {
+	.sof_irq_mask                  = 0x400,
+	.eof_irq_mask                  = 0x800,
+	.subscribe_irq_mask            = 0xC00,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_880_rdi4_reg_data = {
+	.sof_irq_mask                  = 0x1000,
+	.eof_irq_mask                  = 0x2000,
+	.subscribe_irq_mask            = 0x3000,
+};
+
+static struct cam_sfe_top_hw_info sfe880_top_hw_info = {
+	.common_reg = &sfe880_top_commong_reg,
+	.modules_hw_info = &sfe880_modules_common_reg,
+	.common_reg_data = &sfe_880_top_common_reg_data,
+	.ipp_module_desc =  sfe_880_mod_desc,
+	.wr_client_desc  =  sfe_880_wr_client_desc,
+	.pix_reg_data    = &sfe_880_pix_reg_data,
+	.rdi_reg_data[0] = &sfe_880_rdi0_reg_data,
+	.rdi_reg_data[1] = &sfe_880_rdi1_reg_data,
+	.rdi_reg_data[2] = &sfe_880_rdi2_reg_data,
+	.rdi_reg_data[3] = &sfe_880_rdi3_reg_data,
+	.rdi_reg_data[4] = &sfe_880_rdi4_reg_data,
+	.num_inputs = 6,
+	.input_type = {
+		CAM_SFE_PIX_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+	},
+	.num_top_errors  = ARRAY_SIZE(sfe_880_top_irq_err_desc),
+	.top_err_desc    = sfe_880_top_irq_err_desc,
+	.num_clc_module  = 12,
+	.clc_dbg_mod_info = &sfe880_clc_dbg_module_info,
+	.num_of_testbus = 2,
+	.test_bus_info = {
+		/* TEST BUS 1 INFO */
+		{
+			.debugfs_val  = SFE_DEBUG_ENABLE_TESTBUS1,
+			.enable       = false,
+			.value        = 0x1,
+			.size         = ARRAY_SIZE(sfe880_testbus1_info),
+			.testbus      = sfe880_testbus1_info,
+		},
+		/* TEST BUS 2 INFO */
+		{
+			.debugfs_val  = SFE_DEBUG_ENABLE_TESTBUS2,
+			.enable       = false,
+			.value        = 0x3,
+			.size         = ARRAY_SIZE(sfe880_testbus2_info),
+			.testbus      = sfe880_testbus2_info,
+		},
+	},
+};
+
+static struct cam_irq_register_set sfe880_bus_rd_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00000404,
+		.clear_reg_offset  = 0x00000408,
+		.status_reg_offset = 0x00000410,
+		.set_reg_offset    = 0x00000418,
+	},
+};
+
+static struct cam_sfe_bus_rd_err_irq_desc sfe880_bus_rd_irq_err_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.err_name = "INFO_CONS_VIOLATION",
+		.desc = "Clients have illegal programming, check CONS_VIOLATION_STATUS",
+	},
+	{
+		.bitmask = BIT(31),
+		.err_name = "INFO_CCIF_VIOLATION",
+	},
+};
+
+static struct cam_sfe_bus_rd_constraint_error_desc
+	sfe880_bus_rd_cons_error_desc[CAM_SFE_BUS_RD_CONS_ERR_MAX] = {
+	{
+		.bitmask    = BIT(0),
+		.error_desc = "Image Addr Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(1),
+		.error_desc = "Ubwc Addr Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(2),
+		.error_desc = "Stride Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(3),
+		.error_desc = "Y Unit Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(4),
+		.error_desc = "X Unit Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(5),
+		.error_desc = "Image width Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(6),
+		.error_desc = "Image height Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(7),
+		.error_desc = "Meta Stride Unalign Latch",
+	},
+};
+
+static struct cam_sfe_bus_rd_constraint_error_info sfe880_bus_rd_constraint_error_info = {
+	.constraint_error_list = sfe880_bus_rd_cons_error_desc,
+	.num_cons_err          = 8,
+	.cons_chk_en_avail     = true,
+};
+
+static struct cam_sfe_bus_rd_hw_info sfe880_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00000400,
+		.misr_reset                   = 0x0000041C,
+		.pwr_iso_cfg                  = 0x00000424,
+		.input_if_cmd                 = 0x00000414,
+		.test_bus_ctrl                = 0x0000042C,
+		.security_cfg                 = 0x00000420,
+		.cons_violation_status        = 0x00000430,
+		.ccif_violation_status        = 0x00000434,
+		.irq_reg_info = {
+			.num_registers = 1,
+			.irq_reg_set = sfe880_bus_rd_irq_reg,
+			.global_irq_cmd_offset = 0x0000040C,
+			.global_clear_bitmask  = 0x00000001,
+		},
+	},
+	.num_client = 3,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x00000450,
+			.image_addr               = 0x00000458,
+			.buf_width                = 0x0000045C,
+			.buf_height               = 0x00000460,
+			.stride                   = 0x00000464,
+			.unpacker_cfg             = 0x00000468,
+			.latency_buf_allocation   = 0x0000047C,
+			.system_cache_cfg         = 0x00000490,
+			.addr_cfg                 = 0x00000498,
+			.debug_status_cfg         = 0x000004A4,
+			.debug_status_0           = 0x000004A8,
+			.debug_status_1           = 0x000004AC,
+			.name                     = "Fetch0",
+		},
+		/* BUS Client 1 */
+		{
+			.cfg                      = 0x000004F0,
+			.image_addr               = 0x000004F8,
+			.buf_width                = 0x000004FC,
+			.buf_height               = 0x00000500,
+			.stride                   = 0x00000504,
+			.unpacker_cfg             = 0x00000508,
+			.latency_buf_allocation   = 0x0000051C,
+			.system_cache_cfg         = 0x00000530,
+			.addr_cfg                 = 0x00000538,
+			.debug_status_cfg         = 0x00000544,
+			.debug_status_0           = 0x00000548,
+			.debug_status_1           = 0x0000054C,
+			.name                     = "Fetch1",
+		},
+		/* BUS Client 2 */
+		{
+			.cfg                      = 0x00000590,
+			.image_addr               = 0x00000598,
+			.buf_width                = 0x0000059C,
+			.buf_height               = 0x000005A0,
+			.stride                   = 0x000005A4,
+			.unpacker_cfg             = 0x000005A8,
+			.latency_buf_allocation   = 0x000005BC,
+			.system_cache_cfg         = 0x000005D0,
+			.addr_cfg                 = 0x000005D8,
+			.debug_status_cfg         = 0x000005E4,
+			.debug_status_0           = 0x000005E8,
+			.debug_status_1           = 0x000005EC,
+			.name                     = "Fetch2",
+		},
+	},
+	.num_bus_rd_resc = 3,
+	.sfe_bus_rd_info = {
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI0,
+			.mid[0] = 0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI1,
+			.mid[0] = 1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI2,
+			.mid[0] = 2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.num_bus_rd_errors     = ARRAY_SIZE(sfe880_bus_rd_irq_err_desc),
+	.bus_rd_err_desc       = sfe880_bus_rd_irq_err_desc,
+	.top_irq_shift          = 0x1,
+	.latency_buf_allocation = 2048,
+	.sys_cache_default_val  = 0x20,
+	.irq_err_mask           = 0x80000001,
+	.fs_sync_shift          = 0x14,
+	.constraint_error_info  = &sfe880_bus_rd_constraint_error_info,
+};
+
+static struct cam_sfe_bus_wr_err_irq_desc sfe880_bus_wr_irq_err_desc[] = {
+	{
+		.bitmask = BIT(26),
+		.err_name = "IPCC_FENCE_DATA_ERR",
+		.desc = "IPCC or FENCE Data was not available in the Input Fifo",
+	},
+	{
+		.bitmask = BIT(27),
+		.err_name = "IPCC_FENCE_ADDR_ERR",
+		.desc = "IPCC or FENCE address fifo was empty and read was attempted",
+	},
+	{
+		.bitmask = BIT(28),
+		.err_name = "CONS_VIOLATION",
+		.desc = "Programming of software registers violated the constraints",
+	},
+	{
+		.bitmask = BIT(30),
+		.err_name = "VIOLATION",
+		.desc = "Client has a violation in ccif protocol at input",
+	},
+	{
+		.bitmask = BIT(31),
+		.err_name = "IMAGE_SIZE_VIOLATION",
+		.desc = "Programmed image size is not same as image size from the CCIF",
+	},
+};
+
+static struct cam_sfe_bus_wr_constraint_error_desc
+	sfe880_bus_wr_cons_error_desc[CAM_SFE_BUS_CONS_ERR_MAX] = {
+	{
+		.bitmask = BIT(0),
+		.error_description = "PPC 1x1 input not supported"
+	},
+	{
+		.bitmask = BIT(1),
+		.error_description = "PPC 1x2 input not supported"
+	},
+	{
+		.bitmask = BIT(2),
+		.error_description = "PPC 2x1 input not supported"
+	},
+	{
+		.bitmask = BIT(3),
+		.error_description = "PPC 2x2 input not supported"
+	},
+	{
+		.bitmask = BIT(4),
+		.error_description = "Pack 8 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(5),
+		.error_description = "Pack 16 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(6),
+		.error_description = "Pack 24 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(7),
+		.error_description = "Pack 32 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(8),
+		.error_description = "Pack 64 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(9),
+		.error_description = "Pack MIPI 20 format not supported"
+	},
+	{
+		.bitmask = BIT(10),
+		.error_description = "Pack MIPI 14 format not supported"
+	},
+	{
+		.bitmask = BIT(11),
+		.error_description = "Pack MIPI 12 format not supported"
+	},
+	{
+		.bitmask = BIT(12),
+		.error_description = "Pack MIPI 10 format not supported"
+	},
+	{
+		.bitmask = BIT(13),
+		.error_description = "Pack 128 BPP format not supported"
+	},
+	{
+		.bitmask = BIT(14),
+		.error_description = "UBWC P16 format not supported"
+	},
+	{
+		.bitmask = BIT(15),
+		.error_description = "UBWC P10 format not supported"
+	},
+	{
+		.bitmask = BIT(16),
+		.error_description = "UBWC NV12 format not supported"
+	},
+	{
+		.bitmask = BIT(17),
+		.error_description = "UBWC NV12 4R format not supported"
+	},
+	{
+		.bitmask = BIT(18),
+		.error_description = "UBWC TP10 format not supported"
+	},
+	{
+		.bitmask = BIT(19),
+		.error_description = "Frame based Mode not supported"
+	},
+	{
+		.bitmask = BIT(20),
+		.error_description = "Index based Mode not supported"
+	},
+	{
+		.bitmask = BIT(21),
+		.error_description = "FIFO image addr unalign"
+	},
+	{
+		.bitmask = BIT(22),
+		.error_description = "FIFO ubwc addr unalign"
+	},
+	{
+		.bitmask = BIT(23),
+		.error_description = "FIFO frmheader addr unalign"
+	},
+	{
+		.bitmask = BIT(24),
+		.error_description = "Image address unalign"
+	},
+	{
+		.bitmask = BIT(25),
+		.error_description = "UBWC address unalign"
+	},
+	{
+		.bitmask = BIT(26),
+		.error_description = "Frame Header address unalign"
+	},
+	{
+		.bitmask = BIT(27),
+		.error_description = "Stride unalign"
+	},
+	{
+		.bitmask = BIT(28),
+		.error_description = "X Initialization unalign"
+	},
+	{
+		.bitmask = BIT(29),
+		.error_description = "Image Width unalign"
+	},
+	{
+		.bitmask = BIT(30),
+		.error_description = "Image Height unalign"
+	},
+	{
+		.bitmask = BIT(31),
+		.error_description = "Meta Stride unalign"
+	},
+};
+
+static struct cam_sfe_bus_wr_constraint_error_info sfe880_bus_wr_constraint_error_info = {
+	.constraint_error_list   = sfe880_bus_wr_cons_error_desc,
+	.num_cons_err            = 32,
+	.img_width_unalign_shift = 29,
+};
+
+static struct cam_irq_register_set sfe880_bus_wr_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00000818,
+		.clear_reg_offset  = 0x00000820,
+		.status_reg_offset = 0x00000828,
+		.set_reg_offset    = 0x00000850,
+	},
+};
+
+static struct cam_sfe_bus_wr_hw_info sfe880_bus_wr_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000800,
+		.cgc_ovd                          = 0x00000808,
+		.if_frameheader_cfg               = {
+			0x00000834,
+			0x00000838,
+			0x0000083C,
+			0x00000840,
+			0x00000844,
+			0x00000848,
+		},
+		.pwr_iso_cfg                      = 0x0000085C,
+		.overflow_status_clear            = 0x00000860,
+		.ccif_violation_status            = 0x00000864,
+		.overflow_status                  = 0x00000868,
+		.image_size_violation_status      = 0x00000870,
+		.debug_status_top_cfg             = 0x000008F0,
+		.debug_status_top                 = 0x000008F4,
+		.test_bus_ctrl                    = 0x00000994,
+		.top_irq_mask_0                   = 0x00000020,
+		.qos_eos_cfg                      = 0x00000990,
+		.irq_reg_info = {
+			.num_registers = 1,
+			.irq_reg_set = sfe880_bus_wr_irq_reg,
+			.global_irq_cmd_offset = 0x00000830,
+			.global_clear_bitmask  = 0x00000001,
+		},
+	},
+	.num_client = 17,
+	.bus_client_reg = {
+		/* BUS Client 0 REMOSAIC */
+		{
+			.cfg                      = 0x00000A00,
+			.image_addr               = 0x00000A04,
+			.frame_incr               = 0x00000A08,
+			.image_cfg_0              = 0x00000A0C,
+			.image_cfg_1              = 0x00000A10,
+			.image_cfg_2              = 0x00000A14,
+			.packer_cfg               = 0x00000A18,
+			.frame_header_addr        = 0x00000A20,
+			.frame_header_incr        = 0x00000A24,
+			.frame_header_cfg         = 0x00000A28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000A30,
+			.irq_subsample_pattern    = 0x00000A34,
+			.framedrop_period         = 0x00000A38,
+			.framedrop_pattern        = 0x00000A3C,
+			.system_cache_cfg         = 0x00000A68,
+			.addr_cfg                 = 0x00000A70,
+			.addr_status_0            = 0x00000A78,
+			.addr_status_1            = 0x00000A7C,
+			.addr_status_2            = 0x00000A80,
+			.addr_status_3            = 0x00000A84,
+			.debug_status_cfg         = 0x00000A88,
+			.debug_status_0           = 0x00000A8C,
+			.debug_status_1           = 0x00000A90,
+			.mmu_prefetch_cfg         = 0x00000A60,
+			.mmu_prefetch_max_offset  = 0x00000A64,
+			.bw_limiter_addr          = 0x00000A1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_0,
+		},
+		/* BUS Client 1 IR OUT */
+		{
+			.cfg                      = 0x00000B00,
+			.image_addr               = 0x00000B04,
+			.frame_incr               = 0x00000B08,
+			.image_cfg_0              = 0x00000B0C,
+			.image_cfg_1              = 0x00000B10,
+			.image_cfg_2              = 0x00000B14,
+			.packer_cfg               = 0x00000B18,
+			.frame_header_addr        = 0x00000B20,
+			.frame_header_incr        = 0x00000B24,
+			.frame_header_cfg         = 0x00000B28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000B30,
+			.irq_subsample_pattern    = 0x00000B34,
+			.framedrop_period         = 0x00000B38,
+			.framedrop_pattern        = 0x00000B3C,
+			.system_cache_cfg         = 0x00000B68,
+			.addr_cfg                 = 0x00000B70,
+			.addr_status_0            = 0x00000B78,
+			.addr_status_1            = 0x00000B7C,
+			.addr_status_2            = 0x00000B80,
+			.addr_status_3            = 0x00000B84,
+			.debug_status_cfg         = 0x00000B88,
+			.debug_status_0           = 0x00000B8C,
+			.debug_status_1           = 0x00000B90,
+			.mmu_prefetch_cfg         = 0x00000B60,
+			.mmu_prefetch_max_offset  = 0x00000B64,
+			.bw_limiter_addr          = 0x00000B1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_1,
+		},
+		/* BUS Client 2 STATS_BE_0 */
+		{
+			.cfg                      = 0x00000C00,
+			.image_addr               = 0x00000C04,
+			.frame_incr               = 0x00000C08,
+			.image_cfg_0              = 0x00000C0C,
+			.image_cfg_1              = 0x00000C10,
+			.image_cfg_2              = 0x00000C14,
+			.packer_cfg               = 0x00000C18,
+			.frame_header_addr        = 0x00000C20,
+			.frame_header_incr        = 0x00000C24,
+			.frame_header_cfg         = 0x00000C28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000C30,
+			.irq_subsample_pattern    = 0x00000C34,
+			.framedrop_period         = 0x00000C38,
+			.framedrop_pattern        = 0x00000C3C,
+			.system_cache_cfg         = 0x00000C68,
+			.addr_cfg                 = 0x00000C70,
+			.addr_status_0            = 0x00000C78,
+			.addr_status_1            = 0x00000C7C,
+			.addr_status_2            = 0x00000C80,
+			.addr_status_3            = 0x00000C84,
+			.debug_status_cfg         = 0x00000C88,
+			.debug_status_0           = 0x00000C8C,
+			.debug_status_1           = 0x00000C90,
+			.mmu_prefetch_cfg         = 0x00000C60,
+			.mmu_prefetch_max_offset  = 0x00000C64,
+			.bw_limiter_addr          = 0x00000C1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 3 STATS_BHIST_0 */
+		{
+			.cfg                      = 0x00000D00,
+			.image_addr               = 0x00000D04,
+			.frame_incr               = 0x00000D08,
+			.image_cfg_0              = 0x00000D0C,
+			.image_cfg_1              = 0x00000D10,
+			.image_cfg_2              = 0x00000D14,
+			.packer_cfg               = 0x00000D18,
+			.frame_header_addr        = 0x00000D20,
+			.frame_header_incr        = 0x00000D24,
+			.frame_header_cfg         = 0x00000D28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000D30,
+			.irq_subsample_pattern    = 0x00000D34,
+			.framedrop_period         = 0x00000D38,
+			.framedrop_pattern        = 0x00000D3C,
+			.system_cache_cfg         = 0x00000D68,
+			.addr_cfg                 = 0x00000D70,
+			.addr_status_0            = 0x00000D78,
+			.addr_status_1            = 0x00000D7C,
+			.addr_status_2            = 0x00000D80,
+			.addr_status_3            = 0x00000D84,
+			.debug_status_cfg         = 0x00000D88,
+			.debug_status_0           = 0x00000D8C,
+			.debug_status_1           = 0x00000D90,
+			.mmu_prefetch_cfg         = 0x00000D60,
+			.mmu_prefetch_max_offset  = 0x00000D64,
+			.bw_limiter_addr          = 0x00000D1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 4 STATS_BE_1 */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.frame_header_addr        = 0x00000E20,
+			.frame_header_incr        = 0x00000E24,
+			.frame_header_cfg         = 0x00000E28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_cfg                 = 0x00000E70,
+			.addr_status_0            = 0x00000E78,
+			.addr_status_1            = 0x00000E7C,
+			.addr_status_2            = 0x00000E80,
+			.addr_status_3            = 0x00000E84,
+			.debug_status_cfg         = 0x00000E88,
+			.debug_status_0           = 0x00000E8C,
+			.debug_status_1           = 0x00000E90,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.bw_limiter_addr          = 0x00000E1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 5 STATS_BHIST_1 */
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_cfg                 = 0x00000F70,
+			.addr_status_0            = 0x00000F78,
+			.addr_status_1            = 0x00000F7C,
+			.addr_status_2            = 0x00000F80,
+			.addr_status_3            = 0x00000F84,
+			.debug_status_cfg         = 0x00000F88,
+			.debug_status_0           = 0x00000F8C,
+			.debug_status_1           = 0x00000F90,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.bw_limiter_addr          = 0x00000F1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 6 STATS_BE_2 */
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.frame_header_addr        = 0x00001020,
+			.frame_header_incr        = 0x00001024,
+			.frame_header_cfg         = 0x00001028,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.system_cache_cfg         = 0x00001068,
+			.addr_cfg                 = 0x00001070,
+			.addr_status_0            = 0x00001078,
+			.addr_status_1            = 0x0000107C,
+			.addr_status_2            = 0x00001080,
+			.addr_status_3            = 0x00001084,
+			.debug_status_cfg         = 0x00001088,
+			.debug_status_0           = 0x0000108C,
+			.debug_status_1           = 0x00001090,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.bw_limiter_addr          = 0x0000101C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 7 STATS_BHIST_2 */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.frame_header_addr        = 0x00001120,
+			.frame_header_incr        = 0x00001124,
+			.frame_header_cfg         = 0x00001128,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.system_cache_cfg         = 0x00001168,
+			.addr_cfg                 = 0x00001170,
+			.addr_status_0            = 0x00001178,
+			.addr_status_1            = 0x0000117C,
+			.addr_status_2            = 0x00001180,
+			.addr_status_3            = 0x00001184,
+			.debug_status_cfg         = 0x00001188,
+			.debug_status_0           = 0x0000118C,
+			.debug_status_1           = 0x00001190,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.bw_limiter_addr          = 0x0000111C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 8 STATS_RS_0 */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.system_cache_cfg         = 0x00001268,
+			.addr_cfg                 = 0x00001270,
+			.addr_status_0            = 0x00001278,
+			.addr_status_1            = 0x0000127C,
+			.addr_status_2            = 0x00001280,
+			.addr_status_3            = 0x00001284,
+			.debug_status_cfg         = 0x00001288,
+			.debug_status_0           = 0x0000128C,
+			.debug_status_1           = 0x00001290,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.bw_limiter_addr          = 0x0000121C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 9 STATS_RS_1 */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.system_cache_cfg         = 0x00001368,
+			.addr_cfg                 = 0x00001370,
+			.addr_status_0            = 0x00001378,
+			.addr_status_1            = 0x0000137C,
+			.addr_status_2            = 0x00001380,
+			.addr_status_3            = 0x00001384,
+			.debug_status_cfg         = 0x00001388,
+			.debug_status_0           = 0x0000138C,
+			.debug_status_1           = 0x00001390,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.bw_limiter_addr          = 0x0000131C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 10 STATS_RS_2 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.system_cache_cfg         = 0x00001468,
+			.addr_cfg                 = 0x00001470,
+			.addr_status_0            = 0x00001478,
+			.addr_status_1            = 0x0000147C,
+			.addr_status_2            = 0x00001480,
+			.addr_status_3            = 0x00001484,
+			.debug_status_cfg         = 0x00001488,
+			.debug_status_0           = 0x0000148C,
+			.debug_status_1           = 0x00001490,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.bw_limiter_addr          = 0x0000141C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 11 RDI0 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.line_done_cfg            = 0x0000152C,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.system_cache_cfg         = 0x00001568,
+			.addr_cfg                 = 0x00001570,
+			.addr_status_0            = 0x00001578,
+			.addr_status_1            = 0x0000157C,
+			.addr_status_2            = 0x00001580,
+			.addr_status_3            = 0x00001584,
+			.debug_status_cfg         = 0x00001588,
+			.debug_status_0           = 0x0000158C,
+			.debug_status_1           = 0x00001590,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.bw_limiter_addr          = 0x0000151C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_5,
+		},
+		/* BUS Client 12 RDI1 */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.line_done_cfg            = 0x0000162C,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.system_cache_cfg         = 0x00001668,
+			.addr_cfg                 = 0x00001670,
+			.addr_status_0            = 0x00001678,
+			.addr_status_1            = 0x0000167C,
+			.addr_status_2            = 0x00001680,
+			.addr_status_3            = 0x00001684,
+			.debug_status_cfg         = 0x00001688,
+			.debug_status_0           = 0x0000168C,
+			.debug_status_1           = 0x00001690,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.bw_limiter_addr          = 0x0000161C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_6,
+		},
+		/* BUS Client 13 RDI2 */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.frame_header_addr        = 0x00001720,
+			.frame_header_incr        = 0x00001724,
+			.frame_header_cfg         = 0x00001728,
+			.line_done_cfg            = 0x0000172C,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.system_cache_cfg         = 0x00001768,
+			.addr_cfg                 = 0x00001770,
+			.addr_status_0            = 0x00001778,
+			.addr_status_1            = 0x0000177C,
+			.addr_status_2            = 0x00001780,
+			.addr_status_3            = 0x00001784,
+			.debug_status_cfg         = 0x00001788,
+			.debug_status_0           = 0x0000178C,
+			.debug_status_1           = 0x00001790,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.bw_limiter_addr          = 0x0000171C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_7,
+		},
+		/* BUS Client 14 RDI3 */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.line_done_cfg            = 0x0000182C,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.framedrop_period         = 0x00001838,
+			.framedrop_pattern        = 0x0000183C,
+			.system_cache_cfg         = 0x00001868,
+			.addr_cfg                 = 0x00001870,
+			.addr_status_0            = 0x00001878,
+			.addr_status_1            = 0x0000187C,
+			.addr_status_2            = 0x00001880,
+			.addr_status_3            = 0x00001884,
+			.debug_status_cfg         = 0x00001888,
+			.debug_status_0           = 0x0000188C,
+			.debug_status_1           = 0x00001890,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.bw_limiter_addr          = 0x0000181C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_8,
+		},
+		/* BUS Client 15 RDI4 */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.line_done_cfg            = 0x0000192C,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.framedrop_period         = 0x00001938,
+			.framedrop_pattern        = 0x0000193C,
+			.system_cache_cfg         = 0x00001968,
+			.addr_cfg                 = 0x00001970,
+			.addr_status_0            = 0x00001978,
+			.addr_status_1            = 0x0000197C,
+			.addr_status_2            = 0x00001980,
+			.addr_status_3            = 0x00001984,
+			.debug_status_cfg         = 0x00001988,
+			.debug_status_0           = 0x0000198C,
+			.debug_status_1           = 0x00001990,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.bw_limiter_addr          = 0x0000191C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_9,
+		},
+		/* BUS Client 16 HDR_STATS */
+		{
+			.cfg                      = 0x00001A00,
+			.image_addr               = 0x00001A04,
+			.frame_incr               = 0x00001A08,
+			.image_cfg_0              = 0x00001A0C,
+			.image_cfg_1              = 0x00001A10,
+			.image_cfg_2              = 0x00001A14,
+			.packer_cfg               = 0x00001A18,
+			.frame_header_addr        = 0x00001A20,
+			.frame_header_incr        = 0x00001A24,
+			.frame_header_cfg         = 0x00001A28,
+			.irq_subsample_period     = 0x00001A30,
+			.irq_subsample_pattern    = 0x00001A34,
+			.framedrop_period         = 0x00001A38,
+			.framedrop_pattern        = 0x00001A3C,
+			.system_cache_cfg         = 0x00001A68,
+			.addr_cfg                 = 0x00001A70,
+			.addr_status_0            = 0x00001A78,
+			.addr_status_1            = 0x00001A7C,
+			.addr_status_2            = 0x00001A80,
+			.addr_status_3            = 0x00001A84,
+			.debug_status_cfg         = 0x00001A88,
+			.debug_status_0           = 0x00001A8C,
+			.debug_status_1           = 0x00001A90,
+			.mmu_prefetch_cfg         = 0x00001A60,
+			.mmu_prefetch_max_offset  = 0x00001A64,
+			.bw_limiter_addr          = 0x00001A1C,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_10,
+		},
+	},
+	.num_out = 17,
+	.sfe_out_hw_info = {
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_1,
+			.mid[0]        = 45,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 11,
+			.en_line_done  = 1,
+			.name          = "RDI_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_2,
+			.mid[0]        = 46,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 12,
+			.en_line_done  = 1,
+			.name          = "RDI_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_3,
+			.mid[0]        = 47,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 13,
+			.en_line_done  = 1,
+			.name          = "RDI_2",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_4,
+			.mid[0]        = 48,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 14,
+			.name          = "RDI_3",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI4,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_5,
+			.mid[0]        = 49,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 15,
+			.name          = "RDI_4",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RAW_DUMP,
+			.max_width     = 9312,
+			.max_height    = 6992,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 32,
+			.mid[1]        = 33,
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = 0,
+			.name          = "REMOSIAC",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_IR,
+			.max_width     = 9312,
+			.max_height    = 6772,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 34,
+			.mid[1]        = 35,
+			.num_wm        = 1,
+			.wm_idx        = 1,
+			.name          = "IR_OUT",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 36,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 2,
+			.name          = "STATS_BE_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 37,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 3,
+			.name          = "STATS_BHIST_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 38,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 4,
+			.name          = "STATS_BE_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 39,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 5,
+			.name          = "STATS_BHIST_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 40,
+			.num_wm        = 1,
+			.wm_idx        = 6,
+			.name          = "STATS_BE_2",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 41,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 7,
+			.name          = "STATS_BHIST_2",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BAYER_RS_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 42,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 8,
+			.name          = "STATS_RS_0",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BAYER_RS_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 43,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 9,
+			.name          = "STATS_RS_1",
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BAYER_RS_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]        = 44,
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = 10,
+			.name          = "STATS_RS_2",
+		},
+		{
+			.sfe_out_type = CAM_SFE_BUS_SFE_OUT_HDR_STATS,
+			.max_width    = 9312,
+			.max_height   = 6772,
+			.source_group = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.mid[0]       = 50,
+			.mid[1]       = 51,
+			.num_mid      = 2,
+			.num_wm       = 1,
+			.wm_idx       = 16,
+			.name         = "HDR_STATS"
+		},
+	},
+	.constraint_error_info = &sfe880_bus_wr_constraint_error_info,
+	.num_bus_wr_errors     = ARRAY_SIZE(sfe880_bus_wr_irq_err_desc),
+	.bus_wr_err_desc       = sfe880_bus_wr_irq_err_desc,
+	.comp_done_mask = {
+		BIT(17), BIT(18), BIT(19), BIT(20), BIT(21),  BIT(23),
+		BIT(24), BIT(25), BIT(26), BIT(27), BIT(22),
+	},
+	.num_comp_grp           = 11,
+	.line_done_cfg          = 0x11,
+	.top_irq_shift          = 0x0,
+	.max_out_res            = CAM_ISP_SFE_OUT_RES_BASE + 18,
+	.pack_align_shift       = 5,
+	.max_bw_counter_limit   = 0xFF,
+	.sys_cache_default_val  = 0x20,
+	.irq_err_mask           = 0xD0000000,
+};
+
+static struct cam_irq_register_set sfe880_top_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000020,
+		.clear_reg_offset  = 0x00000024,
+		.status_reg_offset = 0x00000028,
+		.set_reg_offset    = 0x0000002C,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+};
+
+static struct cam_irq_controller_reg_info sfe880_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = sfe880_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x0000001C,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+struct cam_sfe_hw_info cam_sfe880_hw_info = {
+	.irq_reg_info                  = &sfe880_top_irq_reg_info,
+
+	.bus_wr_version                = CAM_SFE_BUS_WR_VER_1_0,
+	.bus_wr_hw_info                = &sfe880_bus_wr_hw_info,
+
+	.bus_rd_version                = CAM_SFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &sfe880_bus_rd_hw_info,
+
+	.top_version                   = CAM_SFE_TOP_VER_1_0,
+	.top_hw_info                   = &sfe880_top_hw_info,
+};
+
+#endif /* _CAM_SFE880_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.c
@@ -0,0 +1,622 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/list.h>
+#include "cam_tasklet_util.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_sfe_soc.h"
+#include "cam_sfe_core.h"
+#include "cam_debug_util.h"
+
+static const char drv_name[] = "sfe";
+
+int cam_sfe_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_sfe_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_sfe_read(void *device_priv,
+	void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_sfe_write(void *device_priv,
+	void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_sfe_init_hw(void *hw_priv, void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *sfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	sfe_hw->open_count++;
+	if (sfe_hw->open_count > 1) {
+		mutex_unlock(&sfe_hw->hw_mutex);
+		CAM_DBG(CAM_SFE, "SFE has already been initialized cnt: %d",
+			sfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&sfe_hw->hw_mutex);
+
+	soc_info = &sfe_hw->soc_info;
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+
+	/* Turn ON Regulators, Clocks and other SOC resources */
+	if (!core_info->sfe_hw_info->bus_wr_version &&
+		core_info->sfe_hw_info->bus_rd_version)
+		rc = cam_sfe_enable_soc_resources(soc_info, true);
+	else
+		rc = cam_sfe_enable_soc_resources(soc_info, false);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Enable SOC failed");
+		rc = -EFAULT;
+		goto deinit_hw;
+	}
+
+	CAM_DBG(CAM_SFE, "SFE SOC resource enabled");
+
+	if (core_info->sfe_top->hw_ops.init) {
+		rc = core_info->sfe_top->hw_ops.init(core_info->sfe_top->top_priv, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_SFE, "Top init failed rc=%d", rc);
+			goto deinit_hw;
+		}
+	}
+
+	if (core_info->sfe_hw_info->bus_wr_version &&
+		core_info->sfe_bus_wr->hw_ops.init) {
+		rc = core_info->sfe_bus_wr->hw_ops.init(core_info->sfe_bus_wr->bus_priv, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_SFE, "Bus WR init failed rc=%d", rc);
+			goto deinit_hw;
+		}
+	}
+
+	if (core_info->sfe_hw_info->bus_rd_version &&
+		core_info->sfe_bus_rd->hw_ops.init) {
+		rc = core_info->sfe_bus_rd->hw_ops.init(core_info->sfe_bus_rd->bus_priv, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_SFE, "Bus RD init failed rc=%d", rc);
+			goto deinit_hw;
+		}
+	}
+
+	/*
+	 * Async Reset as part of power ON
+	 * Any register write in bus_wr_init/bus_rd_init
+	 * will be cleared by sync reset in CSID.
+	 *
+	 */
+
+	sfe_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	return rc;
+
+deinit_hw:
+	cam_sfe_deinit_hw(hw_priv, NULL, 0);
+	return rc;
+}
+
+int cam_sfe_deinit_hw(void *hw_priv, void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *sfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	if (!sfe_hw->open_count) {
+		mutex_unlock(&sfe_hw->hw_mutex);
+		CAM_ERR(CAM_SFE, "Unbalanced deinit");
+		return -EFAULT;
+	}
+
+	sfe_hw->open_count--;
+	if (sfe_hw->open_count) {
+		mutex_unlock(&sfe_hw->hw_mutex);
+		CAM_DBG(CAM_SFE, "open_cnt non-zero: %d",
+			sfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&sfe_hw->hw_mutex);
+
+	soc_info = &sfe_hw->soc_info;
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+
+	if (core_info->sfe_hw_info->bus_rd_version &&
+		core_info->sfe_bus_rd->hw_ops.deinit) {
+		rc = core_info->sfe_bus_rd->hw_ops.deinit(core_info->sfe_bus_rd->bus_priv, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Bus RD deinit failed rc=%d", rc);
+	}
+
+	/* Probe write engine only if it exists - 0x0 is not a valid version */
+	if (core_info->sfe_hw_info->bus_wr_version &&
+		core_info->sfe_bus_wr->hw_ops.deinit) {
+		rc = core_info->sfe_bus_wr->hw_ops.deinit(core_info->sfe_bus_wr->bus_priv, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Bus WR deinit failed rc=%d", rc);
+	}
+
+	if (core_info->sfe_top->hw_ops.deinit) {
+		rc = core_info->sfe_top->hw_ops.deinit(core_info->sfe_top->top_priv, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Top deinit failed rc=%d", rc);
+	}
+
+	/* Turn OFF Regulators, Clocks and other SOC resources */
+	CAM_DBG(CAM_SFE, "Disable SFE SOC resource");
+	rc = cam_sfe_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_SFE, "Disable SOC failed");
+
+	sfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	CAM_DBG(CAM_SFE, "SFE deinit done rc: %d", rc);
+	return rc;
+}
+
+int cam_sfe_test_irq_line(void *hw_priv)
+{
+	struct cam_hw_info *sfe_hw = hw_priv;
+	struct cam_sfe_hw_core_info *core_info;
+	int rc;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	core_info = sfe_hw->core_info;
+
+	rc = cam_sfe_init_hw(sfe_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE:%d failed to init hw", sfe_hw->soc_info.index);
+		return rc;
+	}
+
+	rc = cam_irq_controller_test_irq_line(core_info->sfe_irq_controller, "SFE:%d",
+		sfe_hw->soc_info.index);
+	if (rc)
+		CAM_ERR(CAM_SFE, "failed to test SFE:%d", sfe_hw->soc_info.index);
+
+	rc = cam_sfe_deinit_hw(sfe_hw, NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_SFE, "SFE:%d failed to deinit hw", sfe_hw->soc_info.index);
+
+	return rc;
+}
+
+int cam_sfe_reserve(void *hw_priv, void *reserve_args, uint32_t arg_size)
+{
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *sfe_hw  = hw_priv;
+	struct cam_sfe_acquire_args       *acquire;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_sfe_acquire_args))) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+	acquire = (struct cam_sfe_acquire_args   *)reserve_args;
+
+	CAM_DBG(CAM_SFE, "SFE acquire for res type: %d",
+		acquire->rsrc_type);
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	if (acquire->rsrc_type == CAM_ISP_RESOURCE_SFE_IN)
+		rc = core_info->sfe_top->hw_ops.reserve(
+			core_info->sfe_top->top_priv,
+			reserve_args, arg_size);
+	else if (acquire->rsrc_type == CAM_ISP_RESOURCE_SFE_OUT)
+		rc = core_info->sfe_bus_wr->hw_ops.reserve(
+			core_info->sfe_bus_wr->bus_priv, acquire,
+			sizeof(*acquire));
+	else if (acquire->rsrc_type == CAM_ISP_RESOURCE_SFE_RD)
+		rc = core_info->sfe_bus_rd->hw_ops.reserve(
+			core_info->sfe_bus_rd->bus_priv, acquire,
+			sizeof(*acquire));
+	else
+		CAM_ERR(CAM_SFE, "Invalid SFE res_type: %d",
+			acquire->rsrc_type);
+	mutex_unlock(&sfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_sfe_release(void *hw_priv, void *release_args, uint32_t arg_size)
+{
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *sfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *sfe_res;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_sfe_hw_core_info *) sfe_hw->core_info;
+	sfe_res = (struct cam_isp_resource_node  *) release_args;
+
+	CAM_DBG(CAM_SFE, "SFE release for res type: %d",
+		sfe_res->res_type);
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_IN)
+		rc = core_info->sfe_top->hw_ops.release(
+			core_info->sfe_top->top_priv, sfe_res,
+			sizeof(struct cam_isp_resource_node));
+	else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_OUT)
+		rc = core_info->sfe_bus_wr->hw_ops.release(
+			core_info->sfe_bus_wr->bus_priv, sfe_res,
+			sizeof(*sfe_res));
+	else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_RD)
+		rc = core_info->sfe_bus_rd->hw_ops.release(
+			core_info->sfe_bus_rd->bus_priv, sfe_res,
+			sizeof(*sfe_res));
+	else
+		CAM_ERR(CAM_SFE, "Invalid SFE res type: %d",
+			sfe_res->res_type);
+	mutex_unlock(&sfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_sfe_start(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *sfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *sfe_res;
+	int                                rc;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+	sfe_res = (struct cam_isp_resource_node  *)start_args;
+	core_info->tasklet_info = sfe_res->tasklet_info;
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_IN) {
+		rc = core_info->sfe_top->hw_ops.start(
+			core_info->sfe_top->top_priv, sfe_res,
+			sizeof(struct cam_isp_resource_node));
+		if (rc)
+			CAM_ERR(CAM_SFE, "Failed to start SFE IN rc: %d", rc);
+	} else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_OUT) {
+		rc = core_info->sfe_bus_wr->hw_ops.start(sfe_res, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Failed to start SFE BUS WR rc: %d",
+				rc);
+	} else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_RD) {
+		rc = core_info->sfe_bus_rd->hw_ops.start(sfe_res,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Failed to start SFE BUS RD rc: %d",
+				rc);
+	} else {
+		CAM_ERR(CAM_SFE, "Invalid SFE res type:%d",
+			sfe_res->res_type);
+		rc = -EINVAL;
+	}
+
+	mutex_unlock(&sfe_hw->hw_mutex);
+	CAM_DBG(CAM_SFE,
+		"Start for SFE res type: %u res id: %u res_state: %d rc: %d",
+		sfe_res->res_type, sfe_res->res_id,
+		sfe_res->res_state, rc);
+	return rc;
+}
+
+int cam_sfe_stop(void *hw_priv, void *stop_args, uint32_t arg_size)
+{
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *sfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *sfe_res;
+	int rc = -EINVAL;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+	sfe_res = (struct cam_isp_resource_node  *)stop_args;
+	mutex_lock(&sfe_hw->hw_mutex);
+
+	if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_IN)
+		rc = core_info->sfe_top->hw_ops.stop(
+			core_info->sfe_top->top_priv, sfe_res,
+			sizeof(struct cam_isp_resource_node));
+	else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_OUT)
+		rc = core_info->sfe_bus_wr->hw_ops.stop(sfe_res, NULL, 0);
+	else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_RD)
+		rc = core_info->sfe_bus_rd->hw_ops.stop(sfe_res, NULL, 0);
+	else
+		CAM_ERR(CAM_SFE, "Invalid SFE res type: %d", sfe_res->res_type);
+
+	mutex_unlock(&sfe_hw->hw_mutex);
+	CAM_DBG(CAM_SFE,
+			"Stop for SFE res type: %u res id: %u res_state: %d rc: %d",
+			sfe_res->res_type, sfe_res->res_id,
+			sfe_res->res_state, rc);
+
+	return rc;
+}
+
+int cam_sfe_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *sfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &sfe_hw->soc_info;
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+	case CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE:
+	case CAM_ISP_HW_CMD_FCG_CONFIG:
+		rc = core_info->sfe_top->hw_ops.process_cmd(
+			core_info->sfe_top->top_priv, cmd_type,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+	case CAM_ISP_HW_CMD_BUF_UPDATE:
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+	case CAM_ISP_HW_CMD_GET_WM_SECURE_MODE:
+	case CAM_ISP_HW_SFE_SYS_CACHE_WM_CONFIG:
+	case CAM_ISP_HW_CMD_WM_BW_LIMIT_CONFIG:
+	case CAM_ISP_HW_SFE_BUS_MINI_DUMP:
+	case CAM_ISP_HW_USER_DUMP:
+	case CAM_ISP_HW_CMD_GET_LAST_CONSUMED_ADDR:
+		if (core_info->sfe_hw_info->bus_wr_version) {
+			rc = core_info->sfe_bus_wr->hw_ops.process_cmd(
+				core_info->sfe_bus_wr->bus_priv, cmd_type,
+				cmd_args, arg_size);
+		}
+		break;
+	case CAM_ISP_HW_CMD_GET_CLK_THRESHOLDS:
+		if (core_info->sfe_bus_rd) {
+			rc = core_info->sfe_bus_rd->hw_ops.process_cmd(
+				core_info->sfe_bus_rd->bus_priv, cmd_type,
+				cmd_args, arg_size);
+		}
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE_RM:
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM:
+	case CAM_ISP_HW_CMD_BUF_UPDATE_RM:
+	case CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD:
+	case CAM_ISP_HW_SFE_SYS_CACHE_RM_CONFIG:
+	case CAM_ISP_HW_CMD_RM_ENABLE_DISABLE:
+	case CAM_ISP_HW_CMD_GET_RM_SECURE_MODE:
+		if (core_info->sfe_hw_info->bus_rd_version) {
+			rc = core_info->sfe_bus_rd->hw_ops.process_cmd(
+				core_info->sfe_bus_rd->bus_priv, cmd_type,
+				cmd_args, arg_size);
+		}
+		break;
+	case  CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ:
+		/* Not supported */
+		break;
+	case CAM_ISP_HW_CMD_SET_SFE_DEBUG_CFG:
+		/* propagate to SFE top */
+		core_info->sfe_top->hw_ops.process_cmd(
+			core_info->sfe_top->top_priv, cmd_type,
+			cmd_args, arg_size);
+		fallthrough;
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO:
+	case CAM_ISP_HW_CMD_IRQ_INJECTION:
+	case CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION:
+		/* propagate to SFE bus wr */
+		if (core_info->sfe_hw_info->bus_wr_version) {
+			core_info->sfe_bus_wr->hw_ops.process_cmd(
+				core_info->sfe_bus_wr->bus_priv, cmd_type,
+				cmd_args, arg_size);
+		}
+		/* propagate to SFE bus rd */
+		if (core_info->sfe_hw_info->bus_rd_version) {
+			core_info->sfe_bus_rd->hw_ops.process_cmd(
+				core_info->sfe_bus_rd->bus_priv, cmd_type,
+				cmd_args, arg_size);
+		}
+		break;
+	case CAM_ISP_HW_CMD_QUERY_CAP:
+		/* propagate to SFE top */
+		core_info->sfe_top->hw_ops.process_cmd(
+			core_info->sfe_top->top_priv, cmd_type,
+			cmd_args, arg_size);
+
+		/* propagate to SFE bus wr */
+		if (core_info->sfe_hw_info->bus_wr_version) {
+			core_info->sfe_bus_wr->hw_ops.process_cmd(
+				core_info->sfe_bus_wr->bus_priv, cmd_type,
+				cmd_args, arg_size);
+		}
+		break;
+	case CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA:
+		*((struct cam_hw_soc_info **)cmd_args) = soc_info;
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Invalid cmd type: %d", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+irqreturn_t cam_sfe_irq(int irq_num, void *data)
+{
+	struct cam_hw_info            *sfe_hw;
+	struct cam_sfe_hw_core_info   *core_info;
+
+	if (!data)
+		return IRQ_NONE;
+
+	sfe_hw = (struct cam_hw_info *)data;
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+
+	return cam_irq_controller_handle_irq(irq_num,
+		core_info->sfe_irq_controller, CAM_IRQ_EVT_GROUP_0);
+}
+
+int cam_sfe_core_init(
+	struct cam_sfe_hw_core_info  *core_info,
+	struct cam_hw_soc_info       *soc_info,
+	struct cam_hw_intf           *hw_intf,
+	struct cam_sfe_hw_info       *sfe_hw_info)
+{
+	int rc = -EINVAL;
+
+	rc = cam_irq_controller_init(drv_name,
+		CAM_SOC_GET_REG_MAP_START(soc_info, SFE_CORE_BASE_IDX),
+		sfe_hw_info->irq_reg_info, &core_info->sfe_irq_controller);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE irq controller init failed");
+		return rc;
+	}
+
+	rc = cam_sfe_top_init(sfe_hw_info->top_version, soc_info, hw_intf,
+		sfe_hw_info->top_hw_info, core_info->sfe_irq_controller,
+		&core_info->sfe_top);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE top init failed rc: %d", rc);
+		goto deinit_controller;
+	}
+
+	/* Probe write engine only if it exists - 0x0 is not a valid version */
+	if (sfe_hw_info->bus_wr_version) {
+		rc = cam_sfe_bus_init(sfe_hw_info->bus_wr_version, BUS_TYPE_SFE_WR,
+			soc_info, hw_intf, sfe_hw_info->bus_wr_hw_info,
+			core_info->sfe_irq_controller,
+			&core_info->sfe_bus_wr);
+		if (rc) {
+			CAM_ERR(CAM_SFE, "SFE bus wr init failed rc: %d", rc);
+			goto deinit_top;
+		}
+	}
+
+	/* Probe fetch engine only if it exists - 0x0 is not a valid version */
+	if (sfe_hw_info->bus_rd_version) {
+		rc = cam_sfe_bus_init(sfe_hw_info->bus_rd_version, BUS_TYPE_SFE_RD,
+			soc_info, hw_intf, sfe_hw_info->bus_rd_hw_info,
+			core_info->sfe_irq_controller,
+			&core_info->sfe_bus_rd);
+		if (rc) {
+			CAM_ERR(CAM_SFE, "SFE bus rd init failed rc: %d", rc);
+			goto deinit_bus_wr;
+		}
+	}
+
+	spin_lock_init(&core_info->spin_lock);
+	CAM_DBG(CAM_SFE, "SFE device [%u] INIT success",
+		hw_intf->hw_idx);
+	return rc;
+
+deinit_bus_wr:
+	if (sfe_hw_info->bus_wr_version)
+		cam_sfe_bus_deinit(sfe_hw_info->bus_wr_version,
+			BUS_TYPE_SFE_WR, &core_info->sfe_bus_wr);
+deinit_top:
+	cam_sfe_top_deinit(sfe_hw_info->top_version,
+		&core_info->sfe_top);
+deinit_controller:
+	if (cam_irq_controller_deinit(&core_info->sfe_irq_controller))
+		CAM_ERR(CAM_SFE,
+			"Error cam_irq_controller_deinit failed rc=%d", rc);
+
+	return rc;
+}
+
+int cam_sfe_core_deinit(
+	struct cam_sfe_hw_core_info  *core_info,
+	struct cam_sfe_hw_info       *sfe_hw_info)
+{
+	int                rc = -EINVAL;
+	unsigned long      flags;
+
+	spin_lock_irqsave(&core_info->spin_lock, flags);
+
+	if (sfe_hw_info->bus_rd_version) {
+		rc = cam_sfe_bus_deinit(sfe_hw_info->bus_rd_version,
+				BUS_TYPE_SFE_RD, &core_info->sfe_bus_rd);
+		if (rc)
+			CAM_ERR(CAM_SFE,
+				"SFE bus rd deinit failed rc: %d", rc);
+	}
+
+	if (sfe_hw_info->bus_wr_version) {
+		rc = cam_sfe_bus_deinit(sfe_hw_info->bus_wr_version,
+				BUS_TYPE_SFE_WR, &core_info->sfe_bus_wr);
+		if (rc)
+			CAM_ERR(CAM_SFE,
+				"SFE bus wr deinit failed rc: %d", rc);
+	}
+
+	rc = cam_sfe_top_deinit(sfe_hw_info->top_version,
+		&core_info->sfe_top);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"SFE top deinit failed rc: %d", rc);
+
+	rc = cam_irq_controller_deinit(&core_info->sfe_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"Error cam_irq_controller_deinit failed rc=%d", rc);
+
+	spin_unlock_irqrestore(&core_info->spin_lock, flags);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.h
@@ -0,0 +1,91 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_CORE_H_
+#define _CAM_SFE_CORE_H_
+
+#include <linux/spinlock_types.h>
+#include "cam_hw_intf.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_top.h"
+
+#define CAM_SFE_EVT_MAX                        256
+
+struct cam_sfe_hw_info {
+	struct cam_irq_controller_reg_info *irq_reg_info;
+
+	uint32_t                            bus_wr_version;
+	void                               *bus_wr_hw_info;
+
+	uint32_t                            bus_rd_version;
+	void                               *bus_rd_hw_info;
+
+	uint32_t                            top_version;
+	void                               *top_hw_info;
+};
+
+struct cam_sfe_hw_core_info {
+	struct cam_sfe_hw_info             *sfe_hw_info;
+	struct cam_sfe_top                 *sfe_top;
+	struct cam_sfe_bus                 *sfe_bus_wr;
+	struct cam_sfe_bus                 *sfe_bus_rd;
+	void                               *sfe_irq_controller;
+	void                               *tasklet_info;
+	spinlock_t                          spin_lock;
+};
+
+/*
+ * Debug config to enable interrupts and debug features
+ */
+#define SFE_DEBUG_ENABLE_SOF_EOF_IRQ              BIT(0)
+#define SFE_DEBUG_ENABLE_SENSOR_DIAG_INFO         BIT(1)
+#define SFE_DEBUG_ENABLE_FRAME_COUNTER            BIT(2)
+#define SFE_DEBUG_ENABLE_RD_DONE_IRQ              BIT(3)
+#define SFE_DEBUG_DISABLE_MMU_PREFETCH            BIT(4)
+#define SFE_DEBUG_ENABLE_TESTBUS1                 BIT(8)
+#define SFE_DEBUG_ENABLE_TESTBUS2                 BIT(9)
+
+/* Reserve 4 bits for future test-busses in debug config */
+#define SFE_DEBUG_ENABLE_TESTBUS_RESERVED1        BIT(10)
+#define SFE_DEBUG_ENABLE_TESTBUS_RESERVED2        BIT(11)
+#define SFE_DEBUG_ENABLE_TESTBUS_RESERVED3        BIT(12)
+#define SFE_DEBUG_ENABLE_TESTBUS_RESERVED4        BIT(13)
+
+int cam_sfe_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_sfe_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size);
+int cam_sfe_read(void *device_priv,
+	void *read_args, uint32_t arg_size);
+int cam_sfe_write(void *device_priv,
+	void *write_args, uint32_t arg_size);
+int cam_sfe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_sfe_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_sfe_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_sfe_release(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_sfe_start(void *device_priv,
+	void *start_args, uint32_t arg_size);
+int cam_sfe_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_sfe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+int cam_sfe_test_irq_line(void *hw_priv);
+
+irqreturn_t cam_sfe_irq(int irq_num, void *data);
+
+int cam_sfe_core_init(struct cam_sfe_hw_core_info *core_info,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	struct cam_sfe_hw_info             *sfe_hw_info);
+
+int cam_sfe_core_deinit(struct cam_sfe_hw_core_info *core_info,
+	struct cam_sfe_hw_info             *sfe_hw_info);
+
+#endif /* _CAM_SFE_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.c
@@ -0,0 +1,310 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/module.h>
+#include <dt-bindings/msm-camera.h>
+#include "cam_sfe_dev.h"
+#include "cam_sfe_core.h"
+#include "cam_sfe_soc.h"
+#include "cam_sfe680.h"
+#include "cam_sfe_lite690.h"
+#include "cam_sfe_lite692.h"
+#include "cam_sfe780.h"
+#include "cam_sfe860.h"
+#include "cam_sfe880.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_isp_hw_intf_data cam_sfe_hw_list[CAM_SFE_HW_NUM_MAX];
+static uint32_t g_num_sfe_hws;
+
+static int cam_sfe_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+
+	struct cam_hw_info                *sfe_info = NULL;
+	struct cam_hw_intf                *sfe_hw_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_sfe_hw_info            *hw_info = NULL;
+	struct platform_device            *pdev = NULL;
+	struct cam_sfe_soc_private        *soc_priv;
+	uint32_t                           sfe_dev_idx;
+	int                                i, rc = 0;
+
+	pdev = to_platform_device(dev);
+
+	rc = of_property_read_u32(pdev->dev.of_node, "cell-index", &sfe_dev_idx);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Failed to read cell-index of SFE HW, rc: %d", rc);
+		goto end;
+	}
+
+	if (!cam_cpas_is_feature_supported(CAM_CPAS_SFE_FUSE, BIT(sfe_dev_idx), NULL)) {
+		CAM_DBG(CAM_SFE, "SFE:%d is not supported", sfe_dev_idx);
+		goto end;
+	}
+
+	sfe_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!sfe_hw_intf) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	sfe_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!sfe_info) {
+		rc = -ENOMEM;
+		goto free_sfe_hw_intf;
+	}
+
+	sfe_info->soc_info.pdev = pdev;
+	sfe_info->soc_info.dev = &pdev->dev;
+	sfe_info->soc_info.dev_name = pdev->name;
+	sfe_hw_intf->hw_priv = sfe_info;
+	sfe_hw_intf->hw_idx = sfe_dev_idx;
+	sfe_hw_intf->hw_ops.get_hw_caps = cam_sfe_get_hw_caps;
+	sfe_hw_intf->hw_ops.init = cam_sfe_init_hw;
+	sfe_hw_intf->hw_ops.deinit = cam_sfe_deinit_hw;
+	sfe_hw_intf->hw_ops.reset = cam_sfe_reset;
+	sfe_hw_intf->hw_ops.reserve = cam_sfe_reserve;
+	sfe_hw_intf->hw_ops.release = cam_sfe_release;
+	sfe_hw_intf->hw_ops.start = cam_sfe_start;
+	sfe_hw_intf->hw_ops.stop = cam_sfe_stop;
+	sfe_hw_intf->hw_ops.read = cam_sfe_read;
+	sfe_hw_intf->hw_ops.write = cam_sfe_write;
+	sfe_hw_intf->hw_ops.process_cmd = cam_sfe_process_cmd;
+	sfe_hw_intf->hw_ops.test_irq_line = cam_sfe_test_irq_line;
+	sfe_hw_intf->hw_type = CAM_ISP_HW_TYPE_SFE;
+
+	CAM_DBG(CAM_SFE, "SFE component bind type %d index %d",
+		sfe_hw_intf->hw_type, sfe_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, sfe_hw_intf);
+
+	sfe_info->core_info = kzalloc(sizeof(struct cam_sfe_hw_core_info),
+		GFP_KERNEL);
+	if (!sfe_info->core_info) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for core");
+		rc = -ENOMEM;
+		goto free_sfe_hw;
+	}
+	core_info = (struct cam_sfe_hw_core_info *)sfe_info->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_SFE, "Of_match Failed");
+		rc = -EINVAL;
+		goto free_core_info;
+	}
+	hw_info = (struct cam_sfe_hw_info *)match_dev->data;
+	core_info->sfe_hw_info = hw_info;
+
+	rc = cam_sfe_init_soc_resources(&sfe_info->soc_info, cam_sfe_irq,
+		sfe_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE, "Failed to init soc rc=%d", rc);
+		goto free_core_info;
+	}
+
+	rc = cam_sfe_core_init(core_info, &sfe_info->soc_info,
+		sfe_hw_intf, hw_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE, "Failed to init core rc=%d", rc);
+		goto deinit_soc;
+	}
+
+	sfe_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&sfe_info->hw_mutex);
+	spin_lock_init(&sfe_info->hw_lock);
+	init_completion(&sfe_info->hw_complete);
+
+	if (sfe_hw_intf->hw_idx < CAM_SFE_HW_NUM_MAX)
+		cam_sfe_hw_list[sfe_hw_intf->hw_idx].hw_intf = sfe_hw_intf;
+
+	soc_priv = sfe_info->soc_info.soc_private;
+	cam_sfe_hw_list[sfe_hw_intf->hw_idx].num_hw_pid = soc_priv->num_pid;
+	for (i = 0; i < soc_priv->num_pid; i++)
+		cam_sfe_hw_list[sfe_hw_intf->hw_idx].hw_pid[i] =
+			soc_priv->pid[i];
+
+	CAM_DBG(CAM_SFE, "SFE%d bound successfully",
+		sfe_hw_intf->hw_idx);
+
+	return rc;
+
+deinit_soc:
+	if (cam_sfe_deinit_soc_resources(&sfe_info->soc_info))
+		CAM_ERR(CAM_SFE, "Failed to deinit soc");
+free_core_info:
+	kfree(sfe_info->core_info);
+free_sfe_hw:
+	kfree(sfe_info);
+free_sfe_hw_intf:
+	kfree(sfe_hw_intf);
+end:
+	return rc;
+}
+
+static void cam_sfe_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+
+	struct cam_hw_info                *sfe_info = NULL;
+	struct cam_hw_intf                *sfe_hw_intf = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct platform_device            *pdev = NULL;
+	int                                rc = 0;
+
+	pdev = to_platform_device(dev);
+	sfe_hw_intf = platform_get_drvdata(pdev);
+	if (!sfe_hw_intf) {
+		CAM_ERR(CAM_SFE, "Error! No data in pdev");
+		return;
+	}
+
+	CAM_DBG(CAM_SFE, "SFE component unbound type %d index %d",
+		sfe_hw_intf->hw_type, sfe_hw_intf->hw_idx);
+
+	if (sfe_hw_intf->hw_idx < CAM_SFE_HW_NUM_MAX)
+		cam_sfe_hw_list[sfe_hw_intf->hw_idx].hw_intf = NULL;
+
+	sfe_info = sfe_hw_intf->hw_priv;
+	if (!sfe_info) {
+		CAM_ERR(CAM_SFE, "HW data is NULL");
+		goto free_sfe_hw_intf;
+	}
+
+	core_info = (struct cam_sfe_hw_core_info *)sfe_info->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_SFE, "core data NULL");
+		goto deinit_soc;
+	}
+
+	rc = cam_sfe_core_deinit(core_info, core_info->sfe_hw_info);
+	if (rc < 0)
+		CAM_ERR(CAM_SFE, "Failed to deinit core rc=%d", rc);
+
+	kfree(sfe_info->core_info);
+
+deinit_soc:
+	rc = cam_sfe_deinit_soc_resources(&sfe_info->soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_SFE, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&sfe_info->hw_mutex);
+	kfree(sfe_info);
+
+	CAM_DBG(CAM_SFE, "SFE%d remove successful", sfe_hw_intf->hw_idx);
+
+free_sfe_hw_intf:
+	kfree(sfe_hw_intf);
+}
+
+const static struct component_ops cam_sfe_component_ops = {
+	.bind = cam_sfe_component_bind,
+	.unbind = cam_sfe_component_unbind,
+};
+
+void cam_sfe_get_num_hws(uint32_t *sfe_num)
+{
+	if (sfe_num)
+		*sfe_num = g_num_sfe_hws;
+	else
+		CAM_ERR(CAM_SFE, "Invalid argument, g_num_sfe_hws: %u", g_num_sfe_hws);
+}
+
+int cam_sfe_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_SFE, "Adding SFE component");
+	g_num_sfe_hws++;
+
+	rc = component_add(&pdev->dev, &cam_sfe_component_ops);
+	if (rc)
+		CAM_ERR(CAM_SFE, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_sfe_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_sfe_component_ops);
+	return 0;
+}
+
+int cam_sfe_hw_init(struct cam_isp_hw_intf_data **sfe_hw, uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_sfe_hw_list[hw_idx].hw_intf) {
+		*sfe_hw = &cam_sfe_hw_list[hw_idx];
+		rc = 0;
+	} else {
+		*sfe_hw = NULL;
+		rc = -ENODEV;
+	}
+
+	return rc;
+}
+
+static const struct of_device_id cam_sfe_dt_match[] = {
+	{
+		.compatible = "qcom,sfe680",
+		.data = &cam_sfe680_hw_info,
+	},
+	{
+		.compatible = "qcom,sfe780",
+		.data = &cam_sfe780_hw_info,
+	},
+	{
+		.compatible = "qcom,sfe860",
+		.data = &cam_sfe860_hw_info,
+	},
+	{
+		.compatible = "qcom,sfe880",
+		.data = &cam_sfe880_hw_info,
+	},
+	{
+		.compatible = "qcom,sfe-lite690",
+		.data = &cam_sfe_lite_690_hw_info,
+	},
+	{
+		.compatible = "qcom,sfe-lite692",
+		.data = &cam_sfe_lite_692_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_sfe_dt_match);
+
+struct platform_driver cam_sfe_driver = {
+	.probe = cam_sfe_probe,
+	.remove = cam_sfe_remove,
+	.driver = {
+		.name = "cam_sfe",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_sfe_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_sfe_init_module(void)
+{
+	return platform_driver_register(&cam_sfe_driver);
+}
+
+
+void cam_sfe_exit_module(void)
+{
+	platform_driver_unregister(&cam_sfe_driver);
+}
+
+MODULE_DESCRIPTION("CAM SFE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_DEV_H_
+#define _CAM_SFE_DEV_H_
+
+/**
+ * @brief : API to register SFE hw to platform framework.
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_init_module(void);
+
+/**
+ * @brief : API to remove SFE  Hw from platform framework.
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+void cam_sfe_exit_module(void);
+
+#endif /* _CAM_SFE_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_lite690.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_lite690.h
@@ -0,0 +1,220 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_LITE_690_H_
+#define _CAM_SFE_LITE_690_H_
+#include "cam_sfe_core.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+
+
+static struct cam_sfe_top_debug_info sfe_lite_690_clc_dbg_module_info[CAM_SFE_TOP_DBG_REG_MAX][8] = {
+	SFE_DBG_INFO_ARRAY_4bit(
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	SFE_DBG_INFO_ARRAY_4bit(
+		"SFE_LITE vld/rdy/idle",
+		"SFE_LITE vld/rdy/idle",
+		"SFE_LITE vld/rdy/idle",
+		"SFE_LITE vld/rdy/idle",
+		"SFE_LITE vld/rdy/idle",
+		"SFE_LITE vld/rdy/idle",
+		"SFE_LITE vld/rdy/idle",
+		"SFE_LITE vld/rdy/idle"
+	),
+};
+
+static struct cam_sfe_top_common_reg_offset  sfe_lite_690_top_commong_reg  = {
+	.hw_version                    = 0x00000000,
+	.core_cgc_ctrl                 = 0x00000004,
+	.ahb_clk_ovd                   = 0x00000008,
+	.top_debug_cfg                 = 0x00000028,
+	.lcr_supported                 = false,
+	.ir_supported                  = false,
+	.qcfa_only                     = false,
+	.num_debug_registers           = 2,
+	.top_cc_test_bus_supported     = false,
+	.top_debug = {
+		0x00000020,
+		0x00000024,
+	},
+};
+
+static struct cam_sfe_path_common_reg_data sfe_690_rd_top_reg_data = {
+	.sof_irq_mask                  = 0x1,
+	.eof_irq_mask                  = 0x2,
+	.subscribe_irq_mask            = 0x6,
+};
+
+
+static struct cam_sfe_top_common_reg_data sfe_lite_690_top_common_reg_data = {
+	.top_debug_cfg_en              = 0x1,
+};
+
+static struct cam_sfe_top_hw_info sfe_lite_690_top_hw_info = {
+	.common_reg = &sfe_lite_690_top_commong_reg,
+	.common_reg_data = &sfe_lite_690_top_common_reg_data,
+	.rd_top_reg_data = &sfe_690_rd_top_reg_data,
+	.num_inputs = 1,
+	.input_type = {
+		CAM_SFE_RD_VER_1_0,
+	},
+	.num_clc_module  = 2,
+	.clc_dbg_mod_info = &sfe_lite_690_clc_dbg_module_info,
+};
+
+static struct cam_irq_register_set sfe_lite_690_bus_rd_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00000104,
+		.clear_reg_offset  = 0x00000108,
+		.status_reg_offset = 0x00000110,
+		.set_reg_offset    = 0x00000118,
+	},
+};
+
+static struct cam_sfe_bus_rd_constraint_error_desc
+	sfe_lite_690_bus_rd_cons_error_desc[CAM_SFE_BUS_RD_CONS_ERR_MAX] = {
+	{
+		.bitmask    = BIT(0),
+		.error_desc = "Image Addr Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(1),
+		.error_desc = "Ubwc Addr Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(2),
+		.error_desc = "Stride Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(3),
+		.error_desc = "Y Unit Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(4),
+		.error_desc = "X Unit Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(5),
+		.error_desc = "Image width Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(6),
+		.error_desc = "Image height Unalign Latch",
+	},
+	{
+		.bitmask    = BIT(7),
+		.error_desc = "Meta Stride Unalign Latch",
+	},
+};
+
+static struct cam_sfe_bus_rd_constraint_error_info sfe_lite_690_bus_rd_constraint_error_info = {
+	.constraint_error_list = sfe_lite_690_bus_rd_cons_error_desc,
+	.num_cons_err          = 8,
+};
+
+static struct cam_sfe_bus_rd_hw_info sfe_lite_690_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00000500,
+		.misr_reset                   = 0x0000051C,
+		.pwr_iso_cfg                  = 0x00000524,
+		.input_if_cmd                 = 0x00000514,
+		.test_bus_ctrl                = 0x0000052C,
+		.security_cfg                 = 0x00000520,
+		.cons_violation_status        = 0x00000534,
+		.irq_reg_info = {
+			.num_registers = 1,
+			.irq_reg_set = sfe_lite_690_bus_rd_irq_reg,
+			.global_irq_cmd_offset = 0x0000050C,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+	},
+	.num_client = 1,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x00000550,
+			.image_addr               = 0x00000558,
+			.buf_width                = 0x0000055C,
+			.buf_height               = 0x00000560,
+			.stride                   = 0x00000564,
+			.unpacker_cfg             = 0x00000568,
+			.latency_buf_allocation   = 0x0000057C,
+			.system_cache_cfg         = 0x0000059C,
+			.debug_status_cfg         = 0x00000590,
+			.debug_status_0           = 0x00000594,
+			.debug_status_1           = 0x00000598,
+			.name                     = "Fetch0",
+		},
+	},
+	.num_bus_rd_resc = 1,
+	.sfe_bus_rd_info = {
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI0,
+			.mid[0] = 0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.max_clk_threshold = 600000000,
+			.nom_clk_threshold = 600000000,
+			.min_clk_threshold = 480000000,
+			.bytes_per_clk     = 2,
+		},
+	},
+	.top_irq_shift = 0x0,
+	/*
+	 * Refer to CAMNOC HPG for the updated value for a given target
+	 * 48 OTs, 2 SFEs each with 3 RDs, 48 / 6 = 8
+	 * We can allocate 256 * 8 = 2048 bytes. 256 bytes being
+	 * the minimum
+	 */
+	.latency_buf_allocation = 2048,
+	.sys_cache_default_val  = 0x20,
+	.irq_err_mask           = 0x9,
+	.constraint_error_info  = &sfe_lite_690_bus_rd_constraint_error_info,
+	.rd_only                = true,
+};
+
+static struct cam_irq_register_set sfe_lite_690_top_irq_reg_set[1] = {
+	{
+		.mask_reg_offset   = 0x00000010,
+		.clear_reg_offset  = 0x00000014,
+		.status_reg_offset = 0x00000018,
+		.set_reg_offset    = 0x0000001C,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+};
+
+static struct cam_irq_controller_reg_info sfe_lite_690_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = sfe_lite_690_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x0000000C,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+struct cam_sfe_hw_info cam_sfe_lite_690_hw_info = {
+	.irq_reg_info                  = &sfe_lite_690_top_irq_reg_info,
+
+	/*SFE lite does not have support of bus write engine*/
+	.bus_wr_version                = 0x0,
+
+	.bus_rd_version                = CAM_SFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &sfe_lite_690_bus_rd_hw_info,
+
+	.top_version                   = CAM_SFE_TOP_VER_1_0,
+	.top_hw_info                   = &sfe_lite_690_top_hw_info,
+};
+
+#endif /* _CAM_SFE_LITE_690_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_lite692.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_lite692.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_LITE_692_H_
+#define _CAM_SFE_LITE_692_H_
+#include "cam_sfe_core.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+
+
+struct cam_sfe_hw_info cam_sfe_lite_692_hw_info = {
+	.irq_reg_info                  = &sfe_lite_690_top_irq_reg_info,
+
+	/*SFE lite does not have support of bus write engine*/
+	.bus_wr_version                = 0x0,
+
+	.bus_rd_version                = CAM_SFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &sfe_lite_690_bus_rd_hw_info,
+
+	.top_version                   = CAM_SFE_TOP_VER_1_0,
+	.top_hw_info                   = &sfe_lite_690_top_hw_info,
+};
+
+#endif /* _CAM_SFE_LITE_692_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.c
@@ -0,0 +1,268 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_cpas_api.h"
+#include "cam_sfe_soc.h"
+#include "cam_debug_util.h"
+
+static int cam_sfe_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_sfe_soc_private       *soc_private = soc_info->soc_private;
+	struct platform_device           *pdev = soc_info->pdev;
+	uint32_t                          num_pid = 0;
+	int                               i, rc = 0;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Error get DT properties failed rc=%d", rc);
+		goto end;
+	}
+
+	rc = of_property_read_u32(pdev->dev.of_node, "rt-wrapper-base",
+		&soc_private->rt_wrapper_base);
+	if (rc) {
+		soc_private->rt_wrapper_base = 0;
+		CAM_DBG(CAM_ISP, "rc: %d Error reading rt_wrapper_base for core_idx: %u",
+			rc, soc_info->index);
+		rc = 0;
+	}
+
+	soc_private->num_pid = 0;
+	num_pid = of_property_count_u32_elems(pdev->dev.of_node, "cam_hw_pid");
+	CAM_DBG(CAM_SFE, "sfe:%d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_ISP_HW_MAX_PID_VAL)
+		goto end;
+
+	for (i = 0; i < num_pid; i++)
+		of_property_read_u32_index(pdev->dev.of_node, "cam_hw_pid", i,
+			&soc_private->pid[i]);
+
+	soc_private->num_pid = num_pid;
+end:
+	return rc;
+}
+
+static int cam_sfe_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler_func, void *data)
+{
+	int rc = 0, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler_func, &(irq_data[0]));
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"Error Request platform resource failed rc=%d", rc);
+
+	return rc;
+}
+
+static int cam_sfe_release_platform_resource(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"Error Release platform resource failed rc=%d", rc);
+
+	return rc;
+}
+
+int cam_sfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler_func, void *irq_data)
+{
+	int rc = 0;
+	struct cam_sfe_soc_private       *soc_private;
+	struct cam_cpas_register_params   cpas_register_param;
+
+	soc_private = kzalloc(sizeof(struct cam_sfe_soc_private),
+		GFP_KERNEL);
+	if (!soc_private)
+		return -ENOMEM;
+
+	soc_info->soc_private = soc_private;
+	rc = cam_cpas_get_cpas_hw_version(&soc_private->cpas_version);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Error! Invalid cpas version rc=%d", rc);
+		goto free_soc_private;
+	}
+	soc_info->hw_version = soc_private->cpas_version;
+
+	rc = cam_sfe_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE, "Error Get DT properties failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	rc = cam_cpas_query_drv_enable(NULL, &soc_info->is_clk_drv_en);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Failed to query DRV enable rc:%d", rc);
+		goto free_soc_private;
+	}
+
+	rc = cam_sfe_request_platform_resource(soc_info,
+		irq_handler_func, irq_data);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE,
+			"Error Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	strscpy(cpas_register_param.identifier, "sfe",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	cpas_register_param.cam_cpas_client_cb = NULL;
+	cpas_register_param.userdata = soc_info;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	} else {
+		soc_private->cpas_handle = cpas_register_param.client_handle;
+	}
+
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+	return rc;
+}
+
+int cam_sfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_sfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_SFE, "Error soc_info NULL");
+		return -ENODEV;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_SFE, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_SFE, "CPAS unregistration failed rc=%d", rc);
+
+	rc = cam_sfe_release_platform_resource(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_SFE,
+			"Error Release platform resources failed rc=%d", rc);
+
+	kfree(soc_private);
+	return rc;
+}
+
+int cam_sfe_enable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool rd_path_only)
+{
+	int                               rc = 0;
+	struct cam_sfe_soc_private       *soc_private;
+	struct cam_ahb_vote               ahb_vote;
+	struct cam_axi_vote               axi_vote = {0};
+
+	if (!soc_info) {
+		CAM_ERR(CAM_SFE, "Error! Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type       = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_SFE_NRDI;
+	if(rd_path_only)
+		axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	else
+		axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_RT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_RT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_RT_AXI_BW;
+
+	rc = cam_cpas_start(soc_private->cpas_handle,
+			&ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "CPAS start failed rc=%d", rc);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_cpas_query_drv_enable(NULL, &soc_info->is_clk_drv_en);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to query DRV enable rc:%d", rc);
+		return rc;
+	}
+
+	/*
+	 * using sfe index - assuming csid and sfe are one to one map on chipsets where
+	 * cesta is present.
+	 */
+	rc = cam_soc_util_enable_platform_resource(soc_info,
+		(soc_info->is_clk_drv_en ? soc_info->index : CAM_CLK_SW_CLIENT_IDX), true,
+		soc_info->lowest_clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Enable platform failed rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_sfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	return -EPERM;
+}
+
+int cam_sfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	return -EPERM;
+}
+
+int cam_sfe_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_sfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_SFE, "Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info,
+		(soc_info->is_clk_drv_en ? soc_info->index : CAM_CLK_SW_CLIENT_IDX), true, true);
+	if (rc)
+		CAM_ERR(CAM_SFE, "Disable platform failed rc=%d", rc);
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_SFE, "CPAS stop failed rc=%d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.h
@@ -0,0 +1,114 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_SOC_H_
+#define _CAM_SFE_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_isp_hw.h"
+
+/*
+ * struct cam_sfe_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to SFE HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ * @cpas_version:            CPAS version
+ * @* @rt_wrapper_base:      Base address of the RT-Wrapper if the hw is in rt-wrapper
+ * @num_pid:                 Number of pids of sfe
+ * @pid:                     SFE pid values list
+ */
+struct cam_sfe_soc_private {
+	uint32_t    cpas_handle;
+	uint32_t    cpas_version;
+	uint32_t    rt_wrapper_base;
+	uint32_t    num_pid;
+	uint32_t    pid[CAM_ISP_HW_MAX_PID_VAL];
+};
+
+/*
+ * cam_sfe_init_soc_resources()
+ *
+ * @Brief:                   Initialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ * @handler:                 Irq handler function pointer
+ * @irq_data:                Irq handler function Callback data
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t sfe_irq_handler, void *irq_data);
+
+/*
+ * cam_sfe_deinit_soc_resources()
+ *
+ * @Brief:                   Deinitialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_sfe_enable_soc_resources()
+ *
+ * @brief:                   Enable regulator, irq resources, Clocks
+ *
+ * @soc_info:                Device soc information
+ * @rd_path_only:            Indicate whether hw has only read path
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_enable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool rd_path_only);
+
+/*
+ * cam_sfe_disable_soc_resources()
+ *
+ * @brief:                   Disable regulator, irq resources, Clocks
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_sfe_soc_enable_clk()
+ *
+ * @brief:                   Enable clock wsfe given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+extern int cam_sfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+/*
+ * cam_sfe_soc_disable_clk()
+ *
+ * @brief:                   Disable clock wsfe given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+#endif /* _CAM_SFE_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus.c
@@ -0,0 +1,168 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+#include "cam_sfe_bus_wr.h"
+#include "cam_debug_util.h"
+
+int cam_sfe_bus_init(
+	uint32_t                       bus_version,
+	int                            bus_type,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *bus_hw_info,
+	void                          *sfe_irq_controller,
+	struct cam_sfe_bus           **sfe_bus)
+{
+	int rc = -ENODEV;
+
+	switch (bus_type) {
+	case BUS_TYPE_SFE_WR:
+		switch (bus_version) {
+		case CAM_SFE_BUS_WR_VER_1_0:
+			rc = cam_sfe_bus_wr_init(soc_info, hw_intf,
+				bus_hw_info, sfe_irq_controller, sfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Unsupported Bus WR Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	case BUS_TYPE_SFE_RD:
+		switch (bus_version) {
+		case CAM_SFE_BUS_RD_VER_1_0:
+			rc = cam_sfe_bus_rd_init(soc_info, hw_intf,
+				bus_hw_info, sfe_irq_controller, sfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Unsupported Bus RD Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Unsupported Bus type %d", bus_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_sfe_bus_deinit(
+	uint32_t              bus_version,
+	int                   bus_type,
+	struct cam_sfe_bus  **sfe_bus)
+{
+	int rc = -ENODEV;
+
+	switch (bus_type) {
+	case BUS_TYPE_SFE_WR:
+		switch (bus_version) {
+		case CAM_SFE_BUS_WR_VER_1_0:
+			rc = cam_sfe_bus_wr_deinit(sfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Unsupported Bus WR Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	case BUS_TYPE_SFE_RD:
+		switch (bus_version) {
+		case CAM_SFE_BUS_RD_VER_1_0:
+			rc = cam_sfe_bus_rd_deinit(sfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Unsupported Bus RD Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Unsupported Bus type %d", bus_type);
+		break;
+	}
+
+	return rc;
+}
+
+static inline int __cam_sfe_bus_validate_alloc_type(
+	uint32_t alloc_type) {
+
+	if ((alloc_type >= CACHE_ALLOC_NONE) &&
+		(alloc_type <= CACHE_ALLOC_TBH_ALLOC))
+		return 1;
+	else
+		return 0;
+}
+
+void cam_sfe_bus_parse_cache_cfg(
+	bool is_read,
+	uint32_t debug_val,
+	struct cam_sfe_bus_cache_dbg_cfg *dbg_cfg)
+{
+	uint32_t scratch_alloc_shift = 0, buf_alloc_shift = 0;
+	uint32_t scratch_cfg, buf_cfg, alloc_type;
+
+	if (debug_val == DISABLE_CACHING_FOR_ALL) {
+		dbg_cfg->disable_all = true;
+		goto end;
+	}
+
+	if (is_read) {
+		scratch_alloc_shift = CACHE_SCRATCH_RD_ALLOC_SHIFT;
+		buf_alloc_shift = CACHE_BUF_RD_ALLOC_SHIFT;
+	} else {
+		scratch_alloc_shift = CACHE_SCRATCH_WR_ALLOC_SHIFT;
+		buf_alloc_shift = CACHE_BUF_WR_ALLOC_SHIFT;
+	}
+
+	scratch_cfg = (debug_val >> CACHE_SCRATCH_DEBUG_SHIFT) & 0xF;
+	buf_cfg = (debug_val >> CACHE_BUF_DEBUG_SHIFT) & 0xF;
+	dbg_cfg->print_cache_cfg = (bool)(debug_val >> CACHE_BUF_PRINT_DBG_SHIFT);
+
+	/* Check for scratch cfg */
+	if (scratch_cfg == 0xF) {
+		dbg_cfg->disable_for_scratch = true;
+	} else if (scratch_cfg == 1) {
+		alloc_type =
+			(debug_val >> scratch_alloc_shift) & 0xF;
+		if (__cam_sfe_bus_validate_alloc_type(alloc_type)) {
+			dbg_cfg->scratch_alloc = alloc_type;
+			dbg_cfg->scratch_dbg_cfg = true;
+		}
+		dbg_cfg->disable_for_scratch = false;
+	} else {
+		/* Reset to default */
+		dbg_cfg->disable_for_scratch = false;
+		dbg_cfg->scratch_dbg_cfg = false;
+	}
+
+	/* Check for buf cfg */
+	if (buf_cfg == 0xF) {
+		dbg_cfg->disable_for_buf = true;
+	} else if (buf_cfg == 1) {
+		alloc_type =
+			(debug_val >> buf_alloc_shift) & 0xF;
+		if (__cam_sfe_bus_validate_alloc_type(alloc_type)) {
+			dbg_cfg->buf_alloc = alloc_type;
+			dbg_cfg->buf_dbg_cfg = true;
+		}
+		dbg_cfg->disable_for_buf = false;
+	} else {
+		/* Reset to default */
+		dbg_cfg->disable_for_buf = false;
+		dbg_cfg->buf_dbg_cfg = false;
+	}
+
+	/* Reset to default */
+	dbg_cfg->disable_all = false;
+
+end:
+	return;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.c
@@ -0,0 +1,2316 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+#include "cam_sfe_core.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_common_util.h"
+
+static const char drv_name[] = "sfe_bus_rd";
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	(sizeof(struct cam_sfe_bus_rd_reg_offset_bus_client)/4)
+
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+#define CAM_SFE_BUS_RD_PAYLOAD_MAX         16
+
+enum cam_sfe_bus_rd_unpacker_format {
+	BUS_RD_UNPACKER_FMT_PLAIN_128             = 0x0,
+	BUS_RD_UNPACKER_FMT_PLAIN_8               = 0x1,
+	BUS_RD_UNPACKER_FMT_PLAIN_16_10BPP        = 0x2,
+	BUS_RD_UNPACKER_FMT_PLAIN_16_12BPP        = 0x3,
+	BUS_RD_UNPACKER_FMT_PLAIN_16_14BPP        = 0x4,
+	BUS_RD_UNPACKER_FMT_PLAIN_32_20BPP        = 0x5,
+	BUS_RD_UNPACKER_FMT_ARGB_10               = 0x6,
+	BUS_RD_UNPACKER_FMT_ARGB_12               = 0x7,
+	BUS_RD_UNPACKER_FMT_ARGB_14               = 0x8,
+	BUS_RD_UNPACKER_FMT_PLAIN_32              = 0x9,
+	BUS_RD_UNPACKER_FMT_PLAIN_64              = 0xA,
+	BUS_RD_UNPACKER_FMT_TP_10                 = 0xB,
+	BUS_RD_UNPACKER_FMT_MIPI8                 = 0xC,
+	BUS_RD_UNPACKER_FMT_MIPI10                = 0xD,
+	BUS_RD_UNPACKER_FMT_MIPI12                = 0xE,
+	BUS_RD_UNPACKER_FMT_MIPI14                = 0xF,
+	BUS_RD_UNPACKER_FMT_PLAIN_16_16BPP        = 0x10,
+	BUS_RD_UNPACKER_FMT_PLAIN_128_ODD_EVEN    = 0x11,
+	BUS_RD_UNPACKER_FMT_PLAIN_8_ODD_EVEN      = 0x12,
+	BUS_RD_UNPACKER_FMT_MAX                   = 0x13,
+};
+
+struct cam_sfe_bus_rd_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_sfe_bus_rd_reg_offset_common    *common_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+	void                                       *bus_irq_controller;
+	void                                       *sfe_irq_controller;
+	spinlock_t                                  spin_lock;
+	struct list_head                            free_payload_list;
+	struct cam_sfe_bus_rd_irq_evt_payload       evt_payload[
+		CAM_SFE_BUS_RD_PAYLOAD_MAX];
+	cam_hw_mgr_event_cb_func                    event_cb;
+	bool                                        err_irq_subscribe;
+	uint32_t                                    sfe_debug_cfg;
+	uint32_t                                    irq_err_mask;
+
+	struct cam_sfe_bus_cache_dbg_cfg            cache_dbg_cfg;
+	bool                                        cons_chk_en_avail;
+};
+
+struct cam_sfe_bus_rd_rm_resource_data {
+	struct cam_sfe_bus_rd_common_data            *common_data;
+	struct cam_sfe_bus_rd_reg_offset_bus_client  *hw_regs;
+	void                *ctx;
+	uint32_t             index;
+	uint32_t             min_vbi;
+	uint32_t             fs_mode;
+	uint32_t             hbi_count;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	uint32_t             latency_buf_allocation;
+	uint32_t             unpacker_cfg;
+	uint32_t             burst_len;
+	uint32_t             en_cfg;
+	uint32_t             input_if_cmd;
+	uint32_t             cache_cfg;
+	uint32_t             current_scid;
+	uint32_t             offset;
+	bool                 enable_caching;
+	bool                 enable_disable_cfg_done;
+};
+
+struct cam_sfe_bus_rd_data {
+	uint32_t                           bus_rd_type;
+	struct cam_sfe_bus_rd_common_data *common_data;
+	struct cam_sfe_bus_rd_priv        *bus_priv;
+
+	uint32_t                           num_rm;
+	struct cam_isp_resource_node      *rm_res[PLANE_MAX];
+	uint32_t                           format;
+	uint32_t                           max_width;
+	uint32_t                           max_height;
+	struct cam_cdm_utils_ops          *cdm_util_ops;
+	void                              *priv;
+	uint32_t                           secure_mode;
+	uint32_t                           fs_sync_enable;
+	bool                               is_offline;
+};
+
+struct cam_sfe_bus_rd_priv {
+	struct cam_sfe_bus_rd_common_data   common_data;
+	uint32_t                            num_client;
+	uint32_t                            num_bus_rd_resc;
+
+	struct cam_isp_resource_node  bus_client[
+		CAM_SFE_BUS_RD_MAX_CLIENTS];
+	struct cam_isp_resource_node  sfe_bus_rd[
+		CAM_SFE_BUS_RD_MAX];
+	struct cam_sfe_bus_rd_hw_info      *bus_rd_hw_info;
+	int                                 irq_handle;
+	int                                 error_irq_handle;
+	void                               *tasklet_info;
+	uint32_t                            top_irq_shift;
+	uint32_t                            latency_buf_allocation;
+	uint32_t                            sys_cache_default_cfg;
+	uint32_t                            max_clk_threshold;
+	uint32_t                            nom_clk_threshold;
+	uint32_t                            min_clk_threshold;
+	uint32_t                            bytes_per_clk;
+	bool                                rd_only;
+};
+
+static void cam_sfe_bus_rd_pxls_to_bytes(uint32_t pxls, uint32_t fmt,
+	uint32_t *bytes)
+{
+	switch (fmt) {
+	case BUS_RD_UNPACKER_FMT_PLAIN_128:
+		*bytes = pxls * 16;
+		break;
+	case BUS_RD_UNPACKER_FMT_PLAIN_8:
+	case BUS_RD_UNPACKER_FMT_PLAIN_8_ODD_EVEN:
+	case BUS_RD_UNPACKER_FMT_PLAIN_16_10BPP:
+	case BUS_RD_UNPACKER_FMT_PLAIN_16_12BPP:
+	case BUS_RD_UNPACKER_FMT_PLAIN_16_14BPP:
+	case BUS_RD_UNPACKER_FMT_PLAIN_16_16BPP:
+	case BUS_RD_UNPACKER_FMT_ARGB_10:
+	case BUS_RD_UNPACKER_FMT_ARGB_12:
+	case BUS_RD_UNPACKER_FMT_ARGB_14:
+		*bytes = pxls * 2;
+		break;
+	case BUS_RD_UNPACKER_FMT_PLAIN_32_20BPP:
+	case BUS_RD_UNPACKER_FMT_PLAIN_32:
+		*bytes = pxls * 4;
+		break;
+	case BUS_RD_UNPACKER_FMT_PLAIN_64:
+		*bytes = pxls * 8;
+		break;
+	case BUS_RD_UNPACKER_FMT_TP_10:
+		*bytes = ALIGNUP(pxls, 3) * 4 / 3;
+		break;
+	case BUS_RD_UNPACKER_FMT_MIPI8:
+		*bytes = pxls;
+		break;
+	case BUS_RD_UNPACKER_FMT_MIPI10:
+		*bytes = ALIGNUP(pxls * 5, 4) / 4;
+		break;
+	case BUS_RD_UNPACKER_FMT_MIPI12:
+		*bytes = ALIGNUP(pxls * 3, 2) / 2;
+		break;
+	case BUS_RD_UNPACKER_FMT_MIPI14:
+		*bytes = ALIGNUP(pxls * 7, 4) / 4;
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Invalid unpacker_fmt:%d", fmt);
+		break;
+	}
+}
+
+static enum cam_sfe_bus_rd_unpacker_format
+	cam_sfe_bus_get_unpacker_fmt(uint32_t unpack_fmt)
+{
+	switch (unpack_fmt) {
+	case CAM_FORMAT_PLAIN128:
+		return BUS_RD_UNPACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_PLAIN8:
+		return BUS_RD_UNPACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_PLAIN16_10:
+		return BUS_RD_UNPACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return BUS_RD_UNPACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return BUS_RD_UNPACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN32_20:
+		return BUS_RD_UNPACKER_FMT_PLAIN_32_20BPP;
+	case CAM_FORMAT_ARGB_10:
+		return BUS_RD_UNPACKER_FMT_ARGB_10;
+	case CAM_FORMAT_ARGB_12:
+		return BUS_RD_UNPACKER_FMT_ARGB_12;
+	case CAM_FORMAT_ARGB_14:
+		return BUS_RD_UNPACKER_FMT_ARGB_14;
+	case CAM_FORMAT_PLAIN32:
+	case CAM_FORMAT_ARGB:
+		return BUS_RD_UNPACKER_FMT_PLAIN_32;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_ARGB_16:
+	case CAM_FORMAT_PD10:
+		return BUS_RD_UNPACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_TP10:
+		return BUS_RD_UNPACKER_FMT_TP_10;
+	case CAM_FORMAT_MIPI_RAW_8:
+		return BUS_RD_UNPACKER_FMT_MIPI8;
+	case CAM_FORMAT_MIPI_RAW_10:
+		return BUS_RD_UNPACKER_FMT_MIPI10;
+	case CAM_FORMAT_MIPI_RAW_12:
+		return BUS_RD_UNPACKER_FMT_MIPI12;
+	case CAM_FORMAT_MIPI_RAW_14:
+		return BUS_RD_UNPACKER_FMT_MIPI14;
+	case CAM_FORMAT_PLAIN16_16:
+		return BUS_RD_UNPACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN8_SWAP:
+		return BUS_RD_UNPACKER_FMT_PLAIN_8_ODD_EVEN;
+	default:
+		return BUS_RD_UNPACKER_FMT_MAX;
+	}
+}
+
+static enum cam_sfe_bus_rd_type
+	cam_sfe_bus_get_bus_rd_res_id(uint32_t res_type)
+{
+	switch (res_type) {
+	case CAM_ISP_SFE_IN_RD_0:
+		return CAM_SFE_BUS_RD_RDI0;
+	case CAM_ISP_SFE_IN_RD_1:
+		return CAM_SFE_BUS_RD_RDI1;
+	case CAM_ISP_SFE_IN_RD_2:
+		return CAM_SFE_BUS_RD_RDI2;
+	default:
+		return CAM_SFE_BUS_RD_MAX;
+	}
+}
+
+static int cam_sfe_bus_get_num_rm(
+	enum cam_sfe_bus_rd_type res_type)
+{
+	switch (res_type) {
+	case CAM_SFE_BUS_RD_RDI0:
+	case CAM_SFE_BUS_RD_RDI1:
+	case CAM_SFE_BUS_RD_RDI2:
+		return 1;
+	default:
+		CAM_ERR(CAM_SFE, "Unsupported resource_type %u", res_type);
+		return -EINVAL;
+	}
+}
+
+static int cam_sfe_bus_get_rm_idx(
+	enum cam_sfe_bus_rd_type    sfe_bus_rd_res_id,
+	enum cam_sfe_bus_plane_type plane)
+{
+	int rm_idx = -1;
+
+	switch (sfe_bus_rd_res_id) {
+	case CAM_SFE_BUS_RD_RDI0:
+		switch (plane) {
+		case PLANE_Y:
+			rm_idx = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_SFE_BUS_RD_RDI1:
+		switch (plane) {
+		case PLANE_Y:
+			rm_idx = 1;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_SFE_BUS_RD_RDI2:
+		switch (plane) {
+		case PLANE_Y:
+			rm_idx = 2;
+			break;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	return rm_idx;
+}
+
+static int cam_sfe_bus_rd_get_evt_payload(
+	struct cam_sfe_bus_rd_common_data      *common_data,
+	struct cam_sfe_bus_rd_irq_evt_payload **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&common_data->spin_lock);
+
+	if (list_empty(&common_data->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE,
+			"No free BUS RD event payload");
+		*evt_payload = NULL;
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&common_data->free_payload_list,
+		struct cam_sfe_bus_rd_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+
+done:
+	spin_unlock(&common_data->spin_lock);
+	return rc;
+}
+
+static int cam_sfe_bus_rd_put_evt_payload(
+	struct cam_sfe_bus_rd_common_data       *common_data,
+	struct cam_sfe_bus_rd_irq_evt_payload  **evt_payload)
+{
+	unsigned long flags;
+
+	if (!common_data) {
+		CAM_ERR(CAM_SFE, "Invalid param common_data NULL");
+		return -EINVAL;
+	}
+
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_SFE, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&common_data->spin_lock, flags);
+		list_add_tail(&(*evt_payload)->list,
+			&common_data->free_payload_list);
+	spin_unlock_irqrestore(&common_data->spin_lock, flags);
+
+	*evt_payload = NULL;
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_handle_irq(
+	uint32_t    evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	struct cam_sfe_bus_rd_priv *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	CAM_DBG(CAM_SFE, "Top Bus RD IRQ Received");
+
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller, CAM_IRQ_EVT_GROUP_0);
+
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_sfe_bus_rd_print_dimensions(
+	enum cam_sfe_bus_rd_type     bus_rd_res_id,
+	struct cam_sfe_bus_rd_priv  *bus_rd_priv)
+{
+	int i;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_sfe_bus_rd_data             *rsrc_data = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data *rm_data;
+	struct cam_sfe_bus_rd_common_data      *common_data;
+
+	rsrc_node = &bus_rd_priv->sfe_bus_rd[bus_rd_res_id];
+	rsrc_data = rsrc_node->res_priv;
+
+	for (i = 0; i < rsrc_data->num_rm; i++) {
+		rm_data = rsrc_data->rm_res[i]->res_priv;
+
+		if (!rm_data) {
+			CAM_WARN(CAM_SFE, "Unsupported SFE RD %d", bus_rd_res_id);
+			continue;
+		}
+
+		common_data = rm_data->common_data;
+		CAM_INFO(CAM_SFE,
+			"SFE: %u RD: %u res_id: 0x%x width: 0x%x height: 0x%x stride: 0x%x unpacker: 0x%x addr: 0x%x",
+			bus_rd_priv->common_data.core_index, i, rsrc_node->res_id,
+			rm_data->width, rm_data->height, rm_data->stride, rm_data->unpacker_cfg,
+			cam_io_r_mb(common_data->mem_base + rm_data->hw_regs->image_addr));
+	}
+
+	return 0;
+}
+static void cam_sfe_bus_rd_print_constraint_error(struct cam_sfe_bus_rd_priv *bus_priv,
+	uint32_t cons_err, uint8_t *rm_name)
+{
+	struct cam_sfe_bus_rd_constraint_error_info *cons_err_info;
+	int i;
+
+	cons_err_info = bus_priv->bus_rd_hw_info->constraint_error_info;
+	for (i = 0; i < cons_err_info->num_cons_err; i++) {
+		if (cons_err_info->constraint_error_list[i].bitmask &
+			cons_err)
+			CAM_ERR(CAM_SFE, "RM: %s Error_desc: %s", rm_name,
+				cons_err_info->constraint_error_list[i].error_desc);
+	}
+}
+
+static void cam_sfe_bus_rd_get_constraint_error(struct cam_sfe_bus_rd_priv *bus_priv,
+	uint32_t constraint_err_status)
+{
+	struct cam_isp_resource_node *sfe_bus_rd = NULL;
+	struct cam_sfe_bus_rd_data   *sfe_bus_rd_data = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data *rm_rsrc_data = NULL;
+	uint32_t bus_rd_resc_type, cons_err;
+	uint8_t *rm_name;
+	int i, j;
+
+	for (i = 0; i < bus_priv->num_bus_rd_resc; i++) {
+		bus_rd_resc_type =
+			bus_priv->bus_rd_hw_info->sfe_bus_rd_info[i].sfe_bus_rd_type;
+		if (bus_rd_resc_type < 0 ||
+			bus_rd_resc_type >= CAM_SFE_BUS_RD_MAX) {
+			CAM_ERR(CAM_SFE, "Invalid SFE RD resource type:%d",
+				bus_rd_resc_type);
+			return;
+		}
+
+		sfe_bus_rd = &bus_priv->sfe_bus_rd[bus_rd_resc_type];
+		if (!sfe_bus_rd || !sfe_bus_rd->res_priv) {
+			CAM_DBG(CAM_ISP, "SFE bus rd:%d in resc node or data is NULL", i);
+			continue;
+		}
+
+		sfe_bus_rd_data = sfe_bus_rd->res_priv;
+		for (j = 0; j < sfe_bus_rd_data->num_rm; j++) {
+			rm_rsrc_data = sfe_bus_rd_data->rm_res[j]->res_priv;
+			if (!rm_rsrc_data)
+				continue;
+
+			if (!(constraint_err_status & BIT(rm_rsrc_data->index)))
+				continue;
+
+			rm_name = sfe_bus_rd_data->rm_res[j]->res_name;
+			cons_err = cam_io_r_mb(
+				bus_priv->common_data.mem_base +
+				rm_rsrc_data->hw_regs->debug_status_0);
+			if (!cons_err)
+				continue;
+
+			CAM_ERR(CAM_SFE,
+				"Constraint Violation bitflag: 0x%x bus rd resc type: 0x%x",
+				cons_err, bus_rd_resc_type);
+			cam_sfe_bus_rd_print_constraint_error(bus_priv,
+				cons_err, rm_name);
+		}
+	}
+}
+
+static int cam_sfe_bus_acquire_rm(
+	struct cam_sfe_bus_rd_priv             *bus_rd_priv,
+	void                                   *tasklet,
+	void                                   *ctx,
+	enum cam_sfe_bus_rd_type                sfe_bus_rd_res_id,
+	enum cam_sfe_bus_plane_type             plane,
+	struct cam_isp_resource_node          **rm_res,
+	uint32_t                                unpacker_fmt)
+{
+	uint32_t                                rm_idx = 0;
+	struct cam_isp_resource_node           *rm_res_local = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data = NULL;
+
+	*rm_res = NULL;
+
+	rm_idx = cam_sfe_bus_get_rm_idx(sfe_bus_rd_res_id, plane);
+	if (rm_idx < 0 || rm_idx >= bus_rd_priv->num_client) {
+		CAM_ERR(CAM_SFE, "Unsupported SFE RM:%d plane:%d",
+			sfe_bus_rd_res_id, plane);
+		return -EINVAL;
+	}
+
+	rm_res_local = &bus_rd_priv->bus_client[rm_idx];
+	if (rm_res_local->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_DBG(CAM_SFE, "SFE:%u RM:%u res not available state:%d",
+			bus_rd_priv->common_data.core_index, rm_idx,
+			rm_res_local->res_state);
+		return -EALREADY;
+	}
+	rm_res_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rm_res_local->tasklet_info = tasklet;
+
+	rsrc_data = rm_res_local->res_priv;
+	rsrc_data->ctx = ctx;
+	rsrc_data->unpacker_cfg =
+		cam_sfe_bus_get_unpacker_fmt(unpacker_fmt);
+	if (rsrc_data->unpacker_cfg == BUS_RD_UNPACKER_FMT_MAX) {
+		CAM_ERR(CAM_SFE, "SFE:%u RM:%u Invalid unpacker fmt:%u",
+			bus_rd_priv->common_data.core_index, rm_idx, unpacker_fmt);
+		return -EINVAL;
+	}
+
+	rsrc_data->latency_buf_allocation =
+		bus_rd_priv->latency_buf_allocation;
+	rsrc_data->enable_caching =  false;
+	rsrc_data->enable_disable_cfg_done = false;
+	rsrc_data->offset = 0;
+	/* Default register value */
+	rsrc_data->cache_cfg = 0x20;
+
+	*rm_res = rm_res_local;
+
+	CAM_DBG(CAM_SFE, "SFE:%d RM:%d Acquired",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+	return 0;
+}
+
+static int cam_sfe_bus_release_rm(void          *bus_priv,
+	struct cam_isp_resource_node                *rm_res)
+{
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data =
+		rm_res->res_priv;
+
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->unpacker_cfg = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->enable_caching =  false;
+	rsrc_data->offset = 0;
+
+	rm_res->tasklet_info = NULL;
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_SFE, "SFE:%d RM:%d released",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+	return 0;
+}
+
+static int cam_sfe_bus_start_rm(struct cam_isp_resource_node *rm_res)
+{
+	uint32_t width_in_bytes = 0;
+	struct cam_sfe_bus_rd_rm_resource_data  *rm_data;
+	struct cam_sfe_bus_rd_common_data       *common_data;
+	const uint32_t enable_cons_violation = 11 << 2;
+	uint32_t core_cfg_mask;
+
+	rm_data = rm_res->res_priv;
+	common_data = rm_data->common_data;
+
+	cam_sfe_bus_rd_pxls_to_bytes(rm_data->width,
+		rm_data->unpacker_cfg, &width_in_bytes);
+
+	cam_io_w_mb(width_in_bytes, common_data->mem_base +
+		rm_data->hw_regs->buf_width);
+	cam_io_w_mb(rm_data->height, common_data->mem_base +
+		rm_data->hw_regs->buf_height);
+	cam_io_w_mb(rm_data->stride, common_data->mem_base +
+		rm_data->hw_regs->stride);
+	cam_io_w_mb(rm_data->unpacker_cfg, common_data->mem_base +
+		rm_data->hw_regs->unpacker_cfg);
+	cam_io_w_mb(rm_data->latency_buf_allocation, common_data->mem_base +
+		rm_data->hw_regs->latency_buf_allocation);
+
+	/* Ignore if already configured via CDM */
+	if (!rm_data->enable_disable_cfg_done) {
+		core_cfg_mask = CAM_SFE_BUS_RD_EN_CLIENT_CFG;
+		if (common_data->cons_chk_en_avail)
+			core_cfg_mask |= CAM_SFE_BUS_RD_EN_CONS_CHK_CFG;
+		cam_io_w_mb(core_cfg_mask,
+			common_data->mem_base + rm_data->hw_regs->cfg);
+	}
+
+	/* Enable constraint error detection */
+	cam_io_w_mb(enable_cons_violation,
+		common_data->mem_base + rm_data->hw_regs->debug_status_cfg);
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	CAM_DBG(CAM_SFE,
+		"Start SFE:%d RM:%d offset:0x%X width:%d [in bytes: %u] height:%d unpack_fmt:%d stride:%d latency_buf_alloc:%u",
+		rm_data->common_data->core_index, rm_data->index,
+		rm_data->offset, rm_data->width, width_in_bytes,
+		rm_data->height, rm_data->unpacker_cfg, rm_data->stride,
+		rm_data->latency_buf_allocation);
+
+	return 0;
+}
+
+static int cam_sfe_bus_stop_rm(struct cam_isp_resource_node *rm_res)
+{
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data =
+		rm_res->res_priv;
+	struct cam_sfe_bus_rd_common_data      *common_data =
+		rsrc_data->common_data;
+
+	/* Disable RM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_data->enable_disable_cfg_done = false;
+
+	CAM_DBG(CAM_SFE, "SFE:%d RM:%d stopped",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	return 0;
+}
+
+static int cam_sfe_bus_init_rm_resource(uint32_t index,
+	struct cam_sfe_bus_rd_priv     *bus_rd_priv,
+	struct cam_sfe_bus_rd_hw_info  *bus_rd_hw_info,
+	struct cam_isp_resource_node   *rm_res)
+{
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data;
+	uint8_t *name;
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_rd_rm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_SFE, "Failed to alloc SFE:%d RM res priv",
+			bus_rd_priv->common_data.core_index);
+		return -ENOMEM;
+	}
+	rm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &bus_rd_hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &bus_rd_priv->common_data;
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&rm_res->list);
+
+	rm_res->start = cam_sfe_bus_start_rm;
+	rm_res->stop = cam_sfe_bus_stop_rm;
+	rm_res->hw_intf = bus_rd_priv->common_data.hw_intf;
+	name = bus_rd_priv->bus_rd_hw_info->bus_client_reg[index].name;
+	if (name)
+		scnprintf(rm_res->res_name, CAM_ISP_RES_NAME_LEN,
+			"%s", name);
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_rm_resource(
+	struct cam_isp_resource_node    *rm_res)
+{
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data;
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&rm_res->list);
+
+	rm_res->start = NULL;
+	rm_res->stop = NULL;
+	rm_res->top_half_handler = NULL;
+	rm_res->bottom_half_handler = NULL;
+	rm_res->hw_intf = NULL;
+
+	rsrc_data = rm_res->res_priv;
+	rm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_out_done_top_half(
+	uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                 rc = 0, i;
+	struct cam_isp_resource_node           *sfe_rd = NULL;
+	struct cam_sfe_bus_rd_data             *rsrc_data = NULL;
+	struct cam_sfe_bus_rd_irq_evt_payload  *evt_payload;
+
+	sfe_rd = th_payload->handler_priv;
+	if (!sfe_rd) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "No SFE RD resource");
+		return -ENODEV;
+	}
+
+	rsrc_data = sfe_rd->res_priv;
+
+	CAM_DBG(CAM_SFE, "SFE:%d Bus IRQ status_0: 0x%X",
+		rsrc_data->common_data->core_index,
+		th_payload->evt_status_arr[0]);
+
+	rc  = cam_sfe_bus_rd_get_evt_payload(rsrc_data->common_data,
+			&evt_payload);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_SFE,
+			"Failed to get payload for SFE:%d Bus IRQ status_0: 0x%X status_1: 0x%X",
+			rsrc_data->common_data->core_index,
+			th_payload->evt_status_arr[0]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	evt_payload->core_index = rsrc_data->common_data->core_index;
+	evt_payload->evt_id = evt_id;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+	return rc;
+}
+
+static int cam_sfe_bus_rd_out_done_bottom_half(
+	void                *handler_priv,
+	void                *evt_payload_priv)
+{
+	int                                    rc = -EINVAL;
+	uint32_t                               status = 0;
+	struct cam_isp_resource_node          *sfe_rd = handler_priv;
+	struct cam_sfe_bus_rd_data            *rsrc_data = sfe_rd->res_priv;
+	struct cam_sfe_bus_rd_irq_evt_payload *evt_payload = evt_payload_priv;
+
+	status = evt_payload->irq_reg_val[CAM_SFE_IRQ_BUS_RD_REG_STATUS0];
+	cam_sfe_bus_rd_put_evt_payload(rsrc_data->common_data, &evt_payload);
+
+	if (status & CAM_SFE_BUS_RD_IRQ_RUP_DONE)
+		CAM_DBG(CAM_SFE, "Received SFE:%d BUS RD RUP",
+			rsrc_data->common_data->core_index);
+
+	if (status & CAM_SFE_BUS_RD_IRQ_RD0_BUF_DONE)
+		CAM_DBG(CAM_SFE, "Received SFE:%d BUS RD0 BUF DONE",
+			rsrc_data->common_data->core_index);
+
+	if (status & CAM_SFE_BUS_RD_IRQ_RD1_BUF_DONE)
+		CAM_DBG(CAM_SFE, "Received SFE:%d BUS RD1 BUF DONE",
+			rsrc_data->common_data->core_index);
+
+	if (status & CAM_SFE_BUS_RD_IRQ_RD2_BUF_DONE)
+		CAM_DBG(CAM_SFE, "Received SFE:%d BUS RD2 BUF DONE",
+			rsrc_data->common_data->core_index);
+
+	return rc;
+}
+
+static int cam_sfe_bus_rd_handle_err_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int i, rc = 0;
+	struct cam_sfe_bus_rd_priv *bus_priv;
+	struct cam_sfe_bus_rd_irq_evt_payload *evt_payload = NULL;
+
+	bus_priv = th_payload->handler_priv;
+	rc  = cam_sfe_bus_rd_get_evt_payload(
+		&bus_priv->common_data, &evt_payload);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < th_payload->num_registers; i++) {
+		evt_payload->irq_reg_val[i] =
+			th_payload->evt_status_arr[i];
+		CAM_DBG(CAM_SFE, "SFE:%d Bus RD IRQ status_%d: 0x%x",
+			bus_priv->common_data.core_index, i,
+			th_payload->evt_status_arr[i]);
+	}
+
+	evt_payload->constraint_violation = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->cons_violation_status);
+
+	if (bus_priv->common_data.irq_err_mask
+		& CAM_SFE_BUS_RD_IRQ_CCIF_VIOLATION) {
+		evt_payload->ccif_violation = cam_io_r_mb(
+			bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->ccif_violation_status);
+	}
+	cam_irq_controller_disable_all(bus_priv->common_data.bus_irq_controller);
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	th_payload->evt_payload_priv = evt_payload;
+	return 0;
+}
+
+static int cam_sfe_bus_rd_get_err_port_info(struct cam_sfe_bus_rd_priv *bus_priv,
+	uint32_t err_status, void **rsrc_data_priv, uint32_t *err_res_id)
+{
+	struct cam_sfe_bus_rd_rm_resource_data *rm_rsrc_data;
+	struct cam_isp_resource_node           *sfe_bus_rd;
+	struct cam_sfe_bus_rd_data             *sfe_bus_rd_data;
+	uint32_t bus_rd_resc_type;
+	int i, j;
+
+	for (i = 0; i < bus_priv->num_bus_rd_resc; i++) {
+		bus_rd_resc_type =
+			bus_priv->bus_rd_hw_info->sfe_bus_rd_info[i].sfe_bus_rd_type;
+		if (bus_rd_resc_type < 0 ||
+			(bus_rd_resc_type >= CAM_SFE_BUS_RD_MAX)) {
+			CAM_ERR(CAM_SFE, "Invalid SFE RD resource type:%d",
+				bus_rd_resc_type);
+			return -EINVAL;
+		}
+
+		sfe_bus_rd = &bus_priv->sfe_bus_rd[bus_rd_resc_type];
+		if (!sfe_bus_rd || !sfe_bus_rd->res_priv)
+			continue;
+
+		if (sfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_STREAMING)
+			continue;
+
+		sfe_bus_rd_data = sfe_bus_rd->res_priv;
+		*rsrc_data_priv = sfe_bus_rd_data->priv;
+		for (j = 0; j < sfe_bus_rd_data->num_rm; j++) {
+			rm_rsrc_data = sfe_bus_rd_data->rm_res[j]->res_priv;
+			if (!rm_rsrc_data)
+				continue;
+
+			if (err_status & BIT(rm_rsrc_data->index)) {
+				*err_res_id = sfe_bus_rd->res_id;
+				return 0;
+			}
+		}
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_rd_handle_err_irq_bottom_half(
+	void  *handler_priv, void *evt_payload_priv)
+{
+	int rc = 0;
+	struct cam_sfe_bus_rd_irq_evt_payload  *evt_payload;
+	struct cam_sfe_bus_rd_priv             *bus_priv;
+	struct cam_sfe_bus_rd_common_data      *common_data = NULL;
+	struct cam_isp_hw_event_info            evt_info;
+	struct cam_isp_hw_error_event_info      err_evt_info;
+	uint32_t status = 0;
+	uint32_t violation_status = 0;
+	void *rsrc_data_priv = NULL;
+	uint32_t bus_rd_res_id = CAM_SFE_BUS_RD_MAX;
+
+	if (!handler_priv || !evt_payload_priv)
+		return -EINVAL;
+
+	bus_priv = (struct cam_sfe_bus_rd_priv *)handler_priv;
+	evt_payload = (struct cam_sfe_bus_rd_irq_evt_payload *)evt_payload_priv;
+	common_data = &bus_priv->common_data;
+	status = evt_payload->irq_reg_val[CAM_SFE_IRQ_BUS_RD_REG_STATUS0];
+
+	if (!(status & bus_priv->common_data.irq_err_mask))
+		return 0;
+
+	if (status & CAM_SFE_BUS_RD_IRQ_CONS_VIOLATION) {
+		CAM_ERR(CAM_SFE, "SFE:[%d] status 0x%x Constraint Violation status 0x%x",
+			bus_priv->common_data.core_index, status,
+			evt_payload->constraint_violation);
+		cam_sfe_bus_rd_get_constraint_error(bus_priv,
+			evt_payload->constraint_violation);
+	}
+
+	if (status & CAM_SFE_BUS_RD_IRQ_CCIF_VIOLATION)
+		CAM_ERR(CAM_SFE, "SFE:[%d] status 0x%x CCIF Violation status 0x%x",
+			bus_priv->common_data.core_index, status,
+			evt_payload->ccif_violation);
+
+	violation_status = evt_payload->constraint_violation |
+		evt_payload->ccif_violation;
+
+	cam_sfe_bus_rd_put_evt_payload(common_data, &evt_payload);
+
+	rc = cam_sfe_bus_rd_get_err_port_info(bus_priv, violation_status,
+			&rsrc_data_priv, &bus_rd_res_id);
+	if (rc < 0)
+		CAM_ERR(CAM_SFE, "Failed to get err port info, violation_status = %d",
+			violation_status);
+
+	if (!common_data->event_cb)
+		return 0;
+
+	evt_info.hw_type = CAM_ISP_HW_TYPE_SFE;
+	evt_info.hw_idx = bus_priv->common_data.core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_SFE_RD;
+	evt_info.res_id = bus_rd_res_id;
+	err_evt_info.err_type = CAM_SFE_IRQ_STATUS_VIOLATION;
+	evt_info.event_data = (void *)&err_evt_info;
+
+	if (!rsrc_data_priv) {
+		CAM_WARN(CAM_SFE,
+			"SFE:[%d] bus rd error notification failed, cb data is NULL",
+			bus_priv->common_data.core_index);
+		return -EINVAL;
+	}
+
+	common_data->event_cb(rsrc_data_priv,
+		CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+	return 0;
+}
+
+static int cam_sfe_bus_subscribe_error_irq(
+	struct cam_sfe_bus_rd_priv          *bus_priv)
+{
+	uint32_t sfe_top_irq_mask[CAM_SFE_IRQ_REGISTERS_MAX] = {0};
+	uint32_t bus_rd_err_irq_mask[CAM_SFE_BUS_RD_IRQ_REGISTERS_MAX] = {0};
+
+	/* Subscribe top IRQ */
+	sfe_top_irq_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	bus_priv->irq_handle = cam_irq_controller_subscribe_irq(
+		bus_priv->common_data.sfe_irq_controller,
+		CAM_IRQ_PRIORITY_0,
+		sfe_top_irq_mask,
+		bus_priv,
+		cam_sfe_bus_rd_handle_irq,
+		NULL,
+		NULL,
+		NULL,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (bus_priv->irq_handle < 1) {
+		CAM_ERR(CAM_SFE,
+			"Failed to subscribe TOP IRQ for BUS RD");
+		bus_priv->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	cam_irq_controller_register_dependent(bus_priv->common_data.sfe_irq_controller,
+		bus_priv->common_data.bus_irq_controller, sfe_top_irq_mask);
+
+	if (bus_priv->tasklet_info != NULL) {
+		bus_rd_err_irq_mask[0] = bus_priv->common_data.irq_err_mask;
+
+		bus_priv->error_irq_handle = cam_irq_controller_subscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			bus_rd_err_irq_mask,
+			bus_priv,
+			cam_sfe_bus_rd_handle_err_irq_top_half,
+			cam_sfe_bus_rd_handle_err_irq_bottom_half,
+			bus_priv->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (bus_priv->error_irq_handle < 1) {
+			CAM_ERR(CAM_SFE, "Failed to subscribe error IRQ");
+			bus_priv->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	bus_priv->common_data.err_irq_subscribe = true;
+	CAM_DBG(CAM_SFE, "BUS RD error irq subscribed");
+	return 0;
+}
+
+static int cam_sfe_bus_rd_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update      *secure_mode = cmd_args;
+	struct cam_sfe_bus_rd_data            *rsrc_data = NULL;
+	uint32_t                              *mode;
+
+	rsrc_data = (struct cam_sfe_bus_rd_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode = (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_sfe_bus_acquire_bus_rd(void *bus_priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                           rc = -ENODEV;
+	int                                           i;
+	enum cam_sfe_bus_rd_type                      bus_rd_res_id;
+	int                                           num_rm;
+	struct cam_sfe_bus_rd_priv                   *bus_rd_priv =
+		bus_priv;
+	struct cam_sfe_acquire_args                  *acq_args = acquire_args;
+	struct cam_sfe_hw_sfe_bus_rd_acquire_args    *bus_rd_acquire_args;
+	struct cam_isp_resource_node                 *rsrc_node = NULL;
+	struct cam_sfe_bus_rd_data                   *rsrc_data = NULL;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_SFE, "Invalid Param");
+		return -EINVAL;
+	}
+
+	bus_rd_acquire_args = &acq_args->sfe_rd;
+
+	bus_rd_res_id = cam_sfe_bus_get_bus_rd_res_id(
+		bus_rd_acquire_args->res_id);
+	if (bus_rd_res_id == CAM_SFE_BUS_RD_MAX)
+		return -ENODEV;
+
+	num_rm = cam_sfe_bus_get_num_rm(bus_rd_res_id);
+	if (num_rm < 1)
+		return -EINVAL;
+
+	rsrc_node = &bus_rd_priv->sfe_bus_rd[bus_rd_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_SFE, "SFE:%d RM:0x%x not available state:%d",
+			bus_rd_priv->common_data.core_index,
+			acq_args->rsrc_type, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	rsrc_node->res_id = bus_rd_acquire_args->res_id;
+	rsrc_data = rsrc_node->res_priv;
+
+	CAM_DBG(CAM_SFE, "SFE:%d acquire RD type:0x%x res_id 0x%x",
+		rsrc_data->common_data->core_index, acq_args->rsrc_type, rsrc_node->res_id);
+
+	rsrc_data->num_rm = num_rm;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	bus_rd_priv->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = bus_rd_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = bus_rd_acquire_args->cdm_ops;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->is_offline = bus_rd_acquire_args->is_offline;
+	rsrc_data->bus_priv = bus_rd_priv;
+
+	/* Enable FS sync for sHDR & FS */
+	if (!rsrc_data->is_offline)
+		rsrc_data->fs_sync_enable = 1;
+
+	if (!rsrc_data->secure_mode) {
+		rsrc_data->secure_mode =
+			bus_rd_acquire_args->secure_mode;
+	} else if (rsrc_data->secure_mode !=
+		bus_rd_acquire_args->secure_mode) {
+		CAM_ERR(CAM_SFE,
+			"Current Mode %u Requesting Mode %u",
+			rsrc_data->secure_mode,
+			bus_rd_acquire_args->secure_mode);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_rm; i++) {
+		rc = cam_sfe_bus_acquire_rm(bus_rd_priv,
+			acq_args->tasklet,
+			acq_args->priv,
+			bus_rd_res_id,
+			i,
+			&rsrc_data->rm_res[i],
+			bus_rd_acquire_args->unpacker_fmt);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d RM:%d acquire failed rc:%d",
+				rsrc_data->common_data->core_index,
+				bus_rd_res_id, rc);
+			goto release_rm;
+		}
+	}
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	bus_rd_acquire_args->rsrc_node = rsrc_node;
+	bus_rd_acquire_args->sfe_rd_only = bus_rd_priv->rd_only;
+
+	CAM_DBG(CAM_SFE, "SFE:%d acquire RD 0x%x successful",
+		rsrc_data->common_data->core_index, acq_args->rsrc_type);
+	return rc;
+
+release_rm:
+	for (i--; i >= 0; i--)
+		cam_sfe_bus_release_rm(bus_rd_priv, rsrc_data->rm_res[i]);
+	return rc;
+}
+
+static int cam_sfe_bus_release_bus_rd(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node   *sfe_bus_rd = NULL;
+	struct cam_sfe_bus_rd_data     *rsrc_data = NULL;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_SFE, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	sfe_bus_rd = release_args;
+	rsrc_data = sfe_bus_rd->res_priv;
+
+	if (sfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE,
+			"SFE:%d RD type:0x%x invalid resource state:%d",
+			rsrc_data->common_data->core_index,
+			sfe_bus_rd->res_id, sfe_bus_rd->res_state);
+	}
+
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		cam_sfe_bus_release_rm(bus_priv, rsrc_data->rm_res[i]);
+	rsrc_data->num_rm = 0;
+
+	sfe_bus_rd->tasklet_info = NULL;
+	sfe_bus_rd->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+	rsrc_data->secure_mode = 0;
+
+	if (sfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		sfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_sfe_bus_start_bus_rd(
+	void *hw_priv, void *stop_hw_args, uint32_t arg_size)
+{
+	int rc = -1, i;
+	const uint32_t buf_done_shift = 2;
+	uint32_t bus_rd_done_irq_mask[1] = {0};
+	struct cam_isp_resource_node	  *sfe_bus_rd = NULL;
+	struct cam_sfe_bus_rd_data		  *rsrc_data = NULL;
+	struct cam_sfe_bus_rd_priv		  *bus_priv = NULL;
+	struct cam_sfe_bus_rd_common_data *common_data = NULL;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+
+	sfe_bus_rd = (struct cam_isp_resource_node *)hw_priv;
+	rsrc_data = sfe_bus_rd->res_priv;
+	bus_priv = rsrc_data->bus_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_SFE, "SFE:%d start RD type:0x%x",
+		common_data->hw_intf->hw_idx, sfe_bus_rd->res_id);
+
+	if (sfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE, "Invalid resource state:%d",
+			sfe_bus_rd->res_state);
+		return -EACCES;
+	}
+
+	/* subscribe error irqs */
+	if (!bus_priv->common_data.err_irq_subscribe) {
+		rc = cam_sfe_bus_subscribe_error_irq(bus_priv);
+		if (rc)
+			return rc;
+	}
+
+	if (!rsrc_data->is_offline) {
+		uint32_t if_cmd_val = (rsrc_data->fs_sync_enable <<
+			bus_priv->bus_rd_hw_info->fs_sync_shift);
+
+		cam_io_w_mb(if_cmd_val, common_data->mem_base +
+			common_data->common_reg->input_if_cmd);
+		CAM_DBG(CAM_SFE, "SFE:%d fs_sync for RD:0x%x configured with val: 0x%x",
+			common_data->hw_intf->hw_idx, sfe_bus_rd->res_id, if_cmd_val);
+	}
+
+	if (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE)
+		cam_io_w_mb(1, common_data->mem_base +
+			common_data->common_reg->security_cfg);
+
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		rc = cam_sfe_bus_start_rm(rsrc_data->rm_res[i]);
+
+	/* Remove after driver stabilizes */
+	common_data->sfe_debug_cfg |=
+		SFE_DEBUG_ENABLE_RD_DONE_IRQ;
+
+	if (common_data->sfe_debug_cfg &
+		SFE_DEBUG_ENABLE_RD_DONE_IRQ) {
+
+		/* Subscribe RUP */
+		bus_rd_done_irq_mask[0] |= 0x2;
+
+		/* Subscribe buf done */
+		bus_rd_done_irq_mask[0] |=
+			(1 << (rsrc_data->bus_rd_type + buf_done_shift));
+		sfe_bus_rd->irq_handle = cam_irq_controller_subscribe_irq(
+			common_data->bus_irq_controller,
+			CAM_IRQ_PRIORITY_2,
+			bus_rd_done_irq_mask,
+			sfe_bus_rd,
+			cam_sfe_bus_rd_out_done_top_half,
+			cam_sfe_bus_rd_out_done_bottom_half,
+			sfe_bus_rd->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (sfe_bus_rd->irq_handle < 1) {
+			CAM_ERR(CAM_SFE,
+				"Failed to subscribe RUP/BUF done IRQ");
+			sfe_bus_rd->irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	sfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_sfe_bus_stop_bus_rd(
+	void *hw_priv, void *stop_hw_args, uint32_t arg_size)
+{
+	int rc = 0, i;
+	struct cam_isp_resource_node *sfe_bus_rd = NULL;
+	struct cam_sfe_bus_rd_data   *rsrc_data = NULL;
+	struct cam_sfe_bus_rd_priv   *bus_priv = NULL;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+
+	sfe_bus_rd = (struct cam_isp_resource_node *)hw_priv;
+	rsrc_data = sfe_bus_rd->res_priv;
+	bus_priv = rsrc_data->bus_priv;
+
+	if (sfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		sfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_SFE, "SFE: %d res_id: 0x%x state: %d",
+			rsrc_data->common_data->core_index, sfe_bus_rd->res_id,
+			sfe_bus_rd->res_state);
+		return rc;
+	}
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		rc = cam_sfe_bus_stop_rm(rsrc_data->rm_res[i]);
+
+	sfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	/* Unsubscribe RUP & Buf done */
+	if (sfe_bus_rd->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+				rsrc_data->common_data->bus_irq_controller,
+				sfe_bus_rd->irq_handle);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Failed to unsubscribe rup/buf done irq");
+		sfe_bus_rd->irq_handle = 0;
+	}
+
+	/* Unsubscribe error irqs */
+	if (bus_priv->common_data.err_irq_subscribe) {
+		if (bus_priv->irq_handle) {
+			rc = cam_irq_controller_unsubscribe_irq(
+					bus_priv->common_data.sfe_irq_controller,
+					bus_priv->irq_handle);
+			if (rc)
+				CAM_ERR(CAM_SFE, "Failed to unsubscribe top irq");
+			bus_priv->irq_handle = 0;
+			cam_irq_controller_unregister_dependent(
+				bus_priv->common_data.sfe_irq_controller,
+				bus_priv->common_data.bus_irq_controller);
+		}
+
+		if (bus_priv->error_irq_handle) {
+			rc = cam_irq_controller_unsubscribe_irq(
+					bus_priv->common_data.bus_irq_controller,
+					bus_priv->error_irq_handle);
+			if (rc)
+				CAM_ERR(CAM_SFE, "Failed to unsubscribe error irq");
+			bus_priv->error_irq_handle = 0;
+		}
+		bus_priv->common_data.err_irq_subscribe = false;
+	}
+
+	CAM_DBG(CAM_SFE, "SFE:%d stopped Bus RD:0x%x",
+		rsrc_data->common_data->core_index,
+		sfe_bus_rd->res_id);
+	return rc;
+}
+
+static int cam_sfe_bus_init_sfe_bus_read_resource(
+	uint32_t                           index,
+	struct cam_sfe_bus_rd_priv        *bus_rd_priv,
+	struct cam_sfe_bus_rd_hw_info     *bus_rd_hw_info)
+{
+	struct cam_isp_resource_node         *sfe_bus_rd = NULL;
+	struct cam_sfe_bus_rd_data           *rsrc_data = NULL;
+	int rc = 0;
+	int32_t sfe_bus_rd_resc_type =
+		bus_rd_hw_info->sfe_bus_rd_info[index].sfe_bus_rd_type;
+
+	if (sfe_bus_rd_resc_type < 0 ||
+		sfe_bus_rd_resc_type >= CAM_SFE_BUS_RD_MAX) {
+		CAM_ERR(CAM_SFE, "Init SFE RD failed, Invalid type=%d",
+			sfe_bus_rd_resc_type);
+		return -EINVAL;
+	}
+
+	sfe_bus_rd = &bus_rd_priv->sfe_bus_rd[sfe_bus_rd_resc_type];
+	if (sfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		sfe_bus_rd->res_priv) {
+		CAM_ERR(CAM_SFE,
+			"Error. Looks like same resource is init again");
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_rd_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	sfe_bus_rd->res_priv = rsrc_data;
+
+	sfe_bus_rd->res_type = CAM_ISP_RESOURCE_SFE_RD;
+	sfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&sfe_bus_rd->list);
+
+	rsrc_data->bus_rd_type    =
+		bus_rd_hw_info->sfe_bus_rd_info[index].sfe_bus_rd_type;
+	rsrc_data->common_data = &bus_rd_priv->common_data;
+	rsrc_data->max_width   =
+		bus_rd_hw_info->sfe_bus_rd_info[index].max_width;
+	rsrc_data->max_height  =
+		bus_rd_hw_info->sfe_bus_rd_info[index].max_height;
+	rsrc_data->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+	sfe_bus_rd->hw_intf = bus_rd_priv->common_data.hw_intf;
+
+	bus_rd_priv->max_clk_threshold  =
+		bus_rd_hw_info->sfe_bus_rd_info[index].max_clk_threshold;
+	bus_rd_priv->nom_clk_threshold  =
+		bus_rd_hw_info->sfe_bus_rd_info[index].nom_clk_threshold;
+	bus_rd_priv->min_clk_threshold  =
+		bus_rd_hw_info->sfe_bus_rd_info[index].min_clk_threshold;
+	bus_rd_priv->bytes_per_clk  =
+		bus_rd_hw_info->sfe_bus_rd_info[index].bytes_per_clk;
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_sfe_bus_rd_resource(
+	struct cam_isp_resource_node    *sfe_bus_rd_res)
+{
+	struct cam_sfe_bus_rd_data *rsrc_data =
+		sfe_bus_rd_res->res_priv;
+
+	if (sfe_bus_rd_res->res_state ==
+		CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		CAM_DBG(CAM_SFE, "HW%d Res %d already deinitialized");
+		return 0;
+	}
+
+	sfe_bus_rd_res->start = NULL;
+	sfe_bus_rd_res->stop = NULL;
+	sfe_bus_rd_res->top_half_handler = NULL;
+	sfe_bus_rd_res->bottom_half_handler = NULL;
+	sfe_bus_rd_res->hw_intf = NULL;
+
+	sfe_bus_rd_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&sfe_bus_rd_res->list);
+	sfe_bus_rd_res->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+/*
+ * API similar to cam_sfe_bus_rd_update_rm() with the
+ * only change being config is done via AHB instead of CDM
+ */
+static int cam_sfe_bus_rd_config_rm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update       *update_buf;
+	struct cam_sfe_bus_rd_data             *sfe_bus_rd_data = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data *rm_data = NULL;
+	struct cam_sfe_bus_cache_dbg_cfg       *cache_dbg_cfg = NULL;
+	uint32_t width = 0, height = 0, stride = 0, width_in_bytes = 0;
+	uint32_t i, img_addr = 0, img_offset = 0;
+	uint32_t curr_cache_cfg = 0;
+	dma_addr_t iova;
+
+	bus_priv = (struct cam_sfe_bus_rd_priv  *) priv;
+	update_buf = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	cache_dbg_cfg = &bus_priv->common_data.cache_dbg_cfg;
+
+	sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *)
+		update_buf->res->res_priv;
+
+	if (!sfe_bus_rd_data) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SFE, "num of RM: %d scratch_buf_cfg: %s",
+		sfe_bus_rd_data->num_rm,
+		update_buf->use_scratch_cfg ? "true" : "false");
+	if (update_buf->rm_update->num_buf != sfe_bus_rd_data->num_rm) {
+		CAM_ERR(CAM_SFE,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->rm_update->num_buf,
+			sfe_bus_rd_data->num_rm);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < sfe_bus_rd_data->num_rm; i++) {
+		rm_data = sfe_bus_rd_data->rm_res[i]->res_priv;
+
+		stride = update_buf->rm_update->stride;
+		iova = update_buf->rm_update->image_buf[i] + rm_data->offset;
+		if (rm_data->width && rm_data->height)
+		{
+			width =  rm_data->width;
+			height = rm_data->height;
+		} else {
+			width = update_buf->rm_update->width;
+			height = update_buf->rm_update->height;
+		}
+
+		if (cam_smmu_is_expanded_memory()) {
+			img_offset = CAM_36BIT_INTF_GET_IOVA_OFFSET(iova);
+			img_addr = CAM_36BIT_INTF_GET_IOVA_BASE(iova);
+		} else {
+			img_addr = iova;
+		}
+
+		/* update size register */
+		cam_sfe_bus_rd_pxls_to_bytes(width,
+			rm_data->unpacker_cfg, &width_in_bytes);
+		rm_data->height = height;
+		rm_data->width = width;
+		curr_cache_cfg = rm_data->cache_cfg;
+		rm_data->cache_cfg = bus_priv->sys_cache_default_cfg;
+		if ((!cache_dbg_cfg->disable_for_scratch) &&
+			(rm_data->enable_caching)) {
+			rm_data->cache_cfg =
+				rm_data->current_scid << 8;
+			rm_data->cache_cfg |= (3 << 4);
+			if (cache_dbg_cfg->scratch_dbg_cfg)
+				rm_data->cache_cfg |= cache_dbg_cfg->scratch_alloc;
+			else
+				rm_data->cache_cfg |= CACHE_ALLOC_FORGET;
+
+			if (cache_dbg_cfg->print_cache_cfg &&
+				(curr_cache_cfg != rm_data->cache_cfg)) {
+				CAM_INFO(CAM_SFE,
+					"SFE:%d Scratch Buff RM:%d current_scid:%d cache_cfg:0x%x",
+					rm_data->common_data->core_index,
+					rm_data->index, rm_data->current_scid, rm_data->cache_cfg);
+			}
+		}
+
+		cam_io_w_mb(rm_data->cache_cfg,
+			rm_data->common_data->mem_base +
+			rm_data->hw_regs->system_cache_cfg);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d cache_cfg:0x%x",
+			rm_data->common_data->core_index,
+			rm_data->index, rm_data->cache_cfg);
+
+		cam_io_w_mb(width_in_bytes,
+			rm_data->common_data->mem_base +
+			rm_data->hw_regs->buf_width);
+		cam_io_w_mb(height,
+			rm_data->common_data->mem_base +
+			rm_data->hw_regs->buf_height);
+
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d width:0x%X[in bytes: 0x%x] height:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, width, width_in_bytes, height);
+
+		rm_data->stride = stride;
+		cam_io_w_mb(stride,
+			rm_data->common_data->mem_base +
+			rm_data->hw_regs->stride);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d image_stride:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, stride);
+
+		cam_io_w_mb(
+			img_addr,
+			rm_data->common_data->mem_base +
+			rm_data->hw_regs->image_addr);
+
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d image_address:0x%x offset: 0x%x",
+			rm_data->common_data->core_index, rm_data->index,
+			img_addr, rm_data->offset);
+		if (cam_smmu_is_expanded_memory())
+			CAM_DBG(CAM_SFE, "SFE:%d RM:%d image address offset: 0x%x",
+				rm_data->common_data->core_index,
+				rm_data->index,
+				img_offset);
+			cam_io_w_mb(img_offset,
+				rm_data->common_data->mem_base +
+				rm_data->hw_regs->addr_cfg);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_update_rm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update       *update_buf;
+	struct cam_buf_io_cfg                  *io_cfg = NULL;
+	struct cam_sfe_bus_rd_data             *sfe_bus_rd_data = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data *rm_data = NULL;
+	struct cam_cdm_utils_ops               *cdm_util_ops;
+	struct cam_sfe_bus_cache_dbg_cfg       *cache_dbg_cfg = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t width = 0, height = 0, stride = 0, width_in_bytes = 0;
+	uint32_t i, j, size = 0, img_addr = 0, img_offset = 0;
+	dma_addr_t iova;
+	uint32_t curr_cache_cfg = 0;
+
+	bus_priv = (struct cam_sfe_bus_rd_priv  *) priv;
+	update_buf = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	cache_dbg_cfg = &bus_priv->common_data.cache_dbg_cfg;
+
+	sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *)
+		update_buf->res->res_priv;
+	if (!sfe_bus_rd_data || !sfe_bus_rd_data->cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = sfe_bus_rd_data->cdm_util_ops;
+	CAM_DBG(CAM_SFE, "#of RM: %d scratch_buf_cfg: %s",
+		sfe_bus_rd_data->num_rm,
+		update_buf->use_scratch_cfg ? "true" : "false");
+	if (update_buf->rm_update->num_buf != sfe_bus_rd_data->num_rm) {
+		CAM_ERR(CAM_SFE,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->rm_update->num_buf,
+			sfe_bus_rd_data->num_rm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &sfe_bus_rd_data->common_data->io_buf_update[0];
+	if (!update_buf->use_scratch_cfg)
+		io_cfg = update_buf->rm_update->io_cfg;
+
+	for (i = 0, j = 0; i < sfe_bus_rd_data->num_rm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_SFE,
+				"reg_val_pair %d exceeds the array limit %lu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		rm_data = sfe_bus_rd_data->rm_res[i]->res_priv;
+
+		CAM_DBG(CAM_SFE,
+			"RM: %d i %d scratch cfg %d io cfg %d %dx%d update buf %d %dx%d rm data %d %dx%d",
+			sfe_bus_rd_data->num_rm, i,
+			update_buf->use_scratch_cfg,
+			io_cfg->planes[i].plane_stride,
+			io_cfg->planes[i].width,
+			io_cfg->planes[i].height,
+			update_buf->rm_update->stride,
+			update_buf->rm_update->width,
+			update_buf->rm_update->height,
+			rm_data->stride,
+			rm_data->width,
+			rm_data->height);
+
+		if (update_buf->use_scratch_cfg) {
+			stride = update_buf->rm_update->stride;
+			width = update_buf->rm_update->width;
+			height = update_buf->rm_update->height;
+		} else {
+			stride = io_cfg->planes[i].plane_stride;
+			width = io_cfg->planes[i].width;
+			height = io_cfg->planes[i].height;
+		}
+
+		/* If width & height updated in blob in real time cases , use that */
+		if (!sfe_bus_rd_data->is_offline) {
+			if (rm_data->width && rm_data->height) {
+				width =  rm_data->width;
+				height = rm_data->height;
+			}
+
+			CAM_DBG(CAM_SFE, "SFE:%d RM:%d width:0x%X height:0x%X",
+				rm_data->common_data->core_index,
+				rm_data->index, width,height);
+		}
+
+		iova = update_buf->rm_update->image_buf[i] + rm_data->offset;
+		if (cam_smmu_is_expanded_memory()) {
+			img_offset = CAM_36BIT_INTF_GET_IOVA_OFFSET(iova);
+			img_addr = CAM_36BIT_INTF_GET_IOVA_BASE(iova);
+		} else {
+			img_addr = iova;
+		}
+
+		/* update size register */
+		if (sfe_bus_rd_data->is_offline) {
+			rm_data->unpacker_cfg = cam_sfe_bus_get_unpacker_fmt(
+					update_buf->rm_update->unpacker_fmt);
+
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				rm_data->hw_regs->unpacker_cfg, rm_data->unpacker_cfg);
+		}
+
+		cam_sfe_bus_rd_pxls_to_bytes(width,
+			rm_data->unpacker_cfg, &width_in_bytes);
+		rm_data->height = height;
+		rm_data->width = width;
+
+		curr_cache_cfg = rm_data->cache_cfg;
+		rm_data->cache_cfg = bus_priv->sys_cache_default_cfg;
+		if (rm_data->enable_caching) {
+			if ((cache_dbg_cfg->disable_for_scratch) &&
+				(update_buf->use_scratch_cfg))
+				goto skip_cache_cfg;
+
+			if ((cache_dbg_cfg->disable_for_buf) &&
+				(!update_buf->use_scratch_cfg))
+				goto skip_cache_cfg;
+
+			rm_data->cache_cfg =
+				rm_data->current_scid << 8;
+			rm_data->cache_cfg |= (3 << 4);
+			if ((update_buf->use_scratch_cfg) &&
+				(cache_dbg_cfg->scratch_dbg_cfg)) {
+				rm_data->cache_cfg |= cache_dbg_cfg->scratch_alloc;
+			} else if ((!update_buf->use_scratch_cfg) &&
+				(cache_dbg_cfg->buf_dbg_cfg)) {
+				rm_data->cache_cfg |= cache_dbg_cfg->buf_alloc;
+			} else {
+				if (update_buf->use_scratch_cfg)
+					rm_data->cache_cfg |= CACHE_ALLOC_FORGET;
+				else
+					rm_data->cache_cfg |= CACHE_ALLOC_DEALLOC;
+			}
+
+			if (cache_dbg_cfg->print_cache_cfg &&
+				(curr_cache_cfg != rm_data->cache_cfg)) {
+				CAM_INFO(CAM_SFE, "SFE:%d RM:%d current_scid:%d cache_cfg:0x%x",
+					rm_data->common_data->core_index,
+					rm_data->index, rm_data->current_scid, rm_data->cache_cfg);
+			}
+		}
+
+skip_cache_cfg:
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->system_cache_cfg,
+			rm_data->cache_cfg);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d cache_cfg:0x%x",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->buf_width, width_in_bytes);
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->buf_height, height);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d width:0x%X [in bytes: 0x%x] height:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, rm_data->width,
+			width_in_bytes, rm_data->height);
+
+		rm_data->stride = stride;
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->stride, rm_data->stride);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d image_stride:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->image_addr, img_addr);
+		if (cam_smmu_is_expanded_memory())
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				rm_data->hw_regs->addr_cfg, img_offset);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d image_address:0x%x image_offset:0x%x",
+			rm_data->common_data->core_index,
+			rm_data->index, img_addr, img_offset);
+	}
+
+	num_regval_pairs = j / 2;
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_buf->cmd.size) {
+			CAM_ERR(CAM_SFE,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				update_buf->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_buf->cmd.cmd_buf_addr, num_regval_pairs,
+			reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_buf->cmd.used_bytes = size * 4;
+	} else {
+		update_buf->cmd.used_bytes = 0;
+		CAM_DBG(CAM_SFE,
+			"No reg val pairs. num_rms: %u",
+			sfe_bus_rd_data->num_rm);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_update_rm_core_cfg(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update       *cmd_update;
+	struct cam_sfe_bus_rd_data             *sfe_bus_rd_data = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data *rm_data = NULL;
+	struct cam_cdm_utils_ops               *cdm_util_ops;
+	bool enable_disable;
+	uint32_t *reg_val_pair;
+	uint32_t  num_regval_pairs = 0, i, j, size = 0;
+	uint32_t hw_cfg = 0;
+
+	cmd_update =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	enable_disable = *(bool *)cmd_update->data;
+
+	sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *)
+		cmd_update->res->res_priv;
+
+	if (!sfe_bus_rd_data) {
+		CAM_ERR(CAM_SFE, "Invalid SFE rd data: %pK",
+			sfe_bus_rd_data);
+		return -EINVAL;
+	}
+
+	if (enable_disable) {
+		hw_cfg = CAM_SFE_BUS_RD_EN_CLIENT_CFG;
+		if (sfe_bus_rd_data->common_data->cons_chk_en_avail)
+			hw_cfg |= CAM_SFE_BUS_RD_EN_CONS_CHK_CFG;
+	}
+
+	cdm_util_ops = sfe_bus_rd_data->cdm_util_ops;
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Invalid cdm ops: %pK",
+			cdm_util_ops);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &sfe_bus_rd_data->common_data->io_buf_update[0];
+	for (i = 0, j = 0; i < sfe_bus_rd_data->num_rm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_SFE,
+				"reg_val_pair %d exceeds the array limit %lu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		rm_data = sfe_bus_rd_data->rm_res[i]->res_priv;
+		/* To avoid AHB write @ stream on */
+		rm_data->enable_disable_cfg_done = true;
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->cfg, hw_cfg);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d cfg:0x%x",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+	}
+
+	num_regval_pairs = j / 2;
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > cmd_update->cmd.size) {
+			CAM_ERR(CAM_SFE,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				cmd_update->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			cmd_update->cmd.cmd_buf_addr, num_regval_pairs,
+			reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		cmd_update->cmd.used_bytes = size * 4;
+	} else {
+		cmd_update->cmd.used_bytes = 0;
+		CAM_DBG(CAM_SFE,
+			"No reg val pairs. num_rms: %u",
+			sfe_bus_rd_data->num_rm);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_get_res_for_mid(
+	struct cam_sfe_bus_rd_priv *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_hw_info          *hw_info;
+	struct cam_isp_hw_get_cmd_update       *cmd_update = cmd_args;
+	struct cam_isp_hw_get_res_for_mid      *get_res = NULL;
+	int i, j;
+
+	get_res = (struct cam_isp_hw_get_res_for_mid *)cmd_update->data;
+	if (!get_res) {
+		CAM_ERR(CAM_SFE,
+			"invalid get resource for mid paramas");
+		return -EINVAL;
+	}
+
+	hw_info =  bus_priv->bus_rd_hw_info;
+	for (i = 0; i < bus_priv->num_bus_rd_resc; i++) {
+		for (j = 0; j < CAM_SFE_BUS_MAX_MID_PER_PORT; j++) {
+			if (hw_info->sfe_bus_rd_info[i].mid[j] == get_res->mid)
+				goto end;
+		}
+	}
+
+	/*
+	 * Do not update out_res_id in case of no match.
+	 * Correct value will be dumped in hw mgr
+	 */
+	if (i == bus_priv->num_bus_rd_resc) {
+		CAM_INFO(CAM_SFE, "mid:%d does not match with any read resource", get_res->mid);
+		return 0;
+	}
+
+end:
+	CAM_INFO(CAM_SFE, "match mid :%d  read resource: 0x%x found",
+		get_res->mid, bus_priv->sfe_bus_rd[i].res_id);
+	get_res->out_res_id = bus_priv->sfe_bus_rd[i].res_id;
+	return 0;
+}
+
+static int cam_sfe_bus_rd_irq_inject(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_priv          *bus_priv = NULL;
+	struct cam_hw_soc_info              *soc_info = NULL;
+	struct cam_sfe_bus_rd_hw_info       *bus_rd_hw_info = NULL;
+	struct cam_irq_controller_reg_info  *irq_reg_info = NULL;
+	struct cam_irq_register_set         *inject_reg = NULL;
+	struct cam_isp_irq_inject_param     *inject_params = NULL;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	bus_priv = (struct cam_sfe_bus_rd_priv *)priv;
+	soc_info = bus_priv->common_data.soc_info;
+	bus_rd_hw_info = (struct cam_sfe_bus_rd_hw_info *)bus_priv->bus_rd_hw_info;
+	irq_reg_info = &bus_rd_hw_info->common_reg.irq_reg_info;
+	inject_reg = irq_reg_info->irq_reg_set;
+	inject_params = (struct cam_isp_irq_inject_param *)cmd_args;
+
+	if (!inject_reg) {
+		CAM_INFO(CAM_SFE, "Invalid inject_reg");
+		return -EINVAL;
+	}
+
+	if (inject_params->reg_unit ==
+		CAM_ISP_SFE_0_BUS_RD_INPUT_IF_IRQ_SET_REG) {
+		cam_io_w_mb(inject_params->irq_mask,
+			soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base +
+			inject_reg->set_reg_offset);
+		cam_io_w_mb(0x10, soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base +
+			irq_reg_info->global_irq_cmd_offset);
+		CAM_INFO(CAM_SFE, "Injected : irq_mask %#x set_reg_offset %#x",
+			inject_params->irq_mask, inject_reg->set_reg_offset);
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_rd_dump_irq_desc(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	int                               i, offset = 0;
+	struct cam_sfe_bus_rd_priv       *bus_priv = NULL;
+	struct cam_sfe_bus_rd_hw_info    *bus_rd_hw_info = NULL;
+	struct cam_isp_irq_inject_param  *inject_params = NULL;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	bus_priv = (struct cam_sfe_bus_rd_priv *)priv;
+	bus_rd_hw_info = (struct cam_sfe_bus_rd_hw_info *)bus_priv->bus_rd_hw_info;
+	inject_params = (struct cam_isp_irq_inject_param *)cmd_args;
+
+	if (inject_params->reg_unit ==
+			CAM_ISP_SFE_0_BUS_RD_INPUT_IF_IRQ_SET_REG) {
+		offset += scnprintf(inject_params->line_buf + offset,
+			LINE_BUFFER_LEN - offset,
+			"Printing executable IRQ for hw_type: SFE reg_unit: %d\n",
+			inject_params->reg_unit);
+
+		for (i = 0; i < bus_rd_hw_info->num_bus_rd_errors; i++)
+			offset += scnprintf(inject_params->line_buf + offset,
+				LINE_BUFFER_LEN - offset, "%#12x : %s - %s\n",
+				bus_rd_hw_info->bus_rd_err_desc[i].bitmask,
+				bus_rd_hw_info->bus_rd_err_desc[i].err_name,
+				bus_rd_hw_info->bus_rd_err_desc[i].desc);
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_rd_get_off_clk_thr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_priv    *bus_priv;
+	struct cam_isp_hw_get_off_clk_thr  *args = cmd_args;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_off_clk_thr)) {
+		CAM_ERR(CAM_ISP, "invalid ars size");
+		return -EINVAL;
+	}
+	bus_priv = (struct cam_sfe_bus_rd_priv  *) priv;
+	args->max_clk_threshold = bus_priv->max_clk_threshold;
+	args->nom_clk_threshold = bus_priv->nom_clk_threshold;
+	args->min_clk_threshold = bus_priv->min_clk_threshold;
+	args->bytes_per_clk     = bus_priv->bytes_per_clk;
+
+	return 0;
+}
+
+static int cam_sfe_bus_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_priv *bus_priv = hw_priv;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SFE, "SFE:%d bus-rd hw-version:0x%x",
+		bus_priv->common_data.core_index,
+		cam_io_r_mb(bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->hw_version));
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	return 0;
+}
+
+static int cam_sfe_bus_rd_config_update(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	int i;
+	struct cam_isp_hw_get_cmd_update       *rm_config_update;
+	struct cam_isp_vfe_wm_config           *rm_config = NULL;
+	struct cam_sfe_bus_rd_data             *sfe_bus_rd_data = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data *rm_data = NULL;
+
+	rm_config_update =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	rm_config = (struct cam_isp_vfe_wm_config  *)
+		rm_config_update->data;
+
+	sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *)
+		rm_config_update->res->res_priv;
+
+	if (!sfe_bus_rd_data) {
+		CAM_ERR(CAM_SFE, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < sfe_bus_rd_data->num_rm; i++) {
+		rm_data = sfe_bus_rd_data->rm_res[i]->res_priv;
+
+		rm_data->offset = rm_config->offset;
+		rm_data->width = rm_config->width;
+		rm_data->height = rm_config->height;
+		CAM_DBG(CAM_SFE,
+			"SFE: %u RM: %d offset: %u width: %u height: %u",
+			rm_data->index, rm_data->index, rm_data->offset,
+			rm_data->width, rm_data->height);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_cache_config(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	int i;
+	struct cam_sfe_bus_rd_priv              *bus_priv;
+	struct cam_isp_sfe_bus_sys_cache_config *cache_cfg;
+	struct cam_sfe_bus_rd_data              *sfe_bus_rd_data = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data  *rm_data = NULL;
+
+	bus_priv = (struct cam_sfe_bus_rd_priv  *)priv;
+	cache_cfg =  (struct cam_isp_sfe_bus_sys_cache_config *)cmd_args;
+
+	sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *)
+		cache_cfg->res->res_priv;
+
+	if (!sfe_bus_rd_data) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	if (bus_priv->common_data.cache_dbg_cfg.disable_all)
+		return 0;
+
+	for (i = 0; i < sfe_bus_rd_data->num_rm; i++) {
+		rm_data = (struct cam_sfe_bus_rd_rm_resource_data *)
+			sfe_bus_rd_data->rm_res[i]->res_priv;
+		rm_data->enable_caching = cache_cfg->use_cache;
+		rm_data->current_scid = cache_cfg->scid;
+		cache_cfg->rd_cfg_done = true;
+
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d cache_enable:%s scid:%u",
+			rm_data->common_data->core_index,
+			rm_data->index,
+			(rm_data->enable_caching ? "true" : "false"),
+			rm_data->current_scid);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_set_debug_cfg(
+	void *priv, void *cmd_args)
+{
+	struct cam_sfe_bus_rd_priv *bus_priv =
+		(struct cam_sfe_bus_rd_priv  *) priv;
+	struct cam_sfe_debug_cfg_params *debug_cfg;
+
+	debug_cfg = (struct cam_sfe_debug_cfg_params *)cmd_args;
+
+	if (debug_cfg->cache_config)
+		cam_sfe_bus_parse_cache_cfg(true,
+			debug_cfg->u.cache_cfg.sfe_cache_dbg,
+			&bus_priv->common_data.cache_dbg_cfg);
+	else
+		bus_priv->common_data.sfe_debug_cfg =
+			debug_cfg->u.dbg_cfg.sfe_debug_cfg;
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_process_cmd(
+	void *priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE,
+			"Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CLK_THRESHOLDS:
+		rc = cam_sfe_bus_rd_get_off_clk_thr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM:
+		rc = cam_sfe_bus_rd_update_rm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BUF_UPDATE_RM:
+		rc = cam_sfe_bus_rd_config_rm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_RM_SECURE_MODE:
+		rc = cam_sfe_bus_rd_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD:
+		rc = cam_sfe_bus_rd_config_update(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SET_SFE_DEBUG_CFG:
+		rc = cam_sfe_bus_rd_set_debug_cfg(priv, cmd_args);
+		break;
+	case CAM_ISP_HW_SFE_SYS_CACHE_RM_CONFIG:
+		rc = cam_sfe_bus_rd_cache_config(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_RM_ENABLE_DISABLE:
+		rc = cam_sfe_bus_rd_update_rm_core_cfg(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+		rc = cam_sfe_bus_rd_get_res_for_mid(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO: {
+		struct cam_isp_hw_event_info  *event_info =
+			(struct cam_isp_hw_event_info *)cmd_args;
+		enum cam_sfe_bus_rd_type       bus_rd_res_id;
+
+		bus_rd_res_id = cam_sfe_bus_get_bus_rd_res_id(
+			event_info->res_id);
+
+		/* Skip if it's not a read resource */
+		if (bus_rd_res_id == CAM_SFE_BUS_RD_MAX) {
+			CAM_DBG(CAM_SFE,
+				"Not a SFE read res: 0x%x - skip dump",
+				event_info->res_id);
+			rc = 0;
+			break;
+		}
+
+		rc = cam_sfe_bus_rd_print_dimensions(bus_rd_res_id,
+			(struct cam_sfe_bus_rd_priv  *)priv);
+		break;
+	}
+	case CAM_ISP_HW_CMD_IRQ_INJECTION:
+		rc = cam_sfe_bus_rd_irq_inject(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION:
+		rc = cam_sfe_bus_rd_dump_irq_desc(priv, cmd_args, arg_size);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_SFE,
+			"Invalid SFE BUS RD command type: %d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_sfe_bus_rd_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *sfe_irq_controller,
+	struct cam_sfe_bus                  **sfe_bus)
+{
+	int i, rc = 0;
+	struct cam_sfe_bus_rd_priv    *bus_priv = NULL;
+	struct cam_sfe_bus            *sfe_bus_local;
+	struct cam_sfe_bus_rd_hw_info *bus_rd_hw_info = bus_hw_info;
+
+	if (!soc_info || !hw_intf || !bus_hw_info) {
+		CAM_ERR(CAM_SFE,
+			"Invalid_params soc_info:%pK hw_intf:%pK hw_info:%pK data:%pK",
+			soc_info, hw_intf, bus_rd_hw_info);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	sfe_bus_local = kzalloc(sizeof(struct cam_sfe_bus), GFP_KERNEL);
+	if (!sfe_bus_local) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for sfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_sfe_bus_rd_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for sfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+
+	sfe_bus_local->bus_priv = bus_priv;
+	bus_priv->num_client                    = bus_rd_hw_info->num_client;
+	bus_priv->num_bus_rd_resc               =
+		bus_rd_hw_info->num_bus_rd_resc;
+	bus_priv->common_data.core_index        = soc_info->index;
+	bus_priv->common_data.mem_base          =
+		CAM_SOC_GET_REG_MAP_START(soc_info, SFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf           = hw_intf;
+	bus_priv->common_data.sfe_irq_controller = sfe_irq_controller;
+	bus_priv->common_data.common_reg        = &bus_rd_hw_info->common_reg;
+	bus_priv->common_data.irq_err_mask      = bus_rd_hw_info->irq_err_mask;
+	bus_priv->common_data.cons_chk_en_avail =
+		bus_rd_hw_info->constraint_error_info->cons_chk_en_avail;
+	bus_priv->common_data.soc_info         = soc_info;
+	bus_priv->top_irq_shift                 = bus_rd_hw_info->top_irq_shift;
+	bus_priv->latency_buf_allocation        = bus_rd_hw_info->latency_buf_allocation;
+	bus_priv->sys_cache_default_cfg         = bus_rd_hw_info->sys_cache_default_val;
+	bus_priv->rd_only                       = bus_rd_hw_info->rd_only;
+	bus_priv->bus_rd_hw_info = bus_rd_hw_info;
+
+	rc = cam_irq_controller_init(drv_name,
+		bus_priv->common_data.mem_base,
+		&bus_rd_hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "IRQ controller init failed");
+		goto free_bus_priv;
+	}
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_sfe_bus_init_rm_resource(i, bus_priv, bus_hw_info,
+			&bus_priv->bus_client[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_SFE, "Init RM failed for client:%d, rc=%d",
+				i, rc);
+			goto deinit_rm;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_bus_rd_resc; i++) {
+		rc = cam_sfe_bus_init_sfe_bus_read_resource(i, bus_priv,
+			bus_rd_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_SFE, "Init SFE RD failed for client:%d, rc=%d",
+				i, rc);
+			goto deinit_sfe_bus_rd;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_SFE_BUS_RD_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+
+	sfe_bus_local->hw_ops.reserve      = cam_sfe_bus_acquire_bus_rd;
+	sfe_bus_local->hw_ops.release      = cam_sfe_bus_release_bus_rd;
+	sfe_bus_local->hw_ops.start        = cam_sfe_bus_start_bus_rd;
+	sfe_bus_local->hw_ops.stop         = cam_sfe_bus_stop_bus_rd;
+	sfe_bus_local->hw_ops.init         = cam_sfe_bus_init_hw;
+	sfe_bus_local->hw_ops.deinit       = cam_sfe_bus_deinit_hw;
+	sfe_bus_local->top_half_handler    = cam_sfe_bus_rd_handle_irq;
+	sfe_bus_local->bottom_half_handler = NULL;
+	sfe_bus_local->hw_ops.process_cmd  = cam_sfe_bus_rd_process_cmd;
+
+	*sfe_bus = sfe_bus_local;
+	bus_priv->common_data.sfe_debug_cfg = 0;
+
+	return rc;
+
+deinit_sfe_bus_rd:
+	for (--i; i >= 0; i--)
+		cam_sfe_bus_deinit_sfe_bus_rd_resource(
+			&bus_priv->sfe_bus_rd[i]);
+deinit_rm:
+	if (i < 0)
+		i = bus_priv->num_client;
+	for (--i; i >= 0; i--)
+		cam_sfe_bus_deinit_rm_resource(&bus_priv->bus_client[i]);
+
+free_bus_priv:
+	kfree(sfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(sfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_sfe_bus_rd_deinit(
+	struct cam_sfe_bus                  **sfe_bus)
+{
+	int i, rc = 0;
+	unsigned long flags;
+	struct cam_sfe_bus_rd_priv    *bus_priv = NULL;
+	struct cam_sfe_bus            *sfe_bus_local;
+
+	if (!sfe_bus || !*sfe_bus) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+	sfe_bus_local = *sfe_bus;
+
+	bus_priv = sfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_SFE, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_SFE_BUS_RD_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_sfe_bus_deinit_rm_resource(&bus_priv->bus_client[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"Deinit RM failed rc=%d", rc);
+	}
+
+	for (i = 0; i < bus_priv->num_bus_rd_resc; i++) {
+		rc = cam_sfe_bus_deinit_sfe_bus_rd_resource(
+			&bus_priv->sfe_bus_rd[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"Deinit SFE RD failed rc=%d", rc);
+	}
+
+	rc = cam_irq_controller_deinit(
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"Deinit IRQ Controller failed rc=%d", rc);
+
+	kfree(sfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(sfe_bus_local);
+	*sfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.h
@@ -0,0 +1,195 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_BUS_RD_H_
+#define _CAM_SFE_BUS_RD_H_
+
+#include "cam_sfe_bus.h"
+
+#define CAM_SFE_BUS_RD_MAX_CLIENTS        3
+#define CAM_SFE_BUS_RD_CONS_ERR_MAX       32
+
+/* IRQ status bits */
+#define CAM_SFE_BUS_RD_IRQ_CONS_VIOLATION BIT(0)
+#define CAM_SFE_BUS_RD_IRQ_RUP_DONE       BIT(1)
+#define CAM_SFE_BUS_RD_IRQ_RD0_BUF_DONE   BIT(2)
+#define CAM_SFE_BUS_RD_IRQ_RD1_BUF_DONE   BIT(3)
+#define CAM_SFE_BUS_RD_IRQ_RD2_BUF_DONE   BIT(4)
+#define CAM_SFE_BUS_RD_IRQ_CCIF_VIOLATION BIT(31)
+
+/* Client core config selection */
+#define CAM_SFE_BUS_RD_EN_CLIENT_CFG      BIT(0)
+#define CAM_SFE_BUS_RD_EN_CONS_CHK_CFG    BIT(2)
+
+enum cam_sfe_bus_rd_type {
+	CAM_SFE_BUS_RD_RDI0,
+	CAM_SFE_BUS_RD_RDI1,
+	CAM_SFE_BUS_RD_RDI2,
+	CAM_SFE_BUS_RD_MAX,
+};
+
+/*
+ * struct cam_sfe_bus_rd_err_irq_desc:
+ *
+ * @Brief:        Bus rd error irq description
+ */
+struct cam_sfe_bus_rd_err_irq_desc {
+	uint32_t  bitmask;
+	char     *err_name;
+	char     *desc;
+};
+
+/*
+ * struct cam_sfe_bus_rd_constraint_error_desc:
+ *
+ * @Brief:        Constraint error description
+ */
+struct cam_sfe_bus_rd_constraint_error_desc {
+	uint32_t bitmask;
+	char    *error_desc;
+};
+
+/*
+ * struct cam_sfe_bus_rd_constraint_error_info
+ *
+ * @Brief:        Constraint error info
+ *
+ * @constraint_error_list: Error description for various constraint errors.
+ * @num_cons_err:          Number of constraint violation errors.
+ * @cons_chk_en_avail:     Indicate if there is an option to enable constraint checker
+ *                         violation in core cfg reg for each client.
+ */
+struct cam_sfe_bus_rd_constraint_error_info {
+	struct cam_sfe_bus_rd_constraint_error_desc
+		*constraint_error_list;
+	uint32_t num_cons_err;
+	bool cons_chk_en_avail;
+};
+
+/*
+ * struct cam_sfe_bus_rd_reg_offset_common:
+ *
+ * @Brief:        Common registers across BUS RD Clients
+ */
+struct cam_sfe_bus_rd_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t misr_reset;
+	uint32_t pwr_iso_cfg;
+	uint32_t input_if_cmd;
+	uint32_t test_bus_ctrl;
+	uint32_t security_cfg;
+	uint32_t cons_violation_status;
+	uint32_t ccif_violation_status;
+	struct cam_irq_controller_reg_info irq_reg_info;
+};
+
+/*
+ * struct cam_sfe_bus_rd_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS RD Clients
+ */
+struct cam_sfe_bus_rd_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t buf_width;
+	uint32_t buf_height;
+	uint32_t stride;
+	uint32_t unpacker_cfg;
+	uint32_t latency_buf_allocation;
+	uint32_t system_cache_cfg;
+	uint32_t addr_cfg;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	char    *name;
+};
+
+/*
+ * struct cam_sfe_bus_rd_hw_info:
+ *
+ * @Brief:        HW capability of SFE Bus RD Client
+ */
+struct cam_sfe_bus_rd_info {
+	enum cam_sfe_bus_rd_type  sfe_bus_rd_type;
+	uint32_t                  mid[CAM_SFE_BUS_MAX_MID_PER_PORT];
+	uint32_t                  max_width;
+	uint32_t                  max_height;
+	uint32_t                  max_clk_threshold;
+	uint32_t                  nom_clk_threshold;
+	uint32_t                  min_clk_threshold;
+	uint32_t                  bytes_per_clk;
+};
+
+/*
+ * struct cam_sfe_bus_rd_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:             Common register details
+ * @num_client:             Number of bus rd clients
+ * @bus_client_reg:         Bus client register info
+ * @num_bus_rd_resc:        Number of SFE BUS RD masters
+ * @sfe_bus_rd_info:        SFE bus rd client info
+ * @top_irq_shift:          Top irq shift val
+ * @latency_buf_allocation: latency buf allocation
+ * @sys_cache_default_val:  System cache default config
+ * @irq_err_mask:           IRQ error mask
+ * @fs_sync_shift:          Shift to enable FS sync
+ * @constraint_error_info:  constraint violation errors info
+ */
+struct cam_sfe_bus_rd_hw_info {
+	struct cam_sfe_bus_rd_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_sfe_bus_rd_reg_offset_bus_client
+		bus_client_reg[CAM_SFE_BUS_RD_MAX_CLIENTS];
+	uint32_t num_bus_rd_resc;
+	struct cam_sfe_bus_rd_info
+		sfe_bus_rd_info[CAM_SFE_BUS_RD_MAX];
+	uint32_t num_bus_rd_errors;
+	struct cam_sfe_bus_rd_err_irq_desc *bus_rd_err_desc;
+	uint32_t top_irq_shift;
+	uint32_t latency_buf_allocation;
+	uint32_t sys_cache_default_val;
+	uint32_t irq_err_mask;
+	uint32_t fs_sync_shift;
+	struct cam_sfe_bus_rd_constraint_error_info *constraint_error_info;
+	bool rd_only;
+};
+
+/*
+ * cam_sfe_bus_rd_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @sfe_bus:                 Pointer to sfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_rd_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *sfe_irq_controller,
+	struct cam_sfe_bus                  **sfe_bus);
+
+/*
+ * cam_sfe_bus_rd_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @sfe_bus:                 Pointer to sfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_rd_deinit(struct cam_sfe_bus       **sfe_bus);
+
+#endif /* _CAM_SFE_BUS_RD_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.c
@@ -0,0 +1,3704 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_wr.h"
+#include "cam_sfe_core.h"
+#include "cam_sfe_soc.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+
+static const char drv_name[] = "sfe_bus_wr";
+
+#define CAM_SFE_BUS_WR_PAYLOAD_MAX             256
+
+#define CAM_SFE_RDI_BUS_DEFAULT_WIDTH          0xFFFF
+#define CAM_SFE_RDI_BUS_DEFAULT_STRIDE         0xFFFF
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	(sizeof(struct cam_sfe_bus_reg_offset_bus_client) / 4)
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+enum cam_sfe_bus_wr_packer_format {
+	PACKER_FMT_PLAIN_128,
+	PACKER_FMT_PLAIN_8,
+	PACKER_FMT_PLAIN_8_ODD_EVEN,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN,
+	PACKER_FMT_PLAIN_16_10BPP,
+	PACKER_FMT_PLAIN_16_12BPP,
+	PACKER_FMT_PLAIN_16_14BPP,
+	PACKER_FMT_PLAIN_16_16BPP,
+	PACKER_FMT_PLAIN_32,
+	PACKER_FMT_PLAIN_64,
+	PACKER_FMT_TP_10,
+	PACKER_FMT_MIPI10,
+	PACKER_FMT_MIPI12,
+	PACKER_FMT_MIPI14,
+	PACKER_FMT_MIPI20,
+	PACKER_FMT_PLAIN_32_20BPP,
+	PACKER_FMT_MAX,
+};
+
+enum cam_sfe_bus_wr_wm_mode {
+	CAM_SFE_WM_LINE_BASED_MODE,
+	CAM_SFE_WM_FRAME_BASED_MODE,
+	CAM_SFE_WM_INDEX_BASED_MODE,
+};
+
+struct cam_sfe_bus_wr_common_data {
+	uint32_t                                    core_index;
+	uint32_t                                    hw_version;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *sfe_irq_controller;
+	void                                       *buf_done_controller;
+	void                                       *bus_irq_controller;
+	struct cam_sfe_bus_reg_offset_common       *common_reg;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+	struct list_head                            free_payload_list;
+	spinlock_t                                  spin_lock;
+	struct cam_sfe_bus_wr_irq_evt_payload       evt_payload[
+		CAM_SFE_BUS_WR_PAYLOAD_MAX];
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    addr_no_sync;
+	uint32_t                                    line_done_cfg;
+	uint32_t                                    pack_align_shift;
+	uint32_t                                    max_bw_counter_limit;
+	bool                                        err_irq_subscribe;
+	cam_hw_mgr_event_cb_func                    event_cb;
+	uint32_t                                    irq_err_mask;
+
+	uint32_t                                    sys_cache_default_cfg;
+	uint32_t                                    sfe_debug_cfg;
+	struct cam_sfe_bus_cache_dbg_cfg            cache_dbg_cfg;
+	struct cam_hw_soc_info                     *soc_info;
+};
+
+struct cam_sfe_wr_scratch_buf_info {
+	uint32_t     width;
+	uint32_t     height;
+	uint32_t     stride;
+	uint32_t     slice_height;
+	dma_addr_t   io_addr;
+};
+
+struct cam_sfe_bus_wr_wm_resource_data {
+	uint32_t             index;
+	struct cam_sfe_bus_wr_common_data         *common_data;
+	struct cam_sfe_bus_reg_offset_bus_client  *hw_regs;
+	struct cam_sfe_wr_scratch_buf_info scratch_buf_info;
+
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	enum cam_sfe_bus_wr_packer_format pack_fmt;
+	enum cam_sfe_bus_wr_wm_mode wm_mode;
+
+	uint32_t             h_init;
+
+	uint32_t             irq_subsample_period;
+	uint32_t             irq_subsample_pattern;
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             en_cfg;
+	uint32_t             is_dual;
+
+	uint32_t             acquired_width;
+	uint32_t             acquired_height;
+
+	uint32_t             cache_cfg;
+	int32_t              current_scid;
+	bool                 enable_caching;
+	bool                 init_cfg_done;
+	bool                 hfr_cfg_done;
+	bool                 use_wm_pack;
+	bool                 en_line_done;
+};
+
+struct cam_sfe_bus_wr_comp_grp_data {
+	enum cam_sfe_bus_wr_comp_grp_type          comp_grp_type;
+	uint32_t                                   comp_done_mask;
+	struct cam_sfe_bus_wr_common_data         *common_data;
+
+	uint32_t                                   is_master;
+	uint32_t                                   is_dual;
+	uint32_t                                   dual_slave_core;
+	uint32_t                                   intra_client_mask;
+	uint32_t                                   addr_sync_mode;
+	uint32_t                                   composite_mask;
+
+	uint32_t                                   acquire_dev_cnt;
+	uint32_t                                   irq_trigger_cnt;
+};
+
+struct cam_sfe_bus_wr_out_data {
+	uint32_t                              out_type;
+	uint32_t                              source_group;
+	struct cam_sfe_bus_wr_common_data    *common_data;
+	struct cam_sfe_bus_wr_priv           *bus_priv;
+
+	uint32_t                           num_wm;
+	struct cam_isp_resource_node      *wm_res;
+
+	struct cam_isp_resource_node      *comp_grp;
+	struct list_head                   sfe_out_list;
+
+	uint32_t                           is_master;
+	uint32_t                           is_dual;
+
+	uint32_t                           format;
+	uint32_t                           max_width;
+	uint32_t                           max_height;
+	struct cam_cdm_utils_ops          *cdm_util_ops;
+	uint32_t                           secure_mode;
+	void                              *priv;
+};
+
+struct cam_sfe_bus_wr_priv {
+	struct cam_sfe_bus_wr_common_data   common_data;
+	uint32_t                            num_client;
+	uint32_t                            num_out;
+	uint32_t                            max_out_res;
+	uint32_t                            num_comp_grp;
+	uint32_t                            top_irq_shift;
+
+	struct cam_isp_resource_node       *comp_grp;
+	struct cam_isp_resource_node       *sfe_out;
+
+	int                                 bus_irq_handle;
+	int                                 error_irq_handle;
+	void                               *tasklet_info;
+	struct cam_sfe_bus_wr_constraint_error_info *constraint_error_info;
+	struct cam_sfe_bus_sfe_out_hw_info *sfe_out_hw_info;
+	struct cam_sfe_bus_wr_hw_info      *bus_wr_hw_info;
+};
+
+static int cam_sfe_bus_subscribe_error_irq(
+	struct cam_sfe_bus_wr_priv  *bus_priv);
+
+static inline int32_t cam_sfe_bus_wr_get_out_type(
+	struct cam_sfe_bus_wr_priv *bus_priv,
+	int32_t index)
+{
+	int32_t sfe_out_type = CAM_SFE_BUS_SFE_OUT_MAX;
+
+	if (bus_priv && bus_priv->sfe_out_hw_info)
+		sfe_out_type =
+			bus_priv->sfe_out_hw_info[index].sfe_out_type;
+
+	return sfe_out_type;
+}
+
+static bool cam_sfe_bus_can_be_secure(uint32_t out_type)
+{
+	switch (out_type) {
+	case CAM_SFE_BUS_SFE_OUT_RAW_DUMP:
+	case CAM_SFE_BUS_SFE_OUT_RDI0:
+	case CAM_SFE_BUS_SFE_OUT_RDI1:
+	case CAM_SFE_BUS_SFE_OUT_RDI2:
+	case CAM_SFE_BUS_SFE_OUT_RDI3:
+	case CAM_SFE_BUS_SFE_OUT_RDI4:
+	case CAM_SFE_BUS_SFE_OUT_IR:
+		return true;
+	case CAM_SFE_BUS_SFE_OUT_LCR:
+	case CAM_SFE_BUS_SFE_OUT_BE_0:
+	case CAM_SFE_BUS_SFE_OUT_BHIST_0:
+	case CAM_SFE_BUS_SFE_OUT_BE_1:
+	case CAM_SFE_BUS_SFE_OUT_BHIST_1:
+	case CAM_SFE_BUS_SFE_OUT_BE_2:
+	case CAM_SFE_BUS_SFE_OUT_BHIST_2:
+	case CAM_SFE_BUS_SFE_OUT_BAYER_RS_0:
+	case CAM_SFE_BUS_SFE_OUT_BAYER_RS_1:
+	case CAM_SFE_BUS_SFE_OUT_BAYER_RS_2:
+	case CAM_SFE_BUS_SFE_OUT_HDR_STATS:
+	default:
+		return false;
+	}
+}
+
+static enum cam_sfe_bus_sfe_out_type
+	cam_sfe_bus_wr_get_out_res_id(uint32_t res_type)
+{
+	switch (res_type) {
+	case CAM_ISP_SFE_OUT_RES_RAW_DUMP:
+		return CAM_SFE_BUS_SFE_OUT_RAW_DUMP;
+	case CAM_ISP_SFE_OUT_RES_RDI_0:
+		return CAM_SFE_BUS_SFE_OUT_RDI0;
+	case CAM_ISP_SFE_OUT_RES_RDI_1:
+		return CAM_SFE_BUS_SFE_OUT_RDI1;
+	case CAM_ISP_SFE_OUT_RES_RDI_2:
+		return CAM_SFE_BUS_SFE_OUT_RDI2;
+	case CAM_ISP_SFE_OUT_RES_RDI_3:
+		return CAM_SFE_BUS_SFE_OUT_RDI3;
+	case CAM_ISP_SFE_OUT_RES_RDI_4:
+		return CAM_SFE_BUS_SFE_OUT_RDI4;
+	case CAM_ISP_SFE_OUT_BE_STATS_0:
+		return CAM_SFE_BUS_SFE_OUT_BE_0;
+	case CAM_ISP_SFE_OUT_BHIST_STATS_0:
+		return CAM_SFE_BUS_SFE_OUT_BHIST_0;
+	case CAM_ISP_SFE_OUT_BE_STATS_1:
+		return CAM_SFE_BUS_SFE_OUT_BE_1;
+	case CAM_ISP_SFE_OUT_BHIST_STATS_1:
+		return CAM_SFE_BUS_SFE_OUT_BHIST_1;
+	case CAM_ISP_SFE_OUT_BE_STATS_2:
+		return CAM_SFE_BUS_SFE_OUT_BE_2;
+	case CAM_ISP_SFE_OUT_BHIST_STATS_2:
+		return CAM_SFE_BUS_SFE_OUT_BHIST_2;
+	case CAM_ISP_SFE_OUT_RES_LCR:
+		return CAM_SFE_BUS_SFE_OUT_LCR;
+	case CAM_ISP_SFE_OUT_RES_IR:
+		return CAM_SFE_BUS_SFE_OUT_IR;
+	case CAM_ISP_SFE_OUT_BAYER_RS_STATS_0:
+		return CAM_SFE_BUS_SFE_OUT_BAYER_RS_0;
+	case CAM_ISP_SFE_OUT_BAYER_RS_STATS_1:
+		return CAM_SFE_BUS_SFE_OUT_BAYER_RS_1;
+	case CAM_ISP_SFE_OUT_BAYER_RS_STATS_2:
+		return CAM_SFE_BUS_SFE_OUT_BAYER_RS_2;
+	case CAM_ISP_SFE_OUT_HDR_STATS:
+		return CAM_SFE_BUS_SFE_OUT_HDR_STATS;
+	default:
+		return CAM_SFE_BUS_SFE_OUT_MAX;
+	}
+}
+
+bool cam_sfe_is_mipi_pcking_needed(
+	struct cam_sfe_bus_wr_priv *bus_priv,
+	int wm_index)
+{
+	int i;
+
+	for(i = 0; i < bus_priv->num_out; i++)
+	{
+		if (((wm_index == bus_priv->sfe_out_hw_info[i].wm_idx) &&
+			(bus_priv->sfe_out_hw_info[i].sfe_out_type ==
+				CAM_SFE_BUS_SFE_OUT_RAW_DUMP)) ||
+			((wm_index == bus_priv->sfe_out_hw_info[i].wm_idx) &&
+				(bus_priv->sfe_out_hw_info[i].sfe_out_type ==
+					CAM_SFE_BUS_SFE_OUT_IR)))
+		       return true;
+	}
+
+	return false;
+}
+
+static enum cam_sfe_bus_wr_packer_format
+	cam_sfe_bus_get_packer_fmt(
+	struct cam_sfe_bus_wr_priv *bus_priv,
+	uint32_t out_fmt,
+	int wm_index)
+{
+	bool is_mipi_packing =
+		cam_sfe_is_mipi_pcking_needed(bus_priv, wm_index);
+
+	switch (out_fmt) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PD8:
+		return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_MIPI_RAW_10:
+		if (is_mipi_packing)
+			return PACKER_FMT_MIPI10;
+		else
+			return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_MIPI_RAW_12:
+		if (is_mipi_packing)
+			return PACKER_FMT_MIPI12;
+		else
+			return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_MIPI_RAW_14:
+		if (is_mipi_packing)
+			return PACKER_FMT_MIPI14;
+		else
+			return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_MIPI_RAW_20:
+		if (is_mipi_packing)
+			return PACKER_FMT_MIPI20;
+		else
+			return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_PLAIN8:
+		return PACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_NV12:
+	case CAM_FORMAT_UBWC_NV12:
+	case CAM_FORMAT_UBWC_NV12_4R:
+	case CAM_FORMAT_Y_ONLY:
+		return PACKER_FMT_PLAIN_8_LSB_MSB_10;
+	case CAM_FORMAT_PLAIN16_10:
+		return PACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return PACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return PACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN16_16:
+		return PACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN32:
+	case CAM_FORMAT_ARGB:
+		return PACKER_FMT_PLAIN_32;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_ARGB_16:
+	case CAM_FORMAT_PD10:
+		return PACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_UBWC_TP10:
+	case CAM_FORMAT_TP10:
+		return PACKER_FMT_TP_10;
+	default:
+		return PACKER_FMT_MAX;
+	}
+}
+
+static void cam_sfe_bus_wr_print_constraint_errors(
+	struct cam_sfe_bus_wr_priv *bus_priv,
+	uint8_t *wm_name,
+	uint32_t constraint_errors)
+{
+	struct cam_sfe_bus_wr_constraint_error_info *constraint_err_info;
+	uint32_t i;
+
+	CAM_ERR(CAM_ISP, "Constraint violation bitflags: 0x%X",
+		constraint_errors);
+
+	constraint_err_info = bus_priv->constraint_error_info;
+	for (i = 0; i < constraint_err_info->num_cons_err; i++) {
+		if (constraint_err_info->constraint_error_list[i].bitmask &
+			constraint_errors) {
+			CAM_ERR(CAM_SFE, "WM: %s Error_desc: %s", wm_name,
+				constraint_err_info->constraint_error_list[i].error_description);
+		}
+	}
+}
+
+static void cam_sfe_bus_wr_get_constraint_errors(
+	bool                       *skip_error_notify,
+	struct cam_sfe_bus_wr_priv *bus_priv,
+	uint32_t *cons_err)
+{
+	uint32_t i, j, sfe_out_type;
+	uint8_t *wm_name = NULL;
+	struct cam_isp_resource_node              *out_rsrc_node = NULL;
+	struct cam_sfe_bus_wr_out_data            *out_rsrc_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data    *wm_data   = NULL;
+	struct cam_sfe_bus_wr_common_data         *common_data = NULL;
+	struct cam_sfe_bus_wr_constraint_error_info      *cons_err_info = NULL;
+	bool out_rsrc_is_rdi;
+
+	cons_err_info = bus_priv->constraint_error_info;
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		sfe_out_type = cam_sfe_bus_wr_get_out_type(bus_priv, i);
+		if ((sfe_out_type < 0) ||
+			(sfe_out_type >= CAM_SFE_BUS_SFE_OUT_MAX)) {
+			CAM_ERR(CAM_SFE, "Invalid sfe out type:%d",
+				sfe_out_type);
+			return;
+		}
+
+		out_rsrc_node = &bus_priv->sfe_out[sfe_out_type];
+		if (!out_rsrc_node || !out_rsrc_node->res_priv) {
+			CAM_DBG(CAM_ISP,
+				"SFE out:%d out rsrc node or data is NULL", i);
+			continue;
+		}
+
+		out_rsrc_data = out_rsrc_node->res_priv;
+		common_data = out_rsrc_data->common_data;
+
+		if ((out_rsrc_data->out_type >= CAM_SFE_BUS_SFE_OUT_RDI0) &&
+			(out_rsrc_data->out_type <= CAM_SFE_BUS_SFE_OUT_RDI4))
+			out_rsrc_is_rdi = true;
+		else
+			out_rsrc_is_rdi = false;
+
+		for (j = 0; j < out_rsrc_data->num_wm; j++) {
+			wm_data = out_rsrc_data->wm_res[j].res_priv;
+			wm_name = out_rsrc_data->wm_res[j].res_name;
+			if (!wm_data)
+				continue;
+
+			*cons_err = cam_io_r_mb(common_data->mem_base +
+				wm_data->hw_regs->debug_status_1);
+			if (*cons_err == 0)
+				continue;
+
+			/*
+			 * Due to HW bug in constraint checker which signals false alert,
+			 * skip image addr unalign constraint error for RDI WMs on
+			 * SFE v780 or older and skip image width unalign constraint error
+			 * for any WM when programmed in frame base mode.
+			 */
+
+			if (out_rsrc_is_rdi && (*cons_err &
+				BIT(cons_err_info->img_addr_unalign_shift))) {
+				*skip_error_notify = true;
+				CAM_DBG(CAM_SFE,
+					"Ignoring Image Addr Unalign error on SFE[%u] out rsrc: %u WM: %s",
+				common_data->core_index, out_rsrc_data->out_type, wm_name);
+				continue;
+			}
+
+			if ((*cons_err & BIT(cons_err_info->img_width_unalign_shift)) &&
+				(wm_data->en_cfg & BIT(16))) {
+				*skip_error_notify = true;
+				CAM_DBG(CAM_SFE,
+					"Ignoring Image Width Unalign error on SFE[%u] out rsrc: %u WM: %s in frame based mode",
+					common_data->core_index, out_rsrc_data->out_type, wm_name);
+				continue;
+			}
+
+			cam_sfe_bus_wr_print_constraint_errors(
+				bus_priv, wm_name, *cons_err);
+		}
+	}
+}
+
+static inline void cam_sfe_bus_config_rdi_wm_frame_based_mode(
+	struct cam_sfe_bus_wr_wm_resource_data  *rsrc_data)
+{
+	rsrc_data->width = CAM_SFE_RDI_BUS_DEFAULT_WIDTH;
+	rsrc_data->height = 0;
+	rsrc_data->stride = CAM_SFE_RDI_BUS_DEFAULT_STRIDE;
+	rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+}
+
+static int cam_sfe_bus_config_rdi_wm(
+	struct cam_sfe_bus_wr_wm_resource_data  *rsrc_data)
+{
+
+	rsrc_data->pack_fmt = PACKER_FMT_PLAIN_128;
+	switch (rsrc_data->format) {
+	case CAM_FORMAT_MIPI_RAW_10:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 5) / 4, 16) / 16;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+
+		if (rsrc_data->use_wm_pack) {
+			rsrc_data->pack_fmt = PACKER_FMT_MIPI10;
+			if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE)
+				rsrc_data->width = ALIGNUP((rsrc_data->acquired_width), 8);
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_6:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 3) / 4, 16) / 16;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width, 16) / 16;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 3) / 2, 16) / 16;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+
+		if (rsrc_data->use_wm_pack) {
+			rsrc_data->pack_fmt = PACKER_FMT_MIPI12;
+			if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE)
+				rsrc_data->width = ALIGNUP((rsrc_data->acquired_width), 8);
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 7) / 2, 16) / 16;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		if (rsrc_data->use_wm_pack) {
+			rsrc_data->pack_fmt = PACKER_FMT_MIPI14;
+			if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE)
+				rsrc_data->width = ALIGNUP((rsrc_data->acquired_width), 8);
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 2), 16) / 16;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 5) / 2, 16) / 16;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		break;
+	case CAM_FORMAT_PLAIN128:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 16), 16) / 16;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		break;
+	case CAM_FORMAT_PLAIN32_20:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 4), 16) / 16;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		break;
+	case CAM_FORMAT_PLAIN8:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->stride = rsrc_data->width * 2;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		break;
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_12:
+	case CAM_FORMAT_PLAIN16_14:
+	case CAM_FORMAT_PLAIN16_16:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 2, 16) / 16;
+			rsrc_data->en_cfg = 0x1;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		break;
+	case CAM_FORMAT_PLAIN64:
+		if (rsrc_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 8, 16) / 16;
+			rsrc_data->en_cfg = 0x1;
+		} else if (rsrc_data->wm_mode == CAM_SFE_WM_FRAME_BASED_MODE) {
+			cam_sfe_bus_config_rdi_wm_frame_based_mode(rsrc_data);
+		} else {
+			CAM_WARN(CAM_SFE, "No index mode support for SFE WM: %u",
+				rsrc_data->index);
+		}
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Unsupported RDI format %d",
+			rsrc_data->format);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_acquire_wm(
+	struct cam_sfe_bus_wr_priv             *bus_priv,
+	struct cam_sfe_hw_sfe_out_acquire_args *out_acq_args,
+	void                                   *tasklet,
+	enum cam_sfe_bus_sfe_out_type           sfe_out_res_id,
+	enum cam_sfe_bus_plane_type             plane,
+	struct cam_isp_resource_node           *wm_res,
+	uint32_t                               *comp_done_mask,
+	enum cam_sfe_bus_wr_comp_grp_type      *comp_grp_id)
+{
+	int32_t wm_idx = 0, rc;
+	struct cam_sfe_bus_wr_wm_resource_data  *rsrc_data = NULL;
+	char wm_mode[50] = {0};
+
+	if (wm_res->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_SFE, "WM:%d not available state:%d",
+			wm_idx, wm_res->res_state);
+		return -EALREADY;
+	}
+
+	rsrc_data = wm_res->res_priv;
+	wm_idx = rsrc_data->index;
+	rsrc_data->format = out_acq_args->out_port_info->format;
+	rsrc_data->use_wm_pack = out_acq_args->use_wm_pack;
+	rsrc_data->pack_fmt = cam_sfe_bus_get_packer_fmt(bus_priv,
+		rsrc_data->format, wm_idx);
+
+	rsrc_data->width = out_acq_args->out_port_info->width;
+	rsrc_data->height = out_acq_args->out_port_info->height;
+	rsrc_data->acquired_width = out_acq_args->out_port_info->width;
+	rsrc_data->acquired_height = out_acq_args->out_port_info->height;
+	rsrc_data->is_dual = out_acq_args->is_dual;
+	rsrc_data->enable_caching =  false;
+	rsrc_data->offset = 0;
+
+	/* RDI0-4 line based mode by default */
+	if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_RDI0 ||
+		sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_RDI1 ||
+		sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_RDI2 ||
+		sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_RDI3 ||
+		sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_RDI4)
+		rsrc_data->wm_mode = CAM_SFE_WM_LINE_BASED_MODE;
+
+	/* Set WM offset value to default */
+	rsrc_data->offset  = 0;
+	CAM_DBG(CAM_SFE, "WM:%d width %d height %d", rsrc_data->index,
+		rsrc_data->width, rsrc_data->height);
+
+	if ((sfe_out_res_id >= CAM_SFE_BUS_SFE_OUT_RDI0) &&
+		(sfe_out_res_id <= CAM_SFE_BUS_SFE_OUT_RDI4)) {
+		rc = cam_sfe_bus_config_rdi_wm(rsrc_data);
+		if (rc)
+			return rc;
+	} else if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_RAW_DUMP) {
+		rsrc_data->stride = rsrc_data->width;
+		rsrc_data->en_cfg = 0x1;
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+			/* LSB aligned */
+			rsrc_data->pack_fmt |=
+				(1 << bus_priv->common_data.pack_align_shift);
+			break;
+		default:
+			break;
+		}
+	} else if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_IR) {
+		rsrc_data->stride = rsrc_data->width;
+		rsrc_data->en_cfg = 0x1;
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+			/* LSB aligned */
+			rsrc_data->pack_fmt |=
+				(1 << bus_priv->common_data.pack_align_shift);
+			break;
+		default:
+			break;
+		}
+	} else if ((sfe_out_res_id >= CAM_SFE_BUS_SFE_OUT_BE_0) &&
+		(sfe_out_res_id <= CAM_SFE_BUS_SFE_OUT_BAYER_RS_2)) {
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+	} else if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_LCR) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			/* LSB aligned */
+			rsrc_data->pack_fmt |=
+				(1 << bus_priv->common_data.pack_align_shift);
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Invalid format %d out_type:%d",
+				rsrc_data->format, sfe_out_res_id);
+			return -EINVAL;
+		}
+	} else if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_HDR_STATS) {
+		rsrc_data->en_cfg = 0x1;
+		rsrc_data->stride = rsrc_data->width;
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+			/* LSB aligned */
+			rsrc_data->pack_fmt |=
+				(1 << bus_priv->common_data.pack_align_shift);
+			break;
+		default:
+			break;
+		}
+	} else {
+		CAM_ERR(CAM_SFE, "Invalid out_type:%d requested",
+			sfe_out_res_id);
+		return -EINVAL;
+	}
+
+	*comp_grp_id = rsrc_data->hw_regs->comp_group;
+	*comp_done_mask |= (1 << sfe_out_res_id);
+
+	switch (rsrc_data->en_cfg) {
+	case 0x1:
+		strscpy(wm_mode, "line-based", sizeof(wm_mode));
+		break;
+	case ((0x1 << 16) | 0x1):
+		strscpy(wm_mode, "frame-based", sizeof(wm_mode));
+		break;
+	case ((0x2 << 16) | 0x1):
+		strscpy(wm_mode, "index-based", sizeof(wm_mode));
+		break;
+	}
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	wm_res->tasklet_info = tasklet;
+
+	CAM_DBG(CAM_SFE,
+		"SFE:%d WM:%d %s processed width:%d height:%d format:0x%X pack_fmt 0x%x %s",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		wm_res->res_name, rsrc_data->width, rsrc_data->height,
+		rsrc_data->format, rsrc_data->pack_fmt, wm_mode);
+	return 0;
+}
+
+static int cam_sfe_bus_release_wm(void   *bus_priv,
+	struct cam_isp_resource_node     *wm_res)
+{
+	struct cam_sfe_bus_wr_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->pack_fmt = 0;
+	rsrc_data->irq_subsample_period = 0;
+	rsrc_data->irq_subsample_pattern = 0;
+	rsrc_data->framedrop_period = 0;
+	rsrc_data->framedrop_pattern = 0;
+	rsrc_data->h_init = 0;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+	rsrc_data->enable_caching =  false;
+	rsrc_data->offset = 0;
+
+	wm_res->tasklet_info = NULL;
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_SFE, "SFE:%d Release WM:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	return 0;
+}
+
+static int cam_sfe_bus_start_wm(struct cam_isp_resource_node *wm_res)
+{
+	const uint32_t image_cfg_height_shift_val = 16;
+	const uint32_t enable_debug_status_1 = 11 << 8;
+	struct cam_sfe_bus_wr_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_sfe_bus_wr_common_data        *common_data =
+		rsrc_data->common_data;
+
+	cam_io_w((rsrc_data->height << image_cfg_height_shift_val)
+		| rsrc_data->width, common_data->mem_base +
+		rsrc_data->hw_regs->image_cfg_0);
+	cam_io_w(rsrc_data->pack_fmt,
+		common_data->mem_base + rsrc_data->hw_regs->packer_cfg);
+
+	/* configure line_done_cfg for RDI0-2 */
+	if (rsrc_data->en_line_done) {
+		CAM_DBG(CAM_SFE, "configure line_done_cfg 0x%x for WM: %d",
+			rsrc_data->common_data->line_done_cfg,
+			rsrc_data->index);
+		cam_io_w_mb(rsrc_data->common_data->line_done_cfg,
+			common_data->mem_base +
+			rsrc_data->hw_regs->line_done_cfg);
+	}
+
+	if (!(common_data->sfe_debug_cfg & SFE_DEBUG_DISABLE_MMU_PREFETCH)) {
+		cam_io_w_mb(1, common_data->mem_base +
+			rsrc_data->hw_regs->mmu_prefetch_cfg);
+		cam_io_w_mb(0xFFFFFFFF, common_data->mem_base +
+			rsrc_data->hw_regs->mmu_prefetch_max_offset);
+		CAM_DBG(CAM_SFE, "SFE: %u WM: %u MMU prefetch enabled",
+			rsrc_data->common_data->core_index,
+			rsrc_data->index);
+	}
+
+	/* Enable WM */
+	cam_io_w_mb(rsrc_data->en_cfg, common_data->mem_base +
+		rsrc_data->hw_regs->cfg);
+
+	/* Enable constraint error detection */
+	cam_io_w_mb(enable_debug_status_1,
+		common_data->mem_base +
+		rsrc_data->hw_regs->debug_status_cfg);
+
+	CAM_DBG(CAM_SFE,
+		"Start SFE:%d WM:%d %s offset:0x%X en_cfg:0x%X width:%d height:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		wm_res->res_name, (uint32_t) rsrc_data->hw_regs->cfg,
+		rsrc_data->en_cfg, rsrc_data->width, rsrc_data->height);
+	CAM_DBG(CAM_SFE, "WM:%d pk_fmt:%d stride:%d",
+		rsrc_data->index, rsrc_data->pack_fmt & PACKER_FMT_MAX,
+		rsrc_data->stride);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_sfe_bus_stop_wm(struct cam_isp_resource_node *wm_res)
+{
+	struct cam_sfe_bus_wr_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_sfe_bus_wr_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable WM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+	CAM_DBG(CAM_SFE, "Stop SFE:%d WM:%d %s",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		wm_res->res_name);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+
+	return 0;
+}
+
+static int cam_sfe_bus_handle_wm_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_sfe_bus_handle_wm_done_bottom_half(void *wm_node,
+	void *evt_payload_priv)
+{
+	return -EPERM;
+}
+
+static int cam_sfe_bus_init_wm_resource(uint32_t index,
+	struct cam_sfe_bus_wr_priv      *bus_priv,
+	struct cam_sfe_bus_wr_hw_info   *hw_info,
+	struct cam_isp_resource_node    *wm_res,
+	struct cam_isp_resource_node    **comp_grp,
+	uint8_t                         *wm_name,
+	bool                             en_line_done)
+{
+	struct cam_sfe_bus_wr_wm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_wr_wm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for WM res priv");
+		return -ENOMEM;
+	}
+
+	wm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->en_line_done = en_line_done;
+	rsrc_data->hw_regs = &hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &bus_priv->common_data;
+	*comp_grp = &bus_priv->comp_grp[(&hw_info->bus_client_reg[index])->comp_group];
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = cam_sfe_bus_start_wm;
+	wm_res->stop = cam_sfe_bus_stop_wm;
+	wm_res->top_half_handler = cam_sfe_bus_handle_wm_done_top_half;
+	wm_res->bottom_half_handler =
+		cam_sfe_bus_handle_wm_done_bottom_half;
+	wm_res->hw_intf = bus_priv->common_data.hw_intf;
+	if (wm_name)
+		scnprintf(wm_res->res_name, CAM_ISP_RES_NAME_LEN, "%s",
+			wm_name);
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_wm_resource(
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_sfe_bus_wr_wm_resource_data *rsrc_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = NULL;
+	wm_res->bottom_half_handler = NULL;
+	wm_res->hw_intf = NULL;
+
+	rsrc_data = wm_res->res_priv;
+	wm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static void cam_sfe_bus_add_wm_to_comp_grp(
+	struct cam_isp_resource_node    *comp_grp,
+	uint32_t                         composite_mask)
+{
+	struct cam_sfe_bus_wr_comp_grp_data  *rsrc_data = comp_grp->res_priv;
+
+	rsrc_data->composite_mask |= composite_mask;
+}
+
+static int cam_sfe_bus_acquire_comp_grp(
+	struct cam_sfe_bus_wr_priv           *bus_priv,
+	struct cam_isp_out_port_generic_info *out_port_info,
+	void                                 *tasklet,
+	uint32_t                              is_dual,
+	uint32_t                              is_master,
+	struct cam_isp_resource_node         *comp_grp,
+	enum cam_sfe_bus_wr_comp_grp_type     comp_grp_id)
+{
+	int rc = 0;
+	struct cam_sfe_bus_wr_comp_grp_data  *rsrc_data = NULL;
+
+	rsrc_data = comp_grp->res_priv;
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		rsrc_data->intra_client_mask = 0x1;
+		comp_grp->tasklet_info = tasklet;
+		comp_grp->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		rsrc_data->is_master = is_master;
+		rsrc_data->is_dual = is_dual;
+
+		if (is_master)
+			rsrc_data->addr_sync_mode = 0;
+		else
+			rsrc_data->addr_sync_mode = 1;
+
+	} else {
+		rsrc_data = comp_grp->res_priv;
+		/* Do not support runtime change in composite mask */
+		if (comp_grp->res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) {
+			CAM_ERR(CAM_SFE, "Invalid State %d comp_grp:%u",
+				comp_grp->res_state,
+				rsrc_data->comp_grp_type);
+			return -EBUSY;
+		}
+	}
+
+	CAM_DBG(CAM_SFE, "Acquire SFE:%d comp_grp:%u",
+		rsrc_data->common_data->core_index, rsrc_data->comp_grp_type);
+
+	rsrc_data->acquire_dev_cnt++;
+
+	return rc;
+}
+
+static int cam_sfe_bus_release_comp_grp(
+	struct cam_sfe_bus_wr_priv         *bus_priv,
+	struct cam_isp_resource_node       *in_comp_grp)
+{
+	struct cam_sfe_bus_wr_comp_grp_data  *in_rsrc_data = NULL;
+
+	if (!in_comp_grp) {
+		CAM_ERR(CAM_SFE, "Invalid Params comp_grp %pK", in_comp_grp);
+		return -EINVAL;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_SFE, "Already released comp_grp");
+		return 0;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_SFE, "Invalid State %d",
+			in_comp_grp->res_state);
+		return -EBUSY;
+	}
+
+	in_rsrc_data = in_comp_grp->res_priv;
+	CAM_DBG(CAM_SFE, "Release SFE:%d comp_grp:%u",
+		bus_priv->common_data.core_index,
+		in_rsrc_data->comp_grp_type);
+
+	in_rsrc_data->acquire_dev_cnt--;
+	if (in_rsrc_data->acquire_dev_cnt == 0) {
+
+		in_rsrc_data->dual_slave_core = CAM_SFE_CORE_MAX;
+		in_rsrc_data->addr_sync_mode = 0;
+		in_rsrc_data->composite_mask = 0;
+
+		in_comp_grp->tasklet_info = NULL;
+		in_comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_start_comp_grp(
+	struct cam_isp_resource_node *comp_grp,
+	uint32_t *bus_irq_reg_mask)
+{
+	int rc = 0;
+	struct cam_sfe_bus_wr_comp_grp_data *rsrc_data = NULL;
+
+	rsrc_data = comp_grp->res_priv;
+
+	CAM_DBG(CAM_SFE,
+		"Start SFE:%d comp_grp:%d streaming state:%d comp_mask:0x%X",
+		rsrc_data->common_data->core_index,
+		rsrc_data->comp_grp_type, comp_grp->res_state,
+		rsrc_data->composite_mask);
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		return 0;
+
+	/* CSID buf done register */
+	bus_irq_reg_mask[0] = rsrc_data->comp_done_mask;
+
+	CAM_DBG(CAM_SFE, "Start Done SFE:%d comp_grp:%d buf_done_mask:0x%x",
+		rsrc_data->common_data->core_index,
+		rsrc_data->comp_grp_type,
+		bus_irq_reg_mask[0]);
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static inline int cam_sfe_bus_stop_comp_grp(
+	struct cam_isp_resource_node          *comp_grp)
+{
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_init_comp_grp(uint32_t index,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_sfe_bus_wr_priv    *bus_priv,
+	struct cam_sfe_bus_wr_hw_info *hw_info,
+	struct cam_isp_resource_node  *comp_grp)
+{
+	struct cam_sfe_bus_wr_comp_grp_data *rsrc_data = NULL;
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_wr_comp_grp_data),
+		GFP_KERNEL);
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	comp_grp->res_priv = rsrc_data;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	rsrc_data->comp_grp_type   = index;
+	rsrc_data->common_data     = &bus_priv->common_data;
+	rsrc_data->dual_slave_core = CAM_SFE_CORE_MAX;
+	rsrc_data->comp_done_mask = hw_info->comp_done_mask[index];
+
+	comp_grp->top_half_handler = NULL;
+	comp_grp->hw_intf = bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_comp_grp(
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_sfe_bus_wr_comp_grp_data *rsrc_data =
+		comp_grp->res_priv;
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = NULL;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = NULL;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+	comp_grp->res_priv = NULL;
+
+	if (!rsrc_data) {
+		CAM_ERR(CAM_SFE, "comp_grp_priv is NULL");
+		return -ENODEV;
+	}
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update  *secure_mode = cmd_args;
+	struct cam_sfe_bus_wr_out_data    *rsrc_data;
+	uint32_t                          *mode;
+
+	rsrc_data = (struct cam_sfe_bus_wr_out_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode = (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_sfe_bus_acquire_sfe_out(void *priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                     rc = -ENODEV;
+	int                                     i;
+	enum cam_sfe_bus_sfe_out_type           sfe_out_res_id;
+	struct cam_sfe_bus_wr_priv             *bus_priv = priv;
+	struct cam_sfe_acquire_args            *acq_args = acquire_args;
+	struct cam_sfe_hw_sfe_out_acquire_args *out_acquire_args;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_sfe_bus_wr_out_data         *rsrc_data = NULL;
+	uint32_t                                secure_caps = 0, mode;
+	enum cam_sfe_bus_wr_comp_grp_type       comp_grp_id;
+	uint32_t                                client_done_mask = 0;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_SFE, "Invalid Param");
+		return -EINVAL;
+	}
+
+	comp_grp_id = CAM_SFE_BUS_WR_COMP_GRP_MAX;
+	out_acquire_args = &acq_args->sfe_out;
+
+	CAM_DBG(CAM_SFE, "SFE:%d Acquire out_type:0x%X",
+		bus_priv->common_data.core_index,
+		out_acquire_args->out_port_info->res_type);
+
+	sfe_out_res_id = cam_sfe_bus_wr_get_out_res_id(
+		out_acquire_args->out_port_info->res_type);
+	if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_MAX)
+		return -ENODEV;
+
+	rsrc_node = &bus_priv->sfe_out[sfe_out_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_SFE,
+			"SFE:%d out_type:0x%X resource not available state:%d",
+			bus_priv->common_data.core_index,
+			sfe_out_res_id, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	if (!acq_args->buf_done_controller) {
+		CAM_ERR(CAM_SFE, "Invalid buf done controller");
+		return -EINVAL;
+	}
+
+	rsrc_data = rsrc_node->res_priv;
+	rsrc_data->common_data->buf_done_controller =
+		acq_args->buf_done_controller;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->bus_priv = bus_priv;
+
+	secure_caps = cam_sfe_bus_can_be_secure(
+		rsrc_data->out_type);
+	mode = out_acquire_args->out_port_info->secure_mode;
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (!rsrc_data->common_data->num_sec_out) {
+			rsrc_data->secure_mode = mode;
+			rsrc_data->common_data->secure_mode = mode;
+		} else {
+			if (mode == rsrc_data->common_data->secure_mode) {
+				rsrc_data->secure_mode =
+					rsrc_data->common_data->secure_mode;
+			} else {
+				rc = -EINVAL;
+				CAM_ERR_RATE_LIMIT(CAM_SFE,
+					"Mismatch: Acquire mode[%d], drvr mode[%d]",
+					rsrc_data->common_data->secure_mode,
+					mode);
+				mutex_unlock(
+					&rsrc_data->common_data->bus_mutex);
+				return rc;
+			}
+		}
+		rsrc_data->common_data->num_sec_out++;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	bus_priv->tasklet_info = acq_args->tasklet;
+	rsrc_node->is_rdi_primary_res = false;
+	rsrc_node->res_id = out_acquire_args->out_port_info->res_type;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = out_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = out_acquire_args->cdm_ops;
+	rsrc_data->format = out_acquire_args->out_port_info->format;
+
+	/* Acquire WM and retrieve COMP GRP ID */
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_sfe_bus_acquire_wm(bus_priv,
+			out_acquire_args,
+			acq_args->tasklet,
+			sfe_out_res_id,
+			i,
+			&rsrc_data->wm_res[i],
+			&client_done_mask,
+			&comp_grp_id);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"Failed to acquire WM SFE:%d out_type:%d rc:%d",
+				rsrc_data->common_data->core_index,
+				sfe_out_res_id, rc);
+			goto release_wm;
+		}
+	}
+
+	/* Acquire composite group using COMP GRP ID */
+	rc = cam_sfe_bus_acquire_comp_grp(bus_priv,
+		out_acquire_args->out_port_info,
+		acq_args->tasklet,
+		out_acquire_args->is_dual,
+		out_acquire_args->is_master,
+		rsrc_data->comp_grp,
+		comp_grp_id);
+	if (rc) {
+		CAM_ERR(CAM_SFE,
+			"Failed to acquire comp_grp SFE:%d out_type:%d rc:%d",
+			rsrc_data->common_data->core_index,
+			sfe_out_res_id, rc);
+		goto release_wm;
+	}
+
+	rsrc_data->is_dual = out_acquire_args->is_dual;
+	rsrc_data->is_master = out_acquire_args->is_master;
+
+	cam_sfe_bus_add_wm_to_comp_grp(rsrc_data->comp_grp,
+		client_done_mask);
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	out_acquire_args->rsrc_node = rsrc_node;
+	out_acquire_args->comp_grp_id = comp_grp_id;
+
+	CAM_DBG(CAM_SFE, "Acquire successful");
+	return rc;
+
+release_wm:
+	for (i--; i >= 0; i--)
+		cam_sfe_bus_release_wm(bus_priv,
+			&rsrc_data->wm_res[i]);
+
+	return rc;
+}
+
+static int cam_sfe_bus_release_sfe_out(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node         *sfe_out = NULL;
+	struct cam_sfe_bus_wr_out_data       *rsrc_data = NULL;
+	uint32_t                              secure_caps = 0;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_SFE, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	sfe_out = release_args;
+	rsrc_data = sfe_out->res_priv;
+
+	if (sfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE,
+			"Invalid resource state:%d SFE:%d out_type:0x%X",
+			sfe_out->res_state, rsrc_data->common_data->core_index,
+			sfe_out->res_id);
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		cam_sfe_bus_release_wm(bus_priv, &rsrc_data->wm_res[i]);
+
+	if (rsrc_data->comp_grp)
+		cam_sfe_bus_release_comp_grp(bus_priv,
+			rsrc_data->comp_grp);
+
+	sfe_out->tasklet_info = NULL;
+	sfe_out->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+
+	secure_caps = cam_sfe_bus_can_be_secure(rsrc_data->out_type);
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (rsrc_data->secure_mode ==
+			rsrc_data->common_data->secure_mode) {
+			rsrc_data->common_data->num_sec_out--;
+			rsrc_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+		} else {
+			/*
+			 * The validity of the mode is properly
+			 * checked while acquiring the output port.
+			 * not expected to reach here, unless there is
+			 * some corruption.
+			 */
+			CAM_ERR(CAM_SFE, "driver[%d],resource[%d] mismatch",
+				rsrc_data->common_data->secure_mode,
+				rsrc_data->secure_mode);
+		}
+
+		if (!rsrc_data->common_data->num_sec_out)
+			rsrc_data->common_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	if (sfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		sfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_get_evt_payload(
+	struct cam_sfe_bus_wr_common_data       *common_data,
+	struct cam_sfe_bus_wr_irq_evt_payload  **evt_payload)
+{
+	int rc;
+
+	spin_lock(&common_data->spin_lock);
+
+	if (!common_data->err_irq_subscribe) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "SFE:%d Bus uninitialized",
+			common_data->core_index);
+		*evt_payload = NULL;
+		rc = -EPERM;
+		goto done;
+	}
+
+	if (list_empty(&common_data->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "No free BUS event payload");
+		*evt_payload = NULL;
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&common_data->free_payload_list,
+		struct cam_sfe_bus_wr_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&common_data->spin_lock);
+	return rc;
+}
+
+static int cam_sfe_bus_wr_put_evt_payload(
+	struct cam_sfe_bus_wr_common_data      *common_data,
+	struct cam_sfe_bus_wr_irq_evt_payload **evt_payload)
+{
+	unsigned long flags;
+
+	if (!common_data) {
+		CAM_ERR(CAM_SFE, "Invalid param common_data NULL");
+		return -EINVAL;
+	}
+
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_SFE, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&common_data->spin_lock, flags);
+	if (common_data->err_irq_subscribe)
+		list_add_tail(&(*evt_payload)->list,
+			&common_data->free_payload_list);
+	spin_unlock_irqrestore(&common_data->spin_lock, flags);
+
+	*evt_payload = NULL;
+
+	CAM_DBG(CAM_SFE, "Exit");
+	return 0;
+}
+
+static int cam_sfe_bus_start_sfe_out(
+	struct cam_isp_resource_node          *sfe_out)
+{
+	int rc = 0, i;
+	struct cam_sfe_bus_wr_out_data      *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_priv          *bus_priv;
+	struct cam_sfe_bus_wr_common_data   *common_data = NULL;
+	uint32_t bus_irq_reg_mask[1];
+
+	if (!sfe_out) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = sfe_out->res_priv;
+	bus_priv = rsrc_data->bus_priv;
+	common_data = rsrc_data->common_data;
+
+	if (sfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE,
+			"Invalid resource state:%d SFE:%d out_type:0x%X",
+			sfe_out->res_state, rsrc_data->common_data->core_index,
+			rsrc_data->out_type);
+		return -EACCES;
+	}
+
+	/* subscribe when first out rsrc is streamed on */
+	if (!bus_priv->common_data.err_irq_subscribe) {
+		rc = cam_sfe_bus_subscribe_error_irq(bus_priv);
+		if (rc)
+			return rc;
+	}
+
+	CAM_DBG(CAM_SFE, "Start SFE:%d out_type:0x%X",
+		rsrc_data->common_data->core_index, rsrc_data->out_type);
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_sfe_bus_start_wm(&rsrc_data->wm_res[i]);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d Start Failed for out_type:0x%X",
+				sfe_out->res_state, rsrc_data->common_data->core_index,
+				rsrc_data->out_type);
+
+			return rc;
+		}
+	}
+
+	memset(bus_irq_reg_mask, 0, sizeof(bus_irq_reg_mask));
+	rc = cam_sfe_bus_start_comp_grp(rsrc_data->comp_grp,
+		bus_irq_reg_mask);
+
+	if (rsrc_data->is_dual && !rsrc_data->is_master)
+		goto end;
+
+	sfe_out->irq_handle =  cam_irq_controller_subscribe_irq(
+		common_data->buf_done_controller,
+		CAM_IRQ_PRIORITY_1,
+		bus_irq_reg_mask,
+		sfe_out,
+		sfe_out->top_half_handler,
+		sfe_out->bottom_half_handler,
+		sfe_out->tasklet_info,
+		&tasklet_bh_api,
+		CAM_IRQ_EVT_GROUP_0);
+	if (sfe_out->irq_handle < 1) {
+		CAM_ERR(CAM_SFE, "Subscribe IRQ failed for sfe out_res: %d",
+			sfe_out->res_id);
+		sfe_out->irq_handle = 0;
+		return -EFAULT;
+	}
+end:
+	sfe_out->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_sfe_bus_stop_sfe_out(
+	struct cam_isp_resource_node          *sfe_out)
+{
+	int rc = 0, i;
+	struct cam_sfe_bus_wr_out_data      *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_priv          *bus_priv;
+	struct cam_sfe_bus_wr_common_data   *common_data = NULL;
+
+	if (!sfe_out) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = sfe_out->res_priv;
+	bus_priv = rsrc_data->bus_priv;
+	common_data = rsrc_data->common_data;
+
+	if (sfe_out->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		sfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_SFE, "Stop SFE:%d out_type:0x%X state:%d",
+			rsrc_data->common_data->core_index, rsrc_data->out_type,
+			sfe_out->res_state);
+		return rc;
+	}
+
+	rc = cam_sfe_bus_stop_comp_grp(rsrc_data->comp_grp);
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_sfe_bus_stop_wm(&rsrc_data->wm_res[i]);
+
+	if (sfe_out->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			common_data->buf_done_controller,
+			sfe_out->irq_handle);
+		sfe_out->irq_handle = 0;
+	}
+
+	/*
+	 * Unsubscribe error irq when first
+	 * out rsrc is streamed off
+	 */
+	if (bus_priv->common_data.err_irq_subscribe) {
+		if (bus_priv->error_irq_handle) {
+			rc = cam_irq_controller_unsubscribe_irq(
+					bus_priv->common_data.bus_irq_controller,
+					bus_priv->error_irq_handle);
+			if (rc)
+				CAM_WARN(CAM_SFE, "failed to unsubscribe error irqs");
+			bus_priv->error_irq_handle = 0;
+		}
+
+		if (bus_priv->bus_irq_handle) {
+			rc = cam_irq_controller_unsubscribe_irq(
+					bus_priv->common_data.sfe_irq_controller,
+					bus_priv->bus_irq_handle);
+			if (rc)
+				CAM_WARN(CAM_SFE, "failed to unsubscribe top irq");
+			bus_priv->bus_irq_handle = 0;
+			cam_irq_controller_unregister_dependent(
+				bus_priv->common_data.sfe_irq_controller,
+				bus_priv->common_data.bus_irq_controller);
+		}
+
+		bus_priv->common_data.err_irq_subscribe = false;
+	}
+
+	sfe_out->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_sfe_bus_handle_sfe_out_done_top_half(
+	uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                     rc;
+	int                                         i;
+	struct cam_isp_resource_node               *sfe_out = NULL;
+	struct cam_sfe_bus_wr_out_data             *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_irq_evt_payload      *evt_payload;
+	struct cam_sfe_bus_wr_comp_grp_data        *resource_data;
+	struct cam_sfe_bus_wr_wm_resource_data     *wm_rsrc_data = NULL;
+	uint32_t                                    status_0;
+
+	sfe_out = th_payload->handler_priv;
+	if (!sfe_out) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "No resource");
+		return -ENODEV;
+	}
+
+	rsrc_data = sfe_out->res_priv;
+	resource_data = rsrc_data->comp_grp->res_priv;
+
+	CAM_DBG(CAM_SFE, "SFE:%d Bus IRQ status_0: 0x%X",
+		rsrc_data->common_data->core_index,
+		th_payload->evt_status_arr[0]);
+
+	rc  = cam_sfe_bus_wr_get_evt_payload(rsrc_data->common_data,
+			&evt_payload);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_SFE,
+			"Failed to get payload for SFE:%d Bus IRQ status_0: 0x%X",
+			rsrc_data->common_data->core_index,
+			th_payload->evt_status_arr[0]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	evt_payload->core_index = rsrc_data->common_data->core_index;
+	evt_payload->evt_id = evt_id;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	status_0 = th_payload->evt_status_arr[CAM_SFE_IRQ_BUS_WR_REG_STATUS0];
+
+	if (status_0 & resource_data->comp_done_mask) {
+		/* All SFE out ports have single WM */
+		wm_rsrc_data = rsrc_data->wm_res->res_priv;
+		evt_payload->last_consumed_addr = cam_io_r_mb(
+			wm_rsrc_data->common_data->mem_base +
+			wm_rsrc_data->hw_regs->addr_status_0);
+		trace_cam_log_event("bufdone", "bufdone_IRQ",
+			status_0, resource_data->comp_grp_type);
+	}
+
+	return rc;
+}
+
+static int cam_sfe_bus_handle_comp_done_bottom_half(
+	void                *handler_priv,
+	void                *evt_payload_priv,
+	uint32_t            *comp_grp_id)
+{
+	int rc = CAM_SFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node          *comp_grp = handler_priv;
+	struct cam_sfe_bus_wr_irq_evt_payload *evt_payload = evt_payload_priv;
+	struct cam_sfe_bus_wr_comp_grp_data   *rsrc_data = comp_grp->res_priv;
+	uint32_t                              *cam_sfe_irq_regs;
+	uint32_t                               status_0;
+
+	if (!evt_payload)
+		return rc;
+
+	if (rsrc_data->is_dual && (!rsrc_data->is_master)) {
+		CAM_ERR(CAM_SFE, "Invalid comp_grp:%u is_master:%u",
+			rsrc_data->comp_grp_type, rsrc_data->is_master);
+		return rc;
+	}
+
+	cam_sfe_irq_regs = evt_payload->irq_reg_val;
+	status_0 = cam_sfe_irq_regs[CAM_SFE_IRQ_BUS_WR_REG_STATUS0];
+
+	if (status_0 & rsrc_data->comp_done_mask) {
+		evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+		rc = CAM_SFE_IRQ_STATUS_SUCCESS;
+	}
+
+	CAM_DBG(CAM_SFE, "SFE:%d comp_grp:%d Bus IRQ status_0: 0x%X rc:%d",
+		rsrc_data->common_data->core_index, rsrc_data->comp_grp_type,
+		status_0, rc);
+
+	*comp_grp_id = rsrc_data->comp_grp_type;
+
+	return rc;
+}
+
+static int cam_sfe_bus_handle_sfe_out_done_bottom_half(
+	void                *handler_priv,
+	void                *evt_payload_priv)
+{
+	int rc = -EINVAL;
+	uint32_t evt_id = 0;
+	struct cam_isp_resource_node           *sfe_out = handler_priv;
+	struct cam_sfe_bus_wr_out_data         *rsrc_data = sfe_out->res_priv;
+	struct cam_sfe_bus_wr_irq_evt_payload  *evt_payload = evt_payload_priv;
+	struct cam_isp_hw_event_info            evt_info;
+	struct cam_isp_hw_bufdone_event_info    bufdone_evt_info = {0};
+	void                                   *ctx = NULL;
+	uint32_t                                comp_grp_id = 0;
+
+	rc = cam_sfe_bus_handle_comp_done_bottom_half(
+		rsrc_data->comp_grp, evt_payload_priv, &comp_grp_id);
+	CAM_DBG(CAM_SFE, "SFE:%d out_type:0x%x comp_grp_id:%d rc:%d",
+		rsrc_data->common_data->core_index,
+		rsrc_data->out_type, comp_grp_id, rc);
+
+	ctx = rsrc_data->priv;
+
+	switch (rc) {
+	case CAM_SFE_IRQ_STATUS_SUCCESS:
+		evt_id = evt_payload->evt_id;
+
+		evt_info.res_type = sfe_out->res_type;
+		evt_info.hw_idx   = sfe_out->hw_intf->hw_idx;
+		evt_info.hw_type  = CAM_ISP_HW_TYPE_SFE;
+		evt_info.res_id = sfe_out->res_id;
+		bufdone_evt_info.res_id = sfe_out->res_id;
+		bufdone_evt_info.comp_grp_id = comp_grp_id;
+		bufdone_evt_info.last_consumed_addr = evt_payload->last_consumed_addr;
+		evt_info.event_data = (void *)&bufdone_evt_info;
+
+		if (rsrc_data->common_data->event_cb)
+			rsrc_data->common_data->event_cb(ctx, evt_id,
+				(void *)&evt_info);
+		break;
+	default:
+		break;
+	}
+
+	cam_sfe_bus_wr_put_evt_payload(rsrc_data->common_data, &evt_payload);
+
+	return rc;
+}
+
+static int cam_sfe_bus_init_sfe_out_resource(
+	uint32_t                              index,
+	struct cam_sfe_bus_wr_priv           *bus_priv,
+	struct cam_sfe_bus_wr_hw_info        *hw_info)
+{
+	struct cam_isp_resource_node         *sfe_out = NULL;
+	struct cam_sfe_bus_wr_out_data       *rsrc_data = NULL;
+	int rc = 0, i = 0;
+	int32_t sfe_out_type =
+		cam_sfe_bus_wr_get_out_type(bus_priv, index);
+
+	if (sfe_out_type < 0 ||
+		sfe_out_type >= CAM_SFE_BUS_SFE_OUT_MAX) {
+		CAM_ERR(CAM_SFE, "Init SFE Out failed, Invalid type=%d",
+			sfe_out_type);
+		return -EINVAL;
+	}
+
+	sfe_out = &bus_priv->sfe_out[sfe_out_type];
+	if (sfe_out->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		sfe_out->res_priv) {
+		CAM_ERR(CAM_SFE, "sfe_out_type %d has already been initialized",
+			sfe_out_type);
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_wr_out_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	sfe_out->res_priv = rsrc_data;
+
+	sfe_out->res_type = CAM_ISP_RESOURCE_SFE_OUT;
+	sfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&sfe_out->list);
+
+	rsrc_data->source_group =
+		hw_info->sfe_out_hw_info[index].source_group;
+	rsrc_data->out_type     =
+		hw_info->sfe_out_hw_info[index].sfe_out_type;
+	rsrc_data->common_data  = &bus_priv->common_data;
+	rsrc_data->max_width    =
+		hw_info->sfe_out_hw_info[index].max_width;
+	rsrc_data->max_height   =
+		hw_info->sfe_out_hw_info[index].max_height;
+	rsrc_data->secure_mode  = CAM_SECURE_MODE_NON_SECURE;
+	rsrc_data->num_wm       = hw_info->sfe_out_hw_info[index].num_wm;
+
+	rsrc_data->wm_res = kzalloc((sizeof(struct cam_isp_resource_node) *
+		rsrc_data->num_wm), GFP_KERNEL);
+	if (!rsrc_data->wm_res) {
+		CAM_ERR(CAM_SFE, "Failed to alloc for wm_res");
+		return -ENOMEM;
+	}
+
+	/* All SFE clients have 1 WM hence i = 0 always */
+	rc = cam_sfe_bus_init_wm_resource(
+			hw_info->sfe_out_hw_info[index].wm_idx,
+			bus_priv, hw_info,
+			&rsrc_data->wm_res[i],
+			&rsrc_data->comp_grp,
+			hw_info->sfe_out_hw_info[index].name,
+			hw_info->sfe_out_hw_info[index].en_line_done);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE, "SFE:%d init WM:%d failed rc:%d",
+			bus_priv->common_data.core_index, i, rc);
+		return rc;
+	}
+
+	sfe_out->start = cam_sfe_bus_start_sfe_out;
+	sfe_out->stop = cam_sfe_bus_stop_sfe_out;
+	sfe_out->top_half_handler =
+		cam_sfe_bus_handle_sfe_out_done_top_half;
+	sfe_out->bottom_half_handler =
+		cam_sfe_bus_handle_sfe_out_done_bottom_half;
+	sfe_out->process_cmd = NULL;
+	sfe_out->hw_intf = bus_priv->common_data.hw_intf;
+	sfe_out->irq_handle = 0;
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_sfe_out_resource(
+	struct cam_isp_resource_node    *sfe_out)
+{
+	struct cam_sfe_bus_wr_out_data *rsrc_data = sfe_out->res_priv;
+	int rc = 0, i = 0;
+
+	if (sfe_out->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		return 0;
+	}
+
+	sfe_out->start = NULL;
+	sfe_out->stop = NULL;
+	sfe_out->top_half_handler = NULL;
+	sfe_out->bottom_half_handler = NULL;
+	sfe_out->hw_intf = NULL;
+	sfe_out->irq_handle = 0;
+
+	sfe_out->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&sfe_out->list);
+	sfe_out->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	rsrc_data->comp_grp = NULL;
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_sfe_bus_deinit_wm_resource(&rsrc_data->wm_res[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"SFE:%d deinit WM:%d failed rc:%d",
+				rsrc_data->common_data->core_index, i, rc);
+	}
+
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static inline void __cam_sfe_bus_wr_print_wm_info(
+	struct cam_sfe_bus_wr_wm_resource_data  *wm_data)
+{
+	uint32_t addr_status0, addr_status1, addr_status2, addr_status3;
+
+	addr_status0 = cam_io_r_mb(wm_data->common_data->mem_base +
+		wm_data->hw_regs->addr_status_0);
+	addr_status1 = cam_io_r_mb(wm_data->common_data->mem_base +
+		wm_data->hw_regs->addr_status_1);
+	addr_status2 = cam_io_r_mb(wm_data->common_data->mem_base +
+		wm_data->hw_regs->addr_status_2);
+	addr_status3 = cam_io_r_mb(wm_data->common_data->mem_base +
+		wm_data->hw_regs->addr_status_3);
+
+	CAM_INFO(CAM_SFE,
+		"SFE:%u WM:%u width:%u height:%u stride:%u x_init:%u en_cfg:%u acquired width:%u height:%u pack_cfg: 0x%x",
+		wm_data->common_data->core_index, wm_data->index,
+		wm_data->width, wm_data->height,
+		wm_data->stride, wm_data->h_init,
+		wm_data->en_cfg, wm_data->acquired_width,
+		wm_data->acquired_height, wm_data->pack_fmt);
+
+	CAM_INFO(CAM_SFE,
+		"SFE:%u WM:%u last_consumed_image_addr:0x%x last_consumed_frame_header:0x%x fifo_word_cnt:0x%x [FH + Image] current_image_addr:0x%x",
+		wm_data->common_data->hw_intf->hw_idx, wm_data->index,
+		addr_status0, addr_status1, addr_status2, addr_status3);
+}
+
+static int cam_sfe_bus_wr_print_dimensions(
+	enum cam_sfe_bus_sfe_out_type        sfe_out_res_id,
+	struct cam_sfe_bus_wr_priv          *bus_priv)
+{
+	struct cam_isp_resource_node            *rsrc_node = NULL;
+	struct cam_isp_resource_node            *wm_res = NULL;
+	struct cam_sfe_bus_wr_out_data          *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data  *wm_data   = NULL;
+	int                                      i, wm_idx;
+
+	rsrc_node = &bus_priv->sfe_out[sfe_out_res_id];
+	rsrc_data = rsrc_node->res_priv;
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		wm_res = &rsrc_data->wm_res[i];
+		wm_data = (struct cam_sfe_bus_wr_wm_resource_data  *)
+			wm_res->res_priv;
+		wm_idx = wm_data->index;
+		if (wm_idx < 0 || wm_idx >= bus_priv->num_client) {
+			CAM_WARN(CAM_SFE, "Unsupported SFE out %d", sfe_out_res_id);
+			continue;
+		}
+
+		__cam_sfe_bus_wr_print_wm_info(wm_data);
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_mini_dump(
+	struct cam_sfe_bus_wr_priv *bus_priv,
+	void *cmd_args)
+{
+	struct cam_isp_resource_node            *rsrc_node = NULL;
+	struct cam_sfe_bus_wr_out_data          *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data  *wm        = NULL;
+	struct cam_sfe_bus_mini_dump_data       *md;
+	struct cam_sfe_bus_wm_mini_dump         *md_wm;
+	struct cam_hw_mini_dump_args            *md_args;
+	struct cam_hw_info                      *hw_info = NULL;
+	uint32_t                                 bytes_written = 0;
+	uint32_t                                 i, j, k = 0;
+
+	if (!bus_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid bus private data");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)bus_priv->common_data.hw_intf->hw_priv;
+	md_args = (struct cam_hw_mini_dump_args *)cmd_args;
+
+	if (sizeof(*md) > md_args->len) {
+		md_args->bytes_written = 0;
+		return 0;
+	}
+
+	md = (struct cam_sfe_bus_mini_dump_data *)md_args->start_addr;
+	md->clk_rate = cam_soc_util_get_applied_src_clk(&hw_info->soc_info, true);
+	md->hw_idx = bus_priv->common_data.hw_intf->hw_idx;
+	md->hw_state = hw_info->hw_state;
+	bytes_written += sizeof(*md);
+	md->wm = (struct cam_sfe_bus_wm_mini_dump *)
+			((uint8_t *)md_args->start_addr + bytes_written);
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rsrc_node = &bus_priv->sfe_out[i];
+		rsrc_data = rsrc_node->res_priv;
+		if (!rsrc_data)
+			continue;
+
+		for (j = 0; j < rsrc_data->num_wm; j++) {
+			if (bytes_written + sizeof(*md_wm) > md_args->len)
+				goto end;
+
+			md_wm = &md->wm[k];
+			wm = rsrc_data->wm_res[j].res_priv;
+			md_wm->width  = wm->width;
+			md_wm->index  = wm->index;
+			md_wm->height = wm->height;
+			md_wm->stride = wm->stride;
+			md_wm->en_cfg = wm->en_cfg;
+			md_wm->h_init = wm->h_init;
+			md_wm->format = wm->format;
+			md_wm->acquired_width = wm->acquired_width;
+			md_wm->acquired_height = wm->acquired_height;
+			md_wm->state = rsrc_node->res_state;
+			scnprintf(md_wm->name, CAM_ISP_RES_NAME_LEN,
+				"%s", rsrc_data->wm_res[j].res_name);
+			k++;
+			bytes_written += sizeof(*md_wm);
+		}
+	}
+end:
+	md->num_client = k;
+	md_args->bytes_written = bytes_written;
+	return 0;
+}
+
+static void *cam_sfe_bus_wr_user_dump_info(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_sfe_bus_wr_wm_resource_data  *wm = NULL;
+	uint32_t                                  *addr;
+	uint32_t                                   addr_status0;
+	uint32_t                                   addr_status1;
+	uint32_t                                   addr_status2;
+	uint32_t                                   addr_status3;
+
+	wm = (struct cam_sfe_bus_wr_wm_resource_data *)dump_struct;
+
+	addr_status0 = cam_io_r_mb(wm->common_data->mem_base +
+		wm->hw_regs->addr_status_0);
+	addr_status1 = cam_io_r_mb(wm->common_data->mem_base +
+		wm->hw_regs->addr_status_1);
+	addr_status2 = cam_io_r_mb(wm->common_data->mem_base +
+		wm->hw_regs->addr_status_2);
+	addr_status3 = cam_io_r_mb(wm->common_data->mem_base +
+		wm->hw_regs->addr_status_3);
+
+	addr = (uint32_t *)addr_ptr;
+
+	*addr++ = wm->common_data->hw_intf->hw_idx;
+	*addr++ = wm->index;
+	*addr++ = addr_status0;
+	*addr++ = addr_status1;
+	*addr++ = addr_status2;
+	*addr++ = addr_status3;
+
+	return addr;
+}
+
+static int cam_sfe_bus_wr_user_dump(
+	struct cam_sfe_bus_wr_priv *bus_priv,
+	void *cmd_args)
+{
+	struct cam_isp_resource_node              *rsrc_node = NULL;
+	struct cam_sfe_bus_wr_out_data            *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data    *wm = NULL;
+	struct cam_hw_info                        *hw_info = NULL;
+	struct cam_isp_hw_dump_args               *dump_args;
+	uint32_t                                   i, j = 0;
+	int                                        rc = 0;
+	int32_t                                    sfe_out_type;
+
+
+	if (!bus_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid bus private data");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)bus_priv->common_data.hw_intf->hw_priv;
+	dump_args = (struct cam_isp_hw_dump_args *)cmd_args;
+
+	if (hw_info->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP,
+			"SFE BUS powered down, continuing");
+		return -EINVAL;
+	}
+
+	rc = cam_common_user_dump_helper(dump_args, cam_common_user_dump_clock,
+		hw_info, sizeof(uint64_t), "CLK_RATE_PRINT:");
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "SFE BUS WR: Clock dump failed, rc:%d", rc);
+		return rc;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		sfe_out_type = cam_sfe_bus_wr_get_out_type(bus_priv, i);
+		if ((sfe_out_type < 0) ||
+			(sfe_out_type >= CAM_SFE_BUS_SFE_OUT_MAX)) {
+			CAM_ERR(CAM_SFE, "Invalid sfe out type:%d",
+				sfe_out_type);
+			return -EINVAL;
+		}
+
+		rsrc_node = &bus_priv->sfe_out[sfe_out_type];
+		if (rsrc_node->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+			CAM_DBG(CAM_ISP,
+				"SFE BUS WR: path inactive res ID: %d, continuing",
+				rsrc_node->res_id);
+			continue;
+		}
+
+		rsrc_data = rsrc_node->res_priv;
+		if (!rsrc_data)
+			continue;
+		for (j = 0; j < rsrc_data->num_wm; j++) {
+
+			wm = rsrc_data->wm_res[j].res_priv;
+			if (!wm)
+				continue;
+
+			rc = cam_common_user_dump_helper(dump_args, cam_sfe_bus_wr_user_dump_info,
+				wm, sizeof(uint32_t), "SFE_BUS_CLIENT.%s.%d:",
+				rsrc_data->wm_res[j].res_name,
+				rsrc_data->common_data->core_index);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "SFE BUS WR: Info dump failed, rc:%d", rc);
+				return rc;
+			}
+		}
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_wr_handle_bus_irq(uint32_t    evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_sfe_bus_wr_priv          *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller, CAM_IRQ_EVT_GROUP_0);
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_sfe_bus_wr_handle_err_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+
+	int i = 0, rc = 0;
+	struct cam_sfe_bus_wr_priv *bus_priv =
+		th_payload->handler_priv;
+	struct cam_sfe_bus_wr_irq_evt_payload *evt_payload;
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "SFE:%d BUS Err IRQ",
+		bus_priv->common_data.core_index);
+
+	for (i = 0; i < th_payload->num_registers; i++) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "SFE:%d BUS IRQ status_%d: 0x%X",
+		bus_priv->common_data.core_index, i,
+			th_payload->evt_status_arr[i]);
+	}
+	cam_irq_controller_disable_irq(
+		bus_priv->common_data.bus_irq_controller,
+		bus_priv->error_irq_handle);
+
+	rc  = cam_sfe_bus_wr_get_evt_payload(&bus_priv->common_data,
+		&evt_payload);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->core_index = bus_priv->common_data.core_index;
+
+	evt_payload->ccif_violation_status = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->ccif_violation_status);
+
+	evt_payload->image_size_violation_status = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->image_size_violation_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_sfe_bus_wr_get_err_port_info(struct cam_sfe_bus_wr_priv *bus_priv,
+	uint32_t err_status, void **rsrc_data_priv, uint64_t *out_port)
+{
+	int i, j, wm_idx, sfe_out_type;
+	struct cam_isp_resource_node           *sfe_out = NULL;
+	struct cam_sfe_bus_wr_out_data         *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data *wm_data = NULL;
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		sfe_out_type = cam_sfe_bus_wr_get_out_type(bus_priv, i);
+		if ((sfe_out_type < 0) ||
+			(sfe_out_type >= CAM_SFE_BUS_SFE_OUT_MAX)) {
+			CAM_ERR(CAM_SFE, "Invalid sfe out type:%d",
+				sfe_out_type);
+			return -EINVAL;
+		}
+
+		sfe_out = &bus_priv->sfe_out[sfe_out_type];
+		if (!sfe_out || !sfe_out->res_priv)
+			continue;
+
+		if (sfe_out->res_state != CAM_ISP_RESOURCE_STATE_STREAMING)
+			continue;
+
+		rsrc_data = (struct cam_sfe_bus_wr_out_data *)sfe_out->res_priv;
+		*rsrc_data_priv = rsrc_data->priv;
+
+		for (j = 0; j < rsrc_data->num_wm; j++) {
+			wm_data = (struct cam_sfe_bus_wr_wm_resource_data *)
+				rsrc_data->wm_res[j].res_priv;
+			if (!wm_data)
+				continue;
+
+			wm_idx = wm_data->index;
+			if (wm_idx < 0 || wm_idx >= bus_priv->num_client) {
+				CAM_ERR(CAM_SFE, "Unsupported SFE out %d",
+					wm_idx);
+				return -EINVAL;
+			}
+
+			if (err_status & BIT(wm_idx)) {
+				*out_port |= BIT_ULL(sfe_out->res_id & 0xFF);
+				__cam_sfe_bus_wr_print_wm_info(wm_data);
+			}
+		}
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_wr_handle_err_irq_bottom_half(
+	void *handler_priv, void *evt_payload_priv)
+{
+	int idx = -1;
+	int rc = 0;
+	uint32_t status = 0;
+	uint32_t constraint_errors_status = 0;
+	uint32_t violation_status = 0;
+	uint64_t out_port_mask = 0;
+	bool skip_err_notify = false;
+	struct cam_sfe_bus_wr_priv            *bus_priv = handler_priv;
+	struct cam_sfe_bus_wr_common_data     *common_data;
+	struct cam_isp_hw_event_info           evt_info;
+	struct cam_sfe_bus_wr_irq_evt_payload *evt_payload = evt_payload_priv;
+	void *rsrc_data_priv = NULL;
+
+	if (!handler_priv || !evt_payload_priv)
+		return -EINVAL;
+
+	common_data = &bus_priv->common_data;
+
+	status = evt_payload->irq_reg_val[CAM_SFE_IRQ_BUS_WR_REG_STATUS0];
+
+	if (status & CAM_SFE_BUS_WR_IRQ_CCIF_VIOLATION)
+		CAM_ERR(CAM_SFE, "SFE:%d status0 0x%x CCIF Violation status 0x%x",
+			bus_priv->common_data.core_index, status,
+			evt_payload->ccif_violation_status);
+
+	if (status & CAM_SFE_BUS_WR_IRQ_IMAGE_SIZE_VIOLATION)
+		CAM_ERR(CAM_SFE, "SFE:%d status0 0x%x Image Size Violation status 0x%x",
+			bus_priv->common_data.core_index, status,
+			evt_payload->image_size_violation_status);
+
+	if (status & CAM_SFE_BUS_WR_IRQ_CONS_VIOLATION) {
+		CAM_ERR(CAM_SFE, "SFE:%d status0 0x%x Constraint Violation",
+			bus_priv->common_data.core_index, status);
+		cam_sfe_bus_wr_get_constraint_errors(&skip_err_notify, bus_priv,
+			&constraint_errors_status);
+	}
+
+	violation_status = evt_payload->ccif_violation_status |
+		evt_payload->image_size_violation_status | constraint_errors_status;
+
+	rc = cam_sfe_bus_wr_get_err_port_info(bus_priv, violation_status,
+			&rsrc_data_priv, &out_port_mask);
+	if (rc < 0)
+		CAM_ERR(CAM_SFE, "Failed to get err port info, violation_status = %d",
+			violation_status);
+
+	cam_sfe_bus_wr_put_evt_payload(common_data, &evt_payload);
+
+	if (!skip_err_notify) {
+		struct cam_isp_hw_error_event_info err_evt_info;
+
+		evt_info.hw_idx = common_data->core_index;
+		evt_info.hw_type = CAM_ISP_HW_TYPE_SFE;
+		evt_info.res_type = CAM_ISP_RESOURCE_SFE_OUT;
+		err_evt_info.err_type = CAM_SFE_IRQ_STATUS_VIOLATION;
+		evt_info.event_data = (void *)&err_evt_info;
+
+		if (!rsrc_data_priv) {
+			CAM_WARN(CAM_SFE,
+				"SFE:[%d] out error notification failed, cb data is NULL",
+				bus_priv->common_data.core_index);
+			return -EINVAL;
+		}
+
+		if (!common_data->event_cb)
+			return 0;
+
+		if (!out_port_mask) {
+			/* No valid res_id found */
+			evt_info.res_id = CAM_SFE_BUS_SFE_OUT_MAX;
+			common_data->event_cb(rsrc_data_priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+			return 0;
+		}
+
+		while (out_port_mask) {
+			idx++;
+			if (!(out_port_mask & 0x1)) {
+				out_port_mask >>= 1;
+				continue;
+			}
+
+			evt_info.res_id = CAM_ISP_SFE_OUT_RES_BASE + idx;
+			common_data->event_cb(rsrc_data_priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+			out_port_mask >>= 1;
+		}
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_subscribe_error_irq(
+	struct cam_sfe_bus_wr_priv          *bus_priv)
+{
+	struct cam_sfe_bus_wr_common_data *common_data;
+	uint32_t top_irq_reg_mask[CAM_SFE_IRQ_REGISTERS_MAX] = {0};
+	uint32_t bus_wr_error_irq_mask[CAM_SFE_BUS_WR_IRQ_REGISTERS_MAX] = {0};
+
+	/* Subscribe top IRQ */
+	top_irq_reg_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	common_data = &bus_priv->common_data;
+
+	bus_priv->bus_irq_handle = cam_irq_controller_subscribe_irq(
+		common_data->sfe_irq_controller,
+		CAM_IRQ_PRIORITY_0,
+		top_irq_reg_mask,
+		bus_priv,
+		cam_sfe_bus_wr_handle_bus_irq,
+		NULL,
+		NULL,
+		NULL,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (bus_priv->bus_irq_handle < 1) {
+		CAM_ERR(CAM_SFE, "Failed to subscribe BUS TOP IRQ");
+		bus_priv->bus_irq_handle = 0;
+		return -EFAULT;
+	}
+
+	cam_irq_controller_register_dependent(common_data->sfe_irq_controller,
+		common_data->bus_irq_controller, top_irq_reg_mask);
+
+	if (bus_priv->tasklet_info != NULL) {
+		bus_wr_error_irq_mask[0] = common_data->irq_err_mask;
+
+		bus_priv->error_irq_handle = cam_irq_controller_subscribe_irq(
+			common_data->bus_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			bus_wr_error_irq_mask,
+			bus_priv,
+			cam_sfe_bus_wr_handle_err_irq_top_half,
+			cam_sfe_bus_wr_handle_err_irq_bottom_half,
+			bus_priv->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (bus_priv->error_irq_handle < 1) {
+			CAM_ERR(CAM_SFE, "Failed to subscribe BUS Error IRQ");
+			bus_priv->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	common_data->err_irq_subscribe = true;
+	CAM_DBG(CAM_SFE, "BUS WR error irq subscribed");
+	return 0;
+}
+
+static int cam_sfe_bus_wr_update_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update       *update_buf;
+	struct cam_buf_io_cfg                  *io_cfg = NULL;
+	struct cam_sfe_bus_wr_out_data         *sfe_out_data = NULL;
+	struct cam_cdm_utils_ops               *cdm_util_ops;
+	struct cam_sfe_bus_wr_wm_resource_data *wm_data = NULL;
+	struct cam_sfe_bus_cache_dbg_cfg       *cache_dbg_cfg = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t img_addr = 0, img_offset = 0;
+	uint32_t num_regval_pairs = 0;
+	uint32_t i, j, size = 0;
+	uint32_t frame_inc = 0, val;
+	uint32_t stride = 0, slice_h = 0;
+	dma_addr_t iova;
+	uint32_t curr_cache_cfg = 0;
+
+	bus_priv = (struct cam_sfe_bus_wr_priv *) priv;
+	update_buf = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	cache_dbg_cfg = &bus_priv->common_data.cache_dbg_cfg;
+
+	sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
+		update_buf->res->res_priv;
+	if (!sfe_out_data || !sfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = sfe_out_data->cdm_util_ops;
+	if (update_buf->wm_update->num_buf != sfe_out_data->num_wm) {
+		CAM_ERR(CAM_SFE,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->wm_update->num_buf, sfe_out_data->num_wm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &sfe_out_data->common_data->io_buf_update[0];
+	if (update_buf->use_scratch_cfg)
+		CAM_DBG(CAM_SFE, "Using scratch buf config");
+	else
+		io_cfg = update_buf->wm_update->io_cfg;
+
+	for (i = 0, j = 0; i < sfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_SFE,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = (struct cam_sfe_bus_wr_wm_resource_data *)
+			sfe_out_data->wm_res[i].res_priv;
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg, wm_data->en_cfg);
+		CAM_DBG(CAM_SFE, "WM:%d %s en_cfg 0x%X",
+			wm_data->index, sfe_out_data->wm_res[i].res_name,
+			reg_val_pair[j-1]);
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->packer_cfg, wm_data->pack_fmt);
+		CAM_DBG(CAM_SFE, "WM:%d %s packer_fmt 0x%X",
+			wm_data->index, sfe_out_data->wm_res[i].res_name,
+			reg_val_pair[j-1]);
+
+		curr_cache_cfg = wm_data->cache_cfg;
+		wm_data->cache_cfg = bus_priv->common_data.sys_cache_default_cfg;
+		if (wm_data->enable_caching) {
+			if ((cache_dbg_cfg->disable_for_scratch) &&
+				(update_buf->use_scratch_cfg))
+				goto skip_cache_cfg;
+
+			if ((cache_dbg_cfg->disable_for_buf) &&
+				(!update_buf->use_scratch_cfg))
+				goto skip_cache_cfg;
+
+			wm_data->cache_cfg =
+				wm_data->current_scid << 8;
+			wm_data->cache_cfg |= 3 << 4;
+			if ((update_buf->use_scratch_cfg) &&
+				(cache_dbg_cfg->scratch_dbg_cfg))
+				wm_data->cache_cfg |= cache_dbg_cfg->scratch_alloc;
+			else if ((!update_buf->use_scratch_cfg) &&
+				(cache_dbg_cfg->buf_dbg_cfg))
+				wm_data->cache_cfg |= cache_dbg_cfg->buf_alloc;
+			else
+				wm_data->cache_cfg |= CACHE_ALLOC_ALLOC;
+
+			if (cache_dbg_cfg->print_cache_cfg &&
+				(curr_cache_cfg != wm_data->cache_cfg)) {
+				CAM_INFO(CAM_SFE, "SFE:%d WM:%d current_scid:%d cache_cfg:0x%x",
+					wm_data->common_data->core_index,
+					wm_data->index, wm_data->current_scid, wm_data->cache_cfg);
+			}
+		}
+
+skip_cache_cfg:
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->system_cache_cfg,
+			wm_data->cache_cfg);
+		CAM_DBG(CAM_SFE, "WM:%d cache_cfg:0x%x",
+			wm_data->index, reg_val_pair[j-1]);
+
+		val = (wm_data->height << 16) | wm_data->width;
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_cfg_0, val);
+		CAM_DBG(CAM_SFE, "WM:%d image height and width 0x%X",
+			wm_data->index, reg_val_pair[j-1]);
+
+		/* For initial configuration program all bus registers */
+		if (update_buf->use_scratch_cfg) {
+			stride = update_buf->wm_update->stride;
+			slice_h = update_buf->wm_update->slice_height;
+		} else {
+			stride = io_cfg->planes[i].plane_stride;
+			slice_h = io_cfg->planes[i].slice_height;
+		}
+
+		val = stride;
+		CAM_DBG(CAM_SFE, "before stride %d", val);
+		val = ALIGNUP(val, 16);
+		if (val != stride)
+			CAM_DBG(CAM_SFE, "Warning stride %u expected %u",
+				stride, val);
+
+		if (wm_data->stride != val || !wm_data->init_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_2,
+				stride);
+			wm_data->stride = val;
+			CAM_DBG(CAM_SFE, "WM:%d image stride 0x%X",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		frame_inc = stride * slice_h;
+
+		if (!(wm_data->en_cfg & (0x3 << 16))) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_1, wm_data->h_init);
+			CAM_DBG(CAM_SFE, "WM:%d h_init 0x%X",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		/* WM Image address */
+		iova = update_buf->wm_update->image_buf[i] +
+				wm_data->offset;
+		update_buf->wm_update->image_buf_offset[i] =
+			wm_data->offset;
+
+		if (cam_smmu_is_expanded_memory()) {
+			img_offset = CAM_36BIT_INTF_GET_IOVA_OFFSET(iova);
+			img_addr = CAM_36BIT_INTF_GET_IOVA_BASE(iova);
+			/* Align frame inc to 256 bytes */
+			frame_inc = CAM_36BIT_INTF_GET_IOVA_BASE(frame_inc);
+
+			/* Only write to offset register in 36-bit enabled HW */
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->addr_cfg, img_offset);
+			CAM_DBG(CAM_SFE, "WM:%d image offset 0x%X",
+				wm_data->index, img_offset);
+		} else {
+			img_addr = iova;
+		}
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_addr, img_addr);
+
+		CAM_DBG(CAM_SFE, "WM:%d image address 0x%x", wm_data->index, img_addr);
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->frame_incr, frame_inc);
+		CAM_DBG(CAM_SFE, "WM:%d frame_inc %d expanded mem: %s",
+			wm_data->index, reg_val_pair[j-1],
+			CAM_BOOL_TO_YESNO(cam_smmu_is_expanded_memory));
+
+		/* enable the WM */
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg,
+			wm_data->en_cfg);
+
+		/* set initial configuration done */
+		if (!wm_data->init_cfg_done)
+			wm_data->init_cfg_done = true;
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_buf->cmd.size) {
+			CAM_ERR(CAM_SFE,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				update_buf->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_buf->cmd.cmd_buf_addr, num_regval_pairs,
+			reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_buf->cmd.used_bytes = size * 4;
+	} else {
+		CAM_DBG(CAM_SFE,
+			"No reg val pairs. num_wms: %u",
+			sfe_out_data->num_wm);
+		update_buf->cmd.used_bytes = 0;
+	}
+
+	return 0;
+}
+
+/*
+ * API similar to cam_sfe_bus_wr_update_wm() with the
+ * only change being config is done via AHB instead of CDM
+ */
+static int cam_sfe_bus_wr_config_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update       *update_buf;
+	struct cam_sfe_bus_wr_out_data         *sfe_out_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data *wm_data = NULL;
+	struct cam_sfe_bus_cache_dbg_cfg       *cache_dbg_cfg = NULL;
+	uint32_t i;
+	uint32_t frame_inc = 0, val, img_addr = 0, img_offset = 0;
+	uint32_t stride = 0, slice_h = 0;
+	dma_addr_t iova;
+	uint32_t curr_cache_cfg = 0;
+
+	bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+	update_buf =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	cache_dbg_cfg = &bus_priv->common_data.cache_dbg_cfg;
+
+	sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
+		update_buf->res->res_priv;
+
+	if (!sfe_out_data) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	if (update_buf->wm_update->num_buf != sfe_out_data->num_wm) {
+		CAM_ERR(CAM_SFE,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->wm_update->num_buf, sfe_out_data->num_wm);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < sfe_out_data->num_wm; i++) {
+		wm_data = (struct cam_sfe_bus_wr_wm_resource_data *)
+			sfe_out_data->wm_res[i].res_priv;
+
+		val = (wm_data->height << 16) | wm_data->width;
+		cam_io_w_mb(val,
+			wm_data->common_data->mem_base +
+			wm_data->hw_regs->image_cfg_0);
+		CAM_DBG(CAM_SFE, "WM:%d image height and width 0x%X",
+			wm_data->index, val);
+
+		/* For initial configuration program all bus registers */
+		stride = update_buf->wm_update->stride;
+		slice_h = update_buf->wm_update->slice_height;
+
+		val = stride;
+		CAM_DBG(CAM_SFE, "before stride %d", val);
+		val = ALIGNUP(val, 16);
+		if (val != stride &&
+			val != wm_data->stride)
+			CAM_WARN(CAM_SFE, "Warning stride %u expected %u",
+				stride, val);
+
+		if (wm_data->stride != val || !wm_data->init_cfg_done) {
+			cam_io_w_mb(stride,
+				wm_data->common_data->mem_base +
+				wm_data->hw_regs->image_cfg_2);
+			wm_data->stride = val;
+			CAM_DBG(CAM_SFE, "WM:%d image stride 0x%X",
+				wm_data->index, val);
+		}
+
+		frame_inc = stride * slice_h;
+
+		if (!(wm_data->en_cfg & (0x3 << 16))) {
+			cam_io_w_mb(wm_data->h_init,
+				wm_data->common_data->mem_base +
+				wm_data->hw_regs->image_cfg_1);
+			CAM_DBG(CAM_SFE, "WM:%d h_init 0x%X",
+				wm_data->index, wm_data->h_init);
+		}
+
+		/* WM Image address */
+		iova = update_buf->wm_update->image_buf[i] +
+			wm_data->offset;
+
+		if (cam_smmu_is_expanded_memory()) {
+			img_offset = CAM_36BIT_INTF_GET_IOVA_OFFSET(iova);
+			img_addr = CAM_36BIT_INTF_GET_IOVA_BASE(iova);
+			frame_inc = CAM_36BIT_INTF_GET_IOVA_BASE(frame_inc);
+
+			CAM_DBG(CAM_SFE, "WM:%d image address offset: 0x%x",
+				wm_data->index, img_offset);
+			cam_io_w_mb(img_offset,
+				wm_data->common_data->mem_base + wm_data->hw_regs->addr_cfg);
+		} else {
+			img_addr = iova;
+		}
+
+		CAM_DBG(CAM_SFE, "WM:%d image address: 0x%x, offset: 0x%x",
+			wm_data->index, img_addr, wm_data->offset);
+
+		cam_io_w_mb(img_addr,
+			wm_data->common_data->mem_base + wm_data->hw_regs->image_addr);
+		cam_io_w_mb(frame_inc,
+			wm_data->common_data->mem_base +
+			wm_data->hw_regs->frame_incr);
+
+		CAM_DBG(CAM_SFE, "WM:%d frame_inc: %d expanded_mem: %s",
+			wm_data->index, frame_inc,
+			CAM_BOOL_TO_YESNO(cam_smmu_is_expanded_memory));
+
+		curr_cache_cfg = wm_data->cache_cfg;
+		wm_data->cache_cfg = bus_priv->common_data.sys_cache_default_cfg;
+		if ((!cache_dbg_cfg->disable_for_scratch) &&
+			(wm_data->enable_caching)) {
+			wm_data->cache_cfg =
+				wm_data->current_scid << 8;
+			wm_data->cache_cfg |= 3 << 4;
+			if (cache_dbg_cfg->scratch_dbg_cfg)
+				wm_data->cache_cfg |= cache_dbg_cfg->scratch_alloc;
+			else
+				wm_data->cache_cfg |= CACHE_ALLOC_ALLOC;
+
+			if (cache_dbg_cfg->print_cache_cfg &&
+				(curr_cache_cfg != wm_data->cache_cfg)) {
+				CAM_INFO(CAM_SFE,
+					"SFE:%d Scratch Buff WM:%d current_scid:%d cache_cfg:0x%x",
+					wm_data->common_data->core_index,
+					wm_data->index, wm_data->current_scid, wm_data->cache_cfg);
+			}
+		}
+
+		cam_io_w_mb(wm_data->cache_cfg,
+			wm_data->common_data->mem_base +
+			wm_data->hw_regs->system_cache_cfg);
+		CAM_DBG(CAM_SFE, "WM:%d cache_cfg:0x%x",
+			wm_data->index, wm_data->cache_cfg);
+
+		cam_io_w_mb(wm_data->pack_fmt,
+			wm_data->common_data->mem_base +
+			wm_data->hw_regs->packer_cfg);
+		CAM_DBG(CAM_SFE, "WM:%d packer_cfg 0x%X",
+			wm_data->index, wm_data->pack_fmt);
+
+		/* enable the WM */
+		cam_io_w_mb(wm_data->en_cfg,
+			wm_data->common_data->mem_base +
+			wm_data->hw_regs->cfg);
+		CAM_DBG(CAM_SFE, "WM:%d en_cfg 0x%X",
+			wm_data->index, wm_data->en_cfg);
+
+		/* set initial configuration done */
+		if (!wm_data->init_cfg_done)
+			wm_data->init_cfg_done = true;
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update       *update_hfr;
+	struct cam_sfe_bus_wr_out_data         *sfe_out_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data *wm_data = NULL;
+	struct cam_isp_port_hfr_config         *hfr_cfg = NULL;
+	struct cam_cdm_utils_ops               *cdm_util_ops;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t  i, j, size = 0;
+
+	update_hfr =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
+		update_hfr->res->res_priv;
+
+	if (!sfe_out_data || !sfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = sfe_out_data->cdm_util_ops;
+	reg_val_pair = &sfe_out_data->common_data->io_buf_update[0];
+	hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data;
+
+	for (i = 0, j = 0; i < sfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_SFE,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = sfe_out_data->wm_res[i].res_priv;
+		if ((wm_data->framedrop_pattern !=
+			hfr_cfg->framedrop_pattern) ||
+			!wm_data->hfr_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_pattern,
+				hfr_cfg->framedrop_pattern);
+			wm_data->framedrop_pattern = hfr_cfg->framedrop_pattern;
+			CAM_DBG(CAM_SFE, "WM:%d framedrop pattern 0x%X",
+				wm_data->index, wm_data->framedrop_pattern);
+		}
+
+		if (wm_data->framedrop_period != hfr_cfg->framedrop_period ||
+			!wm_data->hfr_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_period,
+				hfr_cfg->framedrop_period);
+			wm_data->framedrop_period = hfr_cfg->framedrop_period;
+			CAM_DBG(CAM_SFE, "WM:%d framedrop period 0x%X",
+				wm_data->index, wm_data->framedrop_period);
+		}
+
+		if (wm_data->irq_subsample_period != hfr_cfg->subsample_period
+			|| !wm_data->hfr_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_period,
+				hfr_cfg->subsample_period);
+			wm_data->irq_subsample_period =
+				hfr_cfg->subsample_period;
+			CAM_DBG(CAM_SFE, "WM:%d irq subsample period 0x%X",
+				wm_data->index, wm_data->irq_subsample_period);
+		}
+
+		if (wm_data->irq_subsample_pattern != hfr_cfg->subsample_pattern
+			|| !wm_data->hfr_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_pattern,
+				hfr_cfg->subsample_pattern);
+			wm_data->irq_subsample_pattern =
+				hfr_cfg->subsample_pattern;
+			CAM_DBG(CAM_SFE, "WM:%d irq subsample pattern 0x%X",
+				wm_data->index, wm_data->irq_subsample_pattern);
+		}
+
+		/* set initial configuration done */
+		if (!wm_data->hfr_cfg_done)
+			wm_data->hfr_cfg_done = true;
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_hfr->cmd.size) {
+			CAM_ERR(CAM_SFE,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				update_hfr->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_hfr->cmd.cmd_buf_addr, num_regval_pairs,
+			reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_hfr->cmd.used_bytes = size * 4;
+	} else {
+		CAM_DBG(CAM_SFE,
+			"No reg val pairs. num_wms: %u",
+			sfe_out_data->num_wm);
+		update_hfr->cmd.used_bytes = 0;
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_update_stripe_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv                *bus_priv;
+	struct cam_isp_hw_dual_isp_update_args    *stripe_args;
+	struct cam_sfe_bus_wr_out_data            *sfe_out_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data    *wm_data = NULL;
+	struct cam_isp_dual_stripe_config         *stripe_config;
+	uint32_t outport_id, ports_plane_idx, i;
+
+	bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+	stripe_args = (struct cam_isp_hw_dual_isp_update_args *)cmd_args;
+
+	sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
+		stripe_args->res->res_priv;
+
+	if (!sfe_out_data) {
+		CAM_ERR(CAM_SFE, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	outport_id = stripe_args->res->res_id & 0xFF;
+	if (stripe_args->res->res_id < CAM_ISP_SFE_OUT_RES_BASE ||
+		stripe_args->res->res_id >= bus_priv->max_out_res)
+		return 0;
+
+	ports_plane_idx = (stripe_args->split_id *
+	(stripe_args->dual_cfg->num_ports * CAM_PACKET_MAX_PLANES)) +
+	(outport_id * CAM_PACKET_MAX_PLANES);
+	for (i = 0; i < sfe_out_data->num_wm; i++) {
+		wm_data = sfe_out_data->wm_res[i].res_priv;
+		stripe_config = (struct cam_isp_dual_stripe_config  *)
+			&stripe_args->dual_cfg->stripes_flex[ports_plane_idx + i];
+		wm_data->width = stripe_config->width;
+
+		/*
+		 * UMD sends buffer offset address as offset for clients
+		 * programmed to operate in frame/index based mode and h_init
+		 * value as offset for clients programmed to operate in line
+		 * based mode.
+		 */
+
+		if (wm_data->en_cfg & (0x3 << 16))
+			wm_data->offset = stripe_config->offset;
+		else
+			wm_data->h_init = stripe_config->offset;
+
+		CAM_DBG(CAM_SFE,
+			"out_type:0x%X WM:%d width:%d offset:0x%X h_init:%d",
+			stripe_args->res->res_id, wm_data->index,
+			wm_data->width, wm_data->offset, wm_data->h_init);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_update_wm_config(
+	void                                        *cmd_args)
+{
+	int                                          i;
+	enum cam_sfe_bus_wr_packer_format            packer_fmt = PACKER_FMT_MAX;
+	struct cam_isp_hw_get_cmd_update            *wm_config_update;
+	struct cam_sfe_bus_wr_out_data              *sfe_out_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data      *wm_data = NULL;
+	struct cam_isp_vfe_wm_config                *wm_config = NULL;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	wm_config_update = cmd_args;
+	sfe_out_data = wm_config_update->res->res_priv;
+	wm_config = (struct cam_isp_vfe_wm_config  *)
+		wm_config_update->data;
+
+	if (!sfe_out_data || !sfe_out_data->cdm_util_ops || !wm_config) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < sfe_out_data->num_wm; i++) {
+		wm_data = sfe_out_data->wm_res[i].res_priv;
+
+		if (wm_config->wm_mode > CAM_SFE_WM_INDEX_BASED_MODE) {
+			CAM_ERR(CAM_SFE, "Invalid wm_mode: 0x%X WM:%d",
+				wm_config->wm_mode, wm_data->index);
+			return -EINVAL;
+		}
+
+		wm_data->en_cfg = (wm_config->wm_mode << 16) |
+			(wm_config->virtual_frame_en << 1) | 0x1;
+		wm_data->width  = wm_config->width;
+
+		if (wm_config->packer_format) {
+			packer_fmt = cam_sfe_bus_get_packer_fmt(sfe_out_data->bus_priv,
+				wm_config->packer_format, wm_data->index);
+
+			/* Reconfigure only for valid packer fmt */
+			if (packer_fmt != PACKER_FMT_MAX) {
+				switch (wm_config->packer_format) {
+				case CAM_FORMAT_PLAIN16_10:
+				case CAM_FORMAT_PLAIN16_12:
+				case CAM_FORMAT_PLAIN16_14:
+				case CAM_FORMAT_PLAIN16_16:
+					packer_fmt |=
+						(1 << wm_data->common_data->pack_align_shift);
+					break;
+				default:
+					break;
+				}
+				wm_data->pack_fmt = packer_fmt;
+			}
+		}
+
+		if ((sfe_out_data->out_type >= CAM_SFE_BUS_SFE_OUT_RDI0) &&
+			(sfe_out_data->out_type <= CAM_SFE_BUS_SFE_OUT_RDI4)) {
+			wm_data->wm_mode = wm_config->wm_mode;
+
+			/*
+			 * Update width based on format for line based mode only
+			 * Image size ignored for frame based mode
+			 * Index based not supported currently
+			 */
+			if (wm_data->wm_mode == CAM_SFE_WM_LINE_BASED_MODE)
+				cam_sfe_bus_config_rdi_wm(wm_data);
+		}
+
+		if (i == PLANE_C)
+			wm_data->height = wm_config->height / 2;
+		else
+			wm_data->height = wm_config->height;
+
+		wm_data->offset = wm_config->offset;
+		CAM_DBG(CAM_SFE,
+			"WM:%d en_cfg:0x%X height:%d width:%d offset:%u packer_fmt: 0x%x",
+			wm_data->index, wm_data->en_cfg, wm_data->height,
+			wm_data->width, wm_data->offset, wm_data->pack_fmt);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_update_bw_limiter(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update       *wm_config_update;
+	struct cam_sfe_bus_wr_out_data         *sfe_out_data = NULL;
+	struct cam_cdm_utils_ops               *cdm_util_ops;
+	struct cam_sfe_bus_wr_wm_resource_data *wm_data = NULL;
+	struct cam_isp_wm_bw_limiter_config    *wm_bw_limit_cfg = NULL;
+	uint32_t                                counter_limit = 0, reg_val = 0;
+	uint32_t                               *reg_val_pair, num_regval_pairs = 0;
+	uint32_t                                i, j, size = 0;
+
+	wm_config_update = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	wm_bw_limit_cfg  = (struct cam_isp_wm_bw_limiter_config  *)
+			wm_config_update->data;
+
+	sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
+		wm_config_update->res->res_priv;
+	if (!sfe_out_data || !sfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = sfe_out_data->cdm_util_ops;
+	reg_val_pair = &sfe_out_data->common_data->io_buf_update[0];
+	for (i = 0, j = 0; i < sfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - (MAX_BUF_UPDATE_REG_NUM * 2))) {
+			CAM_ERR(CAM_SFE,
+				"reg_val_pair %d exceeds the array limit %zu for WM idx %d",
+				j, MAX_REG_VAL_PAIR_SIZE, i);
+			return -ENOMEM;
+		}
+
+		/* Num WMs needs to match max planes */
+		if (i >= CAM_PACKET_MAX_PLANES) {
+			CAM_WARN(CAM_SFE,
+				"Num of WMs: %d exceeded max planes", i);
+			goto add_reg_pair;
+		}
+
+		wm_data = (struct cam_sfe_bus_wr_wm_resource_data *)
+			sfe_out_data->wm_res[i].res_priv;
+		if (!wm_data->hw_regs->bw_limiter_addr) {
+			CAM_ERR(CAM_SFE,
+				"WM: %d %s has no support for bw limiter",
+				wm_data->index, sfe_out_data->wm_res[i].res_name);
+			return -EINVAL;
+		}
+
+		counter_limit = wm_bw_limit_cfg->counter_limit[i];
+
+		/* Validate max counter limit */
+		if (counter_limit >
+			wm_data->common_data->max_bw_counter_limit) {
+			CAM_WARN(CAM_SFE,
+				"Invalid counter limit: 0x%x capping to max: 0x%x",
+				wm_bw_limit_cfg->counter_limit[i],
+				wm_data->common_data->max_bw_counter_limit);
+			counter_limit = wm_data->common_data->max_bw_counter_limit;
+		}
+
+		if (wm_bw_limit_cfg->enable_limiter && counter_limit) {
+			reg_val = 1;
+			reg_val |= (counter_limit << 1);
+		} else {
+			reg_val = 0;
+		}
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->bw_limiter_addr, reg_val);
+		CAM_DBG(CAM_SFE, "WM: %d %s bw_limter: 0x%x",
+			wm_data->index, sfe_out_data->wm_res[i].res_name,
+			reg_val_pair[j-1]);
+	}
+
+add_reg_pair:
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > wm_config_update->cmd.size) {
+			CAM_ERR(CAM_SFE,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				wm_config_update->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			wm_config_update->cmd.cmd_buf_addr, num_regval_pairs,
+			reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		wm_config_update->cmd.used_bytes = size * 4;
+	} else {
+		CAM_DBG(CAM_SFE,
+			"No reg val pairs. num_wms: %u",
+			sfe_out_data->num_wm);
+		wm_config_update->cmd.used_bytes = 0;
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_get_res_for_mid(
+	struct cam_sfe_bus_wr_priv *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update       *cmd_update = cmd_args;
+	struct cam_isp_hw_get_res_for_mid       *get_res = NULL;
+	int i, j;
+
+	get_res = (struct cam_isp_hw_get_res_for_mid *)cmd_update->data;
+	if (!get_res) {
+		CAM_ERR(CAM_SFE,
+			"invalid get resource for mid paramas");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+
+		for (j = 0; j < bus_priv->sfe_out_hw_info[i].num_mid; j++) {
+			if (bus_priv->sfe_out_hw_info[i].mid[j] == get_res->mid)
+				goto end;
+		}
+	}
+	/*
+	 * Do not update out_res_id in case of no match.
+	 * Correct value will be dumped in hw mgr
+	 */
+	if (i == bus_priv->num_out) {
+		CAM_INFO(CAM_SFE, "mid:%d does not match with any out resource", get_res->mid);
+		return 0;
+	}
+
+end:
+	CAM_INFO(CAM_SFE, "match mid :%d  out resource: %s 0x%x found",
+		get_res->mid, bus_priv->sfe_out_hw_info[i].name,
+		bus_priv->sfe_out[i].res_id);
+	get_res->out_res_id = bus_priv->sfe_out[i].res_id;
+	return 0;
+}
+
+static int cam_sfe_bus_wr_irq_inject(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv          *bus_priv = NULL;
+	struct cam_hw_soc_info              *soc_info = NULL;
+	struct cam_sfe_bus_wr_hw_info       *bus_wr_hw_info = NULL;
+	struct cam_irq_controller_reg_info  *irq_reg_info = NULL;
+	struct cam_irq_register_set         *inject_reg = NULL;
+	struct cam_isp_irq_inject_param     *inject_params = NULL;
+
+	bus_priv = (struct cam_sfe_bus_wr_priv *)priv;
+	soc_info = bus_priv->common_data.soc_info;
+	bus_wr_hw_info = (struct cam_sfe_bus_wr_hw_info *)bus_priv->bus_wr_hw_info;
+	irq_reg_info = &bus_wr_hw_info->common_reg.irq_reg_info;
+	inject_reg = irq_reg_info->irq_reg_set;
+	inject_params = (struct cam_isp_irq_inject_param *)cmd_args;
+
+	if (!inject_params || !inject_reg) {
+		CAM_INFO(CAM_SFE, "Invalid inject_params or inject_reg");
+		return -EINVAL;
+	}
+
+	if (inject_params->reg_unit ==
+		CAM_ISP_SFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG) {
+
+		cam_io_w_mb(inject_params->irq_mask,
+			soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base +
+			inject_reg->set_reg_offset);
+		cam_io_w_mb(0x10, soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base +
+			irq_reg_info->global_irq_cmd_offset);
+		CAM_INFO(CAM_SFE, "Injected : irq_mask %#x set_reg_offset %#x",
+			inject_params->irq_mask, inject_reg->set_reg_offset);
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_wr_dump_irq_desc(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	int                                          i, offset = 0;
+	struct cam_sfe_bus_wr_priv                  *bus_priv = NULL;
+	struct cam_sfe_bus_wr_hw_info               *bus_wr_hw_info = NULL;
+	struct cam_isp_irq_inject_param             *inject_params = NULL;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	bus_priv = (struct cam_sfe_bus_wr_priv *)priv;
+	bus_wr_hw_info = (struct cam_sfe_bus_wr_hw_info *)bus_priv->bus_wr_hw_info;
+	inject_params = (struct cam_isp_irq_inject_param *)cmd_args;
+
+	if (inject_params->reg_unit ==
+			CAM_ISP_SFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG) {
+		offset += scnprintf(inject_params->line_buf + offset,
+			LINE_BUFFER_LEN - offset,
+			"Printing executable IRQ for hw_type: SFE reg_unit: %d\n",
+			inject_params->reg_unit);
+
+		for (i = 0; i < bus_wr_hw_info->num_bus_wr_errors; i++)
+			offset += scnprintf(inject_params->line_buf + offset,
+				LINE_BUFFER_LEN - offset, "%#12x : %s - %s\n",
+				bus_wr_hw_info->bus_wr_err_desc[i].bitmask,
+				bus_wr_hw_info->bus_wr_err_desc[i].err_name,
+				bus_wr_hw_info->bus_wr_err_desc[i].desc);
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_wr_start_hw(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	return cam_sfe_bus_start_sfe_out(hw_priv);
+}
+
+static int cam_sfe_bus_wr_stop_hw(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	return cam_sfe_bus_stop_sfe_out(hw_priv);
+}
+
+static int cam_sfe_bus_wr_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv *bus_priv = hw_priv;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SFE, "SFE:%d bus-wr hw-version:0x%x",
+		bus_priv->common_data.core_index,
+		cam_io_r_mb(bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->hw_version));
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	return 0;
+}
+
+static int cam_sfe_bus_wr_cache_config(
+	void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	int i;
+	struct cam_sfe_bus_wr_priv              *bus_priv;
+	struct cam_isp_sfe_bus_sys_cache_config *cache_cfg;
+	struct cam_sfe_bus_wr_out_data          *sfe_out_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data  *wm_data = NULL;
+
+
+	bus_priv = (struct cam_sfe_bus_wr_priv  *)priv;
+	cache_cfg = (struct cam_isp_sfe_bus_sys_cache_config *)cmd_args;
+
+	sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
+		cache_cfg->res->res_priv;
+
+	if (!sfe_out_data) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	if (bus_priv->common_data.cache_dbg_cfg.disable_all)
+		return 0;
+
+	for (i = 0; i < sfe_out_data->num_wm; i++) {
+		wm_data = (struct cam_sfe_bus_wr_wm_resource_data *)
+			sfe_out_data->wm_res[i].res_priv;
+		wm_data->enable_caching = cache_cfg->use_cache;
+		wm_data->current_scid = cache_cfg->scid;
+		cache_cfg->wr_cfg_done = true;
+
+		CAM_DBG(CAM_SFE, "SFE:%d WM:%d cache_enable:%s scid:%u",
+			wm_data->common_data->core_index,
+			wm_data->index,
+			(wm_data->enable_caching ? "true" : "false"),
+			wm_data->current_scid);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_set_debug_cfg(
+	void *priv, void *cmd_args)
+{
+	struct cam_sfe_bus_wr_priv *bus_priv =
+		(struct cam_sfe_bus_wr_priv  *) priv;
+	struct cam_sfe_debug_cfg_params *debug_cfg;
+
+	debug_cfg = (struct cam_sfe_debug_cfg_params *)cmd_args;
+
+	if (debug_cfg->cache_config)
+		cam_sfe_bus_parse_cache_cfg(false,
+			debug_cfg->u.cache_cfg.sfe_cache_dbg,
+			&bus_priv->common_data.cache_dbg_cfg);
+	else
+		bus_priv->common_data.sfe_debug_cfg =
+			debug_cfg->u.dbg_cfg.sfe_debug_cfg;
+
+	return 0;
+}
+
+static uint32_t cam_sfe_bus_get_last_consumed_addr(
+	struct cam_sfe_bus_wr_priv *bus_priv,
+	uint32_t res_type)
+{
+	uint32_t                                  last_consumed_addr;
+	struct cam_isp_resource_node             *rsrc_node = NULL;
+	struct cam_sfe_bus_wr_out_data           *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data   *wm_rsrc_data = NULL;
+	enum cam_sfe_bus_sfe_out_type             res_id;
+
+	res_id = cam_sfe_bus_wr_get_out_res_id(res_type);
+
+	if (res_id >= CAM_SFE_BUS_SFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "invalid res id:%u", res_id);
+		return 0;
+	}
+
+	rsrc_node = &bus_priv->sfe_out[res_id];
+	rsrc_data = rsrc_node->res_priv;
+
+	/* All SFE out ports have single WM */
+	wm_rsrc_data = rsrc_data->wm_res->res_priv;
+	last_consumed_addr = cam_io_r_mb(
+		wm_rsrc_data->common_data->mem_base +
+		wm_rsrc_data->hw_regs->addr_status_0);
+
+	return last_consumed_addr;
+}
+
+static int cam_sfe_bus_wr_process_cmd(
+	void *priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_sfe_bus_wr_priv *bus_priv;
+	struct cam_isp_hw_done_event_data *done;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+		rc = cam_sfe_bus_wr_update_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BUF_UPDATE:
+		rc = cam_sfe_bus_wr_config_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+		rc = cam_sfe_bus_wr_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_WM_SECURE_MODE:
+		rc = cam_sfe_bus_wr_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+		rc = cam_sfe_bus_wr_update_stripe_cfg(priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+		rc = 0;
+		break;
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO: {
+		struct cam_isp_hw_event_info  *event_info =
+			(struct cam_isp_hw_event_info *)cmd_args;
+		enum cam_sfe_bus_sfe_out_type  sfe_out_res_id;
+
+		sfe_out_res_id =
+			cam_sfe_bus_wr_get_out_res_id(event_info->res_id);
+
+		/* Skip if not write resource */
+		if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_MAX) {
+			CAM_DBG(CAM_SFE,
+				"No a SFE write res: 0x%x - skip dump",
+				event_info->res_id);
+			rc = 0;
+			break;
+		}
+
+		rc = cam_sfe_bus_wr_print_dimensions(
+			sfe_out_res_id, (struct cam_sfe_bus_wr_priv  *)priv);
+		break;
+		}
+	case CAM_ISP_HW_SFE_BUS_MINI_DUMP: {
+		bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+
+		rc = cam_sfe_bus_mini_dump(bus_priv, cmd_args);
+		break;
+	}
+	case CAM_ISP_HW_USER_DUMP: {
+		bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+
+		rc = cam_sfe_bus_wr_user_dump(bus_priv, cmd_args);
+		break;
+	}
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+		rc = cam_sfe_bus_wr_update_wm_config(cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_CAP: {
+		struct cam_isp_hw_cap *sfe_bus_cap;
+
+		bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+		sfe_bus_cap = (struct cam_isp_hw_cap *) cmd_args;
+		sfe_bus_cap->max_out_res_type = bus_priv->max_out_res;
+		rc = 0;
+		break;
+	}
+	case CAM_ISP_HW_CMD_GET_LAST_CONSUMED_ADDR:
+		bus_priv = (struct cam_sfe_bus_wr_priv *) priv;
+		done = (struct cam_isp_hw_done_event_data *) cmd_args;
+		done->last_consumed_addr = cam_sfe_bus_get_last_consumed_addr(
+			bus_priv, done->resource_handle);
+		break;
+	case CAM_ISP_HW_SFE_SYS_CACHE_WM_CONFIG:
+		rc = cam_sfe_bus_wr_cache_config(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SET_SFE_DEBUG_CFG:
+		rc = cam_sfe_bus_wr_set_debug_cfg(priv, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_WM_BW_LIMIT_CONFIG:
+		rc = cam_sfe_bus_wr_update_bw_limiter(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+		rc = cam_sfe_bus_wr_get_res_for_mid(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_IRQ_INJECTION:
+		rc = cam_sfe_bus_wr_irq_inject(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION:
+		rc = cam_sfe_bus_wr_dump_irq_desc(priv, cmd_args, arg_size);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "Invalid HW command type:%d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_sfe_bus_wr_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *sfe_irq_controller,
+	struct cam_sfe_bus                  **sfe_bus)
+{
+	int i, rc = 0;
+	struct cam_sfe_bus_wr_priv    *bus_priv = NULL;
+	struct cam_sfe_bus            *sfe_bus_local;
+	struct cam_sfe_bus_wr_hw_info *hw_info = bus_hw_info;
+
+	CAM_DBG(CAM_SFE, "Enter");
+
+	if (!soc_info || !hw_intf || !bus_hw_info) {
+		CAM_ERR(CAM_SFE,
+			"Inval_prms soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_hw_info);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	sfe_bus_local = kzalloc(sizeof(struct cam_sfe_bus), GFP_KERNEL);
+	if (!sfe_bus_local) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for sfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_sfe_bus_wr_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for sfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+	sfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                        = hw_info->num_client;
+	bus_priv->num_out                           = hw_info->num_out;
+	bus_priv->max_out_res                       = hw_info->max_out_res;
+	bus_priv->num_comp_grp                      = hw_info->num_comp_grp;
+	bus_priv->top_irq_shift                     = hw_info->top_irq_shift;
+	bus_priv->common_data.num_sec_out           = 0;
+	bus_priv->common_data.secure_mode           = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index            = soc_info->index;
+	bus_priv->common_data.mem_base              =
+		CAM_SOC_GET_REG_MAP_START(soc_info, SFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf               = hw_intf;
+	bus_priv->common_data.common_reg            = &hw_info->common_reg;
+	bus_priv->common_data.line_done_cfg         = hw_info->line_done_cfg;
+	bus_priv->common_data.pack_align_shift      = hw_info->pack_align_shift;
+	bus_priv->common_data.max_bw_counter_limit  = hw_info->max_bw_counter_limit;
+	bus_priv->common_data.err_irq_subscribe     = false;
+	bus_priv->common_data.sfe_irq_controller    = sfe_irq_controller;
+	bus_priv->common_data.irq_err_mask          = hw_info->irq_err_mask;
+	bus_priv->common_data.sys_cache_default_cfg = hw_info->sys_cache_default_val;
+	bus_priv->common_data.soc_info             = soc_info;
+	bus_priv->constraint_error_info             = hw_info->constraint_error_info;
+	bus_priv->sfe_out_hw_info                   = hw_info->sfe_out_hw_info;
+	bus_priv->bus_wr_hw_info                    = hw_info;
+	rc = cam_cpas_get_cpas_hw_version(&bus_priv->common_data.hw_version);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Failed to get hw_version rc:%d", rc);
+		goto free_bus_priv;
+	}
+
+	bus_priv->comp_grp = kzalloc((sizeof(struct cam_isp_resource_node) *
+		bus_priv->num_comp_grp), GFP_KERNEL);
+	if (!bus_priv->comp_grp) {
+		CAM_ERR(CAM_SFE, "Failed to alloc for bus comp groups");
+		rc = -ENOMEM;
+		goto free_bus_priv;
+	}
+
+	bus_priv->sfe_out = kzalloc((sizeof(struct cam_isp_resource_node) *
+		CAM_SFE_BUS_SFE_OUT_MAX), GFP_KERNEL);
+	if (!bus_priv->sfe_out) {
+		CAM_ERR(CAM_SFE, "Failed to alloc for bus out res");
+		rc = -ENOMEM;
+		goto free_comp_grp;
+	}
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+	rc = cam_irq_controller_init(drv_name,
+		bus_priv->common_data.mem_base,
+		&hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Init bus_irq_controller failed");
+		goto free_sfe_out;
+	}
+
+
+	for (i = 0; i < bus_priv->num_comp_grp; i++) {
+		rc = cam_sfe_bus_wr_init_comp_grp(i, soc_info,
+			bus_priv, bus_hw_info,
+			&bus_priv->comp_grp[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_SFE, "SFE:%d init comp_grp:%d failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+			goto deinit_comp_grp;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_sfe_bus_init_sfe_out_resource(i, bus_priv,
+			bus_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d init out_type:0x%X failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+			goto deinit_sfe_out;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+
+	for (i = 0; i < CAM_SFE_BUS_WR_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+
+	sfe_bus_local->hw_ops.reserve      = cam_sfe_bus_acquire_sfe_out;
+	sfe_bus_local->hw_ops.release      = cam_sfe_bus_release_sfe_out;
+	sfe_bus_local->hw_ops.start        = cam_sfe_bus_wr_start_hw;
+	sfe_bus_local->hw_ops.stop         = cam_sfe_bus_wr_stop_hw;
+	sfe_bus_local->hw_ops.init         = cam_sfe_bus_wr_init_hw;
+	sfe_bus_local->hw_ops.deinit       = cam_sfe_bus_wr_deinit_hw;
+	sfe_bus_local->top_half_handler    = NULL;
+	sfe_bus_local->bottom_half_handler = NULL;
+	sfe_bus_local->hw_ops.process_cmd  = cam_sfe_bus_wr_process_cmd;
+	bus_priv->bus_irq_handle = 0;
+	bus_priv->common_data.sfe_debug_cfg = 0;
+	*sfe_bus = sfe_bus_local;
+
+	CAM_DBG(CAM_SFE, "Exit");
+	return rc;
+
+deinit_sfe_out:
+	for (--i; i >= 0; i--)
+		cam_sfe_bus_deinit_sfe_out_resource(&bus_priv->sfe_out[i]);
+
+deinit_comp_grp:
+	if (i < 0)
+		i = bus_priv->num_comp_grp;
+	for (--i; i >= 0; i--)
+		cam_sfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+
+free_sfe_out:
+	kfree(bus_priv->sfe_out);
+
+free_comp_grp:
+	kfree(bus_priv->comp_grp);
+
+free_bus_priv:
+	kfree(sfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(sfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_sfe_bus_wr_deinit(
+	struct cam_sfe_bus                  **sfe_bus)
+{
+	int i, rc = 0;
+	struct cam_sfe_bus_wr_priv    *bus_priv = NULL;
+	struct cam_sfe_bus            *sfe_bus_local;
+	unsigned long                  flags;
+
+	if (!sfe_bus || !*sfe_bus) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+	sfe_bus_local = *sfe_bus;
+
+	bus_priv = sfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_SFE, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_SFE_BUS_WR_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+	bus_priv->common_data.err_irq_subscribe = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	for (i = 0; i < bus_priv->num_comp_grp; i++) {
+		rc = cam_sfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"SFE:%d deinit comp_grp:%d failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_sfe_bus_deinit_sfe_out_resource(
+			&bus_priv->sfe_out[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"SFE:%d deinit out_type:0x%X failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+	}
+
+	kfree(bus_priv->comp_grp);
+	kfree(bus_priv->sfe_out);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+
+	kfree(sfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(sfe_bus_local);
+
+	*sfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.h
@@ -0,0 +1,305 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_SFE_BUS_WR_H_
+#define _CAM_SFE_BUS_WR_H_
+
+#include "cam_sfe_bus.h"
+
+#define CAM_SFE_BUS_WR_MAX_CLIENTS        17
+#define CAM_SFE_BUS_WR_MAX_SUB_GRPS       6
+#define CAM_SFE_BUS_CONS_ERR_MAX          32
+
+#define CAM_SFE_BUS_WR_IRQ_CONS_VIOLATION       BIT(28)
+#define CAM_SFE_BUS_WR_IRQ_CCIF_VIOLATION       BIT(30)
+#define CAM_SFE_BUS_WR_IRQ_IMAGE_SIZE_VIOLATION BIT(31)
+
+enum cam_sfe_bus_wr_src_grp {
+	CAM_SFE_BUS_WR_SRC_GRP_0,
+	CAM_SFE_BUS_WR_SRC_GRP_1,
+	CAM_SFE_BUS_WR_SRC_GRP_2,
+	CAM_SFE_BUS_WR_SRC_GRP_3,
+	CAM_SFE_BUS_WR_SRC_GRP_4,
+	CAM_SFE_BUS_WR_SRC_GRP_5,
+	CAM_SFE_BUS_WR_SRC_GRP_MAX,
+};
+
+enum cam_sfe_bus_wr_comp_grp_type {
+	CAM_SFE_BUS_WR_COMP_GRP_0,
+	CAM_SFE_BUS_WR_COMP_GRP_1,
+	CAM_SFE_BUS_WR_COMP_GRP_2,
+	CAM_SFE_BUS_WR_COMP_GRP_3,
+	CAM_SFE_BUS_WR_COMP_GRP_4,
+	CAM_SFE_BUS_WR_COMP_GRP_5,
+	CAM_SFE_BUS_WR_COMP_GRP_6,
+	CAM_SFE_BUS_WR_COMP_GRP_7,
+	CAM_SFE_BUS_WR_COMP_GRP_8,
+	CAM_SFE_BUS_WR_COMP_GRP_9,
+	CAM_SFE_BUS_WR_COMP_GRP_10,
+	CAM_SFE_BUS_WR_COMP_GRP_MAX,
+};
+
+enum cam_sfe_bus_sfe_out_type {
+	CAM_SFE_BUS_SFE_OUT_RDI0,
+	CAM_SFE_BUS_SFE_OUT_RDI1,
+	CAM_SFE_BUS_SFE_OUT_RDI2,
+	CAM_SFE_BUS_SFE_OUT_RDI3,
+	CAM_SFE_BUS_SFE_OUT_RDI4,
+	CAM_SFE_BUS_SFE_OUT_RAW_DUMP,
+	CAM_SFE_BUS_SFE_OUT_LCR,
+	CAM_SFE_BUS_SFE_OUT_BE_0,
+	CAM_SFE_BUS_SFE_OUT_BHIST_0,
+	CAM_SFE_BUS_SFE_OUT_BE_1,
+	CAM_SFE_BUS_SFE_OUT_BHIST_1,
+	CAM_SFE_BUS_SFE_OUT_BE_2,
+	CAM_SFE_BUS_SFE_OUT_BHIST_2,
+	CAM_SFE_BUS_SFE_OUT_BAYER_RS_0,
+	CAM_SFE_BUS_SFE_OUT_BAYER_RS_1,
+	CAM_SFE_BUS_SFE_OUT_BAYER_RS_2,
+	CAM_SFE_BUS_SFE_OUT_IR,
+	CAM_SFE_BUS_SFE_OUT_HDR_STATS,
+	CAM_SFE_BUS_SFE_OUT_MAX,
+};
+
+/*
+ * struct cam_sfe_bus_wr_err_irq_desc:
+ *
+ * @Brief:        Bus wr error irq description
+ */
+struct cam_sfe_bus_wr_err_irq_desc {
+	uint32_t  bitmask;
+	char     *err_name;
+	char     *desc;
+};
+
+/*
+ * struct cam_sfe_constraint_error_desc:
+ *
+ * @Brief:        Constraint error desc
+ */
+struct cam_sfe_bus_wr_constraint_error_desc {
+	uint32_t  bitmask;
+	char     *error_description;
+};
+
+/*
+ * @brief:        Constraint error info
+ *
+ * @error_desc: Error description for various constraint errors.
+ * @num_cons_err: Number of constraint errors
+ * @img_addr_unalign_shift: shift for image address unalign error
+ * @img_width_unalign_shift: shift for image width unalign error
+ *
+ */
+struct cam_sfe_bus_wr_constraint_error_info {
+	struct cam_sfe_bus_wr_constraint_error_desc *constraint_error_list;
+	uint32_t num_cons_err;
+	uint32_t img_addr_unalign_shift;
+	uint32_t img_width_unalign_shift;
+};
+
+/*
+ * struct cam_sfe_bus_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_sfe_bus_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t cgc_ovd;
+	uint32_t if_frameheader_cfg[CAM_SFE_BUS_WR_MAX_SUB_GRPS];
+	uint32_t pwr_iso_cfg;
+	uint32_t overflow_status_clear;
+	uint32_t ccif_violation_status;
+	uint32_t overflow_status;
+	uint32_t image_size_violation_status;
+	uint32_t debug_status_top_cfg;
+	uint32_t debug_status_top;
+	uint32_t test_bus_ctrl;
+	uint32_t top_irq_mask_0;
+	uint32_t qos_eos_cfg;
+	struct cam_irq_controller_reg_info irq_reg_info;
+};
+
+/*
+ * struct cam_sfe_bus_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_sfe_bus_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t frame_incr;
+	uint32_t image_cfg_0;
+	uint32_t image_cfg_1;
+	uint32_t image_cfg_2;
+	uint32_t packer_cfg;
+	uint32_t frame_header_addr;
+	uint32_t frame_header_incr;
+	uint32_t frame_header_cfg;
+	uint32_t line_done_cfg;
+	uint32_t irq_subsample_period;
+	uint32_t irq_subsample_pattern;
+	uint32_t framedrop_period;
+	uint32_t framedrop_pattern;
+	uint32_t system_cache_cfg;
+	uint32_t addr_cfg;
+	uint32_t addr_status_0;
+	uint32_t addr_status_1;
+	uint32_t addr_status_2;
+	uint32_t addr_status_3;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	uint32_t mmu_prefetch_cfg;
+	uint32_t mmu_prefetch_max_offset;
+	uint32_t bw_limiter_addr;
+	uint32_t comp_group;
+};
+
+/*
+ * struct cam_sfe_bus_sfe_out_hw_info:
+ *
+ * @Brief:        HW capability of SFE Bus Client
+ */
+struct cam_sfe_bus_sfe_out_hw_info {
+	enum cam_sfe_bus_sfe_out_type       sfe_out_type;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+	uint32_t                            source_group;
+	uint32_t                            mid[CAM_SFE_BUS_MAX_MID_PER_PORT];
+	uint32_t                            num_mid;
+	uint32_t                            num_wm;
+	uint32_t                            wm_idx;
+	uint32_t                            en_line_done;
+	uint8_t                            *name;
+};
+
+/*
+ * struct cam_sfe_bus_wr_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:                Common register details
+ * @num_client:                Total number of write clients
+ * @bus_client_reg:            Bus client register info
+ * @sfe_out_hw_info:           SFE output capability
+ * @constraint_error_info:     Constraint Error information
+ * @comp_done_mask:           List of buf done mask shift values for
+ *                             each comp grp
+ * @num_comp_grp:              Number of composite groups
+ * @line_done_cfg:             Line done cfg for wr/rd sync
+ * @top_irq_shift:             Mask shift for top level BUS WR irq
+ * @max_out_res:               maximum number of sfe out res in uapi
+ * @pack_align_shift:          Packer format alignment bit shift
+ * @max_bw_counter_limit:      Max BW counter limit
+ * @sys_cache_default_val:     System cache default config
+ * @irq_err_mask:              IRQ error mask
+ */
+struct cam_sfe_bus_wr_hw_info {
+	struct cam_sfe_bus_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_sfe_bus_reg_offset_bus_client
+		bus_client_reg[CAM_SFE_BUS_WR_MAX_CLIENTS];
+	uint32_t num_out;
+	struct cam_sfe_bus_sfe_out_hw_info
+		sfe_out_hw_info[CAM_SFE_BUS_SFE_OUT_MAX];
+	struct cam_sfe_bus_wr_constraint_error_info
+		*constraint_error_info;
+	uint32_t num_bus_wr_errors;
+	struct cam_sfe_bus_wr_err_irq_desc *bus_wr_err_desc;
+	uint32_t comp_done_mask[CAM_SFE_BUS_WR_COMP_GRP_MAX];
+	uint32_t num_comp_grp;
+	uint32_t line_done_cfg;
+	uint32_t top_irq_shift;
+	uint32_t max_out_res;
+	uint32_t pack_align_shift;
+	uint32_t max_bw_counter_limit;
+	uint32_t sys_cache_default_val;
+	uint32_t irq_err_mask;
+};
+
+/**
+ * struct cam_sfe_bus_wm_mini_dump - SFE WM data
+ *
+ * @width                  Width
+ * @height                 Height
+ * @stride                 stride
+ * @h_init                 init height
+ * @acquired_width         acquired width
+ * @acquired_height        acquired height
+ * @en_cfg                 Enable flag
+ * @format                 format
+ * @index                  Index
+ * @state                  state
+ * @name                   Res name
+ */
+struct cam_sfe_bus_wm_mini_dump {
+	uint32_t   width;
+	uint32_t   height;
+	uint32_t   stride;
+	uint32_t   h_init;
+	uint32_t   acquired_width;
+	uint32_t   acquired_height;
+	uint32_t   en_cfg;
+	uint32_t   format;
+	uint32_t   index;
+	uint32_t   state;
+	uint8_t    name[CAM_ISP_RES_NAME_LEN];
+};
+
+/**
+ * struct cam_sfe_bus_mini_dump_data - SFE bus mini dump data
+ *
+ * @wm:              Write Master client information
+ * @clk_rate:        Clock rate
+ * @num_client:      Num client
+ * @hw_state:        hw statte
+ * @hw_idx:          Hw index
+ */
+struct cam_sfe_bus_mini_dump_data {
+	struct cam_sfe_bus_wm_mini_dump *wm;
+	uint64_t                         clk_rate;
+	uint32_t                         num_client;
+	uint8_t                          hw_state;
+	uint8_t                          hw_idx;
+};
+
+/*
+ * cam_sfe_bus_wr_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @sfe_irq_controller:      SFE irq controller
+ * @sfe_bus:                 Pointer to sfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_wr_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *sfe_irq_controller,
+	struct cam_sfe_bus                  **sfe_bus);
+
+/*
+ * cam_sfe_bus_wr_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @sfe_bus:                 Pointer to sfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_wr_deinit(struct cam_sfe_bus     **sfe_bus);
+
+#endif /* _CAM_SFE_BUS_WR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/include/cam_sfe_bus.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/include/cam_sfe_bus.h
@@ -0,0 +1,155 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_BUS_H_
+#define _CAM_SFE_BUS_H_
+
+#include "cam_sfe_hw_intf.h"
+
+#define CAM_SFE_BUS_WR_VER_1_0          0x1000
+#define CAM_SFE_BUS_RD_VER_1_0          0x1000
+#define CAM_SFE_BUS_MAX_MID_PER_PORT    4
+
+#define CAM_SFE_ADD_REG_VAL_PAIR(buf_array, index, offset, val)    \
+	do {                                               \
+		buf_array[(index)++] = offset;             \
+		buf_array[(index)++] = val;                \
+	} while (0)
+
+#define ALIGNUP(value, alignment) \
+	((value + alignment - 1) / alignment * alignment)
+
+#define CACHE_ALLOC_NONE               0
+#define CACHE_ALLOC_ALLOC              1
+#define CACHE_ALLOC_ALLOC_CLEAN        2
+#define CACHE_ALLOC_ALLOC_TRANS        3
+#define CACHE_ALLOC_CLEAN              5
+#define CACHE_ALLOC_DEALLOC            6
+#define CACHE_ALLOC_FORGET             7
+#define CACHE_ALLOC_TBH_ALLOC          8
+
+#define DISABLE_CACHING_FOR_ALL           0xFFFFFF
+#define CACHE_SCRATCH_RD_ALLOC_SHIFT      0
+#define CACHE_SCRATCH_WR_ALLOC_SHIFT      4
+#define CACHE_SCRATCH_DEBUG_SHIFT         8
+#define CACHE_BUF_RD_ALLOC_SHIFT          12
+#define CACHE_BUF_WR_ALLOC_SHIFT          16
+#define CACHE_BUF_DEBUG_SHIFT             20
+#define CACHE_BUF_PRINT_DBG_SHIFT         26
+
+enum cam_sfe_bus_plane_type {
+	PLANE_Y,
+	PLANE_C,
+	PLANE_MAX,
+};
+
+enum cam_sfe_bus_type {
+	BUS_TYPE_SFE_WR,
+	BUS_TYPE_SFE_RD,
+	BUS_TYPE_SFE_MAX,
+};
+
+/*
+ * struct cam_sfe_bus_cache_dbg_cfg:
+ *
+ * @Brief:                   Bus cache debug cfg
+ *
+ * @scratch_alloc:           Alloc type for scratch
+ * @buf_alloc:               Alloc type for actual buffer
+ * @disable_all:             Disable caching for all [scratch/snapshot]
+ * @disable_for_scratch:     Disable caching for scratch
+ * @scratch_dbg_cfg:         Scratch alloc configured
+ * @disable_for_buf:         Disable caching for buffer
+ * @buf_dbg_cfg:             Buf alloc configured
+ * @print_cache_cfg:         Print cache cfg
+ */
+struct cam_sfe_bus_cache_dbg_cfg {
+	uint32_t scratch_alloc;
+	uint32_t buf_alloc;
+	bool disable_all;
+	bool disable_for_scratch;
+	bool scratch_dbg_cfg;
+	bool disable_for_buf;
+	bool buf_dbg_cfg;
+	bool print_cache_cfg;
+};
+
+/*
+ * struct cam_sfe_bus:
+ *
+ * @Brief:                   Bus interface structure
+ *
+ * @bus_priv:                Private data of BUS
+ * @hw_ops:                  Hardware interface functions
+ * @top_half_handler:        Top Half handler function
+ * @bottom_half_handler:     Bottom Half handler function
+ */
+struct cam_sfe_bus {
+	void                          *bus_priv;
+	struct cam_hw_ops              hw_ops;
+	CAM_IRQ_HANDLER_TOP_HALF       top_half_handler;
+	CAM_IRQ_HANDLER_BOTTOM_HALF    bottom_half_handler;
+};
+
+/*
+ * cam_sfe_bus_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @bus_version:             Version of BUS to initialize
+ * @bus_type:                Bus Type RD/WR
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @sfe_irq_controller:      SFE irq controller
+ * @sfe_bus:                 Pointer to sfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_init(
+	uint32_t      bus_version,
+	int                            bus_type,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *bus_hw_info,
+	void                          *sfe_irq_controller,
+	struct cam_sfe_bus           **sfe_bus);
+
+/*
+ * cam_sfe_bus_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @bus_version:             Version of BUS to deinitialize
+ * @sfe_bus:                 Pointer to sfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_deinit(
+	uint32_t                   bus_version,
+	int                        bus_type,
+	struct cam_sfe_bus       **sfe_bus);
+
+
+/*
+ * cam_sfe_bus_parse_cache_cfg()
+ *
+ * @Brief:                   Parse SFE debug config
+ *
+ * @is_read:                 If set it's RM
+ * @debug_val:               Debug val to be parsed
+ * @dbg_cfg:                 Debug cfg of RM/WM
+ *
+ */
+void cam_sfe_bus_parse_cache_cfg(
+	bool is_read,
+	uint32_t debug_val,
+	struct cam_sfe_bus_cache_dbg_cfg *dbg_cfg);
+
+#endif /* _CAM_SFE_BUS_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.c
@@ -0,0 +1,2435 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_io_util.h"
+#include "cam_cdm_util.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_sfe_top.h"
+#include "cam_debug_util.h"
+#include "cam_sfe_soc.h"
+#include "cam_sfe_core.h"
+
+struct cam_sfe_core_cfg {
+	uint32_t   mode_sel;
+	uint32_t   ops_mode_cfg;
+	uint32_t   fs_mode_cfg;
+};
+
+struct cam_sfe_top_common_data {
+	struct cam_hw_soc_info                  *soc_info;
+	struct cam_hw_intf                      *hw_intf;
+	struct cam_sfe_top_common_reg_offset    *common_reg;
+	struct cam_sfe_top_common_reg_data      *common_reg_data;
+	struct cam_irq_controller               *sfe_irq_controller;
+	struct cam_sfe_top_irq_evt_payload       evt_payload[CAM_SFE_EVT_MAX];
+	struct list_head                         free_payload_list;
+};
+
+struct cam_sfe_top_perf_counter_cfg {
+	uint32_t perf_counter_val;
+	bool     dump_counter;
+};
+
+struct cam_sfe_top_priv {
+	struct cam_sfe_top_common_data      common_data;
+	struct cam_isp_resource_node        in_rsrc[CAM_SFE_TOP_IN_PORT_MAX];
+	uint32_t                            num_in_ports;
+	unsigned long                       applied_clk_rate;
+	unsigned long                       req_clk_rate[CAM_SFE_TOP_IN_PORT_MAX];
+	uint32_t                            last_bw_counter;
+	uint32_t                            last_clk_counter;
+	uint64_t                            total_bw_applied;
+	struct cam_axi_vote                 agg_incoming_vote;
+	struct cam_axi_vote                 req_axi_vote[CAM_SFE_TOP_IN_PORT_MAX];
+	struct cam_axi_vote                 last_bw_vote[CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ];
+	uint64_t                            last_total_bw_vote[CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ];
+	unsigned long                       last_clk_vote[CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ];
+	enum cam_clk_bw_state               clk_state;
+	enum cam_clk_bw_state               bw_state;
+	enum cam_isp_bw_control_action      axi_vote_control[CAM_SFE_TOP_IN_PORT_MAX];
+	struct cam_axi_vote                 applied_axi_vote;
+	struct cam_sfe_core_cfg             core_cfg;
+	uint32_t                            sfe_debug_cfg;
+	uint32_t                            sensor_sel_diag_cfg;
+	struct cam_sfe_top_perf_counter_cfg perf_counters[CAM_SFE_PERF_COUNTER_MAX];
+	uint32_t                            cc_testbus_sel_cfg;
+	int                                 error_irq_handle;
+	uint16_t                            reserve_cnt;
+	uint16_t                            start_stop_cnt;
+	void                               *priv_per_stream;
+	spinlock_t                          spin_lock;
+	cam_hw_mgr_event_cb_func            event_cb;
+	struct cam_sfe_wr_client_desc      *wr_client_desc;
+	struct cam_sfe_top_hw_info         *hw_info;
+	uint32_t                            num_clc_module;
+	struct cam_sfe_top_debug_info     (*clc_dbg_mod_info)[CAM_SFE_TOP_DBG_REG_MAX][8];
+	bool                                skip_clk_data_rst;
+};
+
+struct cam_sfe_path_data {
+	void __iomem                             *mem_base;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_sfe_top_priv                  *top_priv;
+	struct cam_sfe_top_common_reg_offset     *common_reg;
+	struct cam_sfe_top_common_reg_data       *common_reg_data;
+	struct cam_sfe_modules_common_reg_offset *modules_reg;
+	struct cam_sfe_path_common_reg_data      *path_reg_data;
+	struct cam_hw_soc_info                   *soc_info;
+	uint32_t                                  min_hblank_cnt;
+	int                                       sof_eof_handle;
+};
+
+static int cam_sfe_top_apply_clock_start_stop(struct cam_sfe_top_priv *top_priv);
+
+static int cam_sfe_top_apply_bw_start_stop(struct cam_sfe_top_priv *top_priv);
+
+static void cam_sfe_top_print_ipp_violation_info(struct cam_sfe_top_priv *top_priv,
+	uint32_t violation_status);
+
+static const char *cam_sfe_top_clk_bw_state_to_string(uint32_t state)
+{
+	switch (state) {
+	case CAM_CLK_BW_STATE_UNCHANGED:
+		return "UNCHANGED";
+	case CAM_CLK_BW_STATE_INCREASE:
+		return "INCREASE";
+	case CAM_CLK_BW_STATE_DECREASE:
+		return "DECREASE";
+	default:
+		return "Invalid State";
+	}
+}
+
+static int cam_sfe_top_set_axi_bw_vote(
+	struct cam_sfe_top_priv *top_priv,
+	struct cam_axi_vote *final_bw_vote, uint64_t total_bw_new_vote, bool start_stop,
+	uint64_t request_id)
+{
+	int rc = 0;
+	struct cam_hw_soc_info        *soc_info = NULL;
+	struct cam_sfe_soc_private    *soc_private = NULL;
+	int i, j;
+
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = (struct cam_sfe_soc_private *)soc_info->soc_private;
+
+	CAM_DBG(CAM_PERF, "SFE:%d Sending final BW to cpas bw_state:%s bw_vote:%llu req_id:%ld",
+		top_priv->common_data.hw_intf->hw_idx,
+		cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+		total_bw_new_vote, (start_stop ? -1 : request_id));
+	rc = cam_cpas_update_axi_vote(soc_private->cpas_handle,
+		final_bw_vote);
+	if (!rc) {
+		memcpy(&top_priv->applied_axi_vote,
+			final_bw_vote,
+			sizeof(struct cam_axi_vote));
+		top_priv->total_bw_applied = total_bw_new_vote;
+	} else {
+		CAM_ERR(CAM_PERF, "BW request failed, rc=%d", rc);
+		for (i = 0; i < final_bw_vote->num_paths; i++) {
+			CAM_INFO(CAM_PERF,
+				"sfe[%d] : Applied BW Vote : [%s][%s][%s] [%llu %llu %llu]",
+				top_priv->common_data.hw_intf->hw_idx,
+				cam_cpas_axi_util_path_type_to_string(
+				final_bw_vote->axi_path[i].path_data_type),
+				cam_cpas_axi_util_trans_type_to_string(
+				final_bw_vote->axi_path[i].transac_type),
+				cam_cpas_axi_util_drv_vote_lvl_to_string(
+				final_bw_vote->axi_path[i].vote_level),
+				final_bw_vote->axi_path[i].camnoc_bw,
+				final_bw_vote->axi_path[i].mnoc_ab_bw,
+				final_bw_vote->axi_path[i].mnoc_ib_bw);
+		}
+
+		for (i = 0; i < CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ; i++) {
+			for (j = 0; j < top_priv->last_bw_vote[i].num_paths; j++) {
+				CAM_INFO(CAM_PERF,
+					"sfe[%d] : History[%d] BW Vote : [%s][%s] [%s] [%llu %llu %llu]",
+					top_priv->common_data.hw_intf->hw_idx, i,
+					cam_cpas_axi_util_path_type_to_string(
+					top_priv->last_bw_vote[i].axi_path[j].path_data_type),
+					cam_cpas_axi_util_trans_type_to_string(
+					top_priv->last_bw_vote[i].axi_path[j].transac_type),
+					cam_cpas_axi_util_drv_vote_lvl_to_string(
+					top_priv->last_bw_vote[i].axi_path[j].vote_level),
+					top_priv->last_bw_vote[i].axi_path[j].camnoc_bw,
+					top_priv->last_bw_vote[i].axi_path[j].mnoc_ab_bw,
+					top_priv->last_bw_vote[i].axi_path[j].mnoc_ib_bw);
+			}
+		}
+
+	}
+
+	return rc;
+
+}
+
+static int cam_sfe_top_set_hw_clk_rate(struct cam_sfe_top_priv *top_priv,
+	unsigned long final_clk_rate, bool start_stop, uint64_t request_id, bool is_drv_config_en)
+{
+	struct cam_hw_soc_info        *soc_info = NULL;
+	struct cam_sfe_soc_private    *soc_private = NULL;
+	struct cam_ahb_vote            ahb_vote;
+	int rc = 0, clk_lvl = -1;
+	unsigned long cesta_clk_rate_high, cesta_clk_rate_low;
+	int cesta_client_idx = -1;
+	uint32_t lowest_clk_lvl;
+
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = (struct cam_sfe_soc_private *)soc_info->soc_private;
+
+	lowest_clk_lvl = soc_info->lowest_clk_level;
+	cesta_clk_rate_high = final_clk_rate;
+	cesta_clk_rate_low = final_clk_rate;
+
+	if (soc_info->is_clk_drv_en) {
+		cesta_client_idx = top_priv->common_data.hw_intf->hw_idx;
+		if (is_drv_config_en)
+			cesta_clk_rate_low =
+				soc_info->clk_rate[lowest_clk_lvl][soc_info->src_clk_idx];
+		else
+			cesta_clk_rate_low = final_clk_rate;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"Applying SFE:%d Clock name=%s idx=%d cesta_client_idx:%d req clk[high low]=[%lu %lu] req_id=%ld",
+		top_priv->common_data.hw_intf->hw_idx, soc_info->clk_name[soc_info->src_clk_idx],
+		soc_info->src_clk_idx, cesta_client_idx, cesta_clk_rate_high, cesta_clk_rate_low,
+		(start_stop ? -1 : request_id));
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, cesta_client_idx, cesta_clk_rate_high,
+		cesta_clk_rate_low);
+	if (!rc) {
+		top_priv->applied_clk_rate = cesta_clk_rate_high;
+		rc = cam_soc_util_get_clk_level(soc_info, cesta_clk_rate_low,
+			soc_info->src_clk_idx, &clk_lvl);
+		if (rc) {
+			CAM_WARN(CAM_ISP,
+				"Failed to get clk level for %s with clk_rate %lu src_idx %d rc %d",
+				soc_info->dev_name, cesta_clk_rate_high,
+				soc_info->src_clk_idx, rc);
+			rc = 0;
+			goto end;
+		}
+
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = clk_lvl;
+		cam_cpas_update_ahb_vote(soc_private->cpas_handle, &ahb_vote);
+	} else {
+		CAM_ERR(CAM_ISP,
+			"SFE:%d cesta_client_idx:%d Failed to set the req clk rate[high low]: [%llu %llu] rc:%d",
+			top_priv->common_data.hw_intf->hw_idx, cesta_client_idx,
+			cesta_clk_rate_high, cesta_clk_rate_low, rc);
+	}
+
+end:
+	return rc;
+}
+
+static void cam_sfe_top_check_module_status(
+	uint32_t num_reg, uint32_t *reg_val,
+	struct cam_sfe_top_debug_info (*status_list)[CAM_SFE_TOP_DBG_REG_MAX][8])
+{
+	bool found = false;
+	uint32_t i, j, val = 0;
+	size_t len = 0;
+	uint8_t log_buf[1024];
+
+	if (!status_list)
+		return;
+
+	for (i = 0; i < num_reg; i++) {
+		/* Check for ideal values */
+		if ((reg_val[i] == 0) || (reg_val[i] == 0x55555555))
+			continue;
+
+		for (j = 0; j < 8; j++) {
+			val = reg_val[i] >> (*status_list)[i][j].shift;
+			val &= 0xF;
+			if (val == 0 || val == 5)
+				continue;
+
+			CAM_INFO_BUF(CAM_SFE, log_buf, 1024, &len, "%s [I:%u V:%u R:%u]",
+				(*status_list)[i][j].clc_name,
+				((val >> 2) & 1), ((val >> 1) & 1), (val & 1));
+			found = true;
+		}
+		if (found)
+			CAM_INFO_RATE_LIMIT(CAM_SFE, "Check config for Debug%u - %s",
+				i, log_buf);
+		len = 0;
+		found = false;
+	}
+}
+
+static void cam_sfe_top_print_cc_test_bus(
+	struct cam_sfe_top_priv *top_priv)
+{
+	struct cam_sfe_top_common_data     *common_data = &top_priv->common_data;
+	struct cam_hw_soc_info             *soc_info = common_data->soc_info;
+	void __iomem                       *mem_base =
+		soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base;
+	struct cam_sfe_top_cc_testbus_info *testbus_info;
+	uint32_t dbg_testbus_reg = common_data->common_reg->top_debug_testbus_reg;
+	uint32_t size = 0, reg_val = 0, val = 0, i = 0;
+	size_t   len = 0;
+	uint8_t  log_buf[1024] = {0};
+
+	reg_val =  cam_io_r(mem_base +
+		common_data->common_reg->top_debug[dbg_testbus_reg]);
+
+	for (i = 0; i < top_priv->hw_info->num_of_testbus; i++) {
+		if (top_priv->cc_testbus_sel_cfg ==
+			top_priv->hw_info->test_bus_info[i].value) {
+			size = top_priv->hw_info->test_bus_info[i].size;
+			testbus_info =
+				top_priv->hw_info->test_bus_info[i].testbus;
+			break;
+		}
+	}
+
+	if (i == top_priv->hw_info->num_of_testbus) {
+		CAM_WARN(CAM_SFE,
+			"Unexpected value[%d] is programed in test_bus_ctrl reg",
+			top_priv->cc_testbus_sel_cfg);
+		return;
+	}
+
+	for (i = 0; i < size; i++) {
+		val = reg_val >> testbus_info[i].shift;
+		val &= testbus_info[i].mask;
+		if (val)
+			CAM_INFO_BUF(CAM_SFE, log_buf, 1024, &len, "%s [val:%u]",
+				 testbus_info[i].clc_name, val);
+	}
+
+	CAM_INFO(CAM_SFE, "SFE_TOP_DEBUG_%d val %d  config %s",
+		common_data->common_reg->top_debug_testbus_reg,
+		reg_val, log_buf);
+}
+
+static void cam_sfe_top_dump_perf_counters(
+	const char *event,
+	const char *res_name,
+	struct cam_sfe_top_priv *top_priv)
+{
+	int i;
+	void __iomem                         *mem_base;
+	struct cam_sfe_top_common_data       *common_data;
+	struct cam_hw_soc_info               *soc_info;
+	struct cam_sfe_top_common_reg_offset *common_reg;
+
+	common_data = &top_priv->common_data;
+	common_reg = common_data->common_reg;
+	soc_info = common_data->soc_info;
+	mem_base = soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base;
+
+	for (i = 0; i < top_priv->common_data.common_reg->num_perf_counters; i++) {
+		if (top_priv->perf_counters[i].dump_counter) {
+			CAM_INFO(CAM_SFE,
+				"SFE [%u] on %s %s counter: %d pixel_cnt: %d line_cnt: %d stall_cnt: %d always_cnt: %d status: 0x%x",
+				common_data->hw_intf->hw_idx, res_name, event, (i + 1),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_pix_count),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_line_count),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_stall_count),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_always_count),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_count_status));
+		}
+	}
+}
+
+static void cam_sfe_top_print_debug_reg_info(
+	struct cam_sfe_top_priv *top_priv)
+{
+	void __iomem                    *mem_base;
+	struct cam_sfe_top_common_data  *common_data;
+	struct cam_hw_soc_info          *soc_info;
+	uint32_t                        *reg_val = NULL;
+	uint32_t num_reg = 0;
+	int i = 0, j;
+
+	common_data = &top_priv->common_data;
+	soc_info = common_data->soc_info;
+	num_reg = common_data->common_reg->num_debug_registers;
+	mem_base = soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base;
+	reg_val    = kcalloc(num_reg, sizeof(uint32_t), GFP_KERNEL);
+	if (!reg_val)
+		return;
+
+	while (i < num_reg) {
+		for (j = 0; j < 4 && i < num_reg; j++, i++) {
+			reg_val[i] = cam_io_r(mem_base +
+				common_data->common_reg->top_debug[i]);
+		}
+		CAM_INFO(CAM_SFE, "Debug%u: 0x%x Debug%u: 0x%x Debug%u: 0x%x Debug%u: 0x%x",
+			(i - 4), reg_val[i - 4], (i - 3), reg_val[i - 3],
+			(i - 2), reg_val[i - 2], (i - 1), reg_val[i - 1]);
+	}
+
+	cam_sfe_top_check_module_status(top_priv->num_clc_module,
+		reg_val, top_priv->clc_dbg_mod_info);
+
+	if (common_data->common_reg->top_cc_test_bus_supported &&
+		top_priv->cc_testbus_sel_cfg)
+		cam_sfe_top_print_cc_test_bus(top_priv);
+
+	kfree(reg_val);
+
+	cam_sfe_top_dump_perf_counters("ERROR", "", top_priv);
+}
+
+static struct cam_axi_vote *cam_sfe_top_delay_bw_reduction(
+	struct cam_sfe_top_priv *top_priv,
+	uint64_t *to_be_applied_bw)
+{
+	uint32_t i;
+	int vote_idx = -1;
+	uint64_t max_bw = 0;
+
+	for (i = 0; i < CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ; i++) {
+		if (top_priv->last_total_bw_vote[i] >= max_bw) {
+			vote_idx = i;
+			max_bw = top_priv->last_total_bw_vote[i];
+		}
+	}
+
+	*to_be_applied_bw = max_bw;
+
+	return &top_priv->last_bw_vote[vote_idx];
+}
+
+int cam_sfe_top_calc_axi_bw_vote(struct cam_sfe_top_priv *top_priv,
+	bool start_stop, struct cam_axi_vote **to_be_applied_axi_vote,
+	uint64_t *total_bw_new_vote, uint64_t request_id)
+{
+	int rc = 0;
+	uint32_t i;
+	uint32_t num_paths = 0;
+	bool bw_unchanged = true;
+	struct cam_axi_vote *final_bw_vote = NULL;
+
+	if (top_priv->num_in_ports > CAM_SFE_TOP_IN_PORT_MAX) {
+		CAM_ERR(CAM_SFE, "Invalid number of ports %d, max %d",
+			top_priv->num_in_ports, CAM_SFE_TOP_IN_PORT_MAX);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	memset(&top_priv->agg_incoming_vote, 0, sizeof(struct cam_axi_vote));
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->axi_vote_control[i] ==
+			CAM_ISP_BW_CONTROL_INCLUDE) {
+			if (num_paths +
+				top_priv->req_axi_vote[i].num_paths >
+				CAM_CPAS_MAX_PATHS_PER_CLIENT) {
+				CAM_ERR(CAM_PERF,
+					"Required paths(%d) more than max(%d)",
+					num_paths +
+					top_priv->req_axi_vote[i].num_paths,
+					CAM_CPAS_MAX_PATHS_PER_CLIENT);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			memcpy(&top_priv->agg_incoming_vote.axi_path[num_paths],
+				&top_priv->req_axi_vote[i].axi_path[0],
+				top_priv->req_axi_vote[i].num_paths *
+				sizeof(
+				struct cam_cpas_axi_per_path_bw_vote));
+			num_paths += top_priv->req_axi_vote[i].num_paths;
+		}
+	}
+
+	top_priv->agg_incoming_vote.num_paths = num_paths;
+
+	for (i = 0; i < top_priv->agg_incoming_vote.num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"sfe[%d] : New BW Vote : counter[%d] [%s][%s][%s] [%llu %llu %llu]",
+			top_priv->common_data.hw_intf->hw_idx,
+			top_priv->last_bw_counter,
+			cam_cpas_axi_util_path_type_to_string(
+			top_priv->agg_incoming_vote.axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			top_priv->agg_incoming_vote.axi_path[i].transac_type),
+			cam_cpas_axi_util_drv_vote_lvl_to_string(
+			top_priv->agg_incoming_vote.axi_path[i].vote_level),
+			top_priv->agg_incoming_vote.axi_path[i].camnoc_bw,
+			top_priv->agg_incoming_vote.axi_path[i].mnoc_ab_bw,
+			top_priv->agg_incoming_vote.axi_path[i].mnoc_ib_bw);
+
+		*total_bw_new_vote += top_priv->agg_incoming_vote.axi_path[i].camnoc_bw;
+	}
+
+	memcpy(&top_priv->last_bw_vote[top_priv->last_bw_counter], &top_priv->agg_incoming_vote,
+		sizeof(struct cam_axi_vote));
+	top_priv->last_total_bw_vote[top_priv->last_bw_counter] = *total_bw_new_vote;
+	top_priv->last_bw_counter = (top_priv->last_bw_counter + 1) %
+		CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ;
+
+	if (*total_bw_new_vote != top_priv->total_bw_applied)
+		bw_unchanged = false;
+
+	CAM_DBG(CAM_PERF,
+		"applied_total=%lld, new_total=%lld unchanged=%d, start_stop=%d req_id=%ld",
+		top_priv->total_bw_applied,
+		*total_bw_new_vote, bw_unchanged, start_stop, (start_stop ? -1 : request_id));
+
+	if (bw_unchanged) {
+		CAM_DBG(CAM_PERF, "BW config unchanged");
+		*to_be_applied_axi_vote = NULL;
+		top_priv->bw_state = CAM_CLK_BW_STATE_UNCHANGED;
+		goto end;
+	}
+
+	if (start_stop) {
+		/* need to vote current request immediately */
+		final_bw_vote = &top_priv->agg_incoming_vote;
+		/* Reset everything, we can start afresh */
+		memset(top_priv->last_bw_vote, 0, sizeof(struct cam_axi_vote) *
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ);
+		memset(top_priv->last_total_bw_vote, 0, sizeof(uint64_t) *
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ);
+		top_priv->last_bw_counter = 0;
+		top_priv->last_bw_vote[top_priv->last_bw_counter] = top_priv->agg_incoming_vote;
+		top_priv->last_total_bw_vote[top_priv->last_bw_counter] = *total_bw_new_vote;
+		top_priv->last_bw_counter = (top_priv->last_bw_counter + 1) %
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ;
+	} else {
+		/*
+		 * Find max bw request in last few frames. This will be the bw
+		 * that we want to vote to CPAS now.
+		 */
+		final_bw_vote = cam_sfe_top_delay_bw_reduction(top_priv, total_bw_new_vote);
+		if (*total_bw_new_vote == 0)
+			CAM_DBG(CAM_PERF, "to_be_applied_axi_vote is 0, req_id:%llu", request_id);
+	}
+
+	for (i = 0; i < final_bw_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"sfe[%d] : Apply BW Vote : [%s][%s][%s] [%llu %llu %llu]",
+			top_priv->common_data.hw_intf->hw_idx,
+			cam_cpas_axi_util_path_type_to_string(
+			final_bw_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			final_bw_vote->axi_path[i].transac_type),
+			cam_cpas_axi_util_drv_vote_lvl_to_string(
+			final_bw_vote->axi_path[i].vote_level),
+			final_bw_vote->axi_path[i].camnoc_bw,
+			final_bw_vote->axi_path[i].mnoc_ab_bw,
+			final_bw_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	if (*total_bw_new_vote == top_priv->total_bw_applied) {
+		CAM_DBG(CAM_PERF, "SFE:%d Final BW Unchanged after delay",
+			top_priv->common_data.hw_intf->hw_idx);
+		top_priv->bw_state = CAM_CLK_BW_STATE_UNCHANGED;
+		*to_be_applied_axi_vote = NULL;
+		goto end;
+	} else if (*total_bw_new_vote > top_priv->total_bw_applied) {
+		top_priv->bw_state = CAM_CLK_BW_STATE_INCREASE;
+	} else {
+		top_priv->bw_state = CAM_CLK_BW_STATE_DECREASE;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"sfe[%d] : Delayed update: applied_total=%lld new_total=%lld, start_stop=%d bw_state=%s req_id=%ld",
+		top_priv->common_data.hw_intf->hw_idx, top_priv->total_bw_applied,
+		*total_bw_new_vote, start_stop,
+		cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+		(start_stop ? -1 : request_id));
+
+	*to_be_applied_axi_vote = final_bw_vote;
+
+end:
+	return rc;
+}
+
+int cam_sfe_top_bw_update(struct cam_sfe_soc_private *soc_private,
+	struct cam_sfe_top_priv *top_priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bw_update_args        *bw_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_update = (struct cam_sfe_bw_update_args *)cmd_args;
+	res = bw_update->node_res;
+
+	if (!res || !res->hw_intf || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+
+	if (res->res_type != CAM_ISP_RESOURCE_SFE_IN ||
+		res->res_id >= CAM_ISP_HW_SFE_IN_MAX) {
+		CAM_ERR(CAM_SFE, "SFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (top_priv->num_in_ports > CAM_SFE_TOP_IN_PORT_MAX) {
+		CAM_ERR(CAM_SFE, "Invalid number of ports %d, max %d",
+			top_priv->num_in_ports, CAM_SFE_TOP_IN_PORT_MAX);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			memcpy(&top_priv->req_axi_vote[i],
+				&bw_update->sfe_vote,
+				sizeof(struct cam_axi_vote));
+			top_priv->axi_vote_control[i] =
+				CAM_ISP_BW_CONTROL_INCLUDE;
+			break;
+		}
+	}
+
+	return rc;
+}
+
+int cam_sfe_top_bw_control(struct cam_sfe_soc_private *soc_private,
+	struct cam_sfe_top_priv *top_priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_bw_control_args       *bw_ctrl = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_ctrl = (struct cam_isp_bw_control_args *)cmd_args;
+	res = bw_ctrl->node_res;
+
+	if (!res || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_SFE_IN ||
+		res->res_id >= CAM_ISP_HW_SFE_IN_MAX) {
+		CAM_ERR(CAM_SFE, "SFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (top_priv->num_in_ports > CAM_SFE_TOP_IN_PORT_MAX) {
+		CAM_ERR(CAM_SFE, "Invalid number of ports %d, max %d",
+			top_priv->num_in_ports, CAM_SFE_TOP_IN_PORT_MAX);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			top_priv->axi_vote_control[i] = bw_ctrl->action;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE,
+			"SFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_sfe_top_apply_bw_start_stop(top_priv);
+	}
+
+	return rc;
+}
+
+static int cam_sfe_top_core_cfg(
+	struct cam_sfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_sfe_core_config_args *sfe_core_cfg = NULL;
+
+	if ((!cmd_args) ||
+		(arg_size != sizeof(struct cam_sfe_core_config_args))) {
+		CAM_ERR(CAM_SFE, "Invalid inputs");
+		return -EINVAL;
+	}
+
+	sfe_core_cfg = (struct cam_sfe_core_config_args *)cmd_args;
+	top_priv->core_cfg.mode_sel =
+		sfe_core_cfg->core_config.mode_sel;
+	top_priv->core_cfg.fs_mode_cfg =
+		sfe_core_cfg->core_config.fs_mode_cfg;
+	top_priv->core_cfg.ops_mode_cfg =
+		sfe_core_cfg->core_config.ops_mode_cfg;
+
+	return 0;
+}
+
+static inline void cam_sfe_top_delay_clk_reduction(
+	struct cam_sfe_top_priv *top_priv,
+	unsigned long *max_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ; i++) {
+		if (top_priv->last_clk_vote[i] > (*max_clk))
+			*max_clk = top_priv->last_clk_vote[i];
+	}
+}
+
+int cam_sfe_top_calc_hw_clk_rate(
+	struct cam_sfe_top_priv *top_priv, bool start_stop,
+	unsigned long *final_clk_rate, uint64_t request_id)
+{
+	int                            i, rc = 0;
+	unsigned long                  max_req_clk_rate = 0;
+
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->req_clk_rate[i] > max_req_clk_rate)
+			max_req_clk_rate = top_priv->req_clk_rate[i];
+	}
+
+	if (start_stop && !top_priv->skip_clk_data_rst) {
+		/* need to vote current clk immediately */
+		*final_clk_rate = max_req_clk_rate;
+		/* Reset everything, we can start afresh */
+		memset(top_priv->last_clk_vote, 0, sizeof(uint64_t) *
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ);
+		top_priv->last_clk_counter = 0;
+		top_priv->last_clk_vote[top_priv->last_clk_counter] = max_req_clk_rate;
+		top_priv->last_clk_counter = (top_priv->last_clk_counter + 1) %
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ;
+	} else {
+		top_priv->last_clk_vote[top_priv->last_clk_counter] = max_req_clk_rate;
+		top_priv->last_clk_counter = (top_priv->last_clk_counter + 1) %
+				CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ;
+
+		/* Find max clk request in last few requests */
+		cam_sfe_top_delay_clk_reduction(top_priv, final_clk_rate);
+		if (!(*final_clk_rate)) {
+			CAM_ERR(CAM_PERF, "Final clock rate is zero");
+			return -EINVAL;
+		}
+	}
+
+	if (*final_clk_rate == top_priv->applied_clk_rate)
+		top_priv->clk_state = CAM_CLK_BW_STATE_UNCHANGED;
+	else if (*final_clk_rate > top_priv->applied_clk_rate)
+		top_priv->clk_state = CAM_CLK_BW_STATE_INCREASE;
+	else
+		top_priv->clk_state = CAM_CLK_BW_STATE_DECREASE;
+
+	CAM_DBG(CAM_PERF, "SFE:%d Clock state:%s hw_clk_rate:%llu req_id:%ld",
+			top_priv->common_data.hw_intf->hw_idx,
+		cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state),
+		top_priv->applied_clk_rate, (start_stop ? -1 : request_id));
+
+	return rc;
+}
+
+
+static int cam_sfe_top_get_base(
+	struct cam_sfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_sfe_soc_private       *soc_private;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_SFE, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	soc_private = top_priv->common_data.soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "soc_private is null");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_SFE, "buf size: %d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(
+		top_priv->common_data.soc_info,
+		SFE_CORE_BASE_IDX);
+	if (mem_base == -1) {
+		CAM_ERR(CAM_SFE, "failed to get mem_base, index: %d num_reg_map: %u",
+				SFE_CORE_BASE_IDX, top_priv->common_data.soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	if (cdm_args->cdm_id == CAM_CDM_RT) {
+		if (!soc_private->rt_wrapper_base) {
+			CAM_ERR(CAM_ISP, "rt_wrapper_base_addr is null");
+			return -EINVAL;
+		}
+		mem_base -= soc_private->rt_wrapper_base;
+	}
+
+	CAM_DBG(CAM_SFE, "core %d mem_base 0x%x, CDM Id: %d",
+		top_priv->common_data.soc_info->index, mem_base,
+		cdm_args->cdm_id);
+
+	cdm_util_ops->cdm_write_changebase(cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_sfe_top_clock_update(
+	struct cam_sfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_sfe_clock_update_args     *clk_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	int i;
+
+	if (arg_size != sizeof(struct cam_sfe_clock_update_args)) {
+		CAM_ERR(CAM_SFE, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	clk_update =
+		(struct cam_sfe_clock_update_args *)cmd_args;
+	if (!clk_update || !clk_update->node_res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	res = clk_update->node_res;
+
+	if (!res || !res->hw_intf->hw_priv) {
+		CAM_ERR(CAM_PERF, "Invalid inputs");
+		return -EINVAL;
+	}
+
+
+	if (res->res_type != CAM_ISP_RESOURCE_SFE_IN ||
+		res->res_id >= CAM_ISP_HW_SFE_IN_MAX) {
+		CAM_ERR(CAM_PERF,
+			"SFE: %d Invalid res_type: %d res_id: %d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			top_priv->req_clk_rate[i] = clk_update->clk_rate;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_sfe_set_top_debug(
+	struct cam_sfe_top_priv *top_priv,
+	void *cmd_args)
+{
+	int i;
+	uint32_t max_counters = top_priv->common_data.common_reg->num_perf_counters;
+	struct cam_sfe_debug_cfg_params *debug_cfg;
+
+	debug_cfg = (struct cam_sfe_debug_cfg_params *)cmd_args;
+	if (!debug_cfg->cache_config) {
+		top_priv->sfe_debug_cfg = debug_cfg->u.dbg_cfg.sfe_debug_cfg;
+		top_priv->sensor_sel_diag_cfg = debug_cfg->u.dbg_cfg.sfe_sensor_sel;
+
+		if (debug_cfg->u.dbg_cfg.num_counters <= max_counters)
+			for (i = 0; i < max_counters; i++)
+				top_priv->perf_counters[i].perf_counter_val =
+					debug_cfg->u.dbg_cfg.sfe_perf_counter_val[i];
+	}
+
+	return 0;
+}
+
+static int cam_sfe_top_handle_overflow(
+	struct cam_sfe_top_priv *top_priv, void *cmd_args)
+{
+	struct cam_sfe_top_common_data      *common_data;
+	struct cam_hw_soc_info              *soc_info;
+	uint32_t                             bus_overflow_status, violation_status, tmp;
+	uint32_t                             i = 0;
+	struct cam_isp_hw_overflow_info     *overflow_info = NULL;
+
+	overflow_info = (struct cam_isp_hw_overflow_info *)cmd_args;
+	common_data = &top_priv->common_data;
+	soc_info = common_data->soc_info;
+
+	bus_overflow_status = cam_io_r(soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base +
+		top_priv->common_data.common_reg->bus_overflow_status);
+	violation_status = cam_io_r(soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base +
+		top_priv->common_data.common_reg->ipp_violation_status);
+
+	CAM_ERR(CAM_ISP,
+		"SFE%d src_clk_rate sw_client:%lu hw_client:[%lu %lu] bus_overflow_status:%s violation: %s",
+		soc_info->index, soc_info->applied_src_clk_rates.sw_client,
+		soc_info->applied_src_clk_rates.hw_client[soc_info->index].high,
+		soc_info->applied_src_clk_rates.hw_client[soc_info->index].low,
+		CAM_BOOL_TO_YESNO(bus_overflow_status), CAM_BOOL_TO_YESNO(violation_status));
+
+	tmp = bus_overflow_status;
+	while (tmp) {
+		if (tmp & 0x1)
+			CAM_ERR(CAM_ISP, "SFE Bus Overflow %s ",
+				top_priv->wr_client_desc[i].desc);
+		tmp = tmp >> 1;
+		i++;
+	}
+
+	if (violation_status)
+		cam_sfe_top_print_ipp_violation_info(top_priv, violation_status);
+	cam_sfe_top_print_debug_reg_info(top_priv);
+
+	if (bus_overflow_status) {
+		cam_cpas_log_votes(false);
+		overflow_info->is_bus_overflow = true;
+	}
+
+	return 0;
+}
+
+static int cam_sfe_top_apply_clk_bw_update(struct cam_sfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                   *hw_info = NULL;
+	struct cam_hw_intf                   *hw_intf = NULL;
+	struct cam_axi_vote *to_be_applied_axi_vote = NULL;
+	struct cam_isp_apply_clk_bw_args *clk_bw_args = NULL;
+	unsigned long                         final_clk_rate = 0;
+	uint64_t                              total_bw_new_vote = 0;
+	uint64_t                              request_id;
+	int rc = 0;
+
+	if (arg_size != sizeof(struct cam_isp_apply_clk_bw_args)) {
+		CAM_ERR(CAM_SFE, "Invalid arg size: %u", arg_size);
+		return -EINVAL;
+	}
+
+	clk_bw_args = (struct cam_isp_apply_clk_bw_args *)cmd_args;
+	request_id = clk_bw_args->request_id;
+	hw_intf = clk_bw_args->hw_intf;
+	if (!hw_intf) {
+		CAM_ERR(CAM_SFE, "Invalid hw_intf");
+		return -EINVAL;
+	}
+
+	hw_info = hw_intf->hw_priv;
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_DBG(CAM_PERF,
+			"SFE:%d Not ready to set clocks yet :%d",
+			hw_intf->hw_idx, hw_info->hw_state);
+		goto end;
+	}
+
+	if (clk_bw_args->skip_clk_data_rst) {
+		top_priv->skip_clk_data_rst = true;
+		CAM_DBG(CAM_SFE, "SFE:%u requested to avoid clk data rst",
+			hw_intf->hw_idx);
+		return 0;
+	}
+
+	rc = cam_sfe_top_calc_hw_clk_rate(top_priv, false, &final_clk_rate, request_id);
+	if (rc) {
+		CAM_ERR(CAM_SFE,
+			"SFE:%d Failed in calculating clock rate rc=%d",
+			hw_intf->hw_idx, rc);
+		goto end;
+	}
+
+	rc = cam_sfe_top_calc_axi_bw_vote(top_priv, false,
+		&to_be_applied_axi_vote, &total_bw_new_vote, request_id);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE:%d Failed in calculating bw vote rc=%d",
+			hw_intf->hw_idx, rc);
+		goto end;
+	}
+
+	if ((!to_be_applied_axi_vote) && (top_priv->bw_state != CAM_CLK_BW_STATE_UNCHANGED)) {
+		CAM_ERR(CAM_PERF, "SFE:%d Invalid BW vote for state:%s", hw_intf->hw_idx,
+			cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state));
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"SFE:%d APPLY CLK/BW req_id:%ld clk_state:%s bw_state:%s is_drv_config_en:%s",
+		hw_intf->hw_idx, request_id,
+		cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state),
+		cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+		CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+
+	/* Determine BW and clock voting sequence according to state */
+	if ((top_priv->clk_state == CAM_CLK_BW_STATE_UNCHANGED) &&
+		(top_priv->bw_state == CAM_CLK_BW_STATE_UNCHANGED)) {
+		goto end;
+	} else if (top_priv->clk_state == CAM_CLK_BW_STATE_UNCHANGED) {
+		rc = cam_sfe_top_set_axi_bw_vote(top_priv, to_be_applied_axi_vote,
+			total_bw_new_vote, false, request_id);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d Failed in voting final bw:%llu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, total_bw_new_vote,
+				cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state),
+				cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+	} else if (top_priv->bw_state == CAM_CLK_BW_STATE_UNCHANGED) {
+		rc = cam_sfe_top_set_hw_clk_rate(top_priv, final_clk_rate, false, request_id,
+			clk_bw_args->is_drv_config_en);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d Failed in voting final clk:%lu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, final_clk_rate,
+				cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state),
+				cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+	} else if (top_priv->clk_state == CAM_CLK_BW_STATE_INCREASE) {
+		/* Set BW first, followed by Clock */
+		rc = cam_sfe_top_set_axi_bw_vote(top_priv, to_be_applied_axi_vote,
+			total_bw_new_vote, false, request_id);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d Failed in voting final bw:%llu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, total_bw_new_vote,
+				cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state),
+				cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+
+		rc = cam_sfe_top_set_hw_clk_rate(top_priv, final_clk_rate, false, request_id,
+			clk_bw_args->is_drv_config_en);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d Failed in voting final clk:%lu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, final_clk_rate,
+				cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state),
+				cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+	} else if (top_priv->clk_state == CAM_CLK_BW_STATE_DECREASE) {
+		/* Set Clock first, followed by BW */
+		rc = cam_sfe_top_set_hw_clk_rate(top_priv, final_clk_rate, false, request_id,
+			clk_bw_args->is_drv_config_en);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d Failed in voting final clk:%lu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, final_clk_rate,
+				cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state),
+				cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+
+		rc = cam_sfe_top_set_axi_bw_vote(top_priv, to_be_applied_axi_vote,
+			total_bw_new_vote, false, request_id);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d Failed in voting final bw:%llu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, total_bw_new_vote,
+				cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state),
+				cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+	} else {
+		CAM_ERR(CAM_SFE,
+			"Invalid state to apply CLK/BW clk_state:%s bw_state:%s is_drv_config_en:%s",
+			cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state),
+			cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state),
+			CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (top_priv->clk_state != CAM_CLK_BW_STATE_UNCHANGED)
+		clk_bw_args->clock_updated = true;
+
+end:
+	top_priv->clk_state = CAM_CLK_BW_STATE_INIT;
+	top_priv->bw_state = CAM_CLK_BW_STATE_INIT;
+	return rc;
+}
+
+static int cam_sfe_top_apply_clock_start_stop(struct cam_sfe_top_priv *top_priv)
+{
+	int rc = 0;
+	unsigned long final_clk_rate = 0;
+
+	rc = cam_sfe_top_calc_hw_clk_rate(top_priv, true, &final_clk_rate, 0);
+	if (rc) {
+		CAM_ERR(CAM_SFE,
+			"SFE:%d Failed in calculating clock rate rc=%d",
+			top_priv->common_data.hw_intf->hw_idx, rc);
+		goto end;
+	}
+
+	if (top_priv->clk_state == CAM_CLK_BW_STATE_UNCHANGED)
+		goto end;
+
+	rc = cam_sfe_top_set_hw_clk_rate(top_priv, final_clk_rate, true, 0, false);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE:%d Failed in voting final clk:%lu clk_state:%s",
+			top_priv->common_data.hw_intf->hw_idx, final_clk_rate,
+			cam_sfe_top_clk_bw_state_to_string(top_priv->clk_state));
+		goto end;
+	}
+
+end:
+	top_priv->clk_state = CAM_CLK_BW_STATE_INIT;
+	top_priv->skip_clk_data_rst = false;
+	return rc;
+}
+
+static int cam_sfe_top_apply_bw_start_stop(struct cam_sfe_top_priv *top_priv)
+{
+	int rc = 0;
+	uint64_t total_bw_new_vote = 0;
+	struct cam_axi_vote *to_be_applied_axi_vote = NULL;
+
+	rc = cam_sfe_top_calc_axi_bw_vote(top_priv, true,
+		&to_be_applied_axi_vote, &total_bw_new_vote, 0);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE:%d Failed in calculating bw vote rc=%d",
+			top_priv->common_data.hw_intf->hw_idx, rc);
+		goto end;
+	}
+
+	if (top_priv->bw_state == CAM_CLK_BW_STATE_UNCHANGED)
+		goto end;
+
+	rc = cam_sfe_top_set_axi_bw_vote(top_priv, to_be_applied_axi_vote, total_bw_new_vote,
+		true, 0);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE:%d Failed in voting final bw:%llu bw_state:%s",
+			top_priv->common_data.hw_intf->hw_idx, total_bw_new_vote,
+			cam_sfe_top_clk_bw_state_to_string(top_priv->bw_state));
+		goto end;
+	}
+
+end:
+	top_priv->bw_state = CAM_CLK_BW_STATE_INIT;
+	return rc;
+}
+
+static int cam_sfe_top_apply_fcg_update(
+	struct cam_sfe_top_priv      *top_priv,
+	struct cam_isp_hw_fcg_update *fcg_update,
+	struct cam_cdm_utils_ops     *cdm_util_ops)
+{
+	struct cam_isp_fcg_config_internal          *fcg_config;
+	struct cam_isp_ch_ctx_fcg_config_internal   *fcg_ch_ctx;
+	struct cam_isp_predict_fcg_config_internal  *fcg_pr;
+	struct cam_sfe_top_hw_info                  *hw_info;
+	struct cam_sfe_fcg_module_info              *fcg_module_info;
+	uint32_t                                     size, fcg_index_shift;
+	uint32_t                                    *reg_val_pair;
+	uint32_t                                     num_regval_pairs = 0;
+	int                                          rc = 0, i, j = 0;
+
+	if (!top_priv || !fcg_update || (fcg_update->prediction_idx == 0)) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = top_priv->hw_info;
+	fcg_config = (struct cam_isp_fcg_config_internal *)fcg_update->data;
+	if (!fcg_config || !hw_info) {
+		CAM_ERR(CAM_SFE, "Invalid config params");
+		return -EINVAL;
+	}
+
+	fcg_module_info = hw_info->modules_hw_info->fcg_module_info;
+	if (!fcg_module_info) {
+		CAM_ERR(CAM_SFE, "Invalid FCG common data");
+		return -EINVAL;
+	}
+
+	if (fcg_config->num_ch_ctx > CAM_ISP_MAX_FCG_CH_CTXS) {
+		CAM_ERR(CAM_SFE, "out of bound %d",
+				fcg_config->num_ch_ctx);
+		return -EINVAL;
+	}
+
+	reg_val_pair = kcalloc(fcg_module_info->max_reg_val_pair_size, sizeof(uint32_t),
+		GFP_KERNEL);
+	if (!reg_val_pair) {
+		CAM_ERR(CAM_SFE, "Failed allocating memory for reg val pair");
+		return -ENOMEM;
+	}
+
+	fcg_index_shift = fcg_module_info->fcg_index_shift;
+
+	for (i = 0, j = 0; i < fcg_config->num_ch_ctx; i++) {
+		if (j >= fcg_module_info->max_reg_val_pair_size) {
+			CAM_ERR(CAM_SFE, "reg_val_pair %d exceeds the array limit %u",
+				j, fcg_module_info->max_reg_val_pair_size);
+			rc = -ENOMEM;
+			goto free_mem;
+		}
+
+		fcg_ch_ctx = &fcg_config->ch_ctx_fcg_configs[i];
+		if (!fcg_ch_ctx) {
+			CAM_ERR(CAM_SFE, "Failed in FCG channel/context dereference");
+			rc = -EINVAL;
+			goto free_mem;
+		}
+
+		fcg_pr = &fcg_ch_ctx->predicted_fcg_configs[
+			fcg_update->prediction_idx - 1];
+		if (fcg_ch_ctx->fcg_enable_mask & CAM_ISP_FCG_ENABLE_PHASE) {
+			switch (fcg_ch_ctx->fcg_ch_ctx_id) {
+			case CAM_ISP_FCG_MASK_CH1:
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_ch1_phase_index_cfg_0,
+					(fcg_pr->phase_index_r |
+					fcg_pr->phase_index_g << fcg_index_shift));
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_ch1_phase_index_cfg_1,
+					fcg_pr->phase_index_b);
+				CAM_DBG(CAM_SFE,
+					"Program FCG registers for SFE channel 0x%x, phase_index_cfg_0: %u, phase_index_cfg_1: %u",
+					fcg_ch_ctx->fcg_ch_ctx_id,
+					(fcg_pr->phase_index_r |
+					(fcg_pr->phase_index_g << fcg_index_shift)),
+					fcg_pr->phase_index_b);
+				break;
+			case CAM_ISP_FCG_MASK_CH2:
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_ch2_phase_index_cfg_0,
+					(fcg_pr->phase_index_r |
+					fcg_pr->phase_index_g << fcg_index_shift));
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_ch2_phase_index_cfg_1,
+					fcg_pr->phase_index_b);
+				CAM_DBG(CAM_SFE,
+					"Program FCG registers for SFE channel 0x%x, phase_index_cfg_0: %u, phase_index_cfg_1: %u",
+					fcg_ch_ctx->fcg_ch_ctx_id,
+					(fcg_pr->phase_index_r |
+					(fcg_pr->phase_index_g << fcg_index_shift)),
+					fcg_pr->phase_index_b);
+				break;
+			default:
+				CAM_ERR(CAM_SFE, "Unsupported channel id: 0x%x",
+					fcg_ch_ctx->fcg_ch_ctx_id);
+				rc = -EINVAL;
+				goto free_mem;
+			}
+		}
+
+		if (fcg_ch_ctx->fcg_enable_mask & CAM_ISP_FCG_ENABLE_STATS) {
+			switch (fcg_ch_ctx->fcg_ch_ctx_id) {
+			case CAM_ISP_FCG_MASK_CH1:
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_ch1_stats_phase_index_cfg_0,
+					(fcg_pr->stats_index_r |
+					fcg_pr->stats_index_g << fcg_index_shift));
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_ch1_stats_phase_index_cfg_1,
+					fcg_pr->stats_index_b);
+				CAM_DBG(CAM_SFE,
+					"Program FCG registers for SFE channel 0x%x, stats_index_cfg_0: %u, stats_index_cfg_1: %u",
+					fcg_ch_ctx->fcg_ch_ctx_id,
+					(fcg_pr->phase_index_r |
+					(fcg_pr->phase_index_g << fcg_index_shift)),
+					fcg_pr->phase_index_b);
+				break;
+			case CAM_ISP_FCG_MASK_CH2:
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_ch2_stats_phase_index_cfg_0,
+					(fcg_pr->stats_index_r |
+					fcg_pr->stats_index_g << fcg_index_shift));
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_ch2_stats_phase_index_cfg_1,
+					fcg_pr->stats_index_b);
+				CAM_DBG(CAM_SFE,
+					"Program FCG registers for SFE channel 0x%x, stats_index_cfg_0: %u, stats_index_cfg_1: %u",
+					fcg_ch_ctx->fcg_ch_ctx_id,
+					(fcg_pr->phase_index_r |
+					(fcg_pr->phase_index_g << fcg_index_shift)),
+					fcg_pr->phase_index_b);
+				break;
+			default:
+				CAM_ERR(CAM_SFE, "Unsupported channel id: 0x%x",
+					fcg_ch_ctx->fcg_ch_ctx_id);
+				rc = -EINVAL;
+				goto free_mem;
+			}
+		}
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		if ((size * 4) != fcg_update->cmd_size) {
+			CAM_ERR(CAM_SFE,
+				"Failed! Buf size:%d is wrong, expected size: %d",
+				fcg_update->cmd_size, size * 4);
+			rc = -ENOMEM;
+			goto free_mem;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			(uint32_t *)fcg_update->cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+	} else {
+		CAM_WARN(CAM_SFE, "No reg val pairs");
+	}
+
+free_mem:
+	kfree(reg_val_pair);
+	return rc;
+}
+
+static int cam_sfe_top_get_fcg_buf_size(
+	struct cam_sfe_top_priv         *top_priv,
+	struct cam_isp_hw_fcg_get_size  *fcg_get_size,
+	struct cam_cdm_utils_ops        *cdm_util_ops)
+{
+	struct cam_sfe_top_hw_info                  *hw_info;
+	struct cam_sfe_modules_common_reg_offset    *modules_hw_info;
+	uint32_t                                     num_types;
+
+	if (!top_priv) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = top_priv->hw_info;
+	if (!hw_info) {
+		CAM_ERR(CAM_SFE, "Invalid config params");
+		return -EINVAL;
+	}
+
+	modules_hw_info = hw_info->modules_hw_info;
+	if (!modules_hw_info) {
+		CAM_ERR(CAM_SFE, "Invalid modules hw info");
+		return -EINVAL;
+	}
+
+	if (!modules_hw_info->fcg_supported) {
+		fcg_get_size->fcg_supported = false;
+		CAM_DBG(CAM_SFE, "FCG is not supported by hardware");
+		return 0;
+	}
+
+	fcg_get_size->fcg_supported = true;
+	num_types = fcg_get_size->num_types;
+	if (num_types == 0) {
+		CAM_ERR(CAM_SFE, "Number of types(STATS/PHASE) requested is empty");
+		return -EINVAL;
+	}
+
+	fcg_get_size->kmd_size =
+		cdm_util_ops->cdm_required_size_reg_random(
+			num_types * modules_hw_info->fcg_module_info->fcg_type_size);
+	return 0;
+}
+
+static int cam_sfe_top_fcg_config(
+	struct cam_sfe_top_priv         *top_priv,
+	void                            *cmd_args,
+	uint32_t                         arg_size)
+{
+	struct cam_isp_hw_fcg_cmd       *fcg_cmd;
+	struct cam_cdm_utils_ops        *cdm_util_ops;
+	int rc;
+
+	if (arg_size != sizeof(struct cam_isp_hw_fcg_cmd)) {
+		CAM_ERR(CAM_SFE, "Invalid cmd size, arg_size: %u, expected size: %u",
+			arg_size, sizeof(struct cam_isp_hw_fcg_cmd));
+		return -EINVAL;
+	}
+
+	fcg_cmd = (struct cam_isp_hw_fcg_cmd *) cmd_args;
+	if (!fcg_cmd || !fcg_cmd->res) {
+		CAM_ERR(CAM_SFE, "Invalid cmd args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)fcg_cmd->res->cdm_ops;
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	if (fcg_cmd->get_size_flag) {
+		struct cam_isp_hw_fcg_get_size  *fcg_get_size;
+
+		fcg_get_size = &fcg_cmd->u.fcg_get_size;
+		rc = cam_sfe_top_get_fcg_buf_size(top_priv, fcg_get_size, cdm_util_ops);
+	} else {
+		struct cam_isp_hw_fcg_update    *fcg_update;
+
+		fcg_update = &fcg_cmd->u.fcg_update;
+		rc = cam_sfe_top_apply_fcg_update(top_priv, fcg_update, cdm_util_ops);
+	}
+
+	return rc;
+}
+
+int cam_sfe_top_process_cmd(void *priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_sfe_top_priv           *top_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_sfe_soc_private        *soc_private = NULL;
+
+	if (!priv) {
+		CAM_ERR(CAM_SFE, "Invalid top_priv");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_sfe_top_priv *) priv;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = soc_info->soc_private;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_SFE, "soc private is NULL");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_sfe_top_get_base(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+		rc = cam_sfe_top_clock_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+		rc = cam_sfe_top_bw_update(soc_private, top_priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+		rc = cam_sfe_top_bw_control(soc_private, top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = cam_sfe_top_core_cfg(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SET_SFE_DEBUG_CFG:
+		rc = cam_sfe_set_top_debug(top_priv, cmd_args);
+		break;
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+		rc = cam_sfe_top_handle_overflow(top_priv, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE:
+		rc = cam_sfe_top_apply_clk_bw_update(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_FCG_CONFIG:
+		rc = cam_sfe_top_fcg_config(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_CAP: {
+		struct cam_isp_hw_cap *sfe_cap;
+
+		sfe_cap = (struct cam_isp_hw_cap *) cmd_args;
+		sfe_cap->num_perf_counters =
+			top_priv->common_data.common_reg->num_perf_counters;
+		rc = 0;
+	}
+	break;
+	default:
+		CAM_ERR(CAM_SFE, "Invalid cmd type: %d", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int cam_sfe_top_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_sfe_top_priv                 *top_priv;
+	struct cam_sfe_acquire_args             *args;
+	struct cam_sfe_hw_sfe_in_acquire_args   *acquire_args;
+	int rc = -EINVAL, i;
+
+	if (!device_priv || !reserve_args) {
+		CAM_ERR(CAM_SFE,
+			"Error invalid input arguments");
+		return rc;
+	}
+
+	top_priv = (struct cam_sfe_top_priv *)device_priv;
+	args = (struct cam_sfe_acquire_args *)reserve_args;
+	acquire_args = &args->sfe_in;
+
+	if (top_priv->reserve_cnt) {
+		if (top_priv->priv_per_stream != args->priv) {
+			CAM_DBG(CAM_SFE,
+				"Acquiring same SFE[%u] HW res: %u for different streams",
+				top_priv->common_data.hw_intf->hw_idx, acquire_args->res_id);
+			rc = -EINVAL;
+			return rc;
+		}
+	}
+
+	for (i = 0; i < CAM_SFE_TOP_IN_PORT_MAX; i++) {
+		CAM_DBG(CAM_SFE, "i: %d res_id: %d state: %d", i,
+			acquire_args->res_id, top_priv->in_rsrc[i].res_state);
+
+		if ((top_priv->in_rsrc[i].res_id == acquire_args->res_id) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_AVAILABLE)) {
+			CAM_DBG(CAM_SFE,
+				"SFE [%u] for rsrc: %u acquired",
+				top_priv->in_rsrc[i].hw_intf->hw_idx,
+				acquire_args->res_id);
+
+			top_priv->in_rsrc[i].cdm_ops = acquire_args->cdm_ops;
+			top_priv->in_rsrc[i].tasklet_info = args->tasklet;
+			top_priv->in_rsrc[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			acquire_args->rsrc_node =
+				&top_priv->in_rsrc[i];
+			rc = 0;
+			break;
+		}
+	}
+
+	if (!rc) {
+		top_priv->reserve_cnt++;
+		top_priv->priv_per_stream = args->priv;
+		top_priv->event_cb = args->event_cb;
+	}
+
+	return rc;
+}
+
+int cam_sfe_top_release(void *device_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_sfe_top_priv            *top_priv;
+	struct cam_isp_resource_node       *in_res;
+
+	if (!device_priv || !release_args) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_sfe_top_priv   *)device_priv;
+	in_res = (struct cam_isp_resource_node *)release_args;
+
+	CAM_DBG(CAM_SFE,
+		"Release for SFE [%u] resource id: %u in state: %d",
+		in_res->hw_intf->hw_idx, in_res->res_id,
+		in_res->res_state);
+	if (in_res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE, "SFE [%u] invalid res_state: %d",
+			in_res->hw_intf->hw_idx, in_res->res_state);
+		return -EINVAL;
+	}
+
+	in_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	in_res->cdm_ops = NULL;
+	in_res->tasklet_info = NULL;
+	if (top_priv->reserve_cnt)
+		top_priv->reserve_cnt--;
+
+	if (!top_priv->reserve_cnt) {
+		top_priv->priv_per_stream = NULL;
+		top_priv->event_cb = NULL;
+	}
+
+	return 0;
+}
+
+static int cam_sfe_top_get_evt_payload(
+	struct cam_sfe_top_priv                *top_priv,
+	struct cam_sfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&top_priv->spin_lock);
+	if (list_empty(&top_priv->common_data.free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free CAMIF LITE event payload");
+		*evt_payload = NULL;
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(
+		&top_priv->common_data.free_payload_list,
+		struct cam_sfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+
+done:
+	spin_unlock(&top_priv->spin_lock);
+	return rc;
+}
+
+static int cam_sfe_top_put_evt_payload(
+	struct cam_sfe_top_priv                *top_priv,
+	struct cam_sfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!top_priv) {
+		CAM_ERR(CAM_SFE, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_SFE, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&top_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list,
+		&top_priv->common_data.free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&top_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_SFE, "Done");
+	return 0;
+}
+
+static int cam_sfe_top_handle_err_irq_top_half(
+	uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int rc = 0, i;
+	uint32_t irq_status = 0;
+	void __iomem *base = NULL;
+	struct cam_sfe_top_priv            *top_priv;
+	struct cam_sfe_top_irq_evt_payload *evt_payload;
+
+	top_priv = th_payload->handler_priv;
+	irq_status = th_payload->evt_status_arr[0];
+
+	CAM_DBG(CAM_SFE, "Top error IRQ Received: 0x%x", irq_status);
+
+	base = top_priv->common_data.soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base;
+	if (irq_status & top_priv->common_data.common_reg_data->error_irq_mask) {
+		cam_irq_controller_disable_all(
+			top_priv->common_data.sfe_irq_controller);
+	}
+
+	rc  = cam_sfe_top_get_evt_payload(top_priv, &evt_payload);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] =
+			th_payload->evt_status_arr[i];
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	evt_payload->violation_status =
+	cam_io_r(base +
+		top_priv->common_data.common_reg->ipp_violation_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_sfe_top_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int rc = 0, i;
+	uint32_t irq_status = 0;
+	struct cam_sfe_top_priv             *top_priv;
+	struct cam_isp_resource_node        *res;
+	struct cam_sfe_path_data            *path_data;
+	struct cam_sfe_top_irq_evt_payload  *evt_payload;
+
+	res = th_payload->handler_priv;
+	path_data = res->res_priv;
+	top_priv = path_data->top_priv;
+
+	rc  = cam_sfe_top_get_evt_payload(top_priv, &evt_payload);
+	if (rc)
+		return rc;
+
+	irq_status = th_payload->evt_status_arr[0];
+	CAM_DBG(CAM_SFE, "SFE top irq status: 0x%x",
+			irq_status);
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] =
+			th_payload->evt_status_arr[i];
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	th_payload->evt_payload_priv = evt_payload;
+	return rc;
+}
+
+void cam_sfe_top_sel_frame_counter(
+	uint32_t res_id, uint32_t *val,
+	bool read_counter,
+	struct cam_sfe_path_data *path_data)
+{
+	const uint32_t frame_cnt_shift = 0x4;
+	uint32_t frame_cnt0 = 0, frame_cnt1 = 0;
+	struct cam_sfe_top_common_reg_offset *common_reg = NULL;
+
+	if (read_counter) {
+		common_reg = path_data->common_reg;
+		frame_cnt0 = cam_io_r(path_data->mem_base +
+			common_reg->diag_sensor_frame_cnt_status0);
+		frame_cnt1 = cam_io_r(path_data->mem_base +
+			common_reg->diag_sensor_frame_cnt_status1);
+	}
+
+	switch (res_id) {
+	case CAM_ISP_HW_SFE_IN_PIX:
+		*val |= (1 << frame_cnt_shift);
+		if (read_counter)
+			CAM_INFO(CAM_SFE, "IPP frame_cnt 0x%x",
+				frame_cnt0 & 0xFF);
+		break;
+	case CAM_ISP_HW_SFE_IN_RDI0:
+		*val |= (1 << (frame_cnt_shift + 1));
+		if (read_counter)
+			CAM_INFO(CAM_SFE, "RDI0 frame_cnt 0x%x",
+				(frame_cnt0 >> 16) & 0xFF);
+		break;
+	case CAM_ISP_HW_SFE_IN_RDI1:
+		*val |= (1 << (frame_cnt_shift + 2));
+		if (read_counter)
+			CAM_INFO(CAM_SFE, "RDI1 frame_cnt 0x%x",
+				(frame_cnt0 >> 24) & 0xFF);
+		break;
+	case CAM_ISP_HW_SFE_IN_RDI2:
+		*val |= (1 << (frame_cnt_shift + 3));
+		if (read_counter)
+			CAM_INFO(CAM_SFE, "RDI2 frame_cnt 0x%x",
+				frame_cnt1 & 0xFF);
+		break;
+	case CAM_ISP_HW_SFE_IN_RDI3:
+		*val |= (1 << (frame_cnt_shift + 4));
+		if (read_counter)
+			CAM_INFO(CAM_SFE, "RDI3 frame_cnt 0x%x",
+				(frame_cnt1 >> 16) & 0xFF);
+		break;
+	case CAM_ISP_HW_SFE_IN_RDI4:
+		*val |= (1 << (frame_cnt_shift + 5));
+		if (read_counter)
+			CAM_INFO(CAM_SFE, "RDI4 frame_cnt 0x%x",
+				(frame_cnt1 >> 24) & 0xFF);
+		break;
+	default:
+		break;
+	}
+}
+
+static void cam_sfe_top_print_ipp_violation_info(
+	struct cam_sfe_top_priv *top_priv,
+	uint32_t violation_status)
+{
+	struct cam_sfe_top_common_data *common_data = &top_priv->common_data;
+	struct cam_hw_soc_info         *soc_info = common_data->soc_info;
+	uint32_t val = violation_status;
+
+	CAM_INFO(CAM_SFE, "SFE[%u] IPP Violation status 0x%x",
+	     soc_info->index, val);
+
+	if (top_priv->hw_info->ipp_module_desc)
+		CAM_ERR(CAM_SFE, "SFE[%u] IPP Violation Module id: [%u %s]",
+			soc_info->index,
+			top_priv->hw_info->ipp_module_desc[val].id,
+			top_priv->hw_info->ipp_module_desc[val].desc);
+
+}
+
+static void cam_sfe_top_print_top_irq_error(
+	struct cam_sfe_top_priv *top_priv,
+	uint32_t irq_status,
+	uint32_t violation_status)
+{
+	uint32_t i = 0;
+
+	for (i = 0; i < top_priv->hw_info->num_top_errors; i++) {
+		if (top_priv->hw_info->top_err_desc[i].bitmask &
+			irq_status) {
+			CAM_ERR(CAM_SFE, "%s %s",
+				top_priv->hw_info->top_err_desc[i].err_name,
+				top_priv->hw_info->top_err_desc[i].desc);
+		}
+	}
+
+	if (irq_status & top_priv->common_data.common_reg->ipp_violation_mask)
+		cam_sfe_top_print_ipp_violation_info(top_priv, violation_status);
+
+}
+
+static int cam_sfe_top_handle_err_irq_bottom_half(
+	void *handler_priv, void *evt_payload_priv)
+{
+	int i;
+	uint32_t viol_sts;
+	uint32_t irq_status[CAM_SFE_IRQ_REGISTERS_MAX] = {0};
+	enum cam_sfe_hw_irq_status          ret = CAM_SFE_IRQ_STATUS_MAX;
+	struct cam_isp_hw_event_info        evt_info;
+	struct cam_sfe_top_priv            *top_priv = handler_priv;
+	struct cam_sfe_top_irq_evt_payload *payload = evt_payload_priv;
+
+	for (i = 0; i < CAM_SFE_IRQ_REGISTERS_MAX; i++)
+		irq_status[i] = payload->irq_reg_val[i];
+
+	evt_info.hw_idx = top_priv->common_data.soc_info->index;
+	evt_info.hw_type = CAM_ISP_HW_TYPE_SFE;
+	evt_info.res_type = CAM_ISP_RESOURCE_SFE_IN;
+	evt_info.reg_val = 0;
+
+	if (irq_status[0] &
+		top_priv->common_data.common_reg_data->error_irq_mask) {
+		struct cam_isp_hw_error_event_info err_evt_info;
+
+		viol_sts = payload->violation_status;
+		CAM_INFO(CAM_SFE, "Violation status 0x%x",
+			viol_sts);
+		cam_sfe_top_print_top_irq_error(top_priv,
+			irq_status[0], viol_sts);
+		err_evt_info.err_type = CAM_SFE_IRQ_STATUS_VIOLATION;
+		evt_info.event_data = (void *)&err_evt_info;
+		cam_sfe_top_print_debug_reg_info(top_priv);
+		if (top_priv->event_cb)
+			top_priv->event_cb(top_priv->priv_per_stream,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		ret = CAM_SFE_IRQ_STATUS_VIOLATION;
+	}
+
+	cam_sfe_top_put_evt_payload(top_priv, &payload);
+
+	return ret;
+}
+
+static int cam_sfe_top_handle_irq_bottom_half(
+	void *handler_priv, void *evt_payload_priv)
+{
+	int i;
+	uint32_t val0, val1, frame_cnt, offset0, offset1;
+	uint32_t irq_status[CAM_SFE_IRQ_REGISTERS_MAX] = {0};
+	enum cam_sfe_hw_irq_status          ret = CAM_SFE_IRQ_STATUS_MAX;
+	struct cam_isp_resource_node       *res = handler_priv;
+	struct cam_sfe_path_data           *path_data = res->res_priv;
+	struct cam_sfe_top_priv            *top_priv = path_data->top_priv;
+	struct cam_sfe_top_irq_evt_payload *payload = evt_payload_priv;
+
+	for (i = 0; i < CAM_SFE_IRQ_REGISTERS_MAX; i++)
+		irq_status[i] = payload->irq_reg_val[i];
+
+	if (irq_status[0] & path_data->path_reg_data->subscribe_irq_mask) {
+		if (irq_status[0] & path_data->path_reg_data->sof_irq_mask) {
+			CAM_DBG(CAM_SFE, "SFE:%d Received %s SOF",
+				res->hw_intf->hw_idx,
+				res->res_name);
+			offset0 = path_data->common_reg->diag_sensor_status_0;
+			offset1 = path_data->common_reg->diag_sensor_status_1;
+			/* check for any debug info at SOF */
+			if (top_priv->sfe_debug_cfg &
+				SFE_DEBUG_ENABLE_SENSOR_DIAG_INFO) {
+				val0 =  cam_io_r(path_data->mem_base +
+					offset0);
+				val1 = cam_io_r(path_data->mem_base +
+					offset1);
+				CAM_INFO(CAM_SFE,
+					"SFE:%d HBI: 0x%x VBI: 0x%x NEQ_HBI: %s HBI_MIN_ERR: %s",
+					res->hw_intf->hw_idx, (val0 & 0x3FFF), val1,
+					(val0 & (0x4000) ? "TRUE" : "FALSE"),
+					(val0 & (0x8000) ? "TRUE" : "FALSE"));
+			}
+
+			if (top_priv->sfe_debug_cfg &
+				SFE_DEBUG_ENABLE_FRAME_COUNTER)
+				cam_sfe_top_sel_frame_counter(
+					res->res_id, &frame_cnt,
+					true, path_data);
+
+			cam_sfe_top_dump_perf_counters("SOF", res->res_name, top_priv);
+		}
+
+		if (irq_status[0] &
+			path_data->path_reg_data->eof_irq_mask) {
+			CAM_DBG(CAM_SFE, "SFE:%d Received %s EOF",
+				res->hw_intf->hw_idx,
+				res->res_name);
+
+			cam_sfe_top_dump_perf_counters("EOF", res->res_name, top_priv);
+		}
+		ret = CAM_SFE_IRQ_STATUS_SUCCESS;
+	}
+
+	cam_sfe_top_put_evt_payload(top_priv, &payload);
+
+	return ret;
+}
+
+int cam_sfe_top_start(
+	void *priv, void *start_args, uint32_t arg_size)
+{
+	int                                   rc = -EINVAL;
+	uint32_t                              val = 0, diag_cfg = 0;
+	bool                                  debug_cfg_enabled = false;
+	struct cam_sfe_top_priv              *top_priv;
+	struct cam_isp_resource_node         *sfe_res;
+	struct cam_hw_info                   *hw_info = NULL;
+	struct cam_sfe_path_data             *path_data;
+	uint32_t   error_mask[CAM_SFE_IRQ_REGISTERS_MAX];
+	uint32_t   sof_eof_mask[CAM_SFE_IRQ_REGISTERS_MAX];
+	uint32_t core_cfg = 0, i = 0;
+
+	if (!priv || !start_args) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_sfe_top_priv *)priv;
+	sfe_res = (struct cam_isp_resource_node *) start_args;
+
+	hw_info = (struct cam_hw_info  *)sfe_res->hw_intf->hw_priv;
+	if (!hw_info) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return rc;
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_SFE, "SFE HW [%u] not powered up",
+			hw_info->soc_info.index);
+		rc = -EPERM;
+		return rc;
+	}
+
+	path_data = (struct cam_sfe_path_data *)sfe_res->res_priv;
+	rc = cam_sfe_top_apply_clock_start_stop(top_priv);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE:%d Failed in applying start clock rc:%d",
+			hw_info->soc_info.index, rc);
+		return rc;
+	}
+
+	rc = cam_sfe_top_apply_bw_start_stop(top_priv);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE:%d Failed in applying start bw rc:%d",
+			hw_info->soc_info.index, rc);
+		return rc;
+	}
+
+	core_cfg = cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->core_cfg);
+
+	/* core cfg updated via CDM */
+	CAM_DBG(CAM_SFE, "SFE HW [%u] core_cfg: 0x%x",
+		hw_info->soc_info.index, core_cfg);
+
+	for (i = 0; i < path_data->common_reg->num_sfe_mode; i++) {
+		if (path_data->common_reg->sfe_mode[i].value ==
+			core_cfg) {
+			CAM_DBG(CAM_SFE, "SFE HW [%u] : [%s]",
+				hw_info->soc_info.index,
+				path_data->common_reg->sfe_mode[i].desc);
+			break;
+		}
+	}
+
+	/* First resource stream on */
+	if (!top_priv->start_stop_cnt) {
+
+		/* Enable debug cfg registers */
+		cam_io_w(path_data->common_reg_data->top_debug_cfg_en,
+			path_data->mem_base +
+			path_data->common_reg->top_debug_cfg);
+
+		/* Enables the context controller testbus*/
+		if (path_data->common_reg->top_cc_test_bus_supported) {
+			for (i = 0; i < top_priv->hw_info->num_of_testbus; i++) {
+				if ((top_priv->sfe_debug_cfg &
+					top_priv->hw_info->test_bus_info[i].debugfs_val) ||
+					top_priv->hw_info->test_bus_info[i].enable) {
+					top_priv->cc_testbus_sel_cfg =
+						top_priv->hw_info->test_bus_info[i].value;
+					break;
+				}
+			}
+
+			if (top_priv->cc_testbus_sel_cfg)
+				cam_io_w(top_priv->cc_testbus_sel_cfg,
+					path_data->mem_base +
+					path_data->common_reg->top_cc_test_bus_ctrl);
+		}
+
+		for (i = 0; i < top_priv->common_data.common_reg->num_perf_counters; i++) {
+			if (!top_priv->perf_counters[i].perf_counter_val)
+				continue;
+
+			top_priv->perf_counters[i].dump_counter = true;
+			cam_io_w_mb(top_priv->perf_counters[i].perf_counter_val,
+				path_data->mem_base +
+				path_data->common_reg->perf_count_reg[i].perf_count_cfg);
+			CAM_DBG(CAM_SFE, "SFE [%u] perf_count_%d: 0x%x",
+				hw_info->soc_info.index, (i + 1),
+				top_priv->perf_counters[i].perf_counter_val);
+		}
+	}
+
+	/* Enable sensor diag info */
+	if (top_priv->sfe_debug_cfg &
+		SFE_DEBUG_ENABLE_SENSOR_DIAG_INFO) {
+		if ((top_priv->sensor_sel_diag_cfg) &&
+			(top_priv->sensor_sel_diag_cfg <
+			CAM_SFE_TOP_IN_PORT_MAX))
+			val |= top_priv->sensor_sel_diag_cfg <<
+				path_data->common_reg_data->sensor_sel_shift;
+		debug_cfg_enabled = true;
+	}
+
+	if (top_priv->sfe_debug_cfg & SFE_DEBUG_ENABLE_FRAME_COUNTER) {
+		cam_sfe_top_sel_frame_counter(sfe_res->res_id, &val,
+			false, path_data);
+		debug_cfg_enabled = true;
+	}
+
+	if (debug_cfg_enabled) {
+		diag_cfg = cam_io_r(path_data->mem_base +
+			path_data->common_reg->diag_config);
+		diag_cfg |= val;
+		diag_cfg |= path_data->common_reg_data->enable_diagnostic_hw;
+		CAM_DBG(CAM_SFE, "Diag config 0x%x", diag_cfg);
+		cam_io_w(diag_cfg,
+			path_data->mem_base +
+			path_data->common_reg->diag_config);
+	}
+
+	error_mask[0] = path_data->common_reg_data->error_irq_mask;
+	/* Enable error IRQ by default once */
+	if (!top_priv->error_irq_handle) {
+		top_priv->error_irq_handle = cam_irq_controller_subscribe_irq(
+			top_priv->common_data.sfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			error_mask,
+			top_priv,
+			cam_sfe_top_handle_err_irq_top_half,
+			cam_sfe_top_handle_err_irq_bottom_half,
+			sfe_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (top_priv->error_irq_handle < 1) {
+			CAM_ERR(CAM_SFE, "Failed to subscribe Top IRQ");
+			top_priv->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	/* Remove after driver stabilizes */
+	top_priv->sfe_debug_cfg |= SFE_DEBUG_ENABLE_SOF_EOF_IRQ;
+
+	if ((top_priv->sfe_debug_cfg & SFE_DEBUG_ENABLE_SOF_EOF_IRQ) ||
+		(debug_cfg_enabled)) {
+		if (!path_data->sof_eof_handle) {
+			sof_eof_mask[0] =
+				path_data->path_reg_data->subscribe_irq_mask;
+			path_data->sof_eof_handle =
+				cam_irq_controller_subscribe_irq(
+				top_priv->common_data.sfe_irq_controller,
+				CAM_IRQ_PRIORITY_1,
+				sof_eof_mask,
+				sfe_res,
+				cam_sfe_top_handle_irq_top_half,
+				cam_sfe_top_handle_irq_bottom_half,
+				sfe_res->tasklet_info,
+				&tasklet_bh_api,
+				CAM_IRQ_EVT_GROUP_0);
+
+			if (path_data->sof_eof_handle < 1) {
+				CAM_ERR(CAM_SFE,
+					"Failed to subscribe SOF/EOF IRQ");
+				path_data->sof_eof_handle = 0;
+				return -EFAULT;
+			}
+		}
+	}
+
+	sfe_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	top_priv->start_stop_cnt++;
+	return 0;
+}
+
+int cam_sfe_top_stop(
+	void *priv, void *stop_args, uint32_t arg_size)
+{
+	int i;
+	bool debug_cfg_disable = false;
+	uint32_t val = 0, diag_cfg = 0;
+	struct cam_sfe_top_priv       *top_priv;
+	struct cam_isp_resource_node  *sfe_res;
+	struct cam_sfe_path_data      *path_data;
+
+	if (!priv || !stop_args) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_sfe_top_priv *)priv;
+	sfe_res = (struct cam_isp_resource_node *) stop_args;
+	path_data = sfe_res->res_priv;
+
+	if (sfe_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		sfe_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	/* Unsubscribe for IRQs */
+	sfe_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	for (i = 0; i < CAM_SFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->in_rsrc[i].res_id == sfe_res->res_id) {
+			if (!top_priv->skip_clk_data_rst)
+				top_priv->req_clk_rate[i] = 0;
+			memset(&top_priv->req_axi_vote[i], 0,
+				sizeof(struct cam_axi_vote));
+			top_priv->axi_vote_control[i] =
+				CAM_ISP_BW_CONTROL_EXCLUDE;
+			break;
+		}
+	}
+
+	if (path_data->sof_eof_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			top_priv->common_data.sfe_irq_controller,
+			path_data->sof_eof_handle);
+		path_data->sof_eof_handle = 0;
+	}
+
+	if (top_priv->sfe_debug_cfg & SFE_DEBUG_ENABLE_FRAME_COUNTER) {
+		cam_sfe_top_sel_frame_counter(sfe_res->res_id, &val,
+			false, path_data);
+		debug_cfg_disable = true;
+	}
+
+	if (top_priv->start_stop_cnt)
+		top_priv->start_stop_cnt--;
+
+	if (!top_priv->start_stop_cnt &&
+		((top_priv->sfe_debug_cfg &
+		SFE_DEBUG_ENABLE_FRAME_COUNTER) ||
+		(top_priv->sfe_debug_cfg &
+		SFE_DEBUG_ENABLE_SENSOR_DIAG_INFO))) {
+		val |= path_data->common_reg_data->enable_diagnostic_hw;
+		debug_cfg_disable = true;
+	}
+
+	if (debug_cfg_disable) {
+		diag_cfg = cam_io_r(path_data->mem_base +
+			path_data->common_reg->diag_config);
+		diag_cfg &= ~val;
+		cam_io_w(diag_cfg,
+			path_data->mem_base +
+			path_data->common_reg->diag_config);
+	}
+
+	/*
+	 * Reset clk rate & unsubscribe error irq
+	 * when all resources are streamed off
+	 */
+	if (!top_priv->start_stop_cnt) {
+		if (!top_priv->skip_clk_data_rst)
+			top_priv->applied_clk_rate = 0;
+
+		if (top_priv->error_irq_handle > 0) {
+			cam_irq_controller_unsubscribe_irq(
+				top_priv->common_data.sfe_irq_controller,
+				top_priv->error_irq_handle);
+			top_priv->error_irq_handle = 0;
+		}
+
+		/* Reset perf counters at stream off */
+		for (i = 0; i <  top_priv->common_data.common_reg->num_perf_counters; i++) {
+			if (top_priv->perf_counters[i].dump_counter)
+				cam_io_w_mb(0x0, path_data->mem_base +
+					path_data->common_reg->perf_count_reg[i].perf_count_cfg);
+			top_priv->perf_counters[i].dump_counter = false;
+		}
+	}
+
+	return 0;
+}
+
+int cam_sfe_top_init_hw(void *priv, void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_sfe_top_priv *top_priv = priv;
+	void __iomem *mem_base;
+
+	if (!priv) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	mem_base = top_priv->common_data.soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base;
+
+	CAM_DBG(CAM_SFE, "SFE:%d hw-version:0x%x",
+		top_priv->common_data.hw_intf->hw_idx,
+		cam_io_r_mb(mem_base + top_priv->hw_info->common_reg->hw_version));
+
+	return 0;
+}
+
+int cam_sfe_top_init(
+	uint32_t                            hw_version,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	void                               *top_hw_info,
+	void                               *sfe_irq_controller,
+	struct cam_sfe_top                **sfe_top_ptr)
+{
+	int i, j, rc = 0;
+	struct cam_sfe_top_priv           *top_priv = NULL;
+	struct cam_sfe_path_data          *path_data = NULL;
+	struct cam_sfe_top                *sfe_top;
+	struct cam_sfe_top_hw_info        *sfe_top_hw_info =
+		(struct cam_sfe_top_hw_info *)top_hw_info;
+
+	sfe_top = kzalloc(sizeof(struct cam_sfe_top), GFP_KERNEL);
+	if (!sfe_top) {
+		CAM_DBG(CAM_SFE, "Error, Failed to alloc for sfe_top");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	top_priv = kzalloc(sizeof(struct cam_sfe_top_priv),
+		GFP_KERNEL);
+	if (!top_priv) {
+		rc = -ENOMEM;
+		goto free_sfe_top;
+	}
+
+	sfe_top->top_priv = top_priv;
+	top_priv->common_data.sfe_irq_controller = sfe_irq_controller;
+	if (sfe_top_hw_info->num_inputs > CAM_SFE_TOP_IN_PORT_MAX) {
+		CAM_ERR(CAM_SFE,
+			"Invalid number of input resources: %d max: %d",
+			sfe_top_hw_info->num_inputs,
+			CAM_SFE_TOP_IN_PORT_MAX);
+		rc = -EINVAL;
+		goto free_top_priv;
+	}
+
+	top_priv->num_in_ports = sfe_top_hw_info->num_inputs;
+
+	CAM_DBG(CAM_SFE,
+		"Initializing SFE [%u] top with hw_version: 0x%x",
+		hw_intf->hw_idx, hw_version);
+	for (i = 0, j = 0; i < top_priv->num_in_ports &&
+		j < CAM_SFE_RDI_MAX; i++) {
+		top_priv->in_rsrc[i].res_type = CAM_ISP_RESOURCE_SFE_IN;
+		top_priv->in_rsrc[i].hw_intf = hw_intf;
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		top_priv->req_clk_rate[i] = 0;
+
+		path_data = kzalloc(sizeof(struct cam_sfe_path_data),
+			GFP_KERNEL);
+		if (!path_data) {
+			CAM_DBG(CAM_SFE,
+				"Failed to alloc SFE [%u] for input type %d",
+				hw_intf->hw_idx,
+				sfe_top_hw_info->input_type[i]);
+			goto deinit_resources;
+		}
+
+		if (sfe_top_hw_info->input_type[i] ==
+			CAM_SFE_PIX_VER_1_0) {
+			top_priv->in_rsrc[i].res_id = CAM_ISP_HW_SFE_IN_PIX;
+			path_data->path_reg_data =
+				sfe_top_hw_info->pix_reg_data;
+			scnprintf(top_priv->in_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "PIX");
+		} else if (sfe_top_hw_info->input_type[i] ==
+			CAM_SFE_RDI_VER_1_0) {
+			top_priv->in_rsrc[i].res_id =
+				CAM_ISP_HW_SFE_IN_RDI0 + j;
+			scnprintf(top_priv->in_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "RDI%d", j);
+			path_data->path_reg_data =
+				sfe_top_hw_info->rdi_reg_data[j++];
+		} else if (sfe_top_hw_info->input_type[i] ==
+			CAM_SFE_RD_VER_1_0) {
+			top_priv->in_rsrc[i].res_id = CAM_ISP_HW_SFE_IN_RD;
+			path_data->path_reg_data =
+				sfe_top_hw_info->rd_top_reg_data;
+			scnprintf(top_priv->in_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "RD");
+		} else {
+			CAM_ERR(CAM_SFE, "Invalid SFE input type: %u",
+				sfe_top_hw_info->input_type[i]);
+			rc = -EINVAL;
+			goto deinit_resources;
+		}
+
+		path_data->mem_base = soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base;
+		path_data->common_reg = sfe_top_hw_info->common_reg;
+		path_data->common_reg_data = sfe_top_hw_info->common_reg_data;
+		path_data->modules_reg = sfe_top_hw_info->modules_hw_info;
+		path_data->top_priv = top_priv;
+		path_data->hw_intf = hw_intf;
+		path_data->soc_info = soc_info;
+		top_priv->in_rsrc[i].res_priv = path_data;
+	}
+
+	top_priv->common_data.soc_info = soc_info;
+	top_priv->common_data.hw_intf = hw_intf;
+	top_priv->common_data.common_reg =
+		sfe_top_hw_info->common_reg;
+	top_priv->common_data.common_reg_data = sfe_top_hw_info->common_reg_data;
+	top_priv->hw_info = sfe_top_hw_info;
+	top_priv->wr_client_desc  = sfe_top_hw_info->wr_client_desc;
+	top_priv->num_clc_module   = sfe_top_hw_info->num_clc_module;
+	top_priv->clc_dbg_mod_info = sfe_top_hw_info->clc_dbg_mod_info;
+	top_priv->sfe_debug_cfg = 0;
+	top_priv->cc_testbus_sel_cfg = 0;
+
+	sfe_top->hw_ops.process_cmd = cam_sfe_top_process_cmd;
+	sfe_top->hw_ops.start = cam_sfe_top_start;
+	sfe_top->hw_ops.stop = cam_sfe_top_stop;
+	sfe_top->hw_ops.reserve = cam_sfe_top_reserve;
+	sfe_top->hw_ops.release = cam_sfe_top_release;
+	sfe_top->hw_ops.init = cam_sfe_top_init_hw;
+
+	spin_lock_init(&top_priv->spin_lock);
+	INIT_LIST_HEAD(&top_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_SFE_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&top_priv->common_data.evt_payload[i].list);
+		list_add_tail(&top_priv->common_data.evt_payload[i].list,
+			&top_priv->common_data.free_payload_list);
+	}
+
+	*sfe_top_ptr = sfe_top;
+
+	return rc;
+
+deinit_resources:
+	for (--i; i >= 0; i--) {
+		top_priv->in_rsrc[i].start = NULL;
+		top_priv->in_rsrc[i].stop  = NULL;
+		top_priv->in_rsrc[i].process_cmd = NULL;
+		top_priv->in_rsrc[i].top_half_handler = NULL;
+		top_priv->in_rsrc[i].bottom_half_handler = NULL;
+
+		if (!top_priv->in_rsrc[i].res_priv)
+			continue;
+
+		kfree(top_priv->in_rsrc[i].res_priv);
+		top_priv->in_rsrc[i].res_priv = NULL;
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	}
+free_top_priv:
+	kfree(sfe_top->top_priv);
+	sfe_top->top_priv = NULL;
+free_sfe_top:
+	kfree(sfe_top);
+end:
+	*sfe_top_ptr = NULL;
+	return rc;
+}
+
+int cam_sfe_top_deinit(
+	uint32_t             hw_version,
+	struct cam_sfe_top **sfe_top_ptr)
+{
+	int i, rc = 0;
+	unsigned long flags;
+	struct cam_sfe_top      *sfe_top;
+	struct cam_sfe_top_priv *top_priv;
+
+	if (!sfe_top_ptr) {
+		CAM_ERR(CAM_SFE, "Error Invalid input");
+		return -ENODEV;
+	}
+
+	sfe_top = *sfe_top_ptr;
+	if (!sfe_top) {
+		CAM_ERR(CAM_SFE, "Error sfe top NULL");
+		return -ENODEV;
+	}
+
+	top_priv = sfe_top->top_priv;
+	if (!top_priv) {
+		CAM_ERR(CAM_SFE, "Error sfe top priv NULL");
+		rc = -ENODEV;
+		goto free_sfe_top;
+	}
+
+	CAM_DBG(CAM_SFE,
+		"Deinit SFE [%u] top with hw_version 0x%x",
+		top_priv->common_data.hw_intf->hw_idx,
+		hw_version);
+
+	spin_lock_irqsave(&top_priv->spin_lock, flags);
+	INIT_LIST_HEAD(&top_priv->common_data.free_payload_list);
+		for (i = 0; i < CAM_SFE_EVT_MAX; i++)
+			INIT_LIST_HEAD(
+				&top_priv->common_data.evt_payload[i].list);
+	spin_unlock_irqrestore(&top_priv->spin_lock, flags);
+
+	for (i = 0; i < CAM_SFE_TOP_IN_PORT_MAX; i++) {
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+		top_priv->in_rsrc[i].start = NULL;
+		top_priv->in_rsrc[i].stop  = NULL;
+		top_priv->in_rsrc[i].process_cmd = NULL;
+		top_priv->in_rsrc[i].top_half_handler = NULL;
+		top_priv->in_rsrc[i].bottom_half_handler = NULL;
+
+		if (!top_priv->in_rsrc[i].res_priv) {
+			CAM_ERR(CAM_SFE, "Error res_priv is NULL");
+			continue;
+		}
+
+		kfree(top_priv->in_rsrc[i].res_priv);
+		top_priv->in_rsrc[i].res_priv = NULL;
+	}
+
+	kfree(sfe_top->top_priv);
+
+free_sfe_top:
+	kfree(sfe_top);
+	*sfe_top_ptr = NULL;
+
+	return rc;
+}
+
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.h
@@ -0,0 +1,207 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_TOP_H_
+#define _CAM_SFE_TOP_H_
+
+#include "cam_cpas_api.h"
+
+#define CAM_SFE_PIX_VER_1_0    0x10
+#define CAM_SFE_RDI_VER_1_0    0x1000
+#define CAM_SFE_TOP_VER_1_0    0x10000
+#define CAM_SFE_RD_VER_1_0     0x100000
+
+#define CAM_SFE_TOP_IN_PORT_MAX                7
+#define CAM_SFE_RDI_MAX                        5
+
+#define CAM_SHIFT_TOP_CORE_CFG_MODE_SEL        2
+#define CAM_SHIFT_TOP_CORE_CFG_OPS_MODE_CFG    1
+#define CAM_SHIFT_TOP_CORE_CFG_FS_MODE_CFG     0
+
+#define CAM_SFE_TOP_DBG_REG_MAX                20
+#define CAM_SFE_TOP_TESTBUS_MAX                 2
+#define CAM_SFE_PERF_COUNTER_MAX                2
+
+struct cam_sfe_top_module_desc {
+	uint32_t id;
+	uint8_t *desc;
+};
+
+struct cam_sfe_top {
+	void                   *top_priv;
+	struct cam_hw_ops       hw_ops;
+};
+
+struct cam_sfe_mode {
+	int  value;
+	char  *desc;
+};
+
+struct cam_sfe_wr_client_desc {
+	uint32_t  wm_id;
+	uint8_t  *desc;
+};
+
+struct cam_sfe_top_err_irq_desc {
+	uint32_t  bitmask;
+	char     *err_name;
+	char     *desc;
+};
+
+struct cam_sfe_top_debug_info {
+	uint32_t  shift;
+	char     *clc_name;
+};
+
+struct cam_sfe_top_cc_testbus_info {
+	uint32_t  mask;
+	uint32_t  shift;
+	char     *clc_name;
+};
+
+struct cam_sfe_testbus_info {
+	uint32_t  debugfs_val;
+	bool      enable;
+	uint32_t  value;
+	uint32_t  size;
+	struct cam_sfe_top_cc_testbus_info *testbus;
+};
+
+struct cam_sfe_top_perf_count_reg_offset {
+	uint32_t perf_count_cfg;
+	uint32_t perf_pix_count;
+	uint32_t perf_line_count;
+	uint32_t perf_stall_count;
+	uint32_t perf_always_count;
+	uint32_t perf_count_status;
+};
+
+struct cam_sfe_top_common_reg_offset {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t stats_feature;
+	uint32_t core_cgc_ctrl;
+	uint32_t ahb_clk_ovd;
+	uint32_t core_cfg;
+	uint32_t ipp_violation_status;
+	uint32_t diag_config;
+	uint32_t diag_sensor_status_0;
+	uint32_t diag_sensor_status_1;
+	uint32_t diag_sensor_frame_cnt_status0;
+	uint32_t diag_sensor_frame_cnt_status1;
+	uint32_t stats_ch2_throttle_cfg;
+	uint32_t stats_ch1_throttle_cfg;
+	uint32_t stats_ch0_throttle_cfg;
+	uint32_t lcr_throttle_cfg;
+	uint32_t hdr_throttle_cfg;
+	uint32_t sfe_op_throttle_cfg;
+	uint32_t irc_throttle_cfg;
+	uint32_t sfe_single_dual_cfg;
+	uint32_t bus_overflow_status;
+	uint32_t num_perf_counters;
+	struct cam_sfe_top_perf_count_reg_offset
+		perf_count_reg[CAM_SFE_PERF_COUNTER_MAX];
+	uint32_t top_debug_cfg;
+	uint32_t top_cc_test_bus_ctrl;
+	bool     lcr_supported;
+	bool     ir_supported;
+	bool     qcfa_only;
+	struct   cam_sfe_mode *sfe_mode;
+	uint32_t num_sfe_mode;
+	uint32_t ipp_violation_mask;
+	uint32_t top_debug_testbus_reg;
+	uint32_t top_debug_nonccif_regstart_idx;
+	uint32_t top_cc_test_bus_supported;
+	uint32_t num_debug_registers;
+	uint32_t top_debug[CAM_SFE_TOP_DBG_REG_MAX];
+};
+
+struct cam_sfe_fcg_module_info {
+	uint32_t fcg_index_shift;
+	uint32_t max_reg_val_pair_size;
+	uint32_t fcg_type_size;
+	uint32_t fcg_ch1_phase_index_cfg_0;
+	uint32_t fcg_ch1_phase_index_cfg_1;
+	uint32_t fcg_ch2_phase_index_cfg_0;
+	uint32_t fcg_ch2_phase_index_cfg_1;
+	uint32_t fcg_ch1_stats_phase_index_cfg_0;
+	uint32_t fcg_ch1_stats_phase_index_cfg_1;
+	uint32_t fcg_ch2_stats_phase_index_cfg_0;
+	uint32_t fcg_ch2_stats_phase_index_cfg_1;
+};
+
+struct cam_sfe_modules_common_reg_offset {
+	uint32_t                                demux_module_cfg;
+	uint32_t                                demux_xcfa_cfg;
+	uint32_t                                demux_hdr_cfg;
+	uint32_t                                demux_lcr_sel;
+	uint32_t                                hdrc_remo_mod_cfg;
+	uint32_t                                hdrc_remo_xcfa_bin_cfg;
+	uint32_t                                xcfa_hdrc_remo_out_mux_cfg;
+	struct cam_sfe_fcg_module_info         *fcg_module_info;
+	bool                                    fcg_supported;
+};
+
+struct cam_sfe_top_common_reg_data {
+	uint32_t error_irq_mask;
+	uint32_t enable_diagnostic_hw;
+	uint32_t top_debug_cfg_en;
+	uint32_t sensor_sel_shift;
+};
+
+struct cam_sfe_path_common_reg_data {
+	uint32_t sof_irq_mask;
+	uint32_t eof_irq_mask;
+	uint32_t subscribe_irq_mask;
+};
+
+struct cam_sfe_top_hw_info {
+	struct cam_sfe_top_common_reg_offset     *common_reg;
+	struct cam_sfe_modules_common_reg_offset *modules_hw_info;
+	struct cam_sfe_top_common_reg_data       *common_reg_data;
+	struct cam_sfe_top_module_desc           *ipp_module_desc;
+	struct cam_sfe_wr_client_desc            *wr_client_desc;
+	struct cam_sfe_path_common_reg_data      *pix_reg_data;
+	struct cam_sfe_path_common_reg_data      *rd_top_reg_data;
+	struct cam_sfe_path_common_reg_data      *rdi_reg_data[CAM_SFE_RDI_MAX];
+	uint32_t                                  num_inputs;
+	uint32_t                                  input_type[
+		CAM_SFE_TOP_IN_PORT_MAX];
+	uint32_t                                  num_top_errors;
+	struct cam_sfe_top_err_irq_desc          *top_err_desc;
+	uint32_t                                  num_clc_module;
+	struct cam_sfe_top_debug_info           (*clc_dbg_mod_info)[CAM_SFE_TOP_DBG_REG_MAX][8];
+	uint32_t                                  num_of_testbus;
+	struct cam_sfe_testbus_info               test_bus_info[CAM_SFE_TOP_TESTBUS_MAX];
+};
+
+int cam_sfe_top_init(
+	uint32_t                            hw_version,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	void                               *top_hw_info,
+	void                               *sfe_irq_controller,
+	struct cam_sfe_top                **sfe_top);
+
+int cam_sfe_top_deinit(
+	uint32_t                       hw_version,
+	struct cam_sfe_top           **sfe_top);
+
+#define SFE_DBG_INFO(shift_val, name) {.shift = shift_val, .clc_name = name}
+
+#define SFE_DBG_INFO_ARRAY_4bit(name1, name2, name3, name4, name5, name6, name7, name8) \
+	{                                                                               \
+		SFE_DBG_INFO(0, name1),                                                 \
+		SFE_DBG_INFO(4, name2),                                                 \
+		SFE_DBG_INFO(8, name3),                                                 \
+		SFE_DBG_INFO(12, name4),                                                \
+		SFE_DBG_INFO(16, name5),                                                \
+		SFE_DBG_INFO(20, name6),                                                \
+		SFE_DBG_INFO(24, name7),                                                \
+		SFE_DBG_INFO(28, name8),                                                \
+	}
+
+#endif /* _CAM_SFE_TOP_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid.c
@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#include <linux/module.h>
+#include "cam_tfe_csid_core.h"
+#include "cam_tfe_csid530.h"
+#include "cam_tfe_csid640.h"
+#include "cam_tfe_csid640_210.h"
+#include "cam_tfe_csid770.h"
+#include "cam_tfe_csid665.h"
+#include "cam_tfe_csid_dev.h"
+#include "camera_main.h"
+
+#define CAM_TFE_CSID_DRV_NAME                    "tfe_csid"
+
+static const struct of_device_id cam_tfe_csid_dt_match[] = {
+	{
+		.compatible = "qcom,csid530",
+		.data = &cam_tfe_csid530_hw_info,
+	},
+	{
+		.compatible = "qcom,csid640",
+		.data = &cam_tfe_csid640_hw_info,
+	},
+	{
+		.compatible = "qcom,csid640_210",
+		.data = &cam_tfe_csid640_210_hw_info,
+	},
+	{
+		.compatible = "qcom,csid770",
+		.data = &cam_tfe_csid770_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite770",
+		.data = &cam_tfe_csid770_hw_info,
+	},
+	{
+		.compatible = "qcom,csid665",
+		.data = &cam_tfe_csid665_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_tfe_csid_dt_match);
+
+struct platform_driver cam_tfe_csid_driver = {
+	.probe = cam_tfe_csid_probe,
+	.remove = cam_tfe_csid_remove,
+	.driver = {
+		.name = CAM_TFE_CSID_DRV_NAME,
+		.of_match_table = cam_tfe_csid_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_tfe_csid_init_module(void)
+{
+	return platform_driver_register(&cam_tfe_csid_driver);
+}
+
+void cam_tfe_csid_exit_module(void)
+{
+	platform_driver_unregister(&cam_tfe_csid_driver);
+}
+
+MODULE_DESCRIPTION("CAM TFE_CSID driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_H_
+#define _CAM_TFE_CSID_H_
+
+int cam_tfe_csid_init_module(void);
+void cam_tfe_csid_exit_module(void);
+
+#endif /*_CAM_TFE_CSID_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid530.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid530.h
@@ -0,0 +1,243 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_530_H_
+#define _CAM_TFE_CSID_530_H_
+
+#include "cam_tfe_csid_core.h"
+
+#define CAM_TFE_CSID_VERSION_V530                 0x50030000
+
+static struct cam_tfe_csid_pxl_reg_offset  cam_tfe_csid_530_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	.csid_pxl_err_recovery_cfg0_addr     = 0x2d0,
+	.csid_pxl_err_recovery_cfg1_addr     = 0x2d4,
+	.csid_pxl_err_recovery_cfg2_addr     = 0x2d8,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.halt_master_sel_shift               = 4,
+	.halt_mode_shift                     = 2,
+	.halt_master_sel_master_val          = 3,
+	.halt_master_sel_slave_val           = 0,
+	.binning_supported                   = 0,
+	.is_multi_vc_dt_supported            = false,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_530_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x3b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x3b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x3b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+	/* configurations */
+	.is_multi_vc_dt_supported                 = false,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_530_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x4b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x4b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x4b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+	/* configurations */
+	.is_multi_vc_dt_supported                 = false,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_530_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x5b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x5b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x5b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+	/* configurations */
+	.is_multi_vc_dt_supported                 = false,
+};
+
+static struct cam_tfe_csid_csi2_rx_reg_offset
+	cam_tfe_csid_530_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.phy_sel_base                                 = 1,
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.phy_tpg_base_id                              = 0,
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 12,
+	.csi2_capture_cphy_pkt_dt_shift               = 14,
+	.csi2_capture_cphy_pkt_vc_shift               = 20,
+	.csi2_rx_phy_num_mask                         = 0x7,
+	.csi2_rx_long_pkt_hdr_rst_stb_shift           = 0x1,
+	.csi2_rx_short_pkt_hdr_rst_stb_shift          = 0x2,
+	.csi2_rx_cphy_pkt_hdr_rst_stb_shift           = 0x3,
+	.need_to_sel_tpg_mux                          = false,
+};
+
+static struct cam_tfe_csid_common_reg_offset
+	cam_tfe_csid_530_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 5,
+	.minor_version                                = 3,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.ipp_path_rst_stb_all                         = 0x17,
+	.rdi_path_rst_stb_all                         = 0x97,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x3FFFF,
+	.rdi_irq_mask_all                             = 0x3FFFF,
+	.top_tfe2_pix_pipe_fuse_reg                   = 0xFE4,
+	.top_tfe2_fuse_reg                            = 0xFE8,
+	.format_measure_support                       = false,
+};
+
+static struct cam_tfe_csid_reg_offset cam_tfe_csid_530_reg_offset = {
+	.cmn_reg          = &cam_tfe_csid_530_cmn_reg_offset,
+	.csi2_reg         = &cam_tfe_csid_530_csi2_reg_offset,
+	.ipp_reg          = &cam_tfe_csid_530_ipp_reg_offset,
+	.rdi_reg = {
+		&cam_tfe_csid_530_rdi_0_reg_offset,
+		&cam_tfe_csid_530_rdi_1_reg_offset,
+		&cam_tfe_csid_530_rdi_2_reg_offset,
+		},
+};
+
+static struct cam_tfe_csid_hw_info cam_tfe_csid530_hw_info = {
+	.csid_reg = &cam_tfe_csid_530_reg_offset,
+	.hw_dts_version = CAM_TFE_CSID_VERSION_V530,
+};
+
+#endif /*_CAM_TFE_CSID_530_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid640.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid640.h
@@ -0,0 +1,288 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_640_H_
+#define _CAM_TFE_CSID_640_H_
+
+#include "cam_tfe_csid_core.h"
+
+#define CAM_TFE_CSID_VERSION_V640                 0x60040000
+
+static struct cam_tfe_csid_pxl_reg_offset  cam_tfe_csid_640_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	.csid_pxl_err_recovery_cfg0_addr     = 0x2d0,
+	.csid_pxl_err_recovery_cfg1_addr     = 0x2d4,
+	.csid_pxl_err_recovery_cfg2_addr     = 0x2d8,
+	.csid_pxl_multi_vcdt_cfg0_addr       = 0x2dc,
+	.csid_pxl_format_measure_cfg0_addr   = 0x270,
+	.csid_pxl_format_measure_cfg1_addr   = 0x274,
+	.csid_pxl_format_measure0_addr       = 0x278,
+	.csid_pxl_format_measure1_addr       = 0x27c,
+	.csid_pxl_format_measure2_addr       = 0x280,
+
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.halt_master_sel_shift               = 4,
+	.halt_mode_shift                     = 2,
+	.halt_master_sel_master_val          = 3,
+	.halt_master_sel_slave_val           = 0,
+	.binning_supported                   = 3,
+	.bin_qcfa_en_shift_val               = 30,
+	.bin_en_shift_val                    = 2,
+	.is_multi_vc_dt_supported            = true,
+	.format_measure_en_shift_val         = 0,
+	.measure_en_hbi_vbi_cnt_val          = 0xc,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_640_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x3b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x3b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x3b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x3bc,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+
+	/* configurations */
+	.is_multi_vc_dt_supported                 = true,
+	.format_measure_en_shift_val              = 0,
+	.measure_en_hbi_vbi_cnt_val               = 0xc,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_640_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x4b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x4b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x4b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x4bc,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+
+	/* configurations */
+	.is_multi_vc_dt_supported                 = true,
+	.format_measure_en_shift_val              = 0,
+	.measure_en_hbi_vbi_cnt_val               = 0xc,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_640_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x5b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x5b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x5b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x5bc,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+
+	/* configurations */
+	.is_multi_vc_dt_supported                 = true,
+	.format_measure_en_shift_val              = 0,
+	.measure_en_hbi_vbi_cnt_val               = 0xc,
+};
+
+static struct cam_tfe_csid_csi2_rx_reg_offset
+	cam_tfe_csid_640_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.phy_sel_base                                 = 1,
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.phy_tpg_base_id                              = 1,
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 12,
+	.csi2_capture_cphy_pkt_dt_shift               = 14,
+	.csi2_capture_cphy_pkt_vc_shift               = 20,
+	.csi2_rx_phy_num_mask                         = 0x7,
+	.csi2_rx_long_pkt_hdr_rst_stb_shift           = 0x1,
+	.csi2_rx_short_pkt_hdr_rst_stb_shift          = 0x2,
+	.csi2_rx_cphy_pkt_hdr_rst_stb_shift           = 0x3,
+	.need_to_sel_tpg_mux                          = true,
+};
+
+static struct cam_tfe_csid_common_reg_offset
+	cam_tfe_csid_640_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 5,
+	.minor_version                                = 3,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.ipp_path_rst_stb_all                         = 0x17,
+	.rdi_path_rst_stb_all                         = 0x97,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.vc1_shift_val                                = 2,
+	.dt1_shift_val                                = 7,
+	.multi_vc_dt_en_shift_val                     = 0,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x3FFFF,
+	.rdi_irq_mask_all                             = 0x3FFFF,
+	.top_tfe2_pix_pipe_fuse_reg                   = 0xFE4,
+	.top_tfe2_fuse_reg                            = 0xFE8,
+	.format_measure_support                       = true,
+	.format_measure_height_shift_val              = 16,
+	.format_measure_height_mask_val               = 0xe,
+	.format_measure_width_mask_val                = 0x10,
+	.sync_clk                                     = true,
+};
+
+static struct cam_tfe_csid_reg_offset cam_tfe_csid_640_reg_offset = {
+	.cmn_reg          = &cam_tfe_csid_640_cmn_reg_offset,
+	.csi2_reg         = &cam_tfe_csid_640_csi2_reg_offset,
+	.ipp_reg          = &cam_tfe_csid_640_ipp_reg_offset,
+	.rdi_reg = {
+		&cam_tfe_csid_640_rdi_0_reg_offset,
+		&cam_tfe_csid_640_rdi_1_reg_offset,
+		&cam_tfe_csid_640_rdi_2_reg_offset,
+		},
+};
+
+static struct cam_tfe_csid_hw_info cam_tfe_csid640_hw_info = {
+	.csid_reg = &cam_tfe_csid_640_reg_offset,
+	.hw_dts_version = CAM_TFE_CSID_VERSION_V640,
+};
+
+#endif /*_CAM_TFE_CSID_640_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid640_210.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid640_210.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_640_210_H_
+#define _CAM_TFE_CSID_640_210_H_
+
+#include "cam_tfe_csid_core.h"
+#include "cam_tfe_csid640.h"
+
+#define CAM_TFE_CSID_VERSION_V640_210               0x60040000
+
+static struct cam_tfe_csid_hw_info cam_tfe_csid640_210_hw_info = {
+	.csid_reg = &cam_tfe_csid_640_reg_offset,
+	.hw_dts_version = CAM_TFE_CSID_VERSION_V640_210,
+};
+
+#endif /*_CAM_TFE_CSID_640_210_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid665.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid665.h
@@ -0,0 +1,366 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_665_H_
+#define _CAM_TFE_CSID_665_H_
+
+#include "cam_tfe_csid_core.h"
+
+#define CAM_TFE_CSID_VERSION_V665                 0x70065000
+
+static struct cam_tfe_csid_pxl_reg_offset  cam_tfe_csid_665_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_frame_drop_pattern         = 0x20c,
+	.csid_pxl_frame_drop_period          = 0x210,
+	.csid_pxl_irq_subsample_pattern      = 0x214,
+	.csid_pxl_irq_subsample_period       = 0x218,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_format_measure_cfg0_addr   = 0x270,
+	.csid_pxl_format_measure_cfg1_addr   = 0x274,
+	.csid_pxl_format_measure0_addr       = 0x278,
+	.csid_pxl_format_measure1_addr       = 0x27c,
+	.csid_pxl_format_measure2_addr       = 0x280,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	.csid_pxl_err_recovery_cfg0_addr     = 0x2d0,
+	.csid_pxl_err_recovery_cfg1_addr     = 0x2d4,
+	.csid_pxl_err_recovery_cfg2_addr     = 0x2d8,
+	.csid_pxl_multi_vcdt_cfg0_addr       = 0x2dc,
+
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.halt_master_sel_shift               = 4,
+	.halt_mode_shift                     = 2,
+	.halt_master_sel_master_val          = 1,
+	.halt_master_sel_slave_val           = 0,
+	.binning_supported                   = 3,
+	.bin_qcfa_en_shift_val               = 30,
+	.bin_en_shift_val                    = 2,
+	.is_multi_vc_dt_supported            = true,
+	.format_measure_en_shift_val         = 0,
+	.measure_en_hbi_vbi_cnt_val          = 0xc,
+};
+
+static struct cam_tfe_csid_pxl_reg_offset  cam_tfe_csid_665_ppp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0xA0,
+	.csid_pxl_irq_mask_addr              = 0xA4,
+	.csid_pxl_irq_clear_addr             = 0xA8,
+	.csid_pxl_irq_set_addr               = 0xAc,
+
+	.csid_pxl_cfg0_addr                  = 0x700,
+	.csid_pxl_cfg1_addr                  = 0x704,
+	.csid_pxl_ctrl_addr                  = 0x708,
+	.csid_pxl_frame_drop_pattern         = 0x70c,
+	.csid_pxl_frame_drop_period          = 0x710,
+	.csid_pxl_irq_subsample_pattern      = 0x714,
+	.csid_pxl_irq_subsample_period       = 0x718,
+	.csid_pxl_hcrop_addr                 = 0x71c,
+	.csid_pxl_vcrop_addr                 = 0x720,
+	.csid_pxl_rst_strobes_addr           = 0x740,
+	.csid_pxl_status_addr                = 0x754,
+	.csid_pxl_misr_val_addr              = 0x758,
+	.csid_pxl_format_measure_cfg0_addr   = 0x770,
+	.csid_pxl_format_measure_cfg1_addr   = 0x774,
+	.csid_pxl_format_measure0_addr       = 0x778,
+	.csid_pxl_format_measure1_addr       = 0x77c,
+	.csid_pxl_format_measure2_addr       = 0x780,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x790,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x794,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x798,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x79c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x7a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x7a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x7a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x7ac,
+	.csid_pxl_ppp_sparse_pd_ext_cfg0     = 0x7c0,
+	.csid_pxl_err_recovery_cfg0_addr     = 0x7d0,
+	.csid_pxl_err_recovery_cfg1_addr     = 0x7d4,
+	.csid_pxl_err_recovery_cfg2_addr     = 0x7d8,
+	.csid_pxl_multi_vcdt_cfg0_addr       = 0x7dc,
+
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.halt_master_sel_shift               = 4,
+	.halt_mode_shift                     = 2,
+	.halt_master_sel_master_val          = 3,
+	.halt_master_sel_slave_val           = 2,
+	.binning_supported                   = 0,
+	.bin_qcfa_en_shift_val               = 30,
+	.bin_en_shift_val                    = 2,
+	.is_multi_vc_dt_supported            = true,
+	.format_measure_en_shift_val         = 0,
+	.measure_en_hbi_vbi_cnt_val          = 0xc,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_665_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_frame_drop_pattern              = 0x30c,
+	.csid_rdi_frame_drop_period               = 0x310,
+	.csid_rdi_irq_subsample_pattern           = 0x314,
+	.csid_rdi_irq_subsample_period            = 0x318,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_misr_val2_addr                  = 0x35c,
+	.csid_rdi_misr_val3_addr                  = 0x360,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x3b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x3b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x3b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x3bc,
+
+	/* configurations */
+	.is_multi_vc_dt_supported                 = true,
+	.format_measure_en_shift_val              = 0,
+	.measure_en_hbi_vbi_cnt_val               = 0xc,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_665_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_frame_drop_pattern              = 0x40c,
+	.csid_rdi_frame_drop_period               = 0x410,
+	.csid_rdi_irq_subsample_pattern           = 0x414,
+	.csid_rdi_irq_subsample_period            = 0x418,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_misr_val2_addr                  = 0x45c,
+	.csid_rdi_misr_val3_addr                  = 0x460,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x4b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x4b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x4b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x4bc,
+
+	/* configurations */
+	.is_multi_vc_dt_supported                 = true,
+	.format_measure_en_shift_val              = 0,
+	.measure_en_hbi_vbi_cnt_val               = 0xc,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_665_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_frame_drop_pattern              = 0x50c,
+	.csid_rdi_frame_drop_period               = 0x510,
+	.csid_rdi_irq_subsample_pattern           = 0x514,
+	.csid_rdi_irq_subsample_period            = 0x518,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_misr_val2_addr                  = 0x55c,
+	.csid_rdi_misr_val3_addr                  = 0x560,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x5b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x5b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x5b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x5bc,
+
+	/* configurations */
+	.is_multi_vc_dt_supported                 = true,
+	.format_measure_en_shift_val              = 0,
+	.measure_en_hbi_vbi_cnt_val               = 0xc,
+};
+
+static struct cam_tfe_csid_csi2_rx_reg_offset
+	cam_tfe_csid_665_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.phy_sel_base                                 = 1,
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.phy_tpg_base_id                              = 3,
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 12,
+	.csi2_capture_cphy_pkt_dt_shift               = 14,
+	.csi2_capture_cphy_pkt_vc_shift               = 20,
+	.csi2_rx_phy_num_mask                         = 0x7,
+	.csi2_rx_long_pkt_hdr_rst_stb_shift           = 0x1,
+	.csi2_rx_short_pkt_hdr_rst_stb_shift          = 0x2,
+	.csi2_rx_cphy_pkt_hdr_rst_stb_shift           = 0x3,
+	.need_to_sel_tpg_mux                          = true,
+};
+
+static struct cam_tfe_csid_common_reg_offset
+	cam_tfe_csid_665_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 5,
+	.minor_version                                = 3,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 1,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.ipp_path_rst_stb_all                         = 0x17,
+	.ppp_path_rst_stb_all                         = 0x17,
+	.rdi_path_rst_stb_all                         = 0x97,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.vc1_shift_val                                = 2,
+	.dt1_shift_val                                = 7,
+	.multi_vc_dt_en_shift_val                     = 0,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x3FFFF,
+	.ppp_irq_mask_all                             = 0x3FFFF,
+	.rdi_irq_mask_all                             = 0x3FFFF,
+	.top_tfe2_pix_pipe_fuse_reg                   = 0xFE4,
+	.top_tfe2_fuse_reg                            = 0xFE8,
+	.format_measure_support                       = true,
+	.format_measure_height_shift_val              = 16,
+	.format_measure_height_mask_val               = 0xFFFF,
+	.format_measure_width_mask_val                = 0xFFFF,
+	.sync_clk                                     = true,
+};
+
+static struct cam_tfe_csid_reg_offset cam_tfe_csid_665_reg_offset = {
+	.cmn_reg          = &cam_tfe_csid_665_cmn_reg_offset,
+	.csi2_reg         = &cam_tfe_csid_665_csi2_reg_offset,
+	.ipp_reg          = &cam_tfe_csid_665_ipp_reg_offset,
+	.ppp_reg          = &cam_tfe_csid_665_ppp_reg_offset,
+	.rdi_reg = {
+		&cam_tfe_csid_665_rdi_0_reg_offset,
+		&cam_tfe_csid_665_rdi_1_reg_offset,
+		&cam_tfe_csid_665_rdi_2_reg_offset,
+		},
+};
+
+static struct cam_tfe_csid_hw_info cam_tfe_csid665_hw_info = {
+	.csid_reg = &cam_tfe_csid_665_reg_offset,
+	.hw_dts_version = CAM_TFE_CSID_VERSION_V665,
+};
+
+#endif /*_CAM_TFE_CSID_665_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid770.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid770.h
@@ -0,0 +1,367 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_770_H_
+#define _CAM_TFE_CSID_770_H_
+
+#include "cam_tfe_csid_core.h"
+
+#define CAM_TFE_CSID_VERSION_V770                 0x70070000
+
+static struct cam_tfe_csid_pxl_reg_offset  cam_tfe_csid_770_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_frame_drop_pattern         = 0x20c,
+	.csid_pxl_frame_drop_period          = 0x210,
+	.csid_pxl_irq_subsample_pattern      = 0x214,
+	.csid_pxl_irq_subsample_period       = 0x218,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_format_measure_cfg0_addr   = 0x270,
+	.csid_pxl_format_measure_cfg1_addr   = 0x274,
+	.csid_pxl_format_measure0_addr       = 0x278,
+	.csid_pxl_format_measure1_addr       = 0x27c,
+	.csid_pxl_format_measure2_addr       = 0x280,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	.csid_pxl_err_recovery_cfg0_addr     = 0x2d0,
+	.csid_pxl_err_recovery_cfg1_addr     = 0x2d4,
+	.csid_pxl_err_recovery_cfg2_addr     = 0x2d8,
+	.csid_pxl_multi_vcdt_cfg0_addr       = 0x2dc,
+
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.halt_master_sel_shift               = 4,
+	.halt_mode_shift                     = 2,
+	.halt_master_sel_master_val          = 1,
+	.halt_master_sel_slave_val           = 0,
+	.binning_supported                   = 3,
+	.bin_qcfa_en_shift_val               = 30,
+	.bin_en_shift_val                    = 2,
+	.is_multi_vc_dt_supported            = true,
+	.format_measure_en_shift_val         = 0,
+	.measure_en_hbi_vbi_cnt_val          = 0xc,
+};
+
+static struct cam_tfe_csid_pxl_reg_offset  cam_tfe_csid_770_ppp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0xA0,
+	.csid_pxl_irq_mask_addr              = 0xA4,
+	.csid_pxl_irq_clear_addr             = 0xA8,
+	.csid_pxl_irq_set_addr               = 0xAc,
+
+	.csid_pxl_cfg0_addr                  = 0x700,
+	.csid_pxl_cfg1_addr                  = 0x704,
+	.csid_pxl_ctrl_addr                  = 0x708,
+	.csid_pxl_frame_drop_pattern         = 0x70c,
+	.csid_pxl_frame_drop_period          = 0x710,
+	.csid_pxl_irq_subsample_pattern      = 0x714,
+	.csid_pxl_irq_subsample_period       = 0x718,
+	.csid_pxl_hcrop_addr                 = 0x71c,
+	.csid_pxl_vcrop_addr                 = 0x720,
+	.csid_pxl_rst_strobes_addr           = 0x740,
+	.csid_pxl_status_addr                = 0x754,
+	.csid_pxl_misr_val_addr              = 0x758,
+	.csid_pxl_format_measure_cfg0_addr   = 0x770,
+	.csid_pxl_format_measure_cfg1_addr   = 0x774,
+	.csid_pxl_format_measure0_addr       = 0x778,
+	.csid_pxl_format_measure1_addr       = 0x77c,
+	.csid_pxl_format_measure2_addr       = 0x780,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x790,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x794,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x798,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x79c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x7a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x7a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x7a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x7ac,
+	.csid_pxl_ppp_sparse_pd_ext_cfg0     = 0x7c0,
+	.csid_pxl_err_recovery_cfg0_addr     = 0x7d0,
+	.csid_pxl_err_recovery_cfg1_addr     = 0x7d4,
+	.csid_pxl_err_recovery_cfg2_addr     = 0x7d8,
+	.csid_pxl_multi_vcdt_cfg0_addr       = 0x7dc,
+
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.halt_master_sel_shift               = 4,
+	.halt_mode_shift                     = 2,
+	.halt_master_sel_master_val          = 3,
+	.halt_master_sel_slave_val           = 2,
+	.binning_supported                   = 0,
+	.bin_qcfa_en_shift_val               = 30,
+	.bin_en_shift_val                    = 2,
+	.is_multi_vc_dt_supported            = true,
+	.format_measure_en_shift_val         = 0,
+	.measure_en_hbi_vbi_cnt_val          = 0xc,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_770_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_frame_drop_pattern              = 0x30c,
+	.csid_rdi_frame_drop_period               = 0x310,
+	.csid_rdi_irq_subsample_pattern           = 0x314,
+	.csid_rdi_irq_subsample_period            = 0x318,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_misr_val2_addr                  = 0x35c,
+	.csid_rdi_misr_val3_addr                  = 0x360,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x3b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x3b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x3b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x3bc,
+
+	/* configurations */
+	.is_multi_vc_dt_supported                 = true,
+	.format_measure_en_shift_val              = 0,
+	.measure_en_hbi_vbi_cnt_val               = 0xc,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_770_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_frame_drop_pattern              = 0x40c,
+	.csid_rdi_frame_drop_period               = 0x410,
+	.csid_rdi_irq_subsample_pattern           = 0x414,
+	.csid_rdi_irq_subsample_period            = 0x418,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_misr_val2_addr                  = 0x45c,
+	.csid_rdi_misr_val3_addr                  = 0x460,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x4b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x4b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x4b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x4bc,
+
+	/* configurations */
+	.is_multi_vc_dt_supported                 = true,
+	.format_measure_en_shift_val              = 0,
+	.measure_en_hbi_vbi_cnt_val               = 0xc,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_770_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_frame_drop_pattern              = 0x50c,
+	.csid_rdi_frame_drop_period               = 0x510,
+	.csid_rdi_irq_subsample_pattern           = 0x514,
+	.csid_rdi_irq_subsample_period            = 0x518,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_misr_val2_addr                  = 0x55c,
+	.csid_rdi_misr_val3_addr                  = 0x560,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x5b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x5b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x5b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x5bc,
+
+	/* configurations */
+	.is_multi_vc_dt_supported                 = true,
+	.format_measure_en_shift_val              = 0,
+	.measure_en_hbi_vbi_cnt_val               = 0xc,
+};
+
+static struct cam_tfe_csid_csi2_rx_reg_offset
+	cam_tfe_csid_770_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.phy_sel_base                                 = 1,
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.phy_tpg_base_id                              = 3,
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_rx_epd_mode_shift_en                    = 8,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 12,
+	.csi2_capture_cphy_pkt_dt_shift               = 14,
+	.csi2_capture_cphy_pkt_vc_shift               = 20,
+	.csi2_rx_phy_num_mask                         = 0x7,
+	.csi2_rx_long_pkt_hdr_rst_stb_shift           = 0x1,
+	.csi2_rx_short_pkt_hdr_rst_stb_shift          = 0x2,
+	.csi2_rx_cphy_pkt_hdr_rst_stb_shift           = 0x3,
+	.need_to_sel_tpg_mux                          = true,
+};
+
+static struct cam_tfe_csid_common_reg_offset
+	cam_tfe_csid_770_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 5,
+	.minor_version                                = 3,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 1,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.ipp_path_rst_stb_all                         = 0x17,
+	.ppp_path_rst_stb_all                         = 0x17,
+	.rdi_path_rst_stb_all                         = 0x97,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.vc1_shift_val                                = 2,
+	.dt1_shift_val                                = 7,
+	.multi_vc_dt_en_shift_val                     = 0,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x3FFFF,
+	.ppp_irq_mask_all                             = 0x3FFFF,
+	.rdi_irq_mask_all                             = 0x3FFFF,
+	.top_tfe2_pix_pipe_fuse_reg                   = 0xFE4,
+	.top_tfe2_fuse_reg                            = 0xFE8,
+	.format_measure_support                       = true,
+	.format_measure_height_shift_val              = 16,
+	.format_measure_height_mask_val               = 0xFFFF,
+	.format_measure_width_mask_val                = 0xFFFF,
+	.sync_clk                                     = true,
+};
+
+static struct cam_tfe_csid_reg_offset cam_tfe_csid_770_reg_offset = {
+	.cmn_reg          = &cam_tfe_csid_770_cmn_reg_offset,
+	.csi2_reg         = &cam_tfe_csid_770_csi2_reg_offset,
+	.ipp_reg          = &cam_tfe_csid_770_ipp_reg_offset,
+	.ppp_reg          = &cam_tfe_csid_770_ppp_reg_offset,
+	.rdi_reg = {
+		&cam_tfe_csid_770_rdi_0_reg_offset,
+		&cam_tfe_csid_770_rdi_1_reg_offset,
+		&cam_tfe_csid_770_rdi_2_reg_offset,
+		},
+};
+
+static struct cam_tfe_csid_hw_info cam_tfe_csid770_hw_info = {
+	.csid_reg = &cam_tfe_csid_770_reg_offset,
+	.hw_dts_version = CAM_TFE_CSID_VERSION_V770,
+};
+
+#endif /*_CAM_TFE_CSID_770_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.c
@@ -0,0 +1,4692 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+#include <media/cam_tfe.h>
+#include <media/cam_defs.h>
+#include <media/cam_req_mgr.h>
+
+#include "cam_tfe_csid_core.h"
+#include "cam_csid_ppi_core.h"
+#include "cam_isp_hw.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_subdev.h"
+#include "cam_tasklet_util.h"
+#include "cam_common_util.h"
+#include "cam_tfe_csid_hw_intf.h"
+#include <dt-bindings/msm-camera.h>
+#include "cam_cpas_hw_intf.h"
+
+/* Timeout value in msec */
+#define TFE_CSID_TIMEOUT                               1000
+
+/* Timeout values in usec */
+#define CAM_TFE_CSID_TIMEOUT_SLEEP_US                  1000
+#define CAM_TFE_CSID_TIMEOUT_ALL_US                    100000
+
+/*
+ * Constant Factors needed to change QTimer ticks to nanoseconds
+ * QTimer Freq = 19.2 MHz
+ * Time(us) = ticks/19.2
+ * Time(ns) = ticks/19.2 * 1000
+ */
+#define CAM_TFE_CSID_QTIMER_MUL_FACTOR                 10000
+#define CAM_TFE_CSID_QTIMER_DIV_FACTOR                 192
+
+/* Max number of sof irq's triggered in case of SOF freeze */
+#define CAM_TFE_CSID_IRQ_SOF_DEBUG_CNT_MAX 12
+
+/* Max CSI Rx irq error count threshold value */
+#define CAM_TFE_CSID_MAX_IRQ_ERROR_COUNT               5
+
+static int cam_tfe_csid_is_ipp_ppp_format_supported(
+	uint32_t in_format)
+{
+	int rc = -EINVAL;
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+		rc = 0;
+		break;
+	default:
+		break;
+	}
+	return rc;
+}
+
+static int cam_tfe_csid_get_format_rdi(
+	uint32_t in_format, uint32_t out_format,
+	uint32_t *decode_fmt, uint32_t *plain_fmt)
+{
+	int rc = 0;
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_6:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			*decode_fmt = 0x0;
+			*plain_fmt = 0x0;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_PLAIN128:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			*decode_fmt = 0x1;
+			*plain_fmt = 0x0;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_PLAIN128:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+			*decode_fmt = 0x2;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_12:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN16_12:
+			*decode_fmt = 0x3;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_14:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN16_14:
+			*decode_fmt = 0x4;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_16:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN16_16:
+			*decode_fmt = 0x5;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	default:
+		rc = -EINVAL;
+		break;
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Unsupported format pair in %d out %d",
+			in_format, out_format);
+
+	return rc;
+}
+
+static int cam_tfe_csid_get_format_ipp_ppp(
+	uint32_t in_format,
+	uint32_t *decode_fmt, uint32_t *plain_fmt)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "input format:%d",
+		 in_format);
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		*decode_fmt  = 0;
+		*plain_fmt = 0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		*decode_fmt  = 0x1;
+		*plain_fmt = 0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		*decode_fmt  = 0x2;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		*decode_fmt  = 0x3;
+		*plain_fmt = 0x1;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported format %d",
+			in_format);
+		rc = -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "decode_fmt:%d plain_fmt:%d",
+		 *decode_fmt, *plain_fmt);
+
+	return rc;
+}
+
+static int cam_tfe_match_vc_dt_pair(int32_t *vc, uint32_t *dt,
+	uint32_t num_valid_vc_dt, struct cam_tfe_csid_cid_data *cid_data)
+{
+	int i;
+
+	if (num_valid_vc_dt == 0 || num_valid_vc_dt > CAM_ISP_TFE_VC_DT_CFG) {
+		CAM_ERR(CAM_ISP, "invalid num_valid_vc_dt: %d",
+			num_valid_vc_dt);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_valid_vc_dt; i++) {
+		if (vc[i] != cid_data->vc_dt[i].vc ||
+			dt[i] != cid_data->vc_dt[i].dt)
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
+static void cam_tfe_csid_enable_path_for_init_frame_drop(
+	struct cam_tfe_csid_hw *csid_hw,
+	int res_id)
+{
+	struct cam_tfe_csid_path_cfg             *path_data;
+	const struct cam_tfe_csid_pxl_reg_offset *pxl_reg = NULL;
+	const struct cam_tfe_csid_rdi_reg_offset *rdi_reg = NULL;
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	struct cam_isp_resource_node             *res;
+	uint32_t val;
+
+	if (!csid_hw) {
+		CAM_WARN(CAM_ISP, "csid_hw cannot be NULL");
+		return;
+	}
+
+	csid_reg  = csid_hw->csid_info->csid_reg;
+	soc_info  = &csid_hw->hw_info->soc_info;
+
+	if (res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+		res = &csid_hw->ipp_res;
+		pxl_reg = csid_reg->ipp_reg;
+	} else if (res_id == CAM_TFE_CSID_PATH_RES_PPP) {
+		res = &csid_hw->ppp_res;
+		pxl_reg = csid_reg->ppp_reg;
+	} else if (res_id >= CAM_TFE_CSID_PATH_RES_RDI_0 &&
+			res_id <= CAM_TFE_CSID_PATH_RES_RDI_2) {
+		res = &csid_hw->rdi_res[res_id];
+		rdi_reg = csid_reg->rdi_reg[res_id];
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res_id");
+		return;
+	}
+
+	path_data = (struct cam_tfe_csid_path_cfg *)res->res_priv;
+
+	if (!path_data || !path_data->init_frame_drop)
+		return;
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING)
+		return;
+
+	path_data->res_sof_cnt++;
+	if ((path_data->res_sof_cnt + 1) <
+			path_data->res_sof_cnt) {
+		CAM_WARN(CAM_ISP, "Res %d sof count overflow %d",
+			res_id, path_data->res_sof_cnt);
+		return;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id %d SOF cnt:%d init_frame_drop:%d",
+		csid_hw->hw_intf->hw_idx, res_id, path_data->res_sof_cnt,
+		path_data->init_frame_drop);
+
+	if ((path_data->res_sof_cnt ==
+		path_data->init_frame_drop) &&
+		pxl_reg) {
+		CAM_DBG(CAM_ISP, "CSID:%d Enabling pixel %s Path",
+			csid_hw->hw_intf->hw_idx,
+			(res_id == CAM_TFE_CSID_PATH_RES_IPP) ? "IPP" : "PPP");
+		if (path_data->sync_mode !=
+			CAM_ISP_HW_SYNC_SLAVE) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_ctrl_addr);
+			val |= CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY;
+			cam_io_w_mb(val,
+				soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_ctrl_addr);
+		}
+
+		if (!(csid_hw->csid_debug &
+				TFE_CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_irq_mask_addr);
+			val &= ~(TFE_CSID_PATH_INFO_INPUT_SOF);
+			cam_io_w_mb(val,
+				soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_irq_mask_addr);
+		}
+	} else if ((path_data->res_sof_cnt ==
+		path_data->init_frame_drop) && rdi_reg) {
+		CAM_DBG(CAM_ISP, "Enabling RDI %d Path", res_id);
+		cam_io_w_mb(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY,
+			soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_ctrl_addr);
+		if (!(csid_hw->csid_debug &
+				TFE_CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				rdi_reg->csid_rdi_irq_mask_addr);
+			val &= ~(TFE_CSID_PATH_INFO_INPUT_SOF);
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				rdi_reg->csid_rdi_irq_mask_addr);
+		}
+	}
+}
+
+static bool cam_tfe_csid_check_path_active(struct cam_tfe_csid_hw   *csid_hw)
+{
+	const struct cam_tfe_csid_reg_offset  *csid_reg;
+	struct cam_hw_soc_info                *soc_info;
+	uint32_t i;
+	uint32_t path_status = 1;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	/* check the IPP path status */
+	if (csid_reg->cmn_reg->num_pix) {
+		path_status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_status_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d IPP path status:%d",
+			csid_hw->hw_intf->hw_idx, path_status);
+		/* if status is 0 then it is active */
+		if (!path_status)
+			goto end;
+	}
+
+	/* check the PPP path status */
+	if (csid_reg->cmn_reg->num_ppp) {
+		path_status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_status_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d PPP path status:%d",
+			csid_hw->hw_intf->hw_idx, path_status);
+		/* if status is 0 then it is active */
+		if (!path_status)
+			goto end;
+	}
+
+	/* Check the RDI path status */
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		path_status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_status_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d RDI:%d path status:%d",
+			csid_hw->hw_intf->hw_idx, i,  path_status);
+		/* if status is 0 then it is active */
+		if (!path_status)
+			goto end;
+	}
+
+end:
+	/* if status is 0 then path is active */
+	return path_status ? false : true;
+}
+
+static void cam_tfe_csid_reset_path_data(
+	struct cam_tfe_csid_hw       *csid_hw,
+	struct cam_isp_resource_node *res)
+{
+	struct cam_tfe_csid_path_cfg *path_data = NULL;
+
+	if (!csid_hw || !res) {
+		CAM_WARN(CAM_ISP, "csid_hw or res cannot be NULL");
+		return;
+	}
+	path_data = res->res_priv;
+
+	if (path_data) {
+		path_data->init_frame_drop = 0;
+		path_data->res_sof_cnt     = 0;
+	}
+}
+
+static int cam_tfe_csid_cid_get(struct cam_tfe_csid_hw *csid_hw,
+	int32_t *vc, uint32_t *dt, uint32_t num_valid_vc_dt,  uint32_t *cid)
+{
+	uint32_t  i = 0, j = 0;
+
+	if (num_valid_vc_dt == 0 || num_valid_vc_dt > CAM_ISP_TFE_VC_DT_CFG) {
+		CAM_ERR(CAM_ISP, "CSID:%d invalid num_valid_vc_dt: %d",
+			csid_hw->hw_intf->hw_idx, num_valid_vc_dt);
+		return -EINVAL;
+	}
+
+
+	/* Return already reserved CID if the VC/DT matches */
+	for (i = 0; i < CAM_TFE_CSID_CID_MAX; i++) {
+		if (csid_hw->cid_res[i].cnt >= 1) {
+			if (!cam_tfe_match_vc_dt_pair(vc, dt, num_valid_vc_dt,
+				&csid_hw->cid_res[i])) {
+				csid_hw->cid_res[i].cnt++;
+				*cid = i;
+				CAM_DBG(CAM_ISP, "CSID:%d CID %d allocated",
+					csid_hw->hw_intf->hw_idx, i);
+				return 0;
+			}
+		}
+	}
+
+	for (i = 0; i < CAM_TFE_CSID_CID_MAX; i++) {
+		if (!csid_hw->cid_res[i].cnt) {
+			for (j = 0; j < num_valid_vc_dt; j++) {
+				csid_hw->cid_res[i].vc_dt[j].vc  = vc[j];
+				csid_hw->cid_res[i].vc_dt[j].dt  = dt[j];
+				csid_hw->cid_res[i].num_valid_vc_dt++;
+				csid_hw->cid_res[i].cnt++;
+			}
+			*cid = i;
+			CAM_DBG(CAM_ISP, "CSID:%d CID %d allocated",
+				csid_hw->hw_intf->hw_idx, i);
+			return 0;
+		}
+	}
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d Free cid is not available",
+		 csid_hw->hw_intf->hw_idx);
+	/* Dump CID values */
+	for (i = 0; i < CAM_TFE_CSID_CID_MAX; i++) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d CID:%d vc:%d dt:%d cnt:%d",
+			csid_hw->hw_intf->hw_idx, i,
+			csid_hw->cid_res[i].vc_dt[0].vc,
+			csid_hw->cid_res[i].vc_dt[0].dt,
+			csid_hw->cid_res[i].cnt);
+	}
+	return -EINVAL;
+}
+
+static int cam_tfe_csid_global_reset(struct cam_tfe_csid_hw *csid_hw)
+{
+	struct cam_hw_soc_info                *soc_info;
+	const struct cam_tfe_csid_reg_offset  *csid_reg;
+	struct cam_tfe_csid_path_cfg          *path_data = NULL;
+	int rc = 0;
+	uint32_t val = 0, i;
+	uint32_t status;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid HW State:%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d Csid reset", csid_hw->hw_intf->hw_idx);
+
+	/* Mask all interrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_mask_addr);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_mask_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_mask_addr);
+
+	/* clear all interrupts */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+
+	cam_io_w_mb(csid_reg->csi2_reg->csi2_irq_mask_all,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_clear_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(csid_reg->cmn_reg->ppp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_clear_addr);
+
+	for (i = 0 ; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->rdi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_clear_addr);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	cam_io_w_mb(0x80, soc_info->reg_map[0].mem_base +
+		csid_hw->csid_info->csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+
+	/* perform the top CSID HW registers reset */
+	cam_io_w_mb(csid_reg->cmn_reg->csid_rst_stb,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_rst_strobes_addr);
+
+	rc = cam_common_read_poll_timeout(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_status_addr,
+		CAM_TFE_CSID_TIMEOUT_SLEEP_US, CAM_TFE_CSID_TIMEOUT_ALL_US,
+		0x1, 0x1, &status);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d csid_reset fail rc = %d",
+			  csid_hw->hw_intf->hw_idx, rc);
+		rc = -ETIMEDOUT;
+	}
+
+	status = cam_io_r(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_status_addr);
+	CAM_DBG(CAM_ISP, "Status reg %d", status);
+
+	/* perform the SW registers reset */
+	reinit_completion(&csid_hw->csid_top_complete);
+	cam_io_w_mb(csid_reg->cmn_reg->csid_reg_rst_stb,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_rst_strobes_addr);
+
+	rc = cam_common_wait_for_completion_timeout(
+			&csid_hw->csid_top_complete,
+			msecs_to_jiffies(TFE_CSID_TIMEOUT));
+	if (rc <= 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d soft reg reset fail rc = %d",
+			 csid_hw->hw_intf->hw_idx, rc);
+		if (rc == 0)
+			rc = -ETIMEDOUT;
+	} else
+		rc = 0;
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+	if (val != 0)
+		CAM_ERR(CAM_ISP, "CSID:%d IRQ value after reset rc = %d",
+			csid_hw->hw_intf->hw_idx, val);
+	csid_hw->error_irq_count = 0;
+	csid_hw->prev_boot_timestamp = 0;
+
+	if (csid_hw->pxl_pipe_enable) {
+		path_data = (struct cam_tfe_csid_path_cfg *)
+			csid_hw->ipp_res.res_priv;
+		path_data->res_sof_cnt = 0;
+	}
+
+	if (csid_reg->cmn_reg->num_ppp) {
+		path_data = (struct cam_tfe_csid_path_cfg *)
+			csid_hw->ppp_res.res_priv;
+		path_data->res_sof_cnt = 0;
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		path_data = (struct cam_tfe_csid_path_cfg  *)
+			csid_hw->rdi_res[i].res_priv;
+		path_data->res_sof_cnt = 0;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_path_reset(struct cam_tfe_csid_hw *csid_hw,
+	struct cam_tfe_csid_reset_cfg_args  *reset)
+{
+	int rc = 0;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_isp_resource_node              *res;
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	uint32_t  reset_strb_addr, reset_strb_val, val, id;
+	struct completion  *complete;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	res      = reset->node_res;
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid hw state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d resource:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+		if (!csid_reg->ipp_reg) {
+			CAM_ERR(CAM_ISP, "CSID:%d IPP not supported :%d",
+				 csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			return -EINVAL;
+		}
+
+		reset_strb_addr = csid_reg->ipp_reg->csid_pxl_rst_strobes_addr;
+		complete = &csid_hw->csid_ipp_complete;
+		reset_strb_val = csid_reg->cmn_reg->ipp_path_rst_stb_all;
+
+		/* Enable path reset done interrupt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+		val |= TFE_CSID_PATH_INFO_RST_DONE;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			 csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+	} else if (res->res_id == CAM_TFE_CSID_PATH_RES_PPP) {
+		if (!csid_reg->ppp_reg) {
+			CAM_ERR(CAM_ISP, "CSID:%d PPP not supported :%d",
+				 csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			return -EINVAL;
+		}
+
+		reset_strb_addr = csid_reg->ppp_reg->csid_pxl_rst_strobes_addr;
+		complete = &csid_hw->csid_ppp_complete;
+		reset_strb_val = csid_reg->cmn_reg->ppp_path_rst_stb_all;
+
+		/* Enable path reset done interrupt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_mask_addr);
+		val |= TFE_CSID_PATH_INFO_RST_DONE;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			 csid_reg->ppp_reg->csid_pxl_irq_mask_addr);
+	} else {
+		id = res->res_id;
+		if (!csid_reg->rdi_reg[id]) {
+			CAM_ERR(CAM_ISP, "CSID:%d RDI res not supported :%d",
+				 csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			return -EINVAL;
+		}
+
+		reset_strb_addr =
+			csid_reg->rdi_reg[id]->csid_rdi_rst_strobes_addr;
+		complete =
+			&csid_hw->csid_rdin_complete[id];
+		reset_strb_val = csid_reg->cmn_reg->rdi_path_rst_stb_all;
+
+		/* Enable path reset done interrupt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+		val |= TFE_CSID_PATH_INFO_RST_DONE;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+	}
+
+	reinit_completion(complete);
+
+	/* Reset the corresponding tfe csid path */
+	cam_io_w_mb(reset_strb_val, soc_info->reg_map[0].mem_base +
+				reset_strb_addr);
+
+	rc = cam_common_wait_for_completion_timeout(complete,
+		msecs_to_jiffies(TFE_CSID_TIMEOUT));
+	if (rc <= 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d Res id %d fail rc = %d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_id,  rc);
+		if (rc == 0)
+			rc = -ETIMEDOUT;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_tfe_csid_cid_reserve(struct cam_tfe_csid_hw *csid_hw,
+	struct cam_tfe_csid_hw_reserve_resource_args  *cid_reserv,
+	uint32_t  *cid_value)
+{
+	int i,  rc = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+
+	CAM_DBG(CAM_ISP,
+		"CSID:%d res_id:0x%x Lane type:%d lane_num:%d dt:%d vc:%d, is_EPD: %d",
+		csid_hw->hw_intf->hw_idx,
+		cid_reserv->in_port->res_id,
+		cid_reserv->in_port->lane_type,
+		cid_reserv->in_port->lane_num,
+		cid_reserv->in_port->dt[0],
+		cid_reserv->in_port->vc[0],
+		cid_reserv->in_port->epd_supported);
+
+	if (cid_reserv->in_port->res_id >= CAM_ISP_TFE_IN_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d  Invalid phy sel %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cid_reserv->in_port->lane_type >= CAM_ISP_LANE_TYPE_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d  Invalid lane type %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->lane_type);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((cid_reserv->in_port->lane_type ==  CAM_ISP_LANE_TYPE_DPHY &&
+		cid_reserv->in_port->lane_num > 4)) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid lane num %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->lane_num);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cid_reserv->in_port->lane_type == CAM_ISP_LANE_TYPE_CPHY &&
+		cid_reserv->in_port->lane_num > 3) {
+		CAM_ERR(CAM_ISP, " CSID:%d Invalid lane type %d & num %d",
+			 csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->lane_type,
+			cid_reserv->in_port->lane_num);
+		rc = -EINVAL;
+		goto end;
+	}
+	/* CSID  CSI2 v1.1 supports 4 vc  */
+	for (i = 0; i < cid_reserv->in_port->num_valid_vc_dt; i++) {
+		if (cid_reserv->in_port->dt[i] > 0x3f ||
+			cid_reserv->in_port->vc[i] > 0x1f) {
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d dt %d",
+				csid_hw->hw_intf->hw_idx,
+				cid_reserv->in_port->vc[i],
+				cid_reserv->in_port->dt[i]);
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	if (csid_hw->csi2_reserve_cnt == UINT_MAX) {
+		CAM_ERR(CAM_ISP,
+			"CSID%d reserve cnt reached max",
+			csid_hw->hw_intf->hw_idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "Reserve_cnt %u", csid_hw->csi2_reserve_cnt);
+
+	if (csid_hw->csi2_reserve_cnt) {
+		/* current configure res type should match requested res type */
+		if (csid_hw->in_res_id != cid_reserv->in_port->res_id) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (csid_hw->csi2_rx_cfg.lane_cfg !=
+			cid_reserv->in_port->lane_cfg  ||
+			csid_hw->csi2_rx_cfg.lane_type !=
+			cid_reserv->in_port->lane_type ||
+			csid_hw->csi2_rx_cfg.lane_num !=
+			cid_reserv->in_port->lane_num) {
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	rc = cam_tfe_csid_cid_get(csid_hw,
+		cid_reserv->in_port->vc,
+		cid_reserv->in_port->dt,
+		cid_reserv->in_port->num_valid_vc_dt,
+		cid_value);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d CID Reserve failed res_id %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->res_id);
+		goto end;
+	}
+
+	if (!csid_hw->csi2_reserve_cnt) {
+		csid_hw->in_res_id = cid_reserv->in_port->res_id;
+
+		csid_hw->csi2_rx_cfg.lane_cfg =
+			cid_reserv->in_port->lane_cfg;
+		csid_hw->csi2_rx_cfg.lane_type =
+			cid_reserv->in_port->lane_type;
+		csid_hw->csi2_rx_cfg.lane_num =
+			cid_reserv->in_port->lane_num;
+		if (cid_reserv->in_port->epd_supported)
+			csid_hw->csi2_rx_cfg.epd_supported = 1;
+
+		switch (cid_reserv->in_port->res_id) {
+		case CAM_ISP_TFE_IN_RES_TPG:
+			csid_hw->csi2_rx_cfg.phy_sel = 0;
+			break;
+		case CAM_ISP_TFE_IN_RES_CPHY_TPG_0:
+		case CAM_ISP_TFE_IN_RES_CPHY_TPG_1:
+		case CAM_ISP_TFE_IN_RES_CPHY_TPG_2:
+			csid_reg = csid_hw->csid_info->csid_reg;
+			csid_hw->csi2_rx_cfg.phy_sel =
+				((cid_reserv->in_port->res_id & 0xFF) -
+				CAM_ISP_TFE_IN_RES_CPHY_TPG_0) +
+				csid_reg->csi2_reg->phy_tpg_base_id;
+			break;
+		default:
+			csid_hw->csi2_rx_cfg.phy_sel =
+			    (cid_reserv->in_port->res_id & 0xFF) - 1;
+		    break;
+		}
+	}
+
+	csid_hw->csi2_reserve_cnt++;
+	CAM_DBG(CAM_ISP, "CSID:%d CID:%d acquired reserv cnt:%d phy_sel: %d res_id: %d",
+		csid_hw->hw_intf->hw_idx, *cid_value,
+		csid_hw->csi2_reserve_cnt,
+		csid_hw->csi2_rx_cfg.phy_sel,
+		cid_reserv->in_port->res_id);
+
+end:
+	return rc;
+}
+
+static int cam_tfe_csid_path_reserve(struct cam_tfe_csid_hw *csid_hw,
+	struct cam_tfe_csid_hw_reserve_resource_args  *reserve)
+{
+	int i, rc = 0;
+	struct cam_tfe_csid_path_cfg    *path_data;
+	struct cam_isp_resource_node    *res;
+	uint32_t          cid_value;
+
+	if (reserve->in_port->num_valid_vc_dt == 0 ||
+		reserve->in_port->num_valid_vc_dt > CAM_ISP_TFE_VC_DT_CFG) {
+		CAM_ERR(CAM_ISP, "CSID:%d invalid num_valid_vc_dt: %d",
+			csid_hw->hw_intf->hw_idx,
+			reserve->in_port->num_valid_vc_dt);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* CSID  CSI2 v2.0 supports 4 vc */
+	for (i = 0; i < reserve->in_port->num_valid_vc_dt; i++) {
+		if (reserve->in_port->dt[i] > 0x3f ||
+			reserve->in_port->vc[i] > 0x1f ||
+			(reserve->sync_mode >= CAM_ISP_HW_SYNC_MAX)) {
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d dt %d mode:%d",
+				csid_hw->hw_intf->hw_idx,
+				reserve->in_port->vc[i],
+				reserve->in_port->dt[i],
+				reserve->sync_mode);
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	switch (reserve->res_id) {
+	case CAM_TFE_CSID_PATH_RES_IPP:
+		if (csid_hw->ipp_res.res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d IPP resource not available %d",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->ipp_res.res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (cam_tfe_csid_is_ipp_ppp_format_supported(
+				reserve->in_port->format)) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%d res id:%d un support format %d",
+				csid_hw->hw_intf->hw_idx, reserve->res_id,
+				reserve->in_port->format);
+			rc = -EINVAL;
+			goto end;
+		}
+		rc = cam_tfe_csid_cid_reserve(csid_hw, reserve, &cid_value);
+		if (rc)
+			goto end;
+
+		/* assign the IPP resource */
+		res = &csid_hw->ipp_res;
+		CAM_DBG(CAM_ISP,
+			"CSID:%d IPP resource:%d acquired successfully",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+
+		break;
+
+	case CAM_TFE_CSID_PATH_RES_PPP:
+		if (csid_hw->ppp_res.res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d PPP resource not available %d",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->ppp_res.res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (cam_tfe_csid_is_ipp_ppp_format_supported(
+				reserve->in_port->format)) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%d res id:%d un support format %d",
+				csid_hw->hw_intf->hw_idx, reserve->res_id,
+				reserve->in_port->format);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		rc = cam_tfe_csid_cid_reserve(csid_hw, reserve, &cid_value);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%d res id:%d invalid cid %d",
+			       csid_hw->hw_intf->hw_idx, reserve->res_id, cid_value);
+			goto end;
+		}
+
+		/* assign the PPP resource */
+		res = &csid_hw->ppp_res;
+		CAM_DBG(CAM_ISP,
+			"CSID:%d PPP resource:%d acquired successfully",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+
+		break;
+
+	case CAM_TFE_CSID_PATH_RES_RDI_0:
+	case CAM_TFE_CSID_PATH_RES_RDI_1:
+	case CAM_TFE_CSID_PATH_RES_RDI_2:
+		if (csid_hw->rdi_res[reserve->res_id].res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%d RDI:%d resource not available %d",
+				csid_hw->hw_intf->hw_idx,
+				reserve->res_id,
+				csid_hw->rdi_res[reserve->res_id].res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		rc = cam_tfe_csid_cid_reserve(csid_hw, reserve, &cid_value);
+		if (rc)
+			goto end;
+
+		res = &csid_hw->rdi_res[reserve->res_id];
+		CAM_DBG(CAM_ISP,
+			"CSID:%d RDI resource:%d acquire success",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id);
+
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id:%d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	path_data = (struct cam_tfe_csid_path_cfg   *)res->res_priv;
+
+	CAM_DBG(CAM_ISP, "sensor width:%d height:%d fps:%d vbi:%d hbi:%d",
+		reserve->in_port->sensor_width,
+		reserve->in_port->sensor_height,
+		reserve->in_port->sensor_fps,
+		reserve->in_port->sensor_vbi,
+		reserve->in_port->sensor_hbi);
+	path_data->sensor_width = reserve->in_port->sensor_width;
+	path_data->sensor_height = reserve->in_port->sensor_height;
+	path_data->sensor_fps  = reserve->in_port->sensor_fps;
+	path_data->sensor_hbi = reserve->in_port->sensor_vbi;
+	path_data->sensor_vbi = reserve->in_port->sensor_hbi;
+
+	path_data->cid = cid_value;
+	path_data->in_format = reserve->in_port->format;
+	path_data->out_format = reserve->out_port->format;
+	path_data->sync_mode = reserve->sync_mode;
+	path_data->height  = reserve->in_port->height;
+	path_data->start_line = reserve->in_port->line_start;
+	path_data->end_line = reserve->in_port->line_end;
+	path_data->usage_type = reserve->in_port->usage_type;
+
+	path_data->bayer_bin = reserve->in_port->bayer_bin;
+	path_data->qcfa_bin = reserve->in_port->qcfa_bin;
+	path_data->crop_enable = reserve->crop_enable;
+	path_data->is_shdr_master = reserve->in_port->is_shdr_master;
+	path_data->is_shdr = reserve->in_port->shdr_en;
+
+	csid_hw->event_cb = reserve->event_cb;
+	csid_hw->event_cb_priv = reserve->event_cb_prv;
+
+	if (path_data->qcfa_bin) {
+		if (!cam_cpas_is_feature_supported(CAM_CPAS_QCFA_BINNING_ENABLE,
+			CAM_CPAS_HW_IDX_ANY, NULL)) {
+			CAM_ERR(CAM_ISP, "QCFA bin not supported!");
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Res id: %d height:%d line_start %d line_end %d crop_en %d",
+		reserve->res_id, reserve->in_port->height,
+		reserve->in_port->line_start, reserve->in_port->line_end,
+		path_data->crop_enable);
+
+	path_data->num_valid_vc_dt = 0;
+
+	for (i = 0; i < reserve->in_port->num_valid_vc_dt; i++) {
+		path_data->vc_dt[i].vc = reserve->in_port->vc[i];
+		path_data->vc_dt[i].dt = reserve->in_port->dt[i];
+		path_data->num_valid_vc_dt++;
+	}
+
+	if (reserve->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+		path_data->start_pixel = reserve->in_port->left_start;
+		path_data->end_pixel = reserve->in_port->left_end;
+		path_data->width  = reserve->in_port->left_width;
+		CAM_DBG(CAM_ISP, "CSID:%d master:startpixel 0x%x endpixel:0x%x",
+			csid_hw->hw_intf->hw_idx, path_data->start_pixel,
+			path_data->end_pixel);
+		CAM_DBG(CAM_ISP, "CSID:%d master:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, path_data->start_line,
+			path_data->end_line);
+	} else if (reserve->sync_mode == CAM_ISP_HW_SYNC_SLAVE) {
+		path_data->master_idx = reserve->master_idx;
+		CAM_DBG(CAM_ISP, "CSID:%d master_idx=%d",
+			csid_hw->hw_intf->hw_idx, path_data->master_idx);
+		path_data->start_pixel = reserve->in_port->right_start;
+		path_data->end_pixel = reserve->in_port->right_end;
+		path_data->width  = reserve->in_port->right_width;
+		CAM_DBG(CAM_ISP, "CSID:%d slave:start:0x%x end:0x%x width 0x%x",
+			csid_hw->hw_intf->hw_idx, path_data->start_pixel,
+			path_data->end_pixel, path_data->width);
+		CAM_DBG(CAM_ISP, "CSID:%d slave:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, path_data->start_line,
+			path_data->end_line);
+	} else {
+		path_data->width  = reserve->in_port->left_width;
+		path_data->start_pixel = reserve->in_port->left_start;
+		path_data->end_pixel = reserve->in_port->left_end;
+		CAM_DBG(CAM_ISP, "Res id: %d left width %d start: %d stop:%d",
+			reserve->res_id, reserve->in_port->left_width,
+			reserve->in_port->left_start,
+			reserve->in_port->left_end);
+	}
+
+	CAM_DBG(CAM_ISP, "Res %d width %d height %d", reserve->res_id,
+		path_data->width, path_data->height);
+	reserve->node_res = res;
+
+end:
+	return rc;
+}
+
+static int cam_tfe_csid_enable_csi2(
+	struct cam_tfe_csid_hw          *csid_hw)
+{
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_csid_ppi_cfg                     ppi_lane_cfg;
+	uint32_t val = 0;
+	uint32_t ppi_index = 0, rc;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	CAM_DBG(CAM_ISP, "CSID:%d config csi2 rx",
+		csid_hw->hw_intf->hw_idx);
+
+	/* rx cfg0 */
+	val = 0;
+	val = (csid_hw->csi2_rx_cfg.lane_num - 1)  |
+		(csid_hw->csi2_rx_cfg.lane_cfg << 4) |
+		(csid_hw->csi2_rx_cfg.lane_type << 24);
+	val |= (csid_hw->csi2_rx_cfg.phy_sel &
+		csid_reg->csi2_reg->csi2_rx_phy_num_mask) << 20;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg0_addr);
+
+	if (csid_hw->in_res_id >= CAM_ISP_TFE_IN_RES_CPHY_TPG_0 &&
+		csid_hw->in_res_id <= CAM_ISP_TFE_IN_RES_CPHY_TPG_2 &&
+		csid_reg->csi2_reg->need_to_sel_tpg_mux) {
+		cam_cpas_enable_tpg_mux_sel(csid_hw->in_res_id -
+			CAM_ISP_TFE_IN_RES_CPHY_TPG_0);
+	}
+
+	/* rx cfg1 */
+	val = (1 << csid_reg->csi2_reg->csi2_misr_enable_shift_val);
+
+	/* enable vc mode to configure vc with value more than 3 */
+	val |= (1 << csid_reg->csi2_reg->csi2_vc_mode_shift_val);
+
+	/* enable packet ecc correction */
+	val |= 1;
+	/* enable epd mode */
+	if (csid_hw->csi2_rx_cfg.epd_supported)
+		val |= (csid_hw->csi2_rx_cfg.epd_supported <<
+			csid_reg->csi2_reg->csi2_rx_epd_mode_shift_en);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+
+	/* Enable the CSI2 rx inerrupts */
+	val = TFE_CSID_CSI2_RX_INFO_RST_DONE |
+		TFE_CSID_CSI2_RX_ERROR_LANE0_FIFO_OVERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_LANE1_FIFO_OVERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_LANE2_FIFO_OVERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_LANE3_FIFO_OVERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION |
+		TFE_CSID_CSI2_RX_ERROR_CPHY_SOT_RECEPTION |
+		TFE_CSID_CSI2_RX_ERROR_CRC |
+		TFE_CSID_CSI2_RX_ERROR_ECC |
+		TFE_CSID_CSI2_RX_ERROR_MMAPPED_VC_DT |
+		TFE_CSID_CSI2_RX_ERROR_STREAM_UNDERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_UNBOUNDED_FRAME |
+		TFE_CSID_CSI2_RX_ERROR_CPHY_PH_CRC;
+
+	if (csid_hw->csi2_rx_cfg.epd_supported &&
+		(csid_hw->csi2_rx_cfg.lane_type == CAM_ISP_LANE_TYPE_DPHY))
+		val &= ~TFE_CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION;
+
+	/* Enable the interrupt based on csid debug info set */
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOT_IRQ)
+		val |= TFE_CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED;
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOT_IRQ)
+		val |= TFE_CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED;
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val |= TFE_CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED;
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+		val |= TFE_CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED;
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+		val |= TFE_CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+	/*
+	 * There is one to one mapping for ppi index with phy index
+	 * we do not always update phy sel equal to phy number,for some
+	 * targets "phy_sel = phy_num + 1", and for some targets it is
+	 * "phy_sel = phy_num", ppi_index should be updated accordingly
+	 */
+	ppi_index = csid_hw->csi2_rx_cfg.phy_sel - csid_reg->csi2_reg->phy_sel_base;
+
+	if (csid_hw->ppi_enable && csid_hw->ppi_hw_intf[ppi_index]) {
+		ppi_lane_cfg.lane_type = csid_hw->csi2_rx_cfg.lane_type;
+		ppi_lane_cfg.lane_num  = csid_hw->csi2_rx_cfg.lane_num;
+		ppi_lane_cfg.lane_cfg  = csid_hw->csi2_rx_cfg.lane_cfg;
+
+		CAM_DBG(CAM_ISP, "ppi_index to init %d", ppi_index);
+		rc = csid_hw->ppi_hw_intf[ppi_index]->hw_ops.init(
+				csid_hw->ppi_hw_intf[ppi_index]->hw_priv,
+				&ppi_lane_cfg,
+				sizeof(struct cam_csid_ppi_cfg));
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "PPI:%d Init Failed",
+					ppi_index);
+			return rc;
+		}
+	}
+
+
+	return 0;
+}
+
+static int cam_tfe_csid_disable_csi2(
+	struct cam_tfe_csid_hw          *csid_hw)
+{
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	uint32_t ppi_index = 0, rc;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	CAM_DBG(CAM_ISP, "CSID:%d Disable csi2 rx",
+		csid_hw->hw_intf->hw_idx);
+
+	/* Disable the CSI2 rx inerrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+	/* Reset the Rx CFG registers */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg0_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+
+	ppi_index = csid_hw->csi2_rx_cfg.phy_sel - csid_reg->csi2_reg->phy_sel_base;
+	if (csid_hw->ppi_enable && csid_hw->ppi_hw_intf[ppi_index]) {
+		/* De-Initialize the PPI bridge */
+		CAM_DBG(CAM_ISP, "ppi_index to de-init %d\n", ppi_index);
+		rc = csid_hw->ppi_hw_intf[ppi_index]->hw_ops.deinit(
+				csid_hw->ppi_hw_intf[ppi_index]->hw_priv,
+				NULL, 0);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "PPI:%d De-Init Failed", ppi_index);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_tfe_csid_enable_hw(struct cam_tfe_csid_hw  *csid_hw)
+{
+	int rc = 0;
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_tfe_csid_path_cfg              *path_data = NULL;
+	uint32_t i, val, clk_lvl;
+	unsigned long flags;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	/* overflow check before increment */
+	if (csid_hw->hw_info->open_count == UINT_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Open count reached max",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	/* Increment ref Count */
+	csid_hw->hw_info->open_count++;
+	if (csid_hw->hw_info->open_count > 1) {
+		CAM_DBG(CAM_ISP, "CSID hw has already been enabled");
+		return rc;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d init CSID HW",
+		csid_hw->hw_intf->hw_idx);
+
+	rc = cam_soc_util_get_clk_level(soc_info, csid_hw->clk_rate,
+		soc_info->src_clk_idx, &clk_lvl);
+	CAM_DBG(CAM_ISP, "CSID clock lvl %u", clk_lvl);
+
+	rc = cam_tfe_csid_enable_soc_resources(soc_info, clk_lvl);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d Enable SOC failed",
+			csid_hw->hw_intf->hw_idx);
+		goto err;
+	}
+
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_UP;
+	/* Disable the top IRQ interrupt */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_mask_addr);
+	/* Reset CSID top */
+	rc = cam_tfe_csid_global_reset(csid_hw);
+	if (rc)
+		goto disable_soc;
+
+	/* clear all interrupts */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+
+	cam_io_w_mb(csid_reg->csi2_reg->csi2_irq_mask_all,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_clear_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_clear_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->rdi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_clear_addr);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_hw_version_addr);
+	CAM_DBG(CAM_ISP, "CSID:%d CSID HW version: 0x%x",
+		csid_hw->hw_intf->hw_idx, val);
+
+	/* enable the csi2 rx */
+	rc = cam_tfe_csid_enable_csi2(csid_hw);
+	if (rc)
+		goto disable_soc;
+
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	csid_hw->fatal_err_detected = false;
+	csid_hw->device_enabled = 1;
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+	cam_tasklet_start(csid_hw->tasklet);
+
+	if (csid_hw->pxl_pipe_enable ) {
+		path_data = (struct cam_tfe_csid_path_cfg  *)
+			csid_hw->ipp_res.res_priv;
+		path_data->res_sof_cnt = 0;
+	}
+
+	if (csid_reg->cmn_reg->num_ppp) {
+		path_data = (struct cam_tfe_csid_path_cfg  *)
+			csid_hw->ppp_res.res_priv;
+		path_data->res_sof_cnt = 0;
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		path_data = (struct cam_tfe_csid_path_cfg *)
+			csid_hw->rdi_res[i].res_priv;
+		path_data->res_sof_cnt = 0;
+	}
+
+
+	return rc;
+
+disable_soc:
+	cam_tfe_csid_disable_soc_resources(soc_info);
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+err:
+	csid_hw->hw_info->open_count--;
+	return rc;
+}
+
+static int cam_tfe_csid_disable_hw(struct cam_tfe_csid_hw *csid_hw)
+{
+	int rc = -EINVAL;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	unsigned long                             flags;
+
+	/* Check for refcount */
+	if (!csid_hw->hw_info->open_count) {
+		CAM_WARN(CAM_ISP, "Unbalanced disable_hw");
+		return rc;
+	}
+
+	/* Decrement ref Count */
+	csid_hw->hw_info->open_count--;
+
+	if (csid_hw->hw_info->open_count) {
+		rc = 0;
+		return rc;
+	}
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	/* Disable the csi2 */
+	cam_tfe_csid_disable_csi2(csid_hw);
+
+	CAM_DBG(CAM_ISP, "%s:Calling Global Reset", __func__);
+	cam_tfe_csid_global_reset(csid_hw);
+	CAM_DBG(CAM_ISP, "%s:Global Reset Done", __func__);
+
+	CAM_DBG(CAM_ISP, "CSID:%d De-init CSID HW",
+		csid_hw->hw_intf->hw_idx);
+
+	/* Disable the top IRQ interrupt */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_mask_addr);
+
+	cam_tasklet_stop(csid_hw->tasklet);
+
+	rc = cam_tfe_csid_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CSID:%d Disable CSID SOC failed",
+			csid_hw->hw_intf->hw_idx);
+
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	csid_hw->device_enabled = 0;
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	csid_hw->error_irq_count = 0;
+	csid_hw->prev_boot_timestamp = 0;
+
+	return rc;
+}
+
+static int cam_tfe_csid_init_config_pxl_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	struct cam_tfe_csid_path_cfg             *path_data;
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_tfe_csid_pxl_reg_offset *pxl_reg = NULL;
+	uint32_t decode_format = 0, plain_format = 0, val = 0;
+
+	path_data = (struct cam_tfe_csid_path_cfg  *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+		pxl_reg = csid_reg->ipp_reg;
+	else
+		pxl_reg = csid_reg->ppp_reg;
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d %s :%d is not supported on HW",
+			csid_hw->hw_intf->hw_idx,
+			(res->res_id == CAM_TFE_CSID_PATH_RES_IPP) ? "IPP" : "PPP",
+			res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Config %s Path",
+			(res->res_id == CAM_TFE_CSID_PATH_RES_IPP) ? "IPP" : "PPP");
+	rc = cam_tfe_csid_get_format_ipp_ppp(path_data->in_format,
+		&decode_format, &plain_format);
+	if (rc)
+		return rc;
+
+	/*
+	 * configure Pxl path and enable the time stamp capture.
+	 * enable the HW measrurement blocks
+	 */
+	val = (path_data->vc_dt[0].vc << csid_reg->cmn_reg->vc_shift_val) |
+		(path_data->vc_dt[0].dt << csid_reg->cmn_reg->dt_shift_val) |
+		(path_data->cid << csid_reg->cmn_reg->dt_id_shift_val) |
+		(decode_format << csid_reg->cmn_reg->fmt_shift_val) |
+		(path_data->crop_enable <<
+		csid_reg->cmn_reg->crop_h_en_shift_val) |
+		(path_data->crop_enable <<
+		csid_reg->cmn_reg->crop_v_en_shift_val) |
+		(1 << 1);
+
+	if (pxl_reg->binning_supported && (path_data->qcfa_bin ||
+		path_data->bayer_bin)) {
+
+		CAM_DBG(CAM_ISP,
+			"Set Binning mode, binning_supported: %d, qcfa_bin: %d, bayer_bin: %d",
+			pxl_reg->binning_supported, path_data->qcfa_bin,
+			path_data->bayer_bin);
+
+		if (path_data->bayer_bin && !(pxl_reg->binning_supported &
+			CAM_TFE_CSID_BIN_BAYER)) {
+			CAM_ERR(CAM_ISP,
+				"Bayer bin is not supported! binning_supported: %d",
+				pxl_reg->binning_supported);
+			return -EINVAL;
+		}
+
+		if (path_data->qcfa_bin && !(pxl_reg->binning_supported &
+			CAM_TFE_CSID_BIN_QCFA)) {
+			CAM_ERR(CAM_ISP,
+				"QCFA bin is not supported! binning_supported: %d",
+				pxl_reg->binning_supported);
+			return -EINVAL;
+		}
+
+		if (path_data->qcfa_bin && path_data->bayer_bin) {
+			CAM_ERR(CAM_ISP,
+				"Bayer bin and QCFA bin could not be enabled together!");
+			return -EINVAL;
+		}
+
+		if (path_data->bayer_bin)
+			val |= 1 << pxl_reg->bin_en_shift_val;
+
+		if (path_data->qcfa_bin) {
+			val |= 1 << pxl_reg->bin_qcfa_en_shift_val;
+			val |= 1 << pxl_reg->bin_en_shift_val;
+		}
+	}
+
+	if ((csid_reg->cmn_reg->format_measure_support && res->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+		|| (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO))
+		val |= (1 << pxl_reg->format_measure_en_shift_val);
+
+	val |= (1 << pxl_reg->pix_store_en_shift_val);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg0_addr);
+
+	if (pxl_reg->is_multi_vc_dt_supported &&
+		(path_data->num_valid_vc_dt > 1)) {
+		val = ((path_data->vc_dt[1].vc <<
+			csid_reg->cmn_reg->vc1_shift_val) |
+			(path_data->vc_dt[1].dt <<
+			csid_reg->cmn_reg->dt1_shift_val) |
+			1 << csid_reg->cmn_reg->multi_vc_dt_en_shift_val);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_multi_vcdt_cfg0_addr);
+	}
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg1_addr);
+
+	/* select the post irq sub sample strobe for time stamp capture */
+	val |= TFE_CSID_TIMESTAMP_STB_POST_IRQ;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg1_addr);
+
+	if (path_data->crop_enable) {
+		val = (((path_data->end_pixel & 0xFFFF) <<
+			csid_reg->cmn_reg->crop_shift) |
+			(path_data->start_pixel & 0xFFFF));
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_hcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Horizontal crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		val = (((path_data->end_line & 0xFFFF) <<
+			csid_reg->cmn_reg->crop_shift) |
+			(path_data->start_line & 0xFFFF));
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_vcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Vertical Crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		/* Enable generating early eof strobe based on crop config */
+		if (!(csid_hw->csid_debug & TFE_CSID_DEBUG_DISABLE_EARLY_EOF)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_cfg0_addr);
+			val |= (1 << pxl_reg->early_eof_en_shift_val);
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_cfg0_addr);
+		}
+	}
+
+	if (csid_reg->cmn_reg->format_measure_support &&
+		(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO)) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_format_measure_cfg0_addr);
+		val |= pxl_reg->measure_en_hbi_vbi_cnt_val;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_format_measure_cfg0_addr);
+	}
+
+	/* Enable the Pxl path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg0_addr);
+	val |= (1 << csid_reg->cmn_reg->path_en_shift_val);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg0_addr);
+
+	/* Enable Error Detection Overflow ctrl mode: 2 -> Detect overflow */
+	val = 0x9;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_err_recovery_cfg0_addr);
+
+	/* configure the rx packet capture based on csid debug set */
+	val = 0;
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val = ((1 <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_en_shift) |
+			(path_data->vc_dt[0].vc <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_en_shift) |
+			(path_data->vc_dt[0].dt <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_dt_shift) |
+			(path_data->vc_dt[0].vc <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_en_shift) |
+			(path_data->vc_dt[0].dt <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_dt_shift) |
+			(path_data->vc_dt[0].vc <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_vc_shift));
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_capture_ctrl_addr);
+	CAM_DBG(CAM_ISP, "rx capture control value 0x%x", val);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	return rc;
+}
+
+static int cam_tfe_csid_deinit_pxl_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	const struct cam_tfe_csid_pxl_reg_offset  *pxl_reg = NULL;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+		pxl_reg = csid_reg->ipp_reg;
+	else
+		pxl_reg = csid_reg->ppp_reg;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s Res type %d res_id:%d in wrong state %d",
+			csid_hw->hw_intf->hw_idx,
+			(res->res_id == CAM_TFE_CSID_PATH_RES_IPP) ? "IPP" : "PPP",
+			res->res_type, res->res_id, res->res_state);
+		rc = -EINVAL;
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d %s %d is not supported on HW",
+			csid_hw->hw_intf->hw_idx,
+			(res->res_id == CAM_TFE_CSID_PATH_RES_IPP) ? "IPP" : "PPP",
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Disable Error Recovery */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_err_recovery_cfg0_addr);
+
+end:
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_tfe_csid_enable_pxl_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	struct cam_tfe_csid_path_cfg             *path_data;
+	const struct cam_tfe_csid_pxl_reg_offset *pxl_reg = NULL;
+	uint32_t                                  val = 0;
+
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	pxl_reg = csid_reg->ipp_reg;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d IPP path res type:%d res_id:%d Invalid state%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d IPP resid: %d not supported on HW",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enable IPP path");
+
+	if ((path_data->is_shdr && path_data->is_shdr_master) ||
+		(path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER))
+		/* Set halt mode for master */
+		val = (TFE_CSID_HALT_MODE_MASTER << pxl_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_NONE << pxl_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY << pxl_reg->halt_cmd_shift);
+	else if ((path_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) ||
+			(path_data->is_shdr))
+		/* Set halt mode for slave */
+		val = (TFE_CSID_HALT_MODE_SLAVE << pxl_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_EXTERNAL << pxl_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY << pxl_reg->halt_cmd_shift);
+	else
+		/* Set halt mode for default */
+		val = (TFE_CSID_HALT_MODE_INTERNAL << pxl_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_NONE << pxl_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY << pxl_reg->halt_cmd_shift);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d sync_mode=%d IPP_Ctrl:0x%x is_shdr=%d shdr_master=%d",
+		csid_hw->hw_intf->hw_idx, path_data->sync_mode,
+		cam_io_r_mb(soc_info->reg_map[0].mem_base + pxl_reg->csid_pxl_ctrl_addr),
+		path_data->is_shdr, path_data->is_shdr_master);
+
+	/* Enable the required pxl path interrupts */
+	val = TFE_CSID_PATH_INFO_RST_DONE |
+		TFE_CSID_PATH_ERROR_FIFO_OVERFLOW |
+		TFE_CSID_PATH_IPP_ERROR_CCIF_VIOLATION |
+		TFE_CSID_PATH_IPP_OVERFLOW_IRQ;
+
+	if (csid_reg->cmn_reg->format_measure_support) {
+		val |= TFE_CSID_PATH_ERROR_PIX_COUNT |
+			TFE_CSID_PATH_ERROR_LINE_COUNT;
+	}
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ || path_data->init_frame_drop)
+		val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)
+		val |= TFE_CSID_PATH_INFO_INPUT_EOF;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_mask_addr);
+
+	CAM_DBG(CAM_ISP, "Enable IPP IRQ mask 0x%x", val);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_tfe_csid_change_pxl_halt_mode(
+	struct cam_tfe_csid_hw            *csid_hw,
+	struct cam_tfe_csid_hw_halt_args  *csid_halt)
+{
+	uint32_t val = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	const struct cam_tfe_csid_pxl_reg_offset   *pxl_reg;
+	struct cam_isp_resource_node               *res;
+
+	res = csid_halt->node_res;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id != CAM_TFE_CSID_PATH_RES_IPP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "CSID:%d Res:%d in invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	pxl_reg = csid_reg->ipp_reg;
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_mask_addr);
+
+	/* configure Halt for slave */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+	val &= ~0xC;
+	val |= (csid_halt->halt_mode << 2);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+	CAM_DBG(CAM_ISP, "CSID:%d IPP path Res halt mode:%d configured:%x",
+		csid_hw->hw_intf->hw_idx, csid_halt->halt_mode, val);
+
+	return 0;
+}
+
+static int cam_tfe_csid_disable_pxl_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_tfe_csid_halt_cmd       stop_cmd,
+	bool csid_with_ppp_en)
+{
+	int rc = 0;
+	uint32_t val = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_tfe_csid_path_cfg               *path_data;
+	const struct cam_tfe_csid_pxl_reg_offset   *pxl_reg;
+
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "CSID:%d Res:%d already in stopped state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return rc;
+	}
+
+	pxl_reg = csid_reg->ipp_reg;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_DBG(CAM_ISP, "CSID:%d IPP path Res:%d Invalid state%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d IPP %d is not supported on HW",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (stop_cmd != CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_TFE_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d IPP path un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id:%d IPP path",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_mask_addr);
+
+	path_data->init_frame_drop = 0;
+	path_data->res_sof_cnt     = 0;
+
+	if (((path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER) ||
+		(path_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)) && !csid_with_ppp_en)
+		/* Set halt mode for dual master/slave without pdaf */
+		val = (TFE_CSID_HALT_MODE_GLOBAL << pxl_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_EXTERNAL << pxl_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_HALT_IMMEDIATELY << pxl_reg->halt_cmd_shift);
+	else if ((path_data->is_shdr && path_data->is_shdr_master) ||
+		(path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER))
+		/* Set halt mode for shdr/dual master */
+		val = (TFE_CSID_HALT_MODE_MASTER << pxl_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_NONE << pxl_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY << pxl_reg->halt_cmd_shift);
+	else if ((path_data->is_shdr && !path_data->is_shdr_master) ||
+		(path_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)) {
+		/* Set halt mode for shdr/dual slave */
+		CAM_DBG(CAM_ISP, "skip programming halt mode for slave in %s case",
+			(path_data->is_shdr) ? "SHDR" : "Dual TFE");
+		goto end;
+	} else if (csid_with_ppp_en)
+		/* Set halt mode for single tfe + pdaf */
+		val = (TFE_CSID_HALT_MODE_INTERNAL << pxl_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_NONE << pxl_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY << pxl_reg->halt_cmd_shift);
+	else
+		/* Set halt mode for default */
+		val = (TFE_CSID_HALT_MODE_GLOBAL << pxl_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_EXTERNAL << pxl_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY << pxl_reg->halt_cmd_shift);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "halt CSID:%d sync_mode:%d res_id:%d IPP path pxl_ctrl=0x%x",
+		csid_hw->hw_intf->hw_idx, path_data->sync_mode, res->res_id,
+		cam_io_r_mb(soc_info->reg_map[0].mem_base + pxl_reg->csid_pxl_ctrl_addr));
+
+end:
+	return rc;
+}
+
+static int cam_tfe_csid_enable_ppp_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	struct cam_tfe_csid_path_cfg             *path_data;
+	const struct cam_tfe_csid_pxl_reg_offset *ppp_reg = NULL;
+	uint32_t                                  val = 0;
+
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	ppp_reg = csid_reg->ppp_reg;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d PPP path res type:%d res_id:%d Invalid state%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (!ppp_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d PPP resid: %d not supported on HW",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d Enable PPP path", csid_hw->hw_intf->hw_idx);
+
+	if ((path_data->is_shdr && path_data->is_shdr_master) ||
+		(path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER))
+		/* Set halt mode for master shdr/dual */
+		val = (TFE_CSID_HALT_MODE_SLAVE << ppp_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_INTERNAL1 << ppp_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY << ppp_reg->halt_cmd_shift);
+	else if ((path_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) ||
+			(path_data->is_shdr))
+		/* Set halt mode for slave shdr/dual*/
+		val = (TFE_CSID_HALT_MODE_SLAVE << ppp_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_INTERNAL2 << ppp_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY << ppp_reg->halt_cmd_shift);
+	else
+		/* Set halt mode for default */
+		val = (TFE_CSID_HALT_MODE_SLAVE << ppp_reg->halt_mode_shift) |
+			(TFE_CSID_HALT_CMD_SOURCE_INTERNAL1 << ppp_reg->halt_master_sel_shift) |
+			(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY << ppp_reg->halt_cmd_shift);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + ppp_reg->csid_pxl_ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d sync_mode:%d PPP Ctrl val: 0x%x",
+		csid_hw->hw_intf->hw_idx, path_data->sync_mode,
+		cam_io_r_mb(soc_info->reg_map[0].mem_base + ppp_reg->csid_pxl_ctrl_addr));
+
+	/* Enable the required ppp path interrupts */
+	val = TFE_CSID_PATH_INFO_RST_DONE | TFE_CSID_PATH_ERROR_FIFO_OVERFLOW |
+		TFE_CSID_PATH_PPP_ERROR_CCIF_VIOLATION | TFE_CSID_PATH_PPP_OVERFLOW_IRQ;
+
+	if (csid_reg->cmn_reg->format_measure_support)
+		val |= TFE_CSID_PATH_ERROR_PIX_COUNT | TFE_CSID_PATH_ERROR_LINE_COUNT;
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ || path_data->init_frame_drop)
+		val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)
+		val |= TFE_CSID_PATH_INFO_INPUT_EOF;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + ppp_reg->csid_pxl_irq_mask_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d Enable PPP IRQ mask 0x%x", csid_hw->hw_intf->hw_idx, val);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_tfe_csid_disable_ppp_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_tfe_csid_halt_cmd       stop_cmd)
+{
+	int rc = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_tfe_csid_path_cfg               *path_data;
+	const struct cam_tfe_csid_pxl_reg_offset   *ppp_reg;
+
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "CSID:%d Res:%d already in stopped state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return rc;
+	}
+
+	ppp_reg = csid_reg->ppp_reg;
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_DBG(CAM_ISP, "CSID:%d IPP path Res:%d Invalid state%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (!ppp_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d PPP %d is not supported on HW",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (stop_cmd != CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_TFE_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d PPP path un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id:%d PPP path",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		ppp_reg->csid_pxl_irq_mask_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id:%d Skip prgramming halt mode for PPP path",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	CAM_DBG(CAM_ISP, "CSID:%d sync_mode:%d res_id:%d PPP path halt_ctrl_reg=0x%x",
+		csid_hw->hw_intf->hw_idx, path_data->sync_mode, res->res_id,
+		cam_io_r_mb(soc_info->reg_map[0].mem_base + ppp_reg->csid_pxl_ctrl_addr));
+
+	path_data->init_frame_drop = 0;
+	path_data->res_sof_cnt     = 0;
+
+	return rc;
+}
+
+static int cam_tfe_csid_init_config_rdi_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	struct cam_tfe_csid_path_cfg             *path_data;
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	const struct cam_tfe_csid_rdi_reg_offset *rdi_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	uint32_t path_format = 0, plain_fmt = 0, val = 0, id;
+
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	id = res->res_id;
+	if (!csid_reg->rdi_reg[id]) {
+		CAM_ERR(CAM_ISP, "CSID:%d RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, id);
+		return -EINVAL;
+	}
+
+	rdi_reg = csid_reg->rdi_reg[id];
+	rc = cam_tfe_csid_get_format_rdi(path_data->in_format,
+		path_data->out_format, &path_format, &plain_fmt);
+	if (rc)
+		return rc;
+
+	/*
+	 * RDI path config and enable the time stamp capture
+	 * Enable the measurement blocks
+	 */
+	val = (path_data->vc_dt[0].vc << csid_reg->cmn_reg->vc_shift_val) |
+		(path_data->vc_dt[0].dt << csid_reg->cmn_reg->dt_shift_val) |
+		(path_data->cid << csid_reg->cmn_reg->dt_id_shift_val) |
+		(path_format << csid_reg->cmn_reg->fmt_shift_val) |
+		(plain_fmt << csid_reg->cmn_reg->plain_fmt_shit_val) |
+		(1 << 2) | 1;
+
+	if (csid_reg->cmn_reg->format_measure_support)
+		val |= (1 << rdi_reg->format_measure_en_shift_val);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+
+	if (csid_reg->rdi_reg[id]->is_multi_vc_dt_supported &&
+		(path_data->num_valid_vc_dt > 1)) {
+		val = ((path_data->vc_dt[1].vc <<
+			csid_reg->cmn_reg->vc1_shift_val) |
+			(path_data->vc_dt[1].dt <<
+			csid_reg->cmn_reg->dt1_shift_val) |
+			(1 << csid_reg->cmn_reg->multi_vc_dt_en_shift_val));
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_multi_vcdt_cfg0_addr);
+	}
+
+	/* select the post irq sub sample strobe for time stamp capture */
+	cam_io_w_mb(TFE_CSID_TIMESTAMP_STB_POST_IRQ,
+		soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg1_addr);
+
+	/* Enable Error Detection, Overflow ctrl mode: 2 -> Detect overflow */
+	val = 0x9;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_err_recovery_cfg0_addr);
+
+	/* Configure the halt mode */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+	if (csid_reg->cmn_reg->format_measure_support &&
+		(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO)) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_format_measure_cfg0_addr);
+		val |= rdi_reg->measure_en_hbi_vbi_cnt_val;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_format_measure_cfg0_addr);
+	}
+
+	/* Enable the RPP path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+	val |= (1 << csid_reg->cmn_reg->path_en_shift_val);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+
+	/* configure the rx packet capture based on csid debug set */
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val = ((1 <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_en_shift) |
+			(path_data->vc_dt[0].vc <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_en_shift) |
+			(path_data->vc_dt[0].dt <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_dt_shift) |
+			(path_data->vc_dt[0].vc <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_en_shift) |
+			(path_data->vc_dt[0].dt <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_dt_shift) |
+			(path_data->vc_dt[0].vc <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_vc_shift));
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_capture_ctrl_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	return rc;
+}
+
+static int cam_tfe_csid_deinit_rdi_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	uint32_t id;
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id;
+
+	if (res->res_id > CAM_TFE_CSID_PATH_RES_RDI_2 ||
+		res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		!csid_reg->rdi_reg[id]) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id%d state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	/* Disable Error Recovery */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_err_recovery_cfg0_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_tfe_csid_enable_rdi_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_tfe_csid_path_cfg              *path_data;
+	uint32_t id, val;
+	bool path_active = false;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id;
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_id > CAM_TFE_CSID_PATH_RES_RDI_2 ||
+		!csid_reg->rdi_reg[id]) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d invalid res type:%d res_id:%d state%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	/*Drop one frame extra on RDI for dual TFE use case */
+	if (path_data->usage_type == CAM_ISP_TFE_IN_RES_USAGE_DUAL)
+		path_data->init_frame_drop = 1;
+
+	/*resume at frame boundary */
+	if (!path_data->init_frame_drop) {
+		CAM_DBG(CAM_ISP, "Start RDI:%d path", id);
+		/* resume at frame boundary */
+		cam_io_w_mb(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY,
+				  soc_info->reg_map[0].mem_base +
+				  csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+	} else {
+		path_active = cam_tfe_csid_check_path_active(csid_hw);
+		if (path_active)
+			cam_io_w_mb(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY,
+					  soc_info->reg_map[0].mem_base +
+					  csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+			CAM_DBG(CAM_ISP,
+				"CSID:%d  %s RDI:%d path frame drop %d",
+				csid_hw->hw_intf->hw_idx,
+				path_active ? "Starting" : "Not Starting", id,
+				path_data->init_frame_drop);
+	}
+
+	/* Enable the required RDI interrupts */
+	val = TFE_CSID_PATH_INFO_RST_DONE | TFE_CSID_PATH_ERROR_FIFO_OVERFLOW |
+		TFE_CSID_PATH_RDI_ERROR_CCIF_VIOLATION |
+		TFE_CSID_PATH_RDI_OVERFLOW_IRQ;
+
+	if (csid_reg->cmn_reg->format_measure_support) {
+		val |= TFE_CSID_PATH_ERROR_PIX_COUNT |
+			TFE_CSID_PATH_ERROR_LINE_COUNT;
+	}
+
+	if ((csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ) ||
+		(path_data->init_frame_drop && !path_active))
+		val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)
+		val |= TFE_CSID_PATH_INFO_INPUT_EOF;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_tfe_csid_disable_rdi_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_tfe_csid_halt_cmd                stop_cmd)
+{
+	int rc = 0;
+	uint32_t id, val = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_tfe_csid_path_cfg               *path_data;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id;
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+
+	if ((res->res_id > CAM_TFE_CSID_PATH_RES_RDI_2) ||
+		(!csid_reg->rdi_reg[res->res_id])) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID:%d Res:%d already in stopped state:%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id, res->res_state);
+		return rc;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID:%d Res:%d Invalid res_state%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	if (stop_cmd != CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_TFE_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP, "CSID:%d un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	path_data->init_frame_drop = 0;
+	path_data->res_sof_cnt     = 0;
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+
+	/* Halt the RDI path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+	val &= ~0x3;
+	val |= stop_cmd;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+	return rc;
+}
+
+static int cam_tfe_csid_poll_stop_status(
+	struct cam_tfe_csid_hw          *csid_hw,
+	uint32_t                         res_mask)
+{
+	int rc = 0;
+	uint32_t csid_status_addr = 0, val = 0, res_id = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	uint32_t csid_ctrl_reg = 0;
+	uint32_t csid_cfg0_reg = 0;
+	uint32_t csid_cfg1_reg = 0;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	for (; res_id < CAM_TFE_CSID_PATH_RES_MAX; res_id++, res_mask >>= 1) {
+		if ((res_mask & 0x1) == 0)
+			continue;
+		val = 0;
+
+		if (res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+			csid_status_addr =
+			csid_reg->ipp_reg->csid_pxl_status_addr;
+
+			csid_ctrl_reg = csid_reg->ipp_reg->csid_pxl_ctrl_addr;
+			csid_cfg0_reg = csid_reg->ipp_reg->csid_pxl_cfg0_addr;
+			csid_cfg1_reg = csid_reg->ipp_reg->csid_pxl_cfg1_addr;
+
+			if (csid_hw->ipp_res.res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING)
+				continue;
+
+		} else if (res_id == CAM_TFE_CSID_PATH_RES_PPP) {
+			csid_status_addr =
+			csid_reg->ppp_reg->csid_pxl_status_addr;
+			csid_ctrl_reg = csid_reg->ppp_reg->csid_pxl_ctrl_addr;
+			csid_cfg0_reg = csid_reg->ppp_reg->csid_pxl_cfg0_addr;
+			csid_cfg1_reg = csid_reg->ppp_reg->csid_pxl_cfg1_addr;
+
+			if (csid_hw->ppp_res.res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING)
+				continue;
+
+		} else {
+			csid_status_addr =
+				csid_reg->rdi_reg[res_id]->csid_rdi_status_addr;
+			csid_ctrl_reg = csid_reg->rdi_reg[res_id]->csid_rdi_ctrl_addr;
+			csid_cfg0_reg = csid_reg->rdi_reg[res_id]->csid_rdi_cfg0_addr;
+			csid_cfg1_reg = csid_reg->rdi_reg[res_id]->csid_rdi_cfg1_addr;
+
+			if (csid_hw->rdi_res[res_id].res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING)
+				continue;
+
+		}
+
+		CAM_DBG(CAM_ISP, "start polling CSID:%d res_id:%d",
+			csid_hw->hw_intf->hw_idx, res_id);
+
+		rc = cam_common_read_poll_timeout(
+			    soc_info->reg_map[0].mem_base +
+			    csid_status_addr,
+			    CAM_TFE_CSID_TIMEOUT_SLEEP_US,
+			    CAM_TFE_CSID_TIMEOUT_ALL_US,
+			    0x1, 0x1, &val);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "CSID:%d res:%d halt failed rc %d",
+				csid_hw->hw_intf->hw_idx, res_id, rc);
+
+			CAM_ERR(CAM_ISP, "CSID:%d status:0x%x ctrl_reg:0x%x cfg0:0x%x cfg1:0x%x",
+				csid_hw->hw_intf->hw_idx,
+				cam_io_r_mb(soc_info->reg_map[0].mem_base + csid_status_addr),
+				cam_io_r_mb(soc_info->reg_map[0].mem_base + csid_ctrl_reg),
+				cam_io_r_mb(soc_info->reg_map[0].mem_base + csid_cfg0_reg),
+				cam_io_r_mb(soc_info->reg_map[0].mem_base + csid_cfg1_reg));
+			rc = -ETIMEDOUT;
+			break;
+		}
+		CAM_DBG(CAM_ISP, "End polling CSID:%d res_id:%d",
+			csid_hw->hw_intf->hw_idx, res_id);
+	}
+
+	return rc;
+}
+
+static int __cam_tfe_csid_read_timestamp(void __iomem *base,
+	uint32_t msb_offset, uint32_t lsb_offset, uint64_t *timestamp)
+{
+	uint32_t lsb, msb, tmp, torn = 0;
+
+	msb = cam_io_r_mb(base + msb_offset);
+	do {
+		tmp = msb;
+		torn++;
+		lsb = cam_io_r_mb(base + lsb_offset);
+		msb = cam_io_r_mb(base + msb_offset);
+	} while (tmp != msb);
+
+	*timestamp = msb;
+	*timestamp = (*timestamp << 32) | lsb;
+
+	return (torn > 1);
+}
+
+static int cam_tfe_csid_get_time_stamp(
+		struct cam_tfe_csid_hw   *csid_hw, void *cmd_args)
+{
+	struct cam_tfe_csid_get_time_stamp_args    *time_stamp;
+	struct cam_isp_resource_node               *res;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	const struct cam_tfe_csid_rdi_reg_offset   *rdi_reg;
+	struct timespec64 ts;
+	uint32_t  id, torn, prev_torn;
+	uint64_t  time_delta;
+
+	time_stamp = (struct cam_tfe_csid_get_time_stamp_args  *)cmd_args;
+	res = time_stamp->node_res;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+		torn = __cam_tfe_csid_read_timestamp(
+			soc_info->reg_map[0].mem_base,
+			csid_reg->ipp_reg->csid_pxl_timestamp_curr1_sof_addr,
+			csid_reg->ipp_reg->csid_pxl_timestamp_curr0_sof_addr,
+			&time_stamp->time_stamp_val);
+		if (time_stamp->get_prev_timestamp) {
+			prev_torn = __cam_tfe_csid_read_timestamp(
+				soc_info->reg_map[0].mem_base,
+				csid_reg->ipp_reg->csid_pxl_timestamp_perv1_sof_addr,
+				csid_reg->ipp_reg->csid_pxl_timestamp_perv0_sof_addr,
+				&time_stamp->prev_time_stamp_val);
+		}
+	} else if (res->res_id == CAM_TFE_CSID_PATH_RES_PPP) {
+		torn = __cam_tfe_csid_read_timestamp(
+			soc_info->reg_map[0].mem_base,
+			csid_reg->ppp_reg->csid_pxl_timestamp_curr1_sof_addr,
+			csid_reg->ppp_reg->csid_pxl_timestamp_curr0_sof_addr,
+			&time_stamp->time_stamp_val);
+		if (time_stamp->get_prev_timestamp) {
+			prev_torn = __cam_tfe_csid_read_timestamp(
+				soc_info->reg_map[0].mem_base,
+				csid_reg->ppp_reg->csid_pxl_timestamp_perv1_sof_addr,
+				csid_reg->ppp_reg->csid_pxl_timestamp_perv0_sof_addr,
+				&time_stamp->prev_time_stamp_val);
+		}
+	} else {
+		id = res->res_id;
+		rdi_reg = csid_reg->rdi_reg[id];
+		torn = __cam_tfe_csid_read_timestamp(
+			soc_info->reg_map[0].mem_base,
+			rdi_reg->csid_rdi_timestamp_curr1_sof_addr,
+			rdi_reg->csid_rdi_timestamp_curr0_sof_addr,
+			&time_stamp->time_stamp_val);
+		if (time_stamp->get_prev_timestamp) {
+			prev_torn = __cam_tfe_csid_read_timestamp(
+				soc_info->reg_map[0].mem_base,
+				rdi_reg->csid_rdi_timestamp_prev1_sof_addr,
+				rdi_reg->csid_rdi_timestamp_prev0_sof_addr,
+				&time_stamp->prev_time_stamp_val);
+		}
+	}
+
+	time_stamp->time_stamp_val = mul_u64_u32_div(
+		time_stamp->time_stamp_val,
+		CAM_TFE_CSID_QTIMER_MUL_FACTOR,
+		CAM_TFE_CSID_QTIMER_DIV_FACTOR);
+
+	if (time_stamp->get_prev_timestamp) {
+		time_stamp->prev_time_stamp_val = mul_u64_u32_div(
+			time_stamp->prev_time_stamp_val,
+			CAM_TFE_CSID_QTIMER_MUL_FACTOR,
+			CAM_TFE_CSID_QTIMER_DIV_FACTOR);
+	}
+
+	if (!csid_hw->prev_boot_timestamp) {
+		ktime_get_boottime_ts64(&ts);
+		time_stamp->boot_timestamp =
+			(uint64_t)((ts.tv_sec * 1000000000) +
+			ts.tv_nsec);
+		csid_hw->prev_qtimer_ts = 0;
+		CAM_DBG(CAM_ISP, "timestamp:%lld",
+			time_stamp->boot_timestamp);
+	} else {
+		time_delta = time_stamp->time_stamp_val -
+			csid_hw->prev_qtimer_ts;
+
+		if (csid_hw->prev_boot_timestamp >
+			U64_MAX - time_delta) {
+			CAM_WARN(CAM_ISP, "boottimestamp overflowed");
+			CAM_INFO(CAM_ISP,
+			"currQTimer %lx prevQTimer %lx prevBootTimer %lx torn %d",
+				time_stamp->time_stamp_val,
+				csid_hw->prev_qtimer_ts,
+				csid_hw->prev_boot_timestamp, torn);
+			return -EINVAL;
+		}
+
+		time_stamp->boot_timestamp =
+			csid_hw->prev_boot_timestamp + time_delta;
+	}
+
+	CAM_DBG(CAM_ISP,
+	"currQTimer %lx prevQTimer %lx currBootTimer %lx prevBootTimer %lx torn %d",
+		time_stamp->time_stamp_val,
+		csid_hw->prev_qtimer_ts, time_stamp->boot_timestamp,
+		csid_hw->prev_boot_timestamp, torn);
+
+	csid_hw->prev_qtimer_ts = time_stamp->time_stamp_val;
+	csid_hw->prev_boot_timestamp = time_stamp->boot_timestamp;
+
+	return 0;
+}
+
+static int cam_tfe_csid_print_hbi_vbi(
+	struct cam_tfe_csid_hw  *csid_hw,
+	struct cam_isp_resource_node *res)
+{
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	const struct cam_tfe_csid_rdi_reg_offset   *rdi_reg;
+	uint32_t  hbi = 0, vbi = 0;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+		hbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_format_measure1_addr);
+		vbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_format_measure2_addr);
+	} else if (res->res_id == CAM_TFE_CSID_PATH_RES_PPP) {
+		hbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_format_measure1_addr);
+		vbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_format_measure2_addr);
+	} else if ((res->res_id >= CAM_TFE_CSID_PATH_RES_RDI_0) &&
+		(res->res_id <= CAM_TFE_CSID_PATH_RES_RDI_2)) {
+		rdi_reg = csid_reg->rdi_reg[res->res_id];
+
+		hbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_format_measure1_addr);
+		vbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_format_measure2_addr);
+	} else {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_ISP,
+		"CSID[%u] Resource[id:%d name:%s hbi 0x%x vbi 0x%x]",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_name, hbi, vbi);
+
+	return 0;
+}
+
+static int cam_tfe_csid_set_csid_debug(struct cam_tfe_csid_hw   *csid_hw,
+	void *cmd_args)
+{
+	uint32_t  *csid_debug;
+
+	csid_debug = (uint32_t  *) cmd_args;
+	csid_hw->csid_debug = *csid_debug;
+	CAM_DBG(CAM_ISP, "CSID:%d set csid debug value:%d",
+		csid_hw->hw_intf->hw_idx, csid_hw->csid_debug);
+
+	return 0;
+}
+
+static int cam_tfe_csid_get_hw_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw_caps           *hw_caps;
+	struct cam_tfe_csid_hw                *csid_hw;
+	struct cam_hw_info                    *csid_hw_info;
+	const struct cam_tfe_csid_reg_offset  *csid_reg;
+	struct cam_tfe_csid_soc_private       *soc_private;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	hw_caps = (struct cam_tfe_csid_hw_caps *) get_hw_cap_args;
+	soc_private = (struct cam_tfe_csid_soc_private *) csid_hw_info->soc_info.soc_private;
+
+	hw_caps->num_rdis = csid_reg->cmn_reg->num_rdis;
+	hw_caps->num_pix = csid_hw->pxl_pipe_enable;
+	hw_caps->num_ppp = csid_reg->cmn_reg->num_ppp;
+	hw_caps->major_version = csid_reg->cmn_reg->major_version;
+	hw_caps->minor_version = csid_reg->cmn_reg->minor_version;
+	hw_caps->version_incr = csid_reg->cmn_reg->version_incr;
+	hw_caps->sync_clk = csid_reg->cmn_reg->sync_clk;
+	hw_caps->is_lite = soc_private->is_tfe_csid_lite;
+
+	CAM_DBG(CAM_ISP,
+		"CSID:%d No rdis:%d, no pix:%d, major:%d minor:%d ver :%d",
+		csid_hw->hw_intf->hw_idx, hw_caps->num_rdis,
+		hw_caps->num_pix, hw_caps->major_version,
+		hw_caps->minor_version, hw_caps->version_incr);
+
+	return rc;
+}
+
+static int cam_tfe_csid_reset(void *hw_priv,
+	void *reset_args, uint32_t arg_size)
+{
+	struct cam_tfe_csid_hw          *csid_hw;
+	struct cam_hw_info              *csid_hw_info;
+	struct cam_tfe_csid_reset_cfg_args  *reset;
+	int rc = 0;
+
+	if (!hw_priv || !reset_args || (arg_size !=
+		sizeof(struct cam_tfe_csid_reset_cfg_args))) {
+		CAM_ERR(CAM_ISP, "CSID:Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	reset   = (struct cam_tfe_csid_reset_cfg_args  *)reset_args;
+
+	switch (reset->reset_type) {
+	case CAM_TFE_CSID_RESET_GLOBAL:
+		rc = cam_tfe_csid_global_reset(csid_hw);
+		break;
+	case CAM_TFE_CSID_RESET_PATH:
+		rc = cam_tfe_csid_path_reset(csid_hw, reset);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:Invalid reset type :%d",
+			reset->reset_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_reserve(void *hw_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw                    *csid_hw;
+	struct cam_hw_info                        *csid_hw_info;
+	struct cam_tfe_csid_hw_reserve_resource_args  *reserv;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_tfe_csid_hw_reserve_resource_args))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	reserv = (struct cam_tfe_csid_hw_reserve_resource_args  *)reserve_args;
+
+	if (reserv->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type :%d",
+			csid_hw->hw_intf->hw_idx, reserv->res_type);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "res_type %d, CSID: %u",
+		reserv->res_type, csid_hw->hw_intf->hw_idx);
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	rc = cam_tfe_csid_path_reserve(csid_hw, reserv);
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_tfe_csid_release(void *hw_priv,
+	void *release_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw          *csid_hw;
+	struct cam_hw_info              *csid_hw_info;
+	struct cam_isp_resource_node    *res;
+	struct cam_tfe_csid_path_cfg    *path_data;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	res = (struct cam_isp_resource_node *)release_args;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if ((res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	csid_hw->event_cb = NULL;
+	csid_hw->event_cb_priv = NULL;
+
+	if ((res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE) ||
+		(res->res_state >= CAM_ISP_RESOURCE_STATE_STREAMING)) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%d res type:%d Res %d in state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id,
+			res->res_state);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res type :%d Resource id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	path_data = (struct cam_tfe_csid_path_cfg *)res->res_priv;
+	if (csid_hw->cid_res[path_data->cid].cnt)
+		csid_hw->cid_res[path_data->cid].cnt--;
+
+	if (csid_hw->csi2_reserve_cnt)
+		csid_hw->csi2_reserve_cnt--;
+
+	if (!csid_hw->csi2_reserve_cnt)
+		memset(&csid_hw->csi2_rx_cfg, 0,
+			sizeof(struct cam_tfe_csid_csi2_rx_cfg));
+
+	CAM_DBG(CAM_ISP, "CSID:%d res id :%d cnt:%d reserv cnt:%d",
+		csid_hw->hw_intf->hw_idx,
+		res->res_id, csid_hw->cid_res[path_data->cid].cnt,
+		csid_hw->csi2_reserve_cnt);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	cam_tfe_csid_reset_path_data(csid_hw, res);
+
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_tfe_csid_reset_retain_sw_reg(
+	struct cam_tfe_csid_hw *csid_hw)
+{
+	int rc = 0;
+	uint32_t status;
+	const struct cam_tfe_csid_reg_offset *csid_reg =
+		csid_hw->csid_info->csid_reg;
+	struct cam_hw_soc_info          *soc_info;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	/* Mask top interrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_mask_addr);
+	/* clear the top interrupt first */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	cam_io_w_mb(csid_reg->cmn_reg->csid_rst_stb,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_rst_strobes_addr);
+
+	rc = cam_common_read_poll_timeout(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_status_addr,
+		CAM_TFE_CSID_TIMEOUT_SLEEP_US, CAM_TFE_CSID_TIMEOUT_ALL_US,
+		0x1, 0x1, &status);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d csid_reset fail rc = %d",
+			  csid_hw->hw_intf->hw_idx, rc);
+		status = cam_io_r(soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_top_irq_status_addr);
+		CAM_DBG(CAM_ISP, "Status reg %d", status);
+	} else {
+		CAM_DBG(CAM_ISP, "CSID:%d hw reset completed %d",
+			csid_hw->hw_intf->hw_idx, rc);
+		rc = 0;
+	}
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	return rc;
+}
+
+static int cam_tfe_csid_init_hw(void *hw_priv,
+	void *init_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw                 *csid_hw;
+	struct cam_hw_info                     *csid_hw_info;
+	struct cam_isp_resource_node           *res;
+	const struct cam_tfe_csid_reg_offset   *csid_reg;
+	unsigned long                           flags;
+
+	if (!hw_priv || !init_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	res      = (struct cam_isp_resource_node *)init_args;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if (res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res tpe:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((res->res_type == CAM_ISP_RESOURCE_PIX_PATH) &&
+		(res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED)) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d res type:%d res_id:%dInvalid state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res type :%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	/* Initialize the csid hardware */
+	rc = cam_tfe_csid_enable_hw(csid_hw);
+	if (rc)
+		goto end;
+
+	if ((res->res_id == CAM_TFE_CSID_PATH_RES_IPP) ||
+		(res->res_id == CAM_TFE_CSID_PATH_RES_PPP))
+		rc = cam_tfe_csid_init_config_pxl_path(csid_hw, res);
+	else
+		rc = cam_tfe_csid_init_config_rdi_path(csid_hw, res);
+
+	rc = cam_tfe_csid_reset_retain_sw_reg(csid_hw);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "CSID: Failed in SW reset");
+
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	csid_hw->device_enabled = 1;
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_tfe_csid_deinit_hw(void *hw_priv,
+	void *deinit_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw                 *csid_hw;
+	struct cam_hw_info                     *csid_hw_info;
+	struct cam_isp_resource_node           *res;
+
+	if (!hw_priv || !deinit_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID:Invalid arguments");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter");
+	res = (struct cam_isp_resource_node *)deinit_args;
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid Res type %d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "CSID:%d Res:%d already in De-init state",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_id);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "De-Init IPP Path: %d", res->res_id);
+
+	if ((res->res_id == CAM_TFE_CSID_PATH_RES_IPP) ||
+		(res->res_id == CAM_TFE_CSID_PATH_RES_PPP))
+		rc = cam_tfe_csid_deinit_pxl_path(csid_hw, res);
+	else
+		rc = cam_tfe_csid_deinit_rdi_path(csid_hw, res);
+
+	/* Disable CSID HW */
+	CAM_DBG(CAM_ISP, "Disabling CSID Hw");
+	cam_tfe_csid_disable_hw(csid_hw);
+	CAM_DBG(CAM_ISP, "%s: Exit", __func__);
+
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_tfe_csid_start(void *hw_priv, void *start_args,
+			uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw                 *csid_hw;
+	struct cam_hw_info                     *csid_hw_info;
+	struct cam_isp_resource_node           *res;
+	const struct cam_tfe_csid_reg_offset   *csid_reg;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	res = (struct cam_isp_resource_node *)start_args;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if (res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res tpe:%d res id:%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Reset sof irq debug fields */
+	csid_hw->sof_irq_triggered = false;
+	csid_hw->irq_debug_cnt = 0;
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_type :%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	switch (res->res_type) {
+	case CAM_ISP_RESOURCE_PIX_PATH:
+		if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+			rc = cam_tfe_csid_enable_pxl_path(csid_hw, res);
+		else if (res->res_id == CAM_TFE_CSID_PATH_RES_PPP)
+			rc = cam_tfe_csid_enable_ppp_path(csid_hw, res);
+		else
+			rc = cam_tfe_csid_enable_rdi_path(csid_hw, res);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type%d",
+			csid_hw->hw_intf->hw_idx, res->res_type);
+		break;
+	}
+end:
+	return rc;
+}
+
+int cam_tfe_csid_halt(struct cam_tfe_csid_hw *csid_hw,
+	void *halt_args)
+{
+	struct cam_isp_resource_node         *res;
+	struct cam_tfe_csid_hw_halt_args     *csid_halt;
+	int rc = 0;
+
+	if (!csid_hw || !halt_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_halt = (struct cam_tfe_csid_hw_halt_args *)halt_args;
+
+	/* Change the halt mode */
+	res = csid_halt->node_res;
+	CAM_DBG(CAM_ISP, "CSID:%d res_type %d res_id %d",
+		csid_hw->hw_intf->hw_idx,
+		res->res_type, res->res_id);
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	switch (res->res_id) {
+	case CAM_TFE_CSID_PATH_RES_IPP:
+		rc = cam_tfe_csid_change_pxl_halt_mode(csid_hw, csid_halt);
+		break;
+	default:
+		CAM_DBG(CAM_ISP, "CSID:%d res_id %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_stop(void *hw_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw               *csid_hw;
+	struct cam_hw_info                   *csid_hw_info;
+	struct cam_isp_resource_node         *res;
+	struct cam_tfe_csid_hw_stop_args     *csid_stop;
+	uint32_t  i;
+	uint32_t res_mask = 0;
+	bool csid_with_ppp_en = false;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_tfe_csid_hw_stop_args))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+	csid_stop = (struct cam_tfe_csid_hw_stop_args  *) stop_args;
+
+	if (!csid_stop->num_res) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+
+	if (csid_hw->ppp_res.res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		csid_with_ppp_en = true;
+
+	CAM_DBG(CAM_ISP, "CSID:%d num_res %d csid_with_ppp_en:%d",
+		csid_hw->hw_intf->hw_idx, csid_stop->num_res,
+		csid_with_ppp_en);
+
+	/* Stop the resource first */
+	for (i = 0; i < csid_stop->num_res; i++) {
+		res = csid_stop->node_res[i];
+		CAM_DBG(CAM_ISP, "CSID:%d res_type %d res_id %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id);
+		switch (res->res_type) {
+		case CAM_ISP_RESOURCE_PIX_PATH:
+			res_mask |= (1 << res->res_id);
+			if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+				rc = cam_tfe_csid_disable_pxl_path(csid_hw,
+					res, csid_stop->stop_cmd, csid_with_ppp_en);
+			else if (res->res_id == CAM_TFE_CSID_PATH_RES_PPP)
+				rc = cam_tfe_csid_disable_ppp_path(csid_hw,
+					res, csid_stop->stop_cmd);
+			else
+				rc = cam_tfe_csid_disable_rdi_path(csid_hw,
+					res, csid_stop->stop_cmd);
+
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid res type%d",
+				csid_hw->hw_intf->hw_idx,
+				res->res_type);
+			break;
+		}
+	}
+
+	if (res_mask)
+		rc = cam_tfe_csid_poll_stop_status(csid_hw, res_mask);
+
+	for (i = 0; i < csid_stop->num_res; i++) {
+		res = csid_stop->node_res[i];
+		res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+	}
+
+	CAM_DBG(CAM_ISP,  "%s: Exit", __func__);
+	return rc;
+}
+
+static int cam_tfe_csid_read(void *hw_priv,
+	void *read_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+	return -EINVAL;
+}
+
+static int cam_tfe_csid_write(void *hw_priv,
+	void *write_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+	return -EINVAL;
+}
+
+static int cam_tfe_csid_sof_irq_debug(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	int i = 0;
+	uint32_t val = 0;
+	bool sof_irq_enable = false;
+	const struct cam_tfe_csid_reg_offset    *csid_reg;
+	struct cam_hw_soc_info                  *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (*((uint32_t *)cmd_args) == 1)
+		sof_irq_enable = true;
+
+	if (csid_hw->hw_info->hw_state ==
+		CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%d powered down unable to %s sof irq",
+			csid_hw->hw_intf->hw_idx,
+			sof_irq_enable ? "enable" : "disable");
+		return 0;
+	}
+
+	if (csid_reg->ipp_reg) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+
+		if (val) {
+			if (sof_irq_enable)
+				val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+			else
+				val &= ~TFE_CSID_PATH_INFO_INPUT_SOF;
+
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+			val = 0;
+		}
+	}
+
+	if (csid_reg->ppp_reg) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_mask_addr);
+
+		if (val) {
+			if (sof_irq_enable)
+				val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+			else
+				val &= ~TFE_CSID_PATH_INFO_INPUT_SOF;
+
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->ppp_reg->csid_pxl_irq_mask_addr);
+			val = 0;
+		}
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_mask_addr);
+		if (val) {
+			if (sof_irq_enable)
+				val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+			else
+				val &= ~TFE_CSID_PATH_INFO_INPUT_SOF;
+
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_irq_mask_addr);
+			val = 0;
+		}
+	}
+
+	if (sof_irq_enable) {
+		csid_hw->csid_debug |= TFE_CSID_DEBUG_ENABLE_SOF_IRQ;
+		csid_hw->sof_irq_triggered = true;
+	} else {
+		csid_hw->csid_debug &= ~TFE_CSID_DEBUG_ENABLE_SOF_IRQ;
+		csid_hw->sof_irq_triggered = false;
+	}
+
+	if (!in_irq())
+		CAM_INFO(CAM_ISP, "SOF freeze: CSID:%d SOF irq %s",
+			csid_hw->hw_intf->hw_idx,
+			sof_irq_enable ? "enabled" : "disabled");
+
+	return 0;
+}
+
+static int cam_tfe_csid_set_csid_clock(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_tfe_csid_clock_update_args *clk_update = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	clk_update =
+		(struct cam_tfe_csid_clock_update_args *)cmd_args;
+
+	csid_hw->clk_rate = clk_update->clk_rate;
+	CAM_DBG(CAM_ISP, "CSID clock rate %llu", csid_hw->clk_rate);
+
+	return 0;
+}
+
+static int cam_tfe_csid_dump_csid_clock(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_hw_soc_info   *soc_info;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	CAM_INFO(CAM_ISP, "CSID:%d sw_client clk rate:%lu ",
+		csid_hw->hw_intf->hw_idx,
+		soc_info->applied_src_clk_rates.sw_client);
+
+	return 0;
+}
+
+static int cam_tfe_csid_set_csid_clock_dynamically(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_hw_soc_info   *soc_info;
+	unsigned long            *clk_rate;
+	int rc = 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	clk_rate = (unsigned long *)cmd_args;
+
+	CAM_DBG(CAM_ISP, "CSID[%u] clock rate requested: %llu curr: %llu",
+		csid_hw->hw_intf->hw_idx, *clk_rate, soc_info->applied_src_clk_rates.sw_client);
+
+	if (*clk_rate <= soc_info->applied_src_clk_rates.sw_client)
+		goto end;
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX, *clk_rate, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"unable to set clock dynamically rate:%llu", *clk_rate);
+		return rc;
+	}
+end:
+	*clk_rate = soc_info->applied_src_clk_rates.sw_client;
+	CAM_DBG(CAM_ISP, "CSID[%u] new clock rate %llu",
+		csid_hw->hw_intf->hw_idx, soc_info->applied_src_clk_rates.sw_client);
+
+	return rc;
+}
+
+static int cam_tfe_csid_set_discard_frame_cfg(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_isp_resource_node                 *res;
+	struct cam_tfe_csid_path_cfg                 *path_cfg;
+	struct cam_tfe_csid_discard_init_frame_args  *discard_config = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	discard_config = (struct cam_tfe_csid_discard_init_frame_args *)cmd_args;
+
+	res = discard_config->res;
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID[%u] Invalid res_type: %d res id: %d",
+			csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+		return -EINVAL;
+	}
+
+	if ((res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW)) {
+
+		path_cfg = (struct cam_tfe_csid_path_cfg *)res->res_priv;
+
+		path_cfg->init_frame_drop = discard_config->num_frames;
+		path_cfg->res_sof_cnt = 0;
+	}
+
+	return 0;
+}
+
+static int cam_tfe_csid_get_regdump(struct cam_tfe_csid_hw *csid_hw,
+	void *cmd_args)
+{
+	struct cam_tfe_csid_reg_offset    *csid_reg;
+	struct cam_hw_soc_info            *soc_info;
+	struct cam_isp_resource_node      *res;
+	struct cam_tfe_csid_path_cfg      *path_data;
+	uint32_t id;
+	int i, val;
+
+	csid_reg = (struct cam_tfe_csid_reg_offset   *)
+			csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	res = (struct cam_isp_resource_node  *)cmd_args;
+	path_data = (struct cam_tfe_csid_path_cfg   *)res->res_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+		CAM_INFO(CAM_ISP, "Dumping CSID:%d IPP registers ",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_cfg0_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_cfg0_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_cfg1_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_cfg1_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_ctrl_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_ctrl_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_hcrop_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_hcrop_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_vcrop_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_vcrop_addr, val);
+	} else if (res->res_id == CAM_TFE_CSID_PATH_RES_PPP) {
+		CAM_INFO(CAM_ISP, "Dumping CSID:%d PPP registers ",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_cfg0_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ppp_reg->csid_pxl_cfg0_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_cfg1_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ppp_reg->csid_pxl_cfg1_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_ctrl_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ppp_reg->csid_pxl_ctrl_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_hcrop_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ppp_reg->csid_pxl_hcrop_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_vcrop_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ppp_reg->csid_pxl_vcrop_addr, val);
+	} else {
+		id = res->res_id;
+		CAM_INFO(CAM_ISP, "Dumping CSID:%d RDI:%d registers ",
+			csid_hw->hw_intf->hw_idx, id);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg1_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->rdi_reg[id]->csid_rdi_cfg1_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr, val);
+	}
+	CAM_INFO(CAM_ISP,
+		"start pix:%d end pix:%d start line:%d end line:%d w:%d h:%d",
+		path_data->start_pixel, path_data->end_pixel,
+		path_data->start_line, path_data->end_line,
+		path_data->width, path_data->height);
+	CAM_INFO(CAM_ISP,
+		"clock:%d crop_enable:%d num of vc_dt:%d informat:%d outformat:%d",
+		path_data->clk_rate, path_data->crop_enable,
+		path_data->num_valid_vc_dt,
+		path_data->in_format, path_data->out_format);
+	for (i = 0; i < path_data->num_valid_vc_dt; i++) {
+		CAM_INFO(CAM_ISP, "vc[%d]: %d, dt[%d]: %d",
+			i, path_data->vc_dt[i].vc, i, path_data->vc_dt[i].dt);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_csid_dump_hw(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	int                             i;
+	uint8_t                        *dst;
+	uint32_t                       *addr, *start;
+	uint64_t                       *clk_addr, *clk_start;
+	uint32_t                        min_len;
+	uint32_t                        num_reg;
+	uint32_t                        reg_size = 0;
+	size_t                          remain_len;
+	struct cam_isp_hw_dump_header  *hdr;
+	struct cam_isp_hw_dump_args    *dump_args =
+		(struct cam_isp_hw_dump_args *)cmd_args;
+	struct cam_hw_soc_info         *soc_info;
+
+	if (!dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (!dump_args->cpu_addr || !dump_args->buf_len) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params %pK %zu",
+			(void *)dump_args->cpu_addr,
+			dump_args->buf_len);
+		return -EINVAL;
+	}
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ISP,
+			"Dump offset overshoot offset %zu buf_len %zu",
+			dump_args->offset, dump_args->buf_len);
+		return -ENOSPC;
+	}
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	if (dump_args->is_dump_all)
+		reg_size = soc_info->reg_map[0].size;
+
+	min_len = reg_size +
+		sizeof(struct cam_isp_hw_dump_header) +
+		(sizeof(uint32_t) * CAM_TFE_CSID_DUMP_MISC_NUM_WORDS);
+	remain_len = dump_args->buf_len - dump_args->offset;
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu, min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid HW State:%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		mutex_unlock(&csid_hw->hw_info->hw_mutex);
+		return -EINVAL;
+	}
+
+	if (!dump_args->is_dump_all)
+		goto dump_bw;
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "CSID_REG:");
+	addr = (uint32_t *)(dst + sizeof(struct cam_isp_hw_dump_header));
+	start = addr;
+	num_reg = soc_info->reg_map[0].size/4;
+	hdr->word_size = sizeof(uint32_t);
+	*addr = soc_info->index;
+	addr++;
+
+	for (i = 0; i < num_reg; i++) {
+		addr[0] = soc_info->mem_block[0]->start + (i*4);
+		addr[1] = cam_io_r(soc_info->reg_map[0].mem_base
+			+ (i*4));
+		addr += 2;
+	}
+
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+dump_bw:
+	dst = (char *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "CSID_CLK_RATE:");
+	clk_addr = (uint64_t *)(dst +
+		sizeof(struct cam_isp_hw_dump_header));
+	clk_start = clk_addr;
+	hdr->word_size = sizeof(uint64_t);
+	*clk_addr++ = csid_hw->clk_rate;
+	hdr->size = hdr->word_size * (clk_addr - clk_start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+	CAM_DBG(CAM_ISP, "offset %zu", dump_args->offset);
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return 0;
+}
+
+static int cam_tfe_csid_log_acquire_data(
+	struct cam_tfe_csid_hw   *csid_hw,  void *cmd_args)
+{
+	struct cam_isp_resource_node  *res =
+		(struct cam_isp_resource_node *)cmd_args;
+	struct cam_tfe_csid_path_cfg       *path_data;
+	struct cam_hw_soc_info                         *soc_info;
+	const struct cam_tfe_csid_reg_offset           *csid_reg;
+	uint32_t byte_cnt_ping, byte_cnt_pong;
+
+	path_data = (struct cam_tfe_csid_path_cfg *)res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d invalid res id:%d res type: %d state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_type,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	/* Dump all the acquire data for this  */
+	CAM_INFO(CAM_ISP,
+		"CSID:%d res id:%d type:%d state:%d in f:%d out f:%d st pix:%d end pix:%d st line:%d end line:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_type,
+		res->res_type, path_data->in_format, path_data->out_format,
+		path_data->start_pixel, path_data->end_pixel,
+		path_data->start_line, path_data->end_line);
+
+	if (res->res_id >= CAM_TFE_CSID_PATH_RES_RDI_0  &&
+		res->res_id <= CAM_TFE_CSID_PATH_RES_RDI_2) {
+		/* read total number of bytes transmitted through RDI */
+		byte_cnt_ping = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[res->res_id]->csid_rdi_byte_cntr_ping_addr);
+		byte_cnt_pong = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[res->res_id]->csid_rdi_byte_cntr_pong_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID:%d res id:%d byte cnt val ping:%d pong:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			byte_cnt_ping, byte_cnt_pong);
+	}
+
+	return 0;
+
+}
+
+static int cam_tfe_csid_process_cmd(void *hw_priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw               *csid_hw;
+	struct cam_hw_info                   *csid_hw_info;
+	struct cam_isp_resource_node         *res = NULL;
+
+	if (!hw_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid arguments");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+
+	switch (cmd_type) {
+	case CAM_TFE_CSID_CMD_GET_TIME_STAMP:
+		rc = cam_tfe_csid_get_time_stamp(csid_hw, cmd_args);
+
+		if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+			res = ((struct cam_tfe_csid_get_time_stamp_args *)cmd_args)->node_res;
+			cam_tfe_csid_print_hbi_vbi(csid_hw, res);
+		}
+		break;
+	case CAM_TFE_CSID_SET_CSID_DEBUG:
+		rc = cam_tfe_csid_set_csid_debug(csid_hw, cmd_args);
+		break;
+	case CAM_TFE_CSID_SOF_IRQ_DEBUG:
+		rc = cam_tfe_csid_sof_irq_debug(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE:
+		rc = cam_tfe_csid_set_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CLOCK_DUMP:
+		rc = cam_tfe_csid_dump_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_TFE_CSID_CMD_GET_REG_DUMP:
+		rc = cam_tfe_csid_get_regdump(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_HW:
+		rc = cam_tfe_csid_dump_hw(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE:
+		rc = cam_tfe_csid_halt(csid_hw, cmd_args);
+		break;
+	case CAM_TFE_CSID_LOG_ACQUIRE_DATA:
+		rc = cam_tfe_csid_log_acquire_data(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DYNAMIC_CLOCK_UPDATE:
+		rc = cam_tfe_csid_set_csid_clock_dynamically(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_DISCARD_INIT_FRAMES:
+		rc = cam_tfe_csid_set_discard_frame_cfg(csid_hw, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d unsupported cmd:%d",
+			csid_hw->hw_intf->hw_idx, cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_get_evt_payload(
+	struct cam_tfe_csid_hw *csid_hw,
+	struct cam_csid_evt_payload **evt_payload)
+{
+
+	spin_lock(&csid_hw->spin_lock);
+
+	if (list_empty(&csid_hw->free_payload_list)) {
+		*evt_payload = NULL;
+		spin_unlock(&csid_hw->spin_lock);
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -ENOMEM;
+	}
+
+	*evt_payload = list_first_entry(&csid_hw->free_payload_list,
+			struct cam_csid_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	spin_unlock(&csid_hw->spin_lock);
+
+	return 0;
+}
+
+static int cam_tfe_csid_put_evt_payload(
+	struct cam_tfe_csid_hw *csid_hw,
+	struct cam_csid_evt_payload **evt_payload)
+{
+	unsigned long flags;
+
+	if (*evt_payload == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list,
+		&csid_hw->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+
+	return 0;
+}
+
+static int cam_tfe_csid_evt_bottom_half_handler(
+	void *handler_priv,
+	void *evt_payload_priv)
+{
+	struct cam_tfe_csid_hw *csid_hw;
+	struct cam_csid_evt_payload *evt_payload;
+	const struct cam_tfe_csid_reg_offset    *csid_reg;
+	struct cam_isp_hw_error_event_info err_evt_info;
+	struct cam_isp_hw_event_info event_info;
+	int i;
+	int rc = 0;
+	uint32_t data_idx;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid Param handler_priv %pK evt_payload_priv %pK",
+			handler_priv, evt_payload_priv);
+		return 0;
+	}
+
+	csid_hw = (struct cam_tfe_csid_hw *)handler_priv;
+	evt_payload = (struct cam_csid_evt_payload *)evt_payload_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	data_idx = csid_hw->csi2_rx_cfg.phy_sel - 1;
+
+	if (!csid_hw->event_cb || !csid_hw->event_cb_priv) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"hw_idx %d Invalid args %pK %pK",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->event_cb,
+			csid_hw->event_cb_priv);
+		goto end;
+	}
+
+	if (csid_hw->event_cb_priv != evt_payload->priv) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"hw_idx %d priv mismatch %pK, %pK",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->event_cb_priv,
+			evt_payload->priv);
+		goto end;
+	}
+
+	if (csid_hw->sof_irq_triggered && (evt_payload->evt_type ==
+		CAM_ISP_HW_ERROR_NONE)) {
+		if (evt_payload->irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_INFO_INPUT_SOF) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP SOF received",
+				csid_hw->hw_intf->hw_idx);
+		}
+
+		if (evt_payload->irq_status[TFE_CSID_IRQ_REG_PPP] &
+			TFE_CSID_PATH_INFO_INPUT_SOF) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PPP SOF received",
+				csid_hw->hw_intf->hw_idx);
+		}
+
+		for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+			if (evt_payload->irq_status[i] &
+				TFE_CSID_PATH_INFO_INPUT_SOF)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"CSID:%d RDI:%d SOF received",
+					csid_hw->hw_intf->hw_idx, i);
+		}
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID %d err %d phy %d irq status TOP: 0x%x RX: 0x%x IPP: 0x%x PPP: 0x%x RDI0: 0x%x RDI1: 0x%x RDI2: 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			evt_payload->evt_type,
+			csid_hw->csi2_rx_cfg.phy_sel,
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_TOP],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_RX],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_IPP],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_PPP],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_RDI0],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_RDI1],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_RDI2]);
+	}
+	/* this hunk can be extended to handle more cases
+	 * which we want to offload to bottom half from
+	 * irq handlers
+	 */
+	err_evt_info.err_type = evt_payload->evt_type;
+	event_info.hw_idx = evt_payload->hw_idx;
+	event_info.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	event_info.hw_type = CAM_ISP_HW_TYPE_TFE_CSID;
+
+	switch (evt_payload->evt_type) {
+	case CAM_ISP_HW_ERROR_CSID_FRAME_SIZE:
+			break;
+	case CAM_ISP_HW_ERROR_CSID_FATAL:
+		/* phy_sel starts from 1 and should never be zero*/
+		if (csid_hw->csi2_rx_cfg.phy_sel > 0) {
+			cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+				CAM_SUBDEV_MESSAGE_REG_DUMP, (void *)&data_idx);
+		}
+		csid_hw->fatal_err_detected = true;
+		break;
+	case CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW:
+		event_info.event_data = (void *)&err_evt_info;
+		rc = csid_hw->event_cb(csid_hw->event_cb_priv,
+			CAM_ISP_HW_EVENT_ERROR, (void *)&event_info);
+		break;
+
+	default:
+		CAM_DBG(CAM_ISP, "CSID[%d] error type %d",
+			csid_hw->hw_intf->hw_idx,
+			evt_payload->evt_type);
+		break;
+	}
+end:
+	cam_tfe_csid_put_evt_payload(csid_hw, &evt_payload);
+	return 0;
+}
+
+static int cam_tfe_csid_handle_hw_err_irq(
+	struct cam_tfe_csid_hw *csid_hw,
+	int                     evt_type,
+	uint32_t               *irq_status)
+{
+	int      rc = 0;
+	int      i;
+	void    *bh_cmd = NULL;
+	struct cam_csid_evt_payload *evt_payload;
+
+	CAM_DBG(CAM_ISP, "CSID[%d] error %d",
+		csid_hw->hw_intf->hw_idx, evt_type);
+
+	rc = cam_tfe_csid_get_evt_payload(csid_hw, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No free payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return rc;
+	}
+
+	rc = tasklet_bh_api.get_bh_payload_func(csid_hw->tasklet, &bh_cmd);
+	if (rc || !bh_cmd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID[%d] Can not get cmd for tasklet, evt_type %d",
+			csid_hw->hw_intf->hw_idx,
+			evt_type);
+		return rc;
+	}
+
+	evt_payload->evt_type = evt_type;
+	evt_payload->priv = csid_hw->event_cb_priv;
+	evt_payload->hw_idx = csid_hw->hw_intf->hw_idx;
+
+	for (i = 0; i < TFE_CSID_IRQ_REG_MAX; i++)
+		evt_payload->irq_status[i] = irq_status[i];
+
+	tasklet_bh_api.bottom_half_enqueue_func(csid_hw->tasklet,
+		bh_cmd,
+		csid_hw,
+		evt_payload,
+		cam_tfe_csid_evt_bottom_half_handler);
+
+	return rc;
+}
+
+irqreturn_t cam_tfe_csid_irq(int irq_num, void *data)
+{
+	struct cam_tfe_csid_hw                         *csid_hw;
+	struct cam_hw_soc_info                         *soc_info;
+	const struct cam_tfe_csid_reg_offset           *csid_reg;
+	const struct cam_tfe_csid_pxl_reg_offset       *ipp_reg;
+	const struct cam_tfe_csid_pxl_reg_offset       *ppp_reg;
+	const struct cam_tfe_csid_rdi_reg_offset       *rdi_reg;
+	const struct cam_tfe_csid_common_reg_offset    *cmn_reg;
+	const struct cam_tfe_csid_csi2_rx_reg_offset   *csi2_reg;
+	uint32_t                   irq_status[TFE_CSID_IRQ_REG_MAX] = {0};
+	bool fatal_err_detected = false, is_error_irq = false;
+	uint32_t sof_irq_debug_en = 0, log_en = 0;
+	unsigned long flags;
+	uint32_t i, val, val1;
+	uint32_t data_idx;
+	uint32_t report_err_type = CAM_ISP_HW_ERROR_NONE;
+
+	if (!data) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid arguments");
+		return IRQ_HANDLED;
+	}
+
+	csid_hw = (struct cam_tfe_csid_hw *)data;
+	data_idx = csid_hw->csi2_rx_cfg.phy_sel - 1;
+	CAM_DBG(CAM_ISP, "CSID %d IRQ Handling", csid_hw->hw_intf->hw_idx);
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csi2_reg = csid_reg->csi2_reg;
+
+	/* read */
+	irq_status[TFE_CSID_IRQ_REG_TOP] =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_status_addr);
+
+	irq_status[TFE_CSID_IRQ_REG_RX] =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_status_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		irq_status[TFE_CSID_IRQ_REG_IPP] =
+			cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_irq_status_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		irq_status[TFE_CSID_IRQ_REG_PPP] =
+			cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csid_reg->ppp_reg->csid_pxl_irq_status_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		irq_status[i] =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[i]->csid_rdi_irq_status_addr);
+
+	/* clear */
+	cam_io_w_mb(irq_status[TFE_CSID_IRQ_REG_TOP],
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+
+	cam_io_w_mb(irq_status[TFE_CSID_IRQ_REG_RX],
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_clear_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		cam_io_w_mb(irq_status[TFE_CSID_IRQ_REG_IPP],
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(irq_status[TFE_CSID_IRQ_REG_PPP],
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_clear_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		cam_io_w_mb(irq_status[i],
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_clear_addr);
+	}
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	/* Software register reset complete*/
+	if (irq_status[TFE_CSID_IRQ_REG_TOP])
+		complete(&csid_hw->csid_top_complete);
+
+	if (irq_status[TFE_CSID_IRQ_REG_RX] &
+		BIT(csid_reg->csi2_reg->csi2_rst_done_shift_val))
+		complete(&csid_hw->csid_csi2_complete);
+
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	if (csid_hw->device_enabled == 1) {
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_LANE0_FIFO_OVERFLOW) {
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_LANE1_FIFO_OVERFLOW) {
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_LANE2_FIFO_OVERFLOW) {
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_LANE3_FIFO_OVERFLOW) {
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION) {
+			if (csid_hw->csi2_rx_cfg.epd_supported)
+				CAM_DBG(CAM_ISP,
+					"CSID[%u] Rcvd Only ERROR_EOT for EPD sensor PHY type: %s(%u)",
+					csid_hw->hw_intf->hw_idx,
+					(csid_hw->csi2_rx_cfg.lane_type) ? "cphy" : "dphy",
+					csid_hw->csi2_rx_cfg.lane_type);
+			else
+				csid_hw->error_irq_count++;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_CPHY_SOT_RECEPTION)
+			csid_hw->error_irq_count++;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_STREAM_UNDERFLOW)
+			csid_hw->error_irq_count++;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_UNBOUNDED_FRAME)
+			csid_hw->error_irq_count++;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_CRC)
+			is_error_irq = true;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_ECC)
+			is_error_irq = true;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_MMAPPED_VC_DT)
+			is_error_irq = true;
+
+	}
+handle_fatal_error:
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+
+	if (csid_hw->error_irq_count || fatal_err_detected)
+		is_error_irq = true;
+
+	if (csid_hw->error_irq_count >
+		CAM_TFE_CSID_MAX_IRQ_ERROR_COUNT) {
+		fatal_err_detected = true;
+		csid_hw->error_irq_count = 0;
+	}
+
+	if (fatal_err_detected) {
+		/* Reset the Rx CFG registers */
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_cfg0_addr);
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+		report_err_type = CAM_ISP_HW_ERROR_CSID_FATAL;
+		cam_tfe_csid_handle_hw_err_irq(csid_hw,
+			report_err_type, irq_status);
+	}
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOT_IRQ) {
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL0_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL1_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL2_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL3_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+	}
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOT_IRQ) {
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL0_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL1_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL2_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL3_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+	}
+
+	if ((csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE) &&
+		(irq_status[TFE_CSID_IRQ_REG_RX] &
+		TFE_CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d LONG_PKT_CAPTURED",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_0_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d long packet VC :%d DT:%d WC:%d",
+			csid_hw->hw_intf->hw_idx,
+			(val >> 22), ((val >> 16) & 0x3F), (val & 0xFFFF));
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_1_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d long packet ECC :%d",
+			csid_hw->hw_intf->hw_idx, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_ftr_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d long pkt cal CRC:%d expected CRC:%d",
+			csid_hw->hw_intf->hw_idx, (val >> 16), (val & 0xFFFF));
+		/* reset long pkt strobe to capture next long packet */
+		val = (1 << csi2_reg->csi2_rx_long_pkt_hdr_rst_stb_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_rst_strobes_addr);
+	}
+	if ((csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE) &&
+		(irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d SHORT_PKT_CAPTURED",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_short_pkt_0_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d short pkt VC :%d DT:%d LC:%d",
+			csid_hw->hw_intf->hw_idx,
+			(val >> 22), ((val >> 16) & 0x1F), (val & 0xFFFF));
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_short_pkt_1_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d short packet ECC :%d",
+			csid_hw->hw_intf->hw_idx, val);
+		/* reset short pkt strobe to capture next short packet */
+		val = (1 << csi2_reg->csi2_rx_short_pkt_hdr_rst_stb_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_rst_strobes_addr);
+	}
+
+	if ((csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE) &&
+		(irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d CPHY_PKT_HDR_CAPTURED",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_cphy_pkt_hdr_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d cphy packet VC :%d DT:%d WC:%d",
+			csid_hw->hw_intf->hw_idx,
+			(val >> 22), ((val >> 16) & 0x1F), (val & 0xFFFF));
+		/* reset cphy pkt strobe to capture next short packet */
+		val = (1 << csi2_reg->csi2_rx_cphy_pkt_hdr_rst_stb_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_rst_strobes_addr);
+	}
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_RST_IRQ_LOG) {
+
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID IPP reset complete");
+
+		if (irq_status[TFE_CSID_IRQ_REG_PPP] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID PPP reset complete");
+
+		if (irq_status[TFE_CSID_IRQ_REG_TOP])
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID TOP reset complete");
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			BIT(csid_reg->csi2_reg->csi2_rst_done_shift_val))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID RX reset complete");
+	}
+
+	/* read the IPP errors */
+	if (csid_hw->pxl_pipe_enable) {
+		/* IPP reset done bit */
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) {
+			CAM_DBG(CAM_ISP, "CSID IPP reset complete");
+			complete(&csid_hw->csid_ipp_complete);
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] & TFE_CSID_PATH_INFO_INPUT_SOF) {
+			CAM_DBG(CAM_ISP, "CSID:%d IPP SOF received", csid_hw->hw_intf->hw_idx);
+			cam_tfe_csid_enable_path_for_init_frame_drop(csid_hw,
+				CAM_TFE_CSID_PATH_RES_IPP);
+		}
+
+		if ((irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_INFO_INPUT_SOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			if (!csid_hw->sof_irq_triggered)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP SOF received",
+					csid_hw->hw_intf->hw_idx);
+			else
+				log_en = 1;
+
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
+
+		if ((irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_INFO_INPUT_EOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d IPP EOF received",
+				csid_hw->hw_intf->hw_idx);
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_ERROR_FIFO_OVERFLOW) {
+			/* Stop IPP path immediately */
+			cam_io_w_mb(CAM_TFE_CSID_HALT_IMMEDIATELY,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_ctrl_addr);
+			is_error_irq = true;
+			report_err_type = CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_IPP_ERROR_CCIF_VIOLATION)
+			is_error_irq = true;
+
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] &
+			(TFE_CSID_PATH_ERROR_PIX_COUNT | TFE_CSID_PATH_ERROR_LINE_COUNT)) {
+			ipp_reg = csid_reg->ipp_reg;
+			cmn_reg = csid_reg->cmn_reg;
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				ipp_reg->csid_pxl_format_measure0_addr);
+			val1 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				ipp_reg->csid_pxl_format_measure_cfg1_addr);
+
+			CAM_ERR(CAM_ISP,
+				"Pix/Line count error for CSID: %d IPP path, Expected:: height: %d, width: %d and  Actual:: height: %d width %d",
+				csid_hw->hw_intf->hw_idx,
+				((val1 >>
+				cmn_reg->format_measure_height_shift_val) &
+				cmn_reg->format_measure_height_mask_val),
+				val1 &
+				cmn_reg->format_measure_width_mask_val,
+				((val >>
+				cmn_reg->format_measure_height_shift_val) &
+				cmn_reg->format_measure_height_mask_val),
+				val &
+				cmn_reg->format_measure_width_mask_val);
+			is_error_irq = true;
+			report_err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE;
+		}
+
+	}
+
+	/* read the PPP errors */
+	if (csid_reg->cmn_reg->num_ppp) {
+		/* PPP reset done bit */
+		if (irq_status[TFE_CSID_IRQ_REG_PPP] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) {
+			CAM_DBG(CAM_ISP, "CSID PPP reset complete");
+			complete(&csid_hw->csid_ppp_complete);
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_PPP] & TFE_CSID_PATH_INFO_INPUT_SOF) {
+			CAM_DBG(CAM_ISP, "CSID:%d PPP SOF received", csid_hw->hw_intf->hw_idx);
+			cam_tfe_csid_enable_path_for_init_frame_drop(csid_hw,
+				CAM_TFE_CSID_PATH_RES_PPP);
+		}
+
+		if ((irq_status[TFE_CSID_IRQ_REG_PPP] &
+			TFE_CSID_PATH_INFO_INPUT_SOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			if (!csid_hw->sof_irq_triggered)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PPP SOF received",
+					csid_hw->hw_intf->hw_idx);
+			else
+				log_en = 1;
+
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
+
+		if ((irq_status[TFE_CSID_IRQ_REG_PPP] &
+			TFE_CSID_PATH_INFO_INPUT_EOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d PPP EOF received",
+				csid_hw->hw_intf->hw_idx);
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_PPP] &
+			TFE_CSID_PATH_ERROR_FIFO_OVERFLOW) {
+			/* Stop PPP path immediately */
+			cam_io_w_mb(CAM_TFE_CSID_HALT_IMMEDIATELY,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->ppp_reg->csid_pxl_ctrl_addr);
+			is_error_irq = true;
+			report_err_type = CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_PPP] &
+			TFE_CSID_PATH_PPP_ERROR_CCIF_VIOLATION)
+			is_error_irq = true;
+
+		if (irq_status[TFE_CSID_IRQ_REG_PPP] &
+			(TFE_CSID_PATH_ERROR_PIX_COUNT | TFE_CSID_PATH_ERROR_LINE_COUNT)) {
+			ppp_reg = csid_reg->ppp_reg;
+			cmn_reg = csid_reg->cmn_reg;
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				ppp_reg->csid_pxl_format_measure0_addr);
+			val1 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				ppp_reg->csid_pxl_format_measure_cfg1_addr);
+
+			CAM_ERR(CAM_ISP,
+				"Pix/Line count error for CSID: %d PPP path, Expected:: height: %d, width: %d and  Actual:: height: %d width %d",
+				csid_hw->hw_intf->hw_idx,
+				((val1 >>
+				cmn_reg->format_measure_height_shift_val) &
+				cmn_reg->format_measure_height_mask_val),
+				val1 &
+				cmn_reg->format_measure_width_mask_val,
+				((val >>
+				cmn_reg->format_measure_height_shift_val) &
+				cmn_reg->format_measure_height_mask_val),
+				val &
+				cmn_reg->format_measure_width_mask_val);
+			is_error_irq = true;
+			report_err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE;
+		}
+
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+
+		if ((irq_status[i] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) &&
+			(csid_hw->csid_debug &
+			TFE_CSID_DEBUG_ENABLE_RST_IRQ_LOG))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RDI%d reset complete",
+				csid_hw->hw_intf->hw_idx, i);
+
+		if (irq_status[i] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) {
+			CAM_DBG(CAM_ISP, "CSID:%d RDI%d reset complete",
+				csid_hw->hw_intf->hw_idx, i);
+			complete(&csid_hw->csid_rdin_complete[i]);
+		}
+
+		if (irq_status[i] & TFE_CSID_PATH_INFO_INPUT_SOF) {
+			CAM_DBG(CAM_ISP, "CSID:%d RDI:%d SOF received",
+				csid_hw->hw_intf->hw_idx);
+			cam_tfe_csid_enable_path_for_init_frame_drop(csid_hw, i);
+		}
+
+		if ((irq_status[i] & TFE_CSID_PATH_INFO_INPUT_SOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			if (!csid_hw->sof_irq_triggered)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"CSID:%d RDI:%d SOF received",
+					csid_hw->hw_intf->hw_idx, i);
+			else
+				log_en = 1;
+
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
+
+		if ((irq_status[i] & TFE_CSID_PATH_INFO_INPUT_EOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RDI:%d EOF received",
+				csid_hw->hw_intf->hw_idx, i);
+		}
+
+		if (irq_status[i] & TFE_CSID_PATH_ERROR_FIFO_OVERFLOW) {
+			/* Stop RDI path immediately */
+			is_error_irq = true;
+			cam_io_w_mb(CAM_TFE_CSID_HALT_IMMEDIATELY,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_ctrl_addr);
+			report_err_type = CAM_ISP_HW_ERROR_CSID_OUTPUT_FIFO_OVERFLOW;
+		}
+
+		if ((irq_status[i] & TFE_CSID_PATH_RDI_OVERFLOW_IRQ) ||
+			(irq_status[i] &
+				 TFE_CSID_PATH_RDI_ERROR_CCIF_VIOLATION))
+			is_error_irq = true;
+
+		if ((irq_status[i] & TFE_CSID_PATH_ERROR_PIX_COUNT) ||
+			(irq_status[i] & TFE_CSID_PATH_ERROR_LINE_COUNT)) {
+			rdi_reg = csid_reg->rdi_reg[i];
+			cmn_reg = csid_reg->cmn_reg;
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				rdi_reg->csid_rdi_format_measure0_addr);
+			val1 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				rdi_reg->csid_rdi_format_measure_cfg1_addr);
+
+			CAM_ERR(CAM_ISP,
+				"Pix/Line count error for CSID:%d RDI:%d path, Expected:: height: %d, width: %d and  Actual:: height: %d width %d",
+				csid_hw->hw_intf->hw_idx, i,
+				((val1 >>
+				cmn_reg->format_measure_height_shift_val) &
+				cmn_reg->format_measure_height_mask_val),
+				val1 &
+				cmn_reg->format_measure_width_mask_val,
+				((val >>
+				cmn_reg->format_measure_height_shift_val) &
+				cmn_reg->format_measure_height_mask_val),
+				val &
+				cmn_reg->format_measure_width_mask_val);
+
+			is_error_irq = true;
+			report_err_type = CAM_ISP_HW_ERROR_CSID_FRAME_SIZE;
+		}
+	}
+
+	if (is_error_irq || log_en) {
+		CAM_ERR(CAM_ISP,
+			"CSID %d irq status TOP: 0x%x RX: 0x%x IPP: 0x%x PPP: 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			irq_status[TFE_CSID_IRQ_REG_TOP],
+			irq_status[TFE_CSID_IRQ_REG_RX],
+			irq_status[TFE_CSID_IRQ_REG_IPP],
+			irq_status[TFE_CSID_IRQ_REG_PPP]);
+		CAM_ERR(CAM_ISP,
+			"RDI0: 0x%x RDI1: 0x%x RDI2: 0x%x CSID clk:%d",
+			irq_status[TFE_CSID_IRQ_REG_RDI0],
+			irq_status[TFE_CSID_IRQ_REG_RDI1],
+			irq_status[TFE_CSID_IRQ_REG_RDI2],
+			soc_info->applied_src_clk_rates.sw_client);
+
+		cam_tfe_csid_handle_hw_err_irq(csid_hw,
+			report_err_type, irq_status);
+	}
+
+	if (csid_hw->irq_debug_cnt >= CAM_TFE_CSID_IRQ_SOF_DEBUG_CNT_MAX) {
+		cam_tfe_csid_sof_irq_debug(csid_hw, &sof_irq_debug_en);
+		csid_hw->irq_debug_cnt = 0;
+	}
+
+	CAM_DBG(CAM_ISP, "IRQ Handling exit");
+	return IRQ_HANDLED;
+}
+
+int cam_tfe_csid_hw_probe_init(struct cam_hw_intf  *csid_hw_intf,
+	uint32_t csid_idx)
+{
+	int rc = -EINVAL;
+	uint32_t i, j, val, clk_lvl;
+	struct cam_tfe_csid_path_cfg         *path_data;
+	struct cam_hw_info                   *csid_hw_info;
+	struct cam_tfe_csid_hw               *tfe_csid_hw = NULL;
+	struct cam_tfe_csid_soc_private      *soc_private = NULL;
+	const struct cam_tfe_csid_reg_offset *csid_reg;
+
+	if (csid_idx >= CAM_TFE_CSID_HW_NUM_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid csid index:%d", csid_idx);
+		return rc;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *) csid_hw_intf->hw_priv;
+	tfe_csid_hw  = (struct cam_tfe_csid_hw  *) csid_hw_info->core_info;
+
+	tfe_csid_hw->hw_intf = csid_hw_intf;
+	tfe_csid_hw->hw_info = csid_hw_info;
+	csid_reg = tfe_csid_hw->csid_info->csid_reg;
+
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		tfe_csid_hw->hw_intf->hw_type, csid_idx);
+
+	tfe_csid_hw->device_enabled = 0;
+	tfe_csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&tfe_csid_hw->hw_info->hw_mutex);
+	spin_lock_init(&tfe_csid_hw->hw_info->hw_lock);
+	spin_lock_init(&tfe_csid_hw->spin_lock);
+	init_completion(&tfe_csid_hw->hw_info->hw_complete);
+
+	init_completion(&tfe_csid_hw->csid_top_complete);
+	init_completion(&tfe_csid_hw->csid_csi2_complete);
+	init_completion(&tfe_csid_hw->csid_ipp_complete);
+	init_completion(&tfe_csid_hw->csid_ppp_complete);
+	for (i = 0; i < CAM_TFE_CSID_RDI_MAX; i++)
+		init_completion(&tfe_csid_hw->csid_rdin_complete[i]);
+
+	rc = cam_tfe_csid_init_soc_resources(&tfe_csid_hw->hw_info->soc_info,
+			cam_tfe_csid_irq, tfe_csid_hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d Failed to init_soc", csid_idx);
+		goto err;
+	}
+	rc = cam_soc_util_get_clk_level(&tfe_csid_hw->hw_info->soc_info,
+		tfe_csid_hw->clk_rate,
+		tfe_csid_hw->hw_info->soc_info.src_clk_idx, &clk_lvl);
+	CAM_DBG(CAM_ISP, "CSID clock lvl %u", clk_lvl);
+
+	rc = cam_tfe_csid_enable_soc_resources(&tfe_csid_hw->hw_info->soc_info,
+		clk_lvl);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d Enable SOC failed",
+			tfe_csid_hw->hw_intf->hw_idx);
+		goto err;
+	}
+
+	soc_private = (struct cam_tfe_csid_soc_private *) csid_hw_info->soc_info.soc_private;
+
+	tfe_csid_hw->hw_intf->hw_ops.get_hw_caps = cam_tfe_csid_get_hw_caps;
+	tfe_csid_hw->hw_intf->hw_ops.init        = cam_tfe_csid_init_hw;
+	tfe_csid_hw->hw_intf->hw_ops.deinit      = cam_tfe_csid_deinit_hw;
+	tfe_csid_hw->hw_intf->hw_ops.reset       = cam_tfe_csid_reset;
+	tfe_csid_hw->hw_intf->hw_ops.reserve     = cam_tfe_csid_reserve;
+	tfe_csid_hw->hw_intf->hw_ops.release     = cam_tfe_csid_release;
+	tfe_csid_hw->hw_intf->hw_ops.start       = cam_tfe_csid_start;
+	tfe_csid_hw->hw_intf->hw_ops.stop        = cam_tfe_csid_stop;
+	tfe_csid_hw->hw_intf->hw_ops.read        = cam_tfe_csid_read;
+	tfe_csid_hw->hw_intf->hw_ops.write       = cam_tfe_csid_write;
+	tfe_csid_hw->hw_intf->hw_ops.process_cmd = cam_tfe_csid_process_cmd;
+
+	/* reset the cid values */
+	for (i = 0; i < CAM_TFE_CSID_CID_MAX; i++) {
+		for (j = 0; j < CAM_ISP_TFE_VC_DT_CFG ; j++) {
+			tfe_csid_hw->cid_res[i].vc_dt[j].vc  = 0;
+			tfe_csid_hw->cid_res[i].vc_dt[j].dt  = 0;
+		}
+		tfe_csid_hw->cid_res[i].num_valid_vc_dt = 0;
+		tfe_csid_hw->cid_res[i].cnt = 0;
+	}
+
+	if (tfe_csid_hw->hw_intf->hw_idx == 2) {
+		val = cam_io_r_mb(
+			tfe_csid_hw->hw_info->soc_info.reg_map[1].mem_base +
+			csid_reg->cmn_reg->top_tfe2_fuse_reg);
+		if (val) {
+			CAM_INFO(CAM_ISP, "TFE 2 is not supported by hardware");
+
+			rc = cam_tfe_csid_disable_soc_resources(
+				&tfe_csid_hw->hw_info->soc_info);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"CSID:%d Disable CSID SOC failed",
+					tfe_csid_hw->hw_intf->hw_idx);
+			else
+				rc = -EINVAL;
+			goto err;
+		}
+	}
+
+	val = cam_io_r_mb(
+		tfe_csid_hw->hw_info->soc_info.reg_map[1].mem_base +
+		csid_reg->cmn_reg->top_tfe2_pix_pipe_fuse_reg);
+
+	/* Initialize the IPP resources */
+	if (!soc_private->is_tfe_csid_lite && !(val && (tfe_csid_hw->hw_intf->hw_idx == 2))) {
+		CAM_DBG(CAM_ISP, "initializing the pix path");
+
+		tfe_csid_hw->ipp_res.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		tfe_csid_hw->ipp_res.res_id = CAM_TFE_CSID_PATH_RES_IPP;
+		tfe_csid_hw->ipp_res.res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		tfe_csid_hw->ipp_res.hw_intf = tfe_csid_hw->hw_intf;
+		path_data = kzalloc(sizeof(*path_data),
+					GFP_KERNEL);
+		if (!path_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		tfe_csid_hw->ipp_res.res_priv = path_data;
+		tfe_csid_hw->pxl_pipe_enable = 1;
+	}
+
+	/* Initialize the PPP resources */
+	if (tfe_csid_hw->csid_info->csid_reg->cmn_reg->num_ppp) {
+		CAM_DBG(CAM_ISP, "initializing the ppp path");
+
+		tfe_csid_hw->ppp_res.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		tfe_csid_hw->ppp_res.res_id = CAM_TFE_CSID_PATH_RES_PPP;
+		tfe_csid_hw->ppp_res.res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		tfe_csid_hw->ppp_res.hw_intf = tfe_csid_hw->hw_intf;
+		path_data = kzalloc(sizeof(*path_data),
+					GFP_KERNEL);
+		if (!path_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		tfe_csid_hw->ppp_res.res_priv = path_data;
+	}
+
+	/* Initialize the RDI resource */
+	for (i = 0; i < tfe_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis;
+			i++) {
+		/* res type is from RDI 0 to RDI2 */
+		tfe_csid_hw->rdi_res[i].res_type =
+			CAM_ISP_RESOURCE_PIX_PATH;
+		tfe_csid_hw->rdi_res[i].res_id = i;
+		tfe_csid_hw->rdi_res[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		tfe_csid_hw->rdi_res[i].hw_intf = tfe_csid_hw->hw_intf;
+
+		path_data = kzalloc(sizeof(*path_data),
+			GFP_KERNEL);
+		if (!path_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		tfe_csid_hw->rdi_res[i].res_priv = path_data;
+	}
+
+	rc = cam_tasklet_init(&tfe_csid_hw->tasklet, tfe_csid_hw, csid_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Unable to create CSID tasklet rc %d", rc);
+		goto err;
+	}
+
+	INIT_LIST_HEAD(&tfe_csid_hw->free_payload_list);
+	for (i = 0; i < CAM_CSID_EVT_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&tfe_csid_hw->evt_payload[i].list);
+		list_add_tail(&tfe_csid_hw->evt_payload[i].list,
+			&tfe_csid_hw->free_payload_list);
+	}
+
+	tfe_csid_hw->csid_debug = 0;
+	tfe_csid_hw->error_irq_count = 0;
+	tfe_csid_hw->prev_boot_timestamp = 0;
+
+	rc = cam_tfe_csid_disable_soc_resources(
+		&tfe_csid_hw->hw_info->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d Disable CSID SOC failed",
+			tfe_csid_hw->hw_intf->hw_idx);
+		goto err;
+	}
+
+	/* Check if ppi bridge is present or not? */
+	tfe_csid_hw->ppi_enable = of_property_read_bool(
+		csid_hw_info->soc_info.pdev->dev.of_node,
+		"ppi-enable");
+
+	if (!tfe_csid_hw->ppi_enable)
+		return 0;
+
+	/* Initialize the PPI bridge */
+	for (i = 0; i < CAM_CSID_PPI_HW_MAX; i++) {
+		rc = cam_csid_ppi_hw_init(&tfe_csid_hw->ppi_hw_intf[i], i);
+		if (rc < 0) {
+			CAM_INFO(CAM_ISP, "PPI init failed for PPI %d", i);
+			rc = 0;
+			break;
+		}
+	}
+
+	return 0;
+err:
+	if (rc) {
+		kfree(tfe_csid_hw->ipp_res.res_priv);
+		if (tfe_csid_hw->csid_info->csid_reg->cmn_reg->num_ppp)
+			kfree(tfe_csid_hw->ppp_res.res_priv);
+		for (i = 0; i <
+			tfe_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis;
+			i++)
+			kfree(tfe_csid_hw->rdi_res[i].res_priv);
+	}
+
+	return rc;
+}
+
+
+int cam_tfe_csid_hw_deinit(struct cam_tfe_csid_hw *tfe_csid_hw)
+{
+	int rc = -EINVAL;
+	uint32_t i;
+
+	if (!tfe_csid_hw) {
+		CAM_ERR(CAM_ISP, "Invalid param");
+		return rc;
+	}
+
+	/* release the privdate data memory from resources */
+	kfree(tfe_csid_hw->ipp_res.res_priv);
+
+	if (tfe_csid_hw->csid_info->csid_reg->cmn_reg->num_ppp)
+		kfree(tfe_csid_hw->ppp_res.res_priv);
+
+	for (i = 0; i <
+		tfe_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis;
+		i++) {
+		kfree(tfe_csid_hw->rdi_res[i].res_priv);
+	}
+
+	cam_tfe_csid_deinit_soc_resources(&tfe_csid_hw->hw_info->soc_info);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.h
@@ -0,0 +1,562 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_HW_H_
+#define _CAM_TFE_CSID_HW_H_
+
+#include "cam_hw.h"
+#include "cam_tfe_csid_hw_intf.h"
+#include "cam_tfe_csid_soc.h"
+#include "cam_csid_ppi_core.h"
+
+#define CAM_TFE_CSID_CID_MAX                          4
+
+/* Each word is taken as uint32_t, for dumping uint64_t count as 2 words
+ * 1. soc_index
+ * 2. clk_rate --> uint64_t -> 2 words
+ */
+#define CAM_TFE_CSID_DUMP_MISC_NUM_WORDS              3
+
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED    BIT(0)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED    BIT(1)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED    BIT(2)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED    BIT(3)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED    BIT(4)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED    BIT(5)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED    BIT(6)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED    BIT(7)
+#define TFE_CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED       BIT(8)
+#define TFE_CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED      BIT(9)
+#define TFE_CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED   BIT(10)
+#define TFE_CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION     BIT(11)
+#define TFE_CSID_CSI2_RX_ERROR_CPHY_SOT_RECEPTION     BIT(12)
+#define TFE_CSID_CSI2_RX_ERROR_CPHY_PH_CRC            BIT(13)
+#define TFE_CSID_CSI2_RX_WARNING_ECC                  BIT(14)
+#define TFE_CSID_CSI2_RX_ERROR_LANE0_FIFO_OVERFLOW    BIT(15)
+#define TFE_CSID_CSI2_RX_ERROR_LANE1_FIFO_OVERFLOW    BIT(16)
+#define TFE_CSID_CSI2_RX_ERROR_LANE2_FIFO_OVERFLOW    BIT(17)
+#define TFE_CSID_CSI2_RX_ERROR_LANE3_FIFO_OVERFLOW    BIT(18)
+#define TFE_CSID_CSI2_RX_ERROR_CRC                    BIT(19)
+#define TFE_CSID_CSI2_RX_ERROR_ECC                    BIT(20)
+#define TFE_CSID_CSI2_RX_ERROR_MMAPPED_VC_DT          BIT(21)
+#define TFE_CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT         BIT(22)
+#define TFE_CSID_CSI2_RX_ERROR_STREAM_UNDERFLOW       BIT(23)
+#define TFE_CSID_CSI2_RX_ERROR_UNBOUNDED_FRAME        BIT(24)
+#define TFE_CSID_CSI2_RX_INFO_RST_DONE                BIT(27)
+
+#define TFE_CSID_PATH_INFO_RST_DONE                   BIT(1)
+#define TFE_CSID_PATH_ERROR_FIFO_OVERFLOW             BIT(2)
+#define TFE_CSID_PATH_INFO_INPUT_EOF                  BIT(9)
+#define TFE_CSID_PATH_INFO_INPUT_EOL                  BIT(10)
+#define TFE_CSID_PATH_INFO_INPUT_SOL                  BIT(11)
+#define TFE_CSID_PATH_INFO_INPUT_SOF                  BIT(12)
+#define TFE_CSID_PATH_ERROR_PIX_COUNT                 BIT(13)
+#define TFE_CSID_PATH_ERROR_LINE_COUNT                BIT(14)
+#define TFE_CSID_PATH_IPP_ERROR_CCIF_VIOLATION        BIT(15)
+#define TFE_CSID_PATH_IPP_FRAME_DROP                  BIT(16)
+#define TFE_CSID_PATH_IPP_OVERFLOW_IRQ                BIT(17)
+#define TFE_CSID_PATH_PPP_ERROR_CCIF_VIOLATION        BIT(15)
+#define TFE_CSID_PATH_PPP_FRAME_DROP                  BIT(16)
+#define TFE_CSID_PATH_PPP_OVERFLOW_IRQ                BIT(17)
+#define TFE_CSID_PATH_RDI_ERROR_CCIF_VIOLATION        BIT(15)
+#define TFE_CSID_PATH_RDI_FRAME_DROP                  BIT(16)
+#define TFE_CSID_PATH_RDI_OVERFLOW_IRQ                BIT(17)
+
+/*
+ * Debug values enable the corresponding interrupts and debug logs provide
+ * necessary information
+ */
+#define TFE_CSID_DEBUG_ENABLE_SOF_IRQ                 BIT(0)
+#define TFE_CSID_DEBUG_ENABLE_EOF_IRQ                 BIT(1)
+#define TFE_CSID_DEBUG_ENABLE_SOT_IRQ                 BIT(2)
+#define TFE_CSID_DEBUG_ENABLE_EOT_IRQ                 BIT(3)
+#define TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE       BIT(4)
+#define TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE        BIT(5)
+#define TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE        BIT(6)
+#define TFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO            BIT(7)
+#define TFE_CSID_DEBUG_DISABLE_EARLY_EOF              BIT(8)
+#define TFE_CSID_DEBUG_ENABLE_RST_IRQ_LOG             BIT(9)
+
+#define CAM_CSID_EVT_PAYLOAD_MAX                  10
+
+/* Binning supported masks. Binning support changes for specific paths
+ * and also for targets. With the mask, we handle the supported features
+ * in reg files and handle in code accordingly.
+ */
+
+#define CAM_TFE_CSID_BIN_BAYER                        BIT(0)
+#define CAM_TFE_CSID_BIN_QCFA                         BIT(1)
+
+/* enum cam_csid_path_halt_mode select the path halt mode control */
+enum cam_tfe_csid_path_halt_mode {
+	TFE_CSID_HALT_MODE_INTERNAL,
+	TFE_CSID_HALT_MODE_GLOBAL,
+	TFE_CSID_HALT_MODE_MASTER,
+	TFE_CSID_HALT_MODE_SLAVE,
+};
+
+/* enum cam_csid_path_halt_master select the path halt master control */
+enum cam_tfe_csid_path_halt_master_sel {
+	TFE_CSID_HALT_CMD_SOURCE_EXTERNAL,
+	TFE_CSID_HALT_CMD_SOURCE_NONE,
+	TFE_CSID_HALT_CMD_SOURCE_INTERNAL2,
+	TFE_CSID_HALT_CMD_SOURCE_INTERNAL1,
+};
+
+/**
+ *enum cam_csid_path_timestamp_stb_sel - select the sof/eof strobes used to
+ *        capture the timestamp
+ */
+enum cam_tfe_csid_path_timestamp_stb_sel {
+	TFE_CSID_TIMESTAMP_STB_PRE_HALT,
+	TFE_CSID_TIMESTAMP_STB_POST_HALT,
+	TFE_CSID_TIMESTAMP_STB_POST_IRQ,
+	TFE_CSID_TIMESTAMP_STB_MAX,
+};
+
+struct cam_tfe_csid_pxl_reg_offset {
+	/* Pxl path register offsets*/
+	uint32_t csid_pxl_irq_status_addr;
+	uint32_t csid_pxl_irq_mask_addr;
+	uint32_t csid_pxl_irq_clear_addr;
+	uint32_t csid_pxl_irq_set_addr;
+
+	uint32_t csid_pxl_cfg0_addr;
+	uint32_t csid_pxl_cfg1_addr;
+	uint32_t csid_pxl_ctrl_addr;
+	uint32_t csid_pxl_frame_drop_pattern;
+	uint32_t csid_pxl_frame_drop_period;
+	uint32_t csid_pxl_irq_subsample_pattern;
+	uint32_t csid_pxl_irq_subsample_period;
+	uint32_t csid_pxl_hcrop_addr;
+	uint32_t csid_pxl_vcrop_addr;
+	uint32_t csid_pxl_rst_strobes_addr;
+	uint32_t csid_pxl_status_addr;
+	uint32_t csid_pxl_misr_val_addr;
+	uint32_t csid_pxl_format_measure_cfg0_addr;
+	uint32_t csid_pxl_format_measure_cfg1_addr;
+	uint32_t csid_pxl_format_measure0_addr;
+	uint32_t csid_pxl_format_measure1_addr;
+	uint32_t csid_pxl_format_measure2_addr;
+	uint32_t csid_pxl_timestamp_curr0_sof_addr;
+	uint32_t csid_pxl_timestamp_curr1_sof_addr;
+	uint32_t csid_pxl_timestamp_perv0_sof_addr;
+	uint32_t csid_pxl_timestamp_perv1_sof_addr;
+	uint32_t csid_pxl_timestamp_curr0_eof_addr;
+	uint32_t csid_pxl_timestamp_curr1_eof_addr;
+	uint32_t csid_pxl_timestamp_perv0_eof_addr;
+	uint32_t csid_pxl_timestamp_perv1_eof_addr;
+	uint32_t csid_pxl_ppp_sparse_pd_ext_cfg0;
+	uint32_t csid_pxl_err_recovery_cfg0_addr;
+	uint32_t csid_pxl_err_recovery_cfg1_addr;
+	uint32_t csid_pxl_err_recovery_cfg2_addr;
+	uint32_t csid_pxl_multi_vcdt_cfg0_addr;
+
+	/* configuration */
+	uint32_t pix_store_en_shift_val;
+	uint32_t early_eof_en_shift_val;
+	uint32_t halt_master_sel_shift;
+	uint32_t halt_mode_shift;
+	uint32_t halt_cmd_shift;
+	uint32_t halt_master_sel_master_val;
+	uint32_t halt_master_sel_slave_val;
+	uint32_t binning_supported;
+	uint32_t bin_qcfa_en_shift_val;
+	uint32_t bin_en_shift_val;
+	uint32_t format_measure_en_shift_val;
+	uint32_t measure_en_hbi_vbi_cnt_val;
+	bool     is_multi_vc_dt_supported;
+};
+
+struct cam_tfe_csid_rdi_reg_offset {
+	uint32_t csid_rdi_irq_status_addr;
+	uint32_t csid_rdi_irq_mask_addr;
+	uint32_t csid_rdi_irq_clear_addr;
+	uint32_t csid_rdi_irq_set_addr;
+
+	/*RDI N register address */
+	uint32_t csid_rdi_cfg0_addr;
+	uint32_t csid_rdi_cfg1_addr;
+	uint32_t csid_rdi_ctrl_addr;
+	uint32_t csid_rdi_frame_drop_pattern;
+	uint32_t csid_rdi_frame_drop_period;
+	uint32_t csid_rdi_irq_subsample_pattern;
+	uint32_t csid_rdi_irq_subsample_period;
+	uint32_t csid_rdi_rst_strobes_addr;
+	uint32_t csid_rdi_status_addr;
+	uint32_t csid_rdi_misr_val0_addr;
+	uint32_t csid_rdi_misr_val1_addr;
+	uint32_t csid_rdi_misr_val2_addr;
+	uint32_t csid_rdi_misr_val3_addr;
+	uint32_t csid_rdi_format_measure_cfg0_addr;
+	uint32_t csid_rdi_format_measure_cfg1_addr;
+	uint32_t csid_rdi_format_measure0_addr;
+	uint32_t csid_rdi_format_measure1_addr;
+	uint32_t csid_rdi_format_measure2_addr;
+	uint32_t csid_rdi_timestamp_curr0_sof_addr;
+	uint32_t csid_rdi_timestamp_curr1_sof_addr;
+	uint32_t csid_rdi_timestamp_prev0_sof_addr;
+	uint32_t csid_rdi_timestamp_prev1_sof_addr;
+	uint32_t csid_rdi_timestamp_curr0_eof_addr;
+	uint32_t csid_rdi_timestamp_curr1_eof_addr;
+	uint32_t csid_rdi_timestamp_prev0_eof_addr;
+	uint32_t csid_rdi_timestamp_prev1_eof_addr;
+	uint32_t csid_rdi_err_recovery_cfg0_addr;
+	uint32_t csid_rdi_err_recovery_cfg1_addr;
+	uint32_t csid_rdi_err_recovery_cfg2_addr;
+	uint32_t csid_rdi_byte_cntr_ping_addr;
+	uint32_t csid_rdi_byte_cntr_pong_addr;
+	uint32_t csid_rdi_multi_vcdt_cfg0_addr;
+
+	/* configuration */
+	uint32_t packing_format;
+	uint32_t format_measure_en_shift_val;
+	uint32_t measure_en_hbi_vbi_cnt_val;
+	bool     is_multi_vc_dt_supported;
+};
+
+struct cam_tfe_csid_csi2_rx_reg_offset {
+	uint32_t csid_csi2_rx_irq_status_addr;
+	uint32_t csid_csi2_rx_irq_mask_addr;
+	uint32_t csid_csi2_rx_irq_clear_addr;
+	uint32_t csid_csi2_rx_irq_set_addr;
+	uint32_t csid_csi2_rx_cfg0_addr;
+	uint32_t csid_csi2_rx_cfg1_addr;
+	uint32_t csid_csi2_rx_capture_ctrl_addr;
+	uint32_t csid_csi2_rx_rst_strobes_addr;
+	uint32_t csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr;
+	uint32_t csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr;
+	uint32_t csid_csi2_rx_captured_short_pkt_0_addr;
+	uint32_t csid_csi2_rx_captured_short_pkt_1_addr;
+	uint32_t csid_csi2_rx_captured_long_pkt_0_addr;
+	uint32_t csid_csi2_rx_captured_long_pkt_1_addr;
+	uint32_t csid_csi2_rx_captured_long_pkt_ftr_addr;
+	uint32_t csid_csi2_rx_captured_cphy_pkt_hdr_addr;
+	uint32_t csid_csi2_rx_total_pkts_rcvd_addr;
+	uint32_t csid_csi2_rx_stats_ecc_addr; //no
+	uint32_t csid_csi2_rx_total_crc_err_addr;
+
+	/*configurations */
+	uint32_t phy_tpg_base_id;
+	uint32_t phy_sel_base;
+	uint32_t csi2_rst_srb_all;
+	uint32_t csi2_rst_done_shift_val;
+	uint32_t csi2_irq_mask_all;
+	uint32_t csi2_misr_enable_shift_val;
+	uint32_t csi2_vc_mode_shift_val;
+	uint32_t csi2_rx_epd_mode_shift_en;
+	uint32_t csi2_capture_long_pkt_en_shift;
+	uint32_t csi2_capture_short_pkt_en_shift;
+	uint32_t csi2_capture_cphy_pkt_en_shift;
+	uint32_t csi2_capture_long_pkt_dt_shift;
+	uint32_t csi2_capture_long_pkt_vc_shift;
+	uint32_t csi2_capture_short_pkt_vc_shift;
+	uint32_t csi2_capture_cphy_pkt_dt_shift;
+	uint32_t csi2_capture_cphy_pkt_vc_shift;
+	uint32_t csi2_rx_phy_num_mask;
+	uint32_t csi2_rx_long_pkt_hdr_rst_stb_shift;
+	uint32_t csi2_rx_short_pkt_hdr_rst_stb_shift;
+	uint32_t csi2_rx_cphy_pkt_hdr_rst_stb_shift;
+	bool     need_to_sel_tpg_mux;
+};
+
+struct cam_tfe_csid_common_reg_offset {
+	/* MIPI CSID registers */
+	uint32_t csid_hw_version_addr;
+	uint32_t csid_cfg0_addr;
+	uint32_t csid_ctrl_addr;
+	uint32_t csid_rst_strobes_addr;
+
+	uint32_t csid_test_bus_ctrl_addr;
+	uint32_t csid_top_irq_status_addr;
+	uint32_t csid_top_irq_mask_addr;
+	uint32_t csid_top_irq_clear_addr;
+	uint32_t csid_top_irq_set_addr;
+	uint32_t csid_irq_cmd_addr;
+
+	/*configurations */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t num_rdis;
+	uint32_t num_pix;
+	uint32_t num_ppp;
+	uint32_t csid_reg_rst_stb;
+	uint32_t csid_rst_stb;
+	uint32_t csid_rst_stb_sw_all;
+	uint32_t ipp_path_rst_stb_all;
+	uint32_t ppp_path_rst_stb_all;
+	uint32_t rdi_path_rst_stb_all;
+	uint32_t path_rst_done_shift_val;
+	uint32_t path_en_shift_val;
+	uint32_t dt_id_shift_val;
+	uint32_t vc_shift_val;
+	uint32_t dt_shift_val;
+	uint32_t vc1_shift_val;
+	uint32_t dt1_shift_val;
+	uint32_t multi_vc_dt_en_shift_val;
+	uint32_t fmt_shift_val;
+	uint32_t plain_fmt_shit_val;
+	uint32_t crop_v_en_shift_val;
+	uint32_t crop_h_en_shift_val;
+	uint32_t crop_shift;
+	uint32_t ipp_irq_mask_all;
+	uint32_t ppp_irq_mask_all;
+	uint32_t rdi_irq_mask_all;
+	uint32_t top_tfe2_pix_pipe_fuse_reg;
+	uint32_t top_tfe2_fuse_reg;
+	uint32_t format_measure_height_shift_val;
+	uint32_t format_measure_height_mask_val;
+	uint32_t format_measure_width_mask_val;
+	bool     format_measure_support;
+	bool     sync_clk;
+};
+
+/**
+ * struct cam_tfe_csid_reg_offset- CSID instance register info
+ *
+ * @cmn_reg:  csid common registers info
+ * @ipp_reg:  ipp register offset information
+ * @ppp_reg:  ppp register offset information
+ * @rdi_reg:  rdi register offset information
+ *
+ */
+struct cam_tfe_csid_reg_offset {
+	const struct cam_tfe_csid_common_reg_offset   *cmn_reg;
+	const struct cam_tfe_csid_csi2_rx_reg_offset  *csi2_reg;
+	const struct cam_tfe_csid_pxl_reg_offset      *ipp_reg;
+	const struct cam_tfe_csid_pxl_reg_offset      *ppp_reg;
+	const struct cam_tfe_csid_rdi_reg_offset *rdi_reg[CAM_TFE_CSID_RDI_MAX];
+};
+
+/**
+ * struct cam_tfe_csid_hw_info- CSID HW info
+ *
+ * @csid_reg:        csid register offsets
+ * @hw_dts_version:  HW DTS version
+ * @csid_max_clk:    maximim csid clock
+ *
+ */
+struct cam_tfe_csid_hw_info {
+	const struct cam_tfe_csid_reg_offset   *csid_reg;
+	uint32_t                                hw_dts_version;
+	uint32_t                                csid_max_clk;
+};
+
+/**
+ * struct cam_tfe_csid_csi2_rx_cfg- csid csi2 rx configuration data
+ * @phy_sel:          input resource type for sensor only
+ * @lane_type:        lane type: c-phy or d-phy
+ * @lane_num :        active lane number
+ * @lane_cfg:         lane configurations: 4 bits per lane
+ * @epd_supported:    Flag to check if epd supported
+ *
+ */
+struct cam_tfe_csid_csi2_rx_cfg  {
+	uint32_t                        phy_sel;
+	uint32_t                        lane_type;
+	uint32_t                        lane_num;
+	uint32_t                        lane_cfg;
+	uint32_t                        epd_supported;
+};
+
+/**
+ * struct vc_dt_data- VC DT data
+ *
+ * @vc:          VC data
+ * @dt:          DT data
+ *
+ */
+struct vc_dt_data {
+	uint32_t                     vc;
+	uint32_t                     dt;
+};
+
+/**
+ * struct cam_tfe_csid_cid_data- cid configuration private data
+ *
+ * @vc_dt:              VC DT data
+ * @num_valid_vc_dt:    Number of VC-DTs
+ * @cnt:                Cid resource reference count.
+ *
+ */
+struct cam_tfe_csid_cid_data {
+	struct vc_dt_data            vc_dt[CAM_ISP_TFE_VC_DT_CFG];
+	uint32_t                     num_valid_vc_dt;
+	uint32_t                     cnt;
+};
+
+/**
+ * struct cam_tfe_csid_path_cfg- csid path configuration details. It is stored
+ *                          as private data for IPP/ RDI paths
+ * @vc_dt :             VC DT data
+ * @num_valid_vc_dt:    Number of valid VC-DTs
+ * @cid                 cid number, it is same as DT_ID number in HW
+ * @in_format:          input decode format
+ * @out_format:         output format
+ * @crop_enable:        crop is enable or disabled, if enabled
+ *                      then remaining parameters are valid.
+ * @start_pixel:        start pixel
+ * @end_pixel:          end_pixel
+ * @width:              width
+ * @start_line:         start line
+ * @end_line:           end_line
+ * @height:             heigth
+ * @sync_mode:          Applicable for IPP/RDI path reservation
+ *                      Reserving the path for master IPP or slave IPP
+ *                      master (set value 1), Slave ( set value 2)
+ *                      for RDI, set  mode to none
+ * @master_idx:         For Slave reservation, Give master TFE instance Index.
+ *                      Slave will synchronize with master Start and stop
+ *                      operations
+ * @clk_rate:           Clock rate
+ * @sensor_width:       Sensor width in pixel
+ * @sensor_height:      Sensor height in pixel
+ * @sensor_fps:         Sensor fps
+ * @sensor_hbi:         Sensor horizontal blanking interval
+ * @sensor_vbi:         Sensor vertical blanking interval
+ * @bayer_bin:          Bayer binning
+ * @qcfa_bin:           Quad-CFA binning
+ * @usage_type:         dual or single tfe information
+ * @init_frame_drop     init frame drop value. In dual ife case rdi need to drop
+ *                      one more frame than pix.
+ * @res_sof_cnt         path resource sof count value. it used for initial
+ *                      frame drop
+ * @is_shdr_master      flag to indicate path to be shdr master
+ * @is_shdr             flag to indicate if shdr mode is enabled
+ */
+struct cam_tfe_csid_path_cfg {
+	struct vc_dt_data               vc_dt[CAM_ISP_TFE_VC_DT_CFG];
+	uint32_t                        num_valid_vc_dt;
+	uint32_t                        cid;
+	uint32_t                        in_format;
+	uint32_t                        out_format;
+	bool                            crop_enable;
+	uint32_t                        start_pixel;
+	uint32_t                        end_pixel;
+	uint32_t                        width;
+	uint32_t                        start_line;
+	uint32_t                        end_line;
+	uint32_t                        height;
+	enum cam_isp_hw_sync_mode       sync_mode;
+	uint32_t                        master_idx;
+	uint64_t                        clk_rate;
+	uint32_t                        sensor_width;
+	uint32_t                        sensor_height;
+	uint32_t                        sensor_fps;
+	uint32_t                        sensor_hbi;
+	uint32_t                        sensor_vbi;
+	uint32_t                        bayer_bin;
+	uint32_t                        qcfa_bin;
+	uint32_t                        usage_type;
+	uint32_t                        init_frame_drop;
+	uint32_t                        res_sof_cnt;
+	bool                            is_shdr_master;
+	bool                            is_shdr;
+};
+
+/**
+ * struct cam_csid_evt_payload- payload for csid hw event
+ * @list       : list head
+ * @evt_type   : Event type from CSID
+ * @irq_status : IRQ Status register
+ * @hw_idx     : Hw index
+ * @priv       : Private data of payload
+ */
+struct cam_csid_evt_payload {
+	struct list_head   list;
+	uint32_t           evt_type;
+	uint32_t           irq_status[TFE_CSID_IRQ_REG_MAX];
+	uint32_t           hw_idx;
+	void              *priv;
+};
+
+/**
+ * struct cam_tfe_csid_hw- csid hw device resources data
+ *
+ * @hw_intf:                  contain the csid hw interface information
+ * @hw_info:                  csid hw device information
+ * @csid_info:                csid hw specific information
+ * @tasklet:                  tasklet to handle csid errors
+ * @free_payload_list:        list head for payload
+ * @evt_payload:              Event payload to be passed to tasklet
+ * @in_res_id:                csid in resource type
+ * @csi2_rx_cfg:              csi2 rx decoder configuration for csid
+ * @csi2_rx_reserve_cnt:      csi2 reservations count value
+ * pxl_pipe_enable:           flag to specify if the hardware has IPP
+ * @ipp_res:                  image pixel path resource
+ * @ppp_res:                  PD pixel path resource
+ * @rdi_res:                  raw dump image path resources
+ * @cid_res:                  cid resources values
+ * @csid_top_reset_complete:  csid top reset completion
+ * @csid_csi2_reset_complete: csi2 reset completion
+ * @csid_ipp_reset_complete:  ipp reset completion
+ * @csid_rdin_reset_complete: rdi n completion
+ * @csid_debug:               csid debug information to enable the SOT, EOT,
+ *                            SOF, EOF, measure etc in the csid hw
+ * @clk_rate                  Clock rate
+ * @sof_irq_triggered:        Flag is set on receiving event to enable sof irq
+ *                            incase of SOF freeze.
+ * @irq_debug_cnt:            Counter to track sof irq's when above flag is set.
+ * @error_irq_count           Error IRQ count, if continuous error irq comes
+ *                            need to stop the CSID and mask interrupts.
+ * @device_enabled            Device enabled will set once CSID powered on and
+ *                            initial configuration are done.
+ * @lock_state                csid spin lock
+ * @fatal_err_detected        flag to indicate fatal errror is reported
+ * @event_cb:                 Callback function to hw mgr in case of hw events
+ * @event_cb_priv:            Context data
+ * @ppi_hw_intf               interface to ppi hardware
+ * @ppi_enabled               flag to specify if the hardware has ppi bridge
+ *                            or not
+ * @prev_boot_timestamp       previous frame bootime stamp
+ * @prev_qtimer_ts            previous frame qtimer csid timestamp
+ * @sync_clk                  sync clocks such that freq(TFE)>freq(CSID)>freq(CSIPHY)
+ *
+ */
+struct cam_tfe_csid_hw {
+	struct cam_hw_intf                 *hw_intf;
+	struct cam_hw_info                 *hw_info;
+	struct cam_tfe_csid_hw_info        *csid_info;
+	void                               *tasklet;
+	struct list_head                    free_payload_list;
+	struct cam_csid_evt_payload   evt_payload[CAM_CSID_EVT_PAYLOAD_MAX];
+	uint32_t                            in_res_id;
+	struct cam_tfe_csid_csi2_rx_cfg     csi2_rx_cfg;
+	uint32_t                            csi2_reserve_cnt;
+	uint32_t                            pxl_pipe_enable;
+	struct cam_isp_resource_node        ipp_res;
+	struct cam_isp_resource_node        ppp_res;
+	struct cam_isp_resource_node        rdi_res[CAM_TFE_CSID_RDI_MAX];
+	struct cam_tfe_csid_cid_data        cid_res[CAM_TFE_CSID_CID_MAX];
+	struct completion                   csid_top_complete;
+	struct completion                   csid_csi2_complete;
+	struct completion                   csid_ipp_complete;
+	struct completion                   csid_ppp_complete;
+	struct completion     csid_rdin_complete[CAM_TFE_CSID_RDI_MAX];
+	uint64_t                            csid_debug;
+	uint64_t                            clk_rate;
+	bool                                sof_irq_triggered;
+	uint32_t                            irq_debug_cnt;
+	uint32_t                            error_irq_count;
+	uint32_t                            device_enabled;
+	spinlock_t                          spin_lock;
+	bool                                fatal_err_detected;
+	cam_hw_mgr_event_cb_func            event_cb;
+	void                               *event_cb_priv;
+	struct cam_hw_intf                 *ppi_hw_intf[CAM_CSID_PPI_HW_MAX];
+	bool                                ppi_enable;
+	uint64_t                            prev_boot_timestamp;
+	uint64_t                            prev_qtimer_ts;
+	bool                                sync_clk;
+};
+
+int cam_tfe_csid_hw_probe_init(struct cam_hw_intf  *csid_hw_intf,
+	uint32_t csid_idx);
+
+int cam_tfe_csid_hw_deinit(struct cam_tfe_csid_hw *tfe_csid_hw);
+
+#endif /* _CAM_TFE_CSID_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.c
@@ -0,0 +1,179 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <dt-bindings/msm-camera.h>
+#include "cam_tfe_csid_core.h"
+#include "cam_tfe_csid_dev.h"
+#include "cam_tfe_csid_hw_intf.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_cpas_api.h"
+
+static struct cam_hw_intf *cam_tfe_csid_hw_list[CAM_TFE_CSID_HW_NUM_MAX] = {
+	0, 0, 0};
+
+static int cam_tfe_csid_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+
+	struct cam_hw_intf             *csid_hw_intf;
+	struct cam_hw_info             *csid_hw_info;
+	struct cam_tfe_csid_hw         *csid_dev = NULL;
+	const struct of_device_id      *match_dev = NULL;
+	struct cam_tfe_csid_hw_info    *csid_hw_data = NULL;
+	uint32_t                        csid_dev_idx = 0;
+	int                             rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ISP, "probe called");
+
+	/* get tfe csid hw index */
+	rc = of_property_read_u32(pdev->dev.of_node, "cell-index", &csid_dev_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to read cell-index of TFE CSID HW, rc: %d", rc);
+		goto err;
+	}
+
+	if (!cam_cpas_is_feature_supported(CAM_CPAS_ISP_FUSE, BIT(csid_dev_idx), NULL) ||
+		!cam_cpas_is_feature_supported(CAM_CPAS_ISP_LITE_FUSE, BIT(csid_dev_idx), NULL)) {
+		CAM_DBG(CAM_ISP, "CSID[%d] not supported based on fuse", csid_dev_idx);
+		goto err;
+	}
+
+	csid_hw_intf = kzalloc(sizeof(*csid_hw_intf), GFP_KERNEL);
+	if (!csid_hw_intf) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	csid_hw_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!csid_hw_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	csid_dev = kzalloc(sizeof(struct cam_tfe_csid_hw), GFP_KERNEL);
+	if (!csid_dev) {
+		rc = -ENOMEM;
+		goto free_hw_info;
+	}
+
+	/* get tfe csid hw information */
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "No matching table for the tfe csid hw");
+		rc = -EINVAL;
+		goto free_dev;
+	}
+
+	csid_hw_intf->hw_idx = csid_dev_idx;
+	csid_hw_intf->hw_type = CAM_ISP_HW_TYPE_TFE_CSID;
+	csid_hw_intf->hw_priv = csid_hw_info;
+
+	csid_hw_info->core_info = csid_dev;
+	csid_hw_info->soc_info.pdev = pdev;
+	csid_hw_info->soc_info.dev = &pdev->dev;
+	csid_hw_info->soc_info.dev_name = pdev->name;
+	csid_hw_info->soc_info.index = csid_dev_idx;
+
+	csid_hw_data = (struct cam_tfe_csid_hw_info  *)match_dev->data;
+	/* need to setup the pdev before call the tfe hw probe init */
+	csid_dev->csid_info = csid_hw_data;
+
+	rc = cam_tfe_csid_hw_probe_init(csid_hw_intf, csid_dev_idx);
+	if (rc)
+		goto free_dev;
+
+	platform_set_drvdata(pdev, csid_dev);
+	CAM_DBG(CAM_ISP, "CSID:%d probe successful",
+		csid_hw_intf->hw_idx);
+
+	if (csid_hw_intf->hw_idx < CAM_TFE_CSID_HW_NUM_MAX)
+		cam_tfe_csid_hw_list[csid_hw_intf->hw_idx] = csid_hw_intf;
+	else
+		goto free_dev;
+
+	return 0;
+
+free_dev:
+	kfree(csid_dev);
+free_hw_info:
+	kfree(csid_hw_info);
+free_hw_intf:
+	kfree(csid_hw_intf);
+err:
+	return rc;
+}
+
+void cam_tfe_csid_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_tfe_csid_hw         *csid_dev = NULL;
+	struct cam_hw_intf             *csid_hw_intf;
+	struct cam_hw_info             *csid_hw_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	csid_dev = (struct cam_tfe_csid_hw *)platform_get_drvdata(pdev);
+
+	if (!csid_dev) {
+		CAM_ERR(CAM_ISP, "Error No data in csid_dev");
+		return;
+	}
+
+	csid_hw_intf = csid_dev->hw_intf;
+	csid_hw_info = csid_dev->hw_info;
+
+	CAM_DBG(CAM_ISP, "CSID:%d remove",
+		csid_dev->hw_intf->hw_idx);
+
+	cam_tfe_csid_hw_deinit(csid_dev);
+
+	/*release the csid device memory */
+	kfree(csid_dev);
+	kfree(csid_hw_info);
+	kfree(csid_hw_intf);
+}
+
+const static struct component_ops cam_tfe_csid_component_ops = {
+	.bind = cam_tfe_csid_component_bind,
+	.unbind = cam_tfe_csid_component_unbind,
+};
+
+int cam_tfe_csid_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	rc = component_add(&pdev->dev, &cam_tfe_csid_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_tfe_csid_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_tfe_csid_component_ops);
+	return 0;
+}
+
+int cam_tfe_csid_hw_init(struct cam_hw_intf **tfe_csid_hw,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_tfe_csid_hw_list[hw_idx]) {
+		*tfe_csid_hw = cam_tfe_csid_hw_list[hw_idx];
+	} else {
+		*tfe_csid_hw = NULL;
+		rc = -1;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_DEV_H_
+#define _CAM_TFE_CSID_DEV_H_
+
+#include "cam_isp_hw.h"
+
+irqreturn_t cam_tfe_csid_irq(int irq_num, void *data);
+
+int cam_tfe_csid_probe(struct platform_device *pdev);
+int cam_tfe_csid_remove(struct platform_device *pdev);
+
+#endif /*_CAM_TFE_CSID_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.c
@@ -0,0 +1,215 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/slab.h>
+#include "cam_tfe_csid_soc.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+
+
+int cam_tfe_csid_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler, void *data)
+{
+	int rc = 0, i;
+	struct cam_cpas_register_params   cpas_register_param;
+	struct cam_tfe_csid_soc_private      *soc_private;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	soc_private = kzalloc(sizeof(struct cam_tfe_csid_soc_private),
+		GFP_KERNEL);
+	if (!soc_private)
+		return -ENOMEM;
+
+	soc_info->soc_private = soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	soc_private->is_tfe_csid_lite = false;
+	if (strnstr(soc_info->compatible, "lite", strlen(soc_info->compatible)) != NULL)
+		soc_private->is_tfe_csid_lite = true;
+
+	/* Need to see if we want post process the clock list */
+	rc = cam_soc_util_request_platform_resource(soc_info, csid_irq_handler, &(irq_data[0]));
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Error Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "csid",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	} else {
+		soc_private->cpas_handle = cpas_register_param.client_handle;
+	}
+
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_tfe_csid_deinit_soc_resources(
+	struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPAS unregistration failed rc=%d", rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+
+	return rc;
+}
+
+int cam_tfe_csid_enable_soc_resources(
+	struct cam_hw_soc_info *soc_info, enum cam_vote_level clk_level)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	CAM_DBG(CAM_ISP, "csid camnoc_bw:%lld mnoc_ab_bw:%lld mnoc_ib_bw:%lld ",
+		axi_vote.axi_path[0].camnoc_bw,
+		axi_vote.axi_path[0].mnoc_ab_bw,
+		axi_vote.axi_path[0].mnoc_ib_bw);
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS start failed");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "enable platform failed");
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_tfe_csid_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Disable platform failed");
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_tfe_csid_enable_tfe_force_clock_on(struct cam_hw_soc_info  *soc_info,
+	uint32_t cpas_tfe_base_offset)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+	uint32_t                           cpass_tfe_force_clk_offset;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+
+	soc_private = soc_info->soc_private;
+	cpass_tfe_force_clk_offset =
+		cpas_tfe_base_offset + (0x4 * soc_info->index);
+	rc = cam_cpas_reg_write(soc_private->cpas_handle, CAM_CPAS_REGBASE_CPASTOP,
+		cpass_tfe_force_clk_offset, 1, 1);
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPASS set TFE:%d Force clock On failed",
+			soc_info->index);
+	else
+		CAM_DBG(CAM_ISP, "CPASS set TFE:%d Force clock On",
+		soc_info->index);
+
+	return rc;
+}
+
+int cam_tfe_csid_disable_tfe_force_clock_on(struct cam_hw_soc_info *soc_info,
+	uint32_t cpas_tfe_base_offset)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+	uint32_t                           cpass_tfe_force_clk_offset;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+
+	soc_private = soc_info->soc_private;
+	cpass_tfe_force_clk_offset =
+		cpas_tfe_base_offset + (0x4 * soc_info->index);
+	rc = cam_cpas_reg_write(soc_private->cpas_handle, CAM_CPAS_REGBASE_CPASTOP,
+		cpass_tfe_force_clk_offset,  1, 0);
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPASS set TFE:%d Force clock Off failed",
+			soc_info->index);
+	else
+		CAM_DBG(CAM_ISP, "CPASS set TFE:%d Force clock off",
+		soc_info->index);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.h
@@ -0,0 +1,122 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_SOC_H_
+#define _CAM_TFE_CSID_SOC_H_
+
+#include "cam_isp_hw.h"
+
+/*
+ * struct cam_csid_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to CSID HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ * @is_tfe_csid_lite:        Flag to indicate if it is CSID lite HW
+ */
+struct cam_tfe_csid_soc_private {
+	uint32_t cpas_handle;
+	bool     is_tfe_csid_lite;
+};
+
+/**
+ * struct csid_device_soc_info - CSID SOC info object
+ *
+ * @csi_vdd_voltage:       Csi vdd voltage value
+ *
+ */
+struct cam_tfe_csid_device_soc_info {
+	int                             csi_vdd_voltage;
+};
+
+/**
+ * cam_tfe_csid_init_soc_resources()
+ *
+ * @brief:                 Csid initialization function for the soc info
+ *
+ * @soc_info:              Soc info structure pointer
+ * @csid_irq_handler:      Irq handler function to be registered
+ * @irq_data:              Irq data for the callback function
+ *
+ */
+int cam_tfe_csid_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler, void *irq_data);
+
+
+/**
+ * cam_tfe_csid_deinit_soc_resources()
+ *
+ * @brief:                 Csid de initialization function for the soc info
+ *
+ * @soc_info:              Soc info structure pointer
+ *
+ */
+int cam_tfe_csid_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_tfe_csid_enable_soc_resources()
+ *
+ * @brief:                 Csid soc resource enable function
+ *
+ * @soc_info:              Soc info structure pointer
+ * @clk_lvl:               Vote level to start with
+ *
+ */
+int cam_tfe_csid_enable_soc_resources(struct cam_hw_soc_info  *soc_info,
+	uint32_t clk_lvl);
+
+/**
+ * cam_tfe_csid_disable_soc_resources()
+ *
+ * @brief:                 Csid soc resource disable function
+ *
+ * @soc_info:              Soc info structure pointer
+ *
+ */
+int cam_tfe_csid_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_tfe_csid_enable_tfe_force_clock()
+ *
+ * @brief:                 If csid testgen used for dual isp case, before
+ *                         starting csid test gen, enable tfe force clock on
+ *                         through cpas
+ *
+ * @soc_info:              Soc info structure pointer
+ * @cpas_tfe_base_offset:  Cpas tfe force clock base reg offset value
+ *
+ */
+int cam_tfe_csid_enable_tfe_force_clock_on(struct cam_hw_soc_info  *soc_info,
+	uint32_t cpas_tfe_base_offset);
+
+/**
+ * cam_tfe_csid_disable_tfe_force_clock_on()
+ *
+ * @brief:                 Disable the TFE force clock on after dual ISP
+ *                         CSID test gen stop
+ *
+ * @soc_info:              Soc info structure pointer
+ * @cpas_tfe_base_offset:  Cpas tfe force clock base reg offset value
+ *
+ */
+int cam_tfe_csid_disable_tfe_force_clock_on(struct cam_hw_soc_info *soc_info,
+	uint32_t cpas_tfe_base_offset);
+
+/**
+ * cam_tfe_csid_get_vote_level()
+ *
+ * @brief:                 Get the vote level from clock rate
+ *
+ * @soc_info:              Soc info structure pointer
+ * @clock_rate             Clock rate
+ *
+ */
+uint32_t cam_tfe_csid_get_vote_level(struct cam_hw_soc_info *soc_info,
+	uint64_t clock_rate);
+
+#endif /* _CAM_TFE_CSID_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe.c
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_tfe530.h"
+#include "cam_tfe640.h"
+#include "cam_tfe640_210.h"
+#include "cam_tfe770.h"
+#include "cam_tfe_lite770.h"
+#include "cam_tfe665.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_tfe_core.h"
+#include "cam_tfe_dev.h"
+#include "camera_main.h"
+
+static const struct of_device_id cam_tfe_dt_match[] = {
+	{
+		.compatible = "qcom,tfe530",
+		.data = &cam_tfe530,
+	},
+	{
+		.compatible = "qcom,tfe640",
+		.data = &cam_tfe640,
+	},
+	{
+		.compatible = "qcom,tfe640_210",
+		.data = &cam_tfe640_210,
+	},
+	{
+		.compatible = "qcom,tfe770",
+		.data = &cam_tfe770,
+	},
+	{
+		.compatible = "qcom,tfe-lite770",
+		.data = &cam_tfe_lite770,
+	},
+	{
+		.compatible = "qcom,tfe665",
+		.data = &cam_tfe665,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_tfe_dt_match);
+
+struct platform_driver cam_tfe_driver = {
+	.probe = cam_tfe_probe,
+	.remove = cam_tfe_remove,
+	.driver = {
+		.name = "cam_tfe",
+		.of_match_table = cam_tfe_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_tfe_init_module(void)
+{
+	return platform_driver_register(&cam_tfe_driver);
+}
+
+void cam_tfe_exit_module(void)
+{
+	platform_driver_unregister(&cam_tfe_driver);
+}
+
+MODULE_DESCRIPTION("CAM TFE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe530.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe530.h
@@ -0,0 +1,949 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE530_H_
+#define _CAM_TFE530_H_
+#include "cam_tfe_core.h"
+#include "cam_tfe_bus.h"
+
+
+static struct cam_tfe_top_reg_offset_common  tfe530_top_commong_reg  = {
+	.hw_version                             = 0x00001000,
+	.hw_capability                          = 0x00001004,
+	.lens_feature                           = 0x00001008,
+	.stats_feature                          = 0x0000100C,
+	.zoom_feature                           = 0x00001010,
+	.global_reset_cmd                       = 0x00001014,
+	.core_cgc_ctrl_0                        = 0x00001018,
+	.ahb_cgc_ctrl                           = 0x0000101C,
+	.core_cfg_0                             = 0x00001024,
+	.core_cfg_1                             = 0x00001028,
+	.reg_update_cmd                         = 0x0000102C,
+	.diag_config                            = 0x00001060,
+	.diag_sensor_status_0                   = 0x00001064,
+	.diag_sensor_status_1                   = 0x00001068,
+	.diag_sensor_frame_cnt_status           = 0x0000106C,
+	.violation_status                       = 0x00001070,
+	.stats_throttle_cnt_cfg_0               = 0x00001074,
+	.stats_throttle_cnt_cfg_1               = 0x00001078,
+	.num_debug_reg                          = 4,
+	.debug_reg = {
+		0x000010A0,
+		0x000010A4,
+		0x000010A8,
+		0x000010AC,
+	},
+	.debug_cfg                              = 0x000010DC,
+	.num_perf_cfg                           = 1,
+	.perf_cfg = {
+		{
+			.perf_cnt_cfg           = 0x000010E0,
+			.perf_pixel_count       = 0x000010E4,
+			.perf_line_count        = 0x000010E8,
+			.perf_stall_count       = 0x000010EC,
+			.perf_always_count      = 0x000010F0,
+			.perf_count_status      = 0x000010F4,
+		},
+	},
+	.diag_min_hbi_error_shift               = 15,
+	.diag_neq_hbi_shift                     = 14,
+	.diag_sensor_hbi_mask                   = 0x3FFF,
+	.serializer_supported                   = false,
+	.pp_camif_violation_bit                 = BIT(0),
+	.pp_violation_bit                       = BIT(1),
+	.rdi0_camif_violation_bit               = BIT(2),
+	.rdi1_camif_violation_bit               = BIT(3),
+	.rdi2_camif_violation_bit               = BIT(4),
+	.diag_violation_bit                     = BIT(5),
+	.pp_frame_drop_bit                      = BIT(8),
+	.rdi0_frame_drop_bit                    = BIT(9),
+	.rdi1_frame_drop_bit                    = BIT(10),
+	.rdi2_frame_drop_bit                    = BIT(11),
+	.pp_overflow_bit                        = BIT(16),
+	.rdi0_overflow_bit                      = BIT(17),
+	.rdi1_overflow_bit                      = BIT(18),
+	.rdi2_overflow_bit                      = BIT(19),
+	.mup_shift_val                          = 0,
+	.mup_supported                          = false,
+	.height_shift                           = 16,
+	.epoch_shift_val                        = 16,
+};
+
+static struct cam_tfe_camif_reg  tfe530_camif_reg = {
+	.hw_version                   = 0x00001200,
+	.hw_status                    = 0x00001204,
+	.module_cfg                   = 0x00001260,
+	.pdaf_raw_crop_width_cfg      = 0x00001268,
+	.pdaf_raw_crop_height_cfg     = 0x0000126C,
+	.line_skip_pattern            = 0x00001270,
+	.pixel_skip_pattern           = 0x00001274,
+	.period_cfg                   = 0x00001278,
+	.irq_subsample_pattern        = 0x0000127C,
+	.epoch_irq_cfg                = 0x00001280,
+	.debug_1                      = 0x000013F0,
+	.debug_0                      = 0x000013F4,
+	.test_bus_ctrl                = 0x000013F8,
+	.spare                        = 0x000013F8,
+	.reg_update_cmd               = 0x0000102C,
+};
+
+static struct cam_tfe_camif_reg_data tfe530_camif_reg_data = {
+	.extern_reg_update_mask       = 0x00000001,
+	.dual_tfe_pix_en_shift        = 0x00000001,
+	.extern_reg_update_shift      = 0x0,
+	.camif_pd_rdi2_src_sel_shift  = 0x2,
+	.dual_tfe_sync_sel_shift      = 18,
+	.delay_line_en_shift          = 8,
+	.pixel_pattern_shift          = 24,
+	.pixel_pattern_mask           = 0x7000000,
+	.module_enable_shift          = 0,
+	.pix_out_enable_shift         = 8,
+	.pdaf_output_enable_shift     = 9,
+	.dsp_mode_shift               = 0,
+	.dsp_mode_mask                = 0,
+	.dsp_en_shift                 = 0,
+	.dsp_en_mask                  = 0,
+	.reg_update_cmd_data          = 0x1,
+	.epoch_line_cfg               = 0x00140014,
+	.sof_irq_mask                 = 0x00000001,
+	.epoch0_irq_mask              = 0x00000004,
+	.epoch1_irq_mask              = 0x00000008,
+	.eof_irq_mask                 = 0x00000002,
+	.reg_update_irq_mask          = 0x00000001,
+	.error_irq_mask0              = 0x00010100,
+	.error_irq_mask2              = 0x00000023,
+	.subscribe_irq_mask           = {
+		0x00000000,
+		0x00000007,
+		0x00000000,
+	},
+	.enable_diagnostic_hw         = 0x1,
+	.perf_cnt_start_cmd_shift     = 0,
+	.perf_cnt_continuous_shift    = 2,
+	.perf_client_sel_shift        = 8,
+	.perf_window_start_shift      = 16,
+	.perf_window_end_shift        = 20,
+};
+
+static struct cam_tfe_rdi_reg  tfe530_rdi0_reg = {
+	.rdi_hw_version              = 0x00001400,
+	.rdi_hw_status               = 0x00001404,
+	.rdi_module_config           = 0x00001460,
+	.rdi_skip_period             = 0x00001468,
+	.rdi_irq_subsample_pattern   = 0x0000146C,
+	.rdi_epoch_irq               = 0x00001470,
+	.rdi_debug_1                 = 0x000015F0,
+	.rdi_debug_0                 = 0x000015F4,
+	.rdi_test_bus_ctrl           = 0x000015F8,
+	.rdi_spare                   = 0x000015FC,
+	.reg_update_cmd              = 0x0000102C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe530_rdi0_reg_data = {
+	.reg_update_cmd_data         = 0x2,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000010,
+	.epoch0_irq_mask             = 0x00000040,
+	.epoch1_irq_mask             = 0x00000080,
+	.eof_irq_mask                = 0x00000020,
+	.error_irq_mask0             = 0x00020200,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000030,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x1,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe530_rdi1_reg = {
+	.rdi_hw_version              = 0x00001600,
+	.rdi_hw_status               = 0x00001604,
+	.rdi_module_config           = 0x00001660,
+	.rdi_skip_period             = 0x00001668,
+	.rdi_irq_subsample_pattern   = 0x0000166C,
+	.rdi_epoch_irq               = 0x00001670,
+	.rdi_debug_1                 = 0x000017F0,
+	.rdi_debug_0                 = 0x000017F4,
+	.rdi_test_bus_ctrl           = 0x000017F8,
+	.rdi_spare                   = 0x000017FC,
+	.reg_update_cmd              = 0x0000102C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe530_rdi1_reg_data = {
+	.reg_update_cmd_data         = 0x4,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000100,
+	.epoch0_irq_mask             = 0x00000400,
+	.epoch1_irq_mask             = 0x00000800,
+	.eof_irq_mask                = 0x00000200,
+	.error_irq_mask0             = 0x00040400,
+	.error_irq_mask2             = 0x00000008,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000300,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x2,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe530_rdi2_reg = {
+	.rdi_hw_version              = 0x00001800,
+	.rdi_hw_status               = 0x00001804,
+	.rdi_module_config           = 0x00001860,
+	.rdi_skip_period             = 0x00001868,
+	.rdi_irq_subsample_pattern   = 0x0000186C,
+	.rdi_epoch_irq               = 0x00001870,
+	.rdi_debug_1                 = 0x000019F0,
+	.rdi_debug_0                 = 0x000019F4,
+	.rdi_test_bus_ctrl           = 0x000019F8,
+	.rdi_spare                   = 0x000019FC,
+	.reg_update_cmd              = 0x0000102C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe530_rdi2_reg_data = {
+	.reg_update_cmd_data         = 0x8,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00001000,
+	.epoch0_irq_mask             = 0x00004000,
+	.epoch1_irq_mask             = 0x00008000,
+	.eof_irq_mask                = 0x00002000,
+	.error_irq_mask0             = 0x00080800,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00003000,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x3,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_clc_hw_status  tfe530_clc_hw_info[CAM_TFE_MAX_CLC] = {
+	{
+		.name = "CLC_CAMIF",
+		.hw_status_reg = 0x1204,
+	},
+	{
+		.name = "CLC_RDI0_CAMIF",
+		.hw_status_reg = 0x1404,
+	},
+	{
+		.name = "CLC_RDI1_CAMIF",
+		.hw_status_reg = 0x1604,
+	},
+	{
+		.name = "CLC_RDI2_CAMIF",
+		.hw_status_reg = 0x1804,
+	},
+	{
+		.name = "CLC_CHANNEL_GAIN",
+		.hw_status_reg = 0x2604,
+	},
+	{
+		.name = "CLC_LENS_ROLL_OFF",
+		.hw_status_reg = 0x2804,
+	},
+	{
+		.name = "CLC_WB_BDS",
+		.hw_status_reg = 0x2A04,
+	},
+	{
+		.name = "CLC_STATS_BHIST",
+		.hw_status_reg = 0x2C04,
+	},
+	{
+		.name = "CLC_STATS_TINTLESS_BG",
+		.hw_status_reg = 0x2E04,
+	},
+	{
+		.name = "CLC_STATS_BAF",
+		.hw_status_reg = 0x3004,
+	},
+	{
+		.name = "CLC_STATS_AWB_BG",
+		.hw_status_reg = 0x3204,
+	},
+	{
+		.name = "CLC_STATS_AEC_BG",
+		.hw_status_reg = 0x3404,
+	},
+	{
+		.name = "CLC_STATS_RAW_OUT",
+		.hw_status_reg = 0x3604,
+	},
+	{
+		.name = "CLC_STATS_CROP_POST_BDS",
+		.hw_status_reg = 0x3804,
+	},
+};
+
+static struct  cam_tfe_top_hw_info tfe530_top_hw_info = {
+	.common_reg = &tfe530_top_commong_reg,
+	.camif_hw_info = {
+		.camif_reg = &tfe530_camif_reg,
+		.reg_data  = &tfe530_camif_reg_data,
+	},
+	.rdi_hw_info  = {
+		{
+			.rdi_reg  = &tfe530_rdi0_reg,
+			.reg_data = &tfe530_rdi0_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe530_rdi1_reg,
+			.reg_data = &tfe530_rdi1_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe530_rdi2_reg,
+			.reg_data = &tfe530_rdi2_reg_data,
+		},
+	},
+	.in_port = {
+		CAM_TFE_CAMIF_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0
+	},
+	.reg_dump_data  = {
+		.num_reg_dump_entries    = 19,
+		.num_lut_dump_entries    = 0,
+		.bus_start_addr          = 0x2000,
+		.bus_write_top_end_addr  = 0x2120,
+		.bus_client_start_addr   = 0x2200,
+		.bus_client_offset       = 0x100,
+		.num_bus_clients         = 10,
+		.reg_entry = {
+			{
+				.start_offset = 0x1000,
+				.end_offset   = 0x10F4,
+			},
+			{
+				.start_offset = 0x1260,
+				.end_offset   = 0x1280,
+			},
+			{
+				.start_offset = 0x13F0,
+				.end_offset   = 0x13FC,
+			},
+			{
+				.start_offset = 0x1460,
+				.end_offset   = 0x1470,
+			},
+			{
+				.start_offset = 0x15F0,
+				.end_offset   = 0x15FC,
+			},
+			{
+				.start_offset = 0x1660,
+				.end_offset   = 0x1670,
+			},
+			{
+				.start_offset = 0x17F0,
+				.end_offset   = 0x17FC,
+			},
+			{
+				.start_offset = 0x1860,
+				.end_offset   = 0x1870,
+			},
+			{
+				.start_offset = 0x19F0,
+				.end_offset   = 0x19FC,
+			},
+			{
+				.start_offset = 0x2660,
+				.end_offset   = 0x2694,
+			},
+			{
+				.start_offset = 0x2860,
+				.end_offset   = 0x2884,
+			},
+			{
+				.start_offset = 0x2A60,
+				.end_offset   = 0X2B34,
+			},
+			{
+				.start_offset = 0x2C60,
+				.end_offset   = 0X2C80,
+			},
+			{
+				.start_offset = 0x2E60,
+				.end_offset   = 0X2E7C,
+			},
+			{
+				.start_offset = 0x3060,
+				.end_offset   = 0X3110,
+			},
+			{
+				.start_offset = 0x3260,
+				.end_offset   = 0X3278,
+			},
+			{
+				.start_offset = 0x3460,
+				.end_offset   = 0X3478,
+			},
+			{
+				.start_offset = 0x3660,
+				.end_offset   = 0X3684,
+			},
+			{
+				.start_offset = 0x3860,
+				.end_offset   = 0X3884,
+			},
+		},
+		.lut_entry = {
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x40,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x2800,
+			},
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x41,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x3000,
+			},
+		},
+	},
+};
+
+static struct cam_tfe_bus_hw_info  tfe530_bus_hw_info = {
+	.common_reg = {
+		.hw_version  = 0x00001A00,
+		.cgc_ovd     = 0x00001A08,
+		.comp_cfg_0  = 0x00001A0C,
+		.comp_cfg_1  = 0x00001A10,
+		.frameheader_cfg  = {
+			0x00001A34,
+			0x00001A38,
+			0x00001A3C,
+			0x00001A40,
+		},
+		.pwr_iso_cfg = 0x00001A5C,
+		.overflow_status_clear = 0x00001A60,
+		.ccif_violation_status = 0x00001A64,
+		.overflow_status       = 0x00001A68,
+		.image_size_violation_status = 0x00001A70,
+		.perf_count_cfg = {
+			0x00001A74,
+			0x00001A78,
+			0x00001A7C,
+			0x00001A80,
+			0x00001A84,
+			0x00001A88,
+			0x00001A8C,
+			0x00001A90,
+		},
+		.perf_count_val = {
+			0x00001A94,
+			0x00001A98,
+			0x00001A9C,
+			0x00001AA0,
+			0x00001AA4,
+			0x00001AA8,
+			0x00001AAC,
+			0x00001AB0,
+		},
+		.perf_count_status = 0x00001AB4,
+		.debug_status_top_cfg = 0x00001AD4,
+		.debug_status_top = 0x00001AD8,
+		.test_bus_ctrl = 0x00001ADC,
+		.irq_mask = {
+			0x00001A18,
+			0x00001A1C,
+		},
+		.irq_clear = {
+			0x00001A20,
+			0x00001A24,
+		},
+		.irq_status = {
+			0x00001A28,
+			0x00001A2C,
+		},
+		.irq_cmd = 0x00001A30,
+		.cons_violation_shift = 28,
+		.violation_shift  = 30,
+		.image_size_violation = 31,
+	},
+	.num_client = 10,
+	.bus_client_reg = {
+		/* BUS Client 0 BAYER */
+		{
+			.cfg                   = 0x00001C00,
+			.image_addr            = 0x00001C04,
+			.frame_incr            = 0x00001C08,
+			.image_cfg_0           = 0x00001C0C,
+			.image_cfg_1           = 0x00001C10,
+			.image_cfg_2           = 0x00001C14,
+			.packer_cfg            = 0x00001C18,
+			.bw_limit              = 0x00001C1C,
+			.frame_header_addr     = 0x00001C20,
+			.frame_header_incr     = 0x00001C24,
+			.frame_header_cfg      = 0x00001C28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00001C30,
+			.irq_subsample_pattern = 0x00001C34,
+			.framedrop_period      = 0x00001C38,
+			.framedrop_pattern     = 0x00001C3C,
+			.addr_status_0         = 0x00001C68,
+			.addr_status_1         = 0x00001C6C,
+			.addr_status_2         = 0x00001C70,
+			.addr_status_3         = 0x00001C74,
+			.debug_status_cfg      = 0x00001C78,
+			.debug_status_0        = 0x00001C7C,
+			.debug_status_1        = 0x00001C80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "BAYER",
+		},
+		/* BUS Client 1 IDEAL RAW*/
+		{
+			.cfg                   = 0x00001D00,
+			.image_addr            = 0x00001D04,
+			.frame_incr            = 0x00001D08,
+			.image_cfg_0           = 0x00001D0C,
+			.image_cfg_1           = 0x00001D10,
+			.image_cfg_2           = 0x00001D14,
+			.packer_cfg            = 0x00001D18,
+			.bw_limit              = 0x00001D1C,
+			.frame_header_addr     = 0x00001D20,
+			.frame_header_incr     = 0x00001D24,
+			.frame_header_cfg      = 0x00001D28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00001D30,
+			.irq_subsample_pattern = 0x00001D34,
+			.framedrop_period      = 0x00001D38,
+			.framedrop_pattern     = 0x00001D3C,
+			.addr_status_0         = 0x00001D68,
+			.addr_status_1         = 0x00001D6C,
+			.addr_status_2         = 0x00001D70,
+			.addr_status_3         = 0x00001D74,
+			.debug_status_cfg      = 0x00001D78,
+			.debug_status_0        = 0x00001D7C,
+			.debug_status_1        = 0x00001D80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_1,
+			.client_name           = "IDEAL_RAW",
+		},
+		/* BUS Client 2 Stats BE Tintless */
+		{
+			.cfg                   = 0x00001E00,
+			.image_addr            = 0x00001E04,
+			.frame_incr            = 0x00001E08,
+			.image_cfg_0           = 0x00001E0C,
+			.image_cfg_1           = 0x00001E10,
+			.image_cfg_2           = 0x00001E14,
+			.packer_cfg            = 0x00001E18,
+			.bw_limit              = 0x00001E1C,
+			.frame_header_addr     = 0x00001E20,
+			.frame_header_incr     = 0x00001E24,
+			.frame_header_cfg      = 0x00001E28,
+			.line_done_cfg         = 0x00001E00,
+			.irq_subsample_period  = 0x00001E30,
+			.irq_subsample_pattern = 0x00000E34,
+			.framedrop_period      = 0x00001E38,
+			.framedrop_pattern     = 0x00001E3C,
+			.addr_status_0         = 0x00001E68,
+			.addr_status_1         = 0x00001E6C,
+			.addr_status_2         = 0x00001E70,
+			.addr_status_3         = 0x00001E74,
+			.debug_status_cfg      = 0x00001E78,
+			.debug_status_0        = 0x00001E7C,
+			.debug_status_1        = 0x00001E80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BE TINTLESS",
+		},
+		/* BUS Client 3 Stats Bhist */
+		{
+			.cfg                   = 0x00001F00,
+			.image_addr            = 0x00001F04,
+			.frame_incr            = 0x00001F08,
+			.image_cfg_0           = 0x00001F0C,
+			.image_cfg_1           = 0x00001F10,
+			.image_cfg_2           = 0x00001F14,
+			.packer_cfg            = 0x00001F18,
+			.bw_limit              = 0x00001F1C,
+			.frame_header_addr     = 0x00001F20,
+			.frame_header_incr     = 0x00001F24,
+			.frame_header_cfg      = 0x00001F28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00001F30,
+			.irq_subsample_pattern = 0x00001F34,
+			.framedrop_period      = 0x00001F38,
+			.framedrop_pattern     = 0x00001F3C,
+			.addr_status_0         = 0x00001F68,
+			.addr_status_1         = 0x00001F6C,
+			.addr_status_2         = 0x00001F70,
+			.addr_status_3         = 0x00001F74,
+			.debug_status_cfg      = 0x00001F78,
+			.debug_status_0        = 0x00001F7C,
+			.debug_status_1        = 0x00001F80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BHIST",
+		},
+		/* BUS Client 4 Stats AWB BG */
+		{
+			.cfg                   = 0x00002000,
+			.image_addr            = 0x00002004,
+			.frame_incr            = 0x00002008,
+			.image_cfg_0           = 0x0000200C,
+			.image_cfg_1           = 0x00002010,
+			.image_cfg_2           = 0x00002014,
+			.packer_cfg            = 0x00002018,
+			.bw_limit              = 0x0000201C,
+			.frame_header_addr     = 0x00002020,
+			.frame_header_incr     = 0x00002024,
+			.frame_header_cfg      = 0x00002028,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002030,
+			.irq_subsample_pattern = 0x00002034,
+			.framedrop_period      = 0x00002038,
+			.framedrop_pattern     = 0x0000203C,
+			.addr_status_0         = 0x00002068,
+			.addr_status_1         = 0x0000206C,
+			.addr_status_2         = 0x00002070,
+			.addr_status_3         = 0x00002074,
+			.debug_status_cfg      = 0x00002078,
+			.debug_status_0        = 0x0000207C,
+			.debug_status_1        = 0x00002080,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AWB BG",
+		},
+		/* BUS Client 5 Stats AEC BG */
+		{
+			.cfg                   = 0x00002100,
+			.image_addr            = 0x00002104,
+			.frame_incr            = 0x00002108,
+			.image_cfg_0           = 0x0000210C,
+			.image_cfg_1           = 0x00002110,
+			.image_cfg_2           = 0x00002114,
+			.packer_cfg            = 0x00002118,
+			.bw_limit              = 0x0000211C,
+			.frame_header_addr     = 0x00002120,
+			.frame_header_incr     = 0x00002124,
+			.frame_header_cfg      = 0x00002128,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002130,
+			.irq_subsample_pattern = 0x00002134,
+			.framedrop_period      = 0x00002138,
+			.framedrop_pattern     = 0x0000213C,
+			.addr_status_0         = 0x00002168,
+			.addr_status_1         = 0x0000216C,
+			.addr_status_2         = 0x00002170,
+			.addr_status_3         = 0x00002174,
+			.debug_status_cfg      = 0x00002178,
+			.debug_status_0        = 0x0000217C,
+			.debug_status_1        = 0x00002180,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AEC BG",
+		},
+		/* BUS Client 6 Stats BAF */
+		{
+			.cfg                   = 0x00002200,
+			.image_addr            = 0x00002204,
+			.frame_incr            = 0x00002208,
+			.image_cfg_0           = 0x0000220C,
+			.image_cfg_1           = 0x00002210,
+			.image_cfg_2           = 0x00002214,
+			.packer_cfg            = 0x00002218,
+			.bw_limit              = 0x0000221C,
+			.frame_header_addr     = 0x00002220,
+			.frame_header_incr     = 0x00002224,
+			.frame_header_cfg      = 0x00002228,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002230,
+			.irq_subsample_pattern = 0x00002234,
+			.framedrop_period      = 0x00002238,
+			.framedrop_pattern     = 0x0000223C,
+			.addr_status_0         = 0x00002268,
+			.addr_status_1         = 0x0000226C,
+			.addr_status_2         = 0x00002270,
+			.addr_status_3         = 0x00002274,
+			.debug_status_cfg      = 0x00002278,
+			.debug_status_0        = 0x0000227C,
+			.debug_status_1        = 0x00002280,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_4,
+			.client_name           = "STATS BAF",
+		},
+		/* BUS Client 7 RDI0 */
+		{
+			.cfg                   = 0x00002300,
+			.image_addr            = 0x00002304,
+			.frame_incr            = 0x00002308,
+			.image_cfg_0           = 0x0000230C,
+			.image_cfg_1           = 0x00002310,
+			.image_cfg_2           = 0x00002314,
+			.packer_cfg            = 0x00002318,
+			.bw_limit              = 0x0000231C,
+			.frame_header_addr     = 0x00002320,
+			.frame_header_incr     = 0x00002324,
+			.frame_header_cfg      = 0x00002328,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002330,
+			.irq_subsample_pattern = 0x00002334,
+			.framedrop_period      = 0x00002338,
+			.framedrop_pattern     = 0x0000233C,
+			.addr_status_0         = 0x00002368,
+			.addr_status_1         = 0x0000236C,
+			.addr_status_2         = 0x00002370,
+			.addr_status_3         = 0x00002374,
+			.debug_status_cfg      = 0x00002378,
+			.debug_status_0        = 0x0000237C,
+			.debug_status_1        = 0x00002380,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_5,
+			.client_name           = "RDI0",
+		},
+		/* BUS Client 8 RDI1 */
+		{
+			.cfg                   = 0x00002400,
+			.image_addr            = 0x00002404,
+			.frame_incr            = 0x00002408,
+			.image_cfg_0           = 0x0000240C,
+			.image_cfg_1           = 0x00002410,
+			.image_cfg_2           = 0x00002414,
+			.packer_cfg            = 0x00002418,
+			.bw_limit              = 0x0000241C,
+			.frame_header_addr     = 0x00002420,
+			.frame_header_incr     = 0x00002424,
+			.frame_header_cfg      = 0x00002428,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002430,
+			.irq_subsample_pattern = 0x00002434,
+			.framedrop_period      = 0x00002438,
+			.framedrop_pattern     = 0x0000243C,
+			.addr_status_0         = 0x00002468,
+			.addr_status_1         = 0x0000246C,
+			.addr_status_2         = 0x00002470,
+			.addr_status_3         = 0x00002474,
+			.debug_status_cfg      = 0x00002478,
+			.debug_status_0        = 0x0000247C,
+			.debug_status_1        = 0x00002480,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_6,
+			.client_name           = "RDI1",
+		},
+		/* BUS Client 9 PDAF/RDI2*/
+		{
+			.cfg                   = 0x00002500,
+			.image_addr            = 0x00002504,
+			.frame_incr            = 0x00002508,
+			.image_cfg_0           = 0x0000250C,
+			.image_cfg_1           = 0x00002510,
+			.image_cfg_2           = 0x00002514,
+			.packer_cfg            = 0x00002518,
+			.bw_limit              = 0x0000251C,
+			.frame_header_addr     = 0x00002520,
+			.frame_header_incr     = 0x00002524,
+			.frame_header_cfg      = 0x00002528,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002530,
+			.irq_subsample_pattern = 0x00002534,
+			.framedrop_period      = 0x00002538,
+			.framedrop_pattern     = 0x0000253C,
+			.addr_status_0         = 0x00002568,
+			.addr_status_1         = 0x0000256C,
+			.addr_status_2         = 0x00002570,
+			.addr_status_3         = 0x00002574,
+			.debug_status_cfg      = 0x00002578,
+			.debug_status_0        = 0x0000257C,
+			.debug_status_1        = 0x00002580,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_7,
+			.client_name           = "RDI2/PADF",
+		},
+	},
+	.num_out  = 11,
+	.tfe_out_hw_info = {
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI0,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_5,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_1,
+			.mid[0]              = 23,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI1,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_6,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_2,
+			.mid[0]              = 24,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI2,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_7,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_3,
+			.mid[0]              = 25,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_FULL,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 16,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RAW_DUMP,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_1,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 17,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PDAF,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_7,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_3,
+			.mid[0]              = 25,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 21,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 19,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_TL_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 18,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 20,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_BF,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_4,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 22,
+		},
+	},
+	.num_comp_grp             = 8,
+	.max_wm_per_comp_grp      = 2,
+	.comp_done_shift          = 8,
+	.top_bus_wr_irq_shift     = 1,
+	.comp_buf_done_mask = 0xFF00,
+	.comp_rup_done_mask = 0xF,
+	.bus_irq_error_mask = {
+		0xD0000000,
+		0x00000000,
+	},
+	.support_consumed_addr = true,
+	.pdaf_rdi2_mux_en = true,
+	.rdi_width = 64,
+	.max_bw_counter_limit  = 0xFF,
+	.counter_limit_shift   = 1,
+	.counter_limit_mask    = 0xF,
+	.mode_cfg_shift = 16,
+	.height_shift = 16,
+};
+
+struct cam_tfe_hw_info cam_tfe530 = {
+	.top_irq_mask = {
+		0x00001034,
+		0x00001038,
+		0x0000103C,
+	},
+	.top_irq_clear = {
+		0x00001040,
+		0x00001044,
+		0x00001048,
+	},
+	.top_irq_status = {
+		0x0000104C,
+		0x00001050,
+		0x00001054,
+	},
+	.top_irq_cmd                       = 0x00001030,
+	.global_clear_bitmask              = 0x00000001,
+
+	.bus_irq_mask = {
+		0x00001A18,
+		0x00001A1C,
+	},
+	.bus_irq_clear = {
+		0x00001A20,
+		0x00001A24,
+	},
+	.bus_irq_status = {
+		0x00001A28,
+		0x00001A2C,
+	},
+	.bus_irq_cmd = 0x00001A30,
+	.bus_violation_reg = 0x00001A64,
+	.bus_overflow_reg = 0x00001A68,
+	.bus_image_size_vilation_reg = 0x1A70,
+	.bus_overflow_clear_cmd = 0x1A60,
+	.debug_status_top = 0x1AD8,
+
+	.reset_irq_mask = {
+		0x00000001,
+		0x00000000,
+		0x00000000,
+	},
+	.error_irq_mask = {
+		0x000F0F00,
+		0x00000000,
+		0x0000003F,
+	},
+	.bus_reg_irq_mask = {
+		0x00000002,
+		0x00000000,
+	},
+	.bus_error_irq_mask = {
+		0xC0000000,
+		0x00000000,
+	},
+
+	.num_clc = 14,
+	.clc_hw_status_info            = tfe530_clc_hw_info,
+	.bus_version                   = CAM_TFE_BUS_1_0,
+	.bus_hw_info                   = &tfe530_bus_hw_info,
+
+	.top_version                   = CAM_TFE_TOP_1_0,
+	.top_hw_info                   = &tfe530_top_hw_info,
+};
+
+#endif /* _CAM_TFE530_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe640.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe640.h
@@ -0,0 +1,1264 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE640_H_
+#define _CAM_TFE640_H_
+#include "cam_tfe_core.h"
+#include "cam_tfe_bus.h"
+
+
+static struct cam_tfe_top_reg_offset_common  tfe640_top_commong_reg  = {
+	.hw_version                             = 0x00001800,
+	.hw_capability                          = 0x00001804,
+	.lens_feature                           = 0x00001808,
+	.stats_feature                          = 0x0000180C,
+	.zoom_feature                           = 0x00001810,
+	.global_reset_cmd                       = 0x00001814,
+	.core_cgc_ctrl_0                        = 0x00001818,
+	.ahb_cgc_ctrl                           = 0x0000181C,
+	.core_cfg_0                             = 0x00001824,
+	.reg_update_cmd                         = 0x0000182C,
+	.diag_config                            = 0x00001860,
+	.diag_sensor_status_0                   = 0x00001864,
+	.diag_sensor_status_1                   = 0x00001868,
+	.diag_sensor_frame_cnt_status           = 0x0000186C,
+	.violation_status                       = 0x00001870,
+	.stats_throttle_cnt_cfg_0               = 0x00001874,
+	.stats_throttle_cnt_cfg_1               = 0x00001878,
+	.num_debug_reg                          = 10,
+	.debug_reg = {
+		0x000018A0,
+		0x000018A4,
+		0x000018A8,
+		0x000018AC,
+		0x000018B0,
+		0x000018B4,
+		0x000018B8,
+		0x000018BC,
+		0x000018C0,
+		0x000018C4,
+	},
+	.debug_cfg                              = 0x000018DC,
+	.num_perf_cfg                           = 2,
+	.perf_cfg = {
+		{
+			.perf_cnt_cfg           = 0x000018E0,
+			.perf_pixel_count       = 0x000018E4,
+			.perf_line_count        = 0x000018E8,
+			.perf_stall_count       = 0x000018EC,
+			.perf_always_count      = 0x000018F0,
+			.perf_count_status      = 0x000018F4,
+		},
+		{
+			.perf_cnt_cfg           = 0x000018F8,
+			.perf_pixel_count       = 0x000018FC,
+			.perf_line_count        = 0x00001900,
+			.perf_stall_count       = 0x00001904,
+			.perf_always_count      = 0x00001908,
+			.perf_count_status      = 0x0000190C,
+		},
+	},
+	.diag_min_hbi_error_shift               = 15,
+	.diag_neq_hbi_shift                     = 14,
+	.diag_sensor_hbi_mask                   = 0x3FFF,
+	.serializer_supported                   = true,
+	.pp_camif_violation_bit                 = BIT(0),
+	.pp_violation_bit                       = BIT(1),
+	.rdi0_camif_violation_bit               = BIT(2),
+	.rdi1_camif_violation_bit               = BIT(3),
+	.rdi2_camif_violation_bit               = BIT(4),
+	.diag_violation_bit                     = BIT(5),
+	.pp_frame_drop_bit                      = BIT(8),
+	.rdi0_frame_drop_bit                    = BIT(9),
+	.rdi1_frame_drop_bit                    = BIT(10),
+	.rdi2_frame_drop_bit                    = BIT(11),
+	.pp_overflow_bit                        = BIT(16),
+	.rdi0_overflow_bit                      = BIT(17),
+	.rdi1_overflow_bit                      = BIT(18),
+	.rdi2_overflow_bit                      = BIT(19),
+	.mup_shift_val                          = 0,
+	.mup_supported                          = false,
+	.height_shift                           = 16,
+	.epoch_shift_val                        = 16,
+};
+
+static struct cam_tfe_camif_reg  tfe640_camif_reg = {
+	.hw_version                   = 0x00001C00,
+	.hw_status                    = 0x00001C04,
+	.module_cfg                   = 0x00001C60,
+	.pdaf_raw_crop_width_cfg      = 0x00001C68,
+	.pdaf_raw_crop_height_cfg     = 0x00001C6C,
+	.line_skip_pattern            = 0x00001C70,
+	.pixel_skip_pattern           = 0x00001C74,
+	.period_cfg                   = 0x00001C78,
+	.irq_subsample_pattern        = 0x00001C7C,
+	.epoch_irq_cfg                = 0x00001C80,
+	.debug_1                      = 0x00001DF0,
+	.debug_0                      = 0x00001DF4,
+	.test_bus_ctrl                = 0x00001DF8,
+	.spare                        = 0x00001DFC,
+	.reg_update_cmd               = 0x0000182C,
+};
+
+static struct cam_tfe_camif_reg_data tfe640_camif_reg_data = {
+	.extern_reg_update_mask       = 0x00000001,
+	.dual_tfe_pix_en_shift        = 0x00000001,
+	.extern_reg_update_shift      = 0x0,
+	.dual_tfe_sync_sel_shift      = 18,
+	.delay_line_en_shift          = 8,
+	.pixel_pattern_shift          = 24,
+	.pixel_pattern_mask           = 0x7000000,
+	.module_enable_shift          = 0,
+	.pix_out_enable_shift         = 8,
+	.pdaf_output_enable_shift     = 9,
+	.dsp_mode_shift               = 0,
+	.dsp_mode_mask                = 0,
+	.dsp_en_shift                 = 0,
+	.dsp_en_mask                  = 0,
+	.reg_update_cmd_data          = 0x1,
+	.epoch_line_cfg               = 0x00140014,
+	.sof_irq_mask                 = 0x00000001,
+	.epoch0_irq_mask              = 0x00000004,
+	.epoch1_irq_mask              = 0x00000008,
+	.eof_irq_mask                 = 0x00000002,
+	.reg_update_irq_mask          = 0x00000001,
+	.error_irq_mask0              = 0x00010100,
+	.error_irq_mask2              = 0x00000023,
+	.subscribe_irq_mask           = {
+		0x00000000,
+		0x00000007,
+		0x00000000,
+	},
+	.enable_diagnostic_hw         = 0x1,
+	.perf_cnt_start_cmd_shift     = 0,
+	.perf_cnt_continuous_shift    = 2,
+	.perf_client_sel_shift        = 8,
+	.perf_window_start_shift      = 16,
+	.perf_window_end_shift        = 20,
+	.ai_c_srl_en_shift            = 11,
+	.ds16_c_srl_en_shift          = 10,
+	.ds4_c_srl_en_shift           = 9,
+};
+
+static struct cam_tfe_rdi_reg  tfe640_rdi0_reg = {
+	.rdi_hw_version              = 0x00001E00,
+	.rdi_hw_status               = 0x00001E04,
+	.rdi_module_config           = 0x00001E60,
+	.rdi_skip_period             = 0x00001E68,
+	.rdi_irq_subsample_pattern   = 0x00001E6C,
+	.rdi_epoch_irq               = 0x00001E70,
+	.rdi_debug_1                 = 0x00001FF0,
+	.rdi_debug_0                 = 0x00001FF4,
+	.rdi_test_bus_ctrl           = 0x00001FF8,
+	.rdi_spare                   = 0x00001FFC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe640_rdi0_reg_data = {
+	.reg_update_cmd_data         = 0x2,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000010,
+	.epoch0_irq_mask             = 0x00000040,
+	.epoch1_irq_mask             = 0x00000080,
+	.eof_irq_mask                = 0x00000020,
+	.error_irq_mask0             = 0x00020200,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000030,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x1,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe640_rdi1_reg = {
+	.rdi_hw_version              = 0x00002000,
+	.rdi_hw_status               = 0x00002004,
+	.rdi_module_config           = 0x00002060,
+	.rdi_skip_period             = 0x00002068,
+	.rdi_irq_subsample_pattern   = 0x0000206C,
+	.rdi_epoch_irq               = 0x00002070,
+	.rdi_debug_1                 = 0x000021F0,
+	.rdi_debug_0                 = 0x000021F4,
+	.rdi_test_bus_ctrl           = 0x000021F8,
+	.rdi_spare                   = 0x000021FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe640_rdi1_reg_data = {
+	.reg_update_cmd_data         = 0x4,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000100,
+	.epoch0_irq_mask             = 0x00000400,
+	.epoch1_irq_mask             = 0x00000800,
+	.eof_irq_mask                = 0x00000200,
+	.error_irq_mask0             = 0x00040400,
+	.error_irq_mask2             = 0x00000008,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000300,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x2,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe640_rdi2_reg = {
+	.rdi_hw_version              = 0x00002200,
+	.rdi_hw_status               = 0x00002204,
+	.rdi_module_config           = 0x00002260,
+	.rdi_skip_period             = 0x00002268,
+	.rdi_irq_subsample_pattern   = 0x0000226C,
+	.rdi_epoch_irq               = 0x00002270,
+	.rdi_debug_1                 = 0x000023F0,
+	.rdi_debug_0                 = 0x000023F4,
+	.rdi_test_bus_ctrl           = 0x000023F8,
+	.rdi_spare                   = 0x000023FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe640_rdi2_reg_data = {
+	.reg_update_cmd_data         = 0x8,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00001000,
+	.epoch0_irq_mask             = 0x00004000,
+	.epoch1_irq_mask             = 0x00008000,
+	.eof_irq_mask                = 0x00002000,
+	.error_irq_mask0             = 0x00080800,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00003000,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x3,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_clc_hw_status  tfe640_clc_hw_info[CAM_TFE_MAX_CLC] = {
+	{
+		.name = "CLC_CAMIF",
+		.hw_status_reg = 0x1C04,
+	},
+	{
+		.name = "CLC_RDI0_CAMIF",
+		.hw_status_reg = 0x1E04,
+	},
+	{
+		.name = "CLC_RDI1_CAMIF",
+		.hw_status_reg = 0x2004,
+	},
+	{
+		.name = "CLC_RDI2_CAMIF",
+		.hw_status_reg = 0x2204,
+	},
+	{
+		.name = "CLC_CHANNEL_GAIN",
+		.hw_status_reg = 0x6004,
+	},
+	{
+		.name = "CLC_BPC_PDPC",
+		.hw_status_reg = 0x6204,
+	},
+	{
+		.name = "CLC_LCS",
+		.hw_status_reg = 0x6404,
+	},
+	{
+		.name = "CLC_SHARED_LB",
+		.hw_status_reg = 0x6604,
+	},
+	{
+		.name = "CLC_WB_BDS",
+		.hw_status_reg = 0x6804,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_POST_BDS",
+		.hw_status_reg = 0x6A04,
+	},
+	{
+		.name = "CLC_BLS",
+		.hw_status_reg = 0x6C04,
+	},
+	{
+		.name = "CLC_BAYER_GLUT",
+		.hw_status_reg = 0x6E04,
+	},
+	{
+		.name = "CLC_BAYER_DS4",
+		.hw_status_reg = 0x7004,
+	},
+	{
+		.name = "CLC_COLOR_XFORM_DS4",
+		.hw_status_reg = 0x7204,
+	},
+	{
+		.name = "CLC_CHROMA_DS2",
+		.hw_status_reg = 0x7404,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_Y_DS4",
+		.hw_status_reg = 0x7604,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_C_DS4",
+		.hw_status_reg = 0x7804,
+	},
+	{
+		.name = "CLC_R2PD_DS4",
+		.hw_status_reg = 0x7A04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_4TO1_Y",
+		.hw_status_reg = 0x7C04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_4TO1_C",
+		.hw_status_reg = 0x7E04,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_Y_DS16",
+		.hw_status_reg = 0x8004,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_C_DS16",
+		.hw_status_reg = 0x8204,
+	},
+	{
+		.name = "CLC_R2PD_DS16",
+		.hw_status_reg = 0x8404,
+	},
+	{
+		.name = "CLC_WB_GAIN",
+		.hw_status_reg = 0x8604,
+	},
+	{
+		.name = "CLC_BAYER_DS2",
+		.hw_status_reg = 0x8804,
+	},
+	{
+		.name = "CLC_GTM",
+		.hw_status_reg = 0x8A04,
+	},
+	{
+		.name = "CLC_COLOR_XFORM_AI_DS",
+		.hw_status_reg = 0x8C04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_MN_Y",
+		.hw_status_reg = 0x8E04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_MN_C",
+		.hw_status_reg = 0x9004,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_Y_AI_DS",
+		.hw_status_reg = 0x9204,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_C_AI_DS",
+		.hw_status_reg = 0x9404,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_IDEAL_RAW",
+		.hw_status_reg = 0x9604,
+	},
+	{
+		.name = "CLC_ABF",
+		.hw_status_reg = 0x9804,
+	},
+	{
+		.name = "CLC_STATS_BG",
+		.hw_status_reg = 0x9A04,
+	},
+	{
+		.name = "CLC_STATS_BHIST",
+		.hw_status_reg = 0x9C04,
+	},
+	{
+		.name = "CLC_STATS_AWB_BG",
+		.hw_status_reg = 0x9E04,
+	},
+	{
+		.name = "CLC_STATS_AEC_BG",
+		.hw_status_reg = 0xA004,
+	},
+	{
+		.name = "CLC_STATS_BAF",
+		.hw_status_reg = 0xA204,
+	},
+	{
+		.name = "CLC_STATS_RS",
+		.hw_status_reg = 0xA404,
+	},
+};
+
+static struct  cam_tfe_top_hw_info tfe640_top_hw_info = {
+	.common_reg = &tfe640_top_commong_reg,
+	.camif_hw_info = {
+		.camif_reg = &tfe640_camif_reg,
+		.reg_data  = &tfe640_camif_reg_data,
+	},
+	.rdi_hw_info  = {
+		{
+			.rdi_reg  = &tfe640_rdi0_reg,
+			.reg_data = &tfe640_rdi0_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe640_rdi1_reg,
+			.reg_data = &tfe640_rdi1_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe640_rdi2_reg,
+			.reg_data = &tfe640_rdi2_reg_data,
+		},
+	},
+	.in_port = {
+		CAM_TFE_CAMIF_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0
+	},
+	.reg_dump_data  = {
+		.num_reg_dump_entries    = 19,
+		.num_lut_dump_entries    = 0,
+		.bus_start_addr          = 0x2000,
+		.bus_write_top_end_addr  = 0x2120,
+		.bus_client_start_addr   = 0x2200,
+		.bus_client_offset       = 0x100,
+		.num_bus_clients         = 10,
+		.reg_entry = {
+			{
+				.start_offset = 0x1000,
+				.end_offset   = 0x10F4,
+			},
+			{
+				.start_offset = 0x1260,
+				.end_offset   = 0x1280,
+			},
+			{
+				.start_offset = 0x13F0,
+				.end_offset   = 0x13FC,
+			},
+			{
+				.start_offset = 0x1460,
+				.end_offset   = 0x1470,
+			},
+			{
+				.start_offset = 0x15F0,
+				.end_offset   = 0x15FC,
+			},
+			{
+				.start_offset = 0x1660,
+				.end_offset   = 0x1670,
+			},
+			{
+				.start_offset = 0x17F0,
+				.end_offset   = 0x17FC,
+			},
+			{
+				.start_offset = 0x1860,
+				.end_offset   = 0x1870,
+			},
+			{
+				.start_offset = 0x19F0,
+				.end_offset   = 0x19FC,
+			},
+			{
+				.start_offset = 0x2660,
+				.end_offset   = 0x2694,
+			},
+			{
+				.start_offset = 0x2860,
+				.end_offset   = 0x2884,
+			},
+			{
+				.start_offset = 0x2A60,
+				.end_offset   = 0X2B34,
+			},
+			{
+				.start_offset = 0x2C60,
+				.end_offset   = 0X2C80,
+			},
+			{
+				.start_offset = 0x2E60,
+				.end_offset   = 0X2E7C,
+			},
+			{
+				.start_offset = 0x3060,
+				.end_offset   = 0X3110,
+			},
+			{
+				.start_offset = 0x3260,
+				.end_offset   = 0X3278,
+			},
+			{
+				.start_offset = 0x3460,
+				.end_offset   = 0X3478,
+			},
+			{
+				.start_offset = 0x3660,
+				.end_offset   = 0X3684,
+			},
+			{
+				.start_offset = 0x3860,
+				.end_offset   = 0X3884,
+			},
+		},
+		.lut_entry = {
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x40,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x2800,
+			},
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x41,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x3000,
+			},
+		},
+	},
+};
+
+static struct cam_tfe_bus_hw_info  tfe640_bus_hw_info = {
+	.common_reg = {
+		.hw_version  = 0x00003000,
+		.cgc_ovd     = 0x00003008,
+		.comp_cfg_0  = 0x0000300C,
+		.comp_cfg_1  = 0x00003010,
+		.frameheader_cfg  = {
+			0x00003034,
+			0x00003038,
+			0x0000303C,
+			0x00003040,
+		},
+		.pwr_iso_cfg = 0x0000305C,
+		.overflow_status_clear = 0x00003060,
+		.ccif_violation_status = 0x00003064,
+		.overflow_status       = 0x00003068,
+		.image_size_violation_status = 0x00003070,
+		.perf_count_cfg = {
+			0x00003074,
+			0x00003078,
+			0x0000307C,
+			0x00003080,
+			0x00003084,
+			0x00003088,
+			0x0000308C,
+			0x00003090,
+		},
+		.perf_count_val = {
+			0x00003094,
+			0x00003098,
+			0x0000309C,
+			0x000030A0,
+			0x000030A4,
+			0x000030A8,
+			0x000030AC,
+			0x000030B0,
+		},
+		.perf_count_status = 0x000030B4,
+		.debug_status_top_cfg = 0x000030D4,
+		.debug_status_top = 0x000030D8,
+		.test_bus_ctrl = 0x000030DC,
+		.irq_mask = {
+			0x00003018,
+			0x0000301C,
+		},
+		.irq_clear = {
+			0x00003020,
+			0x00003024,
+		},
+		.irq_status = {
+			0x00003028,
+			0x0000302C,
+		},
+		.irq_cmd = 0x00003030,
+		.cons_violation_shift = 28,
+		.violation_shift  = 30,
+		.image_size_violation = 31,
+	},
+	.num_client = 16,
+	.bus_client_reg = {
+		/* BUS Client 0 BAYER */
+		{
+			.cfg                   = 0x00003200,
+			.image_addr            = 0x00003204,
+			.frame_incr            = 0x00003208,
+			.image_cfg_0           = 0x0000320C,
+			.image_cfg_1           = 0x00003210,
+			.image_cfg_2           = 0x00003214,
+			.packer_cfg            = 0x00003218,
+			.bw_limit              = 0x0000321C,
+			.frame_header_addr     = 0x00003220,
+			.frame_header_incr     = 0x00003224,
+			.frame_header_cfg      = 0x00003228,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003230,
+			.irq_subsample_pattern = 0x00003234,
+			.framedrop_period      = 0x00003238,
+			.framedrop_pattern     = 0x0000323C,
+			.addr_status_0         = 0x00003268,
+			.addr_status_1         = 0x0000326C,
+			.addr_status_2         = 0x00003270,
+			.addr_status_3         = 0x00003274,
+			.debug_status_cfg      = 0x00003278,
+			.debug_status_0        = 0x0000327C,
+			.debug_status_1        = 0x00003280,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "BAYER",
+		},
+		/* BUS Client 1 IDEAL RAW*/
+		{
+			.cfg                   = 0x00003300,
+			.image_addr            = 0x00003304,
+			.frame_incr            = 0x00003308,
+			.image_cfg_0           = 0x0000330C,
+			.image_cfg_1           = 0x00003310,
+			.image_cfg_2           = 0x00003314,
+			.packer_cfg            = 0x00003318,
+			.bw_limit              = 0x0000331C,
+			.frame_header_addr     = 0x00003320,
+			.frame_header_incr     = 0x00003324,
+			.frame_header_cfg      = 0x00003328,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003330,
+			.irq_subsample_pattern = 0x00003334,
+			.framedrop_period      = 0x00003338,
+			.framedrop_pattern     = 0x0000333C,
+			.addr_status_0         = 0x00003368,
+			.addr_status_1         = 0x0000336C,
+			.addr_status_2         = 0x00003370,
+			.addr_status_3         = 0x00003374,
+			.debug_status_cfg      = 0x00003378,
+			.debug_status_0        = 0x0000337C,
+			.debug_status_1        = 0x00003380,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_1,
+			.client_name           = "IDEAL_RAW",
+		},
+		/* BUS Client 2 Stats BE Tintless */
+		{
+			.cfg                   = 0x00003400,
+			.image_addr            = 0x00003404,
+			.frame_incr            = 0x00003408,
+			.image_cfg_0           = 0x0000340C,
+			.image_cfg_1           = 0x00003410,
+			.image_cfg_2           = 0x00003414,
+			.packer_cfg            = 0x00003418,
+			.bw_limit              = 0x0000341C,
+			.frame_header_addr     = 0x00003420,
+			.frame_header_incr     = 0x00003424,
+			.frame_header_cfg      = 0x00003428,
+			.line_done_cfg         = 0x00003400,
+			.irq_subsample_period  = 0x00003430,
+			.irq_subsample_pattern = 0x00003434,
+			.framedrop_period      = 0x00003438,
+			.framedrop_pattern     = 0x0000343C,
+			.addr_status_0         = 0x00003468,
+			.addr_status_1         = 0x0000346C,
+			.addr_status_2         = 0x00003470,
+			.addr_status_3         = 0x00003474,
+			.debug_status_cfg      = 0x00003478,
+			.debug_status_0        = 0x0000347C,
+			.debug_status_1        = 0x00003480,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BE TINTLESS",
+		},
+		/* BUS Client 3 Stats Bhist */
+		{
+			.cfg                   = 0x00003500,
+			.image_addr            = 0x00003504,
+			.frame_incr            = 0x00003508,
+			.image_cfg_0           = 0x0000350C,
+			.image_cfg_1           = 0x00003510,
+			.image_cfg_2           = 0x00003514,
+			.packer_cfg            = 0x00003518,
+			.bw_limit              = 0x0000351C,
+			.frame_header_addr     = 0x00003520,
+			.frame_header_incr     = 0x00003524,
+			.frame_header_cfg      = 0x00003528,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003530,
+			.irq_subsample_pattern = 0x00003534,
+			.framedrop_period      = 0x00003538,
+			.framedrop_pattern     = 0x0000353C,
+			.addr_status_0         = 0x00003568,
+			.addr_status_1         = 0x0000356C,
+			.addr_status_2         = 0x00003570,
+			.addr_status_3         = 0x00003574,
+			.debug_status_cfg      = 0x00003578,
+			.debug_status_0        = 0x0000357C,
+			.debug_status_1        = 0x00003580,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BHIST",
+		},
+		/* BUS Client 4 Stats AWB BG */
+		{
+			.cfg                   = 0x00003600,
+			.image_addr            = 0x00003604,
+			.frame_incr            = 0x00003608,
+			.image_cfg_0           = 0x0000360C,
+			.image_cfg_1           = 0x00003610,
+			.image_cfg_2           = 0x00003614,
+			.packer_cfg            = 0x00003618,
+			.bw_limit              = 0x0000361C,
+			.frame_header_addr     = 0x00003620,
+			.frame_header_incr     = 0x00003624,
+			.frame_header_cfg      = 0x00003628,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003630,
+			.irq_subsample_pattern = 0x00003634,
+			.framedrop_period      = 0x00003638,
+			.framedrop_pattern     = 0x0000363C,
+			.addr_status_0         = 0x00003668,
+			.addr_status_1         = 0x0000366C,
+			.addr_status_2         = 0x00003670,
+			.addr_status_3         = 0x00003674,
+			.debug_status_cfg      = 0x00003678,
+			.debug_status_0        = 0x0000367C,
+			.debug_status_1        = 0x00003680,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AWB BG",
+		},
+		/* BUS Client 5 Stats AEC BG */
+		{
+			.cfg                   = 0x00003700,
+			.image_addr            = 0x00003704,
+			.frame_incr            = 0x00003708,
+			.image_cfg_0           = 0x0000370C,
+			.image_cfg_1           = 0x00003710,
+			.image_cfg_2           = 0x00003714,
+			.packer_cfg            = 0x00003718,
+			.bw_limit              = 0x0000371C,
+			.frame_header_addr     = 0x00003720,
+			.frame_header_incr     = 0x00003724,
+			.frame_header_cfg      = 0x00003728,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003730,
+			.irq_subsample_pattern = 0x00003734,
+			.framedrop_period      = 0x00003738,
+			.framedrop_pattern     = 0x0000373C,
+			.addr_status_0         = 0x00003768,
+			.addr_status_1         = 0x0000376C,
+			.addr_status_2         = 0x00003770,
+			.addr_status_3         = 0x00003774,
+			.debug_status_cfg      = 0x00003778,
+			.debug_status_0        = 0x0000377C,
+			.debug_status_1        = 0x00003780,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AEC BG",
+		},
+		/* BUS Client 6 Stats BAF */
+		{
+			.cfg                   = 0x00003800,
+			.image_addr            = 0x00003804,
+			.frame_incr            = 0x00003808,
+			.image_cfg_0           = 0x0000380C,
+			.image_cfg_1           = 0x00003810,
+			.image_cfg_2           = 0x00003814,
+			.packer_cfg            = 0x00003818,
+			.bw_limit              = 0x0000381C,
+			.frame_header_addr     = 0x00003820,
+			.frame_header_incr     = 0x00003824,
+			.frame_header_cfg      = 0x00003828,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003830,
+			.irq_subsample_pattern = 0x00003834,
+			.framedrop_period      = 0x00003838,
+			.framedrop_pattern     = 0x0000383C,
+			.addr_status_0         = 0x00003868,
+			.addr_status_1         = 0x0000386C,
+			.addr_status_2         = 0x00003870,
+			.addr_status_3         = 0x00003874,
+			.debug_status_cfg      = 0x00003878,
+			.debug_status_0        = 0x0000387C,
+			.debug_status_1        = 0x00003880,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_4,
+			.client_name           = "STATS BAF",
+		},
+		/* BUS Client 7 RDI0 */
+		{
+			.cfg                   = 0x00003900,
+			.image_addr            = 0x00003904,
+			.frame_incr            = 0x00003908,
+			.image_cfg_0           = 0x0000390C,
+			.image_cfg_1           = 0x00003910,
+			.image_cfg_2           = 0x00003914,
+			.packer_cfg            = 0x00003918,
+			.bw_limit              = 0x0000391C,
+			.frame_header_addr     = 0x00003920,
+			.frame_header_incr     = 0x00003924,
+			.frame_header_cfg      = 0x00003928,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003930,
+			.irq_subsample_pattern = 0x00003934,
+			.framedrop_period      = 0x00003938,
+			.framedrop_pattern     = 0x0000393C,
+			.addr_status_0         = 0x00003968,
+			.addr_status_1         = 0x0000396C,
+			.addr_status_2         = 0x00003970,
+			.addr_status_3         = 0x00003974,
+			.debug_status_cfg      = 0x00003978,
+			.debug_status_0        = 0x0000397C,
+			.debug_status_1        = 0x00003980,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_5,
+			.client_name           = "RDI0",
+		},
+		/* BUS Client 8 RDI1 */
+		{
+			.cfg                   = 0x00003A00,
+			.image_addr            = 0x00003A04,
+			.frame_incr            = 0x00003A08,
+			.image_cfg_0           = 0x00003A0C,
+			.image_cfg_1           = 0x00003A10,
+			.image_cfg_2           = 0x00003A14,
+			.packer_cfg            = 0x00003A18,
+			.bw_limit              = 0x00003A1C,
+			.frame_header_addr     = 0x00003A20,
+			.frame_header_incr     = 0x00003A24,
+			.frame_header_cfg      = 0x00003A28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003A30,
+			.irq_subsample_pattern = 0x00003A34,
+			.framedrop_period      = 0x00003A38,
+			.framedrop_pattern     = 0x00003A3C,
+			.addr_status_0         = 0x00003A68,
+			.addr_status_1         = 0x00003A6C,
+			.addr_status_2         = 0x00003A70,
+			.addr_status_3         = 0x00003A74,
+			.debug_status_cfg      = 0x00003A78,
+			.debug_status_0        = 0x00003A7C,
+			.debug_status_1        = 0x00003A80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_6,
+			.client_name           = "RDI1",
+		},
+		/* BUS Client 9 RDI2 */
+		{
+			.cfg                   = 0x00003B00,
+			.image_addr            = 0x00003B04,
+			.frame_incr            = 0x00003B08,
+			.image_cfg_0           = 0x00003B0C,
+			.image_cfg_1           = 0x00003B10,
+			.image_cfg_2           = 0x00003B14,
+			.packer_cfg            = 0x00003B18,
+			.bw_limit              = 0x00003B1C,
+			.frame_header_addr     = 0x00003B20,
+			.frame_header_incr     = 0x00003B24,
+			.frame_header_cfg      = 0x00003B28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003B30,
+			.irq_subsample_pattern = 0x00003B34,
+			.framedrop_period      = 0x00003B38,
+			.framedrop_pattern     = 0x00003B3C,
+			.addr_status_0         = 0x00003B68,
+			.addr_status_1         = 0x00003B6C,
+			.addr_status_2         = 0x00003B70,
+			.addr_status_3         = 0x00003B74,
+			.debug_status_cfg      = 0x00003B78,
+			.debug_status_0        = 0x00003B7C,
+			.debug_status_1        = 0x00003B80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_7,
+			.client_name           = "RDI2",
+		},
+		/* BUS Client 10 PDAF */
+		{
+			.cfg                   = 0x00003C00,
+			.image_addr            = 0x00003C04,
+			.frame_incr            = 0x00003C08,
+			.image_cfg_0           = 0x00003C0C,
+			.image_cfg_1           = 0x00003C10,
+			.image_cfg_2           = 0x00003C14,
+			.packer_cfg            = 0x00003C18,
+			.bw_limit              = 0x00003C1C,
+			.frame_header_addr     = 0x00003C20,
+			.frame_header_incr     = 0x00003C24,
+			.frame_header_cfg      = 0x00003C28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003C30,
+			.irq_subsample_pattern = 0x00003C34,
+			.framedrop_period      = 0x00003C38,
+			.framedrop_pattern     = 0x00003C3C,
+			.addr_status_0         = 0x00003C68,
+			.addr_status_1         = 0x00003C6C,
+			.addr_status_2         = 0x00003C70,
+			.addr_status_3         = 0x00003C74,
+			.debug_status_cfg      = 0x00003C78,
+			.debug_status_0        = 0x00003C7C,
+			.debug_status_1        = 0x00003C80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_8,
+			.client_name           = "PDAF",
+		},
+		/* BUS Client 11 DS4 */
+		{
+			.cfg                   = 0x00003D00,
+			.image_addr            = 0x00003D04,
+			.frame_incr            = 0x00003D08,
+			.image_cfg_0           = 0x00003D0C,
+			.image_cfg_1           = 0x00003D10,
+			.image_cfg_2           = 0x00003D14,
+			.packer_cfg            = 0x00003D18,
+			.bw_limit              = 0x00003D1C,
+			.frame_header_addr     = 0x00003D20,
+			.frame_header_incr     = 0x00003D24,
+			.frame_header_cfg      = 0x00003D28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003D30,
+			.irq_subsample_pattern = 0x00003D34,
+			.framedrop_period      = 0x00003D38,
+			.framedrop_pattern     = 0x00003D3C,
+			.addr_status_0         = 0x00003D68,
+			.addr_status_1         = 0x00003D6C,
+			.addr_status_2         = 0x00003D70,
+			.addr_status_3         = 0x00003D74,
+			.debug_status_cfg      = 0x00003D78,
+			.debug_status_0        = 0x00003D7C,
+			.debug_status_1        = 0x00003D80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "DS4",
+		},
+		/* BUS Client 12 DS16 */
+		{
+			.cfg                   = 0x00003E00,
+			.image_addr            = 0x00003E04,
+			.frame_incr            = 0x00003E08,
+			.image_cfg_0           = 0x00003E0C,
+			.image_cfg_1           = 0x00003E10,
+			.image_cfg_2           = 0x00003E14,
+			.packer_cfg            = 0x00003E18,
+			.bw_limit              = 0x00003E1C,
+			.frame_header_addr     = 0x00003E20,
+			.frame_header_incr     = 0x00003E24,
+			.frame_header_cfg      = 0x00003E28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003E30,
+			.irq_subsample_pattern = 0x00003E34,
+			.framedrop_period      = 0x00003E38,
+			.framedrop_pattern     = 0x00003E3C,
+			.addr_status_0         = 0x00003E68,
+			.addr_status_1         = 0x00003E6C,
+			.addr_status_2         = 0x00003E70,
+			.addr_status_3         = 0x00003E74,
+			.debug_status_cfg      = 0x00003E78,
+			.debug_status_0        = 0x00003E7C,
+			.debug_status_1        = 0x00003E80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "DS16",
+		},
+		/* BUS Client 13 AI-Y */
+		{
+			.cfg                   = 0x00003F00,
+			.image_addr            = 0x00003F04,
+			.frame_incr            = 0x00003F08,
+			.image_cfg_0           = 0x00003F0C,
+			.image_cfg_1           = 0x00003F10,
+			.image_cfg_2           = 0x00003F14,
+			.packer_cfg            = 0x00003F18,
+			.bw_limit              = 0x00003F1C,
+			.frame_header_addr     = 0x00003F20,
+			.frame_header_incr     = 0x00003F24,
+			.frame_header_cfg      = 0x00003F28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003F30,
+			.irq_subsample_pattern = 0x00003F34,
+			.framedrop_period      = 0x00003F38,
+			.framedrop_pattern     = 0x00003F3C,
+			.addr_status_0         = 0x00003F68,
+			.addr_status_1         = 0x00003F6C,
+			.addr_status_2         = 0x00003F70,
+			.addr_status_3         = 0x00003F74,
+			.debug_status_cfg      = 0x00003F78,
+			.debug_status_0        = 0x00003F7C,
+			.debug_status_1        = 0x00003F80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_9,
+			.client_name           = "AI-Y",
+		},
+		/* BUS Client 14 AI-C */
+		{
+			.cfg                   = 0x00004000,
+			.image_addr            = 0x00004004,
+			.frame_incr            = 0x00004008,
+			.image_cfg_0           = 0x0000400C,
+			.image_cfg_1           = 0x00004010,
+			.image_cfg_2           = 0x00004014,
+			.packer_cfg            = 0x00004018,
+			.bw_limit              = 0x0000401C,
+			.frame_header_addr     = 0x00004020,
+			.frame_header_incr     = 0x00004024,
+			.frame_header_cfg      = 0x00004028,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004030,
+			.irq_subsample_pattern = 0x00004034,
+			.framedrop_period      = 0x00004038,
+			.framedrop_pattern     = 0x0000403C,
+			.addr_status_0         = 0x00004068,
+			.addr_status_1         = 0x0000406C,
+			.addr_status_2         = 0x00004070,
+			.addr_status_3         = 0x00004074,
+			.debug_status_cfg      = 0x00004078,
+			.debug_status_0        = 0x0000407C,
+			.debug_status_1        = 0x00004080,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_9,
+			.client_name           = "AI-C",
+		},
+		/* BUS Client 15 Stats RS */
+		{
+			.cfg                   = 0x00004100,
+			.image_addr            = 0x00004104,
+			.frame_incr            = 0x00004108,
+			.image_cfg_0           = 0x0000410C,
+			.image_cfg_1           = 0x00004110,
+			.image_cfg_2           = 0x00004114,
+			.packer_cfg            = 0x00004118,
+			.bw_limit              = 0x0000411C,
+			.frame_header_addr     = 0x00004120,
+			.frame_header_incr     = 0x00004124,
+			.frame_header_cfg      = 0x00004128,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004130,
+			.irq_subsample_pattern = 0x00004134,
+			.framedrop_period      = 0x00004138,
+			.framedrop_pattern     = 0x0000413C,
+			.addr_status_0         = 0x00004168,
+			.addr_status_1         = 0x0000416C,
+			.addr_status_2         = 0x00004170,
+			.addr_status_3         = 0x00004174,
+			.debug_status_cfg      = 0x00004178,
+			.debug_status_0        = 0x0000417C,
+			.debug_status_1        = 0x00004180,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_10,
+			.client_name           = "STATS RS",
+		},
+	},
+	.num_out  = 15,
+	.tfe_out_hw_info = {
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI0,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_5,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_1,
+			.mid[0]              = 4,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI1,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_6,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_2,
+			.mid[0]              = 5,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI2,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_7,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_3,
+			.mid[0]              = 6,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_FULL,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 16,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RAW_DUMP,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_1,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 7,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PDAF,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_8,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 26,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 21,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 18,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_TL_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 17,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 19,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_BF,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_4,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 21,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_RS,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_10,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 27,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_DS4,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 22,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_DS16,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 23,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_AI,
+			.max_width        = 1920,
+			.max_height       = 1920,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_9,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]              = 24,
+			.mid[1]              = 25,
+		},
+	},
+	.num_comp_grp             = 11,
+	.max_wm_per_comp_grp      = 3,
+	.comp_done_shift          = 8,
+	.top_bus_wr_irq_shift     = 1,
+	.comp_buf_done_mask = 0x7FF00,
+	.comp_rup_done_mask = 0xF,
+	.bus_irq_error_mask = {
+		0xD0000000,
+		0x00000000,
+	},
+	.support_consumed_addr = true,
+	.pdaf_rdi2_mux_en = false,
+	.rdi_width = 128,
+	.max_bw_counter_limit  = 0xFF,
+	.counter_limit_shift   = 1,
+	.counter_limit_mask    = 0xF,
+	.mode_cfg_shift = 16,
+	.height_shift = 16,
+};
+
+struct cam_tfe_hw_info cam_tfe640 = {
+	.top_irq_mask = {
+		0x00001834,
+		0x00001838,
+		0x0000183C,
+	},
+	.top_irq_clear = {
+		0x00001840,
+		0x00001844,
+		0x00001848,
+	},
+	.top_irq_status = {
+		0x0000184C,
+		0x00001850,
+		0x00001854,
+	},
+	.top_irq_cmd                       = 0x00001830,
+	.global_clear_bitmask              = 0x00000001,
+	.bus_irq_mask = {
+		0x00003018,
+		0x0000301C,
+	},
+	.bus_irq_clear = {
+		0x00003020,
+		0x00003024,
+	},
+	.bus_irq_status = {
+		0x00003028,
+		0x0000302C,
+	},
+	.bus_irq_cmd = 0x00003030,
+	.bus_violation_reg = 0x00003064,
+	.bus_overflow_reg = 0x00003068,
+	.bus_image_size_vilation_reg = 0x3070,
+	.bus_overflow_clear_cmd = 0x3060,
+	.debug_status_top = 0x30D8,
+
+	.reset_irq_mask = {
+		0x00000001,
+		0x00000000,
+		0x00000000,
+	},
+	.error_irq_mask = {
+		0x000F0F00,
+		0x00000000,
+		0x0000003F,
+	},
+	.bus_reg_irq_mask = {
+		0x00000002,
+		0x00000000,
+	},
+	.bus_error_irq_mask = {
+		0xC0000000,
+		0x00000000,
+	},
+
+	.num_clc = 39,
+	.clc_hw_status_info            = tfe640_clc_hw_info,
+	.bus_version                   = CAM_TFE_BUS_1_0,
+	.bus_hw_info                   = &tfe640_bus_hw_info,
+
+	.top_version                   = CAM_TFE_TOP_1_0,
+	.top_hw_info                   = &tfe640_top_hw_info,
+};
+
+#endif /* _CAM_TFE640__H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe640_210.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe640_210.h
@@ -0,0 +1,79 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE640_210_H_
+#define _CAM_TFE640_210_H_
+#include "cam_tfe_core.h"
+#include "cam_tfe_bus.h"
+#include "cam_tfe640.h"
+
+struct cam_tfe_hw_info cam_tfe640_210 = {
+	.top_irq_mask = {
+		0x00001834,
+		0x00001838,
+		0x0000183C,
+	},
+	.top_irq_clear = {
+		0x00001840,
+		0x00001844,
+		0x00001848,
+	},
+	.top_irq_status = {
+		0x0000184C,
+		0x00001850,
+		0x00001854,
+	},
+	.top_irq_cmd                       = 0x00001830,
+	.global_clear_bitmask              = 0x00000001,
+	.bus_irq_mask = {
+		0x00003018,
+		0x0000301C,
+	},
+	.bus_irq_clear = {
+		0x00003020,
+		0x00003024,
+	},
+	.bus_irq_status = {
+		0x00003028,
+		0x0000302C,
+	},
+	.bus_irq_cmd = 0x00003030,
+	.bus_violation_reg = 0x00003064,
+	.bus_overflow_reg = 0x00003068,
+	.bus_image_size_vilation_reg = 0x3070,
+	.bus_overflow_clear_cmd = 0x3060,
+	.debug_status_top = 0x30D8,
+
+	.reset_irq_mask = {
+		0x00000001,
+		0x00000000,
+		0x00000000,
+	},
+	.error_irq_mask = {
+		0x000F0F00,
+		0x00000000,
+		0x0000003F,
+	},
+	.bus_reg_irq_mask = {
+		0x00000002,
+		0x00000000,
+	},
+	.bus_error_irq_mask = {
+		0xC0000000,
+		0x00000000,
+	},
+
+	.num_clc = 39,
+	.clc_hw_status_info            = tfe640_clc_hw_info,
+	.bus_version                   = CAM_TFE_BUS_1_0,
+	.bus_hw_info                   = &tfe640_bus_hw_info,
+
+	.top_version                   = CAM_TFE_TOP_1_0,
+	.top_hw_info                   = &tfe640_top_hw_info,
+};
+
+#endif /* _CAM_TFE640_210_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe665.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe665.h
@@ -0,0 +1,1471 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE665_H_
+#define _CAM_TFE665_H_
+#include <media/cam_isp_tfe.h>
+#include "cam_tfe_core.h"
+#include "cam_tfe_bus.h"
+
+
+static struct cam_tfe_top_reg_offset_common  tfe665_top_commong_reg  = {
+	.hw_version                             = 0x00001800,
+	.hw_capability                          = 0x00001804,
+	.lens_feature                           = 0x00001808,
+	.stats_feature                          = 0x0000180C,
+	.zoom_feature                           = 0x00001810,
+	.global_reset_cmd                       = 0x00001814,
+	.core_cgc_ctrl_0                        = 0x00001818,
+	.core_cgc_ctrl_1                        = 0x0000181C,
+	.ahb_cgc_ctrl                           = 0x0000181C,
+	.core_cfg_0                             = 0x00001824,
+	.reg_update_cmd                         = 0x0000182C,
+	.diag_config                            = 0x00001860,
+	.diag_sensor_status_0                   = 0x00001864,
+	.diag_sensor_status_1                   = 0x00001868,
+	.diag_sensor_frame_cnt_status           = 0x0000186C,
+	.violation_status                       = 0x00001870,
+	.stats_throttle_cnt_cfg_0               = 0x00001874,
+	.stats_throttle_cnt_cfg_1               = 0x00001878,
+	.num_debug_reg                          = 12,
+	.debug_reg = {
+		0x000018A0,
+		0x000018A4,
+		0x000018A8,
+		0x000018AC,
+		0x000018B0,
+		0x000018B4,
+		0x000018B8,
+		0x000018BC,
+		0x000018C0,
+		0x000018C4,
+		0x000018C8,
+		0x000018CC,
+	},
+	.debug_cfg                              = 0x000018DC,
+	.num_perf_cfg                           = 2,
+	.perf_cfg = {
+		{
+			.perf_cnt_cfg           = 0x000018E0,
+			.perf_pixel_count       = 0x000018E4,
+			.perf_line_count        = 0x000018E8,
+			.perf_stall_count       = 0x000018EC,
+			.perf_always_count      = 0x000018F0,
+			.perf_count_status      = 0x000018F4,
+		},
+		{
+			.perf_cnt_cfg           = 0x000018F8,
+			.perf_pixel_count       = 0x000018FC,
+			.perf_line_count        = 0x00001900,
+			.perf_stall_count       = 0x00001904,
+			.perf_always_count      = 0x00001908,
+			.perf_count_status      = 0x0000190C,
+		},
+	},
+	.diag_sensor_frame_cnt_status_1         = 0x00001920,
+	.diag_min_hbi_error_shift               = 15,
+	.diag_neq_hbi_shift                     = 14,
+	.diag_sensor_hbi_mask                   = 0x3FFF,
+	.serializer_supported                   = true,
+	.pp_camif_violation_bit                 = BIT(0),
+	.pp_violation_bit                       = BIT(1),
+	.rdi0_camif_violation_bit               = BIT(2),
+	.rdi1_camif_violation_bit               = BIT(3),
+	.rdi2_camif_violation_bit               = BIT(4),
+	.diag_violation_bit                     = BIT(5),
+	.ppp_camif_violation_bit                = BIT(6),
+	.ppp_violation_bit                      = BIT(7),
+	.lcr_pd_timing_protocol_violation_bit   = BIT(8),
+	.dyamanic_switch_violation_bit          = BIT(9),
+	.pp_frame_drop_bit                      = BIT(8),
+	.rdi0_frame_drop_bit                    = BIT(9),
+	.rdi1_frame_drop_bit                    = BIT(10),
+	.rdi2_frame_drop_bit                    = BIT(11),
+	.ppp_frame_drop_bit                     = BIT(12),
+	.pp_overflow_bit                        = BIT(16),
+	.rdi0_overflow_bit                      = BIT(17),
+	.rdi1_overflow_bit                      = BIT(18),
+	.rdi2_overflow_bit                      = BIT(19),
+	.ppp_overflow_bit                       = BIT(20),
+	.out_of_sync_frame_drop_bit             = BIT(21),
+	.mup_shift_val                          = 8,
+	.mup_supported                          = true,
+	.height_shift                           = 16,
+	.epoch_shift_val                        = 16,
+};
+
+static struct cam_tfe_camif_reg  tfe665_camif_reg = {
+	.hw_version                   = 0x00001C00,
+	.hw_status                    = 0x00001C04,
+	.module_cfg                   = 0x00001C60,
+	.pdaf_raw_crop_width_cfg      = 0x00001C68,
+	.pdaf_raw_crop_height_cfg     = 0x00001C6C,
+	.line_skip_pattern            = 0x00001C70,
+	.pixel_skip_pattern           = 0x00001C74,
+	.period_cfg                   = 0x00001C78,
+	.irq_subsample_pattern        = 0x00001C7C,
+	.epoch_irq_cfg                = 0x00001C80,
+	.debug_1                      = 0x00001DF0,
+	.debug_0                      = 0x00001DF4,
+	.test_bus_ctrl                = 0x00001DF8,
+	.spare                        = 0x00001DFC,
+	.reg_update_cmd               = 0x0000182C,
+};
+
+static struct cam_tfe_camif_reg_data tfe665_camif_reg_data = {
+	.extern_reg_update_mask       = 0x00000001,
+	.dual_tfe_pix_en_shift        = 0x00000001,
+	.extern_reg_update_shift      = 0x0,
+	.dual_tfe_sync_sel_shift      = 18,
+	.delay_line_en_shift          = 8,
+	.pixel_pattern_shift          = 24,
+	.pixel_pattern_mask           = 0x7000000,
+	.module_enable_shift          = 0,
+	.pix_out_enable_shift         = 8,
+	.pdaf_output_enable_shift     = 9,
+	.dsp_mode_shift               = 0,
+	.dsp_mode_mask                = 0,
+	.dsp_en_shift                 = 0,
+	.dsp_en_mask                  = 0,
+	.reg_update_cmd_data          = 0x1,
+	.epoch_line_cfg               = 0x00140014,
+	.sof_irq_mask                 = 0x00000001,
+	.epoch0_irq_mask              = 0x00000004,
+	.epoch1_irq_mask              = 0x00000008,
+	.eof_irq_mask                 = 0x00000002,
+	.reg_update_irq_mask          = 0x00000001,
+	.error_irq_mask0              = 0x00210100,
+	.error_irq_mask2              = 0x00000223,
+	.subscribe_irq_mask           = {
+		0x00000000,
+		0x00000007,
+		0x00000000,
+	},
+	.enable_diagnostic_hw         = 0x1,
+	.perf_cnt_start_cmd_shift     = 0,
+	.perf_cnt_continuous_shift    = 2,
+	.perf_client_sel_shift        = 8,
+	.perf_window_start_shift      = 16,
+	.perf_window_end_shift        = 20,
+	.ai_c_srl_en_shift            = 11,
+	.ds16_c_srl_en_shift          = 10,
+	.ds4_c_srl_en_shift           = 9,
+	.shdr_mode_shift              = 21,
+	.extern_mup_shift             = 22,
+};
+
+static struct cam_tfe_rdi_reg  tfe665_rdi0_reg = {
+	.rdi_hw_version              = 0x00001E00,
+	.rdi_hw_status               = 0x00001E04,
+	.rdi_module_config           = 0x00001E60,
+	.rdi_skip_period             = 0x00001E68,
+	.rdi_irq_subsample_pattern   = 0x00001E6C,
+	.rdi_epoch_irq               = 0x00001E70,
+	.rdi_debug_1                 = 0x00001FF0,
+	.rdi_debug_0                 = 0x00001FF4,
+	.rdi_test_bus_ctrl           = 0x00001FF8,
+	.rdi_spare                   = 0x00001FFC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe665_rdi0_reg_data = {
+	.reg_update_cmd_data         = 0x2,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000010,
+	.epoch0_irq_mask             = 0x00000040,
+	.epoch1_irq_mask             = 0x00000080,
+	.eof_irq_mask                = 0x00000020,
+	.error_irq_mask0             = 0x00020200,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000030,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x1,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe665_rdi1_reg = {
+	.rdi_hw_version              = 0x00002000,
+	.rdi_hw_status               = 0x00002004,
+	.rdi_module_config           = 0x00002060,
+	.rdi_skip_period             = 0x00002068,
+	.rdi_irq_subsample_pattern   = 0x0000206C,
+	.rdi_epoch_irq               = 0x00002070,
+	.rdi_debug_1                 = 0x000021F0,
+	.rdi_debug_0                 = 0x000021F4,
+	.rdi_test_bus_ctrl           = 0x000021F8,
+	.rdi_spare                   = 0x000021FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe665_rdi1_reg_data = {
+	.reg_update_cmd_data         = 0x4,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000100,
+	.epoch0_irq_mask             = 0x00000400,
+	.epoch1_irq_mask             = 0x00000800,
+	.eof_irq_mask                = 0x00000200,
+	.error_irq_mask0             = 0x00040400,
+	.error_irq_mask2             = 0x00000008,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000300,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x2,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe665_rdi2_reg = {
+	.rdi_hw_version              = 0x00002200,
+	.rdi_hw_status               = 0x00002204,
+	.rdi_module_config           = 0x00002260,
+	.rdi_skip_period             = 0x00002268,
+	.rdi_irq_subsample_pattern   = 0x0000226C,
+	.rdi_epoch_irq               = 0x00002270,
+	.rdi_debug_1                 = 0x000023F0,
+	.rdi_debug_0                 = 0x000023F4,
+	.rdi_test_bus_ctrl           = 0x000023F8,
+	.rdi_spare                   = 0x000023FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe665_rdi2_reg_data = {
+	.reg_update_cmd_data         = 0x8,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00001000,
+	.epoch0_irq_mask             = 0x00004000,
+	.epoch1_irq_mask             = 0x00008000,
+	.eof_irq_mask                = 0x00002000,
+	.error_irq_mask0             = 0x00080800,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00003000,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x3,
+	.diag_sensor_shift           = 0x1,
+
+};
+
+static struct cam_tfe_ppp_reg  tfe665_ppp_reg = {
+	.ppp_hw_version              = 0x00002400,
+	.ppp_hw_status               = 0x00002404,
+	.ppp_module_config           = 0x00002460,
+	.ppp_skip_period             = 0x00002468,
+	.ppp_irq_subsample_pattern   = 0x0000246C,
+	.ppp_epoch_irq               = 0x00002470,
+	.ppp_debug_1                 = 0x000025F0,
+	.ppp_debug_0                 = 0x000025F4,
+	.ppp_test_bus_ctrl           = 0x000025F8,
+	.ppp_spare                   = 0x000025FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_ppp_reg_data tfe665_ppp_reg_data = {
+	.sof_irq_mask                = 0x00000000,
+	.epoch0_irq_mask             = 0x00000000,
+	.epoch1_irq_mask             = 0x00000000,
+	.eof_irq_mask                = 0x00000000,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000000,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x4,
+	.diag_sensor_shift           = 0x1,
+	.pdaf_path_en_shift          = 24,
+	.lcr_dis_en_shift            = 23,
+};
+
+static struct cam_tfe_clc_hw_status  tfe665_clc_hw_info[CAM_TFE_MAX_CLC] = {
+	{
+		.name = "CLC_CAMIF",
+		.hw_status_reg = 0x1C04,
+	},
+	{
+		.name = "CLC_RDI0_CAMIF",
+		.hw_status_reg = 0x1E04,
+	},
+	{
+		.name = "CLC_RDI1_CAMIF",
+		.hw_status_reg = 0x2004,
+	},
+	{
+		.name = "CLC_RDI2_CAMIF",
+		.hw_status_reg = 0x2204,
+	},
+	{
+		.name = "CLC_PD_CAMIF",
+		.hw_status_reg = 0x2404,
+	},
+	{
+		.name = "CLC_PDAF_LITE",
+		.hw_status_reg = 0x2A04,
+	},
+	{
+		.name = "CLC_CHANNEL_GAIN",
+		.hw_status_reg = 0x6004,
+	},
+	{
+		.name = "CLC_BPC_PDPC",
+		.hw_status_reg = 0x6204,
+	},
+	{
+		.name = "CLC_LCS",
+		.hw_status_reg = 0x6404,
+	},
+	{
+		.name = "CLC_SHARED_LB",
+		.hw_status_reg = 0x6604,
+	},
+	{
+		.name = "CLC_WB_BDS",
+		.hw_status_reg = 0x6804,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_POST_BDS",
+		.hw_status_reg = 0x6A04,
+	},
+	{
+		.name = "CLC_BLS",
+		.hw_status_reg = 0x6C04,
+	},
+	{
+		.name = "CLC_BAYER_GLUT",
+		.hw_status_reg = 0x6E04,
+	},
+	{
+		.name = "CLC_BAYER_DS4",
+		.hw_status_reg = 0x7004,
+	},
+	{
+		.name = "CLC_COLOR_XFORM_DS4",
+		.hw_status_reg = 0x7204,
+	},
+	{
+		.name = "CLC_CHROMA_DS2",
+		.hw_status_reg = 0x7404,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_Y_DS4",
+		.hw_status_reg = 0x7604,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_C_DS4",
+		.hw_status_reg = 0x7804,
+	},
+	{
+		.name = "CLC_R2PD_DS4",
+		.hw_status_reg = 0x7A04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_4TO1_Y",
+		.hw_status_reg = 0x7C04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_4TO1_C",
+		.hw_status_reg = 0x7E04,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_Y_DS16",
+		.hw_status_reg = 0x8004,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_C_DS16",
+		.hw_status_reg = 0x8204,
+	},
+	{
+		.name = "CLC_R2PD_DS16",
+		.hw_status_reg = 0x8404,
+	},
+	{
+		.name = "CLC_WB_GAIN",
+		.hw_status_reg = 0x8604,
+	},
+	{
+		.name = "CLC_BAYER_DS2",
+		.hw_status_reg = 0x8804,
+	},
+	{
+		.name = "CLC_GTM",
+		.hw_status_reg = 0x8A04,
+	},
+	{
+		.name = "CLC_COLOR_XFORM_AI_DS",
+		.hw_status_reg = 0x8C04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_MN_Y",
+		.hw_status_reg = 0x8E04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_MN_C",
+		.hw_status_reg = 0x9004,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_Y_AI_DS",
+		.hw_status_reg = 0x9204,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_C_AI_DS",
+		.hw_status_reg = 0x9404,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_IDEAL_RAW",
+		.hw_status_reg = 0x9604,
+	},
+	{
+		.name = "CLC_ABF",
+		.hw_status_reg = 0x9804,
+	},
+	{
+		.name = "CLC_STATS_BG",
+		.hw_status_reg = 0x9A04,
+	},
+	{
+		.name = "CLC_STATS_BHIST",
+		.hw_status_reg = 0x9C04,
+	},
+	{
+		.name = "CLC_STATS_AWB_BG",
+		.hw_status_reg = 0x9E04,
+	},
+	{
+		.name = "CLC_STATS_AEC_BG",
+		.hw_status_reg = 0xA004,
+	},
+	{
+		.name = "CLC_STATS_BAF",
+		.hw_status_reg = 0xA204,
+	},
+	{
+		.name = "CLC_STATS_RS",
+		.hw_status_reg = 0xA404,
+	},
+};
+
+static struct  cam_tfe_top_hw_info tfe665_top_hw_info = {
+	.common_reg = &tfe665_top_commong_reg,
+	.camif_hw_info = {
+		.camif_reg = &tfe665_camif_reg,
+		.reg_data  = &tfe665_camif_reg_data,
+	},
+	.rdi_hw_info  = {
+		{
+			.rdi_reg  = &tfe665_rdi0_reg,
+			.reg_data = &tfe665_rdi0_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe665_rdi1_reg,
+			.reg_data = &tfe665_rdi1_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe665_rdi2_reg,
+			.reg_data = &tfe665_rdi2_reg_data,
+		},
+	},
+	.ppp_hw_info = {
+		.ppp_reg = &tfe665_ppp_reg,
+		.reg_data  = &tfe665_ppp_reg_data,
+	},
+	.in_port = {
+		CAM_TFE_CAMIF_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_PDLIB_VER_1_0
+	},
+	.reg_dump_data  = {
+		.num_reg_dump_entries    = 19,
+		.num_lut_dump_entries    = 0,
+		.bus_start_addr          = 0x2000,
+		.bus_write_top_end_addr  = 0x2120,
+		.bus_client_start_addr   = 0x2200,
+		.bus_client_offset       = 0x100,
+		.num_bus_clients         = 10,
+		.reg_entry = {
+			{
+				.start_offset = 0x1000,
+				.end_offset   = 0x10F4,
+			},
+			{
+				.start_offset = 0x1260,
+				.end_offset   = 0x1280,
+			},
+			{
+				.start_offset = 0x13F0,
+				.end_offset   = 0x13FC,
+			},
+			{
+				.start_offset = 0x1460,
+				.end_offset   = 0x1470,
+			},
+			{
+				.start_offset = 0x15F0,
+				.end_offset   = 0x15FC,
+			},
+			{
+				.start_offset = 0x1660,
+				.end_offset   = 0x1670,
+			},
+			{
+				.start_offset = 0x17F0,
+				.end_offset   = 0x17FC,
+			},
+			{
+				.start_offset = 0x1860,
+				.end_offset   = 0x1870,
+			},
+			{
+				.start_offset = 0x19F0,
+				.end_offset   = 0x19FC,
+			},
+			{
+				.start_offset = 0x2660,
+				.end_offset   = 0x2694,
+			},
+			{
+				.start_offset = 0x2860,
+				.end_offset   = 0x2884,
+			},
+			{
+				.start_offset = 0x2A60,
+				.end_offset   = 0X2B34,
+			},
+			{
+				.start_offset = 0x2C60,
+				.end_offset   = 0X2C80,
+			},
+			{
+				.start_offset = 0x2E60,
+				.end_offset   = 0X2E7C,
+			},
+			{
+				.start_offset = 0x3060,
+				.end_offset   = 0X3110,
+			},
+			{
+				.start_offset = 0x3260,
+				.end_offset   = 0X3278,
+			},
+			{
+				.start_offset = 0x3460,
+				.end_offset   = 0X3478,
+			},
+			{
+				.start_offset = 0x3660,
+				.end_offset   = 0X3684,
+			},
+			{
+				.start_offset = 0x3860,
+				.end_offset   = 0X3884,
+			},
+		},
+		.lut_entry = {
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x40,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x2800,
+			},
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x41,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x3000,
+			},
+		},
+	},
+	.num_path_port_map = 3,
+	.path_port_map = {
+		{CAM_ISP_HW_TFE_IN_PDLIB, CAM_ISP_TFE_OUT_RES_PD_LCR_STATS},
+		{CAM_ISP_HW_TFE_IN_PDLIB, CAM_ISP_TFE_OUT_RES_PD_PREPROCESSED},
+		{CAM_ISP_HW_TFE_IN_PDLIB, CAM_ISP_TFE_OUT_RES_PD_PARSED},
+	},
+};
+
+static struct cam_tfe_bus_hw_info  tfe665_bus_hw_info = {
+	.common_reg = {
+		.hw_version  = 0x00003000,
+		.cgc_ovd     = 0x00003008,
+		.comp_cfg_0  = 0x0000300C,
+		.comp_cfg_1  = 0x00003010,
+		.frameheader_cfg  = {
+			0x00003034,
+			0x00003038,
+			0x0000303C,
+			0x00003040,
+		},
+		.pwr_iso_cfg = 0x0000305C,
+		.overflow_status_clear = 0x00003060,
+		.ccif_violation_status = 0x00003064,
+		.overflow_status       = 0x00003068,
+		.image_size_violation_status = 0x00003070,
+		.perf_count_cfg = {
+			0x00003074,
+			0x00003078,
+			0x0000307C,
+			0x00003080,
+			0x00003084,
+			0x00003088,
+			0x0000308C,
+			0x00003090,
+		},
+		.perf_count_val = {
+			0x00003094,
+			0x00003098,
+			0x0000309C,
+			0x000030A0,
+			0x000030A4,
+			0x000030A8,
+			0x000030AC,
+			0x000030B0,
+		},
+		.perf_count_status = 0x000030B4,
+		.debug_status_top_cfg = 0x000030D4,
+		.debug_status_top = 0x000030D8,
+		.test_bus_ctrl = 0x000030DC,
+		.irq_mask = {
+			0x00003018,
+			0x0000301C,
+		},
+		.irq_clear = {
+			0x00003020,
+			0x00003024,
+		},
+		.irq_status = {
+			0x00003028,
+			0x0000302C,
+		},
+		.irq_cmd = 0x00003030,
+		.cons_violation_shift = 28,
+		.violation_shift  = 30,
+		.image_size_violation = 31,
+	},
+	.num_client = 19,
+	.bus_client_reg = {
+		/* BUS Client 0 BAYER */
+		{
+			.cfg                   = 0x00003200,
+			.image_addr            = 0x00003204,
+			.frame_incr            = 0x00003208,
+			.image_cfg_0           = 0x0000320C,
+			.image_cfg_1           = 0x00003210,
+			.image_cfg_2           = 0x00003214,
+			.packer_cfg            = 0x00003218,
+			.bw_limit              = 0x0000321C,
+			.frame_header_addr     = 0x00003220,
+			.frame_header_incr     = 0x00003224,
+			.frame_header_cfg      = 0x00003228,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003230,
+			.irq_subsample_pattern = 0x00003234,
+			.framedrop_period      = 0x00003238,
+			.framedrop_pattern     = 0x0000323C,
+			.system_cache_cfg      = 0x00003260,
+			.addr_status_0         = 0x00003268,
+			.addr_status_1         = 0x0000326C,
+			.addr_status_2         = 0x00003270,
+			.addr_status_3         = 0x00003274,
+			.debug_status_cfg      = 0x00003278,
+			.debug_status_0        = 0x0000327C,
+			.debug_status_1        = 0x00003280,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "BAYER",
+		},
+		/* BUS Client 1 IDEAL RAW*/
+		{
+			.cfg                   = 0x00003300,
+			.image_addr            = 0x00003304,
+			.frame_incr            = 0x00003308,
+			.image_cfg_0           = 0x0000330C,
+			.image_cfg_1           = 0x00003310,
+			.image_cfg_2           = 0x00003314,
+			.packer_cfg            = 0x00003318,
+			.bw_limit              = 0x0000331C,
+			.frame_header_addr     = 0x00003320,
+			.frame_header_incr     = 0x00003324,
+			.frame_header_cfg      = 0x00003328,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003330,
+			.irq_subsample_pattern = 0x00003334,
+			.framedrop_period      = 0x00003338,
+			.framedrop_pattern     = 0x0000333C,
+			.system_cache_cfg      = 0x00003360,
+			.addr_status_0         = 0x00003368,
+			.addr_status_1         = 0x0000336C,
+			.addr_status_2         = 0x00003370,
+			.addr_status_3         = 0x00003374,
+			.debug_status_cfg      = 0x00003378,
+			.debug_status_0        = 0x0000337C,
+			.debug_status_1        = 0x00003380,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_1,
+			.client_name           = "IDEAL_RAW",
+		},
+		/* BUS Client 2 Stats BE Tintless */
+		{
+			.cfg                   = 0x00003400,
+			.image_addr            = 0x00003404,
+			.frame_incr            = 0x00003408,
+			.image_cfg_0           = 0x0000340C,
+			.image_cfg_1           = 0x00003410,
+			.image_cfg_2           = 0x00003414,
+			.packer_cfg            = 0x00003418,
+			.bw_limit              = 0x0000341C,
+			.frame_header_addr     = 0x00003420,
+			.frame_header_incr     = 0x00003424,
+			.frame_header_cfg      = 0x00003428,
+			.line_done_cfg         = 0x00003400,
+			.irq_subsample_period  = 0x00003430,
+			.irq_subsample_pattern = 0x00003434,
+			.framedrop_period      = 0x00003438,
+			.framedrop_pattern     = 0x0000343C,
+			.system_cache_cfg      = 0x00003460,
+			.addr_status_0         = 0x00003468,
+			.addr_status_1         = 0x0000346C,
+			.addr_status_2         = 0x00003470,
+			.addr_status_3         = 0x00003474,
+			.debug_status_cfg      = 0x00003478,
+			.debug_status_0        = 0x0000347C,
+			.debug_status_1        = 0x00003480,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BE TINTLESS",
+		},
+		/* BUS Client 3 Stats Bhist */
+		{
+			.cfg                   = 0x00003500,
+			.image_addr            = 0x00003504,
+			.frame_incr            = 0x00003508,
+			.image_cfg_0           = 0x0000350C,
+			.image_cfg_1           = 0x00003510,
+			.image_cfg_2           = 0x00003514,
+			.packer_cfg            = 0x00003518,
+			.bw_limit              = 0x0000351C,
+			.frame_header_addr     = 0x00003520,
+			.frame_header_incr     = 0x00003524,
+			.frame_header_cfg      = 0x00003528,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003530,
+			.irq_subsample_pattern = 0x00003534,
+			.framedrop_period      = 0x00003538,
+			.framedrop_pattern     = 0x0000353C,
+			.system_cache_cfg      = 0x00003560,
+			.addr_status_0         = 0x00003568,
+			.addr_status_1         = 0x0000356C,
+			.addr_status_2         = 0x00003570,
+			.addr_status_3         = 0x00003574,
+			.debug_status_cfg      = 0x00003578,
+			.debug_status_0        = 0x0000357C,
+			.debug_status_1        = 0x00003580,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BHIST",
+		},
+		/* BUS Client 4 Stats AWB BG */
+		{
+			.cfg                   = 0x00003600,
+			.image_addr            = 0x00003604,
+			.frame_incr            = 0x00003608,
+			.image_cfg_0           = 0x0000360C,
+			.image_cfg_1           = 0x00003610,
+			.image_cfg_2           = 0x00003614,
+			.packer_cfg            = 0x00003618,
+			.bw_limit              = 0x0000361C,
+			.frame_header_addr     = 0x00003620,
+			.frame_header_incr     = 0x00003624,
+			.frame_header_cfg      = 0x00003628,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003630,
+			.irq_subsample_pattern = 0x00003634,
+			.framedrop_period      = 0x00003638,
+			.framedrop_pattern     = 0x0000363C,
+			.system_cache_cfg      = 0x00003660,
+			.addr_status_0         = 0x00003668,
+			.addr_status_1         = 0x0000366C,
+			.addr_status_2         = 0x00003670,
+			.addr_status_3         = 0x00003674,
+			.debug_status_cfg      = 0x00003678,
+			.debug_status_0        = 0x0000367C,
+			.debug_status_1        = 0x00003680,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AWB BG",
+		},
+		/* BUS Client 5 Stats AEC BG */
+		{
+			.cfg                   = 0x00003700,
+			.image_addr            = 0x00003704,
+			.frame_incr            = 0x00003708,
+			.image_cfg_0           = 0x0000370C,
+			.image_cfg_1           = 0x00003710,
+			.image_cfg_2           = 0x00003714,
+			.packer_cfg            = 0x00003718,
+			.bw_limit              = 0x0000371C,
+			.frame_header_addr     = 0x00003720,
+			.frame_header_incr     = 0x00003724,
+			.frame_header_cfg      = 0x00003728,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003730,
+			.irq_subsample_pattern = 0x00003734,
+			.framedrop_period      = 0x00003738,
+			.framedrop_pattern     = 0x0000373C,
+			.system_cache_cfg      = 0x00003760,
+			.addr_status_0         = 0x00003768,
+			.addr_status_1         = 0x0000376C,
+			.addr_status_2         = 0x00003770,
+			.addr_status_3         = 0x00003774,
+			.debug_status_cfg      = 0x00003778,
+			.debug_status_0        = 0x0000377C,
+			.debug_status_1        = 0x00003780,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AEC BG",
+		},
+		/* BUS Client 6 Stats BAF */
+		{
+			.cfg                   = 0x00003800,
+			.image_addr            = 0x00003804,
+			.frame_incr            = 0x00003808,
+			.image_cfg_0           = 0x0000380C,
+			.image_cfg_1           = 0x00003810,
+			.image_cfg_2           = 0x00003814,
+			.packer_cfg            = 0x00003818,
+			.bw_limit              = 0x0000381C,
+			.frame_header_addr     = 0x00003820,
+			.frame_header_incr     = 0x00003824,
+			.frame_header_cfg      = 0x00003828,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003830,
+			.irq_subsample_pattern = 0x00003834,
+			.framedrop_period      = 0x00003838,
+			.framedrop_pattern     = 0x0000383C,
+			.system_cache_cfg      = 0x00003860,
+			.addr_status_0         = 0x00003868,
+			.addr_status_1         = 0x0000386C,
+			.addr_status_2         = 0x00003870,
+			.addr_status_3         = 0x00003874,
+			.debug_status_cfg      = 0x00003878,
+			.debug_status_0        = 0x0000387C,
+			.debug_status_1        = 0x00003880,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_4,
+			.client_name           = "STATS BAF",
+		},
+		/* BUS Client 7 RDI0 */
+		{
+			.cfg                   = 0x00003900,
+			.image_addr            = 0x00003904,
+			.frame_incr            = 0x00003908,
+			.image_cfg_0           = 0x0000390C,
+			.image_cfg_1           = 0x00003910,
+			.image_cfg_2           = 0x00003914,
+			.packer_cfg            = 0x00003918,
+			.bw_limit              = 0x0000391C,
+			.frame_header_addr     = 0x00003920,
+			.frame_header_incr     = 0x00003924,
+			.frame_header_cfg      = 0x00003928,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003930,
+			.irq_subsample_pattern = 0x00003934,
+			.framedrop_period      = 0x00003938,
+			.framedrop_pattern     = 0x0000393C,
+			.system_cache_cfg      = 0x00003960,
+			.addr_status_0         = 0x00003968,
+			.addr_status_1         = 0x0000396C,
+			.addr_status_2         = 0x00003970,
+			.addr_status_3         = 0x00003974,
+			.debug_status_cfg      = 0x00003978,
+			.debug_status_0        = 0x0000397C,
+			.debug_status_1        = 0x00003980,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_5,
+			.client_name           = "RDI0",
+		},
+		/* BUS Client 8 RDI1 */
+		{
+			.cfg                   = 0x00003A00,
+			.image_addr            = 0x00003A04,
+			.frame_incr            = 0x00003A08,
+			.image_cfg_0           = 0x00003A0C,
+			.image_cfg_1           = 0x00003A10,
+			.image_cfg_2           = 0x00003A14,
+			.packer_cfg            = 0x00003A18,
+			.bw_limit              = 0x00003A1C,
+			.frame_header_addr     = 0x00003A20,
+			.frame_header_incr     = 0x00003A24,
+			.frame_header_cfg      = 0x00003A28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003A30,
+			.irq_subsample_pattern = 0x00003A34,
+			.framedrop_period      = 0x00003A38,
+			.framedrop_pattern     = 0x00003A3C,
+			.system_cache_cfg      = 0x00003A60,
+			.addr_status_0         = 0x00003A68,
+			.addr_status_1         = 0x00003A6C,
+			.addr_status_2         = 0x00003A70,
+			.addr_status_3         = 0x00003A74,
+			.debug_status_cfg      = 0x00003A78,
+			.debug_status_0        = 0x00003A7C,
+			.debug_status_1        = 0x00003A80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_6,
+			.client_name           = "RDI1",
+		},
+		/* BUS Client 9 RDI2 */
+		{
+			.cfg                   = 0x00003B00,
+			.image_addr            = 0x00003B04,
+			.frame_incr            = 0x00003B08,
+			.image_cfg_0           = 0x00003B0C,
+			.image_cfg_1           = 0x00003B10,
+			.image_cfg_2           = 0x00003B14,
+			.packer_cfg            = 0x00003B18,
+			.bw_limit              = 0x00003B1C,
+			.frame_header_addr     = 0x00003B20,
+			.frame_header_incr     = 0x00003B24,
+			.frame_header_cfg      = 0x00003B28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003B30,
+			.irq_subsample_pattern = 0x00003B34,
+			.framedrop_period      = 0x00003B38,
+			.framedrop_pattern     = 0x00003B3C,
+			.system_cache_cfg      = 0x00003B60,
+			.addr_status_0         = 0x00003B68,
+			.addr_status_1         = 0x00003B6C,
+			.addr_status_2         = 0x00003B70,
+			.addr_status_3         = 0x00003B74,
+			.debug_status_cfg      = 0x00003B78,
+			.debug_status_0        = 0x00003B7C,
+			.debug_status_1        = 0x00003B80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_7,
+			.client_name           = "RDI2",
+		},
+		/* BUS Client 10 PDAF */
+		{
+			.cfg                   = 0x00003C00,
+			.image_addr            = 0x00003C04,
+			.frame_incr            = 0x00003C08,
+			.image_cfg_0           = 0x00003C0C,
+			.image_cfg_1           = 0x00003C10,
+			.image_cfg_2           = 0x00003C14,
+			.packer_cfg            = 0x00003C18,
+			.bw_limit              = 0x00003C1C,
+			.frame_header_addr     = 0x00003C20,
+			.frame_header_incr     = 0x00003C24,
+			.frame_header_cfg      = 0x00003C28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003C30,
+			.irq_subsample_pattern = 0x00003C34,
+			.framedrop_period      = 0x00003C38,
+			.framedrop_pattern     = 0x00003C3C,
+			.system_cache_cfg      = 0x00003C60,
+			.addr_status_0         = 0x00003C68,
+			.addr_status_1         = 0x00003C6C,
+			.addr_status_2         = 0x00003C70,
+			.addr_status_3         = 0x00003C74,
+			.debug_status_cfg      = 0x00003C78,
+			.debug_status_0        = 0x00003C7C,
+			.debug_status_1        = 0x00003C80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_8,
+			.client_name           = "PDAF",
+		},
+		/* BUS Client 11 DS4 */
+		{
+			.cfg                   = 0x00003D00,
+			.image_addr            = 0x00003D04,
+			.frame_incr            = 0x00003D08,
+			.image_cfg_0           = 0x00003D0C,
+			.image_cfg_1           = 0x00003D10,
+			.image_cfg_2           = 0x00003D14,
+			.packer_cfg            = 0x00003D18,
+			.bw_limit              = 0x00003D1C,
+			.frame_header_addr     = 0x00003D20,
+			.frame_header_incr     = 0x00003D24,
+			.frame_header_cfg      = 0x00003D28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003D30,
+			.irq_subsample_pattern = 0x00003D34,
+			.framedrop_period      = 0x00003D38,
+			.framedrop_pattern     = 0x00003D3C,
+			.system_cache_cfg      = 0x00003D60,
+			.addr_status_0         = 0x00003D68,
+			.addr_status_1         = 0x00003D6C,
+			.addr_status_2         = 0x00003D70,
+			.addr_status_3         = 0x00003D74,
+			.debug_status_cfg      = 0x00003D78,
+			.debug_status_0        = 0x00003D7C,
+			.debug_status_1        = 0x00003D80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "DS4",
+		},
+		/* BUS Client 12 DS16 */
+		{
+			.cfg                   = 0x00003E00,
+			.image_addr            = 0x00003E04,
+			.frame_incr            = 0x00003E08,
+			.image_cfg_0           = 0x00003E0C,
+			.image_cfg_1           = 0x00003E10,
+			.image_cfg_2           = 0x00003E14,
+			.packer_cfg            = 0x00003E18,
+			.bw_limit              = 0x00003E1C,
+			.frame_header_addr     = 0x00003E20,
+			.frame_header_incr     = 0x00003E24,
+			.frame_header_cfg      = 0x00003E28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003E30,
+			.irq_subsample_pattern = 0x00003E34,
+			.framedrop_period      = 0x00003E38,
+			.framedrop_pattern     = 0x00003E3C,
+			.system_cache_cfg      = 0x00003E60,
+			.addr_status_0         = 0x00003E68,
+			.addr_status_1         = 0x00003E6C,
+			.addr_status_2         = 0x00003E70,
+			.addr_status_3         = 0x00003E74,
+			.debug_status_cfg      = 0x00003E78,
+			.debug_status_0        = 0x00003E7C,
+			.debug_status_1        = 0x00003E80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "DS16",
+		},
+		/* BUS Client 13 AI-Y */
+		{
+			.cfg                   = 0x00003F00,
+			.image_addr            = 0x00003F04,
+			.frame_incr            = 0x00003F08,
+			.image_cfg_0           = 0x00003F0C,
+			.image_cfg_1           = 0x00003F10,
+			.image_cfg_2           = 0x00003F14,
+			.packer_cfg            = 0x00003F18,
+			.bw_limit              = 0x00003F1C,
+			.frame_header_addr     = 0x00003F20,
+			.frame_header_incr     = 0x00003F24,
+			.frame_header_cfg      = 0x00003F28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003F30,
+			.irq_subsample_pattern = 0x00003F34,
+			.framedrop_period      = 0x00003F38,
+			.framedrop_pattern     = 0x00003F3C,
+			.system_cache_cfg      = 0x00003F60,
+			.addr_status_0         = 0x00003F68,
+			.addr_status_1         = 0x00003F6C,
+			.addr_status_2         = 0x00003F70,
+			.addr_status_3         = 0x00003F74,
+			.debug_status_cfg      = 0x00003F78,
+			.debug_status_0        = 0x00003F7C,
+			.debug_status_1        = 0x00003F80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_9,
+			.client_name           = "AI-Y",
+		},
+		/* BUS Client 14 AI-C */
+		{
+			.cfg                   = 0x00004000,
+			.image_addr            = 0x00004004,
+			.frame_incr            = 0x00004008,
+			.image_cfg_0           = 0x0000400C,
+			.image_cfg_1           = 0x00004010,
+			.image_cfg_2           = 0x00004014,
+			.packer_cfg            = 0x00004018,
+			.bw_limit              = 0x0000401C,
+			.frame_header_addr     = 0x00004020,
+			.frame_header_incr     = 0x00004024,
+			.frame_header_cfg      = 0x00004028,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004030,
+			.irq_subsample_pattern = 0x00004034,
+			.framedrop_period      = 0x00004038,
+			.framedrop_pattern     = 0x0000403C,
+			.system_cache_cfg      = 0x00004060,
+			.addr_status_0         = 0x00004068,
+			.addr_status_1         = 0x0000406C,
+			.addr_status_2         = 0x00004070,
+			.addr_status_3         = 0x00004074,
+			.debug_status_cfg      = 0x00004078,
+			.debug_status_0        = 0x0000407C,
+			.debug_status_1        = 0x00004080,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_9,
+			.client_name           = "AI-C",
+		},
+		/* BUS Client 15 Stats RS */
+		{
+			.cfg                   = 0x00004100,
+			.image_addr            = 0x00004104,
+			.frame_incr            = 0x00004108,
+			.image_cfg_0           = 0x0000410C,
+			.image_cfg_1           = 0x00004110,
+			.image_cfg_2           = 0x00004114,
+			.packer_cfg            = 0x00004118,
+			.bw_limit              = 0x0000411C,
+			.frame_header_addr     = 0x00004120,
+			.frame_header_incr     = 0x00004124,
+			.frame_header_cfg      = 0x00004128,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004130,
+			.irq_subsample_pattern = 0x00004134,
+			.framedrop_period      = 0x00004138,
+			.framedrop_pattern     = 0x0000413C,
+			.system_cache_cfg      = 0x00004160,
+			.addr_status_0         = 0x00004168,
+			.addr_status_1         = 0x0000416C,
+			.addr_status_2         = 0x00004170,
+			.addr_status_3         = 0x00004174,
+			.debug_status_cfg      = 0x00004178,
+			.debug_status_0        = 0x0000417C,
+			.debug_status_1        = 0x00004180,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_10,
+			.client_name           = "STATS RS",
+		},
+		/* BUS Client 16 PDAF 0 STAT LCR */
+		{
+			.cfg                   = 0x00004200,
+			.image_addr            = 0x00004204,
+			.frame_incr            = 0x00004208,
+			.image_cfg_0           = 0x0000420C,
+			.image_cfg_1           = 0x00004210,
+			.image_cfg_2           = 0x00004214,
+			.packer_cfg            = 0x00004218,
+			.bw_limit              = 0x0000421C,
+			.frame_header_addr     = 0x00004220,
+			.frame_header_incr     = 0x00004224,
+			.frame_header_cfg      = 0x00004228,
+			.line_done_cfg         = 0x0000422C,
+			.irq_subsample_period  = 0x00004230,
+			.irq_subsample_pattern = 0x00004234,
+			.framedrop_period      = 0x00004238,
+			.framedrop_pattern     = 0x0000423C,
+			.system_cache_cfg      = 0x00004260,
+			.addr_status_0         = 0x00004268,
+			.addr_status_1         = 0x0000426C,
+			.addr_status_2         = 0x00004270,
+			.addr_status_3         = 0x00004274,
+			.debug_status_cfg      = 0x00004278,
+			.debug_status_0        = 0x0000427C,
+			.debug_status_1        = 0x00004280,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_11,
+			.client_name           = "STAT LCR",
+		},
+		/* BUS Client 17 PDAF 1 PD PREPROCESSED*/
+		{
+			.cfg                   = 0x00004300,
+			.image_addr            = 0x00004304,
+			.frame_incr            = 0x00004308,
+			.image_cfg_0           = 0x0000430C,
+			.image_cfg_1           = 0x00004310,
+			.image_cfg_2           = 0x00004314,
+			.packer_cfg            = 0x00004318,
+			.bw_limit              = 0x0000431C,
+			.frame_header_addr     = 0x00004320,
+			.frame_header_incr     = 0x00004324,
+			.frame_header_cfg      = 0x00004328,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004330,
+			.irq_subsample_pattern = 0x00004334,
+			.framedrop_period      = 0x00004338,
+			.framedrop_pattern     = 0x0000433C,
+			.system_cache_cfg      = 0x00004360,
+			.addr_status_0         = 0x00004368,
+			.addr_status_1         = 0x0000436C,
+			.addr_status_2         = 0x00004370,
+			.addr_status_3         = 0x00004374,
+			.debug_status_cfg      = 0x00004378,
+			.debug_status_0        = 0x0000437C,
+			.debug_status_1        = 0x00004380,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_11,
+			.client_name           = "PD PREPROCESSED",
+		},
+		/* BUS Client 18 PDAF 2 PD PARSED*/
+		{
+			.cfg                   = 0x00004400,
+			.image_addr            = 0x00004404,
+			.frame_incr            = 0x00004408,
+			.image_cfg_0           = 0x0000440C,
+			.image_cfg_1           = 0x00004410,
+			.image_cfg_2           = 0x00004414,
+			.packer_cfg            = 0x00004418,
+			.bw_limit              = 0x0000441C,
+			.frame_header_addr     = 0x00004420,
+			.frame_header_incr     = 0x00004424,
+			.frame_header_cfg      = 0x00004428,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004430,
+			.irq_subsample_pattern = 0x00004434,
+			.framedrop_period      = 0x00004438,
+			.framedrop_pattern     = 0x0000443C,
+			.system_cache_cfg      = 0x00004460,
+			.addr_status_0         = 0x00004468,
+			.addr_status_1         = 0x0000446C,
+			.addr_status_2         = 0x00004470,
+			.addr_status_3         = 0x00004474,
+			.debug_status_cfg      = 0x00004478,
+			.debug_status_0        = 0x0000447C,
+			.debug_status_1        = 0x00004480,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_11,
+			.client_name           = "PD PARSED",
+		},
+	},
+	.num_out  = 18,
+	.tfe_out_hw_info = {
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI0,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_5,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_1,
+			.mid[0]           = 16,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI1,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_6,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_2,
+			.mid[0]           = 17,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI2,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_7,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_3,
+			.mid[0]           = 18,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_FULL,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 16,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RAW_DUMP,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_1,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 19,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PDAF,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_8,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 26,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 20,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 18,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_TL_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 17,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 19,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_BF,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_4,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 21,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_RS,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_10,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 27,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_DS4,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 22,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_DS16,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 23,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_AI,
+			.max_width        = 1920,
+			.max_height       = 1920,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_9,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 24,
+			.mid[1]           = 25,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PD_LCR_STATS,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_11,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_4,
+			.mid[0]           = 21,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PD_PREPROCESSED,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_11,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_4,
+			.mid[0]           = 20,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PD_PARSED,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_11,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_4,
+			.mid[0]           = 22,
+			.pid_mask         = 0x70,
+		},
+	},
+	.num_comp_grp             = 12,
+	.max_wm_per_comp_grp      = 3,
+	.comp_done_shift          = 8,
+	.top_bus_wr_irq_shift     = 1,
+	.comp_buf_done_mask = 0xFFF00,
+	.comp_rup_done_mask = 0xF,
+	.bus_irq_error_mask = {
+		0xD0000000,
+		0x00000000,
+	},
+	.support_consumed_addr = true,
+	.pdaf_rdi2_mux_en = false,
+	.rdi_width = 128,
+	.mode_cfg_shift = 16,
+	.height_shift = 16,
+	.max_out_res = CAM_ISP_TFE_OUT_RES_MAX & 0xFF,
+};
+
+struct cam_tfe_hw_info cam_tfe665 = {
+	.top_irq_mask = {
+		0x00001834,
+		0x00001838,
+		0x0000183C,
+	},
+	.top_irq_clear = {
+		0x00001840,
+		0x00001844,
+		0x00001848,
+	},
+	.top_irq_status = {
+		0x0000184C,
+		0x00001850,
+		0x00001854,
+	},
+	.top_irq_cmd                       = 0x00001830,
+	.global_clear_bitmask              = 0x00000001,
+	.bus_irq_mask = {
+		0x00003018,
+		0x0000301C,
+	},
+	.bus_irq_clear = {
+		0x00003020,
+		0x00003024,
+	},
+	.bus_irq_status = {
+		0x00003028,
+		0x0000302C,
+	},
+	.bus_irq_cmd = 0x00003030,
+	.bus_violation_reg = 0x00003064,
+	.bus_overflow_reg = 0x00003068,
+	.bus_image_size_vilation_reg = 0x3070,
+	.bus_overflow_clear_cmd = 0x3060,
+	.debug_status_top = 0x30D8,
+
+	.reset_irq_mask = {
+		0x00000001,
+		0x00000000,
+		0x00000000,
+	},
+	.error_irq_mask = {
+		0x003F1F00,
+		0x00000000,
+		0x000002FF,
+	},
+	.bus_reg_irq_mask = {
+		0x00000002,
+		0x00000000,
+	},
+	.bus_error_irq_mask = {
+		0xC0000000,
+		0x00000000,
+	},
+
+	.num_clc = 39,
+	.clc_hw_status_info            = tfe665_clc_hw_info,
+	.bus_version                   = CAM_TFE_BUS_1_0,
+	.bus_hw_info                   = &tfe665_bus_hw_info,
+
+	.top_version                   = CAM_TFE_TOP_1_0,
+	.top_hw_info                   = &tfe665_top_hw_info,
+};
+
+#endif /* _CAM_TFE665__H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe770.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe770.h
@@ -0,0 +1,1471 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE770_H_
+#define _CAM_TFE770_H_
+#include <media/cam_isp_tfe.h>
+#include "cam_tfe_core.h"
+#include "cam_tfe_bus.h"
+
+
+static struct cam_tfe_top_reg_offset_common  tfe770_top_commong_reg  = {
+	.hw_version                             = 0x00001800,
+	.hw_capability                          = 0x00001804,
+	.lens_feature                           = 0x00001808,
+	.stats_feature                          = 0x0000180C,
+	.zoom_feature                           = 0x00001810,
+	.global_reset_cmd                       = 0x00001814,
+	.core_cgc_ctrl_0                        = 0x00001818,
+	.core_cgc_ctrl_1                        = 0x0000181C,
+	.ahb_cgc_ctrl                           = 0x0000181C,
+	.core_cfg_0                             = 0x00001824,
+	.reg_update_cmd                         = 0x0000182C,
+	.diag_config                            = 0x00001860,
+	.diag_sensor_status_0                   = 0x00001864,
+	.diag_sensor_status_1                   = 0x00001868,
+	.diag_sensor_frame_cnt_status           = 0x0000186C,
+	.violation_status                       = 0x00001870,
+	.stats_throttle_cnt_cfg_0               = 0x00001874,
+	.stats_throttle_cnt_cfg_1               = 0x00001878,
+	.num_debug_reg                          = 12,
+	.debug_reg = {
+		0x000018A0,
+		0x000018A4,
+		0x000018A8,
+		0x000018AC,
+		0x000018B0,
+		0x000018B4,
+		0x000018B8,
+		0x000018BC,
+		0x000018C0,
+		0x000018C4,
+		0x000018C8,
+		0x000018CC,
+	},
+	.debug_cfg                              = 0x000018DC,
+	.num_perf_cfg                           = 2,
+	.perf_cfg = {
+		{
+			.perf_cnt_cfg           = 0x000018E0,
+			.perf_pixel_count       = 0x000018E4,
+			.perf_line_count        = 0x000018E8,
+			.perf_stall_count       = 0x000018EC,
+			.perf_always_count      = 0x000018F0,
+			.perf_count_status      = 0x000018F4,
+		},
+		{
+			.perf_cnt_cfg           = 0x000018F8,
+			.perf_pixel_count       = 0x000018FC,
+			.perf_line_count        = 0x00001900,
+			.perf_stall_count       = 0x00001904,
+			.perf_always_count      = 0x00001908,
+			.perf_count_status      = 0x0000190C,
+		},
+	},
+	.diag_sensor_frame_cnt_status_1         = 0x00001920,
+	.diag_min_hbi_error_shift               = 15,
+	.diag_neq_hbi_shift                     = 14,
+	.diag_sensor_hbi_mask                   = 0x3FFF,
+	.serializer_supported                   = true,
+	.pp_camif_violation_bit                 = BIT(0),
+	.pp_violation_bit                       = BIT(1),
+	.rdi0_camif_violation_bit               = BIT(2),
+	.rdi1_camif_violation_bit               = BIT(3),
+	.rdi2_camif_violation_bit               = BIT(4),
+	.diag_violation_bit                     = BIT(5),
+	.ppp_camif_violation_bit                = BIT(6),
+	.ppp_violation_bit                      = BIT(7),
+	.lcr_pd_timing_protocol_violation_bit   = BIT(8),
+	.dyamanic_switch_violation_bit          = BIT(9),
+	.pp_frame_drop_bit                      = BIT(8),
+	.rdi0_frame_drop_bit                    = BIT(9),
+	.rdi1_frame_drop_bit                    = BIT(10),
+	.rdi2_frame_drop_bit                    = BIT(11),
+	.ppp_frame_drop_bit                     = BIT(12),
+	.pp_overflow_bit                        = BIT(16),
+	.rdi0_overflow_bit                      = BIT(17),
+	.rdi1_overflow_bit                      = BIT(18),
+	.rdi2_overflow_bit                      = BIT(19),
+	.ppp_overflow_bit                       = BIT(20),
+	.out_of_sync_frame_drop_bit             = BIT(21),
+	.mup_shift_val                          = 8,
+	.mup_supported                          = true,
+	.height_shift                           = 16,
+	.epoch_shift_val                        = 16,
+};
+
+static struct cam_tfe_camif_reg  tfe770_camif_reg = {
+	.hw_version                   = 0x00001C00,
+	.hw_status                    = 0x00001C04,
+	.module_cfg                   = 0x00001C60,
+	.pdaf_raw_crop_width_cfg      = 0x00001C68,
+	.pdaf_raw_crop_height_cfg     = 0x00001C6C,
+	.line_skip_pattern            = 0x00001C70,
+	.pixel_skip_pattern           = 0x00001C74,
+	.period_cfg                   = 0x00001C78,
+	.irq_subsample_pattern        = 0x00001C7C,
+	.epoch_irq_cfg                = 0x00001C80,
+	.debug_1                      = 0x00001DF0,
+	.debug_0                      = 0x00001DF4,
+	.test_bus_ctrl                = 0x00001DF8,
+	.spare                        = 0x00001DFC,
+	.reg_update_cmd               = 0x0000182C,
+};
+
+static struct cam_tfe_camif_reg_data tfe770_camif_reg_data = {
+	.extern_reg_update_mask       = 0x00000001,
+	.dual_tfe_pix_en_shift        = 0x00000001,
+	.extern_reg_update_shift      = 0x0,
+	.dual_tfe_sync_sel_shift      = 18,
+	.delay_line_en_shift          = 8,
+	.pixel_pattern_shift          = 24,
+	.pixel_pattern_mask           = 0x7000000,
+	.module_enable_shift          = 0,
+	.pix_out_enable_shift         = 8,
+	.pdaf_output_enable_shift     = 9,
+	.dsp_mode_shift               = 0,
+	.dsp_mode_mask                = 0,
+	.dsp_en_shift                 = 0,
+	.dsp_en_mask                  = 0,
+	.reg_update_cmd_data          = 0x1,
+	.epoch_line_cfg               = 0x00140014,
+	.sof_irq_mask                 = 0x00000001,
+	.epoch0_irq_mask              = 0x00000004,
+	.epoch1_irq_mask              = 0x00000008,
+	.eof_irq_mask                 = 0x00000002,
+	.reg_update_irq_mask          = 0x00000001,
+	.error_irq_mask0              = 0x00210100,
+	.error_irq_mask2              = 0x00000223,
+	.subscribe_irq_mask           = {
+		0x00000000,
+		0x00000007,
+		0x00000000,
+	},
+	.enable_diagnostic_hw         = 0x1,
+	.perf_cnt_start_cmd_shift     = 0,
+	.perf_cnt_continuous_shift    = 2,
+	.perf_client_sel_shift        = 8,
+	.perf_window_start_shift      = 16,
+	.perf_window_end_shift        = 20,
+	.ai_c_srl_en_shift            = 11,
+	.ds16_c_srl_en_shift          = 10,
+	.ds4_c_srl_en_shift           = 9,
+	.shdr_mode_shift              = 21,
+	.extern_mup_shift             = 22,
+};
+
+static struct cam_tfe_rdi_reg  tfe770_rdi0_reg = {
+	.rdi_hw_version              = 0x00001E00,
+	.rdi_hw_status               = 0x00001E04,
+	.rdi_module_config           = 0x00001E60,
+	.rdi_skip_period             = 0x00001E68,
+	.rdi_irq_subsample_pattern   = 0x00001E6C,
+	.rdi_epoch_irq               = 0x00001E70,
+	.rdi_debug_1                 = 0x00001FF0,
+	.rdi_debug_0                 = 0x00001FF4,
+	.rdi_test_bus_ctrl           = 0x00001FF8,
+	.rdi_spare                   = 0x00001FFC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe770_rdi0_reg_data = {
+	.reg_update_cmd_data         = 0x2,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000010,
+	.epoch0_irq_mask             = 0x00000040,
+	.epoch1_irq_mask             = 0x00000080,
+	.eof_irq_mask                = 0x00000020,
+	.error_irq_mask0             = 0x00020200,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000030,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x1,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe770_rdi1_reg = {
+	.rdi_hw_version              = 0x00002000,
+	.rdi_hw_status               = 0x00002004,
+	.rdi_module_config           = 0x00002060,
+	.rdi_skip_period             = 0x00002068,
+	.rdi_irq_subsample_pattern   = 0x0000206C,
+	.rdi_epoch_irq               = 0x00002070,
+	.rdi_debug_1                 = 0x000021F0,
+	.rdi_debug_0                 = 0x000021F4,
+	.rdi_test_bus_ctrl           = 0x000021F8,
+	.rdi_spare                   = 0x000021FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe770_rdi1_reg_data = {
+	.reg_update_cmd_data         = 0x4,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000100,
+	.epoch0_irq_mask             = 0x00000400,
+	.epoch1_irq_mask             = 0x00000800,
+	.eof_irq_mask                = 0x00000200,
+	.error_irq_mask0             = 0x00040400,
+	.error_irq_mask2             = 0x00000008,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000300,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x2,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe770_rdi2_reg = {
+	.rdi_hw_version              = 0x00002200,
+	.rdi_hw_status               = 0x00002204,
+	.rdi_module_config           = 0x00002260,
+	.rdi_skip_period             = 0x00002268,
+	.rdi_irq_subsample_pattern   = 0x0000226C,
+	.rdi_epoch_irq               = 0x00002270,
+	.rdi_debug_1                 = 0x000023F0,
+	.rdi_debug_0                 = 0x000023F4,
+	.rdi_test_bus_ctrl           = 0x000023F8,
+	.rdi_spare                   = 0x000023FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe770_rdi2_reg_data = {
+	.reg_update_cmd_data         = 0x8,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00001000,
+	.epoch0_irq_mask             = 0x00004000,
+	.epoch1_irq_mask             = 0x00008000,
+	.eof_irq_mask                = 0x00002000,
+	.error_irq_mask0             = 0x00080800,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00003000,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x3,
+	.diag_sensor_shift           = 0x1,
+
+};
+
+static struct cam_tfe_ppp_reg  tfe770_ppp_reg = {
+	.ppp_hw_version              = 0x00002400,
+	.ppp_hw_status               = 0x00002404,
+	.ppp_module_config           = 0x00002460,
+	.ppp_skip_period             = 0x00002468,
+	.ppp_irq_subsample_pattern   = 0x0000246C,
+	.ppp_epoch_irq               = 0x00002470,
+	.ppp_debug_1                 = 0x000025F0,
+	.ppp_debug_0                 = 0x000025F4,
+	.ppp_test_bus_ctrl           = 0x000025F8,
+	.ppp_spare                   = 0x000025FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_ppp_reg_data tfe770_ppp_reg_data = {
+	.sof_irq_mask                = 0x00000000,
+	.epoch0_irq_mask             = 0x00000000,
+	.epoch1_irq_mask             = 0x00000000,
+	.eof_irq_mask                = 0x00000000,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000000,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x4,
+	.diag_sensor_shift           = 0x1,
+	.pdaf_path_en_shift          = 24,
+	.lcr_dis_en_shift            = 23,
+};
+
+static struct cam_tfe_clc_hw_status  tfe770_clc_hw_info[CAM_TFE_MAX_CLC] = {
+	{
+		.name = "CLC_CAMIF",
+		.hw_status_reg = 0x1C04,
+	},
+	{
+		.name = "CLC_RDI0_CAMIF",
+		.hw_status_reg = 0x1E04,
+	},
+	{
+		.name = "CLC_RDI1_CAMIF",
+		.hw_status_reg = 0x2004,
+	},
+	{
+		.name = "CLC_RDI2_CAMIF",
+		.hw_status_reg = 0x2204,
+	},
+	{
+		.name = "CLC_PD_CAMIF",
+		.hw_status_reg = 0x2404,
+	},
+	{
+		.name = "CLC_PDAF_LITE",
+		.hw_status_reg = 0x2A04,
+	},
+	{
+		.name = "CLC_CHANNEL_GAIN",
+		.hw_status_reg = 0x6004,
+	},
+	{
+		.name = "CLC_BPC_PDPC",
+		.hw_status_reg = 0x6204,
+	},
+	{
+		.name = "CLC_LCS",
+		.hw_status_reg = 0x6404,
+	},
+	{
+		.name = "CLC_SHARED_LB",
+		.hw_status_reg = 0x6604,
+	},
+	{
+		.name = "CLC_WB_BDS",
+		.hw_status_reg = 0x6804,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_POST_BDS",
+		.hw_status_reg = 0x6A04,
+	},
+	{
+		.name = "CLC_BLS",
+		.hw_status_reg = 0x6C04,
+	},
+	{
+		.name = "CLC_BAYER_GLUT",
+		.hw_status_reg = 0x6E04,
+	},
+	{
+		.name = "CLC_BAYER_DS4",
+		.hw_status_reg = 0x7004,
+	},
+	{
+		.name = "CLC_COLOR_XFORM_DS4",
+		.hw_status_reg = 0x7204,
+	},
+	{
+		.name = "CLC_CHROMA_DS2",
+		.hw_status_reg = 0x7404,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_Y_DS4",
+		.hw_status_reg = 0x7604,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_C_DS4",
+		.hw_status_reg = 0x7804,
+	},
+	{
+		.name = "CLC_R2PD_DS4",
+		.hw_status_reg = 0x7A04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_4TO1_Y",
+		.hw_status_reg = 0x7C04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_4TO1_C",
+		.hw_status_reg = 0x7E04,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_Y_DS16",
+		.hw_status_reg = 0x8004,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_C_DS16",
+		.hw_status_reg = 0x8204,
+	},
+	{
+		.name = "CLC_R2PD_DS16",
+		.hw_status_reg = 0x8404,
+	},
+	{
+		.name = "CLC_WB_GAIN",
+		.hw_status_reg = 0x8604,
+	},
+	{
+		.name = "CLC_BAYER_DS2",
+		.hw_status_reg = 0x8804,
+	},
+	{
+		.name = "CLC_GTM",
+		.hw_status_reg = 0x8A04,
+	},
+	{
+		.name = "CLC_COLOR_XFORM_AI_DS",
+		.hw_status_reg = 0x8C04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_MN_Y",
+		.hw_status_reg = 0x8E04,
+	},
+	{
+		.name = "CLC_DOWNSCALE_MN_C",
+		.hw_status_reg = 0x9004,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_Y_AI_DS",
+		.hw_status_reg = 0x9204,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_C_AI_DS",
+		.hw_status_reg = 0x9404,
+	},
+	{
+		.name = "CLC_CROP_RND_CLAMP_IDEAL_RAW",
+		.hw_status_reg = 0x9604,
+	},
+	{
+		.name = "CLC_ABF",
+		.hw_status_reg = 0x9804,
+	},
+	{
+		.name = "CLC_STATS_BG",
+		.hw_status_reg = 0x9A04,
+	},
+	{
+		.name = "CLC_STATS_BHIST",
+		.hw_status_reg = 0x9C04,
+	},
+	{
+		.name = "CLC_STATS_AWB_BG",
+		.hw_status_reg = 0x9E04,
+	},
+	{
+		.name = "CLC_STATS_AEC_BG",
+		.hw_status_reg = 0xA004,
+	},
+	{
+		.name = "CLC_STATS_BAF",
+		.hw_status_reg = 0xA204,
+	},
+	{
+		.name = "CLC_STATS_RS",
+		.hw_status_reg = 0xA404,
+	},
+};
+
+static struct  cam_tfe_top_hw_info tfe770_top_hw_info = {
+	.common_reg = &tfe770_top_commong_reg,
+	.camif_hw_info = {
+		.camif_reg = &tfe770_camif_reg,
+		.reg_data  = &tfe770_camif_reg_data,
+	},
+	.rdi_hw_info  = {
+		{
+			.rdi_reg  = &tfe770_rdi0_reg,
+			.reg_data = &tfe770_rdi0_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe770_rdi1_reg,
+			.reg_data = &tfe770_rdi1_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe770_rdi2_reg,
+			.reg_data = &tfe770_rdi2_reg_data,
+		},
+	},
+	.ppp_hw_info = {
+		.ppp_reg = &tfe770_ppp_reg,
+		.reg_data  = &tfe770_ppp_reg_data,
+	},
+	.in_port = {
+		CAM_TFE_CAMIF_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_PDLIB_VER_1_0
+	},
+	.reg_dump_data  = {
+		.num_reg_dump_entries    = 19,
+		.num_lut_dump_entries    = 0,
+		.bus_start_addr          = 0x2000,
+		.bus_write_top_end_addr  = 0x2120,
+		.bus_client_start_addr   = 0x2200,
+		.bus_client_offset       = 0x100,
+		.num_bus_clients         = 10,
+		.reg_entry = {
+			{
+				.start_offset = 0x1000,
+				.end_offset   = 0x10F4,
+			},
+			{
+				.start_offset = 0x1260,
+				.end_offset   = 0x1280,
+			},
+			{
+				.start_offset = 0x13F0,
+				.end_offset   = 0x13FC,
+			},
+			{
+				.start_offset = 0x1460,
+				.end_offset   = 0x1470,
+			},
+			{
+				.start_offset = 0x15F0,
+				.end_offset   = 0x15FC,
+			},
+			{
+				.start_offset = 0x1660,
+				.end_offset   = 0x1670,
+			},
+			{
+				.start_offset = 0x17F0,
+				.end_offset   = 0x17FC,
+			},
+			{
+				.start_offset = 0x1860,
+				.end_offset   = 0x1870,
+			},
+			{
+				.start_offset = 0x19F0,
+				.end_offset   = 0x19FC,
+			},
+			{
+				.start_offset = 0x2660,
+				.end_offset   = 0x2694,
+			},
+			{
+				.start_offset = 0x2860,
+				.end_offset   = 0x2884,
+			},
+			{
+				.start_offset = 0x2A60,
+				.end_offset   = 0X2B34,
+			},
+			{
+				.start_offset = 0x2C60,
+				.end_offset   = 0X2C80,
+			},
+			{
+				.start_offset = 0x2E60,
+				.end_offset   = 0X2E7C,
+			},
+			{
+				.start_offset = 0x3060,
+				.end_offset   = 0X3110,
+			},
+			{
+				.start_offset = 0x3260,
+				.end_offset   = 0X3278,
+			},
+			{
+				.start_offset = 0x3460,
+				.end_offset   = 0X3478,
+			},
+			{
+				.start_offset = 0x3660,
+				.end_offset   = 0X3684,
+			},
+			{
+				.start_offset = 0x3860,
+				.end_offset   = 0X3884,
+			},
+		},
+		.lut_entry = {
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x40,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x2800,
+			},
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x41,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x3000,
+			},
+		},
+	},
+	.num_path_port_map = 3,
+	.path_port_map = {
+		{CAM_ISP_HW_TFE_IN_PDLIB, CAM_ISP_TFE_OUT_RES_PD_LCR_STATS},
+		{CAM_ISP_HW_TFE_IN_PDLIB, CAM_ISP_TFE_OUT_RES_PD_PREPROCESSED},
+		{CAM_ISP_HW_TFE_IN_PDLIB, CAM_ISP_TFE_OUT_RES_PD_PARSED},
+	},
+};
+
+static struct cam_tfe_bus_hw_info  tfe770_bus_hw_info = {
+	.common_reg = {
+		.hw_version  = 0x00003000,
+		.cgc_ovd     = 0x00003008,
+		.comp_cfg_0  = 0x0000300C,
+		.comp_cfg_1  = 0x00003010,
+		.frameheader_cfg  = {
+			0x00003034,
+			0x00003038,
+			0x0000303C,
+			0x00003040,
+		},
+		.pwr_iso_cfg = 0x0000305C,
+		.overflow_status_clear = 0x00003060,
+		.ccif_violation_status = 0x00003064,
+		.overflow_status       = 0x00003068,
+		.image_size_violation_status = 0x00003070,
+		.perf_count_cfg = {
+			0x00003074,
+			0x00003078,
+			0x0000307C,
+			0x00003080,
+			0x00003084,
+			0x00003088,
+			0x0000308C,
+			0x00003090,
+		},
+		.perf_count_val = {
+			0x00003094,
+			0x00003098,
+			0x0000309C,
+			0x000030A0,
+			0x000030A4,
+			0x000030A8,
+			0x000030AC,
+			0x000030B0,
+		},
+		.perf_count_status = 0x000030B4,
+		.debug_status_top_cfg = 0x000030D4,
+		.debug_status_top = 0x000030D8,
+		.test_bus_ctrl = 0x000030DC,
+		.irq_mask = {
+			0x00003018,
+			0x0000301C,
+		},
+		.irq_clear = {
+			0x00003020,
+			0x00003024,
+		},
+		.irq_status = {
+			0x00003028,
+			0x0000302C,
+		},
+		.irq_cmd = 0x00003030,
+		.cons_violation_shift = 28,
+		.violation_shift  = 30,
+		.image_size_violation = 31,
+	},
+	.num_client = 19,
+	.bus_client_reg = {
+		/* BUS Client 0 BAYER */
+		{
+			.cfg                   = 0x00003200,
+			.image_addr            = 0x00003204,
+			.frame_incr            = 0x00003208,
+			.image_cfg_0           = 0x0000320C,
+			.image_cfg_1           = 0x00003210,
+			.image_cfg_2           = 0x00003214,
+			.packer_cfg            = 0x00003218,
+			.bw_limit              = 0x0000321C,
+			.frame_header_addr     = 0x00003220,
+			.frame_header_incr     = 0x00003224,
+			.frame_header_cfg      = 0x00003228,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003230,
+			.irq_subsample_pattern = 0x00003234,
+			.framedrop_period      = 0x00003238,
+			.framedrop_pattern     = 0x0000323C,
+			.system_cache_cfg      = 0x00003260,
+			.addr_status_0         = 0x00003268,
+			.addr_status_1         = 0x0000326C,
+			.addr_status_2         = 0x00003270,
+			.addr_status_3         = 0x00003274,
+			.debug_status_cfg      = 0x00003278,
+			.debug_status_0        = 0x0000327C,
+			.debug_status_1        = 0x00003280,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "BAYER",
+		},
+		/* BUS Client 1 IDEAL RAW*/
+		{
+			.cfg                   = 0x00003300,
+			.image_addr            = 0x00003304,
+			.frame_incr            = 0x00003308,
+			.image_cfg_0           = 0x0000330C,
+			.image_cfg_1           = 0x00003310,
+			.image_cfg_2           = 0x00003314,
+			.packer_cfg            = 0x00003318,
+			.bw_limit              = 0x0000331C,
+			.frame_header_addr     = 0x00003320,
+			.frame_header_incr     = 0x00003324,
+			.frame_header_cfg      = 0x00003328,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003330,
+			.irq_subsample_pattern = 0x00003334,
+			.framedrop_period      = 0x00003338,
+			.framedrop_pattern     = 0x0000333C,
+			.system_cache_cfg      = 0x00003360,
+			.addr_status_0         = 0x00003368,
+			.addr_status_1         = 0x0000336C,
+			.addr_status_2         = 0x00003370,
+			.addr_status_3         = 0x00003374,
+			.debug_status_cfg      = 0x00003378,
+			.debug_status_0        = 0x0000337C,
+			.debug_status_1        = 0x00003380,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_1,
+			.client_name           = "IDEAL_RAW",
+		},
+		/* BUS Client 2 Stats BE Tintless */
+		{
+			.cfg                   = 0x00003400,
+			.image_addr            = 0x00003404,
+			.frame_incr            = 0x00003408,
+			.image_cfg_0           = 0x0000340C,
+			.image_cfg_1           = 0x00003410,
+			.image_cfg_2           = 0x00003414,
+			.packer_cfg            = 0x00003418,
+			.bw_limit              = 0x0000341C,
+			.frame_header_addr     = 0x00003420,
+			.frame_header_incr     = 0x00003424,
+			.frame_header_cfg      = 0x00003428,
+			.line_done_cfg         = 0x00003400,
+			.irq_subsample_period  = 0x00003430,
+			.irq_subsample_pattern = 0x00003434,
+			.framedrop_period      = 0x00003438,
+			.framedrop_pattern     = 0x0000343C,
+			.system_cache_cfg      = 0x00003460,
+			.addr_status_0         = 0x00003468,
+			.addr_status_1         = 0x0000346C,
+			.addr_status_2         = 0x00003470,
+			.addr_status_3         = 0x00003474,
+			.debug_status_cfg      = 0x00003478,
+			.debug_status_0        = 0x0000347C,
+			.debug_status_1        = 0x00003480,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BE TINTLESS",
+		},
+		/* BUS Client 3 Stats Bhist */
+		{
+			.cfg                   = 0x00003500,
+			.image_addr            = 0x00003504,
+			.frame_incr            = 0x00003508,
+			.image_cfg_0           = 0x0000350C,
+			.image_cfg_1           = 0x00003510,
+			.image_cfg_2           = 0x00003514,
+			.packer_cfg            = 0x00003518,
+			.bw_limit              = 0x0000351C,
+			.frame_header_addr     = 0x00003520,
+			.frame_header_incr     = 0x00003524,
+			.frame_header_cfg      = 0x00003528,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003530,
+			.irq_subsample_pattern = 0x00003534,
+			.framedrop_period      = 0x00003538,
+			.framedrop_pattern     = 0x0000353C,
+			.system_cache_cfg      = 0x00003560,
+			.addr_status_0         = 0x00003568,
+			.addr_status_1         = 0x0000356C,
+			.addr_status_2         = 0x00003570,
+			.addr_status_3         = 0x00003574,
+			.debug_status_cfg      = 0x00003578,
+			.debug_status_0        = 0x0000357C,
+			.debug_status_1        = 0x00003580,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BHIST",
+		},
+		/* BUS Client 4 Stats AWB BG */
+		{
+			.cfg                   = 0x00003600,
+			.image_addr            = 0x00003604,
+			.frame_incr            = 0x00003608,
+			.image_cfg_0           = 0x0000360C,
+			.image_cfg_1           = 0x00003610,
+			.image_cfg_2           = 0x00003614,
+			.packer_cfg            = 0x00003618,
+			.bw_limit              = 0x0000361C,
+			.frame_header_addr     = 0x00003620,
+			.frame_header_incr     = 0x00003624,
+			.frame_header_cfg      = 0x00003628,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003630,
+			.irq_subsample_pattern = 0x00003634,
+			.framedrop_period      = 0x00003638,
+			.framedrop_pattern     = 0x0000363C,
+			.system_cache_cfg      = 0x00003660,
+			.addr_status_0         = 0x00003668,
+			.addr_status_1         = 0x0000366C,
+			.addr_status_2         = 0x00003670,
+			.addr_status_3         = 0x00003674,
+			.debug_status_cfg      = 0x00003678,
+			.debug_status_0        = 0x0000367C,
+			.debug_status_1        = 0x00003680,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AWB BG",
+		},
+		/* BUS Client 5 Stats AEC BG */
+		{
+			.cfg                   = 0x00003700,
+			.image_addr            = 0x00003704,
+			.frame_incr            = 0x00003708,
+			.image_cfg_0           = 0x0000370C,
+			.image_cfg_1           = 0x00003710,
+			.image_cfg_2           = 0x00003714,
+			.packer_cfg            = 0x00003718,
+			.bw_limit              = 0x0000371C,
+			.frame_header_addr     = 0x00003720,
+			.frame_header_incr     = 0x00003724,
+			.frame_header_cfg      = 0x00003728,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003730,
+			.irq_subsample_pattern = 0x00003734,
+			.framedrop_period      = 0x00003738,
+			.framedrop_pattern     = 0x0000373C,
+			.system_cache_cfg      = 0x00003760,
+			.addr_status_0         = 0x00003768,
+			.addr_status_1         = 0x0000376C,
+			.addr_status_2         = 0x00003770,
+			.addr_status_3         = 0x00003774,
+			.debug_status_cfg      = 0x00003778,
+			.debug_status_0        = 0x0000377C,
+			.debug_status_1        = 0x00003780,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AEC BG",
+		},
+		/* BUS Client 6 Stats BAF */
+		{
+			.cfg                   = 0x00003800,
+			.image_addr            = 0x00003804,
+			.frame_incr            = 0x00003808,
+			.image_cfg_0           = 0x0000380C,
+			.image_cfg_1           = 0x00003810,
+			.image_cfg_2           = 0x00003814,
+			.packer_cfg            = 0x00003818,
+			.bw_limit              = 0x0000381C,
+			.frame_header_addr     = 0x00003820,
+			.frame_header_incr     = 0x00003824,
+			.frame_header_cfg      = 0x00003828,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003830,
+			.irq_subsample_pattern = 0x00003834,
+			.framedrop_period      = 0x00003838,
+			.framedrop_pattern     = 0x0000383C,
+			.system_cache_cfg      = 0x00003860,
+			.addr_status_0         = 0x00003868,
+			.addr_status_1         = 0x0000386C,
+			.addr_status_2         = 0x00003870,
+			.addr_status_3         = 0x00003874,
+			.debug_status_cfg      = 0x00003878,
+			.debug_status_0        = 0x0000387C,
+			.debug_status_1        = 0x00003880,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_4,
+			.client_name           = "STATS BAF",
+		},
+		/* BUS Client 7 RDI0 */
+		{
+			.cfg                   = 0x00003900,
+			.image_addr            = 0x00003904,
+			.frame_incr            = 0x00003908,
+			.image_cfg_0           = 0x0000390C,
+			.image_cfg_1           = 0x00003910,
+			.image_cfg_2           = 0x00003914,
+			.packer_cfg            = 0x00003918,
+			.bw_limit              = 0x0000391C,
+			.frame_header_addr     = 0x00003920,
+			.frame_header_incr     = 0x00003924,
+			.frame_header_cfg      = 0x00003928,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003930,
+			.irq_subsample_pattern = 0x00003934,
+			.framedrop_period      = 0x00003938,
+			.framedrop_pattern     = 0x0000393C,
+			.system_cache_cfg      = 0x00003960,
+			.addr_status_0         = 0x00003968,
+			.addr_status_1         = 0x0000396C,
+			.addr_status_2         = 0x00003970,
+			.addr_status_3         = 0x00003974,
+			.debug_status_cfg      = 0x00003978,
+			.debug_status_0        = 0x0000397C,
+			.debug_status_1        = 0x00003980,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_5,
+			.client_name           = "RDI0",
+		},
+		/* BUS Client 8 RDI1 */
+		{
+			.cfg                   = 0x00003A00,
+			.image_addr            = 0x00003A04,
+			.frame_incr            = 0x00003A08,
+			.image_cfg_0           = 0x00003A0C,
+			.image_cfg_1           = 0x00003A10,
+			.image_cfg_2           = 0x00003A14,
+			.packer_cfg            = 0x00003A18,
+			.bw_limit              = 0x00003A1C,
+			.frame_header_addr     = 0x00003A20,
+			.frame_header_incr     = 0x00003A24,
+			.frame_header_cfg      = 0x00003A28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003A30,
+			.irq_subsample_pattern = 0x00003A34,
+			.framedrop_period      = 0x00003A38,
+			.framedrop_pattern     = 0x00003A3C,
+			.system_cache_cfg      = 0x00003A60,
+			.addr_status_0         = 0x00003A68,
+			.addr_status_1         = 0x00003A6C,
+			.addr_status_2         = 0x00003A70,
+			.addr_status_3         = 0x00003A74,
+			.debug_status_cfg      = 0x00003A78,
+			.debug_status_0        = 0x00003A7C,
+			.debug_status_1        = 0x00003A80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_6,
+			.client_name           = "RDI1",
+		},
+		/* BUS Client 9 RDI2 */
+		{
+			.cfg                   = 0x00003B00,
+			.image_addr            = 0x00003B04,
+			.frame_incr            = 0x00003B08,
+			.image_cfg_0           = 0x00003B0C,
+			.image_cfg_1           = 0x00003B10,
+			.image_cfg_2           = 0x00003B14,
+			.packer_cfg            = 0x00003B18,
+			.bw_limit              = 0x00003B1C,
+			.frame_header_addr     = 0x00003B20,
+			.frame_header_incr     = 0x00003B24,
+			.frame_header_cfg      = 0x00003B28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003B30,
+			.irq_subsample_pattern = 0x00003B34,
+			.framedrop_period      = 0x00003B38,
+			.framedrop_pattern     = 0x00003B3C,
+			.system_cache_cfg      = 0x00003B60,
+			.addr_status_0         = 0x00003B68,
+			.addr_status_1         = 0x00003B6C,
+			.addr_status_2         = 0x00003B70,
+			.addr_status_3         = 0x00003B74,
+			.debug_status_cfg      = 0x00003B78,
+			.debug_status_0        = 0x00003B7C,
+			.debug_status_1        = 0x00003B80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_7,
+			.client_name           = "RDI2",
+		},
+		/* BUS Client 10 PDAF */
+		{
+			.cfg                   = 0x00003C00,
+			.image_addr            = 0x00003C04,
+			.frame_incr            = 0x00003C08,
+			.image_cfg_0           = 0x00003C0C,
+			.image_cfg_1           = 0x00003C10,
+			.image_cfg_2           = 0x00003C14,
+			.packer_cfg            = 0x00003C18,
+			.bw_limit              = 0x00003C1C,
+			.frame_header_addr     = 0x00003C20,
+			.frame_header_incr     = 0x00003C24,
+			.frame_header_cfg      = 0x00003C28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003C30,
+			.irq_subsample_pattern = 0x00003C34,
+			.framedrop_period      = 0x00003C38,
+			.framedrop_pattern     = 0x00003C3C,
+			.system_cache_cfg      = 0x00003C60,
+			.addr_status_0         = 0x00003C68,
+			.addr_status_1         = 0x00003C6C,
+			.addr_status_2         = 0x00003C70,
+			.addr_status_3         = 0x00003C74,
+			.debug_status_cfg      = 0x00003C78,
+			.debug_status_0        = 0x00003C7C,
+			.debug_status_1        = 0x00003C80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_8,
+			.client_name           = "PDAF",
+		},
+		/* BUS Client 11 DS4 */
+		{
+			.cfg                   = 0x00003D00,
+			.image_addr            = 0x00003D04,
+			.frame_incr            = 0x00003D08,
+			.image_cfg_0           = 0x00003D0C,
+			.image_cfg_1           = 0x00003D10,
+			.image_cfg_2           = 0x00003D14,
+			.packer_cfg            = 0x00003D18,
+			.bw_limit              = 0x00003D1C,
+			.frame_header_addr     = 0x00003D20,
+			.frame_header_incr     = 0x00003D24,
+			.frame_header_cfg      = 0x00003D28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003D30,
+			.irq_subsample_pattern = 0x00003D34,
+			.framedrop_period      = 0x00003D38,
+			.framedrop_pattern     = 0x00003D3C,
+			.system_cache_cfg      = 0x00003D60,
+			.addr_status_0         = 0x00003D68,
+			.addr_status_1         = 0x00003D6C,
+			.addr_status_2         = 0x00003D70,
+			.addr_status_3         = 0x00003D74,
+			.debug_status_cfg      = 0x00003D78,
+			.debug_status_0        = 0x00003D7C,
+			.debug_status_1        = 0x00003D80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "DS4",
+		},
+		/* BUS Client 12 DS16 */
+		{
+			.cfg                   = 0x00003E00,
+			.image_addr            = 0x00003E04,
+			.frame_incr            = 0x00003E08,
+			.image_cfg_0           = 0x00003E0C,
+			.image_cfg_1           = 0x00003E10,
+			.image_cfg_2           = 0x00003E14,
+			.packer_cfg            = 0x00003E18,
+			.bw_limit              = 0x00003E1C,
+			.frame_header_addr     = 0x00003E20,
+			.frame_header_incr     = 0x00003E24,
+			.frame_header_cfg      = 0x00003E28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003E30,
+			.irq_subsample_pattern = 0x00003E34,
+			.framedrop_period      = 0x00003E38,
+			.framedrop_pattern     = 0x00003E3C,
+			.system_cache_cfg      = 0x00003E60,
+			.addr_status_0         = 0x00003E68,
+			.addr_status_1         = 0x00003E6C,
+			.addr_status_2         = 0x00003E70,
+			.addr_status_3         = 0x00003E74,
+			.debug_status_cfg      = 0x00003E78,
+			.debug_status_0        = 0x00003E7C,
+			.debug_status_1        = 0x00003E80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "DS16",
+		},
+		/* BUS Client 13 AI-Y */
+		{
+			.cfg                   = 0x00003F00,
+			.image_addr            = 0x00003F04,
+			.frame_incr            = 0x00003F08,
+			.image_cfg_0           = 0x00003F0C,
+			.image_cfg_1           = 0x00003F10,
+			.image_cfg_2           = 0x00003F14,
+			.packer_cfg            = 0x00003F18,
+			.bw_limit              = 0x00003F1C,
+			.frame_header_addr     = 0x00003F20,
+			.frame_header_incr     = 0x00003F24,
+			.frame_header_cfg      = 0x00003F28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003F30,
+			.irq_subsample_pattern = 0x00003F34,
+			.framedrop_period      = 0x00003F38,
+			.framedrop_pattern     = 0x00003F3C,
+			.system_cache_cfg      = 0x00003F60,
+			.addr_status_0         = 0x00003F68,
+			.addr_status_1         = 0x00003F6C,
+			.addr_status_2         = 0x00003F70,
+			.addr_status_3         = 0x00003F74,
+			.debug_status_cfg      = 0x00003F78,
+			.debug_status_0        = 0x00003F7C,
+			.debug_status_1        = 0x00003F80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_9,
+			.client_name           = "AI-Y",
+		},
+		/* BUS Client 14 AI-C */
+		{
+			.cfg                   = 0x00004000,
+			.image_addr            = 0x00004004,
+			.frame_incr            = 0x00004008,
+			.image_cfg_0           = 0x0000400C,
+			.image_cfg_1           = 0x00004010,
+			.image_cfg_2           = 0x00004014,
+			.packer_cfg            = 0x00004018,
+			.bw_limit              = 0x0000401C,
+			.frame_header_addr     = 0x00004020,
+			.frame_header_incr     = 0x00004024,
+			.frame_header_cfg      = 0x00004028,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004030,
+			.irq_subsample_pattern = 0x00004034,
+			.framedrop_period      = 0x00004038,
+			.framedrop_pattern     = 0x0000403C,
+			.system_cache_cfg      = 0x00004060,
+			.addr_status_0         = 0x00004068,
+			.addr_status_1         = 0x0000406C,
+			.addr_status_2         = 0x00004070,
+			.addr_status_3         = 0x00004074,
+			.debug_status_cfg      = 0x00004078,
+			.debug_status_0        = 0x0000407C,
+			.debug_status_1        = 0x00004080,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_9,
+			.client_name           = "AI-C",
+		},
+		/* BUS Client 15 Stats RS */
+		{
+			.cfg                   = 0x00004100,
+			.image_addr            = 0x00004104,
+			.frame_incr            = 0x00004108,
+			.image_cfg_0           = 0x0000410C,
+			.image_cfg_1           = 0x00004110,
+			.image_cfg_2           = 0x00004114,
+			.packer_cfg            = 0x00004118,
+			.bw_limit              = 0x0000411C,
+			.frame_header_addr     = 0x00004120,
+			.frame_header_incr     = 0x00004124,
+			.frame_header_cfg      = 0x00004128,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004130,
+			.irq_subsample_pattern = 0x00004134,
+			.framedrop_period      = 0x00004138,
+			.framedrop_pattern     = 0x0000413C,
+			.system_cache_cfg      = 0x00004160,
+			.addr_status_0         = 0x00004168,
+			.addr_status_1         = 0x0000416C,
+			.addr_status_2         = 0x00004170,
+			.addr_status_3         = 0x00004174,
+			.debug_status_cfg      = 0x00004178,
+			.debug_status_0        = 0x0000417C,
+			.debug_status_1        = 0x00004180,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_10,
+			.client_name           = "STATS RS",
+		},
+		/* BUS Client 16 PDAF 0 STAT LCR */
+		{
+			.cfg                   = 0x00004200,
+			.image_addr            = 0x00004204,
+			.frame_incr            = 0x00004208,
+			.image_cfg_0           = 0x0000420C,
+			.image_cfg_1           = 0x00004210,
+			.image_cfg_2           = 0x00004214,
+			.packer_cfg            = 0x00004218,
+			.bw_limit              = 0x0000421C,
+			.frame_header_addr     = 0x00004220,
+			.frame_header_incr     = 0x00004224,
+			.frame_header_cfg      = 0x00004228,
+			.line_done_cfg         = 0x0000422C,
+			.irq_subsample_period  = 0x00004230,
+			.irq_subsample_pattern = 0x00004234,
+			.framedrop_period      = 0x00004238,
+			.framedrop_pattern     = 0x0000423C,
+			.system_cache_cfg      = 0x00004260,
+			.addr_status_0         = 0x00004268,
+			.addr_status_1         = 0x0000426C,
+			.addr_status_2         = 0x00004270,
+			.addr_status_3         = 0x00004274,
+			.debug_status_cfg      = 0x00004278,
+			.debug_status_0        = 0x0000427C,
+			.debug_status_1        = 0x00004280,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_11,
+			.client_name           = "STAT LCR",
+		},
+		/* BUS Client 17 PDAF 1 PD PREPROCESSED*/
+		{
+			.cfg                   = 0x00004300,
+			.image_addr            = 0x00004304,
+			.frame_incr            = 0x00004308,
+			.image_cfg_0           = 0x0000430C,
+			.image_cfg_1           = 0x00004310,
+			.image_cfg_2           = 0x00004314,
+			.packer_cfg            = 0x00004318,
+			.bw_limit              = 0x0000431C,
+			.frame_header_addr     = 0x00004320,
+			.frame_header_incr     = 0x00004324,
+			.frame_header_cfg      = 0x00004328,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004330,
+			.irq_subsample_pattern = 0x00004334,
+			.framedrop_period      = 0x00004338,
+			.framedrop_pattern     = 0x0000433C,
+			.system_cache_cfg      = 0x00004360,
+			.addr_status_0         = 0x00004368,
+			.addr_status_1         = 0x0000436C,
+			.addr_status_2         = 0x00004370,
+			.addr_status_3         = 0x00004374,
+			.debug_status_cfg      = 0x00004378,
+			.debug_status_0        = 0x0000437C,
+			.debug_status_1        = 0x00004380,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_11,
+			.client_name           = "PD PREPROCESSED",
+		},
+		/* BUS Client 18 PDAF 2 PD PARSED*/
+		{
+			.cfg                   = 0x00004400,
+			.image_addr            = 0x00004404,
+			.frame_incr            = 0x00004408,
+			.image_cfg_0           = 0x0000440C,
+			.image_cfg_1           = 0x00004410,
+			.image_cfg_2           = 0x00004414,
+			.packer_cfg            = 0x00004418,
+			.bw_limit              = 0x0000441C,
+			.frame_header_addr     = 0x00004420,
+			.frame_header_incr     = 0x00004424,
+			.frame_header_cfg      = 0x00004428,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00004430,
+			.irq_subsample_pattern = 0x00004434,
+			.framedrop_period      = 0x00004438,
+			.framedrop_pattern     = 0x0000443C,
+			.system_cache_cfg      = 0x00004460,
+			.addr_status_0         = 0x00004468,
+			.addr_status_1         = 0x0000446C,
+			.addr_status_2         = 0x00004470,
+			.addr_status_3         = 0x00004474,
+			.debug_status_cfg      = 0x00004478,
+			.debug_status_0        = 0x0000447C,
+			.debug_status_1        = 0x00004480,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_11,
+			.client_name           = "PD PARSED",
+		},
+	},
+	.num_out  = 18,
+	.tfe_out_hw_info = {
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI0,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_5,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_1,
+			.mid[0]           = 16,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI1,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_6,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_2,
+			.mid[0]           = 17,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI2,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_7,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_3,
+			.mid[0]           = 18,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_FULL,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 16,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RAW_DUMP,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_1,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 19,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PDAF,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_8,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 26,
+			.pid_mask         = 0x700,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 20,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 18,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_TL_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 17,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 19,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_BF,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_4,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 21,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_RS,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_10,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 27,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_DS4,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 22,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_DS16,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 23,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_AI,
+			.max_width        = 1920,
+			.max_height       = 1920,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_9,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid[0]           = 24,
+			.mid[1]           = 25,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PD_LCR_STATS,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_11,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_4,
+			.mid[0]           = 21,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PD_PREPROCESSED,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_11,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_4,
+			.mid[0]           = 20,
+			.pid_mask         = 0x70,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PD_PARSED,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_11,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_4,
+			.mid[0]           = 22,
+			.pid_mask         = 0x70,
+		},
+	},
+	.num_comp_grp             = 12,
+	.max_wm_per_comp_grp      = 3,
+	.comp_done_shift          = 8,
+	.top_bus_wr_irq_shift     = 1,
+	.comp_buf_done_mask = 0xFFF00,
+	.comp_rup_done_mask = 0xF,
+	.bus_irq_error_mask = {
+		0xD0000000,
+		0x00000000,
+	},
+	.support_consumed_addr = true,
+	.pdaf_rdi2_mux_en = false,
+	.rdi_width = 128,
+	.mode_cfg_shift = 16,
+	.height_shift = 16,
+	.max_out_res = CAM_ISP_TFE_OUT_RES_MAX & 0xFF,
+};
+
+struct cam_tfe_hw_info cam_tfe770 = {
+	.top_irq_mask = {
+		0x00001834,
+		0x00001838,
+		0x0000183C,
+	},
+	.top_irq_clear = {
+		0x00001840,
+		0x00001844,
+		0x00001848,
+	},
+	.top_irq_status = {
+		0x0000184C,
+		0x00001850,
+		0x00001854,
+	},
+	.top_irq_cmd                       = 0x00001830,
+	.global_clear_bitmask              = 0x00000001,
+	.bus_irq_mask = {
+		0x00003018,
+		0x0000301C,
+	},
+	.bus_irq_clear = {
+		0x00003020,
+		0x00003024,
+	},
+	.bus_irq_status = {
+		0x00003028,
+		0x0000302C,
+	},
+	.bus_irq_cmd = 0x00003030,
+	.bus_violation_reg = 0x00003064,
+	.bus_overflow_reg = 0x00003068,
+	.bus_image_size_vilation_reg = 0x3070,
+	.bus_overflow_clear_cmd = 0x3060,
+	.debug_status_top = 0x30D8,
+
+	.reset_irq_mask = {
+		0x00000001,
+		0x00000000,
+		0x00000000,
+	},
+	.error_irq_mask = {
+		0x003F1F00,
+		0x00000000,
+		0x000002FF,
+	},
+	.bus_reg_irq_mask = {
+		0x00000002,
+		0x00000000,
+	},
+	.bus_error_irq_mask = {
+		0xC0000000,
+		0x00000000,
+	},
+
+	.num_clc = 39,
+	.clc_hw_status_info            = tfe770_clc_hw_info,
+	.bus_version                   = CAM_TFE_BUS_1_0,
+	.bus_hw_info                   = &tfe770_bus_hw_info,
+
+	.top_version                   = CAM_TFE_TOP_1_0,
+	.top_hw_info                   = &tfe770_top_hw_info,
+};
+
+#endif /* _CAM_TFE770__H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.c
@@ -0,0 +1,3212 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+#include <media/cam_tfe.h>
+#include <media/cam_isp_tfe.h>
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_tfe_bus.h"
+#include "cam_tfe_irq.h"
+#include "cam_tfe_soc.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_tfe_csid_hw_intf.h"
+
+static const char drv_name[] = "tfe_bus";
+
+#define CAM_TFE_BUS_IRQ_REG0                0
+#define CAM_TFE_BUS_IRQ_REG1                1
+
+#define CAM_TFE_BUS_PAYLOAD_MAX             256
+
+#define CAM_TFE_RDI_BUS_DEFAULT_WIDTH       0xFFFF
+#define CAM_TFE_RDI_BUS_DEFAULT_STRIDE      0xFFFF
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	(sizeof(struct cam_tfe_bus_reg_offset_bus_client) / 4)
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+
+enum cam_tfe_bus_packer_format {
+	PACKER_FMT_PLAIN_128,
+	PACKER_FMT_PLAIN_8,
+	PACKER_FMT_PLAIN_8_ODD_EVEN,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN,
+	PACKER_FMT_PLAIN_16_10BPP,
+	PACKER_FMT_PLAIN_16_12BPP,
+	PACKER_FMT_PLAIN_16_14BPP,
+	PACKER_FMT_PLAIN_16_16BPP,
+	PACKER_FMT_PLAIN_32,
+	PACKER_FMT_PLAIN_64,
+	PACKER_FMT_TP_10,
+	PACKET_FMT_MIPI10,
+	PACKET_FMT_MIPI12,
+	PACKER_FMT_MAX,
+};
+
+struct cam_tfe_bus_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *tfe_core_data;
+	struct cam_tfe_bus_reg_offset_common       *common_reg;
+	uint32_t       io_buf_update[MAX_REG_VAL_PAIR_SIZE];
+
+	spinlock_t                                  spin_lock;
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    comp_done_shift;
+	uint32_t                                    rdi_width;
+	uint32_t                                    mode_cfg_shift;
+	uint32_t                                    height_shift;
+	bool                                        is_lite;
+	bool                                        support_consumed_addr;
+	cam_hw_mgr_event_cb_func                    event_cb;
+	bool                        rup_irq_enable[CAM_TFE_BUS_RUP_GRP_MAX];
+	bool                                        pdaf_rdi2_mux_en;
+	uint32_t                                    max_bw_counter_limit;
+	uint32_t                                    counter_limit_shift;
+	uint32_t                                    counter_limit_mask;
+	uint32_t                                    pack_align_shift;
+};
+
+struct cam_tfe_bus_wm_resource_data {
+	uint32_t             index;
+	uint32_t             out_id;
+	struct cam_tfe_bus_common_data            *common_data;
+	struct cam_tfe_bus_reg_offset_bus_client  *hw_regs;
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	uint32_t             pack_fmt;
+	uint32_t             burst_len;
+	uint32_t             mode;
+
+	uint32_t             irq_subsample_period;
+	uint32_t             irq_subsample_pattern;
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             en_cfg;
+	uint32_t             image_addr_offset;
+	uint32_t             is_dual;
+
+	uint32_t             acquired_width;
+	uint32_t             acquired_height;
+	uint32_t             acquired_stride;
+
+	uint32_t             buffer_offset;
+	bool                 is_buffer_aligned;
+	bool                 limiter_blob_status;
+
+	bool                 is_dim_update;
+};
+
+struct cam_tfe_bus_comp_grp_data {
+	enum cam_tfe_bus_comp_grp_id            comp_grp_id;
+	struct cam_tfe_bus_common_data         *common_data;
+
+	uint32_t                                is_master;
+	uint32_t                                is_dual;
+	uint32_t                                addr_sync_mode;
+	uint32_t                                composite_mask;
+
+	uint32_t                                acquire_dev_cnt;
+	uint32_t                                source_grp;
+	uint32_t                                max_wm_per_comp_grp;
+
+	struct cam_isp_resource_node           **out_rsrc;
+};
+
+struct cam_tfe_bus_tfe_out_data {
+	uint32_t                         out_id;
+	uint32_t                         composite_group;
+	uint32_t                         rup_group_id;
+	uint32_t                         source_group;
+	struct cam_tfe_bus_common_data  *common_data;
+	struct cam_tfe_bus_priv         *bus_priv;
+
+	uint32_t                         num_wm;
+	struct cam_isp_resource_node    *wm_res[PLANE_MAX];
+
+	struct cam_isp_resource_node    *comp_grp;
+	struct list_head                 tfe_out_list;
+
+	uint32_t                         is_master;
+	uint32_t                         is_dual;
+
+	uint32_t                         format;
+	uint32_t                         max_width;
+	uint32_t                         max_height;
+	struct cam_cdm_utils_ops        *cdm_util_ops;
+	uint32_t                         secure_mode;
+	void                            *priv;
+	cam_hw_mgr_event_cb_func         event_cb;
+	uint32_t                         mid[CAM_TFE_BUS_MAX_MID_PER_PORT];
+	uint64_t                         pid_mask;
+};
+
+struct cam_tfe_bus_priv {
+	struct cam_tfe_bus_common_data      common_data;
+	uint32_t                            num_client;
+	uint32_t                            num_out;
+	uint32_t                            num_comp_grp;
+	uint32_t                            max_wm_per_comp_grp;
+	uint32_t                            top_bus_wr_irq_shift;
+
+	struct cam_isp_resource_node  bus_client[CAM_TFE_BUS_MAX_CLIENTS];
+	struct cam_isp_resource_node  comp_grp[CAM_TFE_BUS_COMP_GRP_MAX];
+	struct cam_isp_resource_node  tfe_out[CAM_TFE_BUS_TFE_OUT_MAX];
+
+	struct list_head                    free_comp_grp;
+	struct list_head                    used_comp_grp;
+
+	void                               *tasklet_info;
+	uint32_t                            comp_buf_done_mask;
+	uint32_t                            comp_rup_done_mask;
+	uint32_t           bus_irq_error_mask[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t                            max_out_res;
+};
+
+static bool cam_tfe_bus_can_be_secure(uint32_t out_id)
+{
+	switch (out_id) {
+	case CAM_TFE_BUS_TFE_OUT_FULL:
+	case CAM_TFE_BUS_TFE_OUT_RAW_DUMP:
+	case CAM_TFE_BUS_TFE_OUT_RDI0:
+	case CAM_TFE_BUS_TFE_OUT_RDI1:
+	case CAM_TFE_BUS_TFE_OUT_RDI2:
+	case CAM_TFE_BUS_TFE_OUT_DS4:
+	case CAM_TFE_BUS_TFE_OUT_DS16:
+	case CAM_TFE_BUS_TFE_OUT_AI:
+	case CAM_TFE_BUS_TFE_OUT_PD_LCR_STATS:
+	case CAM_TFE_BUS_TFE_OUT_PD_PREPROCESSED:
+	case CAM_TFE_BUS_TFE_OUT_PD_PARSED:
+		return true;
+
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE:
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST:
+	case CAM_TFE_BUS_TFE_OUT_STATS_TL_BG:
+	case CAM_TFE_BUS_TFE_OUT_STATS_BF:
+	case CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG:
+	case CAM_TFE_BUS_TFE_OUT_STATS_RS:
+	default:
+		return false;
+	}
+}
+
+static enum cam_tfe_bus_tfe_out_id
+	cam_tfe_bus_get_out_res_id(uint32_t out_res_id)
+{
+	switch (out_res_id) {
+	case CAM_ISP_TFE_OUT_RES_FULL:
+		return CAM_TFE_BUS_TFE_OUT_FULL;
+	case CAM_ISP_TFE_OUT_RES_RAW_DUMP:
+		return CAM_TFE_BUS_TFE_OUT_RAW_DUMP;
+	case CAM_ISP_TFE_OUT_RES_PDAF:
+		return CAM_TFE_BUS_TFE_OUT_PDAF;
+	case CAM_ISP_TFE_OUT_RES_RDI_0:
+		return CAM_TFE_BUS_TFE_OUT_RDI0;
+	case CAM_ISP_TFE_OUT_RES_RDI_1:
+		return CAM_TFE_BUS_TFE_OUT_RDI1;
+	case CAM_ISP_TFE_OUT_RES_RDI_2:
+		return CAM_TFE_BUS_TFE_OUT_RDI2;
+	case CAM_ISP_TFE_OUT_RES_STATS_HDR_BE:
+		return CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE;
+	case CAM_ISP_TFE_OUT_RES_STATS_HDR_BHIST:
+		return CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST;
+	case CAM_ISP_TFE_OUT_RES_STATS_TL_BG:
+		return CAM_TFE_BUS_TFE_OUT_STATS_TL_BG;
+	case CAM_ISP_TFE_OUT_RES_STATS_BF:
+		return CAM_TFE_BUS_TFE_OUT_STATS_BF;
+	case CAM_ISP_TFE_OUT_RES_STATS_AWB_BG:
+		return CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG;
+	case CAM_ISP_TFE_OUT_RES_STATS_RS:
+		return CAM_TFE_BUS_TFE_OUT_STATS_RS;
+	case CAM_ISP_TFE_OUT_RES_DS4:
+		return CAM_TFE_BUS_TFE_OUT_DS4;
+	case CAM_ISP_TFE_OUT_RES_DS16:
+		return CAM_TFE_BUS_TFE_OUT_DS16;
+	case CAM_ISP_TFE_OUT_RES_AI:
+		return CAM_TFE_BUS_TFE_OUT_AI;
+	case CAM_ISP_TFE_OUT_RES_PD_LCR_STATS:
+		return CAM_TFE_BUS_TFE_OUT_PD_LCR_STATS;
+	case CAM_ISP_TFE_OUT_RES_PD_PREPROCESSED:
+		return CAM_TFE_BUS_TFE_OUT_PD_PREPROCESSED;
+	case CAM_ISP_TFE_OUT_RES_PD_PARSED:
+		return CAM_TFE_BUS_TFE_OUT_PD_PARSED;
+	default:
+		return CAM_TFE_BUS_TFE_OUT_MAX;
+	}
+}
+
+static int cam_tfe_bus_get_num_wm(
+	enum cam_tfe_bus_tfe_out_id           out_res_id,
+	uint32_t                              format)
+{
+	switch (out_res_id) {
+	case CAM_TFE_BUS_TFE_OUT_RDI0:
+	case CAM_TFE_BUS_TFE_OUT_RDI1:
+	case CAM_TFE_BUS_TFE_OUT_RDI2:
+		switch (format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_MIPI_RAW_14:
+		case CAM_FORMAT_MIPI_RAW_16:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+		case CAM_FORMAT_PLAIN128:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_PDAF:
+		switch (format) {
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+			return 1;
+		default:
+			break;
+		}
+		break;
+
+	case CAM_TFE_BUS_TFE_OUT_FULL:
+		switch (format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RAW_DUMP:
+		switch (format) {
+		case CAM_FORMAT_ARGB_14:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_DS4:
+		switch (format) {
+		case CAM_FORMAT_PD10:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_DS16:
+		switch (format) {
+		case CAM_FORMAT_PD10:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_AI:
+		switch (format) {
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_TP10:
+		case CAM_FORMAT_PLAIN16_10:
+			return 2;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE:
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST:
+	case CAM_TFE_BUS_TFE_OUT_STATS_TL_BG:
+	case CAM_TFE_BUS_TFE_OUT_STATS_BF:
+	case CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG:
+		switch (format) {
+		case CAM_FORMAT_PLAIN64:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_RS:
+		switch (format) {
+		case CAM_FORMAT_PLAIN32:
+		case CAM_FORMAT_PLAIN32_20:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_PD_LCR_STATS:
+	case CAM_TFE_BUS_TFE_OUT_PD_PREPROCESSED:
+	case CAM_TFE_BUS_TFE_OUT_PD_PARSED:
+		switch (format) {
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN64:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	CAM_ERR(CAM_ISP, "Unsupported format %u for resource id %u",
+		format, out_res_id);
+
+	return -EINVAL;
+}
+
+static int cam_tfe_lite_bus_get_wm_idx(
+	enum cam_tfe_bus_tfe_out_id tfe_out_res_id,
+	enum cam_tfe_bus_plane_type plane)
+{
+	int wm_idx = -1;
+
+	switch (tfe_out_res_id) {
+	case CAM_TFE_BUS_TFE_OUT_RDI0:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RDI1:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 1;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RDI2:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 2;
+			break;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	return wm_idx;
+}
+
+static int cam_tfe_bus_get_wm_idx(
+	enum cam_tfe_bus_tfe_out_id tfe_out_res_id,
+	enum cam_tfe_bus_plane_type plane,
+	bool pdaf_rdi2_mux_en)
+{
+	int wm_idx = -1;
+
+	switch (tfe_out_res_id) {
+	case CAM_TFE_BUS_TFE_OUT_RDI0:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 7;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RDI1:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 8;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RDI2:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 9;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_PDAF:
+		switch (plane) {
+		case PLANE_Y:
+			if (pdaf_rdi2_mux_en)
+				wm_idx = 9;
+			else
+				wm_idx = 10;
+			break;
+		default:
+			break;
+		}
+		break;
+
+	case CAM_TFE_BUS_TFE_OUT_FULL:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RAW_DUMP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 1;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 5;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 3;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 4;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_TL_BG:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 2;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_BF:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 6;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_RS:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 15;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_DS4:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 11;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_DS16:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 12;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_AI:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 13;
+			break;
+		case PLANE_C:
+			wm_idx = 14;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_PD_LCR_STATS:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 16;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_PD_PREPROCESSED:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 17;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_PD_PARSED:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 18;
+			break;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	return wm_idx;
+}
+
+static enum cam_tfe_bus_packer_format
+	cam_tfe_bus_get_packer_fmt(uint32_t out_fmt, int wm_index)
+{
+	switch (out_fmt) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_MIPI_RAW_20:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PD8:
+		return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_PLAIN8:
+		return PACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_Y_ONLY:
+		return PACKER_FMT_PLAIN_8_LSB_MSB_10;
+	case CAM_FORMAT_PLAIN16_10:
+		return PACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return PACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return PACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN16_16:
+		return PACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_ARGB:
+		return PACKER_FMT_PLAIN_32;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_PD10:
+		return PACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_TP10:
+		return PACKER_FMT_TP_10;
+	default:
+		return PACKER_FMT_MAX;
+	}
+}
+
+static int cam_tfe_bus_acquire_rdi_wm(
+	struct cam_tfe_bus_wm_resource_data  *rsrc_data)
+{
+	int pack_fmt = 0;
+	int rdi_width = rsrc_data->common_data->rdi_width;
+	int mode_cfg_shift = rsrc_data->common_data->mode_cfg_shift;
+
+	if (rdi_width == 64)
+		pack_fmt = 0xa;
+	else if (rdi_width == 128)
+		pack_fmt = 0x0;
+
+	switch (rsrc_data->format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		rsrc_data->pack_fmt = pack_fmt;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 6, rdi_width) /
+					rdi_width;
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << mode_cfg_shift) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_PLAIN8:
+		rsrc_data->pack_fmt = pack_fmt;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 8, rdi_width) /
+					rdi_width;
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << mode_cfg_shift) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		rsrc_data->pack_fmt = pack_fmt;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 10, rdi_width) /
+					rdi_width;
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << mode_cfg_shift) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		rsrc_data->pack_fmt = pack_fmt;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 12, rdi_width) /
+					rdi_width;
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << mode_cfg_shift) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		rsrc_data->pack_fmt = pack_fmt;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 14, rdi_width) /
+					rdi_width;
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << mode_cfg_shift) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_12:
+	case CAM_FORMAT_PLAIN16_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_PLAIN16_16:
+		rsrc_data->pack_fmt = pack_fmt;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 16, rdi_width) /
+					rdi_width;
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << mode_cfg_shift) | 0x1;
+		}
+		break;
+
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PLAIN64:
+		rsrc_data->pack_fmt = pack_fmt;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 64, rdi_width) /
+					rdi_width;
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << mode_cfg_shift) | 0x1;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported RDI:%d format %d",
+			rsrc_data->index, rsrc_data->format);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_acquire_wm(
+	struct cam_tfe_bus_priv                  *bus_priv,
+	struct cam_isp_tfe_out_port_generic_info *out_port_info,
+	struct cam_isp_resource_node            **wm_res,
+	void                                     *tasklet,
+	enum cam_tfe_bus_tfe_out_id               tfe_out_res_id,
+	enum cam_tfe_bus_plane_type               plane,
+	uint32_t                                 *client_done_mask,
+	uint32_t                                  is_dual,
+	enum cam_tfe_bus_comp_grp_id             *comp_grp_id)
+{
+	struct cam_isp_resource_node         *wm_res_local = NULL;
+	struct cam_tfe_bus_wm_resource_data  *rsrc_data = NULL;
+	uint32_t wm_idx = 0;
+	int rc = 0;
+	*wm_res = NULL;
+	/* No need to allocate for BUS TFE OUT to WM is fixed. */
+	if (bus_priv->common_data.is_lite)
+		wm_idx = cam_tfe_lite_bus_get_wm_idx(tfe_out_res_id, plane);
+	else
+		wm_idx = cam_tfe_bus_get_wm_idx(tfe_out_res_id, plane,
+			bus_priv->common_data.pdaf_rdi2_mux_en);
+	if (wm_idx < 0 || wm_idx >= bus_priv->num_client) {
+		CAM_ERR(CAM_ISP, "Unsupported TFE out %d plane %d wm id %d num client %d",
+			tfe_out_res_id, plane, wm_idx, bus_priv->num_client);
+		return -EINVAL;
+	}
+
+	wm_res_local = &bus_priv->bus_client[wm_idx];
+	if (wm_res_local->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "WM:%d not available state:%d",
+			wm_idx, wm_res_local->res_state);
+		return -EALREADY;
+	}
+	wm_res_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	wm_res_local->tasklet_info = tasklet;
+
+	rsrc_data = wm_res_local->res_priv;
+	rsrc_data->format = out_port_info->format;
+	rsrc_data->pack_fmt = cam_tfe_bus_get_packer_fmt(rsrc_data->format,
+		wm_idx);
+
+	rsrc_data->width = out_port_info->width;
+	rsrc_data->height = out_port_info->height;
+	rsrc_data->stride = out_port_info->stride;
+	rsrc_data->mode = out_port_info->wm_mode;
+	rsrc_data->out_id = tfe_out_res_id;
+
+	/*
+	 * Store the acquire width, height separately. For frame based ports
+	 * width and height modified again
+	 */
+	rsrc_data->acquired_width = out_port_info->width;
+	rsrc_data->acquired_height = out_port_info->height;
+	rsrc_data->acquired_stride = out_port_info->stride;
+
+	rsrc_data->is_dual = is_dual;
+	/* Set WM offset value to default */
+	rsrc_data->offset  = 0;
+
+	if (bus_priv->common_data.is_lite || (((rsrc_data->index >= 7) &&
+		(rsrc_data->index <= 9)) && (tfe_out_res_id != CAM_TFE_BUS_TFE_OUT_PDAF))) {
+		/* WM 7-9 refers to RDI 0/ RDI 1/RDI 2 */
+		rc = cam_tfe_bus_acquire_rdi_wm(rsrc_data);
+		if (rc)
+			return rc;
+
+	} else if (rsrc_data->index == 0 || rsrc_data->index == 1 ||
+		(tfe_out_res_id == CAM_TFE_BUS_TFE_OUT_PDAF) ||
+		(rsrc_data->index  >= 11 && rsrc_data->index <= 14)) {
+	/*  WM 0 FULL_OUT WM 1 IDEAL RAW, CAM_TFE_BUS_TFE_OUT_PDAF for pdaf */
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+			rsrc_data->pack_fmt = 0x1;
+			break;
+		case CAM_FORMAT_MIPI_RAW_10:
+			rsrc_data->pack_fmt = 0xc;
+			break;
+		case CAM_FORMAT_MIPI_RAW_12:
+			rsrc_data->pack_fmt = 0xd;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			rsrc_data->pack_fmt = 0x1;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+			rsrc_data->pack_fmt = 0x5;
+			rsrc_data->pack_fmt |= 0x10;
+
+			/* AI port */
+			if (rsrc_data->index == 13 || rsrc_data->index == 14) {
+				rsrc_data->pack_fmt = 0x5;
+				switch (plane) {
+				case PLANE_C:
+					rsrc_data->height /= 2;
+					break;
+				case PLANE_Y:
+					break;
+				default:
+					CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+					return -EINVAL;
+				}
+			}
+			break;
+		case CAM_FORMAT_PLAIN16_12:
+			rsrc_data->pack_fmt = 0x6;
+			rsrc_data->pack_fmt |= 0x10;
+			break;
+		case CAM_FORMAT_PD10:
+			rsrc_data->pack_fmt = 0x0;
+			rsrc_data->width = DIV_ROUND_UP(rsrc_data->width, 4);
+			rsrc_data->height /= 2;
+			break;
+		case CAM_FORMAT_NV21:
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_Y_ONLY:
+			rsrc_data->pack_fmt = 0x1;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d",
+				rsrc_data->format);
+			return -EINVAL;
+		}
+		rsrc_data->en_cfg = 0x1;
+	} else if ((rsrc_data->index  >= 2 && rsrc_data->index <= 6) ||
+		(rsrc_data->index == 15)) {
+		/* WM 2-6 and 15 are stats */
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << rsrc_data->common_data->mode_cfg_shift) | 0x1;
+
+		/*RS state packet format*/
+		if (rsrc_data->index == 15)
+			rsrc_data->pack_fmt = 0x9;
+	} else if (rsrc_data->index == 16) {
+		/* LCR */
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN64:
+			rsrc_data->width = 0;
+			rsrc_data->height = 0;
+			rsrc_data->stride = 1;
+			rsrc_data->en_cfg = (0x1 << rsrc_data->common_data->mode_cfg_shift) | 0x1;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d out_type:%d index: %d",
+				rsrc_data->format, tfe_out_res_id, rsrc_data->index);
+			return -EINVAL;
+		}
+	} else if (rsrc_data->index == 17) {
+		/* PD_PREPROCESSED */
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_10:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d out_type:%d index: %d",
+				rsrc_data->format, tfe_out_res_id, rsrc_data->index);
+			return -EINVAL;
+		}
+	} else if (rsrc_data->index == 18) {
+		/* PD PARSED */
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_10:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			/* LSB aligned */
+			rsrc_data->pack_fmt |= (1 <<
+				bus_priv->common_data.pack_align_shift);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d out_type:%d index: %d",
+				rsrc_data->format, tfe_out_res_id, rsrc_data->index);
+			return -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid WM:%d requested", rsrc_data->index);
+		return -EINVAL;
+	}
+
+	*wm_res = wm_res_local;
+	*comp_grp_id = rsrc_data->hw_regs->comp_group;
+	*client_done_mask |= (1 << wm_idx);
+
+	CAM_DBG(CAM_ISP,
+		"WM:%d processed width:%d height:%d format:0x%x comp_group:%d packt format:0x%x wm mode:%d",
+		rsrc_data->index, rsrc_data->width, rsrc_data->height,
+		rsrc_data->format, *comp_grp_id, rsrc_data->pack_fmt,
+		rsrc_data->mode);
+	return 0;
+}
+
+static int cam_tfe_bus_release_wm(void   *bus_priv,
+	struct cam_isp_resource_node     *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data   *rsrc_data = wm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->pack_fmt = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->irq_subsample_period = 0;
+	rsrc_data->irq_subsample_pattern = 0;
+	rsrc_data->framedrop_period = 0;
+	rsrc_data->framedrop_pattern = 0;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+	rsrc_data->limiter_blob_status = false;
+	rsrc_data->is_buffer_aligned = false;
+	rsrc_data->buffer_offset = 0;
+
+	wm_res->tasklet_info = NULL;
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_ISP, "TFE:%dRelease WM:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	return 0;
+}
+
+static int cam_tfe_bus_start_wm(struct cam_isp_resource_node *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_tfe_bus_common_data        *common_data =
+		rsrc_data->common_data;
+	int height_shift = rsrc_data->common_data->height_shift;
+
+	/* Skip to overwrite if wm bandwidth limiter blob already sent */
+	if (!rsrc_data->limiter_blob_status)
+		cam_io_w(rsrc_data->common_data->counter_limit_mask,
+			common_data->mem_base + rsrc_data->hw_regs->bw_limit);
+
+	cam_io_w(0xf, common_data->mem_base + rsrc_data->hw_regs->bw_limit);
+	cam_io_w((rsrc_data->height << height_shift) | rsrc_data->width,
+		common_data->mem_base + rsrc_data->hw_regs->image_cfg_0);
+	cam_io_w(rsrc_data->pack_fmt,
+		common_data->mem_base + rsrc_data->hw_regs->packer_cfg);
+
+	/* Configure stride for RDIs on full TFE and TFE lite  */
+	if ((rsrc_data->index > 6) &&
+		((rsrc_data->mode != CAM_ISP_TFE_WM_LINE_BASED_MODE) &&
+		(rsrc_data->out_id != CAM_TFE_BUS_TFE_OUT_PDAF))) {
+		cam_io_w_mb(rsrc_data->stride, (common_data->mem_base +
+			rsrc_data->hw_regs->image_cfg_2));
+		CAM_DBG(CAM_ISP, "WM:%d configure stride reg :0x%x",
+			rsrc_data->index,
+			rsrc_data->stride);
+	}
+
+	CAM_DBG(CAM_ISP, "TFE:%d WM:%d width = %d, height = %d",
+		common_data->core_index, rsrc_data->index,
+		rsrc_data->width, rsrc_data->height);
+	CAM_DBG(CAM_ISP, "WM:%d pk_fmt = %d", rsrc_data->index,
+		rsrc_data->pack_fmt);
+	CAM_DBG(CAM_ISP, "WM:%d stride = %d, burst len = %d",
+		rsrc_data->index, rsrc_data->stride, 0xf);
+	CAM_DBG(CAM_ISP, "TFE:%d Start WM:%d offset 0x%x val 0x%x",
+		common_data->core_index, rsrc_data->index,
+		(uint32_t) rsrc_data->hw_regs->cfg, rsrc_data->en_cfg);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_tfe_bus_stop_wm(struct cam_isp_resource_node *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_tfe_bus_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable WM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+	CAM_DBG(CAM_ISP, "TFE:%d Stop WM:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return 0;
+}
+
+static int cam_tfe_bus_init_wm_resource(uint32_t index,
+	struct cam_tfe_bus_priv    *bus_priv,
+	struct cam_tfe_bus_hw_info *hw_info,
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_tfe_bus_wm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for WM res priv");
+		return -ENOMEM;
+	}
+	wm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &bus_priv->common_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = cam_tfe_bus_start_wm;
+	wm_res->stop = cam_tfe_bus_stop_wm;
+	wm_res->hw_intf = bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_tfe_bus_deinit_wm_resource(
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data *rsrc_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = NULL;
+	wm_res->bottom_half_handler = NULL;
+	wm_res->hw_intf = NULL;
+
+	rsrc_data = wm_res->res_priv;
+	wm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static void cam_tfe_bus_add_wm_to_comp_grp(
+	struct cam_isp_resource_node    *comp_grp,
+	uint32_t                         composite_mask)
+{
+	struct cam_tfe_bus_comp_grp_data  *rsrc_data = comp_grp->res_priv;
+
+	if (rsrc_data)
+		rsrc_data->composite_mask |= composite_mask;
+	else
+		CAM_ERR(CAM_ISP, "Invalid rsrc data");
+}
+
+static bool cam_tfe_bus_match_comp_grp(
+	struct cam_tfe_bus_priv                *bus_priv,
+	struct cam_isp_resource_node          **comp_grp,
+	uint32_t                                comp_grp_id)
+{
+	struct cam_tfe_bus_comp_grp_data       *rsrc_data = NULL;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+
+	list_for_each_entry(comp_grp_local,
+		&bus_priv->used_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_id == comp_grp_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			return true;
+		}
+	}
+
+	list_for_each_entry(comp_grp_local,
+		&bus_priv->free_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_id == comp_grp_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			list_del(&comp_grp_local->list);
+			list_add_tail(&comp_grp_local->list,
+			&bus_priv->used_comp_grp);
+			return false;
+		}
+	}
+
+	*comp_grp = NULL;
+	return false;
+}
+
+static int cam_tfe_bus_acquire_comp_grp(
+	struct cam_tfe_bus_priv                  *bus_priv,
+	struct cam_isp_tfe_out_port_generic_info *out_port_info,
+	void                                     *tasklet,
+	uint32_t                                  is_dual,
+	uint32_t                                  is_master,
+	struct cam_isp_resource_node            **comp_grp,
+	enum cam_tfe_bus_comp_grp_id              comp_grp_id,
+	struct cam_isp_resource_node             *out_rsrc,
+	uint32_t                                  source_group)
+{
+	int rc = 0;
+	struct cam_isp_resource_node      *comp_grp_local = NULL;
+	struct cam_tfe_bus_comp_grp_data  *rsrc_data = NULL;
+	bool previously_acquired  = false;
+
+	if (comp_grp_id >= CAM_TFE_BUS_COMP_GRP_0 &&
+		comp_grp_id < CAM_TFE_BUS_COMP_GRP_MAX) {
+		/* Check if matching comp_grp has already been acquired */
+		previously_acquired = cam_tfe_bus_match_comp_grp(
+			bus_priv, &comp_grp_local, comp_grp_id);
+	}
+
+	if (!comp_grp_local) {
+		CAM_ERR(CAM_ISP, "Invalid comp_grp_id:%d", comp_grp_id);
+		return -ENODEV;
+	}
+
+	rsrc_data = comp_grp_local->res_priv;
+	if (rsrc_data->acquire_dev_cnt >= rsrc_data->max_wm_per_comp_grp) {
+		CAM_ERR(CAM_ISP, "Many acquires comp_grp_id:%d", comp_grp_id);
+		return -ENODEV;
+	}
+
+	if (!previously_acquired) {
+		comp_grp_local->tasklet_info = tasklet;
+		comp_grp_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		rsrc_data->is_master = is_master;
+		rsrc_data->is_dual = is_dual;
+
+		if (is_master)
+			rsrc_data->addr_sync_mode = 0;
+		else
+			rsrc_data->addr_sync_mode = 1;
+	} else {
+		rsrc_data = comp_grp_local->res_priv;
+		/* Do not support runtime change in composite mask */
+		if (comp_grp_local->res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) {
+			CAM_ERR(CAM_ISP, "Invalid State %d Comp Grp %u",
+				comp_grp_local->res_state,
+				rsrc_data->comp_grp_id);
+			return -EBUSY;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "rsrc_data %x acquire_dev_cnt %d", rsrc_data, rsrc_data->acquire_dev_cnt);
+	rsrc_data->source_grp = source_group;
+	rsrc_data->out_rsrc[rsrc_data->acquire_dev_cnt] = out_rsrc;
+	rsrc_data->acquire_dev_cnt++;
+	*comp_grp = comp_grp_local;
+	CAM_DBG(CAM_ISP, "Acquire comp_grp id:%u", rsrc_data->comp_grp_id);
+
+	return rc;
+}
+
+static int cam_tfe_bus_release_comp_grp(
+	struct cam_tfe_bus_priv              *bus_priv,
+	struct cam_isp_resource_node         *comp_grp)
+{
+	struct cam_isp_resource_node      *comp_grp_local = NULL;
+	struct cam_tfe_bus_comp_grp_data  *comp_rsrc_data = NULL;
+	int match_found = 0;
+
+	if (!comp_grp) {
+		CAM_ERR(CAM_ISP, "Invalid Params Comp Grp %pK", comp_grp);
+		return -EINVAL;
+	}
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "Already released Comp Grp");
+		return 0;
+	}
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "Invalid State %d",
+			comp_grp->res_state);
+		return -EBUSY;
+	}
+
+	comp_rsrc_data = comp_grp->res_priv;
+	CAM_DBG(CAM_ISP, "Comp Grp id %u", comp_rsrc_data->comp_grp_id);
+
+	list_for_each_entry(comp_grp_local, &bus_priv->used_comp_grp, list) {
+		if (comp_grp_local == comp_grp) {
+			match_found = 1;
+			break;
+		}
+	}
+
+	if (!match_found) {
+		CAM_ERR(CAM_ISP, "Could not find comp_grp_id:%u",
+			comp_rsrc_data->comp_grp_id);
+		return -ENODEV;
+	}
+
+	comp_rsrc_data->acquire_dev_cnt--;
+	if (comp_rsrc_data->acquire_dev_cnt == 0) {
+		list_del(&comp_grp_local->list);
+
+		comp_rsrc_data->addr_sync_mode = 0;
+		comp_rsrc_data->composite_mask = 0;
+
+		comp_grp_local->tasklet_info = NULL;
+		comp_grp_local->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+		list_add_tail(&comp_grp_local->list, &bus_priv->free_comp_grp);
+		CAM_DBG(CAM_ISP, "Comp Grp id %u released",
+			comp_rsrc_data->comp_grp_id);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_start_comp_grp(
+	struct cam_isp_resource_node *comp_grp)
+{
+	int rc = 0;
+	uint32_t val;
+	struct cam_tfe_bus_comp_grp_data *rsrc_data = NULL;
+	struct cam_tfe_bus_common_data   *common_data = NULL;
+	uint32_t     bus_irq_reg_mask_0  = 0;
+
+	rsrc_data = comp_grp->res_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP, "TFE:%d comp_grp_id:%d streaming state:%d mask:0x%x",
+		common_data->core_index, rsrc_data->comp_grp_id,
+		comp_grp->res_state, rsrc_data->composite_mask);
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		return 0;
+
+	if (rsrc_data->is_dual) {
+		if (rsrc_data->is_master) {
+			val = cam_io_r(common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+			val |= (0x1 << (rsrc_data->comp_grp_id + 16));
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val = cam_io_r(common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+			val |= (0x1 << rsrc_data->comp_grp_id);
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+		} else {
+			val = cam_io_r(common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+			val |= (0x1 << rsrc_data->comp_grp_id);
+			val |= (0x1 << (rsrc_data->comp_grp_id + 16));
+			cam_io_w(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val = cam_io_r(common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+			val |= (0x1 << rsrc_data->comp_grp_id);
+			cam_io_w(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+		}
+	}
+
+	if (rsrc_data->is_dual && !rsrc_data->is_master)
+		goto end;
+
+	/* Update the composite done mask in bus irq mask*/
+	bus_irq_reg_mask_0 = cam_io_r(common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	bus_irq_reg_mask_0 |= (0x1 << (rsrc_data->comp_grp_id +
+		rsrc_data->common_data->comp_done_shift));
+	cam_io_w_mb(bus_irq_reg_mask_0, common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+
+	CAM_DBG(CAM_ISP, "TFE:%d start COMP_GRP:%d bus_irq_mask_0 0x%x",
+		common_data->core_index, rsrc_data->comp_grp_id,
+		bus_irq_reg_mask_0);
+
+end:
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_tfe_bus_stop_comp_grp(
+	struct cam_isp_resource_node          *comp_grp)
+{
+	struct cam_tfe_bus_comp_grp_data *rsrc_data = NULL;
+	struct cam_tfe_bus_common_data *common_data = NULL;
+	uint32_t      bus_irq_reg_mask_0 = 0;
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		return 0;
+
+	rsrc_data = (struct cam_tfe_bus_comp_grp_data *)comp_grp->res_priv;
+	common_data = rsrc_data->common_data;
+
+	/* Update the composite done mask in bus irq mask*/
+	bus_irq_reg_mask_0  = cam_io_r(common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	bus_irq_reg_mask_0 &= ~(0x1 << (rsrc_data->comp_grp_id +
+		rsrc_data->common_data->comp_done_shift));
+	cam_io_w_mb(bus_irq_reg_mask_0, common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return 0;
+}
+
+static int cam_tfe_bus_init_comp_grp(uint32_t index,
+	struct cam_hw_soc_info          *soc_info,
+	struct cam_tfe_bus_priv         *bus_priv,
+	struct cam_tfe_bus_hw_info      *hw_info,
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_tfe_bus_comp_grp_data *rsrc_data = NULL;
+
+	rsrc_data = kzalloc(sizeof(struct cam_tfe_bus_comp_grp_data),
+		GFP_KERNEL);
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	comp_grp->res_priv = rsrc_data;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&comp_grp->list);
+
+	comp_grp->res_id = index;
+	if (bus_priv->common_data.is_lite)
+		rsrc_data->comp_grp_id   = hw_info->bus_client_reg[index].comp_group;
+	else
+		rsrc_data->comp_grp_id   = index;
+	rsrc_data->common_data   = &bus_priv->common_data;
+	rsrc_data->max_wm_per_comp_grp =
+		bus_priv->max_wm_per_comp_grp;
+
+	rsrc_data->out_rsrc = kzalloc(sizeof(struct cam_isp_resource_node *) *
+			rsrc_data->max_wm_per_comp_grp, GFP_KERNEL);
+	if (!rsrc_data->out_rsrc)
+		return -ENOMEM;
+
+	list_add_tail(&comp_grp->list, &bus_priv->free_comp_grp);
+
+	comp_grp->hw_intf = bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_tfe_bus_deinit_comp_grp(
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_tfe_bus_comp_grp_data *rsrc_data =
+		comp_grp->res_priv;
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = NULL;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = NULL;
+
+	list_del_init(&comp_grp->list);
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+	comp_grp->res_priv = NULL;
+
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "comp_grp_priv is NULL");
+		return -ENODEV;
+	}
+	kfree(rsrc_data->out_rsrc);
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_tfe_bus_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update    *secure_mode = cmd_args;
+	struct cam_tfe_bus_tfe_out_data     *rsrc_data;
+	uint32_t                            *mode;
+
+	rsrc_data = (struct cam_tfe_bus_tfe_out_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode = (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_tfe_bus_acquire_tfe_out(void *priv, void *acquire_args,
+	uint32_t args_size)
+{
+	struct cam_tfe_bus_priv                *bus_priv = priv;
+	struct cam_tfe_acquire_args            *acq_args = acquire_args;
+	struct cam_tfe_hw_tfe_out_acquire_args *out_acquire_args;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_tfe_bus_tfe_out_data        *rsrc_data = NULL;
+	enum cam_tfe_bus_tfe_out_id             tfe_out_res_id;
+	enum cam_tfe_bus_comp_grp_id            comp_grp_id;
+	int                                     i, rc = -ENODEV;
+	uint32_t                                secure_caps = 0, mode;
+	uint32_t  format, num_wm, client_done_mask = 0;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_ISP, "Invalid Param");
+		return -EINVAL;
+	}
+
+	out_acquire_args = &acq_args->tfe_out;
+	format = out_acquire_args->out_port_info->format;
+
+	CAM_DBG(CAM_ISP, "resid 0x%x fmt:%d, sec mode:%d wm mode:%d",
+		out_acquire_args->out_port_info->res_id, format,
+		out_acquire_args->out_port_info->secure_mode,
+		out_acquire_args->out_port_info->wm_mode);
+	CAM_DBG(CAM_ISP, "width:%d, height:%d stride:%d",
+		out_acquire_args->out_port_info->width,
+		out_acquire_args->out_port_info->height,
+		out_acquire_args->out_port_info->stride);
+
+	tfe_out_res_id = cam_tfe_bus_get_out_res_id(
+		out_acquire_args->out_port_info->res_id);
+	if (tfe_out_res_id == CAM_TFE_BUS_TFE_OUT_MAX)
+		return -ENODEV;
+
+	num_wm = cam_tfe_bus_get_num_wm(tfe_out_res_id, format);
+	if (num_wm < 1)
+		return -EINVAL;
+
+	rsrc_node = &bus_priv->tfe_out[tfe_out_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "Resource not available: Res_id %d state:%d",
+			tfe_out_res_id, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	rsrc_data = rsrc_node->res_priv;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->event_cb = acq_args->event_cb;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->bus_priv = bus_priv;
+
+	secure_caps = cam_tfe_bus_can_be_secure(rsrc_data->out_id);
+	mode = out_acquire_args->out_port_info->secure_mode;
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (!rsrc_data->common_data->num_sec_out) {
+			rsrc_data->secure_mode = mode;
+			rsrc_data->common_data->secure_mode = mode;
+		} else {
+			if (mode == rsrc_data->common_data->secure_mode) {
+				rsrc_data->secure_mode =
+					rsrc_data->common_data->secure_mode;
+			} else {
+				rc = -EINVAL;
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"Mismatch: Acquire mode[%d], drvr mode[%d]",
+					rsrc_data->common_data->secure_mode,
+					mode);
+				mutex_unlock(
+					&rsrc_data->common_data->bus_mutex);
+				return -EINVAL;
+			}
+		}
+		rsrc_data->common_data->num_sec_out++;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	bus_priv->tasklet_info = acq_args->tasklet;
+	rsrc_data->num_wm = num_wm;
+	rsrc_node->is_rdi_primary_res = 0;
+	rsrc_node->res_id = out_acquire_args->out_port_info->res_id;
+	rsrc_node->cdm_ops = out_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = out_acquire_args->cdm_ops;
+
+	/* Acquire WM and retrieve COMP GRP ID */
+	for (i = 0; i < num_wm; i++) {
+		rc = cam_tfe_bus_acquire_wm(bus_priv,
+			out_acquire_args->out_port_info,
+			&rsrc_data->wm_res[i],
+			acq_args->tasklet,
+			tfe_out_res_id,
+			i, &client_done_mask,
+			out_acquire_args->is_dual,
+			&comp_grp_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"TFE:%d WM acquire failed for Out %d rc=%d",
+				rsrc_data->common_data->core_index,
+				tfe_out_res_id, rc);
+			goto release_wm;
+		}
+	}
+
+	/* Acquire composite group using COMP GRP ID */
+	rc = cam_tfe_bus_acquire_comp_grp(bus_priv,
+		out_acquire_args->out_port_info,
+		acq_args->tasklet,
+		out_acquire_args->is_dual,
+		out_acquire_args->is_master,
+		&rsrc_data->comp_grp,
+		comp_grp_id,
+		rsrc_node,
+		rsrc_data->source_group);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"TFE%d Comp_Grp acquire fail for Out %d rc=%d",
+			rsrc_data->common_data->core_index,
+			tfe_out_res_id, rc);
+		return rc;
+	}
+
+	rsrc_data->is_dual = out_acquire_args->is_dual;
+	rsrc_data->is_master = out_acquire_args->is_master;
+
+	cam_tfe_bus_add_wm_to_comp_grp(rsrc_data->comp_grp,
+		client_done_mask);
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	out_acquire_args->rsrc_node = rsrc_node;
+	out_acquire_args->comp_grp_id = comp_grp_id;
+	return rc;
+
+release_wm:
+	for (i--; i >= 0; i--)
+		cam_tfe_bus_release_wm(bus_priv, rsrc_data->wm_res[i]);
+
+	if (rsrc_data->comp_grp)
+		cam_tfe_bus_release_comp_grp(bus_priv, rsrc_data->comp_grp);
+
+	return rc;
+}
+
+static int cam_tfe_bus_release_tfe_out(void *priv, void *release_args,
+	uint32_t args_size)
+{
+	struct cam_tfe_bus_priv               *bus_priv = priv;
+	struct cam_isp_resource_node          *tfe_out = NULL;
+	struct cam_tfe_bus_tfe_out_data       *rsrc_data = NULL;
+	uint32_t                               secure_caps = 0;
+	uint32_t i;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	tfe_out = (struct cam_isp_resource_node *)release_args;
+	rsrc_data = (struct cam_tfe_bus_tfe_out_data *)tfe_out->res_priv;
+
+	if (tfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid resource state:%d res id:%d",
+			tfe_out->res_state, tfe_out->res_id);
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		cam_tfe_bus_release_wm(bus_priv, rsrc_data->wm_res[i]);
+
+	rsrc_data->num_wm = 0;
+
+	if (rsrc_data->comp_grp)
+		cam_tfe_bus_release_comp_grp(bus_priv, rsrc_data->comp_grp);
+
+	rsrc_data->comp_grp = NULL;
+
+	tfe_out->tasklet_info = NULL;
+	tfe_out->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+
+	secure_caps = cam_tfe_bus_can_be_secure(rsrc_data->out_id);
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (rsrc_data->secure_mode ==
+			rsrc_data->common_data->secure_mode) {
+			rsrc_data->common_data->num_sec_out--;
+			rsrc_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+		} else {
+			/*
+			 * The validity of the mode is properly
+			 * checked while acquiring the output port.
+			 * not expected to reach here, unless there is
+			 * some corruption.
+			 */
+			CAM_ERR(CAM_ISP, "driver[%d],resource[%d] mismatch",
+				rsrc_data->common_data->secure_mode,
+				rsrc_data->secure_mode);
+		}
+
+		if (!rsrc_data->common_data->num_sec_out)
+			rsrc_data->common_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	if (tfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		tfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_tfe_bus_start_tfe_out(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node     *tfe_out = hw_priv;
+	struct cam_tfe_bus_tfe_out_data  *rsrc_data = NULL;
+	struct cam_tfe_bus_common_data   *common_data = NULL;
+	uint32_t bus_irq_reg_mask_0 = 0;
+	uint32_t rup_group_id = 0;
+	int rc = 0, i;
+
+	if (!tfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = tfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+	rup_group_id = rsrc_data->rup_group_id;
+
+	CAM_DBG(CAM_ISP, "TFE:%d Start resource index %d",
+		common_data->core_index, rsrc_data->out_id);
+
+	if (tfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid resource state:%d",
+			common_data->core_index, tfe_out->res_state);
+		return -EACCES;
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_tfe_bus_start_wm(rsrc_data->wm_res[i]);
+
+	rc = cam_tfe_bus_start_comp_grp(rsrc_data->comp_grp);
+
+	if (rsrc_data->is_dual && !rsrc_data->is_master &&
+		!tfe_out->is_rdi_primary_res)
+		goto end;
+
+	if (common_data->rup_irq_enable[rup_group_id])
+		goto end;
+
+	/* Update the composite regupdate mask in bus irq mask*/
+	bus_irq_reg_mask_0 = cam_io_r(common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	bus_irq_reg_mask_0 |= (0x1 << rup_group_id);
+	cam_io_w_mb(bus_irq_reg_mask_0, common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	common_data->rup_irq_enable[rup_group_id] = true;
+
+end:
+	tfe_out->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_tfe_bus_stop_tfe_out(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node      *tfe_out = hw_priv;
+	struct cam_tfe_bus_tfe_out_data   *rsrc_data = NULL;
+	struct cam_tfe_bus_common_data    *common_data = NULL;
+	uint32_t bus_irq_reg_mask_0 = 0,  rup_group = 0;
+	int rc = 0, i;
+
+	if (!tfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = tfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+	rup_group = rsrc_data->rup_group_id;
+
+	if (tfe_out->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		tfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "tfe_out res_state is %d", tfe_out->res_state);
+		return rc;
+	}
+
+	rc = cam_tfe_bus_stop_comp_grp(rsrc_data->comp_grp);
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_tfe_bus_stop_wm(rsrc_data->wm_res[i]);
+
+
+	if (!common_data->rup_irq_enable[rup_group])
+		goto end;
+
+	/* disable composite regupdate mask in bus irq mask register*/
+	bus_irq_reg_mask_0 = cam_io_r(common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	bus_irq_reg_mask_0 &= ~(0x1 << rup_group);
+	cam_io_w_mb(bus_irq_reg_mask_0, common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	common_data->rup_irq_enable[rup_group] = false;
+
+end:
+	tfe_out->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_tfe_bus_init_tfe_out_resource(uint32_t  index,
+	struct cam_tfe_bus_priv                  *bus_priv,
+	struct cam_tfe_bus_hw_info               *hw_info)
+{
+	struct cam_isp_resource_node         *tfe_out = NULL;
+	struct cam_tfe_bus_tfe_out_data *rsrc_data = NULL;
+	int rc = 0;
+	int32_t tfe_out_id = hw_info->tfe_out_hw_info[index].tfe_out_id;
+	int i;
+
+	if (tfe_out_id < 0 ||
+		tfe_out_id >= CAM_TFE_BUS_TFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "Init TFE Out failed, Invalid type=%d",
+			tfe_out_id);
+		return -EINVAL;
+	}
+
+	tfe_out = &bus_priv->tfe_out[tfe_out_id];
+	if (tfe_out->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		tfe_out->res_priv) {
+		CAM_ERR(CAM_ISP, "tfe_out_id %d has already been initialized",
+			tfe_out_id);
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_tfe_bus_tfe_out_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	tfe_out->res_priv = rsrc_data;
+
+	tfe_out->res_type = CAM_ISP_RESOURCE_TFE_OUT;
+	tfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&tfe_out->list);
+
+	rsrc_data->composite_group =
+		hw_info->tfe_out_hw_info[index].composite_group;
+	rsrc_data->rup_group_id    =
+		hw_info->tfe_out_hw_info[index].rup_group_id;
+	rsrc_data->out_id          =
+		hw_info->tfe_out_hw_info[index].tfe_out_id;
+	rsrc_data->common_data     = &bus_priv->common_data;
+	rsrc_data->max_width       =
+		hw_info->tfe_out_hw_info[index].max_width;
+	rsrc_data->max_height      =
+		hw_info->tfe_out_hw_info[index].max_height;
+	rsrc_data->secure_mode  = CAM_SECURE_MODE_NON_SECURE;
+
+	for (i = 0; i < CAM_TFE_BUS_MAX_MID_PER_PORT; i++)
+		rsrc_data->mid[i] = hw_info->tfe_out_hw_info[index].mid[i];
+
+	rsrc_data->pid_mask = hw_info->tfe_out_hw_info[index].pid_mask;
+
+	tfe_out->hw_intf = bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_tfe_bus_deinit_tfe_out_resource(
+	struct cam_isp_resource_node    *tfe_out)
+{
+	struct cam_tfe_bus_tfe_out_data *rsrc_data = tfe_out->res_priv;
+
+	if (tfe_out->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		CAM_DBG(CAM_ISP, "HW%d Res %d already deinitialized");
+		return 0;
+	}
+
+	tfe_out->start = NULL;
+	tfe_out->stop = NULL;
+	tfe_out->top_half_handler = NULL;
+	tfe_out->bottom_half_handler = NULL;
+	tfe_out->hw_intf = NULL;
+
+	tfe_out->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&tfe_out->list);
+	tfe_out->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static const char *cam_tfe_bus_rup_type(
+	uint32_t group_id)
+{
+	switch (group_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		return "CAMIF RUP";
+	case CAM_ISP_HW_TFE_IN_RDI0:
+		return "RDI0 RUP";
+	case CAM_ISP_HW_TFE_IN_RDI1:
+		return "RDI1 RUP";
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		return "RDI2 RUP";
+	case CAM_ISP_HW_TFE_IN_PDLIB:
+		return "PDLIB RUP";
+	default:
+		return "invalid rup group";
+	}
+}
+static int cam_tfe_bus_rup_bottom_half(
+	struct cam_tfe_bus_priv            *bus_priv,
+	struct cam_tfe_irq_evt_payload *evt_payload)
+{
+	struct cam_tfe_bus_tfe_out_data    *out_rsrc_data = NULL;
+	struct cam_isp_hw_event_info        evt_info;
+	uint32_t i, j;
+
+	evt_info.hw_idx = bus_priv->common_data.core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_TFE_OUT;
+
+	for (i = 0; i < CAM_TFE_BUS_RUP_GRP_MAX; i++) {
+		if (!(evt_payload->bus_irq_val[0] &
+			bus_priv->comp_rup_done_mask))
+			break;
+
+		if (evt_payload->bus_irq_val[0] & BIT(i)) {
+			for (j = 0; j < bus_priv->num_out; j++) {
+				out_rsrc_data =
+					(struct cam_tfe_bus_tfe_out_data *)
+					bus_priv->tfe_out[j].res_priv;
+				if (!out_rsrc_data)
+					break;
+
+				if ((out_rsrc_data->rup_group_id == i) &&
+					(bus_priv->tfe_out[j].res_state ==
+					CAM_ISP_RESOURCE_STATE_STREAMING))
+					break;
+			}
+
+			if (j == bus_priv->num_out) {
+				CAM_ERR(CAM_ISP,
+					"TFE:%d out rsc active status[0]:0x%x",
+					bus_priv->common_data.core_index,
+					evt_payload->bus_irq_val[0]);
+				continue;
+			}
+
+			CAM_DBG(CAM_ISP, "TFE:%d Received %s",
+				bus_priv->common_data.core_index,
+				cam_tfe_bus_rup_type(i));
+			evt_info.res_id = i;
+
+			if (!out_rsrc_data) {
+				CAM_ERR(CAM_ISP,
+					"out_rsrc_data null for out_res: %d, RUP_group: %d",
+					j, i);
+				break;
+			}
+			if (out_rsrc_data->event_cb) {
+				out_rsrc_data->event_cb(
+					out_rsrc_data->priv,
+					CAM_ISP_HW_EVENT_REG_UPDATE,
+					(void *)&evt_info);
+				/* reset the rup bit */
+				evt_payload->bus_irq_val[0] &= ~BIT(i);
+			} else
+				CAM_ERR(CAM_ISP,
+					"TFE:%d No event cb id:%lld evt id:%d",
+					bus_priv->common_data.core_index,
+					out_rsrc_data->out_id, evt_info.res_id);
+		}
+	}
+
+	return 0;
+}
+
+static uint32_t cam_tfe_bus_get_last_consumed_addr(
+	struct cam_tfe_bus_priv *bus_priv,
+	uint32_t out_id)
+{
+	uint32_t                             val = 0;
+	struct cam_isp_resource_node        *rsrc_node = NULL;
+	struct cam_tfe_bus_tfe_out_data     *rsrc_data = NULL;
+	struct cam_tfe_bus_wm_resource_data *wm_rsrc_data = NULL;
+	enum cam_tfe_bus_tfe_out_id             tfe_out_res_id;
+
+	tfe_out_res_id = cam_tfe_bus_get_out_res_id(out_id);
+	if (tfe_out_res_id >= CAM_TFE_BUS_TFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "invalid out_id:%u", out_id);
+		return 0;
+	}
+
+	rsrc_node = &bus_priv->tfe_out[tfe_out_res_id];
+	rsrc_data = rsrc_node->res_priv;
+	wm_rsrc_data = rsrc_data->wm_res[PLANE_Y]->res_priv;
+
+	val = cam_io_r_mb(
+		wm_rsrc_data->common_data->mem_base +
+		wm_rsrc_data->hw_regs->addr_status_0);
+
+	CAM_DBG(CAM_ISP, "TFE:%u res_type:0x%x res_id:0x%x last_consumed_addr:0x%x",
+		bus_priv->common_data.core_index, out_id, tfe_out_res_id, val);
+
+	return val;
+}
+
+static int cam_tfe_bus_bufdone_bottom_half(
+	struct cam_tfe_bus_priv            *bus_priv,
+	struct cam_tfe_irq_evt_payload *evt_payload)
+{
+	struct cam_tfe_bus_common_data       *common_data;
+	struct cam_tfe_bus_tfe_out_data      *out_rsrc_data;
+	struct cam_isp_hw_event_info          evt_info;
+	struct cam_isp_resource_node         *out_rsrc = NULL;
+	struct cam_tfe_bus_comp_grp_data     *comp_rsrc_data;
+	struct cam_isp_hw_bufdone_event_info  bufdone_evt_info = {0};
+	uint32_t i;
+	struct cam_tfe_bus_wm_resource_data *wm_rsrc_data = NULL;
+
+	common_data = &bus_priv->common_data;
+
+	for (i = 0; i < bus_priv->num_comp_grp; i++) {
+		if (!(evt_payload->bus_irq_val[0] &
+			bus_priv->comp_buf_done_mask))
+			break;
+
+		comp_rsrc_data = (struct cam_tfe_bus_comp_grp_data  *)
+			bus_priv->comp_grp[i].res_priv;
+
+		CAM_DBG(CAM_ISP, "i: %d irq: 0x%x comm_done: 0x%x com_grp: %d",
+			i, evt_payload->bus_irq_val[0], bus_priv->common_data.comp_done_shift,
+			comp_rsrc_data->comp_grp_id);
+
+		if (evt_payload->bus_irq_val[0] &
+			BIT(comp_rsrc_data->comp_grp_id +
+			bus_priv->common_data.comp_done_shift)) {
+				out_rsrc = comp_rsrc_data->out_rsrc[0];
+				out_rsrc_data = out_rsrc->res_priv;
+				evt_info.res_type = out_rsrc->res_type;
+				evt_info.hw_idx = out_rsrc->hw_intf->hw_idx;
+				evt_info.res_id = out_rsrc->res_id;
+				bufdone_evt_info.res_id = out_rsrc->res_id;
+				bufdone_evt_info.comp_grp_id = comp_rsrc_data->comp_grp_id;
+				wm_rsrc_data = out_rsrc_data->wm_res[PLANE_Y]->res_priv;
+				bufdone_evt_info.last_consumed_addr = cam_io_r_mb(
+					wm_rsrc_data->common_data->mem_base +
+					wm_rsrc_data->hw_regs->addr_status_0);
+				evt_info.event_data = (void *)&bufdone_evt_info;
+
+				if (out_rsrc_data->event_cb)
+					out_rsrc_data->event_cb(out_rsrc_data->priv,
+						CAM_ISP_HW_EVENT_DONE,
+						(void *)&evt_info);
+		}
+	}
+
+	return 0;
+}
+
+static void cam_tfe_bus_error_bottom_half(
+	struct cam_tfe_bus_priv            *bus_priv,
+	struct cam_tfe_irq_evt_payload     *evt_payload)
+{
+	struct cam_tfe_bus_wm_resource_data   *rsrc_data;
+	struct cam_tfe_bus_reg_offset_common  *common_reg;
+	uint32_t i, overflow_status, image_size_violation_status;
+	uint32_t ccif_violation_status;
+
+	common_reg = bus_priv->common_data.common_reg;
+
+	CAM_INFO(CAM_ISP, "BUS IRQ[0]:0x%x BUS IRQ[1]:0x%x",
+		evt_payload->bus_irq_val[0], evt_payload->bus_irq_val[1]);
+
+	overflow_status = cam_io_r_mb(bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->overflow_status);
+
+	image_size_violation_status  = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->image_size_violation_status);
+
+	ccif_violation_status = cam_io_r_mb(bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->ccif_violation_status);
+
+	CAM_INFO(CAM_ISP,
+		"ccif violation status:0x%x image size violation:0x%x overflow status:0x%x",
+		ccif_violation_status,
+		image_size_violation_status,
+		overflow_status);
+
+	/* Check the bus errors */
+	if (evt_payload->bus_irq_val[0] & BIT(common_reg->cons_violation_shift))
+		CAM_INFO(CAM_ISP, "CONS_VIOLATION");
+
+	if (evt_payload->bus_irq_val[0] & BIT(common_reg->violation_shift))
+		CAM_INFO(CAM_ISP, "VIOLATION");
+
+	if (evt_payload->bus_irq_val[0] &
+		BIT(common_reg->image_size_violation)) {
+		CAM_INFO(CAM_ISP, "IMAGE_SIZE_VIOLATION val :0x%x",
+			evt_payload->image_size_violation_status);
+
+		for (i = 0; i < bus_priv->num_client; i++) {
+			if (!(evt_payload->image_size_violation_status >> i))
+				break;
+
+			if (evt_payload->image_size_violation_status & BIT(i)) {
+				rsrc_data = bus_priv->bus_client[i].res_priv;
+				CAM_INFO(CAM_ISP,
+					"WM:%d width 0x%x height:0x%x format:%d stride:0x%x offset:0x%x encfg:0x%x",
+					i,
+					rsrc_data->acquired_width,
+					rsrc_data->acquired_height,
+					rsrc_data->format,
+					rsrc_data->acquired_stride,
+					rsrc_data->offset,
+					rsrc_data->en_cfg);
+
+			CAM_INFO(CAM_ISP,
+				"WM:%d current width 0x%x height:0x%x stride:0x%x",
+				i,
+				rsrc_data->width,
+				rsrc_data->height,
+				rsrc_data->stride);
+
+			}
+		}
+	}
+
+	if (overflow_status) {
+		for (i = 0; i < bus_priv->num_client; i++) {
+
+			if (!(evt_payload->overflow_status >> i))
+				break;
+
+			if (evt_payload->overflow_status & BIT(i)) {
+				rsrc_data = bus_priv->bus_client[i].res_priv;
+				CAM_INFO(CAM_ISP,
+					"WM:%d %s BUS OVERFLOW width0x%x height:0x%x format:%d stride:0x%x offset:0x%x encfg:%x",
+					i,
+					rsrc_data->hw_regs->client_name,
+					rsrc_data->acquired_width,
+					rsrc_data->acquired_height,
+					rsrc_data->format,
+					rsrc_data->acquired_stride,
+					rsrc_data->offset,
+					rsrc_data->en_cfg);
+
+				CAM_INFO(CAM_ISP,
+					"WM:%d current width:0x%x height:0x%x stride:0x%x",
+					i,
+					rsrc_data->width,
+					rsrc_data->height,
+					rsrc_data->stride);
+			}
+		}
+	}
+}
+
+static int cam_tfe_bus_bottom_half(void   *priv,
+	bool rup_process, struct cam_tfe_irq_evt_payload   *evt_payload,
+	bool error_process)
+{
+	struct cam_tfe_bus_priv          *bus_priv;
+	uint32_t val;
+
+	if (!priv || !evt_payload) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid priv param");
+		return -EINVAL;
+	}
+	bus_priv = (struct cam_tfe_bus_priv   *) priv;
+
+	if (error_process) {
+		cam_tfe_bus_error_bottom_half(bus_priv, evt_payload);
+		goto end;
+	}
+
+	/* if bus errors are there, mask all bus errors */
+	if (evt_payload->bus_irq_val[0] & bus_priv->bus_irq_error_mask[0]) {
+		val = cam_io_r(bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->irq_mask[0]);
+		val &= ~bus_priv->bus_irq_error_mask[0];
+		cam_io_w(val, bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->irq_mask[0]);
+
+	}
+
+	if (rup_process) {
+		if (evt_payload->bus_irq_val[0] &
+			bus_priv->comp_rup_done_mask)
+			cam_tfe_bus_rup_bottom_half(bus_priv, evt_payload);
+	} else {
+		if (evt_payload->bus_irq_val[0] &
+			bus_priv->comp_buf_done_mask)
+			cam_tfe_bus_bufdone_bottom_half(bus_priv, evt_payload);
+	}
+
+end:
+	return 0;
+
+}
+
+static int cam_tfe_bus_update_wm_config(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv                    *bus_priv;
+	struct cam_isp_hw_get_cmd_update           *update_wm_cmd;
+	struct cam_tfe_bus_tfe_out_data            *tfe_out_data = NULL;
+	struct cam_tfe_bus_wm_resource_data        *wm_data = NULL;
+	struct cam_isp_tfe_wm_dimension_config     *update_out_cfg;
+	uint32_t  i, rc = 0;
+
+	bus_priv = (struct cam_tfe_bus_priv  *) priv;
+	update_wm_cmd = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	update_out_cfg = (struct cam_isp_tfe_wm_dimension_config *) update_wm_cmd->data;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *) update_wm_cmd->res->res_priv;
+
+	if (!tfe_out_data) {
+		CAM_ERR(CAM_ISP, "Failed! invalid data");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < tfe_out_data->num_wm; i++) {
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		wm_data->is_dim_update = true;
+		wm_data->width = update_out_cfg->width;
+		wm_data->height = update_out_cfg->height;
+		CAM_DBG(CAM_ISP, "WM %d width %lld height %lld", wm_data->index,
+			wm_data->width, wm_data->height);
+	}
+
+	return rc;
+}
+
+static int cam_tfe_bus_diable_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv              *bus_priv;
+	struct cam_isp_hw_get_cmd_update     *update_buf;
+	struct cam_tfe_bus_tfe_out_data      *tfe_out_data = NULL;
+	struct cam_tfe_bus_wm_resource_data  *wm_data = NULL;
+	struct cam_cdm_utils_ops             *cdm_util_ops = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t i, j, size = 0;
+
+	bus_priv = (struct cam_tfe_bus_priv  *) priv;
+	update_buf = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *) update_buf->res->res_priv;
+
+	if (!tfe_out_data || !(tfe_out_data->cdm_util_ops)) {
+		CAM_ERR(CAM_ISP, "Failed! invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = tfe_out_data->cdm_util_ops;
+
+	reg_val_pair = &tfe_out_data->common_data->io_buf_update[0];
+	for (i = 0, j = 0; i < tfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j, wm_data->hw_regs->cfg, 0);
+		CAM_DBG(CAM_ISP, "WM:%d disabled cfg %x", wm_data->index, wm_data->hw_regs->cfg);
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_buf->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				update_buf->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_buf->cmd.cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_buf->cmd.used_bytes = size * 4;
+	} else {
+		update_buf->cmd.used_bytes = 0;
+		CAM_DBG(CAM_ISP, "No reg val pairs. num_wms: %u", tfe_out_data->num_wm);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_update_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv              *bus_priv;
+	struct cam_isp_hw_get_cmd_update     *update_buf;
+	struct cam_buf_io_cfg                *io_cfg;
+	struct cam_tfe_bus_tfe_out_data      *tfe_out_data = NULL;
+	struct cam_tfe_bus_wm_resource_data  *wm_data = NULL;
+	struct cam_cdm_utils_ops             *cdm_util_ops = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t i, j, size = 0;
+	uint32_t frame_inc = 0, val;
+
+	bus_priv = (struct cam_tfe_bus_priv  *) priv;
+	update_buf = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *)
+		update_buf->res->res_priv;
+
+	if (!tfe_out_data || !(tfe_out_data->cdm_util_ops)) {
+		CAM_ERR(CAM_ISP, "Failed! invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = tfe_out_data->cdm_util_ops;
+
+	if (update_buf->wm_update->num_buf != tfe_out_data->num_wm) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->wm_update->num_buf, tfe_out_data->num_wm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &tfe_out_data->common_data->io_buf_update[0];
+	io_cfg = update_buf->wm_update->io_cfg;
+
+	for (i = 0, j = 0; i < tfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		/* update width register */
+		val = ((wm_data->height << wm_data->common_data->height_shift) |
+			(wm_data->width & 0xFFFF));
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_cfg_0, val);
+		CAM_DBG(CAM_ISP, "WM:%d image height and width 0x%x",
+			wm_data->index, reg_val_pair[j-1]);
+
+		val = wm_data->offset;
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_cfg_1, val);
+		CAM_DBG(CAM_ISP, "WM:%d xinit 0x%x",
+			wm_data->index, reg_val_pair[j-1]);
+
+		if ((wm_data->index < 7) || ((wm_data->index >= 7) &&
+			(wm_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE)) ||
+			(wm_data->out_id == CAM_TFE_BUS_TFE_OUT_PDAF) ||
+			(wm_data->index >= 11 && wm_data->index <= 15) ||
+			(wm_data->index >= 17)) {
+
+			CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_2,
+				io_cfg->planes[i].plane_stride);
+			wm_data->stride = io_cfg->planes[i].plane_stride;
+			CAM_DBG(CAM_ISP, "WM %d image stride 0x%x",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		frame_inc = io_cfg->planes[i].plane_stride *
+			io_cfg->planes[i].slice_height;
+
+		if (wm_data->is_buffer_aligned)
+			update_buf->wm_update->image_buf[i] += wm_data->buffer_offset;
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_addr,
+			update_buf->wm_update->image_buf[i]);
+		CAM_DBG(CAM_ISP, "WM %d image address 0x%x",
+			wm_data->index, reg_val_pair[j-1]);
+		update_buf->wm_update->image_buf_offset[i] = 0;
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->frame_incr, frame_inc);
+		CAM_DBG(CAM_ISP, "WM %d frame_inc %d",
+			wm_data->index, reg_val_pair[j-1]);
+
+		/* enable the WM */
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg,
+			wm_data->en_cfg);
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_buf->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				update_buf->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_buf->cmd.cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_buf->cmd.used_bytes = size * 4;
+	} else {
+		update_buf->cmd.used_bytes = 0;
+		CAM_DBG(CAM_ISP,
+			"No reg val pairs. num_wms: %u",
+			tfe_out_data->num_wm);
+	}
+
+	return 0;
+}
+static int cam_tfe_buffer_alignment_update(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv                    *bus_priv;
+	struct cam_isp_hw_get_cmd_update           *alignment_cmd;
+	struct cam_tfe_bus_tfe_out_data            *tfe_out_data = NULL;
+	struct cam_tfe_bus_wm_resource_data        *wm_data = NULL;
+	struct cam_isp_tfe_alignment_offset_config *alignment_port_cfg = NULL;
+	uint32_t  i, rc = 0;
+
+	bus_priv = (struct cam_tfe_bus_priv  *) priv;
+	alignment_cmd = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	alignment_port_cfg = (struct cam_isp_tfe_alignment_offset_config *) alignment_cmd->data;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *) alignment_cmd->res->res_priv;
+
+	if (!tfe_out_data) {
+		CAM_ERR(CAM_ISP, "Failed! invalid data");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < tfe_out_data->num_wm; i++) {
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		wm_data->is_buffer_aligned = true;
+		wm_data->offset = alignment_port_cfg->x_offset;
+		wm_data->buffer_offset = alignment_port_cfg->y_offset;
+		CAM_DBG(CAM_ISP, "wm %d X-Offset %x Y-Offset %x", wm_data->index,
+			wm_data->offset, wm_data->buffer_offset);
+	}
+
+	return rc;
+}
+
+static int cam_tfe_bus_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv                  *bus_priv;
+	struct cam_isp_hw_get_cmd_update         *update_hfr;
+	struct cam_tfe_bus_tfe_out_data          *tfe_out_data = NULL;
+	struct cam_tfe_bus_wm_resource_data      *wm_data = NULL;
+	struct cam_cdm_utils_ops                 *cdm_util_ops = NULL;
+	struct cam_isp_tfe_port_hfr_config       *hfr_cfg = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t  i, j, size = 0;
+
+	bus_priv = (struct cam_tfe_bus_priv  *) priv;
+	update_hfr =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *)
+		update_hfr->res->res_priv;
+
+	if (!tfe_out_data || !(tfe_out_data->cdm_util_ops)) {
+		CAM_ERR(CAM_ISP, "Failed! invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = tfe_out_data->cdm_util_ops;
+	reg_val_pair = &tfe_out_data->common_data->io_buf_update[0];
+	hfr_cfg = (struct cam_isp_tfe_port_hfr_config *)update_hfr->data;
+
+	for (i = 0, j = 0; i < tfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->framedrop_pattern,
+			hfr_cfg->framedrop_pattern);
+		wm_data->framedrop_pattern = hfr_cfg->framedrop_pattern;
+		CAM_DBG(CAM_ISP, "WM:%d framedrop pattern 0x%x",
+			wm_data->index, wm_data->framedrop_pattern);
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->framedrop_period,
+			hfr_cfg->framedrop_period);
+		wm_data->framedrop_period = hfr_cfg->framedrop_period;
+		CAM_DBG(CAM_ISP, "WM:%d framedrop period 0x%x",
+			wm_data->index, wm_data->framedrop_period);
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->irq_subsample_period,
+			hfr_cfg->subsample_period);
+		wm_data->irq_subsample_period = hfr_cfg->subsample_period;
+		CAM_DBG(CAM_ISP, "WM:%d irq subsample period 0x%x",
+			wm_data->index, wm_data->irq_subsample_period);
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->irq_subsample_pattern,
+			hfr_cfg->subsample_pattern);
+		wm_data->irq_subsample_pattern = hfr_cfg->subsample_pattern;
+		CAM_DBG(CAM_ISP, "WM:%d irq subsample pattern 0x%x",
+			wm_data->index, wm_data->irq_subsample_pattern);
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_hfr->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				update_hfr->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_hfr->cmd.cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_hfr->cmd.used_bytes = size * 4;
+	} else {
+		update_hfr->cmd.used_bytes = 0;
+		CAM_DBG(CAM_ISP,
+			"No reg val pairs. num_wms: %u",
+			tfe_out_data->num_wm);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_update_stripe_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv                     *bus_priv;
+	struct cam_tfe_dual_update_args             *stripe_args;
+	struct cam_tfe_bus_tfe_out_data             *tfe_out_data = NULL;
+	struct cam_tfe_bus_wm_resource_data         *wm_data = NULL;
+	struct cam_isp_tfe_dual_stripe_config       *stripe_config;
+	uint32_t i;
+
+	bus_priv = (struct cam_tfe_bus_priv  *) priv;
+	stripe_args = (struct cam_tfe_dual_update_args *)cmd_args;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *)
+		stripe_args->res->res_priv;
+
+	if (!tfe_out_data) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	if (stripe_args->res->res_id < CAM_ISP_TFE_OUT_RES_BASE ||
+		stripe_args->res->res_id >= CAM_ISP_TFE_OUT_RES_MAX)
+		return 0;
+
+	stripe_config = (struct cam_isp_tfe_dual_stripe_config *)
+		stripe_args->stripe_config;
+
+	for (i = 0; i < tfe_out_data->num_wm; i++) {
+		stripe_config = &stripe_args->stripe_config[i];
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		wm_data->width = stripe_config->width;
+		wm_data->offset = stripe_config->offset;
+		CAM_DBG(CAM_ISP, "id:%x WM:%d width:0x%x offset:0x%x",
+			stripe_args->res->res_id, wm_data->index,
+			wm_data->width, wm_data->offset);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_get_res_id_for_mid(
+	struct cam_tfe_bus_priv    *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_tfe_out_data     *tfe_out_data = NULL;
+	struct cam_isp_hw_get_cmd_update   *cmd_update =
+		(struct cam_isp_hw_get_cmd_update   *)cmd_args;
+	struct cam_isp_hw_get_res_for_mid       *get_res = NULL;
+	uint32_t num_mid = 0, port_mid[CAM_TFE_BUS_TFE_OUT_MAX] = {0};
+	int i, j;
+	bool pid_found = false;
+
+	get_res = (struct cam_isp_hw_get_res_for_mid *)cmd_update->data;
+	if (!get_res) {
+		CAM_ERR(CAM_ISP,
+			"invalid get resource for mid paramas");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		tfe_out_data = (struct cam_tfe_bus_tfe_out_data  *)
+			bus_priv->tfe_out[i].res_priv;
+
+		if (!tfe_out_data)
+			continue;
+
+		for (j = 0; j < CAM_TFE_BUS_MAX_MID_PER_PORT; j++) {
+			if (tfe_out_data->mid[j] == get_res->mid)
+				port_mid[num_mid++] = i;
+
+		}
+	}
+
+	for (i = 0; i < num_mid; i++) {
+		tfe_out_data = (struct cam_tfe_bus_tfe_out_data  *)
+			bus_priv->tfe_out[port_mid[i]].res_priv;
+		get_res->out_res_id = bus_priv->tfe_out[port_mid[i]].res_id;
+		if (tfe_out_data->pid_mask & (1 << get_res->pid)) {
+			get_res->out_res_id = bus_priv->tfe_out[port_mid[i]].res_id;
+			pid_found = true;
+			goto end;
+		}
+	}
+
+	if (!num_mid) {
+		CAM_ERR(CAM_ISP,
+			"mid:%d does not match with any out resource",
+			get_res->mid);
+		get_res->out_res_id = 0;
+		return -EINVAL;
+	}
+
+end:
+	CAM_INFO(CAM_ISP, "match mid :%d  out resource:%d found, is pid found %d",
+		get_res->mid, get_res->out_res_id, pid_found);
+	return 0;
+}
+
+static int cam_tfe_bus_update_bw_limiter(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv                  *bus_priv;
+	struct cam_isp_hw_get_cmd_update         *wm_config_update;
+	struct cam_tfe_bus_tfe_out_data          *tfe_out_data = NULL;
+	struct cam_cdm_utils_ops                 *cdm_util_ops;
+	struct cam_tfe_bus_wm_resource_data      *wm_data = NULL;
+	struct cam_isp_tfe_wm_bw_limiter_config  *wm_bw_limit_cfg = NULL;
+	uint32_t                                  counter_limit = 0, reg_val = 0;
+	uint32_t                                 *reg_val_pair, num_regval_pairs = 0;
+	uint32_t                                  i, j, size = 0;
+
+	bus_priv         = (struct cam_tfe_bus_priv  *) priv;
+	wm_config_update = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	wm_bw_limit_cfg  = (struct cam_isp_tfe_wm_bw_limiter_config  *) wm_config_update->data;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *) wm_config_update->res->res_priv;
+	if (!tfe_out_data || !tfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = tfe_out_data->cdm_util_ops;
+	reg_val_pair = &tfe_out_data->common_data->io_buf_update[0];
+	for (i = 0, j = 0; i < tfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - (MAX_BUF_UPDATE_REG_NUM * 2))) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu for WM idx %d",
+				j, MAX_REG_VAL_PAIR_SIZE, i);
+			return -ENOMEM;
+		}
+
+		/* Num WMs needs to match max planes */
+		if (i >= CAM_PACKET_MAX_PLANES) {
+			CAM_WARN(CAM_ISP, "Num of WMs: %d exceeded max planes", i);
+			goto add_reg_pair;
+		}
+
+		wm_data = (struct cam_tfe_bus_wm_resource_data *) tfe_out_data->wm_res[i]->res_priv;
+		if (!wm_data->hw_regs->bw_limit) {
+			CAM_ERR(CAM_ISP,
+				"WM: %d %s has no support for bw limiter",
+				wm_data->index, tfe_out_data->wm_res[i]->res_name);
+			return -EINVAL;
+		}
+
+		counter_limit = wm_bw_limit_cfg->counter_limit[i];
+
+		/* Validate max counter limit */
+		if (counter_limit > wm_data->common_data->max_bw_counter_limit) {
+			CAM_WARN(CAM_ISP, "Invalid counter limit: 0x%x capping to max: 0x%x",
+				wm_bw_limit_cfg->counter_limit[i],
+				wm_data->common_data->max_bw_counter_limit);
+			counter_limit = wm_data->common_data->max_bw_counter_limit;
+		}
+
+		if (wm_bw_limit_cfg->enable_limiter && counter_limit) {
+			reg_val = 1;
+			reg_val |= (counter_limit << wm_data->common_data->counter_limit_shift);
+		} else {
+			reg_val = 0;
+		}
+
+		wm_data->limiter_blob_status = true;
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j, wm_data->hw_regs->bw_limit, reg_val);
+		CAM_DBG(CAM_ISP, "WM: %d for %s bw_limter: 0x%x",
+			wm_data->index, tfe_out_data->wm_res[i]->res_name, reg_val_pair[j-1]);
+	}
+
+add_reg_pair:
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > wm_config_update->cmd.size) {
+			CAM_ERR(CAM_ISP, "Failed! Buf size:%d insufficient, expected size:%d",
+				wm_config_update->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			wm_config_update->cmd.cmd_buf_addr, num_regval_pairs, reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		wm_config_update->cmd.used_bytes = size * 4;
+	} else {
+		CAM_DBG(CAM_ISP, "No reg val pairs. num_wms: %u", tfe_out_data->num_wm);
+		wm_config_update->cmd.used_bytes = 0;
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_dump_bus_info(
+	struct cam_tfe_bus_priv    *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_tfe_out_data     *tfe_out_data = NULL;
+	struct cam_isp_hw_get_cmd_update   *cmd_update =
+		(struct cam_isp_hw_get_cmd_update   *)cmd_args;
+	struct cam_tfe_bus_wm_resource_data   *wm_data;
+	struct cam_tfe_bus_common_data        *common_data;
+	uint32_t i, addr_status0, addr_status1, addr_status2, addr_status3;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data  *)
+		cmd_update->res->res_priv;
+	common_data = tfe_out_data->common_data;
+
+	for (i = 0; i < tfe_out_data->num_wm; i++) {
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		addr_status0 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_0);
+		addr_status1 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_1);
+		addr_status2 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_2);
+		addr_status3 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_3);
+		CAM_INFO(CAM_ISP,
+			"TFE:%d WM:%d %s last consumed addr:0x%x last frame addr:0x%x fifo cnt:0x%x cur clt addr:0x%x",
+			common_data->hw_intf->hw_idx,
+			wm_data->index,
+			wm_data->hw_regs->client_name,
+			addr_status0,
+			addr_status1,
+			addr_status2,
+			addr_status3);
+
+		CAM_INFO(CAM_ISP,
+			"WM:%d %s width0x%x height:0x%x format:%d stride:0x%x offset:0x%x encfg:%x",
+			wm_data->index,
+			wm_data->hw_regs->client_name,
+			wm_data->acquired_width,
+			wm_data->acquired_height,
+			wm_data->format,
+			wm_data->acquired_stride,
+			wm_data->offset,
+			wm_data->en_cfg);
+
+		CAM_INFO(CAM_ISP,
+			"WM:%d current width:0x%x height:0x%x stride:0x%x",
+			wm_data->index,
+			wm_data->width,
+			wm_data->height,
+			wm_data->stride);
+	}
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		wm_data = bus_priv->bus_client[i].res_priv;
+		/* disable WM */
+			cam_io_w_mb(0, common_data->mem_base +
+				wm_data->hw_regs->cfg);
+
+	}
+	return 0;
+}
+
+static int cam_tfe_bus_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv    *bus_priv = hw_priv;
+	uint32_t                   i, top_irq_reg_mask[3] = {0};
+	int rc = -EINVAL;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	top_irq_reg_mask[0] = (1 << bus_priv->top_bus_wr_irq_shift);
+
+	rc  = cam_tfe_irq_config(bus_priv->common_data.tfe_core_data,
+		top_irq_reg_mask, CAM_TFE_TOP_IRQ_REG_NUM, true);
+	if (rc)
+		return rc;
+
+	/* configure the error irq */
+	for (i = 0; i < CAM_TFE_BUS_IRQ_REGISTERS_MAX; i++)
+		cam_io_w(bus_priv->bus_irq_error_mask[i],
+			bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->irq_mask[i]);
+
+	return 0;
+}
+
+static int cam_tfe_bus_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv    *bus_priv = hw_priv;
+	uint32_t                    top_irq_reg_mask[3] = {0};
+	int                              rc = 0;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Error: Invalid args");
+		return -EINVAL;
+	}
+	top_irq_reg_mask[0] = (1 << bus_priv->top_bus_wr_irq_shift);
+	rc  = cam_tfe_irq_config(bus_priv->common_data.tfe_core_data,
+		top_irq_reg_mask, CAM_TFE_TOP_IRQ_REG_NUM, false);
+	if (rc)
+		return rc;
+
+	/* configure the error irq */
+	cam_io_w(0, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->irq_mask[0]);
+
+	cam_io_w_mb(0, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->irq_mask[1]);
+
+	return rc;
+}
+
+static int cam_tfe_bus_check_overflow(
+	struct cam_tfe_bus_priv    *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_wm_resource_data  *rsrc_data;
+	struct cam_isp_hw_overflow_info      *overflow_info = NULL;
+	uint32_t                             bus_overflow_status = 0, i = 0, tmp = 0;
+
+	overflow_info = (struct cam_isp_hw_overflow_info *)cmd_args;
+
+	bus_overflow_status  = cam_io_r(bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->overflow_status);
+
+	if (bus_overflow_status) {
+		overflow_info->is_bus_overflow = true;
+		CAM_INFO(CAM_ISP, "TFE[%d] Bus overflow status: 0x%x",
+				bus_priv->common_data.core_index, bus_overflow_status);
+	}
+
+	tmp = bus_overflow_status;
+	while (tmp) {
+		if (tmp & 0x1) {
+			rsrc_data = bus_priv->bus_client[i].res_priv;
+			CAM_ERR(CAM_ISP, "TFE[%d] WM : %d %s overflow",
+				bus_priv->common_data.core_index, i,
+				rsrc_data->hw_regs->client_name);
+		}
+		tmp = tmp >> 1;
+		i++;
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_process_cmd(void *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv      *bus_priv;
+	int rc = 0;
+	uint32_t i, val;
+	bool *pdaf_rdi2_mux_en;
+	struct cam_isp_hw_done_event_data *done;
+	struct cam_isp_hw_cap *tfe_bus_cap;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+		rc = cam_tfe_bus_update_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+		rc = cam_tfe_bus_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_WM_SECURE_MODE:
+		rc = cam_tfe_bus_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+		rc = cam_tfe_bus_update_stripe_cfg(priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+		bus_priv = (struct cam_tfe_bus_priv  *) priv;
+		/* disable the bus error interrupts */
+		for (i = 0; i < CAM_TFE_BUS_IRQ_REGISTERS_MAX; i++) {
+			val = cam_io_r(bus_priv->common_data.mem_base +
+				bus_priv->common_data.common_reg->irq_mask[i]);
+			val &= ~bus_priv->bus_irq_error_mask[i];
+			cam_io_w(val, bus_priv->common_data.mem_base +
+				bus_priv->common_data.common_reg->irq_mask[i]);
+		}
+		break;
+	case CAM_ISP_HW_CMD_QUERY_CAP:
+		bus_priv = (struct cam_tfe_bus_priv  *) priv;
+		tfe_bus_cap = (struct cam_isp_hw_cap *) cmd_args;
+		tfe_bus_cap->max_out_res_type = bus_priv->max_out_res;
+		tfe_bus_cap->support_consumed_addr =
+			bus_priv->common_data.support_consumed_addr;
+		break;
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+		rc = cam_tfe_bus_get_res_id_for_mid(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO:
+		rc = cam_tfe_bus_dump_bus_info(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_IS_PDAF_RDI2_MUX_EN:
+		bus_priv = (struct cam_tfe_bus_priv  *) priv;
+		pdaf_rdi2_mux_en = (bool *)cmd_args;
+		*pdaf_rdi2_mux_en = bus_priv->common_data.pdaf_rdi2_mux_en;
+		break;
+	case CAM_ISP_HW_CMD_WM_BW_LIMIT_CONFIG:
+		rc = cam_tfe_bus_update_bw_limiter(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_LAST_CONSUMED_ADDR:
+		bus_priv = (struct cam_tfe_bus_priv  *) priv;
+		done = (struct cam_isp_hw_done_event_data *) cmd_args;
+		done->last_consumed_addr = cam_tfe_bus_get_last_consumed_addr(
+			bus_priv, done->resource_handle);
+		break;
+	case CAM_ISP_HW_CMD_BUS_WM_DISABLE:
+		rc = cam_tfe_bus_diable_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+		rc = cam_tfe_bus_check_overflow(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BUFFER_ALIGNMENT_UPDATE:
+		rc = cam_tfe_buffer_alignment_update(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+		rc = cam_tfe_bus_update_wm_config(priv, cmd_args, arg_size);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid camif process command:%d",
+			cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int cam_tfe_bus_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *core_data,
+	struct cam_tfe_bus                  **tfe_bus)
+{
+	int i, rc = 0;
+	struct cam_tfe_bus_priv    *bus_priv = NULL;
+	struct cam_tfe_bus         *tfe_bus_local;
+	struct cam_tfe_bus_hw_info *hw_info = bus_hw_info;
+	struct cam_tfe_soc_private       *soc_private = NULL;
+
+	if (!soc_info || !hw_intf || !bus_hw_info) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_hw_info);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	tfe_bus_local = kzalloc(sizeof(struct cam_tfe_bus), GFP_KERNEL);
+	if (!tfe_bus_local) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for tfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_tfe_bus_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for tfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+	tfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                   = hw_info->num_client;
+	bus_priv->num_out                      = hw_info->num_out;
+	bus_priv->num_comp_grp                 = hw_info->num_comp_grp;
+	bus_priv->max_wm_per_comp_grp          = hw_info->max_wm_per_comp_grp;
+	bus_priv->top_bus_wr_irq_shift         = hw_info->top_bus_wr_irq_shift;
+	bus_priv->max_out_res                  = hw_info->max_out_res;
+	bus_priv->common_data.comp_done_shift  = hw_info->comp_done_shift;
+
+	bus_priv->common_data.num_sec_out      = 0;
+	bus_priv->common_data.secure_mode      = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index       = soc_info->index;
+	bus_priv->common_data.mem_base         =
+		CAM_SOC_GET_REG_MAP_START(soc_info, TFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf          = hw_intf;
+	bus_priv->common_data.tfe_core_data    = core_data;
+	bus_priv->common_data.common_reg       = &hw_info->common_reg;
+	bus_priv->comp_buf_done_mask      = hw_info->comp_buf_done_mask;
+	bus_priv->comp_rup_done_mask      = hw_info->comp_rup_done_mask;
+	bus_priv->common_data.support_consumed_addr =
+		hw_info->support_consumed_addr;
+	bus_priv->common_data.pdaf_rdi2_mux_en = hw_info->pdaf_rdi2_mux_en;
+	bus_priv->common_data.rdi_width = hw_info->rdi_width;
+	bus_priv->common_data.max_bw_counter_limit = hw_info->max_bw_counter_limit;
+	bus_priv->common_data.counter_limit_shift = hw_info->counter_limit_shift;
+	bus_priv->common_data.counter_limit_mask = hw_info->counter_limit_mask;
+	bus_priv->common_data.mode_cfg_shift = hw_info->mode_cfg_shift;
+	bus_priv->common_data.height_shift = hw_info->height_shift;
+	bus_priv->common_data.pack_align_shift = hw_info->pack_align_shift;
+
+	for (i = 0; i < CAM_TFE_BUS_IRQ_REGISTERS_MAX; i++)
+		bus_priv->bus_irq_error_mask[i] =
+			hw_info->bus_irq_error_mask[i];
+
+	bus_priv->common_data.is_lite = soc_private->is_tfe_lite;
+
+	for (i = 0; i < CAM_TFE_BUS_RUP_GRP_MAX; i++)
+		bus_priv->common_data.rup_irq_enable[i] = false;
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_tfe_bus_init_wm_resource(i, bus_priv, bus_hw_info,
+			&bus_priv->bus_client[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init WM failed rc=%d", rc);
+			goto deinit_wm;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_comp_grp; i++) {
+		rc = cam_tfe_bus_init_comp_grp(i, soc_info,
+			bus_priv, bus_hw_info,
+			&bus_priv->comp_grp[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init Comp Grp failed rc=%d", rc);
+			goto deinit_comp_grp;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_tfe_bus_init_tfe_out_resource(i, bus_priv,
+			bus_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init TFE Out failed rc=%d", rc);
+			goto deinit_tfe_out;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+
+	tfe_bus_local->hw_ops.reserve      = cam_tfe_bus_acquire_tfe_out;
+	tfe_bus_local->hw_ops.release      = cam_tfe_bus_release_tfe_out;
+	tfe_bus_local->hw_ops.start        = cam_tfe_bus_start_tfe_out;
+	tfe_bus_local->hw_ops.stop         = cam_tfe_bus_stop_tfe_out;
+	tfe_bus_local->hw_ops.init         = cam_tfe_bus_init_hw;
+	tfe_bus_local->hw_ops.deinit       = cam_tfe_bus_deinit_hw;
+	tfe_bus_local->bottom_half_handler = cam_tfe_bus_bottom_half;
+	tfe_bus_local->hw_ops.process_cmd  = cam_tfe_bus_process_cmd;
+
+	*tfe_bus = tfe_bus_local;
+
+	return rc;
+
+deinit_tfe_out:
+	if (i < 0)
+		i = CAM_TFE_BUS_TFE_OUT_MAX;
+	for (--i; i >= 0; i--)
+		cam_tfe_bus_deinit_tfe_out_resource(&bus_priv->tfe_out[i]);
+
+deinit_comp_grp:
+	if (i < 0)
+		i = bus_priv->num_comp_grp;
+	for (--i; i >= 0; i--)
+		cam_tfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+
+deinit_wm:
+	if (i < 0)
+		i = bus_priv->num_client;
+	for (--i; i >= 0; i--)
+		cam_tfe_bus_deinit_wm_resource(&bus_priv->bus_client[i]);
+
+	kfree(tfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(tfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_tfe_bus_deinit(
+	struct cam_tfe_bus                  **tfe_bus)
+{
+	int i, rc = 0;
+	struct cam_tfe_bus_priv         *bus_priv = NULL;
+	struct cam_tfe_bus              *tfe_bus_local;
+
+	if (!tfe_bus || !*tfe_bus) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+	tfe_bus_local = *tfe_bus;
+	bus_priv = tfe_bus_local->bus_priv;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_tfe_bus_deinit_wm_resource(
+			&bus_priv->bus_client[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit WM failed rc=%d", rc);
+	}
+
+	for (i = 0; i < bus_priv->num_comp_grp; i++) {
+		rc = cam_tfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit Comp Grp failed rc=%d", rc);
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_tfe_bus_deinit_tfe_out_resource(
+			&bus_priv->tfe_out[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit TFE Out failed rc=%d", rc);
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+	kfree(tfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(tfe_bus_local);
+
+	*tfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.h
@@ -0,0 +1,292 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE_BUS_H_
+#define _CAM_TFE_BUS_H_
+
+#include "cam_soc_util.h"
+#include "cam_isp_hw.h"
+#include "cam_tfe_hw_intf.h"
+
+#define CAM_TFE_BUS_MAX_CLIENTS            19
+#define CAM_TFE_BUS_MAX_SUB_GRPS            4
+#define CAM_TFE_BUS_MAX_PERF_CNT_REG        8
+#define CAM_TFE_BUS_MAX_IRQ_REGISTERS       2
+#define CAM_TFE_BUS_CLIENT_NAME_MAX_LENGTH 32
+
+#define CAM_TFE_BUS_1_0             0x1000
+#define CAM_TFE_BUS_MAX_MID_PER_PORT        2
+
+
+#define CAM_TFE_ADD_REG_VAL_PAIR(buf_array, index, offset, val)    \
+	do {                                               \
+		buf_array[(index)++] = offset;             \
+		buf_array[(index)++] = val;                \
+	} while (0)
+
+#define ALIGNUP(value, alignment) \
+	((value + alignment - 1) / alignment * alignment)
+
+typedef int (*CAM_BUS_HANDLER_BOTTOM_HALF)(void      *bus_priv,
+	bool rup_process, struct cam_tfe_irq_evt_payload   *evt_payload,
+	bool error_process);
+
+enum cam_tfe_bus_plane_type {
+	PLANE_Y,
+	PLANE_C,
+	PLANE_MAX,
+};
+
+
+enum cam_tfe_bus_tfe_core_id {
+	CAM_TFE_BUS_TFE_CORE_0,
+	CAM_TFE_BUS_TFE_CORE_1,
+	CAM_TFE_BUS_TFE_CORE_2,
+	CAM_TFE_BUS_TFE_CORE_MAX,
+};
+
+enum cam_tfe_bus_comp_grp_id {
+	CAM_TFE_BUS_COMP_GRP_0,
+	CAM_TFE_BUS_COMP_GRP_1,
+	CAM_TFE_BUS_COMP_GRP_2,
+	CAM_TFE_BUS_COMP_GRP_3,
+	CAM_TFE_BUS_COMP_GRP_4,
+	CAM_TFE_BUS_COMP_GRP_5,
+	CAM_TFE_BUS_COMP_GRP_6,
+	CAM_TFE_BUS_COMP_GRP_7,
+	CAM_TFE_BUS_COMP_GRP_8,
+	CAM_TFE_BUS_COMP_GRP_9,
+	CAM_TFE_BUS_COMP_GRP_10,
+	CAM_TFE_BUS_COMP_GRP_11,
+	CAM_TFE_BUS_COMP_GRP_MAX,
+};
+
+enum cam_tfe_bus_rup_grp_id {
+	CAM_TFE_BUS_RUP_GRP_0,
+	CAM_TFE_BUS_RUP_GRP_1,
+	CAM_TFE_BUS_RUP_GRP_2,
+	CAM_TFE_BUS_RUP_GRP_3,
+	CAM_TFE_BUS_RUP_GRP_4,
+	CAM_TFE_BUS_RUP_GRP_MAX,
+};
+
+enum cam_tfe_bus_tfe_out_id {
+	CAM_TFE_BUS_TFE_OUT_RDI0,
+	CAM_TFE_BUS_TFE_OUT_RDI1,
+	CAM_TFE_BUS_TFE_OUT_RDI2,
+	CAM_TFE_BUS_TFE_OUT_FULL,
+	CAM_TFE_BUS_TFE_OUT_RAW_DUMP,
+	CAM_TFE_BUS_TFE_OUT_PDAF,
+	CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE,
+	CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST,
+	CAM_TFE_BUS_TFE_OUT_STATS_TL_BG,
+	CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG,
+	CAM_TFE_BUS_TFE_OUT_STATS_BF,
+	CAM_TFE_BUS_TFE_OUT_STATS_RS,
+	CAM_TFE_BUS_TFE_OUT_DS4,
+	CAM_TFE_BUS_TFE_OUT_DS16,
+	CAM_TFE_BUS_TFE_OUT_AI,
+	CAM_TFE_BUS_TFE_OUT_PD_LCR_STATS,
+	CAM_TFE_BUS_TFE_OUT_PD_PREPROCESSED,
+	CAM_TFE_BUS_TFE_OUT_PD_PARSED,
+	CAM_TFE_BUS_TFE_OUT_MAX,
+};
+
+/*
+ * struct cam_tfe_bus_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_tfe_bus_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t cgc_ovd;
+	uint32_t comp_cfg_0;
+	uint32_t comp_cfg_1;
+	uint32_t frameheader_cfg[4];
+	uint32_t pwr_iso_cfg;
+	uint32_t overflow_status_clear;
+	uint32_t ccif_violation_status;
+	uint32_t overflow_status;
+	uint32_t image_size_violation_status;
+	uint32_t perf_count_cfg[CAM_TFE_BUS_MAX_PERF_CNT_REG];
+	uint32_t perf_count_val[CAM_TFE_BUS_MAX_PERF_CNT_REG];
+	uint32_t perf_count_status;
+	uint32_t debug_status_top_cfg;
+	uint32_t debug_status_top;
+	uint32_t test_bus_ctrl;
+	uint32_t irq_mask[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t irq_clear[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t irq_status[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t irq_cmd;
+	/* common register data */
+	uint32_t cons_violation_shift;
+	uint32_t violation_shift;
+	uint32_t image_size_violation;
+};
+
+/*
+ * struct cam_tfe_bus_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_tfe_bus_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t frame_incr;
+	uint32_t image_cfg_0;
+	uint32_t image_cfg_1;
+	uint32_t image_cfg_2;
+	uint32_t packer_cfg;
+	uint32_t bw_limit;
+	uint32_t frame_header_addr;
+	uint32_t frame_header_incr;
+	uint32_t frame_header_cfg;
+	uint32_t line_done_cfg;
+	uint32_t irq_subsample_period;
+	uint32_t irq_subsample_pattern;
+	uint32_t framedrop_period;
+	uint32_t framedrop_pattern;
+	uint32_t system_cache_cfg;
+	uint32_t addr_status_0;
+	uint32_t addr_status_1;
+	uint32_t addr_status_2;
+	uint32_t addr_status_3;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	uint32_t comp_group;
+	/*bus data */
+	uint8_t  client_name[CAM_TFE_BUS_CLIENT_NAME_MAX_LENGTH];
+};
+
+/*
+ * struct cam_tfe_bus_tfe_out_hw_info:
+ *
+ * @Brief:           HW capability of TFE Bus Client
+ * tfe_out_id:       Tfe out port id
+ * max_width:        Max width supported by the outport
+ * max_height:       Max height supported by outport
+ * composite_group:  Out port composite group id
+ * rup_group_id:     Reg update group of outport id
+ * mid:              ouport mid value
+ * pid:              pid associated with mid
+ */
+struct cam_tfe_bus_tfe_out_hw_info {
+	enum cam_tfe_bus_tfe_out_id         tfe_out_id;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+	uint32_t                            composite_group;
+	uint32_t                            rup_group_id;
+	uint32_t                            mid[CAM_TFE_BUS_MAX_MID_PER_PORT];
+	uint64_t                            pid_mask;
+};
+
+/*
+ * struct cam_tfe_bus_hw_info:
+ *
+ * @Brief:                 HW register info for entire Bus
+ *
+ * @common_reg:            Common register details
+ * @num_client:            Total number of write clients
+ * @bus_client_reg:        Bus client register info
+ * @tfe_out_hw_info:       TFE output capability
+ * @num_comp_grp:          Number of composite group
+ * @max_wm_per_comp_grp:   Max number of wm associated with one composite group
+ * @comp_done_shift:       Mask shift for comp done mask
+ * @mode_cfg_shift:        Mask shift for mode config
+ * @height_shift:          Mask shift for height shift
+ * @top_bus_wr_irq_shift:  Mask shift for top level BUS WR irq
+ * @comp_buf_done_mask:    Composite buf done bits mask
+ * @comp_rup_done_mask:    Reg update done mask
+ * @bus_irq_error_mask:    Bus irq error mask bits
+ * @rdi_width:             RDI WM width
+ * @support_consumed_addr: Indicate if bus support consumed address
+ * @pdaf_rdi2_mux_en:      Indicate is PDAF is muxed with RDI2
+ * @max_bw_counter_limit:  Max BW counter limit
+ * @counter_limit_shift:   Mask shift for BW counter limit
+ * @counter_limit_mask:    Default Mask of BW limit counter
+ * @en_cfg_shift:          bus client frame based enable bit
+ * @pack_align_shift:      pack alignment shift
+ * @max_out_res:           Max tfe out resource value supported for hw
+ */
+struct cam_tfe_bus_hw_info {
+	struct cam_tfe_bus_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_tfe_bus_reg_offset_bus_client
+		bus_client_reg[CAM_TFE_BUS_MAX_CLIENTS];
+	uint32_t num_out;
+	struct cam_tfe_bus_tfe_out_hw_info
+		tfe_out_hw_info[CAM_TFE_BUS_TFE_OUT_MAX];
+	uint32_t num_comp_grp;
+	uint32_t max_wm_per_comp_grp;
+	uint32_t comp_done_shift;
+	uint32_t mode_cfg_shift;
+	uint32_t height_shift;
+	uint32_t top_bus_wr_irq_shift;
+	uint32_t comp_buf_done_mask;
+	uint32_t comp_rup_done_mask;
+	uint32_t bus_irq_error_mask[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t rdi_width;
+	bool support_consumed_addr;
+	bool pdaf_rdi2_mux_en;
+	uint32_t max_bw_counter_limit;
+	uint32_t counter_limit_shift;
+	uint32_t counter_limit_mask;
+	uint32_t pack_align_shift;
+	uint32_t max_out_res;
+};
+
+/*
+ * struct cam_tfe_bus:
+ *
+ * @Brief:                   Bus interface structure
+ *
+ * @bus_priv:                Private data of bus
+ * @hw_ops:                  Hardware interface functions
+ * @bottom_half_handler:     Bottom Half handler function
+ */
+struct cam_tfe_bus {
+	void                          *bus_priv;
+	struct cam_hw_ops              hw_ops;
+	CAM_BUS_HANDLER_BOTTOM_HALF    bottom_half_handler;
+};
+
+/*
+ * cam_tfe_bus_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @core_data:               Core data pointer used for top irq config
+ * @tfe_bus:                 Pointer to tfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_bus_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *core_data,
+	struct cam_tfe_bus                  **tfe_bus);
+
+/*
+ * cam_tfe_bus_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @tfe_bus:                 Pointer to tfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_bus_deinit(struct cam_tfe_bus     **tfe_bus);
+
+#endif /* _CAM_TFE_BUS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.c
@@ -0,0 +1,3564 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/timer.h>
+#include <linux/ratelimit.h>
+#include <media/cam_tfe.h>
+
+#include "cam_cdm_util.h"
+#include "cam_tasklet_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_tfe_soc.h"
+#include "cam_tfe_core.h"
+#include "cam_tfe_bus.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_compat.h"
+#include "cam_common_util.h"
+#include "cam_tfe_csid_hw_intf.h"
+
+static const char drv_name[] = "tfe";
+
+#define CAM_TFE_HW_RESET_HW_AND_REG_VAL       0x1
+#define CAM_TFE_HW_RESET_HW_VAL               0x10000
+#define CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES 3
+#define CAM_TFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX  2
+#define CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES 3
+#define CAM_TFE_MAX_OUT_OF_SYNC_ERR_COUNT     3
+#define CAM_TFE_DUAL_TFE_SYNC_SEL_IDX_FACTOR  1
+
+struct cam_tfe_top_common_data {
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_tfe_top_reg_offset_common       *common_reg;
+	struct cam_tfe_reg_dump_data               *reg_dump_data;
+};
+
+struct cam_tfe_top_priv {
+	struct cam_tfe_top_common_data      common_data;
+	struct cam_isp_resource_node        in_rsrc[CAM_TFE_TOP_IN_PORT_MAX];
+	unsigned long                       hw_clk_rate;
+	struct cam_axi_vote                 applied_axi_vote;
+	struct cam_axi_vote             req_axi_vote[CAM_TFE_TOP_IN_PORT_MAX];
+	unsigned long                   req_clk_rate[CAM_TFE_TOP_IN_PORT_MAX];
+	struct cam_axi_vote             last_vote[CAM_TFE_TOP_IN_PORT_MAX *
+					CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES];
+	uint32_t                        last_counter;
+	uint64_t                        total_bw_applied;
+	enum cam_tfe_bw_control_action
+		axi_vote_control[CAM_TFE_TOP_IN_PORT_MAX];
+	uint32_t                          irq_prepared_mask[3];
+	void                            *tasklet_info;
+	struct timespec64                    sof_ts;
+	struct timespec64                    epoch_ts;
+	struct timespec64                    eof_ts;
+	struct timespec64                    error_ts;
+	uint32_t                             top_debug;
+	uint32_t                             last_mup_val;
+	uint32_t                             sync_hw_id;
+	atomic_t                             switch_out_of_sync_cnt;
+};
+
+struct cam_tfe_camif_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_tfe_top_reg_offset_common        *common_reg;
+	struct cam_tfe_camif_reg                    *camif_reg;
+	struct cam_tfe_camif_reg_data               *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+
+
+	cam_hw_mgr_event_cb_func           event_cb;
+	void                              *priv;
+	enum cam_isp_hw_sync_mode          sync_mode;
+	uint32_t                           dsp_mode;
+	uint32_t                           pix_pattern;
+	uint32_t                           left_first_pixel;
+	uint32_t                           left_last_pixel;
+	uint32_t                           right_first_pixel;
+	uint32_t                           right_last_pixel;
+	uint32_t                           first_line;
+	uint32_t                           last_line;
+	bool                               enable_sof_irq_debug;
+	uint32_t                           irq_debug_cnt;
+	uint32_t                           camif_debug;
+	uint32_t                           camif_pd_enable;
+	uint32_t                           dual_tfe_sync_sel;
+	uint32_t                           hbi_value;
+	uint32_t                           vbi_value;
+	uint32_t                           qcfa_bin;
+	uint32_t                           bayer_bin;
+	uint32_t                           core_cfg;
+	bool                               shdr_en;
+	bool                               is_shdr_master;
+	uint32_t                           epoch_factor;
+};
+
+struct cam_tfe_rdi_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_tfe_top_reg_offset_common        *common_reg;
+	struct cam_tfe_rdi_reg                      *rdi_reg;
+	struct cam_tfe_rdi_reg_data                 *reg_data;
+	cam_hw_mgr_event_cb_func                     event_cb;
+	void                                        *priv;
+	enum cam_isp_hw_sync_mode                    sync_mode;
+	uint32_t                                     pix_pattern;
+	uint32_t                                     left_first_pixel;
+	uint32_t                                     left_last_pixel;
+	uint32_t                                     first_line;
+	uint32_t                                     last_line;
+	bool                                         shdr_en;
+	bool                                         is_shdr_master;
+	uint32_t                                     epoch_factor;
+};
+
+struct cam_tfe_ppp_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_tfe_top_reg_offset_common        *common_reg;
+	struct cam_tfe_ppp_reg                      *ppp_reg;
+	struct cam_tfe_ppp_reg_data                 *reg_data;
+	cam_hw_mgr_event_cb_func                     event_cb;
+	void                                        *priv;
+	enum cam_isp_hw_sync_mode                    sync_mode;
+	uint32_t                                     pix_pattern;
+	uint32_t                                     left_first_pixel;
+	uint32_t                                     left_last_pixel;
+	uint32_t                                     first_line;
+	uint32_t                                     last_line;
+	uint32_t                                     core_cfg;
+	bool                                         lcr_enable;
+};
+
+static int cam_tfe_validate_pix_pattern(uint32_t pattern)
+{
+	int rc;
+
+	switch (pattern) {
+	case CAM_ISP_TFE_PATTERN_BAYER_RGRGRG:
+	case CAM_ISP_TFE_PATTERN_BAYER_GRGRGR:
+	case CAM_ISP_TFE_PATTERN_BAYER_BGBGBG:
+	case CAM_ISP_TFE_PATTERN_BAYER_GBGBGB:
+	case CAM_ISP_TFE_PATTERN_YUV_YCBYCR:
+	case CAM_ISP_TFE_PATTERN_YUV_YCRYCB:
+	case CAM_ISP_TFE_PATTERN_YUV_CBYCRY:
+	case CAM_ISP_TFE_PATTERN_YUV_CRYCBY:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error Invalid pix pattern:%d", pattern);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int cam_tfe_get_evt_payload(struct cam_tfe_hw_core_info *core_info,
+	struct cam_tfe_irq_evt_payload    **evt_payload)
+{
+	spin_lock(&core_info->spin_lock);
+	if (list_empty(&core_info->free_payload_list)) {
+		*evt_payload = NULL;
+		spin_unlock(&core_info->spin_lock);
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload, core id 0x%x",
+			core_info->core_index);
+		return -ENODEV;
+	}
+
+	*evt_payload = list_first_entry(&core_info->free_payload_list,
+		struct cam_tfe_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	spin_unlock(&core_info->spin_lock);
+
+	return 0;
+}
+
+int cam_tfe_put_evt_payload(void             *core_info,
+	struct cam_tfe_irq_evt_payload  **evt_payload)
+{
+	struct cam_tfe_hw_core_info        *tfe_core_info = core_info;
+	unsigned long                       flags;
+
+	if (!core_info) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&tfe_core_info->spin_lock, flags);
+	(*evt_payload)->error_type = 0;
+	list_add_tail(&(*evt_payload)->list, &tfe_core_info->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&tfe_core_info->spin_lock, flags);
+
+	return 0;
+}
+
+int cam_tfe_get_hw_caps(void *hw_priv, void *get_hw_cap_args,
+		uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+void cam_tfe_get_timestamp(struct cam_isp_timestamp *time_stamp)
+{
+	struct timespec64 ts;
+
+	ktime_get_boottime_ts64(&ts);
+	time_stamp->mono_time.tv_sec    = ts.tv_sec;
+	time_stamp->mono_time.tv_nsec   = ts.tv_nsec;
+}
+
+int cam_tfe_irq_config(void     *tfe_core_data,
+	uint32_t  *irq_mask, uint32_t num_reg, bool enable)
+{
+	struct cam_tfe_hw_core_info    *core_info;
+	struct cam_tfe_top_priv        *top_priv;
+	struct cam_hw_soc_info         *soc_info;
+	void __iomem                   *mem_base;
+	bool                            need_lock;
+	unsigned long                   flags = 0;
+	uint32_t i, val;
+
+	if (!tfe_core_data) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"Invalid core data");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info    *)tfe_core_data;
+	top_priv = (struct cam_tfe_top_priv        *)core_info->top_priv;
+	soc_info = (struct cam_hw_soc_info  *)top_priv->common_data.soc_info;
+	mem_base = soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+
+	need_lock = !in_irq();
+	if (need_lock)
+		spin_lock_irqsave(&core_info->spin_lock, flags);
+
+	for (i = 0; i < num_reg; i++) {
+		val = cam_io_r_mb(mem_base  +
+			core_info->tfe_hw_info->top_irq_mask[i]);
+		if (enable)
+			val |= irq_mask[i];
+		else
+			val &= ~irq_mask[i];
+		cam_io_w_mb(val, mem_base +
+			core_info->tfe_hw_info->top_irq_mask[i]);
+	}
+	if (need_lock)
+		spin_unlock_irqrestore(&core_info->spin_lock, flags);
+
+	return 0;
+}
+
+static void cam_tfe_log_tfe_in_debug_status(
+	struct cam_tfe_top_priv              *top_priv)
+{
+	void __iomem                         *mem_base;
+	struct cam_tfe_camif_data            *camif_data;
+	struct cam_tfe_rdi_data              *rdi_data;
+	struct cam_tfe_top_reg_offset_common *common_reg;
+	struct cam_tfe_ppp_data              *ppp_data;
+	uint32_t  i, val_0, val_1;
+
+	mem_base = top_priv->common_data.soc_info->reg_map[0].mem_base;
+	common_reg = top_priv->common_data.common_reg;
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if ((top_priv->in_rsrc[i].res_state !=
+			CAM_ISP_RESOURCE_STATE_STREAMING))
+			continue;
+
+		if (top_priv->in_rsrc[i].res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+			camif_data = (struct cam_tfe_camif_data  *)
+				top_priv->in_rsrc[i].res_priv;
+			val_0 = cam_io_r(mem_base  +
+				camif_data->camif_reg->debug_0);
+			val_1 = cam_io_r(mem_base  +
+				camif_data->camif_reg->debug_1);
+			CAM_INFO(CAM_ISP,
+				"camif debug1:0x%x Height:0x%x, width:0x%x",
+				val_1,
+				((val_0 >> common_reg->height_shift) & 0x1FFF),
+				(val_0 & 0x1FFF));
+			CAM_INFO(CAM_ISP,
+				"Acquired sync mode:%d left start pxl:0x%x end_pixel:0x%x",
+				camif_data->sync_mode,
+				camif_data->left_first_pixel,
+				camif_data->left_last_pixel);
+
+			if (camif_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+				CAM_INFO(CAM_ISP,
+					"sync mode:%d right start pxl:0x%x end_pixel:0x%x",
+					camif_data->sync_mode,
+					camif_data->right_first_pixel,
+					camif_data->right_last_pixel);
+
+			CAM_INFO(CAM_ISP,
+				"Acquired line start:0x%x line end:0x%x",
+				camif_data->first_line,
+				camif_data->last_line);
+			CAM_INFO(CAM_ISP, "vbi_value:0x%x hbi_value:0x%x",
+				camif_data->vbi_value,
+				camif_data->hbi_value);
+
+		} else if (top_priv->in_rsrc[i].res_id == CAM_ISP_HW_TFE_IN_PDLIB) {
+			ppp_data = (struct cam_tfe_ppp_data  *)
+				top_priv->in_rsrc[i].res_priv;
+			val_0 = cam_io_r(mem_base  +
+				ppp_data->ppp_reg->ppp_debug_0);
+			val_1 = cam_io_r(mem_base  +
+				ppp_data->ppp_reg->ppp_debug_1);
+			CAM_INFO(CAM_ISP,
+				"PDLIB res id:%d debug1:0x%x Height:0x%x, width:0x%x",
+				top_priv->in_rsrc[i].res_id,
+				val_1, ((val_0 >> 16) & 0x1FFF),
+				(val_0 & 0x1FFF));
+			CAM_INFO(CAM_ISP,
+				"sync mode:%d left start pxl:0x%x end_pixel:0x%x",
+				ppp_data->sync_mode,
+				ppp_data->left_first_pixel,
+				ppp_data->left_last_pixel);
+			CAM_INFO(CAM_ISP,
+				"sync mode:%d line start:0x%x line end:0x%x",
+				ppp_data->sync_mode,
+				ppp_data->first_line,
+				ppp_data->last_line);
+		} else if ((top_priv->in_rsrc[i].res_id >=
+			CAM_ISP_HW_TFE_IN_RDI0) ||
+			(top_priv->in_rsrc[i].res_id <=
+			CAM_ISP_HW_TFE_IN_RDI2)) {
+			rdi_data = (struct cam_tfe_rdi_data  *)
+				top_priv->in_rsrc[i].res_priv;
+			val_0 = cam_io_r(mem_base  +
+				rdi_data->rdi_reg->rdi_debug_0);
+			val_1 = cam_io_r(mem_base  +
+				rdi_data->rdi_reg->rdi_debug_1);
+			CAM_INFO(CAM_ISP,
+				"RDI res id:%d debug1:0x%x Height:0x%x, width:0x%x",
+				top_priv->in_rsrc[i].res_id,
+				val_1, ((val_0 >> common_reg->height_shift) & 0x1FFF),
+				(val_0 & 0x1FFF));
+			CAM_INFO(CAM_ISP,
+				"sync mode:%d left start pxl:0x%x end_pixel:0x%x",
+				rdi_data->sync_mode,
+				rdi_data->left_first_pixel,
+				rdi_data->left_last_pixel);
+			CAM_INFO(CAM_ISP,
+				"sync mode:%d line start:0x%x line end:0x%x",
+				rdi_data->sync_mode,
+				rdi_data->first_line,
+				rdi_data->last_line);
+		}
+	}
+}
+static void cam_tfe_log_error_irq_status(
+	struct cam_tfe_hw_core_info          *core_info,
+	struct cam_tfe_top_priv              *top_priv,
+	struct cam_tfe_irq_evt_payload       *evt_payload,
+	struct cam_isp_hw_error_event_info   *err_evt_info,
+	int8_t                               *report_err)
+{
+	struct cam_tfe_hw_info               *hw_info;
+	void __iomem                         *mem_base;
+	struct cam_hw_soc_info               *soc_info;
+	struct cam_tfe_soc_private           *soc_private;
+
+	struct cam_tfe_clc_hw_status         *clc_hw_status;
+	struct cam_tfe_top_reg_offset_common *common_reg;
+	struct timespec64 ts;
+	uint32_t  i, val_0, val_1, val_2, val_3;
+
+	*report_err = 1;
+	ktime_get_boottime_ts64(&ts);
+	hw_info = core_info->tfe_hw_info;
+	mem_base = top_priv->common_data.soc_info->reg_map[0].mem_base;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = top_priv->common_data.soc_info->soc_private;
+	common_reg = top_priv->common_data.common_reg;
+
+	CAM_INFO(CAM_ISP, "current monotonic timestamp:[%lld.%06lld]",
+		ts.tv_sec, ts.tv_nsec/1000);
+	CAM_INFO(CAM_ISP,
+		"ERROR timestamp:[%lld.%06lld] SOF timestamp:[%lld.%06lld] EPOCH timestamp:[%lld.%06lld] EOF timestamp:[%lld.%06lld]",
+		top_priv->error_ts.tv_sec,
+		top_priv->error_ts.tv_nsec/1000,
+		top_priv->sof_ts.tv_sec,
+		top_priv->sof_ts.tv_nsec/1000,
+		top_priv->epoch_ts.tv_sec,
+		top_priv->epoch_ts.tv_nsec/1000,
+		top_priv->eof_ts.tv_sec,
+		top_priv->eof_ts.tv_nsec/1000);
+
+	CAM_INFO(CAM_ISP, "TOP IRQ[0]:0x%x IRQ[1]:0x%x IRQ[2]:0x%x",
+		evt_payload->irq_reg_val[0], evt_payload->irq_reg_val[1],
+		evt_payload->irq_reg_val[2]);
+
+	for (i = 0; i < common_reg->num_debug_reg; i++) {
+		val_0 = cam_io_r(mem_base  +
+			common_reg->debug_reg[i]);
+		CAM_INFO(CAM_ISP, "Top debug [%d]:0x%x", i, val_0);
+	}
+
+	cam_cpas_dump_camnoc_buff_fill_info(soc_private->cpas_handle);
+
+	for (i = 0; i < common_reg->num_perf_cfg; i++) {
+		val_0 = cam_io_r(mem_base + common_reg->perf_cfg[i].perf_pixel_count);
+
+		val_1 = cam_io_r(mem_base + common_reg->perf_cfg[i].perf_line_count);
+
+		val_2 = cam_io_r(mem_base + common_reg->perf_cfg[i].perf_stall_count);
+
+		val_3 = cam_io_r(mem_base + common_reg->perf_cfg[i].perf_always_count);
+
+		CAM_INFO(CAM_ISP,
+			"Top perf cnt [%d] pix:0x%x line:0x%x stall:0x%x always:0x%x",
+			i, val_0, val_1, val_2, val_3);
+	}
+
+	clc_hw_status = hw_info->clc_hw_status_info;
+	for (i = 0; i < hw_info->num_clc; i++) {
+		val_0 = cam_io_r(mem_base  +
+			clc_hw_status[i].hw_status_reg);
+		if (val_0)
+			CAM_INFO(CAM_ISP,
+				"CLC HW status :name:%s offset:0x%x value:0x%x",
+				clc_hw_status[i].name,
+				clc_hw_status[i].hw_status_reg,
+				val_0);
+	}
+
+	cam_tfe_log_tfe_in_debug_status(top_priv);
+
+	/* Check the overflow errors */
+	if (evt_payload->irq_reg_val[0] & hw_info->error_irq_mask[0]) {
+		if (evt_payload->irq_reg_val[0] & common_reg->pp_frame_drop_bit)
+			CAM_INFO(CAM_ISP, "TFE %d PP_FRAME_DROP", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->rdi0_frame_drop_bit)
+			CAM_INFO(CAM_ISP, "TFE %d RDI0_FRAME_DROP", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->rdi1_frame_drop_bit)
+			CAM_INFO(CAM_ISP, "TFE %d RDI1_FRAME_DROP", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->rdi2_frame_drop_bit)
+			CAM_INFO(CAM_ISP, "TFE %d RDI2_FRAME_DROP", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->ppp_frame_drop_bit)
+			CAM_INFO(CAM_ISP, "TFE %d PDAF_FRAME_DROP", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->pp_overflow_bit)
+			CAM_INFO(CAM_ISP, "TFE %d PP_OVERFLOW", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->rdi0_overflow_bit)
+			CAM_INFO(CAM_ISP, "TFE %d RDI0_OVERFLOW", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->rdi1_overflow_bit)
+			CAM_INFO(CAM_ISP, "TFE %d RDI1_OVERFLOW", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->rdi2_overflow_bit)
+			CAM_INFO(CAM_ISP, "TFE %d RDI2_OVERFLOW", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->ppp_overflow_bit)
+			CAM_INFO(CAM_ISP, "TFE %d PDAF_OVERFLOW", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[0] & common_reg->out_of_sync_frame_drop_bit) {
+			CAM_INFO(CAM_ISP,
+				"TFE %d SENSOR_SWITCH_OUT_OF_SYNC_FRAME_DROP mup: last %d curr %d",
+				core_info->core_index, top_priv->last_mup_val,
+				((cam_io_r(mem_base + common_reg->reg_update_cmd) >>
+				common_reg->mup_shift_val) & 1));
+			*report_err = 0;
+			atomic_inc(&top_priv->switch_out_of_sync_cnt);
+			if (atomic_read(&top_priv->switch_out_of_sync_cnt) >=
+				CAM_TFE_MAX_OUT_OF_SYNC_ERR_COUNT) {
+				*report_err = 1;
+				err_evt_info->err_type = CAM_TFE_IRQ_STATUS_OUT_OF_SYNC;
+				CAM_ERR(CAM_ISP, "TFE %d out of sync frame count: %d",
+					core_info->core_index, top_priv->switch_out_of_sync_cnt);
+			}
+		}
+	}
+
+	/* Check the violation errors */
+	if (evt_payload->irq_reg_val[2] & hw_info->error_irq_mask[2]) {
+		if (evt_payload->irq_reg_val[2] & common_reg->pp_camif_violation_bit)
+			CAM_INFO(CAM_ISP, "TFE %d PP_CAMIF_VIOLATION", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[2] & common_reg->pp_violation_bit)
+			CAM_INFO(CAM_ISP, "TFE %d PP_VIOLATION", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[2] & common_reg->rdi0_camif_violation_bit)
+			CAM_INFO(CAM_ISP, "TFE %d RDI0_CAMIF_VIOLATION", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[2] & common_reg->rdi1_camif_violation_bit)
+			CAM_INFO(CAM_ISP, "TFE %d RDI1_CAMIF_VIOLATION", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[2] & common_reg->rdi2_camif_violation_bit)
+			CAM_INFO(CAM_ISP, "TFE %d RDI2_CAMIF_VIOLATION", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[2] & common_reg->diag_violation_bit)
+			CAM_INFO(CAM_ISP, "TFE %d DIAG_VIOLATION", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[2] & common_reg->ppp_camif_violation_bit)
+			CAM_INFO(CAM_ISP, "TFE %d PDAF_CAMIF_VIOLATION", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[2] & common_reg->ppp_violation_bit)
+			CAM_INFO(CAM_ISP, "TFE %d PDAF_VIOLATION", core_info->core_index);
+
+		if (evt_payload->irq_reg_val[2] & common_reg->lcr_pd_timing_protocol_violation_bit)
+			CAM_INFO(CAM_ISP, "TFE %d LCR_PD_INPUT_TIMING_PROTOCOL_VIOLATION",
+				core_info->core_index);
+
+		if (evt_payload->irq_reg_val[2] & common_reg->dyamanic_switch_violation_bit)
+			CAM_INFO(CAM_ISP,
+				"TFE %d DYNAMIC_SHDR_MODE_SWITCH_VIOLATION mup val %d",
+				core_info->core_index, top_priv->last_mup_val);
+
+		val_0 = cam_io_r(mem_base + common_reg->violation_status);
+		CAM_INFO(CAM_ISP, "TFE %d TOP Violation status:0x%x", core_info->core_index, val_0);
+	}
+
+	core_info->tfe_bus->bottom_half_handler(
+		core_info->tfe_bus->bus_priv, false, evt_payload, true);
+
+	CAM_INFO(CAM_ISP,
+		"TFE clock rate:%d TFE total bw applied:%lld",
+		top_priv->hw_clk_rate,
+		top_priv->total_bw_applied);
+
+	cam_cpas_log_votes(false);
+}
+
+static int cam_tfe_error_irq_bottom_half(
+	struct cam_tfe_hw_core_info          *core_info,
+	struct cam_tfe_top_priv              *top_priv,
+	struct cam_tfe_irq_evt_payload       *evt_payload,
+	cam_hw_mgr_event_cb_func              event_cb,
+	void                                 *event_cb_priv)
+{
+	struct cam_isp_hw_error_event_info   err_evt_info;
+	struct cam_isp_hw_event_info         evt_info;
+	struct cam_tfe_hw_info              *hw_info;
+	uint32_t   error_detected = 0;
+	int8_t report_err = 1;
+
+	hw_info = core_info->tfe_hw_info;
+	evt_info.hw_idx = core_info->core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_TFE_IN;
+	evt_info.hw_type = CAM_ISP_HW_TYPE_TFE;
+
+	if (evt_payload->irq_reg_val[0] & hw_info->error_irq_mask[0]) {
+		err_evt_info.err_type = CAM_TFE_IRQ_STATUS_OVERFLOW;
+		error_detected = 1;
+	}
+
+	if ((evt_payload->bus_irq_val[0] & hw_info->bus_error_irq_mask[0]) ||
+		(evt_payload->irq_reg_val[2] & hw_info->error_irq_mask[2])) {
+		err_evt_info.err_type = CAM_TFE_IRQ_STATUS_VIOLATION;
+		error_detected = 1;
+	}
+
+	if (error_detected) {
+		evt_info.event_data = (void *)&err_evt_info;
+		top_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		cam_tfe_log_error_irq_status(core_info, top_priv,
+			evt_payload, &err_evt_info, &report_err);
+		if (report_err) {
+			if (event_cb)
+				event_cb(event_cb_priv, CAM_ISP_HW_EVENT_ERROR,
+					(void *)&evt_info);
+			else
+				CAM_ERR(CAM_ISP, "TFE:%d invalid eventcb:",
+					core_info->core_index);
+		}
+	}
+
+	return 0;
+}
+
+static int cam_tfe_rdi_irq_bottom_half(
+	struct cam_tfe_top_priv              *top_priv,
+	struct cam_isp_resource_node         *rdi_node,
+	bool                                  epoch_process,
+	struct cam_tfe_irq_evt_payload       *evt_payload)
+{
+	struct cam_tfe_rdi_data               *rdi_priv;
+	struct cam_isp_hw_event_info           evt_info;
+	struct cam_hw_info                    *hw_info;
+	struct cam_tfe_top_reg_offset_common  *common_reg;
+	uint32_t                               val, val2;
+
+	rdi_priv = (struct cam_tfe_rdi_data    *)rdi_node->res_priv;
+	hw_info = rdi_node->hw_intf->hw_priv;
+
+	evt_info.hw_idx   = rdi_node->hw_intf->hw_idx;
+	evt_info.res_id   = rdi_node->res_id;
+	evt_info.res_type = rdi_node->res_type;
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		rdi_priv->reg_data->eof_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EOF");
+		top_priv->eof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->eof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+	}
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		rdi_priv->reg_data->sof_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received SOF");
+		top_priv->sof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->sof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		atomic_set(&top_priv->switch_out_of_sync_cnt, 0);
+
+		if (top_priv->top_debug &
+			CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+			common_reg  = rdi_priv->common_reg;
+			val = cam_io_r(rdi_priv->mem_base +
+				common_reg->diag_sensor_status_0);
+			val2 =  cam_io_r(rdi_priv->mem_base +
+				common_reg->diag_sensor_status_1);
+			CAM_INFO(CAM_ISP,
+				"TFE:%d diag sensor hbi min error:%d neq hbi:%d HBI:%d VBI:%d",
+				rdi_node->hw_intf->hw_idx,
+				((val >> common_reg->diag_min_hbi_error_shift)
+					& 0x1),
+				((val >> common_reg->diag_neq_hbi_shift) & 0x1),
+				(val & common_reg->diag_sensor_hbi_mask),
+				val2);
+		}
+	}
+
+	if (epoch_process && (evt_payload->irq_reg_val[1] &
+		rdi_priv->reg_data->epoch0_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EPOCH0");
+		top_priv->epoch_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->epoch_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_ppp_irq_bottom_half(
+	struct cam_tfe_top_priv              *top_priv,
+	struct cam_isp_resource_node         *ppp_node,
+	bool                                  epoch_process,
+	struct cam_tfe_irq_evt_payload       *evt_payload)
+{
+	struct cam_tfe_ppp_data               *ppp_priv;
+	struct cam_isp_hw_event_info           evt_info;
+	struct cam_hw_info                    *hw_info;
+	struct cam_tfe_top_reg_offset_common  *common_reg;
+	uint32_t                               val, val2;
+
+	ppp_priv = (struct cam_tfe_ppp_data    *)ppp_node->res_priv;
+	hw_info = ppp_node->hw_intf->hw_priv;
+
+	evt_info.hw_idx   = ppp_node->hw_intf->hw_idx;
+	evt_info.res_id   = ppp_node->res_id;
+	evt_info.res_type = ppp_node->res_type;
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		ppp_priv->reg_data->eof_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EOF");
+		top_priv->eof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->eof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (ppp_priv->event_cb)
+			ppp_priv->event_cb(ppp_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+	}
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		ppp_priv->reg_data->sof_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received SOF");
+		top_priv->sof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->sof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (ppp_priv->event_cb)
+			ppp_priv->event_cb(ppp_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		if (top_priv->top_debug &
+			CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+			common_reg  = ppp_priv->common_reg;
+			val = cam_io_r(ppp_priv->mem_base +
+				common_reg->diag_sensor_status_0);
+			val2 =  cam_io_r(ppp_priv->mem_base +
+				common_reg->diag_sensor_status_1);
+			CAM_INFO(CAM_ISP,
+				"TFE:%d diag sensor hbi min error:%d neq hbi:%d HBI:%d VBI:%d",
+				ppp_node->hw_intf->hw_idx,
+				((val >> common_reg->diag_min_hbi_error_shift)
+					& 0x1),
+				((val >> common_reg->diag_neq_hbi_shift) & 0x1),
+				(val & common_reg->diag_sensor_hbi_mask),
+				val2);
+		}
+	}
+
+	if (epoch_process && (evt_payload->irq_reg_val[1] &
+		ppp_priv->reg_data->epoch0_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EPOCH0");
+		top_priv->epoch_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->epoch_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (ppp_priv->event_cb)
+			ppp_priv->event_cb(ppp_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_camif_irq_bottom_half(
+	struct cam_tfe_top_priv              *top_priv,
+	struct cam_isp_resource_node         *camif_node,
+	bool                                  epoch_process,
+	struct cam_tfe_irq_evt_payload       *evt_payload)
+{
+	struct cam_tfe_camif_data             *camif_priv;
+	struct cam_isp_hw_event_info           evt_info;
+	struct cam_hw_info                    *hw_info;
+	struct cam_tfe_top_reg_offset_common  *common_reg;
+	uint32_t                              val, val2;
+
+	camif_priv = camif_node->res_priv;
+	hw_info = camif_node->hw_intf->hw_priv;
+	evt_info.hw_idx   = camif_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_node->res_id;
+	evt_info.res_type = camif_node->res_type;
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		camif_priv->reg_data->eof_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EOF");
+
+		top_priv->eof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->eof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+	}
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		camif_priv->reg_data->sof_irq_mask)) {
+		if ((camif_priv->enable_sof_irq_debug) &&
+			(camif_priv->irq_debug_cnt <=
+			CAM_TFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "Received SOF");
+
+			camif_priv->irq_debug_cnt++;
+			if (camif_priv->irq_debug_cnt ==
+				CAM_TFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+				camif_priv->enable_sof_irq_debug =
+					false;
+				camif_priv->irq_debug_cnt = 0;
+			}
+		} else
+			CAM_DBG(CAM_ISP, "Received SOF");
+
+		top_priv->sof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->sof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		atomic_set(&top_priv->switch_out_of_sync_cnt, 0);
+
+		if (top_priv->top_debug &
+			CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+			common_reg  = camif_priv->common_reg;
+			val = cam_io_r(camif_priv->mem_base +
+				common_reg->diag_sensor_status_0);
+			val2 =  cam_io_r(camif_priv->mem_base +
+				common_reg->diag_sensor_status_1);
+			CAM_INFO(CAM_ISP,
+				"TFE:%d diag sensor hbi min error:%d neq hbi:%d HBI:%d VBI:%d",
+				camif_node->hw_intf->hw_idx,
+				((val >> common_reg->diag_min_hbi_error_shift)
+					& 0x1),
+				((val >> common_reg->diag_neq_hbi_shift) & 0x1),
+				(val & common_reg->diag_sensor_hbi_mask),
+				val2);
+		}
+	}
+
+	if (epoch_process  && (evt_payload->irq_reg_val[1] &
+		camif_priv->reg_data->epoch0_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EPOCH");
+
+		top_priv->epoch_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->epoch_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	struct cam_tfe_hw_core_info         *core_info;
+	struct cam_tfe_top_priv             *top_priv;
+	struct cam_tfe_irq_evt_payload      *evt_payload;
+	struct cam_tfe_camif_data           *camif_priv;
+	struct cam_tfe_rdi_data             *rdi_priv;
+	struct cam_tfe_ppp_data             *ppp_priv;
+	cam_hw_mgr_event_cb_func             event_cb = NULL;
+	void                                *event_cb_priv = NULL;
+	uint32_t i;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params handle_priv:%pK, evt_payload_priv:%pK",
+			handler_priv, evt_payload_priv);
+		return 0;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)handler_priv;
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	evt_payload = evt_payload_priv;
+
+	/* process sof and eof */
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if ((top_priv->in_rsrc[i].res_id ==
+			CAM_ISP_HW_TFE_IN_CAMIF) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING)) {
+			camif_priv = (struct cam_tfe_camif_data  *)
+				top_priv->in_rsrc[i].res_priv;
+			event_cb = camif_priv->event_cb;
+			event_cb_priv = camif_priv->priv;
+
+			if (camif_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_camif_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], false,
+					evt_payload);
+
+		} else if ((top_priv->in_rsrc[i].res_id ==
+			CAM_ISP_HW_TFE_IN_PDLIB) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING)) {
+			ppp_priv = (struct cam_tfe_ppp_data *)
+				top_priv->in_rsrc[i].res_priv;
+			event_cb = ppp_priv->event_cb;
+			event_cb_priv = ppp_priv->priv;
+
+			if (ppp_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_ppp_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], false,
+					evt_payload);
+		} else if ((top_priv->in_rsrc[i].res_id >=
+			CAM_ISP_HW_TFE_IN_RDI0) &&
+			(top_priv->in_rsrc[i].res_id <=
+			CAM_ISP_HW_TFE_IN_RDI2) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) &&
+			top_priv->in_rsrc[i].is_rdi_primary_res) {
+			rdi_priv = (struct cam_tfe_rdi_data *)
+				top_priv->in_rsrc[i].res_priv;
+			event_cb = rdi_priv->event_cb;
+			event_cb_priv = rdi_priv->priv;
+
+			if (rdi_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_rdi_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], false,
+					evt_payload);
+		}
+	}
+
+	/* process the irq errors */
+	cam_tfe_error_irq_bottom_half(core_info, top_priv, evt_payload,
+		event_cb, event_cb_priv);
+
+	/* process the reg update in the bus */
+	if (evt_payload->irq_reg_val[0] &
+		core_info->tfe_hw_info->bus_reg_irq_mask[0]) {
+		core_info->tfe_bus->bottom_half_handler(
+			core_info->tfe_bus->bus_priv, true, evt_payload, false);
+	}
+
+	/* process the epoch */
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if ((top_priv->in_rsrc[i].res_id ==
+			CAM_ISP_HW_TFE_IN_CAMIF) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING)) {
+			camif_priv = (struct cam_tfe_camif_data  *)
+				top_priv->in_rsrc[i].res_priv;
+			if (camif_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_camif_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], true,
+					evt_payload);
+		} else if ((top_priv->in_rsrc[i].res_id ==
+			CAM_ISP_HW_TFE_IN_PDLIB) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING)) {
+			ppp_priv = (struct cam_tfe_ppp_data *)
+				top_priv->in_rsrc[i].res_priv;
+			if (ppp_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_ppp_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], true,
+					evt_payload);
+		} else if ((top_priv->in_rsrc[i].res_id >=
+			CAM_ISP_HW_TFE_IN_RDI0) &&
+			(top_priv->in_rsrc[i].res_id <=
+			CAM_ISP_HW_TFE_IN_RDI2) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING)) {
+			rdi_priv = (struct cam_tfe_rdi_data *)
+				top_priv->in_rsrc[i].res_priv;
+			if (rdi_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_rdi_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], true,
+					evt_payload);
+		}
+	}
+
+	/* process the bufone */
+	if (evt_payload->irq_reg_val[0] &
+		core_info->tfe_hw_info->bus_reg_irq_mask[0]) {
+		core_info->tfe_bus->bottom_half_handler(
+			core_info->tfe_bus->bus_priv, false, evt_payload,
+			false);
+	}
+
+	cam_tfe_put_evt_payload(core_info, &evt_payload);
+
+	return 0;
+}
+
+static int cam_tfe_irq_err_top_half(
+	struct cam_tfe_hw_core_info       *core_info,
+	void __iomem                      *mem_base,
+	uint32_t                          *top_irq_status,
+	uint32_t                          *bus_irq_status)
+{
+	uint32_t i;
+
+	if ((top_irq_status[0] &  core_info->tfe_hw_info->error_irq_mask[0]) ||
+		(top_irq_status[2] &
+		core_info->tfe_hw_info->error_irq_mask[2]) ||
+		(bus_irq_status[0] &
+		core_info->tfe_hw_info->bus_error_irq_mask[0])) {
+		CAM_ERR(CAM_ISP,
+			"Encountered Error: tfe:%d: Irq_status0=0x%x status2=0x%x",
+			core_info->core_index, top_irq_status[0],
+			top_irq_status[2]);
+		CAM_ERR(CAM_ISP,
+			"Encountered Error: tfe:%d:BUS Irq_status0=0x%x",
+			core_info->core_index, bus_irq_status[0]);
+
+		for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+			cam_io_w(0, mem_base +
+				core_info->tfe_hw_info->top_irq_mask[i]);
+
+		cam_io_w_mb(core_info->tfe_hw_info->global_clear_bitmask,
+			mem_base + core_info->tfe_hw_info->top_irq_cmd);
+	}
+
+	return 0;
+}
+
+irqreturn_t cam_tfe_irq(int irq_num, void *data)
+{
+	struct cam_hw_info             *tfe_hw;
+	struct cam_tfe_hw_core_info    *core_info;
+	struct cam_tfe_top_priv        *top_priv;
+	void __iomem                   *mem_base;
+	struct cam_tfe_irq_evt_payload  *evt_payload;
+	uint32_t  top_irq_status[CAM_TFE_TOP_IRQ_REG_NUM] = {0};
+	uint32_t   bus_irq_status[CAM_TFE_BUS_MAX_IRQ_REGISTERS] = {0};
+	uint32_t  i,  ccif_violation = 0, overflow_status = 0;
+	uint32_t    image_sz_violation = 0;
+	void        *bh_cmd = NULL;
+	int rc = -EINVAL;
+
+	if (!data)
+		return IRQ_NONE;
+
+	tfe_hw = (struct cam_hw_info *)data;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	mem_base = top_priv->common_data.soc_info->reg_map[0].mem_base;
+
+	if (tfe_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_ISP, "TFE:%d hw is not powered up",
+			core_info->core_index);
+		return IRQ_HANDLED;
+	}
+
+	spin_lock(&core_info->spin_lock);
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		top_irq_status[i] = cam_io_r(mem_base  +
+		core_info->tfe_hw_info->top_irq_status[i]);
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		cam_io_w(top_irq_status[i], mem_base +
+			core_info->tfe_hw_info->top_irq_clear[i]);
+
+	cam_io_w_mb(core_info->tfe_hw_info->global_clear_bitmask,
+		mem_base + core_info->tfe_hw_info->top_irq_cmd);
+
+	CAM_DBG(CAM_ISP, "TFE:%d IRQ status_0:0x%x status_1:0x%x status_2:0x%x",
+		core_info->core_index, top_irq_status[0],
+		top_irq_status[1], top_irq_status[2]);
+
+	if (top_irq_status[0] & core_info->tfe_hw_info->bus_reg_irq_mask[0]) {
+		for (i = 0; i < CAM_TFE_BUS_MAX_IRQ_REGISTERS; i++)
+			bus_irq_status[i] = cam_io_r(mem_base  +
+				core_info->tfe_hw_info->bus_irq_status[i]);
+
+		for (i = 0; i < CAM_TFE_BUS_MAX_IRQ_REGISTERS; i++)
+			cam_io_w(bus_irq_status[i], mem_base +
+				core_info->tfe_hw_info->bus_irq_clear[i]);
+
+		ccif_violation =  cam_io_r(mem_base  +
+			core_info->tfe_hw_info->bus_violation_reg);
+		overflow_status = cam_io_r(mem_base  +
+			core_info->tfe_hw_info->bus_overflow_reg);
+		image_sz_violation = cam_io_r(mem_base  +
+			core_info->tfe_hw_info->bus_image_size_vilation_reg);
+
+		cam_io_w(core_info->tfe_hw_info->global_clear_bitmask,
+			mem_base + core_info->tfe_hw_info->bus_irq_cmd);
+
+		CAM_DBG(CAM_ISP, "TFE:%d BUS IRQ status_0:0x%x status_1:0x%x",
+			core_info->core_index, bus_irq_status[0],
+			bus_irq_status[1]);
+	}
+	spin_unlock(&core_info->spin_lock);
+
+	/* check reset */
+	if ((top_irq_status[0] & core_info->tfe_hw_info->reset_irq_mask[0]) ||
+		(top_irq_status[1] &
+			core_info->tfe_hw_info->reset_irq_mask[1]) ||
+		(top_irq_status[2] &
+			core_info->tfe_hw_info->reset_irq_mask[2])) {
+		/* Reset ack */
+		complete(&core_info->reset_complete);
+		return IRQ_HANDLED;
+	}
+
+	/* Check the irq errors  */
+	cam_tfe_irq_err_top_half(core_info, mem_base, top_irq_status,
+		bus_irq_status);
+
+	rc  = cam_tfe_get_evt_payload(core_info, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ status0=0x%x status2=0x%x",
+			top_irq_status[0], top_irq_status[1]);
+		goto end;
+	}
+
+	cam_tfe_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		evt_payload->irq_reg_val[i] = top_irq_status[i];
+
+	for (i = 0; i < CAM_TFE_BUS_MAX_IRQ_REGISTERS; i++)
+		evt_payload->bus_irq_val[i] = bus_irq_status[i];
+
+	evt_payload->ccif_violation_status = ccif_violation;
+	evt_payload->overflow_status = overflow_status;
+	evt_payload->image_size_violation_status = image_sz_violation;
+
+	evt_payload->core_index = core_info->core_index;
+	evt_payload->core_info  = core_info;
+
+	rc = tasklet_bh_api.get_bh_payload_func(
+		top_priv->tasklet_info, &bh_cmd);
+	if (rc || !bh_cmd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No payload, IRQ handling frozen");
+		cam_tfe_put_evt_payload(core_info, &evt_payload);
+		goto end;
+	}
+
+	tasklet_bh_api.bottom_half_enqueue_func(
+		top_priv->tasklet_info,
+		bh_cmd,
+		core_info,
+		evt_payload,
+		cam_tfe_irq_bottom_half);
+
+end:
+	return IRQ_HANDLED;
+
+}
+
+static int cam_tfe_top_set_hw_clk_rate(
+	struct cam_tfe_top_priv *top_priv)
+{
+	struct cam_hw_soc_info        *soc_info = NULL;
+	int                            i, rc = 0;
+	unsigned long                  max_clk_rate = 0;
+
+	soc_info = top_priv->common_data.soc_info;
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->req_clk_rate[i] > max_clk_rate)
+			max_clk_rate = top_priv->req_clk_rate[i];
+	}
+	if (max_clk_rate == top_priv->hw_clk_rate)
+		return 0;
+
+	CAM_DBG(CAM_ISP, "TFE:%d Clock name=%s idx=%d clk=%llu",
+		top_priv->common_data.soc_info->index,
+		soc_info->clk_name[soc_info->src_clk_idx],
+		soc_info->src_clk_idx, max_clk_rate);
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX, max_clk_rate, 0);
+
+	if (!rc)
+		top_priv->hw_clk_rate = max_clk_rate;
+	else
+		CAM_ERR(CAM_ISP, "TFE:%d set src clock rate:%lld failed, rc=%d",
+		top_priv->common_data.soc_info->index, max_clk_rate,  rc);
+
+	return rc;
+}
+
+static int cam_tfe_top_dynamic_clock_update(
+	struct cam_tfe_top_priv  *top_priv,
+	void                     *cmd_args,
+	uint32_t                 arg_size)
+{
+	struct cam_hw_soc_info   *soc_info;
+	unsigned long            *clk_rate;
+	int rc = 0;
+
+	soc_info = top_priv->common_data.soc_info;
+	clk_rate = (unsigned long *)cmd_args;
+	CAM_DBG(CAM_ISP, "TFE[%u] clock rate requested: %llu curr: %llu",
+		top_priv->common_data.hw_intf->hw_idx, *clk_rate,
+		soc_info->applied_src_clk_rates.sw_client);
+
+	if (*clk_rate <= top_priv->hw_clk_rate)
+		goto end;
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX, *clk_rate, 0);
+	if (!rc) {
+		top_priv->hw_clk_rate = *clk_rate;
+	} else {
+		CAM_ERR(CAM_ISP,
+			"unable to set clock dynamically rate: %llu",
+			*clk_rate);
+		return rc;
+	}
+end:
+	*clk_rate = soc_info->applied_src_clk_rates.sw_client;
+	CAM_DBG(CAM_ISP, "TFE[%u] new clock rate %llu",
+		top_priv->common_data.hw_intf->hw_idx, soc_info->applied_src_clk_rates.sw_client);
+
+	return rc;
+}
+
+static struct cam_axi_vote *cam_tfe_top_delay_bw_reduction(
+	struct cam_tfe_top_priv *top_priv,
+	uint64_t *to_be_applied_bw)
+{
+	uint32_t i, j;
+	int vote_idx = -1;
+	uint64_t max_bw = 0;
+	uint64_t total_bw;
+	struct cam_axi_vote *curr_l_vote;
+
+	for (i = 0; i < (CAM_TFE_TOP_IN_PORT_MAX *
+		CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES); i++) {
+		total_bw = 0;
+		curr_l_vote = &top_priv->last_vote[i];
+		for (j = 0; j < curr_l_vote->num_paths; j++) {
+			if (total_bw >
+				(U64_MAX -
+				curr_l_vote->axi_path[j].camnoc_bw)) {
+				CAM_ERR(CAM_ISP, "Overflow at idx: %d", j);
+				return NULL;
+			}
+
+			total_bw += curr_l_vote->axi_path[j].camnoc_bw;
+		}
+
+		if (total_bw > max_bw) {
+			vote_idx = i;
+			max_bw = total_bw;
+		}
+	}
+
+	if (vote_idx < 0)
+		return NULL;
+
+	*to_be_applied_bw = max_bw;
+
+	return &top_priv->last_vote[vote_idx];
+}
+
+static int cam_tfe_top_set_axi_bw_vote(
+	struct cam_tfe_top_priv *top_priv,
+	bool start_stop)
+{
+	struct cam_axi_vote *agg_vote = NULL;
+	struct cam_axi_vote *to_be_applied_axi_vote = NULL;
+	struct cam_hw_soc_info   *soc_info = top_priv->common_data.soc_info;
+	struct cam_tfe_soc_private *soc_private = soc_info->soc_private;
+	int rc = 0;
+	uint32_t i;
+	uint32_t num_paths = 0;
+	uint64_t total_bw_new_vote = 0;
+	bool bw_unchanged = true;
+	bool apply_bw_update = false;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	agg_vote = kzalloc(sizeof(struct cam_axi_vote), GFP_KERNEL);
+	if (!agg_vote) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->axi_vote_control[i] ==
+			CAM_TFE_BW_CONTROL_INCLUDE) {
+			if (num_paths +
+				top_priv->req_axi_vote[i].num_paths >
+				CAM_CPAS_MAX_PATHS_PER_CLIENT) {
+				CAM_ERR(CAM_ISP,
+					"Required paths(%d) more than max(%d)",
+					num_paths +
+					top_priv->req_axi_vote[i].num_paths,
+					CAM_CPAS_MAX_PATHS_PER_CLIENT);
+				rc = -EINVAL;
+				goto free_mem;
+			}
+
+			memcpy(&agg_vote->axi_path[num_paths],
+				&top_priv->req_axi_vote[i].axi_path[0],
+				top_priv->req_axi_vote[i].num_paths *
+				sizeof(
+				struct cam_cpas_axi_per_path_bw_vote));
+			num_paths += top_priv->req_axi_vote[i].num_paths;
+		}
+	}
+
+	agg_vote->num_paths = num_paths;
+
+	for (i = 0; i < agg_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"tfe[%d] : New BW Vote : counter[%d] [%s][%s] [%llu %llu %llu]",
+			top_priv->common_data.hw_intf->hw_idx,
+			top_priv->last_counter,
+			cam_cpas_axi_util_path_type_to_string(
+			agg_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			agg_vote->axi_path[i].transac_type),
+			agg_vote->axi_path[i].camnoc_bw,
+			agg_vote->axi_path[i].mnoc_ab_bw,
+			agg_vote->axi_path[i].mnoc_ib_bw);
+
+		total_bw_new_vote += agg_vote->axi_path[i].camnoc_bw;
+	}
+
+	memcpy(&top_priv->last_vote[top_priv->last_counter], agg_vote,
+		sizeof(struct cam_axi_vote));
+	top_priv->last_counter = (top_priv->last_counter + 1) %
+		(CAM_TFE_TOP_IN_PORT_MAX *
+		CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES);
+
+	if ((agg_vote->num_paths != top_priv->applied_axi_vote.num_paths) ||
+		(total_bw_new_vote != top_priv->total_bw_applied))
+		bw_unchanged = false;
+
+	CAM_DBG(CAM_PERF,
+		"tfe[%d] : applied_total=%lld, new_total=%lld unchanged=%d, start_stop=%d",
+		top_priv->common_data.hw_intf->hw_idx,
+		top_priv->total_bw_applied, total_bw_new_vote,
+		bw_unchanged, start_stop);
+
+	if (bw_unchanged) {
+		CAM_DBG(CAM_ISP, "BW config unchanged");
+		rc = 0;
+		goto free_mem;
+	}
+
+	if (start_stop) {
+		/* need to vote current request immediately */
+		to_be_applied_axi_vote = agg_vote;
+		/* Reset everything, we can start afresh */
+		memset(top_priv->last_vote, 0x0, sizeof(struct cam_axi_vote) *
+			(CAM_TFE_TOP_IN_PORT_MAX *
+			CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES));
+		top_priv->last_counter = 0;
+		top_priv->last_vote[top_priv->last_counter] = *agg_vote;
+		top_priv->last_counter = (top_priv->last_counter + 1) %
+			(CAM_TFE_TOP_IN_PORT_MAX *
+			CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES);
+	} else {
+		/*
+		 * Find max bw request in last few frames. This will the bw
+		 * that we want to vote to CPAS now.
+		 */
+		to_be_applied_axi_vote =
+			cam_tfe_top_delay_bw_reduction(top_priv,
+			&total_bw_new_vote);
+		if (!to_be_applied_axi_vote) {
+			CAM_ERR(CAM_ISP, "to_be_applied_axi_vote is NULL");
+			rc = -EINVAL;
+			goto free_mem;
+		}
+	}
+
+	for (i = 0; i < to_be_applied_axi_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"tfe[%d] : Apply BW Vote : [%s][%s] [%llu %llu %llu]",
+			top_priv->common_data.hw_intf->hw_idx,
+			cam_cpas_axi_util_path_type_to_string(
+			to_be_applied_axi_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			to_be_applied_axi_vote->axi_path[i].transac_type),
+			to_be_applied_axi_vote->axi_path[i].camnoc_bw,
+			to_be_applied_axi_vote->axi_path[i].mnoc_ab_bw,
+			to_be_applied_axi_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	if ((to_be_applied_axi_vote->num_paths !=
+		top_priv->applied_axi_vote.num_paths) ||
+		(total_bw_new_vote != top_priv->total_bw_applied))
+		apply_bw_update = true;
+
+	CAM_DBG(CAM_PERF,
+		"tfe[%d] : Delayed update: applied_total=%lld, new_total=%lld apply_bw_update=%d, start_stop=%d",
+		top_priv->common_data.hw_intf->hw_idx,
+		top_priv->total_bw_applied, total_bw_new_vote,
+		apply_bw_update, start_stop);
+
+	if (apply_bw_update) {
+		rc = cam_cpas_update_axi_vote(soc_private->cpas_handle,
+			to_be_applied_axi_vote);
+		if (!rc) {
+			memcpy(&top_priv->applied_axi_vote,
+				to_be_applied_axi_vote,
+				sizeof(struct cam_axi_vote));
+			top_priv->total_bw_applied = total_bw_new_vote;
+		} else {
+			CAM_ERR(CAM_ISP, "BW request failed, rc=%d", rc);
+		}
+	}
+
+free_mem:
+	cam_free_clear((void *)agg_vote);
+	agg_vote = NULL;
+	return rc;
+}
+
+static int cam_tfe_top_get_base(struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_tfe_soc_private       *soc_private;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid args");
+		return -EINVAL;
+	}
+
+	soc_private = top_priv->common_data.soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "soc_private is null");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(
+		top_priv->common_data.soc_info, TFE_CORE_BASE_IDX);
+	if (mem_base == -1) {
+		CAM_ERR(CAM_ISP, "failed to get mem_base, index: %d num_reg_map: %u",
+			TFE_CORE_BASE_IDX, top_priv->common_data.soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	if (cdm_args->cdm_id == CAM_CDM_RT) {
+		if (!soc_private->rt_wrapper_base) {
+			CAM_ERR(CAM_ISP, "rt_wrapper_base_addr is null");
+			return -EINVAL;
+		}
+
+		mem_base -= soc_private->rt_wrapper_base;
+	}
+
+	cdm_util_ops->cdm_write_changebase(cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_tfe_top_update_mup(
+	struct cam_tfe_top_priv *top_priv,
+	struct cam_isp_mode_switch_data *mup_config)
+{
+	uint32_t mup_val = 0, final_mup = 0;
+	struct cam_tfe_top_reg_offset_common *common_reg;
+
+	mup_val = mup_config->mup;
+	common_reg = top_priv->common_data.common_reg;
+
+	if (mup_config->mup_en) {
+		final_mup = (mup_val << common_reg->mup_shift_val);
+		top_priv->last_mup_val = mup_val;
+	} else {
+		final_mup = (top_priv->last_mup_val << common_reg->mup_shift_val);
+	}
+
+	return final_mup;
+}
+
+static int cam_tfe_top_get_reg_update(
+	struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	int                               rc = 0;
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2] = {0};
+	struct cam_isp_hw_get_cmd_update *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_tfe_camif_data        *camif_rsrc_data = NULL;
+	struct cam_tfe_rdi_data          *rdi_rsrc_data = NULL;
+	struct cam_isp_resource_node     *in_res;
+	struct cam_isp_mode_switch_data  *mup_config = NULL;
+	struct cam_hw_soc_info           *soc_info;
+	struct cam_tfe_top_reg_offset_common *common_reg;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_info = top_priv->common_data.soc_info;
+	in_res = cdm_args->res;
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((!cdm_args->reg_write) && ((size * 4) > cdm_args->cmd.size)) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (in_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+		camif_rsrc_data =  in_res->res_priv;
+		if (camif_rsrc_data->shdr_en && !camif_rsrc_data->is_shdr_master) {
+			CAM_DBG(CAM_ISP, "Skip reg update cmd for slave camif");
+			goto end;
+		}
+		reg_val_pair[0] = camif_rsrc_data->camif_reg->reg_update_cmd;
+		reg_val_pair[1] =
+			camif_rsrc_data->reg_data->reg_update_cmd_data;
+	} else if ((in_res->res_id >= CAM_ISP_HW_TFE_IN_RDI0) &&
+		(in_res->res_id <= CAM_ISP_HW_TFE_IN_RDI2)) {
+		rdi_rsrc_data =  in_res->res_priv;
+		reg_val_pair[0] = rdi_rsrc_data->rdi_reg->reg_update_cmd;
+		reg_val_pair[1] = rdi_rsrc_data->reg_data->reg_update_cmd_data;
+	} else if (in_res->res_id == CAM_ISP_HW_TFE_IN_PDLIB) {
+		/*REG CMD is not supported in PDLIB. PD CAMIF takes RUP from IPP CAMIF */
+		CAM_DBG(CAM_ISP, "Reg update not supported for res %d",
+			in_res->res_id);
+		cdm_args->cmd.used_bytes = 0;
+		goto end;
+	} else {
+		CAM_ERR(CAM_ISP, "Unknown resource with res_id = %d", in_res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	common_reg = top_priv->common_data.common_reg;
+	if (common_reg->mup_supported) {
+		if (!cdm_args->data) {
+			CAM_ERR(CAM_ISP, "invalid data (NULL), TFE: %d mup_supported :%d",
+					top_priv->common_data.hw_intf->hw_idx , cdm_args->data);
+			return -EINVAL;
+		}
+		mup_config = (struct cam_isp_mode_switch_data *) cdm_args->data;
+		reg_val_pair[1] |= cam_tfe_top_update_mup(top_priv, mup_config);
+		CAM_DBG(CAM_ISP, "MUP supported, TFE: %d final reg_up cmd: 0x%x",
+				top_priv->common_data.hw_intf->hw_idx, reg_val_pair[1]);
+	}
+
+	if (cdm_args->reg_write) {
+		cam_io_w_mb(reg_val_pair[1],
+			soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base + reg_val_pair[0]);
+	} else {
+		cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+			1, reg_val_pair);
+		cdm_args->cmd.used_bytes = size * 4;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_tfe_top_init_config_update(
+	struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	int i = 0;
+	struct cam_isp_hw_init_config_update *init_cfg = NULL;
+	struct cam_isp_resource_node *rsrc_node = NULL;
+	struct cam_tfe_camif_data *camif_data;
+
+	init_cfg = (struct cam_isp_hw_init_config_update *)cmd_args;
+
+	if (arg_size != sizeof(struct cam_isp_hw_init_config_update)) {
+		CAM_ERR(CAM_ISP, "Invalid args size expected: %zu actual: %zu",
+			sizeof(struct cam_isp_hw_init_config_update), arg_size);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->in_rsrc[i].res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+			rsrc_node = &top_priv->in_rsrc[i];
+			break;
+		}
+	}
+
+	if (!rsrc_node) {
+		CAM_ERR(CAM_ISP, "TFE %d null input res node",
+			top_priv->common_data.hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	if (rsrc_node->res_type != CAM_ISP_RESOURCE_TFE_IN) {
+		CAM_ERR(CAM_ISP, "TFE %d Invalid res_type %d res id %d ",
+			rsrc_node->hw_intf->hw_idx, rsrc_node->res_type,
+			rsrc_node->res_id);
+		return -EINVAL;
+	}
+
+	camif_data = (struct cam_tfe_camif_data *)rsrc_node->res_priv;
+	camif_data->epoch_factor = init_cfg->init_config->epoch_cfg.epoch_factor;
+
+	CAM_DBG(CAM_ISP,
+		"Init Update TFE %d res type: %d res id %d epoch_factor: %u",
+		rsrc_node->hw_intf->hw_idx, rsrc_node->res_type,
+		rsrc_node->res_id, camif_data->epoch_factor);
+
+	return 0;
+}
+
+static int cam_tfe_top_clock_update(
+	struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_clock_update_args     *clk_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   i, rc = 0;
+
+	clk_update =
+		(struct cam_tfe_clock_update_args *)cmd_args;
+	res = clk_update->node_res;
+
+	if (!res || !res->hw_intf->hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid input res %pK", res);
+		return -EINVAL;
+	}
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_TFE_IN ||
+		res->res_id >= CAM_ISP_HW_TFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			top_priv->req_clk_rate[i] = clk_update->clk_rate;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_DBG(CAM_ISP,
+			"TFE:%d Not ready to set clocks yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else
+		rc = cam_tfe_top_set_hw_clk_rate(top_priv);
+
+	return rc;
+}
+
+static int cam_tfe_top_bw_update(
+	struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bw_update_args        *bw_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_update = (struct cam_tfe_bw_update_args *)cmd_args;
+	res = bw_update->node_res;
+
+	if (!res || !res->hw_intf || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_TFE_IN ||
+		res->res_id >= CAM_ISP_HW_TFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_ISP_HW_TFE_IN_MAX; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			memcpy(&top_priv->req_axi_vote[i], &bw_update->isp_vote,
+				sizeof(struct cam_axi_vote));
+			top_priv->axi_vote_control[i] =
+				CAM_TFE_BW_CONTROL_INCLUDE;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"TFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_tfe_top_set_axi_bw_vote(top_priv, false);
+	}
+
+	return rc;
+}
+
+static int cam_tfe_top_bw_control(
+	struct cam_tfe_top_priv *top_priv,
+	 void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bw_control_args       *bw_ctrl = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_ctrl = (struct cam_tfe_bw_control_args *)cmd_args;
+	res = bw_ctrl->node_res;
+
+	if (!res || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_TFE_IN ||
+		res->res_id >= CAM_ISP_HW_TFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			top_priv->axi_vote_control[i] = bw_ctrl->action;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"TFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_tfe_top_set_axi_bw_vote(top_priv, true);
+	}
+
+	return rc;
+}
+
+static int cam_tfe_set_sync_hw_idx(
+	struct cam_tfe_hw_core_info *core_info,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv              *top_priv;
+	uint32_t                             *hw_idx;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	hw_idx = (uint32_t *)cmd_args;
+	top_priv->sync_hw_id = *hw_idx;
+
+	CAM_DBG(CAM_ISP, "TFE:%d top sync hw idx %d", core_info->core_index,
+		top_priv->sync_hw_id);
+	return 0;
+}
+
+static int cam_tfe_top_get_reg_dump(
+	struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update  *reg_dump_cmd = cmd_args;
+	struct cam_tfe_soc_private        *soc_private;
+	struct cam_tfe_reg_dump_data      *reg_dump_data;
+	struct cam_hw_soc_info            *soc_info;
+	void __iomem                      *mem_base;
+	int i, j, num_reg_dump_entries;
+	uint32_t val_0, val_1, val_2, val_3, wm_offset, start_offset;
+	uint32_t end_offset, lut_word_size, lut_size, lut_bank_sel, lut_dmi_reg;
+
+	if (!reg_dump_cmd) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((reg_dump_cmd->res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(reg_dump_cmd->res->res_state ==
+		CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = top_priv->common_data.soc_info->soc_private;
+	mem_base = soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+	CAM_INFO(CAM_ISP, "dump tfe:%d registers",
+		top_priv->common_data.hw_intf->hw_idx);
+
+	reg_dump_data = top_priv->common_data.reg_dump_data;
+	num_reg_dump_entries = reg_dump_data->num_reg_dump_entries;
+	for (i = 0; i < num_reg_dump_entries; i++) {
+		start_offset = reg_dump_data->reg_entry[i].start_offset;
+		end_offset = reg_dump_data->reg_entry[i].end_offset;
+
+		for (j = start_offset; (j + 0xc) <= end_offset; j += 0x10) {
+			val_0 = cam_io_r_mb(mem_base + j);
+			val_1 = cam_io_r_mb(mem_base + j + 4);
+			val_2 = cam_io_r_mb(mem_base + j + 0x8);
+			val_3 = cam_io_r_mb(mem_base + j + 0xc);
+			CAM_INFO(CAM_ISP, "0x%04x=0x%08x 0x%08x 0x%08x 0x%08x",
+				j, val_0, val_1, val_2, val_3);
+		}
+	}
+
+	num_reg_dump_entries = reg_dump_data->num_lut_dump_entries;
+	for (i = 0; i < num_reg_dump_entries; i++) {
+		lut_bank_sel = reg_dump_data->lut_entry[i].lut_bank_sel;
+		lut_size = reg_dump_data->lut_entry[i].lut_addr_size;
+		lut_word_size = reg_dump_data->lut_entry[i].lut_word_size;
+		lut_dmi_reg = reg_dump_data->lut_entry[i].dmi_reg_offset;
+
+		cam_io_w_mb(lut_bank_sel, mem_base + lut_dmi_reg + 4);
+		cam_io_w_mb(0, mem_base + 0xC28);
+
+		for (j = 0; j < lut_size; j++) {
+			val_0 = cam_io_r_mb(mem_base + 0xC30);
+			CAM_INFO(CAM_ISP, "Bank%d:0x%x LO: 0x%x",
+				lut_bank_sel, j, val_0);
+		}
+	}
+	/* No mem selected */
+	cam_io_w_mb(0, mem_base + 0xC24);
+	cam_io_w_mb(0, mem_base + 0xC28);
+
+	start_offset = reg_dump_data->bus_start_addr;
+	end_offset = reg_dump_data->bus_write_top_end_addr;
+
+	CAM_INFO(CAM_ISP, "bus start addr:0x%x end_offset:0x%x",
+		start_offset, end_offset);
+
+	for (i = start_offset; (i + 0xc) <= end_offset; i += 0x10) {
+		val_0 = cam_io_r_mb(mem_base + i);
+		val_1 = cam_io_r_mb(mem_base + i + 4);
+		val_2 = cam_io_r_mb(mem_base + i + 0x8);
+		val_3 = cam_io_r_mb(mem_base + i + 0xc);
+		CAM_INFO(CAM_ISP, "0x%04x=0x%08x 0x%08x 0x%08x 0x%08x",
+			i, val_0, val_1, val_2, val_3);
+	}
+
+	wm_offset = reg_dump_data->bus_client_start_addr;
+
+	CAM_INFO(CAM_ISP, "bus wm offset:0x%x",
+		wm_offset);
+
+	for (j = 0; j < reg_dump_data->num_bus_clients; j++) {
+		for (i = 0x0; (i + 0xc) <= 0x3C; i += 0x10) {
+			val_0 = cam_io_r_mb(mem_base + wm_offset + i);
+			val_1 = cam_io_r_mb(mem_base + wm_offset + i + 4);
+			val_2 = cam_io_r_mb(mem_base + wm_offset + i + 0x8);
+			val_3 = cam_io_r_mb(mem_base + wm_offset + i + 0xc);
+			CAM_INFO(CAM_ISP, "0x%04x=0x%08x 0x%08x 0x%08x 0x%08x",
+				(wm_offset + i), val_0, val_1, val_2, val_3);
+		}
+		for (i = 0x60; (i + 0xc) <= 0x80; i += 0x10) {
+			val_0 = cam_io_r_mb(mem_base + wm_offset + i);
+			val_1 = cam_io_r_mb(mem_base + wm_offset + i + 4);
+			val_2 = cam_io_r_mb(mem_base + wm_offset + i + 0x8);
+			val_3 = cam_io_r_mb(mem_base + wm_offset + i + 0xc);
+			CAM_INFO(CAM_ISP, "0x%04x=0x%08x 0x%08x 0x%08x 0x%08x",
+				(wm_offset + i), val_0, val_1, val_2, val_3);
+		}
+		wm_offset += reg_dump_data->bus_client_offset;
+	}
+
+	cam_cpas_dump_camnoc_buff_fill_info(soc_private->cpas_handle);
+
+	/* dump the clock votings */
+	CAM_INFO(CAM_ISP, "TFE:%d clk=%ld",
+		top_priv->common_data.hw_intf->hw_idx,
+		top_priv->hw_clk_rate);
+
+	return 0;
+}
+
+static int cam_tfe_hw_dump(
+	struct cam_tfe_hw_core_info *core_info,
+	void                        *cmd_args,
+	uint32_t                     arg_size)
+{
+	int                                i, j;
+	uint8_t                           *dst;
+	uint32_t                           reg_start_offset;
+	uint32_t                           reg_dump_size = 0;
+	uint32_t                           lut_dump_size = 0;
+	uint32_t                           num_lut_dump_entries = 0;
+	uint32_t                           num_reg;
+	uint32_t                           lut_word_size, lut_size;
+	uint32_t                           lut_bank_sel, lut_dmi_reg;
+	void __iomem                      *reg_base;
+	void __iomem                      *mem_base;
+	uint32_t                          *addr, *start;
+	uint64_t                          *clk_waddr, *clk_wstart;
+	size_t                             remain_len;
+	uint32_t                           min_len;
+	struct cam_hw_info                *tfe_hw_info;
+	struct cam_hw_soc_info            *soc_info;
+	struct cam_tfe_top_priv           *top_priv;
+	struct cam_tfe_soc_private        *soc_private;
+	struct cam_tfe_reg_dump_data      *reg_dump_data;
+	struct cam_isp_hw_dump_header     *hdr;
+	struct cam_isp_hw_dump_args       *dump_args =
+		(struct cam_isp_hw_dump_args *)cmd_args;
+
+	if (!dump_args || !core_info) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (!dump_args->cpu_addr || !dump_args->buf_len) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params %pK %zu",
+			(void *)dump_args->cpu_addr,
+			dump_args->buf_len);
+		return -EINVAL;
+	}
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ISP,
+			"Dump offset overshoot offset %zu buf_len %zu",
+			dump_args->offset, dump_args->buf_len);
+		return -ENOSPC;
+	}
+
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	tfe_hw_info =
+		(struct cam_hw_info *)(top_priv->common_data.hw_intf->hw_priv);
+	reg_dump_data = top_priv->common_data.reg_dump_data;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = top_priv->common_data.soc_info->soc_private;
+	mem_base = soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+
+	if (dump_args->is_dump_all) {
+
+		/*Dump registers size*/
+		for (i = 0; i < reg_dump_data->num_reg_dump_entries; i++)
+			reg_dump_size +=
+				(reg_dump_data->reg_entry[i].end_offset -
+				reg_dump_data->reg_entry[i].start_offset);
+
+		/*
+		 * We dump the offset as well, so the total size dumped becomes
+		 * multiplied by 2
+		 */
+		reg_dump_size *= 2;
+
+		/* LUT dump size */
+		for (i = 0; i < reg_dump_data->num_lut_dump_entries; i++)
+			lut_dump_size +=
+				((reg_dump_data->lut_entry[i].lut_addr_size) *
+				(reg_dump_data->lut_entry[i].lut_word_size/8));
+
+		num_lut_dump_entries = reg_dump_data->num_lut_dump_entries;
+	}
+
+	/*Minimum len comprises of:
+	 * lut_dump_size + reg_dump_size + sizeof dump_header +
+	 * (num_lut_dump_entries--> represents number of banks) +
+	 *  (misc number of words) * sizeof(uint32_t)
+	 */
+	min_len = lut_dump_size + reg_dump_size +
+		sizeof(struct cam_isp_hw_dump_header) +
+		(num_lut_dump_entries * sizeof(uint32_t)) +
+		(sizeof(uint32_t) * CAM_TFE_CORE_DUMP_MISC_NUM_WORDS);
+
+	remain_len = dump_args->buf_len - dump_args->offset;
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu, min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+
+	mutex_lock(&tfe_hw_info->hw_mutex);
+	if (tfe_hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "TFE:%d HW not powered up",
+			core_info->core_index);
+		mutex_unlock(&tfe_hw_info->hw_mutex);
+		return -EPERM;
+	}
+
+	if (!dump_args->is_dump_all)
+		goto dump_bw;
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	hdr->word_size = sizeof(uint32_t);
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "TFE_REG:");
+	addr = (uint32_t *)(dst + sizeof(struct cam_isp_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+	for (i = 0; i < reg_dump_data->num_reg_dump_entries; i++) {
+		num_reg  = (reg_dump_data->reg_entry[i].end_offset -
+			reg_dump_data->reg_entry[i].start_offset)/4;
+		reg_start_offset = reg_dump_data->reg_entry[i].start_offset;
+		reg_base = mem_base + reg_start_offset;
+		for (j = 0; j < num_reg; j++) {
+			addr[0] =
+				soc_info->mem_block[TFE_CORE_BASE_IDX]->start +
+				reg_start_offset + (j*4);
+			addr[1] = cam_io_r(reg_base + (j*4));
+			addr += 2;
+		}
+	}
+
+	/*Dump bus top registers*/
+	num_reg  = (reg_dump_data->bus_write_top_end_addr -
+			reg_dump_data->bus_start_addr)/4;
+	reg_base = mem_base + reg_dump_data->bus_start_addr;
+	reg_start_offset = soc_info->mem_block[TFE_CORE_BASE_IDX]->start +
+		reg_dump_data->bus_start_addr;
+	for (i = 0; i < num_reg; i++) {
+		addr[0] = reg_start_offset + (i*4);
+		addr[1] = cam_io_r(reg_base + (i*4));
+		addr += 2;
+	}
+
+	/* Dump bus clients */
+	reg_base = mem_base + reg_dump_data->bus_client_start_addr;
+	reg_start_offset = soc_info->mem_block[TFE_CORE_BASE_IDX]->start +
+		reg_dump_data->bus_client_start_addr;
+	for (j = 0; j < reg_dump_data->num_bus_clients; j++) {
+
+		for (i = 0; i <= 0x3c; i += 4) {
+			addr[0] = reg_start_offset + i;
+			addr[1] = cam_io_r(reg_base + i);
+			addr += 2;
+		}
+		for (i = 0x60; i <= 0x80; i += 4) {
+			addr[0] = reg_start_offset + (i*4);
+			addr[1] = cam_io_r(reg_base + (i*4));
+			addr += 2;
+		}
+		reg_base += reg_dump_data->bus_client_offset;
+		reg_start_offset += reg_dump_data->bus_client_offset;
+	}
+
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+
+	/* Dump LUT entries */
+	for (i = 0; i < reg_dump_data->num_lut_dump_entries; i++) {
+
+		lut_bank_sel = reg_dump_data->lut_entry[i].lut_bank_sel;
+		lut_size = reg_dump_data->lut_entry[i].lut_addr_size;
+		lut_word_size = reg_dump_data->lut_entry[i].lut_word_size;
+		lut_dmi_reg = reg_dump_data->lut_entry[i].dmi_reg_offset;
+		dst = (char *)dump_args->cpu_addr + dump_args->offset;
+		hdr = (struct cam_isp_hw_dump_header *)dst;
+		scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "LUT_REG:");
+		hdr->word_size = lut_word_size/8;
+		addr = (uint32_t *)(dst +
+			sizeof(struct cam_isp_hw_dump_header));
+		start = addr;
+		*addr++ = lut_bank_sel;
+		cam_io_w_mb(lut_bank_sel, mem_base + lut_dmi_reg + 4);
+		cam_io_w_mb(0, mem_base + 0xC28);
+		for (j = 0; j < lut_size; j++) {
+			*addr = cam_io_r_mb(mem_base + 0xc30);
+			addr++;
+		}
+		hdr->size = hdr->word_size * (addr - start);
+		dump_args->offset +=  hdr->size +
+			sizeof(struct cam_isp_hw_dump_header);
+	}
+	cam_io_w_mb(0, mem_base + 0xC24);
+	cam_io_w_mb(0, mem_base + 0xC28);
+
+dump_bw:
+	dst = (char *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "TFE_CLK_RATE_BW:");
+	clk_waddr = (uint64_t *)(dst +
+		sizeof(struct cam_isp_hw_dump_header));
+	clk_wstart = clk_waddr;
+	hdr->word_size = sizeof(uint64_t);
+	*clk_waddr++ = top_priv->hw_clk_rate;
+	*clk_waddr++ = top_priv->total_bw_applied;
+
+	hdr->size = hdr->word_size * (clk_waddr - clk_wstart);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+
+	dst = (char *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "TFE_NIU_MAXWR:");
+	addr = (uint32_t *)(dst +
+		sizeof(struct cam_isp_hw_dump_header));
+	start = addr;
+	hdr->word_size = sizeof(uint32_t);
+
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+	mutex_unlock(&tfe_hw_info->hw_mutex);
+
+	CAM_DBG(CAM_ISP, "offset %zu", dump_args->offset);
+	return 0;
+}
+
+static int cam_tfe_camif_irq_reg_dump(
+	struct cam_tfe_hw_core_info    *core_info,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv            *top_priv;
+	struct cam_isp_hw_get_cmd_update   *cmd_update;
+	struct cam_isp_resource_node       *camif_res = NULL;
+	void __iomem                       *mem_base;
+	uint32_t i;
+
+	int rc = 0;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments\n");
+		return -EINVAL;
+	}
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	cmd_update = (struct cam_isp_hw_get_cmd_update  *)cmd_args;
+	camif_res = cmd_update->res;
+	mem_base = top_priv->common_data.soc_info->reg_map[0].mem_base;
+	if ((camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)) {
+		CAM_ERR(CAM_ISP, "Error! Invalid state\n");
+		return 0;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++) {
+		CAM_INFO(CAM_ISP,
+			"Core Id =%d TOP IRQ status[%d ] val 0x%x",
+			core_info->core_index, i,
+			cam_io_r_mb(mem_base +
+			core_info->tfe_hw_info->top_irq_status[i]));
+	}
+
+	for (i = 0; i < CAM_TFE_BUS_MAX_IRQ_REGISTERS; i++) {
+		CAM_INFO(CAM_ISP,
+			"Core Id =%d BUS IRQ status[%d ] val:0x%x",
+			core_info->core_index, i,
+			cam_io_r_mb(mem_base +
+			core_info->tfe_hw_info->bus_irq_status[i]));
+	}
+
+	return rc;
+}
+
+int cam_tfe_set_top_debug(struct cam_tfe_hw_core_info    *core_info,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv              *top_priv;
+	uint32_t                             *debug_val;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	debug_val = (uint32_t  *)cmd_args;
+	top_priv->top_debug =  *debug_val;
+
+	CAM_DBG(CAM_ISP, "TFE:%d top debug set:%d",
+		core_info->core_index,
+		top_priv->top_debug);
+
+	return 0;
+}
+
+static int cam_tfe_bus_get_path_port_map(void *top_hw_info,
+		void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_path_port_map *arg = cmd_args;
+	struct cam_tfe_top_hw_info *hw_info =
+		(struct cam_tfe_top_hw_info  *)top_hw_info;
+	int i;
+
+	for (i = 0; i < hw_info->num_path_port_map; i++) {
+		arg->entry[i][0] = hw_info->path_port_map[i][0];
+		arg->entry[i][1] = hw_info->path_port_map[i][1];
+	}
+	arg->num_entries = hw_info->num_path_port_map;
+
+	return 0;
+}
+
+int cam_tfe_top_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv                 *top_priv;
+	struct cam_tfe_acquire_args             *args;
+	struct cam_tfe_hw_tfe_in_acquire_args   *acquire_args;
+	struct cam_tfe_camif_data               *camif_data;
+	struct cam_tfe_ppp_data                 *ppp_data;
+	struct cam_tfe_rdi_data                 *rdi_data;
+	uint32_t i;
+	int rc = -EINVAL;
+
+	if (!device_priv || !reserve_args) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv   *)device_priv;
+	args = (struct cam_tfe_acquire_args *)reserve_args;
+	acquire_args = &args->tfe_in;
+	top_priv->last_mup_val = 0;
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		CAM_DBG(CAM_ISP, "i :%d res_id:%d state:%d", i,
+			acquire_args->res_id, top_priv->in_rsrc[i].res_state);
+
+		if ((top_priv->in_rsrc[i].res_id == acquire_args->res_id) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_AVAILABLE)) {
+			rc = cam_tfe_validate_pix_pattern(
+				acquire_args->in_port->pix_pattern);
+			if (rc)
+				return rc;
+
+			if (acquire_args->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+				camif_data = (struct cam_tfe_camif_data    *)
+					top_priv->in_rsrc[i].res_priv;
+				camif_data->pix_pattern =
+					acquire_args->in_port->pix_pattern;
+				camif_data->dsp_mode =
+					acquire_args->in_port->dsp_mode;
+				camif_data->left_first_pixel =
+					acquire_args->in_port->left_start;
+				camif_data->left_last_pixel =
+					acquire_args->in_port->left_end;
+				camif_data->right_first_pixel =
+					acquire_args->in_port->right_start;
+				camif_data->right_last_pixel =
+					acquire_args->in_port->right_end;
+				camif_data->first_line =
+					acquire_args->in_port->line_start;
+				camif_data->last_line =
+					acquire_args->in_port->line_end;
+				if (acquire_args->in_port->res_id == CAM_ISP_TFE_IN_RES_TPG)
+					camif_data->vbi_value = 0;
+				else
+					camif_data->vbi_value =
+						acquire_args->in_port->sensor_vbi;
+				camif_data->hbi_value =
+					acquire_args->in_port->sensor_hbi;
+				camif_data->camif_pd_enable =
+					acquire_args->camif_pd_enable;
+				camif_data->dual_tfe_sync_sel =
+					acquire_args->dual_tfe_sync_sel_idx;
+				camif_data->sync_mode = acquire_args->sync_mode;
+				camif_data->event_cb = args->event_cb;
+				camif_data->priv = args->priv;
+				camif_data->qcfa_bin =
+					acquire_args->in_port->qcfa_bin;
+				camif_data->bayer_bin =
+					acquire_args->in_port->bayer_bin;
+				camif_data->core_cfg =
+					acquire_args->in_port->core_cfg;
+				camif_data->shdr_en = acquire_args->in_port->shdr_en;
+				camif_data->is_shdr_master = acquire_args->in_port->is_shdr_master;
+
+				CAM_DBG(CAM_ISP,
+					"TFE:%d pix_pattern:%d dsp_mode=%d",
+					top_priv->in_rsrc[i].hw_intf->hw_idx,
+					camif_data->pix_pattern,
+					camif_data->dsp_mode);
+			} else if (acquire_args->res_id == CAM_ISP_HW_TFE_IN_PDLIB) {
+				ppp_data = (struct cam_tfe_ppp_data	*)
+					top_priv->in_rsrc[i].res_priv;
+				ppp_data->pix_pattern =
+					acquire_args->in_port->pix_pattern;
+				ppp_data->sync_mode = acquire_args->sync_mode;
+				ppp_data->event_cb = args->event_cb;
+				ppp_data->priv = args->priv;
+				ppp_data->left_first_pixel =
+					acquire_args->in_port->left_start;
+				ppp_data->left_last_pixel =
+					acquire_args->in_port->left_end;
+				ppp_data->first_line =
+					acquire_args->in_port->line_start;
+				ppp_data->last_line =
+					acquire_args->in_port->line_end;
+				ppp_data->lcr_enable =
+					acquire_args->lcr_enable;
+				ppp_data->core_cfg = acquire_args->in_port->core_cfg;
+			} else {
+				rdi_data = (struct cam_tfe_rdi_data      *)
+					top_priv->in_rsrc[i].res_priv;
+				rdi_data->pix_pattern =
+					acquire_args->in_port->pix_pattern;
+				rdi_data->sync_mode = acquire_args->sync_mode;
+				rdi_data->event_cb = args->event_cb;
+				rdi_data->priv = args->priv;
+				rdi_data->left_first_pixel =
+					acquire_args->in_port->left_start;
+				rdi_data->left_last_pixel =
+					acquire_args->in_port->left_end;
+				rdi_data->first_line =
+					acquire_args->in_port->line_start;
+				rdi_data->last_line =
+					acquire_args->in_port->line_end;
+				rdi_data->shdr_en = acquire_args->in_port->shdr_en;
+				rdi_data->is_shdr_master = acquire_args->in_port->is_shdr_master;
+			}
+
+			top_priv->in_rsrc[i].cdm_ops = acquire_args->cdm_ops;
+			top_priv->in_rsrc[i].tasklet_info = args->tasklet;
+			top_priv->in_rsrc[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			top_priv->tasklet_info = args->tasklet;
+			acquire_args->rsrc_node =
+				&top_priv->in_rsrc[i];
+			rc = 0;
+			break;
+		}
+	}
+
+	return rc;
+}
+
+int cam_tfe_top_release(void *device_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv            *top_priv;
+	struct cam_isp_resource_node       *in_res;
+
+	if (!device_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv   *)device_priv;
+	in_res = (struct cam_isp_resource_node *)release_args;
+
+	CAM_DBG(CAM_ISP, "TFE:%d resource id:%d in state %d",
+		in_res->hw_intf->hw_idx, in_res->res_id,
+		in_res->res_state);
+	if (in_res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Resource Invalid res_state :%d",
+			in_res->hw_intf->hw_idx, in_res->res_state);
+		return -EINVAL;
+	}
+	in_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	in_res->cdm_ops = NULL;
+	in_res->tasklet_info = NULL;
+	in_res->is_rdi_primary_res = 0;
+
+	return 0;
+}
+
+static int cam_tfe_camif_resource_start(
+	struct cam_tfe_hw_core_info         *core_info,
+	struct cam_isp_resource_node        *camif_res)
+{
+	struct cam_tfe_camif_data           *rsrc_data;
+	struct cam_tfe_soc_private          *soc_private;
+	struct cam_tfe_top_priv             *top_priv;
+	uint32_t                             val = 0, epoch_factor = 50;
+	uint32_t                             epoch0_irq_mask;
+	uint32_t                             epoch1_irq_mask;
+	uint32_t                             computed_epoch_line_cfg;
+	uint32_t                             camera_hw_version = 0;
+	struct cam_hw_intf                  *tfe_device;
+	bool                                 pdaf_rdi2_mux_en = false;
+	struct cam_tfe_top_reg_offset_common *common_reg;
+
+	if (!camif_res || !core_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Invalid camif res res_state:%d",
+			core_info->core_index, camif_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_tfe_camif_data  *)camif_res->res_priv;
+	soc_private = rsrc_data->soc_info->soc_private;
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error soc_private NULL",
+			core_info->core_index);
+		return -ENODEV;
+	}
+	common_reg = top_priv->common_data.common_reg;
+	/* Config tfe core*/
+	val = 0;
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val = (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	if ((rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) ||
+		(rsrc_data->sync_mode == CAM_ISP_HW_SYNC_MASTER)) {
+		val |= (1 << rsrc_data->reg_data->dual_tfe_pix_en_shift);
+		val |= ((rsrc_data->dual_tfe_sync_sel + CAM_TFE_DUAL_TFE_SYNC_SEL_IDX_FACTOR) <<
+			rsrc_data->reg_data->dual_tfe_sync_sel_shift);
+	}
+
+	tfe_device = rsrc_data->hw_intf;
+
+	tfe_device->hw_ops.process_cmd(tfe_device->hw_priv,
+		CAM_ISP_HW_CMD_IS_PDAF_RDI2_MUX_EN,
+		&pdaf_rdi2_mux_en,
+		sizeof(pdaf_rdi2_mux_en));
+
+	if (pdaf_rdi2_mux_en && !rsrc_data->camif_pd_enable)
+		val |= (1 << rsrc_data->reg_data->camif_pd_rdi2_src_sel_shift);
+
+	/* enables the Delay Line CLC in the pixel pipeline */
+	val |= BIT(rsrc_data->reg_data->delay_line_en_shift);
+
+	if (rsrc_data->common_reg->serializer_supported) {
+		val |= rsrc_data->core_cfg &
+			(1 << rsrc_data->reg_data->ai_c_srl_en_shift);
+
+		val |= rsrc_data->core_cfg &
+			(1 << rsrc_data->reg_data->ds16_c_srl_en_shift);
+
+		val |= rsrc_data->core_cfg &
+			(1 << rsrc_data->reg_data->ds4_c_srl_en_shift);
+	}
+
+	if (rsrc_data->shdr_en) {
+		val |= (1 << rsrc_data->reg_data->shdr_mode_shift);
+		val |= (1 << rsrc_data->reg_data->dual_tfe_pix_en_shift);
+		val |= ((top_priv->sync_hw_id + CAM_TFE_DUAL_TFE_SYNC_SEL_IDX_FACTOR) <<
+			rsrc_data->reg_data->dual_tfe_sync_sel_shift);
+		if (!rsrc_data->is_shdr_master) {
+			val |= (1 << rsrc_data->reg_data->extern_mup_shift);
+			val |= (1 << rsrc_data->reg_data->extern_reg_update_shift);
+		}
+	}
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	CAM_DBG(CAM_ISP, "TFE:%d core_cfg_0 val:0x%x", core_info->core_index,
+		cam_io_r_mb(rsrc_data->mem_base + rsrc_data->common_reg->core_cfg_0));
+
+	if (cam_cpas_get_cpas_hw_version(&camera_hw_version))
+		CAM_ERR(CAM_ISP, "Failed to get HW version");
+
+	if (camera_hw_version == CAM_CPAS_TITAN_540_V100) {
+		val = cam_io_r(rsrc_data->mem_base +
+			rsrc_data->common_reg->core_cfg_1);
+		val &= ~BIT(0);
+		cam_io_w_mb(val, rsrc_data->mem_base +
+			rsrc_data->common_reg->core_cfg_1);
+		CAM_DBG(CAM_ISP, "TFE:%d core_cfg 1 val:0x%x",
+			core_info->core_index, val);
+	}
+
+	/* Epoch config */
+	if ((rsrc_data->epoch_factor) && (rsrc_data->epoch_factor <= 100))
+		epoch_factor = rsrc_data->epoch_factor;
+
+	epoch0_irq_mask = (((rsrc_data->last_line + rsrc_data->vbi_value) -
+		rsrc_data->first_line) * epoch_factor / 100);
+
+	if (epoch0_irq_mask > (rsrc_data->last_line - rsrc_data->first_line))
+		epoch0_irq_mask = (rsrc_data->last_line -
+					rsrc_data->first_line);
+
+	if (rsrc_data->bayer_bin || rsrc_data->qcfa_bin)
+		epoch0_irq_mask >>= 1;
+
+	epoch1_irq_mask = rsrc_data->reg_data->epoch_line_cfg &
+			0xFFFF;
+	computed_epoch_line_cfg = (epoch0_irq_mask << common_reg->epoch_shift_val) |
+			epoch1_irq_mask;
+	cam_io_w_mb(computed_epoch_line_cfg,
+			rsrc_data->mem_base +
+			rsrc_data->camif_reg->epoch_irq_cfg);
+	CAM_DBG(CAM_ISP, "TFE:%d first_line: %u\n"
+			"last_line: %u\n"
+			"epoch_line_cfg: 0x%x epoch factor %d",
+			core_info->core_index,
+			rsrc_data->first_line,
+			rsrc_data->last_line,
+			computed_epoch_line_cfg, epoch_factor);
+
+	camif_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base + rsrc_data->camif_reg->reg_update_cmd);
+	CAM_DBG(CAM_ISP, "hw id:%d RUP val:%d", camif_res->hw_intf->hw_idx,
+		rsrc_data->reg_data->reg_update_cmd_data);
+
+	/* Disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
+	if (top_priv->top_debug & CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		val = cam_io_r_mb(rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+		val |= rsrc_data->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+	}
+
+	/* Enable the irq only for master or single tfe usecase */
+	if (rsrc_data->sync_mode != CAM_ISP_HW_SYNC_SLAVE)
+		cam_tfe_irq_config(core_info, rsrc_data->reg_data->subscribe_irq_mask,
+			CAM_TFE_TOP_IRQ_REG_NUM, true);
+
+	/* Program perf counters */
+	val = (1 << rsrc_data->reg_data->perf_cnt_start_cmd_shift) |
+		(1 << rsrc_data->reg_data->perf_cnt_continuous_shift) |
+		(1 << rsrc_data->reg_data->perf_client_sel_shift) |
+		(1 << rsrc_data->reg_data->perf_window_start_shift) |
+		(2 << rsrc_data->reg_data->perf_window_end_shift);
+	cam_io_w_mb(val,
+		rsrc_data->mem_base +
+		rsrc_data->common_reg->perf_cfg[0].perf_cnt_cfg);
+	CAM_DBG(CAM_ISP, "TFE:%d perf_cfg val:%d", core_info->core_index,
+		val);
+
+	/* Enable the top debug registers */
+	cam_io_w_mb(0x1,
+		rsrc_data->mem_base + rsrc_data->common_reg->debug_cfg);
+
+	CAM_DBG(CAM_ISP, "Start Camif TFE %d Done", core_info->core_index);
+	return 0;
+}
+
+static int cam_tfe_ppp_resource_start(
+	struct cam_tfe_hw_core_info         *core_info,
+	struct cam_isp_resource_node        *ppp_res)
+{
+	struct cam_tfe_ppp_data             *rsrc_data;
+	uint32_t                             val = 0;
+
+	if (!ppp_res || !core_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (ppp_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Invalid camif res res_state:%d",
+			core_info->core_index, ppp_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_tfe_ppp_data  *)ppp_res->res_priv;
+
+	val = cam_io_r_mb(rsrc_data->mem_base + rsrc_data->common_reg->core_cfg_0);
+
+	/* Config tfe core */
+	val |= (1 << rsrc_data->reg_data->pdaf_path_en_shift);
+
+	val |= (rsrc_data->core_cfg & (1 << rsrc_data->reg_data->lcr_dis_en_shift));
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	ppp_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	CAM_DBG(CAM_ISP, "TFE: %d Start PPP Done, core_cfg 0 val:0x%x",
+		core_info->core_index, val);
+	return 0;
+}
+
+int cam_tfe_top_start(struct cam_tfe_hw_core_info *core_info,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv                 *top_priv;
+	struct cam_isp_resource_node            *in_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_tfe_rdi_data                 *rsrc_rdi_data;
+	uint32_t val;
+	int rc = 0;
+
+	if (!start_args) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Invalid input arguments",
+			core_info->core_index);
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv *)core_info->top_priv;
+	in_res = (struct cam_isp_resource_node *)start_args;
+	hw_info = (struct cam_hw_info  *)in_res->hw_intf->hw_priv;
+	atomic_set(&top_priv->switch_out_of_sync_cnt, 0);
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "TFE:%d HW not powered up",
+			core_info->core_index);
+		rc = -EPERM;
+		goto end;
+	}
+
+	top_priv->last_mup_val = 0;
+	rc = cam_tfe_top_set_hw_clk_rate(top_priv);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d set_hw_clk_rate failed, rc=%d",
+			hw_info->soc_info.index, rc);
+		return rc;
+	}
+
+	rc = cam_tfe_top_set_axi_bw_vote(top_priv, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d set_axi_bw_vote failed, rc=%d",
+			core_info->core_index, rc);
+		return rc;
+	}
+
+	if (in_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+		cam_tfe_camif_resource_start(core_info, in_res);
+	} else if (in_res->res_id == CAM_ISP_HW_TFE_IN_PDLIB) {
+		cam_tfe_ppp_resource_start(core_info, in_res);
+	} else if (in_res->res_id >= CAM_ISP_HW_TFE_IN_RDI0 &&
+		in_res->res_id <= CAM_ISP_HW_TFE_IN_RDI2) {
+		rsrc_rdi_data = (struct cam_tfe_rdi_data *) in_res->res_priv;
+		val = (rsrc_rdi_data->pix_pattern <<
+			rsrc_rdi_data->reg_data->pixel_pattern_shift);
+
+		val |= (1 << rsrc_rdi_data->reg_data->rdi_out_enable_shift);
+		cam_io_w_mb(val, rsrc_rdi_data->mem_base +
+			rsrc_rdi_data->rdi_reg->rdi_module_config);
+
+		/* Epoch config */
+		cam_io_w_mb(rsrc_rdi_data->reg_data->epoch_line_cfg,
+			rsrc_rdi_data->mem_base +
+			rsrc_rdi_data->rdi_reg->rdi_epoch_irq);
+
+		/* Reg Update */
+		cam_io_w_mb(rsrc_rdi_data->reg_data->reg_update_cmd_data,
+			rsrc_rdi_data->mem_base +
+			rsrc_rdi_data->rdi_reg->reg_update_cmd);
+		in_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+		/* Enable the irq */
+		if (in_res->is_rdi_primary_res)
+			cam_tfe_irq_config(core_info,
+				rsrc_rdi_data->reg_data->subscribe_irq_mask,
+				CAM_TFE_TOP_IRQ_REG_NUM, true);
+
+		if (top_priv->top_debug &
+			CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+			val = cam_io_r_mb(rsrc_rdi_data->mem_base +
+				rsrc_rdi_data->common_reg->diag_config);
+			val |= ((rsrc_rdi_data->reg_data->enable_diagnostic_hw)|
+				(rsrc_rdi_data->reg_data->diag_sensor_sel <<
+				rsrc_rdi_data->reg_data->diag_sensor_shift));
+			cam_io_w_mb(val, rsrc_rdi_data->mem_base +
+				rsrc_rdi_data->common_reg->diag_config);
+		}
+
+		CAM_DBG(CAM_ISP, "TFE:%d Start RDI %d", core_info->core_index,
+			in_res->res_id - CAM_ISP_HW_TFE_IN_RDI0);
+	}
+
+	core_info->irq_err_config_cnt++;
+	if (core_info->irq_err_config_cnt == 1)  {
+		cam_tfe_irq_config(core_info,
+			core_info->tfe_hw_info->error_irq_mask,
+			CAM_TFE_TOP_IRQ_REG_NUM, true);
+		top_priv->error_ts.tv_sec = 0;
+		top_priv->error_ts.tv_nsec = 0;
+		top_priv->sof_ts.tv_sec = 0;
+		top_priv->sof_ts.tv_nsec = 0;
+		top_priv->epoch_ts.tv_sec = 0;
+		top_priv->epoch_ts.tv_nsec = 0;
+		top_priv->eof_ts.tv_sec = 0;
+		top_priv->eof_ts.tv_nsec = 0;
+	}
+
+end:
+	return rc;
+}
+
+int cam_tfe_top_stop(struct cam_tfe_hw_core_info *core_info,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv                 *top_priv;
+	struct cam_isp_resource_node            *in_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_tfe_camif_data               *camif_data;
+	struct cam_tfe_rdi_data                 *rsrc_rdi_data;
+	struct cam_tfe_ppp_data                 *ppp_data;
+	uint32_t val = 0;
+	int i, rc = 0;
+
+	if (!stop_args) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Invalid input arguments",
+			core_info->core_index);
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv   *)core_info->top_priv;
+	in_res = (struct cam_isp_resource_node *)stop_args;
+	hw_info = (struct cam_hw_info  *)in_res->hw_intf->hw_priv;
+
+	if (in_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		in_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	if (in_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+		camif_data = (struct cam_tfe_camif_data *)in_res->res_priv;
+
+		cam_io_w_mb(0, camif_data->mem_base +
+			camif_data->camif_reg->module_cfg);
+
+		cam_tfe_irq_config(core_info,
+			camif_data->reg_data->subscribe_irq_mask,
+			CAM_TFE_TOP_IRQ_REG_NUM, false);
+
+		if (in_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+			in_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		val = cam_io_r_mb(camif_data->mem_base +
+				camif_data->common_reg->diag_config);
+		if (val & camif_data->reg_data->enable_diagnostic_hw) {
+			val &= ~camif_data->reg_data->enable_diagnostic_hw;
+			cam_io_w_mb(val, camif_data->mem_base +
+				camif_data->common_reg->diag_config);
+		}
+	}  else if (in_res->res_id == CAM_ISP_HW_TFE_IN_PDLIB) {
+		ppp_data = (struct cam_tfe_ppp_data *)in_res->res_priv;
+
+		cam_io_w_mb(0, ppp_data->mem_base +
+			ppp_data->ppp_reg->ppp_module_config);
+
+		if (in_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+			in_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	} else if ((in_res->res_id >= CAM_ISP_HW_TFE_IN_RDI0) &&
+		(in_res->res_id <= CAM_ISP_HW_TFE_IN_RDI2)) {
+		rsrc_rdi_data = (struct cam_tfe_rdi_data *) in_res->res_priv;
+		cam_io_w_mb(0x0, rsrc_rdi_data->mem_base +
+			rsrc_rdi_data->rdi_reg->rdi_module_config);
+
+		if (in_res->is_rdi_primary_res)
+			cam_tfe_irq_config(core_info,
+				rsrc_rdi_data->reg_data->subscribe_irq_mask,
+				CAM_TFE_TOP_IRQ_REG_NUM, false);
+
+		if (in_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+			in_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res id:%d",
+			core_info->core_index, in_res->res_id);
+		return -EINVAL;
+	}
+
+	if (!rc) {
+		for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+			if (top_priv->in_rsrc[i].res_id == in_res->res_id) {
+				top_priv->req_clk_rate[i] = 0;
+				memset(&top_priv->req_axi_vote[i], 0,
+					sizeof(struct cam_axi_vote));
+				top_priv->axi_vote_control[i] =
+					CAM_TFE_BW_CONTROL_EXCLUDE;
+				break;
+			}
+		}
+	}
+
+	atomic_set(&top_priv->switch_out_of_sync_cnt, 0);
+	core_info->irq_err_config_cnt--;
+	if (!core_info->irq_err_config_cnt)
+		cam_tfe_irq_config(core_info,
+			core_info->tfe_hw_info->error_irq_mask,
+			CAM_TFE_TOP_IRQ_REG_NUM, false);
+
+	return rc;
+}
+
+int cam_tfe_top_init(
+	struct cam_hw_soc_info                 *soc_info,
+	struct cam_hw_intf                     *hw_intf,
+	void                                   *top_hw_info,
+	struct cam_tfe_hw_core_info            *core_info)
+{
+	struct cam_tfe_top_priv           *top_priv = NULL;
+	struct cam_tfe_top_hw_info        *hw_info = top_hw_info;
+	struct cam_tfe_soc_private        *soc_private = NULL;
+	struct cam_tfe_camif_data         *camif_priv = NULL;
+	struct cam_tfe_rdi_data           *rdi_priv = NULL;
+	struct cam_tfe_ppp_data           *ppp_priv = NULL;
+	int i, j, rc = 0;
+
+	top_priv = kzalloc(sizeof(struct cam_tfe_top_priv),
+		GFP_KERNEL);
+	if (!top_priv) {
+		CAM_DBG(CAM_ISP, "TFE:%DError Failed to alloc for tfe_top_priv",
+			core_info->core_index);
+		rc = -ENOMEM;
+		goto end;
+	}
+	core_info->top_priv = top_priv;
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error soc_private NULL",
+			core_info->core_index);
+		rc = -ENODEV;
+		goto free_tfe_top_priv;
+	}
+
+	top_priv->hw_clk_rate = 0;
+	memset(top_priv->last_vote, 0x0, sizeof(struct cam_axi_vote) *
+		(CAM_TFE_TOP_IN_PORT_MAX *
+		CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES));
+	top_priv->last_counter = 0;
+
+	for (i = 0, j = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		top_priv->in_rsrc[i].res_type = CAM_ISP_RESOURCE_TFE_IN;
+		top_priv->in_rsrc[i].hw_intf = hw_intf;
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		top_priv->req_clk_rate[i] = 0;
+		memset(&top_priv->req_axi_vote[i], 0,
+			sizeof(struct cam_axi_vote));
+		top_priv->axi_vote_control[i] =
+			CAM_TFE_BW_CONTROL_EXCLUDE;
+
+		if (hw_info->in_port[i] == CAM_TFE_CAMIF_VER_1_0) {
+			top_priv->in_rsrc[i].res_id =
+				CAM_ISP_HW_TFE_IN_CAMIF;
+
+			camif_priv = kzalloc(sizeof(struct cam_tfe_camif_data),
+				GFP_KERNEL);
+			if (!camif_priv) {
+				CAM_DBG(CAM_ISP,
+					"TFE:%dError Failed to alloc for camif_priv",
+					core_info->core_index);
+				goto free_tfe_top_priv;
+			}
+
+			top_priv->in_rsrc[i].res_priv = camif_priv;
+
+			camif_priv->mem_base    =
+				soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+			camif_priv->camif_reg   =
+				hw_info->camif_hw_info.camif_reg;
+			camif_priv->common_reg  = hw_info->common_reg;
+			camif_priv->reg_data    =
+				hw_info->camif_hw_info.reg_data;
+			camif_priv->hw_intf     = hw_intf;
+			camif_priv->soc_info    = soc_info;
+
+		} else if (hw_info->in_port[i] == CAM_TFE_PDLIB_VER_1_0) {
+			top_priv->in_rsrc[i].res_id =
+				CAM_ISP_HW_TFE_IN_PDLIB;
+
+			ppp_priv = kzalloc(sizeof(struct cam_tfe_ppp_data),
+					GFP_KERNEL);
+			if (!ppp_priv) {
+				CAM_DBG(CAM_ISP,
+					"TFE:%d Error Failed to alloc for ppp_priv",
+					core_info->core_index);
+				goto deinit_resources;
+			}
+
+			top_priv->in_rsrc[i].res_priv = ppp_priv;
+
+			ppp_priv->mem_base    =
+				soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+			ppp_priv->hw_intf     = hw_intf;
+			ppp_priv->common_reg  = hw_info->common_reg;
+			ppp_priv->ppp_reg     =
+				hw_info->ppp_hw_info.ppp_reg;
+			ppp_priv->reg_data    =
+				hw_info->ppp_hw_info.reg_data;
+		} else if (hw_info->in_port[i] == CAM_TFE_RDI_VER_1_0 &&
+				(j < CAM_TFE_RDI_MAX)) {
+			top_priv->in_rsrc[i].res_id =
+				CAM_ISP_HW_TFE_IN_RDI0 + j;
+
+			rdi_priv = kzalloc(sizeof(struct cam_tfe_rdi_data),
+					GFP_KERNEL);
+			if (!rdi_priv) {
+				CAM_DBG(CAM_ISP,
+					"TFE:%d Error Failed to alloc for rdi_priv",
+					core_info->core_index);
+				goto deinit_resources;
+			}
+
+			top_priv->in_rsrc[i].res_priv = rdi_priv;
+
+			rdi_priv->mem_base   =
+				soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+			rdi_priv->hw_intf    = hw_intf;
+			rdi_priv->common_reg = hw_info->common_reg;
+			rdi_priv->rdi_reg    =
+				hw_info->rdi_hw_info[j].rdi_reg;
+			rdi_priv->reg_data =
+				hw_info->rdi_hw_info[j++].reg_data;
+		}  else {
+			CAM_WARN(CAM_ISP, "TFE:%d Invalid inport type: %u at i = %d. j = %d",
+				core_info->core_index, hw_info->in_port[i], i, j);
+		}
+	}
+
+	top_priv->common_data.soc_info     = soc_info;
+	top_priv->common_data.hw_intf      = hw_intf;
+	top_priv->common_data.common_reg   = hw_info->common_reg;
+	top_priv->common_data.reg_dump_data = &hw_info->reg_dump_data;
+
+	return rc;
+
+deinit_resources:
+	for (--i; i >= 0; i--) {
+
+		top_priv->in_rsrc[i].start = NULL;
+		top_priv->in_rsrc[i].stop  = NULL;
+		top_priv->in_rsrc[i].process_cmd = NULL;
+		top_priv->in_rsrc[i].top_half_handler = NULL;
+		top_priv->in_rsrc[i].bottom_half_handler = NULL;
+
+		if (!top_priv->in_rsrc[i].res_priv)
+			continue;
+
+		kfree(top_priv->in_rsrc[i].res_priv);
+		top_priv->in_rsrc[i].res_priv = NULL;
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	}
+free_tfe_top_priv:
+	kfree(core_info->top_priv);
+	core_info->top_priv = NULL;
+end:
+	return rc;
+}
+
+
+int cam_tfe_top_deinit(struct cam_tfe_top_priv  *top_priv)
+{
+	int i, rc = 0;
+
+	if (!top_priv) {
+		CAM_ERR(CAM_ISP, "Error Invalid input");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+		top_priv->in_rsrc[i].start = NULL;
+		top_priv->in_rsrc[i].stop  = NULL;
+		top_priv->in_rsrc[i].process_cmd = NULL;
+		top_priv->in_rsrc[i].top_half_handler = NULL;
+		top_priv->in_rsrc[i].bottom_half_handler = NULL;
+
+		if (!top_priv->in_rsrc[i].res_priv) {
+			CAM_ERR(CAM_ISP, "Error res_priv is NULL");
+			return -ENODEV;
+		}
+
+		kfree(top_priv->in_rsrc[i].res_priv);
+		top_priv->in_rsrc[i].res_priv = NULL;
+	}
+
+	return rc;
+}
+
+int cam_tfe_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_tfe_top_priv           *top_priv  = NULL;
+	struct cam_tfe_hw_info            *hw_info = NULL;
+	void __iomem                      *mem_base;
+	uint32_t *reset_reg_args = reset_core_args;
+	uint32_t i, reset_reg_val, irq_status[3];
+	int rc;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &tfe_hw->soc_info;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	top_priv = core_info->top_priv;
+	hw_info = core_info->tfe_hw_info;
+	mem_base = tfe_hw->soc_info.reg_map[TFE_CORE_BASE_IDX].mem_base;
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		irq_status[i] = cam_io_r(mem_base +
+			core_info->tfe_hw_info->top_irq_status[i]);
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		cam_io_w(irq_status[i], mem_base +
+			core_info->tfe_hw_info->top_irq_clear[i]);
+
+	cam_io_w_mb(core_info->tfe_hw_info->global_clear_bitmask,
+		mem_base + core_info->tfe_hw_info->top_irq_cmd);
+
+	/* Mask all irq registers */
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		cam_io_w(0, mem_base +
+			core_info->tfe_hw_info->top_irq_mask[i]);
+
+	cam_tfe_irq_config(core_info, hw_info->reset_irq_mask,
+		CAM_TFE_TOP_IRQ_REG_NUM, true);
+
+	reinit_completion(&core_info->reset_complete);
+
+	CAM_DBG(CAM_ISP, "calling RESET on tfe %d", soc_info->index);
+
+	switch (*reset_reg_args) {
+	case CAM_TFE_HW_RESET_HW_AND_REG:
+		reset_reg_val = CAM_TFE_HW_RESET_HW_AND_REG_VAL;
+		break;
+	default:
+		reset_reg_val = CAM_TFE_HW_RESET_HW_VAL;
+		break;
+	}
+
+	cam_io_w_mb(reset_reg_val, mem_base +
+		top_priv->common_data.common_reg->global_reset_cmd);
+
+	CAM_DBG(CAM_ISP, "TFE:%d waiting for tfe reset complete",
+		core_info->core_index);
+	/* Wait for Completion or Timeout of 100ms */
+	rc = cam_common_wait_for_completion_timeout(
+			&core_info->reset_complete,
+			msecs_to_jiffies(100));
+	if (rc <= 0) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Reset Timeout",
+			core_info->core_index);
+		rc = -ETIMEDOUT;
+	} else {
+		rc = 0;
+		CAM_DBG(CAM_ISP, "TFE:%d reset complete done (%d)",
+			core_info->core_index, rc);
+	}
+
+	CAM_DBG(CAM_ISP, "TFE:%d reset complete done (%d)",
+		core_info->core_index, rc);
+
+	cam_tfe_irq_config(core_info, hw_info->reset_irq_mask,
+		CAM_TFE_TOP_IRQ_REG_NUM, false);
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+int cam_tfe_init_hw(void *hw_priv, void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *tfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_tfe_top_priv           *top_priv;
+	void __iomem                      *mem_base;
+	int i, rc = 0;
+	unsigned long                      max_clk_rate = 0;
+	uint32_t                           reset_core_args =
+					CAM_TFE_HW_RESET_HW_AND_REG;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &tfe_hw->soc_info;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	top_priv = (struct cam_tfe_top_priv *)core_info->top_priv;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	tfe_hw->open_count++;
+	if (tfe_hw->open_count > 1) {
+		mutex_unlock(&tfe_hw->hw_mutex);
+		CAM_DBG(CAM_ISP, "TFE:%d has already been initialized cnt %d",
+			core_info->core_index, tfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&tfe_hw->hw_mutex);
+	/* read clock value based on clock blob received */
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->req_clk_rate[i] > max_clk_rate)
+			max_clk_rate = top_priv->req_clk_rate[i];
+	}
+
+	/* Turn ON Regulators, Clocks and other SOC resources */
+	rc = cam_tfe_enable_soc_resources(soc_info, max_clk_rate);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Enable SOC failed");
+		rc = -EFAULT;
+		goto decrement_open_cnt;
+	}
+	tfe_hw->hw_state = CAM_HW_STATE_POWER_UP;
+
+	mem_base = tfe_hw->soc_info.reg_map[TFE_CORE_BASE_IDX].mem_base;
+	CAM_DBG(CAM_ISP, "TFE:%d Enable soc done", core_info->core_index);
+
+	/* Do HW Reset */
+	rc = cam_tfe_reset(hw_priv, &reset_core_args, sizeof(uint32_t));
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d Reset Failed rc=%d",
+			core_info->core_index, rc);
+		goto disable_soc;
+	}
+
+	top_priv->hw_clk_rate = max_clk_rate;
+	core_info->irq_err_config_cnt = 0;
+	core_info->irq_err_config = false;
+	rc = core_info->tfe_bus->hw_ops.init(core_info->tfe_bus->bus_priv,
+		NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d Top HW init Failed rc=%d",
+			core_info->core_index, rc);
+		goto disable_soc;
+	}
+
+	return rc;
+
+disable_soc:
+	cam_tfe_disable_soc_resources(soc_info);
+	tfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+decrement_open_cnt:
+	mutex_lock(&tfe_hw->hw_mutex);
+	tfe_hw->open_count--;
+	mutex_unlock(&tfe_hw->hw_mutex);
+	return rc;
+}
+
+int cam_tfe_deinit_hw(void *hw_priv, void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *tfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+	uint32_t                           reset_core_args =
+					CAM_TFE_HW_RESET_HW_AND_REG;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &tfe_hw->soc_info;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (!tfe_hw->open_count) {
+		mutex_unlock(&tfe_hw->hw_mutex);
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "TFE:%d Error Unbalanced deinit",
+			core_info->core_index);
+		return -EFAULT;
+	}
+	tfe_hw->open_count--;
+	if (tfe_hw->open_count) {
+		mutex_unlock(&tfe_hw->hw_mutex);
+		CAM_DBG(CAM_ISP, "TFE:%d open_cnt non-zero =%d",
+			core_info->core_index, tfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	rc = core_info->tfe_bus->hw_ops.deinit(core_info->tfe_bus->bus_priv,
+		NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_ISP, "TFE:%d Bus HW deinit Failed rc=%d",
+			core_info->core_index, rc);
+
+	rc = cam_tfe_reset(hw_priv, &reset_core_args, sizeof(uint32_t));
+
+	/* Turn OFF Regulators, Clocks and other SOC resources */
+	CAM_DBG(CAM_ISP, "TFE:%d Disable SOC resource", core_info->core_index);
+	rc = cam_tfe_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, " TFE:%d Disable SOC failed",
+			core_info->core_index);
+
+	tfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+int cam_tfe_reserve(void *hw_priv, void *reserve_args, uint32_t arg_size)
+{
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_tfe_acquire_args       *acquire;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_tfe_acquire_args))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	acquire = (struct cam_tfe_acquire_args   *)reserve_args;
+
+	CAM_DBG(CAM_ISP, "TFE:%d acquire res type: %d",
+		core_info->core_index, acquire->rsrc_type);
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (acquire->rsrc_type == CAM_ISP_RESOURCE_TFE_IN) {
+		rc = cam_tfe_top_reserve(core_info->top_priv,
+		reserve_args, arg_size);
+	} else if (acquire->rsrc_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		rc = core_info->tfe_bus->hw_ops.reserve(
+			core_info->tfe_bus->bus_priv, acquire,
+			sizeof(*acquire));
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res type:%d",
+			core_info->core_index, acquire->rsrc_type);
+	}
+
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	return rc;
+}
+
+
+int cam_tfe_release(void *hw_priv, void *release_args, uint32_t arg_size)
+{
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node      *) release_args;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_TFE_IN)
+		rc = cam_tfe_top_release(core_info->top_priv, isp_res,
+			sizeof(*isp_res));
+	else if (isp_res->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		rc = core_info->tfe_bus->hw_ops.release(
+			core_info->tfe_bus->bus_priv, isp_res,
+			sizeof(*isp_res));
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res type:%d",
+			core_info->core_index, isp_res->res_type);
+	}
+
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_tfe_start(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *start_res;
+
+	int rc = 0;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	start_res = (struct cam_isp_resource_node  *)start_args;
+	core_info->tasklet_info = start_res->tasklet_info;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (start_res->res_type == CAM_ISP_RESOURCE_TFE_IN) {
+		rc = cam_tfe_top_start(core_info, start_args,
+			arg_size);
+		if (rc)
+			CAM_ERR(CAM_ISP, "TFE:%d Start failed. type:%d",
+				core_info->core_index, start_res->res_type);
+
+	} else if (start_res->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		rc = core_info->tfe_bus->hw_ops.start(start_res, NULL, 0);
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res type:%d",
+			core_info->core_index, start_res->res_type);
+		rc = -EFAULT;
+	}
+
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_tfe_stop(void *hw_priv, void *stop_args, uint32_t arg_size)
+{
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	int rc = -EINVAL;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node  *)stop_args;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_TFE_IN) {
+		rc = cam_tfe_top_stop(core_info, isp_res,
+			sizeof(struct cam_isp_resource_node));
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		rc = core_info->tfe_bus->hw_ops.stop(isp_res, NULL, 0);
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res type:%d",
+			core_info->core_index, isp_res->res_type);
+	}
+
+	CAM_DBG(CAM_ISP, "TFE:%d stopped res type:%d res id:%d res_state:%d ",
+		core_info->core_index, isp_res->res_type,
+		isp_res->res_id, isp_res->res_state);
+
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_tfe_read(void *hw_priv, void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_tfe_write(void *hw_priv, void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_tfe_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *tfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_tfe_hw_info            *hw_info = NULL;
+
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_info = &tfe_hw->soc_info;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	hw_info = core_info->tfe_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_tfe_top_get_base(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_tfe_top_get_reg_update(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+		rc = cam_tfe_top_clock_update(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+		rc = cam_tfe_top_bw_update(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+		rc = cam_tfe_top_bw_control(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_DUMP:
+		rc = cam_tfe_top_get_reg_dump(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_IRQ_REGISTER_DUMP:
+		rc = cam_tfe_camif_irq_reg_dump(core_info, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA:
+		*((struct cam_hw_soc_info **)cmd_args) = soc_info;
+		break;
+	case CAM_ISP_HW_CMD_DUMP_HW:
+		rc = cam_tfe_hw_dump(core_info,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		rc = cam_tfe_set_top_debug(core_info, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DYNAMIC_CLOCK_UPDATE:
+		rc = cam_tfe_top_dynamic_clock_update(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_INIT_CONFIG_UPDATE:
+		rc = cam_tfe_top_init_config_update(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+	case CAM_ISP_HW_CMD_GET_WM_SECURE_MODE:
+	case CAM_ISP_HW_CMD_QUERY_CAP:
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO:
+	case CAM_ISP_HW_CMD_IS_PDAF_RDI2_MUX_EN:
+	case CAM_ISP_HW_CMD_WM_BW_LIMIT_CONFIG:
+	case CAM_ISP_HW_CMD_GET_LAST_CONSUMED_ADDR:
+	case CAM_ISP_HW_CMD_BUS_WM_DISABLE:
+	case CAM_ISP_HW_CMD_BUFFER_ALIGNMENT_UPDATE:
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+		rc = core_info->tfe_bus->hw_ops.process_cmd(
+			core_info->tfe_bus->bus_priv, cmd_type, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_PATH_PORT_MAP:
+		rc = cam_tfe_bus_get_path_port_map(hw_info->top_hw_info, cmd_args,
+					arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SET_SYNC_HW_IDX:
+		rc = cam_tfe_set_sync_hw_idx(core_info, cmd_args, arg_size);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid cmd type:%d",
+			core_info->core_index, cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+end:
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE: %d error with cmd type: %d",
+			core_info->core_index, cmd_type);
+	}
+
+	return rc;
+}
+
+int cam_tfe_core_init(struct cam_tfe_hw_core_info  *core_info,
+	struct cam_hw_soc_info                     *soc_info,
+	struct cam_hw_intf                         *hw_intf,
+	struct cam_tfe_hw_info                     *tfe_hw_info)
+{
+	int rc = -EINVAL;
+	int i;
+
+	rc = cam_tfe_top_init(soc_info, hw_intf, tfe_hw_info->top_hw_info,
+		core_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error cam_tfe_top_init failed",
+			core_info->core_index);
+		goto end;
+	}
+
+	rc = cam_tfe_bus_init(soc_info, hw_intf,
+		tfe_hw_info->bus_hw_info, core_info,
+		&core_info->tfe_bus);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error cam_tfe_bus_init failed",
+			core_info->core_index);
+		goto deinit_top;
+	}
+
+	INIT_LIST_HEAD(&core_info->free_payload_list);
+	for (i = 0; i < CAM_TFE_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&core_info->evt_payload[i].list);
+		list_add_tail(&core_info->evt_payload[i].list,
+			&core_info->free_payload_list);
+	}
+
+	core_info->irq_err_config = false;
+	core_info->irq_err_config_cnt = 0;
+	spin_lock_init(&core_info->spin_lock);
+	init_completion(&core_info->reset_complete);
+
+	return rc;
+
+deinit_top:
+	cam_tfe_top_deinit(core_info->top_priv);
+
+end:
+	return rc;
+}
+
+int cam_tfe_core_deinit(struct cam_tfe_hw_core_info  *core_info,
+	struct cam_tfe_hw_info                       *tfe_hw_info)
+{
+	int                rc = -EINVAL;
+	int                i;
+	unsigned long      flags;
+
+	spin_lock_irqsave(&core_info->spin_lock, flags);
+
+	INIT_LIST_HEAD(&core_info->free_payload_list);
+	for (i = 0; i < CAM_TFE_EVT_MAX; i++)
+		INIT_LIST_HEAD(&core_info->evt_payload[i].list);
+
+	rc = cam_tfe_bus_deinit(&core_info->tfe_bus);
+	if (rc)
+		CAM_ERR(CAM_ISP, "TFE:%d Error cam_tfe_bus_deinit failed rc=%d",
+			core_info->core_index, rc);
+
+	rc = cam_tfe_top_deinit(core_info->top_priv);
+	kfree(core_info->top_priv);
+	core_info->top_priv = NULL;
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Error cam_tfe_top_deinit failed rc=%d", rc);
+
+	spin_unlock_irqrestore(&core_info->spin_lock, flags);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.h
@@ -0,0 +1,383 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE_CORE_H_
+#define _CAM_TFE_CORE_H_
+
+#include <linux/spinlock_types.h>
+#include "cam_hw_intf.h"
+#include "cam_tfe_bus.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_tfe_irq.h"
+
+#define CAM_TFE_CAMIF_VER_1_0        0x10
+#define CAM_TFE_RDI_VER_1_0          0x1000
+#define CAM_TFE_PDLIB_VER_1_0        0x10000
+#define CAM_TFE_TOP_1_0              0x1000
+#define CAM_TFE_TOP_IN_PORT_MAX      5
+#define CAM_TFE_RDI_MAX              4
+
+#define CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS      BIT(0)
+#define CAM_TFE_EVT_MAX                            256
+
+#define CAM_TFE_MAX_REG_DUMP_ENTRIES        20
+#define CAM_TFE_MAX_LUT_DUMP_ENTRIES        10
+
+#define CAM_TFE_MAX_CLC                     42
+#define CAM_TFE_CLC_NAME_LENGTH_MAX         32
+#define CAM_TFE_LITE_MAX_CLC                4
+#define CAM_TFE_MAX_DEBUG_REG               12
+#define CAM_TFE_MAX_PERF_CNT                2
+
+/*we take each word as uint32_t, for dumping uint64_t count as 2 words
+ * soc index
+ * clk_rate--> uint64_t--> count as 2 words
+ * BW--> uint64_t --> count as 2 words
+ * MAX_NIU
+ */
+#define CAM_TFE_CORE_DUMP_MISC_NUM_WORDS 4
+
+enum cam_tfe_lut_word_size {
+	CAM_TFE_LUT_WORD_SIZE_32,
+	CAM_TFE_LUT_WORD_SIZE_64,
+	CAM_TFE_LUT_WORD_SIZE_MAX,
+};
+
+struct cam_tfe_reg_dump_entry {
+	uint32_t     start_offset;
+	uint32_t     end_offset;
+};
+
+struct cam_tfe_lut_dump_entry {
+	enum cam_tfe_lut_word_size  lut_word_size;
+	uint32_t                    lut_bank_sel;
+	uint32_t                    lut_addr_size;
+	uint32_t                    dmi_reg_offset;
+};
+struct cam_tfe_reg_dump_data {
+	uint32_t     num_reg_dump_entries;
+	uint32_t     num_lut_dump_entries;
+	uint32_t     bus_start_addr;
+	uint32_t     bus_write_top_end_addr;
+	uint32_t     bus_client_start_addr;
+	uint32_t     bus_client_offset;
+	uint32_t     num_bus_clients;
+	struct cam_tfe_reg_dump_entry
+		reg_entry[CAM_TFE_MAX_REG_DUMP_ENTRIES];
+	struct cam_tfe_lut_dump_entry
+		lut_entry[CAM_TFE_MAX_LUT_DUMP_ENTRIES];
+};
+
+struct cam_tfe_top_reg_perf_cfg {
+	uint32_t perf_cnt_cfg;
+	uint32_t perf_pixel_count;
+	uint32_t perf_line_count;
+	uint32_t perf_stall_count;
+	uint32_t perf_always_count;
+	uint32_t perf_count_status;
+};
+
+struct cam_tfe_top_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t lens_feature;
+	uint32_t stats_feature;
+	uint32_t zoom_feature;
+	uint32_t global_reset_cmd;
+	uint32_t core_cgc_ctrl_0;
+	uint32_t core_cgc_ctrl_1;
+	uint32_t ahb_cgc_ctrl;
+	uint32_t core_cfg_0;
+	uint32_t core_cfg_1;
+	uint32_t reg_update_cmd;
+	uint32_t diag_config;
+	uint32_t diag_sensor_status_0;
+	uint32_t diag_sensor_status_1;
+	uint32_t diag_sensor_frame_cnt_status;
+	uint32_t violation_status;
+	uint32_t stats_throttle_cnt_cfg_0;
+	uint32_t stats_throttle_cnt_cfg_1;
+	uint32_t num_debug_reg;
+	uint32_t debug_reg[CAM_TFE_MAX_DEBUG_REG];
+	uint32_t debug_cfg;
+	uint32_t num_perf_cfg;
+	struct   cam_tfe_top_reg_perf_cfg perf_cfg[CAM_TFE_MAX_PERF_CNT];
+	uint32_t diag_sensor_frame_cnt_status_1;
+
+	/*reg data */
+	uint32_t diag_min_hbi_error_shift;
+	uint32_t diag_neq_hbi_shift;
+	uint32_t diag_sensor_hbi_mask;
+	uint32_t mup_shift_val;
+
+	/* error bit data */
+	uint32_t pp_camif_violation_bit;
+	uint32_t pp_violation_bit;
+	uint32_t ppp_camif_violation_bit;
+	uint32_t ppp_violation_bit;
+	uint32_t rdi0_camif_violation_bit;
+	uint32_t rdi1_camif_violation_bit;
+	uint32_t rdi2_camif_violation_bit;
+	uint32_t diag_violation_bit;
+	uint32_t dyamanic_switch_violation_bit;
+	uint32_t pp_frame_drop_bit;
+	uint32_t ppp_frame_drop_bit;
+	uint32_t rdi0_frame_drop_bit;
+	uint32_t rdi1_frame_drop_bit;
+	uint32_t rdi2_frame_drop_bit;
+	uint32_t pp_overflow_bit;
+	uint32_t ppp_overflow_bit;
+	uint32_t rdi0_overflow_bit;
+	uint32_t rdi1_overflow_bit;
+	uint32_t rdi2_overflow_bit;
+	uint32_t out_of_sync_frame_drop_bit;
+	uint32_t lcr_pd_timing_protocol_violation_bit;
+	uint32_t height_shift;
+	uint32_t epoch_shift_val;
+
+	/* configuration */
+	bool serializer_supported;
+	bool mup_supported;
+};
+
+struct cam_tfe_camif_reg {
+	uint32_t     hw_version;
+	uint32_t     hw_status;
+	uint32_t     module_cfg;
+	uint32_t     pdaf_raw_crop_width_cfg;
+	uint32_t     pdaf_raw_crop_height_cfg;
+	uint32_t     line_skip_pattern;
+	uint32_t     pixel_skip_pattern;
+	uint32_t     period_cfg;
+	uint32_t     irq_subsample_pattern;
+	uint32_t     epoch_irq_cfg;
+	uint32_t     debug_1;
+	uint32_t     debug_0;
+	uint32_t     test_bus_ctrl;
+	uint32_t     spare;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_tfe_camif_reg_data {
+	uint32_t     extern_reg_update_mask;
+	uint32_t     dual_tfe_pix_en_shift;
+	uint32_t     extern_reg_update_shift;
+	uint32_t     camif_pd_rdi2_src_sel_shift;
+	uint32_t     dual_tfe_sync_sel_shift;
+	uint32_t     delay_line_en_shift;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+	uint32_t     module_enable_shift;
+	uint32_t     pix_out_enable_shift;
+	uint32_t     pdaf_output_enable_shift;
+
+	uint32_t     dsp_mode_shift;
+	uint32_t     dsp_mode_mask;
+	uint32_t     dsp_en_shift;
+	uint32_t     dsp_en_mask;
+
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     epoch1_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     reg_update_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask2;
+	uint32_t     subscribe_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     perf_cnt_start_cmd_shift;
+	uint32_t     perf_cnt_continuous_shift;
+	uint32_t     perf_client_sel_shift;
+	uint32_t     perf_window_start_shift;
+	uint32_t     perf_window_end_shift;
+
+	uint32_t     ai_c_srl_en_shift;
+	uint32_t     ds16_c_srl_en_shift;
+	uint32_t     ds4_c_srl_en_shift;
+
+	uint32_t     shdr_mode_shift;
+	uint32_t     extern_mup_shift;
+};
+
+struct cam_tfe_camif_hw_info {
+	struct cam_tfe_camif_reg      *camif_reg;
+	struct cam_tfe_camif_reg_data *reg_data;
+};
+
+struct cam_tfe_rdi_reg {
+	uint32_t     rdi_hw_version;
+	uint32_t     rdi_hw_status;
+	uint32_t     rdi_module_config;
+	uint32_t     rdi_skip_period;
+	uint32_t     rdi_irq_subsample_pattern;
+	uint32_t     rdi_epoch_irq;
+	uint32_t     rdi_debug_1;
+	uint32_t     rdi_debug_0;
+	uint32_t     rdi_test_bus_ctrl;
+	uint32_t     rdi_spare;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_tfe_rdi_reg_data {
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+	uint32_t     rdi_out_enable_shift;
+
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     epoch1_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask2;
+	uint32_t     subscribe_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     diag_sensor_sel;
+	uint32_t     diag_sensor_shift;
+};
+
+struct cam_tfe_ppp_reg {
+	uint32_t     ppp_hw_version;
+	uint32_t     ppp_hw_status;
+	uint32_t     ppp_module_config;
+	uint32_t     ppp_skip_period;
+	uint32_t     ppp_irq_subsample_pattern;
+	uint32_t     ppp_epoch_irq;
+	uint32_t     ppp_debug_1;
+	uint32_t     ppp_debug_0;
+	uint32_t     ppp_test_bus_ctrl;
+	uint32_t     ppp_spare;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_tfe_ppp_reg_data {
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     epoch1_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     subscribe_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     diag_sensor_sel;
+	uint32_t     diag_sensor_shift;
+
+	uint32_t     pdaf_path_en_shift;
+	uint32_t     lcr_dis_en_shift;
+};
+
+struct cam_tfe_clc_hw_status {
+	uint8_t     name[CAM_TFE_CLC_NAME_LENGTH_MAX];
+	uint32_t    hw_status_reg;
+};
+
+struct cam_tfe_rdi_hw_info {
+	struct cam_tfe_rdi_reg              *rdi_reg;
+	struct cam_tfe_rdi_reg_data         *reg_data;
+};
+
+struct cam_tfe_ppp_hw_info {
+	struct cam_tfe_ppp_reg              *ppp_reg;
+	struct cam_tfe_ppp_reg_data         *reg_data;
+};
+
+struct cam_tfe_top_hw_info {
+	struct cam_tfe_top_reg_offset_common  *common_reg;
+	struct cam_tfe_camif_hw_info           camif_hw_info;
+	struct cam_tfe_rdi_hw_info             rdi_hw_info[CAM_TFE_RDI_MAX];
+	struct cam_tfe_ppp_hw_info             ppp_hw_info;
+	uint32_t in_port[CAM_TFE_TOP_IN_PORT_MAX];
+	struct cam_tfe_reg_dump_data           reg_dump_data;
+	uint32_t                               num_path_port_map;
+	uint32_t path_port_map[CAM_ISP_HW_PATH_PORT_MAP_MAX][2];
+};
+
+struct cam_tfe_hw_info {
+	uint32_t    top_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    top_irq_clear[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    top_irq_status[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    top_irq_cmd;
+	uint32_t    global_clear_bitmask;
+
+	uint32_t    bus_irq_mask[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+	uint32_t    bus_irq_clear[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+	uint32_t    bus_irq_status[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+	uint32_t    bus_irq_cmd;
+
+	uint32_t    bus_violation_reg;
+	uint32_t    bus_overflow_reg;
+	uint32_t    bus_image_size_vilation_reg;
+	uint32_t    bus_overflow_clear_cmd;
+	uint32_t    debug_status_top;
+
+	uint32_t    reset_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    error_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    bus_reg_irq_mask[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+	uint32_t    bus_error_irq_mask[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+
+	uint32_t    num_clc;
+	struct cam_tfe_clc_hw_status  *clc_hw_status_info;
+
+	uint32_t    top_version;
+	void       *top_hw_info;
+
+	uint32_t    bus_version;
+	void       *bus_hw_info;
+};
+
+struct cam_tfe_hw_core_info {
+	uint32_t                            core_index;
+	struct cam_tfe_hw_info             *tfe_hw_info;
+	void                               *top_priv;
+	struct cam_tfe_bus                 *tfe_bus;
+	void                               *tasklet_info;
+	struct cam_tfe_irq_evt_payload  evt_payload[CAM_TFE_EVT_MAX];
+	struct list_head                    free_payload_list;
+	bool                                irq_err_config;
+	uint32_t                            irq_err_config_cnt;
+	spinlock_t                          spin_lock;
+	struct completion                   reset_complete;
+};
+
+int cam_tfe_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_tfe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_tfe_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_tfe_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size);
+int cam_tfe_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_tfe_release(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_tfe_start(void *device_priv,
+	void *start_args, uint32_t arg_size);
+int cam_tfe_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_tfe_read(void *device_priv,
+	void *read_args, uint32_t arg_size);
+int cam_tfe_write(void *device_priv,
+	void *write_args, uint32_t arg_size);
+int cam_tfe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+irqreturn_t cam_tfe_irq(int irq_num, void *data);
+
+int cam_tfe_core_init(struct cam_tfe_hw_core_info *core_info,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	struct cam_tfe_hw_info             *tfe_hw_info);
+
+int cam_tfe_core_deinit(struct cam_tfe_hw_core_info *core_info,
+	struct cam_tfe_hw_info             *tfe_hw_info);
+
+#endif /* _CAM_TFE_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.c
@@ -0,0 +1,279 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <dt-bindings/msm-camera.h>
+#include "cam_tfe_dev.h"
+#include "cam_tfe_core.h"
+#include "cam_tfe_soc.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_cpas_api.h"
+
+static struct cam_isp_hw_intf_data  cam_tfe_hw_list[CAM_TFE_HW_NUM_MAX];
+static uint32_t g_num_tfe_hws, g_num_tfe_lite_hws;
+
+static int cam_tfe_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info                *tfe_hw = NULL;
+	struct cam_hw_intf                *tfe_hw_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_tfe_hw_info            *hw_info = NULL;
+	struct cam_tfe_soc_private        *tfe_soc_priv;
+	int                                rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+	uint32_t tfe_hw_idx = 0;
+	uint32_t  i;
+
+	CAM_DBG(CAM_ISP, "probe called");
+
+	rc = of_property_read_u32(pdev->dev.of_node, "cell-index", &tfe_hw_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to read cell-index of TFE HW, rc: %d", rc);
+		goto end;
+	}
+
+	if (!cam_cpas_is_feature_supported(CAM_CPAS_ISP_FUSE, BIT(tfe_hw_idx), NULL) ||
+		!cam_cpas_is_feature_supported(CAM_CPAS_ISP_LITE_FUSE, BIT(tfe_hw_idx), NULL)) {
+		CAM_DBG(CAM_ISP, "TFE[%d] not supported based on fuse", tfe_hw_idx);
+		goto end;
+	}
+
+	tfe_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!tfe_hw_intf) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	tfe_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!tfe_hw) {
+		rc = -ENOMEM;
+		goto free_tfe_hw_intf;
+	}
+
+	tfe_hw->soc_info.pdev = pdev;
+	tfe_hw->soc_info.dev = &pdev->dev;
+	tfe_hw->soc_info.dev_name = pdev->name;
+	tfe_hw_intf->hw_priv = tfe_hw;
+	tfe_hw_intf->hw_idx = tfe_hw_idx;
+	tfe_hw_intf->hw_ops.get_hw_caps = cam_tfe_get_hw_caps;
+	tfe_hw_intf->hw_ops.init = cam_tfe_init_hw;
+	tfe_hw_intf->hw_ops.deinit = cam_tfe_deinit_hw;
+	tfe_hw_intf->hw_ops.reset = cam_tfe_reset;
+	tfe_hw_intf->hw_ops.reserve = cam_tfe_reserve;
+	tfe_hw_intf->hw_ops.release = cam_tfe_release;
+	tfe_hw_intf->hw_ops.start = cam_tfe_start;
+	tfe_hw_intf->hw_ops.stop = cam_tfe_stop;
+	tfe_hw_intf->hw_ops.read = cam_tfe_read;
+	tfe_hw_intf->hw_ops.write = cam_tfe_write;
+	tfe_hw_intf->hw_ops.process_cmd = cam_tfe_process_cmd;
+	tfe_hw_intf->hw_type = CAM_ISP_HW_TYPE_TFE;
+
+	CAM_DBG(CAM_ISP, "TFE component bind,type %d index %d",
+		tfe_hw_intf->hw_type, tfe_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, tfe_hw_intf);
+
+	tfe_hw->core_info = kzalloc(sizeof(struct cam_tfe_hw_core_info),
+		GFP_KERNEL);
+	if (!tfe_hw->core_info) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for core");
+		rc = -ENOMEM;
+		goto free_tfe_hw;
+	}
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "Of_match Failed");
+		rc = -EINVAL;
+		goto free_core_info;
+	}
+	hw_info = (struct cam_tfe_hw_info *)match_dev->data;
+	core_info->tfe_hw_info = hw_info;
+	core_info->core_index = tfe_hw_intf->hw_idx;
+
+	rc = cam_tfe_init_soc_resources(&tfe_hw->soc_info, cam_tfe_irq,
+		tfe_hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Failed to init soc rc=%d", rc);
+		goto free_core_info;
+	}
+
+	rc = cam_tfe_core_init(core_info, &tfe_hw->soc_info,
+		tfe_hw_intf, hw_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Failed to init core rc=%d", rc);
+		goto deinit_soc;
+	}
+
+	tfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&tfe_hw->hw_mutex);
+	spin_lock_init(&tfe_hw->hw_lock);
+	init_completion(&tfe_hw->hw_complete);
+
+	if (tfe_hw_intf->hw_idx < CAM_TFE_HW_NUM_MAX)
+		cam_tfe_hw_list[tfe_hw_intf->hw_idx].hw_intf = tfe_hw_intf;
+	else {
+		CAM_ERR(CAM_ISP, "HW index:%d is wrong max HW idx:%d",
+			tfe_hw_intf->hw_idx, CAM_TFE_HW_NUM_MAX);
+		goto deinit_soc;
+	}
+
+	tfe_soc_priv = tfe_hw->soc_info.soc_private;
+	cam_tfe_hw_list[tfe_hw_intf->hw_idx].num_hw_pid = tfe_soc_priv->num_pid;
+	for (i = 0; i < tfe_soc_priv->num_pid; i++)
+		cam_tfe_hw_list[tfe_hw_intf->hw_idx].hw_pid[i] =
+			tfe_soc_priv->pid[i];
+
+	cam_tfe_init_hw(tfe_hw, NULL, 0);
+	cam_tfe_deinit_hw(tfe_hw, NULL, 0);
+
+	CAM_DBG(CAM_ISP, "TFE:%d component bound successfully",
+		tfe_hw_intf->hw_idx);
+	return rc;
+
+deinit_soc:
+	if (cam_tfe_deinit_soc_resources(&tfe_hw->soc_info))
+		CAM_ERR(CAM_ISP, "Failed to deinit soc");
+free_core_info:
+	kfree(tfe_hw->core_info);
+free_tfe_hw:
+	kfree(tfe_hw);
+free_tfe_hw_intf:
+	kfree(tfe_hw_intf);
+end:
+	return rc;
+}
+
+static void cam_tfe_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info		  *tfe_hw = NULL;
+	struct cam_hw_intf		  *tfe_hw_intf = NULL;
+	struct cam_tfe_hw_core_info	  *core_info = NULL;
+	int				   rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	tfe_hw_intf = platform_get_drvdata(pdev);
+	if (!tfe_hw_intf) {
+		CAM_ERR(CAM_ISP, "Error! No data in pdev");
+		return;
+	}
+
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		tfe_hw_intf->hw_type, tfe_hw_intf->hw_idx);
+
+	if (tfe_hw_intf->hw_idx < CAM_TFE_HW_NUM_MAX)
+		cam_tfe_hw_list[tfe_hw_intf->hw_idx].hw_intf = NULL;
+
+	tfe_hw = tfe_hw_intf->hw_priv;
+	if (!tfe_hw) {
+		CAM_ERR(CAM_ISP, "Error! HW data is NULL");
+		goto free_tfe_hw_intf;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_ISP, "Error! core data NULL");
+		goto deinit_soc;
+	}
+
+	rc = cam_tfe_core_deinit(core_info, core_info->tfe_hw_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "Failed to deinit core rc=%d", rc);
+
+	kfree(tfe_hw->core_info);
+
+deinit_soc:
+	rc = cam_tfe_deinit_soc_resources(&tfe_hw->soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&tfe_hw->hw_mutex);
+	kfree(tfe_hw);
+
+	CAM_DBG(CAM_ISP, "TFE%d component unbound", tfe_hw_intf->hw_idx);
+
+free_tfe_hw_intf:
+	kfree(tfe_hw_intf);
+}
+
+const static struct component_ops cam_tfe_component_ops = {
+	.bind = cam_tfe_component_bind,
+	.unbind = cam_tfe_component_unbind,
+};
+
+void cam_tfe_get_num_tfe_hws(uint32_t *num_tfes)
+{
+	if (num_tfes)
+		*num_tfes = g_num_tfe_hws;
+	else
+		CAM_ERR(CAM_ISP, "Invalid argument, g_num_tfe_hws: %u", g_num_tfe_hws);
+}
+
+void cam_tfe_get_num_tfe_lite_hws(uint32_t *num_tfe_lites)
+{
+	if (num_tfe_lites)
+		*num_tfe_lites = g_num_tfe_lite_hws;
+	else
+		CAM_ERR(CAM_ISP, "Invalid argument, g_num_tfe_lite_hws: %u", g_num_tfe_lite_hws);
+}
+
+int cam_tfe_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+	const char *compatible_name;
+	struct device_node *of_node = NULL;
+
+	CAM_DBG(CAM_ISP, "Adding TFE component");
+
+	of_node = pdev->dev.of_node;
+
+	rc = of_property_read_string_index(of_node, "compatible", 0,
+		(const char **)&compatible_name);
+	if (rc)
+		CAM_ERR(CAM_ISP, "No compatible string present for: %s, rc: %d", pdev->name, rc);
+
+	if (strnstr(compatible_name, "lite", strlen(compatible_name)) != NULL)
+		g_num_tfe_lite_hws++;
+	else if (strnstr(compatible_name, "tfe", strlen(compatible_name)) != NULL)
+		g_num_tfe_hws++;
+	else
+		CAM_ERR(CAM_ISP, "Failed to increement number of TFEs/TFE-LITEs");
+
+	rc = component_add(&pdev->dev, &cam_tfe_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_tfe_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_tfe_component_ops);
+	return 0;
+}
+
+int cam_tfe_hw_init(struct cam_isp_hw_intf_data **tfe_hw_intf,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_tfe_hw_list[hw_idx].hw_intf) {
+		*tfe_hw_intf = &cam_tfe_hw_list[hw_idx];
+		rc = 0;
+	} else {
+		*tfe_hw_intf = NULL;
+		rc = -ENODEV;
+	}
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.h
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_DEV_H_
+#define _CAM_TFE_DEV_H_
+
+#include <linux/platform_device.h>
+
+/*
+ * cam_tfe_probe()
+ *
+ * @brief:                   Driver probe function called on Boot
+ *
+ * @pdev:                    Platform Device pointer
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_probe(struct platform_device *pdev);
+
+/*
+ * cam_tfe_remove()
+ *
+ * @brief:                   Driver remove function
+ *
+ * @pdev:                    Platform Device pointer
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_remove(struct platform_device *pdev);
+
+int cam_tfe_init_module(void);
+void cam_tfe_exit_module(void);
+
+#endif /* _CAM_TFE_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_irq.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_irq.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_IRQ_H_
+#define _CAM_TFE_IRQ_H_
+
+#include <linux/platform_device.h>
+
+#define CAM_TFE_TOP_IRQ_REG_NUM 3
+
+/*
+ * cam_tfe_irq_config()
+ *
+ * @brief:                   Tfe hw irq configuration
+ *
+ * @tfe_core_data:           tfe core pointer
+ * @irq_mask:                Irq mask for enable interrupts or disable
+ * @num_reg:                 Number irq mask registers
+ * @enable:                  enable = 1, enable the given irq mask interrupts
+ *                           enable = 0 disable the given irq mask interrupts
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_irq_config(void     *tfe_core_data,
+	uint32_t  *irq_mask, uint32_t num_reg, bool enable);
+
+
+#endif /* _CAM_TFE_IRQ_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_lite770.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_lite770.h
@@ -0,0 +1,584 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE_LITE770_H_
+#define _CAM_TFE_LITE770_H_
+#include "cam_tfe_core.h"
+#include "cam_tfe_bus.h"
+
+
+/* throtle cfg register not used, diag sensor frame cnt status1 */
+static struct cam_tfe_top_reg_offset_common  tfe_lite770_top_commong_reg  = {
+	.hw_version                             = 0x00001800,
+	.hw_capability                          = 0x00001804,
+	.lens_feature                           = 0x00001808,
+	.stats_feature                          = 0x0000180C,
+	.zoom_feature                           = 0x00001810,
+	.global_reset_cmd                       = 0x00001814,
+	.core_cgc_ctrl_0                        = 0x00001818,
+	.core_cgc_ctrl_1                        = 0x0000181C,
+	.ahb_cgc_ctrl                           = 0x00001820,
+	.core_cfg_0                             = 0x00001824,
+	.reg_update_cmd                         = 0x0000182C,
+	.diag_config                            = 0x00001860,
+	.diag_sensor_status_0                   = 0x00001864,
+	.diag_sensor_status_1                   = 0x00001868,
+	.diag_sensor_frame_cnt_status           = 0x0000186C,
+	.violation_status                       = 0x00001870,
+	.stats_throttle_cnt_cfg_0               = 0x00001874,
+	.stats_throttle_cnt_cfg_1               = 0x00001878,
+	.num_debug_reg                          = 12,
+	.debug_reg = {
+		0x000018A0,
+		0x000018A4,
+		0x000018A8,
+		0x000018AC,
+		0x000018B0,
+		0x000018B4,
+		0x000018B8,
+		0x000018BC,
+		0x000018C0,
+		0x000018C4,
+		0x000018C8,
+		0x000018CC,
+	},
+	.debug_cfg                              = 0x000018DC,
+	.num_perf_cfg                           = 2,
+	.perf_cfg = {
+		{
+			.perf_cnt_cfg           = 0x000018E0,
+			.perf_pixel_count       = 0x000018E4,
+			.perf_line_count        = 0x000018E8,
+			.perf_stall_count       = 0x000018EC,
+			.perf_always_count      = 0x000018F0,
+			.perf_count_status      = 0x000018F4,
+		},
+		{
+			.perf_cnt_cfg           = 0x000018F8,
+			.perf_pixel_count       = 0x000018FC,
+			.perf_line_count        = 0x00001900,
+			.perf_stall_count       = 0x00001904,
+			.perf_always_count      = 0x00001908,
+			.perf_count_status      = 0x0000190C,
+		},
+	},
+	.diag_sensor_frame_cnt_status_1         = 0x00001920,
+	.diag_min_hbi_error_shift               = 15,
+	.diag_neq_hbi_shift                     = 14,
+	.diag_sensor_hbi_mask                   = 0x3FFF,
+	.serializer_supported                   = true,
+	.height_shift                           = 16,
+	.epoch_shift_val                        = 16,
+};
+
+static struct cam_tfe_rdi_reg  tfe_lite770_rdi0_reg = {
+	.rdi_hw_version              = 0x00001E00,
+	.rdi_hw_status               = 0x00001E04,
+	.rdi_module_config           = 0x00001E60,
+	.rdi_skip_period             = 0x00001E68,
+	.rdi_irq_subsample_pattern   = 0x00001E6C,
+	.rdi_epoch_irq               = 0x00001E70,
+	.rdi_debug_1                 = 0x00001FF0,
+	.rdi_debug_0                 = 0x00001FF4,
+	.rdi_test_bus_ctrl           = 0x00001FF8,
+	.rdi_spare                   = 0x00001FFC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe_lite770_rdi0_reg_data = {
+	.reg_update_cmd_data         = 0x2,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000010,
+	.epoch0_irq_mask             = 0x00000040,
+	.epoch1_irq_mask             = 0x00000080,
+	.eof_irq_mask                = 0x00000020,
+	.error_irq_mask0             = 0x00020200,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000030,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x1,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe_lite770_rdi1_reg = {
+	.rdi_hw_version              = 0x00002000,
+	.rdi_hw_status               = 0x00002004,
+	.rdi_module_config           = 0x00002060,
+	.rdi_skip_period             = 0x00002068,
+	.rdi_irq_subsample_pattern   = 0x0000206C,
+	.rdi_epoch_irq               = 0x00002070,
+	.rdi_debug_1                 = 0x000021F0,
+	.rdi_debug_0                 = 0x000021F4,
+	.rdi_test_bus_ctrl           = 0x000021F8,
+	.rdi_spare                   = 0x000021FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe_lite770_rdi1_reg_data = {
+	.reg_update_cmd_data         = 0x4,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000100,
+	.epoch0_irq_mask             = 0x00000400,
+	.epoch1_irq_mask             = 0x00000800,
+	.eof_irq_mask                = 0x00000200,
+	.error_irq_mask0             = 0x00040400,
+	.error_irq_mask2             = 0x00000008,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000300,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x2,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe_lite770_rdi2_reg = {
+	.rdi_hw_version              = 0x00002200,
+	.rdi_hw_status               = 0x00002204,
+	.rdi_module_config           = 0x00002260,
+	.rdi_skip_period             = 0x00002268,
+	.rdi_irq_subsample_pattern   = 0x0000226C,
+	.rdi_epoch_irq               = 0x00002270,
+	.rdi_debug_1                 = 0x000023F0,
+	.rdi_debug_0                 = 0x000023F4,
+	.rdi_test_bus_ctrl           = 0x000023F8,
+	.rdi_spare                   = 0x000023FC,
+	.reg_update_cmd              = 0x0000182C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe_lite770_rdi2_reg_data = {
+	.reg_update_cmd_data         = 0x8,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00001000,
+	.epoch0_irq_mask             = 0x00004000,
+	.epoch1_irq_mask             = 0x00008000,
+	.eof_irq_mask                = 0x00002000,
+	.error_irq_mask0             = 0x00080800,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00003000,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x3,
+	.diag_sensor_shift           = 0x1,
+
+};
+
+static struct cam_tfe_clc_hw_status  tfe_lite770_clc_hw_info[CAM_TFE_LITE_MAX_CLC] = {
+	{
+		.name = "CLC_RDI0_CAMIF",
+		.hw_status_reg = 0x1E04,
+	},
+	{
+		.name = "CLC_RDI1_CAMIF",
+		.hw_status_reg = 0x2004,
+	},
+	{
+		.name = "CLC_RDI2_CAMIF",
+		.hw_status_reg = 0x2204,
+	},
+};
+
+static struct  cam_tfe_top_hw_info tfe_lite770_top_hw_info = {
+	.common_reg = &tfe_lite770_top_commong_reg,
+	.rdi_hw_info  = {
+		{
+			.rdi_reg  = &tfe_lite770_rdi0_reg,
+			.reg_data = &tfe_lite770_rdi0_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe_lite770_rdi1_reg,
+			.reg_data = &tfe_lite770_rdi1_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe_lite770_rdi2_reg,
+			.reg_data = &tfe_lite770_rdi2_reg_data,
+		},
+	},
+	.in_port = {
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0
+	},
+	.reg_dump_data  = {
+		.num_reg_dump_entries    = 19,
+		.num_lut_dump_entries    = 0,
+		.bus_start_addr          = 0x2000,
+		.bus_write_top_end_addr  = 0x2120,
+		.bus_client_start_addr   = 0x2200,
+		.bus_client_offset       = 0x100,
+		.num_bus_clients         = 10,
+		.reg_entry = {
+			{
+				.start_offset = 0x1000,
+				.end_offset   = 0x10F4,
+			},
+			{
+				.start_offset = 0x1260,
+				.end_offset   = 0x1280,
+			},
+			{
+				.start_offset = 0x13F0,
+				.end_offset   = 0x13FC,
+			},
+			{
+				.start_offset = 0x1460,
+				.end_offset   = 0x1470,
+			},
+			{
+				.start_offset = 0x15F0,
+				.end_offset   = 0x15FC,
+			},
+			{
+				.start_offset = 0x1660,
+				.end_offset   = 0x1670,
+			},
+			{
+				.start_offset = 0x17F0,
+				.end_offset   = 0x17FC,
+			},
+			{
+				.start_offset = 0x1860,
+				.end_offset   = 0x1870,
+			},
+			{
+				.start_offset = 0x19F0,
+				.end_offset   = 0x19FC,
+			},
+			{
+				.start_offset = 0x2660,
+				.end_offset   = 0x2694,
+			},
+			{
+				.start_offset = 0x2860,
+				.end_offset   = 0x2884,
+			},
+			{
+				.start_offset = 0x2A60,
+				.end_offset   = 0X2B34,
+			},
+			{
+				.start_offset = 0x2C60,
+				.end_offset   = 0X2C80,
+			},
+			{
+				.start_offset = 0x2E60,
+				.end_offset   = 0X2E7C,
+			},
+			{
+				.start_offset = 0x3060,
+				.end_offset   = 0X3110,
+			},
+			{
+				.start_offset = 0x3260,
+				.end_offset   = 0X3278,
+			},
+			{
+				.start_offset = 0x3460,
+				.end_offset   = 0X3478,
+			},
+			{
+				.start_offset = 0x3660,
+				.end_offset   = 0X3684,
+			},
+			{
+				.start_offset = 0x3860,
+				.end_offset   = 0X3884,
+			},
+		},
+		.lut_entry = {
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x40,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x2800,
+			},
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x41,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x3000,
+			},
+		},
+	},
+};
+
+static struct cam_tfe_bus_hw_info  tfe_lite770_bus_hw_info = {
+	.common_reg = {
+		.hw_version  = 0x00003000,
+		.cgc_ovd     = 0x00003008,
+		.comp_cfg_0  = 0x0000300C,
+		.comp_cfg_1  = 0x00003010,
+		.frameheader_cfg  = {
+			0x00003034,
+			0x00003038,
+			0x0000303C,
+			0x00003040,
+		},
+		.pwr_iso_cfg = 0x0000305C,
+		.overflow_status_clear = 0x00003060,
+		.ccif_violation_status = 0x00003064,
+		.overflow_status       = 0x00003068,
+		.image_size_violation_status = 0x00003070,
+		.perf_count_cfg = {
+			0x00003074,
+			0x00003078,
+			0x0000307C,
+			0x00003080,
+			0x00003084,
+			0x00003088,
+			0x0000308C,
+			0x00003090,
+		},
+		.perf_count_val = {
+			0x00003094,
+			0x00003098,
+			0x0000309C,
+			0x000030A0,
+			0x000030A4,
+			0x000030A8,
+			0x000030AC,
+			0x000030B0,
+		},
+		.perf_count_status = 0x000030B4,
+		.debug_status_top_cfg = 0x000030D4,
+		.debug_status_top = 0x000030D8,
+		.test_bus_ctrl = 0x000030DC,
+		.irq_mask = {
+			0x00003018,
+			0x0000301C,
+		},
+		.irq_clear = {
+			0x00003020,
+			0x00003024,
+		},
+		.irq_status = {
+			0x00003028,
+			0x0000302C,
+		},
+		.irq_cmd = 0x00003030,
+		.cons_violation_shift = 28,
+		.violation_shift  = 30,
+		.image_size_violation = 31,
+	},
+	.num_client = 3,
+	.bus_client_reg = {
+		{
+			.cfg                   = 0x00003900,
+			.image_addr            = 0x00003904,
+			.frame_incr            = 0x00003908,
+			.image_cfg_0           = 0x0000390C,
+			.image_cfg_1           = 0x00003910,
+			.image_cfg_2           = 0x00003914,
+			.packer_cfg            = 0x00003918,
+			.bw_limit              = 0x0000391C,
+			.frame_header_addr     = 0x00003920,
+			.frame_header_incr     = 0x00003924,
+			.frame_header_cfg      = 0x00003928,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003930,
+			.irq_subsample_pattern = 0x00003934,
+			.framedrop_period      = 0x00003938,
+			.framedrop_pattern     = 0x0000393C,
+			.system_cache_cfg      = 0x00003960,
+			.addr_status_0         = 0x00003968,
+			.addr_status_1         = 0x0000396C,
+			.addr_status_2         = 0x00003970,
+			.addr_status_3         = 0x00003974,
+			.debug_status_cfg      = 0x00003978,
+			.debug_status_0        = 0x0000397C,
+			.debug_status_1        = 0x00003980,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_5,
+			.client_name           = "RDI0",
+		},
+		/* BUS Client 8 RDI1 */
+		{
+			.cfg                   = 0x00003A00,
+			.image_addr            = 0x00003A04,
+			.frame_incr            = 0x00003A08,
+			.image_cfg_0           = 0x00003A0C,
+			.image_cfg_1           = 0x00003A10,
+			.image_cfg_2           = 0x00003A14,
+			.packer_cfg            = 0x00003A18,
+			.bw_limit              = 0x00003A1C,
+			.frame_header_addr     = 0x00003A20,
+			.frame_header_incr     = 0x00003A24,
+			.frame_header_cfg      = 0x00003A28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003A30,
+			.irq_subsample_pattern = 0x00003A34,
+			.framedrop_period      = 0x00003A38,
+			.framedrop_pattern     = 0x00003A3C,
+			.system_cache_cfg      = 0x00003A60,
+			.addr_status_0         = 0x00003A68,
+			.addr_status_1         = 0x00003A6C,
+			.addr_status_2         = 0x00003A70,
+			.addr_status_3         = 0x00003A74,
+			.debug_status_cfg      = 0x00003A78,
+			.debug_status_0        = 0x00003A7C,
+			.debug_status_1        = 0x00003A80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_6,
+			.client_name           = "RDI1",
+		},
+		/* BUS Client 9 RDI2 */
+		{
+			.cfg                   = 0x00003B00,
+			.image_addr            = 0x00003B04,
+			.frame_incr            = 0x00003B08,
+			.image_cfg_0           = 0x00003B0C,
+			.image_cfg_1           = 0x00003B10,
+			.image_cfg_2           = 0x00003B14,
+			.packer_cfg            = 0x00003B18,
+			.bw_limit              = 0x00003B1C,
+			.frame_header_addr     = 0x00003B20,
+			.frame_header_incr     = 0x00003B24,
+			.frame_header_cfg      = 0x00003B28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00003B30,
+			.irq_subsample_pattern = 0x00003B34,
+			.framedrop_period      = 0x00003B38,
+			.framedrop_pattern     = 0x00003B3C,
+			.system_cache_cfg      = 0x00003B60,
+			.addr_status_0         = 0x00003B68,
+			.addr_status_1         = 0x00003B6C,
+			.addr_status_2         = 0x00003B70,
+			.addr_status_3         = 0x00003B74,
+			.debug_status_cfg      = 0x00003B78,
+			.debug_status_0        = 0x00003B7C,
+			.debug_status_1        = 0x00003B80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_7,
+			.client_name           = "RDI2",
+		},
+	},
+	.num_out  = 3,
+	.tfe_out_hw_info = {
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI0,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_1,
+			.mid[0]              = 4,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI1,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_1,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_2,
+			.mid[0]              = 5,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI2,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_3,
+			.mid[0]              = 6,
+		},
+	},
+	.num_comp_grp             = 3,
+	.max_wm_per_comp_grp      = 3,
+	.comp_done_shift          = 8,
+	.top_bus_wr_irq_shift     = 1,
+	.comp_buf_done_mask = 0xE000,
+	.comp_rup_done_mask = 0xF,
+	.bus_irq_error_mask = {
+		0xD0000000,
+		0x00000000,
+	},
+	.support_consumed_addr = true,
+	.pdaf_rdi2_mux_en = false,
+	.rdi_width = 128,
+	.mode_cfg_shift = 16,
+	.height_shift = 16,
+};
+
+struct cam_tfe_hw_info cam_tfe_lite770 = {
+	.top_irq_mask = {
+		0x00001834,
+		0x00001838,
+		0x0000183C,
+	},
+	.top_irq_clear = {
+		0x00001840,
+		0x00001844,
+		0x00001848,
+	},
+	.top_irq_status = {
+		0x0000184C,
+		0x00001850,
+		0x00001854,
+	},
+	.top_irq_cmd                       = 0x00001830,
+	.global_clear_bitmask              = 0x00000001,
+	.bus_irq_mask = {
+		0x00003018,
+		0x0000301C,
+	},
+	.bus_irq_clear = {
+		0x00003020,
+		0x00003024,
+	},
+	.bus_irq_status = {
+		0x00003028,
+		0x0000302C,
+	},
+	.bus_irq_cmd = 0x00003030,
+	.bus_violation_reg = 0x00003064,
+	.bus_overflow_reg = 0x00003068,
+	.bus_image_size_vilation_reg = 0x3070,
+	.bus_overflow_clear_cmd = 0x3060,
+	.debug_status_top = 0x30D8,
+
+	.reset_irq_mask = {
+		0x00000001,
+		0x00000000,
+		0x00000000,
+	},
+	.error_irq_mask = {
+		0x000F0F00,
+		0x00000000,
+		0x0000003F,
+	},
+	.bus_reg_irq_mask = {
+		0x00000002,
+		0x00000000,
+	},
+	.bus_error_irq_mask = {
+		0xC0000000,
+		0x00000000,
+	},
+
+	.num_clc = 3,
+	.clc_hw_status_info            = tfe_lite770_clc_hw_info,
+	.bus_version                   = CAM_TFE_BUS_1_0,
+	.bus_hw_info                   = &tfe_lite770_bus_hw_info,
+
+	.top_version                   = CAM_TFE_TOP_1_0,
+	.top_hw_info                   = &tfe_lite770_top_hw_info,
+};
+
+#endif /* _CAM_TFE_LITE770__H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.c
@@ -0,0 +1,294 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_cpas_api.h"
+#include "cam_tfe_soc.h"
+#include "cam_debug_util.h"
+
+static bool cam_tfe_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool error_handled = false;
+
+	if (!irq_data)
+		return error_handled;
+
+	CAM_DBG(CAM_ISP, "CPSS error type=%d ",
+		irq_data->irq_type);
+
+	return error_handled;
+}
+
+int cam_tfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t tfe_irq_handler, void *data)
+{
+	struct cam_tfe_soc_private       *soc_private;
+	struct cam_cpas_register_params   cpas_register_param;
+	int    rc = 0,  i = 0, num_pid = 0;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	soc_private = kzalloc(sizeof(struct cam_tfe_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_ISP, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! get DT properties failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	soc_private->is_tfe_lite = false;
+	if (strnstr(soc_info->compatible, "lite",
+		strlen(soc_info->compatible)) != NULL)
+		soc_private->is_tfe_lite = true;
+
+	rc = of_property_read_u32(soc_info->pdev->dev.of_node, "rt-wrapper-base",
+		&soc_private->rt_wrapper_base);
+	if (rc) {
+		soc_private->rt_wrapper_base = 0;
+		CAM_DBG(CAM_ISP, "rc: %d Error reading rt_wrapper_base for core_idx: %u",
+			rc, soc_info->index);
+		rc = 0;
+	}
+
+	/* set some default values */
+	soc_private->num_pid = 0;
+
+	num_pid = of_property_count_u32_elems(soc_info->pdev->dev.of_node,
+		"cam_hw_pid");
+	CAM_DBG(CAM_CPAS, "tfe:%d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_ISP_HW_MAX_PID_VAL)
+		goto clk_option;
+
+	for (i = 0; i < num_pid; i++) {
+		of_property_read_u32_index(soc_info->pdev->dev.of_node,
+		"cam_hw_pid", i, &soc_private->pid[i]);
+		CAM_INFO(CAM_CPAS, "tfe:%d I:%d pid %d", soc_info->index,
+			i, soc_private->pid[i]);
+	}
+
+	soc_private->num_pid = num_pid;
+
+clk_option:
+
+	rc = cam_soc_util_get_option_clk_by_name(soc_info, CAM_TFE_DSP_CLK_NAME,
+		&soc_private->dsp_clk_index);
+	if (rc)
+		CAM_WARN(CAM_ISP, "Option clk get failed with rc %d", rc);
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, tfe_irq_handler, &(irq_data[0]));
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Error! Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "tfe",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	cpas_register_param.cam_cpas_client_cb = cam_tfe_cpas_cb;
+	cpas_register_param.userdata = soc_info;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	}
+
+	soc_private->cpas_handle = cpas_register_param.client_handle;
+
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_tfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! soc_info NULL");
+		return -ENODEV;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPAS0 unregistration failed rc=%d", rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Error! Release platform resource failed rc=%d", rc);
+
+
+	if (soc_private->dsp_clk_index != -1) {
+		rc = cam_soc_util_put_optional_clk(soc_info,
+			soc_private->dsp_clk_index);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Error Put dsp clk failed rc=%d", rc);
+	}
+
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_tfe_enable_soc_resources(
+	struct cam_hw_soc_info  *soc_info,
+	unsigned long           max_clk_rate)
+{
+	int                               rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+	struct cam_ahb_vote               ahb_vote;
+	struct cam_axi_vote               axi_vote = {0};
+	int32_t                           apply_level = CAM_LOWSVS_VOTE;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type       = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 1;
+	if (soc_private->is_tfe_lite)
+		axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_IFE_RDI1;
+	else
+		axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_IFE_VID;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_RT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_RT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_RT_AXI_BW;
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! CPAS0 start failed rc=%d", rc);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (max_clk_rate) {
+		rc = cam_soc_util_get_clk_level(soc_info, max_clk_rate, soc_info->src_clk_idx,
+			&apply_level);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Error! getting clk level");
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		apply_level, true);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! enable platform failed rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_tfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	int  rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+	soc_private = soc_info->soc_private;
+
+	if (strcmp(clk_name, CAM_TFE_DSP_CLK_NAME) == 0) {
+		rc = cam_soc_util_clk_enable(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+			soc_private->dsp_clk_index, 0);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+			"Error enable dsp clk failed rc=%d", rc);
+	}
+
+	return rc;
+}
+
+int cam_tfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	int  rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+	soc_private = soc_info->soc_private;
+
+	if (strcmp(clk_name, CAM_TFE_DSP_CLK_NAME) == 0) {
+		rc = cam_soc_util_clk_disable(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+			soc_private->dsp_clk_index);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+			"Error enable dsp clk failed rc=%d", rc);
+	}
+
+	return rc;
+}
+
+
+int cam_tfe_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Disable platform failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.h
@@ -0,0 +1,127 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_SOC_H_
+#define _CAM_TFE_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_isp_hw.h"
+
+#define CAM_TFE_DSP_CLK_NAME "tfe_dsp_clk"
+
+enum cam_cpas_handle_id {
+	CAM_CPAS_HANDLE_CAMIF,
+	CAM_CPAS_HANDLE_RAW,
+	CAM_CPAS_HANDLE_MAX,
+};
+
+/*
+ * struct cam_tfe_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to TFE HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ * @cpas_version:            Has cpas version read from Hardware
+ * @dsp_clk_index:           DSP clk index in optional clocks
+ * @num_pid:                 number of pids of tfe
+ * @pid:                     TFE pid value list
+ * @is_tfe_lite:             Flag to indicate if it is TFE Lite HW
+ */
+struct cam_tfe_soc_private {
+	uint32_t    cpas_handle;
+	uint32_t    cpas_version;
+	uint32_t    rt_wrapper_base;
+	int32_t     dsp_clk_index;
+	uint32_t    num_pid;
+	uint32_t    pid[CAM_ISP_HW_MAX_PID_VAL];
+	bool        is_tfe_lite;
+};
+
+/*
+ * cam_tfe_init_soc_resources()
+ *
+ * @Brief:                   Initialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ * @handler:                 Irq handler function pointer
+ * @irq_data:                Irq handler function Callback data
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t tfe_irq_handler, void *irq_data);
+
+/*
+ * cam_tfe_deinit_soc_resources()
+ *
+ * @Brief:                   Deinitialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_tfe_enable_soc_resources()
+ *
+ * @brief:                   Enable regulator, irq resources, start CPAS
+ *
+ * @soc_info:                Device soc information
+ *
+ * @max_clk_rate:            Max clock rate value
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_enable_soc_resources(struct cam_hw_soc_info *soc_info,
+	unsigned long max_clk_rate);
+
+/*
+ * cam_tfe_disable_soc_resources()
+ *
+ * @brief:                   Disable regulator, irq resources, stop CPAS
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_tfe_soc_enable_clk()
+ *
+ * @brief:                   Enable clock with given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+/*
+ * cam_tfe_soc_disable_dsp_clk()
+ *
+ * @brief:                   Disable clock with given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+#endif /* _CAM_TFE_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.c
@@ -0,0 +1,723 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/timer.h>
+#include <linux/ratelimit.h>
+#include "cam_tasklet_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_top.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_common_util.h"
+
+static const char drv_name[] = "vfe";
+
+int cam_vfe_get_hw_caps(void *hw_priv, void *get_hw_cap_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *vfe_dev = hw_priv;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_dev->core_info;
+
+	if (core_info->vfe_top->hw_ops.get_hw_caps)
+		core_info->vfe_top->hw_ops.get_hw_caps(
+			core_info->vfe_top->top_priv,
+			get_hw_cap_args, arg_size);
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+int cam_vfe_reset_irq_top_half(uint32_t    evt_id,
+	struct cam_irq_th_payload         *th_payload)
+{
+	int32_t                            rc = -EINVAL;
+	struct cam_hw_info                *vfe_hw;
+
+	vfe_hw = th_payload->handler_priv;
+
+	CAM_DBG(CAM_ISP, "TOP_IRQ_STATUS_0 = 0x%x",
+		th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS0]);
+
+	complete(&vfe_hw->hw_complete);
+
+	return rc;
+}
+
+int cam_vfe_init_hw(void *hw_priv, void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *vfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_isp_resource_node      *isp_res = NULL;
+	int rc = 0;
+	uint32_t                           reset_core_args =
+					CAM_VFE_HW_RESET_HW_AND_REG;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	vfe_hw->open_count++;
+	if (vfe_hw->open_count > 1) {
+		mutex_unlock(&vfe_hw->hw_mutex);
+		CAM_DBG(CAM_ISP, "VFE has already been initialized cnt %d",
+			vfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	soc_info = &vfe_hw->soc_info;
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	/* Turn ON Regulators, Clocks and other SOC resources */
+	rc = cam_vfe_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Enable SOC failed");
+		rc = -EFAULT;
+		goto decrement_open_cnt;
+	}
+
+	isp_res   = (struct cam_isp_resource_node *)init_hw_args;
+	if (isp_res && isp_res->init) {
+		rc = isp_res->init(isp_res, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "init Failed rc=%d", rc);
+			goto disable_soc;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Enable soc done");
+
+	/* Do HW Reset */
+	rc = cam_vfe_reset(hw_priv, &reset_core_args, sizeof(uint32_t));
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Reset Failed rc=%d", rc);
+		goto deinint_vfe_res;
+	}
+
+	rc = core_info->vfe_bus->hw_ops.init(core_info->vfe_bus->bus_priv,
+		NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Bus HW init Failed rc=%d", rc);
+		goto deinint_vfe_res;
+	}
+
+	rc = core_info->vfe_top->hw_ops.init(core_info->vfe_top->top_priv,
+		NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Top HW init Failed rc=%d", rc);
+		goto deinint_vfe_res;
+	}
+
+	if (core_info->vfe_rd_bus) {
+		rc = core_info->vfe_rd_bus->hw_ops.init(
+			core_info->vfe_rd_bus->bus_priv,
+			NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Bus RD HW init Failed rc=%d", rc);
+			goto deinint_vfe_res;
+		}
+	}
+
+	vfe_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	return rc;
+
+deinint_vfe_res:
+	if (isp_res && isp_res->deinit)
+		isp_res->deinit(isp_res, NULL, 0);
+disable_soc:
+	cam_vfe_disable_soc_resources(soc_info);
+decrement_open_cnt:
+	mutex_lock(&vfe_hw->hw_mutex);
+	vfe_hw->open_count--;
+	mutex_unlock(&vfe_hw->hw_mutex);
+	return rc;
+}
+
+int cam_vfe_deinit_hw(void *hw_priv, void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *vfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_isp_resource_node      *isp_res = NULL;
+	int rc = 0;
+	uint32_t                           reset_core_args =
+					CAM_VFE_HW_RESET_HW_AND_REG;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	isp_res = (struct cam_isp_resource_node *)deinit_hw_args;
+	if (isp_res && isp_res->deinit) {
+		rc = isp_res->deinit(isp_res, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_ISP, "deinit failed");
+	}
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (!vfe_hw->open_count) {
+		mutex_unlock(&vfe_hw->hw_mutex);
+		CAM_ERR(CAM_ISP, "Error. Unbalanced deinit");
+		return -EFAULT;
+	}
+	vfe_hw->open_count--;
+	if (vfe_hw->open_count) {
+		mutex_unlock(&vfe_hw->hw_mutex);
+		CAM_DBG(CAM_ISP, "open_cnt non-zero =%d", vfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	soc_info = &vfe_hw->soc_info;
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	rc = core_info->vfe_bus->hw_ops.deinit(core_info->vfe_bus->bus_priv,
+		NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Bus HW deinit Failed rc=%d", rc);
+
+	if (core_info->vfe_rd_bus) {
+		rc = core_info->vfe_rd_bus->hw_ops.deinit(
+			core_info->vfe_rd_bus->bus_priv,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Bus HW deinit Failed rc=%d", rc);
+	}
+
+	rc = cam_vfe_reset(hw_priv, &reset_core_args, sizeof(uint32_t));
+
+	/* Turn OFF Regulators, Clocks and other SOC resources */
+	CAM_DBG(CAM_ISP, "Disable SOC resource, rc: %d", rc);
+	rc = cam_vfe_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Disable SOC failed");
+
+	vfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+int cam_vfe_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_hw_info          *vfe_hw     = hw_priv;
+	struct cam_vfe_hw_core_info *core_info;
+	struct cam_vfe_irq_hw_info  *irq_info;
+	uint32_t top_reset_irq_reg_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	irq_info = core_info->vfe_hw_info->irq_hw_info;
+
+	if(!(irq_info->supported_irq & CAM_VFE_HW_IRQ_CAP_RESET))
+		goto skip_reset;
+
+	memset(top_reset_irq_reg_mask, 0, sizeof(top_reset_irq_reg_mask));
+	top_reset_irq_reg_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+				irq_info->reset_mask;
+
+	irq_info->reset_irq_handle = cam_irq_controller_subscribe_irq(
+		core_info->vfe_irq_controller,
+		CAM_IRQ_PRIORITY_0,
+		top_reset_irq_reg_mask,
+		vfe_hw,
+		cam_vfe_reset_irq_top_half,
+		NULL, NULL, NULL, CAM_IRQ_EVT_GROUP_0);
+
+	if (irq_info->reset_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "subscribe irq controller failed");
+		irq_info->reset_irq_handle = 0;
+		return -EFAULT;
+	}
+
+	reinit_completion(&vfe_hw->hw_complete);
+
+	CAM_DBG(CAM_ISP, "Calling RESET on VFE");
+
+	core_info->vfe_top->hw_ops.reset(core_info->vfe_top->top_priv,
+		reset_core_args, arg_size);
+
+	/* Wait for Completion or Timeout of 500ms */
+	rc = cam_common_wait_for_completion_timeout(
+			&vfe_hw->hw_complete, 500);
+
+	if (!rc)
+		CAM_ERR(CAM_ISP, "Reset Timeout");
+	else
+		CAM_DBG(CAM_ISP, "Reset complete (%d)", rc);
+
+	rc = cam_irq_controller_unsubscribe_irq(
+			core_info->vfe_irq_controller,
+			irq_info->reset_irq_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Error. Unsubscribe failed");
+	irq_info->reset_irq_handle = 0;
+
+skip_reset:
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+void cam_isp_hw_get_timestamp(struct cam_isp_timestamp *time_stamp)
+{
+	struct timespec64 ts;
+
+	ktime_get_boottime_ts64(&ts);
+	time_stamp->mono_time.tv_sec    = ts.tv_sec;
+	time_stamp->mono_time.tv_nsec   = ts.tv_nsec;
+}
+
+int cam_vfe_reserve(void *hw_priv, void *reserve_args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *vfe_hw  = hw_priv;
+	struct cam_vfe_acquire_args       *acquire;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_vfe_acquire_args))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	acquire = (struct cam_vfe_acquire_args   *)reserve_args;
+
+	CAM_DBG(CAM_ISP, "acq res type: %d", acquire->rsrc_type);
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (acquire->rsrc_type == CAM_ISP_RESOURCE_VFE_IN) {
+		rc = core_info->vfe_top->hw_ops.reserve(
+			core_info->vfe_top->top_priv,
+			acquire, sizeof(*acquire));
+	} else if (acquire->rsrc_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		rc = core_info->vfe_bus->hw_ops.reserve(
+			core_info->vfe_bus->bus_priv, acquire,
+			sizeof(*acquire));
+	} else if (acquire->rsrc_type == CAM_ISP_RESOURCE_VFE_BUS_RD) {
+		if (core_info->vfe_rd_bus)
+			rc = core_info->vfe_rd_bus->hw_ops.reserve(
+				core_info->vfe_rd_bus->bus_priv, acquire,
+				sizeof(*acquire));
+	} else
+		CAM_ERR(CAM_ISP, "Invalid res type:%d", acquire->rsrc_type);
+
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_vfe_release(void *hw_priv, void *release_args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *vfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node      *) release_args;
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_IN)
+		rc = core_info->vfe_top->hw_ops.release(
+			core_info->vfe_top->top_priv, isp_res,
+			sizeof(*isp_res));
+	else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_OUT)
+		rc = core_info->vfe_bus->hw_ops.release(
+			core_info->vfe_bus->bus_priv, isp_res,
+			sizeof(*isp_res));
+	else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_BUS_RD) {
+		if (core_info->vfe_rd_bus)
+			rc = core_info->vfe_rd_bus->hw_ops.release(
+				core_info->vfe_rd_bus->bus_priv, isp_res,
+				sizeof(*isp_res));
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res type:%d", isp_res->res_type);
+	}
+
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	return rc;
+}
+
+
+int cam_vfe_start(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *vfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	int                                rc = 0;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node  *)start_args;
+	core_info->tasklet_info = isp_res->tasklet_info;
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_IN) {
+		rc = core_info->vfe_top->hw_ops.start(
+			core_info->vfe_top->top_priv, isp_res,
+			sizeof(struct cam_isp_resource_node));
+
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to start VFE IN");
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		rc = core_info->vfe_bus->hw_ops.start(isp_res, NULL, 0);
+
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to start VFE OUT");
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_BUS_RD) {
+		if (core_info->vfe_rd_bus) {
+			rc = core_info->vfe_rd_bus->hw_ops.start(isp_res,
+				NULL, 0);
+
+			if (rc)
+				CAM_ERR(CAM_ISP, "Failed to start BUS RD");
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res type:%d", isp_res->res_type);
+		rc = -EFAULT;
+	}
+
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_vfe_stop(void *hw_priv, void *stop_args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_vfe_irq_hw_info        *irq_info = NULL;
+	struct cam_hw_info                *vfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	int rc = -EINVAL;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node  *)stop_args;
+	irq_info = core_info->vfe_hw_info->irq_hw_info;
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_IN) {
+		rc = core_info->vfe_top->hw_ops.stop(
+			core_info->vfe_top->top_priv, isp_res,
+			sizeof(struct cam_isp_resource_node));
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		rc = core_info->vfe_bus->hw_ops.stop(isp_res, NULL, 0);
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_BUS_RD) {
+		if (core_info->vfe_rd_bus)
+			rc = core_info->vfe_rd_bus->hw_ops.stop(isp_res,
+				NULL, 0);
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res type:%d", isp_res->res_type);
+	}
+
+	if (irq_info->reset_irq_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			core_info->vfe_irq_controller,
+			irq_info->reset_irq_handle);
+		irq_info->reset_irq_handle = 0;
+	}
+
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_vfe_read(void *hw_priv, void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_vfe_write(void *hw_priv, void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_vfe_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *vfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &vfe_hw->soc_info;
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+	case CAM_ISP_HW_CMD_BW_UPDATE:
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+	case CAM_ISP_HW_CMD_DUMP_HW:
+	case CAM_ISP_HW_CMD_ADD_WAIT:
+	case CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER:
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+	case CAM_ISP_HW_CMD_FE_UPDATE_IN_RD:
+	case CAM_ISP_HW_CMD_GET_PATH_PORT_MAP:
+	case CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE:
+	case CAM_ISP_HW_CMD_INIT_CONFIG_UPDATE:
+	case CAM_ISP_HW_CMD_RDI_LCR_CFG:
+	case CAM_ISP_HW_CMD_GET_SET_PRIM_SOF_TS_ADDR:
+	case CAM_ISP_HW_CMD_FCG_CONFIG:
+	case CAM_ISP_HW_CMD_UPDATE_VFE_SRC_RES_DATA:
+	case CAM_ISP_HW_CMD_UPDATE_VFE_SRC_RES_IRQ_MASK:
+		rc = core_info->vfe_top->hw_ops.process_cmd(
+			core_info->vfe_top->top_priv, cmd_type, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+	case CAM_ISP_HW_CMD_UBWC_UPDATE:
+	case CAM_ISP_HW_CMD_UBWC_UPDATE_V2:
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+	case CAM_ISP_HW_CMD_GET_WM_SECURE_MODE:
+	case CAM_ISP_HW_CMD_GET_LAST_CONSUMED_ADDR:
+	case CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ:
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO:
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+	case CAM_ISP_HW_CMD_WM_BW_LIMIT_CONFIG:
+	case CAM_ISP_HW_IFE_BUS_MINI_DUMP:
+	case CAM_ISP_HW_CMD_BUF_UPDATE:
+	case CAM_ISP_HW_USER_DUMP:
+	case CAM_ISP_HW_CMD_MC_CTXT_SEL:
+	case CAM_ISP_HW_CMD_IRQ_INJECTION:
+	case CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION:
+	case CAM_ISP_HW_CMD_WM_UPDATE:
+	case CAM_ISP_HW_CMD_UPDATE_VFE_OUT_RES_DATA:
+	case CAM_ISP_HW_CMD_UPDATE_VFE_OUT_RES_IRQ_MASK:
+	case CAM_ISP_HW_CMD_GET_NUM_OUT_RES:
+		rc = core_info->vfe_bus->hw_ops.process_cmd(
+			core_info->vfe_bus->bus_priv, cmd_type, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE_RM:
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM:
+	case CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD:
+		if (core_info->vfe_rd_bus)
+			rc = core_info->vfe_rd_bus->hw_ops.process_cmd(
+				core_info->vfe_rd_bus->bus_priv, cmd_type,
+				cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA:
+		*((struct cam_hw_soc_info **)cmd_args) = soc_info;
+		rc = 0;
+		break;
+	case CAM_ISP_HW_CMD_QUERY_CAP:
+	case CAM_ISP_HW_CMD_IFE_DEBUG_CFG:
+		/* forward to bus and top */
+		core_info->vfe_bus->hw_ops.process_cmd(
+			core_info->vfe_bus->bus_priv, cmd_type, cmd_args,
+			arg_size);
+
+		core_info->vfe_top->hw_ops.process_cmd(
+			core_info->vfe_top->top_priv, cmd_type, cmd_args,
+			arg_size);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid cmd type:%d", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+irqreturn_t cam_vfe_irq(int irq_num, void *data)
+{
+	struct cam_hw_info            *vfe_hw;
+	struct cam_vfe_hw_core_info   *core_info;
+
+	if (!data)
+		return IRQ_NONE;
+
+	vfe_hw = (struct cam_hw_info *)data;
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	return cam_irq_controller_handle_irq(irq_num,
+		core_info->vfe_irq_controller, CAM_IRQ_EVT_GROUP_0);
+}
+
+int cam_vfe_test_irq_line(void *hw_priv)
+{
+	struct cam_hw_info *vfe_hw = hw_priv;
+	void *vfe_irq_ctrl;
+	int rc;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "invalid argument");
+		return -EINVAL;
+	}
+
+	vfe_irq_ctrl = ((struct cam_vfe_hw_core_info *)vfe_hw->core_info)->vfe_irq_controller;
+	rc = cam_vfe_init_hw(vfe_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "VFE:%d failed to init hw", vfe_hw->soc_info.index);
+		return rc;
+	}
+
+	rc = cam_irq_controller_test_irq_line(vfe_irq_ctrl, "VFE:%d", vfe_hw->soc_info.index);
+	if (rc)
+		CAM_ERR(CAM_ISP, "VFE:%d IRQ line test failed", vfe_hw->soc_info.index);
+
+	rc = cam_vfe_deinit_hw(vfe_hw, NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_ISP, "VFE:%d failed to deinit hw", vfe_hw->soc_info.index);
+
+	return rc;
+}
+
+int cam_vfe_core_init(struct cam_vfe_hw_core_info  *core_info,
+	struct cam_hw_soc_info                     *soc_info,
+	struct cam_hw_intf                         *hw_intf,
+	struct cam_vfe_hw_info                     *vfe_hw_info)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_soc_private *soc_private = NULL;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	rc = cam_irq_controller_init(drv_name,
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX),
+		vfe_hw_info->irq_hw_info->top_irq_reg,
+		&core_info->vfe_irq_controller);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Error, cam_irq_controller_init failed rc = %d", rc);
+		return rc;
+	}
+
+	rc = cam_vfe_top_init(vfe_hw_info->top_version, soc_info, hw_intf,
+		vfe_hw_info->top_hw_info, core_info->vfe_irq_controller,
+		&core_info->vfe_top);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error, cam_vfe_top_init failed rc = %d", rc);
+		goto deinit_controller;
+	}
+
+	rc = cam_vfe_bus_init(vfe_hw_info->bus_version, BUS_TYPE_WR,
+		soc_info, hw_intf, vfe_hw_info->bus_hw_info,
+		core_info->vfe_irq_controller, &core_info->vfe_bus);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error, cam_vfe_bus_init failed rc = %d", rc);
+		goto deinit_top;
+	}
+
+	/* Probe fetch engine only if it exists - 0x0 is not a valid version */
+	if (vfe_hw_info->bus_rd_version) {
+		rc = cam_vfe_bus_init(vfe_hw_info->bus_rd_version, BUS_TYPE_RD,
+			soc_info, hw_intf, vfe_hw_info->bus_rd_hw_info,
+			core_info->vfe_irq_controller, &core_info->vfe_rd_bus);
+		if (rc) {
+			CAM_WARN(CAM_ISP, "Error, RD cam_vfe_bus_init failed");
+			rc = 0;
+		}
+		CAM_DBG(CAM_ISP, "vfe_bus_rd %pK hw_idx %d",
+			core_info->vfe_rd_bus, hw_intf->hw_idx);
+	}
+
+	spin_lock_init(&core_info->spin_lock);
+
+	return rc;
+
+deinit_top:
+	cam_vfe_top_deinit(vfe_hw_info->top_version,
+		&core_info->vfe_top);
+
+deinit_controller:
+	cam_irq_controller_deinit(&core_info->vfe_irq_controller);
+
+	return rc;
+}
+
+int cam_vfe_core_deinit(struct cam_vfe_hw_core_info  *core_info,
+	struct cam_vfe_hw_info                       *vfe_hw_info)
+{
+	int                rc = -EINVAL;
+	unsigned long      flags;
+
+	spin_lock_irqsave(&core_info->spin_lock, flags);
+
+	rc = cam_vfe_bus_deinit(vfe_hw_info->bus_version,
+		&core_info->vfe_bus);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Error cam_vfe_bus_deinit failed rc=%d", rc);
+
+	rc = cam_vfe_top_deinit(vfe_hw_info->top_version,
+		&core_info->vfe_top);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Error cam_vfe_top_deinit failed rc=%d", rc);
+
+	rc = cam_irq_controller_deinit(&core_info->vfe_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Error cam_irq_controller_deinit failed rc=%d", rc);
+
+	spin_unlock_irqrestore(&core_info->spin_lock, flags);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.h
@@ -0,0 +1,99 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CORE_H_
+#define _CAM_VFE_CORE_H_
+
+#include <linux/spinlock_types.h>
+#include "cam_hw_intf.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_hw_intf.h"
+
+#define CAM_VFE_HW_IRQ_CAP_SOF             BIT(0)
+#define CAM_VFE_HW_IRQ_CAP_EPOCH_0         BIT(1)
+#define CAM_VFE_HW_IRQ_CAP_EPOCH_1         BIT(2)
+#define CAM_VFE_HW_IRQ_CAP_RUP             BIT(3)
+#define CAM_VFE_HW_IRQ_CAP_BUF_DONE        BIT(4)
+#define CAM_VFE_HW_IRQ_CAP_EOF             BIT(5)
+#define CAM_VFE_HW_IRQ_CAP_RESET           BIT(6)
+
+#define CAM_VFE_HW_IRQ_CAP_INT_CSID        0x7F
+#define CAM_VFE_HW_IRQ_CAP_LITE_INT_CSID   0x79
+#define CAM_VFE_HW_IRQ_CAP_EXT_CSID        0x27
+#define CAM_VFE_HW_IRQ_CAP_LITE_EXT_CSID   0x21
+
+struct cam_vfe_irq_hw_info {
+	int                                   reset_irq_handle;
+	uint32_t                              reset_mask;
+	struct cam_irq_controller_reg_info   *top_irq_reg;
+	uint32_t                              supported_irq;
+};
+
+struct cam_vfe_hw_info {
+	struct cam_vfe_irq_hw_info       *irq_hw_info;
+
+	uint32_t                          bus_version;
+	void                             *bus_hw_info;
+
+	uint32_t                          bus_rd_version;
+	void                             *bus_rd_hw_info;
+
+	uint32_t                          top_version;
+	void                             *top_hw_info;
+	uint32_t                          camif_version;
+	void                             *camif_reg;
+
+	uint32_t                          camif_lite_version;
+	void                             *camif_lite_reg;
+};
+
+#define CAM_VFE_EVT_MAX                    256
+
+struct cam_vfe_hw_core_info {
+	struct cam_vfe_hw_info             *vfe_hw_info;
+	void                               *vfe_irq_controller;
+	struct cam_vfe_top                 *vfe_top;
+	struct cam_vfe_bus                 *vfe_bus;
+	struct cam_vfe_bus                 *vfe_rd_bus;
+	void                               *tasklet_info;
+	spinlock_t                          spin_lock;
+};
+
+int cam_vfe_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_vfe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_vfe_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_vfe_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size);
+int cam_vfe_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_vfe_release(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_vfe_start(void *device_priv,
+	void *start_args, uint32_t arg_size);
+int cam_vfe_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_vfe_read(void *device_priv,
+	void *read_args, uint32_t arg_size);
+int cam_vfe_write(void *device_priv,
+	void *write_args, uint32_t arg_size);
+int cam_vfe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+int cam_vfe_test_irq_line(void *hw_priv);
+
+irqreturn_t cam_vfe_irq(int irq_num, void *data);
+
+int cam_vfe_core_init(struct cam_vfe_hw_core_info *core_info,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	struct cam_vfe_hw_info             *vfe_hw_info);
+
+int cam_vfe_core_deinit(struct cam_vfe_hw_core_info *core_info,
+	struct cam_vfe_hw_info             *vfe_hw_info);
+
+#endif /* _CAM_VFE_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.c
@@ -0,0 +1,271 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/component.h>
+
+#include "cam_vfe_core.h"
+#include "cam_vfe_soc.h"
+#include "cam_debug_util.h"
+#include <dt-bindings/msm-camera.h>
+
+static  struct cam_isp_hw_intf_data cam_vfe_hw_list[CAM_VFE_HW_NUM_MAX];
+static uint32_t g_num_ife_hws, g_num_ife_lite_hws;
+
+static int cam_vfe_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info                *vfe_hw = NULL;
+	struct cam_hw_intf                *vfe_hw_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_vfe_hw_info            *hw_info = NULL;
+	int                                rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct cam_vfe_soc_private   *vfe_soc_priv;
+	uint32_t  vfe_dev_idx;
+	uint32_t  i;
+
+	rc = of_property_read_u32(pdev->dev.of_node, "cell-index", &vfe_dev_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to read cell-index of IFE HW, rc: %d", rc);
+		goto end;
+	}
+
+	if (!cam_cpas_is_feature_supported(CAM_CPAS_ISP_FUSE, BIT(vfe_dev_idx), NULL) ||
+		!cam_cpas_is_feature_supported(CAM_CPAS_ISP_LITE_FUSE,
+		BIT(vfe_dev_idx), NULL)) {
+		CAM_DBG(CAM_ISP, "IFE:%d is not supported", vfe_dev_idx);
+		goto end;
+	}
+
+	vfe_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!vfe_hw_intf) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	vfe_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!vfe_hw) {
+		rc = -ENOMEM;
+		goto free_vfe_hw_intf;
+	}
+
+	vfe_hw->soc_info.pdev = pdev;
+	vfe_hw->soc_info.dev = &pdev->dev;
+	vfe_hw->soc_info.dev_name = pdev->name;
+	vfe_hw_intf->hw_priv = vfe_hw;
+	vfe_hw_intf->hw_idx = vfe_dev_idx;
+	vfe_hw_intf->hw_ops.get_hw_caps = cam_vfe_get_hw_caps;
+	vfe_hw_intf->hw_ops.init = cam_vfe_init_hw;
+	vfe_hw_intf->hw_ops.deinit = cam_vfe_deinit_hw;
+	vfe_hw_intf->hw_ops.reset = cam_vfe_reset;
+	vfe_hw_intf->hw_ops.reserve = cam_vfe_reserve;
+	vfe_hw_intf->hw_ops.release = cam_vfe_release;
+	vfe_hw_intf->hw_ops.start = cam_vfe_start;
+	vfe_hw_intf->hw_ops.stop = cam_vfe_stop;
+	vfe_hw_intf->hw_ops.read = cam_vfe_read;
+	vfe_hw_intf->hw_ops.write = cam_vfe_write;
+	vfe_hw_intf->hw_ops.process_cmd = cam_vfe_process_cmd;
+	vfe_hw_intf->hw_ops.test_irq_line = cam_vfe_test_irq_line;
+	vfe_hw_intf->hw_type = CAM_ISP_HW_TYPE_VFE;
+
+	CAM_DBG(CAM_ISP, "VFE component bind, type %d index %d",
+		vfe_hw_intf->hw_type, vfe_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, vfe_hw_intf);
+
+	vfe_hw->core_info = kzalloc(sizeof(struct cam_vfe_hw_core_info),
+		GFP_KERNEL);
+	if (!vfe_hw->core_info) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for core");
+		rc = -ENOMEM;
+		goto free_vfe_hw;
+	}
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "Of_match Failed");
+		rc = -EINVAL;
+		goto free_core_info;
+	}
+	hw_info = (struct cam_vfe_hw_info *)match_dev->data;
+	core_info->vfe_hw_info = hw_info;
+
+	rc = cam_vfe_init_soc_resources(&vfe_hw->soc_info, cam_vfe_irq,
+		vfe_hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Failed to init soc rc=%d", rc);
+		goto free_core_info;
+	}
+
+	rc = cam_vfe_core_init(core_info, &vfe_hw->soc_info,
+		vfe_hw_intf, hw_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Failed to init core rc=%d", rc);
+		goto deinit_soc;
+	}
+
+	vfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&vfe_hw->hw_mutex);
+	spin_lock_init(&vfe_hw->hw_lock);
+	init_completion(&vfe_hw->hw_complete);
+
+	if (vfe_hw_intf->hw_idx < CAM_VFE_HW_NUM_MAX)
+		cam_vfe_hw_list[vfe_hw_intf->hw_idx].hw_intf = vfe_hw_intf;
+
+	vfe_soc_priv = vfe_hw->soc_info.soc_private;
+	cam_vfe_hw_list[vfe_hw_intf->hw_idx].num_hw_pid = vfe_soc_priv->num_pid;
+	for (i = 0; i < vfe_soc_priv->num_pid; i++)
+		cam_vfe_hw_list[vfe_hw_intf->hw_idx].hw_pid[i] =
+			vfe_soc_priv->pid[i];
+
+	CAM_DBG(CAM_ISP, "VFE:%d component bound successfully",
+		vfe_hw_intf->hw_idx);
+	return rc;
+
+deinit_soc:
+	if (cam_vfe_deinit_soc_resources(&vfe_hw->soc_info))
+		CAM_ERR(CAM_ISP, "Failed to deinit soc");
+free_core_info:
+	kfree(vfe_hw->core_info);
+free_vfe_hw:
+	kfree(vfe_hw);
+free_vfe_hw_intf:
+	kfree(vfe_hw_intf);
+end:
+	return rc;
+}
+
+static void cam_vfe_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info		  *vfe_hw = NULL;
+	struct cam_hw_intf		  *vfe_hw_intf = NULL;
+	struct cam_vfe_hw_core_info	  *core_info = NULL;
+	int				   rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	vfe_hw_intf = platform_get_drvdata(pdev);
+	if (!vfe_hw_intf) {
+		CAM_ERR(CAM_ISP, "Error! No data in pdev");
+		return;
+	}
+
+	CAM_DBG(CAM_ISP, "VFE component unbind, type %d index %d",
+		vfe_hw_intf->hw_type, vfe_hw_intf->hw_idx);
+
+	if (vfe_hw_intf->hw_idx < CAM_VFE_HW_NUM_MAX)
+		cam_vfe_hw_list[vfe_hw_intf->hw_idx].hw_intf = NULL;
+
+	vfe_hw = vfe_hw_intf->hw_priv;
+	if (!vfe_hw) {
+		CAM_ERR(CAM_ISP, "Error! HW data is NULL");
+		goto free_vfe_hw_intf;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_ISP, "Error! core data NULL");
+		goto deinit_soc;
+	}
+
+	rc = cam_vfe_core_deinit(core_info, core_info->vfe_hw_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "Failed to deinit core rc=%d", rc);
+
+	kfree(vfe_hw->core_info);
+
+deinit_soc:
+	rc = cam_vfe_deinit_soc_resources(&vfe_hw->soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&vfe_hw->hw_mutex);
+	kfree(vfe_hw);
+
+	CAM_DBG(CAM_ISP, "VFE%d component unbound", vfe_hw_intf->hw_idx);
+
+free_vfe_hw_intf:
+	kfree(vfe_hw_intf);
+}
+
+const static struct component_ops cam_vfe_component_ops = {
+	.bind = cam_vfe_component_bind,
+	.unbind = cam_vfe_component_unbind,
+};
+
+void cam_vfe_get_num_ifes(uint32_t *num_ifes)
+{
+	if (num_ifes)
+		*num_ifes = g_num_ife_hws;
+	else
+		CAM_ERR(CAM_ISP, "Invalid argument, g_num_ife_hws: %u", g_num_ife_hws);
+}
+
+void cam_vfe_get_num_ife_lites(uint32_t *num_ife_lites)
+{
+	if (num_ife_lites)
+		*num_ife_lites = g_num_ife_lite_hws;
+	else
+		CAM_ERR(CAM_ISP, "Invalid argument, g_num_ife_lite_hws: %u", g_num_ife_lite_hws);
+}
+
+int cam_vfe_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+	const char *compatible_name;
+	struct device_node *of_node = NULL;
+
+	CAM_DBG(CAM_ISP, "Adding VFE component");
+	of_node = pdev->dev.of_node;
+
+	rc = of_property_read_string_index(of_node, "compatible", 0,
+			(const char **)&compatible_name);
+	if (rc)
+		CAM_ERR(CAM_ISP, "No compatible string present for: %s, rc: %d",
+			pdev->name, rc);
+
+	if (strnstr(compatible_name, "lite", strlen(compatible_name)) != NULL)
+		g_num_ife_lite_hws++;
+	else if (strnstr(compatible_name, "vfe", strlen(compatible_name)) != NULL)
+		g_num_ife_hws++;
+	else
+		CAM_ERR(CAM_ISP, "Failed to increment number of IFEs/IFE-LITEs");
+
+	rc = component_add(&pdev->dev, &cam_vfe_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_vfe_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_vfe_component_ops);
+	return 0;
+}
+
+int cam_vfe_hw_init(struct cam_isp_hw_intf_data **vfe_hw_intf,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_vfe_hw_list[hw_idx].hw_intf) {
+		*vfe_hw_intf = &cam_vfe_hw_list[hw_idx];
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_ISP, "inval param");
+		*vfe_hw_intf = NULL;
+		rc = -ENODEV;
+	}
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_DEV_H_
+#define _CAM_VFE_DEV_H_
+
+#include <linux/platform_device.h>
+
+/*
+ * cam_vfe_probe()
+ *
+ * @brief:                   Driver probe function called on Boot
+ *
+ * @pdev:                    Platform Device pointer
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_probe(struct platform_device *pdev);
+
+/*
+ * cam_vfe_remove()
+ *
+ * @brief:                   Driver remove function
+ *
+ * @pdev:                    Platform Device pointer
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_remove(struct platform_device *pdev);
+
+#endif /* _CAM_VFE_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.c
@@ -0,0 +1,407 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_cpas_api.h"
+#include "cam_vfe_soc.h"
+#include "cam_debug_util.h"
+
+static bool cam_vfe_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool error_handled = false;
+
+	if (!irq_data)
+		return error_handled;
+
+	switch (irq_data->irq_type) {
+	case CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR:
+	case CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR:
+	case CAM_CAMNOC_IRQ_IFE0_UBWC_ENCODE_ERROR:
+	case CAM_CAMNOC_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"IFE UBWC Encode error type=%d status=%x",
+			irq_data->irq_type,
+			irq_data->u.enc_err.encerr_status.value);
+		error_handled = true;
+		break;
+	default:
+		break;
+	}
+
+	return error_handled;
+}
+
+static int cam_vfe_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0, num_ubwc_cfg = 0, i = 0, num_pid = 0;
+	struct device_node *of_node = NULL;
+	struct platform_device *pdev = NULL;
+	struct cam_vfe_soc_private *vfe_soc_private;
+
+	pdev = soc_info->pdev;
+	of_node = pdev->dev.of_node;
+	vfe_soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! get DT properties failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = of_property_read_u32(of_node, "rt-wrapper-base", &vfe_soc_private->rt_wrapper_base);
+	if (rc) {
+		vfe_soc_private->rt_wrapper_base = 0;
+		CAM_DBG(CAM_ISP, "rc: %d Error reading rt_wrapper_base for core_idx: %u",
+			rc, soc_info->index);
+		rc = 0;
+	}
+
+	vfe_soc_private->is_ife_lite = false;
+	if (strnstr(soc_info->compatible, "lite",
+		strlen(soc_info->compatible)) != NULL) {
+		vfe_soc_private->is_ife_lite = true;
+		goto pid;
+	}
+
+	if (!of_property_read_bool(of_node, "ubwc-static-cfg")) {
+		CAM_DBG(CAM_ISP, "ubwc-static-cfg not supported");
+		goto pid;
+	}
+
+	num_ubwc_cfg = of_property_count_u32_elems(of_node,
+		"ubwc-static-cfg");
+
+	if (num_ubwc_cfg < 0 || num_ubwc_cfg > UBWC_STATIC_CONFIG_MAX) {
+		CAM_ERR(CAM_ISP, "wrong num_ubwc_cfg: %d",
+			num_ubwc_cfg);
+		rc = num_ubwc_cfg;
+		goto pid;
+	}
+
+	for (i = 0; i < num_ubwc_cfg; i++) {
+		rc = of_property_read_u32_index(of_node,
+			"ubwc-static-cfg", i,
+			&vfe_soc_private->ubwc_static_ctrl[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"unable to read ubwc static config");
+		}
+	}
+pid:
+	/* set some default values */
+	vfe_soc_private->num_pid = 0;
+
+	num_pid = of_property_count_u32_elems(pdev->dev.of_node, "cam_hw_pid");
+	CAM_DBG(CAM_CPAS, "vfe:%d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_ISP_HW_MAX_PID_VAL)
+		goto end;
+
+	for (i = 0; i < num_pid; i++)
+		of_property_read_u32_index(pdev->dev.of_node, "cam_hw_pid", i,
+		&vfe_soc_private->pid[i]);
+
+	vfe_soc_private->num_pid = num_pid;
+
+end:
+
+	return rc;
+}
+
+static int cam_vfe_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t vfe_irq_handler, void *data)
+{
+	int rc = 0, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, vfe_irq_handler, &(irq_data[0]));
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Error! Request platform resource failed rc=%d", rc);
+
+	return rc;
+}
+
+static int cam_vfe_release_platform_resource(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Error! Release platform resource failed rc=%d", rc);
+
+	return rc;
+}
+
+int cam_vfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t vfe_irq_handler, void *irq_data)
+{
+	int                               rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+	struct cam_cpas_register_params   cpas_register_param;
+
+	soc_private = kzalloc(sizeof(struct cam_vfe_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_ISP, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_cpas_get_cpas_hw_version(&soc_private->cpas_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! Invalid cpas version rc=%d", rc);
+		goto free_soc_private;
+	}
+	soc_info->hw_version = soc_private->cpas_version;
+
+	rc = cam_vfe_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Error! Get DT properties failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	if (!soc_private->is_ife_lite) {
+		rc = cam_cpas_query_drv_enable(NULL, &soc_info->is_clk_drv_en);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to query DRV enable rc:%d", rc);
+			goto free_soc_private;
+		}
+	}
+
+	rc = cam_soc_util_get_option_clk_by_name(soc_info, CAM_VFE_DSP_CLK_NAME,
+		&soc_private->dsp_clk_index);
+	if (rc)
+		CAM_DBG(CAM_ISP, "Option clk get failed with rc %d", rc);
+
+	rc = cam_vfe_request_platform_resource(soc_info, vfe_irq_handler,
+		irq_data);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Error! Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	strscpy(cpas_register_param.identifier, "ife",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	cpas_register_param.cam_cpas_client_cb = cam_vfe_cpas_cb;
+	cpas_register_param.userdata = soc_info;
+
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	} else {
+		soc_private->cpas_handle = cpas_register_param.client_handle;
+	}
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_vfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! soc_info NULL");
+		return -ENODEV;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPAS unregistration failed rc=%d", rc);
+
+	rc = cam_vfe_release_platform_resource(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP,
+			"Error! Release platform resources failed rc=%d", rc);
+
+	if (soc_private->dsp_clk_index != -1) {
+		rc = cam_soc_util_put_optional_clk(soc_info,
+			soc_private->dsp_clk_index);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Error Put dsp clk failed rc=%d", rc);
+	}
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_vfe_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+	struct cam_ahb_vote               ahb_vote;
+	struct cam_axi_vote               axi_vote = {0};
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_private = soc_info->soc_private;
+	ahb_vote.type       = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 1;
+	if (soc_private->is_ife_lite) {
+		axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_IFE_RDI1;
+	} else {
+		axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_IFE_VID;
+		axi_vote.axi_path[0].vote_level = CAM_CPAS_VOTE_LEVEL_LOW;
+	}
+
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_RT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_RT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_RT_AXI_BW;
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! CPAS start failed rc=%d", rc);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (!soc_private->is_ife_lite) {
+		rc = cam_cpas_query_drv_enable(NULL, &soc_info->is_clk_drv_en);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to query DRV enable rc:%d", rc);
+			return rc;
+		}
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info,
+		(soc_info->is_clk_drv_en ? soc_info->index : CAM_CLK_SW_CLIENT_IDX), true,
+		soc_info->lowest_clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! enable platform failed rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_vfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	int  rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_private = soc_info->soc_private;
+
+	if (!strcmp(clk_name, CAM_VFE_DSP_CLK_NAME)) {
+		if (soc_private->dsp_clk_index == -1) {
+			CAM_ERR(CAM_ISP,
+			"DSP clock not supported for vfe: %d", soc_info->index);
+			rc = -EPERM;
+			goto end;
+		}
+
+		rc = cam_soc_util_clk_enable(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+			soc_private->dsp_clk_index, 0);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+			"Error enable dsp clk failed rc=%d", rc);
+	}
+
+end:
+	return rc;
+}
+
+int cam_vfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	int  rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_private = soc_info->soc_private;
+
+	if (!strcmp(clk_name, CAM_VFE_DSP_CLK_NAME)) {
+		if (soc_private->dsp_clk_index == -1) {
+			CAM_ERR(CAM_ISP,
+			"DSP clock not supported for vfe: %d", soc_info->index);
+			rc = -EPERM;
+			goto end;
+		}
+
+		rc = cam_soc_util_clk_disable(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+			soc_private->dsp_clk_index);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+			"Error disable dsp clk failed rc=%d", rc);
+	}
+
+end:
+	return rc;
+}
+
+
+int cam_vfe_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info,
+		(soc_info->is_clk_drv_en ? soc_info->index : CAM_CLK_SW_CLIENT_IDX), true, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Disable platform failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.h
@@ -0,0 +1,124 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_SOC_H_
+#define _CAM_VFE_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_isp_hw.h"
+
+#define CAM_VFE_DSP_CLK_NAME "ife_dsp_clk"
+
+#define UBWC_STATIC_CONFIG_MAX 2
+
+/*
+ * struct cam_vfe_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to VFE HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ * @cpas_version:            Has cpas version read from Hardware
+ * @rt_wrapper_base:         Base address of the RT-Wrapper if the hw is in rt-wrapper
+ * @dsp_clk_index:           DSP clk index in optional clocks
+ * @ubwc_static_ctrl:        UBWC static control configuration
+ * @is_ife_lite:             Flag to indicate full vs lite IFE
+ * @ife_clk_src:             IFE source clock
+ * @num_pid:                 Number of pids of ife
+ * @pid:                     IFE pid values list
+ */
+struct cam_vfe_soc_private {
+	uint32_t    cpas_handle;
+	uint32_t    cpas_version;
+	uint32_t    rt_wrapper_base;
+	int32_t     dsp_clk_index;
+	uint32_t    ubwc_static_ctrl[UBWC_STATIC_CONFIG_MAX];
+	bool        is_ife_lite;
+	uint64_t    ife_clk_src;
+	uint32_t    num_pid;
+	uint32_t    pid[CAM_ISP_HW_MAX_PID_VAL];
+};
+
+/*
+ * cam_vfe_init_soc_resources()
+ *
+ * @Brief:                   Initialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ * @handler:                 Irq handler function pointer
+ * @irq_data:                Irq handler function Callback data
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t vfe_irq_handler, void *irq_data);
+
+/*
+ * cam_vfe_deinit_soc_resources()
+ *
+ * @Brief:                   Deinitialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_vfe_enable_soc_resources()
+ *
+ * @brief:                   Enable regulator, irq resources, start CPAS
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_vfe_disable_soc_resources()
+ *
+ * @brief:                   Disable regulator, irq resources, stop CPAS
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_vfe_soc_enable_clk()
+ *
+ * @brief:                   Enable clock with given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+/*
+ * cam_vfe_soc_disable_dsp_clk()
+ *
+ * @brief:                   Disable clock with given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+#endif /* _CAM_VFE_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_tfe980.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_tfe980.h
@@ -0,0 +1,2495 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_TFE980_H_
+#define _CAM_TFE980_H_
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_TFE_980_NUM_DBG_REG              35
+#define CAM_TFE_BUS_VER3_980_MAX_CLIENTS     28
+
+static struct cam_vfe_top_ver4_module_desc tfe980_ipp_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CLC_STATS_AWB_BG_TINTLESS",
+	},
+	{
+		.id  = 1,
+		.desc = "CLC_STATS_AWB_BG_AE",
+	},
+	{
+		.id = 2,
+		.desc = "CLC_STATS_BHIST_AEC",
+	},
+	{
+		.id = 3,
+		.desc = "CLC_STATS_RS",
+	},
+	{
+		.id = 4,
+		.desc = "CLC_STATS_BFW_AWB",
+	},
+	{
+		.id = 5,
+		.desc = "CLC_STATS_AWB_BG_AWB",
+	},
+	{
+		.id = 6,
+		.desc = "CLC_STATS_BHIST_AF",
+	},
+	{
+		.id = 7,
+		.desc = "CLC_STATS_AWB_BG_ALSC",
+	},
+	{
+		.id = 8,
+		.desc = "CLC_STATS_BHIST_TMC",
+	},
+	{
+		.id = 9,
+		.desc = "CLC_COMPDECOMP_FD",
+	},
+	{
+		.id = 10,
+		.desc = "CLC_COLOR_CORRECT",
+	},
+	{
+		.id = 11,
+		.desc = "CLC_GTM",
+	},
+	{
+		.id = 12,
+		.desc = "CLC_GLUT",
+	},
+	{
+		.id = 13,
+		.desc = "CLC_COLOR_XFORM",
+	},
+	{
+		.id = 14,
+		.desc = "CLC_DOWNSCALE_MN_Y",
+	},
+	{
+		.id  = 15,
+		.desc = "CLC_DOWNSCALE_MN_C",
+	},
+	{
+		.id = 16,
+		.desc = "CLC_CROP_RND_CLAMP_FD_Y",
+	},
+	{
+		.id = 17,
+		.desc = "CLC_CROP_RND_CLAMP_FD_C",
+	},
+	{
+		.id = 18,
+		.desc = "CLC_BDS2_DEMO",
+	},
+	{
+		.id = 19,
+		.desc = "CLC_PUNCH_BDS2",
+	},
+	{
+		.id = 20,
+		.desc = "CLC_PUNCH_DS4_MUX",
+	},
+	{
+		.id = 21,
+		.desc = "CLC_BAYER_DS_4_DS4",
+	},
+	{
+		.id = 22,
+		.desc = "CLC_CROP_RND_CLAMP_DS4"
+	},
+	{
+		.id = 23,
+		.desc = "CLC_PUNCH_DS16"
+	},
+	{
+		.id = 24,
+		.desc = "CLC_BAYER_DS_4_DS16",
+	},
+	{
+		.id = 25,
+		.desc = "CLC_CROP_RND_CLAMP_DS16",
+	},
+	{
+		.id = 26,
+		.desc = "CLC_CROP_RND_CLAMP_DS2",
+	},
+	{
+		.id = 27,
+		.desc = "CLC_RCS_DS2",
+	},
+	{
+		.id = 28,
+		.desc = "CLC_CROP_RND_CLAMP_FULL_OUT",
+	},
+	{
+		.id = 29,
+		.desc = "CLC_COMPDECOMP_BYPASS",
+	},
+	{
+		.id = 30,
+		.desc = "CLC_CROP_RND_CLAMP_BYPASS",
+	},
+	{
+		.id = 31,
+		.desc = "CLC_RCS_FULL_OUT",
+	},
+};
+
+struct cam_vfe_bayer_ver4_module_desc tfe980_bayer_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CLC_DEMUX",
+	},
+	{
+		.id = 1,
+		.desc = "CLC_BPC_PDPC_GIC",
+	},
+	{
+		.id = 2,
+		.desc = "CLC_PDPC_BPC_1D",
+	},
+	{
+		.id = 3,
+		.desc = "CLC_ABF_BINC",
+	},
+	{
+		.id = 4,
+		.desc = "CLC_CHANNEL_GAINS",
+	},
+	{
+		.id = 5,
+		.desc = "CLC_LSC",
+	},
+	{
+		.id = 6,
+		.desc = "CLC_FCG",
+	},
+	{
+		.id = 7,
+		.desc = "CLC_WB_GAIN",
+	},
+	{
+		.id = 8,
+		.desc = "CLC_COMPDECOMP_BAYER",
+	},
+	{
+		.id = 9,
+		.desc = "CLC_CROP_RND_CLAMP_WIRC",
+	},
+};
+
+static struct cam_vfe_top_ver4_wr_client_desc tfe980_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "VIDEO",
+	},
+	{
+		.wm_id = 1,
+		.desc = "DS4_Y",
+	},
+	{
+		.wm_id = 2,
+		.desc = "DS4_C",
+	},
+	{
+		.wm_id = 3,
+		.desc  = "DS16_Y",
+	},
+	{
+		.wm_id = 4,
+		.desc = "DS16_C",
+	},
+	{
+		.wm_id = 5,
+		.desc = "DS2_Y",
+	},
+	{
+		.wm_id = 6,
+		.desc = "DS2_C",
+	},
+	{
+		.wm_id = 7,
+		.desc = "FD_Y",
+	},
+	{
+		.wm_id = 8,
+		.desc = "FD_C",
+	},
+	{
+		.wm_id = 9,
+		.desc = "IR_OUT",
+	},
+	{
+		.wm_id = 10,
+		.desc = "STATS_AEC_BG",
+	},
+	{
+		.wm_id = 11,
+		.desc = "STATS_AEC_BHIST",
+	},
+	{
+		.wm_id = 12,
+		.desc = "STATS_TINTLESS_BG",
+	},
+	{
+		.wm_id = 13,
+		.desc = "STATS_AWB_BG",
+	},
+	{
+		.wm_id = 14,
+		.desc = "STATS_AWB_BFW",
+	},
+	{
+		.wm_id = 15,
+		.desc = "STATS_AF_BHIST",
+	},
+	{
+		.wm_id = 16,
+		.desc = "STATS_ALSC_BG",
+	},
+	{
+		.wm_id = 17,
+		.desc = "STATS_FLICKER",
+	},
+	{
+		.wm_id = 18,
+		.desc = "STATS_TMC_BHIST",
+	},
+	{
+		.wm_id = 19,
+		.desc = "PDAF_0_STATS",
+	},
+	{
+		.wm_id = 20,
+		.desc = "PDAF_1_PREPROCESS_2PD",
+	},
+	{
+		.wm_id = 21,
+		.desc = "PDAF_2_PARSED_DATA",
+	},
+	{
+		.wm_id = 22,
+		.desc = "PDAF_3_CAF",
+	},
+	{
+		.wm_id = 23,
+		.desc = "RDI0",
+	},
+	{
+		.wm_id = 24,
+		.desc = "RDI1",
+	},
+	{
+		.wm_id = 25,
+		.desc = "RDI2",
+	},
+	{
+		.wm_id = 26,
+		.desc = "RDI3",
+	},
+	{
+		.wm_id = 27,
+		.desc = "RDI4",
+	},
+};
+
+static struct cam_vfe_top_ver4_top_err_irq_desc tfe980_top_irq_err_desc[] = {
+	{
+		.bitmask = BIT(2),
+		.err_name = "BAYER_HM violation",
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(24),
+		.err_name = "DYNAMIC PDAF SWITCH VIOLATION",
+		.desc = "PD exposure changes dynamically and the sensor gap is not large enough",
+	},
+	{
+		.bitmask = BIT(25),
+		.err_name  = "HAF violation",
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(26),
+		.err_name = "PP VIOLATION",
+		.desc = "",
+	},
+	{
+		.bitmask  = BIT(27),
+		.err_name = "DIAG VIOLATION",
+		.desc = "HBI is less than the minimum required HBI",
+	},
+};
+
+static struct cam_vfe_top_ver4_pdaf_violation_desc tfe980_haf_violation_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.desc = "Sim monitor 1 violation - SAD output",
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "Sim monitor 2 violation - pre-proc output",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "Sim monitor 3 violation - parsed output",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "Sim monitor 4 violation - CAF output",
+	},
+	{
+		.bitmask  = BIT(4),
+		.desc = "PDAF constraint violation",
+	},
+	{
+		.bitmask = BIT(5),
+		.desc = "CAF constraint violation",
+	},
+};
+
+static struct cam_vfe_top_ver4_pdaf_lcr_res_info tfe980_pdaf_haf_res_mask[] = {
+	{
+		.res_id = CAM_ISP_HW_VFE_IN_RDI0,
+		.val = 0,
+	},
+	{
+		.res_id = CAM_ISP_HW_VFE_IN_RDI1,
+		.val = 1,
+	},
+	{
+		.res_id = CAM_ISP_HW_VFE_IN_RDI2,
+		.val = 2,
+	},
+};
+
+static struct cam_irq_register_set tfe980_top_irq_reg_set = {
+	.mask_reg_offset   = 0x00000080,
+	.clear_reg_offset  = 0x00000084,
+	.status_reg_offset = 0x00000088,
+	.set_reg_offset    = 0x0000008C,
+	.test_set_val      = BIT(1),
+	.test_sub_val      = BIT(0),
+};
+
+static struct cam_irq_controller_reg_info tfe980_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = &tfe980_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x0000007C,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t tfe980_top_debug_reg[] = {
+	0x00000190,
+	0x00000194,
+	0x00000198,
+	0x0000019C,
+	0x000001A0,
+	0x000001A4,
+	0x000001AB,
+	0x000001AC,
+	0x000001B0,
+	0x000001B4,
+	0x000001B8,
+	0x000001BC,
+	0x000001C0,
+	0x000001C4,
+	0x000001C8,
+	0x000001CC,
+	0x000001D0,
+	0x000001D4,
+	0x000001D8,
+	0x000001DC,
+	0x000001E0,
+	0x000001E4,
+	0x000001E8,
+	0x0000C1BC, /*  Bayer debug registers from here onwards */
+	0x0000C1C0,
+	0x0000C1C4,
+	0x0000C1C8,
+	0x0000C1CC,
+	0x0000C1D0,
+	0x0000C1D4,
+	0x0000C1D8,
+	0x0000C1DC,
+	0x0000C1E0,
+	0x0000C1E4,
+	0x0000C1E8,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common tfe980_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.main_feature             = 0x00000008,
+	.bayer_feature            = 0x0000000C,
+	.stats_feature            = 0x00000010,
+	.fd_feature               = 0x00000014,
+	.core_cgc_ovd_0           = 0x00000018,
+	.ahb_cgc_ovd              = 0x00000020,
+	.core_mux_cfg             = 0x00000024,
+	.pdaf_input_cfg_0         = 0x00000028,
+	.pdaf_input_cfg_1         = 0x0000002C,
+	.stats_throttle_cfg_0     = 0x00000030,
+	.stats_throttle_cfg_1     = 0x00000034,
+	.stats_throttle_cfg_2     = 0x00000038,
+	.core_cfg_4               = 0x0000003C,
+	.pdaf_parsed_throttle_cfg = 0x00000040,
+	.wirc_throttle_cfg        = 0x00000044,
+	.fd_y_throttle_cfg        = 0x00000048,
+	.fd_c_throttle_cfg        = 0x0000004C,
+	.ds16_g_throttle_cfg      = 0x00000050,
+	.ds16_br_throttle_cfg     = 0x00000054,
+	.ds4_g_throttle_cfg       = 0x00000058,
+	.ds4_br_throttle_cfg      = 0x0000005C,
+	.ds2_g_throttle_cfg       = 0x00000060,
+	.ds2_br_throttle_cfg      = 0x00000064,
+	.full_out_throttle_cfg    = 0x00000068,
+	.diag_config              = 0x00000094,
+	.global_reset_cmd         = 0x0000007C,
+	.diag_sensor_status_0     = 0x00000098,
+	.diag_sensor_status_1     = 0x0000009C,
+	.diag_frm_cnt_status_0    = 0x000000A0,
+	.diag_frm_cnt_status_1    = 0x000000A4,
+	.diag_frm_cnt_status_2    = 0x000000A8,
+	.ipp_violation_status     = 0x00000090,
+	.bayer_violation_status   = 0x0000DA24,
+	.pdaf_violation_status    = 0x00009304,
+	.dsp_status               = 0x0000006C,
+	.bus_violation_status     = 0x00000864,
+	.bus_overflow_status      = 0x00000868,
+	.num_perf_counters        = 8,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg    = 0x000000AC,
+			.perf_count_cfg_mc = 0x000000B0,
+			.perf_pix_count    = 0x000000B4,
+			.perf_line_count   = 0x000000B8,
+			.perf_stall_count  = 0x000000BC,
+			.perf_always_count = 0x000000C0,
+			.perf_count_status = 0x000000C4,
+		},
+		{
+			.perf_count_cfg    = 0x000000C8,
+			.perf_count_cfg_mc = 0x000000CC,
+			.perf_pix_count    = 0x000000D0,
+			.perf_line_count   = 0x000000D4,
+			.perf_stall_count  = 0x000000D8,
+			.perf_always_count = 0x000000DC,
+			.perf_count_status = 0x000000E0,
+		},
+		{
+			.perf_count_cfg    = 0x000000E4,
+			.perf_count_cfg_mc = 0x000000E8,
+			.perf_pix_count    = 0x000000EC,
+			.perf_line_count   = 0x000000F0,
+			.perf_stall_count  = 0x000000F4,
+			.perf_always_count = 0x000000F8,
+			.perf_count_status = 0x000000FC,
+		},
+		{
+			.perf_count_cfg    = 0x00000100,
+			.perf_count_cfg_mc = 0x00000104,
+			.perf_pix_count    = 0x00000108,
+			.perf_line_count   = 0x0000010C,
+			.perf_stall_count  = 0x00000110,
+			.perf_always_count = 0x00000114,
+			.perf_count_status = 0x00000118,
+		},
+		/*  Bayer per count regs from here onwards */
+		{
+			.perf_count_cfg    = 0x0000C028,
+			.perf_count_cfg_mc = 0x0000C02C,
+			.perf_pix_count    = 0x0000C030,
+			.perf_line_count   = 0x0000C034,
+			.perf_stall_count  = 0x0000C038,
+			.perf_always_count = 0x0000C03C,
+			.perf_count_status = 0x0000C040,
+		},
+		{
+			.perf_count_cfg    = 0x0000C044,
+			.perf_count_cfg_mc = 0x0000C048,
+			.perf_pix_count    = 0x0000C04C,
+			.perf_line_count   = 0x0000C050,
+			.perf_stall_count  = 0x0000C054,
+			.perf_always_count = 0x0000C058,
+			.perf_count_status = 0x0000C05C,
+		},
+		{
+			.perf_count_cfg    = 0x0000C060,
+			.perf_count_cfg_mc = 0x0000C064,
+			.perf_pix_count    = 0x0000C068,
+			.perf_line_count   = 0x0000C06C,
+			.perf_stall_count  = 0x0000C070,
+			.perf_always_count = 0x0000C074,
+			.perf_count_status = 0x0000C078,
+		},
+		{
+			.perf_count_cfg    = 0x0000C07C,
+			.perf_count_cfg_mc = 0x0000C080,
+			.perf_pix_count    = 0x0000C084,
+			.perf_line_count   = 0x0000C088,
+			.perf_stall_count  = 0x0000C08C,
+			.perf_always_count = 0x0000C090,
+			.perf_count_status = 0x0000C094,
+		},
+	},
+	.top_debug_cfg            = 0x000001EC,
+	.bayer_debug_cfg          = 0x0000C1EC,
+	.num_top_debug_reg        = 35,
+	.top_debug = tfe980_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS0,
+};
+
+static struct cam_vfe_ver4_path_reg_data tfe980_ipp_common_reg_data = {
+	.sof_irq_mask                    = 0x150,
+	.eof_irq_mask                    = 0x2A0,
+	.error_irq_mask                  = 0xF000005,
+	.ipp_violation_mask              = 0x4000000,
+	.bayer_violation_mask            = 0x4,
+	.pdaf_violation_mask             = 0x2000000,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+	.is_mc_path                      = true,
+	/* SOF and EOF mask combined for each context */
+	.frm_irq_hw_ctxt_mask = {
+		0x30,
+		0xC0,
+		0x300,
+	},
+};
+
+static struct cam_vfe_ver4_path_reg_data tfe980_pdlib_reg_data = {
+	.sof_irq_mask                    = 0x400,
+	.eof_irq_mask                    = 0x800,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+};
+
+static struct cam_vfe_ver4_path_reg_data tfe980_vfe_full_rdi_reg_data[5] = {
+	{
+		.sof_irq_mask                    = 0x1000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x4000,
+		.eof_irq_mask                    = 0x8000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x10000,
+		.eof_irq_mask                    = 0x20000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x40000,
+		.eof_irq_mask                    = 0x80000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x100000,
+		.eof_irq_mask                    = 0x200000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+};
+
+struct cam_vfe_ver4_path_hw_info
+	tfe980_rdi_hw_info_arr[] = {
+	{
+		.common_reg     = &tfe980_top_common_reg,
+		.reg_data       = &tfe980_vfe_full_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &tfe980_top_common_reg,
+		.reg_data       = &tfe980_vfe_full_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &tfe980_top_common_reg,
+		.reg_data       = &tfe980_vfe_full_rdi_reg_data[2],
+	},
+	{
+		.common_reg     = &tfe980_top_common_reg,
+		.reg_data       = &tfe980_vfe_full_rdi_reg_data[3],
+	},
+	{
+		.common_reg     = &tfe980_top_common_reg,
+		.reg_data       = &tfe980_vfe_full_rdi_reg_data[4],
+	},
+};
+
+static struct cam_vfe_top_ver4_debug_reg_info tfe980_dbg_reg_info[CAM_TFE_980_NUM_DBG_REG][8] = {
+	VFE_DBG_INFO_ARRAY_4bit("test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_AWB_BG_TINTLESS",
+		"STATS_AWB_BG_AE",
+		"STATS_BHIST_AEC",
+		"STATS_RS",
+		"STATS_BFW_AWB",
+		"STATS_AWB_BG_AWB",
+		"STATS_BHIST_AF",
+		"STATS_AWB_BG_ALSC"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_BHIST_TMC",
+		"compdecomp_fd",
+		"color_correct",
+		"gtm",
+		"glut",
+		"color_xform",
+		"downscale_mn_y",
+		"downscale_mn_c"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"crop_rnd_clamp_fd_y",
+		"crop_rnd_clamp_fd_c",
+		"bds2_demo",
+		"punch_bds2",
+		"punch_ds4_mux",
+		"bayer_ds_4_ds4",
+		"crop_rnd_clamp_ds4",
+		"punch_ds16"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"bayer_ds_4_ds16",
+		"crop_rnd_clamp_ds16",
+		"crop_rnd_clamp_ds2",
+		"clc_haf",
+		"clc_rcs_ds2",
+		"clc_crop_rnd_clamp_full_out",
+		"clc_compdecomp_bypass",
+		"clc_crop_rnd_clamp_bypass"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"clc_rcs_full_out",
+		"clc_haf",
+		"csid_tfe_ipp",
+		"ppp_repeater",
+		"stats_awb_bg_tintless",
+		"stats_awb_bg_ae",
+		"stats_ae_bhist",
+		"stats_bayer_rs"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"stats_bayer_bfw",
+		"stats_awb_bg_awb",
+		"stats_bhist_af",
+		"full_out",
+		"ds4_out_y",
+		"ds4_out_c",
+		"ds16_out_y",
+		"ds16_out_c"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"ds2_out_y",
+		"ds2_out_c",
+		"w_ir",
+		"fd_out_y",
+		"fd_out_c",
+		"haf_sad_stats",
+		"haf_caf_stats",
+		"haf_parsed"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"haf_pre_processed",
+		"full_out",
+		"ubwc_stats",
+		"ds4_out_y",
+		"ds4_out_c",
+		"ds16_out_y",
+		"ds16_out_c",
+		"ds2_out_y"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"ubwc_stats",
+		"ds2_out_c",
+		"fd_out_y",
+		"fd_out_c",
+		"w_ir",
+		"stats_awb_bg_ae",
+		"stats_ae_bhist",
+		"stats_awb_bg_tintless"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"stats_awb_bg_alsc",
+		"stats_throttle_to_bus_awb_bg_awb",
+		"stats_throttle_to_bus_bayer_bfw",
+		"stats_throttle_to_bus_bhist_af",
+		"stats_throttle_to_bus_awb_bg_alsc",
+		"stats_throttle_to_bus_bayer_rs",
+		"stats_throttle_to_bus_bhist_tmc",
+		"stats_throttle_to_bus_sad"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"tfe_haf_processed_to_bus",
+		"tfe_haf_parsed_to_bus",
+		"tfe_stats_throttle_to_bus",
+		"rdi0_splitter_to_bus_wr",
+		"rdi1_splitter_to_bus_wr",
+		"rdi2_splitter_to_bus_wr",
+		"rdi3_splitter_to_bus_wr",
+		"rdi4_splitter_to_bus_wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"stats_bhist_tmc_to_bus_wr",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved"
+	),
+	{
+		/* needs to be parsed separately, doesn't conform to I, V, R */
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+	},
+	{
+		/* needs to be parsed separately, doesn't conform to I, V, R */
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+	},
+};
+
+static struct cam_vfe_ver4_fcg_module_info tfe980_fcg_module_info = {
+	.fcg_index_shift                     = 16,
+	.max_reg_val_pair_size               = 6,
+	.fcg_type_size                       = 2,
+	.fcg_phase_index_cfg_0               = 0x0000DE70,
+	.fcg_phase_index_cfg_1               = 0x0000DE74,
+	.fcg_reg_ctxt_shift                  = 0x0,
+	.fcg_reg_ctxt_sel                    = 0x0000DFF4,
+	.fcg_reg_ctxt_mask                   = 0x7,
+};
+
+static struct cam_vfe_top_ver4_hw_info tfe980_top_hw_info = {
+	.common_reg = &tfe980_top_common_reg,
+	.vfe_full_hw_info = {
+		.common_reg     = &tfe980_top_common_reg,
+		.reg_data       = &tfe980_ipp_common_reg_data,
+	},
+	.pdlib_hw_info = {
+		.common_reg     = &tfe980_top_common_reg,
+		.reg_data       = &tfe980_pdlib_reg_data,
+	},
+	.rdi_hw_info            = tfe980_rdi_hw_info_arr,
+	.wr_client_desc         = tfe980_wr_client_desc,
+	.ipp_module_desc        = tfe980_ipp_mod_desc,
+	.bayer_module_desc      = tfe980_bayer_mod_desc,
+	.num_mux = 7,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_PDLIB_VER_1_0,
+	},
+	.num_path_port_map = 3,
+	.path_port_map = {
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PREPROCESS_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PDAF_PARSED_DATA},
+	},
+	.num_rdi                         = ARRAY_SIZE(tfe980_rdi_hw_info_arr),
+	.num_top_errors                  = ARRAY_SIZE(tfe980_top_irq_err_desc),
+	.top_err_desc                    = tfe980_top_irq_err_desc,
+	.num_pdaf_violation_errors       = ARRAY_SIZE(tfe980_haf_violation_desc),
+	.pdaf_violation_desc             = tfe980_haf_violation_desc,
+	.debug_reg_info                  = &tfe980_dbg_reg_info,
+	.pdaf_lcr_res_mask               = tfe980_pdaf_haf_res_mask,
+	.num_pdaf_lcr_res                = ARRAY_SIZE(tfe980_pdaf_haf_res_mask),
+	.fcg_module_info                 = &tfe980_fcg_module_info,
+	.fcg_mc_supported                = true,
+};
+
+static struct cam_irq_register_set tfe980_bus_irq_reg[2] = {
+	{
+		.mask_reg_offset   = 0x00000818,
+		.clear_reg_offset  = 0x00000820,
+		.status_reg_offset = 0x00000828,
+	},
+	{
+		.mask_reg_offset   = 0x0000081C,
+		.clear_reg_offset  = 0x00000824,
+		.status_reg_offset = 0x0000082C,
+	},
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	tfe980_ubwc_regs_client_0 = {
+	.meta_addr        = 0x00000D40,
+	.meta_cfg         = 0x00000D44,
+	.mode_cfg         = 0x00000D48,
+	.stats_ctrl       = 0x00000D4C,
+	.ctrl_2           = 0x00000D50,
+	.lossy_thresh0    = 0x00000D54,
+	.lossy_thresh1    = 0x00000D58,
+	.off_lossy_var    = 0x00000D5C,
+	.bw_limit         = 0x00000D1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	tfe980_ubwc_regs_client_1 = {
+	.meta_addr        = 0x00000E40,
+	.meta_cfg         = 0x00000E44,
+	.mode_cfg         = 0x00000E48,
+	.stats_ctrl       = 0x00000E4C,
+	.ctrl_2           = 0x00000E50,
+	.lossy_thresh0    = 0x00000E54,
+	.lossy_thresh1    = 0x00000E58,
+	.off_lossy_var    = 0x00000E5C,
+	.bw_limit         = 0x00000E1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	tfe980_ubwc_regs_client_2 = {
+	.meta_addr        = 0x00000F40,
+	.meta_cfg         = 0x00000F44,
+	.mode_cfg         = 0x00000F48,
+	.stats_ctrl       = 0x00000F4C,
+	.ctrl_2           = 0x00000F50,
+	.lossy_thresh0    = 0x00000F54,
+	.lossy_thresh1    = 0x00000F58,
+	.off_lossy_var    = 0x00000F5C,
+	.bw_limit         = 0x00000F1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	tfe980_ubwc_regs_client_3 = {
+	.meta_addr        = 0x00001040,
+	.meta_cfg         = 0x00001044,
+	.mode_cfg         = 0x00001048,
+	.stats_ctrl       = 0x0000104C,
+	.ctrl_2           = 0x00001050,
+	.lossy_thresh0    = 0x00001054,
+	.lossy_thresh1    = 0x00001058,
+	.off_lossy_var    = 0x0000105C,
+	.bw_limit         = 0x0000101C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	tfe980_ubwc_regs_client_4 = {
+	.meta_addr        = 0x00001140,
+	.meta_cfg         = 0x00001144,
+	.mode_cfg         = 0x00001148,
+	.stats_ctrl       = 0x0000114C,
+	.ctrl_2           = 0x00001150,
+	.lossy_thresh0    = 0x00001154,
+	.lossy_thresh1    = 0x00001158,
+	.off_lossy_var    = 0x0000115C,
+	.bw_limit         = 0x0000111C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	tfe980_ubwc_regs_client_5 = {
+	.meta_addr        = 0x00001240,
+	.meta_cfg         = 0x00001244,
+	.mode_cfg         = 0x00001248,
+	.stats_ctrl       = 0x0000124C,
+	.ctrl_2           = 0x00001250,
+	.lossy_thresh0    = 0x00001254,
+	.lossy_thresh1    = 0x00001258,
+	.off_lossy_var    = 0x0000125C,
+	.bw_limit         = 0x0000121C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	tfe980_ubwc_regs_client_6 = {
+	.meta_addr        = 0x00001340,
+	.meta_cfg         = 0x00001344,
+	.mode_cfg         = 0x00001348,
+	.stats_ctrl       = 0x0000134C,
+	.ctrl_2           = 0x00001350,
+	.lossy_thresh0    = 0x00001354,
+	.lossy_thresh1    = 0x00001358,
+	.off_lossy_var    = 0x0000135C,
+	.bw_limit         = 0x0000131C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	tfe980_ubwc_regs_client_20 = {
+	.meta_addr        = 0x00002140,
+	.meta_cfg         = 0x00002144,
+	.mode_cfg         = 0x00002148,
+	.stats_ctrl       = 0x0000214C,
+	.ctrl_2           = 0x00002150,
+	.lossy_thresh0    = 0x00002154,
+	.lossy_thresh1    = 0x00002158,
+	.off_lossy_var    = 0x0000215C,
+	.bw_limit         = 0x0000211C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static uint32_t tfe980_out_port_mid[][12] = {
+	{58},
+	{59},
+	{60},
+	{61},
+	{62},
+	{32, 34, 36, 33, 35, 37},
+	{32, 34, 36, 33, 35, 37, 38, 40, 42, 39, 41, 43},
+	{44, 46, 48, 45, 47, 49, 50, 52, 54, 51, 53, 55},
+	{38, 40, 42, 39, 41, 43, 44, 46, 48, 45, 47, 49},
+	{8, 9, 10},
+	{56, 57},
+	{32, 33, 34},
+	{35, 36, 37},
+	{38, 39, 40},
+	{41, 42, 43},
+	{44, 45, 46},
+	{47, 48, 49},
+	{50, 51, 52},
+	{53, 54, 55},
+	{56, 57, 58},
+	{11},
+	{50, 51},
+	{12},
+	{13},
+};
+
+static struct cam_vfe_bus_ver3_hw_info tfe980_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000800,
+		.cgc_ovd                          = 0x00000808,
+		.ctxt_sel                         = 0x00000924,
+		.ubwc_static_ctrl                 = 0x00000858,
+		.pwr_iso_cfg                      = 0x0000085C,
+		.overflow_status_clear            = 0x00000860,
+		.ccif_violation_status            = 0x00000864,
+		.overflow_status                  = 0x00000868,
+		.image_size_violation_status      = 0x00000870,
+		.debug_status_top_cfg             = 0x000008F0,
+		.debug_status_top                 = 0x000008F4,
+		.test_bus_ctrl                    = 0x00000928,
+		.mc_read_sel_shift                = 0x5,
+		.mc_write_sel_shift               = 0x0,
+		.mc_ctxt_mask                     = 0x7,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = tfe980_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00000830,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = CAM_TFE_BUS_VER3_980_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 FULL */
+		{
+			.cfg                      = 0x00000D00,
+			.image_addr               = 0x00000D04,
+			.frame_incr               = 0x00000D08,
+			.image_cfg_0              = 0x00000D0C,
+			.image_cfg_1              = 0x00000D10,
+			.image_cfg_2              = 0x00000D14,
+			.packer_cfg               = 0x00000D18,
+			.frame_header_addr        = 0x00000D20,
+			.frame_header_incr        = 0x00000D24,
+			.frame_header_cfg         = 0x00000D28,
+			.irq_subsample_period     = 0x00000D30,
+			.irq_subsample_pattern    = 0x00000D34,
+			.framedrop_period         = 0x00000D38,
+			.framedrop_pattern        = 0x00000D3C,
+			.mmu_prefetch_cfg         = 0x00000D60,
+			.mmu_prefetch_max_offset  = 0x00000D64,
+			.system_cache_cfg         = 0x00000D68,
+			.addr_cfg                 = 0x00000D70,
+			.ctxt_cfg                 = 0x00000D78,
+			.addr_status_0            = 0x00000D90,
+			.addr_status_1            = 0x00000D94,
+			.addr_status_2            = 0x00000D98,
+			.addr_status_3            = 0x00000D9C,
+			.debug_status_cfg         = 0x00000D7C,
+			.debug_status_0           = 0x00000D80,
+			.debug_status_1           = 0x00000D84,
+			.bw_limiter_addr          = 0x00000D1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &tfe980_ubwc_regs_client_0,
+		},
+		/* BUS Client 1 DS4_Y */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.frame_header_addr        = 0x00000E20,
+			.frame_header_incr        = 0x00000E24,
+			.frame_header_cfg         = 0x00000E28,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_cfg                 = 0x00000E70,
+			.ctxt_cfg                 = 0x00000E78,
+			.addr_status_0            = 0x00000E90,
+			.addr_status_1            = 0x00000E94,
+			.addr_status_2            = 0x00000E98,
+			.addr_status_3            = 0x00000E9C,
+			.debug_status_cfg         = 0x00000E7C,
+			.debug_status_0           = 0x00000E80,
+			.debug_status_1           = 0x00000E84,
+			.bw_limiter_addr          = 0x00000E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &tfe980_ubwc_regs_client_1,
+		},
+		/* BUS Client 2 DS4_C */
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_cfg                 = 0x00000F70,
+			.ctxt_cfg                 = 0x00000F78,
+			.addr_status_0            = 0x00000F90,
+			.addr_status_1            = 0x00000F94,
+			.addr_status_2            = 0x00000F98,
+			.addr_status_3            = 0x00000F9C,
+			.debug_status_cfg         = 0x00000F7C,
+			.debug_status_0           = 0x00000F80,
+			.debug_status_1           = 0x00000F84,
+			.bw_limiter_addr          = 0x00000F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &tfe980_ubwc_regs_client_2,
+		},
+		/* BUS Client 3 DS16_Y */
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.frame_header_addr        = 0x00001020,
+			.frame_header_incr        = 0x00001024,
+			.frame_header_cfg         = 0x00001028,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.system_cache_cfg         = 0x00001068,
+			.addr_cfg                 = 0x00001070,
+			.ctxt_cfg                 = 0x00001078,
+			.addr_status_0            = 0x00001090,
+			.addr_status_1            = 0x00001094,
+			.addr_status_2            = 0x00001098,
+			.addr_status_3            = 0x0000109C,
+			.debug_status_cfg         = 0x0000107C,
+			.debug_status_0           = 0x00001080,
+			.debug_status_1           = 0x00001084,
+			.bw_limiter_addr          = 0x0000101C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &tfe980_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 DS16_C */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.frame_header_addr        = 0x00001120,
+			.frame_header_incr        = 0x00001124,
+			.frame_header_cfg         = 0x00001128,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.system_cache_cfg         = 0x00001168,
+			.addr_cfg                 = 0x00001170,
+			.ctxt_cfg                 = 0x00001178,
+			.addr_status_0            = 0x00001190,
+			.addr_status_1            = 0x00001194,
+			.addr_status_2            = 0x00001198,
+			.addr_status_3            = 0x0000119C,
+			.debug_status_cfg         = 0x0000117C,
+			.debug_status_0           = 0x00001180,
+			.debug_status_1           = 0x00001184,
+			.bw_limiter_addr          = 0x0000111C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &tfe980_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 DS2_Y */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.system_cache_cfg         = 0x00001268,
+			.addr_cfg                 = 0x00001270,
+			.ctxt_cfg                 = 0x00001278,
+			.addr_status_0            = 0x00001290,
+			.addr_status_1            = 0x00001294,
+			.addr_status_2            = 0x00001298,
+			.addr_status_3            = 0x0000129C,
+			.debug_status_cfg         = 0x0000127C,
+			.debug_status_0           = 0x00001280,
+			.debug_status_1           = 0x00001284,
+			.bw_limiter_addr          = 0x0000121C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &tfe980_ubwc_regs_client_5,
+		},
+		/* BUS Client 6 DS2_C */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.system_cache_cfg         = 0x00001368,
+			.addr_cfg                 = 0x00001370,
+			.ctxt_cfg                 = 0x00001378,
+			.addr_status_0            = 0x00001390,
+			.addr_status_1            = 0x00001394,
+			.addr_status_2            = 0x00001398,
+			.addr_status_3            = 0x0000139C,
+			.debug_status_cfg         = 0x0000137C,
+			.debug_status_0           = 0x00001380,
+			.debug_status_1           = 0x00001384,
+			.bw_limiter_addr          = 0x0000131C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &tfe980_ubwc_regs_client_6,
+		},
+		/* BUS Client 7 FD_Y */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_cfg                 = 0x00001470,
+			.ctxt_cfg                 = 0x00001478,
+			.addr_status_0            = 0x00001490,
+			.addr_status_1            = 0x00001494,
+			.addr_status_2            = 0x00001498,
+			.addr_status_3            = 0x0000149C,
+			.debug_status_cfg         = 0x0000147C,
+			.debug_status_0           = 0x00001480,
+			.debug_status_1           = 0x00001484,
+			.bw_limiter_addr          = 0x0000141C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 FD_C */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_cfg                 = 0x00001570,
+			.ctxt_cfg                 = 0x00001578,
+			.addr_status_0            = 0x00001590,
+			.addr_status_1            = 0x00001594,
+			.addr_status_2            = 0x00001598,
+			.addr_status_3            = 0x0000159C,
+			.debug_status_cfg         = 0x0000157C,
+			.debug_status_0           = 0x00001580,
+			.debug_status_1           = 0x00001584,
+			.bw_limiter_addr          = 0x0000151C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 IR */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_cfg                 = 0x00001670,
+			.ctxt_cfg                 = 0x00001678,
+			.addr_status_0            = 0x00001690,
+			.addr_status_1            = 0x00001694,
+			.addr_status_2            = 0x00001698,
+			.addr_status_3            = 0x0000169C,
+			.debug_status_cfg         = 0x0000167C,
+			.debug_status_0           = 0x00001680,
+			.debug_status_1           = 0x00001684,
+			.bw_limiter_addr          = 0x0000161C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 STATS_AEC_BG */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.frame_header_addr        = 0x00001720,
+			.frame_header_incr        = 0x00001724,
+			.frame_header_cfg         = 0x00001728,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_cfg                 = 0x00001770,
+			.ctxt_cfg                 = 0x00001778,
+			.addr_status_0            = 0x00001790,
+			.addr_status_1            = 0x00001794,
+			.addr_status_2            = 0x00001798,
+			.addr_status_3            = 0x0000179C,
+			.debug_status_cfg         = 0x0000177C,
+			.debug_status_0           = 0x00001780,
+			.debug_status_1           = 0x00001784,
+			.bw_limiter_addr          = 0x0000171C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 STATS_AEC_BHIST */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.framedrop_period         = 0x00001838,
+			.framedrop_pattern        = 0x0000183C,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_cfg                 = 0x00001870,
+			.ctxt_cfg                 = 0x00001878,
+			.addr_status_0            = 0x00001890,
+			.addr_status_1            = 0x00001894,
+			.addr_status_2            = 0x00001898,
+			.addr_status_3            = 0x0000189C,
+			.debug_status_cfg         = 0x0000187C,
+			.debug_status_0           = 0x00001880,
+			.debug_status_1           = 0x00001884,
+			.bw_limiter_addr          = 0x0000181C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 STATS_TINTELESS_BG */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.framedrop_period         = 0x00001938,
+			.framedrop_pattern        = 0x0000193C,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_cfg                 = 0x00001970,
+			.ctxt_cfg                 = 0x00001978,
+			.addr_status_0            = 0x00001990,
+			.addr_status_1            = 0x00001994,
+			.addr_status_2            = 0x00001998,
+			.addr_status_3            = 0x0000199C,
+			.debug_status_cfg         = 0x0000197C,
+			.debug_status_0           = 0x00001980,
+			.debug_status_1           = 0x00001984,
+			.bw_limiter_addr          = 0x0000191C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 STATS_AWB_BG */
+		{
+			.cfg                      = 0x00001A00,
+			.image_addr               = 0x00001A04,
+			.frame_incr               = 0x00001A08,
+			.image_cfg_0              = 0x00001A0C,
+			.image_cfg_1              = 0x00001A10,
+			.image_cfg_2              = 0x00001A14,
+			.packer_cfg               = 0x00001A18,
+			.frame_header_addr        = 0x00001A20,
+			.frame_header_incr        = 0x00001A24,
+			.frame_header_cfg         = 0x00001A28,
+			.irq_subsample_period     = 0x00001A30,
+			.irq_subsample_pattern    = 0x00001A34,
+			.framedrop_period         = 0x00001A38,
+			.framedrop_pattern        = 0x00001A3C,
+			.mmu_prefetch_cfg         = 0x00001A60,
+			.mmu_prefetch_max_offset  = 0x00001A64,
+			.system_cache_cfg         = 0x00001A68,
+			.addr_cfg                 = 0x00001A70,
+			.ctxt_cfg                 = 0x00001A78,
+			.addr_status_0            = 0x00001A90,
+			.addr_status_1            = 0x00001A94,
+			.addr_status_2            = 0x00001A98,
+			.addr_status_3            = 0x00001A9C,
+			.debug_status_cfg         = 0x00001A7C,
+			.debug_status_0           = 0x00001A80,
+			.debug_status_1           = 0x00001A84,
+			.bw_limiter_addr          = 0x00001A1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 STATS_AWB_BFW */
+		{
+			.cfg                      = 0x00001B00,
+			.image_addr               = 0x00001B04,
+			.frame_incr               = 0x00001B08,
+			.image_cfg_0              = 0x00001B0C,
+			.image_cfg_1              = 0x00001B10,
+			.image_cfg_2              = 0x00001B14,
+			.packer_cfg               = 0x00001B18,
+			.frame_header_addr        = 0x00001B20,
+			.frame_header_incr        = 0x00001B24,
+			.frame_header_cfg         = 0x00001B28,
+			.irq_subsample_period     = 0x00001B30,
+			.irq_subsample_pattern    = 0x00001B34,
+			.framedrop_period         = 0x00001B38,
+			.framedrop_pattern        = 0x00001B3C,
+			.mmu_prefetch_cfg         = 0x00001B60,
+			.mmu_prefetch_max_offset  = 0x00001B64,
+			.system_cache_cfg         = 0x00001B68,
+			.addr_cfg                 = 0x00001B70,
+			.ctxt_cfg                 = 0x00001B78,
+			.addr_status_0            = 0x00001B90,
+			.addr_status_1            = 0x00001B94,
+			.addr_status_2            = 0x00001B98,
+			.addr_status_3            = 0x00001B9C,
+			.debug_status_cfg         = 0x00001B7C,
+			.debug_status_0           = 0x00001B80,
+			.debug_status_1           = 0x00001B84,
+			.bw_limiter_addr          = 0x00001B1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 STATS_AF_BHIST */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.framedrop_period         = 0x00001C38,
+			.framedrop_pattern        = 0x00001C3C,
+			.mmu_prefetch_cfg         = 0x00001C60,
+			.mmu_prefetch_max_offset  = 0x00001C64,
+			.system_cache_cfg         = 0x00001C68,
+			.addr_cfg                 = 0x00001C70,
+			.ctxt_cfg                 = 0x00001C78,
+			.addr_status_0            = 0x00001C90,
+			.addr_status_1            = 0x00001C94,
+			.addr_status_2            = 0x00001C98,
+			.addr_status_3            = 0x00001C9C,
+			.debug_status_cfg         = 0x00001C7C,
+			.debug_status_0           = 0x00001C80,
+			.debug_status_1           = 0x00001C84,
+			.bw_limiter_addr          = 0x00001C1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 STATS_ALSC_BG */ /* Or ALSC_BHIST? */
+		{
+			.cfg                      = 0x00001D00,
+			.image_addr               = 0x00001D04,
+			.frame_incr               = 0x00001D08,
+			.image_cfg_0              = 0x00001D0C,
+			.image_cfg_1              = 0x00001D10,
+			.image_cfg_2              = 0x00001D14,
+			.packer_cfg               = 0x00001D18,
+			.frame_header_addr        = 0x00001D20,
+			.frame_header_incr        = 0x00001D24,
+			.frame_header_cfg         = 0x00001D28,
+			.irq_subsample_period     = 0x00001D30,
+			.irq_subsample_pattern    = 0x00001D34,
+			.framedrop_period         = 0x00001D38,
+			.framedrop_pattern        = 0x00001D3C,
+			.mmu_prefetch_cfg         = 0x00001D60,
+			.mmu_prefetch_max_offset  = 0x00001D64,
+			.system_cache_cfg         = 0x00001D68,
+			.addr_cfg                 = 0x00001D70,
+			.ctxt_cfg                 = 0x00001D78,
+			.addr_status_0            = 0x00001D90,
+			.addr_status_1            = 0x00001D94,
+			.addr_status_2            = 0x00001D98,
+			.addr_status_3            = 0x00001D9C,
+			.debug_status_cfg         = 0x00001D7C,
+			.debug_status_0           = 0x00001D80,
+			.debug_status_1           = 0x00001D84,
+			.bw_limiter_addr          = 0x00001D1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 STATS_FLICKER_BAYERS */
+		{
+			.cfg                      = 0x00001E00,
+			.image_addr               = 0x00001E04,
+			.frame_incr               = 0x00001E08,
+			.image_cfg_0              = 0x00001E0C,
+			.image_cfg_1              = 0x00001E10,
+			.image_cfg_2              = 0x00001E14,
+			.packer_cfg               = 0x00001E18,
+			.frame_header_addr        = 0x00001E20,
+			.frame_header_incr        = 0x00001E24,
+			.frame_header_cfg         = 0x00001E28,
+			.irq_subsample_period     = 0x00001E30,
+			.irq_subsample_pattern    = 0x00001E34,
+			.framedrop_period         = 0x00001E38,
+			.framedrop_pattern        = 0x00001E3C,
+			.mmu_prefetch_cfg         = 0x00001E60,
+			.mmu_prefetch_max_offset  = 0x00001E64,
+			.system_cache_cfg         = 0x00001E68,
+			.addr_cfg                 = 0x00001E70,
+			.ctxt_cfg                 = 0x00001E78,
+			.addr_status_0            = 0x00001E90,
+			.addr_status_1            = 0x00001E94,
+			.addr_status_2            = 0x00001E98,
+			.addr_status_3            = 0x00001E9C,
+			.debug_status_cfg         = 0x00001E7C,
+			.debug_status_0           = 0x00001E80,
+			.debug_status_1           = 0x00001E84,
+			.bw_limiter_addr          = 0x00001E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 STATS_TMC_BHIST */
+		{
+			.cfg                      = 0x00001F00,
+			.image_addr               = 0x00001F04,
+			.frame_incr               = 0x00001F08,
+			.image_cfg_0              = 0x00001F0C,
+			.image_cfg_1              = 0x00001F10,
+			.image_cfg_2              = 0x00001F14,
+			.packer_cfg               = 0x00001F18,
+			.frame_header_addr        = 0x00001F20,
+			.frame_header_incr        = 0x00001F24,
+			.frame_header_cfg         = 0x00001F28,
+			.irq_subsample_period     = 0x00001F30,
+			.irq_subsample_pattern    = 0x00001F34,
+			.framedrop_period         = 0x00001F38,
+			.framedrop_pattern        = 0x00001F3C,
+			.mmu_prefetch_cfg         = 0x00001F60,
+			.mmu_prefetch_max_offset  = 0x00001F64,
+			.system_cache_cfg         = 0x00001F68,
+			.addr_cfg                 = 0x00001F70,
+			.ctxt_cfg                 = 0x00001F78,
+			.addr_status_0            = 0x00001F90,
+			.addr_status_1            = 0x00001F94,
+			.addr_status_2            = 0x00001F98,
+			.addr_status_3            = 0x00001F9C,
+			.debug_status_cfg         = 0x00001F7C,
+			.debug_status_0           = 0x00001F80,
+			.debug_status_1           = 0x00001F84,
+			.bw_limiter_addr          = 0x00001F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 PDAF_0 */
+		{
+			.cfg                      = 0x00002000,
+			.image_addr               = 0x00002004,
+			.frame_incr               = 0x00002008,
+			.image_cfg_0              = 0x0000200C,
+			.image_cfg_1              = 0x00002010,
+			.image_cfg_2              = 0x00002014,
+			.packer_cfg               = 0x00002018,
+			.frame_header_addr        = 0x00002020,
+			.frame_header_incr        = 0x00002024,
+			.frame_header_cfg         = 0x00002028,
+			.irq_subsample_period     = 0x00002030,
+			.irq_subsample_pattern    = 0x00002034,
+			.framedrop_period         = 0x00002038,
+			.framedrop_pattern        = 0x0000203C,
+			.mmu_prefetch_cfg         = 0x00002060,
+			.mmu_prefetch_max_offset  = 0x00002064,
+			.system_cache_cfg         = 0x00002068,
+			.addr_cfg                 = 0x00002070,
+			.ctxt_cfg                 = 0x00002078,
+			.addr_status_0            = 0x00002090,
+			.addr_status_1            = 0x00002094,
+			.addr_status_2            = 0x00002098,
+			.addr_status_3            = 0x0000209C,
+			.debug_status_cfg         = 0x0000207C,
+			.debug_status_0           = 0x00002080,
+			.debug_status_1           = 0x00002084,
+			.bw_limiter_addr          = 0x0000201C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 PDAF_1 */
+		{
+			.cfg                      = 0x00002100,
+			.image_addr               = 0x00002104,
+			.frame_incr               = 0x00002108,
+			.image_cfg_0              = 0x0000210C,
+			.image_cfg_1              = 0x00002110,
+			.image_cfg_2              = 0x00002114,
+			.packer_cfg               = 0x00002118,
+			.frame_header_addr        = 0x00002120,
+			.frame_header_incr        = 0x00002124,
+			.frame_header_cfg         = 0x00002128,
+			.irq_subsample_period     = 0x00002130,
+			.irq_subsample_pattern    = 0x00002134,
+			.framedrop_period         = 0x00002138,
+			.framedrop_pattern        = 0x0000213C,
+			.mmu_prefetch_cfg         = 0x00002160,
+			.mmu_prefetch_max_offset  = 0x00002164,
+			.system_cache_cfg         = 0x00002168,
+			.addr_cfg                 = 0x00002170,
+			.ctxt_cfg                 = 0x00002178,
+			.addr_status_0            = 0x00002190,
+			.addr_status_1            = 0x00002194,
+			.addr_status_2            = 0x00002198,
+			.addr_status_3            = 0x0000219C,
+			.debug_status_cfg         = 0x0000217C,
+			.debug_status_0           = 0x00002180,
+			.debug_status_1           = 0x00002184,
+			.bw_limiter_addr          = 0x0000211C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = &tfe980_ubwc_regs_client_20,
+		},
+		/* BUS Client 21 PDAF_2 */
+		{
+			.cfg                      = 0x00002200,
+			.image_addr               = 0x00002204,
+			.frame_incr               = 0x00002208,
+			.image_cfg_0              = 0x0000220C,
+			.image_cfg_1              = 0x00002210,
+			.image_cfg_2              = 0x00002214,
+			.packer_cfg               = 0x00002218,
+			.frame_header_addr        = 0x00002220,
+			.frame_header_incr        = 0x00002224,
+			.frame_header_cfg         = 0x00002228,
+			.irq_subsample_period     = 0x00002230,
+			.irq_subsample_pattern    = 0x00002234,
+			.framedrop_period         = 0x00002238,
+			.framedrop_pattern        = 0x0000223C,
+			.mmu_prefetch_cfg         = 0x00002260,
+			.mmu_prefetch_max_offset  = 0x00002264,
+			.system_cache_cfg         = 0x00002268,
+			.addr_cfg                 = 0x00002270,
+			.ctxt_cfg                 = 0x00002278,
+			.addr_status_0            = 0x00002290,
+			.addr_status_1            = 0x00002294,
+			.addr_status_2            = 0x00002298,
+			.addr_status_3            = 0x0000229C,
+			.debug_status_cfg         = 0x0000227C,
+			.debug_status_0           = 0x00002280,
+			.debug_status_1           = 0x00002284,
+			.bw_limiter_addr          = 0x0000221C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 22 PDAF_3 */
+		{
+			.cfg                      = 0x00002300,
+			.image_addr               = 0x00002304,
+			.frame_incr               = 0x00002308,
+			.image_cfg_0              = 0x0000230C,
+			.image_cfg_1              = 0x00002310,
+			.image_cfg_2              = 0x00002314,
+			.packer_cfg               = 0x00002318,
+			.frame_header_addr        = 0x00002320,
+			.frame_header_incr        = 0x00002324,
+			.frame_header_cfg         = 0x00002328,
+			.irq_subsample_period     = 0x00002330,
+			.irq_subsample_pattern    = 0x00002334,
+			.framedrop_period         = 0x00002338,
+			.framedrop_pattern        = 0x0000233C,
+			.mmu_prefetch_cfg         = 0x00002360,
+			.mmu_prefetch_max_offset  = 0x00002364,
+			.system_cache_cfg         = 0x00002368,
+			.addr_cfg                 = 0x00002370,
+			.ctxt_cfg                 = 0x00002378,
+			.addr_status_0            = 0x00002390,
+			.addr_status_1            = 0x00002394,
+			.addr_status_2            = 0x00002398,
+			.addr_status_3            = 0x0000239C,
+			.debug_status_cfg         = 0x0000237C,
+			.debug_status_0           = 0x00002380,
+			.debug_status_1           = 0x00002384,
+			.bw_limiter_addr          = 0x0000231C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 RDI_0 */
+		{
+			.cfg                      = 0x00002400,
+			.image_addr               = 0x00002404,
+			.frame_incr               = 0x00002408,
+			.image_cfg_0              = 0x0000240C,
+			.image_cfg_1              = 0x00002410,
+			.image_cfg_2              = 0x00002414,
+			.packer_cfg               = 0x00002418,
+			.frame_header_addr        = 0x00002420,
+			.frame_header_incr        = 0x00002424,
+			.frame_header_cfg         = 0x00002428,
+			.irq_subsample_period     = 0x00002430,
+			.irq_subsample_pattern    = 0x00002434,
+			.framedrop_period         = 0x00002438,
+			.framedrop_pattern        = 0x0000243C,
+			.mmu_prefetch_cfg         = 0x00002460,
+			.mmu_prefetch_max_offset  = 0x00002464,
+			.system_cache_cfg         = 0x00002468,
+			.addr_cfg                 = 0x00002470,
+			.ctxt_cfg                 = 0x00002478,
+			.addr_status_0            = 0x00002490,
+			.addr_status_1            = 0x00002494,
+			.addr_status_2            = 0x00002498,
+			.addr_status_3            = 0x0000249C,
+			.debug_status_cfg         = 0x0000247C,
+			.debug_status_0           = 0x00002480,
+			.debug_status_1           = 0x00002484,
+			.bw_limiter_addr          = 0x0000241C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 24 RDI_1 */
+		{
+			.cfg                      = 0x00002500,
+			.image_addr               = 0x00002504,
+			.frame_incr               = 0x00002508,
+			.image_cfg_0              = 0x0000250C,
+			.image_cfg_1              = 0x00002510,
+			.image_cfg_2              = 0x00002514,
+			.packer_cfg               = 0x00002518,
+			.frame_header_addr        = 0x00002520,
+			.frame_header_incr        = 0x00002524,
+			.frame_header_cfg         = 0x00002528,
+			.irq_subsample_period     = 0x00002530,
+			.irq_subsample_pattern    = 0x00002534,
+			.framedrop_period         = 0x00002538,
+			.framedrop_pattern        = 0x0000253C,
+			.mmu_prefetch_cfg         = 0x00002560,
+			.mmu_prefetch_max_offset  = 0x00002564,
+			.system_cache_cfg         = 0x00002568,
+			.addr_cfg                 = 0x00002570,
+			.ctxt_cfg                 = 0x00002578,
+			.addr_status_0            = 0x00002590,
+			.addr_status_1            = 0x00002594,
+			.addr_status_2            = 0x00002598,
+			.addr_status_3            = 0x0000259C,
+			.debug_status_cfg         = 0x0000257C,
+			.debug_status_0           = 0x00002580,
+			.debug_status_1           = 0x00002584,
+			.bw_limiter_addr          = 0x0000251C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 25 RDI_2 */
+		{
+			.cfg                      = 0x00002600,
+			.image_addr               = 0x00002604,
+			.frame_incr               = 0x00002608,
+			.image_cfg_0              = 0x0000260C,
+			.image_cfg_1              = 0x00002610,
+			.image_cfg_2              = 0x00002614,
+			.packer_cfg               = 0x00002618,
+			.frame_header_addr        = 0x00002620,
+			.frame_header_incr        = 0x00002624,
+			.frame_header_cfg         = 0x00002628,
+			.irq_subsample_period     = 0x00002630,
+			.irq_subsample_pattern    = 0x00002634,
+			.framedrop_period         = 0x00002638,
+			.framedrop_pattern        = 0x0000263C,
+			.mmu_prefetch_cfg         = 0x00002660,
+			.mmu_prefetch_max_offset  = 0x00002664,
+			.system_cache_cfg         = 0x00002668,
+			.addr_cfg                 = 0x00002670,
+			.ctxt_cfg                 = 0x00002678,
+			.addr_status_0            = 0x00002690,
+			.addr_status_1            = 0x00002694,
+			.addr_status_2            = 0x00002698,
+			.addr_status_3            = 0x0000269C,
+			.debug_status_cfg         = 0x0000267C,
+			.debug_status_0           = 0x00002680,
+			.debug_status_1           = 0x00002684,
+			.bw_limiter_addr          = 0x0000261C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 26 RDI_3 */
+		{
+			.cfg                      = 0x00002700,
+			.image_addr               = 0x00002704,
+			.frame_incr               = 0x00002708,
+			.image_cfg_0              = 0x0000270C,
+			.image_cfg_1              = 0x00002710,
+			.image_cfg_2              = 0x00002714,
+			.packer_cfg               = 0x00002718,
+			.frame_header_addr        = 0x00002720,
+			.frame_header_incr        = 0x00002724,
+			.frame_header_cfg         = 0x00002728,
+			.irq_subsample_period     = 0x00002730,
+			.irq_subsample_pattern    = 0x00002734,
+			.framedrop_period         = 0x00002738,
+			.framedrop_pattern        = 0x0000273C,
+			.mmu_prefetch_cfg         = 0x00002760,
+			.mmu_prefetch_max_offset  = 0x00002764,
+			.system_cache_cfg         = 0x00002768,
+			.addr_cfg                 = 0x00002770,
+			.ctxt_cfg                 = 0x00002778,
+			.addr_status_0            = 0x00002790,
+			.addr_status_1            = 0x00002794,
+			.addr_status_2            = 0x00002798,
+			.addr_status_3            = 0x0000279C,
+			.debug_status_cfg         = 0x0000277C,
+			.debug_status_0           = 0x00002780,
+			.debug_status_1           = 0x00002784,
+			.bw_limiter_addr          = 0x0000271C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_8,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 27 RDI_4 */
+		{
+			.cfg                      = 0x00002800,
+			.image_addr               = 0x00002804,
+			.frame_incr               = 0x00002808,
+			.image_cfg_0              = 0x0000280C,
+			.image_cfg_1              = 0x00002810,
+			.image_cfg_2              = 0x00002814,
+			.packer_cfg               = 0x00002818,
+			.frame_header_addr        = 0x00002820,
+			.frame_header_incr        = 0x00002824,
+			.frame_header_cfg         = 0x00002828,
+			.irq_subsample_period     = 0x00002830,
+			.irq_subsample_pattern    = 0x00002834,
+			.framedrop_period         = 0x00002838,
+			.framedrop_pattern        = 0x0000283C,
+			.mmu_prefetch_cfg         = 0x00002860,
+			.mmu_prefetch_max_offset  = 0x00002864,
+			.system_cache_cfg         = 0x00002868,
+			.addr_cfg                 = 0x00002870,
+			.ctxt_cfg                 = 0x00002878,
+			.addr_status_0            = 0x00002890,
+			.addr_status_1            = 0x00002894,
+			.addr_status_2            = 0x00002898,
+			.addr_status_3            = 0x0000289C,
+			.debug_status_cfg         = 0x0000287C,
+			.debug_status_0           = 0x00002880,
+			.debug_status_1           = 0x00002884,
+			.bw_limiter_addr          = 0x0000281C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_9,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 24,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid           = tfe980_out_port_mid[0],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				23,
+			},
+			.name          = {
+				"RDI_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid           = tfe980_out_port_mid[1],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				24,
+			},
+			.name          = {
+				"RDI_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.mid           = tfe980_out_port_mid[2],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				25,
+			},
+			.name          = {
+				"RDI_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_5,
+			.mid           = tfe980_out_port_mid[3],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				26,
+			},
+			.name          = {
+				"RDI_3",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI4,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_5,
+			.mid           = tfe980_out_port_mid[4],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				27,
+			},
+			.name          = {
+				"RDI_4",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+			.max_width     = 4672,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[5],
+			.num_mid       = 6,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 0,
+			.wm_idx        = {
+				0,
+			},
+			.name          = {
+				"FULL",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+			.max_width     = 1168,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[6],
+			.num_mid       = 12,
+			.num_wm        = 2,
+			.line_based    = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 0,
+			.wm_idx        = {
+				1,
+				2,
+			},
+			.name          = {
+				"DS4_Y",
+				"DS4_UV"
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+			.max_width     = 292,
+			.max_height    = 1024,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[7],
+			.num_mid       = 12,
+			.num_wm        = 2,
+			.line_based    = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 0,
+			.wm_idx        = {
+				3,
+				4,
+			},
+			.name          = {
+				"DS16_Y",
+				"DS16_UV",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS2,
+			.max_width     = 4672,
+			.max_height    = 8192,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[8],
+			.num_mid       = 12,
+			.num_wm        = 2,
+			.line_based    = 1,
+			.mc_based      = true,
+			.wm_idx        = {
+				5,
+				6,
+			},
+			.name          = {
+				"DS2_Y",
+				"DS2_UV",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FD,
+			.max_width     = 9312,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[9],
+			.num_mid       = 3,
+			.num_wm        = 2,
+			.line_based    = 1,
+			.cntxt_cfg_except = true,
+			.wm_idx        = {
+				7,
+				8,
+			},
+			.name          = {
+				"FD_Y",
+				"FD_C",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_IR,
+			.max_width     = 9312,
+			.max_height    = 8192,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[10],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.cntxt_cfg_except = true,
+			.wm_idx        = {
+				9,
+			},
+			.name          = {
+				"IR",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[11],
+			.num_mid       = 3,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				10,
+			},
+			.name          = {
+				"STATS_AEC_BG",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[12],
+			.num_mid       = 3,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				11,
+			},
+			.name          = {
+				"STATS_BHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[13],
+			.num_mid       = 3,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				12,
+			},
+			.name          = {
+				"STATS_TL_BG",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[14],
+			.num_mid       = 3,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				13,
+			},
+			.name          = {
+				"STATS_AWB_BG",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[15],
+			.num_mid       = 3,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				14,
+			},
+			.name          = {
+				"AWB_BFW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AF_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[16],
+			.num_mid       = 3,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				15,
+			},
+			.name          = {
+				"AF_BHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_ALSC,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[17],
+			.num_mid       = 3,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				16,
+			},
+			.name          = {
+				"ALSC_BG",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BAYER_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[18],
+			.num_mid       = 3,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				17,
+			},
+			.name          = {
+				"STATS_RS",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_TMC_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = tfe980_out_port_mid[19],
+			.num_mid       = 3,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				18,
+			},
+			.name          = {
+				"STATS_TMC_BHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+			.max_width     = 14592,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = tfe980_out_port_mid[20],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				19,
+			},
+			.name          = {
+				"PDAF_0_2PD",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = tfe980_out_port_mid[21],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				20,
+			},
+			.name          = {
+				"PDAF_1_PREPROCESS_2PD",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PDAF_PARSED,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = tfe980_out_port_mid[22],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				21,
+			},
+			.name          = {
+				"PDAF_2_PARSED_DATA",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_CAF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = tfe980_out_port_mid[23],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.mc_based      = true,
+			.mc_grp_shift  = 4,
+			.wm_idx        = {
+				22,
+			},
+			.name          = {
+				"STATS_BAF",
+			},
+		},
+	},
+	.num_cons_err = 32,
+	.constraint_error_list = {
+		{
+			.bitmask = BIT(0),
+			.error_description = "PPC 1x1 input Not Supported"
+		},
+		{
+			.bitmask = BIT(1),
+			.error_description = "PPC 1x2 input Not Supported"
+		},
+		{
+			.bitmask = BIT(2),
+			.error_description = "PPC 2x1 input Not Supported"
+		},
+		{
+			.bitmask = BIT(3),
+			.error_description = "PPC 2x2 input Not Supported"
+		},
+		{
+			.bitmask = BIT(4),
+			.error_description = "Pack 8 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(5),
+			.error_description = "Pack 16 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(6),
+			.error_description = "Pack 24 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(7),
+			.error_description = "Pack 32 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(8),
+			.error_description = "Pack 64 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(9),
+			.error_description = "Pack MIPI 20 format Not Supported"
+		},
+		{
+			.bitmask = BIT(10),
+			.error_description = "Pack MIPI 14 format Not Supported"
+		},
+		{
+			.bitmask = BIT(11),
+			.error_description = "Pack MIPI 12 format Not Supported"
+		},
+		{
+			.bitmask = BIT(12),
+			.error_description = "Pack MIPI 10 format Not Supported"
+		},
+		{
+			.bitmask = BIT(13),
+			.error_description = "Pack 128 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(14),
+			.error_description = "UBWC P016 format Not Supported"
+		},
+		{
+			.bitmask = BIT(15),
+			.error_description = "UBWC P010 format Not Supported"
+		},
+		{
+			.bitmask = BIT(16),
+			.error_description = "UBWC NV12 format Not Supported"
+		},
+		{
+			.bitmask = BIT(17),
+			.error_description = "UBWC NV12 4R format Not Supported"
+		},
+		{
+			.bitmask = BIT(18),
+			.error_description = "UBWC TP10 format Not Supported"
+		},
+		{
+			.bitmask = BIT(19),
+			.error_description = "Frame based Mode Not Supported"
+		},
+		{
+			.bitmask = BIT(20),
+			.error_description = "Index based Mode Not Supported"
+		},
+		{
+			.bitmask = BIT(21),
+			.error_description = "FIFO image addr unalign"
+		},
+		{
+			.bitmask = BIT(22),
+			.error_description = "FIFO ubwc addr unalign"
+		},
+		{
+			.bitmask = BIT(23),
+			.error_description = "FIFO framehdr addr unalign"
+		},
+		{
+			.bitmask = BIT(24),
+			.error_description = "Image address unalign"
+		},
+		{
+			.bitmask = BIT(25),
+			.error_description = "UBWC address unalign"
+		},
+		{
+			.bitmask = BIT(26),
+			.error_description = "Frame Header address unalign"
+		},
+		{
+			.bitmask = BIT(27),
+			.error_description = "Stride unalign"
+		},
+		{
+			.bitmask = BIT(28),
+			.error_description = "X Initialization unalign"
+		},
+		{
+			.bitmask = BIT(29),
+			.error_description = "Image Width unalign",
+		},
+		{
+			.bitmask = BIT(30),
+			.error_description = "Image Height unalign",
+		},
+		{
+			.bitmask = BIT(31),
+			.error_description = "Meta Stride unalign",
+		},
+	},
+	.num_comp_grp          = 10,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		0x7, BIT(3), 0x70, BIT(7), BIT(8), BIT(16),
+		BIT(17), BIT(18), BIT(19), BIT(20),
+	},
+	.top_irq_shift         = 0,
+	.max_out_res           = CAM_ISP_IFE_OUT_RES_BASE + 42,
+	.pack_align_shift      = 5,
+	.max_bw_counter_limit  = 0xFF,
+};
+
+static struct cam_vfe_irq_hw_info tfe980_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_EXT_CSID,
+	.top_irq_reg   = &tfe980_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_tfe980_hw_info = {
+	.irq_hw_info                  = &tfe980_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &tfe980_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &tfe980_top_hw_info,
+};
+#endif /* _CAM_TFE980_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.c
@@ -0,0 +1,176 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_vfe170.h"
+#include "cam_vfe170_150.h"
+#include "cam_vfe175.h"
+#include "cam_vfe175_130.h"
+#include "cam_vfe480.h"
+#include "cam_vfe570.h"
+#include "cam_vfe580.h"
+#include "cam_vfe680.h"
+#include "cam_vfe680_110.h"
+#include "cam_vfe780.h"
+#include "cam_vfe860.h"
+#include "cam_vfe880.h"
+#include "cam_tfe980.h"
+#include "cam_vfe690.h"
+#include "cam_vfe692.h"
+#include "cam_vfe_lite17x.h"
+#include "cam_vfe_lite48x.h"
+#include "cam_vfe_lite68x.h"
+#include "cam_vfe_lite69x.h"
+#include "cam_vfe_lite78x.h"
+#include "cam_vfe_lite86x.h"
+#include "cam_vfe_lite88x.h"
+#include "cam_vfe_lite98x.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_dev.h"
+#include "camera_main.h"
+
+static const struct of_device_id cam_vfe_dt_match[] = {
+	{
+		.compatible = "qcom,vfe170",
+		.data = &cam_vfe170_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe170_150",
+		.data = &cam_vfe170_150_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe175",
+		.data = &cam_vfe175_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe175_130",
+		.data = &cam_vfe175_130_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe480",
+		.data = &cam_vfe480_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe570",
+		.data = &cam_vfe570_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe580",
+		.data = &cam_vfe580_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe680",
+		.data = &cam_vfe680_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe690",
+		.data = &cam_vfe690_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe692",
+		.data = &cam_vfe692_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe680_110",
+		.data = &cam_vfe680_110_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe780",
+		.data = &cam_vfe780_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe860",
+		.data = &cam_vfe860_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe880",
+		.data = &cam_vfe880_hw_info,
+	},
+	{
+		.compatible = "qcom,tfe980",
+		.data  = &cam_tfe980_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite170",
+		.data = &cam_vfe_lite17x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite175",
+		.data = &cam_vfe_lite17x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite480",
+		.data = &cam_vfe_lite48x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite570",
+		.data = &cam_vfe_lite48x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite580",
+		.data = &cam_vfe_lite48x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite680",
+		.data = &cam_vfe_lite68x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite690",
+		.data = &cam_vfe_lite69x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite692",
+		.data = &cam_vfe_lite69x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite680_110",
+		.data = &cam_vfe_lite68x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite780",
+		.data = &cam_vfe_lite78x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite860",
+		.data = &cam_vfe_lite86x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite880",
+		.data = &cam_vfe_lite88x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite980",
+		.data = &cam_vfe_lite98x_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_vfe_dt_match);
+
+struct platform_driver cam_vfe_driver = {
+	.probe = cam_vfe_probe,
+	.remove = cam_vfe_remove,
+	.driver = {
+		.name = "cam_vfe",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_vfe_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_vfe_init_module(void)
+{
+	return platform_driver_register(&cam_vfe_driver);
+}
+
+
+void cam_vfe_exit_module(void)
+{
+	platform_driver_unregister(&cam_vfe_driver);
+}
+
+MODULE_DESCRIPTION("CAM VFE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_H_
+#define _CAM_VFE_H_
+
+/**
+ * @brief : API to register VFE hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_vfe_init_module(void);
+
+/**
+ * @brief : API to remove VFE  Hw from platform framework.
+ */
+void cam_vfe_exit_module(void);
+
+#endif /* _CAM_VFE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe170.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe170.h
@@ -0,0 +1,894 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE170_H_
+#define _CAM_VFE170_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe170_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe170_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe170_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000058,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_vfe_camif_ver2_reg vfe170_camif_reg = {
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+};
+
+static struct cam_vfe_camif_reg_data vfe_170_camif_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0x0FFF7E80,
+	.enable_diagnostic_hw            = 0x1,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_170_reg = {
+	.reset    = 0x0000001C,
+	.cgc_ovd  = 0x0000002C,
+	.enable   = 0x00000040,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl stats_170_reg = {
+	.reset    = 0x00000020,
+	.cgc_ovd  = 0x00000030,
+	.enable   = 0x00000044,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl color_170_reg = {
+	.reset    = 0x00000024,
+	.cgc_ovd  = 0x00000034,
+	.enable   = 0x00000048,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl zoom_170_reg = {
+	.reset    = 0x00000028,
+	.cgc_ovd  = 0x00000038,
+	.enable   = 0x0000004C,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe170_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		&lens_170_reg,
+		&stats_170_reg,
+		&color_170_reg,
+		&zoom_170_reg,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000050,
+	.three_D_cfg              = 0x00000054,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe170_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+struct cam_vfe_top_dump_data vfe170_dump_data = {
+	.num_reg_dump_entries  =  2,
+	.num_lut_dump_entries  =  1,
+	.dmi_cfg               =  0xc24,
+	.dmi_addr              =  0xc28,
+	.dmi_data_path_hi      =  0xc2C,
+	.dmi_data_path_lo      =  0xc30,
+	.reg_entry = {
+		{
+			.reg_dump_start = 0x0,
+			.reg_dump_end   = 0x1164,
+		},
+		{
+			.reg_dump_start = 0x2000,
+			.reg_dump_end   = 0x397C,
+		},
+	},
+	.lut_entry = {
+		{
+			.lut_word_size = 64,
+			.lut_bank_sel  = 0x40,
+			.lut_addr_size = 180,
+		},
+	},
+};
+
+static struct cam_vfe_rdi_overflow_status vfe170_rdi_irq_status = {
+	.rdi0_overflow_mask = 0x8,
+	.rdi1_overflow_mask = 0x10,
+	.rdi2_overflow_mask = 0x18,
+	.rdi3_overflow_mask = 0x20,
+	.rdi_overflow_mask  = 0x3c,
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe170_top_hw_info = {
+	.common_reg = &vfe170_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe170_top_common_reg,
+		.camif_reg      = &vfe170_camif_reg,
+		.reg_data       = &vfe_170_camif_reg_data,
+		},
+	.camif_lite_hw_info = {
+		.common_reg     = NULL,
+		.camif_lite_reg = NULL,
+		.reg_data       = NULL,
+		},
+	.rdi_hw_info = {
+		.common_reg      = &vfe170_top_common_reg,
+		.rdi_reg         = &vfe170_rdi_reg,
+		.rdi_irq_status  = &vfe170_rdi_irq_status,
+		.reg_data = {
+			&vfe_170_rdi_0_data,
+			&vfe_170_rdi_1_data,
+			&vfe_170_rdi_2_data,
+			NULL,
+			},
+		},
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_2_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.dump_data = &vfe170_dump_data,
+};
+
+static struct cam_irq_register_set vfe170_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_client ubwc_regs_client_3 = {
+	.tile_cfg         = 0x0000252C,
+	.h_init           = 0x00002530,
+	.v_init           = 0x00002534,
+	.meta_addr        = 0x00002538,
+	.meta_offset      = 0x0000253C,
+	.meta_stride      = 0x00002540,
+	.mode_cfg_0       = 0x00002544,
+	.bw_limit         = 0x000025A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_client ubwc_regs_client_4 = {
+	.tile_cfg         = 0x0000262C,
+	.h_init           = 0x00002630,
+	.v_init           = 0x00002634,
+	.meta_addr        = 0x00002638,
+	.meta_offset      = 0x0000263C,
+	.meta_stride      = 0x00002640,
+	.mode_cfg_0       = 0x00002644,
+	.bw_limit         = 0x000026A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe170_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers         = 3,
+			.irq_reg_set           = vfe170_bus_irq_reg,
+			.global_irq_cmd_offset = 0x00002068,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 20,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                = &ubwc_regs_client_3,
+		},
+		/* BUS Client 4 */
+		{
+			.status0                  = 0x00002600,
+			.status1                  = 0x00002604,
+			.cfg                      = 0x00002608,
+			.header_addr              = 0x0000260C,
+			.header_cfg               = 0x00002610,
+			.image_addr               = 0x00002614,
+			.image_addr_offset        = 0x00002618,
+			.buffer_width_cfg         = 0x0000261C,
+			.buffer_height_cfg        = 0x00002620,
+			.packer_cfg               = 0x00002624,
+			.stride                   = 0x00002628,
+			.irq_subsample_period     = 0x00002648,
+			.irq_subsample_pattern    = 0x0000264C,
+			.framedrop_period         = 0x00002650,
+			.framedrop_pattern        = 0x00002654,
+			.frame_inc                = 0x00002658,
+			.burst_limit              = 0x0000265C,
+			.ubwc_regs                = &ubwc_regs_client_4,
+		},
+		/* BUS Client 5 */
+		{
+			.status0                  = 0x00002700,
+			.status1                  = 0x00002704,
+			.cfg                      = 0x00002708,
+			.header_addr              = 0x0000270C,
+			.header_cfg               = 0x00002710,
+			.image_addr               = 0x00002714,
+			.image_addr_offset        = 0x00002718,
+			.buffer_width_cfg         = 0x0000271C,
+			.buffer_height_cfg        = 0x00002720,
+			.packer_cfg               = 0x00002724,
+			.stride                   = 0x00002728,
+			.irq_subsample_period     = 0x00002748,
+			.irq_subsample_pattern    = 0x0000274C,
+			.framedrop_period         = 0x00002750,
+			.framedrop_pattern        = 0x00002754,
+			.frame_inc                = 0x00002758,
+			.burst_limit              = 0x0000275C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 */
+		{
+			.status0                  = 0x00002800,
+			.status1                  = 0x00002804,
+			.cfg                      = 0x00002808,
+			.header_addr              = 0x0000280C,
+			.header_cfg               = 0x00002810,
+			.image_addr               = 0x00002814,
+			.image_addr_offset        = 0x00002818,
+			.buffer_width_cfg         = 0x0000281C,
+			.buffer_height_cfg        = 0x00002820,
+			.packer_cfg               = 0x00002824,
+			.stride                   = 0x00002828,
+			.irq_subsample_period     = 0x00002848,
+			.irq_subsample_pattern    = 0x0000284C,
+			.framedrop_period         = 0x00002850,
+			.framedrop_pattern        = 0x00002854,
+			.frame_inc                = 0x00002858,
+			.burst_limit              = 0x0000285C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 */
+		{
+			.status0                  = 0x00002900,
+			.status1                  = 0x00002904,
+			.cfg                      = 0x00002908,
+			.header_addr              = 0x0000290C,
+			.header_cfg               = 0x00002910,
+			.image_addr               = 0x00002914,
+			.image_addr_offset        = 0x00002918,
+			.buffer_width_cfg         = 0x0000291C,
+			.buffer_height_cfg        = 0x00002920,
+			.packer_cfg               = 0x00002924,
+			.stride                   = 0x00002928,
+			.irq_subsample_period     = 0x00002948,
+			.irq_subsample_pattern    = 0x0000294C,
+			.framedrop_period         = 0x00002950,
+			.framedrop_pattern        = 0x00002954,
+			.frame_inc                = 0x00002958,
+			.burst_limit              = 0x0000295C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 */
+		{
+			.status0                  = 0x00002A00,
+			.status1                  = 0x00002A04,
+			.cfg                      = 0x00002A08,
+			.header_addr              = 0x00002A0C,
+			.header_cfg               = 0x00002A10,
+			.image_addr               = 0x00002A14,
+			.image_addr_offset        = 0x00002A18,
+			.buffer_width_cfg         = 0x00002A1C,
+			.buffer_height_cfg        = 0x00002A20,
+			.packer_cfg               = 0x00002A24,
+			.stride                   = 0x00002A28,
+			.irq_subsample_period     = 0x00002A48,
+			.irq_subsample_pattern    = 0x00002A4C,
+			.framedrop_period         = 0x00002A50,
+			.framedrop_pattern        = 0x00002A54,
+			.frame_inc                = 0x00002A58,
+			.burst_limit              = 0x00002A5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 */
+		{
+			.status0                  = 0x00002B00,
+			.status1                  = 0x00002B04,
+			.cfg                      = 0x00002B08,
+			.header_addr              = 0x00002B0C,
+			.header_cfg               = 0x00002B10,
+			.image_addr               = 0x00002B14,
+			.image_addr_offset        = 0x00002B18,
+			.buffer_width_cfg         = 0x00002B1C,
+			.buffer_height_cfg        = 0x00002B20,
+			.packer_cfg               = 0x00002B24,
+			.stride                   = 0x00002B28,
+			.irq_subsample_period     = 0x00002B48,
+			.irq_subsample_pattern    = 0x00002B4C,
+			.framedrop_period         = 0x00002B50,
+			.framedrop_pattern        = 0x00002B54,
+			.frame_inc                = 0x00002B58,
+			.burst_limit              = 0x00002B5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 */
+		{
+			.status0                  = 0x00002C00,
+			.status1                  = 0x00002C04,
+			.cfg                      = 0x00002C08,
+			.header_addr              = 0x00002C0C,
+			.header_cfg               = 0x00002C10,
+			.image_addr               = 0x00002C14,
+			.image_addr_offset        = 0x00002C18,
+			.buffer_width_cfg         = 0x00002C1C,
+			.buffer_height_cfg        = 0x00002C20,
+			.packer_cfg               = 0x00002C24,
+			.stride                   = 0x00002C28,
+			.irq_subsample_period     = 0x00002C48,
+			.irq_subsample_pattern    = 0x00002C4C,
+			.framedrop_period         = 0x00002C50,
+			.framedrop_pattern        = 0x00002C54,
+			.frame_inc                = 0x00002C58,
+			.burst_limit              = 0x00002C5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 */
+		{
+			.status0                  = 0x00002D00,
+			.status1                  = 0x00002D04,
+			.cfg                      = 0x00002D08,
+			.header_addr              = 0x00002D0C,
+			.header_cfg               = 0x00002D10,
+			.image_addr               = 0x00002D14,
+			.image_addr_offset        = 0x00002D18,
+			.buffer_width_cfg         = 0x00002D1C,
+			.buffer_height_cfg        = 0x00002D20,
+			.packer_cfg               = 0x00002D24,
+			.stride                   = 0x00002D28,
+			.irq_subsample_period     = 0x00002D48,
+			.irq_subsample_pattern    = 0x00002D4C,
+			.framedrop_period         = 0x00002D50,
+			.framedrop_pattern        = 0x00002D54,
+			.frame_inc                = 0x00002D58,
+			.burst_limit              = 0x00002D5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 */
+		{
+			.status0                  = 0x00002E00,
+			.status1                  = 0x00002E04,
+			.cfg                      = 0x00002E08,
+			.header_addr              = 0x00002E0C,
+			.header_cfg               = 0x00002E10,
+			.image_addr               = 0x00002E14,
+			.image_addr_offset        = 0x00002E18,
+			.buffer_width_cfg         = 0x00002E1C,
+			.buffer_height_cfg        = 0x00002E20,
+			.packer_cfg               = 0x00002E24,
+			.stride                   = 0x00002E28,
+			.irq_subsample_period     = 0x00002E48,
+			.irq_subsample_pattern    = 0x00002E4C,
+			.framedrop_period         = 0x00002E50,
+			.framedrop_pattern        = 0x00002E54,
+			.frame_inc                = 0x00002E58,
+			.burst_limit              = 0x00002E5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 */
+		{
+			.status0                  = 0x00002F00,
+			.status1                  = 0x00002F04,
+			.cfg                      = 0x00002F08,
+			.header_addr              = 0x00002F0C,
+			.header_cfg               = 0x00002F10,
+			.image_addr               = 0x00002F14,
+			.image_addr_offset        = 0x00002F18,
+			.buffer_width_cfg         = 0x00002F1C,
+			.buffer_height_cfg        = 0x00002F20,
+			.packer_cfg               = 0x00002F24,
+			.stride                   = 0x00002F28,
+			.irq_subsample_period     = 0x00002F48,
+			.irq_subsample_pattern    = 0x00002F4C,
+			.framedrop_period         = 0x00002F50,
+			.framedrop_pattern        = 0x00002F54,
+			.frame_inc                = 0x00002F58,
+			.burst_limit              = 0x00002F5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 */
+		{
+			.status0                  = 0x00003000,
+			.status1                  = 0x00003004,
+			.cfg                      = 0x00003008,
+			.header_addr              = 0x0000300C,
+			.header_cfg               = 0x00003010,
+			.image_addr               = 0x00003014,
+			.image_addr_offset        = 0x00003018,
+			.buffer_width_cfg         = 0x0000301C,
+			.buffer_height_cfg        = 0x00003020,
+			.packer_cfg               = 0x00003024,
+			.stride                   = 0x00003028,
+			.irq_subsample_period     = 0x00003048,
+			.irq_subsample_pattern    = 0x0000304C,
+			.framedrop_period         = 0x00003050,
+			.framedrop_pattern        = 0x00003054,
+			.frame_inc                = 0x00003058,
+			.burst_limit              = 0x0000305C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 */
+		{
+			.status0                  = 0x00003100,
+			.status1                  = 0x00003104,
+			.cfg                      = 0x00003108,
+			.header_addr              = 0x0000310C,
+			.header_cfg               = 0x00003110,
+			.image_addr               = 0x00003114,
+			.image_addr_offset        = 0x00003118,
+			.buffer_width_cfg         = 0x0000311C,
+			.buffer_height_cfg        = 0x00003120,
+			.packer_cfg               = 0x00003124,
+			.stride                   = 0x00003128,
+			.irq_subsample_period     = 0x00003148,
+			.irq_subsample_pattern    = 0x0000314C,
+			.framedrop_period         = 0x00003150,
+			.framedrop_pattern        = 0x00003154,
+			.frame_inc                = 0x00003158,
+			.burst_limit              = 0x0000315C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 */
+		{
+			.status0                  = 0x00003200,
+			.status1                  = 0x00003204,
+			.cfg                      = 0x00003208,
+			.header_addr              = 0x0000320C,
+			.header_cfg               = 0x00003210,
+			.image_addr               = 0x00003214,
+			.image_addr_offset        = 0x00003218,
+			.buffer_width_cfg         = 0x0000321C,
+			.buffer_height_cfg        = 0x00003220,
+			.packer_cfg               = 0x00003224,
+			.stride                   = 0x00003228,
+			.irq_subsample_period     = 0x00003248,
+			.irq_subsample_pattern    = 0x0000324C,
+			.framedrop_period         = 0x00003250,
+			.framedrop_pattern        = 0x00003254,
+			.frame_inc                = 0x00003258,
+			.burst_limit              = 0x0000325C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 */
+		{
+			.status0                  = 0x00003300,
+			.status1                  = 0x00003304,
+			.cfg                      = 0x00003308,
+			.header_addr              = 0x0000330C,
+			.header_cfg               = 0x00003310,
+			.image_addr               = 0x00003314,
+			.image_addr_offset        = 0x00003318,
+			.buffer_width_cfg         = 0x0000331C,
+			.buffer_height_cfg        = 0x00003320,
+			.packer_cfg               = 0x00003324,
+			.stride                   = 0x00003328,
+			.irq_subsample_period     = 0x00003348,
+			.irq_subsample_pattern    = 0x0000334C,
+			.framedrop_period         = 0x00003350,
+			.framedrop_pattern        = 0x00003354,
+			.frame_inc                = 0x00003358,
+			.burst_limit              = 0x0000335C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 */
+		{
+			.status0                  = 0x00003400,
+			.status1                  = 0x00003404,
+			.cfg                      = 0x00003408,
+			.header_addr              = 0x0000340C,
+			.header_cfg               = 0x00003410,
+			.image_addr               = 0x00003414,
+			.image_addr_offset        = 0x00003418,
+			.buffer_width_cfg         = 0x0000341C,
+			.buffer_height_cfg        = 0x00003420,
+			.packer_cfg               = 0x00003424,
+			.stride                   = 0x00003428,
+			.irq_subsample_period     = 0x00003448,
+			.irq_subsample_pattern    = 0x0000344C,
+			.framedrop_period         = 0x00003450,
+			.framedrop_pattern        = 0x00003454,
+			.frame_inc                = 0x00003458,
+			.burst_limit              = 0x0000345C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 */
+		{
+			.status0                  = 0x00003500,
+			.status1                  = 0x00003504,
+			.cfg                      = 0x00003508,
+			.header_addr              = 0x0000350C,
+			.header_cfg               = 0x00003510,
+			.image_addr               = 0x00003514,
+			.image_addr_offset        = 0x00003518,
+			.buffer_width_cfg         = 0x0000351C,
+			.buffer_height_cfg        = 0x00003520,
+			.packer_cfg               = 0x00003524,
+			.stride                   = 0x00003528,
+			.irq_subsample_period     = 0x00003548,
+			.irq_subsample_pattern    = 0x0000354C,
+			.framedrop_period         = 0x00003550,
+			.framedrop_pattern        = 0x00003554,
+			.frame_inc                = 0x00003558,
+			.burst_limit              = 0x0000355C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 18,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 19,
+};
+
+static struct cam_vfe_irq_hw_info vfe170_irq_hw_info = {
+	.reset_mask    = BIT(31),
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_INT_CSID,
+	.top_irq_reg       = &vfe170_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe170_hw_info = {
+	.irq_hw_info                   = &vfe170_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe170_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe170_top_hw_info,
+
+	.camif_version                 = CAM_VFE_CAMIF_VER_2_0,
+	.camif_reg                     = &vfe170_camif_reg,
+
+	.camif_lite_version            = 0,
+	.camif_lite_reg                = NULL,
+
+};
+
+#endif /* _CAM_VFE170_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe170_150.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe170_150.h
@@ -0,0 +1,862 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE170_150_H_
+#define _CAM_VFE170_150_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe170_150_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe170_150_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe170_150_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000058,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_vfe_camif_ver2_reg vfe170_150_camif_reg = {
+	.dual_vfe_sync            = 0x00000100,
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+};
+
+static struct cam_vfe_camif_reg_data vfe_170_150_camif_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0x0FFF7E80,
+	.enable_diagnostic_hw            = 0x1,
+	.dual_vfe_sync_mask              = 0x3,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_170_150_reg = {
+	.reset    = 0x0000001C,
+	.cgc_ovd  = 0x0000002C,
+	.enable   = 0x00000040,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl stats_170_150_reg = {
+	.reset    = 0x00000020,
+	.cgc_ovd  = 0x00000030,
+	.enable   = 0x00000044,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl color_170_150_reg = {
+	.reset    = 0x00000024,
+	.cgc_ovd  = 0x00000034,
+	.enable   = 0x00000048,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl zoom_170_150_reg = {
+	.reset    = 0x00000028,
+	.cgc_ovd  = 0x00000038,
+	.enable   = 0x0000004C,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe170_150_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		&lens_170_150_reg,
+		&stats_170_150_reg,
+		&color_170_150_reg,
+		&zoom_170_150_reg,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000050,
+	.three_D_cfg              = 0x00000054,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe170_150_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_150_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_150_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_150_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe170_150_top_hw_info = {
+	.common_reg = &vfe170_150_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe170_150_top_common_reg,
+		.camif_reg      = &vfe170_150_camif_reg,
+		.reg_data       = &vfe_170_150_camif_reg_data,
+		},
+	.camif_lite_hw_info = {
+		.common_reg     = NULL,
+		.camif_lite_reg = NULL,
+		.reg_data       = NULL,
+		},
+	.rdi_hw_info = {
+		.common_reg = &vfe170_150_top_common_reg,
+		.rdi_reg    = &vfe170_150_rdi_reg,
+		.reg_data = {
+			&vfe_170_150_rdi_0_data,
+			&vfe_170_150_rdi_1_data,
+			&vfe_170_150_rdi_2_data,
+			NULL,
+			},
+		},
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_2_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set vfe170_150_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_client
+	vfe_170_150_ubwc_regs_client_3 = {
+		.tile_cfg         = 0x0000252C,
+		.h_init           = 0x00002530,
+		.v_init           = 0x00002534,
+		.meta_addr        = 0x00002538,
+		.meta_offset      = 0x0000253C,
+		.meta_stride      = 0x00002540,
+		.mode_cfg_0       = 0x00002544,
+		.bw_limit         = 0x000025A0,
+		.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_client
+	vfe_170_150_ubwc_regs_client_4 = {
+		.tile_cfg         = 0x0000262C,
+		.h_init           = 0x00002630,
+		.v_init           = 0x00002634,
+		.meta_addr        = 0x00002638,
+		.meta_offset      = 0x0000263C,
+		.meta_stride      = 0x00002640,
+		.mode_cfg_0       = 0x00002644,
+		.bw_limit         = 0x000026A0,
+		.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe170_150_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers         = 3,
+			.irq_reg_set           = vfe170_150_bus_irq_reg,
+			.global_irq_cmd_offset = 0x00002068,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
+	},
+	.num_client = 20,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                =
+				&vfe_170_150_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 */
+		{
+			.status0                  = 0x00002600,
+			.status1                  = 0x00002604,
+			.cfg                      = 0x00002608,
+			.header_addr              = 0x0000260C,
+			.header_cfg               = 0x00002610,
+			.image_addr               = 0x00002614,
+			.image_addr_offset        = 0x00002618,
+			.buffer_width_cfg         = 0x0000261C,
+			.buffer_height_cfg        = 0x00002620,
+			.packer_cfg               = 0x00002624,
+			.stride                   = 0x00002628,
+			.irq_subsample_period     = 0x00002648,
+			.irq_subsample_pattern    = 0x0000264C,
+			.framedrop_period         = 0x00002650,
+			.framedrop_pattern        = 0x00002654,
+			.frame_inc                = 0x00002658,
+			.burst_limit              = 0x0000265C,
+			.ubwc_regs                =
+				&vfe_170_150_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 */
+		{
+			.status0                  = 0x00002700,
+			.status1                  = 0x00002704,
+			.cfg                      = 0x00002708,
+			.header_addr              = 0x0000270C,
+			.header_cfg               = 0x00002710,
+			.image_addr               = 0x00002714,
+			.image_addr_offset        = 0x00002718,
+			.buffer_width_cfg         = 0x0000271C,
+			.buffer_height_cfg        = 0x00002720,
+			.packer_cfg               = 0x00002724,
+			.stride                   = 0x00002728,
+			.irq_subsample_period     = 0x00002748,
+			.irq_subsample_pattern    = 0x0000274C,
+			.framedrop_period         = 0x00002750,
+			.framedrop_pattern        = 0x00002754,
+			.frame_inc                = 0x00002758,
+			.burst_limit              = 0x0000275C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 */
+		{
+			.status0                  = 0x00002800,
+			.status1                  = 0x00002804,
+			.cfg                      = 0x00002808,
+			.header_addr              = 0x0000280C,
+			.header_cfg               = 0x00002810,
+			.image_addr               = 0x00002814,
+			.image_addr_offset        = 0x00002818,
+			.buffer_width_cfg         = 0x0000281C,
+			.buffer_height_cfg        = 0x00002820,
+			.packer_cfg               = 0x00002824,
+			.stride                   = 0x00002828,
+			.irq_subsample_period     = 0x00002848,
+			.irq_subsample_pattern    = 0x0000284C,
+			.framedrop_period         = 0x00002850,
+			.framedrop_pattern        = 0x00002854,
+			.frame_inc                = 0x00002858,
+			.burst_limit              = 0x0000285C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 */
+		{
+			.status0                  = 0x00002900,
+			.status1                  = 0x00002904,
+			.cfg                      = 0x00002908,
+			.header_addr              = 0x0000290C,
+			.header_cfg               = 0x00002910,
+			.image_addr               = 0x00002914,
+			.image_addr_offset        = 0x00002918,
+			.buffer_width_cfg         = 0x0000291C,
+			.buffer_height_cfg        = 0x00002920,
+			.packer_cfg               = 0x00002924,
+			.stride                   = 0x00002928,
+			.irq_subsample_period     = 0x00002948,
+			.irq_subsample_pattern    = 0x0000294C,
+			.framedrop_period         = 0x00002950,
+			.framedrop_pattern        = 0x00002954,
+			.frame_inc                = 0x00002958,
+			.burst_limit              = 0x0000295C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 */
+		{
+			.status0                  = 0x00002A00,
+			.status1                  = 0x00002A04,
+			.cfg                      = 0x00002A08,
+			.header_addr              = 0x00002A0C,
+			.header_cfg               = 0x00002A10,
+			.image_addr               = 0x00002A14,
+			.image_addr_offset        = 0x00002A18,
+			.buffer_width_cfg         = 0x00002A1C,
+			.buffer_height_cfg        = 0x00002A20,
+			.packer_cfg               = 0x00002A24,
+			.stride                   = 0x00002A28,
+			.irq_subsample_period     = 0x00002A48,
+			.irq_subsample_pattern    = 0x00002A4C,
+			.framedrop_period         = 0x00002A50,
+			.framedrop_pattern        = 0x00002A54,
+			.frame_inc                = 0x00002A58,
+			.burst_limit              = 0x00002A5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 */
+		{
+			.status0                  = 0x00002B00,
+			.status1                  = 0x00002B04,
+			.cfg                      = 0x00002B08,
+			.header_addr              = 0x00002B0C,
+			.header_cfg               = 0x00002B10,
+			.image_addr               = 0x00002B14,
+			.image_addr_offset        = 0x00002B18,
+			.buffer_width_cfg         = 0x00002B1C,
+			.buffer_height_cfg        = 0x00002B20,
+			.packer_cfg               = 0x00002B24,
+			.stride                   = 0x00002B28,
+			.irq_subsample_period     = 0x00002B48,
+			.irq_subsample_pattern    = 0x00002B4C,
+			.framedrop_period         = 0x00002B50,
+			.framedrop_pattern        = 0x00002B54,
+			.frame_inc                = 0x00002B58,
+			.burst_limit              = 0x00002B5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 */
+		{
+			.status0                  = 0x00002C00,
+			.status1                  = 0x00002C04,
+			.cfg                      = 0x00002C08,
+			.header_addr              = 0x00002C0C,
+			.header_cfg               = 0x00002C10,
+			.image_addr               = 0x00002C14,
+			.image_addr_offset        = 0x00002C18,
+			.buffer_width_cfg         = 0x00002C1C,
+			.buffer_height_cfg        = 0x00002C20,
+			.packer_cfg               = 0x00002C24,
+			.stride                   = 0x00002C28,
+			.irq_subsample_period     = 0x00002C48,
+			.irq_subsample_pattern    = 0x00002C4C,
+			.framedrop_period         = 0x00002C50,
+			.framedrop_pattern        = 0x00002C54,
+			.frame_inc                = 0x00002C58,
+			.burst_limit              = 0x00002C5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 */
+		{
+			.status0                  = 0x00002D00,
+			.status1                  = 0x00002D04,
+			.cfg                      = 0x00002D08,
+			.header_addr              = 0x00002D0C,
+			.header_cfg               = 0x00002D10,
+			.image_addr               = 0x00002D14,
+			.image_addr_offset        = 0x00002D18,
+			.buffer_width_cfg         = 0x00002D1C,
+			.buffer_height_cfg        = 0x00002D20,
+			.packer_cfg               = 0x00002D24,
+			.stride                   = 0x00002D28,
+			.irq_subsample_period     = 0x00002D48,
+			.irq_subsample_pattern    = 0x00002D4C,
+			.framedrop_period         = 0x00002D50,
+			.framedrop_pattern        = 0x00002D54,
+			.frame_inc                = 0x00002D58,
+			.burst_limit              = 0x00002D5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 */
+		{
+			.status0                  = 0x00002E00,
+			.status1                  = 0x00002E04,
+			.cfg                      = 0x00002E08,
+			.header_addr              = 0x00002E0C,
+			.header_cfg               = 0x00002E10,
+			.image_addr               = 0x00002E14,
+			.image_addr_offset        = 0x00002E18,
+			.buffer_width_cfg         = 0x00002E1C,
+			.buffer_height_cfg        = 0x00002E20,
+			.packer_cfg               = 0x00002E24,
+			.stride                   = 0x00002E28,
+			.irq_subsample_period     = 0x00002E48,
+			.irq_subsample_pattern    = 0x00002E4C,
+			.framedrop_period         = 0x00002E50,
+			.framedrop_pattern        = 0x00002E54,
+			.frame_inc                = 0x00002E58,
+			.burst_limit              = 0x00002E5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 */
+		{
+			.status0                  = 0x00002F00,
+			.status1                  = 0x00002F04,
+			.cfg                      = 0x00002F08,
+			.header_addr              = 0x00002F0C,
+			.header_cfg               = 0x00002F10,
+			.image_addr               = 0x00002F14,
+			.image_addr_offset        = 0x00002F18,
+			.buffer_width_cfg         = 0x00002F1C,
+			.buffer_height_cfg        = 0x00002F20,
+			.packer_cfg               = 0x00002F24,
+			.stride                   = 0x00002F28,
+			.irq_subsample_period     = 0x00002F48,
+			.irq_subsample_pattern    = 0x00002F4C,
+			.framedrop_period         = 0x00002F50,
+			.framedrop_pattern        = 0x00002F54,
+			.frame_inc                = 0x00002F58,
+			.burst_limit              = 0x00002F5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 */
+		{
+			.status0                  = 0x00003000,
+			.status1                  = 0x00003004,
+			.cfg                      = 0x00003008,
+			.header_addr              = 0x0000300C,
+			.header_cfg               = 0x00003010,
+			.image_addr               = 0x00003014,
+			.image_addr_offset        = 0x00003018,
+			.buffer_width_cfg         = 0x0000301C,
+			.buffer_height_cfg        = 0x00003020,
+			.packer_cfg               = 0x00003024,
+			.stride                   = 0x00003028,
+			.irq_subsample_period     = 0x00003048,
+			.irq_subsample_pattern    = 0x0000304C,
+			.framedrop_period         = 0x00003050,
+			.framedrop_pattern        = 0x00003054,
+			.frame_inc                = 0x00003058,
+			.burst_limit              = 0x0000305C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 */
+		{
+			.status0                  = 0x00003100,
+			.status1                  = 0x00003104,
+			.cfg                      = 0x00003108,
+			.header_addr              = 0x0000310C,
+			.header_cfg               = 0x00003110,
+			.image_addr               = 0x00003114,
+			.image_addr_offset        = 0x00003118,
+			.buffer_width_cfg         = 0x0000311C,
+			.buffer_height_cfg        = 0x00003120,
+			.packer_cfg               = 0x00003124,
+			.stride                   = 0x00003128,
+			.irq_subsample_period     = 0x00003148,
+			.irq_subsample_pattern    = 0x0000314C,
+			.framedrop_period         = 0x00003150,
+			.framedrop_pattern        = 0x00003154,
+			.frame_inc                = 0x00003158,
+			.burst_limit              = 0x0000315C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 */
+		{
+			.status0                  = 0x00003200,
+			.status1                  = 0x00003204,
+			.cfg                      = 0x00003208,
+			.header_addr              = 0x0000320C,
+			.header_cfg               = 0x00003210,
+			.image_addr               = 0x00003214,
+			.image_addr_offset        = 0x00003218,
+			.buffer_width_cfg         = 0x0000321C,
+			.buffer_height_cfg        = 0x00003220,
+			.packer_cfg               = 0x00003224,
+			.stride                   = 0x00003228,
+			.irq_subsample_period     = 0x00003248,
+			.irq_subsample_pattern    = 0x0000324C,
+			.framedrop_period         = 0x00003250,
+			.framedrop_pattern        = 0x00003254,
+			.frame_inc                = 0x00003258,
+			.burst_limit              = 0x0000325C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 */
+		{
+			.status0                  = 0x00003300,
+			.status1                  = 0x00003304,
+			.cfg                      = 0x00003308,
+			.header_addr              = 0x0000330C,
+			.header_cfg               = 0x00003310,
+			.image_addr               = 0x00003314,
+			.image_addr_offset        = 0x00003318,
+			.buffer_width_cfg         = 0x0000331C,
+			.buffer_height_cfg        = 0x00003320,
+			.packer_cfg               = 0x00003324,
+			.stride                   = 0x00003328,
+			.irq_subsample_period     = 0x00003348,
+			.irq_subsample_pattern    = 0x0000334C,
+			.framedrop_period         = 0x00003350,
+			.framedrop_pattern        = 0x00003354,
+			.frame_inc                = 0x00003358,
+			.burst_limit              = 0x0000335C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 */
+		{
+			.status0                  = 0x00003400,
+			.status1                  = 0x00003404,
+			.cfg                      = 0x00003408,
+			.header_addr              = 0x0000340C,
+			.header_cfg               = 0x00003410,
+			.image_addr               = 0x00003414,
+			.image_addr_offset        = 0x00003418,
+			.buffer_width_cfg         = 0x0000341C,
+			.buffer_height_cfg        = 0x00003420,
+			.packer_cfg               = 0x00003424,
+			.stride                   = 0x00003428,
+			.irq_subsample_period     = 0x00003448,
+			.irq_subsample_pattern    = 0x0000344C,
+			.framedrop_period         = 0x00003450,
+			.framedrop_pattern        = 0x00003454,
+			.frame_inc                = 0x00003458,
+			.burst_limit              = 0x0000345C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 */
+		{
+			.status0                  = 0x00003500,
+			.status1                  = 0x00003504,
+			.cfg                      = 0x00003508,
+			.header_addr              = 0x0000350C,
+			.header_cfg               = 0x00003510,
+			.image_addr               = 0x00003514,
+			.image_addr_offset        = 0x00003518,
+			.buffer_width_cfg         = 0x0000351C,
+			.buffer_height_cfg        = 0x00003520,
+			.packer_cfg               = 0x00003524,
+			.stride                   = 0x00003528,
+			.irq_subsample_period     = 0x00003548,
+			.irq_subsample_pattern    = 0x0000354C,
+			.framedrop_period         = 0x00003550,
+			.framedrop_pattern        = 0x00003554,
+			.frame_inc                = 0x00003558,
+			.burst_limit              = 0x0000355C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 18,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 19,
+};
+
+static struct cam_vfe_irq_hw_info vfe170_150_irq_hw_info = {
+	.reset_mask    = BIT(31),
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_INT_CSID,
+	.top_irq_reg   = &vfe170_150_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe170_150_hw_info = {
+	.irq_hw_info                  = &vfe170_150_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe170_150_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe170_150_top_hw_info,
+
+	.camif_version                 = CAM_VFE_CAMIF_VER_2_0,
+	.camif_reg                     = &vfe170_150_camif_reg,
+
+	.camif_lite_version            = 0,
+	.camif_lite_reg                = NULL,
+
+};
+
+#endif /* _CAM_vfe170_150_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175.h
@@ -0,0 +1,1057 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE175_H_
+#define _CAM_VFE175_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_camif_lite_ver2.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe175_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe175_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe175_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000058,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_vfe_camif_ver2_reg vfe175_camif_reg = {
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+};
+
+static struct cam_vfe_camif_reg_data vfe_175_camif_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0xEFFF7E80,
+	.subscribe_irq_mask0             = 0x00000017,
+	.subscribe_irq_mask1             = 0x00000000,
+	.enable_diagnostic_hw            = 0x1,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg vfe175_camif_lite_reg = {
+	.camif_lite_cmd                = 0x00000FC0,
+	.camif_lite_config             = 0x00000FC4,
+	.lite_skip_period              = 0x00000FC8,
+	.lite_irq_subsample_pattern    = 0x00000FCC,
+	.lite_epoch_irq                = 0x00000FD0,
+	.reg_update_cmd                = 0x000004AC,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg_data vfe175_camif_lite_reg_data = {
+	.dual_pd_reg_update_cmd_data     = 0x20,
+	.lite_epoch_line_cfg             = 0x00140014,
+	.lite_sof_irq_mask               = 0x00040000,
+	.lite_epoch0_irq_mask            = 0x00100000,
+	.dual_pd_reg_upd_irq_mask        = 0x04000000,
+	.lite_eof_irq_mask               = 0x00080000,
+	.lite_err_irq_mask0              = 0x00400000,
+	.lite_err_irq_mask1              = 0x00004100,
+	.lite_subscribe_irq_mask0        = 0x001C0000,
+	.lite_subscribe_irq_mask1        = 0x0,
+	.extern_reg_update_shift         = 4,
+	.dual_pd_path_sel_shift          = 24,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_175_reg = {
+	.reset    = 0x0000001C,
+	.cgc_ovd  = 0x0000002C,
+	.enable   = 0x00000040,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl stats_175_reg = {
+	.reset    = 0x00000020,
+	.cgc_ovd  = 0x00000030,
+	.enable   = 0x00000044,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl color_175_reg = {
+	.reset    = 0x00000024,
+	.cgc_ovd  = 0x00000034,
+	.enable   = 0x00000048,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl zoom_175_reg = {
+	.reset    = 0x00000028,
+	.cgc_ovd  = 0x00000038,
+	.enable   = 0x0000004C,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe175_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		&lens_175_reg,
+		&stats_175_reg,
+		&color_175_reg,
+		&zoom_175_reg,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000050,
+	.three_D_cfg              = 0x00000054,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe175_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_common_reg_data vfe175_rdi_reg_data = {
+	.subscribe_irq_mask0      = 0x780001E0,
+	.subscribe_irq_mask1      = 0x0,
+	.error_irq_mask0          = 0x0,
+	.error_irq_mask1          = 0x3C,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+struct cam_vfe_top_dump_data vfe175_dump_data = {
+	.num_reg_dump_entries  =  2,
+	.num_lut_dump_entries  =  1,
+	.dmi_cfg               =  0xc24,
+	.dmi_addr              =  0xc28,
+	.dmi_data_path_hi      =  0xc2C,
+	.dmi_data_path_lo      =  0xc30,
+	.reg_entry = {
+		{
+			.reg_dump_start = 0x0,
+			.reg_dump_end   = 0x1164,
+		},
+		{
+			.reg_dump_start = 0x2000,
+			.reg_dump_end   = 0x397C,
+		},
+	},
+	.lut_entry = {
+		{
+			.lut_word_size = 64,
+			.lut_bank_sel  = 0x40,
+			.lut_addr_size = 180,
+		},
+	},
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe175_top_hw_info = {
+	.common_reg = &vfe175_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe175_top_common_reg,
+		.camif_reg      = &vfe175_camif_reg,
+		.reg_data       = &vfe_175_camif_reg_data,
+		},
+	.camif_lite_hw_info = {
+		.common_reg     = &vfe175_top_common_reg,
+		.camif_lite_reg = &vfe175_camif_lite_reg,
+		.reg_data       = &vfe175_camif_lite_reg_data,
+		},
+	.rdi_hw_info = {
+		.common_reg      = &vfe175_top_common_reg,
+		.rdi_reg         = &vfe175_rdi_reg,
+		.common_reg_data = &vfe175_rdi_reg_data,
+		.reg_data = {
+			&vfe_175_rdi_0_data,
+			&vfe_175_rdi_1_data,
+			&vfe_175_rdi_2_data,
+			NULL,
+			},
+		},
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_2_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_CAMIF_LITE_VER_2_0,
+	},
+	.dump_data = &vfe175_dump_data,
+};
+
+static struct cam_irq_register_set vfe175_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_ubwc_regs_client_3 = {
+	.tile_cfg         = 0x0000252C,
+	.h_init           = 0x00002530,
+	.v_init           = 0x00002534,
+	.meta_addr        = 0x00002538,
+	.meta_offset      = 0x0000253C,
+	.meta_stride      = 0x00002540,
+	.mode_cfg_0       = 0x00002544,
+	.mode_cfg_1       = 0x000025A4,
+	.bw_limit         = 0x000025A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_ubwc_regs_client_4 = {
+	.tile_cfg         = 0x0000262C,
+	.h_init           = 0x00002630,
+	.v_init           = 0x00002634,
+	.meta_addr        = 0x00002638,
+	.meta_offset      = 0x0000263C,
+	.meta_stride      = 0x00002640,
+	.mode_cfg_0       = 0x00002644,
+	.mode_cfg_1       = 0x000026A4,
+	.bw_limit         = 0x000026A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_ubwc_regs_client_20 = {
+	.tile_cfg         = 0x0000362C,
+	.h_init           = 0x00003630,
+	.v_init           = 0x00003634,
+	.meta_addr        = 0x00003638,
+	.meta_offset      = 0x0000363C,
+	.meta_stride      = 0x00003640,
+	.mode_cfg_0       = 0x00003644,
+	.mode_cfg_1       = 0x000036A4,
+	.bw_limit         = 0x000036A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_ubwc_regs_client_21 = {
+	.tile_cfg         = 0x0000372C,
+	.h_init           = 0x00003730,
+	.v_init           = 0x00003734,
+	.meta_addr        = 0x00003738,
+	.meta_offset      = 0x0000373C,
+	.meta_stride      = 0x00003740,
+	.mode_cfg_0       = 0x00003744,
+	.mode_cfg_1       = 0x000037A4,
+	.bw_limit         = 0x000037A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe175_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers         = 3,
+			.irq_reg_set           = vfe175_bus_irq_reg,
+			.global_irq_cmd_offset = 0x00002068,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 24,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                = &vfe175_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 */
+		{
+			.status0                  = 0x00002600,
+			.status1                  = 0x00002604,
+			.cfg                      = 0x00002608,
+			.header_addr              = 0x0000260C,
+			.header_cfg               = 0x00002610,
+			.image_addr               = 0x00002614,
+			.image_addr_offset        = 0x00002618,
+			.buffer_width_cfg         = 0x0000261C,
+			.buffer_height_cfg        = 0x00002620,
+			.packer_cfg               = 0x00002624,
+			.stride                   = 0x00002628,
+			.irq_subsample_period     = 0x00002648,
+			.irq_subsample_pattern    = 0x0000264C,
+			.framedrop_period         = 0x00002650,
+			.framedrop_pattern        = 0x00002654,
+			.frame_inc                = 0x00002658,
+			.burst_limit              = 0x0000265C,
+			.ubwc_regs                = &vfe175_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 */
+		{
+			.status0                  = 0x00002700,
+			.status1                  = 0x00002704,
+			.cfg                      = 0x00002708,
+			.header_addr              = 0x0000270C,
+			.header_cfg               = 0x00002710,
+			.image_addr               = 0x00002714,
+			.image_addr_offset        = 0x00002718,
+			.buffer_width_cfg         = 0x0000271C,
+			.buffer_height_cfg        = 0x00002720,
+			.packer_cfg               = 0x00002724,
+			.stride                   = 0x00002728,
+			.irq_subsample_period     = 0x00002748,
+			.irq_subsample_pattern    = 0x0000274C,
+			.framedrop_period         = 0x00002750,
+			.framedrop_pattern        = 0x00002754,
+			.frame_inc                = 0x00002758,
+			.burst_limit              = 0x0000275C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 */
+		{
+			.status0                  = 0x00002800,
+			.status1                  = 0x00002804,
+			.cfg                      = 0x00002808,
+			.header_addr              = 0x0000280C,
+			.header_cfg               = 0x00002810,
+			.image_addr               = 0x00002814,
+			.image_addr_offset        = 0x00002818,
+			.buffer_width_cfg         = 0x0000281C,
+			.buffer_height_cfg        = 0x00002820,
+			.packer_cfg               = 0x00002824,
+			.stride                   = 0x00002828,
+			.irq_subsample_period     = 0x00002848,
+			.irq_subsample_pattern    = 0x0000284C,
+			.framedrop_period         = 0x00002850,
+			.framedrop_pattern        = 0x00002854,
+			.frame_inc                = 0x00002858,
+			.burst_limit              = 0x0000285C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 */
+		{
+			.status0                  = 0x00002900,
+			.status1                  = 0x00002904,
+			.cfg                      = 0x00002908,
+			.header_addr              = 0x0000290C,
+			.header_cfg               = 0x00002910,
+			.image_addr               = 0x00002914,
+			.image_addr_offset        = 0x00002918,
+			.buffer_width_cfg         = 0x0000291C,
+			.buffer_height_cfg        = 0x00002920,
+			.packer_cfg               = 0x00002924,
+			.stride                   = 0x00002928,
+			.irq_subsample_period     = 0x00002948,
+			.irq_subsample_pattern    = 0x0000294C,
+			.framedrop_period         = 0x00002950,
+			.framedrop_pattern        = 0x00002954,
+			.frame_inc                = 0x00002958,
+			.burst_limit              = 0x0000295C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 */
+		{
+			.status0                  = 0x00002A00,
+			.status1                  = 0x00002A04,
+			.cfg                      = 0x00002A08,
+			.header_addr              = 0x00002A0C,
+			.header_cfg               = 0x00002A10,
+			.image_addr               = 0x00002A14,
+			.image_addr_offset        = 0x00002A18,
+			.buffer_width_cfg         = 0x00002A1C,
+			.buffer_height_cfg        = 0x00002A20,
+			.packer_cfg               = 0x00002A24,
+			.stride                   = 0x00002A28,
+			.irq_subsample_period     = 0x00002A48,
+			.irq_subsample_pattern    = 0x00002A4C,
+			.framedrop_period         = 0x00002A50,
+			.framedrop_pattern        = 0x00002A54,
+			.frame_inc                = 0x00002A58,
+			.burst_limit              = 0x00002A5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 */
+		{
+			.status0                  = 0x00002B00,
+			.status1                  = 0x00002B04,
+			.cfg                      = 0x00002B08,
+			.header_addr              = 0x00002B0C,
+			.header_cfg               = 0x00002B10,
+			.image_addr               = 0x00002B14,
+			.image_addr_offset        = 0x00002B18,
+			.buffer_width_cfg         = 0x00002B1C,
+			.buffer_height_cfg        = 0x00002B20,
+			.packer_cfg               = 0x00002B24,
+			.stride                   = 0x00002B28,
+			.irq_subsample_period     = 0x00002B48,
+			.irq_subsample_pattern    = 0x00002B4C,
+			.framedrop_period         = 0x00002B50,
+			.framedrop_pattern        = 0x00002B54,
+			.frame_inc                = 0x00002B58,
+			.burst_limit              = 0x00002B5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 */
+		{
+			.status0                  = 0x00002C00,
+			.status1                  = 0x00002C04,
+			.cfg                      = 0x00002C08,
+			.header_addr              = 0x00002C0C,
+			.header_cfg               = 0x00002C10,
+			.image_addr               = 0x00002C14,
+			.image_addr_offset        = 0x00002C18,
+			.buffer_width_cfg         = 0x00002C1C,
+			.buffer_height_cfg        = 0x00002C20,
+			.packer_cfg               = 0x00002C24,
+			.stride                   = 0x00002C28,
+			.irq_subsample_period     = 0x00002C48,
+			.irq_subsample_pattern    = 0x00002C4C,
+			.framedrop_period         = 0x00002C50,
+			.framedrop_pattern        = 0x00002C54,
+			.frame_inc                = 0x00002C58,
+			.burst_limit              = 0x00002C5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 */
+		{
+			.status0                  = 0x00002D00,
+			.status1                  = 0x00002D04,
+			.cfg                      = 0x00002D08,
+			.header_addr              = 0x00002D0C,
+			.header_cfg               = 0x00002D10,
+			.image_addr               = 0x00002D14,
+			.image_addr_offset        = 0x00002D18,
+			.buffer_width_cfg         = 0x00002D1C,
+			.buffer_height_cfg        = 0x00002D20,
+			.packer_cfg               = 0x00002D24,
+			.stride                   = 0x00002D28,
+			.irq_subsample_period     = 0x00002D48,
+			.irq_subsample_pattern    = 0x00002D4C,
+			.framedrop_period         = 0x00002D50,
+			.framedrop_pattern        = 0x00002D54,
+			.frame_inc                = 0x00002D58,
+			.burst_limit              = 0x00002D5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 */
+		{
+			.status0                  = 0x00002E00,
+			.status1                  = 0x00002E04,
+			.cfg                      = 0x00002E08,
+			.header_addr              = 0x00002E0C,
+			.header_cfg               = 0x00002E10,
+			.image_addr               = 0x00002E14,
+			.image_addr_offset        = 0x00002E18,
+			.buffer_width_cfg         = 0x00002E1C,
+			.buffer_height_cfg        = 0x00002E20,
+			.packer_cfg               = 0x00002E24,
+			.stride                   = 0x00002E28,
+			.irq_subsample_period     = 0x00002E48,
+			.irq_subsample_pattern    = 0x00002E4C,
+			.framedrop_period         = 0x00002E50,
+			.framedrop_pattern        = 0x00002E54,
+			.frame_inc                = 0x00002E58,
+			.burst_limit              = 0x00002E5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 */
+		{
+			.status0                  = 0x00002F00,
+			.status1                  = 0x00002F04,
+			.cfg                      = 0x00002F08,
+			.header_addr              = 0x00002F0C,
+			.header_cfg               = 0x00002F10,
+			.image_addr               = 0x00002F14,
+			.image_addr_offset        = 0x00002F18,
+			.buffer_width_cfg         = 0x00002F1C,
+			.buffer_height_cfg        = 0x00002F20,
+			.packer_cfg               = 0x00002F24,
+			.stride                   = 0x00002F28,
+			.irq_subsample_period     = 0x00002F48,
+			.irq_subsample_pattern    = 0x00002F4C,
+			.framedrop_period         = 0x00002F50,
+			.framedrop_pattern        = 0x00002F54,
+			.frame_inc                = 0x00002F58,
+			.burst_limit              = 0x00002F5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 */
+		{
+			.status0                  = 0x00003000,
+			.status1                  = 0x00003004,
+			.cfg                      = 0x00003008,
+			.header_addr              = 0x0000300C,
+			.header_cfg               = 0x00003010,
+			.image_addr               = 0x00003014,
+			.image_addr_offset        = 0x00003018,
+			.buffer_width_cfg         = 0x0000301C,
+			.buffer_height_cfg        = 0x00003020,
+			.packer_cfg               = 0x00003024,
+			.stride                   = 0x00003028,
+			.irq_subsample_period     = 0x00003048,
+			.irq_subsample_pattern    = 0x0000304C,
+			.framedrop_period         = 0x00003050,
+			.framedrop_pattern        = 0x00003054,
+			.frame_inc                = 0x00003058,
+			.burst_limit              = 0x0000305C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 */
+		{
+			.status0                  = 0x00003100,
+			.status1                  = 0x00003104,
+			.cfg                      = 0x00003108,
+			.header_addr              = 0x0000310C,
+			.header_cfg               = 0x00003110,
+			.image_addr               = 0x00003114,
+			.image_addr_offset        = 0x00003118,
+			.buffer_width_cfg         = 0x0000311C,
+			.buffer_height_cfg        = 0x00003120,
+			.packer_cfg               = 0x00003124,
+			.stride                   = 0x00003128,
+			.irq_subsample_period     = 0x00003148,
+			.irq_subsample_pattern    = 0x0000314C,
+			.framedrop_period         = 0x00003150,
+			.framedrop_pattern        = 0x00003154,
+			.frame_inc                = 0x00003158,
+			.burst_limit              = 0x0000315C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 */
+		{
+			.status0                  = 0x00003200,
+			.status1                  = 0x00003204,
+			.cfg                      = 0x00003208,
+			.header_addr              = 0x0000320C,
+			.header_cfg               = 0x00003210,
+			.image_addr               = 0x00003214,
+			.image_addr_offset        = 0x00003218,
+			.buffer_width_cfg         = 0x0000321C,
+			.buffer_height_cfg        = 0x00003220,
+			.packer_cfg               = 0x00003224,
+			.stride                   = 0x00003228,
+			.irq_subsample_period     = 0x00003248,
+			.irq_subsample_pattern    = 0x0000324C,
+			.framedrop_period         = 0x00003250,
+			.framedrop_pattern        = 0x00003254,
+			.frame_inc                = 0x00003258,
+			.burst_limit              = 0x0000325C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 */
+		{
+			.status0                  = 0x00003300,
+			.status1                  = 0x00003304,
+			.cfg                      = 0x00003308,
+			.header_addr              = 0x0000330C,
+			.header_cfg               = 0x00003310,
+			.image_addr               = 0x00003314,
+			.image_addr_offset        = 0x00003318,
+			.buffer_width_cfg         = 0x0000331C,
+			.buffer_height_cfg        = 0x00003320,
+			.packer_cfg               = 0x00003324,
+			.stride                   = 0x00003328,
+			.irq_subsample_period     = 0x00003348,
+			.irq_subsample_pattern    = 0x0000334C,
+			.framedrop_period         = 0x00003350,
+			.framedrop_pattern        = 0x00003354,
+			.frame_inc                = 0x00003358,
+			.burst_limit              = 0x0000335C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 */
+		{
+			.status0                  = 0x00003400,
+			.status1                  = 0x00003404,
+			.cfg                      = 0x00003408,
+			.header_addr              = 0x0000340C,
+			.header_cfg               = 0x00003410,
+			.image_addr               = 0x00003414,
+			.image_addr_offset        = 0x00003418,
+			.buffer_width_cfg         = 0x0000341C,
+			.buffer_height_cfg        = 0x00003420,
+			.packer_cfg               = 0x00003424,
+			.stride                   = 0x00003428,
+			.irq_subsample_period     = 0x00003448,
+			.irq_subsample_pattern    = 0x0000344C,
+			.framedrop_period         = 0x00003450,
+			.framedrop_pattern        = 0x00003454,
+			.frame_inc                = 0x00003458,
+			.burst_limit              = 0x0000345C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 */
+		{
+			.status0                  = 0x00003500,
+			.status1                  = 0x00003504,
+			.cfg                      = 0x00003508,
+			.header_addr              = 0x0000350C,
+			.header_cfg               = 0x00003510,
+			.image_addr               = 0x00003514,
+			.image_addr_offset        = 0x00003518,
+			.buffer_width_cfg         = 0x0000351C,
+			.buffer_height_cfg        = 0x00003520,
+			.packer_cfg               = 0x00003524,
+			.stride                   = 0x00003528,
+			.irq_subsample_period     = 0x00003548,
+			.irq_subsample_pattern    = 0x0000354C,
+			.framedrop_period         = 0x00003550,
+			.framedrop_pattern        = 0x00003554,
+			.frame_inc                = 0x00003558,
+			.burst_limit              = 0x0000355C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 */
+		{
+			.status0                  = 0x00003600,
+			.status1                  = 0x00003604,
+			.cfg                      = 0x00003608,
+			.header_addr              = 0x0000360C,
+			.header_cfg               = 0x00003610,
+			.image_addr               = 0x00003614,
+			.image_addr_offset        = 0x00003618,
+			.buffer_width_cfg         = 0x0000361C,
+			.buffer_height_cfg        = 0x00003620,
+			.packer_cfg               = 0x00003624,
+			.stride                   = 0x00003628,
+			.irq_subsample_period     = 0x00003648,
+			.irq_subsample_pattern    = 0x0000364C,
+			.framedrop_period         = 0x00003650,
+			.framedrop_pattern        = 0x00003654,
+			.frame_inc                = 0x00003658,
+			.burst_limit              = 0x0000365C,
+			.ubwc_regs                = &vfe175_ubwc_regs_client_20,
+		},
+		/* BUS Client 21 */
+		{
+			.status0                  = 0x00003700,
+			.status1                  = 0x00003704,
+			.cfg                      = 0x00003708,
+			.header_addr              = 0x0000370C,
+			.header_cfg               = 0x00003710,
+			.image_addr               = 0x00003714,
+			.image_addr_offset        = 0x00003718,
+			.buffer_width_cfg         = 0x0000371C,
+			.buffer_height_cfg        = 0x00003720,
+			.packer_cfg               = 0x00003724,
+			.stride                   = 0x00003728,
+			.irq_subsample_period     = 0x00003748,
+			.irq_subsample_pattern    = 0x0000374C,
+			.framedrop_period         = 0x00003750,
+			.framedrop_pattern        = 0x00003754,
+			.frame_inc                = 0x00003758,
+			.burst_limit              = 0x0000375C,
+			.ubwc_regs                = &vfe175_ubwc_regs_client_21,
+		},
+		/* BUS Client 22 */
+		{
+			.status0                  = 0x00003800,
+			.status1                  = 0x00003804,
+			.cfg                      = 0x00003808,
+			.header_addr              = 0x0000380C,
+			.header_cfg               = 0x00003810,
+			.image_addr               = 0x00003814,
+			.image_addr_offset        = 0x00003818,
+			.buffer_width_cfg         = 0x0000381C,
+			.buffer_height_cfg        = 0x00003820,
+			.packer_cfg               = 0x00003824,
+			.stride                   = 0x00003828,
+			.irq_subsample_period     = 0x00003848,
+			.irq_subsample_pattern    = 0x0000384C,
+			.framedrop_period         = 0x00003850,
+			.framedrop_pattern        = 0x00003854,
+			.frame_inc                = 0x00003858,
+			.burst_limit              = 0x0000385C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 */
+		{
+			.status0                  = 0x00003900,
+			.status1                  = 0x00003904,
+			.cfg                      = 0x00003908,
+			.header_addr              = 0x0000390C,
+			.header_cfg               = 0x00003910,
+			.image_addr               = 0x00003914,
+			.image_addr_offset        = 0x00003918,
+			.buffer_width_cfg         = 0x0000391C,
+			.buffer_height_cfg        = 0x00003920,
+			.packer_cfg               = 0x00003924,
+			.stride                   = 0x00003928,
+			.irq_subsample_period     = 0x00003948,
+			.irq_subsample_pattern    = 0x0000394C,
+			.framedrop_period         = 0x00003950,
+			.framedrop_pattern        = 0x00003954,
+			.frame_inc                = 0x00003958,
+			.burst_limit              = 0x0000395C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 22,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 23,
+};
+
+static struct cam_vfe_irq_hw_info vfe175_irq_hw_info = {
+	.reset_mask    = BIT(31),
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_INT_CSID,
+	.top_irq_reg   = &vfe175_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe175_hw_info = {
+	.irq_hw_info                  = &vfe175_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe175_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe175_top_hw_info,
+
+	.camif_version                 = CAM_VFE_CAMIF_VER_2_0,
+	.camif_reg                     = &vfe175_camif_reg,
+
+	.camif_lite_version            = CAM_VFE_CAMIF_LITE_VER_2_0,
+	.camif_lite_reg                = &vfe175_camif_lite_reg,
+
+};
+
+#endif /* _CAM_VFE175_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175_130.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175_130.h
@@ -0,0 +1,1176 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE175_130_H_
+#define _CAM_VFE175_130_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_camif_lite_ver2.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_vfe_bus_rd_ver1.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe175_130_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_vfe_rdi_overflow_status vfe175_130_rdi_irq_status = {
+	.rdi0_overflow_mask = 0x8,
+	.rdi1_overflow_mask = 0x10,
+	.rdi2_overflow_mask = 0x18,
+	.rdi3_overflow_mask = 0x20,
+	.rdi_overflow_mask  = 0x3c,
+};
+
+static struct cam_irq_controller_reg_info vfe175_130_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe175_130_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000058,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_vfe_camif_ver2_reg vfe175_130_camif_reg = {
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+};
+
+static struct cam_vfe_camif_reg_data vfe_175_130_camif_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0xEFFF7E80,
+	.subscribe_irq_mask0             = 0x00000017,
+	.subscribe_irq_mask1             = 0x00000000,
+	.enable_diagnostic_hw            = 0x1,
+};
+
+static struct cam_vfe_fe_ver1_reg vfe175_130_fe_reg = {
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+	.fe_cfg                   = 0x00000084,
+};
+
+static struct cam_vfe_fe_reg_data vfe_175_130_fe_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0xEFFF7E80,
+	.enable_diagnostic_hw            = 0x1,
+	.fe_mux_data                     = 0x2,
+	.hbi_cnt_shift                   = 0x8,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg vfe175_130_camif_lite_reg = {
+	.camif_lite_cmd                = 0x00000FC0,
+	.camif_lite_config             = 0x00000FC4,
+	.lite_skip_period              = 0x00000FC8,
+	.lite_irq_subsample_pattern    = 0x00000FCC,
+	.lite_epoch_irq                = 0x00000FD0,
+	.reg_update_cmd                = 0x000004AC,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg_data
+	vfe175_130_camif_lite_reg_data = {
+	.dual_pd_reg_update_cmd_data     = 0x20,
+	.lite_epoch_line_cfg             = 0x00140014,
+	.lite_sof_irq_mask               = 0x00040000,
+	.lite_epoch0_irq_mask            = 0x00100000,
+	.dual_pd_reg_upd_irq_mask        = 0x04000000,
+	.lite_eof_irq_mask               = 0x00080000,
+	.lite_err_irq_mask0              = 0x00400000,
+	.lite_err_irq_mask1              = 0x00004100,
+	.extern_reg_update_shift         = 4,
+	.dual_pd_path_sel_shift          = 24,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_175_130_reg = {
+	.reset    = 0x0000001C,
+	.cgc_ovd  = 0x0000002C,
+	.enable   = 0x00000040,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl stats_175_130_reg = {
+	.reset    = 0x00000020,
+	.cgc_ovd  = 0x00000030,
+	.enable   = 0x00000044,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl color_175_130_reg = {
+	.reset    = 0x00000024,
+	.cgc_ovd  = 0x00000034,
+	.enable   = 0x00000048,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl zoom_175_130_reg = {
+	.reset    = 0x00000028,
+	.cgc_ovd  = 0x00000038,
+	.enable   = 0x0000004C,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe175_130_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		&lens_175_130_reg,
+		&stats_175_130_reg,
+		&color_175_130_reg,
+		&zoom_175_130_reg,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000050,
+	.three_D_cfg              = 0x00000054,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe175_130_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_common_reg_data vfe175_130_rdi_reg_data = {
+	.subscribe_irq_mask0      = 0x780001E0,
+	.subscribe_irq_mask1      = 0x0,
+	.error_irq_mask0          = 0x0,
+	.error_irq_mask1          = 0x3C,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_130_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_130_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_130_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+struct cam_vfe_top_dump_data vfe175_130_dump_data = {
+	.num_reg_dump_entries  =  2,
+	.num_lut_dump_entries  =  1,
+	.dmi_cfg               =  0xc24,
+	.dmi_addr              =  0xc28,
+	.dmi_data_path_hi      =  0xc2C,
+	.dmi_data_path_lo      =  0xc30,
+	.reg_entry = {
+		{
+			.reg_dump_start = 0x0,
+			.reg_dump_end   = 0x1164,
+		},
+		{
+			.reg_dump_start = 0x2000,
+			.reg_dump_end   = 0x397C,
+		},
+	},
+	.lut_entry = {
+		{
+			.lut_word_size = 64,
+			.lut_bank_sel  = 0x40,
+			.lut_addr_size = 180,
+		},
+	},
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe175_130_top_hw_info = {
+	.common_reg = &vfe175_130_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe175_130_top_common_reg,
+		.camif_reg      = &vfe175_130_camif_reg,
+		.reg_data       = &vfe_175_130_camif_reg_data,
+		},
+	.camif_lite_hw_info = {
+		.common_reg     = &vfe175_130_top_common_reg,
+		.camif_lite_reg = &vfe175_130_camif_lite_reg,
+		.reg_data       = &vfe175_130_camif_lite_reg_data,
+		},
+	.rdi_hw_info = {
+		.common_reg      = &vfe175_130_top_common_reg,
+		.rdi_reg         = &vfe175_130_rdi_reg,
+		.common_reg_data = &vfe175_130_rdi_reg_data,
+		.rdi_irq_status  = &vfe175_130_rdi_irq_status,
+		.reg_data = {
+			&vfe_175_130_rdi_0_data,
+			&vfe_175_130_rdi_1_data,
+			&vfe_175_130_rdi_2_data,
+			NULL,
+			},
+		},
+	.fe_hw_info = {
+		.common_reg     = &vfe175_130_top_common_reg,
+		.fe_reg     = &vfe175_130_fe_reg,
+		.reg_data       = &vfe_175_130_fe_reg_data,
+		},
+	.num_mux = 6,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_2_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_CAMIF_LITE_VER_2_0,
+		CAM_VFE_IN_RD_VER_1_0,
+	},
+	.dump_data = &vfe175_130_dump_data,
+};
+
+static struct cam_irq_register_set vfe175_130_bus_rd_irq_reg[1] = {
+		{
+			.mask_reg_offset   = 0x00005010,
+			.clear_reg_offset  = 0x00005014,
+			.status_reg_offset = 0x0000501C,
+		},
+};
+
+static struct cam_irq_register_set vfe175_130_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_130_ubwc_regs_client_3 = {
+	.tile_cfg         = 0x0000252C,
+	.h_init           = 0x00002530,
+	.v_init           = 0x00002534,
+	.meta_addr        = 0x00002538,
+	.meta_offset      = 0x0000253C,
+	.meta_stride      = 0x00002540,
+	.mode_cfg_0       = 0x00002544,
+	.mode_cfg_1       = 0x000025A4,
+	.bw_limit         = 0x000025A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_130_ubwc_regs_client_4 = {
+	.tile_cfg         = 0x0000262C,
+	.h_init           = 0x00002630,
+	.v_init           = 0x00002634,
+	.meta_addr        = 0x00002638,
+	.meta_offset      = 0x0000263C,
+	.meta_stride      = 0x00002640,
+	.mode_cfg_0       = 0x00002644,
+	.mode_cfg_1       = 0x000026A4,
+	.bw_limit         = 0x000026A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_130_ubwc_regs_client_20 = {
+	.tile_cfg         = 0x0000362C,
+	.h_init           = 0x00003630,
+	.v_init           = 0x00003634,
+	.meta_addr        = 0x00003638,
+	.meta_offset      = 0x0000363C,
+	.meta_stride      = 0x00003640,
+	.mode_cfg_0       = 0x00003644,
+	.mode_cfg_1       = 0x000036A4,
+	.bw_limit         = 0x000036A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_130_ubwc_regs_client_21 = {
+	.tile_cfg         = 0x0000372C,
+	.h_init           = 0x00003730,
+	.v_init           = 0x00003734,
+	.meta_addr        = 0x00003738,
+	.meta_offset      = 0x0000373C,
+	.meta_stride      = 0x00003740,
+	.mode_cfg_0       = 0x00003744,
+	.mode_cfg_1       = 0x000037A4,
+	.bw_limit         = 0x000037A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_rd_ver1_hw_info vfe175_130_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00005000,
+		.hw_capability                = 0x00005004,
+		.sw_reset                     = 0x00005008,
+		.cgc_ovd                      = 0x0000500C,
+		.pwr_iso_cfg                  = 0x000050CC,
+		.input_if_cmd                 = 0x00005020,
+		.test_bus_ctrl                = 0x00005048,
+		.irq_reg_info = {
+			.num_registers         = 1,
+			.irq_reg_set           = vfe175_130_bus_rd_irq_reg,
+			.global_irq_cmd_offset = 0x00005018,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+	},
+	.num_client = 1,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x00005050,
+			.image_addr               = 0x00005058,
+			.buf_size                 = 0x0000505C,
+			.stride                   = 0x00005060,
+			.unpacker_cfg             = 0x00005064,
+			.latency_buf_allocation   = 0x00005078,
+			.burst_limit              = 0x00005080,
+		},
+	},
+	.num_bus_rd_resc = 1,
+	.vfe_bus_rd_hw_info = {
+		{
+			.vfe_bus_rd_type = CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 23,
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe175_130_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers         = 3,
+			.irq_reg_set           = vfe175_130_bus_irq_reg,
+			.global_irq_cmd_offset = 0x00002068,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 24,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                =
+				&vfe175_130_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 */
+		{
+			.status0                  = 0x00002600,
+			.status1                  = 0x00002604,
+			.cfg                      = 0x00002608,
+			.header_addr              = 0x0000260C,
+			.header_cfg               = 0x00002610,
+			.image_addr               = 0x00002614,
+			.image_addr_offset        = 0x00002618,
+			.buffer_width_cfg         = 0x0000261C,
+			.buffer_height_cfg        = 0x00002620,
+			.packer_cfg               = 0x00002624,
+			.stride                   = 0x00002628,
+			.irq_subsample_period     = 0x00002648,
+			.irq_subsample_pattern    = 0x0000264C,
+			.framedrop_period         = 0x00002650,
+			.framedrop_pattern        = 0x00002654,
+			.frame_inc                = 0x00002658,
+			.burst_limit              = 0x0000265C,
+			.ubwc_regs                =
+				&vfe175_130_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 */
+		{
+			.status0                  = 0x00002700,
+			.status1                  = 0x00002704,
+			.cfg                      = 0x00002708,
+			.header_addr              = 0x0000270C,
+			.header_cfg               = 0x00002710,
+			.image_addr               = 0x00002714,
+			.image_addr_offset        = 0x00002718,
+			.buffer_width_cfg         = 0x0000271C,
+			.buffer_height_cfg        = 0x00002720,
+			.packer_cfg               = 0x00002724,
+			.stride                   = 0x00002728,
+			.irq_subsample_period     = 0x00002748,
+			.irq_subsample_pattern    = 0x0000274C,
+			.framedrop_period         = 0x00002750,
+			.framedrop_pattern        = 0x00002754,
+			.frame_inc                = 0x00002758,
+			.burst_limit              = 0x0000275C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 */
+		{
+			.status0                  = 0x00002800,
+			.status1                  = 0x00002804,
+			.cfg                      = 0x00002808,
+			.header_addr              = 0x0000280C,
+			.header_cfg               = 0x00002810,
+			.image_addr               = 0x00002814,
+			.image_addr_offset        = 0x00002818,
+			.buffer_width_cfg         = 0x0000281C,
+			.buffer_height_cfg        = 0x00002820,
+			.packer_cfg               = 0x00002824,
+			.stride                   = 0x00002828,
+			.irq_subsample_period     = 0x00002848,
+			.irq_subsample_pattern    = 0x0000284C,
+			.framedrop_period         = 0x00002850,
+			.framedrop_pattern        = 0x00002854,
+			.frame_inc                = 0x00002858,
+			.burst_limit              = 0x0000285C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 */
+		{
+			.status0                  = 0x00002900,
+			.status1                  = 0x00002904,
+			.cfg                      = 0x00002908,
+			.header_addr              = 0x0000290C,
+			.header_cfg               = 0x00002910,
+			.image_addr               = 0x00002914,
+			.image_addr_offset        = 0x00002918,
+			.buffer_width_cfg         = 0x0000291C,
+			.buffer_height_cfg        = 0x00002920,
+			.packer_cfg               = 0x00002924,
+			.stride                   = 0x00002928,
+			.irq_subsample_period     = 0x00002948,
+			.irq_subsample_pattern    = 0x0000294C,
+			.framedrop_period         = 0x00002950,
+			.framedrop_pattern        = 0x00002954,
+			.frame_inc                = 0x00002958,
+			.burst_limit              = 0x0000295C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 */
+		{
+			.status0                  = 0x00002A00,
+			.status1                  = 0x00002A04,
+			.cfg                      = 0x00002A08,
+			.header_addr              = 0x00002A0C,
+			.header_cfg               = 0x00002A10,
+			.image_addr               = 0x00002A14,
+			.image_addr_offset        = 0x00002A18,
+			.buffer_width_cfg         = 0x00002A1C,
+			.buffer_height_cfg        = 0x00002A20,
+			.packer_cfg               = 0x00002A24,
+			.stride                   = 0x00002A28,
+			.irq_subsample_period     = 0x00002A48,
+			.irq_subsample_pattern    = 0x00002A4C,
+			.framedrop_period         = 0x00002A50,
+			.framedrop_pattern        = 0x00002A54,
+			.frame_inc                = 0x00002A58,
+			.burst_limit              = 0x00002A5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 */
+		{
+			.status0                  = 0x00002B00,
+			.status1                  = 0x00002B04,
+			.cfg                      = 0x00002B08,
+			.header_addr              = 0x00002B0C,
+			.header_cfg               = 0x00002B10,
+			.image_addr               = 0x00002B14,
+			.image_addr_offset        = 0x00002B18,
+			.buffer_width_cfg         = 0x00002B1C,
+			.buffer_height_cfg        = 0x00002B20,
+			.packer_cfg               = 0x00002B24,
+			.stride                   = 0x00002B28,
+			.irq_subsample_period     = 0x00002B48,
+			.irq_subsample_pattern    = 0x00002B4C,
+			.framedrop_period         = 0x00002B50,
+			.framedrop_pattern        = 0x00002B54,
+			.frame_inc                = 0x00002B58,
+			.burst_limit              = 0x00002B5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 */
+		{
+			.status0                  = 0x00002C00,
+			.status1                  = 0x00002C04,
+			.cfg                      = 0x00002C08,
+			.header_addr              = 0x00002C0C,
+			.header_cfg               = 0x00002C10,
+			.image_addr               = 0x00002C14,
+			.image_addr_offset        = 0x00002C18,
+			.buffer_width_cfg         = 0x00002C1C,
+			.buffer_height_cfg        = 0x00002C20,
+			.packer_cfg               = 0x00002C24,
+			.stride                   = 0x00002C28,
+			.irq_subsample_period     = 0x00002C48,
+			.irq_subsample_pattern    = 0x00002C4C,
+			.framedrop_period         = 0x00002C50,
+			.framedrop_pattern        = 0x00002C54,
+			.frame_inc                = 0x00002C58,
+			.burst_limit              = 0x00002C5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 */
+		{
+			.status0                  = 0x00002D00,
+			.status1                  = 0x00002D04,
+			.cfg                      = 0x00002D08,
+			.header_addr              = 0x00002D0C,
+			.header_cfg               = 0x00002D10,
+			.image_addr               = 0x00002D14,
+			.image_addr_offset        = 0x00002D18,
+			.buffer_width_cfg         = 0x00002D1C,
+			.buffer_height_cfg        = 0x00002D20,
+			.packer_cfg               = 0x00002D24,
+			.stride                   = 0x00002D28,
+			.irq_subsample_period     = 0x00002D48,
+			.irq_subsample_pattern    = 0x00002D4C,
+			.framedrop_period         = 0x00002D50,
+			.framedrop_pattern        = 0x00002D54,
+			.frame_inc                = 0x00002D58,
+			.burst_limit              = 0x00002D5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 */
+		{
+			.status0                  = 0x00002E00,
+			.status1                  = 0x00002E04,
+			.cfg                      = 0x00002E08,
+			.header_addr              = 0x00002E0C,
+			.header_cfg               = 0x00002E10,
+			.image_addr               = 0x00002E14,
+			.image_addr_offset        = 0x00002E18,
+			.buffer_width_cfg         = 0x00002E1C,
+			.buffer_height_cfg        = 0x00002E20,
+			.packer_cfg               = 0x00002E24,
+			.stride                   = 0x00002E28,
+			.irq_subsample_period     = 0x00002E48,
+			.irq_subsample_pattern    = 0x00002E4C,
+			.framedrop_period         = 0x00002E50,
+			.framedrop_pattern        = 0x00002E54,
+			.frame_inc                = 0x00002E58,
+			.burst_limit              = 0x00002E5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 */
+		{
+			.status0                  = 0x00002F00,
+			.status1                  = 0x00002F04,
+			.cfg                      = 0x00002F08,
+			.header_addr              = 0x00002F0C,
+			.header_cfg               = 0x00002F10,
+			.image_addr               = 0x00002F14,
+			.image_addr_offset        = 0x00002F18,
+			.buffer_width_cfg         = 0x00002F1C,
+			.buffer_height_cfg        = 0x00002F20,
+			.packer_cfg               = 0x00002F24,
+			.stride                   = 0x00002F28,
+			.irq_subsample_period     = 0x00002F48,
+			.irq_subsample_pattern    = 0x00002F4C,
+			.framedrop_period         = 0x00002F50,
+			.framedrop_pattern        = 0x00002F54,
+			.frame_inc                = 0x00002F58,
+			.burst_limit              = 0x00002F5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 */
+		{
+			.status0                  = 0x00003000,
+			.status1                  = 0x00003004,
+			.cfg                      = 0x00003008,
+			.header_addr              = 0x0000300C,
+			.header_cfg               = 0x00003010,
+			.image_addr               = 0x00003014,
+			.image_addr_offset        = 0x00003018,
+			.buffer_width_cfg         = 0x0000301C,
+			.buffer_height_cfg        = 0x00003020,
+			.packer_cfg               = 0x00003024,
+			.stride                   = 0x00003028,
+			.irq_subsample_period     = 0x00003048,
+			.irq_subsample_pattern    = 0x0000304C,
+			.framedrop_period         = 0x00003050,
+			.framedrop_pattern        = 0x00003054,
+			.frame_inc                = 0x00003058,
+			.burst_limit              = 0x0000305C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 */
+		{
+			.status0                  = 0x00003100,
+			.status1                  = 0x00003104,
+			.cfg                      = 0x00003108,
+			.header_addr              = 0x0000310C,
+			.header_cfg               = 0x00003110,
+			.image_addr               = 0x00003114,
+			.image_addr_offset        = 0x00003118,
+			.buffer_width_cfg         = 0x0000311C,
+			.buffer_height_cfg        = 0x00003120,
+			.packer_cfg               = 0x00003124,
+			.stride                   = 0x00003128,
+			.irq_subsample_period     = 0x00003148,
+			.irq_subsample_pattern    = 0x0000314C,
+			.framedrop_period         = 0x00003150,
+			.framedrop_pattern        = 0x00003154,
+			.frame_inc                = 0x00003158,
+			.burst_limit              = 0x0000315C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 */
+		{
+			.status0                  = 0x00003200,
+			.status1                  = 0x00003204,
+			.cfg                      = 0x00003208,
+			.header_addr              = 0x0000320C,
+			.header_cfg               = 0x00003210,
+			.image_addr               = 0x00003214,
+			.image_addr_offset        = 0x00003218,
+			.buffer_width_cfg         = 0x0000321C,
+			.buffer_height_cfg        = 0x00003220,
+			.packer_cfg               = 0x00003224,
+			.stride                   = 0x00003228,
+			.irq_subsample_period     = 0x00003248,
+			.irq_subsample_pattern    = 0x0000324C,
+			.framedrop_period         = 0x00003250,
+			.framedrop_pattern        = 0x00003254,
+			.frame_inc                = 0x00003258,
+			.burst_limit              = 0x0000325C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 */
+		{
+			.status0                  = 0x00003300,
+			.status1                  = 0x00003304,
+			.cfg                      = 0x00003308,
+			.header_addr              = 0x0000330C,
+			.header_cfg               = 0x00003310,
+			.image_addr               = 0x00003314,
+			.image_addr_offset        = 0x00003318,
+			.buffer_width_cfg         = 0x0000331C,
+			.buffer_height_cfg        = 0x00003320,
+			.packer_cfg               = 0x00003324,
+			.stride                   = 0x00003328,
+			.irq_subsample_period     = 0x00003348,
+			.irq_subsample_pattern    = 0x0000334C,
+			.framedrop_period         = 0x00003350,
+			.framedrop_pattern        = 0x00003354,
+			.frame_inc                = 0x00003358,
+			.burst_limit              = 0x0000335C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 */
+		{
+			.status0                  = 0x00003400,
+			.status1                  = 0x00003404,
+			.cfg                      = 0x00003408,
+			.header_addr              = 0x0000340C,
+			.header_cfg               = 0x00003410,
+			.image_addr               = 0x00003414,
+			.image_addr_offset        = 0x00003418,
+			.buffer_width_cfg         = 0x0000341C,
+			.buffer_height_cfg        = 0x00003420,
+			.packer_cfg               = 0x00003424,
+			.stride                   = 0x00003428,
+			.irq_subsample_period     = 0x00003448,
+			.irq_subsample_pattern    = 0x0000344C,
+			.framedrop_period         = 0x00003450,
+			.framedrop_pattern        = 0x00003454,
+			.frame_inc                = 0x00003458,
+			.burst_limit              = 0x0000345C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 */
+		{
+			.status0                  = 0x00003500,
+			.status1                  = 0x00003504,
+			.cfg                      = 0x00003508,
+			.header_addr              = 0x0000350C,
+			.header_cfg               = 0x00003510,
+			.image_addr               = 0x00003514,
+			.image_addr_offset        = 0x00003518,
+			.buffer_width_cfg         = 0x0000351C,
+			.buffer_height_cfg        = 0x00003520,
+			.packer_cfg               = 0x00003524,
+			.stride                   = 0x00003528,
+			.irq_subsample_period     = 0x00003548,
+			.irq_subsample_pattern    = 0x0000354C,
+			.framedrop_period         = 0x00003550,
+			.framedrop_pattern        = 0x00003554,
+			.frame_inc                = 0x00003558,
+			.burst_limit              = 0x0000355C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 */
+		{
+			.status0                  = 0x00003600,
+			.status1                  = 0x00003604,
+			.cfg                      = 0x00003608,
+			.header_addr              = 0x0000360C,
+			.header_cfg               = 0x00003610,
+			.image_addr               = 0x00003614,
+			.image_addr_offset        = 0x00003618,
+			.buffer_width_cfg         = 0x0000361C,
+			.buffer_height_cfg        = 0x00003620,
+			.packer_cfg               = 0x00003624,
+			.stride                   = 0x00003628,
+			.irq_subsample_period     = 0x00003648,
+			.irq_subsample_pattern    = 0x0000364C,
+			.framedrop_period         = 0x00003650,
+			.framedrop_pattern        = 0x00003654,
+			.frame_inc                = 0x00003658,
+			.burst_limit              = 0x0000365C,
+			.ubwc_regs                =
+				&vfe175_130_ubwc_regs_client_20,
+		},
+		/* BUS Client 21 */
+		{
+			.status0                  = 0x00003700,
+			.status1                  = 0x00003704,
+			.cfg                      = 0x00003708,
+			.header_addr              = 0x0000370C,
+			.header_cfg               = 0x00003710,
+			.image_addr               = 0x00003714,
+			.image_addr_offset        = 0x00003718,
+			.buffer_width_cfg         = 0x0000371C,
+			.buffer_height_cfg        = 0x00003720,
+			.packer_cfg               = 0x00003724,
+			.stride                   = 0x00003728,
+			.irq_subsample_period     = 0x00003748,
+			.irq_subsample_pattern    = 0x0000374C,
+			.framedrop_period         = 0x00003750,
+			.framedrop_pattern        = 0x00003754,
+			.frame_inc                = 0x00003758,
+			.burst_limit              = 0x0000375C,
+			.ubwc_regs                =
+				&vfe175_130_ubwc_regs_client_21,
+		},
+		/* BUS Client 22 */
+		{
+			.status0                  = 0x00003800,
+			.status1                  = 0x00003804,
+			.cfg                      = 0x00003808,
+			.header_addr              = 0x0000380C,
+			.header_cfg               = 0x00003810,
+			.image_addr               = 0x00003814,
+			.image_addr_offset        = 0x00003818,
+			.buffer_width_cfg         = 0x0000381C,
+			.buffer_height_cfg        = 0x00003820,
+			.packer_cfg               = 0x00003824,
+			.stride                   = 0x00003828,
+			.irq_subsample_period     = 0x00003848,
+			.irq_subsample_pattern    = 0x0000384C,
+			.framedrop_period         = 0x00003850,
+			.framedrop_pattern        = 0x00003854,
+			.frame_inc                = 0x00003858,
+			.burst_limit              = 0x0000385C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 */
+		{
+			.status0                  = 0x00003900,
+			.status1                  = 0x00003904,
+			.cfg                      = 0x00003908,
+			.header_addr              = 0x0000390C,
+			.header_cfg               = 0x00003910,
+			.image_addr               = 0x00003914,
+			.image_addr_offset        = 0x00003918,
+			.buffer_width_cfg         = 0x0000391C,
+			.buffer_height_cfg        = 0x00003920,
+			.packer_cfg               = 0x00003924,
+			.stride                   = 0x00003928,
+			.irq_subsample_period     = 0x00003948,
+			.irq_subsample_pattern    = 0x0000394C,
+			.framedrop_period         = 0x00003950,
+			.framedrop_pattern        = 0x00003954,
+			.frame_inc                = 0x00003958,
+			.burst_limit              = 0x0000395C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 22,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 23,
+};
+
+static struct cam_vfe_irq_hw_info vfe175_130_irq_hw_info = {
+	.reset_mask    = BIT(31),
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_INT_CSID,
+	.top_irq_reg   = &vfe175_130_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe175_130_hw_info = {
+	.irq_hw_info                   = &vfe175_130_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe175_130_bus_hw_info,
+
+	.bus_rd_version                = CAM_VFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &vfe175_130_bus_rd_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe175_130_top_hw_info,
+
+	.camif_version                 = CAM_VFE_CAMIF_VER_2_0,
+	.camif_reg                     = &vfe175_130_camif_reg,
+
+	.camif_lite_version            = CAM_VFE_CAMIF_LITE_VER_2_0,
+	.camif_lite_reg                = &vfe175_130_camif_lite_reg,
+
+};
+
+#endif /* _CAM_VFE175_130_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe480.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe480.h
@@ -0,0 +1,1727 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE480_H_
+#define _CAM_VFE480_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_BUS_VER3_480_MAX_CLIENTS     26
+
+static struct cam_irq_register_set vfe480_top_irq_reg_set[3] = {
+	{
+		.mask_reg_offset   = 0x0000003C,
+		.clear_reg_offset  = 0x00000048,
+		.status_reg_offset = 0x00000054,
+	},
+	{
+		.mask_reg_offset   = 0x00000040,
+		.clear_reg_offset  = 0x0000004C,
+		.status_reg_offset = 0x00000058,
+	},
+	{
+		.mask_reg_offset   = 0x00000044,
+		.clear_reg_offset  = 0x00000050,
+		.status_reg_offset = 0x0000005C,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe480_top_irq_reg_info = {
+	.num_registers = 3,
+	.irq_reg_set = vfe480_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000038,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_vfe_camif_ver3_pp_clc_reg vfe480_camif_reg = {
+	.hw_version                  = 0x00002600,
+	.hw_status                   = 0x00002604,
+	.module_cfg                  = 0x00002660,
+	.pdaf_raw_crop_width_cfg     = 0x00002668,
+	.pdaf_raw_crop_height_cfg    = 0x0000266C,
+	.line_skip_pattern           = 0x00002670,
+	.pixel_skip_pattern          = 0x00002674,
+	.period_cfg                  = 0x00002678,
+	.irq_subsample_pattern       = 0x0000267C,
+	.epoch_irq_cfg               = 0x00002680,
+	.debug_1                     = 0x000027F0,
+	.debug_0                     = 0x000027F4,
+	.test_bus_ctrl               = 0x000027F8,
+	.spare                       = 0x000027FC,
+	.reg_update_cmd              = 0x00000034,
+};
+
+static struct cam_vfe_camif_ver3_reg_data vfe_480_camif_reg_data = {
+	.pp_extern_reg_update_shift      = 4,
+	.dual_pd_extern_reg_update_shift = 17,
+	.extern_reg_update_mask          = 1,
+	.dual_ife_pix_en_shift           = 3,
+	.operating_mode_shift            = 11,
+	.input_mux_sel_shift             = 5,
+	.pixel_pattern_shift             = 24,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 24,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 23,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x41,
+	.epoch_line_cfg                  = 0x00000014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.epoch1_irq_mask                 = 0x00000008,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x82000200,
+	.error_irq_mask2                 = 0x30301F80,
+	.subscribe_irq_mask1             = 0x00000007,
+	.frame_id_irq_mask               = 0x400,
+	.enable_diagnostic_hw            = 0x1,
+	.pp_camif_cfg_en_shift           = 0,
+	.pp_camif_cfg_ife_out_en_shift   = 8,
+	.top_debug_cfg_en                = 1,
+};
+
+static struct cam_vfe_top_ver3_reg_offset_common vfe480_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.titan_version            = 0x00000004,
+	.hw_capability            = 0x00000008,
+	.lens_feature             = 0x0000000C,
+	.stats_feature            = 0x00000010,
+	.color_feature            = 0x00000014,
+	.zoom_feature             = 0x00000018,
+	.global_reset_cmd         = 0x0000001C,
+	.core_cfg_0               = 0x0000002C,
+	.core_cfg_1               = 0x00000030,
+	.reg_update_cmd           = 0x00000034,
+	.violation_status         = 0x00000074,
+	.core_cgc_ovd_0           = 0x00000020,
+	.core_cgc_ovd_1           = 0x00000094,
+	.ahb_cgc_ovd              = 0x00000024,
+	.noc_cgc_ovd              = 0x00000028,
+	.trigger_cdm_events       = 0x00000090,
+	.custom_frame_idx         = 0x00000110,
+	.dsp_status               = 0x0000007C,
+	.diag_config              = 0x00000064,
+	.diag_sensor_status_0     = 0x00000068,
+	.diag_sensor_status_1     = 0x00000098,
+	.bus_overflow_status      = 0x0000AA68,
+	.top_debug_cfg            = 0x000000DC,
+	.top_debug_0              = 0x00000080,
+	.top_debug_1              = 0x00000084,
+	.top_debug_2              = 0x00000088,
+	.top_debug_3              = 0x0000008C,
+	.top_debug_4              = 0x0000009C,
+	.top_debug_5              = 0x000000A0,
+	.top_debug_6              = 0x000000A4,
+	.top_debug_7              = 0x000000A8,
+	.top_debug_8              = 0x000000AC,
+	.top_debug_9              = 0x000000B0,
+	.top_debug_10             = 0x000000B4,
+	.top_debug_11             = 0x000000B8,
+	.top_debug_12             = 0x000000BC,
+	.top_debug_13             = 0x000000C0,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg vfe480_camif_rdi[3] = {
+	{
+		.lite_hw_version            = 0x9A00,
+		.lite_hw_status             = 0x9A04,
+		.lite_module_config         = 0x9A60,
+		.lite_skip_period           = 0x9A68,
+		.lite_irq_subsample_pattern = 0x9A6C,
+		.lite_epoch_irq             = 0x9A70,
+		.lite_debug_1               = 0x9BF0,
+		.lite_debug_0               = 0x9BF4,
+		.lite_test_bus_ctrl         = 0x9BF8,
+		.camif_lite_spare           = 0x9BFC,
+		.reg_update_cmd             = 0x34,
+	},
+	{
+		.lite_hw_version            = 0x9C00,
+		.lite_hw_status             = 0x9C04,
+		.lite_module_config         = 0x9C60,
+		.lite_skip_period           = 0x9C68,
+		.lite_irq_subsample_pattern = 0x9C6C,
+		.lite_epoch_irq             = 0x9C70,
+		.lite_debug_1               = 0x9DF0,
+		.lite_debug_0               = 0x9DF4,
+		.lite_test_bus_ctrl         = 0x9DF8,
+		.camif_lite_spare           = 0x9DFC,
+		.reg_update_cmd             = 0x34,
+	},
+	{
+		.lite_hw_version            = 0x9E00,
+		.lite_hw_status             = 0x9E04,
+		.lite_module_config         = 0x9E60,
+		.lite_skip_period           = 0x9E68,
+		.lite_irq_subsample_pattern = 0x9E6C,
+		.lite_epoch_irq             = 0x9E70,
+		.lite_debug_1               = 0x9FF0,
+		.lite_debug_0               = 0x9FF4,
+		.lite_test_bus_ctrl         = 0x9FF8,
+		.camif_lite_spare           = 0x9FFC,
+		.reg_update_cmd             = 0x34,
+	},
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe480_camif_rdi_reg_data[3] = {
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x2,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x10,
+		.epoch0_irq_mask                 = 0x40,
+		.epoch1_irq_mask                 = 0x80,
+		.eof_irq_mask                    = 0x20,
+		.error_irq_mask0                 = 0x20000000,
+		.error_irq_mask2                 = 0x20000,
+		.subscribe_irq_mask1             = 0x30,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x4,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x100,
+		.epoch0_irq_mask                 = 0x400,
+		.epoch1_irq_mask                 = 0x800,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask0                 = 0x10000000,
+		.error_irq_mask2                 = 0x40000,
+		.subscribe_irq_mask1             = 0x300,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x8,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x1000,
+		.epoch0_irq_mask                 = 0x4000,
+		.epoch1_irq_mask                 = 0x8000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask0                 = 0x8000000,
+		.error_irq_mask2                 = 0x80000,
+		.subscribe_irq_mask1             = 0x3000,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 1,
+	},
+};
+
+static struct cam_vfe_camif_lite_ver3_reg vfe480_camif_lcr = {
+	.lite_hw_version            = 0xA000,
+	.lite_hw_status             = 0xA004,
+	.lite_module_config         = 0xA060,
+	.lite_skip_period           = 0xA068,
+	.lite_irq_subsample_pattern = 0xA06C,
+	.lite_epoch_irq             = 0xA070,
+	.lite_debug_1               = 0xA1F0,
+	.lite_debug_0               = 0xA1F4,
+	.lite_test_bus_ctrl         = 0xA1F8,
+	.camif_lite_spare           = 0xA1FC,
+	.reg_update_cmd             = 0x0034,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe480_camif_lcr_reg_data = {
+	.extern_reg_update_shift    = 16,
+	.reg_update_cmd_data        = 0x40,
+	.epoch_line_cfg             = 0x00140014,
+	.sof_irq_mask               = 0x100000,
+	.epoch0_irq_mask            = 0x400000,
+	.epoch1_irq_mask            = 0x800000,
+	.eof_irq_mask               = 0x200000,
+	.error_irq_mask0            = 0x0,
+	.error_irq_mask2            = 0x18000,
+	.subscribe_irq_mask1        = 0x300000,
+	.enable_diagnostic_hw       = 0x1,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg vfe480_camif_pd = {
+	.lite_hw_version            = 0xA400,
+	.lite_hw_status             = 0xA404,
+	.lite_module_config         = 0xA460,
+	.lite_skip_period           = 0xA468,
+	.lite_irq_subsample_pattern = 0xA46C,
+	.lite_epoch_irq             = 0xA470,
+	.lite_debug_1               = 0xA5F0,
+	.lite_debug_0               = 0xA5F4,
+	.lite_test_bus_ctrl         = 0xA5F8,
+	.camif_lite_spare           = 0xA5FC,
+	.reg_update_cmd             = 0x0034,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe480_camif_pd_reg_data = {
+	.extern_reg_update_shift    = 17,
+	.operating_mode_shift       = 13,
+	.input_mux_sel_shift        = 31,
+	.reg_update_cmd_data        = 0x20,
+	.epoch_line_cfg             = 0x00140014,
+	.sof_irq_mask               = 0x10000,
+	.epoch0_irq_mask            = 0x40000,
+	.epoch1_irq_mask            = 0x80000,
+	.eof_irq_mask               = 0x20000,
+	.error_irq_mask0            = 0x40000000,
+	.error_irq_mask2            = 0x6000,
+	.subscribe_irq_mask1        = 0x30000,
+	.enable_diagnostic_hw       = 0x1,
+};
+
+struct cam_vfe_camif_lite_ver3_hw_info rdi_hw_info_arr[CAM_VFE_RDI_VER2_MAX] = {
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[0],
+		.reg_data       = &vfe480_camif_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[1],
+		.reg_data       = &vfe480_camif_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[2],
+		.reg_data       = &vfe480_camif_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver3_hw_info vfe480_top_hw_info = {
+	.common_reg = &vfe480_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_reg      = &vfe480_camif_reg,
+		.reg_data       = &vfe_480_camif_reg_data,
+		},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_pd,
+		.reg_data       = &vfe480_camif_pd_reg_data,
+		},
+	.rdi_hw_info[0] = &rdi_hw_info_arr[0],
+	.rdi_hw_info[1] = &rdi_hw_info_arr[1],
+	.rdi_hw_info[2] = &rdi_hw_info_arr[2],
+	.lcr_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_lcr,
+		.reg_data       = &vfe480_camif_lcr_reg_data,
+		},
+	.num_mux = 6,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_3_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_LCR_VER_1_0,
+	},
+	.num_path_port_map = 2,
+	.path_port_map = {
+		{CAM_ISP_HW_VFE_IN_LCR, CAM_ISP_IFE_OUT_RES_LCR},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_2PD},
+	},
+};
+
+static struct cam_irq_register_set vfe480_bus_irq_reg[2] = {
+		{
+			.mask_reg_offset   = 0x0000AA18,
+			.clear_reg_offset  = 0x0000AA20,
+			.status_reg_offset = 0x0000AA28,
+		},
+		{
+			.mask_reg_offset   = 0x0000AA1C,
+			.clear_reg_offset  = 0x0000AA24,
+			.status_reg_offset = 0x0000AA2C,
+		},
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe480_ubwc_regs_client_0 = {
+	.meta_addr        = 0x0000AC40,
+	.meta_cfg         = 0x0000AC44,
+	.mode_cfg         = 0x0000AC48,
+	.stats_ctrl       = 0x0000AC4C,
+	.ctrl_2           = 0x0000AC50,
+	.lossy_thresh0    = 0x0000AC54,
+	.lossy_thresh1    = 0x0000AC58,
+	.off_lossy_var    = 0x0000AC5C,
+	.bw_limit         = 0x0000AC1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe480_ubwc_regs_client_1 = {
+	.meta_addr        = 0x0000AD40,
+	.meta_cfg         = 0x0000AD44,
+	.mode_cfg         = 0x0000AD48,
+	.stats_ctrl       = 0x0000AD4C,
+	.ctrl_2           = 0x0000AD50,
+	.lossy_thresh0    = 0x0000AD54,
+	.lossy_thresh1    = 0x0000AD58,
+	.off_lossy_var    = 0x0000AD5C,
+	.bw_limit         = 0x0000AD1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe480_ubwc_regs_client_4 = {
+	.meta_addr        = 0x0000B040,
+	.meta_cfg         = 0x0000B044,
+	.mode_cfg         = 0x0000B048,
+	.stats_ctrl       = 0x0000B04C,
+	.ctrl_2           = 0x0000B050,
+	.lossy_thresh0    = 0x0000B054,
+	.lossy_thresh1    = 0x0000B058,
+	.off_lossy_var    = 0x0000B05C,
+	.bw_limit         = 0x0000B01C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe480_ubwc_regs_client_5 = {
+	.meta_addr        = 0x0000B140,
+	.meta_cfg         = 0x0000B144,
+	.mode_cfg         = 0x0000B148,
+	.stats_ctrl       = 0x0000B14C,
+	.ctrl_2           = 0x0000B150,
+	.lossy_thresh0    = 0x0000B154,
+	.lossy_thresh1    = 0x0000B158,
+	.off_lossy_var    = 0x0000B15C,
+	.bw_limit         = 0x0000B11C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static uint32_t vfe480_out_port_mid[][4] = {
+	{8, 0, 0, 0},
+	{9, 0, 0, 0},
+	{10, 0, 0, 0},
+	{32, 33, 34, 35},
+	{16, 0, 0, 0},
+	{17, 0, 0, 0},
+	{11, 12, 0, 0},
+	{20, 21, 22, 0},
+	{25, 26, 0, 0},
+	{40, 0, 0, 0},
+	{41, 0, 0, 0},
+	{42, 0, 0, 0},
+	{43, 0, 0, 0},
+	{44, 0, 0, 0},
+	{45, 0, 0, 0},
+	{46, 0, 0, 0},
+	{47, 0, 0, 0},
+	{48, 0, 0, 0},
+	{36, 37, 38, 39},
+	{18, 0, 0, 0},
+	{19, 0, 0, 0},
+	{23, 24, 0, 0},
+	{27, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe480_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x0000AA00,
+		.cgc_ovd                          = 0x0000AA08,
+		.comp_cfg_0                       = 0x0000AA0C,
+		.comp_cfg_1                       = 0x0000AA10,
+		.if_frameheader_cfg               = {
+			0x0000AA34,
+			0x0000AA38,
+			0x0000AA3C,
+			0x0000AA40,
+			0x0000AA44,
+			0x0000AA48,
+		},
+		.ubwc_static_ctrl                 = 0x0000AA58,
+		.pwr_iso_cfg                      = 0x0000AA5C,
+		.overflow_status_clear            = 0x0000AA60,
+		.ccif_violation_status            = 0x0000AA64,
+		.overflow_status                  = 0x0000AA68,
+		.image_size_violation_status      = 0x0000AA70,
+		.debug_status_top_cfg             = 0x0000AAD4,
+		.debug_status_top                 = 0x0000AAD8,
+		.test_bus_ctrl                    = 0x0000AADC,
+		.top_irq_mask_0                   = 0x0000003C,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe480_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x0000AA30,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = CAM_VFE_BUS_VER3_480_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 FULL Y */
+		{
+			.cfg                      = 0x0000AC00,
+			.image_addr               = 0x0000AC04,
+			.frame_incr               = 0x0000AC08,
+			.image_cfg_0              = 0x0000AC0C,
+			.image_cfg_1              = 0x0000AC10,
+			.image_cfg_2              = 0x0000AC14,
+			.packer_cfg               = 0x0000AC18,
+			.frame_header_addr        = 0x0000AC20,
+			.frame_header_incr        = 0x0000AC24,
+			.frame_header_cfg         = 0x0000AC28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000AC30,
+			.irq_subsample_pattern    = 0x0000AC34,
+			.framedrop_period         = 0x0000AC38,
+			.framedrop_pattern        = 0x0000AC3C,
+			.system_cache_cfg         = 0x0000AC60,
+			.burst_limit              = 0x0000AC64,
+			.addr_status_0            = 0x0000AC68,
+			.addr_status_1            = 0x0000AC6C,
+			.addr_status_2            = 0x0000AC70,
+			.addr_status_3            = 0x0000AC74,
+			.debug_status_cfg         = 0x0000AC78,
+			.debug_status_0           = 0x0000AC7C,
+			.debug_status_1           = 0x0000AC80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe480_ubwc_regs_client_0,
+		},
+		/* BUS Client 1 FULL C */
+		{
+			.cfg                      = 0x0000AD00,
+			.image_addr               = 0x0000AD04,
+			.frame_incr               = 0x0000AD08,
+			.image_cfg_0              = 0x0000AD0C,
+			.image_cfg_1              = 0x0000AD10,
+			.image_cfg_2              = 0x0000AD14,
+			.packer_cfg               = 0x0000AD18,
+			.frame_header_addr        = 0x0000AD20,
+			.frame_header_incr        = 0x0000AD24,
+			.frame_header_cfg         = 0x0000AD28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000AD30,
+			.irq_subsample_pattern    = 0x0000AD34,
+			.framedrop_period         = 0x0000AD38,
+			.framedrop_pattern        = 0x0000AD3C,
+			.system_cache_cfg         = 0x0000AD60,
+			.burst_limit              = 0x0000AD64,
+			.addr_status_0            = 0x0000AD68,
+			.addr_status_1            = 0x0000AD6C,
+			.addr_status_2            = 0x0000AD70,
+			.addr_status_3            = 0x0000AD74,
+			.debug_status_cfg         = 0x0000AD78,
+			.debug_status_0           = 0x0000AD7C,
+			.debug_status_1           = 0x0000AD80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe480_ubwc_regs_client_1,
+		},
+		/* BUS Client 2 DS4 */
+		{
+			.cfg                      = 0x0000AE00,
+			.image_addr               = 0x0000AE04,
+			.frame_incr               = 0x0000AE08,
+			.image_cfg_0              = 0x0000AE0C,
+			.image_cfg_1              = 0x0000AE10,
+			.image_cfg_2              = 0x0000AE14,
+			.packer_cfg               = 0x0000AE18,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000AE30,
+			.irq_subsample_pattern    = 0x0000AE34,
+			.framedrop_period         = 0x0000AE38,
+			.framedrop_pattern        = 0x0000AE3C,
+			.system_cache_cfg         = 0x0000AE60,
+			.burst_limit              = 0x0000AE64,
+			.addr_status_0            = 0x0000AE68,
+			.addr_status_1            = 0x0000AE6C,
+			.addr_status_2            = 0x0000AE70,
+			.addr_status_3            = 0x0000AE74,
+			.debug_status_cfg         = 0x0000AE78,
+			.debug_status_0           = 0x0000AE7C,
+			.debug_status_1           = 0x0000AE80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 DS16 */
+		{
+			.cfg                      = 0x0000AF00,
+			.image_addr               = 0x0000AF04,
+			.frame_incr               = 0x0000AF08,
+			.image_cfg_0              = 0x0000AF0C,
+			.image_cfg_1              = 0x0000AF10,
+			.image_cfg_2              = 0x0000AF14,
+			.packer_cfg               = 0x0000AF18,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000AF30,
+			.irq_subsample_pattern    = 0x0000AF34,
+			.framedrop_period         = 0x0000AF38,
+			.framedrop_pattern        = 0x0000AF3C,
+			.system_cache_cfg         = 0x0000AF60,
+			.burst_limit              = 0x0000AF64,
+			.addr_status_0            = 0x0000AF68,
+			.addr_status_1            = 0x0000AF6C,
+			.addr_status_2            = 0x0000AF70,
+			.addr_status_3            = 0x0000AF74,
+			.debug_status_cfg         = 0x0000AF78,
+			.debug_status_0           = 0x0000AF7C,
+			.debug_status_1           = 0x0000AF80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 DISP Y */
+		{
+			.cfg                      = 0x0000B000,
+			.image_addr               = 0x0000B004,
+			.frame_incr               = 0x0000B008,
+			.image_cfg_0              = 0x0000B00C,
+			.image_cfg_1              = 0x0000B010,
+			.image_cfg_2              = 0x0000B014,
+			.packer_cfg               = 0x0000B018,
+			.frame_header_addr        = 0x0000B020,
+			.frame_header_incr        = 0x0000B024,
+			.frame_header_cfg         = 0x0000B028,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B030,
+			.irq_subsample_pattern    = 0x0000B034,
+			.framedrop_period         = 0x0000B038,
+			.framedrop_pattern        = 0x0000B03C,
+			.system_cache_cfg         = 0x0000B060,
+			.burst_limit              = 0x0000B064,
+			.addr_status_0            = 0x0000B068,
+			.addr_status_1            = 0x0000B06C,
+			.addr_status_2            = 0x0000B070,
+			.addr_status_3            = 0x0000B074,
+			.debug_status_cfg         = 0x0000B078,
+			.debug_status_0           = 0x0000B07C,
+			.debug_status_1           = 0x0000B080,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe480_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 DISP C */
+		{
+			.cfg                      = 0x0000B100,
+			.image_addr               = 0x0000B104,
+			.frame_incr               = 0x0000B108,
+			.image_cfg_0              = 0x0000B10C,
+			.image_cfg_1              = 0x0000B110,
+			.image_cfg_2              = 0x0000B114,
+			.packer_cfg               = 0x0000B118,
+			.frame_header_addr        = 0x0000B120,
+			.frame_header_incr        = 0x0000B124,
+			.frame_header_cfg         = 0x0000B128,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B130,
+			.irq_subsample_pattern    = 0x0000B134,
+			.framedrop_period         = 0x0000B138,
+			.framedrop_pattern        = 0x0000B13C,
+			.system_cache_cfg         = 0x0000B160,
+			.burst_limit              = 0x0000B164,
+			.addr_status_0            = 0x0000B168,
+			.addr_status_1            = 0x0000B16C,
+			.addr_status_2            = 0x0000B170,
+			.addr_status_3            = 0x0000B174,
+			.debug_status_cfg         = 0x0000B178,
+			.debug_status_0           = 0x0000B17C,
+			.debug_status_1           = 0x0000B180,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe480_ubwc_regs_client_5,
+		},
+		/* BUS Client 6 DISP DS4 */
+		{
+			.cfg                      = 0x0000B200,
+			.image_addr               = 0x0000B204,
+			.frame_incr               = 0x0000B208,
+			.image_cfg_0              = 0x0000B20C,
+			.image_cfg_1              = 0x0000B210,
+			.image_cfg_2              = 0x0000B214,
+			.packer_cfg               = 0x0000B218,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B230,
+			.irq_subsample_pattern    = 0x0000B234,
+			.framedrop_period         = 0x0000B238,
+			.framedrop_pattern        = 0x0000B23C,
+			.system_cache_cfg         = 0x0000B260,
+			.burst_limit              = 0x0000B264,
+			.addr_status_0            = 0x0000B268,
+			.addr_status_1            = 0x0000B26C,
+			.addr_status_2            = 0x0000B270,
+			.addr_status_3            = 0x0000B274,
+			.debug_status_cfg         = 0x0000B278,
+			.debug_status_0           = 0x0000B27C,
+			.debug_status_1           = 0x0000B280,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 DISP DS16 */
+		{
+			.cfg                      = 0x0000B300,
+			.image_addr               = 0x0000B304,
+			.frame_incr               = 0x0000B308,
+			.image_cfg_0              = 0x0000B30C,
+			.image_cfg_1              = 0x0000B310,
+			.image_cfg_2              = 0x0000B314,
+			.packer_cfg               = 0x0000B318,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B330,
+			.irq_subsample_pattern    = 0x0000B334,
+			.framedrop_period         = 0x0000B338,
+			.framedrop_pattern        = 0x0000B33C,
+			.system_cache_cfg         = 0x0000B360,
+			.burst_limit              = 0x0000B364,
+			.addr_status_0            = 0x0000B368,
+			.addr_status_1            = 0x0000B36C,
+			.addr_status_2            = 0x0000B370,
+			.addr_status_3            = 0x0000B374,
+			.debug_status_cfg         = 0x0000B378,
+			.debug_status_0           = 0x0000B37C,
+			.debug_status_1           = 0x0000B380,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 FD Y */
+		{
+			.cfg                      = 0x0000B400,
+			.image_addr               = 0x0000B404,
+			.frame_incr               = 0x0000B408,
+			.image_cfg_0              = 0x0000B40C,
+			.image_cfg_1              = 0x0000B410,
+			.image_cfg_2              = 0x0000B414,
+			.packer_cfg               = 0x0000B418,
+			.frame_header_addr        = 0x0000B420,
+			.frame_header_incr        = 0x0000B424,
+			.frame_header_cfg         = 0x0000B428,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B430,
+			.irq_subsample_pattern    = 0x0000B434,
+			.framedrop_period         = 0x0000B438,
+			.framedrop_pattern        = 0x0000B43C,
+			.system_cache_cfg         = 0x0000B460,
+			.burst_limit              = 0x0000B464,
+			.addr_status_0            = 0x0000B468,
+			.addr_status_1            = 0x0000B46C,
+			.addr_status_2            = 0x0000B470,
+			.addr_status_3            = 0x0000B474,
+			.debug_status_cfg         = 0x0000B478,
+			.debug_status_0           = 0x0000B47C,
+			.debug_status_1           = 0x0000B480,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 FD C */
+		{
+			.cfg                      = 0x0000B500,
+			.image_addr               = 0x0000B504,
+			.frame_incr               = 0x0000B508,
+			.image_cfg_0              = 0x0000B50C,
+			.image_cfg_1              = 0x0000B510,
+			.image_cfg_2              = 0x0000B514,
+			.packer_cfg               = 0x0000B518,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B530,
+			.irq_subsample_pattern    = 0x0000B534,
+			.framedrop_period         = 0x0000B538,
+			.framedrop_pattern        = 0x0000B53C,
+			.system_cache_cfg         = 0x0000B560,
+			.burst_limit              = 0x0000B564,
+			.addr_status_0            = 0x0000B568,
+			.addr_status_1            = 0x0000B56C,
+			.addr_status_2            = 0x0000B570,
+			.addr_status_3            = 0x0000B574,
+			.debug_status_cfg         = 0x0000B578,
+			.debug_status_0           = 0x0000B57C,
+			.debug_status_1           = 0x0000B580,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 PIXEL RAW */
+		{
+			.cfg                      = 0x0000B600,
+			.image_addr               = 0x0000B604,
+			.frame_incr               = 0x0000B608,
+			.image_cfg_0              = 0x0000B60C,
+			.image_cfg_1              = 0x0000B610,
+			.image_cfg_2              = 0x0000B614,
+			.packer_cfg               = 0x0000B618,
+			.frame_header_addr        = 0x0000B620,
+			.frame_header_incr        = 0x0000B624,
+			.frame_header_cfg         = 0x0000B628,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B630,
+			.irq_subsample_pattern    = 0x0000B634,
+			.framedrop_period         = 0x0000B638,
+			.framedrop_pattern        = 0x0000B63C,
+			.system_cache_cfg         = 0x0000B660,
+			.burst_limit              = 0x0000B664,
+			.addr_status_0            = 0x0000B668,
+			.addr_status_1            = 0x0000B66C,
+			.addr_status_2            = 0x0000B670,
+			.addr_status_3            = 0x0000B674,
+			.debug_status_cfg         = 0x0000B678,
+			.debug_status_0           = 0x0000B67C,
+			.debug_status_1           = 0x0000B680,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 CAMIF PD */
+		{
+			.cfg                      = 0x0000B700,
+			.image_addr               = 0x0000B704,
+			.frame_incr               = 0x0000B708,
+			.image_cfg_0              = 0x0000B70C,
+			.image_cfg_1              = 0x0000B710,
+			.image_cfg_2              = 0x0000B714,
+			.packer_cfg               = 0x0000B718,
+			.frame_header_addr        = 0x0000B720,
+			.frame_header_incr        = 0x0000B724,
+			.frame_header_cfg         = 0x0000B728,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B730,
+			.irq_subsample_pattern    = 0x0000B734,
+			.framedrop_period         = 0x0000B738,
+			.framedrop_pattern        = 0x0000B73C,
+			.system_cache_cfg         = 0x0000B760,
+			.burst_limit              = 0x0000B764,
+			.addr_status_0            = 0x0000B768,
+			.addr_status_1            = 0x0000B76C,
+			.addr_status_2            = 0x0000B770,
+			.addr_status_3            = 0x0000B774,
+			.debug_status_cfg         = 0x0000B778,
+			.debug_status_0           = 0x0000B77C,
+			.debug_status_1           = 0x0000B780,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 STATS HDR BE */
+		{
+			.cfg                      = 0x0000B800,
+			.image_addr               = 0x0000B804,
+			.frame_incr               = 0x0000B808,
+			.image_cfg_0              = 0x0000B80C,
+			.image_cfg_1              = 0x0000B810,
+			.image_cfg_2              = 0x0000B814,
+			.packer_cfg               = 0x0000B818,
+			.frame_header_addr        = 0x0000B820,
+			.frame_header_incr        = 0x0000B824,
+			.frame_header_cfg         = 0x0000B828,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B830,
+			.irq_subsample_pattern    = 0x0000B834,
+			.framedrop_period         = 0x0000B838,
+			.framedrop_pattern        = 0x0000B83C,
+			.system_cache_cfg         = 0x0000B860,
+			.burst_limit              = 0x0000B864,
+			.addr_status_0            = 0x0000B868,
+			.addr_status_1            = 0x0000B86C,
+			.addr_status_2            = 0x0000B870,
+			.addr_status_3            = 0x0000B874,
+			.debug_status_cfg         = 0x0000B878,
+			.debug_status_0           = 0x0000B87C,
+			.debug_status_1           = 0x0000B880,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 STATS HDR BHIST */
+		{
+			.cfg                      = 0x0000B900,
+			.image_addr               = 0x0000B904,
+			.frame_incr               = 0x0000B908,
+			.image_cfg_0              = 0x0000B90C,
+			.image_cfg_1              = 0x0000B910,
+			.image_cfg_2              = 0x0000B914,
+			.packer_cfg               = 0x0000B918,
+			.frame_header_addr        = 0x0000B920,
+			.frame_header_incr        = 0x0000B924,
+			.frame_header_cfg         = 0x0000B928,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B930,
+			.irq_subsample_pattern    = 0x0000B934,
+			.framedrop_period         = 0x0000B938,
+			.framedrop_pattern        = 0x0000B93C,
+			.system_cache_cfg         = 0x0000B960,
+			.burst_limit              = 0x0000B964,
+			.addr_status_0            = 0x0000B968,
+			.addr_status_1            = 0x0000B96C,
+			.addr_status_2            = 0x0000B970,
+			.addr_status_3            = 0x0000B974,
+			.debug_status_cfg         = 0x0000B978,
+			.debug_status_0           = 0x0000B97C,
+			.debug_status_1           = 0x0000B980,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 STATS TINTLESS BG */
+		{
+			.cfg                      = 0x0000BA00,
+			.image_addr               = 0x0000BA04,
+			.frame_incr               = 0x0000BA08,
+			.image_cfg_0              = 0x0000BA0C,
+			.image_cfg_1              = 0x0000BA10,
+			.image_cfg_2              = 0x0000BA14,
+			.packer_cfg               = 0x0000BA18,
+			.frame_header_addr        = 0x0000BA20,
+			.frame_header_incr        = 0x0000BA24,
+			.frame_header_cfg         = 0x0000BA28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BA30,
+			.irq_subsample_pattern    = 0x0000BA34,
+			.framedrop_period         = 0x0000BA38,
+			.framedrop_pattern        = 0x0000BA3C,
+			.system_cache_cfg         = 0x0000BA60,
+			.burst_limit              = 0x0000BA64,
+			.addr_status_0            = 0x0000BA68,
+			.addr_status_1            = 0x0000BA6C,
+			.addr_status_2            = 0x0000BA70,
+			.addr_status_3            = 0x0000BA74,
+			.debug_status_cfg         = 0x0000BA78,
+			.debug_status_0           = 0x0000BA7C,
+			.debug_status_1           = 0x0000BA80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 STATS AWB BG */
+		{
+			.cfg                      = 0x0000BB00,
+			.image_addr               = 0x0000BB04,
+			.frame_incr               = 0x0000BB08,
+			.image_cfg_0              = 0x0000BB0C,
+			.image_cfg_1              = 0x0000BB10,
+			.image_cfg_2              = 0x0000BB14,
+			.packer_cfg               = 0x0000BB18,
+			.frame_header_addr        = 0x0000BB20,
+			.frame_header_incr        = 0x0000BB24,
+			.frame_header_cfg         = 0x0000BB28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BB30,
+			.irq_subsample_pattern    = 0x0000BB34,
+			.framedrop_period         = 0x0000BB38,
+			.framedrop_pattern        = 0x0000BB3C,
+			.system_cache_cfg         = 0x0000BB60,
+			.burst_limit              = 0x0000BB64,
+			.addr_status_0            = 0x0000BB68,
+			.addr_status_1            = 0x0000BB6C,
+			.addr_status_2            = 0x0000BB70,
+			.addr_status_3            = 0x0000BB74,
+			.debug_status_cfg         = 0x0000BB78,
+			.debug_status_0           = 0x0000BB7C,
+			.debug_status_1           = 0x0000BB80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 STATS BHIST */
+		{
+			.cfg                      = 0x0000BC00,
+			.image_addr               = 0x0000BC04,
+			.frame_incr               = 0x0000BC08,
+			.image_cfg_0              = 0x0000BC0C,
+			.image_cfg_1              = 0x0000BC10,
+			.image_cfg_2              = 0x0000BC14,
+			.packer_cfg               = 0x0000BC18,
+			.frame_header_addr        = 0x0000BC20,
+			.frame_header_incr        = 0x0000BC24,
+			.frame_header_cfg         = 0x0000BC28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BC30,
+			.irq_subsample_pattern    = 0x0000BC34,
+			.framedrop_period         = 0x0000BC38,
+			.framedrop_pattern        = 0x0000BC3C,
+			.system_cache_cfg         = 0x0000BC60,
+			.burst_limit              = 0x0000BC64,
+			.addr_status_0            = 0x0000BC68,
+			.addr_status_1            = 0x0000BC6C,
+			.addr_status_2            = 0x0000BC70,
+			.addr_status_3            = 0x0000BC74,
+			.debug_status_cfg         = 0x0000BC78,
+			.debug_status_0           = 0x0000BC7C,
+			.debug_status_1           = 0x0000BC80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 STATS RS */
+		{
+			.cfg                      = 0x0000BD00,
+			.image_addr               = 0x0000BD04,
+			.frame_incr               = 0x0000BD08,
+			.image_cfg_0              = 0x0000BD0C,
+			.image_cfg_1              = 0x0000BD10,
+			.image_cfg_2              = 0x0000BD14,
+			.packer_cfg               = 0x0000BD18,
+			.frame_header_addr        = 0x0000BD20,
+			.frame_header_incr        = 0x0000BD24,
+			.frame_header_cfg         = 0x0000BD28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BD30,
+			.irq_subsample_pattern    = 0x0000BD34,
+			.framedrop_period         = 0x0000BD38,
+			.framedrop_pattern        = 0x0000BD3C,
+			.system_cache_cfg         = 0x0000BD60,
+			.burst_limit              = 0x0000BD64,
+			.addr_status_0            = 0x0000BD68,
+			.addr_status_1            = 0x0000BD6C,
+			.addr_status_2            = 0x0000BD70,
+			.addr_status_3            = 0x0000BD74,
+			.debug_status_cfg         = 0x0000BD78,
+			.debug_status_0           = 0x0000BD7C,
+			.debug_status_1           = 0x0000BD80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 STATS CS */
+		{
+			.cfg                      = 0x0000BE00,
+			.image_addr               = 0x0000BE04,
+			.frame_incr               = 0x0000BE08,
+			.image_cfg_0              = 0x0000BE0C,
+			.image_cfg_1              = 0x0000BE10,
+			.image_cfg_2              = 0x0000BE14,
+			.packer_cfg               = 0x0000BE18,
+			.frame_header_addr        = 0x0000BE20,
+			.frame_header_incr        = 0x0000BE24,
+			.frame_header_cfg         = 0x0000BE28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BE30,
+			.irq_subsample_pattern    = 0x0000BE34,
+			.framedrop_period         = 0x0000BE38,
+			.framedrop_pattern        = 0x0000BE3C,
+			.system_cache_cfg         = 0x0000BE60,
+			.burst_limit              = 0x0000BE64,
+			.addr_status_0            = 0x0000BE68,
+			.addr_status_1            = 0x0000BE6C,
+			.addr_status_2            = 0x0000BE70,
+			.addr_status_3            = 0x0000BE74,
+			.debug_status_cfg         = 0x0000BE78,
+			.debug_status_0           = 0x0000BE7C,
+			.debug_status_1           = 0x0000BE80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 STATS IHIST */
+		{
+			.cfg                      = 0x0000BF00,
+			.image_addr               = 0x0000BF04,
+			.frame_incr               = 0x0000BF08,
+			.image_cfg_0              = 0x0000BF0C,
+			.image_cfg_1              = 0x0000BF10,
+			.image_cfg_2              = 0x0000BF14,
+			.packer_cfg               = 0x0000BF18,
+			.frame_header_addr        = 0x0000BF20,
+			.frame_header_incr        = 0x0000BF24,
+			.frame_header_cfg         = 0x0000BF28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BF30,
+			.irq_subsample_pattern    = 0x0000BF34,
+			.framedrop_period         = 0x0000BF38,
+			.framedrop_pattern        = 0x0000BF3C,
+			.system_cache_cfg         = 0x0000BF60,
+			.burst_limit              = 0x0000BF64,
+			.addr_status_0            = 0x0000BF68,
+			.addr_status_1            = 0x0000BF6C,
+			.addr_status_2            = 0x0000BF70,
+			.addr_status_3            = 0x0000BF74,
+			.debug_status_cfg         = 0x0000BF78,
+			.debug_status_0           = 0x0000BF7C,
+			.debug_status_1           = 0x0000BF80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 STATS BF */
+		{
+			.cfg                      = 0x0000C000,
+			.image_addr               = 0x0000C004,
+			.frame_incr               = 0x0000C008,
+			.image_cfg_0              = 0x0000C00C,
+			.image_cfg_1              = 0x0000C010,
+			.image_cfg_2              = 0x0000C014,
+			.packer_cfg               = 0x0000C018,
+			.frame_header_addr        = 0x0000C020,
+			.frame_header_incr        = 0x0000C024,
+			.frame_header_cfg         = 0x0000C028,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000C030,
+			.irq_subsample_pattern    = 0x0000C034,
+			.framedrop_period         = 0x0000C038,
+			.framedrop_pattern        = 0x0000C03C,
+			.system_cache_cfg         = 0x0000C060,
+			.burst_limit              = 0x0000C064,
+			.addr_status_0            = 0x0000C068,
+			.addr_status_1            = 0x0000C06C,
+			.addr_status_2            = 0x0000C070,
+			.addr_status_3            = 0x0000C074,
+			.debug_status_cfg         = 0x0000C078,
+			.debug_status_0           = 0x0000C07C,
+			.debug_status_1           = 0x0000C080,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_8,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 21 PDAF V2.0 */
+		{
+			.cfg                      = 0x0000C100,
+			.image_addr               = 0x0000C104,
+			.frame_incr               = 0x0000C108,
+			.image_cfg_0              = 0x0000C10C,
+			.image_cfg_1              = 0x0000C110,
+			.image_cfg_2              = 0x0000C114,
+			.packer_cfg               = 0x0000C118,
+			.frame_header_addr        = 0x0000C120,
+			.frame_header_incr        = 0x0000C124,
+			.frame_header_cfg         = 0x0000C128,
+			.line_done_cfg            = 0x0000C12C,
+			.irq_subsample_period     = 0x0000C130,
+			.irq_subsample_pattern    = 0x0000C134,
+			.framedrop_period         = 0x0000C138,
+			.framedrop_pattern        = 0x0000C13C,
+			.system_cache_cfg         = 0x0000C160,
+			.burst_limit              = 0x0000C164,
+			.addr_status_0            = 0x0000C168,
+			.addr_status_1            = 0x0000C16C,
+			.addr_status_2            = 0x0000C170,
+			.addr_status_3            = 0x0000C174,
+			.debug_status_cfg         = 0x0000C178,
+			.debug_status_0           = 0x0000C17C,
+			.debug_status_1           = 0x0000C180,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_9,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 22 LCR */
+		{
+			.cfg                      = 0x0000C200,
+			.image_addr               = 0x0000C204,
+			.frame_incr               = 0x0000C208,
+			.image_cfg_0              = 0x0000C20C,
+			.image_cfg_1              = 0x0000C210,
+			.image_cfg_2              = 0x0000C214,
+			.packer_cfg               = 0x0000C218,
+			.frame_header_addr        = 0x0000C220,
+			.frame_header_incr        = 0x0000C224,
+			.frame_header_cfg         = 0x0000C228,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000C230,
+			.irq_subsample_pattern    = 0x0000C234,
+			.framedrop_period         = 0x0000C238,
+			.framedrop_pattern        = 0x0000C23C,
+			.system_cache_cfg         = 0x0000C260,
+			.burst_limit              = 0x0000C264,
+			.addr_status_0            = 0x0000C268,
+			.addr_status_1            = 0x0000C26C,
+			.addr_status_2            = 0x0000C270,
+			.addr_status_3            = 0x0000C274,
+			.debug_status_cfg         = 0x0000C278,
+			.debug_status_0           = 0x0000C27C,
+			.debug_status_1           = 0x0000C280,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_10,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 RDI0 */
+		{
+			.cfg                      = 0x0000C300,
+			.image_addr               = 0x0000C304,
+			.frame_incr               = 0x0000C308,
+			.image_cfg_0              = 0x0000C30C,
+			.image_cfg_1              = 0x0000C310,
+			.image_cfg_2              = 0x0000C314,
+			.packer_cfg               = 0x0000C318,
+			.frame_header_addr        = 0x0000C320,
+			.frame_header_incr        = 0x0000C324,
+			.frame_header_cfg         = 0x0000C328,
+			.line_done_cfg            = 0x0000C32C,
+			.irq_subsample_period     = 0x0000C330,
+			.irq_subsample_pattern    = 0x0000C334,
+			.framedrop_period         = 0x0000C338,
+			.framedrop_pattern        = 0x0000C33C,
+			.system_cache_cfg         = 0x0000C360,
+			.burst_limit              = 0x0000C364,
+			.addr_status_0            = 0x0000C368,
+			.addr_status_1            = 0x0000C36C,
+			.addr_status_2            = 0x0000C370,
+			.addr_status_3            = 0x0000C374,
+			.debug_status_cfg         = 0x0000C378,
+			.debug_status_0           = 0x0000C37C,
+			.debug_status_1           = 0x0000C380,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 24 RDI1 */
+		{
+			.cfg                      = 0x0000C400,
+			.image_addr               = 0x0000C404,
+			.frame_incr               = 0x0000C408,
+			.image_cfg_0              = 0x0000C40C,
+			.image_cfg_1              = 0x0000C410,
+			.image_cfg_2              = 0x0000C414,
+			.packer_cfg               = 0x0000C418,
+			.frame_header_addr        = 0x0000C420,
+			.frame_header_incr        = 0x0000C424,
+			.frame_header_cfg         = 0x0000C428,
+			.line_done_cfg            = 0x0000C42C,
+			.irq_subsample_period     = 0x0000C430,
+			.irq_subsample_pattern    = 0x0000C434,
+			.framedrop_period         = 0x0000C438,
+			.framedrop_pattern        = 0x0000C43C,
+			.system_cache_cfg         = 0x0000C460,
+			.burst_limit              = 0x0000C464,
+			.addr_status_0            = 0x0000C468,
+			.addr_status_1            = 0x0000C46C,
+			.addr_status_2            = 0x0000C470,
+			.addr_status_3            = 0x0000C474,
+			.debug_status_cfg         = 0x0000C478,
+			.debug_status_0           = 0x0000C47C,
+			.debug_status_1           = 0x0000C480,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_12,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 25 RDI2 */
+		{
+			.cfg                      = 0x0000C500,
+			.image_addr               = 0x0000C504,
+			.frame_incr               = 0x0000C508,
+			.image_cfg_0              = 0x0000C50C,
+			.image_cfg_1              = 0x0000C510,
+			.image_cfg_2              = 0x0000C514,
+			.packer_cfg               = 0x0000C518,
+			.frame_header_addr        = 0x0000C520,
+			.frame_header_incr        = 0x0000C524,
+			.frame_header_cfg         = 0x0000C528,
+			.line_done_cfg            = 0x0000C52C,
+			.irq_subsample_period     = 0x0000C530,
+			.irq_subsample_pattern    = 0x0000C534,
+			.framedrop_period         = 0x0000C538,
+			.framedrop_pattern        = 0x0000C53C,
+			.system_cache_cfg         = 0x0000C560,
+			.burst_limit              = 0x0000C564,
+			.addr_status_0            = 0x0000C568,
+			.addr_status_1            = 0x0000C56C,
+			.addr_status_2            = 0x0000C570,
+			.addr_status_3            = 0x0000C574,
+			.debug_status_cfg         = 0x0000C578,
+			.debug_status_0           = 0x0000C57C,
+			.debug_status_1           = 0x0000C580,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_13,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 23,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid           = vfe480_out_port_mid[0],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				23,
+			},
+			.name          = {
+				"RDI_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.mid           = vfe480_out_port_mid[1],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				24,
+			},
+			.name          = {
+				"RDI_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_5,
+			.mid           = vfe480_out_port_mid[2],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				25,
+			},
+			.name          = {
+				"RDI_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[3],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				0,
+				1,
+			},
+			.name          = {
+				"FULL_Y",
+				"FULL_C",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[4],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"DS_4",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[5],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"DS_16",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[6],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				10,
+			},
+			.name          = {
+				"PIXEL_RAW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[7],
+			.num_mid       = 3,
+			.num_wm        = 2,
+			.wm_idx        = {
+				8,
+				9,
+			},
+			.name          = {
+				"FD_Y",
+				"FD_C",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[8],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				11,
+			},
+			.name          = {
+				"PDAF",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[9],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				12,
+			},
+			.name          = {
+				"STATS_HDR_BE",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[10],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				13,
+			},
+			.name          = {
+				"STATS_HDR_BHIST",
+			},
+
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[11],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				14,
+			},
+			.name          = {
+				"STATS_TL_BG",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[12],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				20,
+			},
+			.name          = {
+				"STATS_BF",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[13],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				15,
+			},
+			.name          = {
+				"STATS_AWB_BGB",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[14],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				16,
+			},
+			.name          = {
+				"STATS_BHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[15],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				17,
+			},
+			.name          = {
+				"STATS_RS",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[16],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				18,
+			},
+			.name          = {
+				"STATS_CS",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[17],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				19,
+			},
+			.name          = {
+				"IHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[18],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				4,
+				5,
+			},
+			.name          = {
+				"FULL_DISP_Y",
+				"FULL_DISP_C",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+
+			.mid           = vfe480_out_port_mid[19],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				6,
+			},
+			.name          = {
+				"DISP_DS_4",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe480_out_port_mid[20],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				7,
+			},
+			.name          = {
+				"DISP_DS_16",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe480_out_port_mid[21],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				21,
+			},
+			.name          = {
+				"2PD",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LCR,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid           = vfe480_out_port_mid[22],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				22,
+			},
+			.name          = {
+				"LCR",
+			},
+		},
+	},
+	.num_cons_err = 21,
+	.constraint_error_list = {
+		{
+			.bitmask = BIT(0),
+			.error_description = "PPC 1x1 input not supported"
+		},
+		{
+			.bitmask = BIT(1),
+			.error_description = "PPC 1x2 input not supported"
+		},
+		{
+			.bitmask = BIT(2),
+			.error_description = "PPC 2x1 input not supported"
+		},
+		{
+			.bitmask = BIT(3),
+			.error_description = "PPC 2x2 input not supported"
+		},
+		{
+			.bitmask = BIT(4),
+			.error_description = "Pack 8 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(5),
+			.error_description = "Pack 16 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(6),
+			.error_description = "Pack 32 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(7),
+			.error_description = "Pack 64 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(8),
+			.error_description = "Pack 128 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(9),
+			.error_description = "UBWC NV12 format not supported"
+		},
+		{
+			.bitmask = BIT(10),
+			.error_description = "UBWC NV12 4R format not supported"
+		},
+		{
+			.bitmask = BIT(11),
+			.error_description = "UBWC TP10 format not supported"
+		},
+		{
+			.bitmask = BIT(12),
+			.error_description = "Frame based Mode not supported"
+		},
+		{
+			.bitmask = BIT(13),
+			.error_description = "Index based Mode not supported"
+		},
+		{
+			.bitmask = BIT(14),
+			.error_description = "Image address unalign"
+		},
+		{
+			.bitmask = BIT(15),
+			.error_description = "UBWC address unalign"
+		},
+		{
+			.bitmask = BIT(16),
+			.error_description = "Frame Header address unalign"
+		},
+		{
+			.bitmask = BIT(17),
+			.error_description = "X Initialization unalign"
+		},
+		{
+			.bitmask = BIT(18),
+			.error_description = "Image Width unalign"
+		},
+		{
+			.bitmask = BIT(19),
+			.error_description = "Image Height unalign"
+		},
+		{
+			.bitmask = BIT(20),
+			.error_description = "Meta Stride unalign"
+		},
+	},
+
+	.num_comp_grp    = 14,
+	.comp_done_mask = {
+		BIT(6), BIT(7), BIT(8), BIT(9), BIT(10),
+		BIT(11), BIT(12), BIT(13), BIT(14),
+		BIT(15), BIT(16), BIT(17), BIT(18), BIT(19),
+	},
+	.top_irq_shift   = 7,
+	.support_consumed_addr = true,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 25,
+	.supported_irq =  CAM_VFE_HW_IRQ_CAP_BUF_DONE | CAM_VFE_HW_IRQ_CAP_RUP,
+	.comp_cfg_needed = true,
+	.pack_align_shift = 4,
+};
+
+static struct cam_irq_register_set vfe480_bus_rd_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x0000A810,
+		.clear_reg_offset  = 0x0000A814,
+		.status_reg_offset = 0x0000A81C,
+	},
+};
+
+static struct cam_vfe_bus_rd_ver1_hw_info vfe480_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x0000A800,
+		.hw_capability                = 0x0000A804,
+		.sw_reset                     = 0x0000A808,
+		.cgc_ovd                      = 0x0000A80C,
+		.pwr_iso_cfg                  = 0x0000A834,
+		.input_if_cmd                 = 0x0000A820,
+		.test_bus_ctrl                = 0x0000A848,
+		.irq_reg_info = {
+			.num_registers         = 1,
+			.irq_reg_set           = vfe480_bus_rd_irq_reg,
+			.global_irq_cmd_offset = 0x0000A818,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+	},
+	.num_client = 1,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x0000A850,
+			.image_addr               = 0x0000A858,
+			.buf_size                 = 0x0000A85C,
+			.stride                   = 0x0000A860,
+			.unpacker_cfg             = 0x0000A864,
+			.latency_buf_allocation   = 0x0000A878,
+			.burst_limit              = 0x0000A880,
+		},
+	},
+	.num_bus_rd_resc = 1,
+	.vfe_bus_rd_hw_info = {
+		{
+			.vfe_bus_rd_type = CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 8,
+};
+
+static struct cam_vfe_irq_hw_info vfe480_irq_hw_info = {
+	.reset_mask    = BIT(0),
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_INT_CSID,
+	.top_irq_reg       = &vfe480_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe480_hw_info = {
+	.irq_hw_info                   = &vfe480_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe480_bus_hw_info,
+
+	.bus_rd_version                = CAM_VFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &vfe480_bus_rd_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_3_0,
+	.top_hw_info                   = &vfe480_top_hw_info,
+};
+
+#endif /* _CAM_VFE480_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe570.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe570.h
@@ -0,0 +1,129 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE570_H_
+#define _CAM_VFE570_H_
+#include "cam_vfe480.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_core.h"
+
+static struct cam_vfe_camif_ver3_reg_data vfe_570_camif_reg_data = {
+	.pp_extern_reg_update_shift      = 4,
+	.dual_pd_extern_reg_update_shift = 17,
+	.extern_reg_update_mask          = 1,
+	.dual_ife_pix_en_shift           = 3,
+	.dual_ife_sync_sel_shift         = 18,
+	.operating_mode_shift            = 11,
+	.input_mux_sel_shift             = 5,
+	.pixel_pattern_shift             = 24,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 24,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 23,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x41,
+	.epoch_line_cfg                  = 0x00000014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.epoch1_irq_mask                 = 0x00000008,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x82000200,
+	.error_irq_mask2                 = 0x30301F80,
+	.subscribe_irq_mask1             = 0x00000007,
+	.enable_diagnostic_hw            = 0x1,
+	.pp_camif_cfg_en_shift           = 0,
+	.pp_camif_cfg_ife_out_en_shift   = 8,
+	.top_debug_cfg_en                = 1,
+	.dual_vfe_sync_mask              = 0x3,
+	.input_bayer_fmt                 = 0,
+	.input_yuv_fmt                   = 1,
+
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe570_camif_rdi1_reg_data = {
+	.extern_reg_update_shift         = 0,
+	.input_mux_sel_shift             = 7,
+	.reg_update_cmd_data             = 0x4,
+	.epoch_line_cfg                  = 0x0,
+	.sof_irq_mask                    = 0x100,
+	.epoch0_irq_mask                 = 0x400,
+	.epoch1_irq_mask                 = 0x800,
+	.eof_irq_mask                    = 0x200,
+	.error_irq_mask0                 = 0x10000000,
+	.error_irq_mask2                 = 0x40000,
+	.subscribe_irq_mask1             = 0x300,
+	.enable_diagnostic_hw            = 0x1,
+};
+
+struct cam_vfe_camif_lite_ver3_hw_info
+	vfe570_rdi_hw_info_arr[CAM_VFE_RDI_VER2_MAX] = {
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[0],
+		.reg_data       = &vfe480_camif_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[1],
+		.reg_data       = &vfe570_camif_rdi1_reg_data,
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[2],
+		.reg_data       = &vfe480_camif_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver3_hw_info vfe570_top_hw_info = {
+	.common_reg = &vfe480_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_reg      = &vfe480_camif_reg,
+		.reg_data       = &vfe_570_camif_reg_data,
+		},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_pd,
+		.reg_data       = &vfe480_camif_pd_reg_data,
+		},
+	.rdi_hw_info[0] = &vfe570_rdi_hw_info_arr[0],
+	.rdi_hw_info[1] = &vfe570_rdi_hw_info_arr[1],
+	.rdi_hw_info[2] = &vfe570_rdi_hw_info_arr[2],
+	.lcr_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_lcr,
+		.reg_data       = &vfe480_camif_lcr_reg_data,
+		},
+	.num_mux = 6,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_3_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_LCR_VER_1_0,
+	},
+	.num_path_port_map = 2,
+	.path_port_map = {
+		{CAM_ISP_HW_VFE_IN_LCR, CAM_ISP_IFE_OUT_RES_LCR},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_2PD},
+	},
+};
+
+static struct cam_vfe_hw_info cam_vfe570_hw_info = {
+	.irq_hw_info                   = &vfe480_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe480_bus_hw_info,
+
+	.bus_rd_version                = CAM_VFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &vfe480_bus_rd_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_3_0,
+	.top_hw_info                   = &vfe570_top_hw_info,
+};
+
+#endif /* _CAM_VFE570_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe580.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe580.h
@@ -0,0 +1,129 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE580_H_
+#define _CAM_VFE580_H_
+#include "cam_vfe480.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_core.h"
+
+static struct cam_vfe_camif_ver3_reg_data vfe_580_camif_reg_data = {
+	.pp_extern_reg_update_shift      = 4,
+	.dual_pd_extern_reg_update_shift = 17,
+	.extern_reg_update_mask          = 1,
+	.dual_ife_pix_en_shift           = 3,
+	.dual_ife_sync_sel_shift         = 18,
+	.operating_mode_shift            = 11,
+	.input_mux_sel_shift             = 5,
+	.pixel_pattern_shift             = 24,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 24,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 23,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x41,
+	.epoch_line_cfg                  = 0x00000014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.epoch1_irq_mask                 = 0x00000008,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x82000200,
+	.error_irq_mask2                 = 0x30301F80,
+	.subscribe_irq_mask1             = 0x00000007,
+	.enable_diagnostic_hw            = 0x1,
+	.pp_camif_cfg_en_shift           = 0,
+	.pp_camif_cfg_ife_out_en_shift   = 8,
+	.top_debug_cfg_en                = 1,
+	.dual_vfe_sync_mask              = 0x3,
+	.input_bayer_fmt                 = 0,
+	.input_yuv_fmt                   = 1,
+
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe580_camif_rdi1_reg_data = {
+	.extern_reg_update_shift         = 0,
+	.input_mux_sel_shift             = 7,
+	.reg_update_cmd_data             = 0x4,
+	.epoch_line_cfg                  = 0x0,
+	.sof_irq_mask                    = 0x100,
+	.epoch0_irq_mask                 = 0x400,
+	.epoch1_irq_mask                 = 0x800,
+	.eof_irq_mask                    = 0x200,
+	.error_irq_mask0                 = 0x10000000,
+	.error_irq_mask2                 = 0x40000,
+	.subscribe_irq_mask1             = 0x300,
+	.enable_diagnostic_hw            = 0x1,
+};
+
+struct cam_vfe_camif_lite_ver3_hw_info
+	vfe580_rdi_hw_info_arr[CAM_VFE_RDI_VER2_MAX] = {
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[0],
+		.reg_data       = &vfe480_camif_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[1],
+		.reg_data       = &vfe580_camif_rdi1_reg_data,
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[2],
+		.reg_data       = &vfe480_camif_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver3_hw_info vfe580_top_hw_info = {
+	.common_reg = &vfe480_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_reg      = &vfe480_camif_reg,
+		.reg_data       = &vfe_580_camif_reg_data,
+		},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_pd,
+		.reg_data       = &vfe480_camif_pd_reg_data,
+		},
+	.rdi_hw_info[0] = &vfe580_rdi_hw_info_arr[0],
+	.rdi_hw_info[1] = &vfe580_rdi_hw_info_arr[1],
+	.rdi_hw_info[2] = &vfe580_rdi_hw_info_arr[2],
+	.lcr_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_lcr,
+		.reg_data       = &vfe480_camif_lcr_reg_data,
+		},
+	.num_mux = 6,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_3_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_LCR_VER_1_0,
+	},
+	.num_path_port_map = 2,
+	.path_port_map = {
+		{CAM_ISP_HW_VFE_IN_LCR, CAM_ISP_IFE_OUT_RES_LCR},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_2PD},
+	},
+};
+
+static struct cam_vfe_hw_info cam_vfe580_hw_info = {
+	.irq_hw_info                   = &vfe480_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe480_bus_hw_info,
+
+	.bus_rd_version                = CAM_VFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &vfe480_bus_rd_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_3_0,
+	.top_hw_info                   = &vfe580_top_hw_info,
+};
+
+#endif /* _CAM_VFE580_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe680.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe680.h
@@ -0,0 +1,2315 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE680_H_
+#define _CAM_VFE680_H_
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_BUS_VER3_680_MAX_CLIENTS     28
+#define CAM_VFE_680_NUM_DBG_REG              17
+
+static struct cam_vfe_top_ver4_module_desc vfe680_ipp_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CLC_DEMUX",
+	},
+	{
+		.id = 1,
+		.desc = "CLC_CHANNEL_GAIN",
+	},
+	{
+		.id = 2,
+		.desc = "CLC_BPC_PDPC",
+	},
+	{
+		.id = 3,
+		.desc = "CLC_BINCORRECT",
+	},
+	{
+		.id = 4,
+		.desc = "CLC_COMPDECOMP",
+	},
+	{
+		.id = 5,
+		.desc = "CLC_LSC",
+	},
+	{
+		.id = 6,
+		.desc = "CLC_WB_GAIN",
+	},
+	{
+		.id = 7,
+		.desc = "CLC_GIC",
+	},
+	{
+		.id = 8,
+		.desc = "CLC_BPC_ABF",
+	},
+	{
+		.id = 9,
+		.desc = "CLC_BLS",
+	},
+	{
+		.id = 10,
+		.desc = "CLC_BAYER_GTM",
+	},
+	{
+		.id = 11,
+		.desc = "CLC_BAYER_LTM",
+	},
+	{
+		.id = 12,
+		.desc = "CLC_LCAC",
+	},
+	{
+		.id = 13,
+		.desc = "CLC_DEMOSAIC",
+	},
+	{
+		.id = 14,
+		.desc = "CLC_COLOR_CORRECT",
+	},
+	{
+		.id = 15,
+		.desc = "CLC_GTM",
+	},
+	{
+		.id = 16,
+		.desc = "CLC_GLUT",
+	},
+	{
+		.id = 17,
+		.desc = "CLC_COLOR_TRANSFORM",
+	},
+	{
+		.id = 18,
+		.desc = "CLC_UVG",
+	},
+	{
+		.id = 19,
+		.desc = "CLC_PREPROCESSOR",
+	},
+	{
+		.id = 20,
+		.desc = "CLC_CHROMA_UP",
+	},
+	{
+		.id = 21,
+		.desc = "CLC_SPARSE_PD_EXT",
+	},
+	{
+		.id = 22,
+		.desc = "CLC_LCR",
+	},
+	{
+		.id = 23,
+		.desc = "CLC_COMPDECOMP_HVX_TX",
+	},
+	{
+		.id = 24,
+		.desc = "CLC_COMPDECOMP_HVX_RX",
+	},
+	{
+		.id = 25,
+		.desc = "CLC_GTM_FD_OUT",
+	},
+	{
+		.id = 26,
+		.desc = "CLC_CROP_RND_CLAMP_PIXEL_RAW_OUT",
+	},
+	{
+		.id = 27,
+		.desc = "CLC_DOWNSCALE_MN_Y_FD_OUT",
+	},
+	{
+		.id = 28,
+		.desc = "CLC_DOWNSCALE_MN_C_FD_OUT",
+	},
+	{
+		.id = 29,
+		.desc = "CLC_CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_FD_OUT",
+	},
+	{
+		.id = 30,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_FD_OUT",
+	},
+	{
+		.id = 31,
+		.desc = "CLC_DOWNSCALE_MN_Y_DISP_OUT",
+	},
+	{
+		.id = 32,
+		.desc = "CLC_DOWNSCALE_MN_C_DISP_OUT",
+	},
+	{
+		.id = 33,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_DISP_OUT",
+	},
+	{
+		.id = 34,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_DISP_OUT",
+	},
+	{
+		.id = 35,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS4_OUT",
+	},
+	{
+		.id = 36,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS4_OUT",
+	},
+	{
+		.id = 37,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS4_OUT",
+	},
+	{
+		.id = 38,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS4_OUT",
+	},
+	{
+		.id = 39,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS16_OUT",
+	},
+	{
+		.id = 40,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS16_OUT",
+	},
+	{
+		.id = 41,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS16_OUT",
+	},
+	{
+		.id = 42,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS16_OUT",
+	},
+	{
+		.id = 43,
+		.desc = "CLC_DOWNSCALE_MN_Y_VID_OUT",
+	},
+	{
+		.id = 44,
+		.desc = "CLC_DOWNSCALE_MN_C_VID_OUT",
+	},
+	{
+		.id = 45,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_OUT",
+	},
+	{
+		.id = 46,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_VID_OUT",
+	},
+	{
+		.id = 47,
+		.desc = "CLC_DSX_Y_VID_OUT",
+	},
+	{
+		.id = 48,
+		.desc = "CLC_DSX_C_VID_OUT",
+	},
+	{
+		.id = 49,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DSX_Y_VID_OUT",
+	},
+	{
+		.id = 50,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DSX_C_VID_OUT",
+	},
+	{
+		.id = 51,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_VID_DS16_OUT",
+	},
+	{
+		.id = 52,
+		.desc = "CLC_DOWNSCALE_4TO1_C_VID_DS16_OUT",
+	},
+	{
+		.id = 53,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_VID_DS16_OUT",
+	},
+	{
+		.id = 54,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_VID_DS16_OUT",
+	},
+	{
+		.id = 55,
+		.desc = "CLC_STATS_AEC_BE",
+	},
+	{
+		.id = 56,
+		.desc = "CLC_STATS_AEC_BHIST",
+	},
+	{
+		.id = 57,
+		.desc = "CLC_STATS_BHIST",
+	},
+	{
+		.id = 58,
+		.desc = "CLC_STATS_TINTLESS_BG",
+	},
+	{
+		.id = 59,
+		.desc = "CLC_STATS_AWB_BG",
+	},
+	{
+		.id = 60,
+		.desc = "CLC_STATS_BFW",
+	},
+	{
+		.id = 61,
+		.desc = "CLC_STATS_BAF",
+	},
+	{
+		.id = 62,
+		.desc = "CLC_STATS_RS",
+	},
+	{
+		.id = 63,
+		.desc = "CLC_STATS_IHIST",
+	},
+};
+
+static struct cam_vfe_top_ver4_wr_client_desc vfe680_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "VIDEO_FULL_Y",
+	},
+	{
+		.wm_id = 1,
+		.desc = "VIDEO_FULL_C",
+	},
+	{
+		.wm_id = 2,
+		.desc = "VIDEO_DS_4:1",
+	},
+	{
+		.wm_id = 3,
+		.desc = "VIDEO_DS_16:1",
+	},
+	{
+		.wm_id = 4,
+		.desc = "DISPLAY_FULL_Y",
+	},
+	{
+		.wm_id = 5,
+		.desc = "DISPLAY_FULL_C",
+	},
+	{
+		.wm_id = 6,
+		.desc = "DISPLAY_DS_4:1",
+	},
+	{
+		.wm_id = 7,
+		.desc = "DISPLAY_DS_16:1",
+	},
+	{
+		.wm_id = 8,
+		.desc = "FD_Y",
+	},
+	{
+		.wm_id = 9,
+		.desc = "FD_C",
+	},
+	{
+		.wm_id = 10,
+		.desc = "PIXEL_RAW",
+	},
+	{
+		.wm_id = 11,
+		.desc = "STATS_BE0",
+	},
+	{
+		.wm_id = 12,
+		.desc = "STATS_BHIST0",
+	},
+	{
+		.wm_id = 13,
+		.desc = "STATS_TINTLESS_BG",
+	},
+	{
+		.wm_id = 14,
+		.desc = "STATS_AWB_BG",
+	},
+	{
+		.wm_id = 15,
+		.desc = "STATS_AWB_BFW",
+	},
+	{
+		.wm_id = 16,
+		.desc = "STATS_BAF",
+	},
+	{
+		.wm_id = 17,
+		.desc = "STATS_BHIST",
+	},
+	{
+		.wm_id = 18,
+		.desc = "STATS_RS",
+	},
+	{
+		.wm_id = 19,
+		.desc = "STATS_IHIST",
+	},
+	{
+		.wm_id = 20,
+		.desc = "SPARSE_PD",
+	},
+	{
+		.wm_id = 21,
+		.desc = "PDAF_V2.0_PD_DATA",
+	},
+	{
+		.wm_id = 22,
+		.desc = "PDAF_V2.0_SAD",
+	},
+	{
+		.wm_id = 23,
+		.desc = "LCR",
+	},
+	{
+		.wm_id = 24,
+		.desc = "RDI0",
+	},
+	{
+		.wm_id = 25,
+		.desc = "RDI1",
+	},
+	{
+		.wm_id = 26,
+		.desc = "RDI2",
+	},
+	{
+		.wm_id = 27,
+		.desc = "LTM_STATS",
+	},
+};
+
+static struct cam_vfe_top_ver4_top_err_irq_desc vfe680_top_irq_err_desc[] = {
+	{
+		.bitmask = BIT(4),
+		.err_name = "PP VIOLATION",
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(6),
+		.err_name = "PDAF VIOLATION",
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(12),
+		.err_name = "DSP IFE PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the output Data",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_name = "IFE DSP TX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the outgoing data to the DSP interface",
+	},
+	{
+		.bitmask = BIT(14),
+		.err_name = "DSP IFE RX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the incoming data from DSP before processed",
+	},
+	{
+		.bitmask = BIT(15),
+		.err_name = "DSP TX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface TX path FIFO",
+	},
+	{
+		.bitmask = BIT(16),
+		.err_name = "DSP RX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface RX path FIFO",
+	},
+	{
+		.bitmask = BIT(17),
+		.err_name = "DSP ERROR VIOLATION",
+		.desc = "When DSP sends a error signal",
+	},
+	{
+		.bitmask = BIT(18),
+		.err_name = "DIAG VIOLATION",
+		.desc = "HBI is less than the minimum required HBI",
+	},
+};
+
+static struct cam_vfe_top_ver4_pdaf_violation_desc vfe680_pdaf_violation_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.desc = "Sim monitor 1 violation - SAD output",
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "Sim monitor 2 violation - pre-proc output, LSB aligned",
+	},
+};
+
+static struct cam_irq_register_set vfe680_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x00000034,
+		.clear_reg_offset  = 0x0000003c,
+		.status_reg_offset = 0x00000044,
+		.set_reg_offset    = 0x0000004C,
+		.test_set_val      = BIT(1),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x00000038,
+		.clear_reg_offset  = 0x00000040,
+		.status_reg_offset = 0x00000048,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe680_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe680_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000030,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe680_top_debug_reg[] = {
+	0x000000A0,
+	0x000000A4,
+	0x000000A8,
+	0x000000AC,
+	0x000000B0,
+	0x000000B4,
+	0x000000B8,
+	0x000000BC,
+	0x000000C0,
+	0x000000C4,
+	0x000000C8,
+	0x000000CC,
+	0x000000D0,
+	0x000000D4,
+	0x000000D8,
+	0x000000DC,
+	0x000000E0,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe680_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.core_cfg_0               = 0x00000024,
+	.core_cfg_1               = 0x00000028,
+	.core_cfg_2               = 0x0000002C,
+	.global_reset_cmd         = 0x00000030,
+	.diag_config              = 0x00000050,
+	.diag_sensor_status_0     = 0x00000054,
+	.diag_sensor_status_1     = 0x00000058,
+	.diag_frm_cnt_status_0    = 0x0000005C,
+	.diag_frm_cnt_status_1    = 0x00000060,
+	.ipp_violation_status     = 0x00000064,
+	.pdaf_violation_status    = 0x00000404,
+	.core_cfg_3               = 0x00000068,
+	.core_cgc_ovd_0           = 0x00000018,
+	.core_cgc_ovd_1           = 0x0000001C,
+	.ahb_cgc_ovd              = 0x00000020,
+	.dsp_status               = 0x0000006C,
+	.stats_throttle_cfg_0     = 0x00000070,
+	.stats_throttle_cfg_1     = 0x00000074,
+	.stats_throttle_cfg_2     = 0x00000078,
+	.core_cfg_4               = 0x00000080,
+	.core_cfg_5               = 0x00000084,
+	.core_cfg_6               = 0x00000088,
+	.period_cfg               = 0x0000008C,
+	.irq_sub_pattern_cfg      = 0x00000090,
+	.epoch0_pattern_cfg       = 0x00000094,
+	.epoch1_pattern_cfg       = 0x00000098,
+	.epoch_height_cfg         = 0x0000009C,
+	.bus_violation_status     = 0x00000C64,
+	.bus_overflow_status      = 0x00000C68,
+	.num_perf_counters        = 2,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg    = 0x00000100,
+			.perf_pix_count    = 0x00000104,
+			.perf_line_count   = 0x00000108,
+			.perf_stall_count  = 0x0000010C,
+			.perf_always_count = 0x00000110,
+			.perf_count_status = 0x00000114,
+		},
+		{
+			.perf_count_cfg    = 0x00000118,
+			.perf_pix_count    = 0x0000011C,
+			.perf_line_count   = 0x00000120,
+			.perf_stall_count  = 0x00000124,
+			.perf_always_count = 0x00000128,
+			.perf_count_status = 0x0000012C,
+		},
+	},
+	.top_debug_cfg            = 0x000000FC,
+	.num_top_debug_reg        = CAM_VFE_680_NUM_DBG_REG,
+	.top_debug = vfe680_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe_pp_common_reg_data = {
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x10000,
+	.epoch1_irq_mask                 = 0x20000,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask                  = 0x7F050,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+	.ipp_violation_mask              = 0x10,
+	.pdaf_violation_mask             = 0x40,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe680_vfe_full_rdi_reg_data[3] = {
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x400,
+		.eof_irq_mask                    = 0x800,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x1000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe680_pdlib_reg_data = {
+	.sof_irq_mask                    = 0x4,
+	.eof_irq_mask                    = 0x8,
+	.error_irq_mask                  = 0x0,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+};
+
+struct cam_vfe_ver4_path_hw_info
+	vfe680_rdi_hw_info_arr[] = {
+	{
+		.common_reg     = &vfe680_top_common_reg,
+		.reg_data       = &vfe680_vfe_full_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe680_top_common_reg,
+		.reg_data       = &vfe680_vfe_full_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe680_top_common_reg,
+		.reg_data       = &vfe680_vfe_full_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver4_debug_reg_info vfe680_dbg_reg_info[CAM_VFE_680_NUM_DBG_REG][8] = {
+	VFE_DBG_INFO_ARRAY_4bit("test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_IHIST",
+		"STATS_RS",
+		"STATS_BAF",
+		"GTM_BHIST",
+		"TINTLESS_BG",
+		"STATS_BFW",
+		"STATS_BG",
+		"STATS_BHIST"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_BE",
+		"R2PD_DS16_C_VID",
+		"R2PD_DS16_Y_VID",
+		"crop_rnd_clamp_post_downscale_C_DS16_VID",
+		"4to1_C_DS16_VID",
+		"crop_rnd_clamp_post_downscale_Y_DS16_VID",
+		"4to1_Y_DS16_VID",
+		"crop_rnd_clamp_post_dsx_C_VID"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"R2PD_DS4_VID_C",
+		"R2PD_DS4_VID_Y",
+		"DSX_C",
+		"crop_rnd_clamp_post_dsx_Y_VID",
+		"DSX_Y",
+		"crop_rnd_clamp_post_downscale_mn_C_VID",
+		"downscale_mn_C_VID",
+		"crop_rnd_clamp_post_downscale_mn_Y_VID"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"MNDS_Y_VID",
+		"R2PD_DS16_C_DISP",
+		"R2PD_DS16_Y_DISP",
+		"crop_rnd_clamp_post_downscale_C_DS16_DISP",
+		"4to1_C_DS16_DISP",
+		"crop_rnd_clamp_post_downscale_Y_DS16_DISP",
+		"4to1_Y_DS16_DISP",
+		"R2PD_DS4_C_DISP"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"R2PD_DS4_Y_DISP",
+		"crop_rnd_clamp_post_downscale_C_DS4_DISP",
+		"4to1_C_DS4_DISP",
+		"crop_rnd_clamp_post_downscale_Y_DS4_DISP",
+		"4to1_Y_DS4_DISP",
+		"crop_rnd_clamp_post_downscale_mn_C_DISP",
+		"downscale_mn_C_DISP",
+		"crop_rnd_clamp_post_downscale_mn_Y_DISP"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_Y_DISP",
+		"crop_rnd_clamp_post_downscale_mn_C_FD",
+		"downscale_mn_C_FD",
+		"crop_rnd_clamp_post_downscale_mn_Y_FD",
+		"downscale_mn_Y_FD",
+		"gtm_fd_out",
+		"uvg",
+		"color_xform"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"glut",
+		"gtm",
+		"color_correct",
+		"demosaic",
+		"hvx_tap2",
+		"lcac",
+		"bayer_ltm",
+		"bayer_gtm"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"bls",
+		"bpc_abf",
+		"gic",
+		"wb_gain",
+		"lsc",
+		"compdecomp_hxv_rx",
+		"compdecomp_hxv_tx",
+		"hvx_tap1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"decompand",
+		"reserved",
+		"bincorrect",
+		"bpc_pdpc",
+		"channel_gain",
+		"bayer_argb_ccif_converter",
+		"crop_rnd_clamp_pre_argb_packer",
+		"chroma_up_uv"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"chroma_up_y",
+		"demux",
+		"hxv_tap0",
+		"preprocess",
+		"sparse_pd_ext",
+		"lcr",
+		"bayer_ltm_bus_wr",
+		"RDI2"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"RDI1",
+		"RDI0",
+		"lcr_bus_wr",
+		"pdaf_sad_bus_wr",
+		"pd_data_bus_wr",
+		"sparse_pd_bus_wr",
+		"ihist_bus_wr",
+		"flicker_rs_bus_wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"gtm_bhist_bus_wr",
+		"baf_bus_wr",
+		"bfw_bus_wr",
+		"bg_bus_wr",
+		"tintless_bg_bus_wr",
+		"bhist_bus_wr",
+		"be_bus_wr",
+		"pixel_raw_bus_wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"fd_c_bus_wr",
+		"fd_y_bus_wr",
+		"disp_ds16_bus_wr",
+		"disp_ds4_bus_wr",
+		"disp_c_bus_wr",
+		"disp_y_bus_wr",
+		"vid_ds16_bus_Wr",
+		"vid_ds4_bus_Wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"vid_c_bus_wr",
+		"vid_y_bus_wr",
+		"CLC_PDAF",
+		"PIX_PP",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved"
+	),
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe680_top_hw_info = {
+	.common_reg = &vfe680_top_common_reg,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe680_top_common_reg,
+		.reg_data       = &vfe_pp_common_reg_data,
+	},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe680_top_common_reg,
+		.reg_data       = &vfe680_pdlib_reg_data,
+	},
+	.rdi_hw_info            = vfe680_rdi_hw_info_arr,
+	.wr_client_desc         = vfe680_wr_client_desc,
+	.ipp_module_desc        = vfe680_ipp_mod_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.num_path_port_map = 2,
+	.path_port_map = {
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PREPROCESS_2PD}
+	},
+	.num_rdi                         = ARRAY_SIZE(vfe680_rdi_hw_info_arr),
+	.num_top_errors                  = ARRAY_SIZE(vfe680_top_irq_err_desc),
+	.top_err_desc                    = vfe680_top_irq_err_desc,
+	.num_pdaf_violation_errors       = ARRAY_SIZE(vfe680_pdaf_violation_desc),
+	.pdaf_violation_desc             = vfe680_pdaf_violation_desc,
+	.debug_reg_info                  = &vfe680_dbg_reg_info,
+};
+
+static struct cam_irq_register_set vfe680_bus_irq_reg[2] = {
+		{
+			.mask_reg_offset   = 0x00000C18,
+			.clear_reg_offset  = 0x00000C20,
+			.status_reg_offset = 0x00000C28,
+			.set_reg_offset    = 0x00000C50,
+		},
+		{
+			.mask_reg_offset   = 0x00000C1C,
+			.clear_reg_offset  = 0x00000C24,
+			.status_reg_offset = 0x00000C2C,
+			.set_reg_offset    = 0x00000C54,
+		},
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe680_ubwc_regs_client_0 = {
+	.meta_addr        = 0x00000E40,
+	.meta_cfg         = 0x00000E44,
+	.mode_cfg         = 0x00000E48,
+	.stats_ctrl       = 0x00000E4C,
+	.ctrl_2           = 0x00000E50,
+	.lossy_thresh0    = 0x00000E54,
+	.lossy_thresh1    = 0x00000E58,
+	.off_lossy_var    = 0x00000E5C,
+	.bw_limit         = 0x00000E1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe680_ubwc_regs_client_1 = {
+	.meta_addr        = 0x00000F40,
+	.meta_cfg         = 0x00000F44,
+	.mode_cfg         = 0x00000F48,
+	.stats_ctrl       = 0x00000F4C,
+	.ctrl_2           = 0x00000F50,
+	.lossy_thresh0    = 0x00000F54,
+	.lossy_thresh1    = 0x00000F58,
+	.off_lossy_var    = 0x00000F5C,
+	.bw_limit         = 0x00000F1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe680_ubwc_regs_client_4 = {
+	.meta_addr        = 0x00001240,
+	.meta_cfg         = 0x00001244,
+	.mode_cfg         = 0x00001248,
+	.stats_ctrl       = 0x0000124C,
+	.ctrl_2           = 0x00001250,
+	.lossy_thresh0    = 0x00001254,
+	.lossy_thresh1    = 0x00001258,
+	.off_lossy_var    = 0x0000125C,
+	.bw_limit         = 0x0000121C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe680_ubwc_regs_client_5 = {
+	.meta_addr        = 0x00001340,
+	.meta_cfg         = 0x00001344,
+	.mode_cfg         = 0x00001348,
+	.stats_ctrl       = 0x0000134C,
+	.ctrl_2           = 0x00001350,
+	.lossy_thresh0    = 0x00001354,
+	.lossy_thresh1    = 0x00001358,
+	.off_lossy_var    = 0x0000135C,
+	.bw_limit         = 0x0000131C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static uint32_t vfe680_out_port_mid[][4] = {
+	{18, 0, 0, 0},
+	{19, 0, 0, 0},
+	{20, 0, 0, 0},
+	{8, 9, 10, 11},
+	{32, 0, 0, 0},
+	{33, 0, 0, 0},
+	{16, 17, 0, 0},
+	{36, 37, 38, 0},
+	{4, 0, 0, 0},
+	{41, 0, 0, 0},
+	{44, 0, 0, 0},
+	{42, 0, 0, 0},
+	{40, 0, 0, 0},
+	{46, 0, 0, 0},
+	{47, 0, 0, 0},
+	{12, 13, 14, 15},
+	{34, 0, 0, 0},
+	{35, 0, 0, 0},
+	{5, 6, 0, 0},
+	{48, 0, 0, 0},
+	{43, 0, 0, 0},
+	{7, 0, 0, 0},
+	{39, 0, 0, 0},
+	{49, 50, 0, 0},
+	{45, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe680_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000C00,
+		.cgc_ovd                          = 0x00000C08,
+		.if_frameheader_cfg               = {
+			0x00000C34,
+			0x00000C38,
+			0x00000C3C,
+			0x00000C40,
+			0x00000C44,
+		},
+		.ubwc_static_ctrl                 = 0x00000C58,
+		.pwr_iso_cfg                      = 0x00000C5C,
+		.overflow_status_clear            = 0x00000C60,
+		.ccif_violation_status            = 0x00000C64,
+		.overflow_status                  = 0x00000C68,
+		.image_size_violation_status      = 0x00000C70,
+		.debug_status_top_cfg             = 0x00000CD4,
+		.debug_status_top                 = 0x00000CD8,
+		.test_bus_ctrl                    = 0x00000CDC,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe680_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00000C30,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = CAM_VFE_BUS_VER3_680_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 FULL Y */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.frame_header_addr        = 0x00000E20,
+			.frame_header_incr        = 0x00000E24,
+			.frame_header_cfg         = 0x00000E28,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_status_0            = 0x00000E70,
+			.addr_status_1            = 0x00000E74,
+			.addr_status_2            = 0x00000E78,
+			.addr_status_3            = 0x00000E7C,
+			.debug_status_cfg         = 0x00000E80,
+			.debug_status_0           = 0x00000E84,
+			.debug_status_1           = 0x00000E88,
+			.bw_limiter_addr          = 0x00000E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe680_ubwc_regs_client_0,
+		},
+		/* BUS Client 1 FULL C */
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_status_0            = 0x00000F70,
+			.addr_status_1            = 0x00000F74,
+			.addr_status_2            = 0x00000F78,
+			.addr_status_3            = 0x00000F7C,
+			.debug_status_cfg         = 0x00000F80,
+			.debug_status_0           = 0x00000F84,
+			.debug_status_1           = 0x00000F88,
+			.bw_limiter_addr          = 0x00000F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe680_ubwc_regs_client_1,
+		},
+		/* BUS Client 2 DS4 */
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.system_cache_cfg         = 0x00001068,
+			.addr_status_0            = 0x00001070,
+			.addr_status_1            = 0x00001074,
+			.addr_status_2            = 0x00001078,
+			.addr_status_3            = 0x0000107C,
+			.debug_status_cfg         = 0x00001080,
+			.debug_status_0           = 0x00001084,
+			.debug_status_1           = 0x00001088,
+			.bw_limiter_addr          = 0x0000101C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 DS16 */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.system_cache_cfg         = 0x00001168,
+			.addr_status_0            = 0x00001170,
+			.addr_status_1            = 0x00001174,
+			.addr_status_2            = 0x00001178,
+			.addr_status_3            = 0x0000117C,
+			.debug_status_cfg         = 0x00001180,
+			.debug_status_0           = 0x00001184,
+			.debug_status_1           = 0x00001188,
+			.bw_limiter_addr          = 0x0000111C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 DISP Y */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.system_cache_cfg         = 0x00001268,
+			.addr_status_0            = 0x00001270,
+			.addr_status_1            = 0x00001274,
+			.addr_status_2            = 0x00001278,
+			.addr_status_3            = 0x0000127C,
+			.debug_status_cfg         = 0x00001280,
+			.debug_status_0           = 0x00001284,
+			.debug_status_1           = 0x00001288,
+			.bw_limiter_addr          = 0x0000121C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe680_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 DISP C */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.system_cache_cfg         = 0x00001368,
+			.addr_status_0            = 0x00001370,
+			.addr_status_1            = 0x00001374,
+			.addr_status_2            = 0x00001378,
+			.addr_status_3            = 0x0000137C,
+			.debug_status_cfg         = 0x00001380,
+			.debug_status_0           = 0x00001384,
+			.debug_status_1           = 0x00001388,
+			.bw_limiter_addr          = 0x0000131C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe680_ubwc_regs_client_5,
+		},
+		/* BUS Client 6 DISP DS4 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_status_0            = 0x00001470,
+			.addr_status_1            = 0x00001474,
+			.addr_status_2            = 0x00001478,
+			.addr_status_3            = 0x0000147C,
+			.debug_status_cfg         = 0x00001480,
+			.debug_status_0           = 0x00001484,
+			.debug_status_1           = 0x00001488,
+			.bw_limiter_addr          = 0x0000141C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 DISP DS16 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_status_0            = 0x00001570,
+			.addr_status_1            = 0x00001574,
+			.addr_status_2            = 0x00001578,
+			.addr_status_3            = 0x0000157C,
+			.debug_status_cfg         = 0x00001580,
+			.debug_status_0           = 0x00001584,
+			.debug_status_1           = 0x00001588,
+			.bw_limiter_addr          = 0x0000151C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 FD Y */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_status_0            = 0x00001670,
+			.addr_status_1            = 0x00001674,
+			.addr_status_2            = 0x00001678,
+			.addr_status_3            = 0x0000167C,
+			.debug_status_cfg         = 0x00001680,
+			.debug_status_0           = 0x00001684,
+			.debug_status_1           = 0x00001688,
+			.bw_limiter_addr          = 0x0000161C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 FD C */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_status_0            = 0x00001770,
+			.addr_status_1            = 0x00001774,
+			.addr_status_2            = 0x00001778,
+			.addr_status_3            = 0x0000177C,
+			.debug_status_cfg         = 0x00001780,
+			.debug_status_0           = 0x00001784,
+			.debug_status_1           = 0x00001788,
+			.bw_limiter_addr          = 0x0000171C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 PIXEL RAW */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.framedrop_period         = 0x00001838,
+			.framedrop_pattern        = 0x0000183C,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_status_0            = 0x00001870,
+			.addr_status_1            = 0x00001874,
+			.addr_status_2            = 0x00001878,
+			.addr_status_3            = 0x0000187C,
+			.debug_status_cfg         = 0x00001880,
+			.debug_status_0           = 0x00001884,
+			.debug_status_1           = 0x00001888,
+			.bw_limiter_addr          = 0x0000181C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 STATS BE 0 */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.framedrop_period         = 0x00001938,
+			.framedrop_pattern        = 0x0000193C,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_status_0            = 0x00001970,
+			.addr_status_1            = 0x00001974,
+			.addr_status_2            = 0x00001978,
+			.addr_status_3            = 0x0000197C,
+			.debug_status_cfg         = 0x00001980,
+			.debug_status_0           = 0x00001984,
+			.debug_status_1           = 0x00001988,
+			.bw_limiter_addr          = 0x0000191C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 STATS BHIST 0 */
+		{
+			.cfg                      = 0x00001A00,
+			.image_addr               = 0x00001A04,
+			.frame_incr               = 0x00001A08,
+			.image_cfg_0              = 0x00001A0C,
+			.image_cfg_1              = 0x00001A10,
+			.image_cfg_2              = 0x00001A14,
+			.packer_cfg               = 0x00001A18,
+			.frame_header_addr        = 0x00001A20,
+			.frame_header_incr        = 0x00001A24,
+			.frame_header_cfg         = 0x00001A28,
+			.irq_subsample_period     = 0x00001A30,
+			.irq_subsample_pattern    = 0x00001A34,
+			.framedrop_period         = 0x00001A38,
+			.framedrop_pattern        = 0x00001A3C,
+			.mmu_prefetch_cfg         = 0x00001A60,
+			.mmu_prefetch_max_offset  = 0x00001A64,
+			.system_cache_cfg         = 0x00001A68,
+			.addr_status_0            = 0x00001A70,
+			.addr_status_1            = 0x00001A74,
+			.addr_status_2            = 0x00001A78,
+			.addr_status_3            = 0x00001A7C,
+			.debug_status_cfg         = 0x00001A80,
+			.debug_status_0           = 0x00001A84,
+			.debug_status_1           = 0x00001A88,
+			.bw_limiter_addr          = 0x00001A1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 STATS TINTLESS BG */
+		{
+			.cfg                      = 0x00001B00,
+			.image_addr               = 0x00001B04,
+			.frame_incr               = 0x00001B08,
+			.image_cfg_0              = 0x00001B0C,
+			.image_cfg_1              = 0x00001B10,
+			.image_cfg_2              = 0x00001B14,
+			.packer_cfg               = 0x00001B18,
+			.frame_header_addr        = 0x00001B20,
+			.frame_header_incr        = 0x00001B24,
+			.frame_header_cfg         = 0x00001B28,
+			.irq_subsample_period     = 0x00001B30,
+			.irq_subsample_pattern    = 0x00001B34,
+			.framedrop_period         = 0x00001B38,
+			.framedrop_pattern        = 0x00001B3C,
+			.mmu_prefetch_cfg         = 0x00001B60,
+			.mmu_prefetch_max_offset  = 0x00001B64,
+			.system_cache_cfg         = 0x00001B68,
+			.addr_status_0            = 0x00001B70,
+			.addr_status_1            = 0x00001B74,
+			.addr_status_2            = 0x00001B78,
+			.addr_status_3            = 0x00001B7C,
+			.debug_status_cfg         = 0x00001B80,
+			.debug_status_0           = 0x00001B84,
+			.debug_status_1           = 0x00001B88,
+			.bw_limiter_addr          = 0x00001B1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 STATS AWB BG */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.framedrop_period         = 0x00001C38,
+			.framedrop_pattern        = 0x00001C3C,
+			.mmu_prefetch_cfg         = 0x00001C60,
+			.mmu_prefetch_max_offset  = 0x00001C64,
+			.system_cache_cfg         = 0x00001C68,
+			.addr_status_0            = 0x00001C70,
+			.addr_status_1            = 0x00001C74,
+			.addr_status_2            = 0x00001C78,
+			.addr_status_3            = 0x00001C7C,
+			.debug_status_cfg         = 0x00001C80,
+			.debug_status_0           = 0x00001C84,
+			.debug_status_1           = 0x00001C88,
+			.bw_limiter_addr          = 0x00001C1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 STATS AWB BFW */
+		{
+			.cfg                      = 0x00001D00,
+			.image_addr               = 0x00001D04,
+			.frame_incr               = 0x00001D08,
+			.image_cfg_0              = 0x00001D0C,
+			.image_cfg_1              = 0x00001D10,
+			.image_cfg_2              = 0x00001D14,
+			.packer_cfg               = 0x00001D18,
+			.frame_header_addr        = 0x00001D20,
+			.frame_header_incr        = 0x00001D24,
+			.frame_header_cfg         = 0x00001D28,
+			.irq_subsample_period     = 0x00001D30,
+			.irq_subsample_pattern    = 0x00001D34,
+			.framedrop_period         = 0x00001D38,
+			.framedrop_pattern        = 0x00001D3C,
+			.mmu_prefetch_cfg         = 0x00001D60,
+			.mmu_prefetch_max_offset  = 0x00001D64,
+			.system_cache_cfg         = 0x00001D68,
+			.addr_status_0            = 0x00001D70,
+			.addr_status_1            = 0x00001D74,
+			.addr_status_2            = 0x00001D78,
+			.addr_status_3            = 0x00001D7C,
+			.debug_status_cfg         = 0x00001D80,
+			.debug_status_0           = 0x00001D84,
+			.debug_status_1           = 0x00001D88,
+			.bw_limiter_addr          = 0x00001D1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 STATS BAF */
+		{
+			.cfg                      = 0x00001E00,
+			.image_addr               = 0x00001E04,
+			.frame_incr               = 0x00001E08,
+			.image_cfg_0              = 0x00001E0C,
+			.image_cfg_1              = 0x00001E10,
+			.image_cfg_2              = 0x00001E14,
+			.packer_cfg               = 0x00001E18,
+			.frame_header_addr        = 0x00001E20,
+			.frame_header_incr        = 0x00001E24,
+			.frame_header_cfg         = 0x00001E28,
+			.irq_subsample_period     = 0x00001E30,
+			.irq_subsample_pattern    = 0x00001E34,
+			.framedrop_period         = 0x00001E38,
+			.framedrop_pattern        = 0x00001E3C,
+			.mmu_prefetch_cfg         = 0x00001E60,
+			.mmu_prefetch_max_offset  = 0x00001E64,
+			.system_cache_cfg         = 0x00001E68,
+			.addr_status_0            = 0x00001E70,
+			.addr_status_1            = 0x00001E74,
+			.addr_status_2            = 0x00001E78,
+			.addr_status_3            = 0x00001E7C,
+			.debug_status_cfg         = 0x00001E80,
+			.debug_status_0           = 0x00001E84,
+			.debug_status_1           = 0x00001E88,
+			.bw_limiter_addr          = 0x00001E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 STATS BHIST */
+		{
+			.cfg                      = 0x00001F00,
+			.image_addr               = 0x00001F04,
+			.frame_incr               = 0x00001F08,
+			.image_cfg_0              = 0x00001F0C,
+			.image_cfg_1              = 0x00001F10,
+			.image_cfg_2              = 0x00001F14,
+			.packer_cfg               = 0x00001F18,
+			.frame_header_addr        = 0x00001F20,
+			.frame_header_incr        = 0x00001F24,
+			.frame_header_cfg         = 0x00001F28,
+			.irq_subsample_period     = 0x00001F30,
+			.irq_subsample_pattern    = 0x00001F34,
+			.framedrop_period         = 0x00001F38,
+			.framedrop_pattern        = 0x00001F3C,
+			.mmu_prefetch_cfg         = 0x00001F60,
+			.mmu_prefetch_max_offset  = 0x00001F64,
+			.system_cache_cfg         = 0x00001F68,
+			.addr_status_0            = 0x00001F70,
+			.addr_status_1            = 0x00001F74,
+			.addr_status_2            = 0x00001F78,
+			.addr_status_3            = 0x00001F7C,
+			.debug_status_cfg         = 0x00001F80,
+			.debug_status_0           = 0x00001F84,
+			.debug_status_1           = 0x00001F88,
+			.bw_limiter_addr          = 0x00001F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_8,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 STATS RS */
+		{
+			.cfg                      = 0x00002000,
+			.image_addr               = 0x00002004,
+			.frame_incr               = 0x00002008,
+			.image_cfg_0              = 0x0000200C,
+			.image_cfg_1              = 0x00002010,
+			.image_cfg_2              = 0x00002014,
+			.packer_cfg               = 0x00002018,
+			.frame_header_addr        = 0x00002020,
+			.frame_header_incr        = 0x00002024,
+			.frame_header_cfg         = 0x00002028,
+			.irq_subsample_period     = 0x00002030,
+			.irq_subsample_pattern    = 0x00002034,
+			.framedrop_period         = 0x00002038,
+			.framedrop_pattern        = 0x0000203C,
+			.mmu_prefetch_cfg         = 0x00002060,
+			.mmu_prefetch_max_offset  = 0x00002064,
+			.system_cache_cfg         = 0x00002068,
+			.addr_status_0            = 0x00002070,
+			.addr_status_1            = 0x00002074,
+			.addr_status_2            = 0x00002078,
+			.addr_status_3            = 0x0000207C,
+			.debug_status_cfg         = 0x00002080,
+			.debug_status_0           = 0x00002084,
+			.debug_status_1           = 0x00002088,
+			.bw_limiter_addr          = 0x0000201C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_9,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 STATS IHIST */
+		{
+			.cfg                      = 0x00002100,
+			.image_addr               = 0x00002104,
+			.frame_incr               = 0x00002108,
+			.image_cfg_0              = 0x0000210C,
+			.image_cfg_1              = 0x00002110,
+			.image_cfg_2              = 0x00002114,
+			.packer_cfg               = 0x00002118,
+			.frame_header_addr        = 0x00002120,
+			.frame_header_incr        = 0x00002124,
+			.frame_header_cfg         = 0x00002128,
+			.irq_subsample_period     = 0x00002130,
+			.irq_subsample_pattern    = 0x00002134,
+			.framedrop_period         = 0x00002138,
+			.framedrop_pattern        = 0x0000213C,
+			.mmu_prefetch_cfg         = 0x00002160,
+			.mmu_prefetch_max_offset  = 0x00002164,
+			.system_cache_cfg         = 0x00002168,
+			.addr_status_0            = 0x00002170,
+			.addr_status_1            = 0x00002174,
+			.addr_status_2            = 0x00002178,
+			.addr_status_3            = 0x0000217C,
+			.debug_status_cfg         = 0x00002180,
+			.debug_status_0           = 0x00002184,
+			.debug_status_1           = 0x00002188,
+			.bw_limiter_addr          = 0x0000211C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_10,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 SPARSE PD */
+		{
+			.cfg                      = 0x00002200,
+			.image_addr               = 0x00002204,
+			.frame_incr               = 0x00002208,
+			.image_cfg_0              = 0x0000220C,
+			.image_cfg_1              = 0x00002210,
+			.image_cfg_2              = 0x00002214,
+			.packer_cfg               = 0x00002218,
+			.frame_header_addr        = 0x00002220,
+			.frame_header_incr        = 0x00002224,
+			.frame_header_cfg         = 0x00002228,
+			.irq_subsample_period     = 0x00002230,
+			.irq_subsample_pattern    = 0x00002234,
+			.framedrop_period         = 0x00002238,
+			.framedrop_pattern        = 0x0000223C,
+			.mmu_prefetch_cfg         = 0x00002260,
+			.mmu_prefetch_max_offset  = 0x00002264,
+			.system_cache_cfg         = 0x00002268,
+			.addr_status_0            = 0x00002270,
+			.addr_status_1            = 0x00002274,
+			.addr_status_2            = 0x00002278,
+			.addr_status_3            = 0x0000227C,
+			.debug_status_cfg         = 0x00002280,
+			.debug_status_0           = 0x00002284,
+			.debug_status_1           = 0x00002288,
+			.bw_limiter_addr          = 0x0000221C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_12,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 21 PDAF V2.0 PD DATA - 2PD */
+		{
+			.cfg                      = 0x00002300,
+			.image_addr               = 0x00002304,
+			.frame_incr               = 0x00002308,
+			.image_cfg_0              = 0x0000230C,
+			.image_cfg_1              = 0x00002310,
+			.image_cfg_2              = 0x00002314,
+			.packer_cfg               = 0x00002318,
+			.frame_header_addr        = 0x00002320,
+			.frame_header_incr        = 0x00002324,
+			.frame_header_cfg         = 0x00002328,
+			.irq_subsample_period     = 0x00002330,
+			.irq_subsample_pattern    = 0x00002334,
+			.framedrop_period         = 0x00002338,
+			.framedrop_pattern        = 0x0000233C,
+			.mmu_prefetch_cfg         = 0x00002360,
+			.mmu_prefetch_max_offset  = 0x00002364,
+			.system_cache_cfg         = 0x00002368,
+			.addr_status_0            = 0x00002370,
+			.addr_status_1            = 0x00002374,
+			.addr_status_2            = 0x00002378,
+			.addr_status_3            = 0x0000237C,
+			.debug_status_cfg         = 0x00002380,
+			.debug_status_0           = 0x00002384,
+			.debug_status_1           = 0x00002388,
+			.bw_limiter_addr          = 0x0000231C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_13,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 22 PDAF V2.0 SAD STATS */
+		{
+			.cfg                      = 0x00002400,
+			.image_addr               = 0x00002404,
+			.frame_incr               = 0x00002408,
+			.image_cfg_0              = 0x0000240C,
+			.image_cfg_1              = 0x00002410,
+			.image_cfg_2              = 0x00002414,
+			.packer_cfg               = 0x00002418,
+			.frame_header_addr        = 0x00002420,
+			.frame_header_incr        = 0x00002424,
+			.frame_header_cfg         = 0x00002428,
+			.irq_subsample_period     = 0x00002430,
+			.irq_subsample_pattern    = 0x00002434,
+			.framedrop_period         = 0x00002438,
+			.framedrop_pattern        = 0x0000243C,
+			.mmu_prefetch_cfg         = 0x00002460,
+			.mmu_prefetch_max_offset  = 0x00002464,
+			.system_cache_cfg         = 0x00002468,
+			.addr_status_0            = 0x00002470,
+			.addr_status_1            = 0x00002474,
+			.addr_status_2            = 0x00002478,
+			.addr_status_3            = 0x0000247C,
+			.debug_status_cfg         = 0x00002480,
+			.debug_status_0           = 0x00002484,
+			.debug_status_1           = 0x00002488,
+			.bw_limiter_addr          = 0x0000241C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_13,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 LCR */
+		{
+			.cfg                      = 0x00002500,
+			.image_addr               = 0x00002504,
+			.frame_incr               = 0x00002508,
+			.image_cfg_0              = 0x0000250C,
+			.image_cfg_1              = 0x00002510,
+			.image_cfg_2              = 0x00002514,
+			.packer_cfg               = 0x00002518,
+			.frame_header_addr        = 0x00002520,
+			.frame_header_incr        = 0x00002524,
+			.frame_header_cfg         = 0x00002528,
+			.irq_subsample_period     = 0x00002530,
+			.irq_subsample_pattern    = 0x00002534,
+			.framedrop_period         = 0x00002538,
+			.framedrop_pattern        = 0x0000253C,
+			.mmu_prefetch_cfg         = 0x00002560,
+			.mmu_prefetch_max_offset  = 0x00002564,
+			.system_cache_cfg         = 0x00002568,
+			.addr_status_0            = 0x00002570,
+			.addr_status_1            = 0x00002574,
+			.addr_status_2            = 0x00002578,
+			.addr_status_3            = 0x0000257C,
+			.debug_status_cfg         = 0x00002580,
+			.debug_status_0           = 0x00002584,
+			.debug_status_1           = 0x00002588,
+			.bw_limiter_addr          = 0x0000251C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 24 RDI0 */
+		{
+			.cfg                      = 0x00002600,
+			.image_addr               = 0x00002604,
+			.frame_incr               = 0x00002608,
+			.image_cfg_0              = 0x0000260C,
+			.image_cfg_1              = 0x00002610,
+			.image_cfg_2              = 0x00002614,
+			.packer_cfg               = 0x00002618,
+			.frame_header_addr        = 0x00002620,
+			.frame_header_incr        = 0x00002624,
+			.frame_header_cfg         = 0x00002628,
+			.irq_subsample_period     = 0x00002630,
+			.irq_subsample_pattern    = 0x00002634,
+			.framedrop_period         = 0x00002638,
+			.framedrop_pattern        = 0x0000263C,
+			.mmu_prefetch_cfg         = 0x00002660,
+			.mmu_prefetch_max_offset  = 0x00002664,
+			.system_cache_cfg         = 0x00002668,
+			.addr_status_0            = 0x00002670,
+			.addr_status_1            = 0x00002674,
+			.addr_status_2            = 0x00002678,
+			.addr_status_3            = 0x0000267C,
+			.debug_status_cfg         = 0x00002680,
+			.debug_status_0           = 0x00002684,
+			.debug_status_1           = 0x00002688,
+			.bw_limiter_addr          = 0x0000261C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_14,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 25 RDI1 */
+		{
+			.cfg                      = 0x00002700,
+			.image_addr               = 0x00002704,
+			.frame_incr               = 0x00002708,
+			.image_cfg_0              = 0x0000270C,
+			.image_cfg_1              = 0x00002710,
+			.image_cfg_2              = 0x00002714,
+			.packer_cfg               = 0x00002718,
+			.frame_header_addr        = 0x00002720,
+			.frame_header_incr        = 0x00002724,
+			.frame_header_cfg         = 0x00002728,
+			.irq_subsample_period     = 0x00002730,
+			.irq_subsample_pattern    = 0x00002734,
+			.framedrop_period         = 0x00002738,
+			.framedrop_pattern        = 0x0000273C,
+			.mmu_prefetch_cfg         = 0x00002760,
+			.mmu_prefetch_max_offset  = 0x00002764,
+			.system_cache_cfg         = 0x00002768,
+			.addr_status_0            = 0x00002770,
+			.addr_status_1            = 0x00002774,
+			.addr_status_2            = 0x00002778,
+			.addr_status_3            = 0x0000277C,
+			.debug_status_cfg         = 0x00002780,
+			.debug_status_0           = 0x00002784,
+			.debug_status_1           = 0x00002788,
+			.bw_limiter_addr          = 0x0000271C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_15,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 26 RDI2 */
+		{
+			.cfg                      = 0x00002800,
+			.image_addr               = 0x00002804,
+			.frame_incr               = 0x00002808,
+			.image_cfg_0              = 0x0000280C,
+			.image_cfg_1              = 0x00002810,
+			.image_cfg_2              = 0x00002814,
+			.packer_cfg               = 0x00002818,
+			.frame_header_addr        = 0x00002820,
+			.frame_header_incr        = 0x00002824,
+			.frame_header_cfg         = 0x00002828,
+			.irq_subsample_period     = 0x00002830,
+			.irq_subsample_pattern    = 0x00002834,
+			.framedrop_period         = 0x00002838,
+			.framedrop_pattern        = 0x0000283C,
+			.mmu_prefetch_cfg         = 0x00002860,
+			.mmu_prefetch_max_offset  = 0x00002864,
+			.system_cache_cfg         = 0x00002868,
+			.addr_status_0            = 0x00002870,
+			.addr_status_1            = 0x00002874,
+			.addr_status_2            = 0x00002878,
+			.addr_status_3            = 0x0000287C,
+			.debug_status_cfg         = 0x00002880,
+			.debug_status_0           = 0x00002884,
+			.debug_status_1           = 0x00002888,
+			.bw_limiter_addr          = 0x0000281C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_16,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 27 LTM STATS */
+		{
+			.cfg                      = 0x00002900,
+			.image_addr               = 0x00002904,
+			.frame_incr               = 0x00002908,
+			.image_cfg_0              = 0x0000290C,
+			.image_cfg_1              = 0x00002910,
+			.image_cfg_2              = 0x00002914,
+			.packer_cfg               = 0x00002918,
+			.frame_header_addr        = 0x00002920,
+			.frame_header_incr        = 0x00002924,
+			.frame_header_cfg         = 0x00002928,
+			.irq_subsample_period     = 0x00002930,
+			.irq_subsample_pattern    = 0x00002934,
+			.framedrop_period         = 0x00002938,
+			.framedrop_pattern        = 0x0000293C,
+			.mmu_prefetch_cfg         = 0x00002960,
+			.mmu_prefetch_max_offset  = 0x00002964,
+			.system_cache_cfg         = 0x00002968,
+			.addr_status_0            = 0x00002970,
+			.addr_status_1            = 0x00002974,
+			.addr_status_2            = 0x00002978,
+			.addr_status_3            = 0x0000297C,
+			.debug_status_cfg         = 0x00002980,
+			.debug_status_0           = 0x00002984,
+			.debug_status_1           = 0x00002988,
+			.bw_limiter_addr          = 0x0000291C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 25,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid           = vfe680_out_port_mid[0],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				24,
+			},
+			.name          = {
+				"RDI_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid           = vfe680_out_port_mid[1],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				25,
+			},
+			.name          = {
+				"RDI_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.mid           = vfe680_out_port_mid[2],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				26,
+			},
+			.name          = {
+				"RDI_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[3],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				0,
+				1,
+			},
+			.name          = {
+				"FULL_Y",
+				"FULL_C",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[4],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"DS_4",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[5],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"DS_16",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[6],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				10,
+			},
+			.name          = {
+				"PIXEL_RAW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[7],
+			.num_mid       = 3,
+			.num_wm        = 2,
+			.wm_idx        = {
+				8,
+				9,
+			},
+			.name          = {
+				"FD_Y",
+				"FD_C",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_SPARSE_PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[8],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				20,
+			},
+			.name          = {
+				"PDAF",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[9],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				13,
+			},
+			.name          = {
+				"STATS_TL_BG",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+
+			.mid           = vfe680_out_port_mid[10],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				16,
+			},
+			.name          = {
+				"STATS_BF",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[11],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				14,
+			},
+			.name          = {
+				"STATS_AWB_BGB",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[12],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				12,
+			},
+			.name          = {
+				"STATS_BHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[13],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				18,
+			},
+			.name          = {
+				"STATS_RS",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[14],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				19,
+			},
+			.name          = {
+				"STATS_IHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[15],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				4,
+				5,
+			},
+			.name          = {
+				"FULL_DISP_Y",
+				"FULL_DISP_C",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[16],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				6,
+			},
+			.name          = {
+				"DISP_DS_4",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[17],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				7,
+			},
+			.name          = {
+				"DISP_DS_16",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe680_out_port_mid[18],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				21,
+			},
+			.name          = {
+				"2PD",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LCR,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[19],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				23,
+			},
+			.name          = {
+				"LCR",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[20],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				15,
+			},
+			.name          = {
+				"AWB_BFW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe680_out_port_mid[21],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				22,
+			},
+			.name          = {
+				"2PD_STATS",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[22],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				11,
+			},
+			.name          = {
+				"AEC_BE",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[23],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				27,
+			},
+			.name          = {
+				"LTM",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe680_out_port_mid[24],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				17,
+			},
+			.name          = {
+				"GTM_BHIST",
+			},
+		},
+	},
+	.num_cons_err = 29,
+	.constraint_error_list = {
+		{
+			.bitmask = BIT(0),
+			.error_description = "PPC 1x1 input not supported"
+		},
+		{
+			.bitmask = BIT(1),
+			.error_description = "PPC 1x2 input not supported"
+		},
+		{
+			.bitmask = BIT(2),
+			.error_description = "PPC 2x1 input not supported"
+		},
+		{
+			.bitmask = BIT(3),
+			.error_description = "PPC 2x2 input not supported"
+		},
+		{
+			.bitmask = BIT(4),
+			.error_description = "Pack 8 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(5),
+			.error_description = "Pack 16 format not supported"
+		},
+		{
+			.bitmask = BIT(6),
+			.error_description = "Pack 32 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(7),
+			.error_description = "Pack 64 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(8),
+			.error_description = "Pack MIPI 20 format not supported"
+		},
+		{
+			.bitmask = BIT(9),
+			.error_description = "Pack MIPI 14 format not supported"
+		},
+		{
+			.bitmask = BIT(10),
+			.error_description = "Pack MIPI 12 format not supported"
+		},
+		{
+			.bitmask = BIT(11),
+			.error_description = "Pack MIPI 10 format not supported"
+		},
+		{
+			.bitmask = BIT(12),
+			.error_description = "Pack 128 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(13),
+			.error_description = "UBWC NV12 format not supported"
+		},
+		{
+			.bitmask = BIT(14),
+			.error_description = "UBWC NV12 4R format not supported"
+		},
+		{
+			.bitmask = BIT(15),
+			.error_description = "UBWC TP10 format not supported"
+		},
+		{
+			.bitmask = BIT(16),
+			.error_description = "Frame based Mode not supported"
+		},
+		{
+			.bitmask = BIT(17),
+			.error_description = "Index based Mode not supported"
+		},
+		{
+			.bitmask = BIT(18),
+			.error_description = "FIFO image addr unalign"
+		},
+		{
+			.bitmask = BIT(19),
+			.error_description = "FIFO ubwc addr unalign"
+		},
+		{
+			.bitmask = BIT(20),
+			.error_description = "FIFO frmheader addr unalign"
+		},
+		{
+			.bitmask = BIT(21),
+			.error_description = "Image address unalign"
+		},
+		{
+			.bitmask = BIT(22),
+			.error_description = "UBWC address unalign"
+		},
+		{
+			.bitmask = BIT(23),
+			.error_description = "Frame Header address unalign"
+		},
+		{
+			.bitmask = BIT(24),
+			.error_description = "Stride unalign"
+		},
+		{
+			.bitmask = BIT(25),
+			.error_description = "X Initialization unalign"
+		},
+		{
+			.bitmask = BIT(26),
+			.error_description = "Image Width unalign"
+		},
+		{
+			.bitmask = BIT(27),
+			.error_description = "Image Height unalign"
+		},
+		{
+			.bitmask = BIT(28),
+			.error_description = "Meta Stride unalign"
+		},
+	},
+	.num_comp_grp          = 17,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3),
+		BIT(4), BIT(5), BIT(6), BIT(7),
+		BIT(8), BIT(9), BIT(10), BIT(11),
+		BIT(12), BIT(13), BIT(14), BIT(15), BIT(16),
+	},
+	.top_irq_shift         = 0,
+	.max_out_res           = CAM_ISP_IFE_OUT_RES_BASE + 33,
+	.pack_align_shift      = 5,
+	.max_bw_counter_limit  = 0xFF,
+};
+
+static struct cam_vfe_irq_hw_info vfe680_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_EXT_CSID,
+	.top_irq_reg   = &vfe680_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe680_hw_info = {
+	.irq_hw_info                  = &vfe680_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe680_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe680_top_hw_info,
+};
+
+#endif /* _CAM_VFE680_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe680_110.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe680_110.h
@@ -0,0 +1,138 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE680_110_H_
+#define _CAM_VFE680_110_H_
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_680_110_NUM_DBG_REG              17
+
+static uint32_t vfe680_110_top_debug_reg[] = {
+	0x000000A0,
+	0x000000A4,
+	0x000000A8,
+	0x000000AC,
+	0x000000B0,
+	0x000000B4,
+	0x000000B8,
+	0x000000BC,
+	0x000000C0,
+	0x000000C4,
+	0x000000C8,
+	0x000000CC,
+	0x000000D0,
+	0x000000D4,
+	0x000000D8,
+	0x000000DC,
+	0x000000E0,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe680_110_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.core_cfg_0               = 0x00000024,
+	.core_cfg_1               = 0x00000028,
+	.core_cfg_2               = 0x0000002C,
+	.global_reset_cmd         = 0x00000030,
+	.diag_config              = 0x00000050,
+	.diag_sensor_status_0     = 0x00000054,
+	.diag_sensor_status_1     = 0x00000058,
+	.diag_frm_cnt_status_0    = 0x0000005C,
+	.diag_frm_cnt_status_1    = 0x00000060,
+	.ipp_violation_status     = 0x00000064,
+	.pdaf_violation_status    = 0x00000404,
+	.core_cfg_3               = 0x00000068,
+	.core_cgc_ovd_0           = 0x00000018,
+	.core_cgc_ovd_1           = 0x0000001C,
+	.ahb_cgc_ovd              = 0x00000020,
+	.dsp_status               = 0x0000006C,
+	.stats_throttle_cfg_0     = 0x00000070,
+	.stats_throttle_cfg_1     = 0x00000074,
+	.stats_throttle_cfg_2     = 0x00000078,
+	.core_cfg_4               = 0x00000080,
+	.core_cfg_5               = 0x00000084,
+	.core_cfg_6               = 0x00000088,
+	.period_cfg               = 0x0000008C,
+	.irq_sub_pattern_cfg      = 0x00000090,
+	.epoch0_pattern_cfg       = 0x00000094,
+	.epoch1_pattern_cfg       = 0x00000098,
+	.epoch_height_cfg         = 0x0000009C,
+	.bus_violation_status     = 0x00000C64,
+	.bus_overflow_status      = 0x00000C68,
+	.top_debug_cfg            = 0x000000FC,
+	.num_top_debug_reg        = CAM_VFE_680_110_NUM_DBG_REG,
+	.top_debug = vfe680_110_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+struct cam_vfe_ver4_path_hw_info
+	vfe680_110_rdi_hw_info_arr[] = {
+	{
+		.common_reg     = &vfe680_110_top_common_reg,
+		.reg_data       = &vfe680_vfe_full_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe680_110_top_common_reg,
+		.reg_data       = &vfe680_vfe_full_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe680_110_top_common_reg,
+		.reg_data       = &vfe680_vfe_full_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe680_110_top_hw_info = {
+	.common_reg = &vfe680_110_top_common_reg,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe680_110_top_common_reg,
+		.reg_data       = &vfe_pp_common_reg_data,
+	},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe680_110_top_common_reg,
+		.reg_data       = &vfe680_pdlib_reg_data,
+	},
+	.rdi_hw_info            = vfe680_110_rdi_hw_info_arr,
+	.wr_client_desc         = vfe680_wr_client_desc,
+	.ipp_module_desc        = vfe680_ipp_mod_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.num_path_port_map = 2,
+	.path_port_map = {
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PREPROCESS_2PD}
+	},
+	.num_rdi                         = ARRAY_SIZE(vfe680_110_rdi_hw_info_arr),
+	.num_top_errors                  = ARRAY_SIZE(vfe680_top_irq_err_desc),
+	.top_err_desc                    = vfe680_top_irq_err_desc,
+	.num_pdaf_violation_errors       = ARRAY_SIZE(vfe680_pdaf_violation_desc),
+	.pdaf_violation_desc             = vfe680_pdaf_violation_desc,
+	.debug_reg_info                  = &vfe680_dbg_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe680_110_hw_info = {
+	.irq_hw_info                  = &vfe680_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe680_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe680_110_top_hw_info,
+};
+
+#endif /* _CAM_VFE680_110_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe690.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe690.h
@@ -0,0 +1,2103 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE690_H_
+#define _CAM_VFE690_H_
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_BUS_VER3_690_MAX_CLIENTS     25
+#define CAM_VFE_690_NUM_DBG_REG              17
+
+static struct cam_vfe_top_ver4_module_desc vfe690_ipp_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CLC_PREPROCESSOR_W4",
+	},
+	{
+		.id = 1,
+		.desc = "CLC_PREPROCESSOR_W1",
+	},
+	{
+		.id = 2,
+		.desc = "CLC_CHANNEL_GAIN_W5",
+	},
+	{
+		.id = 3,
+		.desc = "CLC_PDPC_BPC_1D_W3",
+	},
+	{
+		.id = 4,
+		.desc = "CLC_PDPC_BPC_1D_POST_LSC_W3",
+	},
+	{
+		.id = 5,
+		.desc = "CLC_LSC_W2",
+	},
+	{
+		.id = 6,
+		.desc = "CLC_WB_GAIN_W4",
+	},
+	{
+		.id = 7,
+		.desc = "CLC_GIC_W2",
+	},
+	{
+		.id = 8,
+		.desc = "CLC_BPC_ABF_W4",
+	},
+	{
+		.id = 9,
+		.desc = "CLC_BLS_W6",
+	},
+	{
+		.id = 10,
+		.desc = "CLC_BAYER_GTM_W2",
+	},
+	{
+		.id = 11,
+		.desc = "CLC_BAYER_LTM_W3",
+	},
+	{
+		.id = 12,
+		.desc = "CLC_LCAC_W2",
+	},
+	{
+		.id = 13,
+		.desc = "CLC_DEMOSAIC_W5",
+	},
+	{
+		.id = 14,
+		.desc = "CLC_COLOR_CORRECT_W7",
+	},
+	{
+		.id = 15,
+		.desc = "CLC_GTM_W1",
+	},
+	{
+		.id = 16,
+		.desc = "CLC_GLUT_W9",
+	},
+	{
+		.id = 17,
+		.desc = "CLC_GLUT_RGB_OUT_W9",
+	},
+	{
+		.id = 18,
+		.desc = "CLC_COLOR_XFORM_W8",
+	},
+	{
+		.id = 19,
+		.desc = "CLC_UVG_W2",
+	},
+	{
+		.id = 20,
+		.desc = "CLC_CROP_RND_CLAMP_PIXEL_RAW_OUT_W11",
+	},
+	{
+		.id = 21,
+		.desc = "CLC_DOWNSCALE_MN_Y_DISP_OUT_W11",
+	},
+	{
+		.id = 22,
+		.desc = "CLC_DOWNSCALE_MN_C_DISP_OUT_W11",
+	},
+	{
+		.id = 23,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_DISP_OUT_W13",
+	},
+	{
+		.id = 24,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_DISP_OUT_W12",
+	},
+	{
+		.id = 25,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS4_OUT_W4",
+	},
+	{
+		.id = 26,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS4_OUT_W6",
+	},
+	{
+		.id = 27,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS4_OUT_W13",
+	},
+	{
+		.id = 28,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS4_OUT_W12",
+	},
+	{
+		.id = 29,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS16_OUT_W5",
+	},
+	{
+		.id = 30,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS16_OUT_W7",
+	},
+	{
+		.id = 31,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS16_OUT_W13",
+	},
+	{
+		.id = 32,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS16_OUT_W12",
+	},
+	{
+		.id = 33,
+		.desc = "CLC_DOWNSCALE_MN_Y_VID_0_OUT_W10",
+	},
+	{
+		.id = 34,
+		.desc = "CLC_DOWNSCALE_MN_Y_VID_1_OUT_W10",
+	},
+	{
+		.id = 35,
+		.desc = "CLC_DOWNSCALE_MN_Y_VID_2_OUT_W10",
+	},
+	{
+		.id = 36,
+		.desc = "CLC_DOWNSCALE_MN_C_VID_OUT_W13",
+	},
+	{
+		.id = 37,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_0_OUT_W10",
+	},
+	{
+		.id = 38,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_1_OUT_W10",
+	},
+	{
+		.id = 39,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_2_OUT_W10",
+	},
+	{
+		.id = 40,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_VID_OUT_W14",
+	},
+	{
+		.id = 41,
+		.desc = "CLC_STATS_AEC_BE_W2",
+	},
+	{
+		.id = 42,
+		.desc = "CLC_STATS_AEC_BHIST_W2",
+	},
+	{
+		.id = 43,
+		.desc = "CLC_STATS_TINTLESS_BG_W2",
+	},
+	{
+		.id = 44,
+		.desc = "CLC_STATS_AWB_BG_W2",
+	},
+	{
+		.id = 45,
+		.desc = "CLC_STATS_BFW_W1",
+	},
+	{
+		.id = 46,
+		.desc = "CLC_STATS_BHIST_W2",
+	},
+	{
+		.id = 47,
+		.desc = "CLC_STATS_RS_W3CLC_STATS_RS_W3",
+	},
+	{
+		.id = 48,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT1_0_OUT_W12",
+	},
+	{
+		.id = 49,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT1_1_OUT_W12",
+	},
+	{
+		.id = 50,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT1_2_OUT_W12",
+	},
+	{
+		.id = 51,
+		.desc = "CLC_DOWNSCALE_MN_C_AI_OUT1_OUT_W14",
+	},
+	{
+		.id = 52,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT1_0_OUT_W10",
+	},
+	{
+		.id = 53,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT1_1_OUT_W10",
+	},
+	{
+		.id = 54,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT1_2_OUT_W10",
+	},
+	{
+		.id = 55,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_AI_OUT1_OUT_W14",
+	},
+	{
+		.id = 56,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT2_0_OUT_W13",
+	},
+	{
+		.id = 57,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT2_1_OUT_W13",
+	},
+	{
+		.id = 58,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT2_2_OUT_W13",
+	},
+	{
+		.id = 59,
+		.desc = "CLC_DOWNSCALE_MN_C_AI_OUT2_OUT_W15",
+	},
+	{
+		.id = 60,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT2_0_OUT_W10",
+	},
+	{
+		.id = 61,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT2_1_OUT_W10",
+	},
+	{
+		.id = 62,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT2_2_OUT_W10",
+	},
+	{
+		.id = 63,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_AI_OUT2_OUT_W14",
+	},
+};
+
+static struct cam_vfe_top_ver4_wr_client_desc vfe690_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "VIDEO_FULL_Y",
+	},
+	{
+		.wm_id = 1,
+		.desc = "VIDEO_FULL_C",
+	},
+	{
+		.wm_id = 2,
+		.desc = "VIDEO_FULL_C2",
+	},
+	{
+		.wm_id = 3,
+		.desc = "DISPLAY_FULL_Y",
+	},
+	{
+		.wm_id = 4,
+		.desc = "DISPLAY_FULL_C",
+	},
+	{
+		.wm_id = 5,
+		.desc = "DISPLAY_DS_4:1",
+	},
+	{
+		.wm_id = 6,
+		.desc = "DISPLAY_DS_16:1",
+	},
+	{
+		.wm_id = 7,
+		.desc = "PIXEL_RAW",
+	},
+	{
+		.wm_id = 8,
+		.desc = "STATS_LTM",
+	},
+	{
+		.wm_id = 9,
+		.desc = "STATS_BE0",
+	},
+	{
+		.wm_id = 10,
+		.desc = "STATS_BHIST0",
+	},
+	{
+		.wm_id = 11,
+		.desc = "STATS_TINTLESS_BG",
+	},
+	{
+		.wm_id = 12,
+		.desc = "STATS_AWB_BG",
+	},
+	{
+		.wm_id = 13,
+		.desc = "STATS_AWB_BFW",
+	},
+	{
+		.wm_id = 14,
+		.desc = "STATS_BHIST",
+	},
+	{
+		.wm_id = 15,
+		.desc = "STATS_RS",
+	},
+	{
+		.wm_id = 16,
+		.desc = "RDI0",
+	},
+	{
+		.wm_id = 17,
+		.desc = "RDI1",
+	},
+	{
+		.wm_id = 18,
+		.desc = "RDI2",
+	},
+	{
+		.wm_id = 19,
+		.desc = "AI_OUT_1_Y",
+	},
+	{
+		.wm_id = 20,
+		.desc = "AI_OUT_1_UV",
+	},
+	{
+		.wm_id = 21,
+		.desc = "AI_OUT_1_C2",
+	},
+	{
+		.wm_id = 22,
+		.desc = "AI_OUT_2_Y",
+	},
+	{
+		.wm_id = 23,
+		.desc = "AI_OUT_2_UV",
+	},
+	{
+		.wm_id = 24,
+		.desc = "AI_OUT_2_C2",
+	},
+};
+
+static struct cam_vfe_top_ver4_top_err_irq_desc vfe690_top_irq_err_desc[] = {
+	{
+		.bitmask = BIT(4),
+		.err_name = "PP VIOLATION",
+		.desc = "PIXEL PIPE VIOLATION",
+	},
+	{
+		.bitmask = BIT(9),
+		.err_name = "DSP IFE PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the output Data",
+	},
+	{
+		.bitmask = BIT(10),
+		.err_name = "IFE DSP TX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the outgoing data to the DSP interface",
+	},
+	{
+		.bitmask = BIT(11),
+		.err_name = "DSP IFE RX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the incoming data from DSP before processed",
+	},
+	{
+		.bitmask = BIT(12),
+		.err_name = "DSP TX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface TX path FIFO",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_name = "DSP RX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface RX path FIFO",
+	},
+	{
+		.bitmask = BIT(14),
+		.err_name = "DSP ERROR VIOLATION",
+		.desc = "When DSP sends a error signal",
+	},
+	{
+		.bitmask = BIT(15),
+		.err_name = "DIAG VIOLATION",
+		.desc = "HBI is less than the minimum required HBI",
+	},
+};
+
+static struct cam_irq_register_set vfe690_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x000000A8,
+		.clear_reg_offset  = 0x000000B0,
+		.status_reg_offset = 0x000000B8,
+		.test_set_val      = BIT(1),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x000000AC,
+		.clear_reg_offset  = 0x000000B4,
+		.status_reg_offset = 0x000000BC,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe690_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe690_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x000000A4,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe690_top_debug_reg[] = {
+	0x00000128,
+	0x0000012C,
+	0x00000130,
+	0x00000134,
+	0x00000138,
+	0x0000013C,
+	0x00000140,
+	0x00000144,
+	0x00000148,
+	0x0000014C,
+	0x00000150,
+	0x00000154,
+	0x00000158,
+	0x0000015C,
+	0x00000160,
+	0x00000164,
+	0x00000168,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe690_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.core_cfg_0               = 0x00000024,
+	.core_cfg_1               = 0x00000028,
+	.core_cfg_2               = 0x0000002C,
+	.global_reset_cmd         = 0x000000A4,
+	.diag_config              = 0x00000044,
+	.diag_sensor_status_0     = 0x00000048,
+	.diag_sensor_status_1     = 0x0000004C,
+	.diag_frm_cnt_status_0    = 0x00000050,
+	.diag_frm_cnt_status_1    = 0x00000054,
+	.ipp_violation_status_0   = 0x000000F0,
+	.ipp_violation_status_1   = 0x000000F4,
+	.core_cgc_ovd_0           = 0x00000018,
+	.core_cgc_ovd_1           = 0x0000001C,
+	.ahb_cgc_ovd              = 0x00000020,
+	.dsp_status               = 0x00000124,
+	.stats_throttle_cfg_0     = 0x0000005C,
+	.stats_throttle_cfg_1     = 0x00000060,
+	.period_cfg               = 0x00000030,
+	.irq_sub_pattern_cfg      = 0x00000034,
+	.epoch0_pattern_cfg       = 0x00000038,
+	.epoch1_pattern_cfg       = 0x0000003C,
+	.epoch_height_cfg         = 0x00000040,
+	.bus_violation_status     = 0x00000464,
+	.bus_overflow_status      = 0x00000468,
+	.num_perf_counters        = 3,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg    = 0x000001A8,
+			.perf_pix_count    = 0x000001AC,
+			.perf_line_count   = 0x000001B0,
+			.perf_stall_count  = 0x000001B4,
+			.perf_always_count = 0x000001B8,
+			.perf_count_status = 0x000001BC,
+		},
+		{
+			.perf_count_cfg    = 0x000001C0,
+			.perf_pix_count    = 0x000001C4,
+			.perf_line_count   = 0x000001C8,
+			.perf_stall_count  = 0x000001CC,
+			.perf_always_count = 0x000001D0,
+			.perf_count_status = 0x000001D4,
+		},
+		{
+			.perf_count_cfg    = 0x000001D8,
+			.perf_pix_count    = 0x000001DC,
+			.perf_line_count   = 0x000001E0,
+			.perf_stall_count  = 0x000001E8,
+			.perf_always_count = 0x000001EC,
+			.perf_count_status = 0x000001F0,
+		},
+	},
+	.top_debug_cfg            = 0x00000170,
+	.num_top_debug_reg        = CAM_VFE_690_NUM_DBG_REG,
+	.top_debug = vfe690_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe690_pp_common_reg_data = {
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x10000,
+	.epoch1_irq_mask                 = 0x20000,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask                  = 0xFE10,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+	.ipp_violation_mask              = 0x10,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe690_vfe_full_rdi_reg_data[3] = {
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x400,
+		.eof_irq_mask                    = 0x800,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x1000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+};
+
+struct cam_vfe_ver4_path_hw_info
+	vfe690_rdi_hw_info_arr[] = {
+	{
+		.common_reg     = &vfe690_top_common_reg,
+		.reg_data       = &vfe690_vfe_full_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe690_top_common_reg,
+		.reg_data       = &vfe690_vfe_full_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe690_top_common_reg,
+		.reg_data       = &vfe690_vfe_full_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver4_debug_reg_info vfe690_dbg_reg_info[CAM_VFE_690_NUM_DBG_REG][8] = {
+	VFE_DBG_INFO_ARRAY_4bit("test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_RS",
+		"GTM_BHIST",
+		"TINTLESS_BG",
+		"STATS_BFW",
+		"STATS_BG",
+		"STATS_BHIST",
+		"STATS_BE",
+		"AI_OUT2_Output_packer_C"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"AI_OUT2_Output_packer_Y2",
+		"AI_OUT2_Output_packer_Y1",
+		"AI_OUT2_Output_packer_Y0",
+		"crop_rnd_clamp_downscale_mn_c_ai_out_2",
+		"downscale_mn_c_ai_out_2",
+		"crop_rnd_clamp_downscale_mn_y_ai_out_2_2",
+		"downscale_mn_y_ai_out2_2",
+		"crop_rnd_clamp_downscale_mn_y_ai_out2_1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_y_ai_out2_1",
+		"crop_rnd_clamp_downscale_mn_y_ai_out2_0",
+		"downscale_mn_y_ai_out2_0",
+		"ai_out1_output_packer_c",
+		"ai_out1_output_packer_y2",
+		"ai_out1_output_packer_y1",
+		"ai_out1_output_packer_y0",
+		"crop_rnd_clamp_downscale_mn_c_ai_out1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_c_ai_out1",
+		"crop_rnd_clamp_downscale_mn_y_ai_out1_2",
+		"downscale_mn_y_ai_out1_2",
+		"crop_rnd_clamp_downscale_mn_y_ai_out1_1",
+		"downscale_mn_y_ai_out1_1",
+		"crop_rnd_clamp_downscale_mn_y_ai_out1_0",
+		"downscale_mn_y_ai_out1_0",
+		"vid_output_packer_c"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"vid_output_packer_y2",
+		"vid_output_packer_y1",
+		"vid_output_packer_y0",
+		"crop_rnd_clamp_downscale_mn_c_vid",
+		"downscale_mn_c_vid",
+		"crop_rnd_clamp_downscale_mn_y_vid_2",
+		"downscale_mn_y_vid_2",
+		"crop_rnd_clamp_downscale_mn_y_vid_1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_y_vid_1",
+		"crop_rnd_clamp_downscale_mn_y_vid_0",
+		"downscale_mn_y_vid_0",
+		"rp2d_ds16_disp",
+		"rp2d_ds16_disp",
+		"crop_rnd_clamp_post_downscale_4to1_c_ds16_disp",
+		"downscale_4to1_c_disp_ds16",
+		"crop_rnd_clamp_post_downscale_4to1_y_ds16_disp"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_4to1_y_disp_ds16_idle",
+		"rp2d_ds4_disp",
+		"rp2d_ds4_disp",
+		"crop_rnd_clamp_post_downscale_4to1_c_ds4_disp",
+		"downscale_4to1_c_disp_ds4",
+		"crop_rnd_clamp_post_downscale_4to1_y_ds4_disp",
+		"downscale_4to1_y_disp_ds4",
+		"crop_rnd_clamp_post_downscale_mn_c_disp"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_c_disp",
+		"crop_rnd_clamp_post_downscale_mn_y_disp",
+		"downscale_mn_y_disp",
+		"uvg",
+		"color_xform",
+		"glut_rgb",
+		"glut",
+		"gtm"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"color_correct",
+		"isp_throttle",
+		"demo",
+		"hvx_tap2",
+		"lcac",
+		"bayer_ltm",
+		"bayer_gtm",
+		"bls"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"bpc_abf",
+		"gic",
+		"wb_gain",
+		"pdpc_bpc_1d_post_lsc",
+		"lsc",
+		"pdpc_bpc_1d",
+		"crop_rnd_clamp_pixe_raw_out",
+		"hvx_tap1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"channel_gain",
+		"compdecomp_idle",
+		"hvx_tap0",
+		"preprocess_idle",
+		"RDI2",
+		"RDI1",
+		"RDI0",
+		"CLIENT_24:AI_OUT_2_C2"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"CLIENT_23:AI_OUT_2_UV/C1",
+		"CLIENT_22:AI_OUT_2_Y/C1",
+		"CLIENT_21:AI_OUT_1_C2",
+		"CLIENT_20:AI_OUT_1_UV/C1",
+		"CLIENT_19:AI_OUT_1_Y/C1",
+		"CLIENT_15:Stats FLICKER RS",
+		"CLIENT_14:Stats GTM BHIST",
+		"CLIENT_13:Stats AWB BFW"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"CLIENT_12:Stats AWB BG",
+		"CLIENT_11:Stats Tintless BG",
+		"CLIENT_10:Stats AEC BHIST",
+		"CLIENT_9:Stats AEC BE",
+		"CLIENT_8:LTM STATS",
+		"CLIENT_7:Pixel Raw",
+		"CLIENT_6:DISP 16:1",
+		"CLIENT_5:DISP 4:1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"CLIENT_4:DISP C 1:1",
+		"CLIENT_3:DISP Y 1:1",
+		"CLIENT_2:VID C2",
+		"CLIENT_1:VID UV/C1",
+		"CLIENT_0:VID Y/C0",
+		"PP",
+		"Reserved",
+		"Reserved"
+	),
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe690_top_hw_info = {
+	.common_reg = &vfe690_top_common_reg,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe690_top_common_reg,
+		.reg_data       = &vfe690_pp_common_reg_data,
+	},
+	.rdi_hw_info            = vfe690_rdi_hw_info_arr,
+	.wr_client_desc         = vfe690_wr_client_desc,
+	.ipp_module_desc        = vfe690_ipp_mod_desc,
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.num_rdi                         = ARRAY_SIZE(vfe690_rdi_hw_info_arr),
+	.num_top_errors                  = ARRAY_SIZE(vfe690_top_irq_err_desc),
+	.top_err_desc                    = vfe690_top_irq_err_desc,
+	.debug_reg_info                  = &vfe690_dbg_reg_info,
+};
+
+static struct cam_irq_register_set vfe690_bus_irq_reg[1] = {
+		{
+			.mask_reg_offset   = 0x00000418,
+			.clear_reg_offset  = 0x00000420,
+			.status_reg_offset = 0x00000428,
+			.set_reg_offset    = 0x00000450,
+		},
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe690_ubwc_regs_client_0 = {
+	.meta_addr        = 0x00000640,
+	.meta_cfg         = 0x00000644,
+	.mode_cfg         = 0x00000648,
+	.stats_ctrl       = 0x0000064C,
+	.ctrl_2           = 0x00000650,
+	.lossy_thresh0    = 0x00000654,
+	.lossy_thresh1    = 0x00000658,
+	.off_lossy_var    = 0x0000065C,
+	.bw_limit         = 0x0000061C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe690_ubwc_regs_client_1 = {
+	.meta_addr        = 0x00000740,
+	.meta_cfg         = 0x00000744,
+	.mode_cfg         = 0x00000748,
+	.stats_ctrl       = 0x0000074C,
+	.ctrl_2           = 0x00000750,
+	.lossy_thresh0    = 0x00000754,
+	.lossy_thresh1    = 0x00000758,
+	.off_lossy_var    = 0x0000075C,
+	.bw_limit         = 0x0000071C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe690_ubwc_regs_client_3 = {
+	.meta_addr        = 0x00000940,
+	.meta_cfg         = 0x00000944,
+	.mode_cfg         = 0x00000948,
+	.stats_ctrl       = 0x0000094C,
+	.ctrl_2           = 0x00000950,
+	.lossy_thresh0    = 0x00000954,
+	.lossy_thresh1    = 0x00000958,
+	.off_lossy_var    = 0x0000095C,
+	.bw_limit         = 0x0000091C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe690_ubwc_regs_client_4 = {
+	.meta_addr        = 0x00000A40,
+	.meta_cfg         = 0x00000A44,
+	.mode_cfg         = 0x00000A48,
+	.stats_ctrl       = 0x00000A4C,
+	.ctrl_2           = 0x00000A50,
+	.lossy_thresh0    = 0x00000A54,
+	.lossy_thresh1    = 0x00000A58,
+	.off_lossy_var    = 0x00000A5C,
+	.bw_limit         = 0x00000A1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe690_ubwc_regs_client_19 = {
+	.meta_addr        = 0x00001940,
+	.meta_cfg         = 0x00001944,
+	.mode_cfg         = 0x00001948,
+	.stats_ctrl       = 0x0000194C,
+	.ctrl_2           = 0x00001950,
+	.lossy_thresh0    = 0x00001954,
+	.lossy_thresh1    = 0x00001958,
+	.off_lossy_var    = 0x0000195C,
+	.bw_limit         = 0x0000191C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe690_ubwc_regs_client_20 = {
+	.meta_addr        = 0x00001A40,
+	.meta_cfg         = 0x00001A44,
+	.mode_cfg         = 0x00001A48,
+	.stats_ctrl       = 0x00001A4C,
+	.ctrl_2           = 0x00001A50,
+	.lossy_thresh0    = 0x00001A54,
+	.lossy_thresh1    = 0x00001A58,
+	.off_lossy_var    = 0x00001A5C,
+	.bw_limit         = 0x00001A1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe690_ubwc_regs_client_22 = {
+	.meta_addr        = 0x00001C40,
+	.meta_cfg         = 0x00001C44,
+	.mode_cfg         = 0x00001C48,
+	.stats_ctrl       = 0x00001C4C,
+	.ctrl_2           = 0x00001C50,
+	.lossy_thresh0    = 0x00001C54,
+	.lossy_thresh1    = 0x00001C58,
+	.off_lossy_var    = 0x00001C5C,
+	.bw_limit         = 0x00001C1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe690_ubwc_regs_client_23 = {
+	.meta_addr        = 0x00001D40,
+	.meta_cfg         = 0x00001D44,
+	.mode_cfg         = 0x00001D48,
+	.stats_ctrl       = 0x00001D4C,
+	.ctrl_2           = 0x00001D50,
+	.lossy_thresh0    = 0x00001D54,
+	.lossy_thresh1    = 0x00001D58,
+	.off_lossy_var    = 0x00001D5C,
+	.bw_limit         = 0x00001D1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static uint32_t vfe690_out_port_mid[][6] = {
+	{29, 0, 0, 0},
+	{30, 0, 0, 0},
+	{31, 0, 0, 0},
+	{32, 33, 34, 35, 36, 37},
+	{18, 19, 0, 0},
+	{24, 0, 0, 0},
+	{25, 0, 0, 0},
+	{23, 0, 0, 0},
+	{28, 0, 0, 0},
+	{38, 39, 40, 41},
+	{16, 0, 0, 0},
+	{17, 0, 0, 0},
+	{26, 0, 0, 0},
+	{22, 0, 0, 0},
+	{20, 21, 0, 0},
+	{27, 0, 0, 0},
+	{42, 43, 44, 45, 46, 47},
+	{48, 49, 50, 51, 52, 53},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe690_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000400,
+		.cgc_ovd                          = 0x00000408,
+		.if_frameheader_cfg               = {
+			0x00000434,
+			0x00000438,
+			0x0000043C,
+			0x00000440,
+		},
+		.ubwc_static_ctrl                 = 0x00000458,
+		.pwr_iso_cfg                      = 0x0000045C,
+		.overflow_status_clear            = 0x00000460,
+		.ccif_violation_status            = 0x00000464,
+		.overflow_status                  = 0x00000468,
+		.image_size_violation_status      = 0x00000470,
+		.debug_status_top_cfg             = 0x000004F0,
+		.debug_status_top                 = 0x000004F4,
+		.test_bus_ctrl                    = 0x000004FC,
+		.irq_reg_info = {
+			.num_registers            = 1,
+			.irq_reg_set              = vfe690_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00000430,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = CAM_VFE_BUS_VER3_690_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 FULL Y */
+		{
+			.cfg                      = 0x00000600,
+			.image_addr               = 0x00000604,
+			.frame_incr               = 0x00000608,
+			.image_cfg_0              = 0x0000060C,
+			.image_cfg_1              = 0x00000610,
+			.image_cfg_2              = 0x00000614,
+			.packer_cfg               = 0x00000618,
+			.frame_header_addr        = 0x00000620,
+			.frame_header_incr        = 0x00000624,
+			.frame_header_cfg         = 0x00000628,
+			.irq_subsample_period     = 0x00000630,
+			.irq_subsample_pattern    = 0x00000634,
+			.framedrop_period         = 0x00000638,
+			.framedrop_pattern        = 0x0000063C,
+			.mmu_prefetch_cfg         = 0x00000660,
+			.mmu_prefetch_max_offset  = 0x00000664,
+			.system_cache_cfg         = 0x00000668,
+			.addr_status_0            = 0x00000670,
+			.addr_status_1            = 0x00000674,
+			.addr_status_2            = 0x00000678,
+			.addr_status_3            = 0x0000067C,
+			.debug_status_cfg         = 0x00000680,
+			.debug_status_0           = 0x00000684,
+			.debug_status_1           = 0x00000688,
+			.bw_limiter_addr          = 0x0000061C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe690_ubwc_regs_client_0,
+		},
+		/* BUS Client 1 FULL C */
+		{
+			.cfg                      = 0x00000700,
+			.image_addr               = 0x00000704,
+			.frame_incr               = 0x00000708,
+			.image_cfg_0              = 0x0000070C,
+			.image_cfg_1              = 0x00000710,
+			.image_cfg_2              = 0x00000714,
+			.packer_cfg               = 0x00000718,
+			.frame_header_addr        = 0x00000720,
+			.frame_header_incr        = 0x00000724,
+			.frame_header_cfg         = 0x00000728,
+			.irq_subsample_period     = 0x00000730,
+			.irq_subsample_pattern    = 0x00000734,
+			.framedrop_period         = 0x00000738,
+			.framedrop_pattern        = 0x0000073C,
+			.mmu_prefetch_cfg         = 0x00000760,
+			.mmu_prefetch_max_offset  = 0x00000764,
+			.system_cache_cfg         = 0x00000768,
+			.addr_status_0            = 0x00000770,
+			.addr_status_1            = 0x00000774,
+			.addr_status_2            = 0x00000778,
+			.addr_status_3            = 0x0000077C,
+			.debug_status_cfg         = 0x00000780,
+			.debug_status_0           = 0x00000784,
+			.debug_status_1           = 0x00000788,
+			.bw_limiter_addr          = 0x0000071C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe690_ubwc_regs_client_1,
+		},
+		/* BUS Client 2 VID C2 */
+		{
+			.cfg                      = 0x00000800,
+			.image_addr               = 0x00000804,
+			.frame_incr               = 0x00000808,
+			.image_cfg_0              = 0x0000080C,
+			.image_cfg_1              = 0x00000810,
+			.image_cfg_2              = 0x00000814,
+			.packer_cfg               = 0x00000818,
+			.irq_subsample_period     = 0x00000830,
+			.irq_subsample_pattern    = 0x00000834,
+			.framedrop_period         = 0x00000838,
+			.framedrop_pattern        = 0x0000083C,
+			.mmu_prefetch_cfg         = 0x00000860,
+			.mmu_prefetch_max_offset  = 0x00000864,
+			.system_cache_cfg         = 0x00000868,
+			.addr_status_0            = 0x00000870,
+			.addr_status_1            = 0x00000874,
+			.addr_status_2            = 0x00000878,
+			.addr_status_3            = 0x0000087C,
+			.debug_status_cfg         = 0x00000880,
+			.debug_status_0           = 0x00000884,
+			.debug_status_1           = 0x00000888,
+			.bw_limiter_addr          = 0x0000081C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 DISP Y */
+		{
+			.cfg                      = 0x00000900,
+			.image_addr               = 0x00000904,
+			.frame_incr               = 0x00000908,
+			.image_cfg_0              = 0x0000090C,
+			.image_cfg_1              = 0x00000910,
+			.image_cfg_2              = 0x00000914,
+			.packer_cfg               = 0x00000918,
+			.frame_header_addr        = 0x00000920,
+			.frame_header_incr        = 0x00000924,
+			.frame_header_cfg         = 0x00000928,
+			.irq_subsample_period     = 0x00000930,
+			.irq_subsample_pattern    = 0x00000934,
+			.framedrop_period         = 0x00000938,
+			.framedrop_pattern        = 0x0000093C,
+			.mmu_prefetch_cfg         = 0x00000960,
+			.mmu_prefetch_max_offset  = 0x00000964,
+			.system_cache_cfg         = 0x00000968,
+			.addr_status_0            = 0x00000970,
+			.addr_status_1            = 0x00000974,
+			.addr_status_2            = 0x00000978,
+			.addr_status_3            = 0x0000097C,
+			.debug_status_cfg         = 0x00000980,
+			.debug_status_0           = 0x00000984,
+			.debug_status_1           = 0x00000988,
+			.bw_limiter_addr          = 0x0000091C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe690_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 DISP C */
+		{
+			.cfg                      = 0x00000A00,
+			.image_addr               = 0x00000A04,
+			.frame_incr               = 0x00000A08,
+			.image_cfg_0              = 0x00000A0C,
+			.image_cfg_1              = 0x00000A10,
+			.image_cfg_2              = 0x00000A14,
+			.packer_cfg               = 0x00000A18,
+			.frame_header_addr        = 0x00000A20,
+			.frame_header_incr        = 0x00000A24,
+			.frame_header_cfg         = 0x00000A28,
+			.irq_subsample_period     = 0x00000A30,
+			.irq_subsample_pattern    = 0x00000A34,
+			.framedrop_period         = 0x00000A38,
+			.framedrop_pattern        = 0x00000A3C,
+			.mmu_prefetch_cfg         = 0x00000A60,
+			.mmu_prefetch_max_offset  = 0x00000A64,
+			.system_cache_cfg         = 0x00000A68,
+			.addr_status_0            = 0x00000A70,
+			.addr_status_1            = 0x00000A74,
+			.addr_status_2            = 0x00000A78,
+			.addr_status_3            = 0x00000A7C,
+			.debug_status_cfg         = 0x00000A80,
+			.debug_status_0           = 0x00000A84,
+			.debug_status_1           = 0x00000A88,
+			.bw_limiter_addr          = 0x00000A1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe690_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 DISP DS4 */
+		{
+			.cfg                      = 0x00000B00,
+			.image_addr               = 0x00000B04,
+			.frame_incr               = 0x00000B08,
+			.image_cfg_0              = 0x00000B0C,
+			.image_cfg_1              = 0x00000B10,
+			.image_cfg_2              = 0x00000B14,
+			.packer_cfg               = 0x00000B18,
+			.irq_subsample_period     = 0x00000B30,
+			.irq_subsample_pattern    = 0x00000B34,
+			.framedrop_period         = 0x00000B38,
+			.framedrop_pattern        = 0x00000B3C,
+			.mmu_prefetch_cfg         = 0x00000B60,
+			.mmu_prefetch_max_offset  = 0x00000B64,
+			.system_cache_cfg         = 0x00000B68,
+			.addr_status_0            = 0x00000B70,
+			.addr_status_1            = 0x00000B74,
+			.addr_status_2            = 0x00000B78,
+			.addr_status_3            = 0x00000B7C,
+			.debug_status_cfg         = 0x00000B80,
+			.debug_status_0           = 0x00000B84,
+			.debug_status_1           = 0x00000B88,
+			.bw_limiter_addr          = 0x00000B1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 DISP DS16 */
+		{
+			.cfg                      = 0x00000C00,
+			.image_addr               = 0x00000C04,
+			.frame_incr               = 0x00000C08,
+			.image_cfg_0              = 0x00000C0C,
+			.image_cfg_1              = 0x00000C10,
+			.image_cfg_2              = 0x00000C14,
+			.packer_cfg               = 0x00000C18,
+			.irq_subsample_period     = 0x00000C30,
+			.irq_subsample_pattern    = 0x00000C34,
+			.framedrop_period         = 0x00000C38,
+			.framedrop_pattern        = 0x00000C3C,
+			.mmu_prefetch_cfg         = 0x00000C60,
+			.mmu_prefetch_max_offset  = 0x00000C64,
+			.system_cache_cfg         = 0x00000C68,
+			.addr_status_0            = 0x00000C70,
+			.addr_status_1            = 0x00000C74,
+			.addr_status_2            = 0x00000C78,
+			.addr_status_3            = 0x00000C7C,
+			.debug_status_cfg         = 0x00000C80,
+			.debug_status_0           = 0x00000C84,
+			.debug_status_1           = 0x00000C88,
+			.bw_limiter_addr          = 0x00000C1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 Pixel Raw */
+		{
+			.cfg                      = 0x00000D00,
+			.image_addr               = 0x00000D04,
+			.frame_incr               = 0x00000D08,
+			.image_cfg_0              = 0x00000D0C,
+			.image_cfg_1              = 0x00000D10,
+			.image_cfg_2              = 0x00000D14,
+			.packer_cfg               = 0x00000D18,
+			.frame_header_addr        = 0x00000D20,
+			.frame_header_incr        = 0x00000D24,
+			.frame_header_cfg         = 0x00000D28,
+			.irq_subsample_period     = 0x00000D30,
+			.irq_subsample_pattern    = 0x00000D34,
+			.framedrop_period         = 0x00000D38,
+			.framedrop_pattern        = 0x00000D3C,
+			.mmu_prefetch_cfg         = 0x00000D60,
+			.mmu_prefetch_max_offset  = 0x00000D64,
+			.system_cache_cfg         = 0x00000D68,
+			.addr_status_0            = 0x00000D70,
+			.addr_status_1            = 0x00000D74,
+			.addr_status_2            = 0x00000D78,
+			.addr_status_3            = 0x00000D7C,
+			.debug_status_cfg         = 0x00000D90,
+			.debug_status_0           = 0x00000D84,
+			.debug_status_1           = 0x00000D88,
+			.bw_limiter_addr          = 0x00000D1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 LTM STATS  */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_status_0            = 0x00000E70,
+			.addr_status_1            = 0x00000E74,
+			.addr_status_2            = 0x00000E78,
+			.addr_status_3            = 0x00000E7C,
+			.debug_status_cfg         = 0x00000E80,
+			.debug_status_0           = 0x00000E84,
+			.debug_status_1           = 0x00000E88,
+			.bw_limiter_addr          = 0x00000E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9:Stats AEC BE*/
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_status_0            = 0x00000F70,
+			.addr_status_1            = 0x00000F74,
+			.addr_status_2            = 0x00000F78,
+			.addr_status_3            = 0x00000F7C,
+			.debug_status_cfg         = 0x00000F80,
+			.debug_status_0           = 0x00000F84,
+			.debug_status_1           = 0x00000F88,
+			.bw_limiter_addr          = 0x00000F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10:Stats AEC BHIST*/
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.frame_header_addr        = 0x00001020,
+			.frame_header_incr        = 0x00001024,
+			.frame_header_cfg         = 0x00001028,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.system_cache_cfg         = 0x00001068,
+			.addr_status_0            = 0x00001070,
+			.addr_status_1            = 0x00001074,
+			.addr_status_2            = 0x00001078,
+			.addr_status_3            = 0x0000107C,
+			.debug_status_cfg         = 0x00001080,
+			.debug_status_0           = 0x00001084,
+			.debug_status_1           = 0x00001088,
+			.bw_limiter_addr          = 0x0000101C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 Stats Tintless BG */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.frame_header_addr        = 0x00001120,
+			.frame_header_incr        = 0x00001124,
+			.frame_header_cfg         = 0x00001128,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.system_cache_cfg         = 0x00001168,
+			.addr_status_0            = 0x00001170,
+			.addr_status_1            = 0x00001174,
+			.addr_status_2            = 0x00001178,
+			.addr_status_3            = 0x0000117C,
+			.debug_status_cfg         = 0x00001180,
+			.debug_status_0           = 0x00001184,
+			.debug_status_1           = 0x00001188,
+			.bw_limiter_addr          = 0x0000111C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 Stats AWB BG */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.system_cache_cfg         = 0x00001268,
+			.addr_status_0            = 0x00001270,
+			.addr_status_1            = 0x00001274,
+			.addr_status_2            = 0x00001278,
+			.addr_status_3            = 0x0000127C,
+			.debug_status_cfg         = 0x00001280,
+			.debug_status_0           = 0x00001284,
+			.debug_status_1           = 0x00001288,
+			.bw_limiter_addr          = 0x0000121C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 Stats AWB BFW */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.system_cache_cfg         = 0x00001368,
+			.addr_status_0            = 0x00001370,
+			.addr_status_1            = 0x00001374,
+			.addr_status_2            = 0x00001378,
+			.addr_status_3            = 0x0000137C,
+			.debug_status_cfg         = 0x00001380,
+			.debug_status_0           = 0x00001384,
+			.debug_status_1           = 0x00001388,
+			.bw_limiter_addr          = 0x0000131C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 Stats GTM BHIST */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_status_0            = 0x00001470,
+			.addr_status_1            = 0x00001474,
+			.addr_status_2            = 0x00001478,
+			.addr_status_3            = 0x0000147C,
+			.debug_status_cfg         = 0x00001480,
+			.debug_status_0           = 0x00001484,
+			.debug_status_1           = 0x00001488,
+			.bw_limiter_addr          = 0x0000141C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 Stats RS */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_status_0            = 0x00001570,
+			.addr_status_1            = 0x00001574,
+			.addr_status_2            = 0x00001578,
+			.addr_status_3            = 0x0000157C,
+			.debug_status_cfg         = 0x00001580,
+			.debug_status_0           = 0x00001584,
+			.debug_status_1           = 0x00001588,
+			.bw_limiter_addr          = 0x0000151C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 RDI0 */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_status_0            = 0x00001670,
+			.addr_status_1            = 0x00001674,
+			.addr_status_2            = 0x00001678,
+			.addr_status_3            = 0x0000167C,
+			.debug_status_cfg         = 0x00001680,
+			.debug_status_0           = 0x00001684,
+			.debug_status_1           = 0x00001688,
+			.bw_limiter_addr          = 0x0000161C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_8,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 RDI1 */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.frame_header_addr        = 0x00001720,
+			.frame_header_incr        = 0x00001724,
+			.frame_header_cfg         = 0x00001728,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_status_0            = 0x00001770,
+			.addr_status_1            = 0x00001774,
+			.addr_status_2            = 0x00001778,
+			.addr_status_3            = 0x0000177C,
+			.debug_status_cfg         = 0x00001780,
+			.debug_status_0           = 0x00001784,
+			.debug_status_1           = 0x00001788,
+			.bw_limiter_addr          = 0x0000171C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_9,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 RDI2 */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.framedrop_period         = 0x00001838,
+			.framedrop_pattern        = 0x0000183C,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_status_0            = 0x00001870,
+			.addr_status_1            = 0x00001874,
+			.addr_status_2            = 0x00001878,
+			.addr_status_3            = 0x0000187C,
+			.debug_status_cfg         = 0x00001880,
+			.debug_status_0           = 0x00001884,
+			.debug_status_1           = 0x00001888,
+			.bw_limiter_addr          = 0x0000181C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_10,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 AI_OUT_1_Y/C1 */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.framedrop_period         = 0x00001938,
+			.framedrop_pattern        = 0x0000193C,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_status_0            = 0x00001970,
+			.addr_status_1            = 0x00001974,
+			.addr_status_2            = 0x00001978,
+			.addr_status_3            = 0x0000197C,
+			.debug_status_cfg         = 0x00001980,
+			.debug_status_0           = 0x00001984,
+			.debug_status_1           = 0x00001988,
+			.bw_limiter_addr          = 0x0000191C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe690_ubwc_regs_client_19,
+		},
+		/* BUS Client 20 AI_OUT_1_UV/C1 */
+		{
+			.cfg                      = 0x00001A00,
+			.image_addr               = 0x00001A04,
+			.frame_incr               = 0x00001A08,
+			.image_cfg_0              = 0x00001A0C,
+			.image_cfg_1              = 0x00001A10,
+			.image_cfg_2              = 0x00001A14,
+			.packer_cfg               = 0x00001A18,
+			.frame_header_addr        = 0x00001A20,
+			.frame_header_incr        = 0x00001A24,
+			.frame_header_cfg         = 0x00001A28,
+			.irq_subsample_period     = 0x00001A30,
+			.irq_subsample_pattern    = 0x00001A34,
+			.framedrop_period         = 0x00001A38,
+			.framedrop_pattern        = 0x00001A3C,
+			.mmu_prefetch_cfg         = 0x00001A60,
+			.mmu_prefetch_max_offset  = 0x00001A64,
+			.system_cache_cfg         = 0x00001A68,
+			.addr_status_0            = 0x00001A70,
+			.addr_status_1            = 0x00001A74,
+			.addr_status_2            = 0x00001A78,
+			.addr_status_3            = 0x00001A7C,
+			.debug_status_cfg         = 0x00001A80,
+			.debug_status_0           = 0x00001A84,
+			.debug_status_1           = 0x00001A88,
+			.bw_limiter_addr          = 0x00001A1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe690_ubwc_regs_client_20,
+		},
+		/* BUS Client 21 AI_OUT_1_C2 */
+		{
+			.cfg                      = 0x00001B00,
+			.image_addr               = 0x00001B04,
+			.frame_incr               = 0x00001B08,
+			.image_cfg_0              = 0x00001B0C,
+			.image_cfg_1              = 0x00001B10,
+			.image_cfg_2              = 0x00001B14,
+			.packer_cfg               = 0x00001B18,
+			.frame_header_addr        = 0x00001B20,
+			.frame_header_incr        = 0x00001B24,
+			.frame_header_cfg         = 0x00001B28,
+			.irq_subsample_period     = 0x00001B30,
+			.irq_subsample_pattern    = 0x00001B34,
+			.framedrop_period         = 0x00001B38,
+			.framedrop_pattern        = 0x00001B3C,
+			.mmu_prefetch_cfg         = 0x00001B60,
+			.mmu_prefetch_max_offset  = 0x00001B64,
+			.system_cache_cfg         = 0x00001B68,
+			.addr_status_0            = 0x00001B70,
+			.addr_status_1            = 0x00001B74,
+			.addr_status_2            = 0x00001B78,
+			.addr_status_3            = 0x00001B7C,
+			.debug_status_cfg         = 0x00001B80,
+			.debug_status_0           = 0x00001B84,
+			.debug_status_1           = 0x00001B88,
+			.bw_limiter_addr          = 0x00001B1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 22 AI_OUT_2_Y/C1 */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.framedrop_period         = 0x00001C38,
+			.framedrop_pattern        = 0x00001C3C,
+			.mmu_prefetch_cfg         = 0x00001C60,
+			.mmu_prefetch_max_offset  = 0x00001C64,
+			.system_cache_cfg         = 0x00001C68,
+			.addr_status_0            = 0x00001C70,
+			.addr_status_1            = 0x00001C74,
+			.addr_status_2            = 0x00001C78,
+			.addr_status_3            = 0x00001C7C,
+			.debug_status_cfg         = 0x00001C80,
+			.debug_status_0           = 0x00001C84,
+			.debug_status_1           = 0x00001C88,
+			.bw_limiter_addr          = 0x00001C1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe690_ubwc_regs_client_22,
+		},
+		/* BUS Client 23 AI_OUT_2_UV/C1 */
+		{
+			.cfg                      = 0x00001D00,
+			.image_addr               = 0x00001D04,
+			.frame_incr               = 0x00001D08,
+			.image_cfg_0              = 0x00001D0C,
+			.image_cfg_1              = 0x00001D10,
+			.image_cfg_2              = 0x00001D14,
+			.packer_cfg               = 0x00001D18,
+			.frame_header_addr        = 0x00001D20,
+			.frame_header_incr        = 0x00001D24,
+			.frame_header_cfg         = 0x00001D28,
+			.irq_subsample_period     = 0x00001D30,
+			.irq_subsample_pattern    = 0x00001D34,
+			.framedrop_period         = 0x00001D38,
+			.framedrop_pattern        = 0x00001D3C,
+			.mmu_prefetch_cfg         = 0x00001D60,
+			.mmu_prefetch_max_offset  = 0x00001D64,
+			.system_cache_cfg         = 0x00001D68,
+			.addr_status_0            = 0x00001D70,
+			.addr_status_1            = 0x00001D74,
+			.addr_status_2            = 0x00001D78,
+			.addr_status_3            = 0x00001D7C,
+			.debug_status_cfg         = 0x00001D90,
+			.debug_status_0           = 0x00001D84,
+			.debug_status_1           = 0x00001D88,
+			.bw_limiter_addr          = 0x00001D1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe690_ubwc_regs_client_23,
+		},
+		/* BUS Client 24 AI_OUT_2_C2 */
+		{
+			.cfg                      = 0x00001E00,
+			.image_addr               = 0x00001E04,
+			.frame_incr               = 0x00001E08,
+			.image_cfg_0              = 0x00001E0C,
+			.image_cfg_1              = 0x00001E10,
+			.image_cfg_2              = 0x00001E14,
+			.packer_cfg               = 0x00001E18,
+			.frame_header_addr        = 0x00001E20,
+			.frame_header_incr        = 0x00001E24,
+			.frame_header_cfg         = 0x00001E28,
+			.irq_subsample_period     = 0x00001E30,
+			.irq_subsample_pattern    = 0x00001E34,
+			.framedrop_period         = 0x00001E38,
+			.framedrop_pattern        = 0x00001E3C,
+			.mmu_prefetch_cfg         = 0x00001E60,
+			.mmu_prefetch_max_offset  = 0x00001E64,
+			.system_cache_cfg         = 0x00001E68,
+			.addr_status_0            = 0x00001E70,
+			.addr_status_1            = 0x00001E74,
+			.addr_status_2            = 0x00001E78,
+			.addr_status_3            = 0x00001E7C,
+			.debug_status_cfg         = 0x00001E80,
+			.debug_status_0           = 0x00001E84,
+			.debug_status_1           = 0x00001E88,
+			.bw_limiter_addr          = 0x00001E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 18,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe690_out_port_mid[0],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				16,
+			},
+			.name          = {
+				"RDI_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid           = vfe690_out_port_mid[1],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				17,
+			},
+			.name          = {
+				"RDI_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid           = vfe690_out_port_mid[2],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				18,
+			},
+			.name          = {
+				"RDI_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[3],
+			.num_mid       = 6,
+			.num_wm        = 3,
+			.wm_idx        = {
+				0,
+				1,
+				2,
+			},
+			.name          = {
+				"FULL_Y",
+				"FULL_C1",
+				"FULL_C2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[4],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				7,
+			},
+			.name          = {
+				"PIXEL_RAW",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[5],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				11,
+			},
+			.name          = {
+				"STATS_TL_BG",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[6],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				12,
+			},
+			.name          = {
+				"STATS_AWB_BGB",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[7],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				10,
+			},
+			.name          = {
+				"STATS_BHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[8],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				15,
+			},
+			.name          = {
+				"STATS_RS",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[9],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				3,
+				4,
+			},
+			.name          = {
+				"FULL_DISP_Y",
+				"FULL_DISP_C",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[10],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				5,
+			},
+			.name          = {
+				"DISP_DS_4",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[11],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				6,
+			},
+			.name          = {
+				"DISP_DS_16",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[12],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				13,
+			},
+			.name          = {
+				"AWB_BFW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[13],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				9,
+			},
+			.name          = {
+				"AEC_BE",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[14],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				8,
+			},
+			.name          = {
+				"LTM",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[15],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				14,
+			},
+			.name          = {
+				"GTM_BHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_1,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[16],
+			.num_mid       = 6,
+			.num_wm        = 3,
+			.wm_idx        = {
+				19,
+				20,
+				21,
+			},
+			.name          = {
+				"AI_OUT_1_Y",
+				"AI_OUT_1_C1",
+				"AI_OUT_1_C2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_2,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe690_out_port_mid[17],
+			.num_mid       = 6,
+			.num_wm        = 3,
+			.wm_idx        = {
+				22,
+				23,
+				24,
+			},
+			.name          = {
+				"AI_OUT_2_Y",
+				"AI_OUT_2_C1",
+				"AI_OUT_2_C2",
+			},
+		},
+	},
+	.num_cons_err = 29,
+	.constraint_error_list = {
+		{
+			.bitmask = BIT(0),
+			.error_description = "PPC 1x1 input not supported"
+		},
+		{
+			.bitmask = BIT(1),
+			.error_description = "PPC 1x2 input not supported"
+		},
+		{
+			.bitmask = BIT(2),
+			.error_description = "PPC 2x1 input not supported"
+		},
+		{
+			.bitmask = BIT(3),
+			.error_description = "PPC 2x2 input not supported"
+		},
+		{
+			.bitmask = BIT(4),
+			.error_description = "Pack 8 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(5),
+			.error_description = "Pack 16 format not supported"
+		},
+		{
+			.bitmask = BIT(6),
+			.error_description = "Pack 32 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(7),
+			.error_description = "Pack 64 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(8),
+			.error_description = "Pack MIPI 20 format not supported"
+		},
+		{
+			.bitmask = BIT(9),
+			.error_description = "Pack MIPI 14 format not supported"
+		},
+		{
+			.bitmask = BIT(10),
+			.error_description = "Pack MIPI 12 format not supported"
+		},
+		{
+			.bitmask = BIT(11),
+			.error_description = "Pack MIPI 10 format not supported"
+		},
+		{
+			.bitmask = BIT(12),
+			.error_description = "Pack 128 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(13),
+			.error_description = "UBWC NV12 format not supported"
+		},
+		{
+			.bitmask = BIT(14),
+			.error_description = "UBWC NV12 4R format not supported"
+		},
+		{
+			.bitmask = BIT(15),
+			.error_description = "UBWC TP10 format not supported"
+		},
+		{
+			.bitmask = BIT(16),
+			.error_description = "Frame based Mode not supported"
+		},
+		{
+			.bitmask = BIT(17),
+			.error_description = "Index based Mode not supported"
+		},
+		{
+			.bitmask = BIT(18),
+			.error_description = "FIFO image addr unalign"
+		},
+		{
+			.bitmask = BIT(19),
+			.error_description = "FIFO ubwc addr unalign"
+		},
+		{
+			.bitmask = BIT(20),
+			.error_description = "FIFO frmheader addr unalign"
+		},
+		{
+			.bitmask = BIT(21),
+			.error_description = "Image address unalign"
+		},
+		{
+			.bitmask = BIT(22),
+			.error_description = "UBWC address unalign"
+		},
+		{
+			.bitmask = BIT(23),
+			.error_description = "Frame Header address unalign"
+		},
+		{
+			.bitmask = BIT(24),
+			.error_description = "Stride unalign"
+		},
+		{
+			.bitmask = BIT(25),
+			.error_description = "X Initialization unalign"
+		},
+		{
+			.bitmask = BIT(26),
+			.error_description = "Image Width unalign"
+		},
+		{
+			.bitmask = BIT(27),
+			.error_description = "Image Height unalign"
+		},
+		{
+			.bitmask = BIT(28),
+			.error_description = "Meta Stride unalign"
+		},
+	},
+	.num_comp_grp          = 11,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3),
+		BIT(4), BIT(5), BIT(6), BIT(7),
+		BIT(13), BIT(14), BIT(15),
+	},
+	.top_irq_shift         = 0,
+	.max_out_res           = CAM_ISP_IFE_OUT_RES_BASE + 45,
+	.pack_align_shift      = 5,
+	.max_bw_counter_limit  = 0xFF,
+};
+
+static struct cam_vfe_irq_hw_info vfe690_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_EXT_CSID,
+	.top_irq_reg   = &vfe690_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe690_hw_info = {
+	.irq_hw_info                  = &vfe690_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe690_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe690_top_hw_info,
+};
+
+#endif /* _CAM_VFE690_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe692.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe692.h
@@ -0,0 +1,2273 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE692_H_
+#define _CAM_VFE692_H_
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_BUS_VER3_692_MAX_CLIENTS     28
+#define CAM_VFE_692_NUM_DBG_REG              17
+
+static struct cam_vfe_top_ver4_module_desc vfe692_ipp_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CLC_PREPROCESSOR",
+	},
+	{
+		.id = 1,
+		.desc = "CLC_COMPDECOMP",
+	},
+	{
+		.id = 2,
+		.desc = "CLC_CHANNEL_GAIN",
+	},
+	{
+		.id = 3,
+		.desc = "CLC_PDPC_BPC_1D",
+	},
+	{
+		.id = 4,
+		.desc = "CLC_PDPC_BPC_1D_POST_LSC",
+	},
+	{
+		.id = 5,
+		.desc = "CLC_LSC",
+	},
+	{
+		.id = 6,
+		.desc = "CLC_WB_GAIN",
+	},
+	{
+		.id = 7,
+		.desc = "CLC_GIC",
+	},
+	{
+		.id = 8,
+		.desc = "CLC_BPC_ABF",
+	},
+	{
+		.id = 9,
+		.desc = "CLC_BLS",
+	},
+	{
+		.id = 10,
+		.desc = "CLC_BAYER_GTM",
+	},
+	{
+		.id = 11,
+		.desc = "CLC_BAYER_LTM",
+	},
+	{
+		.id = 12,
+		.desc = "CLC_LCAC",
+	},
+	{
+		.id = 13,
+		.desc = "CLC_DEMOSAIC",
+	},
+	{
+		.id = 14,
+		.desc = "CLC_COLOR_CORRECT",
+	},
+	{
+		.id = 15,
+		.desc = "CLC_GTM",
+	},
+	{
+		.id = 16,
+		.desc = "CLC_GLUT",
+	},
+	{
+		.id = 17,
+		.desc = "CLC_GLUT_RGB_OUT",
+	},
+	{
+		.id = 18,
+		.desc = "CLC_COLOR_XFORM",
+	},
+	{
+		.id = 19,
+		.desc = "CLC_UVG",
+	},
+	{
+		.id = 20,
+		.desc = "CLC_CROP_RND_CLAMP_PIXEL_RAW_OUT",
+	},
+	{
+		.id = 21,
+		.desc = "CLC_DOWNSCALE_MN_Y_DISP_OUT",
+	},
+	{
+		.id = 22,
+		.desc = "CLC_DOWNSCALE_MN_C_DISP_OUT",
+	},
+	{
+		.id = 23,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_DISP_OUT",
+	},
+	{
+		.id = 24,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_DISP_OUT",
+	},
+	{
+		.id = 25,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS4_OUT",
+	},
+	{
+		.id = 26,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS4_OUT",
+	},
+	{
+		.id = 27,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS4_OUT",
+	},
+	{
+		.id = 28,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS4_OUT",
+	},
+	{
+		.id = 29,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS16_OUT",
+	},
+	{
+		.id = 30,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS16_OUT",
+	},
+	{
+		.id = 31,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS16_OUT",
+	},
+	{
+		.id = 32,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS16_OUT",
+	},
+	{
+		.id = 33,
+		.desc = "CLC_DOWNSCALE_MN_Y_VID_0_OUT",
+	},
+	{
+		.id = 34,
+		.desc = "CLC_DOWNSCALE_MN_Y_VID_1_OUT",
+	},
+	{
+		.id = 35,
+		.desc = "CLC_DOWNSCALE_MN_Y_VID_2_OUT",
+	},
+	{
+		.id = 36,
+		.desc = "CLC_DOWNSCALE_MN_C_VID_OUT",
+	},
+	{
+		.id = 37,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_0_OUT",
+	},
+	{
+		.id = 38,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_1_OUT",
+	},
+	{
+		.id = 39,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_2_OUT",
+	},
+	{
+		.id = 40,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_VID_OUT",
+	},
+	{
+		.id = 41,
+		.desc = "CLC_STATS_AEC_BE",
+	},
+	{
+		.id = 42,
+		.desc = "CLC_STATS_AEC_BHIST",
+	},
+	{
+		.id = 43,
+		.desc = "CLC_STATS_TINTLESS_BG",
+	},
+	{
+		.id = 44,
+		.desc = "CLC_STATS_AWB_BG",
+	},
+	{
+		.id = 45,
+		.desc = "CLC_STATS_BFW",
+	},
+	{
+		.id = 46,
+		.desc = "CLC_STATS_BHIST",
+	},
+	{
+		.id = 47,
+		.desc = "CLC_STATS_RS_W3CLC_STATS_RS",
+	},
+	{
+		.id = 48,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT1_0_OUT",
+	},
+	{
+		.id = 49,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT1_1_OUT",
+	},
+	{
+		.id = 50,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT1_2_OUT",
+	},
+	{
+		.id = 51,
+		.desc = "CLC_DOWNSCALE_MN_C_AI_OUT1_OUT",
+	},
+	{
+		.id = 52,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT1_0_OUT",
+	},
+	{
+		.id = 53,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT1_1_OUT",
+	},
+	{
+		.id = 54,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT1_2_OUT",
+	},
+	{
+		.id = 55,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_AI_OUT1_OUT",
+	},
+	{
+		.id = 56,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT2_0_OUT",
+	},
+	{
+		.id = 57,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT2_1_OUT",
+	},
+	{
+		.id = 58,
+		.desc = "CLC_DOWNSCALE_MN_Y_AI_OUT2_2_OUT",
+	},
+	{
+		.id = 59,
+		.desc = "CLC_DOWNSCALE_MN_C_AI_OUT2_OUT",
+	},
+	{
+		.id = 60,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT2_0_OUT",
+	},
+	{
+		.id = 61,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT2_1_OUT",
+	},
+	{
+		.id = 62,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_AI_OUT2_2_OUT",
+	},
+	{
+		.id = 63,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_AI_OUT2_OUT",
+	},
+};
+
+static struct cam_vfe_top_ver4_wr_client_desc vfe692_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "VIDEO_FULL_Y",
+	},
+	{
+		.wm_id = 1,
+		.desc = "VIDEO_FULL_C",
+	},
+	{
+		.wm_id = 2,
+		.desc = "VIDEO_FULL_C2",
+	},
+	{
+		.wm_id = 3,
+		.desc = "DISPLAY_FULL_Y",
+	},
+	{
+		.wm_id = 4,
+		.desc = "DISPLAY_FULL_C",
+	},
+	{
+		.wm_id = 5,
+		.desc = "DISPLAY_DS_4:1",
+	},
+	{
+		.wm_id = 6,
+		.desc = "DISPLAY_DS_16:1",
+	},
+	{
+		.wm_id = 7,
+		.desc = "PIXEL_RAW",
+	},
+	{
+		.wm_id = 8,
+		.desc = "STATS_LTM",
+	},
+	{
+		.wm_id = 9,
+		.desc = "STATS_BE0",
+	},
+	{
+		.wm_id = 10,
+		.desc = "STATS_BHIST0",
+	},
+	{
+		.wm_id = 11,
+		.desc = "STATS_TINTLESS_BG",
+	},
+	{
+		.wm_id = 12,
+		.desc = "STATS_AWB_BG",
+	},
+	{
+		.wm_id = 13,
+		.desc = "STATS_AWB_BFW",
+	},
+	{
+		.wm_id = 14,
+		.desc = "STATS_BHIST",
+	},
+	{
+		.wm_id = 15,
+		.desc = "STATS_RS",
+	},
+	{
+		.wm_id = 16,
+		.desc = "RDI0",
+	},
+	{
+		.wm_id = 17,
+		.desc = "RDI1",
+	},
+	{
+		.wm_id = 18,
+		.desc = "RDI2",
+	},
+	{
+		.wm_id = 19,
+		.desc = "AI_OUT_1_Y",
+	},
+	{
+		.wm_id = 20,
+		.desc = "AI_OUT_1_UV",
+	},
+	{
+		.wm_id = 21,
+		.desc = "AI_OUT_1_C2",
+	},
+	{
+		.wm_id = 22,
+		.desc = "AI_OUT_2_Y",
+	},
+	{
+		.wm_id = 23,
+		.desc = "AI_OUT_2_UV",
+	},
+	{
+		.wm_id = 24,
+		.desc = "AI_OUT_2_C2",
+	},
+	{
+		.wm_id = 25,
+		.desc = "IR_OUT",
+	},
+	{
+		.wm_id = 26,
+		.desc = "STATS_IR_BG",
+	},
+	{
+		.wm_id = 27,
+		.desc = "STATS_IR_BHIST",
+	},
+};
+
+static struct cam_vfe_top_ver4_top_err_irq_desc vfe692_top_irq_err_desc[] = {
+	{
+		.bitmask = BIT(4),
+		.err_name = "PP VIOLATION",
+		.desc = "PIXEL PIPE VIOLATION",
+	},
+	{
+		.bitmask = BIT(9),
+		.err_name = "DSP IFE PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the output Data",
+	},
+	{
+		.bitmask = BIT(10),
+		.err_name = "IFE DSP TX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the outgoing data to the DSP interface",
+	},
+	{
+		.bitmask = BIT(11),
+		.err_name = "DSP IFE RX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the incoming data from DSP before processed",
+	},
+	{
+		.bitmask = BIT(12),
+		.err_name = "DSP TX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface TX path FIFO",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_name = "DSP RX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface RX path FIFO",
+	},
+	{
+		.bitmask = BIT(14),
+		.err_name = "DSP ERROR VIOLATION",
+		.desc = "When DSP sends a error signal",
+	},
+	{
+		.bitmask = BIT(15),
+		.err_name = "DIAG VIOLATION",
+		.desc = "HBI is less than the minimum required HBI",
+	},
+};
+
+static struct cam_irq_register_set vfe692_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x000000A8,
+		.clear_reg_offset  = 0x000000B0,
+		.status_reg_offset = 0x000000B8,
+		.test_set_val      = BIT(1),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x000000AC,
+		.clear_reg_offset  = 0x000000B4,
+		.status_reg_offset = 0x000000BC,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe692_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe692_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x000000A4,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe692_top_debug_reg[] = {
+	0x00000128,
+	0x0000012C,
+	0x00000130,
+	0x00000134,
+	0x00000138,
+	0x0000013C,
+	0x00000140,
+	0x00000144,
+	0x00000148,
+	0x0000014C,
+	0x00000150,
+	0x00000154,
+	0x00000158,
+	0x0000015C,
+	0x00000160,
+	0x00000164,
+	0x00000168,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe692_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.core_cfg_0               = 0x00000024,
+	.core_cfg_1               = 0x00000028,
+	.core_cfg_2               = 0x0000002C,
+	.global_reset_cmd         = 0x000000A4,
+	.diag_config              = 0x00000044,
+	.diag_sensor_status_0     = 0x00000048,
+	.diag_sensor_status_1     = 0x0000004C,
+	.diag_frm_cnt_status_0    = 0x00000050,
+	.diag_frm_cnt_status_1    = 0x00000054,
+	.ipp_violation_status_0   = 0x000000F0,
+	.ipp_violation_status_1   = 0x000000F4,
+	.core_cgc_ovd_0           = 0x00000018,
+	.core_cgc_ovd_1           = 0x0000001C,
+	.ahb_cgc_ovd              = 0x00000020,
+	.dsp_status               = 0x00000124,
+	.stats_throttle_cfg_0     = 0x0000005C,
+	.stats_throttle_cfg_1     = 0x00000060,
+	.period_cfg               = 0x00000030,
+	.irq_sub_pattern_cfg      = 0x00000034,
+	.epoch0_pattern_cfg       = 0x00000038,
+	.epoch1_pattern_cfg       = 0x0000003C,
+	.epoch_height_cfg         = 0x00000040,
+	.bus_violation_status     = 0x00000464,
+	.bus_overflow_status      = 0x00000468,
+	.num_perf_counters        = 3,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg    = 0x000001A8,
+			.perf_pix_count    = 0x000001AC,
+			.perf_line_count   = 0x000001B0,
+			.perf_stall_count  = 0x000001B4,
+			.perf_always_count = 0x000001B8,
+			.perf_count_status = 0x000001BC,
+		},
+		{
+			.perf_count_cfg    = 0x000001C0,
+			.perf_pix_count    = 0x000001C4,
+			.perf_line_count   = 0x000001C8,
+			.perf_stall_count  = 0x000001CC,
+			.perf_always_count = 0x000001D0,
+			.perf_count_status = 0x000001D4,
+		},
+		{
+			.perf_count_cfg    = 0x000001D8,
+			.perf_pix_count    = 0x000001DC,
+			.perf_line_count   = 0x000001E0,
+			.perf_stall_count  = 0x000001E8,
+			.perf_always_count = 0x000001EC,
+			.perf_count_status = 0x000001F0,
+		},
+	},
+	.top_debug_cfg            = 0x00000170,
+	.num_top_debug_reg        = CAM_VFE_692_NUM_DBG_REG,
+	.top_debug = vfe692_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe692_pp_common_reg_data = {
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x10000,
+	.epoch1_irq_mask                 = 0x20000,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask                  = 0xFE10,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+	.ipp_violation_mask              = 0x10,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe692_vfe_full_rdi_reg_data[3] = {
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x400,
+		.eof_irq_mask                    = 0x800,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x1000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+};
+
+struct cam_vfe_ver4_path_hw_info
+	vfe692_rdi_hw_info_arr[] = {
+	{
+		.common_reg     = &vfe692_top_common_reg,
+		.reg_data       = &vfe692_vfe_full_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe692_top_common_reg,
+		.reg_data       = &vfe692_vfe_full_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe692_top_common_reg,
+		.reg_data       = &vfe692_vfe_full_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver4_debug_reg_info vfe692_dbg_reg_info[CAM_VFE_692_NUM_DBG_REG][8] = {
+	VFE_DBG_INFO_ARRAY_4bit("test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_RS",
+		"GTM_BHIST",
+		"TINTLESS_BG",
+		"STATS_AWF_BFW",
+		"STATS_AWF_BG",
+		"STATS_AEC_BHIST",
+		"STATS_AEC_BE",
+		"AI_OUT2_Output_packer_C"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"AI_OUT2_Output_packer_Y2",
+		"AI_OUT2_Output_packer_Y1",
+		"AI_OUT2_Output_packer_Y0",
+		"crop_rnd_clamp_downscale_mn_c_ai_out_2",
+		"downscale_mn_c_ai_out_2",
+		"crop_rnd_clamp_downscale_mn_y_ai_out_2_2",
+		"downscale_mn_y_ai_out2_2",
+		"crop_rnd_clamp_downscale_mn_y_ai_out2_1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_y_ai_out2_1",
+		"crop_rnd_clamp_downscale_mn_y_ai_out2_0",
+		"downscale_mn_y_ai_out2_0",
+		"ai_out1_output_packer_c",
+		"ai_out1_output_packer_y2",
+		"ai_out1_output_packer_y1",
+		"ai_out1_output_packer_y0",
+		"crop_rnd_clamp_downscale_mn_c_ai_out1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_c_ai_out1",
+		"crop_rnd_clamp_downscale_mn_y_ai_out1_2",
+		"downscale_mn_y_ai_out1_2",
+		"crop_rnd_clamp_downscale_mn_y_ai_out1_1",
+		"downscale_mn_y_ai_out1_1",
+		"crop_rnd_clamp_downscale_mn_y_ai_out1_0",
+		"downscale_mn_y_ai_out1_0",
+		"vid_output_packer_c"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"vid_output_packer_y2",
+		"vid_output_packer_y1",
+		"vid_output_packer_y0",
+		"crop_rnd_clamp_downscale_mn_c_vid",
+		"downscale_mn_c_vid",
+		"crop_rnd_clamp_downscale_mn_y_vid_2",
+		"downscale_mn_y_vid_2",
+		"crop_rnd_clamp_downscale_mn_y_vid_1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_y_vid_1",
+		"crop_rnd_clamp_downscale_mn_y_vid_0",
+		"downscale_mn_y_vid_0",
+		"rp2d_ds16_disp",
+		"rp2d_ds16_disp",
+		"crop_rnd_clamp_post_downscale_4to1_c_ds16_disp",
+		"downscale_4to1_c_disp_ds16",
+		"crop_rnd_clamp_post_downscale_4to1_y_ds16_disp"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_4to1_y_disp_ds16_idle",
+		"rp2d_ds4_disp",
+		"rp2d_ds4_disp",
+		"crop_rnd_clamp_post_downscale_4to1_c_ds4_disp",
+		"downscale_4to1_c_disp_ds4",
+		"crop_rnd_clamp_post_downscale_4to1_y_ds4_disp",
+		"downscale_4to1_y_disp_ds4",
+		"crop_rnd_clamp_post_downscale_mn_c_disp"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_c_disp",
+		"crop_rnd_clamp_post_downscale_mn_y_disp",
+		"downscale_mn_y_disp",
+		"uvg",
+		"color_xform",
+		"glut_rgb",
+		"glut",
+		"gtm"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"color_correct",
+		"isp_throttle",
+		"demo",
+		"hvx_tap2",
+		"lcac",
+		"bayer_ltm",
+		"bayer_gtm",
+		"bls"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"bpc_abf",
+		"gic",
+		"wb_gain",
+		"pdpc_bpc_1d_post_lsc",
+		"lsc",
+		"pdpc_bpc_1d",
+		"crop_rnd_clamp_pixe_raw_out",
+		"hvx_tap1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"channel_gain",
+		"compdecomp_idle",
+		"hvx_tap0",
+		"preprocess_idle",
+		"RDI2",
+		"RDI1",
+		"RDI0",
+		"CLIENT_24:AI_OUT_2_C2"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"CLIENT_23:AI_OUT_2_UV/C1",
+		"CLIENT_22:AI_OUT_2_Y/C1",
+		"CLIENT_21:AI_OUT_1_C2",
+		"CLIENT_20:AI_OUT_1_UV/C1",
+		"CLIENT_19:AI_OUT_1_Y/C1",
+		"CLIENT_15:Stats FLICKER RS",
+		"CLIENT_14:Stats GTM BHIST",
+		"CLIENT_13:Stats AWB BFW"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"CLIENT_12:Stats AWB BG",
+		"CLIENT_11:Stats Tintless BG",
+		"CLIENT_10:Stats AEC BHIST",
+		"CLIENT_9:Stats AEC BE",
+		"CLIENT_8:LTM STATS",
+		"CLIENT_7:Pixel Raw",
+		"CLIENT_6:DISP 16:1",
+		"CLIENT_5:DISP 4:1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"CLIENT_4:DISP C 1:1",
+		"CLIENT_3:DISP Y 1:1",
+		"CLIENT_2:VID C2",
+		"CLIENT_1:VID UV/C1",
+		"CLIENT_0:VID Y/C0",
+		"PP",
+		"CLIENT_25",
+		"CLIENT_26"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"CLIENT_27",
+		"STATS_IR_BHIST",
+		"STATS_IR_BG",
+		"CROP_RND_CLAMP_IR",
+		"XCFA_RGBIR_REMOX",
+		"XCFA_BPC_PDPC",
+		"XCFA_CHANNEL_GAINS",
+		"ISP_THROTTLE_IR"
+	),
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe692_top_hw_info = {
+	.common_reg = &vfe692_top_common_reg,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe692_top_common_reg,
+		.reg_data       = &vfe692_pp_common_reg_data,
+	},
+	.rdi_hw_info            = vfe692_rdi_hw_info_arr,
+	.wr_client_desc         = vfe692_wr_client_desc,
+	.ipp_module_desc        = vfe692_ipp_mod_desc,
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.num_rdi                         = ARRAY_SIZE(vfe692_rdi_hw_info_arr),
+	.num_top_errors                  = ARRAY_SIZE(vfe692_top_irq_err_desc),
+	.top_err_desc                    = vfe692_top_irq_err_desc,
+	.debug_reg_info                  = &vfe692_dbg_reg_info,
+};
+
+static struct cam_irq_register_set vfe692_bus_irq_reg[1] = {
+		{
+			.mask_reg_offset   = 0x00000418,
+			.clear_reg_offset  = 0x00000420,
+			.status_reg_offset = 0x00000428,
+			.set_reg_offset    = 0x00000450,
+		},
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe692_ubwc_regs_client_0 = {
+	.meta_addr        = 0x00000640,
+	.meta_cfg         = 0x00000644,
+	.mode_cfg         = 0x00000648,
+	.stats_ctrl       = 0x0000064C,
+	.ctrl_2           = 0x00000650,
+	.lossy_thresh0    = 0x00000654,
+	.lossy_thresh1    = 0x00000658,
+	.off_lossy_var    = 0x0000065C,
+	.bw_limit         = 0x0000061C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe692_ubwc_regs_client_1 = {
+	.meta_addr        = 0x00000740,
+	.meta_cfg         = 0x00000744,
+	.mode_cfg         = 0x00000748,
+	.stats_ctrl       = 0x0000074C,
+	.ctrl_2           = 0x00000750,
+	.lossy_thresh0    = 0x00000754,
+	.lossy_thresh1    = 0x00000758,
+	.off_lossy_var    = 0x0000075C,
+	.bw_limit         = 0x0000071C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe692_ubwc_regs_client_3 = {
+	.meta_addr        = 0x00000940,
+	.meta_cfg         = 0x00000944,
+	.mode_cfg         = 0x00000948,
+	.stats_ctrl       = 0x0000094C,
+	.ctrl_2           = 0x00000950,
+	.lossy_thresh0    = 0x00000954,
+	.lossy_thresh1    = 0x00000958,
+	.off_lossy_var    = 0x0000095C,
+	.bw_limit         = 0x0000091C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe692_ubwc_regs_client_4 = {
+	.meta_addr        = 0x00000A40,
+	.meta_cfg         = 0x00000A44,
+	.mode_cfg         = 0x00000A48,
+	.stats_ctrl       = 0x00000A4C,
+	.ctrl_2           = 0x00000A50,
+	.lossy_thresh0    = 0x00000A54,
+	.lossy_thresh1    = 0x00000A58,
+	.off_lossy_var    = 0x00000A5C,
+	.bw_limit         = 0x00000A1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe692_ubwc_regs_client_19 = {
+	.meta_addr        = 0x00001940,
+	.meta_cfg         = 0x00001944,
+	.mode_cfg         = 0x00001948,
+	.stats_ctrl       = 0x0000194C,
+	.ctrl_2           = 0x00001950,
+	.lossy_thresh0    = 0x00001954,
+	.lossy_thresh1    = 0x00001958,
+	.off_lossy_var    = 0x0000195C,
+	.bw_limit         = 0x0000191C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe692_ubwc_regs_client_20 = {
+	.meta_addr        = 0x00001A40,
+	.meta_cfg         = 0x00001A44,
+	.mode_cfg         = 0x00001A48,
+	.stats_ctrl       = 0x00001A4C,
+	.ctrl_2           = 0x00001A50,
+	.lossy_thresh0    = 0x00001A54,
+	.lossy_thresh1    = 0x00001A58,
+	.off_lossy_var    = 0x00001A5C,
+	.bw_limit         = 0x00001A1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe692_ubwc_regs_client_22 = {
+	.meta_addr        = 0x00001C40,
+	.meta_cfg         = 0x00001C44,
+	.mode_cfg         = 0x00001C48,
+	.stats_ctrl       = 0x00001C4C,
+	.ctrl_2           = 0x00001C50,
+	.lossy_thresh0    = 0x00001C54,
+	.lossy_thresh1    = 0x00001C58,
+	.off_lossy_var    = 0x00001C5C,
+	.bw_limit         = 0x00001C1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe692_ubwc_regs_client_23 = {
+	.meta_addr        = 0x00001D40,
+	.meta_cfg         = 0x00001D44,
+	.mode_cfg         = 0x00001D48,
+	.stats_ctrl       = 0x00001D4C,
+	.ctrl_2           = 0x00001D50,
+	.lossy_thresh0    = 0x00001D54,
+	.lossy_thresh1    = 0x00001D58,
+	.off_lossy_var    = 0x00001D5C,
+	.bw_limit         = 0x00001D1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static uint32_t vfe692_out_port_mid[][6] = {
+	{29, 0, 0, 0},
+	{30, 0, 0, 0},
+	{31, 0, 0, 0},
+	{32, 33, 34, 35, 36, 37},
+	{18, 19, 0, 0},
+	{24, 0, 0, 0},
+	{25, 0, 0, 0},
+	{23, 0, 0, 0},
+	{28, 0, 0, 0},
+	{38, 39, 40, 41},
+	{16, 0, 0, 0},
+	{17, 0, 0, 0},
+	{26, 0, 0, 0},
+	{22, 0, 0, 0},
+	{20, 21, 0, 0},
+	{27, 0, 0, 0},
+	{42, 43, 44, 45, 46, 47},
+	{48, 49, 50, 51, 52, 53},
+	{16, 17, 0, 0},
+	{18, 0, 0, 0},
+	{19, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe692_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000400,
+		.cgc_ovd                          = 0x00000408,
+		.if_frameheader_cfg               = {
+			0x00000434,
+			0x00000438,
+			0x0000043C,
+			0x00000440,
+		},
+		.ubwc_static_ctrl                 = 0x00000458,
+		.pwr_iso_cfg                      = 0x0000045C,
+		.overflow_status_clear            = 0x00000460,
+		.ccif_violation_status            = 0x00000464,
+		.overflow_status                  = 0x00000468,
+		.image_size_violation_status      = 0x00000470,
+		.debug_status_top_cfg             = 0x000004F0,
+		.debug_status_top                 = 0x000004F4,
+		.test_bus_ctrl                    = 0x000004FC,
+		.irq_reg_info = {
+			.num_registers            = 1,
+			.irq_reg_set              = vfe692_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00000430,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = CAM_VFE_BUS_VER3_692_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 FULL Y */
+		{
+			.cfg                      = 0x00000600,
+			.image_addr               = 0x00000604,
+			.frame_incr               = 0x00000608,
+			.image_cfg_0              = 0x0000060C,
+			.image_cfg_1              = 0x00000610,
+			.image_cfg_2              = 0x00000614,
+			.packer_cfg               = 0x00000618,
+			.frame_header_addr        = 0x00000620,
+			.frame_header_incr        = 0x00000624,
+			.frame_header_cfg         = 0x00000628,
+			.irq_subsample_period     = 0x00000630,
+			.irq_subsample_pattern    = 0x00000634,
+			.framedrop_period         = 0x00000638,
+			.framedrop_pattern        = 0x0000063C,
+			.mmu_prefetch_cfg         = 0x00000660,
+			.mmu_prefetch_max_offset  = 0x00000664,
+			.system_cache_cfg         = 0x00000668,
+			.addr_status_0            = 0x00000670,
+			.addr_status_1            = 0x00000674,
+			.addr_status_2            = 0x00000678,
+			.addr_status_3            = 0x0000067C,
+			.debug_status_cfg         = 0x00000680,
+			.debug_status_0           = 0x00000684,
+			.debug_status_1           = 0x00000688,
+			.bw_limiter_addr          = 0x0000061C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe692_ubwc_regs_client_0,
+		},
+		/* BUS Client 1 FULL C */
+		{
+			.cfg                      = 0x00000700,
+			.image_addr               = 0x00000704,
+			.frame_incr               = 0x00000708,
+			.image_cfg_0              = 0x0000070C,
+			.image_cfg_1              = 0x00000710,
+			.image_cfg_2              = 0x00000714,
+			.packer_cfg               = 0x00000718,
+			.frame_header_addr        = 0x00000720,
+			.frame_header_incr        = 0x00000724,
+			.frame_header_cfg         = 0x00000728,
+			.irq_subsample_period     = 0x00000730,
+			.irq_subsample_pattern    = 0x00000734,
+			.framedrop_period         = 0x00000738,
+			.framedrop_pattern        = 0x0000073C,
+			.mmu_prefetch_cfg         = 0x00000760,
+			.mmu_prefetch_max_offset  = 0x00000764,
+			.system_cache_cfg         = 0x00000768,
+			.addr_status_0            = 0x00000770,
+			.addr_status_1            = 0x00000774,
+			.addr_status_2            = 0x00000778,
+			.addr_status_3            = 0x0000077C,
+			.debug_status_cfg         = 0x00000780,
+			.debug_status_0           = 0x00000784,
+			.debug_status_1           = 0x00000788,
+			.bw_limiter_addr          = 0x0000071C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe692_ubwc_regs_client_1,
+		},
+		/* BUS Client 2 VID C2 */
+		{
+			.cfg                      = 0x00000800,
+			.image_addr               = 0x00000804,
+			.frame_incr               = 0x00000808,
+			.image_cfg_0              = 0x0000080C,
+			.image_cfg_1              = 0x00000810,
+			.image_cfg_2              = 0x00000814,
+			.packer_cfg               = 0x00000818,
+			.irq_subsample_period     = 0x00000830,
+			.irq_subsample_pattern    = 0x00000834,
+			.framedrop_period         = 0x00000838,
+			.framedrop_pattern        = 0x0000083C,
+			.mmu_prefetch_cfg         = 0x00000860,
+			.mmu_prefetch_max_offset  = 0x00000864,
+			.system_cache_cfg         = 0x00000868,
+			.addr_status_0            = 0x00000870,
+			.addr_status_1            = 0x00000874,
+			.addr_status_2            = 0x00000878,
+			.addr_status_3            = 0x0000087C,
+			.debug_status_cfg         = 0x00000880,
+			.debug_status_0           = 0x00000884,
+			.debug_status_1           = 0x00000888,
+			.bw_limiter_addr          = 0x0000081C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 DISP Y */
+		{
+			.cfg                      = 0x00000900,
+			.image_addr               = 0x00000904,
+			.frame_incr               = 0x00000908,
+			.image_cfg_0              = 0x0000090C,
+			.image_cfg_1              = 0x00000910,
+			.image_cfg_2              = 0x00000914,
+			.packer_cfg               = 0x00000918,
+			.frame_header_addr        = 0x00000920,
+			.frame_header_incr        = 0x00000924,
+			.frame_header_cfg         = 0x00000928,
+			.irq_subsample_period     = 0x00000930,
+			.irq_subsample_pattern    = 0x00000934,
+			.framedrop_period         = 0x00000938,
+			.framedrop_pattern        = 0x0000093C,
+			.mmu_prefetch_cfg         = 0x00000960,
+			.mmu_prefetch_max_offset  = 0x00000964,
+			.system_cache_cfg         = 0x00000968,
+			.addr_status_0            = 0x00000970,
+			.addr_status_1            = 0x00000974,
+			.addr_status_2            = 0x00000978,
+			.addr_status_3            = 0x0000097C,
+			.debug_status_cfg         = 0x00000980,
+			.debug_status_0           = 0x00000984,
+			.debug_status_1           = 0x00000988,
+			.bw_limiter_addr          = 0x0000091C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe692_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 DISP C */
+		{
+			.cfg                      = 0x00000A00,
+			.image_addr               = 0x00000A04,
+			.frame_incr               = 0x00000A08,
+			.image_cfg_0              = 0x00000A0C,
+			.image_cfg_1              = 0x00000A10,
+			.image_cfg_2              = 0x00000A14,
+			.packer_cfg               = 0x00000A18,
+			.frame_header_addr        = 0x00000A20,
+			.frame_header_incr        = 0x00000A24,
+			.frame_header_cfg         = 0x00000A28,
+			.irq_subsample_period     = 0x00000A30,
+			.irq_subsample_pattern    = 0x00000A34,
+			.framedrop_period         = 0x00000A38,
+			.framedrop_pattern        = 0x00000A3C,
+			.mmu_prefetch_cfg         = 0x00000A60,
+			.mmu_prefetch_max_offset  = 0x00000A64,
+			.system_cache_cfg         = 0x00000A68,
+			.addr_status_0            = 0x00000A70,
+			.addr_status_1            = 0x00000A74,
+			.addr_status_2            = 0x00000A78,
+			.addr_status_3            = 0x00000A7C,
+			.debug_status_cfg         = 0x00000A80,
+			.debug_status_0           = 0x00000A84,
+			.debug_status_1           = 0x00000A88,
+			.bw_limiter_addr          = 0x00000A1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe692_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 DISP DS4 */
+		{
+			.cfg                      = 0x00000B00,
+			.image_addr               = 0x00000B04,
+			.frame_incr               = 0x00000B08,
+			.image_cfg_0              = 0x00000B0C,
+			.image_cfg_1              = 0x00000B10,
+			.image_cfg_2              = 0x00000B14,
+			.packer_cfg               = 0x00000B18,
+			.irq_subsample_period     = 0x00000B30,
+			.irq_subsample_pattern    = 0x00000B34,
+			.framedrop_period         = 0x00000B38,
+			.framedrop_pattern        = 0x00000B3C,
+			.mmu_prefetch_cfg         = 0x00000B60,
+			.mmu_prefetch_max_offset  = 0x00000B64,
+			.system_cache_cfg         = 0x00000B68,
+			.addr_status_0            = 0x00000B70,
+			.addr_status_1            = 0x00000B74,
+			.addr_status_2            = 0x00000B78,
+			.addr_status_3            = 0x00000B7C,
+			.debug_status_cfg         = 0x00000B80,
+			.debug_status_0           = 0x00000B84,
+			.debug_status_1           = 0x00000B88,
+			.bw_limiter_addr          = 0x00000B1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 DISP DS16 */
+		{
+			.cfg                      = 0x00000C00,
+			.image_addr               = 0x00000C04,
+			.frame_incr               = 0x00000C08,
+			.image_cfg_0              = 0x00000C0C,
+			.image_cfg_1              = 0x00000C10,
+			.image_cfg_2              = 0x00000C14,
+			.packer_cfg               = 0x00000C18,
+			.irq_subsample_period     = 0x00000C30,
+			.irq_subsample_pattern    = 0x00000C34,
+			.framedrop_period         = 0x00000C38,
+			.framedrop_pattern        = 0x00000C3C,
+			.mmu_prefetch_cfg         = 0x00000C60,
+			.mmu_prefetch_max_offset  = 0x00000C64,
+			.system_cache_cfg         = 0x00000C68,
+			.addr_status_0            = 0x00000C70,
+			.addr_status_1            = 0x00000C74,
+			.addr_status_2            = 0x00000C78,
+			.addr_status_3            = 0x00000C7C,
+			.debug_status_cfg         = 0x00000C80,
+			.debug_status_0           = 0x00000C84,
+			.debug_status_1           = 0x00000C88,
+			.bw_limiter_addr          = 0x00000C1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 Pixel Raw */
+		{
+			.cfg                      = 0x00000D00,
+			.image_addr               = 0x00000D04,
+			.frame_incr               = 0x00000D08,
+			.image_cfg_0              = 0x00000D0C,
+			.image_cfg_1              = 0x00000D10,
+			.image_cfg_2              = 0x00000D14,
+			.packer_cfg               = 0x00000D18,
+			.frame_header_addr        = 0x00000D20,
+			.frame_header_incr        = 0x00000D24,
+			.frame_header_cfg         = 0x00000D28,
+			.irq_subsample_period     = 0x00000D30,
+			.irq_subsample_pattern    = 0x00000D34,
+			.framedrop_period         = 0x00000D38,
+			.framedrop_pattern        = 0x00000D3C,
+			.mmu_prefetch_cfg         = 0x00000D60,
+			.mmu_prefetch_max_offset  = 0x00000D64,
+			.system_cache_cfg         = 0x00000D68,
+			.addr_status_0            = 0x00000D70,
+			.addr_status_1            = 0x00000D74,
+			.addr_status_2            = 0x00000D78,
+			.addr_status_3            = 0x00000D7C,
+			.debug_status_cfg         = 0x00000D90,
+			.debug_status_0           = 0x00000D84,
+			.debug_status_1           = 0x00000D88,
+			.bw_limiter_addr          = 0x00000D1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 LTM STATS  */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_status_0            = 0x00000E70,
+			.addr_status_1            = 0x00000E74,
+			.addr_status_2            = 0x00000E78,
+			.addr_status_3            = 0x00000E7C,
+			.debug_status_cfg         = 0x00000E80,
+			.debug_status_0           = 0x00000E84,
+			.debug_status_1           = 0x00000E88,
+			.bw_limiter_addr          = 0x00000E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9:Stats AEC BE*/
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_status_0            = 0x00000F70,
+			.addr_status_1            = 0x00000F74,
+			.addr_status_2            = 0x00000F78,
+			.addr_status_3            = 0x00000F7C,
+			.debug_status_cfg         = 0x00000F80,
+			.debug_status_0           = 0x00000F84,
+			.debug_status_1           = 0x00000F88,
+			.bw_limiter_addr          = 0x00000F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10:Stats AEC BHIST*/
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.frame_header_addr        = 0x00001020,
+			.frame_header_incr        = 0x00001024,
+			.frame_header_cfg         = 0x00001028,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.system_cache_cfg         = 0x00001068,
+			.addr_status_0            = 0x00001070,
+			.addr_status_1            = 0x00001074,
+			.addr_status_2            = 0x00001078,
+			.addr_status_3            = 0x0000107C,
+			.debug_status_cfg         = 0x00001080,
+			.debug_status_0           = 0x00001084,
+			.debug_status_1           = 0x00001088,
+			.bw_limiter_addr          = 0x0000101C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 Stats Tintless BG */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.frame_header_addr        = 0x00001120,
+			.frame_header_incr        = 0x00001124,
+			.frame_header_cfg         = 0x00001128,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.system_cache_cfg         = 0x00001168,
+			.addr_status_0            = 0x00001170,
+			.addr_status_1            = 0x00001174,
+			.addr_status_2            = 0x00001178,
+			.addr_status_3            = 0x0000117C,
+			.debug_status_cfg         = 0x00001180,
+			.debug_status_0           = 0x00001184,
+			.debug_status_1           = 0x00001188,
+			.bw_limiter_addr          = 0x0000111C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 Stats AWB BG */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.system_cache_cfg         = 0x00001268,
+			.addr_status_0            = 0x00001270,
+			.addr_status_1            = 0x00001274,
+			.addr_status_2            = 0x00001278,
+			.addr_status_3            = 0x0000127C,
+			.debug_status_cfg         = 0x00001280,
+			.debug_status_0           = 0x00001284,
+			.debug_status_1           = 0x00001288,
+			.bw_limiter_addr          = 0x0000121C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 Stats AWB BFW */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.system_cache_cfg         = 0x00001368,
+			.addr_status_0            = 0x00001370,
+			.addr_status_1            = 0x00001374,
+			.addr_status_2            = 0x00001378,
+			.addr_status_3            = 0x0000137C,
+			.debug_status_cfg         = 0x00001380,
+			.debug_status_0           = 0x00001384,
+			.debug_status_1           = 0x00001388,
+			.bw_limiter_addr          = 0x0000131C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 Stats GTM BHIST */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_status_0            = 0x00001470,
+			.addr_status_1            = 0x00001474,
+			.addr_status_2            = 0x00001478,
+			.addr_status_3            = 0x0000147C,
+			.debug_status_cfg         = 0x00001480,
+			.debug_status_0           = 0x00001484,
+			.debug_status_1           = 0x00001488,
+			.bw_limiter_addr          = 0x0000141C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 Stats RS */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_status_0            = 0x00001570,
+			.addr_status_1            = 0x00001574,
+			.addr_status_2            = 0x00001578,
+			.addr_status_3            = 0x0000157C,
+			.debug_status_cfg         = 0x00001580,
+			.debug_status_0           = 0x00001584,
+			.debug_status_1           = 0x00001588,
+			.bw_limiter_addr          = 0x0000151C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 RDI0 */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_status_0            = 0x00001670,
+			.addr_status_1            = 0x00001674,
+			.addr_status_2            = 0x00001678,
+			.addr_status_3            = 0x0000167C,
+			.debug_status_cfg         = 0x00001680,
+			.debug_status_0           = 0x00001684,
+			.debug_status_1           = 0x00001688,
+			.bw_limiter_addr          = 0x0000161C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_8,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 RDI1 */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.frame_header_addr        = 0x00001720,
+			.frame_header_incr        = 0x00001724,
+			.frame_header_cfg         = 0x00001728,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_status_0            = 0x00001770,
+			.addr_status_1            = 0x00001774,
+			.addr_status_2            = 0x00001778,
+			.addr_status_3            = 0x0000177C,
+			.debug_status_cfg         = 0x00001780,
+			.debug_status_0           = 0x00001784,
+			.debug_status_1           = 0x00001788,
+			.bw_limiter_addr          = 0x0000171C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_9,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 RDI2 */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.framedrop_period         = 0x00001838,
+			.framedrop_pattern        = 0x0000183C,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_status_0            = 0x00001870,
+			.addr_status_1            = 0x00001874,
+			.addr_status_2            = 0x00001878,
+			.addr_status_3            = 0x0000187C,
+			.debug_status_cfg         = 0x00001880,
+			.debug_status_0           = 0x00001884,
+			.debug_status_1           = 0x00001888,
+			.bw_limiter_addr          = 0x0000181C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_10,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 AI_OUT_1_Y/C1 */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.framedrop_period         = 0x00001938,
+			.framedrop_pattern        = 0x0000193C,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_status_0            = 0x00001970,
+			.addr_status_1            = 0x00001974,
+			.addr_status_2            = 0x00001978,
+			.addr_status_3            = 0x0000197C,
+			.debug_status_cfg         = 0x00001980,
+			.debug_status_0           = 0x00001984,
+			.debug_status_1           = 0x00001988,
+			.bw_limiter_addr          = 0x0000191C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe692_ubwc_regs_client_19,
+		},
+		/* BUS Client 20 AI_OUT_1_UV/C1 */
+		{
+			.cfg                      = 0x00001A00,
+			.image_addr               = 0x00001A04,
+			.frame_incr               = 0x00001A08,
+			.image_cfg_0              = 0x00001A0C,
+			.image_cfg_1              = 0x00001A10,
+			.image_cfg_2              = 0x00001A14,
+			.packer_cfg               = 0x00001A18,
+			.frame_header_addr        = 0x00001A20,
+			.frame_header_incr        = 0x00001A24,
+			.frame_header_cfg         = 0x00001A28,
+			.irq_subsample_period     = 0x00001A30,
+			.irq_subsample_pattern    = 0x00001A34,
+			.framedrop_period         = 0x00001A38,
+			.framedrop_pattern        = 0x00001A3C,
+			.mmu_prefetch_cfg         = 0x00001A60,
+			.mmu_prefetch_max_offset  = 0x00001A64,
+			.system_cache_cfg         = 0x00001A68,
+			.addr_status_0            = 0x00001A70,
+			.addr_status_1            = 0x00001A74,
+			.addr_status_2            = 0x00001A78,
+			.addr_status_3            = 0x00001A7C,
+			.debug_status_cfg         = 0x00001A80,
+			.debug_status_0           = 0x00001A84,
+			.debug_status_1           = 0x00001A88,
+			.bw_limiter_addr          = 0x00001A1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe692_ubwc_regs_client_20,
+		},
+		/* BUS Client 21 AI_OUT_1_C2 */
+		{
+			.cfg                      = 0x00001B00,
+			.image_addr               = 0x00001B04,
+			.frame_incr               = 0x00001B08,
+			.image_cfg_0              = 0x00001B0C,
+			.image_cfg_1              = 0x00001B10,
+			.image_cfg_2              = 0x00001B14,
+			.packer_cfg               = 0x00001B18,
+			.frame_header_addr        = 0x00001B20,
+			.frame_header_incr        = 0x00001B24,
+			.frame_header_cfg         = 0x00001B28,
+			.irq_subsample_period     = 0x00001B30,
+			.irq_subsample_pattern    = 0x00001B34,
+			.framedrop_period         = 0x00001B38,
+			.framedrop_pattern        = 0x00001B3C,
+			.mmu_prefetch_cfg         = 0x00001B60,
+			.mmu_prefetch_max_offset  = 0x00001B64,
+			.system_cache_cfg         = 0x00001B68,
+			.addr_status_0            = 0x00001B70,
+			.addr_status_1            = 0x00001B74,
+			.addr_status_2            = 0x00001B78,
+			.addr_status_3            = 0x00001B7C,
+			.debug_status_cfg         = 0x00001B80,
+			.debug_status_0           = 0x00001B84,
+			.debug_status_1           = 0x00001B88,
+			.bw_limiter_addr          = 0x00001B1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 22 AI_OUT_2_Y/C1 */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.framedrop_period         = 0x00001C38,
+			.framedrop_pattern        = 0x00001C3C,
+			.mmu_prefetch_cfg         = 0x00001C60,
+			.mmu_prefetch_max_offset  = 0x00001C64,
+			.system_cache_cfg         = 0x00001C68,
+			.addr_status_0            = 0x00001C70,
+			.addr_status_1            = 0x00001C74,
+			.addr_status_2            = 0x00001C78,
+			.addr_status_3            = 0x00001C7C,
+			.debug_status_cfg         = 0x00001C80,
+			.debug_status_0           = 0x00001C84,
+			.debug_status_1           = 0x00001C88,
+			.bw_limiter_addr          = 0x00001C1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe692_ubwc_regs_client_22,
+		},
+		/* BUS Client 23 AI_OUT_2_UV/C1 */
+		{
+			.cfg                      = 0x00001D00,
+			.image_addr               = 0x00001D04,
+			.frame_incr               = 0x00001D08,
+			.image_cfg_0              = 0x00001D0C,
+			.image_cfg_1              = 0x00001D10,
+			.image_cfg_2              = 0x00001D14,
+			.packer_cfg               = 0x00001D18,
+			.frame_header_addr        = 0x00001D20,
+			.frame_header_incr        = 0x00001D24,
+			.frame_header_cfg         = 0x00001D28,
+			.irq_subsample_period     = 0x00001D30,
+			.irq_subsample_pattern    = 0x00001D34,
+			.framedrop_period         = 0x00001D38,
+			.framedrop_pattern        = 0x00001D3C,
+			.mmu_prefetch_cfg         = 0x00001D60,
+			.mmu_prefetch_max_offset  = 0x00001D64,
+			.system_cache_cfg         = 0x00001D68,
+			.addr_status_0            = 0x00001D70,
+			.addr_status_1            = 0x00001D74,
+			.addr_status_2            = 0x00001D78,
+			.addr_status_3            = 0x00001D7C,
+			.debug_status_cfg         = 0x00001D90,
+			.debug_status_0           = 0x00001D84,
+			.debug_status_1           = 0x00001D88,
+			.bw_limiter_addr          = 0x00001D1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe692_ubwc_regs_client_23,
+		},
+		/* BUS Client 24 AI_OUT_2_C2 */
+		{
+			.cfg                      = 0x00001E00,
+			.image_addr               = 0x00001E04,
+			.frame_incr               = 0x00001E08,
+			.image_cfg_0              = 0x00001E0C,
+			.image_cfg_1              = 0x00001E10,
+			.image_cfg_2              = 0x00001E14,
+			.packer_cfg               = 0x00001E18,
+			.frame_header_addr        = 0x00001E20,
+			.frame_header_incr        = 0x00001E24,
+			.frame_header_cfg         = 0x00001E28,
+			.irq_subsample_period     = 0x00001E30,
+			.irq_subsample_pattern    = 0x00001E34,
+			.framedrop_period         = 0x00001E38,
+			.framedrop_pattern        = 0x00001E3C,
+			.mmu_prefetch_cfg         = 0x00001E60,
+			.mmu_prefetch_max_offset  = 0x00001E64,
+			.system_cache_cfg         = 0x00001E68,
+			.addr_status_0            = 0x00001E70,
+			.addr_status_1            = 0x00001E74,
+			.addr_status_2            = 0x00001E78,
+			.addr_status_3            = 0x00001E7C,
+			.debug_status_cfg         = 0x00001E80,
+			.debug_status_0           = 0x00001E84,
+			.debug_status_1           = 0x00001E88,
+			.bw_limiter_addr          = 0x00001E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 25 IR_OUT */
+		{
+			.cfg                      = 0x00001F00,
+			.image_addr               = 0x00001F04,
+			.frame_incr               = 0x00001F08,
+			.image_cfg_0              = 0x00001F0C,
+			.image_cfg_1              = 0x00001F10,
+			.image_cfg_2              = 0x00001F14,
+			.packer_cfg               = 0x00001F18,
+			.frame_header_addr        = 0x00001F20,
+			.frame_header_incr        = 0x00001F24,
+			.frame_header_cfg         = 0x00001F28,
+			.irq_subsample_period     = 0x00001F30,
+			.irq_subsample_pattern    = 0x00001F34,
+			.framedrop_period         = 0x00001F38,
+			.framedrop_pattern        = 0x00001F3C,
+			.mmu_prefetch_cfg         = 0x00001F60,
+			.mmu_prefetch_max_offset  = 0x00001F64,
+			.system_cache_cfg         = 0x00001F68,
+			.addr_status_0            = 0x00001F70,
+			.addr_status_1            = 0x00001F74,
+			.addr_status_2            = 0x00001F78,
+			.addr_status_3            = 0x00001F7C,
+			.debug_status_cfg         = 0x00001F80,
+			.debug_status_0           = 0x00001F84,
+			.debug_status_1           = 0x00001F88,
+			.bw_limiter_addr          = 0x00001F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 26 STATS_IR_BG */
+		{
+			.cfg                      = 0x00002000,
+			.image_addr               = 0x00002004,
+			.frame_incr               = 0x00002008,
+			.image_cfg_0              = 0x0000200C,
+			.image_cfg_1              = 0x00002010,
+			.image_cfg_2              = 0x00002014,
+			.packer_cfg               = 0x00002018,
+			.frame_header_addr        = 0x00002020,
+			.frame_header_incr        = 0x00002024,
+			.frame_header_cfg         = 0x00002028,
+			.irq_subsample_period     = 0x00002030,
+			.irq_subsample_pattern    = 0x00002034,
+			.framedrop_period         = 0x00002038,
+			.framedrop_pattern        = 0x0000203C,
+			.mmu_prefetch_cfg         = 0x00002060,
+			.mmu_prefetch_max_offset  = 0x00002064,
+			.system_cache_cfg         = 0x00002068,
+			.addr_status_0            = 0x00002070,
+			.addr_status_1            = 0x00002074,
+			.addr_status_2            = 0x00002078,
+			.addr_status_3            = 0x0000207C,
+			.debug_status_cfg         = 0x00002080,
+			.debug_status_0           = 0x00002084,
+			.debug_status_1           = 0x00002088,
+			.bw_limiter_addr          = 0x0000201C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_12,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 27 STATS_IR_BHIST */
+		{
+			.cfg                      = 0x00002100,
+			.image_addr               = 0x00002104,
+			.frame_incr               = 0x00002108,
+			.image_cfg_0              = 0x0000210C,
+			.image_cfg_1              = 0x00002110,
+			.image_cfg_2              = 0x00002114,
+			.packer_cfg               = 0x00002118,
+			.frame_header_addr        = 0x00002120,
+			.frame_header_incr        = 0x00002124,
+			.frame_header_cfg         = 0x00002128,
+			.irq_subsample_period     = 0x00002130,
+			.irq_subsample_pattern    = 0x00002134,
+			.framedrop_period         = 0x00002138,
+			.framedrop_pattern        = 0x0000213C,
+			.mmu_prefetch_cfg         = 0x00002160,
+			.mmu_prefetch_max_offset  = 0x00002164,
+			.system_cache_cfg         = 0x00002168,
+			.addr_status_0            = 0x00002170,
+			.addr_status_1            = 0x00002174,
+			.addr_status_2            = 0x00002178,
+			.addr_status_3            = 0x0000217C,
+			.debug_status_cfg         = 0x00002180,
+			.debug_status_0           = 0x00002184,
+			.debug_status_1           = 0x00002188,
+			.bw_limiter_addr          = 0x0000211C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_12,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 21,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe692_out_port_mid[0],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				16,
+			},
+			.name          = {
+				"RDI_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid           = vfe692_out_port_mid[1],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				17,
+			},
+			.name          = {
+				"RDI_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid           = vfe692_out_port_mid[2],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				18,
+			},
+			.name          = {
+				"RDI_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[3],
+			.num_mid       = 6,
+			.num_wm        = 3,
+			.wm_idx        = {
+				0,
+				1,
+				2,
+			},
+			.name          = {
+				"FULL_Y",
+				"FULL_C1",
+				"FULL_C2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[4],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				7,
+			},
+			.name          = {
+				"PIXEL_RAW",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[5],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				11,
+			},
+			.name          = {
+				"STATS_TL_BG",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[6],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				12,
+			},
+			.name          = {
+				"STATS_AWB_BGB",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[7],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				10,
+			},
+			.name          = {
+				"STATS_BHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[8],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				15,
+			},
+			.name          = {
+				"STATS_RS",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[9],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				3,
+				4,
+			},
+			.name          = {
+				"FULL_DISP_Y",
+				"FULL_DISP_C",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[10],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				5,
+			},
+			.name          = {
+				"DISP_DS_4",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[11],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				6,
+			},
+			.name          = {
+				"DISP_DS_16",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[12],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				13,
+			},
+			.name          = {
+				"AWB_BFW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[13],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				9,
+			},
+			.name          = {
+				"AEC_BE",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[14],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				8,
+			},
+			.name          = {
+				"LTM",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[15],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				14,
+			},
+			.name          = {
+				"GTM_BHIST",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_1,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[16],
+			.num_mid       = 6,
+			.num_wm        = 3,
+			.wm_idx        = {
+				19,
+				20,
+				21,
+			},
+			.name          = {
+				"AI_OUT_1_Y",
+				"AI_OUT_1_C1",
+				"AI_OUT_1_C2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_2,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[17],
+			.num_mid       = 6,
+			.num_wm        = 3,
+			.wm_idx        = {
+				22,
+				23,
+				24,
+			},
+			.name          = {
+				"AI_OUT_2_Y",
+				"AI_OUT_2_C1",
+				"AI_OUT_2_C2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_IR,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[18],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				25,
+			},
+			.name          = {
+				"IR_OUT",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[19],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				26,
+			},
+			.name          = {
+				"STATS_IR_BG",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe692_out_port_mid[20],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				27,
+			},
+			.name          = {
+				"STATS_IR_BHIST",
+			},
+		},
+	},
+	.num_cons_err = 29,
+	.constraint_error_list = {
+		{
+			.bitmask = BIT(0),
+			.error_description = "PPC 1x1 input not supported"
+		},
+		{
+			.bitmask = BIT(1),
+			.error_description = "PPC 1x2 input not supported"
+		},
+		{
+			.bitmask = BIT(2),
+			.error_description = "PPC 2x1 input not supported"
+		},
+		{
+			.bitmask = BIT(3),
+			.error_description = "PPC 2x2 input not supported"
+		},
+		{
+			.bitmask = BIT(4),
+			.error_description = "Pack 8 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(5),
+			.error_description = "Pack 16 format not supported"
+		},
+		{
+			.bitmask = BIT(6),
+			.error_description = "Pack 32 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(7),
+			.error_description = "Pack 64 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(8),
+			.error_description = "Pack MIPI 20 format not supported"
+		},
+		{
+			.bitmask = BIT(9),
+			.error_description = "Pack MIPI 14 format not supported"
+		},
+		{
+			.bitmask = BIT(10),
+			.error_description = "Pack MIPI 12 format not supported"
+		},
+		{
+			.bitmask = BIT(11),
+			.error_description = "Pack MIPI 10 format not supported"
+		},
+		{
+			.bitmask = BIT(12),
+			.error_description = "Pack 128 BPP format not supported"
+		},
+		{
+			.bitmask = BIT(13),
+			.error_description = "UBWC NV12 format not supported"
+		},
+		{
+			.bitmask = BIT(14),
+			.error_description = "UBWC NV12 4R format not supported"
+		},
+		{
+			.bitmask = BIT(15),
+			.error_description = "UBWC TP10 format not supported"
+		},
+		{
+			.bitmask = BIT(16),
+			.error_description = "Frame based Mode not supported"
+		},
+		{
+			.bitmask = BIT(17),
+			.error_description = "Index based Mode not supported"
+		},
+		{
+			.bitmask = BIT(18),
+			.error_description = "FIFO image addr unalign"
+		},
+		{
+			.bitmask = BIT(19),
+			.error_description = "FIFO ubwc addr unalign"
+		},
+		{
+			.bitmask = BIT(20),
+			.error_description = "FIFO frmheader addr unalign"
+		},
+		{
+			.bitmask = BIT(21),
+			.error_description = "Image address unalign"
+		},
+		{
+			.bitmask = BIT(22),
+			.error_description = "UBWC address unalign"
+		},
+		{
+			.bitmask = BIT(23),
+			.error_description = "Frame Header address unalign"
+		},
+		{
+			.bitmask = BIT(24),
+			.error_description = "Stride unalign"
+		},
+		{
+			.bitmask = BIT(25),
+			.error_description = "X Initialization unalign"
+		},
+		{
+			.bitmask = BIT(26),
+			.error_description = "Image Width unalign"
+		},
+		{
+			.bitmask = BIT(27),
+			.error_description = "Image Height unalign"
+		},
+		{
+			.bitmask = BIT(28),
+			.error_description = "Meta Stride unalign"
+		},
+	},
+	.num_comp_grp          = 13,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3),
+		BIT(4), BIT(5), BIT(6), BIT(7),
+		BIT(13), BIT(14), BIT(15),
+	},
+	.top_irq_shift         = 0,
+	.max_out_res           = CAM_ISP_IFE_OUT_RES_BASE + 47,
+	.pack_align_shift      = 5,
+	.max_bw_counter_limit  = 0xFF,
+};
+
+static struct cam_vfe_irq_hw_info vfe692_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_EXT_CSID,
+	.top_irq_reg   = &vfe692_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe692_hw_info = {
+	.irq_hw_info                  = &vfe692_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe692_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe692_top_hw_info,
+};
+
+#endif /* _CAM_VFE692_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe780.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe780.h
@@ -0,0 +1,2413 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE780_H_
+#define _CAM_VFE780_H_
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_BUS_VER3_780_MAX_CLIENTS     27
+#define CAM_VFE_780_NUM_DBG_REG              17
+
+static struct cam_vfe_top_ver4_module_desc vfe780_ipp_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CLC_DEMUX",
+	},
+	{
+		.id = 1,
+		.desc = "CLC_CHANNEL_GAIN",
+	},
+	{
+		.id = 2,
+		.desc = "CLC_BPC_PDPC",
+	},
+	{
+		.id = 3,
+		.desc = "CLC_BINCORRECT",
+	},
+	{
+		.id = 4,
+		.desc = "CLC_COMPDECOMP",
+	},
+	{
+		.id = 5,
+		.desc = "CLC_LSC",
+	},
+	{
+		.id = 6,
+		.desc = "CLC_WB_GAIN",
+	},
+	{
+		.id = 7,
+		.desc = "CLC_GIC",
+	},
+	{
+		.id = 8,
+		.desc = "CLC_BPC_ABF",
+	},
+	{
+		.id = 9,
+		.desc = "CLC_BLS",
+	},
+	{
+		.id = 10,
+		.desc = "CLC_BAYER_GTM",
+	},
+	{
+		.id = 11,
+		.desc = "CLC_BAYER_LTM",
+	},
+	{
+		.id = 12,
+		.desc = "CLC_LCAC",
+	},
+	{
+		.id = 13,
+		.desc = "CLC_DEMOSAIC",
+	},
+	{
+		.id = 14,
+		.desc = "CLC_COLOR_CORRECT",
+	},
+	{
+		.id = 15,
+		.desc = "CLC_GTM",
+	},
+	{
+		.id = 16,
+		.desc = "CLC_GLUT",
+	},
+	{
+		.id = 17,
+		.desc = "CLC_COLOR_TRANSFORM",
+	},
+	{
+		.id = 18,
+		.desc = "CLC_UVG",
+	},
+	{
+		.id = 19,
+		.desc = "CLC_PREPROCESSOR",
+	},
+	{
+		.id = 20,
+		.desc = "CLC_CHROMA_UP",
+	},
+	{
+		.id = 21,
+		.desc = "Reserved",
+	},
+	{
+		.id = 22,
+		.desc = "Reserved",
+	},
+	{
+		.id = 23,
+		.desc = "CLC_COMPDECOMP_HVX_TX",
+	},
+	{
+		.id = 24,
+		.desc = "CLC_COMPDECOMP_HVX_RX",
+	},
+	{
+		.id = 25,
+		.desc = "CLC_GTM_FD_OUT",
+	},
+	{
+		.id = 26,
+		.desc = "CLC_CROP_RND_CLAMP_PIXEL_RAW_OUT",
+	},
+	{
+		.id = 27,
+		.desc = "CLC_DOWNSCALE_MN_Y_FD_OUT",
+	},
+	{
+		.id = 28,
+		.desc = "CLC_DOWNSCALE_MN_C_FD_OUT",
+	},
+	{
+		.id = 29,
+		.desc = "CLC_CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_FD_OUT",
+	},
+	{
+		.id = 30,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_FD_OUT",
+	},
+	{
+		.id = 31,
+		.desc = "CLC_DOWNSCALE_MN_Y_DISP_OUT",
+	},
+	{
+		.id = 32,
+		.desc = "CLC_DOWNSCALE_MN_C_DISP_OUT",
+	},
+	{
+		.id = 33,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_DISP_OUT",
+	},
+	{
+		.id = 34,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_DISP_OUT",
+	},
+	{
+		.id = 35,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS4_OUT",
+	},
+	{
+		.id = 36,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS4_OUT",
+	},
+	{
+		.id = 37,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS4_OUT",
+	},
+	{
+		.id = 38,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS4_OUT",
+	},
+	{
+		.id = 39,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS16_OUT",
+	},
+	{
+		.id = 40,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS16_OUT",
+	},
+	{
+		.id = 41,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS16_OUT",
+	},
+	{
+		.id = 42,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS16_OUT",
+	},
+	{
+		.id = 43,
+		.desc = "CLC_DOWNSCALE_MN_Y_VID_OUT",
+	},
+	{
+		.id = 44,
+		.desc = "CLC_DOWNSCALE_MN_C_VID_OUT",
+	},
+	{
+		.id = 45,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_OUT",
+	},
+	{
+		.id = 46,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_VID_OUT",
+	},
+	{
+		.id = 47,
+		.desc = "CLC_DSX_Y_VID_OUT",
+	},
+	{
+		.id = 48,
+		.desc = "CLC_DSX_C_VID_OUT",
+	},
+	{
+		.id = 49,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DSX_Y_VID_OUT",
+	},
+	{
+		.id = 50,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DSX_C_VID_OUT",
+	},
+	{
+		.id = 51,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_VID_DS16_OUT",
+	},
+	{
+		.id = 52,
+		.desc = "CLC_DOWNSCALE_4TO1_C_VID_DS16_OUT",
+	},
+	{
+		.id = 53,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_VID_DS16_OUT",
+	},
+	{
+		.id = 54,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_VID_DS16_OUT",
+	},
+	{
+		.id = 55,
+		.desc = "CLC_STATS_AEC_BE",
+	},
+	{
+		.id = 56,
+		.desc = "CLC_STATS_AEC_BHIST",
+	},
+	{
+		.id = 57,
+		.desc = "CLC_STATS_BHIST",
+	},
+	{
+		.id = 58,
+		.desc = "CLC_STATS_TINTLESS_BG",
+	},
+	{
+		.id = 59,
+		.desc = "CLC_STATS_AWB_BG",
+	},
+	{
+		.id = 60,
+		.desc = "CLC_STATS_BFW",
+	},
+	{
+		.id = 61,
+		.desc = "CLC_STATS_RS",
+	},
+	{
+		.id = 62,
+		.desc = "CLC_STATS_IHIST",
+	},
+	{
+		.id = 63,
+		.desc = "Reserved",
+	},
+	{
+		.id = 64,
+		.desc = "CLC_PDPC_BPC_1D",
+	},
+	{
+		.id = 65,
+		.desc = "CLC_PDPC_BPC_1D_POST_LSC",
+	},
+	{
+		.id = 66,
+		.desc = "CLC_STATS_CAF",
+	},
+};
+
+static struct cam_vfe_top_ver4_wr_client_desc vfe780_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "VIDEO_FULL_Y",
+	},
+	{
+		.wm_id = 1,
+		.desc = "VIDEO_FULL_C",
+	},
+	{
+		.wm_id = 2,
+		.desc = "VIDEO_DS_4:1",
+	},
+	{
+		.wm_id = 3,
+		.desc = "VIDEO_DS_16:1",
+	},
+	{
+		.wm_id = 4,
+		.desc = "DISPLAY_FULL_Y",
+	},
+	{
+		.wm_id = 5,
+		.desc = "DISPLAY_FULL_C",
+	},
+	{
+		.wm_id = 6,
+		.desc = "DISPLAY_DS_4:1",
+	},
+	{
+		.wm_id = 7,
+		.desc = "DISPLAY_DS_16:1",
+	},
+	{
+		.wm_id = 8,
+		.desc = "FD_Y",
+	},
+	{
+		.wm_id = 9,
+		.desc = "FD_C",
+	},
+	{
+		.wm_id = 10,
+		.desc = "PIXEL_RAW",
+	},
+	{
+		.wm_id = 11,
+		.desc = "STATS_BE0",
+	},
+	{
+		.wm_id = 12,
+		.desc = "STATS_BHIST0",
+	},
+	{
+		.wm_id = 13,
+		.desc = "STATS_TINTLESS_BG",
+	},
+	{
+		.wm_id = 14,
+		.desc = "STATS_AWB_BG",
+	},
+	{
+		.wm_id = 15,
+		.desc = "STATS_AWB_BFW",
+	},
+	{
+		.wm_id = 16,
+		.desc = "STATS_CAF",
+	},
+	{
+		.wm_id = 17,
+		.desc = "STATS_BHIST",
+	},
+	{
+		.wm_id = 18,
+		.desc = "STATS_BAYER_RS",
+	},
+	{
+		.wm_id = 19,
+		.desc = "STATS_IHIST",
+	},
+	{
+		.wm_id = 20,
+		.desc = "PDAF_0_2PD",
+	},
+	{
+		.wm_id = 21,
+		.desc = "PDAF_1_PREPROCESS_2PD",
+	},
+	{
+		.wm_id = 22,
+		.desc = "PDAF_2_PARSED_DATA",
+	},
+	{
+		.wm_id = 23,
+		.desc = "RDI0",
+	},
+	{
+		.wm_id = 24,
+		.desc = "RDI1",
+	},
+	{
+		.wm_id = 25,
+		.desc = "RDI2",
+	},
+	{
+		.wm_id = 26,
+		.desc = "LTM_STATS",
+	},
+};
+
+static struct cam_vfe_top_ver4_top_err_irq_desc vfe780_top_irq_err_desc[] = {
+	{
+		.bitmask = BIT(4),
+		.err_name = "PP VIOLATION",
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(6),
+		.err_name = "PDAF VIOLATION",
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(7),
+		.err_name = "DYNAMIC PDAF SWITCH VIOLATION",
+		.desc = "PD exposure changes dynamically and the sensor gap is not large enough",
+	},
+	{
+		.bitmask = BIT(8),
+		.err_name = "LCR PD INPUT TIMING PROTOCOL VIOLATION",
+		.desc = "Input timing protocol on the LCR  and PD path is not met",
+	},
+	{
+		.bitmask = BIT(12),
+		.err_name = "DSP IFE PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the output Data",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_name = "IFE DSP TX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the outgoing data to the DSP interface",
+	},
+	{
+		.bitmask = BIT(14),
+		.err_name = "DSP IFE RX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the incoming data from DSP before processed",
+	},
+	{
+		.bitmask = BIT(15),
+		.err_name = "DSP TX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface TX path FIFO",
+	},
+	{
+		.bitmask = BIT(16),
+		.err_name = "DSP RX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface RX path FIFO",
+	},
+	{
+		.bitmask = BIT(17),
+		.err_name = "DSP ERROR VIOLATION",
+		.desc = "When DSP sends a error signal",
+	},
+	{
+		.bitmask = BIT(18),
+		.err_name = "DIAG VIOLATION",
+		.desc = "HBI is less than the minimum required HBI",
+	},
+};
+
+static struct cam_vfe_top_ver4_pdaf_violation_desc vfe780_pdaf_violation_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.desc = "Sim monitor 1 violation - SAD output",
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "Sim monitor 2 violation - pre-proc output",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "Sim monitor 3 violation - parsed output",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "Constraint violation",
+	},
+};
+
+static struct cam_vfe_top_ver4_pdaf_lcr_res_info vfe780_pdaf_lcr_res_mask[] = {
+	{
+		.res_id = CAM_ISP_HW_VFE_IN_RDI0,
+		.val = 0,
+	},
+	{
+		.res_id = CAM_ISP_HW_VFE_IN_RDI1,
+		.val = 1,
+	},
+	{
+		.res_id = CAM_ISP_HW_VFE_IN_RDI2,
+		.val= 2,
+	},
+};
+
+static struct cam_irq_register_set vfe780_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x00000034,
+		.clear_reg_offset  = 0x0000003C,
+		.status_reg_offset = 0x00000044,
+		.set_reg_offset    = 0x0000004C,
+		.test_set_val      = BIT(1),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x00000038,
+		.clear_reg_offset  = 0x00000040,
+		.status_reg_offset = 0x00000048,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe780_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe780_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000030,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe780_top_debug_reg[] = {
+	0x000000A0,
+	0x000000A4,
+	0x000000A8,
+	0x000000AC,
+	0x000000B0,
+	0x000000B4,
+	0x000000B8,
+	0x000000BC,
+	0x000000C0,
+	0x000000C4,
+	0x000000C8,
+	0x000000CC,
+	0x000000D0,
+	0x000000D4,
+	0x000000D8,
+	0x000000DC,
+	0x000000E0,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe780_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.core_cfg_0               = 0x00000024,
+	.core_cfg_1               = 0x00000028,
+	.core_cfg_2               = 0x0000002C,
+	.global_reset_cmd         = 0x00000030,
+	.diag_config              = 0x00000050,
+	.diag_sensor_status_0     = 0x00000054,
+	.diag_sensor_status_1     = 0x00000058,
+	.diag_frm_cnt_status_0    = 0x0000005C,
+	.diag_frm_cnt_status_1    = 0x00000060,
+	.ipp_violation_status     = 0x00000064,
+	.pdaf_violation_status    = 0x00000404,
+	.core_cgc_ovd_0           = 0x00000018,
+	.core_cgc_ovd_1           = 0x0000001C,
+	.ahb_cgc_ovd              = 0x00000020,
+	.dsp_status               = 0x0000006C,
+	.stats_throttle_cfg_0     = 0x00000070,
+	.stats_throttle_cfg_1     = 0x00000074,
+	.stats_throttle_cfg_2     = 0x00000078,
+	.core_cfg_4               = 0x00000080,
+	.core_cfg_5               = 0x00000084,
+	.core_cfg_6               = 0x00000088,
+	.period_cfg               = 0x0000008C,
+	.irq_sub_pattern_cfg      = 0x00000090,
+	.epoch0_pattern_cfg       = 0x00000094,
+	.epoch1_pattern_cfg       = 0x00000098,
+	.epoch_height_cfg         = 0x0000009C,
+	.bus_violation_status     = 0x00000C64,
+	.bus_overflow_status      = 0x00000C68,
+	.num_perf_counters        = 2,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg    = 0x00000100,
+			.perf_pix_count    = 0x00000104,
+			.perf_line_count   = 0x00000108,
+			.perf_stall_count  = 0x0000010C,
+			.perf_always_count = 0x00000110,
+			.perf_count_status = 0x00000114,
+		},
+		{
+			.perf_count_cfg    = 0x00000118,
+			.perf_pix_count    = 0x0000011C,
+			.perf_line_count   = 0x00000120,
+			.perf_stall_count  = 0x00000124,
+			.perf_always_count = 0x00000128,
+			.perf_count_status = 0x0000012C,
+		},
+	},
+	.top_debug_cfg            = 0x000000FC,
+	.num_top_debug_reg        = CAM_VFE_780_NUM_DBG_REG,
+	.pdaf_input_cfg_0         = 0x00000130,
+	.pdaf_input_cfg_1         = 0x00000134,
+	.top_debug = vfe780_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe780_pp_common_reg_data = {
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x10000,
+	.epoch1_irq_mask                 = 0x20000,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask                  = 0x7F1D0,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+	.ipp_violation_mask              = 0x10,
+	.pdaf_violation_mask             = 0x40,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe780_vfe_full_rdi_reg_data[3] = {
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x400,
+		.eof_irq_mask                    = 0x800,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x1000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe780_pdlib_reg_data = {
+	.sof_irq_mask                    = 0x4,
+	.eof_irq_mask                    = 0x8,
+	.error_irq_mask                  = 0x0,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+};
+
+struct cam_vfe_ver4_path_hw_info
+	vfe780_rdi_hw_info_arr[] = {
+	{
+		.common_reg     = &vfe780_top_common_reg,
+		.reg_data       = &vfe780_vfe_full_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe780_top_common_reg,
+		.reg_data       = &vfe780_vfe_full_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe780_top_common_reg,
+		.reg_data       = &vfe780_vfe_full_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver4_debug_reg_info vfe780_dbg_reg_info[CAM_VFE_780_NUM_DBG_REG][8] = {
+	VFE_DBG_INFO_ARRAY_4bit("test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_IHIST",
+		"STATS_RS",
+		"STATS_CAF",
+		"GTM_BHIST",
+		"TINTLESS_BG",
+		"STATS_BFW",
+		"STATS_BG",
+		"STATS_BHIST"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_BE",
+		"R2PD_DS16_C_VID",
+		"R2PD_DS16_Y_VID",
+		"crop_rnd_clamp_post_downscale_C_DS16_VID",
+		"4to1_C_DS16_VID",
+		"crop_rnd_clamp_post_downscale_Y_DS16_VID",
+		"4to1_Y_DS16_VID",
+		"crop_rnd_clamp_post_dsx_C_VID"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"R2PD_DS4_VID_C",
+		"R2PD_DS4_VID_Y",
+		"DSX_C",
+		"crop_rnd_clamp_post_dsx_Y_VID",
+		"DSX_Y",
+		"crop_rnd_clamp_post_downscale_mn_C_VID",
+		"downscale_mn_C_VID",
+		"crop_rnd_clamp_post_downscale_mn_Y_VID"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"MNDS_Y_VID",
+		"R2PD_DS16_C_DISP",
+		"R2PD_DS16_Y_DISP",
+		"crop_rnd_clamp_post_downscale_C_DS16_DISP",
+		"4to1_C_DS16_DISP",
+		"crop_rnd_clamp_post_downscale_Y_DS16_DISP",
+		"4to1_Y_DS16_DISP",
+		"R2PD_DS4_C_DISP"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"R2PD_DS4_Y_DISP",
+		"crop_rnd_clamp_post_downscale_C_DS4_DISP",
+		"4to1_C_DS4_DISP",
+		"crop_rnd_clamp_post_downscale_Y_DS4_DISP",
+		"4to1_Y_DS4_DISP",
+		"crop_rnd_clamp_post_downscale_mn_C_DISP",
+		"downscale_mn_C_DISP",
+		"crop_rnd_clamp_post_downscale_mn_Y_DISP"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_Y_DISP",
+		"crop_rnd_clamp_post_downscale_mn_C_FD",
+		"downscale_mn_C_FD",
+		"crop_rnd_clamp_post_downscale_mn_Y_FD",
+		"downscale_mn_Y_FD",
+		"gtm_fd_out",
+		"uvg",
+		"color_xform"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"glut",
+		"gtm",
+		"color_correct",
+		"demosaic",
+		"hvx_tap2",
+		"lcac",
+		"bayer_ltm",
+		"bayer_gtm"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"bls",
+		"bpc_abf",
+		"gic",
+		"wb_gain",
+		"lsc",
+		"compdecomp_hxv_rx",
+		"compdecomp_hxv_tx",
+		"hvx_tap1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"decompand",
+		"reserved",
+		"bincorrect",
+		"bpc_pdpc",
+		"channel_gain",
+		"bayer_argb_ccif_converter",
+		"crop_rnd_clamp_pre_argb_packer",
+		"chroma_up_uv"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"chroma_up_y",
+		"demux",
+		"hxv_tap0",
+		"preprocess",
+		"reserved",
+		"reserved",
+		"bayer_ltm_bus_wr",
+		"RDI2"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"RDI1",
+		"RDI0",
+		"reserved",
+		"pdaf_2_bus_wr",
+		"pdaf_1_bus_wr",
+		"pdaf_1_bus_wr",
+		"ihist_bus_wr",
+		"flicker_rs_bus_wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"gtm_bhist_bus_wr",
+		"caf_bus_wr",
+		"bfw_bus_wr",
+		"bg_bus_wr",
+		"tintless_bg_bus_wr",
+		"bhist_bus_wr",
+		"be_bus_wr",
+		"pixel_raw_bus_wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"fd_c_bus_wr",
+		"fd_y_bus_wr",
+		"disp_ds16_bus_wr",
+		"disp_ds4_bus_wr",
+		"disp_c_bus_wr",
+		"disp_y_bus_wr",
+		"vid_ds16_bus_Wr",
+		"vid_ds4_bus_Wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"vid_c_bus_wr",
+		"vid_y_bus_wr",
+		"CLC_PDAF",
+		"PIX_PP",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved"
+	),
+	{
+		/* needs to be parsed separately, doesn't conform to I, V, R */
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+	},
+	VFE_DBG_INFO_ARRAY_4bit(
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved"
+	),
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe780_top_hw_info = {
+	.common_reg = &vfe780_top_common_reg,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe780_top_common_reg,
+		.reg_data       = &vfe780_pp_common_reg_data,
+	},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe780_top_common_reg,
+		.reg_data       = &vfe780_pdlib_reg_data,
+	},
+	.rdi_hw_info            = vfe780_rdi_hw_info_arr,
+	.wr_client_desc         = vfe780_wr_client_desc,
+	.ipp_module_desc        = vfe780_ipp_mod_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.num_path_port_map = 3,
+	.path_port_map = {
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PREPROCESS_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PDAF_PARSED_DATA},
+	},
+	.num_rdi                         = ARRAY_SIZE(vfe780_rdi_hw_info_arr),
+	.num_top_errors                  = ARRAY_SIZE(vfe780_top_irq_err_desc),
+	.top_err_desc                    = vfe780_top_irq_err_desc,
+	.num_pdaf_violation_errors       = ARRAY_SIZE(vfe780_pdaf_violation_desc),
+	.pdaf_violation_desc             = vfe780_pdaf_violation_desc,
+	.debug_reg_info                  = &vfe780_dbg_reg_info,
+	.pdaf_lcr_res_mask               = vfe780_pdaf_lcr_res_mask,
+	.num_pdaf_lcr_res                = ARRAY_SIZE(vfe780_pdaf_lcr_res_mask),
+};
+
+static struct cam_irq_register_set vfe780_bus_irq_reg[2] = {
+	{
+		.mask_reg_offset   = 0x00000C18,
+		.clear_reg_offset  = 0x00000C20,
+		.status_reg_offset = 0x00000C28,
+		.set_reg_offset    = 0x00000C50,
+	},
+	{
+		.mask_reg_offset   = 0x00000C1C,
+		.clear_reg_offset  = 0x00000C24,
+		.status_reg_offset = 0x00000C2C,
+		.set_reg_offset    = 0x00000C54,
+	},
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe780_ubwc_regs_client_0 = {
+	.meta_addr        = 0x00000E40,
+	.meta_cfg         = 0x00000E44,
+	.mode_cfg         = 0x00000E48,
+	.stats_ctrl       = 0x00000E4C,
+	.ctrl_2           = 0x00000E50,
+	.lossy_thresh0    = 0x00000E54,
+	.lossy_thresh1    = 0x00000E58,
+	.off_lossy_var    = 0x00000E5C,
+	.bw_limit         = 0x00000E1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe780_ubwc_regs_client_1 = {
+	.meta_addr        = 0x00000F40,
+	.meta_cfg         = 0x00000F44,
+	.mode_cfg         = 0x00000F48,
+	.stats_ctrl       = 0x00000F4C,
+	.ctrl_2           = 0x00000F50,
+	.lossy_thresh0    = 0x00000F54,
+	.lossy_thresh1    = 0x00000F58,
+	.off_lossy_var    = 0x00000F5C,
+	.bw_limit         = 0x00000F1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe780_ubwc_regs_client_4 = {
+	.meta_addr        = 0x00001240,
+	.meta_cfg         = 0x00001244,
+	.mode_cfg         = 0x00001248,
+	.stats_ctrl       = 0x0000124C,
+	.ctrl_2           = 0x00001250,
+	.lossy_thresh0    = 0x00001254,
+	.lossy_thresh1    = 0x00001258,
+	.off_lossy_var    = 0x0000125C,
+	.bw_limit         = 0x0000121C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe780_ubwc_regs_client_5 = {
+	.meta_addr        = 0x00001340,
+	.meta_cfg         = 0x00001344,
+	.mode_cfg         = 0x00001348,
+	.stats_ctrl       = 0x0000134C,
+	.ctrl_2           = 0x00001350,
+	.lossy_thresh0    = 0x00001354,
+	.lossy_thresh1    = 0x00001358,
+	.off_lossy_var    = 0x0000135C,
+	.bw_limit         = 0x0000131C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static uint32_t vfe780_out_port_mid[][4] = {
+	{34, 0, 0, 0},
+	{35, 0, 0, 0},
+	{36, 0, 0, 0},
+	{16, 17, 18, 19},
+	{20, 0, 0, 0},
+	{21, 0, 0, 0},
+	{32, 33, 0, 0},
+	{28, 29, 30},
+	{8, 0, 0, 0},
+	{18, 0, 0, 0},
+	{21, 0, 0, 0},
+	{19, 0, 0, 0},
+	{17, 0, 0, 0},
+	{23, 0, 0, 0},
+	{24, 0, 0, 0},
+	{22, 23, 24, 25},
+	{26, 0, 0, 0},
+	{27, 0, 0, 0},
+	{9, 0, 0, 0},
+	{20, 0, 0, 0},
+	{10, 0, 0, 0},
+	{16, 0, 0, 0},
+	{25, 26, 0, 0},
+	{22, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_err_irq_desc vfe780_bus_irq_err_desc_0[] = {
+	{
+		.bitmask = BIT(26),
+		.err_name = "IPCC_FENCE_DATA_ERR",
+		.desc = "IPCC or FENCE Data was not available in the Input Fifo",
+	},
+	{
+		.bitmask = BIT(27),
+		.err_name = "IPCC_FENCE_ADDR_ERR",
+		.desc = "IPCC or FENCE address fifo was empty and read was attempted",
+	},
+	{
+		.bitmask = BIT(28),
+		.err_name = "CONS_VIOLATION",
+		.desc = "Programming of software registers violated the constraints",
+	},
+	{
+		.bitmask = BIT(30),
+		.err_name = "VIOLATION",
+		.desc = "Client has a violation in ccif protocol at input",
+	},
+	{
+		.bitmask = BIT(31),
+		.err_name = "IMAGE_SIZE_VIOLATION",
+		.desc = "Programmed image size is not same as image size from the CCIF",
+	},
+};
+
+static struct cam_vfe_bus_ver3_err_irq_desc vfe780_bus_irq_err_desc_1[] = {
+	{
+		.bitmask = BIT(28),
+		.err_name = "EARLY_DONE",
+		.desc = "Buf done for each client. Early done irq for clients STATS_BAF",
+	},
+	{
+		.bitmask = BIT(29),
+		.err_name = "EARLY_DONE",
+		.desc = "Buf done for each client. Early done irq for clients STATS_BAF",
+	},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe780_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000C00,
+		.cgc_ovd                          = 0x00000C08,
+		.if_frameheader_cfg               = {
+			0x00000C34,
+			0x00000C38,
+			0x00000C3C,
+			0x00000C40,
+			0x00000C44,
+		},
+		.ubwc_static_ctrl                 = 0x00000C58,
+		.pwr_iso_cfg                      = 0x00000C5C,
+		.overflow_status_clear            = 0x00000C60,
+		.ccif_violation_status            = 0x00000C64,
+		.overflow_status                  = 0x00000C68,
+		.image_size_violation_status      = 0x00000C70,
+		.debug_status_top_cfg             = 0x00000CD4,
+		.debug_status_top                 = 0x00000CD8,
+		.test_bus_ctrl                    = 0x00000CDC,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe780_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00000C30,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = CAM_VFE_BUS_VER3_780_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 FULL Y */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.frame_header_addr        = 0x00000E20,
+			.frame_header_incr        = 0x00000E24,
+			.frame_header_cfg         = 0x00000E28,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_cfg                 = 0x00000E70,
+			.addr_status_0            = 0x00000E74,
+			.addr_status_1            = 0x00000E78,
+			.addr_status_2            = 0x00000E7C,
+			.addr_status_3            = 0x00000E80,
+			.debug_status_cfg         = 0x00000E84,
+			.debug_status_0           = 0x00000E88,
+			.debug_status_1           = 0x00000E8C,
+			.bw_limiter_addr          = 0x00000E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe780_ubwc_regs_client_0,
+		},
+		/* BUS Client 1 FULL C */
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_cfg                 = 0x00000E70,
+			.addr_status_0            = 0x00000F74,
+			.addr_status_1            = 0x00000F78,
+			.addr_status_2            = 0x00000F7C,
+			.addr_status_3            = 0x00000F80,
+			.debug_status_cfg         = 0x00000F84,
+			.debug_status_0           = 0x00000F88,
+			.debug_status_1           = 0x00000F8C,
+			.bw_limiter_addr          = 0x00000F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe780_ubwc_regs_client_1,
+		},
+		/* BUS Client 2 DS4 */
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.system_cache_cfg         = 0x00001068,
+			.addr_cfg                 = 0x00001070,
+			.addr_status_0            = 0x00001074,
+			.addr_status_1            = 0x00001078,
+			.addr_status_2            = 0x0000107C,
+			.addr_status_3            = 0x00001080,
+			.debug_status_cfg         = 0x00001084,
+			.debug_status_0           = 0x00001088,
+			.debug_status_1           = 0x0000108C,
+			.bw_limiter_addr          = 0x0000101C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 DS16 */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.system_cache_cfg         = 0x00001168,
+			.addr_cfg                 = 0x00001170,
+			.addr_status_0            = 0x00001174,
+			.addr_status_1            = 0x00001178,
+			.addr_status_2            = 0x0000117C,
+			.addr_status_3            = 0x00001180,
+			.debug_status_cfg         = 0x00001184,
+			.debug_status_0           = 0x00001188,
+			.debug_status_1           = 0x0000118C,
+			.bw_limiter_addr          = 0x0000111C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 DISP Y */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.system_cache_cfg         = 0x00001268,
+			.addr_cfg                 = 0x00001270,
+			.addr_status_0            = 0x00001274,
+			.addr_status_1            = 0x00001278,
+			.addr_status_2            = 0x0000127C,
+			.addr_status_3            = 0x00001280,
+			.debug_status_cfg         = 0x00001284,
+			.debug_status_0           = 0x00001288,
+			.debug_status_1           = 0x0000128C,
+			.bw_limiter_addr          = 0x0000121C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe780_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 DISP C */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.system_cache_cfg         = 0x00001368,
+			.addr_cfg                 = 0x00001370,
+			.addr_status_0            = 0x00001374,
+			.addr_status_1            = 0x00001378,
+			.addr_status_2            = 0x0000137C,
+			.addr_status_3            = 0x00001380,
+			.debug_status_cfg         = 0x00001384,
+			.debug_status_0           = 0x00001388,
+			.debug_status_1           = 0x0000138C,
+			.bw_limiter_addr          = 0x0000131C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe780_ubwc_regs_client_5,
+		},
+		/* BUS Client 6 DISP DS4 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_cfg                 = 0x00001470,
+			.addr_status_0            = 0x00001474,
+			.addr_status_1            = 0x00001478,
+			.addr_status_2            = 0x0000147C,
+			.addr_status_3            = 0x00001480,
+			.debug_status_cfg         = 0x00001484,
+			.debug_status_0           = 0x00001488,
+			.debug_status_1           = 0x0000148C,
+			.bw_limiter_addr          = 0x0000141C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 DISP DS16 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_cfg                 = 0x00001570,
+			.addr_status_0            = 0x00001574,
+			.addr_status_1            = 0x00001578,
+			.addr_status_2            = 0x0000157C,
+			.addr_status_3            = 0x00001580,
+			.debug_status_cfg         = 0x00001584,
+			.debug_status_0           = 0x00001588,
+			.debug_status_1           = 0x0000158C,
+			.bw_limiter_addr          = 0x0000151C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 FD Y */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_cfg                 = 0x00001670,
+			.addr_status_0            = 0x00001674,
+			.addr_status_1            = 0x00001678,
+			.addr_status_2            = 0x0000167C,
+			.addr_status_3            = 0x00001680,
+			.debug_status_cfg         = 0x00001684,
+			.debug_status_0           = 0x00001688,
+			.debug_status_1           = 0x0000168C,
+			.bw_limiter_addr          = 0x0000161C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 FD C */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_cfg                 = 0x00001770,
+			.addr_status_0            = 0x00001774,
+			.addr_status_1            = 0x00001778,
+			.addr_status_2            = 0x0000177C,
+			.addr_status_3            = 0x00001780,
+			.debug_status_cfg         = 0x00001784,
+			.debug_status_0           = 0x00001788,
+			.debug_status_1           = 0x0000178C,
+			.bw_limiter_addr          = 0x0000171C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 PIXEL RAW */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.framedrop_period         = 0x00001838,
+			.framedrop_pattern        = 0x0000183C,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_cfg                 = 0x00001870,
+			.addr_status_0            = 0x00001874,
+			.addr_status_1            = 0x00001878,
+			.addr_status_2            = 0x0000187C,
+			.addr_status_3            = 0x00001880,
+			.debug_status_cfg         = 0x00001884,
+			.debug_status_0           = 0x00001888,
+			.debug_status_1           = 0x0000188C,
+			.bw_limiter_addr          = 0x0000181C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 STATS BE 0 */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.framedrop_period         = 0x00001938,
+			.framedrop_pattern        = 0x0000193C,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_cfg                 = 0x00001970,
+			.addr_status_0            = 0x00001974,
+			.addr_status_1            = 0x00001978,
+			.addr_status_2            = 0x0000197C,
+			.addr_status_3            = 0x00001980,
+			.debug_status_cfg         = 0x00001984,
+			.debug_status_0           = 0x00001988,
+			.debug_status_1           = 0x0000198C,
+			.bw_limiter_addr          = 0x0000191C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 STATS BHIST 0 */
+		{
+			.cfg                      = 0x00001A00,
+			.image_addr               = 0x00001A04,
+			.frame_incr               = 0x00001A08,
+			.image_cfg_0              = 0x00001A0C,
+			.image_cfg_1              = 0x00001A10,
+			.image_cfg_2              = 0x00001A14,
+			.packer_cfg               = 0x00001A18,
+			.frame_header_addr        = 0x00001A20,
+			.frame_header_incr        = 0x00001A24,
+			.frame_header_cfg         = 0x00001A28,
+			.irq_subsample_period     = 0x00001A30,
+			.irq_subsample_pattern    = 0x00001A34,
+			.framedrop_period         = 0x00001A38,
+			.framedrop_pattern        = 0x00001A3C,
+			.mmu_prefetch_cfg         = 0x00001A60,
+			.mmu_prefetch_max_offset  = 0x00001A64,
+			.system_cache_cfg         = 0x00001A68,
+			.addr_cfg                 = 0x00001A70,
+			.addr_status_0            = 0x00001A74,
+			.addr_status_1            = 0x00001A78,
+			.addr_status_2            = 0x00001A7C,
+			.addr_status_3            = 0x00001A80,
+			.debug_status_cfg         = 0x00001A84,
+			.debug_status_0           = 0x00001A88,
+			.debug_status_1           = 0x00001A8C,
+			.bw_limiter_addr          = 0x00001A1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 STATS TINTLESS BG */
+		{
+			.cfg                      = 0x00001B00,
+			.image_addr               = 0x00001B04,
+			.frame_incr               = 0x00001B08,
+			.image_cfg_0              = 0x00001B0C,
+			.image_cfg_1              = 0x00001B10,
+			.image_cfg_2              = 0x00001B14,
+			.packer_cfg               = 0x00001B18,
+			.frame_header_addr        = 0x00001B20,
+			.frame_header_incr        = 0x00001B24,
+			.frame_header_cfg         = 0x00001B28,
+			.irq_subsample_period     = 0x00001B30,
+			.irq_subsample_pattern    = 0x00001B34,
+			.framedrop_period         = 0x00001B38,
+			.framedrop_pattern        = 0x00001B3C,
+			.mmu_prefetch_cfg         = 0x00001B60,
+			.mmu_prefetch_max_offset  = 0x00001B64,
+			.system_cache_cfg         = 0x00001B68,
+			.addr_cfg                 = 0x00001B70,
+			.addr_status_0            = 0x00001B74,
+			.addr_status_1            = 0x00001B78,
+			.addr_status_2            = 0x00001B7C,
+			.addr_status_3            = 0x00001B80,
+			.debug_status_cfg         = 0x00001B84,
+			.debug_status_0           = 0x00001B88,
+			.debug_status_1           = 0x00001B8C,
+			.bw_limiter_addr          = 0x00001B1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 STATS AWB BG */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.framedrop_period         = 0x00001C38,
+			.framedrop_pattern        = 0x00001C3C,
+			.mmu_prefetch_cfg         = 0x00001C60,
+			.mmu_prefetch_max_offset  = 0x00001C64,
+			.system_cache_cfg         = 0x00001C68,
+			.addr_cfg                 = 0x00001C70,
+			.addr_status_0            = 0x00001C74,
+			.addr_status_1            = 0x00001C78,
+			.addr_status_2            = 0x00001C7C,
+			.addr_status_3            = 0x00001C80,
+			.debug_status_cfg         = 0x00001C84,
+			.debug_status_0           = 0x00001C88,
+			.debug_status_1           = 0x00001C8C,
+			.bw_limiter_addr          = 0x00001C1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 STATS AWB BFW */
+		{
+			.cfg                      = 0x00001D00,
+			.image_addr               = 0x00001D04,
+			.frame_incr               = 0x00001D08,
+			.image_cfg_0              = 0x00001D0C,
+			.image_cfg_1              = 0x00001D10,
+			.image_cfg_2              = 0x00001D14,
+			.packer_cfg               = 0x00001D18,
+			.frame_header_addr        = 0x00001D20,
+			.frame_header_incr        = 0x00001D24,
+			.frame_header_cfg         = 0x00001D28,
+			.irq_subsample_period     = 0x00001D30,
+			.irq_subsample_pattern    = 0x00001D34,
+			.framedrop_period         = 0x00001D38,
+			.framedrop_pattern        = 0x00001D3C,
+			.mmu_prefetch_cfg         = 0x00001D60,
+			.mmu_prefetch_max_offset  = 0x00001D64,
+			.system_cache_cfg         = 0x00001D68,
+			.addr_cfg                 = 0x00001D70,
+			.addr_status_0            = 0x00001D74,
+			.addr_status_1            = 0x00001D78,
+			.addr_status_2            = 0x00001D7C,
+			.addr_status_3            = 0x00001D80,
+			.debug_status_cfg         = 0x00001D84,
+			.debug_status_0           = 0x00001D88,
+			.debug_status_1           = 0x00001D8C,
+			.bw_limiter_addr          = 0x00001D1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 STATS CAF */
+		{
+			.cfg                      = 0x00001E00,
+			.image_addr               = 0x00001E04,
+			.frame_incr               = 0x00001E08,
+			.image_cfg_0              = 0x00001E0C,
+			.image_cfg_1              = 0x00001E10,
+			.image_cfg_2              = 0x00001E14,
+			.packer_cfg               = 0x00001E18,
+			.frame_header_addr        = 0x00001E20,
+			.frame_header_incr        = 0x00001E24,
+			.frame_header_cfg         = 0x00001E28,
+			.irq_subsample_period     = 0x00001E30,
+			.irq_subsample_pattern    = 0x00001E34,
+			.framedrop_period         = 0x00001E38,
+			.framedrop_pattern        = 0x00001E3C,
+			.mmu_prefetch_cfg         = 0x00001E60,
+			.mmu_prefetch_max_offset  = 0x00001E64,
+			.system_cache_cfg         = 0x00001E68,
+			.addr_cfg                 = 0x00001E70,
+			.addr_status_0            = 0x00001E74,
+			.addr_status_1            = 0x00001E78,
+			.addr_status_2            = 0x00001E7C,
+			.addr_status_3            = 0x00001E80,
+			.debug_status_cfg         = 0x00001E84,
+			.debug_status_0           = 0x00001E88,
+			.debug_status_1           = 0x00001E8C,
+			.bw_limiter_addr          = 0x00001E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 STATS BHIST */
+		{
+			.cfg                      = 0x00001F00,
+			.image_addr               = 0x00001F04,
+			.frame_incr               = 0x00001F08,
+			.image_cfg_0              = 0x00001F0C,
+			.image_cfg_1              = 0x00001F10,
+			.image_cfg_2              = 0x00001F14,
+			.packer_cfg               = 0x00001F18,
+			.frame_header_addr        = 0x00001F20,
+			.frame_header_incr        = 0x00001F24,
+			.frame_header_cfg         = 0x00001F28,
+			.irq_subsample_period     = 0x00001F30,
+			.irq_subsample_pattern    = 0x00001F34,
+			.framedrop_period         = 0x00001F38,
+			.framedrop_pattern        = 0x00001F3C,
+			.mmu_prefetch_cfg         = 0x00001F60,
+			.mmu_prefetch_max_offset  = 0x00001F64,
+			.system_cache_cfg         = 0x00001F68,
+			.addr_cfg                 = 0x00001F70,
+			.addr_status_0            = 0x00001F74,
+			.addr_status_1            = 0x00001F78,
+			.addr_status_2            = 0x00001F7C,
+			.addr_status_3            = 0x00001F80,
+			.debug_status_cfg         = 0x00001F84,
+			.debug_status_0           = 0x00001F88,
+			.debug_status_1           = 0x00001F8C,
+			.bw_limiter_addr          = 0x00001F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_8,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 STATS BAYER RS */
+		{
+			.cfg                      = 0x00002000,
+			.image_addr               = 0x00002004,
+			.frame_incr               = 0x00002008,
+			.image_cfg_0              = 0x0000200C,
+			.image_cfg_1              = 0x00002010,
+			.image_cfg_2              = 0x00002014,
+			.packer_cfg               = 0x00002018,
+			.frame_header_addr        = 0x00002020,
+			.frame_header_incr        = 0x00002024,
+			.frame_header_cfg         = 0x00002028,
+			.irq_subsample_period     = 0x00002030,
+			.irq_subsample_pattern    = 0x00002034,
+			.framedrop_period         = 0x00002038,
+			.framedrop_pattern        = 0x0000203C,
+			.mmu_prefetch_cfg         = 0x00002060,
+			.mmu_prefetch_max_offset  = 0x00002064,
+			.system_cache_cfg         = 0x00002068,
+			.addr_cfg                 = 0x00002070,
+			.addr_status_0            = 0x00002074,
+			.addr_status_1            = 0x00002078,
+			.addr_status_2            = 0x0000207C,
+			.addr_status_3            = 0x00002080,
+			.debug_status_cfg         = 0x00002084,
+			.debug_status_0           = 0x00002088,
+			.debug_status_1           = 0x0000208C,
+			.bw_limiter_addr          = 0x0000201C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_9,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 STATS IHIST */
+		{
+			.cfg                      = 0x00002100,
+			.image_addr               = 0x00002104,
+			.frame_incr               = 0x00002108,
+			.image_cfg_0              = 0x0000210C,
+			.image_cfg_1              = 0x00002110,
+			.image_cfg_2              = 0x00002114,
+			.packer_cfg               = 0x00002118,
+			.frame_header_addr        = 0x00002120,
+			.frame_header_incr        = 0x00002124,
+			.frame_header_cfg         = 0x00002128,
+			.irq_subsample_period     = 0x00002130,
+			.irq_subsample_pattern    = 0x00002134,
+			.framedrop_period         = 0x00002138,
+			.framedrop_pattern        = 0x0000213C,
+			.mmu_prefetch_cfg         = 0x00002160,
+			.mmu_prefetch_max_offset  = 0x00002164,
+			.system_cache_cfg         = 0x00002168,
+			.addr_cfg                 = 0x00002170,
+			.addr_status_0            = 0x00002174,
+			.addr_status_1            = 0x00002178,
+			.addr_status_2            = 0x0000217C,
+			.addr_status_3            = 0x00002180,
+			.debug_status_cfg         = 0x00002184,
+			.debug_status_0           = 0x00002188,
+			.debug_status_1           = 0x0000218C,
+			.bw_limiter_addr          = 0x0000211C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_10,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 PDAF_0_2PD */
+		{
+			.cfg                      = 0x00002200,
+			.image_addr               = 0x00002204,
+			.frame_incr               = 0x00002208,
+			.image_cfg_0              = 0x0000220C,
+			.image_cfg_1              = 0x00002210,
+			.image_cfg_2              = 0x00002214,
+			.packer_cfg               = 0x00002218,
+			.frame_header_addr        = 0x00002220,
+			.frame_header_incr        = 0x00002224,
+			.frame_header_cfg         = 0x00002228,
+			.irq_subsample_period     = 0x00002230,
+			.irq_subsample_pattern    = 0x00002234,
+			.framedrop_period         = 0x00002238,
+			.framedrop_pattern        = 0x0000223C,
+			.mmu_prefetch_cfg         = 0x00002260,
+			.mmu_prefetch_max_offset  = 0x00002264,
+			.system_cache_cfg         = 0x00002268,
+			.addr_cfg                 = 0x00002270,
+			.addr_status_0            = 0x00002274,
+			.addr_status_1            = 0x00002278,
+			.addr_status_2            = 0x0000227C,
+			.addr_status_3            = 0x00002280,
+			.debug_status_cfg         = 0x00002284,
+			.debug_status_0           = 0x00002288,
+			.debug_status_1           = 0x0000228C,
+			.bw_limiter_addr          = 0x0000221C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 21 PDAF V2.0 PD DATA PDAF_1_PREPROCESS_2PD */
+		{
+			.cfg                      = 0x00002300,
+			.image_addr               = 0x00002304,
+			.frame_incr               = 0x00002308,
+			.image_cfg_0              = 0x0000230C,
+			.image_cfg_1              = 0x00002310,
+			.image_cfg_2              = 0x00002314,
+			.packer_cfg               = 0x00002318,
+			.frame_header_addr        = 0x00002320,
+			.frame_header_incr        = 0x00002324,
+			.frame_header_cfg         = 0x00002328,
+			.irq_subsample_period     = 0x00002330,
+			.irq_subsample_pattern    = 0x00002334,
+			.framedrop_period         = 0x00002338,
+			.framedrop_pattern        = 0x0000233C,
+			.mmu_prefetch_cfg         = 0x00002360,
+			.mmu_prefetch_max_offset  = 0x00002364,
+			.system_cache_cfg         = 0x00002368,
+			.addr_cfg                 = 0x00002370,
+			.addr_status_0            = 0x00002374,
+			.addr_status_1            = 0x00002378,
+			.addr_status_2            = 0x0000237C,
+			.addr_status_3            = 0x00002380,
+			.debug_status_cfg         = 0x00002384,
+			.debug_status_0           = 0x00002388,
+			.debug_status_1           = 0x0000238C,
+			.bw_limiter_addr          = 0x0000231C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 22 PDAF V2.0 PDAF_2_PARSED_DATA */
+		{
+			.cfg                      = 0x00002400,
+			.image_addr               = 0x00002404,
+			.frame_incr               = 0x00002408,
+			.image_cfg_0              = 0x0000240C,
+			.image_cfg_1              = 0x00002410,
+			.image_cfg_2              = 0x00002414,
+			.packer_cfg               = 0x00002418,
+			.frame_header_addr        = 0x00002420,
+			.frame_header_incr        = 0x00002424,
+			.frame_header_cfg         = 0x00002428,
+			.irq_subsample_period     = 0x00002430,
+			.irq_subsample_pattern    = 0x00002434,
+			.framedrop_period         = 0x00002438,
+			.framedrop_pattern        = 0x0000243C,
+			.mmu_prefetch_cfg         = 0x00002460,
+			.mmu_prefetch_max_offset  = 0x00002464,
+			.system_cache_cfg         = 0x00002468,
+			.addr_cfg                 = 0x00002470,
+			.addr_status_0            = 0x00002474,
+			.addr_status_1            = 0x00002478,
+			.addr_status_2            = 0x0000247C,
+			.addr_status_3            = 0x00002480,
+			.debug_status_cfg         = 0x00002484,
+			.debug_status_0           = 0x00002488,
+			.debug_status_1           = 0x0000248C,
+			.bw_limiter_addr          = 0x0000241C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 RDI0 */
+		{
+			.cfg                      = 0x00002500,
+			.image_addr               = 0x00002504,
+			.frame_incr               = 0x00002508,
+			.image_cfg_0              = 0x0000250C,
+			.image_cfg_1              = 0x00002510,
+			.image_cfg_2              = 0x00002514,
+			.packer_cfg               = 0x00002518,
+			.frame_header_addr        = 0x00002520,
+			.frame_header_incr        = 0x00002524,
+			.frame_header_cfg         = 0x00002528,
+			.line_done_cfg            = 0x0000252C,
+			.irq_subsample_period     = 0x00002530,
+			.irq_subsample_pattern    = 0x00002534,
+			.framedrop_period         = 0x00002538,
+			.framedrop_pattern        = 0x0000253C,
+			.mmu_prefetch_cfg         = 0x00002560,
+			.mmu_prefetch_max_offset  = 0x00002564,
+			.system_cache_cfg         = 0x00002568,
+			.addr_cfg                 = 0x00002570,
+			.addr_status_0            = 0x00002574,
+			.addr_status_1            = 0x00002578,
+			.addr_status_2            = 0x0000257C,
+			.addr_status_3            = 0x00002580,
+			.debug_status_cfg         = 0x00002584,
+			.debug_status_0           = 0x00002588,
+			.debug_status_1           = 0x0000258C,
+			.bw_limiter_addr          = 0x0000251C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_12,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 24 RDI1 */
+		{
+			.cfg                      = 0x00002600,
+			.image_addr               = 0x00002604,
+			.frame_incr               = 0x00002608,
+			.image_cfg_0              = 0x0000260C,
+			.image_cfg_1              = 0x00002610,
+			.image_cfg_2              = 0x00002614,
+			.packer_cfg               = 0x00002618,
+			.frame_header_addr        = 0x00002620,
+			.frame_header_incr        = 0x00002624,
+			.frame_header_cfg         = 0x00002628,
+			.line_done_cfg            = 0x0000262C,
+			.irq_subsample_period     = 0x00002630,
+			.irq_subsample_pattern    = 0x00002634,
+			.framedrop_period         = 0x00002638,
+			.framedrop_pattern        = 0x0000263C,
+			.mmu_prefetch_cfg         = 0x00002660,
+			.mmu_prefetch_max_offset  = 0x00002664,
+			.system_cache_cfg         = 0x00002668,
+			.addr_cfg                 = 0x00002670,
+			.addr_status_0            = 0x00002674,
+			.addr_status_1            = 0x00002678,
+			.addr_status_2            = 0x0000267C,
+			.addr_status_3            = 0x00002680,
+			.debug_status_cfg         = 0x00002684,
+			.debug_status_0           = 0x00002688,
+			.debug_status_1           = 0x0000268C,
+			.bw_limiter_addr          = 0x0000261C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_13,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 25 RDI2 */
+		{
+			.cfg                      = 0x00002700,
+			.image_addr               = 0x00002704,
+			.frame_incr               = 0x00002708,
+			.image_cfg_0              = 0x0000270C,
+			.image_cfg_1              = 0x00002710,
+			.image_cfg_2              = 0x00002714,
+			.packer_cfg               = 0x00002718,
+			.frame_header_addr        = 0x00002720,
+			.frame_header_incr        = 0x00002724,
+			.frame_header_cfg         = 0x00002728,
+			.line_done_cfg            = 0x0000272C,
+			.irq_subsample_period     = 0x00002730,
+			.irq_subsample_pattern    = 0x00002734,
+			.framedrop_period         = 0x00002738,
+			.framedrop_pattern        = 0x0000273C,
+			.mmu_prefetch_cfg         = 0x00002760,
+			.mmu_prefetch_max_offset  = 0x00002764,
+			.system_cache_cfg         = 0x00002768,
+			.addr_cfg                 = 0x00002770,
+			.addr_status_0            = 0x00002774,
+			.addr_status_1            = 0x00002778,
+			.addr_status_2            = 0x0000277C,
+			.addr_status_3            = 0x00002780,
+			.debug_status_cfg         = 0x00002784,
+			.debug_status_0           = 0x00002788,
+			.debug_status_1           = 0x0000278C,
+			.bw_limiter_addr          = 0x0000271C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_14,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 26 LTM STATS */
+		{
+			.cfg                      = 0x00002800,
+			.image_addr               = 0x00002804,
+			.frame_incr               = 0x00002808,
+			.image_cfg_0              = 0x0000280C,
+			.image_cfg_1              = 0x00002810,
+			.image_cfg_2              = 0x00002814,
+			.packer_cfg               = 0x00002818,
+			.frame_header_addr        = 0x00002820,
+			.frame_header_incr        = 0x00002824,
+			.frame_header_cfg         = 0x00002828,
+			.irq_subsample_period     = 0x00002830,
+			.irq_subsample_pattern    = 0x00002834,
+			.framedrop_period         = 0x00002838,
+			.framedrop_pattern        = 0x0000283C,
+			.mmu_prefetch_cfg         = 0x00002860,
+			.mmu_prefetch_max_offset  = 0x00002864,
+			.system_cache_cfg         = 0x00002868,
+			.addr_cfg                 = 0x00002870,
+			.addr_status_0            = 0x00002874,
+			.addr_status_1            = 0x00002878,
+			.addr_status_2            = 0x0000287C,
+			.addr_status_3            = 0x00002880,
+			.debug_status_cfg         = 0x00002884,
+			.debug_status_0           = 0x00002888,
+			.debug_status_1           = 0x0000288C,
+			.bw_limiter_addr          = 0x0000281C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 24,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid           = vfe780_out_port_mid[0],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				23,
+			},
+			.name          = {
+				"RDI_0",
+			},
+			.pid_mask      = 0x700,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid           = vfe780_out_port_mid[1],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				24,
+			},
+			.name          = {
+				"RDI_1",
+			},
+			.pid_mask      = 0x700,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.mid           = vfe780_out_port_mid[2],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				25,
+			},
+			.name          = {
+				"RDI_2",
+			},
+			.pid_mask      = 0x700,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+			.max_width     = 4928,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[3],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				0,
+				1,
+			},
+			.name          = {
+				"FULL_Y",
+				"FULL_C",
+			},
+			.pid_mask      = 0x70000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+			.max_width     = 1696,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[4],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"DS_4",
+			},
+			.pid_mask      = 0x70000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+			.max_width     = 424,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[5],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"DS_16",
+			},
+			.pid_mask      = 0x70000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+			.max_width     = 7296,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[6],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				10,
+			},
+			.name          = {
+				"PIXEL_RAW",
+			},
+			.pid_mask      = 0x700,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FD,
+			.max_width     = 2304,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[7],
+			.num_mid       = 3,
+			.num_wm        = 2,
+			.wm_idx        = {
+				8,
+				9,
+			},
+			.name          = {
+				"FD_Y",
+				"FD_C",
+			},
+			.pid_mask      = 0x70000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+			.max_width     = 14592,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe780_out_port_mid[8],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				20,
+			},
+			.name          = {
+				"PDAF_0_2PD",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[9],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				13,
+			},
+			.name          = {
+				"STATS_TL_BG",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_CAF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[10],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				16,
+			},
+			.name          = {
+				"STATS_BF",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[11],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				14,
+			},
+			.name          = {
+				"STATS_AWB_BGB",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[12],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				12,
+			},
+			.name          = {
+				"STATS_BHIST",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BAYER_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[13],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				18,
+			},
+			.name          = {
+				"STATS_RS",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[14],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				19,
+			},
+			.name          = {
+				"STATS_IHIST",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+			.max_width     = 4928,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[15],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				4,
+				5,
+			},
+			.name          = {
+				"FULL_DISP_Y",
+				"FULL_DISP_C",
+			},
+			.pid_mask      = 0x70000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+			.max_width     = 1232,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[16],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				6,
+			},
+			.name          = {
+				"DISP_DS_4",
+			},
+			.pid_mask      = 0x70000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+			.max_width     = 308,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[17],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				7,
+			},
+			.name          = {
+				"DISP_DS_16",
+			},
+			.pid_mask      = 0x70000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe780_out_port_mid[18],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				21,
+			},
+			.name          = {
+				"PDAF_1_PREPROCESS_2PD",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[19],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				15,
+			},
+			.name          = {
+				"AWB_BFW",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PDAF_PARSED,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe780_out_port_mid[20],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				22,
+			},
+			.name          = {
+				"PDAF_2_PARSED_DATA",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[21],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				11,
+			},
+			.name          = {
+				"AEC_BE",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[22],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				26,
+			},
+			.name          = {
+				"LTM",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe780_out_port_mid[23],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				17,
+			},
+			.name          = {
+				"GTM_BHIST",
+			},
+			.pid_mask      = 0x700000,
+		},
+	},
+
+	.num_cons_err = 29,
+	.constraint_error_list = {
+		{
+			.bitmask = BIT(0),
+			.error_description = "PPC 1x1 input Not Supported"
+		},
+		{
+			.bitmask = BIT(1),
+			.error_description = "PPC 1x2 input Not Supported"
+		},
+		{
+			.bitmask = BIT(2),
+			.error_description = "PPC 2x1 input Not Supported"
+		},
+		{
+			.bitmask = BIT(3),
+			.error_description = "PPC 2x2 input Not Supported"
+		},
+		{
+			.bitmask = BIT(4),
+			.error_description = "Pack 8 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(5),
+			.error_description = "Pack 16 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(6),
+			.error_description = "Pack 32 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(7),
+			.error_description = "Pack 64 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(8),
+			.error_description = "Pack MIPI 20 format Not Supported"
+		},
+		{
+			.bitmask = BIT(9),
+			.error_description = "Pack MIPI 14 format Not Supported"
+		},
+		{
+			.bitmask = BIT(10),
+			.error_description = "Pack MIPI 12 format Not Supported"
+		},
+		{
+			.bitmask = BIT(11),
+			.error_description = "Pack MIPI 10 format Not Supported"
+		},
+		{
+			.bitmask = BIT(12),
+			.error_description = "Pack 128 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(13),
+			.error_description = "UBWC NV12 format Not Supported"
+		},
+		{
+			.bitmask = BIT(14),
+			.error_description = "UBWC NV12 4R format Not Supported"
+		},
+		{
+			.bitmask = BIT(15),
+			.error_description = "UBWC TP10 format Not Supported"
+		},
+		{
+			.bitmask = BIT(16),
+			.error_description = "Frame based Mode Not Supported"
+		},
+		{
+			.bitmask = BIT(17),
+			.error_description = "Index based Mode Not Supported"
+		},
+		{
+			.bitmask = BIT(18),
+			.error_description = "FIFO image addr unalign"
+		},
+		{
+			.bitmask = BIT(19),
+			.error_description = "FIFO ubwc addr unalign"
+		},
+		{
+			.bitmask = BIT(20),
+			.error_description = "FIFO framehdr addr unalign"
+		},
+		{
+			.bitmask = BIT(21),
+			.error_description = "Image address unalign"
+		},
+		{
+			.bitmask = BIT(22),
+			.error_description = "UBWC address unalign"
+		},
+		{
+			.bitmask = BIT(23),
+			.error_description = "Frame Header address unalign"
+		},
+		{
+			.bitmask = BIT(24),
+			.error_description = "Stride unalign"
+		},
+		{
+			.bitmask = BIT(25),
+			.error_description = "X Initialization unalign"
+		},
+		{
+			.bitmask = BIT(26),
+			.error_description = "Image Width unalign"
+		},
+		{
+			.bitmask = BIT(27),
+			.error_description = "Image Height unalign"
+		},
+		{
+			.bitmask = BIT(28),
+			.error_description = "Meta Stride unalign"
+		},
+	},
+	.num_bus_errors_0      = ARRAY_SIZE(vfe780_bus_irq_err_desc_0),
+	.num_bus_errors_1      = ARRAY_SIZE(vfe780_bus_irq_err_desc_1),
+	.bus_err_desc_0        = vfe780_bus_irq_err_desc_0,
+	.bus_err_desc_1        = vfe780_bus_irq_err_desc_1,
+	.num_comp_grp          = 15,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3), BIT(4),
+		BIT(5), BIT(6), BIT(7), BIT(8), BIT(9), BIT(10),
+		BIT(13), BIT(14), BIT(15), BIT(16),
+	},
+	.top_irq_shift         = 0,
+	.max_out_res           = CAM_ISP_IFE_OUT_RES_BASE + 36,
+	.pack_align_shift      = 5,
+	.max_bw_counter_limit  = 0xFF,
+};
+
+static struct cam_vfe_irq_hw_info vfe780_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_EXT_CSID,
+	.top_irq_reg   = &vfe780_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe780_hw_info = {
+	.irq_hw_info                  = &vfe780_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe780_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe780_top_hw_info,
+};
+
+#endif /* _CAM_VFE780_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe860.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe860.h
@@ -0,0 +1,141 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE860_H_
+#define _CAM_VFE860_H_
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe880.h"
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe860_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.core_cfg_0               = 0x00000024,
+	.core_cfg_1               = 0x00000028,
+	.core_cfg_2               = 0x0000002C,
+	.global_reset_cmd         = 0x00000030,
+	.diag_config              = 0x00000050,
+	.diag_sensor_status_0     = 0x00000054,
+	.diag_sensor_status_1     = 0x00000058,
+	.diag_frm_cnt_status_0    = 0x0000005C,
+	.diag_frm_cnt_status_1    = 0x00000060,
+	.ipp_violation_status     = 0x00000064,
+	.pdaf_violation_status    = 0x00000404,
+	.core_cgc_ovd_0           = 0x00000018,
+	.core_cgc_ovd_1           = 0x0000001C,
+	.ahb_cgc_ovd              = 0x00000020,
+	.dsp_status               = 0x0000006C,
+	.stats_throttle_cfg_0     = 0x00000070,
+	.stats_throttle_cfg_1     = 0x00000074,
+	.stats_throttle_cfg_2     = 0x00000078,
+	.core_cfg_4               = 0x00000080,
+	.core_cfg_5               = 0x00000084,
+	.core_cfg_6               = 0x00000088,
+	.period_cfg               = 0x0000008C,
+	.irq_sub_pattern_cfg      = 0x00000090,
+	.epoch0_pattern_cfg       = 0x00000094,
+	.epoch1_pattern_cfg       = 0x00000098,
+	.epoch_height_cfg         = 0x0000009C,
+	.bus_violation_status     = 0x00000C64,
+	.bus_overflow_status      = 0x00000C68,
+	.num_perf_counters        = 2,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg    = 0x00000100,
+			.perf_pix_count    = 0x00000104,
+			.perf_line_count   = 0x00000108,
+			.perf_stall_count  = 0x0000010C,
+			.perf_always_count = 0x00000110,
+			.perf_count_status = 0x00000114,
+		},
+		{
+			.perf_count_cfg    = 0x00000118,
+			.perf_pix_count    = 0x0000011C,
+			.perf_line_count   = 0x00000120,
+			.perf_stall_count  = 0x00000124,
+			.perf_always_count = 0x00000128,
+			.perf_count_status = 0x0000012C,
+		},
+	},
+	.top_debug_cfg            = 0x000000FC,
+	.num_top_debug_reg        = CAM_VFE_880_NUM_DBG_REG,
+	.pdaf_input_cfg_0         = 0x00000130,
+	.pdaf_input_cfg_1         = 0x00000134,
+	.top_debug = vfe880_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+struct cam_vfe_ver4_path_hw_info
+	vfe860_rdi_hw_info_arr[] = {
+	{
+		.common_reg     = &vfe860_top_common_reg,
+		.reg_data       = &vfe880_vfe_full_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe860_top_common_reg,
+		.reg_data       = &vfe880_vfe_full_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe860_top_common_reg,
+		.reg_data       = &vfe880_vfe_full_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe860_top_hw_info = {
+	.common_reg = &vfe860_top_common_reg,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe860_top_common_reg,
+		.reg_data       = &vfe880_pp_common_reg_data,
+	},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe860_top_common_reg,
+		.reg_data       = &vfe880_pdlib_reg_data,
+	},
+	.rdi_hw_info            = vfe860_rdi_hw_info_arr,
+	.wr_client_desc         = vfe880_wr_client_desc,
+	.ipp_module_desc        = vfe880_ipp_mod_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.num_path_port_map = 3,
+	.path_port_map = {
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PREPROCESS_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PDAF_PARSED_DATA},
+	},
+	.num_rdi                         = ARRAY_SIZE(vfe860_rdi_hw_info_arr),
+	.num_top_errors                  = ARRAY_SIZE(vfe880_top_irq_err_desc),
+	.top_err_desc                    = vfe880_top_irq_err_desc,
+	.num_pdaf_violation_errors       = ARRAY_SIZE(vfe880_pdaf_violation_desc),
+	.pdaf_violation_desc             = vfe880_pdaf_violation_desc,
+	.debug_reg_info                  = &vfe880_dbg_reg_info,
+	.pdaf_lcr_res_mask               = vfe880_pdaf_lcr_res_mask,
+	.num_pdaf_lcr_res                = ARRAY_SIZE(vfe880_pdaf_lcr_res_mask),
+	.fcg_module_info                 = &vfe880_fcg_module_info,
+	.fcg_supported                   = true,
+};
+
+static struct cam_vfe_hw_info cam_vfe860_hw_info = {
+	.irq_hw_info                   = &vfe880_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe880_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe860_top_hw_info,
+};
+
+#endif /* _CAM_VFE860_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe880.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe880.h
@@ -0,0 +1,2517 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE880_H_
+#define _CAM_VFE880_H_
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_BUS_VER3_880_MAX_CLIENTS     27
+#define CAM_VFE_880_NUM_DBG_REG              19
+
+static struct cam_vfe_top_ver4_module_desc vfe880_ipp_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CLC_DEMUX",
+	},
+	{
+		.id = 1,
+		.desc = "CLC_CHANNEL_GAIN",
+	},
+	{
+		.id = 2,
+		.desc = "CLC_BPC_PDPC",
+	},
+	{
+		.id = 3,
+		.desc = "CLC_BINCORRECT",
+	},
+	{
+		.id = 4,
+		.desc = "CLC_COMPDECOMP",
+	},
+	{
+		.id = 5,
+		.desc = "CLC_LSC",
+	},
+	{
+		.id = 6,
+		.desc = "CLC_WB_GAIN",
+	},
+	{
+		.id = 7,
+		.desc = "CLC_GIC",
+	},
+	{
+		.id = 8,
+		.desc = "CLC_BPC_ABF",
+	},
+	{
+		.id = 9,
+		.desc = "CLC_BLS",
+	},
+	{
+		.id = 10,
+		.desc = "CLC_BAYER_GTM",
+	},
+	{
+		.id = 11,
+		.desc = "CLC_BAYER_LTM",
+	},
+	{
+		.id = 12,
+		.desc = "CLC_LCAC",
+	},
+	{
+		.id = 13,
+		.desc = "CLC_DEMOSAIC",
+	},
+	{
+		.id = 14,
+		.desc = "CLC_COLOR_CORRECT",
+	},
+	{
+		.id = 15,
+		.desc = "CLC_GTM",
+	},
+	{
+		.id = 16,
+		.desc = "CLC_GLUT",
+	},
+	{
+		.id = 17,
+		.desc = "CLC_COLOR_TRANSFORM",
+	},
+	{
+		.id = 18,
+		.desc = "CLC_UVG",
+	},
+	{
+		.id = 19,
+		.desc = "CLC_PREPROCESSOR",
+	},
+	{
+		.id = 20,
+		.desc = "CLC_CHROMA_UP",
+	},
+	{
+		.id = 21,
+		.desc = "Reserved",
+	},
+	{
+		.id = 22,
+		.desc = "Reserved",
+	},
+	{
+		.id = 23,
+		.desc = "CLC_COMPDECOMP_HVX_TX",
+	},
+	{
+		.id = 24,
+		.desc = "CLC_COMPDECOMP_HVX_RX",
+	},
+	{
+		.id = 25,
+		.desc = "CLC_GTM_FD_OUT",
+	},
+	{
+		.id = 26,
+		.desc = "CLC_CROP_RND_CLAMP_PIXEL_RAW_OUT",
+	},
+	{
+		.id = 27,
+		.desc = "CLC_DOWNSCALE_MN_Y_FD_OUT",
+	},
+	{
+		.id = 28,
+		.desc = "CLC_DOWNSCALE_MN_C_FD_OUT",
+	},
+	{
+		.id = 29,
+		.desc = "CLC_CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_FD_OUT",
+	},
+	{
+		.id = 30,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_FD_OUT",
+	},
+	{
+		.id = 31,
+		.desc = "CLC_DOWNSCALE_MN_Y_DISP_OUT",
+	},
+	{
+		.id = 32,
+		.desc = "CLC_DOWNSCALE_MN_C_DISP_OUT",
+	},
+	{
+		.id = 33,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_DISP_OUT",
+	},
+	{
+		.id = 34,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_DISP_OUT",
+	},
+	{
+		.id = 35,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS4_OUT",
+	},
+	{
+		.id = 36,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS4_OUT",
+	},
+	{
+		.id = 37,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS4_OUT",
+	},
+	{
+		.id = 38,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS4_OUT",
+	},
+	{
+		.id = 39,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_DISP_DS16_OUT",
+	},
+	{
+		.id = 40,
+		.desc = "CLC_DOWNSCALE_4TO1_C_DISP_DS16_OUT",
+	},
+	{
+		.id = 41,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS16_OUT",
+	},
+	{
+		.id = 42,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS16_OUT",
+	},
+	{
+		.id = 43,
+		.desc = "CLC_DOWNSCALE_MN_Y_VID_OUT",
+	},
+	{
+		.id = 44,
+		.desc = "CLC_DOWNSCALE_MN_C_VID_OUT",
+	},
+	{
+		.id = 45,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_OUT",
+	},
+	{
+		.id = 46,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_VID_OUT",
+	},
+	{
+		.id = 47,
+		.desc = "CLC_DSX_Y_VID_OUT",
+	},
+	{
+		.id = 48,
+		.desc = "CLC_DSX_C_VID_OUT",
+	},
+	{
+		.id = 49,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DSX_Y_VID_OUT",
+	},
+	{
+		.id = 50,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DSX_C_VID_OUT",
+	},
+	{
+		.id = 51,
+		.desc = "CLC_DOWNSCALE_4TO1_Y_VID_DS16_OUT",
+	},
+	{
+		.id = 52,
+		.desc = "CLC_DOWNSCALE_4TO1_C_VID_DS16_OUT",
+	},
+	{
+		.id = 53,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_VID_DS16_OUT",
+	},
+	{
+		.id = 54,
+		.desc = "CLC_CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_VID_DS16_OUT",
+	},
+	{
+		.id = 55,
+		.desc = "CLC_STATS_AEC_BE",
+	},
+	{
+		.id = 56,
+		.desc = "CLC_STATS_AEC_BHIST",
+	},
+	{
+		.id = 57,
+		.desc = "CLC_STATS_BHIST",
+	},
+	{
+		.id = 58,
+		.desc = "CLC_STATS_TINTLESS_BG",
+	},
+	{
+		.id = 59,
+		.desc = "CLC_STATS_AWB_BG",
+	},
+	{
+		.id = 60,
+		.desc = "CLC_STATS_BFW",
+	},
+	{
+		.id = 61,
+		.desc = "CLC_STATS_RS",
+	},
+	{
+		.id = 62,
+		.desc = "CLC_STATS_IHIST",
+	},
+	{
+		.id = 63,
+		.desc = "Reserved",
+	},
+	{
+		.id = 64,
+		.desc = "CLC_PDPC_BPC_1D",
+	},
+	{
+		.id = 65,
+		.desc = "CLC_PDPC_BPC_1D_POST_LSC",
+	},
+	{
+		.id = 66,
+		.desc = "CLC_STATS_CAF",
+	},
+	{
+		.id = 67,
+		.desc = "CLC_FCG",
+	},
+	{
+		.id = 68,
+		.desc = "CLC_PDPC_BPC_1D_ALSC_STATS",
+	},
+	{
+		.id = 69,
+		.desc = "CLC_PDPC_BPC_1D_POST_FCG",
+	},
+	{
+		.id = 70,
+		.desc = "CLC_STATS_ALSC_BG",
+	},
+};
+
+static struct cam_vfe_top_ver4_wr_client_desc vfe880_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "VIDEO_FULL_Y",
+	},
+	{
+		.wm_id = 1,
+		.desc = "VIDEO_FULL_C",
+	},
+	{
+		.wm_id = 2,
+		.desc = "VIDEO_DS_4:1",
+	},
+	{
+		.wm_id = 3,
+		.desc = "VIDEO_DS_16:1",
+	},
+	{
+		.wm_id = 4,
+		.desc = "DISPLAY_FULL_Y",
+	},
+	{
+		.wm_id = 5,
+		.desc = "DISPLAY_FULL_C",
+	},
+	{
+		.wm_id = 6,
+		.desc = "DISPLAY_DS_4:1",
+	},
+	{
+		.wm_id = 7,
+		.desc = "DISPLAY_DS_16:1",
+	},
+	{
+		.wm_id = 8,
+		.desc = "FD_Y",
+	},
+	{
+		.wm_id = 9,
+		.desc = "FD_C",
+	},
+	{
+		.wm_id = 10,
+		.desc = "PIXEL_RAW",
+	},
+	{
+		.wm_id = 11,
+		.desc = "STATS_BE0",
+	},
+	{
+		.wm_id = 12,
+		.desc = "STATS_BHIST0",
+	},
+	{
+		.wm_id = 13,
+		.desc = "STATS_TINTLESS_BG",
+	},
+	{
+		.wm_id = 14,
+		.desc = "STATS_AWB_BG",
+	},
+	{
+		.wm_id = 15,
+		.desc = "STATS_AWB_BFW",
+	},
+	{
+		.wm_id = 16,
+		.desc = "STATS_CAF",
+	},
+	{
+		.wm_id = 17,
+		.desc = "STATS_BHIST",
+	},
+	{
+		.wm_id = 18,
+		.desc = "STATS_BAYER_RS",
+	},
+	{
+		.wm_id = 19,
+		.desc = "STATS_IHIST",
+	},
+	{
+		.wm_id = 20,
+		.desc = "PDAF_0_2PD",
+	},
+	{
+		.wm_id = 21,
+		.desc = "PDAF_1_PREPROCESS_2PD",
+	},
+	{
+		.wm_id = 22,
+		.desc = "PDAF_2_PARSED_DATA",
+	},
+	{
+		.wm_id = 23,
+		.desc = "RDI0",
+	},
+	{
+		.wm_id = 24,
+		.desc = "RDI1",
+	},
+	{
+		.wm_id = 25,
+		.desc = "RDI2",
+	},
+	{
+		.wm_id = 26,
+		.desc = "LTM_STATS",
+	},
+	{
+		.wm_id = 27,
+		.desc = "STATS_ALSC",
+	},
+};
+
+static struct cam_vfe_top_ver4_top_err_irq_desc vfe880_top_irq_err_desc[] = {
+	{
+		.bitmask = BIT(4),
+		.err_name = "PP VIOLATION",
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(6),
+		.err_name = "PDAF VIOLATION",
+		.desc = "",
+	},
+	{
+		.bitmask = BIT(7),
+		.err_name = "DYNAMIC PDAF SWITCH VIOLATION",
+		.desc = "PD exposure changes dynamically and the sensor gap is not large enough",
+	},
+	{
+		.bitmask = BIT(8),
+		.err_name = "LCR PD INPUT TIMING PROTOCOL VIOLATION",
+		.desc = "Input timing protocol on the LCR  and PD path is not met",
+	},
+	{
+		.bitmask = BIT(12),
+		.err_name = "DSP IFE PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the output Data",
+	},
+	{
+		.bitmask = BIT(13),
+		.err_name = "IFE DSP TX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the outgoing data to the DSP interface",
+	},
+	{
+		.bitmask = BIT(14),
+		.err_name = "DSP IFE RX PROTOCOL VIOLATION",
+		.desc = "CCIF protocol violation on the incoming data from DSP before processed",
+	},
+	{
+		.bitmask = BIT(15),
+		.err_name = "DSP TX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface TX path FIFO",
+	},
+	{
+		.bitmask = BIT(16),
+		.err_name = "DSP RX FIFO OVERFLOW",
+		.desc = "Overflow on DSP interface RX path FIFO",
+	},
+	{
+		.bitmask = BIT(17),
+		.err_name = "DSP ERROR VIOLATION",
+		.desc = "When DSP sends a error signal",
+	},
+	{
+		.bitmask = BIT(18),
+		.err_name = "DIAG VIOLATION",
+		.desc = "HBI is less than the minimum required HBI",
+	},
+};
+
+static struct cam_vfe_top_ver4_pdaf_violation_desc vfe880_pdaf_violation_desc[] = {
+	{
+		.bitmask = BIT(0),
+		.desc = "Sim monitor 1 violation - SAD output",
+	},
+	{
+		.bitmask = BIT(1),
+		.desc = "Sim monitor 2 violation - pre-proc output",
+	},
+	{
+		.bitmask = BIT(2),
+		.desc = "Sim monitor 3 violation - parsed output",
+	},
+	{
+		.bitmask = BIT(3),
+		.desc = "Constraint violation",
+	},
+};
+
+static struct cam_vfe_top_ver4_pdaf_lcr_res_info vfe880_pdaf_lcr_res_mask[] = {
+	{
+		.res_id = CAM_ISP_HW_VFE_IN_RDI0,
+		.val = 0,
+	},
+	{
+		.res_id = CAM_ISP_HW_VFE_IN_RDI1,
+		.val = 1,
+	},
+	{
+		.res_id = CAM_ISP_HW_VFE_IN_RDI2,
+		.val = 2,
+	},
+};
+
+static struct cam_irq_register_set vfe880_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x00000034,
+		.clear_reg_offset  = 0x0000003C,
+		.status_reg_offset = 0x00000044,
+		.set_reg_offset    = 0x0000004C,
+		.test_set_val      = BIT(1),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x00000038,
+		.clear_reg_offset  = 0x00000040,
+		.status_reg_offset = 0x00000048,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe880_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe880_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000030,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe880_top_debug_reg[] = {
+	0x000000A0,
+	0x000000A4,
+	0x000000A8,
+	0x000000AC,
+	0x000000B0,
+	0x000000B4,
+	0x000000B8,
+	0x000000BC,
+	0x000000C0,
+	0x000000C4,
+	0x000000C8,
+	0x000000CC,
+	0x000000D0,
+	0x000000D4,
+	0x000000D8,
+	0x000000DC,
+	0x000000E0,
+	0x000000E4,
+	0x000000E8,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe880_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.core_cfg_0               = 0x00000024,
+	.core_cfg_1               = 0x00000028,
+	.core_cfg_2               = 0x0000002C,
+	.global_reset_cmd         = 0x00000030,
+	.diag_config              = 0x00000050,
+	.diag_sensor_status_0     = 0x00000054,
+	.diag_sensor_status_1     = 0x00000058,
+	.diag_frm_cnt_status_0    = 0x0000005C,
+	.diag_frm_cnt_status_1    = 0x00000060,
+	.ipp_violation_status     = 0x00000064,
+	.pdaf_violation_status    = 0x00000404,
+	.core_cgc_ovd_0           = 0x00000018,
+	.core_cgc_ovd_1           = 0x0000001C,
+	.ahb_cgc_ovd              = 0x00000020,
+	.dsp_status               = 0x0000006C,
+	.stats_throttle_cfg_0     = 0x00000070,
+	.stats_throttle_cfg_1     = 0x00000074,
+	.stats_throttle_cfg_2     = 0x00000078,
+	.core_cfg_4               = 0x00000080,
+	.core_cfg_5               = 0x00000084,
+	.core_cfg_6               = 0x00000088,
+	.period_cfg               = 0x0000008C,
+	.irq_sub_pattern_cfg      = 0x00000090,
+	.epoch0_pattern_cfg       = 0x00000094,
+	.epoch1_pattern_cfg       = 0x00000098,
+	.epoch_height_cfg         = 0x0000009C,
+	.bus_violation_status     = 0x00000C64,
+	.bus_overflow_status      = 0x00000C68,
+	.num_perf_counters        = 2,
+	.perf_count_reg = {
+		{
+			.perf_count_cfg    = 0x00000100,
+			.perf_pix_count    = 0x00000104,
+			.perf_line_count   = 0x00000108,
+			.perf_stall_count  = 0x0000010C,
+			.perf_always_count = 0x00000110,
+			.perf_count_status = 0x00000114,
+		},
+		{
+			.perf_count_cfg    = 0x00000118,
+			.perf_pix_count    = 0x0000011C,
+			.perf_line_count   = 0x00000120,
+			.perf_stall_count  = 0x00000124,
+			.perf_always_count = 0x00000128,
+			.perf_count_status = 0x0000012C,
+		},
+	},
+	.top_debug_cfg            = 0x000000FC,
+	.num_top_debug_reg        = CAM_VFE_880_NUM_DBG_REG,
+	.pdaf_input_cfg_0         = 0x00000130,
+	.pdaf_input_cfg_1         = 0x00000134,
+	.top_debug = vfe880_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe880_pp_common_reg_data = {
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x10000,
+	.epoch1_irq_mask                 = 0x20000,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask                  = 0x7F1D0,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+	.ipp_violation_mask              = 0x10,
+	.pdaf_violation_mask             = 0x40,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe880_vfe_full_rdi_reg_data[3] = {
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x400,
+		.eof_irq_mask                    = 0x800,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+	{
+		.sof_irq_mask                    = 0x1000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 3,
+	},
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe880_pdlib_reg_data = {
+	.sof_irq_mask                    = 0x4,
+	.eof_irq_mask                    = 0x8,
+	.error_irq_mask                  = 0x0,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 3,
+};
+
+struct cam_vfe_ver4_path_hw_info
+	vfe880_rdi_hw_info_arr[] = {
+	{
+		.common_reg     = &vfe880_top_common_reg,
+		.reg_data       = &vfe880_vfe_full_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe880_top_common_reg,
+		.reg_data       = &vfe880_vfe_full_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe880_top_common_reg,
+		.reg_data       = &vfe880_vfe_full_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver4_debug_reg_info vfe880_dbg_reg_info[CAM_VFE_880_NUM_DBG_REG][8] = {
+	VFE_DBG_INFO_ARRAY_4bit("test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_IHIST",
+		"STATS_RS",
+		"STATS_CAF",
+		"GTM_BHIST",
+		"TINTLESS_BG",
+		"STATS_BFW",
+		"STATS_BG",
+		"STATS_BHIST"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"STATS_BE",
+		"R2PD_DS16_C_VID",
+		"R2PD_DS16_Y_VID",
+		"crop_rnd_clamp_post_downscale_C_DS16_VID",
+		"4to1_C_DS16_VID",
+		"crop_rnd_clamp_post_downscale_Y_DS16_VID",
+		"4to1_Y_DS16_VID",
+		"crop_rnd_clamp_post_dsx_C_VID"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"R2PD_DS4_VID_C",
+		"R2PD_DS4_VID_Y",
+		"DSX_C",
+		"crop_rnd_clamp_post_dsx_Y_VID",
+		"DSX_Y",
+		"crop_rnd_clamp_post_downscale_mn_C_VID",
+		"downscale_mn_C_VID",
+		"crop_rnd_clamp_post_downscale_mn_Y_VID"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"MNDS_Y_VID",
+		"R2PD_DS16_C_DISP",
+		"R2PD_DS16_Y_DISP",
+		"crop_rnd_clamp_post_downscale_C_DS16_DISP",
+		"4to1_C_DS16_DISP",
+		"crop_rnd_clamp_post_downscale_Y_DS16_DISP",
+		"4to1_Y_DS16_DISP",
+		"R2PD_DS4_C_DISP"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"R2PD_DS4_Y_DISP",
+		"crop_rnd_clamp_post_downscale_C_DS4_DISP",
+		"4to1_C_DS4_DISP",
+		"crop_rnd_clamp_post_downscale_Y_DS4_DISP",
+		"4to1_Y_DS4_DISP",
+		"crop_rnd_clamp_post_downscale_mn_C_DISP",
+		"downscale_mn_C_DISP",
+		"crop_rnd_clamp_post_downscale_mn_Y_DISP"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"downscale_mn_Y_DISP",
+		"crop_rnd_clamp_post_downscale_mn_C_FD",
+		"downscale_mn_C_FD",
+		"crop_rnd_clamp_post_downscale_mn_Y_FD",
+		"downscale_mn_Y_FD",
+		"gtm_fd_out",
+		"uvg",
+		"color_xform"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"glut",
+		"gtm",
+		"color_correct",
+		"demosaic",
+		"hvx_tap2",
+		"lcac",
+		"bayer_ltm",
+		"bayer_gtm"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"bls",
+		"bpc_abf",
+		"gic",
+		"wb_gain",
+		"lsc",
+		"compdecomp_hxv_rx",
+		"compdecomp_hxv_tx",
+		"hvx_tap1"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"decompand",
+		"reserved",
+		"bincorrect",
+		"bpc_pdpc",
+		"channel_gain",
+		"bayer_argb_ccif_converter",
+		"crop_rnd_clamp_pre_argb_packer",
+		"chroma_up_uv"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"chroma_up_y",
+		"demux",
+		"hxv_tap0",
+		"preprocess",
+		"reserved",
+		"reserved",
+		"bayer_ltm_bus_wr",
+		"RDI2"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"RDI1",
+		"RDI0",
+		"reserved",
+		"pdaf_2_bus_wr",
+		"pdaf_1_bus_wr",
+		"pdaf_1_bus_wr",
+		"ihist_bus_wr",
+		"flicker_rs_bus_wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"gtm_bhist_bus_wr",
+		"caf_bus_wr",
+		"bfw_bus_wr",
+		"bg_bus_wr",
+		"tintless_bg_bus_wr",
+		"bhist_bus_wr",
+		"be_bus_wr",
+		"pixel_raw_bus_wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"fd_c_bus_wr",
+		"fd_y_bus_wr",
+		"disp_ds16_bus_wr",
+		"disp_ds4_bus_wr",
+		"disp_c_bus_wr",
+		"disp_y_bus_wr",
+		"vid_ds16_bus_Wr",
+		"vid_ds4_bus_Wr"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"vid_c_bus_wr",
+		"vid_y_bus_wr",
+		"CLC_PDAF",
+		"PIX_PP",
+		"reserved",
+		"reserved",
+		"reserved",
+		"reserved"
+	),
+	{
+		/* needs to be parsed separately, doesn't conform to I, V, R */
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+		VFE_DBG_INFO(32, "lcr_pd_timing_debug"),
+	},
+	VFE_DBG_INFO_ARRAY_4bit(
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved",
+		"r2pd_reserved"
+	),
+	{
+		/* needs to be parsed separately, doesn't conform to I, V, R */
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+		VFE_DBG_INFO(32, "lcr_pd_monitor"),
+	},
+	{
+		/* needs to be parsed separately, doesn't conform to I, V, R */
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+		VFE_DBG_INFO(32, "bus_wr_src_idle"),
+	},
+};
+
+static struct cam_vfe_ver4_fcg_module_info vfe880_fcg_module_info = {
+	.fcg_index_shift                     = 16,
+	.max_reg_val_pair_size               = 4,
+	.fcg_type_size                       = 2,
+	.fcg_phase_index_cfg_0               = 0xC870,
+	.fcg_phase_index_cfg_1               = 0xC874,
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe880_top_hw_info = {
+	.common_reg = &vfe880_top_common_reg,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe880_top_common_reg,
+		.reg_data       = &vfe880_pp_common_reg_data,
+	},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe880_top_common_reg,
+		.reg_data       = &vfe880_pdlib_reg_data,
+	},
+	.rdi_hw_info            = vfe880_rdi_hw_info_arr,
+	.wr_client_desc         = vfe880_wr_client_desc,
+	.ipp_module_desc        = vfe880_ipp_mod_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.num_path_port_map = 3,
+	.path_port_map = {
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PREPROCESS_2PD},
+		{CAM_ISP_HW_VFE_IN_PDLIB, CAM_ISP_IFE_OUT_RES_PDAF_PARSED_DATA},
+	},
+	.num_rdi                         = ARRAY_SIZE(vfe880_rdi_hw_info_arr),
+	.num_top_errors                  = ARRAY_SIZE(vfe880_top_irq_err_desc),
+	.top_err_desc                    = vfe880_top_irq_err_desc,
+	.num_pdaf_violation_errors       = ARRAY_SIZE(vfe880_pdaf_violation_desc),
+	.pdaf_violation_desc             = vfe880_pdaf_violation_desc,
+	.debug_reg_info                  = &vfe880_dbg_reg_info,
+	.pdaf_lcr_res_mask               = vfe880_pdaf_lcr_res_mask,
+	.num_pdaf_lcr_res                = ARRAY_SIZE(vfe880_pdaf_lcr_res_mask),
+	.fcg_module_info                 = &vfe880_fcg_module_info,
+	.fcg_supported                   = true,
+};
+
+static struct cam_irq_register_set vfe880_bus_irq_reg[2] = {
+	{
+		.mask_reg_offset   = 0x00000C18,
+		.clear_reg_offset  = 0x00000C20,
+		.status_reg_offset = 0x00000C28,
+		.set_reg_offset    = 0x00000C50,
+	},
+	{
+		.mask_reg_offset   = 0x00000C1C,
+		.clear_reg_offset  = 0x00000C24,
+		.status_reg_offset = 0x00000C2C,
+		.set_reg_offset    = 0x00000C54,
+	},
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe880_ubwc_regs_client_0 = {
+	.meta_addr        = 0x00000E40,
+	.meta_cfg         = 0x00000E44,
+	.mode_cfg         = 0x00000E48,
+	.stats_ctrl       = 0x00000E4C,
+	.ctrl_2           = 0x00000E50,
+	.lossy_thresh0    = 0x00000E54,
+	.lossy_thresh1    = 0x00000E58,
+	.off_lossy_var    = 0x00000E5C,
+	.bw_limit         = 0x00000E1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe880_ubwc_regs_client_1 = {
+	.meta_addr        = 0x00000F40,
+	.meta_cfg         = 0x00000F44,
+	.mode_cfg         = 0x00000F48,
+	.stats_ctrl       = 0x00000F4C,
+	.ctrl_2           = 0x00000F50,
+	.lossy_thresh0    = 0x00000F54,
+	.lossy_thresh1    = 0x00000F58,
+	.off_lossy_var    = 0x00000F5C,
+	.bw_limit         = 0x00000F1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe880_ubwc_regs_client_4 = {
+	.meta_addr        = 0x00001240,
+	.meta_cfg         = 0x00001244,
+	.mode_cfg         = 0x00001248,
+	.stats_ctrl       = 0x0000124C,
+	.ctrl_2           = 0x00001250,
+	.lossy_thresh0    = 0x00001254,
+	.lossy_thresh1    = 0x00001258,
+	.off_lossy_var    = 0x0000125C,
+	.bw_limit         = 0x0000121C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe880_ubwc_regs_client_5 = {
+	.meta_addr        = 0x00001340,
+	.meta_cfg         = 0x00001344,
+	.mode_cfg         = 0x00001348,
+	.stats_ctrl       = 0x0000134C,
+	.ctrl_2           = 0x00001350,
+	.lossy_thresh0    = 0x00001354,
+	.lossy_thresh1    = 0x00001358,
+	.off_lossy_var    = 0x0000135C,
+	.bw_limit         = 0x0000131C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static uint32_t vfe880_out_port_mid[][4] = {
+	{34, 0, 0, 0},
+	{35, 0, 0, 0},
+	{36, 0, 0, 0},
+	{8, 9, 10, 11},
+	{11, 0, 0, 0},
+	{12, 0, 0, 0},
+	{32, 33, 0, 0},
+	{27, 28, 29, 0},
+	{8, 0, 0, 0},
+	{18, 0, 0, 0},
+	{21, 0, 0, 0},
+	{19, 0, 0, 0},
+	{17, 0, 0, 0},
+	{23, 0, 0, 0},
+	{24, 0, 0, 0},
+	{12, 13, 14, 15},
+	{13, 0, 0, 0},
+	{14, 0, 0, 0},
+	{9, 0, 0, 0},
+	{20, 0, 0, 0},
+	{10, 0, 0, 0},
+	{16, 0, 0, 0},
+	{25, 26, 0, 0},
+	{22, 0, 0, 0},
+	{30, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_err_irq_desc vfe880_bus_irq_err_desc_0[] = {
+	{
+		.bitmask = BIT(26),
+		.err_name = "IPCC_FENCE_DATA_ERR",
+		.desc = "IPCC or FENCE Data was not available in the Input Fifo",
+	},
+	{
+		.bitmask = BIT(27),
+		.err_name = "IPCC_FENCE_ADDR_ERR",
+		.desc = "IPCC or FENCE address fifo was empty and read was attempted",
+	},
+	{
+		.bitmask = BIT(28),
+		.err_name = "CONS_VIOLATION",
+		.desc = "Programming of software registers violated the constraints",
+	},
+	{
+		.bitmask = BIT(30),
+		.err_name = "VIOLATION",
+		.desc = "Client has a violation in ccif protocol at input",
+	},
+	{
+		.bitmask = BIT(31),
+		.err_name = "IMAGE_SIZE_VIOLATION",
+		.desc = "Programmed image size is not same as image size from the CCIF",
+	},
+};
+
+static struct cam_vfe_bus_ver3_err_irq_desc vfe880_bus_irq_err_desc_1[] = {
+	{
+		.bitmask = BIT(28),
+		.err_name = "EARLY_DONE",
+		.desc = "Buf done for each client. Early done irq for clients STATS_BAF",
+	},
+	{
+		.bitmask = BIT(29),
+		.err_name = "EARLY_DONE",
+		.desc = "Buf done for each client. Early done irq for clients STATS_BAF",
+	},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe880_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000C00,
+		.cgc_ovd                          = 0x00000C08,
+		.if_frameheader_cfg               = {
+			0x00000C34,
+			0x00000C38,
+			0x00000C3C,
+			0x00000C40,
+			0x00000C44,
+		},
+		.ubwc_static_ctrl                 = 0x00000C58,
+		.pwr_iso_cfg                      = 0x00000C5C,
+		.overflow_status_clear            = 0x00000C60,
+		.ccif_violation_status            = 0x00000C64,
+		.overflow_status                  = 0x00000C68,
+		.image_size_violation_status      = 0x00000C70,
+		.debug_status_top_cfg             = 0x00000CF0,
+		.debug_status_top                 = 0x00000CF4,
+		.test_bus_ctrl                    = 0x00000CDC,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe880_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00000C30,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = CAM_VFE_BUS_VER3_880_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 FULL Y */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.frame_header_addr        = 0x00000E20,
+			.frame_header_incr        = 0x00000E24,
+			.frame_header_cfg         = 0x00000E28,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_cfg                 = 0x00000E70,
+			.addr_status_0            = 0x00000E78,
+			.addr_status_1            = 0x00000E7C,
+			.addr_status_2            = 0x00000E80,
+			.addr_status_3            = 0x00000E84,
+			.debug_status_cfg         = 0x00000E88,
+			.debug_status_0           = 0x00000E8C,
+			.debug_status_1           = 0x00000E90,
+			.bw_limiter_addr          = 0x00000E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe880_ubwc_regs_client_0,
+		},
+		/* BUS Client 1 FULL C */
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_cfg                 = 0x00000E70,
+			.addr_status_0            = 0x00000F78,
+			.addr_status_1            = 0x00000F7C,
+			.addr_status_2            = 0x00000F80,
+			.addr_status_3            = 0x00000F84,
+			.debug_status_cfg         = 0x00000F88,
+			.debug_status_0           = 0x00000F8C,
+			.debug_status_1           = 0x00000F90,
+			.bw_limiter_addr          = 0x00000F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe880_ubwc_regs_client_1,
+		},
+		/* BUS Client 2 DS4 */
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.system_cache_cfg         = 0x00001068,
+			.addr_cfg                 = 0x00001070,
+			.addr_status_0            = 0x00001078,
+			.addr_status_1            = 0x0000107C,
+			.addr_status_2            = 0x00001080,
+			.addr_status_3            = 0x00001084,
+			.debug_status_cfg         = 0x00001088,
+			.debug_status_0           = 0x0000108C,
+			.debug_status_1           = 0x00001090,
+			.bw_limiter_addr          = 0x0000101C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 DS16 */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.system_cache_cfg         = 0x00001168,
+			.addr_cfg                 = 0x00001170,
+			.addr_status_0            = 0x00001178,
+			.addr_status_1            = 0x0000117C,
+			.addr_status_2            = 0x00001180,
+			.addr_status_3            = 0x00001184,
+			.debug_status_cfg         = 0x00001188,
+			.debug_status_0           = 0x0000118C,
+			.debug_status_1           = 0x00001190,
+			.bw_limiter_addr          = 0x0000111C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 DISP Y */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.system_cache_cfg         = 0x00001268,
+			.addr_cfg                 = 0x00001270,
+			.addr_status_0            = 0x00001278,
+			.addr_status_1            = 0x0000127C,
+			.addr_status_2            = 0x00001280,
+			.addr_status_3            = 0x00001284,
+			.debug_status_cfg         = 0x00001288,
+			.debug_status_0           = 0x0000128C,
+			.debug_status_1           = 0x00001290,
+			.bw_limiter_addr          = 0x0000121C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe880_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 DISP C */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.system_cache_cfg         = 0x00001368,
+			.addr_cfg                 = 0x00001370,
+			.addr_status_0            = 0x00001378,
+			.addr_status_1            = 0x0000137C,
+			.addr_status_2            = 0x00001380,
+			.addr_status_3            = 0x00001384,
+			.debug_status_cfg         = 0x00001388,
+			.debug_status_0           = 0x0000138C,
+			.debug_status_1           = 0x00001390,
+			.bw_limiter_addr          = 0x0000131C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe880_ubwc_regs_client_5,
+		},
+		/* BUS Client 6 DISP DS4 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_cfg                 = 0x00001470,
+			.addr_status_0            = 0x00001478,
+			.addr_status_1            = 0x0000147C,
+			.addr_status_2            = 0x00001480,
+			.addr_status_3            = 0x00001484,
+			.debug_status_cfg         = 0x00001488,
+			.debug_status_0           = 0x0000148C,
+			.debug_status_1           = 0x00001490,
+			.bw_limiter_addr          = 0x0000141C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 DISP DS16 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_cfg                 = 0x00001570,
+			.addr_status_0            = 0x00001578,
+			.addr_status_1            = 0x0000157C,
+			.addr_status_2            = 0x00001580,
+			.addr_status_3            = 0x00001584,
+			.debug_status_cfg         = 0x00001588,
+			.debug_status_0           = 0x0000158C,
+			.debug_status_1           = 0x00001590,
+			.bw_limiter_addr          = 0x0000151C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 FD Y */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_cfg                 = 0x00001670,
+			.addr_status_0            = 0x00001678,
+			.addr_status_1            = 0x0000167C,
+			.addr_status_2            = 0x00001680,
+			.addr_status_3            = 0x00001684,
+			.debug_status_cfg         = 0x00001688,
+			.debug_status_0           = 0x0000168C,
+			.debug_status_1           = 0x00001690,
+			.bw_limiter_addr          = 0x0000161C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 FD C */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_cfg                 = 0x00001770,
+			.addr_status_0            = 0x00001778,
+			.addr_status_1            = 0x0000177C,
+			.addr_status_2            = 0x00001780,
+			.addr_status_3            = 0x00001784,
+			.debug_status_cfg         = 0x00001788,
+			.debug_status_0           = 0x0000178C,
+			.debug_status_1           = 0x00001790,
+			.bw_limiter_addr          = 0x0000171C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 PIXEL RAW */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.framedrop_period         = 0x00001838,
+			.framedrop_pattern        = 0x0000183C,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_cfg                 = 0x00001870,
+			.addr_status_0            = 0x00001878,
+			.addr_status_1            = 0x0000187C,
+			.addr_status_2            = 0x00001880,
+			.addr_status_3            = 0x00001884,
+			.debug_status_cfg         = 0x00001888,
+			.debug_status_0           = 0x0000188C,
+			.debug_status_1           = 0x00001890,
+			.bw_limiter_addr          = 0x0000181C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 STATS BE 0 */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.framedrop_period         = 0x00001938,
+			.framedrop_pattern        = 0x0000193C,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_cfg                 = 0x00001970,
+			.addr_status_0            = 0x00001978,
+			.addr_status_1            = 0x0000197C,
+			.addr_status_2            = 0x00001980,
+			.addr_status_3            = 0x00001984,
+			.debug_status_cfg         = 0x00001988,
+			.debug_status_0           = 0x0000198C,
+			.debug_status_1           = 0x00001990,
+			.bw_limiter_addr          = 0x0000191C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 STATS BHIST 0 */
+		{
+			.cfg                      = 0x00001A00,
+			.image_addr               = 0x00001A04,
+			.frame_incr               = 0x00001A08,
+			.image_cfg_0              = 0x00001A0C,
+			.image_cfg_1              = 0x00001A10,
+			.image_cfg_2              = 0x00001A14,
+			.packer_cfg               = 0x00001A18,
+			.frame_header_addr        = 0x00001A20,
+			.frame_header_incr        = 0x00001A24,
+			.frame_header_cfg         = 0x00001A28,
+			.irq_subsample_period     = 0x00001A30,
+			.irq_subsample_pattern    = 0x00001A34,
+			.framedrop_period         = 0x00001A38,
+			.framedrop_pattern        = 0x00001A3C,
+			.mmu_prefetch_cfg         = 0x00001A60,
+			.mmu_prefetch_max_offset  = 0x00001A64,
+			.system_cache_cfg         = 0x00001A68,
+			.addr_cfg                 = 0x00001A70,
+			.addr_status_0            = 0x00001A78,
+			.addr_status_1            = 0x00001A7C,
+			.addr_status_2            = 0x00001A80,
+			.addr_status_3            = 0x00001A84,
+			.debug_status_cfg         = 0x00001A88,
+			.debug_status_0           = 0x00001A8C,
+			.debug_status_1           = 0x00001A90,
+			.bw_limiter_addr          = 0x00001A1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 STATS TINTLESS BG */
+		{
+			.cfg                      = 0x00001B00,
+			.image_addr               = 0x00001B04,
+			.frame_incr               = 0x00001B08,
+			.image_cfg_0              = 0x00001B0C,
+			.image_cfg_1              = 0x00001B10,
+			.image_cfg_2              = 0x00001B14,
+			.packer_cfg               = 0x00001B18,
+			.frame_header_addr        = 0x00001B20,
+			.frame_header_incr        = 0x00001B24,
+			.frame_header_cfg         = 0x00001B28,
+			.irq_subsample_period     = 0x00001B30,
+			.irq_subsample_pattern    = 0x00001B34,
+			.framedrop_period         = 0x00001B38,
+			.framedrop_pattern        = 0x00001B3C,
+			.mmu_prefetch_cfg         = 0x00001B60,
+			.mmu_prefetch_max_offset  = 0x00001B64,
+			.system_cache_cfg         = 0x00001B68,
+			.addr_cfg                 = 0x00001B70,
+			.addr_status_0            = 0x00001B78,
+			.addr_status_1            = 0x00001B7C,
+			.addr_status_2            = 0x00001B80,
+			.addr_status_3            = 0x00001B84,
+			.debug_status_cfg         = 0x00001B88,
+			.debug_status_0           = 0x00001B8C,
+			.debug_status_1           = 0x00001B90,
+			.bw_limiter_addr          = 0x00001B1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 STATS AWB BG */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.framedrop_period         = 0x00001C38,
+			.framedrop_pattern        = 0x00001C3C,
+			.mmu_prefetch_cfg         = 0x00001C60,
+			.mmu_prefetch_max_offset  = 0x00001C64,
+			.system_cache_cfg         = 0x00001C68,
+			.addr_cfg                 = 0x00001C70,
+			.addr_status_0            = 0x00001C78,
+			.addr_status_1            = 0x00001C7C,
+			.addr_status_2            = 0x00001C80,
+			.addr_status_3            = 0x00001C84,
+			.debug_status_cfg         = 0x00001C88,
+			.debug_status_0           = 0x00001C8C,
+			.debug_status_1           = 0x00001C90,
+			.bw_limiter_addr          = 0x00001C1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 STATS AWB BFW */
+		{
+			.cfg                      = 0x00001D00,
+			.image_addr               = 0x00001D04,
+			.frame_incr               = 0x00001D08,
+			.image_cfg_0              = 0x00001D0C,
+			.image_cfg_1              = 0x00001D10,
+			.image_cfg_2              = 0x00001D14,
+			.packer_cfg               = 0x00001D18,
+			.frame_header_addr        = 0x00001D20,
+			.frame_header_incr        = 0x00001D24,
+			.frame_header_cfg         = 0x00001D28,
+			.irq_subsample_period     = 0x00001D30,
+			.irq_subsample_pattern    = 0x00001D34,
+			.framedrop_period         = 0x00001D38,
+			.framedrop_pattern        = 0x00001D3C,
+			.mmu_prefetch_cfg         = 0x00001D60,
+			.mmu_prefetch_max_offset  = 0x00001D64,
+			.system_cache_cfg         = 0x00001D68,
+			.addr_cfg                 = 0x00001D70,
+			.addr_status_0            = 0x00001D78,
+			.addr_status_1            = 0x00001D7C,
+			.addr_status_2            = 0x00001D80,
+			.addr_status_3            = 0x00001D84,
+			.debug_status_cfg         = 0x00001D88,
+			.debug_status_0           = 0x00001D8C,
+			.debug_status_1           = 0x00001D90,
+			.bw_limiter_addr          = 0x00001D1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 STATS CAF */
+		{
+			.cfg                      = 0x00001E00,
+			.image_addr               = 0x00001E04,
+			.frame_incr               = 0x00001E08,
+			.image_cfg_0              = 0x00001E0C,
+			.image_cfg_1              = 0x00001E10,
+			.image_cfg_2              = 0x00001E14,
+			.packer_cfg               = 0x00001E18,
+			.frame_header_addr        = 0x00001E20,
+			.frame_header_incr        = 0x00001E24,
+			.frame_header_cfg         = 0x00001E28,
+			.irq_subsample_period     = 0x00001E30,
+			.irq_subsample_pattern    = 0x00001E34,
+			.framedrop_period         = 0x00001E38,
+			.framedrop_pattern        = 0x00001E3C,
+			.mmu_prefetch_cfg         = 0x00001E60,
+			.mmu_prefetch_max_offset  = 0x00001E64,
+			.system_cache_cfg         = 0x00001E68,
+			.addr_cfg                 = 0x00001E70,
+			.addr_status_0            = 0x00001E78,
+			.addr_status_1            = 0x00001E7C,
+			.addr_status_2            = 0x00001E80,
+			.addr_status_3            = 0x00001E84,
+			.debug_status_cfg         = 0x00001E88,
+			.debug_status_0           = 0x00001E8C,
+			.debug_status_1           = 0x00001E90,
+			.bw_limiter_addr          = 0x00001E1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 STATS BHIST */
+		{
+			.cfg                      = 0x00001F00,
+			.image_addr               = 0x00001F04,
+			.frame_incr               = 0x00001F08,
+			.image_cfg_0              = 0x00001F0C,
+			.image_cfg_1              = 0x00001F10,
+			.image_cfg_2              = 0x00001F14,
+			.packer_cfg               = 0x00001F18,
+			.frame_header_addr        = 0x00001F20,
+			.frame_header_incr        = 0x00001F24,
+			.frame_header_cfg         = 0x00001F28,
+			.irq_subsample_period     = 0x00001F30,
+			.irq_subsample_pattern    = 0x00001F34,
+			.framedrop_period         = 0x00001F38,
+			.framedrop_pattern        = 0x00001F3C,
+			.mmu_prefetch_cfg         = 0x00001F60,
+			.mmu_prefetch_max_offset  = 0x00001F64,
+			.system_cache_cfg         = 0x00001F68,
+			.addr_cfg                 = 0x00001F70,
+			.addr_status_0            = 0x00001F78,
+			.addr_status_1            = 0x00001F7C,
+			.addr_status_2            = 0x00001F80,
+			.addr_status_3            = 0x00001F84,
+			.debug_status_cfg         = 0x00001F88,
+			.debug_status_0           = 0x00001F8C,
+			.debug_status_1           = 0x00001F90,
+			.bw_limiter_addr          = 0x00001F1C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_8,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 STATS BAYER RS */
+		{
+			.cfg                      = 0x00002000,
+			.image_addr               = 0x00002004,
+			.frame_incr               = 0x00002008,
+			.image_cfg_0              = 0x0000200C,
+			.image_cfg_1              = 0x00002010,
+			.image_cfg_2              = 0x00002014,
+			.packer_cfg               = 0x00002018,
+			.frame_header_addr        = 0x00002020,
+			.frame_header_incr        = 0x00002024,
+			.frame_header_cfg         = 0x00002028,
+			.irq_subsample_period     = 0x00002030,
+			.irq_subsample_pattern    = 0x00002034,
+			.framedrop_period         = 0x00002038,
+			.framedrop_pattern        = 0x0000203C,
+			.mmu_prefetch_cfg         = 0x00002060,
+			.mmu_prefetch_max_offset  = 0x00002064,
+			.system_cache_cfg         = 0x00002068,
+			.addr_cfg                 = 0x00002070,
+			.addr_status_0            = 0x00002078,
+			.addr_status_1            = 0x0000207C,
+			.addr_status_2            = 0x00002080,
+			.addr_status_3            = 0x00002084,
+			.debug_status_cfg         = 0x00002088,
+			.debug_status_0           = 0x0000208C,
+			.debug_status_1           = 0x00002090,
+			.bw_limiter_addr          = 0x0000201C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_9,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 STATS IHIST */
+		{
+			.cfg                      = 0x00002100,
+			.image_addr               = 0x00002104,
+			.frame_incr               = 0x00002108,
+			.image_cfg_0              = 0x0000210C,
+			.image_cfg_1              = 0x00002110,
+			.image_cfg_2              = 0x00002114,
+			.packer_cfg               = 0x00002118,
+			.frame_header_addr        = 0x00002120,
+			.frame_header_incr        = 0x00002124,
+			.frame_header_cfg         = 0x00002128,
+			.irq_subsample_period     = 0x00002130,
+			.irq_subsample_pattern    = 0x00002134,
+			.framedrop_period         = 0x00002138,
+			.framedrop_pattern        = 0x0000213C,
+			.mmu_prefetch_cfg         = 0x00002160,
+			.mmu_prefetch_max_offset  = 0x00002164,
+			.system_cache_cfg         = 0x00002168,
+			.addr_cfg                 = 0x00002170,
+			.addr_status_0            = 0x00002178,
+			.addr_status_1            = 0x0000217C,
+			.addr_status_2            = 0x00002180,
+			.addr_status_3            = 0x00002184,
+			.debug_status_cfg         = 0x00002188,
+			.debug_status_0           = 0x0000218C,
+			.debug_status_1           = 0x00002190,
+			.bw_limiter_addr          = 0x0000211C,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_10,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 PDAF_0_2PD */
+		{
+			.cfg                      = 0x00002200,
+			.image_addr               = 0x00002204,
+			.frame_incr               = 0x00002208,
+			.image_cfg_0              = 0x0000220C,
+			.image_cfg_1              = 0x00002210,
+			.image_cfg_2              = 0x00002214,
+			.packer_cfg               = 0x00002218,
+			.frame_header_addr        = 0x00002220,
+			.frame_header_incr        = 0x00002224,
+			.frame_header_cfg         = 0x00002228,
+			.irq_subsample_period     = 0x00002230,
+			.irq_subsample_pattern    = 0x00002234,
+			.framedrop_period         = 0x00002238,
+			.framedrop_pattern        = 0x0000223C,
+			.mmu_prefetch_cfg         = 0x00002260,
+			.mmu_prefetch_max_offset  = 0x00002264,
+			.system_cache_cfg         = 0x00002268,
+			.addr_cfg                 = 0x00002270,
+			.addr_status_0            = 0x00002278,
+			.addr_status_1            = 0x0000227C,
+			.addr_status_2            = 0x00002280,
+			.addr_status_3            = 0x00002284,
+			.debug_status_cfg         = 0x00002288,
+			.debug_status_0           = 0x0000228C,
+			.debug_status_1           = 0x00002290,
+			.bw_limiter_addr          = 0x0000221C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 21 PDAF V2.0 PD DATA PDAF_1_PREPROCESS_2PD */
+		{
+			.cfg                      = 0x00002300,
+			.image_addr               = 0x00002304,
+			.frame_incr               = 0x00002308,
+			.image_cfg_0              = 0x0000230C,
+			.image_cfg_1              = 0x00002310,
+			.image_cfg_2              = 0x00002314,
+			.packer_cfg               = 0x00002318,
+			.frame_header_addr        = 0x00002320,
+			.frame_header_incr        = 0x00002324,
+			.frame_header_cfg         = 0x00002328,
+			.irq_subsample_period     = 0x00002330,
+			.irq_subsample_pattern    = 0x00002334,
+			.framedrop_period         = 0x00002338,
+			.framedrop_pattern        = 0x0000233C,
+			.mmu_prefetch_cfg         = 0x00002360,
+			.mmu_prefetch_max_offset  = 0x00002364,
+			.system_cache_cfg         = 0x00002368,
+			.addr_cfg                 = 0x00002370,
+			.addr_status_0            = 0x00002378,
+			.addr_status_1            = 0x0000237C,
+			.addr_status_2            = 0x00002380,
+			.addr_status_3            = 0x00002384,
+			.debug_status_cfg         = 0x00002388,
+			.debug_status_0           = 0x0000238C,
+			.debug_status_1           = 0x00002390,
+			.bw_limiter_addr          = 0x0000231C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 22 PDAF V2.0 PDAF_2_PARSED_DATA */
+		{
+			.cfg                      = 0x00002400,
+			.image_addr               = 0x00002404,
+			.frame_incr               = 0x00002408,
+			.image_cfg_0              = 0x0000240C,
+			.image_cfg_1              = 0x00002410,
+			.image_cfg_2              = 0x00002414,
+			.packer_cfg               = 0x00002418,
+			.frame_header_addr        = 0x00002420,
+			.frame_header_incr        = 0x00002424,
+			.frame_header_cfg         = 0x00002428,
+			.irq_subsample_period     = 0x00002430,
+			.irq_subsample_pattern    = 0x00002434,
+			.framedrop_period         = 0x00002438,
+			.framedrop_pattern        = 0x0000243C,
+			.mmu_prefetch_cfg         = 0x00002460,
+			.mmu_prefetch_max_offset  = 0x00002464,
+			.system_cache_cfg         = 0x00002468,
+			.addr_cfg                 = 0x00002470,
+			.addr_status_0            = 0x00002478,
+			.addr_status_1            = 0x0000247C,
+			.addr_status_2            = 0x00002480,
+			.addr_status_3            = 0x00002484,
+			.debug_status_cfg         = 0x00002488,
+			.debug_status_0           = 0x0000248C,
+			.debug_status_1           = 0x00002490,
+			.bw_limiter_addr          = 0x0000241C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 RDI0 */
+		{
+			.cfg                      = 0x00002500,
+			.image_addr               = 0x00002504,
+			.frame_incr               = 0x00002508,
+			.image_cfg_0              = 0x0000250C,
+			.image_cfg_1              = 0x00002510,
+			.image_cfg_2              = 0x00002514,
+			.packer_cfg               = 0x00002518,
+			.frame_header_addr        = 0x00002520,
+			.frame_header_incr        = 0x00002524,
+			.frame_header_cfg         = 0x00002528,
+			.line_done_cfg            = 0x0000252C,
+			.irq_subsample_period     = 0x00002530,
+			.irq_subsample_pattern    = 0x00002534,
+			.framedrop_period         = 0x00002538,
+			.framedrop_pattern        = 0x0000253C,
+			.mmu_prefetch_cfg         = 0x00002560,
+			.mmu_prefetch_max_offset  = 0x00002564,
+			.system_cache_cfg         = 0x00002568,
+			.addr_cfg                 = 0x00002570,
+			.addr_status_0            = 0x00002578,
+			.addr_status_1            = 0x0000257C,
+			.addr_status_2            = 0x00002580,
+			.addr_status_3            = 0x00002584,
+			.debug_status_cfg         = 0x00002588,
+			.debug_status_0           = 0x0000258C,
+			.debug_status_1           = 0x00002590,
+			.bw_limiter_addr          = 0x0000251C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_12,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 24 RDI1 */
+		{
+			.cfg                      = 0x00002600,
+			.image_addr               = 0x00002604,
+			.frame_incr               = 0x00002608,
+			.image_cfg_0              = 0x0000260C,
+			.image_cfg_1              = 0x00002610,
+			.image_cfg_2              = 0x00002614,
+			.packer_cfg               = 0x00002618,
+			.frame_header_addr        = 0x00002620,
+			.frame_header_incr        = 0x00002624,
+			.frame_header_cfg         = 0x00002628,
+			.line_done_cfg            = 0x0000262C,
+			.irq_subsample_period     = 0x00002630,
+			.irq_subsample_pattern    = 0x00002634,
+			.framedrop_period         = 0x00002638,
+			.framedrop_pattern        = 0x0000263C,
+			.mmu_prefetch_cfg         = 0x00002660,
+			.mmu_prefetch_max_offset  = 0x00002664,
+			.system_cache_cfg         = 0x00002668,
+			.addr_cfg                 = 0x00002670,
+			.addr_status_0            = 0x00002678,
+			.addr_status_1            = 0x0000267C,
+			.addr_status_2            = 0x00002680,
+			.addr_status_3            = 0x00002684,
+			.debug_status_cfg         = 0x00002688,
+			.debug_status_0           = 0x0000268C,
+			.debug_status_1           = 0x00002690,
+			.bw_limiter_addr          = 0x0000261C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_13,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 25 RDI2 */
+		{
+			.cfg                      = 0x00002700,
+			.image_addr               = 0x00002704,
+			.frame_incr               = 0x00002708,
+			.image_cfg_0              = 0x0000270C,
+			.image_cfg_1              = 0x00002710,
+			.image_cfg_2              = 0x00002714,
+			.packer_cfg               = 0x00002718,
+			.frame_header_addr        = 0x00002720,
+			.frame_header_incr        = 0x00002724,
+			.frame_header_cfg         = 0x00002728,
+			.line_done_cfg            = 0x0000272C,
+			.irq_subsample_period     = 0x00002730,
+			.irq_subsample_pattern    = 0x00002734,
+			.framedrop_period         = 0x00002738,
+			.framedrop_pattern        = 0x0000273C,
+			.mmu_prefetch_cfg         = 0x00002760,
+			.mmu_prefetch_max_offset  = 0x00002764,
+			.system_cache_cfg         = 0x00002768,
+			.addr_cfg                 = 0x00002770,
+			.addr_status_0            = 0x00002778,
+			.addr_status_1            = 0x0000277C,
+			.addr_status_2            = 0x00002780,
+			.addr_status_3            = 0x00002784,
+			.debug_status_cfg         = 0x00002788,
+			.debug_status_0           = 0x0000278C,
+			.debug_status_1           = 0x00002790,
+			.bw_limiter_addr          = 0x0000271C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_14,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 26 LTM STATS */
+		{
+			.cfg                      = 0x00002800,
+			.image_addr               = 0x00002804,
+			.frame_incr               = 0x00002808,
+			.image_cfg_0              = 0x0000280C,
+			.image_cfg_1              = 0x00002810,
+			.image_cfg_2              = 0x00002814,
+			.packer_cfg               = 0x00002818,
+			.frame_header_addr        = 0x00002820,
+			.frame_header_incr        = 0x00002824,
+			.frame_header_cfg         = 0x00002828,
+			.irq_subsample_period     = 0x00002830,
+			.irq_subsample_pattern    = 0x00002834,
+			.framedrop_period         = 0x00002838,
+			.framedrop_pattern        = 0x0000283C,
+			.mmu_prefetch_cfg         = 0x00002860,
+			.mmu_prefetch_max_offset  = 0x00002864,
+			.system_cache_cfg         = 0x00002868,
+			.addr_cfg                 = 0x00002870,
+			.addr_status_0            = 0x00002878,
+			.addr_status_1            = 0x0000287C,
+			.addr_status_2            = 0x00002880,
+			.addr_status_3            = 0x00002884,
+			.debug_status_cfg         = 0x00002888,
+			.debug_status_0           = 0x0000288C,
+			.debug_status_1           = 0x00002890,
+			.bw_limiter_addr          = 0x0000281C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 27 ALSC BG */
+		{
+			.cfg                      = 0x00002900,
+			.image_addr               = 0x00002904,
+			.frame_incr               = 0x00002908,
+			.image_cfg_0              = 0x0000290C,
+			.image_cfg_1              = 0x00002910,
+			.image_cfg_2              = 0x00002914,
+			.packer_cfg               = 0x00002918,
+			.frame_header_addr        = 0x00002920,
+			.frame_header_incr        = 0x00002924,
+			.frame_header_cfg         = 0x00002928,
+			.irq_subsample_period     = 0x00002930,
+			.irq_subsample_pattern    = 0x00002934,
+			.framedrop_period         = 0x00002938,
+			.framedrop_pattern        = 0x0000293C,
+			.mmu_prefetch_cfg         = 0x00002960,
+			.mmu_prefetch_max_offset  = 0x00002964,
+			.system_cache_cfg         = 0x00002968,
+			.addr_cfg                 = 0x00002970,
+			.addr_status_0            = 0x00002978,
+			.addr_status_1            = 0x0000297C,
+			.addr_status_2            = 0x00002980,
+			.addr_status_3            = 0x00002984,
+			.debug_status_cfg         = 0x00002988,
+			.debug_status_0           = 0x0000298C,
+			.debug_status_1           = 0x00002990,
+			.bw_limiter_addr          = 0x0000291C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_15,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 25,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid           = vfe880_out_port_mid[0],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				23,
+			},
+			.name          = {
+				"RDI_0",
+			},
+			.pid_mask      = 0x700,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid           = vfe880_out_port_mid[1],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				24,
+			},
+			.name          = {
+				"RDI_1",
+			},
+			.pid_mask      = 0x700,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = 16384,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.mid           = vfe880_out_port_mid[2],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				25,
+			},
+			.name          = {
+				"RDI_2",
+			},
+			.pid_mask      = 0x700,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+			.max_width     = 4928,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[3],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				0,
+				1,
+			},
+			.name          = {
+				"FULL_Y",
+				"FULL_C",
+			},
+			.pid_mask      = 0x70000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+			.max_width     = 1696,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[4],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"DS_4",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+			.max_width     = 424,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[5],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"DS_16",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+			.max_width     = 7296,
+			.max_height    = 16384,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[6],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				10,
+			},
+			.name          = {
+				"PIXEL_RAW",
+			},
+			.pid_mask      = 0x700,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FD,
+			.max_width     = 2304,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[7],
+			.num_mid       = 3,
+			.num_wm        = 2,
+			.wm_idx        = {
+				8,
+				9,
+			},
+			.name          = {
+				"FD_Y",
+				"FD_C",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+			.max_width     = 14592,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe880_out_port_mid[8],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				20,
+			},
+			.name          = {
+				"PDAF_0_2PD",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[9],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				13,
+			},
+			.name          = {
+				"STATS_TL_BG",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_CAF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[10],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				16,
+			},
+			.name          = {
+				"STATS_BF",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[11],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				14,
+			},
+			.name          = {
+				"STATS_AWB_BGB",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[12],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				12,
+			},
+			.name          = {
+				"STATS_BHIST",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BAYER_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[13],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				18,
+			},
+			.name          = {
+				"STATS_RS",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[14],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				19,
+			},
+			.name          = {
+				"STATS_IHIST",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+			.max_width     = 4928,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[15],
+			.num_mid       = 4,
+			.num_wm        = 2,
+			.wm_idx        = {
+				4,
+				5,
+			},
+			.name          = {
+				"FULL_DISP_Y",
+				"FULL_DISP_C",
+			},
+			.pid_mask      = 0x70000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+			.max_width     = 1232,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[16],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				6,
+			},
+			.name          = {
+				"DISP_DS_4",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+			.max_width     = 308,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[17],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				7,
+			},
+			.name          = {
+				"DISP_DS_16",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe880_out_port_mid[18],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				21,
+			},
+			.name          = {
+				"PDAF_1_PREPROCESS_2PD",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[19],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				15,
+			},
+			.name          = {
+				"AWB_BFW",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PDAF_PARSED,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe880_out_port_mid[20],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				22,
+			},
+			.name          = {
+				"PDAF_2_PARSED_DATA",
+			},
+			.pid_mask      = 0x7000000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[21],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				11,
+			},
+			.name          = {
+				"AEC_BE",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[22],
+			.num_mid       = 2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				26,
+			},
+			.name          = {
+				"LTM",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[23],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				17,
+			},
+			.name          = {
+				"GTM_BHIST",
+			},
+			.pid_mask      = 0x700000,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_ALSC,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe880_out_port_mid[24],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				27,
+			},
+			.name          = {
+				"STATS_ALSC",
+			},
+			.pid_mask      = 0x700000,
+		},
+	},
+
+	.num_cons_err = 29,
+	.constraint_error_list = {
+		{
+			.bitmask = BIT(0),
+			.error_description = "PPC 1x1 input Not Supported"
+		},
+		{
+			.bitmask = BIT(1),
+			.error_description = "PPC 1x2 input Not Supported"
+		},
+		{
+			.bitmask = BIT(2),
+			.error_description = "PPC 2x1 input Not Supported"
+		},
+		{
+			.bitmask = BIT(3),
+			.error_description = "PPC 2x2 input Not Supported"
+		},
+		{
+			.bitmask = BIT(4),
+			.error_description = "Pack 8 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(5),
+			.error_description = "Pack 16 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(6),
+			.error_description = "Pack 32 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(7),
+			.error_description = "Pack 64 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(8),
+			.error_description = "Pack MIPI 20 format Not Supported"
+		},
+		{
+			.bitmask = BIT(9),
+			.error_description = "Pack MIPI 14 format Not Supported"
+		},
+		{
+			.bitmask = BIT(10),
+			.error_description = "Pack MIPI 12 format Not Supported"
+		},
+		{
+			.bitmask = BIT(11),
+			.error_description = "Pack MIPI 10 format Not Supported"
+		},
+		{
+			.bitmask = BIT(12),
+			.error_description = "Pack 128 BPP format Not Supported"
+		},
+		{
+			.bitmask = BIT(13),
+			.error_description = "UBWC NV12 format Not Supported"
+		},
+		{
+			.bitmask = BIT(14),
+			.error_description = "UBWC NV12 4R format Not Supported"
+		},
+		{
+			.bitmask = BIT(15),
+			.error_description = "UBWC TP10 format Not Supported"
+		},
+		{
+			.bitmask = BIT(16),
+			.error_description = "Frame based Mode Not Supported"
+		},
+		{
+			.bitmask = BIT(17),
+			.error_description = "Index based Mode Not Supported"
+		},
+		{
+			.bitmask = BIT(18),
+			.error_description = "FIFO image addr unalign"
+		},
+		{
+			.bitmask = BIT(19),
+			.error_description = "FIFO ubwc addr unalign"
+		},
+		{
+			.bitmask = BIT(20),
+			.error_description = "FIFO framehdr addr unalign"
+		},
+		{
+			.bitmask = BIT(21),
+			.error_description = "Image address unalign"
+		},
+		{
+			.bitmask = BIT(22),
+			.error_description = "UBWC address unalign"
+		},
+		{
+			.bitmask = BIT(23),
+			.error_description = "Frame Header address unalign"
+		},
+		{
+			.bitmask = BIT(24),
+			.error_description = "Stride unalign"
+		},
+		{
+			.bitmask = BIT(25),
+			.error_description = "X Initialization unalign"
+		},
+		{
+			.bitmask = BIT(26),
+			.error_description = "Image Width unalign"
+		},
+		{
+			.bitmask = BIT(27),
+			.error_description = "Image Height unalign"
+		},
+		{
+			.bitmask = BIT(28),
+			.error_description = "Meta Stride unalign"
+		},
+	},
+	.num_bus_errors_0      = ARRAY_SIZE(vfe880_bus_irq_err_desc_0),
+	.num_bus_errors_1      = ARRAY_SIZE(vfe880_bus_irq_err_desc_1),
+	.bus_err_desc_0        = vfe880_bus_irq_err_desc_0,
+	.bus_err_desc_1        = vfe880_bus_irq_err_desc_1,
+	.num_comp_grp          = 16,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3), BIT(4),
+		BIT(5), BIT(6), BIT(7), BIT(8),
+		BIT(9), BIT(10), BIT(13),
+		BIT(14), BIT(15), BIT(16), BIT(11),
+	},
+	.top_irq_shift         = 0,
+	.max_out_res           = CAM_ISP_IFE_OUT_RES_BASE + 37,
+	.pack_align_shift      = 5,
+	.max_bw_counter_limit  = 0xFF,
+};
+
+static struct cam_vfe_irq_hw_info vfe880_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_EXT_CSID,
+	.top_irq_reg   = &vfe880_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe880_hw_info = {
+	.irq_hw_info                  = &vfe880_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe880_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe880_top_hw_info,
+};
+
+#endif /* _CAM_VFE880_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite17x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite17x.h
@@ -0,0 +1,359 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_LITE17X_H_
+#define _CAM_VFE_LITE17X_H_
+
+#include "cam_vfe_bus_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe17x_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe17x_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe17x_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000058,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe17x_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		NULL,
+		NULL,
+		NULL,
+		NULL,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000000,
+	.three_D_cfg              = 0x00000000,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe17x_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_common_reg_data vfe17x_rdi_reg_data = {
+	.subscribe_irq_mask0      = 0x780001E0,
+	.subscribe_irq_mask1      = 0x0,
+	.error_irq_mask0          = 0x0,
+	.error_irq_mask1          = 0x3C,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe17x_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe17x_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe17x_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe17x_rdi_3_data = {
+	.reg_update_cmd_data      = 0x10,
+	.sof_irq_mask             = 0x40000000,
+	.reg_update_irq_mask      = 0x100,
+};
+
+static struct cam_vfe_rdi_overflow_status vfe17x_rdi_irq_status = {
+	.rdi0_overflow_mask = 0x8,
+	.rdi1_overflow_mask = 0x10,
+	.rdi2_overflow_mask = 0x18,
+	.rdi3_overflow_mask = 0x20,
+	.rdi_overflow_mask  = 0x3c,
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe17x_top_hw_info = {
+	.common_reg = &vfe17x_top_common_reg,
+	.camif_hw_info = {
+		.common_reg = NULL,
+		.camif_reg  = NULL,
+		.reg_data   = NULL,
+		},
+	.rdi_hw_info = {
+		.common_reg = &vfe17x_top_common_reg,
+		.rdi_reg    = &vfe17x_rdi_reg,
+		.common_reg_data = &vfe17x_rdi_reg_data,
+		.reg_data = {
+			&vfe17x_rdi_0_data,
+			&vfe17x_rdi_1_data,
+			&vfe17x_rdi_2_data,
+			&vfe17x_rdi_3_data,
+			},
+		.rdi_irq_status  = &vfe17x_rdi_irq_status,
+		},
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set vfe17x_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe17x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers         = 3,
+			.irq_reg_set           = vfe17x_bus_irq_reg,
+			.global_irq_cmd_offset = 0x00002068,
+			.global_clear_bitmask  = 0x00000001,
+			.clear_all_bitmask     = 0xFFFFFFFF,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 4,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 4,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 23,
+};
+
+static struct cam_vfe_irq_hw_info vfe17x_irq_hw_info = {
+	.reset_mask    = BIT(31),
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_LITE_INT_CSID,
+	.top_irq_reg   = &vfe17x_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite17x_hw_info = {
+	.irq_hw_info                  = &vfe17x_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe17x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe17x_top_hw_info,
+
+};
+
+#endif /* _CAM_VFE_LITE17X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite48x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite48x.h
@@ -0,0 +1,469 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_LITE48x_H_
+#define _CAM_VFE_LITE48x_H_
+
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe48x_top_irq_reg_set[3] = {
+	{
+		.mask_reg_offset   = 0x00000028,
+		.clear_reg_offset  = 0x00000034,
+		.status_reg_offset = 0x00000040,
+	},
+	{
+		.mask_reg_offset   = 0x0000002C,
+		.clear_reg_offset  = 0x00000038,
+		.status_reg_offset = 0x00000044,
+	},
+	{
+		.mask_reg_offset   = 0x00000030,
+		.clear_reg_offset  = 0x0000003C,
+		.status_reg_offset = 0x00000048,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe48x_top_irq_reg_info = {
+	.num_registers = 3,
+	.irq_reg_set = vfe48x_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00000024,
+	.global_clear_bitmask  = 0x00000001,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static struct cam_vfe_top_ver3_reg_offset_common vfe48x_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.titan_version            = 0x00000004,
+	.hw_capability            = 0x00000008,
+	.global_reset_cmd         = 0x0000000C,
+	.core_cgc_ovd_0           = 0x00000010,
+	.ahb_cgc_ovd              = 0x00000014,
+	.noc_cgc_ovd              = 0x00000018,
+	.reg_update_cmd           = 0x00000020,
+	.diag_config              = 0x00000050,
+	.diag_sensor_status_0     = 0x00000054,
+	.bus_overflow_status      = 0x00001A68,
+	.top_debug_cfg            = 0x00000074,
+	.top_debug_0              = 0x0000005C,
+	.top_debug_1              = 0x00000068,
+	.top_debug_2              = 0x0000006C,
+	.top_debug_3              = 0x00000070,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg vfe48x_camif_rdi[4] = {
+	{
+		.lite_hw_version            = 0x1200,
+		.lite_hw_status             = 0x1204,
+		.lite_module_config         = 0x1260,
+		.lite_skip_period           = 0x1268,
+		.lite_irq_subsample_pattern = 0x126C,
+		.lite_epoch_irq             = 0x1270,
+		.lite_debug_1               = 0x13F0,
+		.lite_debug_0               = 0x13F4,
+		.lite_test_bus_ctrl         = 0x13F8,
+		.camif_lite_spare           = 0x13FC,
+		.reg_update_cmd             = 0x0020,
+	},
+	{
+		.lite_hw_version            = 0x1400,
+		.lite_hw_status             = 0x1404,
+		.lite_module_config         = 0x1460,
+		.lite_skip_period           = 0x1468,
+		.lite_irq_subsample_pattern = 0x146C,
+		.lite_epoch_irq             = 0x1470,
+		.lite_debug_1               = 0x15F0,
+		.lite_debug_0               = 0x15F4,
+		.lite_test_bus_ctrl         = 0x15F8,
+		.camif_lite_spare           = 0x15FC,
+		.reg_update_cmd             = 0x0020,
+	},
+	{
+		.lite_hw_version            = 0x1600,
+		.lite_hw_status             = 0x1604,
+		.lite_module_config         = 0x1660,
+		.lite_skip_period           = 0x1668,
+		.lite_irq_subsample_pattern = 0x166C,
+		.lite_epoch_irq             = 0x1670,
+		.lite_debug_1               = 0x17F0,
+		.lite_debug_0               = 0x17F4,
+		.lite_test_bus_ctrl         = 0x17F8,
+		.camif_lite_spare           = 0x17FC,
+		.reg_update_cmd             = 0x0020,
+	},
+	{
+		.lite_hw_version            = 0x1800,
+		.lite_hw_status             = 0x1804,
+		.lite_module_config         = 0x1860,
+		.lite_skip_period           = 0x1868,
+		.lite_irq_subsample_pattern = 0x186C,
+		.lite_epoch_irq             = 0x1870,
+		.lite_debug_1               = 0x19F0,
+		.lite_debug_0               = 0x19F4,
+		.lite_test_bus_ctrl         = 0x19F8,
+		.camif_lite_spare           = 0x19FC,
+		.reg_update_cmd             = 0x0020,
+	},
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe48x_camif_rdi_reg_data[4] = {
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x1,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x1,
+		.epoch0_irq_mask                 = 0x4,
+		.epoch1_irq_mask                 = 0x8,
+		.eof_irq_mask                    = 0x02,
+		.error_irq_mask0                 = 0x1,
+		.error_irq_mask2                 = 0x100,
+		.subscribe_irq_mask1             = 0x3,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x2,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x10,
+		.epoch0_irq_mask                 = 0x40,
+		.epoch1_irq_mask                 = 0x80,
+		.eof_irq_mask                    = 0x20,
+		.error_irq_mask0                 = 0x2,
+		.error_irq_mask2                 = 0x200,
+		.subscribe_irq_mask1             = 0x30,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x4,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x100,
+		.epoch0_irq_mask                 = 0x400,
+		.epoch1_irq_mask                 = 0x800,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask0                 = 0x4,
+		.error_irq_mask2                 = 0x400,
+		.subscribe_irq_mask1             = 0x300,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x8,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x1000,
+		.epoch0_irq_mask                 = 0x4000,
+		.epoch1_irq_mask                 = 0x8000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask0                 = 0x8,
+		.error_irq_mask2                 = 0x800,
+		.subscribe_irq_mask1             = 0x3000,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x1,
+	},
+};
+
+static struct cam_vfe_camif_lite_ver3_hw_info
+	vfe48x_rdi_hw_info[CAM_VFE_RDI_VER2_MAX] = {
+	{
+		.common_reg     = &vfe48x_top_common_reg,
+		.camif_lite_reg = &vfe48x_camif_rdi[0],
+		.reg_data       = &vfe48x_camif_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe48x_top_common_reg,
+		.camif_lite_reg = &vfe48x_camif_rdi[1],
+		.reg_data       = &vfe48x_camif_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe48x_top_common_reg,
+		.camif_lite_reg = &vfe48x_camif_rdi[2],
+		.reg_data       = &vfe48x_camif_rdi_reg_data[2],
+	},
+	{
+		.common_reg     = &vfe48x_top_common_reg,
+		.camif_lite_reg = &vfe48x_camif_rdi[3],
+		.reg_data       = &vfe48x_camif_rdi_reg_data[3],
+	},
+};
+
+static struct cam_vfe_top_ver3_hw_info vfe48x_top_hw_info = {
+	.common_reg = &vfe48x_top_common_reg,
+	.rdi_hw_info[0] = &vfe48x_rdi_hw_info[0],
+	.rdi_hw_info[1] = &vfe48x_rdi_hw_info[1],
+	.rdi_hw_info[2] = &vfe48x_rdi_hw_info[2],
+	.rdi_hw_info[3] = &vfe48x_rdi_hw_info[3],
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set vfe48x_bus_irq_reg[2] = {
+	{
+		.mask_reg_offset   = 0x00001A18,
+		.clear_reg_offset  = 0x00001A20,
+		.status_reg_offset = 0x00001A28,
+	},
+	{
+		.mask_reg_offset   = 0x00001A1C,
+		.clear_reg_offset  = 0x00001A24,
+		.status_reg_offset = 0x00001A2C,
+	},
+};
+
+static uint32_t vfe48x_out_port_mid[][4] = {
+	{16, 0, 0, 0},
+	{17, 0, 0, 0},
+	{18, 0, 0, 0},
+	{19, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe48x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00001A00,
+		.cgc_ovd                          = 0x00001A08,
+		.if_frameheader_cfg               = {
+			0x00001A34,
+			0x00001A38,
+			0x00001A3C,
+			0x00001A40,
+		},
+		.pwr_iso_cfg                      = 0x00001A5C,
+		.overflow_status_clear            = 0x00001A60,
+		.ccif_violation_status            = 0x00001A64,
+		.overflow_status                  = 0x00001A68,
+		.image_size_violation_status      = 0x00001A70,
+		.debug_status_top_cfg             = 0x00001AD4,
+		.debug_status_top                 = 0x00001AD8,
+		.test_bus_ctrl                    = 0x00001ADC,
+		.top_irq_mask_0                   = 0x00000028,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe48x_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00001A30,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = 4,
+	.bus_client_reg = {
+		/* RDI 0 */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.line_done_cfg            = 0x00001C2C,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.framedrop_period         = 0x00001C38,
+			.framedrop_pattern        = 0x00001C3C,
+			.system_cache_cfg         = 0x00001C60,
+			.burst_limit              = 0x00001C64,
+			.addr_status_0            = 0x00001C68,
+			.addr_status_1            = 0x00001C6C,
+			.addr_status_2            = 0x00001C70,
+			.addr_status_3            = 0x00001C74,
+			.debug_status_cfg         = 0x00001C78,
+			.debug_status_0           = 0x00001C7C,
+			.debug_status_1           = 0x00001C80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* RDI 1 */
+		{
+			.cfg                      = 0x00001D00,
+			.image_addr               = 0x00001D04,
+			.frame_incr               = 0x00001D08,
+			.image_cfg_0              = 0x00001D0C,
+			.image_cfg_1              = 0x00001D10,
+			.image_cfg_2              = 0x00001D14,
+			.packer_cfg               = 0x00001D18,
+			.frame_header_addr        = 0x00001D20,
+			.frame_header_incr        = 0x00001D24,
+			.frame_header_cfg         = 0x00001D28,
+			.line_done_cfg            = 0x00001D2C,
+			.irq_subsample_period     = 0x00001D30,
+			.irq_subsample_pattern    = 0x00001D34,
+			.framedrop_period         = 0x00001D38,
+			.framedrop_pattern        = 0x00001D3C,
+			.system_cache_cfg         = 0x00001D60,
+			.burst_limit              = 0x00001D64,
+			.addr_status_0            = 0x00001D68,
+			.addr_status_1            = 0x00001D6C,
+			.addr_status_2            = 0x00001D70,
+			.addr_status_3            = 0x00001D74,
+			.debug_status_cfg         = 0x00001D78,
+			.debug_status_0           = 0x00001D7C,
+			.debug_status_1           = 0x00001D80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* RDI 2 */
+		{
+			.cfg                      = 0x00001E00,
+			.image_addr               = 0x00001E04,
+			.frame_incr               = 0x00001E08,
+			.image_cfg_0              = 0x00001E0C,
+			.image_cfg_1              = 0x00001E10,
+			.image_cfg_2              = 0x00001E14,
+			.packer_cfg               = 0x00001E18,
+			.frame_header_addr        = 0x00001E20,
+			.frame_header_incr        = 0x00001E24,
+			.frame_header_cfg         = 0x00001E28,
+			.line_done_cfg            = 0x00001E2C,
+			.irq_subsample_period     = 0x00001E30,
+			.irq_subsample_pattern    = 0x00001E34,
+			.framedrop_period         = 0x00001E38,
+			.framedrop_pattern        = 0x00001E3C,
+			.system_cache_cfg         = 0x00001E60,
+			.burst_limit              = 0x00001E64,
+			.addr_status_0            = 0x00001E68,
+			.addr_status_1            = 0x00001E6C,
+			.addr_status_2            = 0x00001E70,
+			.addr_status_3            = 0x00001E74,
+			.debug_status_cfg         = 0x00001E78,
+			.debug_status_0           = 0x00001E7C,
+			.debug_status_1           = 0x00001E80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* RDI 3 */
+		{
+			.cfg                      = 0x00001F00,
+			.image_addr               = 0x00001F04,
+			.frame_incr               = 0x00001F08,
+			.image_cfg_0              = 0x00001F0C,
+			.image_cfg_1              = 0x00001F10,
+			.image_cfg_2              = 0x00001F14,
+			.packer_cfg               = 0x00001F18,
+			.frame_header_addr        = 0x00001F20,
+			.frame_header_incr        = 0x00001F24,
+			.frame_header_cfg         = 0x00001F28,
+			.line_done_cfg            = 0x00001F2C,
+			.irq_subsample_period     = 0x00001F30,
+			.irq_subsample_pattern    = 0x00001F34,
+			.framedrop_period         = 0x00001F38,
+			.framedrop_pattern        = 0x00001F3C,
+			.system_cache_cfg         = 0x00001F60,
+			.burst_limit              = 0x00001F64,
+			.addr_status_0            = 0x00001F68,
+			.addr_status_1            = 0x00001F6C,
+			.addr_status_2            = 0x00001F70,
+			.addr_status_3            = 0x00001F74,
+			.debug_status_cfg         = 0x00001F78,
+			.debug_status_0           = 0x00001F7C,
+			.debug_status_1           = 0x00001F80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 4,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid           = vfe48x_out_port_mid[0],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				0,
+			},
+			.name          = {
+				"LITE_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid           = vfe48x_out_port_mid[1],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				1,
+			},
+			.name          = {
+				"LITE_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid           = vfe48x_out_port_mid[2],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"LITE_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid           = vfe48x_out_port_mid[3],
+			.num_mid       = 1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"LITE_3",
+			},
+		},
+	},
+	.num_comp_grp    = 4,
+	.comp_done_mask = {
+		BIT(4), BIT(5), BIT(6), BIT(7),
+	},
+	.top_irq_shift   = 4,
+	.support_consumed_addr = true,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 25,
+	.supported_irq =  CAM_VFE_HW_IRQ_CAP_BUF_DONE | CAM_VFE_HW_IRQ_CAP_RUP,
+	.comp_cfg_needed = true,
+};
+
+static struct cam_vfe_irq_hw_info vfe48x_irq_hw_info = {
+	.reset_mask    = BIT(17),
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_LITE_INT_CSID,
+	.top_irq_reg       = &vfe48x_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite48x_hw_info = {
+	.irq_hw_info                  = &vfe48x_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe48x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_3_0,
+	.top_hw_info                   = &vfe48x_top_hw_info,
+
+};
+
+#endif /* _CAM_VFE_LITE48x_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite68x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite68x.h
@@ -0,0 +1,595 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.​
+ */
+
+
+#ifndef _CAM_VFE_LITE68X_H_
+#define _CAM_VFE_LITE68X_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_68X_NUM_DBG_REG 5
+
+static struct cam_vfe_top_ver4_module_desc vfe68x_ipp_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CLC_BLS",
+	},
+	{
+		.id = 1,
+		.desc = "CLC_GLUT",
+	},
+	{
+		.id = 2,
+		.desc = "CLC_STATS_BG",
+	},
+};
+
+static struct cam_vfe_top_ver4_wr_client_desc vfe680x_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "RDI_0",
+	},
+	{
+		.wm_id = 1,
+		.desc = "RDI_1",
+	},
+	{
+		.wm_id = 2,
+		.desc = "RDI_2",
+	},
+	{
+		.wm_id = 3,
+		.desc = "RDI_3",
+	},
+	{
+		.wm_id = 4,
+		.desc = "GAMMA",
+	},
+	{
+		.wm_id = 5,
+		.desc = "BE",
+	},
+};
+
+static struct cam_irq_register_set vfe68x_top_irq_reg_set[3] = {
+	{
+		.mask_reg_offset   = 0x00001024,
+		.clear_reg_offset  = 0x0000102C,
+		.status_reg_offset = 0x0000101C,
+		.set_reg_offset    = 0x00001034,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x00001028,
+		.clear_reg_offset  = 0x00001030,
+		.status_reg_offset = 0x00001020,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe68x_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe68x_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00001038,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe68x_top_debug_reg[] = {
+	0x0000105C,
+	0x00001060,
+	0x00001064,
+	0x00001068,
+	0x0000106C,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe68x_top_common_reg = {
+	.hw_version               = 0x00001000,
+	.hw_capability            = 0x00001004,
+	.core_cgc_ovd_0           = 0x00001014,
+	.ahb_cgc_ovd              = 0x00001018,
+	.core_cfg_0               = 0x0000103C,
+	.diag_config              = 0x00001040,
+	.diag_sensor_status_0     = 0x00001044,
+	.diag_sensor_status_1     = 0x00001048,
+	.ipp_violation_status     = 0x00001054,
+	.bus_violation_status     = 0x00001264,
+	.bus_overflow_status      = 0x00001268,
+	.top_debug_cfg            = 0x00001074,
+	.num_top_debug_reg        = CAM_VFE_68X_NUM_DBG_REG,
+	.top_debug                = vfe68x_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe68x_ipp_reg_data =
+{
+	.sof_irq_mask                    = 0x1,
+	.eof_irq_mask                    = 0x2,
+	.error_irq_mask                  = 0x2,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 0x3,
+	.ipp_violation_mask              = 0x10,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe68x_rdi_reg_data[4] = {
+
+	{
+		.sof_irq_mask                    = 0x4,
+		.eof_irq_mask                    = 0x8,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x10,
+		.eof_irq_mask                    = 0x20,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x40,
+		.eof_irq_mask                    = 0x80,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+};
+
+static struct cam_vfe_ver4_path_hw_info
+	vfe68x_rdi_hw_info[] = {
+	{
+		.common_reg     = &vfe68x_top_common_reg,
+		.reg_data       = &vfe68x_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe68x_top_common_reg,
+		.reg_data       = &vfe68x_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe68x_top_common_reg,
+		.reg_data       = &vfe68x_rdi_reg_data[2],
+	},
+	{
+		.common_reg     = &vfe68x_top_common_reg,
+		.reg_data       = &vfe68x_rdi_reg_data[3],
+	},
+};
+
+static struct cam_vfe_top_ver4_debug_reg_info vfe68x_dbg_reg_info[CAM_VFE_68X_NUM_DBG_REG][8] = {
+	VFE_DBG_INFO_ARRAY_4bit(
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	{
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+	},
+	VFE_DBG_INFO_ARRAY_4bit(
+		"PP_THROTTLE",
+		"STATS_BG_THROTTLE",
+		"STATS_BG",
+		"BLS",
+		"GLUT",
+		"unused",
+		"unused",
+		"unused"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"RDI_0",
+		"RDI_1",
+		"RDI_2",
+		"RDI_3",
+		"PP_STATS_BG",
+		"PP_GLUT",
+		"PP_STATS_BG",
+		"PP_GLUT"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused"
+	),
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe68x_top_hw_info = {
+	.common_reg = &vfe68x_top_common_reg,
+	.rdi_hw_info =   vfe68x_rdi_hw_info,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe68x_top_common_reg,
+		.reg_data       = &vfe68x_ipp_reg_data,
+	},
+	.ipp_module_desc        = vfe68x_ipp_mod_desc,
+	.wr_client_desc         = vfe680x_wr_client_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.num_rdi        = ARRAY_SIZE(vfe68x_rdi_hw_info),
+	.debug_reg_info = &vfe68x_dbg_reg_info,
+};
+
+static struct cam_irq_register_set vfe680x_bus_irq_reg[2] = {
+		{
+			.mask_reg_offset   = 0x00001218,
+			.clear_reg_offset  = 0x00001220,
+			.status_reg_offset = 0x00001228,
+		},
+		{
+			.mask_reg_offset   = 0x0000121C,
+			.clear_reg_offset  = 0x00001224,
+			.status_reg_offset = 0x0000122C,
+		},
+};
+
+static uint32_t vfe680x_out_port_mid[][4] = {
+	{8, 0, 0, 0},
+	{9, 0, 0, 0},
+	{10, 0, 0, 0},
+	{11, 0, 0, 0},
+	{12, 0, 0, 0},
+	{13, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe680x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00001200,
+		.cgc_ovd                          = 0x00001208,
+		.if_frameheader_cfg               = {
+			0x00001234,
+			0x00001238,
+			0x0000123C,
+			0x00001240,
+			0x00001244,
+		},
+		.pwr_iso_cfg                      = 0x0000125C,
+		.overflow_status_clear            = 0x00001260,
+		.ccif_violation_status            = 0x00001264,
+		.overflow_status                  = 0x00001268,
+		.image_size_violation_status      = 0x00001270,
+		.debug_status_top_cfg             = 0x000012D4,
+		.debug_status_top                 = 0x000012D8,
+		.test_bus_ctrl                    = 0x000012DC,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe680x_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00001230,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = 6,
+	.bus_client_reg = {
+		/* BUS Client 0 RDI0 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_status_0            = 0x00001470,
+			.addr_status_1            = 0x00001474,
+			.addr_status_2            = 0x00001478,
+			.addr_status_3            = 0x0000147C,
+			.debug_status_cfg         = 0x00001480,
+			.debug_status_0           = 0x00001484,
+			.debug_status_1           = 0x00001488,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 RDI1 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_status_0            = 0x00001570,
+			.addr_status_1            = 0x00001574,
+			.addr_status_2            = 0x00001578,
+			.addr_status_3            = 0x0000157C,
+			.debug_status_cfg         = 0x00001580,
+			.debug_status_0           = 0x00001584,
+			.debug_status_1           = 0x00001588,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 RDI2 */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_status_0            = 0x00001670,
+			.addr_status_1            = 0x00001674,
+			.addr_status_2            = 0x00001678,
+			.addr_status_3            = 0x0000167C,
+			.debug_status_cfg         = 0x00001680,
+			.debug_status_0           = 0x00001684,
+			.debug_status_1           = 0x00001688,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 RDI3 */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.frame_header_addr        = 0x00001720,
+			.frame_header_incr        = 0x00001724,
+			.frame_header_cfg         = 0x00001728,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_status_0            = 0x00001770,
+			.addr_status_1            = 0x00001774,
+			.addr_status_2            = 0x00001778,
+			.addr_status_3            = 0x0000177C,
+			.debug_status_cfg         = 0x00001780,
+			.debug_status_0           = 0x00001784,
+			.debug_status_1           = 0x00001788,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 Gamma */
+		{
+			.cfg			  = 0x00001800,
+			.image_addr		  = 0x00001804,
+			.frame_incr		  = 0x00001808,
+			.image_cfg_0		  = 0x0000180C,
+			.image_cfg_1		  = 0x00001810,
+			.image_cfg_2		  = 0x00001814,
+			.packer_cfg		  = 0x00001818,
+			.frame_header_addr	  = 0x00001820,
+			.frame_header_incr	  = 0x00001824,
+			.frame_header_cfg	  = 0x00001828,
+			.irq_subsample_period	  = 0x00001830,
+			.irq_subsample_pattern	  = 0x00001834,
+			.framedrop_period	  = 0x00001838,
+			.framedrop_pattern	  = 0x0000183C,
+			.mmu_prefetch_cfg	  = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg	  = 0x00001868,
+			.addr_status_0		  = 0x00001870,
+			.addr_status_1		  = 0x00001874,
+			.addr_status_2		  = 0x00001878,
+			.addr_status_3		  = 0x0000187C,
+			.debug_status_cfg	  = 0x00001880,
+			.debug_status_0		  = 0x00001884,
+			.debug_status_1		  = 0x00001888,
+			.comp_group		  = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs		  = NULL,
+		},
+		/* BUS Client 5 Stats BE */
+		{
+			.cfg			  = 0x00001900,
+			.image_addr		  = 0x00001904,
+			.frame_incr		  = 0x00001908,
+			.image_cfg_0		  = 0x0000190C,
+			.image_cfg_1		  = 0x00001910,
+			.image_cfg_2		  = 0x00001914,
+			.packer_cfg		  = 0x00001918,
+			.frame_header_addr	  = 0x00001920,
+			.frame_header_incr	  = 0x00001924,
+			.frame_header_cfg	  = 0x00001928,
+			.irq_subsample_period	  = 0x00001930,
+			.irq_subsample_pattern	  = 0x00001934,
+			.framedrop_period	  = 0x00001938,
+			.framedrop_pattern	  = 0x0000193C,
+			.mmu_prefetch_cfg	  = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg	  = 0x00001968,
+			.addr_status_0		  = 0x00001970,
+			.addr_status_1		  = 0x00001974,
+			.addr_status_2		  = 0x00001978,
+			.addr_status_3		  = 0x0000197C,
+			.debug_status_cfg	  = 0x00001980,
+			.debug_status_0		  = 0x00001984,
+			.debug_status_1		  = 0x00001988,
+			.comp_group		  = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs		  = NULL,
+		},
+	},
+	.num_out = 6,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.num_wm        = 1,
+			.mid           = vfe680x_out_port_mid[0],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				0,
+			},
+			.name          = {
+				"LITE_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.num_wm        = 1,
+			.mid           = vfe680x_out_port_mid[1],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				1,
+			},
+			.name          = {
+				"LITE_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.num_wm        = 1,
+			.mid           = vfe680x_out_port_mid[2],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"LITE_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.num_wm        = 1,
+			.mid           = vfe680x_out_port_mid[3],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"LITE_3",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_RAW,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.mid           = vfe680x_out_port_mid[4],
+			.num_mid       = 1,
+			.wm_idx        = {
+				4,
+			},
+			.name          = {
+				"PREPROCESS_RAW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.mid           = vfe680x_out_port_mid[5],
+			.num_mid       = 1,
+			.wm_idx        = {
+				5,
+			},
+			.name          = {
+				"STATS_BG",
+			},
+		},
+	},
+	.num_comp_grp    = 5,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3), BIT(4),
+	},
+	.top_irq_shift   = 0,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 33,
+};
+
+static struct cam_vfe_irq_hw_info vfe68x_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_LITE_EXT_CSID,
+	.top_irq_reg   = &vfe68x_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite68x_hw_info = {
+	.irq_hw_info                   = &vfe68x_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe680x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe68x_top_hw_info,
+};
+
+#endif /* _CAM_VFE_LITE68X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite69x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite69x.h
@@ -0,0 +1,561 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_LITE69X_H_
+#define _CAM_VFE_LITE69X_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_69X_NUM_DBG_REG 4
+
+/* Offsets might not match due to csid secure regs at beginning of reg space */
+
+static struct cam_vfe_top_ver4_wr_client_desc vfe690x_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "RDI_0",
+	},
+	{
+		.wm_id = 1,
+		.desc = "RDI_1",
+	},
+	{
+		.wm_id = 2,
+		.desc = "RDI_2",
+	},
+	{
+		.wm_id = 3,
+		.desc = "RDI_3",
+	},
+	{
+		.wm_id = 4,
+		.desc = "RDI_4",
+	},
+	{
+		.wm_id = 5,
+		.desc = "RDI_5",
+	},
+};
+
+static struct cam_irq_register_set vfe69x_top_irq_reg_set[3] = {
+	{
+		.mask_reg_offset   = 0x00001068,
+		.clear_reg_offset  = 0x00001070,
+		.status_reg_offset = 0x00001078,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x0000106C,
+		.clear_reg_offset  = 0x00001074,
+		.status_reg_offset = 0x0000107C,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe69x_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe69x_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00001064,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe69x_top_debug_reg[] = {
+	0x000010E4,
+	0x000010E8,
+	0x000010EC,
+	0x000010F0,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe69x_top_common_reg = {
+	.hw_version               = 0x00001000,
+	.hw_capability            = 0x00001004,
+	.diag_config              = 0x00001010,
+	.diag_sensor_status_0     = 0x00001014,
+	.diag_sensor_status_1     = 0x00001018,
+	.bus_violation_status     = 0x000014E4,
+	.bus_overflow_status      = 0x000014E8,
+	.top_debug_cfg            = 0x000010FC,
+	.num_top_debug_reg        = CAM_VFE_69X_NUM_DBG_REG,
+	.top_debug                = vfe69x_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe69x_rdi_reg_data[6] = {
+
+	{
+		.sof_irq_mask                    = 0x1,
+		.eof_irq_mask                    = 0x2,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x4,
+		.eof_irq_mask                    = 0x8,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x10,
+		.eof_irq_mask                    = 0x20,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x40,
+		.eof_irq_mask                    = 0x80,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x400,
+		.eof_irq_mask                    = 0x800,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+};
+
+static struct cam_vfe_ver4_path_hw_info
+	vfe69x_rdi_hw_info[] = {
+	{
+		.common_reg     = &vfe69x_top_common_reg,
+		.reg_data       = &vfe69x_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe69x_top_common_reg,
+		.reg_data       = &vfe69x_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe69x_top_common_reg,
+		.reg_data       = &vfe69x_rdi_reg_data[2],
+	},
+	{
+		.common_reg     = &vfe69x_top_common_reg,
+		.reg_data       = &vfe69x_rdi_reg_data[3],
+	},
+	{
+		.common_reg     = &vfe69x_top_common_reg,
+		.reg_data       = &vfe69x_rdi_reg_data[4],
+	},
+	{
+		.common_reg     = &vfe69x_top_common_reg,
+		.reg_data       = &vfe69x_rdi_reg_data[5],
+	},
+};
+
+static struct cam_vfe_top_ver4_debug_reg_info vfe69x_dbg_reg_info[CAM_VFE_69X_NUM_DBG_REG][8] = {
+	VFE_DBG_INFO_ARRAY_4bit(
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	{
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+	},
+	VFE_DBG_INFO_ARRAY_4bit(
+		"csid_ccif_rdi0_vld_out",
+		"csid_ccif_rdi1_vld_out",
+		"csid_ccif_rdi3_vld_out",
+		"csid_ccif_rdi4_vld_out",
+		"csid_ccif_rdi5_vld_out",
+		"unused",
+		"unused",
+		"unused"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused"
+	),
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe69x_top_hw_info = {
+	.common_reg = &vfe69x_top_common_reg,
+	.rdi_hw_info =   vfe69x_rdi_hw_info,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe69x_top_common_reg,
+	},
+	.wr_client_desc         = vfe690x_wr_client_desc,
+	.num_mux = 7,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.num_rdi        = ARRAY_SIZE(vfe69x_rdi_hw_info),
+	.debug_reg_info = &vfe69x_dbg_reg_info,
+};
+
+static struct cam_irq_register_set vfe690x_bus_irq_reg[1] = {
+		{
+			.mask_reg_offset   = 0x00001498,
+			.clear_reg_offset  = 0x000014A0,
+			.status_reg_offset = 0x000014A8,
+		},
+};
+
+static uint32_t vfe690x_out_port_mid[][4] = {
+	{16, 0, 0, 0},
+	{17, 0, 0, 0},
+	{18, 0, 0, 0},
+	{19, 0, 0, 0},
+	{20, 0, 0, 0},
+	{21, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe690x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00001400,
+		.cgc_ovd                          = 0x00001408,
+		.if_frameheader_cfg               = {
+			0x000014B4,
+			0x000014B8,
+			0x000014BC,
+			0x000014C0,
+			0x000014C4,
+			0x000014C8,
+		},
+		.pwr_iso_cfg                      = 0x000014DC,
+		.overflow_status_clear            = 0x000014E0,
+		.ccif_violation_status            = 0x000014E4,
+		.overflow_status                  = 0x000014E8,
+		.image_size_violation_status      = 0x000014F0,
+		.debug_status_top_cfg             = 0x00001570,
+		.debug_status_top                 = 0x00001574,
+		.test_bus_ctrl                    = 0x0000157C,
+		.irq_reg_info = {
+			.num_registers            = 1,
+			.irq_reg_set              = vfe680x_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x000014B0,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = 6,
+	.bus_client_reg = {
+		/* BUS Client 0 RDI0 */
+		{
+			.cfg                      = 0x00001680,
+			.image_addr               = 0x00001684,
+			.frame_incr               = 0x00001688,
+			.image_cfg_0              = 0x0000168C,
+			.image_cfg_1              = 0x00001690,
+			.image_cfg_2              = 0x00001694,
+			.packer_cfg               = 0x00001698,
+			.frame_header_addr        = 0x000016A0,
+			.frame_header_incr        = 0x000016A4,
+			.frame_header_cfg         = 0x000016A8,
+			.irq_subsample_period     = 0x000016B0,
+			.irq_subsample_pattern    = 0x000016B4,
+			.mmu_prefetch_cfg         = 0x000016E0,
+			.mmu_prefetch_max_offset  = 0x000016E4,
+			.system_cache_cfg         = 0x000016E8,
+			.addr_status_0            = 0x000016F0,
+			.addr_status_1            = 0x000016F4,
+			.addr_status_2            = 0x000016F8,
+			.addr_status_3            = 0x000016FC,
+			.debug_status_cfg         = 0x00001700,
+			.debug_status_0           = 0x00001704,
+			.debug_status_1           = 0x00001708,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 RDI1 */
+		{
+			.cfg                      = 0x00001780,
+			.image_addr               = 0x00001784,
+			.frame_incr               = 0x00001788,
+			.image_cfg_0              = 0x0000178C,
+			.image_cfg_1              = 0x00001790,
+			.image_cfg_2              = 0x00001794,
+			.packer_cfg               = 0x00001798,
+			.frame_header_addr        = 0x000017A0,
+			.frame_header_incr        = 0x000017A4,
+			.frame_header_cfg         = 0x000017A8,
+			.irq_subsample_period     = 0x000017B0,
+			.irq_subsample_pattern    = 0x000017B4,
+			.mmu_prefetch_cfg         = 0x000017E0,
+			.mmu_prefetch_max_offset  = 0x000017E4,
+			.system_cache_cfg         = 0x000017E8,
+			.addr_status_0            = 0x000017F0,
+			.addr_status_1            = 0x000017F4,
+			.addr_status_2            = 0x000017F8,
+			.addr_status_3            = 0x000017FC,
+			.debug_status_cfg         = 0x00001800,
+			.debug_status_0           = 0x00001804,
+			.debug_status_1           = 0x00001808,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 RDI2 */
+		{
+			.cfg                      = 0x00001880,
+			.image_addr               = 0x00001884,
+			.frame_incr               = 0x00001888,
+			.image_cfg_0              = 0x0000188C,
+			.image_cfg_1              = 0x00001890,
+			.image_cfg_2              = 0x00001894,
+			.packer_cfg               = 0x00001898,
+			.frame_header_addr        = 0x000018A0,
+			.frame_header_incr        = 0x000018A4,
+			.frame_header_cfg         = 0x000018A8,
+			.irq_subsample_period     = 0x000018B0,
+			.irq_subsample_pattern    = 0x000018B4,
+			.mmu_prefetch_cfg         = 0x000018E0,
+			.mmu_prefetch_max_offset  = 0x000018E4,
+			.system_cache_cfg         = 0x000018E8,
+			.addr_status_0            = 0x000018F0,
+			.addr_status_1            = 0x000018F4,
+			.addr_status_2            = 0x000018F8,
+			.addr_status_3            = 0x000018FC,
+			.debug_status_cfg         = 0x00001900,
+			.debug_status_0           = 0x00001904,
+			.debug_status_1           = 0x00001908,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 RDI3 */
+		{
+			.cfg                      = 0x00001980,
+			.image_addr               = 0x00001984,
+			.frame_incr               = 0x00001988,
+			.image_cfg_0              = 0x0000198C,
+			.image_cfg_1              = 0x00001990,
+			.image_cfg_2              = 0x00001994,
+			.packer_cfg               = 0x00001998,
+			.frame_header_addr        = 0x000019A0,
+			.frame_header_incr        = 0x000019A4,
+			.frame_header_cfg         = 0x000019A8,
+			.irq_subsample_period     = 0x000019B0,
+			.irq_subsample_pattern    = 0x000019B4,
+			.mmu_prefetch_cfg         = 0x000019E0,
+			.mmu_prefetch_max_offset  = 0x000019E4,
+			.system_cache_cfg         = 0x000019E8,
+			.addr_status_0            = 0x000019F0,
+			.addr_status_1            = 0x000019F4,
+			.addr_status_2            = 0x000019F8,
+			.addr_status_3            = 0x000019FC,
+			.debug_status_cfg         = 0x00001A00,
+			.debug_status_0           = 0x00001A04,
+			.debug_status_1           = 0x00001A08,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 RDI4 */
+		{
+			.cfg                      = 0x00001A80,
+			.image_addr               = 0x00001A84,
+			.frame_incr               = 0x00001A88,
+			.image_cfg_0              = 0x00001A8C,
+			.image_cfg_1              = 0x00001A90,
+			.image_cfg_2              = 0x00001A94,
+			.packer_cfg               = 0x00001A98,
+			.frame_header_addr        = 0x00001AA0,
+			.frame_header_incr        = 0x00001AA4,
+			.frame_header_cfg         = 0x00001AA8,
+			.irq_subsample_period     = 0x00001AB0,
+			.irq_subsample_pattern    = 0x00001AB4,
+			.mmu_prefetch_cfg         = 0x00001AE0,
+			.mmu_prefetch_max_offset  = 0x00001AE4,
+			.system_cache_cfg         = 0x00001AE8,
+			.addr_status_0            = 0x00001AF0,
+			.addr_status_1            = 0x00001AF4,
+			.addr_status_2            = 0x00001AF8,
+			.addr_status_3            = 0x00001AFC,
+			.debug_status_cfg         = 0x00001B00,
+			.debug_status_0           = 0x00001B04,
+			.debug_status_1           = 0x00001B08,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 5 RDI5 */
+		{
+			.cfg                      = 0x00001B80,
+			.image_addr               = 0x00001B84,
+			.frame_incr               = 0x00001B88,
+			.image_cfg_0              = 0x00001B8C,
+			.image_cfg_1              = 0x00001B90,
+			.image_cfg_2              = 0x00001B94,
+			.packer_cfg               = 0x00001B98,
+			.frame_header_addr        = 0x00001BA0,
+			.frame_header_incr        = 0x00001BA4,
+			.frame_header_cfg         = 0x00001BA8,
+			.irq_subsample_period     = 0x00001BB0,
+			.irq_subsample_pattern    = 0x00001BB4,
+			.mmu_prefetch_cfg         = 0x00001BE0,
+			.mmu_prefetch_max_offset  = 0x00001BE4,
+			.system_cache_cfg         = 0x00001BE8,
+			.addr_status_0            = 0x00001BF0,
+			.addr_status_1            = 0x00001BF4,
+			.addr_status_2            = 0x00001BF8,
+			.addr_status_3            = 0x00001BFC,
+			.debug_status_cfg         = 0x00001C00,
+			.debug_status_0           = 0x00001C04,
+			.debug_status_1           = 0x00001C08,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 6,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.num_wm        = 1,
+			.mid           = vfe690x_out_port_mid[0],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				0,
+			},
+			.name          = {
+				"LITE_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.num_wm        = 1,
+			.mid           = vfe690x_out_port_mid[1],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				1,
+			},
+			.name          = {
+				"LITE_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.num_wm        = 1,
+			.mid           = vfe690x_out_port_mid[2],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"LITE_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.num_wm        = 1,
+			.mid           = vfe690x_out_port_mid[3],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"LITE_3",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI4,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_5,
+			.num_wm        = 1,
+			.mid           = vfe690x_out_port_mid[3],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				4,
+			},
+			.name          = {
+				"LITE_4",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI5,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_6,
+			.num_wm        = 1,
+			.mid           = vfe690x_out_port_mid[3],
+			.num_mid       = 1,
+			.line_based    = 1,
+			.wm_idx        = {
+				5,
+			},
+			.name          = {
+				"LITE_5",
+			},
+		},
+	},
+	.num_comp_grp    = 6,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3), BIT(4), BIT(5)
+	},
+	.top_irq_shift   = 0,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 33,
+};
+
+static struct cam_vfe_irq_hw_info vfe69x_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_LITE_EXT_CSID,
+	.top_irq_reg   = &vfe69x_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite69x_hw_info = {
+	.irq_hw_info                   = &vfe69x_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe690x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe69x_top_hw_info,
+};
+
+#endif /* _CAM_VFE_LITE69X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite78x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite78x.h
@@ -0,0 +1,590 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE_LITE78X_H_
+#define _CAM_VFE_LITE78X_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+#define CAM_VFE_78X_NUM_DBG_REG 5
+
+static struct cam_vfe_top_ver4_module_desc vfe_lite78x_ipp_mod_desc[] = {
+	{
+		.id = 0,
+		.desc = "CLC_BLS",
+	},
+	{
+		.id = 1,
+		.desc = "CLC_GLUT",
+	},
+	{
+		.id = 2,
+		.desc = "CLC_STATS_BG",
+	},
+};
+
+static struct cam_vfe_top_ver4_wr_client_desc vfe_lite78x_wr_client_desc[] = {
+	{
+		.wm_id = 0,
+		.desc = "RDI_0",
+	},
+	{
+		.wm_id = 1,
+		.desc = "RDI_1",
+	},
+	{
+		.wm_id = 2,
+		.desc = "RDI_2",
+	},
+	{
+		.wm_id = 3,
+		.desc = "RDI_3",
+	},
+	{
+		.wm_id = 4,
+		.desc = "GAMMA",
+	},
+	{
+		.wm_id = 5,
+		.desc = "BE",
+	},
+};
+
+static struct cam_irq_register_set vfe_lite78x_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x00001024,
+		.clear_reg_offset  = 0x0000102C,
+		.status_reg_offset = 0x0000101C,
+		.set_reg_offset    = 0x00001034,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x00001028,
+		.clear_reg_offset  = 0x00001030,
+		.status_reg_offset = 0x00001020,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe_lite78x_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe_lite78x_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00001038,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe_lite78x_top_debug_reg[] = {
+	0x0000105C,
+	0x00001060,
+	0x00001064,
+	0x00001068,
+	0x0000106C,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe_lite78x_top_common_reg = {
+	.hw_version               = 0x00001000,
+	.hw_capability            = 0x00001004,
+	.core_cgc_ovd_0           = 0x00001014,
+	.ahb_cgc_ovd              = 0x00001018,
+	.core_cfg_0               = 0x0000103C,
+	.diag_config              = 0x00001040,
+	.diag_sensor_status_0     = 0x00001044,
+	.diag_sensor_status_1     = 0x00001048,
+	.ipp_violation_status     = 0x00001054,
+	.bus_violation_status     = 0x00001264,
+	.bus_overflow_status      = 0x00001268,
+	.top_debug_cfg            = 0x00001074,
+	.num_top_debug_reg        = CAM_VFE_78X_NUM_DBG_REG,
+	.top_debug                = vfe_lite78x_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe_lite78x_ipp_reg_data =
+{
+	.sof_irq_mask                    = 0x1,
+	.eof_irq_mask                    = 0x2,
+	.error_irq_mask                  = 0x2,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 0x3,
+	.ipp_violation_mask              = 0x10,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe_lite78x_rdi_reg_data[4] = {
+
+	{
+		.sof_irq_mask                    = 0x4,
+		.eof_irq_mask                    = 0x8,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x10,
+		.eof_irq_mask                    = 0x20,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x40,
+		.eof_irq_mask                    = 0x80,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+};
+
+static struct cam_vfe_ver4_path_hw_info
+	vfe_lite78x_rdi_hw_info[] = {
+	{
+		.common_reg     = &vfe_lite78x_top_common_reg,
+		.reg_data       = &vfe_lite78x_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe_lite78x_top_common_reg,
+		.reg_data       = &vfe_lite78x_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe_lite78x_top_common_reg,
+		.reg_data       = &vfe_lite78x_rdi_reg_data[2],
+	},
+	{
+		.common_reg     = &vfe_lite78x_top_common_reg,
+		.reg_data       = &vfe_lite78x_rdi_reg_data[3],
+	},
+};
+
+static struct cam_vfe_top_ver4_debug_reg_info vfe78x_dbg_reg_info[CAM_VFE_78X_NUM_DBG_REG][8] = {
+	VFE_DBG_INFO_ARRAY_4bit(
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved",
+		"test_bus_reserved"
+	),
+	{
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+		VFE_DBG_INFO(32, "non-CLC info"),
+	},
+	VFE_DBG_INFO_ARRAY_4bit(
+		"PP_THROTTLE",
+		"STATS_BG_THROTTLE",
+		"STATS_BG",
+		"BLS",
+		"GLUT",
+		"unused",
+		"unused",
+		"unused"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"RDI_0",
+		"RDI_1",
+		"RDI_2",
+		"RDI_3",
+		"PP_STATS_BG",
+		"PP_GLUT",
+		"PP_STATS_BG",
+		"PP_GLUT"
+	),
+	VFE_DBG_INFO_ARRAY_4bit(
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused",
+		"unused"
+	),
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe_lite78x_top_hw_info = {
+	.common_reg = &vfe_lite78x_top_common_reg,
+	.rdi_hw_info = vfe_lite78x_rdi_hw_info,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe_lite78x_top_common_reg,
+		.reg_data       = &vfe_lite78x_ipp_reg_data,
+	},
+	.ipp_module_desc        = vfe_lite78x_ipp_mod_desc,
+	.wr_client_desc         = vfe_lite78x_wr_client_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.debug_reg_info = &vfe78x_dbg_reg_info,
+	.num_rdi        = ARRAY_SIZE(vfe_lite78x_rdi_hw_info),
+};
+
+static struct cam_irq_register_set vfe_lite78x_bus_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00001218,
+		.clear_reg_offset  = 0x00001220,
+		.status_reg_offset = 0x00001228,
+	},
+};
+
+static uint32_t vfe_lite78x_out_port_mid[][4] = {
+	{8, 0, 0, 0},
+	{9, 0, 0, 0},
+	{10, 0, 0, 0},
+	{11, 0, 0, 0},
+	{12, 0, 0, 0},
+	{13, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe_lite78x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00001200,
+		.cgc_ovd                          = 0x00001208,
+		.if_frameheader_cfg               = {
+			0x00001234,
+			0x00001238,
+			0x0000123C,
+			0x00001240,
+			0x00001244,
+		},
+		.pwr_iso_cfg                      = 0x0000125C,
+		.overflow_status_clear            = 0x00001260,
+		.ccif_violation_status            = 0x00001264,
+		.overflow_status                  = 0x00001268,
+		.image_size_violation_status      = 0x00001270,
+		.debug_status_top_cfg             = 0x000012D4,
+		.debug_status_top                 = 0x000012D8,
+		.test_bus_ctrl                    = 0x000012DC,
+		.irq_reg_info = {
+			.num_registers            = 1,
+			.irq_reg_set              = vfe_lite78x_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00001230,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = 6,
+	.bus_client_reg = {
+		/* BUS Client 0 RDI0 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.line_done_cfg            = 0x0000142C,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_cfg                 = 0x00001470,
+			.addr_status_0            = 0x00001474,
+			.addr_status_1            = 0x00001478,
+			.addr_status_2            = 0x0000147C,
+			.addr_status_3            = 0x00001480,
+			.debug_status_cfg         = 0x00001484,
+			.debug_status_0           = 0x00001488,
+			.debug_status_1           = 0x0000148C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 RDI1 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.line_done_cfg            = 0x0000152C,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_cfg                 = 0x00001570,
+			.addr_status_0            = 0x00001574,
+			.addr_status_1            = 0x00001578,
+			.addr_status_2            = 0x0000157C,
+			.addr_status_3            = 0x00001580,
+			.debug_status_cfg         = 0x00001584,
+			.debug_status_0           = 0x00001588,
+			.debug_status_1           = 0x0000158C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 RDI2 */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.line_done_cfg            = 0x0000162C,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_cfg                 = 0x00001670,
+			.addr_status_0            = 0x00001674,
+			.addr_status_1            = 0x00001678,
+			.addr_status_2            = 0x0000167C,
+			.addr_status_3            = 0x00001680,
+			.debug_status_cfg         = 0x00001684,
+			.debug_status_0           = 0x00001688,
+			.debug_status_1           = 0x0000168C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 RDI3 */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.frame_header_addr        = 0x00001720,
+			.frame_header_incr        = 0x00001724,
+			.frame_header_cfg         = 0x00001728,
+			.line_done_cfg            = 0x0000172C,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_cfg                 = 0x00001770,
+			.addr_status_0            = 0x00001774,
+			.addr_status_1            = 0x00001778,
+			.addr_status_2            = 0x0000177C,
+			.addr_status_3            = 0x00001780,
+			.debug_status_cfg         = 0x00001784,
+			.debug_status_0           = 0x00001788,
+			.debug_status_1           = 0x0000178C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 Gamma */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.line_done_cfg            = 0x0000182C,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_cfg                 = 0x00001870,
+			.addr_status_0            = 0x00001874,
+			.addr_status_1            = 0x00001878,
+			.addr_status_2            = 0x0000187C,
+			.addr_status_3            = 0x00001880,
+			.debug_status_cfg         = 0x00001884,
+			.debug_status_0           = 0x00001888,
+			.debug_status_1           = 0x0000188C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 5 Stats BE */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.line_done_cfg            = 0x0000192C,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_cfg                 = 0x00001970,
+			.addr_status_0            = 0x00001974,
+			.addr_status_1            = 0x00001978,
+			.addr_status_2            = 0x0000197C,
+			.addr_status_3            = 0x00001980,
+			.debug_status_cfg         = 0x00001984,
+			.debug_status_0           = 0x00001988,
+			.debug_status_1           = 0x0000198C,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 6,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite78x_out_port_mid[0],
+			.num_mid       = 1,
+			.wm_idx        = {
+				0,
+			},
+			.name          = {
+				"LITE_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite78x_out_port_mid[1],
+			.num_mid       = 1,
+			.wm_idx        = {
+				1,
+			},
+			.name          = {
+				"LITE_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite78x_out_port_mid[2],
+			.num_mid       = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"LITE_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite78x_out_port_mid[3],
+			.num_mid       = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"LITE_3",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_RAW,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.mid           = vfe_lite78x_out_port_mid[4],
+			.num_mid       = 1,
+			.wm_idx        = {
+				4,
+			},
+			.name          = {
+				"PREPROCESS_RAW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.mid           = vfe_lite78x_out_port_mid[5],
+			.num_mid       = 1,
+			.wm_idx        = {
+				5,
+			},
+			.name          = {
+				"STATS_BG",
+			},
+		},
+	},
+	.num_comp_grp    = 5,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3), BIT(4),
+	},
+	.top_irq_shift   = 0,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 34,
+};
+
+static struct cam_vfe_irq_hw_info vfe_lite78x_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_LITE_EXT_CSID,
+	.top_irq_reg   = &vfe_lite78x_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite78x_hw_info = {
+	.irq_hw_info                   = &vfe_lite78x_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe_lite78x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe_lite78x_top_hw_info,
+};
+
+#endif /* _CAM_VFE_LITE78X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite86x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite86x.h
@@ -0,0 +1,86 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE_LITE86X_H_
+#define _CAM_VFE_LITE86X_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_lite78x.h"
+#include "cam_vfe_lite88x.h"
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe_lite86x_top_common_reg = {
+	.hw_version               = 0x00001000,
+	.hw_capability            = 0x00001004,
+	.core_cgc_ovd_0           = 0x00001014,
+	.ahb_cgc_ovd              = 0x00001018,
+	.core_cfg_0               = 0x0000103C,
+	.diag_config              = 0x00001040,
+	.diag_sensor_status_0     = 0x00001044,
+	.diag_sensor_status_1     = 0x00001048,
+	.ipp_violation_status     = 0x00001054,
+	.bus_violation_status     = 0x00001264,
+	.bus_overflow_status      = 0x00001268,
+	.top_debug_cfg            = 0x00001074,
+	.num_top_debug_reg        = CAM_VFE_88X_NUM_DBG_REG,
+	.top_debug                = vfe_lite88x_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_hw_info
+	vfe_lite86x_rdi_hw_info[] = {
+	{
+		.common_reg     = &vfe_lite86x_top_common_reg,
+		.reg_data       = &vfe_lite88x_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe_lite86x_top_common_reg,
+		.reg_data       = &vfe_lite88x_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe_lite86x_top_common_reg,
+		.reg_data       = &vfe_lite88x_rdi_reg_data[2],
+	},
+	{
+		.common_reg     = &vfe_lite86x_top_common_reg,
+		.reg_data       = &vfe_lite88x_rdi_reg_data[3],
+	},
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe_lite86x_top_hw_info = {
+	.common_reg = &vfe_lite86x_top_common_reg,
+	.rdi_hw_info = vfe_lite86x_rdi_hw_info,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe_lite86x_top_common_reg,
+		.reg_data       = &vfe_lite88x_ipp_reg_data,
+	},
+	.ipp_module_desc        = vfe_lite78x_ipp_mod_desc,
+	.wr_client_desc         = vfe_lite78x_wr_client_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.debug_reg_info = &vfe78x_dbg_reg_info,
+	.num_rdi        = ARRAY_SIZE(vfe_lite88x_rdi_hw_info),
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite86x_hw_info = {
+	.irq_hw_info                   = &vfe_lite88x_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe_lite88x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe_lite86x_top_hw_info,
+};
+
+#endif /* _CAM_VFE_LITE86X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite88x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite88x.h
@@ -0,0 +1,497 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE_LITE88X_H_
+#define _CAM_VFE_LITE88X_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_lite78x.h"
+
+#define CAM_VFE_88X_NUM_DBG_REG 5
+
+/* Offsets might not match due to csid secure regs at beginning of reg space */
+
+static struct cam_irq_register_set vfe_lite88x_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x00001024,
+		.clear_reg_offset  = 0x0000102C,
+		.status_reg_offset = 0x0000101C,
+		.set_reg_offset    = 0x00001034,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x00001028,
+		.clear_reg_offset  = 0x00001030,
+		.status_reg_offset = 0x00001020,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe_lite88x_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe_lite88x_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00001038,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe_lite88x_top_debug_reg[] = {
+	0x0000105C,
+	0x00001060,
+	0x00001064,
+	0x00001068,
+	0x0000106C,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe_lite88x_top_common_reg = {
+	.hw_version               = 0x00001000,
+	.hw_capability            = 0x00001004,
+	.core_cgc_ovd_0           = 0x00001014,
+	.ahb_cgc_ovd              = 0x00001018,
+	.core_cfg_0               = 0x0000103C,
+	.diag_config              = 0x00001040,
+	.diag_sensor_status_0     = 0x00001044,
+	.diag_sensor_status_1     = 0x00001048,
+	.ipp_violation_status     = 0x00001054,
+	.bus_violation_status     = 0x00001264,
+	.bus_overflow_status      = 0x00001268,
+	.top_debug_cfg            = 0x00001074,
+	.num_top_debug_reg        = CAM_VFE_88X_NUM_DBG_REG,
+	.top_debug                = vfe_lite88x_top_debug_reg,
+	.frame_timing_irq_reg_idx = CAM_IFE_IRQ_CAMIF_REG_STATUS1,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe_lite88x_ipp_reg_data = {
+	.sof_irq_mask                    = 0x1,
+	.eof_irq_mask                    = 0x2,
+	.error_irq_mask                  = 0x2,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 0x3,
+	.ipp_violation_mask              = 0x10,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe_lite88x_rdi_reg_data[4] = {
+
+	{
+		.sof_irq_mask                    = 0x4,
+		.eof_irq_mask                    = 0x8,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x10,
+		.eof_irq_mask                    = 0x20,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x40,
+		.eof_irq_mask                    = 0x80,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+};
+
+static struct cam_vfe_ver4_path_hw_info
+	vfe_lite88x_rdi_hw_info[] = {
+	{
+		.common_reg     = &vfe_lite88x_top_common_reg,
+		.reg_data       = &vfe_lite88x_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe_lite88x_top_common_reg,
+		.reg_data       = &vfe_lite88x_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe_lite88x_top_common_reg,
+		.reg_data       = &vfe_lite88x_rdi_reg_data[2],
+	},
+	{
+		.common_reg     = &vfe_lite88x_top_common_reg,
+		.reg_data       = &vfe_lite88x_rdi_reg_data[3],
+	},
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe_lite88x_top_hw_info = {
+	.common_reg = &vfe_lite88x_top_common_reg,
+	.rdi_hw_info = vfe_lite88x_rdi_hw_info,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe_lite88x_top_common_reg,
+		.reg_data       = &vfe_lite88x_ipp_reg_data,
+	},
+	.ipp_module_desc        = vfe_lite78x_ipp_mod_desc,
+	.wr_client_desc         = vfe_lite78x_wr_client_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.debug_reg_info = &vfe78x_dbg_reg_info,
+	.num_rdi        = ARRAY_SIZE(vfe_lite88x_rdi_hw_info),
+};
+
+static struct cam_irq_register_set vfe_lite88x_bus_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00001218,
+		.clear_reg_offset  = 0x00001220,
+		.status_reg_offset = 0x00001228,
+	},
+};
+
+static uint32_t vfe_lite88x_out_port_mid[][4] = {
+	{8, 0, 0, 0},
+	{9, 0, 0, 0},
+	{10, 0, 0, 0},
+	{11, 0, 0, 0},
+	{12, 0, 0, 0},
+	{13, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe_lite88x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00001200,
+		.cgc_ovd                          = 0x00001208,
+		.if_frameheader_cfg               = {
+			0x00001234,
+			0x00001238,
+			0x0000123C,
+			0x00001240,
+			0x00001244,
+		},
+		.pwr_iso_cfg                      = 0x0000125C,
+		.overflow_status_clear            = 0x00001260,
+		.ccif_violation_status            = 0x00001264,
+		.overflow_status                  = 0x00001268,
+		.image_size_violation_status      = 0x00001270,
+		.debug_status_top_cfg             = 0x000012F0,
+		.debug_status_top                 = 0x000012F4,
+		.test_bus_ctrl                    = 0x00001394,
+		.irq_reg_info = {
+			.num_registers            = 1,
+			.irq_reg_set              = vfe_lite88x_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00001230,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = 6,
+	.bus_client_reg = {
+		/* BUS Client 0 RDI0 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.line_done_cfg            = 0x0000142C,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_cfg                 = 0x00001470,
+			.addr_status_0            = 0x00001478,
+			.addr_status_1            = 0x0000147C,
+			.addr_status_2            = 0x00001480,
+			.addr_status_3            = 0x00001484,
+			.debug_status_cfg         = 0x00001488,
+			.debug_status_0           = 0x0000148C,
+			.debug_status_1           = 0x00001490,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 RDI1 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.line_done_cfg            = 0x0000152C,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_cfg                 = 0x00001570,
+			.addr_status_0            = 0x00001578,
+			.addr_status_1            = 0x0000157C,
+			.addr_status_2            = 0x00001580,
+			.addr_status_3            = 0x00001584,
+			.debug_status_cfg         = 0x00001588,
+			.debug_status_0           = 0x0000158C,
+			.debug_status_1           = 0x00001590,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 RDI2 */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.line_done_cfg            = 0x0000162C,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_cfg                 = 0x00001670,
+			.addr_status_0            = 0x00001678,
+			.addr_status_1            = 0x0000167C,
+			.addr_status_2            = 0x00001680,
+			.addr_status_3            = 0x00001684,
+			.debug_status_cfg         = 0x00001688,
+			.debug_status_0           = 0x0000168C,
+			.debug_status_1           = 0x00001690,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 RDI3 */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.frame_header_addr        = 0x00001720,
+			.frame_header_incr        = 0x00001724,
+			.frame_header_cfg         = 0x00001728,
+			.line_done_cfg            = 0x0000172C,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_cfg                 = 0x00001770,
+			.addr_status_0            = 0x00001778,
+			.addr_status_1            = 0x0000177C,
+			.addr_status_2            = 0x00001780,
+			.addr_status_3            = 0x00001784,
+			.debug_status_cfg         = 0x00001788,
+			.debug_status_0           = 0x0000178C,
+			.debug_status_1           = 0x00001790,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 Gamma */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.line_done_cfg            = 0x0000182C,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_cfg                 = 0x00001870,
+			.addr_status_0            = 0x00001878,
+			.addr_status_1            = 0x0000187C,
+			.addr_status_2            = 0x00001880,
+			.addr_status_3            = 0x00001884,
+			.debug_status_cfg         = 0x00001888,
+			.debug_status_0           = 0x0000188C,
+			.debug_status_1           = 0x00001890,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 5 Stats BE */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.line_done_cfg            = 0x0000192C,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_cfg                 = 0x00001970,
+			.addr_status_0            = 0x00001978,
+			.addr_status_1            = 0x0000197C,
+			.addr_status_2            = 0x00001980,
+			.addr_status_3            = 0x00001984,
+			.debug_status_cfg         = 0x00001988,
+			.debug_status_0           = 0x0000198C,
+			.debug_status_1           = 0x00001990,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 6,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite88x_out_port_mid[0],
+			.num_mid       = 1,
+			.wm_idx        = {
+				0,
+			},
+			.name          = {
+				"LITE_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite88x_out_port_mid[1],
+			.num_mid       = 1,
+			.wm_idx        = {
+				1,
+			},
+			.name          = {
+				"LITE_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite88x_out_port_mid[2],
+			.num_mid       = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"LITE_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite88x_out_port_mid[3],
+			.num_mid       = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"LITE_3",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_RAW,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.mid           = vfe_lite88x_out_port_mid[4],
+			.num_mid       = 1,
+			.wm_idx        = {
+				4,
+			},
+			.name          = {
+				"PREPROCESS_RAW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.mid           = vfe_lite88x_out_port_mid[5],
+			.num_mid       = 1,
+			.wm_idx        = {
+				5,
+			},
+			.name          = {
+				"STATS_BG",
+			},
+		},
+	},
+	.num_comp_grp    = 5,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3), BIT(4),
+	},
+	.top_irq_shift   = 0,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 34,
+};
+
+static struct cam_vfe_irq_hw_info vfe_lite88x_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_LITE_EXT_CSID,
+	.top_irq_reg   = &vfe_lite88x_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite88x_hw_info = {
+	.irq_hw_info                   = &vfe_lite88x_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe_lite88x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe_lite88x_top_hw_info,
+};
+
+#endif /* _CAM_VFE_LITE88X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite98x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite98x.h
@@ -0,0 +1,495 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE_LITE98X_H_
+#define _CAM_VFE_LITE98X_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver4.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_lite78x.h"
+
+#define CAM_VFE_98X_NUM_DBG_REG 5
+
+/* Offsets might not match due to csid secure regs at beginning of reg space */
+
+static struct cam_irq_register_set vfe_lite98x_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x00001024,
+		.clear_reg_offset  = 0x0000102C,
+		.status_reg_offset = 0x0000101C,
+		.set_reg_offset    = 0x00001034,
+		.test_set_val      = BIT(0),
+		.test_sub_val      = BIT(0),
+	},
+	{
+		.mask_reg_offset   = 0x00001028,
+		.clear_reg_offset  = 0x00001030,
+		.status_reg_offset = 0x00001020,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe_lite98x_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe_lite98x_top_irq_reg_set,
+	.global_irq_cmd_offset = 0x00001038,
+	.global_clear_bitmask  = 0x00000001,
+	.global_set_bitmask    = 0x00000010,
+	.clear_all_bitmask     = 0xFFFFFFFF,
+};
+
+static uint32_t vfe_lite98x_top_debug_reg[] = {
+	0x0000105C,
+	0x00001060,
+	0x00001064,
+	0x00001068,
+	0x0000106C,
+};
+
+static struct cam_vfe_top_ver4_reg_offset_common vfe_lite98x_top_common_reg = {
+	.hw_version               = 0x00001000,
+	.hw_capability            = 0x00001004,
+	.core_cgc_ovd_0           = 0x00001014,
+	.ahb_cgc_ovd              = 0x00001018,
+	.core_cfg_0               = 0x0000103C,
+	.diag_config              = 0x00001040,
+	.diag_sensor_status_0     = 0x00001044,
+	.diag_sensor_status_1     = 0x00001048,
+	.ipp_violation_status     = 0x00001054,
+	.bus_violation_status     = 0x00001264,
+	.bus_overflow_status      = 0x00001268,
+	.top_debug_cfg            = 0x00001074,
+	.num_top_debug_reg        = CAM_VFE_98X_NUM_DBG_REG,
+	.top_debug                = vfe_lite98x_top_debug_reg,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe_lite98x_ipp_reg_data = {
+	.sof_irq_mask                    = 0x1,
+	.eof_irq_mask                    = 0x2,
+	.error_irq_mask                  = 0x2,
+	.enable_diagnostic_hw            = 0x1,
+	.top_debug_cfg_en                = 0x3,
+	.ipp_violation_mask              = 0x10,
+};
+
+static struct cam_vfe_ver4_path_reg_data vfe_lite98x_rdi_reg_data[4] = {
+
+	{
+		.sof_irq_mask                    = 0x4,
+		.eof_irq_mask                    = 0x8,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x10,
+		.eof_irq_mask                    = 0x20,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x40,
+		.eof_irq_mask                    = 0x80,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+	{
+		.sof_irq_mask                    = 0x100,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask                  = 0x0,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x3,
+	},
+};
+
+static struct cam_vfe_ver4_path_hw_info
+	vfe_lite98x_rdi_hw_info[] = {
+	{
+		.common_reg     = &vfe_lite98x_top_common_reg,
+		.reg_data       = &vfe_lite98x_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe_lite98x_top_common_reg,
+		.reg_data       = &vfe_lite98x_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe_lite98x_top_common_reg,
+		.reg_data       = &vfe_lite98x_rdi_reg_data[2],
+	},
+	{
+		.common_reg     = &vfe_lite98x_top_common_reg,
+		.reg_data       = &vfe_lite98x_rdi_reg_data[3],
+	},
+};
+
+static struct cam_vfe_top_ver4_hw_info vfe_lite98x_top_hw_info = {
+	.common_reg = &vfe_lite98x_top_common_reg,
+	.rdi_hw_info = vfe_lite98x_rdi_hw_info,
+	.vfe_full_hw_info = {
+		.common_reg     = &vfe_lite98x_top_common_reg,
+		.reg_data       = &vfe_lite98x_ipp_reg_data,
+	},
+	.ipp_module_desc        = vfe_lite78x_ipp_mod_desc,
+	.wr_client_desc         = vfe_lite78x_wr_client_desc,
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_4_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.debug_reg_info = &vfe78x_dbg_reg_info,
+	.num_rdi        = ARRAY_SIZE(vfe_lite98x_rdi_hw_info),
+};
+
+static struct cam_irq_register_set vfe_lite98x_bus_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00001218,
+		.clear_reg_offset  = 0x00001220,
+		.status_reg_offset = 0x00001228,
+	},
+};
+
+static uint32_t vfe_lite98x_out_port_mid[][4] = {
+	{8, 0, 0, 0},
+	{9, 0, 0, 0},
+	{10, 0, 0, 0},
+	{11, 0, 0, 0},
+	{12, 0, 0, 0},
+	{13, 0, 0, 0},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe_lite98x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00001200,
+		.cgc_ovd                          = 0x00001208,
+		.if_frameheader_cfg               = {
+			0x00001234,
+			0x00001238,
+			0x0000123C,
+			0x00001240,
+			0x00001244,
+		},
+		.pwr_iso_cfg                      = 0x0000125C,
+		.overflow_status_clear            = 0x00001260,
+		.ccif_violation_status            = 0x00001264,
+		.overflow_status                  = 0x00001268,
+		.image_size_violation_status      = 0x00001270,
+		.debug_status_top_cfg             = 0x000012F0,
+		.debug_status_top                 = 0x000012F4,
+		.test_bus_ctrl                    = 0x00001328,
+		.irq_reg_info = {
+			.num_registers            = 1,
+			.irq_reg_set              = vfe_lite98x_bus_irq_reg,
+			.global_irq_cmd_offset    = 0x00001230,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = 6,
+	.bus_client_reg = {
+		/* BUS Client 0 RDI0 */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.frame_header_addr        = 0x00001720,
+			.frame_header_incr        = 0x00001724,
+			.frame_header_cfg         = 0x00001728,
+			.line_done_cfg            = 0x0000172C,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_cfg                 = 0x00001770,
+			.addr_status_0            = 0x00001790,
+			.addr_status_1            = 0x00001794,
+			.addr_status_2            = 0x00001798,
+			.addr_status_3            = 0x0000179C,
+			.debug_status_cfg         = 0x0000177C,
+			.debug_status_0           = 0x00001780,
+			.debug_status_1           = 0x00001784,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 RDI1 */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.line_done_cfg            = 0x0000182C,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_cfg                 = 0x00001870,
+			.addr_status_0            = 0x00001890,
+			.addr_status_1            = 0x00001894,
+			.addr_status_2            = 0x00001898,
+			.addr_status_3            = 0x0000189C,
+			.debug_status_cfg         = 0x0000187C,
+			.debug_status_0           = 0x00001880,
+			.debug_status_1           = 0x00001884,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 RDI2 */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.line_done_cfg            = 0x0000192C,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_cfg                 = 0x00001970,
+			.addr_status_0            = 0x00001990,
+			.addr_status_1            = 0x00001994,
+			.addr_status_2            = 0x00001998,
+			.addr_status_3            = 0x0000199C,
+			.debug_status_cfg         = 0x0000197C,
+			.debug_status_0           = 0x00001980,
+			.debug_status_1           = 0x00001984,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 RDI3 */
+		{
+			.cfg                      = 0x00001A00,
+			.image_addr               = 0x00001A04,
+			.frame_incr               = 0x00001A08,
+			.image_cfg_0              = 0x00001A0C,
+			.image_cfg_1              = 0x00001A10,
+			.image_cfg_2              = 0x00001A14,
+			.packer_cfg               = 0x00001A18,
+			.frame_header_addr        = 0x00001A20,
+			.frame_header_incr        = 0x00001A24,
+			.frame_header_cfg         = 0x00001A28,
+			.line_done_cfg            = 0x00001A2C,
+			.irq_subsample_period     = 0x00001A30,
+			.irq_subsample_pattern    = 0x00001A34,
+			.mmu_prefetch_cfg         = 0x00001A60,
+			.mmu_prefetch_max_offset  = 0x00001A64,
+			.system_cache_cfg         = 0x00001A68,
+			.addr_cfg                 = 0x00001A70,
+			.addr_status_0            = 0x00001A90,
+			.addr_status_1            = 0x00001A94,
+			.addr_status_2            = 0x00001A98,
+			.addr_status_3            = 0x00001A9C,
+			.debug_status_cfg         = 0x00001A7C,
+			.debug_status_0           = 0x00001A80,
+			.debug_status_1           = 0x00001A84,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 Gamma */
+		{
+			.cfg                      = 0x00001B00,
+			.image_addr               = 0x00001B04,
+			.frame_incr               = 0x00001B08,
+			.image_cfg_0              = 0x00001B0C,
+			.image_cfg_1              = 0x00001B10,
+			.image_cfg_2              = 0x00001B14,
+			.packer_cfg               = 0x00001B18,
+			.frame_header_addr        = 0x00001B20,
+			.frame_header_incr        = 0x00001B24,
+			.frame_header_cfg         = 0x00001B28,
+			.line_done_cfg            = 0x00001B2C,
+			.irq_subsample_period     = 0x00001B30,
+			.irq_subsample_pattern    = 0x00001B34,
+			.mmu_prefetch_cfg         = 0x00001B60,
+			.mmu_prefetch_max_offset  = 0x00001B64,
+			.system_cache_cfg         = 0x00001B68,
+			.addr_cfg                 = 0x00001B70,
+			.addr_status_0            = 0x00001B90,
+			.addr_status_1            = 0x00001B94,
+			.addr_status_2            = 0x00001B98,
+			.addr_status_3            = 0x00001B9C,
+			.debug_status_cfg         = 0x00001B7C,
+			.debug_status_0           = 0x00001B80,
+			.debug_status_1           = 0x00001B84,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 5 Stats BE */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.line_done_cfg            = 0x00001C2C,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.mmu_prefetch_cfg         = 0x00001C60,
+			.mmu_prefetch_max_offset  = 0x00001C64,
+			.system_cache_cfg         = 0x00001C68,
+			.addr_cfg                 = 0x00001C70,
+			.addr_status_0            = 0x00001C90,
+			.addr_status_1            = 0x00001C94,
+			.addr_status_2            = 0x00001C98,
+			.addr_status_3            = 0x00001C9C,
+			.debug_status_cfg         = 0x00001C7C,
+			.debug_status_0           = 0x00001C80,
+			.debug_status_1           = 0x00001C84,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 6,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite98x_out_port_mid[0],
+			.num_mid       = 1,
+			.wm_idx        = {
+				0,
+			},
+			.name          = {
+				"LITE_0",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite98x_out_port_mid[1],
+			.num_mid       = 1,
+			.wm_idx        = {
+				1,
+			},
+			.name          = {
+				"LITE_1",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite98x_out_port_mid[2],
+			.num_mid       = 1,
+			.wm_idx        = {
+				2,
+			},
+			.name          = {
+				"LITE_2",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.num_wm        = 1,
+			.line_based    = 1,
+			.mid           = vfe_lite98x_out_port_mid[3],
+			.num_mid       = 1,
+			.wm_idx        = {
+				3,
+			},
+			.name          = {
+				"LITE_3",
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_RAW,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.mid           = vfe_lite98x_out_port_mid[4],
+			.num_mid       = 1,
+			.wm_idx        = {
+				4,
+			},
+			.name          = {
+				"PREPROCESS_RAW",
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.mid           = vfe_lite98x_out_port_mid[5],
+			.num_mid       = 1,
+			.wm_idx        = {
+				5,
+			},
+			.name          = {
+				"STATS_BG",
+			},
+		},
+	},
+	.num_comp_grp    = 5,
+	.support_consumed_addr = true,
+	.comp_done_mask = {
+		BIT(0), BIT(1), BIT(2), BIT(3), BIT(4),
+	},
+	.top_irq_shift   = 0,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 34,
+};
+
+static struct cam_vfe_irq_hw_info vfe_lite98x_irq_hw_info = {
+	.reset_mask    = 0,
+	.supported_irq = CAM_VFE_HW_IRQ_CAP_LITE_EXT_CSID,
+	.top_irq_reg   = &vfe_lite98x_top_irq_reg_info,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite98x_hw_info = {
+	.irq_hw_info                   = &vfe_lite98x_irq_hw_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe_lite98x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe_lite98x_top_hw_info,
+};
+
+#endif /* _CAM_VFE_LITE98X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus.c
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_vfe_bus.h"
+#include "cam_vfe_bus_ver1.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_vfe_bus_rd_ver1.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_debug_util.h"
+
+int cam_vfe_bus_init(uint32_t          bus_version,
+	int                            bus_type,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *bus_hw_info,
+	void                          *vfe_irq_controller,
+	struct cam_vfe_bus           **vfe_bus)
+{
+	int rc = -ENODEV;
+
+	switch (bus_type) {
+	case BUS_TYPE_WR:
+		switch (bus_version) {
+		case CAM_VFE_BUS_VER_2_0:
+			rc = cam_vfe_bus_ver2_init(soc_info, hw_intf,
+				bus_hw_info, vfe_irq_controller, vfe_bus);
+			break;
+		case CAM_VFE_BUS_VER_3_0:
+			rc = cam_vfe_bus_ver3_init(soc_info, hw_intf,
+				bus_hw_info, vfe_irq_controller, vfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unsupported Bus WR Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	case BUS_TYPE_RD:
+		switch (bus_version) {
+		case CAM_VFE_BUS_RD_VER_1_0:
+			/* Call vfe bus rd init function */
+			rc = cam_vfe_bus_rd_ver1_init(soc_info, hw_intf,
+				bus_hw_info, vfe_irq_controller, vfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unsupported Bus RD Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported Bus type %d", bus_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_bus_deinit(uint32_t        bus_version,
+	struct cam_vfe_bus           **vfe_bus)
+{
+	int rc = -ENODEV;
+
+	switch (bus_version) {
+	case CAM_VFE_BUS_VER_2_0:
+		rc = cam_vfe_bus_ver2_deinit(vfe_bus);
+		break;
+	case CAM_VFE_BUS_VER_3_0:
+		rc = cam_vfe_bus_ver3_deinit(vfe_bus);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported Bus Version %x", bus_version);
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.c
@@ -0,0 +1,1382 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_bus_rd_ver1.h"
+#include "cam_vfe_core.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+
+static const char drv_name[] = "vfe_bus_rd";
+
+#define ALIGNUP(value, alignment) \
+	((value + alignment - 1) / alignment * alignment)
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	(sizeof(struct cam_vfe_bus_rd_ver1_reg_offset_bus_client)/4)
+
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+#define CAM_VFE_ADD_REG_VAL_PAIR(buf_array, index, offset, val)    \
+	do {                                               \
+		buf_array[(index)++] = offset;             \
+		buf_array[(index)++] = val;                \
+	} while (0)
+
+#define BUS_RD_VER1_DEFAULT_LATENCY_BUF_ALLOC 512
+
+enum cam_vfe_bus_rd_ver1_unpacker_format {
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_128             = 0x0,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_8               = 0x1,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_10BPP        = 0x2,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_12BPP        = 0x3,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_14BPP        = 0x4,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_32_20BPP        = 0x5,
+	BUS_RD_VER1_UNPACKER_FMT_ARGB_10               = 0x6,
+	BUS_RD_VER1_UNPACKER_FMT_ARGB_12               = 0x7,
+	BUS_RD_VER1_UNPACKER_FMT_ARGB_14               = 0x8,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_32              = 0x9,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_64              = 0xA,
+	BUS_RD_VER1_UNPACKER_FMT_TP_10                 = 0xB,
+	BUS_RD_VER1_UNPACKER_FMT_MIPI8                 = 0xC,
+	BUS_RD_VER1_UNPACKER_FMT_MIPI10                = 0xD,
+	BUS_RD_VER1_UNPACKER_FMT_MIPI12                = 0xE,
+	BUS_RD_VER1_UNPACKER_FMT_MIPI14                = 0xF,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_16BPP        = 0x10,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_128_ODD_EVEN    = 0x11,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_8_ODD_EVEN      = 0x12,
+	BUS_RD_VER1_UNPACKER_FMT_MAX                   = 0x13,
+};
+
+struct cam_vfe_bus_rd_ver1_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *bus_irq_controller;
+	void                                       *vfe_irq_controller;
+	struct cam_vfe_bus_rd_ver1_reg_offset_common  *common_reg;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+
+	struct list_head                            free_payload_list;
+	spinlock_t                                  spin_lock;
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    fs_sync_enable;
+	uint32_t                                    go_cmd_sel;
+	cam_hw_mgr_event_cb_func                    event_cb;
+};
+
+struct cam_vfe_bus_rd_ver1_rm_resource_data {
+	uint32_t             index;
+	struct cam_vfe_bus_rd_ver1_common_data            *common_data;
+	struct cam_vfe_bus_rd_ver1_reg_offset_bus_client  *hw_regs;
+	void                *ctx;
+
+	bool                 init_cfg_done;
+
+	uint32_t             offset;
+
+	uint32_t             min_vbi;
+	uint32_t             fs_mode;
+	uint32_t             hbi_count;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	uint32_t             latency_buf_allocation;
+	uint32_t             unpacker_cfg;
+	uint32_t             burst_len;
+
+	uint32_t             go_cmd_sel;
+	uint32_t             fs_sync_enable;
+	uint32_t             fs_line_sync_en;
+
+	uint32_t             en_cfg;
+	uint32_t             is_dual;
+	uint32_t             img_addr;
+	uint32_t             input_if_cmd;
+};
+
+struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data {
+	uint32_t                              bus_rd_type;
+	struct cam_vfe_bus_rd_ver1_common_data  *common_data;
+
+	uint32_t                         num_rm;
+	struct cam_isp_resource_node    *rm_res[PLANE_MAX];
+
+	struct cam_isp_resource_node    *comp_grp;
+	enum cam_isp_hw_sync_mode        dual_comp_sync_mode;
+	uint32_t                         dual_hw_alternate_vfe_id;
+	struct list_head                 vfe_bus_rd_list;
+
+	uint32_t                         format;
+	uint32_t                         max_width;
+	uint32_t                         max_height;
+	struct cam_cdm_utils_ops        *cdm_util_ops;
+	uint32_t                         secure_mode;
+	int                              irq_handle;
+	void                            *priv;
+	uint32_t                         status;
+	bool                             is_offline;
+};
+
+struct cam_vfe_bus_rd_ver1_priv {
+	struct cam_vfe_bus_rd_ver1_common_data common_data;
+	uint32_t                               num_client;
+	uint32_t                               num_bus_rd_resc;
+
+	struct cam_isp_resource_node  bus_client[
+		CAM_VFE_BUS_RD_VER1_MAX_CLIENTS];
+	struct cam_isp_resource_node  vfe_bus_rd[
+		CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX];
+
+	int                                 irq_handle;
+	void                               *tasklet_info;
+	uint32_t                            top_irq_shift;
+};
+
+static int cam_vfe_bus_rd_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+
+static void cam_vfe_bus_rd_pxls_to_bytes(uint32_t pxls, uint32_t fmt,
+	uint32_t *bytes)
+{
+	switch (fmt) {
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_128:
+		*bytes = pxls * 16;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_8:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_8_ODD_EVEN:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_10BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_12BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_14BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_16BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_ARGB_10:
+	case BUS_RD_VER1_UNPACKER_FMT_ARGB_12:
+	case BUS_RD_VER1_UNPACKER_FMT_ARGB_14:
+		*bytes = pxls * 2;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_32_20BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_32:
+		*bytes = pxls * 4;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_64:
+		*bytes = pxls * 8;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_TP_10:
+		*bytes = ALIGNUP(pxls, 3) * 4 / 3;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_MIPI8:
+		*bytes = pxls;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_MIPI10:
+		*bytes = ALIGNUP(pxls * 5, 4) / 4;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_MIPI12:
+		*bytes = ALIGNUP(pxls * 3, 2) / 2;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_MIPI14:
+		*bytes = ALIGNUP(pxls * 7, 4) / 4;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid unpacker_fmt:%d", fmt);
+		break;
+	}
+}
+
+static enum cam_vfe_bus_rd_ver1_unpacker_format
+	cam_vfe_bus_get_unpacker_fmt(uint32_t unpack_fmt)
+{
+	switch (unpack_fmt) {
+	case CAM_FORMAT_PLAIN128:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_PLAIN8:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_PLAIN16_10:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN32_20:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_32_20BPP;
+	case CAM_FORMAT_ARGB_10:
+		return BUS_RD_VER1_UNPACKER_FMT_ARGB_10;
+	case CAM_FORMAT_ARGB_12:
+		return BUS_RD_VER1_UNPACKER_FMT_ARGB_12;
+	case CAM_FORMAT_ARGB_14:
+		return BUS_RD_VER1_UNPACKER_FMT_ARGB_14;
+	case CAM_FORMAT_PLAIN32:
+	case CAM_FORMAT_ARGB:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_32;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_ARGB_16:
+	case CAM_FORMAT_PD10:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_TP10:
+		return BUS_RD_VER1_UNPACKER_FMT_TP_10;
+	case CAM_FORMAT_MIPI_RAW_8:
+		return BUS_RD_VER1_UNPACKER_FMT_MIPI8;
+	case CAM_FORMAT_MIPI_RAW_10:
+		return BUS_RD_VER1_UNPACKER_FMT_MIPI10;
+	case CAM_FORMAT_MIPI_RAW_12:
+		return BUS_RD_VER1_UNPACKER_FMT_MIPI12;
+	case CAM_FORMAT_MIPI_RAW_14:
+		return BUS_RD_VER1_UNPACKER_FMT_MIPI14;
+	case CAM_FORMAT_PLAIN16_16:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN8_SWAP:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_8_ODD_EVEN;
+	default:
+		return BUS_RD_VER1_UNPACKER_FMT_MAX;
+	}
+}
+
+static enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type
+	cam_vfe_bus_get_bus_rd_res_id(uint32_t res_type)
+{
+	switch (res_type) {
+	case CAM_ISP_RESOURCE_VFE_BUS_RD:
+		return CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0;
+	default:
+		return CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX;
+	}
+}
+
+static int cam_vfe_bus_get_num_rm(
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type res_type)
+{
+	switch (res_type) {
+	case CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0:
+		return 1;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported resource_type %u", res_type);
+		return -EINVAL;
+	}
+}
+
+static int cam_vfe_bus_rd_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	struct cam_isp_resource_node                *bus_rd = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rsrc_data = NULL;
+
+	bus_rd = th_payload->handler_priv;
+	if (!bus_rd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+	rsrc_data = bus_rd->res_priv;
+	rsrc_data->status = th_payload->evt_status_arr[0];
+
+	CAM_DBG(CAM_ISP, "VFE:%d Bus RD IRQ status_0: 0x%X",
+		rsrc_data->common_data->core_index,
+		th_payload->evt_status_arr[0]);
+
+	return 0;
+}
+
+static int cam_vfe_bus_rd_handle_irq_bottom_half(
+	void  *handler_priv, void *evt_payload_priv)
+{
+	struct cam_isp_resource_node                *bus_rd = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rsrc_data = NULL;
+
+	bus_rd = (struct cam_isp_resource_node *)handler_priv;
+	if (!bus_rd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+	rsrc_data = bus_rd->res_priv;
+
+	if (rsrc_data->status & 0x2)
+		CAM_DBG(CAM_ISP, "Received VFE:%d BUS RD RUP",
+			rsrc_data->common_data->core_index);
+	else if (rsrc_data->status & 0x4)
+		CAM_DBG(CAM_ISP, "Received VFE:%d BUS RD BUF DONE",
+			rsrc_data->common_data->core_index);
+	else if (rsrc_data->status & 0x10000) {
+		CAM_ERR(CAM_ISP, "Received VFE:%d BUS RD CCIF Violation",
+			rsrc_data->common_data->core_index);
+		return CAM_VFE_IRQ_STATUS_VIOLATION;
+	}
+
+	return CAM_VFE_IRQ_STATUS_SUCCESS;
+}
+
+static int cam_vfe_bus_get_rm_idx(
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type vfe_bus_rd_res_id,
+	enum cam_vfe_bus_plane_type plane)
+{
+	int rm_idx = -1;
+
+	switch (vfe_bus_rd_res_id) {
+	case CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0:
+		switch (plane) {
+		case PLANE_Y:
+			rm_idx = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	return rm_idx;
+}
+
+static int cam_vfe_bus_acquire_rm(
+	struct cam_vfe_bus_rd_ver1_priv             *ver1_bus_rd_priv,
+	void                                        *tasklet,
+	void                                        *ctx,
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type     vfe_bus_rd_res_id,
+	enum cam_vfe_bus_plane_type                  plane,
+	struct cam_isp_resource_node               **rm_res,
+	uint32_t                                    *client_done_mask,
+	uint32_t                                     is_dual,
+	uint32_t                                     unpacker_fmt,
+	bool                                         is_per_port_acquire)
+{
+	uint32_t                                     rm_idx = 0;
+	struct cam_isp_resource_node                *rm_res_local = NULL;
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data = NULL;
+
+	*rm_res = NULL;
+	*client_done_mask = 0;
+
+	/* No need to allocate for BUS VER2. VFE OUT to RM is fixed. */
+	rm_idx = cam_vfe_bus_get_rm_idx(vfe_bus_rd_res_id, plane);
+	if (rm_idx < 0 || rm_idx >= ver1_bus_rd_priv->num_client) {
+		CAM_ERR(CAM_ISP, "Unsupported VFE RM:%d plane:%d",
+			vfe_bus_rd_res_id, plane);
+		return -EINVAL;
+	}
+
+	rm_res_local = &ver1_bus_rd_priv->bus_client[rm_idx];
+	if (rm_res_local->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "VFE:%d RM:%d res not available state:%d",
+			ver1_bus_rd_priv->common_data.core_index, rm_idx,
+			rm_res_local->res_state);
+		return -EALREADY;
+	}
+	rm_res_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	if (is_per_port_acquire)
+		rm_res_local->is_per_port_acquire = true;
+	rm_res_local->tasklet_info = tasklet;
+
+	rsrc_data = rm_res_local->res_priv;
+	rsrc_data->ctx = ctx;
+	rsrc_data->is_dual = is_dual;
+	rsrc_data->unpacker_cfg = cam_vfe_bus_get_unpacker_fmt(unpacker_fmt);
+	rsrc_data->latency_buf_allocation =
+		BUS_RD_VER1_DEFAULT_LATENCY_BUF_ALLOC;
+	/* Set RM offset value to default */
+	rsrc_data->offset  = 0;
+
+	*client_done_mask = (1 << (rm_idx + 2));
+	*rm_res = rm_res_local;
+
+	CAM_DBG(CAM_ISP, "VFE:%d RM:%d Acquired",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+	return 0;
+}
+
+static int cam_vfe_bus_release_rm(void              *bus_priv,
+	struct cam_isp_resource_node                *rm_res)
+{
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data =
+		rm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->unpacker_cfg = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+
+	rm_res->tasklet_info = NULL;
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_ISP, "VFE:%d RM:%d released",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+	return 0;
+}
+
+static int cam_vfe_bus_start_rm(struct cam_isp_resource_node *rm_res)
+{
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rm_data;
+	struct cam_vfe_bus_rd_ver1_common_data      *common_data;
+	uint32_t                                     buf_size;
+
+	rm_data = rm_res->res_priv;
+	common_data = rm_data->common_data;
+
+	buf_size = ((rm_data->width)&(0x0000FFFF)) |
+		((rm_data->height<<16)&(0xFFFF0000));
+	cam_io_w_mb(buf_size, common_data->mem_base +
+		rm_data->hw_regs->buf_size);
+	cam_io_w_mb(rm_data->width, common_data->mem_base +
+		rm_data->hw_regs->stride);
+	cam_io_w_mb(rm_data->unpacker_cfg, common_data->mem_base +
+		rm_data->hw_regs->unpacker_cfg);
+	cam_io_w_mb(rm_data->latency_buf_allocation, common_data->mem_base +
+		rm_data->hw_regs->latency_buf_allocation);
+	cam_io_w_mb(0x1, common_data->mem_base + rm_data->hw_regs->cfg);
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	CAM_DBG(CAM_ISP,
+		"Start VFE:%d RM:%d offset:0x%X en_cfg:0x%X width:%d height:%d",
+		rm_data->common_data->core_index, rm_data->index,
+		(uint32_t) rm_data->hw_regs->cfg, rm_data->en_cfg,
+		rm_data->width, rm_data->height);
+	CAM_DBG(CAM_ISP, "RM:%d pk_fmt:%d stride:%d", rm_data->index,
+		rm_data->unpacker_cfg, rm_data->stride);
+
+	return 0;
+}
+
+static int cam_vfe_bus_stop_rm(struct cam_isp_resource_node *rm_res)
+{
+	int rc = 0;
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data =
+		rm_res->res_priv;
+	struct cam_vfe_bus_rd_ver1_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable RM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_data->init_cfg_done = false;
+
+	CAM_DBG(CAM_ISP, "VFE:%d RM:%d stopped",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	return rc;
+}
+
+static int cam_vfe_bus_init_rm_resource(uint32_t index,
+	struct cam_vfe_bus_rd_ver1_priv   *ver1_bus_rd_priv,
+	struct cam_vfe_bus_rd_ver1_hw_info *bus_rd_hw_info,
+	struct cam_isp_resource_node    *rm_res)
+{
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_rd_ver1_rm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_ISP, "Failed to alloc VFE:%d RM res priv",
+			ver1_bus_rd_priv->common_data.core_index);
+		return -ENOMEM;
+	}
+	rm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &bus_rd_hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &ver1_bus_rd_priv->common_data;
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&rm_res->list);
+
+	rm_res->start = cam_vfe_bus_start_rm;
+	rm_res->stop = cam_vfe_bus_stop_rm;
+	rm_res->hw_intf = ver1_bus_rd_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_rm_resource(
+	struct cam_isp_resource_node    *rm_res)
+{
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data;
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&rm_res->list);
+
+	rm_res->start = NULL;
+	rm_res->stop = NULL;
+	rm_res->top_half_handler = NULL;
+	rm_res->bottom_half_handler = NULL;
+	rm_res->hw_intf = NULL;
+
+	rsrc_data = rm_res->res_priv;
+	rm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_rd_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	return 0;
+}
+
+static int cam_vfe_bus_acquire_vfe_bus_rd(void *bus_priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                           rc = -ENODEV;
+	int                                           i;
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type      bus_rd_res_id;
+	int                                           num_rm;
+	uint32_t                                      client_done_mask;
+	struct cam_vfe_bus_rd_ver1_priv              *ver1_bus_rd_priv =
+		bus_priv;
+	struct cam_vfe_acquire_args                  *acq_args = acquire_args;
+	struct cam_vfe_hw_vfe_bus_rd_acquire_args    *bus_rd_acquire_args;
+	struct cam_isp_resource_node                 *rsrc_node = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data   *rsrc_data = NULL;
+	bool                                          is_per_port_acquire = false;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_ISP, "Invalid Param");
+		return -EINVAL;
+	}
+
+	bus_rd_acquire_args = &acq_args->vfe_bus_rd;
+
+	bus_rd_res_id = cam_vfe_bus_get_bus_rd_res_id(
+		acq_args->rsrc_type);
+	if (bus_rd_res_id == CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX)
+		return -ENODEV;
+
+	num_rm = cam_vfe_bus_get_num_rm(bus_rd_res_id);
+	if (num_rm < 1)
+		return -EINVAL;
+
+	rsrc_node = &ver1_bus_rd_priv->vfe_bus_rd[bus_rd_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "VFE:%d RM:0x%x not available state:%d",
+			ver1_bus_rd_priv->common_data.core_index,
+			acq_args->rsrc_type, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	if (acq_args->vfe_in.in_port->per_port_en && acq_args->per_port_acquire)
+		is_per_port_acquire = true;
+	rsrc_node->res_id = acq_args->rsrc_type;
+	rsrc_data = rsrc_node->res_priv;
+
+	CAM_DBG(CAM_ISP, "VFE:%d acquire RD type:0x%x",
+		rsrc_data->common_data->core_index, acq_args->rsrc_type);
+
+	rsrc_data->num_rm = num_rm;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	ver1_bus_rd_priv->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = bus_rd_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = bus_rd_acquire_args->cdm_ops;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->is_offline = bus_rd_acquire_args->is_offline;
+
+	for (i = 0; i < num_rm; i++) {
+		rc = cam_vfe_bus_acquire_rm(ver1_bus_rd_priv,
+			acq_args->tasklet,
+			acq_args->priv,
+			bus_rd_res_id,
+			i,
+			&rsrc_data->rm_res[i],
+			&client_done_mask,
+			bus_rd_acquire_args->is_dual,
+			bus_rd_acquire_args->unpacker_fmt,
+			is_per_port_acquire);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d RM:%d acquire failed rc:%d",
+				rsrc_data->common_data->core_index,
+				bus_rd_res_id, rc);
+			goto release_rm;
+		}
+	}
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_node->is_per_port_acquire = is_per_port_acquire;
+
+	bus_rd_acquire_args->rsrc_node = rsrc_node;
+
+	CAM_DBG(CAM_ISP, "VFE:%d acquire RD 0x%x successful",
+		rsrc_data->common_data->core_index, acq_args->rsrc_type);
+	return rc;
+
+release_rm:
+	for (i--; i >= 0; i--)
+		cam_vfe_bus_release_rm(ver1_bus_rd_priv, rsrc_data->rm_res[i]);
+	return rc;
+}
+
+static int cam_vfe_bus_release_vfe_bus_rd(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node          *vfe_bus_rd = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rsrc_data = NULL;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	vfe_bus_rd = release_args;
+	rsrc_data = vfe_bus_rd->res_priv;
+
+	if (vfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d RD type:0x%x invalid resource state:%d",
+			rsrc_data->common_data->core_index,
+			vfe_bus_rd->res_id, vfe_bus_rd->res_state);
+	}
+
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		cam_vfe_bus_release_rm(bus_priv, rsrc_data->rm_res[i]);
+	rsrc_data->num_rm = 0;
+
+	vfe_bus_rd->tasklet_info = NULL;
+	vfe_bus_rd->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+
+	if (vfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		vfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_vfe_bus_rd(
+	struct cam_isp_resource_node          *vfe_bus_rd)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data *rsrc_data = NULL;
+	struct cam_vfe_bus_rd_ver1_common_data *common_data = NULL;
+	uint32_t irq_reg_mask[1] = {0x6}, val = 0;
+
+	if (!vfe_bus_rd) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_bus_rd->res_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP, "VFE:%d start RD type:0x%x", vfe_bus_rd->res_id);
+
+	if (vfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid resource state:%d",
+			vfe_bus_rd->res_state);
+		return -EACCES;
+	}
+
+	if (!rsrc_data->is_offline) {
+		val = (common_data->fs_sync_enable << 5) |
+			(common_data->go_cmd_sel << 4);
+		cam_io_w_mb(val, common_data->mem_base +
+			common_data->common_reg->input_if_cmd);
+	}
+
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		rc = cam_vfe_bus_start_rm(rsrc_data->rm_res[i]);
+
+	rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+		common_data->bus_irq_controller,
+		CAM_IRQ_PRIORITY_1,
+		irq_reg_mask,
+		vfe_bus_rd,
+		cam_vfe_bus_rd_handle_irq_top_half,
+		cam_vfe_bus_rd_handle_irq_bottom_half,
+		vfe_bus_rd->tasklet_info,
+		&tasklet_bh_api,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (rsrc_data->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Failed to subscribe BUS RD IRQ");
+		rsrc_data->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	vfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_vfe_bus_stop_vfe_bus_rd(
+	struct cam_isp_resource_node          *vfe_bus_rd)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rsrc_data = NULL;
+
+	if (!vfe_bus_rd) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_bus_rd->res_priv;
+
+	if (vfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		vfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "VFE:%d Bus RD 0x%x state: %d",
+			rsrc_data->common_data->core_index, vfe_bus_rd->res_id,
+			vfe_bus_rd->res_state);
+		return rc;
+	}
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		rc = cam_vfe_bus_stop_rm(rsrc_data->rm_res[i]);
+
+	if (rsrc_data->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			rsrc_data->common_data->bus_irq_controller,
+			rsrc_data->irq_handle);
+		rsrc_data->irq_handle = 0;
+	}
+
+	vfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	CAM_DBG(CAM_ISP, "VFE:%d stopped Bus RD:0x%x",
+		rsrc_data->common_data->core_index,
+		vfe_bus_rd->res_id);
+	return rc;
+}
+
+static int cam_vfe_bus_init_vfe_bus_read_resource(uint32_t  index,
+	struct cam_vfe_bus_rd_ver1_priv                  *bus_rd_priv,
+	struct cam_vfe_bus_rd_ver1_hw_info               *bus_rd_hw_info)
+{
+	struct cam_isp_resource_node         *vfe_bus_rd = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data *rsrc_data = NULL;
+	int rc = 0;
+	int32_t vfe_bus_rd_resc_type =
+		bus_rd_hw_info->vfe_bus_rd_hw_info[index].vfe_bus_rd_type;
+
+	if (vfe_bus_rd_resc_type < 0 ||
+		vfe_bus_rd_resc_type >= CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX) {
+		CAM_ERR(CAM_ISP, "Init VFE Out failed, Invalid type=%d",
+			vfe_bus_rd_resc_type);
+		return -EINVAL;
+	}
+
+	vfe_bus_rd = &bus_rd_priv->vfe_bus_rd[vfe_bus_rd_resc_type];
+	if (vfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		vfe_bus_rd->res_priv) {
+		CAM_ERR(CAM_ISP,
+			"Error. Looks like same resource is init again");
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	vfe_bus_rd->res_priv = rsrc_data;
+
+	vfe_bus_rd->res_type = CAM_ISP_RESOURCE_VFE_BUS_RD;
+	vfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&vfe_bus_rd->list);
+
+	rsrc_data->bus_rd_type    =
+		bus_rd_hw_info->vfe_bus_rd_hw_info[index].vfe_bus_rd_type;
+	rsrc_data->common_data = &bus_rd_priv->common_data;
+	rsrc_data->max_width   =
+		bus_rd_hw_info->vfe_bus_rd_hw_info[index].max_width;
+	rsrc_data->max_height  =
+		bus_rd_hw_info->vfe_bus_rd_hw_info[index].max_height;
+	rsrc_data->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+
+	vfe_bus_rd->start = cam_vfe_bus_start_vfe_bus_rd;
+	vfe_bus_rd->stop = cam_vfe_bus_stop_vfe_bus_rd;
+	vfe_bus_rd->process_cmd = cam_vfe_bus_rd_process_cmd;
+	vfe_bus_rd->hw_intf = bus_rd_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_vfe_bus_rd_resource(
+	struct cam_isp_resource_node    *vfe_bus_rd_res)
+{
+	struct cam_vfe_bus_ver2_vfe_out_data *rsrc_data =
+		vfe_bus_rd_res->res_priv;
+
+	if (vfe_bus_rd_res->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		CAM_DBG(CAM_ISP, "HW%d Res %d already deinitialized");
+		return 0;
+	}
+
+	vfe_bus_rd_res->start = NULL;
+	vfe_bus_rd_res->stop = NULL;
+	vfe_bus_rd_res->top_half_handler = NULL;
+	vfe_bus_rd_res->bottom_half_handler = NULL;
+	vfe_bus_rd_res->hw_intf = NULL;
+
+	vfe_bus_rd_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&vfe_bus_rd_res->list);
+	vfe_bus_rd_res->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_rd_ver1_handle_irq(uint32_t    evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	struct cam_vfe_bus_rd_ver1_priv *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	CAM_DBG(CAM_ISP, "Top Bus RD IRQ Received");
+
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller, CAM_IRQ_EVT_GROUP_0);
+
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_vfe_bus_rd_update_rm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update         *update_buf;
+	struct cam_buf_io_cfg                    *io_cfg;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *vfe_bus_rd_data = NULL;
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rm_data = NULL;
+	struct cam_cdm_utils_ops                    *cdm_util_ops;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t  i, j, size = 0;
+	uint32_t buf_size = 0;
+
+	update_buf =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_bus_rd_data = (struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data *)
+		update_buf->res->res_priv;
+
+	if (!vfe_bus_rd_data || !vfe_bus_rd_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = vfe_bus_rd_data->cdm_util_ops;
+
+	CAM_DBG(CAM_ISP, "#of RM: %d",  vfe_bus_rd_data->num_rm);
+	if (update_buf->rm_update->num_buf != vfe_bus_rd_data->num_rm) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->rm_update->num_buf,
+			vfe_bus_rd_data->num_rm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &vfe_bus_rd_data->common_data->io_buf_update[0];
+	io_cfg = update_buf->rm_update->io_cfg;
+
+	for (i = 0, j = 0; i < vfe_bus_rd_data->num_rm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %lu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		rm_data = vfe_bus_rd_data->rm_res[i]->res_priv;
+
+		/* update size register */
+		cam_vfe_bus_rd_pxls_to_bytes(io_cfg->planes[i].width,
+			rm_data->unpacker_cfg, &rm_data->width);
+		rm_data->height = io_cfg->planes[i].height;
+
+		buf_size = ((rm_data->width)&(0x0000FFFF)) |
+			((rm_data->height<<16)&(0xFFFF0000));
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->buf_size, buf_size);
+		CAM_DBG(CAM_ISP, "VFE:%d RM:%d image_size:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+
+		rm_data->stride = io_cfg->planes[i].plane_stride;
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->stride, rm_data->stride);
+		CAM_DBG(CAM_ISP, "VFE:%d RM:%d image_stride:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->image_addr,
+			update_buf->rm_update->image_buf[i] +
+				rm_data->offset);
+		CAM_DBG(CAM_ISP, "VFE:%d RM:%d image_address:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+		rm_data->img_addr = reg_val_pair[j-1];
+
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_buf->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				update_buf->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_buf->cmd.cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_buf->cmd.used_bytes = size * 4;
+	} else {
+		update_buf->cmd.used_bytes = 0;
+		CAM_DBG(CAM_ISP,
+			"No reg val pairs. num_rms: %u",
+			vfe_bus_rd_data->num_rm);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_rd_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	return 0;
+}
+
+static int cam_vfe_bus_rd_update_fs_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_rd_ver1_priv              *bus_priv;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data   *vfe_bus_rd_data = NULL;
+	struct cam_vfe_bus_rd_ver1_rm_resource_data  *rm_data = NULL;
+	struct cam_vfe_fe_update_args                *fe_upd_args;
+	struct cam_fe_config                         *fe_cfg;
+	int i = 0;
+
+	bus_priv = (struct cam_vfe_bus_rd_ver1_priv  *) priv;
+	fe_upd_args = (struct cam_vfe_fe_update_args *)cmd_args;
+
+	vfe_bus_rd_data = (struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data *)
+		fe_upd_args->node_res->res_priv;
+
+	if (!vfe_bus_rd_data || !vfe_bus_rd_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	fe_cfg = &fe_upd_args->fe_config;
+
+	for (i = 0; i < vfe_bus_rd_data->num_rm; i++) {
+
+		rm_data = vfe_bus_rd_data->rm_res[i]->res_priv;
+
+		rm_data->format = fe_cfg->format;
+		rm_data->unpacker_cfg = fe_cfg->unpacker_cfg;
+		rm_data->latency_buf_allocation = fe_cfg->latency_buf_size;
+		rm_data->stride = fe_cfg->stride;
+		rm_data->go_cmd_sel = fe_cfg->go_cmd_sel;
+		rm_data->fs_sync_enable = fe_cfg->fs_sync_enable;
+		rm_data->hbi_count = fe_cfg->hbi_count;
+		rm_data->fs_line_sync_en = fe_cfg->fs_line_sync_en;
+		rm_data->fs_mode = fe_cfg->fs_mode;
+		rm_data->min_vbi = fe_cfg->min_vbi;
+
+		CAM_DBG(CAM_ISP,
+			"VFE:%d RM:%d format:0x%x unpacker_cfg:0x%x",
+			rm_data->format, rm_data->unpacker_cfg);
+		CAM_DBG(CAM_ISP,
+			"latency_buf_alloc:0x%x stride:0x%x go_cmd_sel:0x%x",
+			rm_data->latency_buf_allocation, rm_data->stride,
+			rm_data->go_cmd_sel);
+		CAM_DBG(CAM_ISP,
+			"fs_sync_en:%d hbi_cnt:0x%x fs_mode:0x%x min_vbi:0x%x",
+			rm_data->fs_sync_enable, rm_data->hbi_count,
+			rm_data->fs_mode, rm_data->min_vbi);
+	}
+	bus_priv->common_data.fs_sync_enable = fe_cfg->fs_sync_enable;
+	bus_priv->common_data.go_cmd_sel = fe_cfg->go_cmd_sel;
+	return 0;
+}
+
+static int cam_vfe_bus_rd_add_go_cmd(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rd_data;
+	struct cam_isp_hw_get_cmd_update            *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops                    *cdm_util_ops = NULL;
+	uint32_t reg_val_pair[2 * CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX];
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data;
+	int i = 0;
+	uint32_t val = 0, size = 0, offset = 0;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "invalid ars size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	rd_data = (struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *) priv;
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < rd_data->num_rm; i++) {
+		size = cdm_util_ops->cdm_required_size_reg_random(1);
+		/* since cdm returns dwords, we need to convert it into bytes */
+		if ((size * 4) > cdm_args->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"buf size:%d is not sufficient, expected: %d",
+				cdm_args->cmd.size, size);
+			return -EINVAL;
+		}
+
+		rsrc_data = rd_data->rm_res[i]->res_priv;
+		offset = rsrc_data->common_data->common_reg->input_if_cmd;
+		val = cam_io_r_mb(rsrc_data->common_data->mem_base + offset);
+		val |= 0x1;
+		reg_val_pair[i * 2] = offset;
+		reg_val_pair[i * 2 + 1] = val;
+		CAM_DBG(CAM_ISP, "VFE:%d Bus RD go_cmd: 0x%x offset 0x%x",
+			rd_data->common_data->core_index,
+			reg_val_pair[i * 2 + 1], reg_val_pair[i * 2]);
+	}
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+
+}
+
+static int cam_vfe_bus_start_hw(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_start_vfe_bus_rd(hw_priv);
+}
+
+static int cam_vfe_bus_stop_hw(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_stop_vfe_bus_rd(hw_priv);
+}
+
+static int cam_vfe_bus_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_rd_ver1_priv    *bus_priv = hw_priv;
+	uint32_t                            top_irq_reg_mask[3] = {0};
+	uint32_t                            offset = 0;
+	struct cam_vfe_bus_rd_ver1_reg_offset_common  *common_reg;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+	common_reg = bus_priv->common_data.common_reg;
+	top_irq_reg_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	bus_priv->irq_handle = cam_irq_controller_subscribe_irq(
+		bus_priv->common_data.vfe_irq_controller,
+		CAM_IRQ_PRIORITY_2,
+		top_irq_reg_mask,
+		bus_priv,
+		cam_vfe_bus_rd_ver1_handle_irq,
+		NULL,
+		NULL,
+		NULL,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (bus_priv->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Failed to subscribe BUS IRQ");
+		bus_priv->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	/* no clock gating at bus input */
+	offset = common_reg->cgc_ovd;
+	cam_io_w_mb(0x1, bus_priv->common_data.mem_base + offset);
+
+	/* BUS_RD_TEST_BUS_CTRL */
+	offset = common_reg->test_bus_ctrl;
+	cam_io_w_mb(0x0, bus_priv->common_data.mem_base + offset);
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_rd_ver1_priv    *bus_priv = hw_priv;
+	int                              rc = 0;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Error: Invalid args");
+		return -EINVAL;
+	}
+
+	if (bus_priv->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			bus_priv->irq_handle);
+		bus_priv->irq_handle = 0;
+	}
+
+	return rc;
+}
+
+static int __cam_vfe_bus_rd_process_cmd(void *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_rd_process_cmd(priv, cmd_type, cmd_args, arg_size);
+}
+
+static int cam_vfe_bus_rd_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM:
+		rc = cam_vfe_bus_rd_update_rm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE_RM:
+		rc = cam_vfe_bus_rd_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_RM_SECURE_MODE:
+		rc = cam_vfe_bus_rd_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD:
+		rc = cam_vfe_bus_rd_update_fs_cfg(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_FE_TRIGGER_CMD:
+		rc = cam_vfe_bus_rd_add_go_cmd(priv, cmd_args, arg_size);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid camif process command:%d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_bus_rd_ver1_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_rd_ver1_priv    *bus_priv = NULL;
+	struct cam_vfe_bus                 *vfe_bus_local;
+	struct cam_vfe_bus_rd_ver1_hw_info *bus_rd_hw_info = bus_hw_info;
+
+	if (!soc_info || !hw_intf || !bus_hw_info || !vfe_irq_controller) {
+		CAM_ERR(CAM_ISP,
+			"Inval_prms soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_rd_hw_info);
+		CAM_ERR(CAM_ISP, "controller: %pK", vfe_irq_controller);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	vfe_bus_local = kzalloc(sizeof(struct cam_vfe_bus), GFP_KERNEL);
+	if (!vfe_bus_local) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_vfe_bus_rd_ver1_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+
+	vfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                     = bus_rd_hw_info->num_client;
+	bus_priv->num_bus_rd_resc                =
+		bus_rd_hw_info->num_bus_rd_resc;
+	bus_priv->common_data.num_sec_out        = 0;
+	bus_priv->common_data.secure_mode        = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index         = soc_info->index;
+	bus_priv->common_data.mem_base           =
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf            = hw_intf;
+	bus_priv->common_data.vfe_irq_controller = vfe_irq_controller;
+	bus_priv->common_data.common_reg         = &bus_rd_hw_info->common_reg;
+	bus_priv->top_irq_shift                 = bus_rd_hw_info->top_irq_shift;
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+
+	rc = cam_irq_controller_init(drv_name, bus_priv->common_data.mem_base,
+		&bus_rd_hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "cam_irq_controller_init failed");
+		goto free_bus_priv;
+	}
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_vfe_bus_init_rm_resource(i, bus_priv, bus_hw_info,
+			&bus_priv->bus_client[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init RM failed for client:%d, rc=%d",
+				i, rc);
+			goto deinit_rm;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_bus_rd_resc; i++) {
+		rc = cam_vfe_bus_init_vfe_bus_read_resource(i, bus_priv,
+			bus_rd_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init VFE Out failed for client:%d, rc=%d",
+				i, rc);
+			goto deinit_vfe_bus_rd;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+
+	vfe_bus_local->hw_ops.reserve      = cam_vfe_bus_acquire_vfe_bus_rd;
+	vfe_bus_local->hw_ops.release      = cam_vfe_bus_release_vfe_bus_rd;
+	vfe_bus_local->hw_ops.start        = cam_vfe_bus_start_hw;
+	vfe_bus_local->hw_ops.stop         = cam_vfe_bus_stop_hw;
+	vfe_bus_local->hw_ops.init         = cam_vfe_bus_init_hw;
+	vfe_bus_local->hw_ops.deinit       = cam_vfe_bus_deinit_hw;
+	vfe_bus_local->top_half_handler    = cam_vfe_bus_rd_ver1_handle_irq;
+	vfe_bus_local->bottom_half_handler = NULL;
+	vfe_bus_local->hw_ops.process_cmd  = __cam_vfe_bus_rd_process_cmd;
+
+	*vfe_bus = vfe_bus_local;
+
+	return rc;
+
+deinit_vfe_bus_rd:
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_vfe_bus_rd_resource(
+			&bus_priv->vfe_bus_rd[i]);
+deinit_rm:
+	if (i < 0)
+		i = bus_priv->num_client;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_rm_resource(&bus_priv->bus_client[i]);
+
+free_bus_priv:
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_vfe_bus_rd_bus_ver1_deinit(
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_rd_ver1_priv    *bus_priv = NULL;
+	struct cam_vfe_bus                 *vfe_bus_local;
+
+	if (!vfe_bus || !*vfe_bus) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+	vfe_bus_local = *vfe_bus;
+
+	bus_priv = vfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_vfe_bus_deinit_rm_resource(&bus_priv->bus_client[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit RM failed rc=%d", rc);
+	}
+	for (i = 0; i < CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX; i++) {
+		rc = cam_vfe_bus_deinit_vfe_bus_rd_resource(
+			&bus_priv->vfe_bus_rd[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit VFE Out failed rc=%d", rc);
+	}
+
+	rc = cam_irq_controller_deinit(
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Deinit IRQ Controller failed rc=%d", rc);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+	*vfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.h
@@ -0,0 +1,129 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_BUS_R_VER1_H_
+#define _CAM_VFE_BUS_R_VER1_H_
+
+#include "cam_irq_controller.h"
+#include "cam_vfe_bus.h"
+
+#define CAM_VFE_BUS_RD_VER1_MAX_CLIENTS 1
+
+enum cam_vfe_bus_rd_ver1_vfe_core_id {
+	CAM_VFE_BUS_RD_VER1_VFE_CORE_0,
+	CAM_VFE_BUS_RD_VER1_VFE_CORE_1,
+	CAM_VFE_BUS_RD_VER1_VFE_CORE_MAX,
+};
+
+enum cam_vfe_bus_rd_ver1_comp_grp_type {
+	CAM_VFE_BUS_RD_VER1_COMP_GRP_0,
+	CAM_VFE_BUS_RD_VER1_COMP_GRP_MAX,
+};
+
+
+enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type {
+	CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0,
+	CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX,
+};
+
+/*
+ * struct cam_vfe_bus_rd_ver1_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_vfe_bus_rd_ver1_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t sw_reset;
+	uint32_t cgc_ovd;
+	uint32_t pwr_iso_cfg;
+	uint32_t input_if_cmd;
+	uint32_t test_bus_ctrl;
+	struct cam_irq_controller_reg_info irq_reg_info;
+};
+
+/*
+ * struct cam_vfe_bus_rd_ver1_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_vfe_bus_rd_ver1_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t buf_size;
+	uint32_t stride;
+	uint32_t unpacker_cfg;
+	uint32_t latency_buf_allocation;
+	uint32_t burst_limit;
+};
+
+/*
+ * struct cam_vfe_bus_rd_ver1_vfe_bus_hw_info:
+ *
+ * @Brief:        HW capability of VFE Bus Client
+ */
+struct cam_vfe_bus_rd_ver1_vfe_bus_hw_info {
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type  vfe_bus_rd_type;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+};
+
+/*
+ * struct cam_vfe_bus_rd_ver1_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:       Common register details
+ * @bus_client_reg:   Bus client register info
+ * @comp_reg_grp:     Composite group register info
+ * @vfe_out_hw_info:  VFE output capability
+ */
+struct cam_vfe_bus_rd_ver1_hw_info {
+	struct cam_vfe_bus_rd_ver1_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_vfe_bus_rd_ver1_reg_offset_bus_client
+		bus_client_reg[CAM_VFE_BUS_RD_VER1_MAX_CLIENTS];
+	uint32_t num_bus_rd_resc;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_hw_info
+		vfe_bus_rd_hw_info[CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX];
+	uint32_t top_irq_shift;
+};
+
+/*
+ * cam_vfe_bus_rd_ver1_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_rd_ver1_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus);
+
+/*
+ * cam_vfe_bus_rd_bus_ver1_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @vfe_bus:                 Pointer to vfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_rd_bus_ver1_deinit(struct cam_vfe_bus     **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_R_VER1_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver1.h
@@ -0,0 +1,113 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_BUS_VER1_H_
+#define _CAM_VFE_BUS_VER1_H_
+
+enum cam_vfe_bus_ver1_pingpong_id {
+	CAM_VFE_BUS_VER1_PING,
+	CAM_VFE_BUS_VER1_PONG,
+	CAM_VFE_BUS_VER1_PINGPONG_MAX,
+};
+
+enum cam_vfe_bus_ver1_wm_type {
+	CAM_VFE_BUS_WM_TYPE_IMAGE,
+	CAM_VFE_BUS_WM_TYPE_STATS,
+	CAM_VFE_BUS_WM_TYPE_MAX,
+};
+
+enum cam_vfe_bus_ver1_comp_grp_type {
+	CAM_VFE_BUS_VER1_COMP_GRP_IMG0,
+	CAM_VFE_BUS_VER1_COMP_GRP_IMG1,
+	CAM_VFE_BUS_VER1_COMP_GRP_IMG2,
+	CAM_VFE_BUS_VER1_COMP_GRP_IMG3,
+	CAM_VFE_BUS_VER1_COMP_GRP_STATS0,
+	CAM_VFE_BUS_VER1_COMP_GRP_STATS1,
+	CAM_VFE_BUS_VER1_COMP_GRP_MAX,
+};
+
+struct cam_vfe_bus_ver1_common_reg {
+	uint32_t cmd_offset;
+	uint32_t cfg_offset;
+	uint32_t io_fmt_offset;
+	uint32_t argb_cfg_offset;
+	uint32_t xbar_cfg0_offset;
+	uint32_t xbar_cfg1_offset;
+	uint32_t xbar_cfg2_offset;
+	uint32_t xbar_cfg3_offset;
+	uint32_t ping_pong_status_reg;
+};
+
+struct cam_vfe_bus_ver1_wm_reg {
+	uint32_t wm_cfg_offset;
+	uint32_t ping_addr_offset;
+	uint32_t ping_max_addr_offset;
+	uint32_t pong_addr_offset;
+	uint32_t pong_max_addr_offset;
+	uint32_t addr_cfg_offset;
+	uint32_t ub_cfg_offset;
+	uint32_t image_size_offset;
+	uint32_t buffer_cfg_offset;
+	uint32_t framedrop_pattern_offset;
+	uint32_t irq_subsample_pattern_offset;
+	uint32_t ping_pong_status_bit; /* 0 - 31 */
+	uint32_t composite_bit; /* 0 -31 */
+};
+
+struct cam_vfe_bus_ver1_wm_resource_data {
+	uint32_t             index;
+	uint32_t             wm_type;
+	uint32_t             res_type;
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             scanline;
+
+	uint32_t             burst_len;
+
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             buf_valid[CAM_VFE_BUS_VER1_PINGPONG_MAX];
+	uint32_t             ub_size;
+	uint32_t             ub_offset;
+
+	struct cam_vfe_bus_ver1_wm_reg  hw_regs;
+};
+
+struct cam_vfe_bus_ver1_comp_grp_reg {
+	enum cam_vfe_bus_ver1_comp_grp_type comp_grp_type;
+	uint32_t             comp_grp_offset;
+};
+
+struct cam_vfe_bus_ver1_comp_grp {
+	struct cam_vfe_bus_ver1_comp_grp_reg reg_info;
+	struct list_head     wm_list;
+	uint32_t             cur_bit_mask;
+};
+
+/*
+ * cam_vfe_bus_ver1_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @mem_base:                Mapped base address of register space
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ */
+int cam_vfe_bus_ver1_init(
+	void __iomem                         *mem_base,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_VER1_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
@@ -0,0 +1,3999 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_vfe_core.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+
+static const char drv_name[] = "vfe_bus";
+
+#define CAM_VFE_BUS_IRQ_REG0                     0
+#define CAM_VFE_BUS_IRQ_REG1                     1
+#define CAM_VFE_BUS_IRQ_REG2                     2
+#define CAM_VFE_BUS_IRQ_MAX                      3
+
+#define CAM_VFE_BUS_VER2_PAYLOAD_MAX             256
+
+#define CAM_VFE_BUS_SET_DEBUG_REG                0x82
+
+#define CAM_VFE_RDI_BUS_DEFAULT_WIDTH               0xFF01
+#define CAM_VFE_RDI_BUS_DEFAULT_STRIDE              0xFF01
+#define CAM_VFE_BUS_INTRA_CLIENT_MASK               0x3
+#define CAM_VFE_BUS_ADDR_SYNC_INTRA_CLIENT_SHIFT    8
+#define CAM_VFE_BUS_ADDR_NO_SYNC_DEFAULT_VAL \
+	((1 << CAM_VFE_BUS_VER2_MAX_CLIENTS) - 1)
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	((sizeof(struct cam_vfe_bus_ver2_reg_offset_bus_client) +  \
+	sizeof(struct cam_vfe_bus_ver2_reg_offset_ubwc_client))/4)
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+static uint32_t bus_error_irq_mask[3] = {
+	0x7800,
+	0x0000,
+	0x0040,
+};
+
+enum cam_vfe_bus_packer_format {
+	PACKER_FMT_PLAIN_128                   = 0x0,
+	PACKER_FMT_PLAIN_8                     = 0x1,
+	PACKER_FMT_PLAIN_16_10BPP              = 0x2,
+	PACKER_FMT_PLAIN_16_12BPP              = 0x3,
+	PACKER_FMT_PLAIN_16_14BPP              = 0x4,
+	PACKER_FMT_PLAIN_16_16BPP              = 0x5,
+	PACKER_FMT_ARGB_10                     = 0x6,
+	PACKER_FMT_ARGB_12                     = 0x7,
+	PACKER_FMT_ARGB_14                     = 0x8,
+	PACKER_FMT_PLAIN_32_20BPP              = 0x9,
+	PACKER_FMT_PLAIN_64                    = 0xA,
+	PACKER_FMT_TP_10                       = 0xB,
+	PACKER_FMT_PLAIN_32_32BPP              = 0xC,
+	PACKER_FMT_PLAIN_8_ODD_EVEN            = 0xD,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10          = 0xE,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN = 0xF,
+	PACKER_FMT_MAX                         = 0xF,
+};
+
+enum cam_vfe_bus_comp_grp_id {
+	CAM_VFE_BUS_COMP_GROUP_NONE = -EINVAL,
+	CAM_VFE_BUS_COMP_GROUP_ID_0 = 0x0,
+	CAM_VFE_BUS_COMP_GROUP_ID_1 = 0x1,
+	CAM_VFE_BUS_COMP_GROUP_ID_2 = 0x2,
+	CAM_VFE_BUS_COMP_GROUP_ID_3 = 0x3,
+	CAM_VFE_BUS_COMP_GROUP_ID_4 = 0x4,
+	CAM_VFE_BUS_COMP_GROUP_ID_5 = 0x5,
+};
+
+struct cam_vfe_bus_ver2_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *bus_irq_controller;
+	void                                       *vfe_irq_controller;
+	struct cam_vfe_bus_ver2_reg_offset_common  *common_reg;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+
+	struct cam_vfe_bus_irq_evt_payload          evt_payload[
+		CAM_VFE_BUS_VER2_PAYLOAD_MAX];
+	struct list_head                            free_payload_list;
+	spinlock_t                                  spin_lock;
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    addr_no_sync;
+	cam_hw_mgr_event_cb_func                    event_cb;
+	bool                                        hw_init;
+	bool                                        support_consumed_addr;
+	bool                                        disable_ubwc_comp;
+};
+
+struct cam_vfe_bus_ver2_wm_resource_data {
+	uint32_t             index;
+	struct cam_vfe_bus_ver2_common_data            *common_data;
+	struct cam_vfe_bus_ver2_reg_offset_bus_client  *hw_regs;
+
+	bool                 init_cfg_done;
+	bool                 hfr_cfg_done;
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	enum cam_vfe_bus_packer_format pack_fmt;
+
+	uint32_t             burst_len;
+
+	uint32_t             en_ubwc;
+	bool                 ubwc_updated;
+	uint32_t             packer_cfg;
+	uint32_t             tile_cfg;
+	uint32_t             h_init;
+	uint32_t             v_init;
+	uint32_t             ubwc_meta_stride;
+	uint32_t             ubwc_mode_cfg_0;
+	uint32_t             ubwc_mode_cfg_1;
+	uint32_t             ubwc_meta_offset;
+
+	uint32_t             irq_subsample_period;
+	uint32_t             irq_subsample_pattern;
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             en_cfg;
+	uint32_t             is_dual;
+	uint32_t             ubwc_lossy_threshold_0;
+	uint32_t             ubwc_lossy_threshold_1;
+	uint32_t             ubwc_bandwidth_limit;
+	uint32_t             acquired_width;
+	uint32_t             acquired_height;
+};
+
+struct cam_vfe_bus_ver2_comp_grp_data {
+	enum cam_vfe_bus_ver2_comp_grp_type          comp_grp_type;
+	struct cam_vfe_bus_ver2_common_data         *common_data;
+	struct cam_vfe_bus_ver2_reg_offset_comp_grp *hw_regs;
+
+	uint32_t                         comp_grp_local_idx;
+	uint32_t                         unique_id;
+
+	uint32_t                         is_master;
+	uint32_t                         dual_slave_core;
+	uint32_t                         intra_client_mask;
+	uint32_t                         composite_mask;
+	uint32_t                         addr_sync_mode;
+
+	uint32_t                         acquire_dev_cnt;
+};
+
+struct cam_vfe_bus_ver2_vfe_out_data {
+	uint32_t                              out_type;
+	struct cam_vfe_bus_ver2_common_data  *common_data;
+
+	uint32_t                         num_wm;
+	struct cam_isp_resource_node    *wm_res[PLANE_MAX];
+
+	struct cam_isp_resource_node    *comp_grp;
+	enum cam_isp_hw_sync_mode        dual_comp_sync_mode;
+	uint32_t                         dual_hw_alternate_vfe_id;
+	struct list_head                 vfe_out_list;
+
+	uint32_t                         format;
+	uint32_t                         max_width;
+	uint32_t                         max_height;
+	struct cam_cdm_utils_ops        *cdm_util_ops;
+	uint32_t                         secure_mode;
+	void                            *priv;
+	uint32_t                         mid[CAM_VFE_BUS_VER2_MAX_MID_PER_PORT];
+};
+
+struct cam_vfe_bus_ver2_priv {
+	struct cam_vfe_bus_ver2_common_data common_data;
+	uint32_t                            num_client;
+	uint32_t                            num_out;
+	uint32_t                            top_irq_shift;
+
+	struct cam_isp_resource_node  bus_client[CAM_VFE_BUS_VER2_MAX_CLIENTS];
+	struct cam_isp_resource_node  comp_grp[CAM_VFE_BUS_VER2_COMP_GRP_MAX];
+	struct cam_isp_resource_node  vfe_out[CAM_VFE_BUS_VER2_VFE_OUT_MAX];
+
+	struct list_head                    free_comp_grp;
+	struct list_head                    free_dual_comp_grp;
+	struct list_head                    used_comp_grp;
+
+	int                                 irq_handle;
+	int                                 error_irq_handle;
+	void                               *tasklet_info;
+	uint32_t                            max_out_res;
+};
+
+static int cam_vfe_bus_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+
+static int cam_vfe_bus_get_evt_payload(
+	struct cam_vfe_bus_ver2_common_data  *common_data,
+	struct cam_vfe_bus_irq_evt_payload  **evt_payload)
+{
+	int rc;
+
+	spin_lock(&common_data->spin_lock);
+
+	if (!common_data->hw_init) {
+		*evt_payload = NULL;
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE:%d Bus uninitialized",
+			common_data->core_index);
+		rc = -EPERM;
+		goto done;
+	}
+
+	if (list_empty(&common_data->free_payload_list)) {
+		*evt_payload = NULL;
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&common_data->free_payload_list,
+		struct cam_vfe_bus_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&common_data->spin_lock);
+	return rc;
+}
+
+static enum cam_vfe_bus_comp_grp_id
+	cam_vfe_bus_comp_grp_id_convert(uint32_t comp_grp)
+{
+	switch (comp_grp) {
+	case CAM_ISP_RES_COMP_GROUP_ID_0:
+		return CAM_VFE_BUS_COMP_GROUP_ID_0;
+	case CAM_ISP_RES_COMP_GROUP_ID_1:
+		return CAM_VFE_BUS_COMP_GROUP_ID_1;
+	case CAM_ISP_RES_COMP_GROUP_ID_2:
+		return CAM_VFE_BUS_COMP_GROUP_ID_2;
+	case CAM_ISP_RES_COMP_GROUP_ID_3:
+		return CAM_VFE_BUS_COMP_GROUP_ID_3;
+	case CAM_ISP_RES_COMP_GROUP_ID_4:
+		return CAM_VFE_BUS_COMP_GROUP_ID_4;
+	case CAM_ISP_RES_COMP_GROUP_ID_5:
+		return CAM_VFE_BUS_COMP_GROUP_ID_5;
+	case CAM_ISP_RES_COMP_GROUP_NONE:
+	default:
+		return CAM_VFE_BUS_COMP_GROUP_NONE;
+	}
+}
+
+static enum cam_vfe_bus_ver2_comp_grp_type
+	cam_vfe_bus_dual_comp_grp_id_convert(uint32_t comp_grp)
+{
+	switch (comp_grp) {
+	case CAM_VFE_BUS_COMP_GROUP_ID_0:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0;
+	case CAM_VFE_BUS_COMP_GROUP_ID_1:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1;
+	case CAM_VFE_BUS_COMP_GROUP_ID_2:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2;
+	case CAM_VFE_BUS_COMP_GROUP_ID_3:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3;
+	case CAM_VFE_BUS_COMP_GROUP_ID_4:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4;
+	case CAM_VFE_BUS_COMP_GROUP_ID_5:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5;
+	case CAM_VFE_BUS_COMP_GROUP_NONE:
+	default:
+		return CAM_VFE_BUS_VER2_COMP_GRP_MAX;
+	}
+}
+
+static int cam_vfe_bus_put_evt_payload(
+	struct cam_vfe_bus_ver2_common_data     *common_data,
+	struct cam_vfe_bus_irq_evt_payload     **evt_payload)
+{
+	unsigned long flags;
+
+	if (!common_data) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&common_data->spin_lock, flags);
+	if (common_data->hw_init)
+		list_add_tail(&(*evt_payload)->list,
+			&common_data->free_payload_list);
+	spin_unlock_irqrestore(&common_data->spin_lock, flags);
+
+	*evt_payload = NULL;
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_bus_ver2_get_intra_client_mask(
+	enum cam_vfe_bus_ver2_vfe_core_id  dual_slave_core,
+	enum cam_vfe_bus_ver2_vfe_core_id  current_core,
+	uint32_t                          *intra_client_mask)
+{
+	int rc = 0;
+	uint32_t camera_hw_version = 0;
+	uint32_t version_based_intra_client_mask = 0x1;
+
+	*intra_client_mask = 0;
+
+
+	if (dual_slave_core == current_core) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params. Same core as Master and Slave");
+		return -EINVAL;
+	}
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+
+	CAM_DBG(CAM_ISP, "CPAS VERSION %d", camera_hw_version);
+
+	switch (camera_hw_version) {
+	case CAM_CPAS_TITAN_170_V100:
+		version_based_intra_client_mask = 0x3;
+		break;
+	default:
+		version_based_intra_client_mask = 0x1;
+		break;
+	}
+
+
+	switch (current_core) {
+	case CAM_VFE_BUS_VER2_VFE_CORE_0:
+		switch (dual_slave_core) {
+		case CAM_VFE_BUS_VER2_VFE_CORE_1:
+		case CAM_VFE_BUS_VER2_VFE_CORE_2:
+			*intra_client_mask = version_based_intra_client_mask;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid value for slave core %u",
+				dual_slave_core);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_CORE_1:
+		switch (dual_slave_core) {
+		case CAM_VFE_BUS_VER2_VFE_CORE_0:
+		case CAM_VFE_BUS_VER2_VFE_CORE_2:
+			*intra_client_mask = version_based_intra_client_mask;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid value for slave core %u",
+				dual_slave_core);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_CORE_2:
+		switch (dual_slave_core) {
+		case CAM_VFE_BUS_VER2_VFE_CORE_0:
+		case CAM_VFE_BUS_VER2_VFE_CORE_1:
+			*intra_client_mask = version_based_intra_client_mask;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid value for slave core %u",
+				dual_slave_core);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"Invalid value for master core %u", current_core);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static bool cam_vfe_bus_can_be_secure(uint32_t out_type)
+{
+	switch (out_type) {
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16:
+	case CAM_VFE_BUS_VER2_VFE_OUT_FD:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI0:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI1:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI2:
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP:
+		return true;
+
+	case CAM_VFE_BUS_VER2_VFE_OUT_PDAF:
+	case CAM_VFE_BUS_VER2_VFE_OUT_2PD:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST:
+	default:
+		return false;
+	}
+}
+
+static enum cam_vfe_bus_ver2_vfe_out_type
+	cam_vfe_bus_get_out_res_id(uint32_t res_type)
+{
+	switch (res_type) {
+	case CAM_ISP_IFE_OUT_RES_FULL:
+		return CAM_VFE_BUS_VER2_VFE_OUT_FULL;
+	case CAM_ISP_IFE_OUT_RES_DS4:
+		return CAM_VFE_BUS_VER2_VFE_OUT_DS4;
+	case CAM_ISP_IFE_OUT_RES_DS16:
+		return CAM_VFE_BUS_VER2_VFE_OUT_DS16;
+	case CAM_ISP_IFE_OUT_RES_FD:
+		return CAM_VFE_BUS_VER2_VFE_OUT_FD;
+	case CAM_ISP_IFE_OUT_RES_RAW_DUMP:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP;
+	case CAM_ISP_IFE_OUT_RES_PDAF:
+		return CAM_VFE_BUS_VER2_VFE_OUT_PDAF;
+	case CAM_ISP_IFE_OUT_RES_2PD:
+		return CAM_VFE_BUS_VER2_VFE_OUT_2PD;
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RDI0;
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RDI1;
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RDI2;
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RDI3;
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BE:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE;
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST;
+	case CAM_ISP_IFE_OUT_RES_STATS_TL_BG:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG;
+	case CAM_ISP_IFE_OUT_RES_STATS_BF:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF;
+	case CAM_ISP_IFE_OUT_RES_STATS_AWB_BG:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG;
+	case CAM_ISP_IFE_OUT_RES_STATS_BHIST:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST;
+	case CAM_ISP_IFE_OUT_RES_STATS_RS:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS;
+	case CAM_ISP_IFE_OUT_RES_STATS_CS:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS;
+	case CAM_ISP_IFE_OUT_RES_STATS_IHIST:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST;
+	case CAM_ISP_IFE_OUT_RES_FULL_DISP:
+		return CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP;
+	case CAM_ISP_IFE_OUT_RES_DS4_DISP:
+		return CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP;
+	case CAM_ISP_IFE_OUT_RES_DS16_DISP:
+		return CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP;
+	default:
+		return CAM_VFE_BUS_VER2_VFE_OUT_MAX;
+	}
+}
+
+static int cam_vfe_bus_get_num_wm(
+	enum cam_vfe_bus_ver2_vfe_out_type    res_type,
+	uint32_t                              format)
+{
+	switch (res_type) {
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI0:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI1:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI2:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI3:
+		switch (format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_MIPI_RAW_14:
+		case CAM_FORMAT_MIPI_RAW_16:
+		case CAM_FORMAT_MIPI_RAW_20:
+		case CAM_FORMAT_DPCM_10_6_10:
+		case CAM_FORMAT_DPCM_10_8_10:
+		case CAM_FORMAT_DPCM_12_6_12:
+		case CAM_FORMAT_DPCM_12_8_12:
+		case CAM_FORMAT_DPCM_14_8_14:
+		case CAM_FORMAT_DPCM_14_10_14:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+		case CAM_FORMAT_PLAIN32_20:
+		case CAM_FORMAT_PLAIN128:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL:
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP:
+		switch (format) {
+		case CAM_FORMAT_NV21:
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_TP10:
+		case CAM_FORMAT_UBWC_NV12:
+		case CAM_FORMAT_UBWC_NV12_4R:
+		case CAM_FORMAT_UBWC_TP10:
+		case CAM_FORMAT_UBWC_P010:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+			return 2;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FD:
+		switch (format) {
+		case CAM_FORMAT_NV21:
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_TP10:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+			return 2;
+		case CAM_FORMAT_Y_ONLY:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP:
+		switch (format) {
+		case CAM_FORMAT_PD8:
+		case CAM_FORMAT_PD10:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP:
+		switch (format) {
+		case CAM_FORMAT_ARGB_14:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_PDAF:
+		switch (format) {
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_2PD:
+		switch (format) {
+		case CAM_FORMAT_PLAIN16_8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+		case CAM_FORMAT_PLAIN64:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS:
+		switch (format) {
+		case CAM_FORMAT_PLAIN64:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST:
+		switch (format) {
+		case CAM_FORMAT_PLAIN16_16:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	CAM_ERR(CAM_ISP, "Unsupported format %u for resource_type %u",
+		format, res_type);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_bus_get_wm_idx(
+	enum cam_vfe_bus_ver2_vfe_out_type vfe_out_res_id,
+	enum cam_vfe_bus_plane_type plane)
+{
+	int wm_idx = -1;
+
+	switch (vfe_out_res_id) {
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI0:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI1:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 1;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI2:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 2;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI3:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 3;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 3;
+			break;
+		case PLANE_C:
+			wm_idx = 4;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 5;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 6;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FD:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 7;
+			break;
+		case PLANE_C:
+			wm_idx = 8;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 9;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_PDAF:
+	case CAM_VFE_BUS_VER2_VFE_OUT_2PD:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 10;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 11;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 12;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 13;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 14;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 15;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 16;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 17;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 18;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 19;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 20;
+			break;
+		case PLANE_C:
+			wm_idx = 21;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 22;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 23;
+			break;
+		default:
+			break;
+		}
+		break;
+
+	default:
+		break;
+	}
+
+	return wm_idx;
+}
+
+static enum cam_vfe_bus_packer_format
+	cam_vfe_bus_get_packer_fmt(uint32_t out_fmt, int wm_index)
+{
+	switch (out_fmt) {
+	case CAM_FORMAT_NV21:
+		if ((wm_index == 4) || (wm_index == 6) || (wm_index == 21))
+			return PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN;
+		fallthrough;
+	case CAM_FORMAT_NV12:
+	case CAM_FORMAT_UBWC_NV12:
+	case CAM_FORMAT_UBWC_NV12_4R:
+	case CAM_FORMAT_Y_ONLY:
+		return PACKER_FMT_PLAIN_8_LSB_MSB_10;
+	case CAM_FORMAT_PLAIN16_16:
+		return PACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN64:
+		return PACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_PLAIN8:
+		return PACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_10_LSB:
+		return PACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return PACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return PACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN32_20:
+		return PACKER_FMT_PLAIN_32_20BPP;
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_MIPI_RAW_20:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PD8:
+	case CAM_FORMAT_PD10:
+		return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_UBWC_TP10:
+	case CAM_FORMAT_TP10:
+		return PACKER_FMT_TP_10;
+	case CAM_FORMAT_ARGB_14:
+		return PACKER_FMT_ARGB_14;
+	default:
+		return PACKER_FMT_MAX;
+	}
+	return PACKER_FMT_MAX;
+}
+
+static int cam_vfe_bus_acquire_wm(
+	struct cam_vfe_bus_ver2_priv          *ver2_bus_priv,
+	struct cam_isp_out_port_generic_info  *out_port_info,
+	void                                  *tasklet,
+	enum cam_vfe_bus_ver2_vfe_out_type     vfe_out_res_id,
+	enum cam_vfe_bus_plane_type            plane,
+	struct cam_isp_resource_node         **wm_res,
+	uint32_t                              *client_done_mask,
+	uint32_t                               is_dual)
+{
+	uint32_t wm_idx = 0;
+	struct cam_isp_resource_node              *wm_res_local = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data  *rsrc_data = NULL;
+
+	*wm_res = NULL;
+	*client_done_mask = 0;
+
+	/* No need to allocate for BUS VER2. VFE OUT to WM is fixed. */
+	wm_idx = cam_vfe_bus_get_wm_idx(vfe_out_res_id, plane);
+	if (wm_idx < 0 || wm_idx >= ver2_bus_priv->num_client) {
+		CAM_ERR(CAM_ISP, "Unsupported VFE out %d plane %d",
+			vfe_out_res_id, plane);
+		return -EINVAL;
+	}
+
+	wm_res_local = &ver2_bus_priv->bus_client[wm_idx];
+	if (wm_res_local->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "WM res not available state:%d",
+			wm_res_local->res_state);
+		return -EALREADY;
+	}
+	wm_res_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	wm_res_local->tasklet_info = tasklet;
+
+	rsrc_data = wm_res_local->res_priv;
+	rsrc_data->format = out_port_info->format;
+	rsrc_data->pack_fmt = cam_vfe_bus_get_packer_fmt(rsrc_data->format,
+		wm_idx);
+
+	rsrc_data->width = out_port_info->width;
+	rsrc_data->height = out_port_info->height;
+	rsrc_data->acquired_width = out_port_info->width;
+	rsrc_data->acquired_height = out_port_info->height;
+	rsrc_data->is_dual = is_dual;
+	/* Set WM offset value to default */
+	rsrc_data->offset  = 0;
+	CAM_DBG(CAM_ISP, "WM %d width %d height %d", rsrc_data->index,
+		rsrc_data->width, rsrc_data->height);
+
+	if (rsrc_data->index < 3) {
+		/* Write master 0-2 refers to RDI 0/ RDI 1/RDI 2 */
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_MIPI_RAW_6:
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_MIPI_RAW_14:
+		case CAM_FORMAT_MIPI_RAW_16:
+		case CAM_FORMAT_MIPI_RAW_20:
+		case CAM_FORMAT_PLAIN128:
+			rsrc_data->width = CAM_VFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride = CAM_VFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->pack_fmt = 0x0;
+			rsrc_data->en_cfg = 0x3;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->pack_fmt = 0x1;
+			rsrc_data->width = rsrc_data->width * 2;
+			rsrc_data->stride = rsrc_data->width;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+		case CAM_FORMAT_PLAIN32_20:
+			rsrc_data->width = CAM_VFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride = CAM_VFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->pack_fmt = 0x0;
+			rsrc_data->en_cfg = 0x3;
+			break;
+		case CAM_FORMAT_PLAIN64:
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->pack_fmt = 0xA;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unsupported RDI format %d",
+				rsrc_data->format);
+			return -EINVAL;
+		}
+	} else if ((rsrc_data->index < 5) ||
+		(rsrc_data->index == 7) || (rsrc_data->index == 8) ||
+		(rsrc_data->index == 20) || (rsrc_data->index == 21)) {
+		/*
+		 * Write master 3, 4 - for Full OUT , 7-8  FD OUT,
+		 * WM 20-21 = FULL_DISP
+		 */
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_UBWC_NV12_4R:
+			rsrc_data->en_ubwc = 1;
+			rsrc_data->width = ALIGNUP(rsrc_data->width, 64);
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_UBWC_NV12:
+			rsrc_data->en_ubwc = 1;
+			/* Fall through for NV12 */
+		fallthrough;
+		case CAM_FORMAT_NV21:
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_Y_ONLY:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_UBWC_TP10:
+			rsrc_data->en_ubwc = 1;
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width, 48) * 4 / 3;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_TP10:
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width, 3) * 4 / 3;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_PLAIN16_10_LSB:
+			rsrc_data->pack_fmt |= 0x10;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			rsrc_data->width *= 2;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			rsrc_data->width *= 2;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d",
+				rsrc_data->format);
+			return -EINVAL;
+		}
+		rsrc_data->en_cfg = 0x1;
+	} else if (rsrc_data->index >= 11 && rsrc_data->index < 20) {
+		/* Write master 11 - 19 stats */
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = 0x3;
+	} else if (rsrc_data->index == 10) {
+		/* Write master 10 - PDAF/2PD */
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = 0x3;
+		if (vfe_out_res_id == CAM_VFE_BUS_VER2_VFE_OUT_PDAF)
+			/* LSB aligned */
+			rsrc_data->pack_fmt |= 0x10;
+	}  else if (rsrc_data->index == 9) {
+		/* Write master 9 - Raw dump */
+		rsrc_data->width = rsrc_data->width * 2;
+		rsrc_data->stride = rsrc_data->width;
+		rsrc_data->en_cfg = 0x1;
+		/* LSB aligned */
+		rsrc_data->pack_fmt |= 0x10;
+	}  else {
+		/* Write master 5-6 DS ports */
+		uint32_t align_width;
+
+		rsrc_data->width = rsrc_data->width * 4;
+		rsrc_data->height = rsrc_data->height / 2;
+		rsrc_data->en_cfg = 0x1;
+		CAM_DBG(CAM_ISP, "before width %d", rsrc_data->width);
+		align_width = ALIGNUP(rsrc_data->width, 16);
+		if (align_width != rsrc_data->width) {
+			CAM_WARN(CAM_ISP,
+				"Override width %u with expected %u",
+				rsrc_data->width, align_width);
+			rsrc_data->width = align_width;
+		}
+	}
+
+	*client_done_mask = (1 << wm_idx);
+	*wm_res = wm_res_local;
+
+	CAM_DBG(CAM_ISP, "WM %d: processed width %d, processed  height %d",
+		rsrc_data->index, rsrc_data->width, rsrc_data->height);
+	return 0;
+}
+
+static int cam_vfe_bus_release_wm(void   *bus_priv,
+	struct cam_isp_resource_node     *wm_res)
+{
+	struct cam_vfe_bus_ver2_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->pack_fmt = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->irq_subsample_period = 0;
+	rsrc_data->irq_subsample_pattern = 0;
+	rsrc_data->framedrop_period = 0;
+	rsrc_data->framedrop_pattern = 0;
+	rsrc_data->packer_cfg = 0;
+	rsrc_data->en_ubwc = 0;
+	rsrc_data->tile_cfg = 0;
+	rsrc_data->h_init = 0;
+	rsrc_data->v_init = 0;
+	rsrc_data->ubwc_meta_stride = 0;
+	rsrc_data->ubwc_mode_cfg_0 = 0;
+	rsrc_data->ubwc_mode_cfg_1 = 0;
+	rsrc_data->ubwc_meta_offset = 0;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+
+	rsrc_data->ubwc_lossy_threshold_0 = 0;
+	rsrc_data->ubwc_lossy_threshold_1 = 0;
+	rsrc_data->ubwc_bandwidth_limit = 0;
+	wm_res->tasklet_info = NULL;
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_wm(
+	struct cam_isp_resource_node *wm_res,
+	uint32_t                     *bus_irq_reg_mask)
+{
+	int rc = 0, val = 0;
+	struct cam_vfe_bus_ver2_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_vfe_bus_ver2_common_data        *common_data =
+		rsrc_data->common_data;
+	uint32_t camera_hw_version;
+	uint32_t disable_ubwc_comp = rsrc_data->common_data->disable_ubwc_comp;
+
+	cam_io_w(0xf, common_data->mem_base + rsrc_data->hw_regs->burst_limit);
+
+	cam_io_w_mb(rsrc_data->width,
+		common_data->mem_base + rsrc_data->hw_regs->buffer_width_cfg);
+	cam_io_w(rsrc_data->height,
+		common_data->mem_base + rsrc_data->hw_regs->buffer_height_cfg);
+	cam_io_w(rsrc_data->pack_fmt,
+		common_data->mem_base + rsrc_data->hw_regs->packer_cfg);
+
+	/* Configure stride for RDIs */
+	if (rsrc_data->index < 3)
+		cam_io_w_mb(rsrc_data->stride, (common_data->mem_base +
+			rsrc_data->hw_regs->stride));
+
+	bus_irq_reg_mask[CAM_VFE_BUS_IRQ_REG1] = (1 << rsrc_data->index);
+
+	/* enable ubwc if needed*/
+	if (rsrc_data->en_ubwc) {
+		rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "failed to get HW version rc=%d", rc);
+			return rc;
+		}
+		if ((camera_hw_version > CAM_CPAS_TITAN_NONE) &&
+			(camera_hw_version < CAM_CPAS_TITAN_175_V100) &&
+			(camera_hw_version != CAM_CPAS_TITAN_165_V100)) {
+			struct cam_vfe_bus_ver2_reg_offset_ubwc_client
+				*ubwc_regs;
+
+			ubwc_regs =
+				(struct
+				cam_vfe_bus_ver2_reg_offset_ubwc_client *)
+				rsrc_data->hw_regs->ubwc_regs;
+			if (!ubwc_regs) {
+				CAM_ERR(CAM_ISP, "ubwc_regs is NULL");
+				return -EINVAL;
+			}
+			val = cam_io_r_mb(common_data->mem_base +
+				ubwc_regs->mode_cfg_0);
+			val |= 0x1;
+			if (disable_ubwc_comp) {
+				val &= ~ubwc_regs->ubwc_comp_en_bit;
+				CAM_DBG(CAM_ISP,
+					"Force disable UBWC compression, ubwc_mode_cfg: 0x%x",
+					val);
+			}
+			cam_io_w_mb(val, common_data->mem_base +
+				ubwc_regs->mode_cfg_0);
+		} else if ((camera_hw_version == CAM_CPAS_TITAN_175_V100) ||
+			(camera_hw_version == CAM_CPAS_TITAN_175_V101) ||
+			(camera_hw_version == CAM_CPAS_TITAN_175_V120) ||
+			(camera_hw_version == CAM_CPAS_TITAN_175_V130) ||
+			(camera_hw_version == CAM_CPAS_TITAN_165_V100)) {
+			struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+				*ubwc_regs;
+
+			ubwc_regs =
+				(struct
+				cam_vfe_bus_ver2_reg_offset_ubwc_3_client *)
+				rsrc_data->hw_regs->ubwc_regs;
+			if (!ubwc_regs) {
+				CAM_ERR(CAM_ISP, "ubwc_regs is NULL");
+				return -EINVAL;
+			}
+			val = cam_io_r_mb(common_data->mem_base +
+				ubwc_regs->mode_cfg_0);
+			val |= 0x1;
+			if (disable_ubwc_comp) {
+				val &= ~ubwc_regs->ubwc_comp_en_bit;
+				CAM_DBG(CAM_ISP,
+					"Force disable UBWC compression, ubwc_mode_cfg: 0x%x",
+					val);
+			}
+			cam_io_w_mb(val, common_data->mem_base +
+				ubwc_regs->mode_cfg_0);
+		} else {
+			CAM_ERR(CAM_ISP, "Invalid HW version: %d",
+				camera_hw_version);
+			return -EINVAL;
+		}
+	}
+	/* enabling Wm configuratons are taken care in update_wm().
+	 * i.e enable wm only if io buffers are allocated
+	 */
+
+	CAM_DBG(CAM_ISP, "WM res %d width = %d, height = %d", rsrc_data->index,
+		rsrc_data->width, rsrc_data->height);
+	CAM_DBG(CAM_ISP, "WM res %d pk_fmt = %d", rsrc_data->index,
+		rsrc_data->pack_fmt & PACKER_FMT_MAX);
+	CAM_DBG(CAM_ISP, "WM res %d stride = %d, burst len = %d",
+		rsrc_data->index, rsrc_data->stride, 0xf);
+	CAM_DBG(CAM_ISP, "enable WM res %d offset 0x%x val 0x%x",
+		rsrc_data->index, (uint32_t) rsrc_data->hw_regs->cfg,
+		rsrc_data->en_cfg);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_vfe_bus_stop_wm(struct cam_isp_resource_node *wm_res)
+{
+	int rc = 0;
+	struct cam_vfe_bus_ver2_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_vfe_bus_ver2_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable WM */
+	cam_io_w_mb(0x0,
+		common_data->mem_base + rsrc_data->hw_regs->cfg);
+
+	/* Disable all register access, reply on global reset */
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+
+	return rc;
+}
+
+static int cam_vfe_bus_handle_wm_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_handle_wm_done_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int rc = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node          *wm_res = handler_priv;
+	struct cam_vfe_bus_irq_evt_payload    *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver2_wm_resource_data *rsrc_data =
+		(wm_res == NULL) ? NULL : wm_res->res_priv;
+	uint32_t  *cam_ife_irq_regs;
+	uint32_t   status_reg;
+
+	if (!evt_payload || !wm_res || !rsrc_data)
+		return rc;
+
+	CAM_DBG(CAM_ISP, "addr of evt_payload = %llx core index:0x%x",
+		(uint64_t)evt_payload, evt_payload->core_index);
+	CAM_DBG(CAM_ISP, "bus_irq_status_0: = %x", evt_payload->irq_reg_val[0]);
+	CAM_DBG(CAM_ISP, "bus_irq_status_1: = %x", evt_payload->irq_reg_val[1]);
+	CAM_DBG(CAM_ISP, "bus_irq_status_2: = %x", evt_payload->irq_reg_val[2]);
+	CAM_DBG(CAM_ISP, "bus_irq_comp_err: = %x", evt_payload->irq_reg_val[3]);
+	CAM_DBG(CAM_ISP, "bus_irq_comp_owrt: = %x",
+		evt_payload->irq_reg_val[4]);
+	CAM_DBG(CAM_ISP, "bus_irq_dual_comp_err: = %x",
+		evt_payload->irq_reg_val[5]);
+	CAM_DBG(CAM_ISP, "bus_irq_dual_comp_owrt: = %x",
+		evt_payload->irq_reg_val[6]);
+
+	cam_ife_irq_regs = evt_payload->irq_reg_val;
+	status_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_STATUS1];
+
+	if (status_reg & BIT(rsrc_data->index)) {
+		cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_STATUS1] &=
+			~BIT(rsrc_data->index);
+		rc = CAM_VFE_IRQ_STATUS_SUCCESS;
+		evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+	}
+	CAM_DBG(CAM_ISP, "status_reg %x rc %d wm_idx %d",
+		status_reg, rc, rsrc_data->index);
+
+	return rc;
+}
+
+
+static int cam_vfe_bus_err_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	struct cam_vfe_bus_irq_evt_payload *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver2_priv *bus_priv = handler_priv;
+	struct cam_vfe_bus_ver2_common_data *common_data;
+	struct cam_isp_hw_event_info evt_info;
+	struct cam_isp_hw_error_event_info err_evt_info;
+	uint32_t val = 0;
+
+	if (!handler_priv || !evt_payload_priv)
+		return -EINVAL;
+
+	evt_payload = evt_payload_priv;
+	common_data = &bus_priv->common_data;
+
+	val = evt_payload->debug_status_0;
+	CAM_ERR(CAM_ISP, "Bus Violation: debug_status_0 = 0x%x", val);
+
+	if (val & 0x01)
+		CAM_INFO(CAM_ISP, "RDI 0 violation");
+
+	if (val & 0x02)
+		CAM_INFO(CAM_ISP, "RDI 1 violation");
+
+	if (val & 0x04)
+		CAM_INFO(CAM_ISP, "RDI 2 violation");
+
+	if (val & 0x08)
+		CAM_INFO(CAM_ISP, "VID Y 1:1 UBWC violation");
+
+	if (val & 0x010)
+		CAM_INFO(CAM_ISP, "VID C 1:1 UBWC violation");
+
+	if (val & 0x020)
+		CAM_INFO(CAM_ISP, "VID YC 4:1 violation");
+
+	if (val & 0x040)
+		CAM_INFO(CAM_ISP, "VID YC 16:1 violation");
+
+	if (val & 0x080)
+		CAM_INFO(CAM_ISP, "FD Y violation");
+
+	if (val & 0x0100)
+		CAM_INFO(CAM_ISP, "FD C violation");
+
+	if (val & 0x0200)
+		CAM_INFO(CAM_ISP, "RAW DUMP violation");
+
+	if (val & 0x0400)
+		CAM_INFO(CAM_ISP, "PDAF violation");
+
+	if (val & 0x0800)
+		CAM_INFO(CAM_ISP, "STATs HDR BE violation");
+
+	if (val & 0x01000)
+		CAM_INFO(CAM_ISP, "STATs HDR BHIST violation");
+
+	if (val & 0x02000)
+		CAM_INFO(CAM_ISP, "STATs TINTLESS BG violation");
+
+	if (val & 0x04000)
+		CAM_INFO(CAM_ISP, "STATs BF violation");
+
+	if (val & 0x08000)
+		CAM_INFO(CAM_ISP, "STATs AWB BG UBWC violation");
+
+	if (val & 0x010000)
+		CAM_INFO(CAM_ISP, "STATs BHIST violation");
+
+	if (val & 0x020000)
+		CAM_INFO(CAM_ISP, "STATs RS violation");
+
+	if (val & 0x040000)
+		CAM_INFO(CAM_ISP, "STATs CS violation");
+
+	if (val & 0x080000)
+		CAM_INFO(CAM_ISP, "STATs IHIST violation");
+
+	if (val & 0x0100000)
+		CAM_INFO(CAM_ISP, "DISP Y 1:1 UBWC violation");
+
+	if (val & 0x0200000)
+		CAM_INFO(CAM_ISP, "DISP C 1:1 UBWC violation");
+
+	if (val & 0x0400000)
+		CAM_INFO(CAM_ISP, "DISP YC 4:1 violation");
+
+	if (val & 0x0800000)
+		CAM_INFO(CAM_ISP, "DISP YC 16:1 violation");
+
+	cam_vfe_bus_put_evt_payload(common_data, &evt_payload);
+
+	evt_info.hw_type = CAM_ISP_HW_TYPE_VFE;
+	evt_info.hw_idx = common_data->core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	evt_info.res_id = CAM_VFE_BUS_VER2_VFE_OUT_MAX;
+
+	err_evt_info.err_type = CAM_VFE_IRQ_STATUS_VIOLATION;
+	evt_info.event_data = (void *)&err_evt_info;
+
+	if (common_data->event_cb)
+		common_data->event_cb(NULL, CAM_ISP_HW_EVENT_ERROR,
+			(void *)&evt_info);
+
+	return 0;
+}
+
+static int cam_vfe_bus_init_wm_resource(uint32_t index,
+	struct cam_vfe_bus_ver2_priv    *ver2_bus_priv,
+	struct cam_vfe_bus_ver2_hw_info *ver2_hw_info,
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_vfe_bus_ver2_wm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver2_wm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for WM res priv");
+		return -ENOMEM;
+	}
+	wm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &ver2_hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &ver2_bus_priv->common_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = cam_vfe_bus_handle_wm_done_top_half;
+	wm_res->bottom_half_handler = cam_vfe_bus_handle_wm_done_bottom_half;
+	wm_res->hw_intf = ver2_bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_wm_resource(
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_vfe_bus_ver2_wm_resource_data *rsrc_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = NULL;
+	wm_res->bottom_half_handler = NULL;
+	wm_res->hw_intf = NULL;
+
+	rsrc_data = wm_res->res_priv;
+	wm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static void cam_vfe_bus_add_wm_to_comp_grp(
+	struct cam_isp_resource_node    *comp_grp,
+	uint32_t                         composite_mask)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data  *rsrc_data = comp_grp->res_priv;
+
+	rsrc_data->composite_mask |= composite_mask;
+}
+
+static void cam_vfe_bus_match_comp_grp(
+	struct cam_vfe_bus_ver2_priv  *ver2_bus_priv,
+	struct cam_isp_resource_node **comp_grp,
+	uint32_t                       comp_grp_local_idx,
+	uint32_t                       unique_id)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data  *rsrc_data = NULL;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+
+	list_for_each_entry(comp_grp_local,
+		&ver2_bus_priv->used_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_local_idx == comp_grp_local_idx &&
+			rsrc_data->unique_id == unique_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			return;
+		}
+	}
+
+	*comp_grp = NULL;
+}
+
+static int cam_vfe_bus_get_free_dual_comp_grp(
+	struct cam_vfe_bus_ver2_priv  *ver2_bus_priv,
+	struct cam_isp_resource_node **comp_grp,
+	uint32_t                       comp_grp_local_idx)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data  *rsrc_data = NULL;
+	struct cam_isp_resource_node           *dual_comp_grp_local = NULL;
+	struct cam_isp_resource_node           *dual_comp_grp_local_temp = NULL;
+	int32_t  dual_comp_grp_idx = 0;
+	int rc = -EINVAL;
+
+	dual_comp_grp_idx = cam_vfe_bus_dual_comp_grp_id_convert(comp_grp_local_idx);
+
+	CAM_DBG(CAM_ISP, "dual_comp_grp_idx :%d", dual_comp_grp_idx);
+
+	list_for_each_entry_safe(dual_comp_grp_local, dual_comp_grp_local_temp,
+		&ver2_bus_priv->free_dual_comp_grp, list) {
+		rsrc_data = dual_comp_grp_local->res_priv;
+		CAM_DBG(CAM_ISP, "current grp type : %d expected :%d",
+			rsrc_data->comp_grp_type, dual_comp_grp_idx);
+		if (dual_comp_grp_idx != rsrc_data->comp_grp_type) {
+			continue;
+		} else {
+			list_del_init(&dual_comp_grp_local->list);
+			*comp_grp = dual_comp_grp_local;
+			return 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_vfe_bus_acquire_comp_grp(
+	struct cam_vfe_bus_ver2_priv        *ver2_bus_priv,
+	struct cam_isp_out_port_generic_info        *out_port_info,
+	void                                *tasklet,
+	uint32_t                             unique_id,
+	uint32_t                             is_dual,
+	uint32_t                             is_master,
+	enum cam_vfe_bus_ver2_vfe_core_id    dual_slave_core,
+	struct cam_isp_resource_node       **comp_grp)
+{
+	int rc = 0;
+	uint32_t bus_comp_grp_id;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+	struct cam_vfe_bus_ver2_comp_grp_data  *rsrc_data = NULL;
+
+	bus_comp_grp_id = cam_vfe_bus_comp_grp_id_convert(
+		out_port_info->comp_grp_id);
+	/* Perform match only if there is valid comp grp request */
+	if (out_port_info->comp_grp_id != CAM_ISP_RES_COMP_GROUP_NONE) {
+		/* Check if matching comp_grp already acquired */
+		cam_vfe_bus_match_comp_grp(ver2_bus_priv, &comp_grp_local,
+			bus_comp_grp_id, unique_id);
+	}
+
+	if (!comp_grp_local) {
+		/* First find a free group */
+		if (is_dual) {
+			CAM_DBG(CAM_ISP, "Acquire dual comp group");
+			if (list_empty(&ver2_bus_priv->free_dual_comp_grp)) {
+				CAM_ERR(CAM_ISP, "No Free Composite Group");
+				return -ENODEV;
+			}
+			rc = cam_vfe_bus_get_free_dual_comp_grp(
+				ver2_bus_priv, &comp_grp_local, bus_comp_grp_id);
+			if (rc || !comp_grp_local) {
+				CAM_ERR(CAM_ISP,
+					"failed to acquire dual comp grp for :%d rc :%d",
+					bus_comp_grp_id, rc);
+					return rc;
+			}
+			rsrc_data = comp_grp_local->res_priv;
+			rc = cam_vfe_bus_ver2_get_intra_client_mask(
+				dual_slave_core,
+				comp_grp_local->hw_intf->hw_idx,
+				&rsrc_data->intra_client_mask);
+			if (rc)
+				return rc;
+		} else {
+			CAM_DBG(CAM_ISP, "Acquire comp group");
+			if (list_empty(&ver2_bus_priv->free_comp_grp)) {
+				CAM_ERR(CAM_ISP, "No Free Composite Group");
+				return -ENODEV;
+			}
+			comp_grp_local = list_first_entry(
+				&ver2_bus_priv->free_comp_grp,
+				struct cam_isp_resource_node, list);
+			rsrc_data = comp_grp_local->res_priv;
+		}
+
+		list_del(&comp_grp_local->list);
+		comp_grp_local->tasklet_info = tasklet;
+		comp_grp_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		rsrc_data->is_master = is_master;
+		rsrc_data->composite_mask = 0;
+		rsrc_data->unique_id = unique_id;
+		rsrc_data->comp_grp_local_idx = bus_comp_grp_id;
+
+		if (is_master)
+			rsrc_data->addr_sync_mode = 0;
+		else
+			rsrc_data->addr_sync_mode = 1;
+
+		list_add_tail(&comp_grp_local->list,
+			&ver2_bus_priv->used_comp_grp);
+
+	} else {
+		rsrc_data = comp_grp_local->res_priv;
+		/* Do not support runtime change in composite mask */
+		if (comp_grp_local->res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) {
+			CAM_ERR(CAM_ISP, "Invalid State %d Comp Grp %u",
+				comp_grp_local->res_state,
+				rsrc_data->comp_grp_type);
+			return -EBUSY;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Comp Grp type %u", rsrc_data->comp_grp_type);
+
+	rsrc_data->acquire_dev_cnt++;
+	*comp_grp = comp_grp_local;
+
+	return rc;
+}
+
+static int cam_vfe_bus_release_comp_grp(
+	struct cam_vfe_bus_ver2_priv         *ver2_bus_priv,
+	struct cam_isp_resource_node         *in_comp_grp)
+{
+	struct cam_isp_resource_node           *comp_grp = NULL;
+	struct cam_vfe_bus_ver2_comp_grp_data  *in_rsrc_data = NULL;
+	int match_found = 0;
+
+	if (!in_comp_grp) {
+		CAM_ERR(CAM_ISP, "Invalid Params Comp Grp %pK", in_comp_grp);
+		return -EINVAL;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "Already released Comp Grp");
+		return 0;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "Invalid State %d",
+			in_comp_grp->res_state);
+		return -EBUSY;
+	}
+
+	in_rsrc_data = in_comp_grp->res_priv;
+	CAM_DBG(CAM_ISP, "Comp Grp type %u", in_rsrc_data->comp_grp_type);
+
+	list_for_each_entry(comp_grp, &ver2_bus_priv->used_comp_grp, list) {
+		if (comp_grp == in_comp_grp) {
+			match_found = 1;
+			break;
+		}
+	}
+
+	if (!match_found) {
+		CAM_ERR(CAM_ISP, "Could not find matching Comp Grp type %u",
+			in_rsrc_data->comp_grp_type);
+		return -ENODEV;
+	}
+
+	in_rsrc_data->acquire_dev_cnt--;
+	if (in_rsrc_data->acquire_dev_cnt == 0) {
+		list_del(&comp_grp->list);
+
+		in_rsrc_data->unique_id = 0;
+		in_rsrc_data->comp_grp_local_idx = CAM_VFE_BUS_COMP_GROUP_NONE;
+		in_rsrc_data->composite_mask = 0;
+		in_rsrc_data->dual_slave_core = CAM_VFE_BUS_VER2_VFE_CORE_MAX;
+		in_rsrc_data->addr_sync_mode = 0;
+
+		comp_grp->tasklet_info = NULL;
+		comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+		if (in_rsrc_data->comp_grp_type >=
+			CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 &&
+			in_rsrc_data->comp_grp_type <=
+			CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5)
+			list_add_tail(&comp_grp->list,
+				&ver2_bus_priv->free_dual_comp_grp);
+		else if (in_rsrc_data->comp_grp_type >=
+			CAM_VFE_BUS_VER2_COMP_GRP_0 &&
+			in_rsrc_data->comp_grp_type <=
+			CAM_VFE_BUS_VER2_COMP_GRP_5)
+			list_add_tail(&comp_grp->list,
+				&ver2_bus_priv->free_comp_grp);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_comp_grp(
+	struct cam_isp_resource_node *comp_grp,
+	uint32_t                     *bus_irq_reg_mask)
+{
+	int rc = 0;
+	uint32_t addr_sync_cfg;
+	struct cam_vfe_bus_ver2_comp_grp_data      *rsrc_data =
+		comp_grp->res_priv;
+	struct cam_vfe_bus_ver2_common_data        *common_data =
+		rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP, "comp group id:%d streaming state:%d",
+		rsrc_data->comp_grp_type, comp_grp->res_state);
+
+	cam_io_w_mb(rsrc_data->composite_mask, common_data->mem_base +
+		rsrc_data->hw_regs->comp_mask);
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		return 0;
+
+	CAM_DBG(CAM_ISP, "composite_mask is 0x%x", rsrc_data->composite_mask);
+	CAM_DBG(CAM_ISP, "composite_mask addr 0x%x",
+		rsrc_data->hw_regs->comp_mask);
+
+	if (rsrc_data->comp_grp_type >= CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 &&
+		rsrc_data->comp_grp_type <= CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5) {
+		int dual_comp_grp = (rsrc_data->comp_grp_type -
+			CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0);
+
+		if (rsrc_data->is_master) {
+			int intra_client_en = cam_io_r_mb(
+				common_data->mem_base +
+				common_data->common_reg->dual_master_comp_cfg);
+
+			/*
+			 * 2 Bits per comp_grp. Hence left shift by
+			 * comp_grp * 2
+			 */
+			intra_client_en |=
+				(rsrc_data->intra_client_mask <<
+					(dual_comp_grp * 2));
+
+			cam_io_w_mb(intra_client_en, common_data->mem_base +
+				common_data->common_reg->dual_master_comp_cfg);
+
+			bus_irq_reg_mask[CAM_VFE_BUS_IRQ_REG2] =
+				(1 << dual_comp_grp);
+		}
+
+		CAM_DBG(CAM_ISP, "addr_sync_mask addr 0x%x",
+			rsrc_data->hw_regs->addr_sync_mask);
+		cam_io_w_mb(rsrc_data->composite_mask, common_data->mem_base +
+			rsrc_data->hw_regs->addr_sync_mask);
+
+		addr_sync_cfg = cam_io_r_mb(common_data->mem_base +
+			common_data->common_reg->addr_sync_cfg);
+		addr_sync_cfg |= (rsrc_data->addr_sync_mode << dual_comp_grp);
+		/*
+		 * 2 Bits per dual_comp_grp. dual_comp_grp stats at bit number
+		 * 8. Hence left shift cdual_comp_grp dual comp_grp * 2 and
+		 * add 8
+		 */
+		addr_sync_cfg |=
+			(rsrc_data->intra_client_mask <<
+				((dual_comp_grp * 2) +
+				CAM_VFE_BUS_ADDR_SYNC_INTRA_CLIENT_SHIFT));
+		cam_io_w_mb(addr_sync_cfg, common_data->mem_base +
+			common_data->common_reg->addr_sync_cfg);
+
+		common_data->addr_no_sync &= ~(rsrc_data->composite_mask);
+		cam_io_w_mb(common_data->addr_no_sync, common_data->mem_base +
+			common_data->common_reg->addr_sync_no_sync);
+		CAM_DBG(CAM_ISP, "addr_sync_cfg: 0x%x addr_no_sync_cfg: 0x%x",
+			addr_sync_cfg, common_data->addr_no_sync);
+	} else {
+		/* IRQ bits for COMP GRP start at 5. So add 5 to the shift */
+		bus_irq_reg_mask[CAM_VFE_BUS_IRQ_REG0] =
+			(1 << (rsrc_data->comp_grp_type + 5));
+	}
+
+	CAM_DBG(CAM_ISP, "VFE start COMP_GRP%d", rsrc_data->comp_grp_type);
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_vfe_bus_stop_comp_grp(struct cam_isp_resource_node *comp_grp)
+{
+	int rc = 0;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return rc;
+}
+
+static int cam_vfe_bus_handle_comp_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_handle_comp_done_bottom_half(void *handler_priv,
+	void  *evt_payload_priv, uint32_t *grp_id)
+{
+	int rc = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node          *comp_grp = handler_priv;
+	struct cam_vfe_bus_irq_evt_payload    *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver2_comp_grp_data *rsrc_data = comp_grp->res_priv;
+	uint32_t                              *cam_ife_irq_regs;
+	uint32_t                               status_reg;
+	uint32_t                               comp_err_reg;
+	uint32_t                               comp_grp_id;
+
+	CAM_DBG(CAM_ISP, "comp grp type %d", rsrc_data->comp_grp_type);
+
+	if (!evt_payload)
+		return rc;
+
+	cam_ife_irq_regs = evt_payload->irq_reg_val;
+
+	switch (rsrc_data->comp_grp_type) {
+	case CAM_VFE_BUS_VER2_COMP_GRP_0:
+	case CAM_VFE_BUS_VER2_COMP_GRP_1:
+	case CAM_VFE_BUS_VER2_COMP_GRP_2:
+	case CAM_VFE_BUS_VER2_COMP_GRP_3:
+	case CAM_VFE_BUS_VER2_COMP_GRP_4:
+	case CAM_VFE_BUS_VER2_COMP_GRP_5:
+		comp_grp_id = (rsrc_data->comp_grp_type -
+			CAM_VFE_BUS_VER2_COMP_GRP_0);
+
+		/* Check for Regular composite error */
+		status_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_STATUS0];
+
+		comp_err_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_COMP_ERR];
+		if ((status_reg & BIT(11)) &&
+			(comp_err_reg & rsrc_data->composite_mask)) {
+			/* Check for Regular composite error */
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_ERROR;
+			rc = CAM_VFE_IRQ_STATUS_ERR_COMP;
+			break;
+		}
+
+		comp_err_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_COMP_OWRT];
+		/* Check for Regular composite Overwrite */
+		if ((status_reg & BIT(12)) &&
+			(comp_err_reg & rsrc_data->composite_mask)) {
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_ERROR;
+			rc = CAM_VFE_IRQ_STATUS_COMP_OWRT;
+			break;
+		}
+
+		/* Regular Composite SUCCESS */
+		if (status_reg & BIT(comp_grp_id + 5)) {
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+			rc = CAM_VFE_IRQ_STATUS_SUCCESS;
+		}
+
+		CAM_DBG(CAM_ISP, "status reg = 0x%x, bit index = %d rc %d",
+			status_reg, (comp_grp_id + 5), rc);
+		break;
+
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5:
+		comp_grp_id = (rsrc_data->comp_grp_type -
+			CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0);
+
+		/* Check for DUAL composite error */
+		status_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_STATUS2];
+
+		comp_err_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_DUAL_COMP_ERR];
+		if ((status_reg & BIT(6)) &&
+			(comp_err_reg & rsrc_data->composite_mask)) {
+			/* Check for DUAL composite error */
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_ERROR;
+			rc = CAM_VFE_IRQ_STATUS_ERR_COMP;
+			break;
+		}
+
+		/* Check for Dual composite Overwrite */
+		comp_err_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_DUAL_COMP_OWRT];
+		if ((status_reg & BIT(7)) &&
+			(comp_err_reg & rsrc_data->composite_mask)) {
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_ERROR;
+			rc = CAM_VFE_IRQ_STATUS_COMP_OWRT;
+			break;
+		}
+
+		/* DUAL Composite SUCCESS */
+		if (status_reg & BIT(comp_grp_id)) {
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+			rc = CAM_VFE_IRQ_STATUS_SUCCESS;
+		}
+
+		break;
+	default:
+		rc = CAM_VFE_IRQ_STATUS_ERR;
+		CAM_ERR(CAM_ISP, "Invalid comp_grp_type %u",
+			rsrc_data->comp_grp_type);
+		break;
+	}
+
+	*grp_id = rsrc_data->comp_grp_type;
+
+	return rc;
+}
+
+static int cam_vfe_bus_init_comp_grp(uint32_t index,
+	struct cam_vfe_bus_ver2_priv    *ver2_bus_priv,
+	struct cam_vfe_bus_ver2_hw_info *ver2_hw_info,
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data *rsrc_data = NULL;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver2_comp_grp_data),
+		GFP_KERNEL);
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	comp_grp->res_priv = rsrc_data;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&comp_grp->list);
+
+	rsrc_data->comp_grp_type   = index;
+	rsrc_data->common_data     = &ver2_bus_priv->common_data;
+	rsrc_data->hw_regs         = &ver2_hw_info->comp_grp_reg[index];
+	rsrc_data->dual_slave_core = CAM_VFE_BUS_VER2_VFE_CORE_MAX;
+
+	if (rsrc_data->comp_grp_type >= CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 &&
+		rsrc_data->comp_grp_type <= CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5)
+		list_add_tail(&comp_grp->list,
+			&ver2_bus_priv->free_dual_comp_grp);
+	else if (rsrc_data->comp_grp_type >= CAM_VFE_BUS_VER2_COMP_GRP_0
+		&& rsrc_data->comp_grp_type <= CAM_VFE_BUS_VER2_COMP_GRP_5)
+		list_add_tail(&comp_grp->list, &ver2_bus_priv->free_comp_grp);
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = cam_vfe_bus_handle_comp_done_top_half;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = ver2_bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_comp_grp(
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data *rsrc_data =
+		comp_grp->res_priv;
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = NULL;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = NULL;
+
+	list_del_init(&comp_grp->list);
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+	comp_grp->res_priv = NULL;
+
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "comp_grp_priv is NULL");
+		return -ENODEV;
+	}
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+
+	struct cam_isp_hw_get_cmd_update      *secure_mode = cmd_args;
+	struct cam_vfe_bus_ver2_vfe_out_data  *rsrc_data;
+	uint32_t                              *mode;
+
+	rsrc_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode =
+		(rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_vfe_bus_acquire_vfe_out(void *bus_priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                     rc = -ENODEV;
+	int                                     i;
+	enum cam_vfe_bus_ver2_vfe_out_type      vfe_out_res_id;
+	uint32_t                                format;
+	int                                     num_wm;
+	uint32_t                                client_done_mask;
+	struct cam_vfe_bus_ver2_priv           *ver2_bus_priv = bus_priv;
+	struct cam_vfe_acquire_args            *acq_args = acquire_args;
+	struct cam_vfe_hw_vfe_out_acquire_args *out_acquire_args;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data   *rsrc_data = NULL;
+	uint32_t                                secure_caps = 0, mode;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_ISP, "Invalid Param");
+		return -EINVAL;
+	}
+
+	out_acquire_args = &acq_args->vfe_out;
+	format = out_acquire_args->out_port_info->format;
+
+	CAM_DBG(CAM_ISP, "Acquiring resource type 0x%x",
+		out_acquire_args->out_port_info->res_type);
+
+	vfe_out_res_id = cam_vfe_bus_get_out_res_id(
+		out_acquire_args->out_port_info->res_type);
+	if (vfe_out_res_id == CAM_VFE_BUS_VER2_VFE_OUT_MAX)
+		return -ENODEV;
+
+	num_wm = cam_vfe_bus_get_num_wm(vfe_out_res_id, format);
+	if (num_wm < 1)
+		return -EINVAL;
+
+	rsrc_node = &ver2_bus_priv->vfe_out[vfe_out_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "Resource not available: Res_id %d state:%d",
+			vfe_out_res_id, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	rsrc_data = rsrc_node->res_priv;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->common_data->disable_ubwc_comp =
+		out_acquire_args->disable_ubwc_comp;
+	rsrc_data->priv = acq_args->priv;
+
+	secure_caps = cam_vfe_bus_can_be_secure(rsrc_data->out_type);
+	mode = out_acquire_args->out_port_info->secure_mode;
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (!rsrc_data->common_data->num_sec_out) {
+			rsrc_data->secure_mode = mode;
+			rsrc_data->common_data->secure_mode = mode;
+		} else {
+			if (mode == rsrc_data->common_data->secure_mode) {
+				rsrc_data->secure_mode =
+					rsrc_data->common_data->secure_mode;
+			} else {
+				rc = -EINVAL;
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"Mismatch: Acquire mode[%d], drvr mode[%d]",
+					rsrc_data->common_data->secure_mode,
+					mode);
+				mutex_unlock(
+					&rsrc_data->common_data->bus_mutex);
+				return rc;
+			}
+		}
+		rsrc_data->common_data->num_sec_out++;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	ver2_bus_priv->tasklet_info = acq_args->tasklet;
+	rsrc_data->num_wm = num_wm;
+	rsrc_node->res_id = out_acquire_args->out_port_info->res_type;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = out_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = out_acquire_args->cdm_ops;
+
+	/* Reserve Composite Group */
+	if (num_wm > 1 || (out_acquire_args->is_dual) ||
+		(out_acquire_args->out_port_info->comp_grp_id >
+		CAM_ISP_RES_COMP_GROUP_NONE &&
+		out_acquire_args->out_port_info->comp_grp_id <
+		CAM_ISP_RES_COMP_GROUP_ID_MAX)) {
+
+		rc = cam_vfe_bus_acquire_comp_grp(ver2_bus_priv,
+			out_acquire_args->out_port_info,
+			acq_args->tasklet,
+			out_acquire_args->unique_id,
+			out_acquire_args->is_dual,
+			out_acquire_args->is_master,
+			out_acquire_args->dual_slave_core,
+			&rsrc_data->comp_grp);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE%d Comp_Grp acquire fail for Out %d rc=%d",
+				rsrc_data->common_data->core_index,
+				vfe_out_res_id, rc);
+			return rc;
+		}
+	}
+
+	/* Reserve WM */
+	for (i = 0; i < num_wm; i++) {
+		rc = cam_vfe_bus_acquire_wm(ver2_bus_priv,
+			out_acquire_args->out_port_info,
+			acq_args->tasklet,
+			vfe_out_res_id,
+			i,
+			&rsrc_data->wm_res[i],
+			&client_done_mask,
+			out_acquire_args->is_dual);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE%d WM acquire failed for Out %d rc=%d",
+				rsrc_data->common_data->core_index,
+				vfe_out_res_id, rc);
+			goto release_wm;
+		}
+
+		if (rsrc_data->comp_grp)
+			cam_vfe_bus_add_wm_to_comp_grp(rsrc_data->comp_grp,
+				client_done_mask);
+	}
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	out_acquire_args->rsrc_node = rsrc_node;
+
+	CAM_DBG(CAM_ISP, "Acquire successful");
+	return rc;
+
+release_wm:
+	for (i--; i >= 0; i--)
+		cam_vfe_bus_release_wm(ver2_bus_priv, rsrc_data->wm_res[i]);
+
+	cam_vfe_bus_release_comp_grp(ver2_bus_priv,
+		rsrc_data->comp_grp);
+
+	return rc;
+}
+
+static int cam_vfe_bus_release_vfe_out(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node          *vfe_out = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data  *rsrc_data = NULL;
+	uint32_t                               secure_caps = 0;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	vfe_out = release_args;
+	rsrc_data = vfe_out->res_priv;
+
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid resource state:%d",
+			vfe_out->res_state);
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		cam_vfe_bus_release_wm(bus_priv, rsrc_data->wm_res[i]);
+	rsrc_data->num_wm = 0;
+
+	if (rsrc_data->comp_grp)
+		cam_vfe_bus_release_comp_grp(bus_priv, rsrc_data->comp_grp);
+	rsrc_data->comp_grp = NULL;
+
+	vfe_out->tasklet_info = NULL;
+	vfe_out->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+
+	secure_caps = cam_vfe_bus_can_be_secure(rsrc_data->out_type);
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (rsrc_data->secure_mode ==
+			rsrc_data->common_data->secure_mode) {
+			rsrc_data->common_data->num_sec_out--;
+			rsrc_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+		} else {
+			/*
+			 * The validity of the mode is properly
+			 * checked while acquiring the output port.
+			 * not expected to reach here, unless there is
+			 * some corruption.
+			 */
+			CAM_ERR(CAM_ISP, "driver[%d],resource[%d] mismatch",
+				rsrc_data->common_data->secure_mode,
+				rsrc_data->secure_mode);
+		}
+
+		if (!rsrc_data->common_data->num_sec_out)
+			rsrc_data->common_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		vfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_vfe_out(
+	struct cam_isp_resource_node          *vfe_out)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_ver2_vfe_out_data  *rsrc_data = NULL;
+	struct cam_vfe_bus_ver2_common_data   *common_data = NULL;
+	uint32_t bus_irq_reg_mask[CAM_VFE_BUS_IRQ_MAX];
+
+	if (!vfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP, "Start resource index %d", rsrc_data->out_type);
+
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid resource state:%d",
+			vfe_out->res_state);
+		return -EACCES;
+	}
+
+	memset(bus_irq_reg_mask, 0, sizeof(bus_irq_reg_mask));
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_vfe_bus_start_wm(rsrc_data->wm_res[i],
+			bus_irq_reg_mask);
+
+	if (rsrc_data->comp_grp) {
+		memset(bus_irq_reg_mask, 0, sizeof(bus_irq_reg_mask));
+		rc = cam_vfe_bus_start_comp_grp(rsrc_data->comp_grp,
+			bus_irq_reg_mask);
+	}
+
+	vfe_out->irq_handle = cam_irq_controller_subscribe_irq(
+		common_data->bus_irq_controller, CAM_IRQ_PRIORITY_1,
+		bus_irq_reg_mask, vfe_out, vfe_out->top_half_handler,
+		vfe_out->bottom_half_handler, vfe_out->tasklet_info,
+		&tasklet_bh_api, CAM_IRQ_EVT_GROUP_0);
+
+	if (vfe_out->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Subscribe IRQ failed for res_id %d",
+			vfe_out->res_id);
+		vfe_out->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_vfe_bus_stop_vfe_out(
+	struct cam_isp_resource_node          *vfe_out)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_ver2_vfe_out_data  *rsrc_data = NULL;
+	struct cam_vfe_bus_ver2_common_data   *common_data = NULL;
+
+	if (!vfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		vfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "vfe_out res_state is %d", vfe_out->res_state);
+		return rc;
+	}
+
+	if (rsrc_data->comp_grp)
+		rc = cam_vfe_bus_stop_comp_grp(rsrc_data->comp_grp);
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_vfe_bus_stop_wm(rsrc_data->wm_res[i]);
+
+	if (vfe_out->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			common_data->bus_irq_controller,
+			vfe_out->irq_handle);
+		vfe_out->irq_handle = 0;
+	}
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_vfe_bus_handle_vfe_out_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                     rc;
+	int                                         i;
+	struct cam_isp_resource_node               *vfe_out = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data       *rsrc_data = NULL;
+	struct cam_vfe_bus_irq_evt_payload         *evt_payload;
+
+	vfe_out = th_payload->handler_priv;
+	if (!vfe_out) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = 0x%x", th_payload->evt_status_arr[0]);
+	CAM_DBG(CAM_ISP, "IRQ status_1 = 0x%x", th_payload->evt_status_arr[1]);
+	CAM_DBG(CAM_ISP, "IRQ status_2 = 0x%x", th_payload->evt_status_arr[2]);
+
+	rc  = cam_vfe_bus_get_evt_payload(rsrc_data->common_data, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"IRQ status_0 = 0x%x status_1 = 0x%x status_2 = 0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1],
+			th_payload->evt_status_arr[2]);
+
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	evt_payload->core_index = rsrc_data->common_data->core_index;
+	evt_payload->evt_id  = evt_id;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_bus_handle_vfe_out_done_bottom_half(
+	void                                     *handler_priv,
+	void                                     *evt_payload_priv)
+{
+	int rc = -EINVAL;
+	struct cam_isp_resource_node             *vfe_out = handler_priv;
+	struct cam_vfe_bus_ver2_vfe_out_data     *rsrc_data = vfe_out->res_priv;
+	struct cam_isp_hw_event_info              evt_info;
+	struct cam_isp_hw_bufdone_event_info      bufdone_evt_info = {0};
+	void                                     *ctx = NULL;
+	uint32_t                                  evt_id = 0;
+	uint32_t                                  comp_grp_id = 0;
+	struct cam_vfe_bus_irq_evt_payload       *evt_payload =
+		evt_payload_priv;
+
+	/*
+	 * If this resource has Composite Group then we only handle
+	 * Composite done. We acquire Composite if number of WM > 1.
+	 * So Else case is only one individual buf_done = WM[0].
+	 */
+	if (rsrc_data->comp_grp) {
+		rc = cam_vfe_bus_handle_comp_done_bottom_half(
+			rsrc_data->comp_grp, evt_payload_priv, &comp_grp_id);
+	} else {
+		rc = rsrc_data->wm_res[0]->bottom_half_handler(
+			rsrc_data->wm_res[0], evt_payload_priv);
+	}
+
+	ctx = rsrc_data->priv;
+
+	CAM_DBG(CAM_ISP, "vfe_out %d rc %d", rsrc_data->out_type, rc);
+
+	switch (rc) {
+	case CAM_VFE_IRQ_STATUS_SUCCESS:
+		evt_id = evt_payload->evt_id;
+
+		evt_info.hw_type = CAM_ISP_HW_TYPE_VFE;
+		evt_info.res_type = vfe_out->res_type;
+		evt_info.hw_idx   = vfe_out->hw_intf->hw_idx;
+		if (rsrc_data->comp_grp) {
+			bufdone_evt_info.res_id = vfe_out->res_id;
+			bufdone_evt_info.comp_grp_id = comp_grp_id;
+		} else
+			bufdone_evt_info.res_id = vfe_out->res_id;
+
+		evt_info.event_data = (void *)&bufdone_evt_info;
+		if (rsrc_data->common_data->event_cb)
+			rsrc_data->common_data->event_cb(ctx,
+				evt_id, (void *)&evt_info);
+		break;
+	default:
+		break;
+	}
+
+	cam_vfe_bus_put_evt_payload(rsrc_data->common_data, &evt_payload);
+
+	return rc;
+}
+
+static int cam_vfe_bus_init_vfe_out_resource(uint32_t  index,
+	struct cam_vfe_bus_ver2_priv                  *ver2_bus_priv,
+	struct cam_vfe_bus_ver2_hw_info               *ver2_hw_info)
+{
+	struct cam_isp_resource_node         *vfe_out = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data *rsrc_data = NULL;
+	int rc = 0, i;
+	int32_t vfe_out_type =
+		ver2_hw_info->vfe_out_hw_info[index].vfe_out_type;
+
+	if (vfe_out_type < 0 ||
+		vfe_out_type >= CAM_VFE_BUS_VER2_VFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "Init VFE Out failed, Invalid type=%d",
+			vfe_out_type);
+		return -EINVAL;
+	}
+
+	vfe_out = &ver2_bus_priv->vfe_out[vfe_out_type];
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		vfe_out->res_priv) {
+		CAM_ERR(CAM_ISP,
+			"Error. Looks like same resource is init again");
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver2_vfe_out_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	vfe_out->res_priv = rsrc_data;
+
+	vfe_out->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&vfe_out->list);
+
+	rsrc_data->out_type    =
+		ver2_hw_info->vfe_out_hw_info[index].vfe_out_type;
+	rsrc_data->common_data = &ver2_bus_priv->common_data;
+	rsrc_data->max_width   =
+		ver2_hw_info->vfe_out_hw_info[index].max_width;
+	rsrc_data->max_height  =
+		ver2_hw_info->vfe_out_hw_info[index].max_height;
+	rsrc_data->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+
+	vfe_out->start = cam_vfe_bus_start_vfe_out;
+	vfe_out->stop = cam_vfe_bus_stop_vfe_out;
+	vfe_out->top_half_handler = cam_vfe_bus_handle_vfe_out_done_top_half;
+	vfe_out->bottom_half_handler =
+		cam_vfe_bus_handle_vfe_out_done_bottom_half;
+	vfe_out->process_cmd = cam_vfe_bus_process_cmd;
+	vfe_out->hw_intf = ver2_bus_priv->common_data.hw_intf;
+	vfe_out->irq_handle = 0;
+
+	for (i = 0; i < CAM_VFE_BUS_VER2_MAX_MID_PER_PORT; i++)
+		rsrc_data->mid[i] = ver2_hw_info->vfe_out_hw_info[index].mid[i];
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_vfe_out_resource(
+	struct cam_isp_resource_node    *vfe_out)
+{
+	struct cam_vfe_bus_ver2_vfe_out_data *rsrc_data = vfe_out->res_priv;
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		CAM_DBG(CAM_ISP, "HW%d Res %d already deinitialized");
+		return 0;
+	}
+
+	vfe_out->start = NULL;
+	vfe_out->stop = NULL;
+	vfe_out->top_half_handler = NULL;
+	vfe_out->bottom_half_handler = NULL;
+	vfe_out->hw_intf = NULL;
+	vfe_out->irq_handle = 0;
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&vfe_out->list);
+	vfe_out->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver2_handle_irq(uint32_t    evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_vfe_bus_ver2_priv          *bus_priv;
+	int rc = 0;
+
+	bus_priv     = th_payload->handler_priv;
+	CAM_DBG(CAM_ISP, "Enter");
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller, CAM_IRQ_EVT_GROUP_0);
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_vfe_bus_error_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int i = 0, rc = 0;
+	struct cam_vfe_bus_ver2_priv *bus_priv =
+		th_payload->handler_priv;
+	struct cam_vfe_bus_irq_evt_payload *evt_payload;
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "Bus Err IRQ");
+	for (i = 0; i < th_payload->num_registers; i++) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "vfe:%d: IRQ_Status%d: 0x%x",
+		bus_priv->common_data.core_index, i,
+			th_payload->evt_status_arr[i]);
+	}
+	cam_irq_controller_disable_irq(bus_priv->common_data.bus_irq_controller,
+		bus_priv->error_irq_handle);
+
+	rc  = cam_vfe_bus_get_evt_payload(&bus_priv->common_data, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Cannot get payload");
+		return rc;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->core_index = bus_priv->common_data.core_index;
+	evt_payload->evt_id  = evt_id;
+	evt_payload->debug_status_0 = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->debug_status_0);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static void cam_vfe_bus_update_ubwc_meta_addr(
+	uint32_t *reg_val_pair,
+	uint32_t  *j,
+	void     *regs,
+	uint64_t  image_buf)
+{
+	uint32_t  camera_hw_version;
+	struct cam_vfe_bus_ver2_reg_offset_ubwc_client *ubwc_regs;
+	struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client *ubwc_3_regs;
+	int rc = 0;
+
+	if (!regs || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		goto end;
+	}
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc: %d", rc);
+		goto end;
+	} else if ((camera_hw_version < CAM_CPAS_TITAN_170_V100) ||
+		(camera_hw_version > CAM_CPAS_TITAN_175_V130)) {
+		CAM_ERR(CAM_ISP, "Invalid HW version: %d",
+			camera_hw_version);
+		goto end;
+	}
+
+	switch (camera_hw_version) {
+	case CAM_CPAS_TITAN_170_V100:
+	case CAM_CPAS_TITAN_170_V110:
+	case CAM_CPAS_TITAN_170_V120:
+	case CAM_CPAS_TITAN_170_V200:
+		ubwc_regs =
+			(struct cam_vfe_bus_ver2_reg_offset_ubwc_client *)regs;
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->meta_addr,
+			image_buf);
+		break;
+	case CAM_CPAS_TITAN_175_V100:
+	case CAM_CPAS_TITAN_175_V101:
+	case CAM_CPAS_TITAN_175_V120:
+	case CAM_CPAS_TITAN_175_V130:
+	case CAM_CPAS_TITAN_165_V100:
+		ubwc_3_regs =
+			(struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client *)
+			regs;
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_3_regs->meta_addr,
+			image_buf);
+		break;
+	default:
+		break;
+	}
+end:
+	return;
+}
+
+static int cam_vfe_bus_update_ubwc_3_regs(
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data,
+	uint32_t *reg_val_pair,	uint32_t i, uint32_t *j)
+{
+	struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client *ubwc_regs;
+	int rc = 0;
+
+	if (!wm_data || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_regs = (struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client *)
+		wm_data->hw_regs->ubwc_regs;
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		wm_data->hw_regs->packer_cfg, wm_data->packer_cfg);
+	CAM_DBG(CAM_ISP, "WM %d packer cfg 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->is_dual) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->tile_cfg, wm_data->tile_cfg);
+	} else {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->tile_cfg, wm_data->tile_cfg);
+		CAM_DBG(CAM_ISP, "WM %d tile cfg 0x%x",
+			wm_data->index, reg_val_pair[*j-1]);
+	}
+
+	if (wm_data->is_dual) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->h_init, wm_data->offset);
+	} else {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->h_init, wm_data->h_init);
+		CAM_DBG(CAM_ISP, "WM %d h_init 0x%x",
+			wm_data->index, reg_val_pair[*j-1]);
+	}
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->v_init, wm_data->v_init);
+	CAM_DBG(CAM_ISP, "WM %d v_init 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_stride, wm_data->ubwc_meta_stride);
+	CAM_DBG(CAM_ISP, "WM %d meta stride 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->common_data->disable_ubwc_comp) {
+		wm_data->ubwc_mode_cfg_0 &= ~ubwc_regs->ubwc_comp_en_bit;
+		CAM_DBG(CAM_ISP,
+			"Force disable UBWC compression on VFE:%d WM:%d",
+			wm_data->common_data->core_index, wm_data->index);
+	}
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->mode_cfg_0, wm_data->ubwc_mode_cfg_0);
+	CAM_DBG(CAM_ISP, "WM %d ubwc_mode_cfg_0 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->mode_cfg_1, wm_data->ubwc_mode_cfg_1);
+	CAM_DBG(CAM_ISP, "WM %d ubwc_mode_cfg_1 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_offset, wm_data->ubwc_meta_offset);
+	CAM_DBG(CAM_ISP, "WM %d ubwc meta offset 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->ubwc_bandwidth_limit) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->bw_limit, wm_data->ubwc_bandwidth_limit);
+		CAM_DBG(CAM_ISP, "WM %d ubwc bw limit 0x%x",
+			wm_data->index,   wm_data->ubwc_bandwidth_limit);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_update_ubwc_legacy_regs(
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data,
+	uint32_t camera_hw_version, uint32_t *reg_val_pair,
+	uint32_t i, uint32_t *j)
+{
+	struct cam_vfe_bus_ver2_reg_offset_ubwc_client *ubwc_regs;
+	uint32_t ubwc_bw_limit = 0;
+	int rc = 0;
+
+	if (!wm_data || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_regs = (struct cam_vfe_bus_ver2_reg_offset_ubwc_client *)
+		wm_data->hw_regs->ubwc_regs;
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		wm_data->hw_regs->packer_cfg, wm_data->packer_cfg);
+	CAM_DBG(CAM_ISP, "WM %d packer cfg 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->is_dual) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->tile_cfg, wm_data->tile_cfg);
+	} else {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->tile_cfg, wm_data->tile_cfg);
+		CAM_DBG(CAM_ISP, "WM %d tile cfg 0x%x",
+			wm_data->index, reg_val_pair[*j-1]);
+	}
+
+	if (wm_data->is_dual) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->h_init, wm_data->offset);
+	} else {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->h_init, wm_data->h_init);
+		CAM_DBG(CAM_ISP, "WM %d h_init 0x%x",
+			wm_data->index, reg_val_pair[*j-1]);
+	}
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->v_init, wm_data->v_init);
+	CAM_DBG(CAM_ISP, "WM %d v_init 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_stride, wm_data->ubwc_meta_stride);
+	CAM_DBG(CAM_ISP, "WM %d meta stride 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->common_data->disable_ubwc_comp) {
+		wm_data->ubwc_mode_cfg_0 &= ~ubwc_regs->ubwc_comp_en_bit;
+		CAM_DBG(CAM_ISP,
+			"Force disable UBWC compression on VFE:%d WM:%d",
+			wm_data->common_data->core_index, wm_data->index);
+	}
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->mode_cfg_0, wm_data->ubwc_mode_cfg_0);
+	CAM_DBG(CAM_ISP, "WM %d ubwc_mode_cfg_0 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_offset, wm_data->ubwc_meta_offset);
+	CAM_DBG(CAM_ISP, "WM %d ubwc meta offset 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (camera_hw_version == CAM_CPAS_TITAN_170_V110) {
+		switch (wm_data->format) {
+		case CAM_FORMAT_UBWC_TP10:
+			ubwc_bw_limit = 0x8 | BIT(0);
+			break;
+		case CAM_FORMAT_UBWC_NV12_4R:
+			ubwc_bw_limit = 0xB | BIT(0);
+			break;
+		default:
+			ubwc_bw_limit = 0;
+			break;
+		}
+	}
+
+	if (ubwc_bw_limit) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->bw_limit, ubwc_bw_limit);
+		CAM_DBG(CAM_ISP, "WM %d ubwc bw limit 0x%x",
+			wm_data->index, ubwc_bw_limit);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_update_ubwc_regs(
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data,
+	uint32_t *reg_val_pair,	uint32_t i, uint32_t *j)
+{
+	uint32_t camera_hw_version;
+	int rc = 0;
+
+	if (!wm_data || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc =  cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc: %d", rc);
+		goto end;
+	} else if ((camera_hw_version <= CAM_CPAS_TITAN_NONE) ||
+		(camera_hw_version >= CAM_CPAS_TITAN_MAX)) {
+		CAM_ERR(CAM_ISP, "Invalid HW version: %d",
+			camera_hw_version);
+		rc = -EINVAL;
+		goto end;
+	}
+	switch (camera_hw_version) {
+	case CAM_CPAS_TITAN_170_V100:
+	case CAM_CPAS_TITAN_170_V110:
+	case CAM_CPAS_TITAN_170_V120:
+	case CAM_CPAS_TITAN_170_V200:
+		rc = cam_vfe_bus_update_ubwc_legacy_regs(
+			wm_data, camera_hw_version, reg_val_pair, i, j);
+		break;
+	case CAM_CPAS_TITAN_175_V100:
+	case CAM_CPAS_TITAN_175_V101:
+	case CAM_CPAS_TITAN_175_V120:
+	case CAM_CPAS_TITAN_175_V130:
+	case CAM_CPAS_TITAN_165_V100:
+		rc = cam_vfe_bus_update_ubwc_3_regs(
+			wm_data, reg_val_pair, i, j);
+		break;
+	default:
+		break;
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to update ubwc regs rc:%d", rc);
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_update_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update         *update_buf;
+	struct cam_buf_io_cfg                    *io_cfg;
+	struct cam_vfe_bus_ver2_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data = NULL;
+	struct cam_cdm_utils_ops                       *cdm_util_ops;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t  i, j, k, size = 0;
+	uint32_t  frame_inc = 0, val;
+	uint32_t loop_size = 0;
+
+	update_buf =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		update_buf->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = vfe_out_data->cdm_util_ops;
+
+	if (update_buf->wm_update->num_buf != vfe_out_data->num_wm) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->wm_update->num_buf, vfe_out_data->num_wm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	io_cfg = update_buf->wm_update->io_cfg;
+
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+		/* update width register */
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->buffer_width_cfg,
+			wm_data->width);
+		CAM_DBG(CAM_ISP, "WM %d image width 0x%x",
+			wm_data->index, reg_val_pair[j-1]);
+
+		/* For initial configuration program all bus registers */
+		val = io_cfg->planes[i].plane_stride;
+		CAM_DBG(CAM_ISP, "before stride %d", val);
+		val = ALIGNUP(val, 16);
+		if (val != io_cfg->planes[i].plane_stride &&
+			val != wm_data->stride)
+			CAM_WARN(CAM_ISP,
+				"Warning stride %u expected %u",
+				io_cfg->planes[i].plane_stride,
+				val);
+
+		if ((wm_data->stride != val ||
+			!wm_data->init_cfg_done) && (wm_data->index >= 3)) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->stride,
+				io_cfg->planes[i].plane_stride);
+			wm_data->stride = val;
+			CAM_DBG(CAM_ISP, "WM %d image stride 0x%x",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		if (wm_data->en_ubwc) {
+			if (!wm_data->hw_regs->ubwc_regs) {
+				CAM_ERR(CAM_ISP,
+					"No UBWC register to configure.");
+				return -EINVAL;
+			}
+			if (wm_data->ubwc_updated) {
+				wm_data->ubwc_updated = false;
+				cam_vfe_bus_update_ubwc_regs(
+					wm_data, reg_val_pair, i, &j);
+			}
+
+			/* UBWC meta address */
+			cam_vfe_bus_update_ubwc_meta_addr(
+				reg_val_pair, &j,
+				wm_data->hw_regs->ubwc_regs,
+				update_buf->wm_update->image_buf[i]);
+			CAM_DBG(CAM_ISP, "WM %d ubwc meta addr 0x%llx",
+				wm_data->index,
+				update_buf->wm_update->image_buf[i]);
+		}
+
+		if (wm_data->en_ubwc) {
+			frame_inc = ALIGNUP(io_cfg->planes[i].plane_stride *
+			    io_cfg->planes[i].slice_height, 4096);
+			frame_inc += io_cfg->planes[i].meta_size;
+			CAM_DBG(CAM_ISP,
+				"WM %d frm %d: ht: %d stride %d meta: %d",
+				wm_data->index, frame_inc,
+				io_cfg->planes[i].slice_height,
+				io_cfg->planes[i].plane_stride,
+				io_cfg->planes[i].meta_size);
+		} else {
+			frame_inc = io_cfg->planes[i].plane_stride *
+				io_cfg->planes[i].slice_height;
+		}
+
+		if (wm_data->index < 3)
+			loop_size = wm_data->irq_subsample_period + 1;
+		else
+			loop_size = 1;
+
+		/* WM Image address */
+		for (k = 0; k < loop_size; k++) {
+			if (wm_data->en_ubwc)
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					wm_data->hw_regs->image_addr,
+					update_buf->wm_update->image_buf[i] +
+					io_cfg->planes[i].meta_size +
+					k * frame_inc);
+			else
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					wm_data->hw_regs->image_addr,
+					update_buf->wm_update->image_buf[i] +
+					wm_data->offset + k * frame_inc);
+			CAM_DBG(CAM_ISP, "WM %d image address 0x%x",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->frame_inc, frame_inc);
+		CAM_DBG(CAM_ISP, "WM %d frame_inc %d",
+			wm_data->index, reg_val_pair[j-1]);
+
+
+		/* enable the WM */
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg,
+			wm_data->en_cfg);
+
+		/* set initial configuration done */
+		if (!wm_data->init_cfg_done)
+			wm_data->init_cfg_done = true;
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_buf->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				update_buf->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_buf->cmd.cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_buf->cmd.used_bytes = size * 4;
+	} else {
+		update_buf->cmd.used_bytes = 0;
+		CAM_DBG(CAM_ISP,
+			"No reg val pairs. num_wms: %u",
+			vfe_out_data->num_wm);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update         *update_hfr;
+	struct cam_vfe_bus_ver2_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data = NULL;
+	struct cam_isp_port_hfr_config           *hfr_cfg = NULL;
+	struct cam_cdm_utils_ops                 *cdm_util_ops;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t  i, j, size = 0;
+
+	update_hfr =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		update_hfr->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = vfe_out_data->cdm_util_ops;
+
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data;
+
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+
+		if (wm_data->index <= 2 && hfr_cfg->subsample_period > 3) {
+			CAM_ERR(CAM_ISP,
+				"RDI doesn't support irq subsample period %d",
+				hfr_cfg->subsample_period);
+			return -EINVAL;
+		}
+
+		if ((wm_data->framedrop_pattern !=
+			hfr_cfg->framedrop_pattern) ||
+			!wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_pattern,
+				hfr_cfg->framedrop_pattern);
+			wm_data->framedrop_pattern = hfr_cfg->framedrop_pattern;
+			CAM_DBG(CAM_ISP, "WM %d framedrop pattern 0x%x",
+				wm_data->index, wm_data->framedrop_pattern);
+		}
+
+		if (wm_data->framedrop_period != hfr_cfg->framedrop_period ||
+			!wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_period,
+				hfr_cfg->framedrop_period);
+			wm_data->framedrop_period = hfr_cfg->framedrop_period;
+			CAM_DBG(CAM_ISP, "WM %d framedrop period 0x%x",
+				wm_data->index, wm_data->framedrop_period);
+		}
+
+		if (wm_data->irq_subsample_period != hfr_cfg->subsample_period
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_period,
+				hfr_cfg->subsample_period);
+			wm_data->irq_subsample_period =
+				hfr_cfg->subsample_period;
+			CAM_DBG(CAM_ISP, "WM %d irq subsample period 0x%x",
+				wm_data->index, wm_data->irq_subsample_period);
+		}
+
+		if (wm_data->irq_subsample_pattern != hfr_cfg->subsample_pattern
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_pattern,
+				hfr_cfg->subsample_pattern);
+			wm_data->irq_subsample_pattern =
+				hfr_cfg->subsample_pattern;
+			CAM_DBG(CAM_ISP, "WM %d irq subsample pattern 0x%x",
+				wm_data->index, wm_data->irq_subsample_pattern);
+		}
+
+		/* set initial configuration done */
+		if (!wm_data->hfr_cfg_done)
+			wm_data->hfr_cfg_done = true;
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_hfr->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"Failed! Buf size:%d insufficient, expected size:%d",
+				update_hfr->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_hfr->cmd.cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_hfr->cmd.used_bytes = size * 4;
+	} else {
+		update_hfr->cmd.used_bytes = 0;
+		CAM_DBG(CAM_ISP,
+			"No reg val pairs. num_wms: %u",
+			vfe_out_data->num_wm);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_update_ubwc_config(void *cmd_args)
+{
+	struct cam_isp_hw_get_cmd_update         *update_ubwc;
+	struct cam_vfe_bus_ver2_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data = NULL;
+	struct cam_ubwc_plane_cfg_v1             *ubwc_plane_cfg = NULL;
+	uint32_t                                  i;
+	int                                       rc = 0;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	update_ubwc =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		update_ubwc->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_plane_cfg = (struct cam_ubwc_plane_cfg_v1   *)update_ubwc->data;
+
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+		if (i > 0)
+			ubwc_plane_cfg++;
+
+		if (!wm_data->hw_regs->ubwc_regs) {
+			CAM_ERR(CAM_ISP,
+				"No UBWC register to configure.");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (!wm_data->en_ubwc) {
+			CAM_ERR(CAM_ISP, "UBWC Disabled");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (wm_data->packer_cfg !=
+			ubwc_plane_cfg->packer_config ||
+			!wm_data->init_cfg_done) {
+			wm_data->packer_cfg = ubwc_plane_cfg->packer_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->tile_cfg !=
+			ubwc_plane_cfg->tile_config)
+			|| !wm_data->init_cfg_done)) {
+			wm_data->tile_cfg = ubwc_plane_cfg->tile_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->h_init !=
+			ubwc_plane_cfg->h_init) ||
+			!wm_data->init_cfg_done)) {
+			wm_data->h_init = ubwc_plane_cfg->h_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->v_init != ubwc_plane_cfg->v_init ||
+			!wm_data->init_cfg_done) {
+			wm_data->v_init = ubwc_plane_cfg->v_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_stride !=
+			ubwc_plane_cfg->meta_stride ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_stride = ubwc_plane_cfg->meta_stride;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg_0 !=
+			ubwc_plane_cfg->mode_config_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg_0 =
+				ubwc_plane_cfg->mode_config_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg_1 !=
+			ubwc_plane_cfg->mode_config_1 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg_1 =
+				ubwc_plane_cfg->mode_config_1;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_offset !=
+			ubwc_plane_cfg->meta_offset ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_offset = ubwc_plane_cfg->meta_offset;
+			wm_data->ubwc_updated = true;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_update_ubwc_config_v2(void *cmd_args)
+{
+	struct cam_isp_hw_get_cmd_update         *update_ubwc;
+	struct cam_vfe_bus_ver2_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data = NULL;
+	struct cam_vfe_generic_ubwc_config       *ubwc_generic_cfg = NULL;
+	struct cam_vfe_generic_ubwc_plane_config *ubwc_generic_plane_cfg = NULL;
+	uint32_t                                  i;
+	int                                       rc = 0;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	update_ubwc =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		update_ubwc->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_generic_cfg = (struct cam_vfe_generic_ubwc_config *)
+		update_ubwc->data;
+
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+		ubwc_generic_plane_cfg = &ubwc_generic_cfg->ubwc_plane_cfg[i];
+
+		if (!wm_data->hw_regs->ubwc_regs) {
+			CAM_ERR(CAM_ISP,
+				"No UBWC register to configure.");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (!wm_data->en_ubwc) {
+			CAM_ERR(CAM_ISP, "UBWC Disabled");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (wm_data->packer_cfg !=
+			ubwc_generic_plane_cfg->packer_config ||
+			!wm_data->init_cfg_done) {
+			wm_data->packer_cfg =
+				ubwc_generic_plane_cfg->packer_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->tile_cfg !=
+			ubwc_generic_plane_cfg->tile_config)
+			|| !wm_data->init_cfg_done)) {
+			wm_data->tile_cfg = ubwc_generic_plane_cfg->tile_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->h_init !=
+			ubwc_generic_plane_cfg->h_init) ||
+			!wm_data->init_cfg_done)) {
+			wm_data->h_init = ubwc_generic_plane_cfg->h_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->v_init != ubwc_generic_plane_cfg->v_init ||
+			!wm_data->init_cfg_done) {
+			wm_data->v_init = ubwc_generic_plane_cfg->v_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_stride !=
+			ubwc_generic_plane_cfg->meta_stride ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_stride =
+				ubwc_generic_plane_cfg->meta_stride;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg_0 !=
+			ubwc_generic_plane_cfg->mode_config_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg_0 =
+				ubwc_generic_plane_cfg->mode_config_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg_1 !=
+			ubwc_generic_plane_cfg->mode_config_1 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg_1 =
+				ubwc_generic_plane_cfg->mode_config_1;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_offset !=
+			ubwc_generic_plane_cfg->meta_offset ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_offset =
+				ubwc_generic_plane_cfg->meta_offset;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_lossy_threshold_0 !=
+			ubwc_generic_plane_cfg->lossy_threshold_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_lossy_threshold_0 =
+				ubwc_generic_plane_cfg->lossy_threshold_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_lossy_threshold_1 !=
+			ubwc_generic_plane_cfg->lossy_threshold_1 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_lossy_threshold_1 =
+				ubwc_generic_plane_cfg->lossy_threshold_1;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_bandwidth_limit !=
+			ubwc_generic_plane_cfg->bandwidth_limit ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_bandwidth_limit =
+				ubwc_generic_plane_cfg->bandwidth_limit;
+			wm_data->ubwc_updated = true;
+		}
+	}
+
+end:
+	return rc;
+}
+
+
+static int cam_vfe_bus_update_stripe_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv                *bus_priv;
+	struct cam_isp_hw_dual_isp_update_args      *stripe_args;
+	struct cam_vfe_bus_ver2_vfe_out_data        *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data    *wm_data = NULL;
+	struct cam_isp_dual_stripe_config           *stripe_config;
+	uint32_t outport_id, ports_plane_idx, i;
+
+	bus_priv = (struct cam_vfe_bus_ver2_priv  *) priv;
+	stripe_args = (struct cam_isp_hw_dual_isp_update_args *)cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		stripe_args->res->res_priv;
+
+	if (!vfe_out_data) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	outport_id = stripe_args->res->res_id & 0xFF;
+	if (stripe_args->res->res_id < CAM_ISP_IFE_OUT_RES_BASE ||
+		stripe_args->res->res_id >= bus_priv->max_out_res)
+		return 0;
+
+	ports_plane_idx = (stripe_args->split_id *
+	(stripe_args->dual_cfg->num_ports * CAM_PACKET_MAX_PLANES)) +
+	(outport_id * CAM_PACKET_MAX_PLANES);
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+		stripe_config = (struct cam_isp_dual_stripe_config  *)
+			&stripe_args->dual_cfg->stripes_flex[ports_plane_idx + i];
+		wm_data->width = stripe_config->width;
+		wm_data->offset = stripe_config->offset;
+		wm_data->tile_cfg = stripe_config->tileconfig;
+		CAM_DBG(CAM_ISP, "id:%x wm:%d width:0x%x offset:%x tilecfg:%x",
+			stripe_args->res->res_id, i, wm_data->width,
+			wm_data->offset, wm_data->tile_cfg);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_hw(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_start_vfe_out(hw_priv);
+}
+
+static int cam_vfe_bus_stop_hw(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_stop_vfe_out(hw_priv);
+}
+
+static int cam_vfe_bus_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv    *bus_priv = hw_priv;
+	uint32_t                         top_irq_reg_mask[2] = {0};
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (bus_priv->common_data.hw_init)
+		return 0;
+
+	top_irq_reg_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	bus_priv->irq_handle = cam_irq_controller_subscribe_irq(
+		bus_priv->common_data.vfe_irq_controller,
+		CAM_IRQ_PRIORITY_2,
+		top_irq_reg_mask,
+		bus_priv,
+		cam_vfe_bus_ver2_handle_irq,
+		NULL,
+		NULL,
+		NULL,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (bus_priv->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Failed to subscribe BUS IRQ");
+		bus_priv->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	if (bus_priv->tasklet_info != NULL) {
+		bus_priv->error_irq_handle = cam_irq_controller_subscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			bus_error_irq_mask,
+			bus_priv,
+			cam_vfe_bus_error_irq_top_half,
+			cam_vfe_bus_err_bottom_half,
+			bus_priv->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (bus_priv->error_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "Failed to subscribe BUS error IRQ %d",
+				bus_priv->error_irq_handle);
+			bus_priv->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	/*Set Debug Registers*/
+	cam_io_w_mb(CAM_VFE_BUS_SET_DEBUG_REG, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->debug_status_cfg);
+
+	/* BUS_WR_INPUT_IF_ADDR_SYNC_FRAME_HEADER */
+	cam_io_w_mb(0x0, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->addr_sync_frame_hdr);
+
+	/* no clock gating at bus input */
+	cam_io_w_mb(0xFFFFF, bus_priv->common_data.mem_base + 0x0000200C);
+
+	/* BUS_WR_TEST_BUS_CTRL */
+	cam_io_w_mb(0x0, bus_priv->common_data.mem_base + 0x0000211C);
+
+	/* if addr_no_sync has default value then config the addr no sync reg */
+	cam_io_w_mb(CAM_VFE_BUS_ADDR_NO_SYNC_DEFAULT_VAL,
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->addr_sync_no_sync);
+
+	bus_priv->common_data.hw_init = true;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv    *bus_priv = hw_priv;
+	int                              rc = 0, i;
+	unsigned long                    flags;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Error: Invalid args");
+		return -EINVAL;
+	}
+
+	if (!bus_priv->common_data.hw_init)
+		return 0;
+
+	if (bus_priv->error_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			bus_priv->error_irq_handle);
+		bus_priv->error_irq_handle = 0;
+	}
+
+	if (bus_priv->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			bus_priv->irq_handle);
+		bus_priv->irq_handle = 0;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER2_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+	bus_priv->common_data.hw_init = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	return rc;
+}
+
+static int __cam_vfe_bus_process_cmd(void *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_process_cmd(priv, cmd_type, cmd_args, arg_size);
+}
+
+int cam_vfe_bus_dump_wm_data(void *priv, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv  *bus_priv =
+		(struct cam_vfe_bus_ver2_priv  *) priv;
+	struct cam_isp_hw_event_info  *event_info =
+		(struct cam_isp_hw_event_info *)cmd_args;
+	struct cam_isp_resource_node              *rsrc_node = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data      *rsrc_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data  *wm_data   = NULL;
+	int                                        i, wm_idx;
+	enum cam_vfe_bus_ver2_vfe_out_type         vfe_out_res_id;
+
+	vfe_out_res_id = cam_vfe_bus_get_out_res_id(event_info->res_id);
+	rsrc_node = &bus_priv->vfe_out[vfe_out_res_id];
+	rsrc_data = rsrc_node->res_priv;
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		wm_idx = cam_vfe_bus_get_wm_idx(vfe_out_res_id, i);
+		if (wm_idx < 0 || wm_idx >= bus_priv->num_client) {
+			CAM_ERR(CAM_ISP, "Unsupported VFE out %d",
+				vfe_out_res_id);
+			return -EINVAL;
+		}
+		wm_data = bus_priv->bus_client[wm_idx].res_priv;
+		CAM_INFO(CAM_ISP,
+			"VFE:%d WM:%d width:%u height:%u stride:%u x_init:%u en_cfg:%u acquired width:%u height:%u",
+			wm_data->common_data->core_index, wm_idx,
+			wm_data->width,
+			wm_data->height,
+			wm_data->stride, wm_data->h_init,
+			wm_data->en_cfg,
+			wm_data->acquired_width,
+			wm_data->acquired_height);
+	}
+	return 0;
+}
+
+static int cam_vfe_bus_get_res_for_mid(
+	struct cam_vfe_bus_ver2_priv *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_vfe_out_data   *out_data = NULL;
+	struct cam_isp_hw_get_cmd_update       *cmd_update = cmd_args;
+	struct cam_isp_hw_get_res_for_mid      *get_res = NULL;
+	int i, j;
+
+	get_res = (struct cam_isp_hw_get_res_for_mid *)cmd_update->data;
+	if (!get_res) {
+		CAM_ERR(CAM_ISP,
+			"invalid get resource for mid paramas");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		out_data = (struct cam_vfe_bus_ver2_vfe_out_data   *)
+			bus_priv->vfe_out[i].res_priv;
+
+		if (!out_data)
+			continue;
+
+		for (j = 0; j < CAM_VFE_BUS_VER2_MAX_MID_PER_PORT; j++) {
+			if (out_data->mid[j] == get_res->mid)
+				goto end;
+		}
+	}
+
+	if (i == bus_priv->num_out) {
+		CAM_ERR(CAM_ISP,
+			"mid:%d does not match with any out resource",
+			get_res->mid);
+		get_res->out_res_id = 0;
+		return -EINVAL;
+	}
+
+end:
+	CAM_INFO(CAM_ISP, "match mid :%d  out resource:0x%x found",
+		get_res->mid, bus_priv->vfe_out[i].res_id);
+	get_res->out_res_id = bus_priv->vfe_out[i].res_id;
+	return 0;
+}
+
+static int cam_vfe_bus_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_bus_ver2_priv		 *bus_priv;
+	uint32_t top_mask_0 = 0;
+	struct cam_isp_hw_cap *vfe_bus_cap;
+
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+		rc = cam_vfe_bus_update_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+		rc = cam_vfe_bus_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_WM_SECURE_MODE:
+		rc = cam_vfe_bus_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+		rc = cam_vfe_bus_update_stripe_cfg(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+		bus_priv = (struct cam_vfe_bus_ver2_priv  *) priv;
+		if (bus_priv->error_irq_handle) {
+			CAM_DBG(CAM_ISP, "Mask off bus error irq handler");
+			rc = cam_irq_controller_unsubscribe_irq(
+				bus_priv->common_data.bus_irq_controller,
+				bus_priv->error_irq_handle);
+			bus_priv->error_irq_handle = 0;
+		}
+		break;
+	case CAM_ISP_HW_CMD_UBWC_UPDATE:
+		rc = cam_vfe_bus_update_ubwc_config(cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO:
+		rc = cam_vfe_bus_dump_wm_data(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_UBWC_UPDATE_V2:
+		rc = cam_vfe_bus_update_ubwc_config_v2(cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ:
+		bus_priv = (struct cam_vfe_bus_ver2_priv *) priv;
+		top_mask_0 = cam_io_r_mb(bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->top_irq_mask_0);
+		top_mask_0 |= (1 << bus_priv->top_irq_shift);
+		cam_io_w_mb(top_mask_0, bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->top_irq_mask_0);
+		break;
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+		bus_priv = (struct cam_vfe_bus_ver2_priv *) priv;
+		rc = cam_vfe_bus_get_res_for_mid(bus_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_CAP:
+		bus_priv = (struct cam_vfe_bus_ver2_priv  *) priv;
+		vfe_bus_cap = (struct cam_isp_hw_cap *) cmd_args;
+		vfe_bus_cap->max_out_res_type = bus_priv->max_out_res;
+		vfe_bus_cap->support_consumed_addr =
+			bus_priv->common_data.support_consumed_addr;
+
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid camif process command:%d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_bus_ver2_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_ver2_priv    *bus_priv = NULL;
+	struct cam_vfe_bus              *vfe_bus_local;
+	struct cam_vfe_bus_ver2_hw_info *ver2_hw_info = bus_hw_info;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	if (!soc_info || !hw_intf || !bus_hw_info || !vfe_irq_controller) {
+		CAM_ERR(CAM_ISP,
+			"Inval_prms soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_hw_info);
+		CAM_ERR(CAM_ISP, "controller: %pK", vfe_irq_controller);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	vfe_bus_local = kzalloc(sizeof(struct cam_vfe_bus), GFP_KERNEL);
+	if (!vfe_bus_local) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_vfe_bus_ver2_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+	vfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                     = ver2_hw_info->num_client;
+	bus_priv->num_out                        = ver2_hw_info->num_out;
+	bus_priv->top_irq_shift                  = ver2_hw_info->top_irq_shift;
+	bus_priv->max_out_res                    = ver2_hw_info->max_out_res;
+	bus_priv->common_data.num_sec_out        = 0;
+	bus_priv->common_data.secure_mode        = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index         = soc_info->index;
+	bus_priv->common_data.mem_base           =
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf            = hw_intf;
+	bus_priv->common_data.vfe_irq_controller = vfe_irq_controller;
+	bus_priv->common_data.common_reg         = &ver2_hw_info->common_reg;
+	bus_priv->common_data.addr_no_sync       =
+		CAM_VFE_BUS_ADDR_NO_SYNC_DEFAULT_VAL;
+	bus_priv->common_data.hw_init            = false;
+	bus_priv->common_data.support_consumed_addr =
+		ver2_hw_info->support_consumed_addr;
+	bus_priv->common_data.disable_ubwc_comp  = false;
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+
+	rc = cam_irq_controller_init(drv_name, bus_priv->common_data.mem_base,
+		&ver2_hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "cam_irq_controller_init failed");
+		goto free_bus_priv;
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->free_dual_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_vfe_bus_init_wm_resource(i, bus_priv, bus_hw_info,
+			&bus_priv->bus_client[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init WM failed rc=%d", rc);
+			goto deinit_wm;
+		}
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER2_COMP_GRP_MAX; i++) {
+		rc = cam_vfe_bus_init_comp_grp(i, bus_priv, bus_hw_info,
+			&bus_priv->comp_grp[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init Comp Grp failed rc=%d", rc);
+			goto deinit_comp_grp;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_vfe_bus_init_vfe_out_resource(i, bus_priv,
+			bus_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init VFE Out failed rc=%d", rc);
+			goto deinit_vfe_out;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER2_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+
+	vfe_bus_local->hw_ops.reserve      = cam_vfe_bus_acquire_vfe_out;
+	vfe_bus_local->hw_ops.release      = cam_vfe_bus_release_vfe_out;
+	vfe_bus_local->hw_ops.start        = cam_vfe_bus_start_hw;
+	vfe_bus_local->hw_ops.stop         = cam_vfe_bus_stop_hw;
+	vfe_bus_local->hw_ops.init         = cam_vfe_bus_init_hw;
+	vfe_bus_local->hw_ops.deinit       = cam_vfe_bus_deinit_hw;
+	vfe_bus_local->top_half_handler    = cam_vfe_bus_ver2_handle_irq;
+	vfe_bus_local->bottom_half_handler = NULL;
+	vfe_bus_local->hw_ops.process_cmd  = __cam_vfe_bus_process_cmd;
+
+	*vfe_bus = vfe_bus_local;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+
+deinit_vfe_out:
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_vfe_out_resource(&bus_priv->vfe_out[i]);
+
+deinit_comp_grp:
+	if (i < 0)
+		i = CAM_VFE_BUS_VER2_COMP_GRP_MAX;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+
+deinit_wm:
+	if (i < 0)
+		i = bus_priv->num_client;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_wm_resource(&bus_priv->bus_client[i]);
+
+free_bus_priv:
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_vfe_bus_ver2_deinit(
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_ver2_priv    *bus_priv = NULL;
+	struct cam_vfe_bus              *vfe_bus_local;
+	unsigned long                    flags;
+
+	if (!vfe_bus || !*vfe_bus) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+	vfe_bus_local = *vfe_bus;
+
+	bus_priv = vfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER2_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+	bus_priv->common_data.hw_init = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_vfe_bus_deinit_wm_resource(&bus_priv->bus_client[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit WM failed rc=%d", rc);
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER2_COMP_GRP_MAX; i++) {
+		rc = cam_vfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit Comp Grp failed rc=%d", rc);
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER2_VFE_OUT_MAX; i++) {
+		rc = cam_vfe_bus_deinit_vfe_out_resource(&bus_priv->vfe_out[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit VFE Out failed rc=%d", rc);
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->free_dual_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	rc = cam_irq_controller_deinit(
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Deinit IRQ Controller failed rc=%d", rc);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+	*vfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.h
@@ -0,0 +1,239 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_BUS_VER2_H_
+#define _CAM_VFE_BUS_VER2_H_
+
+#include "cam_irq_controller.h"
+#include "cam_vfe_bus.h"
+
+#define CAM_VFE_BUS_VER2_MAX_CLIENTS 24
+#define CAM_VFE_BUS_VER2_MAX_MID_PER_PORT 4
+
+enum cam_vfe_bus_ver2_vfe_core_id {
+	CAM_VFE_BUS_VER2_VFE_CORE_0,
+	CAM_VFE_BUS_VER2_VFE_CORE_1,
+	CAM_VFE_BUS_VER2_VFE_CORE_2,
+	CAM_VFE_BUS_VER2_VFE_CORE_MAX,
+};
+
+enum cam_vfe_bus_ver2_comp_grp_type {
+	CAM_VFE_BUS_VER2_COMP_GRP_0,
+	CAM_VFE_BUS_VER2_COMP_GRP_1,
+	CAM_VFE_BUS_VER2_COMP_GRP_2,
+	CAM_VFE_BUS_VER2_COMP_GRP_3,
+	CAM_VFE_BUS_VER2_COMP_GRP_4,
+	CAM_VFE_BUS_VER2_COMP_GRP_5,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5,
+	CAM_VFE_BUS_VER2_COMP_GRP_MAX,
+};
+
+enum cam_vfe_bus_ver2_vfe_out_type {
+	CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+	CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+	CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+	CAM_VFE_BUS_VER2_VFE_OUT_RDI3,
+	CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+	CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+	CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+	CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+	CAM_VFE_BUS_VER2_VFE_OUT_FD,
+	CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+	CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP,
+	CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP,
+	CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP,
+	CAM_VFE_BUS_VER2_VFE_OUT_2PD,
+	CAM_VFE_BUS_VER2_VFE_OUT_MAX,
+};
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_vfe_bus_ver2_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t sw_reset;
+	uint32_t cgc_ovd;
+	uint32_t pwr_iso_cfg;
+	uint32_t dual_master_comp_cfg;
+	struct cam_irq_controller_reg_info irq_reg_info;
+	uint32_t comp_error_status;
+	uint32_t comp_ovrwr_status;
+	uint32_t dual_comp_error_status;
+	uint32_t dual_comp_ovrwr_status;
+	uint32_t addr_sync_cfg;
+	uint32_t addr_sync_frame_hdr;
+	uint32_t addr_sync_no_sync;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t top_irq_mask_0;
+};
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_ubwc_client:
+ *
+ * @Brief:        UBWC register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver2_reg_offset_ubwc_client {
+	uint32_t tile_cfg;
+	uint32_t h_init;
+	uint32_t v_init;
+	uint32_t meta_addr;
+	uint32_t meta_offset;
+	uint32_t meta_stride;
+	uint32_t mode_cfg_0;
+	uint32_t bw_limit;
+	uint32_t ubwc_comp_en_bit;
+};
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_ubwc_client:
+ *
+ * @Brief:        UBWC register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client {
+	uint32_t tile_cfg;
+	uint32_t h_init;
+	uint32_t v_init;
+	uint32_t meta_addr;
+	uint32_t meta_offset;
+	uint32_t meta_stride;
+	uint32_t mode_cfg_0;
+	uint32_t mode_cfg_1;
+	uint32_t bw_limit;
+	uint32_t ubwc_comp_en_bit;
+};
+
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver2_reg_offset_bus_client {
+	uint32_t status0;
+	uint32_t status1;
+	uint32_t cfg;
+	uint32_t header_addr;
+	uint32_t header_cfg;
+	uint32_t image_addr;
+	uint32_t image_addr_offset;
+	uint32_t buffer_width_cfg;
+	uint32_t buffer_height_cfg;
+	uint32_t packer_cfg;
+	uint32_t stride;
+	uint32_t irq_subsample_period;
+	uint32_t irq_subsample_pattern;
+	uint32_t framedrop_period;
+	uint32_t framedrop_pattern;
+	uint32_t frame_inc;
+	uint32_t burst_limit;
+	void    *ubwc_regs;
+};
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_comp_grp:
+ *
+ * @Brief:        Register offsets for Composite Group registers
+ * comp_mask:     Comp group register address
+ * addr_sync_mask:Address sync group register address
+ */
+struct cam_vfe_bus_ver2_reg_offset_comp_grp {
+	uint32_t                            comp_mask;
+	uint32_t                            addr_sync_mask;
+};
+
+/*
+ * struct cam_vfe_bus_ver2_vfe_out_hw_info:
+ *
+ * @Brief:        HW capability of VFE Bus Client
+ */
+struct cam_vfe_bus_ver2_vfe_out_hw_info {
+	enum cam_vfe_bus_ver2_vfe_out_type  vfe_out_type;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+	uint32_t                         mid[CAM_VFE_BUS_VER2_MAX_MID_PER_PORT];
+};
+
+/*
+ * struct cam_vfe_bus_ver2_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:            Common register details
+ * @bus_client_reg:        Bus client register info
+ * @comp_reg_grp:          Composite group register info
+ * @vfe_out_hw_info:       VFE output capability
+ * @top_irq_shift:         Mask shift for top level BUS WR irq
+ * @support_consumed_addr: Indicate if bus support consumed address
+ * @max_out_res:           Max vfe out resource value supported for hw
+ */
+struct cam_vfe_bus_ver2_hw_info {
+	struct cam_vfe_bus_ver2_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_vfe_bus_ver2_reg_offset_bus_client
+		bus_client_reg[CAM_VFE_BUS_VER2_MAX_CLIENTS];
+	struct cam_vfe_bus_ver2_reg_offset_comp_grp
+		comp_grp_reg[CAM_VFE_BUS_VER2_COMP_GRP_MAX];
+	uint32_t num_out;
+	struct cam_vfe_bus_ver2_vfe_out_hw_info
+		vfe_out_hw_info[CAM_VFE_BUS_VER2_VFE_OUT_MAX];
+	uint32_t top_irq_shift;
+	bool support_consumed_addr;
+	uint32_t max_out_res;
+};
+
+/*
+ * cam_vfe_bus_ver2_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_ver2_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus);
+
+/*
+ * cam_vfe_bus_ver2_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @vfe_bus:                 Pointer to vfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_ver2_deinit(struct cam_vfe_bus     **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_VER2_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.c
@@ -0,0 +1,5427 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_soc.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_trace.h"
+#include "cam_smmu_api.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+
+static const char drv_name[] = "vfe_bus";
+
+#define CAM_VFE_BUS_VER3_IRQ_REG0                0
+#define CAM_VFE_BUS_VER3_IRQ_REG1                1
+
+#define CAM_VFE_BUS_VER3_PAYLOAD_MAX             256
+
+#define CAM_VFE_RDI_BUS_DEFAULT_WIDTH               0xFFFF
+#define CAM_VFE_RDI_BUS_DEFAULT_STRIDE              0xFFFF
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	((sizeof(struct cam_vfe_bus_ver3_reg_offset_bus_client) +  \
+	sizeof(struct cam_vfe_bus_ver3_reg_offset_ubwc_client))/4)
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+static uint32_t bus_error_irq_mask[2] = {
+	0xD0000000,
+	0x00000000,
+};
+
+enum cam_vfe_bus_wr_wm_mode {
+	CAM_VFE_WM_LINE_BASED_MODE,
+        CAM_VFE_WM_FRAME_BASED_MODE,
+        CAM_VFE_WM_INDEX_BASED_MODE,
+        CAM_VFE_WM_MODE_MAX,
+};
+
+enum cam_vfe_bus_ver3_packer_format {
+	PACKER_FMT_VER3_PLAIN_128,
+	PACKER_FMT_VER3_PLAIN_8,
+	PACKER_FMT_VER3_PLAIN_8_ODD_EVEN,
+	PACKER_FMT_VER3_PLAIN_8_LSB_MSB_10,
+	PACKER_FMT_VER3_PLAIN_8_LSB_MSB_10_ODD_EVEN,
+	PACKER_FMT_VER3_PLAIN_16_10BPP,
+	PACKER_FMT_VER3_PLAIN_16_12BPP,
+	PACKER_FMT_VER3_PLAIN_16_14BPP,
+	PACKER_FMT_VER3_PLAIN_16_16BPP,
+	PACKER_FMT_VER3_PLAIN_32,
+	PACKER_FMT_VER3_PLAIN_64,
+	PACKER_FMT_VER3_TP_10,
+	PACKER_FMT_VER3_MIPI10,
+	PACKER_FMT_VER3_MIPI12,
+	PACKER_FMT_VER3_MIPI14,
+	PACKER_FMT_VER3_MIPI20,
+	PACKER_FMT_VER3_PLAIN32_20BPP,
+	PACKER_FMT_VER3_MAX,
+};
+
+struct cam_vfe_bus_irq_violation_type {
+	bool hwpd_violation;
+};
+
+struct cam_vfe_bus_ver3_comp_grp_acquire_args {
+	enum cam_vfe_bus_ver3_comp_grp_type  comp_grp_id;
+	uint64_t                             composite_mask;
+};
+
+struct cam_vfe_bus_ver3_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *bus_irq_controller;
+	void                                       *vfe_irq_controller;
+	void                                       *buf_done_controller;
+	void                                       *priv;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_vfe_bus_ver3_reg_offset_common  *common_reg;
+	struct cam_cdm_utils_ops                   *cdm_util_ops;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+
+	struct cam_vfe_bus_irq_evt_payload          evt_payload[
+		CAM_VFE_BUS_VER3_PAYLOAD_MAX];
+	struct list_head                            free_payload_list;
+	spinlock_t                                  spin_lock;
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    addr_no_sync;
+	uint32_t                                    supported_irq;
+	bool                                        comp_config_needed;
+	bool                                        is_lite;
+	bool                                        hw_init;
+	bool                                        support_consumed_addr;
+	bool                                        disable_ubwc_comp;
+	bool                                        init_irq_subscribed;
+	bool                                        disable_mmu_prefetch;
+	cam_hw_mgr_event_cb_func                    event_cb;
+	int                        rup_irq_handle[CAM_VFE_BUS_VER3_SRC_GRP_MAX];
+	uint32_t                                    pack_align_shift;
+	uint32_t                                    max_bw_counter_limit;
+};
+
+struct cam_vfe_bus_ver3_wm_resource_data {
+	uint32_t             index;
+	struct cam_vfe_bus_ver3_common_data            *common_data;
+	struct cam_vfe_bus_ver3_reg_offset_bus_client  *hw_regs;
+
+	bool                 init_cfg_done;
+	bool                 hfr_cfg_done;
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	enum cam_vfe_bus_ver3_packer_format pack_fmt;
+
+	uint32_t             burst_len;
+
+	uint32_t             en_ubwc;
+	bool                 ubwc_updated;
+	uint32_t             packer_cfg;
+	uint32_t             h_init;
+	uint32_t             ubwc_meta_addr;
+	uint32_t             ubwc_meta_cfg;
+	uint32_t             ubwc_mode_cfg;
+	uint32_t             ubwc_stats_ctrl;
+	uint32_t             ubwc_ctrl_2;
+
+	uint32_t             irq_subsample_period;
+	uint32_t             irq_subsample_pattern;
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             en_cfg;
+	uint32_t             is_dual;
+
+	uint32_t             ubwc_lossy_threshold_0;
+	uint32_t             ubwc_lossy_threshold_1;
+	uint32_t             ubwc_offset_lossy_variance;
+	uint32_t             ubwc_bandwidth_limit;
+	uint32_t             acquired_width;
+	uint32_t             acquired_height;
+	uint32_t             default_line_based;
+	bool                 use_wm_pack;
+	bool                 update_wm_format;
+	enum cam_vfe_bus_wr_wm_mode wm_mode;
+};
+
+struct cam_vfe_bus_ver3_comp_grp_data {
+	enum cam_vfe_bus_ver3_comp_grp_type          comp_grp_type;
+	struct cam_vfe_bus_ver3_common_data         *common_data;
+
+	uint64_t                                     composite_mask;
+	uint32_t                                     comp_done_mask;
+	uint32_t                                     is_master;
+	uint32_t                                     is_dual;
+	uint32_t                                     dual_slave_core;
+	uint32_t                                     intra_client_mask;
+	uint32_t                                     addr_sync_mode;
+
+	uint32_t                                     acquire_dev_cnt;
+	uint32_t                                     irq_trigger_cnt;
+	uint32_t                                     ubwc_static_ctrl;
+};
+
+struct cam_vfe_bus_ver3_vfe_out_data {
+	uint32_t                              out_type;
+	uint32_t                              source_group;
+	struct cam_vfe_bus_ver3_common_data  *common_data;
+	struct cam_vfe_bus_ver3_priv         *bus_priv;
+
+	uint32_t                         num_wm;
+	struct cam_isp_resource_node    *wm_res;
+
+	struct cam_isp_resource_node    *comp_grp;
+	enum cam_isp_hw_sync_mode        dual_comp_sync_mode;
+	uint32_t                         dual_hw_alternate_vfe_id;
+	struct list_head                 vfe_out_list;
+
+	uint32_t                         is_master;
+	uint32_t                         is_dual;
+
+	uint32_t                         format;
+	uint32_t                         max_width;
+	uint32_t                         max_height;
+	uint32_t                         secure_mode;
+	void                            *priv;
+	uint32_t                        *mid;
+	uint32_t                         num_mid;
+	bool                             limiter_enabled;
+	bool                             mc_based;
+	bool                             cntxt_cfg_except;
+	uint32_t                         dst_hw_ctxt_id_mask;
+	uint64_t                         pid_mask;
+};
+
+struct cam_vfe_bus_ver3_priv {
+	struct cam_vfe_bus_ver3_common_data    common_data;
+	uint32_t                               num_client;
+	uint32_t                               num_out;
+	uint32_t                               num_comp_grp;
+	uint32_t                               top_irq_shift;
+
+	struct cam_isp_resource_node          *bus_client;
+	struct cam_isp_resource_node          *comp_grp;
+	struct cam_isp_resource_node          *vfe_out;
+	uint32_t  vfe_out_map_outtype[CAM_VFE_BUS_VER3_VFE_OUT_MAX];
+	struct list_head                       free_comp_grp;
+	struct list_head                       used_comp_grp;
+	int                                    bus_irq_handle;
+	int                                    rup_irq_handle;
+	int                                    error_irq_handle;
+	void                                  *tasklet_info;
+	uint32_t                               max_out_res;
+	uint32_t                               num_cons_err;
+	struct cam_vfe_constraint_error_info  *constraint_error_list;
+	struct cam_vfe_bus_ver3_hw_info       *bus_hw_info;
+};
+
+static void cam_vfe_bus_ver3_unsubscribe_init_irq(
+	struct cam_vfe_bus_ver3_priv          *bus_priv);
+
+static int cam_vfe_bus_ver3_subscribe_init_irq(
+	struct cam_vfe_bus_ver3_priv          *bus_priv);
+
+static int cam_vfe_bus_ver3_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+
+static int cam_vfe_bus_ver3_config_ubwc_regs(
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data);
+
+static int cam_vfe_bus_ver3_get_evt_payload(
+	struct cam_vfe_bus_ver3_common_data  *common_data,
+	struct cam_vfe_bus_irq_evt_payload  **evt_payload)
+{
+	int rc;
+
+	spin_lock(&common_data->spin_lock);
+
+	if (!common_data->hw_init) {
+		*evt_payload = NULL;
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE:%u Bus uninitialized",
+			common_data->core_index);
+		rc = -EPERM;
+		goto done;
+	}
+
+	if (list_empty(&common_data->free_payload_list)) {
+		*evt_payload = NULL;
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE:%u No free BUS event payload",
+				common_data->core_index);
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&common_data->free_payload_list,
+		struct cam_vfe_bus_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&common_data->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_put_evt_payload(
+	struct cam_vfe_bus_ver3_common_data     *common_data,
+	struct cam_vfe_bus_irq_evt_payload     **evt_payload)
+{
+	unsigned long flags;
+
+	if (!common_data) {
+		CAM_ERR(CAM_ISP, "Invalid param common_data NULL");
+		return -EINVAL;
+	}
+
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "VFE:%u No payload to put", common_data->core_index);
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&common_data->spin_lock, flags);
+	if (common_data->hw_init)
+		list_add_tail(&(*evt_payload)->list,
+			&common_data->free_payload_list);
+	spin_unlock_irqrestore(&common_data->spin_lock, flags);
+
+	*evt_payload = NULL;
+
+	CAM_DBG(CAM_ISP, "VFE:%u Done", common_data->core_index);
+	return 0;
+}
+
+static bool cam_vfe_bus_ver3_can_be_secure(uint32_t out_type)
+{
+	switch (out_type) {
+	case CAM_VFE_BUS_VER3_VFE_OUT_FULL:
+	case CAM_VFE_BUS_VER3_VFE_OUT_DS4:
+	case CAM_VFE_BUS_VER3_VFE_OUT_DS16:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RDI0:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RDI1:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RDI2:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RDI3:
+	case CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP:
+	case CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP:
+	case CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP:
+	case CAM_VFE_BUS_VER3_VFE_OUT_2PD:
+	case CAM_VFE_BUS_VER3_VFE_OUT_LCR:
+	case CAM_VFE_BUS_VER3_VFE_OUT_PDAF:
+	case CAM_VFE_BUS_VER3_VFE_OUT_SPARSE_PD:
+	case CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_2PD:
+	case CAM_VFE_BUS_VER3_VFE_OUT_PDAF_PARSED:
+	case CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_RAW:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RDI4:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RDI5:
+	case CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_1:
+	case CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_2:
+	case CAM_VFE_BUS_VER3_VFE_OUT_IR:
+		return true;
+
+	case CAM_VFE_BUS_VER3_VFE_OUT_FD:
+		return cam_secure_get_vfe_fd_port_config();
+
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_CAF:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_BAYER_RS:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_ALSC:
+	case CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE:
+	case CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_BG:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BG:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BHIST:
+	default:
+		return false;
+	}
+}
+
+static enum cam_vfe_bus_ver3_vfe_out_type
+	cam_vfe_bus_ver3_get_out_res_id_and_index(
+	struct cam_vfe_bus_ver3_priv  *bus_priv,
+	uint32_t res_type, uint32_t  *index)
+{
+	uint32_t  vfe_out_type;
+
+	switch (res_type) {
+	case CAM_ISP_IFE_OUT_RES_FULL:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_FULL;
+		break;
+	case CAM_ISP_IFE_OUT_RES_DS4:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_DS4;
+		break;
+	case CAM_ISP_IFE_OUT_RES_DS16:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_DS16;
+		break;
+	case CAM_ISP_IFE_OUT_RES_FD:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_FD;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RAW_DUMP:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP;
+		break;
+	case CAM_ISP_IFE_OUT_RES_2PD:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_2PD;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI0;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI1;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI2;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI3;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BE:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_TL_BG:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_BF:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_AWB_BG:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_BHIST:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_RS:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_CS:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_IHIST:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST;
+		break;
+	case CAM_ISP_IFE_OUT_RES_FULL_DISP:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP;
+		break;
+	case CAM_ISP_IFE_OUT_RES_DS4_DISP:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP;
+		break;
+	case CAM_ISP_IFE_OUT_RES_DS16_DISP:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP;
+		break;
+	case CAM_ISP_IFE_OUT_RES_LCR:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_LCR;
+		break;
+	case CAM_ISP_IFE_OUT_RES_AWB_BFW:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW;
+		break;
+	case CAM_ISP_IFE_OUT_RES_SPARSE_PD:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_SPARSE_PD;
+		break;
+	case CAM_ISP_IFE_OUT_RES_PREPROCESS_2PD:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_2PD;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_AEC_BE:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE;
+		break;
+	case CAM_ISP_IFE_OUT_RES_LTM_STATS:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_GTM_BHIST:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST;
+		break;
+	case CAM_ISP_IFE_LITE_OUT_RES_STATS_BG:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BG;
+		break;
+	case CAM_ISP_IFE_LITE_OUT_RES_PREPROCESS_RAW:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_RAW;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_CAF:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_CAF;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_BAYER_RS:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BAYER_RS;
+		break;
+	case CAM_ISP_IFE_OUT_RES_PDAF_PARSED_DATA:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_PDAF_PARSED;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_ALSC:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_ALSC;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_4:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI4;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_5:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI5;
+		break;
+	case CAM_ISP_IFE_OUT_RES_AI_OUT_1:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_1;
+		break;
+	case CAM_ISP_IFE_OUT_RES_AI_OUT_2:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_2;
+		break;
+	case CAM_ISP_IFE_OUT_RES_IR:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_IR;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_IR_BG:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BG;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_IR_BHIST:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BHIST;
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "VFE:%u Invalid isp res id: %d , assigning max",
+			bus_priv->common_data.core_index, res_type);
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+		*index = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+		return vfe_out_type;
+	}
+	*index = bus_priv->vfe_out_map_outtype[vfe_out_type];
+
+	return vfe_out_type;
+}
+
+static enum cam_vfe_bus_ver3_packer_format
+	cam_vfe_bus_ver3_get_packer_fmt(uint32_t out_fmt, int wm_index)
+{
+	switch (out_fmt) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PD8:
+		return PACKER_FMT_VER3_PLAIN_128;
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_PLAIN8:
+		return PACKER_FMT_VER3_PLAIN_8;
+	case CAM_FORMAT_MIPI_RAW_10:
+		return PACKER_FMT_VER3_MIPI10;
+	case CAM_FORMAT_MIPI_RAW_12:
+		return PACKER_FMT_VER3_MIPI12;
+	case CAM_FORMAT_MIPI_RAW_14:
+		return PACKER_FMT_VER3_MIPI14;
+	case CAM_FORMAT_MIPI_RAW_20:
+		return PACKER_FMT_VER3_MIPI20;
+	case CAM_FORMAT_NV21:
+		if ((wm_index == 1) || (wm_index == 3) || (wm_index == 5))
+			return PACKER_FMT_VER3_PLAIN_8_LSB_MSB_10_ODD_EVEN;
+		fallthrough;
+	case CAM_FORMAT_NV12:
+	case CAM_FORMAT_UBWC_NV12:
+	case CAM_FORMAT_UBWC_NV12_4R:
+	case CAM_FORMAT_Y_ONLY:
+		return PACKER_FMT_VER3_PLAIN_8_LSB_MSB_10;
+	case CAM_FORMAT_PLAIN16_10:
+		return PACKER_FMT_VER3_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return PACKER_FMT_VER3_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return PACKER_FMT_VER3_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN16_16:
+		return PACKER_FMT_VER3_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN32:
+	case CAM_FORMAT_ARGB:
+		return PACKER_FMT_VER3_PLAIN_32;
+	case CAM_FORMAT_PLAIN32_20:
+		return PACKER_FMT_VER3_PLAIN32_20BPP;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_ARGB_16:
+	case CAM_FORMAT_PD10:
+		return PACKER_FMT_VER3_PLAIN_64;
+	case CAM_FORMAT_UBWC_TP10:
+	case CAM_FORMAT_TP10:
+		return PACKER_FMT_VER3_TP_10;
+	default:
+		return PACKER_FMT_VER3_MAX;
+	}
+	return PACKER_FMT_VER3_MAX;
+}
+
+static int cam_vfe_bus_ver3_handle_rup_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                     rc;
+	int                                         i;
+	struct cam_isp_resource_node               *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data       *rsrc_data = NULL;
+	struct cam_vfe_bus_irq_evt_payload         *evt_payload;
+	uint32_t irq_status;
+
+	vfe_out = th_payload->handler_priv;
+	if (!vfe_out) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+
+	CAM_DBG(CAM_ISP, "VFE:%u Bus IRQ status_0: 0x%X",
+		rsrc_data->common_data->core_index,
+		th_payload->evt_status_arr[0]);
+
+	rc  = cam_vfe_bus_ver3_get_evt_payload(rsrc_data->common_data,
+		&evt_payload);
+
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"VFE:%u Bus IRQ status_0: 0x%X",
+			rsrc_data->common_data->core_index,
+			th_payload->evt_status_arr[0]);
+		return rc;
+	}
+
+	evt_payload->core_index = rsrc_data->common_data->core_index;
+	evt_payload->evt_id  = evt_id;
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	irq_status =
+		th_payload->evt_status_arr[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+
+	trace_cam_log_event("RUP", "RUP_IRQ", irq_status, 0);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static void cam_vfe_bus_ver3_print_constraint_errors(
+	struct cam_vfe_bus_ver3_priv *bus_priv,
+	uint8_t *wm_name,
+	uint32_t constraint_errors)
+{
+	uint32_t i;
+
+	CAM_INFO(CAM_ISP, "VFE:%u Constraint violation bitflags: 0x%X",
+		bus_priv->common_data.core_index, constraint_errors);
+
+	for (i = 0; i < bus_priv->num_cons_err; i++) {
+		if (bus_priv->constraint_error_list[i].bitmask &
+			constraint_errors) {
+			CAM_INFO(CAM_ISP, "VFE:%u WM:%s %s",
+				bus_priv->common_data.core_index, wm_name,
+				bus_priv->constraint_error_list[i].error_description);
+		}
+	}
+}
+
+static void cam_vfe_bus_ver3_get_constraint_errors(
+	struct cam_vfe_bus_ver3_priv *bus_priv)
+{
+	uint32_t i, j, constraint_errors;
+	uint8_t *wm_name = NULL;
+	struct cam_isp_resource_node              *out_rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data      *out_rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data  *wm_data   = NULL;
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		out_rsrc_node = &bus_priv->vfe_out[i];
+		if (!out_rsrc_node || !out_rsrc_node->res_priv) {
+			CAM_DBG(CAM_ISP,
+				"VFE:%u out:%d out rsrc node or data is NULL",
+				bus_priv->common_data.core_index, i);
+			continue;
+		}
+		out_rsrc_data = out_rsrc_node->res_priv;
+		for (j = 0; j < out_rsrc_data->num_wm; j++) {
+			wm_data = out_rsrc_data->wm_res[j].res_priv;
+			wm_name = out_rsrc_data->wm_res[j].res_name;
+			if (wm_data) {
+				constraint_errors = cam_io_r_mb(
+					bus_priv->common_data.mem_base +
+					wm_data->hw_regs->debug_status_1);
+				if (!constraint_errors)
+					continue;
+
+				cam_vfe_bus_ver3_print_constraint_errors(
+					bus_priv, wm_name, constraint_errors);
+			}
+		}
+	}
+}
+
+static int cam_vfe_bus_ver3_handle_rup_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int                                   ret = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_vfe_bus_irq_evt_payload   *payload;
+	struct cam_isp_resource_node         *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data *rsrc_data = NULL;
+	struct cam_isp_hw_event_info          evt_info;
+	uint32_t                              irq_status;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	payload = evt_payload_priv;
+	vfe_out = handler_priv;
+	rsrc_data = vfe_out->res_priv;
+
+	if (!rsrc_data->common_data->event_cb) {
+		CAM_ERR(CAM_ISP, "VFE:%u Callback to HW MGR not found", vfe_out->hw_intf->hw_idx);
+		return ret;
+	}
+
+	irq_status = payload->irq_reg_val[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+
+	evt_info.hw_type  = CAM_ISP_HW_TYPE_VFE;
+	evt_info.hw_idx = rsrc_data->common_data->core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_VFE_IN;
+
+	if (!rsrc_data->common_data->is_lite) {
+		if (irq_status & 0x1) {
+			CAM_DBG(CAM_ISP, "VFE:%u Received CAMIF RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_CAMIF;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x2) {
+			CAM_DBG(CAM_ISP, "VFE:%u Received PDLIB RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_PDLIB;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x4)
+			CAM_DBG(CAM_ISP, "VFE:%u Received LCR RUP",
+				evt_info.hw_idx);
+
+		if (irq_status & 0x8) {
+			CAM_DBG(CAM_ISP, "VFE:%u Received RDI0 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI0;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x10) {
+			CAM_DBG(CAM_ISP, "VFE:%u Received RDI1 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI1;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x20) {
+			CAM_DBG(CAM_ISP, "VFE:%u Received RDI2 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI2;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+	} else {
+		if (irq_status & 0x1) {
+			CAM_DBG(CAM_ISP, "VFE:%u Received RDI0 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI0;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x2) {
+			CAM_DBG(CAM_ISP, "VFE:%u Received RDI1 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI1;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x4) {
+			CAM_DBG(CAM_ISP, "VFE:%u Received RDI2 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI2;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x8) {
+			CAM_DBG(CAM_ISP, "VFE:%u Received RDI3 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI3;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+	}
+
+	ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%u Bus RUP IRQ status_0:0x%X rc:%d",
+		evt_info.hw_idx, CAM_ISP_HW_EVENT_REG_UPDATE, irq_status, ret);
+
+	cam_vfe_bus_ver3_put_evt_payload(rsrc_data->common_data, &payload);
+
+	return ret;
+}
+
+static inline void cam_vfe_bus_ver3_config_frame_based_rdi_wm(
+	struct cam_vfe_bus_ver3_wm_resource_data  *rsrc_data)
+{
+	rsrc_data->width = CAM_VFE_RDI_BUS_DEFAULT_WIDTH;
+	rsrc_data->height = 0;
+	rsrc_data->stride = CAM_VFE_RDI_BUS_DEFAULT_STRIDE;
+	rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+}
+
+static int cam_vfe_bus_ver3_config_rdi_wm(
+	struct cam_vfe_bus_ver3_wm_resource_data  *rsrc_data)
+{
+
+	rsrc_data->pack_fmt = PACKER_FMT_VER3_PLAIN_128;
+
+	if (rsrc_data->wm_mode == CAM_VFE_WM_FRAME_BASED_MODE)
+		cam_vfe_bus_ver3_config_frame_based_rdi_wm(rsrc_data);
+	else if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+		 rsrc_data->en_cfg = 0x1;
+	else {
+		CAM_WARN(CAM_ISP, "No index mode %d is supported for VFE: %u  WM: %u",
+			rsrc_data->wm_mode,
+			rsrc_data->common_data->core_index,
+			rsrc_data->index);
+		return 0;
+	}
+
+	switch (rsrc_data->format) {
+	case CAM_FORMAT_MIPI_RAW_10:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width = ALIGNUP((rsrc_data->width * 5) / 4, 16) / 16;
+
+		if (rsrc_data->use_wm_pack) {
+			rsrc_data->pack_fmt = PACKER_FMT_VER3_MIPI10;
+			if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+				rsrc_data->width = ALIGNUP((rsrc_data->acquired_width), 8);
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_6:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 3) / 4, 16) / 16;
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_YUV422:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width, 16) / 16;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 3) / 2, 16) / 16;
+
+		if (rsrc_data->use_wm_pack) {
+			rsrc_data->pack_fmt = PACKER_FMT_VER3_MIPI12;
+			if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+				rsrc_data->width = ALIGNUP((rsrc_data->acquired_width), 8);
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 7) / 2, 16) / 16;
+
+		if (rsrc_data->use_wm_pack) {
+			rsrc_data->pack_fmt = PACKER_FMT_VER3_MIPI14;
+			if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+				rsrc_data->width = ALIGNUP((rsrc_data->acquired_width), 8);
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 2), 16) / 16;
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 5) / 2, 16) / 16;
+
+		if (rsrc_data->use_wm_pack)
+			rsrc_data->pack_fmt = PACKER_FMT_VER3_MIPI20;
+		break;
+	case CAM_FORMAT_PLAIN128:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 16), 16) / 16;
+		break;
+	case CAM_FORMAT_PLAIN32_20:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 4), 16) / 16;
+		break;
+	case CAM_FORMAT_PLAIN8:
+		rsrc_data->en_cfg = 0x1;
+		rsrc_data->stride = rsrc_data->width * 2;
+		break;
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_12:
+	case CAM_FORMAT_PLAIN16_14:
+	case CAM_FORMAT_PLAIN16_16:
+		rsrc_data->width =
+			ALIGNUP(rsrc_data->width * 2, 16) / 16;
+		rsrc_data->en_cfg = 0x1;
+
+		if (rsrc_data->use_wm_pack) {
+			rsrc_data->pack_fmt = cam_vfe_bus_ver3_get_packer_fmt(rsrc_data->format,
+				rsrc_data->index);
+			/* LSB aligned */
+			rsrc_data->pack_fmt |= (1 <<
+				rsrc_data->common_data->pack_align_shift);
+
+			if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+				rsrc_data->width = ALIGNUP((rsrc_data->acquired_width), 8);
+		}
+		break;
+	case CAM_FORMAT_PLAIN64:
+		rsrc_data->width =
+			ALIGNUP(rsrc_data->width * 8, 16) / 16;
+		rsrc_data->en_cfg = 0x1;
+		break;
+	case CAM_FORMAT_YUV422_10:
+		if (rsrc_data->wm_mode == CAM_VFE_WM_LINE_BASED_MODE)
+			rsrc_data->width =
+				ALIGNUP((rsrc_data->width * 5) / 4, 16) / 16;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "VFE:%u Unsupported RDI format %d",
+			rsrc_data->common_data->core_index, rsrc_data->format);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_res_update_config_wm(
+	struct cam_vfe_bus_ver3_priv           *ver3_bus_priv,
+	enum cam_vfe_bus_ver3_vfe_out_type      vfe_out_res_id,
+	enum cam_vfe_bus_plane_type             plane,
+	struct cam_isp_resource_node           *wm_res,
+	enum cam_vfe_bus_ver3_comp_grp_type    *comp_grp_id,
+	char                                   *wm_mode,
+	int32_t                                 wm_mode_size)
+{
+	int32_t rc = 0;
+	struct cam_vfe_bus_ver3_wm_resource_data  *rsrc_data = NULL;
+
+	rsrc_data = wm_res->res_priv;
+
+	if (((vfe_out_res_id >= CAM_VFE_BUS_VER3_VFE_OUT_RDI0) &&
+		(vfe_out_res_id <= CAM_VFE_BUS_VER3_VFE_OUT_RDI5))) {
+		if (rsrc_data->default_line_based)
+			rsrc_data->wm_mode = CAM_VFE_WM_LINE_BASED_MODE;
+		else
+			rsrc_data->wm_mode = CAM_VFE_WM_FRAME_BASED_MODE;
+
+		rc = cam_vfe_bus_ver3_config_rdi_wm(rsrc_data);
+		if (rc)
+			return rc;
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP ||
+			(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_IR)) {
+
+		rsrc_data->stride = rsrc_data->width;
+		rsrc_data->en_cfg = 0x1;
+		/* LSB aligned */
+		rsrc_data->pack_fmt |= (1 <<
+				ver3_bus_priv->common_data.pack_align_shift);
+
+	} else if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_FULL) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_1) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_2) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_FD) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP)) {
+
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_UBWC_NV12_4R:
+			rsrc_data->en_ubwc = 1;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "VFE:%u Invalid plane %d",
+					wm_res->hw_intf->hw_idx, plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_UBWC_NV12:
+			rsrc_data->en_ubwc = 1;
+			fallthrough;
+			/* Fall through for NV12 */
+		case CAM_FORMAT_NV21:
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_Y_ONLY:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "VFE:%u Invalid plane %d",
+					wm_res->hw_intf->hw_idx, plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_UBWC_TP10:
+			rsrc_data->en_ubwc = 1;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "VFE:%u Invalid plane %d",
+					wm_res->hw_intf->hw_idx, plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_TP10:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "VFE:%u Invalid plane %d",
+					wm_res->hw_intf->hw_idx, plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "VFE:%u Invalid plane %d",
+					wm_res->hw_intf->hw_idx, plane);
+				return -EINVAL;
+			}
+			break;
+		default:
+			if (wm_res->is_per_port_acquire) {
+				rsrc_data->height /= 2;
+				break;
+			}
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid format %d out_type:%d",
+				wm_res->hw_intf->hw_idx, rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+		rsrc_data->en_cfg = 0x1;
+
+	} else if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_CAF)) {
+
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+
+	} else if (((vfe_out_res_id >= CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE) &&
+		(vfe_out_res_id <= CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST)) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_BAYER_RS)) {
+
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_2PD) {
+
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_LCR) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_16:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			/* LSB aligned */
+			rsrc_data->pack_fmt |= (1 <<
+				ver3_bus_priv->common_data.pack_align_shift);
+
+			break;
+		default:
+			if (wm_res->is_per_port_acquire) {
+				rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+				rsrc_data->en_cfg = 0x1;
+				/* LSB aligned */
+				rsrc_data->pack_fmt |= (1 <<
+					ver3_bus_priv->common_data.pack_align_shift);
+				break;
+			}
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid format %d out_type:%d",
+				wm_res->hw_intf->hw_idx, rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_SPARSE_PD) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN8:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			break;
+		case CAM_FORMAT_PLAIN16_8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			/* LSB aligned */
+			rsrc_data->pack_fmt |= (1 <<
+				ver3_bus_priv->common_data.pack_align_shift);
+			break;
+		default:
+			if (wm_res->is_per_port_acquire) {
+				rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+				rsrc_data->en_cfg = 0x1;
+				break;
+			}
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid format %d out_type:%d",
+				wm_res->hw_intf->hw_idx, rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_DS4) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_DS16) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP)) {
+
+		rsrc_data->height = rsrc_data->height / 2;
+		rsrc_data->width  = rsrc_data->width / 2;
+		rsrc_data->en_cfg = 0x1;
+
+	} else if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_ALSC)) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN64:
+			rsrc_data->width = 0;
+			rsrc_data->height = 0;
+			rsrc_data->stride = 1;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+			break;
+		default:
+			if (wm_res->is_per_port_acquire) {
+				rsrc_data->width = 0;
+				rsrc_data->height = 0;
+				rsrc_data->stride = 1;
+				rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+				break;
+			}
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid format %d out_type:%d",
+				wm_res->hw_intf->hw_idx, rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_2PD) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_16:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			break;
+		default:
+			if (wm_res->is_per_port_acquire) {
+				rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+				rsrc_data->en_cfg = 0x1;
+				break;
+			}
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid format %d out_type:%d",
+				wm_res->hw_intf->hw_idx, rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN32:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 4, 16);
+			rsrc_data->en_cfg = 0x1;
+			break;
+		default:
+			if (wm_res->is_per_port_acquire) {
+				rsrc_data->stride = ALIGNUP(rsrc_data->width * 4, 16);
+				rsrc_data->en_cfg = 0x1;
+				break;
+			}
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid format %d out_type:%d",
+				wm_res->hw_intf->hw_idx, rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BHIST)  ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BG)) {
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_RAW) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+			rsrc_data->width = 0;
+			rsrc_data->height = 0;
+			rsrc_data->stride = 1;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+			break;
+		default:
+			if (wm_res->is_per_port_acquire) {
+				rsrc_data->width = 0;
+				rsrc_data->height = 0;
+				rsrc_data->stride = 1;
+				rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+				break;
+			}
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid format %d out_type:%d",
+				wm_res->hw_intf->hw_idx, rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_BG) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN64:
+			rsrc_data->width = 0;
+			rsrc_data->height = 0;
+			rsrc_data->stride = 1;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+			break;
+		default:
+			if (wm_res->is_per_port_acquire) {
+				rsrc_data->width = 0;
+				rsrc_data->height = 0;
+				rsrc_data->stride = 1;
+				rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+				break;
+			}
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid format %d out_type:%d",
+				 wm_res->hw_intf->hw_idx, rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_PDAF_PARSED) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_16:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			/* LSB aligned */
+			rsrc_data->pack_fmt |= (1 <<
+				ver3_bus_priv->common_data.pack_align_shift);
+
+			break;
+		default:
+			if (wm_res->is_per_port_acquire) {
+				rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+				rsrc_data->en_cfg = 0x1;
+				/* LSB aligned */
+				rsrc_data->pack_fmt |= (1 <<
+					ver3_bus_priv->common_data.pack_align_shift);
+				break;
+			}
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid format %d out_type:%d",
+				wm_res->hw_intf->hw_idx, rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else {
+		CAM_ERR(CAM_ISP, "VFE:%u Invalid out_type:%d requested",
+			wm_res->hw_intf->hw_idx, vfe_out_res_id);
+		return -EINVAL;
+	}
+
+	*comp_grp_id = rsrc_data->hw_regs->comp_group;
+
+	switch (rsrc_data->en_cfg) {
+	case 0x1:
+		strscpy(wm_mode, "line-based", sizeof(wm_mode));
+		break;
+	case ((0x1 << 16) | 0x1):
+		strscpy(wm_mode, "frame-based", sizeof(wm_mode));
+		break;
+	case ((0x2 << 16) | 0x1):
+		strscpy(wm_mode, "index-based", sizeof(wm_mode));
+		break;
+	}
+
+	return rc;
+}
+
+static bool cam_vfe_bus_ver3_match_comp_grp(
+	struct cam_vfe_bus_ver3_priv           *ver3_bus_priv,
+	struct cam_isp_resource_node          **comp_grp,
+	uint32_t                                comp_grp_id)
+{
+	struct cam_vfe_bus_ver3_comp_grp_data  *rsrc_data = NULL;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+
+	if (!list_empty(&ver3_bus_priv->used_comp_grp)) {
+		list_for_each_entry(comp_grp_local,
+			&ver3_bus_priv->used_comp_grp, list) {
+			rsrc_data = comp_grp_local->res_priv;
+			if (rsrc_data->comp_grp_type == comp_grp_id) {
+				/* Match found */
+				*comp_grp = comp_grp_local;
+				return true;
+			}
+		}
+	}
+
+	list_for_each_entry(comp_grp_local,
+		&ver3_bus_priv->free_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_type == comp_grp_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			list_del(&comp_grp_local->list);
+			list_add_tail(&comp_grp_local->list,
+			&ver3_bus_priv->used_comp_grp);
+			return false;
+		}
+	}
+
+	*comp_grp = NULL;
+	return false;
+}
+
+static int cam_vfe_bus_ver3_acquire_wm(
+	struct cam_vfe_bus_ver3_priv           *ver3_bus_priv,
+	struct cam_vfe_hw_vfe_out_acquire_args *out_acq_args,
+	void                                   *tasklet,
+	enum cam_vfe_bus_ver3_vfe_out_type      vfe_out_res_id,
+	enum cam_vfe_bus_plane_type             plane,
+	struct cam_isp_resource_node           *wm_res,
+	enum cam_vfe_bus_ver3_comp_grp_type   *comp_grp_id,
+	bool                                   is_per_port_acquire,
+	bool                                   update_only)
+{
+	int32_t wm_idx = 0, rc;
+	struct cam_vfe_bus_ver3_wm_resource_data  *rsrc_data = NULL;
+	char wm_mode[50] = {'\0'};
+
+	if (wm_res->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "VFE:%u WM:%d not available state:%d",
+			wm_res->hw_intf->hw_idx, wm_idx, wm_res->res_state);
+		return -EALREADY;
+	}
+
+	rsrc_data = wm_res->res_priv;
+	wm_idx = rsrc_data->index;
+	rsrc_data->format = out_acq_args->out_port_info->format;
+	rsrc_data->use_wm_pack = out_acq_args->use_wm_pack;
+	rsrc_data->pack_fmt = cam_vfe_bus_ver3_get_packer_fmt(rsrc_data->format,
+		wm_idx);
+
+	rsrc_data->width = out_acq_args->out_port_info->width;
+	rsrc_data->height = out_acq_args->out_port_info->height;
+	rsrc_data->acquired_width = out_acq_args->out_port_info->width;
+	rsrc_data->acquired_height = out_acq_args->out_port_info->height;
+	rsrc_data->is_dual = out_acq_args->is_dual;
+
+	/* Set WM offset value to default */
+	rsrc_data->offset  = 0;
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d width %d height %d per_port_en %d",
+		wm_res->hw_intf->hw_idx, rsrc_data->index,
+		rsrc_data->width, rsrc_data->height, is_per_port_acquire);
+
+	if (is_per_port_acquire)
+		wm_res->is_per_port_acquire = true;
+
+	rc = cam_vfe_bus_ver3_res_update_config_wm(ver3_bus_priv, vfe_out_res_id,
+		plane, wm_res, comp_grp_id, wm_mode, sizeof(wm_mode));
+		if (rc)
+			return rc;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	wm_res->tasklet_info = tasklet;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%u WM:%d %s processed width:%d height:%d stride:%d format:0x%X en_ubwc:%d %s",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		wm_res->res_name, rsrc_data->width, rsrc_data->height,
+		rsrc_data->stride, rsrc_data->format, rsrc_data->en_ubwc,
+		wm_mode);
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_release_wm(void   *bus_priv,
+	struct cam_isp_resource_node     *wm_res)
+{
+	struct cam_vfe_bus_ver3_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->pack_fmt = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->irq_subsample_period = 0;
+	rsrc_data->irq_subsample_pattern = 0;
+	rsrc_data->framedrop_period = 0;
+	rsrc_data->framedrop_pattern = 0;
+	rsrc_data->packer_cfg = 0;
+	rsrc_data->en_ubwc = 0;
+	rsrc_data->h_init = 0;
+	rsrc_data->ubwc_meta_addr = 0;
+	rsrc_data->ubwc_meta_cfg = 0;
+	rsrc_data->ubwc_mode_cfg = 0;
+	rsrc_data->ubwc_stats_ctrl = 0;
+	rsrc_data->ubwc_ctrl_2 = 0;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+	rsrc_data->ubwc_updated = false;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+
+	rsrc_data->ubwc_lossy_threshold_0 = 0;
+	rsrc_data->ubwc_lossy_threshold_1 = 0;
+	rsrc_data->ubwc_offset_lossy_variance = 0;
+	rsrc_data->ubwc_bandwidth_limit = 0;
+	wm_res->tasklet_info = NULL;
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_ISP, "VFE:%u Release WM:%d %s",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		wm_res->res_name);
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_start_wm(struct cam_isp_resource_node *wm_res)
+{
+	const uint32_t enable_debug_status_1 = 11 << 8;
+	int val = 0;
+	struct cam_vfe_bus_ver3_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_vfe_bus_ver3_common_data        *common_data =
+		rsrc_data->common_data;
+	struct cam_vfe_bus_ver3_reg_offset_ubwc_client *ubwc_regs;
+	bool disable_ubwc_comp = rsrc_data->common_data->disable_ubwc_comp;
+
+	ubwc_regs = (struct cam_vfe_bus_ver3_reg_offset_ubwc_client *)
+		rsrc_data->hw_regs->ubwc_regs;
+
+	cam_io_w(0xf, common_data->mem_base + rsrc_data->hw_regs->burst_limit);
+
+	cam_io_w((rsrc_data->height << 16) | rsrc_data->width,
+		common_data->mem_base + rsrc_data->hw_regs->image_cfg_0);
+	cam_io_w(rsrc_data->pack_fmt,
+		common_data->mem_base + rsrc_data->hw_regs->packer_cfg);
+
+	/* enable ubwc if needed*/
+	if (rsrc_data->en_ubwc) {
+		if (!ubwc_regs) {
+			CAM_ERR(CAM_ISP,
+				"ubwc_regs is NULL, VFE:%u WM:%d en_ubwc:%d",
+				rsrc_data->common_data->core_index,
+				rsrc_data->index, rsrc_data->en_ubwc);
+			return -EINVAL;
+		}
+
+		if (rsrc_data->ubwc_updated) {
+			cam_vfe_bus_ver3_config_ubwc_regs(rsrc_data);
+			rsrc_data->ubwc_updated = false;
+		}
+
+		val = cam_io_r_mb(common_data->mem_base + ubwc_regs->mode_cfg);
+		val |= 0x1;
+		if (disable_ubwc_comp) {
+			val &= ~ubwc_regs->ubwc_comp_en_bit;
+			CAM_DBG(CAM_ISP,
+				"Force disable UBWC compression, VFE:%u WM:%d ubwc_mode_cfg: 0x%x",
+				rsrc_data->common_data->core_index,
+				rsrc_data->index, val);
+		}
+		cam_io_w_mb(val, common_data->mem_base + ubwc_regs->mode_cfg);
+	}
+
+	/* Validate for debugfs and mmu reg info for targets that don't list it */
+	if (!(common_data->disable_mmu_prefetch) &&
+		(rsrc_data->hw_regs->mmu_prefetch_cfg)) {
+		cam_io_w_mb(1, common_data->mem_base +
+			rsrc_data->hw_regs->mmu_prefetch_cfg);
+		cam_io_w_mb(0xFFFFFFFF, common_data->mem_base +
+			rsrc_data->hw_regs->mmu_prefetch_max_offset);
+		CAM_DBG(CAM_ISP, "VFE: %u WM: %d MMU prefetch enabled",
+			rsrc_data->common_data->core_index,
+			rsrc_data->index);
+	}
+
+	/* Enable WM */
+	cam_io_w_mb(rsrc_data->en_cfg, common_data->mem_base +
+		rsrc_data->hw_regs->cfg);
+
+	/* Enable constraint error detection */
+	cam_io_w_mb(enable_debug_status_1,
+		common_data->mem_base +
+		rsrc_data->hw_regs->debug_status_cfg);
+
+	CAM_DBG(CAM_ISP,
+		"Start VFE:%u WM:%d %s offset:0x%X en_cfg:0x%X width:%d height:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		wm_res->res_name, (uint32_t) rsrc_data->hw_regs->cfg,
+		rsrc_data->en_cfg, rsrc_data->width, rsrc_data->height);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d pk_fmt:%d stride:%d burst len:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index, rsrc_data->pack_fmt,
+		rsrc_data->stride, 0xF);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_stop_wm(struct cam_isp_resource_node *wm_res)
+{
+	struct cam_vfe_bus_ver3_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_vfe_bus_ver3_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable WM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+	CAM_DBG(CAM_ISP, "Stop VFE:%u WM:%d %s",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		wm_res->res_name);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+	rsrc_data->ubwc_updated = false;
+	rsrc_data->update_wm_format = false;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_handle_wm_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_ver3_handle_wm_done_bottom_half(void *wm_node,
+	void *evt_payload_priv)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_ver3_init_wm_resource(uint32_t index,
+	struct cam_vfe_bus_ver3_priv    *ver3_bus_priv,
+	struct cam_vfe_bus_ver3_hw_info *ver3_hw_info,
+	struct cam_isp_resource_node    *wm_res,
+	struct cam_isp_resource_node    **comp_grp,
+	uint8_t                         *wm_name,
+	uint32_t                         line_based_config)
+{
+	struct cam_vfe_bus_ver3_wm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver3_wm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_ISP, "VFE:%u Failed to alloc for WM res priv",
+			ver3_bus_priv->common_data.hw_intf->hw_idx);
+		return -ENOMEM;
+	}
+	wm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->default_line_based = line_based_config;
+	rsrc_data->hw_regs = &ver3_hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &ver3_bus_priv->common_data;
+	*comp_grp = &ver3_bus_priv->comp_grp[(&ver3_hw_info->bus_client_reg[index])->comp_group];
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = cam_vfe_bus_ver3_start_wm;
+	wm_res->stop = cam_vfe_bus_ver3_stop_wm;
+	wm_res->top_half_handler = cam_vfe_bus_ver3_handle_wm_done_top_half;
+	wm_res->bottom_half_handler =
+		cam_vfe_bus_ver3_handle_wm_done_bottom_half;
+	wm_res->hw_intf = ver3_bus_priv->common_data.hw_intf;
+
+	if (wm_name)
+		scnprintf(wm_res->res_name, CAM_ISP_RES_NAME_LEN,
+			"%s", wm_name);
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_deinit_wm_resource(
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_vfe_bus_ver3_wm_resource_data *rsrc_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = NULL;
+	wm_res->bottom_half_handler = NULL;
+	wm_res->hw_intf = NULL;
+
+	rsrc_data = wm_res->res_priv;
+	wm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_acquire_comp_grp(
+	struct cam_vfe_bus_ver3_priv         *ver3_bus_priv,
+	void                                *tasklet,
+	uint32_t                             is_dual,
+	uint32_t                             is_master,
+	struct cam_isp_resource_node       **comp_grp,
+	struct cam_vfe_bus_ver3_comp_grp_acquire_args *comp_acq_args,
+	bool                                 is_per_port_acquire,
+	bool                                 update_only)
+{
+	int rc = 0;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+	struct cam_vfe_bus_ver3_comp_grp_data  *rsrc_data = NULL;
+	bool previously_acquired = false;
+
+	/* Check if matching comp_grp has already been acquired */
+	previously_acquired = cam_vfe_bus_ver3_match_comp_grp(
+		ver3_bus_priv, &comp_grp_local, comp_acq_args->comp_grp_id);
+
+	if (!comp_grp_local) {
+		CAM_ERR(CAM_ISP, "Invalid comp_grp:%d",
+			comp_acq_args->comp_grp_id);
+		return -ENODEV;
+	}
+
+	rsrc_data = comp_grp_local->res_priv;
+
+	if (!previously_acquired) {
+		rsrc_data->intra_client_mask = 0x1;
+		comp_grp_local->tasklet_info = tasklet;
+		comp_grp_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		rsrc_data->is_master = is_master;
+		rsrc_data->is_dual = is_dual;
+
+		if (is_master)
+			rsrc_data->addr_sync_mode = 0;
+		else
+			rsrc_data->addr_sync_mode = 1;
+
+	} else {
+		rsrc_data = comp_grp_local->res_priv;
+		/* Do not support runtime change in composite mask */
+		if (!update_only && comp_grp_local->res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) {
+			CAM_ERR(CAM_ISP, "Invalid State %d comp_grp:%u",
+				comp_grp_local->res_state,
+				rsrc_data->comp_grp_type);
+			return -EBUSY;
+		}
+	}
+
+	if (is_per_port_acquire)
+		comp_grp_local->is_per_port_acquire = true;
+
+	CAM_DBG(CAM_ISP, "Acquire VFE:%d comp_grp:%u is_per_port_acquire :%d",
+		rsrc_data->common_data->core_index,
+		rsrc_data->comp_grp_type, comp_grp_local->is_per_port_acquire);
+
+	if (!update_only)
+		rsrc_data->acquire_dev_cnt++;
+	rsrc_data->composite_mask |= comp_acq_args->composite_mask;
+	*comp_grp = comp_grp_local;
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_release_comp_grp(
+	struct cam_vfe_bus_ver3_priv         *ver3_bus_priv,
+	struct cam_isp_resource_node         *in_comp_grp)
+{
+	struct cam_isp_resource_node           *comp_grp = NULL;
+	struct cam_vfe_bus_ver3_comp_grp_data  *in_rsrc_data = NULL;
+	int match_found = 0;
+
+	if (!in_comp_grp) {
+		CAM_ERR(CAM_ISP, "Invalid Params comp_grp %pK", in_comp_grp);
+		return -EINVAL;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "VFE:%u Already released comp_grp",
+			ver3_bus_priv->common_data.core_index);
+		return 0;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "VFE:%u Invalid State %d",
+			ver3_bus_priv->common_data.core_index, in_comp_grp->res_state);
+		return -EBUSY;
+	}
+
+	in_rsrc_data = in_comp_grp->res_priv;
+	CAM_DBG(CAM_ISP, "Release VFE:%u comp_grp:%u",
+		ver3_bus_priv->common_data.core_index,
+		in_rsrc_data->comp_grp_type);
+
+	list_for_each_entry(comp_grp, &ver3_bus_priv->used_comp_grp, list) {
+		if (comp_grp == in_comp_grp) {
+			match_found = 1;
+			break;
+		}
+	}
+
+	if (!match_found) {
+		CAM_ERR(CAM_ISP, "Could not find comp_grp:%u",
+			in_rsrc_data->comp_grp_type);
+		return -ENODEV;
+	}
+
+	in_rsrc_data->acquire_dev_cnt--;
+	if (in_rsrc_data->acquire_dev_cnt == 0) {
+		list_del(&comp_grp->list);
+		in_rsrc_data->dual_slave_core = CAM_VFE_BUS_VER3_VFE_CORE_MAX;
+		in_rsrc_data->addr_sync_mode = 0;
+		in_rsrc_data->composite_mask = 0;
+
+		in_comp_grp->tasklet_info = NULL;
+		in_comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+		list_add_tail(&comp_grp->list, &ver3_bus_priv->free_comp_grp);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_start_comp_grp(
+	struct cam_vfe_bus_ver3_vfe_out_data *vfe_out_data, uint32_t *bus_irq_reg_mask)
+{
+	int rc = 0;
+	uint32_t val;
+	struct cam_isp_resource_node *comp_grp = vfe_out_data->comp_grp;
+	struct cam_vfe_bus_ver3_comp_grp_data *rsrc_data =
+		vfe_out_data->comp_grp->res_priv;
+	struct cam_vfe_bus_ver3_common_data *common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP,
+		"Start VFE:%u comp_grp:%d streaming state:%d comp_mask:0x%X",
+		rsrc_data->common_data->core_index,
+		rsrc_data->comp_grp_type, comp_grp->res_state,
+		rsrc_data->composite_mask);
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+		bus_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0] = rsrc_data->comp_done_mask;
+		CAM_DBG(CAM_ISP, "Already Start Done VFE:%u comp_grp:%d bus_irq_mask_0: 0x%X",
+			rsrc_data->common_data->core_index,
+			rsrc_data->comp_grp_type,
+			bus_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0]);
+		return 0;
+	}
+
+	if (!common_data->comp_config_needed)
+		goto skip_comp_cfg;
+
+	if (rsrc_data->is_dual) {
+		if (rsrc_data->is_master) {
+			val = cam_io_r_mb(common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val |= (0x1 << (rsrc_data->comp_grp_type + 14));
+
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val = cam_io_r_mb(common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+
+			val |= (0x1 << rsrc_data->comp_grp_type);
+
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+		} else {
+			val = cam_io_r_mb(common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val |= (0x1 << rsrc_data->comp_grp_type);
+			val |= (0x1 << (rsrc_data->comp_grp_type + 14));
+
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val = cam_io_r_mb(common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+
+			val |= (0x1 << rsrc_data->comp_grp_type);
+
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+		}
+	}
+
+skip_comp_cfg:
+
+	if (rsrc_data->ubwc_static_ctrl) {
+		val = cam_io_r_mb(common_data->mem_base +
+			common_data->common_reg->ubwc_static_ctrl);
+		val |= rsrc_data->ubwc_static_ctrl;
+		cam_io_w_mb(val, common_data->mem_base +
+			common_data->common_reg->ubwc_static_ctrl);
+	}
+
+	bus_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0] = rsrc_data->comp_done_mask;
+
+	CAM_DBG(CAM_ISP, "Start Done VFE:%u comp_grp:%d bus_irq_mask_0: 0x%X",
+		rsrc_data->common_data->core_index,
+		rsrc_data->comp_grp_type,
+		bus_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0]);
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_stop_comp_grp(
+	struct cam_isp_resource_node          *comp_grp)
+{
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_handle_comp_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_ver3_handle_comp_done_bottom_half(
+	void                *handler_priv,
+	void                *evt_payload_priv,
+	uint32_t            *comp_grp_id)
+{
+	int rc = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_vfe_bus_ver3_vfe_out_data  *vfe_out  = handler_priv;
+	struct cam_isp_resource_node          *comp_grp = vfe_out->comp_grp;
+	struct cam_vfe_bus_irq_evt_payload    *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver3_comp_grp_data *rsrc_data = comp_grp->res_priv;
+	uint32_t                              *cam_ife_irq_regs;
+	uint32_t                               status_0;
+
+	if (!evt_payload || !rsrc_data) {
+		CAM_ERR(CAM_ISP, "Either evt_payload or rsrc_data is invalid");
+		return rc;
+	}
+	if (rsrc_data->is_dual && (!rsrc_data->is_master)) {
+		CAM_ERR(CAM_ISP, "VFE:%u Invalid comp_grp:%u is_master:%u",
+			rsrc_data->common_data->core_index, rsrc_data->comp_grp_type,
+			rsrc_data->is_master);
+		return rc;
+	}
+
+	cam_ife_irq_regs = evt_payload->irq_reg_val;
+	status_0 = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+
+	if (status_0 & rsrc_data->comp_done_mask) {
+		evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+		rc = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%u comp_grp:%d Bus IRQ status_0: 0x%X rc:%d",
+		rsrc_data->common_data->core_index, rsrc_data->comp_grp_type,
+		status_0, rc);
+
+	*comp_grp_id = rsrc_data->comp_grp_type;
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_init_comp_grp(uint32_t index,
+	struct cam_hw_soc_info          *soc_info,
+	struct cam_vfe_bus_ver3_priv    *ver3_bus_priv,
+	struct cam_vfe_bus_ver3_hw_info *ver3_hw_info,
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_vfe_bus_ver3_comp_grp_data *rsrc_data = NULL;
+	struct cam_vfe_soc_private *vfe_soc_private = soc_info->soc_private;
+	int ddr_type = 0;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver3_comp_grp_data),
+		GFP_KERNEL);
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	comp_grp->res_priv = rsrc_data;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&comp_grp->list);
+
+	rsrc_data->comp_grp_type   = index;
+	rsrc_data->common_data     = &ver3_bus_priv->common_data;
+	rsrc_data->dual_slave_core = CAM_VFE_BUS_VER3_VFE_CORE_MAX;
+	rsrc_data->comp_done_mask = ver3_hw_info->comp_done_mask[index];
+
+	if (rsrc_data->comp_grp_type != CAM_VFE_BUS_VER3_COMP_GRP_0 &&
+		rsrc_data->comp_grp_type != CAM_VFE_BUS_VER3_COMP_GRP_1)
+		rsrc_data->ubwc_static_ctrl = 0;
+	else {
+		ddr_type = cam_get_ddr_type();
+		if ((ddr_type == DDR_TYPE_LPDDR5) ||
+			(ddr_type == DDR_TYPE_LPDDR5X))
+			rsrc_data->ubwc_static_ctrl =
+				vfe_soc_private->ubwc_static_ctrl[1];
+		else
+			rsrc_data->ubwc_static_ctrl =
+				vfe_soc_private->ubwc_static_ctrl[0];
+	}
+
+	list_add_tail(&comp_grp->list, &ver3_bus_priv->free_comp_grp);
+
+	comp_grp->top_half_handler = cam_vfe_bus_ver3_handle_comp_done_top_half;
+	comp_grp->hw_intf = ver3_bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_deinit_comp_grp(
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_vfe_bus_ver3_comp_grp_data *rsrc_data =
+		comp_grp->res_priv;
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = NULL;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = NULL;
+
+	list_del_init(&comp_grp->list);
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+	comp_grp->res_priv = NULL;
+
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "comp_grp_priv is NULL");
+		return -ENODEV;
+	}
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update      *secure_mode = cmd_args;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data;
+	uint32_t                              *mode;
+
+	rsrc_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode = (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_acquire_vfe_out(void *bus_priv, void *acquire_args,
+	uint32_t args_size, bool update_only)
+{
+	int                                     rc = -ENODEV;
+	int                                     i;
+	enum cam_vfe_bus_ver3_vfe_out_type      vfe_out_res_id;
+	struct cam_vfe_bus_ver3_priv           *ver3_bus_priv = bus_priv;
+	struct cam_vfe_acquire_args            *acq_args = acquire_args;
+	struct cam_vfe_hw_vfe_out_acquire_args *out_acquire_args;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data   *rsrc_data = NULL;
+	uint32_t                                secure_caps = 0, mode;
+	struct cam_vfe_bus_ver3_comp_grp_acquire_args comp_acq_args = {0};
+	uint32_t       outmap_index = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+	uint32_t       out_port_res_type;
+	bool is_per_port_acquire = false;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_ISP, "Invalid Param");
+		return -EINVAL;
+	}
+
+	out_acquire_args = &acq_args->vfe_out;
+
+	if (acq_args->per_port_acquire) {
+		out_port_res_type = out_acquire_args->vfe_res_out_id;
+		is_per_port_acquire = true;
+	} else {
+		out_port_res_type = out_acquire_args->out_port_info->acquired_res_type;
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%u Acquire out_type:0x%X use_hw_ctxt:%s hw_ctx_id:0x%x",
+		ver3_bus_priv->common_data.core_index,
+		out_port_res_type,
+		CAM_BOOL_TO_YESNO(out_acquire_args->use_hw_ctxt),
+		out_acquire_args->out_port_info->hw_context_id);
+
+	vfe_out_res_id = cam_vfe_bus_ver3_get_out_res_id_and_index(
+				ver3_bus_priv,
+				out_port_res_type,
+				&outmap_index);
+	if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_MAX) ||
+		(outmap_index >= ver3_bus_priv->num_out)) {
+		CAM_WARN(CAM_ISP,
+			"VFE:%u target does not support req res id :0x%x outtype:%d index:%d",
+			ver3_bus_priv->common_data.core_index,
+			out_acquire_args->out_port_info->acquired_res_type,
+			vfe_out_res_id, outmap_index);
+		return -ENODEV;
+	}
+
+	rsrc_node = &ver3_bus_priv->vfe_out[outmap_index];
+	rsrc_data = rsrc_node->res_priv;
+	if (!update_only &&
+		rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		if ((rsrc_data->mc_based || rsrc_data->cntxt_cfg_except) &&
+			out_acquire_args->use_hw_ctxt &&
+			!(rsrc_data->dst_hw_ctxt_id_mask &
+			out_acquire_args->out_port_info->hw_context_id)) {
+			rsrc_data->dst_hw_ctxt_id_mask |=
+				out_acquire_args->out_port_info->hw_context_id;
+			out_acquire_args->rsrc_node = rsrc_node;
+			rc = 0;
+			goto end;
+		} else {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u out_type:0x%X mc_cap:%s cntxt_except:%s resource not available state:%d dst_hw_ctxt_id_mask:0x%x req_ctxt_id:0x%x",
+				ver3_bus_priv->common_data.core_index,
+				vfe_out_res_id, CAM_BOOL_TO_YESNO(rsrc_data->mc_based),
+				CAM_BOOL_TO_YESNO(rsrc_data->cntxt_cfg_except),
+				rsrc_node->res_state, rsrc_data->dst_hw_ctxt_id_mask,
+				out_acquire_args->out_port_info->hw_context_id);
+			rc = -EBUSY;
+			goto end;
+		}
+	}
+
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->common_data->priv = acq_args->priv;
+	rsrc_data->common_data->disable_ubwc_comp =
+		out_acquire_args->disable_ubwc_comp;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->bus_priv = ver3_bus_priv;
+	rsrc_data->limiter_enabled = false;
+	comp_acq_args.composite_mask = (1ULL << vfe_out_res_id);
+
+	if (out_acquire_args->use_hw_ctxt)
+		rsrc_data->dst_hw_ctxt_id_mask |= out_acquire_args->out_port_info->hw_context_id;
+
+	/* for some hw versions, buf done is not received from vfe but
+	 * from IP external to VFE. In such case, we get the controller
+	 * from hw manager and assign it here
+	 */
+	if (!(ver3_bus_priv->common_data.supported_irq &
+			CAM_VFE_HW_IRQ_CAP_BUF_DONE))
+		rsrc_data->common_data->buf_done_controller =
+			acq_args->buf_done_controller;
+
+	secure_caps = cam_vfe_bus_ver3_can_be_secure(
+		rsrc_data->out_type);
+	mode = out_acquire_args->out_port_info->secure_mode;
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (!rsrc_data->common_data->num_sec_out) {
+			rsrc_data->secure_mode = mode;
+			rsrc_data->common_data->secure_mode = mode;
+		} else {
+			if (mode == rsrc_data->common_data->secure_mode) {
+				rsrc_data->secure_mode =
+					rsrc_data->common_data->secure_mode;
+			} else {
+				rc = -EINVAL;
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"VFE:%u Mismatch: Acquire mode[%d], drvr mode[%d]",
+					ver3_bus_priv->common_data.core_index,
+					rsrc_data->common_data->secure_mode,
+					mode);
+				mutex_unlock(
+					&rsrc_data->common_data->bus_mutex);
+				return rc;
+			}
+		}
+		rsrc_data->common_data->num_sec_out++;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	ver3_bus_priv->tasklet_info = acq_args->tasklet;
+	rsrc_node->is_rdi_primary_res = false;
+	rsrc_node->res_id = out_port_res_type;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = out_acquire_args->cdm_ops;
+	rsrc_data->common_data->cdm_util_ops = out_acquire_args->cdm_ops;
+	rsrc_data->format = out_acquire_args->out_port_info->format;
+
+	if ((rsrc_data->out_type == CAM_VFE_BUS_VER3_VFE_OUT_FD) &&
+		(rsrc_data->format == CAM_FORMAT_Y_ONLY))
+		rsrc_data->num_wm = 1;
+
+	/* Acquire WM and retrieve COMP GRP ID */
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_vfe_bus_ver3_acquire_wm(ver3_bus_priv,
+			out_acquire_args,
+			acq_args->tasklet,
+			vfe_out_res_id,
+			i,
+			&rsrc_data->wm_res[i],
+			&comp_acq_args.comp_grp_id,
+			is_per_port_acquire,
+			update_only);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed to acquire WM VFE:%u out_type:%d rc:%d",
+				rsrc_data->common_data->core_index,
+				vfe_out_res_id, rc);
+			goto release_wm;
+		}
+	}
+
+	/* Acquire composite group using COMP GRP ID */
+	rc = cam_vfe_bus_ver3_acquire_comp_grp(ver3_bus_priv,
+		acq_args->tasklet,
+		out_acquire_args->is_dual,
+		out_acquire_args->is_master,
+		&rsrc_data->comp_grp,
+		&comp_acq_args,
+		is_per_port_acquire,
+		update_only);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Failed to acquire comp_grp VFE:%u out_typp:%d rc:%d",
+			rsrc_data->common_data->core_index,
+			vfe_out_res_id, rc);
+		goto release_wm;
+	}
+
+	rsrc_data->is_dual = out_acquire_args->is_dual;
+	rsrc_data->is_master = out_acquire_args->is_master;
+	if (!update_only)
+		rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_node->is_per_port_acquire = is_per_port_acquire;
+	out_acquire_args->rsrc_node = rsrc_node;
+	out_acquire_args->comp_grp_id = comp_acq_args.comp_grp_id;
+
+	CAM_DBG(CAM_ISP, "VFE:%u Acquire successful", rsrc_data->common_data->core_index);
+	return rc;
+
+release_wm:
+	for (i--; i >= 0; i--)
+		cam_vfe_bus_ver3_release_wm(ver3_bus_priv,
+			&rsrc_data->wm_res[i]);
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_acquire_vfe_out(void *bus_priv,
+	void *acquire_args, uint32_t args_size)
+{
+	return cam_vfe_bus_ver3_update_acquire_vfe_out(bus_priv, acquire_args,
+			args_size, false);
+}
+
+static int cam_vfe_bus_ver3_release_vfe_out(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node          *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data = NULL;
+	uint32_t                               secure_caps = 0;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	vfe_out = release_args;
+	rsrc_data = vfe_out->res_priv;
+
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP,
+			"Invalid resource state:%d VFE:%u out_type:0x%X",
+			vfe_out->res_state, rsrc_data->common_data->core_index,
+			vfe_out->res_id);
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		cam_vfe_bus_ver3_release_wm(bus_priv, &rsrc_data->wm_res[i]);
+
+	if ((rsrc_data->out_type == CAM_VFE_BUS_VER3_VFE_OUT_FD) &&
+		(rsrc_data->format == CAM_FORMAT_Y_ONLY))
+		rsrc_data->num_wm = 2;
+
+	if (rsrc_data->comp_grp)
+		cam_vfe_bus_ver3_release_comp_grp(bus_priv,
+			rsrc_data->comp_grp);
+
+
+	vfe_out->tasklet_info = NULL;
+	vfe_out->cdm_ops = NULL;
+	rsrc_data->dst_hw_ctxt_id_mask = 0;
+
+	secure_caps = cam_vfe_bus_ver3_can_be_secure(rsrc_data->out_type);
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (rsrc_data->secure_mode ==
+			rsrc_data->common_data->secure_mode) {
+			rsrc_data->common_data->num_sec_out--;
+			rsrc_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+		} else {
+			/*
+			 * The validity of the mode is properly
+			 * checked while acquiring the output port.
+			 * not expected to reach here, unless there is
+			 * some corruption.
+			 */
+			CAM_ERR(CAM_ISP, "VFE:%u driver[%d],resource[%d] mismatch",
+				rsrc_data->common_data->core_index,
+				rsrc_data->common_data->secure_mode,
+				rsrc_data->secure_mode);
+		}
+
+		if (!rsrc_data->common_data->num_sec_out)
+			rsrc_data->common_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		vfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_start_vfe_out(
+	struct cam_isp_resource_node          *vfe_out)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_common_data   *common_data = NULL;
+	uint32_t source_group = 0;
+	uint32_t bus_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_MAX];
+	uint32_t rup_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_MAX];
+
+	if (!vfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+	source_group = rsrc_data->source_group;
+
+	CAM_DBG(CAM_ISP, "Start VFE:%u out_type:0x%X",
+		rsrc_data->common_data->core_index, rsrc_data->out_type);
+
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP,
+			"Invalid resource state:%d VFE:%u out_type:0x%X",
+			vfe_out->res_state, rsrc_data->common_data->core_index,
+			rsrc_data->out_type);
+		return -EACCES;
+	}
+
+	/* subscribe when first out rsrc is streamed on */
+	if (!rsrc_data->common_data->init_irq_subscribed) {
+		rc = cam_vfe_bus_ver3_subscribe_init_irq(rsrc_data->bus_priv);
+		if (rc)
+			return rc;
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_vfe_bus_ver3_start_wm(&rsrc_data->wm_res[i]);
+		if (rc)
+			return rc;
+	}
+
+	memset(bus_irq_reg_mask, 0, sizeof(bus_irq_reg_mask));
+	rc = cam_vfe_bus_ver3_start_comp_grp(rsrc_data,
+			bus_irq_reg_mask);
+
+	if (rsrc_data->is_dual && !rsrc_data->is_master)
+		goto end;
+
+	if (vfe_out->is_per_port_start) {
+		CAM_DBG(CAM_ISP, "Skipping irq subscribe for resources that are not updated");
+		goto end;
+	}
+
+	vfe_out->irq_handle = cam_irq_controller_subscribe_irq(
+		common_data->buf_done_controller,
+		CAM_IRQ_PRIORITY_1,
+		bus_irq_reg_mask,
+		vfe_out,
+		vfe_out->top_half_handler,
+		vfe_out->bottom_half_handler,
+		vfe_out->tasklet_info,
+		&tasklet_bh_api,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (vfe_out->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Subscribe IRQ failed for VFE out_res %d, VFE:%u",
+			vfe_out->res_id, rsrc_data->common_data->core_index);
+		vfe_out->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	if ((common_data->is_lite || source_group > CAM_VFE_BUS_VER3_SRC_GRP_0)
+		&& !vfe_out->is_rdi_primary_res)
+		goto end;
+
+	if ((common_data->supported_irq & CAM_VFE_HW_IRQ_CAP_RUP) &&
+		(!common_data->rup_irq_handle[source_group])) {
+		memset(rup_irq_reg_mask, 0, sizeof(rup_irq_reg_mask));
+		rup_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0] |=
+			0x1 << source_group;
+
+		CAM_DBG(CAM_ISP,
+			"VFE:%u out_type:0x%X bus_irq_mask_0:0x%X for RUP",
+			rsrc_data->common_data->core_index, rsrc_data->out_type,
+			rup_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0]);
+
+		common_data->rup_irq_handle[source_group] =
+			cam_irq_controller_subscribe_irq(
+				common_data->bus_irq_controller,
+				CAM_IRQ_PRIORITY_0,
+				rup_irq_reg_mask,
+				vfe_out,
+				cam_vfe_bus_ver3_handle_rup_top_half,
+				cam_vfe_bus_ver3_handle_rup_bottom_half,
+				vfe_out->tasklet_info,
+				&tasklet_bh_api,
+				CAM_IRQ_EVT_GROUP_1);
+
+		if (common_data->rup_irq_handle[source_group] < 1) {
+			CAM_ERR(CAM_ISP, "VFE:%u Failed to subscribe RUP IRQ",
+				rsrc_data->common_data->core_index);
+			common_data->rup_irq_handle[source_group] = 0;
+			return -EFAULT;
+		}
+	}
+
+end:
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_stop_vfe_out(
+	struct cam_isp_resource_node          *vfe_out)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_common_data   *common_data = NULL;
+
+	if (!vfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		vfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "Stop VFE:%u out_type:0x%X state:%d",
+			rsrc_data->common_data->core_index, rsrc_data->out_type,
+			vfe_out->res_state);
+		return rc;
+	}
+
+	rc = cam_vfe_bus_ver3_stop_comp_grp(rsrc_data->comp_grp);
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_vfe_bus_ver3_stop_wm(&rsrc_data->wm_res[i]);
+
+	if (common_data->rup_irq_handle[rsrc_data->source_group]) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			common_data->bus_irq_controller,
+			common_data->rup_irq_handle[rsrc_data->source_group]);
+		common_data->rup_irq_handle[rsrc_data->source_group] = 0;
+	}
+
+	if (vfe_out->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			common_data->buf_done_controller,
+			vfe_out->irq_handle);
+		vfe_out->irq_handle = 0;
+	}
+
+	if (rsrc_data->common_data->init_irq_subscribed)
+		cam_vfe_bus_ver3_unsubscribe_init_irq(rsrc_data->bus_priv);
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_handle_vfe_out_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                     rc;
+	int                                         i;
+	struct cam_isp_resource_node               *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data       *rsrc_data = NULL;
+	struct cam_vfe_bus_irq_evt_payload         *evt_payload;
+	struct cam_vfe_bus_ver3_comp_grp_data      *resource_data;
+	uint32_t                                    status_0;
+	struct cam_vfe_bus_ver3_wm_resource_data   *wm_rsrc_data = NULL;
+
+	vfe_out = th_payload->handler_priv;
+	if (!vfe_out) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	resource_data = rsrc_data->comp_grp->res_priv;
+
+	rc  = cam_vfe_bus_ver3_get_evt_payload(rsrc_data->common_data,
+		&evt_payload);
+
+	if (rc) {
+		for (i = 0; i < th_payload->num_registers; i++)
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"VFE:%u Bus IRQ status_%d: 0x%X",
+				rsrc_data->common_data->core_index, i,
+				th_payload->evt_status_arr[i]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	evt_payload->core_index = rsrc_data->common_data->core_index;
+	evt_payload->evt_id = evt_id;
+
+	for (i = 0; i < th_payload->num_registers; i++) {
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+		CAM_DBG(CAM_ISP, "VFE:%u Bus IRQ status_%d: 0x%X",
+			rsrc_data->common_data->core_index, i,
+			th_payload->evt_status_arr[i]);
+	}
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	status_0 = th_payload->evt_status_arr[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+
+	if (status_0 & resource_data->comp_done_mask) {
+		wm_rsrc_data = rsrc_data->wm_res[PLANE_Y].res_priv;
+		evt_payload->last_consumed_addr = cam_io_r_mb(
+			wm_rsrc_data->common_data->mem_base +
+			wm_rsrc_data->hw_regs->addr_status_0);
+		trace_cam_log_event("bufdone", "bufdone_IRQ",
+			status_0, resource_data->comp_grp_type);
+	}
+
+	if (status_0 & 0x1)
+		trace_cam_log_event("UnexpectedRUP", "RUP_IRQ", status_0, 40);
+
+	CAM_DBG(CAM_ISP, "VFE:%u Exit", rsrc_data->common_data->core_index);
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_handle_vfe_out_done_bottom_half(
+	void                *handler_priv,
+	void                *evt_payload_priv)
+{
+	int                                    rc = -EINVAL;
+	struct cam_isp_resource_node          *vfe_out = handler_priv;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data = vfe_out->res_priv;
+	struct cam_vfe_bus_irq_evt_payload    *evt_payload = evt_payload_priv;
+	struct cam_isp_hw_event_info           evt_info;
+	struct cam_isp_hw_bufdone_event_info   bufdone_evt_info = {0};
+	void                                  *ctx = NULL;
+	uint32_t                               evt_id = 0;
+	uint32_t                               comp_grp_id = 0;
+
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "Invalid rsrc data pointer, returning from bottom half");
+		return rc;
+	}
+
+	rc = cam_vfe_bus_ver3_handle_comp_done_bottom_half(
+		rsrc_data, evt_payload_priv, &comp_grp_id);
+	CAM_DBG(CAM_ISP, "VFE:%u out_type:0x%x comp_grp_id:%d rc:%d",
+		rsrc_data->common_data->core_index, rsrc_data->out_type,
+		comp_grp_id, rc);
+
+	ctx = rsrc_data->priv;
+
+	switch (rc) {
+	case CAM_VFE_IRQ_STATUS_SUCCESS:
+		evt_id = evt_payload->evt_id;
+
+		evt_info.res_type = vfe_out->res_type;
+		evt_info.hw_idx   = vfe_out->hw_intf->hw_idx;
+		evt_info.hw_type  = CAM_ISP_HW_TYPE_VFE;
+		evt_info.res_id = vfe_out->res_id;
+		bufdone_evt_info.res_id = vfe_out->res_id;
+		bufdone_evt_info.comp_grp_id = comp_grp_id;
+		bufdone_evt_info.last_consumed_addr = evt_payload->last_consumed_addr;
+		evt_info.event_data = (void *)&bufdone_evt_info;
+
+		if (rsrc_data->common_data->event_cb)
+			rsrc_data->common_data->event_cb(ctx, evt_id,
+				(void *)&evt_info);
+		break;
+	default:
+		break;
+	}
+
+	cam_vfe_bus_ver3_put_evt_payload(rsrc_data->common_data, &evt_payload);
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_init_vfe_out_resource(uint32_t  index,
+	struct cam_vfe_bus_ver3_priv                  *ver3_bus_priv,
+	struct cam_vfe_bus_ver3_hw_info               *ver3_hw_info)
+{
+	struct cam_isp_resource_node         *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data *rsrc_data = NULL;
+	int rc = 0, i = 0;
+	int32_t vfe_out_type =
+		ver3_hw_info->vfe_out_hw_info[index].vfe_out_type;
+
+	if (vfe_out_type < 0 ||
+		vfe_out_type >= CAM_VFE_BUS_VER3_VFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "Init VFE Out failed, Invalid type=%d",
+			vfe_out_type);
+		return -EINVAL;
+	}
+
+	ver3_bus_priv->vfe_out_map_outtype[vfe_out_type] = index;
+	vfe_out = &ver3_bus_priv->vfe_out[index];
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		vfe_out->res_priv) {
+		CAM_ERR(CAM_ISP, "vfe_out_type %d has already been initialized",
+			vfe_out_type);
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver3_vfe_out_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	vfe_out->res_priv = rsrc_data;
+
+	vfe_out->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&vfe_out->list);
+
+	rsrc_data->source_group =
+		ver3_hw_info->vfe_out_hw_info[index].source_group;
+	rsrc_data->out_type     =
+		ver3_hw_info->vfe_out_hw_info[index].vfe_out_type;
+	rsrc_data->common_data  = &ver3_bus_priv->common_data;
+	rsrc_data->max_width    =
+		ver3_hw_info->vfe_out_hw_info[index].max_width;
+	rsrc_data->max_height   =
+		ver3_hw_info->vfe_out_hw_info[index].max_height;
+	rsrc_data->secure_mode  = CAM_SECURE_MODE_NON_SECURE;
+	rsrc_data->num_wm       = ver3_hw_info->vfe_out_hw_info[index].num_wm;
+	rsrc_data->mc_based = ver3_hw_info->vfe_out_hw_info[index].mc_based;
+	rsrc_data->cntxt_cfg_except = ver3_hw_info->vfe_out_hw_info[index].cntxt_cfg_except;
+
+	rsrc_data->wm_res = kzalloc((sizeof(struct cam_isp_resource_node) *
+		rsrc_data->num_wm), GFP_KERNEL);
+	if (!rsrc_data->wm_res) {
+		CAM_ERR(CAM_ISP, "Failed to alloc for wm_res");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_vfe_bus_ver3_init_wm_resource(
+			ver3_hw_info->vfe_out_hw_info[index].wm_idx[i],
+			ver3_bus_priv, ver3_hw_info,
+			&rsrc_data->wm_res[i],
+			&rsrc_data->comp_grp,
+			ver3_hw_info->vfe_out_hw_info[index].name[i],
+			ver3_hw_info->vfe_out_hw_info[index].line_based);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "VFE:%u init WM:%d failed rc:%d",
+				ver3_bus_priv->common_data.core_index, i, rc);
+			return rc;
+		}
+	}
+
+	rsrc_data->pid_mask = ver3_hw_info->vfe_out_hw_info[index].pid_mask;
+
+	vfe_out->start = cam_vfe_bus_ver3_start_vfe_out;
+	vfe_out->stop = cam_vfe_bus_ver3_stop_vfe_out;
+	vfe_out->top_half_handler =
+		cam_vfe_bus_ver3_handle_vfe_out_done_top_half;
+	vfe_out->bottom_half_handler =
+		cam_vfe_bus_ver3_handle_vfe_out_done_bottom_half;
+	vfe_out->process_cmd = cam_vfe_bus_ver3_process_cmd;
+	vfe_out->hw_intf = ver3_bus_priv->common_data.hw_intf;
+	vfe_out->irq_handle = 0;
+
+	rsrc_data->num_mid = ver3_hw_info->vfe_out_hw_info->num_mid;
+	rsrc_data->mid = ver3_hw_info->vfe_out_hw_info[index].mid;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_deinit_vfe_out_resource(
+	struct cam_isp_resource_node    *vfe_out)
+{
+	struct cam_vfe_bus_ver3_vfe_out_data *rsrc_data = vfe_out->res_priv;
+	int rc = 0, i = 0;
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		return 0;
+	}
+
+	vfe_out->start = NULL;
+	vfe_out->stop = NULL;
+	vfe_out->top_half_handler = NULL;
+	vfe_out->bottom_half_handler = NULL;
+	vfe_out->hw_intf = NULL;
+	vfe_out->irq_handle = 0;
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&vfe_out->list);
+	vfe_out->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_vfe_bus_ver3_deinit_wm_resource(&rsrc_data->wm_res[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"VFE:%u deinit WM:%d failed rc:%d",
+				rsrc_data->common_data->core_index, i, rc);
+	}
+
+	rsrc_data->wm_res = NULL;
+	rsrc_data->comp_grp = NULL;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static void cam_vfe_bus_ver3_print_wm_info(
+	struct cam_vfe_bus_ver3_wm_resource_data  *wm_data,
+	struct cam_vfe_bus_ver3_common_data  *common_data,
+	uint8_t *wm_name)
+{
+	uint32_t addr_status0, addr_status1, addr_status2, addr_status3, limiter;
+
+	addr_status0 = cam_io_r_mb(common_data->mem_base +
+		wm_data->hw_regs->addr_status_0);
+	addr_status1 = cam_io_r_mb(common_data->mem_base +
+		wm_data->hw_regs->addr_status_1);
+	addr_status2 = cam_io_r_mb(common_data->mem_base +
+		wm_data->hw_regs->addr_status_2);
+	addr_status3 = cam_io_r_mb(common_data->mem_base +
+		wm_data->hw_regs->addr_status_3);
+	limiter = cam_io_r_mb(common_data->mem_base +
+		wm_data->hw_regs->bw_limiter_addr);
+
+	CAM_INFO(CAM_ISP,
+		"VFE:%u WM:%d wm_name:%s width:%u height:%u stride:%u x_init:%u en_cfg:%u acquired width:%u height:%u",
+		wm_data->common_data->core_index, wm_data->index, wm_name,
+		wm_data->width,
+		wm_data->height,
+		wm_data->stride, wm_data->h_init,
+		wm_data->en_cfg,
+		wm_data->acquired_width,
+		wm_data->acquired_height);
+	CAM_INFO(CAM_ISP,
+		"VFE:%u WM:%u last consumed address:0x%x last frame addr:0x%x fifo cnt:0x%x current client address:0x%x limiter: 0x%x",
+		common_data->hw_intf->hw_idx, wm_data->index,
+		addr_status0, addr_status1, addr_status2, addr_status3, limiter);
+}
+
+static int cam_vfe_bus_ver3_print_dimensions(
+	uint32_t                                   res_id,
+	struct cam_vfe_bus_ver3_priv              *bus_priv)
+{
+	struct cam_isp_resource_node              *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data      *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data  *wm_data   = NULL;
+	struct cam_vfe_bus_ver3_common_data  *common_data = NULL;
+	int                                        i;
+	uint8_t                                *wm_name = NULL;
+	enum cam_vfe_bus_ver3_vfe_out_type  vfe_out_res_id =
+		CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+	uint32_t  outmap_index = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid bus private data, res_id: %d",
+			res_id);
+		return -EINVAL;
+	}
+
+	vfe_out_res_id = cam_vfe_bus_ver3_get_out_res_id_and_index(bus_priv,
+				res_id, &outmap_index);
+
+	if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_MAX) ||
+		(outmap_index >= bus_priv->num_out)) {
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"target does not support req res id :0x%x outtype:%d index:%d",
+			res_id,
+			vfe_out_res_id, outmap_index);
+		return -EINVAL;
+	}
+
+	rsrc_node = &bus_priv->vfe_out[outmap_index];
+	rsrc_data = rsrc_node->res_priv;
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "VFE out data is null, res_id: %d",
+			vfe_out_res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		wm_data = rsrc_data->wm_res[i].res_priv;
+		wm_name = rsrc_data->wm_res[i].res_name;
+		common_data = rsrc_data->common_data;
+		cam_vfe_bus_ver3_print_wm_info(wm_data, common_data, wm_name);
+	}
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_mini_dump(
+	struct cam_vfe_bus_ver3_priv *bus_priv,
+	void *cmd_args)
+{
+	struct cam_isp_resource_node              *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data      *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data  *wm        = NULL;
+	struct cam_vfe_bus_ver3_mini_dump_data    *md;
+	struct cam_vfe_bus_ver3_wm_mini_dump      *md_wm;
+	struct cam_hw_mini_dump_args              *md_args;
+	struct cam_hw_info                        *hw_info = NULL;
+	uint32_t                                   bytes_written = 0;
+	uint32_t                                   i, j, k = 0;
+
+	if (!bus_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid bus private data");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)bus_priv->common_data.hw_intf->hw_priv;
+	md_args = (struct cam_hw_mini_dump_args *)cmd_args;
+
+	if (sizeof(*md) > md_args->len) {
+		md_args->bytes_written = 0;
+		return 0;
+	}
+
+	md = (struct cam_vfe_bus_ver3_mini_dump_data *)md_args->start_addr;
+	md->clk_rate = cam_soc_util_get_applied_src_clk(&hw_info->soc_info, true);
+	md->hw_idx = bus_priv->common_data.hw_intf->hw_idx;
+	md->hw_state = hw_info->hw_state;
+	bytes_written += sizeof(*md);
+	md->wm = (struct cam_vfe_bus_ver3_wm_mini_dump *)
+			((uint8_t *)md_args->start_addr + bytes_written);
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rsrc_node = &bus_priv->vfe_out[i];
+		rsrc_data = rsrc_node->res_priv;
+		if (!rsrc_data)
+			continue;
+
+		for (j = 0; j < rsrc_data->num_wm; j++) {
+			if (bytes_written + sizeof(*md_wm) > md_args->len)
+				goto end;
+
+			md_wm = &md->wm[k];
+			wm = rsrc_data->wm_res[j].res_priv;
+			md_wm->width  = wm->width;
+			md_wm->index  = wm->index;
+			md_wm->height = wm->height;
+			md_wm->stride = wm->stride;
+			md_wm->en_cfg = wm->en_cfg;
+			md_wm->h_init = wm->h_init;
+			md_wm->format = wm->format;
+			md_wm->acquired_width = wm->acquired_width;
+			md_wm->acquired_height = wm->acquired_height;
+			md_wm->state = rsrc_node->res_state;
+			scnprintf(md_wm->name, CAM_ISP_RES_NAME_LEN,
+				"%s", rsrc_data->wm_res[j].res_name);
+			k++;
+			bytes_written += sizeof(*md_wm);
+		}
+	}
+end:
+	md->num_client = k;
+	md_args->bytes_written = bytes_written;
+	return 0;
+}
+
+static void *cam_vfe_bus_ver3_user_dump_info(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_vfe_bus_ver3_wm_resource_data  *wm = NULL;
+	uint32_t                                  *addr;
+	uint32_t                                   addr_status0;
+	uint32_t                                   addr_status1;
+	uint32_t                                   addr_status2;
+	uint32_t                                   addr_status3;
+
+	wm = (struct cam_vfe_bus_ver3_wm_resource_data *)dump_struct;
+
+	addr_status0 = cam_io_r_mb(wm->common_data->mem_base +
+		wm->hw_regs->addr_status_0);
+	addr_status1 = cam_io_r_mb(wm->common_data->mem_base +
+		wm->hw_regs->addr_status_1);
+	addr_status2 = cam_io_r_mb(wm->common_data->mem_base +
+		wm->hw_regs->addr_status_2);
+	addr_status3 = cam_io_r_mb(wm->common_data->mem_base +
+		wm->hw_regs->addr_status_3);
+
+	addr = (uint32_t *)addr_ptr;
+
+	*addr++ = wm->common_data->hw_intf->hw_idx;
+	*addr++ = wm->index;
+	*addr++ = addr_status0;
+	*addr++ = addr_status1;
+	*addr++ = addr_status2;
+	*addr++ = addr_status3;
+
+	return addr;
+}
+
+static int cam_vfe_bus_ver3_user_dump(
+	struct cam_vfe_bus_ver3_priv *bus_priv,
+	void *cmd_args)
+{
+	struct cam_isp_resource_node              *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data      *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data  *wm = NULL;
+	struct cam_hw_info                        *hw_info = NULL;
+	struct cam_isp_hw_dump_args               *dump_args;
+	uint32_t                                   i, j = 0;
+	int                                        rc = 0;
+
+
+	if (!bus_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Bus private data NULL");
+		return -EINVAL;
+	}
+
+	hw_info = (struct cam_hw_info *)bus_priv->common_data.hw_intf->hw_priv;
+	dump_args = (struct cam_isp_hw_dump_args *)cmd_args;
+
+	if (hw_info->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP,
+			"VFE:%u  BUS powered down", bus_priv->common_data.core_index);
+		return -EINVAL;
+	}
+
+	rc = cam_common_user_dump_helper(dump_args, cam_common_user_dump_clock,
+		hw_info, sizeof(uint64_t), "CLK_RATE_PRINT:");
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "VFE:%u BUS VER3: Clock dump failed, rc: %d",
+			bus_priv->common_data.core_index, rc);
+		return rc;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rsrc_node = &bus_priv->vfe_out[i];
+		if (!rsrc_node)
+			continue;
+
+		if (rsrc_node->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+			CAM_DBG(CAM_ISP,
+				"VFE:%u BUS VER3: path inactive res ID: %d, continuing",
+				bus_priv->common_data.core_index, rsrc_node->res_id);
+			continue;
+		}
+
+		rsrc_data = rsrc_node->res_priv;
+		if (!rsrc_data)
+			continue;
+		for (j = 0; j < rsrc_data->num_wm; j++) {
+
+			wm = rsrc_data->wm_res[j].res_priv;
+			if (!wm)
+				continue;
+
+			rc = cam_common_user_dump_helper(dump_args, cam_vfe_bus_ver3_user_dump_info,
+				wm, sizeof(uint32_t), "VFE_BUS_CLIENT.%s.%d:",
+				rsrc_data->wm_res[j].res_name,
+				rsrc_data->common_data->core_index);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "VFE:%u BUS VER3: Info dump failed, rc: %d",
+					bus_priv->common_data.core_index, rc);
+				return rc;
+			}
+		}
+	}
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_handle_bus_irq(uint32_t    evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_vfe_bus_ver3_priv          *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	CAM_DBG(CAM_ISP, "Enter VFE:%u", bus_priv->common_data.core_index);
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller, CAM_IRQ_EVT_GROUP_0);
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_vfe_bus_ver3_handle_rup_irq(uint32_t     evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_vfe_bus_ver3_priv          *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	CAM_DBG(CAM_ISP, "Enter, VFE:%u", bus_priv->common_data.core_index);
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller, CAM_IRQ_EVT_GROUP_1);
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_vfe_bus_ver3_handle_err_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int i = 0, rc = 0;
+	struct cam_vfe_bus_ver3_priv *bus_priv =
+		th_payload->handler_priv;
+	struct cam_vfe_bus_irq_evt_payload *evt_payload;
+
+	CAM_ERR(CAM_ISP, "VFE:%u BUS Err IRQ",
+		bus_priv->common_data.core_index);
+	for (i = 0; i < th_payload->num_registers; i++) {
+		CAM_ERR(CAM_ISP, "VFE:%u BUS IRQ status_%d: 0x%X",
+		bus_priv->common_data.core_index, i,
+			th_payload->evt_status_arr[i]);
+	}
+	cam_irq_controller_disable_irq(bus_priv->common_data.bus_irq_controller,
+		bus_priv->error_irq_handle);
+
+	rc  = cam_vfe_bus_ver3_get_evt_payload(&bus_priv->common_data,
+		&evt_payload);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->core_index = bus_priv->common_data.core_index;
+
+	evt_payload->ccif_violation_status = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->ccif_violation_status);
+
+	evt_payload->image_size_violation_status = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->image_size_violation_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static void cam_vfe_check_violations(
+	char *error_type,
+	uint32_t status,
+	struct cam_vfe_bus_ver3_priv *bus_priv,
+	uint64_t *out_port,
+	struct cam_vfe_bus_irq_violation_type *violation_type)
+{
+	int i, j;
+	struct cam_isp_resource_node       *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data      *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data  *wm_data   = NULL;
+	struct cam_vfe_bus_ver3_common_data  *common_data = NULL;
+	uint8_t                                *wm_name = NULL;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid bus private data");
+		return;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rsrc_node = &bus_priv->vfe_out[i];
+		rsrc_data = rsrc_node->res_priv;
+		if (!rsrc_data) {
+			CAM_ERR(CAM_ISP, "VFE:%u out data is null, res_id: %d",
+				bus_priv->common_data.core_index, i);
+			return;
+		}
+
+		for (j = 0; j < rsrc_data->num_wm; j++) {
+			wm_data = rsrc_data->wm_res[j].res_priv;
+			common_data = rsrc_data->common_data;
+			wm_name = rsrc_data->wm_res[j].res_name;
+
+			if (status & BIT(wm_data->index)) {
+				CAM_INFO(CAM_ISP, "VFE:%u, %s Violation",
+					bus_priv->common_data.core_index, error_type);
+				cam_vfe_bus_ver3_print_wm_info(wm_data,
+					common_data, wm_name);
+				*out_port |= BIT_ULL(rsrc_node->res_id & 0xFF);
+
+				/* check what type of violation it is*/
+				switch (wm_data->index) {
+				case 21:
+				case 22:
+					if (!strcmp(error_type, "Image Size"))
+						violation_type->hwpd_violation = true;
+					break;
+				default:
+					break;
+				}
+			}
+		}
+	}
+}
+
+static int cam_vfe_bus_ver3_handle_err_irq_bottom_half(
+	void *handler_priv, void *evt_payload_priv)
+{
+	struct cam_vfe_bus_irq_evt_payload *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver3_priv *bus_priv = handler_priv;
+	struct cam_vfe_bus_ver3_common_data *common_data;
+	struct cam_isp_hw_event_info evt_info;
+	struct cam_isp_hw_error_event_info err_evt_info;
+	struct cam_vfe_bus_irq_violation_type violation_type;
+	uint32_t status = 0, image_size_violation = 0, ccif_violation = 0, constraint_violation = 0;
+	uint64_t out_port_mask = 0;
+	int idx = -1;
+
+	if (!handler_priv || !evt_payload_priv)
+		return -EINVAL;
+
+	common_data = &bus_priv->common_data;
+
+	status = evt_payload->irq_reg_val[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+	image_size_violation = (status >> 31) & 0x1;
+	ccif_violation = (status >> 30) & 0x1;
+	constraint_violation = (status >> 28) & 0x1;
+
+	CAM_ERR(CAM_ISP,
+		"VFE:%u BUS error image size violation %d CCIF violation %d constraint violation %d",
+		bus_priv->common_data.core_index, image_size_violation,
+		ccif_violation, constraint_violation);
+	CAM_INFO(CAM_ISP,
+		"VFE:%u Image Size violation status 0x%X CCIF violation status 0x%X",
+		bus_priv->common_data.core_index, evt_payload->image_size_violation_status,
+		evt_payload->ccif_violation_status);
+
+	memset(&evt_info, 0, sizeof(evt_info));
+	memset(&err_evt_info, 0, sizeof(err_evt_info));
+	memset(&violation_type, 0, sizeof(violation_type));
+
+	if (image_size_violation || constraint_violation) {
+		status = evt_payload->image_size_violation_status;
+		if (!status)
+			cam_vfe_bus_ver3_get_constraint_errors(bus_priv);
+		else {
+			cam_vfe_check_violations("Image Size", status, bus_priv,
+				&out_port_mask, &violation_type);
+		}
+	}
+
+	if (ccif_violation) {
+		status = evt_payload->ccif_violation_status;
+		cam_vfe_check_violations("CCIF", status, bus_priv,
+			&out_port_mask, &violation_type);
+	}
+
+	if (image_size_violation && violation_type.hwpd_violation) {
+		err_evt_info.err_mask |= CAM_VFE_IRQ_ERR_MASK_HWPD_VIOLATION;
+		CAM_DBG(CAM_ISP, "HWPD image size violation");
+	}
+
+	cam_vfe_bus_ver3_put_evt_payload(common_data, &evt_payload);
+
+	evt_info.hw_idx = common_data->core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	evt_info.hw_type = CAM_ISP_HW_TYPE_VFE;
+	err_evt_info.err_type = CAM_VFE_IRQ_STATUS_VIOLATION;
+	evt_info.event_data = (void *)&err_evt_info;
+
+	if (!common_data->event_cb)
+		return 0;
+
+	if (!out_port_mask) {
+		/* No valid res_id found */
+		evt_info.res_id = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+		common_data->event_cb(common_data->priv, CAM_ISP_HW_EVENT_ERROR,
+			(void *)&evt_info);
+		return 0;
+	}
+
+	while (out_port_mask) {
+		idx++;
+		if (!(out_port_mask & 0x1)) {
+			out_port_mask >>= 1;
+			continue;
+		}
+
+		evt_info.res_id = CAM_ISP_IFE_OUT_RES_BASE + idx;
+		common_data->event_cb(common_data->priv, CAM_ISP_HW_EVENT_ERROR,
+			(void *)&evt_info);
+		out_port_mask >>= 1;
+	}
+	return 0;
+}
+
+static void cam_vfe_bus_ver3_unsubscribe_init_irq(
+	struct cam_vfe_bus_ver3_priv          *bus_priv)
+{
+	int rc = 0;
+
+	if (bus_priv->error_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			bus_priv->error_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP, "VFE:%u failed to unsubscribe error irqs",
+				bus_priv->common_data.core_index);
+
+		bus_priv->error_irq_handle = 0;
+	}
+
+	if (bus_priv->bus_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			bus_priv->bus_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP, "VFE:%u failed to unsubscribe top irq",
+				bus_priv->common_data.core_index);
+
+		bus_priv->bus_irq_handle = 0;
+		cam_irq_controller_unregister_dependent(bus_priv->common_data.vfe_irq_controller,
+		bus_priv->common_data.bus_irq_controller);
+	}
+
+	if (bus_priv->rup_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			bus_priv->rup_irq_handle);
+		if (rc)
+			CAM_WARN(CAM_ISP, "VFE:%u failed to unsubscribe rup done irq",
+				bus_priv->common_data.core_index);
+
+		bus_priv->rup_irq_handle = 0;
+	}
+
+	bus_priv->common_data.init_irq_subscribed = false;
+	CAM_DBG(CAM_ISP, "BUS init irq unsubscribed, VFE:%u", bus_priv->common_data.core_index);
+}
+
+static int cam_vfe_bus_ver3_subscribe_init_irq(
+	struct cam_vfe_bus_ver3_priv          *bus_priv)
+{
+	uint32_t top_irq_reg_mask[3] = {0};
+
+	/* Subscribe top IRQ */
+	top_irq_reg_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	cam_irq_controller_register_dependent(
+		bus_priv->common_data.vfe_irq_controller,
+		bus_priv->common_data.bus_irq_controller,
+		top_irq_reg_mask);
+
+	bus_priv->bus_irq_handle = cam_irq_controller_subscribe_irq(
+		bus_priv->common_data.vfe_irq_controller,
+		CAM_IRQ_PRIORITY_4,
+		top_irq_reg_mask,
+		bus_priv,
+		cam_vfe_bus_ver3_handle_bus_irq,
+		NULL,
+		NULL,
+		NULL,
+		CAM_IRQ_EVT_GROUP_0);
+
+	if (bus_priv->bus_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "VFE:%u Failed to subscribe BUS (buf_done) IRQ",
+			bus_priv->common_data.core_index);
+		bus_priv->bus_irq_handle = 0;
+		return -EFAULT;
+	}
+
+
+	if (bus_priv->tasklet_info != NULL) {
+		bus_priv->error_irq_handle = cam_irq_controller_subscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			bus_error_irq_mask,
+			bus_priv,
+			cam_vfe_bus_ver3_handle_err_irq_top_half,
+			cam_vfe_bus_ver3_handle_err_irq_bottom_half,
+			bus_priv->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (bus_priv->error_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "VFE:%u Failed to subscribe BUS Error IRQ",
+				bus_priv->common_data.core_index);
+			bus_priv->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	if (bus_priv->common_data.supported_irq & CAM_VFE_HW_IRQ_CAP_RUP) {
+		bus_priv->rup_irq_handle = cam_irq_controller_subscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			CAM_IRQ_PRIORITY_2,
+			top_irq_reg_mask,
+			bus_priv,
+			cam_vfe_bus_ver3_handle_rup_irq,
+			NULL,
+			NULL,
+			NULL,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (bus_priv->rup_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "VFE:%u Failed to subscribe BUS (rup) IRQ",
+				bus_priv->common_data.core_index);
+			bus_priv->rup_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	bus_priv->common_data.init_irq_subscribed = true;
+	CAM_DBG(CAM_ISP, "VFE:%u BUS irq subscribed", bus_priv->common_data.core_index);
+	return 0;
+}
+
+static void cam_vfe_bus_ver3_update_ubwc_meta_addr(
+	uint32_t *reg_val_pair,
+	uint32_t  *j,
+	void     *regs,
+	dma_addr_t  image_buf)
+{
+	struct cam_vfe_bus_ver3_reg_offset_ubwc_client *ubwc_regs;
+	uint32_t temp = cam_smmu_is_expanded_memory() ?
+		CAM_36BIT_INTF_GET_IOVA_BASE(image_buf) : image_buf;
+
+	if (cam_smmu_is_expanded_memory() &&
+		CAM_36BIT_INTF_GET_IOVA_OFFSET(image_buf)) {
+		CAM_ERR(CAM_ISP, "Error, address not aligned! offset:0x%x",
+			CAM_36BIT_INTF_GET_IOVA_OFFSET(image_buf));
+	}
+
+	if (!regs || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		goto end;
+	}
+
+	ubwc_regs = (struct cam_vfe_bus_ver3_reg_offset_ubwc_client *) regs;
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j, ubwc_regs->meta_addr, temp);
+
+end:
+	return;
+}
+
+static int cam_vfe_bus_ver3_update_ubwc_regs(
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data,
+	uint32_t *reg_val_pair,	uint32_t i, uint32_t *j)
+{
+	struct cam_vfe_bus_ver3_reg_offset_ubwc_client *ubwc_regs;
+	int rc = 0;
+
+	if (!wm_data || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_regs = (struct cam_vfe_bus_ver3_reg_offset_ubwc_client *)
+		wm_data->hw_regs->ubwc_regs;
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		wm_data->hw_regs->packer_cfg, wm_data->packer_cfg);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d packer cfg 0x%X",
+		wm_data->common_data->core_index, wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_cfg, wm_data->ubwc_meta_cfg);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d meta stride 0x%X",
+		wm_data->common_data->core_index, wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->common_data->disable_ubwc_comp) {
+		wm_data->ubwc_mode_cfg &= ~ubwc_regs->ubwc_comp_en_bit;
+		CAM_DBG(CAM_ISP,
+			"Force disable UBWC compression on VFE:%u WM:%d",
+			wm_data->common_data->core_index, wm_data->index);
+	}
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->mode_cfg, wm_data->ubwc_mode_cfg);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d ubwc_mode_cfg 0x%X",
+		 wm_data->common_data->core_index, wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->ctrl_2, wm_data->ubwc_ctrl_2);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d ubwc_ctrl_2 0x%X",
+		wm_data->common_data->core_index, wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->lossy_thresh0, wm_data->ubwc_lossy_threshold_0);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d lossy_thresh0 0x%X",
+		wm_data->common_data->core_index, wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->lossy_thresh1, wm_data->ubwc_lossy_threshold_1);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d lossy_thresh1 0x%X",
+		wm_data->common_data->core_index, wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->off_lossy_var, wm_data->ubwc_offset_lossy_variance);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d off_lossy_var 0x%X",
+		wm_data->common_data->core_index, wm_data->index, reg_val_pair[*j-1]);
+
+	/*
+	 * If limit value >= 0xFFFF, limit configured by
+	 * generic limiter blob
+	 */
+	if (wm_data->ubwc_bandwidth_limit < 0xFFFF) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->bw_limit, wm_data->ubwc_bandwidth_limit);
+		CAM_DBG(CAM_ISP, "VFE:%u WM:%d ubwc bw limit 0x%X",
+			wm_data->common_data->core_index, wm_data->index,
+			wm_data->ubwc_bandwidth_limit);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_config_ubwc_regs(
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data)
+{
+	struct cam_vfe_bus_ver3_reg_offset_ubwc_client *ubwc_regs =
+		(struct cam_vfe_bus_ver3_reg_offset_ubwc_client *)
+		wm_data->hw_regs->ubwc_regs;
+
+	cam_io_w_mb(wm_data->packer_cfg, wm_data->common_data->mem_base +
+		wm_data->hw_regs->packer_cfg);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d packer cfg:0x%x",
+		wm_data->common_data->core_index, wm_data->index, wm_data->packer_cfg);
+
+	cam_io_w_mb(wm_data->ubwc_meta_cfg,
+		wm_data->common_data->mem_base + ubwc_regs->meta_cfg);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d meta stride:0x%x",
+		wm_data->common_data->core_index, wm_data->index, wm_data->ubwc_meta_cfg);
+
+	if (wm_data->common_data->disable_ubwc_comp) {
+		wm_data->ubwc_mode_cfg &= ~ubwc_regs->ubwc_comp_en_bit;
+		CAM_DBG(CAM_ISP,
+			"Force disable UBWC compression on VFE:%u WM:%d",
+			wm_data->common_data->core_index, wm_data->index);
+	}
+
+	cam_io_w_mb(wm_data->ubwc_mode_cfg,
+		wm_data->common_data->mem_base + ubwc_regs->mode_cfg);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d ubwc_mode_cfg:0x%x",
+		wm_data->common_data->core_index, wm_data->index, wm_data->ubwc_mode_cfg);
+
+	cam_io_w_mb(wm_data->ubwc_ctrl_2,
+		wm_data->common_data->mem_base + ubwc_regs->ctrl_2);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d ubwc_ctrl_2:0x%x",
+		wm_data->common_data->core_index, wm_data->index, wm_data->ubwc_ctrl_2);
+
+	cam_io_w_mb(wm_data->ubwc_lossy_threshold_0,
+		wm_data->common_data->mem_base + ubwc_regs->lossy_thresh0);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d lossy_thresh0: 0x%x",
+		wm_data->common_data->core_index, wm_data->index, wm_data->ubwc_lossy_threshold_0);
+
+	cam_io_w_mb(wm_data->ubwc_lossy_threshold_1,
+		wm_data->common_data->mem_base + ubwc_regs->lossy_thresh1);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d lossy_thresh0:0x%x",
+		wm_data->common_data->core_index, wm_data->index, wm_data->ubwc_lossy_threshold_1);
+
+	cam_io_w_mb(wm_data->ubwc_offset_lossy_variance,
+		wm_data->common_data->mem_base + ubwc_regs->off_lossy_var);
+	CAM_DBG(CAM_ISP, "VFE:%u WM:%d off_lossy_var:0x%x",
+	wm_data->common_data->core_index, wm_data->index, wm_data->ubwc_offset_lossy_variance);
+
+	/*
+	 * If limit value >= 0xFFFF, limit configured by
+	 * generic limiter blob
+	 */
+	if (wm_data->ubwc_bandwidth_limit < 0xFFFF) {
+		cam_io_w_mb(wm_data->ubwc_bandwidth_limit,
+			wm_data->common_data->mem_base + ubwc_regs->bw_limit);
+		CAM_DBG(CAM_ISP, "VFE:%u WM:%d ubwc bw limit:0x%x",
+			wm_data->common_data->core_index, wm_data->index,
+			wm_data->ubwc_bandwidth_limit);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_config_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update *update_buf;
+	struct cam_vfe_bus_ver3_priv *bus_priv;
+	struct cam_vfe_bus_ver3_vfe_out_data *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data = NULL;
+	struct cam_vfe_bus_ver3_reg_offset_ubwc_client *ubwc_regs;
+	uint32_t i, val, iova_addr, iova_offset, stride;
+	dma_addr_t iova;
+
+	update_buf = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		update_buf->res->res_priv;
+	if (!vfe_out_data) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		return -EINVAL;
+	}
+
+	if (!vfe_out_data->limiter_enabled)
+		CAM_WARN(CAM_ISP,
+			"Configuring scratch for VFE:%u out_type: %u, with no BW limiter enabled",
+			bus_priv->common_data.core_index, vfe_out_data->out_type);
+
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+		ubwc_regs = (struct cam_vfe_bus_ver3_reg_offset_ubwc_client *)
+			wm_data->hw_regs->ubwc_regs;
+
+		stride =  update_buf->wm_update->stride;
+		val = stride;
+		val = ALIGNUP(val, 16);
+		if (val != stride &&
+			val != wm_data->stride)
+			CAM_WARN(CAM_SFE, "VFE:%u Warning stride %u expected %u",
+				bus_priv->common_data.core_index, stride, val);
+
+		if (wm_data->stride != val || !wm_data->init_cfg_done) {
+			cam_io_w_mb(stride, wm_data->common_data->mem_base +
+				wm_data->hw_regs->image_cfg_2);
+			wm_data->stride = val;
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d image stride 0x%x",
+				bus_priv->common_data.core_index, wm_data->index, stride);
+		}
+
+		/* WM Image address */
+		iova = update_buf->wm_update->image_buf[i];
+		if (cam_smmu_is_expanded_memory()) {
+			iova_addr = CAM_36BIT_INTF_GET_IOVA_BASE(iova);
+			iova_offset = CAM_36BIT_INTF_GET_IOVA_OFFSET(iova);
+
+			cam_io_w_mb(iova_addr, wm_data->common_data->mem_base +
+				wm_data->hw_regs->image_addr);
+			cam_io_w_mb(iova_offset, wm_data->common_data->mem_base +
+				wm_data->hw_regs->addr_cfg);
+
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d image address 0x%x 0x%x",
+				bus_priv->common_data.core_index, wm_data->index,
+				iova_addr, iova_offset);
+		} else {
+			iova_addr = iova;
+			cam_io_w_mb(iova_addr, wm_data->common_data->mem_base +
+				wm_data->hw_regs->image_addr);
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d image address 0x%X",
+				bus_priv->common_data.core_index, wm_data->index, iova_addr);
+		}
+
+		if (wm_data->en_ubwc) {
+			if (!wm_data->hw_regs->ubwc_regs) {
+				CAM_ERR(CAM_ISP,
+					"VFE:%u No UBWC register to configure for WM: %u",
+					bus_priv->common_data.core_index, wm_data->index);
+				return -EINVAL;
+			}
+
+			if (wm_data->ubwc_updated) {
+				wm_data->ubwc_updated = false;
+				cam_vfe_bus_ver3_config_ubwc_regs(wm_data);
+			}
+
+			cam_io_w_mb(iova_addr, wm_data->common_data->mem_base +
+				ubwc_regs->meta_addr);
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d meta address 0x%x",
+				bus_priv->common_data.core_index, wm_data->index, iova_addr);
+		}
+
+		/* enable the WM */
+		cam_io_w_mb(wm_data->en_cfg, wm_data->common_data->mem_base +
+			wm_data->hw_regs->cfg);
+		CAM_DBG(CAM_ISP, "VFE:%u WM:%d en_cfg 0x%x",
+			bus_priv->common_data.core_index, wm_data->index, wm_data->en_cfg);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update         *update_buf;
+	struct cam_vfe_bus_ver3_priv             *bus_priv;
+	struct cam_buf_io_cfg                    *io_cfg;
+	struct cam_vfe_bus_ver3_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data = NULL;
+	struct cam_cdm_utils_ops                       *cdm_util_ops;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t i, j, size = 0;
+	uint32_t frame_inc = 0, val;
+	uint32_t iova_addr, iova_offset, image_buf_offset = 0, stride, slice_h;
+	dma_addr_t iova;
+
+	update_buf = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		update_buf->res->res_priv;
+	if (!vfe_out_data || !vfe_out_data->common_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = vfe_out_data->common_data->cdm_util_ops;
+	if ((update_buf->wm_update->num_buf != vfe_out_data->num_wm) &&
+		(!(update_buf->use_scratch_cfg))) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%u Failed! Invalid number buffers:%d required:%d",
+			bus_priv->common_data.core_index, update_buf->wm_update->num_buf,
+			vfe_out_data->num_wm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	if (update_buf->use_scratch_cfg) {
+		CAM_DBG(CAM_ISP, "VFE:%u Using scratch for IFE out_type: %u",
+			bus_priv->common_data.core_index, vfe_out_data->out_type);
+
+		if (!vfe_out_data->limiter_enabled)
+			CAM_WARN(CAM_ISP,
+				"Configuring scratch for VFE:%u out_type: %u, with no BW limiter enabled",
+				bus_priv->common_data.core_index, vfe_out_data->out_type);
+	} else {
+		io_cfg = update_buf->wm_update->io_cfg;
+	}
+
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u reg_val_pair %d exceeds the array limit %zu",
+				bus_priv->common_data.core_index, j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+
+		/* Disable frame header in case it was previously enabled */
+		if ((wm_data->en_cfg) & (1 << 2))
+			wm_data->en_cfg &= ~(1 << 2);
+
+		if (update_buf->wm_update->frame_header &&
+			!update_buf->wm_update->fh_enabled &&
+			wm_data->hw_regs->frame_header_addr) {
+
+			wm_data->en_cfg |= 1 << 2;
+			update_buf->wm_update->fh_enabled = true;
+			if (cam_smmu_is_expanded_memory()) {
+				iova_addr = CAM_36BIT_INTF_GET_IOVA_BASE(
+					update_buf->wm_update->frame_header);
+				iova_offset = CAM_36BIT_INTF_GET_IOVA_OFFSET(
+					update_buf->wm_update->frame_header);
+			} else {
+				iova_addr = update_buf->wm_update->frame_header;
+				iova_offset = 0;
+			}
+
+			if (iova_offset)
+				CAM_ERR(CAM_ISP, "VFE:%u Error, address not aligned! offset:0x%x",
+					bus_priv->common_data.core_index, iova_offset);
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->frame_header_addr, iova_addr);
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->frame_header_cfg,
+				update_buf->wm_update->local_id);
+			CAM_DBG(CAM_ISP,
+				"VFE:%u WM: %d en_cfg 0x%x frame_header %pK local_id %u",
+				bus_priv->common_data.core_index, wm_data->index, wm_data->en_cfg,
+				update_buf->wm_update->frame_header,
+				update_buf->wm_update->local_id);
+		}
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg, wm_data->en_cfg);
+		CAM_DBG(CAM_ISP, "VFE:%u WM:%d %s en_cfg 0x%X",
+			bus_priv->common_data.core_index, wm_data->index,
+			vfe_out_data->wm_res[i].res_name, reg_val_pair[j-1]);
+
+		val = (wm_data->height << 16) | wm_data->width;
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_cfg_0, val);
+		CAM_DBG(CAM_ISP, "VFE:%u WM:%d image height and width 0x%X",
+			bus_priv->common_data.core_index, wm_data->index, reg_val_pair[j-1]);
+
+		/* For initial configuration program all bus registers */
+		if (update_buf->use_scratch_cfg) {
+			stride = update_buf->wm_update->stride;
+			slice_h = update_buf->wm_update->slice_height;
+		} else {
+			stride = io_cfg->planes[i].plane_stride;
+			slice_h = io_cfg->planes[i].slice_height;
+		}
+
+		val = stride;
+		CAM_DBG(CAM_ISP, "VFE:%u val before stride %d",
+			bus_priv->common_data.core_index, val);
+		val = ALIGNUP(val, 16);
+		if (val != stride)
+			CAM_DBG(CAM_ISP, "VFE:%u Warning stride %u expected %u",
+				bus_priv->common_data.core_index, stride, val);
+
+		if (wm_data->stride != val || !wm_data->init_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_2,
+				stride);
+			wm_data->stride = val;
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d image stride 0x%X",
+				bus_priv->common_data.core_index, wm_data->index,
+				reg_val_pair[j-1]);
+		}
+
+		/*
+		 * For write master format update case, we check whether
+		 * the updated format matches with the io config format,
+		 * to help debug the wrong programming on a target who
+		 * doesn't support 2 decode formats on CSID.
+		 */
+		if (wm_data->update_wm_format) {
+			if ((!update_buf->use_scratch_cfg) &&
+				(io_cfg->format != wm_data->format))
+				CAM_WARN(CAM_ISP,
+					"VFE:%u format mismatch, wm_data format:%u io_cfg format:%u",
+					bus_priv->common_data.core_index,
+					wm_data->format,
+					io_cfg->format);
+
+			val = wm_data->pack_fmt;
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->packer_cfg, val);
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d image pack_fmt %d",
+				bus_priv->common_data.core_index,
+				wm_data->index,
+				reg_val_pair[j-1]);
+		}
+
+		if (wm_data->en_ubwc) {
+			if (!wm_data->hw_regs->ubwc_regs) {
+				CAM_ERR(CAM_ISP,
+					"VFE:%u No UBWC register to configure.",
+					bus_priv->common_data.core_index);
+				return -EINVAL;
+			}
+			if (wm_data->ubwc_updated) {
+				wm_data->ubwc_updated = false;
+				cam_vfe_bus_ver3_update_ubwc_regs(
+					wm_data, reg_val_pair, i, &j);
+			}
+
+			/* UBWC meta address */
+			cam_vfe_bus_ver3_update_ubwc_meta_addr(
+				reg_val_pair, &j,
+				wm_data->hw_regs->ubwc_regs,
+				update_buf->wm_update->image_buf[i]);
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d ubwc meta addr 0x%llx",
+				bus_priv->common_data.core_index, wm_data->index,
+				update_buf->wm_update->image_buf[i]);
+		}
+
+		frame_inc = stride * slice_h;
+		if (wm_data->en_ubwc) {
+			frame_inc = ALIGNUP(stride *
+				slice_h, 4096);
+
+			if (!update_buf->use_scratch_cfg) {
+				frame_inc += io_cfg->planes[i].meta_size;
+				CAM_DBG(CAM_ISP,
+					"VFE:%u WM:%d frm %d: ht: %d stride %d meta: %d",
+					bus_priv->common_data.core_index, wm_data->index,
+					frame_inc, io_cfg->planes[i].slice_height,
+					io_cfg->planes[i].plane_stride,
+					io_cfg->planes[i].meta_size);
+			}
+		}
+
+		if (!(wm_data->en_cfg & (0x3 << 16))) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_1, wm_data->h_init);
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d h_init 0x%X",
+				bus_priv->common_data.core_index, wm_data->index,
+				reg_val_pair[j-1]);
+		}
+
+		if ((wm_data->en_ubwc) && (!update_buf->use_scratch_cfg))
+			image_buf_offset = io_cfg->planes[i].meta_size;
+		else if (wm_data->en_cfg & (0x3 << 16))
+			image_buf_offset = wm_data->offset;
+		else
+			image_buf_offset = 0;
+
+		/* WM Image address */
+		iova = update_buf->wm_update->image_buf[i] +
+			image_buf_offset;
+
+		if (cam_smmu_is_expanded_memory()) {
+			iova_addr = CAM_36BIT_INTF_GET_IOVA_BASE(iova);
+			iova_offset = CAM_36BIT_INTF_GET_IOVA_OFFSET(iova);
+
+			/* Align frame inc to 256 as well */
+			frame_inc = CAM_36BIT_INTF_GET_IOVA_BASE(frame_inc);
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_addr, iova_addr);
+
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->addr_cfg, iova_offset);
+
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d image address:0x%X image offset: 0x%X",
+				bus_priv->common_data.core_index, wm_data->index,
+				reg_val_pair[j-3], reg_val_pair[j-1]);
+		} else {
+			iova_addr = iova;
+
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_addr, iova_addr);
+
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d image address 0x%X",
+				bus_priv->common_data.core_index,
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		update_buf->wm_update->image_buf_offset[i] = image_buf_offset;
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->frame_incr, frame_inc);
+		CAM_DBG(CAM_ISP, "VFE:%u WM:%d frame_inc: %d expanded_mem: %s",
+			bus_priv->common_data.core_index, wm_data->index, reg_val_pair[j-1],
+			CAM_BOOL_TO_YESNO(cam_smmu_is_expanded_memory));
+
+		/* enable the WM */
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg,
+			wm_data->en_cfg);
+
+		/* set initial configuration done */
+		if (!wm_data->init_cfg_done)
+			wm_data->init_cfg_done = true;
+	}
+
+	num_regval_pairs = j / 2;
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_buf->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u Failed! Buf size:%d insufficient, expected size:%d",
+				bus_priv->common_data.core_index, update_buf->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_buf->cmd.cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_buf->cmd.used_bytes = size * 4;
+	} else {
+		CAM_DBG(CAM_ISP,
+			"No reg val pairs. num_wms: %u VFE:%u",
+			vfe_out_data->num_wm, bus_priv->common_data.core_index);
+		update_buf->cmd.used_bytes = 0;
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update         *update_hfr;
+	struct cam_vfe_bus_ver3_priv             *bus_priv;
+	struct cam_vfe_bus_ver3_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data = NULL;
+	struct cam_isp_port_hfr_config           *hfr_cfg = NULL;
+	struct cam_cdm_utils_ops                 *cdm_util_ops;
+	uint32_t *reg_val_pair;
+	uint32_t num_regval_pairs = 0;
+	uint32_t  i, j, size = 0;
+
+	update_hfr =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		update_hfr->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->common_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = vfe_out_data->common_data->cdm_util_ops;
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data;
+
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u reg_val_pair %d exceeds the array limit %zu",
+				bus_priv->common_data.core_index, j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+
+		/* Frame drop config is only applicable to full IFE */
+		if (!bus_priv->common_data.is_lite) {
+			if ((wm_data->framedrop_pattern !=
+				hfr_cfg->framedrop_pattern) ||
+				!wm_data->hfr_cfg_done) {
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					wm_data->hw_regs->framedrop_pattern,
+					hfr_cfg->framedrop_pattern);
+				wm_data->framedrop_pattern = hfr_cfg->framedrop_pattern;
+				CAM_DBG(CAM_ISP, "VFE:%u WM:%d framedrop pattern 0x%X",
+					bus_priv->common_data.core_index, wm_data->index,
+					wm_data->framedrop_pattern);
+			}
+
+			if (wm_data->framedrop_period != hfr_cfg->framedrop_period ||
+				!wm_data->hfr_cfg_done) {
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					wm_data->hw_regs->framedrop_period,
+					hfr_cfg->framedrop_period);
+				wm_data->framedrop_period = hfr_cfg->framedrop_period;
+				CAM_DBG(CAM_ISP, "VFE:%u WM:%d framedrop period 0x%X",
+					bus_priv->common_data.core_index, wm_data->index,
+					wm_data->framedrop_period);
+			}
+		}
+
+		if (wm_data->irq_subsample_period != hfr_cfg->subsample_period
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_period,
+				hfr_cfg->subsample_period);
+			wm_data->irq_subsample_period =
+				hfr_cfg->subsample_period;
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d irq subsample period 0x%X",
+				bus_priv->common_data.core_index, wm_data->index,
+				wm_data->irq_subsample_period);
+		}
+
+		if (wm_data->irq_subsample_pattern != hfr_cfg->subsample_pattern
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_pattern,
+				hfr_cfg->subsample_pattern);
+			wm_data->irq_subsample_pattern =
+				hfr_cfg->subsample_pattern;
+			CAM_DBG(CAM_ISP, "VFE:%u WM:%d irq subsample pattern 0x%X",
+				bus_priv->common_data.core_index, wm_data->index,
+				wm_data->irq_subsample_pattern);
+		}
+
+		/* set initial configuration done */
+		if (!wm_data->hfr_cfg_done)
+			wm_data->hfr_cfg_done = true;
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > update_hfr->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u Failed! Buf size:%d insufficient, expected size:%d",
+				bus_priv->common_data.core_index, update_hfr->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			update_hfr->cmd.cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		update_hfr->cmd.used_bytes = size * 4;
+	} else {
+		update_hfr->cmd.used_bytes = 0;
+		CAM_DBG(CAM_ISP,
+			"VFE:%u No reg val pairs. num_wms: %u",
+			 bus_priv->common_data.core_index, vfe_out_data->num_wm);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_ubwc_config_v2(void *cmd_args)
+{
+	struct cam_isp_hw_get_cmd_update         *update_ubwc;
+	struct cam_vfe_bus_ver3_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data = NULL;
+	struct cam_vfe_generic_ubwc_config       *ubwc_generic_cfg = NULL;
+	struct cam_vfe_generic_ubwc_plane_config *ubwc_generic_plane_cfg = NULL;
+	uint32_t                                  i;
+	int                                       rc = 0;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	update_ubwc =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		update_ubwc->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->common_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_generic_cfg = (struct cam_vfe_generic_ubwc_config *)
+		update_ubwc->data;
+
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+		ubwc_generic_plane_cfg = &ubwc_generic_cfg->ubwc_plane_cfg[i];
+
+		if (!wm_data->hw_regs->ubwc_regs) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u No UBWC register to configure.",
+				vfe_out_data->common_data->core_index);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (!wm_data->en_ubwc) {
+			CAM_ERR(CAM_ISP, "VFE:%u UBWC Disabled",
+				vfe_out_data->common_data->core_index);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (wm_data->packer_cfg !=
+			ubwc_generic_plane_cfg->packer_config ||
+			!wm_data->init_cfg_done) {
+			wm_data->packer_cfg =
+				ubwc_generic_plane_cfg->packer_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->h_init !=
+			ubwc_generic_plane_cfg->h_init) ||
+			!wm_data->init_cfg_done)) {
+			wm_data->h_init = ubwc_generic_plane_cfg->h_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_cfg !=
+			ubwc_generic_plane_cfg->meta_stride ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_cfg =
+				ubwc_generic_plane_cfg->meta_stride;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg !=
+			ubwc_generic_plane_cfg->mode_config_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg =
+				ubwc_generic_plane_cfg->mode_config_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_ctrl_2 !=
+			ubwc_generic_plane_cfg->ctrl_2 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_ctrl_2 =
+				ubwc_generic_plane_cfg->ctrl_2;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_lossy_threshold_0 !=
+			ubwc_generic_plane_cfg->lossy_threshold_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_lossy_threshold_0 =
+				ubwc_generic_plane_cfg->lossy_threshold_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_lossy_threshold_1 !=
+			ubwc_generic_plane_cfg->lossy_threshold_1 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_lossy_threshold_1 =
+				ubwc_generic_plane_cfg->lossy_threshold_1;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_offset_lossy_variance !=
+			ubwc_generic_plane_cfg->lossy_var_offset ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_offset_lossy_variance =
+				ubwc_generic_plane_cfg->lossy_var_offset;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_bandwidth_limit !=
+			ubwc_generic_plane_cfg->bandwidth_limit ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_bandwidth_limit =
+				ubwc_generic_plane_cfg->bandwidth_limit;
+			wm_data->ubwc_updated = true;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_update_stripe_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_priv                *bus_priv;
+	struct cam_isp_hw_dual_isp_update_args      *stripe_args;
+	struct cam_vfe_bus_ver3_vfe_out_data        *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data    *wm_data = NULL;
+	struct cam_isp_dual_stripe_config           *stripe_config;
+	uint32_t outport_id, ports_plane_idx, i;
+
+	bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+	stripe_args = (struct cam_isp_hw_dual_isp_update_args *)cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		stripe_args->res->res_priv;
+
+	if (!vfe_out_data) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	outport_id = stripe_args->res->res_id & 0xFF;
+	if (stripe_args->res->res_id < CAM_ISP_IFE_OUT_RES_BASE ||
+		stripe_args->res->res_id >= bus_priv->max_out_res)
+		return 0;
+
+	ports_plane_idx = (stripe_args->split_id *
+	(stripe_args->dual_cfg->num_ports * CAM_PACKET_MAX_PLANES)) +
+	(outport_id * CAM_PACKET_MAX_PLANES);
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+		stripe_config = (struct cam_isp_dual_stripe_config  *)
+			&stripe_args->dual_cfg->stripes_flex[ports_plane_idx + i];
+		wm_data->width = stripe_config->width;
+
+		/*
+		 * UMD sends buffer offset address as offset for clients
+		 * programmed to operate in frame/index based mode and h_init
+		 * value as offset for clients programmed to operate in line
+		 * based mode.
+		 */
+
+		if (wm_data->en_cfg & (0x3 << 16))
+			wm_data->offset = stripe_config->offset;
+		else
+			wm_data->h_init = stripe_config->offset;
+
+		CAM_DBG(CAM_ISP,
+			"VFE:%u out_type:0x%X WM:%d width:%d offset:0x%X h_init:%d",
+			vfe_out_data->common_data->core_index, stripe_args->res->res_id,
+			wm_data->index, wm_data->width, wm_data->offset, wm_data->h_init);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_wm_config(
+	void                                        *cmd_args)
+{
+	int                                          i;
+	struct cam_isp_hw_get_cmd_update            *wm_config_update;
+	struct cam_vfe_bus_ver3_vfe_out_data        *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data    *wm_data = NULL;
+	struct cam_isp_vfe_wm_config                *wm_config = NULL;
+	enum   cam_vfe_bus_ver3_packer_format        packer_fmt =
+		PACKER_FMT_VER3_MAX;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	wm_config_update = cmd_args;
+	vfe_out_data = wm_config_update->res->res_priv;
+	wm_config = (struct cam_isp_vfe_wm_config  *)
+		wm_config_update->data;
+
+	if (!vfe_out_data || !vfe_out_data->common_data->cdm_util_ops || !wm_config) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+
+		if (wm_config->wm_mode >= CAM_VFE_WM_MODE_MAX) {
+			CAM_ERR(CAM_ISP, "VFE:%u Invalid wm_mode: 0x%X WM:%d",
+				vfe_out_data->common_data->core_index, wm_config->wm_mode,
+				wm_data->index);
+			return -EINVAL;
+		}
+
+		wm_data->en_cfg = ((wm_config->wm_mode << 16) |
+			(wm_config->virtual_frame_en << 1) | 0x1);
+		wm_data->width  = wm_config->width;
+
+		if (i == PLANE_C)
+			wm_data->height = wm_config->height / 2;
+		else
+			wm_data->height = wm_config->height;
+
+		/*
+		 * For RAW10/RAW12/RAW14 sensor mode seamless switch case,
+		 * the format may be changed on RDIs, so we update RDIs WM data.
+		 */
+		wm_data->update_wm_format = false;
+		if ((wm_config->packer_format != CAM_FORMAT_BASE) &&
+			(wm_data->format != wm_config->packer_format)) {
+			wm_data->update_wm_format = true;
+			wm_data->format = wm_config->packer_format;
+			packer_fmt = cam_vfe_bus_ver3_get_packer_fmt(
+				wm_config->packer_format, wm_data->index);
+
+			/* Reconfigure only for valid packer fmt */
+			if (packer_fmt != PACKER_FMT_VER3_MAX) {
+				if ((vfe_out_data->out_type >= CAM_VFE_BUS_VER3_VFE_OUT_RDI0) &&
+					(vfe_out_data->out_type <= CAM_VFE_BUS_VER3_VFE_OUT_RDI5)) {
+					if (wm_config->wm_mode != wm_data->wm_mode) {
+						wm_data->wm_mode = wm_config->wm_mode;
+						cam_vfe_bus_ver3_config_rdi_wm(wm_data);
+					}
+				}
+
+				/* LSB aligned for plain type format */
+				switch (wm_config->packer_format) {
+				case CAM_FORMAT_PLAIN16_10:
+				case CAM_FORMAT_PLAIN16_12:
+				case CAM_FORMAT_PLAIN16_14:
+				case CAM_FORMAT_PLAIN16_16:
+					packer_fmt |=
+						(1 << wm_data->common_data->pack_align_shift);
+					wm_data->pack_fmt = packer_fmt;
+					break;
+				default:
+					break;
+				}
+			} else {
+				CAM_ERR(CAM_ISP, "VFE:%u Invalid format:%d",
+					vfe_out_data->common_data->core_index,
+					wm_config->packer_format);
+				return -EINVAL;
+			}
+
+			CAM_DBG(CAM_ISP,
+				"VFE:%u WM:%d update format:%d pack_fmt:%d",
+				vfe_out_data->common_data->core_index, wm_data->index,
+				wm_config->packer_format, wm_data->pack_fmt);
+		}
+
+		CAM_DBG(CAM_ISP,
+			"VFE:%u WM:%d en_cfg:0x%X height:%d width:%d stride:%d",
+			vfe_out_data->common_data->core_index, wm_data->index, wm_data->en_cfg,
+			wm_data->height, wm_data->width, wm_data->stride);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_update_bw_limiter(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update         *wm_config_update;
+	struct cam_vfe_bus_ver3_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_cdm_utils_ops                 *cdm_util_ops;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data = NULL;
+	struct cam_isp_wm_bw_limiter_config      *wm_bw_limit_cfg = NULL;
+	uint32_t                                  counter_limit = 0, reg_val = 0;
+	uint32_t                                 *reg_val_pair, num_regval_pairs = 0;
+	uint32_t                                  i, j, size = 0;
+	bool                                      limiter_enabled = false;
+
+	wm_config_update = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+	wm_bw_limit_cfg  = (struct cam_isp_wm_bw_limiter_config  *)
+			wm_config_update->data;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		wm_config_update->res->res_priv;
+	if (!vfe_out_data || !vfe_out_data->common_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = vfe_out_data->common_data->cdm_util_ops;
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - (MAX_BUF_UPDATE_REG_NUM * 2))) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u reg_val_pair %d exceeds the array limit %zu for WM idx %d",
+				vfe_out_data->common_data->core_index, j,
+				MAX_REG_VAL_PAIR_SIZE, i);
+			return -ENOMEM;
+		}
+
+		/* Num WMs needs to match max planes */
+		if (i >= CAM_PACKET_MAX_PLANES) {
+			CAM_WARN(CAM_ISP,
+				"VFE:%u Num of WMs: %d exceeded max planes",
+				vfe_out_data->common_data->core_index, i);
+			goto add_reg_pair;
+		}
+
+		wm_data = (struct cam_vfe_bus_ver3_wm_resource_data *)
+			vfe_out_data->wm_res[i].res_priv;
+		if (!wm_data->hw_regs->bw_limiter_addr) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u WM: %d %s has no support for bw limiter",
+				vfe_out_data->common_data->core_index, wm_data->index,
+				vfe_out_data->wm_res[i].res_name);
+			return -EINVAL;
+		}
+
+		counter_limit = wm_bw_limit_cfg->counter_limit[i];
+
+		/* Validate max counter limit */
+		if (counter_limit >
+			wm_data->common_data->max_bw_counter_limit) {
+			CAM_WARN(CAM_ISP,
+				"VFE:%u Invalid counter limit: 0x%x capping to max: 0x%x",
+				vfe_out_data->common_data->core_index,
+				wm_bw_limit_cfg->counter_limit[i],
+				wm_data->common_data->max_bw_counter_limit);
+			counter_limit =
+				wm_data->common_data->max_bw_counter_limit;
+		}
+
+		if (wm_bw_limit_cfg->enable_limiter && counter_limit) {
+			reg_val = 1;
+			reg_val |= (counter_limit << 1);
+			limiter_enabled = true;
+		} else {
+			reg_val = 0;
+		}
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->bw_limiter_addr, reg_val);
+		CAM_DBG(CAM_ISP, "VFE:%u WM: %d for %s bw_limter: 0x%x",
+			vfe_out_data->common_data->core_index, wm_data->index,
+			vfe_out_data->wm_res[i].res_name,
+			reg_val_pair[j-1]);
+	}
+
+add_reg_pair:
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		if ((size * 4) > wm_config_update->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u Failed! Buf size:%d insufficient, expected size:%d",
+				vfe_out_data->common_data->core_index,
+				wm_config_update->cmd.size, size);
+			return -ENOMEM;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			wm_config_update->cmd.cmd_buf_addr, num_regval_pairs,
+			reg_val_pair);
+
+		/* cdm util returns dwords, need to convert to bytes */
+		wm_config_update->cmd.used_bytes = size * 4;
+	} else {
+		CAM_DBG(CAM_ISP,
+			"VFE:%u No reg val pairs. num_wms: %u",
+			vfe_out_data->common_data->core_index, vfe_out_data->num_wm);
+		wm_config_update->cmd.used_bytes = 0;
+	}
+
+	vfe_out_data->limiter_enabled = limiter_enabled;
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_mc_ctxt_sel(
+	void *priv, void *cmd_args, uint32_t arg_size)
+
+{
+	struct cam_vfe_bus_ver3_priv              *bus_priv;
+	struct cam_isp_hw_get_cmd_update          *mc_config;
+	struct cam_cdm_utils_ops                  *cdm_util_ops = NULL;
+	struct cam_vfe_bus_ver3_reg_offset_common *common_reg;
+	uint32_t                                   reg_val[2], ctxt_id = 0;
+	uint32_t                                   size = 0;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args priv %x cmd_args %x",
+			priv, cmd_args);
+		return -EINVAL;
+	}
+
+	bus_priv = (struct cam_vfe_bus_ver3_priv  *)priv;
+	mc_config = (struct cam_isp_hw_get_cmd_update *)cmd_args;
+	ctxt_id  = *((uint32_t *)mc_config->data);
+
+	common_reg = bus_priv->common_data.common_reg;
+	reg_val[0] = common_reg->ctxt_sel;
+	reg_val[1] = ctxt_id << common_reg->mc_write_sel_shift;
+
+	cdm_util_ops = bus_priv->common_data.cdm_util_ops;
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > mc_config->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			mc_config->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	cdm_util_ops->cdm_write_regrandom(
+		mc_config->cmd.cmd_buf_addr, 1, reg_val);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	mc_config->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_irq_inject(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_priv      *bus_priv = NULL;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_vfe_bus_ver3_hw_info   *bus_hw_info = NULL;
+	struct cam_isp_irq_inject_param   *inject_params = NULL;
+	struct cam_irq_register_set       *inject_reg = NULL;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	bus_priv = (struct cam_vfe_bus_ver3_priv  *)priv;
+	soc_info = bus_priv->common_data.soc_info;
+	bus_hw_info = (struct cam_vfe_bus_ver3_hw_info *)bus_priv->bus_hw_info;
+	inject_params = (struct cam_isp_irq_inject_param *)cmd_args;
+
+	if (inject_params->reg_unit ==
+		CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG)
+		inject_reg = &bus_hw_info->common_reg.irq_reg_info.irq_reg_set[0];
+	else if (inject_params->reg_unit ==
+		CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_1_REG)
+		inject_reg = &bus_hw_info->common_reg.irq_reg_info.irq_reg_set[1];
+	else
+		return -EINVAL;
+
+	if (!inject_reg) {
+		CAM_INFO(CAM_ISP, "Invalid inject_reg");
+		return -EINVAL;
+	}
+
+	cam_io_w_mb(inject_params->irq_mask,
+		soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base +
+		inject_reg->set_reg_offset);
+	cam_io_w_mb(0x10, soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base +
+		bus_hw_info->common_reg.irq_reg_info.global_irq_cmd_offset);
+	CAM_INFO(CAM_ISP, "Injected : irq_mask %#x set_reg_offset %#x",
+		inject_params->irq_mask, inject_reg->set_reg_offset);
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_dump_irq_desc(
+	void *priv, void *cmd_args, uint32_t arg_size)
+{
+	int                                   i, offset = 0;
+	int                                   num_irq_desc = 0;
+	struct cam_vfe_bus_ver3_priv         *bus_priv = NULL;
+	struct cam_vfe_bus_ver3_hw_info      *bus_hw_info = NULL;
+	struct cam_isp_irq_inject_param      *inject_params = NULL;
+	struct cam_vfe_bus_ver3_err_irq_desc *err_irq_desc = NULL;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return -EINVAL;
+	}
+
+	bus_priv = (struct cam_vfe_bus_ver3_priv *)priv;
+	bus_hw_info = (struct cam_vfe_bus_ver3_hw_info *)bus_priv->bus_hw_info;
+	inject_params = (struct cam_isp_irq_inject_param *)cmd_args;
+
+	if (inject_params->reg_unit ==
+			CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_0_REG) {
+		err_irq_desc = bus_hw_info->bus_err_desc_0;
+		num_irq_desc = bus_hw_info->num_bus_errors_0;
+	} else if (inject_params->reg_unit ==
+			CAM_ISP_IFE_0_BUS_WR_INPUT_IF_IRQ_SET_1_REG) {
+		err_irq_desc = bus_hw_info->bus_err_desc_1;
+		num_irq_desc = bus_hw_info->num_bus_errors_1;
+	} else
+		return -EINVAL;
+
+	offset += scnprintf(inject_params->line_buf + offset,
+		LINE_BUFFER_LEN - offset,
+		"Printing executable IRQ for hw_type: VFE reg_unit: %d\n",
+		inject_params->reg_unit);
+
+	for (i = 0; i < num_irq_desc; i++)
+		offset += scnprintf(inject_params->line_buf + offset,
+			LINE_BUFFER_LEN - offset, "%#12x : %s - %s\n",
+			err_irq_desc[i].bitmask,
+			err_irq_desc[i].err_name,
+			err_irq_desc[i].desc);
+
+	return 0;
+}
+
+
+static int cam_vfe_bus_ver3_update_res_wm(
+	struct cam_vfe_bus_ver3_priv           *ver3_bus_priv,
+	struct cam_vfe_hw_vfe_out_acquire_args *out_acq_args,
+	void                                   *tasklet,
+	enum cam_vfe_bus_ver3_vfe_out_type      vfe_out_res_id,
+	enum cam_vfe_bus_plane_type             plane,
+	struct cam_isp_resource_node           *wm_res,
+	enum cam_vfe_bus_ver3_comp_grp_type   *comp_grp_id)
+{
+	int32_t wm_idx = 0, rc;
+	struct cam_vfe_bus_ver3_wm_resource_data  *rsrc_data = NULL;
+	char wm_mode[50];
+
+	memset(wm_mode, '\0', sizeof(wm_mode));
+
+	wm_res->is_per_port_acquire = false;
+	rsrc_data = wm_res->res_priv;
+	wm_idx = rsrc_data->index;
+	rsrc_data->format = out_acq_args->out_port_info->format;
+	rsrc_data->use_wm_pack = out_acq_args->use_wm_pack;
+	rsrc_data->pack_fmt = cam_vfe_bus_ver3_get_packer_fmt(rsrc_data->format,
+		wm_idx);
+
+	rsrc_data->width = out_acq_args->out_port_info->width;
+	rsrc_data->height = out_acq_args->out_port_info->height;
+	rsrc_data->acquired_width = out_acq_args->out_port_info->width;
+	rsrc_data->acquired_height = out_acq_args->out_port_info->height;
+	rsrc_data->is_dual = out_acq_args->is_dual;
+
+	/* Set WM offset value to default */
+	rsrc_data->offset  = 0;
+	CAM_DBG(CAM_ISP, "WM:%d width %d height %d is_per_port:%d",
+		rsrc_data->index, rsrc_data->width,
+		rsrc_data->height, wm_res->is_per_port_acquire);
+
+	rc = cam_vfe_bus_ver3_res_update_config_wm(ver3_bus_priv, vfe_out_res_id,
+		plane, wm_res, comp_grp_id, wm_mode, sizeof(wm_mode));
+	if (rc)
+		return rc;
+
+	wm_res->tasklet_info = tasklet;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d WM:%d %s processed width:%d height:%d stride:%d format:0x%X en_ubwc:%d %s",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		wm_res->res_name, rsrc_data->width, rsrc_data->height,
+		rsrc_data->stride, rsrc_data->format, rsrc_data->en_ubwc,
+		wm_mode);
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_res_comp_grp(
+	struct cam_vfe_bus_ver3_priv         *ver3_bus_priv,
+	void                                *tasklet,
+	uint32_t                             is_dual,
+	uint32_t                             is_master,
+	struct cam_isp_resource_node       **comp_grp,
+	struct cam_vfe_bus_ver3_comp_grp_acquire_args *comp_acq_args)
+{
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+	struct cam_vfe_bus_ver3_comp_grp_data  *rsrc_data = NULL;
+	bool previously_acquired = false;
+
+	/* Check if matching comp_grp has already been acquired */
+	previously_acquired = cam_vfe_bus_ver3_match_comp_grp(
+		ver3_bus_priv, &comp_grp_local, comp_acq_args->comp_grp_id);
+
+	if (!comp_grp_local || !previously_acquired) {
+		CAM_ERR(CAM_ISP, "Invalid comp_grp:%d",
+			comp_acq_args->comp_grp_id);
+		return -ENODEV;
+	}
+
+	rsrc_data = comp_grp_local->res_priv;
+	/* Do not support runtime change in composite mask */
+	CAM_DBG(CAM_ISP, "Update res VFE:%d comp_grp:%u",
+		rsrc_data->common_data->core_index, rsrc_data->comp_grp_type);
+
+	rsrc_data->acquire_dev_cnt++;
+	rsrc_data->composite_mask |= comp_acq_args->composite_mask;
+	*comp_grp = comp_grp_local;
+	comp_grp_local->is_per_port_acquire = false;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_res_vfe_out(void *bus_priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                     rc = -ENODEV;
+	int                                     i;
+	enum cam_vfe_bus_ver3_vfe_out_type      vfe_out_res_id;
+	uint32_t                                format;
+	struct cam_vfe_bus_ver3_priv           *ver3_bus_priv = bus_priv;
+	struct cam_vfe_acquire_args            *acq_args;
+	struct cam_vfe_resource_update		   *res_update_args;
+	struct cam_vfe_hw_vfe_out_acquire_args *out_acquire_args;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data   *rsrc_data = NULL;
+	uint32_t                                secure_caps = 0, mode;
+	struct cam_vfe_bus_ver3_comp_grp_acquire_args comp_acq_args = {0};
+	uint32_t       outmap_index = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_ISP, "Invalid Param");
+		return -EINVAL;
+	}
+
+	res_update_args = (struct cam_vfe_resource_update *)acquire_args;
+	acq_args = res_update_args->vfe_acquire;
+
+	out_acquire_args = &acq_args->vfe_out;
+	format = out_acquire_args->out_port_info->format;
+
+	CAM_DBG(CAM_ISP, "VFE:%d Acquire out_type:0x%X",
+		ver3_bus_priv->common_data.core_index,
+		out_acquire_args->out_port_info->acquired_res_type);
+
+	vfe_out_res_id = cam_vfe_bus_ver3_get_out_res_id_and_index(
+				ver3_bus_priv,
+				out_acquire_args->out_port_info->acquired_res_type,
+				&outmap_index);
+	if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_MAX) ||
+		(outmap_index >= ver3_bus_priv->num_out)) {
+		CAM_WARN(CAM_ISP,
+			"target does not support req res id :0x%x outtype:%d index:%d num: %d",
+			out_acquire_args->out_port_info->acquired_res_type,
+			vfe_out_res_id, outmap_index, ver3_bus_priv->num_out);
+		return -ENODEV;
+	}
+
+	rsrc_node = &ver3_bus_priv->vfe_out[outmap_index];
+
+	rsrc_data = rsrc_node->res_priv;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->common_data->priv = acq_args->priv;
+	rsrc_data->common_data->disable_ubwc_comp =
+		out_acquire_args->disable_ubwc_comp;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->bus_priv = ver3_bus_priv;
+	rsrc_data->limiter_enabled = false;
+
+	comp_acq_args.composite_mask = (1ULL << vfe_out_res_id);
+
+	/* for some hw versions, buf done is not received from vfe but
+	 * from IP external to VFE. In such case, we get the controller
+	 * from hw manager and assign it here
+	 */
+	if (!(ver3_bus_priv->common_data.supported_irq &
+			CAM_VFE_HW_IRQ_CAP_BUF_DONE))
+		rsrc_data->common_data->buf_done_controller =
+			acq_args->buf_done_controller;
+
+	secure_caps = cam_vfe_bus_ver3_can_be_secure(
+		rsrc_data->out_type);
+	mode = out_acquire_args->out_port_info->secure_mode;
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (!rsrc_data->common_data->num_sec_out) {
+			rsrc_data->secure_mode = mode;
+			rsrc_data->common_data->secure_mode = mode;
+		} else {
+			if (mode == rsrc_data->common_data->secure_mode) {
+				rsrc_data->secure_mode =
+					rsrc_data->common_data->secure_mode;
+			} else {
+				rc = -EINVAL;
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"Mismatch: Acquire mode[%d], drvr mode[%d]",
+					rsrc_data->common_data->secure_mode,
+					mode);
+				mutex_unlock(
+					&rsrc_data->common_data->bus_mutex);
+				return -EINVAL;
+			}
+		}
+		rsrc_data->common_data->num_sec_out++;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	ver3_bus_priv->tasklet_info = acq_args->tasklet;
+	rsrc_node->res_id = out_acquire_args->out_port_info->acquired_res_type;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = out_acquire_args->cdm_ops;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	rsrc_data->format = out_acquire_args->out_port_info->format;
+
+	if ((rsrc_data->out_type == CAM_VFE_BUS_VER3_VFE_OUT_FD) &&
+		(rsrc_data->format == CAM_FORMAT_Y_ONLY))
+		rsrc_data->num_wm = 1;
+
+	/* Update WM params and retrieve COMP GRP ID */
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_vfe_bus_ver3_update_res_wm(ver3_bus_priv,
+			out_acquire_args,
+			acq_args->tasklet,
+			vfe_out_res_id,
+			i,
+			&rsrc_data->wm_res[i],
+			&comp_acq_args.comp_grp_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed to update resource WM VFE:%d out_type:%d rc:%d",
+				rsrc_data->common_data->core_index,
+				vfe_out_res_id, rc);
+			return -EINVAL;
+		}
+	}
+
+
+	/* Update composite group data using COMP GRP ID */
+	rc = cam_vfe_bus_ver3_update_res_comp_grp(ver3_bus_priv,
+		acq_args->tasklet,
+		out_acquire_args->is_dual,
+		out_acquire_args->is_master,
+		&rsrc_data->comp_grp,
+		&comp_acq_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Failed to update resource comp_grp VFE:%d out_typp:%d rc:%d",
+			rsrc_data->common_data->core_index,
+			vfe_out_res_id, rc);
+		return -EINVAL;
+	}
+
+	rsrc_node->is_per_port_acquire = false;
+	rsrc_data->is_dual = out_acquire_args->is_dual;
+	rsrc_data->is_master = out_acquire_args->is_master;
+	out_acquire_args->comp_grp_id = comp_acq_args.comp_grp_id;
+
+	out_acquire_args->rsrc_node = rsrc_node;
+
+	CAM_DBG(CAM_ISP, "Update res successful");
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_enable_irq_vfe_out(void *bus_priv, void *res_irq_mask)
+{
+	int   i, rc = 0;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_common_data   *common_data = NULL;
+	uint32_t source_group = 0;
+	struct cam_isp_resource_node          *vfe_out;
+	struct cam_vfe_res_irq_info           *irq_args;
+	uint32_t bus_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_MAX];
+	uint32_t rup_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_MAX];
+
+	if (!res_irq_mask) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	irq_args = (struct cam_vfe_res_irq_info *)res_irq_mask;
+	for (i = 0; i < irq_args->num_res; i++) {
+		vfe_out = irq_args->node_res[i];
+		rsrc_data = vfe_out->res_priv;
+		common_data = rsrc_data->common_data;
+		source_group = rsrc_data->source_group;
+
+		CAM_DBG(CAM_ISP, "Start VFE:%d out_type:0x%X",
+			rsrc_data->common_data->core_index, rsrc_data->out_type);
+
+		if (rsrc_data->is_dual && !rsrc_data->is_master)
+			goto end;
+
+		memset(bus_irq_reg_mask, 0, sizeof(bus_irq_reg_mask));
+		rc = cam_vfe_bus_ver3_start_comp_grp(rsrc_data, bus_irq_reg_mask);
+
+		memset(rup_irq_reg_mask, 0, sizeof(rup_irq_reg_mask));
+		rup_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0] |=
+		0x1 << source_group;
+
+		if (!vfe_out->irq_handle && !vfe_out->is_per_port_start) {
+			vfe_out->irq_handle = cam_irq_controller_subscribe_irq(
+				common_data->buf_done_controller,
+				CAM_IRQ_PRIORITY_1,
+				bus_irq_reg_mask,
+				vfe_out,
+				vfe_out->top_half_handler,
+				vfe_out->bottom_half_handler,
+				vfe_out->tasklet_info,
+				&tasklet_bh_api,
+				CAM_IRQ_EVT_GROUP_0);
+
+			if (vfe_out->irq_handle < 1) {
+				CAM_ERR(CAM_ISP, "Subscribe IRQ failed for VFE out_res %d, VFE:%u",
+					vfe_out->res_id, rsrc_data->common_data->core_index);
+					vfe_out->irq_handle = 0;
+				return -EFAULT;
+			}
+
+			if ((common_data->is_lite || source_group > CAM_VFE_BUS_VER3_SRC_GRP_0)
+				&& !vfe_out->is_rdi_primary_res)
+				goto end;
+
+			if ((common_data->supported_irq & CAM_VFE_HW_IRQ_CAP_RUP) &&
+				(!common_data->rup_irq_handle[source_group])) {
+				CAM_DBG(CAM_ISP,
+					"VFE:%d out_type:0x%X bus_irq_mask_0:0x%X for RUP",
+					rsrc_data->common_data->core_index, rsrc_data->out_type,
+				rup_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0]);
+
+				common_data->rup_irq_handle[source_group] =
+					cam_irq_controller_subscribe_irq(
+						common_data->bus_irq_controller,
+						CAM_IRQ_PRIORITY_0,
+						rup_irq_reg_mask,
+						vfe_out,
+						cam_vfe_bus_ver3_handle_rup_top_half,
+						cam_vfe_bus_ver3_handle_rup_bottom_half,
+						vfe_out->tasklet_info,
+						&tasklet_bh_api,
+						CAM_IRQ_EVT_GROUP_1);
+
+				if (common_data->rup_irq_handle[source_group] < 1) {
+					CAM_ERR(CAM_ISP, "VFE:%u Failed to subscribe RUP IRQ",
+						rsrc_data->common_data->core_index);
+						common_data->rup_irq_handle[source_group] = 0;
+					return -EFAULT;
+				}
+			}
+		} else if (vfe_out->irq_handle) {
+			rc = cam_irq_controller_update_irq(
+				common_data->buf_done_controller,
+				vfe_out->irq_handle,
+				irq_args->enable_irq,
+				bus_irq_reg_mask);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Update IRQ failed for VFE out_res %d",
+					vfe_out->res_id);
+				return -EFAULT;
+			}
+
+			if ((common_data->is_lite || source_group > CAM_VFE_BUS_VER3_SRC_GRP_0))
+				goto end;
+
+			if ((common_data->supported_irq & CAM_VFE_HW_IRQ_CAP_RUP)) {
+				rc = cam_irq_controller_update_irq(
+						common_data->bus_irq_controller,
+						common_data->rup_irq_handle[source_group],
+						irq_args->enable_irq,
+						rup_irq_reg_mask);
+				if (rc) {
+					CAM_ERR(CAM_ISP, "Update IRQ failed for VFE out_res %d",
+						vfe_out->res_id);
+					return -EFAULT;
+				}
+			}
+		} else {
+			CAM_ERR(CAM_ISP, "VFE out_res irq handle not found");
+			return -EINVAL;
+		}
+	}
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_start_hw(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_ver3_start_vfe_out(hw_priv);
+}
+
+static int cam_vfe_bus_ver3_stop_hw(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_ver3_stop_vfe_out(hw_priv);
+}
+
+static int cam_vfe_bus_ver3_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_priv    *bus_priv = hw_priv;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (bus_priv->common_data.hw_init)
+		return 0;
+
+	/* We take the controller only if the buf done is supported on vfe side
+	 * for some hw, it is taken from IP extenal to VFE like CSID
+	 */
+	if ((bus_priv->common_data.supported_irq & CAM_VFE_HW_IRQ_CAP_BUF_DONE))
+		bus_priv->common_data.buf_done_controller =
+			bus_priv->common_data.bus_irq_controller;
+
+	bus_priv->common_data.hw_init = true;
+
+	CAM_DBG(CAM_ISP, "VFE:%u bus-wr hw-version:0x%x",
+		bus_priv->common_data.core_index,
+		cam_io_r_mb(bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->hw_version));
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_priv    *bus_priv = hw_priv;
+	int                              rc = 0, i;
+	unsigned long                    flags;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Error: Invalid args");
+		return -EINVAL;
+	}
+
+	if (!bus_priv->common_data.hw_init)
+		return 0;
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER3_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+	bus_priv->common_data.hw_init = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	return rc;
+}
+
+static int cam_vfe_bus_get_res_for_mid(
+	struct cam_vfe_bus_ver3_priv *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_vfe_out_data   *out_data = NULL;
+	struct cam_isp_hw_get_cmd_update       *cmd_update = cmd_args;
+	struct cam_isp_hw_get_res_for_mid       *get_res = NULL;
+	uint32_t num_mid = 0, port_mid[CAM_VFE_BUS_VER3_VFE_OUT_MAX] = {0};
+	int i, j;
+	bool pid_found = false;
+
+	get_res = (struct cam_isp_hw_get_res_for_mid *)cmd_update->data;
+	if (!get_res) {
+		CAM_ERR(CAM_ISP,
+			"invalid get resource for mid paramas");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		out_data = (struct cam_vfe_bus_ver3_vfe_out_data   *)
+			bus_priv->vfe_out[i].res_priv;
+
+		if (!out_data)
+			continue;
+
+		for (j = 0; j < out_data->num_mid; j++) {
+			if (out_data->mid[j] == get_res->mid)
+				port_mid[num_mid++] = i;
+		}
+	}
+
+	for (i = 0; i < num_mid; i++) {
+		out_data = (struct cam_vfe_bus_ver3_vfe_out_data   *)
+			bus_priv->vfe_out[i].res_priv;
+		get_res->out_res_id = bus_priv->vfe_out[port_mid[i]].res_id;
+		if (out_data->pid_mask & (1 << get_res->pid)) {
+			get_res->out_res_id = bus_priv->vfe_out[port_mid[i]].res_id;
+			pid_found = true;
+			goto end;
+		}
+	}
+
+	if (!num_mid) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%u mid:%d does not match with any out resource",
+			bus_priv->common_data.core_index, get_res->mid);
+		get_res->out_res_id = 0;
+		return -EINVAL;
+	}
+
+end:
+	CAM_INFO(CAM_ISP, "VFE:%u match mid :%d  out resource:0x%x found, is pid found %d",
+		bus_priv->common_data.core_index, get_res->mid, bus_priv->vfe_out[i].res_id,
+		 pid_found);
+	return 0;
+}
+
+static int __cam_vfe_bus_ver3_process_cmd(void *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_ver3_process_cmd(priv, cmd_type, cmd_args, arg_size);
+}
+
+static uint32_t cam_vfe_bus_ver3_get_last_consumed_addr(
+	struct cam_vfe_bus_ver3_priv *bus_priv,
+	uint32_t res_type)
+{
+	uint32_t                                  last_consumed_addr = 0;
+	struct cam_isp_resource_node             *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data     *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_rsrc_data = NULL;
+	enum cam_vfe_bus_ver3_vfe_out_type        res_id;
+	uint32_t                                  outmap_index =
+		CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+
+	res_id = cam_vfe_bus_ver3_get_out_res_id_and_index(bus_priv,
+		res_type, &outmap_index);
+	if ((res_id >= CAM_VFE_BUS_VER3_VFE_OUT_MAX) ||
+		(outmap_index >= bus_priv->num_out)) {
+		CAM_WARN(CAM_ISP,
+			"target does not support req res id :0x%x outtype:%d index:%d",
+			res_type, res_id, outmap_index);
+		return 0;
+	}
+
+	rsrc_node = &bus_priv->vfe_out[outmap_index];
+	rsrc_data = rsrc_node->res_priv;
+	wm_rsrc_data = rsrc_data->wm_res[PLANE_Y].res_priv;
+	last_consumed_addr = cam_io_r_mb(
+		wm_rsrc_data->common_data->mem_base +
+		wm_rsrc_data->hw_regs->addr_status_0);
+
+	CAM_DBG(CAM_ISP, "VFE:%u res_type:0x%x res_id:0x%x last_consumed_addr:0x%x",
+		bus_priv->common_data.core_index, res_type, res_id, last_consumed_addr);
+
+	return last_consumed_addr;
+}
+
+static int cam_vfe_bus_ver3_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_bus_ver3_priv		 *bus_priv;
+	uint32_t top_mask_0 = 0;
+	struct cam_isp_hw_cap *vfe_bus_cap;
+	struct cam_isp_hw_done_event_data *done;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_WM_UPDATE:
+		rc = cam_vfe_bus_ver3_update_acquire_vfe_out(priv, cmd_args,
+				arg_size, true);
+		break;
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+		rc = cam_vfe_bus_ver3_update_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+		rc = cam_vfe_bus_ver3_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_WM_SECURE_MODE:
+		rc = cam_vfe_bus_ver3_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+		rc = cam_vfe_bus_ver3_update_stripe_cfg(priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+		if (bus_priv->error_irq_handle) {
+			CAM_DBG(CAM_ISP, "VFE:%u Mask off bus error irq handler",
+				priv->hw_intf->hw_idx);
+			rc = cam_irq_controller_unsubscribe_irq(
+				bus_priv->common_data.bus_irq_controller,
+				bus_priv->error_irq_handle);
+			bus_priv->error_irq_handle = 0;
+		}
+		break;
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO: {
+		struct cam_isp_hw_event_info  *event_info;
+
+		event_info =
+			(struct cam_isp_hw_event_info *)cmd_args;
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+
+		rc = cam_vfe_bus_ver3_print_dimensions(
+			event_info->res_id, bus_priv);
+		break;
+		}
+	case CAM_ISP_HW_IFE_BUS_MINI_DUMP: {
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+
+		rc = cam_vfe_bus_ver3_mini_dump(bus_priv, cmd_args);
+		break;
+		}
+	case CAM_ISP_HW_USER_DUMP: {
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+
+		rc = cam_vfe_bus_ver3_user_dump(bus_priv, cmd_args);
+		break;
+	}
+	case CAM_ISP_HW_CMD_UBWC_UPDATE_V2:
+		rc = cam_vfe_bus_ver3_update_ubwc_config_v2(cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+		rc = cam_vfe_bus_ver3_update_wm_config(cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ:
+		bus_priv = (struct cam_vfe_bus_ver3_priv *) priv;
+		top_mask_0 = cam_io_r_mb(bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->top_irq_mask_0);
+		top_mask_0 |= (1 << bus_priv->top_irq_shift);
+		cam_io_w_mb(top_mask_0, bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->top_irq_mask_0);
+		break;
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+		bus_priv = (struct cam_vfe_bus_ver3_priv *) priv;
+		rc = cam_vfe_bus_get_res_for_mid(bus_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_CAP:
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+		vfe_bus_cap = (struct cam_isp_hw_cap *) cmd_args;
+		vfe_bus_cap->max_out_res_type = bus_priv->max_out_res;
+		vfe_bus_cap->support_consumed_addr =
+			bus_priv->common_data.support_consumed_addr;
+		break;
+	case CAM_ISP_HW_CMD_GET_LAST_CONSUMED_ADDR:
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+		done = (struct cam_isp_hw_done_event_data *) cmd_args;
+		done->last_consumed_addr = cam_vfe_bus_ver3_get_last_consumed_addr(
+			bus_priv, done->resource_handle);
+		if (done->last_consumed_addr)
+			rc = 0;
+		break;
+	case CAM_ISP_HW_CMD_IFE_DEBUG_CFG: {
+		struct cam_vfe_generic_debug_config *debug_cfg;
+
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+		debug_cfg = (struct cam_vfe_generic_debug_config *)cmd_args;
+		bus_priv->common_data.disable_mmu_prefetch =
+			debug_cfg->disable_ife_mmu_prefetch;
+
+		CAM_DBG(CAM_ISP, "IFE: %u bus WR prefetch %s",
+			bus_priv->common_data.core_index,
+			bus_priv->common_data.disable_mmu_prefetch ?
+			"disabled" : "enabled");
+		rc = 0;
+	}
+		break;
+	case CAM_ISP_HW_CMD_BUF_UPDATE:
+		rc = cam_vfe_bus_ver3_config_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_WM_BW_LIMIT_CONFIG:
+		rc = cam_vfe_bus_update_bw_limiter(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_MC_CTXT_SEL:
+		rc = cam_vfe_bus_ver3_mc_ctxt_sel(priv, cmd_args, arg_size);
+		break;
+
+	case CAM_ISP_HW_CMD_IRQ_INJECTION:
+		rc = cam_vfe_bus_ver3_irq_inject(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_IRQ_DESCRIPTION:
+		rc = cam_vfe_bus_ver3_dump_irq_desc(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_UPDATE_VFE_OUT_RES_DATA:
+		rc = cam_vfe_bus_ver3_update_res_vfe_out(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_UPDATE_VFE_OUT_RES_IRQ_MASK:
+		rc = cam_vfe_bus_ver3_enable_irq_vfe_out(priv, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_GET_NUM_OUT_RES: {
+		uint32_t *max_num_out_res;
+
+		max_num_out_res = (uint32_t *) cmd_args;
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+		*max_num_out_res = bus_priv->num_out;
+		break;
+	}
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE:%u Invalid camif process command:%d",
+			priv->hw_intf->hw_idx, cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_bus_ver3_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_ver3_priv    *bus_priv = NULL;
+	struct cam_vfe_bus              *vfe_bus_local;
+	struct cam_vfe_bus_ver3_hw_info *ver3_hw_info = bus_hw_info;
+	struct cam_vfe_soc_private      *soc_private = NULL;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	if (!soc_info || !hw_intf || !bus_hw_info || !vfe_irq_controller) {
+		CAM_ERR(CAM_ISP,
+			"Inval_prms soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_hw_info);
+		CAM_ERR(CAM_ISP, "controller: %pK", vfe_irq_controller);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	vfe_bus_local = kzalloc(sizeof(struct cam_vfe_bus), GFP_KERNEL);
+	if (!vfe_bus_local) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_vfe_bus_ver3_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+	vfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                     = ver3_hw_info->num_client;
+	bus_priv->num_out                        = ver3_hw_info->num_out;
+	bus_priv->num_comp_grp                   = ver3_hw_info->num_comp_grp;
+	bus_priv->top_irq_shift                  = ver3_hw_info->top_irq_shift;
+	bus_priv->max_out_res                    = ver3_hw_info->max_out_res;
+	bus_priv->common_data.num_sec_out        = 0;
+	bus_priv->common_data.secure_mode        = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index         = soc_info->index;
+	bus_priv->common_data.mem_base           =
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf            = hw_intf;
+	bus_priv->common_data.vfe_irq_controller = vfe_irq_controller;
+	bus_priv->common_data.common_reg         = &ver3_hw_info->common_reg;
+	bus_priv->common_data.hw_init            = false;
+
+	bus_priv->common_data.is_lite = soc_private->is_ife_lite;
+	bus_priv->common_data.support_consumed_addr =
+		ver3_hw_info->support_consumed_addr;
+	bus_priv->common_data.disable_ubwc_comp = false;
+	bus_priv->common_data.supported_irq      = ver3_hw_info->supported_irq;
+	bus_priv->common_data.comp_config_needed =
+		ver3_hw_info->comp_cfg_needed;
+	bus_priv->common_data.init_irq_subscribed = false;
+	bus_priv->common_data.disable_mmu_prefetch = false;
+	bus_priv->common_data.pack_align_shift =
+		ver3_hw_info->pack_align_shift;
+	bus_priv->common_data.max_bw_counter_limit =
+		ver3_hw_info->max_bw_counter_limit;
+	bus_priv->num_cons_err = ver3_hw_info->num_cons_err;
+	bus_priv->constraint_error_list = ver3_hw_info->constraint_error_list;
+	bus_priv->common_data.soc_info = soc_info;
+	bus_priv->bus_hw_info = ver3_hw_info;
+
+	if (bus_priv->num_out >= CAM_VFE_BUS_VER3_VFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "VFE:%u number of vfe out:%d more than max value:%d ",
+			bus_priv->common_data.core_index, bus_priv->num_out,
+			CAM_VFE_BUS_VER3_VFE_OUT_MAX);
+		rc = -EINVAL;
+		goto free_bus_priv;
+	}
+
+	bus_priv->comp_grp = kzalloc((sizeof(struct cam_isp_resource_node) *
+		bus_priv->num_comp_grp), GFP_KERNEL);
+	if (!bus_priv->comp_grp) {
+		CAM_ERR(CAM_ISP, "VFE:%u Failed to alloc for bus comp groups",
+			bus_priv->common_data.core_index);
+		rc = -ENOMEM;
+		goto free_bus_priv;
+	}
+
+	bus_priv->vfe_out = kzalloc((sizeof(struct cam_isp_resource_node) *
+		bus_priv->num_out), GFP_KERNEL);
+	if (!bus_priv->vfe_out) {
+		CAM_ERR(CAM_ISP, "VFE:%u Failed to alloc for bus out res",
+			bus_priv->common_data.core_index);
+		rc = -ENOMEM;
+		goto free_comp_grp;
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER3_SRC_GRP_MAX; i++)
+		bus_priv->common_data.rup_irq_handle[i] = 0;
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+
+	rc = cam_irq_controller_init(drv_name, bus_priv->common_data.mem_base,
+		&ver3_hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "VFE:%u Init bus_irq_controller failed",
+			bus_priv->common_data.core_index);
+		goto free_vfe_out;
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	for (i = 0; i < bus_priv->num_comp_grp; i++) {
+		rc = cam_vfe_bus_ver3_init_comp_grp(i, soc_info,
+			bus_priv, bus_hw_info,
+			&bus_priv->comp_grp[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "VFE:%u init comp_grp:%d failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+			goto deinit_comp_grp;
+		}
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER3_VFE_OUT_MAX; i++)
+		bus_priv->vfe_out_map_outtype[i] =
+			CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_vfe_bus_ver3_init_vfe_out_resource(i, bus_priv,
+			bus_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u init out_type:0x%X failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+			goto deinit_vfe_out;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER3_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+
+	vfe_bus_local->hw_ops.reserve      = cam_vfe_bus_ver3_acquire_vfe_out;
+	vfe_bus_local->hw_ops.release      = cam_vfe_bus_ver3_release_vfe_out;
+	vfe_bus_local->hw_ops.start        = cam_vfe_bus_ver3_start_hw;
+	vfe_bus_local->hw_ops.stop         = cam_vfe_bus_ver3_stop_hw;
+	vfe_bus_local->hw_ops.init         = cam_vfe_bus_ver3_init_hw;
+	vfe_bus_local->hw_ops.deinit       = cam_vfe_bus_ver3_deinit_hw;
+	vfe_bus_local->top_half_handler    = NULL;
+	vfe_bus_local->bottom_half_handler = NULL;
+	vfe_bus_local->hw_ops.process_cmd  = __cam_vfe_bus_ver3_process_cmd;
+
+	*vfe_bus = vfe_bus_local;
+
+	CAM_DBG(CAM_ISP, "Exit, VFE:%u", bus_priv->common_data.core_index);
+	return rc;
+
+deinit_vfe_out:
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_ver3_deinit_vfe_out_resource(&bus_priv->vfe_out[i]);
+
+deinit_comp_grp:
+	if (i < 0)
+		i = bus_priv->num_comp_grp;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_ver3_deinit_comp_grp(&bus_priv->comp_grp[i]);
+
+free_vfe_out:
+	kfree(bus_priv->vfe_out);
+
+free_comp_grp:
+	kfree(bus_priv->comp_grp);
+
+free_bus_priv:
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_vfe_bus_ver3_deinit(
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_ver3_priv    *bus_priv = NULL;
+	struct cam_vfe_bus              *vfe_bus_local;
+	unsigned long                    flags;
+
+	if (!vfe_bus || !*vfe_bus) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+	vfe_bus_local = *vfe_bus;
+
+	bus_priv = vfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER3_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+	bus_priv->common_data.hw_init = false;
+	bus_priv->common_data.init_irq_subscribed = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	for (i = 0; i < bus_priv->num_comp_grp; i++) {
+		rc = cam_vfe_bus_ver3_deinit_comp_grp(&bus_priv->comp_grp[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"VFE:%u deinit comp_grp:%d failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_vfe_bus_ver3_deinit_vfe_out_resource(
+			&bus_priv->vfe_out[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"VFE:%u deinit out_type:0x%X failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	rc = cam_irq_controller_deinit(
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"VFE:%u Deinit BUS IRQ Controller failed rc=%d",
+			bus_priv->common_data.core_index, rc);
+
+	kfree(bus_priv->comp_grp);
+	kfree(bus_priv->vfe_out);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+	*vfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.h
@@ -0,0 +1,367 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE_BUS_VER3_H_
+#define _CAM_VFE_BUS_VER3_H_
+
+#include "cam_irq_controller.h"
+#include "cam_vfe_bus.h"
+
+#define CAM_VFE_BUS_VER3_MAX_SUB_GRPS        6
+#define CAM_VFE_BUS_VER3_MAX_MID_PER_PORT    4
+#define CAM_VFE_BUS_VER3_CONS_ERR_MAX        32
+#define CAM_VFE_BUS_VER3_MAX_CLIENTS         28
+#define CAM_VFE_BUS_VER3_IRQ_MAX             2
+
+enum cam_vfe_bus_ver3_vfe_core_id {
+	CAM_VFE_BUS_VER3_VFE_CORE_0,
+	CAM_VFE_BUS_VER3_VFE_CORE_1,
+	CAM_VFE_BUS_VER3_VFE_CORE_MAX,
+};
+
+enum cam_vfe_bus_ver3_src_grp {
+	CAM_VFE_BUS_VER3_SRC_GRP_0,
+	CAM_VFE_BUS_VER3_SRC_GRP_1,
+	CAM_VFE_BUS_VER3_SRC_GRP_2,
+	CAM_VFE_BUS_VER3_SRC_GRP_3,
+	CAM_VFE_BUS_VER3_SRC_GRP_4,
+	CAM_VFE_BUS_VER3_SRC_GRP_5,
+	CAM_VFE_BUS_VER3_SRC_GRP_6,
+	CAM_VFE_BUS_VER3_SRC_GRP_MAX,
+};
+
+enum cam_vfe_bus_ver3_comp_grp_type {
+	CAM_VFE_BUS_VER3_COMP_GRP_0,
+	CAM_VFE_BUS_VER3_COMP_GRP_1,
+	CAM_VFE_BUS_VER3_COMP_GRP_2,
+	CAM_VFE_BUS_VER3_COMP_GRP_3,
+	CAM_VFE_BUS_VER3_COMP_GRP_4,
+	CAM_VFE_BUS_VER3_COMP_GRP_5,
+	CAM_VFE_BUS_VER3_COMP_GRP_6,
+	CAM_VFE_BUS_VER3_COMP_GRP_7,
+	CAM_VFE_BUS_VER3_COMP_GRP_8,
+	CAM_VFE_BUS_VER3_COMP_GRP_9,
+	CAM_VFE_BUS_VER3_COMP_GRP_10,
+	CAM_VFE_BUS_VER3_COMP_GRP_11,
+	CAM_VFE_BUS_VER3_COMP_GRP_12,
+	CAM_VFE_BUS_VER3_COMP_GRP_13,
+	CAM_VFE_BUS_VER3_COMP_GRP_14,
+	CAM_VFE_BUS_VER3_COMP_GRP_15,
+	CAM_VFE_BUS_VER3_COMP_GRP_16,
+	CAM_VFE_BUS_VER3_COMP_GRP_MAX,
+};
+
+enum cam_vfe_bus_ver3_vfe_out_type {
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI4,
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI5,
+	CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+	CAM_VFE_BUS_VER3_VFE_OUT_DS2,
+	CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+	CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+	CAM_VFE_BUS_VER3_VFE_OUT_IR,
+	CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+	CAM_VFE_BUS_VER3_VFE_OUT_FD,
+	CAM_VFE_BUS_VER3_VFE_OUT_PDAF,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+	CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+	CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+	CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+	CAM_VFE_BUS_VER3_VFE_OUT_LCR,
+	CAM_VFE_BUS_VER3_VFE_OUT_SPARSE_PD,
+	CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW,
+	CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_2PD,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_BG,
+	CAM_VFE_BUS_VER3_VFE_OUT_PREPROCESS_RAW,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_CAF,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_BAYER_RS,
+	CAM_VFE_BUS_VER3_VFE_OUT_PDAF_PARSED,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_ALSC,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_AF_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_TMC_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_1,
+	CAM_VFE_BUS_VER3_VFE_OUT_AI_OUT_2,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BG,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_IR_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+};
+
+/*
+ * struct cam_vfe_bus_ver3_err_irq_desc:
+ *
+ * @Brief:        Bus error irq description
+ */
+struct cam_vfe_bus_ver3_err_irq_desc {
+	uint32_t  bitmask;
+	char     *err_name;
+	char     *desc;
+};
+
+/*
+ * struct cam_vfe_constraint_error_info:
+ *
+ * @Brief:        Constraint error info
+ */
+struct cam_vfe_constraint_error_info {
+	uint32_t  bitmask;
+	char     *error_description;
+};
+
+/*
+ * struct cam_vfe_bus_ver3_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_vfe_bus_ver3_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t cgc_ovd;
+	uint32_t comp_cfg_0;
+	uint32_t comp_cfg_1;
+	uint32_t ctxt_sel;
+	uint32_t if_frameheader_cfg[CAM_VFE_BUS_VER3_MAX_SUB_GRPS];
+	uint32_t ubwc_static_ctrl;
+	uint32_t pwr_iso_cfg;
+	uint32_t overflow_status_clear;
+	uint32_t ccif_violation_status;
+	uint32_t overflow_status;
+	uint32_t image_size_violation_status;
+	uint32_t debug_status_top_cfg;
+	uint32_t debug_status_top;
+	uint32_t test_bus_ctrl;
+	uint32_t mc_read_sel_shift;
+	uint32_t mc_write_sel_shift;
+	uint32_t mc_ctxt_mask;
+	uint32_t top_irq_mask_0;
+	struct cam_irq_controller_reg_info irq_reg_info;
+};
+
+/*
+ * struct cam_vfe_bus_ver3_reg_offset_ubwc_client:
+ *
+ * @Brief:        UBWC register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver3_reg_offset_ubwc_client {
+	uint32_t meta_addr;
+	uint32_t meta_cfg;
+	uint32_t mode_cfg;
+	uint32_t stats_ctrl;
+	uint32_t ctrl_2;
+	uint32_t lossy_thresh0;
+	uint32_t lossy_thresh1;
+	uint32_t off_lossy_var;
+	uint32_t bw_limit;
+	uint32_t ubwc_comp_en_bit;
+};
+
+/*
+ * struct cam_vfe_bus_ver3_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver3_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t frame_incr;
+	uint32_t image_cfg_0;
+	uint32_t image_cfg_1;
+	uint32_t image_cfg_2;
+	uint32_t packer_cfg;
+	uint32_t frame_header_addr;
+	uint32_t frame_header_incr;
+	uint32_t frame_header_cfg;
+	uint32_t line_done_cfg;
+	uint32_t irq_subsample_period;
+	uint32_t irq_subsample_pattern;
+	uint32_t framedrop_period;
+	uint32_t framedrop_pattern;
+	uint32_t mmu_prefetch_cfg;
+	uint32_t mmu_prefetch_max_offset;
+	uint32_t addr_cfg;
+	uint32_t ctxt_cfg;
+	uint32_t burst_limit;
+	uint32_t system_cache_cfg;
+	void    *ubwc_regs;
+	uint32_t addr_status_0;
+	uint32_t addr_status_1;
+	uint32_t addr_status_2;
+	uint32_t addr_status_3;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	uint32_t debug_status_ctxt;
+	uint32_t hw_ctxt_cfg;
+	uint32_t bw_limiter_addr;
+	uint32_t comp_group;
+};
+
+/*
+ * struct cam_vfe_bus_ver3_vfe_out_hw_info:
+ *
+ * @Brief:        HW capability of VFE Bus Client
+ */
+struct cam_vfe_bus_ver3_vfe_out_hw_info {
+	enum cam_vfe_bus_ver3_vfe_out_type  vfe_out_type;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+	uint32_t                            source_group;
+	uint32_t                           *mid;
+	uint32_t                            num_mid;
+	uint32_t                            num_wm;
+	uint32_t                            line_based;
+	uint32_t                            wm_idx[PLANE_MAX];
+	uint32_t                            mc_grp_shift;
+	uint8_t                            *name[PLANE_MAX];
+	uint64_t                            pid_mask;
+	bool                                mc_based;
+	bool                                cntxt_cfg_except;
+};
+
+/*
+ * struct cam_vfe_bus_ver3_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:            Common register details
+ * @num_client:            Total number of write clients
+ * @bus_client_reg:        Bus client register info
+ * @vfe_out_hw_info:       VFE output capability
+ * @num_cons_err:          Number of constraint errors in list
+ * @constraint_error_list: Static list of all constraint errors
+ * @num_comp_grp:          Number of composite groups
+ * @comp_done_mask:        Mask shift for comp done mask
+ * @top_irq_shift:         Mask shift for top level BUS WR irq
+ * @support_consumed_addr: Indicate if bus support consumed address
+ * @max_out_res:           Max vfe out resource value supported for hw
+ * @supported_irq:         Mask to indicate the IRQ supported
+ * @comp_cfg_needed:       Composite group config is needed for hw
+ * @pack_align_shift:      Shift value for alignment of packer format
+ * @max_bw_counter_limit:  Max BW counter limit
+ */
+struct cam_vfe_bus_ver3_hw_info {
+	struct cam_vfe_bus_ver3_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_vfe_bus_ver3_reg_offset_bus_client
+		bus_client_reg[CAM_VFE_BUS_VER3_MAX_CLIENTS];
+	uint32_t num_out;
+	struct cam_vfe_bus_ver3_vfe_out_hw_info
+		vfe_out_hw_info[CAM_VFE_BUS_VER3_VFE_OUT_MAX];
+	uint32_t num_cons_err;
+	struct cam_vfe_constraint_error_info
+		constraint_error_list[CAM_VFE_BUS_VER3_CONS_ERR_MAX];
+	uint32_t num_bus_errors_0;
+	uint32_t num_bus_errors_1;
+	struct cam_vfe_bus_ver3_err_irq_desc *bus_err_desc_0;
+	struct cam_vfe_bus_ver3_err_irq_desc *bus_err_desc_1;
+	uint32_t num_comp_grp;
+	uint32_t comp_done_mask[CAM_VFE_BUS_VER3_COMP_GRP_MAX];
+	uint32_t top_irq_shift;
+	bool support_consumed_addr;
+	uint32_t max_out_res;
+	uint32_t supported_irq;
+	bool comp_cfg_needed;
+	uint32_t pack_align_shift;
+	uint32_t max_bw_counter_limit;
+};
+
+/**
+ * struct cam_vfe_bus_ver3_wm_mini_dump - VFE WM data
+ *
+ * @width                  Width
+ * @height                 Height
+ * @stride                 stride
+ * @h_init                 init height
+ * @acquired_width         acquired width
+ * @acquired_height        acquired height
+ * @en_cfg                 Enable flag
+ * @format                 format
+ * @index                  Index
+ * @state                  state
+ * @name                   Res name
+ */
+struct cam_vfe_bus_ver3_wm_mini_dump {
+	uint32_t   width;
+	uint32_t   height;
+	uint32_t   stride;
+	uint32_t   h_init;
+	uint32_t   acquired_width;
+	uint32_t   acquired_height;
+	uint32_t   en_cfg;
+	uint32_t   format;
+	uint32_t   index;
+	uint32_t   state;
+	uint8_t    name[CAM_ISP_RES_NAME_LEN];
+};
+
+/**
+ * struct cam_vfe_bus_ver3_mini_dump_data - VFE bus mini dump data
+ *
+ * @wm:              Write Master client information
+ * @clk_rate:        Clock rate
+ * @num_client:      Num client
+ * @hw_state:        hw statte
+ * @hw_idx:          Hw index
+ */
+struct cam_vfe_bus_ver3_mini_dump_data {
+	struct cam_vfe_bus_ver3_wm_mini_dump *wm;
+	uint64_t                              clk_rate;
+	uint32_t                              num_client;
+	uint8_t                               hw_state;
+	uint8_t                               hw_idx;
+};
+
+/*
+ * cam_vfe_bus_ver3_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_ver3_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus);
+
+/*
+ * cam_vfe_bus_ver3_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @vfe_bus:                 Pointer to vfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_ver3_deinit(struct cam_vfe_bus     **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_VER3_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/include/cam_vfe_bus.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/include/cam_vfe_bus.h
@@ -0,0 +1,100 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_BUS_H_
+#define _CAM_VFE_BUS_H_
+
+#include <media/cam_isp.h>
+
+#include "cam_hw_intf.h"
+#include "cam_isp_hw.h"
+
+#define CAM_VFE_BUS_VER_1_0             0x1000
+#define CAM_VFE_BUS_VER_2_0             0x2000
+#define CAM_VFE_BUS_VER_3_0             0x3000
+
+#define CAM_VFE_BUS_RD_VER_1_0          0x1000
+
+#define CAM_VFE_ADD_REG_VAL_PAIR(buf_array, index, offset, val)    \
+	do {                                               \
+		buf_array[(index)++] = offset;             \
+		buf_array[(index)++] = val;                \
+	} while (0)
+
+#define ALIGNUP(value, alignment) \
+	((value + alignment - 1) / alignment * alignment)
+
+enum cam_vfe_bus_plane_type {
+	PLANE_Y,
+	PLANE_C,
+	PLANE_C2,
+	PLANE_MAX,
+};
+
+enum cam_vfe_bus_type {
+	BUS_TYPE_WR,
+	BUS_TYPE_RD,
+	BUS_TYPE_MAX,
+};
+
+/*
+ * struct cam_vfe_bus:
+ *
+ * @Brief:                   Bus interface structure
+ *
+ * @bus_priv:                Private data of BUS
+ * @hw_ops:                  Hardware interface functions
+ * @top_half_handler:        Top Half handler function
+ * @bottom_half_handler:     Bottom Half handler function
+ */
+struct cam_vfe_bus {
+	void               *bus_priv;
+
+	struct cam_hw_ops              hw_ops;
+	CAM_IRQ_HANDLER_TOP_HALF       top_half_handler;
+	CAM_IRQ_HANDLER_BOTTOM_HALF    bottom_half_handler;
+};
+
+/*
+ * cam_vfe_bus_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @bus_version:             Version of BUS to initialize
+ * @bus_type:                Bus Type RD/WR
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_init(uint32_t          bus_version,
+	int                            bus_type,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *bus_hw_info,
+	void                          *vfe_irq_controller,
+	struct cam_vfe_bus           **vfe_bus);
+
+/*
+ * cam_vfe_bus_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @bus_version:             Version of BUS to deinitialize
+ * @vfe_bus:                 Pointer to vfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_deinit(uint32_t        bus_version,
+	struct cam_vfe_bus           **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.c
@@ -0,0 +1,594 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_camif_lite_ver2.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+
+struct cam_vfe_mux_camif_lite_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_camif_lite_ver2_reg          *camif_lite_reg;
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_lite_ver2_reg_data     *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+	enum cam_isp_hw_sync_mode                    sync_mode;
+
+	cam_hw_mgr_event_cb_func              event_cb;
+	void                                 *priv;
+	int                                   irq_err_handle;
+	int                                   irq_handle;
+	void                                 *vfe_irq_controller;
+	struct cam_vfe_top_irq_evt_payload
+		evt_payload[CAM_VFE_CAMIF_LITE_EVT_MAX];
+	struct list_head                      free_payload_list;
+	spinlock_t                            spin_lock;
+	struct timespec64                     error_ts;
+};
+
+static int cam_vfe_camif_lite_get_evt_payload(
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&camif_lite_priv->spin_lock);
+	if (list_empty(&camif_lite_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&camif_lite_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&camif_lite_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_put_evt_payload(
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!camif_lite_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&camif_lite_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list,
+		&camif_lite_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&camif_lite_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_camif_lite_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	bool                                   error_flag = false;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x, IRQ status_1 = %x",
+		th_payload->evt_status_arr[0], th_payload->evt_status_arr[1]);
+
+	camif_lite_node = th_payload->handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[1] || (th_payload->evt_status_arr[0] &
+		camif_lite_priv->reg_data->lite_err_irq_mask0)) {
+		CAM_ERR(CAM_ISP,
+			"CAMIF LITE ERR VFE:%d IRQ STATUS_0=0x%x STATUS_1=0x%x",
+			camif_lite_node->hw_intf->hw_idx,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from VFE:%d",
+			camif_lite_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_all(
+			camif_lite_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_camif_lite_get_evt_payload(camif_lite_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ STATUS_0=0x%x STATUS_1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		camif_lite_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		camif_lite_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->violation_status);
+
+	if (error_flag)
+		CAM_INFO(CAM_ISP, "Violation status = 0x%x",
+			evt_payload->irq_reg_val[i]);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+
+static int cam_vfe_camif_lite_get_reg_update(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *cmd_args,
+	uint32_t                               arg_size)
+{
+	uint32_t                               size = 0;
+	uint32_t                               reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update      *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops              *cdm_util_ops = NULL;
+	struct cam_vfe_mux_camif_lite_data    *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	rsrc_data = camif_lite_res->res_priv;
+	reg_val_pair[0] = rsrc_data->camif_lite_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->dual_pd_reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "CAMIF Lite reg_update_cmd %x offset %x",
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_camif_lite_ver2_acquire_resource(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *acquire_param)
+{
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_data;
+	struct cam_vfe_acquire_args           *acquire_data;
+	int rc = 0;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_lite_data = (struct cam_vfe_mux_camif_lite_data *)
+		camif_lite_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	camif_lite_data->sync_mode   = acquire_data->vfe_in.sync_mode;
+	camif_lite_data->event_cb    = acquire_data->event_cb;
+	camif_lite_data->priv        = acquire_data->priv;
+
+	CAM_DBG(CAM_ISP, "hw id:%d sync_mode=%d",
+		camif_lite_res->hw_intf->hw_idx,
+		camif_lite_data->sync_mode);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_resource_start(
+	struct cam_isp_resource_node         *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data   *rsrc_data;
+	uint32_t                              val = 0;
+	int                                   rc = 0;
+	uint32_t err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_lite_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Invalid camif lite res res_state:%d",
+			camif_lite_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_vfe_mux_camif_lite_data *)
+		camif_lite_res->res_priv;
+
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->lite_err_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->lite_err_irq_mask1;
+
+	/* vfe core config */
+	val = cam_io_r_mb(rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg);
+
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	val |= (1 << rsrc_data->reg_data->dual_pd_path_sel_shift);
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg);
+
+	CAM_DBG(CAM_ISP, "hw id:%d core_cfg val:%d",
+		camif_lite_res->hw_intf->hw_idx, val);
+
+	/* epoch config with 20 line */
+	cam_io_w_mb(rsrc_data->reg_data->lite_epoch_line_cfg,
+		rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->lite_epoch_irq);
+
+	camif_lite_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->dual_pd_reg_update_cmd_data,
+		rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->reg_update_cmd);
+	CAM_DBG(CAM_ISP, "hw id:%d RUP val:%d",
+		camif_lite_res->hw_intf->hw_idx,
+		rsrc_data->reg_data->dual_pd_reg_update_cmd_data);
+
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			camif_lite_res,
+			cam_vfe_camif_lite_err_irq_top_half,
+			camif_lite_res->bottom_half_handler,
+			camif_lite_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	rsrc_data->error_ts.tv_sec = 0;
+	rsrc_data->error_ts.tv_nsec = 0;
+
+	CAM_DBG(CAM_ISP, "Start Camif Lite IFE %d Done",
+		camif_lite_res->hw_intf->hw_idx);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_resource_stop(
+	struct cam_isp_resource_node             *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv;
+	int                                       rc = 0;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_lite_priv = (struct cam_vfe_mux_camif_lite_data *)camif_lite_res;
+
+	if (camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		camif_lite_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	if (camif_lite_priv->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_lite_priv->vfe_irq_controller,
+			camif_lite_priv->irq_handle);
+		camif_lite_priv->irq_handle = 0;
+	}
+
+	if (camif_lite_priv->irq_err_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_lite_priv->vfe_irq_controller,
+			camif_lite_priv->irq_err_handle);
+		camif_lite_priv->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_lite_process_cmd(
+	struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_camif_lite_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_lite_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload  *evt_payload;
+
+	camif_lite_node = th_payload->handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x", th_payload->evt_status_arr[0]);
+	CAM_DBG(CAM_ISP, "IRQ status_1 = %x", th_payload->evt_status_arr[1]);
+
+	rc  = cam_vfe_camif_lite_get_evt_payload(camif_lite_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ status0=0x%x status1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_camif_lite_handle_irq_bottom_half(
+	void                                 *handler_priv,
+	void                                 *evt_payload_priv)
+{
+	int                                   ret = CAM_VFE_IRQ_STATUS_MAX;
+	struct cam_isp_resource_node         *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data   *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload   *payload;
+	struct cam_isp_hw_event_info          evt_info;
+	uint32_t                              irq_status0;
+	uint32_t                              irq_status1;
+	struct cam_hw_soc_info               *soc_info = NULL;
+	struct cam_vfe_soc_private           *soc_private = NULL;
+	struct cam_isp_hw_error_event_info    err_evt_info;
+	struct timespec64                     ts;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	camif_lite_node = handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+	payload = evt_payload_priv;
+	irq_status0 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	irq_status1 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1];
+	soc_info = camif_lite_priv->soc_info;
+	soc_private =
+		(struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	evt_info.hw_type  = CAM_ISP_HW_TYPE_VFE;
+	evt_info.hw_idx   = camif_lite_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_lite_node->res_id;
+	evt_info.res_type = camif_lite_node->res_type;
+
+	CAM_DBG(CAM_ISP, "irq_status_0 = 0x%x irq_status_1 = 0x%x",
+		irq_status0, irq_status1);
+
+	if (irq_status0 & camif_lite_priv->reg_data->lite_sof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF Lite Received SOF",
+			evt_info.hw_idx);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_lite_priv->reg_data->lite_epoch0_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF Lite Received EPOCH",
+			evt_info.hw_idx);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_lite_priv->reg_data->dual_pd_reg_upd_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF Lite Received REG_UPDATE_ACK",
+			evt_info.hw_idx);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_lite_priv->reg_data->lite_eof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF Lite Received EOF",
+			evt_info.hw_idx);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if ((irq_status0 & camif_lite_priv->reg_data->lite_err_irq_mask0) ||
+		(irq_status1 & camif_lite_priv->reg_data->lite_err_irq_mask1)) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE Received ERROR",
+			evt_info.hw_idx);
+
+		err_evt_info.err_type = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		evt_info.event_data = (void *)&err_evt_info;
+
+		cam_cpas_dump_camnoc_buff_fill_info(soc_private->cpas_handle);
+
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic timestamp:[%lld.%09lld]",
+			ts.tv_sec, ts.tv_nsec);
+		CAM_INFO(CAM_ISP,
+			"ERROR timestamp:[%lld.%09lld]",
+			camif_lite_priv->error_ts.tv_sec,
+			camif_lite_priv->error_ts.tv_nsec);
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+
+		cam_cpas_log_votes(false);
+
+	}
+
+	cam_vfe_camif_lite_put_evt_payload(camif_lite_priv, &payload);
+
+	CAM_DBG(CAM_ISP, "returning status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_camif_lite_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_lite_hw_info,
+	struct cam_isp_resource_node  *camif_lite_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv = NULL;
+	struct cam_vfe_camif_lite_ver2_hw_info   *camif_lite_info =
+		camif_lite_hw_info;
+	int                                       i = 0;
+
+	camif_lite_priv = kzalloc(sizeof(*camif_lite_priv),
+		GFP_KERNEL);
+	if (!camif_lite_priv)
+		return -ENOMEM;
+
+	camif_lite_node->res_priv = camif_lite_priv;
+
+	camif_lite_priv->mem_base           =
+		soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	camif_lite_priv->camif_lite_reg     = camif_lite_info->camif_lite_reg;
+	camif_lite_priv->common_reg         = camif_lite_info->common_reg;
+	camif_lite_priv->reg_data           = camif_lite_info->reg_data;
+	camif_lite_priv->hw_intf            = hw_intf;
+	camif_lite_priv->soc_info           = soc_info;
+	camif_lite_priv->vfe_irq_controller = vfe_irq_controller;
+
+	camif_lite_node->init    = NULL;
+	camif_lite_node->deinit  = NULL;
+	camif_lite_node->start   = cam_vfe_camif_lite_resource_start;
+	camif_lite_node->stop    = cam_vfe_camif_lite_resource_stop;
+	camif_lite_node->process_cmd = cam_vfe_camif_lite_process_cmd;
+	camif_lite_node->top_half_handler =
+		cam_vfe_camif_lite_handle_irq_top_half;
+	camif_lite_node->bottom_half_handler =
+		cam_vfe_camif_lite_handle_irq_bottom_half;
+
+	spin_lock_init(&camif_lite_priv->spin_lock);
+	INIT_LIST_HEAD(&camif_lite_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_LITE_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&camif_lite_priv->evt_payload[i].list);
+		list_add_tail(&camif_lite_priv->evt_payload[i].list,
+			&camif_lite_priv->free_payload_list);
+	}
+
+	return 0;
+}
+
+int cam_vfe_camif_lite_ver2_deinit(
+	struct cam_isp_resource_node  *camif_lite_node)
+{
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv =
+		camif_lite_node->res_priv;
+	int                                 i = 0;
+
+	if (!camif_lite_priv) {
+          	CAM_WARN(CAM_ISP, "Error! camif_priv is NULL");
+          	return -ENODEV;
+	}
+  
+  	INIT_LIST_HEAD(&camif_lite_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_LITE_EVT_MAX; i++)
+		INIT_LIST_HEAD(&camif_lite_priv->evt_payload[i].list);
+
+	camif_lite_node->start = NULL;
+	camif_lite_node->stop  = NULL;
+	camif_lite_node->process_cmd = NULL;
+	camif_lite_node->top_half_handler = NULL;
+	camif_lite_node->bottom_half_handler = NULL;
+	camif_lite_node->res_priv = NULL;
+
+	kfree(camif_lite_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.h
@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CAMIF_LITE_VER2_H_
+#define _CAM_VFE_CAMIF_LITE_VER2_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+#define CAM_VFE_CAMIF_LITE_EVT_MAX     256
+
+struct cam_vfe_camif_lite_ver2_reg {
+	uint32_t     camif_lite_cmd;
+	uint32_t     camif_lite_config;
+	uint32_t     lite_skip_period;
+	uint32_t     lite_irq_subsample_pattern;
+	uint32_t     lite_epoch_irq;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_vfe_camif_lite_ver2_reg_data {
+	uint32_t     dual_pd_reg_update_cmd_data;
+	uint32_t     lite_epoch_line_cfg;
+	uint32_t     lite_sof_irq_mask;
+	uint32_t     lite_epoch0_irq_mask;
+	uint32_t     dual_pd_reg_upd_irq_mask;
+	uint32_t     lite_eof_irq_mask;
+	uint32_t     lite_err_irq_mask0;
+	uint32_t     lite_err_irq_mask1;
+	uint32_t     lite_subscribe_irq_mask0;
+	uint32_t     lite_subscribe_irq_mask1;
+	uint32_t     extern_reg_update_shift;
+	uint32_t     dual_pd_path_sel_shift;
+};
+
+struct cam_vfe_camif_lite_ver2_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_lite_ver2_reg          *camif_lite_reg;
+	struct cam_vfe_camif_lite_ver2_reg_data     *reg_data;
+};
+
+int cam_vfe_camif_lite_ver2_acquire_resource(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *acquire_param);
+
+int cam_vfe_camif_lite_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_lite_hw_info,
+	struct cam_isp_resource_node  *camif_lite_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_camif_lite_ver2_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_CAMIF_LITE_VER2_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.c
@@ -0,0 +1,1332 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_camif_lite_ver3.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_cpas_api.h"
+
+struct cam_vfe_mux_camif_lite_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_camif_lite_ver3_reg          *camif_lite_reg;
+	struct cam_vfe_top_ver3_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_lite_ver3_reg_data     *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+	enum cam_isp_hw_sync_mode                    sync_mode;
+	struct cam_vfe_camif_common_cfg              cam_common_cfg;
+
+	cam_hw_mgr_event_cb_func                     event_cb;
+	void                                        *priv;
+	int                                          irq_err_handle;
+	int                                          irq_handle;
+	int                                          sof_irq_handle;
+	void                                        *vfe_irq_controller;
+	struct list_head                             free_payload_list;
+	spinlock_t                                   spin_lock;
+	uint32_t                                     camif_debug;
+	struct cam_vfe_top_irq_evt_payload
+		evt_payload[CAM_VFE_CAMIF_LITE_EVT_MAX];
+	struct timespec64                            sof_ts;
+	struct timespec64                            epoch_ts;
+	struct timespec64                            eof_ts;
+	struct timespec64                            error_ts;
+};
+
+static int cam_vfe_camif_lite_get_evt_payload(
+	struct cam_vfe_mux_camif_lite_data     *camif_lite_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&camif_lite_priv->spin_lock);
+	if (list_empty(&camif_lite_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free CAMIF LITE event payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&camif_lite_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&camif_lite_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_put_evt_payload(
+	struct cam_vfe_mux_camif_lite_data     *camif_lite_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!camif_lite_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&camif_lite_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list,
+		&camif_lite_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&camif_lite_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_camif_lite_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	struct cam_vfe_soc_private            *soc_private = NULL;
+	bool                                   error_flag = false;
+
+	camif_lite_node = th_payload->handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+
+	soc_private = camif_lite_priv->soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[2] || (th_payload->evt_status_arr[0] &
+		camif_lite_priv->reg_data->error_irq_mask0)) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d CAMIF LITE:%d Err IRQ status_1: 0x%X status_2: 0x%X",
+			camif_lite_node->hw_intf->hw_idx,
+			camif_lite_node->res_id,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[2]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from VFE:%d",
+			camif_lite_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_all(
+			camif_lite_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_camif_lite_get_evt_payload(camif_lite_priv, &evt_payload);
+	if (rc)
+		return rc;
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		camif_lite_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		camif_lite_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->violation_status);
+
+	evt_payload->irq_reg_val[++i] = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->bus_overflow_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+
+static int cam_vfe_camif_lite_get_reg_update(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *cmd_args,
+	uint32_t                               arg_size)
+{
+	uint32_t                               size = 0;
+	uint32_t                               reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update      *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops              *cdm_util_ops = NULL;
+	struct cam_vfe_mux_camif_lite_data    *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP,
+			"Invalid args: cdm args %pK", cdm_args);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CAMIF LITE:%d %s get RUP", camif_lite_res->res_id,
+		camif_lite_res->res_name);
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	rsrc_data = camif_lite_res->res_priv;
+	reg_val_pair[0] = rsrc_data->camif_lite_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "CAMIF LITE:%d %s reg_update_cmd 0x%X offset 0x%X",
+		camif_lite_res->res_id, camif_lite_res->res_name,
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_camif_lite_ver3_acquire_resource(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *acquire_param)
+{
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_data;
+	struct cam_vfe_acquire_args           *acquire_data;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_lite_data = (struct cam_vfe_mux_camif_lite_data *)
+		camif_lite_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	camif_lite_data->sync_mode         = acquire_data->vfe_in.sync_mode;
+	camif_lite_data->event_cb          = acquire_data->event_cb;
+	camif_lite_data->priv              = acquire_data->priv;
+	camif_lite_res->is_rdi_primary_res = false;
+	CAM_DBG(CAM_ISP, "Acquired VFE:%d CAMIF LITE:%d %s sync_mode=%d",
+		camif_lite_res->hw_intf->hw_idx,
+		camif_lite_res->res_id,
+		camif_lite_res->res_name,
+		camif_lite_data->sync_mode);
+	return 0;
+}
+
+static int cam_vfe_camif_lite_resource_start(
+	struct cam_isp_resource_node         *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data   *rsrc_data;
+	struct cam_vfe_soc_private           *soc_private = NULL;
+	uint32_t                              val = 0;
+	int                                   rc = 0;
+	uint32_t err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_lite_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid camif lite res res_state:%d",
+			camif_lite_res->res_state);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CAMIF LITE:%d %s Start", camif_lite_res->res_id,
+		camif_lite_res->res_name);
+
+	rsrc_data = (struct cam_vfe_mux_camif_lite_data *)
+		camif_lite_res->res_priv;
+
+	soc_private = rsrc_data->soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	if (soc_private->is_ife_lite)
+		goto skip_core_cfg;
+
+	/* vfe core config */
+	val = cam_io_r_mb(rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	if (camif_lite_res->res_id == CAM_ISP_HW_VFE_IN_LCR &&
+		rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	if (camif_lite_res->res_id == CAM_ISP_HW_VFE_IN_PDLIB) {
+		val |= (1 << rsrc_data->reg_data->operating_mode_shift);
+		val |= (rsrc_data->cam_common_cfg.input_mux_sel_pdaf & 0x1) <<
+			CAM_SHIFT_TOP_CORE_CFG_MUXSEL_PDAF;
+	}
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	CAM_DBG(CAM_ISP, "VFE:%d core_cfg val:%d",
+		camif_lite_res->hw_intf->hw_idx, val);
+
+	/* epoch config */
+	cam_io_w_mb(rsrc_data->reg_data->epoch_line_cfg,
+		rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->lite_epoch_irq);
+
+	rsrc_data->error_ts.tv_sec = 0;
+	rsrc_data->error_ts.tv_nsec = 0;
+	rsrc_data->sof_ts.tv_sec = 0;
+	rsrc_data->sof_ts.tv_nsec = 0;
+	rsrc_data->epoch_ts.tv_sec = 0;
+	rsrc_data->epoch_ts.tv_nsec = 0;
+	rsrc_data->eof_ts.tv_sec = 0;
+	rsrc_data->eof_ts.tv_nsec = 0;
+
+skip_core_cfg:
+
+	camif_lite_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->reg_update_cmd);
+
+	memset(err_irq_mask, 0, sizeof(err_irq_mask));
+	memset(irq_mask, 0, sizeof(irq_mask));
+
+	val = cam_io_r(rsrc_data->mem_base + rsrc_data->common_reg->top_debug_cfg);
+	val |= rsrc_data->reg_data->top_debug_cfg_en;
+	cam_io_w_mb(val, rsrc_data->mem_base + rsrc_data->common_reg->top_debug_cfg);
+
+	if (!camif_lite_res->is_rdi_primary_res)
+		goto subscribe_err;
+
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->epoch0_irq_mask |
+		rsrc_data->reg_data->eof_irq_mask;
+
+	if (!rsrc_data->irq_handle) {
+		rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_3,
+			irq_mask,
+			camif_lite_res,
+			camif_lite_res->top_half_handler,
+			camif_lite_res->bottom_half_handler,
+			camif_lite_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+		if (rsrc_data->irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_handle = 0;
+		}
+	}
+
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+			rsrc_data->reg_data->sof_irq_mask;
+
+	if (!rsrc_data->sof_irq_handle) {
+		rsrc_data->sof_irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			irq_mask,
+			camif_lite_res,
+			camif_lite_res->top_half_handler,
+			camif_lite_res->bottom_half_handler,
+			camif_lite_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+		if (rsrc_data->sof_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->sof_irq_handle = 0;
+		}
+	}
+
+subscribe_err:
+
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->error_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS2] =
+		rsrc_data->reg_data->error_irq_mask2;
+
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			camif_lite_res,
+			cam_vfe_camif_lite_err_irq_top_half,
+			camif_lite_res->bottom_half_handler,
+			camif_lite_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d %s Start Done",
+		camif_lite_res->hw_intf->hw_idx,
+		camif_lite_res->res_id, camif_lite_res->res_name);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_reg_dump(
+	struct cam_isp_resource_node *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv;
+	struct cam_vfe_soc_private         *soc_private = NULL;
+	uint32_t offset, val, wm_idx;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_lite_priv =
+		(struct cam_vfe_mux_camif_lite_data *)camif_lite_res->res_priv;
+
+	soc_private = camif_lite_priv->soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d TOP", camif_lite_priv->hw_intf->hw_idx);
+	if (!soc_private->is_ife_lite) {
+		for (offset = 0x0; offset <= 0x1FC; offset += 0x4) {
+			if (offset == 0x1C || offset == 0x34 ||
+				offset == 0x38 || offset == 0x90)
+				continue;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+		}
+	} else {
+		for (offset = 0x0; offset <= 0x74; offset += 0x4) {
+			if (offset == 0xC || offset == 0x20 || offset == 0x24)
+				continue;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+		}
+	}
+
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_RDI0)
+		goto dump_rdi_1;
+
+	CAM_INFO(CAM_ISP, "IFE:%d RDI0 CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	if (!soc_private->is_ife_lite) {
+		for (offset = 0x9A00; offset <= 0x9BFC; offset += 0x4) {
+			if (offset == 0x9A08)
+				offset = 0x9A60;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x9A60)
+				offset = 0x9A64;
+			else if (offset == 0x9A70)
+				offset = 0x9AEC;
+		}
+	} else {
+		for (offset = 0x1200; offset <= 0x13FC; offset += 0x4) {
+			if (offset == 0x1208)
+				offset = 0x1260;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x1260)
+				offset = 0x1264;
+			else if (offset == 0x1270)
+				offset = 0x12EC;
+		}
+	}
+
+	goto wr_dump;
+
+dump_rdi_1:
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_RDI1)
+		goto dump_rdi_2;
+
+	CAM_INFO(CAM_ISP, "IFE:%d RDI1 CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	if (!soc_private->is_ife_lite) {
+		for (offset = 0x9C00; offset <= 0x9DFC; offset += 0x4) {
+			if (offset == 0x9C08)
+				offset = 0x9C60;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x9C60)
+				offset = 0x9C64;
+			else if (offset == 0x9C70)
+				offset = 0x9DEC;
+		}
+	} else {
+		for (offset = 0x1400; offset <= 0x15FC; offset += 0x4) {
+			if (offset == 0x1408)
+				offset = 0x1460;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x1460)
+				offset = 0x1464;
+			else if (offset == 0x1470)
+				offset = 0x15EC;
+		}
+	}
+
+	goto wr_dump;
+
+dump_rdi_2:
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_RDI2)
+		goto dump_rdi_3;
+
+	CAM_INFO(CAM_ISP, "IFE:%d RDI2 CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	if (!soc_private->is_ife_lite) {
+		for (offset = 0x9E00; offset <= 0x9FFC; offset += 0x4) {
+			if (offset == 0x9E08)
+				offset = 0x9E60;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x9E60)
+				offset = 0x9E64;
+			else if (offset == 0x9E70)
+				offset = 0x9FEC;
+		}
+	} else {
+		for (offset = 0x1600; offset <= 0x17FC; offset += 0x4) {
+			if (offset == 0x1608)
+				offset = 0x1660;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x1660)
+				offset = 0x1664;
+			else if (offset == 0x1670)
+				offset = 0x17EC;
+		}
+	}
+
+	goto wr_dump;
+
+dump_rdi_3:
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_RDI3)
+		goto dump_pdlib;
+
+	CAM_INFO(CAM_ISP, "IFE:%d RDI3 CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	if (soc_private->is_ife_lite) {
+		for (offset = 0x1800; offset <= 0x19FC; offset += 0x4) {
+			if (offset == 0x1808)
+				offset = 0x1860;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x1860)
+				offset = 0x1864;
+			else if (offset == 0x1870)
+				offset = 0x19EC;
+		}
+	}
+
+	goto wr_dump;
+
+dump_pdlib:
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_PDLIB)
+		goto dump_lcr;
+
+	CAM_INFO(CAM_ISP, "IFE:%d PDLIB CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0xA400; offset <= 0xA5FC; offset += 0x4) {
+		if (offset == 0xA408)
+			offset = 0xA460;
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+			offset, val);
+		if (offset == 0xA460)
+			offset = 0xA464;
+		else if (offset == 0xA470)
+			offset = 0xA5EC;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d CLC PDLIB",
+		camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0xA600; offset <= 0xA718; offset += 0x4) {
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	goto wr_dump;
+
+dump_lcr:
+	CAM_INFO(CAM_ISP, "IFE:%d LCR CAMIF", camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0xA000; offset <= 0xA1FC; offset += 0x4) {
+		if (offset == 0xA008)
+			offset = 0xA060;
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+			offset, val);
+		if (offset == 0xA060)
+			offset = 0xA064;
+		else if (offset == 0xA070)
+			offset = 0xA1EC;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d CLC LCR", camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0xA200; offset <= 0xA3FC; offset += 0x4) {
+		if (offset == 0xA208)
+			offset = 0xA260;
+		else if (offset == 0xA288)
+			offset = 0xA3F8;
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+			offset, val);
+		if (offset == 0xA260)
+			offset = 0xA264;
+		else if (offset == 0xA280)
+			offset = 0xA1EC;
+	}
+
+wr_dump:
+	if (!soc_private->is_ife_lite)
+		goto end_dump;
+
+	CAM_INFO(CAM_ISP, "IFE:%d LITE BUS WR",
+		camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0x1A00; offset <= 0x1AE0; offset += 0x4) {
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_DBG(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	for (wm_idx = 0; wm_idx <= 3; wm_idx++) {
+		for (offset = 0x1C00 + 0x100 * wm_idx; offset < (0x1C00 +
+			0x100 * wm_idx + 0x84); offset += 0x4) {
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+		}
+	}
+
+end_dump:
+	return 0;
+}
+
+static int cam_vfe_camif_lite_resource_stop(
+	struct cam_isp_resource_node             *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data       *rsrc_data;
+	int                                       rc = 0;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d %s Stop",
+		camif_lite_res->hw_intf->hw_idx,
+		camif_lite_res->res_id,
+		camif_lite_res->res_name);
+
+	if ((camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	rsrc_data =
+		(struct cam_vfe_mux_camif_lite_data *)camif_lite_res->res_priv;
+
+	/* Disable Camif */
+	cam_io_w_mb(0x0, rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->lite_module_config);
+
+	if (camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		camif_lite_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	if (rsrc_data->irq_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			rsrc_data->irq_handle);
+		rsrc_data->irq_handle = 0;
+	}
+
+	if (rsrc_data->sof_irq_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			rsrc_data->sof_irq_handle);
+		rsrc_data->sof_irq_handle = 0;
+	}
+
+	if (rsrc_data->irq_err_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			rsrc_data->irq_err_handle);
+		rsrc_data->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_lite_ver3_core_config(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv;
+	struct cam_vfe_core_config_args *vfe_core_cfg =
+		(struct cam_vfe_core_config_args *)cmd_args;
+
+	camif_lite_priv =
+		(struct cam_vfe_mux_camif_lite_data *)rsrc_node->res_priv;
+	camif_lite_priv->cam_common_cfg.vid_ds16_r2pd =
+		vfe_core_cfg->core_config.vid_ds16_r2pd;
+	camif_lite_priv->cam_common_cfg.vid_ds4_r2pd =
+		vfe_core_cfg->core_config.vid_ds4_r2pd;
+	camif_lite_priv->cam_common_cfg.disp_ds16_r2pd =
+		vfe_core_cfg->core_config.disp_ds16_r2pd;
+	camif_lite_priv->cam_common_cfg.disp_ds4_r2pd =
+		vfe_core_cfg->core_config.disp_ds4_r2pd;
+	camif_lite_priv->cam_common_cfg.dsp_streaming_tap_point =
+		vfe_core_cfg->core_config.dsp_streaming_tap_point;
+	camif_lite_priv->cam_common_cfg.ihist_src_sel =
+		vfe_core_cfg->core_config.ihist_src_sel;
+	camif_lite_priv->cam_common_cfg.hdr_be_src_sel =
+		vfe_core_cfg->core_config.hdr_be_src_sel;
+	camif_lite_priv->cam_common_cfg.hdr_bhist_src_sel =
+		vfe_core_cfg->core_config.hdr_bhist_src_sel;
+	camif_lite_priv->cam_common_cfg.input_mux_sel_pdaf =
+		vfe_core_cfg->core_config.input_mux_sel_pdaf;
+	camif_lite_priv->cam_common_cfg.input_mux_sel_pp =
+		vfe_core_cfg->core_config.input_mux_sel_pp;
+
+	return 0;
+}
+
+static int cam_vfe_camif_lite_process_cmd(
+	struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv = NULL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_camif_lite_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = cam_vfe_camif_lite_ver3_core_config(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		camif_lite_priv = (struct cam_vfe_mux_camif_lite_data *)
+			rsrc_node->res_priv;
+		camif_lite_priv->camif_debug = *((uint32_t *)cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static void cam_vfe_camif_lite_overflow_debug_info(
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv)
+{
+	struct cam_vfe_soc_private *soc_private = NULL;
+	uint32_t val0, val1, val2, val3;
+
+	soc_private = camif_lite_priv->soc_info->soc_private;
+
+	val0 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_0);
+	val1 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_1);
+	val2 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_2);
+	val3 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_3);
+	CAM_INFO(CAM_ISP,
+		"status_0: 0x%X status_1: 0x%X status_2: 0x%X status_3: 0x%X",
+		val0, val1, val2, val3);
+
+	if (soc_private->is_ife_lite)
+		return;
+
+	val0 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_4);
+	val1 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_5);
+	val2 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_6);
+	val3 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_7);
+	CAM_INFO(CAM_ISP,
+		"status_4: 0x%X status_5: 0x%X status_6: 0x%X status_7: 0x%X",
+		val0, val1, val2, val3);
+	val0 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_8);
+	val1 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_9);
+	val2 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_10);
+	val3 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_11);
+	CAM_INFO(CAM_ISP,
+		"status_8: 0x%X status_9: 0x%X status_10: 0x%X status_11: 0x%X",
+		val0, val1, val2, val3);
+	val0 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_12);
+	val1 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_13);
+	CAM_INFO(CAM_ISP, "status_12: 0x%X status_13: 0x%X",
+		val0, val1);
+}
+
+static void cam_vfe_camif_lite_print_status(uint32_t *status,
+	int err_type, struct cam_vfe_mux_camif_lite_data *camif_lite_priv)
+{
+	uint32_t violation_mask = 0x3F00, violation_status = 0;
+	uint32_t bus_overflow_status = 0, status_0 = 0, status_2 = 0;
+	struct cam_vfe_soc_private *soc_private = NULL;
+
+	if (!status) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return;
+	}
+
+	bus_overflow_status = status[CAM_IFE_IRQ_BUS_OVERFLOW_STATUS];
+	violation_status = status[CAM_IFE_IRQ_VIOLATION_STATUS];
+	status_0 = status[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	status_2 = status[CAM_IFE_IRQ_CAMIF_REG_STATUS2];
+	soc_private = camif_lite_priv->soc_info->soc_private;
+
+	if (soc_private->is_ife_lite)
+		goto ife_lite;
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) {
+		if (status_0 & 0x200000)
+			CAM_INFO(CAM_ISP, "RDI2 FRAME DROP");
+
+		if (status_0 & 0x400000)
+			CAM_INFO(CAM_ISP, "RDI1 FRAME DROP");
+
+		if (status_0 & 0x800000)
+			CAM_INFO(CAM_ISP, "RDI0 FRAME DROP");
+
+		if (status_0 & 0x1000000)
+			CAM_INFO(CAM_ISP, "PD PIPE FRAME DROP");
+
+		if (status_0 & 0x8000000)
+			CAM_INFO(CAM_ISP, "RDI2 OVERFLOW");
+
+		if (status_0 & 0x10000000)
+			CAM_INFO(CAM_ISP, "RDI1 OVERFLOW");
+
+		if (status_0 & 0x20000000)
+			CAM_INFO(CAM_ISP, "RDI0 OVERFLOW");
+
+		if (status_0 & 0x40000000) {
+			CAM_INFO(CAM_ISP, "PD PIPE OVERFLOW");
+			cam_cpas_log_votes(false);
+		}
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && bus_overflow_status) {
+		if (bus_overflow_status & 0x0800)
+			CAM_INFO(CAM_ISP, "CAMIF PD BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0400000)
+			CAM_INFO(CAM_ISP, "LCR BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0800000)
+			CAM_INFO(CAM_ISP, "RDI0 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x01000000)
+			CAM_INFO(CAM_ISP, "RDI1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x02000000)
+			CAM_INFO(CAM_ISP, "RDI2 BUS OVERFLOW");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && !bus_overflow_status) {
+		CAM_INFO(CAM_ISP, "PDLIB / LCR Module hang");
+		/* print debug registers */
+		cam_vfe_camif_lite_overflow_debug_info(camif_lite_priv);
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION) {
+		if (status_2 & 0x02000)
+			CAM_INFO(CAM_ISP, "PD CAMIF VIOLATION");
+
+		if (status_2 & 0x04000)
+			CAM_INFO(CAM_ISP, "PD VIOLATION");
+
+		if (status_2 & 0x08000)
+			CAM_INFO(CAM_ISP, "LCR CAMIF VIOLATION");
+
+		if (status_2 & 0x010000)
+			CAM_INFO(CAM_ISP, "LCR VIOLATION");
+
+		if (status_2 & 0x020000)
+			CAM_INFO(CAM_ISP, "RDI0 CAMIF VIOLATION");
+
+		if (status_2 & 0x040000)
+			CAM_INFO(CAM_ISP, "RDI1 CAMIF VIOLATION");
+
+		if (status_2 & 0x080000)
+			CAM_INFO(CAM_ISP, "RDI2 CAMIF VIOLATION");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION && violation_status) {
+		if (violation_mask & violation_status)
+			CAM_INFO(CAM_ISP, "LCR VIOLATION Module ID:%d",
+				violation_mask & violation_status);
+
+		violation_mask = 0x0F0000;
+		if (violation_mask & violation_status)
+			CAM_INFO(CAM_ISP, "PD VIOLATION Module ID:%d",
+				violation_mask & violation_status);
+
+	}
+
+	goto print_state;
+
+ife_lite:
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) {
+		if (status_0 & 0x100)
+			CAM_INFO(CAM_ISP, "RDI3 FRAME DROP");
+
+		if (status_0 & 0x80)
+			CAM_INFO(CAM_ISP, "RDI2 FRAME DROP");
+
+		if (status_0 & 0x40)
+			CAM_INFO(CAM_ISP, "RDI1 FRAME DROP");
+
+		if (status_0 & 0x20)
+			CAM_INFO(CAM_ISP, "RDI0 FRAME DROP");
+
+		if (status_0 & 0x8)
+			CAM_INFO(CAM_ISP, "RDI3 OVERFLOW");
+
+		if (status_0 & 0x4)
+			CAM_INFO(CAM_ISP, "RDI2 OVERFLOW");
+
+		if (status_0 & 0x2)
+			CAM_INFO(CAM_ISP, "RDI1 OVERFLOW");
+
+		if (status_0 & 0x1)
+			CAM_INFO(CAM_ISP, "RDI0 OVERFLOW");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && bus_overflow_status) {
+		if (bus_overflow_status & 0x01)
+			CAM_INFO(CAM_ISP, "RDI0 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x02)
+			CAM_INFO(CAM_ISP, "RDI1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x04)
+			CAM_INFO(CAM_ISP, "RDI2 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x08)
+			CAM_INFO(CAM_ISP, "RDI3 BUS OVERFLOW");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && !bus_overflow_status) {
+		CAM_INFO(CAM_ISP, "RDI hang");
+		/* print debug registers */
+		cam_vfe_camif_lite_overflow_debug_info(camif_lite_priv);
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION) {
+		if (status_2 & 0x100)
+			CAM_INFO(CAM_ISP, "RDI0 CAMIF VIOLATION");
+
+		if (status_2 & 0x200)
+			CAM_INFO(CAM_ISP, "RDI1 CAMIF VIOLATION");
+
+		if (status_2 & 0x400)
+			CAM_INFO(CAM_ISP, "RDI2 CAMIF VIOLATION");
+
+		if (status_2 & 0x800)
+			CAM_INFO(CAM_ISP, "RDI3 CAMIF VIOLATION");
+	}
+
+print_state:
+	cam_cpas_dump_camnoc_buff_fill_info(soc_private->cpas_handle);
+
+	CAM_INFO(CAM_ISP, "ife_clk_src:%lld", soc_private->ife_clk_src);
+
+	if ((err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) &&
+		bus_overflow_status)
+		cam_cpas_log_votes(false);
+
+}
+
+static int cam_vfe_camif_lite_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+
+	camif_lite_node = th_payload->handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d CAMIF LITE:%d %s IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+		camif_lite_node->hw_intf->hw_idx,
+		camif_lite_node->res_id,
+		camif_lite_node->res_name,
+		th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1],
+		th_payload->evt_status_arr[2]);
+
+	rc  = cam_vfe_camif_lite_get_evt_payload(camif_lite_priv, &evt_payload);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"VFE:%d CAMIF LITE:%d IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+			camif_lite_node->hw_intf->hw_idx,
+			camif_lite_node->res_id,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1],
+			th_payload->evt_status_arr[2]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_camif_lite_handle_irq_bottom_half(
+	void                                    *handler_priv,
+	void                                    *evt_payload_priv)
+{
+	int ret = CAM_VFE_IRQ_STATUS_MAX;
+	struct cam_isp_resource_node *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload *payload;
+	struct cam_isp_hw_event_info evt_info;
+	struct cam_isp_hw_error_event_info err_evt_info;
+	struct cam_vfe_soc_private *soc_private = NULL;
+	uint32_t irq_status[CAM_IFE_IRQ_REGISTERS_MAX] = {0};
+	int i = 0;
+	uint32_t status_0 = 0;
+	struct timespec64 ts;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	camif_lite_node = handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+	payload         = evt_payload_priv;
+
+	soc_private = camif_lite_priv->soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	for (i = 0; i < CAM_IFE_IRQ_REGISTERS_MAX; i++)
+		irq_status[i] = payload->irq_reg_val[i];
+
+	evt_info.hw_type  = CAM_ISP_HW_TYPE_VFE;
+	evt_info.hw_idx   = camif_lite_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_lite_node->res_id;
+	evt_info.res_type = camif_lite_node->res_type;
+	evt_info.hw_type  = CAM_ISP_HW_TYPE_VFE;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d CAMIF LITE:%d %s IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+		evt_info.hw_idx, evt_info.res_id, camif_lite_node->res_name,
+		irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0],
+		irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1],
+		irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS2]);
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_lite_priv->reg_data->sof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d %s Received SOF",
+			evt_info.hw_idx, evt_info.res_id,
+			camif_lite_node->res_name);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+		camif_lite_priv->sof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_lite_priv->sof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_lite_priv->reg_data->epoch0_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d %s Received EPOCH",
+			evt_info.hw_idx, evt_info.res_id,
+			camif_lite_node->res_name);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+		camif_lite_priv->epoch_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_lite_priv->epoch_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_lite_priv->reg_data->eof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d %s Received EOF",
+			evt_info.hw_idx, evt_info.res_id,
+			camif_lite_node->res_name);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+		camif_lite_priv->eof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_lite_priv->eof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+	}
+
+	status_0 = irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+		& camif_lite_priv->reg_data->error_irq_mask0;
+	if (status_0) {
+		CAM_ERR(CAM_ISP, "VFE:%d Overflow",
+			camif_lite_node->hw_intf->hw_idx);
+
+		err_evt_info.err_type = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		evt_info.event_data = (void *)&err_evt_info;
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic timestamp:[%lld.%09lld]",
+			ts.tv_sec, ts.tv_nsec);
+		CAM_INFO(CAM_ISP,
+			"ERROR timestamp:[%lld.%09lld]",
+			camif_lite_priv->error_ts.tv_sec,
+			camif_lite_priv->error_ts.tv_nsec);
+
+		if (camif_lite_node->is_rdi_primary_res)
+			CAM_INFO(CAM_ISP,
+				"SOF timestamp:[%lld.%09lld] EPOCH timestamp:[%lld.%09lld] EOF timestamp:[%lld.%09lld]",
+				camif_lite_priv->sof_ts.tv_sec,
+				camif_lite_priv->sof_ts.tv_nsec,
+				camif_lite_priv->epoch_ts.tv_sec,
+				camif_lite_priv->epoch_ts.tv_nsec,
+				camif_lite_priv->eof_ts.tv_sec,
+				camif_lite_priv->eof_ts.tv_nsec);
+
+		if (status_0 & 0x8000000)
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_2;
+
+		if (status_0 & 0x10000000)
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_1;
+
+		if (status_0 & 0x20000000)
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_0;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_vfe_camif_lite_print_status(irq_status, ret,
+			camif_lite_priv);
+
+		if (camif_lite_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_lite_reg_dump(camif_lite_node);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS2]) {
+		CAM_ERR(CAM_ISP, "VFE:%d Violation",
+			camif_lite_node->hw_intf->hw_idx);
+
+		err_evt_info.err_type = CAM_VFE_IRQ_STATUS_VIOLATION;
+		evt_info.event_data = (void *)&err_evt_info;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_VIOLATION;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_vfe_camif_lite_print_status(irq_status, ret,
+			camif_lite_priv);
+
+		if (camif_lite_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_lite_reg_dump(camif_lite_node);
+	}
+
+	cam_vfe_camif_lite_put_evt_payload(camif_lite_priv, &payload);
+
+	CAM_DBG(CAM_ISP, "returning status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_camif_lite_ver3_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_lite_hw_info,
+	struct cam_isp_resource_node  *camif_lite_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv = NULL;
+	struct cam_vfe_camif_lite_ver3_hw_info   *camif_lite_info =
+		camif_lite_hw_info;
+	int                                       i = 0;
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d %s Init",
+		camif_lite_node->res_id, camif_lite_node->res_id,
+		camif_lite_node->res_name);
+
+	camif_lite_priv = kzalloc(sizeof(*camif_lite_priv),
+		GFP_KERNEL);
+	if (!camif_lite_priv)
+		return -ENOMEM;
+
+	camif_lite_node->res_priv = camif_lite_priv;
+
+	camif_lite_priv->mem_base         =
+		soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	camif_lite_priv->camif_lite_reg     = camif_lite_info->camif_lite_reg;
+	camif_lite_priv->common_reg         = camif_lite_info->common_reg;
+	camif_lite_priv->reg_data           = camif_lite_info->reg_data;
+	camif_lite_priv->hw_intf            = hw_intf;
+	camif_lite_priv->soc_info           = soc_info;
+	camif_lite_priv->vfe_irq_controller = vfe_irq_controller;
+
+	camif_lite_node->init    = NULL;
+	camif_lite_node->deinit  = NULL;
+	camif_lite_node->start   = cam_vfe_camif_lite_resource_start;
+	camif_lite_node->stop    = cam_vfe_camif_lite_resource_stop;
+	camif_lite_node->process_cmd = cam_vfe_camif_lite_process_cmd;
+	camif_lite_node->top_half_handler =
+		cam_vfe_camif_lite_handle_irq_top_half;
+	camif_lite_node->bottom_half_handler =
+		cam_vfe_camif_lite_handle_irq_bottom_half;
+
+	spin_lock_init(&camif_lite_priv->spin_lock);
+	INIT_LIST_HEAD(&camif_lite_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_LITE_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&camif_lite_priv->evt_payload[i].list);
+		list_add_tail(&camif_lite_priv->evt_payload[i].list,
+			&camif_lite_priv->free_payload_list);
+	}
+
+	return 0;
+}
+
+int cam_vfe_camif_lite_ver3_deinit(
+	struct cam_isp_resource_node  *camif_lite_node)
+{
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv =
+		camif_lite_node->res_priv;
+	int                                 i = 0;
+
+	if (!camif_lite_priv) {
+		CAM_ERR(CAM_ISP, "Error! camif_priv is NULL");
+		return -ENODEV;
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d %s Deinit",
+		camif_lite_node->hw_intf->hw_idx, camif_lite_node->res_id,
+		camif_lite_node->res_name);
+
+	INIT_LIST_HEAD(&camif_lite_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_LITE_EVT_MAX; i++)
+		INIT_LIST_HEAD(&camif_lite_priv->evt_payload[i].list);
+
+	camif_lite_node->start = NULL;
+	camif_lite_node->stop  = NULL;
+	camif_lite_node->process_cmd = NULL;
+	camif_lite_node->top_half_handler = NULL;
+	camif_lite_node->bottom_half_handler = NULL;
+
+	camif_lite_node->res_priv = NULL;
+
+	kfree(camif_lite_priv);
+
+	return 0;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.h
@@ -0,0 +1,67 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CAMIF_LITE_VER3_H_
+#define _CAM_VFE_CAMIF_LITE_VER3_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+#define CAM_VFE_RDI_VER2_MAX 4
+#define CAM_VFE_CAMIF_LITE_EVT_MAX 256
+
+struct cam_vfe_camif_lite_ver3_reg {
+	uint32_t     lite_hw_version;
+	uint32_t     lite_hw_status;
+	uint32_t     lite_module_config;
+	uint32_t     lite_skip_period;
+	uint32_t     lite_irq_subsample_pattern;
+	uint32_t     lite_epoch_irq;
+	uint32_t     lite_debug_1;
+	uint32_t     lite_debug_0;
+	uint32_t     lite_test_bus_ctrl;
+	uint32_t     camif_lite_spare;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_vfe_camif_lite_ver3_reg_data {
+	uint32_t     extern_reg_update_shift;
+	uint32_t     operating_mode_shift;
+	uint32_t     input_mux_sel_shift;
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     epoch1_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask2;
+	uint32_t     subscribe_irq_mask1;
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     top_debug_cfg_en;
+};
+
+struct cam_vfe_camif_lite_ver3_hw_info {
+	struct cam_vfe_top_ver3_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_lite_ver3_reg          *camif_lite_reg;
+	struct cam_vfe_camif_lite_ver3_reg_data     *reg_data;
+};
+
+int cam_vfe_camif_lite_ver3_acquire_resource(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *acquire_param);
+
+int cam_vfe_camif_lite_ver3_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_lite_hw_info,
+	struct cam_isp_resource_node  *camif_lite_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_camif_lite_ver3_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_CAMIF_LITE_VER3_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
@@ -0,0 +1,997 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_camif_ver2.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_cpas_api.h"
+
+#define CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX 2
+
+struct cam_vfe_mux_camif_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_camif_ver2_reg               *camif_reg;
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_reg_data               *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+
+	cam_hw_mgr_event_cb_func             event_cb;
+	void                                *priv;
+	int                                  irq_err_handle;
+	int                                  irq_handle;
+	void                                *vfe_irq_controller;
+	struct cam_vfe_top_irq_evt_payload evt_payload[CAM_VFE_CAMIF_EVT_MAX];
+	struct list_head                     free_payload_list;
+	spinlock_t                           spin_lock;
+
+	enum cam_isp_hw_sync_mode          sync_mode;
+	uint32_t                           dsp_mode;
+	uint32_t                           pix_pattern;
+	uint32_t                           first_pixel;
+	uint32_t                           first_line;
+	uint32_t                           last_pixel;
+	uint32_t                           last_line;
+	uint32_t                           hbi_value;
+	uint32_t                           vbi_value;
+	bool                               enable_sof_irq_debug;
+	uint32_t                           irq_debug_cnt;
+	uint32_t                           camif_debug;
+	uint32_t                           dual_hw_idx;
+	uint32_t                           is_dual;
+	struct timespec64                  sof_ts;
+	struct timespec64                  epoch_ts;
+	struct timespec64                  eof_ts;
+	struct timespec64                  error_ts;
+};
+
+static int cam_vfe_camif_get_evt_payload(
+	struct cam_vfe_mux_camif_data            *camif_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&camif_priv->spin_lock);
+	if (list_empty(&camif_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&camif_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+done:
+	spin_unlock(&camif_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_camif_put_evt_payload(
+	struct cam_vfe_mux_camif_data            *camif_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!camif_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&camif_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list, &camif_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&camif_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_camif_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_node;
+	struct cam_vfe_mux_camif_data         *camif_priv;
+	struct cam_vfe_top_irq_evt_payload  *evt_payload;
+	bool                                   error_flag = false;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x, IRQ status_1 = %x",
+		th_payload->evt_status_arr[0], th_payload->evt_status_arr[1]);
+
+	camif_node = th_payload->handler_priv;
+	camif_priv = camif_node->res_priv;
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[1] || (th_payload->evt_status_arr[0] &
+		camif_priv->reg_data->error_irq_mask0)) {
+		CAM_ERR(CAM_ISP,
+			"Camif Error: vfe:%d: IRQ STATUS_0=0x%x STATUS_1=0x%x",
+			camif_node->hw_intf->hw_idx,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from vfe=%d",
+			camif_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_all(
+			camif_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_camif_get_evt_payload(camif_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ STATUS_0=0x%x STATUS_1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		camif_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		camif_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->violation_status);
+
+	if (error_flag)
+		CAM_INFO(CAM_ISP, "Violation status = 0x%x",
+			evt_payload->irq_reg_val[2]);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_vfe_camif_validate_pix_pattern(uint32_t pattern)
+{
+	int rc;
+
+	switch (pattern) {
+	case CAM_ISP_PATTERN_BAYER_RGRGRG:
+	case CAM_ISP_PATTERN_BAYER_GRGRGR:
+	case CAM_ISP_PATTERN_BAYER_BGBGBG:
+	case CAM_ISP_PATTERN_BAYER_GBGBGB:
+	case CAM_ISP_PATTERN_YUV_YCBYCR:
+	case CAM_ISP_PATTERN_YUV_YCRYCB:
+	case CAM_ISP_PATTERN_YUV_CBYCRY:
+	case CAM_ISP_PATTERN_YUV_CRYCBY:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error! Invalid pix pattern:%d", pattern);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int cam_vfe_camif_get_reg_update(
+	struct cam_isp_resource_node  *camif_res,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_vfe_mux_camif_data    *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	rsrc_data = camif_res->res_priv;
+	reg_val_pair[0] = rsrc_data->camif_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "CAMIF reg_update_cmd %x offset %x",
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_camif_ver2_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_camif_data    *camif_data;
+	struct cam_vfe_acquire_args      *acquire_data;
+
+	int rc = 0;
+
+	camif_data   = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args   *)acquire_param;
+
+	rc = cam_vfe_camif_validate_pix_pattern(
+			acquire_data->vfe_in.in_port->test_pattern);
+	if (rc)
+		return rc;
+
+	camif_data->sync_mode   = acquire_data->vfe_in.sync_mode;
+	camif_data->pix_pattern = acquire_data->vfe_in.in_port->test_pattern;
+	camif_data->dsp_mode    = acquire_data->vfe_in.in_port->dsp_mode;
+	camif_data->first_pixel = acquire_data->vfe_in.in_port->left_start;
+	camif_data->last_pixel  = acquire_data->vfe_in.in_port->left_stop;
+	camif_data->first_line  = acquire_data->vfe_in.in_port->line_start;
+	camif_data->last_line   = acquire_data->vfe_in.in_port->line_stop;
+	camif_data->event_cb    = acquire_data->event_cb;
+	camif_data->priv        = acquire_data->priv;
+	camif_data->is_dual     = acquire_data->vfe_in.is_dual;
+	camif_data->hbi_value   = 0;
+	camif_data->vbi_value   = 0;
+
+	if (acquire_data->vfe_in.is_dual)
+		camif_data->dual_hw_idx =
+			acquire_data->vfe_in.dual_hw_idx;
+
+	CAM_DBG(CAM_ISP, "hw id:%d pix_pattern:%d dsp_mode=%d",
+		camif_res->hw_intf->hw_idx,
+		camif_data->pix_pattern, camif_data->dsp_mode);
+	return rc;
+}
+
+static int cam_vfe_camif_resource_init(
+	struct cam_isp_resource_node        *camif_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_camif_data    *camif_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_data   = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+
+	soc_info = camif_data->soc_info;
+
+	if ((camif_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_enable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to enable dsp clk");
+	}
+	camif_data->sof_ts.tv_sec = 0;
+	camif_data->sof_ts.tv_nsec = 0;
+	camif_data->epoch_ts.tv_sec = 0;
+	camif_data->epoch_ts.tv_nsec = 0;
+	camif_data->eof_ts.tv_sec = 0;
+	camif_data->eof_ts.tv_nsec = 0;
+	camif_data->error_ts.tv_sec = 0;
+	camif_data->error_ts.tv_nsec = 0;
+
+	return rc;
+}
+
+static int cam_vfe_camif_resource_deinit(
+	struct cam_isp_resource_node        *camif_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_camif_data    *camif_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_data   = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+
+	soc_info = camif_data->soc_info;
+
+	if ((camif_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_disable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to disable dsp clk");
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_resource_start(
+	struct cam_isp_resource_node   *camif_res)
+{
+	struct cam_vfe_mux_camif_data  *rsrc_data;
+	uint32_t                        val = 0;
+	uint32_t                        epoch0_irq_mask;
+	uint32_t                        epoch1_irq_mask;
+	uint32_t                        computed_epoch_line_cfg;
+	uint32_t                        err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                        irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                        dual_vfe_sync_val;
+	struct cam_vfe_soc_private     *soc_private;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Invalid camif res res_state:%d",
+			camif_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_vfe_mux_camif_data  *)camif_res->res_priv;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->error_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->error_irq_mask1;
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->subscribe_irq_mask0;
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->subscribe_irq_mask1;
+
+	soc_private = rsrc_data->soc_info->soc_private;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+
+	/*config vfe core*/
+	val = (rsrc_data->pix_pattern <<
+			rsrc_data->reg_data->pixel_pattern_shift);
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	if ((rsrc_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(rsrc_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		/* DSP mode reg val is CAM_ISP_DSP_MODE - 1 */
+		val |= (((rsrc_data->dsp_mode - 1) &
+			rsrc_data->reg_data->dsp_mode_mask) <<
+			rsrc_data->reg_data->dsp_mode_shift);
+		val |= (0x1 << rsrc_data->reg_data->dsp_en_shift);
+	}
+
+	cam_io_w_mb(val, rsrc_data->mem_base + rsrc_data->common_reg->core_cfg);
+
+	CAM_DBG(CAM_ISP, "hw id:%d core_cfg val:%d", camif_res->hw_intf->hw_idx,
+		val);
+
+	/* disable the CGC for stats */
+	cam_io_w_mb(0xFFFFFFFF, rsrc_data->mem_base +
+		rsrc_data->common_reg->module_ctrl[
+		CAM_VFE_TOP_VER2_MODULE_STATS]->cgc_ovd);
+
+	/* epoch config */
+	switch (soc_private->cpas_version) {
+	case CAM_CPAS_TITAN_170_V100:
+	case CAM_CPAS_TITAN_170_V110:
+	case CAM_CPAS_TITAN_170_V120:
+	case CAM_CPAS_TITAN_170_V200:
+		cam_io_w_mb(rsrc_data->reg_data->epoch_line_cfg,
+				rsrc_data->mem_base +
+				rsrc_data->camif_reg->epoch_irq);
+		break;
+	default:
+		epoch0_irq_mask = (((rsrc_data->last_line +
+				rsrc_data->vbi_value) -
+				rsrc_data->first_line) / 2);
+		if ((epoch0_irq_mask) >
+			(rsrc_data->last_line - rsrc_data->first_line))
+			epoch0_irq_mask = rsrc_data->last_line -
+				rsrc_data->first_line;
+
+		epoch1_irq_mask = rsrc_data->reg_data->epoch_line_cfg &
+				0xFFFF;
+		computed_epoch_line_cfg = (epoch0_irq_mask << 16) |
+				epoch1_irq_mask;
+		cam_io_w_mb(computed_epoch_line_cfg,
+				rsrc_data->mem_base +
+				rsrc_data->camif_reg->epoch_irq);
+		CAM_DBG(CAM_ISP, "first_line: %u\n"
+				"last_line: %u vbi: %u\n"
+				"epoch_line_cfg: 0x%x",
+				rsrc_data->first_line,
+				rsrc_data->last_line,
+				rsrc_data->vbi_value,
+				computed_epoch_line_cfg);
+		break;
+	}
+
+	if (rsrc_data->is_dual && rsrc_data->reg_data->dual_vfe_sync_mask) {
+		dual_vfe_sync_val = (rsrc_data->dual_hw_idx &
+			rsrc_data->reg_data->dual_vfe_sync_mask) + 1;
+		cam_io_w_mb(dual_vfe_sync_val, rsrc_data->mem_base +
+			rsrc_data->camif_reg->dual_vfe_sync);
+	}
+	camif_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base + rsrc_data->camif_reg->reg_update_cmd);
+	CAM_DBG(CAM_ISP, "hw id:%d RUP val:%d", camif_res->hw_intf->hw_idx,
+		rsrc_data->reg_data->reg_update_cmd_data);
+
+	/* disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
+	if (rsrc_data->camif_debug &
+		CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		val = cam_io_r_mb(rsrc_data->mem_base +
+			rsrc_data->camif_reg->vfe_diag_config);
+		val |= rsrc_data->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, rsrc_data->mem_base +
+			rsrc_data->camif_reg->vfe_diag_config);
+	}
+
+	if ((rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) &&
+		rsrc_data->is_dual)
+		goto subscribe_err;
+
+	if (!rsrc_data->irq_handle) {
+		rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			irq_mask,
+			camif_res,
+			camif_res->top_half_handler,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+		if (rsrc_data->irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rsrc_data->irq_handle = 0;
+		}
+	}
+
+subscribe_err:
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			camif_res,
+			cam_vfe_camif_err_irq_top_half,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Start Camif IFE %d Done", camif_res->hw_intf->hw_idx);
+	return 0;
+}
+
+static int cam_vfe_camif_reg_dump(
+	struct cam_isp_resource_node *camif_res)
+{
+	struct cam_vfe_mux_camif_data *camif_priv;
+	struct cam_vfe_soc_private *soc_private;
+	uint32_t offset, val, wm_idx;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_priv = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+	for (offset = 0x0; offset < 0x1160; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%x value 0x%x", offset, val);
+	}
+
+	for (offset = 0x2000; offset <= 0x20B8; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%x value 0x%x", offset, val);
+	}
+
+	for (wm_idx = 0; wm_idx <= 23; wm_idx++) {
+		for (offset = 0x2200 + 0x100 * wm_idx;
+			offset < 0x2278 + 0x100 * wm_idx; offset += 0x4) {
+			val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+			CAM_INFO(CAM_ISP,
+				"offset 0x%x value 0x%x", offset, val);
+		}
+	}
+
+	soc_private = camif_priv->soc_info->soc_private;
+	cam_cpas_dump_camnoc_buff_fill_info(soc_private->cpas_handle);
+
+	return 0;
+}
+
+static int cam_vfe_camif_resource_stop(
+	struct cam_isp_resource_node        *camif_res)
+{
+	struct cam_vfe_mux_camif_data       *camif_priv;
+	int rc = 0;
+	uint32_t val = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	camif_priv = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+
+	if ((camif_priv->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_priv->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		val = cam_io_r_mb(camif_priv->mem_base +
+				camif_priv->common_reg->core_cfg);
+		val &= (~(1 << camif_priv->reg_data->dsp_en_shift));
+		cam_io_w_mb(val, camif_priv->mem_base +
+			camif_priv->common_reg->core_cfg);
+	}
+
+	if (camif_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		camif_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	val = cam_io_r_mb(camif_priv->mem_base +
+			camif_priv->camif_reg->vfe_diag_config);
+	if (val & camif_priv->reg_data->enable_diagnostic_hw) {
+		val &= ~camif_priv->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, camif_priv->mem_base +
+			camif_priv->camif_reg->vfe_diag_config);
+	}
+
+	if (camif_priv->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller, camif_priv->irq_handle);
+		camif_priv->irq_handle = 0;
+	}
+
+	if (camif_priv->irq_err_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller,
+			camif_priv->irq_err_handle);
+		camif_priv->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_sof_irq_debug(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_data *camif_priv;
+	uint32_t *enable_sof_irq = (uint32_t *)cmd_args;
+
+	camif_priv =
+		(struct cam_vfe_mux_camif_data *)rsrc_node->res_priv;
+
+	if (*enable_sof_irq == 1)
+		camif_priv->enable_sof_irq_debug = true;
+	else
+		camif_priv->enable_sof_irq_debug = false;
+
+	return 0;
+}
+
+int cam_vfe_camif_dump_timestamps(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_data *camif_priv =
+		(struct cam_vfe_mux_camif_data *)rsrc_node->res_priv;
+
+	CAM_INFO(CAM_ISP,
+		"CAMIF ERROR timestamp:[%lld.%09lld] SOF timestamp:[%lld.%09lld] EPOCH timestamp:[%lld.%09lld] EOF timestamp:[%lld.%09lld]",
+		camif_priv->error_ts.tv_sec,
+		camif_priv->error_ts.tv_nsec,
+		camif_priv->sof_ts.tv_sec,
+		camif_priv->sof_ts.tv_nsec,
+		camif_priv->epoch_ts.tv_sec,
+		camif_priv->epoch_ts.tv_nsec,
+		camif_priv->eof_ts.tv_sec,
+		camif_priv->eof_ts.tv_nsec);
+
+	return 0;
+}
+
+static int cam_vfe_camif_blanking_update(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_data *camif_priv =
+		(struct cam_vfe_mux_camif_data *)rsrc_node->res_priv;
+
+	struct cam_isp_blanking_config  *blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+
+	camif_priv->hbi_value = blanking_config->hbi;
+	camif_priv->vbi_value = blanking_config->vbi;
+
+	CAM_DBG(CAM_ISP, "hbi:%d vbi:%d",
+		camif_priv->hbi_value, camif_priv->vbi_value);
+	return 0;
+}
+
+static int cam_vfe_camif_process_cmd(struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_mux_camif_data *camif_priv = NULL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_camif_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SOF_IRQ_DEBUG:
+		rc = cam_vfe_camif_sof_irq_debug(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		camif_priv =
+			(struct cam_vfe_mux_camif_data *)rsrc_node->res_priv;
+		camif_priv->camif_debug = *((uint32_t *)cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+		rc = cam_vfe_camif_dump_timestamps(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_camif_blanking_update(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA:
+		camif_priv = (struct cam_vfe_mux_camif_data *)
+			rsrc_node->res_priv;
+		*((struct cam_hw_soc_info **)cmd_args) = camif_priv->soc_info;
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_node;
+	struct cam_vfe_mux_camif_data         *camif_priv;
+	struct cam_vfe_top_irq_evt_payload  *evt_payload;
+
+	camif_node = th_payload->handler_priv;
+	camif_priv = camif_node->res_priv;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x", th_payload->evt_status_arr[0]);
+	CAM_DBG(CAM_ISP, "IRQ status_1 = %x", th_payload->evt_status_arr[1]);
+
+	rc  = cam_vfe_camif_get_evt_payload(camif_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ status0=0x%x status1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_camif_handle_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int                                   ret = CAM_VFE_IRQ_STATUS_MAX;
+	struct cam_isp_resource_node         *camif_node;
+	struct cam_vfe_mux_camif_data        *camif_priv;
+	struct cam_vfe_top_irq_evt_payload *payload;
+	struct cam_isp_hw_event_info          evt_info;
+	struct cam_hw_soc_info               *soc_info = NULL;
+	struct cam_vfe_soc_private           *soc_private = NULL;
+	uint32_t                              irq_status0;
+	uint32_t                              irq_status1;
+	uint32_t                              val;
+	struct cam_isp_hw_error_event_info    err_evt_info;
+	struct timespec64                     ts;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	camif_node = handler_priv;
+	camif_priv = camif_node->res_priv;
+	payload = evt_payload_priv;
+	irq_status0 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	irq_status1 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1];
+
+	soc_info = camif_priv->soc_info;
+	soc_private = (struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	evt_info.hw_type  = CAM_ISP_HW_TYPE_VFE;
+	evt_info.hw_idx   = camif_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_node->res_id;
+	evt_info.res_type = camif_node->res_type;
+
+	CAM_DBG(CAM_ISP, "irq_status_0 = 0x%x irq_status_1 = 0x%x",
+		irq_status0, irq_status1);
+
+	if (irq_status0 & camif_priv->reg_data->eof_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received EOF");
+		camif_priv->eof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_priv->eof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_priv->reg_data->sof_irq_mask) {
+		if ((camif_priv->enable_sof_irq_debug) &&
+			(camif_priv->irq_debug_cnt <=
+			CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "Received SOF");
+
+			camif_priv->irq_debug_cnt++;
+			if (camif_priv->irq_debug_cnt ==
+				CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+				camif_priv->enable_sof_irq_debug =
+					false;
+				camif_priv->irq_debug_cnt = 0;
+			}
+		} else {
+			CAM_DBG(CAM_ISP, "Received SOF");
+			camif_priv->sof_ts.tv_sec =
+				payload->ts.mono_time.tv_sec;
+			camif_priv->sof_ts.tv_nsec =
+				payload->ts.mono_time.tv_nsec;
+		}
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_priv->reg_data->reg_update_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received REG_UPDATE_ACK");
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_priv->reg_data->epoch0_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received EPOCH");
+		camif_priv->epoch_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_priv->epoch_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_priv->reg_data->error_irq_mask0) {
+		CAM_DBG(CAM_ISP, "Received ERROR");
+
+		err_evt_info.err_type = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		evt_info.event_data = (void *)&err_evt_info;
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic timestamp:[%lld.%09lld]",
+			ts.tv_sec, ts.tv_nsec);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		CAM_INFO(CAM_ISP, "Violation status = %x",
+			payload->irq_reg_val[2]);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_cpas_log_votes(false);
+
+		if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_reg_dump(camif_node->res_priv);
+	}
+
+	if (irq_status1 & camif_priv->reg_data->error_irq_mask1) {
+		CAM_DBG(CAM_ISP, "Received ERROR");
+
+		err_evt_info.err_type = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		evt_info.event_data = (void *)&err_evt_info;
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic timestamp:[%lld.%09lld]",
+			ts.tv_sec, ts.tv_nsec);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		CAM_INFO(CAM_ISP, "Violation status = %x",
+			payload->irq_reg_val[2]);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_cpas_log_votes(false);
+
+		if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_reg_dump(camif_node->res_priv);
+	}
+
+	if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		val = cam_io_r(camif_priv->mem_base +
+			camif_priv->camif_reg->vfe_diag_sensor_status);
+		CAM_DBG(CAM_ISP, "VFE_DIAG_SENSOR_STATUS: 0x%x",
+			camif_priv->mem_base, val);
+	}
+
+	cam_vfe_camif_put_evt_payload(camif_priv, &payload);
+
+	CAM_DBG(CAM_ISP, "returning status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_camif_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_camif_data     *camif_priv = NULL;
+	struct cam_vfe_camif_ver2_hw_info *camif_info = camif_hw_info;
+	int                                i = 0;
+
+	camif_priv = kzalloc(sizeof(struct cam_vfe_mux_camif_data),
+		GFP_KERNEL);
+	if (!camif_priv) {
+		CAM_DBG(CAM_ISP, "Error! Failed to alloc for camif_priv");
+		return -ENOMEM;
+	}
+
+	camif_node->res_priv = camif_priv;
+
+	camif_priv->mem_base    = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	camif_priv->camif_reg   = camif_info->camif_reg;
+	camif_priv->common_reg  = camif_info->common_reg;
+	camif_priv->reg_data    = camif_info->reg_data;
+	camif_priv->hw_intf     = hw_intf;
+	camif_priv->soc_info    = soc_info;
+	camif_priv->vfe_irq_controller = vfe_irq_controller;
+
+	camif_node->init    = cam_vfe_camif_resource_init;
+	camif_node->deinit  = cam_vfe_camif_resource_deinit;
+	camif_node->start   = cam_vfe_camif_resource_start;
+	camif_node->stop    = cam_vfe_camif_resource_stop;
+	camif_node->process_cmd = cam_vfe_camif_process_cmd;
+	camif_node->top_half_handler = cam_vfe_camif_handle_irq_top_half;
+	camif_node->bottom_half_handler = cam_vfe_camif_handle_irq_bottom_half;
+
+	spin_lock_init(&camif_priv->spin_lock);
+	INIT_LIST_HEAD(&camif_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&camif_priv->evt_payload[i].list);
+		list_add_tail(&camif_priv->evt_payload[i].list,
+			&camif_priv->free_payload_list);
+	}
+
+	return 0;
+}
+
+int cam_vfe_camif_ver2_deinit(
+	struct cam_isp_resource_node  *camif_node)
+{
+	struct cam_vfe_mux_camif_data *camif_priv = camif_node->res_priv;
+	int                            i = 0;
+
+	if (!camif_priv) {
+		CAM_ERR(CAM_ISP, "Error! camif_priv is NULL");
+		return -ENODEV;
+	}
+
+	INIT_LIST_HEAD(&camif_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++)
+		INIT_LIST_HEAD(&camif_priv->evt_payload[i].list);
+
+	camif_node->start = NULL;
+	camif_node->stop  = NULL;
+	camif_node->process_cmd = NULL;
+	camif_node->top_half_handler = NULL;
+	camif_node->bottom_half_handler = NULL;
+
+	camif_node->res_priv = NULL;
+
+
+	kfree(camif_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.h
@@ -0,0 +1,89 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CAMIF_VER2_H_
+#define _CAM_VFE_CAMIF_VER2_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+struct cam_vfe_camif_ver2_reg {
+	uint32_t     camif_cmd;
+	uint32_t     camif_config;
+	uint32_t     line_skip_pattern;
+	uint32_t     pixel_skip_pattern;
+	uint32_t     skip_period;
+	uint32_t     irq_subsample_pattern;
+	uint32_t     epoch_irq;
+	uint32_t     raw_crop_width_cfg;
+	uint32_t     raw_crop_height_cfg;
+	uint32_t     reg_update_cmd;
+	uint32_t     vfe_diag_config;
+	uint32_t     vfe_diag_sensor_status;
+	uint32_t     dual_vfe_sync;
+};
+
+struct cam_vfe_camif_reg_data {
+	uint32_t     raw_crop_first_pixel_shift;
+	uint32_t     raw_crop_first_pixel_mask;
+
+	uint32_t     raw_crop_last_pixel_shift;
+	uint32_t     raw_crop_last_pixel_mask;
+
+	uint32_t     raw_crop_first_line_shift;
+	uint32_t     raw_crop_first_line_mask;
+
+	uint32_t     raw_crop_last_line_shift;
+	uint32_t     raw_crop_last_line_mask;
+
+	uint32_t     input_mux_sel_shift;
+	uint32_t     input_mux_sel_mask;
+	uint32_t     extern_reg_update_shift;
+	uint32_t     extern_reg_update_mask;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+
+	uint32_t     dsp_mode_shift;
+	uint32_t     dsp_mode_mask;
+	uint32_t     dsp_en_shift;
+	uint32_t     dsp_en_mask;
+
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     reg_update_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask1;
+	uint32_t     subscribe_irq_mask0;
+	uint32_t     subscribe_irq_mask1;
+
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     dual_vfe_sync_mask;
+};
+
+struct cam_vfe_camif_ver2_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_ver2_reg               *camif_reg;
+	struct cam_vfe_camif_reg_data               *reg_data;
+};
+
+int cam_vfe_camif_ver2_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param);
+
+int cam_vfe_camif_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_camif_ver2_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_CAMIF_VER2_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.c
@@ -0,0 +1,1605 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_camif_ver3.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_cpas_api.h"
+#include "cam_trace.h"
+
+#define CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX 2
+
+struct cam_vfe_mux_camif_ver3_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_camif_ver3_pp_clc_reg        *camif_reg;
+	struct cam_vfe_top_ver3_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_ver3_reg_data          *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+	struct cam_vfe_camif_common_cfg             cam_common_cfg;
+
+	cam_hw_mgr_event_cb_func             event_cb;
+	void                                *priv;
+	int                                  irq_err_handle;
+	int                                  irq_handle;
+	int                                  sof_irq_handle;
+	void                                *vfe_irq_controller;
+	struct cam_vfe_top_irq_evt_payload   evt_payload[CAM_VFE_CAMIF_EVT_MAX];
+	struct list_head                     free_payload_list;
+	spinlock_t                           spin_lock;
+
+	enum cam_isp_hw_sync_mode          sync_mode;
+	uint32_t                           dsp_mode;
+	uint32_t                           pix_pattern;
+	uint32_t                           first_pixel;
+	uint32_t                           first_line;
+	uint32_t                           last_pixel;
+	uint32_t                           last_line;
+	uint32_t                           hbi_value;
+	uint32_t                           vbi_value;
+	bool                               enable_sof_irq_debug;
+	uint32_t                           irq_debug_cnt;
+	uint32_t                           camif_debug;
+	uint32_t                           horizontal_bin;
+	uint32_t                           qcfa_bin;
+	uint32_t                           dual_hw_idx;
+	uint32_t                           is_dual;
+	bool                               is_fe_enabled;
+	bool                               is_offline;
+	struct timespec64                  sof_ts;
+	struct timespec64                  epoch_ts;
+	struct timespec64                  eof_ts;
+	struct timespec64                  error_ts;
+};
+
+static int cam_vfe_camif_ver3_get_evt_payload(
+	struct cam_vfe_mux_camif_ver3_data     *camif_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&camif_priv->spin_lock);
+	if (list_empty(&camif_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free CAMIF event payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&camif_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+done:
+	spin_unlock(&camif_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_put_evt_payload(
+	struct cam_vfe_mux_camif_ver3_data     *camif_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!camif_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&camif_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list, &camif_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&camif_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_node;
+	struct cam_vfe_mux_camif_ver3_data    *camif_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	bool                                   error_flag = false;
+
+	camif_node = th_payload->handler_priv;
+	camif_priv = camif_node->res_priv;
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[2] || (th_payload->evt_status_arr[0] &
+		camif_priv->reg_data->error_irq_mask0)) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d CAMIF Err IRQ status_0: 0x%X status_2: 0x%X",
+			camif_node->hw_intf->hw_idx,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[2]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from VFE:%d",
+			camif_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_all(
+			camif_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_camif_ver3_get_evt_payload(camif_priv, &evt_payload);
+	if (rc)
+		return rc;
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		camif_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		camif_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->violation_status);
+
+	evt_payload->irq_reg_val[++i] = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->bus_overflow_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_validate_pix_pattern(uint32_t pattern,
+	struct cam_vfe_mux_camif_ver3_data *camif_data)
+{
+	int rc;
+
+	switch (pattern) {
+	case CAM_ISP_PATTERN_BAYER_RGRGRG:
+	case CAM_ISP_PATTERN_BAYER_GRGRGR:
+	case CAM_ISP_PATTERN_BAYER_BGBGBG:
+	case CAM_ISP_PATTERN_BAYER_GBGBGB:
+		camif_data->cam_common_cfg.input_pp_fmt =
+			camif_data->reg_data->input_bayer_fmt;
+		rc = 0;
+		break;
+	case CAM_ISP_PATTERN_YUV_YCBYCR:
+	case CAM_ISP_PATTERN_YUV_YCRYCB:
+	case CAM_ISP_PATTERN_YUV_CBYCRY:
+	case CAM_ISP_PATTERN_YUV_CRYCBY:
+		rc = 0;
+		camif_data->cam_common_cfg.input_pp_fmt =
+			camif_data->reg_data->input_yuv_fmt;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error, Invalid pix pattern:%d", pattern);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_get_reg_update(
+	struct cam_isp_resource_node  *camif_res,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                           size = 0;
+	uint32_t                           reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update   *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops           *cdm_util_ops = NULL;
+	struct cam_vfe_mux_camif_ver3_data *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid arg size: %d expected:%ld",
+			arg_size, sizeof(struct cam_isp_hw_get_cmd_update));
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args: %pK", cdm_args);
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, (size*4));
+		return -EINVAL;
+	}
+
+	rsrc_data = camif_res->res_priv;
+	reg_val_pair[0] = rsrc_data->camif_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF reg_update_cmd 0x%X offset 0x%X",
+		camif_res->hw_intf->hw_idx,
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_camif_ver3_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_camif_ver3_data    *camif_data;
+	struct cam_vfe_acquire_args           *acquire_data;
+	int                                    rc = 0;
+
+	camif_data  = (struct cam_vfe_mux_camif_ver3_data *)
+		camif_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	rc = cam_vfe_camif_ver3_validate_pix_pattern(
+		acquire_data->vfe_in.in_port->test_pattern, camif_data);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Validate pix pattern failed, rc = %d", rc);
+		return rc;
+	}
+
+	camif_data->sync_mode      = acquire_data->vfe_in.sync_mode;
+	camif_data->pix_pattern    = acquire_data->vfe_in.in_port->test_pattern;
+	camif_data->dsp_mode       = acquire_data->vfe_in.in_port->dsp_mode;
+	camif_data->first_pixel    = acquire_data->vfe_in.in_port->left_start;
+	camif_data->last_pixel     = acquire_data->vfe_in.in_port->left_stop;
+	camif_data->first_line     = acquire_data->vfe_in.in_port->line_start;
+	camif_data->last_line      = acquire_data->vfe_in.in_port->line_stop;
+	camif_data->is_fe_enabled  = acquire_data->vfe_in.is_fe_enabled;
+	camif_data->is_offline     = acquire_data->vfe_in.is_offline;
+	camif_data->is_dual        = acquire_data->vfe_in.is_dual;
+	camif_data->event_cb       = acquire_data->event_cb;
+	camif_data->priv           = acquire_data->priv;
+	camif_data->qcfa_bin       = acquire_data->vfe_in.in_port->qcfa_bin;
+	camif_data->horizontal_bin =
+		acquire_data->vfe_in.in_port->horizontal_bin;
+	camif_data->hbi_value      = 0;
+	camif_data->vbi_value      = 0;
+
+	if (camif_data->is_dual)
+		camif_data->dual_hw_idx = acquire_data->vfe_in.dual_hw_idx;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d CAMIF pix_pattern:%d dsp_mode=%d is_dual:%d dual_hw_idx:%d",
+		camif_res->hw_intf->hw_idx,
+		camif_data->pix_pattern, camif_data->dsp_mode,
+		camif_data->is_dual, camif_data->dual_hw_idx);
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_resource_init(
+	struct cam_isp_resource_node *camif_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_camif_ver3_data    *camif_data;
+	struct cam_hw_soc_info                *soc_info;
+	int                                    rc = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_data = (struct cam_vfe_mux_camif_ver3_data *)
+		camif_res->res_priv;
+
+	soc_info = camif_data->soc_info;
+
+	if ((camif_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_enable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"failed to enable dsp clk, rc = %d", rc);
+	}
+	camif_data->sof_ts.tv_sec = 0;
+	camif_data->sof_ts.tv_nsec = 0;
+	camif_data->epoch_ts.tv_sec = 0;
+	camif_data->epoch_ts.tv_nsec = 0;
+	camif_data->eof_ts.tv_sec = 0;
+	camif_data->eof_ts.tv_nsec = 0;
+	camif_data->error_ts.tv_sec = 0;
+	camif_data->error_ts.tv_nsec = 0;
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_resource_deinit(
+	struct cam_isp_resource_node        *camif_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_camif_ver3_data    *camif_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_data   = (struct cam_vfe_mux_camif_ver3_data *)
+		camif_res->res_priv;
+
+	soc_info = camif_data->soc_info;
+
+	if ((camif_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_disable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to disable dsp clk");
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_resource_start(
+	struct cam_isp_resource_node *camif_res)
+{
+	struct cam_vfe_mux_camif_ver3_data  *rsrc_data;
+	uint32_t                             val = 0;
+	uint32_t                             epoch0_line_cfg;
+	uint32_t                             epoch1_line_cfg;
+	uint32_t                             computed_epoch_line_cfg;
+	uint32_t                        err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                        irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	struct cam_vfe_soc_private          *soc_private;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error, Invalid camif res res_state:%d",
+			camif_res->res_state);
+		return -EINVAL;
+	}
+
+	memset(err_irq_mask, 0, sizeof(err_irq_mask));
+	memset(irq_mask, 0, sizeof(irq_mask));
+
+	rsrc_data = (struct cam_vfe_mux_camif_ver3_data *)camif_res->res_priv;
+
+	soc_private = rsrc_data->soc_info->soc_private;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error, soc_private NULL");
+		return -ENODEV;
+	}
+
+	/* config debug status registers */
+	val = cam_io_r(rsrc_data->mem_base + rsrc_data->common_reg->top_debug_cfg);
+	val |= rsrc_data->reg_data->top_debug_cfg_en;
+	cam_io_w_mb(val, rsrc_data->mem_base + rsrc_data->common_reg->top_debug_cfg);
+
+	val = cam_io_r_mb(rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	/* AF stitching by hw disabled by default
+	 * PP CAMIF currently operates only in offline mode
+	 */
+
+	if ((rsrc_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(rsrc_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		/* DSP mode reg val is CAM_ISP_DSP_MODE - 1 */
+		if (camif_res->hw_intf->hw_idx != CAM_ISP_HW_VFE_CORE_2) {
+			val |= (((rsrc_data->dsp_mode - 1) &
+				rsrc_data->reg_data->dsp_mode_mask) <<
+				rsrc_data->reg_data->dsp_mode_shift);
+			val |= (0x1 << rsrc_data->reg_data->dsp_en_shift);
+		} else {
+			CAM_ERR(CAM_ISP, "Error, HVX not available for IFE_%d",
+				camif_res->hw_intf->hw_idx);
+			return -EINVAL;
+		}
+	}
+
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->pp_extern_reg_update_shift);
+
+	if ((rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) ||
+		(rsrc_data->sync_mode == CAM_ISP_HW_SYNC_MASTER))
+		val |= (1 << rsrc_data->reg_data->dual_ife_pix_en_shift);
+
+	val |= (~rsrc_data->cam_common_cfg.vid_ds16_r2pd & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_VID_DS16_R2PD;
+	val |= (~rsrc_data->cam_common_cfg.vid_ds4_r2pd & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_VID_DS4_R2PD;
+	val |= (~rsrc_data->cam_common_cfg.disp_ds16_r2pd & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_DISP_DS16_R2PD;
+	val |= (~rsrc_data->cam_common_cfg.disp_ds4_r2pd & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_DISP_DS4_R2PD;
+	val |= (rsrc_data->cam_common_cfg.dsp_streaming_tap_point & 0x3) <<
+		CAM_SHIFT_TOP_CORE_CFG_DSP_STREAMING;
+	val |= (rsrc_data->cam_common_cfg.ihist_src_sel & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_STATS_IHIST;
+	val |= (rsrc_data->cam_common_cfg.hdr_be_src_sel & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_STATS_HDR_BE;
+	val |= (rsrc_data->cam_common_cfg.hdr_bhist_src_sel & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_STATS_HDR_BHIST;
+	val |= (rsrc_data->cam_common_cfg.input_mux_sel_pp & 0x3) <<
+		CAM_SHIFT_TOP_CORE_CFG_INPUTMUX_PP;
+	val |= (rsrc_data->cam_common_cfg.input_pp_fmt & 0x3) <<
+		CAM_SHIFT_TOP_CORE_CFG_INPUT_PP_FMT;
+
+	if (rsrc_data->is_fe_enabled && !rsrc_data->is_offline)
+		val |= 0x2 << rsrc_data->reg_data->operating_mode_shift;
+	else
+		val |= 0x1 << rsrc_data->reg_data->operating_mode_shift;
+
+	if (rsrc_data->is_dual && rsrc_data->reg_data->dual_vfe_sync_mask) {
+		val |= (((rsrc_data->dual_hw_idx &
+				rsrc_data->reg_data->dual_vfe_sync_mask) + 1) <<
+				rsrc_data->reg_data->dual_ife_sync_sel_shift);
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d TOP core_cfg: 0x%X",
+		camif_res->hw_intf->hw_idx, val);
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	/* epoch config */
+	switch (soc_private->cpas_version) {
+	case CAM_CPAS_TITAN_480_V100:
+	case CAM_CPAS_TITAN_580_V100:
+	case CAM_CPAS_TITAN_570_V100:
+	case CAM_CPAS_TITAN_570_V200:
+		epoch0_line_cfg = ((rsrc_data->last_line +
+			rsrc_data->vbi_value) -
+			rsrc_data->first_line) / 4;
+		if ((epoch0_line_cfg * 2) >
+			(rsrc_data->last_line - rsrc_data->first_line))
+			epoch0_line_cfg = (rsrc_data->last_line -
+				rsrc_data->first_line)/2;
+	/* epoch line cfg will still be configured at midpoint of the
+	 * frame width. We use '/ 4' instead of '/ 2'
+	 * cause it is multipixel path
+	 */
+		if (rsrc_data->horizontal_bin || rsrc_data->qcfa_bin)
+			epoch0_line_cfg >>= 1;
+
+		epoch1_line_cfg = rsrc_data->reg_data->epoch_line_cfg &
+			0xFFFF;
+		computed_epoch_line_cfg = (epoch1_line_cfg << 16) |
+			epoch0_line_cfg;
+		cam_io_w_mb(computed_epoch_line_cfg,
+			rsrc_data->mem_base +
+			rsrc_data->camif_reg->epoch_irq_cfg);
+		CAM_DBG(CAM_ISP, "epoch_line_cfg: 0x%X",
+			computed_epoch_line_cfg);
+		break;
+	default:
+			CAM_ERR(CAM_ISP, "Hardware version not proper: 0x%X",
+				soc_private->cpas_version);
+			return -EINVAL;
+		break;
+	}
+
+	camif_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base +
+		rsrc_data->camif_reg->reg_update_cmd);
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF RUP val:0x%X",
+		camif_res->hw_intf->hw_idx,
+		rsrc_data->reg_data->reg_update_cmd_data);
+
+	/* disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
+	if (rsrc_data->camif_debug &
+		CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		val = cam_io_r_mb(rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+		val |= rsrc_data->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+	}
+
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->error_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS2] =
+		rsrc_data->reg_data->error_irq_mask2;
+
+	if ((rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) &&
+		rsrc_data->is_dual)
+		goto subscribe_err;
+
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->epoch0_irq_mask |
+		rsrc_data->reg_data->eof_irq_mask;
+
+	if (!rsrc_data->irq_handle) {
+		rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_3,
+			irq_mask,
+			camif_res,
+			camif_res->top_half_handler,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (rsrc_data->irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rsrc_data->irq_handle = 0;
+		}
+	}
+
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->sof_irq_mask;
+	if (rsrc_data->cam_common_cfg.input_mux_sel_pp & 0x3)
+		irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+			rsrc_data->reg_data->frame_id_irq_mask;
+
+	if (!rsrc_data->sof_irq_handle) {
+		rsrc_data->sof_irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			irq_mask,
+			camif_res,
+			camif_res->top_half_handler,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (rsrc_data->sof_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "SOF IRQ handle subscribe failure");
+			rsrc_data->sof_irq_handle = 0;
+		}
+	}
+
+subscribe_err:
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			camif_res,
+			cam_vfe_camif_ver3_err_irq_top_half,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF Start Done", camif_res->hw_intf->hw_idx);
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_reg_dump(
+	struct cam_isp_resource_node *camif_res)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	uint32_t offset, val, wm_idx;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_priv = (struct cam_vfe_mux_camif_ver3_data *)camif_res->res_priv;
+
+	CAM_INFO(CAM_ISP, "IFE:%d TOP", camif_res->hw_intf->hw_idx);
+	for (offset = 0x0; offset <= 0x1FC; offset += 0x4) {
+		if (offset == 0x1C || offset == 0x34 ||
+			offset == 0x38 || offset == 0x90)
+			continue;
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d PP CLC PREPROCESS",
+		camif_res->hw_intf->hw_idx);
+	for (offset = 0x2200; offset <= 0x23FC; offset += 0x4) {
+		if (offset == 0x2208)
+			offset = 0x2260;
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+		if (offset == 0x2260)
+			offset = 0x23F4;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d PP CLC CAMIF", camif_res->hw_intf->hw_idx);
+	for (offset = 0x2600; offset <= 0x27FC; offset += 0x4) {
+		if (offset == 0x2608)
+			offset = 0x2660;
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+		if (offset == 0x2660)
+			offset = 0x2664;
+		else if (offset == 0x2680)
+			offset = 0x27EC;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d PP CLC Modules", camif_res->hw_intf->hw_idx);
+	for (offset = 0x2800; offset <= 0x8FFC; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d BUS RD", camif_res->hw_intf->hw_idx);
+	for (offset = 0xA800; offset <= 0xA89C; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+		if (offset == 0xA838)
+			offset = 0xA844;
+		if (offset == 0xA864)
+			offset = 0xA874;
+		if (offset == 0xA878)
+			offset = 0xA87C;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d BUS WR", camif_res->hw_intf->hw_idx);
+	for (offset = 0xAA00; offset <= 0xAADC; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_DBG(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	for (wm_idx = 0; wm_idx <= 25; wm_idx++) {
+		for (offset = 0xAC00 + 0x100 * wm_idx;
+			offset < 0xAC84 + 0x100 * wm_idx; offset += 0x4) {
+			val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+		}
+	}
+
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_resource_stop(
+	struct cam_isp_resource_node *camif_res)
+{
+	struct cam_vfe_mux_camif_ver3_data        *camif_priv;
+	int                                        rc = 0;
+	uint32_t                                   val = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_priv = (struct cam_vfe_mux_camif_ver3_data *)camif_res->res_priv;
+
+	if ((camif_priv->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_priv->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		val = cam_io_r_mb(camif_priv->mem_base +
+			camif_priv->common_reg->core_cfg_0);
+		val &= (~(1 << camif_priv->reg_data->dsp_en_shift));
+		cam_io_w_mb(val, camif_priv->mem_base +
+			camif_priv->common_reg->core_cfg_0);
+	}
+
+	if (camif_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		camif_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	val = cam_io_r_mb(camif_priv->mem_base +
+		camif_priv->common_reg->diag_config);
+	if (val & camif_priv->reg_data->enable_diagnostic_hw) {
+		val &= ~camif_priv->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, camif_priv->mem_base +
+			camif_priv->common_reg->diag_config);
+	}
+
+	if (camif_priv->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller, camif_priv->irq_handle);
+		camif_priv->irq_handle = 0;
+	}
+
+	if (camif_priv->sof_irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller,
+			camif_priv->sof_irq_handle);
+		camif_priv->sof_irq_handle = 0;
+	}
+
+	if (camif_priv->irq_err_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller,
+			camif_priv->irq_err_handle);
+		camif_priv->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_core_config(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	struct cam_vfe_core_config_args *vfe_core_cfg =
+		(struct cam_vfe_core_config_args *)cmd_args;
+
+	camif_priv =
+		(struct cam_vfe_mux_camif_ver3_data *)rsrc_node->res_priv;
+	camif_priv->cam_common_cfg.vid_ds16_r2pd =
+		vfe_core_cfg->core_config.vid_ds16_r2pd;
+	camif_priv->cam_common_cfg.vid_ds4_r2pd =
+		vfe_core_cfg->core_config.vid_ds4_r2pd;
+	camif_priv->cam_common_cfg.disp_ds16_r2pd =
+		vfe_core_cfg->core_config.disp_ds16_r2pd;
+	camif_priv->cam_common_cfg.disp_ds4_r2pd =
+		vfe_core_cfg->core_config.disp_ds4_r2pd;
+	camif_priv->cam_common_cfg.dsp_streaming_tap_point =
+		vfe_core_cfg->core_config.dsp_streaming_tap_point;
+	camif_priv->cam_common_cfg.ihist_src_sel =
+		vfe_core_cfg->core_config.ihist_src_sel;
+	camif_priv->cam_common_cfg.hdr_be_src_sel =
+		vfe_core_cfg->core_config.hdr_be_src_sel;
+	camif_priv->cam_common_cfg.hdr_bhist_src_sel =
+		vfe_core_cfg->core_config.hdr_bhist_src_sel;
+	camif_priv->cam_common_cfg.input_mux_sel_pdaf =
+		vfe_core_cfg->core_config.input_mux_sel_pdaf;
+	camif_priv->cam_common_cfg.input_mux_sel_pp =
+		vfe_core_cfg->core_config.input_mux_sel_pp;
+
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_sof_irq_debug(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	uint32_t *enable_sof_irq = (uint32_t *)cmd_args;
+
+	camif_priv =
+		(struct cam_vfe_mux_camif_ver3_data *)rsrc_node->res_priv;
+
+	if (*enable_sof_irq == 1)
+		camif_priv->enable_sof_irq_debug = true;
+	else
+		camif_priv->enable_sof_irq_debug = false;
+
+	return 0;
+}
+
+int cam_vfe_camif_ver3_dump_timestamps(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv =
+		(struct cam_vfe_mux_camif_ver3_data *)rsrc_node->res_priv;
+
+	CAM_INFO(CAM_ISP,
+		"CAMIF ERROR timestamp:[%lld.%09lld] SOF timestamp:[%lld.%09lld] EPOCH timestamp:[%lld.%09lld] EOF timestamp:[%lld.%09lld]",
+		camif_priv->error_ts.tv_sec,
+		camif_priv->error_ts.tv_nsec,
+		camif_priv->sof_ts.tv_sec,
+		camif_priv->sof_ts.tv_nsec,
+		camif_priv->epoch_ts.tv_sec,
+		camif_priv->epoch_ts.tv_nsec,
+		camif_priv->eof_ts.tv_sec,
+		camif_priv->eof_ts.tv_nsec);
+
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_blanking_update(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv =
+		(struct cam_vfe_mux_camif_ver3_data *)rsrc_node->res_priv;
+
+	struct cam_isp_blanking_config  *blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+
+	camif_priv->hbi_value = blanking_config->hbi;
+	camif_priv->vbi_value = blanking_config->vbi;
+
+	CAM_DBG(CAM_ISP, "hbi:%d vbi:%d",
+		camif_priv->hbi_value, camif_priv->vbi_value);
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_process_cmd(
+	struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_mux_camif_ver3_data *camif_priv = NULL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP,
+			"Invalid input arguments rsesource node:%pK cmd_args:%pK",
+			rsrc_node, cmd_args);
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_camif_ver3_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SOF_IRQ_DEBUG:
+		rc = cam_vfe_camif_ver3_sof_irq_debug(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = cam_vfe_camif_ver3_core_config(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		camif_priv = (struct cam_vfe_mux_camif_ver3_data *)
+			rsrc_node->res_priv;
+		camif_priv->camif_debug = *((uint32_t *)cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA:
+		camif_priv = (struct cam_vfe_mux_camif_ver3_data *)
+			rsrc_node->res_priv;
+		*((struct cam_hw_soc_info **)cmd_args) = camif_priv->soc_info;
+		rc = 0;
+		break;
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+		rc = cam_vfe_camif_ver3_dump_timestamps(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_camif_ver3_blanking_update(rsrc_node, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+
+static void cam_vfe_camif_ver3_overflow_debug_info(
+	struct cam_vfe_mux_camif_ver3_data *camif_priv)
+{
+	uint32_t val0, val1, val2, val3;
+
+	val0 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_0);
+	val1 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_1);
+	val2 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_2);
+	val3 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_3);
+	CAM_INFO(CAM_ISP,
+		"status_0: 0x%X status_1: 0x%X status_2: 0x%X status_3: 0x%X",
+		val0, val1, val2, val3);
+
+	val0 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_4);
+	val1 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_5);
+	val2 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_6);
+	val3 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_7);
+	CAM_INFO(CAM_ISP,
+		"status_4: 0x%X status_5: 0x%X status_6: 0x%X status_7: 0x%X",
+		val0, val1, val2, val3);
+
+	val0 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_8);
+	val1 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_9);
+	val2 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_10);
+	val3 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_11);
+	CAM_INFO(CAM_ISP,
+		"status_8: 0x%X status_9: 0x%X status_10: 0x%X status_11: 0x%X",
+		val0, val1, val2, val3);
+
+	val0 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_12);
+	val1 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_13);
+	CAM_INFO(CAM_ISP, "status_12: 0x%X status_13: 0x%X",
+		val0, val1);
+}
+
+static void cam_vfe_camif_ver3_print_status(uint32_t *status,
+	int err_type, struct cam_vfe_mux_camif_ver3_data *camif_priv)
+{
+	uint32_t violation_mask = 0x3F, module_id = 0;
+	uint32_t bus_overflow_status = 0, status_0 = 0, status_2 = 0;
+	struct cam_vfe_soc_private *soc_private;
+
+	if (!status) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return;
+	}
+
+	bus_overflow_status = status[CAM_IFE_IRQ_BUS_OVERFLOW_STATUS];
+	status_0 = status[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	status_2 = status[CAM_IFE_IRQ_CAMIF_REG_STATUS2];
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) {
+		if (status_0 & 0x0200)
+			CAM_INFO(CAM_ISP, "DSP OVERFLOW");
+
+		if (status_0 & 0x2000000)
+			CAM_INFO(CAM_ISP, "PIXEL PIPE FRAME DROP");
+
+		if (status_0 & 0x80000000)
+			CAM_INFO(CAM_ISP, "PIXEL PIPE OVERFLOW");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && bus_overflow_status) {
+		if (bus_overflow_status & 0x01)
+			CAM_INFO(CAM_ISP, "VID Y 1:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x02)
+			CAM_INFO(CAM_ISP, "VID C 1:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x04)
+			CAM_INFO(CAM_ISP, "VID YC 4:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x08)
+			CAM_INFO(CAM_ISP, "VID YC 16:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x010)
+			CAM_INFO(CAM_ISP, "DISP Y 1:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x020)
+			CAM_INFO(CAM_ISP, "DISP C 1:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x040)
+			CAM_INFO(CAM_ISP, "DISP YC 4:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x080)
+			CAM_INFO(CAM_ISP, "DISP YC 16:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0100)
+			CAM_INFO(CAM_ISP, "FD Y BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0200)
+			CAM_INFO(CAM_ISP, "FD C BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0400)
+			CAM_INFO(CAM_ISP, "PIXEL RAW DUMP BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x01000)
+			CAM_INFO(CAM_ISP, "STATS HDR BE BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x02000)
+			CAM_INFO(CAM_ISP, "STATS HDR BHIST BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x04000)
+			CAM_INFO(CAM_ISP, "STATS TINTLESS BG BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x08000)
+			CAM_INFO(CAM_ISP, "STATS AWB BG BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x010000)
+			CAM_INFO(CAM_ISP, "STATS BHIST BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x020000)
+			CAM_INFO(CAM_ISP, "STATS RS BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x040000)
+			CAM_INFO(CAM_ISP, "STATS CS BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x080000)
+			CAM_INFO(CAM_ISP, "STATS IHIST BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0100000)
+			CAM_INFO(CAM_ISP, "STATS BAF BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0200000)
+			CAM_INFO(CAM_ISP, "PDAF BUS OVERFLOW");
+		goto print_state;
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && !bus_overflow_status) {
+		CAM_INFO(CAM_ISP, "PIXEL PIPE Module hang");
+		/* print debug registers */
+		cam_vfe_camif_ver3_overflow_debug_info(camif_priv);
+		goto print_state;
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION) {
+		if (status_2 & 0x080)
+			CAM_INFO(CAM_ISP, "DSP IFE PROTOCOL VIOLATION");
+
+		if (status_2 & 0x0100)
+			CAM_INFO(CAM_ISP, "IFE DSP TX PROTOCOL VIOLATION");
+
+		if (status_2 & 0x0200)
+			CAM_INFO(CAM_ISP, "DSP IFE RX PROTOCOL VIOLATION");
+
+		if (status_2 & 0x0400)
+			CAM_INFO(CAM_ISP, "PP PREPROCESS VIOLATION");
+
+		if (status_2 & 0x0800)
+			CAM_INFO(CAM_ISP, "PP CAMIF VIOLATION");
+
+		if (status_2 & 0x01000)
+			CAM_INFO(CAM_ISP, "PP VIOLATION");
+
+		if (status_2 & 0x0100000)
+			CAM_INFO(CAM_ISP,
+				"DSP_TX_VIOLATION:overflow on DSP interface TX path FIFO");
+
+		if (status_2 & 0x0200000)
+			CAM_INFO(CAM_ISP,
+			"DSP_RX_VIOLATION:overflow on DSP interface RX path FIFO");
+
+		if (status_2 & 0x10000000)
+			CAM_INFO(CAM_ISP, "DSP ERROR VIOLATION");
+
+		if (status_2 & 0x20000000)
+			CAM_INFO(CAM_ISP,
+				"DIAG VIOLATION: HBI is less than the minimum required HBI");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION &&
+		status[CAM_IFE_IRQ_VIOLATION_STATUS]) {
+		module_id =
+			violation_mask & status[CAM_IFE_IRQ_VIOLATION_STATUS];
+		CAM_INFO(CAM_ISP, "PIXEL PIPE VIOLATION Module ID:%d",
+			module_id);
+
+		switch (module_id) {
+		case 0:
+			CAM_INFO(CAM_ISP, "DEMUX");
+			break;
+		case 1:
+			CAM_INFO(CAM_ISP, "CHROMA_UP");
+			break;
+		case 2:
+			CAM_INFO(CAM_ISP, "PEDESTAL");
+			break;
+		case 3:
+			CAM_INFO(CAM_ISP, "LINEARIZATION");
+			break;
+		case 4:
+			CAM_INFO(CAM_ISP, "BPC_PDPC");
+			break;
+		case 5:
+			CAM_INFO(CAM_ISP, "HDR_BINCORRECT");
+			break;
+		case 6:
+			CAM_INFO(CAM_ISP, "ABF");
+			break;
+		case 7:
+			CAM_INFO(CAM_ISP, "LSC");
+			break;
+		case 8:
+			CAM_INFO(CAM_ISP, "DEMOSAIC");
+			break;
+		case 9:
+			CAM_INFO(CAM_ISP, "COLOR_CORRECT");
+			break;
+		case 10:
+			CAM_INFO(CAM_ISP, "GTM");
+			break;
+		case 11:
+			CAM_INFO(CAM_ISP, "GLUT");
+			break;
+		case 12:
+			CAM_INFO(CAM_ISP, "COLOR_XFORM");
+			break;
+		case 13:
+			CAM_INFO(CAM_ISP, "CROP_RND_CLAMP_PIXEL_RAW_OUT");
+			break;
+		case 14:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_Y_FD_OUT");
+			break;
+		case 15:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_C_FD_OUT");
+			break;
+		case 16:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_FD_OUT");
+			break;
+		case 17:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_FD_OUT");
+			break;
+		case 18:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_Y_DISP_OUT");
+			break;
+		case 19:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_C_DISP_OUT");
+			break;
+		case 20:
+			CAM_INFO(CAM_ISP,
+				"module: CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_DISP_OUT");
+			break;
+		case 21:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_DISP_OUT");
+			break;
+		case 22:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_4TO1_Y_DISP_DS4_OUT");
+			break;
+		case 23:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_4TO1_C_DISP_DS4_OUT");
+			break;
+		case 24:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS4_OUT");
+			break;
+		case 25:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS4_OUT");
+			break;
+		case 26:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_4TO1_Y_DISP_DS16_OUT");
+			break;
+		case 27:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_4TO1_C_DISP_DS16_OUT");
+			break;
+		case 28:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS16_OUT");
+			break;
+		case 29:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS16_OUT");
+			break;
+		case 30:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_Y_VID_OUT");
+			break;
+		case 31:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_C_VID_OUT");
+			break;
+		case 32:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_OUT");
+			break;
+		case 33:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_VID_OUT");
+			break;
+		case 34:
+			CAM_INFO(CAM_ISP, "DSX_Y_VID_OUT");
+			break;
+		case 35:
+			CAM_INFO(CAM_ISP, "DSX_C_VID_OUT");
+			break;
+		case 36:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DSX_Y_VID_OUT");
+			break;
+		case 37:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DSX_C_VID_OUT");
+			break;
+		case 38:
+			CAM_INFO(CAM_ISP,
+				"DOWNSCALE_4TO1_Y_VID_DS16_OUT");
+			break;
+		case 39:
+			CAM_INFO(CAM_ISP,
+				"DOWNSCALE_4TO1_C_VID_DS16_OUT");
+			break;
+		case 40:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_VID_DS16_OUT");
+			break;
+		case 41:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_VID_DS16_OUT");
+			break;
+		case 42:
+			CAM_INFO(CAM_ISP, "BLS");
+			break;
+		case 43:
+			CAM_INFO(CAM_ISP, "STATS_TINTLESS_BG");
+			break;
+		case 44:
+			CAM_INFO(CAM_ISP, "STATS_HDR_BHIST");
+			break;
+		case 45:
+			CAM_INFO(CAM_ISP, "STATS_HDR_BE");
+			break;
+		case 46:
+			CAM_INFO(CAM_ISP, "STATS_AWB_BG");
+			break;
+		case 47:
+			CAM_INFO(CAM_ISP, "STATS_BHIST");
+			break;
+		case 48:
+			CAM_INFO(CAM_ISP, "STATS_BAF");
+			break;
+		case 49:
+			CAM_INFO(CAM_ISP, "STATS_RS");
+			break;
+		case 50:
+			CAM_INFO(CAM_ISP, "STATS_CS");
+			break;
+		case 51:
+			CAM_INFO(CAM_ISP, "STATS_IHIST");
+			break;
+		default:
+			CAM_ERR(CAM_ISP,
+				"Invalid Module ID:%d", module_id);
+			break;
+		}
+	}
+
+print_state:
+	soc_private = camif_priv->soc_info->soc_private;
+
+	cam_cpas_dump_camnoc_buff_fill_info(soc_private->cpas_handle);
+
+	CAM_INFO(CAM_ISP, "ife_clk_src:%lld", soc_private->ife_clk_src);
+
+	if ((err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) &&
+		((camif_priv->cam_common_cfg.input_mux_sel_pp & 0x3) ||
+		(bus_overflow_status)))
+		cam_cpas_log_votes(false);
+}
+
+static int cam_vfe_camif_ver3_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_node;
+	struct cam_vfe_mux_camif_ver3_data    *camif_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+
+	camif_node = th_payload->handler_priv;
+	camif_priv = camif_node->res_priv;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d CAMIF IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+		camif_node->hw_intf->hw_idx, th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1], th_payload->evt_status_arr[2]);
+
+	rc  = cam_vfe_camif_ver3_get_evt_payload(camif_priv, &evt_payload);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+		"VFE:%d CAMIF IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+		camif_node->hw_intf->hw_idx, th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1], th_payload->evt_status_arr[2]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	evt_payload->reg_val = 0;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	/* Read frame_id meta at every epoch if custom hw is enabled */
+	if (evt_payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_priv->reg_data->epoch0_irq_mask) {
+		if ((camif_priv->common_reg->custom_frame_idx) &&
+			(camif_priv->cam_common_cfg.input_mux_sel_pp & 0x3))
+			evt_payload->reg_val = cam_io_r_mb(
+			camif_priv->mem_base +
+			camif_priv->common_reg->custom_frame_idx);
+	}
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	if (th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+			& camif_priv->reg_data->sof_irq_mask) {
+		trace_cam_log_event("SOF", "TOP_HALF",
+		th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1],
+		camif_node->hw_intf->hw_idx);
+	}
+
+	if (th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+			& camif_priv->reg_data->epoch0_irq_mask) {
+		trace_cam_log_event("EPOCH0", "TOP_HALF",
+		th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1],
+		camif_node->hw_intf->hw_idx);
+	}
+
+	if (th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+			& camif_priv->reg_data->eof_irq_mask) {
+		trace_cam_log_event("EOF", "TOP_HALF",
+		th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1],
+		camif_node->hw_intf->hw_idx);
+	}
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_handle_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int ret = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node *camif_node;
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	struct cam_vfe_top_irq_evt_payload *payload;
+	struct cam_isp_hw_event_info evt_info;
+	struct cam_isp_hw_error_event_info err_evt_info;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_vfe_soc_private *soc_private = NULL;
+	uint32_t irq_status[CAM_IFE_IRQ_REGISTERS_MAX] = {0};
+	struct timespec64 ts;
+	uint32_t val = 0;
+	int i = 0;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params handle_priv:%pK, evt_payload_priv:%pK",
+			handler_priv, evt_payload_priv);
+		return ret;
+	}
+
+	camif_node = handler_priv;
+	camif_priv = camif_node->res_priv;
+	payload = evt_payload_priv;
+
+	soc_info = camif_priv->soc_info;
+	soc_private =
+		(struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	for (i = 0; i < CAM_IFE_IRQ_REGISTERS_MAX; i++)
+		irq_status[i] = payload->irq_reg_val[i];
+
+	evt_info.hw_type  = CAM_ISP_HW_TYPE_VFE;
+	evt_info.hw_idx   = camif_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_node->res_id;
+	evt_info.res_type = camif_node->res_type;
+	evt_info.reg_val = 0;
+	evt_info.hw_type = CAM_ISP_HW_TYPE_VFE;
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_priv->reg_data->sof_irq_mask) {
+		if ((camif_priv->enable_sof_irq_debug) &&
+			(camif_priv->irq_debug_cnt <=
+			CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "VFE:%d Received SOF",
+				evt_info.hw_idx);
+
+			camif_priv->irq_debug_cnt++;
+			if (camif_priv->irq_debug_cnt ==
+				CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+				camif_priv->enable_sof_irq_debug =
+					false;
+				camif_priv->irq_debug_cnt = 0;
+			}
+		} else {
+			CAM_DBG(CAM_ISP, "VFE:%d Received SOF",
+				evt_info.hw_idx);
+			camif_priv->sof_ts.tv_sec =
+				payload->ts.mono_time.tv_sec;
+			camif_priv->sof_ts.tv_nsec =
+				payload->ts.mono_time.tv_nsec;
+		}
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_priv->reg_data->epoch0_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d Received EPOCH", evt_info.hw_idx);
+		evt_info.reg_val = payload->reg_val;
+		camif_priv->epoch_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_priv->epoch_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_priv->reg_data->eof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d Received EOF", evt_info.hw_idx);
+		camif_priv->eof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_priv->eof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+		& camif_priv->reg_data->error_irq_mask0) {
+		CAM_ERR(CAM_ISP, "VFE:%d Overflow", evt_info.hw_idx);
+
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic timestamp:[%lld.%09lld]",
+			ts.tv_sec, ts.tv_nsec);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		err_evt_info.err_type = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		evt_info.event_data = (void *)&err_evt_info;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_vfe_camif_ver3_print_status(irq_status, ret, camif_priv);
+
+		if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_ver3_reg_dump(camif_node);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+		& camif_priv->reg_data->frame_id_irq_mask) {
+		val = cam_io_r_mb(camif_priv->mem_base +
+			camif_priv->common_reg->custom_frame_idx);
+		CAM_DBG(CAM_ISP,
+			"VFE:%d Frame id change to: %u", evt_info.hw_idx,
+			val);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS2]) {
+		CAM_ERR(CAM_ISP, "VFE:%d Violation", evt_info.hw_idx);
+
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic timestamp:[%lld.%09lld]",
+			ts.tv_sec, ts.tv_nsec);
+
+		ret = CAM_VFE_IRQ_STATUS_VIOLATION;
+		err_evt_info.err_type = CAM_VFE_IRQ_STATUS_VIOLATION;
+		evt_info.event_data = (void *)&err_evt_info;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_vfe_camif_ver3_print_status(irq_status, ret, camif_priv);
+
+		if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_ver3_reg_dump(camif_node);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+	}
+
+	if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		CAM_DBG(CAM_ISP, "VFE:%d VFE_DIAG_SENSOR_STATUS: 0x%X",
+			evt_info.hw_idx, camif_priv->mem_base,
+			cam_io_r(camif_priv->mem_base +
+			camif_priv->common_reg->diag_sensor_status_0));
+	}
+
+	cam_vfe_camif_ver3_put_evt_payload(camif_priv, &payload);
+
+	CAM_DBG(CAM_ISP, "returning status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_camif_ver3_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv = NULL;
+	struct cam_vfe_camif_ver3_hw_info *camif_info = camif_hw_info;
+	int i = 0;
+
+	camif_priv = kzalloc(sizeof(struct cam_vfe_mux_camif_ver3_data),
+		GFP_KERNEL);
+	if (!camif_priv)
+		return -ENOMEM;
+
+	camif_node->res_priv = camif_priv;
+
+	camif_priv->mem_base    = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	camif_priv->camif_reg   = camif_info->camif_reg;
+	camif_priv->common_reg  = camif_info->common_reg;
+	camif_priv->reg_data    = camif_info->reg_data;
+	camif_priv->hw_intf     = hw_intf;
+	camif_priv->soc_info    = soc_info;
+	camif_priv->vfe_irq_controller = vfe_irq_controller;
+
+	camif_node->init    = cam_vfe_camif_ver3_resource_init;
+	camif_node->deinit  = cam_vfe_camif_ver3_resource_deinit;
+	camif_node->start   = cam_vfe_camif_ver3_resource_start;
+	camif_node->stop    = cam_vfe_camif_ver3_resource_stop;
+	camif_node->process_cmd = cam_vfe_camif_ver3_process_cmd;
+	camif_node->top_half_handler = cam_vfe_camif_ver3_handle_irq_top_half;
+	camif_node->bottom_half_handler =
+		cam_vfe_camif_ver3_handle_irq_bottom_half;
+	spin_lock_init(&camif_priv->spin_lock);
+	INIT_LIST_HEAD(&camif_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&camif_priv->evt_payload[i].list);
+		list_add_tail(&camif_priv->evt_payload[i].list,
+			&camif_priv->free_payload_list);
+	}
+
+	return 0;
+}
+
+int cam_vfe_camif_ver3_deinit(
+	struct cam_isp_resource_node  *camif_node)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	int i = 0;
+
+	if (!camif_node) {
+		CAM_ERR(CAM_ISP, "Error, camif_node is NULL %pK", camif_node);
+		return -ENODEV;
+	}
+
+	camif_priv = camif_node->res_priv;
+
+	INIT_LIST_HEAD(&camif_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++)
+		INIT_LIST_HEAD(&camif_priv->evt_payload[i].list);
+
+	camif_priv = camif_node->res_priv;
+
+	camif_node->start = NULL;
+	camif_node->stop  = NULL;
+	camif_node->process_cmd = NULL;
+	camif_node->top_half_handler = NULL;
+	camif_node->bottom_half_handler = NULL;
+	camif_node->res_priv = NULL;
+
+	if (!camif_priv) {
+		CAM_ERR(CAM_ISP, "Error, camif_priv is NULL %pK", camif_priv);
+		return -ENODEV;
+	}
+
+	kfree(camif_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.h
@@ -0,0 +1,89 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CAMIF_VER3_H_
+#define _CAM_VFE_CAMIF_VER3_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+struct cam_vfe_camif_ver3_pp_clc_reg {
+	uint32_t     hw_version;
+	uint32_t     hw_status;
+	uint32_t     module_cfg;
+	uint32_t     pdaf_raw_crop_width_cfg;
+	uint32_t     pdaf_raw_crop_height_cfg;
+	uint32_t     line_skip_pattern;
+	uint32_t     pixel_skip_pattern;
+	uint32_t     period_cfg;
+	uint32_t     irq_subsample_pattern;
+	uint32_t     epoch_irq_cfg;
+	uint32_t     debug_1;
+	uint32_t     debug_0;
+	uint32_t     test_bus_ctrl;
+	uint32_t     spare;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_vfe_camif_ver3_reg_data {
+	uint32_t     pp_extern_reg_update_shift;
+	uint32_t     dual_pd_extern_reg_update_shift;
+	uint32_t     extern_reg_update_mask;
+	uint32_t     dual_ife_pix_en_shift;
+	uint32_t     dual_ife_sync_sel_shift;
+	uint32_t     operating_mode_shift;
+	uint32_t     input_mux_sel_shift;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+
+	uint32_t     dsp_mode_shift;
+	uint32_t     dsp_mode_mask;
+	uint32_t     dsp_en_shift;
+	uint32_t     dsp_en_mask;
+
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     epoch1_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask2;
+	uint32_t     subscribe_irq_mask1;
+	uint32_t     frame_id_irq_mask;
+
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     pp_camif_cfg_en_shift;
+	uint32_t     pp_camif_cfg_ife_out_en_shift;
+	uint32_t     top_debug_cfg_en;
+	uint32_t     dual_vfe_sync_mask;
+
+	uint32_t     input_bayer_fmt;
+	uint32_t     input_yuv_fmt;
+
+};
+
+struct cam_vfe_camif_ver3_hw_info {
+	struct cam_vfe_top_ver3_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_ver3_pp_clc_reg        *camif_reg;
+	struct cam_vfe_camif_ver3_reg_data          *reg_data;
+};
+
+int cam_vfe_camif_ver3_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param);
+
+int cam_vfe_camif_ver3_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_camif_ver3_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_CAMIF_VER3_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.c
@@ -0,0 +1,624 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_fe_ver1.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_cpas_api.h"
+
+#define CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX 2
+
+struct cam_vfe_mux_fe_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_fe_ver1_reg              *fe_reg;
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_fe_reg_data               *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+
+	enum cam_isp_hw_sync_mode          sync_mode;
+	uint32_t                           dsp_mode;
+	uint32_t                           pix_pattern;
+	uint32_t                           first_pixel;
+	uint32_t                           first_line;
+	uint32_t                           last_pixel;
+	uint32_t                           last_line;
+	uint32_t                           hbi_value;
+	uint32_t                           vbi_value;
+	bool                               enable_sof_irq_debug;
+	uint32_t                           irq_debug_cnt;
+	uint32_t                           fe_cfg_data;
+	uint32_t                           hbi_count;
+};
+
+static int cam_vfe_fe_validate_pix_pattern(uint32_t pattern)
+{
+	int rc;
+
+	switch (pattern) {
+	case CAM_ISP_PATTERN_BAYER_RGRGRG:
+	case CAM_ISP_PATTERN_BAYER_GRGRGR:
+	case CAM_ISP_PATTERN_BAYER_BGBGBG:
+	case CAM_ISP_PATTERN_BAYER_GBGBGB:
+	case CAM_ISP_PATTERN_YUV_YCBYCR:
+	case CAM_ISP_PATTERN_YUV_YCRYCB:
+	case CAM_ISP_PATTERN_YUV_CBYCRY:
+	case CAM_ISP_PATTERN_YUV_CRYCBY:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error! Invalid pix pattern:%d", pattern);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int cam_vfe_fe_update(
+	struct cam_isp_resource_node  *fe_res,
+	void *cmd_data, uint32_t arg_size)
+{
+	struct cam_vfe_mux_fe_data    *rsrc_data = NULL;
+	struct cam_vfe_fe_update_args    *args = cmd_data;
+	uint32_t                         fe_cfg_data;
+
+	if (arg_size != sizeof(struct cam_vfe_fe_update_args)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "fe_update->min_vbi = 0x%x", args->fe_config.min_vbi);
+	CAM_DBG(CAM_ISP, "fe_update->hbi_count = 0x%x",
+		args->fe_config.hbi_count);
+	CAM_DBG(CAM_ISP, "fe_update->fs_mode = 0x%x", args->fe_config.fs_mode);
+	CAM_DBG(CAM_ISP, "fe_update->fs_line_sync_en = 0x%x",
+		args->fe_config.fs_line_sync_en);
+
+	fe_cfg_data = args->fe_config.min_vbi |
+			args->fe_config.fs_mode << 8 |
+			args->fe_config.fs_line_sync_en;
+
+	rsrc_data = fe_res->res_priv;
+	rsrc_data->fe_cfg_data = fe_cfg_data;
+	rsrc_data->hbi_count = args->fe_config.hbi_count;
+
+	CAM_DBG(CAM_ISP, "fe_cfg_data = 0x%x", fe_cfg_data);
+	return 0;
+}
+
+static int cam_vfe_fe_get_reg_update(
+	struct cam_isp_resource_node  *fe_res,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_vfe_mux_fe_data    *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	rsrc_data = fe_res->res_priv;
+	reg_val_pair[0] = rsrc_data->fe_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "CAMIF reg_update_cmd 0x%x offset 0x%x",
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_fe_ver1_acquire_resource(
+	struct cam_isp_resource_node  *fe_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_fe_data    *fe_data;
+	struct cam_vfe_acquire_args      *acquire_data;
+
+	int rc = 0;
+
+	fe_data   = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args   *)acquire_param;
+
+	rc = cam_vfe_fe_validate_pix_pattern(
+			acquire_data->vfe_in.in_port->test_pattern);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "pix validation failed: id:%d pix_pattern %d",
+			fe_res->hw_intf->hw_idx,
+			acquire_data->vfe_in.in_port->test_pattern);
+		return rc;
+	}
+
+	fe_data->sync_mode   = acquire_data->vfe_in.sync_mode;
+	fe_data->pix_pattern = acquire_data->vfe_in.in_port->test_pattern;
+	fe_data->dsp_mode    = acquire_data->vfe_in.in_port->dsp_mode;
+	fe_data->first_pixel = acquire_data->vfe_in.in_port->left_start;
+	fe_data->last_pixel  = acquire_data->vfe_in.in_port->left_stop;
+	fe_data->first_line  = acquire_data->vfe_in.in_port->line_start;
+	fe_data->last_line   = acquire_data->vfe_in.in_port->line_stop;
+	fe_data->hbi_value   = 0;
+	fe_data->vbi_value   = 0;
+
+	CAM_DBG(CAM_ISP, "hw id:%d pix_pattern:%d dsp_mode=%d",
+		fe_res->hw_intf->hw_idx,
+		fe_data->pix_pattern, fe_data->dsp_mode);
+	return rc;
+}
+
+static int cam_vfe_fe_resource_init(
+	struct cam_isp_resource_node        *fe_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_fe_data    *fe_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	fe_data   = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+
+	soc_info = fe_data->soc_info;
+
+	if ((fe_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(fe_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_enable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to enable dsp clk");
+	}
+
+	return rc;
+}
+
+static int cam_vfe_fe_resource_deinit(
+	struct cam_isp_resource_node        *fe_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_fe_data    *fe_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	fe_data   = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+
+	soc_info = fe_data->soc_info;
+
+	if ((fe_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(fe_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_disable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to disable dsp clk");
+	}
+
+	return rc;
+
+}
+
+static int cam_vfe_fe_resource_start(
+	struct cam_isp_resource_node        *fe_res)
+{
+	struct cam_vfe_mux_fe_data       *rsrc_data;
+	uint32_t                             val = 0;
+	uint32_t                             epoch0_irq_mask;
+	uint32_t                             epoch1_irq_mask;
+	uint32_t                             computed_epoch_line_cfg;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (fe_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Invalid fe res res_state:%d",
+			fe_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_vfe_mux_fe_data  *)fe_res->res_priv;
+
+	/* config vfe core */
+	val = (rsrc_data->pix_pattern <<
+			rsrc_data->reg_data->pixel_pattern_shift);
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	if ((rsrc_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(rsrc_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		/* DSP mode reg val is CAM_ISP_DSP_MODE - 1 */
+		val |= (((rsrc_data->dsp_mode - 1) &
+			rsrc_data->reg_data->dsp_mode_mask) <<
+			rsrc_data->reg_data->dsp_mode_shift);
+		val |= (0x1 << rsrc_data->reg_data->dsp_en_shift);
+	}
+
+	if (rsrc_data->fe_cfg_data) {
+		/*set Mux mode value to EXT_RD_PATH */
+		val |= (rsrc_data->reg_data->fe_mux_data <<
+				rsrc_data->reg_data->input_mux_sel_shift);
+	}
+
+	if (rsrc_data->hbi_count) {
+		/*set hbi count*/
+		val |= (rsrc_data->hbi_count <<
+			rsrc_data->reg_data->hbi_cnt_shift);
+	}
+	cam_io_w_mb(val, rsrc_data->mem_base + rsrc_data->common_reg->core_cfg);
+
+	CAM_DBG(CAM_ISP, "hw id:%d core_cfg (off:0x%x, val:0x%x)",
+		fe_res->hw_intf->hw_idx,
+		rsrc_data->common_reg->core_cfg,
+		val);
+
+	/* disable the CGC for stats */
+	cam_io_w_mb(0xFFFFFFFF, rsrc_data->mem_base +
+		rsrc_data->common_reg->module_ctrl[
+		CAM_VFE_TOP_VER2_MODULE_STATS]->cgc_ovd);
+
+	/* epoch config */
+	epoch0_irq_mask = (((rsrc_data->last_line + rsrc_data->vbi_value) -
+		rsrc_data->first_line) / 2);
+	if (epoch0_irq_mask > (rsrc_data->last_line - rsrc_data->first_line))
+		epoch0_irq_mask = rsrc_data->last_line - rsrc_data->first_line;
+
+	epoch1_irq_mask = rsrc_data->reg_data->epoch_line_cfg & 0xFFFF;
+	computed_epoch_line_cfg = (epoch0_irq_mask << 16) | epoch1_irq_mask;
+	cam_io_w_mb(computed_epoch_line_cfg,
+		rsrc_data->mem_base + rsrc_data->fe_reg->epoch_irq);
+	CAM_DBG(CAM_ISP,
+		"first_line:0x%x last_line:0x%x vbi:0x%x epoch_line_cfg: 0x%x",
+		rsrc_data->first_line, rsrc_data->last_line,
+		rsrc_data->vbi_value, computed_epoch_line_cfg);
+
+	fe_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Read Back cfg */
+	cam_io_w_mb(rsrc_data->fe_cfg_data,
+		rsrc_data->mem_base + rsrc_data->fe_reg->fe_cfg);
+	CAM_DBG(CAM_ISP, "hw id:%d fe_cfg_data(off:0x%x val:0x%x)",
+		fe_res->hw_intf->hw_idx,
+		rsrc_data->fe_reg->fe_cfg,
+		rsrc_data->fe_cfg_data);
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base + rsrc_data->fe_reg->reg_update_cmd);
+	CAM_DBG(CAM_ISP, "hw id:%d RUP (off:0x%x, val:0x%x)",
+		fe_res->hw_intf->hw_idx,
+		rsrc_data->fe_reg->reg_update_cmd,
+		rsrc_data->reg_data->reg_update_cmd_data);
+
+	/* disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
+	CAM_DBG(CAM_ISP, "Start Camif IFE %d Done", fe_res->hw_intf->hw_idx);
+	return 0;
+}
+
+static int cam_vfe_fe_reg_dump(
+	struct cam_isp_resource_node *fe_res)
+{
+	struct cam_vfe_mux_fe_data *fe_priv;
+	struct cam_vfe_soc_private *soc_private;
+	int rc = 0, i;
+	uint32_t val = 0;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((fe_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(fe_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	fe_priv = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+	soc_private = fe_priv->soc_info->soc_private;
+	for (i = 0xA3C; i <= 0xA90; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	for (i = 0xE0C; i <= 0xE3C; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	for (i = 0x2000; i <= 0x20B8; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	for (i = 0x2500; i <= 0x255C; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	for (i = 0x2600; i <= 0x265C; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	cam_cpas_dump_camnoc_buff_fill_info(soc_private->cpas_handle);
+
+	return rc;
+}
+
+static int cam_vfe_fe_resource_stop(
+	struct cam_isp_resource_node        *fe_res)
+{
+	struct cam_vfe_mux_fe_data       *fe_priv;
+	int rc = 0;
+	uint32_t val = 0;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (fe_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		fe_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	fe_priv = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+
+	if ((fe_priv->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(fe_priv->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		val = cam_io_r_mb(fe_priv->mem_base +
+				fe_priv->common_reg->core_cfg);
+		val &= (~(1 << fe_priv->reg_data->dsp_en_shift));
+		cam_io_w_mb(val, fe_priv->mem_base +
+			fe_priv->common_reg->core_cfg);
+	}
+
+	if (fe_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		fe_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return rc;
+}
+
+static int cam_vfe_fe_sof_irq_debug(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_fe_data *fe_priv;
+	uint32_t *enable_sof_irq = (uint32_t *)cmd_args;
+
+	fe_priv =
+		(struct cam_vfe_mux_fe_data *)rsrc_node->res_priv;
+
+	if (*enable_sof_irq == 1)
+		fe_priv->enable_sof_irq_debug = true;
+	else
+		fe_priv->enable_sof_irq_debug = false;
+
+	return 0;
+}
+
+static int cam_vfe_fe_blanking_update(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_fe_data *fe_priv =
+		(struct cam_vfe_mux_fe_data *)rsrc_node->res_priv;
+
+	struct cam_isp_blanking_config  *blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+
+	fe_priv->hbi_value = blanking_config->hbi;
+	fe_priv->vbi_value = blanking_config->vbi;
+	CAM_DBG(CAM_ISP, "hbi:%d vbi:%d",
+		fe_priv->hbi_value, fe_priv->vbi_value);
+
+	return 0;
+}
+
+static int cam_vfe_fe_process_cmd(struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_fe_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SOF_IRQ_DEBUG:
+		rc = cam_vfe_fe_sof_irq_debug(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_IN_RD:
+		rc = cam_vfe_fe_update(rsrc_node, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_fe_blanking_update(rsrc_node, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_fe_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_fe_handle_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int                                   ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	struct cam_isp_resource_node         *fe_node;
+	struct cam_vfe_mux_fe_data           *fe_priv;
+	struct cam_vfe_top_irq_evt_payload   *payload;
+	uint32_t                              irq_status0;
+	uint32_t                              irq_status1;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		ret = CAM_VFE_IRQ_STATUS_ERR;
+		return ret;
+	}
+
+	fe_node = handler_priv;
+	fe_priv = fe_node->res_priv;
+	payload = evt_payload_priv;
+	irq_status0 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	irq_status1 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1];
+
+	CAM_DBG(CAM_ISP, "event ID, irq_status_0 = 0x%x", irq_status0);
+
+	if (irq_status0 & fe_priv->reg_data->sof_irq_mask) {
+		if ((fe_priv->enable_sof_irq_debug) &&
+			(fe_priv->irq_debug_cnt <=
+			CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "Received SOF");
+
+			fe_priv->irq_debug_cnt++;
+			if (fe_priv->irq_debug_cnt ==
+				CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+				fe_priv->enable_sof_irq_debug =
+					false;
+				fe_priv->irq_debug_cnt = 0;
+			}
+		} else {
+			CAM_DBG(CAM_ISP, "Received SOF");
+		}
+	}
+
+	if (irq_status0 & fe_priv->reg_data->epoch0_irq_mask)
+		CAM_DBG(CAM_ISP, "Received EPOCH");
+
+	if (irq_status0 & fe_priv->reg_data->reg_update_irq_mask)
+		CAM_DBG(CAM_ISP, "Received REG_UPDATE_ACK");
+
+	if (irq_status0 & fe_priv->reg_data->eof_irq_mask)
+		CAM_DBG(CAM_ISP, "Received EOF");
+
+	if (irq_status1 & fe_priv->reg_data->error_irq_mask1) {
+		CAM_DBG(CAM_ISP, "Received ERROR");
+		ret = CAM_VFE_IRQ_STATUS_ERR;
+		cam_vfe_fe_reg_dump(fe_node);
+		/* No HW mgr notification on error */
+	}
+
+	CAM_DBG(CAM_ISP, "returing status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_fe_ver1_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *fe_hw_info,
+	struct cam_isp_resource_node  *fe_node)
+{
+	struct cam_vfe_mux_fe_data     *fe_priv = NULL;
+	struct cam_vfe_fe_ver1_hw_info *fe_info = fe_hw_info;
+
+	fe_priv = kzalloc(sizeof(struct cam_vfe_mux_fe_data),
+		GFP_KERNEL);
+	if (!fe_priv) {
+		CAM_ERR(CAM_ISP, "Error! Failed to alloc for fe_priv");
+		return -ENOMEM;
+	}
+
+	fe_node->res_priv = fe_priv;
+
+	fe_priv->mem_base    = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	fe_priv->fe_reg  = fe_info->fe_reg;
+	fe_priv->common_reg  = fe_info->common_reg;
+	fe_priv->reg_data    = fe_info->reg_data;
+	fe_priv->hw_intf     = hw_intf;
+	fe_priv->soc_info    = soc_info;
+
+	fe_node->init    = cam_vfe_fe_resource_init;
+	fe_node->deinit  = cam_vfe_fe_resource_deinit;
+	fe_node->start   = cam_vfe_fe_resource_start;
+	fe_node->stop    = cam_vfe_fe_resource_stop;
+	fe_node->process_cmd = cam_vfe_fe_process_cmd;
+	fe_node->top_half_handler = cam_vfe_fe_handle_irq_top_half;
+	fe_node->bottom_half_handler = cam_vfe_fe_handle_irq_bottom_half;
+
+	return 0;
+}
+
+int cam_vfe_fe_ver1_deinit(
+	struct cam_isp_resource_node  *fe_node)
+{
+	struct cam_vfe_mux_fe_data *fe_priv = fe_node->res_priv;
+
+	fe_node->start = NULL;
+	fe_node->stop  = NULL;
+	fe_node->process_cmd = NULL;
+	fe_node->top_half_handler = NULL;
+	fe_node->bottom_half_handler = NULL;
+
+	fe_node->res_priv = NULL;
+
+	if (!fe_priv) {
+		CAM_ERR(CAM_ISP, "Error! fe_priv is NULL");
+		return -ENODEV;
+	}
+
+	kfree(fe_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.h
@@ -0,0 +1,87 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_FE_VER1_H_
+#define _CAM_VFE_FE_VER1_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+struct cam_vfe_fe_ver1_reg {
+	uint32_t     camif_cmd;
+	uint32_t     camif_config;
+	uint32_t     line_skip_pattern;
+	uint32_t     pixel_skip_pattern;
+	uint32_t     skip_period;
+	uint32_t     irq_subsample_pattern;
+	uint32_t     epoch_irq;
+	uint32_t     raw_crop_width_cfg;
+	uint32_t     raw_crop_height_cfg;
+	uint32_t     reg_update_cmd;
+	uint32_t     vfe_diag_config;
+	uint32_t     vfe_diag_sensor_status;
+	uint32_t     fe_cfg;
+};
+
+struct cam_vfe_fe_reg_data {
+	uint32_t     raw_crop_first_pixel_shift;
+	uint32_t     raw_crop_first_pixel_mask;
+
+	uint32_t     raw_crop_last_pixel_shift;
+	uint32_t     raw_crop_last_pixel_mask;
+
+	uint32_t     raw_crop_first_line_shift;
+	uint32_t     raw_crop_first_line_mask;
+
+	uint32_t     raw_crop_last_line_shift;
+	uint32_t     raw_crop_last_line_mask;
+
+	uint32_t     input_mux_sel_shift;
+	uint32_t     input_mux_sel_mask;
+	uint32_t     extern_reg_update_shift;
+	uint32_t     extern_reg_update_mask;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+
+	uint32_t     dsp_mode_shift;
+	uint32_t     dsp_mode_mask;
+	uint32_t     dsp_en_shift;
+	uint32_t     dsp_en_mask;
+
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     reg_update_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask1;
+
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     fe_mux_data;
+	uint32_t     hbi_cnt_shift;
+};
+
+struct cam_vfe_fe_ver1_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_fe_ver1_reg              *fe_reg;
+	struct cam_vfe_fe_reg_data              *reg_data;
+};
+
+int cam_vfe_fe_ver1_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param);
+
+int cam_vfe_fe_ver1_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node);
+
+int cam_vfe_fe_ver1_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_FE_VER1_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.c
@@ -0,0 +1,615 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_vfe_rdi.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+
+struct cam_vfe_mux_rdi_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_rdi_ver2_reg                 *rdi_reg;
+	struct cam_vfe_rdi_common_reg_data          *rdi_common_reg_data;
+	struct cam_vfe_rdi_overflow_status          *rdi_irq_status;
+	struct cam_vfe_rdi_reg_data                 *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+
+	cam_hw_mgr_event_cb_func              event_cb;
+	void                                 *priv;
+	int                                   irq_err_handle;
+	int                                   irq_handle;
+	void                                 *vfe_irq_controller;
+	struct cam_vfe_top_irq_evt_payload    evt_payload[CAM_VFE_RDI_EVT_MAX];
+	struct list_head                      free_payload_list;
+	spinlock_t                            spin_lock;
+
+	enum cam_isp_hw_sync_mode          sync_mode;
+	struct timespec64                     sof_ts;
+	struct timespec64                     error_ts;
+};
+
+static int cam_vfe_rdi_get_evt_payload(
+	struct cam_vfe_mux_rdi_data              *rdi_priv,
+	struct cam_vfe_top_irq_evt_payload     **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&rdi_priv->spin_lock);
+	if (list_empty(&rdi_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&rdi_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&rdi_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_rdi_put_evt_payload(
+	struct cam_vfe_mux_rdi_data              *rdi_priv,
+	struct cam_vfe_top_irq_evt_payload      **evt_payload)
+{
+	unsigned long flags;
+
+	if (!rdi_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&rdi_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list, &rdi_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&rdi_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_rdi_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *rdi_node;
+	struct cam_vfe_mux_rdi_data           *rdi_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	bool                                   error_flag = false;
+
+	CAM_DBG(CAM_ISP, "IRQ status_1 = %x", th_payload->evt_status_arr[1]);
+
+	rdi_node = th_payload->handler_priv;
+	rdi_priv = rdi_node->res_priv;
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[1]) {
+		CAM_ERR(CAM_ISP,
+			"RDI Error: vfe:%d: STATUS_1=0x%x",
+			rdi_node->hw_intf->hw_idx,
+			th_payload->evt_status_arr[1]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from vfe=%d",
+			rdi_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_all(
+			rdi_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_rdi_get_evt_payload(rdi_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "STATUS_1=0x%x",
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		rdi_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		rdi_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(rdi_priv->mem_base +
+			rdi_priv->common_reg->violation_status);
+
+	if (error_flag)
+		CAM_INFO(CAM_ISP, "Violation status = 0x%x",
+			evt_payload->irq_reg_val[i]);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_vfe_rdi_get_reg_update(
+	struct cam_isp_resource_node  *rdi_res,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_vfe_mux_rdi_data      *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error - Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Error - Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Error - Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Error - buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size * 4);
+		return -EINVAL;
+	}
+
+	rsrc_data = rdi_res->res_priv;
+	reg_val_pair[0] = rsrc_data->rdi_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "RDI%d reg_update_cmd %x",
+		rdi_res->res_id - CAM_ISP_HW_VFE_IN_RDI0, reg_val_pair[1]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_rdi_ver2_acquire_resource(
+	struct cam_isp_resource_node  *rdi_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_rdi_data   *rdi_data;
+	struct cam_vfe_acquire_args   *acquire_data;
+
+	rdi_data     = (struct cam_vfe_mux_rdi_data *)rdi_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	rdi_data->event_cb          = acquire_data->event_cb;
+	rdi_data->priv              = acquire_data->priv;
+	rdi_data->sync_mode         = acquire_data->vfe_in.sync_mode;
+	rdi_res->is_rdi_primary_res = false;
+
+	return 0;
+}
+
+static int cam_vfe_rdi_resource_start(
+	struct cam_isp_resource_node  *rdi_res)
+{
+	struct cam_vfe_mux_rdi_data   *rsrc_data;
+	int                            rc = 0;
+	uint32_t                       err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                 rdi_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX] = {0};
+
+	if (!rdi_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (rdi_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Invalid rdi res res_state:%d",
+			rdi_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_vfe_mux_rdi_data  *)rdi_res->res_priv;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->rdi_common_reg_data->error_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->rdi_common_reg_data->error_irq_mask1;
+
+	rdi_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base + rsrc_data->rdi_reg->reg_update_cmd);
+
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			rdi_res,
+			cam_vfe_rdi_err_irq_top_half,
+			rdi_res->bottom_half_handler,
+			rdi_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	if (!rdi_res->is_rdi_primary_res)
+		goto end;
+
+	rdi_irq_mask[0] =
+		(rsrc_data->reg_data->reg_update_irq_mask |
+			rsrc_data->reg_data->sof_irq_mask);
+
+	CAM_DBG(CAM_ISP, "RDI%d irq_mask 0x%x",
+		rdi_res->res_id - CAM_ISP_HW_VFE_IN_RDI0,
+		rdi_irq_mask[0]);
+
+	if (!rsrc_data->irq_handle) {
+		rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			rdi_irq_mask,
+			rdi_res,
+			rdi_res->top_half_handler,
+			rdi_res->bottom_half_handler,
+			rdi_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+		if (rsrc_data->irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_handle = 0;
+		}
+	}
+
+	rsrc_data->sof_ts.tv_sec = 0;
+	rsrc_data->sof_ts.tv_nsec = 0;
+	rsrc_data->error_ts.tv_sec = 0;
+	rsrc_data->error_ts.tv_nsec = 0;
+
+	CAM_DBG(CAM_ISP, "Start RDI %d",
+		rdi_res->res_id - CAM_ISP_HW_VFE_IN_RDI0);
+end:
+	return rc;
+}
+
+
+static int cam_vfe_rdi_resource_stop(
+	struct cam_isp_resource_node        *rdi_res)
+{
+	struct cam_vfe_mux_rdi_data         *rdi_priv;
+	int rc = 0;
+
+	if (!rdi_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (rdi_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		rdi_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	rdi_priv = (struct cam_vfe_mux_rdi_data *)rdi_res->res_priv;
+
+	if (rdi_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		rdi_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	if (rdi_priv->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			rdi_priv->vfe_irq_controller, rdi_priv->irq_handle);
+		rdi_priv->irq_handle = 0;
+	}
+
+	if (rdi_priv->irq_err_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			rdi_priv->vfe_irq_controller, rdi_priv->irq_err_handle);
+		rdi_priv->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_rdi_process_cmd(struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_rdi_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported RDI process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_rdi_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *rdi_node;
+	struct cam_vfe_mux_rdi_data           *rdi_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+
+	rdi_node = th_payload->handler_priv;
+	rdi_priv = rdi_node->res_priv;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x", th_payload->evt_status_arr[0]);
+	CAM_DBG(CAM_ISP, "IRQ status_1 = %x", th_payload->evt_status_arr[1]);
+
+	rc  = cam_vfe_rdi_get_evt_payload(rdi_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ status0=0x%x status1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_rdi_handle_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int                                  ret = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node        *rdi_node;
+	struct cam_vfe_mux_rdi_data         *rdi_priv;
+	struct cam_vfe_top_irq_evt_payload  *payload;
+	struct cam_isp_hw_event_info         evt_info;
+	struct cam_isp_hw_error_event_info	 err_evt_info;
+	uint32_t                             irq_status0;
+	uint32_t                             irq_status1;
+	uint32_t                             irq_rdi_status;
+	struct cam_hw_soc_info              *soc_info = NULL;
+	struct cam_vfe_soc_private          *soc_private = NULL;
+	struct timespec64                    ts;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	rdi_node = handler_priv;
+	rdi_priv = rdi_node->res_priv;
+	payload = evt_payload_priv;
+	soc_info = rdi_priv->soc_info;
+	soc_private =
+		(struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	irq_status0 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	irq_status1 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1];
+
+	evt_info.hw_type  = CAM_ISP_HW_TYPE_VFE;
+	evt_info.hw_idx   = rdi_node->hw_intf->hw_idx;
+	evt_info.res_id   = rdi_node->res_id;
+	evt_info.res_type = rdi_node->res_type;
+
+	CAM_DBG(CAM_ISP, "irq_status_0 = %x", irq_status0);
+
+	if (irq_status0 & rdi_priv->reg_data->sof_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received SOF");
+		rdi_priv->sof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		rdi_priv->sof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & rdi_priv->reg_data->reg_update_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received REG UPDATE");
+
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (!rdi_priv->rdi_irq_status)
+		goto end;
+
+	irq_rdi_status =
+		(irq_status1 &
+		rdi_priv->rdi_irq_status->rdi_overflow_mask);
+	if (irq_rdi_status) {
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic timestamp:[%lld.%09lld]",
+			ts.tv_sec, ts.tv_nsec);
+
+		cam_cpas_dump_camnoc_buff_fill_info(soc_private->cpas_handle);
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+		CAM_INFO(CAM_ISP,
+			"ERROR timestamp:[%lld.%09lld] SOF timestamp:[%lld.%09lld]",
+			rdi_priv->error_ts.tv_sec,
+			rdi_priv->error_ts.tv_nsec,
+			rdi_priv->sof_ts.tv_sec,
+			rdi_priv->sof_ts.tv_nsec);
+
+		if (irq_rdi_status &
+			rdi_priv->rdi_irq_status->rdi0_overflow_mask) {
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_0;
+			}
+		else if (irq_rdi_status &
+			rdi_priv->rdi_irq_status->rdi1_overflow_mask) {
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_1;
+			}
+		else if (irq_rdi_status &
+			rdi_priv->rdi_irq_status->rdi2_overflow_mask) {
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_2;
+			}
+		else if (irq_rdi_status &
+			rdi_priv->rdi_irq_status->rdi3_overflow_mask) {
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_3;
+			}
+
+		err_evt_info.err_type = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		evt_info.event_data = (void *)&err_evt_info;
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+			CAM_ISP_HW_EVENT_ERROR,
+			(void *)&evt_info);
+		cam_cpas_log_votes(false);
+	}
+end:
+	cam_vfe_rdi_put_evt_payload(rdi_priv, &payload);
+	CAM_DBG(CAM_ISP, "returing status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_rdi_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *rdi_hw_info,
+	struct cam_isp_resource_node  *rdi_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_rdi_data     *rdi_priv = NULL;
+	struct cam_vfe_rdi_ver2_hw_info *rdi_info = rdi_hw_info;
+	int                              i = 0;
+
+	rdi_priv = kzalloc(sizeof(struct cam_vfe_mux_rdi_data),
+			GFP_KERNEL);
+	if (!rdi_priv) {
+		CAM_DBG(CAM_ISP, "Error! Failed to alloc for rdi_priv");
+		return -ENOMEM;
+	}
+
+	rdi_node->res_priv = rdi_priv;
+
+	rdi_priv->mem_base   = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	rdi_priv->hw_intf    = hw_intf;
+	rdi_priv->common_reg = rdi_info->common_reg;
+	rdi_priv->rdi_reg    = rdi_info->rdi_reg;
+	rdi_priv->vfe_irq_controller  = vfe_irq_controller;
+	rdi_priv->rdi_common_reg_data = rdi_info->common_reg_data;
+	rdi_priv->soc_info = soc_info;
+	rdi_priv->rdi_irq_status = rdi_info->rdi_irq_status;
+
+	switch (rdi_node->res_id) {
+	case CAM_ISP_HW_VFE_IN_RDI0:
+		rdi_priv->reg_data = rdi_info->reg_data[0];
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI1:
+		rdi_priv->reg_data = rdi_info->reg_data[1];
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI2:
+		rdi_priv->reg_data = rdi_info->reg_data[2];
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI3:
+		if (rdi_info->reg_data[3]) {
+			rdi_priv->reg_data = rdi_info->reg_data[3];
+		} else {
+			CAM_ERR(CAM_ISP, "Error! RDI3 is not supported");
+			goto err_init;
+		}
+		break;
+	default:
+		CAM_DBG(CAM_ISP, "invalid Resource id:%d", rdi_node->res_id);
+		goto err_init;
+	}
+
+	rdi_node->start = cam_vfe_rdi_resource_start;
+	rdi_node->stop  = cam_vfe_rdi_resource_stop;
+	rdi_node->process_cmd = cam_vfe_rdi_process_cmd;
+	rdi_node->top_half_handler = cam_vfe_rdi_handle_irq_top_half;
+	rdi_node->bottom_half_handler = cam_vfe_rdi_handle_irq_bottom_half;
+
+	spin_lock_init(&rdi_priv->spin_lock);
+	INIT_LIST_HEAD(&rdi_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_RDI_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&rdi_priv->evt_payload[i].list);
+		list_add_tail(&rdi_priv->evt_payload[i].list,
+			&rdi_priv->free_payload_list);
+	}
+
+	return 0;
+err_init:
+	kfree(rdi_priv);
+	return -EINVAL;
+}
+
+int cam_vfe_rdi_ver2_deinit(
+	struct cam_isp_resource_node  *rdi_node)
+{
+	struct cam_vfe_mux_rdi_data *rdi_priv = rdi_node->res_priv;
+	int                          i = 0;
+
+	if (!rdi_priv) {
+		CAM_ERR(CAM_ISP, "Error! rdi_priv NULL");
+		return -ENODEV;
+	}
+
+	INIT_LIST_HEAD(&rdi_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_RDI_EVT_MAX; i++)
+		INIT_LIST_HEAD(&rdi_priv->evt_payload[i].list);
+
+	rdi_node->start = NULL;
+	rdi_node->stop  = NULL;
+	rdi_node->process_cmd = NULL;
+	rdi_node->top_half_handler = NULL;
+	rdi_node->bottom_half_handler = NULL;
+
+	rdi_node->res_priv = NULL;
+
+	kfree(rdi_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.h
@@ -0,0 +1,64 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_RDI_H_
+#define _CAM_VFE_RDI_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+#define CAM_VFE_RDI_VER2_MAX  4
+
+#define CAM_VFE_RDI_EVT_MAX   256
+
+struct cam_vfe_rdi_ver2_reg {
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_vfe_rdi_overflow_status {
+	uint32_t    rdi0_overflow_mask;
+	uint32_t    rdi1_overflow_mask;
+	uint32_t    rdi2_overflow_mask;
+	uint32_t    rdi3_overflow_mask;
+	uint32_t    rdi_overflow_mask;
+};
+
+struct cam_vfe_rdi_common_reg_data {
+	uint32_t     subscribe_irq_mask0;
+	uint32_t     subscribe_irq_mask1;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask1;
+	uint32_t     error_irq_mask2;
+	uint32_t     rdi_frame_drop_mask;
+};
+
+struct cam_vfe_rdi_reg_data {
+	uint32_t     reg_update_cmd_data;
+	uint32_t     sof_irq_mask;
+	uint32_t     reg_update_irq_mask;
+};
+struct cam_vfe_rdi_ver2_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common  *common_reg;
+	struct cam_vfe_rdi_ver2_reg                *rdi_reg;
+	struct cam_vfe_rdi_common_reg_data         *common_reg_data;
+	struct cam_vfe_rdi_overflow_status         *rdi_irq_status;
+	struct cam_vfe_rdi_reg_data  *reg_data[CAM_VFE_RDI_VER2_MAX];
+};
+
+int cam_vfe_rdi_ver2_acquire_resource(
+	struct cam_isp_resource_node  *rdi_res,
+	void                          *acquire_param);
+
+int cam_vfe_rdi_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *rdi_hw_info,
+	struct cam_isp_resource_node  *rdi_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_rdi_ver2_deinit(
+	struct cam_isp_resource_node  *rdi_node);
+
+#endif /* _CAM_VFE_RDI_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top.c
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_top_ver4.h"
+#include "cam_debug_util.h"
+
+int cam_vfe_top_init(uint32_t          top_version,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *top_hw_info,
+	void                          *vfe_irq_controller,
+	struct cam_vfe_top           **vfe_top)
+{
+	int rc = -EINVAL;
+
+	switch (top_version) {
+	case CAM_VFE_TOP_VER_2_0:
+		rc = cam_vfe_top_ver2_init(soc_info, hw_intf, top_hw_info,
+			vfe_irq_controller, vfe_top);
+		break;
+	case CAM_VFE_TOP_VER_3_0:
+		rc = cam_vfe_top_ver3_init(soc_info, hw_intf, top_hw_info,
+			vfe_irq_controller, vfe_top);
+		break;
+	case CAM_VFE_TOP_VER_4_0:
+		rc = cam_vfe_top_ver4_init(soc_info, hw_intf, top_hw_info,
+			vfe_irq_controller, vfe_top);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error! Unsupported Version %x", top_version);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_deinit(uint32_t        top_version,
+	struct cam_vfe_top           **vfe_top)
+{
+	int rc = -EINVAL;
+
+	switch (top_version) {
+	case CAM_VFE_TOP_VER_2_0:
+		rc = cam_vfe_top_ver2_deinit(vfe_top);
+		break;
+	case CAM_VFE_TOP_VER_3_0:
+		rc = cam_vfe_top_ver3_deinit(vfe_top);
+		break;
+	case CAM_VFE_TOP_VER_4_0:
+		rc = cam_vfe_top_ver4_deinit(vfe_top);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error! Unsupported Version %x", top_version);
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.c
@@ -0,0 +1,786 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_vfe_top_common.h"
+#include "cam_debug_util.h"
+
+static const char *cam_vfe_top_clk_bw_state_to_string(uint32_t state)
+{
+	switch (state) {
+	case CAM_CLK_BW_STATE_UNCHANGED:
+		return "UNCHANGED";
+	case CAM_CLK_BW_STATE_INCREASE:
+		return "INCREASE";
+	case CAM_CLK_BW_STATE_DECREASE:
+		return "DECREASE";
+	default:
+		return "Invalid State";
+	}
+}
+static int cam_vfe_top_set_axi_bw_vote(struct cam_vfe_top_priv_common *top_common,
+	struct cam_axi_vote *final_bw_vote, uint64_t total_bw_new_vote, bool start_stop,
+	uint64_t request_id)
+{
+	int rc = 0;
+	struct cam_hw_soc_info        *soc_info = NULL;
+	struct cam_vfe_soc_private    *soc_private = NULL;
+	int i, j;
+
+	soc_info = top_common->soc_info;
+	soc_private = (struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	CAM_DBG(CAM_PERF, "VFE:%d Sending final BW to cpas bw_state:%s bw_vote:%llu req_id:%ld",
+		top_common->hw_idx, cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+		total_bw_new_vote, (start_stop ? -1 : request_id));
+	rc = cam_cpas_update_axi_vote(soc_private->cpas_handle,
+		final_bw_vote);
+	if (!rc) {
+		memcpy(&top_common->applied_axi_vote,
+			final_bw_vote,
+			sizeof(struct cam_axi_vote));
+		top_common->total_bw_applied = total_bw_new_vote;
+	} else {
+		CAM_ERR(CAM_PERF,
+			"VFE:%d BW request failed, req_id: %ld, final num_paths: %d, rc=%d",
+			top_common->hw_idx, (start_stop ? -1 : request_id),
+			final_bw_vote->num_paths, rc);
+		for (i = 0; i < final_bw_vote->num_paths; i++) {
+			CAM_INFO(CAM_PERF,
+				"ife[%d] : Applied BW Vote : [%s][%s][%s] [%llu %llu %llu]",
+				top_common->hw_idx,
+				cam_cpas_axi_util_path_type_to_string(
+				final_bw_vote->axi_path[i].path_data_type),
+				cam_cpas_axi_util_trans_type_to_string(
+				final_bw_vote->axi_path[i].transac_type),
+				cam_cpas_axi_util_drv_vote_lvl_to_string(
+				final_bw_vote->axi_path[i].vote_level),
+				final_bw_vote->axi_path[i].camnoc_bw,
+				final_bw_vote->axi_path[i].mnoc_ab_bw,
+				final_bw_vote->axi_path[i].mnoc_ib_bw);
+		}
+
+		for (i = 0; i < CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ; i++) {
+			for (j = 0; j < top_common->last_bw_vote[i].num_paths; j++) {
+				CAM_INFO(CAM_PERF,
+					"ife[%d] : History[%d] BW Vote : [%s][%s] [%s] [%llu %llu %llu]",
+					top_common->hw_idx, i,
+					cam_cpas_axi_util_path_type_to_string(
+					top_common->last_bw_vote[i].axi_path[j].path_data_type),
+					cam_cpas_axi_util_trans_type_to_string(
+					top_common->last_bw_vote[i].axi_path[j].transac_type),
+					cam_cpas_axi_util_drv_vote_lvl_to_string(
+					top_common->last_bw_vote[i].axi_path[j].vote_level),
+					top_common->last_bw_vote[i].axi_path[j].camnoc_bw,
+					top_common->last_bw_vote[i].axi_path[j].mnoc_ab_bw,
+					top_common->last_bw_vote[i].axi_path[j].mnoc_ib_bw);
+			}
+		}
+	}
+
+	return rc;
+
+}
+
+static int cam_vfe_top_set_hw_clk_rate(struct cam_vfe_top_priv_common *top_common,
+	unsigned long final_clk_rate, bool start_stop, uint64_t request_id, bool is_drv_config_en)
+{
+	struct cam_hw_soc_info        *soc_info = NULL;
+	struct cam_vfe_soc_private    *soc_private = NULL;
+	struct cam_ahb_vote            ahb_vote;
+	int rc = 0, clk_lvl = -1;
+	unsigned long cesta_clk_rate_high = 0, cesta_clk_rate_low = 0;
+	int cesta_client_idx = -1;
+	uint32_t lowest_clk_lvl;
+
+	soc_info = top_common->soc_info;
+	soc_private = (struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	lowest_clk_lvl = soc_info->lowest_clk_level;
+	cesta_clk_rate_high = final_clk_rate;
+	cesta_clk_rate_low = final_clk_rate;
+
+	if (soc_info->is_clk_drv_en) {
+		cesta_client_idx = top_common->hw_idx;
+		if (is_drv_config_en)
+			cesta_clk_rate_low =
+				soc_info->clk_rate[lowest_clk_lvl][soc_info->src_clk_idx];
+		else
+			cesta_clk_rate_low = final_clk_rate;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"Applying VFE:%d Clock name=%s idx=%d cesta_client_idx:%d req clk[high low]=[%lu %lu] req_id=%ld",
+		top_common->hw_idx, soc_info->clk_name[soc_info->src_clk_idx],
+		soc_info->src_clk_idx, cesta_client_idx, cesta_clk_rate_high, cesta_clk_rate_low,
+		(start_stop ? -1 : request_id));
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, cesta_client_idx, cesta_clk_rate_high,
+		cesta_clk_rate_low);
+	if (!rc) {
+		top_common->applied_clk_rate = cesta_clk_rate_high;
+		rc = cam_soc_util_get_clk_level(soc_info, cesta_clk_rate_low,
+			soc_info->src_clk_idx, &clk_lvl);
+		if (rc) {
+			CAM_WARN(CAM_ISP,
+				"Failed to get clk level for %s with clk_rate %lu src_idx %d rc %d",
+				soc_info->dev_name, cesta_clk_rate_high,
+				soc_info->src_clk_idx, rc);
+			rc = 0;
+			goto end;
+		}
+
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = clk_lvl;
+		cam_cpas_update_ahb_vote(soc_private->cpas_handle, &ahb_vote);
+	} else {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d cesta_client_idx:%d Failed to set the req clk rate[high low]: [%llu %llu] rc:%d",
+			top_common->hw_idx, cesta_client_idx, cesta_clk_rate_high,
+			cesta_clk_rate_low, rc);
+	}
+
+end:
+	return rc;
+}
+
+static inline void cam_vfe_top_delay_clk_reduction(
+	struct cam_vfe_top_priv_common *top_common,
+	unsigned long *max_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ; i++) {
+		if (top_common->last_clk_vote[i] > *max_clk)
+			*max_clk = top_common->last_clk_vote[i];
+	}
+}
+
+static int cam_vfe_top_calc_hw_clk_rate(
+	struct cam_vfe_top_priv_common *top_common, bool start_stop,
+	unsigned long *final_clk_rate, uint64_t request_id)
+{
+	int                            i, rc = 0;
+	unsigned long                  max_req_clk_rate = 0;
+
+	for (i = 0; i < top_common->num_mux; i++) {
+		if (top_common->req_clk_rate[i] > max_req_clk_rate)
+			max_req_clk_rate = top_common->req_clk_rate[i];
+	}
+
+	if (start_stop && !top_common->skip_data_rst_on_stop) {
+		/* need to vote current clk immediately */
+		*final_clk_rate = max_req_clk_rate;
+		/* Reset everything, we can start afresh */
+		memset(top_common->last_clk_vote, 0, sizeof(uint64_t) *
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ);
+		top_common->last_clk_counter = 0;
+		top_common->last_clk_vote[top_common->last_clk_counter] = max_req_clk_rate;
+		top_common->last_clk_counter = (top_common->last_clk_counter + 1) %
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ;
+	} else {
+		top_common->last_clk_vote[top_common->last_clk_counter] =
+			max_req_clk_rate;
+		top_common->last_clk_counter = (top_common->last_clk_counter + 1) %
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ;
+
+		/* Find max clk request in last few requests */
+		cam_vfe_top_delay_clk_reduction(top_common, final_clk_rate);
+		if (!(*final_clk_rate)) {
+			CAM_ERR(CAM_PERF, "Final clock rate is zero");
+			return -EINVAL;
+		}
+	}
+
+	if (*final_clk_rate == top_common->applied_clk_rate)
+		top_common->clk_state = CAM_CLK_BW_STATE_UNCHANGED;
+	else if (*final_clk_rate > top_common->applied_clk_rate)
+		top_common->clk_state = CAM_CLK_BW_STATE_INCREASE;
+	else
+		top_common->clk_state = CAM_CLK_BW_STATE_DECREASE;
+
+	CAM_DBG(CAM_PERF, "VFE:%d Clock state:%s applied_clk_rate:%llu req_id:%ld",
+		top_common->hw_idx, cam_vfe_top_clk_bw_state_to_string(top_common->clk_state),
+		top_common->applied_clk_rate, (start_stop ? -1 : request_id));
+
+	return rc;
+}
+
+int cam_vfe_top_clock_update(struct cam_vfe_top_priv_common *top_common,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_clock_update_args     *clk_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	int                                   i;
+
+	clk_update =
+		(struct cam_vfe_clock_update_args *)cmd_args;
+	res = clk_update->node_res;
+
+	if (!res || !res->hw_intf->hw_priv) {
+		CAM_ERR(CAM_PERF, "Invalid input res %pK", res);
+		return -EINVAL;
+	}
+
+	if (res->res_type != CAM_ISP_RESOURCE_VFE_IN ||
+		res->res_id >= CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_PERF, "VFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_common->num_mux; i++) {
+		if (top_common->mux_rsrc[i].res_id == res->res_id) {
+			top_common->req_clk_rate[i] = clk_update->clk_rate;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static struct cam_axi_vote *cam_vfe_top_delay_bw_reduction(
+	struct cam_vfe_top_priv_common *top_common,
+	uint64_t *to_be_applied_bw)
+{
+	uint32_t i;
+	int vote_idx = -1;
+	uint64_t max_bw = 0;
+
+	for (i = 0; i < CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ; i++) {
+		if (top_common->last_total_bw_vote[i] >= max_bw) {
+			vote_idx = i;
+			max_bw = top_common->last_total_bw_vote[i];
+		}
+	}
+
+	*to_be_applied_bw = max_bw;
+
+	return &top_common->last_bw_vote[vote_idx];
+}
+
+static int cam_vfe_top_calc_axi_bw_vote(
+	struct cam_vfe_top_priv_common *top_common, bool start_stop,
+	struct cam_axi_vote **to_be_applied_axi_vote, uint64_t *total_bw_new_vote,
+	uint64_t request_id)
+{
+	int rc = 0;
+	uint32_t i;
+	uint32_t num_paths = 0;
+	bool bw_unchanged = true;
+	struct cam_axi_vote *final_bw_vote = NULL;
+
+	if (top_common->num_mux > CAM_VFE_TOP_MUX_MAX) {
+		CAM_ERR(CAM_PERF,
+			"Number of Mux exceeds max, # Mux: %d > Limit: %d",
+			top_common->num_mux, CAM_VFE_TOP_MUX_MAX);
+		return -EINVAL;
+	}
+
+	memset(&top_common->agg_incoming_vote, 0, sizeof(struct cam_axi_vote));
+	for (i = 0; i < top_common->num_mux; i++) {
+		if (top_common->axi_vote_control[i] ==
+			CAM_ISP_BW_CONTROL_INCLUDE) {
+			if (num_paths +
+				top_common->req_axi_vote[i].num_paths >
+				CAM_CPAS_MAX_PATHS_PER_CLIENT) {
+				CAM_ERR(CAM_PERF,
+					"Required paths(%d) more than max(%d)",
+					num_paths +
+					top_common->req_axi_vote[i].num_paths,
+					CAM_CPAS_MAX_PATHS_PER_CLIENT);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			memcpy(&top_common->agg_incoming_vote.axi_path[num_paths],
+				&top_common->req_axi_vote[i].axi_path[0],
+				top_common->req_axi_vote[i].num_paths *
+				sizeof(
+				struct cam_cpas_axi_per_path_bw_vote));
+			num_paths += top_common->req_axi_vote[i].num_paths;
+		}
+	}
+
+	top_common->agg_incoming_vote.num_paths = num_paths;
+
+	for (i = 0; i < top_common->agg_incoming_vote.num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"ife[%d] : New BW Vote : counter[%d] [%s][%s][%s] [%llu %llu %llu]",
+			top_common->hw_idx,
+			top_common->last_bw_counter,
+			cam_cpas_axi_util_path_type_to_string(
+			top_common->agg_incoming_vote.axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			top_common->agg_incoming_vote.axi_path[i].transac_type),
+			cam_cpas_axi_util_drv_vote_lvl_to_string(
+			top_common->agg_incoming_vote.axi_path[i].vote_level),
+			top_common->agg_incoming_vote.axi_path[i].camnoc_bw,
+			top_common->agg_incoming_vote.axi_path[i].mnoc_ab_bw,
+			top_common->agg_incoming_vote.axi_path[i].mnoc_ib_bw);
+
+		*total_bw_new_vote += top_common->agg_incoming_vote.axi_path[i].camnoc_bw;
+	}
+
+	memcpy(&top_common->last_bw_vote[top_common->last_bw_counter],
+		&top_common->agg_incoming_vote, sizeof(struct cam_axi_vote));
+	top_common->last_total_bw_vote[top_common->last_bw_counter] = *total_bw_new_vote;
+	top_common->last_bw_counter = (top_common->last_bw_counter + 1) %
+		CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ;
+
+	if (*total_bw_new_vote != top_common->total_bw_applied)
+		bw_unchanged = false;
+
+	CAM_DBG(CAM_PERF,
+		"ife[%d] : applied_total=%lld, new_total=%lld unchanged=%d, start_stop=%d req_id=%ld",
+		top_common->hw_idx, top_common->total_bw_applied,
+		*total_bw_new_vote, bw_unchanged, start_stop, (start_stop ? -1 : request_id));
+
+	if (bw_unchanged) {
+		CAM_DBG(CAM_PERF, "BW config unchanged");
+		*to_be_applied_axi_vote = NULL;
+		top_common->bw_state = CAM_CLK_BW_STATE_UNCHANGED;
+		goto end;
+	}
+
+	if (start_stop) {
+		/* need to vote current request immediately */
+		final_bw_vote = &top_common->agg_incoming_vote;
+		/* Reset everything, we can start afresh */
+		memset(top_common->last_bw_vote, 0, sizeof(struct cam_axi_vote) *
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ);
+		memset(top_common->last_total_bw_vote, 0, sizeof(uint64_t) *
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ);
+		top_common->last_bw_counter = 0;
+		top_common->last_bw_vote[top_common->last_bw_counter] =
+			top_common->agg_incoming_vote;
+		top_common->last_total_bw_vote[top_common->last_bw_counter] = *total_bw_new_vote;
+		top_common->last_bw_counter = (top_common->last_bw_counter + 1) %
+			CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ;
+	} else {
+		/*
+		 * Find max bw request in last few frames. This will be the bw
+		 * that we want to vote to CPAS now.
+		 */
+		final_bw_vote = cam_vfe_top_delay_bw_reduction(top_common, total_bw_new_vote);
+		if (*total_bw_new_vote == 0)
+			CAM_WARN(CAM_PERF, "to_be_applied_axi_vote is 0, req_id:%llu", request_id);
+	}
+
+	for (i = 0; i < final_bw_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"ife[%d] : Apply BW Vote : [%s][%s][%s] [%llu %llu %llu]",
+			top_common->hw_idx,
+			cam_cpas_axi_util_path_type_to_string(
+			final_bw_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			final_bw_vote->axi_path[i].transac_type),
+			cam_cpas_axi_util_drv_vote_lvl_to_string(
+			final_bw_vote->axi_path[i].vote_level),
+			final_bw_vote->axi_path[i].camnoc_bw,
+			final_bw_vote->axi_path[i].mnoc_ab_bw,
+			final_bw_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	if (*total_bw_new_vote == top_common->total_bw_applied) {
+		CAM_DBG(CAM_PERF, "VFE:%d Final BW Unchanged after delay", top_common->hw_idx);
+		top_common->bw_state = CAM_CLK_BW_STATE_UNCHANGED;
+		*to_be_applied_axi_vote = NULL;
+		goto end;
+	} else if (*total_bw_new_vote > top_common->total_bw_applied) {
+		top_common->bw_state = CAM_CLK_BW_STATE_INCREASE;
+	} else {
+		top_common->bw_state = CAM_CLK_BW_STATE_DECREASE;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"ife[%d] : Delayed update: applied_total=%lld new_total=%lld start_stop=%d bw_state=%s req_id=%ld",
+		top_common->hw_idx, top_common->total_bw_applied,
+		*total_bw_new_vote, start_stop,
+		cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+		(start_stop ? -1 : request_id));
+
+	*to_be_applied_axi_vote = final_bw_vote;
+
+end:
+	return rc;
+}
+
+int cam_vfe_top_bw_update_v2(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bw_update_args_v2        *bw_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_update = (struct cam_vfe_bw_update_args_v2 *)cmd_args;
+	res = bw_update->node_res;
+
+	if (!res || !res->hw_intf || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	if (res->res_type != CAM_ISP_RESOURCE_VFE_IN ||
+		res->res_id >= CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "VFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_common->num_mux; i++) {
+		if (top_common->mux_rsrc[i].res_id == res->res_id) {
+			memcpy(&top_common->req_axi_vote[i],
+				&bw_update->isp_vote,
+				sizeof(struct cam_axi_vote));
+			top_common->axi_vote_control[i] =
+				CAM_ISP_BW_CONTROL_INCLUDE;
+			break;
+		}
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_bw_update(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bw_update_args        *bw_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	int                                   rc = 0;
+	int                                   i;
+	struct cam_axi_vote                  *mux_axi_vote;
+
+	bw_update = (struct cam_vfe_bw_update_args *)cmd_args;
+	res = bw_update->node_res;
+
+	if (!res || !res->hw_intf || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+
+	CAM_DBG(CAM_PERF, "res_id=%d, BW=[%lld %lld]",
+		res->res_id, bw_update->camnoc_bw_bytes,
+		bw_update->external_bw_bytes);
+
+	if (res->res_type != CAM_ISP_RESOURCE_VFE_IN ||
+		res->res_id >= CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "VFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_common->num_mux; i++) {
+		mux_axi_vote = &top_common->req_axi_vote[i];
+		if (top_common->mux_rsrc[i].res_id == res->res_id) {
+			mux_axi_vote->num_paths = 1;
+			if ((res->res_id >= CAM_ISP_HW_VFE_IN_RDI0) &&
+				(res->res_id <= CAM_ISP_HW_VFE_IN_RDI5)) {
+				mux_axi_vote->axi_path[0].path_data_type =
+					CAM_AXI_PATH_DATA_IFE_RDI0 +
+					(res->res_id - CAM_ISP_HW_VFE_IN_RDI0);
+			} else {
+				/*
+				 * Vote all bw into VIDEO path as we cannot
+				 * differentiate to which path this has to go
+				 */
+				mux_axi_vote->axi_path[0].path_data_type =
+					CAM_AXI_PATH_DATA_IFE_VID;
+			}
+
+			mux_axi_vote->axi_path[0].transac_type =
+				CAM_AXI_TRANSACTION_WRITE;
+			mux_axi_vote->axi_path[0].camnoc_bw =
+				bw_update->camnoc_bw_bytes;
+			mux_axi_vote->axi_path[0].mnoc_ab_bw =
+				bw_update->external_bw_bytes;
+			mux_axi_vote->axi_path[0].mnoc_ib_bw =
+				bw_update->external_bw_bytes;
+
+			top_common->axi_vote_control[i] =
+				CAM_ISP_BW_CONTROL_INCLUDE;
+			break;
+		}
+
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_bw_control(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_bw_control_args       *bw_ctrl = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_ctrl = (struct cam_isp_bw_control_args *)cmd_args;
+	res = bw_ctrl->node_res;
+
+	if (!res || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_VFE_IN ||
+		res->res_id >= CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "VFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_common->num_mux; i++) {
+		if (top_common->mux_rsrc[i].res_id == res->res_id) {
+			top_common->axi_vote_control[i] = bw_ctrl->action;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_PERF,
+			"VFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_vfe_top_apply_bw_start_stop(top_common);
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_apply_clk_bw_update(struct cam_vfe_top_priv_common *top_common,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                   *hw_info = NULL;
+	struct cam_hw_intf                   *hw_intf = NULL;
+	struct cam_axi_vote *to_be_applied_axi_vote = NULL;
+	struct cam_isp_apply_clk_bw_args *clk_bw_args = NULL;
+	unsigned long                         final_clk_rate = 0;
+	uint64_t                              total_bw_new_vote = 0;
+	uint64_t                              request_id;
+	int rc = 0;
+
+	if (arg_size != sizeof(struct cam_isp_apply_clk_bw_args)) {
+		CAM_ERR(CAM_ISP, "Invalid arg size: %u", arg_size);
+		return -EINVAL;
+	}
+
+	clk_bw_args = (struct cam_isp_apply_clk_bw_args *)cmd_args;
+	request_id = clk_bw_args->request_id;
+	hw_intf = clk_bw_args->hw_intf;
+	if (!hw_intf) {
+		CAM_ERR(CAM_PERF, "Invalid hw_intf");
+		return -EINVAL;
+	}
+
+	hw_info = hw_intf->hw_priv;
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_DBG(CAM_PERF,
+			"VFE:%d Not ready to set clocks yet :%d",
+			hw_intf->hw_idx, hw_info->hw_state);
+		goto end;
+	}
+
+	if (clk_bw_args->skip_clk_data_rst) {
+		top_common->skip_data_rst_on_stop = true;
+		CAM_DBG(CAM_ISP, "VFE:%u requested to avoid clk data rst", hw_intf->hw_idx);
+		return 0;
+	}
+
+	rc = cam_vfe_top_calc_hw_clk_rate(top_common, false, &final_clk_rate, request_id);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d Failed in calculating clock rate rc=%d",
+			hw_intf->hw_idx, rc);
+		goto end;
+	}
+
+	rc = cam_vfe_top_calc_axi_bw_vote(top_common, false,
+		&to_be_applied_axi_vote, &total_bw_new_vote, request_id);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "VFE:%d Failed in calculating bw vote rc=%d",
+			hw_intf->hw_idx, rc);
+		goto end;
+	}
+
+	if ((!to_be_applied_axi_vote) && (top_common->bw_state != CAM_CLK_BW_STATE_UNCHANGED)) {
+		CAM_ERR(CAM_PERF, "VFE:%d Invalid BW vote for state:%s", hw_intf->hw_idx,
+			cam_vfe_top_clk_bw_state_to_string(top_common->bw_state));
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"VFE:%d APPLY CLK/BW req_id:%ld clk_state:%s bw_state:%s is_drv_config_en:%s",
+		hw_intf->hw_idx, request_id,
+		cam_vfe_top_clk_bw_state_to_string(top_common->clk_state),
+		cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+		CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+
+	/* Determine BW and clock voting sequence according to state */
+	if ((top_common->clk_state == CAM_CLK_BW_STATE_UNCHANGED) &&
+		(top_common->bw_state == CAM_CLK_BW_STATE_UNCHANGED)) {
+		goto end;
+	} else if (top_common->clk_state == CAM_CLK_BW_STATE_UNCHANGED) {
+		rc = cam_vfe_top_set_axi_bw_vote(top_common, to_be_applied_axi_vote,
+			total_bw_new_vote, false, request_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in voting final bw:%llu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, total_bw_new_vote,
+				cam_vfe_top_clk_bw_state_to_string(top_common->clk_state),
+				cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+	} else if (top_common->bw_state == CAM_CLK_BW_STATE_UNCHANGED) {
+		rc = cam_vfe_top_set_hw_clk_rate(top_common, final_clk_rate, false, request_id,
+			clk_bw_args->is_drv_config_en);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in voting final clk:%lu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, final_clk_rate,
+				cam_vfe_top_clk_bw_state_to_string(top_common->clk_state),
+				cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+	} else if (top_common->clk_state == CAM_CLK_BW_STATE_INCREASE) {
+		/* Set BW first, followed by Clock */
+		rc = cam_vfe_top_set_axi_bw_vote(top_common, to_be_applied_axi_vote,
+			total_bw_new_vote, false, request_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in voting final bw:%llu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, total_bw_new_vote,
+				cam_vfe_top_clk_bw_state_to_string(top_common->clk_state),
+				cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+
+		rc = cam_vfe_top_set_hw_clk_rate(top_common, final_clk_rate, false, 0,
+			clk_bw_args->is_drv_config_en);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in voting final clk:%lu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, final_clk_rate,
+				cam_vfe_top_clk_bw_state_to_string(top_common->clk_state),
+				cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+	} else if (top_common->clk_state == CAM_CLK_BW_STATE_DECREASE) {
+		/* Set Clock first, followed by BW */
+		rc = cam_vfe_top_set_hw_clk_rate(top_common, final_clk_rate, false, request_id,
+			clk_bw_args->is_drv_config_en);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in voting final clk:%lu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, final_clk_rate,
+				cam_vfe_top_clk_bw_state_to_string(top_common->clk_state),
+				cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+
+		rc = cam_vfe_top_set_axi_bw_vote(top_common, to_be_applied_axi_vote,
+			total_bw_new_vote, false, request_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in voting final bw:%llu clk_state:%s bw_state:%s is_drv_config_en:%s",
+				hw_intf->hw_idx, total_bw_new_vote,
+				cam_vfe_top_clk_bw_state_to_string(top_common->clk_state),
+				cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+				CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+			goto end;
+		}
+	} else {
+		CAM_ERR(CAM_ISP,
+			"Invalid state to apply CLK/BW clk_state:%s bw_state:%s is_drv_config_en:%s",
+			cam_vfe_top_clk_bw_state_to_string(top_common->clk_state),
+			cam_vfe_top_clk_bw_state_to_string(top_common->bw_state),
+			CAM_BOOL_TO_YESNO(clk_bw_args->is_drv_config_en));
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (top_common->clk_state != CAM_CLK_BW_STATE_UNCHANGED)
+		clk_bw_args->clock_updated = true;
+
+end:
+	top_common->clk_state = CAM_CLK_BW_STATE_INIT;
+	top_common->bw_state = CAM_CLK_BW_STATE_INIT;
+	return rc;
+}
+
+int cam_vfe_top_apply_clock_start_stop(struct cam_vfe_top_priv_common *top_common)
+{
+	int rc = 0;
+	unsigned long final_clk_rate = 0;
+
+	rc = cam_vfe_top_calc_hw_clk_rate(top_common, true, &final_clk_rate, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d Failed in calculating clock rate rc=%d",
+			top_common->hw_idx, rc);
+		goto end;
+	}
+
+	if (top_common->clk_state == CAM_CLK_BW_STATE_UNCHANGED)
+		goto end;
+
+	rc = cam_vfe_top_set_hw_clk_rate(top_common, final_clk_rate, true, 0, false);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "VFE:%d Failed in voting final clk:%lu clk_state:%s",
+			top_common->hw_idx, final_clk_rate,
+			cam_vfe_top_clk_bw_state_to_string(top_common->clk_state));
+		goto end;
+	}
+
+end:
+	top_common->clk_state = CAM_CLK_BW_STATE_INIT;
+	top_common->skip_data_rst_on_stop = false;
+	return rc;
+}
+
+int cam_vfe_top_apply_bw_start_stop(struct cam_vfe_top_priv_common *top_common)
+{
+	int rc = 0;
+	uint64_t total_bw_new_vote = 0;
+	struct cam_axi_vote *to_be_applied_axi_vote = NULL;
+
+	rc = cam_vfe_top_calc_axi_bw_vote(top_common, true, &to_be_applied_axi_vote,
+		&total_bw_new_vote, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "VFE:%d Failed in calculating bw vote rc=%d",
+			top_common->hw_idx, rc);
+		goto end;
+	}
+
+	if (top_common->bw_state == CAM_CLK_BW_STATE_UNCHANGED)
+		goto end;
+
+	rc = cam_vfe_top_set_axi_bw_vote(top_common, to_be_applied_axi_vote, total_bw_new_vote,
+		true, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "VFE:%d Failed in voting final bw:%llu bw_state:%s",
+			top_common->hw_idx, total_bw_new_vote,
+			cam_vfe_top_clk_bw_state_to_string(top_common->bw_state));
+		goto end;
+	}
+
+end:
+	top_common->bw_state = CAM_CLK_BW_STATE_INIT;
+	return rc;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.h
@@ -0,0 +1,91 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_TOP_COMMON_H_
+#define _CAM_VFE_TOP_COMMON_H_
+
+#define CAM_VFE_TOP_MUX_MAX 7
+
+#include "cam_cpas_api.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+
+#define CAM_VFE_TOP_MAX_REG_DUMP_ENTRIES 70
+
+#define CAM_VFE_TOP_MAX_LUT_DUMP_ENTRIES 6
+
+struct cam_vfe_top_priv_common {
+	struct cam_isp_resource_node    mux_rsrc[CAM_VFE_TOP_MUX_MAX];
+	uint32_t                        num_mux;
+	uint32_t                        hw_idx;
+	struct cam_axi_vote             applied_axi_vote;
+	struct cam_axi_vote             agg_incoming_vote;
+	struct cam_axi_vote             req_axi_vote[CAM_VFE_TOP_MUX_MAX];
+	struct cam_axi_vote             last_bw_vote[CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ];
+	uint64_t                        last_total_bw_vote[CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ];
+	uint32_t                        last_bw_counter;
+	unsigned long                   last_clk_vote[CAM_DELAY_CLK_BW_REDUCTION_NUM_REQ];
+	uint32_t                        last_clk_counter;
+	uint64_t                        total_bw_applied;
+	enum cam_clk_bw_state           clk_state;
+	enum cam_clk_bw_state           bw_state;
+	uint32_t                        hw_version;
+	enum cam_isp_bw_control_action  axi_vote_control[CAM_VFE_TOP_MUX_MAX];
+	struct cam_hw_soc_info         *soc_info;
+	unsigned long                   applied_clk_rate;
+	unsigned long                   req_clk_rate[CAM_VFE_TOP_MUX_MAX];
+	bool                            skip_data_rst_on_stop;
+
+};
+
+struct cam_vfe_top_reg_dump_entry {
+	uint32_t reg_dump_start;
+	uint32_t reg_dump_end;
+};
+
+struct cam_vfe_top_lut_dump_entry {
+	uint32_t lut_word_size;
+	uint32_t lut_bank_sel;
+	uint32_t lut_addr_size;
+};
+
+struct cam_vfe_top_dump_data {
+	uint32_t num_reg_dump_entries;
+	uint32_t num_lut_dump_entries;
+	uint32_t dmi_cfg;
+	uint32_t dmi_addr;
+	uint32_t dmi_data_path_hi;
+	uint32_t dmi_data_path_lo;
+	struct cam_vfe_top_reg_dump_entry
+		reg_entry[CAM_VFE_TOP_MAX_REG_DUMP_ENTRIES];
+	struct cam_vfe_top_lut_dump_entry
+		lut_entry[CAM_VFE_TOP_MAX_LUT_DUMP_ENTRIES];
+};
+
+int cam_vfe_top_clock_update(struct cam_vfe_top_priv_common *top_common,
+	void *cmd_args, uint32_t arg_size);
+
+int cam_vfe_top_bw_update_v2(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size);
+
+int cam_vfe_top_bw_update(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size);
+
+int cam_vfe_top_bw_control(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size);
+
+int cam_vfe_top_apply_clk_bw_update(
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size);
+
+int cam_vfe_top_apply_clock_start_stop(struct cam_vfe_top_priv_common *top_common);
+
+int cam_vfe_top_apply_bw_start_stop(struct cam_vfe_top_priv_common *top_common);
+
+#endif /* _CAM_VFE_TOP_COMMON_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.c
@@ -0,0 +1,1003 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_io_util.h"
+#include "cam_cdm_util.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_debug_util.h"
+#include "cam_vfe_soc.h"
+
+#define CAM_VFE_HW_RESET_HW_AND_REG_VAL       0x00003F9F
+#define CAM_VFE_HW_RESET_HW_VAL               0x00003F87
+
+struct cam_vfe_top_ver2_common_data {
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_vfe_top_ver2_reg_offset_common  *common_reg;
+	struct cam_vfe_top_dump_data               *dump_data;
+};
+
+struct cam_vfe_top_ver2_priv {
+	struct cam_vfe_top_ver2_common_data common_data;
+	struct cam_vfe_top_priv_common      top_common;
+};
+
+static int cam_vfe_top_mux_get_base(struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error! Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(
+		top_priv->top_common.soc_info, VFE_CORE_BASE_IDX);
+	if (mem_base == -1) {
+		CAM_ERR(CAM_ISP, "failed to get mem_base, index: %d num_reg_map: %u",
+			VFE_CORE_BASE_IDX, top_priv->top_common.soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "core %d mem_base 0x%x",
+		top_priv->top_common.soc_info->index, mem_base);
+
+	cdm_util_ops->cdm_write_changebase(
+	cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_fs_update(
+	struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_fe_update_args *cmd_update = cmd_args;
+
+	if (cmd_update->node_res->process_cmd)
+		return cmd_update->node_res->process_cmd(cmd_update->node_res,
+			CAM_ISP_HW_CMD_FE_UPDATE_IN_RD, cmd_args, arg_size);
+
+	return 0;
+}
+
+static int cam_vfe_top_dump_info(
+	struct cam_vfe_top_ver2_priv *top_priv, uint32_t cmd_type)
+{
+	struct cam_hw_soc_info *soc_info = top_priv->top_common.soc_info;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Null soc_info");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "VFE%d src_clk_rate:%luHz",
+			soc_info->index, soc_info->applied_src_clk_rates.sw_client);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "cmd_type: %u not supported", cmd_type);
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_vfe_top_blanking_update(uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_blanking_config       *blanking_config = NULL;
+	struct cam_isp_resource_node         *node_res = NULL;
+
+	blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+	node_res = blanking_config->node_res;
+
+	if (!node_res) {
+		CAM_ERR(CAM_PERF, "Invalid input res %pK", node_res);
+		return -EINVAL;
+	}
+
+	if (!node_res->process_cmd) {
+		CAM_ERR(CAM_PERF, "Invalid input res process_cmd %pK",
+			node_res->process_cmd);
+		return -EINVAL;
+	}
+
+	return node_res->process_cmd(node_res,
+		cmd_type, cmd_args, arg_size);
+}
+
+static int cam_vfe_top_mux_get_reg_update(
+	struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update  *cmd_update = cmd_args;
+
+	if (cmd_update->res->process_cmd)
+		return cmd_update->res->process_cmd(cmd_update->res,
+			CAM_ISP_HW_CMD_GET_REG_UPDATE, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_top_wait_comp_event(struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error! Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_comp_wait();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	cdm_util_ops->cdm_write_wait_comp_event(cdm_args->cmd.cmd_buf_addr,
+		0, 0x2);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_add_wait_trigger(struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error! Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	reg_val_pair[0] = 0x90;
+	reg_val_pair[1] = 0x1;
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_get_data(
+	struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node  *res = cmd_args;
+
+	if (res->process_cmd)
+		return res->process_cmd(res,
+			CAM_ISP_HW_CMD_CAMIF_DATA, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+int cam_vfe_top_get_hw_caps(void *device_priv,
+	void *args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_get_hw_cap *vfe_cap_info = NULL;
+	struct cam_vfe_top_ver2_priv *vfe_top_prv = NULL;
+	struct cam_vfe_soc_private *vfe_soc_private = NULL;
+
+	if (!device_priv || !args) {
+		CAM_ERR(CAM_ISP,
+			"Invalid arguments device_priv:%p, args:%p",
+			device_priv, args);
+		return -EINVAL;
+	}
+
+	vfe_cap_info = (struct cam_vfe_hw_get_hw_cap *)args;
+	vfe_top_prv = (struct cam_vfe_top_ver2_priv *)device_priv;
+
+	if (!vfe_top_prv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "soc_info is null");
+		return -EFAULT;
+	}
+
+	vfe_soc_private = (struct cam_vfe_soc_private *)
+		vfe_top_prv->top_common.soc_info->soc_private;
+
+	vfe_cap_info->is_lite = (vfe_soc_private->is_ife_lite) ? true : false;
+	vfe_cap_info->incr =
+		(vfe_top_prv->top_common.hw_version) & 0x00ffff;
+	vfe_cap_info->minor =
+		((vfe_top_prv->top_common.hw_version) >> 16) & 0x0fff;
+	vfe_cap_info->major =
+		((vfe_top_prv->top_common.hw_version) >> 28) & 0x000f;
+
+	return 0;
+}
+
+static int cam_vfe_hw_dump(
+	struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args,
+	uint32_t arg_size)
+{
+	int                                i, j;
+	uint8_t                           *dst;
+	uint32_t                           reg_start_offset;
+	uint32_t                           reg_dump_size = 0;
+	uint32_t                           lut_dump_size = 0;
+	uint32_t                           val;
+	uint32_t                           num_reg;
+	void __iomem                      *reg_base;
+	uint32_t                          *addr, *start;
+	size_t                             remain_len;
+	uint32_t                           min_len;
+	struct cam_hw_soc_info            *soc_info;
+	struct cam_vfe_top_dump_data      *dump_data;
+	struct cam_isp_hw_dump_header     *hdr;
+	struct cam_isp_hw_dump_args       *dump_args =
+		(struct cam_isp_hw_dump_args *)cmd_args;
+
+	if (!dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+	if (!dump_args->cpu_addr || !dump_args->buf_len) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params %pK %zu",
+			(void *)dump_args->cpu_addr,
+			dump_args->buf_len);
+		return -EINVAL;
+	}
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ISP,
+			"Dump offset overshoot offset %zu buf_len %zu",
+			dump_args->offset, dump_args->buf_len);
+		return -ENOSPC;
+	}
+	dump_data = top_priv->common_data.dump_data;
+	if (!dump_data) {
+		CAM_ERR(CAM_ISP, "Dump data not available");
+		return -EINVAL;
+	}
+
+	soc_info = top_priv->top_common.soc_info;
+
+	/*Dump registers */
+	for (i = 0; i < dump_data->num_reg_dump_entries; i++)
+		reg_dump_size += (dump_data->reg_entry[i].reg_dump_end -
+			dump_data->reg_entry[i].reg_dump_start);
+	/*
+	 * We dump the offset as well, so the total size dumped becomes
+	 * multiplied by 2
+	 */
+	reg_dump_size *= 2;
+	for (i = 0; i < dump_data->num_lut_dump_entries; i++)
+		lut_dump_size += ((dump_data->lut_entry[i].lut_addr_size) *
+			(dump_data->lut_entry[i].lut_word_size/8));
+
+	/*Minimum len comprises of:
+	 * soc_index
+	 * lut_dump_size + reg_dump_size + sizeof dump_header +
+	 * (num_lut_dump_entries--> represents number of banks)
+	 */
+	min_len = sizeof(uint32_t) + lut_dump_size + reg_dump_size +
+		sizeof(struct cam_isp_hw_dump_header) +
+		(dump_data->num_lut_dump_entries * sizeof(uint32_t));
+	remain_len = dump_args->buf_len - dump_args->offset;
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu, min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	hdr->word_size = sizeof(uint32_t);
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "VFE_REG:");
+	addr = (uint32_t *)(dst + sizeof(struct cam_isp_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+	for (i = 0; i < dump_data->num_reg_dump_entries; i++) {
+		num_reg  = (dump_data->reg_entry[i].reg_dump_end -
+			dump_data->reg_entry[i].reg_dump_start)/4;
+		reg_start_offset = dump_data->reg_entry[i].reg_dump_start;
+		reg_base = soc_info->reg_map[0].mem_base + reg_start_offset;
+		for (j = 0; j < num_reg; j++) {
+			addr[0] = soc_info->mem_block[0]->start +
+				reg_start_offset + (j*4);
+			addr[1] = cam_io_r(reg_base + (j*4));
+			addr += 2;
+		}
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+
+	/*dump LUT*/
+	for (i = 0; i < dump_data->num_lut_dump_entries; i++) {
+
+		dst = (char *)dump_args->cpu_addr + dump_args->offset;
+		hdr = (struct cam_isp_hw_dump_header *)dst;
+		scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "LUT_REG:");
+		hdr->word_size = dump_data->lut_entry[i].lut_word_size/8;
+		addr = (uint32_t *)(dst +
+			sizeof(struct cam_isp_hw_dump_header));
+		start = addr;
+		*addr++ = dump_data->lut_entry[i].lut_bank_sel;
+		val = 0x100 |  dump_data->lut_entry[i].lut_bank_sel;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			dump_data->dmi_cfg);
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			dump_data->dmi_addr);
+		for (j = 0; j < dump_data->lut_entry[i].lut_addr_size;
+			j++) {
+			if (dump_data->lut_entry[i].lut_word_size == 64) {
+				addr[0] = cam_io_r(
+					soc_info->reg_map[0].mem_base +
+					dump_data->dmi_data_path_lo);
+				addr[1] = cam_io_r(
+					soc_info->reg_map[0].mem_base +
+					dump_data->dmi_data_path_hi);
+				addr += 2;
+			} else {
+				*addr = cam_io_r(
+					soc_info->reg_map[0].mem_base +
+					dump_data->dmi_data_path_lo);
+				addr++;
+			}
+		}
+		hdr->size = hdr->word_size * (addr - start);
+		dump_args->offset +=  hdr->size +
+			sizeof(struct cam_isp_hw_dump_header);
+	}
+	CAM_DBG(CAM_ISP, "offset %zu", dump_args->offset);
+	return 0;
+}
+
+int cam_vfe_top_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv   *top_priv = device_priv;
+	struct cam_vfe_top_ver2_common_data common_data = top_priv->common_data;
+
+	top_priv->top_common.applied_clk_rate = 0;
+
+	top_priv->top_common.hw_version =
+		cam_io_r_mb(top_priv->top_common.soc_info->reg_map[0].mem_base +
+		common_data.common_reg->hw_version);
+
+	return 0;
+}
+
+int cam_vfe_top_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv   *top_priv = device_priv;
+	struct cam_hw_soc_info         *soc_info = NULL;
+	struct cam_vfe_top_ver2_reg_offset_common *reg_common = NULL;
+	uint32_t *reset_reg_args = reset_core_args;
+	uint32_t reset_reg_val;
+
+	if (!top_priv || !reset_reg_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	switch (*reset_reg_args) {
+	case CAM_VFE_HW_RESET_HW_AND_REG:
+		reset_reg_val = CAM_VFE_HW_RESET_HW_AND_REG_VAL;
+		break;
+	default:
+		reset_reg_val = CAM_VFE_HW_RESET_HW_VAL;
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "reset reg value: %x", reset_reg_val);
+	soc_info = top_priv->top_common.soc_info;
+	reg_common = top_priv->common_data.common_reg;
+
+	/* Mask All the IRQs except RESET */
+	cam_io_w_mb((1 << 31),
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX) + 0x5C);
+
+	/* Reset HW */
+	cam_io_w_mb(reset_reg_val,
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX) +
+		reg_common->global_reset_cmd);
+
+	CAM_DBG(CAM_ISP, "Reset HW exit");
+	return 0;
+}
+
+int cam_vfe_top_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv            *top_priv;
+	struct cam_vfe_acquire_args             *args;
+	struct cam_vfe_hw_vfe_in_acquire_args   *acquire_args;
+	uint32_t i;
+	int rc = -EINVAL;
+
+	if (!device_priv || !reserve_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver2_priv   *)device_priv;
+	args = (struct cam_vfe_acquire_args *)reserve_args;
+	acquire_args = &args->vfe_in;
+
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->top_common.mux_rsrc[i].res_id ==
+			acquire_args->res_id &&
+			top_priv->top_common.mux_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+
+			if (acquire_args->res_id == CAM_ISP_HW_VFE_IN_CAMIF) {
+				rc = cam_vfe_camif_ver2_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if (acquire_args->res_id ==
+				CAM_ISP_HW_VFE_IN_PDLIB) {
+				rc = cam_vfe_camif_lite_ver2_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if ((acquire_args->res_id >=
+				CAM_ISP_HW_VFE_IN_RDI0) &&
+				(acquire_args->res_id <=
+				CAM_ISP_HW_VFE_IN_RDI3)) {
+				rc = cam_vfe_rdi_ver2_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if (acquire_args->res_id == CAM_ISP_HW_VFE_IN_RD) {
+				rc = cam_vfe_fe_ver1_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			top_priv->top_common.mux_rsrc[i].cdm_ops =
+				acquire_args->cdm_ops;
+			top_priv->top_common.mux_rsrc[i].tasklet_info =
+				args->tasklet;
+			top_priv->top_common.mux_rsrc[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			acquire_args->rsrc_node =
+				&top_priv->top_common.mux_rsrc[i];
+
+			rc = 0;
+			break;
+		}
+	}
+
+	return rc;
+
+}
+
+int cam_vfe_top_release(void *device_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node            *mux_res;
+
+	if (!device_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	mux_res = (struct cam_isp_resource_node *)release_args;
+
+	CAM_DBG(CAM_ISP, "Resource in state %d", mux_res->res_state);
+	if (mux_res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Resource in Invalid res_state :%d",
+			mux_res->res_state);
+		return -EINVAL;
+	}
+	mux_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+int cam_vfe_top_start(void *device_priv,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+	int rc = 0;
+
+	if (!device_priv || !start_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver2_priv *)device_priv;
+	soc_info = top_priv->top_common.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	mux_res = (struct cam_isp_resource_node *)start_args;
+	hw_info = (struct cam_hw_info  *)mux_res->hw_intf->hw_priv;
+
+	if (hw_info->hw_state == CAM_HW_STATE_POWER_UP) {
+		rc = cam_vfe_top_apply_clock_start_stop(&top_priv->top_common);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in applying start clock rc:%d",
+				hw_info->soc_info.index, rc);
+			return rc;
+		}
+
+		rc = cam_vfe_top_apply_bw_start_stop(&top_priv->top_common);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in applying start bw rc:%d",
+				hw_info->soc_info.index, rc);
+			return rc;
+		}
+
+		if (mux_res->start) {
+			rc = mux_res->start(mux_res);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"Invalid res id:%d", mux_res->res_id);
+			rc = -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "VFE HW not powered up");
+		rc = -EPERM;
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+	int i, rc = 0;
+
+	if (!device_priv || !stop_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver2_priv   *)device_priv;
+	mux_res = (struct cam_isp_resource_node *)stop_args;
+	soc_info = top_priv->top_common.soc_info;
+	soc_private = soc_info->soc_private;
+
+	if ((mux_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF) ||
+		(mux_res->res_id == CAM_ISP_HW_VFE_IN_PDLIB) ||
+		(mux_res->res_id == CAM_ISP_HW_VFE_IN_RD) ||
+		((mux_res->res_id >= CAM_ISP_HW_VFE_IN_RDI0) &&
+		(mux_res->res_id <= CAM_ISP_HW_VFE_IN_RDI3))) {
+		rc = mux_res->stop(mux_res);
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res id:%d", mux_res->res_id);
+		return -EINVAL;
+	}
+
+	if (!rc) {
+		for (i = 0; i < top_priv->top_common.num_mux; i++) {
+			if (top_priv->top_common.mux_rsrc[i].res_id ==
+				mux_res->res_id) {
+				top_priv->top_common.req_clk_rate[i] = 0;
+				top_priv->top_common.req_axi_vote[i]
+					.axi_path[0].camnoc_bw = 0;
+				top_priv->top_common.req_axi_vote[i]
+					.axi_path[0].mnoc_ab_bw = 0;
+				top_priv->top_common.req_axi_vote[i]
+					.axi_path[0].mnoc_ib_bw = 0;
+				top_priv->top_common.axi_vote_control[i] =
+					CAM_ISP_BW_CONTROL_EXCLUDE;
+				break;
+			}
+		}
+	}
+	soc_private->ife_clk_src = 0;
+	return rc;
+}
+
+int cam_vfe_top_read(void *device_priv,
+	void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_vfe_top_write(void *device_priv,
+	void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_vfe_top_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_vfe_top_ver2_priv            *top_priv;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+
+	if (!device_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid arguments");
+		return -EINVAL;
+	}
+	top_priv = (struct cam_vfe_top_ver2_priv *)device_priv;
+	soc_info = top_priv->top_common.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_vfe_top_mux_get_base(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_top_mux_get_reg_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+		rc = cam_vfe_top_get_data(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+		rc = cam_vfe_top_clock_update(&top_priv->top_common, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+		rc = cam_vfe_top_dump_info(top_priv, cmd_type);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_IN_RD:
+		rc = cam_vfe_top_fs_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE:
+		rc = cam_vfe_top_bw_update(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+		rc = cam_vfe_top_bw_update_v2(soc_private,
+			&top_priv->top_common, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+		rc = cam_vfe_top_bw_control(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_HW:
+		rc = cam_vfe_hw_dump(top_priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_ADD_WAIT:
+		rc = cam_vfe_top_wait_comp_event(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER:
+		rc = cam_vfe_top_add_wait_trigger(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_top_blanking_update(cmd_type, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE:
+		rc = cam_vfe_top_apply_clk_bw_update(&top_priv->top_common, cmd_args, arg_size);
+		break;
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_ISP, "Error! Invalid cmd:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_ver2_init(
+	struct cam_hw_soc_info                 *soc_info,
+	struct cam_hw_intf                     *hw_intf,
+	void                                   *top_hw_info,
+	void                                   *vfe_irq_controller,
+	struct cam_vfe_top                    **vfe_top_ptr)
+{
+	int i, j, rc = 0;
+	struct cam_vfe_top_ver2_priv           *top_priv = NULL;
+	struct cam_vfe_top_ver2_hw_info        *ver2_hw_info = top_hw_info;
+	struct cam_vfe_top                     *vfe_top;
+
+	vfe_top = kzalloc(sizeof(struct cam_vfe_top), GFP_KERNEL);
+	if (!vfe_top) {
+		CAM_DBG(CAM_ISP, "Error! Failed to alloc for vfe_top");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	top_priv = kzalloc(sizeof(struct cam_vfe_top_ver2_priv),
+		GFP_KERNEL);
+	if (!top_priv) {
+		CAM_DBG(CAM_ISP, "Error! Failed to alloc for vfe_top_priv");
+		rc = -ENOMEM;
+		goto free_vfe_top;
+	}
+
+	vfe_top->top_priv = top_priv;
+	top_priv->top_common.applied_clk_rate = 0;
+	if (ver2_hw_info->num_mux > CAM_VFE_TOP_MUX_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid number of input rsrc: %d, max: %d",
+			ver2_hw_info->num_mux, CAM_VFE_TOP_MUX_MAX);
+		rc = -EINVAL;
+		goto free_top_priv;
+	}
+
+	top_priv->top_common.num_mux = ver2_hw_info->num_mux;
+
+	for (i = 0, j = 0; i < top_priv->top_common.num_mux; i++) {
+		top_priv->top_common.mux_rsrc[i].res_type =
+			CAM_ISP_RESOURCE_VFE_IN;
+		top_priv->top_common.mux_rsrc[i].hw_intf = hw_intf;
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		top_priv->top_common.req_clk_rate[i] = 0;
+
+		if (ver2_hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_2_0) {
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_CAMIF;
+
+			rc = cam_vfe_camif_ver2_init(hw_intf, soc_info,
+				&ver2_hw_info->camif_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			if (rc)
+				goto deinit_resources;
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_CAMIF_LITE_VER_2_0) {
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_PDLIB;
+
+			rc = cam_vfe_camif_lite_ver2_init(hw_intf, soc_info,
+				&ver2_hw_info->camif_lite_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+
+			if (rc)
+				goto deinit_resources;
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_RDI_VER_1_0) {
+			/* set the RDI resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_RDI0 + j++;
+
+			rc = cam_vfe_rdi_ver2_init(hw_intf, soc_info,
+				&ver2_hw_info->rdi_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			if (rc)
+				goto deinit_resources;
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			/* set the RD resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_RD;
+
+			rc = cam_vfe_fe_ver1_init(hw_intf, soc_info,
+				&ver2_hw_info->fe_hw_info,
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				goto deinit_resources;
+		} else {
+			CAM_WARN(CAM_ISP, "Invalid mux type: %u",
+				ver2_hw_info->mux_type[i]);
+		}
+	}
+
+	vfe_top->hw_ops.get_hw_caps = cam_vfe_top_get_hw_caps;
+	vfe_top->hw_ops.init        = cam_vfe_top_init_hw;
+	vfe_top->hw_ops.reset       = cam_vfe_top_reset;
+	vfe_top->hw_ops.reserve     = cam_vfe_top_reserve;
+	vfe_top->hw_ops.release     = cam_vfe_top_release;
+	vfe_top->hw_ops.start       = cam_vfe_top_start;
+	vfe_top->hw_ops.stop        = cam_vfe_top_stop;
+	vfe_top->hw_ops.read        = cam_vfe_top_read;
+	vfe_top->hw_ops.write       = cam_vfe_top_write;
+	vfe_top->hw_ops.process_cmd = cam_vfe_top_process_cmd;
+	*vfe_top_ptr = vfe_top;
+
+	top_priv->top_common.soc_info      = soc_info;
+	top_priv->common_data.hw_intf      = hw_intf;
+	top_priv->top_common.hw_idx        = hw_intf->hw_idx;
+	top_priv->common_data.common_reg   = ver2_hw_info->common_reg;
+	top_priv->common_data.dump_data    = ver2_hw_info->dump_data;
+
+	return rc;
+
+deinit_resources:
+	for (--i; i >= 0; i--) {
+		if (ver2_hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_2_0) {
+			if (cam_vfe_camif_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "Camif Deinit failed");
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_CAMIF_LITE_VER_2_0) {
+			if (cam_vfe_camif_lite_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "Camif lite deinit failed");
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			if (cam_vfe_fe_ver1_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "VFE FE deinit failed");
+		} else {
+			if (cam_vfe_rdi_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "RDI Deinit failed");
+		}
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	}
+
+free_top_priv:
+	kfree(vfe_top->top_priv);
+free_vfe_top:
+	kfree(vfe_top);
+end:
+	return rc;
+}
+
+int cam_vfe_top_ver2_deinit(struct cam_vfe_top  **vfe_top_ptr)
+{
+	int i, rc = 0;
+	struct cam_vfe_top_ver2_priv           *top_priv = NULL;
+	struct cam_vfe_top                     *vfe_top;
+
+	if (!vfe_top_ptr) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input");
+		return -EINVAL;
+	}
+
+	vfe_top = *vfe_top_ptr;
+	if (!vfe_top) {
+		CAM_ERR(CAM_ISP, "Error! vfe_top NULL");
+		return -ENODEV;
+	}
+
+	top_priv = vfe_top->top_priv;
+	if (!top_priv) {
+		CAM_ERR(CAM_ISP, "Error! vfe_top_priv NULL");
+		rc = -ENODEV;
+		goto free_vfe_top;
+	}
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+		if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_CAMIF_VER_2_0) {
+			rc = cam_vfe_camif_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Camif deinit failed rc=%d",
+					rc);
+		} else if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_CAMIF_LITE_VER_2_0) {
+			rc = cam_vfe_camif_lite_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Camif lite deinit failed rc=%d", rc);
+		} else if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_RDI_VER_1_0) {
+			rc = cam_vfe_rdi_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "RDI deinit failed rc=%d", rc);
+		} else if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			rc = cam_vfe_fe_ver1_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Camif deinit failed rc=%d",
+					rc);
+		}
+	}
+
+	kfree(vfe_top->top_priv);
+
+free_vfe_top:
+	kfree(vfe_top);
+	*vfe_top_ptr = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.h
@@ -0,0 +1,65 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_TOP_VER2_H_
+#define _CAM_VFE_TOP_VER2_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_camif_lite_ver2.h"
+#include "cam_vfe_rdi.h"
+#include "cam_vfe_fe_ver1.h"
+#include "cam_vfe_top_common.h"
+
+enum cam_vfe_top_ver2_module_type {
+	CAM_VFE_TOP_VER2_MODULE_LENS,
+	CAM_VFE_TOP_VER2_MODULE_STATS,
+	CAM_VFE_TOP_VER2_MODULE_COLOR,
+	CAM_VFE_TOP_VER2_MODULE_ZOOM,
+	CAM_VFE_TOP_VER2_MODULE_MAX,
+};
+
+struct cam_vfe_top_ver2_reg_offset_module_ctrl {
+	uint32_t reset;
+	uint32_t cgc_ovd;
+	uint32_t enable;
+};
+
+struct cam_vfe_top_ver2_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t lens_feature;
+	uint32_t stats_feature;
+	uint32_t color_feature;
+	uint32_t zoom_feature;
+	uint32_t global_reset_cmd;
+	struct cam_vfe_top_ver2_reg_offset_module_ctrl
+		*module_ctrl[CAM_VFE_TOP_VER2_MODULE_MAX];
+	uint32_t bus_cgc_ovd;
+	uint32_t core_cfg;
+	uint32_t three_D_cfg;
+	uint32_t violation_status;
+	uint32_t reg_update_cmd;
+};
+
+struct cam_vfe_top_ver2_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common  *common_reg;
+	struct cam_vfe_camif_ver2_hw_info           camif_hw_info;
+	struct cam_vfe_camif_lite_ver2_hw_info      camif_lite_hw_info;
+	struct cam_vfe_rdi_ver2_hw_info             rdi_hw_info;
+	struct cam_vfe_fe_ver1_hw_info              fe_hw_info;
+	struct cam_vfe_top_dump_data               *dump_data;
+	uint32_t                                    num_mux;
+	uint32_t mux_type[CAM_VFE_TOP_MUX_MAX];
+};
+
+int cam_vfe_top_ver2_init(struct cam_hw_soc_info     *soc_info,
+	struct cam_hw_intf                           *hw_intf,
+	void                                         *top_hw_info,
+	void                                         *vfe_irq_controller,
+	struct cam_vfe_top                          **vfe_top_ptr);
+
+int cam_vfe_top_ver2_deinit(struct cam_vfe_top      **vfe_top);
+
+#endif /* _CAM_VFE_TOP_VER2_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.c
@@ -0,0 +1,956 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_io_util.h"
+#include "cam_cdm_util.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_debug_util.h"
+#include "cam_vfe_soc.h"
+
+#define CAM_VFE_HW_RESET_HW_AND_REG_VAL       0x00000001
+#define CAM_VFE_HW_RESET_HW_VAL               0x00010000
+#define CAM_VFE_LITE_HW_RESET_AND_REG_VAL     0x00000002
+#define CAM_VFE_LITE_HW_RESET_HW_VAL          0x00000001
+#define CAM_CDM_WAIT_COMP_EVENT_BIT           0x2
+
+struct cam_vfe_top_ver3_common_data {
+	struct cam_vfe_top_ver3_hw_info            *hw_info;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_vfe_top_ver3_reg_offset_common  *common_reg;
+};
+
+struct cam_vfe_top_ver3_priv {
+	struct cam_vfe_top_ver3_common_data common_data;
+	struct cam_vfe_top_priv_common      top_common;
+};
+
+static int cam_vfe_top_ver3_get_path_port_map(struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_path_port_map *arg = cmd_args;
+	struct cam_vfe_top_ver3_hw_info *hw_info = top_priv->common_data.hw_info;
+	int i;
+
+	for (i = 0; i < hw_info->num_path_port_map; i++) {
+		arg->entry[i][0] = hw_info->path_port_map[i][0];
+		arg->entry[i][1] = hw_info->path_port_map[i][1];
+	}
+	arg->num_entries = hw_info->num_path_port_map;
+
+	return 0;
+}
+
+static int cam_vfe_top_ver3_mux_get_base(struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error, Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(
+		top_priv->top_common.soc_info, VFE_CORE_BASE_IDX);
+	if (mem_base == -1) {
+		CAM_ERR(CAM_ISP, "failed to get mem_base, index: %d num_reg_map: %u",
+			VFE_CORE_BASE_IDX, top_priv->top_common.soc_info->num_reg_map);
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_ISP, "core %d mem_base 0x%x",
+		top_priv->top_common.soc_info->index, mem_base);
+
+	cdm_util_ops->cdm_write_changebase(
+	cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_fs_update(
+	struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_fe_update_args *cmd_update = cmd_args;
+
+	if (cmd_update->node_res->process_cmd)
+		return cmd_update->node_res->process_cmd(cmd_update->node_res,
+			CAM_ISP_HW_CMD_FE_UPDATE_IN_RD, cmd_args, arg_size);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver3_dump_info(
+	struct cam_vfe_top_ver3_priv *top_priv, uint32_t cmd_type)
+{
+	struct cam_hw_soc_info *soc_info = top_priv->top_common.soc_info;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Null soc_info");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "VFE%d src_clk_rate:%luHz",
+			soc_info->index, soc_info->applied_src_clk_rates.sw_client);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "cmd_type: %u not supported", cmd_type);
+		break;
+	}
+
+	return 0;
+}
+
+
+static int cam_vfe_top_ver3_blanking_update(uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_blanking_config       *blanking_config = NULL;
+	struct cam_isp_resource_node         *node_res = NULL;
+
+	blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+	node_res = blanking_config->node_res;
+
+	if (!node_res) {
+		CAM_ERR(CAM_PERF, "Invalid input res %pK", node_res);
+		return -EINVAL;
+	}
+
+	if (!node_res->process_cmd) {
+		CAM_ERR(CAM_PERF, "Invalid input res process_cmd %pK",
+			node_res->process_cmd);
+		return -EINVAL;
+	}
+
+	return node_res->process_cmd(node_res,
+		cmd_type, cmd_args, arg_size);
+}
+
+static int cam_vfe_core_config_control(
+	struct cam_vfe_top_ver3_priv *top_priv,
+	 void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_core_config_args  *core_config = cmd_args;
+
+	if (core_config->node_res->process_cmd)
+		return core_config->node_res->process_cmd(core_config->node_res,
+			CAM_ISP_HW_CMD_CORE_CONFIG, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_top_ver3_mux_get_reg_update(
+	struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update  *cmd_update = cmd_args;
+
+	if (cmd_update->res->process_cmd)
+		return cmd_update->res->process_cmd(cmd_update->res,
+			CAM_ISP_HW_CMD_GET_REG_UPDATE, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_top_wait_comp_event(struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error, Invalid arg size = %d expected = %d",
+			arg_size, sizeof(struct cam_isp_hw_get_cmd_update));
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_comp_wait();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	cdm_util_ops->cdm_write_wait_comp_event(cdm_args->cmd.cmd_buf_addr,
+		0, CAM_CDM_WAIT_COMP_EVENT_BIT);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_add_wait_trigger(struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_vfe_top_ver3_reg_offset_common *reg_common = NULL;
+	uint32_t set_cdm_trigger_event;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error, Invalid arg size = %d expected = %d",
+			arg_size, sizeof(struct cam_isp_hw_get_cmd_update));
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	if (cdm_args->trigger_cdm_en == true)
+		set_cdm_trigger_event = 1;
+	else
+		set_cdm_trigger_event = 0;
+
+	reg_common = top_priv->common_data.common_reg;
+	reg_val_pair[0] = reg_common->trigger_cdm_events;
+	reg_val_pair[1] = set_cdm_trigger_event;
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver3_get_data(
+	struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node  *res = cmd_args;
+
+	if (res->process_cmd)
+		return res->process_cmd(res,
+			CAM_ISP_HW_CMD_CAMIF_DATA, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+int cam_vfe_top_ver3_get_hw_caps(void *device_priv,
+	void *args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_get_hw_cap *vfe_cap_info = NULL;
+	struct cam_vfe_top_ver3_priv *vfe_top_prv = NULL;
+	struct cam_vfe_soc_private *vfe_soc_private = NULL;
+
+	if (!device_priv || !args) {
+		CAM_ERR(CAM_ISP,
+			"Invalid arguments device_priv:%p, args:%p",
+			device_priv, args);
+		return -EINVAL;
+	}
+
+	vfe_cap_info = (struct cam_vfe_hw_get_hw_cap *)args;
+	vfe_top_prv = (struct cam_vfe_top_ver3_priv *)device_priv;
+
+	if (!vfe_top_prv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "soc_info is null");
+		return -EFAULT;
+	}
+
+	vfe_soc_private = (struct cam_vfe_soc_private *)
+		vfe_top_prv->top_common.soc_info->soc_private;
+
+	vfe_cap_info->is_lite = (vfe_soc_private->is_ife_lite) ? true : false;
+	vfe_cap_info->incr =
+		(vfe_top_prv->top_common.hw_version) & 0x00ffff;
+	vfe_cap_info->minor =
+		((vfe_top_prv->top_common.hw_version) >> 16) & 0x0fff;
+	vfe_cap_info->major =
+		((vfe_top_prv->top_common.hw_version) >> 28) & 0x000f;
+
+	return 0;
+}
+
+int cam_vfe_top_ver3_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv   *top_priv = device_priv;
+	struct cam_vfe_top_ver3_common_data common_data = top_priv->common_data;
+
+	top_priv->top_common.applied_clk_rate = 0;
+
+	/**
+	 * Auto clock gating is enabled by default, but no harm
+	 * in setting the value we expect.
+	 */
+	CAM_DBG(CAM_ISP, "Enabling clock gating at IFE top");
+
+	cam_soc_util_w_mb(top_priv->top_common.soc_info, VFE_CORE_BASE_IDX,
+		common_data.common_reg->core_cgc_ovd_0, 0x0);
+
+	cam_soc_util_w_mb(top_priv->top_common.soc_info, VFE_CORE_BASE_IDX,
+		common_data.common_reg->core_cgc_ovd_1, 0x0);
+
+	cam_soc_util_w_mb(top_priv->top_common.soc_info, VFE_CORE_BASE_IDX,
+		common_data.common_reg->ahb_cgc_ovd, 0x0);
+
+	cam_soc_util_w_mb(top_priv->top_common.soc_info, VFE_CORE_BASE_IDX,
+		common_data.common_reg->noc_cgc_ovd, 0x0);
+
+	top_priv->top_common.hw_version =
+		cam_io_r_mb(top_priv->top_common.soc_info->reg_map[0].mem_base +
+		common_data.common_reg->hw_version);
+
+	return 0;
+}
+
+int cam_vfe_top_ver3_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv   *top_priv = device_priv;
+	struct cam_hw_soc_info         *soc_info = NULL;
+	struct cam_vfe_soc_private     *soc_private = NULL;
+	struct cam_vfe_top_ver3_reg_offset_common *reg_common = NULL;
+	uint32_t *reset_reg_args = reset_core_args;
+	uint32_t reset_reg_val;
+
+	if (!top_priv || !reset_reg_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = top_priv->top_common.soc_info;
+	reg_common = top_priv->common_data.common_reg;
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	switch (*reset_reg_args) {
+	case CAM_VFE_HW_RESET_HW_AND_REG:
+		if (!soc_private->is_ife_lite)
+			reset_reg_val = CAM_VFE_HW_RESET_HW_AND_REG_VAL;
+		else
+			reset_reg_val = CAM_VFE_LITE_HW_RESET_AND_REG_VAL;
+		break;
+	default:
+		if (!soc_private->is_ife_lite)
+			reset_reg_val = CAM_VFE_HW_RESET_HW_VAL;
+		else
+			reset_reg_val = CAM_VFE_LITE_HW_RESET_HW_VAL;
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "reset reg value: 0x%x", reset_reg_val);
+
+	/* Mask All the IRQs except RESET */
+	if (!soc_private->is_ife_lite)
+		cam_io_w_mb(0x00000001,
+			CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX)
+			+ 0x3C);
+	else
+		cam_io_w_mb(0x00020000,
+			CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX)
+			+ 0x28);
+
+	/* Reset HW */
+	cam_io_w_mb(reset_reg_val,
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX) +
+		reg_common->global_reset_cmd);
+
+	CAM_DBG(CAM_ISP, "Reset HW exit");
+	return 0;
+}
+
+int cam_vfe_top_ver3_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv            *top_priv;
+	struct cam_vfe_acquire_args             *args;
+	struct cam_vfe_hw_vfe_in_acquire_args   *acquire_args;
+	uint32_t i;
+	int rc = -EINVAL;
+
+	if (!device_priv || !reserve_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver3_priv   *)device_priv;
+	args = (struct cam_vfe_acquire_args *)reserve_args;
+	acquire_args = &args->vfe_in;
+
+	CAM_DBG(CAM_ISP, "res id %d", acquire_args->res_id);
+
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->top_common.mux_rsrc[i].res_id ==
+			acquire_args->res_id &&
+			top_priv->top_common.mux_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+
+			if (acquire_args->res_id == CAM_ISP_HW_VFE_IN_CAMIF) {
+				rc = cam_vfe_camif_ver3_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if (acquire_args->res_id >= CAM_ISP_HW_VFE_IN_RDI0 &&
+				acquire_args->res_id < CAM_ISP_HW_VFE_IN_MAX) {
+				rc = cam_vfe_camif_lite_ver3_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if (acquire_args->res_id == CAM_ISP_HW_VFE_IN_RD) {
+				rc = cam_vfe_fe_ver1_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			top_priv->top_common.mux_rsrc[i].cdm_ops =
+				acquire_args->cdm_ops;
+			top_priv->top_common.mux_rsrc[i].tasklet_info =
+				args->tasklet;
+			top_priv->top_common.mux_rsrc[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			acquire_args->rsrc_node =
+				&top_priv->top_common.mux_rsrc[i];
+
+			rc = 0;
+			CAM_DBG(CAM_ISP, "VFE[%u] Res [id:%d name:%s] reserved",
+				top_priv->common_data.hw_intf->hw_idx,
+				acquire_args->res_id,
+				top_priv->top_common.mux_rsrc[i].res_name);
+			break;
+		}
+	}
+
+	return rc;
+
+}
+
+int cam_vfe_top_ver3_release(void *device_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node            *mux_res;
+
+	if (!device_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	mux_res = (struct cam_isp_resource_node *)release_args;
+
+	CAM_DBG(CAM_ISP, "%s Resource in state %d", mux_res->res_name,
+		mux_res->res_state);
+	if (mux_res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error, Resource in Invalid res_state :%d",
+			mux_res->res_state);
+		return -EINVAL;
+	}
+	mux_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+int cam_vfe_top_ver3_start(void *device_priv,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+	int rc = 0;
+
+	if (!device_priv || !start_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver3_priv *)device_priv;
+	soc_info = top_priv->top_common.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	mux_res = (struct cam_isp_resource_node *)start_args;
+	hw_info = (struct cam_hw_info  *)mux_res->hw_intf->hw_priv;
+
+	if (hw_info->hw_state == CAM_HW_STATE_POWER_UP) {
+		rc = cam_vfe_top_apply_clock_start_stop(&top_priv->top_common);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in applying start clock rc:%d",
+				hw_info->soc_info.index, rc);
+			return rc;
+		}
+
+		rc = cam_vfe_top_apply_bw_start_stop(&top_priv->top_common);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d Failed in applying start bw rc:%d",
+				hw_info->soc_info.index, rc);
+			return rc;
+		}
+
+		if (mux_res->start) {
+			rc = mux_res->start(mux_res);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"Invalid res id:%d", mux_res->res_id);
+			rc = -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "VFE HW not powered up");
+		rc = -EPERM;
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_ver3_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+	int i, rc = 0;
+
+	if (!device_priv || !stop_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver3_priv   *)device_priv;
+	mux_res = (struct cam_isp_resource_node *)stop_args;
+	soc_info = top_priv->top_common.soc_info;
+	soc_private = soc_info->soc_private;
+
+	if (mux_res->res_id < CAM_ISP_HW_VFE_IN_MAX) {
+		rc = mux_res->stop(mux_res);
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res id:%d", mux_res->res_id);
+		return -EINVAL;
+	}
+
+	if (!rc) {
+		for (i = 0; i < top_priv->top_common.num_mux; i++) {
+			if (top_priv->top_common.mux_rsrc[i].res_id ==
+				mux_res->res_id) {
+				top_priv->top_common.req_clk_rate[i] = 0;
+				memset(&top_priv->top_common.req_axi_vote[i],
+					0, sizeof(struct cam_axi_vote));
+				top_priv->top_common.axi_vote_control[i] =
+					CAM_ISP_BW_CONTROL_EXCLUDE;
+				break;
+			}
+		}
+	}
+
+	soc_private->ife_clk_src = 0;
+
+	return rc;
+}
+
+int cam_vfe_top_ver3_read(void *device_priv,
+	void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_vfe_top_ver3_write(void *device_priv,
+	void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_vfe_top_ver3_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_vfe_top_ver3_priv            *top_priv;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+
+	if (!device_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver3_priv *)device_priv;
+	soc_info = top_priv->top_common.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_vfe_top_ver3_mux_get_base(top_priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_top_ver3_mux_get_reg_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+		rc = cam_vfe_top_ver3_get_data(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+		rc = cam_vfe_top_clock_update(&top_priv->top_common, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+		rc = cam_vfe_top_ver3_dump_info(top_priv, cmd_type);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_IN_RD:
+		rc = cam_vfe_top_fs_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE:
+		rc = cam_vfe_top_bw_update(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+		rc = cam_vfe_top_bw_update_v2(soc_private,
+			&top_priv->top_common, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+		rc = cam_vfe_top_bw_control(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = cam_vfe_core_config_control(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_ADD_WAIT:
+		rc = cam_vfe_top_wait_comp_event(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER:
+		rc = cam_vfe_top_add_wait_trigger(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_top_ver3_blanking_update(cmd_type,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_PATH_PORT_MAP:
+		rc = cam_vfe_top_ver3_get_path_port_map(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE:
+		rc = cam_vfe_top_apply_clk_bw_update(&top_priv->top_common, cmd_args, arg_size);
+		break;
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_ISP, "Error, Invalid cmd:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_ver3_init(
+	struct cam_hw_soc_info                 *soc_info,
+	struct cam_hw_intf                     *hw_intf,
+	void                                   *top_hw_info,
+	void                                   *vfe_irq_controller,
+	struct cam_vfe_top                    **vfe_top_ptr)
+{
+	int i, j, rc = 0;
+	struct cam_vfe_top_ver3_priv           *top_priv = NULL;
+	struct cam_vfe_top_ver3_hw_info        *ver3_hw_info = top_hw_info;
+	struct cam_vfe_top                     *vfe_top;
+
+	vfe_top = kzalloc(sizeof(struct cam_vfe_top), GFP_KERNEL);
+	if (!vfe_top) {
+		CAM_DBG(CAM_ISP, "Error, Failed to alloc for vfe_top");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	top_priv = kzalloc(sizeof(struct cam_vfe_top_ver3_priv),
+		GFP_KERNEL);
+	if (!top_priv) {
+		CAM_DBG(CAM_ISP, "Error, Failed to alloc for vfe_top_priv");
+		rc = -ENOMEM;
+		goto free_vfe_top;
+	}
+
+	vfe_top->top_priv = top_priv;
+	top_priv->top_common.applied_clk_rate = 0;
+	if (ver3_hw_info->num_mux > CAM_VFE_TOP_MUX_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid number of input rsrc: %d, max: %d",
+			ver3_hw_info->num_mux, CAM_VFE_TOP_MUX_MAX);
+		rc = -EINVAL;
+		goto free_top_priv;
+	}
+
+	top_priv->top_common.num_mux = ver3_hw_info->num_mux;
+	top_priv->common_data.hw_info = top_hw_info;
+
+	for (i = 0, j = 0; i < top_priv->top_common.num_mux &&
+		j < CAM_VFE_RDI_VER2_MAX; i++) {
+		top_priv->top_common.mux_rsrc[i].res_type =
+			CAM_ISP_RESOURCE_VFE_IN;
+		top_priv->top_common.mux_rsrc[i].hw_intf = hw_intf;
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		top_priv->top_common.req_clk_rate[i] = 0;
+
+		if (ver3_hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_3_0) {
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_CAMIF;
+
+			rc = cam_vfe_camif_ver3_init(hw_intf, soc_info,
+				&ver3_hw_info->camif_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			scnprintf(top_priv->top_common.mux_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "CAMIF");
+			if (rc)
+				goto deinit_resources;
+		} else if (ver3_hw_info->mux_type[i] ==
+			CAM_VFE_PDLIB_VER_1_0) {
+			/* set the PDLIB resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_PDLIB;
+
+			rc = cam_vfe_camif_lite_ver3_init(hw_intf, soc_info,
+				&ver3_hw_info->pdlib_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			scnprintf(top_priv->top_common.mux_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "PDLIB");
+			if (rc)
+				goto deinit_resources;
+		} else if (ver3_hw_info->mux_type[i] ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			/* set the RD resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_RD;
+
+			rc = cam_vfe_fe_ver1_init(hw_intf, soc_info,
+				&ver3_hw_info->fe_hw_info,
+				&top_priv->top_common.mux_rsrc[i]);
+			scnprintf(top_priv->top_common.mux_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "IN_RD");
+			if (rc)
+				goto deinit_resources;
+		} else if (ver3_hw_info->mux_type[i] ==
+			CAM_VFE_RDI_VER_1_0) {
+			/* set the RDI resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_RDI0 + j;
+
+			scnprintf(top_priv->top_common.mux_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "RDI_%d", j);
+
+			rc = cam_vfe_camif_lite_ver3_init(hw_intf, soc_info,
+				ver3_hw_info->rdi_hw_info[j++],
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			if (rc)
+				goto deinit_resources;
+		} else if (ver3_hw_info->mux_type[i] ==
+			CAM_VFE_LCR_VER_1_0) {
+			/* set the LCR resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_LCR;
+
+			rc = cam_vfe_camif_lite_ver3_init(hw_intf, soc_info,
+				&ver3_hw_info->lcr_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			scnprintf(top_priv->top_common.mux_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "LCR");
+			if (rc)
+				goto deinit_resources;
+		} else {
+			CAM_WARN(CAM_ISP, "Invalid mux type: %u",
+				ver3_hw_info->mux_type[i]);
+		}
+	}
+
+	vfe_top->hw_ops.get_hw_caps = cam_vfe_top_ver3_get_hw_caps;
+	vfe_top->hw_ops.init        = cam_vfe_top_ver3_init_hw;
+	vfe_top->hw_ops.reset       = cam_vfe_top_ver3_reset;
+	vfe_top->hw_ops.reserve     = cam_vfe_top_ver3_reserve;
+	vfe_top->hw_ops.release     = cam_vfe_top_ver3_release;
+	vfe_top->hw_ops.start       = cam_vfe_top_ver3_start;
+	vfe_top->hw_ops.stop        = cam_vfe_top_ver3_stop;
+	vfe_top->hw_ops.read        = cam_vfe_top_ver3_read;
+	vfe_top->hw_ops.write       = cam_vfe_top_ver3_write;
+	vfe_top->hw_ops.process_cmd = cam_vfe_top_ver3_process_cmd;
+	*vfe_top_ptr = vfe_top;
+
+	top_priv->top_common.soc_info      = soc_info;
+	top_priv->common_data.hw_intf      = hw_intf;
+	top_priv->top_common.hw_idx        = hw_intf->hw_idx;
+	top_priv->common_data.common_reg   = ver3_hw_info->common_reg;
+
+	return rc;
+
+deinit_resources:
+	for (--i; i >= 0; i--) {
+		if (ver3_hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_3_0) {
+			if (cam_vfe_camif_ver3_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "Camif Deinit failed");
+		} else if (ver3_hw_info->mux_type[i] == CAM_VFE_IN_RD_VER_1_0) {
+			if (cam_vfe_fe_ver1_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "Camif fe Deinit failed");
+		} else {
+			if (cam_vfe_camif_lite_ver3_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP,
+					"Camif lite res id %d Deinit failed",
+					top_priv->top_common.mux_rsrc[i]
+					.res_id);
+		}
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	}
+
+free_top_priv:
+	kfree(vfe_top->top_priv);
+free_vfe_top:
+	kfree(vfe_top);
+end:
+	return rc;
+}
+
+int cam_vfe_top_ver3_deinit(struct cam_vfe_top  **vfe_top_ptr)
+{
+	int i, rc = 0;
+	struct cam_vfe_top_ver3_priv           *top_priv = NULL;
+	struct cam_vfe_top                     *vfe_top;
+
+	if (!vfe_top_ptr) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input");
+		return -EINVAL;
+	}
+
+	vfe_top = *vfe_top_ptr;
+	if (!vfe_top) {
+		CAM_ERR(CAM_ISP, "Error, vfe_top NULL");
+		return -ENODEV;
+	}
+
+	top_priv = vfe_top->top_priv;
+	if (!top_priv) {
+		CAM_ERR(CAM_ISP, "Error, vfe_top_priv NULL");
+		rc = -ENODEV;
+		goto free_vfe_top;
+	}
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+		if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_CAMIF_VER_3_0) {
+			rc = cam_vfe_camif_ver3_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Camif deinit failed rc=%d",
+					rc);
+		} else if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			rc = cam_vfe_fe_ver1_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Camif deinit failed rc=%d",
+					rc);
+		} else {
+			rc = cam_vfe_camif_lite_ver3_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Camif lite res id %d Deinit failed",
+					top_priv->top_common.mux_rsrc[i]
+					.res_id);
+		}
+	}
+
+	kfree(vfe_top->top_priv);
+
+free_vfe_top:
+	kfree(vfe_top);
+	*vfe_top_ptr = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.h
@@ -0,0 +1,104 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_TOP_VER3_H_
+#define _CAM_VFE_TOP_VER3_H_
+
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_camif_lite_ver3.h"
+#include "cam_vfe_fe_ver1.h"
+#include "cam_vfe_top_common.h"
+
+#define CAM_SHIFT_TOP_CORE_CFG_MUXSEL_PDAF       31
+#define CAM_SHIFT_TOP_CORE_CFG_VID_DS16_R2PD     30
+#define CAM_SHIFT_TOP_CORE_CFG_VID_DS4_R2PD      29
+#define CAM_SHIFT_TOP_CORE_CFG_DISP_DS16_R2PD    28
+#define CAM_SHIFT_TOP_CORE_CFG_DISP_DS4_R2PD     27
+#define CAM_SHIFT_TOP_CORE_CFG_DSP_STREAMING     25
+#define CAM_SHIFT_TOP_CORE_CFG_INPUT_PP_FMT      14
+#define CAM_SHIFT_TOP_CORE_CFG_STATS_IHIST       10
+#define CAM_SHIFT_TOP_CORE_CFG_STATS_HDR_BE       9
+#define CAM_SHIFT_TOP_CORE_CFG_STATS_HDR_BHIST    8
+#define CAM_SHIFT_TOP_CORE_CFG_INPUTMUX_PP        5
+
+struct cam_vfe_top_ver3_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t titan_version;
+	uint32_t hw_capability;
+	uint32_t lens_feature;
+	uint32_t stats_feature;
+	uint32_t color_feature;
+	uint32_t zoom_feature;
+	uint32_t global_reset_cmd;
+	uint32_t core_cgc_ovd_0;
+	uint32_t core_cgc_ovd_1;
+	uint32_t ahb_cgc_ovd;
+	uint32_t noc_cgc_ovd;
+	uint32_t bus_cgc_ovd;
+	uint32_t core_cfg_0;
+	uint32_t core_cfg_1;
+	uint32_t reg_update_cmd;
+	uint32_t trigger_cdm_events;
+	uint32_t violation_status;
+	uint32_t custom_frame_idx;
+	uint32_t dsp_status;
+	uint32_t diag_config;
+	uint32_t diag_sensor_status_0;
+	uint32_t diag_sensor_status_1;
+	uint32_t bus_overflow_status;
+	uint32_t top_debug_cfg;
+	uint32_t top_debug_0;
+	uint32_t top_debug_1;
+	uint32_t top_debug_2;
+	uint32_t top_debug_3;
+	uint32_t top_debug_4;
+	uint32_t top_debug_5;
+	uint32_t top_debug_6;
+	uint32_t top_debug_7;
+	uint32_t top_debug_8;
+	uint32_t top_debug_9;
+	uint32_t top_debug_10;
+	uint32_t top_debug_11;
+	uint32_t top_debug_12;
+	uint32_t top_debug_13;
+};
+
+struct cam_vfe_camif_common_cfg {
+	uint32_t     vid_ds16_r2pd;
+	uint32_t     vid_ds4_r2pd;
+	uint32_t     disp_ds16_r2pd;
+	uint32_t     disp_ds4_r2pd;
+	uint32_t     dsp_streaming_tap_point;
+	uint32_t     ihist_src_sel;
+	uint32_t     hdr_be_src_sel;
+	uint32_t     hdr_bhist_src_sel;
+	uint32_t     input_mux_sel_pdaf;
+	uint32_t     input_mux_sel_pp;
+	uint32_t     input_pp_fmt;
+};
+
+struct cam_vfe_top_ver3_hw_info {
+	struct cam_vfe_top_ver3_reg_offset_common  *common_reg;
+	struct cam_vfe_camif_ver3_hw_info           camif_hw_info;
+	struct cam_vfe_camif_lite_ver3_hw_info      pdlib_hw_info;
+	struct cam_vfe_camif_lite_ver3_hw_info
+		*rdi_hw_info[CAM_VFE_RDI_VER2_MAX];
+	struct cam_vfe_camif_lite_ver3_hw_info      lcr_hw_info;
+	struct cam_vfe_fe_ver1_hw_info              fe_hw_info;
+	uint32_t                                    num_mux;
+	uint32_t                                    num_path_port_map;
+	uint32_t mux_type[CAM_VFE_TOP_MUX_MAX];
+	uint32_t path_port_map[CAM_ISP_HW_PATH_PORT_MAP_MAX][2];
+};
+
+int cam_vfe_top_ver3_init(struct cam_hw_soc_info     *soc_info,
+	struct cam_hw_intf                           *hw_intf,
+	void                                         *top_hw_info,
+	void                                         *vfe_irq_controller,
+	struct cam_vfe_top                          **vfe_top);
+
+int cam_vfe_top_ver3_deinit(struct cam_vfe_top      **vfe_top);
+
+#endif /* _CAM_VFE_TOP_VER3_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver4.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver4.c
@@ -0,0 +1,2711 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_io_util.h"
+#include "cam_cdm_util.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver4.h"
+#include "cam_debug_util.h"
+#include "cam_vfe_soc.h"
+#include "cam_trace.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_cdm_intf_api.h"
+
+#define CAM_SHIFT_TOP_CORE_VER_4_CFG_DSP_EN            8
+#define CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX            2
+#define CAM_VFE_LEN_LOG_BUF                            256
+
+struct cam_vfe_top_ver4_common_data {
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_vfe_top_ver4_reg_offset_common  *common_reg;
+	struct cam_vfe_top_ver4_hw_info            *hw_info;
+};
+
+struct cam_vfe_top_ver4_perf_counter_cfg {
+	uint32_t perf_counter_val;
+	bool     dump_counter;
+};
+
+struct cam_vfe_top_ver4_prim_sof_ts_reg_addr {
+	void __iomem  *curr0_ts_addr;
+	void __iomem  *curr1_ts_addr;
+};
+
+struct cam_vfe_top_ver4_priv {
+	struct cam_vfe_top_ver4_common_data          common_data;
+	struct cam_vfe_top_priv_common               top_common;
+	atomic_t                                     overflow_pending;
+	uint8_t                                      log_buf[CAM_VFE_LEN_LOG_BUF];
+	uint32_t                                     sof_cnt;
+	struct cam_vfe_top_ver4_perf_counter_cfg     perf_counters[CAM_VFE_PERF_CNT_MAX];
+	struct cam_vfe_top_ver4_prim_sof_ts_reg_addr sof_ts_reg_addr;
+	bool                                         enable_ife_frame_irqs;
+};
+
+enum cam_vfe_top_ver4_fsm_state {
+	VFE_TOP_VER4_FSM_SOF = 0,
+	VFE_TOP_VER4_FSM_EPOCH,
+	VFE_TOP_VER4_FSM_EOF,
+	VFE_TOP_VER4_FSM_MAX,
+};
+
+struct cam_vfe_mux_ver4_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_soc_info                      *soc_info;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_top_ver4_reg_offset_common   *common_reg;
+	struct cam_vfe_top_common_cfg                cam_common_cfg;
+	struct cam_vfe_ver4_path_reg_data           *reg_data;
+	struct cam_vfe_top_ver4_priv                *top_priv;
+
+	cam_hw_mgr_event_cb_func             event_cb;
+	void                                *priv;
+	int                                  irq_err_handle;
+	int                                  frame_irq_handle;
+	void                                *vfe_irq_controller;
+	struct cam_vfe_top_irq_evt_payload   evt_payload[CAM_VFE_CAMIF_EVT_MAX];
+	struct list_head                     free_payload_list;
+	spinlock_t                           spin_lock;
+
+	enum cam_isp_hw_sync_mode          sync_mode;
+	uint32_t                           dsp_mode;
+	uint32_t                           pix_pattern;
+	uint32_t                           first_pixel;
+	uint32_t                           first_line;
+	uint32_t                           last_pixel;
+	uint32_t                           last_line;
+	uint32_t                           hbi_value;
+	uint32_t                           vbi_value;
+	uint32_t                           irq_debug_cnt;
+	uint32_t                           camif_debug;
+	uint32_t                           horizontal_bin;
+	uint32_t                           qcfa_bin;
+	uint32_t                           dual_hw_idx;
+	uint32_t                           is_dual;
+	uint32_t                           epoch_factor;
+	struct timespec64                  sof_ts;
+	struct timespec64                  epoch_ts;
+	struct timespec64                  eof_ts;
+	struct timespec64                  error_ts;
+	enum cam_vfe_top_ver4_fsm_state    fsm_state;
+	uint32_t                           n_frame_irqs;
+	bool                               is_fe_enabled;
+	bool                               is_offline;
+	bool                               is_lite;
+	bool                               is_pixel_path;
+	bool                               sfe_binned_epoch_cfg;
+	bool                               enable_sof_irq_debug;
+	bool                               handle_camif_irq;
+	uint32_t                           hw_ctxt_mask;
+};
+
+static inline int cam_vfe_top_ver4_get_hw_ctxt_from_irq_status(
+	struct cam_vfe_mux_ver4_data *vfe_priv,
+	uint32_t irq_status)
+{
+	int i;
+
+	for (i = 0; i < CAM_ISP_MULTI_CTXT_MAX; i++)
+		if (irq_status & vfe_priv->reg_data->frm_irq_hw_ctxt_mask[i])
+			break;
+
+	if (i < CAM_ISP_MULTI_CTXT_MAX)
+		return i;
+
+	return -1;
+}
+
+static int cam_vfe_top_ver4_get_path_port_map(struct cam_vfe_top_ver4_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_path_port_map *arg = cmd_args;
+	struct cam_vfe_top_ver4_hw_info *hw_info = top_priv->common_data.hw_info;
+	int i;
+
+	for (i = 0; i < hw_info->num_path_port_map; i++) {
+		arg->entry[i][0] = hw_info->path_port_map[i][0];
+		arg->entry[i][1] = hw_info->path_port_map[i][1];
+	}
+	arg->num_entries = hw_info->num_path_port_map;
+
+	return 0;
+}
+
+static int cam_vfe_top_ver4_pdaf_lcr_config(struct cam_vfe_top_ver4_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver4_hw_info  *hw_info;
+	struct cam_isp_hw_get_cmd_update *cdm_args = NULL;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	uint32_t                          i;
+	uint32_t                          reg_val_idx = 0;
+	uint32_t                          num_reg_vals;
+	uint32_t                          reg_val_pair[4];
+	struct cam_isp_lcr_rdi_cfg_args  *cfg_args;
+	size_t                            size;
+
+	if (!cmd_args || !top_priv) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_args = (struct cam_isp_hw_get_cmd_update *)cmd_args;
+	if (!cdm_args->res) {
+		CAM_ERR(CAM_ISP, "VFE:%u Error, Invalid res", top_priv->top_common.hw_idx);
+		return -EINVAL;
+	}
+
+	hw_info = top_priv->common_data.hw_info;
+	if (!hw_info->num_pdaf_lcr_res || !hw_info->pdaf_lcr_res_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%u PDAF LCR is not supported", top_priv->top_common.hw_idx);
+		return 0;
+	}
+
+	cfg_args = (struct cam_isp_lcr_rdi_cfg_args *)cdm_args->data;
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "VFE:%u Invalid CDM ops", top_priv->top_common.hw_idx);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < hw_info->num_pdaf_lcr_res; i++)
+		if (cfg_args->ife_src_res_id == hw_info->pdaf_lcr_res_mask[i].res_id)
+			break;
+
+	if (i == hw_info->num_pdaf_lcr_res) {
+		CAM_ERR(CAM_ISP, "VFE:%u Res :%d src_res :%u is not supported for mux",
+			top_priv->top_common.hw_idx, cfg_args->rdi_lcr_cfg->res_id,
+			cfg_args->ife_src_res_id);
+		return -EINVAL;
+	}
+
+	if (cfg_args->is_init)
+		num_reg_vals = 2;
+	else
+		num_reg_vals = 1;
+
+	size = cdm_util_ops->cdm_required_size_reg_random(num_reg_vals);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "VFE:%u buf size:%d is not sufficient, expected: %d",
+			top_priv->top_common.hw_idx, cdm_args->cmd.size, (size*4));
+		return -EINVAL;
+	}
+
+	if (cfg_args->is_init) {
+		reg_val_pair[reg_val_idx++] = hw_info->common_reg->pdaf_input_cfg_1;
+		reg_val_pair[reg_val_idx++] = 0;
+	}
+
+	reg_val_pair[reg_val_idx++] = hw_info->common_reg->pdaf_input_cfg_0;
+	reg_val_pair[reg_val_idx] = hw_info->pdaf_lcr_res_mask[i].val;
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		num_reg_vals, reg_val_pair);
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+
+int cam_vfe_top_acquire_resource_update_res(
+	struct cam_isp_resource_node  *vfe_full_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_ver4_data      *res_data;
+	struct cam_vfe_acquire_args       *acquire_data;
+
+	res_data  = (struct cam_vfe_mux_ver4_data *)
+		vfe_full_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	res_data->sync_mode      = acquire_data->vfe_in.sync_mode;
+	res_data->event_cb       = acquire_data->event_cb;
+	res_data->priv           = acquire_data->priv;
+
+	if (!res_data->is_pixel_path)
+		goto config_done;
+
+	res_data->pix_pattern    = acquire_data->vfe_in.in_port->test_pattern;
+	res_data->dsp_mode       = acquire_data->vfe_in.in_port->dsp_mode;
+	res_data->first_pixel    = acquire_data->vfe_in.in_port->left_start;
+	res_data->last_pixel     = acquire_data->vfe_in.in_port->left_stop;
+	res_data->first_line     = acquire_data->vfe_in.in_port->line_start;
+	res_data->last_line      = acquire_data->vfe_in.in_port->line_stop;
+	res_data->is_fe_enabled  = acquire_data->vfe_in.is_fe_enabled;
+	res_data->is_offline     = acquire_data->vfe_in.is_offline;
+	res_data->is_dual        = acquire_data->vfe_in.is_dual;
+	res_data->qcfa_bin       = acquire_data->vfe_in.in_port->qcfa_bin;
+	res_data->horizontal_bin =
+		acquire_data->vfe_in.in_port->horizontal_bin;
+	res_data->sfe_binned_epoch_cfg =
+		acquire_data->vfe_in.in_port->sfe_binned_epoch_cfg;
+	res_data->handle_camif_irq	 = acquire_data->vfe_in.handle_camif_irq;
+
+	if (res_data->is_dual)
+		res_data->dual_hw_idx = acquire_data->vfe_in.dual_hw_idx;
+
+config_done:
+	CAM_DBG(CAM_ISP,
+		"VFE:%d Res:[id:%d name:%s] dsp_mode:%d is_dual:%d dual_hw_idx:%d handle_camif_irq:%d",
+		vfe_full_res->hw_intf->hw_idx,
+		vfe_full_res->res_id,
+		vfe_full_res->res_name,
+		res_data->dsp_mode,
+		res_data->is_dual, res_data->dual_hw_idx,
+		res_data->handle_camif_irq);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver4_update_res(struct cam_vfe_top_ver4_priv *top_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_vfe_acquire_args             *args;
+	struct cam_vfe_resource_update          *res_update_args;
+	struct cam_vfe_hw_vfe_in_acquire_args   *acquire_args;
+	uint32_t i;
+	int rc = -EINVAL;
+
+	if (!top_priv || !reserve_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	res_update_args = (struct cam_vfe_resource_update *)reserve_args;
+	args = (struct cam_vfe_acquire_args *)res_update_args->vfe_acquire;
+	acquire_args = &args->vfe_in;
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->top_common.mux_rsrc[i].res_id ==
+			acquire_args->res_id) {
+
+			if (acquire_args->res_id == CAM_ISP_HW_VFE_IN_CAMIF) {
+				rc = cam_vfe_top_acquire_resource_update_res(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if (acquire_args->res_id >= CAM_ISP_HW_VFE_IN_RDI0 &&
+				acquire_args->res_id < CAM_ISP_HW_VFE_IN_MAX) {
+				rc = cam_vfe_top_acquire_resource_update_res(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			top_priv->top_common.mux_rsrc[i].tasklet_info =
+				args->tasklet;
+			top_priv->top_common.mux_rsrc[i].is_per_port_acquire =
+				false;
+
+			acquire_args->rsrc_node =
+				&top_priv->top_common.mux_rsrc[i];
+
+			rc = 0;
+			break;
+		}
+	}
+	return rc;
+}
+
+static int cam_vfe_ver4_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload);
+
+static int cam_vfe_top_ver4_enable_irq(
+	struct cam_vfe_top_ver4_priv *top_priv,
+	void *res_irq_mask)
+{
+	struct cam_isp_resource_node   *vfe_res;
+	struct cam_vfe_mux_ver4_data   *rsrc_data;
+	int                             i, rc = 0;
+	struct cam_vfe_res_irq_info    *irq_args;
+	uint32_t                        err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+
+	if (!res_irq_mask) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	irq_args = (struct cam_vfe_res_irq_info *)res_irq_mask;
+	for (i = 0; i < irq_args->num_res; i++) {
+		vfe_res = irq_args->node_res[i];
+
+		if (vfe_res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+			/* possible reason can be irqs are already disabled */
+			CAM_DBG(CAM_ISP, "Error, Invalid camif res res_state:%d",
+				vfe_res->res_state);
+			return 0;
+		}
+
+		rsrc_data = (struct cam_vfe_mux_ver4_data *)vfe_res->res_priv;
+
+		/* Perport works with csid only.
+		 * No need to subscribe frame irq at ife side, it is already taken care from csid
+		 */
+		err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] = rsrc_data->reg_data->error_irq_mask;
+
+		if (!vfe_res->is_per_port_acquire && !rsrc_data->irq_err_handle &&
+			!vfe_res->is_per_port_start) {
+			rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+				rsrc_data->vfe_irq_controller,
+				CAM_IRQ_PRIORITY_0,
+				err_irq_mask,
+				vfe_res,
+				cam_vfe_ver4_err_irq_top_half,
+				vfe_res->bottom_half_handler,
+				vfe_res->tasklet_info,
+				&tasklet_bh_api,
+				CAM_IRQ_EVT_GROUP_0);
+
+			if (rsrc_data->irq_err_handle < 1) {
+				CAM_ERR(CAM_ISP, "VFE:%u Error IRQ handle subscribe failure",
+					vfe_res->hw_intf->hw_idx);
+				rc = -ENOMEM;
+				rsrc_data->irq_err_handle = 0;
+			}
+		} else {
+			if (rsrc_data->irq_err_handle) {
+				rc = cam_irq_controller_update_irq(
+					rsrc_data->vfe_irq_controller,
+					rsrc_data->irq_err_handle,
+					irq_args->enable_irq,
+					err_irq_mask);
+
+				if (rc) {
+					CAM_ERR(CAM_ISP, "Error IRQ handle update failure");
+					rc = -ENOMEM;
+				}
+			} else {
+				CAM_ERR(CAM_ISP, "Frame IRQ Err handle not found");
+			}
+		}
+
+		CAM_DBG(CAM_ISP, "VFE:%d Res: %s irq enable update done err_irq_mask:0x%x",
+			vfe_res->hw_intf->hw_idx,
+			vfe_res->res_name, err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0]);
+		}
+
+	return rc;
+}
+
+static int cam_vfe_top_ver4_mux_get_base(struct cam_vfe_top_ver4_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_vfe_soc_private       *soc_private;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error, Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	soc_private = top_priv->top_common.soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "VFE:%u soc_private is null", top_priv->top_common.hw_idx);
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "VFE:%u Invalid CDM ops", top_priv->top_common.hw_idx);
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "VFE:%u buf size:%d is not sufficient, expected: %d",
+			top_priv->top_common.hw_idx, cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(
+		top_priv->top_common.soc_info, VFE_CORE_BASE_IDX);
+	if (mem_base == -1) {
+		CAM_ERR(CAM_ISP, "failed to get mem_base, index: %d num_reg_map: %u",
+			VFE_CORE_BASE_IDX, top_priv->top_common.soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	if (cdm_args->cdm_id == CAM_CDM_RT) {
+		if (!soc_private->rt_wrapper_base) {
+			CAM_ERR(CAM_ISP, "VFE:%u rt_wrapper_base_addr is null",
+				top_priv->top_common.hw_idx);
+			return -EINVAL;
+		}
+
+		mem_base -= soc_private->rt_wrapper_base;
+	}
+
+	CAM_DBG(CAM_ISP, "core %u mem_base 0x%x, cdm_id: %u",
+		top_priv->top_common.soc_info->index, mem_base,
+		cdm_args->cdm_id);
+
+	cdm_util_ops->cdm_write_changebase(cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_fs_update(
+	struct cam_vfe_top_ver4_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_fe_update_args *cmd_update = cmd_args;
+
+	if (cmd_update->node_res->process_cmd)
+		return cmd_update->node_res->process_cmd(cmd_update->node_res,
+			CAM_ISP_HW_CMD_FE_UPDATE_IN_RD, cmd_args, arg_size);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver4_set_primary_sof_timer_reg_addr(
+	struct cam_vfe_top_ver4_priv *top_priv, void *cmd_args)
+{
+	struct cam_ife_csid_ts_reg_addr *sof_ts_addr_update_args;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	sof_ts_addr_update_args = (struct cam_ife_csid_ts_reg_addr *)cmd_args;
+
+	if (!sof_ts_addr_update_args->curr0_ts_addr ||
+		!sof_ts_addr_update_args->curr1_ts_addr) {
+		CAM_ERR(CAM_ISP, "Invalid SOF Qtimer address: curr0: 0x%pK, curr1: 0x%pK",
+		sof_ts_addr_update_args->curr0_ts_addr,
+		sof_ts_addr_update_args->curr1_ts_addr);
+		return -EINVAL;
+	}
+
+	top_priv->sof_ts_reg_addr.curr0_ts_addr =
+		sof_ts_addr_update_args->curr0_ts_addr;
+	top_priv->sof_ts_reg_addr.curr1_ts_addr =
+		sof_ts_addr_update_args->curr1_ts_addr;
+
+	return 0;
+}
+
+static void cam_vfe_top_ver4_check_module_status(
+	uint32_t num_reg, uint32_t *reg_val,
+	struct cam_vfe_top_ver4_debug_reg_info (*status_list)[][8])
+{
+	bool found = false;
+	uint32_t i, j, val = 0;
+	size_t len = 0;
+	uint8_t log_buf[1024];
+
+	if (!status_list)
+		return;
+
+	for (i = 0; i < num_reg; i++) {
+		/* Check for ideal values */
+		if ((reg_val[i] == 0) || (reg_val[i] == 0x55555555))
+			continue;
+
+		for (j = 0; j < 8; j++) {
+			val = reg_val[i] >> (*status_list)[i][j].shift;
+			val &= 0xF;
+			if (val == 0 || val == 5)
+				continue;
+
+			CAM_INFO_BUF(CAM_ISP, log_buf, 1024, &len, "%s [I:%u V:%u R:%u]",
+				(*status_list)[i][j].clc_name,
+				((val >> 2) & 1), ((val >> 1) & 1), (val & 1));
+			found = true;
+		}
+		if (found)
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "Check config for Debug%u - %s", i, log_buf);
+		len = 0;
+		found = false;
+		memset(log_buf, 0, sizeof(uint8_t)*1024);
+	}
+}
+
+static void cam_vfe_top_ver4_print_pdaf_violation_info(
+	struct cam_vfe_mux_ver4_data *vfe_priv)
+{
+	struct cam_vfe_top_ver4_priv        *top_priv;
+	struct cam_hw_soc_info              *soc_info;
+	struct cam_vfe_top_ver4_common_data *common_data;
+	void __iomem                        *base;
+	uint32_t                             val = 0;
+	uint32_t                             i = 0;
+
+	top_priv    =  vfe_priv->top_priv;
+	common_data = &top_priv->common_data;
+	soc_info    =  top_priv->top_common.soc_info;
+	base        =  soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	val         =  cam_io_r(base +
+			    common_data->common_reg->pdaf_violation_status),
+
+	CAM_INFO(CAM_ISP, "VFE[%u] PDAF HW Violation status 0x%x",
+	     soc_info->index, val);
+
+	for (i = 0; i < common_data->hw_info->num_pdaf_violation_errors; i++) {
+		if (common_data->hw_info->pdaf_violation_desc[i].bitmask &
+			val) {
+			CAM_ERR(CAM_ISP, "%s",
+				common_data->hw_info->pdaf_violation_desc[i].desc);
+
+		}
+	}
+}
+
+static void cam_vfe_top_ver4_print_ipp_violation_info(
+	struct cam_vfe_top_ver4_priv *top_priv)
+{
+	struct cam_hw_soc_info              *soc_info;
+	struct cam_vfe_top_ver4_common_data *common_data;
+	void __iomem                        *base;
+	uint32_t                             val = 0;
+
+	common_data = &top_priv->common_data;
+	soc_info    =  top_priv->top_common.soc_info;
+	base        =  soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	val         =  cam_io_r(base +
+			    common_data->common_reg->ipp_violation_status),
+
+	CAM_INFO(CAM_ISP, "VFE[%u] IPP Violation status 0x%x",
+	     soc_info->index, val);
+
+	if (common_data->hw_info->ipp_module_desc)
+		CAM_ERR(CAM_ISP, "VFE[%u] IPP Violation Module id: [%u %s]",
+			soc_info->index,
+			common_data->hw_info->ipp_module_desc[val].id,
+			common_data->hw_info->ipp_module_desc[val].desc);
+
+}
+
+static void cam_vfe_top_ver4_print_top_irq_error(
+	struct cam_vfe_mux_ver4_data *vfe_priv,
+	uint32_t irq_status)
+{
+	uint32_t                                    i = 0;
+	struct cam_vfe_top_ver4_priv               *top_priv;
+	struct cam_vfe_top_ver4_common_data        *common_data;
+
+	top_priv    =  vfe_priv->top_priv;
+	common_data = &top_priv->common_data;
+
+	for (i = 0; i < common_data->hw_info->num_top_errors; i++) {
+		if (common_data->hw_info->top_err_desc[i].bitmask &
+			irq_status) {
+			CAM_ERR(CAM_ISP, "%s %s",
+				common_data->hw_info->top_err_desc[i].err_name,
+				common_data->hw_info->top_err_desc[i].desc);
+
+		}
+	}
+
+	if (irq_status & vfe_priv->reg_data->ipp_violation_mask)
+		cam_vfe_top_ver4_print_ipp_violation_info(top_priv);
+
+	if (irq_status & vfe_priv->reg_data->pdaf_violation_mask)
+		cam_vfe_top_ver4_print_pdaf_violation_info(vfe_priv);
+}
+
+static void cam_vfe_top_dump_perf_counters(
+	const char *event,
+	const char *res_name,
+	struct cam_vfe_top_ver4_priv *top_priv)
+{
+	int i;
+	void __iomem                              *mem_base;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_vfe_top_ver4_reg_offset_common *common_reg;
+
+	soc_info = top_priv->top_common.soc_info;
+	common_reg = top_priv->common_data.common_reg;
+	mem_base = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+
+	for (i = 0; i < top_priv->common_data.common_reg->num_perf_counters; i++) {
+		if (top_priv->perf_counters[i].dump_counter) {
+			CAM_INFO(CAM_ISP,
+				"VFE [%u] on %s %s counter: %d pixel_cnt: %d line_cnt: %d stall_cnt: %d always_cnt: %d status: 0x%x",
+				top_priv->common_data.hw_intf->hw_idx, res_name, event, (i + 1),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_pix_count),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_line_count),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_stall_count),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_always_count),
+				cam_io_r_mb(mem_base +
+					common_reg->perf_count_reg[i].perf_count_status));
+		}
+	}
+}
+
+static void cam_vfe_top_ver4_print_debug_reg_status(
+	struct cam_vfe_top_ver4_priv *top_priv)
+{
+	struct cam_vfe_top_ver4_reg_offset_common  *common_reg;
+	uint32_t                                    val = 0;
+	uint32_t                                    num_reg =  0;
+	uint32_t                                    i = 0, j;
+	size_t                                      len = 0;
+	uint8_t                                    *log_buf;
+	uint32_t                                   reg_val[CAM_VFE_TOP_DBG_REG_MAX] = {0};
+	struct cam_hw_soc_info                     *soc_info;
+	void __iomem                               *base;
+
+	soc_info   =  top_priv->top_common.soc_info;
+	common_reg =  top_priv->common_data.common_reg;
+	num_reg    =  common_reg->num_top_debug_reg;
+	base       =  soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	log_buf    =  top_priv->log_buf;
+
+	while (i < num_reg) {
+		for(j = 0; j < 4 && i < num_reg; j++, i++) {
+			val = cam_io_r(base +
+				common_reg->top_debug[i]);
+			reg_val[i] = val;
+			CAM_INFO_BUF(CAM_ISP, log_buf, CAM_VFE_LEN_LOG_BUF, &len,
+				"VFE[%u] status %2d : 0x%08x", soc_info->index, i, val);
+		}
+		CAM_INFO(CAM_ISP, "VFE[%u]: Top Debug Status: %s", soc_info->index, log_buf);
+		len = 0;
+	}
+
+	cam_vfe_top_ver4_check_module_status(num_reg, reg_val,
+		top_priv->common_data.hw_info->debug_reg_info);
+	cam_vfe_top_dump_perf_counters("ERROR", "", top_priv);
+}
+
+int cam_vfe_top_ver4_dump_timestamps(
+	struct cam_vfe_top_ver4_priv *top_priv,
+	int  res_id)
+{
+	uint32_t                           i;
+	struct cam_vfe_mux_ver4_data      *vfe_priv = NULL;
+	struct cam_isp_resource_node      *res = NULL;
+	struct cam_isp_resource_node      *camif_res = NULL;
+	struct timespec64                  ts;
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+
+		res = &top_priv->top_common.mux_rsrc[i];
+
+		if (!res || !res->res_priv) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE[%u] Invalid Resource",
+					top_priv->common_data.hw_intf->hw_idx);
+			return -EINVAL;
+		}
+
+		vfe_priv  = res->res_priv;
+
+		if (!vfe_priv->frame_irq_handle)
+			continue;
+
+		if (vfe_priv->is_pixel_path) {
+			camif_res = res;
+			if (res->res_id == res_id)
+				break;
+		} else {
+			if (res->is_rdi_primary_res && res->res_id == res_id) {
+				break;
+			} else if (!res->is_rdi_primary_res && camif_res) {
+				vfe_priv  = camif_res->res_priv;
+				break;
+			}
+		}
+	}
+
+	if (i ==  top_priv->top_common.num_mux || !vfe_priv) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE[%u] invalid res_id %d",
+			top_priv->common_data.hw_intf->hw_idx, res_id);
+		return 0;
+	}
+
+	ktime_get_boottime_ts64(&ts);
+
+	CAM_INFO(CAM_ISP,
+		"VFE[%u] res: %u current_ts: %lld:%lld epoch_factor: %u%%",
+		vfe_priv->hw_intf->hw_idx, res_id, ts.tv_sec, ts.tv_nsec,
+		vfe_priv->epoch_factor);
+
+	CAM_INFO(CAM_ISP,
+		"VFE[%u] CAMIF Error timestamp:[%lld.%09lld] SOF timestamp:[%lld.%09lld] EPOCH timestamp:[%lld.%09lld] EOF timestamp:[%lld.%09lld]",
+		vfe_priv->hw_intf->hw_idx, vfe_priv->error_ts.tv_sec,
+		vfe_priv->error_ts.tv_nsec,
+		vfe_priv->sof_ts.tv_sec,
+		vfe_priv->sof_ts.tv_nsec,
+		vfe_priv->epoch_ts.tv_sec,
+		vfe_priv->epoch_ts.tv_nsec,
+		vfe_priv->eof_ts.tv_sec,
+		vfe_priv->eof_ts.tv_nsec);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver4_print_overflow_debug_info(
+	struct cam_vfe_top_ver4_priv *top_priv, void *cmd_args)
+{
+	struct cam_vfe_top_ver4_common_data *common_data;
+	struct cam_hw_soc_info              *soc_info;
+	struct cam_vfe_soc_private *soc_private = NULL;
+	uint32_t                             violation_status = 0, bus_overflow_status = 0, tmp;
+	uint32_t                             i = 0;
+	int                                  res_id;
+	struct cam_isp_hw_overflow_info     *overflow_info = NULL;
+
+	overflow_info = (struct cam_isp_hw_overflow_info *)cmd_args;
+	res_id = overflow_info->res_id;
+
+	common_data = &top_priv->common_data;
+	soc_info = top_priv->top_common.soc_info;
+	soc_private = soc_info->soc_private;
+
+	bus_overflow_status = cam_io_r(soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base +
+		common_data->common_reg->bus_overflow_status);
+	violation_status = cam_io_r(soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base +
+		common_data->common_reg->bus_violation_status);
+
+	if (soc_private->is_ife_lite)
+		CAM_ERR(CAM_ISP,
+			"VFE[%u] sof_cnt:%d src_clk:%lu overflow:%s violation:%s",
+			soc_info->index, top_priv->sof_cnt,
+			soc_info->applied_src_clk_rates.sw_client,
+			CAM_BOOL_TO_YESNO(bus_overflow_status),
+			CAM_BOOL_TO_YESNO(violation_status));
+	else
+		CAM_ERR(CAM_ISP,
+			"VFE[%u] sof_cnt:%d src_clk sw_client:%lu hw_client:[%lu %lu] overflow:%s violation:%s",
+			soc_info->index, top_priv->sof_cnt,
+			soc_info->applied_src_clk_rates.sw_client,
+			soc_info->applied_src_clk_rates.hw_client[soc_info->index].high,
+			soc_info->applied_src_clk_rates.hw_client[soc_info->index].low,
+			CAM_BOOL_TO_YESNO(bus_overflow_status),
+			CAM_BOOL_TO_YESNO(violation_status));
+
+	if (bus_overflow_status) {
+		overflow_info->is_bus_overflow = true;
+		CAM_INFO(CAM_ISP, "VFE[%u] Bus overflow status: 0x%x",
+			soc_info->index, bus_overflow_status);
+	}
+
+	tmp = bus_overflow_status;
+	while (tmp) {
+		if (tmp & 0x1)
+			CAM_ERR(CAM_ISP, "VFE[%u] Bus Overflow %s",
+				soc_info->index, common_data->hw_info->wr_client_desc[i].desc);
+		tmp = tmp >> 1;
+		i++;
+	}
+
+	cam_vfe_top_ver4_dump_timestamps(top_priv, res_id);
+	cam_cpas_dump_camnoc_buff_fill_info(soc_private->cpas_handle);
+	if (bus_overflow_status)
+		cam_cpas_log_votes(false);
+
+	if (violation_status)
+		CAM_INFO(CAM_ISP, "VFE[%u] Bus violation status: 0x%x",
+			soc_info->index, violation_status);
+
+	i = 0;
+	tmp = violation_status;
+	while (tmp) {
+		if (tmp & 0x1)
+			CAM_ERR(CAM_ISP, "VFE[%u] Bus Violation %s",
+				soc_info->index, common_data->hw_info->wr_client_desc[i].desc);
+		tmp = tmp >> 1;
+		i++;
+	}
+
+	cam_vfe_top_ver4_print_debug_reg_status(top_priv);
+
+	return 0;
+}
+
+static int cam_vfe_core_config_control(
+	struct cam_vfe_top_ver4_priv *top_priv,
+	 void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_core_config_args *vfe_core_cfg = cmd_args;
+	struct cam_isp_resource_node *rsrc_node = vfe_core_cfg->node_res;
+	struct cam_vfe_mux_ver4_data *vfe_priv = rsrc_node->res_priv;
+
+	vfe_priv->cam_common_cfg.vid_ds16_r2pd =
+		vfe_core_cfg->core_config.vid_ds16_r2pd;
+	vfe_priv->cam_common_cfg.vid_ds4_r2pd =
+		vfe_core_cfg->core_config.vid_ds4_r2pd;
+	vfe_priv->cam_common_cfg.disp_ds16_r2pd =
+		vfe_core_cfg->core_config.disp_ds16_r2pd;
+	vfe_priv->cam_common_cfg.disp_ds4_r2pd =
+		vfe_core_cfg->core_config.disp_ds4_r2pd;
+	vfe_priv->cam_common_cfg.dsp_streaming_tap_point =
+		vfe_core_cfg->core_config.dsp_streaming_tap_point;
+	vfe_priv->cam_common_cfg.ihist_src_sel =
+		vfe_core_cfg->core_config.ihist_src_sel;
+	vfe_priv->cam_common_cfg.input_pp_fmt =
+		vfe_core_cfg->core_config.core_cfg_flag
+			& CAM_ISP_PARAM_CORE_CFG_PP_FORMAT;
+	vfe_priv->cam_common_cfg.hdr_mux_sel_pp =
+		vfe_core_cfg->core_config.core_cfg_flag
+			& CAM_ISP_PARAM_CORE_CFG_HDR_MUX_SEL;
+
+	return 0;
+}
+
+static int cam_vfe_init_config_update(
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_init_config_update *init_cfg = cmd_args;
+	struct cam_isp_resource_node *rsrc_node = init_cfg->node_res;
+	struct cam_vfe_mux_ver4_data *mux_data = rsrc_node->res_priv;
+
+	if (arg_size != sizeof(struct cam_isp_hw_init_config_update)) {
+		CAM_ERR(CAM_ISP, "VFE:%u Invalid args size expected: %zu actual: %zu",
+			rsrc_node->hw_intf->hw_idx, sizeof(struct cam_isp_hw_init_config_update),
+			arg_size);
+		return -EINVAL;
+	}
+
+	mux_data->epoch_factor =
+		init_cfg->init_config->epoch_cfg.epoch_factor;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%u Init Update for res_name: %s epoch_factor: %u%%",
+		rsrc_node->hw_intf->hw_idx, rsrc_node->res_name, mux_data->epoch_factor);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver4_mux_get_reg_update(
+	struct cam_vfe_top_ver4_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "VFE:%u Invalid request, Add RUP in CSID",
+		top_priv->common_data.hw_intf->hw_idx);
+	return -EINVAL;
+}
+
+static int cam_vfe_top_ver4_get_data(
+	struct cam_vfe_top_ver4_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node  *res = cmd_args;
+
+	if (res->process_cmd)
+		return res->process_cmd(res,
+			CAM_ISP_HW_CMD_CAMIF_DATA, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+int cam_vfe_top_ver4_get_hw_caps(void *device_priv, void *args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_get_hw_cap *vfe_cap_info = NULL;
+	struct cam_vfe_top_ver4_priv *vfe_top_prv = NULL;
+	struct cam_vfe_soc_private *soc_priv = NULL;
+
+	if (!device_priv || !args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments device_priv:%p, args:%p", device_priv, args);
+		return -EINVAL;
+	}
+
+	vfe_cap_info = args;
+	vfe_top_prv = device_priv;
+
+	if (!vfe_top_prv->top_common.soc_info) {
+		CAM_ERR(CAM_ISP, "soc info is null");
+		return -EFAULT;
+	}
+
+	soc_priv = (struct cam_vfe_soc_private *)vfe_top_prv->top_common.soc_info->soc_private;
+
+	vfe_cap_info->is_lite = soc_priv->is_ife_lite;
+	vfe_cap_info->incr    = (vfe_top_prv->top_common.hw_version) & 0x00ffff;
+	vfe_cap_info->minor   = ((vfe_top_prv->top_common.hw_version) >> 16) & 0x0fff;
+	vfe_cap_info->major   = (vfe_top_prv->top_common.hw_version) >> 28;
+
+	return 0;
+}
+
+int cam_vfe_top_ver4_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver4_priv   *top_priv = device_priv;
+	struct cam_vfe_top_ver4_common_data common_data = top_priv->common_data;
+
+	top_priv->top_common.applied_clk_rate = 0;
+
+	top_priv->top_common.hw_version = cam_io_r_mb(
+		top_priv->top_common.soc_info->reg_map[0].mem_base +
+		common_data.common_reg->hw_version);
+	CAM_DBG(CAM_ISP, "VFE:%u hw-version:0x%x",
+		top_priv->top_common.hw_idx,
+		top_priv->top_common.hw_version);
+
+	return 0;
+}
+
+int cam_vfe_top_ver4_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size)
+{
+	CAM_DBG(CAM_ISP, "Reset not supported");
+	return 0;
+}
+
+int cam_vfe_top_acquire_resource(
+	struct cam_isp_resource_node  *vfe_full_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_ver4_data      *res_data;
+	struct cam_vfe_acquire_args       *acquire_data;
+	int                                    rc = 0;
+
+	res_data  = (struct cam_vfe_mux_ver4_data *)
+		vfe_full_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	res_data->sync_mode      = acquire_data->vfe_in.sync_mode;
+	res_data->event_cb       = acquire_data->event_cb;
+	res_data->priv           = acquire_data->priv;
+
+	if (!res_data->is_pixel_path)
+		goto config_done;
+
+	res_data->pix_pattern    = acquire_data->vfe_in.in_port->test_pattern;
+	res_data->dsp_mode       = acquire_data->vfe_in.in_port->dsp_mode;
+	res_data->first_pixel    = acquire_data->vfe_in.in_port->left_start;
+	res_data->last_pixel     = acquire_data->vfe_in.in_port->left_stop;
+	res_data->first_line     = acquire_data->vfe_in.in_port->line_start;
+	res_data->last_line      = acquire_data->vfe_in.in_port->line_stop;
+	res_data->is_fe_enabled  = acquire_data->vfe_in.is_fe_enabled;
+	res_data->is_offline     = acquire_data->vfe_in.is_offline;
+	res_data->is_dual        = acquire_data->vfe_in.is_dual;
+	res_data->qcfa_bin       = acquire_data->vfe_in.in_port->qcfa_bin;
+	res_data->horizontal_bin =
+		acquire_data->vfe_in.in_port->horizontal_bin;
+	res_data->vbi_value      = 0;
+	res_data->hbi_value      = 0;
+	res_data->sfe_binned_epoch_cfg =
+		acquire_data->vfe_in.in_port->sfe_binned_epoch_cfg;
+	res_data->handle_camif_irq   = acquire_data->vfe_in.handle_camif_irq;
+
+	if (res_data->is_dual)
+		res_data->dual_hw_idx = acquire_data->vfe_in.dual_hw_idx;
+
+config_done:
+	CAM_DBG(CAM_ISP,
+		"VFE:%u Res:[id:%d name:%s] dsp_mode:%d is_dual:%d dual_hw_idx:%d",
+		vfe_full_res->hw_intf->hw_idx,
+		vfe_full_res->res_id,
+		vfe_full_res->res_name,
+		res_data->dsp_mode,
+		res_data->is_dual, res_data->dual_hw_idx);
+
+	return rc;
+}
+
+int cam_vfe_top_ver4_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver4_priv            *top_priv;
+	struct cam_vfe_acquire_args             *args;
+	struct cam_vfe_hw_vfe_in_acquire_args   *acquire_args;
+	struct cam_vfe_mux_ver4_data            *vfe_priv = NULL;
+	uint32_t i;
+	int rc = -EINVAL;
+
+	if (!device_priv || !reserve_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver4_priv   *)device_priv;
+	args = (struct cam_vfe_acquire_args *)reserve_args;
+	acquire_args = &args->vfe_in;
+
+	CAM_DBG(CAM_ISP, "VFE:%u res id %d",
+		top_priv->common_data.hw_intf->hw_idx, acquire_args->res_id);
+
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->top_common.mux_rsrc[i].res_id == acquire_args->res_id) {
+			vfe_priv = (struct cam_vfe_mux_ver4_data *)
+				top_priv->top_common.mux_rsrc[i].res_priv;
+
+			if (top_priv->top_common.mux_rsrc[i].res_state !=
+				CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+				if (acquire_args->res_id != CAM_ISP_HW_VFE_IN_CAMIF) {
+					CAM_ERR(CAM_ISP, "VFE:%d Duplicate acquire for camif",
+						top_priv->common_data.hw_intf->hw_idx);
+					rc = -EINVAL;
+					break;
+				}
+
+				if (!vfe_priv->hw_ctxt_mask && !acquire_args->hw_ctxt_mask) {
+					rc = -EINVAL;
+					goto end;
+				}
+
+				if (!(vfe_priv->hw_ctxt_mask & acquire_args->hw_ctxt_mask)) {
+					CAM_DBG(CAM_ISP,
+						"VFE:%d Update hw ctxt mask: 0x%x for camif curr_mask_val: 0x%x",
+						top_priv->common_data.hw_intf->hw_idx,
+						acquire_args->hw_ctxt_mask,
+						vfe_priv->hw_ctxt_mask);
+					vfe_priv->hw_ctxt_mask |= acquire_args->hw_ctxt_mask;
+					acquire_args->rsrc_node = &top_priv->top_common.mux_rsrc[i];
+					rc = 0;
+				} else {
+					CAM_ERR(CAM_ISP,
+						"VFE:%d Duplicate hw ctxt mask: 0x%x for camif curr_mask_val: 0x%x",
+						top_priv->common_data.hw_intf->hw_idx,
+						acquire_args->hw_ctxt_mask,
+						vfe_priv->hw_ctxt_mask);
+					rc = -EINVAL;
+				}
+
+				break;
+			}
+
+			if (((acquire_args->res_id == CAM_ISP_HW_VFE_IN_CAMIF) ||
+				(acquire_args->res_id >= CAM_ISP_HW_VFE_IN_RDI0)) &&
+				(acquire_args->res_id < CAM_ISP_HW_VFE_IN_MAX)) {
+				rc = cam_vfe_top_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			top_priv->top_common.mux_rsrc[i].cdm_ops =
+				acquire_args->cdm_ops;
+			top_priv->top_common.mux_rsrc[i].tasklet_info =
+				args->tasklet;
+			vfe_priv->hw_ctxt_mask = acquire_args->hw_ctxt_mask;
+			top_priv->top_common.mux_rsrc[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			if (acquire_args->in_port->per_port_en && args->per_port_acquire)
+				top_priv->top_common.mux_rsrc[i].is_per_port_acquire = true;
+			acquire_args->rsrc_node = &top_priv->top_common.mux_rsrc[i];
+
+			rc = 0;
+			break;
+		}
+	}
+end:
+	return rc;
+
+}
+
+int cam_vfe_top_ver4_release(void *device_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_vfe_top_ver4_priv            *top_priv;
+	struct cam_vfe_mux_ver4_data            *vfe_priv = NULL;
+
+	if (!device_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	mux_res = (struct cam_isp_resource_node *)release_args;
+	top_priv = (struct cam_vfe_top_ver4_priv   *)device_priv;
+	vfe_priv = (struct cam_vfe_mux_ver4_data *) mux_res->res_priv;
+
+	CAM_DBG(CAM_ISP, "VFE:%u Resource in state %d",
+		top_priv->common_data.hw_intf->hw_idx, mux_res->res_state);
+	if (mux_res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "VFE:%u Error, Resource in Invalid res_state :%d",
+			top_priv->common_data.hw_intf->hw_idx, mux_res->res_state);
+		return -EINVAL;
+	}
+
+	memset(&vfe_priv->top_priv->sof_ts_reg_addr, 0,
+		sizeof(vfe_priv->top_priv->sof_ts_reg_addr));
+	vfe_priv->hw_ctxt_mask = 0;
+	mux_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+int cam_vfe_top_ver4_start(void *device_priv,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver4_priv     *top_priv;
+	struct cam_isp_resource_node     *mux_res;
+	struct cam_hw_info               *hw_info = NULL;
+	struct cam_hw_soc_info           *soc_info = NULL;
+	struct cam_vfe_soc_private       *soc_private = NULL;
+	int rc = 0, i;
+
+	if (!device_priv || !start_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver4_priv *)device_priv;
+	soc_info = top_priv->top_common.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "VFE:%u Error soc_private NULL",
+			top_priv->common_data.hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	mux_res = (struct cam_isp_resource_node *)start_args;
+	hw_info = (struct cam_hw_info *)mux_res->hw_intf->hw_priv;
+
+	if (hw_info->hw_state == CAM_HW_STATE_POWER_UP) {
+		rc = cam_vfe_top_apply_clock_start_stop(&top_priv->top_common);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u Failed in applying start clock rc:%d",
+				hw_info->soc_info.index, rc);
+			return rc;
+		}
+
+		rc = cam_vfe_top_apply_bw_start_stop(&top_priv->top_common);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u Failed in applying start bw rc:%d",
+				hw_info->soc_info.index, rc);
+			return rc;
+		}
+
+		if (mux_res->start) {
+			rc = mux_res->start(mux_res);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"VFE:%u Invalid res id:%d",
+				hw_info->soc_info.index, mux_res->res_id);
+			rc = -EINVAL;
+		}
+
+		/* Perf counter config */
+		for (i = 0; i < top_priv->common_data.common_reg->num_perf_counters; i++) {
+			if (!top_priv->perf_counters[i].perf_counter_val)
+				continue;
+
+			top_priv->perf_counters[i].dump_counter = true;
+			cam_io_w_mb(top_priv->perf_counters[i].perf_counter_val,
+				soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base +
+				top_priv->common_data.common_reg->perf_count_reg[i].perf_count_cfg);
+			CAM_DBG(CAM_ISP, "VFE [%u] perf_count_%d: 0x%x",
+				hw_info->soc_info.index, (i + 1),
+				top_priv->perf_counters[i].perf_counter_val);
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "VFE:%u HW not powered up", hw_info->soc_info.index);
+		rc = -EPERM;
+	}
+
+	atomic_set(&top_priv->overflow_pending, 0);
+	return rc;
+}
+
+int cam_vfe_top_ver4_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver4_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	int i, rc = 0;
+
+	if (!device_priv || !stop_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver4_priv   *)device_priv;
+	soc_info = top_priv->top_common.soc_info;
+	mux_res = (struct cam_isp_resource_node *)stop_args;
+
+	if (mux_res->res_id < CAM_ISP_HW_VFE_IN_MAX) {
+		rc = mux_res->stop(mux_res);
+	} else {
+		CAM_ERR(CAM_ISP, "VFE:%u Invalid res id:%d",
+			top_priv->common_data.hw_intf->hw_idx, mux_res->res_id);
+		return -EINVAL;
+	}
+
+	if (!rc) {
+		for (i = 0; i < top_priv->top_common.num_mux; i++) {
+			if (top_priv->top_common.mux_rsrc[i].res_id ==
+				mux_res->res_id) {
+				if (!top_priv->top_common.skip_data_rst_on_stop)
+					top_priv->top_common.req_clk_rate[i] = 0;
+				memset(&top_priv->top_common.req_axi_vote[i],
+					0, sizeof(struct cam_axi_vote));
+				top_priv->top_common.axi_vote_control[i] =
+					CAM_ISP_BW_CONTROL_EXCLUDE;
+				break;
+			}
+		}
+	}
+
+	/* Reset perf counters at stream off */
+	for (i = 0; i < top_priv->common_data.common_reg->num_perf_counters; i++) {
+		if (top_priv->perf_counters[i].dump_counter)
+			cam_io_w_mb(0x0,
+				soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base +
+				top_priv->common_data.common_reg->perf_count_reg[i].perf_count_cfg);
+		top_priv->perf_counters[i].dump_counter = false;
+	}
+
+	if (top_priv->common_data.hw_info->num_pdaf_lcr_res)
+		cam_io_w(1, soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base +
+			top_priv->common_data.common_reg->pdaf_input_cfg_1);
+
+	atomic_set(&top_priv->overflow_pending, 0);
+	return rc;
+}
+
+int cam_vfe_top_ver4_read(void *device_priv,
+	void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_vfe_top_ver4_write(void *device_priv,
+	void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_top_apply_fcg_update(
+	struct cam_vfe_top_ver4_priv    *top_priv,
+	struct cam_isp_hw_fcg_update    *fcg_update,
+	struct cam_cdm_utils_ops        *cdm_util_ops)
+{
+	struct cam_isp_fcg_config_internal             *fcg_config;
+	struct cam_isp_ch_ctx_fcg_config_internal      *fcg_ch_ctx;
+	struct cam_isp_predict_fcg_config_internal     *fcg_pr;
+	struct cam_vfe_top_ver4_hw_info                *hw_info;
+	struct cam_vfe_ver4_fcg_module_info            *fcg_module_info;
+	uint32_t                                        size, fcg_index_shift;
+	uint32_t                                       *reg_val_pair;
+	uint32_t                                        num_regval_pairs = 0;
+	int                                             rc = 0, i, j = 0;
+
+	if (!top_priv || !fcg_update || (fcg_update->prediction_idx == 0)) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = top_priv->common_data.hw_info;
+	fcg_config = (struct cam_isp_fcg_config_internal *)fcg_update->data;
+	if (!hw_info || !fcg_config) {
+		CAM_ERR(CAM_ISP, "Invalid config params");
+		return -EINVAL;
+	}
+
+	fcg_module_info = hw_info->fcg_module_info;
+	if (!fcg_module_info) {
+		CAM_ERR(CAM_ISP, "Invalid FCG common data");
+		return -EINVAL;
+	}
+
+	if (fcg_config->num_ch_ctx > CAM_ISP_MAX_FCG_CH_CTXS) {
+		CAM_ERR(CAM_SFE, "out of bounds %d",
+			fcg_config->num_ch_ctx);
+		return -EINVAL;
+	}
+
+	reg_val_pair = kcalloc(fcg_module_info->max_reg_val_pair_size, sizeof(uint32_t),
+		GFP_KERNEL);
+	if (!reg_val_pair) {
+		CAM_ERR(CAM_ISP, "Failed allocating memory for reg val pair");
+		return -ENOMEM;
+	}
+
+	fcg_index_shift = fcg_module_info->fcg_index_shift;
+
+	for (i = 0, j = 0; i < fcg_config->num_ch_ctx; i++) {
+		if (j >= fcg_module_info->max_reg_val_pair_size) {
+			CAM_ERR(CAM_ISP, "reg_val_pair %d exceeds the array limit %u",
+				j, fcg_module_info->max_reg_val_pair_size);
+			rc = -ENOMEM;
+			goto free_mem;
+		}
+
+		fcg_ch_ctx = &fcg_config->ch_ctx_fcg_configs[i];
+		if (!fcg_ch_ctx) {
+			CAM_ERR(CAM_ISP, "Failed in FCG channel/context dereference");
+			rc = -EINVAL;
+			goto free_mem;
+		}
+
+		fcg_pr = &fcg_ch_ctx->predicted_fcg_configs[
+			fcg_update->prediction_idx - 1];
+
+		/* For VFE/MC_TFE, only PHASE should be enabled */
+		if (fcg_ch_ctx->fcg_enable_mask & CAM_ISP_FCG_ENABLE_PHASE) {
+			switch (fcg_ch_ctx->fcg_ch_ctx_id) {
+			/* Same value as CAM_ISP_FCG_MASK_CH0/1/2 to support both VFE and MC_TFE */
+			case CAM_ISP_MULTI_CTXT0_MASK:
+				if (hw_info->fcg_mc_supported) {
+					CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+						fcg_module_info->fcg_reg_ctxt_sel,
+						(fcg_module_info->fcg_reg_ctxt_mask &
+						(fcg_ch_ctx->fcg_ch_ctx_id <<
+						fcg_module_info->fcg_reg_ctxt_shift)));
+					CAM_DBG(CAM_ISP,
+						"Program FCG registers for MC_TFE, ch_ctx_id: 0x%x, sel_wr: 0x%x",
+						fcg_ch_ctx->fcg_ch_ctx_id,
+						(fcg_module_info->fcg_reg_ctxt_mask &
+						(fcg_ch_ctx->fcg_ch_ctx_id <<
+						fcg_module_info->fcg_reg_ctxt_shift)));
+				}
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_phase_index_cfg_0,
+					(fcg_pr->phase_index_r |
+					(fcg_pr->phase_index_g << fcg_index_shift)));
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_phase_index_cfg_1,
+					fcg_pr->phase_index_b);
+				CAM_DBG(CAM_ISP,
+					"Program FCG registers for IFE/MC_TFE, ch_ctx_id: 0x%x, phase_index_cfg_0: %u, phase_index_cfg_1: %u",
+					fcg_ch_ctx->fcg_ch_ctx_id,
+					(fcg_pr->phase_index_r |
+					(fcg_pr->phase_index_g << fcg_index_shift)),
+					fcg_pr->phase_index_b);
+				break;
+			case CAM_ISP_MULTI_CTXT1_MASK:
+			case CAM_ISP_MULTI_CTXT2_MASK:
+				if (!hw_info->fcg_mc_supported) {
+					CAM_ERR(CAM_ISP,
+						"No support for multi context for FCG on ch_ctx_id: 0x%x",
+						fcg_ch_ctx->fcg_ch_ctx_id);
+					rc = -EINVAL;
+					goto free_mem;
+				}
+
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_reg_ctxt_sel,
+					(fcg_module_info->fcg_reg_ctxt_mask &
+					(fcg_ch_ctx->fcg_ch_ctx_id <<
+					fcg_module_info->fcg_reg_ctxt_shift)));
+				CAM_DBG(CAM_ISP,
+					"Program FCG registers for MC_TFE, ch_ctx_id: 0x%x, sel_wr: 0x%x",
+					fcg_ch_ctx->fcg_ch_ctx_id,
+					(fcg_module_info->fcg_reg_ctxt_mask &
+					(fcg_ch_ctx->fcg_ch_ctx_id <<
+					fcg_module_info->fcg_reg_ctxt_shift)));
+
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_phase_index_cfg_0,
+					(fcg_pr->phase_index_r |
+					(fcg_pr->phase_index_g << fcg_index_shift)));
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					fcg_module_info->fcg_phase_index_cfg_1,
+					fcg_pr->phase_index_b);
+				CAM_DBG(CAM_ISP,
+					"Program FCG registers for MC_TFE, ch_ctx_id: 0x%x, phase_index_cfg_0: %u, phase_index_cfg_1: %u",
+					fcg_ch_ctx->fcg_ch_ctx_id,
+					(fcg_pr->phase_index_r |
+					(fcg_pr->phase_index_g << fcg_index_shift)),
+					fcg_pr->phase_index_b);
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Unsupported ch_ctx_id: 0x%x",
+					fcg_ch_ctx->fcg_ch_ctx_id);
+				rc = -EINVAL;
+				goto free_mem;
+			}
+		}
+	}
+
+	num_regval_pairs = j / 2;
+
+	if (num_regval_pairs) {
+		size = cdm_util_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		if ((size * 4) != fcg_update->cmd_size) {
+			CAM_ERR(CAM_ISP,
+				"Failed! Buf size:%d is wrong, expected size: %d",
+				fcg_update->cmd_size, size * 4);
+			rc = -ENOMEM;
+			goto free_mem;
+		}
+
+		cdm_util_ops->cdm_write_regrandom(
+			(uint32_t *)fcg_update->cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+	} else {
+		CAM_WARN(CAM_ISP, "No reg val pairs");
+	}
+
+free_mem:
+	kfree(reg_val_pair);
+	return rc;
+}
+
+static int cam_vfe_top_get_fcg_buf_size(
+	struct cam_vfe_top_ver4_priv    *top_priv,
+	struct cam_isp_hw_fcg_get_size  *fcg_get_size,
+	struct cam_cdm_utils_ops        *cdm_util_ops)
+{
+	struct cam_vfe_top_ver4_hw_info                *hw_info;
+	struct cam_vfe_ver4_fcg_module_info            *fcg_module_info;
+	uint32_t                                        num_types, num_reg_val;
+
+	if (!top_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_info = top_priv->common_data.hw_info;
+	if (!hw_info) {
+		CAM_ERR(CAM_ISP, "Invalid config params");
+		return -EINVAL;
+	}
+
+	if (!hw_info->fcg_supported &&
+		!hw_info->fcg_mc_supported) {
+		fcg_get_size->fcg_supported = false;
+		CAM_DBG(CAM_ISP, "FCG is not supported by hardware");
+		return 0;
+	}
+
+	fcg_module_info = hw_info->fcg_module_info;
+	fcg_get_size->fcg_supported = true;
+	num_types = fcg_get_size->num_types;
+	if (num_types == 0) {
+		CAM_ERR(CAM_ISP, "Number of types(STATS/PHASE) requested is empty");
+		return -EINVAL;
+	}
+
+	num_reg_val = num_types * fcg_module_info->fcg_type_size;
+
+	/* Count for wr_sel register in MC_TFE */
+	if (hw_info->fcg_mc_supported)
+		num_reg_val += fcg_get_size->num_ctxs;
+
+	fcg_get_size->kmd_size =
+		cdm_util_ops->cdm_required_size_reg_random(num_reg_val);
+	return 0;
+}
+
+static int cam_vfe_top_fcg_config(
+	struct cam_vfe_top_ver4_priv    *top_priv,
+	void                            *cmd_args,
+	uint32_t                         arg_size)
+{
+	struct cam_isp_hw_fcg_cmd       *fcg_cmd;
+	struct cam_cdm_utils_ops        *cdm_util_ops;
+	int rc;
+
+	if (arg_size != sizeof(struct cam_isp_hw_fcg_cmd)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size, arg_size: %u, expected size: %u",
+			arg_size, sizeof(struct cam_isp_hw_fcg_cmd));
+		return -EINVAL;
+	}
+
+	fcg_cmd = (struct cam_isp_hw_fcg_cmd *) cmd_args;
+	if (!fcg_cmd || !fcg_cmd->res) {
+		CAM_ERR(CAM_ISP, "Invalid cmd args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)fcg_cmd->res->cdm_ops;
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	if (fcg_cmd->get_size_flag) {
+		struct cam_isp_hw_fcg_get_size  *fcg_get_size;
+
+		fcg_get_size = &fcg_cmd->u.fcg_get_size;
+		rc = cam_vfe_top_get_fcg_buf_size(top_priv, fcg_get_size, cdm_util_ops);
+	} else {
+		struct cam_isp_hw_fcg_update    *fcg_update;
+
+		fcg_update = &fcg_cmd->u.fcg_update;
+		rc = cam_vfe_top_apply_fcg_update(top_priv, fcg_update, cdm_util_ops);
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_ver4_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_vfe_top_ver4_priv            *top_priv;
+	struct cam_hw_soc_info                  *soc_info;
+	struct cam_vfe_soc_private              *soc_private;
+
+	if (!device_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver4_priv *)device_priv;
+	soc_info = top_priv->top_common.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "VFE:%u Error soc_private NULL",
+			top_priv->common_data.hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_vfe_top_ver4_mux_get_base(top_priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_top_ver4_mux_get_reg_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+		rc = cam_vfe_top_ver4_get_data(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+		rc = cam_vfe_top_clock_update(&top_priv->top_common, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_NOTIFY_OVERFLOW:
+		atomic_set(&top_priv->overflow_pending, 1);
+		rc = cam_vfe_top_ver4_print_overflow_debug_info(top_priv,
+			cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_IN_RD:
+		rc = cam_vfe_top_fs_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE:
+		rc = cam_vfe_top_bw_update(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+		rc = cam_vfe_top_bw_update_v2(soc_private,
+			&top_priv->top_common, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+		rc = cam_vfe_top_bw_control(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = cam_vfe_core_config_control(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_PATH_PORT_MAP:
+		rc = cam_vfe_top_ver4_get_path_port_map(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_APPLY_CLK_BW_UPDATE:
+		rc = cam_vfe_top_apply_clk_bw_update(&top_priv->top_common, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_INIT_CONFIG_UPDATE:
+		rc = cam_vfe_init_config_update(cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_RDI_LCR_CFG:
+		rc = cam_vfe_top_ver4_pdaf_lcr_config(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_CAP: {
+		struct cam_isp_hw_cap *ife_cap;
+
+		ife_cap = (struct cam_isp_hw_cap *) cmd_args;
+		ife_cap->num_perf_counters =
+			top_priv->common_data.common_reg->num_perf_counters;
+	}
+		break;
+	case CAM_ISP_HW_CMD_IFE_DEBUG_CFG: {
+		int i;
+		uint32_t max_counters = top_priv->common_data.common_reg->num_perf_counters;
+		struct cam_vfe_generic_debug_config *debug_cfg;
+
+		debug_cfg = (struct cam_vfe_generic_debug_config *)cmd_args;
+		if (debug_cfg->num_counters <= max_counters)
+			for (i = 0; i < max_counters; i++)
+				top_priv->perf_counters[i].perf_counter_val =
+					debug_cfg->vfe_perf_counter_val[i];
+
+		top_priv->enable_ife_frame_irqs = debug_cfg->enable_ife_frame_irqs;
+	}
+		break;
+	case CAM_ISP_HW_CMD_GET_SET_PRIM_SOF_TS_ADDR: {
+		struct cam_ife_csid_ts_reg_addr  *sof_addr_args =
+			(struct cam_ife_csid_ts_reg_addr *)cmd_args;
+
+		if (sof_addr_args->get_addr) {
+			CAM_ERR(CAM_ISP, "VFE does not support get of primary SOF ts addr");
+			rc = -EINVAL;
+		} else
+			rc = cam_vfe_top_ver4_set_primary_sof_timer_reg_addr(top_priv,
+				sof_addr_args);
+	}
+		break;
+	case CAM_ISP_HW_CMD_FCG_CONFIG:
+		rc = cam_vfe_top_fcg_config(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_UPDATE_VFE_SRC_RES_DATA:
+		rc = cam_vfe_top_ver4_update_res(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_UPDATE_VFE_SRC_RES_IRQ_MASK:
+		rc = cam_vfe_top_ver4_enable_irq(top_priv, cmd_args);
+		break;
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_ISP, "VFE:%u Error, Invalid cmd:%d",
+			top_priv->common_data.hw_intf->hw_idx, cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_get_evt_payload(
+	struct cam_vfe_mux_ver4_data           *vfe_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&vfe_priv->spin_lock);
+	if (list_empty(&vfe_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free VFE event payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&vfe_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+done:
+	spin_unlock(&vfe_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_top_put_evt_payload(
+	struct cam_vfe_mux_ver4_data           *vfe_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!vfe_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "VFE:%u No payload to put", vfe_priv->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&vfe_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list, &vfe_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&vfe_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "VFE:%u Done", vfe_priv->hw_intf->hw_idx);
+	return 0;
+}
+
+static int cam_vfe_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *vfe_res;
+	struct cam_vfe_mux_ver4_data          *vfe_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+
+	vfe_res = th_payload->handler_priv;
+	vfe_priv = vfe_res->res_priv;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%u IRQ status_0: 0x%X status_1: 0x%X",
+		vfe_res->hw_intf->hw_idx, th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1]);
+
+	rc  = cam_vfe_get_evt_payload(vfe_priv, &evt_payload);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+		"VFE:%u IRQ status_0: 0x%X status_1: 0x%X",
+		vfe_res->hw_intf->hw_idx, th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	evt_payload->reg_val = 0;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	if (th_payload->evt_status_arr[vfe_priv->common_reg->frame_timing_irq_reg_idx]
+			& vfe_priv->reg_data->sof_irq_mask) {
+		if (vfe_priv->top_priv->sof_ts_reg_addr.curr0_ts_addr &&
+			vfe_priv->top_priv->sof_ts_reg_addr.curr1_ts_addr) {
+			evt_payload->ts.sof_ts =
+				cam_io_r_mb(vfe_priv->top_priv->sof_ts_reg_addr.curr1_ts_addr);
+			evt_payload->ts.sof_ts = (evt_payload->ts.sof_ts << 32) |
+				cam_io_r_mb(vfe_priv->top_priv->sof_ts_reg_addr.curr0_ts_addr);
+		}
+
+		trace_cam_log_event("SOF", "TOP_HALF",
+		th_payload->evt_status_arr[vfe_priv->common_reg->frame_timing_irq_reg_idx],
+		vfe_res->hw_intf->hw_idx);
+	}
+
+	if (th_payload->evt_status_arr[vfe_priv->common_reg->frame_timing_irq_reg_idx]
+			& vfe_priv->reg_data->epoch0_irq_mask) {
+		trace_cam_log_event("EPOCH0", "TOP_HALF",
+		th_payload->evt_status_arr[vfe_priv->common_reg->frame_timing_irq_reg_idx],
+		vfe_res->hw_intf->hw_idx);
+	}
+
+	if (th_payload->evt_status_arr[vfe_priv->common_reg->frame_timing_irq_reg_idx]
+			& vfe_priv->reg_data->eof_irq_mask) {
+		trace_cam_log_event("EOF", "TOP_HALF",
+		th_payload->evt_status_arr[vfe_priv->common_reg->frame_timing_irq_reg_idx],
+		vfe_res->hw_intf->hw_idx);
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%u Exit", vfe_res->hw_intf->hw_idx);
+	return rc;
+}
+
+static void cam_vfe_irq_status_to_event(struct cam_vfe_mux_ver4_data *vfe_priv,
+	uint32_t irq_status, bool *sof, bool *epoch, bool *eof)
+{
+	*sof = (irq_status & vfe_priv->reg_data->sof_irq_mask);
+	*epoch = (irq_status & vfe_priv->reg_data->epoch0_irq_mask);
+	*eof = (irq_status & vfe_priv->reg_data->eof_irq_mask);
+}
+
+static enum cam_vfe_top_ver4_fsm_state cam_vfe_top_ver4_fsm_next_state(
+	struct cam_isp_resource_node *res,
+	enum cam_vfe_top_ver4_fsm_state state)
+{
+	switch (state) {
+	case VFE_TOP_VER4_FSM_SOF:
+		return (res->is_rdi_primary_res) ? VFE_TOP_VER4_FSM_EOF : VFE_TOP_VER4_FSM_EPOCH;
+	case VFE_TOP_VER4_FSM_EPOCH:
+		return VFE_TOP_VER4_FSM_EOF;
+	case VFE_TOP_VER4_FSM_EOF:
+		return VFE_TOP_VER4_FSM_SOF;
+	default:
+		/* set to SOF to recover from incorrect state */
+		return VFE_TOP_VER4_FSM_SOF;
+	}
+}
+
+static const char *cam_vfe_top_ver4_fsm_state_to_string(
+	enum cam_vfe_top_ver4_fsm_state state)
+{
+	switch (state) {
+	case VFE_TOP_VER4_FSM_SOF:   return "SOF";
+	case VFE_TOP_VER4_FSM_EPOCH: return "EPOCH";
+	case VFE_TOP_VER4_FSM_EOF:   return "EOF";
+	default:                     return "INVALID";
+	}
+}
+
+typedef int (*cam_vfe_handle_frame_irq_t)(struct cam_vfe_mux_ver4_data *vfe_priv,
+	struct cam_vfe_top_irq_evt_payload *payload,
+	struct cam_isp_hw_event_info *evt_info);
+
+
+static int cam_vfe_handle_sof(struct cam_vfe_mux_ver4_data *vfe_priv,
+	struct cam_vfe_top_irq_evt_payload *payload,
+	struct cam_isp_hw_event_info *evt_info)
+{
+	if ((vfe_priv->enable_sof_irq_debug) &&
+		(vfe_priv->irq_debug_cnt <=
+		CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "VFE:%u Received SOF",
+			vfe_priv->hw_intf->hw_idx);
+
+		vfe_priv->irq_debug_cnt++;
+		if (vfe_priv->irq_debug_cnt ==
+			CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+			vfe_priv->enable_sof_irq_debug = false;
+			vfe_priv->irq_debug_cnt = 0;
+		}
+	} else {
+		uint32_t frm_irq_status =
+			payload->irq_reg_val[vfe_priv->common_reg->frame_timing_irq_reg_idx];
+		int hw_ctxt_id = -1;
+
+		if (vfe_priv->reg_data->is_mc_path)
+			hw_ctxt_id = cam_vfe_top_ver4_get_hw_ctxt_from_irq_status(vfe_priv,
+				frm_irq_status);
+
+		CAM_DBG(CAM_ISP, "VFE:%u is_mc:%s hw_ctxt:%d Received SOF",
+			vfe_priv->hw_intf->hw_idx,
+			CAM_BOOL_TO_YESNO(vfe_priv->reg_data->is_mc_path), hw_ctxt_id);
+		vfe_priv->sof_ts.tv_sec = payload->ts.mono_time.tv_sec;
+		vfe_priv->sof_ts.tv_nsec = payload->ts.mono_time.tv_nsec;
+	}
+	vfe_priv->top_priv->sof_cnt++;
+
+	return 0;
+}
+
+static int cam_vfe_handle_epoch(struct cam_vfe_mux_ver4_data *vfe_priv,
+	struct cam_vfe_top_irq_evt_payload *payload,
+	struct cam_isp_hw_event_info *evt_info)
+{
+	CAM_DBG(CAM_ISP, "VFE:%u Received EPOCH", vfe_priv->hw_intf->hw_idx);
+	evt_info->reg_val = payload->reg_val;
+	vfe_priv->epoch_ts.tv_sec = payload->ts.mono_time.tv_sec;
+	vfe_priv->epoch_ts.tv_nsec = payload->ts.mono_time.tv_nsec;
+
+	return 0;
+}
+
+static int cam_vfe_handle_eof(struct cam_vfe_mux_ver4_data *vfe_priv,
+	struct cam_vfe_top_irq_evt_payload *payload,
+	struct cam_isp_hw_event_info *evt_info)
+{
+	uint32_t frm_irq_status =
+		payload->irq_reg_val[vfe_priv->common_reg->frame_timing_irq_reg_idx];
+	int hw_ctxt_id = -1;
+
+	if (vfe_priv->reg_data->is_mc_path)
+		hw_ctxt_id = cam_vfe_top_ver4_get_hw_ctxt_from_irq_status(vfe_priv, frm_irq_status);
+
+	CAM_DBG(CAM_ISP, "VFE:%u is_mc:%s hw_ctxt:%d Received EOF",
+		vfe_priv->hw_intf->hw_idx,
+		CAM_BOOL_TO_YESNO(vfe_priv->reg_data->is_mc_path), hw_ctxt_id);
+
+	vfe_priv->eof_ts.tv_sec = payload->ts.mono_time.tv_sec;
+	vfe_priv->eof_ts.tv_nsec = payload->ts.mono_time.tv_nsec;
+
+	return 0;
+}
+
+static int __cam_vfe_handle_frame_timing_irqs(struct cam_isp_resource_node *vfe_res, bool event,
+	enum cam_isp_hw_event_type event_type, cam_vfe_handle_frame_irq_t handle_irq_fn,
+	struct cam_vfe_top_irq_evt_payload *payload, struct cam_isp_hw_event_info *evt_info)
+{
+	struct cam_vfe_mux_ver4_data *vfe_priv = vfe_res->res_priv;
+
+	if (!event) {
+		CAM_WARN(CAM_ISP, "VFE:%u missed %s", vfe_priv->hw_intf->hw_idx,
+			cam_isp_hw_evt_type_to_string(event_type));
+	} else {
+		handle_irq_fn(vfe_priv, payload, evt_info);
+		if (!(vfe_priv->top_priv->enable_ife_frame_irqs)
+			&& vfe_priv->event_cb)
+			vfe_priv->event_cb(vfe_priv->priv, event_type, evt_info);
+	}
+	vfe_priv->fsm_state = cam_vfe_top_ver4_fsm_next_state(vfe_res, vfe_priv->fsm_state);
+
+	return 0;
+}
+
+static int cam_vfe_handle_frame_timing_irqs(struct cam_isp_resource_node *vfe_res,
+	uint32_t irq_status, struct cam_vfe_top_irq_evt_payload *payload,
+	struct cam_isp_hw_event_info *evt_info)
+{
+	struct cam_vfe_mux_ver4_data *vfe_priv = vfe_res->res_priv;
+	bool sof, epoch, eof;
+	int i, j;
+
+	cam_vfe_irq_status_to_event(vfe_priv, irq_status, &sof, &epoch, &eof);
+	CAM_DBG(CAM_ISP, "VFE:%u SOF:%s EPOCH:%s EOF:%s", vfe_priv->hw_intf->hw_idx,
+		CAM_BOOL_TO_YESNO(sof), CAM_BOOL_TO_YESNO(epoch), CAM_BOOL_TO_YESNO(eof));
+
+	i = (sof ? 1 : 0) + (epoch ? 1 : 0) + (eof ? 1 : 0);
+	j = i;
+
+	if (i == vfe_priv->n_frame_irqs)
+		CAM_WARN_RATE_LIMIT(CAM_ISP, "VFE:%u top-half delay", vfe_priv->hw_intf->hw_idx);
+
+	while (i > 0) {
+		bool event;
+		enum cam_isp_hw_event_type event_type;
+		cam_vfe_handle_frame_irq_t handle_irq_fn;
+
+		CAM_DBG_PR2(CAM_ISP, "VFE:%u enter state:%s (%d/%d)", vfe_priv->hw_intf->hw_idx,
+			cam_vfe_top_ver4_fsm_state_to_string(vfe_priv->fsm_state), i, j);
+
+		switch (vfe_priv->fsm_state) {
+		case VFE_TOP_VER4_FSM_SOF:
+			event = sof;
+			event_type = CAM_ISP_HW_EVENT_SOF;
+			handle_irq_fn = cam_vfe_handle_sof;
+			break;
+		case VFE_TOP_VER4_FSM_EPOCH:
+			event = epoch;
+			event_type = CAM_ISP_HW_EVENT_EPOCH;
+			handle_irq_fn = cam_vfe_handle_epoch;
+			break;
+		case VFE_TOP_VER4_FSM_EOF:
+			event = eof;
+			event_type = CAM_ISP_HW_EVENT_EOF;
+			handle_irq_fn = cam_vfe_handle_eof;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "VFE:%u frame state machine in invalid state",
+				vfe_priv->hw_intf->hw_idx);
+			return -EINVAL;
+		}
+
+		/* consume event */
+		if (event)
+			i--;
+
+		__cam_vfe_handle_frame_timing_irqs(vfe_res, event, event_type, handle_irq_fn,
+			payload, evt_info);
+
+		CAM_DBG_PR2(CAM_ISP, "VFE:%u exit state:%s (%d/%d)", vfe_priv->hw_intf->hw_idx,
+			cam_vfe_top_ver4_fsm_state_to_string(vfe_priv->fsm_state), i, j);
+	}
+
+	return CAM_VFE_IRQ_STATUS_SUCCESS;
+}
+
+static int cam_vfe_handle_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int ret = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node *vfe_res;
+	struct cam_vfe_mux_ver4_data *vfe_priv;
+	struct cam_vfe_top_irq_evt_payload *payload;
+	struct cam_isp_hw_event_info evt_info;
+	struct cam_isp_hw_error_event_info err_evt_info;
+	struct cam_isp_sof_ts_data sof_and_boot_time;
+	uint32_t irq_status[CAM_IFE_IRQ_REGISTERS_MAX] = {0}, frame_timing_mask;
+	struct timespec64 ts;
+	int i = 0;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params handle_priv:%pK, evt_payload_priv:%pK",
+			handler_priv, evt_payload_priv);
+		return ret;
+	}
+
+	vfe_res = handler_priv;
+	vfe_priv = vfe_res->res_priv;
+	payload = evt_payload_priv;
+
+	if (atomic_read(&vfe_priv->top_priv->overflow_pending)) {
+		CAM_INFO(CAM_ISP,
+			"VFE:%u Handling overflow, Ignore bottom half",
+			vfe_res->hw_intf->hw_idx);
+		cam_vfe_top_put_evt_payload(vfe_priv, &payload);
+		return IRQ_HANDLED;
+	}
+
+	for (i = 0; i < CAM_IFE_IRQ_REGISTERS_MAX; i++)
+		irq_status[i] = payload->irq_reg_val[i];
+
+	sof_and_boot_time.boot_time = payload->ts.mono_time;
+	sof_and_boot_time.sof_ts = payload->ts.sof_ts;
+
+	evt_info.hw_idx   = vfe_res->hw_intf->hw_idx;
+	evt_info.hw_type  = CAM_ISP_HW_TYPE_VFE;
+	evt_info.res_id   = vfe_res->res_id;
+	evt_info.res_type = vfe_res->res_type;
+	evt_info.reg_val = 0;
+	evt_info.event_data = &sof_and_boot_time;
+
+	frame_timing_mask = vfe_priv->reg_data->sof_irq_mask |
+				vfe_priv->reg_data->epoch0_irq_mask |
+				vfe_priv->reg_data->eof_irq_mask;
+
+	if (irq_status[vfe_priv->common_reg->frame_timing_irq_reg_idx] & frame_timing_mask) {
+		ret = cam_vfe_handle_frame_timing_irqs(vfe_res,
+			irq_status[vfe_priv->common_reg->frame_timing_irq_reg_idx] &
+			frame_timing_mask,
+			payload, &evt_info);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+		& vfe_priv->reg_data->error_irq_mask) {
+		CAM_ERR(CAM_ISP, "VFE:%u Error", evt_info.hw_idx);
+
+		err_evt_info.err_type = CAM_VFE_IRQ_STATUS_VIOLATION;
+		evt_info.event_data = (void *)&err_evt_info;
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"VFE:%u current monotonic timestamp:[%lld.%09lld]",
+			evt_info.hw_idx, ts.tv_sec, ts.tv_nsec);
+
+		if (vfe_priv->event_cb)
+			vfe_priv->event_cb(vfe_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		cam_vfe_top_ver4_print_debug_reg_status(vfe_priv->top_priv);
+
+		cam_vfe_top_ver4_print_top_irq_error(vfe_priv,
+			irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0]);
+
+		ret = CAM_VFE_IRQ_STATUS_ERR;
+	}
+
+	if (vfe_priv->camif_debug & CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		CAM_DBG(CAM_ISP, "VFE:%u VFE_DIAG_SENSOR_STATUS: 0x%X",
+			evt_info.hw_idx, vfe_priv->mem_base,
+			cam_io_r(vfe_priv->mem_base +
+			vfe_priv->common_reg->diag_sensor_status_0));
+	}
+
+	/* Perf counter dump */
+	if (irq_status[vfe_priv->common_reg->frame_timing_irq_reg_idx] &
+		vfe_priv->reg_data->eof_irq_mask)
+		cam_vfe_top_dump_perf_counters("EOF", vfe_res->res_name, vfe_priv->top_priv);
+
+	if (irq_status[vfe_priv->common_reg->frame_timing_irq_reg_idx] &
+		vfe_priv->reg_data->sof_irq_mask)
+		cam_vfe_top_dump_perf_counters("SOF", vfe_res->res_name, vfe_priv->top_priv);
+
+	cam_vfe_top_put_evt_payload(vfe_priv, &payload);
+
+	CAM_DBG(CAM_ISP, "VFE:%u returning status = %d", evt_info.hw_idx, ret);
+	return ret;
+}
+
+static int cam_vfe_ver4_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc = 0;
+	int                                    i;
+	struct cam_isp_resource_node          *vfe_res;
+	struct cam_vfe_mux_ver4_data          *vfe_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	bool                                   error_flag = false;
+
+	vfe_res = th_payload->handler_priv;
+	vfe_priv = vfe_res->res_priv;
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if ((th_payload->evt_status_arr[0] &
+		vfe_priv->reg_data->error_irq_mask)) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%u Err IRQ status_0: 0x%X",
+			vfe_res->hw_intf->hw_idx,
+			th_payload->evt_status_arr[0]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from VFE:%u",
+			vfe_res->hw_intf->hw_idx);
+		cam_irq_controller_disable_all(
+			vfe_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_get_evt_payload(vfe_priv, &evt_payload);
+	if (rc)
+		return rc;
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		vfe_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		vfe_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_vfe_resource_start(
+	struct cam_isp_resource_node *vfe_res)
+{
+	struct cam_vfe_mux_ver4_data   *rsrc_data;
+	uint32_t                        val = 0, epoch_factor = 50;
+	int                             rc = 0;
+	uint32_t                        err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                        irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+
+	if (!vfe_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (vfe_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "VFE:%u Error, Invalid camif res res_state:%d",
+			vfe_res->hw_intf->hw_idx, vfe_res->res_state);
+		return -EINVAL;
+	}
+
+	memset(err_irq_mask, 0, sizeof(err_irq_mask));
+	memset(irq_mask, 0, sizeof(irq_mask));
+	rsrc_data = (struct cam_vfe_mux_ver4_data *)vfe_res->res_priv;
+
+	/* config debug status registers */
+	cam_io_w_mb(rsrc_data->reg_data->top_debug_cfg_en, rsrc_data->mem_base +
+		rsrc_data->common_reg->top_debug_cfg);
+
+	if (rsrc_data->is_lite || !rsrc_data->is_pixel_path)
+		goto skip_core_cfg;
+
+	/* IFE top cfg programmed via CDM */
+	CAM_DBG(CAM_ISP, "VFE:%u TOP core_cfg0: 0x%x core_cfg1: 0x%x",
+		vfe_res->hw_intf->hw_idx,
+		cam_io_r_mb(rsrc_data->mem_base +
+			rsrc_data->common_reg->core_cfg_0),
+		cam_io_r_mb(rsrc_data->mem_base +
+			rsrc_data->common_reg->core_cfg_1));
+
+	/* % epoch factor from userland */
+	if ((rsrc_data->epoch_factor) && (rsrc_data->epoch_factor <= 100))
+		epoch_factor = rsrc_data->epoch_factor;
+
+	val = ((rsrc_data->last_line + rsrc_data->vbi_value) -
+		rsrc_data->first_line) * epoch_factor / 100;
+
+	if (val > rsrc_data->last_line)
+		val = rsrc_data->last_line;
+
+	if (rsrc_data->horizontal_bin || rsrc_data->qcfa_bin ||
+		rsrc_data->sfe_binned_epoch_cfg)
+		val >>= 1;
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+				rsrc_data->common_reg->epoch_height_cfg);
+	CAM_DBG(CAM_ISP,
+		"VFE:%u height [0x%x : 0x%x] vbi_val: 0x%x epoch_factor: %u%% epoch_line_cfg: 0x%x",
+		vfe_res->hw_intf->hw_idx, rsrc_data->first_line, rsrc_data->last_line,
+		rsrc_data->vbi_value, epoch_factor, val);
+
+skip_core_cfg:
+	vfe_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* reset sof count */
+	rsrc_data->top_priv->sof_cnt = 0;
+
+	/* disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
+	if (rsrc_data->camif_debug &
+		CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		val = cam_io_r_mb(rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+		val |= rsrc_data->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+	}
+
+	if (vfe_res->is_per_port_start) {
+		CAM_DBG(CAM_ISP, "Skipping irq subscribe for resources that are not updated");
+		goto skip_irq_subscribe;
+	}
+
+	/* Skip subscribing to timing irqs in these scenarios:
+	 * Debug config is not enabled for IFE frame timing IRQs, and
+	 *     1. Resource is dual IFE slave
+	 *     2. Resource is not primary RDI
+	 *     3. non-sfe use cases, such cases are taken care in CSID.
+	 */
+
+	if (!(rsrc_data->top_priv->enable_ife_frame_irqs) &&
+		(((rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) && rsrc_data->is_dual) ||
+		(!rsrc_data->is_pixel_path && !vfe_res->is_rdi_primary_res) ||
+		!rsrc_data->handle_camif_irq))
+		goto skip_frame_irq_subscribe;
+
+	irq_mask[rsrc_data->common_reg->frame_timing_irq_reg_idx] =
+		rsrc_data->reg_data->sof_irq_mask | rsrc_data->reg_data->epoch0_irq_mask |
+		rsrc_data->reg_data->eof_irq_mask;
+
+	rsrc_data->n_frame_irqs =
+		hweight32(irq_mask[rsrc_data->common_reg->frame_timing_irq_reg_idx]);
+
+	if (!rsrc_data->frame_irq_handle) {
+		rsrc_data->frame_irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			irq_mask,
+			vfe_res,
+			vfe_res->top_half_handler,
+			vfe_res->bottom_half_handler,
+			vfe_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (rsrc_data->frame_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "VFE:%u Frame IRQs handle subscribe failure",
+				vfe_res->hw_intf->hw_idx);
+			rc = -ENOMEM;
+			rsrc_data->frame_irq_handle = 0;
+		}
+	}
+
+skip_frame_irq_subscribe:
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] = rsrc_data->reg_data->error_irq_mask;
+
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			vfe_res,
+			cam_vfe_ver4_err_irq_top_half,
+			vfe_res->bottom_half_handler,
+			vfe_res->tasklet_info,
+			&tasklet_bh_api,
+			CAM_IRQ_EVT_GROUP_0);
+
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "VFE:%u Error IRQ handle subscribe failure",
+				vfe_res->hw_intf->hw_idx);
+			rc = -ENOMEM;
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+skip_irq_subscribe:
+	rsrc_data->fsm_state = VFE_TOP_VER4_FSM_SOF;
+
+	CAM_DBG(CAM_ISP, "VFE:%u Res: %s Start Done",
+		vfe_res->hw_intf->hw_idx,
+		vfe_res->res_name);
+
+	return rc;
+}
+
+static int cam_vfe_resource_stop(
+	struct cam_isp_resource_node *vfe_res)
+{
+	struct cam_vfe_mux_ver4_data        *vfe_priv;
+	struct cam_vfe_top_ver4_priv        *top_priv;
+	int                                  rc = 0;
+	uint32_t                             val = 0;
+
+	if (!vfe_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((vfe_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(vfe_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	vfe_priv = (struct cam_vfe_mux_ver4_data *)vfe_res->res_priv;
+	top_priv = vfe_priv->top_priv;
+
+	if (vfe_priv->is_lite || !vfe_priv->is_pixel_path)
+		goto skip_core_decfg;
+
+	if ((vfe_priv->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(vfe_priv->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		val = cam_io_r_mb(vfe_priv->mem_base +
+			vfe_priv->common_reg->core_cfg_0);
+		val &= (~(1 << CAM_SHIFT_TOP_CORE_VER_4_CFG_DSP_EN));
+		cam_io_w_mb(val, vfe_priv->mem_base +
+			vfe_priv->common_reg->core_cfg_0);
+	}
+
+skip_core_decfg:
+	if (vfe_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		vfe_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	val = cam_io_r_mb(vfe_priv->mem_base +
+		vfe_priv->common_reg->diag_config);
+	if (val & vfe_priv->reg_data->enable_diagnostic_hw) {
+		val &= ~vfe_priv->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, vfe_priv->mem_base +
+			vfe_priv->common_reg->diag_config);
+	}
+
+	if (vfe_priv->frame_irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			vfe_priv->vfe_irq_controller,
+			vfe_priv->frame_irq_handle);
+		vfe_priv->frame_irq_handle = 0;
+	}
+	vfe_priv->n_frame_irqs = 0;
+
+	if (vfe_priv->irq_err_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			vfe_priv->vfe_irq_controller,
+			vfe_priv->irq_err_handle);
+		vfe_priv->irq_err_handle = 0;
+	}
+
+	/* Skip epoch factor reset for internal recovery */
+	if (!top_priv->top_common.skip_data_rst_on_stop)
+		vfe_priv->epoch_factor = 0;
+
+	CAM_DBG(CAM_ISP, "VFE:%u Res: %s Stopped",
+		vfe_res->hw_intf->hw_idx,
+		vfe_res->res_name);
+
+	return rc;
+}
+
+static int cam_vfe_resource_init(
+	struct cam_isp_resource_node *vfe_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_ver4_data          *rsrc_data;
+	struct cam_hw_soc_info                *soc_info;
+	int                                    rc = 0;
+
+	if (!vfe_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_res->res_priv;
+	soc_info = rsrc_data->soc_info;
+
+	if ((rsrc_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(rsrc_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_enable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"VFE:%u failed to enable dsp clk, rc = %d",
+				vfe_res->hw_intf->hw_idx, rc);
+	}
+
+	rsrc_data->sof_ts.tv_sec = 0;
+	rsrc_data->sof_ts.tv_nsec = 0;
+	rsrc_data->epoch_ts.tv_sec = 0;
+	rsrc_data->epoch_ts.tv_nsec = 0;
+	rsrc_data->eof_ts.tv_sec = 0;
+	rsrc_data->eof_ts.tv_nsec = 0;
+	rsrc_data->error_ts.tv_sec = 0;
+	rsrc_data->error_ts.tv_nsec = 0;
+
+	CAM_DBG(CAM_ISP, "VFE:%u Res: %s Init Done",
+		vfe_res->hw_intf->hw_idx,
+		vfe_res->res_name);
+
+	return rc;
+}
+
+static int cam_vfe_resource_deinit(
+	struct cam_isp_resource_node        *vfe_res,
+	void *deinit_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_ver4_data          *rsrc_data;
+	struct cam_hw_soc_info                *soc_info;
+	int                                    rc = 0;
+
+	if (!vfe_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_res->res_priv;
+	soc_info = rsrc_data->soc_info;
+
+	if ((rsrc_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(rsrc_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_disable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "VFE:%u failed to disable dsp clk",
+				vfe_res->hw_intf->hw_idx);
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%u Res: %s DeInit Done",
+		vfe_res->hw_intf->hw_idx,
+		vfe_res->res_name);
+	return rc;
+}
+
+int cam_vfe_res_mux_init(
+	struct cam_vfe_top_ver4_priv  *top_priv,
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *vfe_hw_info,
+	struct cam_isp_resource_node  *vfe_res,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_ver4_data           *vfe_priv = NULL;
+	struct cam_vfe_ver4_path_hw_info       *hw_info = vfe_hw_info;
+	struct cam_vfe_soc_private    *soc_priv = soc_info->soc_private;
+	int i;
+
+	vfe_priv = kzalloc(sizeof(struct cam_vfe_mux_ver4_data),
+		GFP_KERNEL);
+	if (!vfe_priv)
+		return -ENOMEM;
+
+	vfe_res->res_priv     = vfe_priv;
+	vfe_priv->mem_base    = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	vfe_priv->common_reg  = hw_info->common_reg;
+	vfe_priv->reg_data    = hw_info->reg_data;
+	vfe_priv->hw_intf     = hw_intf;
+	vfe_priv->is_lite     = soc_priv->is_ife_lite;
+	vfe_priv->soc_info    = soc_info;
+	vfe_priv->vfe_irq_controller = vfe_irq_controller;
+	vfe_priv->is_pixel_path = (vfe_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF);
+	vfe_priv->top_priv     = top_priv;
+
+	vfe_res->init                = cam_vfe_resource_init;
+	vfe_res->deinit              = cam_vfe_resource_deinit;
+	vfe_res->start               = cam_vfe_resource_start;
+	vfe_res->stop                = cam_vfe_resource_stop;
+	vfe_res->top_half_handler    = cam_vfe_handle_irq_top_half;
+	vfe_res->bottom_half_handler = cam_vfe_handle_irq_bottom_half;
+
+	spin_lock_init(&vfe_priv->spin_lock);
+	INIT_LIST_HEAD(&vfe_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&vfe_priv->evt_payload[i].list);
+		list_add_tail(&vfe_priv->evt_payload[i].list,
+			&vfe_priv->free_payload_list);
+	}
+	return 0;
+}
+
+int cam_vfe_res_mux_deinit(
+	struct cam_isp_resource_node  *vfe_res)
+{
+	struct cam_vfe_mux_ver4_data *vfe_priv;
+	int i = 0;
+
+	if (!vfe_res) {
+		CAM_ERR(CAM_ISP, "Error, VFE Node Resource is NULL %pK", vfe_res);
+		return -ENODEV;
+	}
+
+	vfe_priv = vfe_res->res_priv;
+
+	vfe_res->init                = NULL;
+	vfe_res->deinit              = NULL;
+	vfe_res->start               = NULL;
+	vfe_res->stop                = NULL;
+	vfe_res->process_cmd         = NULL;
+	vfe_res->top_half_handler    = NULL;
+	vfe_res->bottom_half_handler = NULL;
+	vfe_res->res_priv            = NULL;
+
+	if (!vfe_priv) {
+		CAM_ERR(CAM_ISP, "VFE:%u vfe_priv is NULL %pK", vfe_res->hw_intf->hw_idx, vfe_priv);
+		return -ENODEV;
+	}
+
+	INIT_LIST_HEAD(&vfe_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++)
+		INIT_LIST_HEAD(&vfe_priv->evt_payload[i].list);
+	kfree(vfe_priv);
+
+	return 0;
+}
+
+int cam_vfe_top_ver4_init(
+	struct cam_hw_soc_info                 *soc_info,
+	struct cam_hw_intf                     *hw_intf,
+	void                                   *top_hw_info,
+	void                                   *vfe_irq_controller,
+	struct cam_vfe_top                    **vfe_top_ptr)
+{
+	int i, j, rc = 0;
+	struct cam_vfe_top_ver4_priv           *top_priv = NULL;
+	struct cam_vfe_top_ver4_hw_info        *hw_info = top_hw_info;
+	struct cam_vfe_top                     *vfe_top;
+
+	vfe_top = kzalloc(sizeof(struct cam_vfe_top), GFP_KERNEL);
+	if (!vfe_top) {
+		CAM_DBG(CAM_ISP, "VFE:%u Error, Failed to alloc for vfe_top", hw_intf->hw_idx);
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	top_priv = kzalloc(sizeof(struct cam_vfe_top_ver4_priv),
+		GFP_KERNEL);
+	if (!top_priv) {
+		CAM_DBG(CAM_ISP, "VFE:%u Error, Failed to alloc for vfe_top_priv", hw_intf->hw_idx);
+		rc = -ENOMEM;
+		goto free_vfe_top;
+	}
+
+	vfe_top->top_priv = top_priv;
+	top_priv->top_common.applied_clk_rate = 0;
+
+	if (hw_info->num_mux > CAM_VFE_TOP_MUX_MAX) {
+		CAM_ERR(CAM_ISP, "VFE:%u Invalid number of input rsrc: %d, max: %d",
+			hw_intf->hw_idx, hw_info->num_mux, CAM_VFE_TOP_MUX_MAX);
+		rc = -EINVAL;
+		goto free_top_priv;
+	}
+
+	top_priv->top_common.num_mux = hw_info->num_mux;
+
+	for (i = 0, j = 0; i < top_priv->top_common.num_mux &&
+		j < hw_info->num_rdi; i++) {
+		top_priv->top_common.mux_rsrc[i].res_type =
+			CAM_ISP_RESOURCE_VFE_IN;
+		top_priv->top_common.mux_rsrc[i].hw_intf = hw_intf;
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		top_priv->top_common.req_clk_rate[i] = 0;
+
+		if (hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_4_0) {
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_CAMIF;
+
+			rc = cam_vfe_res_mux_init(top_priv,
+				hw_intf, soc_info,
+				&hw_info->vfe_full_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			scnprintf(top_priv->top_common.mux_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "CAMIF");
+		} else if (hw_info->mux_type[i] ==
+			CAM_VFE_PDLIB_VER_1_0) {
+			/* set the PDLIB resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_PDLIB;
+
+			rc = cam_vfe_res_mux_init(top_priv,
+				hw_intf, soc_info,
+				&hw_info->pdlib_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			scnprintf(top_priv->top_common.mux_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "PDLIB");
+		} else if (hw_info->mux_type[i] ==
+			CAM_VFE_RDI_VER_1_0) {
+			/* set the RDI resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_RDI0 + j;
+
+			scnprintf(top_priv->top_common.mux_rsrc[i].res_name,
+				CAM_ISP_RES_NAME_LEN, "RDI_%d", j);
+			rc = cam_vfe_res_mux_init(top_priv,
+				hw_intf, soc_info,
+				&hw_info->rdi_hw_info[j++],
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+		} else {
+			CAM_WARN(CAM_ISP, "VFE:%u Invalid mux type: %u",
+				hw_intf->hw_idx, hw_info->mux_type[i]);
+		}
+		if (rc)
+			goto deinit_resources;
+	}
+
+
+	vfe_top->hw_ops.get_hw_caps = cam_vfe_top_ver4_get_hw_caps;
+	vfe_top->hw_ops.init        = cam_vfe_top_ver4_init_hw;
+	vfe_top->hw_ops.reset       = cam_vfe_top_ver4_reset;
+	vfe_top->hw_ops.reserve     = cam_vfe_top_ver4_reserve;
+	vfe_top->hw_ops.release     = cam_vfe_top_ver4_release;
+	vfe_top->hw_ops.start       = cam_vfe_top_ver4_start;
+	vfe_top->hw_ops.stop        = cam_vfe_top_ver4_stop;
+	vfe_top->hw_ops.read        = cam_vfe_top_ver4_read;
+	vfe_top->hw_ops.write       = cam_vfe_top_ver4_write;
+	vfe_top->hw_ops.process_cmd = cam_vfe_top_ver4_process_cmd;
+	*vfe_top_ptr = vfe_top;
+
+	top_priv->common_data.hw_info      = hw_info;
+	top_priv->top_common.soc_info     = soc_info;
+	top_priv->common_data.hw_intf      = hw_intf;
+	top_priv->top_common.hw_idx        = hw_intf->hw_idx;
+	top_priv->common_data.common_reg   = hw_info->common_reg;
+
+	if (top_priv->common_data.common_reg->num_perf_counters > CAM_VFE_PERF_CNT_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid number of perf counters: %d max: %d",
+			top_priv->common_data.common_reg->num_perf_counters,
+			CAM_VFE_PERF_CNT_MAX);
+		rc = -EINVAL;
+		goto deinit_resources;
+	}
+
+	return rc;
+
+deinit_resources:
+
+	for (--i; i >= 0; i--) {
+		if (hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_4_0) {
+			if (cam_vfe_res_mux_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "VFE:%u Camif Deinit failed", hw_intf->hw_idx);
+		} else {
+			if (cam_vfe_res_mux_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP,
+					"VFE:%u Camif lite res id %d Deinit failed",
+					hw_intf->hw_idx, top_priv->top_common.mux_rsrc[i]
+					.res_id);
+		}
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	}
+
+
+free_top_priv:
+	kfree(vfe_top->top_priv);
+free_vfe_top:
+	kfree(vfe_top);
+end:
+	return rc;
+}
+
+int cam_vfe_top_ver4_deinit(struct cam_vfe_top  **vfe_top_ptr)
+{
+	int i, rc = 0;
+	struct cam_vfe_top_ver4_priv           *top_priv = NULL;
+	struct cam_vfe_top                     *vfe_top;
+
+	if (!vfe_top_ptr) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input");
+		return -EINVAL;
+	}
+
+	vfe_top = *vfe_top_ptr;
+	if (!vfe_top) {
+		CAM_ERR(CAM_ISP, "Error, vfe_top NULL");
+		return -ENODEV;
+	}
+
+	top_priv = vfe_top->top_priv;
+	if (!top_priv) {
+		CAM_ERR(CAM_ISP, "Error, vfe_top_priv NULL");
+		rc = -ENODEV;
+		goto free_vfe_top;
+	}
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+		rc = cam_vfe_res_mux_deinit(&top_priv->top_common.mux_rsrc[i]);
+		if (rc)
+			CAM_ERR(CAM_ISP, "VFE:%u Mux[%d] deinit failed rc=%d",
+				top_priv->common_data.hw_intf->hw_idx, i, rc);
+	}
+
+	kfree(vfe_top->top_priv);
+
+free_vfe_top:
+	kfree(vfe_top);
+	*vfe_top_ptr = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver4.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver4.h
@@ -0,0 +1,242 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_TOP_VER4_H_
+#define _CAM_VFE_TOP_VER4_H_
+
+#include "cam_vfe_top_common.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+#define CAM_VFE_RDI_VER2_MAX                           4
+#define CAM_VFE_CAMIF_LITE_EVT_MAX                     256
+#define CAM_VFE_TOP_DBG_REG_MAX                        35
+
+struct cam_vfe_top_ver4_perf_count_reg_offset {
+	uint32_t perf_count_cfg;
+	uint32_t perf_count_cfg_mc;
+	uint32_t perf_pix_count;
+	uint32_t perf_line_count;
+	uint32_t perf_stall_count;
+	uint32_t perf_always_count;
+	uint32_t perf_count_status;
+};
+
+struct cam_vfe_top_ver4_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t titan_version;
+	uint32_t hw_capability;
+	uint32_t main_feature;
+	uint32_t bayer_feature;
+	uint32_t lens_feature;
+	uint32_t stats_feature;
+	uint32_t color_feature;
+	uint32_t zoom_feature;
+	uint32_t fd_feature;
+	uint32_t global_reset_cmd;
+	uint32_t core_cgc_ovd_0;
+	uint32_t core_cgc_ovd_1;
+	uint32_t ahb_cgc_ovd;
+	uint32_t noc_cgc_ovd;
+	uint32_t bus_cgc_ovd;
+	uint32_t core_cfg_0;
+	uint32_t core_cfg_1;
+	uint32_t core_cfg_2;
+	uint32_t core_cfg_3;
+	uint32_t core_cfg_4;
+	uint32_t core_cfg_5;
+	uint32_t core_cfg_6;
+	uint32_t core_mux_cfg;
+	uint32_t period_cfg;
+	uint32_t reg_update_cmd;
+	uint32_t trigger_cdm_events;
+	uint32_t ipp_violation_status;
+	uint32_t ipp_violation_status_0;
+	uint32_t ipp_violation_status_1;
+	uint32_t bayer_violation_status;
+	uint32_t pdaf_violation_status;
+	uint32_t custom_frame_idx;
+	uint32_t dsp_status;
+	uint32_t diag_config;
+	uint32_t diag_sensor_status_0;
+	uint32_t diag_sensor_status_1;
+	uint32_t diag_frm_cnt_status_0;
+	uint32_t diag_frm_cnt_status_1;
+	uint32_t diag_frm_cnt_status_2;
+	uint32_t stats_throttle_cfg_0;
+	uint32_t stats_throttle_cfg_1;
+	uint32_t stats_throttle_cfg_2;
+	uint32_t pdaf_parsed_throttle_cfg;
+	uint32_t wirc_throttle_cfg;
+	uint32_t fd_y_throttle_cfg;
+	uint32_t fd_c_throttle_cfg;
+	uint32_t ds16_g_throttle_cfg;
+	uint32_t ds16_br_throttle_cfg;
+	uint32_t ds4_g_throttle_cfg;
+	uint32_t ds4_br_throttle_cfg;
+	uint32_t ds2_g_throttle_cfg;
+	uint32_t ds2_br_throttle_cfg;
+	uint32_t full_out_throttle_cfg;
+	uint32_t bus_violation_status;
+	uint32_t bus_overflow_status;
+	uint32_t irq_sub_pattern_cfg;
+	uint32_t epoch0_pattern_cfg;
+	uint32_t epoch1_pattern_cfg;
+	uint32_t epoch_height_cfg;
+	uint32_t num_perf_counters;
+	struct cam_vfe_top_ver4_perf_count_reg_offset
+		perf_count_reg[CAM_VFE_PERF_CNT_MAX];
+	uint32_t top_debug_cfg;
+	uint32_t bayer_debug_cfg;
+	uint32_t pdaf_input_cfg_0;
+	uint32_t pdaf_input_cfg_1;
+	uint32_t num_top_debug_reg;
+	uint32_t *top_debug;
+	uint32_t frame_timing_irq_reg_idx;
+};
+
+struct cam_vfe_top_common_cfg {
+	uint32_t     vid_ds16_r2pd;
+	uint32_t     vid_ds4_r2pd;
+	uint32_t     disp_ds16_r2pd;
+	uint32_t     disp_ds4_r2pd;
+	uint32_t     dsp_streaming_tap_point;
+	uint32_t     ihist_src_sel;
+	uint32_t     input_pp_fmt;
+	uint32_t     hdr_mux_sel_pp;
+};
+
+struct cam_vfe_top_ver4_module_desc {
+	uint32_t id;
+	uint8_t *desc;
+};
+
+struct cam_vfe_bayer_ver4_module_desc {
+	uint32_t id;
+	uint8_t *desc;
+};
+
+struct cam_vfe_top_ver4_wr_client_desc {
+	uint32_t  wm_id;
+	uint8_t  *desc;
+};
+
+struct cam_vfe_top_ver4_top_err_irq_desc {
+	uint32_t  bitmask;
+	char     *err_name;
+	char     *desc;
+};
+
+struct cam_vfe_top_ver4_pdaf_violation_desc {
+	uint32_t  bitmask;
+	char     *desc;
+};
+
+struct cam_vfe_top_ver4_bayer_violation_desc {
+	uint32_t bitmask;
+	char     *desc;
+};
+
+struct cam_vfe_top_ver4_pdaf_lcr_res_info {
+	uint32_t  res_id;
+	uint32_t  val;
+};
+
+struct cam_vfe_ver4_path_hw_info {
+	struct cam_vfe_top_ver4_reg_offset_common  *common_reg;
+	struct cam_vfe_ver4_path_reg_data          *reg_data;
+};
+
+struct cam_vfe_top_ver4_debug_reg_info {
+	uint32_t  shift;
+	char     *clc_name;
+};
+
+
+struct cam_vfe_ver4_fcg_module_info {
+	uint32_t fcg_index_shift;
+	uint32_t max_reg_val_pair_size;
+	uint32_t fcg_type_size;
+	uint32_t fcg_phase_index_cfg_0;
+	uint32_t fcg_phase_index_cfg_1;
+	uint32_t fcg_reg_ctxt_shift;
+	uint32_t fcg_reg_ctxt_mask;
+	uint32_t fcg_reg_ctxt_sel;
+};
+
+struct cam_vfe_top_ver4_hw_info {
+	struct cam_vfe_top_ver4_reg_offset_common      *common_reg;
+	struct cam_vfe_ver4_path_hw_info                vfe_full_hw_info;
+	struct cam_vfe_ver4_path_hw_info                pdlib_hw_info;
+	struct cam_vfe_ver4_path_hw_info               *rdi_hw_info;
+	struct cam_vfe_ver4_path_reg_data              *reg_data;
+	struct cam_vfe_top_ver4_wr_client_desc         *wr_client_desc;
+	struct cam_vfe_top_ver4_module_desc            *ipp_module_desc;
+	struct cam_vfe_bayer_ver4_module_desc          *bayer_module_desc;
+	uint32_t                                        num_reg;
+	struct cam_vfe_top_ver4_debug_reg_info        (*debug_reg_info)[][8];
+	uint32_t                                        num_mux;
+	uint32_t                                        num_path_port_map;
+	uint32_t mux_type[CAM_VFE_TOP_MUX_MAX];
+	uint32_t path_port_map[CAM_ISP_HW_PATH_PORT_MAP_MAX][2];
+	uint32_t                                         num_rdi;
+	uint32_t                                         num_top_errors;
+	struct cam_vfe_top_ver4_top_err_irq_desc        *top_err_desc;
+	uint32_t                                         num_pdaf_violation_errors;
+	struct cam_vfe_top_ver4_pdaf_violation_desc     *pdaf_violation_desc;
+	struct cam_vfe_top_ver4_pdaf_lcr_res_info       *pdaf_lcr_res_mask;
+	uint32_t                                         num_pdaf_lcr_res;
+	struct cam_vfe_ver4_fcg_module_info             *fcg_module_info;
+	bool                                             fcg_supported;
+	bool                                             fcg_mc_supported;
+};
+
+struct cam_vfe_ver4_path_reg_data {
+	uint32_t                                     epoch_line_cfg;
+	uint32_t                                     sof_irq_mask;
+	uint32_t                                     epoch0_irq_mask;
+	uint32_t                                     epoch1_irq_mask;
+	uint32_t                                     eof_irq_mask;
+	uint32_t                                     error_irq_mask;
+	uint32_t                                     enable_diagnostic_hw;
+	uint32_t                                     top_debug_cfg_en;
+	uint32_t                                     ipp_violation_mask;
+	uint32_t                                     bayer_violation_mask;
+	uint32_t                                     pdaf_violation_mask;
+	bool                                         is_mc_path;
+	uint32_t                                     frm_irq_hw_ctxt_mask[CAM_ISP_MULTI_CTXT_MAX];
+};
+
+
+int cam_vfe_top_ver4_init(struct cam_hw_soc_info     *soc_info,
+	struct cam_hw_intf                           *hw_intf,
+	void                                         *top_hw_info,
+	void                                         *vfe_irq_controller,
+	struct cam_vfe_top                          **vfe_top);
+
+int cam_vfe_top_ver4_deinit(struct cam_vfe_top      **vfe_top);
+
+#define VFE_DBG_INFO(shift_val, name) {.shift = shift_val, .clc_name = name}
+
+#define VFE_DBG_INFO_ARRAY_4bit(name1, name2, name3, name4, name5, name6, name7, name8) \
+	{                                                                               \
+		VFE_DBG_INFO(0, name1),                                                 \
+		VFE_DBG_INFO(4, name2),                                                 \
+		VFE_DBG_INFO(8, name3),                                                 \
+		VFE_DBG_INFO(12, name4),                                                \
+		VFE_DBG_INFO(16, name5),                                                \
+		VFE_DBG_INFO(20, name6),                                                \
+		VFE_DBG_INFO(24, name7),                                                \
+		VFE_DBG_INFO(28, name8),                                                \
+	}
+
+#define CAM_VFE_ADD_REG_VAL_PAIR(buf_array, index, offset, val)    \
+	do {                                               \
+		buf_array[(index)++] = offset;             \
+		buf_array[(index)++] = val;                \
+	} while (0)
+
+#endif /* _CAM_VFE_TOP_VER4_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/include/cam_vfe_top.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/include/cam_vfe_top.h
@@ -0,0 +1,52 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_TOP_H_
+#define _CAM_VFE_TOP_H_
+
+#include "cam_hw_intf.h"
+#include "cam_isp_hw.h"
+
+#define CAM_VFE_TOP_VER_1_0 0x100000
+#define CAM_VFE_TOP_VER_2_0 0x200000
+#define CAM_VFE_TOP_VER_3_0 0x300000
+#define CAM_VFE_TOP_VER_4_0 0x400000
+
+#define CAM_VFE_CAMIF_VER_1_0 0x10
+#define CAM_VFE_CAMIF_VER_2_0 0x20
+#define CAM_VFE_CAMIF_VER_3_0 0x30
+#define CAM_VFE_CAMIF_VER_4_0 0x40
+
+#define CAM_VFE_CAMIF_LITE_VER_2_0 0x02
+
+#define CAM_VFE_RDI_VER_1_0    0x1000
+#define CAM_VFE_IN_RD_VER_1_0  0x2000
+
+#define CAM_VFE_LCR_VER_1_0 0x100
+#define CAM_VFE_PDLIB_VER_1_0 0x10000
+
+/*
+ * Debug values for camif module
+ */
+#define CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS      BIT(0)
+#define CAMIF_DEBUG_ENABLE_REG_DUMP                BIT(1)
+#define CAM_VFE_CAMIF_EVT_MAX                      256
+
+struct cam_vfe_top {
+	void                   *top_priv;
+	struct cam_hw_ops       hw_ops;
+};
+
+int cam_vfe_top_init(uint32_t          top_version,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *top_hw_info,
+	void                          *vfe_irq_controller,
+	struct cam_vfe_top           **vfe_top);
+
+int cam_vfe_top_deinit(uint32_t        top_version,
+	struct cam_vfe_top           **vfe_top);
+
+#endif /* _CAM_VFE_TOP_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/cam_jpeg_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/cam_jpeg_context.c
@@ -0,0 +1,402 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#include <media/cam_sync.h>
+#include "cam_mem_mgr.h"
+#include "cam_jpeg_context.h"
+#include "cam_context_utils.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+#include "cam_jpeg_hw_intf.h"
+
+static const char jpeg_dev_name[] = "cam-jpeg";
+
+static int cam_jpeg_context_dump_active_request(void *data, void *args)
+{
+
+	struct cam_context         *ctx = (struct cam_context *)data;
+	struct cam_ctx_request     *req = NULL;
+	struct cam_ctx_request     *req_temp = NULL;
+	struct cam_hw_dump_pf_args *pf_args = (struct cam_hw_dump_pf_args *)args;
+	int rc = 0;
+
+	if (!ctx || !pf_args) {
+		CAM_ERR(CAM_JPEG, "Invalid ctx %pK or pf args %pK",
+			ctx, pf_args);
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_JPEG, "iommu fault for jpeg ctx %d state %d",
+		ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+			&ctx->active_req_list, list) {
+		CAM_INFO(CAM_JPEG, "Active req_id: %lld, ctx_id: %u",
+			req->request_id, ctx->ctx_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_args, &req->pf_data);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "Failed to dump pf info ctx_id: %u state: %d",
+				ctx->ctx_id, ctx->state);
+	}
+
+	if (pf_args->pf_context_info.ctx_found) {
+		/* Send PF notification to UMD if PF found on current CTX */
+		rc = cam_context_send_pf_evt(ctx, pf_args);
+		if (rc)
+			CAM_ERR(CAM_JPEG,
+				"Failed to notify PF event to userspace rc: %d", rc);
+	}
+
+	return rc;
+}
+
+static int cam_jpeg_context_mini_dump(void *priv, void *args)
+{
+	int rc;
+	struct cam_context *ctx;
+
+	if (!priv || args) {
+		CAM_ERR(CAM_ICP, "Invalid param priv %pK args %pK", priv, args);
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)priv;
+	rc = cam_context_mini_dump(ctx, args);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Mini Dump failed %d", rc);
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Unable to Acquire device %d", rc);
+	else
+		ctx->state = CAM_CTX_ACQUIRED;
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	cam_common_release_evt_params(ctx->dev_hdl);
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Unable to release device %d", rc);
+
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_dump_dev_in_acquired(
+	struct cam_context      *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Failed to dump device, rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_flush_dev_in_acquired(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_context_utils_flush_args flush_args;
+
+	flush_args.cmd = cmd;
+	flush_args.flush_active_req = true;
+
+	rc = cam_context_flush_dev_to_hw(ctx, &flush_args);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to flush device");
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_config_dev_in_acquired(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	return cam_context_prepare_dev_to_hw(ctx, cmd);
+}
+
+static int __cam_jpeg_ctx_handle_buf_done_in_acquired(void *ctx, void *done_evt_data)
+{
+	struct cam_jpeg_hw_buf_done_evt_data *buf_done = done_evt_data;
+
+	return cam_context_buf_done_from_hw(ctx, buf_done->buf_done_data,
+		 buf_done->evt_id);
+}
+
+static int __cam_jpeg_ctx_handle_evt_inducement(void *ctx, void *inject_evt_arg)
+{
+	return cam_context_apply_evt_injection(ctx, inject_evt_arg);
+}
+
+static int __cam_jpeg_ctx_handle_hw_event(void *ctx,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc;
+
+	if (!ctx || !evt_data) {
+		CAM_ERR(CAM_JPEG, "Invalid parameters ctx %s evt_data: %s",
+			CAM_IS_NULL_TO_STR(ctx), CAM_IS_NULL_TO_STR(evt_data));
+		return -EINVAL;
+	}
+
+	switch (evt_id) {
+	case CAM_JPEG_EVT_ID_BUF_DONE:
+		rc = __cam_jpeg_ctx_handle_buf_done_in_acquired(ctx, evt_data);
+		break;
+	case CAM_JPEG_EVT_ID_INDUCE_ERR:
+		rc = __cam_jpeg_ctx_handle_evt_inducement(ctx, evt_data);
+		break;
+	default:
+		CAM_ERR(CAM_JPEG, "Invalid event id: %u", evt_id);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_stop_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Failed in Stop dev, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int cam_jpeg_context_validate_event_notify_injection(struct cam_context *ctx,
+	struct cam_hw_inject_evt_param *evt_params)
+{
+	int rc = 0;
+	uint32_t evt_type;
+	uint64_t req_id;
+
+	req_id   = evt_params->req_id;
+	evt_type = evt_params->u.evt_notify.evt_notify_type;
+
+	switch (evt_type) {
+	case V4L_EVENT_CAM_REQ_MGR_NODE_EVENT: {
+		struct cam_hw_inject_node_evt_param *node_evt_params =
+			&evt_params->u.evt_notify.u.node_evt_params;
+
+		switch (node_evt_params->event_type) {
+		case CAM_REQ_MGR_RETRY_EVENT:
+			break;
+		default:
+			CAM_ERR(CAM_JPEG,
+				"Invalid event type %u for node event injection event cause: %u req id: %llu ctx id: %u dev hdl: %d",
+				node_evt_params->event_type, node_evt_params->event_cause,
+				req_id, ctx->ctx_id, ctx->dev_hdl);
+			return -EINVAL;
+		}
+
+		CAM_INFO(CAM_JPEG,
+			"Inject Node evt: event type: %u event cause: %u req id: %llu ctx id: %u dev hdl: %d",
+			node_evt_params->event_type, node_evt_params->event_cause,
+			req_id, ctx->ctx_id, ctx->dev_hdl);
+		break;
+	}
+	case V4L_EVENT_CAM_REQ_MGR_PF_ERROR: {
+		struct cam_hw_inject_pf_evt_param *pf_evt_params =
+			&evt_params->u.evt_notify.u.pf_evt_params;
+		bool non_fatal_en;
+
+		rc = cam_smmu_is_cb_non_fatal_fault_en(ctx->img_iommu_hdl, &non_fatal_en);
+		if (rc) {
+			CAM_ERR(CAM_JPEG,
+				"Fail to query whether device's cb has non-fatal enabled rc: %d",
+				rc);
+			return rc;
+		}
+
+		if (!non_fatal_en) {
+			CAM_ERR(CAM_JPEG,
+				"Fail to inject page fault event notification. Page fault is fatal for JPEG");
+			return -EINVAL;
+		}
+
+		CAM_INFO(CAM_JPEG,
+			"Inject PF evt: req_id: %llu ctx id: %u dev hdl: %d ctx found: %hhu",
+			req_id, ctx->ctx_id, ctx->dev_hdl, pf_evt_params->ctx_found);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_JPEG, "Event notification type not supported: %u", evt_type);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_jpeg_context_inject_evt(void *context, void *evt_args)
+{
+	struct cam_context *ctx = context;
+	struct cam_hw_inject_evt_param *evt_params = NULL;
+	struct cam_hw_inject_buffer_error_param *buf_err_params = NULL;
+	int rc = 0;
+
+	if (!ctx || !evt_args) {
+		CAM_ERR(CAM_JPEG,
+			"invalid params ctx %s event args %s",
+			CAM_IS_NULL_TO_STR(ctx), CAM_IS_NULL_TO_STR(evt_args));
+		return -EINVAL;
+	}
+
+	evt_params = (struct cam_hw_inject_evt_param *)evt_args;
+
+	if (evt_params->inject_id == CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE) {
+		buf_err_params = &evt_params->u.buf_err_evt;
+		if (buf_err_params->sync_error > CAM_SYNC_JPEG_EVENT_START ||
+			buf_err_params->sync_error < CAM_SYNC_JPEG_EVENT_END) {
+			CAM_INFO(CAM_JPEG, "Inject buffer sync error %u ctx id: %u req id %llu",
+				buf_err_params->sync_error, ctx->ctx_id, evt_params->req_id);
+		} else {
+			CAM_ERR(CAM_JPEG, "Invalid buffer sync error %u",
+				buf_err_params->sync_error);
+			return -EINVAL;
+		}
+	} else {
+		rc = cam_jpeg_context_validate_event_notify_injection(ctx, evt_params);
+		if (rc) {
+			CAM_ERR(CAM_JPEG,
+				"Event notification injection failed validation rc: %d", rc);
+			return rc;
+		}
+	}
+
+	if (ctx->hw_mgr_intf->hw_inject_evt)
+		ctx->hw_mgr_intf->hw_inject_evt(ctx->ctxt_to_hw_map, evt_args);
+
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_jpeg_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = { },
+		.crm_ops = { },
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_jpeg_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = { },
+		.irq_ops = NULL,
+		.mini_dump_ops = cam_jpeg_context_mini_dump,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.release_dev = __cam_jpeg_ctx_release_dev_in_acquired,
+			.config_dev = __cam_jpeg_ctx_config_dev_in_acquired,
+			.stop_dev = __cam_jpeg_ctx_stop_dev_in_acquired,
+			.flush_dev = __cam_jpeg_ctx_flush_dev_in_acquired,
+			.dump_dev = __cam_jpeg_ctx_dump_dev_in_acquired,
+		},
+		.crm_ops = { },
+		.irq_ops = __cam_jpeg_ctx_handle_hw_event,
+		.pagefault_ops = cam_jpeg_context_dump_active_request,
+		.mini_dump_ops = cam_jpeg_context_mini_dump,
+		.evt_inject_ops = cam_jpeg_context_inject_evt,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {},
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {},
+	},
+};
+
+int cam_jpeg_context_init(struct cam_jpeg_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id,
+	int img_iommu_hdl)
+{
+	int rc;
+	int i;
+
+	if (!ctx || !ctx_base) {
+		CAM_ERR(CAM_JPEG, "Invalid Context");
+		rc = -EFAULT;
+		goto err;
+	}
+
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->base = ctx_base;
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++)
+		ctx->req_base[i].req_priv = &ctx->jpeg_req[i];
+
+	rc = cam_context_init(ctx_base, jpeg_dev_name, CAM_JPEG, ctx_id,
+		NULL, hw_intf, ctx->req_base, CAM_CTX_REQ_MAX, img_iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Camera Context Base init failed");
+		goto err;
+	}
+
+	ctx_base->state_machine = cam_jpeg_ctx_state_machine;
+	ctx_base->ctx_priv = ctx;
+
+	ctx_base->max_hw_update_entries = CAM_CTX_CFG_MAX;
+	ctx_base->max_in_map_entries = CAM_CTX_CFG_MAX;
+	ctx_base->max_out_map_entries = CAM_CTX_CFG_MAX;
+err:
+	return rc;
+}
+
+int cam_jpeg_context_deinit(struct cam_jpeg_context *ctx)
+{
+	if (!ctx || !ctx->base) {
+		CAM_ERR(CAM_JPEG, "Invalid params: %pK", ctx);
+		return -EINVAL;
+	}
+
+	cam_context_deinit(ctx->base);
+
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/cam_jpeg_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/cam_jpeg_context.h
@@ -0,0 +1,71 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_JPEG_CONTEXT_H_
+#define _CAM_JPEG_CONTEXT_H_
+
+#include <media/cam_jpeg.h>
+
+#include "cam_context.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+
+#define CAM_JPEG_HW_EVENT_MAX 20
+
+/**
+ * struct cam_jpeg_context - Jpeg context
+ * @base      : Base jpeg cam context object
+ * @jpeg_req  : Jpeg reguest data stored during prepare update
+ * @req_base  : Common request structure
+ */
+struct cam_jpeg_context {
+	struct cam_context *base;
+	struct cam_jpeg_request_data jpeg_req[CAM_CTX_REQ_MAX];
+	struct cam_ctx_request req_base[CAM_CTX_REQ_MAX];
+};
+
+/* cam jpeg context irq handling function type */
+typedef int (*cam_jpeg_hw_event_cb_func)(
+	struct cam_jpeg_context *ctx_jpeg,
+	void *evt_data);
+
+/**
+ * struct cam_jpeg_ctx_irq_ops - Function table for handling IRQ callbacks
+ *
+ * @irq_ops: Array of handle function pointers.
+ *
+ */
+struct cam_jpeg_ctx_irq_ops {
+	cam_jpeg_hw_event_cb_func irq_ops[CAM_JPEG_HW_EVENT_MAX];
+};
+
+/**
+ * cam_jpeg_context_init()
+ *
+ * @brief: Initialization function for the JPEG context
+ *
+ * @ctx: JPEG context obj to be initialized
+ * @ctx_base: Context base from cam_context
+ * @hw_intf: JPEG hw manager interface
+ * @ctx_id: ID for this context
+ * @img_iommu_hdl: IOMMU HDL for image buffers
+ *
+ */
+int cam_jpeg_context_init(struct cam_jpeg_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id,
+	int img_iommu_hdl);
+
+/**
+ * cam_jpeg_context_deinit()
+ *
+ * @brief: Deinitialize function for the JPEG context
+ *
+ * @ctx: JPEG context obj to be deinitialized
+ *
+ */
+int cam_jpeg_context_deinit(struct cam_jpeg_context *ctx);
+
+#endif  /* __CAM_JPEG_CONTEXT_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/cam_jpeg_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/cam_jpeg_dev.c
@@ -0,0 +1,295 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_node.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_jpeg_dev.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+#include "cam_common_util.h"
+#include "cam_context_utils.h"
+
+#define CAM_JPEG_DEV_NAME "cam-jpeg"
+
+static struct cam_jpeg_dev g_jpeg_dev;
+
+static int cam_jpeg_dev_evt_inject_cb(void *inject_args)
+{
+	struct cam_common_inject_evt_param *inject_params = inject_args;
+	int i;
+
+	for (i = 0; i < CAM_JPEG_CTX_MAX; i++) {
+		if (g_jpeg_dev.ctx[i].dev_hdl == inject_params->dev_hdl) {
+			cam_context_add_evt_inject(&g_jpeg_dev.ctx[i],
+				&inject_params->evt_params);
+			return 0;
+		}
+	}
+
+	CAM_ERR(CAM_JPEG, "No dev hdl found %d", inject_params->dev_hdl);
+	return -EINVAL;
+}
+
+static void cam_jpeg_dev_iommu_fault_handler(
+	struct cam_smmu_pf_info *pf_smmu_info)
+{
+	int i, rc;
+	struct cam_node *node = NULL;
+	struct cam_hw_dump_pf_args pf_args = {0};
+
+	if (!pf_smmu_info || !pf_smmu_info->token) {
+		CAM_ERR(CAM_JPEG, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_smmu_info->token;
+
+	pf_args.pf_smmu_info = pf_smmu_info;
+
+	for (i = 0; i < node->ctx_size; i++) {
+		cam_context_dump_pf_info(&(node->ctx_list[i]), &pf_args);
+		if (pf_args.pf_context_info.ctx_found)
+			/* found ctx and packet of the faulted address */
+			break;
+	}
+
+	if (i == node->ctx_size) {
+		/* Faulted ctx not found. But report PF to UMD anyway*/
+		rc = cam_context_send_pf_evt(NULL, &pf_args);
+		if (rc)
+			CAM_ERR(CAM_JPEG,
+				"Failed to notify PF event to userspace rc: %d", rc);
+	}
+}
+
+static void cam_jpeg_dev_mini_dump_cb(void *priv, void *args)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!priv || !args) {
+		CAM_ERR(CAM_JPEG, "Invalid param priv %pK %pK args", priv, args);
+		return;
+	}
+
+	ctx = (struct cam_context *)priv;
+	cam_context_mini_dump_from_hw(ctx, args);
+}
+
+static const struct of_device_id cam_jpeg_dt_match[] = {
+	{
+		.compatible = "qcom,cam-jpeg"
+	},
+	{ }
+};
+
+static int cam_jpeg_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
+	mutex_lock(&g_jpeg_dev.jpeg_mutex);
+	g_jpeg_dev.open_cnt++;
+	mutex_unlock(&g_jpeg_dev.jpeg_mutex);
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
+	return 0;
+}
+
+static int cam_jpeg_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&g_jpeg_dev.jpeg_mutex);
+	if (g_jpeg_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_JPEG, "JPEG subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	g_jpeg_dev.open_cnt--;
+
+	if (!node) {
+		CAM_ERR(CAM_JPEG, "Node ptr is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (g_jpeg_dev.open_cnt == 0)
+		cam_node_shutdown(node);
+
+end:
+	mutex_unlock(&g_jpeg_dev.jpeg_mutex);
+	return rc;
+}
+
+static int cam_jpeg_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_JPEG, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+	return cam_jpeg_subdev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_jpeg_subdev_internal_ops = {
+	.close = cam_jpeg_subdev_close,
+	.open = cam_jpeg_subdev_open,
+};
+
+static int cam_jpeg_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+	int i;
+	struct cam_hw_mgr_intf hw_mgr_intf;
+	struct cam_node *node;
+	int iommu_hdl = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	g_jpeg_dev.sd.internal_ops = &cam_jpeg_subdev_internal_ops;
+	g_jpeg_dev.sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+	rc = cam_subdev_probe(&g_jpeg_dev.sd, pdev, CAM_JPEG_DEV_NAME,
+		CAM_JPEG_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "JPEG cam_subdev_probe failed %d", rc);
+		goto err;
+	}
+	node = (struct cam_node *)g_jpeg_dev.sd.token;
+
+	rc = cam_jpeg_hw_mgr_init(pdev->dev.of_node,
+		(uint64_t *)&hw_mgr_intf, &iommu_hdl,
+		cam_jpeg_dev_mini_dump_cb);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Can not initialize JPEG HWmanager %d", rc);
+		goto unregister;
+	}
+
+	for (i = 0; i < CAM_JPEG_CTX_MAX; i++) {
+		rc = cam_jpeg_context_init(&g_jpeg_dev.ctx_jpeg[i],
+			&g_jpeg_dev.ctx[i],
+			&node->hw_mgr_intf,
+			i, iommu_hdl);
+		if (rc) {
+			CAM_ERR(CAM_JPEG, "JPEG context init failed %d %d",
+				i, rc);
+			goto ctx_init_fail;
+		}
+	}
+
+	cam_common_register_evt_inject_cb(cam_jpeg_dev_evt_inject_cb,
+		CAM_COMMON_EVT_INJECT_HW_JPEG);
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_jpeg_dev.ctx, CAM_JPEG_CTX_MAX,
+		CAM_JPEG_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "JPEG node init failed %d", rc);
+		goto ctx_init_fail;
+	}
+
+	node->sd_handler = cam_jpeg_subdev_close_internal;
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_jpeg_dev_iommu_fault_handler, node);
+
+	mutex_init(&g_jpeg_dev.jpeg_mutex);
+
+	rc = cam_subdev_register(&g_jpeg_dev.sd, pdev);
+	CAM_DBG(CAM_JPEG, "Component bound successfully");
+
+	return rc;
+
+ctx_init_fail:
+	for (--i; i >= 0; i--)
+		if (cam_jpeg_context_deinit(&g_jpeg_dev.ctx_jpeg[i]))
+			CAM_ERR(CAM_JPEG, "deinit fail %d %d", i, rc);
+unregister:
+	if (cam_subdev_remove(&g_jpeg_dev.sd))
+		CAM_ERR(CAM_JPEG, "remove fail %d", rc);
+err:
+	return rc;
+}
+
+static void cam_jpeg_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+	int i;
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_jpeg_context_deinit(&g_jpeg_dev.ctx_jpeg[i]);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "JPEG context %d deinit failed %d",
+				i, rc);
+	}
+
+	rc = cam_unregister_subdev(&g_jpeg_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Unregister failed %d", rc);
+
+	rc = cam_subdev_remove(&g_jpeg_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Subdev remove failed %d", rc);
+}
+
+const static struct component_ops cam_jpeg_dev_component_ops = {
+	.bind = cam_jpeg_dev_component_bind,
+	.unbind = cam_jpeg_dev_component_unbind,
+};
+
+static int cam_jpeg_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_jpeg_dev_component_ops);
+	return 0;
+}
+
+static int cam_jpeg_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_JPEG, "Adding JPEG component");
+	rc = component_add(&pdev->dev, &cam_jpeg_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to add component rc: %d", rc);
+
+	return rc;
+
+}
+
+struct platform_driver jpeg_driver = {
+	.probe = cam_jpeg_dev_probe,
+	.remove = cam_jpeg_dev_remove,
+	.driver = {
+		.name = "cam_jpeg",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_jpeg_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_jpeg_dev_init_module(void)
+{
+	return platform_driver_register(&jpeg_driver);
+}
+
+void cam_jpeg_dev_exit_module(void)
+{
+	platform_driver_unregister(&jpeg_driver);
+}
+
+MODULE_DESCRIPTION("MSM JPEG driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/cam_jpeg_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/cam_jpeg_dev.h
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_JPEG_DEV_H_
+#define _CAM_JPEG_DEV_H_
+
+#include "cam_subdev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_context.h"
+#include "cam_jpeg_context.h"
+
+/**
+ * struct cam_jpeg_dev - Camera JPEG V4l2 device node
+ *
+ * @sd: Commone camera subdevice node
+ * @node: Pointer to jpeg subdevice
+ * @ctx: JPEG base context storage
+ * @ctx_jpeg: JPEG private context storage
+ * @jpeg_mutex: Jpeg dev mutex
+ * @open_cnt: Open device count
+ */
+struct cam_jpeg_dev {
+	struct cam_subdev sd;
+	struct cam_node *node;
+	struct cam_context ctx[CAM_JPEG_CTX_MAX];
+	struct cam_jpeg_context ctx_jpeg[CAM_JPEG_CTX_MAX];
+	struct mutex jpeg_mutex;
+	int32_t open_cnt;
+};
+
+/**
+ * @brief : API to register JPEG dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_jpeg_dev_init_module(void);
+
+/**
+ * @brief : API to remove JPEG dev from platform framework.
+ */
+void cam_jpeg_dev_exit_module(void);
+#endif /* __CAM_JPEG_DEV_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
@@ -0,0 +1,2374 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/uaccess.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/mutex.h>
+#include <linux/spinlock_types.h>
+#include <linux/timer.h>
+#include <linux/debugfs.h>
+#include <media/cam_defs.h>
+#include <media/cam_jpeg.h>
+#include <media/cam_sync.h>
+
+#include "cam_packet_util.h"
+#include "cam_hw.h"
+#include "cam_jpeg_context.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_jpeg_hw_mgr.h"
+#include "cam_smmu_api.h"
+#include "cam_mem_mgr.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+#include "cam_cpas_api.h"
+#include "cam_sync_api.h"
+#include "cam_presil_hw_access.h"
+
+#define CAM_JPEG_HW_ENTRIES_MAX                       20
+
+#define CAM_JPEG_MAX_NUM_CMD_BUFFS                    5
+
+#define CAM_JPEG_CHBASE_CMD_BUFF_IDX                  0
+#define CAM_JPEG_CFG_CMD_BUFF_IDX                     1
+#define CAM_JPEG_PARAM_CMD_BUFF_IDX                   2
+#define CAM_JPEG_THUBMNAIL_SIZE_CMD_BUFF_IDX          3
+
+#define CAM_JPEG_DEV_TYPE(type) ((type) == CAM_JPEG_DEV_TYPE_ENC ? "ENC" : "DMA")
+
+static struct cam_jpeg_hw_mgr g_jpeg_hw_mgr;
+
+static int32_t cam_jpeg_hw_mgr_sched_bottom_half(uint32_t irq_status,
+	int32_t result_size, void *data);
+static int cam_jpeg_mgr_process_hw_update_entries(void *priv, void *data);
+static int cam_jpeg_insert_cdm_change_base(
+	struct cam_hw_config_args *config_args,
+	struct cam_jpeg_hw_ctx_data *ctx_data,
+	struct cam_jpeg_hw_mgr *hw_mgr);
+
+static inline void cam_jpeg_mgr_move_req_to_free_list(struct cam_jpeg_hw_cfg_req *p_cfg_req)
+{
+	if (!p_cfg_req) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return;
+	}
+
+	cam_mem_put_cpu_buf(p_cfg_req->hw_cfg_args.hw_update_entries[0].handle);
+	list_add_tail(&p_cfg_req->list, &g_jpeg_hw_mgr.free_req_list);
+}
+
+static void cam_jpeg_mgr_apply_evt_injection(struct cam_hw_done_event_data *buf_done_data,
+	struct cam_jpeg_hw_ctx_data *ctx_data, bool *signal_fence_buffer)
+{
+	struct cam_hw_inject_evt_param *evt_inject_params = &ctx_data->evt_inject_params;
+	struct cam_common_evt_inject_data inject_evt;
+
+	inject_evt.buf_done_data = buf_done_data;
+	inject_evt.evt_params = evt_inject_params;
+
+	if (ctx_data->ctxt_event_cb)
+		ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_JPEG_EVT_ID_INDUCE_ERR,
+			&inject_evt);
+
+	if (evt_inject_params->inject_id == CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE)
+		*signal_fence_buffer = false;
+
+	evt_inject_params->is_valid = false;
+}
+
+static int cam_jpeg_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	if (!blob_data || !user_data || !blob_size) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments. blob_data: %p user_data: %p blob_size: %u",
+			blob_data, user_data, blob_size);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_JPEG, "blob_type: %u, blob_size: %u", blob_type, blob_size);
+
+	switch(blob_type) {
+	case CAM_JPEG_THUMBNAIL_SIZE_BLOB:
+		*((uint32_t *)user_data) = (uint32_t) *((uint32_t *)blob_data);
+		CAM_DBG(CAM_JPEG, "Thumbnail max size: %u bytes", *((uint32_t *)user_data));
+		break;
+	default:
+		CAM_ERR(CAM_JPEG, "Invalid blob_tye: %u", blob_type);
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_jpeg_add_command_buffers(struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_jpeg_hw_ctx_data *ctx_data)
+{
+	struct cam_cmd_buf_desc                          *cmd_desc = NULL;
+	struct cam_jpeg_request_data                     *jpeg_request_data;
+	struct cam_kmd_buf_info                           kmd_buf;
+	unsigned int                                      num_entry = 0;
+	unsigned int                                      i;
+	int                                               rc;
+
+	if (!packet || !prepare_args || !ctx_data) {
+		CAM_ERR(CAM_JPEG, "Invalid args: packet: 0x%p, prepare_args: 0x%p, ctx_data: 0x%p",
+			packet, prepare_args, ctx_data);
+		return -EINVAL;
+	}
+
+	jpeg_request_data = (struct cam_jpeg_request_data *) prepare_args->priv;
+
+	if (!jpeg_request_data) {
+		CAM_ERR(CAM_JPEG, "prepare_args private is null");
+		return -EINVAL;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *)&packet->payload_flex + (packet->cmd_buf_offset / 4));
+
+	CAM_DBG(CAM_JPEG,
+		"Pkt: %pK req_id: %u cmd_desc: %pK Size: %lu, num_cmd_buffs: %d dev_type: %u",
+		(void *)packet,
+		packet->header.request_id,
+		(void *)cmd_desc,
+		sizeof(struct cam_cmd_buf_desc),
+		packet->num_cmd_buf,
+		ctx_data->jpeg_dev_acquire_info.dev_type);
+
+	num_entry = prepare_args->num_hw_update_entries;
+
+	rc = cam_packet_util_get_kmd_buffer(packet, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "get kmd buf failed %d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_JPEG, "KMD Buffer: used_bytes: %u handle: 0x%x offset: 0x%x",
+		kmd_buf.used_bytes, kmd_buf.handle, kmd_buf.offset);
+
+	/* fill kmd buf info into 1st hw update entry for change base*/
+	prepare_args->hw_update_entries[num_entry].len = (uint32_t)kmd_buf.used_bytes;
+	prepare_args->hw_update_entries[num_entry].handle = (uint32_t)kmd_buf.handle;
+	prepare_args->hw_update_entries[num_entry].offset = (uint32_t)kmd_buf.offset;
+	num_entry++;
+
+	jpeg_request_data->dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+	jpeg_request_data->request_id = packet->header.request_id;
+	jpeg_request_data->thumbnail_threshold_size = 0;
+	jpeg_request_data->out_size_mem_handle = 0;
+	jpeg_request_data->out_size_offset = 0;
+
+	CAM_DBG(CAM_JPEG,
+		"Change_Base HW_Entry. Offset: 0x%x Length: %u mem_handle: 0x%x num_entry: %d",
+		prepare_args->hw_update_entries[num_entry].offset,
+		prepare_args->hw_update_entries[num_entry].len,
+		prepare_args->hw_update_entries[num_entry].handle,
+		num_entry);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		CAM_DBG(CAM_JPEG,
+			"Metadata: %u Offset: 0x%x Length: %u mem_handle: 0x%x num_entry: %d",
+			cmd_desc[i].meta_data, cmd_desc[i].offset,
+			cmd_desc[i].length, cmd_desc[i].mem_handle,
+			num_entry);
+
+		switch(cmd_desc[i].meta_data) {
+		case CAM_JPEG_ENC_PACKET_CONFIG_DATA:
+		case CAM_JPEG_DMA_PACKET_PLANE0_CONFIG_DATA:
+		case CAM_JPEG_DMA_PACKET_PLANE1_CONFIG_DATA:
+			prepare_args->hw_update_entries[num_entry].len =
+				(uint32_t)cmd_desc[i].length;
+			prepare_args->hw_update_entries[num_entry].handle =
+				(uint32_t)cmd_desc[i].mem_handle;
+			prepare_args->hw_update_entries[num_entry].offset =
+				(uint32_t)cmd_desc[i].offset;
+
+			num_entry++;
+			break;
+		case CAM_JPEG_PACKET_INOUT_PARAM:
+			jpeg_request_data->out_size_mem_handle = cmd_desc[i].mem_handle;
+			jpeg_request_data->out_size_offset = cmd_desc[i].offset;
+			break;
+		case CAM_JPEG_PACKET_GENERIC_BLOB:
+			rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+				&cam_jpeg_generic_blob_handler,
+				(void *)&jpeg_request_data->thumbnail_threshold_size);
+			break;
+		default:
+			CAM_ERR(CAM_JPEG, "Invalid metadata");
+			return -EINVAL;
+		}
+	}
+
+	CAM_DBG(CAM_JPEG, "num_entry: %u", num_entry);
+	prepare_args->num_hw_update_entries = num_entry;
+
+	return rc;
+}
+
+static int cam_jpeg_process_next_hw_update(void *priv, void *data,
+	struct cam_hw_done_event_data *buf_data)
+{
+	int rc;
+	struct cam_jpeg_hw_mgr *hw_mgr = priv;
+	struct cam_hw_update_entry *cmd;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_hw_config_args *config_args = NULL;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	uint32_t dev_type;
+	struct cam_jpeg_hw_cfg_req *p_cfg_req = NULL;
+	uint32_t cdm_cfg_to_insert = 0;
+	uint32_t pass_num;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_JPEG, "Invalid data");
+		return -EINVAL;
+	}
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)data;
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+	p_cfg_req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+	config_args = (struct cam_hw_config_args *)&p_cfg_req->hw_cfg_args;
+
+	if (!hw_mgr->devices[dev_type][0]->hw_ops.reset) {
+		CAM_ERR(CAM_JPEG, "op reset null ");
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_INVLD_CMD;
+		rc = -EFAULT;
+		goto end_error;
+	}
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.reset(
+		hw_mgr->devices[dev_type][0]->hw_priv,
+		NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "jpeg hw reset failed %d", rc);
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_HW_RESET_FAILED;
+		goto end_error;
+	}
+
+	cdm_cmd = ctx_data->cdm_cmd;
+	cdm_cmd->type = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+	cdm_cmd->flag = false;
+	cdm_cmd->userdata = NULL;
+	cdm_cmd->cookie = 0;
+	cdm_cmd->cmd_arrary_count = 0;
+
+	/* insert cdm chage base cmd */
+	rc = cam_jpeg_insert_cdm_change_base(config_args,
+		ctx_data, hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "insert change base failed %d", rc);
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_CDM_CHANGE_BASE_ERR;
+		goto end_error;
+	}
+
+	/* insert next cdm payload at index */
+	/* for enc or dma 1st pass at index 1 */
+	/* for dma 2nd pass at index 2*/
+	if (p_cfg_req->num_hw_entry_processed == 0) {
+		cdm_cfg_to_insert = CAM_JPEG_CFG_CMD_BUFF_IDX;
+		pass_num = 1;
+	} else {
+		cdm_cfg_to_insert = p_cfg_req->num_hw_entry_processed + 1;
+		pass_num = 2;
+	}
+
+	CAM_DBG(CAM_JPEG, "processed %d total %d using cfg entry %d for %pK",
+		p_cfg_req->num_hw_entry_processed,
+		config_args->num_hw_update_entries,
+		cdm_cfg_to_insert,
+		p_cfg_req);
+
+	cmd = (config_args->hw_update_entries + cdm_cfg_to_insert);
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].bl_addr.mem_handle =
+		cmd->handle;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].offset =
+		cmd->offset;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].len =
+		cmd->len;
+	CAM_DBG(CAM_JPEG, "Entry: %d, hdl: 0x%x, offset: 0x%x, len: %d",
+		cdm_cmd->cmd_arrary_count,
+		cmd->handle,
+		cmd->offset,
+		cmd->len);
+	cdm_cmd->cmd_arrary_count++;
+
+	rc = cam_cdm_submit_bls(
+		hw_mgr->cdm_info[dev_type][0].cdm_handle,
+		cdm_cmd);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Failed to apply the configs %d", rc);
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_CDM_CONFIG_ERR;
+		goto end_error;
+	}
+
+	if (g_jpeg_hw_mgr.camnoc_misr_test) {
+		/* configure jpeg hw and camnoc misr */
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			CAM_JPEG_CMD_CONFIG_HW_MISR,
+			&g_jpeg_hw_mgr.camnoc_misr_test,
+			sizeof(g_jpeg_hw_mgr.camnoc_misr_test));
+		if (rc) {
+			CAM_ERR(CAM_JPEG, "Failed to apply the configs %d",
+				rc);
+			buf_data->evt_param = CAM_SYNC_JPEG_EVENT_MISR_CONFIG_ERR;
+			goto end_error;
+		}
+	}
+
+	if (!hw_mgr->devices[dev_type][0]->hw_ops.start) {
+		CAM_ERR(CAM_JPEG, "op start null ");
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_INVLD_CMD;
+		rc = -EINVAL;
+		goto end_error;
+	}
+
+	CAM_TRACE(CAM_JPEG, "Start JPEG %s ctx %lld Req %llu Pass %d",
+		CAM_JPEG_DEV_TYPE(dev_type),
+		(uint64_t) ctx_data,
+		config_args->request_id, pass_num);
+
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.start(
+		hw_mgr->devices[dev_type][0]->hw_priv, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Failed to apply the configs %d",
+			rc);
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_START_HW_ERR;
+		goto end_error;
+	}
+
+	cam_cpas_notify_event("JPEG Submit", config_args->request_id);
+
+	return 0;
+end_error:
+	return rc;
+}
+
+static int cam_jpeg_mgr_bottom_half_irq(void *priv, void *data)
+{
+	int                                                      rc = 0;
+	int32_t                                                  i;
+	uintptr_t                                                dev_type = 0;
+	struct cam_jpeg_process_irq_work_data_t                 *task_data;
+	struct cam_jpeg_hw_ctx_data                             *ctx_data = NULL;
+	struct cam_context                                      *cam_ctx = NULL;
+	struct cam_hw_done_event_data                            buf_data;
+	struct cam_jpeg_set_irq_cb                               irq_cb;
+	struct cam_jpeg_irq_cb_data                             *irq_cb_data;
+	struct cam_jpeg_hw_cfg_req                              *p_cfg_req = NULL;
+	struct crm_workq_task                                   *task;
+	struct cam_jpeg_process_frame_work_data_t               *wq_task_data;
+	struct cam_jpeg_request_data                            *jpeg_req;
+	struct cam_req_mgr_message                               v4l2_msg = {0};
+	struct cam_ctx_request                                  *req;
+	struct cam_jpeg_misr_dump_args                           misr_args;
+	struct cam_jpeg_hw_buf_done_evt_data                     jpeg_done_evt;
+	struct cam_jpeg_config_inout_param_info                 *inout_params;
+	uint32_t						*cmd_buf_kaddr;
+	uintptr_t						 kaddr;
+	size_t							 len;
+	size_t							 inout_param_size;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_JPEG, "Invalid data");
+		return -EINVAL;
+	}
+
+	task_data = data;
+
+	irq_cb_data = (struct cam_jpeg_irq_cb_data *)task_data->data;
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)irq_cb_data->private_data;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_JPEG, "No ctx data found!");
+		return -EINVAL;
+	}
+
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		return -EINVAL;
+	}
+
+	cam_ctx = (struct cam_context *) ctx_data->context_priv;
+	if (!cam_ctx) {
+		CAM_ERR(CAM_JPEG, "cam_ctx is null");
+		return -EINVAL;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	mutex_lock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+
+	p_cfg_req = g_jpeg_hw_mgr.dev_hw_cfg_args[dev_type][0];
+
+	if (g_jpeg_hw_mgr.device_in_use[dev_type][0] == false ||
+		p_cfg_req == NULL) {
+		CAM_ERR(CAM_JPEG, "irq for old request %d", rc);
+		mutex_unlock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	p_cfg_req->num_hw_entry_processed++;
+	CAM_DBG(CAM_JPEG, "dev_type: %u, hw_entry_processed %d",
+		dev_type, p_cfg_req->num_hw_entry_processed);
+
+	if (g_jpeg_hw_mgr.camnoc_misr_test) {
+		misr_args.req_id = p_cfg_req->req_id;
+		misr_args.enable_bug = g_jpeg_hw_mgr.bug_on_misr;
+		CAM_DBG(CAM_JPEG, "req %lld bug is enabled for MISR :%d",
+			misr_args.req_id, misr_args.enable_bug);
+
+		/* dump jpeg hw and camnoc misr */
+		rc = g_jpeg_hw_mgr.devices[dev_type][0]->hw_ops.process_cmd(
+			g_jpeg_hw_mgr.devices[dev_type][0]->hw_priv,
+			CAM_JPEG_CMD_DUMP_HW_MISR_VAL, &misr_args,
+			sizeof(struct cam_jpeg_misr_dump_args));
+		if (rc)
+			CAM_WARN_RATE_LIMIT(CAM_JPEG, "jpeg and camnoc hw misr enable failed %d",
+				rc);
+	}
+
+	/* If we have processed just plane 1 for jpeg dma,
+	 * send the configuration data for plane 1 as well.*/
+	if (dev_type == CAM_JPEG_RES_TYPE_DMA) {
+		if ((task_data->u.is_dma_frame_done) && (p_cfg_req->num_hw_entry_processed < 2)) {
+			/* Processes next entry before freeing the device */
+			rc  = cam_jpeg_process_next_hw_update(priv, ctx_data,
+				&buf_data);
+			if (!rc) {
+				mutex_unlock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+				return 0;
+			}
+		}
+	}
+
+	jpeg_req = irq_cb_data->jpeg_req;
+	inout_param_size = sizeof(struct cam_jpeg_config_inout_param_info);
+
+	if (jpeg_req->dev_type == CAM_JPEG_RES_TYPE_ENC) {
+		rc = cam_mem_get_cpu_buf(jpeg_req->out_size_mem_handle,
+			(uintptr_t *)&kaddr, &len);
+		if (!rc) {
+			if ((inout_param_size > len) ||
+				(jpeg_req->out_size_offset >= (len - inout_param_size)))
+				CAM_ERR(CAM_JPEG,
+					"Inval off = %u cmd buf len = %zu inout_param_size = %d",
+					jpeg_req->out_size_offset, len, inout_param_size);
+			else {
+				cmd_buf_kaddr = (uint32_t *)kaddr;
+				cmd_buf_kaddr += (jpeg_req->out_size_offset / sizeof(uint32_t));
+				inout_params =
+					(struct cam_jpeg_config_inout_param_info *)cmd_buf_kaddr;
+				inout_params->output_size = task_data->u.output_encode_size;
+			}
+			cam_mem_put_cpu_buf(jpeg_req->out_size_mem_handle);
+		}
+		else
+			CAM_ERR(CAM_JPEG, "Buffer pointer for inout param is null");
+
+		CAM_DBG(CAM_JPEG, "Encoded Size %d Thresold Size: %u",
+			task_data->u.output_encode_size,
+			jpeg_req->thumbnail_threshold_size);
+
+		if (jpeg_req->thumbnail_threshold_size) {
+			if (task_data->u.output_encode_size > jpeg_req->thumbnail_threshold_size) {
+				CAM_DBG(CAM_JPEG, "Thumbnail max size: %u dev_type: %u",
+					jpeg_req->thumbnail_threshold_size, jpeg_req->dev_type);
+				v4l2_msg.session_hdl = cam_ctx->session_hdl;
+				v4l2_msg.u.node_msg.request_id = jpeg_req->request_id;
+				v4l2_msg.u.node_msg.link_hdl = cam_ctx->link_hdl;
+				v4l2_msg.u.node_msg.device_hdl = cam_ctx->dev_hdl;
+				v4l2_msg.u.node_msg.event_type = CAM_REQ_MGR_RETRY_EVENT;
+				v4l2_msg.u.node_msg.event_cause =
+					CAM_REQ_MGR_JPEG_THUBNAIL_SIZE_ERROR;
+				cam_req_mgr_notify_message(&v4l2_msg,
+					V4L_EVENT_CAM_REQ_MGR_NODE_EVENT,
+					V4L_EVENT_CAM_REQ_MGR_EVENT);
+
+				for (i = 0; i < p_cfg_req->hw_cfg_args.num_out_map_entries; i++) {
+					cam_sync_put_obj_ref(
+						p_cfg_req->hw_cfg_args.out_map_entries[i].sync_id);
+				}
+
+				spin_lock(&cam_ctx->lock);
+				if (!list_empty(&cam_ctx->active_req_list)) {
+					req = list_first_entry(&cam_ctx->active_req_list,
+						struct cam_ctx_request, list);
+					list_del_init(&req->list);
+					list_add_tail(&req->list, &cam_ctx->free_req_list);
+				}
+				spin_unlock(&cam_ctx->lock);
+
+				goto exit;
+			}
+		}
+	}
+
+	buf_data.num_handles = p_cfg_req->hw_cfg_args.num_out_map_entries;
+	for (i = 0; i < buf_data.num_handles; i++) {
+		buf_data.resource_handle[i] =
+			p_cfg_req->hw_cfg_args.out_map_entries[i].resource_handle;
+	}
+
+	buf_data.request_id = jpeg_req->request_id;
+	jpeg_done_evt.evt_id = CAM_CTX_EVT_ID_SUCCESS;
+	jpeg_done_evt.buf_done_data = &buf_data;
+	ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_JPEG_EVT_ID_BUF_DONE,
+		&jpeg_done_evt);
+
+exit:
+	irq_cb.jpeg_hw_mgr_cb = cam_jpeg_hw_mgr_sched_bottom_half;
+	irq_cb.irq_cb_data.private_data = NULL;
+	irq_cb.irq_cb_data.jpeg_req = NULL;
+	irq_cb.b_set_cb = false;
+
+	if (!g_jpeg_hw_mgr.devices[dev_type][0]->hw_ops.process_cmd) {
+		CAM_ERR(CAM_JPEG, "process_cmd null");
+		rc = -EINVAL;
+		goto err;
+	}
+	rc = g_jpeg_hw_mgr.devices[dev_type][0]->hw_ops.process_cmd(
+		g_jpeg_hw_mgr.devices[dev_type][0]->hw_priv,
+		CAM_JPEG_CMD_SET_IRQ_CB,
+		&irq_cb, sizeof(irq_cb));
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "CMD_SET_IRQ_CB failed %d", rc);
+		goto err;
+	}
+
+	if (g_jpeg_hw_mgr.devices[dev_type][0]->hw_ops.deinit) {
+		rc = g_jpeg_hw_mgr.devices[dev_type][0]->hw_ops.deinit(
+			g_jpeg_hw_mgr.devices[dev_type][0]->hw_priv, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "Failed to Deinit %lu HW", dev_type);
+	}
+
+	g_jpeg_hw_mgr.device_in_use[dev_type][0] = false;
+	g_jpeg_hw_mgr.dev_hw_cfg_args[dev_type][0] = NULL;
+
+	task = cam_req_mgr_workq_get_task(g_jpeg_hw_mgr.work_process_frame);
+	if (!task) {
+		CAM_ERR(CAM_JPEG, "no empty task");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	wq_task_data = (struct cam_jpeg_process_frame_work_data_t *)task->payload;
+	if (!task_data) {
+		CAM_ERR(CAM_JPEG, "task_data is NULL");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	wq_task_data->data = NULL;
+	wq_task_data->request_id = 0;
+	wq_task_data->type = CAM_JPEG_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_jpeg_mgr_process_hw_update_entries;
+	rc = cam_req_mgr_workq_enqueue_task(task, &g_jpeg_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "could not enque task %d", rc);
+		goto err;
+	}
+
+	cam_jpeg_mgr_move_req_to_free_list(p_cfg_req);
+err:
+	mutex_unlock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_jpeg_hw_mgr_sched_bottom_half(uint32_t irq_status, int32_t irq_data, void *data)
+{
+	int32_t rc;
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct cam_jpeg_process_irq_work_data_t *task_data;
+
+	spin_lock_irqsave(&g_jpeg_hw_mgr.hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(g_jpeg_hw_mgr.work_process_irq_cb);
+	if (!task) {
+		CAM_ERR(CAM_JPEG, "no empty task");
+		spin_unlock_irqrestore(&g_jpeg_hw_mgr.hw_mgr_lock, flags);
+		return -ENOMEM;
+	}
+
+	task_data = (struct cam_jpeg_process_irq_work_data_t *)task->payload;
+	task_data->data = data;
+	task_data->irq_status = irq_status;
+	task_data->u.irq_data = irq_data;
+	task_data->type = CAM_JPEG_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_jpeg_mgr_bottom_half_irq;
+
+	rc = cam_req_mgr_workq_enqueue_task(task, &g_jpeg_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&g_jpeg_hw_mgr.hw_mgr_lock, flags);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_get_free_ctx(struct cam_jpeg_hw_mgr *hw_mgr)
+{
+	int i = 0;
+	int num_ctx = CAM_JPEG_CTX_MAX;
+
+	for (i = 0; i < num_ctx; i++) {
+		mutex_lock(&hw_mgr->ctx_data[i].ctx_mutex);
+		if (hw_mgr->ctx_data[i].in_use == false) {
+			hw_mgr->ctx_data[i].in_use = true;
+			mutex_unlock(&hw_mgr->ctx_data[i].ctx_mutex);
+			break;
+		}
+		mutex_unlock(&hw_mgr->ctx_data[i].ctx_mutex);
+	}
+
+	return i;
+}
+
+
+static int cam_jpeg_mgr_release_ctx(
+	struct cam_jpeg_hw_mgr *hw_mgr, struct cam_jpeg_hw_ctx_data *ctx_data)
+{
+	if (!ctx_data) {
+		CAM_ERR(CAM_JPEG, "invalid ctx_data %pK", ctx_data);
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is already un-used: %pK", ctx_data);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return -EINVAL;
+	}
+
+	ctx_data->in_use = false;
+	memset(&ctx_data->evt_inject_params, 0, sizeof(struct cam_hw_inject_evt_param));
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return 0;
+}
+
+static int cam_jpeg_insert_cdm_change_base(
+	struct cam_hw_config_args *config_args,
+	struct cam_jpeg_hw_ctx_data *ctx_data,
+	struct cam_jpeg_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	uint32_t dev_type;
+	struct cam_cdm_bl_request *cdm_cmd;
+	uint32_t size;
+	uint32_t mem_cam_base;
+	uintptr_t iova_addr;
+	uint32_t *ch_base_iova_addr;
+	size_t ch_base_len;
+
+	rc = cam_mem_get_cpu_buf(
+		config_args->hw_update_entries[CAM_JPEG_CHBASE_CMD_BUFF_IDX].handle,
+		&iova_addr, &ch_base_len);
+	if (rc) {
+		CAM_ERR(CAM_JPEG,
+			"unable to get src buf info for cmd buf: %d", rc);
+		return rc;
+	}
+
+	if (config_args->hw_update_entries[CAM_JPEG_CHBASE_CMD_BUFF_IDX].offset >=
+		ch_base_len) {
+		CAM_ERR(CAM_JPEG, "Not enough buf offset %d len %d",
+			config_args->hw_update_entries[CAM_JPEG_CHBASE_CMD_BUFF_IDX].offset,
+			ch_base_len);
+		cam_mem_put_cpu_buf(
+			config_args->hw_update_entries[CAM_JPEG_CHBASE_CMD_BUFF_IDX].handle);
+		return -EINVAL;
+	}
+
+	ch_base_iova_addr = (uint32_t *)iova_addr;
+	ch_base_iova_addr = (ch_base_iova_addr +
+		(config_args->hw_update_entries[CAM_JPEG_CHBASE_CMD_BUFF_IDX].offset /
+		sizeof(uint32_t)));
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+	mem_cam_base = hw_mgr->cdm_reg_map[dev_type][0]->mem_cam_base;
+	size =
+	hw_mgr->cdm_info[dev_type][0].cdm_ops->cdm_required_size_changebase();
+	hw_mgr->cdm_info[dev_type][0].cdm_ops->cdm_write_changebase(
+		ch_base_iova_addr, mem_cam_base);
+
+	cdm_cmd = ctx_data->cdm_cmd;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].bl_addr.mem_handle =
+		config_args->hw_update_entries[CAM_JPEG_CHBASE_CMD_BUFF_IDX].handle;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].offset =
+		config_args->hw_update_entries[CAM_JPEG_CHBASE_CMD_BUFF_IDX].offset;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].len = size * sizeof(uint32_t);
+	CAM_DBG(CAM_JPEG, "Entry: %d, hdl: 0x%x, offset: 0x%x, len: %d, addr: 0x%p",
+		cdm_cmd->cmd_arrary_count,
+		cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].bl_addr.mem_handle,
+		cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].offset,
+		cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].len,
+		(void *)iova_addr);
+	cdm_cmd->cmd_arrary_count++;
+	cdm_cmd->gen_irq_arb = false;
+
+	ch_base_iova_addr += size;
+	*ch_base_iova_addr = 0;
+	ch_base_iova_addr += size;
+	*ch_base_iova_addr = 0;
+
+	cam_mem_put_cpu_buf(
+		config_args->hw_update_entries[CAM_JPEG_CHBASE_CMD_BUFF_IDX].handle);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_process_hw_update_entries(void *priv, void *data)
+{
+	int                                                        rc;
+	int                                                        i = 0;
+	uintptr_t                                                  request_id = 0;
+	uint32_t                                                   dev_type;
+	struct cam_jpeg_hw_mgr                                    *hw_mgr = priv;
+	struct cam_hw_config_args                                 *config_args = NULL;
+	struct cam_jpeg_hw_ctx_data                               *ctx_data = NULL;
+	struct cam_jpeg_request_data                              *jpeg_req;
+	struct cam_jpeg_process_frame_work_data_t                 *task_data;
+	struct cam_jpeg_set_irq_cb                                 irq_cb;
+	struct cam_jpeg_hw_cfg_req                                *p_cfg_req = NULL;
+	struct cam_hw_done_event_data                              buf_data;
+	struct cam_jpeg_hw_buf_done_evt_data                       jpeg_done_evt;
+	bool                                                       event_inject = false;
+	bool                                                       signal_fence_buffer = true;
+
+	task_data = (struct cam_jpeg_process_frame_work_data_t *)data;
+	if (!hw_mgr || !task_data) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments %pK %pK",
+			hw_mgr, task_data);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	if (list_empty(&hw_mgr->hw_config_req_list)) {
+		CAM_DBG(CAM_JPEG, "no available request");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	p_cfg_req = list_first_entry(&hw_mgr->hw_config_req_list,
+		struct cam_jpeg_hw_cfg_req, list);
+	if (!p_cfg_req) {
+		CAM_ERR(CAM_JPEG, "no request");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (false == hw_mgr->device_in_use[p_cfg_req->dev_type][0]) {
+		hw_mgr->device_in_use[p_cfg_req->dev_type][0] = true;
+		hw_mgr->dev_hw_cfg_args[p_cfg_req->dev_type][0] = p_cfg_req;
+		list_del_init(&p_cfg_req->list);
+	} else {
+		CAM_DBG(CAM_JPEG, "Not dequeing, just return");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	config_args = (struct cam_hw_config_args *)&p_cfg_req->hw_cfg_args;
+	request_id = task_data->request_id;
+	jpeg_req = (struct cam_jpeg_request_data *)config_args->priv;
+	if (request_id != (uintptr_t)jpeg_req->request_id) {
+		CAM_DBG(CAM_JPEG, "Probably received req from Bottom half. req %zd %zd",
+			request_id, (uintptr_t)jpeg_req->request_id);
+	}
+
+	if (!config_args->num_hw_update_entries) {
+		CAM_ERR(CAM_JPEG, "No hw update enteries are available");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		rc = -EINVAL;
+		goto end_unusedev;
+	}
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)config_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		rc = -EINVAL;
+		goto end_unusedev;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	CAM_DBG(CAM_JPEG, "req_id: %u, dev_type: %u",
+		request_id, dev_type);
+
+	if (dev_type != p_cfg_req->dev_type)
+		CAM_WARN(CAM_JPEG, "dev types not same something wrong");
+
+	if (!hw_mgr->devices[dev_type][0]->hw_ops.init) {
+		CAM_ERR(CAM_JPEG, "hw op init null ");
+		rc = -EFAULT;
+		goto end;
+	}
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.init(
+		hw_mgr->devices[dev_type][0]->hw_priv,
+		ctx_data,
+		sizeof(ctx_data));
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Failed to Init %d HW", dev_type);
+		goto end;
+	}
+
+	if (ctx_data->evt_inject_params.is_valid &&
+		ctx_data->evt_inject_params.req_id == request_id) {
+		event_inject = true;
+		goto end_callcb;
+	}
+
+	irq_cb.jpeg_hw_mgr_cb = cam_jpeg_hw_mgr_sched_bottom_half;
+	irq_cb.irq_cb_data.private_data = (void *)ctx_data;
+	irq_cb.irq_cb_data.jpeg_req = jpeg_req;
+	irq_cb.b_set_cb = true;
+	if (!hw_mgr->devices[dev_type][0]->hw_ops.process_cmd) {
+		CAM_ERR(CAM_JPEG, "op process_cmd null ");
+		buf_data.evt_param = CAM_SYNC_JPEG_EVENT_INVLD_CMD;
+		rc = -EFAULT;
+		goto end_callcb;
+	}
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+		hw_mgr->devices[dev_type][0]->hw_priv,
+		CAM_JPEG_CMD_SET_IRQ_CB,
+		&irq_cb, sizeof(irq_cb));
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "SET_IRQ_CB failed %d", rc);
+		buf_data.evt_param = CAM_SYNC_JPEG_EVENT_SET_IRQ_CB;
+		goto end_callcb;
+	}
+
+	/* insert one of the cdm payloads */
+	rc = cam_jpeg_process_next_hw_update(priv, ctx_data, &buf_data);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "next hw update failed %d", rc);
+		goto end_callcb;
+	}
+
+	p_cfg_req->submit_timestamp = ktime_get();
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+
+end_callcb:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	if (p_cfg_req) {
+		buf_data.num_handles =
+			config_args->num_out_map_entries;
+		for (i = 0; i < buf_data.num_handles; i++) {
+			buf_data.resource_handle[i] =
+			config_args->out_map_entries[i].resource_handle;
+		}
+		buf_data.request_id = (uintptr_t)jpeg_req->request_id;
+		if (event_inject)
+			cam_jpeg_mgr_apply_evt_injection(&buf_data, ctx_data,
+				&signal_fence_buffer);
+
+		if (signal_fence_buffer) {
+			jpeg_done_evt.evt_id = CAM_CTX_EVT_ID_ERROR;
+			jpeg_done_evt.buf_done_data = &buf_data;
+			ctx_data->ctxt_event_cb(ctx_data->context_priv,
+				CAM_JPEG_EVT_ID_BUF_DONE, &jpeg_done_evt);
+		}
+	}
+end_unusedev:
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	hw_mgr->device_in_use[p_cfg_req->dev_type][0] = false;
+	hw_mgr->dev_hw_cfg_args[p_cfg_req->dev_type][0] = NULL;
+
+end:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_jpeg_mgr_config_hw(void *hw_mgr_priv, void *config_hw_args)
+{
+	struct cam_jpeg_hw_mgr                             *hw_mgr = hw_mgr_priv;
+	struct cam_hw_config_args                          *config_args = config_hw_args;
+	struct cam_jpeg_hw_ctx_data                        *ctx_data = NULL;
+	struct cam_jpeg_request_data                       *jpeg_req;
+	struct crm_workq_task                              *task;
+	struct cam_jpeg_process_frame_work_data_t          *task_data;
+	struct cam_jpeg_hw_cfg_req                         *p_cfg_req = NULL;
+	int                                                 rc;
+
+	if (!hw_mgr || !config_args) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments %pK %pK",
+			hw_mgr, config_args);
+		return -EINVAL;
+	}
+
+	if (!config_args->num_hw_update_entries) {
+		CAM_ERR(CAM_JPEG, "No hw update enteries are available");
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)config_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	if (list_empty(&hw_mgr->free_req_list)) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_JPEG, "list empty");
+		return -ENOMEM;
+	}
+
+	p_cfg_req = list_first_entry(&hw_mgr->free_req_list,
+		struct cam_jpeg_hw_cfg_req, list);
+	list_del_init(&p_cfg_req->list);
+
+	/* Update Currently Processing Config Request */
+	p_cfg_req->hw_cfg_args = *config_args;
+	p_cfg_req->dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	jpeg_req = (struct cam_jpeg_request_data *)config_args->priv;
+	p_cfg_req->req_id = (uintptr_t)jpeg_req->request_id;
+	p_cfg_req->num_hw_entry_processed = 0;
+	CAM_DBG(CAM_JPEG, "req_id: %u, dev_type: %d",
+		p_cfg_req->req_id, ctx_data->jpeg_dev_acquire_info.dev_type);
+	task = cam_req_mgr_workq_get_task(g_jpeg_hw_mgr.work_process_frame);
+	if (!task) {
+		CAM_ERR(CAM_JPEG, "no empty task");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		rc = -ENOMEM;
+		goto err_after_dq_free_list;
+	}
+
+	task_data = (struct cam_jpeg_process_frame_work_data_t *)
+		task->payload;
+	if (!task_data) {
+		CAM_ERR(CAM_JPEG, "task_data is NULL");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		rc = -EINVAL;
+		goto err_after_dq_free_list;
+	}
+	CAM_DBG(CAM_JPEG, "cfge %pK num %d",
+		p_cfg_req->hw_cfg_args.hw_update_entries,
+		p_cfg_req->hw_cfg_args.num_hw_update_entries);
+
+	list_add_tail(&p_cfg_req->list, &hw_mgr->hw_config_req_list);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	task_data->data = config_args->priv;
+	task_data->request_id = (uintptr_t)jpeg_req->request_id;
+	task_data->type = CAM_JPEG_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_jpeg_mgr_process_hw_update_entries;
+
+	rc = cam_req_mgr_workq_enqueue_task(task, &g_jpeg_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "failed to enqueue task %d", rc);
+		goto err_after_get_task;
+	}
+
+	return rc;
+
+err_after_get_task:
+	list_del_init(&p_cfg_req->list);
+err_after_dq_free_list:
+	cam_jpeg_mgr_move_req_to_free_list(p_cfg_req);
+	return rc;
+}
+
+static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int rc, i, j, k;
+	struct cam_hw_prepare_update_args *prepare_args =
+		prepare_hw_update_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	struct cam_packet *packet = NULL;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	if (!prepare_args || !hw_mgr) {
+		CAM_ERR(CAM_JPEG, "Invalid args %pK %pK",
+			prepare_args, hw_mgr);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)prepare_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	packet = prepare_args->packet;
+	if (!packet) {
+		CAM_ERR(CAM_JPEG, "received packet is NULL");
+		return -EINVAL;
+	}
+
+	if (((packet->header.op_code & 0xff) != CAM_JPEG_OPCODE_ENC_UPDATE) &&
+		((packet->header.op_code
+		& 0xff) != CAM_JPEG_OPCODE_DMA_UPDATE)) {
+		CAM_ERR(CAM_JPEG, "Invalid Opcode in pkt: %d",
+			packet->header.op_code & 0xff);
+		return -EINVAL;
+	}
+
+	rc = cam_packet_util_validate_packet(packet, prepare_args->remain_len);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "invalid packet %d", rc);
+		return rc;
+	}
+
+	if (!packet->num_cmd_buf ||
+		(packet->num_cmd_buf > CAM_JPEG_MAX_NUM_CMD_BUFFS) ||
+		!packet->num_patches || !packet->num_io_configs ||
+		(packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {
+		CAM_ERR(CAM_JPEG,
+			"wrong number of cmd/patch/io_configs info: %u %u %u",
+			packet->num_cmd_buf, packet->num_patches,
+			packet->num_io_configs);
+		return -EINVAL;
+	}
+
+	rc = cam_packet_util_process_patches(packet, prepare_args->buf_tracker,
+		hw_mgr->iommu_hdl, -1, false);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Patch processing failed %d", rc);
+		return rc;
+	}
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload_flex +
+		packet->io_configs_offset / 4);
+	CAM_DBG(CAM_JPEG, "Packet: %pK, io_cfg_ptr: %pK size: %lu req_id: %u dev_type: %d",
+		(void *)packet,
+		(void *)io_cfg_ptr,
+		sizeof(struct cam_buf_io_cfg),
+		packet->header.request_id,
+		ctx_data->jpeg_dev_acquire_info.dev_type);
+
+	prepare_args->num_out_map_entries = 0;
+
+	for (i = 0, j = 0, k = 0; i < packet->num_io_configs; i++) {
+		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) {
+			prepare_args->in_map_entries[j].resource_handle =
+				io_cfg_ptr[i].resource_type;
+			prepare_args->in_map_entries[j++].sync_id =
+				io_cfg_ptr[i].fence;
+			prepare_args->num_in_map_entries++;
+		} else {
+			prepare_args->out_map_entries[k].resource_handle =
+				io_cfg_ptr[i].resource_type;
+			prepare_args->out_map_entries[k++].sync_id =
+				io_cfg_ptr[i].fence;
+			prepare_args->num_out_map_entries++;
+		}
+		CAM_DBG(CAM_JPEG, "dir[%d]: %u, fence: %u resource_type %d ",
+			i, io_cfg_ptr[i].direction, io_cfg_ptr[i].fence,
+			io_cfg_ptr[i].resource_type);
+	}
+
+	rc = cam_jpeg_add_command_buffers(packet, prepare_args, ctx_data);
+
+	if (cam_presil_mode_enabled()) {
+		CAM_INFO(CAM_JPEG, "Sending relevant buffers for request:%llu to presil",
+			packet->header.request_id);
+		rc = cam_presil_send_buffers_from_packet(packet, hw_mgr->iommu_hdl,
+			hw_mgr->cdm_iommu_hdl);
+		if (rc) {
+			CAM_ERR(CAM_JPEG, "Error sending buffers for request:%llu to presil",
+				packet->header.request_id);
+			return rc;
+		}
+	}
+
+	CAM_DBG(CAM_JPEG, "will wait on input sync sync_id %d",
+		prepare_args->in_map_entries[0].sync_id);
+
+	return rc;
+}
+
+static void cam_jpeg_mgr_stop_deinit_dev(struct cam_jpeg_hw_mgr *hw_mgr,
+	struct cam_jpeg_hw_cfg_req *p_cfg_req, uint32_t dev_type)
+{
+	int rc = 0;
+	struct cam_jpeg_set_irq_cb irq_cb;
+
+	/* stop reset Unregister CB and deinit */
+	irq_cb.jpeg_hw_mgr_cb = cam_jpeg_hw_mgr_sched_bottom_half;
+	irq_cb.irq_cb_data.private_data = NULL;
+	irq_cb.irq_cb_data.jpeg_req = NULL;
+	irq_cb.b_set_cb = false;
+	if (hw_mgr->devices[dev_type][0]->hw_ops.process_cmd) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			CAM_JPEG_CMD_SET_IRQ_CB,
+			&irq_cb, sizeof(irq_cb));
+		if (rc)
+			CAM_ERR(CAM_JPEG, "SET_IRQ_CB fail %d", rc);
+	} else {
+		CAM_ERR(CAM_JPEG, "process_cmd null %d", dev_type);
+	}
+
+	if (hw_mgr->devices[dev_type][0]->hw_ops.stop) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.stop(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "stop fail %d", rc);
+	} else {
+		CAM_ERR(CAM_JPEG, "op stop null %d", dev_type);
+	}
+
+	if (hw_mgr->devices[dev_type][0]->hw_ops.deinit) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.deinit(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "Failed to Deinit %d HW %d",
+				dev_type, rc);
+	} else {
+		CAM_ERR(CAM_JPEG, "op deinit null %d", dev_type);
+	}
+
+	hw_mgr->device_in_use[dev_type][0] = false;
+	hw_mgr->dev_hw_cfg_args[dev_type][0] = NULL;
+}
+
+static int cam_jpeg_mgr_flush(void *hw_mgr_priv,
+	struct cam_jpeg_hw_ctx_data *ctx_data)
+{
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	uint32_t dev_type;
+	struct cam_jpeg_hw_cfg_req *p_cfg_req = NULL;
+	struct cam_jpeg_hw_cfg_req *cfg_req = NULL, *req_temp = NULL;
+
+	CAM_DBG(CAM_JPEG, "E: JPEG flush ctx");
+
+	if (!hw_mgr || !ctx_data) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	p_cfg_req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+
+	if (hw_mgr->device_in_use[dev_type][0] == true &&
+		p_cfg_req != NULL) {
+		if ((struct cam_jpeg_hw_ctx_data *)
+			p_cfg_req->hw_cfg_args.ctxt_to_hw_map == ctx_data) {
+			cam_jpeg_mgr_stop_deinit_dev(hw_mgr, p_cfg_req,
+				dev_type);
+			list_del_init(&p_cfg_req->list);
+			cam_jpeg_mgr_move_req_to_free_list(p_cfg_req);
+		}
+	}
+
+	list_for_each_entry_safe(cfg_req, req_temp,
+		&hw_mgr->hw_config_req_list, list) {
+		if ((struct cam_jpeg_hw_ctx_data *)
+			cfg_req->hw_cfg_args.ctxt_to_hw_map != ctx_data)
+			continue;
+
+		list_del_init(&cfg_req->list);
+		cam_jpeg_mgr_move_req_to_free_list(cfg_req);
+	}
+
+	CAM_DBG(CAM_JPEG, "X: JPEG flush ctx");
+
+	return 0;
+}
+
+static int cam_jpeg_mgr_flush_req(void *hw_mgr_priv,
+	struct cam_jpeg_hw_ctx_data *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	struct cam_jpeg_hw_mgr                                   *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_cfg_req                               *cfg_req = NULL;
+	struct cam_jpeg_hw_cfg_req                               *req_temp = NULL;
+	struct cam_jpeg_request_data                             *jpeg_req;
+	uintptr_t                                                 request_id = 0;
+	uint32_t dev_type;
+	struct cam_jpeg_hw_cfg_req *p_cfg_req = NULL;
+	bool b_req_found = false;
+
+	CAM_DBG(CAM_JPEG, "E: JPEG flush req");
+
+	if (!hw_mgr || !ctx_data || !flush_args) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (flush_args->num_req_pending)
+		return 0;
+
+	jpeg_req = (struct cam_jpeg_request_data *)flush_args->flush_req_active[0];
+	if (!jpeg_req) {
+		CAM_ERR(CAM_JPEG, "Request data is null");
+		return -EINVAL;
+	}
+
+	request_id = (uintptr_t)jpeg_req->request_id;
+
+	if (!flush_args->num_req_active)
+		return 0;
+
+	if (request_id <= 0) {
+		CAM_ERR(CAM_JPEG, "Invalid red id %ld", request_id);
+		return -EINVAL;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	p_cfg_req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+	if (hw_mgr->device_in_use[dev_type][0] == true &&
+		p_cfg_req != NULL) {
+		if (((struct cam_jpeg_hw_ctx_data *)
+			p_cfg_req->hw_cfg_args.ctxt_to_hw_map == ctx_data) &&
+			(p_cfg_req->req_id == request_id)) {
+			cam_jpeg_mgr_stop_deinit_dev(hw_mgr, p_cfg_req,
+				dev_type);
+			list_del_init(&p_cfg_req->list);
+			cam_jpeg_mgr_move_req_to_free_list(p_cfg_req);
+			b_req_found = true;
+		}
+	}
+
+	list_for_each_entry_safe(cfg_req, req_temp,
+		&hw_mgr->hw_config_req_list, list) {
+		if ((struct cam_jpeg_hw_ctx_data *)
+			cfg_req->hw_cfg_args.ctxt_to_hw_map != ctx_data)
+			continue;
+
+		if (cfg_req->req_id != request_id)
+			continue;
+
+		list_del_init(&cfg_req->list);
+		cam_jpeg_mgr_move_req_to_free_list(cfg_req);
+		b_req_found = true;
+		break;
+	}
+
+	if (!b_req_found) {
+		CAM_ERR(CAM_JPEG, "req not found %ld", request_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_JPEG, "X: JPEG flush req");
+	return 0;
+}
+
+static int cam_jpeg_mgr_hw_flush(void *hw_mgr_priv, void *flush_hw_args)
+{
+	int rc = 0;
+	struct cam_hw_flush_args *flush_args = flush_hw_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+
+	if (!hw_mgr || !flush_args || !flush_args->ctxt_to_hw_map) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)flush_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	if ((flush_args->flush_type >= CAM_FLUSH_TYPE_MAX) ||
+		(flush_args->flush_type < CAM_FLUSH_TYPE_REQ)) {
+		CAM_ERR(CAM_JPEG, "Invalid flush type: %d",
+			flush_args->flush_type);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_ALL:
+		rc = cam_jpeg_mgr_flush(hw_mgr_priv, ctx_data);
+		if ((rc))
+			CAM_ERR(CAM_JPEG, "Flush failed %d", rc);
+		break;
+	case CAM_FLUSH_TYPE_REQ:
+		rc = cam_jpeg_mgr_flush_req(hw_mgr_priv, ctx_data, flush_args);
+		break;
+	default:
+		CAM_ERR(CAM_JPEG, "Invalid flush type: %d",
+			flush_args->flush_type);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_hw_stop(void *hw_mgr_priv, void *stop_hw_args)
+{
+	int rc;
+	struct cam_hw_stop_args *stop_args =
+		(struct cam_hw_stop_args *)stop_hw_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+
+	if (!hw_mgr || !stop_args || !stop_args->ctxt_to_hw_map) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)stop_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	rc = cam_jpeg_mgr_flush(hw_mgr_priv, ctx_data);
+	if ((rc))
+		CAM_ERR(CAM_JPEG, "flush failed %d", rc);
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_release_hw(void *hw_mgr_priv, void *release_hw_args)
+{
+	int rc;
+	struct cam_hw_release_args *release_hw = release_hw_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	uint32_t dev_type;
+
+	if (!hw_mgr || !release_hw || !release_hw->ctxt_to_hw_map) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)release_hw->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (hw_mgr->cdm_info[dev_type][0].ref_cnt == 0) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_JPEG, "Error Unbalanced deinit");
+		return -EFAULT;
+	}
+
+	hw_mgr->cdm_info[dev_type][0].ref_cnt--;
+	if (!(hw_mgr->cdm_info[dev_type][0].ref_cnt)) {
+		if (cam_cdm_stream_off(
+			hw_mgr->cdm_info[dev_type][0].cdm_handle)) {
+			CAM_ERR(CAM_JPEG, "CDM stream off failed %d",
+				hw_mgr->cdm_info[dev_type][0].cdm_handle);
+		}
+		/* release cdm handle */
+		cam_cdm_release(hw_mgr->cdm_info[dev_type][0].cdm_handle);
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	rc = cam_jpeg_mgr_release_ctx(hw_mgr, ctx_data);
+	if (rc) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_JPEG, "JPEG release ctx failed");
+		kfree(ctx_data->cdm_cmd);
+		ctx_data->cdm_cmd = NULL;
+
+		return -EINVAL;
+	}
+
+	kfree(ctx_data->cdm_cmd);
+	ctx_data->cdm_cmd = NULL;
+	CAM_DBG(CAM_JPEG, "handle %llu", ctx_data);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	int rc = 0;
+	int32_t ctx_id = 0;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	struct cam_hw_acquire_args *args = acquire_hw_args;
+	struct cam_jpeg_acquire_dev_info jpeg_dev_acquire_info;
+	struct cam_cdm_acquire_data cdm_acquire;
+	uint32_t dev_type;
+
+	if ((!hw_mgr_priv) || (!acquire_hw_args)) {
+		CAM_ERR(CAM_JPEG, "Invalid params: %pK %pK", hw_mgr_priv,
+			acquire_hw_args);
+		return -EINVAL;
+	}
+
+	if (args->num_acq > 1) {
+		CAM_ERR(CAM_JPEG,
+			"number of resources are wrong: %u",
+			args->num_acq);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&jpeg_dev_acquire_info,
+			(void __user *)args->acquire_info,
+			sizeof(jpeg_dev_acquire_info))) {
+		CAM_ERR(CAM_JPEG, "copy failed");
+		return -EFAULT;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	ctx_id = cam_jpeg_mgr_get_free_ctx(hw_mgr);
+	if (ctx_id >= CAM_JPEG_CTX_MAX) {
+		CAM_ERR(CAM_JPEG, "No free ctx space in hw_mgr");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EFAULT;
+	}
+
+	ctx_data = &hw_mgr->ctx_data[ctx_id];
+
+	ctx_data->cdm_cmd =
+		kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+			((CAM_JPEG_HW_ENTRIES_MAX - 1) *
+			sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+	if (!ctx_data->cdm_cmd) {
+		rc = -ENOMEM;
+		goto jpeg_release_ctx;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	ctx_data->jpeg_dev_acquire_info = jpeg_dev_acquire_info;
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	if (ctx_data->jpeg_dev_acquire_info.dev_type >=
+		CAM_JPEG_RES_TYPE_MAX) {
+		rc = -EINVAL;
+		goto acq_cdm_hdl_failed;
+	}
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+	CAM_DBG(CAM_JPEG, "ctx_id: %u, dev_type: %u",
+		ctx_id, dev_type);
+	if (!hw_mgr->cdm_info[dev_type][0].ref_cnt) {
+
+		if (dev_type == CAM_JPEG_RES_TYPE_ENC) {
+			memcpy(cdm_acquire.identifier,
+				"jpegenc", sizeof("jpegenc"));
+		} else {
+			memcpy(cdm_acquire.identifier,
+				"jpegdma", sizeof("jpegdma"));
+		}
+		cdm_acquire.cell_index = 0;
+		cdm_acquire.handle = 0;
+		cdm_acquire.userdata = ctx_data;
+		if (hw_mgr->cdm_reg_map[dev_type][0]) {
+			cdm_acquire.base_array[0] =
+				hw_mgr->cdm_reg_map[dev_type][0];
+		}
+		cdm_acquire.base_array_cnt = 1;
+		cdm_acquire.id = CAM_CDM_VIRTUAL;
+		cdm_acquire.cam_cdm_callback = NULL;
+		cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+
+		rc = cam_cdm_acquire(&cdm_acquire);
+		if (rc) {
+			CAM_ERR(CAM_JPEG, "Failed to acquire the CDM HW %d",
+				rc);
+			rc = -EFAULT;
+			goto acq_cdm_hdl_failed;
+		}
+		hw_mgr->cdm_info[dev_type][0].cdm_handle = cdm_acquire.handle;
+		hw_mgr->cdm_info[dev_type][0].cdm_ops = cdm_acquire.ops;
+		hw_mgr->cdm_info[dev_type][0].ref_cnt++;
+	} else {
+		hw_mgr->cdm_info[dev_type][0].ref_cnt++;
+	}
+
+	if (hw_mgr->cdm_info[dev_type][0].ref_cnt == 1)
+		if (cam_cdm_stream_on(
+			hw_mgr->cdm_info[dev_type][0].cdm_handle)) {
+			CAM_ERR(CAM_JPEG, "Can not start cdm (%d)!",
+				hw_mgr->cdm_info[dev_type][0].cdm_handle);
+			rc = -EFAULT;
+			goto start_cdm_hdl_failed;
+		}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	ctx_data->context_priv = args->context_data;
+
+	args->ctxt_to_hw_map = (void *)&(hw_mgr->ctx_data[ctx_id]);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	hw_mgr->ctx_data[ctx_id].ctxt_event_cb = args->event_cb;
+	hw_mgr->ctx_data[ctx_id].mini_dump_cb = args->mini_dump_cb;
+
+	if (copy_to_user((void __user *)args->acquire_info,
+		&jpeg_dev_acquire_info,
+		sizeof(jpeg_dev_acquire_info))) {
+		rc = -EFAULT;
+		goto copy_to_user_failed;
+	}
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_JPEG, "success ctx_data= %pK", ctx_data);
+
+	return rc;
+
+copy_to_user_failed:
+	if (hw_mgr->cdm_info[dev_type][0].ref_cnt == 1)
+		cam_cdm_stream_off(hw_mgr->cdm_info[dev_type][0].cdm_handle);
+start_cdm_hdl_failed:
+	if (hw_mgr->cdm_info[dev_type][0].ref_cnt == 1)
+		cam_cdm_release(hw_mgr->cdm_info[dev_type][0].cdm_handle);
+	hw_mgr->cdm_info[dev_type][0].ref_cnt--;
+acq_cdm_hdl_failed:
+	kfree(ctx_data->cdm_cmd);
+jpeg_release_ctx:
+	cam_jpeg_mgr_release_ctx(hw_mgr, ctx_data);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_get_hw_caps(void *hw_mgr_priv, void *hw_caps_args)
+{
+	int rc;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd *query_cap = hw_caps_args;
+
+	if (!hw_mgr_priv || !hw_caps_args) {
+		CAM_ERR(CAM_JPEG, "Invalid params: %pK %pK",
+			hw_mgr_priv, hw_caps_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_jpeg_query_cap_cmd) != query_cap->size) {
+		CAM_ERR(CAM_JPEG,
+			"Input query cap size:%u does not match expected query cap size: %u",
+			query_cap->size, sizeof(struct cam_jpeg_query_cap_cmd));
+		return -EFAULT;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	if (copy_to_user(u64_to_user_ptr(query_cap->caps_handle),
+		&g_jpeg_hw_mgr.jpeg_caps,
+		sizeof(struct cam_jpeg_query_cap_cmd))) {
+		CAM_ERR(CAM_JPEG, "copy_to_user failed");
+		rc = -EFAULT;
+		goto copy_error;
+	}
+	CAM_DBG(CAM_JPEG, "Success");
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return 0;
+
+copy_error:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_jpeg_command_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_workq_jpeg_message_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int cam_jpeg_setup_workqs(void)
+{
+	int rc, i;
+
+	rc = cam_req_mgr_workq_create(
+		"jpeg_command_queue",
+		CAM_JPEG_WORKQ_NUM_TASK,
+		&g_jpeg_hw_mgr.work_process_frame,
+		CRM_WORKQ_USAGE_NON_IRQ, 0,
+		cam_req_mgr_process_workq_jpeg_command_queue);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "unable to create a worker %d", rc);
+		goto work_process_frame_failed;
+	}
+
+	rc = cam_req_mgr_workq_create(
+		"jpeg_message_queue",
+		CAM_JPEG_WORKQ_NUM_TASK,
+		&g_jpeg_hw_mgr.work_process_irq_cb,
+		CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_jpeg_message_queue);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "unable to create a worker %d", rc);
+		goto work_process_irq_cb_failed;
+	}
+
+	g_jpeg_hw_mgr.process_frame_work_data =
+		kzalloc(sizeof(struct cam_jpeg_process_frame_work_data_t) *
+			CAM_JPEG_WORKQ_NUM_TASK, GFP_KERNEL);
+	if (!g_jpeg_hw_mgr.process_frame_work_data) {
+		rc = -ENOMEM;
+		goto work_process_frame_data_failed;
+	}
+
+	g_jpeg_hw_mgr.process_irq_cb_work_data =
+		kzalloc(sizeof(struct cam_jpeg_process_irq_work_data_t) *
+			CAM_JPEG_WORKQ_NUM_TASK, GFP_KERNEL);
+	if (!g_jpeg_hw_mgr.process_irq_cb_work_data) {
+		rc = -ENOMEM;
+		goto work_process_irq_cb_data_failed;
+	}
+
+	for (i = 0; i < CAM_JPEG_WORKQ_NUM_TASK; i++)
+		g_jpeg_hw_mgr.work_process_irq_cb->task.pool[i].payload =
+			&g_jpeg_hw_mgr.process_irq_cb_work_data[i];
+
+	for (i = 0; i < CAM_JPEG_WORKQ_NUM_TASK; i++)
+		g_jpeg_hw_mgr.work_process_frame->task.pool[i].payload =
+			&g_jpeg_hw_mgr.process_frame_work_data[i];
+
+	INIT_LIST_HEAD(&g_jpeg_hw_mgr.hw_config_req_list);
+	INIT_LIST_HEAD(&g_jpeg_hw_mgr.free_req_list);
+	for (i = 0; i < CAM_JPEG_HW_CFG_Q_MAX; i++) {
+		INIT_LIST_HEAD(&(g_jpeg_hw_mgr.req_list[i].list));
+		list_add_tail(&(g_jpeg_hw_mgr.req_list[i].list),
+			&(g_jpeg_hw_mgr.free_req_list));
+	}
+
+	return rc;
+
+work_process_irq_cb_data_failed:
+	kfree(g_jpeg_hw_mgr.process_frame_work_data);
+work_process_frame_data_failed:
+	cam_req_mgr_workq_destroy(&g_jpeg_hw_mgr.work_process_irq_cb);
+work_process_irq_cb_failed:
+	cam_req_mgr_workq_destroy(&g_jpeg_hw_mgr.work_process_frame);
+work_process_frame_failed:
+
+	return rc;
+}
+
+static int cam_jpeg_init_devices(struct device_node *of_node,
+	uint32_t *p_num_enc_dev,
+	uint32_t *p_num_dma_dev)
+{
+	int count, i, rc;
+	uint32_t num_dev;
+	uint32_t num_dma_dev;
+	const char *name = NULL;
+	struct device_node *child_node = NULL;
+	struct platform_device *child_pdev = NULL;
+	struct cam_hw_intf *child_dev_intf = NULL;
+	struct cam_hw_info *enc_hw = NULL;
+	struct cam_hw_info *dma_hw = NULL;
+	struct cam_hw_soc_info *enc_soc_info = NULL;
+	struct cam_hw_soc_info *dma_soc_info = NULL;
+
+	if (!p_num_enc_dev || !p_num_dma_dev) {
+		rc = -EINVAL;
+		goto num_dev_failed;
+	}
+	count = of_property_count_strings(of_node, "compat-hw-name");
+	if (!count) {
+		CAM_ERR(CAM_JPEG,
+			"no compat hw found in dev tree, count = %d",
+			count);
+		rc = -EINVAL;
+		goto num_dev_failed;
+	}
+
+	rc = of_property_read_u32(of_node, "num-jpeg-enc", &num_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "read num enc devices failed %d", rc);
+		goto num_enc_failed;
+	}
+	g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC] = kzalloc(
+		sizeof(struct cam_hw_intf *) * num_dev, GFP_KERNEL);
+	if (!g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC]) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_JPEG, "getting number of dma dev nodes failed");
+		goto num_enc_failed;
+	}
+
+	rc = of_property_read_u32(of_node, "num-jpeg-dma", &num_dma_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "get num dma dev nodes failed %d", rc);
+		goto num_dma_failed;
+	}
+
+	g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA] = kzalloc(
+		sizeof(struct cam_hw_intf *) * num_dma_dev, GFP_KERNEL);
+	if (!g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA]) {
+		rc = -ENOMEM;
+		goto num_dma_failed;
+	}
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node, "compat-hw-name",
+			i, &name);
+		if (rc) {
+			CAM_ERR(CAM_JPEG, "getting dev object name failed");
+			goto compat_hw_name_failed;
+		}
+
+		child_node = of_find_node_by_name(NULL, name);
+		if (!child_node) {
+			CAM_ERR(CAM_JPEG,
+				"error! Cannot find node in dtsi %s", name);
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+
+		child_pdev = of_find_device_by_node(child_node);
+		if (!child_pdev) {
+			CAM_ERR(CAM_JPEG, "failed to find device on bus %s",
+				child_node->name);
+			rc = -ENODEV;
+			of_node_put(child_node);
+			goto compat_hw_name_failed;
+		}
+
+		child_dev_intf = (struct cam_hw_intf *)platform_get_drvdata(
+			child_pdev);
+		if (!child_dev_intf) {
+			CAM_ERR(CAM_JPEG, "no child device");
+			of_node_put(child_node);
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+		CAM_DBG(CAM_JPEG, "child_intf %pK type %d id %d",
+			child_dev_intf,
+			child_dev_intf->hw_type,
+			child_dev_intf->hw_idx);
+
+		if ((child_dev_intf->hw_type == CAM_JPEG_DEV_ENC &&
+			child_dev_intf->hw_idx >= num_dev) ||
+			(child_dev_intf->hw_type == CAM_JPEG_DEV_DMA &&
+			child_dev_intf->hw_idx >= num_dma_dev)) {
+			CAM_ERR(CAM_JPEG, "index out of range");
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+		g_jpeg_hw_mgr.devices[child_dev_intf->hw_type]
+			[child_dev_intf->hw_idx] = child_dev_intf;
+
+		of_node_put(child_node);
+	}
+
+	enc_hw = (struct cam_hw_info *)
+		g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC][0]->hw_priv;
+	enc_soc_info = &enc_hw->soc_info;
+	g_jpeg_hw_mgr.cdm_reg_map[CAM_JPEG_DEV_ENC][0] =
+		&enc_soc_info->reg_map[0];
+	dma_hw = (struct cam_hw_info *)
+		g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA][0]->hw_priv;
+	dma_soc_info = &dma_hw->soc_info;
+	g_jpeg_hw_mgr.cdm_reg_map[CAM_JPEG_DEV_DMA][0] =
+		&dma_soc_info->reg_map[0];
+
+	(void) g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC][0]->hw_ops.process_cmd(
+		g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC][0]->hw_priv,
+		CAM_JPEG_CMD_GET_NUM_PID,
+		&g_jpeg_hw_mgr.num_pid[CAM_JPEG_DEV_ENC],
+		sizeof(uint32_t));
+
+	rc = g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA][0]->hw_ops.process_cmd(
+		g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA][0]->hw_priv,
+		CAM_JPEG_CMD_GET_NUM_PID,
+		&g_jpeg_hw_mgr.num_pid[CAM_JPEG_DEV_DMA],
+		sizeof(uint32_t));
+
+	*p_num_enc_dev = num_dev;
+	*p_num_dma_dev = num_dma_dev;
+
+	return rc;
+
+compat_hw_name_failed:
+	kfree(g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA]);
+num_dma_failed:
+	kfree(g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC]);
+num_enc_failed:
+num_dev_failed:
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_hw_dump(void *hw_mgr_priv, void *dump_hw_args)
+{
+	int                             rc;
+	uint8_t                        *dst;
+	ktime_t                         cur_time;
+	size_t                          remain_len;
+	uint32_t                        min_len;
+	uint32_t                        dev_type;
+	uint64_t                        diff;
+	uint64_t                       *addr, *start;
+	struct timespec64               cur_ts;
+	struct timespec64               req_ts;
+	struct cam_jpeg_hw_mgr         *hw_mgr;
+	struct cam_hw_dump_args        *dump_args;
+	struct cam_jpeg_hw_cfg_req     *p_cfg_req;
+	struct cam_jpeg_hw_ctx_data    *ctx_data;
+	struct cam_jpeg_hw_dump_args    jpeg_dump_args;
+	struct cam_jpeg_hw_dump_header *hdr;
+
+	if (!hw_mgr_priv || !dump_hw_args) {
+		CAM_ERR(CAM_JPEG, "Invalid args %pK %pK",
+			hw_mgr_priv, dump_hw_args);
+		return -EINVAL;
+	}
+
+	hw_mgr = hw_mgr_priv;
+	dump_args = (struct cam_hw_dump_args *)dump_hw_args;
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)dump_args->ctxt_to_hw_map;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_JPEG, "Invalid context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	if (true == hw_mgr->device_in_use[dev_type][0]) {
+		p_cfg_req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+		if (p_cfg_req  && p_cfg_req->req_id ==
+			    (uintptr_t)dump_args->request_id)
+			goto hw_dump;
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return 0;
+
+hw_dump:
+	cur_time = ktime_get();
+	diff = ktime_us_delta(p_cfg_req->submit_timestamp, cur_time);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(p_cfg_req->submit_timestamp);
+
+	if (diff < CAM_JPEG_RESPONSE_TIME_THRESHOLD) {
+		CAM_INFO(CAM_JPEG,
+			"No error req %lld req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return 0;
+	}
+
+	CAM_INFO(CAM_JPEG,
+		"Error req %lld req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&jpeg_dump_args.cpu_addr, &jpeg_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -rc;
+	}
+
+	if (jpeg_dump_args.buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_JPEG, "dump offset overshoot len %zu offset %zu",
+			jpeg_dump_args.buf_len, dump_args->offset);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	remain_len = jpeg_dump_args.buf_len - dump_args->offset;
+	min_len = sizeof(struct cam_jpeg_hw_dump_header) +
+			(CAM_JPEG_HW_DUMP_NUM_WORDS * sizeof(uint64_t));
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_JPEG, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)jpeg_dump_args.cpu_addr + dump_args->offset;
+	hdr = (struct cam_jpeg_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_JPEG_HW_DUMP_TAG_MAX_LEN,
+		"JPEG_REQ:");
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_jpeg_hw_dump_header));
+	start = addr;
+	*addr++ = dump_args->request_id;
+	*addr++ = req_ts.tv_sec;
+	*addr++ = req_ts.tv_nsec/NSEC_PER_USEC;
+	*addr++ = cur_ts.tv_sec;
+	*addr++ = cur_ts.tv_nsec/NSEC_PER_USEC;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_jpeg_hw_dump_header);
+	jpeg_dump_args.request_id = dump_args->request_id;
+	jpeg_dump_args.offset = dump_args->offset;
+
+	if (hw_mgr->devices[dev_type][0]->hw_ops.process_cmd) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			CAM_JPEG_CMD_HW_DUMP,
+			&jpeg_dump_args, sizeof(jpeg_dump_args));
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	CAM_DBG(CAM_JPEG, "Offset before %u after %u",
+		dump_args->offset, jpeg_dump_args.offset);
+	dump_args->offset = jpeg_dump_args.offset;
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static void cam_jpeg_mgr_dump_pf_data(
+	struct cam_jpeg_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args  *hw_cmd_args)
+{
+	struct cam_jpeg_hw_ctx_data       *ctx_data;
+	struct cam_packet                 *packet;
+	struct cam_jpeg_match_pid_args     jpeg_pid_mid_args;
+	struct cam_hw_dump_pf_args        *pf_args;
+	struct cam_hw_mgr_pf_request_info *pf_req_info;
+	uint32_t                           dev_type;
+	bool                               hw_pid_support = true;
+	int                                rc = 0;
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data  *)hw_cmd_args->ctxt_to_hw_map;
+	pf_args = hw_cmd_args->u.pf_cmd_args->pf_args;
+	pf_req_info = hw_cmd_args->u.pf_cmd_args->pf_req_info;
+	rc = cam_packet_util_get_packet_addr(&packet,
+		pf_req_info->packet_handle, pf_req_info->packet_offset);
+	if (rc)
+		return;
+
+	jpeg_pid_mid_args.fault_mid = pf_args->pf_smmu_info->mid;
+	jpeg_pid_mid_args.pid = pf_args->pf_smmu_info->pid;
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	if (!hw_mgr->num_pid[dev_type]) {
+		hw_pid_support = false;
+		goto iodump;
+	}
+
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+		hw_mgr->devices[dev_type][0]->hw_priv,
+		CAM_JPEG_CMD_MATCH_PID_MID,
+		&jpeg_pid_mid_args, sizeof(jpeg_pid_mid_args));
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "CAM_JPEG_CMD_MATCH_PID_MID failed %d", rc);
+		cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
+		return;
+	}
+
+	if (!jpeg_pid_mid_args.pid_match_found) {
+		CAM_INFO(CAM_JPEG, "This context data is not matched with pf pid and mid");
+		cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
+		return;
+	}
+	pf_args->pf_context_info.resource_type = jpeg_pid_mid_args.match_res;
+
+iodump:
+	cam_packet_util_dump_io_bufs(packet, hw_mgr->iommu_hdl, hw_mgr->iommu_sec_hdl,
+		pf_args, hw_pid_support);
+	cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
+
+	/* Dump JPEG registers for debug purpose */
+	if (dev_type == CAM_JPEG_RES_TYPE_DMA ||
+		dev_type == CAM_JPEG_RES_TYPE_ENC) {
+		rc = hw_mgr->devices[dev_type][CAM_JPEG_MEM_BASE_INDEX]->hw_ops.process_cmd(
+			hw_mgr->devices[dev_type][CAM_JPEG_MEM_BASE_INDEX]->hw_priv,
+			CAM_JPEG_CMD_DUMP_DEBUG_REGS,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "Invalid process_cmd ops");
+
+	} else {
+		CAM_ERR(CAM_JPEG, "Invalid dev_type %d", dev_type);
+	}
+}
+
+static int cam_jpeg_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_jpeg_mgr_dump_pf_data(hw_mgr, hw_cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_JPEG, "Invalid cmd :%d",
+			hw_cmd_args->cmd_type);
+	}
+
+	return rc;
+}
+
+static unsigned long cam_jpeg_hw_mgr_mini_dump_cb(void *dst, unsigned long len,
+	void *priv_data)
+{
+	struct cam_jpeg_hw_mini_dump_req *md_req;
+	struct cam_jpeg_hw_mgr_mini_dump *md;
+	struct cam_jpeg_hw_ctx_mini_dump *ctx_md;
+	struct cam_jpeg_hw_ctx_data      *ctx;
+	struct cam_jpeg_hw_mgr           *hw_mgr;
+	struct cam_jpeg_hw_cfg_req       *req;
+	struct cam_hw_mini_dump_args      hw_dump_args;
+	uint32_t                          dev_type;
+	uint32_t                          i = 0;
+	unsigned long                     dumped_len = 0;
+	unsigned long                     remain_len = len;
+
+	if (!dst || len < sizeof(*md)) {
+		CAM_ERR(CAM_JPEG, "Invalid params dst %pk len %lu", dst, len);
+		return 0;
+	}
+
+	md = (struct cam_jpeg_hw_mgr_mini_dump *)dst;
+	md->num_context = 0;
+	hw_mgr = &g_jpeg_hw_mgr;
+	for (i = 0; i < CAM_JPEG_RES_TYPE_MAX; i++) {
+		if (hw_mgr->devices[i][0]->hw_ops.process_cmd) {
+			hw_mgr->devices[i][0]->hw_ops.process_cmd(
+				hw_mgr->devices[i][0]->hw_priv,
+				CAM_JPEG_CMD_MINI_DUMP,
+				&md->core[i],
+				sizeof(struct cam_jpeg_mini_dump_core_info));
+		}
+	}
+
+	dumped_len += sizeof(*md);
+	remain_len = len - dumped_len;
+	for (i = 0; i < CAM_JPEG_CTX_MAX; i++) {
+		ctx = &hw_mgr->ctx_data[i];
+		if (!ctx->in_use)
+			continue;
+
+		if (remain_len < sizeof(*ctx_md))
+			goto end;
+
+		md->num_context++;
+		ctx_md = (struct cam_jpeg_hw_ctx_mini_dump *)
+			    ((uint8_t *)dst + dumped_len);
+		md->ctx[i] = ctx_md;
+		ctx_md->in_use  = ctx->in_use;
+		memcpy(&ctx_md->acquire_info, &ctx->jpeg_dev_acquire_info,
+			sizeof(struct cam_jpeg_acquire_dev_info));
+		dev_type = ctx->jpeg_dev_acquire_info.dev_type;
+		req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+		if (req) {
+			md_req = &md->cfg_req[dev_type];
+			memcpy(&md_req->submit_timestamp, &req->submit_timestamp,
+				sizeof(ktime_t));
+			md_req->req_id = req->req_id;
+			md_req->dev_type = req->dev_type;
+			md_req->num_hw_entry_processed = req->num_hw_entry_processed;
+		}
+
+		hw_dump_args.len = remain_len;
+		hw_dump_args.bytes_written = 0;
+		hw_dump_args.start_addr = (void *)((uint8_t *)dst + dumped_len);
+		hw_mgr->mini_dump_cb(ctx->context_priv, &hw_dump_args);
+		if (dumped_len + hw_dump_args.bytes_written >= len)
+			goto end;
+
+		dumped_len += hw_dump_args.bytes_written;
+		remain_len = len - dumped_len;
+	}
+
+end:
+	return dumped_len;
+}
+
+static int cam_jpeg_set_camnoc_misr_test(void *data, u64 val)
+{
+	g_jpeg_hw_mgr.camnoc_misr_test = val;
+	return 0;
+}
+
+static int cam_jpeg_get_camnoc_misr_test(void *data, u64 *val)
+{
+	*val = g_jpeg_hw_mgr.camnoc_misr_test;
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(camnoc_misr_test, cam_jpeg_get_camnoc_misr_test,
+	cam_jpeg_set_camnoc_misr_test, "%08llu");
+
+static int cam_jpeg_set_bug_on_misr(void *data, u64 val)
+{
+	g_jpeg_hw_mgr.bug_on_misr = val;
+	return 0;
+}
+
+static int cam_jpeg_get_bug_on_misr(void *data, u64 *val)
+{
+	*val = g_jpeg_hw_mgr.bug_on_misr;
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(bug_on_misr_mismatch, cam_jpeg_get_bug_on_misr,
+	cam_jpeg_set_bug_on_misr, "%08llu");
+
+#ifdef CONFIG_CAM_TEST_IRQ_LINE
+
+static int cam_jpeg_test_irq_line(void)
+{
+	struct cam_hw_intf *hw_intf;
+	int rc = -EINVAL, i, j;
+
+	for (i = 0; i < CAM_JPEG_DEV_PER_TYPE_MAX; i++) {
+		for (j = 0; j < CAM_JPEG_DEV_MAX; j++) {
+			hw_intf = g_jpeg_hw_mgr.devices[j][i];
+			if (hw_intf && hw_intf->hw_ops.test_irq_line) {
+				rc = hw_intf->hw_ops.test_irq_line(hw_intf->hw_priv);
+				if (rc)
+					CAM_ERR(CAM_JPEG,
+						"failed to verify IRQ line for JPEG-%s[%d]",
+						CAM_JPEG_DEV_TYPE(j), i);
+			}
+		}
+	}
+
+	return rc;
+}
+
+#else
+
+static int cam_jpeg_test_irq_line(void)
+{
+	CAM_ERR(CAM_JPEG, "IRQ line verification disabled!");
+	return -EPERM;
+}
+
+#endif
+
+#if (defined(CONFIG_CAM_TEST_IRQ_LINE) && defined(CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE))
+
+static int cam_jpeg_test_irq_line_at_probe(void)
+{
+	return cam_jpeg_test_irq_line();
+}
+
+#else
+
+static int cam_jpeg_test_irq_line_at_probe(void)
+{
+	return 0;
+}
+
+#endif
+
+static int cam_jpeg_set_irq_line_test(void *data, u64 val)
+{
+	cam_jpeg_test_irq_line();
+	return 0;
+}
+
+static int cam_jpeg_get_irq_line_test(void *data, u64 *val)
+{
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_jpeg_irq_line_test, cam_jpeg_get_irq_line_test,
+	cam_jpeg_set_irq_line_test, "%08llu");
+
+static int cam_jpeg_mgr_create_debugfs_entry(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("jpeg", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "DebugFS could not create directory!");
+		return rc;
+	}
+	/* Store parent inode for cleanup in caller */
+	g_jpeg_hw_mgr.dentry = dbgfileptr;
+
+	debugfs_create_file("camnoc_misr_test", 0644, g_jpeg_hw_mgr.dentry,
+		NULL, &camnoc_misr_test);
+
+	debugfs_create_file("bug_on_misr_mismatch", 0644, g_jpeg_hw_mgr.dentry,
+		NULL, &bug_on_misr_mismatch);
+
+	debugfs_create_file("test_irq_line", 0644, g_jpeg_hw_mgr.dentry,
+		NULL, &cam_jpeg_irq_line_test);
+
+	return rc;
+}
+
+static void cam_jpeg_mgr_inject_evt(void *hw_mgr_priv, void *evt_args)
+{
+	struct cam_jpeg_hw_ctx_data *ctx_data      = hw_mgr_priv;
+	struct cam_hw_inject_evt_param *evt_params = evt_args;
+
+	if (!ctx_data || !evt_params) {
+		CAM_ERR(CAM_JPEG, "Invalid parameters ctx data %s event params %s",
+			CAM_IS_NULL_TO_STR(ctx_data), CAM_IS_NULL_TO_STR(evt_params));
+		return;
+	}
+
+	memcpy(&ctx_data->evt_inject_params, evt_params,
+		sizeof(struct cam_hw_inject_evt_param));
+
+	ctx_data->evt_inject_params.is_valid = true;
+}
+
+int cam_jpeg_hw_mgr_init(struct device_node *of_node, uint64_t *hw_mgr_hdl,
+	int *iommu_hdl, cam_jpeg_mini_dump_cb mini_dump_cb)
+{
+	int i, rc;
+	uint32_t num_dev;
+	uint32_t num_dma_dev;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	struct cam_iommu_handle cdm_handles;
+
+	hw_mgr_intf = (struct cam_hw_mgr_intf *)hw_mgr_hdl;
+	if (!of_node || !hw_mgr_intf) {
+		CAM_ERR(CAM_JPEG, "Invalid args of_node %pK hw_mgr %pK",
+			of_node, hw_mgr_intf);
+		return -EINVAL;
+	}
+
+	memset(hw_mgr_hdl, 0x0, sizeof(struct cam_hw_mgr_intf));
+	hw_mgr_intf->hw_mgr_priv = &g_jpeg_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_jpeg_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire = cam_jpeg_mgr_acquire_hw;
+	hw_mgr_intf->hw_release = cam_jpeg_mgr_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_jpeg_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config = cam_jpeg_mgr_config_hw;
+	hw_mgr_intf->hw_flush = cam_jpeg_mgr_hw_flush;
+	hw_mgr_intf->hw_stop = cam_jpeg_mgr_hw_stop;
+	hw_mgr_intf->hw_cmd = cam_jpeg_mgr_cmd;
+	hw_mgr_intf->hw_dump = cam_jpeg_mgr_hw_dump;
+	hw_mgr_intf->hw_inject_evt = cam_jpeg_mgr_inject_evt;
+
+	mutex_init(&g_jpeg_hw_mgr.hw_mgr_mutex);
+	spin_lock_init(&g_jpeg_hw_mgr.hw_mgr_lock);
+
+	for (i = 0; i < CAM_JPEG_CTX_MAX; i++)
+		mutex_init(&g_jpeg_hw_mgr.ctx_data[i].ctx_mutex);
+
+	rc = cam_jpeg_init_devices(of_node, &num_dev, &num_dma_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "jpeg init devices %d", rc);
+		goto smmu_get_failed;
+	}
+
+	rc = cam_smmu_get_handle("jpeg", &g_jpeg_hw_mgr.iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "jpeg get iommu handle failed %d", rc);
+		goto smmu_get_failed;
+	}
+
+	CAM_DBG(CAM_JPEG, "mmu handle :%d", g_jpeg_hw_mgr.iommu_hdl);
+
+	rc = cam_cdm_get_iommu_handle("jpegenc", &cdm_handles);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "acquire cdm iommu handle Fail  %d", rc);
+		g_jpeg_hw_mgr.cdm_iommu_hdl = -1;
+		g_jpeg_hw_mgr.cdm_iommu_hdl_secure = -1;
+		goto cdm_iommu_failed;
+	}
+	g_jpeg_hw_mgr.cdm_iommu_hdl = cdm_handles.non_secure;
+	g_jpeg_hw_mgr.cdm_iommu_hdl_secure = cdm_handles.secure;
+
+	g_jpeg_hw_mgr.jpeg_caps.dev_iommu_handle.non_secure =
+		g_jpeg_hw_mgr.iommu_hdl;
+	g_jpeg_hw_mgr.jpeg_caps.dev_iommu_handle.secure =
+		g_jpeg_hw_mgr.iommu_sec_hdl;
+	g_jpeg_hw_mgr.jpeg_caps.cdm_iommu_handle.non_secure =
+		g_jpeg_hw_mgr.cdm_iommu_hdl;
+	g_jpeg_hw_mgr.jpeg_caps.cdm_iommu_handle.secure =
+		g_jpeg_hw_mgr.cdm_iommu_hdl_secure;
+	g_jpeg_hw_mgr.jpeg_caps.num_enc = num_dev;
+	g_jpeg_hw_mgr.jpeg_caps.num_dma = num_dma_dev;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_ENC].hw_ver.major = 4;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_ENC].hw_ver.minor = 2;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_ENC].hw_ver.incr  = 0;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_ENC].hw_ver.reserved = 0;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_DMA].hw_ver.major = 4;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_DMA].hw_ver.minor = 2;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_DMA].hw_ver.incr  = 0;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_DMA].hw_ver.reserved = 0;
+
+	g_jpeg_hw_mgr.mini_dump_cb = mini_dump_cb;
+
+	rc = cam_jpeg_setup_workqs();
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "setup work qs failed  %d", rc);
+		goto cdm_iommu_failed;
+	}
+
+	if (iommu_hdl)
+		*iommu_hdl = g_jpeg_hw_mgr.iommu_hdl;
+
+	cam_common_register_mini_dump_cb(cam_jpeg_hw_mgr_mini_dump_cb, "CAM_JPEG",
+		NULL);
+	cam_jpeg_mgr_create_debugfs_entry();
+	cam_jpeg_test_irq_line_at_probe();
+
+	return 0;
+
+cdm_iommu_failed:
+	cam_smmu_destroy_handle(g_jpeg_hw_mgr.iommu_hdl);
+	g_jpeg_hw_mgr.iommu_hdl = 0;
+smmu_get_failed:
+	mutex_destroy(&g_jpeg_hw_mgr.hw_mgr_mutex);
+	for (i = 0; i < CAM_JPEG_CTX_MAX; i++)
+		mutex_destroy(&g_jpeg_hw_mgr.ctx_data[i].ctx_mutex);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.h
@@ -0,0 +1,227 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_HW_MGR_H
+#define CAM_JPEG_HW_MGR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_jpeg.h>
+
+#include "cam_jpeg_hw_intf.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+
+#define CAM_JPEG_WORKQ_NUM_TASK             30
+#define CAM_JPEG_WORKQ_TASK_CMD_TYPE        1
+#define CAM_JPEG_WORKQ_TASK_MSG_TYPE        2
+#define CAM_JPEG_HW_CFG_Q_MAX               50
+
+/*
+ * Response time threshold in ms beyond which a request is not expected
+ * to be with JPEG hw
+ */
+#define CAM_JPEG_RESPONSE_TIME_THRESHOLD   100000
+
+/**
+ * struct cam_jpeg_process_frame_work_data_t
+ *
+ * @type: Task type
+ * @data: Pointer to command data
+ * @request_id: Request id
+ */
+struct cam_jpeg_process_frame_work_data_t {
+	uint32_t type;
+	void *data;
+	uintptr_t request_id;
+};
+
+/**
+ * struct cam_jpeg_process_irq_work_data_t
+ *
+ * @type                   : Task type
+ * @output_encode_size     : Result size of encoder
+ * @is_dma_frame_done      : Flag to indicate whther the dma fram done was recived or not.
+ * @irq_status             : IRQ status
+ * @data                   : Pointer to message data
+ */
+struct cam_jpeg_process_irq_work_data_t {
+	uint32_t       type;
+	union core_data {
+		int32_t        output_encode_size;
+		int32_t        is_dma_frame_done;
+		int32_t        irq_data;
+	} u;
+	uint32_t       irq_status;
+	void          *data;
+};
+
+/**
+ * struct cam_jpeg_hw_cdm_info_t
+ *
+ * @ref_cnt: Ref count of how many times device type is acquired
+ * @cdm_handle: Cdm handle
+ * @cdm_ops: Cdm ops struct
+ */
+struct cam_jpeg_hw_cdm_info_t {
+	int ref_cnt;
+	uint32_t cdm_handle;
+	struct cam_cdm_utils_ops *cdm_ops;
+};
+
+/**
+ * struct cam_jpeg_hw_cfg_req_t
+ *
+ * @list_head: List head
+ * @hw_cfg_args: Hw config args
+ * @dev_type: Dev type for cfg request
+ * @req_id: Request Id
+ * @submit_timestamp: Timestamp of submitting request
+ * @num_hw_entry_processed: Cdm payloads already processed
+ */
+struct cam_jpeg_hw_cfg_req {
+	struct list_head list;
+	struct cam_hw_config_args hw_cfg_args;
+	uint32_t dev_type;
+	uintptr_t req_id;
+	ktime_t    submit_timestamp;
+	uint32_t num_hw_entry_processed;
+};
+
+/**
+ * struct cam_jpeg_hw_ctx_data
+ *
+ * @context_priv: Context private data, cam_context from
+ *     acquire.
+ * @ctx_mutex: Mutex for context
+ * @jpeg_dev_acquire_info: Acquire device info
+ * @ctxt_event_cb: Context callback function
+ * @in_use: Flag for context usage
+ * @wait_complete: Completion info
+ * @cdm_cmd: Cdm cmd submitted for that context.
+ * @mini_dump_cb: Mini dump cb
+ * @evt_inject_params: Event injection params for hw_mgr_ctx
+ */
+struct cam_jpeg_hw_ctx_data {
+	void *context_priv;
+	struct mutex ctx_mutex;
+	struct cam_jpeg_acquire_dev_info jpeg_dev_acquire_info;
+	cam_hw_event_cb_func ctxt_event_cb;
+	bool in_use;
+	struct completion wait_complete;
+	struct cam_cdm_bl_request *cdm_cmd;
+	cam_ctx_mini_dump_cb_func      mini_dump_cb;
+	struct cam_hw_inject_evt_param evt_inject_params;
+};
+
+/**
+ * struct cam_jpeg_hw_mgr
+ * @hw_mgr_mutex: Mutex for JPEG hardware manager
+ * @hw_mgr_lock: Spinlock for JPEG hardware manager
+ * @ctx_data: Context data
+ * @jpeg_caps: JPEG capabilities
+ * @iommu_hdl: Non secure IOMMU handle
+ * @iommu_sec_hdl: Secure IOMMU handle
+ * @work_process_frame: Work queue for hw config requests
+ * @work_process_irq_cb: Work queue for processing IRQs.
+ * @process_frame_work_data: Work data pool for hw config
+ *     requests
+ * @process_irq_cb_work_data: Work data pool for irq requests
+ * @cdm_iommu_hdl: Iommu handle received from cdm
+ * @cdm_iommu_hdl_secure: Secure iommu handle received from cdm
+ * @dentry: Debugfs entry
+ * @camnoc_misr_test : debugfs entry to select camnoc_misr for read or write path
+ * @bug_on_misr : enable/disable bug on when misr mismatch is seen
+ * @devices: Core hw Devices of JPEG hardware manager
+ * @cdm_info: Cdm info for each core device.
+ * @cdm_reg_map: Regmap of each device for cdm.
+ * @device_in_use: Flag device being used for an active request
+ * @dev_hw_cfg_args: Current cfg request per core dev
+ * @hw_config_req_list: Pending hw update requests list
+ * @free_req_list: Free nodes for above list
+ * @req_list: Nodes of hw update list
+ * @num_pid: num of pids supported in the device
+ * @mini_dump_cb: Mini dump cb
+ */
+struct cam_jpeg_hw_mgr {
+	struct mutex hw_mgr_mutex;
+	spinlock_t hw_mgr_lock;
+	struct cam_jpeg_hw_ctx_data ctx_data[CAM_JPEG_CTX_MAX];
+	struct cam_jpeg_query_cap_cmd jpeg_caps;
+	int32_t iommu_hdl;
+	int32_t iommu_sec_hdl;
+	struct cam_req_mgr_core_workq *work_process_frame;
+	struct cam_req_mgr_core_workq *work_process_irq_cb;
+	struct cam_jpeg_process_frame_work_data_t *process_frame_work_data;
+	struct cam_jpeg_process_irq_work_data_t *process_irq_cb_work_data;
+	int cdm_iommu_hdl;
+	int cdm_iommu_hdl_secure;
+	struct dentry *dentry;
+	u64 camnoc_misr_test;
+	u64 bug_on_misr;
+
+	struct cam_hw_intf **devices[CAM_JPEG_DEV_TYPE_MAX];
+	struct cam_jpeg_hw_cdm_info_t cdm_info[CAM_JPEG_DEV_TYPE_MAX]
+		[CAM_JPEG_NUM_DEV_PER_RES_MAX];
+	struct cam_soc_reg_map *cdm_reg_map[CAM_JPEG_DEV_TYPE_MAX]
+		[CAM_JPEG_NUM_DEV_PER_RES_MAX];
+	uint32_t device_in_use[CAM_JPEG_DEV_TYPE_MAX]
+		[CAM_JPEG_NUM_DEV_PER_RES_MAX];
+	struct cam_jpeg_hw_cfg_req *dev_hw_cfg_args[CAM_JPEG_DEV_TYPE_MAX]
+		[CAM_JPEG_NUM_DEV_PER_RES_MAX];
+
+	struct list_head hw_config_req_list;
+	struct list_head free_req_list;
+	struct cam_jpeg_hw_cfg_req req_list[CAM_JPEG_HW_CFG_Q_MAX];
+	uint32_t num_pid[CAM_JPEG_DEV_TYPE_MAX];
+	cam_jpeg_mini_dump_cb      mini_dump_cb;
+};
+
+/**
+ * struct cam_jpeg_hw_mini_dump_req
+ *
+ * @submit_timestamp:        Time stamp of request submit
+ * @req_id:                  Request Id
+ * @dev_type:                Dev type
+ * @num_hw_entry_processed:  Num of hw entry processed
+ */
+struct cam_jpeg_hw_mini_dump_req {
+	ktime_t    submit_timestamp;
+	uintptr_t  req_id;
+	uint32_t   dev_type;
+	uint32_t   num_hw_entry_processed;
+};
+
+/**
+ * struct cam_jpeg_hw_ctx_mini_dump
+ *
+ * @acquire_info:        Acquire info
+ * @hw_ctx:              hw context info
+ * @in_use:              flag to indicate if in use
+ */
+struct cam_jpeg_hw_ctx_mini_dump {
+	struct cam_jpeg_acquire_dev_info        acquire_info;
+	struct cam_hw_mini_dump_info            hw_ctx;
+	bool                                    in_use;
+};
+
+/**
+ * struct cam_jpeg_hw_mgr_mini_dump
+ *
+ * @ctx:               Context info array
+ * @cfg_req:           Cfg req
+ * @core:              core info
+ * @num_context:       Num of context
+ */
+struct cam_jpeg_hw_mgr_mini_dump {
+	struct cam_jpeg_hw_ctx_mini_dump      *ctx[CAM_JPEG_CTX_MAX];
+	struct cam_jpeg_hw_mini_dump_req       cfg_req[CAM_JPEG_DEV_TYPE_MAX];
+	struct cam_jpeg_mini_dump_core_info    core[CAM_JPEG_RES_TYPE_MAX];
+	uint32_t                               num_context;
+};
+#endif /* CAM_JPEG_HW_MGR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/include/cam_jpeg_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/include/cam_jpeg_hw_intf.h
@@ -0,0 +1,114 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_HW_INTF_H
+#define CAM_JPEG_HW_INTF_H
+
+#include "cam_cpas_api.h"
+
+#define CAM_JPEG_DEV_PER_TYPE_MAX     1
+
+#define CAM_JPEG_CMD_BUF_MAX_SIZE     128
+#define CAM_JPEG_MSG_BUF_MAX_SIZE     CAM_JPEG_CMD_BUF_MAX_SIZE
+
+#define JPEG_VOTE                     640000000
+
+#define CAM_JPEG_HW_DUMP_TAG_MAX_LEN 128
+#define CAM_JPEG_HW_DUMP_NUM_WORDS   5
+#define CAM_JPEG_HW_MAX_NUM_PID      2
+#define CAM_JPEG_CAMNOC_MISR_VAL_ROW 2
+#define CAM_JPEG_CAMNOC_MISR_VAL_COL 4
+#define CAM_JPEG_ENC_MISR_VAL_NUM    3
+#define CAM_JPEG_MISR_ID_LOW_RD      1
+#define CAM_JPEG_MISR_ID_LOW_WR      2
+#define CAM_JPEG_MEM_BASE_INDEX      0
+
+/**
+ * struct cam_jpeg_irq_cb_data - Data that gets passed from IRQ when the cb function is called
+ * @private_data      : Void * for privat data
+ * @jpeg_req          : Jpeg reguest data stored during prepare update
+ */
+struct cam_jpeg_irq_cb_data {
+	void                         *private_data;
+	struct cam_jpeg_request_data *jpeg_req;
+};
+
+struct cam_jpeg_set_irq_cb {
+	int32_t (*jpeg_hw_mgr_cb)(uint32_t irq_status, int32_t result_size, void *data);
+	struct cam_jpeg_irq_cb_data irq_cb_data;
+	uint32_t b_set_cb;
+};
+
+struct cam_jpeg_hw_dump_args {
+	uint64_t  request_id;
+	uintptr_t cpu_addr;
+	size_t    offset;
+	size_t    buf_len;
+};
+
+struct cam_jpeg_hw_dump_header {
+	uint8_t     tag[CAM_JPEG_HW_DUMP_TAG_MAX_LEN];
+	uint64_t    size;
+	uint32_t    word_size;
+};
+
+struct cam_jpeg_match_pid_args {
+	uint32_t    pid;
+	uint32_t    fault_mid;
+	bool        pid_match_found;
+	uint32_t    match_res;
+};
+
+struct cam_jpeg_mini_dump_core_info {
+	uint32_t           framedone;
+	uint32_t           resetdone;
+	uint32_t           iserror;
+	uint32_t           stopdone;
+	uint32_t           open_count;
+	int32_t            ref_count;
+	uint32_t           core_state;
+	uint32_t           hw_state;
+};
+
+/**
+ * struct cam_jpeg_misr_dump_args
+ * @req_id     : Request Id
+ * @enable_bug : This flag indicates whether BUG_ON(1) has to be called or not on MISR mismatch
+ */
+struct cam_jpeg_misr_dump_args {
+	uint32_t    req_id;
+	bool        enable_bug;
+};
+
+/**
+ * struct cam_jpeg_hw_buf_done_evt_data
+ * @buf_done_data:    buf done payload
+ * @evt_id:           event id (success/cancel/error)
+ */
+struct cam_jpeg_hw_buf_done_evt_data {
+	void      *buf_done_data;
+	uint32_t   evt_id;
+};
+
+enum cam_jpeg_cmd_type {
+	CAM_JPEG_CMD_CDM_CFG,
+	CAM_JPEG_CMD_SET_IRQ_CB,
+	CAM_JPEG_CMD_HW_DUMP,
+	CAM_JPEG_CMD_GET_NUM_PID,
+	CAM_JPEG_CMD_MATCH_PID_MID,
+	CAM_JPEG_CMD_MINI_DUMP,
+	CAM_JPEG_CMD_CONFIG_HW_MISR,
+	CAM_JPEG_CMD_DUMP_HW_MISR_VAL,
+	CAM_JPEG_CMD_DUMP_DEBUG_REGS,
+	CAM_JPEG_CMD_MAX,
+};
+
+enum cam_jpeg_hw_event_type {
+	CAM_JPEG_EVT_ID_BUF_DONE,
+	CAM_JPEG_EVT_ID_INDUCE_ERR,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/include/cam_jpeg_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/include/cam_jpeg_hw_mgr_intf.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_HW_MGR_INTF_H
+#define CAM_JPEG_HW_MGR_INTF_H
+
+#include <linux/of.h>
+#include <media/cam_jpeg.h>
+#include <media/cam_defs.h>
+
+#define CAM_JPEG_CTX_MAX        24
+
+enum cam_jpeg_hw_type {
+	CAM_JPEG_DEV_ENC,
+	CAM_JPEG_DEV_DMA,
+	CAM_JPEG_DEV_MAX,
+};
+
+/**
+ * struct cam_jpeg_request_data - Jpeg request data received from command buffers
+ * @dev_type                 : Jpeg device type(ENC vs DMA)
+ * @request_id               : Request ID
+ * @thumbnail_threshold_size : Threshold size for thumbnail image
+ * @out_size_mem_handle      : handle to the buffer to share encoded output size with userspace
+ * @out_size_offset          : offset to memory where out_size_mem_handle is stored
+ */
+struct cam_jpeg_request_data {
+	uint32_t                            dev_type;
+	uint64_t                            request_id;
+	uint32_t                            thumbnail_threshold_size;
+	__s32				    out_size_mem_handle;
+	uint32_t			    out_size_offset;
+};
+
+typedef void (*cam_jpeg_mini_dump_cb)(void *priv, void *dst);
+
+int cam_jpeg_hw_mgr_init(struct device_node *of_node,
+	uint64_t *hw_mgr_hdl, int *iommu_hdl,
+	cam_jpeg_mini_dump_cb mini_dump_cb);
+
+#endif /* CAM_JPEG_HW_MGR_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_165_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_165_hw_info_ver_4_2_0.h
@@ -0,0 +1,76 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_165_HW_INFO_VER_4_2_0_H
+#define CAM_JPEG_DMA_165_HW_INFO_VER_4_2_0_H
+
+#define CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE (1 << 0)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RD_BUF_DONE  (1 << 1)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_WR_BUF_DONE  (1 << 5)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT     (1 << 9)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE     (1 << 10)
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE
+#define CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE
+
+static struct cam_jpeg_dma_device_hw_info cam_jpeg_dma_165_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x14,
+		.int_status = 0x10,
+		.int_mask = 0x0C,
+		.hw_cmd = 0x1C,
+		.reset_cmd = 0x08,
+		.encode_size = 0x180,
+		.core_cfg = 0x18,
+		.misr_cfg0 = 0x160,
+		.misr_cfg1 = 0x164,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x32083,
+		.hw_cmd_stop = 0x00000004,
+		.misr_cfg0 = 0x506,
+	},
+	.int_status = {
+		.framedone = CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK,
+		.iserror = 0x0,
+		.stopdone = CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x4,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x5908,
+		.id_mask_low = 0x5920,
+		.id_value_low = 0x5918,
+		.misc_ctl = 0x5910,
+		.sigdata0 = 0x5950,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD00,
+		.id_value_low_wr = 0xD42,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.max_misr_wr = 4,
+	.camnoc_misr_sigdata = 4,
+	.master_we_sel = 2,
+	.misr_rd_word_sel = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_DMA_165_HW_INFO_VER_4_2_0_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_580_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_580_hw_info_ver_4_2_0.h
@@ -0,0 +1,76 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_580_HW_INFO_VER_4_2_0_H
+#define CAM_JPEG_DMA_580_HW_INFO_VER_4_2_0_H
+
+#define CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE (1 << 0)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RD_BUF_DONE  (1 << 1)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_WR_BUF_DONE  (1 << 5)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT     (1 << 9)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE     (1 << 10)
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE
+#define CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE
+
+static struct cam_jpeg_dma_device_hw_info cam_jpeg_dma_580_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x14,
+		.int_status = 0x10,
+		.int_mask = 0x0C,
+		.hw_cmd = 0x1C,
+		.reset_cmd = 0x08,
+		.encode_size = 0x180,
+		.core_cfg = 0x18,
+		.misr_cfg0 = 0x160,
+		.misr_cfg1 = 0x164,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x32083,
+		.hw_cmd_stop = 0x00000004,
+		.misr_cfg0 = 0x506,
+	},
+	.int_status = {
+		.framedone = CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK,
+		.iserror = 0x0,
+		.stopdone = CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x4,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x3608,
+		.id_mask_low = 0x3620,
+		.id_value_low = 0x3618,
+		.misc_ctl = 0x3610,
+		.sigdata0 = 0x3650,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD00,
+		.id_value_low_wr = 0xD42,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.max_misr_wr = 4,
+	.camnoc_misr_sigdata = 4,
+	.master_we_sel = 2,
+	.misr_rd_word_sel = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_DMA_580_HW_INFO_VER_4_2_0_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_680_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_680_hw_info_ver_4_2_0.h
@@ -0,0 +1,87 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_680_HW_INFO_VER_4_2_0_H
+#define CAM_JPEG_DMA_680_HW_INFO_VER_4_2_0_H
+
+#define CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE (1 << 0)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RD_BUF_DONE  (1 << 1)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_WR_BUF_DONE  (1 << 5)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT     (1 << 9)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE     (1 << 10)
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE
+#define CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE
+
+static struct cam_jpeg_dma_device_hw_info cam_jpeg_dma_680_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x14,
+		.int_status = 0x10,
+		.int_mask = 0x0C,
+		.hw_cmd = 0x1C,
+		.reset_cmd = 0x08,
+		.encode_size = 0x180,
+		.core_cfg = 0x18,
+		.misr_cfg0 = 0x160,
+		.misr_cfg1 = 0x164,
+	},
+	.debug_reg_offset = {
+		.top_offset = 0x0,
+		.top_range = 0x19,
+		.we_offset = 0xB8,
+		.we_range = 0x9,
+		.we_qos_offset = 0x144,
+		.we_qos_range = 0x1C,
+		.perf_offset = 0xFEC,
+		.perf_range = 0x5,
+		},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x32083,
+		.hw_cmd_stop = 0x00000004,
+		.misr_cfg0 = 0x506,
+	},
+	.int_status = {
+		.framedone = CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK,
+		.iserror = 0x0,
+		.stopdone = CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x4,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x8108,
+		.id_mask_low = 0x8120,
+		.id_value_low = 0x8118,
+		.misc_ctl = 0x8110,
+		.sigdata0 = 0x8150,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD00,
+		.id_value_low_wr = 0xD42,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.max_misr_wr = 4,
+	.camnoc_misr_sigdata = 4,
+	.master_we_sel = 2,
+	.misr_rd_word_sel = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_DMA_680_HW_INFO_VER_4_2_0_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_770_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_770_hw_info_ver_4_2_0.h
@@ -0,0 +1,76 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_770_HW_INFO_VER_4_2_0_H
+#define CAM_JPEG_DMA_770_HW_INFO_VER_4_2_0_H
+
+#define CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE (1 << 0)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RD_BUF_DONE  (1 << 1)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_WR_BUF_DONE  (1 << 5)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT     (1 << 9)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE     (1 << 10)
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE
+#define CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE
+
+static struct cam_jpeg_dma_device_hw_info cam_jpeg_dma_770_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x14,
+		.int_status = 0x10,
+		.int_mask = 0x0C,
+		.hw_cmd = 0x1C,
+		.reset_cmd = 0x08,
+		.encode_size = 0x180,
+		.core_cfg = 0x18,
+		.misr_cfg0 = 0x160,
+		.misr_cfg1 = 0x164,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x32083,
+		.hw_cmd_stop = 0x00000004,
+		.misr_cfg0 = 0x506,
+	},
+	.int_status = {
+		.framedone = CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK,
+		.iserror = 0x0,
+		.stopdone = CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x4,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x8108,
+		.id_mask_low = 0x8120,
+		.id_value_low = 0x8118,
+		.misc_ctl = 0x8110,
+		.sigdata0 = 0x8150,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD00,
+		.id_value_low_wr = 0xD42,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.max_misr_wr = 4,
+	.camnoc_misr_sigdata = 4,
+	.master_we_sel = 2,
+	.misr_rd_word_sel = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_DMA_770_HW_INFO_VER_4_2_0_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_780_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_780_hw_info_ver_4_2_0.h
@@ -0,0 +1,86 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_780_HW_INFO_VER_4_2_0_H
+#define CAM_JPEG_DMA_780_HW_INFO_VER_4_2_0_H
+
+#define CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE (1 << 0)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RD_BUF_DONE  (1 << 1)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_WR_BUF_DONE  (1 << 5)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT     (1 << 9)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE     (1 << 10)
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE
+#define CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE
+
+static struct cam_jpeg_dma_device_hw_info cam_jpeg_dma_780_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x14,
+		.int_status = 0x10,
+		.int_mask = 0x0C,
+		.hw_cmd = 0x1C,
+		.reset_cmd = 0x08,
+		.encode_size = 0x180,
+		.core_cfg = 0x18,
+		.misr_cfg0 = 0x160,
+		.misr_cfg1 = 0x164,
+	},
+	.debug_reg_offset = {
+		.top_offset = 0x0,
+		.top_range = 0x19,
+		.we_offset = 0xB8,
+		.we_range = 0x9,
+		.we_qos_offset = 0x144,
+		.we_qos_range = 0x1C,
+		.perf_offset = 0xFEC,
+		.perf_range = 0x5,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x32083,
+		.hw_cmd_stop = 0x00000004,
+		.misr_cfg0 = 0x506,
+	},
+	.int_status = {
+		.framedone = CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK,
+		.iserror = 0x0,
+		.stopdone = CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x4,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x2C88,
+		.id_mask_low = 0x2CA0,
+		.id_value_low = 0x2C98,
+		.misc_ctl = 0x2C90,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x3,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD00,
+		.id_value_low_wr = 0xD42,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.max_misr_wr = 4,
+	.camnoc_misr_sigdata = 0,
+	.master_we_sel = 2,
+	.misr_rd_word_sel = 4,
+	.camnoc_misr_support = 0,
+};
+
+#endif /* CAM_JPEG_DMA_780_HW_INFO_VER_4_2_0_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_hw_info_ver_4_2_0.h
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_HW_INFO_VER_4_2_0_H
+#define CAM_JPEG_DMA_HW_INFO_VER_4_2_0_H
+
+#define CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE (1 << 0)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RD_BUF_DONE  (1 << 1)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_WR_BUF_DONE  (1 << 5)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT     (1 << 9)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE     (1 << 10)
+
+#define CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE
+#define CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE
+
+static struct cam_jpeg_dma_device_hw_info cam_jpeg_dma_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x14,
+		.int_status = 0x10,
+		.int_mask = 0x0C,
+		.hw_cmd = 0x1C,
+		.reset_cmd = 0x08,
+		.encode_size = 0x180,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x32083,
+		.hw_cmd_stop = 0x00000004,
+	},
+	.int_status = {
+		.framedone = CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK,
+		.iserror = 0x0,
+		.stopdone = CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT,
+	},
+	.camnoc_misr_support = 0,
+};
+
+#endif /* CAM_JPEG_DMA_HW_INFO_VER_4_2_0_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.c
@@ -0,0 +1,816 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "jpeg_dma_core.h"
+#include "jpeg_dma_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_jpeg_hw_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+
+#define CAM_JPEG_HW_IRQ_IS_FRAME_DONE(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.framedone)
+#define CAM_JPEG_HW_IRQ_IS_RESET_ACK(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.resetdone)
+#define CAM_JPEG_HW_IRQ_IS_STOP_DONE(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.stopdone)
+
+#define CAM_JPEG_DMA_RESET_TIMEOUT msecs_to_jiffies(500)
+
+int cam_jpeg_dma_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	int rc;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+
+	if (!soc_info || !core_info) {
+		CAM_ERR(CAM_JPEG, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	mutex_lock(&core_info->core_mutex);
+	if (++core_info->ref_count > 1) {
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = JPEG_VOTE;
+	axi_vote.axi_path[0].mnoc_ab_bw = JPEG_VOTE;
+	axi_vote.axi_path[0].mnoc_ib_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].mnoc_ab_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].mnoc_ib_bw = JPEG_VOTE;
+
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "cpass start failed: %d", rc);
+		goto cpas_failed;
+	}
+
+	rc = cam_jpeg_dma_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "soc enable is failed %d", rc);
+		goto soc_failed;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+
+	return 0;
+
+soc_failed:
+	cam_cpas_stop(core_info->cpas_handle);
+cpas_failed:
+	--core_info->ref_count;
+	mutex_unlock(&core_info->core_mutex);
+
+	return rc;
+}
+
+int cam_jpeg_dma_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	int rc;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	if (!soc_info || !core_info) {
+		CAM_ERR(CAM_JPEG, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	mutex_lock(&core_info->core_mutex);
+	if (--core_info->ref_count > 0) {
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	if (core_info->ref_count < 0) {
+		CAM_ERR(CAM_JPEG, "ref cnt %d", core_info->ref_count);
+		core_info->ref_count = 0;
+		mutex_unlock(&core_info->core_mutex);
+		return -EFAULT;
+	}
+
+	rc = cam_jpeg_dma_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "soc disable failed %d", rc);
+
+	rc = cam_cpas_stop(core_info->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "cpas stop failed: %d", rc);
+
+	mutex_unlock(&core_info->core_mutex);
+
+	return 0;
+}
+
+irqreturn_t cam_jpeg_dma_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *jpeg_dma_dev = data;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	uint32_t irq_status = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return IRQ_HANDLED;
+	}
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	hw_info = core_info->jpeg_dma_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	irq_status = cam_io_r_mb(mem_base +
+		core_info->jpeg_dma_hw_info->reg_offset.int_status);
+	cam_io_w_mb(irq_status,
+		soc_info->reg_map[0].mem_base +
+		core_info->jpeg_dma_hw_info->reg_offset.int_clr);
+	CAM_DBG(CAM_JPEG, "irq_num: %d  irq_status: 0x%x , core_state: %d",
+		irq_num, irq_status, core_info->core_state);
+	if (CAM_JPEG_HW_IRQ_IS_FRAME_DONE(irq_status, hw_info)) {
+		spin_lock(&jpeg_dma_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_DMA_CORE_READY) {
+			CAM_TRACE(CAM_JPEG, "DMA FrameDone IRQ");
+			CAM_DBG(CAM_JPEG, "frane_done");
+			core_info->core_state = CAM_JPEG_DMA_CORE_RESETTING_ON_DONE;
+			cam_io_w_mb(hw_info->reg_val.reset_cmd,
+				mem_base + hw_info->reg_offset.reset_cmd);
+		} else {
+			CAM_WARN(CAM_JPEG, "unexpected frame done ");
+			core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+		}
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+	}
+
+	if (CAM_JPEG_HW_IRQ_IS_RESET_ACK(irq_status, hw_info)) {
+		spin_lock(&jpeg_dma_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_DMA_CORE_RESETTING) {
+			core_info->core_state = CAM_JPEG_DMA_CORE_READY;
+			complete(&jpeg_dma_dev->hw_complete);
+			CAM_DBG(CAM_JPEG, "JPEG DMA %s reset done",
+				jpeg_dma_dev->soc_info.dev_name);
+		} else if (core_info->core_state == CAM_JPEG_DMA_CORE_RESETTING_ON_DONE) {
+			if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+				core_info->irq_cb.jpeg_hw_mgr_cb(irq_status, 1,
+					(void *)&core_info->irq_cb.irq_cb_data);
+			} else {
+				CAM_WARN(CAM_JPEG, "unexpected frame done");
+			}
+			core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected reset irq");
+		}
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+	}
+
+	if (CAM_JPEG_HW_IRQ_IS_STOP_DONE(irq_status, hw_info)) {
+		spin_lock(&jpeg_dma_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_DMA_CORE_ABORTING) {
+			core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+			complete(&jpeg_dma_dev->hw_complete);
+			if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+				core_info->irq_cb.jpeg_hw_mgr_cb(irq_status, 0,
+					(void *)&core_info->irq_cb.irq_cb_data);
+			}
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected abort irq");
+		}
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+	}
+
+	return IRQ_HANDLED;
+}
+
+int cam_jpeg_dma_reset_hw(void *data,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = data;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long rem_jiffies;
+	int rc = 0;
+
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	/* maskdisable.clrirq.maskenable.resetcmd */
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	hw_info = core_info->jpeg_dma_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	mutex_lock(&core_info->core_mutex);
+	spin_lock(&jpeg_dma_dev->hw_lock);
+	if (core_info->core_state == CAM_JPEG_DMA_CORE_RESETTING) {
+		CAM_ERR(CAM_JPEG, "dma alrady resetting");
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	reinit_completion(&jpeg_dma_dev->hw_complete);
+
+	core_info->core_state = CAM_JPEG_DMA_CORE_RESETTING;
+	spin_unlock(&jpeg_dma_dev->hw_lock);
+
+	cam_io_w_mb(hw_info->reg_val.int_mask_disable_all,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.int_clr_clearall,
+		mem_base + hw_info->reg_offset.int_clr);
+	cam_io_w_mb(hw_info->reg_val.int_mask_enable_all,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.reset_cmd,
+		mem_base + hw_info->reg_offset.reset_cmd);
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(
+			&jpeg_dma_dev->hw_complete,
+			CAM_JPEG_DMA_RESET_TIMEOUT);
+	if (!rem_jiffies) {
+		CAM_ERR(CAM_JPEG, "dma error Reset Timeout");
+		core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+		rc = -ETIMEDOUT;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	return rc;
+}
+
+int cam_jpeg_dma_test_irq_line(void *data)
+{
+	struct cam_hw_info *jpeg_dma_dev = data;
+	int rc;
+
+	if (!data) {
+		CAM_ERR(CAM_JPEG, "invalid args");
+		return -EINVAL;
+	}
+
+	rc = cam_jpeg_dma_init_hw(data, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "failed to init hw (rc=%d)", rc);
+		return rc;
+	}
+
+	rc = cam_jpeg_dma_reset_hw(data, NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to trigger reset irq (rc=%d)", rc);
+	else
+		CAM_INFO(CAM_JPEG, "verified JPEG DMA (%s) IRQ line",
+			jpeg_dma_dev->soc_info.dev_name);
+
+	rc = cam_jpeg_dma_deinit_hw(data, NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to de-init hw (rc=%d)", rc);
+
+	return 0;
+}
+
+int cam_jpeg_dma_start_hw(void *data,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = data;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	hw_info = core_info->jpeg_dma_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	if (core_info->core_state != CAM_JPEG_DMA_CORE_READY) {
+		CAM_ERR(CAM_JPEG, "Error not ready");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_JPEG, "Starting DMA");
+	cam_io_w_mb(0x00000601,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.hw_cmd_start,
+		mem_base + hw_info->reg_offset.hw_cmd);
+
+	return 0;
+}
+
+int cam_jpeg_dma_stop_hw(void *data,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = data;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long rem_jiffies;
+
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	hw_info = core_info->jpeg_dma_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	mutex_lock(&core_info->core_mutex);
+	spin_lock(&jpeg_dma_dev->hw_lock);
+	if (core_info->core_state == CAM_JPEG_DMA_CORE_ABORTING) {
+		CAM_ERR(CAM_JPEG, "alrady stopping");
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	reinit_completion(&jpeg_dma_dev->hw_complete);
+	core_info->core_state = CAM_JPEG_DMA_CORE_ABORTING;
+	spin_unlock(&jpeg_dma_dev->hw_lock);
+
+	cam_io_w_mb(hw_info->reg_val.hw_cmd_stop,
+		mem_base + hw_info->reg_offset.hw_cmd);
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(
+			&jpeg_dma_dev->hw_complete,
+			CAM_JPEG_DMA_RESET_TIMEOUT);
+	if (!rem_jiffies) {
+		CAM_ERR(CAM_JPEG, "error Reset Timeout");
+		core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	return 0;
+}
+
+static int  cam_jpeg_dma_mini_dump(struct cam_hw_info *dev, void *args) {
+
+	struct cam_jpeg_mini_dump_core_info *md;
+	struct cam_jpeg_dma_device_hw_info   *hw_info;
+	struct cam_jpeg_dma_device_core_info *core_info;
+
+	if (!dev || !args) {
+		CAM_ERR(CAM_JPEG, "Invalid params dev %pK args %pK", dev, args);
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_jpeg_dma_device_core_info *)dev->core_info;
+	hw_info = core_info->jpeg_dma_hw_info;
+	md = (struct cam_jpeg_mini_dump_core_info *)args;
+
+	md->framedone = hw_info->int_status.framedone;
+	md->resetdone = hw_info->int_status.resetdone;
+	md->iserror = hw_info->int_status.iserror;
+	md->stopdone = hw_info->int_status.stopdone;
+	md->open_count = dev->open_count;
+	md->hw_state = dev->hw_state;
+	md->ref_count = core_info->ref_count;
+	md->core_state = core_info->core_state;
+	return 0;
+}
+
+int cam_jpeg_dma_dump_camnoc_misr_val(struct cam_jpeg_dma_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *dma_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	struct cam_jpeg_misr_dump_args       *pmisr_args;
+	int32_t camnoc_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{0}};
+	int i, rc = 0;
+	int32_t val;
+	uint32_t index = 0;
+	bool mismatch = false;
+
+	dma_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	pmisr_args = (struct cam_jpeg_misr_dump_args *)cmd_args;
+	if (!pmisr_args) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+	val = cam_io_r_mb(dma_mem_base + hw_info->reg_offset.core_cfg);
+	index = (val >> hw_info->int_status.scale_enable_shift) &
+		hw_info->int_status.scale_enable;
+	CAM_DBG(CAM_JPEG, "index %d", index);
+
+	for (i = 0; i < hw_info->camnoc_misr_sigdata; i++) {
+		camnoc_misr_val[index][i] = cam_io_r_mb(camnoc_mem_base +
+			hw_info->camnoc_misr_reg_offset.sigdata0 + (i * 8));
+		if (hw_info->prev_camnoc_misr_val[index][i] !=
+			camnoc_misr_val[index][i])
+			mismatch = true;
+	}
+	if (mismatch && (pmisr_args->req_id != 1)) {
+		CAM_ERR(CAM_JPEG,
+			"CAMNOC DMA_MISR MISMATCH [req:%d][i:%d][index:%d]\n"
+			"curr:0x%x %x %x %x prev:0x%x %x %x %x isbug:%d",
+			pmisr_args->req_id, i, index,
+			camnoc_misr_val[index][3], camnoc_misr_val[index][2],
+			camnoc_misr_val[index][1], camnoc_misr_val[index][0],
+			hw_info->prev_camnoc_misr_val[index][3],
+			hw_info->prev_camnoc_misr_val[index][2],
+			hw_info->prev_camnoc_misr_val[index][1],
+			hw_info->prev_camnoc_misr_val[index][0],
+			pmisr_args->enable_bug);
+		if (pmisr_args->enable_bug)
+			BUG_ON(1);
+	}
+	CAM_DBG(CAM_JPEG,
+		"CAMNOC DMA_MISR req:%d SigData:0x %x %x %x %x",
+		pmisr_args->req_id,
+		camnoc_misr_val[index][3], camnoc_misr_val[index][2],
+		camnoc_misr_val[index][1], camnoc_misr_val[index][0]);
+	for (i = 0; i < hw_info->camnoc_misr_sigdata; i++)
+		hw_info->prev_camnoc_misr_val[index][i] =
+			camnoc_misr_val[index][i];
+	/* stop misr : cam_noc_cam_noc_0_req_link_misrprb_MiscCtl_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.misc_ctl_stop,
+		camnoc_mem_base + hw_info->camnoc_misr_reg_offset.misc_ctl);
+
+	return rc;
+}
+
+int cam_jpeg_dma_dump_hw_misr_val(struct cam_jpeg_dma_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *dma_mem_base = NULL;
+	struct cam_jpeg_misr_dump_args       *pmisr_args;
+	int32_t dma_wr_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{0}};
+	int32_t dma_rd_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{0}};
+	int offset, i, rc = 0;
+	int32_t val;
+	uint32_t index = 0;
+	bool mismatch = false;
+
+	dma_mem_base = soc_info->reg_map[0].mem_base;
+	pmisr_args = (struct cam_jpeg_misr_dump_args *)cmd_args;
+	if (!pmisr_args) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+	val = cam_io_r_mb(dma_mem_base + hw_info->reg_offset.core_cfg);
+	index = (val >> hw_info->int_status.scale_enable_shift) &
+		hw_info->int_status.scale_enable;
+	CAM_DBG(CAM_JPEG, "index %d", index);
+
+	/* After the session is complete, read back the MISR values.
+	 * fetch engine MISR values
+	 */
+	offset = hw_info->reg_offset.misr_cfg1;
+	for (i = 0; i < hw_info->max_misr_rd; i++) {
+		val = i << hw_info->misr_rd_word_sel;
+		cam_io_w_mb(val, dma_mem_base + offset);
+		dma_rd_misr_val[index][i] = cam_io_r_mb(dma_mem_base +
+			offset + 0x4);
+		if (hw_info->prev_dma_rd_misr_val[index][i] != dma_rd_misr_val[index][i])
+			mismatch = true;
+	}
+	if (mismatch && (pmisr_args->req_id != 1)) {
+		CAM_ERR(CAM_JPEG,
+			"CAMNOC DMA_RD_MISR MISMATCH [req:%d][index:%d][i:%d]\n"
+			"curr:0x%x %x %x %x prev:0x%x %x %x %x isbug:%d",
+			pmisr_args->req_id, index, i,
+			dma_rd_misr_val[index][3], dma_rd_misr_val[index][2],
+			dma_rd_misr_val[index][1], dma_rd_misr_val[index][0],
+			hw_info->prev_dma_rd_misr_val[index][3],
+			hw_info->prev_dma_rd_misr_val[index][2],
+			hw_info->prev_dma_rd_misr_val[index][1],
+			hw_info->prev_dma_rd_misr_val[index][0],
+			pmisr_args->enable_bug);
+		if (pmisr_args->enable_bug)
+			BUG_ON(1);
+	}
+
+	CAM_DBG(CAM_JPEG,
+		"CORE JPEG DMA RD MISR: 0x%x %x %x %x",
+		dma_rd_misr_val[index][3], dma_rd_misr_val[index][2],
+		dma_rd_misr_val[index][1], dma_rd_misr_val[index][0]);
+
+	mismatch = false;
+	for (i = 0; i < hw_info->max_misr_rd; i++) {
+		hw_info->prev_dma_rd_misr_val[index][i] =
+			dma_rd_misr_val[index][i];
+	}
+
+	/* write engine MISR values */
+	for (i = 0; i < hw_info->max_misr_wr; i++) {
+		val = hw_info->master_we_sel | (i << hw_info->misr_rd_word_sel);
+		cam_io_w_mb(val, dma_mem_base + offset);
+		dma_wr_misr_val[index][i] = cam_io_r_mb(dma_mem_base +
+			offset + 0x4);
+		if (hw_info->prev_dma_wr_misr_val[index][i] !=
+			dma_wr_misr_val[index][i])
+			mismatch = true;
+	}
+	if (mismatch && (pmisr_args->req_id != 1)) {
+		CAM_ERR(CAM_JPEG,
+			"CAMNOC DMA_WR_MISR MISMATCH [req:%d][index:%d][i:%d]\n"
+			"curr:0x%x %x %x %x prev:0x%x %x %x %x isbug:%d",
+			pmisr_args->req_id, index, i,
+			dma_wr_misr_val[index][3], dma_wr_misr_val[index][2],
+			dma_wr_misr_val[index][1], dma_wr_misr_val[index][0],
+			hw_info->prev_dma_wr_misr_val[index][3],
+			hw_info->prev_dma_wr_misr_val[index][2],
+			hw_info->prev_dma_wr_misr_val[index][1],
+			hw_info->prev_dma_wr_misr_val[index][0],
+			pmisr_args->enable_bug);
+		if (pmisr_args->enable_bug)
+			BUG_ON(1);
+	}
+	CAM_DBG(CAM_JPEG,
+		"CORE JPEG DMA WR MISR: 0x%x %x %x %x",
+		dma_wr_misr_val[index][3], dma_wr_misr_val[index][2],
+		dma_wr_misr_val[index][1], dma_wr_misr_val[index][0]);
+
+	for (i = 0; i < hw_info->max_misr_wr; i++) {
+		hw_info->prev_dma_wr_misr_val[index][i] =
+			dma_wr_misr_val[index][i];
+	}
+
+	return rc;
+}
+
+int cam_jpeg_dma_config_cmanoc_hw_misr(struct cam_jpeg_dma_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *dma_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	uint32_t                             *camnoc_misr_test = NULL;
+	int val = 0;
+
+	dma_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	if (!camnoc_mem_base) {
+		CAM_ERR(CAM_JPEG, "Invalid camnoc base address");
+		return -EINVAL;
+	}
+	camnoc_misr_test = (uint32_t *)cmd_args;
+	if (!camnoc_misr_test) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+	/* enable FE and WE with sample data mode */
+	cam_io_w_mb(hw_info->reg_val.misr_cfg0, dma_mem_base +
+		hw_info->reg_offset.misr_cfg0);
+
+	/* cam_noc_cam_noc_0_req_link_misrprb_MainCtl_Low
+	 * enable CRC generation on both RD, WR and transaction payload
+	 */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.main_ctl, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.main_ctl);
+	/* cam_noc_cam_noc_0_req_link_misrprb_IdMask_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.main_ctl, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.id_mask_low);
+	/* cam_noc_cam_noc_0_req_link_misrprb_IdValue_Low */
+	switch (*camnoc_misr_test) {
+	case CAM_JPEG_MISR_ID_LOW_RD:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_rd;
+		break;
+	case CAM_JPEG_MISR_ID_LOW_WR:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_wr;
+		break;
+	default:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_rd;
+		break;
+	}
+	cam_io_w_mb(val, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.id_value_low);
+	/* start/reset misr : cam_noc_cam_noc_0_req_link_misrprb_MiscCtl_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.misc_ctl_start,
+		camnoc_mem_base + hw_info->camnoc_misr_reg_offset.misc_ctl);
+	CAM_DBG(CAM_JPEG, "DMA CAMNOC and HW MISR configured");
+
+	return 0;
+}
+
+int cam_jpeg_dma_dump_debug_regs(struct cam_hw_info *jpeg_dma_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)jpeg_dma_dev->core_info;
+
+	CAM_INFO(CAM_JPEG, "************ JPEG DMA REGISTER DUMP ************");
+
+	/* JPEG DMA TOP, Interrupt, core config, command registers & Fetch Engine Registers */
+	cam_soc_util_reg_dump(soc_info, CAM_JPEG_MEM_BASE_INDEX,
+		core_info->jpeg_dma_hw_info->debug_reg_offset.top_offset,
+		core_info->jpeg_dma_hw_info->debug_reg_offset.top_range);
+
+	/* Write Engine */
+	cam_soc_util_reg_dump(soc_info, CAM_JPEG_MEM_BASE_INDEX,
+		core_info->jpeg_dma_hw_info->debug_reg_offset.we_offset,
+		core_info->jpeg_dma_hw_info->debug_reg_offset.we_range);
+
+	/*
+	 * WE qos cfg, test bus and debug regs, spare regs, bus misr, scale reg, core status regs
+	 *	 & MMU prefetch regs
+	 */
+	cam_soc_util_reg_dump(soc_info, CAM_JPEG_MEM_BASE_INDEX,
+		core_info->jpeg_dma_hw_info->debug_reg_offset.we_qos_offset,
+		core_info->jpeg_dma_hw_info->debug_reg_offset.we_qos_range);
+
+	/* Perf Registers */
+	cam_soc_util_reg_dump(soc_info, CAM_JPEG_MEM_BASE_INDEX,
+		core_info->jpeg_dma_hw_info->debug_reg_offset.perf_offset,
+		core_info->jpeg_dma_hw_info->debug_reg_offset.perf_range);
+
+	return 0;
+}
+
+int cam_jpeg_dma_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = device_priv;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_jpeg_dma_device_hw_info   *hw_info = NULL;
+	struct cam_jpeg_match_pid_args       *match_pid_mid = NULL;
+	uint32_t                             *num_pid = NULL;
+	struct cam_hw_soc_info               *soc_info = NULL;
+	int i, rc = 0;
+	unsigned long flags = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_JPEG_CMD_MAX) {
+		CAM_ERR(CAM_JPEG, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+
+	hw_info = core_info->jpeg_dma_hw_info;
+	soc_info = &jpeg_dma_dev->soc_info;
+
+
+	switch (cmd_type) {
+	case CAM_JPEG_CMD_SET_IRQ_CB:
+	{
+		struct cam_jpeg_set_irq_cb *irq_cb = cmd_args;
+		struct cam_jpeg_irq_cb_data *irq_cb_data;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		irq_cb_data = &irq_cb->irq_cb_data;
+		spin_lock_irqsave(&jpeg_dma_dev->hw_lock, flags);
+		if (irq_cb->b_set_cb) {
+			core_info->irq_cb.jpeg_hw_mgr_cb =
+				irq_cb->jpeg_hw_mgr_cb;
+			core_info->irq_cb.irq_cb_data.jpeg_req = irq_cb_data->jpeg_req;
+			core_info->irq_cb.irq_cb_data.private_data = irq_cb_data->private_data;
+		} else {
+			core_info->irq_cb.jpeg_hw_mgr_cb = NULL;
+			core_info->irq_cb.irq_cb_data.jpeg_req = NULL;
+			core_info->irq_cb.irq_cb_data.private_data = NULL;
+		}
+		spin_unlock_irqrestore(&jpeg_dma_dev->hw_lock, flags);
+		rc = 0;
+		break;
+	}
+	case CAM_JPEG_CMD_GET_NUM_PID:
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		num_pid = (uint32_t    *)cmd_args;
+		*num_pid = core_info->num_pid;
+
+		break;
+	case CAM_JPEG_CMD_MATCH_PID_MID:
+		match_pid_mid = (struct cam_jpeg_match_pid_args *)cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		for (i = 0; i < core_info->num_pid; i++) {
+			if (core_info->pid[i] == match_pid_mid->pid)
+				break;
+		}
+
+		if (i == core_info->num_pid)
+			match_pid_mid->pid_match_found = false;
+		else
+			match_pid_mid->pid_match_found = true;
+
+		if (match_pid_mid->pid_match_found) {
+			if (match_pid_mid->fault_mid == core_info->rd_mid) {
+				match_pid_mid->match_res =
+					CAM_JPEG_DMA_INPUT_IMAGE;
+			} else if (match_pid_mid->fault_mid ==
+				core_info->wr_mid) {
+				match_pid_mid->match_res =
+					CAM_JPEG_DMA_OUTPUT_IMAGE;
+			} else
+				match_pid_mid->pid_match_found = false;
+		}
+
+		break;
+	case CAM_JPEG_CMD_MINI_DUMP:
+		rc = cam_jpeg_dma_mini_dump(jpeg_dma_dev, cmd_args);
+		break;
+	case CAM_JPEG_CMD_CONFIG_HW_MISR:
+	{
+		if (hw_info->camnoc_misr_support)
+			rc = cam_jpeg_dma_config_cmanoc_hw_misr(hw_info, soc_info, cmd_args);
+		else
+			CAM_DBG(CAM_JPEG, "camnoc misr is not supported");
+		break;
+	}
+	case CAM_JPEG_CMD_DUMP_HW_MISR_VAL:
+	{
+		if (hw_info->camnoc_misr_support) {
+			rc = cam_jpeg_dma_dump_hw_misr_val(hw_info, soc_info, cmd_args);
+			if (rc)
+				break;
+			rc = cam_jpeg_dma_dump_camnoc_misr_val(hw_info, soc_info, cmd_args);
+		} else {
+			CAM_DBG(CAM_JPEG, "camnoc misr is not supported");
+		}
+		break;
+	}
+	case CAM_JPEG_CMD_DUMP_DEBUG_REGS:
+		rc = cam_jpeg_dma_dump_debug_regs(jpeg_dma_dev);
+		break;
+	default:
+		rc = -EINVAL;
+		break;
+	}
+	if (rc)
+		CAM_ERR(CAM_JPEG, "error cmdtype %d rc = %d", cmd_type, rc);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.h
@@ -0,0 +1,147 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_CORE_H
+#define CAM_JPEG_DMA_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/dma-buf.h>
+
+#include "cam_jpeg_hw_intf.h"
+
+struct cam_jpeg_dma_reg_offsets {
+	uint32_t hw_version;
+	uint32_t int_status;
+	uint32_t int_clr;
+	uint32_t int_mask;
+	uint32_t hw_cmd;
+	uint32_t reset_cmd;
+	uint32_t encode_size;
+	uint32_t core_cfg;
+	uint32_t misr_cfg0;
+	uint32_t misr_cfg1;
+};
+
+struct cam_jpeg_dma_regval {
+	uint32_t int_clr_clearall;
+	uint32_t int_mask_disable_all;
+	uint32_t int_mask_enable_all;
+	uint32_t hw_cmd_start;
+	uint32_t reset_cmd;
+	uint32_t hw_cmd_stop;
+	uint32_t misr_cfg0;
+};
+
+struct cam_jpeg_dma_int_status {
+	uint32_t framedone;
+	uint32_t resetdone;
+	uint32_t iserror;
+	uint32_t stopdone;
+	uint32_t scale_enable;
+	uint32_t scale_enable_shift;
+};
+
+struct cam_jpeg_dma_camnoc_misr_reg_offset {
+	uint32_t main_ctl;
+	uint32_t id_mask_low;
+	uint32_t id_value_low;
+	uint32_t misc_ctl;
+	uint32_t sigdata0;
+};
+
+struct cam_jpeg_dma_camnoc_misr_reg_val {
+	uint32_t main_ctl;
+	uint32_t id_mask_low;
+	uint32_t id_value_low_rd;
+	uint32_t id_value_low_wr;
+	uint32_t misc_ctl_start;
+	uint32_t misc_ctl_stop;
+};
+
+struct cam_jpeg_dma_debug_regs_offset {
+	uint32_t top_offset;
+	uint32_t top_range;
+	uint32_t we_offset;
+	uint32_t we_range;
+	uint32_t we_qos_offset;
+	uint32_t we_qos_range;
+	uint32_t perf_offset;
+	uint32_t perf_range;
+};
+
+struct cam_jpeg_dma_device_hw_info {
+	struct cam_jpeg_dma_reg_offsets reg_offset;
+	struct cam_jpeg_dma_regval reg_val;
+	struct cam_jpeg_dma_debug_regs_offset debug_reg_offset;
+	struct cam_jpeg_dma_int_status int_status;
+	struct cam_jpeg_dma_camnoc_misr_reg_offset camnoc_misr_reg_offset;
+	struct cam_jpeg_dma_camnoc_misr_reg_val camnoc_misr_reg_val;
+	uint32_t max_misr;
+	uint32_t max_misr_rd;
+	uint32_t max_misr_wr;
+	uint32_t camnoc_misr_sigdata;
+	uint32_t master_we_sel;
+	uint32_t misr_rd_word_sel;
+	uint32_t camnoc_misr_support;
+	int32_t prev_dma_wr_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL];
+	int32_t prev_dma_rd_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL];
+	int32_t prev_camnoc_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL];
+};
+
+enum cam_jpeg_dma_core_state {
+	CAM_JPEG_DMA_CORE_NOT_READY,
+	CAM_JPEG_DMA_CORE_READY,
+	CAM_JPEG_DMA_CORE_RESETTING,
+	CAM_JPEG_DMA_CORE_ABORTING,
+	CAM_JPEG_DMA_CORE_RESETTING_ON_DONE,
+	CAM_JPEG_DMA_CORE_STATE_MAX,
+};
+
+struct cam_jpeg_dma_device_core_info {
+	enum cam_jpeg_dma_core_state core_state;
+	struct cam_jpeg_dma_device_hw_info *jpeg_dma_hw_info;
+	uint32_t cpas_handle;
+	struct cam_jpeg_set_irq_cb irq_cb;
+	int32_t ref_count;
+	struct mutex core_mutex;
+	uint32_t num_pid;
+	uint32_t pid[CAM_JPEG_HW_MAX_NUM_PID];
+	uint32_t rd_mid;
+	uint32_t wr_mid;
+};
+
+int cam_jpeg_dma_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_start_hw(void *device_priv,
+	void *start_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_stop_hw(void *device_priv,
+	void *stop_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_reset_hw(void *device_priv,
+	void *reset_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+int cam_jpeg_dma_test_irq_line(void *data);
+irqreturn_t cam_jpeg_dma_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register JPEG DMA hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_jpeg_dma_init_module(void);
+
+/**
+ * @brief : API to remove JPEG DMA Hw from platform framework.
+ */
+void cam_jpeg_dma_exit_module(void);
+#endif /* CAM_JPEG_DMA_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.c
@@ -0,0 +1,295 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+
+#include "jpeg_dma_core.h"
+#include "jpeg_dma_soc.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_jpeg_hw_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_jpeg_dma_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_dma_165_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_dma_580_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_dma_680_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_dma_780_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_dma_770_hw_info_ver_4_2_0.h"
+#include "camera_main.h"
+
+static int cam_jpeg_dma_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_jpeg_dma_device_core_info *core_info,
+	uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = soc_info->dev;
+	memcpy(cpas_register_params.identifier, "jpeg-dma",
+		sizeof("jpeg-dma"));
+	cpas_register_params.cam_cpas_client_cb = NULL;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "cpas_register failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_jpeg_dma_unregister_cpas(
+	struct cam_jpeg_dma_device_core_info *core_info)
+{
+	int rc;
+
+	rc = cam_cpas_unregister_client(core_info->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "cpas unregister failed: %d", rc);
+	core_info->cpas_handle = 0;
+
+	return rc;
+}
+
+static int cam_jpeg_dma_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *jpeg_dma_dev = NULL;
+	struct cam_hw_intf *jpeg_dma_dev_intf = NULL;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	struct cam_jpeg_dma_soc_private  *soc_private;
+	int i, rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	jpeg_dma_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!jpeg_dma_dev_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &jpeg_dma_dev_intf->hw_idx);
+
+	jpeg_dma_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!jpeg_dma_dev) {
+		rc = -ENOMEM;
+		goto error_alloc_dev;
+	}
+	jpeg_dma_dev->soc_info.pdev = pdev;
+	jpeg_dma_dev->soc_info.dev = &pdev->dev;
+	jpeg_dma_dev->soc_info.dev_name = pdev->name;
+	jpeg_dma_dev_intf->hw_priv = jpeg_dma_dev;
+	jpeg_dma_dev_intf->hw_ops.init = cam_jpeg_dma_init_hw;
+	jpeg_dma_dev_intf->hw_ops.deinit = cam_jpeg_dma_deinit_hw;
+	jpeg_dma_dev_intf->hw_ops.start = cam_jpeg_dma_start_hw;
+	jpeg_dma_dev_intf->hw_ops.stop = cam_jpeg_dma_stop_hw;
+	jpeg_dma_dev_intf->hw_ops.reset = cam_jpeg_dma_reset_hw;
+	jpeg_dma_dev_intf->hw_ops.process_cmd = cam_jpeg_dma_process_cmd;
+	jpeg_dma_dev_intf->hw_ops.test_irq_line = cam_jpeg_dma_test_irq_line;
+	jpeg_dma_dev_intf->hw_type = CAM_JPEG_DEV_DMA;
+
+	platform_set_drvdata(pdev, jpeg_dma_dev_intf);
+	jpeg_dma_dev->core_info =
+		kzalloc(sizeof(struct cam_jpeg_dma_device_core_info),
+			GFP_KERNEL);
+	if (!jpeg_dma_dev->core_info) {
+		rc = -ENOMEM;
+		goto error_alloc_core;
+	}
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_JPEG, " No jpeg_dma hardware info");
+		rc = -EINVAL;
+		goto error_match_dev;
+	}
+	hw_info = (struct cam_jpeg_dma_device_hw_info *)match_dev->data;
+	core_info->jpeg_dma_hw_info = hw_info;
+	core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+	mutex_init(&core_info->core_mutex);
+
+	rc = cam_jpeg_dma_init_soc_resources(&jpeg_dma_dev->soc_info,
+		cam_jpeg_dma_irq,
+		jpeg_dma_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "failed to init_soc %d", rc);
+		goto error_init_soc;
+	}
+
+	rc = cam_jpeg_dma_register_cpas(&jpeg_dma_dev->soc_info,
+		core_info, jpeg_dma_dev_intf->hw_idx);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, " failed to reg cpas %d", rc);
+		goto error_reg_cpas;
+	}
+	jpeg_dma_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&jpeg_dma_dev->hw_mutex);
+	spin_lock_init(&jpeg_dma_dev->hw_lock);
+	init_completion(&jpeg_dma_dev->hw_complete);
+	CAM_DBG(CAM_JPEG, "JPEG-DMA component bound successfully");
+
+	soc_private = (struct cam_jpeg_dma_soc_private  *)
+		jpeg_dma_dev->soc_info.soc_private;
+
+	core_info->num_pid = soc_private->num_pid;
+	for (i = 0; i < soc_private->num_pid; i++)
+		core_info->pid[i] = soc_private->pid[i];
+
+	core_info->rd_mid = soc_private->rd_mid;
+	core_info->wr_mid = soc_private->wr_mid;
+
+	return rc;
+
+error_reg_cpas:
+	cam_soc_util_release_platform_resource(&jpeg_dma_dev->soc_info);
+error_init_soc:
+	mutex_destroy(&core_info->core_mutex);
+error_match_dev:
+	kfree(jpeg_dma_dev->core_info);
+error_alloc_core:
+	kfree(jpeg_dma_dev);
+error_alloc_dev:
+	kfree(jpeg_dma_dev_intf);
+
+	return rc;
+}
+
+static void cam_jpeg_dma_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *jpeg_dma_dev = NULL;
+	struct cam_hw_intf *jpeg_dma_dev_intf = NULL;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	int rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	jpeg_dma_dev_intf = platform_get_drvdata(pdev);
+	if (!jpeg_dma_dev_intf) {
+		CAM_ERR(CAM_JPEG, "error No data in pdev");
+		return;
+	}
+
+	jpeg_dma_dev = jpeg_dma_dev_intf->hw_priv;
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "error HW data is NULL");
+		goto free_jpeg_hw_intf;
+	}
+
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_JPEG, "error core data NULL");
+		goto deinit_soc;
+	}
+
+	rc = cam_jpeg_dma_unregister_cpas(core_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, " unreg failed to reg cpas %d", rc);
+
+	mutex_destroy(&core_info->core_mutex);
+	kfree(core_info);
+
+deinit_soc:
+	rc = cam_soc_util_release_platform_resource(&jpeg_dma_dev->soc_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&jpeg_dma_dev->hw_mutex);
+	kfree(jpeg_dma_dev);
+
+free_jpeg_hw_intf:
+	kfree(jpeg_dma_dev_intf);
+}
+
+const static struct component_ops cam_jpeg_dma_component_ops = {
+	.bind = cam_jpeg_dma_component_bind,
+	.unbind = cam_jpeg_dma_component_unbind,
+};
+
+static int cam_jpeg_dma_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_jpeg_dma_component_ops);
+	return 0;
+}
+
+static int cam_jpeg_dma_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_JPEG, "Adding JPEG dma component");
+	rc = component_add(&pdev->dev, &cam_jpeg_dma_component_ops);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static const struct of_device_id cam_jpeg_dma_dt_match[] = {
+	{
+		.compatible = "qcom,cam_jpeg_dma",
+		.data = &cam_jpeg_dma_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_dma_165",
+		.data = &cam_jpeg_dma_165_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_dma_580",
+		.data = &cam_jpeg_dma_580_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_dma_680",
+		.data = &cam_jpeg_dma_680_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_dma_780",
+		.data = &cam_jpeg_dma_780_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_dma_770",
+		.data = &cam_jpeg_dma_770_hw_info,
+
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_jpeg_dma_dt_match);
+
+struct platform_driver cam_jpeg_dma_driver = {
+	.probe = cam_jpeg_dma_probe,
+	.remove = cam_jpeg_dma_remove,
+	.driver = {
+		.name = "cam-jpeg-dma",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_jpeg_dma_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_jpeg_dma_init_module(void)
+{
+	return platform_driver_register(&cam_jpeg_dma_driver);
+}
+
+void cam_jpeg_dma_exit_module(void)
+{
+	platform_driver_unregister(&cam_jpeg_dma_driver);
+}
+
+MODULE_DESCRIPTION("CAM JPEG_DMA driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.c
@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_jpeg.h>
+
+#include "jpeg_dma_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+int cam_jpeg_dma_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t jpeg_dma_irq_handler, void *data)
+{
+	struct cam_jpeg_dma_soc_private  *soc_private;
+	struct platform_device *pdev = NULL;
+	int num_pid = 0, i = 0;
+	int rc;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	soc_private = kzalloc(sizeof(struct cam_jpeg_dma_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_JPEG, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+	pdev = soc_info->pdev;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info,
+		jpeg_dma_irq_handler, &(irq_data[0]));
+	if (rc)
+		CAM_ERR(CAM_JPEG, "init soc failed %d", rc);
+
+	soc_private->num_pid = 0;
+	soc_private->rd_mid = UINT_MAX;
+	soc_private->wr_mid = UINT_MAX;
+
+	num_pid = of_property_count_u32_elems(pdev->dev.of_node, "cam_hw_pid");
+	CAM_DBG(CAM_JPEG, "jpeg:%d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_JPEG_HW_MAX_NUM_PID)
+		goto end;
+
+	soc_private->num_pid  = num_pid;
+	for (i = 0; i < num_pid; i++)
+		of_property_read_u32_index(pdev->dev.of_node, "cam_hw_pid", i,
+		&soc_private->pid[i]);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cam_hw_rd_mid", &soc_private->rd_mid);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cam_hw_wr_mid", &soc_private->wr_mid);
+
+end:
+	return rc;
+}
+
+int cam_jpeg_dma_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		CAM_SVS_VOTE, true);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "enable platform failed %d", rc);
+
+	return rc;
+}
+
+int cam_jpeg_dma_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "disable platform failed %d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2021 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_JPEG_DMA_SOC_H_
+#define _CAM_JPEG_DMA_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_jpeg_hw_intf.h"
+
+/*
+ * struct cam_jpeg_dma_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to JPEG DMA Driver
+ *
+ * @num_pid                  JPEG number of pids
+ * @pid:                     JPEG DMA pid value list
+ * @rd_mid:                  JPEG DMA inport read mid value
+ * @wr_mid:                  JPEG DMA outport write mid value
+ */
+struct cam_jpeg_dma_soc_private {
+	uint32_t    num_pid;
+	uint32_t    pid[CAM_JPEG_HW_MAX_NUM_PID];
+	uint32_t    rd_mid;
+	uint32_t    wr_mid;
+};
+
+int cam_jpeg_dma_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t jpeg_dma_irq_handler, void *irq_data);
+
+int cam_jpeg_dma_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_jpeg_dma_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_JPEG_DMA_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_165_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_165_hw_info_ver_4_2_0.h
@@ -0,0 +1,103 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_165_HW_INFO_TITAN170_H
+#define CAM_JPEG_ENC_165_HW_INFO_TITAN170_H
+
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK 0x00000001
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_SHIFT 0x00000000
+
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK 0x10000000
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_SHIFT 0x0000000a
+
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK 0x8000000
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_SHIFT 0x0000001b
+
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_MASK 0x00000800
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_SHIFT 0x0000000b
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF      (0x1<<19)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR     (0x1<<20)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR   (0x1<<21)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF (0x1<<22)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW    (0x1<<23)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM       (0x1<<24)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ   (0x1<<25)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM       (0x1<<26)
+#define CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK        (0x1<<29)
+
+#define CAM_JPEG_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK
+#define CAM_JPEG_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK
+#define CAM_JPEG_HW_MASK_COMP_ERR \
+		(CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK)
+
+static struct cam_jpeg_enc_device_hw_info cam_jpeg_enc_165_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x1c,
+		.int_status = 0x20,
+		.int_mask = 0x18,
+		.hw_cmd = 0x10,
+		.reset_cmd = 0x8,
+		.encode_size = 0x180,
+		.core_cfg = 0xc,
+		.misr_cfg = 0x2B4,
+		.misr_rd0 = 0x2B8,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x200320D3,
+		.hw_cmd_stop = 0x00000002,
+		.misr_cfg = 0x7,
+	},
+	.int_status = {
+		.framedone = CAM_JPEG_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEG_HW_MASK_COMP_RESET_ACK,
+		.iserror = CAM_JPEG_HW_MASK_COMP_ERR,
+		.stopdone = CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x7,
+	},
+	.reg_dump = {
+		.start_offset = 0x0,
+		.end_offset = 0x33C,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x5908,
+		.id_mask_low = 0x5920,
+		.id_value_low = 0x5918,
+		.misc_ctl = 0x5910,
+		.sigdata0 = 0x5950,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD80,
+		.id_value_low_wr = 0xDC2,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.camnoc_misr_sigdata = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_ENC_165_HW_INFO_TITAN170_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_580_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_580_hw_info_ver_4_2_0.h
@@ -0,0 +1,103 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_580_HW_INFO_TITAN170_H
+#define CAM_JPEG_ENC_580_HW_INFO_TITAN170_H
+
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK 0x00000001
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_SHIFT 0x00000000
+
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK 0x10000000
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_SHIFT 0x0000000a
+
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK 0x8000000
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_SHIFT 0x0000001b
+
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_MASK 0x00000800
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_SHIFT 0x0000000b
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF      (0x1<<19)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR     (0x1<<20)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR   (0x1<<21)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF (0x1<<22)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW    (0x1<<23)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM       (0x1<<24)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ   (0x1<<25)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM       (0x1<<26)
+#define CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK        (0x1<<29)
+
+#define CAM_JPEG_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK
+#define CAM_JPEG_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK
+#define CAM_JPEG_HW_MASK_COMP_ERR \
+		(CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK)
+
+static struct cam_jpeg_enc_device_hw_info cam_jpeg_enc_580_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x1c,
+		.int_status = 0x20,
+		.int_mask = 0x18,
+		.hw_cmd = 0x10,
+		.reset_cmd = 0x8,
+		.encode_size = 0x180,
+		.core_cfg = 0xc,
+		.misr_cfg = 0x2B4,
+		.misr_rd0 = 0x2B8,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x200320D3,
+		.hw_cmd_stop = 0x00000002,
+		.misr_cfg = 0x7,
+	},
+	.int_status = {
+		.framedone = CAM_JPEG_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEG_HW_MASK_COMP_RESET_ACK,
+		.iserror = CAM_JPEG_HW_MASK_COMP_ERR,
+		.stopdone = CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x7,
+	},
+	.reg_dump = {
+		.start_offset = 0x0,
+		.end_offset = 0x33C,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x3608,
+		.id_mask_low = 0x3620,
+		.id_value_low = 0x3618,
+		.misc_ctl = 0x3610,
+		.sigdata0 = 0x3650,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD80,
+		.id_value_low_wr = 0xDC2,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.camnoc_misr_sigdata = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_ENC_580_HW_INFO_TITAN170_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_680_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_680_hw_info_ver_4_2_0.h
@@ -0,0 +1,114 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_680_HW_INFO_TITAN170_H
+#define CAM_JPEG_ENC_680_HW_INFO_TITAN170_H
+
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK 0x00000001
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_SHIFT 0x00000000
+
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK 0x10000000
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_SHIFT 0x0000000a
+
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK 0x8000000
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_SHIFT 0x0000001b
+
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_MASK 0x00000800
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_SHIFT 0x0000000b
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF      (0x1<<19)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR     (0x1<<20)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR   (0x1<<21)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF (0x1<<22)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW    (0x1<<23)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM       (0x1<<24)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ   (0x1<<25)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM       (0x1<<26)
+#define CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK        (0x1<<29)
+
+#define CAM_JPEG_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK
+#define CAM_JPEG_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK
+#define CAM_JPEG_HW_MASK_COMP_ERR \
+		(CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK)
+
+static struct cam_jpeg_enc_device_hw_info cam_jpeg_enc_680_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x1c,
+		.int_status = 0x20,
+		.int_mask = 0x18,
+		.hw_cmd = 0x10,
+		.reset_cmd = 0x8,
+		.encode_size = 0x180,
+		.core_cfg = 0xc,
+		.misr_cfg = 0x2B4,
+		.misr_rd0 = 0x2B8,
+	},
+	.debug_reg_offset = {
+		.top_offset = 0x0,
+		.top_range = 0x24,
+		.we_offset = 0xC0,
+		.we_range = 0x31,
+		.scale_offset = 0x26C,
+		.scale_range = 0x35,
+		.perf_offset = 0xFEC,
+		.perf_range = 0x5,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x200320D3,
+		.hw_cmd_stop = 0x00000002,
+		.misr_cfg = 0x7,
+	},
+	.int_status = {
+		.framedone = CAM_JPEG_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEG_HW_MASK_COMP_RESET_ACK,
+		.iserror = CAM_JPEG_HW_MASK_COMP_ERR,
+		.stopdone = CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x7,
+	},
+	.reg_dump = {
+		.start_offset = 0x0,
+		.end_offset = 0x33C,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x8108,
+		.id_mask_low = 0x8120,
+		.id_value_low = 0x8118,
+		.misc_ctl = 0x8110,
+		.sigdata0 = 0x8150,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD80,
+		.id_value_low_wr = 0xDC2,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.camnoc_misr_sigdata = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_ENC_680_HW_INFO_TITAN170_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_770_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_770_hw_info_ver_4_2_0.h
@@ -0,0 +1,103 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_770_HW_INFO_TITAN170_H
+#define CAM_JPEG_ENC_770_HW_INFO_TITAN170_H
+
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK 0x00000001
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_SHIFT 0x00000000
+
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK 0x10000000
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_SHIFT 0x0000000a
+
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK 0x8000000
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_SHIFT 0x0000001b
+
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_MASK 0x00000800
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_SHIFT 0x0000000b
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF      (0x1<<19)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR     (0x1<<20)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR   (0x1<<21)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF (0x1<<22)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW    (0x1<<23)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM       (0x1<<24)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ   (0x1<<25)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM       (0x1<<26)
+#define CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK        (0x1<<29)
+
+#define CAM_JPEG_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK
+#define CAM_JPEG_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK
+#define CAM_JPEG_HW_MASK_COMP_ERR \
+		(CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK)
+
+static struct cam_jpeg_enc_device_hw_info cam_jpeg_enc_770_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x1c,
+		.int_status = 0x20,
+		.int_mask = 0x18,
+		.hw_cmd = 0x10,
+		.reset_cmd = 0x8,
+		.encode_size = 0x180,
+		.core_cfg = 0xc,
+		.misr_cfg = 0x2B4,
+		.misr_rd0 = 0x2B8,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x200320D3,
+		.hw_cmd_stop = 0x00000002,
+		.misr_cfg = 0x7,
+	},
+	.int_status = {
+		.framedone = CAM_JPEG_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEG_HW_MASK_COMP_RESET_ACK,
+		.iserror = CAM_JPEG_HW_MASK_COMP_ERR,
+		.stopdone = CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x7,
+	},
+	.reg_dump = {
+		.start_offset = 0x0,
+		.end_offset = 0x33C,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x8108,
+		.id_mask_low = 0x8120,
+		.id_value_low = 0x8118,
+		.misc_ctl = 0x8110,
+		.sigdata0 = 0x8150,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD80,
+		.id_value_low_wr = 0xDC2,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.camnoc_misr_sigdata = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_ENC_770_HW_INFO_TITAN170_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_780_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_780_hw_info_ver_4_2_0.h
@@ -0,0 +1,113 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_780_HW_INFO_TITAN170_H
+#define CAM_JPEG_ENC_780_HW_INFO_TITAN170_H
+
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK 0x00000001
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_SHIFT 0x00000000
+
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK 0x10000000
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_SHIFT 0x0000000a
+
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK 0x8000000
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_SHIFT 0x0000001b
+
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_MASK 0x00000800
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_SHIFT 0x0000000b
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF      (0x1<<19)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR     (0x1<<20)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR   (0x1<<21)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF (0x1<<22)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW    (0x1<<23)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM       (0x1<<24)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ   (0x1<<25)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM       (0x1<<26)
+#define CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK        (0x1<<29)
+
+#define CAM_JPEG_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK
+#define CAM_JPEG_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK
+#define CAM_JPEG_HW_MASK_COMP_ERR \
+		(CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK)
+
+static struct cam_jpeg_enc_device_hw_info cam_jpeg_enc_780_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x1c,
+		.int_status = 0x20,
+		.int_mask = 0x18,
+		.hw_cmd = 0x10,
+		.reset_cmd = 0x8,
+		.encode_size = 0x180,
+		.core_cfg = 0xc,
+		.misr_cfg = 0x2B4,
+		.misr_rd0 = 0x2B8,
+	},
+	.debug_reg_offset = {
+		.top_offset = 0x0,
+		.top_range = 0x24,
+		.we_offset = 0xC0,
+		.we_range = 0x31,
+		.scale_offset = 0x26C,
+		.scale_range = 0x35,
+		.perf_offset = 0xFEC,
+		.perf_range = 0x5,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x200320D3,
+		.hw_cmd_stop = 0x00000002,
+		.misr_cfg = 0x7,
+	},
+	.int_status = {
+		.framedone = CAM_JPEG_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEG_HW_MASK_COMP_RESET_ACK,
+		.iserror = CAM_JPEG_HW_MASK_COMP_ERR,
+		.stopdone = CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x7,
+	},
+	.reg_dump = {
+		.start_offset = 0x0,
+		.end_offset = 0x33C,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x2C88,
+		.id_mask_low = 0x2CA0,
+		.id_value_low = 0x2C98,
+		.misc_ctl = 0x2C90,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x3,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD80,
+		.id_value_low_wr = 0xDC2,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.camnoc_misr_sigdata = 0,
+	.camnoc_misr_support = 0,
+};
+
+#endif /* CAM_JPEG_ENC_780_HW_INFO_TITAN170_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_hw_info_ver_4_2_0.h
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_HW_INFO_TITAN170_H
+#define CAM_JPEG_ENC_HW_INFO_TITAN170_H
+
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK 0x00000001
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_SHIFT 0x00000000
+
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK 0x10000000
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_SHIFT 0x0000000a
+
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK 0x8000000
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_SHIFT 0x0000001b
+
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_MASK 0x00000800
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_SHIFT 0x0000000b
+
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF      (0x1<<19)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR     (0x1<<20)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR   (0x1<<21)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF (0x1<<22)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW    (0x1<<23)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM       (0x1<<24)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ   (0x1<<25)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM       (0x1<<26)
+#define CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK        (0x1<<29)
+
+#define CAM_JPEG_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK
+#define CAM_JPEG_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK
+#define CAM_JPEG_HW_MASK_COMP_ERR \
+		(CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK)
+
+static struct cam_jpeg_enc_device_hw_info cam_jpeg_enc_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x1c,
+		.int_status = 0x20,
+		.int_mask = 0x18,
+		.hw_cmd = 0x10,
+		.reset_cmd = 0x8,
+		.encode_size = 0x180,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x200320D3,
+		.hw_cmd_stop = 0x00000002,
+	},
+	.int_status = {
+		.framedone = CAM_JPEG_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEG_HW_MASK_COMP_RESET_ACK,
+		.iserror = CAM_JPEG_HW_MASK_COMP_ERR,
+		.stopdone = CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK,
+	},
+	.reg_dump = {
+		.start_offset = 0x0,
+		.end_offset = 0x33C,
+	},
+	.camnoc_misr_support = 0,
+};
+
+#endif /* CAM_JPEG_ENC_HW_INFO_TITAN170_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.c
@@ -0,0 +1,914 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "jpeg_enc_core.h"
+#include "jpeg_enc_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_jpeg_hw_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+
+#define CAM_JPEG_HW_IRQ_IS_FRAME_DONE(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.framedone)
+#define CAM_JPEG_HW_IRQ_IS_RESET_ACK(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.resetdone)
+#define CAM_JPEG_HW_IRQ_IS_ERR(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.iserror)
+#define CAM_JPEG_HW_IRQ_IS_STOP_DONE(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.stopdone)
+
+#define CAM_JPEG_ENC_RESET_TIMEOUT msecs_to_jiffies(500)
+
+int cam_jpeg_enc_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	unsigned long flags;
+	int rc;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+
+	if (!soc_info || !core_info) {
+		CAM_ERR(CAM_JPEG, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	mutex_lock(&core_info->core_mutex);
+	if (++core_info->ref_count > 1) {
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = JPEG_VOTE;
+	axi_vote.axi_path[0].mnoc_ab_bw = JPEG_VOTE;
+	axi_vote.axi_path[0].mnoc_ib_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].mnoc_ab_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].mnoc_ib_bw = JPEG_VOTE;
+
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "cpass start failed: %d", rc);
+		goto cpas_failed;
+	}
+
+	rc = cam_jpeg_enc_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "soc enable is failed %d", rc);
+		goto soc_failed;
+	}
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	jpeg_enc_dev->hw_state = CAM_HW_STATE_POWER_UP;
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+
+	mutex_unlock(&core_info->core_mutex);
+
+	return 0;
+
+soc_failed:
+	cam_cpas_stop(core_info->cpas_handle);
+cpas_failed:
+	--core_info->ref_count;
+	mutex_unlock(&core_info->core_mutex);
+
+	return rc;
+}
+
+int cam_jpeg_enc_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	unsigned long flags;
+	int rc;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	if (!soc_info || !core_info) {
+		CAM_ERR(CAM_JPEG, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	mutex_lock(&core_info->core_mutex);
+	if (--core_info->ref_count > 0) {
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	if (core_info->ref_count < 0) {
+		CAM_ERR(CAM_JPEG, "ref cnt %d", core_info->ref_count);
+		core_info->ref_count = 0;
+		mutex_unlock(&core_info->core_mutex);
+		return -EFAULT;
+	}
+
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	jpeg_enc_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+	rc = cam_jpeg_enc_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "soc disable failed %d", rc);
+
+	rc = cam_cpas_stop(core_info->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "cpas stop failed: %d", rc);
+
+	mutex_unlock(&core_info->core_mutex);
+
+	return 0;
+}
+
+irqreturn_t cam_jpeg_enc_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *jpeg_enc_dev = data;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	uint32_t irq_status = 0;
+	uint32_t encoded_size = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return IRQ_HANDLED;
+	}
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	spin_lock(&jpeg_enc_dev->hw_lock);
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+		return IRQ_HANDLED;
+	}
+	irq_status = cam_io_r_mb(mem_base +
+		core_info->jpeg_enc_hw_info->reg_offset.int_status);
+
+	cam_io_w_mb(irq_status,
+		soc_info->reg_map[0].mem_base +
+		core_info->jpeg_enc_hw_info->reg_offset.int_clr);
+	spin_unlock(&jpeg_enc_dev->hw_lock);
+
+	CAM_DBG(CAM_JPEG, "irq_num: %d  irq_status: 0x%x , core_state: %d",
+		irq_num, irq_status, core_info->core_state);
+
+	if (CAM_JPEG_HW_IRQ_IS_FRAME_DONE(irq_status, hw_info)) {
+		spin_lock(&jpeg_enc_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_ENC_CORE_READY) {
+			CAM_TRACE(CAM_JPEG, "Ctx %lld ENC FrameDone IRQ",
+				core_info->irq_cb.irq_cb_data.private_data);
+			encoded_size = cam_io_r_mb(mem_base +
+			core_info->jpeg_enc_hw_info->reg_offset.encode_size);
+			if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+				core_info->irq_cb.jpeg_hw_mgr_cb(irq_status,
+					encoded_size,
+					(void *)&core_info->irq_cb.irq_cb_data);
+			} else {
+				CAM_ERR(CAM_JPEG, "unexpected done, no cb");
+			}
+			cam_cpas_notify_event("JPEG FrameDone", 0);
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected done irq");
+		}
+		core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+	}
+	if (CAM_JPEG_HW_IRQ_IS_RESET_ACK(irq_status, hw_info)) {
+		spin_lock(&jpeg_enc_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_ENC_CORE_RESETTING) {
+			core_info->core_state = CAM_JPEG_ENC_CORE_READY;
+			complete(&jpeg_enc_dev->hw_complete);
+			CAM_DBG(CAM_JPEG, "JPEG ENC (%s) reset done",
+				jpeg_enc_dev->soc_info.dev_name);
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected reset irq");
+		}
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+	}
+	if (CAM_JPEG_HW_IRQ_IS_STOP_DONE(irq_status, hw_info)) {
+		spin_lock(&jpeg_enc_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_ENC_CORE_ABORTING) {
+			core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+			complete(&jpeg_enc_dev->hw_complete);
+			if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+				core_info->irq_cb.jpeg_hw_mgr_cb(irq_status, -1,
+					(void *)&core_info->irq_cb.irq_cb_data);
+			}
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected abort irq");
+		}
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+	}
+	/* Unexpected/unintended HW interrupt */
+	if (CAM_JPEG_HW_IRQ_IS_ERR(irq_status, hw_info)) {
+		spin_lock(&jpeg_enc_dev->hw_lock);
+		core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+		CAM_ERR_RATE_LIMIT(CAM_JPEG,
+			"error irq_num %d  irq_status = %x , core_state %d",
+			irq_num, irq_status, core_info->core_state);
+
+		if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+			core_info->irq_cb.jpeg_hw_mgr_cb(irq_status, -1,
+				(void *)&core_info->irq_cb.irq_cb_data);
+		}
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+	}
+
+	return IRQ_HANDLED;
+}
+
+int cam_jpeg_enc_reset_hw(void *data,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = data;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long rem_jiffies;
+	unsigned long flags;
+	int rc = 0;
+
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	/* maskdisable.clrirq.maskenable.resetcmd */
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	mutex_lock(&core_info->core_mutex);
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		mutex_unlock(&core_info->core_mutex);
+		return -EINVAL;
+	}
+	if (core_info->core_state == CAM_JPEG_ENC_CORE_RESETTING) {
+		CAM_ERR(CAM_JPEG, "alrady resetting");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	reinit_completion(&jpeg_enc_dev->hw_complete);
+	core_info->core_state = CAM_JPEG_ENC_CORE_RESETTING;
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+
+	cam_io_w_mb(hw_info->reg_val.int_mask_disable_all,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.int_clr_clearall,
+		mem_base + hw_info->reg_offset.int_clr);
+	cam_io_w_mb(hw_info->reg_val.int_mask_enable_all,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.reset_cmd,
+		mem_base + hw_info->reg_offset.reset_cmd);
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(
+			&jpeg_enc_dev->hw_complete,
+			CAM_JPEG_ENC_RESET_TIMEOUT);
+	if (!rem_jiffies) {
+		CAM_ERR(CAM_JPEG, "error Reset Timeout");
+		core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+		rc = -ETIMEDOUT;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	return rc;
+}
+
+int cam_jpeg_enc_test_irq_line(void *data)
+{
+	struct cam_hw_info *jpeg_enc_dev = data;
+	int rc;
+
+	if (!data) {
+		CAM_ERR(CAM_JPEG, "invalid args");
+		return -EINVAL;
+	}
+
+	rc = cam_jpeg_enc_init_hw(data, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "failed to init hw (rc=%d)", rc);
+		return rc;
+	}
+
+	rc = cam_jpeg_enc_reset_hw(data, NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to trigger reset irq (rc=%d)", rc);
+	else
+		CAM_INFO(CAM_JPEG, "verified JPEG DMA (%s) IRQ line",
+			jpeg_enc_dev->soc_info.dev_name);
+
+	rc = cam_jpeg_enc_deinit_hw(data, NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to de-init hw (rc=%d)", rc);
+
+	return 0;
+}
+
+int cam_jpeg_enc_start_hw(void *data,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = data;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long flags;
+
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		return -EINVAL;
+	}
+	if (core_info->core_state != CAM_JPEG_ENC_CORE_READY) {
+		CAM_ERR(CAM_JPEG, "Error not ready: %d", core_info->core_state);
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		return -EINVAL;
+	}
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+
+	CAM_DBG(CAM_JPEG, "Starting JPEG ENC");
+	cam_io_w_mb(hw_info->reg_val.hw_cmd_start,
+		mem_base + hw_info->reg_offset.hw_cmd);
+
+	return 0;
+}
+
+int cam_jpeg_enc_stop_hw(void *data,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = data;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long rem_jiffies;
+	unsigned long flags;
+
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	mutex_lock(&core_info->core_mutex);
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		mutex_unlock(&core_info->core_mutex);
+		return -EINVAL;
+	}
+	if (core_info->core_state == CAM_JPEG_ENC_CORE_ABORTING) {
+		CAM_ERR(CAM_JPEG, "alrady stopping");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	reinit_completion(&jpeg_enc_dev->hw_complete);
+	core_info->core_state = CAM_JPEG_ENC_CORE_ABORTING;
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+
+	cam_io_w_mb(hw_info->reg_val.hw_cmd_stop,
+		mem_base + hw_info->reg_offset.hw_cmd);
+
+	rem_jiffies = cam_common_wait_for_completion_timeout(
+			&jpeg_enc_dev->hw_complete,
+			CAM_JPEG_ENC_RESET_TIMEOUT);
+	if (!rem_jiffies) {
+		CAM_ERR(CAM_JPEG, "error Reset Timeout");
+		core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	return 0;
+}
+
+int cam_jpeg_enc_hw_dump(
+	struct cam_hw_info           *jpeg_enc_dev,
+	struct cam_jpeg_hw_dump_args *dump_args)
+{
+
+	int                                   i;
+	uint8_t                              *dst;
+	uint32_t                             *addr, *start;
+	uint32_t                              num_reg, min_len;
+	uint32_t                              reg_start_offset;
+	size_t                                remain_len;
+	struct cam_hw_soc_info               *soc_info;
+	struct cam_jpeg_hw_dump_header       *hdr;
+	struct cam_jpeg_enc_device_hw_info   *hw_info;
+	struct cam_jpeg_enc_device_core_info *core_info;
+
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mutex_lock(&core_info->core_mutex);
+	spin_lock(&jpeg_enc_dev->hw_lock);
+
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+		mutex_unlock(&core_info->core_mutex);
+		return -EINVAL;
+	}
+
+	spin_unlock(&jpeg_enc_dev->hw_lock);
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_JPEG, "dump buffer overshoot %zu %zu",
+			dump_args->buf_len, dump_args->offset);
+		mutex_unlock(&core_info->core_mutex);
+		return -ENOSPC;
+	}
+
+	remain_len = dump_args->buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_jpeg_hw_dump_header) +
+		    soc_info->reg_map[0].size + sizeof(uint32_t);
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_JPEG, "dump buffer exhaust %zu %u",
+			remain_len, min_len);
+		mutex_unlock(&core_info->core_mutex);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_jpeg_hw_dump_header *)dst;
+	snprintf(hdr->tag, CAM_JPEG_HW_DUMP_TAG_MAX_LEN,
+		"JPEG_REG:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_jpeg_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+	num_reg = (hw_info->reg_dump.end_offset -
+		hw_info->reg_dump.start_offset)/4;
+	reg_start_offset = hw_info->reg_dump.start_offset;
+	for (i = 0; i < num_reg; i++) {
+		*addr++ = soc_info->mem_block[0]->start +
+			reg_start_offset + i*4;
+		*addr++ = cam_io_r(soc_info->reg_map[0].mem_base + (i*4));
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_jpeg_hw_dump_header);
+	CAM_DBG(CAM_JPEG, "offset %zu", dump_args->offset);
+
+	return 0;
+}
+
+static int  cam_jpeg_enc_mini_dump(struct cam_hw_info *dev, void *args) {
+
+	struct cam_jpeg_mini_dump_core_info *md;
+	struct cam_jpeg_enc_device_hw_info   *hw_info;
+	struct cam_jpeg_enc_device_core_info *core_info;
+
+	if (!dev || !args) {
+		CAM_ERR(CAM_JPEG, "Invalid params priv %pK args %pK", dev, args);
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_jpeg_enc_device_core_info *)dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	md = (struct cam_jpeg_mini_dump_core_info *)args;
+
+	md->framedone = hw_info->int_status.framedone;
+	md->resetdone = hw_info->int_status.resetdone;
+	md->iserror = hw_info->int_status.iserror;
+	md->stopdone = hw_info->int_status.stopdone;
+	md->open_count = dev->open_count;
+	md->hw_state = dev->hw_state;
+	md->ref_count = core_info->ref_count;
+	md->core_state = core_info->core_state;
+	return 0;
+}
+
+int cam_jpeg_enc_dump_camnoc_misr_val(struct cam_jpeg_enc_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *enc_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	struct cam_jpeg_misr_dump_args       *pmisr_args;
+	int32_t val;
+	uint32_t index = 0;
+	int i;
+	bool mismatch = false;
+	int32_t camnoc_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{0}};
+
+	enc_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	if (!camnoc_mem_base) {
+		CAM_ERR(CAM_JPEG, "Invalid camnoc base address");
+		return -EINVAL;
+	}
+	pmisr_args = (struct cam_jpeg_misr_dump_args *)cmd_args;
+	if (!pmisr_args) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+
+	val = cam_io_r_mb(enc_mem_base + hw_info->reg_offset.core_cfg);
+	index = (val >> hw_info->int_status.scale_enable_shift) &
+		hw_info->int_status.scale_enable;
+	CAM_DBG(CAM_JPEG, "index %d", index);
+
+	for (i = 0; i < hw_info->camnoc_misr_sigdata; i++) {
+		camnoc_misr_val[index][i] = cam_io_r_mb(camnoc_mem_base +
+			hw_info->camnoc_misr_reg_offset.sigdata0 + (i * 8));
+		if (hw_info->prev_camnoc_misr_val[index][i] != camnoc_misr_val[index][i])
+			mismatch = true;
+	}
+	if (mismatch && (pmisr_args->req_id != 1)) {
+		CAM_ERR(CAM_JPEG,
+			"CAMNOC ENC_MISR MISMATCH [req:%d][i:%d][index:%d]\n"
+			"curr SigData:0x%x %x %x %x prev SigData:0x%x %x %x %x isbug:%d",
+			pmisr_args->req_id, i, index,
+			camnoc_misr_val[index][3], camnoc_misr_val[index][2],
+			camnoc_misr_val[index][1], camnoc_misr_val[index][0],
+			hw_info->prev_camnoc_misr_val[index][3],
+			hw_info->prev_camnoc_misr_val[index][2],
+			hw_info->prev_camnoc_misr_val[index][1],
+			hw_info->prev_camnoc_misr_val[index][0], pmisr_args->enable_bug);
+		if (pmisr_args->enable_bug)
+			BUG_ON(1);
+	}
+	CAM_DBG(CAM_JPEG,
+		"CAMNOC ENC MISR req:%d SigData:0x%x %x %x %x",
+		pmisr_args->req_id,
+		camnoc_misr_val[index][3], camnoc_misr_val[index][2],
+		camnoc_misr_val[index][1], camnoc_misr_val[index][0]);
+	for (i = 0; i < hw_info->camnoc_misr_sigdata; i++)
+		hw_info->prev_camnoc_misr_val[index][i] = camnoc_misr_val[index][i];
+	/* stop misr : cam_noc_cam_noc_0_req_link_misrprb_MiscCtl_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.misc_ctl_stop,
+		camnoc_mem_base + hw_info->camnoc_misr_reg_offset.misc_ctl);
+	return 0;
+}
+
+int cam_jpeg_enc_dump_hw_misr_val(struct cam_jpeg_enc_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *enc_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	struct cam_jpeg_misr_dump_args       *pmisr_args;
+	int32_t val;
+	uint32_t index = 0;
+	int offset, i, j;
+	bool mismatch = false;
+	int32_t enc_misr_val[CAM_JPEG_ENC_MISR_VAL_NUM][CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{{0}}};
+
+	enc_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	if (!camnoc_mem_base) {
+		CAM_ERR(CAM_JPEG, "Invalid camnoc base address");
+		return -EINVAL;
+	}
+	pmisr_args = (struct cam_jpeg_misr_dump_args *)cmd_args;
+	if (!pmisr_args) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+
+	val = cam_io_r_mb(enc_mem_base + hw_info->reg_offset.core_cfg);
+	index = (val >> hw_info->int_status.scale_enable_shift) &
+		hw_info->int_status.scale_enable;
+	CAM_DBG(CAM_JPEG, "index %d", index);
+
+	for (i = 0; i < hw_info->max_misr; i++) {
+		offset = hw_info->reg_offset.misr_rd0 + (i * 0x10);
+		for (j = 0; j < hw_info->max_misr_rd; j++) {
+			enc_misr_val[i][index][j] = cam_io_r_mb(enc_mem_base +
+				offset + (j * 4));
+			if (hw_info->prev_enc_misr_val[i][index][j] !=
+				enc_misr_val[i][index][j])
+				mismatch = true;
+		}
+		if (mismatch && (pmisr_args->req_id != 1)) {
+			CAM_ERR(CAM_JPEG,
+				"ENC_MISR RD MISMATCH [req:%d][i:%d][index:%d][j:%d]\n"
+				"curr:0x%x %x %x %x prev:0x%x %x %x %x isbug:%d",
+				pmisr_args->req_id, i, index, j, enc_misr_val[i][index][3],
+				enc_misr_val[i][index][2], enc_misr_val[i][index][1],
+				enc_misr_val[i][index][0], hw_info->prev_enc_misr_val[i][index][3],
+				hw_info->prev_enc_misr_val[i][index][2],
+				hw_info->prev_enc_misr_val[i][index][1],
+				hw_info->prev_enc_misr_val[i][index][0], pmisr_args->enable_bug);
+			if (pmisr_args->enable_bug)
+				BUG_ON(1);
+		}
+		CAM_DBG(CAM_JPEG, "ENC_MISR RD [req:%d][%d]: 0x%x %x %x %x",
+			pmisr_args->req_id, i,
+			enc_misr_val[i][index][3], enc_misr_val[i][index][2],
+			enc_misr_val[i][index][1], enc_misr_val[i][index][0]);
+		mismatch = false;
+
+		for (j = 0; j < hw_info->max_misr_rd; j++)
+			hw_info->prev_enc_misr_val[i][index][j] = enc_misr_val[i][index][j];
+	}
+
+	return 0;
+}
+
+int cam_jpeg_enc_config_cmanoc_hw_misr(struct cam_jpeg_enc_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *enc_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	uint32_t                             *camnoc_misr_test = NULL;
+	int val = 0;
+
+	enc_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	if (!camnoc_mem_base) {
+		CAM_ERR(CAM_JPEG, "Invalid camnoc base address");
+		return -EINVAL;
+	}
+	camnoc_misr_test = (uint32_t *)cmd_args;
+	if (!camnoc_misr_test) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+
+	/* enable all MISRs */
+	cam_io_w_mb(hw_info->reg_val.misr_cfg, enc_mem_base +
+		hw_info->reg_offset.misr_cfg);
+
+	/* cam_noc_cam_noc_0_req_link_misrprb_MainCtl_Low
+	 * enable CRC generation on both RD, WR and transaction payload
+	 */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.main_ctl, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.main_ctl);
+
+	/* cam_noc_cam_noc_0_req_link_misrprb_IdMask_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.main_ctl, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.id_mask_low);
+
+	/* cam_noc_cam_noc_0_req_link_misrprb_IdValue_Low */
+	switch (*camnoc_misr_test) {
+	case CAM_JPEG_MISR_ID_LOW_RD:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_rd;
+		break;
+	case CAM_JPEG_MISR_ID_LOW_WR:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_wr;
+		break;
+	default:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_rd;
+		break;
+	}
+	cam_io_w_mb(val, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.id_value_low);
+
+	/* start/reset misr : cam_noc_cam_noc_0_req_link_misrprb_MiscCtl_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.misc_ctl_start,
+		camnoc_mem_base + hw_info->camnoc_misr_reg_offset.misc_ctl);
+	CAM_DBG(CAM_JPEG, "ENC CAMNOC MISR configured");
+
+	return 0;
+}
+
+int cam_jpeg_enc_dump_debug_regs(struct cam_hw_info *jpeg_enc_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)jpeg_enc_dev->core_info;
+
+	CAM_INFO(CAM_JPEG, "******** JPEG ENCODER REGISTER DUMP *********");
+
+	/* JPEG DMA TOP, Interrupt, core config, command registers & Fetch Engine Registers*/
+	cam_soc_util_reg_dump(soc_info, CAM_JPEG_MEM_BASE_INDEX,
+		core_info->jpeg_enc_hw_info->debug_reg_offset.top_offset,
+		core_info->jpeg_enc_hw_info->debug_reg_offset.top_range);
+
+	/* Write Engine & Encoder debug registers*/
+	cam_soc_util_reg_dump(soc_info, CAM_JPEG_MEM_BASE_INDEX,
+		core_info->jpeg_enc_hw_info->debug_reg_offset.we_offset,
+		core_info->jpeg_enc_hw_info->debug_reg_offset.we_range);
+
+	/* WE qos cfg, test bus, DMI, spare regs, bus misr, scale reg & MMU prefetch regs */
+	cam_soc_util_reg_dump(soc_info, CAM_JPEG_MEM_BASE_INDEX,
+		core_info->jpeg_enc_hw_info->debug_reg_offset.scale_offset,
+		core_info->jpeg_enc_hw_info->debug_reg_offset.scale_range);
+
+	/* Perf Registers */
+	cam_soc_util_reg_dump(soc_info, CAM_JPEG_MEM_BASE_INDEX,
+		core_info->jpeg_enc_hw_info->debug_reg_offset.perf_offset,
+		core_info->jpeg_enc_hw_info->debug_reg_offset.perf_range);
+	return 0;
+}
+
+int cam_jpeg_enc_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = device_priv;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_jpeg_enc_device_hw_info   *hw_info = NULL;
+	struct cam_jpeg_match_pid_args       *match_pid_mid = NULL;
+	uint32_t    *num_pid = NULL;
+	struct cam_hw_soc_info               *soc_info = NULL;
+	int i, rc = 0;
+	unsigned long flags = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_JPEG_CMD_MAX) {
+		CAM_ERR(CAM_JPEG, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+
+	hw_info = core_info->jpeg_enc_hw_info;
+	soc_info = &jpeg_enc_dev->soc_info;
+
+	switch (cmd_type) {
+	case CAM_JPEG_CMD_SET_IRQ_CB:
+	{
+		struct cam_jpeg_set_irq_cb *irq_cb = cmd_args;
+		struct cam_jpeg_irq_cb_data *irq_cb_data;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		irq_cb_data = &irq_cb->irq_cb_data;
+		spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+
+		if (irq_cb->b_set_cb) {
+			core_info->irq_cb.jpeg_hw_mgr_cb = irq_cb->jpeg_hw_mgr_cb;
+			core_info->irq_cb.irq_cb_data.private_data = irq_cb_data->private_data;
+			core_info->irq_cb.irq_cb_data.jpeg_req = irq_cb_data->jpeg_req;
+		} else {
+			core_info->irq_cb.jpeg_hw_mgr_cb = NULL;
+			core_info->irq_cb.irq_cb_data.private_data = NULL;
+			core_info->irq_cb.irq_cb_data.jpeg_req = NULL;
+		}
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		rc = 0;
+		break;
+	}
+	case CAM_JPEG_CMD_HW_DUMP:
+	{
+		rc = cam_jpeg_enc_hw_dump(jpeg_enc_dev,
+			cmd_args);
+		break;
+	}
+	case CAM_JPEG_CMD_GET_NUM_PID:
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		num_pid = (uint32_t    *)cmd_args;
+		*num_pid = core_info->num_pid;
+
+		break;
+	case CAM_JPEG_CMD_MATCH_PID_MID:
+		match_pid_mid = (struct cam_jpeg_match_pid_args *)cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		for (i = 0 ; i < core_info->num_pid; i++) {
+			if (core_info->pid[i] == match_pid_mid->pid)
+				break;
+		}
+
+		if (i == core_info->num_pid)
+			match_pid_mid->pid_match_found = false;
+		else
+			match_pid_mid->pid_match_found = true;
+
+		if (match_pid_mid->pid_match_found) {
+			if (match_pid_mid->fault_mid == core_info->rd_mid) {
+				match_pid_mid->match_res =
+					CAM_JPEG_ENC_INPUT_IMAGE;
+			} else if (match_pid_mid->fault_mid ==
+				core_info->wr_mid) {
+				match_pid_mid->match_res =
+					CAM_JPEG_ENC_OUTPUT_IMAGE;
+			} else
+				match_pid_mid->pid_match_found = false;
+		}
+
+		break;
+	case CAM_JPEG_CMD_MINI_DUMP:
+	{
+		rc = cam_jpeg_enc_mini_dump(jpeg_enc_dev, cmd_args);
+		break;
+	}
+	case CAM_JPEG_CMD_CONFIG_HW_MISR:
+	{
+		if (hw_info->camnoc_misr_support)
+			rc = cam_jpeg_enc_config_cmanoc_hw_misr(hw_info, soc_info, cmd_args);
+		else
+			CAM_DBG(CAM_JPEG, "camnoc misr is not supported");
+		break;
+	}
+	case CAM_JPEG_CMD_DUMP_HW_MISR_VAL:
+	{
+		if (hw_info->camnoc_misr_support) {
+			rc = cam_jpeg_enc_dump_hw_misr_val(hw_info, soc_info, cmd_args);
+			if (rc)
+				break;
+			rc = cam_jpeg_enc_dump_camnoc_misr_val(hw_info, soc_info, cmd_args);
+		} else {
+			CAM_DBG(CAM_JPEG, "camnoc misr is not supported");
+		}
+		break;
+	}
+	case CAM_JPEG_CMD_DUMP_DEBUG_REGS:
+		rc = cam_jpeg_enc_dump_debug_regs(jpeg_enc_dev);
+		break;
+	default:
+		rc = -EINVAL;
+		break;
+	}
+	if (rc)
+		CAM_ERR(CAM_JPEG, "error cmdtype %d rc = %d", cmd_type, rc);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.h
@@ -0,0 +1,147 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_CORE_H
+#define CAM_JPEG_ENC_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include "cam_jpeg_hw_intf.h"
+
+struct cam_jpeg_enc_reg_offsets {
+	uint32_t hw_version;
+	uint32_t int_status;
+	uint32_t int_clr;
+	uint32_t int_mask;
+	uint32_t hw_cmd;
+	uint32_t reset_cmd;
+	uint32_t encode_size;
+	uint32_t core_cfg;
+	uint32_t misr_cfg;
+	uint32_t misr_rd0;
+};
+
+struct cam_jpeg_enc_regval {
+	uint32_t int_clr_clearall;
+	uint32_t int_mask_disable_all;
+	uint32_t int_mask_enable_all;
+	uint32_t hw_cmd_start;
+	uint32_t reset_cmd;
+	uint32_t hw_cmd_stop;
+	uint32_t misr_cfg;
+};
+
+struct cam_jpeg_enc_int_status {
+	uint32_t framedone;
+	uint32_t resetdone;
+	uint32_t iserror;
+	uint32_t stopdone;
+	uint32_t scale_enable;
+	uint32_t scale_enable_shift;
+};
+
+struct cam_jpeg_enc_reg_dump {
+	uint32_t start_offset;
+	uint32_t end_offset;
+};
+
+struct cam_jpeg_enc_camnoc_misr_reg_offset {
+	uint32_t main_ctl;
+	uint32_t id_mask_low;
+	uint32_t id_value_low;
+	uint32_t misc_ctl;
+	uint32_t sigdata0;
+};
+
+struct cam_jpeg_enc_camnoc_misr_reg_val {
+	uint32_t main_ctl;
+	uint32_t id_mask_low;
+	uint32_t id_value_low_rd;
+	uint32_t id_value_low_wr;
+	uint32_t misc_ctl_start;
+	uint32_t misc_ctl_stop;
+};
+
+struct cam_jpeg_enc_debug_regs_offset {
+	uint32_t top_offset;
+	uint32_t top_range;
+	uint32_t we_offset;
+	uint32_t we_range;
+	uint32_t scale_offset;
+	uint32_t scale_range;
+	uint32_t perf_offset;
+	uint32_t perf_range;
+};
+
+struct cam_jpeg_enc_device_hw_info {
+	struct cam_jpeg_enc_reg_offsets reg_offset;
+	struct cam_jpeg_enc_debug_regs_offset debug_reg_offset;
+	struct cam_jpeg_enc_regval reg_val;
+	struct cam_jpeg_enc_int_status int_status;
+	struct cam_jpeg_enc_reg_dump reg_dump;
+	struct cam_jpeg_enc_camnoc_misr_reg_offset camnoc_misr_reg_offset;
+	struct cam_jpeg_enc_camnoc_misr_reg_val camnoc_misr_reg_val;
+	uint32_t max_misr;
+	uint32_t max_misr_rd;
+	uint32_t camnoc_misr_sigdata;
+	uint32_t camnoc_misr_support;
+	int32_t prev_camnoc_misr_val[
+		CAM_JPEG_CAMNOC_MISR_VAL_ROW][CAM_JPEG_CAMNOC_MISR_VAL_COL];
+	int32_t prev_enc_misr_val[CAM_JPEG_ENC_MISR_VAL_NUM][
+		CAM_JPEG_CAMNOC_MISR_VAL_ROW][CAM_JPEG_CAMNOC_MISR_VAL_COL];
+};
+
+enum cam_jpeg_enc_core_state {
+	CAM_JPEG_ENC_CORE_NOT_READY,
+	CAM_JPEG_ENC_CORE_READY,
+	CAM_JPEG_ENC_CORE_RESETTING,
+	CAM_JPEG_ENC_CORE_ABORTING,
+	CAM_JPEG_ENC_CORE_STATE_MAX,
+};
+
+struct cam_jpeg_enc_device_core_info {
+	enum cam_jpeg_enc_core_state core_state;
+	struct cam_jpeg_enc_device_hw_info *jpeg_enc_hw_info;
+	uint32_t cpas_handle;
+	struct cam_jpeg_set_irq_cb irq_cb;
+	int32_t ref_count;
+	struct mutex core_mutex;
+	uint32_t num_pid;
+	uint32_t pid[CAM_JPEG_HW_MAX_NUM_PID];
+	uint32_t rd_mid;
+	uint32_t wr_mid;
+};
+
+int cam_jpeg_enc_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_start_hw(void *device_priv,
+	void *start_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_stop_hw(void *device_priv,
+	void *stop_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_reset_hw(void *device_priv,
+	void *reset_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+int cam_jpeg_enc_test_irq_line(void *data);
+
+irqreturn_t cam_jpeg_enc_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register JPEG ENC hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_jpeg_enc_init_module(void);
+
+/**
+ * @brief : API to remove JPEG ENC Hw from platform framework.
+ */
+void cam_jpeg_enc_exit_module(void);
+#endif /* CAM_JPEG_ENC_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.c
@@ -0,0 +1,295 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+
+#include "jpeg_enc_core.h"
+#include "jpeg_enc_soc.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_jpeg_hw_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_jpeg_enc_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_enc_165_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_enc_580_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_enc_680_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_enc_780_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_enc_770_hw_info_ver_4_2_0.h"
+#include "camera_main.h"
+
+static int cam_jpeg_enc_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_jpeg_enc_device_core_info *core_info,
+	uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = soc_info->dev;
+	memcpy(cpas_register_params.identifier, "jpeg-enc",
+		sizeof("jpeg-enc"));
+	cpas_register_params.cam_cpas_client_cb = NULL;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "cpas_register failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_jpeg_enc_unregister_cpas(
+	struct cam_jpeg_enc_device_core_info *core_info)
+{
+	int rc;
+
+	rc = cam_cpas_unregister_client(core_info->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "cpas unregister failed: %d", rc);
+	core_info->cpas_handle = 0;
+
+	return rc;
+}
+
+static int cam_jpeg_enc_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *jpeg_enc_dev = NULL;
+	struct cam_hw_intf *jpeg_enc_dev_intf = NULL;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct cam_jpeg_enc_soc_private  *soc_private;
+	int i;
+	int rc;
+
+	jpeg_enc_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!jpeg_enc_dev_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &jpeg_enc_dev_intf->hw_idx);
+
+	jpeg_enc_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!jpeg_enc_dev) {
+		rc = -ENOMEM;
+		goto error_alloc_dev;
+	}
+	jpeg_enc_dev->soc_info.pdev = pdev;
+	jpeg_enc_dev->soc_info.dev = &pdev->dev;
+	jpeg_enc_dev->soc_info.dev_name = pdev->name;
+	jpeg_enc_dev_intf->hw_priv = jpeg_enc_dev;
+	jpeg_enc_dev_intf->hw_ops.init = cam_jpeg_enc_init_hw;
+	jpeg_enc_dev_intf->hw_ops.deinit = cam_jpeg_enc_deinit_hw;
+	jpeg_enc_dev_intf->hw_ops.start = cam_jpeg_enc_start_hw;
+	jpeg_enc_dev_intf->hw_ops.stop = cam_jpeg_enc_stop_hw;
+	jpeg_enc_dev_intf->hw_ops.reset = cam_jpeg_enc_reset_hw;
+	jpeg_enc_dev_intf->hw_ops.process_cmd = cam_jpeg_enc_process_cmd;
+	jpeg_enc_dev_intf->hw_ops.test_irq_line = cam_jpeg_enc_test_irq_line;
+	jpeg_enc_dev_intf->hw_type = CAM_JPEG_DEV_ENC;
+
+	platform_set_drvdata(pdev, jpeg_enc_dev_intf);
+	jpeg_enc_dev->core_info =
+		kzalloc(sizeof(struct cam_jpeg_enc_device_core_info),
+			GFP_KERNEL);
+	if (!jpeg_enc_dev->core_info) {
+		rc = -ENOMEM;
+		goto error_alloc_core;
+	}
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_JPEG, " No jpeg_enc hardware info");
+		rc = -EINVAL;
+		goto error_match_dev;
+	}
+	hw_info = (struct cam_jpeg_enc_device_hw_info *)match_dev->data;
+	core_info->jpeg_enc_hw_info = hw_info;
+	core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+	mutex_init(&core_info->core_mutex);
+
+	rc = cam_jpeg_enc_init_soc_resources(&jpeg_enc_dev->soc_info,
+		cam_jpeg_enc_irq,
+		jpeg_enc_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, " failed to init_soc %d", rc);
+		goto error_init_soc;
+	}
+
+	rc = cam_jpeg_enc_register_cpas(&jpeg_enc_dev->soc_info,
+		core_info, jpeg_enc_dev_intf->hw_idx);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, " failed to reg cpas %d", rc);
+		goto error_reg_cpas;
+	}
+	jpeg_enc_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&jpeg_enc_dev->hw_mutex);
+	spin_lock_init(&jpeg_enc_dev->hw_lock);
+	init_completion(&jpeg_enc_dev->hw_complete);
+	CAM_DBG(CAM_JPEG, "JPEG-Encoder component bound successfully");
+
+	soc_private = (struct cam_jpeg_enc_soc_private  *)
+		jpeg_enc_dev->soc_info.soc_private;
+
+	core_info->num_pid = soc_private->num_pid;
+	for (i = 0; i < soc_private->num_pid; i++)
+		core_info->pid[i] = soc_private->pid[i];
+
+	core_info->rd_mid = soc_private->rd_mid;
+	core_info->wr_mid = soc_private->wr_mid;
+
+	return rc;
+
+error_reg_cpas:
+	cam_soc_util_release_platform_resource(&jpeg_enc_dev->soc_info);
+error_init_soc:
+	mutex_destroy(&core_info->core_mutex);
+error_match_dev:
+	kfree(jpeg_enc_dev->core_info);
+error_alloc_core:
+	kfree(jpeg_enc_dev);
+error_alloc_dev:
+	kfree(jpeg_enc_dev_intf);
+
+	return rc;
+}
+
+static void cam_jpeg_enc_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *jpeg_enc_dev = NULL;
+	struct cam_hw_intf *jpeg_enc_dev_intf = NULL;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	int rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	jpeg_enc_dev_intf = platform_get_drvdata(pdev);
+	if (!jpeg_enc_dev_intf) {
+		CAM_ERR(CAM_JPEG, "error No data in pdev");
+		return;
+	}
+
+	jpeg_enc_dev = jpeg_enc_dev_intf->hw_priv;
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "error HW data is NULL");
+		goto free_jpeg_hw_intf;
+	}
+
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_JPEG, "error core data NULL");
+		goto deinit_soc;
+	}
+
+	rc = cam_jpeg_enc_unregister_cpas(core_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, " unreg failed to reg cpas %d", rc);
+
+	mutex_destroy(&core_info->core_mutex);
+	kfree(core_info);
+
+deinit_soc:
+	rc = cam_soc_util_release_platform_resource(&jpeg_enc_dev->soc_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&jpeg_enc_dev->hw_mutex);
+	kfree(jpeg_enc_dev);
+
+free_jpeg_hw_intf:
+	kfree(jpeg_enc_dev_intf);
+}
+
+const static struct component_ops cam_jpeg_enc_component_ops = {
+	.bind = cam_jpeg_enc_component_bind,
+	.unbind = cam_jpeg_enc_component_unbind,
+};
+
+static int cam_jpeg_enc_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_jpeg_enc_component_ops);
+	return 0;
+}
+
+static int cam_jpeg_enc_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_JPEG, "Adding JPEG component");
+	rc = component_add(&pdev->dev, &cam_jpeg_enc_component_ops);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static const struct of_device_id cam_jpeg_enc_dt_match[] = {
+	{
+		.compatible = "qcom,cam_jpeg_enc",
+		.data = &cam_jpeg_enc_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_enc_165",
+		.data = &cam_jpeg_enc_165_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_enc_580",
+		.data = &cam_jpeg_enc_580_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_enc_680",
+		.data = &cam_jpeg_enc_680_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_enc_780",
+		.data = &cam_jpeg_enc_780_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_enc_770",
+		.data = &cam_jpeg_enc_770_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_jpeg_enc_dt_match);
+
+struct platform_driver cam_jpeg_enc_driver = {
+	.probe = cam_jpeg_enc_probe,
+	.remove = cam_jpeg_enc_remove,
+	.driver = {
+		.name = "cam-jpeg-enc",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_jpeg_enc_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_jpeg_enc_init_module(void)
+{
+	return platform_driver_register(&cam_jpeg_enc_driver);
+}
+
+void cam_jpeg_enc_exit_module(void)
+{
+	platform_driver_unregister(&cam_jpeg_enc_driver);
+}
+
+MODULE_DESCRIPTION("CAM JPEG_ENC driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.c
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_jpeg.h>
+
+#include "jpeg_enc_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+int cam_jpeg_enc_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t jpeg_enc_irq_handler, void *data)
+{
+	struct cam_jpeg_enc_soc_private  *soc_private;
+	struct platform_device *pdev = NULL;
+	int num_pid = 0, i = 0;
+	int rc;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	soc_private = kzalloc(sizeof(struct cam_jpeg_enc_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_ISP, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info,
+		jpeg_enc_irq_handler, &(irq_data[0]));
+	if (rc)
+		CAM_ERR(CAM_JPEG, "init soc failed %d", rc);
+
+	soc_private->num_pid = 0;
+	soc_private->rd_mid = UINT_MAX;
+	soc_private->wr_mid = UINT_MAX;
+
+	pdev = soc_info->pdev;
+	num_pid = of_property_count_u32_elems(pdev->dev.of_node, "cam_hw_pid");
+	CAM_DBG(CAM_JPEG, "jpeg enc:%d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_JPEG_HW_MAX_NUM_PID)
+		goto end;
+
+	soc_private->num_pid  = num_pid;
+	for (i = 0; i < num_pid; i++)
+		of_property_read_u32_index(pdev->dev.of_node, "cam_hw_pid", i,
+		&soc_private->pid[i]);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cam_hw_rd_mid", &soc_private->rd_mid);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cam_hw_wr_mid", &soc_private->wr_mid);
+end:
+	return rc;
+}
+
+int cam_jpeg_enc_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		CAM_SVS_VOTE, true);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "enable platform failed %d", rc);
+
+	return rc;
+}
+
+int cam_jpeg_enc_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "disable platform failed %d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2021 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_JPEG_ENC_SOC_H_
+#define _CAM_JPEG_ENC_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_jpeg_hw_intf.h"
+
+/*
+ * struct cam_jpeg_enc_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to JPEG ENC Driver
+ *
+ * @num_pid                  JPEG number of pids
+ * @pid:                     JPEG enc pid value list
+ * @rd_mid:                  JPEG enc inport read mid value
+ * @wr_mid:                  JPEG enc outport write mid value
+ */
+struct cam_jpeg_enc_soc_private {
+	uint32_t    num_pid;
+	uint32_t    pid[CAM_JPEG_HW_MAX_NUM_PID];
+	uint32_t    rd_mid;
+	uint32_t    wr_mid;
+};
+
+int cam_jpeg_enc_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t jpeg_enc_irq_handler, void *irq_data);
+
+int cam_jpeg_enc_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_jpeg_enc_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_JPEG_ENC_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/cam_lrme_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/cam_lrme_context.c
@@ -0,0 +1,281 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_debug_util.h"
+#include "cam_lrme_context.h"
+
+static const char lrme_dev_name[] = "cam-lrme";
+
+static int __cam_lrme_ctx_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc = 0;
+	uintptr_t ctxt_to_hw_map = (uintptr_t)ctx->ctxt_to_hw_map;
+	struct cam_lrme_context *lrme_ctx = ctx->ctx_priv;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to acquire");
+		return rc;
+	}
+
+	ctxt_to_hw_map |= (lrme_ctx->index << CAM_LRME_CTX_INDEX_SHIFT);
+	ctx->ctxt_to_hw_map = (void *)ctxt_to_hw_map;
+
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to release");
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_start_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_start_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to start");
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACTIVATED;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_config_dev_in_activated(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to config");
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_dump_dev_in_activated(
+	struct cam_context      *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed to dump device");
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_flush_dev_in_activated(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_context_utils_flush_args flush_args;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	flush_args.cmd = cmd;
+	flush_args.flush_active_req = true;
+
+	rc = cam_context_flush_dev_to_hw(ctx, &flush_args);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed to flush device");
+
+	return rc;
+}
+static int __cam_lrme_ctx_stop_dev_in_activated(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to stop dev");
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_release_dev_in_activated(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = __cam_lrme_ctx_stop_dev_in_activated(ctx, NULL);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to stop");
+		return rc;
+	}
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to release");
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_handle_irq_in_activated(void *context,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc;
+
+	CAM_DBG(CAM_LRME, "Enter");
+
+	rc = cam_context_buf_done_from_hw(context, evt_data, evt_id);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed in buf done, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_lrme_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_lrme_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.config_dev = __cam_lrme_ctx_config_dev_in_activated,
+			.release_dev = __cam_lrme_ctx_release_dev_in_acquired,
+			.start_dev = __cam_lrme_ctx_start_dev_in_acquired,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activate */
+	{
+		.ioctl_ops = {
+			.config_dev = __cam_lrme_ctx_config_dev_in_activated,
+			.release_dev = __cam_lrme_ctx_release_dev_in_activated,
+			.stop_dev = __cam_lrme_ctx_stop_dev_in_activated,
+			.flush_dev = __cam_lrme_ctx_flush_dev_in_activated,
+			.dump_dev = __cam_lrme_ctx_dump_dev_in_activated,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_lrme_ctx_handle_irq_in_activated,
+	},
+};
+
+int cam_lrme_context_init(struct cam_lrme_context *lrme_ctx,
+	struct cam_context *base_ctx,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t index
+	int img_iommu_hdl)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter");
+
+	if (!base_ctx || !lrme_ctx) {
+		CAM_ERR(CAM_LRME, "Invalid input");
+		return -EINVAL;
+	}
+
+	memset(lrme_ctx, 0, sizeof(*lrme_ctx));
+
+	rc = cam_context_init(base_ctx, lrme_dev_name, CAM_LRME, index,
+		NULL, hw_intf, lrme_ctx->req_base, CAM_CTX_REQ_MAX, img_iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to init context");
+		return rc;
+	}
+	lrme_ctx->base = base_ctx;
+	lrme_ctx->index = index;
+	base_ctx->ctx_priv = lrme_ctx;
+	base_ctx->state_machine = cam_lrme_ctx_state_machine;
+
+	base_ctx->max_hw_update_entries = CAM_CTX_CFG_MAX;
+	base_ctx->max_in_map_entries = CAM_CTX_CFG_MAX;
+	base_ctx->max_out_map_entries = CAM_CTX_CFG_MAX;
+
+	return rc;
+}
+
+int cam_lrme_context_deinit(struct cam_lrme_context *lrme_ctx)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter");
+
+	if (!lrme_ctx) {
+		CAM_ERR(CAM_LRME, "No ctx to deinit");
+		return -EINVAL;
+	}
+
+	rc = cam_context_deinit(lrme_ctx->base);
+
+	memset(lrme_ctx, 0, sizeof(*lrme_ctx));
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/cam_lrme_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/cam_lrme_context.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_CONTEXT_H_
+#define _CAM_LRME_CONTEXT_H_
+
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_interface.h"
+
+#define CAM_LRME_CTX_INDEX_SHIFT 16
+
+/**
+ * struct cam_lrme_context
+ *
+ * @base      : Base context pointer for this LRME context
+ * @req_base  : List of base request for this LRME context
+ */
+struct cam_lrme_context {
+	struct cam_context         *base;
+	struct cam_ctx_request      req_base[CAM_CTX_REQ_MAX];
+	uint64_t index;
+};
+
+int cam_lrme_context_init(struct cam_lrme_context *lrme_ctx,
+	struct cam_context *base_ctx, struct cam_hw_mgr_intf *hw_intf,
+	uint32_t index, int img_iommu_hdl);
+int cam_lrme_context_deinit(struct cam_lrme_context *lrme_ctx);
+
+#endif /* _CAM_LRME_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/cam_lrme_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/cam_lrme_dev.c
@@ -0,0 +1,283 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_lrme_context.h"
+#include "cam_lrme_hw_mgr.h"
+#include "cam_lrme_hw_mgr_intf.h"
+#include "camera_main.h"
+
+#define CAM_LRME_DEV_NAME "cam-lrme"
+
+/**
+ * struct cam_lrme_dev
+ *
+ * @sd       : Subdev information
+ * @ctx      : List of base contexts
+ * @lrme_ctx : List of LRME contexts
+ * @lock     : Mutex for LRME subdev
+ * @open_cnt : Open count of LRME subdev
+ */
+struct cam_lrme_dev {
+	struct cam_subdev        sd;
+	struct cam_context       ctx[CAM_CTX_MAX];
+	struct cam_lrme_context  lrme_ctx[CAM_CTX_MAX];
+	struct mutex             lock;
+	uint32_t                 open_cnt;
+};
+
+static struct cam_lrme_dev *g_lrme_dev;
+
+static int cam_lrme_dev_buf_done_cb(void *ctxt_to_hw_map, uint32_t evt_id,
+	void *evt_data)
+{
+	uint64_t index;
+	struct cam_context *ctx;
+	int rc;
+
+	index = CAM_LRME_DECODE_CTX_INDEX(ctxt_to_hw_map);
+	CAM_DBG(CAM_LRME, "ctx index %llu, evt_id %u\n", index, evt_id);
+	ctx = &g_lrme_dev->ctx[index];
+	rc = ctx->irq_cb_intf(ctx, evt_id, evt_data);
+	if (rc)
+		CAM_ERR(CAM_LRME, "irq callback failed");
+
+	return rc;
+}
+
+static int cam_lrme_dev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_lrme_dev *lrme_dev = g_lrme_dev;
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
+	if (!lrme_dev) {
+		CAM_ERR(CAM_LRME,
+			"LRME Dev not initialized, dev=%pK", lrme_dev);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+		return -ENODEV;
+	}
+
+	mutex_lock(&lrme_dev->lock);
+	lrme_dev->open_cnt++;
+	mutex_unlock(&lrme_dev->lock);
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
+	return 0;
+}
+
+static int cam_lrme_dev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_lrme_dev *lrme_dev = g_lrme_dev;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	if (!lrme_dev) {
+		CAM_ERR(CAM_LRME, "Invalid args");
+		return -ENODEV;
+	}
+
+	mutex_lock(&lrme_dev->lock);
+	if (lrme_dev->open_cnt <= 0) {
+		CAM_DBG(CAM_LRME, "LRME subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	lrme_dev->open_cnt--;
+	if (!node) {
+		CAM_ERR(CAM_LRME, "Node is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (lrme_dev->open_cnt == 0)
+		cam_node_shutdown(node);
+
+end:
+	mutex_unlock(&lrme_dev->lock);
+	return rc;
+}
+
+static int cam_lrme_dev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_LRME, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+	return cam_lrme_dev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_lrme_subdev_internal_ops = {
+	.open = cam_lrme_dev_open,
+	.close = cam_lrme_dev_close,
+};
+
+static int cam_lrme_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+	int i;
+	struct cam_hw_mgr_intf hw_mgr_intf;
+	struct cam_node *node;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	g_lrme_dev = kzalloc(sizeof(struct cam_lrme_dev), GFP_KERNEL);
+	if (!g_lrme_dev) {
+		CAM_ERR(CAM_LRME, "No memory");
+		return -ENOMEM;
+	}
+	g_lrme_dev->sd.internal_ops = &cam_lrme_subdev_internal_ops;
+	g_lrme_dev->sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	mutex_init(&g_lrme_dev->lock);
+
+	rc = cam_subdev_probe(&g_lrme_dev->sd, pdev, CAM_LRME_DEV_NAME,
+		CAM_LRME_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "LRME cam_subdev_probe failed");
+		goto free_mem;
+	}
+	node = (struct cam_node *)g_lrme_dev->sd.token;
+
+	rc = cam_lrme_hw_mgr_init(&hw_mgr_intf, cam_lrme_dev_buf_done_cb);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Can not initialized LRME HW manager");
+		goto unregister;
+	}
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_lrme_context_init(&g_lrme_dev->lrme_ctx[i],
+				&g_lrme_dev->ctx[i],
+				&node->hw_mgr_intf, i, -1);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "LRME context init failed");
+			goto deinit_ctx;
+		}
+	}
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_lrme_dev->ctx, CAM_CTX_MAX,
+		CAM_LRME_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "LRME node init failed");
+		goto deinit_ctx;
+	}
+
+	node->sd_handler = cam_lrme_dev_close_internal;
+	rc = cam_subdev_register(&g_lrme_dev->sd, pdev);
+	CAM_DBG(CAM_LRME, "Component bound successfully");
+
+	return rc;
+
+deinit_ctx:
+	for (--i; i >= 0; i--) {
+		if (cam_lrme_context_deinit(&g_lrme_dev->lrme_ctx[i]))
+			CAM_ERR(CAM_LRME, "LRME context %d deinit failed", i);
+	}
+unregister:
+	if (cam_subdev_remove(&g_lrme_dev->sd))
+		CAM_ERR(CAM_LRME, "Failed in subdev remove");
+free_mem:
+	kfree(g_lrme_dev);
+
+	return rc;
+}
+
+static void cam_lrme_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+	int rc = 0;
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_lrme_context_deinit(&g_lrme_dev->lrme_ctx[i]);
+		if (rc)
+			CAM_ERR(CAM_LRME, "LRME context %d deinit failed", i);
+	}
+
+	rc = cam_lrme_hw_mgr_deinit();
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed in hw mgr deinit, rc=%d", rc);
+
+	rc = cam_unregister_subdev(&g_lrme_dev->sd);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Unregister failed rc: %d", rc);
+
+	rc = cam_subdev_remove(&g_lrme_dev->sd);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Subdev remove failed rc: %d", rc);
+
+	mutex_destroy(&g_lrme_dev->lock);
+	kfree(g_lrme_dev);
+	g_lrme_dev = NULL;
+}
+
+const static struct component_ops cam_lrme_component_ops = {
+	.bind = cam_lrme_component_bind,
+	.unbind = cam_lrme_component_unbind,
+};
+
+static int cam_lrme_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Adding LRME component");
+	rc = component_add(&pdev->dev, &cam_lrme_component_ops);
+	if (rc)
+		CAM_ERR(CAM_LRME, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_lrme_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_lrme_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_lrme_dt_match[] = {
+	{
+		.compatible = "qcom,cam-lrme"
+	},
+	{}
+};
+
+struct platform_driver cam_lrme_driver = {
+	.probe = cam_lrme_dev_probe,
+	.remove = cam_lrme_dev_remove,
+	.driver = {
+		.name = "cam_lrme",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_lrme_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_lrme_dev_init_module(void)
+{
+	return platform_driver_register(&cam_lrme_driver);
+}
+
+void cam_lrme_dev_exit_module(void)
+{
+	platform_driver_unregister(&cam_lrme_driver);
+}
+
+MODULE_DESCRIPTION("MSM LRME driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/cam_lrme_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/cam_lrme_dev.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_DEV_H_
+#define _CAM_LRME_DEV_H_
+
+/**
+ * @brief : API to register LRME dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_lrme_dev_init_module(void);
+
+/**
+ * @brief : API to remove LRME dev from platform framework.
+ */
+void cam_lrme_dev_exit_module(void);
+
+#endif /* _CAM_LRME_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
@@ -0,0 +1,1230 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_sync.h>
+
+#include "cam_io_util.h"
+#include "cam_soc_util.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_smmu_api.h"
+#include "cam_packet_util.h"
+#include "cam_lrme_context.h"
+#include "cam_lrme_hw_intf.h"
+#include "cam_lrme_hw_core.h"
+#include "cam_lrme_hw_soc.h"
+#include "cam_lrme_hw_mgr_intf.h"
+#include "cam_lrme_hw_mgr.h"
+
+static struct cam_lrme_hw_mgr g_lrme_hw_mgr;
+
+static int cam_lrme_mgr_util_reserve_device(struct cam_lrme_hw_mgr *hw_mgr,
+	struct cam_lrme_acquire_args *lrme_acquire_args)
+{
+	int i, index = 0;
+	uint32_t min_ctx = UINT_MAX;
+	struct cam_lrme_device *hw_device = NULL;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (!hw_mgr->device_count) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_LRME, "No device is registered");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < hw_mgr->device_count && i < CAM_LRME_HW_MAX; i++) {
+		hw_device = &hw_mgr->hw_device[i];
+		if (!hw_device->num_context) {
+			index = i;
+			break;
+		}
+		if (hw_device->num_context < min_ctx) {
+			min_ctx = hw_device->num_context;
+			index = i;
+		}
+	}
+
+	hw_device = &hw_mgr->hw_device[index];
+	hw_device->num_context++;
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_LRME, "reserve device index %d", index);
+
+	return index;
+}
+
+static int cam_lrme_mgr_util_get_device(struct cam_lrme_hw_mgr *hw_mgr,
+	uint32_t device_index, struct cam_lrme_device **hw_device)
+{
+	if (!hw_mgr) {
+		CAM_ERR(CAM_LRME, "invalid params hw_mgr %pK", hw_mgr);
+		return -EINVAL;
+	}
+
+	if (device_index >= CAM_LRME_HW_MAX) {
+		CAM_ERR(CAM_LRME, "Wrong device index %d", device_index);
+		return -EINVAL;
+	}
+
+	*hw_device = &hw_mgr->hw_device[device_index];
+
+	return 0;
+}
+
+static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet,
+	size_t remain_len)
+{
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	int i, rc;
+
+	if (!packet) {
+		CAM_ERR(CAM_LRME, "Invalid args");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_LRME, "Packet request=%d, op_code=0x%x, size=%d, flags=%d",
+		packet->header.request_id, packet->header.op_code,
+		packet->header.size, packet->header.flags);
+	CAM_DBG(CAM_LRME,
+		"Packet cmdbuf(offset=%d, num=%d) io(offset=%d, num=%d)",
+		packet->cmd_buf_offset, packet->num_cmd_buf,
+		packet->io_configs_offset, packet->num_io_configs);
+	CAM_DBG(CAM_LRME,
+		"Packet Patch(offset=%d, num=%d) kmd(offset=%d, num=%d)",
+		packet->patch_offset, packet->num_patches,
+		packet->kmd_cmd_buf_offset, packet->kmd_cmd_buf_index);
+
+	if (cam_packet_util_validate_packet(packet, remain_len)) {
+		CAM_ERR(CAM_LRME, "invalid packet:%d %d %d %d %d",
+			packet->kmd_cmd_buf_index,
+			packet->num_cmd_buf, packet->cmd_buf_offset,
+			packet->io_configs_offset, packet->header.size);
+		return -EINVAL;
+	}
+
+	if (!packet->num_io_configs) {
+		CAM_ERR(CAM_LRME, "no io configs");
+		return -EINVAL;
+	}
+
+	if (!packet->num_cmd_buf) {
+		CAM_ERR(CAM_LRME, "no cmd bufs");
+		return -EINVAL;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *)((uint8_t *)&packet->payload_flex +
+		packet->cmd_buf_offset);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		CAM_DBG(CAM_LRME,
+			"CmdBuf[%d] hdl=%d, offset=%d, size=%d, len=%d, type=%d, meta_data=%d",
+			i,
+			cmd_desc[i].mem_handle, cmd_desc[i].offset,
+			cmd_desc[i].size, cmd_desc[i].length, cmd_desc[i].type,
+			cmd_desc[i].meta_data);
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Invalid cmd buffer %d", i);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_lrme_hw_io_buffer *input_buf,
+	struct cam_lrme_hw_io_buffer *output_buf, uint32_t io_buf_size,
+	struct list_head *buf_tracker)
+{
+	int rc = -EINVAL;
+	uint32_t num_in_buf, num_out_buf, i, j, plane;
+	struct cam_buf_io_cfg *io_cfg;
+	dma_addr_t io_addr[CAM_PACKET_MAX_PLANES];
+	size_t size;
+
+	num_in_buf = 0;
+	num_out_buf = 0;
+	io_cfg = (struct cam_buf_io_cfg *)((uint8_t *)
+		 &prepare->packet->payload_flex +
+		 prepare->packet->io_configs_offset);
+
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		CAM_DBG(CAM_LRME,
+			"IOConfig[%d] : handle[%d] Dir[%d] Res[%d] Fence[%d], Format[%d]",
+			i, io_cfg[i].mem_handle[0], io_cfg[i].direction,
+			io_cfg[i].resource_type,
+			io_cfg[i].fence, io_cfg[i].format);
+
+		memset(io_addr, 0, sizeof(io_addr));
+		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {
+			if (!io_cfg[i].mem_handle[plane])
+				break;
+
+			rc = cam_mem_get_io_buf(io_cfg[i].mem_handle[plane],
+				iommu_hdl, &io_addr[plane], &size, NULL, buf_tracker);
+			if (rc) {
+				CAM_ERR(CAM_LRME, "Cannot get io buf for %d %d",
+					plane, rc);
+				return -ENOMEM;
+			}
+
+			if ((size_t)io_cfg[i].offsets[plane] >= size) {
+				CAM_ERR(CAM_LRME, "Invalid plane offset: %zu",
+					(size_t)io_cfg[i].offsets[plane]);
+				return -EINVAL;
+			}
+
+			io_addr[plane] += io_cfg[i].offsets[plane];
+
+			CAM_DBG(CAM_LRME, "IO Address[%d][%d] : %llu",
+				io_cfg[i].direction, plane, io_addr[plane]);
+		}
+
+		switch (io_cfg[i].direction) {
+		case CAM_BUF_INPUT: {
+			if (num_in_buf >= io_buf_size) {
+				CAM_ERR(CAM_LRME,
+					"Invalid number of buffers %d %d %d",
+					num_in_buf, num_out_buf, io_buf_size);
+				return -EINVAL;
+			}
+			prepare->in_map_entries[num_in_buf].resource_handle =
+				io_cfg[i].resource_type;
+			prepare->in_map_entries[num_in_buf].sync_id =
+				io_cfg[i].fence;
+
+			input_buf[num_in_buf].valid = true;
+			for (j = 0; j < plane; j++)
+				input_buf[num_in_buf].io_addr[j] = io_addr[j];
+			input_buf[num_in_buf].num_plane = plane;
+			input_buf[num_in_buf].io_cfg = &io_cfg[i];
+
+			num_in_buf++;
+			break;
+		}
+		case CAM_BUF_OUTPUT: {
+			if (num_out_buf >= io_buf_size) {
+				CAM_ERR(CAM_LRME,
+					"Invalid number of buffers %d %d %d",
+					num_in_buf, num_out_buf, io_buf_size);
+				return -EINVAL;
+			}
+			prepare->out_map_entries[num_out_buf].resource_handle =
+				io_cfg[i].resource_type;
+			prepare->out_map_entries[num_out_buf].sync_id =
+				io_cfg[i].fence;
+
+			output_buf[num_out_buf].valid = true;
+			for (j = 0; j < plane; j++)
+				output_buf[num_out_buf].io_addr[j] = io_addr[j];
+			output_buf[num_out_buf].num_plane = plane;
+			output_buf[num_out_buf].io_cfg = &io_cfg[i];
+
+			num_out_buf++;
+			break;
+		}
+		default:
+			CAM_ERR(CAM_LRME, "Unsupported io direction %d",
+				io_cfg[i].direction);
+			return -EINVAL;
+		}
+	}
+	prepare->num_in_map_entries = num_in_buf;
+	prepare->num_out_map_entries = num_out_buf;
+
+	return 0;
+}
+
+static int cam_lrme_mgr_util_prepare_hw_update_entries(
+	struct cam_lrme_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_lrme_hw_cmd_config_args *config_args,
+	struct cam_kmd_buf_info *kmd_buf_info)
+{
+	int i, rc = 0;
+	struct cam_lrme_device *hw_device = NULL;
+	uint32_t *kmd_buf_addr;
+	uint32_t num_entry;
+	uint32_t kmd_buf_max_size;
+	uint32_t kmd_buf_used_bytes = 0;
+	struct cam_hw_update_entry *hw_entry;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+
+	hw_device = config_args->hw_device;
+	if (!hw_device) {
+		CAM_ERR(CAM_LRME, "Invalid hw_device");
+		return -EINVAL;
+	}
+
+	kmd_buf_addr = (uint32_t *)((uint8_t *)kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes);
+	kmd_buf_max_size = kmd_buf_info->size - kmd_buf_info->used_bytes;
+
+	config_args->cmd_buf_addr = kmd_buf_addr;
+	config_args->size = kmd_buf_max_size;
+	config_args->config_buf_size = 0;
+
+	if (hw_device->hw_intf.hw_ops.process_cmd) {
+		rc = hw_device->hw_intf.hw_ops.process_cmd(
+			hw_device->hw_intf.hw_priv,
+			CAM_LRME_HW_CMD_PREPARE_HW_UPDATE,
+			config_args,
+			sizeof(struct cam_lrme_hw_cmd_config_args));
+		if (rc) {
+			CAM_ERR(CAM_LRME,
+				"Failed in CMD_PREPARE_HW_UPDATE %d", rc);
+			return rc;
+		}
+	} else {
+		CAM_ERR(CAM_LRME, "Can't find handle function");
+		return -EINVAL;
+	}
+
+	kmd_buf_used_bytes += config_args->config_buf_size;
+
+	if (!kmd_buf_used_bytes || (kmd_buf_used_bytes > kmd_buf_max_size)) {
+		CAM_ERR(CAM_LRME, "Invalid kmd used bytes %d (%d)",
+			kmd_buf_used_bytes, kmd_buf_max_size);
+		return -ENOMEM;
+	}
+
+	hw_entry = prepare->hw_update_entries;
+	num_entry = 0;
+
+	if (config_args->config_buf_size) {
+		if ((num_entry + 1) >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_LRME, "Insufficient  HW entries :%d %d",
+				num_entry, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		hw_entry[num_entry].handle = kmd_buf_info->handle;
+		hw_entry[num_entry].len = config_args->config_buf_size;
+		hw_entry[num_entry].offset = kmd_buf_info->offset;
+
+		kmd_buf_info->used_bytes += config_args->config_buf_size;
+		kmd_buf_info->offset += config_args->config_buf_size;
+		num_entry++;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *)((uint8_t *)
+		&prepare->packet->payload_flex + prepare->packet->cmd_buf_offset);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		if ((num_entry + 1) >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_LRME, "Exceed max num of entry");
+			return -EINVAL;
+		}
+
+		hw_entry[num_entry].handle = cmd_desc[i].mem_handle;
+		hw_entry[num_entry].len = cmd_desc[i].length;
+		hw_entry[num_entry].offset = cmd_desc[i].offset;
+		num_entry++;
+	}
+	prepare->num_hw_update_entries = num_entry;
+
+	CAM_DBG(CAM_LRME, "FinalConfig : hw_entries=%d, Sync(in=%d, out=%d)",
+		prepare->num_hw_update_entries, prepare->num_in_map_entries,
+		prepare->num_out_map_entries);
+
+	return rc;
+}
+
+static void cam_lrme_mgr_util_put_frame_req(
+	struct list_head *src_list,
+	struct cam_lrme_frame_request *frame_req,
+	struct mutex *lock,
+	bool free_buffer)
+{
+	if (!frame_req) {
+		CAM_ERR(CAM_LRME, "Invalid frame_req");
+		return;
+	}
+
+	mutex_lock(lock);
+	if (free_buffer)
+		cam_mem_put_cpu_buf(frame_req->hw_update_entries[0]->handle)
+
+	list_add_tail(frame_req->frame_list, src_list);
+	mutex_unlock(lock);
+}
+
+static int cam_lrme_mgr_util_get_frame_req(
+	struct list_head *src_list,
+	struct cam_lrme_frame_request **frame_req,
+	struct mutex *lock)
+{
+	int rc = 0;
+	struct cam_lrme_frame_request *req_ptr = NULL;
+
+	mutex_lock(lock);
+	if (!list_empty(src_list)) {
+		req_ptr = list_first_entry(src_list,
+			struct cam_lrme_frame_request, frame_list);
+		list_del_init(&req_ptr->frame_list);
+	} else {
+		rc = -ENOENT;
+	}
+	*frame_req = req_ptr;
+	mutex_unlock(lock);
+
+	return rc;
+}
+
+
+static int cam_lrme_mgr_util_submit_req(void *priv, void *data)
+{
+	struct cam_lrme_device *hw_device;
+	struct cam_lrme_hw_mgr *hw_mgr;
+	struct cam_lrme_frame_request *frame_req = NULL;
+	struct cam_lrme_hw_submit_args submit_args;
+	struct cam_lrme_mgr_work_data *work_data;
+	int rc;
+	int req_prio = 0;
+
+	if (!priv) {
+		CAM_ERR(CAM_LRME, "worker doesn't have private data");
+		return -EINVAL;
+	}
+
+	hw_mgr = (struct cam_lrme_hw_mgr *)priv;
+	work_data = (struct cam_lrme_mgr_work_data *)data;
+	hw_device = work_data->hw_device;
+
+	rc = cam_lrme_mgr_util_get_frame_req(
+		&hw_device->frame_pending_list_high, &frame_req,
+		&hw_device->high_req_lock);
+
+	if (!frame_req) {
+		rc = cam_lrme_mgr_util_get_frame_req(
+			&hw_device->frame_pending_list_normal, &frame_req,
+			&hw_device->normal_req_lock);
+		if (frame_req)
+			req_prio = 1;
+	}
+
+	if (!frame_req) {
+		CAM_DBG(CAM_LRME, "No pending request");
+		return 0;
+	}
+
+	if (hw_device->hw_intf.hw_ops.process_cmd) {
+		submit_args.hw_update_entries = frame_req->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			frame_req->num_hw_update_entries;
+		submit_args.frame_req = frame_req;
+
+		rc = hw_device->hw_intf.hw_ops.process_cmd(
+			hw_device->hw_intf.hw_priv,
+			CAM_LRME_HW_CMD_SUBMIT,
+			&submit_args, sizeof(struct cam_lrme_hw_submit_args));
+
+		if (rc == -EBUSY)
+			CAM_DBG(CAM_LRME, "device busy");
+		else if (rc)
+			CAM_ERR(CAM_LRME, "submit request failed rc %d", rc);
+		if (rc) {
+			req_prio == 0 ? mutex_lock(&hw_device->high_req_lock) :
+				mutex_lock(&hw_device->normal_req_lock);
+			list_add(&frame_req->frame_list,
+				(req_prio == 0 ?
+				 &hw_device->frame_pending_list_high :
+				 &hw_device->frame_pending_list_normal));
+			req_prio == 0 ? mutex_unlock(&hw_device->high_req_lock) :
+				mutex_unlock(&hw_device->normal_req_lock);
+		}
+		if (rc == -EBUSY)
+			rc = 0;
+	} else {
+		req_prio == 0 ? mutex_lock(&hw_device->high_req_lock) :
+			mutex_lock(&hw_device->normal_req_lock);
+		list_add(&frame_req->frame_list,
+			(req_prio == 0 ?
+			 &hw_device->frame_pending_list_high :
+			 &hw_device->frame_pending_list_normal));
+		req_prio == 0 ? mutex_unlock(&hw_device->high_req_lock) :
+			mutex_unlock(&hw_device->normal_req_lock);
+		rc = -EINVAL;
+	}
+
+	CAM_DBG(CAM_LRME, "End of submit, rc %d", rc);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_util_schedule_frame_req(
+	struct cam_lrme_hw_mgr *hw_mgr, struct cam_lrme_device *hw_device)
+{
+	int rc = 0;
+	struct crm_workq_task *task;
+	struct cam_lrme_mgr_work_data *work_data;
+
+	task = cam_req_mgr_workq_get_task(hw_device->work);
+	if (!task) {
+		CAM_ERR(CAM_LRME, "Can not get task for worker");
+		return -ENOMEM;
+	}
+
+	work_data = (struct cam_lrme_mgr_work_data *)task->payload;
+	work_data->hw_device = hw_device;
+
+	task->process_cb = cam_lrme_mgr_util_submit_req;
+	CAM_DBG(CAM_LRME, "enqueue submit task");
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr, CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_util_release(struct cam_lrme_hw_mgr *hw_mgr,
+	uint32_t device_index)
+{
+	int rc = 0;
+	struct cam_lrme_device *hw_device;
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	hw_device->num_context--;
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_cb(void *data,
+	struct cam_lrme_hw_cb_args *cb_args)
+{
+	struct cam_lrme_hw_mgr *hw_mgr = &g_lrme_hw_mgr;
+	int rc = 0;
+	uint32_t evt_id = CAM_CTX_EVT_ID_ERROR;
+	struct cam_lrme_frame_request *frame_req;
+	struct cam_lrme_device *hw_device;
+
+	if (!data || !cb_args) {
+		CAM_ERR(CAM_LRME, "Invalid input args");
+		return -EINVAL;
+	}
+
+	hw_device = (struct cam_lrme_device *)data;
+	frame_req = cb_args->frame_req;
+
+	if (cb_args->cb_type & CAM_LRME_CB_PUT_FRAME) {
+		memset(frame_req, 0x0, sizeof(*frame_req));
+		INIT_LIST_HEAD(&frame_req->frame_list);
+		cam_lrme_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+				frame_req, &hw_mgr->free_req_lock, true);
+		cb_args->cb_type &= ~CAM_LRME_CB_PUT_FRAME;
+		frame_req = NULL;
+	}
+
+	if (cb_args->cb_type & CAM_LRME_CB_COMP_REG_UPDATE) {
+		cb_args->cb_type &= ~CAM_LRME_CB_COMP_REG_UPDATE;
+		CAM_DBG(CAM_LRME, "Reg update");
+	}
+
+	if (!frame_req)
+		return rc;
+
+	if (cb_args->cb_type & CAM_LRME_CB_BUF_DONE) {
+		cb_args->cb_type &= ~CAM_LRME_CB_BUF_DONE;
+		evt_id = CAM_CTX_EVT_ID_SUCCESS;
+	} else if (cb_args->cb_type & CAM_LRME_CB_ERROR) {
+		cb_args->cb_type &= ~CAM_LRME_CB_ERROR;
+		evt_id = CAM_CTX_EVT_ID_ERROR;
+	} else {
+		CAM_ERR(CAM_LRME, "Wrong cb type %d, req %lld",
+			cb_args->cb_type, frame_req->req_id);
+		return -EINVAL;
+	}
+
+	if (hw_mgr->event_cb) {
+		struct cam_hw_done_event_data buf_data;
+
+		buf_data.request_id = frame_req->req_id;
+		buf_data.evt_param = (cb_args->cb_type & CAM_LRME_CB_ERROR) ?
+			CAM_SYNC_LRME_EVENT_CB_ERROR :
+			CAM_SYNC_COMMON_EVENT_SUCCESS;
+		CAM_DBG(CAM_LRME, "frame req %llu, evt_id %d",
+			frame_req->req_id, evt_id);
+		rc = hw_mgr->event_cb(frame_req->ctxt_to_hw_map,
+			evt_id, &buf_data);
+	} else {
+		CAM_ERR(CAM_LRME, "No cb function");
+	}
+
+	memset(frame_req, 0x0, sizeof(*frame_req));
+	INIT_LIST_HEAD(&frame_req->frame_list);
+	cam_lrme_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+				&frame_req->frame_list,
+				&hw_mgr->free_req_lock, true);
+
+	rc = cam_lrme_mgr_util_schedule_frame_req(hw_mgr, hw_device);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_get_caps(void *hw_mgr_priv, void *hw_get_caps_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd *args = hw_get_caps_args;
+
+	if (sizeof(struct cam_lrme_query_cap_cmd) != args->size) {
+		CAM_ERR(CAM_LRME,
+			"sizeof(struct cam_query_cap_cmd) = %zu, args->size = %d",
+			sizeof(struct cam_query_cap_cmd), args->size);
+		return -EFAULT;
+	}
+
+	if (copy_to_user(u64_to_user_ptr(args->caps_handle),
+		&(hw_mgr->lrme_caps),
+		sizeof(struct cam_lrme_query_cap_cmd))) {
+		CAM_ERR(CAM_LRME, "copy to user failed");
+		return -EFAULT;
+	}
+
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_acquire(void *hw_mgr_priv, void *hw_acquire_args)
+{
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_acquire_args *args =
+		(struct cam_hw_acquire_args *)hw_acquire_args;
+	struct cam_lrme_acquire_args lrme_acquire_args;
+	uintptr_t device_index;
+
+	if (!hw_mgr_priv || !args) {
+		CAM_ERR(CAM_LRME,
+		"Invalid input params hw_mgr_priv %pK, acquire_args %pK",
+		hw_mgr_priv, args);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&lrme_acquire_args,
+		(void __user *)args->acquire_info,
+		sizeof(struct cam_lrme_acquire_args))) {
+		CAM_ERR(CAM_LRME, "Failed to copy acquire args from user");
+		return -EFAULT;
+	}
+
+	device_index = cam_lrme_mgr_util_reserve_device(hw_mgr,
+		&lrme_acquire_args);
+	CAM_DBG(CAM_LRME, "Get device id %llu", device_index);
+
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Get wrong device id %lu", device_index);
+		return -EINVAL;
+	}
+
+	/* device_index is the right 4 bit in ctxt_to_hw_map */
+	args->ctxt_to_hw_map = (void *)device_index;
+
+	return 0;
+}
+
+static int cam_lrme_mgr_hw_release(void *hw_mgr_priv, void *hw_release_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_release_args *args =
+		(struct cam_hw_release_args *)hw_release_args;
+	uint64_t device_index;
+
+	if (!hw_mgr_priv || !hw_release_args) {
+		CAM_ERR(CAM_LRME, "Invalid arguments %pK, %pK",
+			hw_mgr_priv, hw_release_args);
+		return -EINVAL;
+	}
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %llu", device_index);
+		return -EPERM;
+	}
+
+	rc = cam_lrme_mgr_util_release(hw_mgr, device_index);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed in release device, rc=%d", rc);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_dump(void *hw_mgr_priv, void *hw_dump_args)
+{
+	struct cam_hw_dump_args *dump_args = hw_dump_args;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_lrme_device *hw_device;
+	int rc = 0;
+	uint32_t device_index;
+	struct cam_lrme_hw_dump_args lrme_dump_args;
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(dump_args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_LRME, "Start device index %d", device_index);
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to get hw device");
+		return rc;
+	}
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&lrme_dump_args.cpu_addr,
+		&lrme_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+	lrme_dump_args.offset =  dump_args->offset;
+	lrme_dump_args.request_id = dump_args->request_id;
+
+	rc = hw_device->hw_intf.hw_ops.process_cmd(
+		hw_device->hw_intf.hw_priv,
+		CAM_LRME_HW_CMD_DUMP,
+		&lrme_dump_args,
+		sizeof(struct cam_lrme_hw_dump_args));
+	CAM_DBG(CAM_LRME, "Offset before %zu after %zu",
+		dump_args->offset, lrme_dump_args.offset);
+	dump_args->offset = lrme_dump_args.offset;
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_flush(void *hw_mgr_priv, void *hw_flush_args)
+{	int rc = 0, i;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_flush_args *args;
+	struct cam_lrme_device *hw_device;
+	struct cam_lrme_frame_request *frame_req = NULL, *req_to_flush = NULL;
+	struct cam_lrme_frame_request **req_list = NULL;
+	uint32_t device_index;
+	struct cam_lrme_hw_flush_args lrme_flush_args;
+	uint32_t priority;
+
+	if (!hw_mgr_priv || !hw_flush_args) {
+		CAM_ERR(CAM_LRME, "Invalid args %pK %pK",
+			hw_mgr_priv, hw_flush_args);
+		return -EINVAL;
+	}
+
+	args = (struct cam_hw_flush_args *)hw_flush_args;
+	device_index = ((uintptr_t)args->ctxt_to_hw_map & 0xF);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in getting device %d", rc);
+		goto end;
+	}
+
+	req_list = (struct cam_lrme_frame_request **)args->flush_req_pending;
+	for (i = 0; i < args->num_req_pending; i++) {
+		frame_req = req_list[i];
+		memset(frame_req, 0x0, sizeof(*frame_req));
+		cam_lrme_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+			&frame_req->frame_list, &hw_mgr->free_req_lock, true);
+	}
+
+	req_list = (struct cam_lrme_frame_request **)args->flush_req_active;
+	for (i = 0; i < args->num_req_active; i++) {
+		frame_req = req_list[i];
+		priority = CAM_LRME_DECODE_PRIORITY(args->ctxt_to_hw_map);
+		mutex_lock((priority == CAM_LRME_PRIORITY_HIGH) ?
+			&hw_device->high_req_lock :
+			&hw_device->normal_req_lock);
+		if (!list_empty(&frame_req->frame_list)) {
+			list_del_init(&frame_req->frame_list);
+			cam_lrme_mgr_util_put_frame_req(
+				&hw_mgr->frame_free_list,
+				&frame_req->frame_list,
+				&hw_mgr->free_req_lock, true);
+		} else
+			req_to_flush = frame_req;
+		mutex_unlock((priority == CAM_LRME_PRIORITY_HIGH) ?
+			&hw_device->high_req_lock :
+			&hw_device->normal_req_lock);
+	}
+	if (!req_to_flush)
+		goto end;
+	if (hw_device->hw_intf.hw_ops.flush) {
+		lrme_flush_args.ctxt_to_hw_map = req_to_flush->ctxt_to_hw_map;
+		lrme_flush_args.flush_type = args->flush_type;
+		lrme_flush_args.req_to_flush = req_to_flush;
+		rc = hw_device->hw_intf.hw_ops.flush(hw_device->hw_intf.hw_priv,
+			&lrme_flush_args,
+			sizeof(lrme_flush_args));
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Failed in HW Stop %d", rc);
+			goto end;
+		}
+	} else {
+		CAM_ERR(CAM_LRME, "No stop ops");
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+
+static int cam_lrme_mgr_hw_start(void *hw_mgr_priv, void *hw_start_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_start_args *args =
+		(struct cam_hw_start_args *)hw_start_args;
+	struct cam_lrme_device *hw_device;
+	uint32_t device_index;
+
+	if (!hw_mgr || !args) {
+		CAM_ERR(CAM_LRME, "Invalid input params");
+		return -EINVAL;
+	}
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_LRME, "Start device index %d", device_index);
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to get hw device");
+		return rc;
+	}
+
+	if (hw_device->hw_intf.hw_ops.start) {
+		rc = hw_device->hw_intf.hw_ops.start(
+			hw_device->hw_intf.hw_priv, NULL, 0);
+	} else {
+		CAM_ERR(CAM_LRME, "Invalid start function");
+		return -EINVAL;
+	}
+
+	rc = hw_device->hw_intf.hw_ops.process_cmd(
+			hw_device->hw_intf.hw_priv,
+			CAM_LRME_HW_CMD_DUMP_REGISTER,
+			&g_lrme_hw_mgr.debugfs_entry.dump_register,
+			sizeof(bool));
+
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_stop(void *hw_mgr_priv, void *stop_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_stop_args *args =
+		(struct cam_hw_stop_args *)stop_args;
+	struct cam_lrme_device *hw_device;
+	uint32_t device_index;
+
+	if (!hw_mgr_priv || !stop_args) {
+		CAM_ERR(CAM_LRME, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_LRME, "Stop device index %d", device_index);
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to get hw device");
+		return rc;
+	}
+
+	if (hw_device->hw_intf.hw_ops.stop) {
+		rc = hw_device->hw_intf.hw_ops.stop(
+			hw_device->hw_intf.hw_priv, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Failed in HW stop %d", rc);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_prepare_update(void *hw_mgr_priv,
+	void *hw_prepare_update_args)
+{
+	int rc = 0, i;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_prepare_update_args *args =
+		(struct cam_hw_prepare_update_args *)hw_prepare_update_args;
+	struct cam_lrme_device *hw_device;
+	struct cam_kmd_buf_info kmd_buf;
+	struct cam_lrme_hw_cmd_config_args config_args;
+	struct cam_lrme_frame_request *frame_req = NULL;
+	uint32_t device_index;
+
+	if (!hw_mgr_priv || !hw_prepare_update_args) {
+		CAM_ERR(CAM_LRME, "Invalid args %pK %pK",
+			hw_mgr_priv, hw_prepare_update_args);
+		return -EINVAL;
+	}
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in getting device %d", rc);
+		goto error;
+	}
+
+	rc = cam_lrme_mgr_util_packet_validate(args->packet, args->remain_len);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in packet validation %d", rc);
+		goto error;
+	}
+
+	rc = cam_packet_util_get_kmd_buffer(args->packet, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in get kmd buf buffer %d", rc);
+		goto error;
+	}
+
+	CAM_DBG(CAM_LRME,
+		"KMD Buf : hdl=%d, cpu_addr=%pK, offset=%d, size=%d, used=%d",
+		kmd_buf.handle, kmd_buf.cpu_addr, kmd_buf.offset,
+		kmd_buf.size, kmd_buf.used_bytes);
+
+	rc = cam_packet_util_process_patches(args->packet,
+		hw_mgr->device_iommu.non_secure, hw_mgr->device_iommu.secure, false);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Patch packet failed, rc=%d", rc);
+		return rc;
+	}
+
+	memset(&config_args, 0, sizeof(config_args));
+	config_args.hw_device = hw_device;
+
+	rc = cam_lrme_mgr_util_prepare_io_buffer(
+		hw_mgr->device_iommu.non_secure, args,
+		config_args.input_buf, config_args.output_buf,
+		CAM_LRME_MAX_IO_BUFFER, args->buf_tracker);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in prepare IO Buf %d", rc);
+		goto error;
+	}
+	/* Check port number */
+	if (args->num_in_map_entries == 0 || args->num_out_map_entries == 0) {
+		CAM_ERR(CAM_LRME, "Error in port number in %d, out %d",
+			args->num_in_map_entries, args->num_out_map_entries);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	rc = cam_lrme_mgr_util_prepare_hw_update_entries(hw_mgr, args,
+		&config_args, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in hw update entries %d", rc);
+		goto error;
+	}
+
+	rc = cam_lrme_mgr_util_get_frame_req(&hw_mgr->frame_free_list,
+		&frame_req, &hw_mgr->free_req_lock);
+	if (rc || !frame_req) {
+		CAM_ERR(CAM_LRME, "Can not get free frame request");
+		goto error;
+	}
+
+	frame_req->ctxt_to_hw_map = args->ctxt_to_hw_map;
+	frame_req->req_id = args->packet->header.request_id;
+	frame_req->hw_device = hw_device;
+	frame_req->num_hw_update_entries = args->num_hw_update_entries;
+	for (i = 0; i < args->num_hw_update_entries; i++)
+		frame_req->hw_update_entries[i] = args->hw_update_entries[i];
+
+	args->priv = frame_req;
+
+	CAM_DBG(CAM_LRME, "FramePrepare : Frame[%lld]", frame_req->req_id);
+
+	return 0;
+
+error:
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_config(void *hw_mgr_priv,
+	void *hw_config_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_config_args *args =
+		(struct cam_hw_config_args *)hw_config_args;
+	struct cam_lrme_frame_request *frame_req;
+	struct cam_lrme_device *hw_device = NULL;
+	enum cam_lrme_hw_mgr_ctx_priority priority;
+
+	if (!hw_mgr_priv || !hw_config_args) {
+		CAM_ERR(CAM_LRME, "Invalid arguments, hw_mgr %pK, config %pK",
+			hw_mgr_priv, hw_config_args);
+		return -EINVAL;
+	}
+
+	if (!args->num_hw_update_entries) {
+		CAM_ERR(CAM_LRME, "No hw update entries");
+		return -EINVAL;
+	}
+
+	frame_req = (struct cam_lrme_frame_request *)args->priv;
+	if (!frame_req) {
+		CAM_ERR(CAM_LRME, "No frame request");
+		return -EINVAL;
+	}
+
+	hw_device = frame_req->hw_device;
+	if (!hw_device)
+		return -EINVAL;
+
+	priority = CAM_LRME_DECODE_PRIORITY(args->ctxt_to_hw_map);
+	if (priority == CAM_LRME_PRIORITY_HIGH) {
+		cam_lrme_mgr_util_put_frame_req(
+			&hw_device->frame_pending_list_high,
+			&frame_req->frame_list, &hw_device->high_req_lock, false);
+	} else {
+		cam_lrme_mgr_util_put_frame_req(
+			&hw_device->frame_pending_list_normal,
+			&frame_req->frame_list, &hw_device->normal_req_lock, false);
+	}
+
+	CAM_DBG(CAM_LRME, "schedule req %llu", frame_req->req_id);
+	rc = cam_lrme_mgr_util_schedule_frame_req(hw_mgr, hw_device);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_create_debugfs_entry(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("lrme", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_ISP,"DebugFS could not create directory!");
+		return -ENOENT;
+	}
+	/* Store parent inode for cleanup in caller */
+	g_lrme_hw_mgr.debugfs_entry.dentry = dbgfileptr;
+
+	debugfs_create_bool("dump_register", 0644, g_lrme_hw_mgr.debugfs_entry.dentry,
+		&g_lrme_hw_mgr.debugfs_entry.dump_register);
+
+	return 0;
+}
+
+static void cam_req_mgr_process_workq_cam_lrme_device_submit_worker(
+	struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+int cam_lrme_mgr_register_device(
+	struct cam_hw_intf *lrme_hw_intf,
+	struct cam_iommu_handle *device_iommu,
+	struct cam_iommu_handle *cdm_iommu)
+{
+	struct cam_lrme_device *hw_device;
+	char buf[128];
+	int i, rc;
+
+	hw_device = &g_lrme_hw_mgr.hw_device[lrme_hw_intf->hw_idx];
+
+	g_lrme_hw_mgr.device_iommu = *device_iommu;
+	g_lrme_hw_mgr.cdm_iommu = *cdm_iommu;
+
+	memcpy(&hw_device->hw_intf, lrme_hw_intf, sizeof(struct cam_hw_intf));
+
+	mutex_init(&hw_device->high_req_lock);
+	mutex_init(&hw_device->normal_req_lock);
+	INIT_LIST_HEAD(&hw_device->frame_pending_list_high);
+	INIT_LIST_HEAD(&hw_device->frame_pending_list_normal);
+
+	rc = snprintf(buf, sizeof(buf), "cam_lrme_device_submit_worker%d",
+		lrme_hw_intf->hw_idx);
+	CAM_DBG(CAM_LRME, "Create submit workq for %s", buf);
+	rc = cam_req_mgr_workq_create(buf,
+		CAM_LRME_WORKQ_NUM_TASK,
+		&hw_device->work, CRM_WORKQ_USAGE_NON_IRQ, 0,
+		cam_req_mgr_process_workq_cam_lrme_device_submit_worker);
+	if (rc) {
+		CAM_ERR(CAM_LRME,
+			"Unable to create a worker, rc=%d", rc);
+		return rc;
+	}
+
+	for (i = 0; i < CAM_LRME_WORKQ_NUM_TASK; i++)
+		hw_device->work->task.pool[i].payload =
+			&hw_device->work_data[i];
+
+	if (hw_device->hw_intf.hw_ops.process_cmd) {
+		struct cam_lrme_hw_cmd_set_cb cb_args;
+
+		cb_args.cam_lrme_hw_mgr_cb = cam_lrme_mgr_cb;
+		cb_args.data = hw_device;
+
+		rc = hw_device->hw_intf.hw_ops.process_cmd(
+			hw_device->hw_intf.hw_priv,
+			CAM_LRME_HW_CMD_REGISTER_CB,
+			&cb_args, sizeof(cb_args));
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Register cb failed");
+			goto destroy_workqueue;
+		}
+		CAM_DBG(CAM_LRME, "cb registered");
+	}
+
+	if (hw_device->hw_intf.hw_ops.get_hw_caps) {
+		rc = hw_device->hw_intf.hw_ops.get_hw_caps(
+			hw_device->hw_intf.hw_priv, &hw_device->hw_caps,
+			sizeof(hw_device->hw_caps));
+		if (rc)
+			CAM_ERR(CAM_LRME, "Get caps failed");
+	} else {
+		CAM_ERR(CAM_LRME, "No get_hw_caps function");
+		goto destroy_workqueue;
+	}
+	g_lrme_hw_mgr.lrme_caps.dev_caps[lrme_hw_intf->hw_idx] =
+		hw_device->hw_caps;
+	g_lrme_hw_mgr.device_count++;
+	g_lrme_hw_mgr.lrme_caps.device_iommu = g_lrme_hw_mgr.device_iommu;
+	g_lrme_hw_mgr.lrme_caps.cdm_iommu = g_lrme_hw_mgr.cdm_iommu;
+	g_lrme_hw_mgr.lrme_caps.num_devices = g_lrme_hw_mgr.device_count;
+
+	hw_device->valid = true;
+
+	CAM_DBG(CAM_LRME, "device registration done");
+	return 0;
+
+destroy_workqueue:
+	cam_req_mgr_workq_destroy(&hw_device->work);
+
+	return rc;
+}
+
+int cam_lrme_mgr_deregister_device(int device_index)
+{
+	struct cam_lrme_device *hw_device;
+
+	hw_device = &g_lrme_hw_mgr.hw_device[device_index];
+	cam_req_mgr_workq_destroy(&hw_device->work);
+	mutex_destroy(&hw_device->high_req_lock);
+	mutex_destroy(&hw_device->normal_req_lock);
+	memset(hw_device, 0x0, sizeof(struct cam_lrme_device));
+	g_lrme_hw_mgr.device_count--;
+
+	return 0;
+}
+
+int cam_lrme_hw_mgr_deinit(void)
+{
+	mutex_destroy(&g_lrme_hw_mgr.hw_mgr_mutex);
+	mutex_destroy(&g_lrme_hw_mgr.free_req_lock);
+	memset(&g_lrme_hw_mgr, 0x0, sizeof(g_lrme_hw_mgr));
+
+	return 0;
+}
+
+int cam_lrme_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf,
+	cam_hw_event_cb_func cam_lrme_dev_buf_done_cb)
+{
+	int i, rc = 0;
+	struct cam_lrme_frame_request *frame_req;
+
+	if (!hw_mgr_intf)
+		return -EINVAL;
+
+	CAM_DBG(CAM_LRME, "device count %d", g_lrme_hw_mgr.device_count);
+	if (g_lrme_hw_mgr.device_count > CAM_LRME_HW_MAX) {
+		CAM_ERR(CAM_LRME, "Invalid count of devices");
+		return -EINVAL;
+	}
+
+	memset(hw_mgr_intf, 0, sizeof(*hw_mgr_intf));
+
+	mutex_init(&g_lrme_hw_mgr.hw_mgr_mutex);
+	mutex_init(&g_lrme_hw_mgr.free_req_lock);
+	INIT_LIST_HEAD(&g_lrme_hw_mgr.frame_free_list);
+
+	/* Init hw mgr frame requests and add to free list */
+	for (i = 0; i < CAM_CTX_REQ_MAX * CAM_CTX_MAX; i++) {
+		frame_req = &g_lrme_hw_mgr.frame_req[i];
+
+		memset(frame_req, 0x0, sizeof(*frame_req));
+		INIT_LIST_HEAD(&frame_req->frame_list);
+
+		list_add_tail(&frame_req->frame_list,
+			&g_lrme_hw_mgr.frame_free_list);
+	}
+
+	hw_mgr_intf->hw_mgr_priv = &g_lrme_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_lrme_mgr_get_caps;
+	hw_mgr_intf->hw_acquire = cam_lrme_mgr_hw_acquire;
+	hw_mgr_intf->hw_release = cam_lrme_mgr_hw_release;
+	hw_mgr_intf->hw_start = cam_lrme_mgr_hw_start;
+	hw_mgr_intf->hw_stop = cam_lrme_mgr_hw_stop;
+	hw_mgr_intf->hw_prepare_update = cam_lrme_mgr_hw_prepare_update;
+	hw_mgr_intf->hw_config = cam_lrme_mgr_hw_config;
+	hw_mgr_intf->hw_read = NULL;
+	hw_mgr_intf->hw_write = NULL;
+	hw_mgr_intf->hw_close = NULL;
+	hw_mgr_intf->hw_flush = cam_lrme_mgr_hw_flush;
+
+	g_lrme_hw_mgr.event_cb = cam_lrme_dev_buf_done_cb;
+	hw_mgr_intf->hw_dump = cam_lrme_mgr_hw_dump;
+
+	cam_lrme_mgr_create_debugfs_entry();
+	CAM_DBG(CAM_LRME, "Hw mgr init done");
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.h
@@ -0,0 +1,127 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_MGR_H_
+#define _CAM_LRME_HW_MGR_H_
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include <media/cam_lrme.h>
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_lrme_hw_intf.h"
+#include "cam_context.h"
+
+#define CAM_LRME_HW_MAX 1
+#define CAM_LRME_WORKQ_NUM_TASK 10
+
+#define CAM_LRME_DECODE_DEVICE_INDEX(ctxt_to_hw_map) \
+	((uintptr_t)ctxt_to_hw_map & 0xF)
+
+#define CAM_LRME_DECODE_PRIORITY(ctxt_to_hw_map) \
+	(((uintptr_t)ctxt_to_hw_map & 0xF0) >> 4)
+
+#define CAM_LRME_DECODE_CTX_INDEX(ctxt_to_hw_map) \
+	((uint64_t)(uintptr_t)ctxt_to_hw_map >> CAM_LRME_CTX_INDEX_SHIFT)
+
+/**
+ * enum cam_lrme_hw_mgr_ctx_priority
+ *
+ * CAM_LRME_PRIORITY_HIGH   : High priority client
+ * CAM_LRME_PRIORITY_NORMAL : Normal priority client
+ */
+enum cam_lrme_hw_mgr_ctx_priority {
+	CAM_LRME_PRIORITY_HIGH,
+	CAM_LRME_PRIORITY_NORMAL,
+};
+
+/**
+ * struct cam_lrme_mgr_work_data : HW Mgr work data
+ *
+ * @hw_device                    : Pointer to the hw device
+ */
+struct cam_lrme_mgr_work_data {
+	struct cam_lrme_device *hw_device;
+};
+
+/**
+ * struct cam_lrme_debugfs_entry : debugfs entry struct
+ *
+ * @dentry                       : entry of debugfs
+ * @dump_register                : flag to dump registers
+ */
+struct cam_lrme_debugfs_entry {
+	struct dentry   *dentry;
+	bool             dump_register;
+};
+
+/**
+ * struct cam_lrme_device     : LRME HW device
+ *
+ * @hw_caps                   : HW device's capabilities
+ * @hw_intf                   : HW device's interface information
+ * @num_context               : Number of contexts using this device
+ * @valid                     : Whether this device is valid
+ * @work                      : HW device's work queue
+ * @work_data                 : HW device's work data
+ * @frame_pending_list_high   : High priority request queue
+ * @frame_pending_list_normal : Normal priority request queue
+ * @high_req_lock             : mutex of high priority queue
+ * @normal_req_lock           : mutex of normal priority queue
+ */
+struct cam_lrme_device {
+	struct cam_lrme_dev_cap        hw_caps;
+	struct cam_hw_intf             hw_intf;
+	uint32_t                       num_context;
+	bool                           valid;
+	struct cam_req_mgr_core_workq *work;
+	struct cam_lrme_mgr_work_data  work_data[CAM_LRME_WORKQ_NUM_TASK];
+	struct list_head               frame_pending_list_high;
+	struct list_head               frame_pending_list_normal;
+	struct mutex                   high_req_lock;
+	struct mutex                   normal_req_lock;
+};
+
+/**
+ * struct cam_lrme_hw_mgr : LRME HW manager
+ *
+ * @device_count    : Number of HW devices
+ * @frame_free_list : List of free frame request
+ * @hw_mgr_mutex    : Mutex to protect HW manager data
+ * @free_req_lock   : Mutex to protect frame_free_list
+ * @hw_device       : List of HW devices
+ * @device_iommu    : Device iommu
+ * @cdm_iommu       : cdm iommu
+ * @frame_req       : List of frame request to use
+ * @lrme_caps       : LRME capabilities
+ * @event_cb        : IRQ callback function
+ * @debugfs_entry   : debugfs entry to set debug prop
+ */
+struct cam_lrme_hw_mgr {
+	uint32_t                      device_count;
+	struct list_head              frame_free_list;
+	struct mutex                  hw_mgr_mutex;
+	struct mutex                  free_req_lock;
+	struct cam_lrme_device        hw_device[CAM_LRME_HW_MAX];
+	struct cam_iommu_handle       device_iommu;
+	struct cam_iommu_handle       cdm_iommu;
+	struct cam_lrme_frame_request frame_req[CAM_CTX_REQ_MAX * CAM_CTX_MAX];
+	struct cam_lrme_query_cap_cmd lrme_caps;
+	cam_hw_event_cb_func          event_cb;
+	struct cam_lrme_debugfs_entry debugfs_entry;
+};
+
+int cam_lrme_mgr_register_device(struct cam_hw_intf *lrme_hw_intf,
+	struct cam_iommu_handle *device_iommu,
+	struct cam_iommu_handle *cdm_iommu);
+int cam_lrme_mgr_deregister_device(int device_index);
+
+#endif /* _CAM_LRME_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr_intf.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_MGR_INTF_H_
+#define _CAM_LRME_HW_MGR_INTF_H_
+
+#include <linux/of.h>
+
+#include "cam_debug_util.h"
+#include "cam_hw_mgr_intf.h"
+
+int cam_lrme_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf,
+	cam_hw_event_cb_func cam_lrme_dev_buf_done_cb);
+int cam_lrme_hw_mgr_deinit(void);
+
+#endif /* _CAM_LRME_HW_MGR_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.c
@@ -0,0 +1,1453 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/timer.h>
+#include "cam_lrme_hw_core.h"
+#include "cam_lrme_hw_soc.h"
+#include "cam_smmu_api.h"
+
+static void cam_lrme_dump_registers(void __iomem *base)
+{
+	/* dump the clc registers */
+	cam_io_dump(base, 0x60, (0xc0 - 0x60) / 0x4);
+	/* dump the fe and we registers */
+	cam_io_dump(base, 0x200, (0x29c - 0x200) / 0x4);
+	cam_io_dump(base, 0x2f0, (0x330 - 0x2f0) / 0x4);
+	cam_io_dump(base, 0x500, (0x5b4 - 0x500) / 0x4);
+	cam_io_dump(base, 0x700, (0x778 - 0x700) / 0x4);
+	cam_io_dump(base, 0x800, (0x878 - 0x800) / 0x4);
+	/* dump lrme sw registers, interrupts */
+	cam_io_dump(base, 0x900, (0x928 - 0x900) / 0x4);
+}
+
+static int  cam_lrme_dump_regs_to_buf(
+	struct cam_lrme_frame_request *req,
+	struct cam_hw_info *lrme_hw,
+	struct cam_lrme_hw_dump_args *dump_args)
+{
+	int                             i;
+	uint8_t                        *dst;
+	uint32_t                       *addr, *start;
+	uint32_t                        num_reg, min_len;
+	size_t                          remain_len;
+	struct cam_hw_soc_info         *soc_info;
+	struct cam_lrme_hw_dump_header *hdr;
+
+	if (!lrme_hw || !req || !dump_args) {
+		CAM_ERR(CAM_LRME, "Invalid params %pK, %pK, %pK",
+			lrme_hw, req, dump_args);
+		return -EINVAL;
+	}
+	soc_info = &lrme_hw->soc_info;
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_LRME, "dump buffer overshoot len %zu offset %zu",
+			dump_args->buf_len, dump_args->offset);
+		return -ENOSPC;
+	}
+	remain_len = dump_args->buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_lrme_hw_dump_header) +
+		    soc_info->reg_map[0].size + sizeof(uint32_t);
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_LRME, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_lrme_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_LRME_HW_DUMP_TAG_MAX_LEN,
+		"LRME_REG:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_lrme_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+	num_reg = soc_info->reg_map[0].size/4;
+	for (i = 0; i < num_reg; i++) {
+		*addr++ = soc_info->mem_block[0]->start + (i*4);
+		*addr++ = cam_io_r(soc_info->reg_map[0].mem_base + (i*4));
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_lrme_hw_dump_header);
+	CAM_DBG(CAM_LRME, "offset %zu", dump_args->offset);
+	return 0;
+}
+
+static int cam_lrme_hw_dump(
+	struct cam_hw_info           *lrme_hw,
+	struct cam_lrme_hw_dump_args *dump_args)
+{
+	uint8_t                        *dst;
+	ktime_t                         cur_time;
+	size_t                          remain_len;
+	uint32_t                        min_len;
+	uint64_t                        diff;
+	uint64_t                       *addr, *start;
+	struct timespec64               cur_ts;
+	struct timespec64               req_ts;
+	struct cam_lrme_core           *lrme_core;
+	struct cam_lrme_frame_request  *req = NULL;
+	struct cam_lrme_hw_dump_header *hdr;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+	if (lrme_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_DBG(CAM_LRME, "LRME HW is in off state");
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+
+	if (lrme_core->req_submit &&
+		lrme_core->req_submit->req_id == dump_args->request_id)
+		req = lrme_core->req_submit;
+	else if (lrme_core->req_proc &&
+		lrme_core->req_proc->req_id == dump_args->request_id)
+		req = lrme_core->req_proc;
+
+	if (!req) {
+		CAM_DBG(CAM_LRME, "LRME req %lld not with hw",
+			dump_args->request_id);
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	cur_time = ktime_get();
+	diff = ktime_us_delta(req->submit_timestamp, cur_time);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(req->submit_timestamp);
+
+	if (diff < CAM_LRME_RESPONSE_TIME_THRESHOLD) {
+		CAM_INFO(CAM_LRME,
+			"No error req %lld req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	CAM_INFO(CAM_LRME,
+		"Error req %lld req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_LRME, "dump buffer overshoot len %zu offset %zu",
+			dump_args->buf_len, dump_args->offset);
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	remain_len = dump_args->buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_lrme_hw_dump_header) +
+		    (CAM_LRME_HW_DUMP_NUM_WORDS * sizeof(uint64_t));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_LRME, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_lrme_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_LRME_HW_DUMP_TAG_MAX_LEN,
+		"LRME_REQ:");
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_lrme_hw_dump_header));
+	start = addr;
+	*addr++ = req->req_id;
+	*addr++ = req_ts.tv_sec;
+	*addr++ = req_ts.tv_nsec/NSEC_PER_USEC;
+	*addr++ = cur_ts.tv_sec;
+	*addr++ = cur_ts.tv_nsec/NSEC_PER_USEC;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_lrme_hw_dump_header);
+	cam_lrme_dump_regs_to_buf(req, lrme_hw, dump_args);
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return 0;
+}
+
+static void cam_lrme_cdm_write_reg_val_pair(uint32_t *buffer,
+	uint32_t *index, uint32_t reg_offset, uint32_t reg_value)
+{
+	buffer[(*index)++] = reg_offset;
+	buffer[(*index)++] = reg_value;
+}
+
+static void cam_lrme_hw_util_fill_fe_reg(struct cam_lrme_hw_io_buffer *io_buf,
+	uint32_t index, uint32_t *reg_val_pair, uint32_t *num_cmd,
+	struct cam_lrme_hw_info *hw_info)
+{
+	uint32_t reg_val;
+
+	/* 1. config buffer size */
+	if (io_buf->io_cfg->format == CAM_FORMAT_PLAIN16_10)
+		reg_val = io_buf->io_cfg->planes[0].width * 2;
+	else
+		reg_val = io_buf->io_cfg->planes[0].width;
+	reg_val |= (io_buf->io_cfg->planes[0].height << 16);
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_rd_reg.bus_client_reg[index].rd_buffer_size,
+		reg_val);
+
+	CAM_DBG(CAM_LRME,
+		"width %d", io_buf->io_cfg->planes[0].width);
+	CAM_DBG(CAM_LRME,
+		"height %d", io_buf->io_cfg->planes[0].height);
+
+	/* 2. config image address */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_rd_reg.bus_client_reg[index].addr_image,
+		io_buf->io_addr[0]);
+
+	CAM_DBG(CAM_LRME, "io addr %llu", io_buf->io_addr[0]);
+
+	/* 3. config stride */
+	reg_val = io_buf->io_cfg->planes[0].plane_stride;
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_rd_reg.bus_client_reg[index].rd_stride,
+		reg_val);
+
+	CAM_DBG(CAM_LRME, "plane_stride %d",
+		io_buf->io_cfg->planes[0].plane_stride);
+
+	/* 4. enable client */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_rd_reg.bus_client_reg[index].core_cfg, 0x1);
+
+	/* 5. unpack_cfg */
+	if (io_buf->io_cfg->format == CAM_FORMAT_PD10)
+		cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+			hw_info->bus_rd_reg.bus_client_reg[index].unpack_cfg_0,
+			0x0);
+	else if (io_buf->io_cfg->format == CAM_FORMAT_Y_ONLY ||
+			io_buf->io_cfg->format == CAM_FORMAT_PLAIN8 ||
+			io_buf->io_cfg->format == CAM_FORMAT_NV12 ||
+			io_buf->io_cfg->format == CAM_FORMAT_NV21)
+		cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+			hw_info->bus_rd_reg.bus_client_reg[index].unpack_cfg_0,
+			0x1);
+	else if (io_buf->io_cfg->format == CAM_FORMAT_PLAIN16_10)
+		cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+			hw_info->bus_rd_reg.bus_client_reg[index].unpack_cfg_0,
+			0x22);
+	else
+		CAM_ERR(CAM_LRME, "Unsupported format %d",
+			io_buf->io_cfg->format);
+}
+
+static void cam_lrme_hw_util_fill_we_reg(struct cam_lrme_hw_io_buffer *io_buf,
+	uint32_t index, uint32_t *reg_val_pair, uint32_t *num_cmd,
+	struct cam_lrme_hw_info *hw_info)
+{
+	/* config client mode */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].cfg,
+		0x1);
+
+	/* image address */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].addr_image,
+		io_buf->io_addr[0]);
+	CAM_DBG(CAM_LRME, "io addr %llu", io_buf->io_addr[0]);
+
+	/* buffer width and height */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].buffer_width_cfg,
+		io_buf->io_cfg->planes[0].width);
+	CAM_DBG(CAM_LRME, "width %d", io_buf->io_cfg->planes[0].width);
+
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].buffer_height_cfg,
+		io_buf->io_cfg->planes[0].height);
+	CAM_DBG(CAM_LRME, "height %d", io_buf->io_cfg->planes[0].height);
+
+	/* packer cfg */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].packer_cfg,
+		(index == 0) ? 0x1 : 0x5);
+
+	/* client stride */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].wr_stride,
+		io_buf->io_cfg->planes[0].plane_stride);
+	CAM_DBG(CAM_LRME, "plane_stride %d",
+		io_buf->io_cfg->planes[0].plane_stride);
+}
+
+
+static int cam_lrme_hw_util_process_config_hw(struct cam_hw_info *lrme_hw,
+	struct cam_lrme_hw_cmd_config_args *config_args)
+{
+	int i;
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_cdm_info *hw_cdm_info;
+	uint32_t *cmd_buf_addr = config_args->cmd_buf_addr;
+	uint32_t reg_val_pair[CAM_LRME_MAX_REG_PAIR_NUM];
+	struct cam_lrme_hw_io_buffer *io_buf;
+	struct cam_lrme_hw_info *hw_info =
+		((struct cam_lrme_core *)lrme_hw->core_info)->hw_info;
+	uint32_t num_cmd = 0;
+	uint32_t num_regval_pairs = 0;
+	uint32_t size;
+	uint32_t mem_base, available_size = config_args->size;
+	uint32_t output_res_mask = 0, input_res_mask = 0;
+
+
+	if (!cmd_buf_addr) {
+		CAM_ERR(CAM_LRME, "Invalid input args");
+		return -EINVAL;
+	}
+
+	hw_cdm_info =
+		((struct cam_lrme_core *)lrme_hw->core_info)->hw_cdm_info;
+
+	for (i = 0; i < CAM_LRME_MAX_IO_BUFFER; i++) {
+		io_buf = &config_args->input_buf[i];
+
+		if (io_buf->valid == false)
+			break;
+
+		if (io_buf->io_cfg->direction != CAM_BUF_INPUT) {
+			CAM_ERR(CAM_LRME, "Incorrect direction %d %d",
+				io_buf->io_cfg->direction, CAM_BUF_INPUT);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_LRME,
+			"resource_type %d", io_buf->io_cfg->resource_type);
+
+		switch (io_buf->io_cfg->resource_type) {
+		case CAM_LRME_IO_TYPE_TAR:
+			cam_lrme_hw_util_fill_fe_reg(io_buf, 0, reg_val_pair,
+				&num_cmd, hw_info);
+
+			input_res_mask |= CAM_LRME_INPUT_PORT_TYPE_TAR;
+			break;
+		case CAM_LRME_IO_TYPE_REF:
+			cam_lrme_hw_util_fill_fe_reg(io_buf, 1, reg_val_pair,
+				&num_cmd, hw_info);
+
+			input_res_mask |= CAM_LRME_INPUT_PORT_TYPE_REF;
+			break;
+		default:
+			CAM_ERR(CAM_LRME, "wrong resource_type %d",
+				io_buf->io_cfg->resource_type);
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < CAM_LRME_BUS_RD_MAX_CLIENTS; i++)
+		if (!((input_res_mask >> i) & 0x1))
+			cam_lrme_cdm_write_reg_val_pair(reg_val_pair, &num_cmd,
+				hw_info->bus_rd_reg.bus_client_reg[i].core_cfg,
+				0x0);
+
+	for (i = 0; i < CAM_LRME_MAX_IO_BUFFER; i++) {
+		io_buf = &config_args->output_buf[i];
+
+		if (io_buf->valid == false)
+			break;
+
+		if (io_buf->io_cfg->direction != CAM_BUF_OUTPUT) {
+			CAM_ERR(CAM_LRME, "Incorrect direction %d %d",
+				io_buf->io_cfg->direction, CAM_BUF_INPUT);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_LRME, "resource_type %d",
+			io_buf->io_cfg->resource_type);
+		switch (io_buf->io_cfg->resource_type) {
+		case CAM_LRME_IO_TYPE_DS2:
+			cam_lrme_hw_util_fill_we_reg(io_buf, 0, reg_val_pair,
+				&num_cmd, hw_info);
+
+			output_res_mask |= CAM_LRME_OUTPUT_PORT_TYPE_DS2;
+			break;
+		case CAM_LRME_IO_TYPE_RES:
+			cam_lrme_hw_util_fill_we_reg(io_buf, 1, reg_val_pair,
+				&num_cmd, hw_info);
+
+			output_res_mask |= CAM_LRME_OUTPUT_PORT_TYPE_RES;
+			break;
+
+		default:
+			CAM_ERR(CAM_LRME, "wrong resource_type %d",
+				io_buf->io_cfg->resource_type);
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < CAM_LRME_BUS_RD_MAX_CLIENTS; i++)
+		if (!((output_res_mask >> i) & 0x1))
+			cam_lrme_cdm_write_reg_val_pair(reg_val_pair, &num_cmd,
+				hw_info->bus_wr_reg.bus_client_reg[i].cfg, 0x0);
+
+	if (output_res_mask) {
+		/* write composite mask */
+		cam_lrme_cdm_write_reg_val_pair(reg_val_pair, &num_cmd,
+			hw_info->bus_wr_reg.common_reg.composite_mask_0,
+			output_res_mask);
+	}
+
+	size = hw_cdm_info->cdm_ops->cdm_required_size_changebase();
+	if ((size * 4) > available_size) {
+		CAM_ERR(CAM_LRME, "buf size:%d is not sufficient, expected: %d",
+			available_size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(soc_info, CAM_LRME_BASE_IDX);
+	if (mem_base == -1) {
+		CAM_ERR(CAM_LRME, "failed to get mem_base, index: %d num_reg_map: %u",
+			CAM_LRME_BASE_IDX, soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	hw_cdm_info->cdm_ops->cdm_write_changebase(cmd_buf_addr, mem_base);
+	cmd_buf_addr += size;
+	available_size -= (size * 4);
+
+	num_regval_pairs = num_cmd / 2;
+
+	if (num_regval_pairs) {
+		size = hw_cdm_info->cdm_ops->cdm_required_size_reg_random(
+			num_regval_pairs);
+
+		if ((size * 4) > available_size) {
+			CAM_ERR(CAM_LRME, "buf size:%d is not sufficient, expected: %d",
+				available_size, size);
+			return -ENOMEM;
+		}
+
+		hw_cdm_info->cdm_ops->cdm_write_regrandom(cmd_buf_addr,
+			num_regval_pairs, reg_val_pair);
+		cmd_buf_addr += size;
+		available_size -= (size * 4);
+
+	} else {
+		CAM_DBG(CAM_LRME, "No reg val pairs");
+	}
+
+	config_args->config_buf_size = config_args->size - available_size;
+
+	return 0;
+}
+
+static int cam_lrme_hw_util_submit_go(struct cam_hw_info *lrme_hw)
+{
+	struct cam_lrme_core *lrme_core;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_lrme_hw_info   *hw_info;
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	hw_info = lrme_core->hw_info;
+	soc_info = &lrme_hw->soc_info;
+
+	cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.cmd);
+
+	return 0;
+}
+
+static int cam_lrme_hw_util_reset(struct cam_hw_info *lrme_hw,
+	uint32_t reset_type)
+{
+	struct cam_lrme_core *lrme_core;
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_hw_info *hw_info;
+	long time_left;
+
+	lrme_core = lrme_hw->core_info;
+	hw_info = lrme_core->hw_info;
+
+	switch (reset_type) {
+	case CAM_LRME_HW_RESET_TYPE_HW_RESET:
+		reinit_completion(&lrme_core->reset_complete);
+		cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+			hw_info->titan_reg.top_rst_cmd);
+		time_left = cam_common_wait_for_completion_timeout(
+			&lrme_core->reset_complete,
+			msecs_to_jiffies(CAM_LRME_HW_RESET_TIMEOUT));
+		if (time_left <= 0) {
+			CAM_ERR(CAM_LRME,
+				"HW reset wait failed time_left=%ld",
+				time_left);
+			return -ETIMEDOUT;
+		}
+		break;
+	case CAM_LRME_HW_RESET_TYPE_SW_RESET:
+		cam_io_w_mb(0x3, soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.sw_reset);
+		cam_io_w_mb(0x3, soc_info->reg_map[0].mem_base +
+			hw_info->bus_rd_reg.common_reg.sw_reset);
+		reinit_completion(&lrme_core->reset_complete);
+		cam_io_w_mb(0x2, soc_info->reg_map[0].mem_base +
+			hw_info->titan_reg.top_rst_cmd);
+		time_left = cam_common_wait_for_completion_timeout(
+			&lrme_core->reset_complete,
+			msecs_to_jiffies(CAM_LRME_HW_RESET_TIMEOUT));
+		if (time_left <= 0) {
+			CAM_ERR(CAM_LRME,
+				"SW reset wait failed time_left=%ld",
+				time_left);
+			return -ETIMEDOUT;
+		}
+		break;
+	}
+
+	return 0;
+}
+
+int cam_lrme_hw_util_get_caps(struct cam_hw_info *lrme_hw,
+	struct cam_lrme_dev_cap *hw_caps)
+{
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_hw_info *hw_info =
+		((struct cam_lrme_core *)lrme_hw->core_info)->hw_info;
+	uint32_t reg_value;
+
+	if (!hw_info) {
+		CAM_ERR(CAM_LRME, "Invalid hw info data");
+		return -EINVAL;
+	}
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->clc_reg.clc_hw_version);
+	hw_caps->clc_hw_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->clc_hw_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->clc_hw_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.hw_version);
+	hw_caps->bus_rd_hw_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->bus_rd_hw_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->bus_rd_hw_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.hw_version);
+	hw_caps->bus_wr_hw_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->bus_wr_hw_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->bus_wr_hw_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_hw_version);
+	hw_caps->top_hw_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->top_hw_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->top_hw_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_titan_version);
+	hw_caps->top_titan_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->top_titan_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->top_titan_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	return 0;
+}
+
+static int cam_lrme_hw_util_submit_req(struct cam_lrme_core *lrme_core,
+	struct cam_lrme_frame_request *frame_req)
+{
+	struct cam_lrme_cdm_info *hw_cdm_info =
+		lrme_core->hw_cdm_info;
+	struct cam_cdm_bl_request *cdm_cmd = hw_cdm_info->cdm_cmd;
+	struct cam_hw_update_entry *cmd;
+	int i, rc = 0;
+
+	if (frame_req->num_hw_update_entries > 0) {
+		cdm_cmd->cmd_arrary_count = frame_req->num_hw_update_entries;
+		cdm_cmd->type = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+		cdm_cmd->flag = false;
+		cdm_cmd->userdata = NULL;
+		cdm_cmd->cookie = 0;
+		cdm_cmd->gen_irq_arb = false;
+
+		for (i = 0; i <= frame_req->num_hw_update_entries; i++) {
+			cmd = (frame_req->hw_update_entries + i);
+			cdm_cmd->cmd_flex[i].bl_addr.mem_handle = cmd->handle;
+			cdm_cmd->cmd_flex[i].offset = cmd->offset;
+			cdm_cmd->cmd_flex[i].len = cmd->len;
+			cdm_cmd->cmd_flex[i].arbitrate = false;
+		}
+
+		rc = cam_cdm_submit_bls(hw_cdm_info->cdm_handle, cdm_cmd);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Failed to submit cdm commands");
+			return -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_LRME, "No hw update entry");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_lrme_hw_util_flush_ctx(struct cam_hw_info *lrme_hw,
+	void *ctxt_to_hw_map)
+{
+	int rc = -ENODEV;
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	struct cam_lrme_hw_cb_args cb_args;
+	struct cam_lrme_frame_request *req_proc, *req_submit;
+	struct cam_lrme_hw_submit_args submit_args;
+
+	rc = cam_lrme_hw_util_reset(lrme_hw, CAM_LRME_HW_RESET_TYPE_HW_RESET);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "reset failed");
+		return rc;
+	}
+
+	lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+	req_proc = lrme_core->req_proc;
+	req_submit = lrme_core->req_submit;
+	lrme_core->req_proc = NULL;
+	lrme_core->req_submit = NULL;
+
+	if (req_submit && req_submit->ctxt_to_hw_map == ctxt_to_hw_map) {
+		cb_args.cb_type = CAM_LRME_CB_PUT_FRAME;
+		cb_args.frame_req = req_submit;
+		if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb)
+			lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+				lrme_core->hw_mgr_cb.data, &cb_args);
+	} else if (req_submit) {
+		submit_args.frame_req = req_submit;
+		submit_args.hw_update_entries = req_submit->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			req_submit->num_hw_update_entries;
+		rc = cam_lrme_hw_util_submit_req(lrme_core, req_submit);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Submit failed");
+		lrme_core->req_submit = req_submit;
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+	}
+
+	if (req_proc && req_proc->ctxt_to_hw_map == ctxt_to_hw_map) {
+		cb_args.cb_type = CAM_LRME_CB_PUT_FRAME;
+		cb_args.frame_req = req_proc;
+		if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb)
+			lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+				lrme_core->hw_mgr_cb.data, &cb_args);
+	} else if (req_proc) {
+		submit_args.frame_req = req_proc;
+		submit_args.hw_update_entries = req_proc->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			req_proc->num_hw_update_entries;
+		rc = cam_lrme_hw_util_submit_req(lrme_core, req_proc);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Submit failed");
+		lrme_core->req_submit = req_proc;
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+	}
+
+	return rc;
+}
+
+static int cam_lrme_hw_util_flush_req(struct cam_hw_info *lrme_hw,
+	struct cam_lrme_frame_request *req_to_flush)
+{
+	int rc = -ENODEV;
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	struct cam_lrme_hw_cb_args cb_args;
+	struct cam_lrme_frame_request *req_proc, *req_submit;
+	struct cam_lrme_hw_submit_args submit_args;
+
+	rc = cam_lrme_hw_util_reset(lrme_hw, CAM_LRME_HW_RESET_TYPE_HW_RESET);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "reset failed");
+		return rc;
+	}
+
+	lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+	req_proc = lrme_core->req_proc;
+	req_submit = lrme_core->req_submit;
+	lrme_core->req_proc = NULL;
+	lrme_core->req_submit = NULL;
+
+	if (req_submit && req_submit == req_to_flush) {
+		cb_args.cb_type = CAM_LRME_CB_PUT_FRAME;
+		cb_args.frame_req = req_submit;
+		if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb)
+			lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+				lrme_core->hw_mgr_cb.data, &cb_args);
+	} else if (req_submit) {
+		submit_args.frame_req = req_submit;
+		submit_args.hw_update_entries = req_submit->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			req_submit->num_hw_update_entries;
+		rc = cam_lrme_hw_util_submit_req(lrme_core, req_submit);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Submit failed");
+		lrme_core->req_submit = req_submit;
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+	}
+
+	if (req_proc && req_proc == req_to_flush) {
+		cb_args.cb_type = CAM_LRME_CB_PUT_FRAME;
+		cb_args.frame_req = req_proc;
+		if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb)
+			lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+				lrme_core->hw_mgr_cb.data, &cb_args);
+	} else if (req_proc) {
+		submit_args.frame_req = req_proc;
+		submit_args.hw_update_entries = req_proc->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			req_proc->num_hw_update_entries;
+		rc = cam_lrme_hw_util_submit_req(lrme_core, req_proc);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Submit failed");
+		lrme_core->req_submit = req_proc;
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+	}
+
+	return rc;
+}
+
+
+static int cam_lrme_hw_util_process_err(struct cam_hw_info *lrme_hw)
+{
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	struct cam_lrme_frame_request *req_proc, *req_submit;
+	struct cam_lrme_hw_cb_args cb_args;
+	int rc;
+
+	req_proc = lrme_core->req_proc;
+	req_submit = lrme_core->req_submit;
+	cb_args.cb_type = CAM_LRME_CB_ERROR;
+
+	if ((lrme_core->state != CAM_LRME_CORE_STATE_PROCESSING) &&
+		(lrme_core->state != CAM_LRME_CORE_STATE_REQ_PENDING) &&
+		(lrme_core->state != CAM_LRME_CORE_STATE_REQ_PROC_PEND)) {
+		CAM_ERR(CAM_LRME, "Get error irq in wrong state %d",
+			lrme_core->state);
+	}
+
+	cam_lrme_dump_registers(lrme_hw->soc_info.reg_map[0].mem_base);
+
+	CAM_ERR_RATE_LIMIT(CAM_LRME, "Start recovery");
+	lrme_core->state = CAM_LRME_CORE_STATE_RECOVERY;
+	rc = cam_lrme_hw_util_reset(lrme_hw, CAM_LRME_HW_RESET_TYPE_HW_RESET);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed to reset");
+
+	lrme_core->req_proc = NULL;
+	lrme_core->req_submit = NULL;
+	if (!rc)
+		lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+
+	cb_args.frame_req = req_proc;
+	lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(lrme_core->hw_mgr_cb.data,
+		&cb_args);
+
+	cb_args.frame_req = req_submit;
+	lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(lrme_core->hw_mgr_cb.data,
+		&cb_args);
+
+	return rc;
+}
+
+static int cam_lrme_hw_util_process_reg_update(
+	struct cam_hw_info *lrme_hw, struct cam_lrme_hw_cb_args *cb_args)
+{
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	int rc = 0;
+
+	cb_args->cb_type |= CAM_LRME_CB_COMP_REG_UPDATE;
+	if (lrme_core->state == CAM_LRME_CORE_STATE_REQ_PENDING) {
+		lrme_core->state = CAM_LRME_CORE_STATE_PROCESSING;
+	} else {
+		CAM_ERR(CAM_LRME, "Reg update in wrong state %d",
+			lrme_core->state);
+		rc = cam_lrme_hw_util_process_err(lrme_hw);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Failed to reset");
+		return -EINVAL;
+	}
+
+	lrme_core->req_proc = lrme_core->req_submit;
+	lrme_core->req_submit = NULL;
+
+	if (lrme_core->dump_flag)
+		cam_lrme_dump_registers(lrme_hw->soc_info.reg_map[0].mem_base);
+
+	return 0;
+}
+
+static int cam_lrme_hw_util_process_idle(
+	struct cam_hw_info *lrme_hw, struct cam_lrme_hw_cb_args *cb_args)
+{
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	int rc = 0;
+
+	cb_args->cb_type |= CAM_LRME_CB_BUF_DONE;
+	switch (lrme_core->state) {
+	case CAM_LRME_CORE_STATE_REQ_PROC_PEND:
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+		break;
+
+	case CAM_LRME_CORE_STATE_PROCESSING:
+		lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+		break;
+
+	default:
+		CAM_ERR(CAM_LRME, "Idle in wrong state %d",
+			lrme_core->state);
+		rc = cam_lrme_hw_util_process_err(lrme_hw);
+		return rc;
+	}
+	cb_args->frame_req = lrme_core->req_proc;
+	lrme_core->req_proc = NULL;
+
+	return 0;
+}
+
+void cam_lrme_set_irq(struct cam_hw_info *lrme_hw,
+	enum cam_lrme_irq_set set)
+{
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	struct cam_lrme_hw_info *hw_info = lrme_core->hw_info;
+
+	switch (set) {
+	case CAM_LRME_IRQ_ENABLE:
+		cam_io_w_mb(0xFFFF,
+			soc_info->reg_map[0].mem_base +
+			hw_info->titan_reg.top_irq_mask);
+		cam_io_w_mb(0xFFFFF,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.irq_mask_0);
+		cam_io_w_mb(0xFFFFF,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.irq_mask_1);
+		cam_io_w_mb(0xFFFFF,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_rd_reg.common_reg.irq_mask);
+		break;
+
+	case CAM_LRME_IRQ_DISABLE:
+		cam_io_w_mb(0x0,
+			soc_info->reg_map[0].mem_base +
+			hw_info->titan_reg.top_irq_mask);
+		cam_io_w_mb(0x0,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.irq_mask_0);
+		cam_io_w_mb(0x0,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.irq_mask_1);
+		cam_io_w_mb(0x0,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_rd_reg.common_reg.irq_mask);
+		break;
+	}
+}
+
+
+int cam_lrme_hw_process_irq(void *priv, void *data)
+{
+	struct cam_lrme_hw_work_data *work_data;
+	struct cam_hw_info *lrme_hw;
+	struct cam_lrme_core *lrme_core;
+	int rc = 0;
+	uint32_t top_irq_status, fe_irq_status;
+	uint32_t *we_irq_status;
+	struct cam_lrme_hw_cb_args cb_args;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_LRME, "Invalid data %pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	memset(&cb_args, 0, sizeof(struct cam_lrme_hw_cb_args));
+	lrme_hw = (struct cam_hw_info *)priv;
+	work_data = (struct cam_lrme_hw_work_data *)data;
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	top_irq_status = work_data->top_irq_status;
+	fe_irq_status = work_data->fe_irq_status;
+	we_irq_status = work_data->we_irq_status;
+
+	CAM_DBG(CAM_LRME,
+		"top status %x, fe status %x, we status0 %x, we status1 %x",
+		top_irq_status, fe_irq_status, we_irq_status[0],
+		we_irq_status[1]);
+	CAM_DBG(CAM_LRME, "Current state %d", lrme_core->state);
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_DBG(CAM_LRME, "LRME HW is in off state");
+		goto end;
+	}
+
+	if (top_irq_status & (1 << 3)) {
+		CAM_DBG(CAM_LRME, "Error");
+		rc = cam_lrme_hw_util_process_err(lrme_hw);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Process error failed");
+		goto end;
+	}
+
+	if (we_irq_status[0] & (1 << 1)) {
+		CAM_DBG(CAM_LRME, "reg update");
+		rc = cam_lrme_hw_util_process_reg_update(lrme_hw, &cb_args);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Process reg_update failed");
+			goto end;
+		}
+	}
+
+	if (top_irq_status & (1 << 4)) {
+		CAM_DBG(CAM_LRME, "IDLE");
+		if (!lrme_core->req_proc) {
+			CAM_DBG(CAM_LRME, "No frame request to process idle");
+			goto end;
+		}
+		rc = cam_lrme_hw_util_process_idle(lrme_hw, &cb_args);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Process idle failed");
+			goto end;
+		}
+	}
+
+	if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb) {
+		lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+			lrme_core->hw_mgr_cb.data, &cb_args);
+	} else {
+		CAM_ERR(CAM_LRME, "No hw mgr cb");
+		rc = -EINVAL;
+	}
+
+end:
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return rc;
+}
+
+int cam_lrme_hw_start(void *hw_priv, void *hw_start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = (struct cam_hw_info *)hw_priv;
+	int rc = 0;
+	struct cam_lrme_core *lrme_core;
+
+	if (!lrme_hw) {
+		CAM_ERR(CAM_LRME,
+			"Invalid input params, lrme_hw %pK",
+			lrme_hw);
+		return -EINVAL;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_hw->open_count > 0) {
+		lrme_hw->open_count++;
+		CAM_DBG(CAM_LRME, "This device is activated before");
+		goto unlock;
+	}
+
+	rc = cam_lrme_soc_enable_resources(lrme_hw);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to enable soc resources");
+		goto unlock;
+	}
+
+	rc = cam_lrme_hw_util_reset(lrme_hw, CAM_LRME_HW_RESET_TYPE_HW_RESET);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to reset hw");
+		goto disable_soc;
+	}
+
+	if (lrme_core->hw_cdm_info) {
+		struct cam_lrme_cdm_info *hw_cdm_info =
+			lrme_core->hw_cdm_info;
+
+		rc = cam_cdm_stream_on(hw_cdm_info->cdm_handle);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Failed to stream on cdm");
+			goto disable_soc;
+		}
+	}
+
+	lrme_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	lrme_hw->open_count++;
+	lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+
+	CAM_DBG(CAM_LRME, "open count %d", lrme_hw->open_count);
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return rc;
+
+disable_soc:
+	if (cam_lrme_soc_disable_resources(lrme_hw))
+		CAM_ERR(CAM_LRME, "Error in disable soc resources");
+unlock:
+	CAM_DBG(CAM_LRME, "open count %d", lrme_hw->open_count);
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return rc;
+}
+
+int cam_lrme_hw_stop(void *hw_priv, void *hw_stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = (struct cam_hw_info *)hw_priv;
+	int rc = 0;
+	struct cam_lrme_core *lrme_core;
+
+	if (!lrme_hw) {
+		CAM_ERR(CAM_LRME, "Invalid argument");
+		return -EINVAL;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_hw->open_count == 0 ||
+		lrme_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_ERR(CAM_LRME, "Error Unbalanced stop");
+		return -EINVAL;
+	}
+	lrme_hw->open_count--;
+
+	CAM_DBG(CAM_LRME, "open count %d", lrme_hw->open_count);
+
+	if (lrme_hw->open_count)
+		goto unlock;
+
+	lrme_core->req_proc = NULL;
+	lrme_core->req_submit = NULL;
+
+	if (lrme_core->hw_cdm_info) {
+		struct cam_lrme_cdm_info *hw_cdm_info =
+			lrme_core->hw_cdm_info;
+
+		rc = cam_cdm_stream_off(hw_cdm_info->cdm_handle);
+		if (rc) {
+			CAM_ERR(CAM_LRME,
+				"Failed in CDM StreamOff, handle=0x%x, rc=%d",
+				hw_cdm_info->cdm_handle, rc);
+			goto unlock;
+		}
+	}
+
+	rc = cam_lrme_soc_disable_resources(lrme_hw);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed in Disable SOC, rc=%d", rc);
+
+	lrme_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	if (lrme_core->state == CAM_LRME_CORE_STATE_IDLE) {
+		lrme_core->state = CAM_LRME_CORE_STATE_INIT;
+	} else {
+		CAM_ERR(CAM_LRME, "HW in wrong state %d", lrme_core->state);
+		rc = -EINVAL;
+	}
+
+unlock:
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return rc;
+}
+
+int cam_lrme_hw_submit_req(void *hw_priv, void *hw_submit_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_lrme_core *lrme_core;
+	struct cam_lrme_hw_submit_args *args =
+		(struct cam_lrme_hw_submit_args *)hw_submit_args;
+	int rc = 0;
+	struct cam_lrme_frame_request *frame_req;
+
+
+	if (!hw_priv || !hw_submit_args) {
+		CAM_ERR(CAM_LRME, "Invalid input");
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_lrme_hw_submit_args) != arg_size) {
+		CAM_ERR(CAM_LRME,
+			"size of args %zu, arg_size %d",
+			sizeof(struct cam_lrme_hw_submit_args), arg_size);
+		return -EINVAL;
+	}
+
+	frame_req = args->frame_req;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_hw->open_count == 0) {
+		CAM_ERR(CAM_LRME, "HW is not open");
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return -EINVAL;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	if (lrme_core->state != CAM_LRME_CORE_STATE_IDLE &&
+		lrme_core->state != CAM_LRME_CORE_STATE_PROCESSING) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_DBG(CAM_LRME, "device busy, can not submit, state %d",
+			lrme_core->state);
+		return -EBUSY;
+	}
+
+	if (lrme_core->req_submit != NULL) {
+		CAM_ERR(CAM_LRME, "req_submit is not NULL");
+		return -EBUSY;
+	}
+
+	rc = cam_lrme_hw_util_submit_req(lrme_core, frame_req);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Submit req failed");
+		goto error;
+	}
+
+	frame_req->submit_timestamp = ktime_get();
+
+	switch (lrme_core->state) {
+	case CAM_LRME_CORE_STATE_PROCESSING:
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PROC_PEND;
+		break;
+
+	case CAM_LRME_CORE_STATE_IDLE:
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+		break;
+
+	default:
+		CAM_ERR(CAM_LRME, "Wrong hw state");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	lrme_core->req_submit = frame_req;
+
+	mutex_unlock(&lrme_hw->hw_mutex);
+	CAM_DBG(CAM_LRME, "Release lock, submit done for req %llu",
+		frame_req->req_id);
+
+	return 0;
+
+error:
+	mutex_unlock(&lrme_hw->hw_mutex);
+
+	return rc;
+
+}
+
+int cam_lrme_hw_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = hw_priv;
+	struct cam_lrme_core *lrme_core;
+	struct cam_lrme_hw_reset_args *lrme_reset_args = reset_core_args;
+	int rc;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_LRME, "Invalid input args");
+		return -EINVAL;
+	}
+
+	if (!reset_core_args ||
+		sizeof(struct cam_lrme_hw_reset_args) != arg_size) {
+		CAM_ERR(CAM_LRME, "Invalid reset args");
+		return -EINVAL;
+	}
+
+	lrme_core = lrme_hw->core_info;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+	if (lrme_core->state == CAM_LRME_CORE_STATE_RECOVERY) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_ERR(CAM_LRME, "Reset not allowed in %d state",
+			lrme_core->state);
+		return -EINVAL;
+	}
+
+	lrme_core->state = CAM_LRME_CORE_STATE_RECOVERY;
+
+	rc = cam_lrme_hw_util_reset(lrme_hw, lrme_reset_args->reset_type);
+	if (rc) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_ERR(CAM_FD, "Failed to reset");
+		return rc;
+	}
+
+	lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+
+	mutex_unlock(&lrme_hw->hw_mutex);
+
+	return 0;
+}
+
+int cam_lrme_hw_flush(void *hw_priv, void *hw_flush_args, uint32_t arg_size)
+{
+	struct cam_lrme_core         *lrme_core = NULL;
+	struct cam_hw_info           *lrme_hw = hw_priv;
+	struct cam_lrme_hw_flush_args *flush_args =
+		(struct cam_lrme_hw_flush_args *)hw_flush_args;
+	int rc = -ENODEV;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_LRME, "Invalid arguments %pK", hw_priv);
+		return -EINVAL;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_core->state != CAM_LRME_CORE_STATE_PROCESSING &&
+		lrme_core->state != CAM_LRME_CORE_STATE_REQ_PENDING &&
+		lrme_core->state != CAM_LRME_CORE_STATE_REQ_PROC_PEND) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_DBG(CAM_LRME, "Flush is not needed in %d state",
+			lrme_core->state);
+		return 0;
+	}
+
+	if (!lrme_core->req_proc && !lrme_core->req_submit) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_DBG(CAM_LRME, "no req in device");
+		return 0;
+	}
+
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_ALL:
+		if ((!lrme_core->req_submit ||
+			lrme_core->req_submit->ctxt_to_hw_map !=
+			flush_args->ctxt_to_hw_map) &&
+			(!lrme_core->req_proc ||
+			lrme_core->req_proc->ctxt_to_hw_map !=
+			flush_args->ctxt_to_hw_map)) {
+			mutex_unlock(&lrme_hw->hw_mutex);
+			CAM_DBG(CAM_LRME, "hw running on different ctx");
+			return 0;
+		}
+		rc = cam_lrme_hw_util_flush_ctx(lrme_hw,
+			flush_args->ctxt_to_hw_map);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Flush all failed");
+		break;
+
+	case CAM_FLUSH_TYPE_REQ:
+		if ((!lrme_core->req_submit ||
+			lrme_core->req_submit != flush_args->req_to_flush) &&
+			(!lrme_core->req_proc ||
+			lrme_core->req_proc != flush_args->req_to_flush)) {
+			mutex_unlock(&lrme_hw->hw_mutex);
+			CAM_DBG(CAM_LRME, "hw running on different ctx");
+			return 0;
+		}
+		rc = cam_lrme_hw_util_flush_req(lrme_hw,
+			flush_args->req_to_flush);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Flush req failed");
+		break;
+
+	default:
+		CAM_ERR(CAM_LRME, "Unsupported flush type");
+		break;
+	}
+
+	mutex_unlock(&lrme_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_lrme_hw_get_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw;
+	struct cam_lrme_core *lrme_core;
+	struct cam_lrme_dev_cap *lrme_hw_caps =
+		(struct cam_lrme_dev_cap *)get_hw_cap_args;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_LRME, "Invalid input pointers %pK %pK",
+			hw_priv, get_hw_cap_args);
+		return -EINVAL;
+	}
+
+	lrme_hw = (struct cam_hw_info *)hw_priv;
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	*lrme_hw_caps = lrme_core->hw_caps;
+
+	return 0;
+}
+
+irqreturn_t cam_lrme_hw_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *lrme_hw;
+	struct cam_lrme_core *lrme_core;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_lrme_hw_info   *hw_info;
+	struct crm_workq_task *task;
+	struct cam_lrme_hw_work_data *work_data;
+	uint32_t top_irq_status, fe_irq_status, we_irq_status0, we_irq_status1;
+	int rc;
+
+	if (!data) {
+		CAM_ERR(CAM_LRME, "Invalid data in IRQ callback");
+		return IRQ_NONE;
+	}
+
+	lrme_hw = (struct cam_hw_info *)data;
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	soc_info = &lrme_hw->soc_info;
+	hw_info = lrme_core->hw_info;
+
+	top_irq_status = cam_io_r_mb(
+		soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_irq_status);
+	CAM_DBG(CAM_LRME, "top_irq_status %x", top_irq_status);
+	cam_io_w_mb(top_irq_status,
+		soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_irq_clear);
+	top_irq_status &= CAM_LRME_TOP_IRQ_MASK;
+
+	fe_irq_status = cam_io_r_mb(
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.irq_status);
+	CAM_DBG(CAM_LRME, "fe_irq_status %x", fe_irq_status);
+	cam_io_w_mb(fe_irq_status,
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.irq_clear);
+	fe_irq_status &= CAM_LRME_FE_IRQ_MASK;
+
+	we_irq_status0 = cam_io_r_mb(
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_status_0);
+	CAM_DBG(CAM_LRME, "we_irq_status[0] %x", we_irq_status0);
+	cam_io_w_mb(we_irq_status0,
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_clear_0);
+	we_irq_status0 &= CAM_LRME_WE_IRQ_MASK_0;
+
+	we_irq_status1 = cam_io_r_mb(
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_status_1);
+	CAM_DBG(CAM_LRME, "we_irq_status[1] %x", we_irq_status1);
+	cam_io_w_mb(we_irq_status1,
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_clear_1);
+	we_irq_status1 &= CAM_LRME_WE_IRQ_MASK_1;
+
+	cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_irq_cmd);
+	cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_cmd);
+	cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.irq_cmd);
+
+	if (top_irq_status & 0x1) {
+		complete(&lrme_core->reset_complete);
+		top_irq_status &= (~0x1);
+	}
+
+	if (top_irq_status || fe_irq_status ||
+		we_irq_status0 || we_irq_status1) {
+		task = cam_req_mgr_workq_get_task(lrme_core->work);
+		if (!task) {
+			CAM_ERR(CAM_LRME, "no empty task available");
+			return IRQ_NONE;
+		}
+		work_data = (struct cam_lrme_hw_work_data *)task->payload;
+		work_data->top_irq_status = top_irq_status;
+		work_data->fe_irq_status = fe_irq_status;
+		work_data->we_irq_status[0] = we_irq_status0;
+		work_data->we_irq_status[1] = we_irq_status1;
+		task->process_cb = cam_lrme_hw_process_irq;
+		rc = cam_req_mgr_workq_enqueue_task(task, data,
+			CRM_TASK_PRIORITY_0);
+		if (rc)
+			CAM_ERR(CAM_LRME,
+				"Failed in enqueue work task, rc=%d", rc);
+	}
+
+	return IRQ_HANDLED;
+}
+
+int cam_lrme_hw_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = (struct cam_hw_info *)hw_priv;
+	int rc = 0;
+
+	switch (cmd_type) {
+	case CAM_LRME_HW_CMD_PREPARE_HW_UPDATE: {
+		struct cam_lrme_hw_cmd_config_args *config_args;
+
+		config_args = (struct cam_lrme_hw_cmd_config_args *)cmd_args;
+		rc = cam_lrme_hw_util_process_config_hw(lrme_hw, config_args);
+		break;
+	}
+
+	case CAM_LRME_HW_CMD_REGISTER_CB: {
+		struct cam_lrme_hw_cmd_set_cb *cb_args;
+		struct cam_lrme_device *hw_device;
+		struct cam_lrme_core *lrme_core =
+			(struct cam_lrme_core *)lrme_hw->core_info;
+		cb_args = (struct cam_lrme_hw_cmd_set_cb *)cmd_args;
+		lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb =
+			cb_args->cam_lrme_hw_mgr_cb;
+		lrme_core->hw_mgr_cb.data = cb_args->data;
+		hw_device = cb_args->data;
+		rc = 0;
+		break;
+	}
+
+	case CAM_LRME_HW_CMD_SUBMIT: {
+		struct cam_lrme_hw_submit_args *submit_args;
+
+		submit_args = (struct cam_lrme_hw_submit_args *)cmd_args;
+		rc = cam_lrme_hw_submit_req(hw_priv,
+			submit_args, arg_size);
+		break;
+	}
+
+	case CAM_LRME_HW_CMD_DUMP_REGISTER: {
+		struct cam_lrme_core *lrme_core =
+			(struct cam_lrme_core *)lrme_hw->core_info;
+		lrme_core->dump_flag = *(bool *)cmd_args;
+		CAM_DBG(CAM_LRME, "dump_flag %d", lrme_core->dump_flag);
+		break;
+	}
+
+	case CAM_LRME_HW_CMD_DUMP: {
+		struct cam_lrme_hw_dump_args *dump_args =
+		   (struct cam_lrme_hw_dump_args *)cmd_args;
+		rc = cam_lrme_hw_dump(lrme_hw, dump_args);
+		break;
+		}
+	default:
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.h
@@ -0,0 +1,470 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_CORE_H_
+#define _CAM_LRME_HW_CORE_H_
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_defs.h>
+#include <media/cam_lrme.h>
+
+#include "cam_common_util.h"
+#include "cam_debug_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_lrme_hw_intf.h"
+#include "cam_lrme_hw_soc.h"
+#include "cam_req_mgr_workq.h"
+
+#define CAM_LRME_HW_RESET_TIMEOUT 3000
+
+#define CAM_LRME_BUS_RD_MAX_CLIENTS 2
+#define CAM_LRME_BUS_WR_MAX_CLIENTS 2
+
+#define CAM_LRME_HW_WORKQ_NUM_TASK 30
+
+#define CAM_LRME_TOP_IRQ_MASK          0x19
+#define CAM_LRME_WE_IRQ_MASK_0         0x2
+#define CAM_LRME_WE_IRQ_MASK_1         0x0
+#define CAM_LRME_FE_IRQ_MASK           0x0
+
+#define CAM_LRME_MAX_REG_PAIR_NUM 60
+
+#define CAM_LRME_RESPONSE_TIME_THRESHOLD 100000
+#define CAM_LRME_HW_DUMP_TAG_MAX_LEN     128
+#define CAM_LRME_HW_DUMP_NUM_WORDS       5
+
+/**
+ * enum cam_lrme_irq_set
+ *
+ * @CAM_LRME_IRQ_ENABLE  : Enable irqs
+ * @CAM_LRME_IRQ_DISABLE : Disable irqs
+ */
+enum cam_lrme_irq_set {
+	CAM_LRME_IRQ_ENABLE,
+	CAM_LRME_IRQ_DISABLE,
+};
+
+/**
+ * struct cam_lrme_cdm_info : information used to submit cdm command
+ *
+ * @cdm_handle      : CDM handle for this device
+ * @cdm_ops         : CDM ops
+ * @cdm_cmd         : CDM command pointer
+ */
+struct cam_lrme_cdm_info {
+	uint32_t                   cdm_handle;
+	struct cam_cdm_utils_ops  *cdm_ops;
+	struct cam_cdm_bl_request *cdm_cmd;
+};
+
+/**
+ * struct cam_lrme_hw_work_data : Work data for HW work queue
+ *
+ * @top_irq_status : Top registers irq status
+ * @fe_irq_status  : FE engine irq status
+ * @we_irq_status  : WE engine irq status
+ */
+struct cam_lrme_hw_work_data {
+	uint32_t                          top_irq_status;
+	uint32_t                          fe_irq_status;
+	uint32_t                          we_irq_status[2];
+};
+
+/**
+ *  enum cam_lrme_core_state : LRME core states
+ *
+ * @CAM_LRME_CORE_STATE_UNINIT        : LRME is in uninit state
+ * @CAM_LRME_CORE_STATE_INIT          : LRME is in init state after probe
+ * @ CAM_LRME_CORE_STATE_IDLE         : LRME is in idle state. Hardware is in
+ *                                      this state when no frame is processing
+ *                                      or waiting for this core.
+ * @CAM_LRME_CORE_STATE_REQ_PENDING   : LRME is in pending state. One frame is
+ *                                      waiting for processing
+ * @CAM_LRME_CORE_STATE_PROCESSING    : LRME is in processing state. HW manager
+ *                                      can submit one more frame to HW
+ * @CAM_LRME_CORE_STATE_REQ_PROC_PEND : Indicate two frames are inside HW.
+ * @CAM_LRME_CORE_STATE_RECOVERY      : Indicate core is in the process of reset
+ * @CAM_LRME_CORE_STATE_MAX           : upper limit of states
+ */
+enum cam_lrme_core_state {
+	CAM_LRME_CORE_STATE_UNINIT,
+	CAM_LRME_CORE_STATE_INIT,
+	CAM_LRME_CORE_STATE_IDLE,
+	CAM_LRME_CORE_STATE_REQ_PENDING,
+	CAM_LRME_CORE_STATE_PROCESSING,
+	CAM_LRME_CORE_STATE_REQ_PROC_PEND,
+	CAM_LRME_CORE_STATE_RECOVERY,
+	CAM_LRME_CORE_STATE_MAX,
+};
+
+/**
+ *  struct cam_lrme_core : LRME HW core information
+ *
+ * @hw_info        : Pointer to base HW information structure
+ * @device_iommu   : Device iommu handle
+ * @cdm_iommu      : CDM iommu handle
+ * @hw_caps        : Hardware capabilities
+ * @state          : Hardware state
+ * @reset_complete : Reset completion
+ * @work           : Hardware workqueue to handle irq events
+ * @work_data      : Work data used by hardware workqueue
+ * @hw_mgr_cb      : Hw manager callback
+ * @req_proc       : Pointer to the processing frame request
+ * @req_submit     : Pointer to the frame request waiting for processing
+ * @hw_cdm_info    : CDM information used by this device
+ * @hw_idx         : Hardware index
+ */
+struct cam_lrme_core {
+	struct cam_lrme_hw_info          *hw_info;
+	struct cam_iommu_handle           device_iommu;
+	struct cam_iommu_handle           cdm_iommu;
+	struct cam_lrme_dev_cap           hw_caps;
+	enum cam_lrme_core_state          state;
+	struct completion                 reset_complete;
+	struct cam_req_mgr_core_workq    *work;
+	struct cam_lrme_hw_work_data      work_data[CAM_LRME_HW_WORKQ_NUM_TASK];
+	struct cam_lrme_hw_cmd_set_cb     hw_mgr_cb;
+	struct cam_lrme_frame_request    *req_proc;
+	struct cam_lrme_frame_request    *req_submit;
+	struct cam_lrme_cdm_info         *hw_cdm_info;
+	uint32_t                          hw_idx;
+	bool                              dump_flag;
+};
+
+/**
+ * struct cam_lrme_bus_rd_reg_common : Offsets of FE common registers
+ *
+ * @hw_version    : Offset of hw_version register
+ * @hw_capability : Offset of hw_capability register
+ * @sw_reset      : Offset of sw_reset register
+ * @cgc_override  : Offset of cgc_override register
+ * @irq_mask      : Offset of irq_mask register
+ * @irq_clear     : Offset of irq_clear register
+ * @irq_cmd       : Offset of irq_cmd register
+ * @irq_status    : Offset of irq_status register
+ * @cmd           : Offset of cmd register
+ * @irq_set       : Offset of irq_set register
+ * @misr_reset    : Offset of misr_reset register
+ * @security_cfg  : Offset of security_cfg register
+ * @pwr_iso_cfg   : Offset of pwr_iso_cfg register
+ * @pwr_iso_seed  : Offset of pwr_iso_seed register
+ * @test_bus_ctrl : Offset of test_bus_ctrl register
+ * @spare         : Offset of spare register
+ */
+struct cam_lrme_bus_rd_reg_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t sw_reset;
+	uint32_t cgc_override;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_cmd;
+	uint32_t irq_status;
+	uint32_t cmd;
+	uint32_t irq_set;
+	uint32_t misr_reset;
+	uint32_t security_cfg;
+	uint32_t pwr_iso_cfg;
+	uint32_t pwr_iso_seed;
+	uint32_t test_bus_ctrl;
+	uint32_t spare;
+};
+
+/**
+ * struct cam_lrme_bus_wr_reg_common : Offset of WE common registers
+ * @hw_version        : Offset of hw_version register
+ * @hw_capability     : Offset of hw_capability register
+ * @sw_reset          : Offset of sw_reset register
+ * @cgc_override      : Offset of cgc_override register
+ * @misr_reset        : Offset of misr_reset register
+ * @pwr_iso_cfg       : Offset of pwr_iso_cfg register
+ * @test_bus_ctrl     : Offset of test_bus_ctrl register
+ * @composite_mask_0  : Offset of composite_mask_0 register
+ * @irq_mask_0        : Offset of irq_mask_0 register
+ * @irq_mask_1        : Offset of irq_mask_1 register
+ * @irq_clear_0       : Offset of irq_clear_0 register
+ * @irq_clear_1       : Offset of irq_clear_1 register
+ * @irq_status_0      : Offset of irq_status_0 register
+ * @irq_status_1      : Offset of irq_status_1 register
+ * @irq_cmd           : Offset of irq_cmd register
+ * @irq_set_0         : Offset of irq_set_0 register
+ * @irq_set_1         : Offset of irq_set_1 register
+ * @addr_fifo_status  : Offset of addr_fifo_status register
+ * @frame_header_cfg0 : Offset of frame_header_cfg0 register
+ * @frame_header_cfg1 : Offset of frame_header_cfg1 register
+ * @spare             : Offset of spare register
+ */
+struct cam_lrme_bus_wr_reg_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t sw_reset;
+	uint32_t cgc_override;
+	uint32_t misr_reset;
+	uint32_t pwr_iso_cfg;
+	uint32_t test_bus_ctrl;
+	uint32_t composite_mask_0;
+	uint32_t irq_mask_0;
+	uint32_t irq_mask_1;
+	uint32_t irq_clear_0;
+	uint32_t irq_clear_1;
+	uint32_t irq_status_0;
+	uint32_t irq_status_1;
+	uint32_t irq_cmd;
+	uint32_t irq_set_0;
+	uint32_t irq_set_1;
+	uint32_t addr_fifo_status;
+	uint32_t frame_header_cfg0;
+	uint32_t frame_header_cfg1;
+	uint32_t spare;
+};
+
+/**
+ * struct cam_lrme_bus_rd_bus_client : Offset of FE registers
+ *
+ * @core_cfg                : Offset of core_cfg register
+ * @ccif_meta_data          : Offset of ccif_meta_data register
+ * @addr_image              : Offset of addr_image register
+ * @rd_buffer_size          : Offset of rd_buffer_size register
+ * @rd_stride               : Offset of rd_stride register
+ * @unpack_cfg_0            : Offset of unpack_cfg_0 register
+ * @latency_buff_allocation : Offset of latency_buff_allocation register
+ * @burst_limit_cfg         : Offset of burst_limit_cfg register
+ * @misr_cfg_0              : Offset of misr_cfg_0 register
+ * @misr_cfg_1              : Offset of misr_cfg_1 register
+ * @misr_rd_val             : Offset of misr_rd_val register
+ * @debug_status_cfg        : Offset of debug_status_cfg register
+ * @debug_status_0          : Offset of debug_status_0 register
+ * @debug_status_1          : Offset of debug_status_1 register
+ */
+struct cam_lrme_bus_rd_bus_client {
+	uint32_t core_cfg;
+	uint32_t ccif_meta_data;
+	uint32_t addr_image;
+	uint32_t rd_buffer_size;
+	uint32_t rd_stride;
+	uint32_t unpack_cfg_0;
+	uint32_t latency_buff_allocation;
+	uint32_t burst_limit_cfg;
+	uint32_t misr_cfg_0;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_val;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+};
+
+/**
+ * struct cam_lrme_bus_wr_bus_client : Offset of WE registers
+ *
+ * @status_0                  : Offset of status_0 register
+ * @status_1                  : Offset of status_1 register
+ * @cfg                       : Offset of cfg register
+ * @addr_frame_header         : Offset of addr_frame_header register
+ * @frame_header_cfg          : Offset of frame_header_cfg register
+ * @addr_image                : Offset of addr_image register
+ * @addr_image_offset         : Offset of addr_image_offset register
+ * @buffer_width_cfg          : Offset of buffer_width_cfg register
+ * @buffer_height_cfg         : Offset of buffer_height_cfg register
+ * @packer_cfg                : Offset of packer_cfg register
+ * @wr_stride                 : Offset of wr_stride register
+ * @irq_subsample_cfg_period  : Offset of irq_subsample_cfg_period register
+ * @irq_subsample_cfg_pattern : Offset of irq_subsample_cfg_pattern register
+ * @burst_limit_cfg           : Offset of burst_limit_cfg register
+ * @misr_cfg                  : Offset of misr_cfg register
+ * @misr_rd_word_sel          : Offset of misr_rd_word_sel register
+ * @misr_val                  : Offset of misr_val register
+ * @debug_status_cfg          : Offset of debug_status_cfg register
+ * @debug_status_0            : Offset of debug_status_0 register
+ * @debug_status_1            : Offset of debug_status_1 register
+ */
+struct cam_lrme_bus_wr_bus_client {
+	uint32_t status_0;
+	uint32_t status_1;
+	uint32_t cfg;
+	uint32_t addr_frame_header;
+	uint32_t frame_header_cfg;
+	uint32_t addr_image;
+	uint32_t addr_image_offset;
+	uint32_t buffer_width_cfg;
+	uint32_t buffer_height_cfg;
+	uint32_t packer_cfg;
+	uint32_t wr_stride;
+	uint32_t irq_subsample_cfg_period;
+	uint32_t irq_subsample_cfg_pattern;
+	uint32_t burst_limit_cfg;
+	uint32_t misr_cfg;
+	uint32_t misr_rd_word_sel;
+	uint32_t misr_val;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+};
+
+/**
+ * struct cam_lrme_bus_rd_hw_info : FE registers information
+ *
+ * @common_reg     : FE common register
+ * @bus_client_reg : List of FE bus registers information
+ */
+struct cam_lrme_bus_rd_hw_info {
+	struct cam_lrme_bus_rd_reg_common common_reg;
+	struct cam_lrme_bus_rd_bus_client
+		bus_client_reg[CAM_LRME_BUS_RD_MAX_CLIENTS];
+};
+
+/**
+ * struct cam_lrme_bus_wr_hw_info : WE engine registers information
+ *
+ * @common_reg     : WE common register
+ * @bus_client_reg : List of WE bus registers information
+ */
+struct cam_lrme_bus_wr_hw_info {
+	struct cam_lrme_bus_wr_reg_common common_reg;
+	struct cam_lrme_bus_wr_bus_client
+		bus_client_reg[CAM_LRME_BUS_WR_MAX_CLIENTS];
+};
+
+/**
+ * struct cam_lrme_clc_reg : Offset of clc registers
+ *
+ * @clc_hw_version                 : Offset of clc_hw_version register
+ * @clc_hw_status                  : Offset of clc_hw_status register
+ * @clc_hw_status_dbg              : Offset of clc_hw_status_dbg register
+ * @clc_module_cfg                 : Offset of clc_module_cfg register
+ * @clc_moduleformat               : Offset of clc_moduleformat register
+ * @clc_rangestep                  : Offset of clc_rangestep register
+ * @clc_offset                     : Offset of clc_offset register
+ * @clc_maxallowedsad              : Offset of clc_maxallowedsad register
+ * @clc_minallowedtarmad           : Offset of clc_minallowedtarmad register
+ * @clc_meaningfulsaddiff          : Offset of clc_meaningfulsaddiff register
+ * @clc_minsaddiffdenom            : Offset of clc_minsaddiffdenom register
+ * @clc_robustnessmeasuredistmap_0 : Offset of measuredistmap_0 register
+ * @clc_robustnessmeasuredistmap_1 : Offset of measuredistmap_1 register
+ * @clc_robustnessmeasuredistmap_2 : Offset of measuredistmap_2 register
+ * @clc_robustnessmeasuredistmap_3 : Offset of measuredistmap_3 register
+ * @clc_robustnessmeasuredistmap_4 : Offset of measuredistmap_4 register
+ * @clc_robustnessmeasuredistmap_5 : Offset of measuredistmap_5 register
+ * @clc_robustnessmeasuredistmap_6 : Offset of measuredistmap_6 register
+ * @clc_robustnessmeasuredistmap_7 : Offset of measuredistmap_7 register
+ * @clc_ds_crop_horizontal         : Offset of clc_ds_crop_horizontal register
+ * @clc_ds_crop_vertical           : Offset of clc_ds_crop_vertical register
+ * @clc_tar_pd_unpacker            : Offset of clc_tar_pd_unpacker register
+ * @clc_ref_pd_unpacker            : Offset of clc_ref_pd_unpacker register
+ * @clc_sw_override                : Offset of clc_sw_override register
+ * @clc_tar_height                 : Offset of clc_tar_height register
+ * @clc_test_bus_ctrl              : Offset of clc_test_bus_ctrl register
+ * @clc_spare                      : Offset of clc_spare register
+ */
+struct cam_lrme_clc_reg {
+	uint32_t clc_hw_version;
+	uint32_t clc_hw_status;
+	uint32_t clc_hw_status_dbg;
+	uint32_t clc_module_cfg;
+	uint32_t clc_moduleformat;
+	uint32_t clc_rangestep;
+	uint32_t clc_offset;
+	uint32_t clc_maxallowedsad;
+	uint32_t clc_minallowedtarmad;
+	uint32_t clc_meaningfulsaddiff;
+	uint32_t clc_minsaddiffdenom;
+	uint32_t clc_robustnessmeasuredistmap_0;
+	uint32_t clc_robustnessmeasuredistmap_1;
+	uint32_t clc_robustnessmeasuredistmap_2;
+	uint32_t clc_robustnessmeasuredistmap_3;
+	uint32_t clc_robustnessmeasuredistmap_4;
+	uint32_t clc_robustnessmeasuredistmap_5;
+	uint32_t clc_robustnessmeasuredistmap_6;
+	uint32_t clc_robustnessmeasuredistmap_7;
+	uint32_t clc_ds_crop_horizontal;
+	uint32_t clc_ds_crop_vertical;
+	uint32_t clc_tar_pd_unpacker;
+	uint32_t clc_ref_pd_unpacker;
+	uint32_t clc_sw_override;
+	uint32_t clc_tar_height;
+	uint32_t clc_ref_height;
+	uint32_t clc_test_bus_ctrl;
+	uint32_t clc_spare;
+};
+
+/**
+ * struct cam_lrme_titan_reg : Offset of LRME top registers
+ *
+ * @top_hw_version           : Offset of top_hw_version register
+ * @top_titan_version        : Offset of top_titan_version register
+ * @top_rst_cmd              : Offset of top_rst_cmd register
+ * @top_core_clk_cfg         : Offset of top_core_clk_cfg register
+ * @top_irq_status           : Offset of top_irq_status register
+ * @top_irq_mask             : Offset of top_irq_mask register
+ * @top_irq_clear            : Offset of top_irq_clear register
+ * @top_irq_set              : Offset of top_irq_set register
+ * @top_irq_cmd              : Offset of top_irq_cmd register
+ * @top_violation_status     : Offset of top_violation_status register
+ * @top_spare                : Offset of top_spare register
+ */
+struct cam_lrme_titan_reg {
+	uint32_t top_hw_version;
+	uint32_t top_titan_version;
+	uint32_t top_rst_cmd;
+	uint32_t top_core_clk_cfg;
+	uint32_t top_irq_status;
+	uint32_t top_irq_mask;
+	uint32_t top_irq_clear;
+	uint32_t top_irq_set;
+	uint32_t top_irq_cmd;
+	uint32_t top_violation_status;
+	uint32_t top_spare;
+};
+
+/**
+ * struct cam_lrme_hw_info : LRME registers information
+ *
+ * @clc_reg    : LRME CLC registers
+ * @bus_rd_reg : LRME FE registers
+ * @bus_wr_reg : LRME WE registers
+ * @titan_reg  : LRME top reisters
+ */
+struct cam_lrme_hw_info {
+	struct cam_lrme_clc_reg clc_reg;
+	struct cam_lrme_bus_rd_hw_info bus_rd_reg;
+	struct cam_lrme_bus_wr_hw_info bus_wr_reg;
+	struct cam_lrme_titan_reg titan_reg;
+};
+
+/**
+ * struct cam_lrme_hw_dump_header : LRME hw dump header
+ *
+ * @tag       : LRME hw dump header tag
+ * @size      : Size of data
+ * @word_size : size of each word
+ */
+
+struct cam_lrme_hw_dump_header {
+	uint8_t     tag[CAM_LRME_HW_DUMP_TAG_MAX_LEN];
+	uint64_t    size;
+	uint32_t    word_size;
+};
+
+int cam_lrme_hw_process_irq(void *priv, void *data);
+int cam_lrme_hw_submit_req(void *hw_priv, void *hw_submit_args,
+	uint32_t arg_size);
+int cam_lrme_hw_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size);
+int cam_lrme_hw_stop(void *hw_priv, void *stop_args, uint32_t arg_size);
+int cam_lrme_hw_get_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size);
+irqreturn_t cam_lrme_hw_irq(int irq_num, void *data);
+int cam_lrme_hw_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+int cam_lrme_hw_util_get_caps(struct cam_hw_info *lrme_hw,
+	struct cam_lrme_dev_cap *hw_caps);
+int cam_lrme_hw_start(void *hw_priv, void *hw_init_args, uint32_t arg_size);
+int cam_lrme_hw_flush(void *hw_priv, void *hw_flush_args, uint32_t arg_size);
+void cam_lrme_set_irq(struct cam_hw_info *lrme_hw, enum cam_lrme_irq_set set);
+
+#endif /* _CAM_LRME_HW_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_dev.c
@@ -0,0 +1,334 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_req_mgr.h>
+
+#include "cam_subdev.h"
+#include "cam_lrme_hw_intf.h"
+#include "cam_lrme_hw_core.h"
+#include "cam_lrme_hw_soc.h"
+#include "cam_lrme_hw_reg.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_lrme_hw_mgr.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+
+static int cam_lrme_hw_dev_util_cdm_acquire(struct cam_lrme_core *lrme_core,
+	struct cam_hw_info *lrme_hw)
+{
+	int rc, i;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_cdm_acquire_data cdm_acquire;
+	struct cam_lrme_cdm_info *hw_cdm_info;
+
+	hw_cdm_info = kzalloc(sizeof(struct cam_lrme_cdm_info),
+		GFP_KERNEL);
+	if (!hw_cdm_info) {
+		CAM_ERR(CAM_LRME, "No memory for hw_cdm_info");
+		return -ENOMEM;
+	}
+
+	cdm_cmd = kzalloc((sizeof(struct cam_cdm_bl_request) +
+		((CAM_LRME_MAX_HW_ENTRIES - 1) *
+		sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+	if (!cdm_cmd) {
+		CAM_ERR(CAM_LRME, "No memory for cdm_cmd");
+		kfree(hw_cdm_info);
+		return -ENOMEM;
+	}
+
+	memset(&cdm_acquire, 0, sizeof(cdm_acquire));
+	strscpy(cdm_acquire.identifier, "lrmecdm", sizeof("lrmecdm"));
+	cdm_acquire.cell_index = lrme_hw->soc_info.index;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = hw_cdm_info;
+	cdm_acquire.cam_cdm_callback = NULL;
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.base_array_cnt = lrme_hw->soc_info.num_reg_map;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	for (i = 0; i < lrme_hw->soc_info.num_reg_map; i++)
+		cdm_acquire.base_array[i] = &lrme_hw->soc_info.reg_map[i];
+
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Can't acquire cdm");
+		goto error;
+	}
+
+	hw_cdm_info->cdm_cmd = cdm_cmd;
+	hw_cdm_info->cdm_ops = cdm_acquire.ops;
+	hw_cdm_info->cdm_handle = cdm_acquire.handle;
+
+	lrme_core->hw_cdm_info = hw_cdm_info;
+	CAM_DBG(CAM_LRME, "cdm acquire done");
+
+	return 0;
+error:
+	kfree(cdm_cmd);
+	kfree(hw_cdm_info);
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_cam_lrme_hw_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int cam_lrme_hw_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *lrme_hw;
+	struct cam_hw_intf lrme_hw_intf;
+	struct cam_lrme_core *lrme_core;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_lrme_hw_info *hw_info;
+	int rc, i;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	lrme_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!lrme_hw) {
+		CAM_ERR(CAM_LRME, "No memory to create lrme_hw");
+		return -ENOMEM;
+	}
+
+	lrme_core = kzalloc(sizeof(struct cam_lrme_core), GFP_KERNEL);
+	if (!lrme_core) {
+		CAM_ERR(CAM_LRME, "No memory to create lrme_core");
+		kfree(lrme_hw);
+		return -ENOMEM;
+	}
+
+	lrme_hw->core_info = lrme_core;
+	lrme_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	lrme_hw->soc_info.pdev = pdev;
+	lrme_hw->soc_info.dev = &pdev->dev;
+	lrme_hw->soc_info.dev_name = pdev->name;
+	lrme_hw->open_count = 0;
+	lrme_core->state = CAM_LRME_CORE_STATE_INIT;
+
+	mutex_init(&lrme_hw->hw_mutex);
+	spin_lock_init(&lrme_hw->hw_lock);
+	init_completion(&lrme_hw->hw_complete);
+	init_completion(&lrme_core->reset_complete);
+
+	rc = cam_req_mgr_workq_create("cam_lrme_hw_worker",
+		CAM_LRME_HW_WORKQ_NUM_TASK,
+		&lrme_core->work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_cam_lrme_hw_worker);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Unable to create a workq, rc=%d", rc);
+		goto free_memory;
+	}
+
+	for (i = 0; i < CAM_LRME_HW_WORKQ_NUM_TASK; i++)
+		lrme_core->work->task.pool[i].payload =
+			&lrme_core->work_data[i];
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev || !match_dev->data) {
+		CAM_ERR(CAM_LRME, "No Of_match data, %pK", match_dev);
+		rc = -EINVAL;
+		goto destroy_workqueue;
+	}
+	hw_info = (struct cam_lrme_hw_info *)match_dev->data;
+	lrme_core->hw_info = hw_info;
+
+	rc = cam_lrme_soc_init_resources(&lrme_hw->soc_info,
+		cam_lrme_hw_irq, lrme_hw);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to init soc, rc=%d", rc);
+		goto destroy_workqueue;
+	}
+
+	rc = cam_lrme_hw_dev_util_cdm_acquire(lrme_core, lrme_hw);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to acquire cdm");
+		goto deinit_platform_res;
+	}
+
+	rc = cam_smmu_get_handle("lrme", &lrme_core->device_iommu.non_secure);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Get iommu handle failed");
+		goto release_cdm;
+	}
+
+	rc = cam_lrme_hw_start(lrme_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to hw init, rc=%d", rc);
+		goto detach_smmu;
+	}
+
+	rc = cam_lrme_hw_util_get_caps(lrme_hw, &lrme_core->hw_caps);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to get hw caps, rc=%d", rc);
+		if (cam_lrme_hw_stop(lrme_hw, NULL, 0))
+			CAM_ERR(CAM_LRME, "Failed in hw deinit");
+		goto detach_smmu;
+	}
+
+	rc = cam_lrme_hw_stop(lrme_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to deinit hw, rc=%d", rc);
+		goto detach_smmu;
+	}
+
+	lrme_core->hw_idx = lrme_hw->soc_info.index;
+	lrme_hw_intf.hw_priv = lrme_hw;
+	lrme_hw_intf.hw_idx = lrme_hw->soc_info.index;
+	lrme_hw_intf.hw_ops.get_hw_caps = cam_lrme_hw_get_caps;
+	lrme_hw_intf.hw_ops.init = NULL;
+	lrme_hw_intf.hw_ops.deinit = NULL;
+	lrme_hw_intf.hw_ops.reset = cam_lrme_hw_reset;
+	lrme_hw_intf.hw_ops.reserve = NULL;
+	lrme_hw_intf.hw_ops.release = NULL;
+	lrme_hw_intf.hw_ops.start = cam_lrme_hw_start;
+	lrme_hw_intf.hw_ops.stop = cam_lrme_hw_stop;
+	lrme_hw_intf.hw_ops.read = NULL;
+	lrme_hw_intf.hw_ops.write = NULL;
+	lrme_hw_intf.hw_ops.process_cmd = cam_lrme_hw_process_cmd;
+	lrme_hw_intf.hw_ops.flush = cam_lrme_hw_flush;
+	lrme_hw_intf.hw_type = CAM_HW_LRME;
+
+	rc = cam_cdm_get_iommu_handle("lrmecdm", &lrme_core->cdm_iommu);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to acquire the CDM iommu handles");
+		goto detach_smmu;
+	}
+
+	rc = cam_lrme_mgr_register_device(&lrme_hw_intf,
+		&lrme_core->device_iommu,
+		&lrme_core->cdm_iommu);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to register device");
+		goto detach_smmu;
+	}
+
+	platform_set_drvdata(pdev, lrme_hw);
+	CAM_DBG(CAM_LRME, "HW:%d component bound successfully",
+		lrme_hw_intf.hw_idx);
+
+	return rc;
+
+detach_smmu:
+	cam_smmu_destroy_handle(lrme_core->device_iommu.non_secure);
+release_cdm:
+	cam_cdm_release(lrme_core->hw_cdm_info->cdm_handle);
+	kfree(lrme_core->hw_cdm_info->cdm_cmd);
+	kfree(lrme_core->hw_cdm_info);
+deinit_platform_res:
+	if (cam_lrme_soc_deinit_resources(&lrme_hw->soc_info))
+		CAM_ERR(CAM_LRME, "Failed in soc deinit");
+	mutex_destroy(&lrme_hw->hw_mutex);
+destroy_workqueue:
+	cam_req_mgr_workq_destroy(&lrme_core->work);
+free_memory:
+	mutex_destroy(&lrme_hw->hw_mutex);
+	kfree(lrme_hw);
+	kfree(lrme_core);
+
+	return rc;
+}
+
+static void cam_lrme_hw_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct cam_hw_info *lrme_hw;
+	struct cam_lrme_core *lrme_core;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	lrme_hw = platform_get_drvdata(pdev);
+	if (!lrme_hw) {
+		CAM_ERR(CAM_LRME, "Invalid lrme_hw from fd_hw_intf");
+		return;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	if (!lrme_core) {
+		CAM_ERR(CAM_LRME, "Invalid lrme_core from fd_hw");
+		goto deinit_platform_res;
+	}
+
+	cam_smmu_destroy_handle(lrme_core->device_iommu.non_secure);
+	cam_cdm_release(lrme_core->hw_cdm_info->cdm_handle);
+	cam_lrme_mgr_deregister_device(lrme_core->hw_idx);
+
+	kfree(lrme_core->hw_cdm_info->cdm_cmd);
+	kfree(lrme_core->hw_cdm_info);
+	kfree(lrme_core);
+
+deinit_platform_res:
+	rc = cam_lrme_soc_deinit_resources(&lrme_hw->soc_info);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Error in LRME soc deinit, rc=%d", rc);
+
+	mutex_destroy(&lrme_hw->hw_mutex);
+	kfree(lrme_hw);
+}
+
+const static struct component_ops cam_lrme_hw_dev_component_ops = {
+	.bind = cam_lrme_hw_dev_component_bind,
+	.unbind = cam_lrme_hw_dev_component_unbind,
+};
+
+static int cam_lrme_hw_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Adding LRME HW component");
+	rc = component_add(&pdev->dev, &cam_lrme_hw_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_LRME, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_lrme_hw_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_lrme_hw_dev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_lrme_hw_dt_match[] = {
+	{
+		.compatible = "qcom,lrme",
+		.data = &cam_lrme10_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_lrme_hw_dt_match);
+
+struct platform_driver cam_lrme_hw_driver = {
+	.probe = cam_lrme_hw_dev_probe,
+	.remove = cam_lrme_hw_dev_remove,
+	.driver = {
+		.name = "cam_lrme_hw",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_lrme_hw_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_lrme_hw_init_module(void)
+{
+	return platform_driver_register(&cam_lrme_hw_driver);
+}
+
+void cam_lrme_hw_exit_module(void)
+{
+	platform_driver_unregister(&cam_lrme_hw_driver);
+}
+
+MODULE_DESCRIPTION("CAM LRME HW driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_intf.h
@@ -0,0 +1,226 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_INTF_H_
+#define _CAM_LRME_HW_INTF_H_
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_lrme.h>
+
+#include "cam_io_util.h"
+#include "cam_soc_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_subdev.h"
+#include "cam_cpas_api.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+
+
+#define CAM_LRME_MAX_IO_BUFFER 2
+#define CAM_LRME_MAX_HW_ENTRIES 5
+
+#define CAM_LRME_BASE_IDX 0
+
+/**
+ *  enum cam_lrme_hw_type : Enum for LRME HW type
+ *
+ * @CAM_HW_LRME : LRME HW type
+ */
+enum cam_lrme_hw_type {
+	CAM_HW_LRME,
+};
+
+/**
+ * enum cam_lrme_cb_type : HW manager call back type
+ *
+ * @CAM_LRME_CB_BUF_DONE        : Indicate buf done has been generated
+ * @CAM_LRME_CB_COMP_REG_UPDATE : Indicate receiving WE comp reg update
+ * @CAM_LRME_CB_PUT_FRAME       : Request HW manager to put back the frame
+ * @CAM_LRME_CB_ERROR           : Indicate error irq has been generated
+ */
+enum cam_lrme_cb_type {
+	CAM_LRME_CB_BUF_DONE = 1,
+	CAM_LRME_CB_COMP_REG_UPDATE = 1 << 1,
+	CAM_LRME_CB_PUT_FRAME = 1 << 2,
+	CAM_LRME_CB_ERROR = 1 << 3,
+};
+
+/**
+ * enum cam_lrme_hw_cmd_type : HW CMD type
+ *
+ * @CAM_LRME_HW_CMD_prepare_hw_update : Prepare HW update
+ * @CAM_LRME_HW_CMD_REGISTER_CB       : register HW manager callback
+ * @CAM_LRME_HW_CMD_SUBMIT            : Submit frame to HW
+ * @CAM_LRME_HW_CMD_DUMP_REGISTER     : dump register values
+ * @CAM_LRME_HW_CMD_DUMP              : dump register values to buffer
+ */
+enum cam_lrme_hw_cmd_type {
+	CAM_LRME_HW_CMD_PREPARE_HW_UPDATE,
+	CAM_LRME_HW_CMD_REGISTER_CB,
+	CAM_LRME_HW_CMD_SUBMIT,
+	CAM_LRME_HW_CMD_DUMP_REGISTER,
+	CAM_LRME_HW_CMD_DUMP,
+};
+
+/**
+ * enum cam_lrme_hw_reset_type : Type of reset
+ *
+ * @CAM_LRME_HW_RESET_TYPE_HW_RESET : HW reset
+ * @CAM_LRME_HW_RESET_TYPE_SW_RESET : SW reset
+ */
+enum cam_lrme_hw_reset_type {
+	CAM_LRME_HW_RESET_TYPE_HW_RESET,
+	CAM_LRME_HW_RESET_TYPE_SW_RESET,
+};
+
+/**
+ *struct cam_lrme_frame_request : LRME frame request
+ *
+ * @frame_list            : List head
+ * @req_id                : Request ID
+ * @ctxt_to_hw_map        : Information about context id, priority and device id
+ * @hw_device             : Pointer to HW device
+ * @hw_update_entries     : List of hw_update_entries
+ * @num_hw_update_entries : number of hw_update_entries
+ * @submit_timestamp      : timestamp of submitting request with hw
+ */
+struct cam_lrme_frame_request {
+	struct list_head           frame_list;
+	uint64_t                   req_id;
+	void                      *ctxt_to_hw_map;
+	struct cam_lrme_device    *hw_device;
+	struct cam_hw_update_entry hw_update_entries[CAM_LRME_MAX_HW_ENTRIES];
+	uint32_t                   num_hw_update_entries;
+	ktime_t                    submit_timestamp;
+};
+
+/**
+ * struct cam_lrme_hw_io_buffer : IO buffer information
+ *
+ * @valid     : Indicate whether this IO config is valid
+ * @io_cfg    : Pointer to IO configuration
+ * @num_buf   : Number of buffers
+ * @num_plane : Number of planes
+ * @io_addr   : List of IO address
+ */
+struct cam_lrme_hw_io_buffer {
+	bool                   valid;
+	struct cam_buf_io_cfg *io_cfg;
+	uint32_t               num_buf;
+	uint32_t               num_plane;
+	uint64_t               io_addr[CAM_PACKET_MAX_PLANES];
+};
+
+/**
+ * struct cam_lrme_hw_cmd_config_args : Args for prepare HW update
+ *
+ * @hw_device       : Pointer to HW device
+ * @input_buf       : List of input buffers
+ * @output_buf      : List of output buffers
+ * @cmd_buf_addr    : Pointer to available KMD buffer
+ * @size            : Available KMD buffer size
+ * @config_buf_size : Size used to prepare update
+ */
+struct cam_lrme_hw_cmd_config_args {
+	struct cam_lrme_device *hw_device;
+	struct cam_lrme_hw_io_buffer input_buf[CAM_LRME_MAX_IO_BUFFER];
+	struct cam_lrme_hw_io_buffer output_buf[CAM_LRME_MAX_IO_BUFFER];
+	uint32_t *cmd_buf_addr;
+	uint32_t size;
+	uint32_t config_buf_size;
+};
+
+/**
+ * struct cam_lrme_hw_flush_args : Args for flush HW
+ *
+ * @ctxt_to_hw_map : Identity of context
+ * @req_to_flush   : Pointer to the frame need to flush in
+ *                   case of single frame flush
+ * @flush_type     : Flush type
+ */
+struct cam_lrme_hw_flush_args {
+	void                          *ctxt_to_hw_map;
+	struct cam_lrme_frame_request *req_to_flush;
+	uint32_t                       flush_type;
+};
+
+/**
+ * struct cam_lrme_hw_reset_args : Args for reset HW
+ *
+ * @reset_type : Enum cam_lrme_hw_reset_type
+ */
+struct cam_lrme_hw_reset_args {
+	uint32_t reset_type;
+};
+
+/**
+ * struct cam_lrme_hw_cb_args : HW manager callback args
+ *
+ * @cb_type   : Callback event type
+ * @frame_req : Pointer to the frame associated with the cb
+ */
+struct cam_lrme_hw_cb_args {
+	uint32_t                       cb_type;
+	struct cam_lrme_frame_request *frame_req;
+};
+
+/**
+ * struct cam_lrme_hw_cmd_set_cb : Args for set callback function
+ *
+ * @cam_lrme_hw_mgr_cb : Callback function pointer
+ * @data               : Data sent along with callback function
+ */
+struct cam_lrme_hw_cmd_set_cb {
+	int (*cam_lrme_hw_mgr_cb)(void *data,
+		struct cam_lrme_hw_cb_args *args);
+	void *data;
+};
+
+/**
+ * struct cam_lrme_hw_submit_args : Args for submit request
+ *
+ * @hw_update_entries     : List of hw update entries used to program registers
+ * @num_hw_update_entries : Number of hw update entries
+ * @frame_req             : Pointer to the frame request
+ */
+struct cam_lrme_hw_submit_args {
+	struct cam_hw_update_entry    *hw_update_entries;
+	uint32_t            num_hw_update_entries;
+	struct cam_lrme_frame_request *frame_req;
+};
+
+/**
+ * struct cam_lrme_hw_dump_args : Args for dump request
+ *
+ * @request_id   : Issue request id
+ * @cpu_addr     : start address of the target buffer
+ * @offset       : offset of the buffer
+ * @buf_len      : Length of target buffer
+ */
+struct cam_lrme_hw_dump_args {
+	uint64_t  request_id;
+	uintptr_t cpu_addr;
+	size_t    offset;
+	size_t    buf_len;
+};
+
+/**
+ * @brief : API to register LRME hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_lrme_hw_init_module(void);
+
+/**
+ * @brief : API to remove LRME Hw from platform framework.
+ */
+void cam_lrme_hw_exit_module(void);
+
+#endif /* _CAM_LRME_HW_INTF_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_reg.h
@@ -0,0 +1,186 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_REG_H_
+#define _CAM_LRME_HW_REG_H_
+
+#include "cam_lrme_hw_core.h"
+
+static struct cam_lrme_hw_info cam_lrme10_hw_info = {
+	.clc_reg = {
+		.clc_hw_version                 = 0x00000000,
+		.clc_hw_status                  = 0x00000004,
+		.clc_hw_status_dbg              = 0x00000008,
+		.clc_module_cfg                 = 0x00000060,
+		.clc_moduleformat               = 0x000000A8,
+		.clc_rangestep                  = 0x00000068,
+		.clc_offset                     = 0x0000006C,
+		.clc_maxallowedsad              = 0x00000070,
+		.clc_minallowedtarmad           = 0x00000074,
+		.clc_meaningfulsaddiff          = 0x00000078,
+		.clc_minsaddiffdenom            = 0x0000007C,
+		.clc_robustnessmeasuredistmap_0 = 0x00000080,
+		.clc_robustnessmeasuredistmap_1 = 0x00000084,
+		.clc_robustnessmeasuredistmap_2 = 0x00000088,
+		.clc_robustnessmeasuredistmap_3 = 0x0000008C,
+		.clc_robustnessmeasuredistmap_4 = 0x00000090,
+		.clc_robustnessmeasuredistmap_5 = 0x00000094,
+		.clc_robustnessmeasuredistmap_6 = 0x00000098,
+		.clc_robustnessmeasuredistmap_7 = 0x0000009C,
+		.clc_ds_crop_horizontal         = 0x000000A0,
+		.clc_ds_crop_vertical           = 0x000000A4,
+		.clc_tar_pd_unpacker            = 0x000000AC,
+		.clc_ref_pd_unpacker            = 0x000000B0,
+		.clc_sw_override                = 0x000000B4,
+		.clc_tar_height                 = 0x000000B8,
+		.clc_ref_height                 = 0x000000BC,
+		.clc_test_bus_ctrl              = 0x000001F8,
+		.clc_spare                      = 0x000001FC,
+	},
+	.bus_rd_reg = {
+		.common_reg = {
+			.hw_version     = 0x00000200,
+			.hw_capability  = 0x00000204,
+			.sw_reset       = 0x00000208,
+			.cgc_override   = 0x0000020C,
+			.irq_mask       = 0x00000210,
+			.irq_clear      = 0x00000214,
+			.irq_cmd        = 0x00000218,
+			.irq_status     = 0x0000021C,
+			.cmd            = 0x00000220,
+			.irq_set        = 0x00000224,
+			.misr_reset     = 0x0000022C,
+			.security_cfg   = 0x00000230,
+			.pwr_iso_cfg    = 0x00000234,
+			.pwr_iso_seed   = 0x00000238,
+			.test_bus_ctrl  = 0x00000248,
+			.spare          = 0x0000024C,
+		},
+		.bus_client_reg = {
+			/* bus client 0 */
+			{
+				.core_cfg                = 0x00000250,
+				.ccif_meta_data          = 0x00000254,
+				.addr_image              = 0x00000258,
+				.rd_buffer_size          = 0x0000025C,
+				.rd_stride               = 0x00000260,
+				.unpack_cfg_0            = 0x00000264,
+				.latency_buff_allocation = 0x00000278,
+				.burst_limit_cfg         = 0x00000280,
+				.misr_cfg_0              = 0x00000284,
+				.misr_cfg_1              = 0x00000288,
+				.misr_rd_val             = 0x0000028C,
+				.debug_status_cfg        = 0x00000290,
+				.debug_status_0          = 0x00000294,
+				.debug_status_1          = 0x00000298,
+			},
+			/* bus client 1 */
+			{
+				.core_cfg                = 0x000002F0,
+				.ccif_meta_data          = 0x000002F4,
+				.addr_image              = 0x000002F8,
+				.rd_buffer_size          = 0x000002FC,
+				.rd_stride               = 0x00000300,
+				.unpack_cfg_0            = 0x00000304,
+				.latency_buff_allocation = 0x00000318,
+				.burst_limit_cfg         = 0x00000320,
+				.misr_cfg_0              = 0x00000324,
+				.misr_cfg_1              = 0x00000328,
+				.misr_rd_val             = 0x0000032C,
+				.debug_status_cfg        = 0x00000330,
+				.debug_status_0          = 0x00000334,
+				.debug_status_1          = 0x00000338,
+			},
+		},
+	},
+	.bus_wr_reg = {
+		.common_reg = {
+			.hw_version        = 0x00000500,
+			.hw_capability     = 0x00000504,
+			.sw_reset          = 0x00000508,
+			.cgc_override      = 0x0000050C,
+			.misr_reset        = 0x000005C8,
+			.pwr_iso_cfg       = 0x000005CC,
+			.test_bus_ctrl     = 0x0000061C,
+			.composite_mask_0  = 0x00000510,
+			.irq_mask_0        = 0x00000544,
+			.irq_mask_1        = 0x00000548,
+			.irq_clear_0       = 0x00000550,
+			.irq_clear_1       = 0x00000554,
+			.irq_status_0      = 0x0000055C,
+			.irq_status_1      = 0x00000560,
+			.irq_cmd           = 0x00000568,
+			.irq_set_0         = 0x000005BC,
+			.irq_set_1         = 0x000005C0,
+			.addr_fifo_status  = 0x000005A8,
+			.frame_header_cfg0 = 0x000005AC,
+			.frame_header_cfg1 = 0x000005B0,
+			.spare             = 0x00000620,
+		},
+		.bus_client_reg = {
+			/* bus client 0 */
+			{
+				.status_0                  = 0x00000700,
+				.status_1                  = 0x00000704,
+				.cfg                       = 0x00000708,
+				.addr_frame_header         = 0x0000070C,
+				.frame_header_cfg          = 0x00000710,
+				.addr_image                = 0x00000714,
+				.addr_image_offset         = 0x00000718,
+				.buffer_width_cfg          = 0x0000071C,
+				.buffer_height_cfg         = 0x00000720,
+				.packer_cfg                = 0x00000724,
+				.wr_stride                 = 0x00000728,
+				.irq_subsample_cfg_period  = 0x00000748,
+				.irq_subsample_cfg_pattern = 0x0000074C,
+				.burst_limit_cfg           = 0x0000075C,
+				.misr_cfg                  = 0x00000760,
+				.misr_rd_word_sel          = 0x00000764,
+				.misr_val                  = 0x00000768,
+				.debug_status_cfg          = 0x0000076C,
+				.debug_status_0            = 0x00000770,
+				.debug_status_1            = 0x00000774,
+			},
+			/* bus client 1 */
+			{
+				.status_0                  = 0x00000800,
+				.status_1                  = 0x00000804,
+				.cfg                       = 0x00000808,
+				.addr_frame_header         = 0x0000080C,
+				.frame_header_cfg          = 0x00000810,
+				.addr_image                = 0x00000814,
+				.addr_image_offset         = 0x00000818,
+				.buffer_width_cfg          = 0x0000081C,
+				.buffer_height_cfg         = 0x00000820,
+				.packer_cfg                = 0x00000824,
+				.wr_stride                 = 0x00000828,
+				.irq_subsample_cfg_period  = 0x00000848,
+				.irq_subsample_cfg_pattern = 0x0000084C,
+				.burst_limit_cfg           = 0x0000085C,
+				.misr_cfg                  = 0x00000860,
+				.misr_rd_word_sel          = 0x00000864,
+				.misr_val                  = 0x00000868,
+				.debug_status_cfg          = 0x0000086C,
+				.debug_status_0            = 0x00000870,
+				.debug_status_1            = 0x00000874,
+			},
+		},
+	},
+	.titan_reg = {
+		.top_hw_version        = 0x00000900,
+		.top_titan_version     = 0x00000904,
+		.top_rst_cmd           = 0x00000908,
+		.top_core_clk_cfg      = 0x00000920,
+		.top_irq_status        = 0x0000090C,
+		.top_irq_mask          = 0x00000910,
+		.top_irq_clear         = 0x00000914,
+		.top_irq_set           = 0x00000918,
+		.top_irq_cmd           = 0x0000091C,
+		.top_violation_status  = 0x00000924,
+		.top_spare             = 0x000009FC,
+	},
+};
+
+#endif /* _CAM_LRME_HW_REG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.c
@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_lrme_hw_core.h"
+#include "cam_lrme_hw_soc.h"
+
+
+int cam_lrme_soc_enable_resources(struct cam_hw_info *lrme_hw)
+{
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_soc_private *soc_private =
+		(struct cam_lrme_soc_private *)soc_info->soc_private;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	int rc = 0;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ib_bw = 7200000;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = 7200000;
+	axi_vote.axi_path[1].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[1].mnoc_ib_bw = 7200000;
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to start cpas, rc %d", rc);
+		return -EFAULT;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		soc_info->lowest_clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_LRME,
+			"Failed to enable platform resource, rc %d", rc);
+		goto stop_cpas;
+	}
+
+	cam_lrme_set_irq(lrme_hw, CAM_LRME_IRQ_ENABLE);
+
+	return rc;
+
+stop_cpas:
+	if (cam_cpas_stop(soc_private->cpas_handle))
+		CAM_ERR(CAM_LRME, "Failed to stop cpas");
+
+	return rc;
+}
+
+int cam_lrme_soc_disable_resources(struct cam_hw_info *lrme_hw)
+{
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_soc_private *soc_private;
+	int rc = 0;
+
+	soc_private = soc_info->soc_private;
+
+	cam_lrme_set_irq(lrme_hw, CAM_LRME_IRQ_DISABLE);
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to disable platform resource");
+		return rc;
+	}
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed to stop cpas");
+
+	return rc;
+}
+
+int cam_lrme_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *private_data)
+{
+	struct cam_lrme_soc_private *soc_private;
+	struct cam_cpas_register_params cpas_register_param;
+	int rc, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed in get_dt_properties, rc=%d", rc);
+		return rc;
+	}
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = private_data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler, &(irq_data[0]));
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed in request_platform_resource rc=%d",
+			rc);
+		return rc;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_lrme_soc_private), GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto release_res;
+	}
+	soc_info->soc_private = soc_private;
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier,
+		"lrmecpas", CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = &soc_info->pdev->dev;
+	cpas_register_param.userdata = private_data;
+	cpas_register_param.cam_cpas_client_cb = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "CPAS registration failed");
+		goto free_soc_private;
+	}
+	soc_private->cpas_handle = cpas_register_param.client_handle;
+	CAM_DBG(CAM_LRME, "CPAS handle=%d", soc_private->cpas_handle);
+
+	return rc;
+
+free_soc_private:
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+release_res:
+	cam_soc_util_release_platform_resource(soc_info);
+
+	return rc;
+}
+
+int cam_lrme_soc_deinit_resources(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_lrme_soc_private *soc_private =
+		(struct cam_lrme_soc_private *)soc_info->soc_private;
+	int rc;
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Unregister cpas failed, handle=%d, rc=%d",
+			soc_private->cpas_handle, rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_LRME, "release platform failed, rc=%d", rc);
+
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_SOC_H_
+#define _CAM_LRME_HW_SOC_H_
+
+#include "cam_soc_util.h"
+
+struct cam_lrme_soc_private {
+	uint32_t cpas_handle;
+};
+
+int cam_lrme_soc_enable_resources(struct cam_hw_info *lrme_hw);
+int cam_lrme_soc_disable_resources(struct cam_hw_info *lrme_hw);
+int cam_lrme_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *private_data);
+int cam_lrme_soc_deinit_resources(struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_LRME_HW_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/cam_ope_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/cam_ope_context.c
@@ -0,0 +1,294 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <media/cam_sync.h>
+#include <media/cam_defs.h>
+#include <media/cam_ope.h>
+#include "cam_sync_api.h"
+#include "cam_node.h"
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_ope_context.h"
+#include "cam_req_mgr_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+
+static const char ope_dev_name[] = "cam-ope";
+
+static int cam_ope_context_dump_active_request(void *data, void *args)
+{
+	struct cam_context         *ctx = (struct cam_context *)data;
+	struct cam_ctx_request     *req = NULL;
+	struct cam_ctx_request     *req_temp = NULL;
+	struct cam_hw_dump_pf_args *pf_args = (struct cam_hw_dump_pf_args *)args;
+	int rc = 0;
+
+	if (!ctx || !pf_args) {
+		CAM_ERR(CAM_OPE, "Invalid ctx %pK or pf args %pK",
+			ctx, pf_args);
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_OPE, "iommu fault for ope ctx %d state %d",
+		ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+			&ctx->active_req_list, list) {
+		CAM_INFO(CAM_OPE, "Active req_id: %llu ctx_id: %u",
+			req->request_id, ctx->ctx_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_args, &req->pf_data);
+		if (rc)
+			CAM_ERR(CAM_OPE, "Failed to dump pf info ctx_id: %u state: %d",
+				ctx->ctx_id, ctx->state);
+	}
+
+	if (pf_args->pf_context_info.ctx_found) {
+		/* Send PF notification to UMD if PF found on current CTX */
+		rc = cam_context_send_pf_evt(ctx, pf_args);
+		if (rc)
+			CAM_ERR(CAM_OPE,
+				"Failed to notify PF event to userspace rc: %d", rc);
+	}
+
+	return rc;
+}
+
+static int __cam_ope_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (!rc) {
+		ctx->state = CAM_CTX_ACQUIRED;
+		trace_cam_context_state("OPE", ctx);
+	}
+
+	return rc;
+}
+
+static int __cam_ope_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Unable to release device");
+
+	ctx->state = CAM_CTX_AVAILABLE;
+	trace_cam_context_state("OPE", ctx);
+	return rc;
+}
+
+static int __cam_ope_start_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_start_dev_to_hw(ctx, cmd);
+	if (!rc) {
+		ctx->state = CAM_CTX_READY;
+		trace_cam_context_state("OPE", ctx);
+	}
+
+	return rc;
+}
+
+static int __cam_ope_flush_dev_in_ready(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_context_utils_flush_args flush_args;
+
+	flush_args.cmd = cmd;
+	flush_args.flush_active_req = false;
+
+	rc = cam_context_flush_dev_to_hw(ctx, &flush_args);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to flush device");
+
+	return rc;
+}
+
+static int __cam_ope_dump_dev_in_ready(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to dump device");
+
+	return rc;
+}
+
+static int __cam_ope_config_dev_in_ready(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+	size_t len;
+	uintptr_t packet_addr;
+
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "[%s][%d] Can not get packet address",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to prepare device");
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+}
+
+static int __cam_ope_stop_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to stop device");
+
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("OPE", ctx);
+	return rc;
+}
+
+static int __cam_ope_release_dev_in_ready(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = __cam_ope_stop_dev_in_ready(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to stop device");
+
+	rc = __cam_ope_release_dev_in_acquired(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to release device");
+
+	return rc;
+}
+
+static int __cam_ope_handle_buf_done_in_ready(void *ctx,
+	uint32_t evt_id, void *done)
+{
+	return cam_context_buf_done_from_hw(ctx, done, evt_id);
+}
+
+static struct cam_ctx_ops
+	cam_ope_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_ope_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.release_dev = __cam_ope_release_dev_in_acquired,
+			.start_dev = __cam_ope_start_dev_in_acquired,
+			.config_dev = __cam_ope_config_dev_in_ready,
+			.flush_dev = __cam_ope_flush_dev_in_ready,
+			.dump_dev = __cam_ope_dump_dev_in_ready,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_ope_handle_buf_done_in_ready,
+		.pagefault_ops = cam_ope_context_dump_active_request,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_ope_stop_dev_in_ready,
+			.release_dev = __cam_ope_release_dev_in_ready,
+			.config_dev = __cam_ope_config_dev_in_ready,
+			.flush_dev = __cam_ope_flush_dev_in_ready,
+			.dump_dev = __cam_ope_dump_dev_in_ready,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_ope_handle_buf_done_in_ready,
+		.pagefault_ops = cam_ope_context_dump_active_request,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_ope_context_dump_active_request,
+	},
+};
+
+int cam_ope_context_init(struct cam_ope_context *ctx,
+	struct cam_hw_mgr_intf *hw_intf, uint32_t ctx_id, int img_iommu_hdl)
+{
+	int rc;
+
+	if ((!ctx) || (!ctx->base) || (!hw_intf)) {
+		CAM_ERR(CAM_OPE, "Invalid params: %pK %pK", ctx, hw_intf);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	rc = cam_context_init(ctx->base, ope_dev_name, CAM_OPE, ctx_id,
+		NULL, hw_intf, ctx->req_base, CAM_CTX_REQ_MAX, img_iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "Camera Context Base init failed");
+		goto err;
+	}
+
+	ctx->base->state_machine = cam_ope_ctx_state_machine;
+	ctx->base->ctx_priv = ctx;
+	ctx->ctxt_to_hw_map = NULL;
+
+	ctx->base->max_hw_update_entries = CAM_CTX_CFG_MAX;
+	ctx->base->max_in_map_entries = CAM_CTX_CFG_MAX;
+	ctx->base->max_out_map_entries = CAM_CTX_CFG_MAX;
+err:
+	return rc;
+}
+
+int cam_ope_context_deinit(struct cam_ope_context *ctx)
+{
+	if ((!ctx) || (!ctx->base)) {
+		CAM_ERR(CAM_OPE, "Invalid params: %pK", ctx);
+		return -EINVAL;
+	}
+
+	cam_context_deinit(ctx->base);
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
+
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/cam_ope_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/cam_ope_context.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_OPE_CONTEXT_H_
+#define _CAM_OPE_CONTEXT_H_
+
+#include "cam_context.h"
+
+#define OPE_CTX_MAX 32
+
+/**
+ * struct cam_ope_context - ope context
+ * @base:           ope context object
+ * @state_machine:  state machine for OPE context
+ * @req_base:       common request structure
+ * @state:          ope context state
+ * @ctxt_to_hw_map: context to FW handle mapping
+ */
+struct cam_ope_context {
+	struct cam_context *base;
+	struct cam_ctx_ops *state_machine;
+	struct cam_ctx_request req_base[CAM_CTX_REQ_MAX];
+	uint32_t state;
+	void *ctxt_to_hw_map;
+};
+
+/**
+ * cam_ope_context_init() - OPE context init
+ * @ctx:     Pointer to context
+ * @hw_intf: Pointer to OPE hardware interface
+ * @ctx_id:  ID for this context
+ * @img_iommu_hdl: IOMMU HDL for image buffers
+ *
+ */
+int cam_ope_context_init(struct cam_ope_context *ctx,
+	struct cam_hw_mgr_intf *hw_intf, uint32_t ctx_id, int img_iommu_hdl);
+
+/**
+ * cam_ope_context_deinit() - OPE context deinit
+ * @ctx: Pointer to context
+ */
+int cam_ope_context_deinit(struct cam_ope_context *ctx);
+
+#endif /* _CAM_OPE_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/cam_ope_subdev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/cam_ope_subdev.c
@@ -0,0 +1,338 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/platform_device.h>
+#include <linux/videodev2.h>
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_defs.h>
+#include <media/cam_ope.h>
+#include "cam_req_mgr_dev.h"
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_context.h"
+#include "cam_ope_context.h"
+#include "cam_ope_hw_mgr_intf.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+#include "cam_context_utils.h"
+
+#define OPE_DEV_NAME        "cam-ope"
+
+struct cam_ope_subdev {
+	struct cam_subdev sd;
+	struct cam_node *node;
+	struct cam_context ctx[OPE_CTX_MAX];
+	struct cam_ope_context ctx_ope[OPE_CTX_MAX];
+	struct mutex ope_lock;
+	int32_t open_cnt;
+	int32_t reserved;
+};
+
+static struct cam_ope_subdev g_ope_dev;
+
+static void cam_ope_dev_iommu_fault_handler(
+	struct cam_smmu_pf_info *pf_smmu_info)
+{
+	int i, rc;
+	struct cam_node *node = NULL;
+	struct cam_hw_dump_pf_args pf_args = {0};
+
+	if (!pf_smmu_info || !pf_smmu_info->token) {
+		CAM_ERR(CAM_OPE, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_smmu_info->token;
+	pf_args.pf_smmu_info = pf_smmu_info;
+
+	for (i = 0; i < node->ctx_size; i++) {
+		cam_context_dump_pf_info(&(node->ctx_list[i]), &pf_args);
+		if (pf_args.pf_context_info.ctx_found)
+			/* found ctx and packet of the faulted address */
+			break;
+	}
+
+	if (i == node->ctx_size) {
+		/* Faulted ctx not found. But report PF to UMD anyway*/
+		rc = cam_context_send_pf_evt(NULL, &pf_args);
+		if (rc)
+			CAM_ERR(CAM_OPE,
+				"Failed to notify PF event to userspace rc: %d", rc);
+	}
+}
+
+static int cam_ope_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_hw_mgr_intf *hw_mgr_intf = NULL;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+	int rc = 0;
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
+	mutex_lock(&g_ope_dev.ope_lock);
+	if (g_ope_dev.open_cnt >= 1) {
+		CAM_ERR(CAM_OPE, "OPE subdev is already opened");
+		rc = -EALREADY;
+		goto end;
+	}
+
+	if (!node) {
+		CAM_ERR(CAM_OPE, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	hw_mgr_intf = &node->hw_mgr_intf;
+	rc = hw_mgr_intf->hw_open(hw_mgr_intf->hw_mgr_priv, NULL);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "OPE HW open failed: %d", rc);
+		goto end;
+	}
+	g_ope_dev.open_cnt++;
+	CAM_DBG(CAM_OPE, "OPE HW open success: %d", rc);
+end:
+	mutex_unlock(&g_ope_dev.ope_lock);
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+	return rc;
+}
+
+static int cam_ope_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_hw_mgr_intf *hw_mgr_intf = NULL;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&g_ope_dev.ope_lock);
+	if (g_ope_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_OPE, "OPE subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+	g_ope_dev.open_cnt--;
+	if (!node) {
+		CAM_ERR(CAM_OPE, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	hw_mgr_intf = &node->hw_mgr_intf;
+	if (!hw_mgr_intf) {
+		CAM_ERR(CAM_OPE, "hw_mgr_intf is not initialized");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_node_shutdown(node);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "HW close failed");
+		goto end;
+	}
+	CAM_DBG(CAM_OPE, "OPE HW close success: %d", rc);
+
+end:
+	mutex_unlock(&g_ope_dev.ope_lock);
+	return rc;
+}
+
+static int cam_ope_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_OPE, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_ope_subdev_close_internal(sd, fh);
+}
+
+const struct v4l2_subdev_internal_ops cam_ope_subdev_internal_ops = {
+	.open = cam_ope_subdev_open,
+	.close = cam_ope_subdev_close,
+};
+
+static int cam_ope_subdev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0, i = 0;
+	struct cam_node *node;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	int iommu_hdl = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_OPE, "Binding OPE subdev component");
+	if (!pdev) {
+		CAM_ERR(CAM_OPE, "pdev is NULL");
+		return -EINVAL;
+	}
+
+	g_ope_dev.sd.pdev = pdev;
+	g_ope_dev.sd.internal_ops = &cam_ope_subdev_internal_ops;
+	g_ope_dev.sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+	rc = cam_subdev_probe(&g_ope_dev.sd, pdev, OPE_DEV_NAME,
+		CAM_OPE_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "OPE cam_subdev_probe failed:%d", rc);
+		return rc;
+	}
+
+	node = (struct cam_node *) g_ope_dev.sd.token;
+
+	hw_mgr_intf = kzalloc(sizeof(*hw_mgr_intf), GFP_KERNEL);
+	if (!hw_mgr_intf) {
+		rc = -EINVAL;
+		goto hw_alloc_fail;
+	}
+
+	rc = cam_ope_hw_mgr_init(pdev->dev.of_node, (uint64_t *)hw_mgr_intf,
+		&iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "OPE HW manager init failed: %d", rc);
+		goto hw_init_fail;
+	}
+
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		g_ope_dev.ctx_ope[i].base = &g_ope_dev.ctx[i];
+		rc = cam_ope_context_init(&g_ope_dev.ctx_ope[i],
+			hw_mgr_intf, i, iommu_hdl);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE context init failed");
+			goto ctx_fail;
+		}
+	}
+
+	rc = cam_node_init(node, hw_mgr_intf, g_ope_dev.ctx,
+		OPE_CTX_MAX, OPE_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "OPE node init failed");
+		goto ctx_fail;
+	}
+
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_ope_dev_iommu_fault_handler, node);
+
+	g_ope_dev.open_cnt = 0;
+	mutex_init(&g_ope_dev.ope_lock);
+
+	node->sd_handler = cam_ope_subdev_close_internal;
+	rc = cam_subdev_register(&g_ope_dev.sd, pdev);
+	CAM_DBG(CAM_OPE, "Subdev component bound successfully");
+
+	return rc;
+
+ctx_fail:
+	for (--i; i >= 0; i--)
+		cam_ope_context_deinit(&g_ope_dev.ctx_ope[i]);
+hw_init_fail:
+	kfree(hw_mgr_intf);
+hw_alloc_fail:
+	cam_subdev_remove(&g_ope_dev.sd);
+	return rc;
+}
+
+static void cam_ope_subdev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+	struct v4l2_subdev *sd;
+	struct cam_subdev *subdev;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	if (!pdev) {
+		CAM_ERR(CAM_OPE, "pdev is NULL");
+		return;
+	}
+
+	sd = platform_get_drvdata(pdev);
+	if (!sd) {
+		CAM_ERR(CAM_OPE, "V4l2 subdev is NULL");
+		return;
+	}
+
+	subdev = v4l2_get_subdevdata(sd);
+	if (!subdev) {
+		CAM_ERR(CAM_OPE, "cam subdev is NULL");
+		return;
+	}
+
+	for (i = 0; i < OPE_CTX_MAX; i++)
+		cam_ope_context_deinit(&g_ope_dev.ctx_ope[i]);
+
+	cam_node_deinit(g_ope_dev.node);
+	cam_unregister_subdev(&g_ope_dev.sd);
+	cam_subdev_remove(&g_ope_dev.sd);
+	mutex_destroy(&g_ope_dev.ope_lock);
+}
+
+const static struct component_ops cam_ope_subdev_component_ops = {
+	.bind = cam_ope_subdev_component_bind,
+	.unbind = cam_ope_subdev_component_unbind,
+};
+
+static int cam_ope_subdev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_OPE, "Adding OPE subdev component");
+	rc = component_add(&pdev->dev, &cam_ope_subdev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_OPE, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_ope_subdev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ope_subdev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_ope_dt_match[] = {
+	{.compatible = "qcom,cam-ope"},
+	{}
+};
+
+
+struct platform_driver cam_ope_subdev_driver = {
+	.probe = cam_ope_subdev_probe,
+	.remove = cam_ope_subdev_remove,
+	.driver = {
+		.name = "cam_ope",
+		.of_match_table = cam_ope_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ope_subdev_init_module(void)
+{
+	return platform_driver_register(&cam_ope_subdev_driver);
+}
+
+void cam_ope_subdev_exit_module(void)
+{
+	platform_driver_unregister(&cam_ope_subdev_driver);
+}
+
+MODULE_DESCRIPTION("MSM OPE driver");
+MODULE_LICENSE("GPL v2");
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
@@ -0,0 +1,4308 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/uaccess.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/io.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/mutex.h>
+#include <linux/spinlock_types.h>
+#include <linux/workqueue.h>
+#include <linux/timer.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <linux/debugfs.h>
+#include <media/cam_defs.h>
+#include <media/cam_ope.h>
+#include <media/cam_cpas.h>
+
+#include "cam_sync_api.h"
+#include "cam_packet_util.h"
+#include "cam_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_ope_hw_mgr_intf.h"
+#include "cam_ope_hw_mgr.h"
+#include "ope_hw.h"
+#include "cam_smmu_api.h"
+#include "cam_mem_mgr.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_debug_util.h"
+#include "cam_soc_util.h"
+#include "cam_trace.h"
+#include "cam_cpas_api.h"
+#include "cam_common_util.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm_util.h"
+#include "cam_cdm.h"
+#include "ope_dev_intf.h"
+#include "cam_compat.h"
+
+static struct cam_ope_hw_mgr *ope_hw_mgr;
+
+static int cam_ope_req_timer_reset(struct cam_ope_ctx *ctx_data);
+
+static void cam_ope_mgr_dump_pf_data(struct cam_ope_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args  *hw_cmd_args);
+
+static int cam_ope_mgr_get_rsc_idx(struct cam_ope_ctx *ctx_data,
+	struct ope_io_buf_info *in_io_buf)
+{
+	int k = 0;
+	int rsc_idx = -EINVAL;
+
+	if (in_io_buf->direction == CAM_BUF_INPUT) {
+		for (k = 0; k < OPE_IN_RES_MAX; k++) {
+			if (ctx_data->ope_acquire.in_res[k].res_id ==
+				in_io_buf->resource_type)
+				break;
+		}
+		if (k == OPE_IN_RES_MAX) {
+			CAM_ERR(CAM_OPE, "Invalid res_id %d",
+				in_io_buf->resource_type);
+			goto end;
+		}
+		rsc_idx = k;
+	} else if (in_io_buf->direction == CAM_BUF_OUTPUT) {
+		for (k = 0; k < OPE_OUT_RES_MAX; k++) {
+			if (ctx_data->ope_acquire.out_res[k].res_id ==
+				in_io_buf->resource_type)
+				break;
+		}
+		if (k == OPE_OUT_RES_MAX) {
+			CAM_ERR(CAM_OPE, "Invalid res_id %d",
+				in_io_buf->resource_type);
+			goto end;
+		}
+		rsc_idx = k;
+	}
+
+end:
+	return rsc_idx;
+}
+
+static bool cam_ope_is_pending_request(struct cam_ope_ctx *ctx_data)
+{
+	return !bitmap_empty(ctx_data->bitmap, CAM_CTX_REQ_MAX);
+}
+
+static int cam_ope_mgr_process_cmd(void *priv, void *data)
+{
+	int rc;
+	struct ope_cmd_work_data *task_data = NULL;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_OPE, "Invalid params%pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	ctx_data = priv;
+	task_data = (struct ope_cmd_work_data *)data;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	cdm_cmd = task_data->data;
+
+	if (!cdm_cmd) {
+		CAM_ERR(CAM_OPE, "Invalid params%pK", cdm_cmd);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	if (ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_OPE, "ctx id :%u is not in use",
+			ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	if (task_data->req_id <= ctx_data->last_flush_req) {
+		CAM_WARN(CAM_OPE,
+			"request %lld has been flushed, reject packet",
+			task_data->req_id, ctx_data->last_flush_req);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	if (!cam_ope_is_pending_request(ctx_data)) {
+		CAM_WARN(CAM_OPE, "no pending req, req %lld last flush %lld",
+			task_data->req_id, ctx_data->last_flush_req);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_OPE,
+		"cam_cdm_submit_bls: handle 0x%x, ctx_id %d req %d cookie %d",
+		ctx_data->ope_cdm.cdm_handle, ctx_data->ctx_id,
+		task_data->req_id, cdm_cmd->cookie);
+
+	if (task_data->req_id > ctx_data->last_flush_req)
+		ctx_data->last_flush_req = 0;
+
+	cam_ope_req_timer_reset(ctx_data);
+
+	rc = cam_cdm_submit_bls(ctx_data->ope_cdm.cdm_handle, cdm_cmd);
+
+	if (!rc)
+		ctx_data->req_cnt++;
+	else
+		CAM_ERR(CAM_OPE, "submit failed for %lld", cdm_cmd->cookie);
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_ope_mgr_reset_hw(void)
+{
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+	int i, rc = 0;
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RESET,
+			NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Reset failed: %d", rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static void cam_ope_free_io_config(struct cam_ope_request *req)
+{
+	int i, j;
+
+	for (i = 0; i < OPE_MAX_BATCH_SIZE; i++) {
+		for (j = 0; j < OPE_MAX_IO_BUFS; j++) {
+			if (req->io_buf[i][j]) {
+				cam_free_clear((void *)req->io_buf[i][j]);
+				req->io_buf[i][j] = NULL;
+			}
+		}
+	}
+}
+
+static void cam_ope_device_timer_stop(struct cam_ope_hw_mgr *hw_mgr)
+{
+	if (hw_mgr->clk_info.watch_dog) {
+		hw_mgr->clk_info.watch_dog_reset_counter = 0;
+		crm_timer_exit(&hw_mgr->clk_info.watch_dog);
+		hw_mgr->clk_info.watch_dog = NULL;
+	}
+}
+
+static void cam_ope_device_timer_reset(struct cam_ope_hw_mgr *hw_mgr)
+{
+
+	if (hw_mgr->clk_info.watch_dog) {
+		CAM_DBG(CAM_OPE, "reset timer");
+		crm_timer_reset(hw_mgr->clk_info.watch_dog);
+			hw_mgr->clk_info.watch_dog_reset_counter++;
+	}
+}
+
+static int cam_ope_req_timer_modify(struct cam_ope_ctx *ctx_data,
+	int32_t expires)
+{
+	if (ctx_data->req_watch_dog) {
+		CAM_DBG(CAM_OPE, "stop timer : ctx_id = %d", ctx_data->ctx_id);
+		crm_timer_modify(ctx_data->req_watch_dog, expires);
+	}
+	return 0;
+}
+
+static int cam_ope_req_timer_stop(struct cam_ope_ctx *ctx_data)
+{
+	if (ctx_data->req_watch_dog) {
+		CAM_DBG(CAM_OPE, "stop timer : ctx_id = %d", ctx_data->ctx_id);
+		ctx_data->req_watch_dog_reset_counter = 0;
+		crm_timer_exit(&ctx_data->req_watch_dog);
+		ctx_data->req_watch_dog = NULL;
+	}
+	return 0;
+}
+
+static int cam_ope_req_timer_reset(struct cam_ope_ctx *ctx_data)
+{
+	if (ctx_data && ctx_data->req_watch_dog) {
+		ctx_data->req_watch_dog_reset_counter++;
+		CAM_DBG(CAM_OPE, "reset timer : ctx_id = %d, counter=%d",
+			ctx_data->ctx_id,
+			ctx_data->req_watch_dog_reset_counter);
+		crm_timer_reset(ctx_data->req_watch_dog);
+	}
+
+	return 0;
+}
+
+
+static int cam_ope_mgr_reapply_config(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_request *ope_req)
+{
+	int rc = 0;
+	uint64_t request_id = 0;
+	struct crm_workq_task *task;
+	struct ope_cmd_work_data *task_data;
+
+	request_id = ope_req->request_id;
+	CAM_DBG(CAM_OPE, "reapply req_id = %lld", request_id);
+
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		return -ENOMEM;
+	}
+
+	task_data = (struct ope_cmd_work_data *)task->payload;
+	task_data->data = (void *)ope_req->cdm_cmd;
+	task_data->req_id = request_id;
+	task_data->type = OPE_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_ope_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, ctx_data,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_get_valid_ctx_id(void)
+{
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+	int i;
+
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		if (hw_mgr->ctx[i].ctx_state == OPE_CTX_STATE_ACQUIRED)
+			break;
+	}
+
+	if (i == OPE_CTX_MAX)
+		return -EINVAL;
+
+	return i;
+}
+
+static int32_t cam_ope_mgr_process_msg(void *priv, void *data)
+{
+	struct ope_msg_work_data *task_data;
+	struct cam_ope_hw_mgr *hw_mgr;
+	struct cam_ope_ctx *ctx;
+	uint32_t irq_status;
+	int32_t ctx_id;
+	int rc = 0, i;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_OPE, "Invalid data");
+		return -EINVAL;
+	}
+
+	task_data = data;
+	hw_mgr = priv;
+	irq_status = task_data->irq_status;
+	ctx_id = cam_get_valid_ctx_id();
+	if (ctx_id < 0) {
+		CAM_ERR(CAM_OPE, "No valid context to handle error");
+		return ctx_id;
+	}
+
+	ctx = &hw_mgr->ctx[ctx_id];
+
+	/* Indicate about this error to CDM and reset OPE*/
+	rc = cam_cdm_handle_error(ctx->ope_cdm.cdm_handle);
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_OPE, "ctx id: %d not in right state: %d",
+			ctx_id, ctx->ctx_state);
+		mutex_unlock(&ctx->ctx_mutex);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RESET,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_OPE, "OPE Dev acquire failed: %d", rc);
+	}
+
+	mutex_unlock(&ctx->ctx_mutex);
+	return rc;
+}
+
+static int cam_ope_dump_hang_patches(struct cam_packet *packet,
+	struct cam_ope_hang_dump *dump)
+{
+	struct cam_patch_desc *patch_desc = NULL;
+	dma_addr_t iova_addr;
+	size_t     src_buf_size;
+	int        i, rc = 0;
+	int32_t iommu_hdl = ope_hw_mgr->iommu_hdl;
+
+	/* process patch descriptor */
+	patch_desc = (struct cam_patch_desc *)
+		((uint32_t *) &packet->payload_flex +
+		packet->patch_offset/4);
+
+	for (i = 0; i < packet->num_patches; i++) {
+		rc = cam_mem_get_io_buf(patch_desc[i].src_buf_hdl,
+			iommu_hdl, &iova_addr, &src_buf_size, NULL, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_UTIL,
+				"get src buf address failed for handle 0x%x",
+				patch_desc[i].src_buf_hdl);
+			return rc;
+		}
+		dump->entries[dump->num_bufs].memhdl =
+			patch_desc[i].src_buf_hdl;
+		dump->entries[dump->num_bufs].iova   = iova_addr;
+		dump->entries[dump->num_bufs].offset = patch_desc[i].src_offset;
+		dump->entries[dump->num_bufs].len    = 0;
+		dump->entries[dump->num_bufs].size   = src_buf_size;
+		dump->num_bufs++;
+	}
+	return rc;
+}
+
+static int cam_ope_dump_direct(struct ope_cmd_buf_info *cmd_buf_info,
+	struct cam_ope_hang_dump *dump)
+{
+	dma_addr_t iova_addr;
+	size_t size;
+	int rc = 0;
+
+	rc = cam_mem_get_io_buf(cmd_buf_info->mem_handle,
+		ope_hw_mgr->iommu_hdl, &iova_addr, &size, NULL, NULL);
+	if (rc < 0) {
+		CAM_ERR(CAM_UTIL, "get cmd buf addressfailed for handle 0x%x",
+			cmd_buf_info->mem_handle);
+		return rc;
+	}
+	dump->entries[dump->num_bufs].memhdl = cmd_buf_info->mem_handle;
+	dump->entries[dump->num_bufs].iova   = iova_addr;
+	dump->entries[dump->num_bufs].offset = cmd_buf_info->offset;
+	dump->entries[dump->num_bufs].len    = cmd_buf_info->length;
+	dump->entries[dump->num_bufs].size   = size;
+	dump->num_bufs++;
+	return 0;
+}
+
+static void cam_ope_dump_dmi(struct cam_ope_hang_dump *dump, uint32_t addr,
+	uint32_t length)
+{
+	int i;
+	uint32_t memhdl = 0, iova = 0, size;
+
+	for (i = 0; i < dump->num_bufs; i++) {
+		if (dump->entries[i].iova + dump->entries[i].offset == addr) {
+			if (dump->entries[i].len == length)
+				goto end;
+			else if (dump->entries[i].len == 0) {
+				dump->entries[i].len = length;
+				goto end;
+			} else {
+				iova = dump->entries[i].iova;
+				memhdl = dump->entries[i].memhdl;
+				size = dump->entries[i].size;
+			}
+		}
+	}
+	if (memhdl && iova) {
+		dump->entries[dump->num_bufs].memhdl = memhdl;
+		dump->entries[dump->num_bufs].iova = iova;
+		dump->entries[dump->num_bufs].offset = addr - iova;
+		dump->entries[dump->num_bufs].len = length;
+		dump->entries[dump->num_bufs].size = size;
+		dump->num_bufs++;
+	}
+end:
+	return;
+}
+
+static int cam_ope_mgr_put_cmd_buf(struct cam_packet *packet)
+{
+	int i = 0;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
+			cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
+			continue;
+
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+
+	return 0;
+}
+
+static int cam_ope_dump_indirect(struct ope_cmd_buf_info *cmd_buf_info,
+	struct cam_ope_hang_dump *dump)
+{
+	int rc = 0;
+	uintptr_t cpu_addr;
+	size_t buf_len;
+	uint32_t num_dmi;
+	struct cdm_dmi_cmd dmi_cmd;
+	uint32_t *print_ptr, print_idx;
+
+	rc = cam_mem_get_cpu_buf(cmd_buf_info->mem_handle,
+		&cpu_addr, &buf_len);
+	if (rc || !cpu_addr) {
+		CAM_ERR(CAM_OPE, "get cmd buf fail 0x%x",
+			cmd_buf_info->mem_handle);
+		return rc;
+	}
+	cpu_addr = cpu_addr + cmd_buf_info->offset;
+
+	num_dmi = cmd_buf_info->length /
+		sizeof(struct cdm_dmi_cmd);
+	print_ptr = (uint32_t *)cpu_addr;
+	for (print_idx = 0; print_idx < num_dmi; print_idx++) {
+		memcpy(&dmi_cmd, (const void *)print_ptr,
+			sizeof(struct cdm_dmi_cmd));
+		cam_ope_dump_dmi(dump, dmi_cmd.addr, dmi_cmd.length+1);
+			print_ptr += sizeof(struct cdm_dmi_cmd) /
+				sizeof(uint32_t);
+	}
+	cam_mem_put_cpu_buf((int32_t) cmd_buf_info->mem_handle);
+	return rc;
+}
+
+static int cam_ope_mgr_dump_cmd_buf(uintptr_t frame_process_addr,
+	struct cam_ope_hang_dump *dump)
+{
+	int rc = 0;
+	int i, j;
+	struct ope_frame_process *frame_process;
+	struct ope_cmd_buf_info *cmd_buf;
+
+	frame_process = (struct ope_frame_process *)frame_process_addr;
+	for (i = 0; i < frame_process->batch_size; i++) {
+		for (j = 0; j < frame_process->num_cmd_bufs[i]; j++) {
+			cmd_buf = &frame_process->cmd_buf[i][j];
+			if (cmd_buf->type == OPE_CMD_BUF_TYPE_DIRECT) {
+				if (cmd_buf->cmd_buf_usage == OPE_CMD_BUF_DEBUG)
+					continue;
+				cam_ope_dump_direct(cmd_buf, dump);
+			} else if (cmd_buf->type == OPE_CMD_BUF_TYPE_INDIRECT)
+				cam_ope_dump_indirect(cmd_buf, dump);
+		}
+	}
+	return rc;
+}
+
+static int cam_ope_mgr_dump_frame_set(uintptr_t frame_process_addr,
+	struct cam_ope_hang_dump *dump)
+{
+	int i, j, rc = 0;
+	dma_addr_t iova_addr;
+	size_t size;
+	struct ope_frame_process *frame_process;
+	struct ope_io_buf_info *io_buf;
+	struct cam_ope_buf_entry *buf_entry;
+	struct cam_ope_output_info *output_info;
+
+	frame_process = (struct ope_frame_process *)frame_process_addr;
+	for (j = 0; j < frame_process->batch_size; j++) {
+		for (i = 0; i < frame_process->frame_set[j].num_io_bufs; i++) {
+			io_buf = &frame_process->frame_set[j].io_buf[i];
+			rc = cam_mem_get_io_buf(io_buf->mem_handle[0],
+				ope_hw_mgr->iommu_hdl, &iova_addr, &size, NULL, NULL);
+			if (rc) {
+				CAM_ERR(CAM_OPE, "get io buf fail 0x%x",
+					io_buf->mem_handle[0]);
+				return rc;
+			}
+			buf_entry = &dump->entries[dump->num_bufs];
+			buf_entry->memhdl = io_buf->mem_handle[0];
+			buf_entry->iova = iova_addr;
+			buf_entry->offset = io_buf->plane_offset[0];
+			buf_entry->len = size - io_buf->plane_offset[0];
+			buf_entry->size = size;
+			dump->num_bufs++;
+			if (io_buf->direction == 2) {
+				output_info =
+					&dump->outputs[dump->num_outputs];
+				output_info->iova = iova_addr;
+				output_info->offset = io_buf->plane_offset[0];
+				output_info->len = size -
+					io_buf->plane_offset[0];
+				dump->num_outputs++;
+			}
+		}
+	}
+	return rc;
+}
+
+static int cam_ope_dump_frame_process(struct cam_packet *packet,
+	struct cam_ope_hang_dump *dump)
+{
+	int rc = 0;
+	int i;
+	size_t len;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	uintptr_t cpu_addr = 0;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
+			cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
+			continue;
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&cpu_addr, &len);
+		if (rc || !cpu_addr) {
+			CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+				cmd_desc[i].mem_handle);
+			return rc;
+		}
+		cpu_addr = cpu_addr + cmd_desc[i].offset;
+		break;
+	}
+
+	if (!cpu_addr) {
+		CAM_ERR(CAM_OPE, "invalid number of cmd buf");
+		return -EINVAL;
+	}
+
+	cam_ope_mgr_dump_cmd_buf(cpu_addr, dump);
+	cam_ope_mgr_dump_frame_set(cpu_addr, dump);
+	cam_ope_mgr_put_cmd_buf(packet);
+	return rc;
+}
+
+static int cam_ope_dump_bls(struct cam_ope_request *ope_req,
+	struct cam_ope_hang_dump *dump)
+{
+	struct cam_cdm_bl_request *cdm_cmd;
+	size_t size;
+	int i, rc;
+	dma_addr_t iova_addr;
+
+	cdm_cmd = ope_req->cdm_cmd;
+	for (i = 0; i < cdm_cmd->cmd_arrary_count; i++) {
+		rc = cam_mem_get_io_buf(cdm_cmd->cmd_flex[i].bl_addr.mem_handle,
+				ope_hw_mgr->iommu_hdl, &iova_addr, &size, NULL, NULL);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "get io buf fail 0x%x",
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle);
+			return rc;
+		}
+		dump->bl_entries[dump->num_bls].base =
+			(uint32_t)iova_addr + cdm_cmd->cmd_flex[i].offset;
+		dump->bl_entries[dump->num_bls].len = cdm_cmd->cmd_flex[i].len;
+		dump->bl_entries[dump->num_bls].arbitration =
+			cdm_cmd->cmd_flex[i].arbitrate;
+		dump->num_bls++;
+	}
+	return 0;
+}
+
+static void cam_ope_dump_req_data(struct cam_ope_request *ope_req)
+{
+	struct cam_ope_hang_dump *dump;
+	struct cam_packet *packet =
+		(struct cam_packet *)ope_req->hang_data.packet;
+
+	if (!ope_req->ope_debug_buf.cpu_addr ||
+		ope_req->ope_debug_buf.len < sizeof(struct cam_ope_hang_dump) ||
+		(ope_req->ope_debug_buf.offset + ope_req->ope_debug_buf.len)
+			> ope_req->ope_debug_buf.size) {
+		CAM_ERR(CAM_OPE, "Invalid debug buf, size %d %d len %d off %d",
+				sizeof(struct cam_ope_hang_dump),
+				ope_req->ope_debug_buf.size,
+				ope_req->ope_debug_buf.len,
+				ope_req->ope_debug_buf.offset);
+		return;
+	}
+
+	dump = (struct cam_ope_hang_dump *)ope_req->ope_debug_buf.cpu_addr;
+	memset(dump, 0, sizeof(struct cam_ope_hang_dump));
+	dump->num_bufs = 0;
+	cam_ope_dump_hang_patches(packet, dump);
+	cam_ope_dump_frame_process(packet, dump);
+	cam_ope_dump_bls(ope_req, dump);
+}
+
+static bool cam_ope_check_req_delay(struct cam_ope_ctx *ctx_data,
+	uint64_t req_time)
+{
+	struct timespec64 ts;
+	uint64_t ts_ns;
+
+	ktime_get_boottime_ts64(&ts);
+	ts_ns = (uint64_t)((ts.tv_sec * 1000000000) +
+		ts.tv_nsec);
+
+	if (ts_ns - req_time <
+		((ctx_data->req_timer_timeout -
+			ctx_data->req_timer_timeout / 10) * 1000000)) {
+		CAM_INFO(CAM_OPE, "ctx: %d, ts_ns : %llu",
+		ctx_data->ctx_id, ts_ns);
+		cam_ope_req_timer_reset(ctx_data);
+		return true;
+	}
+
+	return false;
+}
+
+static int32_t cam_ope_process_request_timer(void *priv, void *data)
+{
+	struct ope_clk_work_data *clk_data = (struct ope_clk_work_data *)data;
+	struct cam_ope_ctx *ctx_data = (struct cam_ope_ctx *)clk_data->data;
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+	uint32_t id;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_ope_clk_info *clk_info;
+	struct cam_ope_dev_bw_update clk_update;
+	int i = 0;
+	int device_share_ratio = 1;
+	int path_index;
+	struct crm_workq_task *task;
+	struct ope_msg_work_data *task_data;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "ctx_data is NULL, failed to update clk");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	if ((ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) ||
+		(ctx_data->req_watch_dog_reset_counter == 0)) {
+		CAM_DBG(CAM_OPE, "state %d counter = %d", ctx_data->ctx_state,
+			ctx_data->req_watch_dog_reset_counter);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return 0;
+	}
+
+	if (cam_ope_is_pending_request(ctx_data)) {
+
+		if (cam_ope_check_req_delay(ctx_data,
+			ctx_data->last_req_time)) {
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+
+		if (cam_ope_check_req_delay(ctx_data,
+			ope_hw_mgr->last_callback_time)) {
+			CAM_WARN(CAM_OPE,
+				"ope ctx: %d stuck due to other contexts",
+				ctx_data->ctx_id);
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+
+		if (!cam_cdm_detect_hang_error(ctx_data->ope_cdm.cdm_handle)) {
+			cam_ope_req_timer_reset(ctx_data);
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+
+		/* Try checking ctx struck again */
+		if (cam_ope_check_req_delay(ctx_data,
+			ope_hw_mgr->last_callback_time)) {
+			CAM_WARN(CAM_OPE,
+				"ope ctx: %d stuck due to other contexts",
+				ctx_data->ctx_id);
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+
+		CAM_ERR(CAM_OPE,
+			"pending req at HW, ctx %d lrt %llu lct %llu",
+			ctx_data->ctx_id, ctx_data->last_req_time,
+			ope_hw_mgr->last_callback_time);
+		hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				OPE_HW_DUMP_DEBUG,
+				NULL, 0);
+
+		task = cam_req_mgr_workq_get_task(ope_hw_mgr->msg_work);
+		if (!task) {
+			CAM_ERR(CAM_OPE, "no empty task");
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+		task_data = (struct ope_msg_work_data *)task->payload;
+		task_data->data = hw_mgr;
+		task_data->irq_status = 1;
+		task_data->type = OPE_WORKQ_TASK_MSG_TYPE;
+		task->process_cb = cam_ope_mgr_process_msg;
+		cam_req_mgr_workq_enqueue_task(task, ope_hw_mgr,
+			CRM_TASK_PRIORITY_0);
+		cam_ope_req_timer_reset(ctx_data);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return 0;
+	}
+
+	cam_ope_req_timer_modify(ctx_data, ~0);
+	/* Remove context BW */
+	dev_intf = hw_mgr->ope_dev_intf[0];
+	if (!dev_intf) {
+		CAM_ERR(CAM_OPE, "OPE dev intf is NULL");
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return -EINVAL;
+	}
+
+	clk_info = &hw_mgr->clk_info;
+	id = OPE_HW_BW_UPDATE;
+	device_share_ratio = hw_mgr->num_ope;
+
+	clk_update.ahb_vote.type = CAM_VOTE_DYNAMIC;
+	clk_update.ahb_vote.vote.freq = 0;
+	clk_update.ahb_vote_valid = false;
+
+	/*
+	 * Remove previous vote of this context from hw mgr first.
+	 * hw_mgr_clk_info has all valid paths, with each path in its
+	 * own index. BW that we wanted to vote now is after removing
+	 * current context's vote from hw mgr consolidated vote
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index = ctx_data->clk_info.axi_path[i]
+			.path_data_type -
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) {
+			CAM_WARN(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i]
+				.path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+				continue;
+		}
+
+		clk_info->axi_path[path_index].camnoc_bw -=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		clk_info->axi_path[path_index].mnoc_ab_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		clk_info->axi_path[path_index].mnoc_ib_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		clk_info->axi_path[path_index].ddr_ab_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+		clk_info->axi_path[path_index].ddr_ib_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+	}
+
+	memset(&ctx_data->clk_info.axi_path[0], 0,
+		CAM_OPE_MAX_PER_PATH_VOTES *
+		sizeof(struct cam_cpas_axi_per_path_bw_vote));
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+
+	clk_update.axi_vote.num_paths = clk_info->num_paths;
+	memcpy(&clk_update.axi_vote.axi_path[0],
+		&clk_info->axi_path[0],
+		clk_update.axi_vote.num_paths *
+		sizeof(struct cam_cpas_axi_per_path_bw_vote));
+
+	if (device_share_ratio > 1) {
+		for (i = 0; i < clk_update.axi_vote.num_paths; i++) {
+			do_div(
+			clk_update.axi_vote.axi_path[i].camnoc_bw,
+				device_share_ratio);
+			do_div(
+			clk_update.axi_vote.axi_path[i].mnoc_ab_bw,
+				device_share_ratio);
+			do_div(
+			clk_update.axi_vote.axi_path[i].mnoc_ib_bw,
+				device_share_ratio);
+			do_div(
+			clk_update.axi_vote.axi_path[i].ddr_ab_bw,
+				device_share_ratio);
+			do_div(
+			clk_update.axi_vote.axi_path[i].ddr_ib_bw,
+				device_share_ratio);
+		}
+	}
+
+	clk_update.axi_vote_valid = true;
+	dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, id,
+		&clk_update, sizeof(clk_update));
+
+	CAM_DBG(CAM_OPE, "X :ctx_id = %d curr_fc = %u bc = %u",
+		ctx_data->ctx_id, ctx_data->clk_info.curr_fc,
+		ctx_data->clk_info.base_clk);
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return 0;
+}
+
+static void cam_ope_req_timer_cb(struct timer_list *timer_data)
+{
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct ope_clk_work_data *task_data;
+	struct cam_req_mgr_timer *timer =
+	container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+
+	spin_lock_irqsave(&ope_hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->timer_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		spin_unlock_irqrestore(&ope_hw_mgr->hw_mgr_lock, flags);
+		return;
+	}
+
+	task_data = (struct ope_clk_work_data *)task->payload;
+	task_data->data = timer->parent;
+	task_data->type = OPE_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_ope_process_request_timer;
+	cam_req_mgr_workq_enqueue_task(task, ope_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&ope_hw_mgr->hw_mgr_lock, flags);
+}
+
+static int cam_ope_start_req_timer(struct cam_ope_ctx *ctx_data)
+{
+	int rc = 0;
+
+	rc = crm_timer_init(&ctx_data->req_watch_dog,
+		ctx_data->req_timer_timeout, ctx_data, &cam_ope_req_timer_cb);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to start timer");
+
+	ctx_data->req_watch_dog_reset_counter = 0;
+
+	return rc;
+}
+
+static int cam_ope_supported_clk_rates(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data)
+{
+	int i;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_hw_info *dev = NULL;
+
+	dev_intf = hw_mgr->ope_dev_intf[0];
+	if (!dev_intf) {
+		CAM_ERR(CAM_OPE, "dev_intf is invalid");
+		return -EINVAL;
+	}
+
+	dev = (struct cam_hw_info *)dev_intf->hw_priv;
+	soc_info = &dev->soc_info;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++) {
+		ctx_data->clk_info.clk_rate[i] =
+			soc_info->clk_rate[i][soc_info->src_clk_idx];
+		CAM_DBG(CAM_OPE, "clk_info[%d] = %d",
+			i, ctx_data->clk_info.clk_rate[i]);
+	}
+
+	return 0;
+}
+
+static int cam_ope_ctx_clk_info_init(struct cam_ope_ctx *ctx_data)
+{
+	int i;
+
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+	ctx_data->clk_info.uncompressed_bw = 0;
+	ctx_data->clk_info.compressed_bw = 0;
+
+	for (i = 0; i < CAM_OPE_MAX_PER_PATH_VOTES; i++) {
+		ctx_data->clk_info.axi_path[i].camnoc_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ab_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ib_bw = 0;
+	}
+
+	cam_ope_supported_clk_rates(ope_hw_mgr, ctx_data);
+
+	return 0;
+}
+
+static int32_t cam_ope_deinit_idle_clk(void *priv, void *data)
+{
+	struct cam_ope_hw_mgr *hw_mgr = (struct cam_ope_hw_mgr *)priv;
+	struct ope_clk_work_data *task_data = (struct ope_clk_work_data *)data;
+	struct cam_ope_clk_info *clk_info =
+		(struct cam_ope_clk_info *)task_data->data;
+	uint32_t id;
+	uint32_t i;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_hw_intf *dev_intf = NULL;
+	int rc = 0;
+	bool busy = false;
+
+	clk_info->base_clk = 0;
+	clk_info->curr_clk = 0;
+	clk_info->over_clked = 0;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx[i];
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (ctx_data->ctx_state == OPE_CTX_STATE_ACQUIRED) {
+			busy = cam_ope_is_pending_request(ctx_data);
+			if (busy) {
+				mutex_unlock(&ctx_data->ctx_mutex);
+				break;
+			}
+			cam_ope_ctx_clk_info_init(ctx_data);
+		}
+		mutex_unlock(&ctx_data->ctx_mutex);
+	}
+
+	if (busy) {
+		cam_ope_device_timer_reset(hw_mgr);
+		rc = -EBUSY;
+		goto done;
+	}
+
+	dev_intf = hw_mgr->ope_dev_intf[0];
+	id = OPE_HW_CLK_DISABLE;
+
+	CAM_DBG(CAM_OPE, "Disable %d", clk_info->hw_type);
+
+	dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, id,	NULL, 0);
+
+done:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static void cam_ope_device_timer_cb(struct timer_list *timer_data)
+{
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct ope_clk_work_data *task_data;
+	struct cam_req_mgr_timer *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+
+	spin_lock_irqsave(&ope_hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->timer_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		spin_unlock_irqrestore(&ope_hw_mgr->hw_mgr_lock, flags);
+		return;
+	}
+
+	task_data = (struct ope_clk_work_data *)task->payload;
+	task_data->data = timer->parent;
+	task_data->type = OPE_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_ope_deinit_idle_clk;
+	cam_req_mgr_workq_enqueue_task(task, ope_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&ope_hw_mgr->hw_mgr_lock, flags);
+}
+
+static int cam_ope_device_timer_start(struct cam_ope_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	int i;
+
+	for (i = 0; i < CLK_HW_MAX; i++)  {
+		if (!hw_mgr->clk_info.watch_dog) {
+			rc = crm_timer_init(&hw_mgr->clk_info.watch_dog,
+				OPE_DEVICE_IDLE_TIMEOUT, &hw_mgr->clk_info,
+				&cam_ope_device_timer_cb);
+
+			if (rc)
+				CAM_ERR(CAM_OPE, "Failed to start timer %d", i);
+
+			hw_mgr->clk_info.watch_dog_reset_counter = 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ope_get_actual_clk_rate_idx(
+	struct cam_ope_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return i;
+
+	/*
+	 * Caller has to ensure returned index is within array
+	 * size bounds while accessing that index.
+	 */
+
+	return i;
+}
+
+static bool cam_ope_is_over_clk(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info)
+{
+	int base_clk_idx;
+	int curr_clk_idx;
+
+	base_clk_idx = cam_ope_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->base_clk);
+
+	curr_clk_idx = cam_ope_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->curr_clk);
+
+	CAM_DBG(CAM_OPE, "bc_idx = %d cc_idx = %d %d %d",
+		base_clk_idx, curr_clk_idx, hw_mgr_clk_info->base_clk,
+		hw_mgr_clk_info->curr_clk);
+
+	if (curr_clk_idx > base_clk_idx)
+		return true;
+
+	return false;
+}
+
+
+static int cam_ope_get_lower_clk_rate(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_ope_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	while (i > 0) {
+		if (ctx_data->clk_info.clk_rate[i - 1])
+			return ctx_data->clk_info.clk_rate[i - 1];
+		i--;
+	}
+
+	CAM_DBG(CAM_OPE, "Already clk at lower level");
+
+	return base_clk;
+}
+
+static int cam_ope_get_next_clk_rate(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_ope_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	while (i < CAM_MAX_VOTE - 1) {
+		if (ctx_data->clk_info.clk_rate[i + 1])
+			return ctx_data->clk_info.clk_rate[i + 1];
+		i++;
+	}
+
+	CAM_DBG(CAM_OPE, "Already clk at higher level");
+
+	return base_clk;
+}
+
+static int cam_ope_get_actual_clk_rate(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return ctx_data->clk_info.clk_rate[i];
+
+	return base_clk;
+}
+
+static int cam_ope_calc_total_clk(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_clk_info *hw_mgr_clk_info, uint32_t dev_type)
+{
+	int i;
+	struct cam_ope_ctx *ctx_data;
+
+	hw_mgr_clk_info->base_clk = 0;
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx[i];
+		if (ctx_data->ctx_state == OPE_CTX_STATE_ACQUIRED)
+			hw_mgr_clk_info->base_clk +=
+				ctx_data->clk_info.base_clk;
+	}
+
+	return 0;
+}
+
+static uint32_t cam_ope_mgr_calc_base_clk(uint32_t frame_cycles,
+	uint64_t budget)
+{
+	uint64_t mul = 1000000000;
+	uint64_t base_clk = frame_cycles * mul;
+
+	do_div(base_clk, budget);
+
+	CAM_DBG(CAM_OPE, "budget = %lld fc = %d ib = %lld base_clk = %lld",
+		budget, frame_cycles,
+		(long long)(frame_cycles * mul), base_clk);
+
+	return base_clk;
+}
+
+static bool cam_ope_update_clk_overclk_free(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info,
+	struct cam_ope_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	int rc = false;
+
+	/*
+	 * In caseof no pending packets case
+	 *    1. In caseof overclk cnt is less than threshold, increase
+	 *       overclk count and no update in the clock rate
+	 *    2. In caseof overclk cnt is greater than or equal to threshold
+	 *       then lower clock rate by one level and update hw_mgr current
+	 *       clock value.
+	 *        a. In case of new clock rate greater than sum of clock
+	 *           rates, reset overclk count value to zero if it is
+	 *           overclock
+	 *        b. if it is less than sum of base clocks then go to next
+	 *           level of clock and make overclk count to zero
+	 *        c. if it is same as sum of base clock rates update overclock
+	 *           cnt to 0
+	 */
+	if (hw_mgr_clk_info->over_clked < hw_mgr_clk_info->threshold) {
+		hw_mgr_clk_info->over_clked++;
+		rc = false;
+	} else {
+		hw_mgr_clk_info->curr_clk =
+			cam_ope_get_lower_clk_rate(hw_mgr, ctx_data,
+			hw_mgr_clk_info->curr_clk);
+		if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk) {
+			if (cam_ope_is_over_clk(hw_mgr, ctx_data,
+				hw_mgr_clk_info))
+				hw_mgr_clk_info->over_clked = 0;
+		} else if (hw_mgr_clk_info->curr_clk <
+			hw_mgr_clk_info->base_clk) {
+			hw_mgr_clk_info->curr_clk =
+			cam_ope_get_next_clk_rate(hw_mgr, ctx_data,
+				hw_mgr_clk_info->curr_clk);
+				hw_mgr_clk_info->over_clked = 0;
+		} else if (hw_mgr_clk_info->curr_clk ==
+			hw_mgr_clk_info->base_clk) {
+			hw_mgr_clk_info->over_clked = 0;
+		}
+		rc = true;
+	}
+
+	return rc;
+}
+
+static bool cam_ope_update_clk_free(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info,
+	struct cam_ope_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	int rc = false;
+	bool over_clocked = false;
+
+	ctx_data->clk_info.curr_fc = clk_info->frame_cycles;
+	ctx_data->clk_info.base_clk = base_clk;
+	cam_ope_calc_total_clk(hw_mgr, hw_mgr_clk_info,
+		ctx_data->ope_acquire.dev_type);
+
+	/*
+	 * Current clock is not always sum of base clocks, due to
+	 * clock scales update to next higher or lower levels, it
+	 * equals to one of discrete clock values supported by hardware.
+	 * So even current clock is higher than sum of base clocks, we
+	 * can not consider it is over clocked. if it is greater than
+	 * discrete clock level then only it is considered as over clock.
+	 * 1. Handle over clock case
+	 * 2. If current clock is less than sum of base clocks
+	 *    update current clock
+	 * 3. If current clock is same as sum of base clocks no action
+	 */
+
+	over_clocked = cam_ope_is_over_clk(hw_mgr, ctx_data,
+		hw_mgr_clk_info);
+
+	if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk &&
+		over_clocked) {
+		rc = cam_ope_update_clk_overclk_free(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+	} else if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->over_clked = 0;
+		rc = false;
+	}  else if (hw_mgr_clk_info->curr_clk < hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->curr_clk = cam_ope_get_actual_clk_rate(hw_mgr,
+			ctx_data, hw_mgr_clk_info->base_clk);
+		rc = true;
+	}
+
+	return rc;
+}
+
+static bool cam_ope_update_clk_busy(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info,
+	struct cam_ope_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	uint32_t next_clk_level;
+	uint32_t actual_clk;
+	bool rc = false;
+
+	/* 1. if current request frame cycles(fc) are more than previous
+	 *      frame fc
+	 *      Calculate the new base clock.
+	 *      if sum of base clocks are more than next available clk level
+	 *       Update clock rate, change curr_clk_rate to sum of base clock
+	 *       rates and make over_clked to zero
+	 *      else
+	 *       Update clock rate to next level, update curr_clk_rate and make
+	 *       overclked cnt to zero
+	 * 2. if current fc is less than or equal to previous  frame fc
+	 *      Still Bump up the clock to next available level
+	 *      if it is available, then update clock, make overclk cnt to
+	 *      zero. If the clock is already at highest clock rate then
+	 *      no need to update the clock
+	 */
+	ctx_data->clk_info.base_clk = base_clk;
+	hw_mgr_clk_info->over_clked = 0;
+	if (clk_info->frame_cycles > ctx_data->clk_info.curr_fc) {
+		cam_ope_calc_total_clk(hw_mgr, hw_mgr_clk_info,
+			ctx_data->ope_acquire.dev_type);
+		actual_clk = cam_ope_get_actual_clk_rate(hw_mgr,
+			ctx_data, base_clk);
+		if (hw_mgr_clk_info->base_clk > actual_clk) {
+			hw_mgr_clk_info->curr_clk = hw_mgr_clk_info->base_clk;
+		} else {
+			next_clk_level = cam_ope_get_next_clk_rate(hw_mgr,
+				ctx_data, hw_mgr_clk_info->curr_clk);
+			hw_mgr_clk_info->curr_clk = next_clk_level;
+		}
+		rc = true;
+	} else {
+		next_clk_level =
+			cam_ope_get_next_clk_rate(hw_mgr, ctx_data,
+				hw_mgr_clk_info->curr_clk);
+		if (hw_mgr_clk_info->curr_clk < next_clk_level) {
+			hw_mgr_clk_info->curr_clk = next_clk_level;
+			rc = true;
+		}
+	}
+	ctx_data->clk_info.curr_fc = clk_info->frame_cycles;
+
+	return rc;
+}
+
+static bool cam_ope_check_clk_update(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, int idx)
+{
+	bool busy = false, rc = false;
+	uint32_t base_clk;
+	struct cam_ope_clk_bw_request *clk_info;
+	uint64_t req_id;
+	struct cam_ope_clk_info *hw_mgr_clk_info;
+
+	/* TODO: Have default clock rates update */
+	/* TODO: Add support for debug clock updates */
+	cam_ope_req_timer_reset(ctx_data);
+	cam_ope_device_timer_reset(hw_mgr);
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+	req_id = ctx_data->req_list[idx]->request_id;
+	if (ctx_data->req_cnt > 1)
+		busy = true;
+
+	CAM_DBG(CAM_OPE, "busy = %d req_id = %lld", busy, req_id);
+
+	clk_info = &ctx_data->req_list[idx]->clk_info;
+
+	/* Calculate base clk rate */
+	base_clk = cam_ope_mgr_calc_base_clk(
+		clk_info->frame_cycles, clk_info->budget_ns);
+	ctx_data->clk_info.rt_flag = clk_info->rt_flag;
+
+	if (busy)
+		rc = cam_ope_update_clk_busy(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+	else
+		rc = cam_ope_update_clk_free(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+
+	CAM_DBG(CAM_OPE, "bc = %d cc = %d busy = %d overclk = %d uc = %d",
+		hw_mgr_clk_info->base_clk, hw_mgr_clk_info->curr_clk,
+		busy, hw_mgr_clk_info->over_clked, rc);
+
+	return rc;
+}
+
+static int cam_ope_mgr_update_clk_rate(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data)
+{
+	struct cam_ope_dev_clk_update clk_upd_cmd;
+	int i;
+
+	clk_upd_cmd.clk_rate = hw_mgr->clk_info.curr_clk;
+
+	CAM_DBG(CAM_PERF, "clk_rate %u for dev_type %d", clk_upd_cmd.clk_rate,
+		ctx_data->ope_acquire.dev_type);
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv,
+			OPE_HW_CLK_UPDATE,
+			&clk_upd_cmd, sizeof(clk_upd_cmd));
+	}
+
+	return 0;
+}
+
+static int cam_ope_mgr_calculate_num_path(
+	struct cam_ope_clk_bw_req_internal_v2 *clk_info,
+	struct cam_ope_ctx *ctx_data)
+{
+	int i, path_index = 0;
+
+	for (i = 0; i < CAM_OPE_MAX_PER_PATH_VOTES; i++) {
+		if ((clk_info->axi_path[i].path_data_type <
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET) ||
+			(clk_info->axi_path[i].path_data_type >
+			CAM_AXI_PATH_DATA_OPE_MAX_OFFSET) ||
+			((clk_info->axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET) >=
+			CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_DBG(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		path_index = clk_info->axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		CAM_DBG(CAM_OPE,
+			"clk_info: i[%d]: [%s %s] bw [%lld %lld] num_path: %d",
+			i,
+			cam_cpas_axi_util_trans_type_to_string(
+			clk_info->axi_path[i].transac_type),
+			cam_cpas_axi_util_path_type_to_string(
+			clk_info->axi_path[i].path_data_type),
+			clk_info->axi_path[i].camnoc_bw,
+			clk_info->axi_path[i].mnoc_ab_bw,
+			clk_info->num_paths);
+	}
+
+	return (path_index+1);
+}
+
+static bool cam_ope_update_bw_v2(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info,
+	struct cam_ope_clk_bw_req_internal_v2 *clk_info,
+	bool busy)
+{
+	int i, path_index;
+	bool update_required = true;
+
+	/*
+	 * If current request bandwidth is different from previous frames, then
+	 * recalculate bandwidth of all contexts of same hardware and update
+	 * voting of bandwidth
+	 */
+
+	for (i = 0; i < clk_info->num_paths; i++)
+		CAM_DBG(CAM_OPE, "clk_info camnoc = %lld busy = %d",
+			clk_info->axi_path[i].camnoc_bw, busy);
+
+	if (clk_info->num_paths == ctx_data->clk_info.num_paths) {
+		update_required = false;
+		for (i = 0; i < clk_info->num_paths; i++) {
+			if ((clk_info->axi_path[i].transac_type ==
+			ctx_data->clk_info.axi_path[i].transac_type) &&
+				(clk_info->axi_path[i].path_data_type ==
+			ctx_data->clk_info.axi_path[i].path_data_type) &&
+				(clk_info->axi_path[i].camnoc_bw ==
+			ctx_data->clk_info.axi_path[i].camnoc_bw) &&
+				(clk_info->axi_path[i].mnoc_ab_bw ==
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw)) {
+				continue;
+			} else {
+				update_required = true;
+				break;
+			}
+		}
+	}
+
+	if (!update_required) {
+		CAM_DBG(CAM_OPE,
+		"Incoming BW hasn't changed, no update required");
+		return false;
+	}
+
+	if (busy) {
+		for (i = 0; i < clk_info->num_paths; i++) {
+			if (ctx_data->clk_info.axi_path[i].camnoc_bw >
+				clk_info->axi_path[i].camnoc_bw)
+				return false;
+		}
+	}
+
+	/*
+	 * Remove previous vote of this context from hw mgr first.
+	 * hw_mgr_clk_info has all valid paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index =
+		ctx_data->clk_info.axi_path[i].path_data_type -
+		CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) {
+			CAM_WARN(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+	hw_mgr_clk_info->axi_path[path_index].camnoc_bw -=
+		ctx_data->clk_info.axi_path[i].camnoc_bw;
+	hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw -=
+		ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+	hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw -=
+		ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+	hw_mgr_clk_info->axi_path[path_index].ddr_ab_bw -=
+		ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+	hw_mgr_clk_info->axi_path[path_index].ddr_ib_bw -=
+		ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+	}
+
+	ctx_data->clk_info.num_paths =
+		cam_ope_mgr_calculate_num_path(clk_info, ctx_data);
+
+	memcpy(&ctx_data->clk_info.axi_path[0],
+		&clk_info->axi_path[0],
+		clk_info->num_paths * sizeof(struct cam_cpas_axi_per_path_bw_vote));
+
+	/*
+	 * Add new vote of this context in hw mgr.
+	 * hw_mgr_clk_info has all paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index =
+		ctx_data->clk_info.axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) {
+			CAM_WARN(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		hw_mgr_clk_info->axi_path[path_index].path_data_type =
+			ctx_data->clk_info.axi_path[i].path_data_type;
+		hw_mgr_clk_info->axi_path[path_index].transac_type =
+			ctx_data->clk_info.axi_path[i].transac_type;
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw +=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ab_bw +=
+			ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ib_bw +=
+			ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+		CAM_DBG(CAM_OPE,
+			"Consolidate Path Vote : Dev[%s] i[%d] path_idx[%d] : [%s %s] [%lld %lld]",
+			ctx_data->ope_acquire.dev_name,
+			i, path_index,
+			cam_cpas_axi_util_trans_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].transac_type),
+			cam_cpas_axi_util_path_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].path_data_type),
+			hw_mgr_clk_info->axi_path[path_index].camnoc_bw,
+			hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw);
+	}
+
+	if (hw_mgr_clk_info->num_paths < ctx_data->clk_info.num_paths)
+		hw_mgr_clk_info->num_paths = ctx_data->clk_info.num_paths;
+
+	return true;
+}
+
+static bool cam_ope_check_bw_update(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, int idx)
+{
+	bool busy = false, bw_updated = false;
+	int i;
+	struct cam_ope_clk_bw_req_internal_v2 *clk_info_v2;
+	struct cam_ope_clk_info *hw_mgr_clk_info;
+	uint64_t req_id;
+
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+	req_id = ctx_data->req_list[idx]->request_id;
+	if (ctx_data->req_cnt > 1)
+		busy = true;
+
+	clk_info_v2 = &ctx_data->req_list[idx]->clk_info_v2;
+
+	bw_updated = cam_ope_update_bw_v2(hw_mgr, ctx_data,
+		hw_mgr_clk_info, clk_info_v2, busy);
+
+	for (i = 0; i < hw_mgr_clk_info->num_paths; i++) {
+		CAM_DBG(CAM_OPE,
+			"Final path_type: %s, transac_type: %s, camnoc_bw = %lld mnoc_ab_bw = %lld, mnoc_ib_bw = %lld, device: %s",
+			cam_cpas_axi_util_path_type_to_string(
+			hw_mgr_clk_info->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			hw_mgr_clk_info->axi_path[i].transac_type),
+			hw_mgr_clk_info->axi_path[i].camnoc_bw,
+			hw_mgr_clk_info->axi_path[i].mnoc_ab_bw,
+			hw_mgr_clk_info->axi_path[i].mnoc_ib_bw,
+			ctx_data->ope_acquire.dev_name);
+	}
+
+	return bw_updated;
+}
+
+static int cam_ope_update_cpas_vote(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data)
+{
+	int i = 0;
+	struct cam_ope_clk_info *clk_info;
+	struct cam_ope_dev_bw_update bw_update = {{0}, {0}, 0, 0};
+
+	clk_info = &hw_mgr->clk_info;
+
+	bw_update.ahb_vote.type = CAM_VOTE_DYNAMIC;
+	bw_update.ahb_vote.vote.freq = 0;
+	bw_update.ahb_vote_valid = false;
+
+
+	bw_update.axi_vote.num_paths = clk_info->num_paths;
+	memcpy(&bw_update.axi_vote.axi_path[0],
+		&clk_info->axi_path[0],
+		bw_update.axi_vote.num_paths *
+		sizeof(struct cam_cpas_axi_per_path_bw_vote));
+
+	bw_update.axi_vote_valid = true;
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv,
+			OPE_HW_BW_UPDATE,
+			&bw_update, sizeof(bw_update));
+	}
+
+	return 0;
+}
+
+static int cam_ope_mgr_ope_clk_update(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, int idx)
+{
+	int rc = 0;
+
+	if (cam_ope_check_clk_update(hw_mgr, ctx_data, idx))
+		rc = cam_ope_mgr_update_clk_rate(hw_mgr, ctx_data);
+
+	if (cam_ope_check_bw_update(hw_mgr, ctx_data, idx))
+		rc |= cam_ope_update_cpas_vote(hw_mgr, ctx_data);
+
+	return rc;
+}
+
+static void cam_ope_ctx_cdm_callback(uint32_t handle, void *userdata,
+	enum cam_cdm_cb_status status, void *cookie)
+{
+	int rc = 0;
+	struct cam_ope_ctx *ctx;
+	struct cam_ope_request *ope_req;
+	struct cam_hw_done_event_data buf_data;
+	struct timespec64 ts;
+	uint32_t evt_id = CAM_CTX_EVT_ID_SUCCESS;
+	uint64_t req_id = 0;
+	bool dump_flag = true;
+	int i;
+
+	if (!userdata) {
+		CAM_ERR(CAM_OPE, "Invalid ctx from CDM callback");
+		return;
+	}
+
+	if (status != CAM_CDM_CB_STATUS_PAGEFAULT)
+		req_id = *(uint64_t *)cookie;
+
+	if (req_id >= CAM_CTX_REQ_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid reqIdx = %u", req_id);
+		return;
+	}
+
+	ctx = userdata;
+	mutex_lock(&ctx->ctx_mutex);
+
+	if (!test_bit(req_id, ctx->bitmap)) {
+		CAM_ERR(CAM_OPE, "Req not present reqIdx = %u for ctx_id = %d",
+			req_id, ctx->ctx_id);
+		goto end;
+	}
+
+	ope_req = ctx->req_list[req_id];
+
+	ktime_get_boottime_ts64(&ts);
+	ope_hw_mgr->last_callback_time = (uint64_t)((ts.tv_sec * 1000000000) +
+		ts.tv_nsec);
+
+	CAM_DBG(CAM_REQ,
+		"hdl=%x, udata=%pK, status=%d, cookie=%u",
+		handle, userdata, status, req_id);
+	CAM_DBG(CAM_REQ, "req_id= %llu ctx_id= %d lcb=%llu",
+		ope_req->request_id, ctx->ctx_id,
+		ope_hw_mgr->last_callback_time);
+
+	if (ctx->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		CAM_ERR(CAM_OPE, "ctx %u is in %d state",
+			ctx->ctx_id, ctx->ctx_state);
+		mutex_unlock(&ctx->ctx_mutex);
+		return;
+	}
+
+	if (status == CAM_CDM_CB_STATUS_BL_SUCCESS) {
+		CAM_DBG(CAM_OPE,
+			"hdl=%x, udata=%pK, status=%d, cookie=%u  req_id=%llu ctx_id=%d",
+			handle, userdata, status, req_id,
+			ope_req->request_id, ctx->ctx_id);
+		cam_ope_req_timer_reset(ctx);
+		cam_ope_device_timer_reset(ope_hw_mgr);
+		buf_data.evt_param = CAM_SYNC_COMMON_EVENT_SUCCESS;
+	} else if (status == CAM_CDM_CB_STATUS_HW_RESUBMIT) {
+		CAM_INFO(CAM_OPE, "After reset of CDM and OPE, reapply req");
+		buf_data.evt_param = CAM_SYNC_OPE_EVENT_HW_RESUBMIT;
+		rc = cam_ope_mgr_reapply_config(ope_hw_mgr, ctx, ope_req);
+		if (!rc)
+			goto end;
+	} else {
+		CAM_INFO(CAM_OPE,
+			"CDM hdl=%x, udata=%pK, status=%d, cookie=%u req_id = %llu ctx_id=%d",
+			 handle, userdata, status, req_id,
+			 ope_req->request_id, ctx->ctx_id);
+		CAM_INFO(CAM_OPE, "Rst of CDM and OPE for error reqid = %lld",
+			ope_req->request_id);
+
+		if (status != CAM_CDM_CB_STATUS_HW_FLUSH) {
+			cam_ope_dump_req_data(ope_req);
+			dump_flag = false;
+
+			CAM_INFO(CAM_OPE, "bach_size: %d", ctx->req_list[req_id]->num_batch);
+			for (i = 0; i < ctx->req_list[req_id]->num_batch; i++)
+				CAM_INFO(CAM_OPE, "i: %d num_stripes: %d",
+					i, ctx->req_list[req_id]->num_stripes[i]);
+		}
+		rc = cam_ope_mgr_reset_hw();
+		evt_id = CAM_CTX_EVT_ID_ERROR;
+
+		if (status == CAM_CDM_CB_STATUS_PAGEFAULT)
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_PAGE_FAULT;
+		else if (status == CAM_CDM_CB_STATUS_HW_FLUSH)
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_HW_FLUSH;
+		else if (status == CAM_CDM_CB_STATUS_HW_RESET_DONE)
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_HW_RESET_DONE;
+		else if (status == CAM_CDM_CB_STATUS_HW_ERROR)
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_HW_ERROR;
+		else
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_UNKNOWN;
+	}
+
+	if (ope_hw_mgr->dump_req_data_enable && dump_flag)
+		cam_ope_dump_req_data(ope_req);
+
+	ctx->req_cnt--;
+
+	buf_data.request_id = ope_req->request_id;
+	ope_req->request_id = 0;
+	cam_free_clear((void *)ctx->req_list[req_id]->cdm_cmd);
+	ctx->req_list[req_id]->cdm_cmd = NULL;
+	cam_ope_free_io_config(ctx->req_list[req_id]);
+	cam_free_clear((void *)ctx->req_list[req_id]);
+	ctx->req_list[req_id] = NULL;
+	clear_bit(req_id, ctx->bitmap);
+	ctx->ctxt_event_cb(ctx->context_priv, evt_id, &buf_data);
+
+end:
+	mutex_unlock(&ctx->ctx_mutex);
+}
+
+int32_t cam_ope_hw_mgr_cb(uint32_t irq_status, void *data)
+{
+	int32_t rc = 0;
+	unsigned long flags;
+	struct cam_ope_hw_mgr *hw_mgr = data;
+	struct crm_workq_task *task;
+	struct ope_msg_work_data *task_data;
+
+	if (!data) {
+		CAM_ERR(CAM_OPE, "irq cb data is NULL");
+		return rc;
+	}
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->msg_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+		return -ENOMEM;
+	}
+
+	task_data = (struct ope_msg_work_data *)task->payload;
+	task_data->data = hw_mgr;
+	task_data->irq_status = irq_status;
+	task_data->type = OPE_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_ope_mgr_process_msg;
+	rc = cam_req_mgr_workq_enqueue_task(task, ope_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+
+	return rc;
+}
+
+static int cam_ope_mgr_create_kmd_buf(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_request *ope_req,
+	uintptr_t   ope_cmd_buf_addr)
+{
+	int i, rc = 0;
+	struct cam_ope_dev_prepare_req prepare_req;
+
+	prepare_req.ctx_data = ctx_data;
+	prepare_req.hw_mgr = hw_mgr;
+	prepare_req.packet = packet;
+	prepare_req.prepare_args = prepare_args;
+	prepare_req.req_idx = ope_req->req_idx;
+	prepare_req.kmd_buf_offset = 0;
+	prepare_req.frame_process =
+		(struct ope_frame_process *)ope_cmd_buf_addr;
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv,
+			OPE_HW_PREPARE, &prepare_req, sizeof(prepare_req));
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Dev prepare failed: %d", rc);
+			goto end;
+		}
+	}
+
+	ope_req->genirq_buff_info.handle         = ope_req->ope_kmd_buf.mem_handle;
+	ope_req->genirq_buff_info.cpu_addr       = (uint32_t *)ope_req->ope_kmd_buf.cpu_addr;
+	ope_req->genirq_buff_info.offset         = prepare_req.kmd_buf_offset;
+	ope_req->genirq_buff_info.used_bytes     = 0;
+	ope_req->genirq_buff_info.size           = ope_req->ope_kmd_buf.size -
+		ope_req->ope_kmd_buf.len - prepare_req.kmd_buf_offset;
+
+	if (!ope_req->genirq_buff_info.size) {
+		CAM_ERR(CAM_OPE, "Not enough memory available for CDM GenIRQ Command");
+		return -ENOMEM;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ope_mgr_process_io_cfg(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prep_arg,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx)
+{
+	int i, j = 0, k = 0, l, rc = 0;
+	struct ope_io_buf *io_buf;
+	int32_t sync_in_obj[CAM_MAX_IN_RES];
+	int32_t merged_sync_in_obj;
+	struct cam_ope_request *ope_request;
+
+	ope_request = ctx_data->req_list[req_idx];
+	prep_arg->num_out_map_entries = 0;
+	prep_arg->num_in_map_entries = 0;
+
+	ope_request = ctx_data->req_list[req_idx];
+	CAM_DBG(CAM_OPE, "E: req_idx = %u %x", req_idx, packet);
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (l = 0; l < ope_request->num_io_bufs[i]; l++) {
+			io_buf = ope_request->io_buf[i][l];
+			if (io_buf->direction == CAM_BUF_INPUT) {
+				if (io_buf->fence != -1) {
+					if (j < CAM_MAX_IN_RES) {
+						sync_in_obj[j++] =
+							io_buf->fence;
+						prep_arg->num_in_map_entries++;
+					} else {
+						CAM_ERR(CAM_OPE,
+						"reached max in_res %d %d",
+						io_buf->resource_type,
+						ope_request->request_id);
+					}
+				} else {
+					CAM_ERR(CAM_OPE, "Invalid fence %d %d",
+						io_buf->resource_type,
+						ope_request->request_id);
+				}
+			} else {
+				if (io_buf->fence != -1) {
+					prep_arg->out_map_entries[k].sync_id =
+						io_buf->fence;
+					k++;
+					prep_arg->num_out_map_entries++;
+				} else {
+					if (io_buf->resource_type
+						!= OPE_OUT_RES_STATS_LTM) {
+						CAM_ERR(CAM_OPE,
+						"Invalid fence %d %d",
+						io_buf->resource_type,
+						ope_request->request_id);
+					}
+				}
+			}
+			CAM_DBG(CAM_REQ,
+				"ctx_id: %u req_id: %llu dir[%d] %u, fence: %d",
+				ctx_data->ctx_id, packet->header.request_id, i,
+				io_buf->direction, io_buf->fence);
+			CAM_DBG(CAM_REQ, "rsc_type = %u fmt = %d",
+				io_buf->resource_type,
+				io_buf->format);
+		}
+	}
+
+	if (prep_arg->num_in_map_entries > 1 &&
+		prep_arg->num_in_map_entries <= CAM_MAX_IN_RES)
+		prep_arg->num_in_map_entries =
+			cam_common_util_remove_duplicate_arr(
+			sync_in_obj, prep_arg->num_in_map_entries);
+
+	if (prep_arg->num_in_map_entries > 1 &&
+		prep_arg->num_in_map_entries <= CAM_MAX_IN_RES) {
+		rc = cam_sync_merge(&sync_in_obj[0],
+			prep_arg->num_in_map_entries, &merged_sync_in_obj);
+		if (rc) {
+			prep_arg->num_out_map_entries = 0;
+			prep_arg->num_in_map_entries = 0;
+			return rc;
+		}
+
+		ope_request->in_resource = merged_sync_in_obj;
+
+		prep_arg->in_map_entries[0].sync_id = merged_sync_in_obj;
+		prep_arg->num_in_map_entries = 1;
+		CAM_DBG(CAM_REQ, "ctx_id: %u req_id: %llu Merged Sync obj: %d",
+			ctx_data->ctx_id, packet->header.request_id,
+			merged_sync_in_obj);
+	} else if (prep_arg->num_in_map_entries == 1) {
+		prep_arg->in_map_entries[0].sync_id = sync_in_obj[0];
+		prep_arg->num_in_map_entries = 1;
+		ope_request->in_resource = 0;
+		CAM_DBG(CAM_OPE, "fence = %d", sync_in_obj[0]);
+	} else {
+		CAM_DBG(CAM_OPE, "Invalid count of input fences, count: %d",
+			prep_arg->num_in_map_entries);
+		prep_arg->num_in_map_entries = 0;
+		ope_request->in_resource = 0;
+		rc = -EINVAL;
+	}
+	return rc;
+}
+
+static void cam_ope_mgr_print_stripe_info(uint32_t batch,
+	uint32_t io_buf, uint32_t plane, uint32_t stripe,
+	struct ope_stripe_io *stripe_info, uint64_t iova_addr)
+{
+	CAM_DBG(CAM_OPE, "b:%d io:%d p:%d s:%d: E",
+		batch, io_buf, plane, stripe);
+	CAM_DBG(CAM_OPE, "width: %d s_h: %u s_s: %u",
+		stripe_info->width, stripe_info->height,
+		stripe_info->stride);
+	CAM_DBG(CAM_OPE, "s_xinit = %u iova = %x s_loc = %u",
+		stripe_info->x_init, iova_addr, stripe_info->s_location);
+	CAM_DBG(CAM_OPE, "s_off = %u s_format = %u s_len = %u d_bus %d",
+		stripe_info->offset, stripe_info->format,
+		stripe_info->len, stripe_info->disable_bus);
+	CAM_DBG(CAM_OPE, "s_align = %u s_pack = %u s_unpack = %u",
+		stripe_info->alignment, stripe_info->pack_format,
+		stripe_info->unpack_format);
+	CAM_DBG(CAM_OPE, "b:%d io:%d p:%d s:%d: E",
+		batch, io_buf, plane, stripe);
+}
+
+static int cam_ope_mgr_process_cmd_io_buf_req(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet, struct cam_ope_ctx *ctx_data,
+	uintptr_t frame_process_addr, size_t length, struct cam_ope_request *ope_request
+	struct list_head *buf_tracker)
+{
+	int rc = 0;
+	int i, j, k, l;
+	dma_addr_t iova_addr;
+	size_t len;
+	struct ope_frame_process *in_frame_process;
+	struct ope_frame_set *in_frame_set;
+	struct ope_io_buf_info *in_io_buf;
+	struct ope_stripe_info *in_stripe_info;
+	struct ope_io_buf *io_buf;
+	struct ope_stripe_io *stripe_info;
+	uint32_t alignment;
+	uint32_t rsc_idx;
+	uint32_t pack_format;
+	uint32_t unpack_format;
+	struct ope_in_res_info *in_res;
+	struct ope_out_res_info *out_res;
+	bool is_secure;
+
+	in_frame_process = (struct ope_frame_process *)frame_process_addr;
+
+	ope_request->num_batch = in_frame_process->batch_size;
+
+	for (i = 0; i < in_frame_process->batch_size; i++) {
+		in_frame_set = &in_frame_process->frame_set[i];
+		for (j = 0; j < in_frame_set->num_io_bufs; j++) {
+			in_io_buf = &in_frame_set->io_buf[j];
+			for (k = 0; k < in_io_buf->num_planes; k++) {
+				if (!in_io_buf->num_stripes[k]) {
+					CAM_ERR(CAM_OPE, "Null num_stripes");
+					return -EINVAL;
+				}
+				for (l = 0; l < in_io_buf->num_stripes[k];
+					l++) {
+					in_stripe_info =
+						&in_io_buf->stripe_info[k][l];
+				}
+			}
+		}
+	}
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		in_frame_set = &in_frame_process->frame_set[i];
+		ope_request->num_io_bufs[i] = in_frame_set->num_io_bufs;
+		if (in_frame_set->num_io_bufs > OPE_MAX_IO_BUFS) {
+			CAM_ERR(CAM_OPE, "Wrong number of io buffers: %d",
+				in_frame_set->num_io_bufs);
+			return -EINVAL;
+		}
+
+		for (j = 0; j < in_frame_set->num_io_bufs; j++) {
+			in_io_buf = &in_frame_set->io_buf[j];
+			ope_request->io_buf[i][j] =
+				kzalloc(sizeof(struct ope_io_buf), GFP_KERNEL);
+			if (!ope_request->io_buf[i][j]) {
+				CAM_ERR(CAM_OPE,
+					"IO config allocation failure");
+				cam_ope_free_io_config(ope_request);
+				return -ENOMEM;
+			}
+			io_buf = ope_request->io_buf[i][j];
+			if (in_io_buf->num_planes > OPE_MAX_PLANES) {
+				CAM_ERR(CAM_OPE, "wrong number of planes: %u",
+					in_io_buf->num_planes);
+				return -EINVAL;
+			}
+
+			io_buf->num_planes = in_io_buf->num_planes;
+			io_buf->resource_type = in_io_buf->resource_type;
+			io_buf->direction = in_io_buf->direction;
+			io_buf->fence = in_io_buf->fence;
+			io_buf->format = in_io_buf->format;
+
+			rc = cam_ope_mgr_get_rsc_idx(ctx_data, in_io_buf);
+			if (rc < 0) {
+				CAM_ERR(CAM_OPE, "Invalid rsc idx = %d", rc);
+				return rc;
+			}
+			rsc_idx = rc;
+			if (in_io_buf->direction == CAM_BUF_INPUT) {
+				in_res =
+					&ctx_data->ope_acquire.in_res[rsc_idx];
+				alignment = in_res->alignment;
+				unpack_format = in_res->unpacker_format;
+				pack_format = 0;
+				if (in_io_buf->pix_pattern >
+					PIXEL_PATTERN_CRYCBY) {
+					CAM_ERR(CAM_OPE,
+						 "Invalid pix pattern = %u",
+						in_io_buf->pix_pattern);
+					return -EINVAL;
+				}
+				io_buf->pix_pattern = in_io_buf->pix_pattern;
+			} else if (in_io_buf->direction == CAM_BUF_OUTPUT) {
+				out_res =
+					&ctx_data->ope_acquire.out_res[rsc_idx];
+				alignment = out_res->alignment;
+				pack_format = out_res->packer_format;
+				unpack_format = 0;
+			}
+
+			for (k = 0; k < in_io_buf->num_planes; k++) {
+				io_buf->num_stripes[k] =
+					in_io_buf->num_stripes[k];
+				is_secure = cam_mem_is_secure_buf(
+					in_io_buf->mem_handle[k]);
+				if (is_secure)
+					rc = cam_mem_get_io_buf(
+						in_io_buf->mem_handle[k],
+						hw_mgr->iommu_sec_hdl,
+						&iova_addr, &len, NULL, buf_tracker);
+				else
+					rc = cam_mem_get_io_buf(
+						in_io_buf->mem_handle[k],
+						hw_mgr->iommu_hdl,
+						&iova_addr, &len, NULL, buf_tracker);
+
+				if (rc) {
+					CAM_ERR(CAM_OPE, "get buf failed: %d",
+						rc);
+					return -EINVAL;
+				}
+				if (len < in_io_buf->length[k]) {
+					CAM_ERR(CAM_OPE, "Invalid length");
+					return -EINVAL;
+				}
+
+				iova_addr += in_io_buf->plane_offset[k];
+				CAM_DBG(CAM_OPE,
+					"E rsc %d stripes %d dir %d plane %d",
+					in_io_buf->resource_type,
+					in_io_buf->direction,
+					in_io_buf->num_stripes[k], k);
+				for (l = 0; l < in_io_buf->num_stripes[k];
+					l++) {
+					in_stripe_info =
+						&in_io_buf->stripe_info[k][l];
+					stripe_info = &io_buf->s_io[k][l];
+					stripe_info->offset =
+						in_stripe_info->offset;
+					stripe_info->format = in_io_buf->format;
+					stripe_info->s_location =
+						in_stripe_info->stripe_location;
+					stripe_info->iova_addr =
+						iova_addr + stripe_info->offset;
+					stripe_info->width =
+						in_stripe_info->width;
+					stripe_info->height =
+						in_stripe_info->height;
+					stripe_info->stride =
+						in_io_buf->plane_stride[k];
+					stripe_info->x_init =
+						in_stripe_info->x_init;
+					stripe_info->len = len;
+					stripe_info->alignment = alignment;
+					stripe_info->pack_format = pack_format;
+					stripe_info->unpack_format =
+						unpack_format;
+					stripe_info->disable_bus =
+						in_stripe_info->disable_bus;
+					cam_ope_mgr_print_stripe_info(i, j,
+						k, l, stripe_info, iova_addr);
+				}
+				CAM_DBG(CAM_OPE,
+					"X rsc %d stripes %d dir %d plane %d",
+					in_io_buf->resource_type,
+					in_io_buf->direction,
+					in_io_buf->num_stripes[k], k);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet, struct cam_ope_ctx *ctx_data,
+	uintptr_t frame_process_addr, size_t length, struct cam_ope_request *ope_request
+	struct list_head *buf_tracker)
+{
+	int rc = 0;
+	int i, j;
+	dma_addr_t iova_addr;
+	dma_addr_t iova_cdm_addr;
+	uintptr_t cpu_addr;
+	size_t len;
+	struct ope_frame_process *frame_process;
+	struct ope_cmd_buf_info *cmd_buf;
+	bool is_kmd_buf_valid = false;
+
+	frame_process = (struct ope_frame_process *)frame_process_addr;
+
+	if (frame_process->batch_size > OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch: %d",
+			frame_process->batch_size);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < frame_process->batch_size; i++) {
+		if (frame_process->num_cmd_bufs[i] > OPE_MAX_CMD_BUFS) {
+			CAM_ERR(CAM_OPE, "Invalid cmd bufs for batch %d %d",
+				i, frame_process->num_cmd_bufs[i]);
+			return -EINVAL;
+		}
+	}
+
+	CAM_DBG(CAM_OPE, "cmd buf for req id = %lld b_size = %d",
+		packet->header.request_id, frame_process->batch_size);
+
+	for (i = 0; i < frame_process->batch_size; i++) {
+		CAM_DBG(CAM_OPE, "batch: %d count %d", i,
+			frame_process->num_cmd_bufs[i]);
+		for (j = 0; j < frame_process->num_cmd_bufs[i]; j++) {
+			CAM_DBG(CAM_OPE, "batch: %d cmd_buf_idx :%d mem_hdl:%x",
+				i, j, frame_process->cmd_buf[i][j].mem_handle);
+			CAM_DBG(CAM_OPE, "size = %u scope = %d buf_type = %d",
+				frame_process->cmd_buf[i][j].size,
+				frame_process->cmd_buf[i][j].cmd_buf_scope,
+				frame_process->cmd_buf[i][j].type);
+			CAM_DBG(CAM_OPE, "usage = %d buffered = %d s_idx = %d",
+			frame_process->cmd_buf[i][j].cmd_buf_usage,
+			frame_process->cmd_buf[i][j].cmd_buf_buffered,
+			frame_process->cmd_buf[i][j].stripe_idx);
+		}
+	}
+
+	ope_request->num_batch = frame_process->batch_size;
+
+	for (i = 0; i < frame_process->batch_size; i++) {
+		for (j = 0; j < frame_process->num_cmd_bufs[i]; j++) {
+			cmd_buf = &frame_process->cmd_buf[i][j];
+
+			switch (cmd_buf->cmd_buf_scope) {
+			case OPE_CMD_BUF_SCOPE_FRAME: {
+				rc = cam_mem_get_io_buf(cmd_buf->mem_handle,
+					hw_mgr->iommu_hdl, &iova_addr, &len, NULL,
+						buf_tracker);
+				if (rc) {
+					CAM_ERR(CAM_OPE, "get cmd buffailed %x",
+						hw_mgr->iommu_hdl);
+					goto end;
+				}
+
+				iova_addr = iova_addr + cmd_buf->offset;
+
+				rc = cam_mem_get_io_buf(cmd_buf->mem_handle,
+					hw_mgr->iommu_cdm_hdl, &iova_cdm_addr, &len, NULL,
+					buf_tracker);
+				if (rc) {
+					CAM_ERR(CAM_OPE, "get cmd buffailed %x",
+						hw_mgr->iommu_hdl);
+					goto end;
+				}
+
+				iova_cdm_addr = iova_cdm_addr + cmd_buf->offset;
+
+				rc = cam_mem_get_cpu_buf(cmd_buf->mem_handle,
+					&cpu_addr, &len);
+				if (rc || !cpu_addr) {
+					CAM_ERR(CAM_OPE, "get cmd buffailed %x",
+						hw_mgr->iommu_hdl);
+					goto end;
+				}
+				if ((len <= frame_process->cmd_buf[i][j].offset) ||
+					(frame_process->cmd_buf[i][j].size <
+					frame_process->cmd_buf[i][j].length) ||
+					((len - frame_process->cmd_buf[i][j].offset) <
+					 frame_process->cmd_buf[i][j].length)) {
+					CAM_ERR(CAM_OPE, "Invalid offset.");
+					return -EINVAL;
+				}
+				cpu_addr = cpu_addr +
+					frame_process->cmd_buf[i][j].offset;
+				CAM_DBG(CAM_OPE, "Hdl %x size %d len %d off %d",
+					cmd_buf->mem_handle, cmd_buf->size,
+					cmd_buf->length,
+					cmd_buf->offset);
+				if (cmd_buf->cmd_buf_usage == OPE_CMD_BUF_KMD) {
+					ope_request->ope_kmd_buf.mem_handle =
+						cmd_buf->mem_handle;
+					ope_request->ope_kmd_buf.cpu_addr =
+						cpu_addr;
+					ope_request->ope_kmd_buf.iova_addr =
+						iova_addr;
+					ope_request->ope_kmd_buf.iova_cdm_addr =
+						iova_cdm_addr;
+					ope_request->ope_kmd_buf.len = len;
+					ope_request->ope_kmd_buf.offset =
+						cmd_buf->offset;
+					ope_request->ope_kmd_buf.size =
+						cmd_buf->size;
+					is_kmd_buf_valid = true;
+					CAM_DBG(CAM_OPE, "kbuf:%x io:%x cdm:%x",
+					ope_request->ope_kmd_buf.cpu_addr,
+					ope_request->ope_kmd_buf.iova_addr,
+					ope_request->ope_kmd_buf.iova_cdm_addr);
+				} else if (cmd_buf->cmd_buf_usage ==
+					OPE_CMD_BUF_DEBUG) {
+					ope_request->ope_debug_buf.cpu_addr =
+						cpu_addr;
+					ope_request->ope_debug_buf.iova_addr =
+						iova_addr;
+					ope_request->ope_debug_buf.len =
+						cmd_buf->length;
+					ope_request->ope_debug_buf.size =
+						len;
+					ope_request->ope_debug_buf.offset =
+						cmd_buf->offset;
+					CAM_DBG(CAM_OPE, "dbg buf = %x",
+					ope_request->ope_debug_buf.cpu_addr);
+				}
+				cam_mem_put_cpu_buf(cmd_buf->mem_handle);
+				break;
+			}
+			case OPE_CMD_BUF_SCOPE_STRIPE: {
+				uint32_t num_cmd_bufs = 0;
+				uint32_t s_idx = 0;
+
+				s_idx = cmd_buf->stripe_idx;
+				if (s_idx < 0 || s_idx >= OPE_MAX_STRIPES) {
+					CAM_ERR(CAM_OPE, "Invalid index.");
+					return -EINVAL;
+				}
+				num_cmd_bufs =
+				ope_request->num_stripe_cmd_bufs[i][s_idx];
+
+				if (!num_cmd_bufs)
+					ope_request->num_stripes[i]++;
+
+				ope_request->num_stripe_cmd_bufs[i][s_idx]++;
+				break;
+			}
+
+			default:
+				break;
+			}
+		}
+	}
+
+
+	for (i = 0; i < frame_process->batch_size; i++) {
+		CAM_DBG(CAM_OPE, "num of stripes for batch %d is %d",
+			i, ope_request->num_stripes[i]);
+		for (j = 0; j < ope_request->num_stripes[i]; j++) {
+			CAM_DBG(CAM_OPE, "cmd buffers for stripe: %d:%d is %d",
+				i, j, ope_request->num_stripe_cmd_bufs[i][j]);
+		}
+	}
+
+	if (!is_kmd_buf_valid) {
+		CAM_DBG(CAM_OPE, "Invalid kmd buffer");
+		rc = -EINVAL;
+	}
+end:
+	return rc;
+}
+
+static int cam_ope_mgr_process_cmd_desc(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet, struct cam_ope_ctx *ctx_data,
+	uintptr_t *ope_cmd_buf_addr, struct cam_ope_request *ope_request
+	struct list_head *buf_tracker)
+{
+	int rc = 0;
+	int i;
+	int num_cmd_buf = 0;
+	size_t len;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	uintptr_t cpu_addr = 0;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+
+	*ope_cmd_buf_addr = 0;
+	for (i = 0; i < packet->num_cmd_buf; i++, num_cmd_buf++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
+			cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
+			continue;
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&cpu_addr, &len);
+		if (rc || !cpu_addr) {
+			CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+				hw_mgr->iommu_hdl);
+			goto end;
+		}
+		if ((len <= cmd_desc[i].offset) ||
+			(cmd_desc[i].size < cmd_desc[i].length) ||
+			((len - cmd_desc[i].offset) <
+			cmd_desc[i].length)) {
+			CAM_ERR(CAM_OPE, "Invalid offset or length");
+			goto end;
+		}
+		cpu_addr = cpu_addr + cmd_desc[i].offset;
+		*ope_cmd_buf_addr = cpu_addr;
+	}
+
+	if (!cpu_addr) {
+		CAM_ERR(CAM_OPE, "invalid number of cmd buf");
+		*ope_cmd_buf_addr = 0;
+		return -EINVAL;
+	}
+
+	ope_request->request_id = packet->header.request_id;
+
+	rc = cam_ope_mgr_process_cmd_buf_req(hw_mgr, packet, ctx_data,
+		cpu_addr, len, ope_request, buf_tracker);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "Process OPE cmd request is failed: %d", rc);
+		goto end;
+	}
+
+	rc = cam_ope_mgr_process_cmd_io_buf_req(hw_mgr, packet, ctx_data,
+		cpu_addr, len, ope_request, buf_tracker);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "Process OPE cmd io request is failed: %d",
+			rc);
+		goto end;
+	}
+
+	return rc;
+
+end:
+	*ope_cmd_buf_addr = 0;
+	return rc;
+}
+
+static bool cam_ope_mgr_is_valid_inconfig(struct cam_packet *packet)
+{
+	int i, num_in_map_entries = 0;
+	bool in_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+					packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT)
+			num_in_map_entries++;
+
+	if (num_in_map_entries <= OPE_IN_RES_MAX) {
+		in_config_valid = true;
+	} else {
+		CAM_ERR(CAM_OPE, "In config entries(%u) more than allowed(%u)",
+				num_in_map_entries, OPE_IN_RES_MAX);
+	}
+
+	CAM_DBG(CAM_OPE, "number of in_config info: %u %u %u %u",
+			packet->num_io_configs, OPE_MAX_IO_BUFS,
+			num_in_map_entries, OPE_IN_RES_MAX);
+
+	return in_config_valid;
+}
+
+static bool cam_ope_mgr_is_valid_outconfig(struct cam_packet *packet)
+{
+	int i, num_out_map_entries = 0;
+	bool out_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+					packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+		if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT)
+			num_out_map_entries++;
+
+	if (num_out_map_entries <= OPE_OUT_RES_MAX) {
+		out_config_valid = true;
+	} else {
+		CAM_ERR(CAM_OPE, "Out config entries(%u) more than allowed(%u)",
+				num_out_map_entries, OPE_OUT_RES_MAX);
+	}
+
+	CAM_DBG(CAM_OPE, "number of out_config info: %u %u %u %u",
+			packet->num_io_configs, OPE_MAX_IO_BUFS,
+			num_out_map_entries, OPE_OUT_RES_MAX);
+
+	return out_config_valid;
+}
+
+static int cam_ope_mgr_pkt_validation(struct cam_packet *packet)
+{
+	if ((packet->header.op_code & 0xff) !=
+		OPE_OPCODE_CONFIG) {
+		CAM_ERR(CAM_OPE, "Invalid Opcode in pkt: %d",
+			packet->header.op_code & 0xff);
+		return -EINVAL;
+	}
+
+	if (!packet->num_io_configs ||
+		packet->num_io_configs > OPE_MAX_IO_BUFS) {
+		CAM_ERR(CAM_OPE, "Invalid number of io configs: %d %d",
+			OPE_MAX_IO_BUFS, packet->num_io_configs);
+		return -EINVAL;
+	}
+
+	if (!packet->num_cmd_buf ||
+		packet->num_cmd_buf > OPE_PACKET_MAX_CMD_BUFS) {
+		CAM_ERR(CAM_OPE, "Invalid number of cmd buffers: %d %d",
+			OPE_PACKET_MAX_CMD_BUFS, packet->num_cmd_buf);
+		return -EINVAL;
+	}
+
+	if (!cam_ope_mgr_is_valid_inconfig(packet) ||
+		!cam_ope_mgr_is_valid_outconfig(packet)) {
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_OPE, "number of cmd/patch info: %u %u %u %u",
+			packet->num_cmd_buf,
+			packet->num_io_configs, OPE_MAX_IO_BUFS,
+			packet->num_patches);
+	return 0;
+}
+
+static int cam_ope_get_acquire_info(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_acquire_args *args,
+	struct cam_ope_ctx *ctx)
+{
+	int i = 0;
+
+	if (args->num_acq > 1) {
+		CAM_ERR(CAM_OPE, "Invalid number of resources: %d",
+			args->num_acq);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&ctx->ope_acquire,
+		(void __user *)args->acquire_info,
+		sizeof(struct ope_acquire_dev_info))) {
+		CAM_ERR(CAM_OPE, "Failed in acquire");
+		return -EFAULT;
+	}
+
+	if (ctx->ope_acquire.secure_mode > CAM_SECURE_MODE_SECURE) {
+		CAM_ERR(CAM_OPE, "Invalid mode:%d",
+			ctx->ope_acquire.secure_mode);
+		return -EINVAL;
+	}
+
+	if (ctx->ope_acquire.num_out_res > OPE_OUT_RES_MAX) {
+		CAM_ERR(CAM_OPE, "num of out resources exceeding : %u",
+			ctx->ope_acquire.num_out_res);
+		return -EINVAL;
+	}
+
+	if (ctx->ope_acquire.num_in_res > OPE_IN_RES_MAX) {
+		CAM_ERR(CAM_OPE, "num of in resources exceeding : %u",
+			ctx->ope_acquire.num_in_res);
+		return -EINVAL;
+	}
+
+	if (ctx->ope_acquire.dev_type >= OPE_DEV_TYPE_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid device type: %d",
+			ctx->ope_acquire.dev_type);
+		return -EFAULT;
+	}
+
+	if (ctx->ope_acquire.hw_type >= OPE_HW_TYPE_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid HW type: %d",
+			ctx->ope_acquire.hw_type);
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_OPE, "top: %u %u %s %u %u %u %u %u",
+		ctx->ope_acquire.hw_type, ctx->ope_acquire.dev_type,
+		ctx->ope_acquire.dev_name,
+		ctx->ope_acquire.nrt_stripes_for_arb,
+		ctx->ope_acquire.secure_mode, ctx->ope_acquire.batch_size,
+		ctx->ope_acquire.num_in_res, ctx->ope_acquire.num_out_res);
+
+	for (i = 0; i < ctx->ope_acquire.num_in_res; i++) {
+		CAM_DBG(CAM_OPE, "IN: %u %u %u %u %u %u %u %u",
+		ctx->ope_acquire.in_res[i].res_id,
+		ctx->ope_acquire.in_res[i].format,
+		ctx->ope_acquire.in_res[i].width,
+		ctx->ope_acquire.in_res[i].height,
+		ctx->ope_acquire.in_res[i].alignment,
+		ctx->ope_acquire.in_res[i].unpacker_format,
+		ctx->ope_acquire.in_res[i].max_stripe_size,
+		ctx->ope_acquire.in_res[i].fps);
+	}
+
+	for (i = 0; i < ctx->ope_acquire.num_out_res; i++) {
+		CAM_DBG(CAM_OPE, "OUT: %u %u %u %u %u %u %u %u",
+		ctx->ope_acquire.out_res[i].res_id,
+		ctx->ope_acquire.out_res[i].format,
+		ctx->ope_acquire.out_res[i].width,
+		ctx->ope_acquire.out_res[i].height,
+		ctx->ope_acquire.out_res[i].alignment,
+		ctx->ope_acquire.out_res[i].packer_format,
+		ctx->ope_acquire.out_res[i].subsample_period,
+		ctx->ope_acquire.out_res[i].subsample_pattern);
+	}
+
+	return 0;
+}
+
+static int cam_ope_get_free_ctx(struct cam_ope_hw_mgr *hw_mgr)
+{
+	int i;
+
+	i = find_first_zero_bit(hw_mgr->ctx_bitmap, hw_mgr->ctx_bits);
+	if (i >= OPE_CTX_MAX || i < 0) {
+		CAM_ERR(CAM_OPE, "Invalid ctx id = %d", i);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx[i].ctx_mutex);
+	if (hw_mgr->ctx[i].ctx_state != OPE_CTX_STATE_FREE) {
+		CAM_ERR(CAM_OPE, "Invalid ctx %d state %d",
+			i, hw_mgr->ctx[i].ctx_state);
+		mutex_unlock(&hw_mgr->ctx[i].ctx_mutex);
+		return -EINVAL;
+	}
+	set_bit(i, hw_mgr->ctx_bitmap);
+	mutex_unlock(&hw_mgr->ctx[i].ctx_mutex);
+
+	return i;
+}
+
+
+static int cam_ope_put_free_ctx(struct cam_ope_hw_mgr *hw_mgr, uint32_t ctx_id)
+{
+	if (ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid ctx_id: %d", ctx_id);
+		return 0;
+	}
+
+	hw_mgr->ctx[ctx_id].ctx_state = OPE_CTX_STATE_FREE;
+	clear_bit(ctx_id, hw_mgr->ctx_bitmap);
+
+	return 0;
+}
+
+static int cam_ope_mgr_get_hw_caps(void *hw_priv, void *hw_caps_args)
+{
+	struct cam_ope_hw_mgr *hw_mgr;
+	struct cam_query_cap_cmd *query_cap = hw_caps_args;
+	struct ope_hw_ver hw_ver;
+	int rc = 0, i;
+
+	if (!hw_priv || !hw_caps_args) {
+		CAM_ERR(CAM_OPE, "Invalid args: %x %x", hw_priv, hw_caps_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct ope_query_cap_cmd) != query_cap->size) {
+		CAM_ERR(CAM_OPE,
+			"Input query cap size:%u does not match expected query cap size: %u",
+			query_cap->size, sizeof(struct ope_query_cap_cmd));
+		return -EFAULT;
+	}
+
+	hw_mgr = hw_priv;
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (copy_from_user(&hw_mgr->ope_caps,
+		u64_to_user_ptr(query_cap->caps_handle),
+		sizeof(struct ope_query_cap_cmd))) {
+		CAM_ERR(CAM_OPE, "copy_from_user failed: size = %d",
+			sizeof(struct ope_query_cap_cmd));
+		rc = -EFAULT;
+		goto end;
+	}
+
+	for (i = 0; i < hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.get_hw_caps(
+			hw_mgr->ope_dev_intf[i]->hw_priv,
+			&hw_ver, sizeof(hw_ver));
+		if (rc)
+			goto end;
+
+		hw_mgr->ope_caps.hw_ver[i] = hw_ver;
+	}
+
+	hw_mgr->ope_caps.dev_iommu_handle.non_secure = hw_mgr->iommu_hdl;
+	hw_mgr->ope_caps.dev_iommu_handle.secure = hw_mgr->iommu_sec_hdl;
+	hw_mgr->ope_caps.cdm_iommu_handle.non_secure = hw_mgr->iommu_cdm_hdl;
+	hw_mgr->ope_caps.cdm_iommu_handle.secure = hw_mgr->iommu_sec_cdm_hdl;
+	hw_mgr->ope_caps.num_ope = hw_mgr->num_ope;
+
+	CAM_DBG(CAM_OPE, "iommu sec %d iommu ns %d cdm s %d cdm ns %d",
+		hw_mgr->ope_caps.dev_iommu_handle.secure,
+		hw_mgr->ope_caps.dev_iommu_handle.non_secure,
+		hw_mgr->ope_caps.cdm_iommu_handle.secure,
+		hw_mgr->ope_caps.cdm_iommu_handle.non_secure);
+
+	if (copy_to_user(u64_to_user_ptr(query_cap->caps_handle),
+		&hw_mgr->ope_caps, sizeof(struct ope_query_cap_cmd))) {
+		CAM_ERR(CAM_OPE, "copy_to_user failed: size = %d",
+			sizeof(struct ope_query_cap_cmd));
+		rc = -EFAULT;
+	}
+
+end:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_ope_mgr_acquire_hw(void *hw_priv, void *hw_acquire_args)
+{
+	int rc = 0, i;
+	int ctx_id;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_ope_ctx *ctx;
+	struct cam_hw_acquire_args *args = hw_acquire_args;
+	struct cam_ope_dev_acquire ope_dev_acquire;
+	struct cam_ope_dev_release ope_dev_release;
+	struct cam_cdm_acquire_data *cdm_acquire;
+	struct cam_ope_dev_init init;
+	struct cam_ope_dev_clk_update clk_update;
+	struct cam_ope_dev_bw_update *bw_update;
+	struct cam_ope_set_irq_cb irq_cb;
+	struct cam_hw_info *dev = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	int32_t idx;
+
+	if ((!hw_priv) || (!hw_acquire_args)) {
+		CAM_ERR(CAM_OPE, "Invalid args: %x %x",
+			hw_priv, hw_acquire_args);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	ctx_id = cam_ope_get_free_ctx(hw_mgr);
+	if (ctx_id < 0) {
+		CAM_ERR(CAM_OPE, "No free ctx");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return ctx_id;
+	}
+
+	ctx = &hw_mgr->ctx[ctx_id];
+	ctx->ctx_id = ctx_id;
+	mutex_lock(&ctx->ctx_mutex);
+	rc = cam_ope_get_acquire_info(hw_mgr, args, ctx);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "get_acquire info failed: %d", rc);
+		goto end;
+	}
+
+	cdm_acquire = kzalloc(sizeof(struct cam_cdm_acquire_data), GFP_KERNEL);
+	if (!cdm_acquire) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		goto end;
+	}
+	strscpy(cdm_acquire->identifier, "ope", sizeof("ope"));
+	if (ctx->ope_acquire.dev_type == OPE_DEV_TYPE_OPE_RT) {
+		cdm_acquire->priority = CAM_CDM_BL_FIFO_3;
+		ctx->req_timer_timeout = OPE_REQUEST_RT_TIMEOUT;
+	}
+	else if (ctx->ope_acquire.dev_type ==
+		OPE_DEV_TYPE_OPE_NRT) {
+		cdm_acquire->priority = CAM_CDM_BL_FIFO_0;
+		ctx->req_timer_timeout = OPE_REQUEST_NRT_TIMEOUT;
+	}
+	else
+		goto free_cdm_acquire;
+
+	cdm_acquire->cell_index = 0;
+	cdm_acquire->handle = 0;
+	cdm_acquire->userdata = ctx;
+	cdm_acquire->cam_cdm_callback = cam_ope_ctx_cdm_callback;
+	cdm_acquire->id = CAM_CDM_VIRTUAL;
+	cdm_acquire->base_array_cnt = 1;
+	cdm_acquire->base_array[0] = hw_mgr->cdm_reg_map[OPE_DEV_OPE][0];
+
+	rc = cam_cdm_acquire(cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "cdm_acquire is failed: %d", rc);
+		goto cdm_acquire_failed;
+	}
+
+	ctx->ope_cdm.cdm_ops = cdm_acquire->ops;
+	ctx->ope_cdm.cdm_handle = cdm_acquire->handle;
+
+	rc = cam_cdm_stream_on(cdm_acquire->handle);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "cdm stream on failure: %d", rc);
+		goto cdm_stream_on_failure;
+	}
+
+	if (!hw_mgr->ope_ctx_cnt) {
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			init.hfi_en = ope_hw_mgr->hfi_en;
+			rc = hw_mgr->ope_dev_intf[i]->hw_ops.init(
+				hw_mgr->ope_dev_intf[i]->hw_priv, &init,
+				sizeof(init));
+			if (rc) {
+				CAM_ERR(CAM_OPE, "OPE Dev init failed: %d", rc);
+				goto ope_dev_init_failure;
+			}
+		}
+
+		/* Install IRQ CB */
+		irq_cb.ope_hw_mgr_cb = cam_ope_hw_mgr_cb;
+		irq_cb.data = hw_mgr;
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			init.hfi_en = ope_hw_mgr->hfi_en;
+			rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				OPE_HW_SET_IRQ_CB,
+				&irq_cb, sizeof(irq_cb));
+			if (rc) {
+				CAM_ERR(CAM_OPE, "OPE Dev init failed: %d", rc);
+				goto ope_irq_set_failed;
+			}
+		}
+
+		dev = (struct cam_hw_info *)hw_mgr->ope_dev_intf[0]->hw_priv;
+		soc_info = &dev->soc_info;
+		idx = soc_info->src_clk_idx;
+
+		hw_mgr->clk_info.base_clk =
+			soc_info->clk_rate[CAM_TURBO_VOTE][idx];
+		hw_mgr->clk_info.threshold = 5;
+		hw_mgr->clk_info.over_clked = 0;
+
+		for (i = 0; i < CAM_OPE_MAX_PER_PATH_VOTES; i++) {
+			hw_mgr->clk_info.axi_path[i].camnoc_bw = 0;
+			hw_mgr->clk_info.axi_path[i].mnoc_ab_bw = 0;
+			hw_mgr->clk_info.axi_path[i].mnoc_ib_bw = 0;
+			hw_mgr->clk_info.axi_path[i].ddr_ab_bw = 0;
+			hw_mgr->clk_info.axi_path[i].ddr_ib_bw = 0;
+		}
+	}
+
+	ope_dev_acquire.ctx_id = ctx_id;
+	ope_dev_acquire.ope_acquire = &ctx->ope_acquire;
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_ACQUIRE,
+			&ope_dev_acquire, sizeof(ope_dev_acquire));
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Dev acquire failed: %d", rc);
+			goto ope_dev_acquire_failed;
+		}
+	}
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		dev = (struct cam_hw_info *)hw_mgr->ope_dev_intf[i]->hw_priv;
+		soc_info = &dev->soc_info;
+		idx = soc_info->src_clk_idx;
+		clk_update.clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][idx];
+		hw_mgr->clk_info.curr_clk =
+			soc_info->clk_rate[CAM_TURBO_VOTE][idx];
+
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_CLK_UPDATE,
+			&clk_update, sizeof(clk_update));
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Dev clk update failed: %d", rc);
+			goto ope_clk_update_failed;
+		}
+	}
+
+	bw_update = kzalloc(sizeof(struct cam_ope_dev_bw_update), GFP_KERNEL);
+	if (!bw_update) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		goto ope_clk_update_failed;
+	}
+	bw_update->ahb_vote_valid = false;
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		bw_update->axi_vote.num_paths = 1;
+		bw_update->axi_vote_valid = true;
+		bw_update->axi_vote.axi_path[0].camnoc_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].mnoc_ab_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].mnoc_ib_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].ddr_ab_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].ddr_ib_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].transac_type =
+			CAM_AXI_TRANSACTION_WRITE;
+		bw_update->axi_vote.axi_path[0].path_data_type =
+			CAM_AXI_PATH_DATA_ALL;
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_BW_UPDATE,
+			bw_update, sizeof(*bw_update));
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Dev clk update failed: %d", rc);
+			goto free_bw_update;
+		}
+	}
+
+	cam_ope_start_req_timer(ctx);
+	cam_ope_device_timer_start(hw_mgr);
+	hw_mgr->ope_ctx_cnt++;
+	ctx->context_priv = args->context_data;
+	args->ctxt_to_hw_map = ctx;
+	ctx->ctxt_event_cb = args->event_cb;
+	cam_ope_ctx_clk_info_init(ctx);
+	ctx->ctx_state = OPE_CTX_STATE_ACQUIRED;
+	kfree(cdm_acquire);
+	cdm_acquire = NULL;
+	kfree(bw_update);
+	bw_update = NULL;
+
+	mutex_unlock(&ctx->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_INFO(CAM_OPE, "OPE: %d acquire succesfull rc %d", ctx_id, rc);
+	return rc;
+
+free_bw_update:
+	cam_free_clear((void *)bw_update);
+	bw_update = NULL;
+ope_clk_update_failed:
+	ope_dev_release.ctx_id = ctx_id;
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		if (hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RELEASE,
+			&ope_dev_release, sizeof(ope_dev_release)))
+			CAM_ERR(CAM_OPE, "OPE Dev release failed");
+	}
+ope_dev_acquire_failed:
+	if (!hw_mgr->ope_ctx_cnt) {
+		irq_cb.ope_hw_mgr_cb = NULL;
+		irq_cb.data = hw_mgr;
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			init.hfi_en = ope_hw_mgr->hfi_en;
+			if (hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				OPE_HW_SET_IRQ_CB,
+				&irq_cb, sizeof(irq_cb)))
+				CAM_ERR(CAM_OPE,
+					"OPE IRQ de register failed");
+		}
+	}
+ope_irq_set_failed:
+	if (!hw_mgr->ope_ctx_cnt) {
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			if (hw_mgr->ope_dev_intf[i]->hw_ops.deinit(
+				hw_mgr->ope_dev_intf[i]->hw_priv, NULL, 0))
+				CAM_ERR(CAM_OPE, "OPE deinit fail");
+			if (hw_mgr->ope_dev_intf[i]->hw_ops.stop(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				NULL, 0))
+				CAM_ERR(CAM_OPE, "OPE stop fail");
+		}
+	}
+ope_dev_init_failure:
+cdm_stream_on_failure:
+	cam_cdm_release(cdm_acquire->handle);
+	ctx->ope_cdm.cdm_ops = NULL;
+	ctx->ope_cdm.cdm_handle = 0;
+
+cdm_acquire_failed:
+free_cdm_acquire:
+	cam_free_clear((void *)cdm_acquire);
+	cdm_acquire = NULL;
+end:
+	args->ctxt_to_hw_map = NULL;
+	cam_ope_put_free_ctx(hw_mgr, ctx_id);
+	mutex_unlock(&ctx->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_ope_mgr_remove_bw(struct cam_ope_hw_mgr *hw_mgr, int ctx_id)
+{
+	int i, path_index, rc = 0;
+	struct cam_ope_ctx *ctx_data = NULL;
+	struct cam_ope_clk_info *hw_mgr_clk_info;
+
+	ctx_data = &hw_mgr->ctx[ctx_id];
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index =
+		ctx_data->clk_info.axi_path[i].path_data_type -
+		CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) {
+			CAM_WARN(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw -=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ab_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ib_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+	}
+
+	rc = cam_ope_update_cpas_vote(hw_mgr, ctx_data);
+
+	return rc;
+}
+
+static int cam_ope_mgr_ope_clk_remove(struct cam_ope_hw_mgr *hw_mgr, int ctx_id)
+{
+	struct cam_ope_ctx *ctx_data = NULL;
+	struct cam_ope_clk_info *hw_mgr_clk_info;
+
+	ctx_data = &hw_mgr->ctx[ctx_id];
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+
+	if (hw_mgr_clk_info->base_clk >= ctx_data->clk_info.base_clk)
+		hw_mgr_clk_info->base_clk -= ctx_data->clk_info.base_clk;
+
+	/* reset clock info */
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+
+	return 0;
+}
+
+static int cam_ope_mgr_release_ctx(struct cam_ope_hw_mgr *hw_mgr, int ctx_id)
+{
+	int i = 0, rc = 0;
+	struct cam_ope_dev_release ope_dev_release;
+
+	if (ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "ctx_id is wrong: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+	if (hw_mgr->ctx[ctx_id].ctx_state !=
+		OPE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+		CAM_DBG(CAM_OPE, "ctx id: %d not in right state: %d",
+			ctx_id, hw_mgr->ctx[ctx_id].ctx_state);
+		return 0;
+	}
+
+	hw_mgr->ctx[ctx_id].ctx_state = OPE_CTX_STATE_RELEASE;
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		ope_dev_release.ctx_id = ctx_id;
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RELEASE,
+			&ope_dev_release, sizeof(ope_dev_release));
+		if (rc)
+			CAM_ERR(CAM_OPE, "OPE Dev release failed: %d", rc);
+	}
+
+	rc = cam_cdm_stream_off(hw_mgr->ctx[ctx_id].ope_cdm.cdm_handle);
+	if (rc)
+		CAM_ERR(CAM_OPE, "OPE CDM streamoff failed: %d", rc);
+
+	rc = cam_cdm_release(hw_mgr->ctx[ctx_id].ope_cdm.cdm_handle);
+	if (rc)
+		CAM_ERR(CAM_OPE, "OPE CDM relase failed: %d", rc);
+
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		if (!hw_mgr->ctx[ctx_id].req_list[i])
+			continue;
+
+		if (hw_mgr->ctx[ctx_id].req_list[i]->cdm_cmd) {
+			cam_free_clear((void *)hw_mgr->ctx[ctx_id].req_list[i]->cdm_cmd);
+			hw_mgr->ctx[ctx_id].req_list[i]->cdm_cmd = NULL;
+		}
+		cam_ope_free_io_config(hw_mgr->ctx[ctx_id].req_list[i]);
+		cam_free_clear((void *)hw_mgr->ctx[ctx_id].req_list[i]);
+		hw_mgr->ctx[ctx_id].req_list[i] = NULL;
+		clear_bit(i, hw_mgr->ctx[ctx_id].bitmap);
+	}
+
+	cam_ope_req_timer_stop(&hw_mgr->ctx[ctx_id]);
+	hw_mgr->ctx[ctx_id].ope_cdm.cdm_handle = 0;
+	hw_mgr->ctx[ctx_id].req_cnt = 0;
+	hw_mgr->ctx[ctx_id].last_flush_req = 0;
+	cam_ope_put_free_ctx(hw_mgr, ctx_id);
+
+	rc = cam_ope_mgr_ope_clk_remove(hw_mgr, ctx_id);
+	if (rc)
+		CAM_ERR(CAM_OPE, "OPE clk update failed: %d", rc);
+
+	hw_mgr->ope_ctx_cnt--;
+	mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+	CAM_DBG(CAM_OPE, "X: ctx_id = %d", ctx_id);
+
+	return 0;
+}
+
+static int cam_ope_mgr_release_hw(void *hw_priv, void *hw_release_args)
+{
+	int i, rc = 0;
+	int ctx_id = 0;
+	struct cam_hw_release_args *release_hw = hw_release_args;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_ope_ctx *ctx_data = NULL;
+	struct cam_ope_set_irq_cb irq_cb;
+	struct cam_hw_intf *dev_intf;
+
+	if (!release_hw || !hw_mgr) {
+		CAM_ERR(CAM_OPE, "Invalid args: %pK %pK", release_hw, hw_mgr);
+		return -EINVAL;
+	}
+
+	ctx_data = release_hw->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "NULL ctx data");
+		return -EINVAL;
+	}
+
+	ctx_id = ctx_data->ctx_id;
+	if (ctx_id < 0 || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid ctx id: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+	if (hw_mgr->ctx[ctx_id].ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_OPE, "ctx is not in use: %d", ctx_id);
+		mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	rc = cam_ope_mgr_release_ctx(hw_mgr, ctx_id);
+	if (!hw_mgr->ope_ctx_cnt) {
+		CAM_DBG(CAM_OPE, "Last Release");
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			dev_intf = hw_mgr->ope_dev_intf[i];
+			irq_cb.ope_hw_mgr_cb = NULL;
+			irq_cb.data = NULL;
+			rc = dev_intf->hw_ops.process_cmd(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				OPE_HW_SET_IRQ_CB,
+				&irq_cb, sizeof(irq_cb));
+			if (rc)
+				CAM_ERR(CAM_OPE, "IRQ dereg failed: %d", rc);
+		}
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			dev_intf = hw_mgr->ope_dev_intf[i];
+			rc = dev_intf->hw_ops.deinit(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				NULL, 0);
+			if (rc)
+				CAM_ERR(CAM_OPE, "deinit failed: %d", rc);
+		}
+		cam_ope_device_timer_stop(hw_mgr);
+	}
+
+	rc = cam_ope_mgr_remove_bw(hw_mgr, ctx_id);
+	if (rc)
+		CAM_ERR(CAM_OPE, "OPE remove bw failed: %d", rc);
+
+	if (!hw_mgr->ope_ctx_cnt) {
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			dev_intf = hw_mgr->ope_dev_intf[i];
+			rc = dev_intf->hw_ops.stop(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				NULL, 0);
+			if (rc)
+				CAM_ERR(CAM_OPE, "stop failed: %d", rc);
+		}
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_OPE, "Release done for ctx_id %d", ctx_id);
+	return rc;
+}
+
+
+static int cam_ope_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	struct cam_ope_clk_bw_request *clk_info;
+	struct ope_clk_bw_request_v2 *soc_req_v2;
+	struct cam_ope_clk_bw_req_internal_v2 *clk_info_v2;
+	struct ope_cmd_generic_blob *blob;
+	struct cam_ope_ctx *ctx_data;
+	uint32_t index;
+	size_t clk_update_size;
+	int rc = 0, i;
+
+	if (!blob_data || (blob_size == 0)) {
+		CAM_ERR(CAM_OPE, "Invalid blob info %pK %d", blob_data,
+		blob_size);
+		return -EINVAL;
+	}
+
+	blob = (struct ope_cmd_generic_blob *)user_data;
+	ctx_data = blob->ctx;
+	index = blob->req_idx;
+
+	switch (blob_type) {
+	case OPE_CMD_GENERIC_BLOB_CLK_V2:
+		if (blob_size < sizeof(struct ope_clk_bw_request_v2)) {
+			CAM_ERR(CAM_OPE, "Mismatch blob size %d expected %lu",
+				blob_size,
+				sizeof(struct ope_clk_bw_request_v2));
+			return -EINVAL;
+		}
+
+		soc_req_v2 = (struct ope_clk_bw_request_v2 *)blob_data;
+		if (soc_req_v2->num_paths > CAM_OPE_MAX_PER_PATH_VOTES) {
+			CAM_ERR(CAM_OPE, "Invalid num paths: %d",
+				soc_req_v2->num_paths);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (soc_req_v2->num_paths != 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote) >
+				((UINT_MAX -
+				sizeof(struct ope_clk_bw_request_v2)) /
+				(soc_req_v2->num_paths - 1))) {
+				CAM_ERR(CAM_OPE,
+					"Size exceeds limit paths:%u size per path:%lu",
+					soc_req_v2->num_paths - 1,
+					sizeof(
+					struct cam_axi_per_path_bw_vote));
+			return -EINVAL;
+			}
+		}
+
+		clk_update_size = sizeof(struct ope_clk_bw_request_v2) +
+			((soc_req_v2->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote));
+		if (blob_size < clk_update_size) {
+			CAM_ERR(CAM_OPE, "Invalid blob size: %u",
+				blob_size);
+			return -EINVAL;
+		}
+
+		clk_info = &ctx_data->req_list[index]->clk_info;
+		clk_info_v2 = &ctx_data->req_list[index]->clk_info_v2;
+		clk_info_v2->budget_ns = soc_req_v2->budget_ns;
+		clk_info_v2->frame_cycles = soc_req_v2->frame_cycles;
+		clk_info_v2->rt_flag = soc_req_v2->rt_flag;
+		clk_info_v2->num_paths = soc_req_v2->num_paths;
+
+		for (i = 0; i < soc_req_v2->num_paths; i++) {
+			clk_info_v2->axi_path[i].usage_data =
+				soc_req_v2->axi_path_flex[i].usage_data;
+			clk_info_v2->axi_path[i].transac_type =
+				soc_req_v2->axi_path_flex[i].transac_type;
+			clk_info_v2->axi_path[i].path_data_type =
+				soc_req_v2->axi_path_flex[i].path_data_type;
+			clk_info_v2->axi_path[i].vote_level = 0;
+			clk_info_v2->axi_path[i].camnoc_bw = soc_req_v2->axi_path_flex[i].camnoc_bw;
+			clk_info_v2->axi_path[i].mnoc_ab_bw =
+				soc_req_v2->axi_path_flex[i].mnoc_ab_bw;
+			clk_info_v2->axi_path[i].mnoc_ib_bw =
+				soc_req_v2->axi_path_flex[i].mnoc_ib_bw;
+		}
+
+		/* Use v1 structure for clk fields */
+		clk_info->budget_ns = clk_info_v2->budget_ns;
+		clk_info->frame_cycles = clk_info_v2->frame_cycles;
+		clk_info->rt_flag = clk_info_v2->rt_flag;
+
+		CAM_DBG(CAM_OPE, "budget=%llu, frame_cycle=%llu, rt_flag=%d",
+			clk_info_v2->budget_ns, clk_info_v2->frame_cycles,
+			clk_info_v2->rt_flag);
+		break;
+
+	default:
+		CAM_WARN(CAM_OPE, "Invalid blob type %d", blob_type);
+		break;
+	}
+	return rc;
+}
+
+static int cam_ope_process_generic_cmd_buffer(
+	struct cam_packet *packet,
+	struct cam_ope_ctx *ctx_data,
+	int32_t index,
+	uint64_t *io_buf_addr)
+{
+	int i, rc = 0;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct ope_cmd_generic_blob cmd_generic_blob;
+
+	cmd_generic_blob.ctx = ctx_data;
+	cmd_generic_blob.req_idx = index;
+	cmd_generic_blob.io_buf_addr = io_buf_addr;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data != OPE_CMD_META_GENERIC_BLOB)
+			continue;
+
+		rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+			cam_ope_packet_generic_blob_handler, &cmd_generic_blob);
+		if (rc)
+			CAM_ERR(CAM_OPE, "Failed in processing blobs %d", rc);
+	}
+
+	return rc;
+}
+
+static int cam_ope_mgr_prepare_hw_update(void *hw_priv,
+	void *hw_prepare_update_args)
+{
+	int rc = 0;
+	struct cam_packet *packet = NULL;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_prepare_update_args *prepare_args =
+		hw_prepare_update_args;
+	struct cam_ope_ctx *ctx_data = NULL;
+	uintptr_t   ope_cmd_buf_addr;
+	uint32_t request_idx = 0;
+	struct cam_ope_request *ope_req;
+	struct timespec64 ts;
+
+	if ((!prepare_args) || (!hw_mgr) || (!prepare_args->packet)) {
+		CAM_ERR(CAM_OPE, "Invalid args: %x %x",
+			prepare_args, hw_mgr);
+		return -EINVAL;
+	}
+
+	ctx_data = prepare_args->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "Invalid Context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE, "ctx id %u is not acquired state: %d",
+			ctx_data->ctx_id, ctx_data->ctx_state);
+		return -EINVAL;
+	}
+
+	packet = prepare_args->packet;
+	rc = cam_packet_util_validate_packet(packet, prepare_args->remain_len);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE,
+			"packet validation failed: %d req_id: %d ctx: %d",
+			rc, packet->header.request_id, ctx_data->ctx_id);
+		return rc;
+	}
+
+	rc = cam_ope_mgr_pkt_validation(packet);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE,
+			"ope packet validation failed: %d req_id: %d ctx: %d",
+			rc, packet->header.request_id, ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	rc = cam_packet_util_process_patches(packet, prepare_args->buf_tracker,
+		hw_mgr->iommu_cdm_hdl, hw_mgr->iommu_sec_cdm_hdl, false);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE, "Patching failed: %d req_id: %d ctx: %d",
+			rc, packet->header.request_id, ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	request_idx  = find_first_zero_bit(ctx_data->bitmap, ctx_data->bits);
+	if (request_idx >= CAM_CTX_REQ_MAX || request_idx < 0) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE, "Invalid ctx req slot = %d", request_idx);
+		return -EINVAL;
+	}
+
+	ctx_data->req_list[request_idx] =
+		kzalloc(sizeof(struct cam_ope_request), GFP_KERNEL);
+	if (!ctx_data->req_list[request_idx]) {
+		CAM_ERR(CAM_OPE, "mem allocation failed ctx:%d req_idx:%d",
+			ctx_data->ctx_id, request_idx);
+		rc = -ENOMEM;
+		goto req_mem_alloc_failed;
+	}
+
+	ope_req = ctx_data->req_list[request_idx];
+	ope_req->req_idx = request_idx;
+	ope_req->cdm_cmd =
+		kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+			((OPE_MAX_CDM_BLS - 1) *
+			sizeof(struct cam_cdm_bl_cmd))),
+			GFP_KERNEL);
+	if (!ope_req->cdm_cmd) {
+		CAM_ERR(CAM_OPE, "Cdm mem alloc failed ctx:%d req_idx:%d",
+			ctx_data->ctx_id, request_idx);
+		rc = -ENOMEM;
+		goto req_cdm_mem_alloc_failed;
+	}
+
+	rc = cam_ope_mgr_process_cmd_desc(hw_mgr, packet,
+		ctx_data, &ope_cmd_buf_addr, ope_req, prepare_args->buf_tracker);
+	if (rc) {
+		CAM_ERR(CAM_OPE,
+			"cmd desc processing failed :%d ctx: %d req_id:%d",
+			rc, ctx_data->ctx_id, packet->header.request_id);
+		goto end;
+	}
+
+	rc = cam_ope_mgr_process_io_cfg(hw_mgr, packet, prepare_args,
+		ctx_data, request_idx);
+	if (rc) {
+		CAM_ERR(CAM_OPE,
+			"IO cfg processing failed: %d ctx: %d req_id:%d",
+			rc, ctx_data->ctx_id, packet->header.request_id);
+		goto end;
+	}
+
+	rc = cam_ope_mgr_create_kmd_buf(hw_mgr, packet, prepare_args,
+		ctx_data, ope_req, ope_cmd_buf_addr);
+	if (rc) {
+		CAM_ERR(CAM_OPE,
+			"create kmd buf failed: %d ctx: %d request_id:%d",
+			rc, ctx_data->ctx_id, packet->header.request_id);
+		goto end;
+	}
+
+	rc = cam_ope_process_generic_cmd_buffer(packet, ctx_data,
+		request_idx, NULL);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "Failed: %d ctx: %d req_id: %d req_idx: %d",
+			rc, ctx_data->ctx_id, packet->header.request_id,
+			request_idx);
+		goto end;
+	}
+
+	ope_req->cdm_cmd->genirq_buff             = &ope_req->genirq_buff_info;
+	ope_req->hang_data.packet                 = packet;
+	prepare_args->num_hw_update_entries       = 1;
+	prepare_args->hw_update_entries[0].addr   = (uintptr_t)ope_req->cdm_cmd;
+	prepare_args->priv                        = ope_req;
+
+	CAM_INFO(CAM_REQ, "OPE req %x num_batch %d", ope_req, ope_req->num_batch);
+
+	ktime_get_boottime_ts64(&ts);
+	ctx_data->last_req_time = (uint64_t)((ts.tv_sec * 1000000000) + ts.tv_nsec);
+	CAM_DBG(CAM_REQ, "req_id= %llu ctx_id= %d lrt=%llu",
+		packet->header.request_id, ctx_data->ctx_id,
+		ctx_data->last_req_time);
+	cam_ope_req_timer_modify(ctx_data, ctx_data->req_timer_timeout);
+	set_bit(request_idx, ctx_data->bitmap);
+	cam_ope_mgr_put_cmd_buf(packet);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	CAM_DBG(CAM_REQ, "Prepare Hw update Successful request_id: %d  ctx: %d",
+		packet->header.request_id, ctx_data->ctx_id);
+	return rc;
+
+end:
+	cam_ope_mgr_put_cmd_buf(packet);
+	cam_free_clear((void *)ctx_data->req_list[request_idx]->cdm_cmd);
+	ctx_data->req_list[request_idx]->cdm_cmd = NULL;
+req_cdm_mem_alloc_failed:
+	cam_free_clear((void *)ctx_data->req_list[request_idx]);
+	ctx_data->req_list[request_idx] = NULL;
+req_mem_alloc_failed:
+	clear_bit(request_idx, ctx_data->bitmap);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return rc;
+}
+
+static int cam_ope_mgr_handle_config_err(
+	struct cam_hw_config_args *config_args,
+	struct cam_ope_ctx *ctx_data)
+{
+	struct cam_hw_done_event_data buf_data;
+	struct cam_ope_request *ope_req;
+	uint32_t req_idx;
+
+	ope_req = config_args->priv;
+
+	buf_data.request_id = ope_req->request_id;
+	buf_data.evt_param = CAM_SYNC_OPE_EVENT_CONFIG_ERR;
+	ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_CTX_EVT_ID_ERROR,
+		&buf_data);
+
+	req_idx = ope_req->req_idx;
+	ope_req->request_id = 0;
+	cam_free_clear((void *)ctx_data->req_list[req_idx]->cdm_cmd);
+	ctx_data->req_list[req_idx]->cdm_cmd = NULL;
+	cam_ope_free_io_config(ctx_data->req_list[req_idx]);
+	cam_free_clear((void *)ctx_data->req_list[req_idx]);
+	ctx_data->req_list[req_idx] = NULL;
+	clear_bit(req_idx, ctx_data->bitmap);
+
+	return 0;
+}
+
+static int cam_ope_mgr_enqueue_config(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_hw_config_args *config_args)
+{
+	int rc = 0;
+	uint64_t request_id = 0;
+	struct crm_workq_task *task;
+	struct ope_cmd_work_data *task_data;
+	struct cam_hw_update_entry *hw_update_entries;
+	struct cam_ope_request *ope_req = NULL;
+
+	ope_req = config_args->priv;
+	request_id = config_args->request_id;
+	hw_update_entries = config_args->hw_update_entries;
+
+	CAM_DBG(CAM_OPE, "req_id = %lld %pK", request_id, config_args->priv);
+
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		return -ENOMEM;
+	}
+
+	task_data = (struct ope_cmd_work_data *)task->payload;
+	task_data->data = (void *)hw_update_entries->addr;
+	task_data->req_id = request_id;
+	task_data->type = OPE_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_ope_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, ctx_data,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_ope_mgr_config_hw(void *hw_priv, void *hw_config_args)
+{
+	int rc = 0;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_config_args *config_args = hw_config_args;
+	struct cam_ope_ctx *ctx_data = NULL;
+	struct cam_ope_request *ope_req = NULL;
+	struct cam_cdm_bl_request *cdm_cmd;
+
+	CAM_DBG(CAM_OPE, "E");
+	if (!hw_mgr || !config_args) {
+		CAM_ERR(CAM_OPE, "Invalid arguments %pK %pK",
+			hw_mgr, config_args);
+		return -EINVAL;
+	}
+
+	if (!config_args->num_hw_update_entries) {
+		CAM_ERR(CAM_OPE, "No hw update enteries are available");
+		return -EINVAL;
+	}
+
+	ctx_data = config_args->ctxt_to_hw_map;
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_OPE, "ctx id :%u is not in use",
+			ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	ope_req = config_args->priv;
+	cdm_cmd = (struct cam_cdm_bl_request *) config_args->hw_update_entries->addr;
+	cdm_cmd->cookie = ope_req->req_idx;
+
+	cam_ope_mgr_ope_clk_update(hw_mgr, ctx_data, ope_req->req_idx);
+	ctx_data->req_list[ope_req->req_idx]->submit_timestamp = ktime_get();
+
+	if (ope_req->request_id <= ctx_data->last_flush_req)
+		CAM_WARN(CAM_OPE,
+			"Anomaly submitting flushed req %llu [last_flush %llu] in ctx %u",
+			ope_req->request_id, ctx_data->last_flush_req,
+			ctx_data->ctx_id);
+
+	rc = cam_ope_mgr_enqueue_config(hw_mgr, ctx_data, config_args);
+	if (rc)
+		goto config_err;
+
+	CAM_DBG(CAM_REQ, "req_id %llu, ctx_id %u io config",
+		ope_req->request_id, ctx_data->ctx_id);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+config_err:
+	cam_ope_mgr_handle_config_err(config_args, ctx_data);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_ope_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_ope_hw_mgr  *hw_mgr = hw_mgr_priv;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_OPE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_ope_mgr_dump_pf_data(hw_mgr, hw_cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Invalid cmd: %d",
+			hw_cmd_args->cmd_type);
+	}
+
+	return rc;
+}
+
+static int cam_ope_mgr_hw_open_u(void *hw_priv, void *fw_download_args)
+{
+	struct cam_ope_hw_mgr *hw_mgr;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_OPE, "Invalid args: %pK", hw_priv);
+		return -EINVAL;
+	}
+
+	hw_mgr = hw_priv;
+	if (!hw_mgr->open_cnt) {
+		hw_mgr->open_cnt++;
+	} else {
+		rc = -EBUSY;
+		CAM_ERR(CAM_OPE, "Multiple opens are not supported");
+	}
+
+	return rc;
+}
+
+static cam_ope_mgr_hw_close_u(void *hw_priv, void *hw_close_args)
+{
+	struct cam_ope_hw_mgr *hw_mgr;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_OPE, "Invalid args: %pK", hw_priv);
+		return -EINVAL;
+	}
+
+	hw_mgr = hw_priv;
+	if (!hw_mgr->open_cnt) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_OPE, "device is already closed");
+	} else {
+		hw_mgr->open_cnt--;
+	}
+
+	return rc;
+}
+
+static int cam_ope_mgr_flush_req(struct cam_ope_ctx *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	int idx;
+	int64_t request_id;
+
+	request_id = *(int64_t *)flush_args->flush_req_pending[0];
+	for (idx = 0; idx < CAM_CTX_REQ_MAX; idx++) {
+		if (!ctx_data->req_list[idx])
+			continue;
+
+		if (ctx_data->req_list[idx]->request_id != request_id)
+			continue;
+
+		ctx_data->req_list[idx]->request_id = 0;
+		cam_free_clear((void *)ctx_data->req_list[idx]->cdm_cmd);
+		ctx_data->req_list[idx]->cdm_cmd = NULL;
+		cam_ope_free_io_config(ctx_data->req_list[idx]);
+		cam_free_clear((void *)ctx_data->req_list[idx]);
+		ctx_data->req_list[idx] = NULL;
+		clear_bit(idx, ctx_data->bitmap);
+	}
+
+	return 0;
+}
+
+static int cam_ope_mgr_flush_all(struct cam_ope_ctx *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	int i, rc;
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+
+	rc = cam_cdm_flush_hw(ctx_data->ope_cdm.cdm_handle);
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	for (i = 0; i < hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RESET,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_OPE, "OPE Dev reset failed: %d", rc);
+	}
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		if (!ctx_data->req_list[i])
+			continue;
+
+		ctx_data->req_list[i]->request_id = 0;
+		cam_free_clear((void *)ctx_data->req_list[i]->cdm_cmd);
+		ctx_data->req_list[i]->cdm_cmd = NULL;
+		cam_ope_free_io_config(ctx_data->req_list[i]);
+		cam_free_clear((void *)ctx_data->req_list[i]);
+		ctx_data->req_list[i] = NULL;
+		clear_bit(i, ctx_data->bitmap);
+	}
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return rc;
+}
+
+static int cam_ope_mgr_hw_dump(void *hw_priv, void *hw_dump_args)
+{
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_dump_args  *dump_args;
+	int idx;
+	ktime_t cur_time;
+	struct timespec64 cur_ts, req_ts;
+	uint64_t diff;
+
+	if ((!hw_priv) || (!hw_dump_args)) {
+		CAM_ERR(CAM_OPE, "Invalid params %pK %pK",
+			hw_priv, hw_dump_args);
+		return -EINVAL;
+	}
+
+	dump_args = (struct cam_hw_dump_args *)hw_dump_args;
+	ctx_data = dump_args->ctxt_to_hw_map;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "Invalid context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	mutex_lock(&ctx_data->ctx_mutex);
+
+	CAM_INFO(CAM_OPE, "Req %lld", dump_args->request_id);
+	for (idx = 0; idx < CAM_CTX_REQ_MAX; idx++) {
+		if (!ctx_data->req_list[idx])
+			continue;
+
+		if (ctx_data->req_list[idx]->request_id ==
+			dump_args->request_id)
+			break;
+	}
+
+	/* no matching request found */
+	if (idx == CAM_CTX_REQ_MAX) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return 0;
+	}
+
+	cur_time = ktime_get();
+	diff = ktime_us_delta(cur_time,
+			ctx_data->req_list[idx]->submit_timestamp);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(ctx_data->req_list[idx]->submit_timestamp);
+
+	if (diff < (ctx_data->req_timer_timeout * 1000)) {
+		CAM_INFO(CAM_OPE,
+			"No Error req %llu req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return 0;
+	}
+
+	CAM_ERR(CAM_OPE, "Error req %llu req timestamp:[%lld.%06lld] curr timestamp:[%lld.%06lld]",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return 0;
+}
+
+static int cam_ope_mgr_hw_flush(void *hw_priv, void *hw_flush_args)
+{
+	struct cam_hw_flush_args *flush_args = hw_flush_args;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+
+	if ((!hw_priv) || (!hw_flush_args)) {
+		CAM_ERR(CAM_OPE, "Input params are Null");
+		return -EINVAL;
+	}
+
+	ctx_data = flush_args->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "Ctx data is NULL");
+		return -EINVAL;
+	}
+
+	if ((flush_args->flush_type >= CAM_FLUSH_TYPE_MAX) ||
+		(flush_args->flush_type < CAM_FLUSH_TYPE_REQ)) {
+		CAM_ERR(CAM_OPE, "Invalid flush type: %d",
+			flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_ALL:
+		mutex_lock(&hw_mgr->hw_mgr_mutex);
+		ctx_data->last_flush_req = flush_args->last_flush_req;
+
+		CAM_DBG(CAM_REQ, "ctx_id %d Flush type %d last_flush_req %u",
+				ctx_data->ctx_id, flush_args->flush_type,
+				ctx_data->last_flush_req);
+
+		cam_ope_mgr_flush_all(ctx_data, flush_args);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		break;
+	case CAM_FLUSH_TYPE_REQ:
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (flush_args->num_req_active) {
+			CAM_ERR(CAM_OPE, "Flush request is not supported");
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return -EINVAL;
+		}
+		if (flush_args->num_req_pending)
+			cam_ope_mgr_flush_req(ctx_data, flush_args);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Invalid flush type: %d",
+				flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_ope_mgr_alloc_devs(struct device_node *of_node)
+{
+	int rc;
+	uint32_t num_dev;
+
+	rc = of_property_read_u32(of_node, "num-ope", &num_dev);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "getting num of ope failed: %d", rc);
+		return -EINVAL;
+	}
+
+	ope_hw_mgr->devices[OPE_DEV_OPE] = kzalloc(
+		sizeof(struct cam_hw_intf *) * num_dev, GFP_KERNEL);
+	if (!ope_hw_mgr->devices[OPE_DEV_OPE])
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int cam_ope_mgr_init_devs(struct device_node *of_node)
+{
+	int rc = 0;
+	int count, i;
+	const char *name = NULL;
+	struct device_node *child_node = NULL;
+	struct platform_device *child_pdev = NULL;
+	struct cam_hw_intf *child_dev_intf = NULL;
+	struct cam_hw_info *ope_dev;
+	struct cam_hw_soc_info *soc_info = NULL;
+
+	rc = cam_ope_mgr_alloc_devs(of_node);
+	if (rc)
+		return rc;
+
+	count = of_property_count_strings(of_node, "compat-hw-name");
+	if (!count) {
+		CAM_ERR(CAM_OPE, "no compat hw found in dev tree, cnt = %d",
+			count);
+		rc = -EINVAL;
+		goto compat_hw_name_failed;
+	}
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node, "compat-hw-name",
+			i, &name);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "getting dev object name failed");
+			goto compat_hw_name_failed;
+		}
+
+		child_node = of_find_node_by_name(NULL, name);
+		if (!child_node) {
+			CAM_ERR(CAM_OPE, "Cannot find node in dtsi %s", name);
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+
+		child_pdev = of_find_device_by_node(child_node);
+		if (!child_pdev) {
+			CAM_ERR(CAM_OPE, "failed to find device on bus %s",
+				child_node->name);
+			rc = -ENODEV;
+			of_node_put(child_node);
+			goto compat_hw_name_failed;
+		}
+
+		child_dev_intf = (struct cam_hw_intf *)platform_get_drvdata(
+			child_pdev);
+		if (!child_dev_intf) {
+			CAM_ERR(CAM_OPE, "no child device");
+			of_node_put(child_node);
+			goto compat_hw_name_failed;
+		}
+		ope_hw_mgr->devices[child_dev_intf->hw_type]
+			[child_dev_intf->hw_idx] = child_dev_intf;
+
+		if (!child_dev_intf->hw_ops.process_cmd)
+			goto compat_hw_name_failed;
+
+		of_node_put(child_node);
+	}
+
+	ope_hw_mgr->num_ope = count;
+
+	for (i = 0; i < count; i++) {
+		ope_hw_mgr->ope_dev_intf[i] =
+			ope_hw_mgr->devices[OPE_DEV_OPE][i];
+		ope_dev = ope_hw_mgr->ope_dev_intf[i]->hw_priv;
+		soc_info = &ope_dev->soc_info;
+		ope_hw_mgr->cdm_reg_map[i][0] =
+			soc_info->reg_map[0].mem_base;
+	}
+
+	ope_hw_mgr->hfi_en = of_property_read_bool(of_node, "hfi_en");
+
+	return 0;
+compat_hw_name_failed:
+	kfree(ope_hw_mgr->devices[OPE_DEV_OPE]);
+	ope_hw_mgr->devices[OPE_DEV_OPE] = NULL;
+	return rc;
+}
+
+static void cam_req_mgr_process_ope_command_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_ope_msg_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_ope_timer_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int cam_ope_mgr_create_wq(void)
+{
+
+	int rc;
+	int i;
+
+	rc = cam_req_mgr_workq_create("ope_command_queue", OPE_WORKQ_NUM_TASK,
+		&ope_hw_mgr->cmd_work, CRM_WORKQ_USAGE_NON_IRQ,
+		0, cam_req_mgr_process_ope_command_queue);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "unable to create a command worker");
+		goto cmd_work_failed;
+	}
+
+	rc = cam_req_mgr_workq_create("ope_message_queue", OPE_WORKQ_NUM_TASK,
+		&ope_hw_mgr->msg_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_ope_msg_queue);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "unable to create a message worker");
+		goto msg_work_failed;
+	}
+
+	rc = cam_req_mgr_workq_create("ope_timer_queue", OPE_WORKQ_NUM_TASK,
+		&ope_hw_mgr->timer_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_ope_timer_queue);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "unable to create a timer worker");
+		goto timer_work_failed;
+	}
+
+	ope_hw_mgr->cmd_work_data =
+		kzalloc(sizeof(struct ope_cmd_work_data) * OPE_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!ope_hw_mgr->cmd_work_data) {
+		rc = -ENOMEM;
+		goto cmd_work_data_failed;
+	}
+
+	ope_hw_mgr->msg_work_data =
+		kzalloc(sizeof(struct ope_msg_work_data) * OPE_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!ope_hw_mgr->msg_work_data) {
+		rc = -ENOMEM;
+		goto msg_work_data_failed;
+	}
+
+	ope_hw_mgr->timer_work_data =
+		kzalloc(sizeof(struct ope_clk_work_data) * OPE_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!ope_hw_mgr->timer_work_data) {
+		rc = -ENOMEM;
+		goto timer_work_data_failed;
+	}
+
+	for (i = 0; i < OPE_WORKQ_NUM_TASK; i++)
+		ope_hw_mgr->msg_work->task.pool[i].payload =
+				&ope_hw_mgr->msg_work_data[i];
+
+	for (i = 0; i < OPE_WORKQ_NUM_TASK; i++)
+		ope_hw_mgr->cmd_work->task.pool[i].payload =
+				&ope_hw_mgr->cmd_work_data[i];
+
+	for (i = 0; i < OPE_WORKQ_NUM_TASK; i++)
+		ope_hw_mgr->timer_work->task.pool[i].payload =
+				&ope_hw_mgr->timer_work_data[i];
+	return 0;
+
+
+timer_work_data_failed:
+	kfree(ope_hw_mgr->msg_work_data);
+msg_work_data_failed:
+	kfree(ope_hw_mgr->cmd_work_data);
+cmd_work_data_failed:
+	cam_req_mgr_workq_destroy(&ope_hw_mgr->timer_work);
+timer_work_failed:
+	cam_req_mgr_workq_destroy(&ope_hw_mgr->msg_work);
+msg_work_failed:
+	cam_req_mgr_workq_destroy(&ope_hw_mgr->cmd_work);
+cmd_work_failed:
+	return rc;
+}
+
+static int cam_ope_create_debug_fs(void)
+{
+	int rc;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("ope", &ope_hw_mgr->dentry);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "failed to create dentry");
+		return rc;
+	}
+
+	debugfs_create_bool("frame_dump_enable", 0644, ope_hw_mgr->dentry,
+		&ope_hw_mgr->frame_dump_enable);
+
+	debugfs_create_bool("dump_req_data_enable", 0644, ope_hw_mgr->dentry,
+		&ope_hw_mgr->dump_req_data_enable);
+
+	return 0;
+}
+
+
+int cam_ope_hw_mgr_init(struct device_node *of_node, uint64_t *hw_mgr_hdl,
+	int *iommu_hdl)
+{
+	int i, rc = 0, j;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	struct cam_iommu_handle cdm_handles;
+
+	if (!of_node || !hw_mgr_hdl) {
+		CAM_ERR(CAM_OPE, "Invalid args of_node %pK hw_mgr %pK",
+			of_node, hw_mgr_hdl);
+		return -EINVAL;
+	}
+	hw_mgr_intf = (struct cam_hw_mgr_intf *)hw_mgr_hdl;
+
+	ope_hw_mgr = kzalloc(sizeof(struct cam_ope_hw_mgr), GFP_KERNEL);
+	if (!ope_hw_mgr) {
+		CAM_ERR(CAM_OPE, "Unable to allocate mem for: size = %d",
+			sizeof(struct cam_ope_hw_mgr));
+		return -ENOMEM;
+	}
+
+	hw_mgr_intf->hw_mgr_priv = ope_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_ope_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire  = cam_ope_mgr_acquire_hw;
+	hw_mgr_intf->hw_release  = cam_ope_mgr_release_hw;
+	hw_mgr_intf->hw_start    = NULL;
+	hw_mgr_intf->hw_stop     = NULL;
+	hw_mgr_intf->hw_prepare_update = cam_ope_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config_stream_settings = NULL;
+	hw_mgr_intf->hw_config = cam_ope_mgr_config_hw;
+	hw_mgr_intf->hw_read   = NULL;
+	hw_mgr_intf->hw_write  = NULL;
+	hw_mgr_intf->hw_cmd    = cam_ope_mgr_cmd;
+	hw_mgr_intf->hw_open   = cam_ope_mgr_hw_open_u;
+	hw_mgr_intf->hw_close  = cam_ope_mgr_hw_close_u;
+	hw_mgr_intf->hw_flush  = cam_ope_mgr_hw_flush;
+	hw_mgr_intf->hw_dump   = cam_ope_mgr_hw_dump;
+
+	ope_hw_mgr->secure_mode = false;
+	mutex_init(&ope_hw_mgr->hw_mgr_mutex);
+	spin_lock_init(&ope_hw_mgr->hw_mgr_lock);
+
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		ope_hw_mgr->ctx[i].bitmap_size =
+			BITS_TO_LONGS(CAM_CTX_REQ_MAX) *
+			sizeof(long);
+		ope_hw_mgr->ctx[i].bitmap = kzalloc(
+			ope_hw_mgr->ctx[i].bitmap_size, GFP_KERNEL);
+		if (!ope_hw_mgr->ctx[i].bitmap) {
+			CAM_ERR(CAM_OPE, "bitmap allocation failed: size = %d",
+				ope_hw_mgr->ctx[i].bitmap_size);
+			rc = -ENOMEM;
+			goto ope_ctx_bitmap_failed;
+		}
+		ope_hw_mgr->ctx[i].bits = ope_hw_mgr->ctx[i].bitmap_size *
+			BITS_PER_BYTE;
+		mutex_init(&ope_hw_mgr->ctx[i].ctx_mutex);
+	}
+
+	rc = cam_ope_mgr_init_devs(of_node);
+	if (rc)
+		goto dev_init_failed;
+
+	ope_hw_mgr->ctx_bitmap_size =
+		BITS_TO_LONGS(OPE_CTX_MAX) * sizeof(long);
+	ope_hw_mgr->ctx_bitmap = kzalloc(ope_hw_mgr->ctx_bitmap_size,
+		GFP_KERNEL);
+	if (!ope_hw_mgr->ctx_bitmap) {
+		rc = -ENOMEM;
+		goto ctx_bitmap_alloc_failed;
+	}
+
+	ope_hw_mgr->ctx_bits = ope_hw_mgr->ctx_bitmap_size *
+		BITS_PER_BYTE;
+
+	for (i = 0; i < OPE_DEV_MAX; i++) {
+		rc = cam_ope_hw_init(&ope_hw_mgr->ope_dev_data[i], i);
+		if (rc)
+			goto ctx_bitmap_alloc_failed;
+	}
+
+	rc = cam_smmu_get_handle("ope", &ope_hw_mgr->iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "get mmu handle failed: %d", rc);
+		goto ope_get_hdl_failed;
+	}
+
+	rc = cam_smmu_get_handle("cam-secure", &ope_hw_mgr->iommu_sec_hdl);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "get secure mmu handle failed: %d", rc);
+		goto secure_hdl_failed;
+	}
+
+	rc = cam_cdm_get_iommu_handle("ope", &cdm_handles);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "ope cdm handle get is failed: %d", rc);
+		goto ope_cdm_hdl_failed;
+	}
+
+	ope_hw_mgr->iommu_cdm_hdl = cdm_handles.non_secure;
+	ope_hw_mgr->iommu_sec_cdm_hdl = cdm_handles.secure;
+	CAM_DBG(CAM_OPE, "iommu hdls %x %x cdm %x %x",
+		ope_hw_mgr->iommu_hdl, ope_hw_mgr->iommu_sec_hdl,
+		ope_hw_mgr->iommu_cdm_hdl,
+		ope_hw_mgr->iommu_sec_cdm_hdl);
+
+	rc = cam_ope_mgr_create_wq();
+	if (rc)
+		goto ope_wq_create_failed;
+
+	cam_ope_create_debug_fs();
+
+	if (iommu_hdl)
+		*iommu_hdl = ope_hw_mgr->iommu_hdl;
+
+	return rc;
+
+ope_wq_create_failed:
+	ope_hw_mgr->iommu_cdm_hdl = -1;
+	ope_hw_mgr->iommu_sec_cdm_hdl = -1;
+ope_cdm_hdl_failed:
+	cam_smmu_destroy_handle(ope_hw_mgr->iommu_sec_hdl);
+	ope_hw_mgr->iommu_sec_hdl = -1;
+secure_hdl_failed:
+	cam_smmu_destroy_handle(ope_hw_mgr->iommu_hdl);
+	ope_hw_mgr->iommu_hdl = -1;
+ope_get_hdl_failed:
+	cam_free_clear((void *)ope_hw_mgr->ctx_bitmap);
+	ope_hw_mgr->ctx_bitmap = NULL;
+	ope_hw_mgr->ctx_bitmap_size = 0;
+	ope_hw_mgr->ctx_bits = 0;
+ctx_bitmap_alloc_failed:
+	cam_free_clear((void *)ope_hw_mgr->devices[OPE_DEV_OPE]);
+	ope_hw_mgr->devices[OPE_DEV_OPE] = NULL;
+dev_init_failed:
+ope_ctx_bitmap_failed:
+	mutex_destroy(&ope_hw_mgr->hw_mgr_mutex);
+	for (j = i - 1; j >= 0; j--) {
+		mutex_destroy(&ope_hw_mgr->ctx[j].ctx_mutex);
+		cam_free_clear((void *)ope_hw_mgr->ctx[j].bitmap);
+		ope_hw_mgr->ctx[j].bitmap = NULL;
+		ope_hw_mgr->ctx[j].bitmap_size = 0;
+		ope_hw_mgr->ctx[j].bits = 0;
+	}
+	cam_free_clear((void *)ope_hw_mgr);
+	ope_hw_mgr = NULL;
+
+	return rc;
+}
+
+static void cam_ope_mgr_dump_pf_data(
+	struct cam_ope_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args *hw_cmd_args)
+{
+	struct cam_ope_ctx                *ctx_data;
+	struct cam_packet                 *packet;
+	struct cam_buf_io_cfg             *io_cfg = NULL;
+	struct cam_ope_request            *ope_request;
+	struct ope_io_buf                 *io_buf = NULL;
+	struct cam_ope_match_pid_args      ope_pid_mid_args;
+	struct cam_hw_dump_pf_args        *pf_args;
+	struct cam_hw_mgr_pf_request_info *pf_req_info;
+
+	int          device_idx;
+	bool         *ctx_found;
+	bool         io_buf_found = false;
+	int          i, j;
+	bool         hw_pid_support = true;
+	bool         hw_id_found = false;
+	uint32_t     *resource_type;
+	int          stripe_num;
+	int          rc = 0;
+
+	ctx_data    = (struct cam_ope_ctx *)hw_cmd_args->ctxt_to_hw_map;
+	pf_args = hw_cmd_args->u.pf_cmd_args->pf_args;
+	pf_req_info = hw_cmd_args->u.pf_cmd_args->pf_req_info;
+	rc = cam_packet_util_get_packet_addr(&packet, pf_req_info->packet_handle,
+		pf_req_info->packet_offset);
+	if (rc)
+		return rc;
+	ope_request = pf_req_info->req;
+
+	ope_pid_mid_args.fault_mid =  pf_args->pf_smmu_info->mid;
+	ope_pid_mid_args.fault_pid = pf_args->pf_smmu_info->pid;
+	ctx_found = &(pf_args->pf_context_info.ctx_found);
+	resource_type = &(pf_args->pf_context_info.resource_type);
+
+	if (ctx_data->pf_mid_found)
+		goto stripedump;
+
+	if (*ctx_found && *resource_type) {
+		hw_pid_support = false;
+		goto stripedump;
+	} else {
+		*ctx_found = false;
+	}
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		if (!ope_hw_mgr->ope_dev_data[i]->hw_intf)
+			continue;
+		for (j = 0; j < ope_hw_mgr->ope_dev_data[i]->num_hw_pid; j++) {
+			if (ope_hw_mgr->ope_dev_data[i]->hw_pid[j] ==
+					pf_args->pf_smmu_info->pid) {
+				hw_id_found = true;
+				device_idx = i;
+				*ctx_found = true;
+				break;
+			}
+		}
+		if (hw_id_found)
+			break;
+	}
+
+	if (i == ope_hw_mgr->num_ope) {
+		CAM_INFO(CAM_OPE,
+			"PID:%d  is not matching with any OPE HW PIDs ctx id:%d",
+			pf_args->pf_smmu_info->pid, ctx_data->ctx_id);
+		cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
+		return;
+	}
+
+	ope_pid_mid_args.device_idx = device_idx;
+
+	rc = hw_mgr->devices[OPE_DEV_OPE][device_idx]->hw_ops.process_cmd(
+		hw_mgr->devices[OPE_DEV_OPE][device_idx]->hw_priv,
+		OPE_HW_MATCH_PID_MID,
+		&ope_pid_mid_args, sizeof(ope_pid_mid_args));
+	if (rc) {
+		CAM_ERR(CAM_OPE,
+			"CAM_OPE_CMD_MATCH_PID_MID failed %d", rc);
+		cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
+		return;
+	}
+
+	*resource_type = ope_pid_mid_args.match_res;
+	CAM_INFO(CAM_OPE, "Fault port %d", *resource_type);
+
+stripedump:
+	io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload_flex +
+			packet->io_configs_offset / 4);
+
+	if (!ope_request)
+		goto iodump;
+
+	CAM_INFO(CAM_OPE, "req_id %d Num of batches %d",
+			ope_request->request_id, ope_request->num_batch);
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = 0; j < ope_request->num_io_bufs[i]; j++) {
+			io_buf = ope_request->io_buf[i][j];
+			if (io_buf) {
+				if (io_buf->resource_type == *resource_type) {
+					io_buf_found = true;
+					break;
+				}
+			}
+		}
+		if (io_buf_found)
+			break;
+	}
+
+iodump:
+	cam_packet_util_dump_io_bufs(packet, hw_mgr->iommu_hdl,
+		hw_mgr->iommu_sec_hdl, pf_args, hw_pid_support);
+
+	if (io_buf_found) {
+		for (j = 0; j < CAM_PACKET_MAX_PLANES; j++) {
+			if (j >= OPE_MAX_PLANES) {
+				CAM_INFO(CAM_OPE, "Invalid plane idx: %d", j);
+				break;
+			}
+
+			for (stripe_num = 0; stripe_num < io_buf->num_stripes[j]; stripe_num++) {
+				CAM_INFO(CAM_OPE,
+					"pln_num %d stripe_num %d width %d height %d stride %d iovaddr 0x%llx",
+					j, stripe_num, io_buf->s_io[j][stripe_num].width,
+					io_buf->s_io[j][stripe_num].height,
+					io_buf->s_io[j][stripe_num].stride,
+					io_buf->s_io[j][stripe_num].iova_addr);
+			}
+		}
+	}
+	cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.h
@@ -0,0 +1,630 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_OPE_HW_MGR_H
+#define CAM_OPE_HW_MGR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "ope_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_smmu_api.h"
+#include "cam_soc_util.h"
+#include "cam_req_mgr_timer.h"
+#include "cam_context.h"
+#include "ope_hw.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_req_mgr_timer.h"
+
+#define OPE_CTX_MAX               32
+#define CAM_FRAME_CMD_MAX         20
+
+
+#define OPE_WORKQ_NUM_TASK        100
+#define OPE_WORKQ_TASK_CMD_TYPE   1
+#define OPE_WORKQ_TASK_MSG_TYPE   2
+
+#define OPE_PACKET_SIZE           0
+#define OPE_PACKET_TYPE           1
+#define OPE_PACKET_OPCODE         2
+
+#define OPE_PACKET_MAX_CMD_BUFS   4
+
+#define OPE_MAX_OUTPUT_SUPPORTED  8
+#define OPE_MAX_INPUT_SUPPORTED   3
+
+#define OPE_FRAME_PROCESS_SUCCESS 0
+#define OPE_FRAME_PROCESS_FAILURE 1
+
+#define OPE_CTX_STATE_FREE        0
+#define OPE_CTX_STATE_IN_USE      1
+#define OPE_CTX_STATE_ACQUIRED    2
+#define OPE_CTX_STATE_RELEASE     3
+
+#define OPE_CMDS                  OPE_MAX_CMD_BUFS
+#define CAM_MAX_IN_RES            8
+
+#define OPE_MAX_CDM_BLS           32
+
+#define CAM_OPE_MAX_PER_PATH_VOTES 6
+#define CAM_OPE_BW_CONFIG_UNKNOWN  0
+#define CAM_OPE_BW_CONFIG_V2       2
+
+#define CLK_HW_OPE                 0x0
+#define CLK_HW_MAX                 0x1
+
+#define OPE_DEVICE_IDLE_TIMEOUT    400
+#define OPE_REQUEST_RT_TIMEOUT        200
+#define OPE_REQUEST_NRT_TIMEOUT        400
+
+/**
+ * struct cam_ope_clk_bw_request_v2
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @reserved: Reserved for future use
+ * @num_paths: Number of paths for per path bw vote
+ * @axi_path: Per path vote info for OPE
+ */
+struct cam_ope_clk_bw_req_internal_v2 {
+	uint64_t budget_ns;
+	uint32_t frame_cycles;
+	uint32_t rt_flag;
+	uint32_t reserved;
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_OPE_MAX_PER_PATH_VOTES];
+};
+
+/**
+ * struct cam_ope_clk_bw_request
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @uncompressed_bw: Bandwidth required to process frame
+ * @compressed_bw: Compressed bandwidth to process frame
+ */
+struct cam_ope_clk_bw_request {
+	uint64_t budget_ns;
+	uint32_t frame_cycles;
+	uint32_t rt_flag;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+};
+
+/**
+ * struct cam_ctx_clk_info
+ * @curr_fc: Context latest request frame cycles
+ * @rt_flag: Flag to indicate real time request
+ * @base_clk: Base clock to process the request
+ * @reserved: Reserved field
+ * @uncompressed_bw: Current bandwidth voting
+ * @compressed_bw: Current compressed bandwidth voting
+ * @clk_rate: Supported clock rates for the context
+ * @num_paths: Number of valid AXI paths
+ * @axi_path: ctx based per path bw vote
+ */
+struct cam_ctx_clk_info {
+	uint32_t curr_fc;
+	uint32_t rt_flag;
+	uint32_t base_clk;
+	uint32_t reserved;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+	int32_t clk_rate[CAM_MAX_VOTE];
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_OPE_MAX_PER_PATH_VOTES];
+};
+
+/**
+ * struct ope_cmd_generic_blob
+ * @ctx: Current context info
+ * @req_info_idx: Index used for request
+ * @io_buf_addr: pointer to io buffer address
+ */
+struct ope_cmd_generic_blob {
+	struct cam_ope_ctx *ctx;
+	uint32_t req_idx;
+	uint64_t *io_buf_addr;
+};
+
+/**
+ * struct cam_ope_clk_info
+ * @base_clk: Base clock to process request
+ * @curr_clk: Current clock of hadrware
+ * @threshold: Threshold for overclk count
+ * @over_clked: Over clock count
+ * @uncompressed_bw: Current bandwidth voting
+ * @compressed_bw: Current compressed bandwidth voting
+ * @num_paths: Number of AXI vote paths
+ * @axi_path: Current per path bw vote info
+ * @hw_type: IPE/BPS device type
+ * @watch_dog: watchdog timer handle
+ * @watch_dog_reset_counter: Counter for watch dog reset
+ */
+struct cam_ope_clk_info {
+	uint32_t base_clk;
+	uint32_t curr_clk;
+	uint32_t threshold;
+	uint32_t over_clked;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+	uint32_t num_paths;
+	struct cam_cpas_axi_per_path_bw_vote axi_path[CAM_OPE_MAX_PER_PATH_VOTES];
+	uint32_t hw_type;
+	struct cam_req_mgr_timer *watch_dog;
+	uint32_t watch_dog_reset_counter;
+};
+
+/**
+ * struct ope_cmd_work_data
+ *
+ * @type:       Type of work data
+ * @data:       Private data
+ * @req_id:     Request Id
+ */
+struct ope_cmd_work_data {
+	uint32_t type;
+	void *data;
+	int64_t req_id;
+};
+
+/**
+ * struct ope_msg_work_data
+ *
+ * @type:       Type of work data
+ * @data:       Private data
+ * @irq_status: IRQ status
+ */
+struct ope_msg_work_data {
+	uint32_t type;
+	void *data;
+	uint32_t irq_status;
+};
+
+/**
+ * struct ope_clk_work_data
+ *
+ * @type: Type of work data
+ * @data: Private data
+ */
+struct ope_clk_work_data {
+	uint32_t type;
+	void *data;
+};
+
+/**
+ * struct cdm_dmi_cmd
+ *
+ * @length:   Number of bytes in LUT
+ * @reserved: reserved bits
+ * @cmd:      Command ID (CDMCmd)
+ * @addr:     Address of the LUT in memory
+ * @DMIAddr:  Address of the target DMI config register
+ * @DMISel:   DMI identifier
+ */
+struct cdm_dmi_cmd {
+	unsigned int length   : 16;
+	unsigned int reserved : 8;
+	unsigned int cmd      : 8;
+	unsigned int addr;
+	unsigned int DMIAddr  : 24;
+	unsigned int DMISel   : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct ope_debug_buffer
+ *
+ * @cpu_addr:         CPU address
+ * @iova_addr:        IOVA address
+ * @len:              Buffer length
+ * @size:             Buffer Size
+ * @offset:	      buffer offset
+ */
+struct ope_debug_buffer {
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	size_t len;
+	uint32_t size;
+	uint32_t offset;
+};
+
+/**
+ * struct ope_kmd_buffer
+ *
+ * @mem_handle:       Memory handle
+ * @cpu_addr:         CPU address
+ * @iova_addr:        IOVA address
+ * @iova_cdm_addr:    CDM IOVA address
+ * @offset:           Offset of buffer
+ * @len:              Buffer length
+ * @size:             Buffer Size
+ */
+struct ope_kmd_buffer {
+	uint32_t mem_handle;
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	dma_addr_t iova_cdm_addr;
+	uint32_t offset;
+	size_t len;
+	uint32_t size;
+};
+
+struct ope_stripe_settings {
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	size_t len;
+	uint32_t size;
+	uint32_t buf_type;
+	uint32_t type_buffered;
+};
+
+/**
+ * struct ope_pass_settings
+ *
+ * @cpu_addr:         CPU address
+ * @iova_addr:        IOVA address
+ * @len:              Buffer length
+ * @size:             Buffer Size
+ * @idx:              Pass Index
+ * @buf_type:         Direct/Indirect type
+ * @type_buffered:    SB/DB types
+ */
+struct ope_pass_settings {
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	size_t len;
+	uint32_t size;
+	uint32_t idx;
+	uint32_t buf_type;
+	uint32_t type_buffered;
+};
+
+/**
+ * struct ope_frame_settings
+ *
+ * @cpu_addr:         CPU address
+ * @iova_addr:        IOVA address
+ * @offset:           offset
+ * @len:              Buffer length
+ * @size:             Buffer Size
+ * @buf_type:         Direct/Indirect type
+ * @type_buffered:    SB/DB types
+ * @prefecth_disable: Disable prefetch
+ */
+struct ope_frame_settings {
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	uint32_t offset;
+	size_t len;
+	uint32_t size;
+	uint32_t buf_type;
+	uint32_t type_buffered;
+	uint32_t prefecth_disable;
+};
+
+/**
+ * struct ope_stripe_io
+ *
+ * @format:            Stripe format
+ * @s_location:        Stripe location
+ * @cpu_addr:          Stripe CPU address
+ * @iova_addr:         Stripe IOVA address
+ * @width:             Stripe width
+ * @height:            Stripe height
+ * @stride:            Stripe stride
+ * @unpack_format:     Unpack format
+ * @pack_format:       Packing format
+ * @alignment:         Stripe alignment
+ * @offset:            Stripe offset
+ * @x_init:            X_init
+ * @subsample_period:  Subsample period
+ * @subsample_pattern: Subsample pattern
+ * @len:               Stripe buffer length
+ * @disable_bus:       disable bus for the stripe
+ */
+struct ope_stripe_io {
+	uint32_t format;
+	uint32_t s_location;
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	uint32_t width;
+	uint32_t height;
+	uint32_t stride;
+	uint32_t unpack_format;
+	uint32_t pack_format;
+	uint32_t alignment;
+	uint32_t offset;
+	uint32_t x_init;
+	uint32_t subsample_period;
+	uint32_t subsample_pattern;
+	size_t len;
+	uint32_t disable_bus;
+};
+
+/**
+ * struct ope_io_buf
+ *
+ * @direction:     Direction of a buffer
+ * @resource_type: Resource type of IO Buffer
+ * @format:        Format
+ * @fence:         Fence
+ * @num_planes:    Number of planes
+ * @num_stripes:   Number of stripes
+ * @s_io:          Stripe info
+ */
+struct ope_io_buf {
+	uint32_t direction;
+	uint32_t resource_type;
+	uint32_t format;
+	uint32_t fence;
+	uint32_t num_planes;
+	uint32_t pix_pattern;
+	uint32_t num_stripes[OPE_MAX_PLANES];
+	struct ope_stripe_io s_io[OPE_MAX_PLANES][OPE_MAX_STRIPES];
+};
+
+/**
+ * struct cam_ope_request
+ *
+ * @request_id:          Request Id
+ * @req_idx:             Index in request list
+ * @state:               Request state
+ * @num_batch:           Number of batches
+ * @num_cmd_bufs:        Number of command buffers
+ * @num_frame_bufs:      Number of frame buffers
+ * @num_pass_bufs:       Number of pass Buffers
+ * @num_stripes:         Number of Stripes
+ * @num_io_bufs:         Number of IO Buffers
+ * @in_resource:         Input resource
+ * @num_stripe_cmd_bufs: Command buffers per stripe
+ * @ope_kmd_buf:         KMD buffer for OPE programming
+ * @ope_debug_buf:       Debug buffer
+ * @io_buf:              IO config info of a request
+ * @cdm_cmd:             CDM command for OPE CDM
+ * @clk_info:            Clock Info V1
+ * @clk_info_v2:         Clock Info V2
+ * @hang_data:           Debug data for HW error
+ * @submit_timestamp:    Submit timestamp to hw
+ */
+struct cam_ope_request {
+	uint64_t request_id;
+	uint32_t req_idx;
+	uint32_t state;
+	uint32_t num_batch;
+	uint32_t num_cmd_bufs;
+	uint32_t num_frame_bufs;
+	uint32_t num_pass_bufs;
+	uint32_t num_stripes[OPE_MAX_BATCH_SIZE];
+	uint32_t num_io_bufs[OPE_MAX_BATCH_SIZE];
+	uint32_t in_resource;
+	uint8_t num_stripe_cmd_bufs[OPE_MAX_BATCH_SIZE][OPE_MAX_STRIPES];
+	struct ope_kmd_buffer ope_kmd_buf;
+	struct ope_debug_buffer ope_debug_buf;
+	struct cam_kmd_buf_info genirq_buff_info;
+	struct ope_io_buf *io_buf[OPE_MAX_BATCH_SIZE][OPE_MAX_IO_BUFS];
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_ope_clk_bw_request clk_info;
+	struct cam_ope_clk_bw_req_internal_v2 clk_info_v2;
+	struct cam_hw_mgr_pf_request_info hang_data;
+	ktime_t submit_timestamp;
+};
+
+/**
+ * struct cam_ope_cdm
+ *
+ * @cdm_handle: OPE CDM Handle
+ * @cdm_ops:    OPE CDM Operations
+ */
+struct cam_ope_cdm {
+	uint32_t cdm_handle;
+	struct cam_cdm_utils_ops *cdm_ops;
+};
+
+/**
+ * struct cam_ope_ctx
+ *
+ * @context_priv:    Private data of context
+ * @bitmap:          Context bit map
+ * @bitmap_size:     Context bit map size
+ * @bits:            Context bit map bits
+ * @ctx_id:          Context ID
+ * @ctx_state:       State of a context
+ * @req_cnt:         Requests count
+ * @ctx_mutex:       Mutex for context
+ * @acquire_dev_cmd: Cam acquire command
+ * @ope_acquire:     OPE acquire command
+ * @ctxt_event_cb:   Callback of a context
+ * @req_list:        Request List
+ * @ope_cdm:         OPE CDM info
+ * @last_req_time:   Timestamp of last request
+ * @req_watch_dog:   Watchdog for requests
+ * @req_watch_dog_reset_counter: Request reset counter
+ * @clk_info:        OPE Ctx clock info
+ * @clk_watch_dog:   Clock watchdog
+ * @clk_watch_dog_reset_counter: Reset counter
+ * @last_flush_req: last flush req for this ctx
+ * @req_timer_timeout: req timer timeout value
+ */
+struct cam_ope_ctx {
+	void *context_priv;
+	size_t bitmap_size;
+	void *bitmap;
+	size_t bits;
+	uint32_t ctx_id;
+	uint32_t ctx_state;
+	uint32_t req_cnt;
+	struct mutex ctx_mutex;
+	struct cam_acquire_dev_cmd acquire_dev_cmd;
+	struct ope_acquire_dev_info ope_acquire;
+	cam_hw_event_cb_func ctxt_event_cb;
+	struct cam_ope_request *req_list[CAM_CTX_REQ_MAX];
+	struct cam_ope_cdm ope_cdm;
+	uint64_t last_req_time;
+	struct cam_req_mgr_timer *req_watch_dog;
+	uint32_t req_watch_dog_reset_counter;
+	struct cam_ctx_clk_info clk_info;
+	struct cam_req_mgr_timer *clk_watch_dog;
+	uint32_t clk_watch_dog_reset_counter;
+	uint64_t last_flush_req;
+	bool pf_mid_found;
+	uint64_t req_timer_timeout;
+};
+
+/**
+ * struct cam_ope_hw_intf_data - OPE hw intf data
+ *
+ * @Brief:        ope hw intf pointer and pid list data
+ *
+ * @devices:      ope hw intf pointer
+ * @num_devices:  Number of OPE devices
+ * @num_hw_pid:   Number of pids for this hw
+ * @hw_pid:       ope hw pid values
+ *
+ */
+struct cam_ope_hw_intf_data {
+	struct cam_hw_intf  *hw_intf;
+	uint32_t             num_hw_pid;
+	uint32_t             hw_pid[OPE_DEV_MAX];
+};
+
+/**
+ * struct cam_ope_hw_mgr
+ *
+ * @open_cnt:             OPE device open count
+ * @ope_ctx_cnt:          Open context count
+ * @hw_mgr_mutex:         Mutex for HW manager
+ * @hw_mgr_lock:          Spinlock for HW manager
+ * @hfi_en:               Flag for HFI
+ * @iommu_hdl:            OPE Handle
+ * @iommu_sec_hdl:        OPE Handle for secure
+ * @iommu_cdm_hdl:        CDM Handle
+ * @iommu_sec_cdm_hdl:    CDM Handle for secure
+ * @num_ope:              Number of OPE
+ * @secure_mode:          Mode of OPE operation
+ * @ctx_bitmap:           Context bit map
+ * @ctx_bitmap_size:      Context bit map size
+ * @ctx_bits:             Context bit map bits
+ * @ctx:                  OPE context
+ * @devices:              OPE devices
+ * @ope_dev_data:         OPE device specific data
+ * @ope_caps:             OPE capabilities
+ * @cmd_work:             Command work
+ * @msg_work:             Message work
+ * @timer_work:           Timer work
+ * @cmd_work_data:        Command work data
+ * @msg_work_data:        Message work data
+ * @timer_work_data:      Timer work data
+ * @ope_dev_intf:         OPE device interface
+ * @cdm_reg_map:          OPE CDM register map
+ * @clk_info:             OPE clock Info for HW manager
+ * @dentry:               Pointer to OPE debugfs directory
+ * @frame_dump_enable:    OPE frame setting dump enablement
+ * @dump_req_data_enable: OPE hang dump enablement
+ */
+struct cam_ope_hw_mgr {
+	int32_t             open_cnt;
+	uint32_t            ope_ctx_cnt;
+	struct mutex        hw_mgr_mutex;
+	spinlock_t          hw_mgr_lock;
+	bool                hfi_en;
+	int32_t             iommu_hdl;
+	int32_t             iommu_sec_hdl;
+	int32_t             iommu_cdm_hdl;
+	int32_t             iommu_sec_cdm_hdl;
+	uint32_t            num_ope;
+	bool                secure_mode;
+	void *ctx_bitmap;
+	size_t ctx_bitmap_size;
+	size_t ctx_bits;
+	struct cam_ope_ctx  ctx[OPE_CTX_MAX];
+	struct cam_hw_intf **devices[OPE_DEV_MAX];
+	struct cam_ope_hw_intf_data *ope_dev_data[OPE_DEV_MAX];
+	struct ope_query_cap_cmd ope_caps;
+	uint64_t last_callback_time;
+
+	struct cam_req_mgr_core_workq *cmd_work;
+	struct cam_req_mgr_core_workq *msg_work;
+	struct cam_req_mgr_core_workq *timer_work;
+	struct ope_cmd_work_data *cmd_work_data;
+	struct ope_msg_work_data *msg_work_data;
+	struct ope_clk_work_data *timer_work_data;
+	struct cam_hw_intf *ope_dev_intf[OPE_DEV_MAX];
+	struct cam_soc_reg_map *cdm_reg_map[OPE_DEV_MAX][OPE_BASE_MAX];
+	struct cam_ope_clk_info clk_info;
+	struct dentry *dentry;
+	bool   frame_dump_enable;
+	bool   dump_req_data_enable;
+};
+
+/**
+ * struct cam_ope_buf_entry
+ *
+ * @fd:                FD of cmd buffer
+ * @memhdl:           Memhandle of cmd buffer
+ * @iova:              IOVA address of cmd buffer
+ * @offset:            Offset of cmd buffer
+ * @len:               Length of cmd buffer
+ * @size:              Size of cmd buffer
+ */
+struct cam_ope_buf_entry {
+	uint32_t          fd;
+	uint64_t          memhdl;
+	uint64_t          iova;
+	uint64_t          offset;
+	uint64_t          len;
+	uint64_t          size;
+};
+
+/**
+ * struct cam_ope_bl_entry
+ *
+ * @base:              Base IOVA address of BL
+ * @len:               Length of BL
+ * @arbitration:       Arbitration bit
+ */
+struct cam_ope_bl_entry {
+	uint32_t         base;
+	uint32_t         len;
+	uint32_t         arbitration;
+};
+
+/**
+ * struct cam_ope_output_info
+ *
+ * @iova:              IOVA address of output buffer
+ * @offset:            Offset of buffer
+ * @len:               Length of buffer
+ */
+struct cam_ope_output_info {
+	uint64_t    iova;
+	uint64_t    offset;
+	uint64_t    len;
+};
+
+/**
+ * struct cam_ope_hang_dump
+ *
+ * @num_bls:           count of BLs for request
+ * @num_bufs:          Count of buffer related to request
+ * @num_outputs:       Count of output beffers
+ * @entries:           Buffers info
+ * @bl_entries:        BLs info
+ * @outputs:           Output info
+ */
+struct cam_ope_hang_dump {
+	uint32_t num_bls;
+	uint32_t num_bufs;
+	uint64_t num_outputs;
+	struct cam_ope_buf_entry entries[OPE_MAX_BATCH_SIZE * OPE_MAX_CMD_BUFS];
+	struct cam_ope_bl_entry bl_entries[OPE_MAX_CDM_BLS];
+	struct cam_ope_output_info outputs
+		[OPE_MAX_BATCH_SIZE * OPE_OUT_RES_MAX];
+};
+#endif /* CAM_OPE_HW_MGR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr_intf.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_HW_MGR_INTF_H
+#define CAM_OPE_HW_MGR_INTF_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "cam_ope_hw_mgr.h"
+
+int cam_ope_hw_mgr_init(struct device_node *of_node, uint64_t *hw_mgr_hdl,
+	int *iommu_hdl);
+
+int cam_ope_hw_init(struct cam_ope_hw_intf_data **ope_hw_intf_data,
+	uint32_t hw_idx);
+
+#endif /* CAM_OPE_HW_MGR_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.c
@@ -0,0 +1,882 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include <media/cam_ope.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+#include "ope_bus_rd.h"
+#include "cam_common_util.h"
+
+static struct ope_bus_rd *bus_rd;
+
+enum cam_ope_bus_unpacker_format {
+	UNPACKER_FMT_PLAIN_128                   = 0x0,
+	UNPACKER_FMT_PLAIN_8                     = 0x1,
+	UNPACKER_FMT_PLAIN_16_10BPP              = 0x2,
+	UNPACKER_FMT_PLAIN_16_12BPP              = 0x3,
+	UNPACKER_FMT_PLAIN_16_14BPP              = 0x4,
+	UNPACKER_FMT_PLAIN_32_20BPP              = 0x5,
+	UNPACKER_FMT_ARGB_16_10BPP               = 0x6,
+	UNPACKER_FMT_ARGB_16_12BPP               = 0x7,
+	UNPACKER_FMT_ARGB_16_14BPP               = 0x8,
+	UNPACKER_FMT_PLAIN_32                    = 0x9,
+	UNPACKER_FMT_PLAIN_64                    = 0xA,
+	UNPACKER_FMT_TP_10                       = 0xB,
+	UNPACKER_FMT_MIPI_8                      = 0xC,
+	UNPACKER_FMT_MIPI_10                     = 0xD,
+	UNPACKER_FMT_MIPI_12                     = 0xE,
+	UNPACKER_FMT_MIPI_14                     = 0xF,
+	UNPACKER_FMT_PLAIN_16_16BPP              = 0x10,
+	UNPACKER_FMT_PLAIN_128_ODD_EVEN          = 0x11,
+	UNPACKER_FMT_PLAIN_8_ODD_EVEN            = 0x12,
+	UNPACKER_FMT_MAX                         = 0x13,
+};
+
+static int cam_ope_bus_rd_in_port_idx(uint32_t input_port_id)
+{
+	int i;
+
+	for (i = 0; i < OPE_IN_RES_MAX; i++)
+		if (bus_rd->in_port_to_rm[i].input_port_id ==
+			input_port_id)
+			return i;
+
+	return -EINVAL;
+}
+
+static int cam_ope_bus_rd_combo_idx(uint32_t format)
+{
+	int rc = -EINVAL;
+
+	switch (format) {
+	case CAM_FORMAT_YUV422:
+	case CAM_FORMAT_NV21:
+	case CAM_FORMAT_NV12:
+		rc = BUS_RD_YUV;
+		break;
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_MIPI_RAW_20:
+	case CAM_FORMAT_QTI_RAW_8:
+	case CAM_FORMAT_QTI_RAW_10:
+	case CAM_FORMAT_QTI_RAW_12:
+	case CAM_FORMAT_QTI_RAW_14:
+	case CAM_FORMAT_PLAIN8:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_12:
+	case CAM_FORMAT_PLAIN16_14:
+	case CAM_FORMAT_PLAIN16_16:
+	case CAM_FORMAT_PLAIN32_20:
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_PLAIN128:
+		rc = BUS_RD_BAYER;
+		break;
+	default:
+		break;
+		}
+
+	CAM_DBG(CAM_OPE, "Input format = %u rc = %d",
+		format, rc);
+	return rc;
+}
+
+static int cam_ope_bus_is_rm_enabled(
+	struct cam_ope_request *ope_request,
+	uint32_t batch_idx,
+	uint32_t rm_id)
+{
+	int i, k;
+	int32_t combo_idx;
+	struct ope_io_buf *io_buf;
+	struct ope_bus_in_port_to_rm *in_port_to_rm;
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ope_request->num_io_bufs[batch_idx]; i++) {
+		io_buf = ope_request->io_buf[batch_idx][i];
+		if (io_buf->direction != CAM_BUF_INPUT)
+			continue;
+		in_port_to_rm =
+			&bus_rd->in_port_to_rm[io_buf->resource_type - 1];
+		combo_idx = cam_ope_bus_rd_combo_idx(io_buf->format);
+		if (combo_idx < 0) {
+			CAM_ERR(CAM_OPE, "Invalid combo_idx");
+			return -EINVAL;
+		}
+		for (k = 0; k < io_buf->num_planes; k++) {
+			if (rm_id ==
+				in_port_to_rm->rm_port_id[combo_idx][k])
+				return true;
+		}
+	}
+
+	return false;
+}
+
+static uint32_t *cam_ope_bus_rd_update(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t *kmd_buf, int batch_idx,
+	int io_idx, struct cam_ope_dev_prepare_req *prepare,
+	int32_t *num_stripes)
+{
+	int k, l, m;
+	uint32_t idx;
+	int32_t combo_idx;
+	uint32_t req_idx, count = 0, temp;
+	uint32_t temp_reg[128] = {0};
+	uint32_t rm_id, header_size;
+	uint32_t rsc_type;
+	uint32_t *next_buff_addr = NULL;
+	struct cam_hw_prepare_update_args *prepare_args;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_request *ope_request;
+	struct ope_io_buf *io_buf;
+	struct ope_stripe_io *stripe_io;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+	struct cam_ope_bus_rd_reg *rd_reg;
+	struct cam_ope_bus_rd_client_reg *rd_reg_client;
+	struct cam_ope_bus_rd_reg_val *rd_reg_val;
+	struct cam_ope_bus_rd_client_reg_val *rd_res_val_client;
+	struct ope_bus_in_port_to_rm *in_port_to_rm;
+	struct ope_bus_rd_io_port_cdm_info *io_port_cdm;
+	struct cam_cdm_utils_ops *cdm_ops;
+	struct ope_bus_rd_io_port_info *io_port_info;
+
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, prepare);
+		return NULL;
+	}
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return NULL;
+	}
+
+	if (io_idx >= OPE_MAX_IO_BUFS) {
+		CAM_ERR(CAM_OPE, "Invalid IO idx: %d", io_idx);
+		return NULL;
+	}
+
+	prepare_args = prepare->prepare_args;
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	ope_request = ctx_data->req_list[req_idx];
+	CAM_DBG(CAM_OPE, "req_idx = %d req_id = %lld KMDbuf %x offset %d",
+		req_idx, ope_request->request_id,
+		kmd_buf, prepare->kmd_buf_offset);
+	bus_rd_ctx = bus_rd->bus_rd_ctx[ctx_id];
+	io_port_info = &bus_rd_ctx->io_port_info;
+	rd_reg = ope_hw_info->bus_rd_reg;
+	rd_reg_val = ope_hw_info->bus_rd_reg_val;
+	io_buf = ope_request->io_buf[batch_idx][io_idx];
+
+	CAM_DBG(CAM_OPE,
+		"req_idx = %d req_id = %lld KMDbuf 0x%x offset %d rsc %d",
+		req_idx, ope_request->request_id,
+		kmd_buf, prepare->kmd_buf_offset,
+		io_buf->resource_type);
+	CAM_DBG(CAM_OPE, "batch:%d iobuf:%d direction:%d",
+		batch_idx, io_idx, io_buf->direction);
+	io_port_cdm =
+	&bus_rd_ctx->io_port_cdm_batch.io_port_cdm[batch_idx];
+	in_port_to_rm =
+	&bus_rd->in_port_to_rm[io_buf->resource_type - 1];
+	combo_idx = cam_ope_bus_rd_combo_idx(io_buf->format);
+	if (combo_idx < 0) {
+		CAM_ERR(CAM_OPE, "Invalid combo_idx");
+		return NULL;
+	}
+
+	for (k = 0; k < io_buf->num_planes; k++) {
+		for (l = 0; l < io_buf->num_stripes[k]; l++) {
+			*num_stripes = io_buf->num_stripes[k];
+			stripe_io = &io_buf->s_io[k][l];
+			rsc_type = io_buf->resource_type - 1;
+			/* frame level info */
+			/* stripe level info */
+			rm_id = in_port_to_rm->rm_port_id[combo_idx][k];
+			rd_reg_client = &rd_reg->rd_clients[rm_id];
+			rd_res_val_client = &rd_reg_val->rd_clients[rm_id];
+
+			/* security cfg */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg->security_cfg;
+			temp_reg[count++] =
+				ctx_data->ope_acquire.secure_mode;
+
+			/* enable client */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->core_cfg;
+			temp_reg[count++] = 1;
+
+			/* ccif meta data */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->ccif_meta_data;
+			temp = 0;
+			temp |= stripe_io->s_location &
+				rd_res_val_client->stripe_location_mask;
+			temp |= (io_buf->pix_pattern &
+				rd_res_val_client->pix_pattern_mask) <<
+				rd_res_val_client->pix_pattern_shift;
+			temp_reg[count++] = temp;
+
+			/* Address of the Image */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->img_addr;
+			temp_reg[count++] = stripe_io->iova_addr;
+
+			/* Buffer size */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->img_cfg;
+			temp = 0;
+			temp = stripe_io->height;
+			temp |=
+			(stripe_io->width &
+				rd_res_val_client->img_width_mask) <<
+				rd_res_val_client->img_width_shift;
+			temp_reg[count++] = temp;
+
+			/* stride */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->stride;
+			temp_reg[count++] = stripe_io->stride;
+
+			/*
+			 * In case of NV12, change the unpacker format of
+			 * chroma plane to odd even byte swapped format.
+			 */
+			if (k == 1 && stripe_io->format == CAM_FORMAT_NV12)
+				stripe_io->unpack_format =
+					UNPACKER_FMT_PLAIN_8_ODD_EVEN;
+
+			/* Unpack cfg : Mode and alignment */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->unpack_cfg;
+			temp = 0;
+			temp |= (stripe_io->unpack_format &
+				rd_res_val_client->mode_mask) <<
+				rd_res_val_client->mode_shift;
+			temp |= (stripe_io->alignment &
+				rd_res_val_client->alignment_mask) <<
+				rd_res_val_client->alignment_shift;
+			temp_reg[count++] = temp;
+
+			/* latency buffer allocation */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->latency_buf_allocation;
+			temp_reg[count++] = io_port_info->latency_buf_size;
+
+			header_size = cdm_ops->cdm_get_cmd_header_size(
+				CAM_CDM_CMD_REG_RANDOM);
+			idx = io_port_cdm->num_s_cmd_bufs[l];
+			io_port_cdm->s_cdm_info[l][idx].len = sizeof(temp) *
+				(count + header_size);
+			io_port_cdm->s_cdm_info[l][idx].offset =
+				prepare->kmd_buf_offset;
+			io_port_cdm->s_cdm_info[l][idx].addr = kmd_buf;
+			io_port_cdm->num_s_cmd_bufs[l]++;
+
+			next_buff_addr = cdm_ops->cdm_write_regrandom(
+				kmd_buf, count/2, temp_reg);
+			if (next_buff_addr > kmd_buf)
+				prepare->kmd_buf_offset +=
+					((count + header_size) * sizeof(temp));
+			kmd_buf = next_buff_addr;
+			CAM_DBG(CAM_OPE, "b:%d io:%d p:%d s:%d",
+				batch_idx, io_idx, k, l);
+			for (m = 0; m < count; m += 2)
+				CAM_DBG(CAM_OPE, "%d: off: 0x%x val: 0x%x",
+					m, temp_reg[m], temp_reg[m+1]);
+			CAM_DBG(CAM_OPE, "kmd_buf:%x offset:%d",
+				kmd_buf, prepare->kmd_buf_offset);
+			CAM_DBG(CAM_OPE, "RD cmdbufs:%d off:%d len %d",
+				io_port_cdm->num_s_cmd_bufs[l],
+				io_port_cdm->s_cdm_info[l][idx].offset,
+				io_port_cdm->s_cdm_info[l][idx].len);
+			count = 0;
+		}
+	}
+
+	return kmd_buf;
+}
+
+static uint32_t *cam_ope_bus_rm_disable(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, struct cam_ope_dev_prepare_req *prepare,
+	int batch_idx, int rm_idx,
+	uint32_t *kmd_buf, uint32_t num_stripes)
+{
+	int l;
+	uint32_t idx;
+	uint32_t req_idx;
+	uint32_t temp_reg[128];
+	uint32_t count = 0;
+	uint32_t temp = 0;
+	uint32_t header_size;
+	uint32_t *next_buff_addr = NULL;
+	struct cam_ope_ctx *ctx_data;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+	struct cam_ope_bus_rd_reg *rd_reg;
+	struct cam_ope_bus_rd_client_reg *rd_reg_client;
+	struct ope_bus_rd_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_rd_io_port_cdm_info *io_port_cdm;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, prepare);
+		return NULL;
+	}
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return NULL;
+	}
+
+	if (rm_idx >= MAX_RD_CLIENTS) {
+		CAM_ERR(CAM_OPE, "Invalid read client: %d", rm_idx);
+		return NULL;
+	}
+
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	bus_rd_ctx = bus_rd->bus_rd_ctx[ctx_id];
+	io_port_cdm_batch = &bus_rd_ctx->io_port_cdm_batch;
+	rd_reg = ope_hw_info->bus_rd_reg;
+
+	CAM_DBG(CAM_OPE,
+		"kmd_buf = 0x%x req_idx = %d offset = %d rd_idx %d b %d",
+		kmd_buf, req_idx, prepare->kmd_buf_offset, rm_idx, batch_idx);
+
+	io_port_cdm =
+		&bus_rd_ctx->io_port_cdm_batch.io_port_cdm[batch_idx];
+
+	for (l = 0; l < num_stripes; l++) {
+		/* stripe level info */
+		rd_reg_client = &rd_reg->rd_clients[rm_idx];
+
+		/* Core cfg: enable, Mode */
+		temp_reg[count++] = rd_reg->offset +
+			rd_reg_client->core_cfg;
+		temp_reg[count++] = 0;
+
+		header_size = cdm_ops->cdm_get_cmd_header_size(
+			CAM_CDM_CMD_REG_RANDOM);
+		idx = io_port_cdm->num_s_cmd_bufs[l];
+		io_port_cdm->s_cdm_info[l][idx].len =
+			sizeof(temp) * (count + header_size);
+		io_port_cdm->s_cdm_info[l][idx].offset =
+			prepare->kmd_buf_offset;
+		io_port_cdm->s_cdm_info[l][idx].addr = kmd_buf;
+		io_port_cdm->num_s_cmd_bufs[l]++;
+
+		next_buff_addr = cdm_ops->cdm_write_regrandom(
+			kmd_buf, count/2, temp_reg);
+		if (next_buff_addr > kmd_buf)
+			prepare->kmd_buf_offset += ((count + header_size) *
+				sizeof(temp));
+		kmd_buf = next_buff_addr;
+		CAM_DBG(CAM_OPE, "RD cmd bufs = %d",
+			io_port_cdm->num_s_cmd_bufs[l]);
+		CAM_DBG(CAM_OPE, "stripe %d off:%d len:%d",
+			l, io_port_cdm->s_cdm_info[l][idx].offset,
+			io_port_cdm->s_cdm_info[l][idx].len);
+		count = 0;
+	}
+
+	prepare->rd_cdm_batch = &bus_rd_ctx->io_port_cdm_batch;
+
+	return kmd_buf;
+}
+
+static int cam_ope_bus_rd_prepare(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	int i, j;
+	int32_t combo_idx;
+	uint32_t req_idx, count = 0, temp;
+	uint32_t temp_reg[32] = {0};
+	uint32_t header_size;
+	uint32_t *kmd_buf;
+	uint32_t *next_buff_addr = NULL;
+	int is_rm_enabled;
+	struct cam_ope_dev_prepare_req *prepare;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_request *ope_request;
+	struct ope_io_buf *io_buf;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+	struct cam_ope_bus_rd_reg *rd_reg;
+	struct cam_ope_bus_rd_reg_val *rd_reg_val;
+	struct ope_bus_rd_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_rd_io_port_cdm_info *io_port_cdm = NULL;
+	struct cam_cdm_utils_ops *cdm_ops;
+	int32_t num_stripes = 0;
+
+	if (ctx_id < 0 || !data) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+	prepare = data;
+
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		prepare->kmd_buf_offset;
+	CAM_DBG(CAM_OPE, "req_idx = %d req_id = %lld",
+		req_idx, ope_request->request_id);
+	CAM_DBG(CAM_OPE, "KMD buf and offset = %x %d",
+		kmd_buf, prepare->kmd_buf_offset);
+	bus_rd_ctx = bus_rd->bus_rd_ctx[ctx_id];
+	io_port_cdm_batch =
+		&bus_rd_ctx->io_port_cdm_batch;
+	memset(io_port_cdm_batch, 0,
+		sizeof(struct ope_bus_rd_io_port_cdm_batch));
+	rd_reg = ope_hw_info->bus_rd_reg;
+	rd_reg_val = ope_hw_info->bus_rd_reg_val;
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = 0; j < ope_request->num_io_bufs[i]; j++) {
+			io_buf = ope_request->io_buf[i][j];
+			if (io_buf->direction != CAM_BUF_INPUT)
+				continue;
+
+			CAM_DBG(CAM_OPE, "batch:%d iobuf:%d direction:%d",
+				i, j, io_buf->direction);
+			io_port_cdm =
+			&bus_rd_ctx->io_port_cdm_batch.io_port_cdm[i];
+
+			combo_idx = cam_ope_bus_rd_combo_idx(io_buf->format);
+			if (combo_idx < 0) {
+				CAM_ERR(CAM_OPE, "Invalid combo_idx");
+				return combo_idx;
+			}
+
+			kmd_buf = cam_ope_bus_rd_update(ope_hw_info,
+				ctx_id, kmd_buf, i, j, prepare,
+				&num_stripes);
+			if (!kmd_buf) {
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+	}
+
+	if (!io_port_cdm) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Disable RMs which are not enabled */
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = 0; j < rd_reg_val->num_clients; j++) {
+			is_rm_enabled = cam_ope_bus_is_rm_enabled(
+				ope_request, i, j);
+			if (is_rm_enabled < 0) {
+				rc = -EINVAL;
+				goto end;
+			}
+			if (is_rm_enabled)
+				continue;
+
+			kmd_buf = cam_ope_bus_rm_disable(ope_hw_info,
+				ctx_id, prepare, i, j,
+				kmd_buf, num_stripes);
+			if (!kmd_buf) {
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+	}
+
+	/* Go command */
+	count = 0;
+	temp_reg[count++] = rd_reg->offset +
+		rd_reg->input_if_cmd;
+	temp = 0;
+	temp |= rd_reg_val->go_cmd;
+	temp_reg[count++] = temp;
+
+	header_size =
+	cdm_ops->cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+	for (i = 0; i < ope_request->num_batch; i++) {
+		io_port_cdm =
+			&bus_rd_ctx->io_port_cdm_batch.io_port_cdm[i];
+		io_port_cdm->go_cmd_addr = kmd_buf;
+		io_port_cdm->go_cmd_len =
+			sizeof(temp) * (count + header_size);
+		io_port_cdm->go_cmd_offset =
+			prepare->kmd_buf_offset;
+	}
+	next_buff_addr = cdm_ops->cdm_write_regrandom(
+		kmd_buf, count/2, temp_reg);
+	if (next_buff_addr > kmd_buf)
+		prepare->kmd_buf_offset +=
+			((count + header_size) * sizeof(temp));
+	kmd_buf = next_buff_addr;
+	CAM_DBG(CAM_OPE, "kmd_buf:%x,offset:%d",
+		kmd_buf, prepare->kmd_buf_offset);
+	CAM_DBG(CAM_OPE, "t_reg:%xcount: %d size:%d",
+		 temp_reg, count, header_size);
+	prepare->rd_cdm_batch = &bus_rd_ctx->io_port_cdm_batch;
+
+end:
+	return rc;
+}
+
+static int cam_ope_bus_rd_release(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (ctx_id < 0 || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	vfree(bus_rd->bus_rd_ctx[ctx_id]);
+	bus_rd->bus_rd_ctx[ctx_id] = NULL;
+
+	return rc;
+}
+
+static int cam_ope_bus_rd_acquire(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i;
+	struct ope_acquire_dev_info *in_acquire;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+	struct ope_bus_in_port_to_rm *in_port_to_rm;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+	int combo_idx;
+	int in_port_idx;
+
+
+	if (ctx_id < 0 || !data || !ope_hw_info || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x %x",
+			ctx_id, data, ope_hw_info);
+		return -EINVAL;
+	}
+
+	bus_rd->bus_rd_ctx[ctx_id] = vzalloc(sizeof(struct ope_bus_rd_ctx));
+	if (!bus_rd->bus_rd_ctx[ctx_id]) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		return -ENOMEM;
+	}
+
+	bus_rd->bus_rd_ctx[ctx_id]->ope_acquire = data;
+	in_acquire = data;
+	bus_rd_ctx = bus_rd->bus_rd_ctx[ctx_id];
+	bus_rd_ctx->num_in_ports = in_acquire->num_in_res;
+	bus_rd_ctx->security_flag = in_acquire->secure_mode;
+	bus_rd_reg_val = ope_hw_info->bus_rd_reg_val;
+
+	for (i = 0; i < in_acquire->num_in_res; i++) {
+		if (!in_acquire->in_res[i].width)
+			continue;
+
+		CAM_DBG(CAM_OPE, "i = %d format = %u width = %x height = %x",
+			i, in_acquire->in_res[i].format,
+			in_acquire->in_res[i].width,
+			in_acquire->in_res[i].height);
+		CAM_DBG(CAM_OPE, "pix_pattern:%u alignment:%u unpack_format:%u",
+			in_acquire->in_res[i].pixel_pattern,
+			in_acquire->in_res[i].alignment,
+			in_acquire->in_res[i].unpacker_format);
+		CAM_DBG(CAM_OPE, "max_stripe = %u fps = %u",
+			in_acquire->in_res[i].max_stripe_size,
+			in_acquire->in_res[i].fps);
+
+		in_port_idx = cam_ope_bus_rd_in_port_idx(i + 1);
+		if (in_port_idx < 0) {
+			CAM_ERR(CAM_OPE, "Invalid in_port_idx: %d", i + 1);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		in_port_to_rm = &bus_rd->in_port_to_rm[in_port_idx];
+		combo_idx = cam_ope_bus_rd_combo_idx(
+			in_acquire->in_res[i].format);
+		if (combo_idx < 0) {
+			CAM_ERR(CAM_OPE, "Invalid format: %d",
+				in_acquire->in_res[i].format);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (!in_port_to_rm->num_rm[combo_idx]) {
+			CAM_ERR(CAM_OPE, "Invalid format for Input port");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		bus_rd_ctx->io_port_info.input_port_id[i] =
+			in_acquire->in_res[i].res_id;
+		bus_rd_ctx->io_port_info.input_format_type[i] =
+			in_acquire->in_res[i].format;
+		if (in_acquire->in_res[i].pixel_pattern >
+			PIXEL_PATTERN_CRYCBY) {
+			CAM_ERR(CAM_OPE, "Invalid pix pattern = %u",
+				in_acquire->in_res[i].pixel_pattern);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		bus_rd_ctx->io_port_info.pixel_pattern[i] =
+			in_acquire->in_res[i].pixel_pattern;
+		bus_rd_ctx->io_port_info.latency_buf_size =
+			bus_rd_reg_val->latency_buf_size;
+
+		CAM_DBG(CAM_OPE, "i:%d port_id = %u format %u pix_pattern = %u",
+			i, bus_rd_ctx->io_port_info.input_port_id[i],
+			bus_rd_ctx->io_port_info.input_format_type[i],
+			bus_rd_ctx->io_port_info.pixel_pattern[i]);
+		CAM_DBG(CAM_OPE, "latency_buf_size = %u",
+			bus_rd_ctx->io_port_info.latency_buf_size);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ope_bus_rd_init(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+	struct cam_ope_bus_rd_reg *bus_rd_reg;
+	struct cam_ope_dev_init *dev_init = data;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	bus_rd_reg_val = ope_hw_info->bus_rd_reg_val;
+	bus_rd_reg = ope_hw_info->bus_rd_reg;
+	bus_rd_reg->base = dev_init->core_info->ope_hw_info->ope_bus_rd_base;
+
+	/* OPE SW RESET */
+	init_completion(&bus_rd->reset_complete);
+
+	/* enable interrupt mask */
+	cam_io_w_mb(bus_rd_reg_val->irq_mask,
+		ope_hw_info->bus_rd_reg->base + bus_rd_reg->irq_mask);
+
+	cam_io_w_mb(bus_rd_reg_val->sw_reset,
+		ope_hw_info->bus_rd_reg->base + bus_rd_reg->sw_reset);
+
+	rc = cam_common_wait_for_completion_timeout(
+		&bus_rd->reset_complete, msecs_to_jiffies(30000));
+
+	if (!rc || rc < 0) {
+		CAM_ERR(CAM_OPE, "reset error result = %d", rc);
+		if (!rc)
+			rc = -ETIMEDOUT;
+	} else {
+		rc = 0;
+	}
+
+	cam_io_w_mb(bus_rd_reg_val->irq_mask,
+		ope_hw_info->bus_rd_reg->base + bus_rd_reg->irq_mask);
+
+	return rc;
+}
+
+static int cam_ope_bus_rd_probe(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i, j, combo_idx, k;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+	struct cam_ope_bus_rd_reg *bus_rd_reg;
+	struct ope_bus_in_port_to_rm *in_port_to_rm;
+	uint32_t input_port_idx;
+	uint32_t rm_idx;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+	bus_rd = kzalloc(sizeof(struct ope_bus_rd), GFP_KERNEL);
+	if (!bus_rd) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		return -ENOMEM;
+	}
+	bus_rd->ope_hw_info = ope_hw_info;
+	bus_rd_reg_val = ope_hw_info->bus_rd_reg_val;
+	bus_rd_reg = ope_hw_info->bus_rd_reg;
+
+	for (i = 0; i < bus_rd_reg_val->num_clients; i++) {
+		input_port_idx =
+			bus_rd_reg_val->rd_clients[i].input_port_id - 1;
+		in_port_to_rm = &bus_rd->in_port_to_rm[input_port_idx];
+		if (bus_rd_reg_val->rd_clients[i].format_type &
+			BUS_RD_COMBO_BAYER_MASK) {
+			combo_idx = BUS_RD_BAYER;
+			rm_idx = in_port_to_rm->num_rm[combo_idx];
+			in_port_to_rm->input_port_id =
+				bus_rd_reg_val->rd_clients[i].input_port_id;
+			in_port_to_rm->rm_port_id[combo_idx][rm_idx] =
+				bus_rd_reg_val->rd_clients[i].rm_port_id;
+			if (!in_port_to_rm->num_rm[combo_idx])
+				in_port_to_rm->num_combos++;
+			in_port_to_rm->num_rm[combo_idx]++;
+		}
+		if (bus_rd_reg_val->rd_clients[i].format_type &
+			BUS_RD_COMBO_YUV_MASK) {
+			combo_idx = BUS_RD_YUV;
+			rm_idx = in_port_to_rm->num_rm[combo_idx];
+			in_port_to_rm->input_port_id =
+				bus_rd_reg_val->rd_clients[i].input_port_id;
+			in_port_to_rm->rm_port_id[combo_idx][rm_idx] =
+				bus_rd_reg_val->rd_clients[i].rm_port_id;
+			if (!in_port_to_rm->num_rm[combo_idx])
+				in_port_to_rm->num_combos++;
+			in_port_to_rm->num_rm[combo_idx]++;
+		}
+	}
+
+	for (i = 0; i < OPE_IN_RES_MAX; i++) {
+		in_port_to_rm = &bus_rd->in_port_to_rm[i];
+		CAM_DBG(CAM_OPE, "input port id = %d num_combos = %d",
+			in_port_to_rm->input_port_id,
+			in_port_to_rm->num_combos);
+		for (j = 0; j < in_port_to_rm->num_combos; j++) {
+			CAM_DBG(CAM_OPE, "combo idx = %d num_rms = %d",
+				j, in_port_to_rm->num_rm[j]);
+			for (k = 0; k < in_port_to_rm->num_rm[j]; k++) {
+				CAM_DBG(CAM_OPE, "rm port id = %d",
+					in_port_to_rm->rm_port_id[j][k]);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ope_bus_rd_isr(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	uint32_t irq_status;
+	struct cam_ope_bus_rd_reg *bus_rd_reg;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+	struct cam_ope_irq_data *irq_data = data;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	bus_rd_reg = ope_hw_info->bus_rd_reg;
+	bus_rd_reg_val = ope_hw_info->bus_rd_reg_val;
+
+	/* Read and Clear Top Interrupt status */
+	irq_status = cam_io_r_mb(bus_rd_reg->base + bus_rd_reg->irq_status);
+	cam_io_w_mb(irq_status,
+		bus_rd_reg->base + bus_rd_reg->irq_clear);
+
+	cam_io_w_mb(bus_rd_reg_val->irq_set_clear,
+		bus_rd_reg->base + bus_rd_reg->irq_cmd);
+
+	if (irq_status & bus_rd_reg_val->rst_done) {
+		complete(&bus_rd->reset_complete);
+		CAM_DBG(CAM_OPE, "ope bus rd reset done");
+	}
+
+	if ((irq_status & bus_rd_reg_val->violation) ==
+		bus_rd_reg_val->violation) {
+		irq_data->error = 1;
+		CAM_ERR(CAM_OPE, "ope bus rd CCIF vioalation");
+	}
+
+	return rc;
+}
+
+int cam_ope_bus_rd_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data)
+{
+	int rc = -EINVAL;
+
+	switch (cmd_id) {
+	case OPE_HW_PROBE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: E");
+		rc = cam_ope_bus_rd_probe(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: X");
+		break;
+	case OPE_HW_INIT:
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: E");
+		rc = cam_ope_bus_rd_init(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: X");
+		break;
+	case OPE_HW_ACQUIRE:
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: E");
+		rc = cam_ope_bus_rd_acquire(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: X");
+		break;
+	case OPE_HW_RELEASE:
+		CAM_DBG(CAM_OPE, "OPE_HW_RELEASE: E");
+		rc = cam_ope_bus_rd_release(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_RELEASE: X");
+		break;
+	case OPE_HW_PREPARE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PREPARE: E");
+		rc = cam_ope_bus_rd_prepare(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PREPARE: X");
+		break;
+	case OPE_HW_ISR:
+		rc = cam_ope_bus_rd_isr(ope_hw_info, 0, data);
+		break;
+	case OPE_HW_DEINIT:
+	case OPE_HW_START:
+	case OPE_HW_STOP:
+	case OPE_HW_FLUSH:
+	case OPE_HW_CLK_UPDATE:
+	case OPE_HW_BW_UPDATE:
+	case OPE_HW_RESET:
+	case OPE_HW_SET_IRQ_CB:
+		rc = 0;
+		CAM_DBG(CAM_OPE, "Unhandled cmds: %d", cmd_id);
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Unsupported cmd: %d", cmd_id);
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.h
@@ -0,0 +1,138 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef OPE_BUS_RD_H
+#define OPE_BUS_RD_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "ope_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_soc_util.h"
+#include "cam_context.h"
+#include "cam_ope_context.h"
+#include "cam_ope_hw_mgr.h"
+
+/**
+ * struct ope_bus_rd_cdm_info
+ *
+ * @offset: Offset
+ * @addr:   Address
+ * @len:    Length
+ */
+struct ope_bus_rd_cdm_info {
+	uint32_t offset;
+	uint32_t *addr;
+	uint32_t len;
+};
+
+/**
+ * struct ope_bus_rd_io_port_cdm_info
+ *
+ * @num_frames_cmds: Number of frame commands
+ * @f_cdm_info:      Frame cdm info
+ * @num_stripes:     Number of stripes
+ * @num_s_cmd_bufs:  Number of stripe commands
+ * @s_cdm_info:      Stripe cdm info
+ * @go_cmd_addr:     GO command address
+ * @go_cmd_len:      GO command length
+ */
+struct ope_bus_rd_io_port_cdm_info {
+	uint32_t num_frames_cmds;
+	struct ope_bus_rd_cdm_info f_cdm_info[MAX_RD_CLIENTS];
+	uint32_t num_stripes;
+	uint32_t num_s_cmd_bufs[OPE_MAX_STRIPES];
+	struct ope_bus_rd_cdm_info s_cdm_info[OPE_MAX_STRIPES][MAX_RD_CLIENTS];
+	uint32_t go_cmd_offset;
+	uint32_t *go_cmd_addr;
+	uint32_t go_cmd_len;
+};
+
+/**
+ * struct ope_bus_rd_io_port_cdm_batch
+ *
+ * num_batch:   Number of batches
+ * io_port_cdm: CDM IO Port Info
+ */
+struct ope_bus_rd_io_port_cdm_batch {
+	uint32_t num_batch;
+	struct ope_bus_rd_io_port_cdm_info io_port_cdm[OPE_MAX_BATCH_SIZE];
+};
+
+/**
+ * struct ope_bus_rd_rm
+ *
+ * @rm_port_id:  RM port ID
+ * @format_type: Format type
+ */
+struct ope_bus_rd_rm {
+	uint32_t rm_port_id;
+	uint32_t format_type;
+};
+
+/**
+ * struct ope_bus_in_port_to_rm
+ *
+ * @input_port_id:  Intput port ID
+ * @num_combos:     Number of combos
+ * @num_rm:         Number of RMs
+ * @rm_port_id:     RM port Id
+ */
+struct ope_bus_in_port_to_rm {
+	uint32_t input_port_id;
+	uint32_t num_combos;
+	uint32_t num_rm[BUS_RD_COMBO_MAX];
+	uint32_t rm_port_id[BUS_RD_COMBO_MAX][MAX_RD_CLIENTS];
+};
+
+/**
+ * struct ope_bus_rd_io_port_info
+ *
+ * @pixel_pattern:      Pixel pattern
+ * @input_port_id:      Port Id
+ * @input_format_type:  Format type
+ * @latency_buf_size:   Latency buffer size
+ */
+struct ope_bus_rd_io_port_info {
+	uint32_t pixel_pattern[OPE_IN_RES_MAX];
+	uint32_t input_port_id[OPE_IN_RES_MAX];
+	uint32_t input_format_type[OPE_IN_RES_MAX];
+	uint32_t latency_buf_size;
+};
+
+/**
+ * struct ope_bus_rd_ctx
+ *
+ * @ope_acquire:       OPE acquire structure
+ * @security_flag:     security flag
+ * @num_in_ports:      Number of in ports
+ * @io_port_info:      IO port info
+ * @io_port_cdm_batch: IO port cdm info
+ */
+struct ope_bus_rd_ctx {
+	struct ope_acquire_dev_info *ope_acquire;
+	bool security_flag;
+	uint32_t num_in_ports;
+	struct ope_bus_rd_io_port_info io_port_info;
+	struct ope_bus_rd_io_port_cdm_batch io_port_cdm_batch;
+};
+
+/**
+ * struct ope_bus_rd
+ *
+ * @ope_hw_info:    OPE hardware info
+ * @in_port_to_rm:  IO port to RM mapping
+ * @bus_rd_ctx:     RM context
+ */
+struct ope_bus_rd {
+	struct ope_hw *ope_hw_info;
+	struct ope_bus_in_port_to_rm in_port_to_rm[OPE_IN_RES_MAX];
+	struct ope_bus_rd_ctx *bus_rd_ctx[OPE_CTX_MAX];
+	struct completion reset_complete;
+};
+#endif /* OPE_BUS_RD_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.c
@@ -0,0 +1,809 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include <media/cam_ope.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+#include "ope_bus_wr.h"
+#include "cam_cdm_util.h"
+
+static struct ope_bus_wr *wr_info;
+
+enum cam_ope_bus_packer_format {
+	PACKER_FMT_PLAIN_128                   = 0x0,
+	PACKER_FMT_PLAIN_8                     = 0x1,
+	PACKER_FMT_PLAIN_8_ODD_EVEN            = 0x2,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10          = 0x3,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN = 0x4,
+	PACKER_FMT_PLAIN_16_10BPP              = 0x5,
+	PACKER_FMT_PLAIN_16_12BPP              = 0x6,
+	PACKER_FMT_PLAIN_16_14BPP              = 0x7,
+	PACKER_FMT_PLAIN_16_16BPP              = 0x8,
+	PACKER_FMT_PLAIN_32                    = 0x9,
+	PACKER_FMT_PLAIN_64                    = 0xA,
+	PACKER_FMT_TP_10                       = 0xB,
+	PACKER_FMT_MIPI_10                     = 0xC,
+	PACKER_FMT_MIPI_12                     = 0xD,
+	PACKER_FMT_MAX                         = 0xE,
+};
+
+static int cam_ope_bus_en_port_idx(
+	struct cam_ope_request *ope_request,
+	uint32_t batch_idx,
+	uint32_t output_port_id)
+{
+	int i;
+	struct ope_io_buf *io_buf;
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ope_request->num_io_bufs[batch_idx]; i++) {
+		io_buf = ope_request->io_buf[batch_idx][i];
+		if (io_buf->direction != CAM_BUF_OUTPUT)
+			continue;
+		if (io_buf->resource_type == output_port_id)
+			return i;
+	}
+
+	return -EINVAL;
+}
+static int cam_ope_bus_wr_out_port_idx(uint32_t output_port_id)
+{
+	int i;
+
+	for (i = 0; i < OPE_OUT_RES_MAX; i++)
+		if (wr_info->out_port_to_wm[i].output_port_id == output_port_id)
+			return i;
+
+	return -EINVAL;
+}
+
+
+static int cam_ope_bus_wr_subsample(
+	struct cam_ope_ctx *ctx_data,
+	struct ope_hw *ope_hw_info,
+	struct cam_ope_bus_wr_client_reg *wr_reg_client,
+	struct ope_io_buf *io_buf,
+	uint32_t *temp_reg, uint32_t count,
+	int plane_idx, int stripe_idx)
+{
+	int k, l;
+	struct cam_ope_bus_wr_reg *wr_reg;
+	struct cam_ope_bus_wr_reg_val *wr_reg_val;
+
+	wr_reg = ope_hw_info->bus_wr_reg;
+	wr_reg_val = ope_hw_info->bus_wr_reg_val;
+
+	if (plane_idx >= OPE_MAX_PLANES) {
+		CAM_ERR(CAM_OPE, "Invalid plane idx: %d", plane_idx);
+		return count;
+	}
+	k = plane_idx;
+	l = stripe_idx;
+
+	/* subsample period and pattern */
+	if ((ctx_data->ope_acquire.dev_type ==
+		OPE_DEV_TYPE_OPE_RT) && l == 0) {
+		temp_reg[count++] = wr_reg->offset +
+			wr_reg_client->subsample_period;
+		temp_reg[count++] = io_buf->num_stripes[k];
+
+		temp_reg[count++] = wr_reg->offset +
+			wr_reg_client->subsample_pattern;
+		temp_reg[count++] = 1 <<
+			(io_buf->num_stripes[k] - 1);
+	} else if ((ctx_data->ope_acquire.dev_type ==
+		OPE_DEV_TYPE_OPE_NRT) &&
+		((l %
+		ctx_data->ope_acquire.nrt_stripes_for_arb) ==
+		0)) {
+		if (io_buf->num_stripes[k] >=
+			(l +
+			ctx_data->ope_acquire.nrt_stripes_for_arb)){
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->subsample_period;
+			temp_reg[count++] =
+				ctx_data->ope_acquire.nrt_stripes_for_arb;
+
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->subsample_pattern;
+			temp_reg[count++] = 1 <<
+				(ctx_data->ope_acquire.nrt_stripes_for_arb -
+				1);
+		} else {
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->subsample_period;
+			temp_reg[count++] = io_buf->num_stripes[k] - l;
+
+			/* subsample pattern */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->subsample_pattern;
+			temp_reg[count++] = 1 << (io_buf->num_stripes[k] -
+				l - 1);
+		}
+	}
+	return count;
+}
+
+static int cam_ope_bus_wr_release(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (ctx_id < 0 || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	vfree(wr_info->bus_wr_ctx[ctx_id]);
+	wr_info->bus_wr_ctx[ctx_id] = NULL;
+
+	return rc;
+}
+
+static uint32_t *cam_ope_bus_wr_update(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, struct cam_ope_dev_prepare_req *prepare,
+	int batch_idx, int io_idx,
+	uint32_t *kmd_buf, uint32_t *num_stripes)
+{
+	int k, l, m, out_port_idx;
+	uint32_t idx;
+	uint32_t num_wm_ports;
+	uint32_t comb_idx;
+	uint32_t req_idx;
+	uint32_t temp_reg[128];
+	uint32_t count = 0;
+	uint32_t temp = 0;
+	uint32_t wm_port_id;
+	uint32_t header_size;
+	uint32_t *next_buff_addr = NULL;
+	struct cam_hw_prepare_update_args *prepare_args;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_request *ope_request;
+	struct ope_io_buf *io_buf;
+	struct ope_stripe_io *stripe_io;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct cam_ope_bus_wr_reg *wr_reg;
+	struct cam_ope_bus_wr_client_reg *wr_reg_client;
+	struct cam_ope_bus_wr_reg_val *wr_reg_val;
+	struct cam_ope_bus_wr_client_reg_val *wr_res_val_client;
+	struct ope_bus_out_port_to_wm *out_port_to_wm;
+	struct ope_bus_wr_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_wr_io_port_cdm_info *io_port_cdm;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, prepare);
+		return NULL;
+	}
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return NULL;
+	}
+
+	if (io_idx >= OPE_MAX_IO_BUFS) {
+		CAM_ERR(CAM_OPE, "Invalid IO idx: %d", io_idx);
+		return NULL;
+	}
+
+	prepare_args = prepare->prepare_args;
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	ope_request = ctx_data->req_list[req_idx];
+	bus_wr_ctx = wr_info->bus_wr_ctx[ctx_id];
+	io_port_cdm_batch = &bus_wr_ctx->io_port_cdm_batch;
+	wr_reg = ope_hw_info->bus_wr_reg;
+	wr_reg_val = ope_hw_info->bus_wr_reg_val;
+
+	CAM_DBG(CAM_OPE, "kmd_buf = %x req_idx = %d req_id = %lld offset = %d",
+		kmd_buf, req_idx, ope_request->request_id,
+		prepare->kmd_buf_offset);
+
+	io_buf = ope_request->io_buf[batch_idx][io_idx];
+	CAM_DBG(CAM_OPE, "batch = %d io buf num = %d dir = %d rsc %d",
+		batch_idx, io_idx, io_buf->direction, io_buf->resource_type);
+
+	io_port_cdm =
+		&bus_wr_ctx->io_port_cdm_batch.io_port_cdm[batch_idx];
+	out_port_idx =
+		cam_ope_bus_wr_out_port_idx(io_buf->resource_type);
+	if (out_port_idx < 0) {
+		CAM_ERR(CAM_OPE, "Invalid idx for rsc type: %d",
+			io_buf->resource_type);
+		return NULL;
+	}
+	out_port_to_wm = &wr_info->out_port_to_wm[out_port_idx];
+	comb_idx = BUS_WR_YUV;
+	num_wm_ports = out_port_to_wm->num_wm[comb_idx];
+
+	for (k = 0; k < io_buf->num_planes; k++) {
+		*num_stripes = io_buf->num_stripes[k];
+		for (l = 0; l < io_buf->num_stripes[k]; l++) {
+			stripe_io = &io_buf->s_io[k][l];
+			CAM_DBG(CAM_OPE, "comb_idx = %d p_idx = %d s_idx = %d",
+				comb_idx, k, l);
+			/* frame level info */
+			/* stripe level info */
+			wm_port_id = out_port_to_wm->wm_port_id[comb_idx][k];
+			wr_reg_client = &wr_reg->wr_clients[wm_port_id];
+			wr_res_val_client = &wr_reg_val->wr_clients[wm_port_id];
+
+			/* Core cfg: enable, Mode */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->core_cfg;
+			temp = 0;
+			if (!stripe_io->disable_bus)
+				temp = wr_res_val_client->core_cfg_en;
+			temp |= ((wr_res_val_client->mode &
+				wr_res_val_client->mode_mask) <<
+				wr_res_val_client->mode_shift);
+			temp_reg[count++] = temp;
+
+			/* Address of the Image */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->img_addr;
+			temp_reg[count++] = stripe_io->iova_addr;
+
+			/* Buffer size */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->img_cfg;
+			temp = 0;
+			temp = stripe_io->width;
+			temp |= (stripe_io->height &
+				wr_res_val_client->height_mask) <<
+				wr_res_val_client->height_shift;
+			temp_reg[count++] = temp;
+
+			/* x_init */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->x_init;
+			temp_reg[count++] = stripe_io->x_init;
+
+			/* stride */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->stride;
+			temp_reg[count++] = stripe_io->stride;
+
+			/* pack cfg : Format and alignment */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->pack_cfg;
+			temp = 0;
+
+			/*
+			 * In case of NV12, change the packer format of chroma
+			 * plane to odd even byte swapped format
+			 */
+
+			if (k == 1 && stripe_io->format == CAM_FORMAT_NV12)
+				stripe_io->pack_format =
+					PACKER_FMT_PLAIN_8_ODD_EVEN;
+
+			temp |= ((stripe_io->pack_format &
+				wr_res_val_client->format_mask) <<
+				wr_res_val_client->format_shift);
+			temp |= ((stripe_io->alignment &
+				wr_res_val_client->alignment_mask) <<
+				wr_res_val_client->alignment_shift);
+			temp_reg[count++] = temp;
+
+			/* subsample period and pattern */
+			count = cam_ope_bus_wr_subsample(
+					ctx_data, ope_hw_info,
+					wr_reg_client, io_buf,
+					temp_reg, count, k, l);
+
+			header_size = cdm_ops->cdm_get_cmd_header_size(
+				CAM_CDM_CMD_REG_RANDOM);
+			idx = io_port_cdm->num_s_cmd_bufs[l];
+			io_port_cdm->s_cdm_info[l][idx].len =
+				sizeof(temp) * (count + header_size);
+			io_port_cdm->s_cdm_info[l][idx].offset =
+				prepare->kmd_buf_offset;
+			io_port_cdm->s_cdm_info[l][idx].addr = kmd_buf;
+			io_port_cdm->num_s_cmd_bufs[l]++;
+
+			next_buff_addr = cdm_ops->cdm_write_regrandom(
+				kmd_buf, count/2, temp_reg);
+			if (next_buff_addr > kmd_buf)
+				prepare->kmd_buf_offset +=
+					((count + header_size) * sizeof(temp));
+			kmd_buf = next_buff_addr;
+
+			CAM_DBG(CAM_OPE, "b:%d io:%d p:%d s:%d",
+				batch_idx, io_idx, k, l);
+			for (m = 0; m < count; m += 2)
+				CAM_DBG(CAM_OPE, "%d: off: 0x%x val: 0x%x",
+					m, temp_reg[m], temp_reg[m+1]);
+			CAM_DBG(CAM_OPE, "kmdbuf:%x, offset:%d",
+				kmd_buf, prepare->kmd_buf_offset);
+			CAM_DBG(CAM_OPE, "WR cmd bufs = %d off:%d len:%d",
+				io_port_cdm->num_s_cmd_bufs[l],
+				io_port_cdm->s_cdm_info[l][idx].offset,
+				io_port_cdm->s_cdm_info[l][idx].len);
+			count = 0;
+		}
+	}
+
+	return kmd_buf;
+}
+
+static uint32_t *cam_ope_bus_wm_disable(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, struct cam_ope_dev_prepare_req *prepare,
+	int batch_idx, int io_idx,
+	uint32_t *kmd_buf, uint32_t num_stripes)
+{
+	int k, l;
+	uint32_t idx;
+	uint32_t num_wm_ports;
+	uint32_t comb_idx;
+	uint32_t req_idx;
+	uint32_t temp_reg[128];
+	uint32_t count = 0;
+	uint32_t temp = 0;
+	uint32_t wm_port_id;
+	uint32_t header_size;
+	uint32_t *next_buff_addr = NULL;
+	struct cam_ope_ctx *ctx_data;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct cam_ope_bus_wr_reg *wr_reg;
+	struct cam_ope_bus_wr_client_reg *wr_reg_client;
+	struct ope_bus_out_port_to_wm *out_port_to_wm;
+	struct ope_bus_wr_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_wr_io_port_cdm_info *io_port_cdm;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, prepare);
+		return NULL;
+	}
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return NULL;
+	}
+
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	bus_wr_ctx = wr_info->bus_wr_ctx[ctx_id];
+	io_port_cdm_batch = &bus_wr_ctx->io_port_cdm_batch;
+	wr_reg = ope_hw_info->bus_wr_reg;
+
+	CAM_DBG(CAM_OPE,
+		"kmd_buf = %x req_idx = %d offset = %d out_idx %d b %d",
+		kmd_buf, req_idx, prepare->kmd_buf_offset, io_idx, batch_idx);
+
+	io_port_cdm =
+		&bus_wr_ctx->io_port_cdm_batch.io_port_cdm[batch_idx];
+	out_port_to_wm = &wr_info->out_port_to_wm[io_idx];
+	comb_idx = BUS_WR_YUV;
+	num_wm_ports = out_port_to_wm->num_wm[comb_idx];
+
+	for (k = 0; k < num_wm_ports; k++) {
+		for (l = 0; l < num_stripes; l++) {
+			/* frame level info */
+			/* stripe level info */
+			wm_port_id = out_port_to_wm->wm_port_id[comb_idx][k];
+			wr_reg_client = &wr_reg->wr_clients[wm_port_id];
+
+			/* Core cfg: enable, Mode */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->core_cfg;
+			temp_reg[count++] = 0;
+
+			header_size = cdm_ops->cdm_get_cmd_header_size(
+				CAM_CDM_CMD_REG_RANDOM);
+			idx = io_port_cdm->num_s_cmd_bufs[l];
+			io_port_cdm->s_cdm_info[l][idx].len =
+				sizeof(temp) * (count + header_size);
+			io_port_cdm->s_cdm_info[l][idx].offset =
+				prepare->kmd_buf_offset;
+			io_port_cdm->s_cdm_info[l][idx].addr = kmd_buf;
+			io_port_cdm->num_s_cmd_bufs[l]++;
+
+			next_buff_addr = cdm_ops->cdm_write_regrandom(
+				kmd_buf, count/2, temp_reg);
+
+			if (next_buff_addr > kmd_buf)
+				prepare->kmd_buf_offset +=
+					((count + header_size) * sizeof(temp));
+			kmd_buf = next_buff_addr;
+
+			CAM_DBG(CAM_OPE, "WR cmd bufs = %d",
+				io_port_cdm->num_s_cmd_bufs[l]);
+			CAM_DBG(CAM_OPE, "s:%d off:%d len:%d",
+				l, io_port_cdm->s_cdm_info[l][idx].offset,
+				io_port_cdm->s_cdm_info[l][idx].len);
+			count = 0;
+		}
+	}
+
+	prepare->wr_cdm_batch = &bus_wr_ctx->io_port_cdm_batch;
+
+	return kmd_buf;
+}
+
+static int cam_ope_bus_wr_prepare(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	int i, j = 0;
+	uint32_t req_idx;
+	uint32_t *kmd_buf;
+	struct cam_ope_dev_prepare_req *prepare;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_request *ope_request;
+	struct ope_io_buf *io_buf;
+	uint32_t temp;
+	int io_buf_idx;
+	uint32_t num_stripes = 0;
+	struct ope_bus_wr_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+
+	if (ctx_id < 0 || !data) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+	prepare = data;
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	bus_wr_ctx = wr_info->bus_wr_ctx[ctx_id];
+
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		(prepare->kmd_buf_offset / sizeof(temp));
+
+
+	CAM_DBG(CAM_OPE, "kmd_buf = %x req_idx = %d req_id = %lld offset = %d",
+		kmd_buf, req_idx, ope_request->request_id,
+		prepare->kmd_buf_offset);
+
+	io_port_cdm_batch = &wr_info->bus_wr_ctx[ctx_id]->io_port_cdm_batch;
+	memset(io_port_cdm_batch, 0,
+		sizeof(struct ope_bus_wr_io_port_cdm_batch));
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = 0; j < ope_request->num_io_bufs[i]; j++) {
+			io_buf = ope_request->io_buf[i][j];
+			CAM_DBG(CAM_OPE, "batch = %d io buf num = %d dir = %d",
+				i, j, io_buf->direction);
+			if (io_buf->direction != CAM_BUF_OUTPUT)
+				continue;
+
+			kmd_buf = cam_ope_bus_wr_update(ope_hw_info,
+				ctx_id, prepare, i, j,
+				kmd_buf, &num_stripes);
+			if (!kmd_buf) {
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+	}
+
+	/* Disable WMs which are not enabled */
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = OPE_OUT_RES_VIDEO; j <= OPE_OUT_RES_MAX; j++) {
+			io_buf_idx = cam_ope_bus_en_port_idx(ope_request, i, j);
+			if (io_buf_idx >= 0)
+				continue;
+
+			io_buf_idx = cam_ope_bus_wr_out_port_idx(j);
+			if (io_buf_idx < 0) {
+				CAM_ERR(CAM_OPE, "Invalid idx for rsc type:%d",
+					j);
+				return io_buf_idx;
+			}
+			kmd_buf = cam_ope_bus_wm_disable(ope_hw_info,
+				ctx_id, prepare, i, io_buf_idx,
+				kmd_buf, num_stripes);
+		}
+	}
+	prepare->wr_cdm_batch = &bus_wr_ctx->io_port_cdm_batch;
+
+end:
+	return rc;
+}
+
+static int cam_ope_bus_wr_acquire(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i;
+	struct ope_acquire_dev_info *in_acquire;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct ope_bus_out_port_to_wm *out_port_to_wr;
+	int combo_idx;
+	int out_port_idx;
+
+	if (ctx_id < 0 || !data || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+
+	wr_info->bus_wr_ctx[ctx_id] = vzalloc(sizeof(struct ope_bus_wr_ctx));
+	if (!wr_info->bus_wr_ctx[ctx_id]) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		return -ENOMEM;
+	}
+
+	wr_info->bus_wr_ctx[ctx_id]->ope_acquire = data;
+	in_acquire = data;
+	bus_wr_ctx = wr_info->bus_wr_ctx[ctx_id];
+	bus_wr_ctx->num_out_ports = in_acquire->num_out_res;
+	bus_wr_ctx->security_flag = in_acquire->secure_mode;
+
+	for (i = 0; i < in_acquire->num_out_res; i++) {
+		if (!in_acquire->out_res[i].width)
+			continue;
+
+		CAM_DBG(CAM_OPE, "i = %d format = %u width = %x height = %x",
+			i, in_acquire->out_res[i].format,
+			in_acquire->out_res[i].width,
+			in_acquire->out_res[i].height);
+		CAM_DBG(CAM_OPE, "pix_pattern:%u alignment:%u packer_format:%u",
+			in_acquire->out_res[i].pixel_pattern,
+			in_acquire->out_res[i].alignment,
+			in_acquire->out_res[i].packer_format);
+		CAM_DBG(CAM_OPE, "subsample_period = %u subsample_pattern = %u",
+			in_acquire->out_res[i].subsample_period,
+			in_acquire->out_res[i].subsample_pattern);
+
+		out_port_idx =
+		cam_ope_bus_wr_out_port_idx(in_acquire->out_res[i].res_id);
+		if (out_port_idx < 0) {
+			CAM_DBG(CAM_OPE, "Invalid in_port_idx: %d",
+				in_acquire->out_res[i].res_id);
+			rc = -EINVAL;
+			goto end;
+		}
+		out_port_to_wr = &wr_info->out_port_to_wm[out_port_idx];
+		combo_idx = BUS_WR_YUV;
+		if (!out_port_to_wr->num_wm[combo_idx]) {
+			CAM_DBG(CAM_OPE, "Invalid format for Input port");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		bus_wr_ctx->io_port_info.output_port_id[i] =
+			in_acquire->out_res[i].res_id;
+		bus_wr_ctx->io_port_info.output_format_type[i] =
+			in_acquire->out_res[i].format;
+		if (in_acquire->out_res[i].pixel_pattern >
+			PIXEL_PATTERN_CRYCBY) {
+			CAM_DBG(CAM_OPE, "Invalid pix pattern = %u",
+				in_acquire->out_res[i].pixel_pattern);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		bus_wr_ctx->io_port_info.pixel_pattern[i] =
+			in_acquire->out_res[i].pixel_pattern;
+		bus_wr_ctx->io_port_info.latency_buf_size = 4096;
+		CAM_DBG(CAM_OPE, "i:%d port_id = %u format %u pix_pattern = %u",
+			i, bus_wr_ctx->io_port_info.output_port_id[i],
+			bus_wr_ctx->io_port_info.output_format_type[i],
+			bus_wr_ctx->io_port_info.pixel_pattern[i]);
+		CAM_DBG(CAM_OPE, "latency_buf_size = %u",
+			bus_wr_ctx->io_port_info.latency_buf_size);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ope_bus_wr_init(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_ope_bus_wr_reg_val *bus_wr_reg_val;
+	struct cam_ope_bus_wr_reg *bus_wr_reg;
+	struct cam_ope_dev_init *dev_init = data;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	wr_info->ope_hw_info = ope_hw_info;
+	bus_wr_reg_val = ope_hw_info->bus_wr_reg_val;
+	bus_wr_reg = ope_hw_info->bus_wr_reg;
+	bus_wr_reg->base = dev_init->core_info->ope_hw_info->ope_bus_wr_base;
+
+	cam_io_w_mb(bus_wr_reg_val->irq_mask_0,
+		ope_hw_info->bus_wr_reg->base + bus_wr_reg->irq_mask_0);
+	cam_io_w_mb(bus_wr_reg_val->irq_mask_1,
+		ope_hw_info->bus_wr_reg->base + bus_wr_reg->irq_mask_1);
+
+	return rc;
+}
+
+static int cam_ope_bus_wr_probe(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i, j, combo_idx, k;
+	struct cam_ope_bus_wr_reg_val *bus_wr_reg_val;
+	struct ope_bus_out_port_to_wm *out_port_to_wm;
+	uint32_t output_port_idx;
+	uint32_t wm_idx;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+	wr_info = kzalloc(sizeof(struct ope_bus_wr), GFP_KERNEL);
+	if (!wr_info) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		return -ENOMEM;
+	}
+
+	wr_info->ope_hw_info = ope_hw_info;
+	bus_wr_reg_val = ope_hw_info->bus_wr_reg_val;
+
+	for (i = 0; i < bus_wr_reg_val->num_clients; i++) {
+		output_port_idx =
+			bus_wr_reg_val->wr_clients[i].output_port_id - 1;
+		out_port_to_wm = &wr_info->out_port_to_wm[output_port_idx];
+		combo_idx = BUS_WR_YUV;
+		wm_idx = out_port_to_wm->num_wm[combo_idx];
+		out_port_to_wm->output_port_id =
+			bus_wr_reg_val->wr_clients[i].output_port_id;
+		out_port_to_wm->wm_port_id[combo_idx][wm_idx] =
+			bus_wr_reg_val->wr_clients[i].wm_port_id;
+		if (!out_port_to_wm->num_wm[combo_idx])
+			out_port_to_wm->num_combos++;
+		out_port_to_wm->num_wm[combo_idx]++;
+	}
+
+	for (i = 0; i < OPE_OUT_RES_MAX; i++) {
+		out_port_to_wm = &wr_info->out_port_to_wm[i];
+		CAM_DBG(CAM_OPE, "output port id = %d num_combos = %d",
+			out_port_to_wm->output_port_id,
+			out_port_to_wm->num_combos);
+		for (j = 0; j < out_port_to_wm->num_combos; j++) {
+			CAM_DBG(CAM_OPE, "combo idx = %d num_wms = %d",
+				j, out_port_to_wm->num_wm[j]);
+			for (k = 0; k < out_port_to_wm->num_wm[j]; k++) {
+				CAM_DBG(CAM_OPE, "wm port id = %d",
+					out_port_to_wm->wm_port_id[j][k]);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ope_bus_wr_isr(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	uint32_t irq_status_0, irq_status_1, violation_status;
+	struct cam_ope_bus_wr_reg *bus_wr_reg;
+	struct cam_ope_bus_wr_reg_val *bus_wr_reg_val;
+	struct cam_ope_irq_data *irq_data = data;
+
+	if (!ope_hw_info || !irq_data) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	bus_wr_reg = ope_hw_info->bus_wr_reg;
+	bus_wr_reg_val = ope_hw_info->bus_wr_reg_val;
+
+	/* Read and Clear Top Interrupt status */
+	irq_status_0 = cam_io_r_mb(bus_wr_reg->base + bus_wr_reg->irq_status_0);
+	irq_status_1 = cam_io_r_mb(bus_wr_reg->base + bus_wr_reg->irq_status_1);
+	cam_io_w_mb(irq_status_0,
+		bus_wr_reg->base + bus_wr_reg->irq_clear_0);
+	cam_io_w_mb(irq_status_1,
+		bus_wr_reg->base + bus_wr_reg->irq_clear_1);
+
+	cam_io_w_mb(bus_wr_reg_val->irq_set_clear,
+		bus_wr_reg->base + bus_wr_reg->irq_cmd);
+
+	if (irq_status_0 & bus_wr_reg_val->cons_violation) {
+		irq_data->error = 1;
+		CAM_ERR(CAM_OPE, "ope bus wr cons_violation");
+	}
+
+	if (irq_status_0 & bus_wr_reg_val->violation) {
+		irq_data->error = 1;
+		violation_status = cam_io_r_mb(bus_wr_reg->base +
+			bus_wr_reg->violation_status);
+		CAM_ERR(CAM_OPE,
+			"ope bus wr violation, violation_status 0x%x",
+			violation_status);
+	}
+
+	if (irq_status_0 & bus_wr_reg_val->img_size_violation) {
+		irq_data->error = 1;
+		violation_status = cam_io_r_mb(bus_wr_reg->base +
+			bus_wr_reg->image_size_violation_status);
+		CAM_ERR(CAM_OPE,
+			"ope bus wr img_size_violation, violation_status 0x%x",
+			violation_status);
+	}
+
+	return rc;
+}
+
+int cam_ope_bus_wr_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data)
+{
+	int rc = 0;
+
+	switch (cmd_id) {
+	case OPE_HW_PROBE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: E");
+		rc = cam_ope_bus_wr_probe(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: X");
+		break;
+	case OPE_HW_INIT:
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: E");
+		rc = cam_ope_bus_wr_init(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: X");
+		break;
+	case OPE_HW_ACQUIRE:
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: E");
+		rc = cam_ope_bus_wr_acquire(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: X");
+		break;
+	case OPE_HW_RELEASE:
+		CAM_DBG(CAM_OPE, "OPE_HW_RELEASE: E");
+		rc = cam_ope_bus_wr_release(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_RELEASE: X");
+		break;
+	case OPE_HW_PREPARE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PREPARE: E");
+		rc = cam_ope_bus_wr_prepare(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PREPARE: X");
+		break;
+	case OPE_HW_DEINIT:
+	case OPE_HW_START:
+	case OPE_HW_STOP:
+	case OPE_HW_FLUSH:
+	case OPE_HW_CLK_UPDATE:
+	case OPE_HW_BW_UPDATE:
+	case OPE_HW_RESET:
+	case OPE_HW_SET_IRQ_CB:
+		rc = 0;
+		CAM_DBG(CAM_OPE, "Unhandled cmds: %d", cmd_id);
+		break;
+	case OPE_HW_ISR:
+		rc = cam_ope_bus_wr_isr(ope_hw_info, 0, data);
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Unsupported cmd: %d", cmd_id);
+		break;
+	}
+
+	return rc;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.h
@@ -0,0 +1,137 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef OPE_BUS_WR_H
+#define OPE_BUS_WR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "ope_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_soc_util.h"
+#include "cam_context.h"
+#include "cam_ope_context.h"
+#include "cam_ope_hw_mgr.h"
+
+/**
+ * struct ope_bus_wr_cdm_info
+ *
+ * @offset: Offset
+ * @addr:   Address
+ * @len:    Length
+ */
+struct ope_bus_wr_cdm_info {
+	uint32_t offset;
+	uint32_t *addr;
+	uint32_t len;
+};
+
+/**
+ * struct ope_bus_wr_io_port_cdm_info
+ *
+ * @num_frames_cmds: Number of frame commands
+ * @f_cdm_info:      Frame cdm info
+ * @num_stripes:     Number of stripes
+ * @num_s_cmd_bufs:  Number of stripe commands
+ * @s_cdm_info:      Stripe cdm info
+ * @go_cmd_addr:     GO command address
+ * @go_cmd_len:      GO command length
+ */
+struct ope_bus_wr_io_port_cdm_info {
+	uint32_t num_frames_cmds;
+	struct ope_bus_wr_cdm_info f_cdm_info[MAX_WR_CLIENTS];
+	uint32_t num_stripes;
+	uint32_t num_s_cmd_bufs[OPE_MAX_STRIPES];
+	struct ope_bus_wr_cdm_info s_cdm_info[OPE_MAX_STRIPES][MAX_WR_CLIENTS];
+	uint32_t *go_cmd_addr;
+	uint32_t go_cmd_len;
+};
+
+/**
+ * struct ope_bus_wr_io_port_cdm_batch
+ *
+ * num_batch:   Number of batches
+ * io_port_cdm: CDM IO Port Info
+ */
+struct ope_bus_wr_io_port_cdm_batch {
+	uint32_t num_batch;
+	struct ope_bus_wr_io_port_cdm_info io_port_cdm[OPE_MAX_BATCH_SIZE];
+};
+
+/**
+ * struct ope_bus_wr_wm
+ *
+ * @wm_port_id:  WM port ID
+ * @format_type: Format type
+ */
+struct ope_bus_wr_wm {
+	uint32_t wm_port_id;
+	uint32_t format_type;
+};
+
+/**
+ * struct ope_bus_out_port_to_wm
+ *
+ * @output_port_id: Output port ID
+ * @num_combos:     Number of combos
+ * @num_wm:         Number of WMs
+ * @wm_port_id:     WM port Id
+ */
+struct ope_bus_out_port_to_wm {
+	uint32_t output_port_id;
+	uint32_t num_combos;
+	uint32_t num_wm[BUS_WR_COMBO_MAX];
+	uint32_t wm_port_id[BUS_WR_COMBO_MAX][MAX_WR_CLIENTS];
+};
+
+/**
+ * struct ope_bus_wr_io_port_info
+ *
+ * @pixel_pattern:      Pixel pattern
+ * @output_port_id:     Port Id
+ * @output_format_type: Format type
+ * @latency_buf_size:   Latency buffer size
+ */
+struct ope_bus_wr_io_port_info {
+	uint32_t pixel_pattern[OPE_OUT_RES_MAX];
+	uint32_t output_port_id[OPE_OUT_RES_MAX];
+	uint32_t output_format_type[OPE_OUT_RES_MAX];
+	uint32_t latency_buf_size;
+};
+
+/**
+ * struct ope_bus_wr_ctx
+ *
+ * @ope_acquire:       OPE acquire structure
+ * @security_flag:     security flag
+ * @num_out_ports:     Number of out ports
+ * @io_port_info:      IO port info
+ * @io_port_cdm_batch: IO port cdm info
+ */
+struct ope_bus_wr_ctx {
+	struct ope_acquire_dev_info *ope_acquire;
+	bool security_flag;
+	uint32_t num_out_ports;
+	struct ope_bus_wr_io_port_info io_port_info;
+	struct ope_bus_wr_io_port_cdm_batch io_port_cdm_batch;
+};
+
+/**
+ * struct ope_bus_wr
+ *
+ * @ope_hw_info:    OPE hardware info
+ * @out_port_to_wm: IO port to WM mapping
+ * @bus_wr_ctx:     WM context
+ */
+struct ope_bus_wr {
+	struct ope_hw *ope_hw_info;
+	struct ope_bus_out_port_to_wm out_port_to_wm[OPE_OUT_RES_MAX];
+	struct ope_bus_wr_ctx *bus_wr_ctx[OPE_CTX_MAX];
+};
+
+#endif /* OPE_BUS_WR_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.c
@@ -0,0 +1,1814 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include <media/cam_ope.h>
+
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+#include "cam_cdm_util.h"
+#include "ope_bus_rd.h"
+#include "ope_bus_wr.h"
+#include "cam_compat.h"
+
+static int cam_ope_caps_vote(struct cam_ope_device_core_info *core_info,
+	struct cam_ope_dev_bw_update *cpas_vote)
+{
+	int rc = 0;
+
+	if (cpas_vote->ahb_vote_valid)
+		rc = cam_cpas_update_ahb_vote(core_info->cpas_handle,
+			&cpas_vote->ahb_vote);
+	if (cpas_vote->axi_vote_valid)
+		rc = cam_cpas_update_axi_vote(core_info->cpas_handle,
+			&cpas_vote->axi_vote);
+	if (rc)
+		CAM_ERR(CAM_OPE, "cpas vote is failed: %d", rc);
+
+	return rc;
+}
+
+int cam_ope_get_hw_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *ope_dev = hw_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ope_device_core_info *core_info = NULL;
+	struct ope_hw_ver *ope_hw_ver;
+	struct cam_ope_top_reg_val *top_reg_val;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ope_dev->soc_info;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_OPE, "soc_info = %x core_info = %x",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	if (!get_hw_cap_args) {
+		CAM_ERR(CAM_OPE, "Invalid caps");
+		return -EINVAL;
+	}
+
+	top_reg_val = core_info->ope_hw_info->ope_hw->top_reg_val;
+	ope_hw_ver = get_hw_cap_args;
+	ope_hw_ver->hw_type = core_info->hw_type;
+	ope_hw_ver->hw_ver.major =
+		(core_info->hw_version & top_reg_val->major_mask) >>
+		top_reg_val->major_shift;
+	ope_hw_ver->hw_ver.minor =
+		(core_info->hw_version & top_reg_val->minor_mask) >>
+		top_reg_val->minor_shift;
+	ope_hw_ver->hw_ver.incr =
+		(core_info->hw_version & top_reg_val->incr_mask) >>
+		top_reg_val->incr_shift;
+
+	return 0;
+}
+
+int cam_ope_start(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	return 0;
+}
+
+int cam_ope_stop(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ope_dev = hw_priv;
+	struct cam_ope_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_OPE, "core_info = %pK", core_info);
+		return -EINVAL;
+	}
+
+	if (core_info->cpas_start) {
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_OPE, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	}
+
+	return rc;
+}
+
+int cam_ope_flush(void *hw_priv, void *flush_args, uint32_t arg_size)
+{
+	return 0;
+}
+
+static int cam_ope_dev_process_init(struct ope_hw *ope_hw,
+	void *cmd_args)
+{
+	int rc = 0;
+
+	rc = cam_ope_top_process(ope_hw, 0, OPE_HW_INIT, cmd_args);
+	if (rc)
+		goto top_init_fail;
+
+	rc = cam_ope_bus_rd_process(ope_hw, 0, OPE_HW_INIT, cmd_args);
+		if (rc)
+			goto bus_rd_init_fail;
+
+	rc = cam_ope_bus_wr_process(ope_hw, 0, OPE_HW_INIT, cmd_args);
+		if (rc)
+			goto bus_wr_init_fail;
+
+	return rc;
+
+bus_wr_init_fail:
+	rc = cam_ope_bus_rd_process(ope_hw, 0,
+		OPE_HW_DEINIT, NULL);
+bus_rd_init_fail:
+	rc = cam_ope_top_process(ope_hw, 0,
+		OPE_HW_DEINIT, NULL);
+top_init_fail:
+	return rc;
+}
+
+static int cam_ope_process_init(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_init(ope_hw, cmd_args);
+
+	CAM_ERR(CAM_OPE, "hfi_en is not supported");
+	return -EINVAL;
+}
+
+int cam_ope_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ope_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ope_device_core_info *core_info = NULL;
+	struct cam_ope_cpas_vote *cpas_vote;
+	int rc = 0;
+	struct cam_ope_dev_init *init;
+	struct ope_hw *ope_hw;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_info = &ope_dev->soc_info;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_OPE, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		rc = -EINVAL;
+		goto end;
+	}
+	ope_hw = core_info->ope_hw_info->ope_hw;
+
+	cpas_vote = kzalloc(sizeof(struct cam_ope_cpas_vote), GFP_KERNEL);
+	if (!cpas_vote) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	cpas_vote->ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote->ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	cpas_vote->axi_vote.num_paths = 1;
+	cpas_vote->axi_vote.axi_path[0].path_data_type =
+		CAM_AXI_PATH_DATA_ALL;
+	cpas_vote->axi_vote.axi_path[0].transac_type =
+		CAM_AXI_TRANSACTION_WRITE;
+	cpas_vote->axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].ddr_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].ddr_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote->ahb_vote, &cpas_vote->axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "cpass start failed: %d", rc);
+		goto free_cpas_vote;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_ope_enable_soc_resources(soc_info);
+	if (rc)
+		goto enable_soc_resource_failed;
+	else
+		core_info->clk_enable = true;
+
+	init = init_hw_args;
+
+	core_info->ope_hw_info->hfi_en = init->hfi_en;
+	init->core_info = core_info;
+	rc = cam_ope_process_init(ope_hw, init_hw_args, init->hfi_en);
+	if (rc)
+		goto process_init_failed;
+	else
+		goto free_cpas_vote;
+
+process_init_failed:
+	if (cam_ope_disable_soc_resources(soc_info, core_info->clk_enable))
+		CAM_ERR(CAM_OPE, "disable soc resource failed");
+enable_soc_resource_failed:
+	if (cam_cpas_stop(core_info->cpas_handle))
+		CAM_ERR(CAM_OPE, "cpas stop is failed");
+	else
+		core_info->cpas_start = false;
+free_cpas_vote:
+	cam_free_clear((void *)cpas_vote);
+	cpas_vote = NULL;
+end:
+	return rc;
+}
+
+int cam_ope_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ope_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ope_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ope_dev->soc_info;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_OPE, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	rc = cam_ope_disable_soc_resources(soc_info, core_info->clk_enable);
+	if (rc)
+		CAM_ERR(CAM_OPE, "soc disable is failed : %d", rc);
+	core_info->clk_enable = false;
+
+	return rc;
+}
+
+static int cam_ope_dev_process_dump_debug_reg(struct ope_hw *ope_hw)
+{
+	int rc = 0;
+
+	rc = cam_ope_top_process(ope_hw, -1,
+		OPE_HW_DUMP_DEBUG, NULL);
+
+	return rc;
+}
+
+static int cam_ope_dev_process_reset(struct ope_hw *ope_hw, void *cmd_args)
+{
+	int rc = 0;
+
+	rc = cam_ope_top_process(ope_hw, -1,
+		OPE_HW_RESET, NULL);
+
+	return rc;
+}
+
+static int cam_ope_dev_process_release(struct ope_hw *ope_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_ope_dev_release *ope_dev_release;
+
+	ope_dev_release = cmd_args;
+	rc = cam_ope_top_process(ope_hw, ope_dev_release->ctx_id,
+		OPE_HW_RELEASE, NULL);
+
+	rc |= cam_ope_bus_rd_process(ope_hw, ope_dev_release->ctx_id,
+		OPE_HW_RELEASE, NULL);
+
+	rc |= cam_ope_bus_wr_process(ope_hw, ope_dev_release->ctx_id,
+		OPE_HW_RELEASE, NULL);
+
+	return rc;
+}
+
+static int cam_ope_dev_process_acquire(struct ope_hw *ope_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_ope_dev_acquire *ope_dev_acquire;
+
+	if (!cmd_args || !ope_hw) {
+		CAM_ERR(CAM_OPE, "Invalid arguments: %pK %pK",
+		cmd_args, ope_hw);
+		return -EINVAL;
+	}
+
+	ope_dev_acquire = cmd_args;
+	rc = cam_ope_top_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_ACQUIRE, ope_dev_acquire->ope_acquire);
+	if (rc)
+		goto top_acquire_fail;
+
+	rc = cam_ope_bus_rd_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_ACQUIRE, ope_dev_acquire->ope_acquire);
+	if (rc)
+		goto bus_rd_acquire_fail;
+
+	rc = cam_ope_bus_wr_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_ACQUIRE, ope_dev_acquire->ope_acquire);
+	if (rc)
+		goto bus_wr_acquire_fail;
+
+	return 0;
+
+bus_wr_acquire_fail:
+	cam_ope_bus_rd_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_RELEASE, ope_dev_acquire->ope_acquire);
+bus_rd_acquire_fail:
+	cam_ope_top_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_RELEASE, ope_dev_acquire->ope_acquire);
+top_acquire_fail:
+	return rc;
+}
+
+static int cam_ope_dev_prepare_cdm_request(
+	struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t kmd_buf_offset,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req,
+	uint32_t len, bool arbitrate)
+{
+	int i;
+	struct cam_ope_request *ope_request;
+	struct cam_cdm_bl_request *cdm_cmd;
+	uint32_t *kmd_buf;
+
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_cmd = ope_request->cdm_cmd;
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		kmd_buf_offset;
+
+	cdm_cmd->type = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+	cdm_cmd->flag = true;
+	cdm_cmd->userdata = ctx_data;
+	cdm_cmd->cookie = req_idx;
+	cdm_cmd->gen_irq_arb = true;
+
+	i = cdm_cmd->cmd_arrary_count;
+	cdm_cmd->cmd_flex[i].bl_addr.mem_handle = ope_request->ope_kmd_buf.mem_handle;
+	cdm_cmd->cmd_flex[i].offset = kmd_buf_offset + ope_request->ope_kmd_buf.offset;
+	cdm_cmd->cmd_flex[i].len = len;
+	cdm_cmd->cmd_flex[i].arbitrate = arbitrate;
+	cdm_cmd->cmd_flex[i].enable_debug_gen_irq = false;
+
+	cdm_cmd->cmd_arrary_count++;
+
+	CAM_DBG(CAM_OPE, "CDM cmd:Req idx = %d req_id = %lld array cnt = %d",
+		cdm_cmd->cookie, ope_request->request_id,
+		cdm_cmd->cmd_arrary_count);
+	CAM_DBG(CAM_OPE, "CDM cmd:mem_hdl = %d offset = %d len = %d, iova 0x%x",
+		ope_request->ope_kmd_buf.mem_handle, kmd_buf_offset, len,
+		cdm_cmd->cmd_flex[i].bl_addr.hw_iova);
+
+	return 0;
+}
+
+
+static int dump_dmi_cmd(uint32_t print_idx,
+	uint32_t *print_ptr, struct cdm_dmi_cmd *dmi_cmd,
+	uint32_t *temp)
+{
+	CAM_DBG(CAM_OPE, "%d:dma_ptr:%x l:%d",
+		print_idx, print_ptr,
+		dmi_cmd->length);
+	CAM_DBG(CAM_OPE, "%d:cmd:%hhx addr:%x",
+		print_ptr, dmi_cmd->cmd,
+		dmi_cmd->addr);
+	CAM_DBG(CAM_OPE, "%d: dmiadr:%x sel:%d",
+		print_idx, dmi_cmd->DMIAddr,
+		dmi_cmd->DMISel);
+	CAM_DBG(CAM_OPE, "%d: %x %x %x",
+		print_idx,
+		temp[0], temp[1], temp[2]);
+
+	return 0;
+}
+
+static int dump_direct_cmd(uint32_t print_idx,
+	uint32_t *print_ptr,
+	struct ope_frame_process *frm_proc,
+	int batch_idx, int cmd_buf_idx)
+{
+	int len;
+
+	if (cmd_buf_idx >= OPE_MAX_CMD_BUFS ||
+		batch_idx >= OPE_MAX_BATCH_SIZE)
+		return 0;
+
+	len = frm_proc->cmd_buf[batch_idx][cmd_buf_idx].length / 4;
+	CAM_DBG(CAM_OPE, "Frame DB : direct: E");
+	for (print_idx = 0; print_idx < len; print_idx++)
+		CAM_DBG(CAM_OPE, "%d: %x", print_idx, print_ptr[print_idx]);
+	CAM_DBG(CAM_OPE, "Frame DB : direct: X");
+
+	return 0;
+}
+
+static int dump_frame_cmd(struct ope_frame_process *frm_proc,
+	int i, int j, uint64_t iova_addr, uint32_t *kmd_buf, uint32_t buf_len)
+{
+	if (j >= OPE_MAX_CMD_BUFS || i >= OPE_MAX_BATCH_SIZE)
+		return 0;
+
+	CAM_DBG(CAM_OPE, "Frame DB:scope:%d buffer:%d type:%d",
+		frm_proc->cmd_buf[i][j].cmd_buf_scope,
+		frm_proc->cmd_buf[i][j].cmd_buf_buffered,
+		frm_proc->cmd_buf[i][j].type);
+	CAM_DBG(CAM_OPE, "kmdbuf:%x memhdl:%x iova:%x %pK",
+		kmd_buf,
+		frm_proc->cmd_buf[i][j].mem_handle,
+		iova_addr, iova_addr);
+	CAM_DBG(CAM_OPE, "buflen:%d len:%d offset:%d",
+		buf_len,
+		frm_proc->cmd_buf[i][j].length,
+		frm_proc->cmd_buf[i][j].offset);
+
+	return 0;
+}
+
+static int dump_stripe_cmd(struct ope_frame_process *frm_proc,
+	uint32_t stripe_idx, int i, int k, uint64_t iova_addr,
+	uint32_t *kmd_buf, uint32_t buf_len)
+{
+	if (k >= OPE_MAX_CMD_BUFS)
+		return 0;
+
+	CAM_DBG(CAM_OPE, "Stripe:%d scope:%d buffer:%d",
+		stripe_idx,
+		frm_proc->cmd_buf[i][k].cmd_buf_scope,
+		frm_proc->cmd_buf[i][k].cmd_buf_buffered);
+	CAM_DBG(CAM_OPE, "type:%d kmdbuf:%x memhdl:%x",
+		frm_proc->cmd_buf[i][k].type, kmd_buf,
+		frm_proc->cmd_buf[i][k].mem_handle);
+	CAM_DBG(CAM_OPE, "iova:%x %pK buflen:%d len:%d",
+		iova_addr, iova_addr, buf_len,
+		frm_proc->cmd_buf[i][k].length);
+	CAM_DBG(CAM_OPE, "offset:%d",
+		frm_proc->cmd_buf[i][k].offset);
+	return 0;
+}
+
+static uint32_t *ope_create_frame_cmd_batch(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf, uint32_t buffered, int batch_idx,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0, i, j;
+	uint32_t temp[3];
+	struct cam_ope_request *ope_request;
+	struct cdm_dmi_cmd *dmi_cmd;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	dma_addr_t iova_addr;
+	uintptr_t cpu_addr;
+	size_t buf_len;
+	uint32_t print_idx;
+	uint32_t *print_ptr;
+	int num_dmi = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[0];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[0];
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid input: %d", batch_idx);
+		return NULL;
+	}
+	i = batch_idx;
+
+	for (j = 0; j < frm_proc->num_cmd_bufs[i]; j++) {
+		if (frm_proc->cmd_buf[i][j].cmd_buf_scope !=
+			OPE_CMD_BUF_SCOPE_FRAME)
+			continue;
+
+		if (frm_proc->cmd_buf[i][j].cmd_buf_usage ==
+			OPE_CMD_BUF_KMD ||
+			frm_proc->cmd_buf[i][j].cmd_buf_usage ==
+			OPE_CMD_BUF_DEBUG)
+			continue;
+
+		if (frm_proc->cmd_buf[i][j].cmd_buf_buffered !=
+			buffered)
+			continue;
+
+		if (!frm_proc->cmd_buf[i][j].mem_handle)
+			continue;
+
+		rc = cam_mem_get_io_buf(
+			frm_proc->cmd_buf[i][j].mem_handle,
+			hw_mgr->iommu_cdm_hdl, &iova_addr, &buf_len, NULL, NULL);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+				hw_mgr->iommu_hdl);
+			return NULL;
+		}
+		iova_addr = iova_addr + frm_proc->cmd_buf[i][j].offset;
+
+		rc = cam_mem_get_cpu_buf(
+			frm_proc->cmd_buf[i][j].mem_handle,
+			&cpu_addr, &buf_len);
+		if (rc || !cpu_addr) {
+			CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+				hw_mgr->iommu_hdl);
+			return NULL;
+		}
+
+		cpu_addr = cpu_addr + frm_proc->cmd_buf[i][j].offset;
+		if (frm_proc->cmd_buf[i][j].type ==
+			OPE_CMD_BUF_TYPE_DIRECT) {
+			kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+				iova_addr,
+				frm_proc->cmd_buf[i][j].length);
+			print_ptr = (uint32_t *)cpu_addr;
+			dump_direct_cmd(print_idx, print_ptr,
+				frm_proc, i, j);
+		} else {
+			num_dmi = frm_proc->cmd_buf[i][j].length /
+				sizeof(struct cdm_dmi_cmd);
+			CAM_DBG(CAM_OPE, "Frame DB : In direct: E");
+			print_ptr = (uint32_t *)cpu_addr;
+			for (print_idx = 0;
+				print_idx < num_dmi; print_idx++) {
+				memcpy(temp, (const void *)print_ptr,
+					sizeof(struct cdm_dmi_cmd));
+				dmi_cmd = (struct cdm_dmi_cmd *)temp;
+				if (!dmi_cmd->addr) {
+					CAM_ERR(CAM_OPE, "Null dmi cmd addr");
+					cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][j].mem_handle);
+					return NULL;
+				}
+
+				kmd_buf = cdm_ops->cdm_write_dmi(
+					kmd_buf,
+					0, dmi_cmd->DMIAddr,
+					dmi_cmd->DMISel, dmi_cmd->addr,
+					dmi_cmd->length);
+				if (hw_mgr->frame_dump_enable)
+					dump_dmi_cmd(print_idx,
+						print_ptr, dmi_cmd, temp);
+				print_ptr +=
+					sizeof(struct cdm_dmi_cmd) /
+					sizeof(uint32_t);
+			}
+			CAM_DBG(CAM_OPE, "Frame DB : In direct: X");
+		}
+		if (hw_mgr->frame_dump_enable)
+			dump_frame_cmd(frm_proc, i, j,
+				iova_addr, kmd_buf, buf_len);
+
+		cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][j].mem_handle);
+	}
+	return kmd_buf;
+
+}
+
+static uint32_t *ope_create_frame_wr(struct cam_ope_ctx *ctx_data,
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info,
+	uint32_t *kmd_buf, struct cam_ope_request *ope_request)
+{
+	struct cam_cdm_utils_ops *cdm_ops;
+	int i;
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	for (i = 0; i < wr_cdm_info->num_frames_cmds; i++) {
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			wr_cdm_info->f_cdm_info[i].offset,
+			wr_cdm_info->f_cdm_info[i].len);
+		CAM_DBG(CAM_OPE, "FrameWR:i:%d kmdbuf:%x len:%d iova:%x %pK",
+			i, kmd_buf, wr_cdm_info->f_cdm_info[i].len,
+			ope_request->ope_kmd_buf.iova_cdm_addr,
+			ope_request->ope_kmd_buf.iova_cdm_addr);
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_frame_rd(struct cam_ope_ctx *ctx_data,
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info,
+	uint32_t *kmd_buf, struct cam_ope_request *ope_request)
+{
+	struct cam_cdm_utils_ops *cdm_ops;
+	int i;
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	/* Frame 0 RD */
+	for (i = 0; i < rd_cdm_info->num_frames_cmds; i++) {
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			rd_cdm_info->f_cdm_info[i].offset,
+			rd_cdm_info->f_cdm_info[i].len);
+		CAM_DBG(CAM_OPE, "FrameRD:i:%d kmdbuf:%x len:%d iova:%x %pK",
+			 i, kmd_buf, rd_cdm_info->f_cdm_info[i].len,
+			 ope_request->ope_kmd_buf.iova_cdm_addr,
+			 ope_request->ope_kmd_buf.iova_cdm_addr);
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_frame_cmd(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf, uint32_t buffered,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0, i, j;
+	uint32_t temp[3];
+	struct cam_ope_request *ope_request;
+	struct cdm_dmi_cmd *dmi_cmd;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	dma_addr_t iova_addr;
+	uintptr_t cpu_addr;
+	size_t buf_len;
+	uint32_t print_idx;
+	uint32_t *print_ptr;
+	int num_dmi = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[0];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[0];
+
+	for (i = 0; i < frm_proc->batch_size; i++) {
+		for (j = 0; j < frm_proc->num_cmd_bufs[i]; j++) {
+			if (frm_proc->cmd_buf[i][j].cmd_buf_scope !=
+				OPE_CMD_BUF_SCOPE_FRAME)
+				continue;
+
+			if (frm_proc->cmd_buf[i][j].cmd_buf_usage ==
+				OPE_CMD_BUF_KMD ||
+				frm_proc->cmd_buf[i][j].cmd_buf_usage ==
+				OPE_CMD_BUF_DEBUG)
+				continue;
+
+			if (frm_proc->cmd_buf[i][j].cmd_buf_buffered !=
+				buffered)
+				continue;
+
+			if (!frm_proc->cmd_buf[i][j].mem_handle)
+				continue;
+
+			rc = cam_mem_get_io_buf(
+				frm_proc->cmd_buf[i][j].mem_handle,
+				hw_mgr->iommu_cdm_hdl, &iova_addr, &buf_len, NULL, NULL);
+			if (rc) {
+				CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+					hw_mgr->iommu_hdl);
+				return NULL;
+			}
+			iova_addr = iova_addr + frm_proc->cmd_buf[i][j].offset;
+
+			rc = cam_mem_get_cpu_buf(
+				frm_proc->cmd_buf[i][j].mem_handle,
+				&cpu_addr, &buf_len);
+			if (rc || !cpu_addr) {
+				CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+					hw_mgr->iommu_hdl);
+				return NULL;
+			}
+
+			cpu_addr = cpu_addr + frm_proc->cmd_buf[i][j].offset;
+			if (frm_proc->cmd_buf[i][j].type ==
+				OPE_CMD_BUF_TYPE_DIRECT) {
+				kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+					iova_addr,
+					frm_proc->cmd_buf[i][j].length);
+				print_ptr = (uint32_t *)cpu_addr;
+				if (hw_mgr->frame_dump_enable)
+					dump_direct_cmd(print_idx, print_ptr,
+						frm_proc, i, j);
+			} else {
+				num_dmi = frm_proc->cmd_buf[i][j].length /
+					sizeof(struct cdm_dmi_cmd);
+				CAM_DBG(CAM_OPE, "Frame DB : In direct: E");
+				print_ptr = (uint32_t *)cpu_addr;
+				for (print_idx = 0;
+					print_idx < num_dmi; print_idx++) {
+					memcpy(temp, (const void *)print_ptr,
+						sizeof(struct cdm_dmi_cmd));
+					dmi_cmd = (struct cdm_dmi_cmd *)temp;
+					if (!dmi_cmd->addr) {
+						CAM_ERR(CAM_OPE,
+							"Null dmi cmd addr");
+						cam_mem_put_cpu_buf(
+							frm_proc->cmd_buf[i][j].mem_handle);
+						return NULL;
+					}
+
+					kmd_buf = cdm_ops->cdm_write_dmi(
+						kmd_buf,
+						0, dmi_cmd->DMIAddr,
+						dmi_cmd->DMISel, dmi_cmd->addr,
+						dmi_cmd->length);
+					if (hw_mgr->frame_dump_enable)
+						dump_dmi_cmd(print_idx,
+							print_ptr, dmi_cmd,
+							temp);
+					print_ptr +=
+						sizeof(struct cdm_dmi_cmd) /
+						sizeof(uint32_t);
+				}
+				CAM_DBG(CAM_OPE, "Frame DB : In direct: X");
+			}
+			if (hw_mgr->frame_dump_enable)
+				dump_frame_cmd(frm_proc, i, j,
+					iova_addr, kmd_buf, buf_len);
+
+			cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][j].mem_handle);
+		}
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripe_cmd(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	uint32_t *kmd_buf,
+	int batch_idx,
+	int s_idx,
+	uint32_t stripe_idx,
+	struct ope_frame_process *frm_proc)
+{
+	int rc = 0, i, j, k;
+	uint32_t temp[3];
+	struct cdm_dmi_cmd *dmi_cmd;
+	dma_addr_t iova_addr;
+	uintptr_t cpu_addr;
+	size_t buf_len;
+	uint32_t print_idx;
+	uint32_t *print_ptr;
+	int num_dmi = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+	uint32_t reg_val_pair[2];
+	struct cam_hw_info *ope_dev;
+	struct cam_ope_device_core_info *core_info;
+	struct ope_hw *ope_hw;
+	struct cam_ope_top_reg *top_reg;
+
+	if (s_idx >= OPE_MAX_CMD_BUFS ||
+		batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid inputs: %d %d",
+			batch_idx, s_idx);
+		return NULL;
+	}
+
+	i = batch_idx;
+	j = s_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	/* cmd buffer stripes */
+	for (k = 0; k < frm_proc->num_cmd_bufs[i]; k++) {
+		if (frm_proc->cmd_buf[i][k].cmd_buf_scope !=
+			OPE_CMD_BUF_SCOPE_STRIPE)
+			continue;
+
+		if (frm_proc->cmd_buf[i][k].stripe_idx !=
+			stripe_idx)
+			continue;
+
+		if (!frm_proc->cmd_buf[i][k].mem_handle)
+			continue;
+
+		CAM_DBG(CAM_OPE, "process stripe %d", stripe_idx);
+		rc = cam_mem_get_io_buf(frm_proc->cmd_buf[i][k].mem_handle,
+			hw_mgr->iommu_cdm_hdl, &iova_addr, &buf_len, NULL, NULL);
+		if (rc) {
+			CAM_DBG(CAM_OPE, "get cmd buf fail %x",
+				hw_mgr->iommu_hdl);
+			return NULL;
+		}
+		iova_addr = iova_addr + frm_proc->cmd_buf[i][k].offset;
+		rc = cam_mem_get_cpu_buf(frm_proc->cmd_buf[i][k].mem_handle,
+			&cpu_addr, &buf_len);
+		if (rc || !cpu_addr) {
+			CAM_DBG(CAM_OPE, "get cmd buf fail %x",
+				hw_mgr->iommu_hdl);
+			return NULL;
+		}
+		cpu_addr = cpu_addr + frm_proc->cmd_buf[i][k].offset;
+
+		if (frm_proc->cmd_buf[i][k].type == OPE_CMD_BUF_TYPE_DIRECT) {
+			kmd_buf = cdm_ops->cdm_write_indirect(
+				kmd_buf,
+				iova_addr,
+				frm_proc->cmd_buf[i][k].length);
+			print_ptr = (uint32_t *)cpu_addr;
+			CAM_DBG(CAM_OPE, "Stripe:%d direct:E",
+				stripe_idx);
+			if (hw_mgr->frame_dump_enable)
+				dump_direct_cmd(print_idx, print_ptr,
+					frm_proc, i, k);
+			CAM_DBG(CAM_OPE, "Stripe:%d direct:X", stripe_idx);
+		} else if (frm_proc->cmd_buf[i][k].type ==
+			OPE_CMD_BUF_TYPE_INDIRECT) {
+			num_dmi = frm_proc->cmd_buf[i][j].length /
+				sizeof(struct cdm_dmi_cmd);
+			CAM_DBG(CAM_OPE, "Stripe:%d Indirect:E", stripe_idx);
+			print_ptr = (uint32_t *)cpu_addr;
+			for (print_idx = 0; print_idx < num_dmi; print_idx++) {
+				memcpy(temp, (const void *)print_ptr,
+					sizeof(struct cdm_dmi_cmd));
+				dmi_cmd = (struct cdm_dmi_cmd *)temp;
+				if (!dmi_cmd->addr) {
+					CAM_ERR(CAM_OPE, "Null dmi cmd addr");
+					cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][k].mem_handle);
+					return NULL;
+				}
+
+				kmd_buf = cdm_ops->cdm_write_dmi(kmd_buf,
+					0, dmi_cmd->DMIAddr, dmi_cmd->DMISel,
+					dmi_cmd->addr, dmi_cmd->length);
+				if (hw_mgr->frame_dump_enable)
+					dump_dmi_cmd(print_idx,
+						print_ptr, dmi_cmd, temp);
+				print_ptr += sizeof(struct cdm_dmi_cmd) /
+					sizeof(uint32_t);
+			}
+			CAM_DBG(CAM_OPE, "Stripe:%d Indirect:X", stripe_idx);
+		}
+
+		if (hw_mgr->frame_dump_enable)
+			dump_stripe_cmd(frm_proc, stripe_idx, i, k,
+				iova_addr, kmd_buf, buf_len);
+
+		cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][k].mem_handle);
+	}
+
+	ope_dev = hw_mgr->ope_dev_intf[0]->hw_priv;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	ope_hw = core_info->ope_hw_info->ope_hw;
+	top_reg = ope_hw->top_reg;
+
+	reg_val_pair[0] = top_reg->offset + top_reg->scratch_reg;
+	reg_val_pair[1] = stripe_idx;
+	kmd_buf = cdm_ops->cdm_write_regrandom(kmd_buf, 1, reg_val_pair);
+
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripe_wr(struct cam_ope_ctx *ctx_data,
+	uint32_t stripe_idx, struct ope_bus_wr_io_port_cdm_info *wr_cdm_info,
+	struct cam_ope_request *ope_request, uint32_t *kmd_buf)
+{
+	struct cam_cdm_utils_ops *cdm_ops;
+	int k;
+
+	if (stripe_idx >= OPE_MAX_STRIPES) {
+		CAM_ERR(CAM_OPE, "invalid s_idx = %d", stripe_idx);
+		return NULL;
+	}
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	for (k = 0; k < wr_cdm_info->num_s_cmd_bufs[stripe_idx]; k++) {
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			wr_cdm_info->s_cdm_info[stripe_idx][k].offset,
+			wr_cdm_info->s_cdm_info[stripe_idx][k].len);
+		CAM_DBG(CAM_OPE, "WR stripe:%d %d kmdbuf:%x",
+			stripe_idx, k, kmd_buf);
+		CAM_DBG(CAM_OPE, "offset:%d len:%d iova:%x %pK",
+			wr_cdm_info->s_cdm_info[stripe_idx][k].offset,
+			wr_cdm_info->s_cdm_info[stripe_idx][k].len,
+			ope_request->ope_kmd_buf.iova_cdm_addr,
+			ope_request->ope_kmd_buf.iova_cdm_addr);
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripe_rd(struct cam_ope_ctx *ctx_data,
+	uint32_t stripe_idx, struct ope_bus_rd_io_port_cdm_info *rd_cdm_info,
+	struct cam_ope_request *ope_request, uint32_t *kmd_buf)
+{
+	struct cam_cdm_utils_ops *cdm_ops;
+	int k;
+
+	if (stripe_idx >= OPE_MAX_STRIPES) {
+		CAM_ERR(CAM_OPE, "invalid s_idx = %d", stripe_idx);
+		return NULL;
+	}
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	for (k = 0; k < rd_cdm_info->num_s_cmd_bufs[stripe_idx]; k++) {
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			rd_cdm_info->s_cdm_info[stripe_idx][k].offset,
+			rd_cdm_info->s_cdm_info[stripe_idx][k].len);
+		CAM_DBG(CAM_OPE, "WR stripe:%d %d kmdbuf:%x",
+			stripe_idx, k, kmd_buf);
+		CAM_DBG(CAM_OPE, "offset:%d len:%d iova:%x %pK",
+			rd_cdm_info->s_cdm_info[stripe_idx][k].offset,
+			rd_cdm_info->s_cdm_info[stripe_idx][k].len,
+			ope_request->ope_kmd_buf.iova_cdm_addr,
+			ope_request->ope_kmd_buf.iova_cdm_addr);
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripes_batch(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf, int batch_idx,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int i, j;
+	struct cam_ope_request *ope_request;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	uint32_t stripe_idx = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid input: %d", batch_idx);
+		return NULL;
+	}
+	i = batch_idx;
+	/* Stripes */
+
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[i];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[i];
+	for (j = 0; j < ope_request->num_stripes[i]; j++) {
+		/* cmd buffer stripes */
+		kmd_buf = ope_create_stripe_cmd(hw_mgr, ctx_data,
+			kmd_buf, i, j, stripe_idx, frm_proc);
+		if (!kmd_buf)
+			goto end;
+
+		/* WR stripes */
+		kmd_buf = ope_create_stripe_wr(ctx_data, stripe_idx,
+			wr_cdm_info, ope_request, kmd_buf);
+		if (!kmd_buf)
+			goto end;
+
+		/* RD stripes */
+		kmd_buf = ope_create_stripe_rd(ctx_data, stripe_idx,
+			rd_cdm_info, ope_request, kmd_buf);
+		if (!kmd_buf)
+			goto end;
+
+		/* add go command */
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+		(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+		rd_cdm_info->go_cmd_offset,
+		rd_cdm_info->go_cmd_len);
+
+		CAM_DBG(CAM_OPE, "Go cmd for stripe:%d kmd_buf:%x",
+			stripe_idx, kmd_buf);
+		CAM_DBG(CAM_OPE, "iova:%x %pK",
+			ope_request->ope_kmd_buf.iova_cdm_addr,
+			ope_request->ope_kmd_buf.iova_cdm_addr);
+
+		/* wait for RUP done */
+		kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+			OPE_WAIT_COMP_RUP, 0x0);
+		CAM_DBG(CAM_OPE, "wait RUP cmd stripe:%d kmd_buf:%x",
+			stripe_idx, kmd_buf);
+		stripe_idx++;
+	}
+
+end:
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripes(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int i, j;
+	struct cam_ope_request *ope_request;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	uint32_t stripe_idx = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	/* Stripes */
+	for (i = 0; i < frm_proc->batch_size; i++) {
+		wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[i];
+		rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[i];
+		for (j = 0; j < ope_request->num_stripes[i]; j++) {
+			/* cmd buffer stripes */
+			kmd_buf = ope_create_stripe_cmd(hw_mgr, ctx_data,
+				kmd_buf, i, j, stripe_idx, frm_proc);
+			if (!kmd_buf)
+				goto end;
+
+			/* WR stripes */
+			kmd_buf = ope_create_stripe_wr(ctx_data, stripe_idx,
+				wr_cdm_info, ope_request, kmd_buf);
+			if (!kmd_buf)
+				goto end;
+
+			/* RD stripes */
+			kmd_buf = ope_create_stripe_rd(ctx_data, stripe_idx,
+				rd_cdm_info, ope_request, kmd_buf);
+			if (!kmd_buf)
+				goto end;
+
+			/* add go command */
+			kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			rd_cdm_info->go_cmd_offset,
+			rd_cdm_info->go_cmd_len);
+
+			CAM_DBG(CAM_OPE, "Go cmd for stripe:%d kmd_buf:%x",
+				stripe_idx, kmd_buf);
+			CAM_DBG(CAM_OPE, "iova:%x %pK",
+				ope_request->ope_kmd_buf.iova_cdm_addr,
+				ope_request->ope_kmd_buf.iova_cdm_addr);
+
+			/* wait for RUP done */
+			kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+				OPE_WAIT_COMP_RUP, 0x0);
+			CAM_DBG(CAM_OPE, "wait RUP cmd stripe:%d kmd_buf:%x",
+				stripe_idx, kmd_buf);
+			stripe_idx++;
+		}
+	}
+end:
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripes_nrt(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req,
+	uint32_t *kmd_buf_offset, uint32_t **cdm_kmd_start_addr)
+{
+	int i, j;
+	struct cam_ope_request *ope_request;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	uint32_t stripe_idx = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+	uint32_t len;
+	int num_nrt_stripes, num_arb;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	num_nrt_stripes = ctx_data->ope_acquire.nrt_stripes_for_arb;
+	num_arb = ope_request->num_stripes[0] /
+		ctx_data->ope_acquire.nrt_stripes_for_arb;
+	if (ope_request->num_stripes[0] %
+		ctx_data->ope_acquire.nrt_stripes_for_arb)
+		num_arb++;
+	CAM_DBG(CAM_OPE, "Number of ARB for snap: %d", num_arb);
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	/* Stripes */
+	for (i = 0; i < frm_proc->batch_size; i++) {
+		wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[i];
+		rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[i];
+		for (j = 0; j < ope_request->num_stripes[i]; j++) {
+			CAM_DBG(CAM_OPE, "num_nrt_stripes = %d num_arb = %d",
+				num_nrt_stripes, num_arb);
+			if (!num_nrt_stripes) {
+				kmd_buf = cdm_ops->cdm_write_wait_comp_event(
+					kmd_buf,
+					OPE_WAIT_COMP_IDLE, 0x0);
+				len = (kmd_buf - *cdm_kmd_start_addr) *
+					sizeof(uint32_t);
+				cam_ope_dev_prepare_cdm_request(
+					ope_dev_prepare_req->hw_mgr,
+					ope_dev_prepare_req->prepare_args,
+					ope_dev_prepare_req->ctx_data,
+					ope_dev_prepare_req->req_idx,
+					*kmd_buf_offset, ope_dev_prepare_req,
+					len, true);
+				*cdm_kmd_start_addr = kmd_buf;
+				*kmd_buf_offset += len;
+			}
+			/* cmd buffer stripes */
+			kmd_buf = ope_create_stripe_cmd(hw_mgr, ctx_data,
+				kmd_buf, i, j, stripe_idx, frm_proc);
+			if (!kmd_buf)
+				goto end;
+
+			/* WR stripes */
+			kmd_buf = ope_create_stripe_wr(ctx_data, stripe_idx,
+				wr_cdm_info, ope_request, kmd_buf);
+			if (!kmd_buf)
+				goto end;
+
+			/* RD stripes */
+			kmd_buf = ope_create_stripe_rd(ctx_data, stripe_idx,
+				rd_cdm_info, ope_request, kmd_buf);
+			if (!kmd_buf)
+				goto end;
+
+			if (!num_nrt_stripes) {
+				/* For num_nrt_stripes create CDM BL with ARB */
+				/* Add Frame level cmds in this condition */
+				/* Frame 0 DB */
+				kmd_buf = ope_create_frame_cmd(hw_mgr,
+					ctx_data, req_idx,
+					kmd_buf, OPE_CMD_BUF_DOUBLE_BUFFERED,
+					ope_dev_prepare_req);
+				if (!kmd_buf)
+					goto end;
+
+				/* Frame 0 SB */
+				kmd_buf = ope_create_frame_cmd(hw_mgr,
+					ctx_data, req_idx,
+					kmd_buf, OPE_CMD_BUF_SINGLE_BUFFERED,
+					ope_dev_prepare_req);
+				if (!kmd_buf)
+					goto end;
+
+				/* Frame 0 WR */
+				kmd_buf = ope_create_frame_wr(ctx_data,
+					wr_cdm_info, kmd_buf, ope_request);
+				if (!kmd_buf)
+					goto end;
+
+				/* Frame 0 RD */
+				kmd_buf = ope_create_frame_rd(ctx_data,
+					rd_cdm_info, kmd_buf, ope_request);
+				if (!kmd_buf)
+					goto end;
+				num_arb--;
+				num_nrt_stripes =
+				ctx_data->ope_acquire.nrt_stripes_for_arb;
+			}
+			// add go command
+			kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			rd_cdm_info->go_cmd_offset,
+			rd_cdm_info->go_cmd_len);
+
+			CAM_DBG(CAM_OPE, "Go cmd for stripe:%d kmd_buf:%x",
+				stripe_idx, kmd_buf);
+			CAM_DBG(CAM_OPE, "iova:%x %pK",
+				ope_request->ope_kmd_buf.iova_cdm_addr,
+				ope_request->ope_kmd_buf.iova_cdm_addr);
+
+			// wait for RUP done
+			kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+				OPE_WAIT_COMP_RUP, 0x0);
+			CAM_DBG(CAM_OPE, "wait RUP cmd stripe:%d kmd_buf:%x",
+				stripe_idx, kmd_buf);
+			stripe_idx++;
+			num_nrt_stripes--;
+		}
+	}
+end:
+	return kmd_buf;
+}
+
+static int cam_ope_dev_create_kmd_buf_nrt(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0;
+	uint32_t len;
+	struct cam_ope_request *ope_request;
+	uint32_t *kmd_buf;
+	uint32_t *cdm_kmd_start_addr;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	struct cam_cdm_utils_ops *cdm_ops;
+	uint32_t kmd_buff_offset = ope_dev_prepare_req->kmd_buf_offset;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		(ope_dev_prepare_req->kmd_buf_offset / sizeof(len));
+	cdm_kmd_start_addr = kmd_buf;
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[0];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[0];
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	kmd_buf = cdm_ops->cdm_write_clear_comp_event(kmd_buf,
+				OPE_WAIT_COMP_IDLE|OPE_WAIT_COMP_RUP, 0x0);
+
+	/* Frame 0 DB */
+	kmd_buf = ope_create_frame_cmd(hw_mgr,
+		ctx_data, req_idx,
+		kmd_buf, OPE_CMD_BUF_DOUBLE_BUFFERED,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 SB */
+	kmd_buf = ope_create_frame_cmd(hw_mgr,
+		ctx_data, req_idx,
+		kmd_buf, OPE_CMD_BUF_SINGLE_BUFFERED,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 WR */
+	kmd_buf = ope_create_frame_wr(ctx_data,
+		wr_cdm_info, kmd_buf, ope_request);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 RD */
+	kmd_buf = ope_create_frame_rd(ctx_data,
+		rd_cdm_info, kmd_buf, ope_request);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Stripes */
+	kmd_buf = ope_create_stripes_nrt(hw_mgr, ctx_data, req_idx, kmd_buf,
+		ope_dev_prepare_req, &kmd_buff_offset, &cdm_kmd_start_addr);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Last arbitration if there are odd number of stripes */
+	/* wait_idle_irq */
+	kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+		OPE_WAIT_COMP_IDLE, 0x0);
+
+	/* prepare CDM submit packet */
+	len = (kmd_buf - cdm_kmd_start_addr) * sizeof(uint32_t);
+	cam_ope_dev_prepare_cdm_request(ope_dev_prepare_req->hw_mgr,
+		ope_dev_prepare_req->prepare_args,
+		ope_dev_prepare_req->ctx_data, ope_dev_prepare_req->req_idx,
+		ope_dev_prepare_req->kmd_buf_offset, ope_dev_prepare_req,
+		len, false);
+
+	ope_dev_prepare_req->kmd_buf_offset += len;
+end:
+	return rc;
+}
+
+static int cam_ope_dev_create_kmd_buf_batch(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0, i;
+	uint32_t len;
+	struct cam_ope_request *ope_request;
+	uint32_t *kmd_buf;
+	uint32_t *cdm_kmd_start_addr;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		(ope_dev_prepare_req->kmd_buf_offset / sizeof(len));
+	cdm_kmd_start_addr = kmd_buf;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	kmd_buf = cdm_ops->cdm_write_clear_comp_event(kmd_buf,
+				OPE_WAIT_COMP_IDLE|OPE_WAIT_COMP_RUP, 0x0);
+
+	for (i = 0; i < frm_proc->batch_size; i++) {
+		wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[i];
+		rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[i];
+
+		/* After second batch DB programming add prefecth dis */
+		if (i) {
+			kmd_buf =
+				cdm_ops->cdm_write_wait_prefetch_disable(
+				kmd_buf, 0x0,
+				OPE_WAIT_COMP_IDLE, 0x0);
+		}
+
+		/* Frame i DB */
+		kmd_buf = ope_create_frame_cmd_batch(hw_mgr,
+			ctx_data, req_idx,
+			kmd_buf, OPE_CMD_BUF_DOUBLE_BUFFERED, i,
+			ope_dev_prepare_req);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Frame i SB */
+		kmd_buf = ope_create_frame_cmd_batch(hw_mgr,
+			ctx_data, req_idx,
+			kmd_buf, OPE_CMD_BUF_SINGLE_BUFFERED, i,
+			ope_dev_prepare_req);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Frame i WR */
+		kmd_buf = ope_create_frame_wr(ctx_data,
+			wr_cdm_info, kmd_buf, ope_request);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Frame i RD */
+		kmd_buf = ope_create_frame_rd(ctx_data,
+			rd_cdm_info, kmd_buf, ope_request);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Stripe level programming for batch i */
+			/* Stripes */
+		kmd_buf = ope_create_stripes_batch(hw_mgr, ctx_data, req_idx,
+			kmd_buf, i, ope_dev_prepare_req);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	/* wait_idle_irq */
+	kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+			OPE_WAIT_COMP_IDLE, 0x0);
+
+	/* prepare CDM submit packet */
+	len = (kmd_buf - cdm_kmd_start_addr) * sizeof(uint32_t);
+	cam_ope_dev_prepare_cdm_request(ope_dev_prepare_req->hw_mgr,
+		ope_dev_prepare_req->prepare_args,
+		ope_dev_prepare_req->ctx_data, ope_dev_prepare_req->req_idx,
+		ope_dev_prepare_req->kmd_buf_offset, ope_dev_prepare_req,
+		len, false);
+
+	ope_dev_prepare_req->kmd_buf_offset += len;
+
+end:
+	return rc;
+}
+
+static int cam_ope_dev_create_kmd_buf(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0;
+	uint32_t len;
+	struct cam_ope_request *ope_request;
+	uint32_t *kmd_buf;
+	uint32_t *cdm_kmd_start_addr;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+
+	if (ctx_data->ope_acquire.dev_type == OPE_DEV_TYPE_OPE_NRT) {
+		return cam_ope_dev_create_kmd_buf_nrt(
+			ope_dev_prepare_req->hw_mgr,
+			ope_dev_prepare_req->prepare_args,
+			ope_dev_prepare_req->ctx_data,
+			ope_dev_prepare_req->req_idx,
+			ope_dev_prepare_req);
+	}
+
+	if (ctx_data->ope_acquire.batch_size > 1) {
+		return cam_ope_dev_create_kmd_buf_batch(
+		ope_dev_prepare_req->hw_mgr,
+		ope_dev_prepare_req->prepare_args,
+		ope_dev_prepare_req->ctx_data,
+		ope_dev_prepare_req->req_idx,
+		ope_dev_prepare_req);
+	}
+
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		(ope_dev_prepare_req->kmd_buf_offset / sizeof(len));
+	cdm_kmd_start_addr = kmd_buf;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[0];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[0];
+
+
+	CAM_DBG(CAM_OPE, "kmd_buf:%x req_idx:%d req_id:%lld offset:%d",
+		kmd_buf, req_idx, ope_request->request_id, ope_dev_prepare_req->kmd_buf_offset);
+
+	kmd_buf = cdm_ops->cdm_write_clear_comp_event(kmd_buf,
+				OPE_WAIT_COMP_IDLE|OPE_WAIT_COMP_RUP, 0x0);
+	/* Frame 0 DB */
+	kmd_buf = ope_create_frame_cmd(hw_mgr,
+		ctx_data, req_idx,
+		kmd_buf, OPE_CMD_BUF_DOUBLE_BUFFERED,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 SB */
+	kmd_buf = ope_create_frame_cmd(hw_mgr,
+		ctx_data, req_idx,
+		kmd_buf, OPE_CMD_BUF_SINGLE_BUFFERED,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 WR */
+	kmd_buf = ope_create_frame_wr(ctx_data,
+		wr_cdm_info, kmd_buf, ope_request);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 RD */
+	kmd_buf = ope_create_frame_rd(ctx_data,
+		rd_cdm_info, kmd_buf, ope_request);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Stripes */
+	kmd_buf = ope_create_stripes(hw_mgr, ctx_data, req_idx, kmd_buf,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* wait_idle_irq */
+	kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+			OPE_WAIT_COMP_IDLE, 0x0);
+
+	CAM_DBG(CAM_OPE, "wait for idle IRQ: kmd_buf:%x", kmd_buf);
+
+	/* prepare CDM submit packet */
+	len = (kmd_buf - cdm_kmd_start_addr) * sizeof(uint32_t);
+	CAM_DBG(CAM_OPE, "kmd_start_addr:%x kmdbuf_addr:%x len:%d",
+		cdm_kmd_start_addr, kmd_buf, len);
+	cam_ope_dev_prepare_cdm_request(
+		ope_dev_prepare_req->hw_mgr,
+		ope_dev_prepare_req->prepare_args,
+		ope_dev_prepare_req->ctx_data,
+		ope_dev_prepare_req->req_idx,
+		ope_dev_prepare_req->kmd_buf_offset,
+		ope_dev_prepare_req,
+		len, false);
+	ope_dev_prepare_req->kmd_buf_offset += len;
+end:
+	return rc;
+}
+
+static int cam_ope_dev_process_prepare(struct ope_hw *ope_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req;
+
+	ope_dev_prepare_req = cmd_args;
+
+	rc = cam_ope_top_process(ope_hw, ope_dev_prepare_req->ctx_data->ctx_id,
+		OPE_HW_PREPARE, ope_dev_prepare_req);
+	if (rc)
+		goto end;
+
+	rc = cam_ope_bus_rd_process(ope_hw,
+		ope_dev_prepare_req->ctx_data->ctx_id,
+		OPE_HW_PREPARE, ope_dev_prepare_req);
+	if (rc)
+		goto end;
+
+	rc = cam_ope_bus_wr_process(ope_hw,
+		ope_dev_prepare_req->ctx_data->ctx_id,
+		OPE_HW_PREPARE, ope_dev_prepare_req);
+	if (rc)
+		goto end;
+
+	rc = cam_ope_dev_create_kmd_buf(ope_dev_prepare_req->hw_mgr,
+			ope_dev_prepare_req->prepare_args,
+			ope_dev_prepare_req->ctx_data,
+			ope_dev_prepare_req->req_idx,
+			ope_dev_prepare_req);
+
+end:
+	return rc;
+}
+
+static int cam_ope_dev_process_probe(struct ope_hw *ope_hw,
+	void *cmd_args)
+{
+	cam_ope_top_process(ope_hw, -1, OPE_HW_PROBE, NULL);
+	cam_ope_bus_rd_process(ope_hw, -1, OPE_HW_PROBE, NULL);
+	cam_ope_bus_wr_process(ope_hw, -1, OPE_HW_PROBE, NULL);
+
+	return 0;
+}
+
+static int cam_ope_process_probe(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	struct cam_ope_dev_probe *ope_probe = cmd_args;
+
+	if (!ope_probe->hfi_en)
+		return cam_ope_dev_process_probe(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_dump_debug_reg(struct ope_hw *ope_hw,
+	bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_dump_debug_reg(ope_hw);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_reset(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_reset(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_release(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_release(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_acquire(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_acquire(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_prepare(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_prepare(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+int cam_ope_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct    cam_hw_info *ope_dev = device_priv;
+	struct    cam_hw_soc_info *soc_info = NULL;
+	struct    cam_ope_device_core_info *core_info = NULL;
+	struct    cam_ope_match_pid_args  *match_pid_mid = NULL;
+	struct    ope_hw *ope_hw;
+	bool      hfi_en;
+	unsigned long flags;
+	int i;
+	uint32_t device_idx;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_OPE, "Invalid args %x for cmd %u",
+			device_priv, cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &ope_dev->soc_info;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_OPE, "soc_info = %x core_info = %x",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	hfi_en = core_info->ope_hw_info->hfi_en;
+	ope_hw = core_info->ope_hw_info->ope_hw;
+	if (!ope_hw) {
+		CAM_ERR(CAM_OPE, "Invalid ope hw info");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case OPE_HW_PROBE:
+		rc = cam_ope_process_probe(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_ACQUIRE:
+		rc = cam_ope_process_acquire(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_RELEASE:
+		rc = cam_ope_process_release(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_PREPARE:
+		rc = cam_ope_process_prepare(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_START:
+		break;
+	case OPE_HW_STOP:
+		break;
+	case OPE_HW_FLUSH:
+		break;
+	case OPE_HW_RESET:
+		rc = cam_ope_process_reset(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_CLK_UPDATE: {
+		struct cam_ope_dev_clk_update *clk_upd_cmd =
+			(struct cam_ope_dev_clk_update *)cmd_args;
+
+		if (core_info->clk_enable == false) {
+			rc = cam_soc_util_clk_enable_default(soc_info, CAM_CLK_SW_CLIENT_IDX,
+				CAM_SVS_VOTE);
+			if (rc) {
+				CAM_ERR(CAM_OPE, "Clock enable is failed");
+				return rc;
+			}
+			core_info->clk_enable = true;
+		}
+
+		rc = cam_ope_update_clk_rate(soc_info, clk_upd_cmd->clk_rate);
+		if (rc)
+			CAM_ERR(CAM_OPE, "Failed to update clk: %d", rc);
+		}
+		break;
+	case OPE_HW_CLK_DISABLE: {
+		if (core_info->clk_enable == true)
+			cam_soc_util_clk_disable_default(soc_info, CAM_CLK_SW_CLIENT_IDX);
+
+		core_info->clk_enable = false;
+		}
+		break;
+	case OPE_HW_BW_UPDATE: {
+		struct cam_ope_dev_bw_update *cpas_vote = cmd_args;
+
+		if (!cmd_args)
+			return -EINVAL;
+
+		rc = cam_ope_caps_vote(core_info, cpas_vote);
+		if (rc)
+			CAM_ERR(CAM_OPE, "failed to update bw: %d", rc);
+		}
+		break;
+	case OPE_HW_SET_IRQ_CB: {
+		struct cam_ope_set_irq_cb *irq_cb = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_OPE, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		spin_lock_irqsave(&ope_dev->hw_lock, flags);
+		core_info->irq_cb.ope_hw_mgr_cb = irq_cb->ope_hw_mgr_cb;
+		core_info->irq_cb.data = irq_cb->data;
+		spin_unlock_irqrestore(&ope_dev->hw_lock, flags);
+		}
+		break;
+	case OPE_HW_DUMP_DEBUG:
+		rc = cam_ope_process_dump_debug_reg(ope_hw, hfi_en);
+		break;
+	case OPE_HW_MATCH_PID_MID:
+		if (!cmd_args) {
+			CAM_ERR(CAM_OPE, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		match_pid_mid = (struct cam_ope_match_pid_args *)cmd_args;
+		match_pid_mid->mid_match_found = false;
+
+		device_idx = match_pid_mid->device_idx;
+
+		for (i = 0; i < MAX_RW_CLIENTS; i++) {
+			if ((match_pid_mid->fault_mid ==
+				ope_hw->common->ope_mid_info[device_idx][i].mid) &&
+				(match_pid_mid->fault_pid ==
+				ope_hw->common->ope_mid_info[device_idx][i].pid)) {
+				match_pid_mid->match_res =
+				ope_hw->common->ope_mid_info[device_idx][i].cam_ope_res_type;
+				match_pid_mid->mid_match_found = true;
+				break;
+			}
+		}
+		if (!match_pid_mid->mid_match_found) {
+			rc = -1;
+			CAM_INFO(CAM_OPE, "mid match not found");
+		}
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+irqreturn_t cam_ope_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *ope_dev = data;
+	struct cam_ope_device_core_info *core_info = NULL;
+	struct ope_hw *ope_hw;
+	struct cam_ope_irq_data irq_data;
+
+	if (!data) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info or query_cap args");
+		return IRQ_HANDLED;
+	}
+
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	ope_hw = core_info->ope_hw_info->ope_hw;
+
+	irq_data.error = 0;
+	cam_ope_top_process(ope_hw, 0, OPE_HW_ISR, &irq_data);
+	cam_ope_bus_rd_process(ope_hw, 0, OPE_HW_ISR, &irq_data);
+	cam_ope_bus_wr_process(ope_hw, 0, OPE_HW_ISR, &irq_data);
+
+
+	spin_lock(&ope_dev->hw_lock);
+	if (core_info->irq_cb.ope_hw_mgr_cb && core_info->irq_cb.data)
+		if (irq_data.error)
+			core_info->irq_cb.ope_hw_mgr_cb(irq_data.error,
+				core_info->irq_cb.data);
+	spin_unlock(&ope_dev->hw_lock);
+
+
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.h
@@ -0,0 +1,102 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_CORE_H
+#define CAM_OPE_CORE_H
+
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/dma-buf.h>
+#include <media/cam_ope.h>
+#include "cam_cpas_api.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+
+#define CAM_OPE_HW_MAX_NUM_PID 2
+
+/**
+ * struct cam_ope_cpas_vote
+ * @ahb_vote: AHB vote info
+ * @axi_vote: AXI vote info
+ * @ahb_vote_valid: Flag for ahb vote data
+ * @axi_vote_valid: flag for axi vote data
+ */
+struct cam_ope_cpas_vote {
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote;
+	uint32_t ahb_vote_valid;
+	uint32_t axi_vote_valid;
+};
+
+/**
+ * struct cam_ope_device_hw_info
+ *
+ * @ope_hw:          OPE hardware
+ * @hw_idx:          Hardware index
+ * @ope_cdm_base:    Base address of CDM
+ * @ope_top_base:    Base address of top
+ * @ope_qos_base:    Base address of QOS
+ * @ope_pp_base:     Base address of PP
+ * @ope_bus_rd_base: Base address of RD
+ * @ope_bus_wr_base: Base address of WM
+ * @hfi_en:          HFI flag enable
+ * @reserved:        Reserved
+ */
+struct cam_ope_device_hw_info {
+	struct ope_hw *ope_hw;
+	uint32_t hw_idx;
+	void *ope_cdm_base;
+	void *ope_top_base;
+	void *ope_qos_base;
+	void *ope_pp_base;
+	void *ope_bus_rd_base;
+	void *ope_bus_wr_base;
+	bool hfi_en;
+	uint32_t reserved;
+};
+
+/**
+ * struct cam_ope_device_core_info
+ *
+ * @ope_hw_info: OPE hardware info
+ * @hw_version:  Hardware version
+ * @hw_idx:      Hardware Index
+ * @hw_type:     Hardware Type
+ * @cpas_handle: CPAS Handle
+ * @cpas_start:  CPAS start flag
+ * @clk_enable:  Clock enable flag
+ * @irq_cb:      IRQ Callback
+ */
+struct cam_ope_device_core_info {
+	struct cam_ope_device_hw_info *ope_hw_info;
+	uint32_t hw_version;
+	uint32_t hw_idx;
+	uint32_t hw_type;
+	uint32_t cpas_handle;
+	bool cpas_start;
+	bool clk_enable;
+	struct cam_ope_set_irq_cb irq_cb;
+};
+
+int cam_ope_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ope_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ope_start(void *device_priv,
+	void *start_args, uint32_t arg_size);
+int cam_ope_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_ope_flush(void *device_priv,
+	void *flush_args, uint32_t arg_size);
+int cam_ope_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_ope_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+irqreturn_t cam_ope_irq(int irq_num, void *data);
+
+#endif /* CAM_OPE_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev.c
@@ -0,0 +1,332 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_hw.h"
+#include "ope_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_ope_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "ope_hw_100.h"
+#include "ope_dev_intf.h"
+#include "camera_main.h"
+
+static struct cam_ope_hw_intf_data cam_ope_dev_list[OPE_DEV_MAX];
+static struct cam_ope_device_hw_info ope_hw_info;
+struct cam_ope_soc_private ope_soc_info;
+EXPORT_SYMBOL(ope_soc_info);
+
+static struct hw_version_reg ope_hw_version_reg = {
+	.hw_ver = 0x0,
+};
+
+static int cam_ope_init_hw_version(struct cam_hw_soc_info *soc_info,
+	struct cam_ope_device_core_info *core_info)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_OPE, "soc_info = %x core_info = %x",
+		soc_info, core_info);
+	CAM_DBG(CAM_OPE, "CDM:%x TOP: %x QOS: %x PP: %x RD: %x WR: %x",
+		soc_info->reg_map[OPE_CDM_BASE].mem_base,
+		soc_info->reg_map[OPE_TOP_BASE].mem_base,
+		soc_info->reg_map[OPE_QOS_BASE].mem_base,
+		soc_info->reg_map[OPE_PP_BASE].mem_base,
+		soc_info->reg_map[OPE_BUS_RD].mem_base,
+		soc_info->reg_map[OPE_BUS_WR].mem_base);
+	CAM_DBG(CAM_OPE, "core: %x",
+		core_info->ope_hw_info->ope_cdm_base);
+
+	core_info->ope_hw_info->ope_cdm_base =
+		soc_info->reg_map[OPE_CDM_BASE].mem_base;
+	core_info->ope_hw_info->ope_top_base =
+		soc_info->reg_map[OPE_TOP_BASE].mem_base;
+	core_info->ope_hw_info->ope_qos_base =
+		soc_info->reg_map[OPE_QOS_BASE].mem_base;
+	core_info->ope_hw_info->ope_pp_base =
+		soc_info->reg_map[OPE_PP_BASE].mem_base;
+	core_info->ope_hw_info->ope_bus_rd_base =
+		soc_info->reg_map[OPE_BUS_RD].mem_base;
+	core_info->ope_hw_info->ope_bus_wr_base =
+		soc_info->reg_map[OPE_BUS_WR].mem_base;
+
+	core_info->hw_version = cam_io_r_mb(
+			core_info->ope_hw_info->ope_top_base +
+			ope_hw_version_reg.hw_ver);
+
+	switch (core_info->hw_version) {
+	case OPE_HW_VER_1_0_0:
+	case OPE_HW_VER_1_1_0:
+		core_info->ope_hw_info->ope_hw = &ope_hw_100;
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Unsupported version : %u",
+			core_info->hw_version);
+		rc = -EINVAL;
+		break;
+	}
+
+	ope_hw_100.top_reg->base = core_info->ope_hw_info->ope_top_base;
+	ope_hw_100.bus_rd_reg->base = core_info->ope_hw_info->ope_bus_rd_base;
+	ope_hw_100.bus_wr_reg->base = core_info->ope_hw_info->ope_bus_wr_base;
+	ope_hw_100.pp_reg->base = core_info->ope_hw_info->ope_pp_base;
+
+	return rc;
+}
+
+int cam_ope_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_ope_device_core_info *core_info,
+	uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "ope", sizeof("ope"));
+	cpas_register_params.cam_cpas_client_cb = NULL;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_ope_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf                *ope_dev_intf = NULL;
+	struct cam_hw_info                *ope_dev = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_ope_device_core_info   *core_info = NULL;
+	struct cam_ope_dev_probe           ope_probe;
+	struct cam_ope_cpas_vote           cpas_vote;
+	struct cam_ope_soc_private        *soc_private;
+	int i;
+	uint32_t hw_idx;
+	int rc = 0;
+
+	struct platform_device *pdev = to_platform_device(dev);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &hw_idx);
+
+	ope_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!ope_dev_intf)
+		return -ENOMEM;
+
+	ope_dev_intf->hw_idx = hw_idx;
+	ope_dev_intf->hw_type = OPE_DEV_OPE;
+	ope_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!ope_dev) {
+		rc = -ENOMEM;
+		goto ope_dev_alloc_failed;
+	}
+
+	ope_dev->soc_info.pdev = pdev;
+	ope_dev->soc_info.dev = &pdev->dev;
+	ope_dev->soc_info.dev_name = pdev->name;
+	ope_dev_intf->hw_priv = ope_dev;
+	ope_dev_intf->hw_ops.init = cam_ope_init_hw;
+	ope_dev_intf->hw_ops.deinit = cam_ope_deinit_hw;
+	ope_dev_intf->hw_ops.get_hw_caps = cam_ope_get_hw_caps;
+	ope_dev_intf->hw_ops.start = cam_ope_start;
+	ope_dev_intf->hw_ops.stop = cam_ope_stop;
+	ope_dev_intf->hw_ops.flush = cam_ope_flush;
+	ope_dev_intf->hw_ops.process_cmd = cam_ope_process_cmd;
+
+	CAM_DBG(CAM_OPE, "type %d index %d",
+		ope_dev_intf->hw_type,
+		ope_dev_intf->hw_idx);
+
+	if (ope_dev_intf->hw_idx < OPE_DEV_MAX)
+		cam_ope_dev_list[ope_dev_intf->hw_idx].hw_intf =
+			ope_dev_intf;
+
+	platform_set_drvdata(pdev, ope_dev_intf);
+
+
+	ope_dev->core_info = kzalloc(sizeof(struct cam_ope_device_core_info),
+		GFP_KERNEL);
+	if (!ope_dev->core_info) {
+		rc = -ENOMEM;
+		goto ope_core_alloc_failed;
+	}
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	core_info->ope_hw_info = &ope_hw_info;
+	ope_dev->soc_info.soc_private = &ope_soc_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		rc = -EINVAL;
+		CAM_DBG(CAM_OPE, "No ope hardware info");
+		goto ope_match_dev_failed;
+	}
+
+	rc = cam_ope_init_soc_resources(&ope_dev->soc_info, cam_ope_irq,
+		ope_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "failed to init_soc");
+		goto init_soc_failed;
+	}
+	core_info->hw_type = OPE_DEV_OPE;
+	core_info->hw_idx = hw_idx;
+	rc = cam_ope_register_cpas(&ope_dev->soc_info,
+		core_info, ope_dev_intf->hw_idx);
+	if (rc < 0)
+		goto register_cpas_failed;
+
+	rc = cam_ope_enable_soc_resources(&ope_dev->soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "enable soc resorce failed: %d", rc);
+		goto enable_soc_failed;
+	}
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_AXI_PATH_DATA_OPE_WR_VID;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_AXI_TRANSACTION_WRITE;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].ddr_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].ddr_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+
+	rc = cam_ope_init_hw_version(&ope_dev->soc_info, ope_dev->core_info);
+	if (rc)
+		goto init_hw_failure;
+
+	cam_ope_disable_soc_resources(&ope_dev->soc_info, true);
+	cam_cpas_stop(core_info->cpas_handle);
+	ope_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	ope_probe.hfi_en = ope_soc_info.hfi_en;
+	cam_ope_process_cmd(ope_dev, OPE_HW_PROBE,
+		&ope_probe, sizeof(ope_probe));
+	mutex_init(&ope_dev->hw_mutex);
+	spin_lock_init(&ope_dev->hw_lock);
+	init_completion(&ope_dev->hw_complete);
+
+	CAM_DBG(CAM_OPE, "OPE:%d component bound successfully",
+		ope_dev_intf->hw_idx);
+	soc_private = ope_dev->soc_info.soc_private;
+	cam_ope_dev_list[ope_dev_intf->hw_idx].num_hw_pid =
+		soc_private->num_pid;
+
+	for (i = 0; i < soc_private->num_pid; i++)
+		cam_ope_dev_list[ope_dev_intf->hw_idx].hw_pid[i] =
+			soc_private->pid[i];
+
+	return rc;
+
+init_hw_failure:
+enable_soc_failed:
+register_cpas_failed:
+init_soc_failed:
+ope_match_dev_failed:
+	kfree(ope_dev->core_info);
+ope_core_alloc_failed:
+	kfree(ope_dev);
+ope_dev_alloc_failed:
+	kfree(ope_dev_intf);
+	return rc;
+}
+
+static void cam_ope_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_OPE, "Unbinding component: %s", pdev->name);
+}
+
+int cam_ope_hw_init(struct cam_ope_hw_intf_data **ope_hw_intf_data,
+		uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_ope_dev_list[hw_idx].hw_intf) {
+		*ope_hw_intf_data = &cam_ope_dev_list[hw_idx];
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_OPE, "inval param");
+		*ope_hw_intf_data = NULL;
+		rc = -ENODEV;
+	}
+	return rc;
+}
+
+const static struct component_ops cam_ope_component_ops = {
+	.bind = cam_ope_component_bind,
+	.unbind = cam_ope_component_unbind,
+};
+
+int cam_ope_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_OPE, "Adding OPE component");
+	rc = component_add(&pdev->dev, &cam_ope_component_ops);
+	if (rc)
+		CAM_ERR(CAM_OPE, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static const struct of_device_id cam_ope_dt_match[] = {
+	{
+		.compatible = "qcom,ope",
+		.data = &ope_hw_version_reg,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_ope_dt_match);
+
+struct platform_driver cam_ope_driver = {
+	.probe = cam_ope_probe,
+	.driver = {
+		.name = "ope",
+		.of_match_table = cam_ope_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ope_init_module(void)
+{
+	return platform_driver_register(&cam_ope_driver);
+}
+
+void cam_ope_exit_module(void)
+{
+	platform_driver_unregister(&cam_ope_driver);
+}
+
+MODULE_DESCRIPTION("CAM OPE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev_intf.h
@@ -0,0 +1,186 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_DEV_INTF_H
+#define CAM_OPE_DEV_INTF_H
+
+#include <media/cam_ope.h>
+#include "cam_ope_hw_mgr.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cpas_api.h"
+
+
+#define OPE_HW_INIT          0x1
+#define OPE_HW_DEINIT        0x2
+#define OPE_HW_ACQUIRE       0x3
+#define OPE_HW_RELEASE       0x4
+#define OPE_HW_START         0x5
+#define OPE_HW_STOP          0x6
+#define OPE_HW_FLUSH         0x7
+#define OPE_HW_PREPARE       0x8
+#define OPE_HW_ISR           0x9
+#define OPE_HW_PROBE         0xA
+#define OPE_HW_CLK_UPDATE    0xB
+#define OPE_HW_BW_UPDATE     0xC
+#define OPE_HW_RESET         0xD
+#define OPE_HW_SET_IRQ_CB    0xE
+#define OPE_HW_CLK_DISABLE   0xF
+#define OPE_HW_CLK_ENABLE    0x10
+#define OPE_HW_DUMP_DEBUG    0x11
+#define OPE_HW_MATCH_PID_MID     0x12
+
+struct cam_ope_match_pid_args {
+	uint32_t    fault_pid;
+	uint32_t    fault_mid;
+	uint32_t    match_res;
+	uint32_t    device_idx;
+	bool        mid_match_found;
+};
+
+/**
+ * struct cam_ope_dev_probe
+ *
+ * @hfi_en: HFI enable flag
+ */
+struct cam_ope_dev_probe {
+	bool hfi_en;
+};
+
+/**
+ * struct cam_ope_dev_init
+ *
+ * @hfi_en:    HFI enable flag
+ * @core_info: OPE core info
+ */
+struct cam_ope_dev_init {
+	bool hfi_en;
+	struct cam_ope_device_core_info *core_info;
+};
+
+/**
+ * struct cam_ope_dev_clk_update
+ *
+ * @clk_rate: Clock rate
+ */
+struct cam_ope_dev_clk_update {
+	uint32_t clk_rate;
+};
+
+/**
+ * struct cam_ope_dev_bw_update
+ *
+ * @ahb_vote:       AHB vote info
+ * @axi_vote:       AXI vote info
+ * @ahb_vote_valid: Flag for ahb vote
+ * @axi_vote_valid: Flag for axi vote
+ */
+struct cam_ope_dev_bw_update {
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote;
+	uint32_t ahb_vote_valid;
+	uint32_t axi_vote_valid;
+};
+
+/**
+ * struct cam_ope_dev_caps
+ *
+ * @hw_idx: Hardware index
+ * @hw_ver: Hardware version info
+ */
+struct cam_ope_dev_caps {
+	uint32_t hw_idx;
+	struct ope_hw_ver hw_ver;
+};
+
+/**
+ * struct cam_ope_dev_acquire
+ *
+ * @ctx_id:      Context id
+ * @ope_acquire: OPE acquire info
+ * @bus_wr_ctx:  Bus Write context
+ * @bus_rd_ctx:  Bus Read context
+ */
+struct cam_ope_dev_acquire {
+	uint32_t ctx_id;
+	struct ope_acquire_dev_info *ope_acquire;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+};
+
+/**
+ * struct cam_ope_dev_release
+ *
+ * @ctx_id:      Context id
+ * @bus_wr_ctx:  Bus Write context
+ * @bus_rd_ctx:  Bus Read context
+ */
+struct cam_ope_dev_release {
+	uint32_t ctx_id;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+};
+
+/**
+ * struct cam_ope_set_irq_cb
+ *
+ * @ope_hw_mgr_cb: Callback to hardware manager
+ * @data:          Private data
+ */
+struct cam_ope_set_irq_cb {
+	int32_t (*ope_hw_mgr_cb)(uint32_t irq_status, void *data);
+	void *data;
+};
+
+/**
+ * struct cam_ope_irq_data
+ *
+ * @error: IRQ error
+ */
+struct cam_ope_irq_data {
+	uint32_t error;
+};
+
+/**
+ * struct cam_ope_dev_prepare_req
+ *
+ * @hw_mgr:         OPE hardware manager
+ * @packet:         Packet
+ * @prepare_args:   Prepare request args
+ * @ctx_data:       Context data
+ * @wr_cdm_batch:   WM request
+ * @rd_cdm_batch:   RD master request
+ * @frame_process:  Frame process command
+ * @req_idx:        Request Index
+ * @kmd_buf_offset: KMD buffer offset
+ */
+struct cam_ope_dev_prepare_req {
+	struct cam_ope_hw_mgr *hw_mgr;
+	struct cam_packet *packet;
+	struct cam_hw_prepare_update_args *prepare_args;
+	struct cam_ope_ctx *ctx_data;
+	struct ope_bus_wr_io_port_cdm_batch *wr_cdm_batch;
+	struct ope_bus_rd_io_port_cdm_batch *rd_cdm_batch;
+	struct ope_frame_process *frame_process;
+	uint32_t req_idx;
+	uint32_t kmd_buf_offset;
+};
+
+int cam_ope_top_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data);
+
+int cam_ope_bus_rd_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data);
+
+int cam_ope_bus_wr_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data);
+
+int cam_ope_init_module(void);
+void cam_ope_exit_module(void);
+
+int cam_ope_subdev_init_module(void);
+void cam_ope_subdev_exit_module(void);
+
+#endif /* CAM_OPE_DEV_INTF_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_hw.h
@@ -0,0 +1,435 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_HW_H
+#define CAM_OPE_HW_H
+
+#define OPE_HW_VER_1_0_0 0x10000000
+#define OPE_HW_VER_1_1_0 0x10010000
+
+#define OPE_DEV_OPE  0
+#define OPE_DEV_MAX  1
+
+#define MAX_RD_CLIENTS   3
+#define MAX_WR_CLIENTS   8
+#define MAX_PP_CLIENTS   32
+
+#define MAX_RW_CLIENTS   (MAX_RD_CLIENTS + MAX_WR_CLIENTS)
+
+#define OPE_CDM_BASE     0x0
+#define OPE_TOP_BASE     0x1
+#define OPE_QOS_BASE     0x2
+#define OPE_PP_BASE      0x3
+#define OPE_BUS_RD       0x4
+#define OPE_BUS_WR       0x5
+#define OPE_BASE_MAX     0x6
+
+#define BUS_RD_COMBO_BAYER_MASK   0x1
+#define BUS_RD_COMBO_YUV_MASK     0x2
+#define BUS_RD_COMBO_MAX          0x2
+
+#define BUS_RD_BAYER         0x0
+#define BUS_RD_YUV           0x1
+
+#define BUS_WR_COMBO_YUV_MASK    0x1
+#define BUS_WR_COMBO_MAX         0x1
+
+#define BUS_WR_YUV           0x0
+
+#define BUS_WR_VIDEO_Y       0x0
+#define BUS_WR_VIDEO_C       0x1
+#define BUS_WR_DISP_Y        0x2
+#define BUS_WR_DISP_C        0x3
+#define BUS_WR_ARGB          0x4
+#define BUS_WR_STATS_RS      0x5
+#define BUS_WR_STATS_IHIST   0x6
+#define BUS_WR_STATS_LTM     0x7
+
+#define OPE_WAIT_COMP_RUP     0x1
+#define OPE_WAIT_COMP_WR_DONE 0x2
+#define OPE_WAIT_COMP_IDLE    0x4
+#define OPE_WAIT_COMP_GEN_IRQ 0x8
+
+#define OPE_MAX_DEBUG_REGISTER 30
+
+struct cam_ope_pid_mid_info {
+	int cam_ope_res_type;
+	uint32_t pid;
+	uint32_t mid;
+	bool read;
+};
+
+struct cam_ope_common {
+	uint32_t mode[CAM_FORMAT_MAX];
+	struct cam_ope_pid_mid_info (*ope_mid_info)[MAX_RW_CLIENTS];
+};
+
+struct cam_ope_top_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t reset_cmd;
+	uint32_t core_clk_cfg_ctrl_0;
+	uint32_t ahb_clk_cgc_ctrl;
+	uint32_t core_cfg;
+	uint32_t irq_status;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_set;
+	uint32_t irq_cmd;
+	uint32_t violation_status;
+	uint32_t throttle_cnt_cfg;
+	uint32_t debug_cfg;
+	uint32_t scratch_reg;
+	uint32_t num_debug_registers;
+	struct cam_ope_debug_register *debug_regs;
+};
+
+struct cam_ope_top_reg_val {
+	uint32_t hw_version;
+	uint32_t major_mask;
+	uint32_t major_shift;
+	uint32_t minor_mask;
+	uint32_t minor_shift;
+	uint32_t incr_mask;
+	uint32_t incr_shift;
+	uint32_t irq_mask;
+	uint32_t irq_set_clear;
+	uint32_t sw_reset_cmd;
+	uint32_t hw_reset_cmd;
+	uint32_t core_clk_cfg_ctrl_0;
+	uint32_t ahb_clk_cgc_ctrl;
+	uint32_t input_format;
+	uint32_t input_format_mask;
+	uint32_t color_correct_src_sel;
+	uint32_t color_correct_src_sel_mask;
+	uint32_t stats_ihist_src_sel;
+	uint32_t stats_ihist_src_sel_mask;
+	uint32_t chroma_up_src_sel;
+	uint32_t chroma_up_src_sel_mask;
+	uint32_t argb_alpha;
+	uint32_t argb_alpha_mask;
+	uint32_t rs_throttle_cnt;
+	uint32_t rs_throttle_cnt_mask;
+	uint32_t ihist_throttle_cnt;
+	uint32_t ihist_throttle_cnt_mask;
+	uint32_t rst_done;
+	uint32_t we_done;
+	uint32_t fe_done;
+	uint32_t ope_violation;
+	uint32_t idle;
+	uint32_t debug_cfg_val;
+};
+
+struct cam_ope_qos_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t hw_status;
+	uint32_t module_cfg;
+	uint32_t curve_cfg_0;
+	uint32_t curve_cfg_1;
+	uint32_t window_cfg;
+	uint32_t eos_status_0;
+	uint32_t eos_status_1;
+	uint32_t eos_status_2;
+};
+
+struct cam_ope_qos_reg_val {
+	uint32_t hw_version;
+	uint32_t proc_interval;
+	uint32_t proc_interval_mask;
+	uint32_t static_health;
+	uint32_t static_health_mask;
+	uint32_t module_cfg_en;
+	uint32_t module_cfg_en_mask;
+	uint32_t yexp_ymin_dec;
+	uint32_t yexp_ymin_dec_mask;
+	uint32_t ymin_inc;
+	uint32_t ymin_inc_mask;
+	uint32_t initial_delta;
+	uint32_t initial_delta_mask;
+	uint32_t window_cfg;
+};
+
+struct cam_ope_bus_rd_client_reg {
+	uint32_t core_cfg;
+	uint32_t ccif_meta_data;
+	uint32_t img_addr;
+	uint32_t img_cfg;
+	uint32_t stride;
+	uint32_t unpack_cfg;
+	uint32_t latency_buf_allocation;
+	uint32_t misr_cfg_0;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_val;
+};
+
+struct cam_ope_bus_rd_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t sw_reset;
+	uint32_t cgc_override;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_cmd;
+	uint32_t irq_status;
+	uint32_t input_if_cmd;
+	uint32_t irq_set;
+	uint32_t misr_reset;
+	uint32_t security_cfg;
+	uint32_t iso_cfg;
+	uint32_t iso_seed;
+
+	uint32_t num_clients;
+	struct cam_ope_bus_rd_client_reg rd_clients[MAX_RD_CLIENTS];
+};
+
+struct cam_ope_bus_rd_client_reg_val {
+	uint32_t core_cfg;
+	uint32_t stripe_location;
+	uint32_t stripe_location_mask;
+	uint32_t stripe_location_shift;
+	uint32_t pix_pattern;
+	uint32_t pix_pattern_mask;
+	uint32_t pix_pattern_shift;
+	uint32_t img_addr;
+	uint32_t img_width;
+	uint32_t img_width_mask;
+	uint32_t img_width_shift;
+	uint32_t img_height;
+	uint32_t img_height_mask;
+	uint32_t img_height_shift;
+	uint32_t stride;
+	uint32_t mode;
+	uint32_t mode_mask;
+	uint32_t mode_shift;
+	uint32_t alignment;
+	uint32_t alignment_mask;
+	uint32_t alignment_shift;
+	uint32_t latency_buf_allocation;
+	uint32_t misr_cfg_samp_mode;
+	uint32_t misr_cfg_samp_mode_mask;
+	uint32_t misr_cfg_en;
+	uint32_t misr_cfg_en_mask;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_val;
+	uint32_t input_port_id;
+	uint32_t rm_port_id;
+	uint32_t format_type;
+	uint32_t num_combos_supported;
+};
+
+struct cam_ope_bus_rd_reg_val {
+	uint32_t hw_version;
+	uint32_t sw_reset;
+	uint32_t cgc_override;
+	uint32_t irq_mask;
+	uint32_t go_cmd;
+	uint32_t go_cmd_mask;
+	uint32_t ica_en;
+	uint32_t ica_en_mask;
+	uint32_t static_prg;
+	uint32_t static_prg_mask;
+	uint32_t go_cmd_sel;
+	uint32_t go_cmd_sel_mask;
+	uint32_t fs_sync_en;
+	uint32_t fs_sync_en_mask;
+	uint32_t misr_reset;
+	uint32_t security_cfg;
+	uint32_t iso_bpp_select;
+	uint32_t iso_bpp_select_mask;
+	uint32_t iso_pattern_select;
+	uint32_t iso_pattern_select_mask;
+	uint32_t iso_en;
+	uint32_t iso_en_mask;
+	uint32_t iso_seed;
+	uint32_t irq_set_clear;
+	uint32_t rst_done;
+	uint32_t rup_done;
+	uint32_t rd_buf_done;
+	uint32_t violation;
+	uint32_t latency_buf_size;
+
+	uint32_t num_clients;
+	struct cam_ope_bus_rd_client_reg_val rd_clients[MAX_RD_CLIENTS];
+};
+
+struct cam_ope_bus_wr_client_reg {
+	uint32_t core_cfg;
+	uint32_t img_addr;
+	uint32_t img_cfg;
+	uint32_t x_init;
+	uint32_t stride;
+	uint32_t pack_cfg;
+	uint32_t bw_limit;
+	uint32_t frame_header_addr;
+	uint32_t subsample_period;
+	uint32_t subsample_pattern;
+};
+
+struct cam_ope_bus_wr_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t cgc_override;
+	uint32_t irq_mask_0;
+	uint32_t irq_mask_1;
+	uint32_t irq_clear_0;
+	uint32_t irq_clear_1;
+	uint32_t irq_status_0;
+	uint32_t irq_status_1;
+	uint32_t irq_cmd;
+	uint32_t frame_header_cfg_0;
+	uint32_t local_frame_header_cfg_0;
+	uint32_t irq_set_0;
+	uint32_t irq_set_1;
+	uint32_t iso_cfg;
+	uint32_t violation_status;
+	uint32_t image_size_violation_status;
+	uint32_t misr_cfg_0;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_sel;
+	uint32_t misr_reset;
+	uint32_t misr_val;
+	uint32_t num_clients;
+	struct cam_ope_bus_wr_client_reg wr_clients[MAX_WR_CLIENTS];
+};
+
+struct cam_ope_bus_wr_client_reg_val {
+	uint32_t core_cfg_en;
+	uint32_t core_cfg_en_mask;
+	uint32_t core_cfg_en_shift;
+	uint32_t virtual_frame_en;
+	uint32_t virtual_frame_en_mask;
+	uint32_t virtual_frame_en_shift;
+	uint32_t frame_header_en;
+	uint32_t frame_header_en_mask;
+	uint32_t frame_header_en_shift;
+	uint32_t auto_recovery_en;
+	uint32_t auto_recovery_en_mask;
+	uint32_t auto_recovery_en_shift;
+	uint32_t mode;
+	uint32_t mode_mask;
+	uint32_t mode_shift;
+	uint32_t img_addr;
+	uint32_t width;
+	uint32_t width_mask;
+	uint32_t width_shift;
+	uint32_t height;
+	uint32_t height_mask;
+	uint32_t height_shift;
+	uint32_t x_init;
+	uint32_t stride;
+	uint32_t format;
+	uint32_t format_mask;
+	uint32_t format_shift;
+	uint32_t alignment;
+	uint32_t alignment_mask;
+	uint32_t alignment_shift;
+	uint32_t bw_limit_en;
+	uint32_t bw_limit_en_mask;
+	uint32_t bw_limit_counter;
+	uint32_t bw_limit_counter_mask;
+	uint32_t frame_header_addr;
+	uint32_t subsample_period;
+	uint32_t subsample_pattern;
+	uint32_t output_port_id;
+	uint32_t wm_port_id;
+	uint32_t format_type;
+	uint32_t num_combos_supported;
+};
+
+struct cam_ope_bus_wr_reg_val {
+	uint32_t hw_version;
+	uint32_t cgc_override;
+	uint32_t irq_mask_0;
+	uint32_t irq_mask_1;
+	uint32_t irq_set_clear;
+	uint32_t comp_rup_done;
+	uint32_t comp_buf_done;
+	uint32_t cons_violation;
+	uint32_t violation;
+	uint32_t img_size_violation;
+	uint32_t frame_header_cfg_0;
+	uint32_t local_frame_header_cfg_0;
+	uint32_t iso_cfg;
+	uint32_t misr_0_en;
+	uint32_t misr_0_en_mask;
+	uint32_t misr_1_en;
+	uint32_t misr_1_en_mask;
+	uint32_t misr_2_en;
+	uint32_t misr_2_en_mask;
+	uint32_t misr_3_en;
+	uint32_t misr_3_en_mask;
+	uint32_t misr_0_samp_mode;
+	uint32_t misr_0_samp_mode_mask;
+	uint32_t misr_1_samp_mode;
+	uint32_t misr_1_samp_mode_mask;
+	uint32_t misr_2_samp_mode;
+	uint32_t misr_2_samp_mode_mask;
+	uint32_t misr_3_samp_mode;
+	uint32_t misr_3_samp_mode_mask;
+	uint32_t misr_0_id;
+	uint32_t misr_0_id_mask;
+	uint32_t misr_1_id;
+	uint32_t misr_1_id_mask;
+	uint32_t misr_2_id;
+	uint32_t misr_2_id_mask;
+	uint32_t misr_3_id;
+	uint32_t misr_3_id_mask;
+	uint32_t misr_rd_misr_sel;
+	uint32_t misr_rd_misr_sel_mask;
+	uint32_t misr_rd_word_sel;
+	uint32_t misr_rd_word_sel_mask;
+	uint32_t misr_reset;
+	uint32_t misr_val;
+
+
+	uint32_t num_clients;
+	struct cam_ope_bus_wr_client_reg_val wr_clients[MAX_WR_CLIENTS];
+};
+
+struct cam_ope_debug_register {
+	uint32_t offset;
+};
+
+struct cam_ope_bus_pp_client_reg {
+	uint32_t hw_status;
+};
+
+struct cam_ope_pp_reg {
+	void *base;
+	uint32_t offset;
+
+	uint32_t num_clients;
+	struct cam_ope_bus_pp_client_reg pp_clients[MAX_PP_CLIENTS];
+};
+
+struct ope_hw {
+	struct cam_ope_top_reg        *top_reg;
+	struct cam_ope_top_reg_val    *top_reg_val;
+
+	struct cam_ope_bus_rd_reg     *bus_rd_reg;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+
+	struct cam_ope_bus_wr_reg     *bus_wr_reg;
+	struct cam_ope_bus_wr_reg_val *bus_wr_reg_val;
+
+	struct cam_ope_qos_reg        *qos_reg;
+	struct cam_ope_qos_reg_val    *qos_reg_val;
+
+	struct cam_ope_common         *common;
+
+	struct cam_ope_pp_reg        *pp_reg;
+};
+
+struct hw_version_reg {
+	uint32_t hw_ver;
+	uint32_t reserved;
+};
+
+#endif /* CAM_OPE_HW_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_hw_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_hw_100.h
@@ -0,0 +1,752 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_HW_100_H
+#define CAM_OPE_HW_100_H
+
+#define OPE_BUS_RD_TYPE_BAYER            0x0
+#define OPE_BUS_RD_TYPE_YUV_Y            0x0
+#define OPE_BUS_RD_TYPE_YUC_C            0x1
+#define OPE_BUS_RD_TYPE_CDM              0x2
+
+#define OPE_BUS_WR_TYPE_VID_Y            0x0
+#define OPE_BUS_WR_TYPE_VID_C            0x1
+#define OPE_BUS_WR_TYPE_DISP_Y           0x2
+#define OPE_BUS_WR_TYPE_DISP_C           0x3
+#define OPE_BUS_WR_TYPE_ARGB             0x4
+#define OPE_BUS_WR_TYPE_RS               0x5
+#define OPE_BUS_WR_TYPE_IHIST            0x6
+#define OPE_BUS_WR_TYPE_LTM              0x7
+
+static struct cam_ope_pid_mid_info g_ope_mid_info[OPE_DEV_MAX][MAX_RW_CLIENTS] = {
+	{
+		{
+			.cam_ope_res_type = OPE_IN_RES_FULL,
+			.pid = 0,
+			.mid = 0,
+			.read = true,
+		},
+		{
+			.cam_ope_res_type = OPE_IN_RES_FULL,
+			.pid = 0,
+			.mid = 1,
+			.read = true,
+		},
+		{
+			.cam_ope_res_type = OPE_IN_RES_FULL,
+			.pid = 0,
+			.mid = 2,
+			.read = true,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_VIDEO,
+			.pid = 1,
+			.mid = 16,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_VIDEO,
+			.pid = 1,
+			.mid = 17,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_DISP,
+			.pid = 1,
+			.mid = 18,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_DISP,
+			.pid = 1,
+			.mid = 19,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_ARGB,
+			.pid = 1,
+			.mid = 20,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_STATS_RS,
+			.pid = 1,
+			.mid = 21,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_STATS_IHIST,
+			.pid = 1,
+			.mid = 22,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_STATS_LTM,
+			.pid = 1,
+			.mid = 23,
+			.read = false,
+		},
+	},
+};
+
+static struct cam_ope_common common_data = {
+	.ope_mid_info = g_ope_mid_info,
+};
+
+enum cam_ope_bus_rd_unpacker_format {
+	BUS_RD_VER1_PACKER_FMT_PLAIN_128_BYPASS            = 0x0,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_8                     = 0x1,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_16_10BPP              = 0x2,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_16_12BPP              = 0x3,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_16_14BPP              = 0x4,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_32_20BPP              = 0x5,
+	BUS_RD_VER1_PACKER_FMT_ARGB16_10                   = 0x6,
+	BUS_RD_VER1_PACKER_FMT_ARGB16_12                   = 0x7,
+	BUS_RD_VER1_PACKER_FMT_ARGB16_14                   = 0x8,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_32                    = 0x9,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_64                    = 0xA,
+	BUS_RD_VER1_PACKER_FMT_TP_10                       = 0xB,
+	BUS_RD_VER1_PACKER_FMT_MIPI_8                      = 0xC,
+	BUS_RD_VER1_PACKER_FMT_MIPI_10                     = 0xD,
+	BUS_RD_VER1_PACKER_FMT_MIPI_12                     = 0xE,
+	BUS_RD_VER1_PACKER_FMT_MIPI_14                     = 0xF,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_16_16BPP              = 0x10,
+	BUS_RD_VER1_PACKER_FMT_BYPASS_SWAP                 = 0x11,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_8_SWAP                = 0x12,
+	BUS_RD_VER1_PACKER_FMT_MAX                         = 0x13,
+};
+
+static struct cam_ope_debug_register ope_debug_regs[OPE_MAX_DEBUG_REGISTER] = {
+	{
+		.offset = 0xA0,
+	},
+	{
+		.offset = 0xA4
+	},
+	{
+		.offset = 0xA8,
+	},
+	{
+		.offset = 0xAC,
+	},
+	{
+		.offset = 0xB0,
+	},
+	{
+		.offset = 0xB4,
+	},
+	{
+		.offset = 0xB8,
+	},
+	{
+		.offset = 0xBC,
+	},
+	{
+		.offset = 0xD0,
+	},
+	{
+		.offset = 0xD4,
+	},
+};
+
+static struct cam_ope_top_reg ope_top_reg = {
+	.offset              = 0x400,
+	.hw_version          = 0x0,
+	.reset_cmd           = 0x4,
+	.core_clk_cfg_ctrl_0 = 0x8,
+	.ahb_clk_cgc_ctrl    = 0xC,
+	.core_cfg            = 0x10,
+	.irq_status          = 0x14,
+	.irq_mask            = 0x18,
+	.irq_clear           = 0x1C,
+	.irq_set             = 0x20,
+	.irq_cmd             = 0x24,
+	.violation_status    = 0x28,
+	.throttle_cnt_cfg    = 0x2C,
+	.debug_cfg           = 0xDC,
+	.scratch_reg         = 0x1F0,
+	.num_debug_registers = 10,
+	.debug_regs          = ope_debug_regs,
+};
+
+static struct cam_ope_top_reg_val ope_top_reg_val = {
+	.hw_version    = 0x10000000,
+	.major_mask    = 0xFFFF,
+	.major_shift   = 0x0,
+	.minor_mask    = 0x0FFF0000,
+	.minor_shift   = 0xF,
+	.incr_mask     = 0xF0000000,
+	.incr_shift    = 0x1B,
+	.irq_mask      = 0x0000000F,
+	.sw_reset_cmd  = 0x2,
+	.hw_reset_cmd  = 0x1,
+	.irq_set_clear = 0x1,
+	.rst_done      = 0x1,
+	.we_done       = 0x2,
+	.fe_done       = 0x4,
+	.ope_violation = 0x8,
+	.idle          = 0x10,
+	.debug_cfg_val = 0x1,
+};
+
+
+static struct cam_ope_bus_rd_reg_val ope_bus_rd_reg_val = {
+	.hw_version = 0x00050000,
+	.sw_reset = 0x1,
+	.cgc_override = 0x0,
+	.irq_mask   = 0x30001,
+	.irq_set_clear = 0x1,
+	.rst_done      = 0x1,
+	.rup_done      = 0x2,
+	.rd_buf_done   = 0xC,
+	.violation     = 0x3000,
+	.go_cmd = 0x1,
+	.security_cfg = 0x0,
+	.latency_buf_size = 4096,
+	.num_clients = 0x2,
+	.rd_clients = {
+		{
+			.core_cfg = 0x1,
+			.stripe_location_mask = 0x3,
+			.stripe_location_shift = 0x0,
+			.pix_pattern_mask = 0x3F,
+			.pix_pattern_shift = 0x2,
+			.img_width_mask = 0xFFFF,
+			.img_width_shift = 0x10,
+			.img_height_mask = 0xFFFF,
+			.img_height_shift = 0x0,
+			.mode_mask = 0x1F,
+			.mode_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x5,
+			.latency_buf_allocation = 4096,
+			.input_port_id = OPE_IN_RES_FULL,
+			.rm_port_id = 0,
+			.format_type = BUS_RD_COMBO_BAYER_MASK |
+				BUS_RD_COMBO_YUV_MASK,
+			.num_combos_supported = 2,
+		},
+		{
+			.core_cfg = 0x1,
+			.stripe_location_mask = 0x3,
+			.stripe_location_shift = 0x0,
+			.pix_pattern_mask = 0x3F,
+			.pix_pattern_shift = 0x2,
+			.img_width_mask = 0xFFFF,
+			.img_width_shift = 0x10,
+			.img_height_mask = 0xFFFF,
+			.img_height_shift = 0x0,
+			.mode_mask = 0x1F,
+			.mode_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x5,
+			.latency_buf_allocation = 4096,
+			.input_port_id = OPE_IN_RES_FULL,
+			.rm_port_id = 1,
+			.format_type = BUS_RD_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+
+		},
+	},
+};
+
+static struct cam_ope_bus_rd_reg ope_bus_rd_reg = {
+	.offset = 0x4C00,
+	.hw_version = 0x0,
+	.sw_reset = 0x4,
+	.cgc_override = 0x8,
+	.irq_mask = 0xC,
+	.irq_clear = 0x10,
+	.irq_cmd = 0x14,
+	.irq_status = 0x18,
+	.input_if_cmd = 0x1C,
+	.irq_set = 0x20,
+	.misr_reset = 0x24,
+	.security_cfg = 0x28,
+	.iso_cfg = 0x2C,
+	.iso_seed = 0x30,
+	.num_clients = 0x2,
+	.rd_clients = {
+		{
+			.core_cfg = 0x50,
+			.ccif_meta_data = 0x54,
+			.img_addr = 0x58,
+			.img_cfg = 0x5C,
+			.stride = 0x60,
+			.unpack_cfg = 0x64,
+			.latency_buf_allocation = 0x78,
+			.misr_cfg_0 =  0x80,
+			.misr_cfg_1 =  0x84,
+			.misr_rd_val = 0x88,
+		},
+		{
+			.core_cfg = 0xF0,
+			.ccif_meta_data = 0xF4,
+			.img_addr = 0xF8,
+			.img_cfg = 0xFC,
+			.stride = 0x100,
+			.unpack_cfg = 0x104,
+			.latency_buf_allocation = 0x118,
+			.misr_cfg_0 =  0x120,
+			.misr_cfg_1 =  0x124,
+			.misr_rd_val = 0x128,
+		},
+	},
+};
+
+static struct cam_ope_bus_wr_reg ope_bus_wr_reg = {
+	.offset = 0x4D90,
+	.hw_version = 0x0,
+	.cgc_override = 0x8,
+	.irq_mask_0 = 0x18,
+	.irq_mask_1 = 0x1C,
+	.irq_clear_0 = 0x20,
+	.irq_clear_1 = 0x24,
+	.irq_status_0 = 0x28,
+	.irq_status_1 = 0x2C,
+	.irq_cmd = 0x30,
+	.frame_header_cfg_0 = 0x34,
+	.local_frame_header_cfg_0 = 0x4C,
+	.irq_set_0 = 0x50,
+	.irq_set_1 = 0x54,
+	.iso_cfg = 0x5C,
+	.violation_status = 0x64,
+	.image_size_violation_status  = 0x70,
+	.misr_cfg_0 = 0xB8,
+	.misr_cfg_1 = 0xBC,
+	.misr_rd_sel = 0xC8,
+	.misr_reset = 0xCC,
+	.misr_val = 0xD0,
+	.num_clients = 0x8,
+	.wr_clients = {
+		{
+			.core_cfg = 0x200,
+			.img_addr = 0x204,
+			.img_cfg = 0x20C,
+			.x_init = 0x210,
+			.stride = 0x214,
+			.pack_cfg = 0x218,
+			.bw_limit = 0x21C,
+			.frame_header_addr = 0x220,
+			.subsample_period = 0x230,
+			.subsample_pattern = 0x234,
+		},
+		{
+			.core_cfg = 0x300,
+			.img_addr = 0x304,
+			.img_cfg = 0x30C,
+			.x_init = 0x310,
+			.stride = 0x314,
+			.pack_cfg = 0x318,
+			.bw_limit = 0x31C,
+			.frame_header_addr = 0x320,
+			.subsample_period = 0x330,
+			.subsample_pattern = 0x334,
+		},
+		{
+			.core_cfg = 0x400,
+			.img_addr = 0x404,
+			.img_cfg = 0x40C,
+			.x_init = 0x410,
+			.stride = 0x414,
+			.pack_cfg = 0x418,
+			.bw_limit = 0x41C,
+			.frame_header_addr = 0x420,
+			.subsample_period = 0x430,
+			.subsample_pattern = 0x434,
+		},
+		{
+			.core_cfg = 0x500,
+			.img_addr = 0x504,
+			.img_cfg = 0x50C,
+			.x_init = 0x510,
+			.stride = 0x514,
+			.pack_cfg = 0x518,
+			.bw_limit = 0x51C,
+			.frame_header_addr = 0x520,
+			.subsample_period = 0x530,
+			.subsample_pattern = 0x534,
+		},
+		{
+			.core_cfg = 0x600,
+			.img_addr = 0x604,
+			.img_cfg = 0x60C,
+			.x_init = 0x610,
+			.stride = 0x614,
+			.pack_cfg = 0x618,
+			.bw_limit = 0x61C,
+			.frame_header_addr = 0x620,
+			.subsample_period = 0x630,
+			.subsample_pattern = 0x634,
+		},
+		{
+			.core_cfg = 0x700,
+			.img_addr = 0x704,
+			.img_cfg = 0x70C,
+			.x_init = 0x710,
+			.stride = 0x714,
+			.pack_cfg = 0x718,
+			.bw_limit = 0x71C,
+			.frame_header_addr = 0x720,
+			.subsample_period = 0x730,
+			.subsample_pattern = 0x734,
+		},
+		{
+			.core_cfg = 0x800,
+			.img_addr = 0x804,
+			.img_cfg = 0x80C,
+			.x_init = 0x810,
+			.stride = 0x814,
+			.pack_cfg = 0x818,
+			.bw_limit = 0x81C,
+			.frame_header_addr = 0x820,
+			.subsample_period = 0x830,
+			.subsample_pattern = 0x834,
+		},
+		{
+			.core_cfg = 0x900,
+			.img_addr = 0x904,
+			.img_cfg = 0x90C,
+			.x_init = 0x910,
+			.stride = 0x914,
+			.pack_cfg = 0x918,
+			.bw_limit = 0x91C,
+			.frame_header_addr = 0x920,
+			.subsample_period = 0x930,
+			.subsample_pattern = 0x934,
+		},
+	},
+};
+
+static struct cam_ope_bus_wr_reg_val ope_bus_wr_reg_val = {
+	.hw_version = 0x20010000,
+	.irq_mask_0 = 0xD0000000,
+	.irq_mask_1 = 0x0,
+	.irq_set_clear = 0x1,
+	.comp_rup_done = 0x1,
+	.comp_buf_done = 0x100,
+	.cons_violation = 0x10000000,
+	.violation = 0x40000000,
+	.img_size_violation = 0x80000000,
+	.num_clients = 0x8,
+	.wr_clients = {
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_VIDEO,
+			.wm_port_id = BUS_WR_VIDEO_Y,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_VIDEO,
+			.wm_port_id = BUS_WR_VIDEO_C,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_DISP,
+			.wm_port_id = BUS_WR_DISP_Y,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_DISP,
+			.wm_port_id = BUS_WR_DISP_C,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_ARGB,
+			.wm_port_id = BUS_WR_ARGB,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_STATS_RS,
+			.wm_port_id = BUS_WR_STATS_RS,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_STATS_IHIST,
+			.wm_port_id = BUS_WR_STATS_IHIST,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_STATS_LTM,
+			.wm_port_id = BUS_WR_STATS_LTM,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+	},
+};
+
+static struct cam_ope_pp_reg ope_pp_reg = {
+	.offset = 0x800,
+	.num_clients = MAX_PP_CLIENTS,
+	.pp_clients = {
+		{
+			.hw_status = 0x4,
+		},
+		{
+			.hw_status = 0x204,
+		},
+		{
+			.hw_status = 0x404,
+		},
+		{
+			.hw_status = 0x604,
+		},
+		{
+			.hw_status = 0x804,
+		},
+		{
+			.hw_status = 0xA04,
+		},
+		{
+			.hw_status = 0xC04,
+		},
+		{
+			.hw_status = 0xE04,
+		},
+		{
+			.hw_status = 0x1004,
+		},
+		{
+			.hw_status = 0x1204,
+		},
+		{
+			.hw_status = 0x1404,
+		},
+		{
+			.hw_status = 0x1604,
+		},
+		{
+			.hw_status = 0x1804,
+		},
+		{
+			.hw_status = 0x1A04,
+		},
+		{
+			.hw_status = 0x1C04,
+		},
+		{
+			.hw_status = 0x1E04,
+		},
+		{
+			.hw_status = 0x2204,
+		},
+		{
+			.hw_status = 0x2604,
+		},
+		{
+			.hw_status = 0x2804,
+		},
+		{
+			.hw_status = 0x2A04,
+		},
+		{
+			.hw_status = 0x2C04,
+		},
+		{
+			.hw_status = 0x2E04,
+		},
+		{
+			.hw_status = 0x3004,
+		},
+		{
+			.hw_status = 0x3204,
+		},
+		{
+			.hw_status = 0x3404,
+		},
+		{
+			.hw_status = 0x3604,
+		},
+		{
+			.hw_status = 0x3804,
+		},
+		{
+			.hw_status = 0x3A04,
+		},
+		{
+			.hw_status = 0x3C04,
+		},
+		{
+			.hw_status = 0x3E04,
+		},
+		{
+			.hw_status = 0x4004,
+		},
+		{
+			.hw_status = 0x4204,
+		},
+	},
+};
+
+static struct ope_hw ope_hw_100 = {
+	.top_reg     = &ope_top_reg,
+	.top_reg_val = &ope_top_reg_val,
+	.bus_rd_reg  = &ope_bus_rd_reg,
+	.bus_rd_reg_val  = &ope_bus_rd_reg_val,
+	.bus_wr_reg  = &ope_bus_wr_reg,
+	.bus_wr_reg_val  = &ope_bus_wr_reg_val,
+	.pp_reg  = &ope_pp_reg,
+	.common  = &common_data,
+};
+
+#endif /* CAM_OPE_HW_100_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.c
@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/dma-buf.h>
+#include <media/cam_defs.h>
+#include <media/cam_ope.h>
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+
+static int cam_ope_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct platform_device *pdev = NULL;
+	struct device_node *of_node = NULL;
+	struct cam_ope_soc_private *ope_soc_info;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_OPE, "soc_info is NULL");
+		return -EINVAL;
+	}
+
+	pdev = soc_info->pdev;
+	of_node = pdev->dev.of_node;
+	ope_soc_info = soc_info->soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_OPE, "get ope dt prop is failed: %d", rc);
+
+	ope_soc_info->hfi_en = of_property_read_bool(of_node, "hfi_en");
+
+	return rc;
+}
+
+static int cam_ope_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t ope_irq_handler, void *data)
+{
+	int rc = 0, i;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = data;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, ope_irq_handler, &(irq_data[0]));
+
+	return rc;
+}
+
+int cam_ope_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ope_irq_handler, void *irq_data)
+{
+	struct cam_ope_soc_private  *soc_private;
+	struct platform_device *pdev = NULL;
+	int num_pid = 0, i = 0;
+	int rc = 0;
+
+	soc_private = kzalloc(sizeof(struct cam_ope_soc_private), GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_ISP, "Error! soc_private Alloc Failed");
+			return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_ope_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_ope_request_platform_resource(soc_info, ope_irq_handler,
+		irq_data);
+	if (rc < 0)
+		return rc;
+
+	soc_private->num_pid = 0;
+	pdev = soc_info->pdev;
+	num_pid = of_property_count_u32_elems(pdev->dev.of_node, "cam_hw_pid");
+	CAM_DBG(CAM_OPE, "ope: %d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_OPE_HW_MAX_NUM_PID)
+		goto end;
+
+	soc_private->num_pid  = num_pid;
+
+	for (i = 0; i < num_pid; i++)
+		of_property_read_u32_index(pdev->dev.of_node, "cam_hw_pid", i,
+				&soc_private->pid[i]);
+end:
+	return rc;
+}
+
+int cam_ope_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		CAM_SVS_VOTE, true);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "enable platform failed");
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_ope_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, disable_clk,
+		true);
+	if (rc)
+		CAM_ERR(CAM_OPE, "enable platform failed");
+
+	return rc;
+}
+
+int cam_ope_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate)
+{
+	int32_t src_clk_idx;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_OPE, "Invalid soc info");
+		return -EINVAL;
+	}
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	CAM_DBG(CAM_OPE, "clk_rate = %u src_clk_index = %d",
+		clk_rate, src_clk_idx);
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE] == true) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_OPE, "clk_rate %d greater than max, reset to %d",
+			clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	CAM_DBG(CAM_OPE, "clk_rate = %u src_clk_index = %d",
+		clk_rate, src_clk_idx);
+	return cam_soc_util_set_src_clk_rate(soc_info, CAM_CLK_SW_CLIENT_IDX, clk_rate, 0);
+}
+
+int cam_ope_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable)
+{
+	int rc = 0;
+
+	if (clk_enable)
+		rc = cam_soc_util_clk_enable_default(soc_info, CAM_CLK_SW_CLIENT_IDX, CAM_SVS_VOTE);
+	else
+		cam_soc_util_clk_disable_default(soc_info, CAM_CLK_SW_CLIENT_IDX);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.h
@@ -0,0 +1,41 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_SOC_H
+#define CAM_OPE_SOC_H
+
+#include "cam_soc_util.h"
+
+#define CAM_OPE_HW_MAX_NUM_PID 2
+
+/**
+ * struct cam_ope_soc_private
+ *
+ * @hfi_en:  HFI enable flag
+ * @num_pid: OPE number of pids
+ * @pid:     OPE pid value list
+ */
+struct cam_ope_soc_private {
+	uint32_t hfi_en;
+	uint32_t num_pid;
+	uint32_t pid[CAM_OPE_HW_MAX_NUM_PID];
+};
+
+
+
+int cam_ope_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ope_irq_handler, void *irq_data);
+
+
+int cam_ope_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_ope_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk);
+
+int cam_ope_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate);
+
+int cam_ope_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable);
+#endif /* CAM_OPE_SOC_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.c
@@ -0,0 +1,379 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+#include "ope_top.h"
+#include "cam_common_util.h"
+
+static struct ope_top ope_top_info;
+
+static int cam_ope_top_dump_debug_reg(struct ope_hw *ope_hw_info)
+{
+	uint32_t i, val[3];
+	struct cam_ope_top_reg *top_reg;
+	struct cam_ope_pp_reg *pp_reg;
+	uint32_t pp_hw_status = 0;
+
+	top_reg = ope_hw_info->top_reg;
+	pp_reg = ope_hw_info->pp_reg;
+
+	for (i = 0; i < top_reg->num_debug_registers; i = i+3) {
+		val[0] = cam_io_r_mb(top_reg->base +
+			top_reg->debug_regs[i].offset);
+		val[1] = ((i+1) < top_reg->num_debug_registers) ?
+			cam_io_r_mb(top_reg->base +
+			top_reg->debug_regs[i+1].offset) : 0;
+		val[2] = ((i+2) < top_reg->num_debug_registers) ?
+			cam_io_r_mb(top_reg->base +
+			top_reg->debug_regs[i+2].offset) : 0;
+
+		CAM_INFO(CAM_OPE, "status[%d-%d] : 0x%x 0x%x 0x%x",
+			i, i+2, val[0], val[1], val[2]);
+	}
+
+	CAM_INFO(CAM_OPE, "scrath reg: 0x%x, stripe_idx: %d",
+		top_reg->offset + top_reg->scratch_reg,
+		cam_io_r_mb(top_reg->base + top_reg->scratch_reg));
+
+	for (i = 0; i < pp_reg->num_clients ; i++) {
+		pp_hw_status = 0;
+		pp_hw_status =
+			cam_io_r_mb(pp_reg->base +
+				pp_reg->pp_clients[i]
+					.hw_status);
+
+		if (pp_hw_status)
+			CAM_ERR(CAM_OPE,
+				"ope pp hw_status offset 0x%x val 0x%x",
+				pp_reg->pp_clients[i].hw_status,
+				pp_hw_status);
+	}
+	return 0;
+}
+
+static int cam_ope_top_reset(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_ope_top_reg *top_reg;
+	struct cam_ope_top_reg_val *top_reg_val;
+	uint32_t irq_mask, irq_status;
+	unsigned long flags;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	top_reg = ope_hw_info->top_reg;
+	top_reg_val = ope_hw_info->top_reg_val;
+
+	mutex_lock(&ope_top_info.ope_hw_mutex);
+	reinit_completion(&ope_top_info.reset_complete);
+
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		ope_hw_info->top_reg->base + top_reg->irq_mask);
+
+	/* OPE SW RESET */
+	cam_io_w_mb(top_reg_val->sw_reset_cmd,
+		ope_hw_info->top_reg->base + top_reg->reset_cmd);
+
+	rc = cam_common_wait_for_completion_timeout(
+			&ope_top_info.reset_complete,
+			msecs_to_jiffies(60));
+
+	cam_io_w_mb(top_reg_val->debug_cfg_val,
+		top_reg->base + top_reg->debug_cfg);
+
+	if (!rc || rc < 0) {
+		spin_lock_irqsave(&ope_top_info.hw_lock, flags);
+		if (!completion_done(&ope_top_info.reset_complete)) {
+			CAM_DBG(CAM_OPE,
+				"IRQ delayed, checking the status registers");
+			irq_mask = cam_io_r_mb(ope_hw_info->top_reg->base +
+				top_reg->irq_mask);
+			irq_status = cam_io_r_mb(ope_hw_info->top_reg->base +
+				top_reg->irq_status);
+			if (irq_status & top_reg_val->rst_done) {
+				CAM_DBG(CAM_OPE, "ope reset done");
+				cam_io_w_mb(irq_status,
+					top_reg->base + top_reg->irq_clear);
+				cam_io_w_mb(top_reg_val->irq_set_clear,
+					top_reg->base + top_reg->irq_cmd);
+			} else {
+				CAM_ERR(CAM_OPE,
+					"irq mask 0x%x irq status 0x%x",
+					irq_mask, irq_status);
+				cam_ope_top_dump_debug_reg(ope_hw_info);
+				rc = -ETIMEDOUT;
+			}
+		} else {
+			rc = 0;
+		}
+		spin_unlock_irqrestore(&ope_top_info.hw_lock, flags);
+	} else {
+		rc = 0;
+	}
+
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		ope_hw_info->top_reg->base + top_reg->irq_mask);
+
+	mutex_unlock(&ope_top_info.ope_hw_mutex);
+	return rc;
+}
+
+static int cam_ope_top_release(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (ctx_id < 0) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	ope_top_info.top_ctx[ctx_id].ope_acquire = NULL;
+
+	return rc;
+}
+
+static int cam_ope_top_acquire(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (ctx_id < 0 || !data) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+
+	ope_top_info.top_ctx[ctx_id].ope_acquire = data;
+
+	return rc;
+}
+
+static int cam_ope_top_init(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_ope_top_reg *top_reg;
+	struct cam_ope_top_reg_val *top_reg_val;
+	struct cam_ope_dev_init *dev_init = data;
+	uint32_t irq_mask, irq_status;
+	unsigned long flags;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	top_reg = ope_hw_info->top_reg;
+	top_reg_val = ope_hw_info->top_reg_val;
+
+	top_reg->base = dev_init->core_info->ope_hw_info->ope_top_base;
+
+	mutex_init(&ope_top_info.ope_hw_mutex);
+	/* OPE SW RESET */
+	init_completion(&ope_top_info.reset_complete);
+
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		ope_hw_info->top_reg->base + top_reg->irq_mask);
+	cam_io_w_mb(top_reg_val->sw_reset_cmd,
+		ope_hw_info->top_reg->base + top_reg->reset_cmd);
+
+	rc = cam_common_wait_for_completion_timeout(
+			&ope_top_info.reset_complete,
+			msecs_to_jiffies(60));
+
+	cam_io_w_mb(top_reg_val->debug_cfg_val,
+		top_reg->base + top_reg->debug_cfg);
+
+	if (!rc || rc < 0) {
+		spin_lock_irqsave(&ope_top_info.hw_lock, flags);
+		if (!completion_done(&ope_top_info.reset_complete)) {
+			CAM_DBG(CAM_OPE,
+				"IRQ delayed, checking the status registers");
+			irq_mask = cam_io_r_mb(ope_hw_info->top_reg->base +
+				top_reg->irq_mask);
+			irq_status = cam_io_r_mb(ope_hw_info->top_reg->base +
+				top_reg->irq_status);
+			if (irq_status & top_reg_val->rst_done) {
+				CAM_DBG(CAM_OPE, "ope reset done");
+				cam_io_w_mb(irq_status,
+					top_reg->base + top_reg->irq_clear);
+				cam_io_w_mb(top_reg_val->irq_set_clear,
+					top_reg->base + top_reg->irq_cmd);
+			} else {
+				CAM_ERR(CAM_OPE,
+					"irq mask 0x%x irq status 0x%x",
+					irq_mask, irq_status);
+				cam_ope_top_dump_debug_reg(ope_hw_info);
+				rc = -ETIMEDOUT;
+			}
+		} else {
+			CAM_DBG(CAM_OPE, "reset done");
+			rc = 0;
+		}
+		spin_unlock_irqrestore(&ope_top_info.hw_lock, flags);
+	} else {
+		rc = 0;
+	}
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		ope_hw_info->top_reg->base + top_reg->irq_mask);
+
+	return rc;
+}
+
+static int cam_ope_top_probe(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	ope_top_info.ope_hw_info = ope_hw_info;
+	spin_lock_init(&ope_top_info.hw_lock);
+
+	return rc;
+}
+
+static int cam_ope_top_isr(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	uint32_t irq_status;
+	uint32_t violation_status;
+	uint32_t pp_hw_status = 0;
+	struct cam_ope_top_reg *top_reg;
+	struct cam_ope_top_reg_val *top_reg_val;
+	struct cam_ope_pp_reg *pp_reg;
+	struct cam_ope_irq_data *irq_data = data;
+	int i;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	top_reg = ope_hw_info->top_reg;
+	top_reg_val = ope_hw_info->top_reg_val;
+	pp_reg = ope_hw_info->pp_reg;
+
+	spin_lock(&ope_top_info.hw_lock);
+	/* Read and Clear Top Interrupt status */
+	irq_status = cam_io_r_mb(top_reg->base + top_reg->irq_status);
+	cam_io_w_mb(irq_status,
+		top_reg->base + top_reg->irq_clear);
+
+	cam_io_w_mb(top_reg_val->irq_set_clear,
+		top_reg->base + top_reg->irq_cmd);
+
+	if (irq_status & top_reg_val->rst_done) {
+		CAM_DBG(CAM_OPE, "ope reset done");
+		complete(&ope_top_info.reset_complete);
+	}
+
+	if (irq_status & top_reg_val->ope_violation) {
+		violation_status = cam_io_r_mb(top_reg->base +
+			top_reg->violation_status);
+		irq_data->error = 1;
+		CAM_ERR(CAM_OPE, "ope violation: %x", violation_status);
+
+		for (i = 0; i < pp_reg->num_clients ; i++) {
+			pp_hw_status = 0;
+			pp_hw_status =
+				cam_io_r_mb(pp_reg->base +
+					pp_reg->pp_clients[i]
+						.hw_status);
+
+			if (pp_hw_status)
+				CAM_ERR(CAM_OPE,
+					"ope pp hw_status offset 0x%x val 0x%x",
+					pp_reg->pp_clients[i].hw_status,
+					pp_hw_status);
+		}
+	}
+	spin_unlock(&ope_top_info.hw_lock);
+
+	return rc;
+}
+
+int cam_ope_top_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data)
+{
+	int rc = 0;
+
+	switch (cmd_id) {
+	case OPE_HW_PROBE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: E");
+		rc = cam_ope_top_probe(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: X");
+		break;
+	case OPE_HW_INIT:
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: E");
+		rc = cam_ope_top_init(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: X");
+		break;
+	case OPE_HW_DEINIT:
+		break;
+	case OPE_HW_ACQUIRE:
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: E");
+		rc = cam_ope_top_acquire(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: X");
+		break;
+	case OPE_HW_PREPARE:
+		break;
+	case OPE_HW_RELEASE:
+		rc = cam_ope_top_release(ope_hw_info, ctx_id, data);
+		break;
+	case OPE_HW_START:
+		break;
+	case OPE_HW_STOP:
+		break;
+	case OPE_HW_FLUSH:
+		break;
+	case OPE_HW_ISR:
+		rc = cam_ope_top_isr(ope_hw_info, 0, data);
+		break;
+	case OPE_HW_RESET:
+		rc = cam_ope_top_reset(ope_hw_info, 0, 0);
+		break;
+	case OPE_HW_DUMP_DEBUG:
+		rc = cam_ope_top_dump_debug_reg(ope_hw_info);
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.h
@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef OPE_TOP_H
+#define OPE_TOP_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "ope_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_soc_util.h"
+#include "cam_context.h"
+#include "cam_ope_context.h"
+#include "cam_ope_hw_mgr.h"
+
+/**
+ * struct ope_top_ctx
+ *
+ * @ope_acquire: OPE acquire info
+ */
+struct ope_top_ctx {
+	struct ope_acquire_dev_info *ope_acquire;
+};
+
+/**
+ * struct ope_top
+ *
+ * @ope_hw_info:    OPE hardware info
+ * @top_ctx:        OPE top context
+ * @reset_complete: Reset complete flag
+ * @ope_mutex:      OPE hardware mutex
+ * @hw_lock:        OPE hardware spinlock
+ */
+struct ope_top {
+	struct ope_hw *ope_hw_info;
+	struct ope_top_ctx top_ctx[OPE_CTX_MAX];
+	struct completion reset_complete;
+	struct mutex      ope_hw_mutex;
+	spinlock_t        hw_lock;
+};
+#endif /* OPE_TOP_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_presil/inc/cam_presil_hw_access.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_presil/inc/cam_presil_hw_access.h
@@ -0,0 +1,228 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_PRESIL_HW_ACCESS_H_
+#define _CAM_PRESIL_HW_ACCESS_H_
+
+#include <linux/interrupt.h>
+
+#define CAM_PRESIL_CLIENT_ID_CAMERA 0x1
+#define CAM_PRESIL_CLIENT_ID_EVA    0x2
+
+/* presil events to carry shared values from HW-KMD to PC-HOST CSim Wrapper */
+#define CAM_PRESIL_EVENT_HFI_REG_BASE                                0x600
+#define CAM_PRESIL_EVENT_HFI_REG(n) (CAM_PRESIL_EVENT_HFI_REG_BASE + (n * 4))
+#define CAM_PRESIL_EVENT_HFI_REG_CMD_Q_IOVA                          CAM_PRESIL_EVENT_HFI_REG(1)
+#define CAM_PRESIL_EVENT_HFI_REG_MSG_Q_IOVA                          CAM_PRESIL_EVENT_HFI_REG(2)
+#define CAM_PRESIL_EVENT_HFI_REG_DBG_Q_IOVA                          CAM_PRESIL_EVENT_HFI_REG(3)
+#define CAM_PRESIL_EVENT_HFI_REG_SFR_LEN                             CAM_PRESIL_EVENT_HFI_REG(4)
+#define CAM_PRESIL_EVENT_HFI_REG_ICP_V1_HW_VERSION_TO_START_HFI_INIT CAM_PRESIL_EVENT_HFI_REG(13)
+#define CAM_PRESIL_EVENT_HFI_REG_ON_FIRST_REG_START_FW_DOWNLOAD      0x638   /* write FF to start */
+#define CAM_PRESIL_EVENT_IFE_FRAME_RUN                               0x123   /* write FF to start */
+
+
+/*
+ * enum cam_presil_err - return code from presil apis
+ *
+ * @CAM_PRESIL_SUCCESS         : Success
+ * @CAM_PRESIL_FAILED          : Failed
+ * @CAM_PRESIL_BLOCKED         : not presil hw
+ * @CAM_PRESIL_BLOCKED_BOOTUP  : presil hw but at boot presil not connected
+ *
+ */
+enum cam_presil_err {
+	CAM_PRESIL_SUCCESS = 0x0,
+	CAM_PRESIL_FAILED,
+	CAM_PRESIL_BLOCKED,
+	CAM_PRESIL_BLOCKED_BOOTUP,
+};
+
+/**
+ * struct cam_presil_intr_reginfo - register received with irq
+ * callback
+ */
+struct cam_presil_intr_reginfo
+{
+	uint32_t intr_en_off;
+	uint32_t intr_status_off;
+	uint32_t intr_en_val;
+	uint32_t intr_status_val;
+};
+
+/**
+ * struct cam_presil_intr_regwrinfo - reg val pair from pchost
+ */
+struct cam_presil_intr_regwrinfo
+{
+	void *   reg_off;
+	uint32_t reg_val;
+};
+
+#define CAM_MODE_MAX_REG_CNT 25
+
+/**
+ * struct cam_presil_irq_data - data received along with irq cb
+ * from pchost
+ */
+struct cam_presil_irq_data
+{
+	uint32_t                         irq_num;
+	uint32_t                         irq_reg_count;
+	struct cam_presil_intr_reginfo   intr_reg[CAM_MODE_MAX_REG_CNT];
+	uint32_t                         irq_wr_count;
+	struct cam_presil_intr_regwrinfo intr_wr_reg[CAM_MODE_MAX_REG_CNT];
+	uint32_t                         magic;
+};
+
+/*
+ *  cam_presil_subscribe_device_irq()
+ *
+ * @brief         :  Register for irq from presil framework.
+ *
+ * @irq_num       :  Unique irq number
+ * @irq_handler   :  handler callback
+ * @irq_priv_data :  Callback data
+ * @irq_name      :  Irq name
+ *
+ * @return true or false.
+ */
+bool cam_presil_subscribe_device_irq(int irq_num, irq_handler_t irq_handler,
+	void* irq_priv_data, const char *irq_name);
+
+/*
+ *  cam_presil_subscribe_device_irq()
+ *
+ * @brief   :  Un-Register for irq from presil framework.
+ *
+ * @irq_num :  Unique irq number
+ *
+ * @return true or false.
+ */
+bool cam_presil_unsubscribe_device_irq(int irq_num);
+
+/*
+ *  cam_presil_register_read()
+ *
+ * @brief   :  register read from presil hw.
+ *
+ * @addr    :  Register offset
+ * @pValue  :  Value read from hw
+ *
+ * @return:  Success or Failure
+ */
+int cam_presil_register_read(void *addr, uint32_t *pValue);
+
+/*
+ *  cam_presil_register_write()
+ *
+ * @brief   :  register write to presil hw.
+ *
+ * @addr    :  Register offset
+ * @pValue  :  Value to write to hw
+ * @flags   :  Flags
+ *
+ * @return:  Success or Failure
+ */
+int cam_presil_register_write(void *addr, uint32_t value, uint32_t flags);
+
+/*
+ *  cam_presil_send_buffer()
+ *
+ * @brief        :  Copy buffer content to presil hw memory.
+ *
+ * @dma_buf_uint :  Not fd , it is dma_buf ptr to be sent to
+ * 	presil umd daemon
+ * @mmu_hdl      :  Iommu handle
+ * @offset       :  Offset to start copy
+ * @size         :  Size of copy
+ * @addr32       :  Iova to start copy at
+ *
+ * @return:  Success or Failure
+ */
+int cam_presil_send_buffer(uint64_t dma_buf_uint, int mmu_hdl, uint32_t offset,
+	uint32_t size, uint32_t addr32);
+
+/*
+ *  cam_presil_retrieve_buffer()
+ *
+ * @brief        :  Copy buffer content back from presil hw memory.
+ *
+ * @dma_buf_uint :  Not fd , it is dma_buf ptr to be sent to
+ * 	presil umd daemon
+ * @mmu_hdl      :  Iommu handle
+ * @offset       :  Offset to start copy
+ * @size         :  Size of copy
+ * @addr32       :  Iova to start copy at
+ *
+ * @return:  Success or Failure
+ */
+int cam_presil_retrieve_buffer(uint64_t dma_buf_uint,
+	int mmu_hdl, uint32_t offset, uint32_t size, uint32_t addr32);
+
+/*
+ *  cam_presil_readl_poll_timeout()
+ *
+ * @brief         :  Custom register poll function for presil hw.
+ *
+ * @mem_address   :  Reg offset to poll
+ * @val           :  Value to compare
+ * @max_try_count :  Max number of tries
+ * @interval_msec :  Interval between tries
+ *
+ * @return:  Success or Failure
+ */
+int cam_presil_readl_poll_timeout(void __iomem *mem_address, uint32_t val,
+	int max_try_count, int interval_msec);
+
+/*
+ *  cam_presil_hfi_write_cmd()
+ *
+ * @brief   :  Write HFI command to presil hw.
+ *
+ * @addr       :  Pointer to HFI command
+ * @cmdlen     :  Length
+ * @client_id  :  client Id of caller
+ *
+ * @return:  Success or Failure
+ */
+int cam_presil_hfi_write_cmd(void *addr, uint32_t cmdlen, uint32_t client_id);
+
+/*
+ *  cam_presil_hfi_read_message()
+ *
+ * @brief         :  Read HFI response message from presil hw.
+ *
+ * @pmsg          :  Pointer to HFI message buffer
+ * @q_id          :  Length
+ * @words_read    :  Response message
+ * @client_id     :  client Id of caller
+ *
+ * @return:  Success or Failure
+ */
+int cam_presil_hfi_read_message(uint32_t *pmsg, uint8_t q_id,
+	uint32_t *words_read, uint32_t client_id);
+
+/**
+ * @brief : API to check if camera driver running in presil
+ *        enabled mode
+ *
+ * @return true or false.
+ */
+bool cam_presil_mode_enabled(void);
+
+/*
+ *  cam_presil_send_event()
+ *
+ * @brief   :  send event to pchost.
+ *
+ * @event_id :  Event Id
+ * @value  :  Value with additional information
+ *
+ * @return:  Success or Failure
+ */
+int cam_presil_send_event(uint32_t event_id, uint32_t value);
+
+#endif /* _CAM_PRESIL_HW_ACCESS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_presil/stub/cam_presil_hw_access_stub.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_presil/stub/cam_presil_hw_access_stub.c
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_debug_util.h"
+#include "cam_presil_hw_access.h"
+
+bool cam_presil_mode_enabled(void)
+{
+	return false;
+}
+
+bool cam_presil_subscribe_device_irq(int irq_num,
+	irq_handler_t irq_handler, void *irq_priv_data, const char *irq_name)
+{
+	return true;
+}
+
+bool cam_presil_unsubscribe_device_irq(int irq_num)
+{
+	return true;
+}
+
+int cam_presil_register_read(void *addr, uint32_t *val)
+{
+	return CAM_PRESIL_SUCCESS;
+}
+
+int cam_presil_register_write(void *addr, uint32_t value, uint32_t flags)
+{
+	return CAM_PRESIL_SUCCESS;
+}
+
+int cam_presil_send_buffer(uint64_t dma_buf_uint, int mmu_hdl, uint32_t offset,
+	uint32_t size, uint32_t addr32)
+{
+	return CAM_PRESIL_SUCCESS;
+}
+
+int cam_presil_retrieve_buffer(uint64_t dma_buf_uint, int mmu_hdl,
+	uint32_t offset, uint32_t size, uint32_t addr32)
+{
+	return CAM_PRESIL_SUCCESS;
+}
+
+int cam_presil_readl_poll_timeout(void __iomem *mem_address, uint32_t val,
+	int max_try_count, int interval_msec)
+{
+	return CAM_PRESIL_SUCCESS;
+}
+
+int cam_presil_hfi_write_cmd(void *hfi_cmd, uint32_t cmdlen, uint32_t client_id)
+{
+	return CAM_PRESIL_SUCCESS;
+}
+
+int cam_presil_hfi_read_message(uint32_t *pmsg, uint8_t q_id,
+	uint32_t *words_read, uint32_t client_id)
+{
+	return CAM_PRESIL_SUCCESS;
+}
+
+int cam_presil_send_event(uint32_t event_id, uint32_t value)
+{
+	return CAM_PRESIL_SUCCESS;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_mem_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_mem_mgr.c
@@ -0,0 +1,2861 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/dma-buf.h>
+#include <linux/version.h>
+#include <linux/debugfs.h>
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+#include <linux/mem-buf.h>
+#include <soc/qcom/secure_buffer.h>
+#endif
+
+#include "cam_compat.h"
+#include "cam_req_mgr_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_smmu_api.h"
+#include "cam_debug_util.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+#include "cam_presil_hw_access.h"
+
+#define CAM_MEM_SHARED_BUFFER_PAD_4K (4 * 1024)
+
+static struct cam_mem_table tbl;
+static atomic_t cam_mem_mgr_state = ATOMIC_INIT(CAM_MEM_MGR_UNINITIALIZED);
+
+/* Number of words for dumping req state info */
+#define CAM_MEM_MGR_DUMP_BUF_NUM_WORDS  29
+
+/* cam_mem_mgr_debug - global struct to keep track of debug settings for mem mgr
+ *
+ * @dentry                  : Directory entry to the mem mgr root folder
+ * @alloc_profile_enable    : Whether to enable alloc profiling
+ * @override_cpu_access_dir : Override cpu access direction to BIDIRECTIONAL
+ */
+static struct {
+	struct dentry *dentry;
+	bool alloc_profile_enable;
+	bool override_cpu_access_dir;
+} g_cam_mem_mgr_debug;
+
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+static void cam_mem_mgr_put_dma_heaps(void);
+static int cam_mem_mgr_get_dma_heaps(void);
+#endif
+
+#ifdef CONFIG_CAM_PRESIL
+static inline void cam_mem_mgr_reset_presil_params(int idx)
+{
+	tbl.bufq[idx].presil_params.fd_for_umd_daemon = -1;
+	tbl.bufq[idx].presil_params.refcount = 0;
+}
+#else
+static inline void cam_mem_mgr_reset_presil_params(int idx)
+{
+	return;
+}
+#endif
+
+static unsigned long cam_mem_mgr_mini_dump_cb(void *dst, unsigned long len,
+	void *priv_data)
+{
+	struct cam_mem_table_mini_dump      *md;
+
+	if (!dst) {
+		CAM_ERR(CAM_MEM, "Invalid  params");
+		return 0;
+	}
+
+	if (len < sizeof(*md)) {
+		CAM_ERR(CAM_MEM, "Insufficient length %u", len);
+		return 0;
+	}
+
+	md = (struct cam_mem_table_mini_dump *)dst;
+	memcpy(md->bufq, tbl.bufq, CAM_MEM_BUFQ_MAX * sizeof(struct cam_mem_buf_queue));
+	md->dbg_buf_idx = tbl.dbg_buf_idx;
+	md->alloc_profile_enable = g_cam_mem_mgr_debug.alloc_profile_enable;
+	md->force_cache_allocs = tbl.force_cache_allocs;
+	md->need_shared_buffer_padding = tbl.need_shared_buffer_padding;
+	return sizeof(*md);
+}
+
+static void cam_mem_mgr_print_tbl(void)
+{
+	int i;
+	uint64_t ms, hrs, min, sec;
+	struct timespec64 current_ts;
+
+	CAM_GET_TIMESTAMP(current_ts);
+	CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
+	CAM_INFO(CAM_MEM, "***%llu:%llu:%llu:%llu Mem mgr table dump***",
+		hrs, min, sec, ms);
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
+		CAM_CONVERT_TIMESTAMP_FORMAT((tbl.bufq[i].timestamp), hrs, min, sec, ms);
+		CAM_INFO(CAM_MEM,
+			"%llu:%llu:%llu:%llu idx %d fd %d i_ino %lu size %llu active %d buf_handle %d krefCount %d urefCount %d buf_name %s",
+			hrs, min, sec, ms, i, tbl.bufq[i].fd, tbl.bufq[i].i_ino,
+			tbl.bufq[i].len, tbl.bufq[i].active, tbl.bufq[i].buf_handle,
+			kref_read(&tbl.bufq[i].krefcount), kref_read(&tbl.bufq[i].urefcount),
+			tbl.bufq[i].buf_name);
+	}
+
+}
+/**
+ * For faster lookups, maintaining same indexing as SMMU
+ * for saving iova for a given buffer for a given context
+ * bank
+ *
+ * Buffer X : [iova_1, 0x0, iova_3, ...]
+ * Here iova_1 is for device_1, no iova available for device_2,
+ * iova_3 for device_3 and so on
+ */
+static inline bool cam_mem_mgr_get_hwva_entry_idx(
+	int32_t mem_handle, int32_t *entry_idx)
+{
+	int entry;
+
+	entry = GET_SMMU_TABLE_IDX(mem_handle);
+	if (unlikely((entry < 0) || (entry >= tbl.max_hdls_supported))) {
+		CAM_ERR(CAM_MEM,
+			"Invalid mem_hdl: 0x%x, failed to lookup", mem_handle);
+		return false;
+	}
+
+	*entry_idx = entry;
+	return true;
+}
+
+static int cam_mem_util_get_dma_dir(uint32_t flags)
+{
+	int rc = -EINVAL;
+
+	if (flags & CAM_MEM_FLAG_HW_READ_ONLY)
+		rc = DMA_TO_DEVICE;
+	else if (flags & CAM_MEM_FLAG_HW_WRITE_ONLY)
+		rc = DMA_FROM_DEVICE;
+	else if (flags & CAM_MEM_FLAG_HW_READ_WRITE)
+		rc = DMA_BIDIRECTIONAL;
+	else if (flags & CAM_MEM_FLAG_PROTECTED_MODE)
+		rc = DMA_BIDIRECTIONAL;
+
+	return rc;
+}
+
+static int cam_mem_util_map_cpu_va(struct dma_buf *dmabuf, uintptr_t *vaddr, size_t *len)
+{
+	int rc = 0;
+
+	/*
+	 * dma_buf_begin_cpu_access() and dma_buf_end_cpu_access()
+	 * need to be called in pair to avoid stability issue.
+	 */
+	rc = dma_buf_begin_cpu_access(dmabuf, DMA_BIDIRECTIONAL);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "dma begin access failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_compat_util_get_dmabuf_va(dmabuf, vaddr);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "kernel vmap failed: rc = %d", rc);
+		*len = 0;
+		dma_buf_end_cpu_access(dmabuf, DMA_BIDIRECTIONAL);
+	}
+	else {
+		*len = dmabuf->size;
+		CAM_DBG(CAM_MEM, "vaddr = %llu, len = %zu", *vaddr, *len);
+	}
+
+	return rc;
+}
+
+static int cam_mem_util_unmap_cpu_va(struct dma_buf *dmabuf,
+	uint64_t vaddr)
+{
+	int rc = 0;
+
+	if (!dmabuf || !vaddr) {
+		CAM_ERR(CAM_MEM, "Invalid input args %pK %llX", dmabuf, vaddr);
+		return -EINVAL;
+	}
+
+	cam_compat_util_put_dmabuf_va(dmabuf, (void *)vaddr);
+
+	/*
+	 * dma_buf_begin_cpu_access() and
+	 * dma_buf_end_cpu_access() need to be called in pair
+	 * to avoid stability issue.
+	 */
+	rc = dma_buf_end_cpu_access(dmabuf, DMA_BIDIRECTIONAL);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Failed in end cpu access, dmabuf=%pK",
+			dmabuf);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int cam_mem_mgr_create_debug_fs(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available() || g_cam_mem_mgr_debug.dentry)
+		return 0;
+
+	rc = cam_debugfs_create_subdir("memmgr", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+
+	g_cam_mem_mgr_debug.dentry = dbgfileptr;
+
+	debugfs_create_bool("alloc_profile_enable", 0644, g_cam_mem_mgr_debug.dentry,
+		&g_cam_mem_mgr_debug.alloc_profile_enable);
+
+	debugfs_create_bool("override_cpu_access_dir", 0644, g_cam_mem_mgr_debug.dentry,
+		&g_cam_mem_mgr_debug.override_cpu_access_dir);
+end:
+	return rc;
+}
+
+int cam_mem_mgr_init(void)
+{
+	int i;
+	int bitmap_size;
+	int rc = 0;
+
+	if (atomic_read(&cam_mem_mgr_state))
+		return 0;
+
+	memset(tbl.bufq, 0, sizeof(tbl.bufq));
+
+	if (cam_smmu_need_force_alloc_cached(&tbl.force_cache_allocs)) {
+		CAM_ERR(CAM_MEM, "Error in getting force cache alloc flag");
+		return -EINVAL;
+	}
+
+	tbl.need_shared_buffer_padding = cam_smmu_need_shared_buffer_padding();
+
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+	rc = cam_mem_mgr_get_dma_heaps();
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Failed in getting dma heaps rc=%d", rc);
+		return rc;
+	}
+#endif
+	bitmap_size = BITS_TO_LONGS(CAM_MEM_BUFQ_MAX) * sizeof(long);
+	tbl.bitmap = kzalloc(bitmap_size, GFP_KERNEL);
+	if (!tbl.bitmap) {
+		rc = -ENOMEM;
+		goto put_heaps;
+	}
+
+	tbl.bits = bitmap_size * BITS_PER_BYTE;
+	bitmap_zero(tbl.bitmap, tbl.bits);
+	/* We need to reserve slot 0 because 0 is invalid */
+	set_bit(0, tbl.bitmap);
+
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
+		tbl.bufq[i].fd = -1;
+		tbl.bufq[i].buf_handle = -1;
+		cam_mem_mgr_reset_presil_params(i);
+		mutex_init(&tbl.bufq[i].q_lock);
+		spin_lock_init(&tbl.bufq[i].idx_lock);
+	}
+	mutex_init(&tbl.m_lock);
+
+	atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_INITIALIZED);
+
+	cam_mem_mgr_create_debug_fs();
+	cam_common_register_mini_dump_cb(cam_mem_mgr_mini_dump_cb,
+		"cam_mem", NULL);
+
+	rc = cam_smmu_driver_init(&tbl.csf_version, &tbl.max_hdls_supported);
+	if (rc)
+		goto clean_bitmap_and_mutex;
+
+	if (!tbl.max_hdls_supported) {
+		CAM_ERR(CAM_MEM, "Invalid number of supported handles");
+		rc = -EINVAL;
+		goto clean_bitmap_and_mutex;
+	}
+
+	tbl.max_hdls_info_size = sizeof(struct cam_mem_buf_hw_hdl_info) *
+		tbl.max_hdls_supported;
+
+	/* Index 0 is reserved as invalid slot */
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
+		tbl.bufq[i].hdls_info = kzalloc(tbl.max_hdls_info_size, GFP_KERNEL);
+
+		if (!tbl.bufq[i].hdls_info) {
+			CAM_ERR(CAM_MEM, "Failed to allocate hdls array queue idx: %d", i);
+			rc = -ENOMEM;
+			goto free_hdls_info;
+		}
+	}
+
+	return 0;
+
+free_hdls_info:
+	for (--i; i > 0; i--) {
+		kfree(tbl.bufq[i].hdls_info);
+		tbl.bufq[i].hdls_info = NULL;
+	}
+
+clean_bitmap_and_mutex:
+	kfree(tbl.bitmap);
+	tbl.bitmap = NULL;
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++)
+		mutex_destroy(&tbl.bufq[i].q_lock);
+	mutex_destroy(&tbl.m_lock);
+	atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_UNINITIALIZED);
+put_heaps:
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+	cam_mem_mgr_put_dma_heaps();
+#endif
+	return rc;
+}
+
+static int32_t cam_mem_get_slot(void)
+{
+	int32_t idx;
+
+	mutex_lock(&tbl.m_lock);
+	idx = find_first_zero_bit(tbl.bitmap, tbl.bits);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		mutex_unlock(&tbl.m_lock);
+		return -ENOMEM;
+	}
+	set_bit(idx, tbl.bitmap);
+	mutex_unlock(&tbl.m_lock);
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	spin_lock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].active = true;
+	spin_unlock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].release_deferred = false;
+	CAM_GET_TIMESTAMP((tbl.bufq[idx].timestamp));
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	return idx;
+}
+
+static void cam_mem_put_slot(int32_t idx)
+{
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	spin_lock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].active = false;
+	spin_unlock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].release_deferred = false;
+	tbl.bufq[idx].is_internal = false;
+	memset(&tbl.bufq[idx].timestamp, 0, sizeof(struct timespec64));
+	kref_init(&tbl.bufq[idx].krefcount);
+	kref_init(&tbl.bufq[idx].urefcount);
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	mutex_lock(&tbl.m_lock);
+	clear_bit(idx, tbl.bitmap);
+	mutex_unlock(&tbl.m_lock);
+}
+
+static bool cam_mem_mgr_is_iova_info_updated_locked(
+	struct cam_mem_buf_hw_hdl_info *hw_vaddr_info_arr,
+	int32_t iommu_hdl)
+{
+	int entry;
+	struct cam_mem_buf_hw_hdl_info *vaddr_entry;
+
+	/* validate hdl for entry idx */
+	if (!cam_mem_mgr_get_hwva_entry_idx(iommu_hdl, &entry))
+		return false;
+
+	vaddr_entry = &hw_vaddr_info_arr[entry];
+	if (vaddr_entry->valid_mapping &&
+		vaddr_entry->iommu_hdl == iommu_hdl)
+		return true;
+
+	return false;
+}
+
+static void cam_mem_mgr_update_iova_info_locked(
+	struct cam_mem_buf_hw_hdl_info *hw_vaddr_info_arr,
+	dma_addr_t vaddr, int32_t iommu_hdl, size_t len,
+	bool valid_mapping, struct kref *ref_count)
+{
+	int entry;
+	struct cam_mem_buf_hw_hdl_info *vaddr_entry;
+
+	/* validate hdl for entry idx */
+	if (!cam_mem_mgr_get_hwva_entry_idx(iommu_hdl, &entry))
+		return;
+
+	vaddr_entry = &hw_vaddr_info_arr[entry];
+
+	vaddr_entry->vaddr = vaddr;
+	vaddr_entry->iommu_hdl = iommu_hdl;
+	vaddr_entry->addr_updated = true;
+	vaddr_entry->valid_mapping = valid_mapping;
+	vaddr_entry->len = len;
+	vaddr_entry->ref_count = ref_count;
+}
+
+/* Utility to be invoked with bufq entry lock held */
+static int cam_mem_mgr_try_retrieving_hwva_locked(
+	int idx, int32_t mmu_handle, dma_addr_t *iova_ptr, size_t *len_ptr,
+	struct list_head *buf_tracker)
+{
+	int rc = -EINVAL, entry;
+	struct cam_mem_buf_hw_hdl_info *hdl_info = NULL;
+
+	/* Check for valid entry */
+	if (cam_mem_mgr_get_hwva_entry_idx(mmu_handle, &entry)) {
+		hdl_info =  &tbl.bufq[idx].hdls_info[entry];
+
+		/* Ensure we are picking a valid entry */
+		if ((hdl_info->iommu_hdl == mmu_handle) && (hdl_info->addr_updated)) {
+			*iova_ptr = hdl_info->vaddr;
+			*len_ptr = hdl_info->len;
+			if (buf_tracker)
+				cam_smmu_add_buf_to_track_list(tbl.bufq[idx].fd,
+					tbl.bufq[idx].i_ino, &hdl_info->ref_count, buf_tracker,
+					GET_SMMU_TABLE_IDX(mmu_handle));
+			rc = 0;
+		}
+	}
+
+	return rc;
+}
+
+int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
+	dma_addr_t *iova_ptr, size_t *len_ptr, uint32_t *flags,
+	struct list_head *buf_tracker)
+{
+	int rc = 0, idx;
+	bool retrieved_iova = false;
+	struct kref *ref_count;
+
+	*len_ptr = 0;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0)
+		return -ENOENT;
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "Buffer at idx=%d is already unmapped,",
+			idx);
+		rc = -EAGAIN;
+		goto err;
+	}
+
+	if (buf_handle != tbl.bufq[idx].buf_handle) {
+		rc = -EINVAL;
+		goto err;
+	}
+
+	if (flags)
+		*flags = tbl.bufq[idx].flags;
+
+	/* Try retrieving iova if saved previously */
+	rc = cam_mem_mgr_try_retrieving_hwva_locked(idx, mmu_handle, iova_ptr, len_ptr,
+		buf_tracker);
+	if (!rc) {
+		retrieved_iova = true;
+		goto end;
+	}
+
+	if (CAM_MEM_MGR_IS_SECURE_HDL(buf_handle))
+		rc = cam_smmu_get_stage2_iova(mmu_handle, tbl.bufq[idx].fd, tbl.bufq[idx].dma_buf,
+			iova_ptr, len_ptr, buf_tracker, &ref_count);
+	else
+		rc = cam_smmu_get_iova(mmu_handle, tbl.bufq[idx].fd, tbl.bufq[idx].dma_buf,
+			iova_ptr, len_ptr, buf_tracker, &ref_count);
+
+	if (rc) {
+		CAM_ERR(CAM_MEM,
+			"failed to find buf_hdl:0x%x, mmu_hdl: 0x%x for fd:%d i_ino:%lu",
+			buf_handle, mmu_handle, tbl.bufq[idx].fd, tbl.bufq[idx].i_ino);
+		goto err;
+	}
+
+	/* Save iova in bufq for future use */
+	cam_mem_mgr_update_iova_info_locked(tbl.bufq[idx].hdls_info,
+		*iova_ptr, mmu_handle, *len_ptr, false, ref_count);
+
+end:
+	CAM_DBG(CAM_MEM,
+		"handle:0x%x fd:%d i_ino:%lu iova_ptr:0x%lx len_ptr:%lu retrieved from bufq: %s",
+		mmu_handle, tbl.bufq[idx].fd, tbl.bufq[idx].i_ino, *iova_ptr, *len_ptr,
+		CAM_BOOL_TO_YESNO(retrieved_iova));
+err:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_get_io_buf);
+
+int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr, size_t *len)
+{
+	int idx, rc = 0;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!buf_handle || !vaddr_ptr || !len)
+		return -EINVAL;
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
+
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0)
+		return -EINVAL;
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "Buffer at idx=%d is already unmapped,",
+			idx);
+		rc = -EPERM;
+		goto end;
+	}
+
+	if (buf_handle != tbl.bufq[idx].buf_handle) {
+		CAM_ERR(CAM_MEM, "idx: %d Invalid buf handle %d",
+				idx, buf_handle);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!(tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS)) {
+		CAM_ERR(CAM_MEM, "idx: %d Invalid flag 0x%x",
+					idx, tbl.bufq[idx].flags);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	spin_lock(&tbl.bufq[idx].idx_lock);
+	if (tbl.bufq[idx].kmdvaddr && kref_get_unless_zero(&tbl.bufq[idx].krefcount)) {
+		*vaddr_ptr = tbl.bufq[idx].kmdvaddr;
+		*len = tbl.bufq[idx].len;
+	} else {
+		CAM_ERR(CAM_MEM, "No KMD access requested, kmdvddr= %p, idx= %d, buf_handle= %d",
+			tbl.bufq[idx].kmdvaddr, idx, buf_handle);
+		rc = -EINVAL;
+	}
+	spin_unlock(&tbl.bufq[idx].idx_lock);
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_get_cpu_buf);
+
+int cam_mem_mgr_cache_ops(struct cam_mem_cache_ops_cmd *cmd)
+{
+	int rc = 0, idx;
+	uint32_t cache_dir;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!cmd)
+		return -EINVAL;
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(cmd->buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0)
+		return -EINVAL;
+
+	mutex_lock(&tbl.m_lock);
+	if (!test_bit(idx, tbl.bitmap)) {
+		CAM_ERR(CAM_MEM, "Buffer at idx=%d is already unmapped,",
+			idx);
+		mutex_unlock(&tbl.m_lock);
+		return -EINVAL;
+	}
+	mutex_unlock(&tbl.m_lock);
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (cmd->buf_handle != tbl.bufq[idx].buf_handle) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+	CAM_DBG(CAM_MEM, "Calling dmap buf APIs for cache operations");
+	cache_dir = DMA_BIDIRECTIONAL;
+#else
+	unsigned long dmabuf_flag = 0;
+	rc = dma_buf_get_flags(tbl.bufq[idx].dma_buf, &dmabuf_flag);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "cache get flags failed %d", rc);
+		goto end;
+	}
+
+	if (dmabuf_flag & ION_FLAG_CACHED) {
+		switch (cmd->mem_cache_ops) {
+		case CAM_MEM_CLEAN_CACHE:
+			cache_dir = DMA_TO_DEVICE;
+			break;
+		case CAM_MEM_INV_CACHE:
+			cache_dir = DMA_FROM_DEVICE;
+			break;
+		case CAM_MEM_CLEAN_INV_CACHE:
+			cache_dir = DMA_BIDIRECTIONAL;
+			break;
+		default:
+			CAM_ERR(CAM_MEM,
+				"invalid cache ops :%d", cmd->mem_cache_ops);
+			rc = -EINVAL;
+			goto end;
+		}
+	} else {
+		CAM_DBG(CAM_MEM, "BUF is not cached");
+		goto end;
+	}
+#endif
+	rc = dma_buf_begin_cpu_access(tbl.bufq[idx].dma_buf,
+		(cmd->mem_cache_ops == CAM_MEM_CLEAN_INV_CACHE) ?
+		DMA_BIDIRECTIONAL : DMA_TO_DEVICE);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "dma begin access failed rc=%d", rc);
+		goto end;
+	}
+
+	rc = dma_buf_end_cpu_access(tbl.bufq[idx].dma_buf,
+		cache_dir);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "dma end access failed rc=%d", rc);
+		goto end;
+	}
+
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_cache_ops);
+
+int cam_mem_mgr_cpu_access_op(struct cam_mem_cpu_access_op *cmd)
+{
+	int rc = 0, idx;
+	uint32_t direction;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_MEM, "Invalid cmd");
+		return -EINVAL;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(cmd->buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Invalid idx=%d, buf_handle 0x%x, access=0x%x",
+			idx, cmd->buf_handle, cmd->access);
+		return -EINVAL;
+	}
+
+	mutex_lock(&tbl.m_lock);
+	if (!test_bit(idx, tbl.bitmap)) {
+		CAM_ERR(CAM_MEM, "Buffer at idx=%d is already freed/unmapped", idx);
+		mutex_unlock(&tbl.m_lock);
+		return -EINVAL;
+	}
+	mutex_unlock(&tbl.m_lock);
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (cmd->buf_handle != tbl.bufq[idx].buf_handle) {
+		CAM_ERR(CAM_MEM,
+			"Buffer at idx=%d is different incoming handle 0x%x, actual handle 0x%x",
+			idx, cmd->buf_handle, tbl.bufq[idx].buf_handle);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_MEM, "buf_handle=0x%x, access=0x%x, access_type=0x%x, override_access=%d",
+		cmd->buf_handle, cmd->access, cmd->access_type,
+		g_cam_mem_mgr_debug.override_cpu_access_dir);
+
+	if (cmd->access_type & CAM_MEM_CPU_ACCESS_READ &&
+		cmd->access_type & CAM_MEM_CPU_ACCESS_WRITE) {
+		direction = DMA_BIDIRECTIONAL;
+	} else if (cmd->access_type & CAM_MEM_CPU_ACCESS_READ) {
+		direction = DMA_FROM_DEVICE;
+	} else if (cmd->access_type & CAM_MEM_CPU_ACCESS_WRITE) {
+		direction = DMA_TO_DEVICE;
+	} else {
+		direction = DMA_BIDIRECTIONAL;
+		CAM_WARN(CAM_MEM,
+			"Invalid access type buf_handle=0x%x, access=0x%x, access_type=0x%x",
+			cmd->buf_handle, cmd->access, cmd->access_type);
+	}
+
+	if (g_cam_mem_mgr_debug.override_cpu_access_dir)
+		direction = DMA_BIDIRECTIONAL;
+
+	if (cmd->access & CAM_MEM_BEGIN_CPU_ACCESS) {
+		rc = dma_buf_begin_cpu_access(tbl.bufq[idx].dma_buf, direction);
+		if (rc) {
+			CAM_ERR(CAM_MEM,
+				"dma begin cpu access failed rc=%d, buf_handle=0x%x, access=0x%x, access_type=0x%x",
+				rc, cmd->buf_handle, cmd->access, cmd->access_type);
+			goto end;
+		}
+	}
+
+	if (cmd->access & CAM_MEM_END_CPU_ACCESS) {
+		rc = dma_buf_end_cpu_access(tbl.bufq[idx].dma_buf, direction);
+		if (rc) {
+			CAM_ERR(CAM_MEM,
+				"dma end cpu access failed rc=%d, buf_handle=0x%x, access=0x%x, access_type=0x%x",
+				rc, cmd->buf_handle, cmd->access, cmd->access_type);
+			goto end;
+		}
+	}
+
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_cpu_access_op);
+
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+
+#define CAM_MAX_VMIDS 4
+
+static void cam_mem_mgr_put_dma_heaps(void)
+{
+	CAM_DBG(CAM_MEM, "Releasing DMA Buf heaps usage");
+}
+
+static int cam_mem_mgr_get_dma_heaps(void)
+{
+	int rc = 0;
+
+	tbl.system_heap = NULL;
+	tbl.system_movable_heap = NULL;
+	tbl.system_uncached_heap = NULL;
+	tbl.camera_heap = NULL;
+	tbl.camera_uncached_heap = NULL;
+	tbl.secure_display_heap = NULL;
+	tbl.ubwc_p_heap = NULL;
+	tbl.ubwc_p_movable_heap = NULL;
+
+	tbl.system_heap = dma_heap_find("system");
+	if (IS_ERR_OR_NULL(tbl.system_heap)) {
+		rc = PTR_ERR(tbl.system_heap);
+		CAM_ERR(CAM_MEM, "System heap not found, rc=%d", rc);
+		tbl.system_heap = NULL;
+		goto put_heaps;
+	}
+
+	tbl.system_movable_heap = dma_heap_find("qcom,system-movable");
+	if (IS_ERR_OR_NULL(tbl.system_movable_heap)) {
+		rc = PTR_ERR(tbl.system_movable_heap);
+		CAM_DBG(CAM_MEM, "qcom system heap not found, rc=%d", rc);
+		tbl.system_movable_heap = NULL;
+		/* not fatal error, we can fallback to system heap */
+	}
+
+	tbl.system_uncached_heap = dma_heap_find("qcom,system-uncached");
+	if (IS_ERR_OR_NULL(tbl.system_uncached_heap)) {
+		if (tbl.force_cache_allocs) {
+			/* optional, we anyway do not use uncached */
+			CAM_DBG(CAM_MEM,
+				"qcom system-uncached heap not found, err=%d",
+				PTR_ERR(tbl.system_uncached_heap));
+			tbl.system_uncached_heap = NULL;
+		} else {
+			/* fatal, must need uncached heaps */
+			rc = PTR_ERR(tbl.system_uncached_heap);
+			CAM_ERR(CAM_MEM,
+				"qcom system-uncached heap not found, rc=%d",
+				rc);
+			tbl.system_uncached_heap = NULL;
+			goto put_heaps;
+		}
+	}
+
+	tbl.ubwc_p_heap = dma_heap_find("qcom,ubwcp");
+	if (IS_ERR_OR_NULL(tbl.ubwc_p_heap)) {
+		CAM_DBG(CAM_MEM, "qcom ubwcp heap not found, err=%d", PTR_ERR(tbl.ubwc_p_heap));
+		tbl.ubwc_p_heap = NULL;
+	}
+
+	tbl.ubwc_p_movable_heap = dma_heap_find("qcom,ubwcp-movable");
+	if (IS_ERR_OR_NULL(tbl.ubwc_p_movable_heap)) {
+		CAM_DBG(CAM_MEM, "qcom ubwcp movable heap not found, err=%d",
+			PTR_ERR(tbl.ubwc_p_movable_heap));
+		tbl.ubwc_p_movable_heap = NULL;
+	}
+
+	tbl.secure_display_heap = dma_heap_find("qcom,display");
+	if (IS_ERR_OR_NULL(tbl.secure_display_heap)) {
+		rc = PTR_ERR(tbl.secure_display_heap);
+		CAM_ERR(CAM_MEM, "qcom,display heap not found, rc=%d",
+			rc);
+		tbl.secure_display_heap = NULL;
+		goto put_heaps;
+	}
+
+	tbl.camera_heap = dma_heap_find("qcom,camera");
+	if (IS_ERR_OR_NULL(tbl.camera_heap)) {
+		/* optional heap, not a fatal error */
+		CAM_DBG(CAM_MEM, "qcom camera heap not found, err=%d",
+			PTR_ERR(tbl.camera_heap));
+		tbl.camera_heap = NULL;
+	}
+
+	tbl.camera_uncached_heap = dma_heap_find("qcom,camera-uncached");
+	if (IS_ERR_OR_NULL(tbl.camera_uncached_heap)) {
+		/* optional heap, not a fatal error */
+		CAM_DBG(CAM_MEM, "qcom camera heap not found, err=%d",
+			PTR_ERR(tbl.camera_uncached_heap));
+		tbl.camera_uncached_heap = NULL;
+	}
+
+	CAM_INFO(CAM_MEM,
+		"Heaps : system=%pK %pK, system_uncached=%pK, camera=%pK, camera-uncached=%pK, secure_display=%pK, ubwc_p=%pK %pK",
+		tbl.system_heap, tbl.system_movable_heap, tbl.system_uncached_heap,
+		tbl.camera_heap, tbl.camera_uncached_heap,
+		tbl.secure_display_heap, tbl.ubwc_p_heap,  tbl.ubwc_p_movable_heap);
+
+	return 0;
+put_heaps:
+	cam_mem_mgr_put_dma_heaps();
+	return rc;
+}
+
+int cam_mem_mgr_check_for_supported_heaps(uint64_t *heap_mask)
+{
+	uint64_t heap_caps = 0;
+
+	if (!heap_mask)
+		return -EINVAL;
+
+	if (tbl.ubwc_p_heap)
+		heap_caps |= CAM_REQ_MGR_MEM_UBWC_P_HEAP_SUPPORTED;
+
+	if ((tbl.camera_heap) || (tbl.camera_uncached_heap))
+		heap_caps |= CAM_REQ_MGR_MEM_CAMERA_HEAP_SUPPORTED;
+
+	*heap_mask = heap_caps;
+	return 0;
+}
+
+static int cam_mem_util_get_dma_buf(size_t len,
+	unsigned int cam_flags,
+	enum cam_mem_mgr_allocator alloc_type,
+	struct dma_buf **buf,
+	unsigned long *i_ino)
+{
+	int rc = 0;
+	struct dma_heap *heap = NULL, *try_heap = NULL;
+	struct timespec64 ts1, ts2;
+	long microsec = 0;
+	bool use_cached_heap = false;
+	struct mem_buf_lend_kernel_arg arg;
+	int vmids[CAM_MAX_VMIDS];
+	int perms[CAM_MAX_VMIDS];
+	int num_vmids = 0;
+
+	if (!buf) {
+		CAM_ERR(CAM_MEM, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (g_cam_mem_mgr_debug.alloc_profile_enable)
+		CAM_GET_TIMESTAMP(ts1);
+
+	if ((cam_flags & CAM_MEM_FLAG_CACHE) ||
+		(tbl.force_cache_allocs &&
+		(!(cam_flags & CAM_MEM_FLAG_PROTECTED_MODE)))) {
+		CAM_DBG(CAM_MEM,
+			"Using CACHED heap, cam_flags=0x%x, force_cache_allocs=%d",
+			cam_flags, tbl.force_cache_allocs);
+		use_cached_heap = true;
+	} else if (cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) {
+		use_cached_heap = true;
+		CAM_DBG(CAM_MEM,
+			"Using CACHED heap for secure, cam_flags=0x%x, force_cache_allocs=%d",
+			cam_flags, tbl.force_cache_allocs);
+	} else {
+		use_cached_heap = false;
+		if (!tbl.system_uncached_heap && !tbl.camera_uncached_heap) {
+			CAM_ERR(CAM_MEM,
+				"Using UNCACHED heap not supported, cam_flags=0x%x, force_cache_allocs=%d",
+				cam_flags, tbl.force_cache_allocs);
+			return -EINVAL;
+		}
+	}
+
+	if (cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) {
+		if (IS_CSF25(tbl.csf_version.arch_ver, tbl.csf_version.max_ver)) {
+			heap = tbl.system_heap;
+			len = cam_align_dma_buf_size(len);
+		} else {
+			heap = tbl.secure_display_heap;
+			vmids[num_vmids] = VMID_CP_CAMERA;
+			perms[num_vmids] = PERM_READ | PERM_WRITE;
+			num_vmids++;
+		}
+
+		if (cam_flags & CAM_MEM_FLAG_CDSP_OUTPUT) {
+			CAM_DBG(CAM_MEM, "Secure mode CDSP flags");
+
+			vmids[num_vmids] = VMID_CP_CDSP;
+			perms[num_vmids] = PERM_READ | PERM_WRITE;
+			num_vmids++;
+		}
+	} else if (cam_flags & CAM_MEM_FLAG_EVA_NOPIXEL) {
+		heap = tbl.secure_display_heap;
+		vmids[num_vmids] = VMID_CP_NON_PIXEL;
+		perms[num_vmids] = PERM_READ | PERM_WRITE;
+		num_vmids++;
+	} else if (cam_flags & CAM_MEM_FLAG_UBWC_P_HEAP) {
+		if (!tbl.ubwc_p_heap) {
+			CAM_ERR(CAM_MEM, "ubwc-p heap is not available, can't allocate");
+			return -EINVAL;
+		}
+
+		if (tbl.ubwc_p_movable_heap && (alloc_type == CAM_MEMMGR_ALLOC_USER))
+			heap = tbl.ubwc_p_movable_heap;
+		else
+			heap = tbl.ubwc_p_heap;
+		CAM_DBG(CAM_MEM, "Allocating from ubwc-p heap %pK, size=%d, flags=0x%x",
+			heap, len, cam_flags);
+	} else if (use_cached_heap) {
+
+		/*
+		 * The default scheme is to try allocating from the camera heap
+		 * if available; if not, try for the system heap. Userland can also select
+		 * to pick a specific heap for allocation; this will deviate from the
+		 * default selection scheme.
+		 *
+		 */
+		if (!(cam_flags & CAM_MEM_FLAG_USE_SYS_HEAP_ONLY))
+			try_heap = tbl.camera_heap;
+
+		if (!(cam_flags & CAM_MEM_FLAG_USE_CAMERA_HEAP_ONLY)) {
+			if (tbl.system_movable_heap && (alloc_type == CAM_MEMMGR_ALLOC_USER))
+				heap = tbl.system_movable_heap;
+			else
+				heap = tbl.system_heap;
+		}
+	} else {
+		if (!(cam_flags & CAM_MEM_FLAG_USE_SYS_HEAP_ONLY))
+			try_heap = tbl.camera_uncached_heap;
+
+		if (!(cam_flags & CAM_MEM_FLAG_USE_CAMERA_HEAP_ONLY))
+			heap = tbl.system_uncached_heap;
+	}
+
+	CAM_DBG(CAM_MEM, "Using heaps : try=%pK, heap=%pK", try_heap, heap);
+
+	*buf = NULL;
+
+	if (!try_heap && !heap) {
+		CAM_ERR(CAM_MEM,
+			"No heap available for allocation, can't allocate flag: 0x%x",
+			cam_flags);
+		return -EINVAL;
+	}
+
+	if (try_heap) {
+		*buf = dma_heap_buffer_alloc(try_heap, len, O_RDWR, 0);
+		if (IS_ERR(*buf)) {
+			CAM_WARN(CAM_MEM,
+				"Failed in allocating from try heap, heap=%pK, len=%zu, err=%d",
+				try_heap, len, PTR_ERR(*buf));
+			*buf = NULL;
+		}
+	}
+
+	if (*buf == NULL) {
+		*buf = dma_heap_buffer_alloc(heap, len, O_RDWR, 0);
+		if (IS_ERR(*buf)) {
+			rc = PTR_ERR(*buf);
+			CAM_ERR(CAM_MEM,
+				"Failed in allocating from heap, heap=%pK, len=%zu, err=%d",
+				heap, len, rc);
+			*buf = NULL;
+			return rc;
+		}
+	}
+
+	*i_ino = file_inode((*buf)->file)->i_ino;
+
+	if (((cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) &&
+		!IS_CSF25(tbl.csf_version.arch_ver, tbl.csf_version.max_ver)) ||
+		(cam_flags & CAM_MEM_FLAG_EVA_NOPIXEL)) {
+		if (num_vmids >= CAM_MAX_VMIDS) {
+			CAM_ERR(CAM_MEM, "Insufficient array size for vmids %d", num_vmids);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		arg.nr_acl_entries = num_vmids;
+		arg.vmids = vmids;
+		arg.perms = perms;
+
+		rc = mem_buf_lend(*buf, &arg);
+		if (rc) {
+			CAM_ERR(CAM_MEM,
+				"Failed in buf lend rc=%d, buf=%pK, vmids [0]=0x%x, [1]=0x%x, [2]=0x%x",
+				rc, *buf, vmids[0], vmids[1], vmids[2]);
+			goto end;
+		}
+	}
+
+	CAM_DBG(CAM_MEM, "Allocate success, len=%zu, *buf=%pK, i_ino=%lu", len, *buf, *i_ino);
+
+	if (g_cam_mem_mgr_debug.alloc_profile_enable) {
+		CAM_GET_TIMESTAMP(ts2);
+		CAM_GET_TIMESTAMP_DIFF_IN_MICRO(ts1, ts2, microsec);
+		trace_cam_log_event("IONAllocProfile", "size and time in micro",
+			len, microsec);
+	}
+
+	return rc;
+end:
+	dma_buf_put(*buf);
+	return rc;
+}
+#else
+
+bool cam_mem_mgr_ubwc_p_heap_supported(void)
+{
+	return false;
+}
+
+static int cam_mem_util_get_dma_buf(size_t len,
+	unsigned int cam_flags,
+	enum cam_mem_mgr_allocator alloc_type,
+	struct dma_buf **buf,
+	unsigned long *i_ino)
+{
+	int rc = 0;
+	unsigned int heap_id;
+	int32_t ion_flag = 0;
+	struct timespec64 ts1, ts2;
+	long microsec = 0;
+
+	if (!buf) {
+		CAM_ERR(CAM_MEM, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (cam_flags & CAM_MEM_FLAG_UBWC_P_HEAP) {
+		CAM_ERR(CAM_MEM, "ubwcp heap not supported");
+		return -EINVAL;
+	}
+
+	if (g_cam_mem_mgr_debug.alloc_profile_enable)
+		CAM_GET_TIMESTAMP(ts1);
+
+	if ((cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) &&
+		(cam_flags & CAM_MEM_FLAG_CDSP_OUTPUT)) {
+		heap_id = ION_HEAP(ION_SECURE_DISPLAY_HEAP_ID);
+		ion_flag |=
+			ION_FLAG_SECURE | ION_FLAG_CP_CAMERA | ION_FLAG_CP_CDSP;
+	} else if (cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) {
+		heap_id = ION_HEAP(ION_SECURE_DISPLAY_HEAP_ID);
+		ion_flag |= ION_FLAG_SECURE | ION_FLAG_CP_CAMERA;
+	} else {
+		heap_id = ION_HEAP(ION_SYSTEM_HEAP_ID) |
+			ION_HEAP(ION_CAMERA_HEAP_ID);
+	}
+
+	if (cam_flags & CAM_MEM_FLAG_CACHE)
+		ion_flag |= ION_FLAG_CACHED;
+	else
+		ion_flag &= ~ION_FLAG_CACHED;
+
+	if (tbl.force_cache_allocs && (!(ion_flag & ION_FLAG_SECURE)))
+		ion_flag |= ION_FLAG_CACHED;
+
+	*buf = ion_alloc(len, heap_id, ion_flag);
+	if (IS_ERR_OR_NULL(*buf))
+		return -ENOMEM;
+
+	*i_ino = file_inode((*buf)->file)->i_ino;
+
+	if (g_cam_mem_mgr_debug.alloc_profile_enable) {
+		CAM_GET_TIMESTAMP(ts2);
+		CAM_GET_TIMESTAMP_DIFF_IN_MICRO(ts1, ts2, microsec);
+		trace_cam_log_event("IONAllocProfile", "size and time in micro",
+			len, microsec);
+	}
+
+	return rc;
+}
+#endif
+
+static int cam_mem_util_buffer_alloc(size_t len, uint32_t flags,
+	struct dma_buf **dmabuf,
+	int *fd,
+	unsigned long *i_ino)
+{
+	int rc;
+
+	rc = cam_mem_util_get_dma_buf(len, flags, CAM_MEMMGR_ALLOC_USER, dmabuf, i_ino);
+	if (rc) {
+		CAM_ERR(CAM_MEM,
+			"Error allocating dma buf : len=%llu, flags=0x%x",
+			len, flags);
+		return rc;
+	}
+
+	/*
+	 * increment the ref count so that ref count becomes 2 here
+	 * when we close fd, refcount becomes 1 and when we do
+	 * dmap_put_buf, ref count becomes 0 and memory will be freed.
+	 */
+	get_dma_buf(*dmabuf);
+
+	*fd = dma_buf_fd(*dmabuf, O_CLOEXEC);
+	if (*fd < 0) {
+		CAM_ERR(CAM_MEM, "get fd fail, *fd=%d", *fd);
+		rc = -EINVAL;
+		goto put_buf;
+	}
+
+	CAM_DBG(CAM_MEM, "Alloc success : len=%zu, *dmabuf=%pK, fd=%d, i_ino=%lu",
+		len, *dmabuf, *fd, *i_ino);
+
+	return rc;
+
+put_buf:
+	dma_buf_put(*dmabuf);
+	return rc;
+}
+
+static int cam_mem_util_check_alloc_flags(struct cam_mem_mgr_alloc_cmd_v2 *cmd)
+{
+	if (cmd->num_hdl > CAM_MEM_MMU_MAX_HANDLE) {
+		CAM_ERR(CAM_MEM, "Num of mmu hdl exceeded maximum(%d)",
+			CAM_MEM_MMU_MAX_HANDLE);
+		return -EINVAL;
+	}
+
+	if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE &&
+		cmd->flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		CAM_ERR(CAM_MEM, "Kernel mapping in secure mode not allowed");
+		return -EINVAL;
+	}
+
+	if ((cmd->flags & CAM_MEM_FLAG_EVA_NOPIXEL) &&
+		(cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE ||
+		cmd->flags & CAM_MEM_FLAG_KMD_ACCESS)) {
+		CAM_ERR(CAM_MEM,
+			"Kernel mapping and secure mode not allowed in no pixel mode");
+		return -EINVAL;
+	}
+
+	if (cmd->flags & CAM_MEM_FLAG_UBWC_P_HEAP &&
+		(cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE ||
+		cmd->flags & CAM_MEM_FLAG_EVA_NOPIXEL ||
+		cmd->flags & CAM_MEM_FLAG_KMD_ACCESS ||
+		cmd->flags & CAM_MEM_FLAG_CMD_BUF_TYPE ||
+		cmd->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS ||
+		cmd->flags & CAM_MEM_FLAG_HW_AND_CDM_OR_SHARED)) {
+		CAM_ERR(CAM_MEM,
+			"UBWC-P buffer not supported with this combinatation of flags 0x%x",
+			cmd->flags);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_mem_util_check_map_flags(struct cam_mem_mgr_map_cmd_v2 *cmd)
+{
+	if (!cmd->flags) {
+		CAM_ERR(CAM_MEM, "Invalid flags");
+		return -EINVAL;
+	}
+
+	if (cmd->num_hdl > CAM_MEM_MMU_MAX_HANDLE) {
+		CAM_ERR(CAM_MEM, "Num of mmu hdl %d exceeded maximum(%d)",
+			cmd->num_hdl, CAM_MEM_MMU_MAX_HANDLE);
+		return -EINVAL;
+	}
+
+	if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE &&
+		cmd->flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		CAM_ERR(CAM_MEM,
+			"Kernel mapping in secure mode not allowed, flags=0x%x",
+			cmd->flags);
+		return -EINVAL;
+	}
+
+	if (cmd->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) {
+		CAM_ERR(CAM_MEM,
+			"Shared memory buffers are not allowed to be mapped");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_mem_util_map_hw_va(uint32_t flags,
+	int32_t *mmu_hdls,
+	int32_t num_hdls,
+	int fd,
+	struct dma_buf *dmabuf,
+	struct cam_mem_buf_hw_hdl_info *hw_vaddr_info_arr,
+	size_t *len,
+	enum cam_smmu_region_id region,
+	bool is_internal)
+{
+	int i;
+	int rc = -1;
+	int dir = cam_mem_util_get_dma_dir(flags);
+	/* Delayed unmap should be disabled by default in QLI */
+	bool dis_delayed_unmap = true;
+	dma_addr_t hw_vaddr;
+	struct kref *ref_count;
+	struct cam_mem_buf_hw_hdl_info *hdl_info = NULL;
+
+	if (dir < 0) {
+		CAM_ERR(CAM_MEM, "fail to map DMA direction, dir=%d", dir);
+		return dir;
+	}
+
+	if (flags & CAM_MEM_FLAG_DISABLE_DELAYED_UNMAP)
+		dis_delayed_unmap = true;
+
+	CAM_DBG(CAM_MEM,
+		"map_hw_va : fd = %d, flags = 0x%x, dir=%d, num_hdls=%d",
+		fd, flags, dir, num_hdls);
+
+	for (i = 0; i < num_hdls; i++) {
+		if (cam_mem_mgr_is_iova_info_updated_locked(hw_vaddr_info_arr, mmu_hdls[i]))
+			continue;
+
+		/* If 36-bit enabled, check for ICP cmd buffers and map them within the shared region */
+		if (cam_smmu_is_expanded_memory() &&
+			cam_smmu_supports_shared_region(mmu_hdls[i]) &&
+			((flags & CAM_MEM_FLAG_CMD_BUF_TYPE) ||
+			(flags & CAM_MEM_FLAG_HW_AND_CDM_OR_SHARED)))
+			region = CAM_SMMU_REGION_SHARED;
+
+		if (flags & CAM_MEM_FLAG_PROTECTED_MODE)
+			rc = cam_smmu_map_stage2_iova(mmu_hdls[i], fd, dmabuf, dir, &hw_vaddr, len,
+				&ref_count);
+		else
+			rc = cam_smmu_map_user_iova(mmu_hdls[i], fd, dmabuf, dis_delayed_unmap, dir,
+				&hw_vaddr, len, region, is_internal, &ref_count);
+		if (rc) {
+			CAM_ERR(CAM_MEM,
+					"Failed %s map to smmu, i=%d, fd=%d, dir=%d, mmu_hdl=%d, rc=%d",
+					(flags & CAM_MEM_FLAG_PROTECTED_MODE) ? "" : "secured",
+					i, fd, dir, mmu_hdls[i], rc);
+			goto multi_map_fail;
+		}
+
+		/* cache hw va */
+		cam_mem_mgr_update_iova_info_locked(hw_vaddr_info_arr,
+			hw_vaddr, mmu_hdls[i], *len, true, ref_count);
+	}
+
+	return rc;
+multi_map_fail:
+	for (i = 0; i < tbl.max_hdls_supported; i++) {
+		if (!hw_vaddr_info_arr[i].valid_mapping)
+			continue;
+
+		hdl_info = &hw_vaddr_info_arr[i];
+
+		if (flags & CAM_MEM_FLAG_PROTECTED_MODE)
+			cam_smmu_unmap_stage2_iova(hdl_info->iommu_hdl, fd, dmabuf,
+				false);
+		else
+			cam_smmu_unmap_user_iova(hdl_info->iommu_hdl, fd, dmabuf,
+				CAM_SMMU_REGION_IO, false);
+	}
+	/* reset any updated entries */
+	memset(hw_vaddr_info_arr, 0x0, tbl.max_hdls_info_size);
+	return rc;
+}
+
+int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd_v2 *cmd)
+{
+	int rc, idx;
+	struct dma_buf *dmabuf = NULL;
+	int fd = -1;
+	size_t len;
+	uintptr_t kvaddr = 0;
+	size_t klen;
+	unsigned long i_ino = 0;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_MEM, " Invalid argument");
+		return -EINVAL;
+	}
+
+	if (cmd->num_hdl > tbl.max_hdls_supported) {
+		CAM_ERR(CAM_MEM, "Num of mmu hdl %d exceeded maximum(%d)",
+			cmd->num_hdl, tbl.max_hdls_supported);
+		return -EINVAL;
+	}
+
+	len = cmd->len;
+
+	if (tbl.need_shared_buffer_padding &&
+		(cmd->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS)) {
+		len += CAM_MEM_SHARED_BUFFER_PAD_4K;
+		CAM_DBG(CAM_MEM, "Pad 4k size, actual %llu, allocating %zu",
+			cmd->len, len);
+	}
+
+	rc = cam_mem_util_check_alloc_flags(cmd);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Invalid flags: flags = 0x%X, rc=%d",
+			cmd->flags, rc);
+		return rc;
+	}
+
+	rc = cam_mem_util_buffer_alloc(len, cmd->flags, &dmabuf, &fd, &i_ino);
+	if (rc) {
+		CAM_ERR(CAM_MEM,
+			"Ion Alloc failed, len=%llu, align=%llu, flags=0x%x, num_hdl=%d",
+			len, cmd->align, cmd->flags, cmd->num_hdl);
+		cam_mem_mgr_print_tbl();
+		return rc;
+	}
+	if (!dmabuf) {
+		CAM_ERR(CAM_MEM,
+			"Ion Alloc return NULL dmabuf! fd=%d, i_ino=%lu, len=%d", fd, i_ino, len);
+		cam_mem_mgr_print_tbl();
+		return rc;
+	}
+
+	idx = cam_mem_get_slot();
+	if (idx < 0) {
+		CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d", idx);
+		rc = -ENOMEM;
+		cam_mem_mgr_print_tbl();
+		goto slot_fail;
+	}
+
+	if (cam_dma_buf_set_name(dmabuf, cmd->buf_name))
+		CAM_ERR(CAM_MEM, "set dma buffer name(%s) failed", cmd->buf_name);
+
+	if ((cmd->flags & CAM_MEM_FLAG_HW_READ_WRITE) ||
+		(cmd->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) ||
+		(cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)) {
+
+		enum cam_smmu_region_id region;
+
+		if (cmd->flags & CAM_MEM_FLAG_HW_READ_WRITE)
+			region = CAM_SMMU_REGION_IO;
+
+
+		if (cmd->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS)
+			region = CAM_SMMU_REGION_SHARED;
+
+		if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)
+			region = CAM_SMMU_REGION_IO;
+
+		rc = cam_mem_util_map_hw_va(cmd->flags,
+			cmd->mmu_hdls,
+			cmd->num_hdl,
+			fd,
+			dmabuf,
+			tbl.bufq[idx].hdls_info,
+			&len,
+			region,
+			true);
+
+		if (rc) {
+			CAM_ERR(CAM_MEM,
+				"Failed in map_hw_va len=%llu, flags=0x%x, fd=%d, region=%d, num_hdl=%d, rc=%d",
+				len, cmd->flags,
+				fd, region, cmd->num_hdl, rc);
+			if (rc == -EALREADY) {
+				if ((size_t)dmabuf->size != len)
+					rc = -EBADR;
+				cam_mem_mgr_print_tbl();
+			}
+			goto map_hw_fail;
+		}
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	tbl.bufq[idx].fd = fd;
+	tbl.bufq[idx].i_ino = i_ino;
+	tbl.bufq[idx].dma_buf = NULL;
+	tbl.bufq[idx].flags = cmd->flags;
+	tbl.bufq[idx].buf_handle = GET_MEM_HANDLE(idx, fd);
+	tbl.bufq[idx].is_internal = true;
+	if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)
+		CAM_MEM_MGR_SET_SECURE_HDL(tbl.bufq[idx].buf_handle, true);
+
+	if (cmd->flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		rc = cam_mem_util_map_cpu_va(dmabuf, &kvaddr, &klen);
+		if (rc) {
+			CAM_ERR(CAM_MEM, "dmabuf: %pK mapping failed: %d",
+				dmabuf, rc);
+			goto map_kernel_fail;
+		}
+	}
+
+	if (cmd->flags & CAM_MEM_FLAG_KMD_DEBUG_FLAG)
+		tbl.dbg_buf_idx = idx;
+
+	tbl.bufq[idx].kmdvaddr = kvaddr;
+	tbl.bufq[idx].dma_buf = dmabuf;
+	tbl.bufq[idx].len = len;
+	tbl.bufq[idx].num_hdls = cmd->num_hdl;
+	cam_mem_mgr_reset_presil_params(idx);
+	tbl.bufq[idx].is_imported = false;
+
+	if (cmd->flags & CAM_MEM_FLAG_KMD_ACCESS)
+		kref_init(&tbl.bufq[idx].krefcount);
+
+	kref_init(&tbl.bufq[idx].urefcount);
+
+	tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_USER;
+	strscpy(tbl.bufq[idx].buf_name, cmd->buf_name, sizeof(tbl.bufq[idx].buf_name));
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	cmd->out.buf_handle = tbl.bufq[idx].buf_handle;
+	cmd->out.fd = tbl.bufq[idx].fd;
+	cmd->out.vaddr = 0;
+
+	CAM_DBG(CAM_MEM,
+		"fd=%d, flags=0x%x, num_hdl=%d, idx=%d, buf handle=%x, len=%zu, i_ino=%lu, name:%s",
+		cmd->out.fd, cmd->flags, cmd->num_hdl, idx, cmd->out.buf_handle,
+		tbl.bufq[idx].len, tbl.bufq[idx].i_ino, cmd->buf_name);
+
+	return rc;
+
+map_kernel_fail:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+map_hw_fail:
+	cam_mem_put_slot(idx);
+slot_fail:
+	dma_buf_put(dmabuf);
+	return rc;
+}
+
+static bool cam_mem_util_is_map_internal(int32_t fd, unsigned i_ino)
+{
+	uint32_t i;
+	bool is_internal = false;
+
+	mutex_lock(&tbl.m_lock);
+	for_each_set_bit(i, tbl.bitmap, tbl.bits) {
+		if ((tbl.bufq[i].fd == fd) && (tbl.bufq[i].i_ino == i_ino)) {
+			is_internal = tbl.bufq[i].is_internal;
+			break;
+		}
+	}
+	mutex_unlock(&tbl.m_lock);
+
+	return is_internal;
+}
+
+int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd_v2 *cmd)
+{
+	int32_t idx;
+	int rc;
+	struct dma_buf *dmabuf;
+	size_t len = 0;
+	bool is_internal = false;
+	unsigned long i_ino;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!cmd || (cmd->fd < 0)) {
+		CAM_ERR(CAM_MEM, "Invalid argument");
+		return -EINVAL;
+	}
+
+	if (cmd->num_hdl > tbl.max_hdls_supported) {
+		CAM_ERR(CAM_MEM, "Num of mmu hdl %d exceeded maximum(%d)",
+			cmd->num_hdl, tbl.max_hdls_supported);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_util_check_map_flags(cmd);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Invalid flags: flags = %X", cmd->flags);
+		return rc;
+	}
+
+	dmabuf = dma_buf_get(cmd->fd);
+	if (IS_ERR_OR_NULL((void *)(dmabuf))) {
+		CAM_ERR(CAM_MEM, "Failed to import dma_buf fd");
+		return -EINVAL;
+	}
+
+	i_ino = file_inode(dmabuf->file)->i_ino;
+
+	is_internal = cam_mem_util_is_map_internal(cmd->fd, i_ino);
+
+	idx = cam_mem_get_slot();
+	if (idx < 0) {
+		CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d, fd=%d",
+			idx, cmd->fd);
+		rc = -ENOMEM;
+		cam_mem_mgr_print_tbl();
+		goto slot_fail;
+	}
+
+	if (cam_dma_buf_set_name(dmabuf, cmd->buf_name))
+		CAM_DBG(CAM_MEM, "Dma buffer (%s) busy", cmd->buf_name);
+
+	if ((cmd->flags & CAM_MEM_FLAG_HW_READ_WRITE) ||
+		(cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)) {
+		rc = cam_mem_util_map_hw_va(cmd->flags,
+			cmd->mmu_hdls,
+			cmd->num_hdl,
+			cmd->fd,
+			dmabuf,
+			tbl.bufq[idx].hdls_info,
+			&len,
+			CAM_SMMU_REGION_IO,
+			is_internal);
+		if (rc) {
+			CAM_ERR(CAM_MEM,
+				"Failed in map_hw_va, flags=0x%x, fd=%d, len=%llu, region=%d, num_hdl=%d, rc=%d",
+				cmd->flags, cmd->fd, len,
+				CAM_SMMU_REGION_IO, cmd->num_hdl, rc);
+			if (rc == -EALREADY) {
+				if ((size_t)dmabuf->size != len) {
+					rc = -EBADR;
+					cam_mem_mgr_print_tbl();
+				}
+			}
+			goto map_fail;
+		}
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	tbl.bufq[idx].fd = cmd->fd;
+	tbl.bufq[idx].i_ino = i_ino;
+	tbl.bufq[idx].dma_buf = NULL;
+	tbl.bufq[idx].flags = cmd->flags;
+	spin_lock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].buf_handle = GET_MEM_HANDLE(idx, cmd->fd);
+	spin_unlock(&tbl.bufq[idx].idx_lock);
+
+	if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)
+		CAM_MEM_MGR_SET_SECURE_HDL(tbl.bufq[idx].buf_handle, true);
+	tbl.bufq[idx].kmdvaddr = 0;
+	tbl.bufq[idx].dma_buf = dmabuf;
+	tbl.bufq[idx].len = len;
+	tbl.bufq[idx].num_hdls = cmd->num_hdl;
+	tbl.bufq[idx].is_imported = true;
+	tbl.bufq[idx].is_internal = is_internal;
+	if (cmd->flags & CAM_MEM_FLAG_KMD_ACCESS)
+		kref_init(&tbl.bufq[idx].krefcount);
+	kref_init(&tbl.bufq[idx].urefcount);
+	tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_USER;
+	strscpy(tbl.bufq[idx].buf_name, cmd->buf_name, sizeof(tbl.bufq[idx].buf_name));
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	cmd->out.buf_handle = tbl.bufq[idx].buf_handle;
+	cmd->out.vaddr = 0;
+	cmd->out.size = (uint32_t)len;
+	CAM_DBG(CAM_MEM,
+		"fd=%d, flags=0x%x, num_hdl=%d, idx=%d, buf handle=%x, len=%zu, i_ino=%lu, name:%s",
+		cmd->fd, cmd->flags, cmd->num_hdl, idx, cmd->out.buf_handle,
+		tbl.bufq[idx].len, tbl.bufq[idx].i_ino, cmd->buf_name);
+
+	return rc;
+map_fail:
+	cam_mem_put_slot(idx);
+slot_fail:
+	dma_buf_put(dmabuf);
+	return rc;
+}
+
+static int cam_mem_util_unmap_hw_va(int32_t idx,
+	enum cam_smmu_region_id region,
+	enum cam_smmu_mapping_client client, bool force_unmap)
+{
+	int i, fd, num_hdls;
+	uint32_t flags;
+	struct cam_mem_buf_hw_hdl_info *hdl_info = NULL;
+	struct dma_buf *dma_buf;
+	unsigned long i_ino;
+	int rc = 0;
+
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index");
+		return -EINVAL;
+	}
+
+	flags = tbl.bufq[idx].flags;
+	num_hdls = tbl.bufq[idx].num_hdls;
+	fd = tbl.bufq[idx].fd;
+	dma_buf = tbl.bufq[idx].dma_buf;
+	i_ino = tbl.bufq[idx].i_ino;
+
+	if (unlikely(!num_hdls)) {
+		CAM_DBG(CAM_MEM, "No valid handles to unmap");
+		return 0;
+	}
+
+	CAM_DBG(CAM_MEM,
+		"unmap_hw_va : idx=%d, fd=%x, i_ino=%lu flags=0x%x, num_hdls=%d, client=%d",
+		idx, fd, i_ino, flags, tbl.bufq[idx].num_hdls, client);
+
+	for (i = 0; i < tbl.max_hdls_supported; i++) {
+		if (!tbl.bufq[idx].hdls_info[i].valid_mapping)
+			continue;
+
+		hdl_info = &tbl.bufq[idx].hdls_info[i];
+
+		if (flags & CAM_MEM_FLAG_PROTECTED_MODE)
+			rc = cam_smmu_unmap_stage2_iova(hdl_info->iommu_hdl, fd, dma_buf,
+				force_unmap);
+		else if (client == CAM_SMMU_MAPPING_USER)
+			rc = cam_smmu_unmap_user_iova(hdl_info->iommu_hdl, fd, dma_buf, region,
+				force_unmap);
+		else if (client == CAM_SMMU_MAPPING_KERNEL)
+			rc = cam_smmu_unmap_kernel_iova(hdl_info->iommu_hdl,
+				tbl.bufq[idx].dma_buf, region);
+		else {
+			CAM_ERR(CAM_MEM, "invalid caller for unmapping : %d", client);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (rc < 0) {
+			CAM_ERR(CAM_MEM,
+				"Failed in %s unmap, i=%d, fd=%d, i_ino=%lu, mmu_hdl=%d, rc=%d",
+				((flags & CAM_MEM_FLAG_PROTECTED_MODE) ? "secure" : "non-secure"),
+				i, fd, i_ino, hdl_info->iommu_hdl, rc);
+			goto end;
+		}
+
+		CAM_DBG(CAM_MEM,
+			"i: %d unmap_hw_va : idx=%d, fd=%x, i_ino=%lu flags=0x%x, num_hdls=%d, client=%d hdl: %d",
+			i, idx, fd, i_ino, flags, tbl.bufq[idx].num_hdls,
+			client, hdl_info->iommu_hdl);
+
+		/* exit loop if all handles for this buffer have been unmapped */
+		if (!(--num_hdls))
+			break;
+	}
+
+end:
+	return rc;
+}
+
+static void cam_mem_mgr_unmap_active_buf(int idx)
+{
+	enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED;
+
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_SHARED_ACCESS)
+		region = CAM_SMMU_REGION_SHARED;
+	else if (tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_READ_WRITE)
+		region = CAM_SMMU_REGION_IO;
+
+	cam_mem_util_unmap_hw_va(idx, region, CAM_SMMU_MAPPING_USER, true);
+
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS)
+		cam_mem_util_unmap_cpu_va(tbl.bufq[idx].dma_buf,
+			tbl.bufq[idx].kmdvaddr);
+}
+
+static int cam_mem_mgr_cleanup_table(void)
+{
+	int i;
+
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
+		mutex_lock(&tbl.bufq[i].q_lock);
+		spin_lock(&tbl.bufq[i].idx_lock);
+		if (!tbl.bufq[i].active) {
+			CAM_DBG(CAM_MEM,
+				"Buffer inactive at idx=%d, continuing", i);
+			spin_unlock(&tbl.bufq[i].idx_lock);
+			mutex_unlock(&tbl.bufq[i].q_lock);
+			mutex_destroy(&tbl.bufq[i].q_lock);
+			continue;
+		} else {
+			CAM_DBG(CAM_MEM,
+			"Active buffer at idx=%d, possible leak needs unmapping",
+			i);
+			spin_unlock(&tbl.bufq[i].idx_lock);
+			cam_mem_mgr_unmap_active_buf(i);
+		}
+
+		if (tbl.bufq[i].dma_buf) {
+			dma_buf_put(tbl.bufq[i].dma_buf);
+			tbl.bufq[i].dma_buf = NULL;
+		}
+		tbl.bufq[i].fd = -1;
+		tbl.bufq[i].i_ino = 0;
+		tbl.bufq[i].flags = 0;
+		tbl.bufq[i].buf_handle = -1;
+		tbl.bufq[i].len = 0;
+		tbl.bufq[i].num_hdls = 0;
+		tbl.bufq[i].dma_buf = NULL;
+		tbl.bufq[i].active = false;
+		tbl.bufq[i].release_deferred = false;
+		tbl.bufq[i].is_internal = false;
+		kref_init(&tbl.bufq[i].krefcount);
+		kref_init(&tbl.bufq[i].urefcount);
+		memset(tbl.bufq[i].hdls_info, 0x0, tbl.max_hdls_info_size);
+		cam_mem_mgr_reset_presil_params(i);
+		mutex_unlock(&tbl.bufq[i].q_lock);
+		mutex_destroy(&tbl.bufq[i].q_lock);
+	}
+	mutex_lock(&tbl.m_lock);
+	bitmap_zero(tbl.bitmap, tbl.bits);
+	/* We need to reserve slot 0 because 0 is invalid */
+	set_bit(0, tbl.bitmap);
+	mutex_unlock(&tbl.m_lock);
+
+	return 0;
+}
+
+void cam_mem_mgr_deinit(void)
+{
+	int i;
+
+	if (!atomic_read(&cam_mem_mgr_state))
+		return;
+
+	atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_UNINITIALIZED);
+	cam_mem_mgr_cleanup_table();
+	cam_smmu_driver_deinit();
+	mutex_lock(&tbl.m_lock);
+	bitmap_zero(tbl.bitmap, tbl.bits);
+	kfree(tbl.bitmap);
+	tbl.bitmap = NULL;
+	tbl.dbg_buf_idx = -1;
+
+	/* index 0 is reserved */
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
+		kfree(tbl.bufq[i].hdls_info);
+		tbl.bufq[i].hdls_info = NULL;
+	}
+
+	mutex_unlock(&tbl.m_lock);
+	mutex_destroy(&tbl.m_lock);
+}
+
+static void cam_mem_util_unmap_dummy(struct kref *kref)
+{
+	CAM_DBG(CAM_MEM, "Cam mem util unmap dummy");
+}
+
+static void cam_mem_util_unmap(int32_t idx)
+{
+	int rc = 0;
+	enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED;
+	enum cam_smmu_mapping_client client;
+
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index");
+		return;
+	}
+
+	client = tbl.bufq[idx].smmu_mapping_client;
+
+	CAM_DBG(CAM_MEM, "Flags = %X idx %d", tbl.bufq[idx].flags, idx);
+
+	if (!tbl.bufq[idx].active) {
+		CAM_WARN(CAM_MEM, "Buffer at idx=%d is already unmapped", idx);
+		return;
+	}
+
+	/* Deactivate the buffer queue to prevent multiple unmap */
+	spin_lock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].active = false;
+	tbl.bufq[idx].buf_handle = -1;
+	spin_unlock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].release_deferred = false;
+
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		if (tbl.bufq[idx].dma_buf && tbl.bufq[idx].kmdvaddr) {
+			rc = cam_mem_util_unmap_cpu_va(tbl.bufq[idx].dma_buf,
+				tbl.bufq[idx].kmdvaddr);
+			if (rc)
+				CAM_ERR(CAM_MEM,
+					"Failed, dmabuf=%pK, kmdvaddr=%pK",
+					tbl.bufq[idx].dma_buf,
+					(void *) tbl.bufq[idx].kmdvaddr);
+		}
+	}
+
+	/* SHARED flag gets precedence, all other flags after it */
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) {
+		region = CAM_SMMU_REGION_SHARED;
+	} else {
+		if (tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_READ_WRITE)
+			region = CAM_SMMU_REGION_IO;
+	}
+
+	if ((tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_READ_WRITE) ||
+		(tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) ||
+		(tbl.bufq[idx].flags & CAM_MEM_FLAG_PROTECTED_MODE)) {
+		rc = cam_mem_util_unmap_hw_va(idx, region, client, false);
+		if (rc)
+			CAM_ERR(CAM_MEM, "Failed, dmabuf=%pK",
+				tbl.bufq[idx].dma_buf);
+	}
+
+	tbl.bufq[idx].flags = 0;
+
+	CAM_DBG(CAM_MEM,
+		"Ion buf at idx = %d freeing fd = %d, imported %d, dma_buf %pK, i_ino %lu",
+		idx, tbl.bufq[idx].fd, tbl.bufq[idx].is_imported, tbl.bufq[idx].dma_buf,
+		tbl.bufq[idx].i_ino);
+
+	if (tbl.bufq[idx].dma_buf)
+		dma_buf_put(tbl.bufq[idx].dma_buf);
+
+	tbl.bufq[idx].fd = -1;
+	tbl.bufq[idx].i_ino = 0;
+	tbl.bufq[idx].dma_buf = NULL;
+	tbl.bufq[idx].is_imported = false;
+	tbl.bufq[idx].is_internal = false;
+	tbl.bufq[idx].len = 0;
+	tbl.bufq[idx].num_hdls = 0;
+	memset(tbl.bufq[idx].hdls_info, 0x0, tbl.max_hdls_info_size);
+	cam_mem_mgr_reset_presil_params(idx);
+	memset(&tbl.bufq[idx].timestamp, 0, sizeof(struct timespec64));
+	memset(&tbl.bufq[idx].krefcount, 0, sizeof(struct kref));
+	memset(&tbl.bufq[idx].urefcount, 0, sizeof(struct kref));
+
+	mutex_lock(&tbl.m_lock);
+	clear_bit(idx, tbl.bitmap);
+	mutex_unlock(&tbl.m_lock);
+
+}
+
+static void cam_mem_util_unmap_wrapper(struct kref *kref)
+{
+	int32_t idx;
+	struct cam_mem_buf_queue *bufq = container_of(kref, typeof(*bufq), krefcount);
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(bufq->buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "idx: %d not valid", idx);
+		return;
+	}
+
+	cam_mem_util_unmap(idx);
+}
+
+void cam_mem_put_cpu_buf(int32_t buf_handle)
+{
+	int idx;
+	uint64_t ms, hrs, min, sec;
+	struct timespec64 current_ts;
+	uint32_t krefcount = 0, urefcount = 0;
+	bool unmap = false;
+
+	if (!buf_handle) {
+		CAM_ERR(CAM_MEM, "Invalid buf_handle");
+		return;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "idx: %d not valid", idx);
+		return;
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	spin_lock(&tbl.bufq[idx].idx_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "idx: %d not active", idx);
+		spin_unlock(&tbl.bufq[idx].idx_lock);
+		goto end;
+	}
+
+	if (buf_handle != tbl.bufq[idx].buf_handle) {
+		CAM_ERR(CAM_MEM, "idx: %d Invalid buf handle %d",
+				idx, buf_handle);
+		spin_unlock(&tbl.bufq[idx].idx_lock);
+		goto end;
+	}
+
+	kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap_dummy);
+
+	krefcount = kref_read(&tbl.bufq[idx].krefcount);
+	urefcount = kref_read(&tbl.bufq[idx].urefcount);
+	spin_unlock(&tbl.bufq[idx].idx_lock);
+
+	if ((krefcount == 1) && (urefcount == 0))
+		unmap = true;
+
+	if (unmap) {
+		cam_mem_util_unmap(idx);
+		CAM_GET_TIMESTAMP(current_ts);
+		CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
+		CAM_DBG(CAM_MEM,
+			"%llu:%llu:%llu:%llu  Called unmap from here, buf_handle: %u, idx: %d",
+			hrs, min, sec, ms, buf_handle, idx);
+	} else if (tbl.bufq[idx].release_deferred) {
+		CAM_CONVERT_TIMESTAMP_FORMAT((tbl.bufq[idx].timestamp), hrs, min, sec, ms);
+		CAM_ERR(CAM_MEM,
+			"%llu:%llu:%llu:%llu idx %d fd %d i_ino %lu size %llu active %d buf_handle %d krefCount %d urefCount %d buf_name %s",
+			hrs, min, sec, ms, idx, tbl.bufq[idx].fd, tbl.bufq[idx].i_ino,
+			tbl.bufq[idx].len, tbl.bufq[idx].active, tbl.bufq[idx].buf_handle,
+			krefcount, urefcount, tbl.bufq[idx].buf_name);
+		CAM_GET_TIMESTAMP(current_ts);
+		CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
+		CAM_ERR(CAM_MEM,
+			"%llu:%llu:%llu:%llu  Not unmapping even after defer, buf_handle: %u, idx: %d",
+			hrs, min, sec, ms, buf_handle, idx);
+	} else if (krefcount == 0) {
+		CAM_ERR(CAM_MEM,
+			"Unbalanced release Called buf_handle: %u, idx: %d kref: %d",
+			tbl.bufq[idx].buf_handle, idx, krefcount);
+	}
+
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+}
+EXPORT_SYMBOL(cam_mem_put_cpu_buf);
+
+void cam_mem_put_kref(int32_t buf_handle)
+{
+	int idx;
+	uint32_t krefcount = 0, urefcount = 0;
+	uint64_t ms, hrs, min, sec;
+
+	if (!buf_handle) {
+		CAM_ERR(CAM_MEM, "Invalid buf_handle");
+		return;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "idx: %d not valid", idx);
+		return;
+	}
+
+	spin_lock(&tbl.bufq[idx].idx_lock);
+	if (tbl.bufq[idx].active && (buf_handle == tbl.bufq[idx].buf_handle)) {
+		urefcount = kref_read(&tbl.bufq[idx].urefcount);
+		krefcount = kref_read(&tbl.bufq[idx].krefcount);
+
+		if (urefcount == 0) {
+			spin_unlock(&tbl.bufq[idx].idx_lock);
+			goto warn;
+		} else
+			kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap_dummy);
+	}
+	spin_unlock(&tbl.bufq[idx].idx_lock);
+	return;
+warn:
+	CAM_CONVERT_TIMESTAMP_FORMAT((tbl.bufq[idx].timestamp), hrs, min, sec, ms);
+	CAM_ERR(CAM_MEM,
+		"%llu:%llu:%llu:%llu idx %d fd %d i_ino %lu size %llu active %d buf_handle %d krefCount %d urefCount %d buf_name %s",
+		hrs, min, sec, ms, idx, tbl.bufq[idx].fd, tbl.bufq[idx].i_ino,
+		tbl.bufq[idx].len, tbl.bufq[idx].active, tbl.bufq[idx].buf_handle,
+		krefcount, urefcount, tbl.bufq[idx].buf_name);
+	CAM_ERR(CAM_MEM, "Buffer unmap called from UMD before KMD , not unmapping!");
+
+}
+EXPORT_SYMBOL(cam_mem_put_kref);
+
+int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd)
+{
+	int idx;
+	int rc = 0;
+	uint64_t ms, hrs, min, sec;
+	struct timespec64 current_ts;
+	uint32_t krefcount = 0, urefcount = 0;
+	bool unmap = false;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_MEM, "Invalid argument");
+		return -EINVAL;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(cmd->buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index %d extracted from mem handle",
+			idx);
+		return -EINVAL;
+	}
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "Released buffer state should be active");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tbl.bufq[idx].buf_handle != cmd->buf_handle) {
+		CAM_ERR(CAM_MEM,
+			"Released buf handle %d not matching within table %d, idx=%d",
+			cmd->buf_handle, tbl.bufq[idx].buf_handle, idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_MEM, "Releasing hdl = %x, idx = %d", cmd->buf_handle, idx);
+
+	kref_put(&tbl.bufq[idx].urefcount, cam_mem_util_unmap_dummy);
+
+	urefcount = kref_read(&tbl.bufq[idx].urefcount);
+
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		krefcount = kref_read(&tbl.bufq[idx].krefcount);
+		if ((krefcount == 1) && (urefcount == 0))
+			unmap = true;
+	} else {
+		if (urefcount == 0)
+			unmap = true;
+	}
+
+	if (unmap) {
+		cam_mem_util_unmap(idx);
+		CAM_DBG(CAM_MEM,
+			"Called unmap from here, buf_handle: %u, idx: %d", cmd->buf_handle, idx);
+	} else if (tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		rc = -EINVAL;
+		CAM_GET_TIMESTAMP(current_ts);
+		CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
+		CAM_CONVERT_TIMESTAMP_FORMAT((tbl.bufq[idx].timestamp), hrs, min, sec, ms);
+		CAM_ERR(CAM_MEM,
+			"%llu:%llu:%llu:%llu idx %d fd %d i_ino %lu size %llu active %d buf_handle %d krefCount %d urefCount %d buf_name %s",
+			hrs, min, sec, ms, idx, tbl.bufq[idx].fd, tbl.bufq[idx].i_ino,
+			tbl.bufq[idx].len, tbl.bufq[idx].active, tbl.bufq[idx].buf_handle,
+			krefcount, urefcount, tbl.bufq[idx].buf_name);
+		if (tbl.bufq[idx].release_deferred)
+			CAM_ERR(CAM_MEM, "Unbalanced release Called buf_handle: %u, idx: %d",
+				tbl.bufq[idx].buf_handle, idx);
+		tbl.bufq[idx].release_deferred = true;
+	}
+
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+
+int cam_mem_mgr_request_mem(struct cam_mem_mgr_request_desc *inp,
+	struct cam_mem_mgr_memory_desc *out)
+{
+	struct dma_buf *buf = NULL;
+	int ion_fd = -1, rc = 0;
+	uintptr_t kvaddr;
+	dma_addr_t iova = 0;
+	size_t request_len = 0;
+	uint32_t mem_handle;
+	int32_t idx;
+	int32_t smmu_hdl = 0;
+	unsigned long i_ino = 0;
+
+	enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!inp || !out) {
+		CAM_ERR(CAM_MEM, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (!(inp->flags & CAM_MEM_FLAG_HW_READ_WRITE ||
+		inp->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS ||
+		inp->flags & CAM_MEM_FLAG_CACHE)) {
+		CAM_ERR(CAM_MEM, "Invalid flags for request mem");
+		return -EINVAL;
+	}
+
+	rc = cam_mem_util_get_dma_buf(inp->size, inp->flags, CAM_MEMMGR_ALLOC_KERNEL, &buf, &i_ino);
+
+	if (rc) {
+		CAM_ERR(CAM_MEM, "ION alloc failed for shared buffer");
+		goto ion_fail;
+	} else if (!buf) {
+		CAM_ERR(CAM_MEM, "ION alloc returned NULL buffer");
+		goto ion_fail;
+	} else {
+		CAM_DBG(CAM_MEM, "Got dma_buf = %pK", buf);
+	}
+
+	/*
+	 * we are mapping kva always here,
+	 * update flags so that we do unmap properly
+	 */
+	inp->flags |= CAM_MEM_FLAG_KMD_ACCESS;
+	rc = cam_mem_util_map_cpu_va(buf, &kvaddr, &request_len);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Failed to get kernel vaddr");
+		goto map_fail;
+	}
+
+	if (!inp->smmu_hdl) {
+		CAM_ERR(CAM_MEM, "Invalid SMMU handle");
+		rc = -EINVAL;
+		goto smmu_fail;
+	}
+
+	/* SHARED flag gets precedence, all other flags after it */
+	if (inp->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) {
+		region = CAM_SMMU_REGION_SHARED;
+	} else {
+		if (inp->flags & CAM_MEM_FLAG_HW_READ_WRITE)
+			region = CAM_SMMU_REGION_IO;
+	}
+
+	rc = cam_smmu_map_kernel_iova(inp->smmu_hdl,
+		buf,
+		CAM_SMMU_MAP_RW,
+		&iova,
+		&request_len,
+		region);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_MEM, "SMMU mapping failed");
+		goto smmu_fail;
+	}
+
+	smmu_hdl = inp->smmu_hdl;
+
+	idx = cam_mem_get_slot();
+	if (idx < 0) {
+		CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d", idx);
+		rc = -ENOMEM;
+		cam_mem_mgr_print_tbl();
+		goto slot_fail;
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	mem_handle = GET_MEM_HANDLE(idx, ion_fd);
+	tbl.bufq[idx].dma_buf = buf;
+	tbl.bufq[idx].fd = -1;
+	tbl.bufq[idx].i_ino = i_ino;
+	tbl.bufq[idx].flags = inp->flags;
+	spin_lock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].buf_handle = mem_handle;
+	spin_unlock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].kmdvaddr = kvaddr;
+
+	cam_mem_mgr_update_iova_info_locked(tbl.bufq[idx].hdls_info,
+		iova, inp->smmu_hdl, inp->size, true, NULL);
+
+	tbl.bufq[idx].len = inp->size;
+	tbl.bufq[idx].num_hdls = 1;
+	tbl.bufq[idx].is_imported = false;
+	kref_init(&tbl.bufq[idx].krefcount);
+	tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_KERNEL;
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	out->kva = kvaddr;
+	out->iova = (uint32_t)iova;
+	out->smmu_hdl = smmu_hdl;
+	out->mem_handle = mem_handle;
+	out->len = inp->size;
+	out->region = region;
+
+	CAM_DBG(CAM_MEM, "idx=%d, dmabuf=%pK, i_ino=%lu, flags=0x%x, mem_handle=0x%x",
+		idx, buf, i_ino, inp->flags, mem_handle);
+
+	return rc;
+slot_fail:
+	cam_smmu_unmap_kernel_iova(inp->smmu_hdl,
+		buf, region);
+smmu_fail:
+	cam_mem_util_unmap_cpu_va(buf, kvaddr);
+map_fail:
+	dma_buf_put(buf);
+ion_fail:
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_request_mem);
+
+int cam_mem_mgr_release_mem(struct cam_mem_mgr_memory_desc *inp)
+{
+	int32_t idx;
+	int rc = 0;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!inp) {
+		CAM_ERR(CAM_MEM, "Invalid argument");
+		return -EINVAL;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(inp->mem_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index extracted from mem handle");
+		return -EINVAL;
+	}
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "Released buffer state should be active");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tbl.bufq[idx].buf_handle != inp->mem_handle) {
+		CAM_ERR(CAM_MEM,
+			"Released buf handle not matching within table");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_MEM, "Releasing hdl = %X", inp->mem_handle);
+	if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap_wrapper))
+		CAM_DBG(CAM_MEM,
+			"Called unmap from here, buf_handle: %u, idx: %d",
+			tbl.bufq[idx].buf_handle, idx);
+	else {
+		CAM_ERR(CAM_MEM,
+			"Unbalanced release Called buf_handle: %u, idx: %d",
+			tbl.bufq[idx].buf_handle, idx);
+		rc = -EINVAL;
+	}
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_release_mem);
+
+int cam_mem_mgr_reserve_memory_region(struct cam_mem_mgr_request_desc *inp,
+	enum cam_smmu_region_id region,
+	struct cam_mem_mgr_memory_desc *out)
+{
+	struct dma_buf *buf = NULL;
+	int rc = 0, ion_fd = -1;
+	dma_addr_t iova = 0;
+	size_t request_len = 0;
+	uint32_t mem_handle;
+	int32_t idx;
+	int32_t smmu_hdl = 0;
+	uintptr_t kvaddr = 0;
+	unsigned long i_ino = 0;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!inp || !out) {
+		CAM_ERR(CAM_MEM, "Invalid param(s)");
+		return -EINVAL;
+	}
+
+	if (!inp->smmu_hdl) {
+		CAM_ERR(CAM_MEM, "Invalid SMMU handle");
+		return -EINVAL;
+	}
+
+	if ((region != CAM_SMMU_REGION_SECHEAP) &&
+		(region != CAM_SMMU_REGION_FWUNCACHED)) {
+		CAM_ERR(CAM_MEM, "Only secondary heap supported");
+		return -EINVAL;
+	}
+
+	rc = cam_mem_util_get_dma_buf(inp->size, 0, CAM_MEMMGR_ALLOC_KERNEL, &buf, &i_ino);
+
+	if (rc) {
+		CAM_ERR(CAM_MEM, "ION alloc failed for sec heap buffer");
+		goto ion_fail;
+	} else if (!buf) {
+		CAM_ERR(CAM_MEM, "ION alloc returned NULL buffer");
+		goto ion_fail;
+	} else {
+		CAM_DBG(CAM_MEM, "Got dma_buf = %pK", buf);
+	}
+
+	if (inp->flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		rc = cam_mem_util_map_cpu_va(buf, &kvaddr, &request_len);
+		if (rc) {
+			CAM_ERR(CAM_MEM, "Failed to get kernel vaddr");
+			goto kmap_fail;
+		}
+	}
+
+	rc = cam_smmu_reserve_buf_region(region,
+		inp->smmu_hdl, buf, &iova, &request_len);
+
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Reserving secondary heap failed");
+		goto smmu_fail;
+	}
+
+	smmu_hdl = inp->smmu_hdl;
+
+	idx = cam_mem_get_slot();
+	if (idx < 0) {
+		CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d", idx);
+		rc = -ENOMEM;
+		cam_mem_mgr_print_tbl();
+		goto slot_fail;
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	mem_handle = GET_MEM_HANDLE(idx, ion_fd);
+	tbl.bufq[idx].fd = -1;
+	tbl.bufq[idx].i_ino = i_ino;
+	tbl.bufq[idx].dma_buf = buf;
+	tbl.bufq[idx].flags = inp->flags;
+	spin_lock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].buf_handle = mem_handle;
+	spin_unlock(&tbl.bufq[idx].idx_lock);
+	tbl.bufq[idx].kmdvaddr = kvaddr;
+
+	cam_mem_mgr_update_iova_info_locked(tbl.bufq[idx].hdls_info,
+		iova, inp->smmu_hdl, request_len, true, NULL);
+
+	tbl.bufq[idx].len = request_len;
+	tbl.bufq[idx].num_hdls = 1;
+	tbl.bufq[idx].is_imported = false;
+	kref_init(&tbl.bufq[idx].krefcount);
+	tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_KERNEL;
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	out->kva = kvaddr;
+	out->iova = (uint32_t)iova;
+	out->smmu_hdl = smmu_hdl;
+	out->mem_handle = mem_handle;
+	out->len = request_len;
+	out->region = region;
+
+	return rc;
+
+slot_fail:
+	cam_smmu_release_buf_region(region, smmu_hdl);
+smmu_fail:
+	if (region == CAM_SMMU_REGION_FWUNCACHED)
+		cam_mem_util_unmap_cpu_va(buf, kvaddr);
+kmap_fail:
+	dma_buf_put(buf);
+ion_fail:
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_reserve_memory_region);
+
+static void *cam_mem_mgr_user_dump_buf(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_mem_buf_queue          *buf = NULL;
+	uint64_t                          *addr;
+	int                                i = 0;
+
+	buf = (struct cam_mem_buf_queue *)dump_struct;
+
+	addr = (uint64_t *)addr_ptr;
+
+	*addr++ = buf->timestamp.tv_sec;
+	*addr++ = buf->timestamp.tv_nsec / NSEC_PER_USEC;
+	*addr++ = buf->fd;
+	*addr++ = buf->i_ino;
+	*addr++ = buf->buf_handle;
+	*addr++ = buf->len;
+	*addr++ = buf->align;
+	*addr++ = buf->flags;
+	*addr++ = buf->kmdvaddr;
+	*addr++ = buf->is_imported;
+	*addr++ = buf->is_internal;
+	*addr++ = buf->num_hdls;
+	for (i = 0; i < tbl.max_hdls_supported; i++) {
+		if (!buf->hdls_info[i].addr_updated)
+			continue;
+
+		*addr++ = buf->hdls_info[i].iommu_hdl;
+		*addr++ = buf->hdls_info[i].vaddr;
+	}
+
+	return addr;
+}
+
+int cam_mem_mgr_dump_user(struct cam_dump_req_cmd *dump_req)
+{
+	int                             rc = 0;
+	int                             i;
+	struct cam_common_hw_dump_args  dump_args;
+	size_t                          buf_len;
+	size_t                          remain_len;
+	uint32_t                        min_len;
+	uintptr_t                       cpu_addr;
+
+	rc = cam_mem_get_cpu_buf(dump_req->buf_handle,
+		&cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Invalid handle %u rc %d",
+			dump_req->buf_handle, rc);
+		return rc;
+	}
+	if (buf_len <= dump_req->offset) {
+		CAM_WARN(CAM_MEM, "Dump buffer overshoot len %zu offset %zu",
+			buf_len, dump_req->offset);
+		cam_mem_put_cpu_buf(dump_req->buf_handle);
+		return -ENOSPC;
+	}
+
+	remain_len = buf_len - dump_req->offset;
+	min_len =
+		(CAM_MEM_BUFQ_MAX *
+		(CAM_MEM_MGR_DUMP_BUF_NUM_WORDS * sizeof(uint64_t) +
+		sizeof(struct cam_common_hw_dump_header)));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_MEM, "Dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		cam_mem_put_cpu_buf(dump_req->buf_handle);
+		return -ENOSPC;
+	}
+
+	dump_args.req_id = dump_req->issue_req_id;
+	dump_args.cpu_addr = cpu_addr;
+	dump_args.buf_len = buf_len;
+	dump_args.offset = dump_req->offset;
+	dump_args.ctxt_to_hw_map = NULL;
+
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
+		mutex_lock(&tbl.bufq[i].q_lock);
+		if (tbl.bufq[i].active) {
+			rc = cam_common_user_dump_helper(&dump_args,
+				cam_mem_mgr_user_dump_buf,
+				&tbl.bufq[i],
+				sizeof(uint64_t), "MEM_MGR_BUF.%d:", i);
+			if (rc) {
+				CAM_ERR(CAM_CRM,
+					"Dump state info failed, rc: %d",
+					rc);
+				mutex_unlock(&tbl.bufq[i].q_lock);
+				return rc;
+			}
+		}
+		mutex_unlock(&tbl.bufq[i].q_lock);
+	}
+
+	dump_req->offset = dump_args.offset;
+	cam_mem_put_cpu_buf(dump_req->buf_handle);
+
+	return rc;
+}
+
+
+int cam_mem_mgr_free_memory_region(struct cam_mem_mgr_memory_desc *inp)
+{
+	int32_t rc = 0, idx, entry_idx;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!inp) {
+		CAM_ERR(CAM_MEM, "Invalid argument");
+		return -EINVAL;
+	}
+
+	if ((inp->region != CAM_SMMU_REGION_SECHEAP) &&
+		(inp->region != CAM_SMMU_REGION_FWUNCACHED)) {
+		CAM_ERR(CAM_MEM, "Only secondary heap supported");
+		return -EINVAL;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(inp->mem_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index extracted from mem handle");
+		return -EINVAL;
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "Released buffer state should be active");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tbl.bufq[idx].buf_handle != inp->mem_handle) {
+		CAM_ERR(CAM_MEM,
+			"Released buf handle not matching within table");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tbl.bufq[idx].num_hdls != 1) {
+		CAM_ERR(CAM_MEM,
+			"Sec heap region should have only one smmu hdl");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	if (!cam_mem_mgr_get_hwva_entry_idx(inp->smmu_hdl, &entry_idx)) {
+		CAM_ERR(CAM_MEM,
+			"Passed SMMU handle not a valid handle");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	if (inp->smmu_hdl != tbl.bufq[idx].hdls_info[entry_idx].iommu_hdl) {
+		CAM_ERR(CAM_MEM,
+			"Passed SMMU handle doesn't match with internal hdl");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	rc = cam_smmu_release_buf_region(inp->region, inp->smmu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_MEM,
+			"Sec heap region release failed");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	CAM_DBG(CAM_MEM, "Releasing hdl = %X", inp->mem_handle);
+	if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap_wrapper))
+		CAM_DBG(CAM_MEM,
+			"Called unmap from here, buf_handle: %u, idx: %d",
+			inp->mem_handle, idx);
+	else {
+		CAM_ERR(CAM_MEM,
+			"Unbalanced release Called buf_handle: %u, idx: %d",
+			inp->mem_handle, idx);
+		rc = -EINVAL;
+	}
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_free_memory_region);
+
+#ifdef CONFIG_CAM_PRESIL
+struct dma_buf *cam_mem_mgr_get_dma_buf(int fd)
+{
+	struct dma_buf *dmabuf = NULL;
+
+	dmabuf = dma_buf_get(fd);
+	if (IS_ERR_OR_NULL((void *)(dmabuf))) {
+		CAM_ERR(CAM_MEM, "Failed to import dma_buf for fd");
+		return NULL;
+	}
+
+	CAM_INFO(CAM_PRESIL, "Received DMA Buf* %pK", dmabuf);
+
+	return dmabuf;
+}
+
+int cam_mem_mgr_put_dmabuf_from_fd(uint64_t input_dmabuf)
+{
+	struct dma_buf *dmabuf = (struct dma_buf *)(uint64_t)input_dmabuf;
+	int idx = 0;
+
+	CAM_INFO(CAM_PRESIL, "Received dma_buf :%pK", dmabuf);
+
+	if (!dmabuf) {
+		CAM_ERR(CAM_PRESIL, "NULL to import dma_buf fd");
+		return -EINVAL;
+	}
+
+	for (idx = 0; idx < CAM_MEM_BUFQ_MAX; idx++) {
+		if ((tbl.bufq[idx].dma_buf != NULL) && (tbl.bufq[idx].dma_buf == dmabuf)) {
+			if (tbl.bufq[idx].presil_params.refcount)
+				tbl.bufq[idx].presil_params.refcount--;
+			else
+				CAM_ERR(CAM_PRESIL, "Unbalanced dmabuf put: %pK", dmabuf);
+
+			if (!tbl.bufq[idx].presil_params.refcount) {
+				dma_buf_put(dmabuf);
+				cam_mem_mgr_reset_presil_params(idx);
+				CAM_DBG(CAM_PRESIL, "Done dma_buf_put for %pK", dmabuf);
+			}
+		}
+	}
+
+	return 0;
+}
+
+int cam_mem_mgr_get_fd_from_dmabuf(uint64_t input_dmabuf)
+{
+	int fd_for_dmabuf = -1;
+	struct dma_buf *dmabuf = (struct dma_buf *)(uint64_t)input_dmabuf;
+	int idx = 0;
+
+	CAM_DBG(CAM_PRESIL, "Received dma_buf :%pK", dmabuf);
+
+	if (!dmabuf) {
+		CAM_ERR(CAM_PRESIL, "NULL to import dma_buf fd");
+		return -EINVAL;
+	}
+
+	for (idx = 0; idx < CAM_MEM_BUFQ_MAX; idx++) {
+		if ((tbl.bufq[idx].dma_buf != NULL) && (tbl.bufq[idx].dma_buf == dmabuf)) {
+			CAM_DBG(CAM_PRESIL,
+				"Found entry for request from Presil UMD Daemon at %d, dmabuf %pK fd_for_umd_daemon %d refcount: %d",
+				idx, tbl.bufq[idx].dma_buf,
+				tbl.bufq[idx].presil_params.fd_for_umd_daemon,
+				tbl.bufq[idx].presil_params.refcount);
+
+			if (tbl.bufq[idx].presil_params.fd_for_umd_daemon < 0) {
+				fd_for_dmabuf = dma_buf_fd(dmabuf, O_CLOEXEC);
+				if (fd_for_dmabuf < 0) {
+					CAM_ERR(CAM_PRESIL, "get fd fail, fd_for_dmabuf=%d",
+						fd_for_dmabuf);
+					return -EINVAL;
+				}
+
+				tbl.bufq[idx].presil_params.fd_for_umd_daemon = fd_for_dmabuf;
+				CAM_INFO(CAM_PRESIL,
+					"Received generated idx %d fd_for_dmabuf Buf* %lld", idx,
+					fd_for_dmabuf);
+			} else {
+				fd_for_dmabuf = tbl.bufq[idx].presil_params.fd_for_umd_daemon;
+				CAM_INFO(CAM_PRESIL,
+					"Received existing at idx %d fd_for_dmabuf Buf* %lld", idx,
+					fd_for_dmabuf);
+			}
+
+			tbl.bufq[idx].presil_params.refcount++;
+		} else {
+			CAM_DBG(CAM_MEM,
+				"Not found dmabuf at idx=%d, dma_buf %pK handle 0x%0x active %d ",
+				idx, tbl.bufq[idx].dma_buf, tbl.bufq[idx].buf_handle,
+				tbl.bufq[idx].active);
+		}
+	}
+
+	return (int)fd_for_dmabuf;
+}
+
+int cam_mem_mgr_send_buffer_to_presil(int32_t iommu_hdl, int32_t buf_handle)
+{
+	int rc = 0;
+
+	/* Sending Presil IO Buf to PC side ( as iova start address indicates) */
+	uint64_t io_buf_addr;
+	size_t io_buf_size;
+	int i, j, fd = -1, idx = 0;
+	uint8_t *iova_ptr = NULL;
+	uint64_t dmabuf = 0;
+	bool is_mapped_in_cb = false;
+
+	CAM_DBG(CAM_PRESIL, "buf handle 0x%0x", buf_handle);
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
+	for (i = 0; i < tbl.bufq[idx].num_hdl; i++) {
+		if (tbl.bufq[idx].hdls[i] == iommu_hdl)
+			is_mapped_in_cb = true;
+	}
+
+	if (!is_mapped_in_cb) {
+		for (j = 0; j < CAM_MEM_BUFQ_MAX; j++) {
+			if (tbl.bufq[j].i_ino == tbl.bufq[idx].i_ino) {
+				for (i = 0; i < tbl.bufq[j].num_hdl; i++) {
+					if (tbl.bufq[j].hdls[i] == iommu_hdl)
+						is_mapped_in_cb = true;
+				}
+			}
+		}
+
+		if (!is_mapped_in_cb) {
+			CAM_DBG(CAM_PRESIL,
+				"Still Could not find idx=%d, FD %d buf_handle 0x%0x",
+				idx, GET_FD_FROM_HANDLE(buf_handle), buf_handle);
+
+			/*
+			 * Okay to return 0, since this function also gets called for buffers that
+			 * are shared only between umd/kmd, these may not be mapped with smmu
+			 */
+			return 0;
+		}
+	}
+
+	if ((tbl.bufq[idx].buf_handle != 0) && (tbl.bufq[idx].active) &&
+		(tbl.bufq[idx].buf_handle == buf_handle)) {
+		CAM_DBG(CAM_PRESIL,
+			"Found dmabuf in bufq idx %d, FD %d handle 0x%0x dmabuf %pK",
+			idx, tbl.bufq[idx].fd, tbl.bufq[idx].buf_handle, tbl.bufq[idx].dma_buf);
+		dmabuf = (uint64_t)tbl.bufq[idx].dma_buf;
+		fd = tbl.bufq[idx].fd;
+	} else {
+		CAM_ERR(CAM_PRESIL,
+			"Could not find dmabuf Invalid Mem idx=%d, FD %d handle 0x%0x active %d",
+			idx, tbl.bufq[idx].fd, tbl.bufq[idx].buf_handle, tbl.bufq[idx].active);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_io_buf(buf_handle, iommu_hdl, &io_buf_addr, &io_buf_size,
+		NULL, NULL);
+	if (rc || NULL == (void *)io_buf_addr) {
+		CAM_DBG(CAM_PRESIL, "Invalid ioaddr : 0x%x, fd = %d,  dmabuf = %pK",
+			io_buf_addr, fd, dmabuf);
+		return -EINVAL;
+	}
+
+	iova_ptr = (uint8_t *)io_buf_addr;
+	CAM_INFO(CAM_PRESIL, "Sending buffer with ioaddr : 0x%x, fd = %d, dmabuf = %pK",
+		io_buf_addr, fd, dmabuf);
+
+	rc = cam_presil_send_buffer(dmabuf, 0, 0, (uint32_t)io_buf_size, (uint64_t)iova_ptr);
+
+	return rc;
+}
+
+int cam_mem_mgr_send_all_buffers_to_presil(int32_t iommu_hdl)
+{
+	int idx = 0;
+	int rc = 0;
+	int32_t fd_already_sent[128];
+	int fd_already_sent_count = 0;
+	int fd_already_index = 0;
+	int fd_already_sent_found = 0;
+
+
+	memset(&fd_already_sent, 0x0, sizeof(fd_already_sent));
+
+	for (idx = 0; idx < CAM_MEM_BUFQ_MAX; idx++) {
+		if ((tbl.bufq[idx].buf_handle != 0) && (tbl.bufq[idx].active)) {
+			CAM_DBG(CAM_PRESIL, "Sending %d, FD %d handle 0x%0x", idx, tbl.bufq[idx].fd,
+				tbl.bufq[idx].buf_handle);
+			fd_already_sent_found = 0;
+
+			for (fd_already_index = 0; fd_already_index < fd_already_sent_count;
+				fd_already_index++) {
+
+				if (fd_already_sent[fd_already_index] == tbl.bufq[idx].fd) {
+					fd_already_sent_found = 1;
+					CAM_DBG(CAM_PRESIL,
+						"fd_already_sent %d, FD %d handle 0x%0x flags=0x%0x",
+						idx, tbl.bufq[idx].fd, tbl.bufq[idx].buf_handle,
+						tbl.bufq[idx].flags);
+				}
+			}
+
+			if (fd_already_sent_found)
+				continue;
+
+			CAM_DBG(CAM_PRESIL, "Sending %d, FD %d handle 0x%0x flags=0x%0x", idx,
+				tbl.bufq[idx].fd, tbl.bufq[idx].buf_handle, tbl.bufq[idx].flags);
+
+			rc = cam_mem_mgr_send_buffer_to_presil(iommu_hdl, tbl.bufq[idx].buf_handle);
+			fd_already_sent[fd_already_sent_count++] = tbl.bufq[idx].fd;
+
+		} else {
+			CAM_DBG(CAM_PRESIL, "Invalid Mem idx=%d, FD %d handle 0x%0x active %d",
+				idx, tbl.bufq[idx].fd, tbl.bufq[idx].buf_handle,
+				tbl.bufq[idx].active);
+		}
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_send_all_buffers_to_presil);
+
+int cam_mem_mgr_retrieve_buffer_from_presil(int32_t buf_handle, uint32_t buf_size,
+	uint32_t offset, int32_t iommu_hdl)
+{
+	int rc = 0;
+
+	/* Receive output buffer from Presil IO Buf to PC side (as iova start address indicates) */
+	uint64_t io_buf_addr;
+	size_t io_buf_size;
+	uint64_t dmabuf = 0;
+	int fd = 0;
+	uint8_t *iova_ptr = NULL;
+	int idx = 0;
+
+
+	CAM_DBG(CAM_PRESIL, "buf handle 0x%0x ", buf_handle);
+	rc = cam_mem_get_io_buf(buf_handle, iommu_hdl, &io_buf_addr, &io_buf_size,
+		NULL, NULL);
+	if (rc) {
+		CAM_ERR(CAM_PRESIL, "Unable to get IOVA for buffer buf_hdl: 0x%0x iommu_hdl: 0x%0x",
+			buf_handle, iommu_hdl);
+		return -EINVAL;
+	}
+
+	iova_ptr = (uint8_t *)io_buf_addr;
+	iova_ptr += offset;   // correct target address to start writing buffer to.
+
+	if (!buf_size) {
+		buf_size = io_buf_size;
+		CAM_DBG(CAM_PRESIL, "Updated buf_size from Zero to 0x%0x", buf_size);
+	}
+
+	fd = GET_FD_FROM_HANDLE(buf_handle);
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
+	if ((tbl.bufq[idx].buf_handle != 0) && (tbl.bufq[idx].active) &&
+		(tbl.bufq[idx].buf_handle == buf_handle)) {
+		CAM_DBG(CAM_PRESIL, "Found dmabuf in bufq idx %d, FD %d handle 0x%0x dmabuf %pK",
+			idx, tbl.bufq[idx].fd, tbl.bufq[idx].buf_handle, tbl.bufq[idx].dma_buf);
+		dmabuf = (uint64_t)tbl.bufq[idx].dma_buf;
+	} else {
+		CAM_ERR(CAM_PRESIL,
+			"Could not find dmabuf Invalid Mem idx=%d, FD %d handle 0x%0x active %d ",
+			idx, tbl.bufq[idx].fd, tbl.bufq[idx].buf_handle, tbl.bufq[idx].active);
+	}
+
+	CAM_DBG(CAM_PRESIL,
+		"Retrieving buffer with ioaddr : 0x%x, offset = %d, size = %d, fd = %d, dmabuf = %pK",
+		io_buf_addr, offset, buf_size, fd, dmabuf);
+
+	rc = cam_presil_retrieve_buffer(dmabuf, 0, 0, (uint32_t)buf_size, (uint64_t)io_buf_addr);
+
+	CAM_INFO(CAM_PRESIL,
+		"Retrieved buffer with ioaddr : 0x%x, offset = %d, size = %d, fd = %d, dmabuf = %pK",
+		io_buf_addr, 0, buf_size, fd, dmabuf);
+
+	return rc;
+}
+
+#else /* ifdef CONFIG_CAM_PRESIL */
+struct dma_buf * cam_mem_mgr_get_dma_buf(int fd)
+{
+	return NULL;
+}
+
+int cam_mem_mgr_send_all_buffers_to_presil(int32_t iommu_hdl)
+{
+       return 0;
+}
+
+int cam_mem_mgr_send_buffer_to_presil(int32_t iommu_hdl, int32_t buf_handle)
+{
+	return 0;
+}
+
+int cam_mem_mgr_retrieve_buffer_from_presil(int32_t buf_handle,
+	uint32_t buf_size,
+	uint32_t offset,
+	int32_t iommu_hdl)
+{
+	return 0;
+}
+#endif /* ifdef CONFIG_CAM_PRESIL */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_mem_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_mem_mgr.h
@@ -0,0 +1,305 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_MEM_MGR_H_
+#define _CAM_MEM_MGR_H_
+
+#include <linux/mutex.h>
+#include <linux/dma-buf.h>
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+#include <linux/dma-heap.h>
+#endif
+#include <media/cam_req_mgr.h>
+#include "cam_mem_mgr_api.h"
+
+/* Enum for possible mem mgr states */
+enum cam_mem_mgr_state {
+	CAM_MEM_MGR_UNINITIALIZED,
+	CAM_MEM_MGR_INITIALIZED,
+};
+
+/*Enum for memory allocation initiator */
+enum cam_mem_mgr_allocator {
+	CAM_MEMMGR_ALLOC_USER,
+	CAM_MEMMGR_ALLOC_KERNEL,
+};
+
+/*Enum for possible SMMU operations */
+enum cam_smmu_mapping_client {
+	CAM_SMMU_MAPPING_USER,
+	CAM_SMMU_MAPPING_KERNEL,
+};
+
+#ifdef CONFIG_CAM_PRESIL
+struct cam_presil_dmabuf_params {
+	int32_t fd_for_umd_daemon;
+	uint32_t refcount;
+};
+#endif
+
+/**
+ * struct cam_mem_buf_hw_vaddr_info
+ *
+ * @iommu_hdl:     IOMMU handle for the given bank
+ * @vaddr:         IOVA of the buffer
+ * @len:           cached length for a given handle
+ * @ref_count:     ref count for buffer
+ * @addr_updated:  Indicates if entry is updated only for addr caching
+ * @valid_mapping: Indicates if entry is indeed a valid mapping for this buf
+ *
+ */
+struct cam_mem_buf_hw_hdl_info {
+	int32_t iommu_hdl;
+	dma_addr_t vaddr;
+	size_t len;
+	struct kref *ref_count;
+
+	bool addr_updated;
+	bool valid_mapping;
+};
+
+/**
+ * struct cam_mem_buf_queue
+ *
+ * @dma_buf:           pointer to the allocated dma_buf in the table
+ * @q_lock:            mutex lock for buffer
+ * @fd:                file descriptor of buffer
+ * @i_ino:             inode number of this dmabuf. Uniquely identifies a buffer
+ * @buf_handle:        unique handle for buffer
+ * @align:             alignment for allocation
+ * @len:               size of buffer
+ * @flags:             attributes of buffer
+ * @num_hdls:          number of valid handles
+ * @vaddr_info:        Array of IOVA addresses mapped for different devices
+ *                     using the same indexing as SMMU
+ * @kmdvaddr:          Kernel virtual address
+ * @active:            state of the buffer
+ * @release_deferred:  Buffer is deferred for release.
+ * @is_imported:       Flag indicating if buffer is imported from an FD in user space
+ * @is_internal:       Flag indicating kernel allocated buffer
+ * @timestamp:         Timestamp at which this entry in tbl was made
+ * @krefcount:         Reference counter to track whether the buffer is
+ *                     mapped and in use by kmd
+ * @smmu_mapping_client: Client buffer (User or kernel)
+ * @buf_name:            Name associated with buffer.
+ * @presil_params:       Parameters specific to presil environment
+ * @urefcount:           Reference counter to track whether the buffer is
+ *                       mapped and in use by umd
+ * @idx_lock:           spinlock for buffer
+ */
+struct cam_mem_buf_queue {
+	struct dma_buf *dma_buf;
+	struct mutex q_lock;
+	int32_t fd;
+	unsigned long i_ino;
+	int32_t buf_handle;
+	int32_t align;
+	size_t len;
+	uint32_t flags;
+	uintptr_t kmdvaddr;
+	int32_t num_hdls;
+	struct cam_mem_buf_hw_hdl_info *hdls_info;
+	bool active;
+	bool release_deferred;
+	bool is_imported;
+	bool is_internal;
+	struct timespec64 timestamp;
+	struct kref krefcount;
+	enum cam_smmu_mapping_client smmu_mapping_client;
+	char buf_name[CAM_DMA_BUF_NAME_LEN];
+
+#ifdef CONFIG_CAM_PRESIL
+	struct cam_presil_dmabuf_params presil_params;
+#endif
+	struct kref urefcount;
+	spinlock_t idx_lock;
+};
+
+/**
+ * struct cam_mem_table
+ *
+ * @m_lock: mutex lock for table
+ * @bitmap: bitmap of the mem mgr utility
+ * @bits: max bits of the utility
+ * @bufq: array of buffers
+ * @dbg_buf_idx: debug buffer index to get usecases info
+ * @max_hdls_supported: Maximum number of SMMU device handles supported
+ *                      A buffer can only be mapped for these number of
+ *                      device context banks
+ * @max_hdls_info_size: Size of the hdls array allocated per buffer,
+ *                      computed value to be used in driver
+ * @force_cache_allocs: Force all internal buffer allocations with cache
+ * @need_shared_buffer_padding: Whether padding is needed for shared buffer
+ *                              allocations.
+ * @csf_version: Camera security framework version
+ * @system_heap: Handle to system heap
+ * @system_movable_heap: Handle to system movable heap
+ * @system_uncached_heap: Handle to system uncached heap
+ * @camera_heap: Handle to camera heap
+ * @camera_uncached_heap: Handle to camera uncached heap
+ * @secure_display_heap: Handle to secure display heap
+ * @ubwc_p_heap: Handle to ubwc-p heap
+ * @ubwc_p_movable_heap: Handle to ubwc-p movable heap
+ */
+struct cam_mem_table {
+	struct mutex m_lock;
+	void *bitmap;
+	size_t bits;
+	struct cam_mem_buf_queue bufq[CAM_MEM_BUFQ_MAX];
+	size_t dbg_buf_idx;
+	int32_t max_hdls_supported;
+	size_t max_hdls_info_size;
+	bool force_cache_allocs;
+	bool need_shared_buffer_padding;
+	struct cam_csf_version csf_version;
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+	struct dma_heap *system_heap;
+	struct dma_heap *system_movable_heap;
+	struct dma_heap *system_uncached_heap;
+	struct dma_heap *camera_heap;
+	struct dma_heap *camera_uncached_heap;
+	struct dma_heap *secure_display_heap;
+	struct dma_heap *ubwc_p_heap;
+	struct dma_heap *ubwc_p_movable_heap;
+#endif
+
+};
+
+/**
+ * struct cam_mem_table_mini_dump
+ *
+ * @bufq: array of buffers
+ * @dbg_buf_idx: debug buffer index to get usecases info
+ * @alloc_profile_enable: Whether to enable alloc profiling
+ * @dbg_buf_idx: debug buffer index to get usecases info
+ * @force_cache_allocs: Force all internal buffer allocations with cache
+ * @need_shared_buffer_padding: Whether padding is needed for shared buffer
+ *                              allocations.
+ */
+struct cam_mem_table_mini_dump {
+	struct cam_mem_buf_queue bufq[CAM_MEM_BUFQ_MAX];
+	size_t dbg_buf_idx;
+	bool   alloc_profile_enable;
+	bool   force_cache_allocs;
+	bool   need_shared_buffer_padding;
+};
+
+/**
+ * @brief: Allocates and maps buffer
+ *
+ * @cmd:   Allocation information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd_v2 *cmd);
+
+/**
+ * @brief: Releases a buffer reference
+ *
+ * @cmd:   Buffer release information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd);
+
+/**
+ * @brief Maps a buffer
+ *
+ * @cmd: Buffer mapping information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd_v2 *cmd);
+
+/**
+ * @brief: Perform cache ops on the buffer
+ *
+ * @cmd:   Cache ops information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_cache_ops(struct cam_mem_cache_ops_cmd *cmd);
+
+/**
+ * @brief: Perform cpu access ops on the buffer
+ *
+ * @cmd:   CPU access ops information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_cpu_access_op(struct cam_mem_cpu_access_op *cmd);
+
+/**
+ * @brief: Provide all supported heap capabilities
+ *
+ * @heap_mask: Update mask for all supported heaps
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_check_for_supported_heaps(uint64_t *heap_mask);
+
+/**
+ * @brief: Initializes the memory manager
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_init(void);
+
+/**
+ * @brief:  Tears down the memory manager
+ *
+ * @return None
+ */
+void cam_mem_mgr_deinit(void);
+
+#ifdef CONFIG_CAM_PRESIL
+/**
+ * @brief: Put dma-buf for input dmabuf
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_put_dmabuf_from_fd(uint64_t input_dmabuf);
+
+/**
+ * @brief: Create a fd for dma-buf
+ *
+ * @return Status of operation. Negative in case of error. Zero or
+ *       Positive otherwise.
+ */
+int cam_mem_mgr_get_fd_from_dmabuf(uint64_t input_dmabuf);
+#endif /* ifdef CONFIG_CAM_PRESIL */
+
+/**
+ * @brief: Copy buffer content to presil mem for all buffers of
+ *       iommu handle
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_send_all_buffers_to_presil(int32_t iommu_hdl);
+
+/**
+ * @brief: Copy buffer content of single buffer to presil
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_send_buffer_to_presil(int32_t iommu_hdl, int32_t buf_handle);
+
+/**
+ * @brief: Copy back buffer content of single buffer from
+ *       presil
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_retrieve_buffer_from_presil(int32_t buf_handle,
+	uint32_t buf_size, uint32_t offset, int32_t iommu_hdl);
+
+/**
+ * @brief: Dump mem mgr info into user buffer
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_dump_user(struct cam_dump_req_cmd *dump_req);
+#endif /* _CAM_MEM_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_core.c
@@ -0,0 +1,5995 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include "cam_req_mgr_interface.h"
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_core.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_req_mgr_debug.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_req_mgr_debug.h"
+#include "cam_common_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_cpas_api.h"
+
+static struct cam_req_mgr_core_device *g_crm_core_dev;
+static struct cam_req_mgr_core_link g_links[MAXIMUM_LINKS_CAPACITY];
+
+static void __cam_req_mgr_reset_apply_data(struct cam_req_mgr_core_link *link)
+{
+	int pd;
+
+	for (pd = 0; pd < CAM_PIPELINE_DELAY_MAX; pd++) {
+		link->req.apply_data[pd].req_id = -1;
+		link->req.prev_apply_data[pd].req_id = -1;
+	}
+}
+
+static void __cam_req_mgr_reset_state_monitor_array(
+	struct cam_req_mgr_core_link *link)
+{
+	int i = 0;
+	struct cam_req_mgr_state_monitor *state_monitor;
+
+	for (i = 0; i < MAX_REQ_STATE_MONITOR_NUM; i++) {
+		state_monitor = &link->req.state_monitor[i];
+		state_monitor->req_state = CAM_CRM_STATE_INVALID;
+		state_monitor->req_id = -1;
+		state_monitor->frame_id = -1;
+		memset(&state_monitor->time_stamp, 0, sizeof(struct timespec64));
+		memset(&state_monitor->name, 0, sizeof(state_monitor->name));
+	}
+}
+
+void cam_req_mgr_core_link_reset(struct cam_req_mgr_core_link *link)
+{
+	int i = 0;
+
+	spin_lock_bh(&link->req.reset_link_spin_lock);
+	link->link_hdl = 0;
+	link->num_devs = 0;
+	link->max_delay = CAM_PIPELINE_DELAY_0;
+	link->min_delay = CAM_PIPELINE_DELAY_2;
+	link->workq = NULL;
+	link->pd_mask = 0;
+	link->l_dev = NULL;
+	link->req.in_q = NULL;
+	link->req.l_tbl = NULL;
+	link->req.num_tbl = 0;
+	link->watchdog = NULL;
+	spin_lock_bh(&link->link_state_spin_lock);
+	link->state = CAM_CRM_LINK_STATE_AVAILABLE;
+	spin_unlock_bh(&link->link_state_spin_lock);
+	link->parent = NULL;
+	link->sync_link_sof_skip = false;
+	link->open_req_cnt = 0;
+	link->last_flush_id = -1;
+	link->initial_sync_req = -1;
+	link->dual_trigger = false;
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_EOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_EOF] = 0;
+	link->in_msync_mode = false;
+	link->retry_cnt = 0;
+	link->is_shutdown = false;
+	link->initial_skip = true;
+	link->sof_timestamp = 0;
+	link->prev_sof_timestamp = 0;
+	link->skip_init_frame = false;
+	link->num_sync_links = 0;
+	link->last_sof_trigger_jiffies = 0;
+	link->wq_congestion = false;
+	link->try_for_internal_recovery = false;
+	link->is_sending_req = false;
+	atomic_set(&link->eof_event_cnt, 0);
+	link->cont_empty_slots = 0;
+	link->is_shdr = false;
+	link->wait_for_dual_trigger = false;
+	__cam_req_mgr_reset_apply_data(link);
+	__cam_req_mgr_reset_state_monitor_array(link);
+
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION - 1; i++)
+		link->sync_link[i] = NULL;
+	spin_unlock_bh(&link->req.reset_link_spin_lock);
+
+	mutex_lock(&link->lock);
+	link->properties_mask = CAM_LINK_PROPERTY_NONE;
+	mutex_unlock(&link->lock);
+}
+
+void cam_req_mgr_handle_core_shutdown(void)
+{
+	struct cam_req_mgr_core_session *session;
+	struct cam_req_mgr_core_session *tsession;
+	struct cam_req_mgr_session_info ses_info;
+
+	if (!list_empty(&g_crm_core_dev->session_head)) {
+		list_for_each_entry_safe(session, tsession,
+			&g_crm_core_dev->session_head, entry) {
+			ses_info.session_hdl =
+				session->session_hdl;
+			cam_req_mgr_destroy_session(&ses_info, true);
+		}
+	}
+}
+
+static int __cam_req_mgr_setup_payload(struct cam_req_mgr_core_workq *workq)
+{
+	int32_t                  i = 0;
+	int                      rc = 0;
+	struct crm_task_payload *task_data = NULL;
+
+	task_data = kcalloc(
+		workq->task.num_task, sizeof(*task_data),
+		GFP_KERNEL);
+	if (!task_data) {
+		rc = -ENOMEM;
+	} else {
+		for (i = 0; i < workq->task.num_task; i++)
+			workq->task.pool[i].payload = &task_data[i];
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_find_pd_tbl()
+ *
+ * @brief    : Find pipeline delay based table pointer which matches delay
+ * @tbl      : Pointer to list of request table
+ * @delay    : Pipeline delay value to be searched for comparison
+ *
+ * @return   : pointer to request table for matching pipeline delay table.
+ *
+ */
+static struct cam_req_mgr_req_tbl *__cam_req_mgr_find_pd_tbl(
+	struct cam_req_mgr_req_tbl *tbl, int32_t delay)
+{
+	if (!tbl)
+		return NULL;
+
+	do {
+		if (delay != tbl->pd)
+			tbl = tbl->next;
+		else
+			return tbl;
+	} while (tbl != NULL);
+
+	return NULL;
+}
+
+/**
+ * __cam_req_mgr_inc_idx()
+ *
+ * @brief    : Increment val passed by step size and rollover after max_val
+ * @val      : value to be incremented
+ * @step     : amount/step by which val is incremented
+ * @max_val  : max val after which idx will roll over
+ *
+ */
+static void __cam_req_mgr_inc_idx(int32_t *val, int32_t step, int32_t max_val)
+{
+	*val = (*val + step) % max_val;
+}
+
+/**
+ * __cam_req_mgr_dec_idx()
+ *
+ * @brief    : Decrement val passed by step size and rollover after max_val
+ * @val      : value to be decremented
+ * @step     : amount/step by which val is decremented
+ * @max_val  : after zero value will roll over to max val
+ *
+ */
+static void __cam_req_mgr_dec_idx(int32_t *val, int32_t step, int32_t max_val)
+{
+	*val = *val - step;
+	if (*val < 0)
+		*val = max_val + (*val);
+}
+
+/**
+ * __cam_req_mgr_inject_delay()
+ *
+ * @brief         : Check if any pd device is injecting delay
+ * @tbl           : cam_req_mgr_req_tbl
+ * @curr_idx      : slot idx
+ * @trigger       : Trigger point
+ *
+ * @return   : 0 for success, negative for failure
+ */
+static int __cam_req_mgr_inject_delay(
+	struct cam_req_mgr_req_tbl *tbl,
+	int32_t curr_idx, uint32_t trigger)
+{
+	struct cam_req_mgr_tbl_slot *slot = NULL;
+	int rc = 0;
+
+	while (tbl) {
+		slot = &tbl->slot[curr_idx];
+		if ((trigger == CAM_TRIGGER_POINT_SOF) &&
+			(slot->inject_delay_at_sof > 0)) {
+			slot->inject_delay_at_sof--;
+			CAM_DBG(CAM_CRM,
+				"Delay injected by pd %d device at SOF, inject_delay_at_sof:%d",
+				tbl->pd, slot->inject_delay_at_sof);
+			rc = -EAGAIN;
+		} else if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+			(slot->inject_delay_at_eof > 0)) {
+			slot->inject_delay_at_eof--;
+			CAM_DBG(CAM_CRM,
+				"Delay injected by pd %d device at EOF, inject_delay_at_eof:%d",
+				tbl->pd, slot->inject_delay_at_eof);
+			rc = -EAGAIN;
+		}
+		__cam_req_mgr_dec_idx(&curr_idx, tbl->pd_delta,
+			tbl->num_slots);
+		tbl = tbl->next;
+	}
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_dev_handle_to_name()
+ *
+ * @brief    : Finds device name based on the device handle
+ * @dev_hdl  : Device handle whose name is to be found
+ * @link     : Link on which the device is connected
+ * @return   : String containing the device name
+ *
+ */
+static char *__cam_req_mgr_dev_handle_to_name(
+	int32_t dev_hdl, struct cam_req_mgr_core_link *link)
+{
+	struct cam_req_mgr_connected_device *dev = NULL;
+	int i = 0;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+
+		if (dev_hdl == dev->dev_hdl)
+			return dev->dev_info.name;
+	}
+
+	return "Invalid dev_hdl";
+}
+
+/**
+ * __cam_req_mgr_name_to_dev_handle()
+ *
+ * @brief      : Finds device handle based on the device name
+ * @dev_name   : Device name whose dev handle is to be found
+ * @link       : Link on which the device is connected
+ * @return     : device handle
+ *
+ */
+static int32_t __cam_req_mgr_name_to_dev_handle(
+	char *dev_name, struct cam_req_mgr_core_link *link)
+{
+	struct cam_req_mgr_connected_device *dev = NULL;
+	int i = 0;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		CAM_DBG(CAM_CRM, "dev name %s, iterate dev name %s",
+			dev_name, dev->dev_info.name);
+
+		if (strcmp(dev_name, dev->dev_info.name) == 0)
+			return dev->dev_hdl;
+	}
+	return -EINVAL;
+}
+
+/**
+ * __cam_req_mgr_find_dev_name()
+ *
+ * @brief      : Find the dev name whose req is not ready
+ * @link       : link info
+ * @req_id     : req_id which is not ready
+ * @pd         : pipeline delay
+ * @masked_val : masked value holds the bit for all devices
+ *               that don't have the req_id ready for a given
+ *               pipeline delay
+ * @pd         : pipeline delay
+ *
+ */
+static void __cam_req_mgr_find_dev_name(
+	struct cam_req_mgr_core_link *link,
+	int64_t req_id, uint32_t pd, uint32_t masked_val)
+{
+	int i = 0;
+	struct cam_req_mgr_connected_device *dev = NULL;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (dev->dev_info.p_delay == pd) {
+			if (masked_val & BIT(dev->dev_bit))
+				continue;
+			if (link->wq_congestion)
+				CAM_INFO_RATE_LIMIT(CAM_CRM,
+					"WQ congestion, Skip Frame: req: %lld not ready on link: 0x%x for pd: %d dev: %s open_req count: %u",
+					req_id, link->link_hdl, pd,
+					dev->dev_info.name, link->open_req_cnt);
+			else
+				CAM_INFO(CAM_CRM,
+					"Skip Frame: req: %lld not ready on link: 0x%x for pd: %d dev: %s open_req count: %u",
+					req_id, link->link_hdl, pd,
+					dev->dev_info.name, link->open_req_cnt);
+		}
+	}
+}
+
+static const char *__cam_req_mgr_operation_type_to_str(
+	enum cam_req_mgr_req_state type)
+{
+	switch (type) {
+	case CAM_CRM_REQ_READY:
+		return "REQ_READY";
+	case CAM_CRM_NOTIFY_TRIGGER:
+		return "NOTIFY_TRIGGER";
+	case CAM_CRM_PROCESS_TRIGGER:
+		return "PROCESS_TRIGGER";
+	case CAM_CRM_SEND_REQ:
+		return "SEND_REQ";
+	case CAM_CRM_NOTIFY_ERR:
+		return "NOTIFY_ERR";
+	case CAM_CRM_PROCESS_ERR:
+		return "PROCESS_ERR";
+	default:
+		return "INVALID_TYPE";
+	}
+}
+
+static void __cam_req_mgr_update_state_monitor_array(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_state_monitor *state)
+{
+	int idx = link->req.next_state_idx;
+	char *dev_name = NULL;
+	struct cam_req_mgr_state_monitor *state_monitor =
+		&link->req.state_monitor[idx];
+
+	dev_name = __cam_req_mgr_dev_handle_to_name(state->dev_hdl, link);
+
+	spin_lock_bh(&link->req.monitor_slock);
+	CAM_DBG(CAM_REQ,
+		"Update: link_hdl %x dev %x dev_name %s req_id %lld frame_id %lld set to State: %s",
+		link->link_hdl, state->dev_hdl,
+		dev_name,
+		state->req_id, state->frame_id,
+		__cam_req_mgr_operation_type_to_str(state->req_state));
+
+	state_monitor->req_state = state->req_state;
+	state_monitor->req_id = state->req_id;
+	state_monitor->dev_hdl = state->dev_hdl;
+	state_monitor->frame_id = state->frame_id;
+	scnprintf(state_monitor->name, sizeof(state_monitor->name), "%s", dev_name);
+	ktime_get_clocktai_ts64(&state_monitor->time_stamp);
+
+	__cam_req_mgr_inc_idx(&link->req.next_state_idx, 1, MAX_REQ_STATE_MONITOR_NUM);
+
+	spin_unlock_bh(&link->req.monitor_slock);
+}
+
+/**
+ * __cam_req_mgr_dump_state_monitor_array()
+ *
+ * @brief    : dump the state monitor array, dump from index next_wr_idx
+ *             to print state information in time order.
+ * @link     : link pointer
+ *
+ */
+static void __cam_req_mgr_dump_state_monitor_array(
+	struct cam_req_mgr_core_link *link)
+{
+	int i;
+	int idx = link->req.next_state_idx;
+	struct tm ts;
+	struct timespec64 timespec;
+
+	/*
+	 * Get current time and print it immediately, wen need this log to cacluate the
+	 * difference between log time and the time we get using ktime_get_clocktai_ts64,
+	 * we need do like this because the time we get always has a 20-30ms difference from
+	 * log time and do not have a good solution at present.
+	 */
+	ktime_get_clocktai_ts64(&timespec);
+	time64_to_tm(timespec.tv_sec, 0, &ts);
+	CAM_INFO(CAM_CRM, "Link %x start dump state monitor array, time: %d-%d %d:%d:%d.%lld",
+		link->link_hdl, ts.tm_mon + 1, ts.tm_mday, ts.tm_hour,
+		ts.tm_min, ts.tm_sec, timespec.tv_nsec / 1000000);
+
+	CAM_INFO(CAM_CRM, "%16s  %6s  %10s  %8s  %10s",
+		"state", "req id", "dev hdl", "frame id", "time stamp");
+	spin_lock_bh(&link->req.monitor_slock);
+	for (i = 0; i < MAX_REQ_STATE_MONITOR_NUM; i++) {
+		if (link->req.state_monitor[idx].req_state != CAM_CRM_STATE_INVALID) {
+			time64_to_tm(link->req.state_monitor[idx].time_stamp.tv_sec, 0, &ts);
+			CAM_INFO(CAM_CRM, "%16s  %6d  %10x  %8d  %d-%d %d:%d:%d.%lld",
+				__cam_req_mgr_operation_type_to_str(
+				link->req.state_monitor[idx].req_state),
+				link->req.state_monitor[idx].req_id,
+				link->req.state_monitor[idx].dev_hdl,
+				link->req.state_monitor[idx].frame_id,
+				ts.tm_mon + 1, ts.tm_mday, ts.tm_hour,
+				ts.tm_min, ts.tm_sec,
+				link->req.state_monitor[idx].time_stamp.tv_nsec / 1000000);
+		}
+
+		__cam_req_mgr_inc_idx(&idx, 1, MAX_REQ_STATE_MONITOR_NUM);
+	}
+	spin_unlock_bh(&link->req.monitor_slock);
+}
+
+/**
+ * __cam_req_mgr_notify_frame_skip()
+ *
+ * @brief : Notify all devices of frame skipping
+ *
+ */
+static int __cam_req_mgr_notify_frame_skip(
+	struct cam_req_mgr_core_link *link,
+	uint32_t trigger)
+{
+	int                                  rc = 0, i, j, pd, idx;
+	bool                                 found = false;
+	struct cam_req_mgr_apply_request     frame_skip;
+	struct cam_req_mgr_apply            *apply_data = NULL;
+	struct cam_req_mgr_connected_device *dev = NULL;
+	struct cam_req_mgr_tbl_slot         *slot = NULL;
+
+	apply_data = link->req.prev_apply_data;
+
+	if (link->max_delay < 0 || link->max_delay >= CAM_PIPELINE_DELAY_MAX) {
+		CAM_ERR(CAM_CRM, "link->max_delay is out of bounds: %d",
+			link->max_delay);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		pd = dev->dev_info.p_delay;
+		if (pd >= CAM_PIPELINE_DELAY_MAX) {
+			CAM_WARN(CAM_CRM, "pd %d greater than max",
+				pd);
+			continue;
+		}
+
+		found = false;
+		idx = apply_data[pd].idx;
+		slot = &dev->pd_tbl->slot[idx];
+
+		for (j = 0; j < slot->ops.num_dev; j++) {
+			if (dev->dev_hdl == slot->ops.dev_hdl[j]) {
+				found = true;
+				break;
+			}
+		}
+
+		/*
+		 * If apply_at_eof is enabled do not apply at SOF
+		 * e.x. Flash device
+		 */
+		if ((trigger == CAM_TRIGGER_POINT_SOF) && found &&
+			(slot->ops.apply_at_eof))
+			continue;
+
+		/*
+		 * If apply_at_eof is not enabled ignore EOF
+		 */
+		if ((trigger == CAM_TRIGGER_POINT_EOF) && found &&
+			(!slot->ops.apply_at_eof))
+			continue;
+
+		frame_skip.dev_hdl = dev->dev_hdl;
+		frame_skip.link_hdl = link->link_hdl;
+		frame_skip.request_id =
+			apply_data[pd].req_id;
+		frame_skip.trigger_point = trigger;
+		frame_skip.report_if_bubble = 0;
+		frame_skip.last_applied_max_pd_req =
+			 link->req.prev_apply_data[link->max_delay].req_id;
+
+		CAM_DBG(CAM_REQ,
+			"Notify_frame_skip: link: 0x%x pd %d req_id %lld last_applied %lld",
+			link->link_hdl, pd, apply_data[pd].req_id,
+			link->req.prev_apply_data[link->max_delay].req_id);
+		if ((dev->ops) && (dev->ops->notify_frame_skip))
+			dev->ops->notify_frame_skip(&frame_skip);
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_send_evt()
+ *
+ * @brief      : Send event to all connected devices
+ * @req_id     : Req ID
+ * @type       : Event type
+ * @error      : Error type
+ * @link       : Link info
+ *
+ */
+static int __cam_req_mgr_send_evt(
+	uint64_t                       req_id,
+	enum cam_req_mgr_link_evt_type type,
+	enum cam_req_mgr_device_error  error,
+	struct cam_req_mgr_core_link  *link)
+{
+	int i;
+	struct cam_req_mgr_link_evt_data     evt_data = {0};
+	struct cam_req_mgr_connected_device *device = NULL;
+
+	CAM_DBG(CAM_CRM,
+		"Notify event type: %d to all connected devices on link: 0x%x",
+		type, link->link_hdl);
+
+	/* Try for internal recovery */
+	if (link->try_for_internal_recovery)
+		evt_data.try_for_recovery = true;
+
+	for (i = 0; i < link->num_devs; i++) {
+		device = &link->l_dev[i];
+		if (device != NULL) {
+			evt_data.dev_hdl = device->dev_hdl;
+			evt_data.evt_type = type;
+			evt_data.link_hdl = link->link_hdl;
+			evt_data.req_id = req_id;
+			evt_data.u.error = error;
+			if (device->ops && device->ops->process_evt)
+				device->ops->process_evt(&evt_data);
+		}
+	}
+
+	/* Updated if internal recovery succeeded */
+	link->try_for_internal_recovery = evt_data.try_for_recovery;
+
+	return 0;
+}
+
+/**
+ * __cam_req_mgr_notify_error_on_link()
+ *
+ * @brief : Notify userspace on exceeding max retry
+ *          attempts to apply same req
+ * @link  : link on which the req could not be applied
+ *
+ */
+static int __cam_req_mgr_notify_error_on_link(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_connected_device *dev)
+{
+	struct cam_req_mgr_core_session *session = NULL;
+	struct cam_req_mgr_message       msg = {0};
+	int rc = 0, pd;
+
+	session = (struct cam_req_mgr_core_session *)link->parent;
+	if (!session) {
+		CAM_WARN(CAM_CRM, "session ptr NULL %x", link->link_hdl);
+		return -EINVAL;
+	}
+
+	pd = dev->dev_info.p_delay;
+	if (pd >= CAM_PIPELINE_DELAY_MAX) {
+		CAM_ERR(CAM_CRM, "pd : %d is more than expected", pd);
+		return -EINVAL;
+	}
+
+	if (link->min_delay >= CAM_PIPELINE_DELAY_MAX) {
+		CAM_ERR(CAM_CRM, "min pd : %d is more than expected",
+			link->min_delay);
+		return -EINVAL;
+	}
+
+	/* Notify all devices in the link about the error */
+	__cam_req_mgr_send_evt(link->req.apply_data[link->min_delay].req_id,
+		CAM_REQ_MGR_LINK_EVT_STALLED, CRM_KMD_ERR_FATAL, link);
+
+	/*
+	 * Internal recovery succeeded - skip userland notification
+	 * If recovery had failed subdevice will reset this flag
+	 */
+	if (link->try_for_internal_recovery) {
+		CAM_INFO(CAM_CRM, "Internal recovery succeeded on link: 0x%x",
+			link->link_hdl);
+		return 0;
+	}
+
+	CAM_ERR_RATE_LIMIT(CAM_CRM,
+		"Notifying userspace to trigger recovery on link 0x%x for session %d",
+		link->link_hdl, session->session_hdl);
+
+	__cam_req_mgr_dump_state_monitor_array(link);
+
+	memset(&msg, 0, sizeof(msg));
+
+	msg.session_hdl = session->session_hdl;
+	msg.u.err_msg.error_type = CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	msg.u.err_msg.request_id =
+		link->req.apply_data[pd].req_id;
+	msg.u.err_msg.link_hdl   = link->link_hdl;
+	msg.u.err_msg.resource_size = 0;
+	msg.u.err_msg.error_code = CAM_REQ_MGR_LINK_STALLED_ERROR;
+
+	CAM_DBG(CAM_CRM, "Failed for device: %s while applying request: %lld",
+		dev->dev_info.name, link->req.apply_data[pd].req_id);
+
+	rc = cam_req_mgr_notify_message(&msg,
+		V4L_EVENT_CAM_REQ_MGR_ERROR,
+		V4L_EVENT_CAM_REQ_MGR_EVENT);
+
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_CRM,
+			"Error in notifying recovery for session %d link 0x%x rc %d",
+			session->session_hdl, link->link_hdl, rc);
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_traverse()
+ *
+ * @brief    : Traverse through pd tables, it will internally cover all linked
+ *             pd tables. Each pd table visited will check if idx passed to its
+ *             in ready state. If ready means all devices linked to the pd table
+ *             have this request id packet ready. Then it calls subsequent pd
+ *             tbl with new idx. New idx value takes into account the delta
+ *             between current pd table and next one.
+ * @traverse_data: contains all the info to traverse through pd tables
+ *
+ * @return: 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_traverse(struct cam_req_mgr_traverse *traverse_data)
+{
+	int                          rc = 0;
+	int32_t                      next_idx = traverse_data->idx;
+	int32_t                      curr_idx = traverse_data->idx;
+	struct cam_req_mgr_req_tbl  *tbl;
+	struct cam_req_mgr_apply    *apply_data;
+	struct cam_req_mgr_tbl_slot *slot = NULL;
+
+	if (!traverse_data->tbl || !traverse_data->apply_data) {
+		CAM_ERR(CAM_CRM, "NULL pointer %pK %pK",
+			traverse_data->tbl, traverse_data->apply_data);
+		traverse_data->result = 0;
+		return -EINVAL;
+	}
+
+	tbl = traverse_data->tbl;
+	apply_data = traverse_data->apply_data;
+	slot = &tbl->slot[curr_idx];
+	CAM_DBG(CAM_CRM,
+		"Enter pd %d idx %d state %d skip %d status %d skip_idx %d",
+		tbl->pd, curr_idx, tbl->slot[curr_idx].state,
+		tbl->skip_traverse, traverse_data->in_q->slot[curr_idx].status,
+		traverse_data->in_q->slot[curr_idx].skip_idx);
+
+	/* Check if req is ready or in skip mode or pd tbl is in skip mode */
+	if (tbl->slot[curr_idx].state == CRM_REQ_STATE_READY ||
+		traverse_data->in_q->slot[curr_idx].skip_idx == 1 ||
+		tbl->skip_traverse > 0) {
+		if (tbl->next) {
+			__cam_req_mgr_dec_idx(&next_idx, tbl->pd_delta,
+				tbl->num_slots);
+			traverse_data->idx = next_idx;
+			traverse_data->tbl = tbl->next;
+			rc = __cam_req_mgr_traverse(traverse_data);
+		}
+		if (rc >= 0) {
+			SET_SUCCESS_BIT(traverse_data->result, tbl->pd);
+
+			if (traverse_data->validate_only == false) {
+				apply_data[tbl->pd].pd = tbl->pd;
+				apply_data[tbl->pd].req_id =
+					CRM_GET_REQ_ID(
+					traverse_data->in_q, curr_idx);
+				apply_data[tbl->pd].idx = curr_idx;
+
+				CAM_DBG(CAM_CRM, "req_id: %lld with pd of %d",
+				apply_data[tbl->pd].req_id,
+				apply_data[tbl->pd].pd);
+				/*
+				 * If traverse is successful decrement
+				 * traverse skip
+				 */
+				if (tbl->skip_traverse > 0) {
+					apply_data[tbl->pd].req_id = -1;
+					tbl->skip_traverse--;
+				}
+			}
+		} else {
+			/* linked pd table is not ready for this traverse yet */
+			return rc;
+		}
+	} else {
+		/* This pd table is not ready to proceed with asked idx */
+		traverse_data->result_data.req_id =
+			CRM_GET_REQ_ID(traverse_data->in_q, curr_idx);
+		traverse_data->result_data.pd = tbl->pd;
+		traverse_data->result_data.masked_value =
+			(tbl->dev_mask & slot->req_ready_map);
+		SET_FAILURE_BIT(traverse_data->result, tbl->pd);
+		return -EAGAIN;
+	}
+
+	return 0;
+}
+
+/**
+ * __cam_req_mgr_in_q_skip_idx()
+ *
+ * @brief    : Decrement val passed by step size and rollover after max_val
+ * @in_q     : input queue pointer
+ * @idx      : Sets skip_idx bit of the particular slot to true so when traverse
+ *             happens for this idx, no req will be submitted for devices
+ *             handling this idx.
+ *
+ */
+static void __cam_req_mgr_in_q_skip_idx(struct cam_req_mgr_req_queue *in_q,
+	int32_t idx)
+{
+	in_q->slot[idx].req_id = -1;
+	in_q->slot[idx].skip_idx = 1;
+	CAM_DBG(CAM_CRM, "SET IDX SKIP on slot= %d", idx);
+}
+
+/**
+ * __cam_req_mgr_tbl_set_id()
+ *
+ * @brief    : Set unique id to table
+ * @tbl      : pipeline based table which requires new id
+ * @req      : pointer to request data wihch contains num_tables counter
+ *
+ */
+static void __cam_req_mgr_tbl_set_id(struct cam_req_mgr_req_tbl *tbl,
+	struct cam_req_mgr_req_data *req)
+{
+	if (!tbl)
+		return;
+	do {
+		tbl->id = req->num_tbl++;
+		CAM_DBG(CAM_CRM, "%d: pd %d skip_traverse %d delta %d",
+			tbl->id, tbl->pd, tbl->skip_traverse,
+			tbl->pd_delta);
+		tbl = tbl->next;
+	} while (tbl != NULL);
+}
+
+/**
+ * __cam_req_mgr_tbl_set_all_skip_cnt()
+ *
+ * @brief    : Each pd table sets skip value based on delta between itself and
+ *             max pd value. During initial streamon or bubble case this is
+ *             used. That way each pd table skips required num of traverse and
+ *             align themselve with req mgr connected devs.
+ * @l_tbl    : iterates through list of pd tables and sets skip traverse
+ *
+ */
+static void __cam_req_mgr_tbl_set_all_skip_cnt(
+	struct cam_req_mgr_req_tbl **l_tbl)
+{
+	struct cam_req_mgr_req_tbl *tbl = *l_tbl;
+	int32_t                     max_pd;
+
+	if (!tbl)
+		return;
+
+	max_pd = tbl->pd;
+	do {
+		tbl->skip_traverse = max_pd - tbl->pd;
+		CAM_DBG(CAM_CRM, "%d: pd %d skip_traverse %d delta %d",
+			tbl->id, tbl->pd, tbl->skip_traverse,
+			tbl->pd_delta);
+		tbl = tbl->next;
+	} while (tbl != NULL);
+}
+
+/**
+ * __cam_req_mgr_find_slot_for_req()
+ *
+ * @brief    : Find idx from input queue at which req id is enqueued
+ * @in_q     : input request queue pointer
+ * @req_id   : request id which needs to be searched in input queue
+ *
+ * @return   : slot index where passed request id is stored, -1 for failure
+ *
+ */
+static int32_t __cam_req_mgr_find_slot_for_req(
+	struct cam_req_mgr_req_queue *in_q, int64_t req_id)
+{
+	int32_t                   idx, i;
+	struct cam_req_mgr_slot  *slot;
+
+	idx = in_q->rd_idx;
+	for (i = 0; i < in_q->num_slots; i++) {
+		slot = &in_q->slot[idx];
+		if (slot->req_id == req_id) {
+			CAM_DBG(CAM_CRM,
+				"req: %lld found at idx: %d status: %d sync_mode: %d",
+				req_id, idx, slot->status, slot->sync_mode);
+			break;
+		}
+		__cam_req_mgr_dec_idx(&idx, 1, in_q->num_slots);
+	}
+	if (i >= in_q->num_slots)
+		idx = -1;
+
+	return idx;
+}
+
+/**
+ * __cam_req_mgr_disconnect_req_on_sync_link()
+ *
+ * @brief    : Disconnect link and sync link
+ * @link     : pointer to link
+ * @slot     : poniter to slot
+ *
+ */
+static void __cam_req_mgr_disconnect_req_on_sync_link(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_slot      *slot)
+{
+	int                           i, j;
+	int                           sync_idx;
+	struct cam_req_mgr_slot      *sync_slot;
+	struct cam_req_mgr_req_queue *sync_in_q;
+	struct cam_req_mgr_core_link *sync_link;
+
+	for (i = 0; i < slot->num_sync_links; i++) {
+		sync_link = cam_get_link_priv(slot->sync_link_hdls[i]);
+		if (!sync_link)
+			continue;
+
+		sync_in_q = sync_link->req.in_q;
+		sync_idx = __cam_req_mgr_find_slot_for_req(sync_in_q, slot->req_id);
+		if (sync_idx < 0)
+			continue;
+
+		CAM_DBG(CAM_CRM,
+			"Req: %llu on link: 0x%x flushed, update sync_link: 0x%x at slot: %d",
+			slot->req_id, link->link_hdl, sync_link->link_hdl, sync_idx);
+
+		sync_slot = &sync_in_q->slot[sync_idx];
+		if (sync_slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+			sync_slot->sync_mode = CAM_REQ_MGR_SYNC_MODE_NO_SYNC;
+			sync_slot->num_sync_links = 0;
+
+			for (j = 0; j < MAXIMUM_LINKS_PER_SESSION - 1; j++) {
+				if (sync_slot->sync_link_hdls[j] == link->link_hdl)
+					sync_slot->sync_link_hdls[j] = 0;
+			}
+		}
+	}
+}
+
+/**
+ * __cam_req_mgr_flush_req_slot()
+ *
+ * @brief    : reset all the slots/pd tables when flush is
+ *             invoked
+ * @link     : link pointer
+ *
+ */
+static void __cam_req_mgr_flush_req_slot(
+	struct cam_req_mgr_core_link *link)
+{
+	int                           i;
+	int                           idx;
+	struct cam_req_mgr_slot      *slot;
+	struct cam_req_mgr_req_tbl   *tbl;
+	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
+
+	for (idx = 0; idx < in_q->num_slots; idx++) {
+		slot = &in_q->slot[idx];
+		tbl = link->req.l_tbl;
+		CAM_DBG(CAM_CRM,
+			"RESET idx: %d req_id: %lld slot->status: %d",
+			idx, slot->req_id, slot->status);
+
+		if ((slot->req_id > 0) && slot->num_sync_links)
+			__cam_req_mgr_disconnect_req_on_sync_link(link, slot);
+
+		/* Reset input queue slot */
+		slot->req_id = -1;
+		slot->bubble_times = 0;
+		slot->internal_recovered = false;
+		slot->skip_idx = 1;
+		slot->recover = 0;
+		slot->additional_timeout = 0;
+		slot->sync_mode = CAM_REQ_MGR_SYNC_MODE_NO_SYNC;
+		slot->status = CRM_SLOT_STATUS_NO_REQ;
+		slot->num_sync_links = 0;
+		for (i = 0; i < MAXIMUM_LINKS_PER_SESSION - 1; i++)
+			slot->sync_link_hdls[i] = 0;
+
+		/* Reset all pd table slot */
+		while (tbl != NULL) {
+			CAM_DBG(CAM_CRM, "pd: %d: idx %d state %d",
+				tbl->pd, idx, tbl->slot[idx].state);
+			tbl->slot[idx].req_ready_map = 0;
+			tbl->slot[idx].req_apply_map = 0;
+			tbl->slot[idx].state = CRM_REQ_STATE_EMPTY;
+			tbl->slot[idx].ops.apply_at_eof = false;
+			for (i = 0; i < MAX_DEV_FOR_SPECIAL_OPS; i++)
+				tbl->slot[idx].ops.dev_hdl[i] = -1;
+			tbl->slot[idx].ops.num_dev = 0;
+			tbl = tbl->next;
+		}
+	}
+
+	atomic_set(&link->eof_event_cnt, 0);
+	in_q->wr_idx = 0;
+	in_q->rd_idx = 0;
+
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_EOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_EOF] = 0;
+	link->cont_empty_slots = 0;
+}
+
+/**
+ * __cam_req_mgr_reset_req_slot()
+ *
+ * @brief    : reset specified idx/slot in input queue as well as all pd tables
+ * @link     : link pointer
+ * @idx      : slot index which will be reset
+ *
+ */
+static void __cam_req_mgr_reset_req_slot(struct cam_req_mgr_core_link *link,
+	int32_t idx)
+{
+	int                           i;
+	struct cam_req_mgr_slot      *slot;
+	struct cam_req_mgr_req_tbl   *tbl = link->req.l_tbl;
+	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
+
+	slot = &in_q->slot[idx];
+	CAM_DBG(CAM_CRM, "RESET: idx: %d: slot->status %d", idx, slot->status);
+
+	/* Check if CSL has already pushed new request*/
+	if (slot->status == CRM_SLOT_STATUS_REQ_ADDED ||
+		in_q->last_applied_idx == idx ||
+		idx < 0)
+		return;
+
+	if ((slot->req_id > 0) && slot->num_sync_links)
+		__cam_req_mgr_disconnect_req_on_sync_link(link, slot);
+
+	/* Reset input queue slot */
+	slot->req_id = -1;
+	slot->bubble_times = 0;
+	slot->internal_recovered = false;
+	slot->skip_idx = 0;
+	slot->recover = 0;
+	slot->additional_timeout = 0;
+	slot->recovery_counter = 0;
+	slot->sync_mode = CAM_REQ_MGR_SYNC_MODE_NO_SYNC;
+	slot->status = CRM_SLOT_STATUS_NO_REQ;
+	slot->num_sync_links = 0;
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION - 1; i++)
+		slot->sync_link_hdls[i] = 0;
+
+	/* Reset all pd table slot */
+	while (tbl != NULL) {
+		CAM_DBG(CAM_CRM, "pd: %d: idx %d state %d",
+			tbl->pd, idx, tbl->slot[idx].state);
+		tbl->slot[idx].req_ready_map = 0;
+		tbl->slot[idx].req_apply_map = 0;
+		tbl->slot[idx].state = CRM_REQ_STATE_EMPTY;
+		tbl->slot[idx].inject_delay_at_sof = 0;
+		tbl->slot[idx].inject_delay_at_eof = 0;
+		tbl->slot[idx].ops.apply_at_eof = false;
+		for (i = 0; i < MAX_DEV_FOR_SPECIAL_OPS; i++)
+			tbl->slot[idx].ops.dev_hdl[i] = -1;
+		tbl->slot[idx].ops.num_dev = 0;
+		tbl = tbl->next;
+	}
+}
+
+/**
+ * __cam_req_mgr_validate_crm_wd_timer()
+ *
+ * @brief    : Validate/modify the wd timer based on associated
+ *             timeout with the request
+ * @link     : link pointer
+ *
+ */
+static void __cam_req_mgr_validate_crm_wd_timer(
+	struct cam_req_mgr_core_link *link)
+{
+	int idx = 0;
+	int next_frame_timeout, current_frame_timeout, max_frame_timeout;
+	int64_t current_req_id, next_req_id;
+	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
+
+	if (link->skip_init_frame) {
+		CAM_DBG(CAM_CRM,
+			"skipping modifying wd timer for first frame after streamon");
+		link->skip_init_frame = false;
+		return;
+	}
+
+	idx = in_q->rd_idx;
+	__cam_req_mgr_dec_idx(
+		&idx, (link->max_delay - 1),
+		in_q->num_slots);
+	next_frame_timeout = in_q->slot[idx].additional_timeout;
+	next_req_id = in_q->slot[idx].req_id;
+	CAM_DBG(CAM_CRM,
+		"rd_idx: %d idx: %d next_req_id: %lld next_frame_timeout: %d ms",
+		in_q->rd_idx, idx, next_req_id, next_frame_timeout);
+
+	idx = in_q->rd_idx;
+	__cam_req_mgr_dec_idx(
+		&idx, link->max_delay,
+		in_q->num_slots);
+	current_frame_timeout = in_q->slot[idx].additional_timeout;
+	current_req_id = in_q->slot[idx].req_id;
+	CAM_DBG(CAM_CRM,
+		"rd_idx: %d idx: %d curr_req_id: %lld current_frame_timeout: %d ms",
+		in_q->rd_idx, idx, current_req_id, current_frame_timeout);
+
+	if ((current_req_id == -1) && (next_req_id == -1)) {
+		CAM_DBG(CAM_CRM,
+			"Skip modifying wd timer, continue with same timeout");
+		return;
+	}
+
+	max_frame_timeout = (current_frame_timeout > next_frame_timeout) ?
+		current_frame_timeout : next_frame_timeout;
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->watchdog) {
+		if ((max_frame_timeout + CAM_REQ_MGR_WATCHDOG_TIMEOUT) >
+			link->watchdog->expires) {
+			CAM_DBG(CAM_CRM,
+				"Modifying wd timer expiry from %d ms to %d ms",
+				link->watchdog->expires,
+				(next_frame_timeout +
+				 CAM_REQ_MGR_WATCHDOG_TIMEOUT));
+			crm_timer_modify(link->watchdog,
+				max_frame_timeout +
+				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
+		} else if (max_frame_timeout) {
+			CAM_DBG(CAM_CRM,
+				"Reset wd timer to frame from %d ms to %d ms",
+				link->watchdog->expires,
+				(max_frame_timeout +
+				 CAM_REQ_MGR_WATCHDOG_TIMEOUT));
+			crm_timer_modify(link->watchdog,
+				max_frame_timeout +
+				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
+		} else if (!max_frame_timeout && (link->watchdog->expires >
+			CAM_REQ_MGR_WATCHDOG_TIMEOUT)) {
+			CAM_DBG(CAM_CRM,
+				"Reset wd timer to default from %d ms to %d ms",
+				link->watchdog->expires,
+				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
+			crm_timer_modify(link->watchdog,
+				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
+		}
+	} else {
+		CAM_WARN(CAM_CRM, "Watchdog timer exited already");
+	}
+	spin_unlock_bh(&link->link_state_spin_lock);
+}
+
+/**
+ * __cam_req_mgr_check_for_lower_pd_devices()
+ *
+ * @brief    : Checks if there are any devices on the link having a lesser
+ *             pd than the max pd of the link
+ * @link     : Pointer to link which needs to be checked
+ *
+ * @return   : 0 if a lower pd device is found negative otherwise
+ */
+static int __cam_req_mgr_check_for_lower_pd_devices(
+	struct cam_req_mgr_core_link	*link)
+{
+	int i = 0;
+	struct cam_req_mgr_connected_device *dev = NULL;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (dev->dev_info.p_delay < link->max_delay)
+			return 0;
+	}
+
+	return -EAGAIN;
+}
+
+/**
+ * __cam_req_mgr_move_to_next_req_slot()
+ *
+ * @brief    : While streaming if input queue does not contain any pending
+ *             request, req mgr still needs to submit pending request ids to
+ *             devices with lower pipeline delay value. But if there are
+ *             continuous max_delay empty slots, we don't need to move to
+ *             next slot since the last request is applied to all devices.
+ * @in_q     : Pointer to input queue where req mgr wil peep into
+ *
+ * @return   : 0 for success, negative for failure
+ */
+static int __cam_req_mgr_move_to_next_req_slot(
+	struct cam_req_mgr_core_link *link)
+{
+	int rc = 0;
+	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
+	int32_t idx = in_q->rd_idx;
+	struct cam_req_mgr_slot *slot;
+
+	__cam_req_mgr_inc_idx(&idx, 1, in_q->num_slots);
+	slot = &in_q->slot[idx];
+
+	CAM_DBG(CAM_CRM, "idx: %d: slot->status %d", idx, slot->status);
+
+	/*
+	 * Some slot can't be reset due to irq congestion and
+	 * and performance issue, we need to reset it when we
+	 * want to move to this slot.
+	 */
+	if (slot->status == CRM_SLOT_STATUS_REQ_APPLIED) {
+		CAM_WARN(CAM_CRM,
+			"slot [idx: %d req: %lld last_applied_idx: %d] was not reset, reset it now",
+			idx, in_q->slot[idx].req_id, in_q->last_applied_idx);
+		if (in_q->last_applied_idx == idx) {
+			CAM_WARN(CAM_CRM,
+				"last_applied_idx: %d",
+				in_q->last_applied_idx);
+			in_q->last_applied_idx = -1;
+		}
+		__cam_req_mgr_reset_req_slot(link, idx);
+	}
+
+	/* Check if there is new req from CSL, if not complete req */
+	if (slot->status == CRM_SLOT_STATUS_NO_REQ) {
+		rc = __cam_req_mgr_check_for_lower_pd_devices(link);
+		if (rc) {
+			CAM_DBG(CAM_CRM, "No lower pd devices on link 0x%x",
+				link->link_hdl);
+			return rc;
+		}
+
+		if (link->cont_empty_slots++ >= link->max_delay) {
+			CAM_DBG(CAM_CRM, "There are %d continuous empty slots on link 0x%x",
+				link->cont_empty_slots, link->link_hdl);
+			return -EAGAIN;
+		}
+
+		__cam_req_mgr_in_q_skip_idx(in_q, idx);
+		slot->status = CRM_SLOT_STATUS_REQ_ADDED;
+		if (in_q->wr_idx != idx)
+			CAM_WARN(CAM_CRM,
+				"CHECK here wr %d, rd %d", in_q->wr_idx, idx);
+		else
+			__cam_req_mgr_inc_idx(&in_q->wr_idx, 1, in_q->num_slots);
+	} else
+		link->cont_empty_slots = 0;
+
+	__cam_req_mgr_inc_idx(&in_q->rd_idx, 1, in_q->num_slots);
+
+	return rc;
+}
+
+static void cam_req_mgr_reconfigure_link(struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_connected_device *device, bool is_active)
+{
+	int i = 0;
+	struct cam_req_mgr_connected_device *dev = NULL;
+	struct cam_req_mgr_req_tbl          *tbl = NULL;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+
+		if (dev->dev_info.trigger_on && !dev->dev_info.is_shdr_master) {
+			dev->is_active = is_active;
+			tbl = dev->pd_tbl;
+			if (is_active) {
+				tbl->dev_mask |= (1 << dev->dev_bit);
+			} else {
+				tbl->dev_mask &= ~(1 << dev->dev_bit);
+				dev->dev_info.mode_switch_req = 0;
+			}
+		}
+
+	}
+}
+
+/**
+ * __cam_req_mgr_send_req()
+ *
+ * @brief    : send request id to be applied to each device connected on link
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through
+ * @in_q     : pointer to input request queue
+ *
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_send_req(struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_req_queue *in_q, uint32_t trigger,
+	struct cam_req_mgr_connected_device **failed_dev)
+{
+	int                                  rc = 0, pd, i, j, idx;
+	bool                                 found = false;
+	int64_t                              req_applied_to_min_pd = -1;
+	struct cam_req_mgr_connected_device *dev = NULL;
+	struct cam_req_mgr_apply_request     apply_req;
+	struct cam_req_mgr_link_evt_data     evt_data;
+	struct cam_req_mgr_tbl_slot          *slot = NULL;
+	struct cam_req_mgr_apply             *apply_data = NULL;
+	struct cam_req_mgr_state_monitor     state;
+	bool                                 prev_dual_trigger_status = false;
+
+	apply_req.link_hdl = link->link_hdl;
+	apply_req.report_if_bubble = 0;
+	apply_req.re_apply = false;
+	if (link->retry_cnt > 0) {
+		if (g_crm_core_dev->recovery_on_apply_fail)
+			apply_req.re_apply = true;
+	}
+
+	if (link->state == CAM_CRM_LINK_STATE_ERR)
+		apply_req.recovery = true;
+	else
+		apply_req.recovery = false;
+
+	if (link->max_delay < 0 || link->max_delay >= CAM_PIPELINE_DELAY_MAX) {
+		CAM_ERR(CAM_CRM, "link->max_delay is out of bounds: %d",
+			link->max_delay);
+		return -EINVAL;
+	}
+
+	apply_data = link->req.apply_data;
+
+	/*
+	 * This For loop is to address the special operation requested
+	 * by device
+	 */
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		pd = dev->dev_info.p_delay;
+		if (pd >= CAM_PIPELINE_DELAY_MAX) {
+			CAM_WARN(CAM_CRM, "pd %d greater than max",
+				pd);
+			continue;
+		}
+
+		found = false;
+		idx = apply_data[pd].idx;
+		slot = &dev->pd_tbl->slot[idx];
+
+		if (!slot->ops.num_dev || (slot->ops.num_dev > MAX_DEV_FOR_SPECIAL_OPS)) {
+			CAM_DBG(CAM_CRM,
+				"No special ops detected for slot %d dev %s num_dev %d",
+				idx, dev->dev_info.name, slot->ops.num_dev);
+			continue;
+		}
+
+		if (!dev->is_active) {
+			CAM_DBG(CAM_CRM, "Device %x linked with link %x is not active",
+			dev->dev_hdl, link->link_hdl);
+			continue;
+		}
+
+		for (j = 0; j < slot->ops.num_dev; j++) {
+			if (dev->dev_hdl == slot->ops.dev_hdl[j]) {
+				found = true;
+				break;
+			}
+		}
+
+		if (!found) {
+			CAM_DBG(CAM_CRM,
+				"Dev_hdl : %d Not matched", dev->dev_hdl);
+			continue;
+		}
+
+		if (slot->req_apply_map & BIT(dev->dev_bit))
+			continue;
+
+		if (apply_data[pd].skip_idx ||
+			(apply_data[pd].req_id < 0)) {
+			CAM_DBG(CAM_CRM,
+				"dev %s skip %d req_id %lld",
+				dev->dev_info.name,
+				apply_data[pd].skip_idx,
+				apply_data[pd].req_id);
+			apply_req.dev_hdl = dev->dev_hdl;
+			apply_req.request_id =
+				link->req.prev_apply_data[pd].req_id;
+			apply_req.trigger_point = trigger;
+			apply_req.report_if_bubble = 0;
+			apply_req.last_applied_max_pd_req =
+				link->req.prev_apply_data[link->max_delay].req_id;
+			if ((dev->ops) && (dev->ops->notify_frame_skip))
+				dev->ops->notify_frame_skip(&apply_req);
+			continue;
+		}
+
+		/* This one is to prevent EOF request to apply on SOF*/
+		if ((trigger == CAM_TRIGGER_POINT_SOF) &&
+			(slot->ops.apply_at_eof)) {
+			CAM_DBG(CAM_CRM, "EOF event cannot be applied at SOF");
+			break;
+		}
+
+		if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+			(!slot->ops.apply_at_eof)) {
+			CAM_DBG(CAM_CRM, "NO EOF DATA FOR REQ: %llu",
+				apply_data[pd].req_id);
+			break;
+		}
+
+		apply_req.dev_hdl = dev->dev_hdl;
+		apply_req.request_id =
+			apply_data[pd].req_id;
+		apply_req.trigger_point = trigger;
+		if ((dev->ops) && (dev->ops->apply_req)) {
+			rc = dev->ops->apply_req(&apply_req);
+			if (rc) {
+				*failed_dev = dev;
+				__cam_req_mgr_notify_frame_skip(link,
+					trigger);
+				return rc;
+			} else
+				slot->req_apply_map |= BIT(dev->dev_bit);
+		} else {
+			CAM_DBG(CAM_REQ,
+				"link_hdl: %x pd: %d req_id %lld ops %p apply_req %p",
+				link->link_hdl, pd, apply_req.request_id,
+				dev->ops, (dev->ops ? dev->ops->apply_req : NULL));
+			break;
+		}
+
+		state.req_state = CAM_CRM_SEND_REQ;
+		state.req_id = apply_req.request_id;
+		state.dev_hdl = apply_req.dev_hdl;
+		state.frame_id = -1;
+		__cam_req_mgr_update_state_monitor_array(link, &state);
+
+		CAM_DBG(CAM_REQ,
+			"SEND: link_hdl %x dev %s pd %d req_id %lld",
+			link->link_hdl, dev->dev_info.name,
+			pd, apply_req.request_id);
+
+		if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+			(slot->ops.apply_at_eof)) {
+			slot->ops.apply_at_eof = false;
+			if (atomic_read(&link->eof_event_cnt) > 0)
+				atomic_dec(&link->eof_event_cnt);
+			return 0;
+		}
+	}
+
+	/* For regular send requests */
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (dev) {
+			pd = dev->dev_info.p_delay;
+			if (pd >= CAM_PIPELINE_DELAY_MAX) {
+				CAM_WARN(CAM_CRM, "pd %d greater than max",
+					pd);
+				continue;
+			}
+
+			if (!(dev->dev_info.trigger & trigger))
+				continue;
+
+			idx = apply_data[pd].idx;
+			slot = &dev->pd_tbl->slot[idx];
+
+			if (dev->dev_info.trigger_on && !dev->dev_info.is_shdr_master &&
+				slot->ops.skip_isp_apply) {
+				CAM_DBG(CAM_CRM, "Skip slave switch req %d apply %lld",
+					dev->dev_info.mode_switch_req, apply_data[pd].req_id);
+				continue;
+			}
+
+			if (apply_data[pd].skip_idx ||
+				(apply_data[pd].req_id < 0)) {
+				CAM_DBG(CAM_CRM,
+					"dev %s skip %d req_id %lld",
+					dev->dev_info.name,
+					apply_data[pd].skip_idx,
+					apply_data[pd].req_id);
+				apply_req.dev_hdl = dev->dev_hdl;
+				apply_req.request_id =
+					link->req.prev_apply_data[pd].req_id;
+				apply_req.trigger_point = trigger;
+				apply_req.report_if_bubble = 0;
+				apply_req.last_applied_max_pd_req =
+					link->req.prev_apply_data[link->max_delay].req_id;
+				if ((dev->ops) && (dev->ops->notify_frame_skip))
+					dev->ops->notify_frame_skip(&apply_req);
+				continue;
+			}
+
+			found = false;
+
+			apply_req.dev_hdl = dev->dev_hdl;
+			apply_req.request_id =
+				apply_data[pd].req_id;
+			apply_req.report_if_bubble =
+				in_q->slot[idx].recover;
+
+			/*
+			 * If it is dual trigger usecase, need to tell
+			 * devices that the req is re-applied, then the
+			 * devices need to skip applying if the req has
+			 * been handled.
+			 * e.x. ISP device
+			 */
+			if (link->retry_cnt > 0) {
+				if (!apply_req.report_if_bubble &&
+					link->dual_trigger)
+					apply_req.re_apply = true;
+			}
+
+			if (slot->req_apply_map & BIT(dev->dev_bit))
+				continue;
+
+			for (j = 0; j < slot->ops.num_dev; j++) {
+				if (dev->dev_hdl == slot->ops.dev_hdl[j]) {
+					found = true;
+					break;
+				}
+			}
+
+			/*
+			 * If apply_at_eof is enabled do not apply at SOF
+			 * e.x. Flash device
+			 */
+			if ((trigger == CAM_TRIGGER_POINT_SOF) && found &&
+				(slot->ops.apply_at_eof))
+				continue;
+
+			if ((trigger == CAM_TRIGGER_POINT_EOF) && found &&
+				(!slot->ops.apply_at_eof))
+				continue;
+
+			apply_req.trigger_point = trigger;
+			apply_req.dual_trigger_status = CAM_REQ_DUAL_TRIGGER_NONE;
+			CAM_DBG(CAM_REQ,
+				"SEND: link_hdl %x dev %s pd %d req_id %lld",
+				link->link_hdl, dev->dev_info.name,
+				pd, apply_req.request_id);
+			if (dev->ops && dev->ops->apply_req) {
+				rc = dev->ops->apply_req(&apply_req);
+				if (rc < 0) {
+					*failed_dev = dev;
+					break;
+				} else
+					slot->req_apply_map |= BIT(dev->dev_bit);
+			}
+
+			state.req_state = CAM_CRM_SEND_REQ;
+			state.req_id = apply_req.request_id;
+			state.dev_hdl = apply_req.dev_hdl;
+			state.frame_id = -1;
+			__cam_req_mgr_update_state_monitor_array(link, &state);
+
+			if (link->is_shdr && dev->dev_info.is_shdr_master) {
+				prev_dual_trigger_status = link->wait_for_dual_trigger;
+				if (apply_req.dual_trigger_status ==
+					CAM_REQ_DUAL_TRIGGER_TWO_EXPOSURE)
+					link->wait_for_dual_trigger = true;
+				else if (apply_req.dual_trigger_status ==
+					CAM_REQ_DUAL_TRIGGER_ONE_EXPOSURE)
+					link->wait_for_dual_trigger = false;
+
+				if (prev_dual_trigger_status != link->wait_for_dual_trigger)
+					cam_req_mgr_reconfigure_link(
+						link, dev, link->wait_for_dual_trigger);
+			}
+
+			if (pd == link->min_delay)
+				req_applied_to_min_pd = apply_req.request_id;
+
+			trace_cam_req_mgr_apply_request(link, &apply_req, dev);
+		}
+	}
+
+	if (rc < 0) {
+		CAM_WARN_RATE_LIMIT(CAM_CRM, "APPLY FAILED pd %d req_id %lld",
+			dev->dev_info.p_delay, apply_req.request_id);
+		/* Apply req failed notify already applied devs */
+		for (; i >= 0; i--) {
+			dev = &link->l_dev[i];
+			evt_data.evt_type = CAM_REQ_MGR_LINK_EVT_ERR;
+			evt_data.dev_hdl = dev->dev_hdl;
+			evt_data.link_hdl =  link->link_hdl;
+			evt_data.req_id = apply_req.request_id;
+			evt_data.u.error = CRM_KMD_ERR_BUBBLE;
+			if (dev->ops && dev->ops->process_evt)
+				dev->ops->process_evt(&evt_data);
+		}
+		__cam_req_mgr_notify_frame_skip(link, trigger);
+	} else {
+		memcpy(link->req.prev_apply_data, link->req.apply_data,
+			CAM_PIPELINE_DELAY_MAX *
+			sizeof(struct cam_req_mgr_apply));
+		if (req_applied_to_min_pd > 0) {
+			link->open_req_cnt--;
+			CAM_DBG(CAM_REQ,
+				"Open_reqs: %u after successfully applying req:%d",
+				link->open_req_cnt, req_applied_to_min_pd);
+		}
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_check_link_is_ready()
+ *
+ * @brief    : traverse through all request tables and see if all devices are
+ *             ready to apply request settings.
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through
+ * @idx      : index within input request queue
+ * @validate_only : Whether to validate only and/or update settings
+ *
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_check_link_is_ready(struct cam_req_mgr_core_link *link,
+	int32_t idx, bool validate_only)
+{
+	int                            rc;
+	struct cam_req_mgr_traverse    traverse_data;
+	struct cam_req_mgr_req_queue  *in_q;
+	struct cam_req_mgr_apply      *apply_data;
+
+	in_q = link->req.in_q;
+
+	apply_data = link->req.apply_data;
+
+	if (validate_only == false) {
+		memset(apply_data, 0,
+		    sizeof(struct cam_req_mgr_apply) * CAM_PIPELINE_DELAY_MAX);
+	}
+
+	traverse_data.apply_data = apply_data;
+	traverse_data.idx = idx;
+	traverse_data.tbl = link->req.l_tbl;
+	traverse_data.in_q = in_q;
+	traverse_data.result = 0;
+	traverse_data.result_data.masked_value = 0;
+	traverse_data.result_data.pd = 0;
+	traverse_data.result_data.req_id = 0;
+	traverse_data.validate_only = validate_only;
+	traverse_data.open_req_cnt = link->open_req_cnt;
+
+	/*
+	 * Some no-sync mode requests are processed after link config,
+	 * then process the sync mode requests after no-sync mode requests
+	 * are handled, the initial_skip should be false when processing
+	 * the sync mode requests.
+	 */
+	if (link->initial_skip) {
+		CAM_DBG(CAM_CRM,
+			"Set initial_skip to false for link %x",
+			link->link_hdl);
+		link->initial_skip = false;
+	}
+
+	/*
+	 *  Traverse through all pd tables, if result is success,
+	 *  apply the settings
+	 */
+	rc = __cam_req_mgr_traverse(&traverse_data);
+	CAM_DBG(CAM_CRM,
+		"SOF: idx %d result %x pd_mask %x rc %d",
+		idx, traverse_data.result, link->pd_mask, rc);
+
+	if (!rc && traverse_data.result == link->pd_mask) {
+		CAM_DBG(CAM_CRM,
+			"READY: link_hdl= %x idx= %d, req_id= %lld :%lld :%lld",
+			link->link_hdl, idx,
+			apply_data[2].req_id,
+			apply_data[1].req_id,
+			apply_data[0].req_id);
+	} else {
+		rc = -EAGAIN;
+		__cam_req_mgr_find_dev_name(link,
+			traverse_data.result_data.req_id,
+			traverse_data.result_data.pd,
+			traverse_data.result_data.masked_value);
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_check_sync_for_mslave()
+ *
+ * @brief    : Processes requests during sync mode [master-slave]
+ *             Here master corresponds to the link having a higher
+ *             max_delay (pd) compared to the slave link.
+ * @link     : Pointer to link whose input queue and req tbl are
+ *             traversed through
+ * @slot     : Pointer to the current slot being processed
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_check_sync_for_mslave(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_core_link *sync_link,
+	struct cam_req_mgr_slot *slot)
+{
+	struct cam_req_mgr_slot      *sync_slot = NULL;
+	int sync_slot_idx = 0, prev_idx, next_idx, rd_idx, sync_rd_idx, rc = 0;
+	int64_t req_id = 0, sync_req_id = 0;
+	int32_t sync_num_slots = 0;
+
+	if (!sync_link  || !link) {
+		CAM_ERR(CAM_CRM, "Sync link or link is null");
+		return -EINVAL;
+	}
+
+	req_id = slot->req_id;
+
+	if (!sync_link->req.in_q) {
+		CAM_ERR(CAM_CRM, "Link hdl %x in_q is NULL",
+			sync_link->link_hdl);
+		return -EINVAL;
+	}
+
+	sync_num_slots = sync_link->req.in_q->num_slots;
+	sync_rd_idx = sync_link->req.in_q->rd_idx;
+
+	CAM_DBG(CAM_CRM,
+		"link_hdl %x req %lld frame_skip_flag %d open_req_cnt:%u initial_sync_req [%lld,%lld] is_master:%d",
+		link->link_hdl, req_id, link->sync_link_sof_skip,
+		link->open_req_cnt, link->initial_sync_req,
+		sync_link->initial_sync_req, link->is_master);
+
+	if (sync_link->sync_link_sof_skip) {
+		CAM_DBG(CAM_CRM,
+			"No req applied on corresponding SOF on sync link: %x",
+				sync_link->link_hdl);
+		sync_link->sync_link_sof_skip = false;
+		return -EAGAIN;
+	}
+
+	if (link->in_msync_mode &&
+		sync_link->in_msync_mode &&
+		(req_id - sync_link->req.in_q->slot[sync_rd_idx].req_id >
+		link->max_delay - sync_link->max_delay)) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld on link:%x need to hold for link: %x req:%d",
+			req_id,
+			link->link_hdl,
+			sync_link->link_hdl,
+			sync_link->req.in_q->slot[sync_rd_idx].req_id);
+		return -EINVAL;
+	}
+
+	if (link->is_master) {
+		if (sync_link->initial_skip) {
+			CAM_DBG(CAM_CRM,  "Link 0x%x [slave] not streamed on",
+				sync_link->link_hdl);
+			return -EAGAIN;
+		}
+
+		rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, true);
+		if (rc) {
+			CAM_DBG(CAM_CRM,
+				"Req: %lld [master] not ready on link: %x, rc=%d",
+				req_id, link->link_hdl, rc);
+			link->sync_link_sof_skip = true;
+			return rc;
+		}
+
+		prev_idx = slot->idx;
+		__cam_req_mgr_dec_idx(&prev_idx,
+			(link->max_delay - sync_link->max_delay),
+			link->req.in_q->num_slots);
+
+		rd_idx = sync_link->req.in_q->rd_idx;
+		sync_req_id = link->req.in_q->slot[prev_idx].req_id;
+		if ((sync_link->initial_sync_req != -1) &&
+			(sync_link->initial_sync_req <= sync_req_id)) {
+			sync_slot_idx = __cam_req_mgr_find_slot_for_req(
+				sync_link->req.in_q, sync_req_id);
+			if (sync_slot_idx == -1) {
+				CAM_DBG(CAM_CRM,
+					"Prev Req: %lld [master] not found on link: %x [slave]",
+					sync_req_id, sync_link->link_hdl);
+				link->sync_link_sof_skip = true;
+				return -EINVAL;
+			}
+
+			if ((sync_link->req.in_q->slot[sync_slot_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED) &&
+				(((sync_slot_idx - rd_idx + sync_num_slots) %
+				sync_num_slots) >= 1) &&
+				(sync_link->req.in_q->slot[rd_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED)) {
+				CAM_DBG(CAM_CRM,
+					"Prev Req: %lld [master] not next on link: %x [slave]",
+					sync_req_id,
+					sync_link->link_hdl);
+				return -EINVAL;
+			}
+
+			rc = __cam_req_mgr_check_link_is_ready(sync_link,
+				sync_slot_idx, true);
+			if (rc &&
+				(sync_link->req.in_q->slot[sync_slot_idx].status
+				!= CRM_SLOT_STATUS_REQ_APPLIED)) {
+				CAM_DBG(CAM_CRM,
+					"Req: %lld not ready on [slave] link: %x, rc=%d",
+					sync_req_id, sync_link->link_hdl, rc);
+				link->sync_link_sof_skip = true;
+				return rc;
+			}
+		}
+	} else {
+		if (link->initial_skip)
+			link->initial_skip = false;
+
+		rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, true);
+		if (rc) {
+			CAM_DBG(CAM_CRM,
+				"Req: %lld [slave] not ready on link: %x, rc=%d",
+				req_id, link->link_hdl, rc);
+			link->sync_link_sof_skip = true;
+			return rc;
+		}
+
+		next_idx = link->req.in_q->rd_idx;
+		rd_idx = sync_link->req.in_q->rd_idx;
+		__cam_req_mgr_inc_idx(&next_idx,
+			(sync_link->max_delay - link->max_delay),
+			link->req.in_q->num_slots);
+
+		sync_req_id = link->req.in_q->slot[next_idx].req_id;
+
+		if ((sync_link->initial_sync_req != -1) &&
+			(sync_link->initial_sync_req <= sync_req_id)) {
+			sync_slot_idx = __cam_req_mgr_find_slot_for_req(
+				sync_link->req.in_q, sync_req_id);
+			if (sync_slot_idx == -1) {
+				CAM_DBG(CAM_CRM,
+					"Next Req: %lld [slave] not found on link: %x [master]",
+					sync_req_id, sync_link->link_hdl);
+				link->sync_link_sof_skip = true;
+				return -EINVAL;
+			}
+
+			if ((sync_link->req.in_q->slot[sync_slot_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED) &&
+				(((sync_slot_idx - rd_idx + sync_num_slots) %
+				sync_num_slots) >= 1) &&
+				(sync_link->req.in_q->slot[rd_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED)) {
+				CAM_DBG(CAM_CRM,
+					"Next Req: %lld [slave] not next on link: %x [master]",
+					sync_req_id, sync_link->link_hdl);
+				return -EINVAL;
+			}
+
+			sync_slot = &sync_link->req.in_q->slot[sync_slot_idx];
+			rc = __cam_req_mgr_check_link_is_ready(sync_link,
+				sync_slot_idx, true);
+			if (rc && (sync_slot->status !=
+				CRM_SLOT_STATUS_REQ_APPLIED)) {
+				CAM_DBG(CAM_CRM,
+					"Next Req: %lld [slave] not ready on [master] link: %x, rc=%d",
+					sync_req_id, sync_link->link_hdl, rc);
+				link->sync_link_sof_skip = true;
+				return rc;
+			}
+		}
+	}
+
+	CAM_DBG(CAM_REQ,
+		"Req: %lld ready to apply on link: %x [validation successful]",
+		req_id, link->link_hdl);
+
+	return 0;
+}
+
+
+/**
+ * __cam_req_mgr_check_sync_request_is_ready()
+ *
+ * @brief    : processes requests during sync mode
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through
+ * @slot     : pointer to the current slot being processed
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_check_sync_req_is_ready(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_core_link *sync_link,
+	struct cam_req_mgr_slot *slot,
+	uint32_t trigger)
+{
+	struct cam_req_mgr_slot *sync_rd_slot = NULL;
+	int64_t req_id = 0, sync_req_id = 0;
+	int sync_slot_idx = 0, sync_rd_idx = 0, rc = 0;
+	int32_t sync_num_slots = 0;
+	uint64_t sync_frame_duration = 0;
+	uint64_t sof_timestamp_delta = 0;
+	uint64_t master_slave_diff = 0;
+	bool ready = true, sync_ready = true;
+	int slot_idx_diff = 0;
+
+	if (!sync_link || !link) {
+		CAM_ERR(CAM_CRM, "Sync link null");
+		return -EINVAL;
+	}
+
+	req_id = slot->req_id;
+
+	if (!sync_link->req.in_q) {
+		CAM_ERR(CAM_CRM, "Link hdl %x in_q is NULL",
+			sync_link->link_hdl);
+		return -EINVAL;
+	}
+
+	sync_num_slots = sync_link->req.in_q->num_slots;
+	sync_rd_idx    = sync_link->req.in_q->rd_idx;
+	sync_rd_slot   = &sync_link->req.in_q->slot[sync_rd_idx];
+	sync_req_id    = sync_rd_slot->req_id;
+
+	CAM_DBG(CAM_REQ,
+		"link_hdl %x sync link_hdl %x req %lld",
+		link->link_hdl, sync_link->link_hdl, req_id);
+
+	if ((sync_link->initial_skip) &&
+		(req_id >= sync_req_id)) {
+		link->initial_skip = false;
+		CAM_DBG(CAM_CRM,
+			"sync link %x not streamed on",
+			sync_link->link_hdl);
+		return -EAGAIN;
+	}
+
+	if (sync_link->prev_sof_timestamp)
+		sync_frame_duration = sync_link->sof_timestamp -
+			sync_link->prev_sof_timestamp;
+	else
+		sync_frame_duration = DEFAULT_FRAME_DURATION;
+
+	sof_timestamp_delta =
+		link->sof_timestamp >= sync_link->sof_timestamp
+		? link->sof_timestamp - sync_link->sof_timestamp
+		: sync_link->sof_timestamp - link->sof_timestamp;
+
+	CAM_DBG(CAM_CRM,
+		"sync link %x last frame_duration is %d ns",
+		sync_link->link_hdl, sync_frame_duration);
+
+	if (link->initial_skip) {
+		link->initial_skip = false;
+
+		if ((link->sof_timestamp > sync_link->sof_timestamp) &&
+			(sync_link->sof_timestamp > 0) &&
+			(link->sof_timestamp - sync_link->sof_timestamp) <
+			(sync_frame_duration / 2)) {
+			/*
+			 * If this frame sync with the previous frame of sync
+			 * link, then we need to skip this frame, since the
+			 * previous frame of sync link is also skipped.
+			 */
+			CAM_DBG(CAM_CRM,
+				"This frame sync with previous sync_link %x frame",
+				sync_link->link_hdl);
+			return -EAGAIN;
+		} else if (link->sof_timestamp <= sync_link->sof_timestamp) {
+			/*
+			 * Sometimes, link receives the SOF event is eariler
+			 * than sync link in IFE CSID side, but link's SOF
+			 * event is processed later than sync link's, then
+			 * we need to skip this SOF event since the sync
+			 * link's SOF event is also skipped.
+			 */
+			CAM_DBG(CAM_CRM,
+				"The previous frame of sync link is skipped");
+			return -EAGAIN;
+		}
+	}
+
+	if (sync_link->sync_link_sof_skip) {
+		CAM_DBG(CAM_REQ,
+			"No req applied on corresponding SOF on sync link: %x",
+			sync_link->link_hdl);
+		sync_link->sync_link_sof_skip = false;
+		return -EAGAIN;
+	}
+
+	sync_slot_idx = __cam_req_mgr_find_slot_for_req(
+		sync_link->req.in_q, req_id);
+	if (sync_slot_idx == -1) {
+		CAM_DBG(CAM_CRM, "Req: %lld not found on link: %x [other link]",
+			req_id, sync_link->link_hdl);
+		return -EAGAIN;
+	}
+
+	slot_idx_diff = (sync_slot_idx - sync_rd_idx + sync_num_slots) %
+		sync_num_slots;
+	if ((sync_link->req.in_q->slot[sync_slot_idx].status !=
+		CRM_SLOT_STATUS_REQ_APPLIED) &&
+		((slot_idx_diff > 1) ||
+		((slot_idx_diff == 1) &&
+		(sync_rd_slot->status !=
+		CRM_SLOT_STATUS_REQ_APPLIED)))) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld [other link] not next req to be applied on link: %x",
+			req_id, sync_link->link_hdl);
+		return -EAGAIN;
+	}
+
+	rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, true);
+	if (rc) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld [My link] not ready on link: %x, rc=%d",
+			req_id, link->link_hdl, rc);
+		ready = false;
+	}
+
+	if (sync_link->req.in_q) {
+		rc = __cam_req_mgr_check_link_is_ready(sync_link,
+			sync_slot_idx, true);
+		if (rc && (sync_link->req.in_q->slot[sync_slot_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED)) {
+			CAM_DBG(CAM_CRM,
+				"Req: %lld not ready on link: %x, rc=%d",
+				req_id, sync_link->link_hdl, rc);
+			sync_ready = false;
+		}
+	} else {
+		CAM_ERR(CAM_CRM, "Link hdl %x in_q is NULL",
+			sync_link->link_hdl);
+		return -EINVAL;
+	}
+
+	/*
+	 * If both of them are ready or not ready, then just
+	 * skip this sof and don't skip sync link next SOF.
+	 */
+	if (sync_ready != ready) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld ready %d sync_ready %d, ignore sync link next SOF",
+			req_id, ready, sync_ready);
+
+		/*
+		 * Only skip the frames if current frame sync with
+		 * next frame of sync link.
+		 */
+		if (sof_timestamp_delta > sync_frame_duration / 2)
+			link->sync_link_sof_skip = true;
+		return -EINVAL;
+	} else if (!ready) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld not ready on link: %x",
+			req_id, link->link_hdl);
+		return -EINVAL;
+	}
+
+	/*
+	 * Do the self-correction when the frames are sync,
+	 * we consider that the frames are synced if the
+	 * difference of two SOF timestamp less than
+	 * (sync_frame_duration / 5).
+	 */
+	master_slave_diff = sync_frame_duration;
+	do_div(master_slave_diff, 5);
+	if ((trigger == CAM_TRIGGER_POINT_SOF) &&
+		(sync_link->sof_timestamp > 0) &&
+		(sof_timestamp_delta < master_slave_diff) &&
+		(sync_rd_slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) &&
+		(req_id >= link->initial_sync_req) &&
+		(req_id - link->initial_sync_req >=
+		(INITIAL_IN_SYNC_REQ + link->max_delay))) {
+
+		/*
+		 * This means current frame should sync with next
+		 * frame of sync link, then the request id of in
+		 * rd slot of two links should be same.
+		 */
+		CAM_DBG(CAM_CRM,
+			"link %x req_id %lld, sync_link %x req_id %lld",
+			link->link_hdl, req_id,
+			sync_link->link_hdl, sync_req_id);
+
+		if (req_id > sync_req_id) {
+			CAM_DBG(CAM_CRM,
+				"link %x too quickly, skip this frame",
+				link->link_hdl);
+			return -EAGAIN;
+		} else if (req_id < sync_req_id) {
+			CAM_DBG(CAM_CRM,
+				"sync link %x too quickly, skip next frame of sync link",
+				sync_link->link_hdl);
+			link->sync_link_sof_skip = true;
+		} else if ((sync_link->req.in_q->slot[sync_slot_idx].status !=
+			CRM_SLOT_STATUS_REQ_APPLIED) && !sync_link->is_sending_req) {
+			CAM_DBG(CAM_CRM,
+				"link %x other not applied", link->link_hdl);
+			return -EAGAIN;
+		}
+	}
+	CAM_DBG(CAM_REQ,
+		"Req: %lld ready to apply on link: %x [validation successful]",
+		req_id, link->link_hdl);
+
+	return 0;
+}
+
+static int __cam_req_mgr_check_multi_sync_link_ready(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_core_link **sync_link,
+	struct cam_req_mgr_slot *slot,
+	int32_t num_sync_links,
+	uint32_t trigger)
+{
+	int i, rc = 0;
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state == CAM_CRM_LINK_STATE_IDLE) {
+		spin_unlock_bh(&link->link_state_spin_lock);
+		CAM_ERR(CAM_CRM, "link hdl %x is in idle state",
+				link->link_hdl);
+		return -EINVAL;
+	}
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	for (i = 0; i < num_sync_links; i++) {
+		if (sync_link[i]) {
+			if (slot->req_id <= sync_link[i]->last_flush_id) {
+				CAM_DBG(CAM_CRM,
+					"link:0x%x req:%lld has been flushed in sync link:0x%x, last_flush_id:%lld",
+					link->link_hdl, slot->req_id,
+					sync_link[i]->link_hdl,
+					sync_link[i]->last_flush_id);
+
+				rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, true);
+				if (!rc)
+					continue;
+				else {
+					CAM_DBG(CAM_CRM, "link %x not ready", link->link_hdl);
+					return -EINVAL;
+				}
+			}
+
+			if (sync_link[i]->state ==
+				CAM_CRM_LINK_STATE_IDLE) {
+				CAM_ERR(CAM_CRM, "sync link hdl %x is idle",
+					sync_link[i]->link_hdl);
+				return -EINVAL;
+			}
+			if (link->max_delay == sync_link[i]->max_delay) {
+				rc = __cam_req_mgr_check_sync_req_is_ready(
+						link, sync_link[i],
+						slot, trigger);
+				if (rc < 0) {
+					CAM_DBG(CAM_CRM, "link %x not ready",
+						link->link_hdl);
+					return rc;
+				}
+			} else if (link->max_delay >
+					sync_link[i]->max_delay) {
+				link->is_master = true;
+				sync_link[i]->is_master = false;
+				rc = __cam_req_mgr_check_sync_for_mslave(
+					link, sync_link[i], slot);
+				if (rc < 0) {
+					CAM_DBG(CAM_CRM, "link%x not ready",
+						link->link_hdl);
+					return rc;
+				}
+			} else {
+				link->is_master = false;
+				sync_link[i]->is_master = true;
+				rc = __cam_req_mgr_check_sync_for_mslave(
+						link, sync_link[i], slot);
+				if (rc < 0) {
+					CAM_DBG(CAM_CRM, "link %x not ready",
+						link->link_hdl);
+					return rc;
+				}
+			}
+		} else {
+			CAM_ERR(CAM_REQ, "Sync link is null");
+			return -EINVAL;
+		}
+	}
+
+	rc = __cam_req_mgr_inject_delay(link->req.l_tbl,
+		slot->idx, trigger);
+	if (rc < 0) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld needs to inject delay at %s",
+			slot->req_id,
+			(trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF");
+		return -EINVAL;
+	}
+
+	/*
+	 *  At this point all validation is successfully done
+	 *  and we can proceed to apply the given request.
+	 *  Ideally the next call should return success.
+	 */
+	rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, false);
+	if (rc)
+		CAM_WARN(CAM_CRM, "Unexpected return value rc: %d", rc);
+
+	return 0;
+}
+
+/**
+ * __cam_req_mgr_process_req()
+ *
+ * @brief    : processes read index in request queue and traverse through table
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through
+ *
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_process_req(struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_trigger_notify *trigger_data)
+{
+	int                                  rc = 0, idx, pd, i;
+	int                                  reset_step = 0;
+	bool                                 is_applied = true;
+	int32_t                              num_sync_links;
+	uint32_t                             trigger = trigger_data->trigger;
+	uint64_t                             wq_sched_timeout = 0;
+	struct cam_req_mgr_slot             *slot = NULL;
+	struct cam_req_mgr_tbl_slot         *tbl_slot = NULL;
+	struct cam_req_mgr_req_queue        *in_q;
+	struct cam_req_mgr_core_session     *session;
+	struct cam_req_mgr_connected_device *dev = NULL;
+	struct cam_req_mgr_core_link        *tmp_link = NULL;
+	struct cam_req_mgr_apply            *apply_data = NULL;
+	struct cam_req_mgr_core_link
+		*sync_link[MAXIMUM_LINKS_PER_SESSION - 1];
+
+	session = (struct cam_req_mgr_core_session *)link->parent;
+	if (!session) {
+		CAM_WARN(CAM_CRM, "session ptr NULL %x", link->link_hdl);
+		return -EINVAL;
+	}
+
+	mutex_lock(&session->lock);
+	/*
+	 * During session destroy/unlink the link state is updated and session
+	 * mutex is released when flushing the workq. In case the wq is scheduled
+	 * thereafter this API will then check the updated link state and exit
+	 */
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state == CAM_CRM_LINK_STATE_IDLE) {
+		spin_unlock_bh(&link->link_state_spin_lock);
+		mutex_unlock(&session->lock);
+		return -EPERM;
+	}
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	in_q = link->req.in_q;
+	/*
+	 * Check if new read index,
+	 * - if in pending  state, traverse again to complete
+	 *    transaction of this read index.
+	 * - if in applied_state, somthign wrong.
+	 * - if in no_req state, no new req
+	 */
+	CAM_DBG(CAM_REQ,
+		"%s Req[%lld] idx %d req_status %d link_hdl %x wd_timeout %d ms trigger:%d",
+		((trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF"),
+		in_q->slot[in_q->rd_idx].req_id, in_q->rd_idx,
+		in_q->slot[in_q->rd_idx].status, link->link_hdl,
+		in_q->slot[in_q->rd_idx].additional_timeout, trigger);
+
+	slot = &in_q->slot[in_q->rd_idx];
+
+	if ((trigger != CAM_TRIGGER_POINT_SOF) &&
+		(trigger != CAM_TRIGGER_POINT_EOF))
+		goto end;
+
+	if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+		(!atomic_read(&link->eof_event_cnt))) {
+		CAM_DBG(CAM_CRM, "Not any request to schedule at EOF");
+		goto end;
+	}
+
+	if (slot->status == CRM_SLOT_STATUS_REQ_APPLIED)
+		goto end;
+
+	if (trigger == CAM_TRIGGER_POINT_SOF) {
+
+		if (slot->status == CRM_SLOT_STATUS_NO_REQ) {
+			CAM_DBG(CAM_CRM, "No Pending req");
+			rc = 0;
+			__cam_req_mgr_notify_frame_skip(link,
+				trigger);
+			goto end;
+		}
+
+		/*
+		 * Update the timestamp in session lock protection
+		 * to avoid timing issue.
+		 */
+		link->prev_sof_timestamp = link->sof_timestamp;
+		link->sof_timestamp = trigger_data->sof_timestamp_val;
+
+		/* Use half frame interval to detect the WQ congestion */
+		wq_sched_timeout = CAM_REQ_MGR_HALF_FRAME_DURATION(link->sof_timestamp -
+			link->prev_sof_timestamp) / CAM_COMMON_NS_PER_MS;
+
+		/* Check for WQ congestion */
+		if (jiffies_to_msecs(jiffies -
+			link->last_sof_trigger_jiffies) <
+			wq_sched_timeout)
+			link->wq_congestion = true;
+		else
+			link->wq_congestion = false;
+
+		/*
+		 * Only update the jiffies for SOF trigger,
+		 * since it is used to protect from
+		 * applying fails in ISP which is triggered at SOF.
+		 */
+		if (trigger == CAM_TRIGGER_POINT_SOF)
+			link->last_sof_trigger_jiffies = jiffies;
+
+	}
+
+	if (slot->status != CRM_SLOT_STATUS_REQ_READY) {
+		if (slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+			/*
+			 * If slot->num_sync_links is 0, it is sched_req_v1, otherwise
+			 * it is sched_req_v2.
+			 */
+			if (slot->num_sync_links == 0) {
+				num_sync_links = link->num_sync_links;
+				for (i = 0; i < num_sync_links; i++)
+					sync_link[i] = link->sync_link[i];
+			} else {
+				num_sync_links = slot->num_sync_links;
+				for (i = 0; i < num_sync_links; i++)
+					sync_link[i] = cam_get_link_priv(slot->sync_link_hdls[i]);
+			}
+			rc = __cam_req_mgr_check_multi_sync_link_ready(
+				link, sync_link, slot, num_sync_links, trigger);
+		} else {
+			if (link->in_msync_mode) {
+				CAM_DBG(CAM_CRM,
+					"Settings master-slave non sync mode for link 0x%x",
+					link->link_hdl);
+				link->in_msync_mode = false;
+				link->initial_sync_req = -1;
+				for (i = 0; i < link->num_sync_links; i++) {
+					if (link->sync_link[i]) {
+						tmp_link = link->sync_link[i];
+						tmp_link->initial_sync_req = -1;
+						tmp_link->in_msync_mode = false;
+					}
+				}
+			}
+
+			/*
+			 * Validate that if the req is ready to apply before
+			 * checking the inject delay.
+			 */
+			rc = __cam_req_mgr_check_link_is_ready(link,
+				slot->idx, true);
+
+			if (!rc) {
+				rc = __cam_req_mgr_inject_delay(link->req.l_tbl,
+					slot->idx, trigger);
+				if (rc < 0)
+					CAM_DBG(CAM_CRM,
+						"Req: %lld needs to inject delay at %s",
+						slot->req_id,
+						(trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF");
+
+				if (!rc)
+					rc = __cam_req_mgr_check_link_is_ready(link,
+						slot->idx, false);
+			}
+		}
+
+		if (rc < 0) {
+			/*
+			 * If traverse result is not success, then some devices
+			 * are not ready with packet for the asked request id,
+			 * hence try again in next sof
+			 */
+			slot->status = CRM_SLOT_STATUS_REQ_PENDING;
+			spin_lock_bh(&link->link_state_spin_lock);
+			if (link->state == CAM_CRM_LINK_STATE_ERR) {
+				/*
+				 * During error recovery all tables should be
+				 * ready, don't expect to enter here.
+				 * @TODO: gracefully handle if recovery fails.
+				 */
+				CAM_ERR_RATE_LIMIT(CAM_CRM,
+					"FATAL recovery cant finish idx %d status %d",
+					in_q->rd_idx,
+					in_q->slot[in_q->rd_idx].status);
+				rc = -EPERM;
+			}
+			spin_unlock_bh(&link->link_state_spin_lock);
+			__cam_req_mgr_notify_frame_skip(link, trigger);
+			__cam_req_mgr_validate_crm_wd_timer(link);
+			goto end;
+		} else {
+			slot->status = CRM_SLOT_STATUS_REQ_READY;
+			link->is_sending_req = true;
+			CAM_DBG(CAM_REQ,
+				"linx_hdl %x Req[%lld] idx %d ready to apply",
+				link->link_hdl, in_q->slot[in_q->rd_idx].req_id,
+				in_q->rd_idx);
+		}
+	} else {
+		rc = __cam_req_mgr_inject_delay(link->req.l_tbl,
+			slot->idx, trigger);
+		if (rc < 0) {
+			CAM_DBG(CAM_CRM,
+				"linx_hdl %x Req: %lld needs to inject delay at %s",
+				link->link_hdl, slot->req_id,
+				(trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF");
+			__cam_req_mgr_notify_frame_skip(link, trigger);
+			__cam_req_mgr_validate_crm_wd_timer(link);
+			goto end;
+		}
+	}
+	mutex_unlock(&session->lock);
+
+	rc = __cam_req_mgr_send_req(link, link->req.in_q, trigger, &dev);
+	if (rc < 0) {
+		/* Apply req failed retry at next sof */
+		slot->status = CRM_SLOT_STATUS_REQ_PENDING;
+		link->is_sending_req = false;
+
+		if (!link->wq_congestion && dev) {
+			if (rc != -EAGAIN)
+				link->retry_cnt++;
+
+			if (link->retry_cnt >= MAXIMUM_RETRY_ATTEMPTS) {
+				CAM_DBG(CAM_CRM,
+					"Max retry attempts (count %d) reached on link[0x%x] for req [%lld]",
+					MAXIMUM_RETRY_ATTEMPTS, link->link_hdl,
+					in_q->slot[in_q->rd_idx].req_id);
+
+				cam_req_mgr_debug_delay_detect();
+				trace_cam_delay_detect("CRM",
+					"Max retry attempts reached",
+					in_q->slot[in_q->rd_idx].req_id,
+					CAM_DEFAULT_VALUE,
+					link->link_hdl,
+					CAM_DEFAULT_VALUE, rc);
+
+				/*
+				 * Try for internal recovery - primarily for IFE subdev
+				 * if it's the first instance of stall
+				 */
+				if (!slot->recovery_counter)
+					link->try_for_internal_recovery = true;
+
+				__cam_req_mgr_notify_error_on_link(link, dev);
+
+				/* Increment internal recovery counter */
+				if (link->try_for_internal_recovery) {
+					slot->recovery_counter++;
+					link->try_for_internal_recovery = false;
+				}
+
+				link->retry_cnt = 0;
+			}
+		} else
+			CAM_WARN_RATE_LIMIT(CAM_CRM,
+				"workqueue congestion, last applied idx:%d rd idx:%d",
+				in_q->last_applied_idx,
+				in_q->rd_idx);
+	} else {
+		if (link->retry_cnt)
+			link->retry_cnt = 0;
+
+		/* Check for any long exposure settings */
+		__cam_req_mgr_validate_crm_wd_timer(link);
+
+		spin_lock_bh(&link->link_state_spin_lock);
+		if (link->state == CAM_CRM_LINK_STATE_ERR) {
+			CAM_WARN(CAM_CRM, "Err recovery done idx %d",
+				in_q->rd_idx);
+			link->state = CAM_CRM_LINK_STATE_READY;
+		}
+		spin_unlock_bh(&link->link_state_spin_lock);
+
+		if (link->sync_link_sof_skip)
+			link->sync_link_sof_skip = false;
+
+		apply_data = link->req.apply_data;
+
+		for (i = 0; i < link->num_devs; i++) {
+			dev = &link->l_dev[i];
+			pd = dev->dev_info.p_delay;
+
+			if (pd >= CAM_PIPELINE_DELAY_MAX) {
+				rc = -EINVAL;
+				CAM_ERR(CAM_CRM, "link_hdl %x dev %s pd %d greater than max",
+					link->link_hdl, dev->dev_info.name, pd);
+				goto end;
+			}
+
+			idx = apply_data[pd].idx;
+			tbl_slot = &dev->pd_tbl->slot[idx];
+
+			if ((apply_data[pd].req_id != -1) &&
+				!(tbl_slot->req_apply_map & BIT(dev->dev_bit)) &&
+				(dev->is_active)) {
+				is_applied = false;
+				break;
+			}
+		}
+
+		if (is_applied) {
+			slot->status = CRM_SLOT_STATUS_REQ_APPLIED;
+
+			CAM_DBG(CAM_CRM, "req %d is applied on link %x success",
+				slot->req_id,
+				link->link_hdl);
+			idx = in_q->rd_idx;
+			reset_step = link->max_delay;
+
+			for (i = 0; i < link->num_sync_links; i++) {
+				if (link->sync_link[i]) {
+					if ((link->in_msync_mode) &&
+						(link->sync_link[i]->max_delay >
+							reset_step))
+						reset_step =
+						link->sync_link[i]->max_delay;
+				}
+			}
+
+			in_q->last_applied_idx = idx;
+
+			__cam_req_mgr_dec_idx(
+				&idx, reset_step + 1,
+				in_q->num_slots);
+			__cam_req_mgr_reset_req_slot(link, idx);
+		}
+		link->is_sending_req = false;
+	}
+
+	return rc;
+
+end:
+	mutex_unlock(&session->lock);
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_add_tbl_to_link()
+ *
+ * @brief    : Add table to list under link sorted by pd decremeting order
+ * @l_tbl    : list of pipeline delay tables.
+ * @new_tbl  : new tbl which will be appended to above list as per its pd value
+ *
+ */
+static void __cam_req_mgr_add_tbl_to_link(struct cam_req_mgr_req_tbl **l_tbl,
+	struct cam_req_mgr_req_tbl *new_tbl)
+{
+	struct cam_req_mgr_req_tbl *tbl;
+
+	if (!(*l_tbl) || (*l_tbl)->pd < new_tbl->pd) {
+		new_tbl->next = *l_tbl;
+		if (*l_tbl) {
+			new_tbl->pd_delta =
+				new_tbl->pd - (*l_tbl)->pd;
+		}
+		*l_tbl = new_tbl;
+	} else {
+		tbl = *l_tbl;
+
+		/* Reach existing  tbl which has less pd value */
+		while (tbl->next != NULL &&
+			new_tbl->pd < tbl->next->pd) {
+			tbl = tbl->next;
+		}
+		if (tbl->next != NULL) {
+			new_tbl->pd_delta =
+				new_tbl->pd - tbl->next->pd;
+		} else {
+			/* This is last table in linked list*/
+			new_tbl->pd_delta = 0;
+		}
+		new_tbl->next = tbl->next;
+		tbl->next = new_tbl;
+		tbl->pd_delta = tbl->pd - new_tbl->pd;
+	}
+	CAM_DBG(CAM_CRM, "added pd %d tbl to link delta %d", new_tbl->pd,
+		new_tbl->pd_delta);
+}
+
+/**
+ * __cam_req_mgr_create_pd_tbl()
+ *
+ * @brief    : Creates new request table for new delay value
+ * @delay    : New pd table allocated will have this delay value
+ *
+ * @return   : pointer to newly allocated table, NULL for failure
+ *
+ */
+static struct cam_req_mgr_req_tbl *__cam_req_mgr_create_pd_tbl(int32_t delay)
+{
+	int i = 0;
+
+	struct cam_req_mgr_req_tbl *tbl =
+		kzalloc(sizeof(struct cam_req_mgr_req_tbl), GFP_KERNEL);
+	if (tbl != NULL) {
+		tbl->num_slots = MAX_REQ_SLOTS;
+		CAM_DBG(CAM_CRM, "pd= %d slots= %d", delay, tbl->num_slots);
+		for (i = 0; i < MAX_REQ_SLOTS; i++) {
+			tbl->slot[i].ops.apply_at_eof = false;
+		}
+	}
+
+	return tbl;
+}
+
+/**
+ * __cam_req_mgr_destroy_all_tbl()
+ *
+ * @brief   : This func will destroy all pipeline delay based req table structs
+ * @l_tbl    : pointer to first table in list and it has max pd .
+ *
+ */
+static void __cam_req_mgr_destroy_all_tbl(struct cam_req_mgr_req_tbl **l_tbl)
+{
+	struct cam_req_mgr_req_tbl  *tbl = *l_tbl, *temp;
+
+	CAM_DBG(CAM_CRM, "*l_tbl %pK", tbl);
+	while (tbl != NULL) {
+		temp = tbl->next;
+		kfree(tbl);
+		tbl = temp;
+	}
+	*l_tbl = NULL;
+}
+
+/**
+ * __cam_req_mgr_setup_in_q()
+ *
+ * @brief : Initialize req table data
+ * @req   : request data pointer
+ *
+ * @return: 0 for success, negative for failure
+ *
+ */
+static int  __cam_req_mgr_setup_in_q(struct cam_req_mgr_req_data *req)
+{
+	int                           i;
+	struct cam_req_mgr_req_queue *in_q = req->in_q;
+
+	if (!in_q) {
+		CAM_ERR(CAM_CRM, "NULL in_q");
+		return -EINVAL;
+	}
+
+	mutex_lock(&req->lock);
+	in_q->num_slots = MAX_REQ_SLOTS;
+
+	for (i = 0; i < in_q->num_slots; i++) {
+		in_q->slot[i].idx = i;
+		in_q->slot[i].req_id = -1;
+		in_q->slot[i].skip_idx = 0;
+		in_q->slot[i].status = CRM_SLOT_STATUS_NO_REQ;
+	}
+
+	in_q->wr_idx = 0;
+	in_q->rd_idx = 0;
+	mutex_unlock(&req->lock);
+
+	return 0;
+}
+
+/**
+ * __cam_req_mgr_reset_req_tbl()
+ *
+ * @brief : Initialize req table data
+ * @req   : request queue pointer
+ *
+ * @return: 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_reset_in_q(struct cam_req_mgr_req_data *req)
+{
+	struct cam_req_mgr_req_queue *in_q = req->in_q;
+
+	if (!in_q) {
+		CAM_ERR(CAM_CRM, "NULL in_q");
+		return -EINVAL;
+	}
+
+	mutex_lock(&req->lock);
+	memset(in_q->slot, 0,
+		sizeof(struct cam_req_mgr_slot) * in_q->num_slots);
+	in_q->num_slots = 0;
+
+	in_q->wr_idx = 0;
+	in_q->rd_idx = 0;
+	mutex_unlock(&req->lock);
+
+	return 0;
+}
+
+/**
+ * __cam_req_mgr_process_sof_freeze()
+ *
+ * @brief : Apoptosis - Handles case when connected devices are not responding
+ * @priv  : link information
+ * @data  : task data
+ *
+ */
+static int __cam_req_mgr_process_sof_freeze(void *priv, void *data)
+{
+	struct cam_req_mgr_core_link    *link = NULL;
+	struct cam_req_mgr_req_queue    *in_q = NULL;
+	struct cam_req_mgr_core_session *session = NULL;
+	struct cam_req_mgr_message       msg = {0};
+	int rc = 0;
+	int64_t last_applied_req_id = -EINVAL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	session = (struct cam_req_mgr_core_session *)link->parent;
+	if (!session) {
+		CAM_WARN(CAM_CRM, "session ptr NULL %x", link->link_hdl);
+		return -EINVAL;
+	}
+
+	in_q = link->req.in_q;
+	if (in_q) {
+		mutex_lock(&link->req.lock);
+		if (in_q->last_applied_idx >= 0)
+			last_applied_req_id =
+				in_q->slot[in_q->last_applied_idx].req_id;
+		mutex_unlock(&link->req.lock);
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if ((link->watchdog) && (link->watchdog->pause_timer)) {
+		CAM_INFO(CAM_CRM,
+			"link:%x watchdog paused, maybe stream on/off is delayed",
+			link->link_hdl);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		return rc;
+	}
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	CAM_ERR(CAM_CRM,
+		"SOF freeze for session: %d link: 0x%x max_pd: %d last_req_id:%d",
+		session->session_hdl, link->link_hdl, link->max_delay,
+		last_applied_req_id);
+
+	__cam_req_mgr_send_evt(0, CAM_REQ_MGR_LINK_EVT_SOF_FREEZE,
+		CRM_KMD_ERR_FATAL, link);
+	memset(&msg, 0, sizeof(msg));
+
+	msg.session_hdl = session->session_hdl;
+	msg.u.err_msg.error_type = CAM_REQ_MGR_ERROR_TYPE_SOF_FREEZE;
+	msg.u.err_msg.request_id = 0;
+	msg.u.err_msg.link_hdl   = link->link_hdl;
+	msg.u.err_msg.error_code = CAM_REQ_MGR_ISP_UNREPORTED_ERROR;
+	msg.u.err_msg.resource_size = 0;
+
+	rc = cam_req_mgr_notify_message(&msg,
+		V4L_EVENT_CAM_REQ_MGR_ERROR, V4L_EVENT_CAM_REQ_MGR_EVENT);
+
+	if (rc)
+		CAM_ERR(CAM_CRM,
+			"Error notifying SOF freeze for session %d link 0x%x rc %d",
+			session->session_hdl, link->link_hdl, rc);
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_sof_freeze()
+ *
+ * @brief : Callback function for timer timeout indicating SOF freeze
+ * @data  : timer pointer
+ *
+ */
+static void __cam_req_mgr_sof_freeze(struct timer_list *timer_data)
+{
+	struct cam_req_mgr_timer     *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+	struct crm_workq_task               *task = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct crm_task_payload             *task_data;
+
+	if (!timer) {
+		CAM_ERR(CAM_CRM, "NULL timer");
+		return;
+	}
+
+	link = (struct cam_req_mgr_core_link *)timer->parent;
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR(CAM_CRM, "No empty task");
+		return;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_NOTIFY_FREEZE;
+	task->process_cb = &__cam_req_mgr_process_sof_freeze;
+	cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+}
+
+/**
+ * __cam_req_mgr_create_subdevs()
+ *
+ * @brief   : Create new crm  subdev to link with realtime devices
+ * @l_dev   : list of subdevs internal to crm
+ * @num_dev : num of subdevs to be created for link
+ *
+ * @return  : pointer to allocated list of devices
+ */
+static int __cam_req_mgr_create_subdevs(
+	struct cam_req_mgr_connected_device **l_dev, int32_t num_dev)
+{
+	int rc = 0;
+	*l_dev = kzalloc(sizeof(struct cam_req_mgr_connected_device) *
+		num_dev, GFP_KERNEL);
+	if (!*l_dev)
+		rc = -ENOMEM;
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_destroy_subdev()
+ *
+ * @brief    : Cleans up the subdevs allocated by crm for link
+ * @l_device : pointer to list of subdevs crm created
+ *
+ */
+static void __cam_req_mgr_destroy_subdev(
+	struct cam_req_mgr_connected_device **l_device)
+{
+	CAM_DBG(CAM_CRM, "*l_device %pK", *l_device);
+	if (*(l_device) != NULL) {
+		kfree(*(l_device));
+		*l_device = NULL;
+	}
+}
+
+/**
+ * __cam_req_mgr_disconnect_link()
+ *
+ * @brief    : Unlinks all devices on the link
+ * @link     : pointer to link
+ *
+ * @return   : returns if unlink for any device was success or failure
+ */
+static int __cam_req_mgr_disconnect_link(struct cam_req_mgr_core_link *link)
+{
+	int32_t                                 i = 0;
+	struct cam_req_mgr_connected_device    *dev;
+	struct cam_req_mgr_core_dev_link_setup  link_data;
+	int                                     rc = 0;
+
+	link_data.link_enable = 0;
+	link_data.link_hdl = link->link_hdl;
+	link_data.crm_cb = NULL;
+
+	/* Using device ops unlink devices */
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		link_data.dev_hdl = dev->dev_hdl;
+		if (dev->ops && dev->ops->link_setup) {
+			rc = dev->ops->link_setup(&link_data);
+			if (rc)
+				CAM_ERR(CAM_CRM,
+					"Unlink failed dev name %s hdl %x",
+					dev->dev_info.name,
+					dev->dev_hdl);
+		}
+		dev->dev_hdl = 0;
+		dev->parent = NULL;
+		dev->ops = NULL;
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_destroy_link_info()
+ *
+ * @brief    : Cleans up the mem allocated while linking
+ * @link     : pointer to link, mem associated with this link is freed
+ */
+static void __cam_req_mgr_destroy_link_info(struct cam_req_mgr_core_link *link)
+{
+	__cam_req_mgr_destroy_all_tbl(&link->req.l_tbl);
+	__cam_req_mgr_reset_in_q(&link->req);
+	link->req.num_tbl = 0;
+	mutex_destroy(&link->req.lock);
+
+	link->pd_mask = 0;
+	link->num_devs = 0;
+	link->max_delay = CAM_PIPELINE_DELAY_0;
+	link->min_delay = CAM_PIPELINE_DELAY_2;
+}
+
+/**
+ * __cam_req_mgr_reserve_link()
+ *
+ * @brief: Reserves one link data struct within session
+ * @session: session identifier
+ *
+ * @return: pointer to link reserved
+ *
+ */
+static struct cam_req_mgr_core_link *__cam_req_mgr_reserve_link(
+	struct cam_req_mgr_core_session *session)
+{
+	struct cam_req_mgr_core_link *link;
+	struct cam_req_mgr_req_queue *in_q;
+	int i;
+
+	if (!session || !g_crm_core_dev) {
+		CAM_ERR(CAM_CRM, "NULL session/core_dev ptr");
+		return NULL;
+	}
+
+	if (session->num_links >= MAXIMUM_LINKS_PER_SESSION) {
+		CAM_ERR(CAM_CRM, "Reached max links %d per session limit %d",
+			session->num_links, MAXIMUM_LINKS_PER_SESSION);
+		return NULL;
+	}
+	for (i = 0; i < MAXIMUM_LINKS_CAPACITY; i++) {
+		if (!atomic_cmpxchg(&g_links[i].is_used, 0, 1)) {
+			link = &g_links[i];
+			CAM_DBG(CAM_CRM, "alloc link index %d", i);
+			cam_req_mgr_core_link_reset(link);
+			break;
+		}
+	}
+	if (i == MAXIMUM_LINKS_CAPACITY)
+		return NULL;
+
+	in_q = kzalloc(sizeof(struct cam_req_mgr_req_queue),
+		GFP_KERNEL);
+	if (!in_q) {
+		CAM_ERR(CAM_CRM, "failed to create input queue, no mem");
+		return NULL;
+	}
+
+	mutex_lock(&link->lock);
+	link->num_devs = 0;
+	link->max_delay = CAM_PIPELINE_DELAY_0;
+	link->min_delay = CAM_PIPELINE_DELAY_2;
+	memset(in_q->slot, 0,
+		sizeof(struct cam_req_mgr_slot) * MAX_REQ_SLOTS);
+	link->req.in_q = in_q;
+	in_q->num_slots = 0;
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	link->state = CAM_CRM_LINK_STATE_IDLE;
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	link->parent = (void *)session;
+	link->is_sending_req = false;
+
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION - 1; i++)
+		link->sync_link[i] = NULL;
+
+	mutex_unlock(&link->lock);
+
+	mutex_lock(&session->lock);
+	/*  Loop through and find a free index */
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION; i++) {
+		if (!session->links[i]) {
+			CAM_DBG(CAM_CRM,
+				"Free link index %d found, num_links=%d",
+				i, session->num_links);
+			session->links[i] = link;
+			break;
+		}
+	}
+
+	if (i == MAXIMUM_LINKS_PER_SESSION) {
+		CAM_ERR(CAM_CRM, "Free link index not found");
+		goto error;
+	}
+
+	session->num_links++;
+	CAM_DBG(CAM_CRM, "Active session links (%d)",
+		session->num_links);
+	mutex_unlock(&session->lock);
+
+	return link;
+error:
+	mutex_unlock(&session->lock);
+	kfree(in_q);
+	return NULL;
+}
+
+/*
+ * __cam_req_mgr_free_link()
+ *
+ * @brief: Frees the link and its request queue
+ *
+ * @link: link identifier
+ *
+ */
+static void __cam_req_mgr_free_link(struct cam_req_mgr_core_link *link)
+{
+	ptrdiff_t i;
+	kfree(link->req.in_q);
+	link->parent = NULL;
+	i = link - g_links;
+	CAM_DBG(CAM_CRM, "free link index %d", i);
+	cam_req_mgr_core_link_reset(link);
+	atomic_set(&g_links[i].is_used, 0);
+}
+
+/**
+ * __cam_req_mgr_unreserve_link()
+ *
+ * @brief  : Removes the link data struct from the session and frees it
+ * @session: session identifier
+ * @link   : link identifier
+ *
+ */
+static void __cam_req_mgr_unreserve_link(
+	struct cam_req_mgr_core_session *session,
+	struct cam_req_mgr_core_link *link)
+{
+	int i, j;
+
+	if (!session || !link) {
+		CAM_ERR(CAM_CRM, "NULL session/link ptr %pK %pK",
+			session, link);
+		return;
+	}
+
+	mutex_lock(&session->lock);
+	if (!session->num_links) {
+		CAM_WARN(CAM_CRM, "No active link or invalid state: hdl %x",
+			link->link_hdl);
+		mutex_unlock(&session->lock);
+		return;
+	}
+
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION; i++) {
+		if (session->links[i] == link)
+			session->links[i] = NULL;
+		for (j = 0; j < MAXIMUM_LINKS_PER_SESSION - 1; j++) {
+			if (link->sync_link[j]) {
+				if (link->sync_link[j] == session->links[i])
+					session->links[i]->sync_link[j] = NULL;
+			}
+		}
+	}
+
+	for (j = 0; j < MAXIMUM_LINKS_PER_SESSION - 1; j++)
+		link->sync_link[j] = NULL;
+	session->num_links--;
+	CAM_DBG(CAM_CRM, "Active session links (%d)", session->num_links);
+	mutex_unlock(&session->lock);
+	__cam_req_mgr_free_link(link);
+}
+
+/* Workqueue context processing section */
+
+static int __cam_req_mgr_flush_dev_with_max_pd(struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_flush_info *flush_info, int max_pd)
+{
+	struct cam_req_mgr_connected_device *device;
+	struct cam_req_mgr_flush_request flush_req;
+	int i, rc = 0;
+
+	for (i = 0; i < link->num_devs; i++) {
+		device = &link->l_dev[i];
+		if (device->dev_info.p_delay > max_pd)
+			continue;
+
+		flush_req.link_hdl = flush_info->link_hdl;
+		flush_req.dev_hdl = device->dev_hdl;
+		flush_req.req_id = flush_info->req_id;
+		flush_req.type = flush_info->flush_type;
+
+		if (device->ops && device->ops->flush_req)
+			rc = device->ops->flush_req(&flush_req);
+	}
+
+	return rc;
+}
+
+static int __cam_req_mgr_get_dev_pd(struct cam_req_mgr_core_link *link,
+	enum cam_req_mgr_device_id dev_id)
+{
+	struct cam_req_mgr_connected_device *dev;
+	int i;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (dev->dev_info.dev_id == dev_id)
+			return dev->dev_info.p_delay;
+	}
+
+	return -ENODEV;
+}
+
+/**
+ * __cam_req_mgr_try_cancel_req()
+ *
+ * @brief      : Attempt to cancel a request. Requests that have not been
+ *               applied to IFE can be cancelled.
+ * @link       : Link on which to cancel
+ * @flush_info : Contains info about the request to be flushed
+ *
+ * @return: 0 on success.
+ */
+static int __cam_req_mgr_try_cancel_req(struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_flush_info *flush_info)
+{
+	struct cam_req_mgr_slot *slot = NULL;
+	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
+	int idx, pd = CAM_PIPELINE_DELAY_MAX;
+
+	idx = __cam_req_mgr_find_slot_for_req(in_q, flush_info->req_id);
+	if (idx < 0) {
+		CAM_ERR(CAM_CRM, "req_id %lld not found in input queue", flush_info->req_id);
+		return -ENOENT;
+	}
+
+	slot = &in_q->slot[idx];
+	if ((slot->req_id > 0) && slot->num_sync_links)
+		__cam_req_mgr_disconnect_req_on_sync_link(link, slot);
+
+	switch (slot->status) {
+	case CRM_SLOT_STATUS_REQ_PENDING:
+	case CRM_SLOT_STATUS_REQ_APPLIED:
+		pd = __cam_req_mgr_get_dev_pd(link, CAM_REQ_MGR_DEVICE_IFE);
+		if ((pd < 0) || (pd >= CAM_PIPELINE_DELAY_MAX)) {
+			CAM_ERR(CAM_CRM, "pd: %d link_hdl: 0x%x red_id: %d", pd,
+				link->link_hdl, flush_info->req_id);
+			return pd;
+		}
+
+		if (flush_info->req_id <= link->req.prev_apply_data[pd].req_id) {
+			CAM_WARN(CAM_CRM, "req %lld already applied to IFE on link 0x%x",
+				flush_info->req_id, flush_info->link_hdl);
+			return -EPERM;
+		}
+
+		/* find highest pd device that can be flushed */
+		while (pd + 1 <= link->max_delay) {
+			if (flush_info->req_id <= link->req.prev_apply_data[pd + 1].req_id)
+				break;
+			pd++;
+		}
+		fallthrough;
+	case CRM_SLOT_STATUS_REQ_READY:
+	case CRM_SLOT_STATUS_REQ_ADDED:
+		slot->additional_timeout = 0;
+		__cam_req_mgr_in_q_skip_idx(in_q, idx);
+		break;
+	default:
+		CAM_ERR(CAM_CRM, "invalid state for slot link:0x%x req:%lld",
+			flush_info->link_hdl, flush_info->req_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CRM, "cancelling request %lld on link 0x%x for devices with pd less than %d",
+		flush_info->req_id, flush_info->link_hdl, pd);
+	__cam_req_mgr_flush_dev_with_max_pd(link, flush_info, pd);
+	link->open_req_cnt--;
+	return 0;
+}
+
+/**
+ * cam_req_mgr_process_flush_req()
+ *
+ * @brief: This runs in workque thread context. Call core funcs to check
+ *         which requests need to be removed/cancelled.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+int cam_req_mgr_process_flush_req(void *priv, void *data)
+{
+	int                                  rc = 0;
+	struct cam_req_mgr_flush_info       *flush_info = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct crm_task_payload             *task_data = NULL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	flush_info  = (struct cam_req_mgr_flush_info *)&task_data->u;
+	CAM_DBG(CAM_REQ, "link_hdl %x req_id %lld type %d",
+		flush_info->link_hdl,
+		flush_info->req_id,
+		flush_info->flush_type);
+
+	trace_cam_flush_req(link, flush_info);
+
+	mutex_lock(&link->req.lock);
+	switch (flush_info->flush_type) {
+	case CAM_REQ_MGR_FLUSH_TYPE_ALL:
+		link->last_flush_id = flush_info->req_id;
+		CAM_INFO(CAM_CRM, "Last request id to flush is %lld on link 0x%x",
+			flush_info->req_id, link->link_hdl);
+		__cam_req_mgr_flush_req_slot(link);
+		__cam_req_mgr_reset_apply_data(link);
+		__cam_req_mgr_flush_dev_with_max_pd(link, flush_info, link->max_delay);
+		link->open_req_cnt = 0;
+		break;
+	case CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ:
+		link->last_flush_id = flush_info->req_id;
+		CAM_DBG(CAM_CRM, "Canceling req %lld on link 0x%x",
+			flush_info->req_id, link->link_hdl);
+		rc = __cam_req_mgr_try_cancel_req(link, flush_info);
+		if (rc)
+			CAM_WARN(CAM_CRM, "cannot cancel req_id %lld on link 0x%x",
+				flush_info->req_id, flush_info->link_hdl);
+		break;
+	default:
+		CAM_ERR(CAM_CRM, "Invalid flush type %u", flush_info->flush_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	complete(&link->workq_comp);
+	mutex_unlock(&link->req.lock);
+
+	return rc;
+}
+
+/**
+ * cam_req_mgr_process_sched_req()
+ *
+ * @brief: This runs in workque thread context. Call core funcs to check
+ *         which peding requests can be processed.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+int cam_req_mgr_process_sched_req(void *priv, void *data)
+{
+	int                                  rc = 0, i, sync_idx = 0;
+	struct cam_req_mgr_sched_request_v2 *sched_req = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_req_queue        *in_q = NULL;
+	struct cam_req_mgr_slot             *slot = NULL;
+	struct crm_task_payload             *task_data = NULL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	sched_req  = (struct cam_req_mgr_sched_request_v2 *)&task_data->u;
+	in_q = link->req.in_q;
+
+	CAM_DBG(CAM_CRM,
+		"link_hdl %x req_id %lld at slot %d sync_mode %d is_master %d exp_timeout_val %d ms",
+		sched_req->link_hdl, sched_req->req_id,
+		in_q->wr_idx, sched_req->sync_mode,
+		link->is_master,
+		sched_req->additional_timeout);
+
+	mutex_lock(&link->req.lock);
+	slot = &in_q->slot[in_q->wr_idx];
+
+	if (slot->status != CRM_SLOT_STATUS_NO_REQ &&
+		slot->status != CRM_SLOT_STATUS_REQ_APPLIED)
+		CAM_WARN(CAM_CRM, "in_q overwrite %d", slot->status);
+
+	slot->status = CRM_SLOT_STATUS_REQ_ADDED;
+	slot->req_id = sched_req->req_id;
+	slot->sync_mode = sched_req->sync_mode;
+	slot->skip_idx = 0;
+	slot->recover = sched_req->bubble_enable;
+
+	if (sched_req->additional_timeout < 0) {
+		CAM_WARN(CAM_CRM,
+			"Requested timeout is invalid [%dms]",
+			sched_req->additional_timeout);
+		slot->additional_timeout = 0;
+	} else if (sched_req->additional_timeout >
+		CAM_REQ_MGR_WATCHDOG_TIMEOUT_MAX) {
+		CAM_WARN(CAM_CRM,
+			"Requested timeout [%dms] max supported timeout [%dms] resetting to max",
+			sched_req->additional_timeout,
+			CAM_REQ_MGR_WATCHDOG_TIMEOUT_MAX);
+		slot->additional_timeout = CAM_REQ_MGR_WATCHDOG_TIMEOUT_MAX;
+	} else
+		slot->additional_timeout = sched_req->additional_timeout;
+
+	for (i = 0; i < sched_req->num_links; i++) {
+		if (link->link_hdl != sched_req->link_hdls[i]) {
+			slot->sync_link_hdls[sync_idx] = sched_req->link_hdls[i];
+			CAM_DBG(CAM_REQ, "link:0x%x req:%lld sync_link[%d]:0x%x",
+				link->link_hdl, slot->req_id, sync_idx,
+				slot->sync_link_hdls[sync_idx]);
+			sync_idx++;
+		}
+	}
+	slot->num_sync_links = sync_idx;
+
+	link->open_req_cnt++;
+	CAM_DBG(CAM_REQ, "Open_req_cnt: %u after scheduling req: %d",
+		link->open_req_cnt,
+		sched_req->req_id);
+	__cam_req_mgr_inc_idx(&in_q->wr_idx, 1, in_q->num_slots);
+
+	if (slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+		if (link->initial_sync_req == -1)
+			link->initial_sync_req = slot->req_id;
+	} else {
+		link->initial_sync_req = -1;
+		for (i = 0; i < link->num_sync_links; i++) {
+			if (link->sync_link[i])
+				link->sync_link[i]->initial_sync_req = -1;
+		}
+	}
+
+	mutex_unlock(&link->req.lock);
+
+end:
+	return rc;
+}
+
+/**
+ * cam_req_mgr_sync_info_for_sync_mode()
+ *
+ * @brief    : Keep links in sync by syncing the according req
+ *             table slot info on the sync link during sync mode.
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through.
+ * @add_req  : information about new request available at a device.
+ * @slot     : pointer to the current slot being processed.
+ * @type     : sync type
+ * @return   : 0 for success, negative for failure.
+ */
+int cam_req_mgr_sync_info_for_sync_mode(
+	struct cam_req_mgr_core_link   *link,
+	struct cam_req_mgr_add_request *add_req,
+	struct cam_req_mgr_tbl_slot    *slot,
+	uint32_t type)
+{
+	int                                  rc = 0, i = 0, j = 0;
+	int                                  idx;
+	int32_t                              sync_dev_hdl = -1;
+	char                                *dev_name = NULL;
+	struct cam_req_mgr_connected_device *device = NULL;
+	struct cam_req_mgr_req_tbl          *tbl = NULL;
+	struct cam_req_mgr_tbl_slot         *sync_slot = NULL;
+
+	for (i = 0; i < link->num_sync_links; i++) {
+		mutex_lock(&link->sync_link[i]->req.lock);
+		idx = __cam_req_mgr_find_slot_for_req(
+			link->sync_link[i]->req.in_q, add_req->req_id);
+		if (idx < 0) {
+			CAM_ERR(CAM_CRM,
+				"Req_id %lld not found in in_q for dev %s on link 0x%x",
+				add_req->req_id, link->l_dev[i].dev_info.name,
+				link->sync_link[i]->link_hdl);
+			rc = -EBADSLT;
+			mutex_unlock(&link->sync_link[i]->req.lock);
+			goto end;
+		}
+
+		dev_name = __cam_req_mgr_dev_handle_to_name(
+			add_req->dev_hdl, link);
+		sync_dev_hdl = __cam_req_mgr_name_to_dev_handle(
+			dev_name, link->sync_link[i]);
+
+		for (j = 0; j < link->sync_link[i]->num_devs; j++) {
+			device = &link->sync_link[i]->l_dev[j];
+			CAM_DBG(CAM_CRM,
+				"Req %lld device hdl %x : sync link dev hdl %x",
+				add_req->req_id, device->dev_hdl, sync_dev_hdl);
+			if (device->dev_hdl == sync_dev_hdl) {
+				tbl = device->pd_tbl;
+				break;
+			}
+		}
+
+		if (!tbl) {
+			CAM_ERR_RATE_LIMIT(CAM_CRM,
+				"Sync link dev hdl %x not found", sync_dev_hdl);
+			rc = -EINVAL;
+			mutex_unlock(&link->sync_link[i]->req.lock);
+			goto end;
+		}
+
+		sync_slot = &tbl->slot[idx];
+
+		switch (type) {
+		case CAM_SYNC_TYPE_DELAY_AT_SOF:
+			sync_slot->inject_delay_at_sof = slot->inject_delay_at_sof;
+			break;
+		case CAM_SYNC_TYPE_DELAY_AT_EOF:
+			sync_slot->inject_delay_at_eof = slot->inject_delay_at_eof;
+			break;
+		case CAM_SYNC_TYPE_APPLY_AT_EOF:
+			sync_slot->ops.apply_at_eof = slot->ops.apply_at_eof;
+			if (sync_slot->ops.num_dev == MAX_DEV_FOR_SPECIAL_OPS)
+				CAM_WARN(CAM_CRM,
+					"Sync link 0x%x slot:%d already has %d devices, can't add more",
+					link->sync_link[i]->link_hdl, idx, sync_slot->ops.num_dev);
+			else
+				sync_slot->ops.dev_hdl[sync_slot->ops.num_dev++] = sync_dev_hdl;
+			break;
+		default:
+			CAM_ERR(CAM_CRM, "Invalid Sync type:%u", type);
+			rc = -EINVAL;
+			break;
+		}
+		mutex_unlock(&link->sync_link[i]->req.lock);
+	}
+end:
+	return rc;
+}
+
+/**
+ * cam_req_mgr_process_add_req()
+ *
+ * @brief: This runs in workque thread context. Call core funcs to check
+ *         which peding requests can be processed.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+int cam_req_mgr_process_add_req(void *priv, void *data)
+{
+	int                                  rc = 0, i = 0;
+	int                                  idx;
+	struct cam_req_mgr_add_request      *add_req = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_connected_device *device = NULL;
+	struct cam_req_mgr_connected_device *dev_l = NULL;
+	struct cam_req_mgr_req_tbl          *tbl = NULL;
+	struct cam_req_mgr_tbl_slot         *slot = NULL;
+	struct crm_task_payload             *task_data = NULL;
+	struct cam_req_mgr_slot             *link_slot = NULL;
+	struct cam_req_mgr_state_monitor     state;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	add_req = (struct cam_req_mgr_add_request *)&task_data->u;
+
+	for (i = 0; i < link->num_devs; i++) {
+		device = &link->l_dev[i];
+		if (device->dev_hdl == add_req->dev_hdl) {
+			tbl = device->pd_tbl;
+			break;
+		}
+	}
+	if (!tbl) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "dev_hdl not found %x, %x %x",
+			add_req->dev_hdl,
+			link->l_dev[0].dev_hdl,
+			link->l_dev[1].dev_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+	/*
+	 * Go through request table and add
+	 * request id to proper table
+	 * 1. find req slot in in_q matching req_id.sent by dev
+	 * 2. goto table of this device based on p_delay
+	 * 3. mark req_ready_map with this dev_bit.
+	 */
+
+	mutex_lock(&link->req.lock);
+	idx = __cam_req_mgr_find_slot_for_req(link->req.in_q, add_req->req_id);
+	if (idx < 0) {
+		CAM_ERR(CAM_CRM,
+			"Req_id %lld not found in in_q for dev %s on link 0x%x",
+			add_req->req_id, device->dev_info.name, link->link_hdl);
+		rc = -EBADSLT;
+		mutex_unlock(&link->req.lock);
+		goto end;
+	}
+
+	link_slot = &link->req.in_q->slot[idx];
+	slot = &tbl->slot[idx];
+	slot->ops.skip_isp_apply = false;
+
+	if ((add_req->skip_at_sof & 0xFF) > slot->inject_delay_at_sof) {
+		slot->inject_delay_at_sof = (add_req->skip_at_sof & 0xFF);
+		CAM_DBG(CAM_CRM,
+			"Req_id %llu injecting delay %llu frame at SOF by %s",
+			add_req->req_id,
+			slot->inject_delay_at_sof,
+			device->dev_info.name);
+
+		if (link_slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+			rc = cam_req_mgr_sync_info_for_sync_mode(
+				link, add_req, slot, CAM_SYNC_TYPE_DELAY_AT_SOF);
+			if (rc < 0) {
+				CAM_ERR(CAM_CRM,
+					"Req_id %llu injecting delay %llu failed frame at SOF by %s for sync link",
+					add_req->req_id,
+					slot->inject_delay_at_sof,
+					device->dev_info.name);
+				mutex_unlock(&link->req.lock);
+				goto end;
+			} else {
+				CAM_DBG(CAM_CRM,
+					"Req_id %llu injecting delay %llu frame at SOF by %s for sync link",
+					add_req->req_id,
+					slot->inject_delay_at_sof,
+					device->dev_info.name);
+			}
+		}
+	}
+
+	if ((add_req->skip_at_eof & 0xFF) > slot->inject_delay_at_eof) {
+		slot->inject_delay_at_eof = (add_req->skip_at_eof & 0xFF);
+		CAM_DBG(CAM_CRM,
+			"Req_id %llu injecting delay %llu frame at EOF by %s",
+			add_req->req_id,
+			slot->inject_delay_at_eof,
+			device->dev_info.name);
+
+		if (link_slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+			rc = cam_req_mgr_sync_info_for_sync_mode(
+				link, add_req, slot, CAM_SYNC_TYPE_DELAY_AT_EOF);
+			if (rc < 0) {
+				CAM_ERR(CAM_CRM,
+					"Req_id %llu injecting delay %llu failed frame at EOF by %s for sync link",
+					add_req->req_id,
+					slot->inject_delay_at_eof,
+					device->dev_info.name);
+				mutex_unlock(&link->req.lock);
+				goto end;
+			} else {
+				CAM_DBG(CAM_CRM,
+					"Req_id %llu injecting delay %llu frame at EOF by %s for sync link",
+					add_req->req_id,
+					slot->inject_delay_at_eof,
+					device->dev_info.name);
+			}
+		}
+	}
+
+	if (add_req->trigger_eof) {
+		slot->ops.apply_at_eof = true;
+		if (slot->ops.num_dev == MAX_DEV_FOR_SPECIAL_OPS) {
+			CAM_ERR(CAM_REQ,
+				"Req_id %llu slot:%d already has %d devices, can't add more",
+				add_req->req_id, idx, slot->ops.num_dev);
+			mutex_unlock(&link->req.lock);
+			return -EINVAL;
+		}
+
+		slot->ops.dev_hdl[slot->ops.num_dev++] = add_req->dev_hdl;
+		CAM_DBG(CAM_REQ,
+			"Req_id %llu slot:%d added for EOF tigger for Device: %s",
+			add_req->req_id, idx, device->dev_info.name);
+
+		if (link_slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+			rc = cam_req_mgr_sync_info_for_sync_mode(
+				link, add_req, slot, CAM_SYNC_TYPE_APPLY_AT_EOF);
+			if (rc < 0) {
+				CAM_ERR(CAM_REQ,
+					"Req_id %llu slot:%d added failed for EOF tigger for Device: %s for sync link",
+					add_req->req_id, idx, device->dev_info.name);
+
+				mutex_unlock(&link->req.lock);
+				goto end;
+			} else {
+				CAM_DBG(CAM_REQ,
+					"Req_id %llu slot:%d added for EOF tigger for Device: %s for sync link",
+					add_req->req_id, idx, device->dev_info.name);
+
+			}
+		}
+	}
+
+	if (slot->state != CRM_REQ_STATE_PENDING &&
+		slot->state != CRM_REQ_STATE_EMPTY) {
+		CAM_WARN(CAM_CRM,
+			"Unexpected state %d for slot %d map %x for dev %s on link 0x%x",
+			slot->state, idx, slot->req_ready_map,
+			device->dev_info.name, link->link_hdl);
+	}
+
+	slot->state = CRM_REQ_STATE_PENDING;
+	slot->req_ready_map |= BIT(device->dev_bit);
+
+	CAM_DBG(CAM_CRM, "idx %d dev_hdl %x req_id %lld pd %d ready_map %x tbl mask %x",
+		idx, add_req->dev_hdl, add_req->req_id, tbl->pd,
+		slot->req_ready_map, tbl->dev_mask);
+
+	trace_cam_req_mgr_add_req(link, idx, add_req, tbl, device);
+
+	if (slot->req_ready_map == tbl->dev_mask) {
+		CAM_DBG(CAM_REQ,
+			"link 0x%x idx %d req_id %lld pd %d SLOT READY",
+			link->link_hdl, idx, add_req->req_id, tbl->pd);
+		slot->state = CRM_REQ_STATE_READY;
+
+		state.req_state = CAM_CRM_REQ_READY;
+		state.req_id = add_req->req_id;
+		state.dev_hdl = -1;
+		state.frame_id = -1;
+		__cam_req_mgr_update_state_monitor_array(link, &state);
+	}
+
+	if (!link->is_shdr && !device->dev_info.trigger_on) {
+		mutex_unlock(&link->req.lock);
+		return rc;
+	}
+
+	if (device->dev_info.trigger_on &&
+		add_req->num_exp == CAM_REQ_DUAL_TRIGGER_ONE_EXPOSURE) {
+		for (i = 0; i < link->num_devs; i++) {
+			dev_l = &link->l_dev[i];
+			if (dev_l->dev_info.trigger_on && dev_l->dev_hdl != add_req->dev_hdl) {
+				slot->ops.skip_isp_apply = true;
+				slot->req_ready_map |= (1 << dev_l->dev_bit);
+				if (slot->req_ready_map == tbl->dev_mask) {
+					slot->state = CRM_REQ_STATE_READY;
+					CAM_DBG(CAM_REQ,
+						"SHDR link %x idx %d req_id %lld pd %d SLOT READY",
+						link->link_hdl, idx, add_req->req_id, tbl->pd);
+				}
+				break;
+			}
+		}
+	}
+
+	if (device->dev_info.trigger_on &&
+		add_req->num_exp == CAM_REQ_DUAL_TRIGGER_TWO_EXPOSURE &&
+		!device->dev_info.is_shdr_master) {
+		tbl->dev_mask |= (1 << device->dev_bit);
+		if (slot->req_ready_map == tbl->dev_mask) {
+			slot->state = CRM_REQ_STATE_READY;
+			CAM_DBG(CAM_REQ,
+				"SHDR link 0x%x idx %d req_id %lld pd %d SLOT READY",
+				link->link_hdl, idx, add_req->req_id, tbl->pd);
+		}
+	}
+
+	mutex_unlock(&link->req.lock);
+end:
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_apply_on_bubble()
+ *
+ * @brief    : This API tries to apply settings to the device
+ *             with highest pd on the bubbled frame
+ * @link     : link information.
+ * @err_info : contains information about frame_id, trigger etc.
+ *
+ */
+void __cam_req_mgr_apply_on_bubble(
+	struct cam_req_mgr_core_link    *link,
+	struct cam_req_mgr_error_notify *err_info)
+{
+	int rc = 0;
+	struct cam_req_mgr_trigger_notify trigger_data;
+
+	trigger_data.dev_hdl = err_info->dev_hdl;
+	trigger_data.frame_id = err_info->frame_id;
+	trigger_data.link_hdl = err_info->link_hdl;
+	trigger_data.sof_timestamp_val =
+		err_info->sof_timestamp_val;
+	trigger_data.trigger = err_info->trigger;
+
+	rc = __cam_req_mgr_process_req(link, &trigger_data);
+	if (rc)
+		CAM_ERR(CAM_CRM,
+			"Failed to apply request on bubbled frame");
+}
+
+/**
+ * cam_req_mgr_process_error()
+ *
+ * @brief: This runs in workque thread context. bubble /err recovery.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+int cam_req_mgr_process_error(void *priv, void *data)
+{
+	int                                  rc = 0, idx = -1;
+	int                                  i, slot_diff;
+	struct cam_req_mgr_error_notify     *err_info = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_req_queue        *in_q = NULL;
+	struct cam_req_mgr_slot             *slot = NULL;
+	struct crm_task_payload             *task_data = NULL;
+	struct cam_req_mgr_state_monitor     state;
+	struct cam_req_mgr_req_tbl          *tbl;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	err_info  = (struct cam_req_mgr_error_notify *)&task_data->u;
+	CAM_DBG(CAM_CRM, "link_hdl %x req_id %lld error %d",
+		err_info->link_hdl,
+		err_info->req_id,
+		err_info->error);
+
+	in_q = link->req.in_q;
+	tbl = link->req.l_tbl;
+
+	state.req_state = CAM_CRM_PROCESS_ERR;
+	state.req_id = err_info->req_id;
+	state.dev_hdl = -1;
+	state.frame_id = -1;
+	__cam_req_mgr_update_state_monitor_array(link, &state);
+
+	mutex_lock(&link->req.lock);
+	switch (err_info->error) {
+	case CRM_KMD_ERR_BUBBLE:
+	case CRM_KMD_WARN_INTERNAL_RECOVERY:
+		idx = __cam_req_mgr_find_slot_for_req(in_q, err_info->req_id);
+		if (idx < 0) {
+			CAM_ERR_RATE_LIMIT(CAM_CRM,
+				"req_id %lld not found in input queue",
+				err_info->req_id);
+		} else {
+			CAM_DBG(CAM_CRM, "req_id %lld found at idx %d last_applied %d",
+				err_info->req_id, idx, in_q->last_applied_idx);
+			slot = &in_q->slot[idx];
+			if (!slot->recover) {
+				CAM_WARN(CAM_CRM,
+					"err recovery disabled req_id %lld",
+					err_info->req_id);
+				mutex_unlock(&link->req.lock);
+				return 0;
+			} else if (slot->status != CRM_SLOT_STATUS_REQ_PENDING
+			&& slot->status != CRM_SLOT_STATUS_REQ_APPLIED) {
+				CAM_WARN(CAM_CRM,
+					"req_id %lld can not be recovered %d",
+					err_info->req_id, slot->status);
+				mutex_unlock(&link->req.lock);
+				return -EINVAL;
+			}
+			/* Bring processing pointer to bubbled req id */
+			__cam_req_mgr_tbl_set_all_skip_cnt(&link->req.l_tbl);
+			in_q->rd_idx = idx;
+			/* Increment bubble counter only for bubble errors */
+			if (err_info->error == CRM_KMD_ERR_BUBBLE)
+				in_q->slot[idx].bubble_times++;
+			in_q->slot[idx].status = CRM_SLOT_STATUS_REQ_ADDED;
+
+			/* Reset request apply map for all pd tables */
+			while (tbl) {
+				tbl->slot[idx].req_apply_map = 0;
+				tbl = tbl->next;
+			}
+
+			if (link->sync_link[0]) {
+				in_q->slot[idx].sync_mode = 0;
+				__cam_req_mgr_inc_idx(&idx, 1,
+					link->req.l_tbl->num_slots);
+				in_q->slot[idx].sync_mode = 0;
+			}
+
+			/*
+			 * We need do internal recovery for back to back bubble, but if
+			 * the request had been internal recovered, we won't recover
+			 * it again.
+			 */
+			if ((in_q->slot[idx].bubble_times >= REQ_MAXIMUM_BUBBLE_TIMES) &&
+				!in_q->slot[idx].internal_recovered) {
+				link->try_for_internal_recovery = true;
+				/*
+				 * Notify all devices in the link about the error, need to pause
+				 * watch dog before internal recovery because the recover may
+				 * take a long time. if don't pause watch dog here, SOF freeze
+				 * may be triggered. After recovery, need to restart watch dog.
+				 */
+				crm_timer_reset(link->watchdog);
+				link->watchdog->pause_timer = true;
+				__cam_req_mgr_send_evt(err_info->req_id,
+					CAM_REQ_MGR_LINK_EVT_STALLED, CRM_KMD_ERR_FATAL, link);
+				crm_timer_reset(link->watchdog);
+				link->watchdog->pause_timer = false;
+				in_q->slot[idx].internal_recovered = true;
+				link->try_for_internal_recovery = false;
+			}
+
+			/*
+			 * Reset till last applied, even if there are scheduling delays
+			 * we start fresh from the request on which bubble has
+			 * been reported
+			 */
+			idx = in_q->rd_idx;
+			if (in_q->last_applied_idx >= 0) {
+				slot_diff = in_q->last_applied_idx - idx;
+				if (slot_diff < 0)
+					slot_diff += link->req.l_tbl->num_slots;
+			} else {
+				/* Next req at the minimum may be applied */
+				slot_diff = 1;
+			}
+
+			for (i = 0; i < slot_diff; i++) {
+				__cam_req_mgr_inc_idx(&idx, 1,
+					link->req.l_tbl->num_slots);
+
+				CAM_DBG(CAM_CRM,
+					"Recovery on idx: %d reset slot [idx: %d status: %d]",
+					in_q->rd_idx, idx, in_q->slot[idx].status);
+				if (in_q->slot[idx].status == CRM_SLOT_STATUS_REQ_APPLIED) {
+					in_q->slot[idx].status = CRM_SLOT_STATUS_REQ_ADDED;
+
+					tbl = link->req.l_tbl;
+					/* Reset request apply map for all pd tables */
+					while (tbl) {
+						tbl->slot[idx].req_apply_map = 0;
+						tbl = tbl->next;
+					}
+				}
+			}
+
+			spin_lock_bh(&link->link_state_spin_lock);
+			link->state = CAM_CRM_LINK_STATE_ERR;
+			spin_unlock_bh(&link->link_state_spin_lock);
+			link->open_req_cnt++;
+
+			/* Apply immediately to highest pd device on same frame */
+			__cam_req_mgr_apply_on_bubble(link, err_info);
+		}
+		break;
+	case CRM_KMD_ERR_FATAL:
+		rc = __cam_req_mgr_send_evt(err_info->req_id,
+			CAM_REQ_MGR_LINK_EVT_ERR, err_info->error, link);
+		break;
+	default:
+		break;
+	}
+	mutex_unlock(&link->req.lock);
+
+end:
+	return rc;
+}
+
+/**
+ * cam_req_mgr_process_stop()
+ *
+ * @brief: This runs in workque thread context. stop notification.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+int cam_req_mgr_process_stop(void *priv, void *data)
+{
+	int                                  rc = 0;
+	struct cam_req_mgr_core_link        *link = NULL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	__cam_req_mgr_flush_req_slot(link);
+end:
+	return rc;
+}
+
+/**
+ * cam_req_mgr_notify_eof_event()
+ *
+ * @brief  : This runs in workqueue thread context. Call core funcs to
+ *           notify eof event to sub devices.
+ * @link   : link info
+ *
+ */
+static void cam_req_mgr_notify_eof_event(struct cam_req_mgr_core_link *link)
+{
+	int                                  i;
+	struct cam_req_mgr_connected_device *dev = NULL;
+	struct cam_req_mgr_link_evt_data     evt_data;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		evt_data.dev_hdl = dev->dev_hdl;
+		evt_data.evt_type = CAM_REQ_MGR_LINK_EVT_EOF;
+		evt_data.link_hdl = link->link_hdl;
+
+		if (dev->ops && dev->ops->process_evt)
+			dev->ops->process_evt(&evt_data);
+	}
+
+	CAM_DBG(CAM_CRM, "Notify EOF event done on link:0x%x",
+		link->link_hdl);
+}
+
+/**
+ * cam_req_mgr_process_trigger()
+ *
+ * @brief: This runs in workque thread context. Call core funcs to check
+ *         which peding requests can be processed.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+static int cam_req_mgr_process_trigger(void *priv, void *data)
+{
+	int                                  rc = 0;
+	int32_t                              idx = -1;
+	struct cam_req_mgr_trigger_notify   *trigger_data = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_req_queue        *in_q = NULL;
+	struct crm_task_payload             *task_data = NULL;
+	int                                  reset_step = 0;
+	int                                  i = 0;
+	struct cam_req_mgr_state_monitor     state;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	trigger_data = (struct cam_req_mgr_trigger_notify *)&task_data->u;
+
+	CAM_DBG(CAM_REQ, "link_hdl %x frame_id %lld, trigger %x\n",
+		trigger_data->link_hdl,
+		trigger_data->frame_id,
+		trigger_data->trigger);
+
+	in_q = link->req.in_q;
+
+	state.req_state = CAM_CRM_PROCESS_TRIGGER;
+	state.req_id = in_q->slot[in_q->rd_idx].req_id;
+	state.dev_hdl = -1;
+	state.frame_id = trigger_data->frame_id;
+	__cam_req_mgr_update_state_monitor_array(link, &state);
+
+	mutex_lock(&link->req.lock);
+
+	if (trigger_data->trigger == CAM_TRIGGER_POINT_SOF) {
+		idx = __cam_req_mgr_find_slot_for_req(in_q,
+			trigger_data->req_id);
+		if (idx >= 0) {
+			if (idx == in_q->last_applied_idx)
+				in_q->last_applied_idx = -1;
+			if (idx == in_q->rd_idx)
+				__cam_req_mgr_dec_idx(&idx, 1, in_q->num_slots);
+
+			reset_step = link->max_delay;
+			for (i = 0; i < link->num_sync_links; i++) {
+				if (link->sync_link[i]) {
+					if ((link->in_msync_mode) &&
+						(link->sync_link[i]->max_delay >
+							reset_step))
+						reset_step =
+						link->sync_link[i]->max_delay;
+				}
+			}
+
+			__cam_req_mgr_dec_idx(
+				&idx, reset_step + 1,
+				in_q->num_slots);
+
+			__cam_req_mgr_reset_req_slot(link, idx);
+		}
+	} else if (trigger_data->trigger == CAM_TRIGGER_POINT_EOF) {
+		if (link->properties_mask & CAM_LINK_PROPERTY_SENSOR_STANDBY_AFTER_EOF)
+			cam_req_mgr_notify_eof_event(link);
+	}
+
+	/*
+	 * Check if current read index is in applied state, if yes make it free
+	 *    and increment read index to next slot.
+	 */
+	CAM_DBG(CAM_CRM, "link_hdl %x curent idx %d req_status %d",
+		link->link_hdl, in_q->rd_idx, in_q->slot[in_q->rd_idx].status);
+
+	spin_lock_bh(&link->link_state_spin_lock);
+
+	if (link->state < CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN(CAM_CRM, "invalid link state:%d for link 0x%x",
+			link->state, link->link_hdl);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto release_lock;
+	}
+
+	if (link->state == CAM_CRM_LINK_STATE_ERR)
+		CAM_WARN_RATE_LIMIT(CAM_CRM, "Error recovery idx %d status %d",
+			in_q->rd_idx,
+			in_q->slot[in_q->rd_idx].status);
+
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	/*
+	 * Move to next req at SOF only in case
+	 * the rd_idx is updated at EOF.
+	 */
+	if ((trigger_data->trigger == CAM_TRIGGER_POINT_SOF) &&
+		(in_q->slot[in_q->rd_idx].status == CRM_SLOT_STATUS_REQ_APPLIED)) {
+		/*
+		 * Do NOT reset req q slot data here, it can not be done
+		 * here because we need to preserve the data to handle bubble.
+		 *
+		 * Check if any new req is pending in slot, if not finish the
+		 * lower pipeline delay device with available req ids.
+		 */
+		CAM_DBG(CAM_CRM, "link[%x] Req[%lld] invalidating slot",
+			link->link_hdl, in_q->slot[in_q->rd_idx].req_id);
+		rc = __cam_req_mgr_move_to_next_req_slot(link);
+		if (rc) {
+			CAM_DBG(CAM_REQ,
+				"No pending req to apply to lower pd devices");
+			rc = 0;
+			__cam_req_mgr_notify_frame_skip(link, trigger_data->trigger);
+			goto release_lock;
+		}
+	}
+
+	rc = __cam_req_mgr_process_req(link, trigger_data);
+
+release_lock:
+	mutex_unlock(&link->req.lock);
+end:
+	return rc;
+}
+
+/* Linked devices' Callback section */
+
+/**
+ * cam_req_mgr_cb_add_req()
+ *
+ * @brief    : Drivers call this function to notify new packet is available.
+ * @add_req  : Information about new request available at a device.
+ *
+ * @return   : 0 on success, negative in case of failure
+ *
+ */
+static int cam_req_mgr_cb_add_req(struct cam_req_mgr_add_request *add_req)
+{
+	int                             rc = 0, i = 0, idx;
+	struct crm_workq_task          *task = NULL;
+	struct cam_req_mgr_core_link   *link = NULL;
+	struct cam_req_mgr_add_request *dev_req;
+	struct crm_task_payload        *task_data;
+
+	if (!add_req) {
+		CAM_ERR(CAM_CRM, "sof_data is NULL");
+		return -EINVAL;
+	}
+
+	link = cam_get_link_priv(add_req->link_hdl);
+	if (!link) {
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", add_req->link_hdl);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_REQ,
+		"dev name %s dev_hdl %d dev req %lld, trigger_eof %d link_state %d",
+		__cam_req_mgr_dev_handle_to_name(add_req->dev_hdl, link),
+		add_req->dev_hdl, add_req->req_id, add_req->trigger_eof,
+		link->state);
+
+	mutex_lock(&link->lock);
+	/* Validate if req id is present in input queue */
+	idx = __cam_req_mgr_find_slot_for_req(link->req.in_q, add_req->req_id);
+	if (idx < 0) {
+		if (((uint32_t)add_req->req_id) <= (link->last_flush_id)) {
+			CAM_INFO(CAM_CRM,
+				"req %lld not found in in_q; it has been flushed [last_flush_req %lld] link 0x%x",
+				add_req->req_id, link->last_flush_id, link->link_hdl);
+			rc = -EBADR;
+		} else {
+			CAM_ERR(CAM_CRM,
+				"req %lld not found in in_q on link 0x%x [last_flush_req %lld]",
+				add_req->req_id, link->link_hdl, link->last_flush_id);
+			rc = -ENOENT;
+		}
+		goto end;
+	}
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "no empty task dev %x req %lld",
+			add_req->dev_hdl, add_req->req_id);
+		rc = -EBUSY;
+		goto end;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_DEV_ADD_REQ;
+	dev_req = (struct cam_req_mgr_add_request *)&task_data->u;
+	dev_req->req_id = add_req->req_id;
+	dev_req->link_hdl = add_req->link_hdl;
+	dev_req->dev_hdl = add_req->dev_hdl;
+	dev_req->trigger_eof = add_req->trigger_eof;
+	dev_req->skip_at_sof = add_req->skip_at_sof;
+	dev_req->skip_at_eof = add_req->skip_at_eof;
+	dev_req->num_exp = add_req->num_exp;
+
+	if (dev_req->trigger_eof) {
+		atomic_inc(&link->eof_event_cnt);
+		CAM_DBG(CAM_REQ, "Req_id: %llu, eof_event_cnt: %d",
+			dev_req->req_id, link->eof_event_cnt);
+		for (i = 0; i < link->num_sync_links; i++) {
+			mutex_lock(&link->sync_link[i]->req.lock);
+			atomic_set(&link->sync_link[i]->eof_event_cnt, link->eof_event_cnt.counter);
+			CAM_DBG(CAM_REQ,
+				"Sync link idx: %d, sync link_hdl: 0x%x, eof_event_cnt: %d",
+				i, link->sync_link[i]->link_hdl,
+				link->sync_link[i]->eof_event_cnt);
+			mutex_unlock(&link->sync_link[i]->req.lock);
+		}
+	}
+
+	task->process_cb = &cam_req_mgr_process_add_req;
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+	CAM_DBG(CAM_CRM, "X: dev %x dev req %lld",
+		add_req->dev_hdl, add_req->req_id);
+
+end:
+	mutex_unlock(&link->lock);
+	return rc;
+}
+
+/**
+ * cam_req_mgr_cb_notify_err()
+ *
+ * @brief    : Error received from device, sends bubble recovery
+ * @err_info : contains information about error occurred like bubble/overflow
+ *
+ * @return   : 0 on success, negative in case of failure
+ *
+ */
+static int cam_req_mgr_cb_notify_err(
+	struct cam_req_mgr_error_notify *err_info)
+{
+	int                              rc = 0;
+	struct crm_workq_task           *task = NULL;
+	struct cam_req_mgr_core_link    *link = NULL;
+	struct cam_req_mgr_error_notify *notify_err;
+	struct crm_task_payload         *task_data;
+	struct cam_req_mgr_state_monitor state;
+
+	if (!err_info) {
+		CAM_ERR(CAM_CRM, "err_info is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = cam_get_link_priv(err_info->link_hdl);
+	if (!link) {
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", err_info->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	state.req_state = CAM_CRM_NOTIFY_ERR;
+	state.req_id = err_info->req_id;
+	state.dev_hdl = -1;
+	state.frame_id = err_info->frame_id;
+	__cam_req_mgr_update_state_monitor_array(link, &state);
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state != CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN(CAM_CRM, "invalid link state:%d", link->state);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto end;
+	}
+	crm_timer_reset(link->watchdog);
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR(CAM_CRM, "no empty task req_id %lld", err_info->req_id);
+		rc = -EBUSY;
+		goto end;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_NOTIFY_ERR;
+	notify_err = (struct cam_req_mgr_error_notify *)&task_data->u;
+	notify_err->req_id = err_info->req_id;
+	notify_err->link_hdl = err_info->link_hdl;
+	notify_err->dev_hdl = err_info->dev_hdl;
+	notify_err->error = err_info->error;
+	notify_err->trigger = err_info->trigger;
+	task->process_cb = &cam_req_mgr_process_error;
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+
+end:
+	return rc;
+}
+
+static int __cam_req_mgr_check_for_dual_trigger(
+	struct cam_req_mgr_core_link    *link,
+	uint32_t                         trigger)
+{
+	int rc  = -EAGAIN;
+
+	CAM_DBG(CAM_CRM, "%s trigger_cnt [%u: %u]",
+		(trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF",
+		link->trigger_cnt[0][trigger], link->trigger_cnt[1][trigger]);
+
+	if (link->trigger_cnt[0][trigger] == link->trigger_cnt[1][trigger]) {
+		link->trigger_cnt[0][trigger] = 0;
+		link->trigger_cnt[1][trigger] = 0;
+		rc = 0;
+		return rc;
+	}
+
+	if ((link->trigger_cnt[0][trigger] &&
+		(link->trigger_cnt[0][trigger] - link->trigger_cnt[1][trigger] > 1)) ||
+		(link->trigger_cnt[1][trigger] &&
+		(link->trigger_cnt[1][trigger] - link->trigger_cnt[0][trigger] > 1))) {
+
+		CAM_WARN(CAM_CRM,
+			"One of the devices could not generate trigger");
+
+		link->trigger_cnt[0][trigger] = 0;
+		link->trigger_cnt[1][trigger] = 0;
+		CAM_DBG(CAM_CRM, "Reset the trigger cnt");
+		return rc;
+	}
+
+	CAM_DBG(CAM_CRM, "Only one device has generated trigger for %s",
+		(trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF");
+
+	return rc;
+}
+
+/**
+ * cam_req_mgr_cb_notify_timer()
+ *
+ * @brief      : Notify SOF timer to pause after flush
+ * @timer_data : contains information about frame_id, link etc.
+ *
+ * @return  : 0 on success
+ *
+ */
+static int cam_req_mgr_cb_notify_timer(
+	struct cam_req_mgr_timer_notify *timer_data)
+{
+	int                              rc = 0;
+	struct cam_req_mgr_core_link    *link = NULL;
+
+	if (!timer_data) {
+		CAM_ERR(CAM_CRM, "timer data  is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = cam_get_link_priv(timer_data->link_hdl);
+	if (!link) {
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", timer_data->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state < CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN(CAM_CRM, "invalid link state:%d", link->state);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto end;
+	}
+	if (link->watchdog) {
+		if (!timer_data->state)
+			link->watchdog->pause_timer = true;
+		else
+			link->watchdog->pause_timer = false;
+		crm_timer_reset(link->watchdog);
+		CAM_DBG(CAM_CRM, "link %x pause_timer %d",
+			link->link_hdl, link->watchdog->pause_timer);
+	}
+
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+end:
+	return rc;
+}
+
+/*
+ * cam_req_mgr_cb_notify_stop()
+ *
+ * @brief    : Stop received from device, resets the morked slots
+ * @err_info : contains information about error occurred like bubble/overflow
+ *
+ * @return   : 0 on success, negative in case of failure
+ *
+ */
+static int cam_req_mgr_cb_notify_stop(
+	struct cam_req_mgr_notify_stop *stop_info)
+{
+	int                              rc = 0;
+	struct crm_workq_task           *task = NULL;
+	struct cam_req_mgr_core_link    *link = NULL;
+	struct cam_req_mgr_notify_stop  *notify_stop;
+	struct crm_task_payload         *task_data;
+
+	if (!stop_info) {
+		CAM_ERR(CAM_CRM, "stop_info is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = cam_get_link_priv(stop_info->link_hdl);
+	if (!link) {
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", stop_info->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state != CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN(CAM_CRM, "invalid link state:%d", link->state);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto end;
+	}
+	crm_timer_reset(link->watchdog);
+	link->watchdog->pause_timer = true;
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR(CAM_CRM, "no empty task");
+		rc = -EBUSY;
+		goto end;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_NOTIFY_ERR;
+	notify_stop = (struct cam_req_mgr_notify_stop *)&task_data->u;
+	notify_stop->link_hdl = stop_info->link_hdl;
+	task->process_cb = &cam_req_mgr_process_stop;
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+
+end:
+	return rc;
+}
+
+/**
+ * cam_req_mgr_cb_notify_trigger()
+ *
+ * @brief   : SOF received from device, sends trigger through workqueue
+ * @sof_data: contains information about frame_id, link etc.
+ *
+ * @return  : 0 on success
+ *
+ */
+static int cam_req_mgr_cb_notify_trigger(
+	struct cam_req_mgr_trigger_notify *trigger_data)
+{
+	int32_t                          rc = 0, trigger_id = 0;
+	uint32_t                         trigger;
+	struct crm_workq_task           *task = NULL;
+	struct cam_req_mgr_core_link    *link = NULL;
+	struct cam_req_mgr_trigger_notify   *notify_trigger;
+	struct crm_task_payload         *task_data;
+	struct cam_req_mgr_state_monitor state;
+	struct cam_req_mgr_req_queue    *in_q = NULL;
+
+	if (!trigger_data) {
+		CAM_ERR(CAM_CRM, "trigger_data is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = cam_get_link_priv(trigger_data->link_hdl);
+	if (!link) {
+		CAM_WARN_RATE_LIMIT(CAM_CRM, "link ptr NULL %x", trigger_data->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_REQ, "link_hdl %x frame_id %lld, trigger %x\n",
+		trigger_data->link_hdl,
+		trigger_data->frame_id,
+		trigger_data->trigger);
+
+	trigger_id = trigger_data->trigger_id;
+	trigger = trigger_data->trigger;
+
+	spin_lock_bh(&link->req.reset_link_spin_lock);
+	in_q = link->req.in_q;
+	if (!in_q) {
+		CAM_DBG(CAM_CRM, "in_q ptr NULL, link_hdl %x", trigger_data->link_hdl);
+		spin_unlock_bh(&link->req.reset_link_spin_lock);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	state.req_state = CAM_CRM_NOTIFY_TRIGGER;
+	state.req_id = in_q->slot[in_q->rd_idx].req_id;
+	state.dev_hdl = -1;
+	state.frame_id = trigger_data->frame_id;
+	__cam_req_mgr_update_state_monitor_array(link, &state);
+	spin_unlock_bh(&link->req.reset_link_spin_lock);
+
+	/*
+	 * Reduce the workq overhead when there is
+	 * not any eof event found.
+	 */
+	if (trigger == CAM_TRIGGER_POINT_EOF) {
+		if (!atomic_read(&link->eof_event_cnt) &&
+			!(link->properties_mask & CAM_LINK_PROPERTY_SENSOR_STANDBY_AFTER_EOF)) {
+			CAM_DBG(CAM_CRM, "No any request to schedule at EOF");
+			goto end;
+		}
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state < CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN_RATE_LIMIT(CAM_CRM, "invalid link state:%d", link->state);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto end;
+	}
+
+	if ((link->watchdog) && (link->watchdog->pause_timer) &&
+		(trigger == CAM_TRIGGER_POINT_SOF))
+		link->watchdog->pause_timer = false;
+
+	if (link->dual_trigger && link->wait_for_dual_trigger) {
+		if ((trigger_id >= 0) && (trigger_id <
+			CAM_REQ_MGR_MAX_TRIGGERS)) {
+			link->trigger_cnt[trigger_id][trigger]++;
+			rc = __cam_req_mgr_check_for_dual_trigger(link, trigger);
+			if (rc) {
+				spin_unlock_bh(&link->link_state_spin_lock);
+				goto end;
+			}
+		} else {
+			CAM_ERR(CAM_CRM, "trigger_id invalid %d", trigger_id);
+			rc = -EINVAL;
+			spin_unlock_bh(&link->link_state_spin_lock);
+			goto end;
+		}
+	}
+
+	if (trigger_data->trigger == CAM_TRIGGER_POINT_SOF)
+		crm_timer_reset(link->watchdog);
+
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "no empty task frame %lld",
+			trigger_data->frame_id);
+		rc = -EBUSY;
+		spin_lock_bh(&link->link_state_spin_lock);
+		if ((link->watchdog) && !(link->watchdog->pause_timer))
+			link->watchdog->pause_timer = true;
+		spin_unlock_bh(&link->link_state_spin_lock);
+		goto end;
+	}
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = (trigger_data->trigger == CAM_TRIGGER_POINT_SOF) ?
+		CRM_WORKQ_TASK_NOTIFY_SOF : CRM_WORKQ_TASK_NOTIFY_EOF;
+	notify_trigger = (struct cam_req_mgr_trigger_notify *)&task_data->u;
+	notify_trigger->frame_id = trigger_data->frame_id;
+	notify_trigger->link_hdl = trigger_data->link_hdl;
+	notify_trigger->dev_hdl = trigger_data->dev_hdl;
+	notify_trigger->trigger = trigger_data->trigger;
+	notify_trigger->req_id = trigger_data->req_id;
+	notify_trigger->sof_timestamp_val = trigger_data->sof_timestamp_val;
+	task->process_cb = &cam_req_mgr_process_trigger;
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+
+end:
+	return rc;
+}
+
+static struct cam_req_mgr_crm_cb cam_req_mgr_ops = {
+	.notify_trigger = cam_req_mgr_cb_notify_trigger,
+	.notify_err     = cam_req_mgr_cb_notify_err,
+	.add_req        = cam_req_mgr_cb_add_req,
+	.notify_timer   = cam_req_mgr_cb_notify_timer,
+	.notify_stop    = cam_req_mgr_cb_notify_stop,
+};
+
+/**
+ * __cam_req_mgr_setup_link_info()
+ *
+ * @brief     : Sets up input queue, create pd based tables, communicate with
+ *              devs connected on this link and setup communication.
+ * @link      : pointer to link to setup
+ * @link_info : link_info coming from CSL to prepare link
+ *
+ * @return    : 0 on success, negative in case of failure
+ *
+ */
+static int __cam_req_mgr_setup_link_info(struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_ver_info *link_info)
+{
+	int                                     rc = 0, i = 0, num_devices = 0;
+	struct cam_req_mgr_core_dev_link_setup  link_data;
+	struct cam_req_mgr_connected_device    *dev;
+	struct cam_req_mgr_req_tbl             *pd_tbl;
+	enum cam_pipeline_delay                 max_delay;
+	enum cam_modeswitch_delay               max_modeswitch;
+	uint32_t num_trigger_devices = 0;
+
+	if (link_info->version == VERSION_1) {
+		if (link_info->u.link_info_v1.num_devices >
+			CAM_REQ_MGR_MAX_HANDLES)
+			return -EPERM;
+	} else if (link_info->version == VERSION_2) {
+		if (link_info->u.link_info_v2.num_devices >
+			CAM_REQ_MGR_MAX_HANDLES_V2)
+			return -EPERM;
+	}
+
+	mutex_init(&link->req.lock);
+	CAM_DBG(CAM_CRM, "LOCK_DBG in_q lock %pK", &link->req.lock);
+	link->req.num_tbl = 0;
+
+	rc = __cam_req_mgr_setup_in_q(&link->req);
+	if (rc < 0)
+		return rc;
+
+	max_delay = CAM_PIPELINE_DELAY_0;
+	max_modeswitch = CAM_MODESWITCH_DELAY_0;
+	if (link_info->version == VERSION_1)
+		num_devices = link_info->u.link_info_v1.num_devices;
+	else if (link_info->version == VERSION_2)
+		num_devices = link_info->u.link_info_v2.num_devices;
+	for (i = 0; i < num_devices; i++) {
+		dev = &link->l_dev[i];
+		/* Using dev hdl, get ops ptr to communicate with device */
+		if (link_info->version == VERSION_1)
+			dev->ops = (struct cam_req_mgr_kmd_ops *)
+					cam_get_device_ops(
+					link_info->u.link_info_v1.dev_hdls[i]);
+		else if (link_info->version == VERSION_2)
+			dev->ops = (struct cam_req_mgr_kmd_ops *)
+					cam_get_device_ops(
+					link_info->u.link_info_v2.dev_hdls[i]);
+		if (!dev->ops ||
+			!dev->ops->get_dev_info ||
+			!dev->ops->link_setup) {
+			CAM_ERR(CAM_CRM, "FATAL: device ops NULL");
+			rc = -ENXIO;
+			goto error;
+		}
+		if (link_info->version == VERSION_1)
+			dev->dev_hdl = link_info->u.link_info_v1.dev_hdls[i];
+		else if (link_info->version == VERSION_2)
+			dev->dev_hdl = link_info->u.link_info_v2.dev_hdls[i];
+		dev->parent = (void *)link;
+		dev->dev_info.dev_hdl = dev->dev_hdl;
+		rc = dev->ops->get_dev_info(&dev->dev_info);
+
+		trace_cam_req_mgr_connect_device(link, &dev->dev_info);
+		if (link_info->version == VERSION_1)
+			CAM_DBG(CAM_CRM,
+				"%x: connected: %s, id %d, delay %d, trigger %x",
+				link_info->u.link_info_v1.session_hdl,
+				dev->dev_info.name,
+				dev->dev_info.dev_id, dev->dev_info.p_delay,
+				dev->dev_info.trigger);
+		else if (link_info->version == VERSION_2)
+			CAM_DBG(CAM_CRM,
+				"%x: connected: %s, id %d, delay %d, trigger %x",
+				link_info->u.link_info_v2.session_hdl,
+				dev->dev_info.name,
+				dev->dev_info.dev_id, dev->dev_info.p_delay,
+				dev->dev_info.trigger);
+		if (rc < 0 ||
+			dev->dev_info.p_delay >=
+			CAM_PIPELINE_DELAY_MAX ||
+			dev->dev_info.p_delay <
+			CAM_PIPELINE_DELAY_0) {
+			CAM_ERR(CAM_CRM, "get device info failed");
+			goto error;
+		} else if (dev->dev_info.m_delay >=
+			CAM_MODESWITCH_DELAY_MAX ||
+			dev->dev_info.m_delay <
+			CAM_MODESWITCH_DELAY_0) {
+			CAM_ERR(CAM_CRM, "get mode switch info failed");
+			goto error;
+		} else {
+			if (link_info->version == VERSION_1) {
+				CAM_DBG(CAM_CRM, "%x: connected: %s, delay %d",
+					link_info->u.link_info_v1.session_hdl,
+					dev->dev_info.name,
+					dev->dev_info.p_delay);
+				}
+			else if (link_info->version == VERSION_2) {
+				CAM_DBG(CAM_CRM, "%x: connected: %s, delay %d",
+					link_info->u.link_info_v2.session_hdl,
+					dev->dev_info.name,
+					dev->dev_info.p_delay);
+				}
+			if (dev->dev_info.p_delay > max_delay)
+				max_delay = dev->dev_info.p_delay;
+
+			if (dev->dev_info.m_delay > max_modeswitch)
+				max_modeswitch = dev->dev_info.m_delay;
+		}
+
+		if (dev->dev_info.trigger_on)
+			num_trigger_devices++;
+
+		dev->is_active = true;
+	}
+
+	if (num_trigger_devices > CAM_REQ_MGR_MAX_TRIGGERS) {
+		CAM_ERR(CAM_CRM,
+			"Unsupported number of trigger devices %u",
+			num_trigger_devices);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	link_data.link_enable = 1;
+	link_data.link_hdl = link->link_hdl;
+	link_data.crm_cb = &cam_req_mgr_ops;
+	link_data.max_delay = max_delay;
+	link_data.mode_switch_max_delay = max_modeswitch;
+	if (num_trigger_devices == CAM_REQ_MGR_MAX_TRIGGERS)
+		link->dual_trigger = true;
+
+	num_trigger_devices = 0;
+	for (i = 0; i < num_devices; i++) {
+		dev = &link->l_dev[i];
+
+		link_data.dev_hdl = dev->dev_hdl;
+		/*
+		 * For unique pipeline delay table create request
+		 * tracking table
+		 */
+		if (link->pd_mask & BIT(dev->dev_info.p_delay)) {
+			pd_tbl = __cam_req_mgr_find_pd_tbl(link->req.l_tbl,
+				dev->dev_info.p_delay);
+			if (!pd_tbl) {
+				CAM_ERR(CAM_CRM, "pd %d tbl not found",
+					dev->dev_info.p_delay);
+				rc = -ENXIO;
+				goto error;
+			}
+		} else {
+			pd_tbl = __cam_req_mgr_create_pd_tbl(
+				dev->dev_info.p_delay);
+			if (pd_tbl == NULL) {
+				CAM_ERR(CAM_CRM, "create new pd tbl failed");
+				rc = -ENXIO;
+				goto error;
+			}
+			pd_tbl->pd = dev->dev_info.p_delay;
+			link->pd_mask |= BIT(pd_tbl->pd);
+			/*
+			 * Add table to list and also sort list
+			 * from max pd to lowest
+			 */
+			__cam_req_mgr_add_tbl_to_link(&link->req.l_tbl, pd_tbl);
+		}
+		dev->dev_bit = pd_tbl->dev_count++;
+		dev->pd_tbl = pd_tbl;
+		pd_tbl->dev_mask |= BIT(dev->dev_bit);
+		CAM_DBG(CAM_CRM, "dev_bit %u name %s pd %u mask %d",
+			dev->dev_bit, dev->dev_info.name, pd_tbl->pd,
+			pd_tbl->dev_mask);
+		link_data.trigger_id = -1;
+		if ((dev->dev_info.trigger_on) && (link->dual_trigger)) {
+			link_data.trigger_id = num_trigger_devices;
+			num_trigger_devices++;
+		}
+
+		/* Communicate with dev to establish the link */
+		dev->ops->link_setup(&link_data);
+
+		/* Compute max/min pipeline delay */
+		if (dev->dev_info.p_delay > link->max_delay)
+			link->max_delay = dev->dev_info.p_delay;
+		if (dev->dev_info.p_delay < link->min_delay)
+			link->min_delay = dev->dev_info.p_delay;
+
+		/* Compute max/min modeswitch delay */
+		if (dev->dev_info.m_delay > link->max_mswitch_delay)
+			link->max_mswitch_delay = dev->dev_info.m_delay;
+		if (dev->dev_info.m_delay < link->min_mswitch_delay)
+			link->min_mswitch_delay = dev->dev_info.m_delay;
+	}
+
+	link->num_devs = num_devices;
+
+	/* Assign id for pd tables */
+	__cam_req_mgr_tbl_set_id(link->req.l_tbl, &link->req);
+
+	/* At start, expect max pd devices, all are in skip state */
+	__cam_req_mgr_tbl_set_all_skip_cnt(&link->req.l_tbl);
+
+	return 0;
+
+error:
+	__cam_req_mgr_destroy_link_info(link);
+	return rc;
+}
+
+/* IOCTLs handling section */
+int cam_req_mgr_create_session(
+	struct cam_req_mgr_session_info *ses_info)
+{
+	int                              rc = 0;
+	int32_t                          session_hdl;
+	struct cam_req_mgr_core_session *cam_session = NULL;
+
+	if (!ses_info) {
+		CAM_DBG(CAM_CRM, "NULL session info pointer");
+		return -EINVAL;
+	}
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	cam_session = kzalloc(sizeof(*cam_session),
+		GFP_KERNEL);
+	if (!cam_session) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	session_hdl = cam_create_session_hdl((void *)cam_session);
+	if (session_hdl < 0) {
+		CAM_ERR(CAM_CRM, "unable to create session_hdl = %x",
+			session_hdl);
+		rc = session_hdl;
+		kfree(cam_session);
+		goto end;
+	}
+	ses_info->session_hdl = session_hdl;
+
+	mutex_init(&cam_session->lock);
+	CAM_DBG(CAM_CRM, "LOCK_DBG session lock %pK hdl 0x%x",
+		&cam_session->lock, session_hdl);
+
+	mutex_lock(&cam_session->lock);
+	cam_session->session_hdl = session_hdl;
+	cam_session->num_links = 0;
+	cam_session->sync_mode = CAM_REQ_MGR_SYNC_MODE_NO_SYNC;
+	list_add(&cam_session->entry, &g_crm_core_dev->session_head);
+	mutex_unlock(&cam_session->lock);
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_unlink()
+ *
+ * @brief  : Unlink devices on a link structure from the session
+ *           This API is to be invoked with session mutex held
+ * @session: session of the link
+ * @link   : Pointer to the link structure
+ *
+ * @return: 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_unlink(
+	struct cam_req_mgr_core_session *session,
+	struct cam_req_mgr_core_link *link)
+{
+	int rc;
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	link->state = CAM_CRM_LINK_STATE_IDLE;
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	if (!link->is_shutdown) {
+		rc = __cam_req_mgr_disconnect_link(link);
+		if (rc)
+			CAM_ERR(CAM_CORE,
+				"Unlink for all devices was not successful");
+	}
+
+	mutex_lock(&link->lock);
+	spin_lock_bh(&link->link_state_spin_lock);
+	/* Destroy timer of link */
+	crm_timer_exit(&link->watchdog);
+	spin_unlock_bh(&link->link_state_spin_lock);
+	/* Release session mutex for workq processing */
+	mutex_unlock(&session->lock);
+	/* Destroy workq of link */
+	cam_req_mgr_workq_destroy(&link->workq);
+	/* Acquire session mutex after workq flush */
+	mutex_lock(&session->lock);
+	/* Cleanup request tables and unlink devices */
+	__cam_req_mgr_destroy_link_info(link);
+	/* Free memory holding data of linked devs */
+
+	__cam_req_mgr_destroy_subdev(&link->l_dev);
+
+	/* Destroy the link handle */
+	rc = cam_destroy_link_hdl(link->link_hdl);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM, "error destroying link hdl %x rc %d",
+			link->link_hdl, rc);
+	} else
+		link->link_hdl = -1;
+
+	mutex_unlock(&link->lock);
+	return rc;
+}
+
+int cam_req_mgr_destroy_session(
+		struct cam_req_mgr_session_info *ses_info,
+		bool is_shutdown)
+{
+	int rc;
+	int i;
+	struct cam_req_mgr_core_session *cam_session = NULL;
+	struct cam_req_mgr_core_link *link;
+
+	if (!ses_info) {
+		CAM_DBG(CAM_CRM, "NULL session info pointer");
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	cam_session = cam_get_session_priv(ses_info->session_hdl);
+	if (!cam_session || (cam_session->session_hdl != ses_info->session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, ses_info->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), ses_info->session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		rc = -ENOENT;
+		goto end;
+
+	}
+
+	mutex_lock(&cam_session->lock);
+	if (cam_session->num_links) {
+		CAM_DBG(CAM_CRM, "destroy session %x num_active_links %d",
+			ses_info->session_hdl,
+			cam_session->num_links);
+
+		for (i = 0; i < MAXIMUM_LINKS_PER_SESSION; i++) {
+			link = cam_session->links[i];
+			if (!link)
+				continue;
+
+			CAM_DBG(CAM_CRM, "Unlink link hdl 0x%x",
+				link->link_hdl);
+			/* Ignore return value since session is going away */
+			link->is_shutdown = is_shutdown;
+			__cam_req_mgr_unlink(cam_session, link);
+			__cam_req_mgr_free_link(link);
+		}
+	}
+	list_del(&cam_session->entry);
+	mutex_unlock(&cam_session->lock);
+	mutex_destroy(&cam_session->lock);
+
+	kfree(cam_session);
+
+	rc = cam_destroy_session_hdl(ses_info->session_hdl);
+	if (rc < 0)
+		CAM_ERR(CAM_CRM, "unable to destroy session_hdl = %x rc %d",
+			ses_info->session_hdl, rc);
+
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_link_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+int cam_req_mgr_link(struct cam_req_mgr_ver_info *link_info)
+{
+	int                                     rc = 0;
+	int                                     wq_flag = 0;
+	char                                    buf[128];
+	struct cam_create_dev_hdl               root_dev = {0};
+	struct cam_req_mgr_core_session        *cam_session;
+	struct cam_req_mgr_core_link           *link;
+
+	if (!link_info) {
+		CAM_DBG(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+	if (link_info->u.link_info_v1.num_devices > CAM_REQ_MGR_MAX_HANDLES) {
+		CAM_ERR(CAM_CRM, "Invalid num devices %d",
+			link_info->u.link_info_v1.num_devices);
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+
+	/* session hdl's priv data is cam session struct */
+	cam_session = cam_get_session_priv(link_info->u.link_info_v1.session_hdl);
+	if (!cam_session || (cam_session->session_hdl != link_info->u.link_info_v1.session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, link_info->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), link_info->u.link_info_v1.session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+
+	/* Allocate link struct and map it with session's request queue */
+	link = __cam_req_mgr_reserve_link(cam_session);
+	if (!link) {
+		CAM_ERR(CAM_CRM, "failed to reserve new link");
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_CRM, "link reserved %pK %x", link, link->link_hdl);
+
+	root_dev.session_hdl = link_info->u.link_info_v1.session_hdl;
+	root_dev.priv = (void *)link;
+	root_dev.dev_id = CAM_CRM;
+
+	mutex_lock(&link->lock);
+	/* Create unique handle for link */
+	link->link_hdl = cam_create_link_hdl(&root_dev);
+	if (link->link_hdl < 0) {
+		CAM_ERR(CAM_CRM,
+			"Insufficient memory to create new device handle");
+		rc = link->link_hdl;
+		goto link_hdl_fail;
+	}
+	link_info->u.link_info_v1.link_hdl = link->link_hdl;
+	link->last_flush_id = 0;
+
+	/* Allocate memory to hold data of all linked devs */
+	rc = __cam_req_mgr_create_subdevs(&link->l_dev,
+		link_info->u.link_info_v1.num_devices);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM,
+			"Insufficient memory to create new crm subdevs");
+		goto create_subdev_failed;
+	}
+
+	/* Using device ops query connected devs, prepare request tables */
+	rc = __cam_req_mgr_setup_link_info(link, link_info);
+	if (rc < 0)
+		goto setup_failed;
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	link->state = CAM_CRM_LINK_STATE_READY;
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	/* Create worker for current link */
+	snprintf(buf, sizeof(buf), "%x-%x",
+		link_info->u.link_info_v1.session_hdl, link->link_hdl);
+	wq_flag = CAM_WORKQ_FLAG_HIGH_PRIORITY | CAM_WORKQ_FLAG_SERIAL;
+	rc = cam_req_mgr_workq_create(buf, CRM_WORKQ_NUM_TASKS,
+		&link->workq, CRM_WORKQ_USAGE_NON_IRQ, wq_flag,
+		cam_req_mgr_process_workq_link_worker);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM, "FATAL: unable to create worker");
+		__cam_req_mgr_destroy_link_info(link);
+		goto setup_failed;
+	}
+
+	/* Assign payload to workqueue tasks */
+	rc = __cam_req_mgr_setup_payload(link->workq);
+	if (rc < 0) {
+		__cam_req_mgr_destroy_link_info(link);
+		cam_req_mgr_workq_destroy(&link->workq);
+		goto setup_failed;
+	}
+
+	mutex_unlock(&link->lock);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+setup_failed:
+	__cam_req_mgr_destroy_subdev(&link->l_dev);
+create_subdev_failed:
+	cam_destroy_link_hdl(link->link_hdl);
+	link_info->u.link_info_v1.link_hdl = -1;
+link_hdl_fail:
+	mutex_unlock(&link->lock);
+	__cam_req_mgr_unreserve_link(cam_session, link);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_link_v2(struct cam_req_mgr_ver_info *link_info)
+{
+	int                                     rc = 0;
+	int                                     wq_flag = 0;
+	char                                    buf[128];
+	struct cam_create_dev_hdl               root_dev = {0};
+	struct cam_req_mgr_core_session        *cam_session;
+	struct cam_req_mgr_core_link           *link;
+
+	if (!link_info) {
+		CAM_DBG(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+	if (link_info->u.link_info_v2.num_devices >
+		CAM_REQ_MGR_MAX_HANDLES_V2) {
+		CAM_ERR(CAM_CRM, "Invalid num devices %d",
+			link_info->u.link_info_v2.num_devices);
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+
+	/* session hdl's priv data is cam session struct */
+	cam_session = cam_get_session_priv(link_info->u.link_info_v2.session_hdl);
+	if (!cam_session || (cam_session->session_hdl != link_info->u.link_info_v2.session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, link_info->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), link_info->u.link_info_v2.session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+
+	/* Allocate link struct and map it with session's request queue */
+	link = __cam_req_mgr_reserve_link(cam_session);
+	if (!link) {
+		CAM_ERR(CAM_CRM, "failed to reserve new link");
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_CRM, "link reserved %pK %x", link, link->link_hdl);
+
+	root_dev.session_hdl = link_info->u.link_info_v2.session_hdl;
+	root_dev.priv = (void *)link;
+	root_dev.dev_id = CAM_CRM;
+
+	mutex_lock(&link->lock);
+	/* Create unique handle for link */
+	link->link_hdl = cam_create_link_hdl(&root_dev);
+	if (link->link_hdl < 0) {
+		CAM_ERR(CAM_CRM,
+			"Insufficient memory to create new device handle");
+		rc = link->link_hdl;
+		goto link_hdl_fail;
+	}
+	link_info->u.link_info_v2.link_hdl = link->link_hdl;
+	link->last_flush_id = 0;
+
+	/* Allocate memory to hold data of all linked devs */
+	rc = __cam_req_mgr_create_subdevs(&link->l_dev,
+		link_info->u.link_info_v2.num_devices);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM,
+			"Insufficient memory to create new crm subdevs");
+		goto create_subdev_failed;
+	}
+
+	/* Using device ops query connected devs, prepare request tables */
+	rc = __cam_req_mgr_setup_link_info(link, link_info);
+	if (rc < 0)
+		goto setup_failed;
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	link->state = CAM_CRM_LINK_STATE_READY;
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	/* Create worker for current link */
+	snprintf(buf, sizeof(buf), "%x-%x",
+		link_info->u.link_info_v2.session_hdl, link->link_hdl);
+	wq_flag = CAM_WORKQ_FLAG_HIGH_PRIORITY | CAM_WORKQ_FLAG_SERIAL;
+	rc = cam_req_mgr_workq_create(buf, CRM_WORKQ_NUM_TASKS,
+		&link->workq, CRM_WORKQ_USAGE_NON_IRQ, wq_flag,
+		cam_req_mgr_process_workq_link_worker);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM, "FATAL: unable to create worker");
+		__cam_req_mgr_destroy_link_info(link);
+		goto setup_failed;
+	}
+
+	/* Assign payload to workqueue tasks */
+	rc = __cam_req_mgr_setup_payload(link->workq);
+	if (rc < 0) {
+		__cam_req_mgr_destroy_link_info(link);
+		cam_req_mgr_workq_destroy(&link->workq);
+		goto setup_failed;
+	}
+
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_EOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_EOF] = 0;
+
+	mutex_unlock(&link->lock);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+setup_failed:
+	__cam_req_mgr_destroy_subdev(&link->l_dev);
+create_subdev_failed:
+	cam_destroy_link_hdl(link->link_hdl);
+	link_info->u.link_info_v2.link_hdl = -1;
+link_hdl_fail:
+	mutex_unlock(&link->lock);
+	__cam_req_mgr_unreserve_link(cam_session, link);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+
+int cam_req_mgr_unlink(struct cam_req_mgr_unlink_info *unlink_info)
+{
+	int                              rc = 0;
+	struct cam_req_mgr_core_session *cam_session;
+	struct cam_req_mgr_core_link    *link;
+
+	if (!unlink_info) {
+		CAM_ERR(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	CAM_DBG(CAM_CRM, "link_hdl %x", unlink_info->link_hdl);
+
+	/* session hdl's priv data is cam session struct */
+	cam_session = cam_get_session_priv(unlink_info->session_hdl);
+	if (!cam_session || (cam_session->session_hdl != unlink_info->session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, unlink_info->ses_hdl:%x, cam_session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), unlink_info->session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+
+	/* link hdl's priv data is core_link struct */
+	link = cam_get_link_priv(unlink_info->link_hdl);
+	if (!link || (link->link_hdl != unlink_info->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, unlink_info->link_hdl:%x, link->link_hdl:%x",
+			CAM_IS_NULL_TO_STR(link), unlink_info->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto done;
+	}
+	mutex_lock(&cam_session->lock);
+	rc = __cam_req_mgr_unlink(cam_session, link);
+	mutex_unlock(&cam_session->lock);
+
+	/* Free curent link and put back into session's free pool of links */
+	__cam_req_mgr_unreserve_link(cam_session, link);
+
+done:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_schedule_request(
+	struct cam_req_mgr_sched_request *sched_req)
+{
+	int                                  rc = 0;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_core_session     *session = NULL;
+	struct cam_req_mgr_sched_request_v2 *sched;
+	struct crm_task_payload              task_data;
+
+	if (!sched_req) {
+		CAM_ERR(CAM_CRM, "csl_req is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	link = cam_get_link_priv(sched_req->link_hdl);
+	if (!link || (link->link_hdl != sched_req->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, sched_req->link_hdl:%x, link->link_hdl:%x",
+			CAM_IS_NULL_TO_STR(link), sched_req->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	session = (struct cam_req_mgr_core_session *)link->parent;
+	if (!session) {
+		CAM_WARN(CAM_CRM, "session ptr NULL %x", sched_req->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (sched_req->req_id <= link->last_flush_id) {
+		CAM_INFO(CAM_CRM,
+			"request %lld is flushed, last_flush_id to flush %d",
+			sched_req->req_id, link->last_flush_id);
+		rc = -EBADR;
+		goto end;
+	}
+
+	if (sched_req->req_id > link->last_flush_id)
+		link->last_flush_id = 0;
+
+	CAM_DBG(CAM_CRM, "link 0x%x req %lld, sync_mode %d",
+		sched_req->link_hdl, sched_req->req_id, sched_req->sync_mode);
+
+	task_data.type = CRM_WORKQ_TASK_SCHED_REQ;
+	sched = (struct cam_req_mgr_sched_request_v2 *)&task_data.u;
+	sched->req_id = sched_req->req_id;
+	sched->sync_mode = sched_req->sync_mode;
+	sched->link_hdl = sched_req->link_hdl;
+	sched->additional_timeout = sched_req->additional_timeout;
+	if (session->force_err_recovery == AUTO_RECOVERY) {
+		sched->bubble_enable = sched_req->bubble_enable;
+	} else {
+		sched->bubble_enable =
+		(session->force_err_recovery == FORCE_ENABLE_RECOVERY) ? 1 : 0;
+	}
+
+	rc = cam_req_mgr_process_sched_req(link, &task_data);
+
+	CAM_DBG(CAM_REQ, "Open req %lld on link 0x%x with sync_mode %d",
+		sched_req->req_id, sched_req->link_hdl, sched_req->sync_mode);
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_schedule_request_v2(
+	struct cam_req_mgr_sched_request_v2 *sched_req)
+{
+	int                                  i = 0;
+	int                                  rc = 0;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_core_session     *session = NULL;
+	struct crm_task_payload              task_data;
+	struct cam_req_mgr_sched_request_v2 *sched;
+	struct cam_req_mgr_core_link        *sync_links[MAXIMUM_LINKS_PER_SESSION];
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+
+	link = cam_get_link_priv(sched_req->link_hdl);
+	if (!link || (link->link_hdl != sched_req->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, sched_req->link_hdl:%x, link->link_hdl:%x",
+			CAM_IS_NULL_TO_STR(link), sched_req->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	session = (struct cam_req_mgr_core_session *)link->parent;
+	if (!session) {
+		CAM_WARN(CAM_CRM, "session ptr NULL %x", sched_req->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (sched_req->req_id <= link->last_flush_id) {
+		CAM_INFO(CAM_CRM,
+			"request %lld is flushed, last_flush_id to flush %d",
+			sched_req->req_id, link->last_flush_id);
+		rc = -EBADR;
+		goto end;
+	}
+
+	if (sched_req->req_id > link->last_flush_id)
+		link->last_flush_id = 0;
+
+	CAM_DBG(CAM_CRM, "link 0x%x req %lld, sync_mode %d num_links %d",
+		sched_req->link_hdl, sched_req->req_id, sched_req->sync_mode,
+		sched_req->num_links);
+
+	task_data.type = CRM_WORKQ_TASK_SCHED_REQ;
+	sched = (struct cam_req_mgr_sched_request_v2 *)&task_data.u;
+	sched->req_id = sched_req->req_id;
+	sched->sync_mode = sched_req->sync_mode;
+	sched->link_hdl = sched_req->link_hdl;
+	sched->additional_timeout = sched_req->additional_timeout;
+
+	if (session->force_err_recovery == AUTO_RECOVERY) {
+		sched->bubble_enable = sched_req->bubble_enable;
+	} else {
+		sched->bubble_enable =
+		(session->force_err_recovery == FORCE_ENABLE_RECOVERY) ? 1 : 0;
+	}
+
+	if (sched_req->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+		if ((sched_req->num_links <= 0) &&
+			(sched_req->num_links > MAXIMUM_LINKS_PER_SESSION)) {
+			CAM_ERR(CAM_CRM, "link:0x%x req:%lld invalid num_links:%d",
+				link->link_hdl, sched_req->req_id, sched_req->num_links);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		for (i = 0; i < sched_req->num_links; i++) {
+			if (!sched_req->link_hdls[i]) {
+				CAM_ERR(CAM_CRM, "link handle %d in sched_req is null", i);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			sync_links[i] = cam_get_link_priv(sched_req->link_hdls[i]);
+			if (!sync_links[i] ||
+				(sync_links[i]->link_hdl != sched_req->link_hdls[i])) {
+				CAM_ERR(CAM_CRM,
+					"Invalid sync link, sync link[%d]: %s sched_req->link_hdl: %x sync_links->link_hdl: 0x%x",
+					i, CAM_IS_NULL_TO_STR(sync_links[i]),
+					sched_req->link_hdls[i],
+					((!sync_links[i]) ? CAM_REQ_MGR_DEFAULT_HDL_VAL :
+					sync_links[i]->link_hdl));
+				rc = -EINVAL;
+				goto end;
+			}
+
+			sched->link_hdls[i] = sched_req->link_hdls[i];
+		}
+		sched->num_links = sched_req->num_links;
+	} else
+		sched->num_links = 0;
+
+	rc = cam_req_mgr_process_sched_req(link, &task_data);
+
+	CAM_DBG(CAM_REQ, "Open req %lld on link 0x%x with sync_mode %d",
+		sched_req->req_id, sched_req->link_hdl, sched_req->sync_mode);
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_sync_config(
+	struct cam_req_mgr_sync_mode *sync_info)
+{
+	int                              i, j, rc = 0;
+	int                              sync_idx = 0;
+	struct cam_req_mgr_core_session *cam_session;
+	struct cam_req_mgr_core_link    *link[MAX_LINKS_PER_SESSION];
+
+	if (!sync_info) {
+		CAM_ERR(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+
+	if ((sync_info->num_links < 0) ||
+		(sync_info->num_links >
+		MAX_LINKS_PER_SESSION)) {
+		CAM_ERR(CAM_CRM, "Invalid num links %d", sync_info->num_links);
+		return -EINVAL;
+	}
+
+	if ((sync_info->sync_mode != CAM_REQ_MGR_SYNC_MODE_SYNC) &&
+		(sync_info->sync_mode != CAM_REQ_MGR_SYNC_MODE_NO_SYNC)) {
+		CAM_ERR(CAM_CRM, "Invalid sync mode %d", sync_info->sync_mode);
+		return -EINVAL;
+	}
+
+	if ((!sync_info->link_hdls[0]) || (!sync_info->link_hdls[1])) {
+		CAM_WARN(CAM_CRM, "Invalid link handles 0x%x 0x%x",
+			sync_info->link_hdls[0], sync_info->link_hdls[1]);
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	/* session hdl's priv data is cam session struct */
+	cam_session = cam_get_session_priv(sync_info->session_hdl);
+	if (!cam_session || (cam_session->session_hdl != sync_info->session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, sync_info->session_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), sync_info->session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+
+	mutex_lock(&cam_session->lock);
+
+	for (i = 0; i < sync_info->num_links; i++) {
+
+		if (!sync_info->link_hdls[i]) {
+			CAM_ERR(CAM_CRM, "link handle %d is null", i);
+			rc = -EINVAL;
+			goto done;
+		}
+
+		link[i] = cam_get_link_priv(sync_info->link_hdls[i]);
+		if (!link[i] || (link[i]->link_hdl != sync_info->link_hdls[i])) {
+			CAM_ERR(CAM_CRM, "link: %s, sync_info->link_hdl:%x, link->link_hdl:%x",
+				CAM_IS_NULL_TO_STR(link), sync_info->link_hdls[i],
+				(!link[i]) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link[i]->link_hdl);
+			rc = -EINVAL;
+			goto done;
+		}
+
+		link[i]->sync_link_sof_skip = false;
+		link[i]->is_master = false;
+		link[i]->in_msync_mode = false;
+		link[i]->initial_sync_req = -1;
+		link[i]->num_sync_links = 0;
+
+		for (j = 0; j < sync_info->num_links-1; j++)
+			link[i]->sync_link[j] = NULL;
+	}
+
+	if (sync_info->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+		for (i = 0; i < sync_info->num_links; i++) {
+			j = 0;
+			sync_idx = 0;
+			CAM_DBG(CAM_REQ, "link %x adds sync link:",
+				link[i]->link_hdl);
+			while (j < sync_info->num_links) {
+				if (i != j) {
+					link[i]->sync_link[sync_idx++] =
+						link[j];
+					link[i]->num_sync_links++;
+					CAM_DBG(CAM_REQ, "sync_link[%d] : %x",
+						sync_idx-1, link[j]->link_hdl);
+				}
+				j++;
+			}
+			link[i]->initial_skip = true;
+			link[i]->sof_timestamp = 0;
+		}
+	} else {
+		for (j = 0; j < sync_info->num_links; j++) {
+			link[j]->initial_skip = true;
+			link[j]->sof_timestamp = 0;
+		}
+	}
+
+	cam_session->sync_mode = sync_info->sync_mode;
+	CAM_DBG(CAM_REQ,
+		"Sync config completed on %d links with sync_mode %d",
+		sync_info->num_links, sync_info->sync_mode);
+
+done:
+	mutex_unlock(&cam_session->lock);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_flush_requests(
+	struct cam_req_mgr_flush_info *flush_info)
+{
+	int                               rc = 0;
+	struct crm_workq_task            *task = NULL;
+	struct cam_req_mgr_core_link     *link = NULL;
+	struct cam_req_mgr_flush_info    *flush;
+	struct crm_task_payload          *task_data;
+	struct cam_req_mgr_core_session  *session = NULL;
+
+	if (!flush_info) {
+		CAM_ERR(CAM_CRM, "flush req is NULL");
+		return -EFAULT;
+	}
+	if (flush_info->flush_type >= CAM_REQ_MGR_FLUSH_TYPE_MAX) {
+		CAM_ERR(CAM_CRM, "incorrect flush type %x",
+			flush_info->flush_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+
+	/* session hdl's priv data is cam session struct */
+	session = cam_get_session_priv(flush_info->session_hdl);
+	if (!session || (session->session_hdl != flush_info->session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, flush_info->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(session), flush_info->session_hdl,
+			(!session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : session->session_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+	if (session->num_links <= 0) {
+		CAM_WARN(CAM_CRM, "No active links in session %x",
+		flush_info->session_hdl);
+		goto end;
+	}
+
+	link = cam_get_link_priv(flush_info->link_hdl);
+	if (!link || (link->link_hdl != flush_info->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, flush_info->link_hdl:%x, link->link_hdl:%x",
+			CAM_IS_NULL_TO_STR(link), flush_info->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_FLUSH_REQ;
+	flush = (struct cam_req_mgr_flush_info *)&task_data->u;
+	flush->req_id = flush_info->req_id;
+	flush->link_hdl = flush_info->link_hdl;
+	flush->flush_type = flush_info->flush_type;
+	task->process_cb = &cam_req_mgr_process_flush_req;
+	init_completion(&link->workq_comp);
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+	if (rc) {
+		CAM_ERR(CAM_CRM, "Failed to queue flush task rc: %d", rc);
+		goto end;
+	}
+
+	/* Blocking call */
+	rc = cam_common_wait_for_completion_timeout(
+		&link->workq_comp,
+		msecs_to_jiffies(CAM_REQ_MGR_SCHED_REQ_TIMEOUT));
+	if (!rc)
+		CAM_WARN(CAM_CRM, "Flush call timeout for session_hdl %u link_hdl %u type: %d",
+			flush_info->link_hdl, flush_info->session_hdl,
+			flush_info->flush_type);
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_rearrange_devs(
+	struct cam_req_mgr_core_link       *link)
+{
+	int i, rc = 0;
+	uint32_t  master_dev_idx = 0, slave_dev_idx = 0;
+	struct cam_req_mgr_connected_device    *dev, tmp_dev;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+
+		if (!dev->dev_info.trigger_on)
+			continue;
+		rc = dev->ops->get_dev_info(&dev->dev_info);
+		if (rc) {
+			CAM_ERR(CAM_CRM, "Get dev info failed link %x dev %x",
+				link->link_hdl, dev->dev_hdl);
+			continue;
+		}
+
+		if (dev->dev_info.is_shdr_master)
+			master_dev_idx = i;
+		else
+			slave_dev_idx = i;
+	}
+
+	if (master_dev_idx < slave_dev_idx) {
+		tmp_dev = link->l_dev[master_dev_idx];
+		link->l_dev[master_dev_idx] = link->l_dev[slave_dev_idx];
+		link->l_dev[slave_dev_idx] = tmp_dev;
+	}
+
+	link->is_shdr = true;
+	link->wait_for_dual_trigger = true;
+	CAM_DBG(CAM_CRM, "link hdl %x wait for dual triger %d",
+		link->link_hdl, link->wait_for_dual_trigger);
+
+	return rc;
+}
+
+int cam_req_mgr_link_control(struct cam_req_mgr_link_control *control)
+{
+	int                                 rc = 0, i;
+	struct cam_req_mgr_core_link       *link = NULL;
+	int                                 init_timeout = 0;
+
+	if (!control) {
+		CAM_ERR(CAM_CRM, "Control command is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((control->num_links <= 0) ||
+		(control->num_links > MAX_LINKS_PER_SESSION)) {
+		CAM_ERR(CAM_CRM, "Invalid number of links %d",
+			control->num_links);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	for (i = 0; i < control->num_links; i++) {
+		link = cam_get_link_priv(control->link_hdls[i]);
+		if (!link || (link->link_hdl != control->link_hdls[i])) {
+			CAM_ERR(CAM_CRM, "link: %s, control->link_hdl:%x, link->link_hdl:%x",
+				CAM_IS_NULL_TO_STR(link), control->link_hdls[i],
+				(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+			rc = -EINVAL;
+			break;
+		}
+
+		mutex_lock(&link->lock);
+		if (control->ops == CAM_REQ_MGR_LINK_ACTIVATE) {
+			spin_lock_bh(&link->link_state_spin_lock);
+			link->state = CAM_CRM_LINK_STATE_READY;
+			spin_unlock_bh(&link->link_state_spin_lock);
+			if (control->init_timeout[i])
+				link->skip_init_frame = true;
+			init_timeout = (2 * control->init_timeout[i]);
+			CAM_DBG(CAM_CRM,
+				"Activate link: 0x%x init_timeout: %d ms",
+				link->link_hdl, control->init_timeout[i]);
+			/* Start SOF watchdog timer */
+			rc = crm_timer_init(&link->watchdog,
+				(init_timeout + CAM_REQ_MGR_WATCHDOG_TIMEOUT),
+				link, &__cam_req_mgr_sof_freeze);
+			if (rc < 0) {
+				CAM_ERR(CAM_CRM,
+					"SOF timer start fails: link=0x%x",
+					link->link_hdl);
+				rc = -EFAULT;
+			}
+
+			if (link->dual_trigger)
+				rc = cam_req_mgr_rearrange_devs(link);
+			/* Wait for the streaming of sync link */
+			link->initial_skip = true;
+			/* Pause the timer before sensor stream on */
+			spin_lock_bh(&link->link_state_spin_lock);
+			link->watchdog->pause_timer = true;
+			spin_unlock_bh(&link->link_state_spin_lock);
+			/* notify nodes */
+			__cam_req_mgr_send_evt(0, CAM_REQ_MGR_LINK_EVT_RESUME,
+				CRM_KMD_ERR_MAX, link);
+		} else if (control->ops == CAM_REQ_MGR_LINK_DEACTIVATE) {
+			/* notify nodes */
+			__cam_req_mgr_send_evt(0, CAM_REQ_MGR_LINK_EVT_PAUSE,
+				CRM_KMD_ERR_MAX, link);
+
+			/* Destroy SOF watchdog timer */
+			spin_lock_bh(&link->link_state_spin_lock);
+			link->state = CAM_CRM_LINK_STATE_IDLE;
+			link->skip_init_frame = false;
+			crm_timer_exit(&link->watchdog);
+			spin_unlock_bh(&link->link_state_spin_lock);
+			CAM_DBG(CAM_CRM,
+				"De-activate link: 0x%x", link->link_hdl);
+		} else {
+			CAM_ERR(CAM_CRM, "Invalid link control command");
+			rc = -EINVAL;
+		}
+		mutex_unlock(&link->lock);
+	}
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+end:
+	return rc;
+}
+
+int cam_req_mgr_link_properties(struct cam_req_mgr_link_properties *properties)
+{
+	int                                    i, rc = 0;
+	struct cam_req_mgr_core_link          *link = NULL;
+	struct cam_req_mgr_connected_device   *dev;
+	struct cam_req_mgr_link_evt_data       evt_data;
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	link = cam_get_link_priv(properties->link_hdl);
+	if (!link || (link->link_hdl != properties->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, properties->link_hdl:0x%x, link->link_hdl:0x%x",
+			CAM_IS_NULL_TO_STR(link), properties->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state != CAM_CRM_LINK_STATE_READY) {
+		spin_unlock_bh(&link->link_state_spin_lock);
+		CAM_ERR(CAM_CRM,
+			"Only can config link 0x%x properties in ready state",
+			link->link_hdl);
+		rc = -EAGAIN;
+		goto end;
+	}
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	mutex_lock(&link->lock);
+	link->properties_mask = properties->properties_mask;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		evt_data.dev_hdl = dev->dev_hdl;
+		evt_data.link_hdl = link->link_hdl;
+		evt_data.evt_type = CAM_REQ_MGR_LINK_EVT_UPDATE_PROPERTIES;
+		evt_data.u.properties_mask = link->properties_mask;
+
+		if (dev->ops && dev->ops->process_evt) {
+			rc = dev->ops->process_evt(&evt_data);
+			if (rc) {
+				CAM_ERR(CAM_CRM,
+					"Failed to set properties on link 0x%x dev 0x%x",
+					link->link_hdl, dev->dev_hdl);
+				mutex_unlock(&link->lock);
+				goto end;
+			}
+		}
+	}
+
+	mutex_unlock(&link->lock);
+
+	CAM_DBG(CAM_CRM, "link 0x%x set properties successfully, properties mask:0x%x",
+		link->link_hdl, link->properties_mask);
+
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+static void *cam_req_mgr_user_dump_state_monitor_array_info(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_req_mgr_state_monitor  *evt = NULL;
+	uint64_t                          *addr;
+	struct cam_common_hw_dump_header  *hdr;
+	uint8_t                           *dst;
+
+	evt = (struct cam_req_mgr_state_monitor *)dump_struct;
+
+	addr = (uint64_t *)addr_ptr;
+
+	*addr++ = evt->req_id;
+
+	dst = (uint8_t *)addr;
+	hdr = (struct cam_common_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_CRM_DUMP_TAG_MAX_LEN,
+		"%s", evt->name);
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_common_hw_dump_header));
+
+	dst = (uint8_t *)addr;
+	hdr = (struct cam_common_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_CRM_DUMP_TAG_MAX_LEN,
+		"%s", __cam_req_mgr_operation_type_to_str(evt->req_state));
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_common_hw_dump_header));
+
+	*addr++ = evt->dev_hdl;
+	*addr++ = evt->frame_id;
+	*addr++ = evt->time_stamp.tv_sec;
+	*addr++ = evt->time_stamp.tv_nsec / NSEC_PER_USEC;
+	return addr;
+}
+
+/**
+ * cam_req_mgr_dump_state_monitor_info()
+ *
+ * @brief     : dump the state monitor array, dump from index next_wr_idx
+ *             to save state information in time order.
+ * @link      : link pointer
+ * @dump_info : dump payload
+ */
+static int cam_req_mgr_dump_state_monitor_info(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_dump_info *dump_info)
+{
+	int                             rc = 0;
+	int                             i;
+	int                             idx = link->req.next_state_idx;
+	struct cam_common_hw_dump_args  dump_args;
+	size_t                          buf_len;
+	size_t                          remain_len;
+	uint32_t                        min_len;
+	uintptr_t                       cpu_addr;
+
+	rc = cam_mem_get_cpu_buf(dump_info->buf_handle,
+		&cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_CRM, "Invalid handle %u rc %d",
+			dump_info->buf_handle, rc);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return rc;
+	}
+	if (buf_len <= dump_info->offset) {
+		CAM_WARN(CAM_CRM, "Dump buffer overshoot len %zu offset %zu",
+			buf_len, dump_info->offset);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return -ENOSPC;
+	}
+
+	remain_len = buf_len - dump_info->offset;
+	min_len = sizeof(struct cam_common_hw_dump_header) +
+		(MAX_REQ_STATE_MONITOR_NUM * (CAM_CRM_DUMP_EVENT_NUM_WORDS * sizeof(uint64_t) +
+		sizeof(struct cam_common_hw_dump_header) * CAM_CRM_DUMP_EVENT_NUM_HEADERS));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_CRM, "Dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return -ENOSPC;
+	}
+
+	dump_args.req_id = dump_info->req_id;
+	dump_args.cpu_addr = cpu_addr;
+	dump_args.buf_len = buf_len;
+	dump_args.offset = dump_info->offset;
+	dump_args.ctxt_to_hw_map = NULL;
+
+	for (i = 0; i < MAX_REQ_STATE_MONITOR_NUM; i++) {
+		if (link->req.state_monitor[idx].req_state != CAM_CRM_STATE_INVALID) {
+			rc = cam_common_user_dump_helper(&dump_args,
+				cam_req_mgr_user_dump_state_monitor_array_info,
+				&link->req.state_monitor[idx],
+				sizeof(uint64_t), "CRM_STATE_MONITOR.%x:", link->link_hdl);
+			if (rc) {
+				CAM_ERR(CAM_CRM,
+					"Dump state info failed, rc: %d",
+					rc);
+				cam_mem_put_cpu_buf(dump_info->buf_handle);
+				return rc;
+			}
+		}
+		__cam_req_mgr_inc_idx(&idx, 1, MAX_REQ_STATE_MONITOR_NUM);
+	}
+
+	dump_info->offset = dump_args.offset;
+	cam_mem_put_cpu_buf(dump_info->buf_handle);
+	return rc;
+}
+
+int cam_req_mgr_dump_request(struct cam_dump_req_cmd *dump_req)
+{
+	int                                  rc = 0;
+	int                                  i;
+	struct cam_req_mgr_dump_info         info;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_core_session     *session = NULL;
+	struct cam_req_mgr_connected_device *device = NULL;
+
+	if (!dump_req) {
+		CAM_ERR(CAM_CRM, "dump req is NULL");
+		return -EFAULT;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	/* session hdl's priv data is cam session struct */
+	session = cam_get_session_priv(dump_req->session_handle);
+	if (!session || (session->session_hdl != dump_req->session_handle)) {
+		CAM_ERR(CAM_CRM, "session: %s, dump_req->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(session), dump_req->session_handle,
+			(!session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : session->session_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+	if (session->num_links <= 0) {
+		CAM_WARN(CAM_CRM, "No active links in session %x",
+			dump_req->session_handle);
+		goto end;
+	}
+
+	link = cam_get_link_priv(dump_req->link_hdl);
+	if (!link || (link->link_hdl != dump_req->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, dump_req->link_hdl:%x, link->link_hdl:%x",
+			CAM_IS_NULL_TO_STR(link), dump_req->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/*
+	 * Dump Mem MGR
+	 */
+	rc = cam_mem_mgr_dump_user(dump_req);
+	if (rc)
+		CAM_ERR(CAM_REQ,
+			"Fail to dump mem mgr rc %d", rc);
+
+	/*
+	 * Dump CRM
+	 */
+	info.offset = dump_req->offset;
+	info.link_hdl = dump_req->link_hdl;
+	info.dev_hdl = 0;
+	info.req_id = dump_req->issue_req_id;
+	info.buf_handle = dump_req->buf_handle;
+	info.error_type = dump_req->error_type;
+	rc =  cam_req_mgr_dump_state_monitor_info(link, &info);
+	if (rc)
+		CAM_ERR(CAM_REQ,
+			"Fail to dump state monitor req %llu rc %d",
+			info.req_id, rc);
+
+	info.buf_handle = dump_req->buf_handle;
+	rc = cam_cpas_dump_state_monitor_info(&info);
+	if (rc)
+		CAM_ERR(CAM_CRM, "Fail to dump cpas vote info, rc %d", rc);
+
+	for (i = 0; i < link->num_devs; i++) {
+		device = &link->l_dev[i];
+		info.link_hdl = dump_req->link_hdl;
+		info.dev_hdl = device->dev_hdl;
+		info.req_id = dump_req->issue_req_id;
+		info.buf_handle = dump_req->buf_handle;
+		info.error_type = dump_req->error_type;
+		if (device->ops && device->ops->dump_req) {
+			rc = device->ops->dump_req(&info);
+			if (rc)
+				CAM_ERR(CAM_REQ,
+					"Fail dump req %llu dev %d rc %d",
+					info.req_id, device->dev_hdl, rc);
+		}
+	}
+	dump_req->offset = info.offset;
+	CAM_INFO(CAM_REQ, "req %llu, offset %zu",
+		dump_req->issue_req_id, dump_req->offset);
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+static unsigned long cam_req_mgr_core_mini_dump_cb(void *dst, unsigned long len,
+	void *priv_data)
+{
+	struct cam_req_mgr_core_link *link;
+	struct cam_req_mgr_core_mini_dump *md;
+	struct cam_req_mgr_core_link_mini_dump *md_link;
+	struct cam_req_mgr_req_tbl   *l_tbl = NULL;
+	uint8_t *waddr;
+	unsigned long dumped_len = 0;
+	unsigned long remain_len = len;
+	uint32_t i = 0, j = 0, k = 0;
+
+	if (!dst || len < sizeof(*md)) {
+		CAM_ERR(CAM_CRM, "Insufficient received length %lu dumped len: %u",
+			len, dumped_len);
+		return 0;
+	}
+
+	md = (struct cam_req_mgr_core_mini_dump *)dst;
+	md->num_link = 0;
+	waddr = (uint8_t *)dst + sizeof(*md);
+	dumped_len += sizeof(*md);
+	remain_len -= dumped_len;
+
+	for (i = 0; i < MAXIMUM_LINKS_CAPACITY; i++) {
+		if (remain_len < sizeof(*md_link)) {
+			CAM_ERR(CAM_CRM,
+			"Insufficent received length: %lu, dumped_len %lu",
+			len, dumped_len);
+			goto end;
+		}
+
+		if (atomic_read(&g_links[i].is_used) == 0)
+			continue;
+
+		waddr += (k * sizeof(*md_link));
+		md_link = (struct cam_req_mgr_core_link_mini_dump *)waddr;
+		md->link[k] = md_link;
+		link = &g_links[i];
+		md_link->sync_link_sof_skip = link->sync_link_sof_skip;
+		md_link->num_sync_links = link->num_sync_links;
+		md_link->initial_sync_req = link->initial_sync_req;
+		md_link->last_flush_id = link->last_flush_id;
+		md_link->is_used = atomic_read(&link->is_used);
+		md_link->retry_cnt = link->retry_cnt;
+		md_link->eof_event_cnt = atomic_read(&link->eof_event_cnt);
+		md_link->pd_mask = link->pd_mask;
+		md_link->link_hdl = link->link_hdl;
+		md_link->num_devs = link->num_devs;
+		md_link->max_delay = link->max_delay;
+		md_link->dual_trigger = link->dual_trigger;
+		md_link->state = link->state;
+		md_link->is_shutdown = link->is_shutdown;
+		md_link->skip_init_frame = link->skip_init_frame;
+		md_link->is_master = link->is_master;
+		md_link->initial_skip = link->initial_skip;
+		md_link->in_msync_mode = link->in_msync_mode;
+		md_link->wq_congestion = link->wq_congestion;
+		memcpy(md_link->req.apply_data, link->req.apply_data,
+			sizeof(link->req.apply_data));
+		memcpy(md_link->req.prev_apply_data, link->req.prev_apply_data,
+			sizeof(link->req.prev_apply_data));
+		memcpy(&md_link->req.in_q, link->req.in_q,
+			sizeof(struct cam_req_mgr_req_queue));
+		md_link->req.num_tbl = link->req.num_tbl;
+
+		md_link->workq.workq_scheduled_ts =
+					    link->workq->workq_scheduled_ts;
+		md_link->workq.task.pending_cnt =
+				atomic_read(&link->workq->task.pending_cnt);
+		md_link->workq.task.free_cnt =
+				atomic_read(&link->workq->task.free_cnt);
+		md_link->workq.task.num_task = link->workq->task.num_task;
+
+		l_tbl = link->req.l_tbl;
+		j = 0;
+		while(l_tbl) {
+			md_link->req.l_tbl[j].id = l_tbl->id;
+			md_link->req.l_tbl[j].pd = l_tbl->id;
+			md_link->req.l_tbl[j].dev_count = l_tbl->dev_count;
+			md_link->req.l_tbl[j].dev_mask = l_tbl->dev_mask;
+			md_link->req.l_tbl[j].skip_traverse =
+				l_tbl->skip_traverse;
+			md_link->req.l_tbl[j].pd_delta = l_tbl->pd_delta;
+			md_link->req.l_tbl[j].num_slots = l_tbl->num_slots;
+			memcpy(md_link->req.l_tbl[j].slot, l_tbl->slot,
+				sizeof(l_tbl->slot));
+			l_tbl = l_tbl->next;
+			j++;
+		}
+		md->num_link++;
+		dumped_len += sizeof(*md_link);
+		remain_len = len - dumped_len;
+	}
+end:
+	return dumped_len;
+}
+
+int cam_req_mgr_core_device_init(void)
+{
+	int i;
+	CAM_DBG(CAM_CRM, "Enter g_crm_core_dev %pK", g_crm_core_dev);
+
+	if (g_crm_core_dev) {
+		CAM_WARN(CAM_CRM, "core device is already initialized");
+		return 0;
+	}
+	g_crm_core_dev = kzalloc(sizeof(*g_crm_core_dev),
+		GFP_KERNEL);
+	if (!g_crm_core_dev)
+		return -ENOMEM;
+
+	CAM_DBG(CAM_CRM, "g_crm_core_dev %pK", g_crm_core_dev);
+	INIT_LIST_HEAD(&g_crm_core_dev->session_head);
+	mutex_init(&g_crm_core_dev->crm_lock);
+	cam_req_mgr_debug_register(g_crm_core_dev);
+
+	for (i = 0; i < MAXIMUM_LINKS_CAPACITY; i++) {
+		mutex_init(&g_links[i].lock);
+		spin_lock_init(&g_links[i].link_state_spin_lock);
+		spin_lock_init(&g_links[i].req.monitor_slock);
+		spin_lock_init(&g_links[i].req.reset_link_spin_lock);
+		atomic_set(&g_links[i].is_used, 0);
+		cam_req_mgr_core_link_reset(&g_links[i]);
+	}
+	cam_common_register_mini_dump_cb(cam_req_mgr_core_mini_dump_cb,
+		"CAM_CRM", NULL);
+
+	return 0;
+}
+
+int cam_req_mgr_core_device_deinit(void)
+{
+	if (!g_crm_core_dev) {
+		CAM_ERR(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CRM, "g_crm_core_dev %pK", g_crm_core_dev);
+	cam_req_mgr_debug_unregister();
+	mutex_destroy(&g_crm_core_dev->crm_lock);
+	kfree(g_crm_core_dev);
+	g_crm_core_dev = NULL;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_core.h
@@ -0,0 +1,788 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_CORE_H_
+#define _CAM_REQ_MGR_CORE_H_
+
+#include <linux/spinlock_types.h>
+#include "cam_req_mgr_interface.h"
+#include "cam_req_mgr_core_defs.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_req_mgr_timer.h"
+
+#define CAM_REQ_MGR_MAX_LINKED_DEV     16
+#define MAX_REQ_SLOTS                  48
+#define MAX_REQ_STATE_MONITOR_NUM      108
+#define MAX_DEV_FOR_SPECIAL_OPS        4
+
+#define CAM_REQ_MGR_WATCHDOG_TIMEOUT          1000
+#define CAM_REQ_MGR_WATCHDOG_TIMEOUT_DEFAULT  5000
+#define CAM_REQ_MGR_WATCHDOG_TIMEOUT_MAX      50000
+#define CAM_REQ_MGR_SCHED_REQ_TIMEOUT         1000
+#define CAM_REQ_MGR_SIMULATE_SCHED_REQ        30
+#define CAM_REQ_MGR_DEFAULT_HDL_VAL           0
+
+#define FORCE_DISABLE_RECOVERY  2
+#define FORCE_ENABLE_RECOVERY   1
+#define AUTO_RECOVERY           0
+
+#define CRM_WORKQ_NUM_TASKS 60
+
+#define MAX_SYNC_COUNT 65535
+
+
+/* Default frame rate is 30 */
+#define DEFAULT_FRAME_DURATION 33333333
+
+#define INITIAL_IN_SYNC_REQ 5
+
+#define SYNC_LINK_SOF_CNT_MAX_LMT 1
+
+#define MAXIMUM_LINKS_CAPACITY     8
+
+#define MAXIMUM_LINKS_PER_SESSION  64
+
+#define MAXIMUM_RETRY_ATTEMPTS 3
+
+#define VERSION_1  1
+#define VERSION_2  2
+#define CAM_REQ_MGR_MAX_TRIGGERS   2
+
+#define REQ_MAXIMUM_BUBBLE_TIMES   2
+
+#define CAM_REQ_MGR_HALF_FRAME_DURATION(frame_duration) (frame_duration / 2)
+
+/* Number of words for dumping req state info*/
+#define CAM_CRM_DUMP_EVENT_NUM_WORDS  6
+
+/* Maximum length of tag while dumping */
+#define CAM_CRM_DUMP_TAG_MAX_LEN 128
+
+/* Number of headers in dumping req state info function*/
+#define CAM_CRM_DUMP_EVENT_NUM_HEADERS  2
+
+
+/**
+ * enum crm_workq_task_type
+ * @codes: to identify which type of task is present
+ */
+enum crm_workq_task_type {
+	CRM_WORKQ_TASK_GET_DEV_INFO,
+	CRM_WORKQ_TASK_SETUP_LINK,
+	CRM_WORKQ_TASK_DEV_ADD_REQ,
+	CRM_WORKQ_TASK_APPLY_REQ,
+	CRM_WORKQ_TASK_NOTIFY_SOF,
+	CRM_WORKQ_TASK_NOTIFY_EOF,
+	CRM_WORKQ_TASK_NOTIFY_ERR,
+	CRM_WORKQ_TASK_NOTIFY_FREEZE,
+	CRM_WORKQ_TASK_SCHED_REQ,
+	CRM_WORKQ_TASK_FLUSH_REQ,
+	CRM_WORKQ_TASK_INVALID,
+};
+
+/**
+ * struct crm_task_payload
+ * @type           : to identify which type of task is present
+ * @u              : union of payload of all types of tasks supported
+ * @sched_req      : contains info of  incoming reqest from CSL to CRM
+ * @flush_info     : contains info of cancelled reqest
+ * @dev_req        : contains tracking info of available req id at device
+ * @send_req       : contains info of apply settings to be sent to devs in link
+ * @notify_trigger : contains notification from IFE to CRM about trigger
+ * @notify_err     : contains error info happened while processing request
+ * -
+ */
+struct crm_task_payload {
+	enum crm_workq_task_type type;
+	union {
+		struct cam_req_mgr_sched_request_v2     sched_req;
+		struct cam_req_mgr_flush_info           flush_info;
+		struct cam_req_mgr_add_request          dev_req;
+		struct cam_req_mgr_send_request         send_req;
+		struct cam_req_mgr_trigger_notify       notify_trigger;
+		struct cam_req_mgr_error_notify         notify_err;
+	} u;
+};
+
+/**
+ * enum crm_req_state
+ * State machine for life cycle of request in pd table
+ * EMPTY   : indicates req slot is empty
+ * PENDING : indicates req slot is waiting for reqs from all devs
+ * READY   : indicates req slot is ready to be sent to devs
+ * INVALID : indicates req slot is not in valid state
+ */
+enum crm_req_state {
+	CRM_REQ_STATE_EMPTY,
+	CRM_REQ_STATE_PENDING,
+	CRM_REQ_STATE_READY,
+	CRM_REQ_STATE_INVALID,
+};
+
+/**
+ * enum crm_slot_status
+ * State machine for life cycle of request in input queue
+ * NO_REQ     : empty slot
+ * REQ_ADDED  : new entry in slot
+ * REQ_PENDING    : waiting for next trigger to apply
+ * REQ_READY      : req has ready
+ * REQ_APPLIED    : req is sent to all devices
+ * INVALID    : invalid state
+ */
+enum crm_slot_status {
+	CRM_SLOT_STATUS_NO_REQ,
+	CRM_SLOT_STATUS_REQ_ADDED,
+	CRM_SLOT_STATUS_REQ_PENDING,
+	CRM_SLOT_STATUS_REQ_READY,
+	CRM_SLOT_STATUS_REQ_APPLIED,
+	CRM_SLOT_STATUS_INVALID,
+};
+
+/**
+ * enum cam_req_mgr_link_state
+ * State machine for life cycle of link in crm
+ * AVAILABLE  : link available
+ * IDLE       : link initialized but not ready yet
+ * READY      : link is ready for use
+ * ERR        : link has encountered error
+ * MAX        : invalid state
+ */
+enum cam_req_mgr_link_state {
+	CAM_CRM_LINK_STATE_AVAILABLE,
+	CAM_CRM_LINK_STATE_IDLE,
+	CAM_CRM_LINK_STATE_READY,
+	CAM_CRM_LINK_STATE_ERR,
+	CAM_CRM_LINK_STATE_MAX,
+};
+
+/**
+ * enum cam_req_mgr_sync_type
+ * Sync type for syncing info
+ * DELAY_AT_SOF  : inject delay at SOF
+ * DELAY_AT_EOF  : inject delay at EOF
+ * APPLY_AT_EOF  : apply at EOF
+ */
+enum cam_req_mgr_sync_type {
+	CAM_SYNC_TYPE_DELAY_AT_SOF,
+	CAM_SYNC_TYPE_DELAY_AT_EOF,
+	CAM_SYNC_TYPE_APPLY_AT_EOF,
+};
+
+/**
+ * enum cam_req_mgr_req_state
+ * Request operation type for request state recording
+ * REQ_READY        : all packets for this request is added
+ * NOTIFY_TRIGGER   : request is triggered
+ * PROCESS_TRIGGER  : request is in trigger processing
+ * SEND_REQ         : CRM is sending request to each device
+ * NOTIFY_ERR       : request is notified an error
+ * PROCESS_ERR      : request is in error processing
+ * INVALID          : invalid state
+ */
+enum cam_req_mgr_req_state {
+	CAM_CRM_REQ_READY,
+	CAM_CRM_NOTIFY_TRIGGER,
+	CAM_CRM_PROCESS_TRIGGER,
+	CAM_CRM_SEND_REQ,
+	CAM_CRM_NOTIFY_ERR,
+	CAM_CRM_PROCESS_ERR,
+	CAM_CRM_STATE_INVALID,
+};
+
+/**
+ * struct cam_req_mgr_traverse_result
+ * @req_id        : Req id that is not ready
+ * @pd            : pipeline delay
+ * @masked_value  : Holds the dev bit for devices not ready
+ *                  for the given request
+ */
+struct cam_req_mgr_traverse_result {
+	int64_t  req_id;
+	uint32_t pd;
+	uint32_t masked_value;
+};
+
+/**
+ * struct cam_req_mgr_traverse
+ * @idx              : slot index
+ * @result           : contains which all tables were able to apply successfully
+ * @result_data      : holds the result of traverse in case it fails
+ * @tbl              : pointer of pipeline delay based request table
+ * @apply_data       : pointer which various tables will update during traverse
+ * @in_q             : input request queue pointer
+ * @validate_only    : Whether to validate only and/or update settings
+ * @open_req_cnt     : Count of open requests yet to be serviced in the kernel.
+ */
+struct cam_req_mgr_traverse {
+	int32_t                            idx;
+	uint32_t                           result;
+	struct cam_req_mgr_traverse_result result_data;
+	struct cam_req_mgr_req_tbl        *tbl;
+	struct cam_req_mgr_apply          *apply_data;
+	struct cam_req_mgr_req_queue      *in_q;
+	bool                               validate_only;
+	uint32_t                           open_req_cnt;
+};
+
+/**
+ * struct cam_req_mgr_apply
+ * @idx      : corresponding input queue slot index
+ * @pd       : pipeline delay of device
+ * @req_id   : req id for dev with above pd to process
+ * @skip_idx: skip applying settings when this is set.
+ */
+struct cam_req_mgr_apply {
+	int32_t idx;
+	int32_t pd;
+	int64_t req_id;
+	int32_t skip_idx;
+};
+
+/**
+ * struct crm_tbl_slot_special_ops
+ * @num_dev         : Number of devices need to be applied at this trigger point
+ * @dev_hdl         : Device handle who requested for special ops
+ * @apply_at_eof    : Boolean Identifier for request to be applied at EOF
+ * @is_applied      : Flag to identify if request is already applied to device
+ *                    in previous frame
+ * @skip_isp_apply  : Flag to indicate skip apply req for ISP
+ */
+struct crm_tbl_slot_special_ops {
+	uint32_t num_dev;
+	int32_t dev_hdl[MAX_DEV_FOR_SPECIAL_OPS];
+	bool apply_at_eof;
+	bool is_applied;
+	bool skip_isp_apply;
+};
+
+/**
+ * struct cam_req_mgr_tbl_slot
+ * @idx                 : slot index
+ * @req_ready_map       : mask tracking which all devices have request ready
+ * @req_apply_map       : mask tracking which all devices have request applied
+ * @state               : state machine for life cycle of a slot
+ * @inject_delay_at_sof : insert extra bubbling for flash type of use cases
+ * @inject_delay_at_eof : insert extra bubbling for flash type of use cases
+ * @ops                 : special operation for the table slot
+ *                        e.g.
+ *                        skip_next frame: in case of applying one device
+ *                        and skip others
+ *                        apply_at_eof: device that needs to apply at EOF
+ */
+struct cam_req_mgr_tbl_slot {
+	int32_t                                idx;
+	uint32_t                               req_ready_map;
+	uint32_t                               req_apply_map;
+	enum crm_req_state                     state;
+	uint32_t                               inject_delay_at_sof;
+	uint32_t                               inject_delay_at_eof;
+	struct  crm_tbl_slot_special_ops       ops;
+};
+
+/**
+ * struct cam_req_mgr_req_tbl
+ * @id            : table indetifier
+ * @pd            : pipeline delay of table
+ * @dev_count     : num of devices having same pipeline delay
+ * @dev_mask      : mask to track which devices are linked
+ * @skip_traverse : to indicate how many traverses need to be dropped
+ *                  by this table especially in the beginning or bubble recovery
+ * @next          : pointer to next pipeline delay request table
+ * @pd_delta      : differnce between this table's pipeline delay and next
+ * @num_slots     : number of request slots present in the table
+ * @slot          : array of slots tracking requests availability at devices
+ */
+struct cam_req_mgr_req_tbl {
+	int32_t                     id;
+	int32_t                     pd;
+	int32_t                     dev_count;
+	int32_t                     dev_mask;
+	int32_t                     skip_traverse;
+	struct cam_req_mgr_req_tbl *next;
+	int32_t                     pd_delta;
+	int32_t                     num_slots;
+	struct cam_req_mgr_tbl_slot slot[MAX_REQ_SLOTS];
+};
+
+/**
+ * struct cam_req_mgr_slot
+ * - Internal Book keeping
+ * @idx                : slot index
+ * @skip_idx           : if req id in this slot needs to be skipped/not applied
+ * @status             : state machine for life cycle of a slot
+ * - members updated due to external events
+ * @recover            : if user enabled recovery for this request.
+ * @req_id             : mask tracking which all devices have request ready
+ * @sync_mode          : Sync mode in which req id in this slot has to applied
+ * @additional_timeout : Adjusted watchdog timeout value associated with
+ * this request
+ * @recovery_counter   : Internal recovery counter
+ * @num_sync_links     : Num of sync links
+ * @sync_link_hdls     : Array of sync link handles
+ * @bubble_times       : times of bubbles the req happended
+ * @internal_recovered : indicate if internal recover is already done for request
+ * of this slot
+ */
+struct cam_req_mgr_slot {
+	int32_t               idx;
+	int32_t               skip_idx;
+	enum crm_slot_status  status;
+	int32_t               recover;
+	int64_t               req_id;
+	int32_t               sync_mode;
+	int32_t               additional_timeout;
+	int32_t               recovery_counter;
+	int32_t               num_sync_links;
+	int32_t               sync_link_hdls[MAXIMUM_LINKS_PER_SESSION - 1];
+	uint32_t              bubble_times;
+	bool                  internal_recovered;
+};
+
+/**
+ * struct cam_req_mgr_req_queue
+ * @num_slots   : max num of input queue slots
+ * @slot        : request slot holding incoming request id and bubble info.
+ * @rd_idx      : indicates slot index currently in process.
+ * @wr_idx      : indicates slot index to hold new upcoming req.
+ * @last_applied_idx : indicates slot index last applied successfully.
+ */
+struct cam_req_mgr_req_queue {
+	int32_t                     num_slots;
+	struct cam_req_mgr_slot     slot[MAX_REQ_SLOTS];
+	int32_t                     rd_idx;
+	int32_t                     wr_idx;
+	int32_t                     last_applied_idx;
+};
+
+/**
+ * struct cam_req_mgr_req_state_monitor
+ * @req_state    : operation type
+ * @req_id       : request id
+ * @dev_hdl      : to track which device is sending request
+ * @frame_id     : frame id
+ * @time_stamp   : the time stamp of the state
+ * @name         : device_name
+ */
+struct cam_req_mgr_state_monitor {
+	enum cam_req_mgr_req_state  req_state;
+	int64_t                     req_id;
+	int32_t                     dev_hdl;
+	int64_t                     frame_id;
+	struct timespec64           time_stamp;
+	char                        name[256];
+};
+
+/**
+ * struct cam_req_mgr_req_data
+ * @in_q                  : Poiner to Input request queue
+ * @l_tbl                 : unique pd request tables.
+ * @num_tbl               : how many unique pd value devices are present
+ * @apply_data            : Holds information about request id for a request
+ * @prev_apply_data       : Holds information about request id for a previous
+ *                          applied request
+ * @state_monitor         : used to track the request state in CRM
+ * @next_state_idx        : indicates index to hold new request state
+ * @lock                  : mutex lock protecting request data ops.
+ * @monitor_slock         : spin lock protecting state mointor variables
+ * @reset_link_spin_lock  : spin lock protecting link data ops when reset link
+ */
+struct cam_req_mgr_req_data {
+	struct cam_req_mgr_req_queue *in_q;
+	struct cam_req_mgr_req_tbl   *l_tbl;
+	int32_t                       num_tbl;
+	struct cam_req_mgr_apply      apply_data[CAM_PIPELINE_DELAY_MAX];
+	struct cam_req_mgr_apply      prev_apply_data[CAM_PIPELINE_DELAY_MAX];
+	struct cam_req_mgr_state_monitor state_monitor[
+		MAX_REQ_STATE_MONITOR_NUM];
+	int32_t                       next_state_idx;
+	struct mutex                  lock;
+	spinlock_t                    monitor_slock;
+	spinlock_t                    reset_link_spin_lock;
+};
+
+/**
+ * struct cam_req_mgr_connected_device
+ * - Device Properties
+ * @dev_hdl   : device handle
+ * @dev_bit   : unique bit assigned to device in link
+ * - Device characteristics
+ * @pd_tbl    : tracks latest available req id at this device
+ * @dev_info  : holds dev characteristics such as pipeline delay, dev name
+ * @ops       : holds func pointer to call methods on this device
+ * @parent    : pvt data - like link which this dev hdl belongs to
+ * @is_active : indicate whether device is active in auto shdr usecase
+ */
+struct cam_req_mgr_connected_device {
+	int32_t                         dev_hdl;
+	int64_t                         dev_bit;
+	struct cam_req_mgr_req_tbl     *pd_tbl;
+	struct cam_req_mgr_device_info  dev_info;
+	struct cam_req_mgr_kmd_ops     *ops;
+	void                           *parent;
+	bool                            is_active;
+};
+
+/**
+ * struct cam_req_mgr_core_link
+ * -  Link Properties
+ * @link_hdl             : Link identifier
+ * @num_devs             : num of connected devices to this link
+ * @max_delay            : Max of pipeline delay of all connected devs
+ * @min_delay            : Min of pipeline delay of all connected devs
+ * @max_mswitch_delay    : Max of modeswitch delay of all connected devs
+ * @min_mswitch_delay    : Min of modeswitch delay of all connected devs
+ * @workq                : Pointer to handle workq related jobs
+ * @pd_mask              : each set bit indicates the device with pd equal to
+ *                          bit position is available.
+ * - List of connected devices
+ * @l_dev                : List of connected devices to this link
+ * - Request handling data struct
+ * @req                  : req data holder.
+ * - Timer
+ * @watchdog             : watchdog timer to recover from sof freeze
+ * - Link private data
+ * @workq_comp           : conditional variable to block user thread for workq
+ *                          to finish schedule request processing
+ * @state                : link state machine
+ * @parent               : pvt data - link's parent is session
+ * @lock                 : mutex lock to guard link data operations
+ * @link_state_spin_lock : spin lock to protect link state variable
+ * @sync_link            : array of pointer to the sync link for synchronization
+ * @num_sync_links       : num of links sync associated with this link
+ * @sync_link_sof_skip   : flag determines if a pkt is not available for a given
+ *                         frame in a particular link skip corresponding
+ *                         frame in sync link as well.
+ * @open_req_cnt         : Counter to keep track of open requests that are yet
+ *                         to be serviced in the kernel.
+ * @last_flush_id        : Last request to flush
+ * @is_used              : 1 if link is in use else 0
+ * @is_master            : Based on pd among links, the link with the highest pd
+ *                         is assigned as master
+ * @initial_skip         : Flag to determine if slave has started streaming in
+ *                         master-slave sync
+ * @in_msync_mode        : Flag to determine if a link is in master-slave mode
+ * @initial_sync_req     : The initial req which is required to sync with the
+ *                         other link
+ * @retry_cnt            : Counter that tracks number of attempts to apply
+ *                         the same req
+ * @is_shutdown          : Flag to indicate if link needs to be disconnected
+ *                         as part of shutdown.
+ * @sof_timestamp_value  : SOF timestamp value
+ * @prev_sof_timestamp   : Previous SOF timestamp value
+ * @dual_trigger         : Links needs to wait for two triggers prior to
+ *                         applying the settings
+ * @trigger_cnt          : trigger count value per device initiating the trigger
+ * @eof_event_cnt        : Atomic variable to track the number of EOF requests
+ * @skip_init_frame      : skip initial frames crm_wd_timer validation in the
+ *                         case of long exposure use case
+ * @last_sof_trigger_jiffies : Record the jiffies of last sof trigger jiffies
+ * @wq_congestion        : Indicates if WQ congestion is detected or not
+ * @try_for_internal_recovery : If the link stalls try for RT internal recovery
+ * @properties_mask      : Indicates if current link enables some special properties
+ * @cont_empty_slots     : Continuous empty slots
+ * @is_shdr              : flag to indicate auto shdr usecase without SFE
+ * @wait_for_dual_trigger: Flag to indicate whether to wait for second epoch in dual trigger
+ */
+struct cam_req_mgr_core_link {
+	int32_t                              link_hdl;
+	int32_t                              num_devs;
+	enum cam_pipeline_delay              max_delay;
+	enum cam_pipeline_delay              min_delay;
+	enum cam_modeswitch_delay            max_mswitch_delay;
+	enum cam_modeswitch_delay            min_mswitch_delay;
+	struct cam_req_mgr_core_workq       *workq;
+	int32_t                              pd_mask;
+	struct cam_req_mgr_connected_device *l_dev;
+	struct cam_req_mgr_req_data          req;
+	struct cam_req_mgr_timer            *watchdog;
+	struct completion                    workq_comp;
+	enum cam_req_mgr_link_state          state;
+	void                                *parent;
+	struct mutex                         lock;
+	spinlock_t                           link_state_spin_lock;
+	struct cam_req_mgr_core_link
+			*sync_link[MAXIMUM_LINKS_PER_SESSION - 1];
+	int32_t                              num_sync_links;
+	bool                                 sync_link_sof_skip;
+	uint32_t                             open_req_cnt;
+	int64_t                              last_flush_id;
+	atomic_t                             is_used;
+	bool                                 is_master;
+	bool                                 initial_skip;
+	bool                                 in_msync_mode;
+	int64_t                              initial_sync_req;
+	uint32_t                             retry_cnt;
+	bool                                 is_shutdown;
+	uint64_t                             sof_timestamp;
+	uint64_t                             prev_sof_timestamp;
+	bool                                 dual_trigger;
+	uint32_t trigger_cnt[CAM_REQ_MGR_MAX_TRIGGERS]
+				[CAM_TRIGGER_MAX_POINTS + 1];
+	atomic_t                             eof_event_cnt;
+	bool                                 skip_init_frame;
+	uint64_t                             last_sof_trigger_jiffies;
+	bool                                 wq_congestion;
+	bool                                 try_for_internal_recovery;
+	bool                                 is_sending_req;
+	uint32_t                             properties_mask;
+	uint32_t                             cont_empty_slots;
+	bool                                 is_shdr;
+	bool                                 wait_for_dual_trigger;
+};
+
+/**
+ * struct cam_req_mgr_core_session
+ * - Session Properties
+ * @session_hdl        : session identifier
+ * @num_links          : num of active links for current session
+ * - Links of this session
+ * @links              : pointer to array of links within session
+ * - Session private data
+ * @entry              : pvt data - entry in the list of sessions
+ * @lock               : pvt data - spin lock to guard session data
+ * - Debug data
+ * @force_err_recovery : For debugging, we can force bubble recovery
+ *                       to be always ON or always OFF using debugfs.
+ * @sync_mode          : Sync mode for this session links
+ */
+struct cam_req_mgr_core_session {
+	int32_t                       session_hdl;
+	uint32_t                      num_links;
+	struct cam_req_mgr_core_link *links[MAXIMUM_LINKS_PER_SESSION];
+	struct list_head              entry;
+	struct mutex                  lock;
+	int32_t                       force_err_recovery;
+	int32_t                       sync_mode;
+};
+
+/**
+ * struct cam_req_mgr_core_device
+ * - Core camera request manager data struct
+ * @session_head : list head holding sessions
+ * @crm_lock     : mutex lock to protect session creation & destruction
+ * @recovery_on_apply_fail : Recovery on apply failure using debugfs.
+ */
+struct cam_req_mgr_core_device {
+	struct list_head             session_head;
+	struct mutex                 crm_lock;
+	bool                         recovery_on_apply_fail;
+};
+
+/**
+ * struct cam_req_mgr_req_tbl
+ * @id            : table indetifier
+ * @pd            : pipeline delay of table
+ * @dev_count     : num of devices having same pipeline delay
+ * @dev_mask      : mask to track which devices are linked
+ * @skip_traverse : to indicate how many traverses need to be dropped
+ *                  by this table especially in the beginning or bubble recovery
+ * @pd_delta      : differnce between this table's pipeline delay and next
+ * @num_slots     : number of request slots present in the table
+ * @slot          : array of slots tracking requests availability at devices
+ */
+struct cam_req_mgr_req_tbl_mini_dump {
+	int32_t                     id;
+	int32_t                     pd;
+	int32_t                     dev_count;
+	int32_t                     dev_mask;
+	int32_t                     skip_traverse;
+	int32_t                     pd_delta;
+	int32_t                     num_slots;
+	struct cam_req_mgr_tbl_slot slot[MAX_REQ_SLOTS];
+};
+
+/**
+ * struct cam_req_mgr_req_data_mini_dump
+ * @apply_data       : Holds information about request id for a request
+ * @prev_apply_data  : Holds information about request id for a previous
+ *                     applied request
+ * @in_q             : Poiner to Input request queue
+ * @l_tbl            : unique pd request tables.
+ * @num_tbl          : how many unique pd value devices are present
+ */
+struct cam_req_mgr_req_data_mini_dump {
+	struct cam_req_mgr_apply       apply_data[CAM_PIPELINE_DELAY_MAX];
+	struct cam_req_mgr_apply       prev_apply_data[CAM_PIPELINE_DELAY_MAX];
+	struct cam_req_mgr_req_queue   in_q;
+	struct cam_req_mgr_req_tbl_mini_dump l_tbl[4];
+	int32_t                              num_tbl;
+};
+
+/**
+ * struct cam_req_mgr_core_link_mini_dump
+ * @workq                : Work q information
+ * @req                  : req data holder.
+ * @initial_sync_req     : The initial req which is required to sync with the
+ * @prev_sof_timestamp   : Previous SOF timestamp value
+ * @last_flush_id        : Last request to flush
+ * @is_used              : 1 if link is in use else 0
+ * @eof_event_cnt        : Atomic variable to track the number of EOF requests
+ * @pd_mask              : each set bit indicates the device with pd equal to
+ * @num_sync_links       : num of links sync associated with this link
+ * @open_req_cnt         : Counter to keep track of open requests that are yet
+ *                         to be serviced in the kernel.
+ * @link_hdl             : Link identifier
+ * @num_devs             : num of connected devices to this link
+ * @max_delay            : Max of pipeline delay of all connected devs
+ *                          bit position is available.
+ * @state                : link state machine
+ * @dual_trigger         : Dual tirgger flag
+ * @is_shutdown          : Is shutting down
+ * @skip_init_frame      : skip initial frames crm_wd_timer validation in the
+ * @is_master            : Based on pd among links, the link with the highest pd
+ *                         is assigned as master
+ * @initial_skip         : Flag to determine if slave has started streaming in
+ *                         master-slave sync
+ * @in_m_sync_mode       : M-sync  mode flag
+ * @sync_link_sof_skip   : flag determines if a pkt is not available
+ * @wq_congestion        : Indicates if WQ congestion is detected or not
+ */
+struct cam_req_mgr_core_link_mini_dump {
+	struct cam_req_mgr_core_workq_mini_dump  workq;
+	struct cam_req_mgr_req_data_mini_dump    req;
+	int64_t                   initial_sync_req;
+	uint32_t                  last_flush_id;
+	uint32_t                  is_used;
+	uint32_t                  retry_cnt;
+	uint32_t                  eof_event_cnt;
+	int32_t                   pd_mask;
+	int32_t                   num_sync_links;
+	int32_t                   open_req_cnt;
+	int32_t                   link_hdl;
+	int32_t                   num_devs;
+	enum cam_pipeline_delay   max_delay;
+	enum cam_req_mgr_link_state   state;
+	bool                       dual_trigger;
+	bool                       is_shutdown;
+	bool                       skip_init_frame;
+	bool                       is_master;
+	bool                       initial_skip;
+	bool                       in_msync_mode;
+	bool                       sync_link_sof_skip;
+	bool                       wq_congestion;
+};
+
+/**
+ * struct cam_req_mgr_core_mini_dump
+ * @link             : Array of dumped links
+ * @num_link         : Number of links dumped
+ */
+struct cam_req_mgr_core_mini_dump {
+	struct cam_req_mgr_core_link_mini_dump *link[MAXIMUM_LINKS_PER_SESSION];
+	uint32_t num_link;
+};
+
+/**
+ * cam_req_mgr_create_session()
+ * @brief    : creates session
+ * @ses_info : output param for session handle
+ *
+ * called as part of session creation.
+ */
+int cam_req_mgr_create_session(struct cam_req_mgr_session_info *ses_info);
+
+/**
+ * cam_req_mgr_destroy_session()
+ * @brief    : destroy session
+ * @ses_info : session handle info, input param
+ * @is_shutdown: To indicate if devices on link need to be disconnected.
+ *
+ * Called as part of session destroy
+ * return success/failure
+ */
+int cam_req_mgr_destroy_session(struct cam_req_mgr_session_info *ses_info,
+	bool is_shutdown);
+
+/**
+ * cam_req_mgr_link()
+ * @brief     : creates a link for a session
+ * @link_info : handle and session info to create a link
+ *
+ * link is formed in a session for multiple devices. it creates
+ * a unique link handle for the link and is specific to a
+ * session. Returns link handle
+ */
+int cam_req_mgr_link(struct cam_req_mgr_ver_info *link_info);
+int cam_req_mgr_link_v2(struct cam_req_mgr_ver_info *link_info);
+
+
+/**
+ * cam_req_mgr_unlink()
+ * @brief       : destroy a link in a session
+ * @unlink_info : session and link handle info
+ *
+ * link is destroyed in a session
+ */
+int cam_req_mgr_unlink(struct cam_req_mgr_unlink_info *unlink_info);
+
+/**
+ * cam_req_mgr_schedule_request()
+ * @brief: Request is scheduled
+ * @sched_req: request id, session and link id info, bubble recovery info
+ */
+int cam_req_mgr_schedule_request(struct cam_req_mgr_sched_request *sched_req);
+
+/**
+ * cam_req_mgr_schedule_request_v2()
+ * @brief: Request is scheduled
+ * @sched_req: request id, session, link id info, bubble recovery info and sync info
+ */
+int cam_req_mgr_schedule_request_v2(struct cam_req_mgr_sched_request_v2 *sched_req);
+
+/**
+ * cam_req_mgr_sync_config()
+ * @brief: sync for links in a session
+ * @sync_info: session, links info and master link info
+ */
+int cam_req_mgr_sync_config(struct cam_req_mgr_sync_mode *sync_info);
+
+/**
+ * cam_req_mgr_flush_requests()
+ * @brief: flush all requests
+ * @flush_info: requests related to link and session
+ */
+int cam_req_mgr_flush_requests(struct cam_req_mgr_flush_info *flush_info);
+
+/**
+ * cam_req_mgr_core_device_init()
+ * @brief: initialize crm core
+ */
+int cam_req_mgr_core_device_init(void);
+
+/**
+ * cam_req_mgr_core_device_deinit()
+ * @brief: cleanp crm core
+ */
+int cam_req_mgr_core_device_deinit(void);
+
+/**
+ * cam_req_mgr_handle_core_shutdown()
+ * @brief: Handles camera close
+ */
+void cam_req_mgr_handle_core_shutdown(void);
+
+/**
+ * cam_req_mgr_link_control()
+ * @brief:   Handles link control operations
+ * @control: Link control command
+ */
+int cam_req_mgr_link_control(struct cam_req_mgr_link_control *control);
+
+/**
+ * cam_req_mgr_dump_request()
+ * @brief:   Dumps the request information
+ * @dump_req: Dump request
+ */
+int cam_req_mgr_dump_request(struct cam_dump_req_cmd *dump_req);
+
+/**
+ * cam_req_mgr_link_properties()
+ * @brief:   Handles link properties
+ * @properties: Link properties
+ */
+int cam_req_mgr_link_properties(struct cam_req_mgr_link_properties *properties);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_core_defs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_core_defs.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_REQ_MGR_CORE_DEFS_H_
+#define _CAM_REQ_MGR_CORE_DEFS_H_
+
+#define CRM_TRACE_ENABLE 0
+#define CRM_DEBUG_MUTEX 0
+
+#define SET_SUCCESS_BIT(ret, pd)  (ret |= (1 << (pd)))
+
+#define SET_FAILURE_BIT(ret, pd)  (ret &= (~(1 << (pd))))
+
+#define CRM_GET_REQ_ID(in_q, idx) in_q->slot[idx].req_id
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_debug.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_debug.c
@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_req_mgr_debug.h"
+
+#define MAX_SESS_INFO_LINE_BUFF_LEN 256
+
+static char sess_info_buffer[MAX_SESS_INFO_LINE_BUFF_LEN];
+static int cam_debug_mgr_delay_detect;
+
+static int cam_req_mgr_debug_set_bubble_recovery(void *data, u64 val)
+{
+	struct cam_req_mgr_core_device  *core_dev = data;
+	struct cam_req_mgr_core_session *session;
+	int rc = 0;
+
+	mutex_lock(&core_dev->crm_lock);
+
+	if (!list_empty(&core_dev->session_head)) {
+		list_for_each_entry(session,
+			&core_dev->session_head, entry) {
+			session->force_err_recovery = val;
+		}
+	}
+
+	mutex_unlock(&core_dev->crm_lock);
+
+	return rc;
+}
+
+static int cam_req_mgr_debug_get_bubble_recovery(void *data, u64 *val)
+{
+	struct cam_req_mgr_core_device *core_dev = data;
+	struct cam_req_mgr_core_session *session;
+
+	mutex_lock(&core_dev->crm_lock);
+
+	if (!list_empty(&core_dev->session_head)) {
+		session = list_first_entry(&core_dev->session_head,
+			struct cam_req_mgr_core_session,
+			entry);
+		*val = session->force_err_recovery;
+	}
+	mutex_unlock(&core_dev->crm_lock);
+
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(bubble_recovery, cam_req_mgr_debug_get_bubble_recovery,
+	cam_req_mgr_debug_set_bubble_recovery, "%lld\n");
+
+static int session_info_open(struct inode *inode, struct file *file)
+{
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+static ssize_t session_info_read(struct file *t_file, char *t_char,
+	size_t t_size_t, loff_t *t_loff_t)
+{
+	int i;
+	char *out_buffer = sess_info_buffer;
+	char line_buffer[MAX_SESS_INFO_LINE_BUFF_LEN] = {0};
+	struct cam_req_mgr_core_device *core_dev =
+		(struct cam_req_mgr_core_device *) t_file->private_data;
+	struct cam_req_mgr_core_session *session;
+
+	memset(out_buffer, 0, MAX_SESS_INFO_LINE_BUFF_LEN);
+
+	mutex_lock(&core_dev->crm_lock);
+
+	if (!list_empty(&core_dev->session_head)) {
+		list_for_each_entry(session,
+			&core_dev->session_head, entry) {
+			snprintf(line_buffer, sizeof(line_buffer),
+				"session_hdl = %x \t"
+				"num_links = %d\n",
+				session->session_hdl, session->num_links);
+			strlcat(out_buffer, line_buffer,
+				sizeof(sess_info_buffer));
+			for (i = 0; i < session->num_links; i++) {
+				snprintf(line_buffer, sizeof(line_buffer),
+					"link_hdl[%d] = 0x%x, num_devs connected = %d\n",
+					i, session->links[i]->link_hdl,
+					session->links[i]->num_devs);
+				strlcat(out_buffer, line_buffer,
+					sizeof(sess_info_buffer));
+			}
+		}
+	}
+
+	mutex_unlock(&core_dev->crm_lock);
+
+	return simple_read_from_buffer(t_char, t_size_t,
+		t_loff_t, out_buffer, strlen(out_buffer));
+}
+
+static ssize_t session_info_write(struct file *t_file,
+	const char *t_char, size_t t_size_t, loff_t *t_loff_t)
+{
+	memset(sess_info_buffer, 0, MAX_SESS_INFO_LINE_BUFF_LEN);
+
+	return 0;
+}
+
+static const struct file_operations session_info = {
+	.open = session_info_open,
+	.read = session_info_read,
+	.write = session_info_write,
+};
+
+static struct dentry *debugfs_root;
+int cam_req_mgr_debug_register(struct cam_req_mgr_core_device *core_dev)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("req_mgr", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_MEM,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	debugfs_root = dbgfileptr;
+
+	debugfs_create_file("sessions_info", 0644, debugfs_root,
+		core_dev, &session_info);
+	debugfs_create_file("bubble_recovery", 0644,
+		debugfs_root, core_dev, &bubble_recovery);
+	debugfs_create_bool("recovery_on_apply_fail", 0644,
+		debugfs_root, &core_dev->recovery_on_apply_fail);
+	debugfs_create_u32("delay_detect_count", 0644, debugfs_root,
+		&cam_debug_mgr_delay_detect);
+end:
+	return rc;
+}
+
+int cam_req_mgr_debug_unregister(void)
+{
+	debugfs_root = NULL;
+	return 0;
+}
+
+void cam_req_mgr_debug_delay_detect(void)
+{
+	cam_debug_mgr_delay_detect += 1;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_debug.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_debug.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_DEBUG_H_
+#define _CAM_REQ_MGR_DEBUG_H_
+
+#include <linux/debugfs.h>
+#include "cam_req_mgr_core.h"
+#include "cam_debug_util.h"
+
+int cam_req_mgr_debug_register(struct cam_req_mgr_core_device *core_dev);
+int cam_req_mgr_debug_unregister(void);
+
+/* cam_req_mgr_debug_delay_detect()
+ * @brief    : increment debug_fs varaible by 1 whenever delay occurred.
+ */
+void cam_req_mgr_debug_delay_detect(void);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_dev.c
@@ -0,0 +1,1179 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/highmem.h>
+#include <linux/types.h>
+#include <linux/rwsem.h>
+
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_defs.h>
+
+#include "cam_req_mgr_dev.h"
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_core.h"
+#include "cam_subdev.h"
+#include "cam_mem_mgr.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+#include "cam_cpas_hw.h"
+#include "cam_compat.h"
+#include "camera_main.h"
+
+#define CAM_REQ_MGR_EVENT_MAX 30
+#define CAM_I3C_MASTER_COMPAT "qcom,geni-i3c"
+
+static struct cam_req_mgr_device g_dev;
+struct kmem_cache *g_cam_req_mgr_timer_cachep;
+static struct list_head cam_req_mgr_ordered_sd_list;
+
+DECLARE_RWSEM(rwsem_lock);
+
+static struct device_attribute camera_debug_sysfs_attr =
+	__ATTR(debug_node, 0600, NULL, cam_debug_sysfs_node_store);
+
+static const struct of_device_id cam_sensor_module_dt_match[] = {
+	{.compatible = "qcom,cam-sensor"},
+	{ .compatible = "qcom,eeprom" },
+	{.compatible = "qcom,actuator"},
+	{ .compatible = "qcom,ois" },
+	{.compatible = "qcom,camera-flash", .data = NULL},
+	{}
+};
+
+static int cam_media_device_setup(struct device *dev)
+{
+	int rc;
+
+	g_dev.v4l2_dev->mdev = kzalloc(sizeof(*g_dev.v4l2_dev->mdev),
+		GFP_KERNEL);
+	if (!g_dev.v4l2_dev->mdev) {
+		rc = -ENOMEM;
+		goto mdev_fail;
+	}
+
+	media_device_init(g_dev.v4l2_dev->mdev);
+	g_dev.v4l2_dev->mdev->dev = dev;
+	strscpy(g_dev.v4l2_dev->mdev->model, CAM_REQ_MGR_VNODE_NAME,
+		sizeof(g_dev.v4l2_dev->mdev->model));
+
+	rc = media_device_register(g_dev.v4l2_dev->mdev);
+	if (rc)
+		goto media_fail;
+
+	return rc;
+
+media_fail:
+	kfree(g_dev.v4l2_dev->mdev);
+	g_dev.v4l2_dev->mdev = NULL;
+mdev_fail:
+	return rc;
+}
+
+static void cam_media_device_cleanup(void)
+{
+	media_device_unregister(g_dev.v4l2_dev->mdev);
+	media_device_cleanup(g_dev.v4l2_dev->mdev);
+	kfree(g_dev.v4l2_dev->mdev);
+	g_dev.v4l2_dev->mdev = NULL;
+}
+
+static int cam_v4l2_device_setup(struct device *dev)
+{
+	int rc;
+
+	g_dev.v4l2_dev = kzalloc(sizeof(*g_dev.v4l2_dev),
+		GFP_KERNEL);
+	if (!g_dev.v4l2_dev)
+		return -ENOMEM;
+
+	rc = v4l2_device_register(dev, g_dev.v4l2_dev);
+	if (rc)
+		goto reg_fail;
+
+	return rc;
+
+reg_fail:
+	kfree(g_dev.v4l2_dev);
+	g_dev.v4l2_dev = NULL;
+	return rc;
+}
+
+static void cam_v4l2_device_cleanup(void)
+{
+	v4l2_device_unregister(g_dev.v4l2_dev);
+	kfree(g_dev.v4l2_dev);
+	g_dev.v4l2_dev = NULL;
+}
+
+void cam_req_mgr_rwsem_read_op(enum cam_subdev_rwsem lock)
+{
+	if (lock == CAM_SUBDEV_LOCK)
+		down_read(&rwsem_lock);
+	else if (lock == CAM_SUBDEV_UNLOCK)
+		up_read(&rwsem_lock);
+}
+
+static void cam_req_mgr_rwsem_write_op(enum cam_subdev_rwsem lock)
+{
+	if (lock == CAM_SUBDEV_LOCK)
+		down_write(&rwsem_lock);
+	else if (lock == CAM_SUBDEV_UNLOCK)
+		up_write(&rwsem_lock);
+}
+
+static int cam_req_mgr_open(struct file *filep)
+{
+	int rc;
+
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK);
+
+	mutex_lock(&g_dev.cam_lock);
+	if (g_dev.open_cnt >= 1) {
+		rc = -EALREADY;
+		goto end;
+	}
+
+	rc = v4l2_fh_open(filep);
+	if (rc) {
+		CAM_ERR(CAM_CRM, "v4l2_fh_open failed: %d", rc);
+		goto end;
+	}
+
+	spin_lock_bh(&g_dev.cam_eventq_lock);
+	g_dev.cam_eventq = filep->private_data;
+	spin_unlock_bh(&g_dev.cam_eventq_lock);
+
+	g_dev.open_cnt++;
+	rc = cam_mem_mgr_init();
+	if (rc) {
+		g_dev.open_cnt--;
+		CAM_ERR(CAM_CRM, "mem mgr init failed");
+		goto mem_mgr_init_fail;
+	}
+
+	mutex_unlock(&g_dev.cam_lock);
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
+	return rc;
+
+mem_mgr_init_fail:
+	v4l2_fh_release(filep);
+end:
+	mutex_unlock(&g_dev.cam_lock);
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
+	return rc;
+}
+
+static unsigned int cam_req_mgr_poll(struct file *f,
+	struct poll_table_struct *pll_table)
+{
+	int rc = 0;
+	struct v4l2_fh *eventq = f->private_data;
+
+	if (!eventq)
+		return -EINVAL;
+
+	poll_wait(f, &eventq->wait, pll_table);
+	if (v4l2_event_pending(eventq))
+		rc = POLLPRI;
+
+	return rc;
+}
+
+static int cam_req_mgr_close(struct file *filep)
+{
+	struct v4l2_subdev *sd;
+	struct cam_subdev *csd;
+	struct v4l2_fh *vfh = filep->private_data;
+	struct v4l2_subdev_fh *subdev_fh = to_v4l2_subdev_fh(vfh);
+
+	CAM_WARN(CAM_CRM,
+		"release invoked associated userspace process has died, open_cnt: %d",
+		g_dev.open_cnt);
+
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK);
+
+	mutex_lock(&g_dev.cam_lock);
+
+	if (g_dev.open_cnt <= 0) {
+		mutex_unlock(&g_dev.cam_lock);
+		cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
+		return -EINVAL;
+	}
+
+	cam_req_mgr_handle_core_shutdown();
+	g_dev.shutdown_state = true;
+
+	list_for_each_entry(csd, &cam_req_mgr_ordered_sd_list, list) {
+		sd = &csd->sd;
+		if (!(sd->flags & V4L2_SUBDEV_FL_HAS_DEVNODE))
+			continue;
+		if (sd->internal_ops) {
+			CAM_DBG(CAM_CRM, "Invoke subdev close for device %s",
+				sd->name);
+			v4l2_subdev_call(sd, core, ioctl,
+				CAM_SD_SHUTDOWN, subdev_fh);
+		}
+	}
+
+	g_dev.open_cnt--;
+	g_dev.shutdown_state = false;
+	v4l2_fh_release(filep);
+
+	spin_lock_bh(&g_dev.cam_eventq_lock);
+	g_dev.cam_eventq = NULL;
+	spin_unlock_bh(&g_dev.cam_eventq_lock);
+
+	cam_req_mgr_util_free_hdls();
+	cam_mem_mgr_deinit();
+	mutex_unlock(&g_dev.cam_lock);
+
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
+
+	return 0;
+}
+
+static struct v4l2_file_operations g_cam_fops = {
+	.owner  = THIS_MODULE,
+	.open   = cam_req_mgr_open,
+	.poll   = cam_req_mgr_poll,
+	.release = cam_req_mgr_close,
+	.unlocked_ioctl   = video_ioctl2,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = video_ioctl2,
+#endif
+};
+
+static void cam_v4l2_event_queue_notify_error(const struct v4l2_event *old,
+	struct v4l2_event *new)
+{
+	struct cam_req_mgr_message *ev_header;
+
+	ev_header = CAM_REQ_MGR_GET_PAYLOAD_PTR((*old),
+		struct cam_req_mgr_message);
+
+	switch (old->id) {
+	case V4L_EVENT_CAM_REQ_MGR_SOF:
+	case V4L_EVENT_CAM_REQ_MGR_SOF_BOOT_TS:
+	case V4L_EVENT_CAM_REQ_MGR_SOF_UNIFIED_TS:
+		if (ev_header->u.frame_msg.request_id)
+			CAM_ERR(CAM_CRM,
+				"Failed to notify %s Sess %X FrameId %lld FrameMeta %d ReqId %lld link %X",
+				((old->id == V4L_EVENT_CAM_REQ_MGR_SOF) ?
+				"SOF_TS" : ((old->id == V4L_EVENT_CAM_REQ_MGR_SOF_BOOT_TS) ?
+				"BOOT_TS" : "UNIFIED_TS")),
+				ev_header->session_hdl,
+				ev_header->u.frame_msg.frame_id,
+				ev_header->u.frame_msg.frame_id_meta,
+				ev_header->u.frame_msg.request_id,
+				ev_header->u.frame_msg.link_hdl);
+		else
+			CAM_WARN_RATE_LIMIT_CUSTOM(CAM_CRM, 5, 1,
+				"Failed to notify %s Sess %X FrameId %lld FrameMeta %d ReqId %lld link %X",
+				((old->id == V4L_EVENT_CAM_REQ_MGR_SOF) ?
+				"SOF_TS" : ((old->id == V4L_EVENT_CAM_REQ_MGR_SOF_BOOT_TS) ?
+				"BOOT_TS" : "UNIFIED_TS")),
+				ev_header->session_hdl,
+				ev_header->u.frame_msg.frame_id,
+				ev_header->u.frame_msg.frame_id_meta,
+				ev_header->u.frame_msg.request_id,
+				ev_header->u.frame_msg.link_hdl);
+		break;
+	case V4L_EVENT_CAM_REQ_MGR_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_CRM,
+			"Failed to notify ERROR Sess %X ReqId %d Link %X Type %d ERR_code: %u",
+			ev_header->session_hdl,
+			ev_header->u.err_msg.request_id,
+			ev_header->u.err_msg.link_hdl,
+			ev_header->u.err_msg.error_type,
+			ev_header->u.err_msg.error_code);
+		break;
+	case V4L_EVENT_CAM_REQ_MGR_NODE_EVENT:
+		CAM_ERR_RATE_LIMIT(CAM_CRM,
+			"Failed to notify node event. Sess 0x%x ReqId %d Lnk 0x%x dev_hdl: %d evt_type: %u evt_cause: %u",
+			ev_header->session_hdl,
+			ev_header->u.node_msg.request_id,
+			ev_header->u.node_msg.link_hdl,
+			ev_header->u.node_msg.device_hdl,
+			ev_header->u.node_msg.event_type,
+			ev_header->u.node_msg.event_cause);
+		break;
+	default:
+		CAM_ERR(CAM_CRM, "Failed to notify crm event id %d",
+			old->id);
+	}
+}
+
+static struct v4l2_subscribed_event_ops g_cam_v4l2_ops = {
+	.merge = cam_v4l2_event_queue_notify_error,
+};
+
+static int cam_subscribe_event(struct v4l2_fh *fh,
+	const struct v4l2_event_subscription *sub)
+{
+	g_dev.v4l2_sub_ids |= 1 << sub->id;
+	return v4l2_event_subscribe(fh, sub, CAM_REQ_MGR_EVENT_MAX,
+		&g_cam_v4l2_ops);
+}
+
+uint32_t cam_req_mgr_get_id_subscribed(void)
+{
+	return g_dev.v4l2_sub_ids;
+}
+EXPORT_SYMBOL(cam_req_mgr_get_id_subscribed);
+
+static int cam_unsubscribe_event(struct v4l2_fh *fh,
+	const struct v4l2_event_subscription *sub)
+{
+	g_dev.v4l2_sub_ids &= ~(1 << sub->id);
+	return v4l2_event_unsubscribe(fh, sub);
+}
+
+static long cam_private_ioctl(struct file *file, void *fh,
+	bool valid_prio, unsigned int cmd, void *arg)
+{
+	int rc = 0;
+	struct cam_control *k_ioctl;
+
+	if ((!arg) || (cmd != VIDIOC_CAM_CONTROL))
+		return -EINVAL;
+
+	k_ioctl = (struct cam_control *)arg;
+
+	if (!k_ioctl->handle)
+		return -EINVAL;
+
+	switch (k_ioctl->op_code) {
+	case CAM_REQ_MGR_CREATE_SESSION: {
+		struct cam_req_mgr_session_info ses_info;
+
+		if (k_ioctl->size != sizeof(ses_info))
+			return -EINVAL;
+
+		if (copy_from_user(&ses_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_session_info))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_create_session(&ses_info);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&ses_info,
+				sizeof(struct cam_req_mgr_session_info)))
+				rc = -EFAULT;
+		}
+		break;
+
+	case CAM_REQ_MGR_DESTROY_SESSION: {
+		struct cam_req_mgr_session_info ses_info;
+
+		if (k_ioctl->size != sizeof(ses_info))
+			return -EINVAL;
+
+		if (copy_from_user(&ses_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_session_info))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_destroy_session(&ses_info, false);
+		}
+		break;
+
+	case CAM_REQ_MGR_LINK: {
+		struct cam_req_mgr_ver_info ver_info;
+
+		if (k_ioctl->size != sizeof(ver_info.u.link_info_v1))
+			return -EINVAL;
+
+		if (copy_from_user(&ver_info.u.link_info_v1,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_link_info))) {
+			return -EFAULT;
+		}
+		ver_info.version = VERSION_1;
+		rc = cam_req_mgr_link(&ver_info);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&ver_info.u.link_info_v1,
+				sizeof(struct cam_req_mgr_link_info)))
+				rc = -EFAULT;
+		}
+		break;
+
+	case CAM_REQ_MGR_LINK_V2: {
+		struct cam_req_mgr_ver_info ver_info;
+
+		if (k_ioctl->size != sizeof(ver_info.u.link_info_v2))
+			return -EINVAL;
+
+		if (copy_from_user(&ver_info.u.link_info_v2,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_link_info_v2))) {
+			return -EFAULT;
+		}
+
+		ver_info.version = VERSION_2;
+		rc = cam_req_mgr_link_v2(&ver_info);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&ver_info.u.link_info_v2,
+				sizeof(struct cam_req_mgr_link_info_v2)))
+				rc = -EFAULT;
+			}
+		break;
+
+	case CAM_REQ_MGR_UNLINK: {
+		struct cam_req_mgr_unlink_info unlink_info;
+
+		if (k_ioctl->size != sizeof(unlink_info))
+			return -EINVAL;
+
+		if (copy_from_user(&unlink_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_unlink_info))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_unlink(&unlink_info);
+		}
+		break;
+
+	case CAM_REQ_MGR_SCHED_REQ: {
+		struct cam_req_mgr_sched_request sched_req;
+
+		if (k_ioctl->size != sizeof(sched_req))
+			return -EINVAL;
+
+		if (copy_from_user(&sched_req,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_sched_request))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_schedule_request(&sched_req);
+		}
+		break;
+
+	case CAM_REQ_MGR_SCHED_REQ_V2: {
+		struct cam_req_mgr_sched_request_v2 sched_req;
+
+		if (k_ioctl->size != sizeof(sched_req))
+			return -EINVAL;
+
+		if (copy_from_user(&sched_req,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_sched_request_v2))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_schedule_request_v2(&sched_req);
+		}
+		break;
+
+	case CAM_REQ_MGR_FLUSH_REQ: {
+		struct cam_req_mgr_flush_info flush_info;
+
+		if (k_ioctl->size != sizeof(flush_info))
+			return -EINVAL;
+
+		if (copy_from_user(&flush_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_flush_info))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_flush_requests(&flush_info);
+		}
+		break;
+
+	case CAM_REQ_MGR_SYNC_MODE: {
+		struct cam_req_mgr_sync_mode sync_info;
+
+		if (k_ioctl->size != sizeof(sync_info))
+			return -EINVAL;
+
+		if (copy_from_user(&sync_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_sync_mode))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_sync_config(&sync_info);
+		}
+		break;
+
+	case CAM_REQ_MGR_ALLOC_BUF: {
+		struct cam_mem_mgr_alloc_cmd cmd;
+		struct cam_mem_mgr_alloc_cmd_v2 cmd_v2 = {0};
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_alloc_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		strscpy(cmd_v2.buf_name, "UNKNOWN", CAM_DMA_BUF_NAME_LEN);
+		memcpy(cmd_v2.mmu_hdls, cmd.mmu_hdls,
+			sizeof(__s32) * CAM_MEM_MMU_MAX_HANDLE);
+		cmd_v2.num_hdl = cmd.num_hdl;
+		cmd_v2.flags = cmd.flags;
+		cmd_v2.len = cmd.len;
+		cmd_v2.align = cmd.align;
+
+		rc = cam_mem_mgr_alloc_and_map(&cmd_v2);
+		memcpy(&cmd.out, &cmd_v2.out, sizeof(cmd.out));
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&cmd, sizeof(struct cam_mem_mgr_alloc_cmd))) {
+				rc = -EFAULT;
+				break;
+			}
+		}
+		break;
+	case CAM_REQ_MGR_ALLOC_BUF_V2: {
+		struct cam_mem_mgr_alloc_cmd_v2 cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_alloc_cmd_v2))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_mem_mgr_alloc_and_map(&cmd);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&cmd, sizeof(struct cam_mem_mgr_alloc_cmd_v2))) {
+				rc = -EFAULT;
+				break;
+			}
+		}
+		break;
+	case CAM_REQ_MGR_MAP_BUF: {
+		struct cam_mem_mgr_map_cmd cmd;
+		struct cam_mem_mgr_map_cmd_v2 cmd_v2 = {0};
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_map_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		strscpy(cmd_v2.buf_name, "UNKNOWN", CAM_DMA_BUF_NAME_LEN);
+		memcpy(cmd_v2.mmu_hdls, cmd.mmu_hdls,
+			sizeof(__s32) * CAM_MEM_MMU_MAX_HANDLE);
+		cmd_v2.num_hdl = cmd.num_hdl;
+		cmd_v2.flags = cmd.flags;
+		cmd_v2.fd = cmd.fd;
+
+		rc = cam_mem_mgr_map(&cmd_v2);
+		memcpy(&cmd.out, &cmd_v2.out, sizeof(cmd.out));
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&cmd, sizeof(struct cam_mem_mgr_map_cmd))) {
+				rc = -EFAULT;
+				break;
+			}
+		}
+		break;
+	case CAM_REQ_MGR_MAP_BUF_V2: {
+		struct cam_mem_mgr_map_cmd_v2 cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_map_cmd_v2))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_mem_mgr_map(&cmd);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&cmd, sizeof(struct cam_mem_mgr_map_cmd_v2))) {
+				rc = -EFAULT;
+				break;
+			}
+		}
+		break;
+	case CAM_REQ_MGR_RELEASE_BUF: {
+		struct cam_mem_mgr_release_cmd cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_release_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_mem_mgr_release(&cmd);
+		}
+		break;
+	case CAM_REQ_MGR_CACHE_OPS: {
+		struct cam_mem_cache_ops_cmd cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_cache_ops_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_mem_mgr_cache_ops(&cmd);
+		}
+		break;
+	case CAM_REQ_MGR_MEM_CPU_ACCESS_OP: {
+		struct cam_mem_cpu_access_op cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_cpu_access_op))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_mem_mgr_cpu_access_op(&cmd);
+		if (rc)
+			rc = -EINVAL;
+		}
+		break;
+	case CAM_REQ_MGR_LINK_CONTROL: {
+		struct cam_req_mgr_link_control cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_link_control))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_req_mgr_link_control(&cmd);
+		if (rc)
+			rc = -EINVAL;
+		}
+		break;
+	case CAM_REQ_MGR_REQUEST_DUMP: {
+		struct cam_dump_req_cmd cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_dump_req_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+		rc = cam_req_mgr_dump_request(&cmd);
+		if (rc) {
+			CAM_ERR(CAM_CORE, "dump fail for dev %d req %llu rc %d",
+				cmd.dev_handle, cmd.issue_req_id, rc);
+			break;
+		}
+		if (copy_to_user(
+			u64_to_user_ptr(k_ioctl->handle),
+			&cmd, sizeof(struct cam_dump_req_cmd)))
+			rc = -EFAULT;
+		}
+		break;
+	case CAM_REQ_MGR_LINK_PROPERTIES: {
+		struct cam_req_mgr_link_properties cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_link_properties))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_req_mgr_link_properties(&cmd);
+		}
+		break;
+	case CAM_REQ_MGR_QUERY_CAP: {
+		struct cam_req_mgr_query_cap cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_query_cap))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		cmd.feature_mask = 0;
+
+		rc = cam_mem_mgr_check_for_supported_heaps(&cmd.feature_mask);
+		if (rc) {
+			CAM_ERR(CAM_CRM, "Failed to retrieve heap capability rc: %d", rc);
+			break;
+		}
+
+		if (copy_to_user(
+			u64_to_user_ptr(k_ioctl->handle),
+			&cmd, sizeof(struct cam_req_mgr_query_cap)))
+			rc = -EFAULT;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_CRM, "Invalid Opcode %d", k_ioctl->op_code);
+		rc = -ENOIOCTLCMD;
+	}
+
+	return rc;
+}
+
+static const struct v4l2_ioctl_ops g_cam_ioctl_ops = {
+	.vidioc_subscribe_event = cam_subscribe_event,
+	.vidioc_unsubscribe_event = cam_unsubscribe_event,
+	.vidioc_default = cam_private_ioctl,
+};
+
+static int cam_video_device_setup(void)
+{
+	int rc;
+
+	g_dev.video = video_device_alloc();
+	if (!g_dev.video) {
+		rc = -ENOMEM;
+		goto video_fail;
+	}
+
+	g_dev.video->v4l2_dev = g_dev.v4l2_dev;
+
+	strscpy(g_dev.video->name, "cam-req-mgr",
+		sizeof(g_dev.video->name));
+	g_dev.video->release = video_device_release_empty;
+	g_dev.video->fops = &g_cam_fops;
+	g_dev.video->ioctl_ops = &g_cam_ioctl_ops;
+	g_dev.video->minor = -1;
+	g_dev.video->vfl_type = VFL_TYPE_VIDEO;
+	g_dev.video->device_caps |= V4L2_CAP_VIDEO_CAPTURE;
+	rc = video_register_device(g_dev.video, VFL_TYPE_VIDEO, -1);
+	if (rc) {
+		CAM_ERR(CAM_CRM,
+			"video device registration failure rc = %d, name = %s, device_caps = %d",
+			rc, g_dev.video->name, g_dev.video->device_caps);
+		goto v4l2_fail;
+	}
+
+	rc = media_entity_pads_init(&g_dev.video->entity, 0, NULL);
+	if (rc)
+		goto entity_fail;
+
+	g_dev.video->entity.function = CAM_VNODE_DEVICE_TYPE;
+	g_dev.video->entity.name = video_device_node_name(g_dev.video);
+
+	return rc;
+
+entity_fail:
+	video_unregister_device(g_dev.video);
+v4l2_fail:
+	video_device_release(g_dev.video);
+	g_dev.video = NULL;
+video_fail:
+	return rc;
+}
+
+int cam_req_mgr_notify_message(struct cam_req_mgr_message *msg,
+	uint32_t id,
+	uint32_t type)
+{
+	struct v4l2_event event;
+	struct cam_req_mgr_message *ev_header;
+
+	if (!msg)
+		return -EINVAL;
+
+	event.id = id;
+	event.type = type;
+	ev_header = CAM_REQ_MGR_GET_PAYLOAD_PTR(event,
+		struct cam_req_mgr_message);
+	memcpy(ev_header, msg, sizeof(struct cam_req_mgr_message));
+	v4l2_event_queue(g_dev.video, &event);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_req_mgr_notify_message);
+
+void cam_video_device_cleanup(void)
+{
+	media_entity_cleanup(&g_dev.video->entity);
+	video_unregister_device(g_dev.video);
+	video_device_release(g_dev.video);
+	g_dev.video = NULL;
+}
+
+void cam_subdev_notify_message(u32 subdev_type,
+		enum cam_subdev_message_type_t message_type,
+		void *data)
+{
+	struct v4l2_subdev *sd = NULL;
+	struct cam_subdev *csd = NULL;
+
+	list_for_each_entry(sd, &g_dev.v4l2_dev->subdevs, list) {
+		if (sd->entity.function == subdev_type) {
+			csd = container_of(sd, struct cam_subdev, sd);
+			if (csd->msg_cb != NULL)
+				csd->msg_cb(sd, message_type, data);
+		}
+	}
+}
+EXPORT_SYMBOL(cam_subdev_notify_message);
+
+bool cam_req_mgr_is_open(void)
+{
+	bool crm_status = false;
+
+	mutex_lock(&g_dev.cam_lock);
+	crm_status = g_dev.open_cnt ? true : false;
+	mutex_unlock(&g_dev.cam_lock);
+
+	return crm_status;
+}
+EXPORT_SYMBOL(cam_req_mgr_is_open);
+
+bool cam_req_mgr_is_shutdown(void)
+{
+	return g_dev.shutdown_state;
+}
+EXPORT_SYMBOL(cam_req_mgr_is_shutdown);
+
+int cam_register_subdev(struct cam_subdev *csd)
+{
+	struct v4l2_subdev *sd;
+	int rc;
+
+	if (!g_dev.state) {
+		CAM_DBG(CAM_CRM, "camera root device not ready yet");
+		return -EPROBE_DEFER;
+	}
+
+	if (!csd || !csd->name) {
+		CAM_ERR(CAM_CRM, "invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_dev.dev_lock);
+
+	sd = &csd->sd;
+	v4l2_subdev_init(sd, csd->ops);
+	sd->internal_ops = csd->internal_ops;
+	snprintf(sd->name, sizeof(sd->name), "%s", csd->name);
+	v4l2_set_subdevdata(sd, csd->token);
+
+	sd->flags = csd->sd_flags;
+	sd->entity.num_pads = 0;
+	sd->entity.pads = NULL;
+	sd->entity.function = csd->ent_function;
+
+	list_add(&csd->list, &cam_req_mgr_ordered_sd_list);
+	list_sort(NULL, &cam_req_mgr_ordered_sd_list,
+		cam_req_mgr_ordered_list_cmp);
+
+	rc = v4l2_device_register_subdev(g_dev.v4l2_dev, sd);
+	if (rc) {
+		CAM_ERR(CAM_CRM, "register subdev failed");
+		goto reg_fail;
+	}
+
+	rc = v4l2_device_register_subdev_nodes(g_dev.v4l2_dev);
+	if (rc) {
+		CAM_ERR(CAM_CRM, "Failed to register subdev node: %s, rc: %d",
+			sd->name, rc);
+		goto reg_fail;
+	}
+
+	if (sd->flags & V4L2_SUBDEV_FL_HAS_DEVNODE) {
+		sd->entity.name = video_device_node_name(sd->devnode);
+		CAM_DBG(CAM_CRM, "created node :%s", sd->entity.name);
+	}
+
+	g_dev.count++;
+
+reg_fail:
+	mutex_unlock(&g_dev.dev_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_register_subdev);
+
+int cam_unregister_subdev(struct cam_subdev *csd)
+{
+	if (!g_dev.state) {
+		CAM_ERR(CAM_CRM, "camera root device not ready yet");
+		return -ENODEV;
+	}
+
+	mutex_lock(&g_dev.dev_lock);
+	v4l2_device_unregister_subdev(&csd->sd);
+	g_dev.count--;
+	mutex_unlock(&g_dev.dev_lock);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_unregister_subdev);
+
+static inline void cam_req_mgr_destroy_timer_slab(void)
+{
+	kmem_cache_destroy(g_cam_req_mgr_timer_cachep);
+	g_cam_req_mgr_timer_cachep = NULL;
+}
+
+static int cam_req_mgr_component_master_bind(struct device *dev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CRM, "Master bind called");
+	rc = cam_v4l2_device_setup(dev);
+	if (rc)
+		return rc;
+
+	rc = cam_media_device_setup(dev);
+	if (rc)
+		goto media_setup_fail;
+
+	rc = cam_video_device_setup();
+	if (rc)
+		goto video_setup_fail;
+
+	g_dev.open_cnt = 0;
+	g_dev.shutdown_state = false;
+	mutex_init(&g_dev.cam_lock);
+	spin_lock_init(&g_dev.cam_eventq_lock);
+	mutex_init(&g_dev.dev_lock);
+
+	rc = cam_req_mgr_util_init();
+	if (rc) {
+		CAM_ERR(CAM_CRM, "cam req mgr util init is failed");
+		goto req_mgr_util_fail;
+	}
+
+	rc = cam_req_mgr_core_device_init();
+	if (rc) {
+		CAM_ERR(CAM_CRM, "core device setup failed");
+		goto req_mgr_core_fail;
+	}
+
+	INIT_LIST_HEAD(&cam_req_mgr_ordered_sd_list);
+
+	if (g_cam_req_mgr_timer_cachep == NULL) {
+		g_cam_req_mgr_timer_cachep = KMEM_CACHE(cam_req_mgr_timer, 0x0);
+		if (!g_cam_req_mgr_timer_cachep)
+			CAM_ERR(CAM_CRM,
+				"Failed to create kmem_cache for crm_timer");
+		else
+			CAM_DBG(CAM_CRM, "Name : cam_req_mgr_timer");
+	}
+
+	CAM_DBG(CAM_CRM, "All probes done, binding slave components");
+	g_dev.state = true;
+	rc = component_bind_all(dev, NULL);
+	if (rc) {
+		CAM_ERR(CAM_CRM,
+			"Error in binding all components rc: %d, Camera initialization failed!",
+			rc);
+		goto req_mgr_device_deinit;
+	}
+
+	CAM_INFO(CAM_CRM,
+		"All components bound successfully, Spectra camera driver initialized");
+	rc = sysfs_create_file(&dev->kobj, &camera_debug_sysfs_attr.attr);
+	if (rc < 0) {
+		CAM_ERR(CAM_CPAS,
+			"Failed to create debug attribute, rc=%d\n", rc);
+		goto sysfs_fail;
+	}
+
+	return rc;
+
+sysfs_fail:
+	sysfs_remove_file(&dev->kobj, &camera_debug_sysfs_attr.attr);
+req_mgr_device_deinit:
+	cam_req_mgr_destroy_timer_slab();
+	cam_req_mgr_core_device_deinit();
+req_mgr_core_fail:
+	cam_req_mgr_util_deinit();
+req_mgr_util_fail:
+	mutex_destroy(&g_dev.dev_lock);
+	mutex_destroy(&g_dev.cam_lock);
+	cam_video_device_cleanup();
+video_setup_fail:
+	cam_media_device_cleanup();
+media_setup_fail:
+	cam_v4l2_device_cleanup();
+	g_dev.state = false;
+	return rc;
+}
+
+static void cam_req_mgr_component_master_unbind(struct device *dev)
+{
+	/* Unbinding all slave components first */
+	component_unbind_all(dev, NULL);
+
+	/* Now proceed with unbinding master */
+	sysfs_remove_file(&dev->kobj, &camera_debug_sysfs_attr.attr);
+	cam_req_mgr_core_device_deinit();
+	cam_req_mgr_util_deinit();
+	cam_media_device_cleanup();
+	cam_video_device_cleanup();
+	cam_v4l2_device_cleanup();
+	cam_req_mgr_destroy_timer_slab();
+	mutex_destroy(&g_dev.dev_lock);
+	g_dev.state = false;
+}
+
+static const struct component_master_ops cam_req_mgr_component_master_ops = {
+	.bind = cam_req_mgr_component_master_bind,
+	.unbind = cam_req_mgr_component_master_unbind,
+};
+
+static int cam_req_mgr_remove(struct platform_device *pdev)
+{
+	component_master_del(&pdev->dev, &cam_req_mgr_component_master_ops);
+	return 0;
+}
+
+static int cam_req_mgr_probe(struct platform_device *pdev)
+{
+	int rc = 0, i;
+	struct component_match *match_list = NULL;
+	struct device *dev = &pdev->dev;
+	struct device_node *np = NULL;
+	uint32_t cam_bypass_driver = 0;
+	struct device_node *of_node = NULL;
+
+	for (i = 0; i < ARRAY_SIZE(cam_component_i2c_drivers); i++) {
+		while ((np = of_find_compatible_node(np, NULL,
+			cam_component_i2c_drivers[i]->driver.of_match_table->compatible))) {
+			if (of_device_is_available(np) && !(of_find_i2c_device_by_node(np))) {
+				CAM_INFO_RATE_LIMIT(CAM_CRM,
+					"I2C device: %s not available, deferring probe",
+					np->full_name);
+				rc = -EPROBE_DEFER;
+				goto end;
+			}
+		}
+	}
+
+	np = NULL;
+	while ((np = of_find_compatible_node(np, NULL, CAM_I3C_MASTER_COMPAT))) {
+		rc = of_platform_populate(np, cam_sensor_module_dt_match, NULL, NULL);
+		if (rc) {
+			CAM_ERR(CAM_CRM,
+				"Failed to populate child nodes as platform devices for parent: %s, rc=%d",
+				np->full_name, rc);
+			goto end;
+		}
+	}
+
+	rc = camera_component_match_add_drivers(dev, &match_list);
+	if (rc) {
+		CAM_ERR(CAM_CRM,
+			"Unable to match components, probe failed rc: %d",
+			rc);
+		goto end;
+	}
+
+	/* Supply match_list to master for handing over control */
+	rc = component_master_add_with_match(dev,
+		&cam_req_mgr_component_master_ops, match_list);
+	if (rc) {
+		CAM_ERR(CAM_CRM,
+			"Unable to add master, probe failed rc: %d",
+			rc);
+		goto end;
+	}
+
+	of_node = dev->of_node;
+	rc = of_property_read_u32(of_node, "cam-bypass-driver",
+		&cam_bypass_driver);
+	if (!rc) {
+		cam_soc_util_set_bypass_drivers(cam_bypass_driver);
+	} else {
+		CAM_INFO(CAM_CRM, "bypass driver parameter not found");
+		rc = 0;
+	}
+
+end:
+	of_node_put(np);
+	return rc;
+}
+
+static const struct of_device_id cam_req_mgr_dt_match[] = {
+	{.compatible = "qcom,cam-req-mgr"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_req_mgr_dt_match);
+
+struct platform_driver cam_req_mgr_driver = {
+	.probe = cam_req_mgr_probe,
+	.remove = cam_req_mgr_remove,
+	.driver = {
+		.name = "cam_req_mgr",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_req_mgr_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_req_mgr_init(void)
+{
+	return platform_driver_register(&cam_req_mgr_driver);
+}
+EXPORT_SYMBOL(cam_req_mgr_init);
+
+void cam_req_mgr_exit(void)
+{
+	platform_driver_unregister(&cam_req_mgr_driver);
+}
+
+MODULE_DESCRIPTION("Camera Request Manager");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_dev.h
@@ -0,0 +1,61 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_DEV_H_
+#define _CAM_REQ_MGR_DEV_H_
+
+#include "media/cam_req_mgr.h"
+/**
+ * struct cam_req_mgr_device - a camera request manager device
+ *
+ * @video: pointer to struct video device.
+ * @v4l2_dev: pointer to struct v4l2 device.
+ * @count: number of subdevices registered.
+ * @dev_lock: lock for the subdevice count.
+ * @state: state of the root device.
+ * @open_cnt: open count of subdev
+ * @v4l2_sub_ids: bits representing v4l2 event ids subscribed or not
+ * @cam_lock: per file handle lock
+ * @cam_eventq: event queue
+ * @cam_eventq_lock: lock for event queue
+ * @shutdown_state: shutdown state
+ */
+struct cam_req_mgr_device {
+	struct video_device *video;
+	struct v4l2_device *v4l2_dev;
+	int count;
+	struct mutex dev_lock;
+	bool state;
+	int32_t open_cnt;
+	uint32_t v4l2_sub_ids;
+	struct mutex cam_lock;
+	struct v4l2_fh *cam_eventq;
+	spinlock_t cam_eventq_lock;
+	bool shutdown_state;
+};
+
+#define CAM_REQ_MGR_GET_PAYLOAD_PTR(ev, type)        \
+	(type *)((char *)ev.u.data)
+
+int cam_req_mgr_notify_message(struct cam_req_mgr_message *msg,
+	uint32_t id,
+	uint32_t type);
+
+/**
+ * @brief : API to register REQ_MGR to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_req_mgr_init(void);
+
+/**
+ * @brief : API to remove REQ_MGR from platform framework.
+ */
+void cam_req_mgr_exit(void);
+
+/**
+ * @brief : API to get V4L2 eventIDs subscribed by UMD.
+ */
+uint32_t cam_req_mgr_get_id_subscribed(void);
+#endif /* _CAM_REQ_MGR_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_interface.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_req_mgr_interface.h
@@ -0,0 +1,473 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_INTERFACE_H
+#define _CAM_REQ_MGR_INTERFACE_H
+
+#include <linux/types.h>
+#include <media/cam_req_mgr.h>
+#include "cam_req_mgr_core_defs.h"
+#include "cam_req_mgr_util.h"
+
+struct cam_req_mgr_trigger_notify;
+struct cam_req_mgr_error_notify;
+struct cam_req_mgr_add_request;
+struct cam_req_mgr_timer_notify;
+struct cam_req_mgr_notify_stop;
+struct cam_req_mgr_device_info;
+struct cam_req_mgr_core_dev_link_setup;
+struct cam_req_mgr_apply_request;
+struct cam_req_mgr_flush_request;
+struct cam_req_mgr_link_evt_data;
+struct cam_req_mgr_dump_info;
+
+/* Request Manager -- camera device driver interface */
+/**
+ * @brief: camera kernel drivers to cam req mgr communication
+ *
+ * @cam_req_mgr_notify_trigger: for device which generates trigger to inform CRM
+ * @cam_req_mgr_notify_err    : device use this to inform about different errors
+ * @cam_req_mgr_add_req       : to info CRM about new rqeuest received from
+ *                              userspace
+ * @cam_req_mgr_notify_timer  : start the timer
+ */
+typedef int (*cam_req_mgr_notify_trigger)(struct cam_req_mgr_trigger_notify *);
+typedef int (*cam_req_mgr_notify_err)(struct cam_req_mgr_error_notify *);
+typedef int (*cam_req_mgr_add_req)(struct cam_req_mgr_add_request *);
+typedef int (*cam_req_mgr_notify_timer)(struct cam_req_mgr_timer_notify *);
+typedef int (*cam_req_mgr_notify_stop)(struct cam_req_mgr_notify_stop *);
+
+/**
+ * @brief: cam req mgr to camera device drivers
+ *
+ * @cam_req_mgr_get_dev_info     : to fetch details about device linked
+ * @cam_req_mgr_link_setup       : to establish link with device for a session
+ * @cam_req_mgr_apply_req        : CRM asks device to apply certain request id
+ * @cam_req_mgr_notify_frame_skip: CRM asks device to apply setting for
+ *                                 frame skip
+ * @cam_req_mgr_flush_req        : Flush or cancel request
+ * cam_req_mgr_process_evt       : generic events
+ * @cam_req_mgr_dump_req         : dump request
+ */
+typedef int (*cam_req_mgr_get_dev_info) (struct cam_req_mgr_device_info *);
+typedef int (*cam_req_mgr_link_setup)(struct cam_req_mgr_core_dev_link_setup *);
+typedef int (*cam_req_mgr_apply_req)(struct cam_req_mgr_apply_request *);
+typedef int (*cam_req_mgr_notify_frame_skip)(
+	struct cam_req_mgr_apply_request *);
+typedef int (*cam_req_mgr_flush_req)(struct cam_req_mgr_flush_request *);
+typedef int (*cam_req_mgr_process_evt)(struct cam_req_mgr_link_evt_data *);
+typedef int (*cam_req_mgr_dump_req)(struct cam_req_mgr_dump_info *);
+
+/**
+ * @brief          : cam_req_mgr_crm_cb - func table
+ *
+ * @notify_trigger : payload for trigger indication event
+ * @notify_err     : payload for different error occurred at device
+ * @add_req        : payload to inform which device and what request is received
+ * @notify_timer   : payload for timer start event
+ * @notify_stop    : payload to inform stop event
+ */
+struct cam_req_mgr_crm_cb {
+	cam_req_mgr_notify_trigger  notify_trigger;
+	cam_req_mgr_notify_err      notify_err;
+	cam_req_mgr_add_req         add_req;
+	cam_req_mgr_notify_timer    notify_timer;
+	cam_req_mgr_notify_stop     notify_stop;
+};
+
+/**
+ * @brief        : cam_req_mgr_kmd_ops - func table
+ *
+ * @get_dev_info     : payload to fetch device details
+ * @link_setup       : payload to establish link with device
+ * @apply_req        : payload to apply request id on a device linked
+ * @notify_frame_skip: payload to notify frame skip
+ * @flush_req        : payload to flush request
+ * @process_evt      : payload to generic event
+ * @dump_req         : payload to dump request
+ */
+struct cam_req_mgr_kmd_ops {
+	cam_req_mgr_get_dev_info      get_dev_info;
+	cam_req_mgr_link_setup        link_setup;
+	cam_req_mgr_apply_req         apply_req;
+	cam_req_mgr_notify_frame_skip notify_frame_skip;
+	cam_req_mgr_flush_req         flush_req;
+	cam_req_mgr_process_evt       process_evt;
+	cam_req_mgr_dump_req          dump_req;
+};
+
+/**
+ * enum cam_pipeline_delay
+ * @brief     : enumerator for different pipeline delays in camera
+ *
+ * @DELAY_0   : device processed settings on same frame
+ * @DELAY_1   : device processed settings after 1 frame
+ * @DELAY_2   : device processed settings after 2 frames
+ * @DELAY_MAX : maximum supported pipeline delay
+ */
+enum cam_pipeline_delay {
+	CAM_PIPELINE_DELAY_0,
+	CAM_PIPELINE_DELAY_1,
+	CAM_PIPELINE_DELAY_2,
+	CAM_PIPELINE_DELAY_MAX,
+};
+
+/**
+ * enum cam_modeswitch_delay
+ * @brief     : enumerator for different modeswitch delays in camera
+ *
+ * @DELAY_0   : device processed mode switch settings after 0 frame
+ * @DELAY_1   : device processed mode switch settings after 1 frame
+ * @DELAY_2   : device processed mode switch settings after 2 frames
+ * @DELAY_MAX : maximum supported mode switch delay
+ */
+enum cam_modeswitch_delay {
+	CAM_MODESWITCH_DELAY_0,
+	CAM_MODESWITCH_DELAY_1,
+	CAM_MODESWITCH_DELAY_2,
+	CAM_MODESWITCH_DELAY_MAX,
+};
+
+
+/**
+ * @CAM_TRIGGER_POINT_SOF   : Trigger point for Start Of Frame
+ * @CAM_TRIGGER_POINT_EOF   : Trigger point for End Of Frame
+ * @CAM_TRIGGER_MAX_POINTS  : Maximum number of trigger point
+ */
+#define CAM_TRIGGER_POINT_SOF     (1 << 0)
+#define CAM_TRIGGER_POINT_EOF     (1 << 1)
+#define CAM_TRIGGER_MAX_POINTS    2
+
+
+enum cam_req_mgr_dual_trigger {
+	CAM_REQ_DUAL_TRIGGER_NONE,
+	CAM_REQ_DUAL_TRIGGER_ONE_EXPOSURE,
+	CAM_REQ_DUAL_TRIGGER_TWO_EXPOSURE,
+	CAM_REQ_DUAL_TRIGGER_MAX,
+};
+
+/**
+ * enum cam_req_status
+ * @brief   : enumerator for request status
+ *
+ * @SUCCESS : device processed settings successfully
+ * @FAILED  : device processed settings failed
+ * @MAX     : invalid status value
+ */
+enum cam_req_status {
+	CAM_REQ_STATUS_SUCCESS,
+	CAM_REQ_STATUS_FAILED,
+	CAM_REQ_STATUS_MAX,
+};
+
+/**
+ * enum cam_req_mgr_device_error
+ * @brief      : enumerator for different errors occurred at device
+ *
+ * @NOT_FOUND  : settings asked by request manager is not found
+ * @BUBBLE     : device hit timing issue and is able to recover
+ * @FATAL      : device is in bad shape and can not recover from error
+ * @PAGE_FAULT : Page fault while accessing memory
+ * @OVERFLOW   : Bus Overflow for IFE/VFE
+ * @TIMEOUT    : Timeout from cci or bus.
+ * @RECOVERY   : Internal recovery for bus overflow
+ * @MAX        : Invalid error value
+ */
+enum cam_req_mgr_device_error {
+	CRM_KMD_ERR_NOT_FOUND,
+	CRM_KMD_ERR_BUBBLE,
+	CRM_KMD_ERR_FATAL,
+	CRM_KMD_ERR_PAGE_FAULT,
+	CRM_KMD_ERR_OVERFLOW,
+	CRM_KMD_ERR_TIMEOUT,
+	CRM_KMD_ERR_STOPPED,
+	CRM_KMD_WARN_INTERNAL_RECOVERY,
+	CRM_KMD_ERR_MAX,
+};
+
+/**
+ * enum cam_req_mgr_device_id
+ * @brief       : enumerator for different devices in subsystem
+ *
+ * @CAM_REQ_MGR : request manager itself
+ * @SENSOR      : sensor device
+ * @FLASH       : LED flash or dual LED device
+ * @ACTUATOR    : lens mover
+ * @IFE         : Image processing device
+ * @CUSTOM      : Custom HW block
+ * @EXTERNAL_1  : third party device
+ * @EXTERNAL_2  : third party device
+ * @EXTERNAL_3  : third party device
+ * @TPG         : Test Pattern Generator
+ * @MAX         : invalid device id
+ */
+enum cam_req_mgr_device_id {
+	CAM_REQ_MGR_DEVICE,
+	CAM_REQ_MGR_DEVICE_SENSOR,
+	CAM_REQ_MGR_DEVICE_FLASH,
+	CAM_REQ_MGR_DEVICE_ACTUATOR,
+	CAM_REQ_MGR_DEVICE_IFE,
+	CAM_REQ_MGR_DEVICE_CUSTOM_HW,
+	CAM_REQ_MGR_DEVICE_EXTERNAL_1,
+	CAM_REQ_MGR_DEVICE_EXTERNAL_2,
+	CAM_REQ_MGR_DEVICE_EXTERNAL_3,
+	CAM_REQ_MGR_DEVICE_TPG,
+	CAM_REQ_MGR_DEVICE_ID_MAX,
+};
+
+/* Camera device driver to Req Mgr device interface */
+
+/**
+ * enum cam_req_mgr_link_evt_type
+ * @CAM_REQ_MGR_LINK_EVT_ERR               : error on the link from any of the
+ *                                           connected devices
+ * @CAM_REQ_MGR_LINK_EVT_PAUSE             : to pause the link
+ * @CAM_REQ_MGR_LINK_EVT_RESUME            : resumes the link which was paused
+ * @CAM_REQ_MGR_LINK_EVT_SOF_FREEZE        : request manager has detected an
+ *                                           sof freeze
+ * @CAM_REQ_MGR_LINK_EVT_STALLED           : Indicate to all connected devices
+ *                                           that the pipeline is stalled.
+ *                                           Devices can handle accordingly
+ * @CAM_REQ_MGR_LINK_EVT_EOF               : Indicate to all connected devices
+ *                                           that we get an EOF
+ * @CAM_REQ_MGR_LINK_EVT_UPDATE_PROPERTIES : Notify sub devices of the properties
+ *                                           updating
+ * @CAM_REQ_MGR_LINK_EVT_MAX               : invalid event type
+ */
+enum cam_req_mgr_link_evt_type {
+	CAM_REQ_MGR_LINK_EVT_ERR,
+	CAM_REQ_MGR_LINK_EVT_PAUSE,
+	CAM_REQ_MGR_LINK_EVT_RESUME,
+	CAM_REQ_MGR_LINK_EVT_SOF_FREEZE,
+	CAM_REQ_MGR_LINK_EVT_STALLED,
+	CAM_REQ_MGR_LINK_EVT_EOF,
+	CAM_REQ_MGR_LINK_EVT_UPDATE_PROPERTIES,
+	CAM_REQ_MGR_LINK_EVT_MAX,
+};
+
+/**
+ * struct cam_req_mgr_trigger_notify
+ * @link_hdl : link identifier
+ * @dev_hdl  : device handle which has sent this req id
+ * @frame_id : frame id for internal tracking
+ * @trigger  : trigger point of this notification, CRM will send apply
+ *             only to the devices which subscribe to this point.
+ * @sof_timestamp_val: Captured time stamp value at sof hw event
+ * @req_id   : req id which returned buf_done
+ * @trigger_id: ID to differentiate between the trigger devices
+ */
+struct cam_req_mgr_trigger_notify {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	int64_t  frame_id;
+	uint32_t trigger;
+	uint64_t sof_timestamp_val;
+	uint64_t req_id;
+	int32_t  trigger_id;
+};
+
+/**
+ * struct cam_req_mgr_timer_notify
+ * @link_hdl : link identifier
+ * @dev_hdl  : device handle which has sent this req id
+ * @state    : timer state i.e ON or OFF
+ */
+struct cam_req_mgr_timer_notify {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	bool     state;
+};
+
+/**
+ * struct cam_req_mgr_error_notify
+ * @link_hdl : link identifier
+ * @dev_hdl  : device handle which has sent this req id
+ * @req_id   : req id which hit error
+ * @frame_id : frame id for internal tracking
+ * @trigger  : trigger point of this notification, CRM will send apply
+ * @sof_timestamp_val : Captured time stamp value at sof hw event
+ * @error    : what error device hit while processing this req
+ */
+struct cam_req_mgr_error_notify {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	uint64_t req_id;
+	int64_t  frame_id;
+	uint32_t trigger;
+	uint64_t sof_timestamp_val;
+	enum cam_req_mgr_device_error error;
+};
+
+/**
+ * struct cam_req_mgr_add_request
+ * @link_hdl             : link identifier
+ * @dev_hdl              : device handle which has sent this req id
+ * @req_id               : req id which device is ready to process
+ * @skip_at_sof          : before applying req mgr introduce bubble
+ *                         by not sending request to devices. ex: IFE and Flash
+ * @skip_at_eof          : before applying req mgr introduce bubble
+ *                         by not sending request to devices. ex: IFE and Flash
+ * @trigger_eof          : to identify that one of the device at this slot needs
+ *                         to be apply at EOF
+ * @num_exp              : num of exposure associated with the request
+ */
+struct cam_req_mgr_add_request {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	uint64_t req_id;
+	uint32_t skip_at_sof;
+	uint32_t skip_at_eof;
+	uint32_t num_exp;
+	bool     trigger_eof;
+};
+
+/**
+ * struct cam_req_mgr_notify_stop
+ * @link_hdl             : link identifier
+ *
+ */
+struct cam_req_mgr_notify_stop {
+	int32_t  link_hdl;
+};
+
+
+/* CRM to KMD devices */
+/**
+ * struct cam_req_mgr_device_info
+ * @dev_hdl : Input_param : device handle for reference
+ * @name    : link link or unlink
+ * @dev_id  : device id info
+ * @p_delay : delay between time settings applied and take effect
+ * @m_delay : delay between time modeswitch settings applied and take effect
+ * @trigger : Trigger point for the client
+ * @mode_switch_req : Request id on which sensor mode switch observed on the device
+ * @trigger_on : This device provides trigger
+ * @is_shdr : Flag to indicate auto shdr usecase without SFE
+ * @is_shdr_master : Flag to indicate master dev in auto shdr usecase without SFE
+ */
+struct cam_req_mgr_device_info {
+	int32_t                     dev_hdl;
+	char                        name[256];
+	enum cam_req_mgr_device_id  dev_id;
+	enum cam_pipeline_delay     p_delay;
+	enum cam_modeswitch_delay   m_delay;
+	uint32_t                    trigger;
+	uint64_t                    mode_switch_req;
+	bool                        trigger_on;
+	bool                        is_shdr;
+	bool                        is_shdr_master;
+};
+
+/**
+ * struct cam_req_mgr_core_dev_link_setup
+ * @link_enable     : link or unlink
+ * @link_hdl        : link identifier
+ * @dev_hdl         : device handle for reference
+ * @max_delay       : max pipeline delay on this link
+ * @mode_switch_max_delay : max modeswitch delay on this link
+ * @crm_cb          : callback funcs to communicate with req mgr
+ * @trigger_id      : Unique ID provided to the triggering device
+ */
+struct cam_req_mgr_core_dev_link_setup {
+	int32_t                    link_enable;
+	int32_t                    link_hdl;
+	int32_t                    dev_hdl;
+	enum cam_pipeline_delay    max_delay;
+	enum cam_modeswitch_delay  mode_switch_max_delay;
+	struct cam_req_mgr_crm_cb *crm_cb;
+	int32_t                    trigger_id;
+};
+
+/**
+ * struct cam_req_mgr_apply_request
+ * @link_hdl         : link identifier
+ * @dev_hdl          : device handle for cross check
+ * @request_id       : request id settings to apply
+ * @last_applied_max_pd_req : Last applied req on highest pd dev -1 is considered invalid
+ * @report_if_bubble : report to crm if failure in applying
+ * @trigger_point    : the trigger point of this apply
+ * @re_apply         : to skip re_apply for buf_done request
+ * @recovery         : Indicate if it is recovery req
+ * @dual_trigger_status : Enum to indicate status of dual trigger
+ */
+struct cam_req_mgr_apply_request {
+	int32_t                       link_hdl;
+	int32_t                       dev_hdl;
+	uint64_t                      request_id;
+	int64_t                       last_applied_max_pd_req;
+	int32_t                       report_if_bubble;
+	uint32_t                      trigger_point;
+	bool                          re_apply;
+	bool                          recovery;
+	enum cam_req_mgr_dual_trigger dual_trigger_status;
+};
+
+/**
+ * struct cam_req_mgr_flush_request
+ * @link_hdl    : link identifier
+ * @dev_hdl     : device handle for cross check
+ * @type        : cancel request type flush all or a request
+ * @req_id      : request id to cancel
+ *
+ */
+struct cam_req_mgr_flush_request {
+	int32_t     link_hdl;
+	int32_t     dev_hdl;
+	uint32_t    type;
+	uint64_t    req_id;
+};
+
+/**
+ * struct cam_req_mgr_event_data
+ * @link_hdl          : link handle
+ * @req_id            : request id
+ * @try_for_recovery  : Link is stalled allow subdevices to recover if
+ *                      possible
+ * @evt_type          : link event
+ * @error             : error code
+ * @properties_mask   : properties mask
+ */
+struct cam_req_mgr_link_evt_data {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	uint64_t req_id;
+	bool     try_for_recovery;
+	enum cam_req_mgr_link_evt_type evt_type;
+	union {
+		enum cam_req_mgr_device_error error;
+		uint32_t properties_mask;
+	} u;
+};
+
+/**
+ * struct cam_req_mgr_send_request
+ * @link_hdl   : link identifier
+ * @in_q       : input request queue pointer
+ */
+struct cam_req_mgr_send_request {
+	int32_t    link_hdl;
+	struct cam_req_mgr_req_queue *in_q;
+};
+
+/**
+ * struct cam_req_mgr_dump_info
+ * @req_id      : request id to dump
+ * @offset      : offset of buffer
+ * @error_type  : error type
+ * @buf_handle  : buf handle
+ * @link_hdl    : link identifier
+ * @dev_hdl     : device handle for cross check
+ *
+ */
+struct cam_req_mgr_dump_info {
+	uint64_t    req_id;
+	size_t      offset;
+	uint32_t    error_type;
+	uint32_t    buf_handle;
+	int32_t     link_hdl;
+	int32_t     dev_hdl;
+};
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_subdev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_req_mgr/cam_subdev.h
@@ -0,0 +1,237 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SUBDEV_H_
+#define _CAM_SUBDEV_H_
+
+#include <linux/types.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+
+#define CAM_SUBDEVICE_EVENT_MAX 30
+
+
+/* Enum for indicating CSID event */
+enum cam_subdev_phy_csid_state {
+	CAM_SUBDEV_PHY_CSID_HALT = 1,
+	CAM_SUBDEV_PHY_CSID_RESUME,
+};
+
+/**
+ * struct cam_subdev_msg_phy_conn_csid_info: Contains phy num and connected CSID info
+ *
+ * @phy_idx:          Phy idx value indicating which phy is connected to csid core
+ * @lane_cfg:         This value is similar to lane_assign in the PHY
+ *                    driver, and is used to identify the particular
+ *                    PHY instance with which this IFE session is
+ *                    connected to.
+ * @core_idx:         Primary(in case of dual ife) core idx for the csid to which the phy
+ *                    is connected, -1 while disconnecting
+ */
+struct cam_subdev_msg_phy_conn_csid_info {
+	uint32_t phy_idx;
+	uint32_t lane_cfg;
+	int32_t core_idx;
+};
+
+/**
+ * struct cam_subdev_msg_phy_drv_info: Contains drv config info
+ *
+ * @phy_idx:               Phy idx value indicating which phy is connected to csid core
+ * @lane_cfg:              This value is similar to lane_assign in the PHY
+ *                         driver, and is used to identify the particular
+ *                         PHY instance with which this IFE session is
+ *                         connected to.
+ * @use_hw_client_voting:  Whether to use hw client voting for csiphy clk
+ * @is_drv_config_en:      If DRV config is enabled in CSID
+ */
+struct cam_subdev_msg_phy_drv_info {
+	uint32_t phy_idx;
+	uint32_t lane_cfg;
+	bool     use_hw_client_voting;
+	bool     is_drv_config_en;
+};
+
+/**
+ * struct cam_subdev_msg_phy_halt_resume_info: Contains csid halt resume info
+ *
+ * @phy_idx:     Phy idx value indicating which phy is connected to csid core
+ * @lane_cfg:    This value is similar to lane_assign in the PHY
+ *               driver, and is used to identify the particular
+ *               PHY instance with which this IFE session is
+ *               connected to.
+ * @csid_state:  Notification of CSID state
+ */
+struct cam_subdev_msg_phy_halt_resume_info {
+	uint32_t                       phy_idx;
+	uint32_t                       lane_cfg;
+	enum cam_subdev_phy_csid_state csid_state;
+};
+
+enum cam_subdev_message_type_t {
+	CAM_SUBDEV_MESSAGE_REG_DUMP = 0x1,
+	CAM_SUBDEV_MESSAGE_APPLY_CSIPHY_AUX,
+	CAM_SUBDEV_MESSAGE_DOMAIN_ID_SECURE_PARAMS,
+	CAM_SUBDEV_MESSAGE_CONN_CSID_INFO,
+	CAM_SUBDEV_MESSAGE_DRV_INFO,
+	CAM_SUBDEV_MESSAGE_NOTIFY_HALT_RESUME,
+	CAM_SUBDEV_MESSAGE_CLOCK_UPDATE
+};
+
+/* Enum for close sequence priority */
+enum cam_subdev_close_seq_priority {
+	CAM_SD_CLOSE_HIGH_PRIORITY,
+	CAM_SD_CLOSE_MEDIUM_PRIORITY,
+	CAM_SD_CLOSE_MEDIUM_LOW_PRIORITY,
+	CAM_SD_CLOSE_LOW_PRIORITY
+};
+
+enum cam_subdev_rwsem {
+	CAM_SUBDEV_LOCK = 1,
+	CAM_SUBDEV_UNLOCK,
+};
+
+/**
+ * struct cam_subdev - describes a camera sub-device
+ *
+ * @pdev:                  Pointer to the platform device
+ * @sd:                    V4l2 subdevice
+ * @ops:                   V4l2 subdecie operations
+ * @internal_ops:          V4l2 subdevice internal operations
+ * @name:                  Name of the sub-device. Please notice that the name
+ *                             must be unique.
+ * @sd_flags:              Subdev flags. Can be:
+ *                             %V4L2_SUBDEV_FL_HAS_DEVNODE - Set this flag if
+ *                                 this subdev needs a device node.
+ *                             %V4L2_SUBDEV_FL_HAS_EVENTS -  Set this flag if
+ *                                 this subdev generates events.
+ * @token:                 Pointer to cookie of the client driver
+ * @ent_function:          Media entity function type. Can be:
+ *                             %CAM_IFE_DEVICE_TYPE - identifies as IFE device.
+ *                             %CAM_ICP_DEVICE_TYPE - identifies as ICP device.
+ * @list:                  list pointer
+ * @close_seq_prior:         cam_subdev_close_seq_priority type
+ *
+ * Each instance of a subdev driver should create this struct, either
+ * stand-alone or embedded in a larger struct. This structure should be
+ * initialized/registered by cam_register_subdev
+ *
+ */
+struct cam_subdev {
+	struct platform_device                *pdev;
+	struct v4l2_subdev                     sd;
+	const struct v4l2_subdev_ops          *ops;
+	const struct v4l2_subdev_internal_ops *internal_ops;
+	char                                  *name;
+	u32                                    sd_flags;
+	void                                  *token;
+	u32                                    ent_function;
+	void                                  (*msg_cb)(
+					struct v4l2_subdev *sd,
+					enum cam_subdev_message_type_t msg_type,
+					void *data);
+	struct list_head                       list;
+	enum cam_subdev_close_seq_priority     close_seq_prior;
+};
+
+/**
+ * cam_subdev_notify_message()
+ *
+ * @brief:  Notify message to a subdevs of specific type
+ *
+ * @subdev_type:           Subdev type
+ * @message_type:          message type
+ * @data:                  data to be delivered.
+ *
+ */
+void cam_subdev_notify_message(u32 subdev_type,
+		enum cam_subdev_message_type_t message_type,
+		void *data);
+
+/**
+ * cam_subdev_probe()
+ *
+ * @brief:      Camera Subdevice node probe function for v4l2 setup
+ *
+ * @sd:                    Camera subdevice object
+ * @name:                  Name of the subdevice node
+ * @dev_type:              Subdevice node type
+ *
+ */
+int cam_subdev_probe(struct cam_subdev *sd, struct platform_device *pdev,
+	char *name, uint32_t dev_type);
+/**
+ * cam_subdev_register()
+ *
+ * @brief:      Camera Subdevice node probe function for v4l2 setup
+ *
+ * @sd:                    Camera subdevice object
+ * @pdev:                  Pointer to the platform device
+ *
+ */
+int cam_subdev_register(struct cam_subdev *sd, struct platform_device *pdev);
+
+/**
+ * cam_subdev_remove()
+ *
+ * @brief:      Called when subdevice node is unloaded
+ *
+ * @sd:                    Camera subdevice node object
+ *
+ */
+int cam_subdev_remove(struct cam_subdev *sd);
+
+/**
+ * cam_register_subdev()
+ *
+ * @brief:   This is the common utility function to be called by each camera
+ *           subdevice node when it tries to register itself to the camera
+ *           request manager
+ *
+ * @sd:                    Pointer to struct cam_subdev.
+ */
+int cam_register_subdev(struct cam_subdev *sd);
+
+/**
+ * cam_unregister_subdev()
+ *
+ * @brief:    This is the common utility function to be called by each camera
+ *            subdevice node when it tries to unregister itself from the
+ *            camera request manger
+ *
+ * @sd:                    Pointer to struct cam_subdev.
+ */
+int cam_unregister_subdev(struct cam_subdev *sd);
+
+/**
+ * cam_req_mgr_rwsem_read_op()
+ *
+ * @brief : API to acquire read semaphore lock to platform framework.
+ *
+ * @lock  : value indicates to lock or unlock the read lock
+ */
+void cam_req_mgr_rwsem_read_op(enum cam_subdev_rwsem lock);
+
+/**
+ * cam_req_mgr_is_open()
+ *
+ * @brief:    This common utility function returns the crm active status
+ *
+ */
+bool  cam_req_mgr_is_open(void);
+
+/**
+ * cam_req_mgr_is_shutdown()
+ *
+ * @brief:    This common utility function returns the shutdown state
+ */
+bool cam_req_mgr_is_shutdown(void);
+
+#endif /* _CAM_SUBDEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c
@@ -0,0 +1,1136 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <cam_sensor_cmn_header.h>
+#include "cam_actuator_core.h"
+#include "cam_sensor_util.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+
+int32_t cam_actuator_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int rc = 0;
+
+	power_info->power_setting_size = 1;
+	power_info->power_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_setting)
+		return -ENOMEM;
+
+	power_info->power_setting[0].seq_type = SENSOR_VAF;
+	power_info->power_setting[0].seq_val = CAM_VAF;
+	power_info->power_setting[0].config_val = 1;
+	power_info->power_setting[0].delay = 2;
+
+	power_info->power_down_setting_size = 1;
+	power_info->power_down_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_down_setting) {
+		rc = -ENOMEM;
+		goto free_power_settings;
+	}
+
+	power_info->power_down_setting[0].seq_type = SENSOR_VAF;
+	power_info->power_down_setting[0].seq_val = CAM_VAF;
+	power_info->power_down_setting[0].config_val = 0;
+
+	return rc;
+
+free_power_settings:
+	kfree(power_info->power_setting);
+	power_info->power_setting = NULL;
+	power_info->power_setting_size = 0;
+	return rc;
+}
+
+static int32_t cam_actuator_power_up(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	int rc = 0;
+	struct cam_hw_soc_info                 *soc_info = &a_ctrl->soc_info;
+	struct cam_actuator_soc_private        *soc_private;
+	struct cam_sensor_power_ctrl_t         *power_info;
+	struct completion                      *i3c_probe_completion = NULL;
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	if ((power_info->power_setting == NULL) &&
+		(power_info->power_down_setting == NULL)) {
+		CAM_INFO(CAM_ACTUATOR,
+			"Using default power settings");
+		rc = cam_actuator_construct_default_power_setting(power_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Construct default actuator power setting failed.");
+			return rc;
+		}
+	}
+
+	/* Parse and fill vreg params for power up settings */
+	rc = msm_camera_fill_vreg_params(
+		&a_ctrl->soc_info,
+		power_info->power_setting,
+		power_info->power_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR,
+			"failed to fill vreg params for power up rc:%d", rc);
+		return rc;
+	}
+
+	/* Parse and fill vreg params for power down settings*/
+	rc = msm_camera_fill_vreg_params(
+		&a_ctrl->soc_info,
+		power_info->power_down_setting,
+		power_info->power_down_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR,
+			"failed to fill vreg params power down rc:%d", rc);
+		return rc;
+	}
+
+	power_info->dev = soc_info->dev;
+
+	if (a_ctrl->io_master_info.master_type == I3C_MASTER)
+		i3c_probe_completion = cam_actuator_get_i3c_completion(a_ctrl->soc_info.index);
+
+	rc = cam_sensor_core_power_up(power_info, soc_info, i3c_probe_completion);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR,
+			"failed in actuator power up rc %d", rc);
+		return rc;
+	}
+
+	rc = camera_io_init(&a_ctrl->io_master_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "cci init failed: rc: %d", rc);
+		goto cci_failure;
+	}
+
+	return rc;
+cci_failure:
+	if (cam_sensor_util_power_down(power_info, soc_info))
+		CAM_ERR(CAM_ACTUATOR, "Power down failure");
+
+	return rc;
+}
+
+static int32_t cam_actuator_power_down(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_power_ctrl_t *power_info;
+	struct cam_hw_soc_info *soc_info = &a_ctrl->soc_info;
+	struct cam_actuator_soc_private  *soc_private;
+
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "failed: a_ctrl %pK", a_ctrl);
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+	soc_info = &a_ctrl->soc_info;
+
+	if (!power_info) {
+		CAM_ERR(CAM_ACTUATOR, "failed: power_info %pK", power_info);
+		return -EINVAL;
+	}
+	rc = cam_sensor_util_power_down(power_info, soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR, "power down the core is failed:%d", rc);
+		return rc;
+	}
+
+	camera_io_release(&a_ctrl->io_master_info);
+
+	return rc;
+}
+
+static int32_t cam_actuator_i2c_modes_util(
+	struct camera_io_master *io_master_info,
+	struct i2c_settings_list *i2c_list)
+{
+	int32_t rc = 0;
+	uint32_t i, size;
+
+	if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_RANDOM) {
+		rc = camera_io_dev_write(io_master_info,
+			&(i2c_list->i2c_settings));
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to random write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_SEQ) {
+		rc = camera_io_dev_write_continuous(
+			io_master_info,
+			&(i2c_list->i2c_settings),
+			CAM_SENSOR_I2C_WRITE_SEQ);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to seq write I2C settings: %d",
+				rc);
+			return rc;
+			}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_BURST) {
+		rc = camera_io_dev_write_continuous(
+			io_master_info,
+			&(i2c_list->i2c_settings),
+			CAM_SENSOR_I2C_WRITE_BURST);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to burst write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_POLL) {
+		size = i2c_list->i2c_settings.size;
+		for (i = 0; i < size; i++) {
+			rc = camera_io_dev_poll(
+			io_master_info,
+			i2c_list->i2c_settings.reg_setting[i].reg_addr,
+			i2c_list->i2c_settings.reg_setting[i].reg_data,
+			i2c_list->i2c_settings.reg_setting[i].data_mask,
+			i2c_list->i2c_settings.addr_type,
+			i2c_list->i2c_settings.data_type,
+			i2c_list->i2c_settings.reg_setting[i].delay);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR,
+					"i2c poll apply setting Fail: %d", rc);
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+int32_t cam_actuator_slaveInfo_pkt_parser(struct cam_actuator_ctrl_t *a_ctrl,
+	uint32_t *cmd_buf, size_t len)
+{
+	int32_t rc = 0;
+	struct cam_cmd_i2c_info *i2c_info;
+
+	if (!a_ctrl || !cmd_buf || (len < sizeof(struct cam_cmd_i2c_info))) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+	if (a_ctrl->io_master_info.master_type == CCI_MASTER) {
+		a_ctrl->io_master_info.cci_client->cci_i2c_master =
+			a_ctrl->cci_i2c_master;
+		a_ctrl->io_master_info.cci_client->i2c_freq_mode =
+			i2c_info->i2c_freq_mode;
+		a_ctrl->io_master_info.cci_client->sid =
+			i2c_info->slave_addr >> 1;
+		CAM_DBG(CAM_ACTUATOR, "Slave addr: 0x%x Freq Mode: %d",
+			i2c_info->slave_addr, i2c_info->i2c_freq_mode);
+	} else if (a_ctrl->io_master_info.master_type == I2C_MASTER) {
+		a_ctrl->io_master_info.client->addr = i2c_info->slave_addr;
+		CAM_DBG(CAM_ACTUATOR, "Slave addr: 0x%x", i2c_info->slave_addr);
+	} else {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Master type: %d",
+			a_ctrl->io_master_info.master_type);
+		 rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int32_t cam_actuator_apply_settings(struct cam_actuator_ctrl_t *a_ctrl,
+	struct i2c_settings_array *i2c_set)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0;
+
+	if (a_ctrl == NULL || i2c_set == NULL) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (i2c_set->is_settings_valid != 1) {
+		CAM_ERR(CAM_ACTUATOR, " Invalid settings");
+		return -EINVAL;
+	}
+
+	list_for_each_entry(i2c_list,
+		&(i2c_set->list_head), list) {
+		rc = cam_actuator_i2c_modes_util(
+			&(a_ctrl->io_master_info),
+			i2c_list);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to apply settings: %d",
+				rc);
+		} else {
+			CAM_DBG(CAM_ACTUATOR,
+				"Success:request ID: %d",
+				i2c_set->request_id);
+		}
+	}
+
+	return rc;
+}
+
+int32_t cam_actuator_apply_request(struct cam_req_mgr_apply_request *apply)
+{
+	int32_t rc = 0, request_id, del_req_id;
+	struct cam_actuator_ctrl_t *a_ctrl = NULL;
+
+	if (!apply) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Input Args");
+		return -EINVAL;
+	}
+
+	a_ctrl = (struct cam_actuator_ctrl_t *)
+		cam_get_device_priv(apply->dev_hdl);
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Device data is NULL");
+		return -EINVAL;
+	}
+	request_id = apply->request_id % MAX_PER_FRAME_ARRAY;
+
+	trace_cam_apply_req("Actuator", a_ctrl->soc_info.index, apply->request_id, apply->link_hdl);
+
+	CAM_DBG(CAM_ACTUATOR, "Request Id: %lld", apply->request_id);
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	if ((apply->request_id ==
+		a_ctrl->i2c_data.per_frame[request_id].request_id) &&
+		(a_ctrl->i2c_data.per_frame[request_id].is_settings_valid)
+		== 1) {
+		rc = cam_actuator_apply_settings(a_ctrl,
+			&a_ctrl->i2c_data.per_frame[request_id]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in applying the request: %lld\n",
+				apply->request_id);
+			goto release_mutex;
+		}
+	}
+	del_req_id = (request_id +
+		MAX_PER_FRAME_ARRAY - MAX_SYSTEM_PIPELINE_DELAY) %
+		MAX_PER_FRAME_ARRAY;
+
+	if (apply->request_id >
+		a_ctrl->i2c_data.per_frame[del_req_id].request_id) {
+		a_ctrl->i2c_data.per_frame[del_req_id].request_id = 0;
+		rc = delete_request(&a_ctrl->i2c_data.per_frame[del_req_id]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Fail deleting the req: %d err: %d\n",
+				del_req_id, rc);
+			goto release_mutex;
+		}
+	} else {
+		CAM_DBG(CAM_ACTUATOR, "No Valid Req to clean Up");
+	}
+
+release_mutex:
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+	return rc;
+}
+
+int32_t cam_actuator_establish_link(
+	struct cam_req_mgr_core_dev_link_setup *link)
+{
+	struct cam_actuator_ctrl_t *a_ctrl = NULL;
+
+	if (!link) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	a_ctrl = (struct cam_actuator_ctrl_t *)
+		cam_get_device_priv(link->dev_hdl);
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	if (link->link_enable) {
+		a_ctrl->bridge_intf.link_hdl = link->link_hdl;
+		a_ctrl->bridge_intf.crm_cb = link->crm_cb;
+	} else {
+		a_ctrl->bridge_intf.link_hdl = -1;
+		a_ctrl->bridge_intf.crm_cb = NULL;
+	}
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+
+	return 0;
+}
+
+static int cam_actuator_update_req_mgr(
+	struct cam_actuator_ctrl_t *a_ctrl,
+	struct cam_packet *csl_packet)
+{
+	int rc = 0;
+	struct cam_req_mgr_add_request add_req;
+
+	memset(&add_req, 0, sizeof(add_req));
+	add_req.link_hdl = a_ctrl->bridge_intf.link_hdl;
+	add_req.req_id = csl_packet->header.request_id;
+	add_req.dev_hdl = a_ctrl->bridge_intf.device_hdl;
+
+	if (a_ctrl->bridge_intf.crm_cb &&
+		a_ctrl->bridge_intf.crm_cb->add_req) {
+		rc = a_ctrl->bridge_intf.crm_cb->add_req(&add_req);
+		if (rc) {
+			if (rc == -EBADR)
+				CAM_INFO(CAM_ACTUATOR,
+					"Adding request: %llu failed: rc: %d, it has been flushed",
+					csl_packet->header.request_id, rc);
+			else
+				CAM_ERR(CAM_ACTUATOR,
+					"Adding request: %llu failed: rc: %d",
+					csl_packet->header.request_id, rc);
+			return rc;
+		}
+		CAM_DBG(CAM_ACTUATOR, "Request Id: %lld added to CRM",
+			add_req.req_id);
+	} else {
+		CAM_ERR(CAM_ACTUATOR, "Can't add Request ID: %lld to CRM",
+			csl_packet->header.request_id);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int32_t cam_actuator_publish_dev_info(struct cam_req_mgr_device_info *info)
+{
+	if (!info) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	info->dev_id = CAM_REQ_MGR_DEVICE_ACTUATOR;
+	strscpy(info->name, CAM_ACTUATOR_NAME, sizeof(info->name));
+	info->p_delay = CAM_PIPELINE_DELAY_1;
+	info->m_delay = CAM_MODESWITCH_DELAY_1;
+	info->trigger = CAM_TRIGGER_POINT_SOF;
+
+	return 0;
+}
+
+int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
+	void *arg)
+{
+	int32_t  rc = 0;
+	int32_t  i = 0;
+	uint32_t total_cmd_buf_in_bytes = 0;
+	size_t   len_of_buff = 0;
+	size_t   remain_len = 0;
+	uint32_t *offset = NULL;
+	uint32_t *cmd_buf = NULL;
+	uintptr_t generic_ptr;
+	uintptr_t generic_pkt_ptr;
+	struct common_header      *cmm_hdr = NULL;
+	struct cam_control        *ioctl_ctrl = NULL;
+	struct cam_packet         *csl_packet = NULL;
+	struct cam_config_dev_cmd config;
+	struct i2c_data_settings  *i2c_data = NULL;
+	struct i2c_settings_array *i2c_reg_settings = NULL;
+	struct cam_cmd_buf_desc   *cmd_desc = NULL;
+	struct cam_actuator_soc_private *soc_private = NULL;
+	struct cam_sensor_power_ctrl_t  *power_info = NULL;
+
+	if (!a_ctrl || !arg) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+
+	power_info = &soc_private->power_info;
+
+	ioctl_ctrl = (struct cam_control *)arg;
+	if (copy_from_user(&config,
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(config)))
+		return -EFAULT;
+	rc = cam_mem_get_cpu_buf(config.packet_handle,
+		&generic_pkt_ptr, &len_of_buff);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "Error in converting command Handle %d",
+			rc);
+		return rc;
+	}
+
+	remain_len = len_of_buff;
+	if ((sizeof(struct cam_packet) > len_of_buff) ||
+		((size_t)config.offset >= len_of_buff -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_ACTUATOR,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len_of_buff);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	remain_len -= (size_t)config.offset;
+	csl_packet = (struct cam_packet *)
+			(generic_pkt_ptr + (uint32_t)config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid packet params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ACTUATOR, "Pkt opcode: %d",	csl_packet->header.op_code);
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) !=
+		CAM_ACTUATOR_PACKET_OPCODE_INIT &&
+		csl_packet->header.request_id <= a_ctrl->last_flush_req
+		&& a_ctrl->last_flush_req != 0) {
+		CAM_DBG(CAM_ACTUATOR,
+			"reject request %lld, last request to flush %lld",
+			csl_packet->header.request_id, a_ctrl->last_flush_req);
+		rc = -EBADR;
+		goto end;
+	}
+
+	if (csl_packet->header.request_id > a_ctrl->last_flush_req)
+		a_ctrl->last_flush_req = 0;
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_ACTUATOR_PACKET_OPCODE_INIT:
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+		/* Loop through multiple command buffers */
+		for (i = 0; i < csl_packet->num_cmd_buf; i++) {
+			rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+			if (rc)
+				return rc;
+
+			total_cmd_buf_in_bytes = cmd_desc[i].length;
+			if (!total_cmd_buf_in_bytes)
+				continue;
+			rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+					&generic_ptr, &len_of_buff);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR, "Failed to get cpu buf");
+				goto end;
+			}
+			cmd_buf = (uint32_t *)generic_ptr;
+			if (!cmd_buf) {
+				CAM_ERR(CAM_ACTUATOR, "invalid cmd buf");
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				rc = -EINVAL;
+				goto end;
+			}
+			if ((len_of_buff < sizeof(struct common_header)) ||
+				(cmd_desc[i].offset > (len_of_buff -
+				sizeof(struct common_header)))) {
+				CAM_ERR(CAM_ACTUATOR,
+					"Invalid length for sensor cmd");
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				rc = -EINVAL;
+				goto end;
+			}
+			remain_len = len_of_buff - cmd_desc[i].offset;
+			cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+			cmm_hdr = (struct common_header *)cmd_buf;
+
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				CAM_DBG(CAM_ACTUATOR,
+					"Received slave info buffer");
+				rc = cam_actuator_slaveInfo_pkt_parser(
+					a_ctrl, cmd_buf, remain_len);
+				if (rc < 0) {
+					CAM_ERR(CAM_ACTUATOR,
+					"Failed to parse slave info: %d", rc);
+					cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+					goto end;
+				}
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
+			case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
+				CAM_DBG(CAM_ACTUATOR,
+					"Received power settings buffer");
+				rc = cam_sensor_update_power_settings(
+					cmd_buf,
+					total_cmd_buf_in_bytes,
+					power_info, remain_len);
+				if (rc) {
+					CAM_ERR(CAM_ACTUATOR,
+					"Failed:parse power settings: %d",
+					rc);
+					cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+					goto end;
+				}
+				break;
+			default:
+				CAM_DBG(CAM_ACTUATOR,
+					"Received initSettings buffer");
+				i2c_data = &(a_ctrl->i2c_data);
+				i2c_reg_settings =
+					&i2c_data->init_settings;
+
+				i2c_reg_settings->request_id = 0;
+				i2c_reg_settings->is_settings_valid = 1;
+				rc = cam_sensor_i2c_command_parser(
+					&a_ctrl->io_master_info,
+					i2c_reg_settings,
+					&cmd_desc[i], 1, NULL);
+				if (rc < 0) {
+					CAM_ERR(CAM_ACTUATOR,
+					"Failed:parse init settings: %d",
+					rc);
+					cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+					goto end;
+				}
+				break;
+			}
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+		}
+
+		if (a_ctrl->cam_act_state == CAM_ACTUATOR_ACQUIRE) {
+			rc = cam_actuator_power_up(a_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR,
+					" Actuator Power up failed");
+				goto end;
+			}
+			a_ctrl->cam_act_state = CAM_ACTUATOR_CONFIG;
+		}
+
+		rc = cam_actuator_apply_settings(a_ctrl,
+			&a_ctrl->i2c_data.init_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR, "Cannot apply Init settings");
+			goto end;
+		}
+
+		/* Delete the request even if the apply is failed */
+		rc = delete_request(&a_ctrl->i2c_data.init_settings);
+		if (rc < 0) {
+			CAM_WARN(CAM_ACTUATOR,
+				"Fail in deleting the Init settings");
+			rc = 0;
+		}
+		break;
+	case CAM_ACTUATOR_PACKET_AUTO_MOVE_LENS:
+		if (a_ctrl->cam_act_state < CAM_ACTUATOR_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+				"Not in right state to move lens: %d",
+				a_ctrl->cam_act_state);
+			goto end;
+		}
+		a_ctrl->setting_apply_state = ACT_APPLY_SETTINGS_NOW;
+
+		i2c_data = &(a_ctrl->i2c_data);
+		i2c_reg_settings = &i2c_data->init_settings;
+
+		i2c_data->init_settings.request_id =
+			csl_packet->header.request_id;
+		i2c_reg_settings->is_settings_valid = 1;
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += csl_packet->cmd_buf_offset / sizeof(uint32_t);
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_sensor_i2c_command_parser(
+			&a_ctrl->io_master_info,
+			i2c_reg_settings,
+			cmd_desc, 1, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Auto move lens parsing failed: %d", rc);
+			goto end;
+		}
+		rc = cam_actuator_update_req_mgr(a_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in adding request to request manager");
+			goto end;
+		}
+		break;
+	case CAM_ACTUATOR_PACKET_MANUAL_MOVE_LENS:
+		if (a_ctrl->cam_act_state < CAM_ACTUATOR_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+				"Not in right state to move lens: %d",
+				a_ctrl->cam_act_state);
+			goto end;
+		}
+
+		a_ctrl->setting_apply_state = ACT_APPLY_SETTINGS_LATER;
+		i2c_data = &(a_ctrl->i2c_data);
+		i2c_reg_settings = &i2c_data->per_frame[
+			csl_packet->header.request_id % MAX_PER_FRAME_ARRAY];
+
+		 i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+		i2c_reg_settings->is_settings_valid = 1;
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += csl_packet->cmd_buf_offset / sizeof(uint32_t);
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_sensor_i2c_command_parser(
+			&a_ctrl->io_master_info,
+			i2c_reg_settings,
+			cmd_desc, 1, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Manual move lens parsing failed: %d", rc);
+			goto end;
+		}
+
+		rc = cam_actuator_update_req_mgr(a_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in adding request to request manager");
+			goto end;
+		}
+		break;
+	case CAM_ACTUATOR_PACKET_NOP_OPCODE:
+		if (a_ctrl->cam_act_state < CAM_ACTUATOR_CONFIG) {
+			CAM_WARN(CAM_ACTUATOR,
+				"Received NOP packets in invalid state: %d",
+				a_ctrl->cam_act_state);
+			rc = -EINVAL;
+			goto end;
+		}
+		rc = cam_actuator_update_req_mgr(a_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in adding request to request manager");
+			goto end;
+		}
+		break;
+	case CAM_ACTUATOR_PACKET_OPCODE_READ: {
+		uint64_t qtime_ns;
+		struct cam_buf_io_cfg *io_cfg;
+		struct i2c_settings_array i2c_read_settings;
+
+		if (a_ctrl->cam_act_state < CAM_ACTUATOR_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+				"Not in right state to read actuator: %d",
+				a_ctrl->cam_act_state);
+			goto end;
+		}
+		CAM_DBG(CAM_ACTUATOR, "number of I/O configs: %d:",
+			csl_packet->num_io_configs);
+		if (csl_packet->num_io_configs == 0) {
+			CAM_ERR(CAM_ACTUATOR, "No I/O configs to process");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		INIT_LIST_HEAD(&(i2c_read_settings.list_head));
+
+		io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+			&csl_packet->payload_flex +
+			csl_packet->io_configs_offset);
+
+		if (io_cfg == NULL) {
+			CAM_ERR(CAM_ACTUATOR, "I/O config is invalid(NULL)");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		i2c_read_settings.is_settings_valid = 1;
+		i2c_read_settings.request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&a_ctrl->io_master_info,
+			&i2c_read_settings,
+			cmd_desc, 1, io_cfg);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"actuator read pkt parsing failed: %d", rc);
+			goto end;
+		}
+
+		rc = cam_sensor_i2c_read_data(
+			&i2c_read_settings,
+			&a_ctrl->io_master_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR, "cannot read data, rc:%d", rc);
+			delete_request(&i2c_read_settings);
+			goto end;
+		}
+
+		if (csl_packet->num_io_configs > 1) {
+			rc = cam_sensor_util_get_current_qtimer_ns(&qtime_ns);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "failed to get qtimer rc:%d");
+				delete_request(&i2c_read_settings);
+				return rc;
+			}
+
+			rc = cam_sensor_util_write_qtimer_to_io_buffer(
+				qtime_ns, &io_cfg[1]);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR,
+					"write qtimer failed rc: %d", rc);
+				delete_request(&i2c_read_settings);
+				return rc;
+			}
+		}
+
+		rc = delete_request(&i2c_read_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in deleting the read settings");
+			goto end;
+		}
+		break;
+		}
+	default:
+		CAM_ERR(CAM_ACTUATOR, "Wrong Opcode: %d",
+			csl_packet->header.op_code & 0xFFFFFF);
+		rc = -EINVAL;
+		goto end;
+	}
+
+end:
+	cam_mem_put_cpu_buf(config.packet_handle);
+	return rc;
+}
+
+void cam_actuator_shutdown(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	int rc = 0;
+	struct cam_actuator_soc_private  *soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info =
+		&soc_private->power_info;
+
+	if (a_ctrl->cam_act_state == CAM_ACTUATOR_INIT)
+		return;
+
+	if (a_ctrl->cam_act_state >= CAM_ACTUATOR_CONFIG) {
+		rc = cam_actuator_power_down(a_ctrl);
+		if (rc < 0)
+			CAM_ERR(CAM_ACTUATOR, "Actuator Power down failed");
+		a_ctrl->cam_act_state = CAM_ACTUATOR_ACQUIRE;
+	}
+
+	if (a_ctrl->cam_act_state >= CAM_ACTUATOR_ACQUIRE) {
+		rc = cam_destroy_device_hdl(a_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_ACTUATOR, "destroying  dhdl failed");
+		a_ctrl->bridge_intf.device_hdl = -1;
+		a_ctrl->bridge_intf.link_hdl = -1;
+		a_ctrl->bridge_intf.session_hdl = -1;
+	}
+
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_setting_size = 0;
+	power_info->power_down_setting_size = 0;
+	a_ctrl->last_flush_req = 0;
+
+	a_ctrl->cam_act_state = CAM_ACTUATOR_INIT;
+}
+
+int32_t cam_actuator_driver_cmd(struct cam_actuator_ctrl_t *a_ctrl,
+	void *arg)
+{
+	int rc = 0;
+	struct cam_control *cmd = (struct cam_control *)arg;
+	struct cam_actuator_soc_private *soc_private = NULL;
+	struct cam_sensor_power_ctrl_t  *power_info = NULL;
+
+	if (!a_ctrl || !cmd) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+
+	power_info = &soc_private->power_info;
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ACTUATOR, "Opcode to Actuator: %d", cmd->op_code);
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	switch (cmd->op_code) {
+	case CAM_ACQUIRE_DEV: {
+		struct cam_sensor_acquire_dev actuator_acq_dev;
+		struct cam_create_dev_hdl bridge_params;
+
+		if (a_ctrl->bridge_intf.device_hdl != -1) {
+			CAM_ERR(CAM_ACTUATOR, "Device is already acquired");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = copy_from_user(&actuator_acq_dev,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(actuator_acq_dev));
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR, "Failed Copying from user\n");
+			goto release_mutex;
+		}
+
+		bridge_params.session_hdl = actuator_acq_dev.session_handle;
+		bridge_params.ops = &a_ctrl->bridge_intf.ops;
+		bridge_params.v4l2_sub_dev_flag = 0;
+		bridge_params.media_entity_flag = 0;
+		bridge_params.priv = a_ctrl;
+		bridge_params.dev_id = CAM_ACTUATOR;
+
+		actuator_acq_dev.device_handle =
+			cam_create_device_hdl(&bridge_params);
+		if (actuator_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_ACTUATOR, "Can not create device handle");
+			goto release_mutex;
+		}
+		a_ctrl->bridge_intf.device_hdl = actuator_acq_dev.device_handle;
+		a_ctrl->bridge_intf.session_hdl =
+			actuator_acq_dev.session_handle;
+
+		CAM_DBG(CAM_ACTUATOR, "Device Handle: %d",
+			actuator_acq_dev.device_handle);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&actuator_acq_dev,
+			sizeof(struct cam_sensor_acquire_dev))) {
+			CAM_ERR(CAM_ACTUATOR, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+
+		a_ctrl->cam_act_state = CAM_ACTUATOR_ACQUIRE;
+	}
+		break;
+	case CAM_RELEASE_DEV: {
+		if (a_ctrl->cam_act_state == CAM_ACTUATOR_START) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+				"Cant release actuator: in start state");
+			goto release_mutex;
+		}
+
+		if (a_ctrl->bridge_intf.device_hdl == -1) {
+			CAM_ERR(CAM_ACTUATOR, "link hdl: %d device hdl: %d",
+				a_ctrl->bridge_intf.device_hdl,
+				a_ctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (a_ctrl->cam_act_state == CAM_ACTUATOR_CONFIG) {
+			rc = cam_actuator_power_down(a_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR,
+					"Actuator Power Down Failed");
+				goto release_mutex;
+			}
+		}
+
+		if (a_ctrl->bridge_intf.link_hdl != -1) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Device [%d] still active on link 0x%x",
+				a_ctrl->cam_act_state,
+				a_ctrl->bridge_intf.link_hdl);
+			rc = -EAGAIN;
+			goto release_mutex;
+		}
+
+		rc = cam_destroy_device_hdl(a_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_ACTUATOR, "destroying the device hdl");
+		a_ctrl->bridge_intf.device_hdl = -1;
+		a_ctrl->bridge_intf.link_hdl = -1;
+		a_ctrl->bridge_intf.session_hdl = -1;
+		a_ctrl->cam_act_state = CAM_ACTUATOR_INIT;
+		a_ctrl->last_flush_req = 0;
+		kfree(power_info->power_setting);
+		kfree(power_info->power_down_setting);
+		power_info->power_setting = NULL;
+		power_info->power_down_setting = NULL;
+		power_info->power_down_setting_size = 0;
+		power_info->power_setting_size = 0;
+	}
+		break;
+	case CAM_QUERY_CAP: {
+		struct cam_actuator_query_cap actuator_cap = {0};
+
+		actuator_cap.slot_info = a_ctrl->soc_info.index;
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&actuator_cap,
+			sizeof(struct cam_actuator_query_cap))) {
+			CAM_ERR(CAM_ACTUATOR, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+	}
+		break;
+	case CAM_START_DEV: {
+		if (a_ctrl->cam_act_state != CAM_ACTUATOR_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+			"Not in right state to start : %d",
+			a_ctrl->cam_act_state);
+			goto release_mutex;
+		}
+		a_ctrl->cam_act_state = CAM_ACTUATOR_START;
+		a_ctrl->last_flush_req = 0;
+	}
+		break;
+	case CAM_STOP_DEV: {
+		struct i2c_settings_array *i2c_set = NULL;
+		int i;
+
+		if (a_ctrl->cam_act_state != CAM_ACTUATOR_START) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+			"Not in right state to stop : %d",
+			a_ctrl->cam_act_state);
+			goto release_mutex;
+		}
+
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			i2c_set = &(a_ctrl->i2c_data.per_frame[i]);
+
+			if (i2c_set->is_settings_valid == 1) {
+				rc = delete_request(i2c_set);
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"delete request: %lld rc: %d",
+						i2c_set->request_id, rc);
+			}
+		}
+		a_ctrl->last_flush_req = 0;
+		a_ctrl->cam_act_state = CAM_ACTUATOR_CONFIG;
+	}
+		break;
+	case CAM_CONFIG_DEV: {
+		a_ctrl->setting_apply_state =
+			ACT_APPLY_SETTINGS_LATER;
+		rc = cam_actuator_i2c_pkt_parse(a_ctrl, arg);
+		if (rc < 0) {
+			if (rc == -EBADR)
+				CAM_INFO(CAM_ACTUATOR,
+					"Failed in actuator Parsing, it has been flushed");
+			else
+				CAM_ERR(CAM_ACTUATOR,
+					"Failed in actuator Parsing");
+			goto release_mutex;
+		}
+
+		if (a_ctrl->setting_apply_state ==
+			ACT_APPLY_SETTINGS_NOW) {
+			rc = cam_actuator_apply_settings(a_ctrl,
+				&a_ctrl->i2c_data.init_settings);
+			if ((rc == -EAGAIN) &&
+			(a_ctrl->io_master_info.master_type == CCI_MASTER)) {
+				CAM_WARN(CAM_ACTUATOR,
+					"CCI HW is in resetting mode:: Reapplying Init settings");
+				usleep_range(1000, 1010);
+				rc = cam_actuator_apply_settings(a_ctrl,
+					&a_ctrl->i2c_data.init_settings);
+			}
+
+			if (rc < 0)
+				CAM_ERR(CAM_ACTUATOR,
+					"Failed to apply Init settings: rc = %d",
+					rc);
+			/* Delete the request even if the apply is failed */
+			rc = delete_request(&a_ctrl->i2c_data.init_settings);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR,
+					"Failed in Deleting the Init Pkt: %d",
+					rc);
+				goto release_mutex;
+			}
+		}
+	}
+		break;
+	default:
+		CAM_ERR(CAM_ACTUATOR, "Invalid Opcode %d", cmd->op_code);
+	}
+
+release_mutex:
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+
+	return rc;
+}
+
+int32_t cam_actuator_flush_request(struct cam_req_mgr_flush_request *flush_req)
+{
+	int32_t rc = 0, i;
+	uint32_t cancel_req_id_found = 0;
+	struct cam_actuator_ctrl_t *a_ctrl = NULL;
+	struct i2c_settings_array *i2c_set = NULL;
+
+	if (!flush_req)
+		return -EINVAL;
+
+	a_ctrl = (struct cam_actuator_ctrl_t *)
+		cam_get_device_priv(flush_req->dev_hdl);
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	if (a_ctrl->i2c_data.per_frame == NULL) {
+		CAM_ERR(CAM_ACTUATOR, "i2c frame data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		a_ctrl->last_flush_req = flush_req->req_id;
+		CAM_DBG(CAM_ACTUATOR, "last reqest to flush is %lld",
+			flush_req->req_id);
+	}
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		i2c_set = &(a_ctrl->i2c_data.per_frame[i]);
+
+		if ((flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ)
+				&& (i2c_set->request_id != flush_req->req_id))
+			continue;
+
+		if (i2c_set->is_settings_valid == 1) {
+			rc = delete_request(i2c_set);
+			if (rc < 0)
+				CAM_ERR(CAM_ACTUATOR,
+					"delete request: %lld rc: %d",
+					i2c_set->request_id, rc);
+
+			if (flush_req->type ==
+				CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+				cancel_req_id_found = 1;
+				break;
+			}
+		}
+	}
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ &&
+		!cancel_req_id_found)
+		CAM_DBG(CAM_ACTUATOR,
+			"Flush request id:%lld not found in the pending list",
+			flush_req->req_id);
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.h
@@ -0,0 +1,69 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ACTUATOR_CORE_H_
+#define _CAM_ACTUATOR_CORE_H_
+
+#include "cam_actuator_dev.h"
+
+/**
+ * @power_info: power setting info to control the power
+ *
+ * This API construct the default actuator power setting.
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int32_t cam_actuator_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info);
+
+/**
+ * @apply: Req mgr structure for applying request
+ *
+ * This API applies the request that is mentioned
+ */
+int32_t cam_actuator_apply_request(struct cam_req_mgr_apply_request *apply);
+
+/**
+ * @info: Sub device info to req mgr
+ *
+ * This API publish the subdevice info to req mgr
+ */
+int32_t cam_actuator_publish_dev_info(struct cam_req_mgr_device_info *info);
+
+/**
+ * @flush: Req mgr structure for flushing request
+ *
+ * This API flushes the request that is mentioned
+ */
+int cam_actuator_flush_request(struct cam_req_mgr_flush_request *flush);
+
+
+/**
+ * @link: Link setup info
+ *
+ * This API establishes link actuator subdevice with req mgr
+ */
+int32_t cam_actuator_establish_link(
+	struct cam_req_mgr_core_dev_link_setup *link);
+
+/**
+ * @a_ctrl: Actuator ctrl structure
+ * @arg:    Camera control command argument
+ *
+ * This API handles the camera control argument reached to actuator
+ */
+int32_t cam_actuator_driver_cmd(struct cam_actuator_ctrl_t *a_ctrl, void *arg);
+
+/**
+ * @a_ctrl: Actuator ctrl structure
+ *
+ * This API handles the shutdown ioctl/close
+ */
+void cam_actuator_shutdown(struct cam_actuator_ctrl_t *a_ctrl);
+
+struct completion *cam_actuator_get_i3c_completion(uint32_t index);
+
+#endif /* _CAM_ACTUATOR_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.c
@@ -0,0 +1,675 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_actuator_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_actuator_soc.h"
+#include "cam_actuator_core.h"
+#include "cam_trace.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+static struct cam_i3c_actuator_data {
+	struct cam_actuator_ctrl_t                  *a_ctrl;
+	struct completion                            probe_complete;
+} g_i3c_actuator_data[MAX_CAMERAS];
+
+struct completion *cam_actuator_get_i3c_completion(uint32_t index)
+{
+	return &g_i3c_actuator_data[index].probe_complete;
+}
+
+static int cam_actuator_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_actuator_ctrl_t *a_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "a_ctrl ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	cam_actuator_shutdown(a_ctrl);
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+
+	return 0;
+}
+
+static int cam_actuator_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_ACTUATOR,
+			"CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_actuator_subdev_close_internal(sd, fh);
+}
+
+static long cam_actuator_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int rc = 0;
+	struct cam_actuator_ctrl_t *a_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_actuator_driver_cmd(a_ctrl, arg);
+		if (rc) {
+			if (rc == -EBADR)
+				CAM_INFO(CAM_ACTUATOR,
+					"Failed for driver_cmd: %d, it has been flushed",
+					rc);
+			else
+				CAM_ERR(CAM_ACTUATOR,
+					"Failed for driver_cmd: %d", rc);
+		}
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_actuator_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ACTUATOR, "Invalid ioctl cmd: %u", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_actuator_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_ACTUATOR,
+			"Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		cmd = VIDIOC_CAM_CONTROL;
+		rc = cam_actuator_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in actuator subdev handling rc: %d",
+				rc);
+			return rc;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ACTUATOR, "Invalid compat ioctl: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+	return rc;
+}
+#endif
+
+static struct v4l2_subdev_core_ops cam_actuator_subdev_core_ops = {
+	.ioctl = cam_actuator_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_actuator_init_subdev_do_ioctl,
+#endif
+};
+
+static struct v4l2_subdev_ops cam_actuator_subdev_ops = {
+	.core = &cam_actuator_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cam_actuator_internal_ops = {
+	.close = cam_actuator_subdev_close,
+};
+
+static int cam_actuator_init_subdev(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	int rc = 0;
+
+	a_ctrl->v4l2_dev_str.internal_ops =
+		&cam_actuator_internal_ops;
+	a_ctrl->v4l2_dev_str.ops =
+		&cam_actuator_subdev_ops;
+	strscpy(a_ctrl->device_name, CAMX_ACTUATOR_DEV_NAME,
+		sizeof(a_ctrl->device_name));
+	a_ctrl->v4l2_dev_str.name =
+		a_ctrl->device_name;
+	a_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	a_ctrl->v4l2_dev_str.ent_function =
+		CAM_ACTUATOR_DEVICE_TYPE;
+	a_ctrl->v4l2_dev_str.token = a_ctrl;
+	a_ctrl->v4l2_dev_str.close_seq_prior =
+		 CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(a_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_ACTUATOR,
+			"Fail with cam_register_subdev rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_actuator_i2c_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t                          rc = 0;
+	int32_t                          i = 0;
+	struct i2c_client               *client;
+	struct cam_actuator_ctrl_t      *a_ctrl;
+	struct cam_hw_soc_info          *soc_info = NULL;
+	struct cam_actuator_soc_private *soc_private = NULL;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (!client) {
+		CAM_ERR(CAM_ACTUATOR,
+			"Failed to get i2c client");
+		return -EFAULT;
+	}
+
+	/* Create sensor control structure */
+	a_ctrl = kzalloc(sizeof(*a_ctrl), GFP_KERNEL);
+	if (!a_ctrl)
+		return -ENOMEM;
+
+	i2c_set_clientdata(client, a_ctrl);
+
+	soc_private = kzalloc(sizeof(struct cam_actuator_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto free_ctrl;
+	}
+	a_ctrl->soc_info.soc_private = soc_private;
+
+	a_ctrl->io_master_info.client = client;
+	soc_info = &a_ctrl->soc_info;
+	soc_info->dev = &client->dev;
+	soc_info->dev_name = client->name;
+	a_ctrl->io_master_info.master_type = I2C_MASTER;
+
+	rc = cam_actuator_parse_dt(a_ctrl, &client->dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "failed: cam_sensor_parse_dt rc %d", rc);
+		goto free_soc;
+	}
+
+	rc = cam_actuator_init_subdev(a_ctrl);
+	if (rc)
+		goto free_soc;
+
+	if (soc_private->i2c_info.slave_addr != 0)
+		a_ctrl->io_master_info.client->addr =
+			soc_private->i2c_info.slave_addr;
+
+	a_ctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (a_ctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto unreg_subdev;
+	}
+
+	cam_sensor_module_add_i2c_device((void *) a_ctrl, CAM_SENSOR_ACTUATOR);
+
+	INIT_LIST_HEAD(&(a_ctrl->i2c_data.init_settings.list_head));
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
+		INIT_LIST_HEAD(&(a_ctrl->i2c_data.per_frame[i].list_head));
+
+	a_ctrl->bridge_intf.device_hdl = -1;
+	a_ctrl->bridge_intf.link_hdl = -1;
+	a_ctrl->bridge_intf.ops.get_dev_info =
+		cam_actuator_publish_dev_info;
+	a_ctrl->bridge_intf.ops.link_setup =
+		cam_actuator_establish_link;
+	a_ctrl->bridge_intf.ops.apply_req =
+		cam_actuator_apply_request;
+	a_ctrl->last_flush_req = 0;
+	a_ctrl->cam_act_state = CAM_ACTUATOR_INIT;
+
+	return rc;
+
+unreg_subdev:
+	cam_unregister_subdev(&(a_ctrl->v4l2_dev_str));
+free_soc:
+	kfree(soc_private);
+free_ctrl:
+	kfree(a_ctrl);
+	return rc;
+}
+
+static void cam_actuator_i2c_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct i2c_client               *client = NULL;
+	struct cam_actuator_ctrl_t      *a_ctrl = NULL;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (!client) {
+		CAM_ERR(CAM_ACTUATOR,
+			"Failed to get i2c client");
+		return;
+	}
+
+	a_ctrl = i2c_get_clientdata(client);
+	/* Handle I2C Devices */
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Actuator device is NULL");
+		return;
+	}
+
+	CAM_INFO(CAM_ACTUATOR, "i2c remove invoked");
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	cam_actuator_shutdown(a_ctrl);
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+	cam_unregister_subdev(&(a_ctrl->v4l2_dev_str));
+
+	cam_actuator_release_power_domain(a_ctrl);
+
+	/*Free Allocated Mem */
+	kfree(a_ctrl->i2c_data.per_frame);
+	a_ctrl->i2c_data.per_frame = NULL;
+	a_ctrl->soc_info.soc_private = NULL;
+	v4l2_set_subdevdata(&a_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(a_ctrl);
+}
+
+const static struct component_ops cam_actuator_i2c_component_ops = {
+	.bind = cam_actuator_i2c_component_bind,
+	.unbind = cam_actuator_i2c_component_unbind,
+};
+
+static int32_t cam_actuator_i2c_driver_probe(struct i2c_client *client)
+{
+	int rc = 0;
+
+	if (client == NULL) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_ACTUATOR, "%s :: i2c_check_functionality failed",
+			 client->name);
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_ACTUATOR, "Adding sensor actuator component");
+	rc = component_add(&client->dev, &cam_actuator_i2c_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ACTUATOR, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_actuator_platform_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t                          rc = 0;
+	int32_t                          i = 0;
+	bool                             i3c_i2c_target;
+	struct cam_actuator_ctrl_t       *a_ctrl = NULL;
+	struct cam_actuator_soc_private  *soc_private = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return 0;
+
+	/* Create actuator control structure */
+	a_ctrl = devm_kzalloc(&pdev->dev,
+		sizeof(struct cam_actuator_ctrl_t), GFP_KERNEL);
+	if (!a_ctrl)
+		return -ENOMEM;
+
+	/*fill in platform device*/
+	a_ctrl->v4l2_dev_str.pdev = pdev;
+	a_ctrl->soc_info.pdev = pdev;
+	a_ctrl->soc_info.dev = &pdev->dev;
+	a_ctrl->soc_info.dev_name = pdev->name;
+	a_ctrl->io_master_info.master_type = CCI_MASTER;
+
+	a_ctrl->io_master_info.cci_client = kzalloc(sizeof(
+		struct cam_sensor_cci_client), GFP_KERNEL);
+	if (!(a_ctrl->io_master_info.cci_client)) {
+		rc = -ENOMEM;
+		goto free_ctrl;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_actuator_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto free_cci_client;
+	}
+	a_ctrl->soc_info.soc_private = soc_private;
+	soc_private->power_info.dev = &pdev->dev;
+
+	a_ctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (a_ctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto free_soc;
+	}
+
+	cam_sensor_module_add_i2c_device((void *) a_ctrl, CAM_SENSOR_ACTUATOR);
+
+	INIT_LIST_HEAD(&(a_ctrl->i2c_data.init_settings.list_head));
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
+		INIT_LIST_HEAD(&(a_ctrl->i2c_data.per_frame[i].list_head));
+
+	rc = cam_actuator_parse_dt(a_ctrl, &(pdev->dev));
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "Paring actuator dt failed rc %d", rc);
+		goto free_mem;
+	}
+
+	/* Fill platform device id*/
+	pdev->id = a_ctrl->soc_info.index;
+
+	rc = cam_actuator_init_subdev(a_ctrl);
+	if (rc)
+		goto free_mem;
+
+	a_ctrl->bridge_intf.device_hdl = -1;
+	a_ctrl->bridge_intf.link_hdl = -1;
+	a_ctrl->bridge_intf.ops.get_dev_info =
+		cam_actuator_publish_dev_info;
+	a_ctrl->bridge_intf.ops.link_setup =
+		cam_actuator_establish_link;
+	a_ctrl->bridge_intf.ops.apply_req =
+		cam_actuator_apply_request;
+	a_ctrl->bridge_intf.ops.flush_req =
+		cam_actuator_flush_request;
+	a_ctrl->last_flush_req = 0;
+
+	platform_set_drvdata(pdev, a_ctrl);
+	a_ctrl->cam_act_state = CAM_ACTUATOR_INIT;
+	CAM_DBG(CAM_ACTUATOR, "Component bound successfully %d",
+		a_ctrl->soc_info.index);
+
+	g_i3c_actuator_data[a_ctrl->soc_info.index].a_ctrl = a_ctrl;
+	init_completion(&g_i3c_actuator_data[a_ctrl->soc_info.index].probe_complete);
+
+	return rc;
+
+free_mem:
+	kfree(a_ctrl->i2c_data.per_frame);
+free_soc:
+	kfree(soc_private);
+free_cci_client:
+	kfree(a_ctrl->io_master_info.cci_client);
+free_ctrl:
+	devm_kfree(&pdev->dev, a_ctrl);
+	return rc;
+}
+
+static void cam_actuator_platform_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_actuator_ctrl_t      *a_ctrl;
+	bool                             i3c_i2c_target;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return;
+
+	a_ctrl = platform_get_drvdata(pdev);
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Actuator device is NULL");
+		return;
+	}
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	cam_actuator_shutdown(a_ctrl);
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+	cam_unregister_subdev(&(a_ctrl->v4l2_dev_str));
+
+	cam_actuator_release_power_domain(a_ctrl);
+
+	kfree(a_ctrl->io_master_info.cci_client);
+	a_ctrl->io_master_info.cci_client = NULL;
+	kfree(a_ctrl->soc_info.soc_private);
+	a_ctrl->soc_info.soc_private = NULL;
+	kfree(a_ctrl->i2c_data.per_frame);
+	a_ctrl->i2c_data.per_frame = NULL;
+	v4l2_set_subdevdata(&a_ctrl->v4l2_dev_str.sd, NULL);
+	platform_set_drvdata(pdev, NULL);
+	devm_kfree(&pdev->dev, a_ctrl);
+	CAM_INFO(CAM_ACTUATOR, "Actuator component unbinded");
+}
+
+const static struct component_ops cam_actuator_platform_component_ops = {
+	.bind = cam_actuator_platform_component_bind,
+	.unbind = cam_actuator_platform_component_unbind,
+};
+
+int cam_actuator_i2c_driver_remove_common(struct i2c_client *client)
+{
+	component_del(&client->dev, &cam_actuator_i2c_component_ops);
+
+	return 0;
+}
+
+static int32_t cam_actuator_platform_remove(
+	struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_actuator_platform_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_actuator_driver_dt_match[] = {
+	{.compatible = "qcom,actuator"},
+	{}
+};
+
+static int32_t cam_actuator_driver_platform_probe(
+	struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ACTUATOR, "Adding sensor actuator component");
+	rc = component_add(&pdev->dev, &cam_actuator_platform_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ACTUATOR, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+MODULE_DEVICE_TABLE(of, cam_actuator_driver_dt_match);
+
+struct platform_driver cam_actuator_platform_driver = {
+	.probe = cam_actuator_driver_platform_probe,
+	.driver = {
+		.name = "qcom,actuator",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_actuator_driver_dt_match,
+		.suppress_bind_attrs = true,
+	},
+	.remove = cam_actuator_platform_remove,
+};
+
+static const struct i2c_device_id i2c_id[] = {
+	{ACTUATOR_DRIVER_I2C, (kernel_ulong_t)NULL},
+	{ }
+};
+
+static const struct of_device_id cam_actuator_i2c_driver_dt_match[] = {
+	{.compatible = "qcom,cam-i2c-actuator"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_actuator_i2c_driver_dt_match);
+
+struct i2c_driver cam_actuator_i2c_driver = {
+	.id_table = i2c_id,
+	.probe  = cam_actuator_i2c_driver_probe,
+	.remove = cam_actuator_i2c_driver_remove,
+	.driver = {
+		.of_match_table = cam_actuator_i2c_driver_dt_match,
+		.owner = THIS_MODULE,
+		.name = ACTUATOR_DRIVER_I2C,
+		.suppress_bind_attrs = true,
+	},
+};
+
+static struct i3c_device_id actuator_i3c_id[MAX_I3C_DEVICE_ID_ENTRIES + 1];
+
+static int cam_actuator_i3c_driver_probe(struct i3c_device *client)
+{
+	int32_t rc = 0;
+	struct cam_actuator_ctrl_t       *a_ctrl = NULL;
+	uint32_t                          index;
+	struct device                    *dev;
+
+	if (!client) {
+		CAM_INFO(CAM_ACTUATOR, "Null Client pointer");
+		return -EINVAL;
+	}
+
+	dev = &client->dev;
+
+	CAM_DBG(CAM_ACTUATOR, "Probe for I3C Slave %s", dev_name(dev));
+
+	rc = of_property_read_u32(dev->of_node, "cell-index", &index);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR, "device %s failed to read cell-index", dev_name(dev));
+		return rc;
+	}
+
+	if (index >= MAX_CAMERAS) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Cell-Index: %u for %s", index, dev_name(dev));
+		return -EINVAL;
+	}
+
+	a_ctrl = g_i3c_actuator_data[index].a_ctrl;
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR,
+			"a_ctrl is null. I3C Probe before platfom driver probe for %s",
+			dev_name(dev));
+		return -EINVAL;
+	}
+
+	a_ctrl->io_master_info.i3c_client = client;
+
+	complete_all(&g_i3c_actuator_data[index].probe_complete);
+
+	CAM_DBG(CAM_ACTUATOR, "I3C Probe Finished for %s", dev_name(dev));
+	return rc;
+}
+
+static struct i3c_driver cam_actuator_i3c_driver = {
+	.id_table = actuator_i3c_id,
+	.probe = cam_actuator_i3c_driver_probe,
+	.remove = cam_i3c_driver_remove,
+	.driver = {
+		.owner = THIS_MODULE,
+		.name = ACTUATOR_DRIVER_I3C,
+		.of_match_table = cam_actuator_driver_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_actuator_driver_init(void)
+{
+	int32_t rc = 0;
+	struct device_node                      *dev;
+	int num_entries = 0;
+
+	rc = platform_driver_register(&cam_actuator_platform_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR,
+			"platform_driver_register failed rc = %d", rc);
+		return rc;
+	}
+
+	rc = i2c_add_driver(&cam_actuator_i2c_driver);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR, "i2c_add_driver failed rc = %d", rc);
+		goto i2c_register_err;
+	}
+
+	memset(actuator_i3c_id, 0, sizeof(struct i3c_device_id) * (MAX_I3C_DEVICE_ID_ENTRIES + 1));
+
+	dev = of_find_node_by_name(NULL, I3C_SENSOR_DEV_ID_DT_NODE);
+	if (!dev) {
+		CAM_DBG(CAM_ACTUATOR, "Couldnt Find the i3c-id-table dev node");
+		return 0;
+	}
+
+	rc = cam_sensor_count_elems_i3c_device_id(dev, &num_entries,
+		"i3c-actuator-id-table");
+	if (rc)
+		return 0;
+
+	rc = cam_sensor_fill_i3c_device_id(dev, num_entries,
+		"i3c-actuator-id-table", actuator_i3c_id);
+	if (rc)
+		goto i3c_register_err;
+
+	rc = i3c_driver_register_with_owner(&cam_actuator_i3c_driver, THIS_MODULE);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR, "i3c_driver registration failed, rc: %d", rc);
+		goto i3c_register_err;
+	}
+
+	return 0;
+
+i3c_register_err:
+	i2c_del_driver(&cam_actuator_i2c_driver);
+i2c_register_err:
+	platform_driver_unregister(&cam_actuator_platform_driver);
+
+	return rc;
+}
+
+void cam_actuator_driver_exit(void)
+{
+	struct device_node *dev;
+
+	platform_driver_unregister(&cam_actuator_platform_driver);
+	i2c_del_driver(&cam_actuator_i2c_driver);
+
+	dev = of_find_node_by_name(NULL, I3C_SENSOR_DEV_ID_DT_NODE);
+	if (!dev) {
+		CAM_DBG(CAM_ACTUATOR, "Couldnt Find the i3c-id-table dev node");
+		return;
+	}
+
+	i3c_driver_unregister(&cam_actuator_i3c_driver);
+}
+
+MODULE_DESCRIPTION("cam_actuator_driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.h
@@ -0,0 +1,141 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#ifndef _CAM_ACTUATOR_DEV_H_
+#define _CAM_ACTUATOR_DEV_H_
+
+#include <cam_sensor_io.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <cam_cci_dev.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_subdev.h>
+#include "cam_sensor_util.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_context.h"
+
+#define NUM_MASTERS 2
+#define NUM_QUEUES 2
+
+#define ACTUATOR_DRIVER_I2C                    "cam-i2c-actuator"
+#define CAMX_ACTUATOR_DEV_NAME                 "cam-actuator-driver"
+#define ACTUATOR_DRIVER_I3C                    "i3c_camera_actuator"
+
+
+#define MSM_ACTUATOR_MAX_VREGS (10)
+#define ACTUATOR_MAX_POLL_COUNT 10
+
+enum cam_actuator_apply_state_t {
+	ACT_APPLY_SETTINGS_NOW,
+	ACT_APPLY_SETTINGS_LATER,
+};
+
+enum cam_actuator_state {
+	CAM_ACTUATOR_INIT,
+	CAM_ACTUATOR_ACQUIRE,
+	CAM_ACTUATOR_CONFIG,
+	CAM_ACTUATOR_START,
+};
+
+/**
+ * struct cam_actuator_i2c_info_t - I2C info
+ * @slave_addr      :   slave address
+ * @i2c_freq_mode   :   i2c frequency mode
+ */
+struct cam_actuator_i2c_info_t {
+	uint16_t slave_addr;
+	uint8_t i2c_freq_mode;
+};
+
+struct cam_actuator_soc_private {
+	struct cam_actuator_i2c_info_t i2c_info;
+	struct cam_sensor_power_ctrl_t power_info;
+};
+
+/**
+ * struct actuator_intf_params
+ * @device_hdl: Device Handle
+ * @session_hdl: Session Handle
+ * @ops: KMD operations
+ * @crm_cb: Callback API pointers
+ */
+struct actuator_intf_params {
+	int32_t device_hdl;
+	int32_t session_hdl;
+	int32_t link_hdl;
+	struct cam_req_mgr_kmd_ops ops;
+	struct cam_req_mgr_crm_cb *crm_cb;
+};
+
+/**
+ * struct cam_actuator_ctrl_t
+ * @device_name: Device name
+ * @i2c_driver: I2C device info
+ * @pdev: Platform device
+ * @cci_i2c_master: I2C structure
+ * @io_master_info: Information about the communication master
+ * @actuator_mutex: Actuator mutex
+ * @is_i3c_device : A Flag to indicate whether this actuator is I3C device
+ * @act_apply_state: Actuator settings aRegulator config
+ * @id: Cell Index
+ * @res_apply_state: Actuator settings apply state
+ * @cam_act_state:   Actuator state
+ * @gconf: GPIO config
+ * @pinctrl_info: Pinctrl information
+ * @v4l2_dev_str: V4L2 device structure
+ * @i2c_data: I2C register settings structure
+ * @act_info: Sensor query cap structure
+ * @of_node: Node ptr
+ * @last_flush_req: Last request to flush
+ */
+struct cam_actuator_ctrl_t {
+	char device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct i2c_driver *i2c_driver;
+	enum cci_i2c_master_t cci_i2c_master;
+	enum cci_device_num cci_num;
+	struct camera_io_master io_master_info;
+	struct cam_hw_soc_info soc_info;
+	struct mutex actuator_mutex;
+	bool is_i3c_device;
+	uint32_t id;
+	enum cam_actuator_apply_state_t setting_apply_state;
+	enum cam_actuator_state cam_act_state;
+	uint8_t cam_pinctrl_status;
+	struct cam_subdev v4l2_dev_str;
+	struct i2c_data_settings i2c_data;
+	struct cam_actuator_query_cap act_info;
+	struct actuator_intf_params bridge_intf;
+	uint32_t last_flush_req;
+};
+
+/**
+ * @brief : API to remove Actuator i2c Hw from driver framework.
+ * *@return return 0 on success.
+ */
+int cam_actuator_i2c_driver_remove_common(struct i2c_client *client);
+
+/**
+ * @brief : API to register Actuator hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_actuator_driver_init(void);
+
+/**
+ * @brief : API to remove Actuator Hw from platform framework.
+ */
+void cam_actuator_driver_exit(void);
+#endif /* _CAM_ACTUATOR_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.c
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_sensor_util.h>
+#include <cam_sensor_io.h>
+#include <cam_req_mgr_util.h>
+#include "cam_actuator_soc.h"
+#include "cam_soc_util.h"
+
+int32_t cam_actuator_parse_dt(struct cam_actuator_ctrl_t *a_ctrl,
+	struct device *dev)
+{
+	int32_t                         i, rc = 0;
+	struct cam_hw_soc_info          *soc_info = &a_ctrl->soc_info;
+	struct cam_actuator_soc_private *soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t  *power_info = &soc_private->power_info;
+	struct device_node              *of_node = NULL;
+	struct device_node              *of_parent = NULL;
+
+	/* Initialize mutex */
+	mutex_init(&(a_ctrl->actuator_mutex));
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "parsing common soc dt(rc %d)", rc);
+		return rc;
+	}
+
+	of_node = soc_info->dev->of_node;
+
+	rc = of_property_read_bool(of_node, "i3c-target");
+	if (rc) {
+		a_ctrl->is_i3c_device = true;
+		a_ctrl->io_master_info.master_type = I3C_MASTER;
+	}
+
+	CAM_DBG(CAM_SENSOR, "I3C Target: %s", CAM_BOOL_TO_YESNO(a_ctrl->is_i3c_device));
+
+	if (a_ctrl->io_master_info.master_type == CCI_MASTER) {
+		rc = of_property_read_u32(of_node, "cci-master",
+			&(a_ctrl->cci_i2c_master));
+		CAM_DBG(CAM_ACTUATOR, "cci-master %d, rc %d",
+			a_ctrl->cci_i2c_master, rc);
+		if ((rc < 0) || (a_ctrl->cci_i2c_master >= MASTER_MAX)) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Wrong info: rc: %d, dt CCI master:%d",
+				rc, a_ctrl->cci_i2c_master);
+			rc = -EFAULT;
+			return rc;
+		}
+
+		of_parent = of_get_parent(of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&a_ctrl->cci_num) < 0)
+			/* Set default master 0 */
+			a_ctrl->cci_num = CCI_DEVICE_0;
+		a_ctrl->io_master_info.cci_client->cci_device = a_ctrl->cci_num;
+		CAM_DBG(CAM_ACTUATOR, "cci-device %d", a_ctrl->cci_num);
+	}
+
+	/* Initialize regulators to default parameters */
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		soc_info->rgltr[i] = devm_regulator_get(soc_info->dev,
+					soc_info->rgltr_name[i]);
+		if (IS_ERR_OR_NULL(soc_info->rgltr[i])) {
+			rc = PTR_ERR(soc_info->rgltr[i]);
+			rc = rc ? rc : -EINVAL;
+			CAM_ERR(CAM_ACTUATOR, "get failed for regulator %s %d",
+				 soc_info->rgltr_name[i], rc);
+			return rc;
+		}
+		CAM_DBG(CAM_ACTUATOR, "get for regulator %s",
+			soc_info->rgltr_name[i]);
+	}
+
+	rc = cam_sensor_util_request_power_domain(soc_info);
+	if (rc < 0)
+		return rc;
+
+	if (!soc_info->gpio_data) {
+		CAM_DBG(CAM_ACTUATOR, "No GPIO found");
+		rc = 0;
+		return rc;
+	}
+
+	if (!soc_info->gpio_data->cam_gpio_common_tbl_size) {
+		CAM_DBG(CAM_ACTUATOR, "No GPIO found");
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
+		&power_info->gpio_num_info);
+	if ((rc < 0) || (!power_info->gpio_num_info)) {
+		CAM_ERR(CAM_ACTUATOR, "No/Error Actuator GPIOs");
+		return -EINVAL;
+	}
+	return rc;
+}
+
+void cam_actuator_release_power_domain(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	struct cam_hw_soc_info *soc_info = &a_ctrl->soc_info;
+
+	cam_sensor_util_release_power_domain(soc_info);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ACTUATOR_SOC_H_
+#define _CAM_ACTUATOR_SOC_H_
+
+#include "cam_actuator_dev.h"
+
+/**
+ * @a_ctrl: Actuator ctrl structure
+ *
+ * This API parses actuator device tree
+ */
+int cam_actuator_parse_dt(struct cam_actuator_ctrl_t *a_ctrl,
+	struct device *dev);
+
+/**
+ * @a_ctrl: Actuator ctrl structure
+ *
+ * This API serves for releasing power domain
+ */
+void cam_actuator_release_power_domain(struct cam_actuator_ctrl_t *a_ctrl);
+
+#endif /* _CAM_ACTUATOR_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_core.c
@@ -0,0 +1,3017 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_cci_core.h"
+#include "cam_cci_dev.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+#define CCI_MASTER_LOCK_TIMEOUT msecs_to_jiffies(1000)
+
+
+static int32_t cam_cci_process_master_lock(struct cam_cci_ctrl *cci_ctrl,
+	struct cci_device *cci_dev,
+	bool condition,
+	bool force_unlock)
+{
+	int32_t rc = 0;
+	enum cci_i2c_master_t master = cci_ctrl->cci_info->cci_i2c_master;
+	int32_t loop_check_cnt = 0;
+	int32_t process_cmd = 0;
+
+	CAM_DBG(CAM_CCI,"Entered for cmd=%d with condition=%d", cci_ctrl->cmd, condition);
+	CAM_DBG(CAM_CCI, "E: isMlocked=%d isRAlocked=%d isMowned=%d MusageCnt=%d force_unlock=%d",
+		cci_dev->cci_master_info[master].is_master_locked,
+		cci_dev->cci_master_info[master].is_read_append_locked,
+		cci_ctrl->cci_info->is_master_owned,
+		cci_dev->cci_master_info[master].master_usage_cnt,
+		force_unlock);
+
+	if (cci_dev->cci_state ==  CCI_STATE_ENABLED) {
+
+		if(force_unlock) {
+			process_cmd = MSM_CCI_I2C_SEQUENTIAL_XFER_UNLOCK;
+		} else {
+			process_cmd = cci_ctrl->cmd;
+		}
+loop_check_again:
+	if(loop_check_cnt > 1) {
+		CAM_ERR(CAM_CCI,"loop_check_again is greater than 1 loop_check_cnt=%d",
+                loop_check_cnt);
+	}
+	if(condition) {
+		mutex_lock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+
+		switch (process_cmd) {
+		case MSM_CCI_I2C_READ:
+		case MSM_CCI_I2C_WRITE:
+		case MSM_CCI_I2C_WRITE_SEQ:
+		case MSM_CCI_I2C_WRITE_BURST:
+		case MSM_CCI_I2C_WRITE_SYNC:
+		case MSM_CCI_I2C_WRITE_ASYNC:
+		case MSM_CCI_I2C_WRITE_SYNC_BLOCK: {
+			if (!cci_dev->cci_master_info[master].is_master_locked ||
+				cci_ctrl->cci_info->is_master_owned) {
+				//Not locked or owned by same client
+					cci_dev->cci_master_info[master].master_usage_cnt++;
+					CAM_DBG(CAM_CCI, "master usage count=%d for cmd=%d",
+						cci_dev->cci_master_info[master].master_usage_cnt, cci_ctrl->cmd);
+			}
+			else if (cci_dev->cci_master_info[master].is_master_locked &&
+					!cci_ctrl->cci_info->is_master_owned) {
+				// locked but not owned by same client so add to wait queue
+				CAM_DBG(CAM_CCI, "Going to enter wait for pid=%d threadid=%d",
+					current->pid, current->tgid);
+				mutex_unlock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+				rc = wait_event_interruptible_timeout(
+						cci_dev->cci_master_info[master].lock_wait,
+						!cci_dev->cci_master_info[master].is_master_locked,
+						CCI_MASTER_LOCK_TIMEOUT);
+				if (rc < 0) {
+						CAM_ERR(CAM_CCI,"wait failed");
+						rc = -1;
+					} else if (rc == 0) {
+						CAM_ERR(CAM_CCI," wait timeout happend and condition is still not met");
+						rc = -1;
+					} else {
+						//Now condition success try to check again
+						CAM_DBG(CAM_CCI,"Now condition success try to check again for cmd=%d",
+							cci_ctrl->cmd);
+						rc = 0;
+						loop_check_cnt++;
+						mutex_unlock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+						goto loop_check_again;
+					}
+			}
+			else {
+				CAM_ERR(CAM_CCI, "ERROR cmd=%d isMlocked=%d isRAlocked=%d isMowned=%d MusageCnt=%d",
+					cci_ctrl->cmd,
+					cci_dev->cci_master_info[master].is_master_locked,
+					cci_dev->cci_master_info[master].is_read_append_locked,
+					cci_ctrl->cci_info->is_master_owned,
+					cci_dev->cci_master_info[master].master_usage_cnt);
+				rc = -1;
+			}
+		}
+		break;
+		case MSM_CCI_I2C_READ_APPEND_WRITE:
+			if (cci_dev->cci_master_info[master].is_master_locked &&
+				cci_ctrl->cci_info->is_master_owned &&
+				!cci_dev->cci_master_info[master].is_read_append_locked) {
+				cci_dev->cci_master_info[master].master_usage_cnt++;
+				CAM_DBG(CAM_CCI, "master usage count=%d for read_append_write(already global_locked)",
+					cci_dev->cci_master_info[master].master_usage_cnt);
+			}
+			else if(!cci_dev->cci_master_info[master].is_master_locked &&
+				(cci_dev->cci_master_info[master].master_usage_cnt == 0)) {
+				//Now take lock success
+					cci_dev->cci_master_info[master].is_master_locked = TRUE;
+					cci_dev->cci_master_info[master].is_read_append_locked = TRUE;
+					cci_ctrl->cci_info->is_master_owned = TRUE;
+					cci_dev->cci_master_info[master].master_usage_cnt++;
+					CAM_DBG(CAM_CCI, "master usage count=%d for read_append_write(success)",
+						cci_dev->cci_master_info[master].master_usage_cnt);
+			}
+			else if (!cci_dev->cci_master_info[master].is_master_locked &&
+				(cci_dev->cci_master_info[master].master_usage_cnt > 0)) {
+				// Not locked but usage count is greater than 0 so someone is still accessing the master,
+				// so add to wait queue until the count becomes 0
+				CAM_DBG(CAM_CCI, "Going to enter wait for pid=%d threadid=%d",
+					current->pid, current->tgid);
+
+				mutex_unlock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+				rc = wait_event_interruptible_timeout(
+						cci_dev->cci_master_info[master].lock_wait,
+						(cci_dev->cci_master_info[master].master_usage_cnt == 0),
+						CCI_MASTER_LOCK_TIMEOUT);
+				if (rc < 0) {
+						CAM_ERR(CAM_CCI,"wait failed");
+						rc = -1;
+					} else if (rc == 0) {
+						CAM_ERR(CAM_CCI," wait timeout happend and condition is still not met");
+						rc = -1;
+					} else {
+						//Now condition success try to check again
+						CAM_DBG(CAM_CCI,"Now condition success try to check again for cmd=%d",
+							cci_ctrl->cmd);
+						rc = 0;
+						loop_check_cnt++;
+						mutex_unlock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+						goto loop_check_again;
+					}
+			}
+			else {
+				CAM_ERR(CAM_CCI, "ERROR cmd=%d isMlocked=%d isRAlocked=%d isMowned=%d MusageCnt=%d",
+					cci_ctrl->cmd,
+					cci_dev->cci_master_info[master].is_master_locked,
+					cci_dev->cci_master_info[master].is_read_append_locked,
+					cci_ctrl->cci_info->is_master_owned,
+					cci_dev->cci_master_info[master].master_usage_cnt);
+				rc = -1;
+			}
+			break;
+		case MSM_CCI_I2C_SEQUENTIAL_XFER_LOCK: {
+			if (cci_dev->cci_master_info[master].is_master_locked &&
+				cci_ctrl->cci_info->is_master_owned) {
+				CAM_ERR(CAM_CCI, "master cannot be locked by same thread again for SEQUENTIAL_XFER_LOCK");
+				rc = -1;
+			}
+			else if(!cci_dev->cci_master_info[master].is_master_locked &&
+				(cci_dev->cci_master_info[master].master_usage_cnt == 0)) {
+				//Now take lock success
+					cci_dev->cci_master_info[master].is_master_locked = TRUE;
+					cci_ctrl->cci_info->is_master_owned = TRUE;
+					cci_dev->cci_master_info[master].master_usage_cnt++;
+					CAM_DBG(CAM_CCI, "Master lock acquired by pid=%d threadid=%d",
+						current->pid, current->tgid);
+					CAM_DBG(CAM_CCI, "master usage count=%d for SEQUENTIAL_XFER_LOCK (success)",
+						cci_dev->cci_master_info[master].master_usage_cnt);
+			}
+			else if (!cci_dev->cci_master_info[master].is_master_locked &&
+				(cci_dev->cci_master_info[master].master_usage_cnt > 0)) {
+				// Not locked but usage count is greater than 0 so someone is still accessing the master,
+				// so add to wait queue until the count becomes 0
+				CAM_DBG(CAM_CCI, "Going to enter wait for pid=%d threadid=%d",
+					current->pid, current->tgid);
+				mutex_unlock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+				rc = wait_event_interruptible_timeout(
+						cci_dev->cci_master_info[master].lock_wait,
+						(cci_dev->cci_master_info[master].master_usage_cnt == 0),
+						CCI_MASTER_LOCK_TIMEOUT);
+				if (rc < 0) {
+						CAM_ERR(CAM_CCI,"wait failed");
+						rc = -1;
+					} else if (rc == 0) {
+						CAM_ERR(CAM_CCI," wait timeout happend and condition is still not met");
+						rc = -1;
+					} else {
+						//Now condition success try to check again
+						CAM_DBG(CAM_CCI,"Now condition success try to check again for cmd=%d",
+							cci_ctrl->cmd);
+						rc = 0;
+						loop_check_cnt++;
+						mutex_unlock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+						goto loop_check_again;
+					}
+			}
+			else {
+				CAM_ERR(CAM_CCI, "ERROR cmd=%d isMlocked=%d isRAlocked=%d isMowned=%d MusageCnt=%d",
+					cci_ctrl->cmd,
+					cci_dev->cci_master_info[master].is_master_locked,
+					cci_dev->cci_master_info[master].is_read_append_locked,
+					cci_ctrl->cci_info->is_master_owned,
+					cci_dev->cci_master_info[master].master_usage_cnt);
+					rc = -1;
+			}
+		}
+		break;
+		case MSM_CCI_I2C_SEQUENTIAL_XFER_UNLOCK: {
+			if (cci_dev->cci_master_info[master].is_master_locked &&
+				cci_ctrl->cci_info->is_master_owned &&
+				(cci_dev->cci_master_info[master].master_usage_cnt == 1)) {
+				CAM_DBG(CAM_CCI, "master is locked by correct thread so lets SEQUENTIAL_XFER_UNLOCK now");
+				cci_dev->cci_master_info[master].is_master_locked = FALSE;
+				cci_ctrl->cci_info->is_master_owned = FALSE;
+				cci_dev->cci_master_info[master].master_usage_cnt--;
+				CAM_DBG(CAM_CCI, "Master lock released by pid=%d threadid=%d",
+					current->pid, current->tgid);
+				wake_up(&cci_dev->cci_master_info[master].lock_wait);
+				CAM_DBG(CAM_CCI, "master SEQUENTIAL_XFER_UNLOCK success");
+			}
+			else if (cci_dev->cci_master_info[master].is_master_locked &&
+					(!cci_ctrl->cci_info->is_master_owned) &&
+					(!force_unlock)){
+				//Master is locked but not owned by the caller but still asking for unlock
+				CAM_ERR(CAM_CCI, "UNLOCK ERROR cmd=%d isMlocked=%d isRAlocked=%d isMowned=%d MusageCnt=%d",
+					cci_ctrl->cmd,
+					cci_dev->cci_master_info[master].is_master_locked,
+					cci_dev->cci_master_info[master].is_read_append_locked,
+					cci_ctrl->cci_info->is_master_owned,
+					cci_dev->cci_master_info[master].master_usage_cnt);
+				rc = -1;
+			}
+			else if (!force_unlock) {
+				CAM_ERR(CAM_CCI, "UNLOCK ERROR cmd=%d isMlocked=%d isRAlocked=%d isMowned=%d MusageCnt=%d force=%d",
+					cci_ctrl->cmd,
+					cci_dev->cci_master_info[master].is_master_locked,
+					cci_dev->cci_master_info[master].is_read_append_locked,
+					cci_ctrl->cci_info->is_master_owned,
+					cci_dev->cci_master_info[master].master_usage_cnt,
+					force_unlock);
+					rc = -1;
+			}
+		}
+		break;
+		default:
+			CAM_DBG(CAM_CCI, "some cmd=%d need not to process anything here just ignore",
+				cci_ctrl->cmd);
+			break;
+
+		}
+		mutex_unlock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+	}
+	else {
+		mutex_lock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+
+		switch (process_cmd) {
+		case MSM_CCI_I2C_READ:
+		case MSM_CCI_I2C_WRITE:
+		case MSM_CCI_I2C_WRITE_SEQ:
+		case MSM_CCI_I2C_WRITE_BURST:
+		case MSM_CCI_I2C_WRITE_SYNC:
+		case MSM_CCI_I2C_WRITE_ASYNC:
+		case MSM_CCI_I2C_WRITE_SYNC_BLOCK: {
+			if (!cci_dev->cci_master_info[master].is_master_locked ||
+				cci_ctrl->cci_info->is_master_owned ||
+				cci_dev->cci_master_info[master].master_usage_cnt) {
+				//Not locked or owned by same client or valid usage count
+					cci_dev->cci_master_info[master].master_usage_cnt--;
+					wake_up(&cci_dev->cci_master_info[master].lock_wait);
+					CAM_DBG(CAM_CCI, "master usage count=%d for cmd=%d",
+						cci_dev->cci_master_info[master].master_usage_cnt, cci_ctrl->cmd);
+			}
+			else {
+				CAM_ERR(CAM_CCI, "ERROR cmd=%d isMlocked=%d isRAlocked=%d isMowned=%d MusageCnt=%d",
+					cci_ctrl->cmd,
+					cci_dev->cci_master_info[master].is_master_locked,
+					cci_dev->cci_master_info[master].is_read_append_locked,
+					cci_ctrl->cci_info->is_master_owned,
+					cci_dev->cci_master_info[master].master_usage_cnt);
+				rc = -1;
+			}
+		}
+		break;
+		case MSM_CCI_I2C_READ_APPEND_WRITE:
+			if (cci_dev->cci_master_info[master].is_master_locked &&
+				cci_ctrl->cci_info->is_master_owned &&
+				!cci_dev->cci_master_info[master].is_read_append_locked) {
+				cci_dev->cci_master_info[master].master_usage_cnt--;
+				wake_up(&cci_dev->cci_master_info[master].lock_wait);
+				CAM_DBG(CAM_CCI, "master usage count=%d for read_append_write complete (already global_locked)",
+					cci_dev->cci_master_info[master].master_usage_cnt);
+			}
+			else if (cci_dev->cci_master_info[master].is_master_locked &&
+				cci_ctrl->cci_info->is_master_owned &&
+				cci_dev->cci_master_info[master].is_read_append_locked &&
+				(cci_dev->cci_master_info[master].master_usage_cnt == 1)) {
+				//Now take lock success
+					cci_dev->cci_master_info[master].is_master_locked = FALSE;
+					cci_dev->cci_master_info[master].is_read_append_locked = FALSE;
+					cci_ctrl->cci_info->is_master_owned = FALSE;
+					cci_dev->cci_master_info[master].master_usage_cnt--;
+					wake_up(&cci_dev->cci_master_info[master].lock_wait);
+					CAM_DBG(CAM_CCI, "master usage count=%d for read_append_write complete(success)",
+						cci_dev->cci_master_info[master].master_usage_cnt);
+			}
+			else {
+				CAM_ERR(CAM_CCI, "ERROR cmd=%d isMlocked=%d isRAlocked=%d isMowned=%d MusageCnt=%d",
+					cci_ctrl->cmd,
+					cci_dev->cci_master_info[master].is_master_locked,
+					cci_dev->cci_master_info[master].is_read_append_locked,
+					cci_ctrl->cci_info->is_master_owned,
+					cci_dev->cci_master_info[master].master_usage_cnt);
+				rc = -1;
+			}
+			break;
+		case MSM_CCI_I2C_SEQUENTIAL_XFER_LOCK:
+		case MSM_CCI_I2C_SEQUENTIAL_XFER_UNLOCK:
+			break;
+		default:
+			CAM_DBG(CAM_CCI, "some cmd=%d need not to process anything here just ignore",
+				cci_ctrl->cmd);
+			break;
+		}
+		mutex_unlock(&(cci_dev->cci_master_info[master].master_lock_mutex));
+	}
+	}
+	else {
+		CAM_DBG(CAM_CCI, "master lock state processing cannot be done until cci is enabled so just bypass");
+	}
+	CAM_DBG(CAM_CCI,"Exit for cmd=%d with condition=%d rc=%d", cci_ctrl->cmd, condition, rc);
+	CAM_DBG(CAM_CCI, "X: isMlocked=%d isRAlocked=%d isMowned=%d MusageCnt=%d",
+		cci_dev->cci_master_info[master].is_master_locked,
+		cci_dev->cci_master_info[master].is_read_append_locked,
+		cci_ctrl->cci_info->is_master_owned,
+		cci_dev->cci_master_info[master].master_usage_cnt);
+
+	return rc;
+}
+
+static int32_t cam_cci_convert_type_to_num_bytes(
+	enum camera_sensor_i2c_type type)
+{
+	int32_t num_bytes;
+
+	switch (type) {
+	case CAMERA_SENSOR_I2C_TYPE_BYTE:
+		num_bytes = 1;
+		break;
+	case CAMERA_SENSOR_I2C_TYPE_WORD:
+		num_bytes = 2;
+		break;
+	case CAMERA_SENSOR_I2C_TYPE_3B:
+		num_bytes = 3;
+		break;
+	case CAMERA_SENSOR_I2C_TYPE_DWORD:
+		num_bytes = 4;
+		break;
+	default:
+		CAM_ERR(CAM_CCI, "Wrong Sensor I2c Type: %d", type);
+		num_bytes = 0;
+		break;
+	}
+	return num_bytes;
+}
+
+static void cam_cci_flush_queue(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master)
+{
+	int32_t rc = 0;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+
+	cam_io_w_mb(1 << master, base + CCI_HALT_REQ_ADDR);
+	if (!cci_dev->cci_master_info[master].status)
+		reinit_completion(&cci_dev->cci_master_info[master]
+			.reset_complete);
+	if (!cam_common_wait_for_completion_timeout(
+		&cci_dev->cci_master_info[master].reset_complete,
+		CCI_TIMEOUT)) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d wait timeout for reset complete",
+			cci_dev->soc_info.index, master);
+
+		/* Set reset pending flag to true */
+		cci_dev->cci_master_info[master].reset_pending = true;
+		cci_dev->cci_master_info[master].status = 0;
+
+		/* Set proper mask to RESET CMD address based on MASTER */
+		if (master == MASTER_0)
+			cam_io_w_mb(CCI_M0_RESET_RMSK,
+				base + CCI_RESET_CMD_ADDR);
+		else
+			cam_io_w_mb(CCI_M1_RESET_RMSK,
+				base + CCI_RESET_CMD_ADDR);
+
+		/* wait for reset done irq */
+		if (!cam_common_wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].reset_complete,
+			CCI_TIMEOUT)) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d Retry:: wait timeout for reset complete",
+				cci_dev->soc_info.index, master);
+		}
+		cci_dev->cci_master_info[master].status = 0;
+	}
+
+	if (!rc)
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d Success: Reset complete",
+			cci_dev->soc_info.index, master);
+}
+
+static int32_t cam_cci_validate_queue(struct cci_device *cci_dev,
+	uint32_t len,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+	uint32_t read_val = 0;
+	uint32_t reg_offset = master * 0x200 + queue * 0x100;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	unsigned long flags;
+
+	read_val = cam_io_r_mb(base +
+		CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+	CAM_DBG(CAM_CCI,
+		"CCI%d_I2C_M%d_Q%d_CUR_WORD_CNT_ADDR %d len %d max %d",
+		cci_dev->soc_info.index, master, queue, read_val, len,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size);
+	if ((read_val + len + 1) >
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size) {
+		uint32_t reg_val = 0;
+		uint32_t report_id =
+			cci_dev->cci_i2c_queue_info[master][queue].report_id;
+		uint32_t report_val = CCI_I2C_REPORT_CMD | (1 << 8) |
+			(1 << 9) | (report_id << 4);
+
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_REPORT_CMD",
+			cci_dev->soc_info.index, master, queue);
+		cam_io_w_mb(report_val,
+			base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+			reg_offset);
+		read_val++;
+		cci_dev->cci_i2c_queue_info[master][queue].report_id++;
+		if (cci_dev->cci_i2c_queue_info[master][queue].report_id == REPORT_IDSIZE)
+			cci_dev->cci_i2c_queue_info[master][queue].report_id = 0;
+
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d_EXEC_WORD_CNT_ADDR %d",
+			cci_dev->soc_info.index, master, queue, read_val);
+		cam_io_w_mb(read_val, base +
+			CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+		reg_val = 1 << ((master * 2) + queue);
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_START_ADDR", cci_dev->soc_info.index, master, queue);
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		atomic_set(
+			&cci_dev->cci_master_info[master].done_pending[queue],
+			1);
+		cam_io_w_mb(reg_val, base + CCI_QUEUE_START_ADDR);
+		atomic_set(&cci_dev->cci_master_info[master].q_free[queue], 1);
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		if (!cam_common_wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].report_q[queue],
+			CCI_TIMEOUT)) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d wait timeout, rc:%d",
+				cci_dev->soc_info.index, master, queue, rc);
+			cam_cci_flush_queue(cci_dev, master);
+			return -EINVAL;
+		}
+		rc = cci_dev->cci_master_info[master].status;
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d is in error state",
+				cci_dev->soc_info.index, master, queue);
+			cci_dev->cci_master_info[master].status = 0;
+		}
+	}
+
+	return rc;
+}
+
+static int32_t cam_cci_write_i2c_queue(struct cci_device *cci_dev,
+	uint32_t val,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+	uint32_t reg_offset = master * 0x200 + queue * 0x100;
+	struct cam_hw_soc_info *soc_info = NULL;
+	void __iomem *base = NULL;
+
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+
+	soc_info = &cci_dev->soc_info;
+	base = soc_info->reg_map[0].mem_base;
+
+	rc = cam_cci_validate_queue(cci_dev, 1, master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Failed to validate:: rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		return rc;
+	}
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_LOAD_DATA_ADDR:val 0x%x:0x%x ",
+		cci_dev->soc_info.index, master, queue,
+		CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset, val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset);
+
+	return rc;
+}
+
+static void cam_cci_lock_queue(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue, uint32_t en)
+{
+	uint32_t                val = 0;
+	uint32_t                read_val = 0;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem           *base =
+		soc_info->reg_map[0].mem_base;
+	uint32_t                reg_offset =
+		master * 0x200 + queue * 0x100;
+
+	if (queue != PRIORITY_QUEUE)
+		return;
+
+	val = en ? CCI_I2C_LOCK_CMD : CCI_I2C_UNLOCK_CMD;
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_LOAD_DATA_ADDR:val 0x%x:0x%x ",
+		cci_dev->soc_info.index, master, queue,
+		CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset, val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset);
+
+	if (cci_dev->cci_master_info[master].is_burst_enable[queue] == true) {
+		cci_dev->cci_master_info[master].num_words_exec[queue]++;
+		read_val = cci_dev->cci_master_info[master].num_words_exec[queue];
+	} else {
+		read_val = cam_io_r_mb(base +
+			CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+	}
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_EXEC_WORD_CNT_ADDR %d",
+		cci_dev->soc_info.index, master, queue, read_val);
+	cam_io_w_mb(read_val, base +
+		CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+}
+
+void cam_cci_dump_registers(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master, enum cci_i2c_queue_t queue)
+{
+	uint32_t dump_en = 0;
+	uint32_t read_val = 0;
+	uint32_t i = 0;
+	uint32_t reg_offset = 0;
+	void __iomem *base = cci_dev->soc_info.reg_map[0].mem_base;
+
+	dump_en = cci_dev->dump_en;
+	if (!(dump_en & CAM_CCI_NACK_DUMP_EN) &&
+		!(dump_en & CAM_CCI_TIMEOUT_DUMP_EN)) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Nack and Timeout dump is not enabled",
+			cci_dev->soc_info.index, master, queue);
+		return;
+	}
+
+	CAM_INFO(CAM_CCI, "**** CCI%d_I2C_M%d_Q%d register dump ****",
+		cci_dev->soc_info.index, master, queue);
+
+	/* CCI Top Registers */
+	CAM_INFO(CAM_CCI, "**** CCI TOP Registers ****");
+	for (i = 0; i < DEBUG_TOP_REG_COUNT; i++) {
+		reg_offset = DEBUG_TOP_REG_START + i * 4;
+		read_val = cam_io_r_mb(base + reg_offset);
+		CAM_INFO(CAM_CCI, "offset = 0x%X value = 0x%X",
+			reg_offset, read_val);
+	}
+
+	/* CCI Master registers */
+	CAM_INFO(CAM_CCI, "**** CCI%d_I2C_M%d Registers ****",
+		cci_dev->soc_info.index, master);
+	for (i = 0; i < DEBUG_MASTER_REG_COUNT; i++) {
+		if ((i * 4) == 0x18)
+			continue;
+
+		reg_offset = DEBUG_MASTER_REG_START + master*0x100 + i * 4;
+		read_val = cam_io_r_mb(base + reg_offset);
+		CAM_INFO(CAM_CCI, "offset = 0x%X value = 0x%X",
+			reg_offset, read_val);
+	}
+
+	/* CCI Master Queue registers */
+	CAM_INFO(CAM_CCI, " **** CCI%d_I2C_M%d_Q%d Registers ****",
+		cci_dev->soc_info.index, master, queue);
+	for (i = 0; i < DEBUG_MASTER_QUEUE_REG_COUNT; i++) {
+		reg_offset = DEBUG_MASTER_QUEUE_REG_START +  master*0x200 +
+			queue*0x100 + i * 4;
+		read_val = cam_io_r_mb(base + reg_offset);
+		CAM_INFO(CAM_CCI, "offset = 0x%X value = 0x%X",
+			reg_offset, read_val);
+	}
+
+	/* CCI Interrupt registers */
+	CAM_INFO(CAM_CCI, " ****CCI Interrupt Registers****");
+	for (i = 0; i < DEBUG_INTR_REG_COUNT; i++) {
+		reg_offset = DEBUG_INTR_REG_START + i * 4;
+		read_val = cam_io_r_mb(base + reg_offset);
+		CAM_INFO(CAM_CCI, "offset = 0x%X value = 0x%X",
+			reg_offset, read_val);
+	}
+}
+EXPORT_SYMBOL(cam_cci_dump_registers);
+
+static uint32_t cam_cci_wait(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev pointer is NULL");
+		return -EINVAL;
+	}
+
+	if (!cam_common_wait_for_completion_timeout(
+		&cci_dev->cci_master_info[master].report_q[queue],
+		CCI_TIMEOUT)) {
+		cam_cci_dump_registers(cci_dev, master, queue);
+
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d wait timeout, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		rc = -ETIMEDOUT;
+		cam_cci_flush_queue(cci_dev, master);
+		CAM_INFO(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d dump register after reset",
+			cci_dev->soc_info.index, master, queue);
+		cam_cci_dump_registers(cci_dev, master, queue);
+		return rc;
+	}
+
+	rc = cci_dev->cci_master_info[master].status;
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q% is in error state",
+			cci_dev->soc_info.index, master, queue);
+		cci_dev->cci_master_info[master].status = 0;
+		return rc;
+	}
+
+	return 0;
+}
+
+static void cam_cci_load_report_cmd(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+
+	uint32_t reg_offset = master * 0x200 + queue * 0x100;
+	uint32_t read_val = cam_io_r_mb(base +
+		CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+	uint32_t report_id =
+		cci_dev->cci_i2c_queue_info[master][queue].report_id;
+	uint32_t report_val = CCI_I2C_REPORT_CMD | (1 << 8) |
+		(1 << 9) | (report_id << 4);
+
+	CAM_DBG(CAM_CCI,
+		"CCI%d_I2C_M%d_Q%d_REPORT_CMD curr_w_cnt: %d report_id %d",
+		cci_dev->soc_info.index, master, queue, read_val, report_id);
+	cam_io_w_mb(report_val,
+		base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset);
+	if (cci_dev->cci_master_info[master].is_burst_enable[queue] == true) {
+		cci_dev->cci_master_info[master].num_words_exec[queue]++;
+		read_val = cci_dev->cci_master_info[master].num_words_exec[queue];
+	} else {
+		read_val++;
+	}
+	cci_dev->cci_i2c_queue_info[master][queue].report_id++;
+	if (cci_dev->cci_i2c_queue_info[master][queue].report_id == REPORT_IDSIZE)
+		cci_dev->cci_i2c_queue_info[master][queue].report_id = 0;
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_EXEC_WORD_CNT_ADDR %d (ReadValue: %u)",
+		cci_dev->soc_info.index, master, queue, read_val,
+		cam_io_r_mb(base + CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset));
+	cam_io_w_mb(read_val, base +
+		CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+}
+
+static int32_t cam_cci_wait_report_cmd(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	unsigned long flags;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+
+	uint32_t reg_val = 1 << ((master * 2) + queue);
+
+	spin_lock_irqsave(
+		&cci_dev->cci_master_info[master].lock_q[queue], flags);
+	atomic_set(&cci_dev->cci_master_info[master].q_free[queue], 1);
+	atomic_set(&cci_dev->cci_master_info[master].done_pending[queue], 1);
+	spin_unlock_irqrestore(
+		&cci_dev->cci_master_info[master].lock_q[queue], flags);
+	cam_io_w_mb(reg_val, base + CCI_QUEUE_START_ADDR);
+
+	return cam_cci_wait(cci_dev, master, queue);
+}
+
+static int32_t cam_cci_transfer_end(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+	unsigned long flags;
+
+	spin_lock_irqsave(
+		&cci_dev->cci_master_info[master].lock_q[queue], flags);
+	if (atomic_read(&cci_dev->cci_master_info[master].q_free[queue]) == 0) {
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		cam_cci_load_report_cmd(cci_dev, master, queue);
+		cam_cci_lock_queue(cci_dev, master, queue, 0);
+
+		rc = cam_cci_wait_report_cmd(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d Failed for wait_report_cmd for rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+	} else {
+		atomic_set(
+			&cci_dev->cci_master_info[master].done_pending[queue],
+			1);
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		rc = cam_cci_wait(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d Failed with cci_wait for rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+		cam_cci_load_report_cmd(cci_dev, master, queue);
+		cam_cci_lock_queue(cci_dev, master, queue, 0);
+
+		rc = cam_cci_wait_report_cmd(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d Failed in wait_report_cmd for rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int32_t cam_cci_get_queue_free_size(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	uint32_t read_val = 0;
+	uint32_t reg_offset = master * 0x200 + queue * 0x100;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+
+	read_val = cam_io_r_mb(base +
+		CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_CUR_WORD_CNT_ADDR %d max %d",
+		cci_dev->soc_info.index, master, queue, read_val,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size);
+	return ((cci_dev->cci_i2c_queue_info[master][queue].max_queue_size) -
+			read_val);
+}
+
+static void cam_cci_process_half_q(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	unsigned long flags;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	uint32_t reg_val = 1 << ((master * 2) + queue);
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d ENTER", cci_dev->soc_info.index, master, queue);
+
+	spin_lock_irqsave(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+	if (atomic_read(&cci_dev->cci_master_info[master].q_free[queue]) == 0) {
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d is free", cci_dev->soc_info.index, master, queue);
+		cam_cci_load_report_cmd(cci_dev, master, queue);
+		atomic_set(&cci_dev->cci_master_info[master].q_free[queue], 1);
+		cam_io_w_mb(reg_val, base +
+			CCI_QUEUE_START_ADDR);
+	}
+	spin_unlock_irqrestore(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+}
+
+static int32_t cam_cci_process_full_q(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+	unsigned long flags;
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d ENTER", cci_dev->soc_info.index, master, queue);
+	spin_lock_irqsave(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+	if (atomic_read(&cci_dev->cci_master_info[master].q_free[queue]) == 1) {
+		atomic_set(
+			&cci_dev->cci_master_info[master].done_pending[queue],
+			1);
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d is set to 1", cci_dev->soc_info.index, master, queue);
+		rc = cam_cci_wait(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d cci_wait failed for rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+	} else {
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d is set to 0", cci_dev->soc_info.index, master, queue);
+		cam_cci_load_report_cmd(cci_dev, master, queue);
+		rc = cam_cci_wait_report_cmd(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d Failed in wait_report for rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+	}
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d EXIT", cci_dev->soc_info.index, master, queue);
+
+	return rc;
+}
+
+static int32_t cam_cci_calc_cmd_len(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl, uint32_t cmd_size,
+	 struct cam_sensor_i2c_reg_array *i2c_cmd, uint32_t *pack)
+{
+	uint8_t i;
+	uint32_t len = 0;
+	uint8_t data_len = 0, addr_len = 0;
+	uint8_t pack_max_len;
+	struct cam_sensor_i2c_reg_setting *msg;
+	struct cam_sensor_i2c_reg_array *cmd = i2c_cmd;
+	uint32_t size = cmd_size;
+
+	if (!cci_dev || !c_ctrl) {
+		CAM_ERR(CAM_CCI, "Invalid arguments cci_dev:%p, c_ctrl:%p",
+			cci_dev, c_ctrl);
+		return -EINVAL;
+	}
+
+	msg = &c_ctrl->cfg.cci_i2c_write_cfg;
+	*pack = 0;
+
+	if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ ||
+		c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST) {
+		addr_len = cam_cci_convert_type_to_num_bytes(msg->addr_type);
+		len = (size + addr_len) <= (cci_dev->payload_size) ?
+			(size + addr_len):cci_dev->payload_size;
+	} else {
+		addr_len = cam_cci_convert_type_to_num_bytes(msg->addr_type);
+		data_len = cam_cci_convert_type_to_num_bytes(msg->data_type);
+		len = data_len + addr_len;
+		pack_max_len = size < (cci_dev->payload_size-len) ?
+			size : (cci_dev->payload_size-len);
+		for (i = 0; i < pack_max_len;) {
+			if (cmd->delay || ((cmd - i2c_cmd) >= (cmd_size - 1)))
+				break;
+			if (cmd->reg_addr + 1 ==
+				(cmd+1)->reg_addr) {
+				len += data_len;
+				if (len > cci_dev->payload_size) {
+					len = len - data_len;
+					break;
+				}
+				(*pack)++;
+			} else {
+				break;
+			}
+			i += data_len;
+			cmd++;
+		}
+	}
+
+	if (len > cci_dev->payload_size) {
+		CAM_ERR(CAM_CCI, "Len error: len: %u expected_len: %u",
+			len, cci_dev->payload_size);
+		return -EINVAL;
+	}
+
+	len += 1; /*add i2c WR command*/
+	len = len/4 + 1;
+
+	return len;
+}
+
+static uint32_t cam_cci_cycles_per_ms(unsigned long clk)
+{
+	uint32_t cycles_per_us;
+
+	if (clk) {
+		cycles_per_us = ((clk/1000)*256)/1000;
+	} else {
+		CAM_ERR(CAM_CCI, "Failed: Can use default: %d",
+			CYCLES_PER_MICRO_SEC_DEFAULT);
+		cycles_per_us = CYCLES_PER_MICRO_SEC_DEFAULT;
+	}
+
+	return cycles_per_us;
+}
+
+void cam_cci_get_clk_rates(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl)
+
+{
+	int32_t src_clk_idx, j;
+	uint32_t cci_clk_src;
+	unsigned long clk;
+	struct cam_cci_clk_params_t *clk_params = NULL;
+
+	enum i2c_freq_mode i2c_freq_mode = c_ctrl->cci_info->i2c_freq_mode;
+	struct cam_hw_soc_info *soc_info = &cci_dev->soc_info;
+
+	if (i2c_freq_mode >= I2C_MAX_MODES ||
+		i2c_freq_mode < I2C_STANDARD_MODE) {
+		CAM_ERR(CAM_CCI, "Invalid frequency mode: %d",
+			(int32_t)i2c_freq_mode);
+		cci_dev->clk_level_index = -1;
+		return;
+	}
+
+	clk_params = &cci_dev->cci_clk_params[i2c_freq_mode];
+	cci_clk_src = clk_params->cci_clk_src;
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	if (src_clk_idx < 0) {
+		cci_dev->cycles_per_us = CYCLES_PER_MICRO_SEC_DEFAULT;
+		cci_dev->clk_level_index = 0;
+		return;
+	}
+
+	if (cci_clk_src == 0) {
+		clk = soc_info->clk_rate[0][src_clk_idx];
+		cci_dev->cycles_per_us = cam_cci_cycles_per_ms(clk);
+		cci_dev->clk_level_index = 0;
+		return;
+	}
+
+	for (j = 0; j < CAM_MAX_VOTE; j++) {
+		clk = soc_info->clk_rate[j][src_clk_idx];
+		if (clk == cci_clk_src) {
+			cci_dev->cycles_per_us = cam_cci_cycles_per_ms(clk);
+			cci_dev->clk_level_index = j;
+			return;
+		}
+	}
+}
+
+static int32_t cam_cci_set_clk_param(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	struct cam_cci_clk_params_t *clk_params = NULL;
+	enum cci_i2c_master_t master = c_ctrl->cci_info->cci_i2c_master;
+	enum i2c_freq_mode i2c_freq_mode = c_ctrl->cci_info->i2c_freq_mode;
+	void __iomem *base = cci_dev->soc_info.reg_map[0].mem_base;
+	struct cam_cci_master_info *cci_master =
+		&cci_dev->cci_master_info[master];
+
+	if ((i2c_freq_mode >= I2C_MAX_MODES) || (i2c_freq_mode < 0)) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d invalid i2c_freq_mode = %d",
+			cci_dev->soc_info.index, master, i2c_freq_mode);
+		return -EINVAL;
+	}
+	/*
+	 * If no change in i2c freq, then acquire semaphore only for the first
+	 * i2c transaction to indicate I2C transaction is in progress, else
+	 * always try to acquire semaphore, to make sure that no other I2C
+	 * transaction is in progress.
+	 */
+	mutex_lock(&cci_master->mutex);
+
+	if (i2c_freq_mode == cci_dev->i2c_freq_mode[master]) {
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d, curr_freq: %d", cci_dev->soc_info.index, master,
+			i2c_freq_mode);
+		mutex_lock(&cci_master->freq_cnt_lock);
+		if (cci_master->freq_ref_cnt == 0)
+			down(&cci_master->master_sem);
+		cci_master->freq_ref_cnt++;
+		mutex_unlock(&cci_master->freq_cnt_lock);
+		mutex_unlock(&cci_master->mutex);
+		return 0;
+	}
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d, curr_freq: %d, req_freq: %d",
+		cci_dev->soc_info.index, master, cci_dev->i2c_freq_mode[master], i2c_freq_mode);
+	down(&cci_master->master_sem);
+
+	mutex_lock(&cci_master->freq_cnt_lock);
+	cci_master->freq_ref_cnt++;
+	mutex_unlock(&cci_master->freq_cnt_lock);
+
+	clk_params = &cci_dev->cci_clk_params[i2c_freq_mode];
+
+	if (master == MASTER_0) {
+		cam_io_w_mb(clk_params->hw_thigh << 16 |
+			clk_params->hw_tlow,
+			base + CCI_I2C_M0_SCL_CTL_ADDR);
+		cam_io_w_mb(clk_params->hw_tsu_sto << 16 |
+			clk_params->hw_tsu_sta,
+			base + CCI_I2C_M0_SDA_CTL_0_ADDR);
+		cam_io_w_mb(clk_params->hw_thd_dat << 16 |
+			clk_params->hw_thd_sta,
+			base + CCI_I2C_M0_SDA_CTL_1_ADDR);
+		cam_io_w_mb(clk_params->hw_tbuf,
+			base + CCI_I2C_M0_SDA_CTL_2_ADDR);
+		cam_io_w_mb(clk_params->hw_scl_stretch_en << 8 |
+			clk_params->hw_trdhld << 4 | clk_params->hw_tsp,
+			base + CCI_I2C_M0_MISC_CTL_ADDR);
+	} else if (master == MASTER_1) {
+		cam_io_w_mb(clk_params->hw_thigh << 16 |
+			clk_params->hw_tlow,
+			base + CCI_I2C_M1_SCL_CTL_ADDR);
+		cam_io_w_mb(clk_params->hw_tsu_sto << 16 |
+			clk_params->hw_tsu_sta,
+			base + CCI_I2C_M1_SDA_CTL_0_ADDR);
+		cam_io_w_mb(clk_params->hw_thd_dat << 16 |
+			clk_params->hw_thd_sta,
+			base + CCI_I2C_M1_SDA_CTL_1_ADDR);
+		cam_io_w_mb(clk_params->hw_tbuf,
+			base + CCI_I2C_M1_SDA_CTL_2_ADDR);
+		cam_io_w_mb(clk_params->hw_scl_stretch_en << 8 |
+			clk_params->hw_trdhld << 4 | clk_params->hw_tsp,
+			base + CCI_I2C_M1_MISC_CTL_ADDR);
+	}
+	cci_dev->i2c_freq_mode[master] = i2c_freq_mode;
+
+	mutex_unlock(&cci_master->mutex);
+
+	return 0;
+}
+
+int32_t cam_cci_data_queue_burst_apply(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master, enum cci_i2c_queue_t queue,
+	uint32_t triggerHalfQueue)
+{
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	uint32_t reg_val = 1 << ((master * 2) + queue);
+	uint32_t iterate = 0;
+	uint32_t numBytes = 0;
+	bool condition = false;
+	uint32_t num_word_written_to_queue = 0;
+	uint32_t *data_queue = NULL;
+	uint32_t index = 0;
+	uint32_t reg_offset;
+	uint32_t queue_size = cci_dev->cci_i2c_queue_info[master][queue].max_queue_size;
+	uint32_t numWordsInQueue = 0, queueStartThreshold = 0;
+
+	reg_offset = master * 0x200 + queue * 0x100;
+	data_queue = cci_dev->cci_master_info[master].data_queue[queue];
+	num_word_written_to_queue = cci_dev->cci_master_info[master].num_words_in_data_queue[queue];
+	index = cci_dev->cci_master_info[master].data_queue_start_index[queue];
+	queueStartThreshold = cci_dev->cci_master_info[master].half_queue_mark[queue];
+
+	if (data_queue == NULL)	{
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d data_queue is NULL",
+			cci_dev->soc_info.index, master, queue);
+		return -EINVAL;
+	}
+
+	/* At First this routine is called from process context with FULL QUEUE
+	 * Execution. and next iteration will be called from IRQ Context to process
+	 * only HALF QUEUE size decided by precomputed value "queueStartThreshold"
+	 * */
+	if (triggerHalfQueue == 1) {
+		// Apply HALF QUEUE
+		trace_cam_cci_burst(cci_dev->soc_info.index, master, queue,
+			"thirq raised Buflvl",
+			cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]);
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Threshold IRQ Raised, BufferLevel: %d",
+			cci_dev->soc_info.index, master, queue,
+			cam_io_r_mb(base + CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset));
+	} else {
+		// Apply FULL QUEUE
+		numWordsInQueue = cam_io_r_mb(base +
+			CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+	}
+
+	while (index < num_word_written_to_queue) {
+		numBytes = (data_queue[index] & 0xF0) >> 4;
+		if ((numBytes == 0xF) || (numBytes == 0xE)) {
+		       iterate = 3;
+		} else {
+			numBytes = (numBytes + 4) & ~0x03;
+			iterate = numBytes / 4;
+		}
+		if (numBytes == 0xE) {
+			CAM_DBG(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d THRESHOLD IRQ Enabled; data_queue[%d]: 0x%x refcnt: %d",
+				cci_dev->soc_info.index, master, queue, index, data_queue[index],
+				cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]);
+		}
+		if (triggerHalfQueue == 0) {
+			condition = ((numWordsInQueue + iterate + 1) > queue_size);
+		} else {
+			condition = (cci_dev->cci_master_info[master].th_irq_ref_cnt[queue] > 0) ?
+				(numWordsInQueue >= queueStartThreshold) : 0;
+		}
+
+		if (condition == true) {
+			CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d CUR_WORD_CNT_ADDR %d len %d max %d",
+				cci_dev->soc_info.index, master, queue, numWordsInQueue, iterate, queue_size);
+			if ((cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]) > 0) {
+				cam_io_w_mb(numWordsInQueue, base +
+					CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+				cam_io_w_mb(reg_val, base + CCI_QUEUE_START_ADDR);
+				triggerHalfQueue = 1;
+				numWordsInQueue = 0;
+				CAM_INFO(CAM_CCI,
+					"CCI%d_I2C_M%d_Q%d Issued QUEUE_START, "
+					"wait for Threshold_IRQ, th_irq_ref_cnt[%d]:%d",
+					cci_dev->soc_info.index, master, queue, queue,
+					cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]);
+				trace_cam_cci_burst(cci_dev->soc_info.index, master, queue,
+					"Q_START thirq_cnt",
+					cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]);
+
+				return 0;
+			}
+		} else {
+			while (iterate > 0) {
+				cam_io_w_mb(data_queue[index], base +
+					CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+					master * 0x200 + queue * 0x100);
+				CAM_DBG(CAM_CCI,
+					"CCI%d_I2C_M%d_Q%d LOAD_DATA_ADDR 0x%x, "
+					"index: %d trig: %d numWordsInQueue: %d",
+					cci_dev->soc_info.index, master, queue,
+					data_queue[index], (index + 1),
+					triggerHalfQueue, (numWordsInQueue + 1));
+				numWordsInQueue++;
+				index++;
+				cci_dev->cci_master_info[master].data_queue_start_index[queue] = index;
+				iterate--;
+			}
+		}
+	}
+
+	if ((numWordsInQueue > 0) && (cci_dev->cci_master_info[master].th_irq_ref_cnt[queue] > 0)) {
+		cam_io_w_mb(numWordsInQueue, base +
+			CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+		cam_io_w_mb(reg_val, base + CCI_QUEUE_START_ADDR);
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Issued ****** FINAL QUEUE_START********, "
+			"numWordsInQueue: %d, th_irq_ref_cnt[%d]:%d",
+			cci_dev->soc_info.index, master, queue, queue, numWordsInQueue,
+			cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]);
+		numWordsInQueue = 0;
+	}
+
+	return 0;
+}
+
+static int32_t cam_cci_data_queue_burst(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl, enum cci_i2c_queue_t queue,
+	enum cci_i2c_sync sync_en)
+{
+	uint16_t i = 0, j = 0, len = 0;
+	int32_t rc = 0, en_seq_write = 0;
+	struct cam_sensor_i2c_reg_setting *i2c_msg =
+		&c_ctrl->cfg.cci_i2c_write_cfg;
+	struct cam_sensor_i2c_reg_array *i2c_cmd = i2c_msg->reg_setting;
+	enum cci_i2c_master_t master = c_ctrl->cci_info->cci_i2c_master;
+	uint16_t reg_addr = 0, cmd_size = i2c_msg->size;
+	uint32_t reg_offset, val, delay = 0;
+	uint32_t max_queue_size, queue_size = 0;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	unsigned long flags;
+	uint8_t next_position = i2c_msg->data_type;
+	uint32_t half_queue_mark = 0, full_queue_mark = 0, num_payload = 0;
+	uint32_t num_word_written_to_queue = 0;
+	uint32_t *data_queue = NULL;
+	uint8_t data_len = 0, addr_len = 0;
+	uint32_t index = 0;
+	uint8_t *buf = NULL;
+	uint32_t last_i2c_full_payload = 0;
+	uint32_t trigger_half_queue = 0, queue_start_threshold = 0;
+	uint32_t en_threshold_irq = 0, cci_enable_th_irq = 0;
+
+	if (i2c_cmd == NULL) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Failed: i2c cmd is NULL",
+			cci_dev->soc_info.index, master, queue);
+		return -EINVAL;
+	}
+
+	if ((!cmd_size) || (cmd_size > CCI_I2C_MAX_WRITE)) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d failed: invalid cmd_size %d",
+			cci_dev->soc_info.index, master, queue, cmd_size);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d addr type %d data type %d cmd_size %d",
+		cci_dev->soc_info.index, master, queue, i2c_msg->addr_type, i2c_msg->data_type, cmd_size);
+
+	if (i2c_msg->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d failed: invalid addr_type 0x%X",
+			cci_dev->soc_info.index, master, queue, i2c_msg->addr_type);
+		return -EINVAL;
+	}
+	if (i2c_msg->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d failed: invalid data_type 0x%X",
+			cci_dev->soc_info.index, master, queue, i2c_msg->data_type);
+		return -EINVAL;
+	}
+
+	trace_cam_cci_burst(cci_dev->soc_info.index, master, queue,
+		"cci burst write START for sid",
+		c_ctrl->cci_info->sid);
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d : START for sid: 0x%x size: %d",
+		cci_dev->soc_info.index, master, queue, c_ctrl->cci_info->sid, i2c_msg->size);
+
+	cci_dev->cci_master_info[master].is_burst_enable[queue] = false;
+	cci_dev->cci_master_info[master].num_words_exec[queue] = 0;
+
+	addr_len = cam_cci_convert_type_to_num_bytes(i2c_msg->addr_type);
+	data_len = cam_cci_convert_type_to_num_bytes(i2c_msg->data_type);
+	len = (cmd_size * data_len + addr_len);
+	last_i2c_full_payload = len/MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11;
+	/*
+	 * For every 11 Bytes of Data 1 Byte of data is Control cmd: 0xF9 or 0xE9 or {0x19 to 0xB9}
+	 * Hence compute will account for "len/PAYLOAD_SIZE_11"
+	 */
+	len = len + len/MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11 +
+		(((len % MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11) == 0) ? 0 : 1);
+	if (len % 4) {
+		len = len/4 + 1;
+	} else {
+		len = len/4;
+	}
+	/*
+	 * Its possible that 8 number of CCI cmds, each 32-bit
+	 * can co-exisist in QUEUE along with I2C Data
+	 */
+	len = len + 8;
+
+	data_queue = kzalloc((len * sizeof(uint32_t)),
+			GFP_KERNEL);
+	if (!data_queue) {
+		CAM_ERR(CAM_CCI, "Unable to allocate memory, BUF is NULL");
+		return -ENOMEM;
+	}
+
+	reg_offset = master * 0x200 + queue * 0x100;
+
+	cam_io_w_mb(cci_dev->cci_wait_sync_cfg.cid,
+		base + CCI_SET_CID_SYNC_TIMER_ADDR +
+		cci_dev->cci_wait_sync_cfg.csid *
+		CCI_SET_CID_SYNC_TIMER_OFFSET);
+
+	/* Retry count is not supported in BURST MODE */
+	c_ctrl->cci_info->retries = 0;
+
+	/* 
+	 * 1. Configure Slave ID through SET_PARAM_CMD
+	 *    For Burst Mode retries are not supported.
+	 *    Record the number of words written to QUEUE
+	*/
+	val = CCI_I2C_SET_PARAM_CMD | c_ctrl->cci_info->sid << 4 |
+		c_ctrl->cci_info->retries << 16 |
+		c_ctrl->cci_info->id_map << 18;
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_LOAD_DATA_ADDR:val 0x%x:0x%x",
+		cci_dev->soc_info.index, master, queue, CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset, val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset);
+	index++;
+
+	/* 
+	 * 2. Initialize the variables used for synchronizing between
+	 *    process context and CCI IRQ Context
+	 */
+	spin_lock_irqsave(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+	atomic_set(&cci_dev->cci_master_info[master].q_free[queue], 0);
+	// atomic_set(&cci_dev->cci_master_info[master].th_irq_ref_cnt[queue], 0);
+	reinit_completion(&cci_dev->cci_master_info[master].th_burst_complete[queue]);
+	spin_unlock_irqrestore(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+	cci_dev->cci_master_info[master].th_irq_ref_cnt[queue] = 0;
+
+	max_queue_size =
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size;
+
+	if ((c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ) ||
+		(c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST))
+		queue_size = max_queue_size;
+	else
+		queue_size = max_queue_size / 2;
+	reg_addr = i2c_cmd->reg_addr;
+
+	if (len < queue_size) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d: len: %d < QueueSize: %d "
+			"No need of threshold IRQ",
+			cci_dev->soc_info.index, master, queue, len, queue_size);
+		cci_enable_th_irq = 0;
+	} else {
+		cci_enable_th_irq = CCI_ENABLE_THRESHOLD_IRQ;
+	}
+
+	if (sync_en == MSM_SYNC_ENABLE && cci_dev->valid_sync &&
+		cmd_size < max_queue_size) {
+		val = CCI_I2C_WAIT_SYNC_CMD |
+			((cci_dev->cci_wait_sync_cfg.line) << 4);
+		cam_io_w_mb(val,
+			base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+			reg_offset);
+		index++;
+	}
+
+	/* 3. LOCK the QUEUE So that we can start BURST WRITE*/
+	cam_cci_lock_queue(cci_dev, master, queue, 1);
+	index++;
+
+	/*
+	 * 4. Need to place 0xE0 marker in middle and end of the QUEUE to trigger
+	 *    Thresold Interrupt
+	 */
+	full_queue_mark = (queue_size - index - 1) / MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_WORDS;
+	half_queue_mark = full_queue_mark / 2;
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d queue_size: %d full_queue_mark: %d half_queue_mark: %d",
+		cci_dev->soc_info.index, master, queue, queue_size, full_queue_mark, half_queue_mark);
+
+	/*
+	 * 5. Iterate through entire size of settings ==> {reg_addr, reg_data}
+	 *    and formulate in QUEUE0 like below
+	 *            D2 A1 A2 F9  ==> 0xF9: Hold the BUS for I2C WRITE; {0xA2A1, 0xD2D1,
+	 *            D6 D3 D4 D1  ==> 0xD4D3, 0xD6D5, 0xD8D7, 0xD10D9.......}
+	 *           D10 D7 D8 D5
+	 */
+
+	index = 0;
+	buf = (uint8_t *) &data_queue[index];
+	while (cmd_size) {
+		delay = i2c_cmd->delay;
+		i = 0;
+		buf[i++] = CCI_I2C_WRITE_CMD;
+
+		if (en_seq_write == 0) {
+			for (j = 0; j < i2c_msg->addr_type; j++) {
+				buf[i2c_msg->addr_type - j] = (reg_addr >> (j * 8)) & 0xFF;
+				i++;
+			}
+		}
+		do {
+			if (i2c_msg->data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+				buf[i++] = i2c_cmd->reg_data;
+				if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ ||
+					c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST)
+					reg_addr++;
+			} else {
+				if (i <= cci_dev->payload_size) {
+					/*
+					 * this logic fill reg data to buf[] array
+					 * which has a max index value 11,
+					 * and the sensor reg data type can be DWORD/3B/WORD,
+					 * next_position records the split position or the
+					 * position in the reg data where will be filled into
+					 * next buf[] array slot.
+					 */
+					if (next_position >= CAMERA_SENSOR_I2C_TYPE_DWORD) {
+						buf[i++] = (i2c_cmd->reg_data &
+							0xFF000000) >> 24;
+						if ((i-1) == MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11) {
+							next_position = CAMERA_SENSOR_I2C_TYPE_3B;
+							break;
+						}
+					}
+					/* fill highest byte of 3B type sensor reg data */
+					if (next_position >= CAMERA_SENSOR_I2C_TYPE_3B) {
+						buf[i++] = (i2c_cmd->reg_data &
+							0x00FF0000) >> 16;
+						if ((i-1) == MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11) {
+							next_position = CAMERA_SENSOR_I2C_TYPE_WORD;
+							break;
+						}
+					}
+					/* fill high byte of WORD type sensor reg data */
+					if (next_position >= CAMERA_SENSOR_I2C_TYPE_WORD) {
+						buf[i++] = (i2c_cmd->reg_data &
+							0x0000FF00) >> 8;
+						if ((i-1) == MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11) {
+							next_position = CAMERA_SENSOR_I2C_TYPE_BYTE;
+							break;
+						}
+					}
+					/* fill lowest byte of sensor reg data */
+					buf[i++] = i2c_cmd->reg_data & 0x000000FF;
+					next_position = i2c_msg->data_type;
+
+					if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ ||
+						c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST)
+						reg_addr += i2c_msg->data_type;
+				}
+			}
+			/* move to next cmd while all reg data bytes are filled */
+			if (next_position == i2c_msg->data_type) {
+				i2c_cmd++;
+				--cmd_size;
+			}
+		} while ((cmd_size > 0) && (i <= cci_dev->payload_size));
+
+		num_payload++;
+		en_threshold_irq = cci_enable_th_irq &&
+			(((num_payload % half_queue_mark) == 0) || (num_payload == last_i2c_full_payload));
+		if (cmd_size > 0) {
+			if (en_threshold_irq) {
+				buf[0] |= 0xE0;
+				cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]++;
+				CAM_DBG(CAM_CCI,
+					"CCI%d_I2C_M%d_Q%d Th IRQ enabled for index: %d "
+					"num_payld: %d th_irq_ref_cnt: %d",
+					cci_dev->soc_info.index, master, queue, num_word_written_to_queue,
+					num_payload, cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]);
+			} else {
+				buf[0] |= 0xF0;
+			}
+		} else {
+			buf[0] |= ((i-1) << 4);
+			CAM_DBG(CAM_CCI, "End of register Write............ ");
+		}
+		en_seq_write = 1;
+		len = ((i-1)/4) + 1;
+		/* increment pointer to next multiple of 4; which is a word in CCI QUEUE */
+		buf = buf + ((i+3) & ~0x03);
+		num_word_written_to_queue += len;
+	}
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d num words to Queue: %d th_irq_ref_cnt: %d cci_dev: %p",
+		cci_dev->soc_info.index, master, queue, num_word_written_to_queue,
+		cci_dev->cci_master_info[master].th_irq_ref_cnt[queue], cci_dev);
+
+	trace_cam_cci_burst(cci_dev->soc_info.index, master, queue,
+		"thirq_cnt",
+		cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]);
+
+	index = 0;
+	queue_start_threshold = half_queue_mark * MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_WORDS;
+
+	cci_dev->cci_master_info[master].data_queue[queue] = data_queue;
+	cci_dev->cci_master_info[master].num_words_in_data_queue[queue] = num_word_written_to_queue;
+	cci_dev->cci_master_info[master].data_queue_start_index[queue] = index;
+	cci_dev->cci_master_info[master].half_queue_mark[queue] = queue_start_threshold;
+
+	cam_cci_data_queue_burst_apply(cci_dev, master, queue, trigger_half_queue);
+
+	while ((cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]) > 0) {
+		if (!cam_common_wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].th_burst_complete[queue],
+			CCI_TIMEOUT)) {
+			cam_cci_dump_registers(cci_dev, master, queue);
+
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d wait timeout, rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			rc = -ETIMEDOUT;
+			cam_cci_flush_queue(cci_dev, master);
+			CAM_INFO(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d dump register after reset",
+				cci_dev->soc_info.index, master, queue);
+			cam_cci_dump_registers(cci_dev, master, queue);
+			goto ERROR;
+		}
+		cci_dev->cci_master_info[master].th_irq_ref_cnt[queue]--;
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Threshold IRQ Raised, BufferLevel: %d",
+			cci_dev->soc_info.index, master, queue,
+			cam_io_r_mb(base + CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset));
+	}
+
+	if (cci_dev->cci_master_info[master].th_irq_ref_cnt[queue] > 0) {
+		cci_dev->cci_master_info[master].is_burst_enable[queue] = true;
+		cci_dev->cci_master_info[master].num_words_exec[queue] = 0;
+	}
+
+	rc = cam_cci_transfer_end(cci_dev, master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Slave: 0x%x failed rc %d",
+			cci_dev->soc_info.index, master, queue, (c_ctrl->cci_info->sid << 1), rc);
+		goto ERROR;
+	}
+	trace_cam_cci_burst(cci_dev->soc_info.index, master, queue,
+		"cci burst write Done for sid",
+		c_ctrl->cci_info->sid);
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d : completed ....for sid: 0x%x size: %d",
+		cci_dev->soc_info.index, master, queue, c_ctrl->cci_info->sid, i2c_msg->size);
+
+ERROR:
+	kfree(data_queue);
+	cci_dev->cci_master_info[master].data_queue[queue] = NULL;
+	return rc;
+}
+
+static int32_t cam_cci_data_queue(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl, enum cci_i2c_queue_t queue,
+	enum cci_i2c_sync sync_en)
+{
+	uint16_t i = 0, j = 0, k = 0, h = 0, len = 0;
+	int32_t rc = 0, free_size = 0, en_seq_write = 0;
+	uint8_t write_data[CAM_MAX_NUM_CCI_PAYLOAD_BYTES + 1] = {0};
+	struct cam_sensor_i2c_reg_setting *i2c_msg =
+		&c_ctrl->cfg.cci_i2c_write_cfg;
+	struct cam_sensor_i2c_reg_array *i2c_cmd = i2c_msg->reg_setting;
+	enum cci_i2c_master_t master = c_ctrl->cci_info->cci_i2c_master;
+	uint16_t reg_addr = 0, cmd_size = i2c_msg->size;
+	uint32_t read_val = 0, reg_offset, val, delay = 0;
+	uint32_t max_queue_size, queue_size = 0, cmd = 0;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	unsigned long flags;
+	uint8_t next_position = i2c_msg->data_type;
+
+	if (i2c_cmd == NULL) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Failed: i2c cmd is NULL",
+			cci_dev->soc_info.index, master, queue);
+		return -EINVAL;
+	}
+
+	if ((!cmd_size) || (cmd_size > CCI_I2C_MAX_WRITE)) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d failed: invalid cmd_size %d",
+			cci_dev->soc_info.index, master, queue, cmd_size);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d addr type %d data type %d cmd_size %d",
+		cci_dev->soc_info.index, master, queue, i2c_msg->addr_type, i2c_msg->data_type, cmd_size);
+
+	if (i2c_msg->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d failed: invalid addr_type 0x%X",
+			cci_dev->soc_info.index, master, queue, i2c_msg->addr_type);
+		return -EINVAL;
+	}
+	if (i2c_msg->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d failed: invalid data_type 0x%X",
+			cci_dev->soc_info.index, master, queue, i2c_msg->data_type);
+		return -EINVAL;
+	}
+	reg_offset = master * 0x200 + queue * 0x100;
+
+	cci_dev->cci_master_info[master].is_burst_enable[queue] = false;
+	cci_dev->cci_master_info[master].num_words_exec[queue] = 0;
+	cam_io_w_mb(cci_dev->cci_wait_sync_cfg.cid,
+		base + CCI_SET_CID_SYNC_TIMER_ADDR +
+		cci_dev->cci_wait_sync_cfg.csid *
+		CCI_SET_CID_SYNC_TIMER_OFFSET);
+
+	cam_cci_lock_queue(cci_dev, master, queue, 1);
+
+	val = CCI_I2C_SET_PARAM_CMD | c_ctrl->cci_info->sid << 4 |
+		c_ctrl->cci_info->retries << 16 |
+		c_ctrl->cci_info->id_map << 18;
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_LOAD_DATA_ADDR:val 0x%x:0x%x",
+		cci_dev->soc_info.index, master, queue, CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset, val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset);
+
+	spin_lock_irqsave(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+	atomic_set(&cci_dev->cci_master_info[master].q_free[queue], 0);
+	spin_unlock_irqrestore(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+
+	max_queue_size =
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size;
+
+	if ((c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ) ||
+		(c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST))
+		queue_size = max_queue_size;
+	else
+		queue_size = max_queue_size / 2;
+	reg_addr = i2c_cmd->reg_addr;
+
+	if (sync_en == MSM_SYNC_ENABLE && cci_dev->valid_sync &&
+		cmd_size < max_queue_size) {
+		val = CCI_I2C_WAIT_SYNC_CMD |
+			((cci_dev->cci_wait_sync_cfg.line) << 4);
+		cam_io_w_mb(val,
+			base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+			reg_offset);
+	}
+
+	while (cmd_size) {
+		uint32_t pack = 0;
+
+		len = cam_cci_calc_cmd_len(cci_dev, c_ctrl, cmd_size,
+			i2c_cmd, &pack);
+		if (len <= 0) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d Calculate command len failed, len: %d",
+				cci_dev->soc_info.index, master, queue, len);
+			return -EINVAL;
+		}
+
+		read_val = cam_io_r_mb(base +
+			CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d CUR_WORD_CNT_ADDR %d len %d max %d",
+			cci_dev->soc_info.index, master, queue, read_val, len, max_queue_size);
+		/* + 2 - space alocation for Report and Unlock CMD */
+		if ((read_val + len + 2) > queue_size) {
+			if ((read_val + len + 2) > max_queue_size) {
+				rc = cam_cci_process_full_q(cci_dev,
+					master, queue);
+				if (rc < 0) {
+					CAM_ERR(CAM_CCI,
+						"CCI%d_I2C_M%d_Q%d Failed to process full queue rc: %d",
+						cci_dev->soc_info.index, master, queue, rc);
+					return rc;
+				}
+				continue;
+			}
+			cam_cci_process_half_q(cci_dev, master, queue);
+		}
+
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d cmd_size %d addr 0x%x data 0x%x",
+			cci_dev->soc_info.index, master, queue, cmd_size, i2c_cmd->reg_addr, i2c_cmd->reg_data);
+		delay = i2c_cmd->delay;
+		i = 0;
+		write_data[i++] = CCI_I2C_WRITE_CMD;
+
+		/*
+		 * in case of multiple command
+		 * MSM_CCI_I2C_WRITE : address is not continuous, so update
+		 *	address for a new packet.
+		 * MSM_CCI_I2C_WRITE_SEQ : address is continuous, need to keep
+		 *	the incremented address for a
+		 *	new packet
+		 */
+		if (c_ctrl->cmd == MSM_CCI_I2C_WRITE ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_ASYNC ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_SYNC ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_SYNC_BLOCK)
+			reg_addr = i2c_cmd->reg_addr;
+
+		if (en_seq_write == 0) {
+			for (j = 0; j < i2c_msg->addr_type; j++) {
+				write_data[i2c_msg->addr_type - j] = (reg_addr >> (j * 8)) & 0xFF;
+				i++;
+			}
+		}
+
+		do {
+			if (i2c_msg->data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+				write_data[i++] = i2c_cmd->reg_data;
+				if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ)
+					reg_addr++;
+			} else {
+				if (i <= cci_dev->payload_size) {
+					/*
+					 * this logic fill reg data to write_data[] array
+					 * which has a max index value 11,
+					 * and the sensor reg data type can be DWORD/3B/WORD,
+					 * next_position records the split position or the
+					 * position in the reg data where will be filled into
+					 * next write_data[] array slot.
+					 */
+					if (next_position >= CAMERA_SENSOR_I2C_TYPE_DWORD) {
+						write_data[i++] = (i2c_cmd->reg_data &
+							0xFF000000) >> 24;
+						if ((i-1) == MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11) {
+							next_position = CAMERA_SENSOR_I2C_TYPE_3B;
+							break;
+						}
+					}
+					/* fill highest byte of 3B type sensor reg data */
+					if (next_position >= CAMERA_SENSOR_I2C_TYPE_3B) {
+						write_data[i++] = (i2c_cmd->reg_data &
+							0x00FF0000) >> 16;
+						if ((i-1) == MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11) {
+							next_position = CAMERA_SENSOR_I2C_TYPE_WORD;
+							break;
+						}
+					}
+					/* fill high byte of WORD type sensor reg data */
+					if (next_position >= CAMERA_SENSOR_I2C_TYPE_WORD) {
+						write_data[i++] = (i2c_cmd->reg_data &
+							0x0000FF00) >> 8;
+						if ((i-1) == MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11) {
+							next_position = CAMERA_SENSOR_I2C_TYPE_BYTE;
+							break;
+						}
+					}
+					/* fill lowest byte of sensor reg data */
+					write_data[i++] = i2c_cmd->reg_data & 0x000000FF;
+					next_position = i2c_msg->data_type;
+
+					if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ)
+						reg_addr += i2c_msg->data_type;
+				}
+			}
+			/* move to next cmd while all reg data bytes are filled */
+			if (next_position == i2c_msg->data_type) {
+				i2c_cmd++;
+				--cmd_size;
+			}
+		} while (((c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST) || pack--) &&
+				(cmd_size > 0) && (i <= cci_dev->payload_size));
+		free_size = cam_cci_get_queue_free_size(cci_dev, master,
+				queue);
+		if ((c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST) &&
+			((i-1) == MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11) &&
+			cci_dev->support_seq_write && cmd_size > 0 &&
+			free_size > BURST_MIN_FREE_SIZE) {
+			write_data[0] |= 0xF0;
+			en_seq_write = 1;
+		} else {
+			write_data[0] |= ((i-1) << 4);
+			en_seq_write = 0;
+		}
+		len = ((i-1)/4) + 1;
+
+		CAM_DBG(CAM_CCI, "free_size %d, en_seq_write %d i: %d len: %d ",
+			free_size, en_seq_write, i, len);
+		read_val = cam_io_r_mb(base +
+			CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+		for (h = 0, k = 0; h < len; h++) {
+			cmd = 0;
+			for (j = 0; (j < 4 && k < i); j++)
+				cmd |= (write_data[k++] << (j * 8));
+			CAM_DBG(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d LOAD_DATA_ADDR 0x%x, len:%d, cnt: %d",
+				cci_dev->soc_info.index, master, queue, cmd, len, read_val);
+			cam_io_w_mb(cmd, base +
+				CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+				master * 0x200 + queue * 0x100);
+
+			read_val += 1;
+
+		}
+
+		cam_io_w_mb(read_val, base +
+			CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+
+		if ((delay > 0) && (delay < CCI_MAX_DELAY) &&
+			en_seq_write == 0) {
+			cmd = (uint32_t)((delay * cci_dev->cycles_per_us) /
+				0x100);
+			cmd <<= 4;
+			cmd |= CCI_I2C_WAIT_CMD;
+			CAM_DBG(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d_LOAD_DATA_ADDR 0x%x",
+				cci_dev->soc_info.index, master, queue, cmd);
+			cam_io_w_mb(cmd, base +
+				CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+				master * 0x200 + queue * 0x100);
+			read_val += 1;
+			cam_io_w_mb(read_val, base +
+				CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+		}
+	}
+
+	rc = cam_cci_transfer_end(cci_dev, master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Slave: 0x%x failed rc %d",
+			cci_dev->soc_info.index, master, queue, (c_ctrl->cci_info->sid << 1), rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int32_t cam_cci_burst_read(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	uint32_t val = 0, i = 0, j = 0, irq_mask_update = 0;
+	unsigned long rem_jiffies, flags;
+	int32_t read_words = 0, exp_words = 0;
+	int32_t index = 0, first_byte = 0, total_read_words = 0;
+	enum cci_i2c_master_t master;
+	enum cci_i2c_queue_t queue = QUEUE_1;
+	struct cci_device                  *cci_dev = NULL;
+	struct cam_cci_read_cfg            *read_cfg = NULL;
+	struct cam_hw_soc_info             *soc_info = NULL;
+	void __iomem                       *base = NULL;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+	master = c_ctrl->cci_info->cci_i2c_master;
+	read_cfg = &c_ctrl->cfg.cci_i2c_read_cfg;
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+		|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Invalid I2C master addr",
+			cci_dev->soc_info.index, master, queue);
+		return -EINVAL;
+	}
+
+	/* Set the I2C Frequency */
+	rc = cam_cci_set_clk_param(cci_dev, c_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d cam_cci_set_clk_param failed rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		return rc;
+	}
+
+	mutex_lock(&cci_dev->cci_master_info[master].mutex_q[queue]);
+	cci_dev->is_burst_read[master] = true;
+	reinit_completion(&cci_dev->cci_master_info[master].report_q[queue]);
+
+	soc_info = &cci_dev->soc_info;
+	base = soc_info->reg_map[0].mem_base;
+
+	/*
+	 * Call validate queue to make sure queue is empty before starting.
+	 * If this call fails, don't proceed with i2c_read call. This is to
+	 * avoid overflow / underflow of queue
+	 */
+	rc = cam_cci_validate_queue(cci_dev,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size - 1,
+		master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Initial validataion failed rc:%d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	if (c_ctrl->cci_info->retries > CCI_I2C_READ_MAX_RETRIES) {
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Invalid read retries info retries from slave: %d, max retries: %d",
+			cci_dev->soc_info.index, master, queue, c_ctrl->cci_info->retries, CCI_I2C_READ_MAX_RETRIES);
+		goto rel_mutex_q;
+	}
+
+	if (read_cfg->data == NULL) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Data ptr is NULL",
+			cci_dev->soc_info.index, master, queue);
+		goto rel_mutex_q;
+	}
+
+	if (read_cfg->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d failed : Invalid addr type: %u",
+			cci_dev->soc_info.index, master, queue, read_cfg->addr_type);
+		rc = -EINVAL;
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_LOCK_CMD;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d failed to write lock_cmd for rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d set param sid 0x%x retries %d id_map %d",
+		cci_dev->soc_info.index, master, queue,
+		c_ctrl->cci_info->sid, c_ctrl->cci_info->retries,
+		c_ctrl->cci_info->id_map);
+	val = CCI_I2C_SET_PARAM_CMD | c_ctrl->cci_info->sid << 4 |
+		c_ctrl->cci_info->retries << 16 |
+		c_ctrl->cci_info->id_map << 18;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Failed to write param_cmd for rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_WRITE_DISABLE_P_CMD | (read_cfg->addr_type << 4);
+	for (i = 0; i < read_cfg->addr_type; i++) {
+		val |= ((read_cfg->addr >> (i << 3)) & 0xFF)  <<
+		((read_cfg->addr_type - i) << 3);
+	}
+
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Failed to write disable cmd for rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_READ_CMD | (read_cfg->num_byte << 4);
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Failed to write read_cmd for rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_UNLOCK_CMD;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d failed to write unlock_cmd for rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = cam_io_r_mb(base + CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR
+			+ master * 0x200 + queue * 0x100);
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d cur word cnt 0x%x",
+		cci_dev->soc_info.index, master, queue, val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR
+			+ master * 0x200 + queue * 0x100);
+
+	val = 1 << ((master * 2) + queue);
+	cam_io_w_mb(val, base + CCI_QUEUE_START_ADDR);
+
+	exp_words = ((read_cfg->num_byte / 4) + 1);
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d waiting for threshold [exp_words %d]",
+		cci_dev->soc_info.index, master, queue, exp_words);
+
+	while (total_read_words != exp_words) {
+		rem_jiffies = cam_common_wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].th_complete,
+			CCI_TIMEOUT);
+		if (!rem_jiffies) {
+			rc = -ETIMEDOUT;
+			val = cam_io_r_mb(base +
+				CCI_I2C_M0_READ_BUF_LEVEL_ADDR +
+				master * 0x100);
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d wait timeout for th_complete, FIFO buf_lvl:0x%x, rc: %d",
+				cci_dev->soc_info.index, master, queue, val, rc);
+			cam_cci_dump_registers(cci_dev, master, queue);
+
+			cam_cci_flush_queue(cci_dev, master);
+			goto rel_mutex_q;
+		}
+
+		if (cci_dev->cci_master_info[master].status) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d Error with Slave: 0x%x",
+				cci_dev->soc_info.index, master, queue, (c_ctrl->cci_info->sid << 1));
+			rc = -EINVAL;
+			cci_dev->cci_master_info[master].status = 0;
+			goto rel_mutex_q;
+		}
+
+		read_words = cam_io_r_mb(base +
+			CCI_I2C_M0_READ_BUF_LEVEL_ADDR + master * 0x100);
+		if (read_words <= 0) {
+			CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d FIFO Buffer lvl is 0",
+				cci_dev->soc_info.index, master, queue);
+			goto enable_irq;
+		}
+
+read_again:
+		j++;
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d Iteration: %u read_words %d",
+			cci_dev->soc_info.index, master, queue, j, read_words);
+
+		total_read_words += read_words;
+		while (read_words > 0) {
+			val = cam_io_r_mb(base +
+				CCI_I2C_M0_READ_DATA_ADDR + master * 0x100);
+			for (i = 0; (i < 4) &&
+				(index < read_cfg->num_byte); i++) {
+				CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d i:%d index:%d",
+					cci_dev->soc_info.index, master, queue, i, index);
+				if (!first_byte) {
+					CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d sid 0x%x",
+						cci_dev->soc_info.index, master, queue, val & 0xFF);
+					first_byte++;
+				} else {
+					read_cfg->data[index] =
+						(val  >> (i * 8)) & 0xFF;
+					CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d data[%d] 0x%x",
+						cci_dev->soc_info.index, master, queue, index,
+						read_cfg->data[index]);
+					index++;
+				}
+			}
+			read_words--;
+		}
+
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d Iteration:%u total_read_words %d",
+			cci_dev->soc_info.index, master, queue, j, total_read_words);
+
+		read_words = cam_io_r_mb(base +
+			CCI_I2C_M0_READ_BUF_LEVEL_ADDR + master * 0x100);
+		if (read_words > 0) {
+			CAM_DBG(CAM_CCI, "FIFO Buffer lvl is %d", read_words);
+			goto read_again;
+		}
+
+enable_irq:
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		if (cci_dev->irqs_disabled) {
+			irq_mask_update =
+				cam_io_r_mb(base + CCI_IRQ_MASK_1_ADDR);
+			if (master == MASTER_0 && cci_dev->irqs_disabled &
+				CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD)
+				irq_mask_update |=
+					CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+			else if (master == MASTER_1 && cci_dev->irqs_disabled &
+				CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD)
+				irq_mask_update |=
+					CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+			cam_io_w_mb(irq_mask_update,
+				base + CCI_IRQ_MASK_1_ADDR);
+		}
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+
+		if (total_read_words == exp_words) {
+		   /*
+		    * This wait is for RD_DONE irq, if RD_DONE is
+		    * triggered we will call complete on both threshold
+		    * & read done waits. As part of the threshold wait
+		    * we will be draining the entire buffer out. This
+		    * wait is to compensate for the complete invoked for
+		    * RD_DONE exclusively.
+		    */
+			rem_jiffies = cam_common_wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].rd_done,
+			CCI_TIMEOUT);
+			if (!rem_jiffies) {
+				rc = -ETIMEDOUT;
+				val = cam_io_r_mb(base +
+					CCI_I2C_M0_READ_BUF_LEVEL_ADDR +
+					master * 0x100);
+				CAM_ERR(CAM_CCI,
+					"CCI%d_I2C_M%d_Q%d wait timeout for RD_DONE irq for rc = %d FIFO buf_lvl:0x%x, rc: %d",
+					cci_dev->soc_info.index, master, queue,
+					val, rc);
+				cam_cci_dump_registers(cci_dev,
+						master, queue);
+
+				cam_cci_flush_queue(cci_dev, master);
+				goto rel_mutex_q;
+			}
+
+			if (cci_dev->cci_master_info[master].status) {
+				CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Error with Slave 0x%x",
+					cci_dev->soc_info.index, master, queue, (c_ctrl->cci_info->sid << 1));
+				rc = -EINVAL;
+				cci_dev->cci_master_info[master].status = 0;
+				goto rel_mutex_q;
+			}
+			break;
+		}
+	}
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d Burst read successful words_read %d",
+		cci_dev->soc_info.index, master, queue, total_read_words);
+
+rel_mutex_q:
+	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[queue]);
+
+	mutex_lock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	if (--cci_dev->cci_master_info[master].freq_ref_cnt == 0)
+		up(&cci_dev->cci_master_info[master].master_sem);
+	mutex_unlock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	return rc;
+}
+
+static int32_t cam_cci_read(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	uint32_t val = 0;
+	uint8_t read_data_byte[CAM_MAX_NUM_CCI_PAYLOAD_BYTES + 1] = {0};
+	uint32_t *reg_addr;
+	int32_t read_words = 0, exp_words = 0;
+	int32_t index = 0, first_byte = 0;
+	uint32_t i = 0;
+	enum cci_i2c_master_t master;
+	enum cci_i2c_queue_t queue = QUEUE_1;
+	struct cci_device *cci_dev = NULL;
+	struct cam_cci_read_cfg *read_cfg = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	void __iomem *base = NULL;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+	master = c_ctrl->cci_info->cci_i2c_master;
+	read_cfg = &c_ctrl->cfg.cci_i2c_read_cfg;
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+		|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Invalid I2C master addr:%d",
+			cci_dev->soc_info.index, master, queue, c_ctrl->cci_info->cci_i2c_master);
+		return -EINVAL;
+	}
+
+	/* Set the I2C Frequency */
+	rc = cam_cci_set_clk_param(cci_dev, c_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "cam_cci_set_clk_param failed rc = %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&cci_dev->cci_master_info[master].mutex_q[queue]);
+	cci_dev->is_burst_read[master] = false;
+	reinit_completion(&cci_dev->cci_master_info[master].report_q[queue]);
+
+	soc_info = &cci_dev->soc_info;
+	base = soc_info->reg_map[0].mem_base;
+
+	/*
+	 * Call validate queue to make sure queue is empty before starting.
+	 * If this call fails, don't proceed with i2c_read call. This is to
+	 * avoid overflow / underflow of queue
+	 */
+	rc = cam_cci_validate_queue(cci_dev,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size - 1,
+		master, queue);
+	if (rc < 0) {
+		val = cam_io_r_mb(base + CCI_I2C_M0_Q0_CUR_CMD_ADDR +
+			master * 0x200 + queue * 0x100);
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Initial validataion failed rc: %d, CUR_CMD:0x%x",
+			cci_dev->soc_info.index, master, queue, rc, val);
+		goto rel_mutex_q;
+	}
+
+	if (c_ctrl->cci_info->retries > CCI_I2C_READ_MAX_RETRIES) {
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Invalid read retries info retries from slave: %d, max retries: %d",
+			cci_dev->soc_info.index, master, queue, c_ctrl->cci_info->retries, CCI_I2C_READ_MAX_RETRIES);
+		goto rel_mutex_q;
+	}
+
+	if (read_cfg->data == NULL) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Data ptr is NULL",
+			cci_dev->soc_info.index, master, queue);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_LOCK_CMD;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d failed to write lock_cmd for rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d set param sid 0x%x retries %d id_map %d",
+		cci_dev->soc_info.index, master, queue,
+		c_ctrl->cci_info->sid, c_ctrl->cci_info->retries,
+		c_ctrl->cci_info->id_map);
+	val = CCI_I2C_SET_PARAM_CMD | c_ctrl->cci_info->sid << 4 |
+		c_ctrl->cci_info->retries << 16 |
+		c_ctrl->cci_info->id_map << 18;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Failed to write param_cmd for rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	if (read_cfg->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Failed : Invalid addr type: %u",
+			cci_dev->soc_info.index, master, queue, read_cfg->addr_type);
+		rc = -EINVAL;
+		goto rel_mutex_q;
+	}
+
+	read_data_byte[0] = CCI_I2C_WRITE_DISABLE_P_CMD | (read_cfg->addr_type << 4);
+	for (i = 0; i < read_cfg->addr_type; i++) {
+		read_data_byte[read_cfg->addr_type - i] = (read_cfg->addr >> (i * 8)) & 0xFF;
+	}
+
+	reg_addr = (uint32_t *)&read_data_byte[0];
+	read_words = DIV_ROUND_UP(read_cfg->addr_type + 1, 4);
+
+	for (i = 0; i < read_words; i++) {
+		rc = cam_cci_write_i2c_queue(cci_dev, *reg_addr, master, queue);
+		if (rc < 0) {
+			CAM_DBG(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d Failed to write disable_cmd for rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			goto rel_mutex_q;
+		}
+		reg_addr++;
+	}
+
+	val = CCI_I2C_READ_CMD | (read_cfg->num_byte << 4);
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Failed to write read_cmd for rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_UNLOCK_CMD;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d failed to write unlock_cmd for rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = cam_io_r_mb(base + CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR
+			+ master * 0x200 + queue * 0x100);
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d_CUR_WORD_CNT 0x%x",
+		cci_dev->soc_info.index, master, queue, val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR
+			+ master * 0x200 + queue * 0x100);
+
+	val = 1 << ((master * 2) + queue);
+	cam_io_w_mb(val, base + CCI_QUEUE_START_ADDR);
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d exp_words to be read: %d",
+		cci_dev->soc_info.index, master, queue, ((read_cfg->num_byte / 4) + 1));
+
+	if (!cam_common_wait_for_completion_timeout(
+		&cci_dev->cci_master_info[master].rd_done, CCI_TIMEOUT)) {
+		cam_cci_dump_registers(cci_dev, master, queue);
+
+		rc = -ETIMEDOUT;
+		val = cam_io_r_mb(base +
+			CCI_I2C_M0_READ_BUF_LEVEL_ADDR + master * 0x100);
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d rd_done wait timeout FIFO buf_lvl: 0x%x, rc: %d",
+			cci_dev->soc_info.index, master, queue, val, rc);
+		cam_cci_flush_queue(cci_dev, master);
+		goto rel_mutex_q;
+	}
+
+	if (cci_dev->cci_master_info[master].status) {
+		if (cci_dev->is_probing)
+			CAM_INFO(CAM_CCI, "CCI%d_I2C_M%d_Q%d ERROR with Slave 0x%x",
+				cci_dev->soc_info.index, master, queue,
+				(c_ctrl->cci_info->sid << 1));
+		else
+			CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d ERROR with Slave 0x%x",
+				cci_dev->soc_info.index, master, queue,
+				(c_ctrl->cci_info->sid << 1));
+		rc = -EINVAL;
+		cci_dev->cci_master_info[master].status = 0;
+		goto rel_mutex_q;
+	}
+
+	read_words = cam_io_r_mb(base +
+		CCI_I2C_M0_READ_BUF_LEVEL_ADDR + master * 0x100);
+	exp_words = ((read_cfg->num_byte / 4) + 1);
+	if (read_words != exp_words) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d read_words: %d, exp words: %d",
+			cci_dev->soc_info.index, master, queue, read_words, exp_words);
+		memset(read_cfg->data, 0, read_cfg->num_byte);
+		rc = -EINVAL;
+		goto rel_mutex_q;
+	}
+	index = 0;
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d index: %d, num_type: %d",
+		cci_dev->soc_info.index, master, queue, index, read_cfg->num_byte);
+	first_byte = 0;
+	while (read_words > 0) {
+		val = cam_io_r_mb(base +
+			CCI_I2C_M0_READ_DATA_ADDR + master * 0x100);
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d read val: 0x%x",
+			cci_dev->soc_info.index, master, queue, val);
+		for (i = 0; (i < 4) && (index < read_cfg->num_byte); i++) {
+			CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d i: %d, index: %d",
+				cci_dev->soc_info.index, master, queue, i, index);
+			if (!first_byte) {
+				CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d sid: 0x%x",
+					cci_dev->soc_info.index, master, queue, val & 0xFF);
+				first_byte++;
+			} else {
+				read_cfg->data[index] =
+					(val  >> (i * 8)) & 0xFF;
+				CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d data[%d] 0x%x",
+					cci_dev->soc_info.index, master, queue, index,
+					read_cfg->data[index]);
+				index++;
+			}
+		}
+		read_words--;
+	}
+rel_mutex_q:
+	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[queue]);
+
+	mutex_lock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	if (--cci_dev->cci_master_info[master].freq_ref_cnt == 0)
+		up(&cci_dev->cci_master_info[master].master_sem);
+	mutex_unlock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	return rc;
+}
+
+static int32_t cam_cci_i2c_write(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl, enum cci_i2c_queue_t queue,
+	enum cci_i2c_sync sync_en)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev;
+	enum cci_i2c_master_t master;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+
+	if (cci_dev->cci_state != CCI_STATE_ENABLED) {
+		CAM_ERR(CAM_CCI, "invalid cci: %d state: %d",
+			cci_dev->soc_info.index, cci_dev->cci_state);
+		return -EINVAL;
+	}
+	master = c_ctrl->cci_info->cci_i2c_master;
+	if (master >= MASTER_MAX || master < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Invalid I2C master addr",
+			cci_dev->soc_info.index,
+			master);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d_Q%d set param sid 0x%x retries %d id_map %d",
+		cci_dev->soc_info.index, master, queue, c_ctrl->cci_info->sid, c_ctrl->cci_info->retries,
+		c_ctrl->cci_info->id_map);
+
+	/* Set the I2C Frequency */
+	rc = cam_cci_set_clk_param(cci_dev, c_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d cam_cci_set_clk_param failed rc %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		return rc;
+	}
+	reinit_completion(&cci_dev->cci_master_info[master].report_q[queue]);
+	reinit_completion(&cci_dev->cci_master_info[master].th_burst_complete[queue]);
+	/*
+	 * Call validate queue to make sure queue is empty before starting.
+	 * If this call fails, don't proceed with i2c_write call. This is to
+	 * avoid overflow / underflow of queue
+	 */
+	rc = cam_cci_validate_queue(cci_dev,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size-1,
+		master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Initial validataion failed rc %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto ERROR;
+	}
+	if (c_ctrl->cci_info->retries > CCI_I2C_READ_MAX_RETRIES) {
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d_Q%d Invalid read retries info retries from slave: %d, max retries: %d",
+			cci_dev->soc_info.index, master, queue, c_ctrl->cci_info->retries, CCI_I2C_READ_MAX_RETRIES);
+		goto ERROR;
+	}
+	if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST) {
+		rc = cam_cci_data_queue_burst(cci_dev, c_ctrl, queue, sync_en);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d Failed in queueing i2c Burst write data for rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			goto ERROR;
+		}
+	} else {
+		rc = cam_cci_data_queue(cci_dev, c_ctrl, queue, sync_en);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d_Q%d Failed in queueing the data for rc: %d sid 0x%x ",
+				cci_dev->soc_info.index, master, queue, rc, c_ctrl->cci_info->sid);
+			goto ERROR;
+		}
+	}
+
+ERROR:
+	mutex_lock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	if (--cci_dev->cci_master_info[master].freq_ref_cnt == 0)
+		up(&cci_dev->cci_master_info[master].master_sem);
+	mutex_unlock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	return rc;
+}
+
+static void cam_cci_write_async_helper(struct work_struct *work)
+{
+	int rc;
+	struct cci_device *cci_dev;
+	struct cci_write_async *write_async =
+		container_of(work, struct cci_write_async, work);
+	enum cci_i2c_master_t master;
+	struct cam_cci_master_info *cci_master_info;
+
+	cam_common_util_thread_switch_delay_detect(
+		"cam_cci_workq", "schedule", cam_cci_write_async_helper,
+		write_async->workq_scheduled_ts,
+		CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+	cci_dev = write_async->cci_dev;
+	master = write_async->c_ctrl.cci_info->cci_i2c_master;
+	cci_master_info = &cci_dev->cci_master_info[master];
+
+	mutex_lock(&cci_master_info->mutex_q[write_async->queue]);
+	rc = cam_cci_i2c_write(&(cci_dev->v4l2_dev_str.sd),
+		&write_async->c_ctrl, write_async->queue, write_async->sync_en);
+	mutex_unlock(&cci_master_info->mutex_q[write_async->queue]);
+	if (rc < 0)
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Failed rc: %d",
+		cci_dev->soc_info.index, master, write_async->queue, rc);
+
+	kfree(write_async->c_ctrl.cfg.cci_i2c_write_cfg.reg_setting);
+	kfree(write_async);
+}
+
+static int32_t cam_cci_i2c_write_async(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl, enum cci_i2c_queue_t queue,
+	enum cci_i2c_sync sync_en)
+{
+	int32_t rc = 0;
+	struct cci_write_async *write_async;
+	struct cci_device *cci_dev;
+	struct cam_sensor_i2c_reg_setting *cci_i2c_write_cfg;
+	struct cam_sensor_i2c_reg_setting *cci_i2c_write_cfg_w;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+
+	write_async = kzalloc(sizeof(*write_async), GFP_KERNEL);
+	if (!write_async) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Memory allocation failed for write_async",
+			cci_dev->soc_info.index, c_ctrl->cci_info->cci_i2c_master, queue);
+		return -ENOMEM;
+	}
+
+
+	INIT_WORK(&write_async->work, cam_cci_write_async_helper);
+	write_async->cci_dev = cci_dev;
+	write_async->c_ctrl = *c_ctrl;
+	write_async->queue = queue;
+	write_async->sync_en = sync_en;
+
+	cci_i2c_write_cfg = &c_ctrl->cfg.cci_i2c_write_cfg;
+	cci_i2c_write_cfg_w = &write_async->c_ctrl.cfg.cci_i2c_write_cfg;
+
+	if (cci_i2c_write_cfg->size == 0) {
+		kfree(write_async);
+		return -EINVAL;
+	}
+
+	cci_i2c_write_cfg_w->reg_setting =
+		kzalloc(sizeof(struct cam_sensor_i2c_reg_array)*
+		cci_i2c_write_cfg->size, GFP_KERNEL);
+	if (!cci_i2c_write_cfg_w->reg_setting) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d_Q%d Couldn't allocate memory for reg_setting",
+			cci_dev->soc_info.index, c_ctrl->cci_info->cci_i2c_master, queue);
+		kfree(write_async);
+		return -ENOMEM;
+	}
+	memcpy(cci_i2c_write_cfg_w->reg_setting,
+		cci_i2c_write_cfg->reg_setting,
+		(sizeof(struct cam_sensor_i2c_reg_array)*
+						cci_i2c_write_cfg->size));
+
+	cci_i2c_write_cfg_w->addr_type = cci_i2c_write_cfg->addr_type;
+	cci_i2c_write_cfg_w->addr_type = cci_i2c_write_cfg->addr_type;
+	cci_i2c_write_cfg_w->data_type = cci_i2c_write_cfg->data_type;
+	cci_i2c_write_cfg_w->size = cci_i2c_write_cfg->size;
+	cci_i2c_write_cfg_w->delay = cci_i2c_write_cfg->delay;
+
+	write_async->workq_scheduled_ts = ktime_get();
+	queue_work(cci_dev->write_wq[write_async->queue], &write_async->work);
+
+	return rc;
+}
+
+static int32_t cam_cci_read_bytes_v_1_2(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev = NULL;
+	enum cci_i2c_master_t master;
+	struct cam_cci_read_cfg *read_cfg = NULL;
+	uint16_t read_bytes = 0;
+
+	if (!sd || !c_ctrl) {
+		CAM_ERR(CAM_CCI, "sd %pK c_ctrl %pK",
+			sd, c_ctrl);
+		return -EINVAL;
+	}
+	if (!c_ctrl->cci_info) {
+		CAM_ERR(CAM_CCI, "cci_info NULL");
+		return -EINVAL;
+	}
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+	if (cci_dev->cci_state != CCI_STATE_ENABLED) {
+		CAM_ERR(CAM_CCI, "invalid CCI:%d state %d",
+			cci_dev->soc_info.index, cci_dev->cci_state);
+		return -EINVAL;
+	}
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+			|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "Invalid I2C master addr");
+		return -EINVAL;
+	}
+
+	master = c_ctrl->cci_info->cci_i2c_master;
+	read_cfg = &c_ctrl->cfg.cci_i2c_read_cfg;
+	if ((!read_cfg->num_byte) || (read_cfg->num_byte > CCI_I2C_MAX_READ)) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d read num bytes 0",
+			cci_dev->soc_info.index, master);
+		rc = -EINVAL;
+		goto ERROR;
+	}
+
+	reinit_completion(&cci_dev->cci_master_info[master].rd_done);
+	read_bytes = read_cfg->num_byte;
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d Bytes to read %u",
+		cci_dev->soc_info.index, master, read_bytes);
+	do {
+		if (read_bytes >= CCI_READ_MAX_V_1_2)
+			read_cfg->num_byte = CCI_READ_MAX_V_1_2;
+		else
+			read_cfg->num_byte = read_bytes;
+
+		cci_dev->is_burst_read[master] = false;
+		rc = cam_cci_read(sd, c_ctrl);
+		if (rc) {
+			if (cci_dev->is_probing)
+				CAM_INFO(CAM_CCI, "CCI%d_I2C_M%d failed to read rc: %d",
+					cci_dev->soc_info.index, master, rc);
+			else
+				CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d failed to read rc: %d",
+					cci_dev->soc_info.index, master, rc);
+			goto ERROR;
+		}
+
+		if (read_bytes >= CCI_READ_MAX_V_1_2) {
+			read_cfg->addr += CCI_READ_MAX_V_1_2;
+			read_cfg->data += CCI_READ_MAX_V_1_2;
+			read_bytes -= CCI_READ_MAX_V_1_2;
+		} else {
+			read_bytes = 0;
+		}
+	} while (read_bytes);
+
+ERROR:
+	return rc;
+}
+
+static int32_t cam_cci_read_bytes(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev = NULL;
+	enum cci_i2c_master_t master;
+	struct cam_cci_read_cfg *read_cfg = NULL;
+	uint16_t read_bytes = 0;
+
+	if (!sd || !c_ctrl) {
+		CAM_ERR(CAM_CCI, "Invalid arg sd %pK c_ctrl %pK",
+			sd, c_ctrl);
+		return -EINVAL;
+	}
+	if (!c_ctrl->cci_info) {
+		CAM_ERR(CAM_CCI, "cci_info NULL");
+		return -EINVAL;
+	}
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+	if (cci_dev->cci_state != CCI_STATE_ENABLED) {
+		CAM_ERR(CAM_CCI, "invalid CCI:%d state %d",
+			cci_dev->soc_info.index, cci_dev->cci_state);
+		return -EINVAL;
+	}
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+			|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "Invalid I2C master addr");
+		return -EINVAL;
+	}
+
+	cci_dev->is_probing = c_ctrl->is_probing;
+
+	master = c_ctrl->cci_info->cci_i2c_master;
+	read_cfg = &c_ctrl->cfg.cci_i2c_read_cfg;
+	if ((!read_cfg->num_byte) || (read_cfg->num_byte > CCI_I2C_MAX_READ)) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d read num bytes 0",
+			cci_dev->soc_info.index, master);
+		rc = -EINVAL;
+		goto ERROR;
+	}
+
+	read_bytes = read_cfg->num_byte;
+
+	/*
+	 * To avoid any conflicts due to back to back trigger of
+	 * THRESHOLD irq's, we reinit the threshold wait before
+	 * we load the burst read cmd.
+	 */
+	mutex_lock(&cci_dev->cci_master_info[master].mutex_q[QUEUE_1]);
+	reinit_completion(&cci_dev->cci_master_info[master].rd_done);
+	reinit_completion(&cci_dev->cci_master_info[master].th_complete);
+	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[QUEUE_1]);
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d Bytes to read %u",
+		cci_dev->soc_info.index, master, read_bytes);
+	do {
+		if (read_bytes >= CCI_I2C_MAX_BYTE_COUNT)
+			read_cfg->num_byte = CCI_I2C_MAX_BYTE_COUNT;
+		else
+			read_cfg->num_byte = read_bytes;
+
+		if (read_cfg->num_byte >= CCI_READ_MAX) {
+			rc = cam_cci_burst_read(sd, c_ctrl);
+		} else {
+			rc = cam_cci_read(sd, c_ctrl);
+		}
+		if (rc) {
+			if (cci_dev->is_probing)
+				CAM_INFO(CAM_CCI, "CCI%d_I2C_M%d Failed to read rc:%d",
+					cci_dev->soc_info.index, master, rc);
+			else
+				CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Failed to read rc:%d",
+					cci_dev->soc_info.index, master, rc);
+			goto ERROR;
+		}
+
+		if (read_bytes >= CCI_I2C_MAX_BYTE_COUNT) {
+			read_cfg->addr += (CCI_I2C_MAX_BYTE_COUNT /
+				read_cfg->data_type);
+			read_cfg->data += CCI_I2C_MAX_BYTE_COUNT;
+			read_bytes -= CCI_I2C_MAX_BYTE_COUNT;
+		} else {
+			read_bytes = 0;
+		}
+	} while (read_bytes);
+
+ERROR:
+	return rc;
+}
+
+static int32_t cam_cci_i2c_set_sync_prms(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev || !c_ctrl) {
+		CAM_ERR(CAM_CCI,
+			"Failed: invalid params cci_dev:%pK, c_ctrl:%pK",
+			cci_dev, c_ctrl);
+		rc = -EINVAL;
+		return rc;
+	}
+	cci_dev->cci_wait_sync_cfg = c_ctrl->cfg.cci_wait_sync_cfg;
+	cci_dev->valid_sync = cci_dev->cci_wait_sync_cfg.csid < 0 ? 0 : 1;
+
+	return rc;
+}
+
+static int32_t cam_cci_release(struct v4l2_subdev *sd,
+	enum cci_i2c_master_t master)
+{
+	uint8_t rc = 0;
+	struct cci_device *cci_dev;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+
+	rc = cam_cci_soc_release(cci_dev, master);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Failed in releasing the rc: %d",
+			cci_dev->soc_info.index, master, rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int32_t cam_cci_write(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev;
+	enum cci_i2c_master_t master;
+	struct cam_cci_master_info *cci_master_info;
+	uint32_t i;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev || !c_ctrl) {
+		CAM_ERR(CAM_CCI,
+			"Failed: invalid params cci_dev:%pK, c_ctrl:%pK",
+			cci_dev, c_ctrl);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	master = c_ctrl->cci_info->cci_i2c_master;
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+		|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Invalid I2C master addr", cci_dev->soc_info.index, master);
+		return -EINVAL;
+	}
+
+	cci_master_info = &cci_dev->cci_master_info[master];
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d ctrl_cmd = %d", cci_dev->soc_info.index, master, c_ctrl->cmd);
+
+	switch (c_ctrl->cmd) {
+	case MSM_CCI_I2C_WRITE_SYNC_BLOCK:
+		mutex_lock(&cci_master_info->mutex_q[SYNC_QUEUE]);
+		rc = cam_cci_i2c_write(sd, c_ctrl,
+			SYNC_QUEUE, MSM_SYNC_ENABLE);
+		mutex_unlock(&cci_master_info->mutex_q[SYNC_QUEUE]);
+		break;
+	case MSM_CCI_I2C_WRITE_SYNC:
+		rc = cam_cci_i2c_write_async(sd, c_ctrl,
+			SYNC_QUEUE, MSM_SYNC_ENABLE);
+		break;
+	case MSM_CCI_I2C_WRITE:
+		for (i = 0; i < NUM_QUEUES; i++) {
+			if (mutex_trylock(&cci_master_info->mutex_q[i])) {
+				rc = cam_cci_i2c_write(sd, c_ctrl, i,
+					MSM_SYNC_DISABLE);
+				mutex_unlock(&cci_master_info->mutex_q[i]);
+				return rc;
+			}
+		}
+		mutex_lock(&cci_master_info->mutex_q[PRIORITY_QUEUE]);
+		rc = cam_cci_i2c_write(sd, c_ctrl,
+			PRIORITY_QUEUE, MSM_SYNC_DISABLE);
+		mutex_unlock(&cci_master_info->mutex_q[PRIORITY_QUEUE]);
+		break;
+	case MSM_CCI_I2C_WRITE_SEQ:
+	case MSM_CCI_I2C_WRITE_BURST:
+		mutex_lock(&cci_master_info->mutex_q[PRIORITY_QUEUE]);
+		rc = cam_cci_i2c_write(sd, c_ctrl,
+			PRIORITY_QUEUE, MSM_SYNC_DISABLE);
+		mutex_unlock(&cci_master_info->mutex_q[PRIORITY_QUEUE]);
+		break;
+	case MSM_CCI_I2C_WRITE_ASYNC:
+		rc = cam_cci_i2c_write_async(sd, c_ctrl,
+			PRIORITY_QUEUE, MSM_SYNC_DISABLE);
+		break;
+	default:
+		rc = -ENOIOCTLCMD;
+	}
+
+	return rc;
+}
+
+static uint32_t cam_cci_read_append_write_modify_bits(
+	uint32_t rd_value, uint32_t mask, uint32_t new_bits)
+{
+	CAM_DBG(CAM_CCI, "Input Args reg=0x%x, mask=0x%x, value=0x%x",
+		rd_value, mask, new_bits);
+	rd_value &= ~mask;
+	rd_value |= (new_bits & mask);
+	CAM_DBG(CAM_CCI, "Output=0x%x", rd_value);
+	return rd_value;
+}
+
+static int cam_cci_read_append_write(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *cci_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev = NULL;
+	enum cci_i2c_master_t master;
+	enum camera_sensor_i2c_type data_type;
+	struct cam_cci_ctrl rd_ctrl;
+	struct cam_cci_master_info *cci_master_info;
+	uint32_t i;
+	unsigned char buf[CAMERA_SENSOR_I2C_TYPE_DWORD];
+	uint32_t rd_data;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev || !cci_ctrl) {
+		CAM_ERR(CAM_CCI,
+			"Failed: invalid params cci_dev:%pK, c_ctrl:%pK",
+			cci_dev, cci_ctrl);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	master = cci_ctrl->cci_info->cci_i2c_master;
+
+	if (cci_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+		|| cci_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Invalid I2C master addr",
+			cci_dev->soc_info.index, master);
+		return -EINVAL;
+	}
+
+	cci_master_info = &cci_dev->cci_master_info[master];
+
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d ctrl_cmd = %d",
+		cci_dev->soc_info.index, master, cci_ctrl->cmd);
+
+	rd_ctrl.cmd = cci_ctrl->cmd;
+	rd_ctrl.cci_info = cci_ctrl->cci_info;
+	rd_ctrl.cfg.cci_i2c_read_cfg.addr =
+		cci_ctrl->cfg.cci_i2c_write_cfg.reg_setting->reg_addr;
+	rd_ctrl.cfg.cci_i2c_read_cfg.addr_type =
+		cci_ctrl->cfg.cci_i2c_write_cfg.addr_type;
+	rd_ctrl.cfg.cci_i2c_read_cfg.data_type =
+		cci_ctrl->cfg.cci_i2c_write_cfg.data_type;
+	rd_ctrl.cfg.cci_i2c_read_cfg.data = buf;
+	rd_ctrl.cfg.cci_i2c_read_cfg.num_byte =
+		cci_ctrl->cfg.cci_i2c_write_cfg.data_type;
+
+	data_type = rd_ctrl.cfg.cci_i2c_read_cfg.data_type;
+
+	rc = cam_cci_read_bytes(sd, &rd_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_CCI, "Read failed, rc: %d", rc);
+		goto exit;
+	}
+
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE)
+		rd_data = buf[0];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD)
+		rd_data = buf[0] << 8 | buf[1];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B)
+		rd_data = buf[0] << 16 | buf[1] << 8 | buf[2];
+	else
+		rd_data = buf[0] << 24 | buf[1] << 16 |
+			buf[2] << 8 | buf[3];
+
+	CAM_DBG(CAM_CCI, "CCI read_data: 0x%x", rd_data);
+	CAM_DBG(CAM_CCI, "User reg_data before: 0x%x",
+		cci_ctrl->cfg.cci_i2c_write_cfg.reg_setting->reg_data);
+
+	cci_ctrl->cfg.cci_i2c_write_cfg.reg_setting->reg_data =
+		cam_cci_read_append_write_modify_bits(rd_data,
+			cci_ctrl->cfg.cci_i2c_write_cfg.reg_setting->data_mask,
+            cci_ctrl->cfg.cci_i2c_write_cfg.reg_setting->reg_data);
+
+	CAM_DBG(CAM_CCI, "User reg_data after: 0x%x",
+		cci_ctrl->cfg.cci_i2c_write_cfg.reg_setting->reg_data);
+
+	mutex_lock(&cci_master_info->mutex_q[SYNC_QUEUE]);
+	rc = cam_cci_i2c_write(sd, cci_ctrl,
+		SYNC_QUEUE, MSM_SYNC_DISABLE);
+	mutex_unlock(&cci_master_info->mutex_q[SYNC_QUEUE]);
+
+exit:
+	return rc;
+}
+
+int32_t cam_cci_core_cfg(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *cci_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev = NULL;
+	enum cci_i2c_master_t master = MASTER_MAX;
+
+	if (!sd) {
+		CAM_ERR(CAM_CCI, "SD IS NULL");
+		return -EINVAL;
+	}
+
+	if (!cci_ctrl) {
+		CAM_ERR(CAM_CCI, "CCI_CTRL IS NULL");
+		return -EINVAL;
+	}
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "CCI_DEV is null");
+		return -EINVAL;
+	}
+
+	if (!cci_ctrl || !cci_ctrl->cci_info) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d CCI_CTRL OR CCI_INFO IS NULL",
+			cci_dev->soc_info.index, master);
+		return -EINVAL;
+	}
+
+	master = cci_ctrl->cci_info->cci_i2c_master;
+	if (master >= MASTER_MAX) {
+		CAM_ERR(CAM_CCI, "INVALID MASTER: %d", master);
+		return -EINVAL;
+	}
+
+	if ((cci_dev->cci_master_info[master].status < 0) && (cci_ctrl->cmd != MSM_CCI_RELEASE)) {
+		CAM_WARN(CAM_CCI, "CCI hardware is resetting");
+		return -EAGAIN;
+	}
+	cci_dev->is_probing = false;
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d cmd = %d", cci_dev->soc_info.index, master, cci_ctrl->cmd);
+
+	rc = cam_cci_process_master_lock(cci_ctrl, cci_dev, TRUE, FALSE);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "MASTER lock state check failed for master: %d for cmd=%d", master, cci_ctrl->cmd);
+		return -EINVAL;
+	}
+
+	switch (cci_ctrl->cmd) {
+	case MSM_CCI_INIT:
+		mutex_lock(&cci_dev->init_mutex);
+		rc = cam_cci_init(sd, cci_ctrl);
+		mutex_unlock(&cci_dev->init_mutex);
+		break;
+	case MSM_CCI_RELEASE:
+		mutex_lock(&cci_dev->init_mutex);
+		rc = cam_cci_release(sd, master);
+		mutex_unlock(&cci_dev->init_mutex);
+		break;
+	case MSM_CCI_I2C_READ:
+		/*
+		 * CCI version 1.2 does not support burst read
+		 * due to the absence of the read threshold register
+		 */
+		if (cci_dev->hw_version == CCI_VERSION_1_2_9) {
+			CAM_DBG(CAM_CCI, "cci-v1.2 no burst read");
+			rc = cam_cci_read_bytes_v_1_2(sd, cci_ctrl);
+		} else {
+			rc = cam_cci_read_bytes(sd, cci_ctrl);
+		}
+		break;
+	case MSM_CCI_I2C_WRITE:
+	case MSM_CCI_I2C_WRITE_SEQ:
+	case MSM_CCI_I2C_WRITE_BURST:
+	case MSM_CCI_I2C_WRITE_SYNC:
+	case MSM_CCI_I2C_WRITE_ASYNC:
+	case MSM_CCI_I2C_WRITE_SYNC_BLOCK:
+		rc = cam_cci_write(sd, cci_ctrl);
+		break;
+	case MSM_CCI_GPIO_WRITE:
+		break;
+	case MSM_CCI_SET_SYNC_CID:
+		rc = cam_cci_i2c_set_sync_prms(sd, cci_ctrl);
+		break;
+	case MSM_CCI_I2C_READ_APPEND_WRITE:
+		rc = cam_cci_read_append_write(sd, cci_ctrl);
+		break;
+	case MSM_CCI_I2C_SEQUENTIAL_XFER_LOCK:
+	case MSM_CCI_I2C_SEQUENTIAL_XFER_UNLOCK:
+		break;
+	default:
+		rc = -ENOIOCTLCMD;
+	}
+
+	cci_ctrl->status = rc;
+	rc = cam_cci_process_master_lock(cci_ctrl, cci_dev, FALSE, FALSE);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "MASTER state check last failed for master: %d with cci status=%d for cmd=%d",
+			master, cci_ctrl->status, cci_ctrl->cmd);
+		return -EINVAL;
+	}
+	if (cci_ctrl->status) {
+		CAM_ERR(CAM_CCI, "cci status=%d for cmd=%d has failed so force unblock to avoid deadlock",
+			cci_ctrl->status, cci_ctrl->cmd);
+		rc = cam_cci_process_master_lock(cci_ctrl, cci_dev, TRUE, TRUE);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI, "MASTER state check last failed for master: %d with cci status=%d for cmd=%d",
+				master, cci_ctrl->status, cci_ctrl->cmd);
+			return -EINVAL;
+		}
+	}
+
+	return cci_ctrl->status;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_core.h
@@ -0,0 +1,60 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAM_CCI_CORE_H_
+#define _CAM_CCI_CORE_H_
+
+#include <linux/irqreturn.h>
+#include <media/cam_sensor.h>
+#include "cam_cci_dev.h"
+#include "cam_cci_soc.h"
+
+/**
+ * @cci_dev: CCI device structure
+ * @c_ctrl: CCI control structure
+ *
+ * This API gets CCI clk rates
+ */
+void cam_cci_get_clk_rates(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl);
+
+/**
+ * @sd: V4L2 sub device
+ * @c_ctrl: CCI control structure
+ *
+ * This API handles I2C operations for CCI
+ */
+int32_t cam_cci_core_cfg(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *cci_ctrl);
+
+/**
+ * @irq_num: IRQ number
+ * @data: CCI private structure
+ *
+ * This API handles CCI IRQs
+ */
+irqreturn_t cam_cci_irq(int irq_num, void *data);
+
+/**
+ * @irq_num: IRQ number
+ * @data: CCI private structure
+ *
+ * This API handles CCI Threaded IRQs
+ */
+irqreturn_t cam_cci_threaded_irq(int irq_num, void *data);
+
+/**
+ * @cci_dev: CCI device structure
+ * @master: CCI master index
+ * @queue: CCI master Queue index
+ * @triggerHalfQueue: Flag to execute FULL/HALF Queue
+ *
+ * This API handles I2C operations for CCI
+ */
+int32_t cam_cci_data_queue_burst_apply(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master, enum cci_i2c_queue_t queue,
+	uint32_t triggerHalfQueue);
+
+#endif /* _CAM_CCI_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_dev.c
@@ -0,0 +1,872 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cci_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_cci_soc.h"
+#include "cam_cci_core.h"
+#include "camera_main.h"
+#include "uapi/linux/sched/types.h"
+#include "linux/sched/types.h"
+#include "linux/sched.h"
+
+#define CCI_MAX_DELAY 1000000
+#define QUEUE_SIZE 100
+
+struct cci_irq_data {
+	int32_t  is_valid;
+	uint32_t irq_status0;
+	uint32_t irq_status1;
+	enum cci_i2c_master_t master;
+	enum cci_i2c_queue_t queue;
+};
+
+static struct v4l2_subdev *g_cci_subdev[MAX_CCI] = { 0 };
+static struct dentry *debugfs_root;
+static struct cci_irq_data cci_irq_queue[QUEUE_SIZE] = { 0 };
+static int32_t head;
+static int32_t tail;
+
+static inline int32_t increment_index(int32_t index)
+{
+	return (index + 1) % QUEUE_SIZE;
+}
+
+struct v4l2_subdev *cam_cci_get_subdev(int cci_dev_index)
+{
+	struct v4l2_subdev *sub_device = NULL;
+
+	if ((cci_dev_index < MAX_CCI) && (g_cci_subdev[cci_dev_index] != NULL))
+		sub_device = g_cci_subdev[cci_dev_index];
+	else
+		CAM_WARN(CAM_CCI, "CCI subdev not available at Index: %u, MAX_CCI : %u",
+			cci_dev_index, MAX_CCI);
+
+	return sub_device;
+}
+
+static long cam_cci_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int32_t rc = 0;
+
+	if (arg == NULL) {
+		CAM_ERR(CAM_CCI, "Args is Null");
+		return -EINVAL;
+	}
+
+	switch (cmd) {
+	case VIDIOC_MSM_CCI_CFG:
+		rc = cam_cci_core_cfg(sd, arg);
+		break;
+	case VIDIOC_CAM_CONTROL:
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_CCI, "Invalid ioctl cmd: %d", cmd);
+		rc = -ENOIOCTLCMD;
+	}
+
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_cci_subdev_compat_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	return cam_cci_subdev_ioctl(sd, cmd, NULL);
+}
+#endif
+
+irqreturn_t cam_cci_irq(int irq_num, void *data)
+{
+	uint32_t irq_status0, irq_status1, reg_bmsk;
+	uint32_t irq_update_rd_done = 0;
+	struct cci_device *cci_dev = data;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	unsigned long flags;
+	bool rd_done_th_assert = false;
+	struct cam_cci_master_info *cci_master_info;
+	irqreturn_t rc = IRQ_HANDLED;
+	int32_t  next_head;
+
+	irq_status0 = cam_io_r_mb(base + CCI_IRQ_STATUS_0_ADDR);
+	irq_status1 = cam_io_r_mb(base + CCI_IRQ_STATUS_1_ADDR);
+	CAM_DBG(CAM_CCI,
+		"BASE: %p, irq0:%x irq1:%x",
+		base, irq_status0, irq_status1);
+
+	cam_io_w_mb(irq_status0, base + CCI_IRQ_CLEAR_0_ADDR);
+	cam_io_w_mb(irq_status1, base + CCI_IRQ_CLEAR_1_ADDR);
+
+	reg_bmsk = CCI_IRQ_MASK_1_RMSK;
+	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD) &&
+	!(irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK)) {
+		reg_bmsk &= ~CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		cci_dev->irqs_disabled |=
+			CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+
+	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD) &&
+	!(irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK)) {
+		reg_bmsk &= ~CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		cci_dev->irqs_disabled |=
+			CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+
+	if (reg_bmsk != CCI_IRQ_MASK_1_RMSK) {
+		cam_io_w_mb(reg_bmsk, base + CCI_IRQ_MASK_1_ADDR);
+		CAM_DBG(CAM_CCI, "Updating the reg mask for irq1: 0x%x",
+			reg_bmsk);
+	} else if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK ||
+		irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) {
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) {
+			spin_lock_irqsave(&cci_dev->lock_status, flags);
+			if (cci_dev->irqs_disabled &
+				CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD) {
+				irq_update_rd_done |=
+					CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+				cci_dev->irqs_disabled &=
+					~CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+			}
+			spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) {
+			spin_lock_irqsave(&cci_dev->lock_status, flags);
+			if (cci_dev->irqs_disabled &
+				CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD) {
+				irq_update_rd_done |=
+					CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+				cci_dev->irqs_disabled &=
+					~CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+			}
+			spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+		}
+	}
+
+	if (irq_update_rd_done != 0) {
+		irq_update_rd_done |= cam_io_r_mb(base + CCI_IRQ_MASK_1_ADDR);
+		cam_io_w_mb(irq_update_rd_done, base + CCI_IRQ_MASK_1_ADDR);
+	}
+
+	cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
+
+	if (irq_status0 & CCI_IRQ_STATUS_0_RST_DONE_ACK_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+		if (cci_dev->cci_master_info[MASTER_0].reset_pending == true) {
+			cci_master_info = &cci_dev->cci_master_info[MASTER_0];
+			cci_dev->cci_master_info[MASTER_0].reset_pending =
+				false;
+			if (!cci_master_info->status)
+				complete(&cci_master_info->reset_complete);
+
+			complete_all(&cci_master_info->rd_done);
+			complete_all(&cci_master_info->th_complete);
+		}
+		if (cci_dev->cci_master_info[MASTER_1].reset_pending == true) {
+			cci_master_info = &cci_dev->cci_master_info[MASTER_1];
+			cci_dev->cci_master_info[MASTER_1].reset_pending =
+				false;
+			if (!cci_master_info->status)
+				complete(&cci_master_info->reset_complete);
+
+			complete_all(&cci_master_info->rd_done);
+			complete_all(&cci_master_info->th_complete);
+		}
+	}
+
+	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) &&
+		(irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD)) {
+		cci_dev->cci_master_info[MASTER_0].status = 0;
+		rd_done_th_assert = true;
+		complete(&cci_dev->cci_master_info[MASTER_0].th_complete);
+		complete(&cci_dev->cci_master_info[MASTER_0].rd_done);
+	}
+	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) &&
+		(!rd_done_th_assert)) {
+		cci_dev->cci_master_info[MASTER_0].status = 0;
+		rd_done_th_assert = true;
+		if (cci_dev->is_burst_read[MASTER_0])
+			complete(
+			&cci_dev->cci_master_info[MASTER_0].th_complete);
+		complete(&cci_dev->cci_master_info[MASTER_0].rd_done);
+	}
+	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD) &&
+		(!rd_done_th_assert)) {
+		cci_dev->cci_master_info[MASTER_0].status = 0;
+		complete(&cci_dev->cci_master_info[MASTER_0].th_complete);
+	}
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_Q0_THRESHOLD)
+	{
+		cci_master_info = &cci_dev->cci_master_info[MASTER_1];
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		trace_cam_cci_burst(cci_dev->soc_info.index, 1, 0,
+			"th_irq honoured irq1",	irq_status1);
+		CAM_DBG(CAM_CCI, "CCI%d_M1_Q0: th_irq honoured irq1: 0x%x th_irq_ref_cnt: %d",
+			cci_dev->soc_info.index, irq_status1,
+			cci_master_info->th_irq_ref_cnt[QUEUE_0]);
+		if (cci_master_info->th_irq_ref_cnt[QUEUE_0] == 1) {
+			complete(&cci_master_info->th_burst_complete[QUEUE_0]);
+		} else {
+			// Decrement Threshold irq ref count
+			cci_master_info->th_irq_ref_cnt[QUEUE_0]--;
+			next_head = increment_index(head);
+			if (next_head == tail) {
+				CAM_ERR(CAM_CCI,
+					"CCI%d_M1_Q0 CPU Scheduing Issue: "
+					"Unable to process BURST",
+					cci_dev->soc_info.index);
+				rc = IRQ_NONE;
+			} else {
+				cci_irq_queue[head].irq_status0 = irq_status0;
+				cci_irq_queue[head].irq_status1 = irq_status1;
+				cci_irq_queue[head].master = MASTER_1;
+				cci_irq_queue[head].queue = QUEUE_0;
+				cci_irq_queue[head].is_valid = 1;
+				head = next_head;
+				// wake up Threaded irq Handler
+				rc = IRQ_WAKE_THREAD;
+			}
+		}
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_Q1_THRESHOLD)
+	{
+		cci_master_info = &cci_dev->cci_master_info[MASTER_1];
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		trace_cam_cci_burst(cci_dev->soc_info.index, 1, 1,
+			"th_irq honoured irq1",	irq_status1);
+		CAM_DBG(CAM_CCI,
+			"CCI%d_M1_Q1: th_irq honoured irq1: 0x%x th_irq_ref_cnt: %d",
+			cci_dev->soc_info.index, irq_status1,
+			cci_master_info->th_irq_ref_cnt[QUEUE_1]);
+		if (cci_master_info->th_irq_ref_cnt[QUEUE_1] == 1) {
+			complete(&cci_master_info->th_burst_complete[QUEUE_1]);
+		} else {
+			// Decrement Threshold irq ref count
+			cci_master_info->th_irq_ref_cnt[QUEUE_1]--;
+			next_head = increment_index(head);
+			if (next_head == tail) {
+				CAM_ERR(CAM_CCI,
+					"CCI%d_M1_Q0 CPU Scheduing Issue: "
+					"Unable to process BURST",
+					cci_dev->soc_info.index);
+				rc = IRQ_NONE;
+			} else {
+				cci_irq_queue[head].irq_status0 = irq_status0;
+				cci_irq_queue[head].irq_status1 = irq_status1;
+				cci_irq_queue[head].master = MASTER_1;
+				cci_irq_queue[head].queue = QUEUE_1;
+				cci_irq_queue[head].is_valid = 1;
+				head = next_head;
+				// wake up Threaded irq Handler
+				rc = IRQ_WAKE_THREAD;
+			}
+		}
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_Q0_THRESHOLD)
+	{
+		cci_master_info = &cci_dev->cci_master_info[MASTER_0];
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		trace_cam_cci_burst(cci_dev->soc_info.index, 0, 0,
+			"th_irq honoured irq1",	irq_status1);
+		CAM_DBG(CAM_CCI,
+			"CCI%d_M0_Q0: th_irq honoured irq1: 0x%x th_irq_ref_cnt: %d",
+			cci_dev->soc_info.index, irq_status1,
+			cci_master_info->th_irq_ref_cnt[QUEUE_0]);
+		if (cci_master_info->th_irq_ref_cnt[QUEUE_0] == 1) {
+			complete(&cci_master_info->th_burst_complete[QUEUE_0]);
+		} else {
+			// Decrement Threshold irq ref count
+			cci_master_info->th_irq_ref_cnt[QUEUE_0]--;
+			next_head = increment_index(head);
+			if (next_head == tail) {
+				CAM_ERR(CAM_CCI,
+					"CCI%d_M1_Q0 CPU Scheduing Issue: "
+					"Unable to process BURST",
+					cci_dev->soc_info.index);
+				rc = IRQ_NONE;
+			} else {
+				cci_irq_queue[head].irq_status0 = irq_status0;
+				cci_irq_queue[head].irq_status1 = irq_status1;
+				cci_irq_queue[head].master = MASTER_0;
+				cci_irq_queue[head].queue = QUEUE_0;
+				cci_irq_queue[head].is_valid = 1;
+				head = next_head;
+				// wake up Threaded irq Handler
+				rc = IRQ_WAKE_THREAD;
+			}
+		}
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_Q1_THRESHOLD)
+	{
+		cci_master_info = &cci_dev->cci_master_info[MASTER_0];
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		trace_cam_cci_burst(cci_dev->soc_info.index, 0, 1,
+			"th_irq honoured irq1",	irq_status1);
+		CAM_DBG(CAM_CCI,
+			"CCI%d_M0_Q1: th_irq honoured irq1: 0x%x th_irq_ref_cnt: %d",
+			cci_dev->soc_info.index, irq_status1,
+			cci_master_info->th_irq_ref_cnt[QUEUE_1]);
+		if (cci_master_info->th_irq_ref_cnt[QUEUE_1] == 1) {
+			complete(&cci_master_info->th_burst_complete[QUEUE_1]);
+		} else {
+			// Decrement Threshold irq ref count
+			cci_master_info->th_irq_ref_cnt[QUEUE_1]--;
+			next_head = increment_index(head);
+			if (next_head == tail) {
+				CAM_ERR(CAM_CCI,
+					"CCI%d_M1_Q0 CPU Scheduing Issue: "
+					"Unable to process BURST",
+					cci_dev->soc_info.index);
+				rc = IRQ_NONE;
+			} else {
+				cci_irq_queue[head].irq_status0 = irq_status0;
+				cci_irq_queue[head].irq_status1 = irq_status1;
+				cci_irq_queue[head].master = MASTER_0;
+				cci_irq_queue[head].queue = QUEUE_1;
+				cci_irq_queue[head].is_valid = 1;
+				head = next_head;
+				// wake up Threaded irq Handler
+				rc = IRQ_WAKE_THREAD;
+			}
+		}
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0_REPORT_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+
+		cci_master_info = &cci_dev->cci_master_info[MASTER_0];
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[MASTER_0].lock_q[QUEUE_0],
+			flags);
+		atomic_set(&cci_master_info->q_free[QUEUE_0], 0);
+		cci_master_info->status = 0;
+		if (atomic_read(&cci_master_info->done_pending[QUEUE_0]) == 1) {
+			complete(&cci_master_info->report_q[QUEUE_0]);
+			atomic_set(&cci_master_info->done_pending[QUEUE_0], 0);
+		}
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[MASTER_0].lock_q[QUEUE_0],
+			flags);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q1_REPORT_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+
+		cci_master_info = &cci_dev->cci_master_info[MASTER_0];
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[MASTER_0].lock_q[QUEUE_1],
+			flags);
+		atomic_set(&cci_master_info->q_free[QUEUE_1], 0);
+		cci_master_info->status = 0;
+		if (atomic_read(&cci_master_info->done_pending[QUEUE_1]) == 1) {
+			complete(&cci_master_info->report_q[QUEUE_1]);
+			atomic_set(&cci_master_info->done_pending[QUEUE_1], 0);
+		}
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[MASTER_0].lock_q[QUEUE_1],
+			flags);
+	}
+	rd_done_th_assert = false;
+	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) &&
+		(irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD)) {
+		cci_dev->cci_master_info[MASTER_1].status = 0;
+		rd_done_th_assert = true;
+		complete(&cci_dev->cci_master_info[MASTER_1].th_complete);
+		complete(&cci_dev->cci_master_info[MASTER_1].rd_done);
+	}
+	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) &&
+		(!rd_done_th_assert)) {
+		cci_dev->cci_master_info[MASTER_1].status = 0;
+		rd_done_th_assert = true;
+		if (cci_dev->is_burst_read[MASTER_1])
+			complete(
+			&cci_dev->cci_master_info[MASTER_1].th_complete);
+		complete(&cci_dev->cci_master_info[MASTER_1].rd_done);
+	}
+	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD) &&
+		(!rd_done_th_assert)) {
+		cci_dev->cci_master_info[MASTER_1].status = 0;
+		complete(&cci_dev->cci_master_info[MASTER_1].th_complete);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0_REPORT_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+
+		cci_master_info = &cci_dev->cci_master_info[MASTER_1];
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_0],
+			flags);
+		atomic_set(&cci_master_info->q_free[QUEUE_0], 0);
+		cci_master_info->status = 0;
+		if (atomic_read(&cci_master_info->done_pending[QUEUE_0]) == 1) {
+			complete(&cci_master_info->report_q[QUEUE_0]);
+			atomic_set(&cci_master_info->done_pending[QUEUE_0], 0);
+		}
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_0],
+			flags);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q1_REPORT_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+
+		cci_master_info = &cci_dev->cci_master_info[MASTER_1];
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_1],
+			flags);
+		atomic_set(&cci_master_info->q_free[QUEUE_1], 0);
+		cci_master_info->status = 0;
+		if (atomic_read(&cci_master_info->done_pending[QUEUE_1]) == 1) {
+			complete(&cci_master_info->report_q[QUEUE_1]);
+			atomic_set(&cci_master_info->done_pending[QUEUE_1], 0);
+		}
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_1],
+			flags);
+	}
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_PAUSE)
+		CAM_DBG(CAM_CCI, "RD_PAUSE ON MASTER_0");
+
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_PAUSE)
+		CAM_DBG(CAM_CCI, "RD_PAUSE ON MASTER_1");
+
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_HALT_ACK_BMSK) {
+		cci_dev->cci_master_info[MASTER_0].reset_pending = true;
+		cam_io_w_mb(CCI_M0_RESET_RMSK,
+			base + CCI_RESET_CMD_ADDR);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0Q1_HALT_ACK_BMSK) {
+		cci_dev->cci_master_info[MASTER_1].reset_pending = true;
+		cam_io_w_mb(CCI_M1_RESET_RMSK,
+			base + CCI_RESET_CMD_ADDR);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_ERROR_BMSK) {
+		cci_dev->cci_master_info[MASTER_0].status = -EINVAL;
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0_NACK_ERROR_BMSK) {
+			if (cci_dev->is_probing) {
+				CAM_INFO(CAM_CCI,
+					"Base:%pK,cci: %d, M0_Q0 NACK ERROR: 0x%x",
+					base, cci_dev->soc_info.index, irq_status0);
+			} else {
+				CAM_ERR(CAM_CCI,
+					"Base:%pK,cci: %d, M0_Q0 NACK ERROR: 0x%x",
+					base, cci_dev->soc_info.index, irq_status0);
+				trace_cam_cci_burst(cci_dev->soc_info.index, 0, 0,
+					"NACK_ERROR irq0", irq_status0);
+			}
+			cam_cci_dump_registers(cci_dev, MASTER_0,
+					QUEUE_0);
+			if ((cci_dev->cci_master_info[MASTER_0].th_irq_ref_cnt[QUEUE_0]) > 0) {
+				complete_all(&cci_dev->cci_master_info[MASTER_0].
+					th_burst_complete[QUEUE_0]);
+			}
+			complete_all(&cci_dev->cci_master_info[MASTER_0]
+				.report_q[QUEUE_0]);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q1_NACK_ERROR_BMSK) {
+			if (cci_dev->is_probing) {
+				CAM_INFO(CAM_CCI,
+					"Base:%pK,cci: %d, M0_Q1 NACK ERROR: 0x%x",
+					base, cci_dev->soc_info.index, irq_status0);
+			} else {
+				CAM_ERR(CAM_CCI,
+					"Base:%pK,cci: %d, M0_Q1 NACK ERROR: 0x%x",
+					base, cci_dev->soc_info.index, irq_status0);
+				trace_cam_cci_burst(cci_dev->soc_info.index, 0, 1,
+					"NACK_ERROR irq0", irq_status0);
+			}
+			cam_cci_dump_registers(cci_dev, MASTER_0,
+					QUEUE_1);
+			if ((cci_dev->cci_master_info[MASTER_0].th_irq_ref_cnt[QUEUE_1]) > 0) {
+				complete_all(&cci_dev->cci_master_info[MASTER_0].
+					th_burst_complete[QUEUE_1]);
+			}
+			complete_all(&cci_dev->cci_master_info[MASTER_0]
+			.report_q[QUEUE_1]);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_ERROR_BMSK)
+			CAM_ERR(CAM_CCI,
+			"Base:%pK, cci: %d, M0 QUEUE_OVER/UNDER_FLOW OR CMD ERR: 0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_ERROR_BMSK)
+			CAM_ERR(CAM_CCI,
+				"Base: %pK, M0 RD_OVER/UNDER_FLOW ERROR: 0x%x",
+				base, irq_status0);
+
+		cci_dev->cci_master_info[MASTER_0].reset_pending = true;
+		cam_io_w_mb(CCI_M0_RESET_RMSK, base + CCI_RESET_CMD_ADDR);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_ERROR_BMSK) {
+		cci_dev->cci_master_info[MASTER_1].status = -EINVAL;
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0_NACK_ERROR_BMSK) {
+			if (cci_dev->is_probing) {
+				CAM_INFO(CAM_CCI,
+					"Base:%pK, cci: %d, M1_Q0 NACK ERROR: 0x%x",
+					base, cci_dev->soc_info.index, irq_status0);
+			} else {
+				CAM_ERR(CAM_CCI,
+					"Base:%pK, cci: %d, M1_Q0 NACK ERROR: 0x%x",
+					base, cci_dev->soc_info.index, irq_status0);
+				trace_cam_cci_burst(cci_dev->soc_info.index, 1, 0,
+					"NACK_ERROR irq0", irq_status0);
+			}
+			cam_cci_dump_registers(cci_dev, MASTER_1,
+					QUEUE_0);
+			if ((cci_dev->cci_master_info[MASTER_1].th_irq_ref_cnt[QUEUE_0]) > 0) {
+				complete_all(&cci_dev->cci_master_info[MASTER_1].
+					th_burst_complete[QUEUE_0]);
+			}
+			complete_all(&cci_dev->cci_master_info[MASTER_1]
+			.report_q[QUEUE_0]);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q1_NACK_ERROR_BMSK) {
+			if (cci_dev->is_probing) {
+				CAM_INFO(CAM_CCI,
+					"Base:%pK, cci: %d, M1_Q1 NACK ERROR: 0x%x",
+					base, cci_dev->soc_info.index, irq_status0);
+			} else {
+				CAM_ERR(CAM_CCI,
+					"Base:%pK, cci: %d, M1_Q1 NACK ERROR: 0x%x",
+					base, cci_dev->soc_info.index, irq_status0);
+				trace_cam_cci_burst(cci_dev->soc_info.index, 1, 1,
+					"NACK_ERROR irq0", irq_status0);
+			}
+			cam_cci_dump_registers(cci_dev, MASTER_1,
+				QUEUE_1);
+			if ((cci_dev->cci_master_info[MASTER_1].th_irq_ref_cnt[QUEUE_1]) > 0) {
+				complete_all(&cci_dev->cci_master_info[MASTER_1].
+					th_burst_complete[QUEUE_1]);
+			}
+			complete_all(&cci_dev->cci_master_info[MASTER_1]
+			.report_q[QUEUE_1]);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0Q1_ERROR_BMSK)
+			CAM_ERR(CAM_CCI,
+			"Base:%pK, cci: %d, M1 QUEUE_OVER_UNDER_FLOW OR CMD ERROR:0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_ERROR_BMSK)
+			CAM_ERR(CAM_CCI,
+				"Base:%pK, cci: %d, M1 RD_OVER/UNDER_FLOW ERROR: 0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+
+		cci_dev->cci_master_info[MASTER_1].reset_pending = true;
+		cam_io_w_mb(CCI_M1_RESET_RMSK, base + CCI_RESET_CMD_ADDR);
+	}
+
+	return rc;
+}
+
+irqreturn_t cam_cci_threaded_irq(int irq_num, void *data)
+{
+	struct cci_device *cci_dev = data;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	struct cci_irq_data cci_data;
+	unsigned long flags;
+	uint32_t triggerHalfQueue = 1;
+	struct task_struct *task = current;
+
+	CAM_INFO(CAM_CCI, "CCI%d: nice: %d rt-Priority: %d cci_dev: %p",
+		soc_info->index, task_nice(current), task->rt_priority, cci_dev);
+	spin_lock_irqsave(&cci_dev->lock_status, flags);
+	if (tail != head) {
+		cci_data = cci_irq_queue[tail];
+		tail = increment_index(tail);
+		/*
+		 * "head" and "tail" variables are shared across
+		 * Top half and Bottom Half routines, Hence place a
+		 * lock while accessing these variables.
+		 */
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+		cam_cci_data_queue_burst_apply(cci_dev,
+			cci_data.master, cci_data.queue, triggerHalfQueue);
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+	}
+	spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	return IRQ_HANDLED;
+}
+
+static int cam_cci_irq_routine(struct v4l2_subdev *sd, u32 status,
+	bool *handled)
+{
+	struct cci_device *cci_dev = NULL;
+	irqreturn_t ret;
+	struct cam_hw_soc_info *soc_info = NULL;
+
+	if (!sd) {
+		CAM_ERR(CAM_CCI, "Error No data in subdev");
+		return -EINVAL;
+	}
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+
+	soc_info = &cci_dev->soc_info;
+
+	ret = cam_cci_irq(soc_info->irq_num[0], cci_dev);
+	if (ret == IRQ_NONE)
+		CAM_ERR(CAM_CCI, "Interrupt was not handled properly, ret %d", ret);
+
+	*handled = true;
+	return 0;
+}
+
+static struct v4l2_subdev_core_ops cci_subdev_core_ops = {
+	.ioctl = cam_cci_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_cci_subdev_compat_ioctl,
+#endif
+	.interrupt_service_routine = cam_cci_irq_routine,
+};
+
+static const struct v4l2_subdev_ops cci_subdev_ops = {
+	.core = &cci_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cci_subdev_intern_ops;
+
+static int cam_cci_get_debug(void *data, u64 *val)
+{
+	struct cci_device *cci_dev = (struct cci_device *)data;
+
+	*val = cci_dev->dump_en;
+
+	return 0;
+}
+
+static int cam_cci_set_debug(void *data, u64 val)
+{
+	struct cci_device *cci_dev = (struct cci_device *)data;
+
+	cci_dev->dump_en = val;
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_cci_debug,
+	cam_cci_get_debug,
+	cam_cci_set_debug, "%16llu\n");
+
+static int cam_cci_create_debugfs_entry(struct cci_device *cci_dev)
+{
+	int rc = 0, idx;
+	struct dentry *dbgfileptr = NULL;
+	static char * const filename[] = { "en_dump_cci0", "en_dump_cci1",
+		"en_dump_cci2", "en_dump_cci3"};
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	if (!debugfs_root) {
+		rc = cam_debugfs_create_subdir("cci", &dbgfileptr);
+		if (rc) {
+			CAM_ERR(CAM_CCI, "debugfs directory creation fail");
+			return rc;
+		}
+		debugfs_root = dbgfileptr;
+	}
+
+	idx = cci_dev->soc_info.index;
+	if (idx >= ARRAY_SIZE(filename)) {
+		CAM_ERR(CAM_CCI, "cci-dev %d invalid", idx);
+		return -ENODEV;
+	}
+
+	debugfs_create_file(filename[idx], 0644, debugfs_root, cci_dev, &cam_cci_debug);
+
+	return 0;
+}
+
+static int cam_cci_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_cpas_register_params cpas_parms;
+	struct cci_device *new_cci_dev;
+	struct cam_hw_soc_info *soc_info = NULL;
+	int rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	new_cci_dev = devm_kzalloc(&pdev->dev, sizeof(struct cci_device),
+		GFP_KERNEL);
+	if (!new_cci_dev) {
+		CAM_ERR(CAM_CCI, "Memory allocation failed for cci_dev");
+		return -ENOMEM;
+	}
+	soc_info = &new_cci_dev->soc_info;
+
+	new_cci_dev->v4l2_dev_str.pdev = pdev;
+
+	soc_info->pdev = pdev;
+	soc_info->dev = &pdev->dev;
+	soc_info->dev_name = pdev->name;
+
+	rc = cam_cci_parse_dt_info(pdev, new_cci_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Resource get Failed rc:%d", rc);
+		goto cci_no_resource;
+	}
+
+	new_cci_dev->v4l2_dev_str.internal_ops =
+		&cci_subdev_intern_ops;
+	new_cci_dev->v4l2_dev_str.ops =
+		&cci_subdev_ops;
+	strscpy(new_cci_dev->device_name, CAMX_CCI_DEV_NAME,
+		sizeof(new_cci_dev->device_name));
+	new_cci_dev->v4l2_dev_str.name =
+		new_cci_dev->device_name;
+	new_cci_dev->v4l2_dev_str.sd_flags = V4L2_SUBDEV_FL_HAS_EVENTS;
+	new_cci_dev->v4l2_dev_str.ent_function =
+		CAM_CCI_DEVICE_TYPE;
+	new_cci_dev->v4l2_dev_str.token =
+		new_cci_dev;
+
+	rc = cam_register_subdev(&(new_cci_dev->v4l2_dev_str));
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Fail with cam_register_subdev rc: %d", rc);
+		goto cci_no_resource;
+	}
+
+	platform_set_drvdata(pdev, &(new_cci_dev->v4l2_dev_str.sd));
+	v4l2_set_subdevdata(&new_cci_dev->v4l2_dev_str.sd, new_cci_dev);
+	if (soc_info->index >= MAX_CCI) {
+		CAM_ERR(CAM_CCI, "Invalid index: %d max supported:%d",
+			soc_info->index, MAX_CCI-1);
+		goto cci_no_resource;
+	}
+
+	g_cci_subdev[soc_info->index] = &new_cci_dev->v4l2_dev_str.sd;
+	mutex_init(&(new_cci_dev->init_mutex));
+	CAM_DBG(CAM_CCI, "Device Type :%d", soc_info->index);
+
+	cpas_parms.cam_cpas_client_cb = NULL;
+	cpas_parms.cell_index = soc_info->index;
+	cpas_parms.dev = &pdev->dev;
+	cpas_parms.userdata = new_cci_dev;
+	strscpy(cpas_parms.identifier, "cci", CAM_HW_IDENTIFIER_LENGTH);
+	rc = cam_cpas_register_client(&cpas_parms);
+	if (rc) {
+		CAM_ERR(CAM_CCI, "CPAS registration failed rc:%d", rc);
+		goto cci_unregister_subdev;
+	}
+
+	CAM_DBG(CAM_CCI, "CPAS registration successful handle=%d",
+		cpas_parms.client_handle);
+	new_cci_dev->cpas_handle = cpas_parms.client_handle;
+
+	rc = cam_cci_create_debugfs_entry(new_cci_dev);
+	if (rc) {
+		CAM_WARN(CAM_CCI, "debugfs creation failed");
+		rc = 0;
+	}
+	head = 0;
+	tail = 0;
+	CAM_DBG(CAM_CCI, "Component bound successfully");
+	return rc;
+
+cci_unregister_subdev:
+	cam_unregister_subdev(&(new_cci_dev->v4l2_dev_str));
+cci_no_resource:
+	devm_kfree(&pdev->dev, new_cci_dev);
+	return rc;
+}
+
+static void cam_cci_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	struct v4l2_subdev *subdev = platform_get_drvdata(pdev);
+	struct cci_device *cci_dev = NULL;
+
+	if (!subdev) {
+		CAM_ERR(CAM_CCI, "Error No data in subdev");
+		return;
+	}
+
+	cci_dev = v4l2_get_subdevdata(subdev);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "Error No data in cci_dev");
+		return;
+	}
+
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return;
+	}
+
+	cam_cpas_unregister_client(cci_dev->cpas_handle);
+	debugfs_root = NULL;
+	cam_cci_soc_remove(pdev, cci_dev);
+	rc = cam_unregister_subdev(&(cci_dev->v4l2_dev_str));
+	if (rc < 0)
+		CAM_ERR(CAM_CCI, "Fail with cam_unregister_subdev. rc:%d", rc);
+
+	devm_kfree(&pdev->dev, cci_dev);
+}
+
+const static struct component_ops cam_cci_component_ops = {
+	.bind = cam_cci_component_bind,
+	.unbind = cam_cci_component_unbind,
+};
+
+static int cam_cci_platform_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CCI, "Adding CCI component");
+	rc = component_add(&pdev->dev, &cam_cci_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CCI, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_cci_device_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_cci_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_cci_dt_match[] = {
+	{.compatible = "qcom,cci"},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_cci_dt_match);
+
+struct platform_driver cci_driver = {
+	.probe = cam_cci_platform_probe,
+	.remove = cam_cci_device_remove,
+	.driver = {
+		.name = CAMX_CCI_DEV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_cci_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_cci_init_module(void)
+{
+	return platform_driver_register(&cci_driver);
+}
+
+void cam_cci_exit_module(void)
+{
+	platform_driver_unregister(&cci_driver);
+}
+
+MODULE_DESCRIPTION("MSM CCI driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_dev.h
@@ -0,0 +1,348 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CCI_DEV_H_
+#define _CAM_CCI_DEV_H_
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/of_platform.h>
+#include <linux/module.h>
+#include <linux/irqreturn.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/debugfs.h>
+#include <linux/platform_device.h>
+#include <linux/semaphore.h>
+#include <linux/wait.h>
+#include <media/cam_sensor.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_io_util.h>
+#include <cam_sensor_util.h>
+#include "cam_subdev.h"
+#include <cam_cpas_api.h>
+#include "cam_cci_hwreg.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+#define CCI_I2C_QUEUE_0_SIZE 128
+#define CCI_I2C_QUEUE_1_SIZE 32
+#define CCI_I2C_QUEUE_0_SIZE_V_1_2 64
+#define CCI_I2C_QUEUE_1_SIZE_V_1_2 16
+#define CYCLES_PER_MICRO_SEC_DEFAULT 4915
+#define CCI_MAX_DELAY 1000000
+
+#define CCI_TIMEOUT msecs_to_jiffies(1500)
+#define NUM_QUEUES 2
+
+#define MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11 11
+#define MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_WORDS ((MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11 + 1) / 4)
+#define BURST_MIN_FREE_SIZE 8
+
+/* Max bytes that can be read per CCI read transaction */
+#define CCI_READ_MAX 256
+#define CCI_READ_MAX_V_1_2 0xE
+#define CCI_I2C_READ_MAX_RETRIES 3
+#define CCI_I2C_MAX_READ 20480
+#define CCI_I2C_MAX_WRITE 20480
+#define CCI_ENABLE_THRESHOLD_IRQ 1
+#define CCI_I2C_MAX_BYTE_COUNT 65535
+
+#define CAMX_CCI_DEV_NAME "cam-cci-driver"
+
+#define CAM_CCI_WORKQUEUE_NAME "cam_cci_wq"
+
+#define MAX_CCI 4
+
+#define PRIORITY_QUEUE (QUEUE_0)
+#define SYNC_QUEUE (QUEUE_1)
+
+#define CAM_CCI_NACK_DUMP_EN      BIT(1)
+#define CAM_CCI_TIMEOUT_DUMP_EN   BIT(2)
+
+#define CCI_VERSION_1_2_9 0x10020009
+#define REPORT_IDSIZE 16
+enum cci_i2c_sync {
+	MSM_SYNC_DISABLE,
+	MSM_SYNC_ENABLE,
+};
+
+enum cam_cci_cmd_type {
+	MSM_CCI_INIT,
+	MSM_CCI_RELEASE,
+	MSM_CCI_SET_SID,
+	MSM_CCI_SET_FREQ,
+	MSM_CCI_SET_SYNC_CID,
+	MSM_CCI_I2C_READ,
+	MSM_CCI_I2C_WRITE,
+	MSM_CCI_I2C_WRITE_SEQ,
+	MSM_CCI_I2C_WRITE_BURST,
+	MSM_CCI_I2C_WRITE_ASYNC,
+	MSM_CCI_GPIO_WRITE,
+	MSM_CCI_I2C_WRITE_SYNC,
+	MSM_CCI_I2C_WRITE_SYNC_BLOCK,
+	MSM_CCI_I2C_READ_APPEND_WRITE,
+	MSM_CCI_I2C_SEQUENTIAL_XFER_LOCK,
+	MSM_CCI_I2C_SEQUENTIAL_XFER_UNLOCK
+};
+
+enum cci_i2c_queue_t {
+	QUEUE_0,
+	QUEUE_1,
+	QUEUE_INVALID,
+};
+
+struct cam_cci_wait_sync_cfg {
+	uint16_t cid;
+	int16_t csid;
+	uint16_t line;
+	uint16_t delay;
+};
+
+struct cam_cci_gpio_cfg {
+	uint16_t gpio_queue;
+	uint16_t i2c_queue;
+};
+
+struct cam_cci_read_cfg {
+	uint32_t addr;
+	uint16_t addr_type;
+	uint8_t *data;
+	uint16_t num_byte;
+	uint16_t data_type;
+};
+
+struct cam_cci_i2c_queue_info {
+	uint32_t max_queue_size;
+	uint32_t report_id;
+	uint32_t irq_en;
+	uint32_t capture_rep_data;
+};
+
+struct cam_cci_master_info {
+	int32_t status;
+	atomic_t q_free[NUM_QUEUES];
+	uint8_t q_lock[NUM_QUEUES];
+	uint8_t reset_pending;
+	struct mutex mutex;
+	struct completion reset_complete;
+	struct completion rd_done;
+	struct completion th_complete;
+	struct mutex mutex_q[NUM_QUEUES];
+	struct completion report_q[NUM_QUEUES];
+	atomic_t done_pending[NUM_QUEUES];
+	spinlock_t lock_q[NUM_QUEUES];
+	struct semaphore master_sem;
+	struct mutex freq_cnt_lock;
+	uint16_t freq_ref_cnt;
+	bool is_initilized;
+	struct completion th_burst_complete[NUM_QUEUES];
+	uint32_t th_irq_ref_cnt[NUM_QUEUES];
+	bool is_burst_enable[NUM_QUEUES];
+	uint32_t num_words_exec[NUM_QUEUES];
+	uint32_t *data_queue[NUM_QUEUES];
+	uint32_t num_words_in_data_queue[NUM_QUEUES];
+	int32_t data_queue_start_index[NUM_QUEUES];
+	int32_t half_queue_mark[NUM_QUEUES];
+	struct mutex master_lock_mutex;
+	bool is_master_locked;
+	bool is_read_append_locked;
+	wait_queue_head_t lock_wait;
+	uint16_t master_usage_cnt;
+};
+
+struct cam_cci_clk_params_t {
+	uint16_t hw_thigh;
+	uint16_t hw_tlow;
+	uint16_t hw_tsu_sto;
+	uint16_t hw_tsu_sta;
+	uint16_t hw_thd_dat;
+	uint16_t hw_thd_sta;
+	uint16_t hw_tbuf;
+	uint8_t hw_scl_stretch_en;
+	uint8_t hw_trdhld;
+	uint8_t hw_tsp;
+	uint32_t cci_clk_src;
+};
+
+enum cam_cci_state_t {
+	CCI_STATE_ENABLED,
+	CCI_STATE_DISABLED,
+};
+
+/**
+ * struct cci_device
+ * @pdev:                       Platform device
+ * @subdev:                     V4L2 sub device
+ * @base:                       Base address of CCI device
+ * @hw_version:                 Hardware version
+ * @ref_count:                  Reference Count
+ * @cci_state:                  CCI state machine
+ * @num_clk:                    Number of CCI clock
+ * @cci_clk:                    CCI clock structure
+ * @cci_clk_info:               CCI clock information
+ * @cam_cci_i2c_queue_info:     CCI queue information
+ * @i2c_freq_mode:              I2C frequency of operations
+ * @master_active_slave:        Number of active/connected slaves for master
+ * @cci_clk_params:             CCI hw clk params
+ * @cci_gpio_tbl:               CCI GPIO table
+ * @cci_gpio_tbl_size:          GPIO table size
+ * @cci_pinctrl:                Pinctrl structure
+ * @cci_pinctrl_status:         CCI pinctrl status
+ * @cci_clk_src:                CCI clk src rate
+ * @cci_vreg:                   CCI regulator structure
+ * @cci_reg_ptr:                CCI individual regulator structure
+ * @regulator_count:            Regulator count
+ * @support_seq_write:          Set this flag when sequential write is enabled
+ * @write_wq:                   Work queue structure
+ * @valid_sync:                 Is it a valid sync with CSID
+ * @v4l2_dev_str:               V4L2 device structure
+ * @cci_wait_sync_cfg:          CCI sync config
+ * @cycles_per_us:              Cycles per micro sec
+ * @payload_size:               CCI packet payload size
+ * @irq_status1:                Store irq_status1 to be cleared after
+ *                              draining FIFO buffer for burst read
+ * @lock_status:                to protect changes to irq_status1
+ * @is_burst_read:              Flag to determine if we are performing
+ *                              a burst read operation or not
+ * @irqs_disabled:              Mask for IRQs that are disabled
+ * @init_mutex:                 Mutex for maintaining refcount for attached
+ *                              devices to cci during init/deinit.
+ * @dump_en:                    To enable the selective dump
+ * @is_probing:                 Flag to determine if we are probing a sensor
+ */
+struct cci_device {
+	struct v4l2_subdev subdev;
+	struct cam_hw_soc_info soc_info;
+	uint32_t hw_version;
+	uint8_t ref_count;
+	enum cam_cci_state_t cci_state;
+	struct cam_cci_i2c_queue_info
+		cci_i2c_queue_info[MASTER_MAX][NUM_QUEUES];
+	struct cam_cci_master_info cci_master_info[MASTER_MAX];
+	enum i2c_freq_mode i2c_freq_mode[MASTER_MAX];
+	uint8_t master_active_slave[MASTER_MAX];
+	struct cam_cci_clk_params_t cci_clk_params[I2C_MAX_MODES];
+	struct msm_pinctrl_info cci_pinctrl;
+	uint8_t cci_pinctrl_status;
+	uint8_t support_seq_write;
+	struct workqueue_struct *write_wq[MASTER_MAX];
+	struct cam_cci_wait_sync_cfg cci_wait_sync_cfg;
+	uint8_t valid_sync;
+	struct cam_subdev v4l2_dev_str;
+	uint32_t cycles_per_us;
+	int32_t clk_level_index;
+	uint8_t payload_size;
+	char device_name[20];
+	uint32_t cpas_handle;
+	uint32_t irq_status1;
+	spinlock_t lock_status;
+	bool is_burst_read[MASTER_MAX];
+	uint32_t irqs_disabled;
+	struct mutex init_mutex;
+	uint64_t  dump_en;
+	bool is_probing;
+};
+
+enum cam_cci_i2c_cmd_type {
+	CCI_I2C_SET_PARAM_CMD = 1,
+	CCI_I2C_WAIT_CMD,
+	CCI_I2C_WAIT_SYNC_CMD,
+	CCI_I2C_WAIT_GPIO_EVENT_CMD,
+	CCI_I2C_TRIG_I2C_EVENT_CMD,
+	CCI_I2C_LOCK_CMD,
+	CCI_I2C_UNLOCK_CMD,
+	CCI_I2C_REPORT_CMD,
+	CCI_I2C_WRITE_CMD,
+	CCI_I2C_READ_CMD,
+	CCI_I2C_WRITE_DISABLE_P_CMD,
+	CCI_I2C_READ_DISABLE_P_CMD,
+	CCI_I2C_WRITE_CMD2,
+	CCI_I2C_WRITE_CMD3,
+	CCI_I2C_REPEAT_CMD,
+	CCI_I2C_INVALID_CMD,
+};
+
+enum cam_cci_gpio_cmd_type {
+	CCI_GPIO_SET_PARAM_CMD = 1,
+	CCI_GPIO_WAIT_CMD,
+	CCI_GPIO_WAIT_SYNC_CMD,
+	CCI_GPIO_WAIT_GPIO_IN_EVENT_CMD,
+	CCI_GPIO_WAIT_I2C_Q_TRIG_EVENT_CMD,
+	CCI_GPIO_OUT_CMD,
+	CCI_GPIO_TRIG_EVENT_CMD,
+	CCI_GPIO_REPORT_CMD,
+	CCI_GPIO_REPEAT_CMD,
+	CCI_GPIO_CONTINUE_CMD,
+	CCI_GPIO_INVALID_CMD,
+};
+
+struct cam_sensor_cci_client {
+	struct v4l2_subdev *cci_subdev;
+	uint32_t freq;
+	enum i2c_freq_mode i2c_freq_mode;
+	enum cci_i2c_master_t cci_i2c_master;
+	uint16_t sid;
+	uint16_t cid;
+	uint32_t timeout;
+	uint16_t retries;
+	uint16_t id_map;
+	uint16_t cci_device;
+	bool is_probing;
+	bool is_master_owned;
+};
+
+struct cam_cci_ctrl {
+	int32_t status;
+	struct cam_sensor_cci_client *cci_info;
+	enum cam_cci_cmd_type cmd;
+	union {
+		struct cam_sensor_i2c_reg_setting cci_i2c_write_cfg;
+		struct cam_cci_read_cfg cci_i2c_read_cfg;
+		struct cam_cci_wait_sync_cfg cci_wait_sync_cfg;
+		struct cam_cci_gpio_cfg gpio_cfg;
+	} cfg;
+	bool is_probing;
+};
+
+struct cci_write_async {
+	struct cci_device *cci_dev;
+	struct cam_cci_ctrl c_ctrl;
+	enum cci_i2c_queue_t queue;
+	struct work_struct work;
+	ktime_t workq_scheduled_ts;
+	enum cci_i2c_sync sync_en;
+};
+
+irqreturn_t cam_cci_irq(int irq_num, void *data);
+irqreturn_t cam_cci_threaded_irq(int irq_num, void *data);
+
+struct v4l2_subdev *cam_cci_get_subdev(int cci_dev_index);
+void cam_cci_dump_registers(struct cci_device *cci_dev,
+		enum cci_i2c_master_t master, enum cci_i2c_queue_t queue);
+
+/**
+ * @brief : API to register CCI hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_cci_init_module(void);
+
+/**
+ * @brief : API to remove CCI Hw from platform framework.
+ */
+void cam_cci_exit_module(void);
+#define VIDIOC_MSM_CCI_CFG \
+	_IOWR('V', BASE_VIDIOC_PRIVATE + 23, struct cam_cci_ctrl)
+
+#endif /* _CAM_CCI_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_hwreg.h
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2015, 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CCI_HWREG_
+#define _CAM_CCI_HWREG_
+
+#define CCI_HW_VERSION_ADDR                                         0x00000000
+#define CCI_RESET_CMD_ADDR                                          0x00000004
+#define CCI_RESET_CMD_RMSK                                          0x0f73f3f7
+#define CCI_M0_RESET_RMSK                                                0x3F1
+#define CCI_M1_RESET_RMSK                                              0x3F001
+#define CCI_QUEUE_START_ADDR                                        0x00000008
+#define CCI_SET_CID_SYNC_TIMER_ADDR                                 0x00000010
+#define CCI_SET_CID_SYNC_TIMER_OFFSET                               0x00000004
+#define CCI_I2C_M0_SCL_CTL_ADDR                                     0x00000100
+#define CCI_I2C_M0_SDA_CTL_0_ADDR                                   0x00000104
+#define CCI_I2C_M0_SDA_CTL_1_ADDR                                   0x00000108
+#define CCI_I2C_M0_SDA_CTL_2_ADDR                                   0x0000010c
+#define CCI_I2C_M0_READ_DATA_ADDR                                   0x00000118
+#define CCI_I2C_M0_MISC_CTL_ADDR                                    0x00000110
+#define CCI_I2C_M0_STATUS_ADDR                                      0x00000114
+#define CCI_I2C_M0_READ_BUF_LEVEL_ADDR                              0x0000011C
+#define CCI_HALT_REQ_ADDR                                           0x00000034
+#define CCI_M0_HALT_REQ_RMSK                                               0x1
+#define CCI_M1_HALT_REQ_RMSK                                               0x2
+#define CCI_I2C_M1_SCL_CTL_ADDR                                     0x00000200
+#define CCI_I2C_M1_SDA_CTL_0_ADDR                                   0x00000204
+#define CCI_I2C_M1_SDA_CTL_1_ADDR                                   0x00000208
+#define CCI_I2C_M1_SDA_CTL_2_ADDR                                   0x0000020c
+#define CCI_I2C_M1_MISC_CTL_ADDR                                    0x00000210
+#define CCI_I2C_M1_STATUS_ADDR                                      0x00000214
+#define CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR                             0x00000304
+#define CCI_I2C_M0_Q0_CUR_CMD_ADDR                                  0x00000308
+#define CCI_I2C_M0_Q0_REPORT_STATUS_ADDR                            0x0000030c
+#define CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR                            0x00000300
+#define CCI_I2C_M0_Q0_LOAD_DATA_ADDR                                0x00000310
+#define CCI_IRQ_MASK_0_ADDR                                         0x00000c04
+#define CCI_IRQ_MASK_0_RMSK                                         0x7fff7ff7
+#define CCI_IRQ_MASK_1_ADDR                                         0x00000c10
+#define CCI_IRQ_MASK_1_RMSK                                         0x00DD0000
+#define CCI_IRQ_CLEAR_0_ADDR                                        0x00000c08
+#define CCI_IRQ_CLEAR_1_ADDR                                        0x00000c14
+#define CCI_IRQ_STATUS_0_ADDR                                       0x00000c0c
+#define CCI_IRQ_STATUS_1_ADDR                                       0x00000c18
+#define CCI_IRQ_STATUS_0_I2C_M1_Q0Q1_HALT_ACK_BMSK                   0x4000000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_HALT_ACK_BMSK                   0x2000000
+#define CCI_IRQ_STATUS_0_RST_DONE_ACK_BMSK                           0x1000000
+#define CCI_IRQ_STATUS_0_I2C_M1_Q1_REPORT_BMSK                        0x100000
+#define CCI_IRQ_STATUS_0_I2C_M1_Q0_REPORT_BMSK                         0x10000
+#define CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK                            0x1000
+#define CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD                          0x100000
+#define CCI_IRQ_STATUS_1_I2C_M1_RD_PAUSE                              0x200000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q1_REPORT_BMSK                           0x100
+#define CCI_IRQ_STATUS_0_I2C_M0_Q0_REPORT_BMSK                            0x10
+#define CCI_IRQ_STATUS_0_I2C_M0_ERROR_BMSK                          0x18000EE6
+#define CCI_IRQ_STATUS_0_I2C_M1_ERROR_BMSK                          0x60EE6000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q0_NACK_ERROR_BMSK                   0x8000000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q1_NACK_ERROR_BMSK                  0x10000000
+#define CCI_IRQ_STATUS_0_I2C_M1_Q0_NACK_ERROR_BMSK                  0x20000000
+#define CCI_IRQ_STATUS_0_I2C_M1_Q1_NACK_ERROR_BMSK                  0x40000000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_ERROR_BMSK                          0xEE0
+#define CCI_IRQ_STATUS_0_I2C_M1_Q0Q1_ERROR_BMSK                       0xEE0000
+#define CCI_IRQ_STATUS_0_I2C_M0_RD_ERROR_BMSK                              0x6
+#define CCI_IRQ_STATUS_0_I2C_M1_RD_ERROR_BMSK                           0x6000
+#define CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK                               0x1
+#define CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD                           0x10000
+#define CCI_IRQ_STATUS_1_I2C_M0_RD_PAUSE                               0x20000
+#define CCI_IRQ_STATUS_1_I2C_M1_Q0_THRESHOLD                          0x400000
+#define CCI_IRQ_STATUS_1_I2C_M1_Q1_THRESHOLD                          0x800000
+#define CCI_IRQ_STATUS_1_I2C_M0_Q0_THRESHOLD                           0x40000
+#define CCI_IRQ_STATUS_1_I2C_M0_Q1_THRESHOLD                           0x80000
+#define CCI_I2C_M0_RD_THRESHOLD_ADDR                                0x00000120
+#define CCI_I2C_M1_RD_THRESHOLD_ADDR                                0x00000220
+#define CCI_I2C_RD_THRESHOLD_VALUE                                        0x30
+#define CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR                               0x00000c00
+
+#define DEBUG_TOP_REG_START                                                0x0
+#define DEBUG_TOP_REG_COUNT                                                 14
+#define DEBUG_MASTER_REG_START                                           0x100
+#define DEBUG_MASTER_REG_COUNT                                               9
+#define DEBUG_MASTER_QUEUE_REG_START                                     0x300
+#define DEBUG_MASTER_QUEUE_REG_COUNT                                         7
+#define DEBUG_INTR_REG_START                                             0xC00
+#define DEBUG_INTR_REG_COUNT                                                 7
+#endif /* _CAM_CCI_HWREG_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_soc.c
@@ -0,0 +1,534 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cci_dev.h"
+#include "cam_cci_core.h"
+#include "linux/interrupt.h"
+#include "uapi/linux/sched/types.h"
+#include "linux/sched/types.h"
+
+static int cam_cci_init_master(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master)
+{
+	int i = 0, rc = 0;
+	void __iomem *base = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	uint32_t max_queue_0_size = 0, max_queue_1_size = 0;
+
+	soc_info = &cci_dev->soc_info;
+	base = soc_info->reg_map[0].mem_base;
+
+	if (cci_dev->hw_version == CCI_VERSION_1_2_9) {
+		max_queue_0_size = CCI_I2C_QUEUE_0_SIZE_V_1_2;
+		max_queue_1_size = CCI_I2C_QUEUE_1_SIZE_V_1_2;
+	} else {
+		max_queue_0_size = CCI_I2C_QUEUE_0_SIZE;
+		max_queue_1_size = CCI_I2C_QUEUE_1_SIZE;
+	}
+
+	cci_dev->master_active_slave[master]++;
+	CAM_DBG(CAM_CCI,
+		"CCI%d_I2C_M%d active slave: %d",
+		cci_dev->soc_info.index, master, cci_dev->master_active_slave[master]);
+	if (!cci_dev->cci_master_info[master].is_initilized) {
+		/* Re-initialize the completion */
+		rc = cam_soc_util_select_pinctrl_state(soc_info, master, true);
+		if (rc) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d Pinctrl active state x'sition failed, rc: %d",
+				cci_dev->soc_info.index, master, rc);
+			goto MASTER_INIT_ERR;
+		}
+
+		reinit_completion(
+		&cci_dev->cci_master_info[master].reset_complete);
+		reinit_completion(&cci_dev->cci_master_info[master].rd_done);
+
+		/* reinit the reports for the queue */
+		for (i = 0; i < NUM_QUEUES; i++)
+			reinit_completion(
+			&cci_dev->cci_master_info[master].report_q[i]);
+
+		/* Set reset pending flag to true */
+		cci_dev->cci_master_info[master].reset_pending = true;
+		cci_dev->cci_master_info[master].status = 0;
+		if (cci_dev->ref_count == 1) {
+			cam_io_w_mb(CCI_RESET_CMD_RMSK,
+				base + CCI_RESET_CMD_ADDR);
+			cam_io_w_mb(0x1, base + CCI_RESET_CMD_ADDR);
+		} else {
+			cam_io_w_mb((master == MASTER_0) ?
+				CCI_M0_RESET_RMSK : CCI_M1_RESET_RMSK,
+				base + CCI_RESET_CMD_ADDR);
+		}
+		if (!cam_common_wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].reset_complete,
+			CCI_TIMEOUT)) {
+			CAM_ERR(CAM_CCI,
+				"CCI%d_I2C_M%d Failed: reset complete timeout",
+				cci_dev->soc_info.index, master);
+			rc = -ETIMEDOUT;
+			goto MASTER_INIT_ERR;
+		}
+
+		flush_workqueue(cci_dev->write_wq[master]);
+
+		/* Setting up the queue size for master */
+		cci_dev->cci_i2c_queue_info[master][QUEUE_0].max_queue_size
+					= max_queue_0_size;
+		cci_dev->cci_i2c_queue_info[master][QUEUE_1].max_queue_size
+					= max_queue_1_size;
+
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d:: Q0: %d Q1: %d",
+			cci_dev->soc_info.index, master,
+			cci_dev->cci_i2c_queue_info[master][QUEUE_0]
+				.max_queue_size,
+			cci_dev->cci_i2c_queue_info[master][QUEUE_1]
+				.max_queue_size);
+
+		cci_dev->cci_master_info[master].status = 0;
+		cci_dev->cci_master_info[master].is_initilized = true;
+		cci_dev->is_burst_read[master] = false;
+	}
+
+	return 0;
+
+MASTER_INIT_ERR:
+	cci_dev->master_active_slave[master]--;
+
+	return rc;
+}
+
+int cam_cci_init(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	uint8_t i = 0;
+	int32_t rc = 0;
+	struct cci_device *cci_dev;
+	enum cci_i2c_master_t master = MASTER_MAX;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	struct cam_hw_soc_info *soc_info = NULL;
+	void __iomem *base = NULL;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev || !c_ctrl) {
+		CAM_ERR(CAM_CCI,
+			"Invalid params cci_dev: %p, c_ctrl: %p",
+			cci_dev, c_ctrl);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	master = c_ctrl->cci_info->cci_i2c_master;
+	soc_info = &cci_dev->soc_info;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d failed: invalid params soc_info:%pK",
+			cci_dev->soc_info.index, master, soc_info);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	base = soc_info->reg_map[0].mem_base;
+
+	if (!base) {
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d failed: invalid params base:%pK",
+			cci_dev->soc_info.index, master, base);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (master >= MASTER_MAX || master < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Incorrect Master",
+			cci_dev->soc_info.index, master);
+		return -EINVAL;
+	}
+
+	if (!cci_dev->write_wq[master]) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Null memory for write wq",
+			cci_dev->soc_info.index, master);
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	if (cci_dev->ref_count++) {
+		rc = cam_cci_init_master(cci_dev, master);
+		if (rc) {
+			CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Failed to init rc: %d",
+				cci_dev->soc_info.index, master, rc);
+			cci_dev->ref_count--;
+		}
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d ref_count %d",
+			cci_dev->soc_info.index, master, cci_dev->ref_count);
+		return rc;
+	}
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(cci_dev->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d CPAS start failed, rc: %d",
+			cci_dev->soc_info.index, master, rc);
+		return rc;
+	}
+
+	cam_cci_get_clk_rates(cci_dev, c_ctrl);
+
+	/* Enable Regulators and IRQ*/
+	rc = cam_soc_util_enable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		soc_info->lowest_clk_level, true);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d request platform resources failed, rc: %d",
+			cci_dev->soc_info.index, master, rc);
+		goto platform_enable_failed;
+	}
+
+	cci_dev->hw_version = cam_io_r_mb(base + CCI_HW_VERSION_ADDR);
+	CAM_DBG(CAM_CCI, "CCI%d_I2C_M%d hw_version = 0x%x",
+		cci_dev->soc_info.index, master, cci_dev->hw_version);
+
+	cci_dev->payload_size = MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11;
+	cci_dev->support_seq_write = 1;
+
+	rc = cam_cci_init_master(cci_dev, master);
+	if (rc) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Failed to init, rc: %d",
+			cci_dev->soc_info.index, master, rc);
+		goto reset_complete_failed;
+	}
+
+	for (i = 0; i < MASTER_MAX; i++)
+		cci_dev->i2c_freq_mode[i] = I2C_MAX_MODES;
+
+	cam_io_w_mb(CCI_IRQ_MASK_0_RMSK, base + CCI_IRQ_MASK_0_ADDR);
+	cam_io_w_mb(CCI_IRQ_MASK_0_RMSK, base + CCI_IRQ_CLEAR_0_ADDR);
+	cam_io_w_mb(CCI_IRQ_MASK_1_RMSK, base + CCI_IRQ_MASK_1_ADDR);
+	cam_io_w_mb(CCI_IRQ_MASK_1_RMSK, base + CCI_IRQ_CLEAR_1_ADDR);
+	cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
+
+	/* Set RD FIFO threshold for M0 & M1 */
+	if (cci_dev->hw_version != CCI_VERSION_1_2_9) {
+		cam_io_w_mb(CCI_I2C_RD_THRESHOLD_VALUE,
+				base + CCI_I2C_M0_RD_THRESHOLD_ADDR);
+		cam_io_w_mb(CCI_I2C_RD_THRESHOLD_VALUE,
+				base + CCI_I2C_M1_RD_THRESHOLD_ADDR);
+	}
+
+	cci_dev->cci_state = CCI_STATE_ENABLED;
+
+	return 0;
+
+reset_complete_failed:
+	cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+platform_enable_failed:
+	cci_dev->ref_count--;
+	cam_cpas_stop(cci_dev->cpas_handle);
+
+	return rc;
+}
+
+void cam_cci_soc_remove(struct platform_device *pdev,
+	struct cci_device *cci_dev)
+{
+	struct cam_hw_soc_info *soc_info = &cci_dev->soc_info;
+
+	cam_soc_util_release_platform_resource(soc_info);
+}
+
+static void cam_cci_init_cci_params(struct cci_device *new_cci_dev)
+{
+	uint8_t i = 0, j = 0;
+
+	for (i = 0; i < MASTER_MAX; i++) {
+		new_cci_dev->cci_master_info[i].status = 0;
+		new_cci_dev->cci_master_info[i].freq_ref_cnt = 0;
+		new_cci_dev->cci_master_info[i].is_initilized = false;
+		new_cci_dev->cci_master_info[i].is_master_locked = false;
+		new_cci_dev->cci_master_info[i].is_read_append_locked = false;
+		new_cci_dev->cci_master_info[i].master_usage_cnt = 0;
+		mutex_init(&new_cci_dev->cci_master_info[i].mutex);
+		mutex_init(&new_cci_dev->cci_master_info[i].master_lock_mutex);
+		init_waitqueue_head(&new_cci_dev->cci_master_info[i].lock_wait);
+		sema_init(&new_cci_dev->cci_master_info[i].master_sem, 1);
+		mutex_init(&new_cci_dev->cci_master_info[i].freq_cnt_lock);
+		init_completion(
+			&new_cci_dev->cci_master_info[i].reset_complete);
+		init_completion(
+			&new_cci_dev->cci_master_info[i].th_complete);
+		init_completion(
+			&new_cci_dev->cci_master_info[i].rd_done);
+
+		for (j = 0; j < NUM_QUEUES; j++) {
+			mutex_init(&new_cci_dev->cci_master_info[i].mutex_q[j]);
+			init_completion(
+				&new_cci_dev->cci_master_info[i].report_q[j]);
+			init_completion(
+				&new_cci_dev->cci_master_info[i].th_burst_complete[j]);
+			spin_lock_init(
+				&new_cci_dev->cci_master_info[i].lock_q[j]);
+		}
+	}
+	spin_lock_init(&new_cci_dev->lock_status);
+}
+
+static void cam_cci_init_default_clk_params(struct cci_device *cci_dev,
+	uint8_t index)
+{
+	/* default clock params are for 100Khz */
+	cci_dev->cci_clk_params[index].hw_thigh = 201;
+	cci_dev->cci_clk_params[index].hw_tlow = 174;
+	cci_dev->cci_clk_params[index].hw_tsu_sto = 204;
+	cci_dev->cci_clk_params[index].hw_tsu_sta = 231;
+	cci_dev->cci_clk_params[index].hw_thd_dat = 22;
+	cci_dev->cci_clk_params[index].hw_thd_sta = 162;
+	cci_dev->cci_clk_params[index].hw_tbuf = 227;
+	cci_dev->cci_clk_params[index].hw_scl_stretch_en = 0;
+	cci_dev->cci_clk_params[index].hw_trdhld = 6;
+	cci_dev->cci_clk_params[index].hw_tsp = 3;
+	cci_dev->cci_clk_params[index].cci_clk_src = 37500000;
+}
+
+static void cam_cci_init_clk_params(struct cci_device *cci_dev)
+{
+	int32_t rc = 0;
+	uint32_t val = 0;
+	uint8_t count = 0;
+	struct device_node *of_node = cci_dev->v4l2_dev_str.pdev->dev.of_node;
+	struct device_node *src_node = NULL;
+
+	for (count = 0; count < I2C_MAX_MODES; count++) {
+
+		if (count == I2C_STANDARD_MODE)
+			src_node = of_find_node_by_name(of_node,
+				"qcom,i2c_standard_mode");
+		else if (count == I2C_FAST_MODE)
+			src_node = of_find_node_by_name(of_node,
+				"qcom,i2c_fast_mode");
+		else if (count == I2C_FAST_PLUS_MODE)
+			src_node = of_find_node_by_name(of_node,
+				"qcom,i2c_fast_plus_mode");
+		else
+			src_node = of_find_node_by_name(of_node,
+				"qcom,i2c_custom_mode");
+
+		rc = of_property_read_u32(src_node, "hw-thigh", &val);
+		CAM_DBG(CAM_CCI, "hw-thigh %d, rc %d", val, rc);
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_thigh = val;
+			rc = of_property_read_u32(src_node, "hw-tlow",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tlow %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tlow = val;
+			rc = of_property_read_u32(src_node, "hw-tsu-sto",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tsu-sto %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tsu_sto = val;
+			rc = of_property_read_u32(src_node, "hw-tsu-sta",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tsu-sta %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tsu_sta = val;
+			rc = of_property_read_u32(src_node, "hw-thd-dat",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-thd-dat %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_thd_dat = val;
+			rc = of_property_read_u32(src_node, "hw-thd-sta",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-thd-sta %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_thd_sta = val;
+			rc = of_property_read_u32(src_node, "hw-tbuf",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tbuf %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tbuf = val;
+			rc = of_property_read_u32(src_node,
+				"hw-scl-stretch-en", &val);
+			CAM_DBG(CAM_CCI, "hw-scl-stretch-en %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_scl_stretch_en = val;
+			rc = of_property_read_u32(src_node, "hw-trdhld",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-trdhld %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_trdhld = val;
+			rc = of_property_read_u32(src_node, "hw-tsp",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tsp %d, rc %d", val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tsp = val;
+			val = 0;
+			rc = of_property_read_u32(src_node, "cci-clk-src",
+				&val);
+			CAM_DBG(CAM_CCI, "cci-clk-src %d, rc %d", val, rc);
+			cci_dev->cci_clk_params[count].cci_clk_src = val;
+		} else
+			cam_cci_init_default_clk_params(cci_dev, count);
+
+		of_node_put(src_node);
+	}
+}
+
+int cam_cci_parse_dt_info(struct platform_device *pdev,
+	struct cci_device *new_cci_dev)
+{
+	int rc = 0, i = 0;
+	struct cam_hw_soc_info *soc_info =
+		&new_cci_dev->soc_info;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+	int32_t  num_irq = 0;
+	struct task_struct  *task = NULL;
+	struct irq_desc     *desc = NULL;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Parsing DT data failed:%d", rc);
+		return -EINVAL;
+	}
+
+	new_cci_dev->ref_count = 0;
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = new_cci_dev;
+	/*
+	 * Bypass devm_request_irq() and induce
+	 * devm_request_threaded_irq() externally.
+	 */
+	num_irq = soc_info->irq_count;
+	soc_info->irq_count = 0;
+	rc = cam_soc_util_request_platform_resource(soc_info,
+		cam_cci_irq, &(irq_data[0]));
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "requesting platform resources failed:%d", rc);
+		return -EINVAL;
+	}
+	soc_info->irq_count = num_irq;
+	for (i = 0; i < soc_info->irq_count; i++) {
+		rc = devm_request_threaded_irq(&pdev->dev,
+			soc_info->irq_num[i],
+			cam_cci_irq,
+			cam_cci_threaded_irq,
+			IRQF_TRIGGER_RISING,
+			soc_info->irq_name[i],
+			(void *)(irq_data[i]));
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI, "Failed to reserve IRQ: %d", rc);
+			return -EINVAL;
+		}
+		disable_irq(soc_info->irq_num[i]);
+
+#if (IS_REACHABLE(CONFIG_SPARSE_IRQ) && \
+	IS_REACHABLE(CONFIG_KVM_BOOK3S_64_HV_MODULE)) || \
+	!IS_REACHABLE(CONFIG_SPARSE_IRQ)
+		desc = irq_to_desc(soc_info->irq_num[i]);
+		if (!desc) {
+			CAM_WARN(CAM_CCI,
+				"Unable to locate Descriptor for irq_num: %d",
+				soc_info->irq_num[i]);
+		} else {
+			task = desc->action->thread;
+			if (task)
+				sched_set_fifo(task);
+		}
+#endif
+	}
+
+	new_cci_dev->v4l2_dev_str.pdev = pdev;
+	cam_cci_init_cci_params(new_cci_dev);
+	cam_cci_init_clk_params(new_cci_dev);
+
+	for (i = 0; i < MASTER_MAX; i++) {
+		new_cci_dev->write_wq[i] = create_singlethread_workqueue(
+			CAM_CCI_WORKQUEUE_NAME);
+		if (!new_cci_dev->write_wq[i])
+			CAM_ERR(CAM_CCI, "Failed to create write wq");
+	}
+	CAM_DBG(CAM_CCI, "Exit");
+	return 0;
+}
+
+int cam_cci_soc_release(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master)
+{
+	uint8_t i = 0, rc = 0;
+	struct cam_hw_soc_info *soc_info = &cci_dev->soc_info;
+
+	if (!cci_dev->ref_count || cci_dev->cci_state != CCI_STATE_ENABLED ||
+			!cci_dev->master_active_slave[master]) {
+		CAM_ERR(CAM_CCI,
+			"CCI%d_I2C_M%d invalid cci_dev_ref count %u | cci state %d | master_ref_count %u",
+			cci_dev->soc_info.index, master, cci_dev->ref_count, cci_dev->cci_state,
+			cci_dev->master_active_slave[master]);
+		return -EINVAL;
+	}
+
+	if (!(--cci_dev->master_active_slave[master])) {
+		if (cam_soc_util_select_pinctrl_state(soc_info, master, false))
+			CAM_WARN(CAM_CCI,
+				"CCI%d_I2C_M%d Pinctrl suspend state x'sition failed",
+				cci_dev->soc_info.index, master);
+
+		cci_dev->cci_master_info[master].is_initilized = false;
+		CAM_DBG(CAM_CCI,
+			"CCI%d_I2C_M%d All submodules are released", cci_dev->soc_info.index, master);
+	}
+
+	if (--cci_dev->ref_count) {
+		CAM_DBG(CAM_CCI, "CCI%d_M%d Submodule release: Ref_count: %d",
+			cci_dev->soc_info.index, master, cci_dev->ref_count);
+		return 0;
+	}
+
+	for (i = 0; i < MASTER_MAX; i++) {
+		if (cci_dev->write_wq[i])
+			flush_workqueue(cci_dev->write_wq[i]);
+		cci_dev->i2c_freq_mode[i] = I2C_MAX_MODES;
+	}
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+	if (rc) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d platform resources disable failed, rc: %d",
+			cci_dev->soc_info.index, master, rc);
+		return rc;
+	}
+
+	cci_dev->cci_state = CCI_STATE_DISABLED;
+	cci_dev->cycles_per_us = 0;
+
+	cam_cpas_stop(cci_dev->cpas_handle);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_cci/cam_cci_soc.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CCI_SOC_H_
+#define _CAM_CCI_SOC_H_
+
+#include "cam_cci_core.h"
+#include "cam_soc_util.h"
+
+/**
+ * @sd: V4L2 sub device
+ * @c_ctrl: CCI control structure
+ *
+ * This API initializes the CCI and acquires SOC resources
+ */
+int cam_cci_init(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl);
+
+/**
+ * @cci_dev: CCI device structure
+ *
+ * This API releases the CCI and its SOC resources
+ */
+int cam_cci_soc_release(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master);
+
+/**
+ * @pdev: Platform device
+ * @new_cci_dev: CCI device structure
+ *
+ * This API parses CCI device tree
+ */
+int cam_cci_parse_dt_info(struct platform_device *pdev,
+	struct cci_device *new_cci_dev);
+
+/**
+ * @pdev: Platform device
+ * @cci_dev: CCI device structure
+ *
+ * This API puts all SOC resources
+ */
+void cam_cci_soc_remove(struct platform_device *pdev,
+	struct cci_device *cci_dev);
+#endif /* _CAM_CCI_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
@@ -0,0 +1,2952 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_compat.h"
+#include "cam_csiphy_core.h"
+#include "cam_csiphy_dev.h"
+#include "cam_csiphy_soc.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_cpas_api.h"
+#include "cam_compat.h"
+
+#define SCM_SVC_CAMERASS 0x18
+#define SECURE_SYSCALL_ID 0x6
+#define SECURE_SYSCALL_ID_2 0x7
+
+#define LANE_MASK_2PH 0x1F
+#define LANE_MASK_3PH 0x7
+
+/* Size of CPAS_SEC_LANE_CP_CTRL register mask */
+#define SEC_LANE_CP_REG_LEN 32
+/*
+ * PHY index at which CPAS_SEC_LANE_CP_CTRL register mask
+ * changes depending on PHY HW version
+ */
+#define CAM_MAX_PHYS_PER_CP_CTRL_REG 4
+
+static DEFINE_MUTEX(active_csiphy_cnt_mutex);
+static DEFINE_MUTEX(main_aon_selection);
+
+static int csiphy_onthego_reg_count;
+static unsigned int csiphy_onthego_regs[150];
+module_param_array(csiphy_onthego_regs, uint, &csiphy_onthego_reg_count, 0644);
+MODULE_PARM_DESC(csiphy_onthego_regs, "Functionality to let csiphy registers program on the fly");
+
+struct g_csiphy_data {
+	void __iomem *base_address;
+	uint8_t is_3phase;
+	uint32_t cpas_handle;
+	bool is_configured_for_main;
+	uint64_t data_rate_aux_mask;
+	uint32_t aon_cam_id;
+	struct cam_csiphy_aon_sel_params_t *aon_sel_param;
+};
+
+static struct g_csiphy_data g_phy_data[MAX_CSIPHY] = {0};
+static int active_csiphy_hw_cnt;
+
+void cam_csiphy_update_auxiliary_mask(struct csiphy_device *csiphy_dev)
+{
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "Invalid param");
+		return;
+	}
+
+	if (!g_phy_data[csiphy_dev->soc_info.index].is_3phase) {
+		CAM_INFO_RATE_LIMIT(CAM_CSIPHY, "2PH Sensor is connected to the PHY");
+		return;
+	}
+
+	g_phy_data[csiphy_dev->soc_info.index].data_rate_aux_mask |=
+			BIT_ULL(csiphy_dev->curr_data_rate_idx);
+
+	/* check if userland has provided a buffer for data rate aux mask */
+	if (csiphy_dev->aux_params.aux_mem_update_en) {
+
+		*csiphy_dev->aux_params.aux_config_ptr =
+			g_phy_data[csiphy_dev->soc_info.index].data_rate_aux_mask;
+	}
+
+	CAM_DBG(CAM_CSIPHY,
+		"CSIPHY:%u configuring aux settings curr_data_rate_idx: %u curr_data_rate: %llu curr_aux_mask: 0x%lx updated in memory: %s",
+		csiphy_dev->soc_info.index, csiphy_dev->curr_data_rate_idx,
+		csiphy_dev->current_data_rate,
+		g_phy_data[csiphy_dev->soc_info.index].data_rate_aux_mask,
+		CAM_BOOL_TO_YESNO(csiphy_dev->aux_params.aux_mem_update_en));
+}
+
+int32_t cam_csiphy_get_instance_offset(struct csiphy_device *csiphy_dev, int32_t dev_handle)
+{
+	int32_t i = 0;
+
+	if ((csiphy_dev->acquire_count >
+		csiphy_dev->session_max_device_support) ||
+		(csiphy_dev->acquire_count < 0)) {
+		CAM_ERR(CAM_CSIPHY,
+			"Invalid acquire count: %d, Max supported device for session: %u",
+			csiphy_dev->acquire_count,
+			csiphy_dev->session_max_device_support);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < csiphy_dev->acquire_count; i++) {
+		if (dev_handle ==
+			csiphy_dev->csiphy_info[i].hdl_data.device_hdl)
+			break;
+	}
+
+	return i;
+}
+
+static int cam_csiphy_cpas_ops(
+	uint32_t cpas_handle, bool start)
+{
+	int rc = 0;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+
+	if (start) {
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = CAM_LOWSVS_D1_VOTE;
+		axi_vote.num_paths = 1;
+		axi_vote.axi_path[0].path_data_type =
+			CAM_AXI_PATH_DATA_ALL;
+		axi_vote.axi_path[0].transac_type =
+			CAM_AXI_TRANSACTION_WRITE;
+		axi_vote.axi_path[0].camnoc_bw =
+			CAM_CPAS_DEFAULT_AXI_BW;
+		axi_vote.axi_path[0].mnoc_ab_bw =
+			CAM_CPAS_DEFAULT_AXI_BW;
+		axi_vote.axi_path[0].mnoc_ib_bw =
+			CAM_CPAS_DEFAULT_AXI_BW;
+
+		rc = cam_cpas_start(cpas_handle,
+			&ahb_vote, &axi_vote);
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "voting CPAS: %d", rc);
+			return rc;
+		}
+		CAM_DBG(CAM_CSIPHY, "CPAS START");
+	} else {
+		rc = cam_cpas_stop(cpas_handle);
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "de-voting CPAS: %d", rc);
+			return rc;
+		}
+		CAM_DBG(CAM_CSIPHY, "CPAS STOPPED");
+	}
+
+	return rc;
+}
+
+static void cam_csiphy_reset_phyconfig_param(struct csiphy_device *csiphy_dev,
+	int32_t index)
+{
+	CAM_DBG(CAM_CSIPHY, "Resetting phyconfig param at index: %d", index);
+	csiphy_dev->csiphy_info[index].lane_cnt = 0;
+	csiphy_dev->csiphy_info[index].lane_assign = 0;
+	csiphy_dev->csiphy_info[index].lane_enable = 0;
+	csiphy_dev->csiphy_info[index].settle_time = 0;
+	csiphy_dev->csiphy_info[index].data_rate = 0;
+	csiphy_dev->csiphy_info[index].secure_mode = 0;
+	csiphy_dev->csiphy_info[index].mipi_flags = 0;
+	csiphy_dev->csiphy_info[index].hdl_data.device_hdl = -1;
+	csiphy_dev->csiphy_info[index].csiphy_3phase = -1;
+	csiphy_dev->csiphy_info[index].conn_csid_idx = -1;
+	csiphy_dev->csiphy_info[index].use_hw_client_voting = false;
+	csiphy_dev->csiphy_info[index].is_drv_config_en = false;
+}
+
+static inline void cam_csiphy_apply_onthego_reg_values(void __iomem *csiphybase, uint8_t csiphy_idx)
+{
+	int                                                      i;
+
+	CAM_DBG(CAM_CSIPHY, "csiphy: %d, onthego_reg_count: %d",
+		csiphy_idx,
+		csiphy_onthego_reg_count);
+
+	if (csiphy_onthego_reg_count % 3)
+		csiphy_onthego_reg_count -= (csiphy_onthego_reg_count % 3);
+
+	for (i = 0; i < csiphy_onthego_reg_count; i += 3) {
+		cam_io_w_mb(csiphy_onthego_regs[i+1],
+			csiphybase + csiphy_onthego_regs[i]);
+
+		if (csiphy_onthego_regs[i+2])
+			usleep_range(csiphy_onthego_regs[i+2], csiphy_onthego_regs[i+2] + 5);
+
+		CAM_INFO(CAM_CSIPHY, "Offset: 0x%x, Val: 0x%x Delay(us): %u",
+			csiphy_onthego_regs[i],
+			cam_io_r_mb(csiphybase + csiphy_onthego_regs[i]),
+			csiphy_onthego_regs[i+2]);
+	}
+}
+
+static inline int cam_csiphy_release_from_reset_state(struct csiphy_device *csiphy_dev,
+	void __iomem *csiphybase, int32_t instance)
+{
+	int                                                  i;
+	struct csiphy_reg_parms_t                           *csiphy_reg;
+	struct csiphy_reg_t                                 *csiphy_reset_release_reg;
+	bool                                                 config_found = false;
+
+	if (!csiphy_dev || !csiphybase) {
+		CAM_ERR(CAM_CSIPHY, "Invalid input params: csiphy_dev: %s, csiphybase: %s",
+			CAM_IS_NULL_TO_STR(csiphy_dev),
+			CAM_IS_NULL_TO_STR(csiphybase));
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CSIPHY, "Csiphy idx: %d", csiphy_dev->soc_info.index);
+
+	csiphy_reg = csiphy_dev->ctrl_reg->csiphy_reg;
+	for (i = 0; i < csiphy_reg->csiphy_reset_exit_array_size; i++) {
+		csiphy_reset_release_reg = &csiphy_dev->ctrl_reg->csiphy_reset_exit_regs[i];
+
+		switch (csiphy_reset_release_reg->csiphy_param_type) {
+		case CSIPHY_2PH_REGS:
+			if (!g_phy_data[csiphy_dev->soc_info.index].is_3phase &&
+				!csiphy_dev->combo_mode &&
+				!csiphy_dev->cphy_dphy_combo_mode) {
+				cam_io_w_mb(csiphy_reset_release_reg->reg_data,
+					csiphybase + csiphy_reset_release_reg->reg_addr);
+				config_found = true;
+			}
+			break;
+		case CSIPHY_3PH_REGS:
+			if (g_phy_data[csiphy_dev->soc_info.index].is_3phase &&
+				!csiphy_dev->combo_mode  &&
+				!csiphy_dev->cphy_dphy_combo_mode) {
+				cam_io_w_mb(csiphy_reset_release_reg->reg_data,
+					csiphybase + csiphy_reset_release_reg->reg_addr);
+				config_found = true;
+			}
+			break;
+		case CSIPHY_2PH_COMBO_REGS:
+			if (!csiphy_dev->csiphy_info[instance].csiphy_3phase &&
+					csiphy_dev->combo_mode &&
+					!csiphy_dev->cphy_dphy_combo_mode) {
+				cam_io_w_mb(csiphy_reset_release_reg->reg_data,
+					csiphybase + csiphy_reset_release_reg->reg_addr);
+				config_found = true;
+			}
+			break;
+		case CSIPHY_3PH_COMBO_REGS:
+			if (csiphy_dev->csiphy_info[instance].csiphy_3phase &&
+					csiphy_dev->combo_mode &&
+					!csiphy_dev->cphy_dphy_combo_mode) {
+				cam_io_w_mb(csiphy_reset_release_reg->reg_data,
+					csiphybase + csiphy_reset_release_reg->reg_addr);
+				config_found = true;
+			}
+			break;
+		case CSIPHY_2PH_3PH_COMBO_REGS:
+			if (!csiphy_dev->combo_mode && csiphy_dev->cphy_dphy_combo_mode) {
+				cam_io_w_mb(csiphy_reset_release_reg->reg_data,
+					csiphybase + csiphy_reset_release_reg->reg_addr);
+				config_found = true;
+			}
+			break;
+		default:
+			CAM_ERR(CAM_CSIPHY, "Invalid combination");
+			return -EINVAL;
+			break;
+		}
+
+		if (config_found) {
+			if (csiphy_reset_release_reg->delay) {
+				usleep_range(csiphy_reset_release_reg->delay,
+					csiphy_reset_release_reg->delay + 5);
+			}
+
+			break;
+		}
+
+	}
+	return 0;
+}
+
+static int __csiphy_prgm_common_data(uint32_t phy_idx, struct csiphy_reg_t *csiphy_common_reg,
+	uint32_t size, bool reset)
+{
+	int i = 0;
+	void __iomem *csiphybase = NULL;
+	uint8_t is_3phase;
+
+	csiphybase = g_phy_data[phy_idx].base_address;
+	is_3phase = g_phy_data[phy_idx].is_3phase;
+
+	if (!csiphybase) {
+		CAM_DBG(CAM_CSIPHY, "CSIPHY: %d is not available in platform", phy_idx);
+		return 0;
+	}
+
+	CAM_DBG(CAM_CSIPHY, "common_data_array_size: %d, is_3phase: %d, reset: %s",
+		size, is_3phase, (reset ? "true" : "false"));
+
+	for (i = 0; i < size; i++) {
+		switch (csiphy_common_reg[i].csiphy_param_type) {
+		case CSIPHY_DEFAULT_PARAMS:
+			cam_io_w_mb(reset ? 0x00 : csiphy_common_reg[i].reg_data,
+				csiphybase + csiphy_common_reg[i].reg_addr);
+			break;
+		case CSIPHY_2PH_REGS:
+			if (!is_3phase) {
+				cam_io_w_mb(reset ? 0x00 : csiphy_common_reg[i].reg_data,
+					csiphybase + csiphy_common_reg[i].reg_addr);
+			}
+			break;
+		case CSIPHY_3PH_REGS:
+			if (is_3phase) {
+				cam_io_w_mb(reset ? 0x00 : csiphy_common_reg[i].reg_data,
+					csiphybase + csiphy_common_reg[i].reg_addr);
+			}
+			break;
+		default:
+			break;
+		}
+
+		if (csiphy_common_reg[i].delay > 0)
+			usleep_range(csiphy_common_reg[i].delay, csiphy_common_reg[i].delay + 5);
+	}
+
+	return 0;
+}
+
+void cam_csiphy_query_cap(struct csiphy_device *csiphy_dev,
+	struct cam_csiphy_query_cap *csiphy_cap)
+{
+	struct cam_hw_soc_info *soc_info = &csiphy_dev->soc_info;
+
+	csiphy_cap->slot_info = soc_info->index;
+	csiphy_cap->version = csiphy_dev->hw_version;
+	csiphy_cap->clk_lane = csiphy_dev->clk_lane;
+	csiphy_cap->reserved = csiphy_dev->is_aggregator_rx;
+}
+
+int cam_csiphy_dump_status_reg(struct csiphy_device *csiphy_dev)
+{
+	struct cam_hw_soc_info *soc_info;
+	void __iomem *phybase = NULL;
+	void __iomem *lane0_offset = 0;
+	void __iomem *lane1_offset = 0;
+	void __iomem *lane2_offset = 0;
+	void __iomem *lane3_offset = 0;
+	void __iomem *clk_offset = 0;
+	struct csiphy_reg_parms_t *csiphy_reg;
+	struct cam_cphy_dphy_status_reg_params_t *status_regs;
+	int i = 0;
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "Null csiphy_dev");
+		return -EINVAL;
+	}
+
+	soc_info = &csiphy_dev->soc_info;
+	if (!soc_info) {
+		CAM_ERR(CAM_CSIPHY, "Null soc_info");
+		return -EINVAL;
+	}
+
+	if (!g_phy_data[soc_info->index].base_address) {
+		CAM_ERR(CAM_CSIPHY, "Invalid cphy_idx: %d", soc_info->index);
+		return -EINVAL;
+	}
+
+	csiphy_reg = csiphy_dev->ctrl_reg->csiphy_reg;
+	status_regs = csiphy_reg->status_reg_params;
+	phybase = g_phy_data[soc_info->index].base_address;
+
+	if (!status_regs) {
+		CAM_ERR(CAM_CSIPHY, "2ph/3ph status offset not set");
+		return -EINVAL;
+	}
+
+	if (g_phy_data[soc_info->index].is_3phase) {
+		CAM_INFO(CAM_CSIPHY, "Dumping 3ph status regs");
+		lane0_offset = phybase + status_regs->csiphy_3ph_status0_offset;
+		lane1_offset =
+			lane0_offset + csiphy_reg->size_offset_betn_lanes;
+		lane2_offset =
+			lane1_offset + csiphy_reg->size_offset_betn_lanes;
+
+		for (i = 0; i < status_regs->csiphy_3ph_status_size; i++) {
+			CAM_INFO(CAM_CSIPHY,
+				"PHY: %d, Status%u. Ln0: 0x%x, Ln1: 0x%x, Ln2: 0x%x",
+				soc_info->index, i,
+				cam_io_r(lane0_offset + (i * 4)),
+				cam_io_r(lane1_offset + (i * 4)),
+				cam_io_r(lane2_offset + (i * 4)));
+		}
+	} else {
+		CAM_INFO(CAM_CSIPHY, "Dumping 2ph status regs");
+		lane0_offset = phybase + status_regs->csiphy_2ph_status0_offset;
+		lane1_offset =
+			lane0_offset + csiphy_reg->size_offset_betn_lanes;
+		lane2_offset =
+			lane1_offset + csiphy_reg->size_offset_betn_lanes;
+		lane3_offset =
+			lane2_offset + csiphy_reg->size_offset_betn_lanes;
+		clk_offset =
+			lane3_offset + (csiphy_reg->size_offset_betn_lanes / 2);
+
+		for (i = 0; i < status_regs->csiphy_2ph_status_size; i++) {
+			CAM_INFO(CAM_CSIPHY,
+				"PHY: %d, Status%u. "
+				"CLK_LN: 0x%x Ln0: 0x%x, Ln1: 0x%x, Ln2: 0x%x, Ln3: 0x%x",
+				soc_info->index, i,
+				cam_io_r(clk_offset + (i * 4)),
+				cam_io_r(lane0_offset + (i * 4)),
+				cam_io_r(lane1_offset + (i * 4)),
+				cam_io_r(lane2_offset + (i * 4)),
+				cam_io_r(lane3_offset + (i * 4)));
+		}
+	}
+	return 0;
+}
+
+void cam_csiphy_reset(struct csiphy_device *csiphy_dev)
+{
+	int32_t  i;
+	void __iomem *base = NULL;
+	uint32_t size =
+		csiphy_dev->ctrl_reg->csiphy_reg->csiphy_reset_enter_array_size;
+	struct cam_hw_soc_info *soc_info = &csiphy_dev->soc_info;
+
+	base = soc_info->reg_map[0].mem_base;
+
+	for (i = 0; i < size; i++) {
+		cam_io_w_mb(
+			csiphy_dev->ctrl_reg->csiphy_reset_enter_regs[i].reg_data,
+			base +
+			csiphy_dev->ctrl_reg->csiphy_reset_enter_regs[i].reg_addr);
+		if (csiphy_dev->ctrl_reg->csiphy_reset_enter_regs[i].delay > 0)
+			usleep_range(
+			csiphy_dev->ctrl_reg->csiphy_reset_enter_regs[i].delay,
+			csiphy_dev->ctrl_reg->csiphy_reset_enter_regs[i].delay
+			+ 5);
+	}
+
+	if (csiphy_dev->en_lane_status_reg_dump) {
+		CAM_INFO(CAM_CSIPHY, "Status Reg Dump after phy reset");
+		cam_csiphy_dump_status_reg(csiphy_dev);
+	}
+}
+
+static void cam_csiphy_program_common_registers(
+	struct csiphy_device *csiphy_dev,
+	bool reset,
+	enum cam_csiphy_common_reg_program selection)
+{
+	int csiphy_idx;
+	uint32_t size;
+	struct csiphy_reg_t *csiphy_common_reg;
+
+	csiphy_common_reg = csiphy_dev->ctrl_reg->csiphy_common_reg;
+	size = csiphy_dev->ctrl_reg->csiphy_reg->csiphy_common_reg_array_size;
+
+	if (selection == CAM_CSIPHY_PRGM_ALL) {
+		if (active_csiphy_hw_cnt < 0 || active_csiphy_hw_cnt >= MAX_CSIPHY) {
+			CAM_WARN(CAM_CSIPHY,
+				"MisMatched in active phy hw: %d and Max supported: %d",
+				active_csiphy_hw_cnt, MAX_CSIPHY);
+			return;
+		}
+
+		if (active_csiphy_hw_cnt) {
+			CAM_DBG(CAM_CSIPHY,
+				"Common Settings already applied for all PHYs. active_phy_cnt: %d",
+				active_csiphy_hw_cnt);
+			return;
+		}
+
+		CAM_DBG(CAM_CSIPHY, "Is reset required: %d", reset);
+
+		for (csiphy_idx = 0; csiphy_idx < MAX_CSIPHY; csiphy_idx++)
+			__csiphy_prgm_common_data(csiphy_idx, csiphy_common_reg, size, reset);
+	} else {
+		__csiphy_prgm_common_data(csiphy_dev->soc_info.index,
+			csiphy_common_reg, size, reset);
+	}
+}
+
+static int cam_csiphy_update_secure_info(struct csiphy_device *csiphy_dev, int32_t index)
+{
+	uint64_t lane_assign_bitmask = 0;
+	uint16_t lane_assign;
+	uint32_t bit_offset_bet_phys_in_cp_ctrl;
+	uint8_t lane_cnt;
+	uint32_t cpas_version;
+	int rc;
+
+	if (csiphy_dev->domain_id_security) {
+		CAM_DBG(CAM_CSIPHY, "Target supports domain ID security, skipping legacy update");
+		return 0;
+	}
+
+	lane_assign = csiphy_dev->csiphy_info[index].lane_assign;
+	lane_cnt = csiphy_dev->csiphy_info[index].lane_cnt;
+
+	while (lane_cnt--) {
+		lane_assign_bitmask |= (1 << (lane_assign & 0xF));
+		lane_assign >>= 4;
+	}
+
+	rc = cam_cpas_get_cpas_hw_version(&cpas_version);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed while getting CPAS Version");
+		return rc;
+	}
+
+	switch (cpas_version) {
+	case CAM_CPAS_TITAN_640_V200:
+	case CAM_CPAS_TITAN_665_V100:
+	case CAM_CPAS_TITAN_770_V100:
+		bit_offset_bet_phys_in_cp_ctrl =
+			CAM_CSIPHY_MAX_DPHY_LANES + CAM_CSIPHY_MAX_CPHY_LANES + 1;
+		break;
+	case CAM_CPAS_TITAN_580_V100:
+	case CAM_CPAS_TITAN_680_V100:
+	case CAM_CPAS_TITAN_780_V100:
+		bit_offset_bet_phys_in_cp_ctrl =
+			(csiphy_dev->soc_info.index < CAM_MAX_PHYS_PER_CP_CTRL_REG) ?
+				(CAM_CSIPHY_MAX_DPHY_LANES + CAM_CSIPHY_MAX_CPHY_LANES) :
+				(CAM_CSIPHY_MAX_DPHY_LANES + CAM_CSIPHY_MAX_CPHY_LANES + 1);
+		break;
+	default:
+		bit_offset_bet_phys_in_cp_ctrl =
+			CAM_CSIPHY_MAX_DPHY_LANES + CAM_CSIPHY_MAX_CPHY_LANES;
+		break;
+	}
+
+	if (csiphy_dev->soc_info.index < CAM_MAX_PHYS_PER_CP_CTRL_REG)
+		csiphy_dev->csiphy_info[index].csiphy_cpas_cp_reg_mask =
+			lane_assign_bitmask <<
+				((csiphy_dev->soc_info.index * bit_offset_bet_phys_in_cp_ctrl) +
+				(!csiphy_dev->csiphy_info[index].csiphy_3phase) *
+				(CAM_CSIPHY_MAX_CPHY_LANES));
+	else
+		csiphy_dev->csiphy_info[index].csiphy_cpas_cp_reg_mask =
+			lane_assign_bitmask <<
+				((csiphy_dev->soc_info.index - CAM_MAX_PHYS_PER_CP_CTRL_REG) *
+					bit_offset_bet_phys_in_cp_ctrl +
+				SEC_LANE_CP_REG_LEN +
+				(!csiphy_dev->csiphy_info[index].csiphy_3phase) *
+					CAM_CSIPHY_MAX_CPHY_LANES);
+
+	CAM_DBG(CAM_CSIPHY, "CSIPHY_idx:%d, cp_reg_mask:0x%llx",
+		csiphy_dev->soc_info.index,
+		csiphy_dev->csiphy_info[index].csiphy_cpas_cp_reg_mask);
+
+	return 0;
+}
+
+static int cam_csiphy_get_lane_enable(
+	struct csiphy_device *csiphy, int index,
+	uint16_t lane_assign, uint32_t *lane_enable)
+{
+	uint32_t lane_select = 0;
+
+	if (csiphy->csiphy_info[index].csiphy_3phase) {
+		CAM_DBG(CAM_CSIPHY, "LaneEnable for CPHY");
+		switch (lane_assign & 0xF) {
+		case 0x0:
+			lane_select |= CPHY_LANE_0;
+			break;
+		case 0x1:
+			lane_select |= CPHY_LANE_1;
+			break;
+		case 0x2:
+			lane_select |= CPHY_LANE_2;
+			break;
+		default:
+			CAM_ERR(CAM_CSIPHY,
+				"Wrong lane configuration for CPHY : %d",
+				lane_assign);
+			*lane_enable = 0;
+			return -EINVAL;
+		}
+	} else {
+		CAM_DBG(CAM_CSIPHY, "LaneEnable for DPHY");
+		switch (lane_assign & 0xF) {
+		case 0x0:
+			lane_select |= DPHY_LANE_0;
+			lane_select |= DPHY_CLK_LN;
+			break;
+		case 0x1:
+			lane_select |= DPHY_LANE_1;
+			lane_select |= DPHY_CLK_LN;
+			break;
+		case 0x2:
+			lane_select |= DPHY_LANE_2;
+			if (csiphy->combo_mode)
+				lane_select |= DPHY_LANE_3;
+			else
+				lane_select |= DPHY_CLK_LN;
+			break;
+		case 0x3:
+			if (csiphy->combo_mode) {
+				CAM_ERR(CAM_CSIPHY,
+					"Wrong lane configuration for DPHYCombo: %d",
+					lane_assign);
+				*lane_enable = 0;
+				return -EINVAL;
+			}
+			lane_select |= DPHY_LANE_3;
+			lane_select |= DPHY_CLK_LN;
+			break;
+		default:
+			CAM_ERR(CAM_CSIPHY,
+				"Wrong lane configuration for DPHY: %d",
+				lane_assign);
+			*lane_enable = 0;
+			return -EINVAL;
+		}
+	}
+
+	*lane_enable = lane_select;
+	CAM_DBG(CAM_CSIPHY, "Lane_select: 0x%x", lane_select);
+
+	return 0;
+}
+
+static int cam_csiphy_sanitize_lane_cnt(
+	struct csiphy_device *csiphy_dev,
+	int32_t index, uint8_t lane_cnt)
+{
+	uint8_t max_supported_lanes = 0;
+
+	if (csiphy_dev->combo_mode) {
+		if (csiphy_dev->csiphy_info[index].csiphy_3phase)
+			max_supported_lanes = 1;
+		else
+			max_supported_lanes = 2;
+	} else if (csiphy_dev->cphy_dphy_combo_mode) {
+		/* 2DPHY + 1CPHY or 2CPHY + 1DPHY */
+		if (csiphy_dev->csiphy_info[index].csiphy_3phase)
+			max_supported_lanes = 2;
+		else
+			max_supported_lanes = 2;
+	} else {
+		/* Mission Mode */
+		if (csiphy_dev->csiphy_info[index].csiphy_3phase)
+			max_supported_lanes = 3;
+		else
+			max_supported_lanes = 4;
+	}
+
+	if (lane_cnt <= 0 || lane_cnt > max_supported_lanes) {
+		CAM_ERR(CAM_CSIPHY,
+			"wrong lane_cnt configuration: expected max lane_cnt: %u received lane_cnt: %u",
+			max_supported_lanes, lane_cnt);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int __cam_csiphy_parse_lane_info_cmd_buf(
+	int32_t dev_handle,
+	struct csiphy_device *csiphy_dev,
+	struct cam_cmd_buf_desc *cmd_desc)
+{
+	int index, rc = 0;
+	uint8_t lane_cnt = 0;
+	uint32_t lane_enable = 0;
+	uint16_t lane_assign = 0, preamble_en = 0;
+	uintptr_t generic_ptr;
+	uint32_t *cmd_buf = NULL;
+	size_t len;
+	rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+		&generic_ptr, &len);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY,
+			"Failed to get cmd buf mem address : %d", rc);
+		return rc;
+	}
+
+	cmd_buf = (uint32_t *)generic_ptr;
+	cmd_buf += cmd_desc->offset / 4;
+	index = cam_csiphy_get_instance_offset(csiphy_dev, dev_handle);
+	if (index < 0 || index >= csiphy_dev->session_max_device_support) {
+		CAM_ERR(CAM_CSIPHY, "index in invalid: %d", index);
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+
+	if (cmd_desc->meta_data == CAM_CSIPHY_PACKET_META_LANE_INFO_V2) {
+		struct cam_csiphy_info_v2 *cam_cmd_csiphy_info_v2 = NULL;
+
+		if ((len < sizeof(struct cam_csiphy_info_v2)) ||
+			(cmd_desc->offset > (len - sizeof(struct cam_csiphy_info_v2)))) {
+			CAM_ERR(CAM_CSIPHY,
+				"Not enough buffer provided for cam_csiphy_info");
+			rc = -EINVAL;
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			return rc;
+		}
+
+		cam_cmd_csiphy_info_v2 = (struct cam_csiphy_info_v2 *)cmd_buf;
+		rc = cam_csiphy_sanitize_lane_cnt(csiphy_dev, index,
+			cam_cmd_csiphy_info_v2->lane_cnt);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "Wrong configuration lane_cnt: %u",
+				cam_cmd_csiphy_info_v2->lane_cnt);
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			return rc;
+		}
+
+		preamble_en = (cam_cmd_csiphy_info_v2->mipi_flags &
+			PREAMBLE_PATTEN_CAL_MASK);
+
+		csiphy_dev->csiphy_info[index].lane_cnt =
+			cam_cmd_csiphy_info_v2->lane_cnt;
+		csiphy_dev->csiphy_info[index].lane_assign =
+			cam_cmd_csiphy_info_v2->lane_assign;
+		csiphy_dev->csiphy_info[index].settle_time =
+			cam_cmd_csiphy_info_v2->settle_time;
+		csiphy_dev->csiphy_info[index].data_rate =
+			cam_cmd_csiphy_info_v2->data_rate;
+		csiphy_dev->csiphy_info[index].secure_mode =
+			cam_cmd_csiphy_info_v2->secure_mode;
+		csiphy_dev->csiphy_info[index].mipi_flags =
+			(cam_cmd_csiphy_info_v2->mipi_flags & SKEW_CAL_MASK);
+		csiphy_dev->csiphy_info[index].channel_type =
+			cam_cmd_csiphy_info_v2->channel_type;
+	} else if (cmd_desc->meta_data == CAM_CSIPHY_PACKET_META_LANE_INFO) {
+		struct cam_csiphy_info *cam_cmd_csiphy_info = NULL;
+
+		if ((len < sizeof(struct cam_csiphy_info)) ||
+			(cmd_desc->offset > (len - sizeof(struct cam_csiphy_info)))) {
+			CAM_ERR(CAM_CSIPHY,
+				"Not enough buffer provided for cam_csiphy_info");
+			rc = -EINVAL;
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			return rc;
+		}
+
+		cam_cmd_csiphy_info = (struct cam_csiphy_info *)cmd_buf;
+		rc = cam_csiphy_sanitize_lane_cnt(csiphy_dev, index,
+			cam_cmd_csiphy_info->lane_cnt);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "Wrong configuration lane_cnt: %u",
+				cam_cmd_csiphy_info->lane_cnt);
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			return rc;
+		}
+
+		preamble_en = (cam_cmd_csiphy_info->mipi_flags &
+			PREAMBLE_PATTEN_CAL_MASK);
+
+		csiphy_dev->csiphy_info[index].lane_cnt =
+			cam_cmd_csiphy_info->lane_cnt;
+		csiphy_dev->csiphy_info[index].lane_assign =
+			cam_cmd_csiphy_info->lane_assign;
+		csiphy_dev->csiphy_info[index].settle_time =
+			cam_cmd_csiphy_info->settle_time;
+		csiphy_dev->csiphy_info[index].data_rate =
+			cam_cmd_csiphy_info->data_rate;
+		csiphy_dev->csiphy_info[index].secure_mode =
+			cam_cmd_csiphy_info->secure_mode;
+		csiphy_dev->csiphy_info[index].mipi_flags =
+			(cam_cmd_csiphy_info->mipi_flags & SKEW_CAL_MASK);
+		csiphy_dev->csiphy_info[index].channel_type =
+			CAM_CSIPHY_DATARATE_SHORT_CHANNEL;
+	}
+
+	/* Cannot support CPHY combo mode with One sensor setting
+	 * preamble enable and second/third sensor is without
+	 * preamble enable.
+	 */
+	if (csiphy_dev->preamble_enable && !preamble_en &&
+		csiphy_dev->combo_mode &&
+		!csiphy_dev->cphy_dphy_combo_mode) {
+		CAM_ERR(CAM_CSIPHY,
+			"Cannot support %s combo mode with differnt preamble settings",
+			(csiphy_dev->csiphy_info[index].csiphy_3phase ?
+			"CPHY" : "DPHY"));
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+
+	csiphy_dev->preamble_enable = preamble_en;
+	lane_assign = csiphy_dev->csiphy_info[index].lane_assign;
+	lane_cnt = csiphy_dev->csiphy_info[index].lane_cnt;
+
+	while (lane_cnt--) {
+		rc = cam_csiphy_get_lane_enable(csiphy_dev, index,
+			(lane_assign & 0xF), &lane_enable);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "Wrong lane configuration: %d",
+				csiphy_dev->csiphy_info[index].lane_assign);
+			if ((csiphy_dev->combo_mode) ||
+				(csiphy_dev->cphy_dphy_combo_mode)) {
+				CAM_DBG(CAM_CSIPHY,
+					"Resetting error to zero for other devices to configure");
+				rc = 0;
+			}
+			lane_enable = 0;
+			csiphy_dev->csiphy_info[index].lane_enable = lane_enable;
+			goto reset_settings;
+		}
+		csiphy_dev->csiphy_info[index].lane_enable |= lane_enable;
+		lane_assign >>= 4;
+	}
+
+	if (csiphy_dev->csiphy_info[index].secure_mode == 1) {
+		rc = cam_csiphy_update_secure_info(csiphy_dev, index);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY,
+				"Secure info configuration failed for index: %d", index);
+			goto reset_settings;
+		}
+	}
+
+	CAM_DBG(CAM_CSIPHY,
+		"phy version:%d, phy_idx: %d, preamble_en: %u",
+		csiphy_dev->hw_version,
+		csiphy_dev->soc_info.index,
+		csiphy_dev->preamble_enable);
+	CAM_DBG(CAM_CSIPHY,
+		"3phase:%d, combo mode:%d, secure mode:%d",
+		csiphy_dev->csiphy_info[index].csiphy_3phase,
+		csiphy_dev->combo_mode,
+		csiphy_dev->csiphy_info[index].secure_mode);
+	CAM_DBG(CAM_CSIPHY,
+		"lane_cnt: 0x%x, lane_assign: 0x%x, lane_enable: 0x%x, settle time:%llu, datarate:%llu",
+		csiphy_dev->csiphy_info[index].lane_cnt,
+		csiphy_dev->csiphy_info[index].lane_assign,
+		csiphy_dev->csiphy_info[index].lane_enable,
+		csiphy_dev->csiphy_info[index].settle_time,
+		csiphy_dev->csiphy_info[index].data_rate);
+
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+
+reset_settings:
+	cam_csiphy_reset_phyconfig_param(csiphy_dev, index);
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+static int __cam_csiphy_handle_cdr_sweep_info(
+	struct csiphy_device               *csiphy_dev,
+	struct cam_csiphy_cdr_sweep_params *cdr_sweep_params)
+{
+	if (cdr_sweep_params->tolerance_op_type != CAM_CSIPHY_CDR_ADD_TOLERANCE &&
+		cdr_sweep_params->tolerance_op_type != CAM_CSIPHY_CDR_SUB_TOLERANCE) {
+		CAM_ERR(CAM_CSIPHY, "Invalid tolerance op type: %u",
+			cdr_sweep_params->tolerance_op_type);
+		return -EINVAL;
+	}
+
+	csiphy_dev->cdr_params.cdr_tolerance = cdr_sweep_params->cdr_tolerance;
+	csiphy_dev->cdr_params.tolerance_op_type = cdr_sweep_params->tolerance_op_type;
+	csiphy_dev->cdr_params.cdr_config_ptr =
+		(uint32_t *)&cdr_sweep_params->configured_cdr;
+	csiphy_dev->cdr_params.cdr_sweep_enabled = true;
+
+	CAM_DBG(CAM_CSIPHY,
+		"CSIPHY:%u cdr sweep with tolerance: %u op_type: %u cpu_addr: %pK enabled",
+		csiphy_dev->soc_info.index, csiphy_dev->cdr_params.cdr_tolerance,
+		csiphy_dev->cdr_params.tolerance_op_type,
+		csiphy_dev->cdr_params.cdr_config_ptr);
+
+	return 0;
+}
+
+static int __cam_csiphy_handle_aux_mem_buffer(
+	struct csiphy_device                  *csiphy_dev,
+	struct cam_csiphy_aux_settings_params *aux_setting_params)
+{
+	if (aux_setting_params->data_rate_aux_mask)
+		g_phy_data[csiphy_dev->soc_info.index].data_rate_aux_mask |=
+			aux_setting_params->data_rate_aux_mask;
+
+	csiphy_dev->aux_params.aux_mem_update_en = true;
+	csiphy_dev->aux_params.aux_config_ptr =
+		(uint32_t *)&aux_setting_params->data_rate_aux_mask;
+
+	CAM_DBG(CAM_CSIPHY,
+		"CSIPHY:%u aux setting buffer provided addr: %pK provided_mask: 0x%llx current_mask :0x%llx",
+		csiphy_dev->soc_info.index, csiphy_dev->aux_params.aux_config_ptr,
+		aux_setting_params->data_rate_aux_mask,
+		g_phy_data[csiphy_dev->soc_info.index].data_rate_aux_mask);
+
+	return 0;
+}
+
+static int32_t __cam_csiphy_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	int rc = 0;
+	struct csiphy_device *csiphy_dev =
+		(struct csiphy_device *)user_data;
+
+	if (!blob_data || (blob_size == 0)) {
+		CAM_ERR(CAM_CSIPHY, "Invalid blob info %pK %u", blob_data,
+			blob_size);
+		return -EINVAL;
+	}
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "Invalid user data");
+		return -EINVAL;
+	}
+
+	switch (blob_type) {
+	case CAM_CSIPHY_GENERIC_BLOB_TYPE_CDR_CONFIG: {
+		struct cam_csiphy_cdr_sweep_params *cdr_sweep_params =
+			(struct cam_csiphy_cdr_sweep_params *)blob_data;
+
+		if (blob_size < sizeof(struct cam_csiphy_cdr_sweep_params)) {
+			CAM_ERR(CAM_CSIPHY, "Invalid blob size expected: 0x%x actual: 0x%x",
+				sizeof(struct cam_csiphy_cdr_sweep_params), blob_size);
+			return -EINVAL;
+		}
+
+		rc = __cam_csiphy_handle_cdr_sweep_info(csiphy_dev, cdr_sweep_params);
+		break;
+	}
+	case CAM_CSIPHY_GENERIC_BLOB_TYPE_AUX_CONFIG: {
+		struct cam_csiphy_aux_settings_params *aux_setting_params =
+			(struct cam_csiphy_aux_settings_params *)blob_data;
+
+		if (blob_size < sizeof(struct cam_csiphy_aux_settings_params)) {
+			CAM_ERR(CAM_CSIPHY, "Invalid blob size expected: 0x%x actual: 0x%x",
+				sizeof(struct cam_csiphy_aux_settings_params), blob_size);
+			return -EINVAL;
+		}
+
+		rc = __cam_csiphy_handle_aux_mem_buffer(csiphy_dev, aux_setting_params);
+		break;
+	}
+	default:
+		CAM_WARN(CAM_CSIPHY, "Invalid blob type %d", blob_type);
+		break;
+	}
+
+	return rc;
+}
+
+int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
+	struct cam_config_dev_cmd *cfg_dev)
+{
+	int                      rc = 0, i;
+	uintptr_t                generic_pkt_ptr;
+	struct cam_packet       *csl_packet = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	size_t                   len, remain_len;
+	uint32_t                 cmd_buf_type;
+
+
+	if (!cfg_dev || !csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "Invalid Args");
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf((int32_t) cfg_dev->packet_handle,
+		&generic_pkt_ptr, &len);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "Failed to get packet Mem address: %d", rc);
+		return rc;
+	}
+
+	remain_len = len;
+	if ((sizeof(struct cam_packet) > len) ||
+		((size_t)cfg_dev->offset >= len - sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_CSIPHY,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len);
+		cam_mem_put_cpu_buf(cfg_dev->packet_handle);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	remain_len -= (size_t)cfg_dev->offset;
+	csl_packet = (struct cam_packet *)
+		(generic_pkt_ptr + (uint32_t)cfg_dev->offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_CSIPHY, "Invalid packet params");
+		cam_mem_put_cpu_buf(cfg_dev->packet_handle);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (csl_packet->num_cmd_buf)
+		cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint32_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset / 4);
+	else {
+		CAM_ERR(CAM_CSIPHY, "num_cmd_buffer = %d", csl_packet->num_cmd_buf);
+		cam_mem_put_cpu_buf(cfg_dev->packet_handle);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	CAM_DBG(CAM_CSIPHY, "CSIPHY:%u num cmd buffers received: %u",
+		csiphy_dev->soc_info.index, csl_packet->num_cmd_buf);
+
+	for (i = 0; i < csl_packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc) {
+			cam_mem_put_cpu_buf(cfg_dev->packet_handle);
+			return rc;
+		}
+
+		cmd_buf_type = cmd_desc[i].meta_data;
+
+		CAM_DBG(CAM_CSIPHY, "CSIPHY:%u cmd_buffer_%d type: %u",
+			csiphy_dev->soc_info.index, i, cmd_buf_type);
+
+		switch (cmd_buf_type) {
+		case CAM_CSIPHY_PACKET_META_LANE_INFO:
+			rc = __cam_csiphy_parse_lane_info_cmd_buf(
+				cfg_dev->dev_handle, csiphy_dev, &cmd_desc[i]);
+			break;
+		case CAM_CSIPHY_PACKET_META_LANE_INFO_V2:
+			rc = __cam_csiphy_parse_lane_info_cmd_buf(
+				cfg_dev->dev_handle, csiphy_dev, &cmd_desc[i]);
+			break;
+		case CAM_CSIPHY_PACKET_META_GENERIC_BLOB:
+			rc =  cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+				__cam_csiphy_generic_blob_handler, csiphy_dev);
+			break;
+		default:
+			CAM_WARN(CAM_CSIPHY,
+				"Invalid meta type: %u", cmd_buf_type);
+			break;
+		}
+
+		if (rc)
+			break;
+	}
+	cam_mem_put_cpu_buf(cfg_dev->packet_handle);
+	return rc;
+}
+
+void cam_csiphy_cphy_irq_config(struct csiphy_device *csiphy_dev)
+{
+	int32_t                        i;
+	struct csiphy_reg_t           *csiphy_irq_reg;
+	uint32_t num_of_irq_status_regs = 0;
+
+	void __iomem *csiphybase =
+		csiphy_dev->soc_info.reg_map[0].mem_base;
+
+	num_of_irq_status_regs =
+		csiphy_dev->ctrl_reg->csiphy_reg->csiphy_interrupt_status_size;
+
+	for (i = 0; i < num_of_irq_status_regs; i++) {
+		csiphy_irq_reg = &csiphy_dev->ctrl_reg->csiphy_irq_reg[i];
+		cam_io_w_mb(csiphy_irq_reg->reg_data,
+			csiphybase + csiphy_irq_reg->reg_addr);
+
+		if (csiphy_irq_reg->delay)
+			usleep_range(csiphy_irq_reg->delay,
+				csiphy_irq_reg->delay + 5);
+	}
+}
+
+void cam_csiphy_cphy_irq_disable(struct csiphy_device *csiphy_dev)
+{
+	int32_t i;
+	void __iomem *csiphybase =
+		csiphy_dev->soc_info.reg_map[0].mem_base;
+	uint32_t num_of_irq_status_regs = 0;
+
+	num_of_irq_status_regs =
+		csiphy_dev->ctrl_reg->csiphy_reg->csiphy_interrupt_status_size;
+
+	for (i = 0; i < num_of_irq_status_regs; i++)
+		cam_io_w_mb(0x0, csiphybase +
+			csiphy_dev->ctrl_reg->csiphy_irq_reg[i].reg_addr);
+}
+
+irqreturn_t cam_csiphy_irq(int irq_num, void *data)
+{
+	struct csiphy_device *csiphy_dev =
+		(struct csiphy_device *)data;
+	struct csiphy_reg_parms_t *csiphy_reg = NULL;
+	void __iomem *base = NULL;
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "Invalid Args");
+		return IRQ_NONE;
+	}
+
+	base = csiphy_dev->soc_info.reg_map[0].mem_base;
+	csiphy_reg = csiphy_dev->ctrl_reg->csiphy_reg;
+
+	if (csiphy_dev->en_common_status_reg_dump) {
+		cam_csiphy_common_status_reg_dump(csiphy_dev);
+		cam_io_w_mb(0x1, base + csiphy_reg->mipi_csiphy_glbl_irq_cmd_addr);
+		cam_io_w_mb(0x0, base + csiphy_reg->mipi_csiphy_glbl_irq_cmd_addr);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static inline void __cam_csiphy_compute_cdr_value(
+	int32_t *cdr_val, struct csiphy_device *csiphy_device)
+{
+	if (csiphy_device->cdr_params.tolerance_op_type ==
+		CAM_CSIPHY_CDR_ADD_TOLERANCE)
+		*cdr_val += csiphy_device->cdr_params.cdr_tolerance;
+	else
+		*cdr_val -= csiphy_device->cdr_params.cdr_tolerance;
+}
+
+static int cam_csiphy_cphy_data_rate_config(struct csiphy_device *csiphy_device, int32_t idx,
+	uint8_t datarate_variant_idx)
+{
+	int i;
+	unsigned int data_rate_idx;
+	uint64_t required_phy_data_rate;
+	void __iomem *csiphybase;
+	ssize_t num_data_rates;
+	struct data_rate_settings_t *settings_table;
+	uint64_t intermediate_var = 0;
+	uint16_t settle_cnt = 0;
+	uint32_t reg_addr, reg_data, reg_param_type;
+	int32_t  delay;
+	struct csiphy_reg_t *config_params;
+	uint8_t csiphy_index = 0;
+	uint32_t channel_type;
+
+	if ((csiphy_device == NULL) || (csiphy_device->ctrl_reg == NULL)) {
+		CAM_ERR(CAM_CSIPHY, "Device is NULL");
+		return -EINVAL;
+	}
+
+	if (csiphy_device->ctrl_reg->data_rates_settings_table == NULL) {
+		CAM_DBG(CAM_CSIPHY,
+			"Data rate specific register table not available");
+		return 0;
+	}
+
+	if (csiphy_device->soc_info.index >= MAX_CSIPHY) {
+		CAM_ERR(CAM_CSIPHY, "soc_info.index:%d >= MAX_CSIPHY:%d ",
+			csiphy_device->soc_info.index, MAX_CSIPHY);
+		return -EINVAL;
+	}
+
+	required_phy_data_rate = csiphy_device->csiphy_info[idx].data_rate;
+	csiphybase = csiphy_device->soc_info.reg_map[0].mem_base;
+	settings_table = csiphy_device->ctrl_reg->data_rates_settings_table;
+	num_data_rates = settings_table->num_data_rate_settings;
+
+	intermediate_var = csiphy_device->csiphy_info[idx].settle_time;
+	do_div(intermediate_var, 200000000);
+	settle_cnt = intermediate_var;
+	csiphy_index = csiphy_device->soc_info.index;
+	channel_type = csiphy_device->csiphy_info[idx].channel_type;
+
+	CAM_DBG(CAM_CSIPHY, "required data rate : %llu", required_phy_data_rate);
+	for (data_rate_idx = 0; data_rate_idx < num_data_rates; data_rate_idx++) {
+		struct data_rate_reg_info_t *drate_settings = settings_table->data_rate_settings;
+		uint64_t supported_phy_bw = drate_settings[data_rate_idx].bandwidth;
+		ssize_t  num_reg_entries = drate_settings[data_rate_idx].data_rate_reg_array_size;
+		struct csiphy_reg_t **drate_reg_array =
+			drate_settings[data_rate_idx].data_rate_reg_array[csiphy_index];
+
+		if ((required_phy_data_rate > supported_phy_bw) &&
+			(data_rate_idx < (num_data_rates - 1))) {
+			CAM_DBG(CAM_CSIPHY,
+				"Skipping table [%d] with BW: %llu, Required data_rate: %llu",
+				data_rate_idx, supported_phy_bw, required_phy_data_rate);
+			continue;
+		}
+
+		CAM_DBG(CAM_CSIPHY, "table[%d] BW : %llu Selected",
+			data_rate_idx, supported_phy_bw);
+
+		if (datarate_variant_idx >= CAM_CSIPHY_MAX_DATARATE_VARIANTS) {
+			CAM_ERR(CAM_CSIPHY, "Datarate variant Idx: %u can not exceed %u",
+				datarate_variant_idx, CAM_CSIPHY_MAX_DATARATE_VARIANTS-1);
+			return -EINVAL;
+		}
+
+		config_params = drate_reg_array[datarate_variant_idx];
+		if (!config_params) {
+			CAM_ERR(CAM_CSIPHY, "Datarate settings are null. datarate variant idx: %u",
+				datarate_variant_idx);
+			return -EINVAL;
+		}
+
+		for (i = 0; i < num_reg_entries; i++) {
+			reg_addr = config_params[i].reg_addr;
+			reg_data = config_params[i].reg_data;
+			reg_param_type = config_params[i].csiphy_param_type;
+			delay = config_params[i].delay;
+			CAM_DBG(CAM_CSIPHY,
+				"param_type: %d writing reg : %x val : %x delay: %dus",
+				reg_param_type, reg_addr, reg_data,
+				delay);
+			switch (reg_param_type) {
+			case CSIPHY_DEFAULT_PARAMS:
+				cam_io_w_mb(reg_data,
+					csiphybase + reg_addr);
+			break;
+			case CSIPHY_SHORT_CHANNEL_PARAMS:
+				if (channel_type == CAM_CSIPHY_DATARATE_SHORT_CHANNEL)
+					cam_io_w_mb(reg_data,
+						csiphybase + reg_addr);
+			break;
+			case CSIPHY_STANDARD_CHANNEL_PARAMS:
+				if (channel_type == CAM_CSIPHY_DATARATE_STANDARD_CHANNEL)
+					cam_io_w_mb(reg_data,
+						csiphybase + reg_addr);
+			break;
+			case CSIPHY_SETTLE_CNT_LOWER_BYTE:
+				cam_io_w_mb(settle_cnt & 0xFF,
+					csiphybase + reg_addr);
+			break;
+			case CSIPHY_SETTLE_CNT_HIGHER_BYTE:
+				cam_io_w_mb((settle_cnt >> 8) & 0xFF,
+					csiphybase + reg_addr);
+			break;
+			case CSIPHY_AUXILIARY_SETTING: {
+				uint32_t phy_idx = csiphy_device->soc_info.index;
+
+				if (g_phy_data[phy_idx].data_rate_aux_mask &
+					BIT_ULL(data_rate_idx)) {
+					cam_io_w_mb(reg_data, csiphybase + reg_addr);
+					CAM_DBG(CAM_CSIPHY,
+						"CSIPHY: %u configuring new aux setting reg_addr: 0x%x reg_val: 0x%x",
+						csiphy_device->soc_info.index, reg_addr, reg_data);
+				}
+			}
+			break;
+			default:
+				CAM_DBG(CAM_CSIPHY, "Do Nothing");
+			break;
+			}
+
+			if ((reg_param_type ==
+				(CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS) &&
+				(channel_type == CAM_CSIPHY_DATARATE_SHORT_CHANNEL)) ||
+				(reg_param_type ==
+				(CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS) &&
+				(channel_type == CAM_CSIPHY_DATARATE_STANDARD_CHANNEL)) ||
+				reg_param_type == CSIPHY_CDR_LN_SETTINGS) {
+				int32_t cdr_val = reg_data;
+				struct cam_csiphy_dev_cdr_sweep_params *cdr_params =
+					&csiphy_device->cdr_params;
+
+				if (cdr_params->cdr_sweep_enabled) {
+					__cam_csiphy_compute_cdr_value(&cdr_val, csiphy_device);
+
+					if (cdr_val < 0) {
+						CAM_ERR(CAM_CSIPHY,
+							"CSIPHY: %u invalid CDR tolerance computation, default: 0x%x tolerance: 0x%x op_type: 0x%x",
+							csiphy_device->soc_info.index,
+							reg_data, cdr_params->cdr_tolerance,
+							cdr_params->tolerance_op_type);
+						return -EINVAL;
+					}
+
+					/* Update userland on configured values */
+					*csiphy_device->cdr_params.cdr_config_ptr = cdr_val;
+				}
+
+				cam_io_w_mb(cdr_val, csiphybase + reg_addr);
+				CAM_DBG(CAM_CSIPHY,
+					"CSIPHY: %u CDR reg_addr: 0x%x reg_val: 0x%x sweep test: %s",
+					csiphy_device->soc_info.index,
+					reg_addr, cdr_val,
+					CAM_BOOL_TO_YESNO(cdr_params->cdr_sweep_enabled));
+			}
+
+			if (delay > 0)
+				usleep_range(delay, delay + 5);
+		}
+
+		csiphy_device->curr_data_rate_idx = data_rate_idx;
+		break;
+	}
+
+	return 0;
+}
+
+static int __cam_csiphy_prgm_bist_reg(struct csiphy_device *csiphy_dev, bool is_3phase)
+{
+	int i;
+	int bist_arr_size;
+	struct csiphy_reg_t *csiphy_common_reg;
+	void __iomem *csiphybase;
+
+	csiphybase = csiphy_dev->soc_info.reg_map[0].mem_base;
+
+	if (is_3phase) {
+		csiphy_common_reg = csiphy_dev->ctrl_reg->csiphy_bist_reg->bist_3ph_settings_arry;
+		bist_arr_size = csiphy_dev->ctrl_reg->csiphy_bist_reg->num_3ph_bist_settings;
+	} else {
+		csiphy_common_reg = csiphy_dev->ctrl_reg->csiphy_bist_reg->bist_2ph_settings_arry;
+		bist_arr_size = csiphy_dev->ctrl_reg->csiphy_bist_reg->num_2ph_bist_settings;
+	}
+
+	if (!csiphy_common_reg) {
+		CAM_DBG(CAM_CSIPHY, "No Bist Settings available for %s",
+			(is_3phase) ? "CPHY" : "DPHY");
+		return 0;
+	}
+
+	for (i = 0; i < bist_arr_size; i++) {
+		cam_io_w_mb(csiphy_common_reg[i].reg_data,
+			csiphybase + csiphy_common_reg[i].reg_addr);
+
+		if (csiphy_common_reg[i].delay)
+			usleep_range(csiphy_common_reg[i].delay, csiphy_common_reg[i].delay + 5);
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_SECURE_CAMERA
+static int cam_csiphy_program_secure_mode(struct csiphy_device *csiphy_dev,
+	bool protect, int32_t offset)
+{
+	int rc = 0;
+
+	if (csiphy_dev->domain_id_security) {
+		if (!csiphy_dev->csiphy_info[offset].secure_info_updated) {
+			CAM_ERR(CAM_CSIPHY,
+				"PHY[%u] domain id info not updated, aborting secure call",
+				csiphy_dev->soc_info.index);
+
+			return -EINVAL;
+		}
+
+		rc = cam_cpas_enable_clks_for_domain_id(true);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "Failed to enable the Domain ID clocks");
+			return rc;
+		}
+	}
+
+	rc = cam_csiphy_notify_secure_mode(csiphy_dev, protect, offset);
+
+	if (csiphy_dev->domain_id_security) {
+		if (cam_cpas_enable_clks_for_domain_id(false))
+			CAM_ERR(CAM_CSIPHY, "Failed to disable the Domain ID clocks");
+
+		if (!protect)
+			csiphy_dev->csiphy_info[offset].secure_info_updated = false;
+	}
+
+	return rc;
+}
+#endif
+
+int32_t cam_csiphy_config_dev(struct csiphy_device *csiphy_dev,
+	int32_t dev_handle, uint8_t datarate_variant_idx)
+{
+	int32_t      rc = 0;
+	uint32_t     lane_enable = 0;
+	uint16_t     i = 0, cfg_size = 0;
+	uint16_t     settle_cnt = 0;
+	uint8_t      skew_cal_enable = 0;
+	uint64_t     intermediate_var;
+	int          index;
+	void __iomem *csiphybase;
+	struct csiphy_reg_t *reg_array;
+	struct csiphy_reg_parms_t *csiphy_reg;
+	bool         is_3phase = false;
+
+	csiphybase = csiphy_dev->soc_info.reg_map[0].mem_base;
+
+	CAM_DBG(CAM_CSIPHY, "ENTER");
+	if (!csiphybase) {
+		CAM_ERR(CAM_CSIPHY, "csiphybase NULL");
+		return -EINVAL;
+	}
+
+	index = cam_csiphy_get_instance_offset(csiphy_dev, dev_handle);
+	if (index < 0 || index >= csiphy_dev->session_max_device_support) {
+		CAM_ERR(CAM_CSIPHY, "index is invalid: %d", index);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CSIPHY,
+		"Index: %d: expected dev_hdl: 0x%x : derived dev_hdl: 0x%x",
+		index, dev_handle,
+		csiphy_dev->csiphy_info[index].hdl_data.device_hdl);
+
+	if (csiphy_dev->csiphy_info[index].csiphy_3phase)
+		is_3phase = true;
+
+	csiphy_reg = csiphy_dev->ctrl_reg->csiphy_reg;
+	if (csiphy_dev->combo_mode) {
+		/* for CPHY(3Phase) or DPHY(2Phase) combo mode selection */
+		if (is_3phase) {
+			/* CPHY combo mode */
+			if (csiphy_dev->ctrl_reg->csiphy_3ph_combo_reg) {
+				reg_array = csiphy_dev->ctrl_reg->csiphy_3ph_combo_reg;
+				cfg_size = csiphy_reg->csiphy_3ph_combo_config_array_size;
+			} else {
+				CAM_WARN(CAM_CSIPHY, "CPHY combo mode reg settings not found");
+				reg_array = csiphy_dev->ctrl_reg->csiphy_3ph_reg;
+				cfg_size = csiphy_reg->csiphy_3ph_config_array_size;
+			}
+		} else {
+			/* DPHY combo mode*/
+			if (csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg) {
+				reg_array = csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg;
+				cfg_size = csiphy_reg->csiphy_2ph_combo_config_array_size;
+			} else {
+				CAM_WARN(CAM_CSIPHY, "DPHY combo mode reg settings not found");
+				reg_array = csiphy_dev->ctrl_reg->csiphy_2ph_reg;
+				cfg_size = csiphy_reg->csiphy_2ph_config_array_size;
+			}
+
+		}
+	} else if (csiphy_dev->cphy_dphy_combo_mode) {
+		/* for CPHY and DPHY combo mode selection */
+		if (csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg) {
+			reg_array = csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg;
+			cfg_size = csiphy_reg->csiphy_2ph_3ph_config_array_size;
+		} else {
+			reg_array = csiphy_dev->ctrl_reg->csiphy_3ph_reg;
+			cfg_size = csiphy_reg->csiphy_3ph_config_array_size;
+			CAM_WARN(CAM_CSIPHY,
+					"Unsupported configuration, Falling back to CPHY mission mode");
+		}
+	} else {
+		/* for CPHY(3Phase) or DPHY(2Phase) Non combe mode selection */
+		if (is_3phase) {
+			CAM_DBG(CAM_CSIPHY,
+				"3phase Non combo mode reg array selected");
+			reg_array = csiphy_dev->ctrl_reg->csiphy_3ph_reg;
+			cfg_size = csiphy_reg->csiphy_3ph_config_array_size;
+		} else {
+			CAM_DBG(CAM_CSIPHY,
+				"2PHASE Non combo mode reg array selected");
+			reg_array = csiphy_dev->ctrl_reg->csiphy_2ph_reg;
+			cfg_size = csiphy_reg->csiphy_2ph_config_array_size;
+		}
+	}
+
+	lane_enable = csiphy_dev->csiphy_info[index].lane_enable;
+
+	if (csiphy_dev->csiphy_info[index].csiphy_3phase) {
+		rc = cam_csiphy_cphy_data_rate_config(csiphy_dev, index, datarate_variant_idx);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY,
+				"Date rate specific configuration failed rc: %d",
+				rc);
+			return rc;
+		}
+	}
+
+	csiphy_dev->lanes_enabled = lane_enable;
+	intermediate_var = csiphy_dev->csiphy_info[index].settle_time;
+	do_div(intermediate_var, 200000000);
+	settle_cnt = intermediate_var;
+	skew_cal_enable = csiphy_dev->csiphy_info[index].mipi_flags;
+
+	for (i = 0; i < cfg_size; i++) {
+		switch (reg_array[i].csiphy_param_type) {
+		case CSIPHY_LANE_ENABLE:
+			cam_io_w_mb(lane_enable, csiphybase + reg_array[i].reg_addr);
+		break;
+		case CSIPHY_DEFAULT_PARAMS:
+			cam_io_w_mb(reg_array[i].reg_data, csiphybase + reg_array[i].reg_addr);
+		break;
+		case CSIPHY_SETTLE_CNT_LOWER_BYTE:
+			cam_io_w_mb(settle_cnt & 0xFF, csiphybase + reg_array[i].reg_addr);
+		break;
+		case CSIPHY_SETTLE_CNT_HIGHER_BYTE:
+			cam_io_w_mb((settle_cnt >> 8) & 0xFF, csiphybase + reg_array[i].reg_addr);
+		break;
+		case CSIPHY_SKEW_CAL:
+		if (skew_cal_enable)
+			cam_io_w_mb(reg_array[i].reg_data, csiphybase + reg_array[i].reg_addr);
+		else
+			cam_io_w_mb(0x00, csiphybase + reg_array[i].reg_addr);
+		break;
+		default:
+			CAM_DBG(CAM_CSIPHY, "Do Nothing");
+		break;
+		}
+
+		if (reg_array[i].delay > 0)
+			usleep_range(reg_array[i].delay, reg_array[i].delay + 5);
+	}
+
+	if (csiphy_dev->preamble_enable)
+		__cam_csiphy_prgm_bist_reg(csiphy_dev, is_3phase);
+
+	cam_csiphy_cphy_irq_config(csiphy_dev);
+
+	CAM_DBG(CAM_CSIPHY, "EXIT");
+	return rc;
+}
+
+void cam_csiphy_shutdown(struct csiphy_device *csiphy_dev)
+{
+	struct cam_hw_soc_info *soc_info;
+	struct cam_csiphy_param *param;
+	int32_t i = 0;
+	int rc = 0;
+
+	if (csiphy_dev->csiphy_state == CAM_CSIPHY_INIT)
+		return;
+
+	if (!csiphy_dev->acquire_count && !csiphy_dev->start_dev_count)
+		return;
+
+	if (csiphy_dev->acquire_count >= CSIPHY_MAX_INSTANCES_PER_PHY) {
+		CAM_WARN(CAM_CSIPHY, "acquire count is invalid: %u",
+			csiphy_dev->acquire_count);
+		csiphy_dev->acquire_count =
+			CSIPHY_MAX_INSTANCES_PER_PHY;
+	}
+
+	if ((csiphy_dev->csiphy_state == CAM_CSIPHY_START) ||
+		csiphy_dev->start_dev_count) {
+		soc_info = &csiphy_dev->soc_info;
+
+		for (i = 0; i < csiphy_dev->acquire_count; i++) {
+			param = &csiphy_dev->csiphy_info[i];
+
+#ifdef CONFIG_SECURE_CAMERA
+			if (param->secure_mode)
+				cam_csiphy_program_secure_mode(csiphy_dev,
+					CAM_SECURE_MODE_NON_SECURE, i);
+#endif
+			param->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+
+			if (soc_info->is_clk_drv_en && param->use_hw_client_voting) {
+				rc = cam_soc_util_set_src_clk_rate(soc_info, param->conn_csid_idx,
+					0, 0);
+				if (rc) {
+					CAM_ERR(CAM_CSIPHY,
+						"[%d] Failed in setting clk rate for %d",
+						soc_info->index, param->conn_csid_idx);
+				} else {
+					rc = cam_soc_util_cesta_channel_switch(param->conn_csid_idx,
+						"csiphy_shutdown");
+					if (rc) {
+						CAM_ERR(CAM_CSIPHY,
+							"Failed to apply power states for cesta client:%d rc:%d",
+							param->conn_csid_idx, rc);
+					}
+				}
+			}
+
+			cam_csiphy_reset_phyconfig_param(csiphy_dev, i);
+		}
+
+		if ((csiphy_dev->prgm_cmn_reg_across_csiphy) &&
+			(active_csiphy_hw_cnt > 0)) {
+			mutex_lock(&active_csiphy_cnt_mutex);
+			active_csiphy_hw_cnt--;
+			mutex_unlock(&active_csiphy_cnt_mutex);
+
+			cam_csiphy_program_common_registers(csiphy_dev, true,
+				CAM_CSIPHY_PRGM_ALL);
+		}
+
+		cam_csiphy_reset(csiphy_dev);
+		cam_soc_util_disable_platform_resource(soc_info, CAM_CLK_SW_CLIENT_IDX, true, true);
+		if (g_phy_data[soc_info->index].aon_cam_id == NOT_AON_CAM)
+			cam_cpas_stop(csiphy_dev->cpas_handle);
+
+		csiphy_dev->csiphy_state = CAM_CSIPHY_ACQUIRE;
+	}
+
+	if (csiphy_dev->csiphy_state == CAM_CSIPHY_ACQUIRE) {
+		for (i = 0; i < csiphy_dev->acquire_count; i++) {
+			if (csiphy_dev->csiphy_info[i].hdl_data.device_hdl
+				!= -1)
+				cam_destroy_device_hdl(
+				csiphy_dev->csiphy_info[i]
+				.hdl_data.device_hdl);
+			csiphy_dev->csiphy_info[i].hdl_data.device_hdl = -1;
+			csiphy_dev->csiphy_info[i].hdl_data.session_hdl = -1;
+		}
+	}
+
+	csiphy_dev->ref_count = 0;
+	for (i = 0; i < csiphy_dev->session_max_device_support; i++) {
+		csiphy_dev->lanes_assigned[i].lane_assign = -1;
+		csiphy_dev->lanes_assigned[i].lane_assign_cnt = 0;
+	}
+	csiphy_dev->lanes_enabled = 0x0;
+	csiphy_dev->acquire_count = 0;
+	csiphy_dev->start_dev_count = 0;
+	csiphy_dev->csiphy_state = CAM_CSIPHY_INIT;
+}
+
+static int32_t cam_csiphy_external_cmd(struct csiphy_device *csiphy_dev,
+	struct cam_config_dev_cmd *p_submit_cmd)
+{
+	struct cam_csiphy_info cam_cmd_csiphy_info;
+	int32_t rc = 0;
+	int32_t  index = -1;
+
+	if (copy_from_user(&cam_cmd_csiphy_info,
+		u64_to_user_ptr(p_submit_cmd->packet_handle),
+		sizeof(struct cam_csiphy_info))) {
+		CAM_ERR(CAM_CSIPHY, "failed to copy cam_csiphy_info\n");
+		rc = -EFAULT;
+	} else {
+		index = cam_csiphy_get_instance_offset(csiphy_dev,
+			p_submit_cmd->dev_handle);
+		if (index < 0 ||
+			index >= csiphy_dev->session_max_device_support) {
+			CAM_ERR(CAM_CSIPHY, "index is invalid: %d", index);
+			return -EINVAL;
+		}
+
+		csiphy_dev->csiphy_info[index].lane_cnt =
+			cam_cmd_csiphy_info.lane_cnt;
+		csiphy_dev->csiphy_info[index].lane_assign =
+			cam_cmd_csiphy_info.lane_assign;
+		csiphy_dev->csiphy_info[index].settle_time =
+			cam_cmd_csiphy_info.settle_time;
+		csiphy_dev->csiphy_info[index].data_rate =
+			cam_cmd_csiphy_info.data_rate;
+		CAM_DBG(CAM_CSIPHY,
+			"%s CONFIG_DEV_EXT settle_time= %lld lane_cnt=%d",
+			__func__,
+			csiphy_dev->csiphy_info[index].settle_time,
+			csiphy_dev->csiphy_info[index].lane_cnt);
+	}
+
+	return rc;
+}
+
+static int cam_csiphy_update_lane_selection(struct csiphy_device *csiphy, int index, bool enable)
+{
+	uint32_t lane_enable;
+	void __iomem *base_address;
+	int32_t lane_reg_addr;
+	int32_t delay;
+
+	base_address = csiphy->soc_info.reg_map[0].mem_base;
+	lane_reg_addr = csiphy->ctrl_reg->csiphy_lane_config_reg->reg_addr;
+	delay = csiphy->ctrl_reg->csiphy_lane_config_reg->delay;
+
+	lane_enable = cam_io_r(base_address + lane_reg_addr);
+
+	if (enable)
+		lane_enable |= csiphy->csiphy_info[index].lane_enable;
+	else
+		lane_enable &= ~csiphy->csiphy_info[index].lane_enable;
+
+	csiphy->lanes_enabled = lane_enable;
+
+	CAM_INFO(CAM_CSIPHY, "lane_reg_addr: 0x%x, lane_assign: 0x%x, lane_enable: 0x%x, delay: %d",
+		lane_reg_addr, csiphy->csiphy_info[index].lane_assign, lane_enable, delay);
+
+	cam_io_w_mb(lane_enable, base_address + lane_reg_addr);
+
+	if (delay)
+		usleep_range(delay, delay + 5);
+
+	return 0;
+}
+
+static void cam_csiphy_update_lane_assign_info(
+	struct csiphy_device *csiphy, int index, bool enable)
+{
+	int i = 0;
+
+	CAM_DBG(CAM_CSIPHY,
+		"acquire_cnt: %d phy_idx: %d offset: %d lane_assign: 0x%x, lanes_enabled: 0x%x max_dev_support: %d",
+		csiphy->acquire_count,
+		csiphy->soc_info.index,
+		index,
+		csiphy->csiphy_info[index].lane_assign,
+		csiphy->lanes_enabled,
+		csiphy->session_max_device_support);
+
+	if (enable) {
+		for (i = 0; i < csiphy->session_max_device_support; i++) {
+			if (csiphy->lanes_assigned[i].lane_assign
+				== csiphy->csiphy_info[index].lane_assign){
+				csiphy->lanes_assigned[i].lane_assign_cnt++;
+				break;
+			}
+		}
+		if (i == csiphy->session_max_device_support) {
+			for (i = 0; i < csiphy->session_max_device_support; i++) {
+				if (csiphy->lanes_assigned[i].lane_assign_cnt == 0) {
+					csiphy->lanes_assigned[i].lane_assign =
+						csiphy->csiphy_info[index].lane_assign;
+					csiphy->lanes_assigned[i].lane_assign_cnt++;
+					break;
+				}
+			}
+		}
+	} else {
+		for (i = 0; i < csiphy->session_max_device_support; i++) {
+			if (csiphy->lanes_assigned[i].lane_assign
+				== csiphy->csiphy_info[index].lane_assign) {
+				csiphy->lanes_assigned[i].lane_assign_cnt--;
+				if (csiphy->lanes_assigned[i].lane_assign_cnt == 0) {
+					csiphy->lanes_assigned[i].lane_assign = -1;
+					cam_csiphy_update_lane_selection(csiphy, index, false);
+				}
+				break;
+			}
+		}
+	}
+
+
+	if (i < csiphy->session_max_device_support && i >= 0) {
+		CAM_DBG(CAM_CSIPHY,
+			"lane_assign_cnt: 0%d, lane_assign: 0x%x, lanes_enabled: 0x%x",
+			csiphy->lanes_assigned[i].lane_assign_cnt,
+			csiphy->lanes_assigned[i].lane_assign,
+			csiphy->lanes_enabled);
+	} else {
+		CAM_ERR(CAM_CSIPHY,
+			"Array out of bounds: > i: %d", i);
+	}
+}
+
+static int __csiphy_cpas_configure_for_main_or_aon(
+	bool get_access, uint32_t phy_idx,
+	struct cam_csiphy_aon_sel_params_t *aon_sel_params)
+{
+	int rc = 0;
+	uint32_t aon_config = 0;
+	uint32_t cpas_handle = g_phy_data[phy_idx].cpas_handle;
+
+	if (g_phy_data[phy_idx].aon_cam_id == NOT_AON_CAM) {
+		CAM_ERR(CAM_CSIPHY, "Not an AON Camera");
+		return -EINVAL;
+	}
+
+	if (!aon_sel_params->aon_cam_sel_offset[g_phy_data[phy_idx].aon_cam_id]) {
+		CAM_ERR(CAM_CSIPHY, "Mux register offset can not be 0. AON_Cam_ID: %u",
+			g_phy_data[phy_idx].aon_cam_id);
+		return -EINVAL;
+	}
+
+	if (get_access == g_phy_data[phy_idx].is_configured_for_main) {
+		CAM_DBG(CAM_CSIPHY, "Already Configured/Released for %s",
+			get_access ? "Main" : "AON");
+		return 0;
+	}
+
+	if (get_access) {
+		rc = cam_csiphy_cpas_ops(cpas_handle, true);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "voting CPAS: %d failed", rc);
+			return rc;
+		}
+	}
+
+	cam_cpas_reg_read(cpas_handle, CAM_CPAS_REGBASE_CPASTOP,
+		aon_sel_params->aon_cam_sel_offset[g_phy_data[phy_idx].aon_cam_id],
+		true, &aon_config);
+
+	if (get_access && !g_phy_data[phy_idx].is_configured_for_main) {
+		aon_config &= ~(aon_sel_params->cam_sel_mask |
+			aon_sel_params->mclk_sel_mask);
+		CAM_INFO(CAM_CSIPHY,
+			"Selecting MainCamera over AON Camera");
+		g_phy_data[phy_idx].is_configured_for_main = true;
+	} else if (!get_access && g_phy_data[phy_idx].is_configured_for_main) {
+		aon_config |= (aon_sel_params->cam_sel_mask |
+			aon_sel_params->mclk_sel_mask);
+		CAM_INFO(CAM_CSIPHY,
+			"Releasing MainCamera to AON Camera");
+		g_phy_data[phy_idx].is_configured_for_main = false;
+	}
+
+	CAM_DBG(CAM_CSIPHY, "value of aon_config = %u", aon_config);
+	rc = cam_cpas_reg_write(cpas_handle, CAM_CPAS_REGBASE_CPASTOP,
+		aon_sel_params->aon_cam_sel_offset[g_phy_data[phy_idx].aon_cam_id],
+		true, aon_config);
+	if (rc)
+		CAM_ERR(CAM_CSIPHY, "CPAS AON sel register write failed");
+
+	if (!get_access) {
+		rc = cam_csiphy_cpas_ops(cpas_handle, false);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "voting CPAS: %d failed", rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+int cam_csiphy_util_update_aon_registration(uint32_t phy_idx, uint32_t aon_cam_id)
+{
+	/* aon support enable for the sensor associated with phy idx*/
+	if (phy_idx >= MAX_CSIPHY) {
+		CAM_ERR(CAM_CSIPHY,
+			"Invalid PHY index: %u", phy_idx);
+		return -EINVAL;
+	}
+
+	if (!g_phy_data[phy_idx].base_address) {
+		CAM_ERR(CAM_CSIPHY, "Invalid PHY idx: %d from Sensor user", phy_idx);
+		return -EINVAL;
+	}
+
+	g_phy_data[phy_idx].aon_cam_id = aon_cam_id;
+
+	return 0;
+}
+
+int cam_csiphy_util_update_aon_ops(
+	bool get_access, uint32_t phy_idx)
+{
+	struct cam_csiphy_aon_sel_params_t *aon_sel_params;
+	int rc = 0;
+
+	if (phy_idx >= MAX_CSIPHY) {
+		CAM_ERR(CAM_CSIPHY, "Null device");
+		return -ENODEV;
+	}
+
+	if (!g_phy_data[phy_idx].base_address) {
+		CAM_ERR(CAM_CSIPHY, "phy_idx: %d is not supported", phy_idx);
+		return -EINVAL;
+	}
+
+	if (!g_phy_data[phy_idx].aon_sel_param) {
+		CAM_ERR(CAM_CSIPHY, "AON select parameters are null");
+		return -EINVAL;
+	}
+
+	aon_sel_params = g_phy_data[phy_idx].aon_sel_param;
+
+	mutex_lock(&main_aon_selection);
+
+	CAM_DBG(CAM_CSIPHY, "PHY idx: %d, AON_support %s", phy_idx,
+		(get_access) ? "enable" : "disable");
+
+	rc = __csiphy_cpas_configure_for_main_or_aon(
+			get_access, phy_idx, aon_sel_params);
+	if (rc)
+		CAM_ERR(CAM_CSIPHY, "Configuration for AON ops failed: rc: %d", rc);
+
+	mutex_unlock(&main_aon_selection);
+	return rc;
+}
+
+static void __cam_csiphy_read_2phase_bist_counter_status(
+	struct csiphy_device *csiphy_dev, uint32_t *counter)
+{
+	int i = 0, lane_count;
+	int bist_status_arr_size =
+		csiphy_dev->ctrl_reg->csiphy_bist_reg->number_of_counters;
+	uint32_t base_offset = 0;
+	void __iomem *phy_base = NULL;
+	uint32_t val = 0;
+	uint32_t offset_betwn_lane = 0;
+	struct bist_reg_settings_t *bist_reg = NULL;
+
+	phy_base = csiphy_dev->soc_info.reg_map[0].mem_base;
+	bist_reg = csiphy_dev->ctrl_reg->csiphy_bist_reg;
+	offset_betwn_lane =
+		csiphy_dev->ctrl_reg->csiphy_reg->size_offset_betn_lanes;
+
+	for (i = 0; i < bist_status_arr_size; i++) {
+		base_offset = bist_reg->bist_counter_2ph_base_offset + (0x4 * i);
+		val = 0;
+		for (lane_count = 0; lane_count < CAM_CSIPHY_MAX_DPHY_LANES; lane_count++) {
+			CAM_DBG(CAM_CSIPHY, "value to be read from addr: 0x%x is 0x%x",
+				base_offset + (lane_count * offset_betwn_lane),
+				(cam_io_r(phy_base + base_offset + (lane_count * offset_betwn_lane))));
+			val |= ((cam_io_r(phy_base + base_offset + (lane_count * offset_betwn_lane))));
+		}
+		*counter |= (val << (i * 8));
+		CAM_DBG(CAM_CSIPHY, "COUNTER VALUE is 0x%x", *counter);
+	}
+
+	return;
+}
+
+static void __cam_csiphy_get_2phase_pattern_status(
+	struct csiphy_device *csiphy_dev)
+{
+	int i;
+	int bist_status_arr_size = csiphy_dev->ctrl_reg->csiphy_bist_reg->num_status_reg;
+	struct csiphy_reg_t *csiphy_common_reg = NULL;
+	void __iomem *csiphybase;
+	uint32_t status = 0;
+	uint32_t counter = 0;
+	struct bist_reg_settings_t *bist_reg;
+
+	CAM_DBG(CAM_CSIPHY, "ENTER");
+	csiphybase = csiphy_dev->soc_info.reg_map[0].mem_base;
+	bist_reg = csiphy_dev->ctrl_reg->csiphy_bist_reg;
+
+	/* This loop is to read every lane status value
+	 * in case if loop breaks with only last lane.
+	 */
+	for (i = 0; i < bist_status_arr_size; i++) {
+		csiphy_common_reg = &bist_reg->bist_status_arr[i];
+		switch (csiphy_common_reg->csiphy_param_type) {
+		case CSIPHY_2PH_REGS:
+			status |= cam_io_r(csiphybase + csiphy_common_reg->reg_addr);
+		break;
+		}
+	}
+
+	/* Read the Counter value for possible corrupted headers */
+	__cam_csiphy_read_2phase_bist_counter_status(csiphy_dev, &counter);
+
+	if ((status & PREAMBLE_PATTERN_BIST_DONE) &&
+		(status & bist_reg->error_status_val_2ph)) {
+		/**
+		 * This condition happen when CSIPHY try to read status after sensor
+		 * streamoff. In this case error bit is set due to postamble detection
+		 * which is bit(4). In this scenraio this is not consider as an error.
+		 * We need to check for status2/3 counter value to determine if there are
+		 * more header that is corrupted than 2. Counter always shows value of 2
+		 * with postamble packet.
+		 *
+		 */
+		if (counter <= PREAMBLE_MAX_ERR_COUNT_ALLOWED) {
+			CAM_INFO(CAM_CSIPHY,
+				"PN9 Pattern rxced succesfully:: counter value: 0x%x, Status0: 0x%x",
+				counter, status);
+		} else {
+			CAM_INFO(CAM_CSIPHY,
+				"PN9 Pattern is corrupted:: counter value: 0x%x, Status0: 0x%x",
+				counter, status);
+		}
+	} else if ((status & PREAMBLE_PATTERN_BIST_DONE) &&
+		!(status & bist_reg->error_status_val_2ph)) {
+		/**
+		 * This condition happen when CSIPHY try to read status with some counter
+		 * value is set to check against. In this case error bit is not expected
+		 * to be set.
+		 */
+		CAM_INFO(CAM_CSIPHY,
+			"PN9 Pattern rxced succesfully:: counter value: 0x%x, Status0: 0x%x",
+			counter, status);
+	} else {
+		CAM_INFO(CAM_CSIPHY,
+			"PN9 Pattern is corrupted:: counter value: 0x%x Status0: 0x%x",
+			counter, status);
+	}
+
+	return;
+}
+
+static void __cam_csiphy_2ph_status_checker_ops(
+	struct csiphy_device *csiphy_dev, bool set)
+{
+	int i = 0;
+	void __iomem *csiphybase = NULL;
+	uint32_t base_offset = 0;
+	uint32_t read_back_value;
+	uint32_t lane_offset = 0;
+	uint32_t offset_betwn_lane = 0;
+	struct bist_reg_settings_t *bist_reg = NULL;
+
+	csiphybase = csiphy_dev->soc_info.reg_map[0].mem_base;
+	bist_reg = csiphy_dev->ctrl_reg->csiphy_bist_reg;
+	base_offset = bist_reg->set_status_update_2ph_base_offset;
+	offset_betwn_lane =
+		csiphy_dev->ctrl_reg->csiphy_reg->size_offset_betn_lanes;
+
+	/* Set checker bit to read the correct status1 value */
+	for (i = 0; i < CAM_CSIPHY_MAX_DPHY_LANES; i++) {
+		lane_offset = base_offset + (i * offset_betwn_lane);
+		read_back_value = cam_io_r(csiphybase + lane_offset);
+		set ? (read_back_value |= PREAMBLE_PATTERN_SET_CHECKER) :
+			(read_back_value &= ~PREAMBLE_PATTERN_SET_CHECKER);
+		cam_io_w_mb(read_back_value, csiphybase + lane_offset);
+	}
+}
+
+static void __cam_csiphy_read_3phase_bist_counter_status(
+	struct csiphy_device *csiphy_dev, uint32_t *counter)
+{
+	int i = 0, lane_count;
+	int bist_status_arr_size =
+		csiphy_dev->ctrl_reg->csiphy_bist_reg->number_of_counters;
+	uint32_t base_offset = 0;
+	void __iomem *phy_base = NULL;
+	uint32_t val = 0;
+	uint32_t offset_betwn_lane = 0;
+	struct bist_reg_settings_t *bist_reg = NULL;
+
+	phy_base = csiphy_dev->soc_info.reg_map[0].mem_base;
+	bist_reg = csiphy_dev->ctrl_reg->csiphy_bist_reg;
+	offset_betwn_lane =
+		csiphy_dev->ctrl_reg->csiphy_reg->size_offset_betn_lanes;
+
+	for (i = 0; i < bist_status_arr_size; i++) {
+		base_offset = bist_reg->bist_counter_3ph_base_offset + (0x4 * i);
+		val = 0;
+		for (lane_count = 0; lane_count < CAM_CSIPHY_MAX_CPHY_LANES; lane_count++) {
+			CAM_DBG(CAM_CSIPHY, "value to be read from addr: 0x%x is 0x%x",
+				base_offset + (lane_count * offset_betwn_lane),
+				(cam_io_r(phy_base + base_offset + (lane_count * offset_betwn_lane))));
+			val |= ((cam_io_r(phy_base + base_offset + (lane_count * offset_betwn_lane))));
+		}
+
+		*counter |= (val << (i * 8));
+		CAM_DBG(CAM_CSIPHY, "COUNTER VALUE is 0x%x", *counter);
+	}
+
+	return;
+}
+
+static void __cam_csiphy_get_3phase_pattern_status(
+	struct csiphy_device *csiphy_dev)
+{
+	int i = 0;
+	int bist_status_arr_size =
+		csiphy_dev->ctrl_reg->csiphy_bist_reg->num_status_reg;
+	struct csiphy_reg_t *csiphy_common_reg = NULL;
+	void __iomem *csiphybase = NULL;
+	uint32_t base_offset = 0;
+	uint32_t lane_offset = 0;
+	uint32_t status1 = 0, status0 = 0;
+	uint32_t counter = 0;
+	uint32_t offset_betwn_lane = 0;
+	struct bist_reg_settings_t *bist_reg = NULL;
+
+	CAM_DBG(CAM_CSIPHY, "ENTER");
+	csiphybase = csiphy_dev->soc_info.reg_map[0].mem_base;
+	bist_reg = csiphy_dev->ctrl_reg->csiphy_bist_reg;
+	base_offset = bist_reg->bist_sensor_data_3ph_status_base_offset;
+	offset_betwn_lane =
+		csiphy_dev->ctrl_reg->csiphy_reg->size_offset_betn_lanes;
+
+	/* This loop is to read every lane status value
+	 * in case if loop breaks with only last lane.
+	 */
+	for (i = 0; i < bist_status_arr_size; i++) {
+		csiphy_common_reg = &bist_reg->bist_status_arr[i];
+		switch (csiphy_common_reg->csiphy_param_type) {
+		case CSIPHY_3PH_REGS:
+			status1 |= cam_io_r(csiphybase + csiphy_common_reg->reg_addr);
+		break;
+		}
+	}
+
+	/* Read Status0 value to detect sensor related communication */
+	for (i = 0; i < CAM_CSIPHY_MAX_CPHY_LANES; i++) {
+		lane_offset = base_offset + (i * offset_betwn_lane);
+		status0 |= cam_io_r(csiphybase + lane_offset);
+	}
+
+
+	/* Read the Counter value for possible corrupted headers */
+	__cam_csiphy_read_3phase_bist_counter_status(csiphy_dev, &counter);
+
+	if ((status1 & PREAMBLE_PATTERN_BIST_DONE) &&
+		(status1 & bist_reg->error_status_val_3ph)) {
+		/**
+		 * This condition happen when CSIPHY try to read status after sensor
+		 * streamoff. In this case error bit is set due to postamble detection
+		 * which is bit(4). In this scenraio this is not consider as an error.
+		 * We need to check for status2/3 counter value to determine if there are
+		 * more header that is corrupted than 2. Counter always shows value of 2
+		 * with postamble packet.
+		 *
+		 */
+		if (counter <= PREAMBLE_MAX_ERR_COUNT_ALLOWED) {
+			CAM_INFO(CAM_CSIPHY,
+				"PN9 Pattern rxced succesfully after sensor streamoff:: counter value: 0x%x Status1: 0x%x Status0: 0x%x",
+				counter, status1, status0);
+		} else {
+			CAM_INFO(CAM_CSIPHY,
+				"PN9 Pattern is corrupted:: counter value: 0x%x Status1: 0x%x Status0: 0x%x",
+				counter, status1, status0);
+		}
+	} else if ((status1 & PREAMBLE_PATTERN_BIST_DONE) &&
+		!(status1 & bist_reg->error_status_val_3ph)) {
+		/**
+		 * This condition happen when CSIPHY try to read status with some counter
+		 * value is set to check against. In this case error bit is not expected
+		 * to be set.
+		 */
+		CAM_INFO(CAM_CSIPHY,
+			"PN9 Pattern rxced succesfully before sensor streamoff:: counter value: 0x%x Status1: 0x%x Status0: 0x%x",
+			counter, status1, status0);
+	} else {
+		CAM_INFO(CAM_CSIPHY,
+			"PN9 Pattern is corrupted:: counter value: 0x%x Status1: 0x%x Status0: 0x%x",
+			counter, status1, status0);
+	}
+
+	return;
+}
+
+static void __cam_csiphy_3ph_status_checker_ops(
+	struct csiphy_device *csiphy_dev, bool set)
+{
+	int i = 0;
+	void __iomem *csiphybase = NULL;
+	uint32_t base_offset = 0;
+	uint32_t read_back_value;
+	uint32_t lane_offset = 0;
+	uint32_t offset_betwn_lane = 0;
+
+	csiphybase = csiphy_dev->soc_info.reg_map[0].mem_base;
+	base_offset =
+		csiphy_dev->ctrl_reg->csiphy_bist_reg->set_status_update_3ph_base_offset;
+	offset_betwn_lane =
+		csiphy_dev->ctrl_reg->csiphy_reg->size_offset_betn_lanes;
+	/* Set checker bit to read the correct status1 value */
+	for (i = 0; i < CAM_CSIPHY_MAX_CPHY_LANES; i++) {
+		lane_offset = base_offset + (i * offset_betwn_lane);
+		read_back_value = cam_io_r(csiphybase + lane_offset);
+		set ? (read_back_value |= PREAMBLE_PATTERN_SET_CHECKER) :
+			(read_back_value &= ~PREAMBLE_PATTERN_SET_CHECKER);
+		cam_io_w_mb(read_back_value, csiphybase + lane_offset);
+	}
+}
+
+static void __cam_csiphy_get_preamble_status(
+	struct csiphy_device *csiphy_dev, int offset)
+{
+	bool is_3phase = false;
+
+	is_3phase = csiphy_dev->csiphy_info[offset].csiphy_3phase;
+
+	if (is_3phase) {
+		__cam_csiphy_3ph_status_checker_ops(csiphy_dev, true);
+		__cam_csiphy_get_3phase_pattern_status(csiphy_dev);
+		__cam_csiphy_3ph_status_checker_ops(csiphy_dev, false);
+	} else {
+		__cam_csiphy_2ph_status_checker_ops(csiphy_dev, true);
+		__cam_csiphy_get_2phase_pattern_status(csiphy_dev);
+		__cam_csiphy_2ph_status_checker_ops(csiphy_dev, false);
+	}
+	return;
+}
+
+int32_t cam_csiphy_core_cfg(void *phy_dev,
+			void *arg)
+{
+	struct cam_control   *cmd = (struct cam_control *)arg;
+	struct csiphy_device *csiphy_dev = (struct csiphy_device *)phy_dev;
+	struct cam_cphy_dphy_status_reg_params_t *status_reg_ptr;
+	struct csiphy_reg_parms_t *csiphy_reg;
+	struct cam_hw_soc_info *soc_info;
+	uint32_t      cphy_trio_status;
+	void __iomem *csiphybase;
+	int32_t              rc = 0;
+
+	if (!csiphy_dev || !cmd) {
+		CAM_ERR(CAM_CSIPHY, "Invalid input args");
+		return -EINVAL;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_CSIPHY, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	soc_info = &csiphy_dev->soc_info;
+	if (!soc_info) {
+		CAM_ERR(CAM_CSIPHY, "Null Soc_info");
+		return -EINVAL;
+	}
+
+	if (!g_phy_data[soc_info->index].base_address) {
+		CAM_ERR(CAM_CSIPHY, "CSIPHY hw is not avaialble at index: %d",
+			soc_info->index);
+		return -EINVAL;
+	}
+
+	csiphybase = soc_info->reg_map[0].mem_base;
+	csiphy_reg = csiphy_dev->ctrl_reg->csiphy_reg;
+	status_reg_ptr = csiphy_reg->status_reg_params;
+
+	CAM_DBG(CAM_CSIPHY, "Opcode received: %d", cmd->op_code);
+	mutex_lock(&csiphy_dev->mutex);
+	switch (cmd->op_code) {
+	case CAM_ACQUIRE_DEV: {
+		struct cam_sensor_acquire_dev csiphy_acq_dev;
+		struct cam_csiphy_acquire_dev_info csiphy_acq_params;
+		int index;
+		struct cam_create_dev_hdl bridge_params;
+
+		CAM_DBG(CAM_CSIPHY, "ACQUIRE_CNT: %d COMBO_MODE: %d",
+			csiphy_dev->acquire_count,
+			csiphy_dev->combo_mode);
+		if ((csiphy_dev->csiphy_state == CAM_CSIPHY_START) &&
+			(csiphy_dev->combo_mode == 0) &&
+			(csiphy_dev->acquire_count > 0) && (csiphy_dev->is_aggregator_rx == 0)) {
+			CAM_ERR(CAM_CSIPHY,
+				"NonComboMode does not support multiple acquire: Acquire_count: %d",
+				csiphy_dev->acquire_count);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if ((csiphy_dev->acquire_count) &&
+			(csiphy_dev->acquire_count >=
+			csiphy_dev->session_max_device_support)) {
+			CAM_ERR(CAM_CSIPHY,
+				"Max acquires are allowed in combo mode: %d",
+				csiphy_dev->session_max_device_support);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		rc = copy_from_user(&csiphy_acq_dev,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(csiphy_acq_dev));
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			goto release_mutex;
+		}
+
+		csiphy_acq_params.combo_mode = 0;
+
+		if (copy_from_user(&csiphy_acq_params,
+			u64_to_user_ptr(csiphy_acq_dev.info_handle),
+			sizeof(csiphy_acq_params))) {
+			CAM_ERR(CAM_CSIPHY,
+				"Failed copying from User");
+			goto release_mutex;
+		}
+
+		if (csiphy_acq_params.combo_mode &&
+			csiphy_acq_params.cphy_dphy_combo_mode) {
+			CAM_ERR(CAM_CSIPHY,
+				"Cannot support both Combo_mode and cphy_dphy_combo_mode");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (csiphy_acq_params.combo_mode == 1) {
+			CAM_DBG(CAM_CSIPHY, "combo mode stream detected");
+			csiphy_dev->combo_mode = 1;
+			if (csiphy_acq_params.csiphy_3phase) {
+				CAM_DBG(CAM_CSIPHY, "3Phase ComboMode");
+				csiphy_dev->session_max_device_support =
+					CSIPHY_MAX_INSTANCES_PER_PHY;
+			} else {
+				csiphy_dev->session_max_device_support =
+					CSIPHY_MAX_INSTANCES_PER_PHY - 1;
+				CAM_DBG(CAM_CSIPHY, "2Phase ComboMode");
+			}
+		}
+		if (csiphy_acq_params.cphy_dphy_combo_mode == 1) {
+			CAM_DBG(CAM_CSIPHY,
+				"cphy_dphy_combo_mode stream detected");
+			csiphy_dev->cphy_dphy_combo_mode = 1;
+			csiphy_dev->session_max_device_support =
+				CSIPHY_MAX_INSTANCES_PER_PHY - 1;
+		}
+
+		if (!csiphy_acq_params.combo_mode &&
+			!csiphy_acq_params.cphy_dphy_combo_mode) {
+			CAM_DBG(CAM_CSIPHY, "Non Combo Mode stream");
+			csiphy_dev->session_max_device_support = 1;
+		}
+
+		if (csiphy_dev->is_aggregator_rx)
+			csiphy_dev->session_max_device_support =
+				CSIPHY_MAX_INSTANCES_PER_AGGREG_RX_PHY;
+
+		bridge_params.ops = NULL;
+		bridge_params.session_hdl = csiphy_acq_dev.session_handle;
+		bridge_params.v4l2_sub_dev_flag = 0;
+		bridge_params.media_entity_flag = 0;
+		bridge_params.priv = csiphy_dev;
+		bridge_params.dev_id = CAM_CSIPHY;
+		csiphy_acq_dev.device_handle =
+			cam_create_device_hdl(&bridge_params);
+		if (csiphy_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_CSIPHY, "Can not create device handle");
+			goto release_mutex;
+		}
+
+		for (index = 0; index < csiphy_dev->session_max_device_support; index++) {
+			if (csiphy_dev->csiphy_info[index].hdl_data.device_hdl == -1)
+				break;
+		}
+
+		if (index >= csiphy_dev->session_max_device_support) {
+			CAM_ERR(CAM_CSIPHY, "Index is invalid: %d", index);
+			goto release_mutex;
+		}
+
+		csiphy_dev->csiphy_info[index].hdl_data.device_hdl =
+			csiphy_acq_dev.device_handle;
+		csiphy_dev->csiphy_info[index].hdl_data.session_hdl =
+			csiphy_acq_dev.session_handle;
+		csiphy_dev->csiphy_info[index].csiphy_3phase =
+			csiphy_acq_params.csiphy_3phase;
+		csiphy_dev->csiphy_info[index].conn_csid_idx = -1;
+		csiphy_dev->csiphy_info[index].use_hw_client_voting = false;
+		csiphy_dev->csiphy_info[index].is_drv_config_en = false;
+
+		CAM_DBG(CAM_CSIPHY, "Add dev_handle:0x%x at index: %d ",
+			csiphy_dev->csiphy_info[index].hdl_data.device_hdl,
+			index);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+				&csiphy_acq_dev,
+				sizeof(struct cam_sensor_acquire_dev))) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (!csiphy_dev->acquire_count) {
+			g_phy_data[soc_info->index].is_3phase = csiphy_acq_params.csiphy_3phase;
+			CAM_DBG(CAM_CSIPHY,
+				"g_csiphy data is updated for index: %d is_3phase: %u",
+				soc_info->index,
+				g_phy_data[soc_info->index].is_3phase);
+		}
+
+		if (g_phy_data[soc_info->index].aon_cam_id != NOT_AON_CAM) {
+			rc = cam_csiphy_util_update_aon_ops(true, soc_info->index);
+			if (rc) {
+				CAM_ERR(CAM_CSIPHY,
+					"Error in setting up AON operation for phy_idx: %d, rc: %d",
+					soc_info->index, rc);
+				goto release_mutex;
+			}
+		}
+
+		csiphy_dev->acquire_count++;
+
+		if (csiphy_dev->csiphy_state == CAM_CSIPHY_INIT)
+			csiphy_dev->csiphy_state = CAM_CSIPHY_ACQUIRE;
+
+		CAM_INFO(CAM_CSIPHY,
+			"CAM_ACQUIRE_DEV: %u Type: %s acquire_count: %d combo: %u cphy+dphy combo: %u",
+			soc_info->index,
+			g_phy_data[soc_info->index].is_3phase ? "CPHY" : "DPHY",
+			csiphy_dev->acquire_count,
+			csiphy_dev->combo_mode,
+			csiphy_dev->cphy_dphy_combo_mode);
+	}
+		break;
+	case CAM_QUERY_CAP: {
+		struct cam_csiphy_query_cap csiphy_cap = {0};
+
+		cam_csiphy_query_cap(csiphy_dev, &csiphy_cap);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&csiphy_cap, sizeof(struct cam_csiphy_query_cap))) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+	}
+		break;
+	case CAM_STOP_DEV: {
+		int32_t offset, rc = 0;
+		struct cam_start_stop_dev_cmd config;
+		struct cam_csiphy_param *param;
+
+		rc = copy_from_user(&config, (void __user *)cmd->handle,
+					sizeof(config));
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			goto release_mutex;
+		}
+
+		if (csiphy_dev->csiphy_state != CAM_CSIPHY_START) {
+			CAM_ERR(CAM_CSIPHY, "Csiphy:%d Not in right state to stop : %d",
+				soc_info->index, csiphy_dev->csiphy_state);
+			goto release_mutex;
+		}
+
+		offset = cam_csiphy_get_instance_offset(csiphy_dev,
+			config.dev_handle);
+		if (offset < 0 ||
+			offset >= csiphy_dev->session_max_device_support) {
+			CAM_ERR(CAM_CSIPHY, "Index is invalid: %d", offset);
+			goto release_mutex;
+		}
+
+		param = &csiphy_dev->csiphy_info[offset];
+
+		cam_csiphy_update_lane_assign_info(csiphy_dev, offset, false);
+
+		if (--csiphy_dev->start_dev_count) {
+#ifdef CONFIG_SECURE_CAMERA
+			if (param->secure_mode)
+				cam_csiphy_program_secure_mode(csiphy_dev,
+					CAM_SECURE_MODE_NON_SECURE, offset);
+#endif
+			param->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+			param->csiphy_cpas_cp_reg_mask = 0;
+
+			if (soc_info->is_clk_drv_en && param->use_hw_client_voting) {
+				rc = cam_soc_util_set_src_clk_rate(soc_info, param->conn_csid_idx,
+					0, 0);
+				if (rc) {
+					CAM_ERR(CAM_CSIPHY,
+						"[%d] Failed in setting clk rate for %d",
+						soc_info->index, param->conn_csid_idx);
+				} else {
+					rc = cam_soc_util_cesta_channel_switch(param->conn_csid_idx,
+						"csiphy_stop_dev");
+					if (rc) {
+						CAM_ERR(CAM_CSIPHY,
+							"Failed to apply power states for cesta client:%d rc:%d",
+							param->conn_csid_idx, rc);
+					}
+				}
+			}
+
+			CAM_INFO(CAM_CSIPHY,
+				"CAM_STOP_PHYDEV: %d, CSID:%d, Type: %s, dev_cnt: %u, slot: %d, Datarate: %llu, Settletime: %llu",
+				soc_info->index, param->conn_csid_idx,
+				g_phy_data[soc_info->index].is_3phase ? "CPHY" : "DPHY",
+				csiphy_dev->start_dev_count, offset, param->data_rate,
+				param->settle_time);
+
+			goto release_mutex;
+		}
+
+#ifdef CONFIG_SECURE_CAMERA
+		if (param->secure_mode)
+			cam_csiphy_program_secure_mode(csiphy_dev, CAM_SECURE_MODE_NON_SECURE,
+				offset);
+#endif
+		param->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+		param->csiphy_cpas_cp_reg_mask = 0x0;
+
+		if (csiphy_dev->prgm_cmn_reg_across_csiphy) {
+			mutex_lock(&active_csiphy_cnt_mutex);
+			active_csiphy_hw_cnt--;
+			mutex_unlock(&active_csiphy_cnt_mutex);
+
+			cam_csiphy_program_common_registers(csiphy_dev, true,
+				CAM_CSIPHY_PRGM_ALL);
+		} else {
+			cam_csiphy_program_common_registers(csiphy_dev, true,
+				CAM_CSIPHY_PRGM_INDVDL);
+		}
+
+		if (csiphy_dev->preamble_enable)
+			__cam_csiphy_get_preamble_status(csiphy_dev, offset);
+
+		cam_csiphy_update_lane_selection(csiphy_dev, offset, false);
+
+		rc = cam_csiphy_disable_hw(csiphy_dev, offset);
+		if (rc < 0)
+			CAM_ERR(CAM_CSIPHY, "Failed in csiphy release");
+
+		if (!g_phy_data[soc_info->index].is_configured_for_main) {
+			if (cam_csiphy_cpas_ops(csiphy_dev->cpas_handle, false)) {
+				CAM_ERR(CAM_CSIPHY, "Failed in de-voting CPAS");
+				rc = -EFAULT;
+			}
+		}
+
+		csiphy_dev->csiphy_state = CAM_CSIPHY_ACQUIRE;
+
+		CAM_INFO(CAM_CSIPHY,
+			"CAM_STOP_PHYDEV: %u, CSID:%d, Type: %s, slot: %d, Datarate: %llu, Settletime: %llu",
+			soc_info->index, param->conn_csid_idx,
+			g_phy_data[soc_info->index].is_3phase ? "CPHY" : "DPHY",
+			offset, param->data_rate, param->settle_time);
+	}
+		break;
+	case CAM_RELEASE_DEV: {
+		int32_t offset;
+		struct cam_release_dev_cmd release;
+
+		if (!csiphy_dev->acquire_count) {
+			CAM_ERR(CAM_CSIPHY, "No valid devices to release");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (copy_from_user(&release,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(release))) {
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+
+		offset = cam_csiphy_get_instance_offset(csiphy_dev,
+			release.dev_handle);
+		if (offset < 0 ||
+			offset >= csiphy_dev->session_max_device_support) {
+			CAM_ERR(CAM_CSIPHY, "index is invalid: %d", offset);
+			goto release_mutex;
+		}
+
+#ifdef CONFIG_SECURE_CAMERA
+		if (csiphy_dev->csiphy_info[offset].secure_mode)
+			cam_csiphy_program_secure_mode(
+				csiphy_dev,
+				CAM_SECURE_MODE_NON_SECURE, offset);
+#endif
+		csiphy_dev->csiphy_info[offset].secure_mode =
+			CAM_SECURE_MODE_NON_SECURE;
+
+		csiphy_dev->csiphy_cpas_cp_reg_mask[offset] = 0x0;
+		csiphy_dev->preamble_enable = 0;
+
+		rc = cam_destroy_device_hdl(release.dev_handle);
+		if (rc < 0)
+			CAM_ERR(CAM_CSIPHY, "destroying the device hdl");
+		csiphy_dev->csiphy_info[offset].hdl_data.device_hdl = -1;
+		csiphy_dev->csiphy_info[offset].hdl_data.session_hdl = -1;
+
+		cam_csiphy_reset_phyconfig_param(csiphy_dev, offset);
+
+		if (csiphy_dev->acquire_count) {
+			csiphy_dev->acquire_count--;
+			CAM_DBG(CAM_CSIPHY, "Acquire_cnt: %d",
+				csiphy_dev->acquire_count);
+		}
+
+		if (csiphy_dev->acquire_count == 0) {
+			CAM_DBG(CAM_CSIPHY, "All PHY devices released");
+			if (g_phy_data[soc_info->index].aon_cam_id != NOT_AON_CAM) {
+				rc = cam_csiphy_util_update_aon_ops(false, soc_info->index);
+				if (rc) {
+					CAM_WARN(CAM_CSIPHY,
+						"Error in releasing AON operation for phy_idx: %d, rc: %d",
+						csiphy_dev->soc_info.index, rc);
+					rc = 0;
+				}
+			}
+			csiphy_dev->combo_mode = 0;
+			csiphy_dev->csiphy_state = CAM_CSIPHY_INIT;
+		}
+
+		if (csiphy_dev->cdr_params.cdr_sweep_enabled)
+			memset(&csiphy_dev->cdr_params, 0x0,
+				sizeof(struct cam_csiphy_dev_cdr_sweep_params));
+
+		if (csiphy_dev->aux_params.aux_mem_update_en)
+			memset(&csiphy_dev->aux_params, 0x0,
+				sizeof(struct cam_csiphy_dev_aux_setting_params));
+
+		CAM_DBG(CAM_CSIPHY, "CAM_RELEASE_PHYDEV: %u Type: %s",
+			soc_info->index,
+			g_phy_data[soc_info->index].is_3phase ? "CPHY" : "DPHY");
+
+		if (csiphy_dev->acquire_count < csiphy_dev->start_dev_count) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_CSIPHY,
+				"PHYDEV %u streamon count:%u bigger than acquire count:%u, missing stream offs",
+				soc_info->index, csiphy_dev->start_dev_count,
+				csiphy_dev->acquire_count);
+		}
+
+		break;
+	}
+	case CAM_CONFIG_DEV: {
+		struct cam_config_dev_cmd config;
+
+		CAM_DBG(CAM_CSIPHY, "CONFIG_DEV Called");
+
+		if (copy_from_user(&config, u64_to_user_ptr(cmd->handle), sizeof(config))) {
+			CAM_ERR(CAM_CSIPHY, "Couldn't copy the Entire Config From User");
+			rc = -EFAULT;
+		} else {
+			rc = cam_cmd_buf_parser(csiphy_dev, &config);
+			if (rc < 0) {
+				CAM_ERR(CAM_CSIPHY, "Fail in cmd buf parser");
+				goto release_mutex;
+			}
+		}
+		break;
+	}
+	case CAM_START_DEV: {
+		struct cam_csiphy_param *param;
+		struct cam_start_stop_dev_cmd config;
+		int32_t i, offset;
+		int clk_vote_level_high = -1;
+		int clk_vote_level_low = -1;
+		uint8_t data_rate_variant_idx = 0;
+		unsigned long clk_rate = 0;
+
+		CAM_DBG(CAM_CSIPHY, "START_DEV Called");
+		rc = copy_from_user(&config, (void __user *)cmd->handle,
+			sizeof(config));
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			goto release_mutex;
+		}
+
+		if ((csiphy_dev->csiphy_state == CAM_CSIPHY_START) &&
+			(csiphy_dev->start_dev_count >
+			csiphy_dev->session_max_device_support)) {
+			CAM_ERR(CAM_CSIPHY,
+				"Invalid start count: %d, Max supported devices: %u",
+				csiphy_dev->start_dev_count,
+				csiphy_dev->session_max_device_support);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		offset = cam_csiphy_get_instance_offset(csiphy_dev,
+			config.dev_handle);
+		if (offset < 0 ||
+			offset >= csiphy_dev->session_max_device_support) {
+			CAM_ERR(CAM_CSIPHY, "index is invalid: %d", offset);
+			goto release_mutex;
+		}
+
+		param = &csiphy_dev->csiphy_info[offset];
+
+		rc = cam_cpas_query_drv_enable(NULL, &soc_info->is_clk_drv_en);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "Failed to query DRV enable rc: %d", rc);
+			goto release_mutex;
+		}
+
+		cam_csiphy_update_lane_assign_info(csiphy_dev, offset, true);
+
+		if (csiphy_dev->start_dev_count) {
+			if (csiphy_dev->is_aggregator_rx) {
+				if ((csiphy_dev->lanes_enabled
+					& csiphy_dev->csiphy_info[offset].lane_enable)
+					== csiphy_dev->csiphy_info[offset].lane_enable) {
+					csiphy_dev->start_dev_count++;
+					CAM_INFO(CAM_CSIPHY,
+						"CAM_START_PHYDEV: %d dev_cnt: %u, slot: %d",
+						soc_info->index,
+						csiphy_dev->start_dev_count,
+						offset);
+					goto release_mutex;
+				}
+			}
+			clk_vote_level_high =
+				csiphy_dev->ctrl_reg->getclockvoting(csiphy_dev, offset);
+			clk_vote_level_low = clk_vote_level_high;
+
+			CAM_DBG(CAM_CSIPHY,
+				"CSIPHY[%d] is_clk_drv_en[%d] conn_csid_idx[%d] use_hw_client_voting[%d] is_drv_config_en[%d]",
+				csiphy_dev->soc_info.index, soc_info->is_clk_drv_en,
+				param->conn_csid_idx, param->use_hw_client_voting,
+				param->is_drv_config_en);
+
+			if (soc_info->is_clk_drv_en && param->use_hw_client_voting) {
+				if (param->is_drv_config_en)
+					clk_vote_level_low = soc_info->lowest_clk_level;
+
+				rc = cam_soc_util_set_clk_rate_level(&csiphy_dev->soc_info,
+					param->conn_csid_idx, clk_vote_level_high,
+					clk_vote_level_low, false);
+				if (rc) {
+					CAM_ERR(CAM_CSIPHY,
+						"Failed to set the req clk_rate level[high low]: [%s %s] cesta_client_idx: %d rc: %d",
+						cam_soc_util_get_string_from_level(
+						clk_vote_level_high),
+						cam_soc_util_get_string_from_level(
+						clk_vote_level_low), param->conn_csid_idx, rc);
+					rc = -EINVAL;
+					goto release_mutex;
+				}
+
+				rc = cam_soc_util_cesta_channel_switch(param->conn_csid_idx,
+					"csiphy_combo");
+				if (rc) {
+					CAM_ERR(CAM_CSIPHY,
+						"Failed to apply power states for crm client:%d rc:%d",
+						param->conn_csid_idx, rc);
+					rc = 0;
+				}
+			} else {
+				rc = cam_soc_util_set_clk_rate_level(&csiphy_dev->soc_info,
+					CAM_CLK_SW_CLIENT_IDX, clk_vote_level_high, 0, false);
+				if (rc) {
+					CAM_WARN(CAM_CSIPHY,
+						"Failed to set the req clk_rate level: %s",
+						cam_soc_util_get_string_from_level(
+						clk_vote_level_high));
+					rc = -EINVAL;
+					goto release_mutex;
+
+				}
+
+				for (i = 0; i < csiphy_dev->soc_info.num_clk;
+									i++) {
+					if (i ==
+					csiphy_dev->soc_info.src_clk_idx) {
+						CAM_DBG(CAM_CSIPHY,
+						"Skipping call back for src"
+						" clk %s",
+						csiphy_dev->soc_info.clk_name[
+									i]);
+						continue;
+					}
+					clk_rate =
+					cam_soc_util_get_clk_rate_applied(
+						&csiphy_dev->soc_info, i,
+						false, clk_vote_level_high);
+					if (clk_rate > 0) {
+						cam_subdev_notify_message(
+						CAM_TFE_DEVICE_TYPE,
+					CAM_SUBDEV_MESSAGE_CLOCK_UPDATE,
+						(void *)(&clk_rate));
+					}
+				}
+			}
+
+#ifdef CONFIG_SECURE_CAMERA
+			if (csiphy_dev->csiphy_info[offset].secure_mode == 1) {
+				if (!cam_cpas_is_feature_supported(
+					CAM_CPAS_SECURE_CAMERA_ENABLE,
+					CAM_CPAS_HW_IDX_ANY, NULL)) {
+					CAM_ERR(CAM_CSIPHY,
+						"sec_cam: camera fuse bit not set");
+					goto release_mutex;
+				}
+
+				rc = cam_csiphy_program_secure_mode(csiphy_dev,
+					CAM_SECURE_MODE_SECURE, offset);
+				if (rc) {
+					csiphy_dev->csiphy_info[offset]
+						.secure_mode =
+						CAM_SECURE_MODE_NON_SECURE;
+					CAM_ERR(CAM_CSIPHY,
+						"sec_cam: notify failed: rc: %d",
+						rc);
+					goto release_mutex;
+				}
+			}
+#endif
+
+			if (csiphy_dev->csiphy_info[offset].csiphy_3phase) {
+				rc = cam_csiphy_cphy_data_rate_config(
+					csiphy_dev, offset, data_rate_variant_idx);
+				if (rc) {
+					CAM_ERR(CAM_CSIPHY,
+						"Data rate specific configuration failed rc: %d",
+						rc);
+					goto release_mutex;
+				}
+			}
+
+			rc = cam_csiphy_update_lane_selection(csiphy_dev, offset, true);
+			if (rc) {
+				CAM_ERR(CAM_CSIPHY, "Update enable lane failed, rc: %d", rc);
+				goto release_mutex;
+			}
+
+			if (csiphy_dev->en_full_phy_reg_dump)
+				cam_csiphy_reg_dump(&csiphy_dev->soc_info);
+
+			csiphy_dev->start_dev_count++;
+
+			CAM_INFO(CAM_CSIPHY,
+				"CAM_START_PHYDEV: %d, CSID:%d, Type: %s, dev_cnt: %u, slot: %d, combo: %u, cphy+dphy: %u, skew_en: %d, sec_mode: %d, Datarate: %llu, Settletime: %llu",
+				soc_info->index,
+				csiphy_dev->csiphy_info[offset].conn_csid_idx,
+				g_phy_data[soc_info->index].is_3phase ? "CPHY" : "DPHY",
+				csiphy_dev->start_dev_count,
+				offset,
+				csiphy_dev->combo_mode,
+				csiphy_dev->cphy_dphy_combo_mode,
+				csiphy_dev->csiphy_info[offset].mipi_flags,
+				csiphy_dev->csiphy_info[offset].secure_mode,
+				csiphy_dev->csiphy_info[offset].data_rate,
+				csiphy_dev->csiphy_info[offset].settle_time);
+
+			goto release_mutex;
+		}
+
+		if (!g_phy_data[soc_info->index].is_configured_for_main) {
+			if (cam_csiphy_cpas_ops(csiphy_dev->cpas_handle, true)) {
+				rc = -EFAULT;
+				CAM_ERR(CAM_CSIPHY, "voting CPAS: %d", rc);
+				goto release_mutex;
+			}
+		}
+
+#ifdef CONFIG_SECURE_CAMERA
+		if (csiphy_dev->csiphy_info[offset].secure_mode == 1) {
+			if (!cam_cpas_is_feature_supported(
+					CAM_CPAS_SECURE_CAMERA_ENABLE,
+					CAM_CPAS_HW_IDX_ANY, NULL)) {
+				CAM_ERR(CAM_CSIPHY,
+					"sec_cam: camera fuse bit not set");
+				rc = -EINVAL;
+				goto cpas_stop;
+			}
+
+			rc = cam_csiphy_program_secure_mode(
+				csiphy_dev,
+				CAM_SECURE_MODE_SECURE, offset);
+			if (rc) {
+				csiphy_dev->csiphy_info[offset].secure_mode =
+					CAM_SECURE_MODE_NON_SECURE;
+				goto cpas_stop;
+			}
+		}
+#endif
+
+		rc = cam_csiphy_enable_hw(csiphy_dev, offset);
+		if (rc != 0) {
+			CAM_ERR(CAM_CSIPHY, "cam_csiphy_enable_hw failed");
+			goto cpas_stop;
+		}
+
+		rc = cam_csiphy_update_lane_selection(csiphy_dev, offset, true);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "Update enable lane failed, rc: %d", rc);
+			goto cpas_stop;
+		}
+
+		if (csiphy_dev->prgm_cmn_reg_across_csiphy) {
+			cam_csiphy_program_common_registers(csiphy_dev, false, CAM_CSIPHY_PRGM_ALL);
+			mutex_lock(&active_csiphy_cnt_mutex);
+			active_csiphy_hw_cnt++;
+			mutex_unlock(&active_csiphy_cnt_mutex);
+		} else {
+			cam_csiphy_program_common_registers(csiphy_dev, false,
+				CAM_CSIPHY_PRGM_INDVDL);
+		}
+
+		rc = cam_csiphy_config_dev(csiphy_dev, config.dev_handle, data_rate_variant_idx);
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "cam_csiphy_config_dev failed");
+			cam_csiphy_disable_hw(csiphy_dev, offset);
+			goto hw_cnt_decrement;
+		}
+
+		if (csiphy_onthego_reg_count)
+			cam_csiphy_apply_onthego_reg_values(csiphybase, soc_info->index);
+
+		cam_csiphy_release_from_reset_state(csiphy_dev, csiphybase, offset);
+
+		if (g_phy_data[soc_info->index].is_3phase && status_reg_ptr) {
+			for (i = 0; i < CAM_CSIPHY_MAX_CPHY_LANES; i++) {
+				if (status_reg_ptr->cphy_lane_status[i]) {
+					cphy_trio_status = cam_io_r_mb(csiphybase +
+						status_reg_ptr->cphy_lane_status[i]);
+
+					cphy_trio_status &= 0x1F;
+					if (cphy_trio_status == 0 || cphy_trio_status == 8) {
+						CAM_DBG(CAM_CSIPHY,
+							"Reg_offset: 0x%x, cphy_trio%d_status = 0x%x",
+							status_reg_ptr->cphy_lane_status[i],
+							i, cphy_trio_status);
+					} else {
+						CAM_WARN(CAM_CSIPHY,
+							"Reg_offset: 0x%x, Cphy_trio%d_status = 0x%x",
+							status_reg_ptr->cphy_lane_status[i],
+							i, cphy_trio_status);
+					}
+				}
+			}
+		}
+
+		if (csiphy_dev->en_full_phy_reg_dump)
+			cam_csiphy_reg_dump(&csiphy_dev->soc_info);
+
+		if (csiphy_dev->en_lane_status_reg_dump) {
+			usleep_range(50000, 50005);
+			CAM_INFO(CAM_CSIPHY, "Status Reg Dump after config");
+			cam_csiphy_dump_status_reg(csiphy_dev);
+		}
+
+		csiphy_dev->start_dev_count++;
+		csiphy_dev->csiphy_state = CAM_CSIPHY_START;
+
+		CAM_INFO(CAM_CSIPHY,
+			"CAM_START_PHYDEV: %d, CSID:%d, Type: %s, dev_cnt: %u, slot: %d, combo: %u, cphy+dphy: %u, skew_en: %d, sec_mode: %d, Datarate: %llu, Settletime: %llu",
+			soc_info->index,
+			csiphy_dev->csiphy_info[offset].conn_csid_idx,
+			g_phy_data[soc_info->index].is_3phase ? "CPHY" : "DPHY",
+			csiphy_dev->start_dev_count,
+			offset,
+			csiphy_dev->combo_mode,
+			csiphy_dev->cphy_dphy_combo_mode,
+			csiphy_dev->csiphy_info[offset].mipi_flags,
+			csiphy_dev->csiphy_info[offset].secure_mode,
+			csiphy_dev->csiphy_info[offset].data_rate,
+			csiphy_dev->csiphy_info[offset].settle_time);
+	}
+		break;
+	case CAM_CONFIG_DEV_EXTERNAL: {
+		struct cam_config_dev_cmd submit_cmd;
+
+		if (copy_from_user(&submit_cmd,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(struct cam_config_dev_cmd))) {
+			CAM_ERR(CAM_CSIPHY, "failed copy config ext\n");
+			rc = -EFAULT;
+			goto release_mutex;
+		} else {
+			rc = cam_csiphy_external_cmd(csiphy_dev, &submit_cmd);
+			if (rc) {
+				CAM_ERR(CAM_CSIPHY,
+					"exteranal command configuration failed rc: %d",
+					rc);
+				goto release_mutex;
+			}
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_CSIPHY, "Invalid Opcode: %d", cmd->op_code);
+		rc = -EINVAL;
+		goto release_mutex;
+	}
+
+	mutex_unlock(&csiphy_dev->mutex);
+	return rc;
+
+hw_cnt_decrement:
+	if (csiphy_dev->prgm_cmn_reg_across_csiphy) {
+		mutex_lock(&active_csiphy_cnt_mutex);
+		active_csiphy_hw_cnt--;
+		mutex_unlock(&active_csiphy_cnt_mutex);
+	}
+
+cpas_stop:
+	if (cam_csiphy_cpas_ops(csiphy_dev->cpas_handle, false))
+		CAM_ERR(CAM_CSIPHY, "cpas stop failed");
+release_mutex:
+	mutex_unlock(&csiphy_dev->mutex);
+
+	return rc;
+}
+
+int cam_csiphy_register_baseaddress(struct csiphy_device *csiphy_dev)
+{
+	int phy_idx;
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "Data is NULL");
+		return -EINVAL;
+	}
+
+	if (csiphy_dev->soc_info.index >= MAX_CSIPHY) {
+		CAM_ERR(CAM_CSIPHY, "Invalid soc index: %u Max soc index: %u",
+			csiphy_dev->soc_info.index, MAX_CSIPHY);
+		return -EINVAL;
+	}
+
+	phy_idx = csiphy_dev->soc_info.index;
+	g_phy_data[phy_idx].base_address =
+		csiphy_dev->soc_info.reg_map[0].mem_base;
+	g_phy_data[phy_idx].cpas_handle =
+		csiphy_dev->cpas_handle;
+	g_phy_data[phy_idx].aon_sel_param =
+		csiphy_dev->ctrl_reg->csiphy_reg->aon_sel_params;
+	g_phy_data[phy_idx].aon_cam_id = NOT_AON_CAM;
+	g_phy_data[phy_idx].is_configured_for_main = false;
+	g_phy_data[phy_idx].data_rate_aux_mask = 0;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.h
@@ -0,0 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_CORE_H_
+#define _CAM_CSIPHY_CORE_H_
+
+#include <linux/irqreturn.h>
+#include "cam_csiphy_dev.h"
+#include <cam_mem_mgr.h>
+#include <cam_req_mgr_util.h>
+#include <cam_io_util.h>
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API programs CSIPhy IRQ  registers
+ */
+void cam_csiphy_cphy_irq_config(struct csiphy_device *csiphy_dev);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API resets CSIPhy hardware
+ */
+void cam_csiphy_reset(struct csiphy_device *csiphy_dev);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ * @arg:    Camera control command argument
+ *
+ * This API handles the camera control argument reached to CSIPhy
+ */
+int cam_csiphy_core_cfg(void *csiphy_dev, void *arg);
+
+/**
+ * @irq_num: IRQ number
+ * @data: CSIPhy device structure
+ *
+ * This API handles CSIPhy IRQs
+ */
+irqreturn_t cam_csiphy_irq(int irq_num, void *data);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API handles the CSIPhy close
+ */
+void cam_csiphy_shutdown(struct csiphy_device *csiphy_dev);
+
+/**
+ * @soc_idx : CSIPHY cell index
+ *
+ * This API registers base address per soc_idx
+ */
+int cam_csiphy_register_baseaddress(struct csiphy_device *csiphy_dev);
+
+/**
+ * @get_access : Get Access for the Main Camera over AON Camera
+ * @phy_idx    : To acquire the correct PHY hw to do the operation with
+ *
+ * This API provides Utility/helper function to program the MUX for
+ * correct PHY hw.
+ *
+ */
+int cam_csiphy_util_update_aon_ops(bool get_access, uint32_t phy_idx);
+
+
+/**
+ * @csiphy_dev : CSIPhy device structure
+ *
+ * This API updates the auxiliary settings mask for the current data rate
+ *
+ */
+void cam_csiphy_update_auxiliary_mask(struct csiphy_device *csiphy_dev);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API allows to print all the cphy/dphy specific status registers
+ */
+int cam_csiphy_dump_status_reg(struct csiphy_device *csiphy_dev);
+
+/**
+ * @phy_idx         : To acquire the correct PHY hw to do the operation with
+ * @aon_camera_id   : AON Camera ID
+ *
+ * This API provides Utility/helper function to register AON Hw supprot for
+ * correct PHY hw.
+ *
+ */
+int cam_csiphy_util_update_aon_registration(uint32_t phy_idx, uint32_t aon_camera_id);
+#endif /* _CAM_CSIPHY_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.c
@@ -0,0 +1,702 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_csiphy_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_csiphy_soc.h"
+#include "cam_csiphy_core.h"
+#include <media/cam_sensor.h>
+#include "camera_main.h"
+#include <dt-bindings/msm-camera.h>
+
+#define CSIPHY_DEBUGFS_NAME_MAX_SIZE 10
+static struct dentry *root_dentry;
+
+static inline void cam_csiphy_trigger_reg_dump(struct csiphy_device *csiphy_dev)
+{
+	cam_csiphy_common_status_reg_dump(csiphy_dev);
+
+	if (csiphy_dev->en_full_phy_reg_dump)
+		cam_csiphy_reg_dump(&csiphy_dev->soc_info);
+
+	if (csiphy_dev->en_lane_status_reg_dump) {
+		CAM_INFO(CAM_CSIPHY, "Status Reg Dump on failure");
+		cam_csiphy_dump_status_reg(csiphy_dev);
+	}
+}
+
+static int cam_csiphy_format_secure_phy_lane_info(
+	struct csiphy_device *csiphy_dev, int offset, uint64_t *mask)
+{
+	struct cam_csiphy_param *param;
+	uint64_t phy_lane_sel_mask = 0;
+
+	param = &csiphy_dev->csiphy_info[offset];
+
+	if (param->csiphy_3phase) {
+		if (param->lane_enable & CPHY_LANE_0)
+			phy_lane_sel_mask |= LANE_0_SEL;
+		if (param->lane_enable & CPHY_LANE_1)
+			phy_lane_sel_mask |= LANE_1_SEL;
+		if (param->lane_enable & CPHY_LANE_2)
+			phy_lane_sel_mask |= LANE_2_SEL;
+		phy_lane_sel_mask <<= CPHY_LANE_SELECTION_SHIFT;
+	} else {
+		if (param->lane_enable & DPHY_LANE_0)
+			phy_lane_sel_mask |= LANE_0_SEL;
+		if (param->lane_enable & DPHY_LANE_1)
+			phy_lane_sel_mask |= LANE_1_SEL;
+		if (param->lane_enable & DPHY_LANE_2)
+			phy_lane_sel_mask |= LANE_2_SEL;
+		if (param->lane_enable & DPHY_LANE_3)
+			phy_lane_sel_mask |= LANE_3_SEL;
+		phy_lane_sel_mask <<= DPHY_LANE_SELECTION_SHIFT;
+	}
+	if (csiphy_dev->soc_info.index > MAX_SUPPORTED_PHY_IDX) {
+		CAM_ERR(CAM_CSIPHY, "Invalid PHY index: %u",
+			csiphy_dev->soc_info.index);
+			return -EINVAL;
+	}
+
+	phy_lane_sel_mask |= BIT(csiphy_dev->soc_info.index);
+	*mask = phy_lane_sel_mask;
+
+	CAM_DBG(CAM_CSIPHY, "Formatted PHY[%u] phy_lane_sel_mask: 0x%llx",
+		csiphy_dev->soc_info.index, *mask);
+
+	return 0;
+
+}
+
+static int cam_csiphy_get_session_index(struct csiphy_device *csiphy_dev,
+	uint32_t lane_assign)
+{
+	int i = 0;
+	struct cam_csiphy_param *param;
+
+	for (i = 0; i < CSIPHY_MAX_INSTANCES_PER_PHY; i++) {
+		param = &csiphy_dev->csiphy_info[i];
+
+		if (param->lane_assign == lane_assign)
+			break;
+	}
+
+	return i;
+}
+
+static void cam_csiphy_populate_secure_info(
+	struct csiphy_device *csiphy_dev, void *data)
+{
+	int i;
+	struct cam_csiphy_secure_info *secure_info =
+		(struct cam_csiphy_secure_info *)data;
+	struct cam_csiphy_param *param;
+
+	for (i = 0; i < CSIPHY_MAX_INSTANCES_PER_PHY; i++) {
+		param = &csiphy_dev->csiphy_info[i];
+
+		if (param->secure_mode &&
+			param->lane_assign == secure_info->lane_assign) {
+
+			param->secure_info.cdm_hw_idx_mask = secure_info->cdm_hw_idx_mask;
+			param->secure_info.csid_hw_idx_mask = secure_info->csid_hw_idx_mask;
+			param->secure_info.vc_mask = secure_info->vc_mask;
+			param->secure_info.phy_lane_sel_mask = 0;
+
+			if (!cam_csiphy_format_secure_phy_lane_info(csiphy_dev, i,
+				&param->csiphy_phy_lane_sel_mask)) {
+				param->secure_info_updated =  true;
+
+				CAM_DBG(CAM_CSIPHY,
+					"PHY[%d] secure info, phy_lane_mask: 0x%llx, ife: 0x%x, cdm: 0x%x, vc_mask: 0x%llx",
+					csiphy_dev->soc_info.index,
+					param->csiphy_phy_lane_sel_mask,
+					param->secure_info.csid_hw_idx_mask,
+					param->secure_info.cdm_hw_idx_mask,
+					param->secure_info.vc_mask);
+			} else
+				CAM_ERR(CAM_CSIPHY,
+					"Error in formatting PHY[%u] phy_lane_sel_mask: 0x%llx",
+					csiphy_dev->soc_info.index,
+					param->csiphy_phy_lane_sel_mask);
+
+			break;
+		}
+	}
+
+	if (i == CSIPHY_MAX_INSTANCES_PER_PHY)
+		CAM_ERR(CAM_CSIPHY, "No matching secure PHY for a session");
+
+}
+
+static void cam_csiphy_subdev_handle_message(struct v4l2_subdev *sd,
+	enum cam_subdev_message_type_t message_type, void *data)
+{
+	struct csiphy_device *csiphy_dev = v4l2_get_subdevdata(sd);
+	uint32_t phy_idx;
+	int rc = 0;
+
+	if (!data) {
+		CAM_ERR(CAM_CSIPHY, "Empty Payload");
+		return;
+	}
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "csiphy_dev ptr is NULL");
+		return;
+	}
+
+	phy_idx = *(uint32_t *)data;
+	if (phy_idx != csiphy_dev->soc_info.index) {
+		CAM_DBG(CAM_CSIPHY, "Current HW IDX: %u, Expected IDX: %u",
+			csiphy_dev->soc_info.index, phy_idx);
+		return;
+	}
+
+	switch (message_type) {
+	case CAM_SUBDEV_MESSAGE_REG_DUMP: {
+		cam_csiphy_trigger_reg_dump(csiphy_dev);
+		break;
+	}
+	case CAM_SUBDEV_MESSAGE_APPLY_CSIPHY_AUX: {
+		cam_csiphy_trigger_reg_dump(csiphy_dev);
+
+		if (!csiphy_dev->skip_aux_settings) {
+			cam_csiphy_update_auxiliary_mask(csiphy_dev);
+
+			CAM_INFO(CAM_CSIPHY,
+				"CSIPHY[%u] updating aux settings for data rate idx: %u",
+				csiphy_dev->soc_info.index, csiphy_dev->curr_data_rate_idx);
+		}
+		break;
+	}
+	case CAM_SUBDEV_MESSAGE_DOMAIN_ID_SECURE_PARAMS: {
+		cam_csiphy_populate_secure_info(csiphy_dev, data);
+
+		break;
+	}
+	case CAM_SUBDEV_MESSAGE_CONN_CSID_INFO: {
+		struct cam_subdev_msg_phy_conn_csid_info *conn_csid_info =
+			(struct cam_subdev_msg_phy_conn_csid_info *) data;
+		int idx;
+		struct cam_csiphy_param *param;
+
+		idx = cam_csiphy_get_session_index(csiphy_dev, conn_csid_info->lane_cfg);
+		if (idx >= CSIPHY_MAX_INSTANCES_PER_PHY) {
+			CAM_ERR(CAM_CSIPHY, "Phy session not found %d %d",
+				csiphy_dev->soc_info.index, conn_csid_info->lane_cfg);
+			break;
+		}
+
+		param = &csiphy_dev->csiphy_info[idx];
+		param->conn_csid_idx = conn_csid_info->core_idx;
+
+		CAM_DBG(CAM_CSIPHY, "PHY: %d, CSID: %d connected", csiphy_dev->soc_info.index,
+			param->conn_csid_idx);
+		break;
+	}
+	case CAM_SUBDEV_MESSAGE_DRV_INFO: {
+		struct cam_subdev_msg_phy_drv_info *drv_info =
+			(struct cam_subdev_msg_phy_drv_info *) data;
+		int idx;
+		struct cam_csiphy_param *param;
+
+		idx = cam_csiphy_get_session_index(csiphy_dev, drv_info->lane_cfg);
+		if (idx >= CSIPHY_MAX_INSTANCES_PER_PHY) {
+			CAM_ERR(CAM_CSIPHY, "Phy session not found %d %d",
+				csiphy_dev->soc_info.index, drv_info->lane_cfg);
+			break;
+		}
+
+		param = &csiphy_dev->csiphy_info[idx];
+		param->is_drv_config_en = drv_info->is_drv_config_en;
+		param->use_hw_client_voting = drv_info->use_hw_client_voting;
+
+		CAM_DBG(CAM_CSIPHY,
+			"PHY: %d, CSID: %d DRV info : use hw client %d, enable drv config %d",
+			csiphy_dev->soc_info.index, param->conn_csid_idx,
+			param->use_hw_client_voting, param->is_drv_config_en);
+
+		break;
+	}
+	case CAM_SUBDEV_MESSAGE_NOTIFY_HALT_RESUME: {
+		int drv_idx;
+		struct cam_subdev_msg_phy_halt_resume_info *halt_resume_info =
+			(struct cam_subdev_msg_phy_halt_resume_info *) data;
+		int idx;
+		struct cam_csiphy_param *param;
+		unsigned long clk_rate;
+
+		idx = cam_csiphy_get_session_index(csiphy_dev, halt_resume_info->lane_cfg);
+		if (idx >= CSIPHY_MAX_INSTANCES_PER_PHY) {
+			CAM_ERR(CAM_CSIPHY, "Phy session not found %d %d",
+				csiphy_dev->soc_info.index, halt_resume_info->lane_cfg);
+			break;
+		}
+
+		param = &csiphy_dev->csiphy_info[idx];
+		drv_idx = param->conn_csid_idx;
+
+		if (!csiphy_dev->soc_info.is_clk_drv_en || !param->use_hw_client_voting ||
+			!param->is_drv_config_en)
+			break;
+
+		CAM_DBG(CAM_CSIPHY,
+			"PHY: %d, CSID: %d DRV info : use hw client %d, enable drv config %d, op=%s",
+			csiphy_dev->soc_info.index, param->conn_csid_idx,
+			param->use_hw_client_voting, param->is_drv_config_en,
+			(halt_resume_info->csid_state == CAM_SUBDEV_PHY_CSID_HALT) ? "HALT" :
+			"RESUME");
+
+		if (halt_resume_info->csid_state == CAM_SUBDEV_PHY_CSID_HALT) {
+			clk_rate =
+				csiphy_dev->soc_info.applied_src_clk_rates.hw_client[drv_idx].high;
+
+			rc = cam_soc_util_set_src_clk_rate(&csiphy_dev->soc_info,
+				CAM_CLK_SW_CLIENT_IDX, clk_rate, 0);
+			if (rc)
+				CAM_ERR(CAM_CSIPHY,
+					"PHY[%d] CSID HALT: csiphy set_rate %ld failed rc: %d",
+					phy_idx, clk_rate, rc);
+		} else if (halt_resume_info->csid_state == CAM_SUBDEV_PHY_CSID_RESUME) {
+			int32_t src_idx = csiphy_dev->soc_info.src_clk_idx;
+			uint32_t lowest_clk_level = csiphy_dev->soc_info.lowest_clk_level;
+
+			clk_rate = csiphy_dev->soc_info.clk_rate[lowest_clk_level][src_idx];
+
+			rc = cam_soc_util_set_src_clk_rate(&csiphy_dev->soc_info,
+				CAM_CLK_SW_CLIENT_IDX, clk_rate, 0);
+			if (rc)
+				CAM_ERR(CAM_CSIPHY,
+					"PHY[%d] CSID RESUME: csiphy _set_rate %ld failed rc: %d",
+					phy_idx, clk_rate, rc);
+		} else {
+			CAM_ERR(CAM_CSIPHY,
+				"CSIPHY:%d Failed to handle CSID halt resume csid_state: %d",
+				phy_idx, halt_resume_info->csid_state);
+		}
+		break;
+	}
+	default:
+		break;
+	}
+}
+
+static int cam_csiphy_debug_register(struct csiphy_device *csiphy_dev)
+{
+	struct dentry *dbgfileptr = NULL;
+	char debugfs_name[CSIPHY_DEBUGFS_NAME_MAX_SIZE];
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "null CSIPHY dev ptr");
+		return -EINVAL;
+	}
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	if (!root_dentry) {
+		if (cam_debugfs_create_subdir("csiphy", &dbgfileptr)) {
+			CAM_ERR(CAM_CSIPHY,
+				"Debugfs could not create directory!");
+			return -ENOENT;
+		}
+		root_dentry = dbgfileptr;
+	}
+
+	/* Create the CSIPHY directory for this csiphy */
+	snprintf(debugfs_name, CSIPHY_DEBUGFS_NAME_MAX_SIZE, "CSIPHY%d",
+		csiphy_dev->soc_info.index);
+	dbgfileptr = debugfs_create_dir(debugfs_name, root_dentry);
+	if (IS_ERR(dbgfileptr)) {
+		CAM_ERR(CAM_CSIPHY, "Could not create a debugfs PHY indx subdirectory. rc: %ld",
+			dbgfileptr);
+		return -ENOENT;
+	}
+
+	debugfs_create_bool("en_common_status_reg_dump", 0644,
+		dbgfileptr, &csiphy_dev->en_common_status_reg_dump);
+
+	debugfs_create_bool("en_lane_status_reg_dump", 0644,
+		dbgfileptr, &csiphy_dev->en_lane_status_reg_dump);
+
+	debugfs_create_bool("en_full_phy_reg_dump", 0644,
+		dbgfileptr, &csiphy_dev->en_full_phy_reg_dump);
+
+	debugfs_create_bool("skip_aux_settings", 0644,
+		dbgfileptr, &csiphy_dev->skip_aux_settings);
+
+	return 0;
+}
+
+static void cam_csiphy_debug_unregister(void)
+{
+	root_dentry = NULL;
+}
+
+static int cam_csiphy_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct csiphy_device *csiphy_dev =
+		v4l2_get_subdevdata(sd);
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "csiphy_dev ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&csiphy_dev->mutex);
+	cam_csiphy_shutdown(csiphy_dev);
+	mutex_unlock(&csiphy_dev->mutex);
+
+	return 0;
+}
+
+static int cam_csiphy_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_CSIPHY, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_csiphy_subdev_close_internal(sd, fh);
+}
+
+static long cam_csiphy_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	struct csiphy_device *csiphy_dev = v4l2_get_subdevdata(sd);
+	int rc = 0;
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "csiphy_dev ptr is NULL");
+		return -EINVAL;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_csiphy_core_cfg(csiphy_dev, arg);
+		if (rc)
+			CAM_ERR(CAM_CSIPHY,
+				"Failed in configuring the device: %d", rc);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_csiphy_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_CSIPHY, "Wrong ioctl : %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_csiphy_subdev_compat_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	int32_t rc = 0;
+	struct cam_control cmd_data;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_CSIPHY, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	/* All the arguments converted to 64 bit here
+	 * Passed to the api in core.c
+	 */
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_csiphy_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc)
+			CAM_ERR(CAM_CSIPHY,
+				"Failed in subdev_ioctl: %d", rc);
+		break;
+	default:
+		CAM_ERR(CAM_CSIPHY, "Invalid compat ioctl cmd: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_CSIPHY,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+static struct v4l2_subdev_core_ops csiphy_subdev_core_ops = {
+	.ioctl = cam_csiphy_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_csiphy_subdev_compat_ioctl,
+#endif
+};
+
+static const struct v4l2_subdev_ops csiphy_subdev_ops = {
+	.core = &csiphy_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops csiphy_subdev_intern_ops = {
+	.close = cam_csiphy_subdev_close,
+};
+
+static int cam_csiphy_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_cpas_register_params cpas_parms;
+	struct csiphy_device *new_csiphy_dev;
+	int32_t               rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+	char wq_name[32];
+	int i;
+
+	new_csiphy_dev = devm_kzalloc(&pdev->dev,
+		sizeof(struct csiphy_device), GFP_KERNEL);
+	if (!new_csiphy_dev)
+		return -ENOMEM;
+
+	mutex_init(&new_csiphy_dev->mutex);
+	new_csiphy_dev->v4l2_dev_str.pdev = pdev;
+
+	new_csiphy_dev->soc_info.pdev = pdev;
+	new_csiphy_dev->soc_info.dev = &pdev->dev;
+	new_csiphy_dev->soc_info.dev_name = pdev->name;
+	new_csiphy_dev->ref_count = 0;
+	new_csiphy_dev->current_data_rate = 0;
+
+	rc = cam_csiphy_parse_dt_info(pdev, new_csiphy_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "DT parsing failed: %d", rc);
+		goto csiphy_no_resource;
+	}
+
+	/* validate PHY fuse only for CSIPHY4 */
+	if ((new_csiphy_dev->soc_info.index == 4) &&
+		!cam_cpas_is_feature_supported(
+			CAM_CPAS_CSIPHY_FUSE,
+			(1 << new_csiphy_dev->soc_info.index), NULL)) {
+		CAM_ERR(CAM_CSIPHY, "PHY%d is not supported",
+			new_csiphy_dev->soc_info.index);
+		goto csiphy_no_resource;
+	}
+
+	if (cam_cpas_query_domain_id_security_support())
+		new_csiphy_dev->domain_id_security = true;
+
+	new_csiphy_dev->v4l2_dev_str.internal_ops =
+		&csiphy_subdev_intern_ops;
+	new_csiphy_dev->v4l2_dev_str.ops =
+		&csiphy_subdev_ops;
+	snprintf(new_csiphy_dev->device_name,
+		CAM_CTX_DEV_NAME_MAX_LENGTH,
+		"%s%d", CAMX_CSIPHY_DEV_NAME,
+		new_csiphy_dev->soc_info.index);
+	new_csiphy_dev->v4l2_dev_str.name =
+		new_csiphy_dev->device_name;
+	new_csiphy_dev->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	new_csiphy_dev->v4l2_dev_str.ent_function =
+		CAM_CSIPHY_DEVICE_TYPE;
+	new_csiphy_dev->v4l2_dev_str.msg_cb =
+		cam_csiphy_subdev_handle_message;
+	new_csiphy_dev->v4l2_dev_str.token =
+		new_csiphy_dev;
+	new_csiphy_dev->v4l2_dev_str.close_seq_prior =
+		CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(new_csiphy_dev->v4l2_dev_str));
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "cam_register_subdev Failed rc: %d", rc);
+		goto csiphy_no_resource;
+	}
+
+	platform_set_drvdata(pdev, &(new_csiphy_dev->v4l2_dev_str.sd));
+
+	for (i = 0; i < CSIPHY_MAX_INSTANCES_PER_AGGREG_RX_PHY; i++) {
+		new_csiphy_dev->csiphy_info[i].hdl_data.device_hdl = -1;
+		new_csiphy_dev->csiphy_info[i].hdl_data.session_hdl = -1;
+		new_csiphy_dev->csiphy_info[i].csiphy_3phase = -1;
+		new_csiphy_dev->csiphy_info[i].data_rate = 0;
+		new_csiphy_dev->csiphy_info[i].settle_time = 0;
+		new_csiphy_dev->csiphy_info[i].lane_cnt = 0;
+		new_csiphy_dev->csiphy_info[i].lane_assign = 0;
+		new_csiphy_dev->csiphy_info[i].lane_enable = 0;
+		new_csiphy_dev->csiphy_info[i].mipi_flags = 0;
+		new_csiphy_dev->csiphy_info[i].conn_csid_idx = -1;
+		new_csiphy_dev->csiphy_info[i].use_hw_client_voting = false;
+		new_csiphy_dev->csiphy_info[i].is_drv_config_en = false;
+		new_csiphy_dev->lanes_assigned[i].lane_assign = -1;
+		new_csiphy_dev->lanes_assigned[i].lane_assign_cnt = 0;
+	}
+
+	new_csiphy_dev->ops.get_dev_info = NULL;
+	new_csiphy_dev->ops.link_setup = NULL;
+	new_csiphy_dev->ops.apply_req = NULL;
+
+	new_csiphy_dev->acquire_count = 0;
+	new_csiphy_dev->start_dev_count = 0;
+	new_csiphy_dev->preamble_enable = 0;
+
+	if (new_csiphy_dev->is_aggregator_rx)
+		new_csiphy_dev->session_max_device_support =
+			CSIPHY_MAX_INSTANCES_PER_AGGREG_RX_PHY;
+
+	cpas_parms.cam_cpas_client_cb = NULL;
+	cpas_parms.cell_index = new_csiphy_dev->soc_info.index;
+	cpas_parms.dev = &pdev->dev;
+	cpas_parms.userdata = new_csiphy_dev;
+
+	strscpy(cpas_parms.identifier, "csiphy", CAM_HW_IDENTIFIER_LENGTH);
+
+	rc = cam_cpas_register_client(&cpas_parms);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY, "CPAS registration failed rc: %d", rc);
+		goto csiphy_unregister_subdev;
+	}
+
+	CAM_DBG(CAM_CSIPHY, "CPAS registration successful handle=%d",
+		cpas_parms.client_handle);
+	new_csiphy_dev->cpas_handle = cpas_parms.client_handle;
+
+	snprintf(wq_name, 32, "%s%d%s", "csiphy",
+		new_csiphy_dev->soc_info.index, "_wq");
+
+	rc = cam_csiphy_register_baseaddress(new_csiphy_dev);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY, "Failed to register baseaddress, rc: %d", rc);
+		goto cpas_unregister;
+	}
+
+	CAM_DBG(CAM_CSIPHY, "%s component bound successfully",
+		pdev->name);
+
+	cam_csiphy_debug_register(new_csiphy_dev);
+
+	return rc;
+
+cpas_unregister:
+	cam_cpas_unregister_client(new_csiphy_dev->cpas_handle);
+csiphy_unregister_subdev:
+	cam_unregister_subdev(&(new_csiphy_dev->v4l2_dev_str));
+csiphy_no_resource:
+	mutex_destroy(&new_csiphy_dev->mutex);
+	devm_kfree(&pdev->dev, new_csiphy_dev);
+	return rc;
+}
+
+static void cam_csiphy_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	struct v4l2_subdev *subdev = NULL;
+	struct csiphy_device *csiphy_dev = NULL;
+
+	subdev = platform_get_drvdata(pdev);
+
+	if (!subdev) {
+		CAM_ERR(CAM_CSIPHY, "Error No data in subdev");
+		return;
+	}
+
+	csiphy_dev = v4l2_get_subdevdata(subdev);
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "Error No data in csiphy_dev");
+		return;
+	}
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "csiphy_dev ptr is NULL");
+		return;
+	}
+
+	cam_csiphy_debug_unregister();
+	CAM_INFO(CAM_CSIPHY, "Unbind CSIPHY component");
+	cam_cpas_unregister_client(csiphy_dev->cpas_handle);
+	cam_csiphy_soc_release(csiphy_dev);
+	mutex_lock(&csiphy_dev->mutex);
+	cam_csiphy_shutdown(csiphy_dev);
+	mutex_unlock(&csiphy_dev->mutex);
+	cam_unregister_subdev(&(csiphy_dev->v4l2_dev_str));
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&(csiphy_dev->v4l2_dev_str.sd), NULL);
+	devm_kfree(&pdev->dev, csiphy_dev);
+}
+
+const static struct component_ops cam_csiphy_component_ops = {
+	.bind = cam_csiphy_component_bind,
+	.unbind = cam_csiphy_component_unbind,
+};
+
+static int32_t cam_csiphy_platform_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CSIPHY, "Adding CSIPHY component");
+	rc = component_add(&pdev->dev, &cam_csiphy_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CSIPHY, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+
+static int32_t cam_csiphy_device_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_csiphy_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_csiphy_dt_match[] = {
+	{.compatible = "qcom,csiphy"},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_csiphy_dt_match);
+
+struct platform_driver csiphy_driver = {
+	.probe = cam_csiphy_platform_probe,
+	.remove = cam_csiphy_device_remove,
+	.driver = {
+		.name = CAMX_CSIPHY_DEV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_csiphy_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int32_t cam_csiphy_init_module(void)
+{
+	return platform_driver_register(&csiphy_driver);
+}
+
+void cam_csiphy_exit_module(void)
+{
+	platform_driver_unregister(&csiphy_driver);
+}
+
+MODULE_DESCRIPTION("CAM CSIPHY driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.h
@@ -0,0 +1,493 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_DEV_H_
+#define _CAM_CSIPHY_DEV_H_
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/irqreturn.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_defs.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_req_mgr_interface.h>
+#include <cam_subdev.h>
+#include <cam_io_util.h>
+#include <cam_cpas_api.h>
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_context.h"
+
+#define MAX_CSIPHY                  8
+
+#define CSIPHY_NUM_CLK_MAX          16
+
+#define MAX_LANES                   5
+#define MAX_SETTINGS_PER_LANE       50
+#define MAX_DATA_RATES              25
+#define MAX_DATA_RATE_REGS          30
+
+#define CAMX_CSIPHY_DEV_NAME "cam-csiphy-driver"
+#define CAM_CSIPHY_RX_CLK_SRC "cphy_rx_src_clk"
+
+#define CSIPHY_DEFAULT_PARAMS            BIT(0)
+#define CSIPHY_LANE_ENABLE               BIT(1)
+#define CSIPHY_SETTLE_CNT_LOWER_BYTE     BIT(2)
+#define CSIPHY_SETTLE_CNT_HIGHER_BYTE    BIT(3)
+#define CSIPHY_2PH_REGS                  BIT(4)
+#define CSIPHY_3PH_REGS                  BIT(5)
+#define CSIPHY_SKEW_CAL                  BIT(6)
+#define CSIPHY_2PH_COMBO_REGS            BIT(7)
+#define CSIPHY_3PH_COMBO_REGS            BIT(8)
+#define CSIPHY_2PH_3PH_COMBO_REGS        BIT(9)
+#define CSIPHY_AUXILIARY_SETTING         BIT(10)
+#define CSIPHY_CDR_LN_SETTINGS           BIT(11)
+#define CSIPHY_SHORT_CHANNEL_PARAMS      BIT(12)
+#define CSIPHY_STANDARD_CHANNEL_PARAMS   BIT(13)
+#define CSIPHY_DNP_PARAMS                BIT(14)
+
+#define CSIPHY_MAX_INSTANCES_PER_PHY           3
+#define CSIPHY_MAX_INSTANCES_PER_AGGREG_RX_PHY 6
+
+#define CAM_CSIPHY_MAX_DPHY_LANES            4
+#define CAM_CSIPHY_MAX_CPHY_LANES            3
+#define CAM_CSIPHY_MAX_CPHY_DPHY_COMBO_LN    3
+#define CAM_CSIPHY_MAX_DATARATE_VARIANTS     3
+
+#define DPHY_LANE_0    BIT(0)
+#define CPHY_LANE_0    BIT(1)
+#define DPHY_LANE_1    BIT(2)
+#define CPHY_LANE_1    BIT(3)
+#define DPHY_LANE_2    BIT(4)
+#define CPHY_LANE_2    BIT(5)
+#define DPHY_LANE_3    BIT(6)
+#define DPHY_CLK_LN    BIT(7)
+
+/* Lane info packing for scm call */
+#define LANE_0_SEL                   BIT(0)
+#define LANE_1_SEL                   BIT(1)
+#define LANE_2_SEL                   BIT(2)
+#define LANE_3_SEL                   BIT(3)
+#define CPHY_LANE_SELECTION_SHIFT    16
+#define DPHY_LANE_SELECTION_SHIFT    24
+#define MAX_SUPPORTED_PHY_IDX        7
+
+/* PRBS Pattern Macros */
+#define PREAMBLE_PATTERN_SET_CHECKER    BIT(4)
+#define PREAMBLE_PATTERN_BIST_DONE      BIT(0)
+#define PREAMBLE_MAX_ERR_COUNT_ALLOWED  2
+
+enum cam_csiphy_state {
+	CAM_CSIPHY_INIT,
+	CAM_CSIPHY_ACQUIRE,
+	CAM_CSIPHY_START,
+};
+
+enum cam_csiphy_datarate_channel {
+	CAM_CSIPHY_DATARATE_SHORT_CHANNEL,
+	CAM_CSIPHY_DATARATE_STANDARD_CHANNEL,
+};
+
+/**
+ * enum cam_csiphy_common_reg_program
+ * @CAM_CSIPHY_PRGM_ALL              : Programs common registers for all CSIPHYs
+ * @CAM_CSIPHY_PRGM_INDVDL           : Programs common registers only for the given CSIPHY
+ */
+enum cam_csiphy_common_reg_program {
+	CAM_CSIPHY_PRGM_ALL = 0,
+	CAM_CSIPHY_PRGM_INDVDL,
+};
+
+/**
+ * struct cam_csiphy_secure_info
+ *
+ * This is an internal struct that is a reflection of the one
+ * passed over from csid
+ *
+ * @phy_lane_sel_mask: This value to be filled completely by csiphy
+ * @lane_assign:       Lane_cfg value sent over from csid is
+ *                     equivalent to lane_assign here
+ * @vc_mask:           Virtual channel masks (Unused for mobile usecase)
+ * @csid_hw_idx_mask:  Bit position denoting CSID(s) in use for secure
+ *                     session
+ * @cdm_hw_idx_mask:   Bit position denoting CDM in use for secure
+ *                     session
+ */
+struct cam_csiphy_secure_info {
+	uint32_t phy_lane_sel_mask;
+	uint32_t lane_assign;
+	uint64_t vc_mask;
+	uint32_t csid_hw_idx_mask;
+	uint32_t cdm_hw_idx_mask;
+};
+
+/**
+ * struct cam_csiphy_aon_sel_params_t
+ * @aon_cam_sel_offset : AON Cam Select Register offset in cpas top
+ * @cam_sel_mask       : Camera select mask.
+ * @mclk_sel_mask      : MCLK select mask.
+ */
+struct cam_csiphy_aon_sel_params_t {
+	uint32_t aon_cam_sel_offset[MAX_AON_CAM];
+	uint32_t cam_sel_mask;
+	uint32_t mclk_sel_mask;
+};
+
+/**
+ * struct cam_cphy_dphy_status_reg_params_t
+ * @csiphy_3ph_status0_offset              : CSIPhy 3ph status addr
+ * @csiphy_2ph_status0_offset              : CSIPhy 2ph status addr
+ * @cphy_lane_status                       : CPHY Lane status6 register offsets for each lane
+ * @csiphy_3ph_status_size                 : CSIPhy 3ph status registers size
+ * @csiphy_2ph_status_size                 : CSIPhy 2ph status registers size
+ */
+struct cam_cphy_dphy_status_reg_params_t {
+	uint32_t csiphy_3ph_status0_offset;
+	uint32_t csiphy_2ph_status0_offset;
+	uint32_t cphy_lane_status[CAM_CSIPHY_MAX_CPHY_LANES];
+	uint16_t csiphy_3ph_status_size;
+	uint16_t csiphy_2ph_status_size;
+};
+
+/**
+ * struct csiphy_reg_parms_t
+ * @mipi_csiphy_glbl_irq_cmd_addr     : CSIPhy irq addr
+ * @mipi_csiphy_interrupt_status0_addr: CSIPhy interrupt status addr
+ * @mipi_csiphy_interrupt_clear0_addr : CSIPhy interrupt clear addr
+ * @status_reg_params                 : Parameters to read cphy/dphy
+ *                                      specific status registers
+ * @size_offset_betn_lanes            : Size Offset between consecutive
+ *                                      2ph or 3ph lanes
+ * @csiphy_interrupt_status_size      : Number of interrupt status registers
+ * @csiphy_num_common_status_regs     : Number of common status registers
+ * @csiphy_common_reg_array_size      : CSIPhy common array size
+ * @csiphy_reset_enter_array_size     : CSIPhy reset array size
+ * @csiphy_reset_exit_array_size      : CSIPhy reset release array size
+ * @csiphy_2ph_config_array_size      : 2ph settings size
+ * @csiphy_3ph_config_array_size      : 3ph settings size
+ * @csiphy_2ph_3ph_config_array_size  : Size of the 2ph-3ph combo settings array
+ * @csiphy_2ph_combo_config_array_size: Size of the 2ph-2ph combo settings array
+ * @csiphy_3ph_combo_config_array_size: Size of the 3ph-3ph combo settings array
+ * @aon_sel_params                    : aon selection parameters
+ */
+struct csiphy_reg_parms_t {
+/*MIPI CSI PHY registers*/
+	uint32_t mipi_csiphy_glbl_irq_cmd_addr;
+	uint32_t mipi_csiphy_interrupt_status0_addr;
+	uint32_t mipi_csiphy_interrupt_clear0_addr;
+	struct cam_cphy_dphy_status_reg_params_t *status_reg_params;
+	uint32_t size_offset_betn_lanes;
+	uint32_t csiphy_interrupt_status_size;
+	uint32_t csiphy_num_common_status_regs;
+	uint32_t csiphy_common_reg_array_size;
+	uint32_t csiphy_reset_enter_array_size;
+	uint32_t csiphy_reset_exit_array_size;
+	uint32_t csiphy_2ph_config_array_size;
+	uint32_t csiphy_3ph_config_array_size;
+	uint32_t csiphy_2ph_3ph_config_array_size;
+	uint32_t csiphy_2ph_combo_config_array_size;
+	uint32_t csiphy_3ph_combo_config_array_size;
+	struct cam_csiphy_aon_sel_params_t *aon_sel_params;
+};
+
+/**
+ * struct csiphy_intf_params
+ * @device_hdl     : Device Handle
+ * @session_hdl    : Session Handle
+ */
+struct csiphy_hdl_tbl {
+	int32_t device_hdl;
+	int32_t session_hdl;
+};
+
+/**
+ * struct csiphy_reg_t
+ * @reg_addr              : Register address
+ * @reg_data              : Register data
+ * @delay                 : Delay in us
+ * @csiphy_param_type     : CSIPhy parameter type
+ */
+struct csiphy_reg_t {
+	int32_t  reg_addr;
+	int32_t  reg_data;
+	int32_t  delay;
+	uint32_t csiphy_param_type;
+};
+
+struct csiphy_device;
+
+/*
+ * struct data_rate_reg_info_t
+ * @bandwidth                 : max bandwidth supported by this reg settings
+ * @data_rate_reg_array_size  : data rate settings size
+ * @data_rate_reg_array       : array of data rate specific reg value pairs
+ */
+struct data_rate_reg_info_t {
+	uint64_t bandwidth;
+	ssize_t  data_rate_reg_array_size;
+	struct csiphy_reg_t *data_rate_reg_array[MAX_CSIPHY][CAM_CSIPHY_MAX_DATARATE_VARIANTS];
+};
+
+/**
+ * struct data_rate_settings_t
+ * @num_data_rate_settings: Number of valid settings
+ *                           present in the data rate settings array
+ * @data_rate_settings    : Array of regsettings which are specific to
+ *                           data rate
+ */
+struct data_rate_settings_t {
+	ssize_t num_data_rate_settings;
+	struct data_rate_reg_info_t *data_rate_settings;
+};
+
+struct bist_reg_settings_t {
+	uint32_t error_status_val_3ph;
+	uint32_t error_status_val_2ph;
+	uint32_t set_status_update_3ph_base_offset;
+	uint32_t set_status_update_2ph_base_offset;
+	uint32_t bist_status_3ph_base_offset;
+	uint32_t bist_status_2ph_base_offset;
+	uint32_t bist_sensor_data_3ph_status_base_offset;
+	uint32_t bist_counter_3ph_base_offset;
+	uint32_t bist_counter_2ph_base_offset;
+	uint32_t number_of_counters;
+	ssize_t num_status_reg;
+	ssize_t num_3ph_bist_settings;
+	struct csiphy_reg_t *bist_3ph_settings_arry;
+	ssize_t num_2ph_bist_settings;
+	struct csiphy_reg_t *bist_2ph_settings_arry;
+	struct csiphy_reg_t *bist_status_arr;
+};
+
+/**
+ * struct csiphy_ctrl_t
+ * @csiphy_reg                : Register address
+ * @csiphy_common_reg         : Common register set
+ * @csiphy_irq_reg            : Irq register set
+ * @csiphy_reset_enter_regs   : Reset register set
+ * @csiphy_reset_exit_regs    : Reset release registers
+ * @csiphy_lane_config_reg    : Lane select register
+ * @csiphy_bist_reg           : Bist register set
+ * @csiphy_2ph_reg            : 2phase register set
+ * @csiphy_2ph_combo_mode_reg : 2ph-2ph combo register set
+ * @csiphy_3ph_reg            : 3phase register set
+ * @csiphy_3ph_combo_reg      : 3ph-3ph combo register set
+ * @csiphy_2ph_3ph_mode_reg   : 2ph-3ph combo register set
+ * @getclockvoting            : function pointer which is used to find the clock
+ *                               voting for the sensor output data rate
+ * @data_rate_settings_table  : Table which maintains the resgister settings specific to data rate
+ */
+struct csiphy_ctrl_t {
+	struct csiphy_reg_parms_t *csiphy_reg;
+	struct csiphy_reg_t *csiphy_common_reg;
+	struct csiphy_reg_t *csiphy_irq_reg;
+	struct csiphy_reg_t *csiphy_reset_enter_regs;
+	struct csiphy_reg_t *csiphy_reset_exit_regs;
+	struct csiphy_reg_t *csiphy_lane_config_reg;
+	struct bist_reg_settings_t *csiphy_bist_reg;
+	struct csiphy_reg_t *csiphy_2ph_reg;
+	struct csiphy_reg_t *csiphy_2ph_combo_mode_reg;
+	struct csiphy_reg_t *csiphy_3ph_reg;
+	struct csiphy_reg_t *csiphy_3ph_combo_reg;
+	struct csiphy_reg_t *csiphy_2ph_3ph_mode_reg;
+	enum   cam_vote_level (*getclockvoting)(struct csiphy_device *phy_dev, int32_t index);
+	struct data_rate_settings_t *data_rates_settings_table;
+};
+
+/**
+ * cam_csiphy_param            :  Provides cmdbuffer structure
+ * @lane_assign                :  Lanes the sensor will be using(One Lane idx in one Nibble)
+ * @lane_cnt                   :  Total number of lanes to be enabled
+ * @secure_mode                :  To identify whether stream is secure/nonsecure
+ * @lane_enable                :  Data Lane selection
+ * @settle_time                :  Settling time in ms
+ * @data_rate                  :  Data rate in mbps
+ * @csiphy_3phase              :  To identify DPHY or CPHY
+ * @mipi_flags                 :  MIPI phy flags
+ * @csiphy_cpas_cp_reg_mask    :  CP reg mask for phy instance
+ * @csiphy_phy_lane_sel_mask   :  Generic format for CP information for PHY and lane
+ * @hdl_data                   :  CSIPHY handle table
+ * @secure_info                :  All domain-id security related information packed in proper
+ *                                format for mink call
+ * @secure_info_updated        :  If all information in the secure_info struct above
+ *                                is passed and formatted properly from CSID driver
+ * @conn_csid_idx              : Connected CSID core idx (Primary csid in case of dual ife)
+ * @use_hw_client_voting       : Whether to use hw client voting for clk on chipsets with cesta
+ * @is_drv_config_en           : If drv is configured in CSID
+ * @channel_type              : Channel type for different channel settings
+ */
+struct cam_csiphy_param {
+	uint16_t                         lane_assign;
+	uint8_t                          lane_cnt;
+	uint8_t                          secure_mode;
+	uint32_t                         lane_enable;
+	uint64_t                         settle_time;
+	uint64_t                         data_rate;
+	int                              csiphy_3phase;
+	uint16_t                         mipi_flags;
+	uint64_t                         csiphy_cpas_cp_reg_mask;
+	uint64_t                         csiphy_phy_lane_sel_mask;
+	struct csiphy_hdl_tbl            hdl_data;
+	struct cam_csiphy_secure_info    secure_info;
+	bool                             secure_info_updated;
+	int32_t                          conn_csid_idx;
+	bool                             use_hw_client_voting;
+	bool                             is_drv_config_en;
+	uint32_t                         channel_type;
+};
+
+/**
+ * cam_lanes_assigned_info     :  Provides info on each lane assign
+ * @lane_assign                :  Lane sensor will be using
+ * @lane_assign_cnt            :  Number of sensors having same lane assign
+ */
+struct cam_lanes_assigned_info {
+	int16_t                    lane_assign;
+	uint8_t                    lane_assign_cnt;
+};
+
+struct csiphy_work_queue {
+	struct csiphy_device *csiphy_dev;
+	int32_t acquire_idx;
+	struct work_struct work;
+};
+
+/**
+ * struct cam_csiphy_dev_cdr_sweep_params
+ *
+ * @cdr_tolerance       : cdr tolerance
+ * @tolerance_op_type   : if tolerance needs to be added/subtracted
+ * @cdr_config_ptr      : Ptr to the cmd buffer, in which
+ *                        configured CDR values will be
+ *                        published
+ * @cdr_sweep_enabled   : cdr sweep enabled
+ */
+struct cam_csiphy_dev_cdr_sweep_params {
+	uint32_t  cdr_tolerance;
+	uint32_t  tolerance_op_type;
+	uint32_t *cdr_config_ptr;
+	bool      cdr_sweep_enabled;
+};
+
+/**
+ * struct cam_csiphy_dev_aux_setting_params
+ *
+ * @aux_config_ptr      : Ptr to the cmd buffer, in which
+ *                        auxiliary settings that are enabled for different
+ *                        data rates will be published
+ * @aux_mem_update_en   : Set if aux mem buffer provided
+ */
+struct cam_csiphy_dev_aux_setting_params {
+	uint32_t *aux_config_ptr;
+	bool      aux_mem_update_en;
+};
+
+/**
+ * struct csiphy_device
+ * @device_name                : Device name
+ * @mutex                      : ioctl operation mutex
+ * @hw_version                 : Hardware Version
+ * @clk_lane                   : Clock lane
+ * @acquire_count              : Acquire device count
+ * @start_dev_count            : Start count
+ * @csiphy_max_clk             : Max timer clock rate
+ * @cpas_handle                : CPAS handle
+ * @session_max_device_support : Max number of devices supported in a session
+ * @combo_mode                 : Info regarding combo_mode is enable / disable
+ * @cphy_dphy_combo_mode       : Info regarding 2ph/3ph combo modes
+ * @rx_clk_src_idx             : Phy src clk index
+ * @is_divisor_32_comp         : 32 bit hw compatibility
+ * @curr_data_rate_idx         : Index of the datarate array which is being used currently by phy
+ * @csiphy_state               : CSIPhy state
+ * @ctrl_reg                   : CSIPhy control registers
+ * @csiphy_3p_clk_info         : 3Phase clock information
+ * @csiphy_3p_clk              : 3Phase clocks structure
+ * @ref_count                  : Reference count
+ * @v4l2_dev_str               : V4L2 related data
+ * @csiphy_info                : Sensor specific csiphy info
+ * @soc_info                   : SOC information
+ * @current_data_rate          : Data rate in mbps
+ * @csiphy_cpas_cp_reg_mask    : Secure csiphy lane mask
+ * @ops                        : KMD operations
+ * @crm_cb                     : Callback API pointers
+ * @cdr_params                 : CDR sweep params
+ * @aux_params                 : AUX settings buffer params
+ * @prgm_cmn_reg_across_csiphy : Flag to decide if com settings need to be programmed for all PHYs
+ * @en_common_status_reg_dump  : Debugfs flag to enable common status register dump
+ * @en_lane_status_reg_dump    : Debugfs flag to enable cphy/dphy lane status dump
+ * @en_full_phy_reg_dump       : Debugfs flag to enable the dump for all the Phy registers
+ * @skip_aux_settings          : Debugfs flag to ignore calls to update aux settings
+ * @domain_id_security         : Flag to determine if target has domain-id based security
+ * @preamble_enable            : To enable preamble pattern
+ * @is_aggregator_rx           : Is PHY an RX for aggregator
+ */
+struct csiphy_device {
+	char                                     device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct mutex                             mutex;
+	uint32_t                                 hw_version;
+	uint32_t                                 clk_lane;
+	uint32_t                                 acquire_count;
+	uint32_t                                 start_dev_count;
+	uint32_t                                 csiphy_max_clk;
+	uint32_t                                 cpas_handle;
+	uint8_t                                  session_max_device_support;
+	uint8_t                                  combo_mode;
+	uint8_t                                  cphy_dphy_combo_mode;
+	uint8_t                                  rx_clk_src_idx;
+	uint8_t                                  is_divisor_32_comp;
+	uint8_t                                  curr_data_rate_idx;
+	enum cam_csiphy_state                    csiphy_state;
+	struct csiphy_ctrl_t                    *ctrl_reg;
+	struct msm_cam_clk_info                  csiphy_3p_clk_info[2];
+	struct clk                              *csiphy_3p_clk[2];
+	int32_t                                  ref_count;
+	struct cam_subdev                        v4l2_dev_str;
+	struct cam_csiphy_param                  csiphy_info[
+					CSIPHY_MAX_INSTANCES_PER_AGGREG_RX_PHY];
+	struct cam_hw_soc_info                   soc_info;
+	uint64_t                                 current_data_rate;
+	uint64_t                                 csiphy_cpas_cp_reg_mask[
+					CSIPHY_MAX_INSTANCES_PER_AGGREG_RX_PHY];
+	struct cam_req_mgr_kmd_ops               ops;
+	struct cam_req_mgr_crm_cb               *crm_cb;
+	struct cam_csiphy_dev_cdr_sweep_params   cdr_params;
+	struct cam_csiphy_dev_aux_setting_params aux_params;
+	bool                                     prgm_cmn_reg_across_csiphy;
+	bool                                     en_common_status_reg_dump;
+	bool                                     en_lane_status_reg_dump;
+	bool                                     en_full_phy_reg_dump;
+	bool                                     skip_aux_settings;
+	bool                                     domain_id_security;
+	uint16_t                                 preamble_enable;
+	bool                                     is_aggregator_rx;
+	uint32_t                                 lanes_enabled;
+	struct cam_lanes_assigned_info           lanes_assigned[
+					CSIPHY_MAX_INSTANCES_PER_AGGREG_RX_PHY];
+};
+
+/**
+ * @brief : API to register CSIPHY hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int32_t cam_csiphy_init_module(void);
+
+/**
+ * @brief : API to remove CSIPHY Hw from platform framework.
+ */
+void cam_csiphy_exit_module(void);
+
+enum cam_vote_level get_clk_voting_dynamic(
+	struct csiphy_device *csiphy_dev, int32_t index);
+
+#endif /* _CAM_CSIPHY_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.c
@@ -0,0 +1,453 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_csiphy_soc.h"
+#include "cam_csiphy_core.h"
+#include "include/cam_csiphy_2_1_0_hwreg.h"
+#include "include/cam_csiphy_2_1_1_hwreg.h"
+#include "include/cam_csiphy_2_1_2_hwreg.h"
+#include "include/cam_csiphy_2_1_3_hwreg.h"
+#include "include/cam_csiphy_2_2_0_hwreg.h"
+#include "include/cam_csiphy_2_2_1_hwreg.h"
+#include "include/cam_csiphy_2_3_0_hwreg.h"
+#include "include/cam_csiphy_1_3_0_hwreg.h"
+
+/* Clock divide factor for CPHY spec v1.0 */
+#define CSIPHY_DIVISOR_16                    16
+/* Clock divide factor for CPHY spec v1.2 and up */
+#define CSIPHY_DIVISOR_32                    32
+/* Clock divide factor for DPHY */
+#define CSIPHY_DIVISOR_8                     8
+#define CSIPHY_LOG_BUFFER_SIZE_IN_BYTES      250
+#define ONE_LOG_LINE_MAX_SIZE                20
+
+static int cam_csiphy_io_dump(void __iomem *base_addr, uint16_t num_regs, int csiphy_idx)
+{
+	char                                    *buffer;
+	uint8_t                                  buffer_offset = 0;
+	uint8_t                                  rem_buffer_size = CSIPHY_LOG_BUFFER_SIZE_IN_BYTES;
+	uint16_t                                 i;
+	uint32_t                                 reg_offset;
+
+	if (!base_addr || !num_regs) {
+		CAM_ERR(CAM_CSIPHY, "Invalid params. base_addr: 0x%p num_regs: %u",
+			base_addr, num_regs);
+		return -EINVAL;
+	}
+
+	buffer = kzalloc(CSIPHY_LOG_BUFFER_SIZE_IN_BYTES, GFP_KERNEL);
+	if (!buffer) {
+		CAM_ERR(CAM_CSIPHY, "Could not allocate the memory for buffer");
+		return -ENOMEM;
+	}
+
+	CAM_INFO(CAM_CSIPHY, "Base: 0x%pK num_regs: %u", base_addr, num_regs);
+	CAM_INFO(CAM_CSIPHY, "CSIPHY:%d Dump", csiphy_idx);
+	for (i = 0; i < num_regs; i++) {
+		reg_offset = i << 2;
+		buffer_offset += scnprintf(buffer + buffer_offset, rem_buffer_size, "0x%x=0x%x\n",
+			reg_offset, cam_io_r_mb(base_addr + reg_offset));
+
+		rem_buffer_size = CSIPHY_LOG_BUFFER_SIZE_IN_BYTES - buffer_offset;
+
+		if (rem_buffer_size <= ONE_LOG_LINE_MAX_SIZE) {
+			buffer[buffer_offset - 1] = '\0';
+			pr_info("%s\n", buffer);
+			buffer_offset = 0;
+			rem_buffer_size = CSIPHY_LOG_BUFFER_SIZE_IN_BYTES;
+		}
+	}
+
+	if (buffer_offset) {
+		buffer[buffer_offset - 1] = '\0';
+		pr_info("%s\n", buffer);
+	}
+
+	kfree(buffer);
+
+	return 0;
+}
+
+int32_t cam_csiphy_reg_dump(struct cam_hw_soc_info *soc_info)
+{
+	int32_t rc = 0;
+	resource_size_t size = 0;
+	void __iomem *addr = NULL;
+
+	if (!soc_info) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CSIPHY, "invalid input %d", rc);
+		return rc;
+	}
+	addr = soc_info->reg_map[0].mem_base;
+	size = resource_size(soc_info->mem_block[0]);
+	rc = cam_csiphy_io_dump(addr, (size >> 2), soc_info->index);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "generating dump failed %d", rc);
+		return rc;
+	}
+	return rc;
+}
+
+int32_t cam_csiphy_common_status_reg_dump(struct csiphy_device *csiphy_dev)
+{
+	struct csiphy_reg_parms_t *csiphy_reg = NULL;
+	int32_t                    rc = 0;
+	resource_size_t            size = 0;
+	void __iomem              *phy_base = NULL;
+	int                        reg_id = 0;
+	uint32_t                   val, status_reg, clear_reg;
+
+	if (!csiphy_dev) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CSIPHY, "invalid input %d", rc);
+		return rc;
+	}
+
+	csiphy_reg = csiphy_dev->ctrl_reg->csiphy_reg;
+	phy_base = csiphy_dev->soc_info.reg_map[0].mem_base;
+	status_reg = csiphy_reg->mipi_csiphy_interrupt_status0_addr;
+	clear_reg = csiphy_reg->mipi_csiphy_interrupt_clear0_addr;
+	size = csiphy_reg->csiphy_num_common_status_regs;
+
+	CAM_INFO(CAM_CSIPHY, "PHY base addr=%pK offset=0x%x size=%d",
+		phy_base, status_reg, size);
+
+	if (phy_base != NULL) {
+		for (reg_id = 0; reg_id < size; reg_id++) {
+			val = cam_io_r(phy_base + status_reg + (0x4 * reg_id));
+
+			if (reg_id < csiphy_reg->csiphy_interrupt_status_size)
+				cam_io_w_mb(val, phy_base + clear_reg + (0x4 * reg_id));
+
+			CAM_INFO(CAM_CSIPHY, "CSIPHY%d_COMMON_STATUS%u = 0x%x",
+				csiphy_dev->soc_info.index, reg_id, val);
+		}
+	} else {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CSIPHY, "phy base is NULL  %d", rc);
+		return rc;
+	}
+	return rc;
+}
+
+enum cam_vote_level get_clk_voting_dynamic(
+	struct csiphy_device *csiphy_dev, int32_t index)
+{
+	uint32_t cam_vote_level = 0;
+	uint32_t last_valid_vote = 0;
+	struct cam_hw_soc_info *soc_info;
+	uint64_t phy_data_rate = csiphy_dev->csiphy_info[index].data_rate;
+
+	soc_info = &csiphy_dev->soc_info;
+	phy_data_rate = max(phy_data_rate, csiphy_dev->current_data_rate);
+
+	if (csiphy_dev->csiphy_info[index].csiphy_3phase) {
+		if (csiphy_dev->is_divisor_32_comp)
+			do_div(phy_data_rate, CSIPHY_DIVISOR_32);
+		else
+			do_div(phy_data_rate, CSIPHY_DIVISOR_16);
+	} else {
+		do_div(phy_data_rate, CSIPHY_DIVISOR_8);
+	}
+
+	/* round off to next integer */
+	phy_data_rate += 1;
+	csiphy_dev->current_data_rate = phy_data_rate;
+
+	for (cam_vote_level = 0; cam_vote_level < CAM_MAX_VOTE; cam_vote_level++) {
+		if (soc_info->clk_level_valid[cam_vote_level] != true)
+			continue;
+
+		if (soc_info->clk_rate[cam_vote_level]
+			[csiphy_dev->rx_clk_src_idx] > phy_data_rate) {
+			CAM_DBG(CAM_CSIPHY,
+				"Found match PHY:%d clk_name:%s data_rate:%llu clk_rate:%d level:%d",
+				soc_info->index,
+				soc_info->clk_name[csiphy_dev->rx_clk_src_idx],
+				phy_data_rate,
+				soc_info->clk_rate[cam_vote_level]
+				[csiphy_dev->rx_clk_src_idx],
+				cam_vote_level);
+			return cam_vote_level;
+		}
+		last_valid_vote = cam_vote_level;
+	}
+	return last_valid_vote;
+}
+
+int32_t cam_csiphy_enable_hw(struct csiphy_device *csiphy_dev, int32_t index)
+{
+	int32_t rc = 0;
+	struct cam_hw_soc_info   *soc_info;
+	enum cam_vote_level vote_level;
+	struct cam_csiphy_param *param = &csiphy_dev->csiphy_info[index];
+	unsigned long clk_rate = 0;
+	int i;
+
+	soc_info = &csiphy_dev->soc_info;
+
+	if (csiphy_dev->ref_count++) {
+		CAM_ERR(CAM_CSIPHY, "csiphy refcount = %d",
+			csiphy_dev->ref_count);
+		goto end;
+	}
+
+	vote_level = csiphy_dev->ctrl_reg->getclockvoting(csiphy_dev, index);
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		CAM_DBG(CAM_CSIPHY, "PHY:%d %s:%d",
+			soc_info->index,
+			soc_info->clk_name[i],
+			soc_info->clk_rate[vote_level][i]);
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info,
+		(soc_info->is_clk_drv_en && param->use_hw_client_voting) ?
+		param->conn_csid_idx : CAM_CLK_SW_CLIENT_IDX, true, vote_level, true);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY,
+			"[%s] failed to enable platform resources, clk_drv_en=%d, use_hw_client=%d conn_csid_idx=%d, rc=%d",
+			soc_info->dev_name, soc_info->is_clk_drv_en, param->use_hw_client_voting,
+			param->conn_csid_idx, rc);
+		goto end;
+	}
+
+	if (soc_info->is_clk_drv_en && param->use_hw_client_voting && param->is_drv_config_en) {
+		int clk_vote_level_high = vote_level;
+		int clk_vote_level_low = soc_info->lowest_clk_level;
+
+		rc = cam_soc_util_set_clk_rate_level(soc_info, param->conn_csid_idx,
+			clk_vote_level_high, clk_vote_level_low, false);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY,
+				"Failed to set the req clk_rate level[high low]: [%s %s] cesta_client_idx: %d rc: %d",
+				cam_soc_util_get_string_from_level(clk_vote_level_high),
+				cam_soc_util_get_string_from_level(clk_vote_level_low),
+				param->conn_csid_idx, rc);
+			rc = -EINVAL;
+			goto disable_platform_resource;
+		}
+
+		rc = cam_soc_util_cesta_channel_switch(param->conn_csid_idx, "csiphy_start");
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY,
+				"[%s] Failed to apply power states for crm client:%d rc:%d",
+				soc_info->dev_name, param->conn_csid_idx, rc);
+			goto disable_platform_resource;
+		}
+
+	} else {
+		clk_rate = soc_info->clk_rate[0][soc_info->src_clk_idx];
+		rc = cam_soc_util_set_src_clk_rate(soc_info,
+			CAM_CLK_SW_CLIENT_IDX, clk_rate, 0);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "csiphy_set_src_clk_rate failed"
+				" rc: %d", rc);
+			rc = -EINVAL;
+			goto disable_platform_resource;
+		}
+
+		for (i = 0; i < soc_info->num_clk; i++) {
+			if (i == soc_info->src_clk_idx) {
+				CAM_DBG(CAM_CSIPHY, "Skipping call back"
+				" for src clk %s", soc_info->clk_name[i]);
+				continue;
+			}
+			clk_rate = cam_soc_util_get_clk_rate_applied(soc_info,
+				i, false, vote_level);
+			if (clk_rate > 0) {
+				cam_subdev_notify_message(CAM_TFE_DEVICE_TYPE,
+					CAM_SUBDEV_MESSAGE_CLOCK_UPDATE,
+					(void *)(&clk_rate));
+			}
+		}
+	}
+
+	cam_csiphy_reset(csiphy_dev);
+
+	return rc;
+
+disable_platform_resource:
+	cam_soc_util_disable_platform_resource(soc_info,
+		(soc_info->is_clk_drv_en && param->use_hw_client_voting) ?
+		param->conn_csid_idx : CAM_CLK_SW_CLIENT_IDX,
+		true, true);
+end:
+	return rc;
+}
+
+int32_t cam_csiphy_disable_hw(struct csiphy_device *csiphy_dev, int32_t index)
+{
+	struct cam_hw_soc_info   *soc_info;
+	struct cam_csiphy_param *param;
+
+	if (!csiphy_dev || !csiphy_dev->ref_count) {
+		CAM_ERR(CAM_CSIPHY, "csiphy dev NULL / ref_count ZERO");
+		return 0;
+	}
+	soc_info = &csiphy_dev->soc_info;
+	param = &csiphy_dev->csiphy_info[index];
+
+	if (--csiphy_dev->ref_count) {
+		CAM_ERR(CAM_CSIPHY, "csiphy refcount = %d",
+			csiphy_dev->ref_count);
+		return 0;
+	}
+
+	cam_csiphy_reset(csiphy_dev);
+
+	cam_soc_util_disable_platform_resource(soc_info,
+		(soc_info->is_clk_drv_en && param->use_hw_client_voting) ?
+		param->conn_csid_idx : CAM_CLK_SW_CLIENT_IDX,
+		true, true);
+
+	return 0;
+}
+
+int32_t cam_csiphy_parse_dt_info(struct platform_device *pdev,
+	struct csiphy_device *csiphy_dev)
+{
+	int32_t   rc = 0, i = 0;
+	uint32_t  clk_cnt = 0;
+	uint32_t   is_regulator_enable_sync;
+	char      *csi_3p_clk_name = "csi_phy_3p_clk";
+	char      *csi_3p_clk_src_name = "csiphy_3p_clk_src";
+	struct cam_hw_soc_info   *soc_info;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	soc_info = &csiphy_dev->soc_info;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "parsing common soc dt(rc %d)", rc);
+		return  rc;
+	}
+
+	if (of_property_read_u32(soc_info->dev->of_node, "rgltr-enable-sync",
+		&is_regulator_enable_sync)) {
+		/* this is not fatal, overwrite to 0 */
+		is_regulator_enable_sync = 0;
+	}
+
+	if (!of_property_read_bool(soc_info->dev->of_node, "aggregator-rx"))
+		csiphy_dev->is_aggregator_rx = false;
+	else
+		csiphy_dev->is_aggregator_rx = true;
+
+	csiphy_dev->prgm_cmn_reg_across_csiphy = (bool) is_regulator_enable_sync;
+
+	if (of_device_is_compatible(soc_info->dev->of_node, "qcom,csiphy-v1.3.0")) {
+		csiphy_dev->ctrl_reg = &ctrl_reg_1_3_0;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V130;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->clk_lane = 0;
+	} else if (of_device_is_compatible(soc_info->dev->of_node, "qcom,csiphy-v2.1.0")) {
+		csiphy_dev->ctrl_reg = &ctrl_reg_2_1_0;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V210;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->clk_lane = 0;
+	} else if (of_device_is_compatible(soc_info->dev->of_node, "qcom,csiphy-v2.1.1")) {
+		csiphy_dev->ctrl_reg = &ctrl_reg_2_1_1;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V211;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->clk_lane = 0;
+	} else if (of_device_is_compatible(soc_info->dev->of_node, "qcom,csiphy-v2.1.2")) {
+		csiphy_dev->ctrl_reg = &ctrl_reg_2_1_2;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V212;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->clk_lane = 0;
+	} else if (of_device_is_compatible(soc_info->dev->of_node, "qcom,csiphy-v2.1.3")) {
+		csiphy_dev->ctrl_reg = &ctrl_reg_2_1_3;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V213;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->clk_lane = 0;
+	} else if (of_device_is_compatible(soc_info->dev->of_node, "qcom,csiphy-v2.2.0")) {
+		csiphy_dev->ctrl_reg = &ctrl_reg_2_2_0;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V220;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->clk_lane = 0;
+	} else if (of_device_is_compatible(soc_info->dev->of_node, "qcom,csiphy-v2.2.1")) {
+		csiphy_dev->ctrl_reg = &ctrl_reg_2_2_1;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V221;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->clk_lane = 0;
+	} else if (of_device_is_compatible(soc_info->dev->of_node, "qcom,csiphy-v2.3.0")) {
+		csiphy_dev->ctrl_reg = &ctrl_reg_2_3_0;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V230;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->clk_lane = 0;
+	} else {
+		CAM_ERR(CAM_CSIPHY, "invalid hw version : 0x%x",
+			csiphy_dev->hw_version);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (soc_info->num_clk > CSIPHY_NUM_CLK_MAX) {
+		CAM_ERR(CAM_CSIPHY, "invalid clk count=%d, max is %d",
+			soc_info->num_clk, CSIPHY_NUM_CLK_MAX);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (!strcmp(soc_info->clk_name[i],
+			csi_3p_clk_src_name)) {
+			csiphy_dev->csiphy_3p_clk_info[0].clk_name =
+				soc_info->clk_name[i];
+			csiphy_dev->csiphy_3p_clk_info[0].clk_rate =
+				soc_info->clk_rate[0][i];
+			csiphy_dev->csiphy_3p_clk[0] =
+				soc_info->clk[i];
+			continue;
+		} else if (!strcmp(soc_info->clk_name[i],
+				csi_3p_clk_name)) {
+			csiphy_dev->csiphy_3p_clk_info[1].clk_name =
+				soc_info->clk_name[i];
+			csiphy_dev->csiphy_3p_clk_info[1].clk_rate =
+				soc_info->clk_rate[0][i];
+			csiphy_dev->csiphy_3p_clk[1] =
+				soc_info->clk[i];
+			continue;
+		} else if (!strcmp(soc_info->clk_name[i],
+				CAM_CSIPHY_RX_CLK_SRC)) {
+			csiphy_dev->rx_clk_src_idx = i;
+			continue;
+		}
+
+		CAM_DBG(CAM_CSIPHY, "clk_rate[%d] = %d", clk_cnt,
+			soc_info->clk_rate[0][clk_cnt]);
+		clk_cnt++;
+	}
+
+	csiphy_dev->csiphy_max_clk =
+		soc_info->clk_rate[0][soc_info->src_clk_idx];
+
+	for (i = 0; i < soc_info->irq_count; i++)
+		irq_data[i] = csiphy_dev;
+
+	rc = cam_cpas_query_drv_enable(NULL, &soc_info->is_clk_drv_en);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY, "Failed to query DRV enable rc:%d", rc);
+		return rc;
+	}
+	rc = cam_soc_util_request_platform_resource(&csiphy_dev->soc_info,
+		cam_csiphy_irq, &(irq_data[0]));
+
+	return rc;
+}
+
+int32_t cam_csiphy_soc_release(struct csiphy_device *csiphy_dev)
+{
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "csiphy dev NULL");
+		return 0;
+	}
+
+	cam_soc_util_release_platform_resource(&csiphy_dev->soc_info);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.h
@@ -0,0 +1,87 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_SOC_H_
+#define _CAM_CSIPHY_SOC_H_
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/irqreturn.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include "cam_csiphy_dev.h"
+#include "cam_csiphy_core.h"
+
+#define CSIPHY_VERSION_V10                        0x10
+#define CSIPHY_VERSION_V11                        0x11
+#define CSIPHY_VERSION_V12                        0x12
+#define CSIPHY_VERSION_V121                       0x121
+#define CSIPHY_VERSION_V123                       0x123
+#define CSIPHY_VERSION_V124                       0x124
+#define CSIPHY_VERSION_V125                       0x125
+#define CSIPHY_VERSION_V130                       0x130
+#define CSIPHY_VERSION_V20                        0x20
+#define CSIPHY_VERSION_V201                       0x201
+#define CSIPHY_VERSION_V210                       0x210
+#define CSIPHY_VERSION_V211                       0x211
+#define CSIPHY_VERSION_V212                       0x212
+#define CSIPHY_VERSION_V213                       0x213
+#define CSIPHY_VERSION_V220                       0x220
+#define CSIPHY_VERSION_V221                       0x221
+#define CSIPHY_VERSION_V230                       0x230
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API release SOC related parameters
+ */
+int cam_csiphy_soc_release(struct csiphy_device *csiphy_dev);
+
+/**
+ * @pdev: Platform device
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API parses csiphy device tree information
+ */
+int cam_csiphy_parse_dt_info(struct platform_device *pdev,
+	struct csiphy_device *csiphy_dev);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API enables SOC related parameters
+ */
+int cam_csiphy_enable_hw(struct csiphy_device *csiphy_dev, int32_t index);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API disables SOC related parameters
+ */
+int cam_csiphy_disable_hw(struct csiphy_device *csiphy_dev, int32_t index);
+
+/**
+ * @soc_info: Soc info of cam hw driver module
+ *
+ * This API dumps memory for the entire mapped region
+ * (needs to be macro enabled before use)
+ */
+int cam_csiphy_reg_dump(struct cam_hw_soc_info *soc_info);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API dumps memory for the entire status region
+ */
+int32_t cam_csiphy_common_status_reg_dump(struct csiphy_device *csiphy_dev);
+#endif /* _CAM_CSIPHY_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_3_0_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_3_0_hwreg.h
@@ -0,0 +1,502 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_1_3_0_HWREG_H_
+#define _CAM_CSIPHY_1_3_0_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct cam_cphy_dphy_status_reg_params_t status_regs_1_3_0 = {
+	.csiphy_3ph_status0_offset = 0x01E0,
+	.csiphy_2ph_status0_offset = 0x0090,
+	.cphy_lane_status = {0x01F8, 0x03F8, 0x05F8},
+	.csiphy_3ph_status_size = 8,
+	.csiphy_2ph_status_size = 16,
+};
+
+struct csiphy_reg_t csiphy_lane_en_reg_1_3_0[] = {
+	{0x0814, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+};
+
+struct csiphy_reg_t csiphy_common_reg_1_3_0[] = {
+	{0x0814, 0xd5, 0x00, CSIPHY_2PH_REGS},
+	{0x0814, 0x2A, 0x00, CSIPHY_3PH_REGS},
+	{0x0818, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x5A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0824, 0x72, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_reset_enter_reg_1_3_0[] = {
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_exit_reg_1_3_0[] = {
+	{0x0800, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x0800, 0x00, 0x00, CSIPHY_2PH_COMBO_REGS},
+	{0x0800, 0x0E, 0xBE8, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_1_3_0[] = {
+	{0x082c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0xFB, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083c, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0840, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0844, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0848, 0xEF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x084c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0850, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0854, 0xFF, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v1_3_0_reg[] = {
+	{0x0724, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x070C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0708, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0024, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0224, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0200, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0208, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0424, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0624, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0600, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0638, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0608, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xFD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x025C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0260, 0xFD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0264, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xFD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x065C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0660, 0xFD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0664, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_2ph_v1_3_0_combo_mode_reg[] = {
+	{0x0724, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x070C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0708, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0024, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0224, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0200, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0208, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0424, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0428, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0624, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0628, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0600, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0638, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0628, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0608, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xFD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x025C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0260, 0xFD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0264, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xFD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_3ph_v1_3_0_reg[] = {
+	{0x0168, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x016C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x015C, 0xC8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x010C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0150, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0188, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x018C, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0190, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0118, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0144, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0164, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x01DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0368, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x036C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x035C, 0xC8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x030C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0350, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0388, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x038C, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0390, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0318, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0344, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0364, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x03DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0568, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x056C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x055C, 0xC8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x050C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0550, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0588, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x058C, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0590, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0518, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0544, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0564, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x05DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0984, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0988, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0980, 0x61, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x09B0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x09B4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0A84, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0A88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0A80, 0x61, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0AB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0AB4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0B84, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0B88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0B80, 0x61, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0BB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+    {0x0BB4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS}
+};
+
+struct csiphy_reg_t datarate_130_1p5Gsps[] = {
+	{0x015C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0168, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x016C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x010C, 0x24, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x035C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0368, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x036C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x030C, 0x24, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x055C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0568, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x056C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x050C, 0x24, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x09B4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AB4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0BB4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_130_1p7Gsps[] = {
+	{0x015C, 0x56, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0168, 0xAE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x016C, 0x65, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x010C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x035C, 0x56, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0368, 0xAE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x036C, 0x65, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x030C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x055C, 0x56, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0568, 0xAE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x056C, 0x65, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x050C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x09B4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AB4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0BB4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_130_2p5Gsps[] = {
+	{0x0168, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x015C, 0xC8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x016C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x010C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0368, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x035C, 0xC8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x036C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x030C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0568, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x055C, 0xC8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x056C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x050C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x09B4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0988, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AB4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0BB4, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_130_3p5Gsps[] = {
+	{0x0168, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x015C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x016C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x010C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0368, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x035C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x036C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x030C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0568, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x055C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x056C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x050C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x09B4, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0988, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AB4, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0BB4, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_130_4p5Gsps[] = {
+	{0x0168, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x015C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x016C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x010C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0368, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x035C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x036C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x030C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0568, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x055C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x056C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x050C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x09B4, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0988, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AB4, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0BB4, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+static struct data_rate_reg_info_t data_rate_settings_1_3_0[] = {
+	{
+		/* ((1.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 3420000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_130_1p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_130_1p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_130_1p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_130_1p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_130_1p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_130_1p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_130_1p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_130_1p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_130_1p5Gsps,
+	},
+	{
+		/* ((1.7 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 3876000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_130_1p7Gsps),
+		.data_rate_reg_array[0][0] = datarate_130_1p7Gsps,
+		.data_rate_reg_array[1][0] = datarate_130_1p7Gsps,
+		.data_rate_reg_array[2][0] = datarate_130_1p7Gsps,
+		.data_rate_reg_array[3][0] = datarate_130_1p7Gsps,
+		.data_rate_reg_array[4][0] = datarate_130_1p7Gsps,
+		.data_rate_reg_array[5][0] = datarate_130_1p7Gsps,
+		.data_rate_reg_array[6][0] = datarate_130_1p7Gsps,
+		.data_rate_reg_array[7][0] = datarate_130_1p7Gsps,
+	},
+	{
+		/* ((2.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5700000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_130_2p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_130_2p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_130_2p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_130_2p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_130_2p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_130_2p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_130_2p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_130_2p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_130_2p5Gsps,
+	},
+	{
+		/* ((3.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7980000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_130_3p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_130_3p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_130_3p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_130_3p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_130_3p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_130_3p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_130_3p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_130_3p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_130_3p5Gsps,
+	},
+	{
+		/* ((4.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 10260000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_130_4p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_130_4p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_130_4p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_130_4p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_130_4p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_130_4p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_130_4p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_130_4p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_130_4p5Gsps,
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_1_3_0 = {
+	.num_data_rate_settings = ARRAY_SIZE(data_rate_settings_1_3_0),
+	.data_rate_settings = data_rate_settings_1_3_0,
+};
+
+struct csiphy_reg_parms_t csiphy_v1_3_0 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x08B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x0858,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x0828,
+	.size_offset_betn_lanes = 0x200,
+	.status_reg_params = &status_regs_1_3_0,
+	.csiphy_common_reg_array_size = ARRAY_SIZE(csiphy_common_reg_1_3_0),
+	.csiphy_reset_enter_array_size = ARRAY_SIZE(csiphy_reset_enter_reg_1_3_0),
+	.csiphy_reset_exit_array_size = ARRAY_SIZE(csiphy_reset_exit_reg_1_3_0),
+	.csiphy_2ph_config_array_size = ARRAY_SIZE(csiphy_2ph_v1_3_0_reg),
+	.csiphy_3ph_config_array_size = ARRAY_SIZE(csiphy_3ph_v1_3_0_reg),
+	.csiphy_2ph_combo_config_array_size = ARRAY_SIZE(csiphy_2ph_v1_3_0_combo_mode_reg),
+	.csiphy_3ph_combo_config_array_size = 0,
+	.csiphy_2ph_3ph_config_array_size = 0,
+	.csiphy_interrupt_status_size = ARRAY_SIZE(csiphy_irq_reg_1_3_0),
+	.csiphy_num_common_status_regs = 20,
+	.aon_sel_params = NULL,
+};
+
+struct csiphy_ctrl_t ctrl_reg_1_3_0 = {
+	.csiphy_common_reg = csiphy_common_reg_1_3_0,
+	.csiphy_2ph_reg = csiphy_2ph_v1_3_0_reg,
+	.csiphy_3ph_reg = csiphy_3ph_v1_3_0_reg,
+	.csiphy_2ph_combo_mode_reg = csiphy_2ph_v1_3_0_combo_mode_reg,
+	.csiphy_3ph_combo_reg = NULL,
+	.csiphy_2ph_3ph_mode_reg = NULL,
+	.csiphy_reg = &csiphy_v1_3_0,
+	.csiphy_irq_reg = csiphy_irq_reg_1_3_0,
+	.csiphy_reset_enter_regs = csiphy_reset_enter_reg_1_3_0,
+	.csiphy_reset_exit_regs = csiphy_reset_exit_reg_1_3_0,
+	.csiphy_lane_config_reg = csiphy_lane_en_reg_1_3_0,
+	.data_rates_settings_table = &data_rate_delta_table_1_3_0,
+	.csiphy_bist_reg = NULL,
+	.getclockvoting = get_clk_voting_dynamic,
+};
+
+#endif /* _CAM_CSIPHY_1_3_0_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_0_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_0_hwreg.h
@@ -0,0 +1,938 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_2_1_0_HWREG_H_
+#define _CAM_CSIPHY_2_1_0_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct cam_csiphy_aon_sel_params_t aon_cam_select_params = {
+	.aon_cam_sel_offset[0] = 0x01E0,
+	.aon_cam_sel_offset[1] = 0,
+	.cam_sel_mask = BIT(0),
+	.mclk_sel_mask = BIT(8),
+};
+
+struct cam_cphy_dphy_status_reg_params_t status_regs_2_1_0 = {
+	.csiphy_3ph_status0_offset = 0x0340,
+	.csiphy_2ph_status0_offset = 0x00C0,
+	.cphy_lane_status = {0x0358, 0x0758, 0x0B58},
+	.csiphy_3ph_status_size = 24,
+	.csiphy_2ph_status_size = 20,
+};
+
+struct csiphy_reg_t csiphy_lane_en_reg_2_1_0[] = {
+	{0x1014, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+};
+
+struct csiphy_reg_t csiphy_common_reg_2_1_0[] = {
+	{0x1084, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1018, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x101C, 0x7A, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_enter_reg_2_1_0[] = {
+	{0x1000, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_exit_reg_2_1_0[] = {
+	{0x1000, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x1000, 0x00, 0x00, CSIPHY_2PH_COMBO_REGS},
+	{0x1000, 0x0E, 0xBE8, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_2_1_0[] = {
+	{0x102c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1030, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1034, 0xfb, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1038, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x103c, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1040, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1044, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1048, 0xef, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x104c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1050, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1054, 0xff, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_1_0_reg[] = {
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C5C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C60, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C64, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_1_0_combo_mode_reg[] = {
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0828, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_3ph_v2_1_0_reg[] = {
+	{0x0268, 0xF1, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0x00, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0xEF, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0204, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x020C, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0218, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x021C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0220, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0224, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0228, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x022C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0264, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0310, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0230, 0x94, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0234, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0238, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x023C, 0xA6, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0258, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0254, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x025C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0248, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x024C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0260, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0x00, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0xEF, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0604, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0618, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x061C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0620, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0624, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0628, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x062C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0664, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0710, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0630, 0x94, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0634, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0638, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x063C, 0xA6, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0658, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0654, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x065C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0648, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x064C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0660, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AFC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0x00, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0xEF, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AEC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A18, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A1C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A20, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A24, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A28, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A2C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A64, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B10, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0ABC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A30, 0x94, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A34, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A38, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A3C, 0xA6, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A58, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A54, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A5C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A48, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A4C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A60, 0xA8, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+struct csiphy_reg_t bist_3ph_arr_2_1_0[] = {
+	/* 3Phase BIST CONFIGURATION REG SET */
+	{0x02D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0250, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0650, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A50, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t bist_status_arr_2_1_0[] = {
+	{0x0344, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0744, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0B44, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x00C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x04C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x08C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x0CC0, 0x00, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct bist_reg_settings_t bist_setting_2_1_0 = {
+	.error_status_val_3ph = 0x10,
+	.error_status_val_2ph = 0x10,
+	.set_status_update_3ph_base_offset = 0x0240,
+	.set_status_update_2ph_base_offset = 0x0050,
+	.bist_status_3ph_base_offset = 0x0344,
+	.bist_status_2ph_base_offset = 0x00C0,
+	.bist_sensor_data_3ph_status_base_offset = 0x0340,
+	.bist_counter_3ph_base_offset = 0x0348,
+	.bist_counter_2ph_base_offset = 0x00C8,
+	.number_of_counters = 2,
+	.num_3ph_bist_settings = ARRAY_SIZE(bist_3ph_arr_2_1_0),
+	.bist_3ph_settings_arry = bist_3ph_arr_2_1_0,
+	.bist_2ph_settings_arry = NULL,
+	.num_2ph_bist_settings = 0,
+	.num_status_reg = ARRAY_SIZE(bist_status_arr_2_1_0),
+	.bist_status_arr = bist_status_arr_2_1_0,
+};
+
+struct csiphy_reg_t datarate_210_1p2Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_AUXILIARY_SETTING},
+};
+
+struct csiphy_reg_t datarate_210_1p5Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x4D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x4D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x4D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_AUXILIARY_SETTING},
+};
+
+struct csiphy_reg_t datarate_210_1p7Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x43, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x43, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x43, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_AUXILIARY_SETTING},
+};
+
+struct csiphy_reg_t datarate_210_2p1Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_AUXILIARY_SETTING},
+};
+
+struct csiphy_reg_t datarate_210_2p35Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x2E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x2E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x2E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_AUXILIARY_SETTING},
+};
+
+struct csiphy_reg_t datarate_210_2p6Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_210_2p8Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_210_3p3Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_210_3p5Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x15, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x15, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x15, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_210_4Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_210_4p5Gsps[] = {
+	{0x0274, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_210_5Gsps[] = {
+	{0x0274, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+static struct data_rate_reg_info_t data_rate_settings_2_1_0[] = {
+	{
+		/* ((1.2 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 2736000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_1p2Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_1p2Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_1p2Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_1p2Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_1p2Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_1p2Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_1p2Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_1p2Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_1p2Gsps,
+	},
+	{
+		/* ((1.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 3420000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_1p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_1p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_1p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_1p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_1p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_1p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_1p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_1p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_1p5Gsps,
+	},
+	{
+		/* ((1.7 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 3876000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_1p7Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_1p7Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_1p7Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_1p7Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_1p7Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_1p7Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_1p7Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_1p7Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_1p7Gsps,
+	},
+	{
+		/* ((2.1 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 4788000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_2p1Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_2p1Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_2p1Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_2p1Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_2p1Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_2p1Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_2p1Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_2p1Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_2p1Gsps,
+	},
+	{
+		/* ((2.35 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5358000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_2p35Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_2p35Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_2p35Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_2p35Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_2p35Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_2p35Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_2p35Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_2p35Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_2p35Gsps,
+	},
+	{
+		/* ((2.6 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5928000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_2p6Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_2p6Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_2p6Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_2p6Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_2p6Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_2p6Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_2p6Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_2p6Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_2p6Gsps,
+	},
+	{
+		/* ((2.8 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6384000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_2p8Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_2p8Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_2p8Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_2p8Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_2p8Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_2p8Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_2p8Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_2p8Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_2p8Gsps,
+	},
+	{
+		/* ((3.3 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7524000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_3p3Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_3p3Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_3p3Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_3p3Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_3p3Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_3p3Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_3p3Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_3p3Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_3p3Gsps,
+	},
+	{
+		/* ((3.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7980000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_3p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_3p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_3p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_3p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_3p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_3p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_3p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_3p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_3p5Gsps,
+	},
+	{
+		/* ((4 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 9120000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_4Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_4Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_4Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_4Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_4Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_4Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_4Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_4Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_4Gsps,
+	},
+	{
+		/* ((4.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 10260000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_4p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_4p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_4p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_4p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_4p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_4p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_4p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_4p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_4p5Gsps,
+	},
+	{
+		/* ((5.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 11400000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_210_5Gsps),
+		.data_rate_reg_array[0][0] = datarate_210_5Gsps,
+		.data_rate_reg_array[1][0] = datarate_210_5Gsps,
+		.data_rate_reg_array[2][0] = datarate_210_5Gsps,
+		.data_rate_reg_array[3][0] = datarate_210_5Gsps,
+		.data_rate_reg_array[4][0] = datarate_210_5Gsps,
+		.data_rate_reg_array[5][0] = datarate_210_5Gsps,
+		.data_rate_reg_array[6][0] = datarate_210_5Gsps,
+		.data_rate_reg_array[7][0] = datarate_210_5Gsps,
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_2_1_0 = {
+	.num_data_rate_settings = ARRAY_SIZE(data_rate_settings_2_1_0),
+	.data_rate_settings = data_rate_settings_2_1_0,
+};
+
+struct csiphy_reg_parms_t csiphy_v2_1_0 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x10B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x1058,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x1028,
+	.size_offset_betn_lanes = 0x400,
+	.status_reg_params = &status_regs_2_1_0,
+	.csiphy_common_reg_array_size = ARRAY_SIZE(csiphy_common_reg_2_1_0),
+	.csiphy_reset_enter_array_size = ARRAY_SIZE(csiphy_reset_enter_reg_2_1_0),
+	.csiphy_reset_exit_array_size = ARRAY_SIZE(csiphy_reset_exit_reg_2_1_0),
+	.csiphy_2ph_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_1_0_reg),
+	.csiphy_3ph_config_array_size = ARRAY_SIZE(csiphy_3ph_v2_1_0_reg),
+	.csiphy_2ph_combo_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_1_0_combo_mode_reg),
+	.csiphy_3ph_combo_config_array_size = 0,
+	.csiphy_2ph_3ph_config_array_size = 0,
+	.csiphy_interrupt_status_size = ARRAY_SIZE(csiphy_irq_reg_2_1_0),
+	.csiphy_num_common_status_regs = 20,
+	.aon_sel_params = &aon_cam_select_params,
+};
+
+struct csiphy_ctrl_t ctrl_reg_2_1_0 = {
+	.csiphy_common_reg = csiphy_common_reg_2_1_0,
+	.csiphy_2ph_reg = csiphy_2ph_v2_1_0_reg,
+	.csiphy_3ph_reg = csiphy_3ph_v2_1_0_reg,
+	.csiphy_2ph_combo_mode_reg = csiphy_2ph_v2_1_0_combo_mode_reg,
+	.csiphy_3ph_combo_reg = NULL,
+	.csiphy_2ph_3ph_mode_reg = NULL,
+	.csiphy_reg = &csiphy_v2_1_0,
+	.csiphy_irq_reg = csiphy_irq_reg_2_1_0,
+	.csiphy_reset_enter_regs = csiphy_reset_enter_reg_2_1_0,
+	.csiphy_reset_exit_regs = csiphy_reset_exit_reg_2_1_0,
+	.csiphy_lane_config_reg = csiphy_lane_en_reg_2_1_0,
+	.data_rates_settings_table = &data_rate_delta_table_2_1_0,
+	.csiphy_bist_reg = &bist_setting_2_1_0,
+	.getclockvoting = get_clk_voting_dynamic,
+};
+
+#endif /* _CAM_CSIPHY_2_1_0_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_1_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_1_hwreg.h
@@ -0,0 +1,927 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_2_1_1_HWREG_H_
+#define _CAM_CSIPHY_2_1_1_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct cam_cphy_dphy_status_reg_params_t status_regs_2_1_1 = {
+	.csiphy_3ph_status0_offset = 0x0340,
+	.csiphy_2ph_status0_offset = 0x00C0,
+	.cphy_lane_status = {0x0358, 0x0758, 0x0B58},
+	.csiphy_3ph_status_size = 24,
+	.csiphy_2ph_status_size = 20,
+};
+
+struct csiphy_reg_t csiphy_lane_en_reg_2_1_1[] = {
+	{0x1014, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+};
+
+struct csiphy_reg_t csiphy_common_reg_2_1_1[] = {
+	{0x1084, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1018, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x101C, 0x7A, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_enter_reg_2_1_1[] = {
+	{0x1000, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_exit_reg_2_1_1[] = {
+	{0x1000, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x1000, 0x00, 0x00, CSIPHY_2PH_COMBO_REGS},
+	{0x1000, 0x0E, 0xBE8, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_2_1_1[] = {
+	{0x102c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1030, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1034, 0xfb, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1038, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x103c, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1040, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1044, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1048, 0xef, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x104c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1050, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1054, 0xff, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_1_1_reg[] = {
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C94, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C5C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C60, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C64, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_1_1_combo_mode_reg[] = {
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0828, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_3ph_v2_1_1_reg[] = {
+	{0x0268, 0xF1, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0x00, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0xEF, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0204, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x020C, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0218, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x021C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0220, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0224, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0228, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x022C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0264, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0310, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0230, 0x94, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0234, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0238, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x023C, 0xA6, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0258, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0254, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x025C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0248, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x024C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0260, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0x00, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0xEF, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0604, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0618, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x061C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0620, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0624, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0628, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x062C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0664, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0710, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0630, 0x94, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0634, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0638, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x063C, 0xA6, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0658, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0654, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x065C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0648, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x064C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0660, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AFC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0x00, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0xEF, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AEC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A18, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A1C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A20, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A24, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A28, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A2C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A64, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B10, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0ABC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A30, 0x94, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A34, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A38, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A3C, 0xA6, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A58, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A54, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A5C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A48, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A4C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A60, 0xA8, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t bist_3ph_arr_2_1_1[] = {
+	/* 3Phase BIST CONFIGURATION REG SET */
+	{0x02D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0250, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0650, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A50, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t bist_status_arr_2_1_1[] = {
+	{0x0344, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0744, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0B44, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x00C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x04C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x08C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x0CC0, 0x00, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct bist_reg_settings_t bist_setting_2_1_1 = {
+	.error_status_val_3ph = 0x10,
+	.error_status_val_2ph = 0x10,
+	.set_status_update_3ph_base_offset = 0x0240,
+	.set_status_update_2ph_base_offset = 0x0050,
+	.bist_status_3ph_base_offset = 0x0344,
+	.bist_status_2ph_base_offset = 0x00C0,
+	.bist_sensor_data_3ph_status_base_offset = 0x0340,
+	.bist_counter_3ph_base_offset = 0x0348,
+	.bist_counter_2ph_base_offset = 0x00C8,
+	.number_of_counters = 2,
+	.num_3ph_bist_settings = ARRAY_SIZE(bist_3ph_arr_2_1_1),
+	.bist_3ph_settings_arry = bist_3ph_arr_2_1_1,
+	.bist_2ph_settings_arry = NULL,
+	.num_2ph_bist_settings = 0,
+	.num_status_reg = ARRAY_SIZE(bist_status_arr_2_1_1),
+	.bist_status_arr = bist_status_arr_2_1_1,
+};
+
+struct csiphy_reg_t datarate_211_1p2Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_1p5Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x4D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x4D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x4D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_1p7Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x43, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x43, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x43, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_2p1Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_2p35Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x2E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x2E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x2E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_2p6Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_2p8Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_3p3Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_3p5Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x15, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x15, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x15, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_4Gsps[] = {
+	{0x0274, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_4p5Gsps[] = {
+	{0x0274, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_211_5Gsps[] = {
+	{0x0274, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0xC1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x18, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+static struct data_rate_reg_info_t data_rate_settings_2_1_1[] = {
+	{
+		/* ((1.2 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 2736000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_1p2Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_1p2Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_1p2Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_1p2Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_1p2Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_1p2Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_1p2Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_1p2Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_1p2Gsps,
+	},
+	{
+		/* ((1.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 3420000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_1p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_1p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_1p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_1p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_1p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_1p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_1p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_1p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_1p5Gsps,
+	},
+	{
+		/* ((1.7 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 3876000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_1p7Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_1p7Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_1p7Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_1p7Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_1p7Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_1p7Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_1p7Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_1p7Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_1p7Gsps,
+	},
+	{
+		/* ((2.1 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 4788000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_2p1Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_2p1Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_2p1Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_2p1Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_2p1Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_2p1Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_2p1Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_2p1Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_2p1Gsps,
+	},
+	{
+		/* ((2.35 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5358000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_2p35Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_2p35Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_2p35Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_2p35Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_2p35Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_2p35Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_2p35Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_2p35Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_2p35Gsps,
+	},
+	{
+		/* ((2.6 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5928000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_2p6Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_2p6Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_2p6Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_2p6Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_2p6Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_2p6Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_2p6Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_2p6Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_2p6Gsps,
+	},
+	{
+		/* ((2.8 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6384000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_2p8Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_2p8Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_2p8Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_2p8Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_2p8Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_2p8Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_2p8Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_2p8Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_2p8Gsps,
+	},
+	{
+		/* ((3.3 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7524000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_3p3Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_3p3Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_3p3Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_3p3Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_3p3Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_3p3Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_3p3Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_3p3Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_3p3Gsps,
+	},
+	{
+		/* ((3.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7980000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_3p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_3p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_3p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_3p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_3p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_3p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_3p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_3p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_3p5Gsps,
+	},
+	{
+		/* ((4 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 9120000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_4Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_4Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_4Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_4Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_4Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_4Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_4Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_4Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_4Gsps,
+	},
+	{
+		/* ((4.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 10260000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_4p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_4p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_4p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_4p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_4p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_4p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_4p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_4p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_4p5Gsps,
+	},
+	{
+		/* ((5.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 11400000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_211_5Gsps),
+		.data_rate_reg_array[0][0] = datarate_211_5Gsps,
+		.data_rate_reg_array[1][0] = datarate_211_5Gsps,
+		.data_rate_reg_array[2][0] = datarate_211_5Gsps,
+		.data_rate_reg_array[3][0] = datarate_211_5Gsps,
+		.data_rate_reg_array[4][0] = datarate_211_5Gsps,
+		.data_rate_reg_array[5][0] = datarate_211_5Gsps,
+		.data_rate_reg_array[6][0] = datarate_211_5Gsps,
+		.data_rate_reg_array[7][0] = datarate_211_5Gsps,
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_2_1_1 = {
+	.num_data_rate_settings = ARRAY_SIZE(data_rate_settings_2_1_1),
+	.data_rate_settings = data_rate_settings_2_1_1,
+};
+
+struct csiphy_reg_parms_t csiphy_v2_1_1 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x10B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x1058,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x1028,
+	.size_offset_betn_lanes = 0x400,
+	.status_reg_params = &status_regs_2_1_1,
+	.csiphy_common_reg_array_size = ARRAY_SIZE(csiphy_common_reg_2_1_1),
+	.csiphy_reset_enter_array_size = ARRAY_SIZE(csiphy_reset_enter_reg_2_1_1),
+	.csiphy_reset_exit_array_size = ARRAY_SIZE(csiphy_reset_exit_reg_2_1_1),
+	.csiphy_2ph_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_1_1_reg),
+	.csiphy_3ph_config_array_size = ARRAY_SIZE(csiphy_3ph_v2_1_1_reg),
+	.csiphy_2ph_combo_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_1_1_combo_mode_reg),
+	.csiphy_3ph_combo_config_array_size = 0,
+	.csiphy_2ph_3ph_config_array_size = 0,
+	.csiphy_interrupt_status_size = ARRAY_SIZE(csiphy_irq_reg_2_1_1),
+	.csiphy_num_common_status_regs = 20,
+	.aon_sel_params = &aon_cam_select_params,
+};
+
+struct csiphy_ctrl_t ctrl_reg_2_1_1 = {
+	.csiphy_common_reg = csiphy_common_reg_2_1_1,
+	.csiphy_2ph_reg = csiphy_2ph_v2_1_1_reg,
+	.csiphy_3ph_reg = csiphy_3ph_v2_1_1_reg,
+	.csiphy_2ph_combo_mode_reg = csiphy_2ph_v2_1_1_combo_mode_reg,
+	.csiphy_3ph_combo_reg = NULL,
+	.csiphy_2ph_3ph_mode_reg = NULL,
+	.csiphy_reg = &csiphy_v2_1_1,
+	.csiphy_irq_reg = csiphy_irq_reg_2_1_1,
+	.csiphy_reset_enter_regs = csiphy_reset_enter_reg_2_1_1,
+	.csiphy_reset_exit_regs = csiphy_reset_exit_reg_2_1_1,
+	.csiphy_lane_config_reg = csiphy_lane_en_reg_2_1_1,
+	.data_rates_settings_table = &data_rate_delta_table_2_1_1,
+	.csiphy_bist_reg = &bist_setting_2_1_1,
+	.getclockvoting = get_clk_voting_dynamic,
+};
+
+#endif /* _CAM_CSIPHY_2_1_1_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_2_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_2_hwreg.h
@@ -0,0 +1,1977 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_2_1_2_HWREG_H_
+#define _CAM_CSIPHY_2_1_2_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct cam_csiphy_aon_sel_params_t aon_cam_select_params_2_1_2 = {
+	.aon_cam_sel_offset[0] = 0x01E0,
+	.aon_cam_sel_offset[1] = 0,
+	.cam_sel_mask = BIT(0),
+	.mclk_sel_mask = BIT(8),
+};
+
+struct cam_cphy_dphy_status_reg_params_t status_regs_2_1_2 = {
+	.csiphy_3ph_status0_offset = 0x0340,
+	.csiphy_2ph_status0_offset = 0x00C0,
+	.cphy_lane_status = {0x0358, 0x0758, 0x0B58},
+	.csiphy_3ph_status_size = 24,
+	.csiphy_2ph_status_size = 20,
+};
+
+struct csiphy_reg_t csiphy_lane_en_reg_2_1_2[] = {
+	{0x1014, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+};
+
+struct csiphy_reg_t csiphy_common_reg_2_1_2[] = {
+	{0x1084, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x101C, 0x7A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1018, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_enter_reg_2_1_2[] = {
+	{0x1000, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_exit_reg_2_1_2[] = {
+	{0x1000, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x1000, 0x00, 0x00, CSIPHY_2PH_COMBO_REGS},
+	{0x1000, 0x0E, 0xBE8, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_2_1_2[] = {
+	{0x102c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1030, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1034, 0xfb, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1038, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x103c, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1040, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1044, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1048, 0xef, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x104c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1050, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1054, 0xff, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_1_2_reg[] = {
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C94, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C5C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C60, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C64, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_1_2_combo_mode_reg[] = {
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0828, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_3ph_v2_1_2_reg[] = {
+	{0x02F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0xEF, 0x03, CSIPHY_DEFAULT_PARAMS},
+	{0x06F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0xEF, 0x03, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AFC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0xEF, 0x03, CSIPHY_DEFAULT_PARAMS},
+	{0x0204, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0218, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x021C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0220, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0224, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0228, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x022C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0264, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0310, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0254, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0260, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0284, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0604, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0618, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x061C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0620, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0624, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0628, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x062C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0664, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0710, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0654, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0660, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0684, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AEC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A18, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A1C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A20, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A24, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A28, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A2C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A64, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B10, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0ABC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A54, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A60, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_100Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_200Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_300Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_350Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_400Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_500Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_600Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_700Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_800Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_900Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_1p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_1p2Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_1p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_1p7Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_2p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_2p1Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_2p35Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_2p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_2p6Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_2p8Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_3p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_3p3Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_3p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_4p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_4p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x06, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x06, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x06, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_5p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x02, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x02, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x02, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_5p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x00, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x00, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x00, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_212_6p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x00, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x026C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x00, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x066C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x00, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive*/
+	{0x020C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+static struct data_rate_reg_info_t data_rate_settings_2_1_2[] = {
+	{
+		/* ((100 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 228000000,
+		.data_rate_reg_array[0][0] = datarate_212_100Msps,
+		.data_rate_reg_array[1][0] = datarate_212_100Msps,
+		.data_rate_reg_array[2][0] = datarate_212_100Msps,
+		.data_rate_reg_array[3][0] = datarate_212_100Msps,
+		.data_rate_reg_array[4][0] = datarate_212_100Msps,
+		.data_rate_reg_array[5][0] = datarate_212_100Msps,
+		.data_rate_reg_array[6][0] = datarate_212_100Msps,
+		.data_rate_reg_array[7][0] = datarate_212_100Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_100Msps),
+	},
+	{
+		/* ((200 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 456000000,
+		.data_rate_reg_array[0][0] = datarate_212_200Msps,
+		.data_rate_reg_array[1][0] = datarate_212_200Msps,
+		.data_rate_reg_array[2][0] = datarate_212_200Msps,
+		.data_rate_reg_array[3][0] = datarate_212_200Msps,
+		.data_rate_reg_array[4][0] = datarate_212_200Msps,
+		.data_rate_reg_array[5][0] = datarate_212_200Msps,
+		.data_rate_reg_array[6][0] = datarate_212_200Msps,
+		.data_rate_reg_array[7][0] = datarate_212_200Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_200Msps),
+	},
+	{
+		/* ((300 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 684000000,
+		.data_rate_reg_array[0][0] = datarate_212_300Msps,
+		.data_rate_reg_array[1][0] = datarate_212_300Msps,
+		.data_rate_reg_array[2][0] = datarate_212_300Msps,
+		.data_rate_reg_array[3][0] = datarate_212_300Msps,
+		.data_rate_reg_array[4][0] = datarate_212_300Msps,
+		.data_rate_reg_array[5][0] = datarate_212_300Msps,
+		.data_rate_reg_array[6][0] = datarate_212_300Msps,
+		.data_rate_reg_array[7][0] = datarate_212_300Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_300Msps),
+	},
+	{
+		/* ((350 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 798000000,
+		.data_rate_reg_array[0][0] = datarate_212_350Msps,
+		.data_rate_reg_array[1][0] = datarate_212_350Msps,
+		.data_rate_reg_array[2][0] = datarate_212_350Msps,
+		.data_rate_reg_array[3][0] = datarate_212_350Msps,
+		.data_rate_reg_array[4][0] = datarate_212_350Msps,
+		.data_rate_reg_array[5][0] = datarate_212_350Msps,
+		.data_rate_reg_array[6][0] = datarate_212_350Msps,
+		.data_rate_reg_array[7][0] = datarate_212_350Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_350Msps),
+	},
+	{
+		/* ((400 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 912000000,
+		.data_rate_reg_array[0][0] = datarate_212_400Msps,
+		.data_rate_reg_array[1][0] = datarate_212_400Msps,
+		.data_rate_reg_array[2][0] = datarate_212_400Msps,
+		.data_rate_reg_array[3][0] = datarate_212_400Msps,
+		.data_rate_reg_array[4][0] = datarate_212_400Msps,
+		.data_rate_reg_array[5][0] = datarate_212_400Msps,
+		.data_rate_reg_array[6][0] = datarate_212_400Msps,
+		.data_rate_reg_array[7][0] = datarate_212_400Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_400Msps),
+	},
+	{
+		/* ((500 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 1140000000,
+		.data_rate_reg_array[0][0] = datarate_212_500Msps,
+		.data_rate_reg_array[1][0] = datarate_212_500Msps,
+		.data_rate_reg_array[2][0] = datarate_212_500Msps,
+		.data_rate_reg_array[3][0] = datarate_212_500Msps,
+		.data_rate_reg_array[4][0] = datarate_212_500Msps,
+		.data_rate_reg_array[5][0] = datarate_212_500Msps,
+		.data_rate_reg_array[6][0] = datarate_212_500Msps,
+		.data_rate_reg_array[7][0] = datarate_212_500Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_500Msps),
+	},
+	{
+		/* ((600 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 1368000000,
+		.data_rate_reg_array[0][0] = datarate_212_600Msps,
+		.data_rate_reg_array[1][0] = datarate_212_600Msps,
+		.data_rate_reg_array[2][0] = datarate_212_600Msps,
+		.data_rate_reg_array[3][0] = datarate_212_600Msps,
+		.data_rate_reg_array[4][0] = datarate_212_600Msps,
+		.data_rate_reg_array[5][0] = datarate_212_600Msps,
+		.data_rate_reg_array[6][0] = datarate_212_600Msps,
+		.data_rate_reg_array[7][0] = datarate_212_600Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_600Msps),
+	},
+	{
+		/* ((700 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 1596000000,
+		.data_rate_reg_array[0][0] = datarate_212_700Msps,
+		.data_rate_reg_array[1][0] = datarate_212_700Msps,
+		.data_rate_reg_array[2][0] = datarate_212_700Msps,
+		.data_rate_reg_array[3][0] = datarate_212_700Msps,
+		.data_rate_reg_array[4][0] = datarate_212_700Msps,
+		.data_rate_reg_array[5][0] = datarate_212_700Msps,
+		.data_rate_reg_array[6][0] = datarate_212_700Msps,
+		.data_rate_reg_array[7][0] = datarate_212_700Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_700Msps),
+	},
+	{
+		/* ((800 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 1824000000,
+		.data_rate_reg_array[0][0] = datarate_212_800Msps,
+		.data_rate_reg_array[1][0] = datarate_212_800Msps,
+		.data_rate_reg_array[2][0] = datarate_212_800Msps,
+		.data_rate_reg_array[3][0] = datarate_212_800Msps,
+		.data_rate_reg_array[4][0] = datarate_212_800Msps,
+		.data_rate_reg_array[5][0] = datarate_212_800Msps,
+		.data_rate_reg_array[6][0] = datarate_212_800Msps,
+		.data_rate_reg_array[7][0] = datarate_212_800Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_800Msps),
+	},
+	{
+		/* ((900 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 2052000000,
+		.data_rate_reg_array[0][0] = datarate_212_900Msps,
+		.data_rate_reg_array[1][0] = datarate_212_900Msps,
+		.data_rate_reg_array[2][0] = datarate_212_900Msps,
+		.data_rate_reg_array[3][0] = datarate_212_900Msps,
+		.data_rate_reg_array[4][0] = datarate_212_900Msps,
+		.data_rate_reg_array[5][0] = datarate_212_900Msps,
+		.data_rate_reg_array[6][0] = datarate_212_900Msps,
+		.data_rate_reg_array[7][0] = datarate_212_900Msps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_900Msps),
+	},
+	{
+		/* ((1000 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 2280000000,
+		.data_rate_reg_array[0][0] = datarate_212_1p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_1p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_1p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_1p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_1p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_1p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_1p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_1p0Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_1p0Gsps),
+	},
+	{
+		/* ((1.2 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 2736000000,
+		.data_rate_reg_array[0][0] = datarate_212_1p2Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_1p2Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_1p2Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_1p2Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_1p2Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_1p2Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_1p2Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_1p2Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_1p2Gsps),
+	},
+	{
+		/* ((1.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 3420000000,
+		.data_rate_reg_array[0][0] = datarate_212_1p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_1p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_1p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_1p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_1p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_1p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_1p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_1p5Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_1p5Gsps),
+	},
+	{
+		/* ((1.7 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 3876000000,
+		.data_rate_reg_array[0][0] = datarate_212_1p7Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_1p7Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_1p7Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_1p7Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_1p7Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_1p7Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_1p7Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_1p7Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_1p7Gsps),
+	},
+	{
+		/* ((2.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 4560000000,
+		.data_rate_reg_array[0][0] = datarate_212_2p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_2p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_2p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_2p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_2p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_2p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_2p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_2p0Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_2p0Gsps),
+	},
+	{
+		/* ((2.1 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 4788000000,
+		.data_rate_reg_array[0][0] = datarate_212_2p1Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_2p1Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_2p1Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_2p1Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_2p1Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_2p1Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_2p1Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_2p1Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_2p1Gsps),
+	},
+	{
+		/* ((2.35 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5358000000,
+		.data_rate_reg_array[0][0] = datarate_212_2p35Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_2p35Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_2p35Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_2p35Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_2p35Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_2p35Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_2p35Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_2p35Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_2p35Gsps),
+	},
+	{
+		/* ((2.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5700000000,
+		.data_rate_reg_array[0][0] = datarate_212_2p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_2p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_2p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_2p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_2p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_2p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_2p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_2p5Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_2p5Gsps),
+	},
+	{
+		/* ((2.6 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5928000000,
+		.data_rate_reg_array[0][0] = datarate_212_2p6Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_2p6Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_2p6Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_2p6Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_2p6Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_2p6Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_2p6Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_2p6Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_2p6Gsps),
+	},
+	{
+		/* ((2.8 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6384000000,
+		.data_rate_reg_array[0][0] = datarate_212_2p8Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_2p8Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_2p8Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_2p8Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_2p8Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_2p8Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_2p8Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_2p8Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_2p8Gsps),
+	},
+	{
+		/* ((3.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6840000000,
+		.data_rate_reg_array[0][0] = datarate_212_3p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_3p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_3p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_3p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_3p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_3p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_3p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_3p0Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_3p0Gsps),
+	},
+	{
+		/* ((3.3 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7524000000,
+		.data_rate_reg_array[0][0] = datarate_212_3p3Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_3p3Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_3p3Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_3p3Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_3p3Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_3p3Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_3p3Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_3p3Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_3p3Gsps),
+	},
+	{
+		/* ((3.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7980000000,
+		.data_rate_reg_array[0][0] = datarate_212_3p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_3p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_3p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_3p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_3p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_3p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_3p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_3p5Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_3p5Gsps),
+	},
+	{
+		/* ((4 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 9120000000,
+		.data_rate_reg_array[0][0] = datarate_212_4p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_4p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_4p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_4p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_4p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_4p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_4p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_4p0Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_4p0Gsps),
+	},
+	{
+		/* ((4.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 10260000000,
+		.data_rate_reg_array[0][0] = datarate_212_4p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_4p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_4p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_4p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_4p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_4p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_4p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_4p5Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_4p5Gsps),
+	},
+	{
+		/* ((5.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 11400000000,
+		.data_rate_reg_array[0][0] = datarate_212_5p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_5p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_5p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_5p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_5p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_5p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_5p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_5p0Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_5p0Gsps),
+	},
+	{
+		/* ((5.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 12540000000,
+		.data_rate_reg_array[0][0] = datarate_212_5p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_5p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_5p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_5p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_5p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_5p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_5p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_5p5Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_5p5Gsps),
+	},
+	{
+		/* ((6.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 13680000000,
+		.data_rate_reg_array[0][0] = datarate_212_6p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_212_6p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_212_6p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_212_6p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_212_6p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_212_6p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_212_6p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_212_6p0Gsps,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_212_6p0Gsps),
+	},
+};
+
+struct csiphy_reg_t bist_3ph_arr_2_1_2[] = {
+	{0x0230, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0234, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0238, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x023C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0258, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02C8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0248, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x024C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0250, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x025C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0630, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0634, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0638, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x063C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0658, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06C8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0648, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x064C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0650, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x065C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A30, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A34, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A38, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A3C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A58, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AC8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A48, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A4C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A50, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A5C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t bist_status_arr_2_1_2[] = {
+	{0x0344, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0744, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0B44, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x00C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x04C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x08C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x0CC0, 0x00, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct bist_reg_settings_t bist_setting_2_1_2 = {
+	.error_status_val_3ph = 0x10,
+	.error_status_val_2ph = 0x10,
+	.set_status_update_3ph_base_offset = 0x0240,
+	.set_status_update_2ph_base_offset = 0x0050,
+	.bist_status_3ph_base_offset = 0x0344,
+	.bist_status_2ph_base_offset = 0x00C0,
+	.bist_sensor_data_3ph_status_base_offset = 0x0340,
+	.bist_counter_3ph_base_offset = 0x0348,
+	.bist_counter_2ph_base_offset = 0x00C8,
+	.number_of_counters = 2,
+	.num_3ph_bist_settings = ARRAY_SIZE(bist_3ph_arr_2_1_2),
+	.bist_3ph_settings_arry = bist_3ph_arr_2_1_2,
+	.bist_2ph_settings_arry = NULL,
+	.num_2ph_bist_settings = 0,
+	.num_status_reg = ARRAY_SIZE(bist_status_arr_2_1_2),
+	.bist_status_arr = bist_status_arr_2_1_2,
+};
+
+struct data_rate_settings_t data_rate_delta_table_2_1_2 = {
+	.num_data_rate_settings = ARRAY_SIZE(data_rate_settings_2_1_2),
+	.data_rate_settings = data_rate_settings_2_1_2,
+};
+
+struct csiphy_reg_parms_t csiphy_v2_1_2 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x10B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x1058,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x1028,
+	.size_offset_betn_lanes = 0x400,
+	.status_reg_params = &status_regs_2_1_2,
+	.csiphy_common_reg_array_size = ARRAY_SIZE(csiphy_common_reg_2_1_2),
+	.csiphy_reset_enter_array_size = ARRAY_SIZE(csiphy_reset_enter_reg_2_1_2),
+	.csiphy_reset_exit_array_size = ARRAY_SIZE(csiphy_reset_exit_reg_2_1_2),
+	.csiphy_2ph_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_1_2_reg),
+	.csiphy_3ph_config_array_size = ARRAY_SIZE(csiphy_3ph_v2_1_2_reg),
+	.csiphy_2ph_combo_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_1_2_combo_mode_reg),
+	.csiphy_3ph_combo_config_array_size = 0,
+	.csiphy_2ph_3ph_config_array_size = 0,
+	.csiphy_interrupt_status_size = ARRAY_SIZE(csiphy_irq_reg_2_1_2),
+	.csiphy_num_common_status_regs = 20,
+	.aon_sel_params = &aon_cam_select_params_2_1_2,
+};
+
+struct csiphy_ctrl_t ctrl_reg_2_1_2 = {
+	.csiphy_common_reg = csiphy_common_reg_2_1_2,
+	.csiphy_2ph_reg = csiphy_2ph_v2_1_2_reg,
+	.csiphy_3ph_reg = csiphy_3ph_v2_1_2_reg,
+	.csiphy_2ph_combo_mode_reg = csiphy_2ph_v2_1_2_combo_mode_reg,
+	.csiphy_3ph_combo_reg = NULL,
+	.csiphy_2ph_3ph_mode_reg = NULL,
+	.csiphy_reg = &csiphy_v2_1_2,
+	.csiphy_irq_reg = csiphy_irq_reg_2_1_2,
+	.csiphy_reset_enter_regs = csiphy_reset_enter_reg_2_1_2,
+	.csiphy_reset_exit_regs = csiphy_reset_exit_reg_2_1_2,
+	.csiphy_lane_config_reg = csiphy_lane_en_reg_2_1_2,
+	.data_rates_settings_table = &data_rate_delta_table_2_1_2,
+	.csiphy_bist_reg = &bist_setting_2_1_2,
+	.getclockvoting = get_clk_voting_dynamic,
+};
+
+#endif /* _CAM_CSIPHY_2_1_2_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_3_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_3_hwreg.h
@@ -0,0 +1,1478 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_2_1_3_HWREG_H_
+#define _CAM_CSIPHY_2_1_3_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct cam_csiphy_aon_sel_params_t aon_cam_select_params_2_1_3 = {
+	.aon_cam_sel_offset[0] = 0x01E0,
+	.aon_cam_sel_offset[1] = 0,
+	.cam_sel_mask = BIT(0),
+	.mclk_sel_mask = BIT(8),
+};
+
+struct cam_cphy_dphy_status_reg_params_t status_regs_2_1_3 = {
+	.csiphy_3ph_status0_offset = 0x0340,
+	.csiphy_2ph_status0_offset = 0x00C0,
+	.cphy_lane_status = {0x0358, 0x0758, 0x0B58},
+	.csiphy_3ph_status_size = 24,
+	.csiphy_2ph_status_size = 20,
+};
+
+struct csiphy_reg_t csiphy_lane_en_reg_2_1_3[] = {
+	{0x1014, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+};
+
+struct csiphy_reg_t csiphy_common_reg_2_1_3[] = {
+	{0x1084, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1018, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x101C, 0x7A, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_enter_reg_2_1_3[] = {
+	{0x1000, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_exit_reg_2_1_3[] = {
+	{0x1000, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x1000, 0x00, 0x00, CSIPHY_2PH_COMBO_REGS},
+	{0x1000, 0x0E, 0xBE8, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_2_1_3[] = {
+	{0x102c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1030, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1034, 0xfb, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1038, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x103c, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1040, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1044, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1048, 0xef, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x104c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1050, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1054, 0xff, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_1_3_reg[] = {
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C94, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C5C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C60, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C64, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_1_3_combo_mode_reg[] = {
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0828, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_3ph_v2_1_3_reg[] = {
+	{0x0268, 0xF1, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0x00, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0xEF, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0204, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x020C, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0218, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x021C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0220, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0224, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0228, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x022C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0264, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0284, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0310, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0254, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0260, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0x00, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0xEF, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0604, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0618, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x061C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0620, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0624, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0628, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x062C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0664, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0684, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0710, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0654, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0660, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AFC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0x00, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0xEF, 0x64, CSIPHY_DEFAULT_PARAMS},
+	{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AEC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A18, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A1C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A20, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A24, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A28, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A2C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A64, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B10, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0ABC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A54, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A60, 0xA8, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t bist_3ph_arr_2_1_3[] = {
+	/* 3Phase BIST CONFIGURATION REG SET */
+	{0x02D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0250, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0650, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A50, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t bist_status_arr_2_1_3[] = {
+
+	{0x0344, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0744, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0B44, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x00C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x04C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x08C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x0CC0, 0x00, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct bist_reg_settings_t bist_setting_2_1_3 = {
+	.error_status_val_3ph = 0x10,
+	.error_status_val_2ph = 0x10,
+	.set_status_update_3ph_base_offset = 0x0240,
+	.set_status_update_2ph_base_offset = 0x0050,
+	.bist_status_3ph_base_offset = 0x0344,
+	.bist_status_2ph_base_offset = 0x00C0,
+	.bist_sensor_data_3ph_status_base_offset = 0x0340,
+	.bist_counter_3ph_base_offset = 0x0348,
+	.bist_counter_2ph_base_offset = 0x00C8,
+	.number_of_counters = 2,
+	.num_3ph_bist_settings = ARRAY_SIZE(bist_3ph_arr_2_1_3),
+	.bist_3ph_settings_arry = bist_3ph_arr_2_1_3,
+	.bist_2ph_settings_arry = NULL,
+	.num_2ph_bist_settings = 0,
+	.num_status_reg = ARRAY_SIZE(bist_status_arr_2_1_3),
+	.bist_status_arr = bist_status_arr_2_1_3,
+};
+
+struct csiphy_reg_t datarate_213_100Msps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0xA70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_200Msps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_300Msps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_400Msps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_500Msps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_600Msps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_700Msps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_800Msps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_900Msps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_1p0Gsps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_1p2Gsps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_1p5Gsps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x4D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x4D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x4D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_1p7Gsps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x43, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x43, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x43, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_2p0Gsps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_2p1Gsps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_2p35Gsps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x2E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x2E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x2E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_2p5Gsps[] = {
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x11, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_2p6Gsps[] = {
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x28, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_2p8Gsps[] = {
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_3p0Gsps[] = {
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+
+struct csiphy_reg_t datarate_213_3p3Gsps[] = {
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x1D, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_3p5Gsps[] = {
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x15, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x15, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x15, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_4Gsps[] = {
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_4p5Gsps[] = {
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x34, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_213_5Gsps[] = {
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x028C, 0x45, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x24, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x068C, 0x45, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x24, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A8C, 0x45, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x24, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+static struct data_rate_reg_info_t data_rate_settings_2_1_3[] = {
+	{
+		/* ((100 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 228000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_100Msps),
+		.data_rate_reg_array[0][0] = datarate_213_100Msps,
+		.data_rate_reg_array[1][0] = datarate_213_100Msps,
+		.data_rate_reg_array[2][0] = datarate_213_100Msps,
+		.data_rate_reg_array[3][0] = datarate_213_100Msps,
+		.data_rate_reg_array[4][0] = datarate_213_100Msps,
+		.data_rate_reg_array[5][0] = datarate_213_100Msps,
+		.data_rate_reg_array[6][0] = datarate_213_100Msps,
+		.data_rate_reg_array[7][0] = datarate_213_100Msps
+	},
+	{
+		/* ((200 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 456000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_200Msps),
+		.data_rate_reg_array[0][0] = datarate_213_200Msps,
+		.data_rate_reg_array[1][0] = datarate_213_200Msps,
+		.data_rate_reg_array[2][0] = datarate_213_200Msps,
+		.data_rate_reg_array[3][0] = datarate_213_200Msps,
+		.data_rate_reg_array[4][0] = datarate_213_200Msps,
+		.data_rate_reg_array[5][0] = datarate_213_200Msps,
+		.data_rate_reg_array[6][0] = datarate_213_200Msps,
+		.data_rate_reg_array[7][0] = datarate_213_200Msps
+	},
+	{
+		/* ((300 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 684000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_300Msps),
+		.data_rate_reg_array[0][0] = datarate_213_300Msps,
+		.data_rate_reg_array[1][0] = datarate_213_300Msps,
+		.data_rate_reg_array[2][0] = datarate_213_300Msps,
+		.data_rate_reg_array[3][0] = datarate_213_300Msps,
+		.data_rate_reg_array[4][0] = datarate_213_300Msps,
+		.data_rate_reg_array[5][0] = datarate_213_300Msps,
+		.data_rate_reg_array[6][0] = datarate_213_300Msps,
+		.data_rate_reg_array[7][0] = datarate_213_300Msps
+	},
+	{
+		/* ((400 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 912000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_400Msps),
+		.data_rate_reg_array[0][0] = datarate_213_400Msps,
+		.data_rate_reg_array[1][0] = datarate_213_400Msps,
+		.data_rate_reg_array[2][0] = datarate_213_400Msps,
+		.data_rate_reg_array[3][0] = datarate_213_400Msps,
+		.data_rate_reg_array[4][0] = datarate_213_400Msps,
+		.data_rate_reg_array[5][0] = datarate_213_400Msps,
+		.data_rate_reg_array[6][0] = datarate_213_400Msps,
+		.data_rate_reg_array[7][0] = datarate_213_400Msps
+	},
+	{
+		/* ((500 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 1140000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_500Msps),
+		.data_rate_reg_array[0][0] = datarate_213_500Msps,
+		.data_rate_reg_array[1][0] = datarate_213_500Msps,
+		.data_rate_reg_array[2][0] = datarate_213_500Msps,
+		.data_rate_reg_array[3][0] = datarate_213_500Msps,
+		.data_rate_reg_array[4][0] = datarate_213_500Msps,
+		.data_rate_reg_array[5][0] = datarate_213_500Msps,
+		.data_rate_reg_array[6][0] = datarate_213_500Msps,
+		.data_rate_reg_array[7][0] = datarate_213_500Msps
+	},
+	{
+		/* ((600 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 1368000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_600Msps),
+		.data_rate_reg_array[0][0] = datarate_213_600Msps,
+		.data_rate_reg_array[1][0] = datarate_213_600Msps,
+		.data_rate_reg_array[2][0] = datarate_213_600Msps,
+		.data_rate_reg_array[3][0] = datarate_213_600Msps,
+		.data_rate_reg_array[4][0] = datarate_213_600Msps,
+		.data_rate_reg_array[5][0] = datarate_213_600Msps,
+		.data_rate_reg_array[6][0] = datarate_213_600Msps,
+		.data_rate_reg_array[7][0] = datarate_213_600Msps
+	},
+	{
+		/* ((700 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 1596000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_700Msps),
+		.data_rate_reg_array[0][0] = datarate_213_700Msps,
+		.data_rate_reg_array[1][0] = datarate_213_700Msps,
+		.data_rate_reg_array[2][0] = datarate_213_700Msps,
+		.data_rate_reg_array[3][0] = datarate_213_700Msps,
+		.data_rate_reg_array[4][0] = datarate_213_700Msps,
+		.data_rate_reg_array[5][0] = datarate_213_700Msps,
+		.data_rate_reg_array[6][0] = datarate_213_700Msps,
+		.data_rate_reg_array[7][0] = datarate_213_700Msps
+	},
+	{
+		/* ((800 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 1824000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_800Msps),
+		.data_rate_reg_array[0][0] = datarate_213_800Msps,
+		.data_rate_reg_array[1][0] = datarate_213_800Msps,
+		.data_rate_reg_array[2][0] = datarate_213_800Msps,
+		.data_rate_reg_array[3][0] = datarate_213_800Msps,
+		.data_rate_reg_array[4][0] = datarate_213_800Msps,
+		.data_rate_reg_array[5][0] = datarate_213_800Msps,
+		.data_rate_reg_array[6][0] = datarate_213_800Msps,
+		.data_rate_reg_array[7][0] = datarate_213_800Msps
+	},
+	{
+		/* ((900 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 2052000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_900Msps),
+		.data_rate_reg_array[0][0] = datarate_213_900Msps,
+		.data_rate_reg_array[1][0] = datarate_213_900Msps,
+		.data_rate_reg_array[2][0] = datarate_213_900Msps,
+		.data_rate_reg_array[3][0] = datarate_213_900Msps,
+		.data_rate_reg_array[4][0] = datarate_213_900Msps,
+		.data_rate_reg_array[5][0] = datarate_213_900Msps,
+		.data_rate_reg_array[6][0] = datarate_213_900Msps,
+		.data_rate_reg_array[7][0] = datarate_213_900Msps
+	},
+	{
+		/* ((1000 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 2280000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_1p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_1p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_1p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_1p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_1p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_1p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_1p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_1p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_1p0Gsps
+	},
+	{
+		/* ((1.2 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 2736000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_1p2Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_1p2Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_1p2Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_1p2Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_1p2Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_1p2Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_1p2Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_1p2Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_1p2Gsps
+	},
+	{
+		/* ((1.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 3420000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_1p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_1p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_1p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_1p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_1p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_1p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_1p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_1p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_1p5Gsps
+	},
+	{
+		/* ((1.7 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 3876000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_1p7Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_1p7Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_1p7Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_1p7Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_1p7Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_1p7Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_1p7Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_1p7Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_1p7Gsps
+	},
+	{
+		/* ((2.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 4560000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_2p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_2p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_2p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_2p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_2p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_2p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_2p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_2p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_2p0Gsps
+	},
+	{
+		/* ((2.1 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 4788000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_2p1Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_2p1Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_2p1Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_2p1Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_2p1Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_2p1Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_2p1Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_2p1Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_2p1Gsps
+	},
+	{
+		/* ((2.35 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5358000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_2p35Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_2p35Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_2p35Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_2p35Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_2p35Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_2p35Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_2p35Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_2p35Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_2p35Gsps
+	},
+	{
+		/* ((2.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5700000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_2p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_2p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_2p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_2p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_2p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_2p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_2p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_2p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_2p5Gsps
+	},
+	{
+		/* ((2.6 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value*/
+		.bandwidth = 5928000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_2p6Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_2p6Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_2p6Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_2p6Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_2p6Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_2p6Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_2p6Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_2p6Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_2p6Gsps,
+	},
+	{
+		/* ((2.8 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6384000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_2p8Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_2p8Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_2p8Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_2p8Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_2p8Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_2p8Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_2p8Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_2p8Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_2p8Gsps,
+	},
+	{
+		/* ((3.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6840000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_3p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_3p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_3p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_3p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_3p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_3p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_3p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_3p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_3p0Gsps,
+	},
+	{
+		/* ((3.3 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7524000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_3p3Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_3p3Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_3p3Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_3p3Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_3p3Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_3p3Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_3p3Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_3p3Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_3p3Gsps,
+	},
+	{
+		/* ((3.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7980000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_3p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_3p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_3p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_3p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_3p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_3p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_3p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_3p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_3p5Gsps,
+	},
+	{
+		/* ((4 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 9120000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_4Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_4Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_4Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_4Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_4Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_4Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_4Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_4Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_4Gsps,
+	},
+	{
+		/* ((4.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 10260000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_4p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_4p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_4p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_4p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_4p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_4p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_4p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_4p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_4p5Gsps,
+	},
+	{
+		/* ((5.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 11400000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_213_5Gsps),
+		.data_rate_reg_array[0][0] = datarate_213_5Gsps,
+		.data_rate_reg_array[1][0] = datarate_213_5Gsps,
+		.data_rate_reg_array[2][0] = datarate_213_5Gsps,
+		.data_rate_reg_array[3][0] = datarate_213_5Gsps,
+		.data_rate_reg_array[4][0] = datarate_213_5Gsps,
+		.data_rate_reg_array[5][0] = datarate_213_5Gsps,
+		.data_rate_reg_array[6][0] = datarate_213_5Gsps,
+		.data_rate_reg_array[7][0] = datarate_213_5Gsps,
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_2_1_3 = {
+	.num_data_rate_settings = ARRAY_SIZE(data_rate_settings_2_1_3),
+	.data_rate_settings = data_rate_settings_2_1_3,
+};
+
+struct csiphy_reg_parms_t csiphy_v2_1_3 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x10B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x1058,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x1028,
+	.size_offset_betn_lanes = 0x400,
+	.status_reg_params = &status_regs_2_1_3,
+	.csiphy_common_reg_array_size = ARRAY_SIZE(csiphy_common_reg_2_1_3),
+	.csiphy_reset_enter_array_size = ARRAY_SIZE(csiphy_reset_enter_reg_2_1_3),
+	.csiphy_reset_exit_array_size = ARRAY_SIZE(csiphy_reset_exit_reg_2_1_3),
+	.csiphy_2ph_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_1_3_reg),
+	.csiphy_3ph_config_array_size = ARRAY_SIZE(csiphy_3ph_v2_1_3_reg),
+	.csiphy_2ph_combo_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_1_3_combo_mode_reg),
+	.csiphy_3ph_combo_config_array_size = 0,
+	.csiphy_2ph_3ph_config_array_size = 0,
+	.csiphy_interrupt_status_size = ARRAY_SIZE(csiphy_irq_reg_2_1_3),
+	.csiphy_num_common_status_regs = 20,
+	.aon_sel_params = &aon_cam_select_params,
+};
+
+struct csiphy_ctrl_t ctrl_reg_2_1_3 = {
+	.csiphy_common_reg = csiphy_common_reg_2_1_3,
+	.csiphy_2ph_reg = csiphy_2ph_v2_1_3_reg,
+	.csiphy_3ph_reg = csiphy_3ph_v2_1_3_reg,
+	.csiphy_2ph_combo_mode_reg = csiphy_2ph_v2_1_3_combo_mode_reg,
+	.csiphy_3ph_combo_reg = NULL,
+	.csiphy_2ph_3ph_mode_reg = NULL,
+	.csiphy_reg = &csiphy_v2_1_3,
+	.csiphy_irq_reg = csiphy_irq_reg_2_1_3,
+	.csiphy_reset_enter_regs = csiphy_reset_enter_reg_2_1_3,
+	.csiphy_reset_exit_regs = csiphy_reset_exit_reg_2_1_3,
+	.csiphy_lane_config_reg = csiphy_lane_en_reg_2_1_3,
+	.data_rates_settings_table = &data_rate_delta_table_2_1_3,
+	.csiphy_bist_reg = &bist_setting_2_1_3,
+	.getclockvoting = get_clk_voting_dynamic,
+};
+
+#endif /* _CAM_CSIPHY_2_1_3_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_2_0_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_2_0_hwreg.h
@@ -0,0 +1,2218 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_2_2_0_HWREG_H_
+#define _CAM_CSIPHY_2_2_0_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct cam_csiphy_aon_sel_params_t aon_cam_select_params_2_2_0 = {
+	.aon_cam_sel_offset[0] = 0x01E0,
+	.aon_cam_sel_offset[1] = 0x01E4,
+	.cam_sel_mask = BIT(0),
+	.mclk_sel_mask = BIT(8),
+};
+
+struct cam_cphy_dphy_status_reg_params_t status_regs_2_2_0 = {
+	.csiphy_3ph_status0_offset = 0x0340,
+	.csiphy_2ph_status0_offset = 0x00C0,
+	.cphy_lane_status = {0x0358, 0x0758, 0x0B58},
+	.csiphy_3ph_status_size = 24,
+	.csiphy_2ph_status_size = 20,
+};
+
+struct csiphy_reg_t csiphy_lane_en_reg_2_2_0[] = {
+	{0x1014, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+};
+
+struct csiphy_reg_t csiphy_common_reg_2_2_0[] = {
+	{0x1084, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x101C, 0x7A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1018, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_enter_reg_2_2_0[] = {
+	{0x1000, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_exit_reg_2_2_0[] = {
+	{0x1000, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x1000, 0x00, 0x00, CSIPHY_2PH_COMBO_REGS},
+	{0x1000, 0x0E, 0xBE8, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_2_2_0[] = {
+	{0x102c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1030, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1034, 0xfb, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1038, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x103c, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1040, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1044, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1048, 0xef, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x104c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1050, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1054, 0xff, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_2_0_reg[] = {
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C94, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C5C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C60, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C64, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_2_0_combo_mode_reg[] = {
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0828, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_3ph_v2_2_0_reg[] = {
+	{0x02F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0xEF, 0xD3, CSIPHY_DEFAULT_PARAMS},
+	{0x06F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0xEF, 0xD3, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AFC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0xEF, 0xD3, CSIPHY_DEFAULT_PARAMS},
+	{0x0204, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0218, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x021C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0220, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0224, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0228, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x022C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0264, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0310, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0254, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0260, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0284, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0604, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0618, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x061C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0620, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0624, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0628, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x062C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0664, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0710, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0654, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0660, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0684, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AEC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A18, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A1C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A20, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A24, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A28, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A2C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A64, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B10, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0ABC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A54, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A60, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_80Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1F, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x02, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1F, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x02, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1F, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x02, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_100Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_200Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_300Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_350Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x8A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x8A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x8A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_400Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_500Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_600Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_700Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_800Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_900Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_1p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_1p2Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_1p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_1p7Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_2p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_2p1Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_2p35Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_2p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_2p6Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_2p8Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_3p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_3p3Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_3p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_4p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0278, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0678, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A78, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_4p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x06, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x06, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x06, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_5p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0278, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0678, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A78, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_5p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0278, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0678, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A78, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_220_6p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0278, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0678, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A78, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+static struct data_rate_reg_info_t data_rate_settings_2_2_0[] = {
+	{
+		/* ((80 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 182400000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_80Msps),
+		.data_rate_reg_array[0][0] = datarate_220_80Msps,
+		.data_rate_reg_array[1][0] = datarate_220_80Msps,
+		.data_rate_reg_array[2][0] = datarate_220_80Msps,
+		.data_rate_reg_array[3][0] = datarate_220_80Msps,
+		.data_rate_reg_array[4][0] = datarate_220_80Msps,
+		.data_rate_reg_array[5][0] = datarate_220_80Msps,
+		.data_rate_reg_array[6][0] = datarate_220_80Msps,
+		.data_rate_reg_array[7][0] = datarate_220_80Msps,
+	},
+	{
+		/* ((100 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 228000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_100Msps),
+		.data_rate_reg_array[0][0] = datarate_220_100Msps,
+		.data_rate_reg_array[1][0] = datarate_220_100Msps,
+		.data_rate_reg_array[2][0] = datarate_220_100Msps,
+		.data_rate_reg_array[3][0] = datarate_220_100Msps,
+		.data_rate_reg_array[4][0] = datarate_220_100Msps,
+		.data_rate_reg_array[5][0] = datarate_220_100Msps,
+		.data_rate_reg_array[6][0] = datarate_220_100Msps,
+		.data_rate_reg_array[7][0] = datarate_220_100Msps,
+	},
+	{
+		/* ((200 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 456000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_200Msps),
+		.data_rate_reg_array[0][0] = datarate_220_200Msps,
+		.data_rate_reg_array[1][0] = datarate_220_200Msps,
+		.data_rate_reg_array[2][0] = datarate_220_200Msps,
+		.data_rate_reg_array[3][0] = datarate_220_200Msps,
+		.data_rate_reg_array[4][0] = datarate_220_200Msps,
+		.data_rate_reg_array[5][0] = datarate_220_200Msps,
+		.data_rate_reg_array[6][0] = datarate_220_200Msps,
+		.data_rate_reg_array[7][0] = datarate_220_200Msps,
+	},
+	{
+		/* ((300 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 684000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_300Msps),
+		.data_rate_reg_array[0][0] = datarate_220_300Msps,
+		.data_rate_reg_array[1][0] = datarate_220_300Msps,
+		.data_rate_reg_array[2][0] = datarate_220_300Msps,
+		.data_rate_reg_array[3][0] = datarate_220_300Msps,
+		.data_rate_reg_array[4][0] = datarate_220_300Msps,
+		.data_rate_reg_array[5][0] = datarate_220_300Msps,
+		.data_rate_reg_array[6][0] = datarate_220_300Msps,
+		.data_rate_reg_array[7][0] = datarate_220_300Msps,
+	},
+	{
+		/* ((350 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 798000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_350Msps),
+		.data_rate_reg_array[0][0] = datarate_220_350Msps,
+		.data_rate_reg_array[1][0] = datarate_220_350Msps,
+		.data_rate_reg_array[2][0] = datarate_220_350Msps,
+		.data_rate_reg_array[3][0] = datarate_220_350Msps,
+		.data_rate_reg_array[4][0] = datarate_220_350Msps,
+		.data_rate_reg_array[5][0] = datarate_220_350Msps,
+		.data_rate_reg_array[6][0] = datarate_220_350Msps,
+		.data_rate_reg_array[7][0] = datarate_220_350Msps,
+	},
+	{
+		/* ((400 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 912000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_400Msps),
+		.data_rate_reg_array[0][0] = datarate_220_400Msps,
+		.data_rate_reg_array[1][0] = datarate_220_400Msps,
+		.data_rate_reg_array[2][0] = datarate_220_400Msps,
+		.data_rate_reg_array[3][0] = datarate_220_400Msps,
+		.data_rate_reg_array[4][0] = datarate_220_400Msps,
+		.data_rate_reg_array[5][0] = datarate_220_400Msps,
+		.data_rate_reg_array[6][0] = datarate_220_400Msps,
+		.data_rate_reg_array[7][0] = datarate_220_400Msps,
+	},
+	{
+		/* ((500 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1140000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_500Msps),
+		.data_rate_reg_array[0][0] = datarate_220_500Msps,
+		.data_rate_reg_array[1][0] = datarate_220_500Msps,
+		.data_rate_reg_array[2][0] = datarate_220_500Msps,
+		.data_rate_reg_array[3][0] = datarate_220_500Msps,
+		.data_rate_reg_array[4][0] = datarate_220_500Msps,
+		.data_rate_reg_array[5][0] = datarate_220_500Msps,
+		.data_rate_reg_array[6][0] = datarate_220_500Msps,
+		.data_rate_reg_array[7][0] = datarate_220_500Msps,
+	},
+	{
+		/* ((600 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1368000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_600Msps),
+		.data_rate_reg_array[0][0] = datarate_220_600Msps,
+		.data_rate_reg_array[1][0] = datarate_220_600Msps,
+		.data_rate_reg_array[2][0] = datarate_220_600Msps,
+		.data_rate_reg_array[3][0] = datarate_220_600Msps,
+		.data_rate_reg_array[4][0] = datarate_220_600Msps,
+		.data_rate_reg_array[5][0] = datarate_220_600Msps,
+		.data_rate_reg_array[6][0] = datarate_220_600Msps,
+		.data_rate_reg_array[7][0] = datarate_220_600Msps,
+	},
+	{
+		/* ((700 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1596000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_700Msps),
+		.data_rate_reg_array[0][0] = datarate_220_700Msps,
+		.data_rate_reg_array[1][0] = datarate_220_700Msps,
+		.data_rate_reg_array[2][0] = datarate_220_700Msps,
+		.data_rate_reg_array[3][0] = datarate_220_700Msps,
+		.data_rate_reg_array[4][0] = datarate_220_700Msps,
+		.data_rate_reg_array[5][0] = datarate_220_700Msps,
+		.data_rate_reg_array[6][0] = datarate_220_700Msps,
+		.data_rate_reg_array[7][0] = datarate_220_700Msps,
+	},
+	{
+		/* ((800 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1824000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_800Msps),
+		.data_rate_reg_array[0][0] = datarate_220_800Msps,
+		.data_rate_reg_array[1][0] = datarate_220_800Msps,
+		.data_rate_reg_array[2][0] = datarate_220_800Msps,
+		.data_rate_reg_array[3][0] = datarate_220_800Msps,
+		.data_rate_reg_array[4][0] = datarate_220_800Msps,
+		.data_rate_reg_array[5][0] = datarate_220_800Msps,
+		.data_rate_reg_array[6][0] = datarate_220_800Msps,
+		.data_rate_reg_array[7][0] = datarate_220_800Msps,
+	},
+	{
+		/* ((900 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 2052000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_900Msps),
+		.data_rate_reg_array[0][0] = datarate_220_900Msps,
+		.data_rate_reg_array[1][0] = datarate_220_900Msps,
+		.data_rate_reg_array[2][0] = datarate_220_900Msps,
+		.data_rate_reg_array[3][0] = datarate_220_900Msps,
+		.data_rate_reg_array[4][0] = datarate_220_900Msps,
+		.data_rate_reg_array[5][0] = datarate_220_900Msps,
+		.data_rate_reg_array[6][0] = datarate_220_900Msps,
+		.data_rate_reg_array[7][0] = datarate_220_900Msps,
+	},
+	{
+		/* ((1000 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 2280000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_1p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_1p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_1p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_1p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_1p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_1p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_1p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_1p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_1p0Gsps,
+	},
+	{
+		/* ((1.2 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 2736000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_1p2Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_1p2Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_1p2Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_1p2Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_1p2Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_1p2Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_1p2Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_1p2Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_1p2Gsps,
+	},
+	{
+		/* ((1.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 3420000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_1p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_1p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_1p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_1p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_1p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_1p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_1p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_1p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_1p5Gsps,
+	},
+	{
+		/* ((1.7 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 3876000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_1p7Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_1p7Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_1p7Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_1p7Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_1p7Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_1p7Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_1p7Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_1p7Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_1p7Gsps,
+	},
+	{
+		/* ((2.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 4560000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_2p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_2p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_2p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_2p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_2p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_2p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_2p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_2p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_2p0Gsps,
+	},
+	{
+		/* ((2.1 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 4788000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_2p1Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_2p1Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_2p1Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_2p1Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_2p1Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_2p1Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_2p1Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_2p1Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_2p1Gsps,
+	},
+	{
+		/* ((2.35 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5358000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_2p35Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_2p35Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_2p35Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_2p35Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_2p35Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_2p35Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_2p35Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_2p35Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_2p35Gsps,
+	},
+	{
+		/* ((2.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5700000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_2p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_2p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_2p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_2p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_2p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_2p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_2p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_2p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_2p5Gsps,
+	},
+	{
+		/* ((2.6 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5928000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_2p6Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_2p6Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_2p6Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_2p6Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_2p6Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_2p6Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_2p6Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_2p6Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_2p6Gsps,
+	},
+	{
+		/* ((2.8 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6384000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_2p8Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_2p8Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_2p8Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_2p8Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_2p8Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_2p8Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_2p8Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_2p8Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_2p8Gsps,
+	},
+	{
+		/* ((3.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6840000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_3p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_3p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_3p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_3p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_3p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_3p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_3p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_3p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_3p0Gsps,
+	},
+	{
+		/* ((3.3 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7524000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_3p3Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_3p3Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_3p3Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_3p3Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_3p3Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_3p3Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_3p3Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_3p3Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_3p3Gsps,
+	},
+	{
+		/* ((3.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7980000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_3p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_3p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_3p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_3p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_3p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_3p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_3p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_3p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_3p5Gsps,
+	},
+	{
+		/* ((4.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 9120000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_4p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_4p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_4p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_4p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_4p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_4p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_4p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_4p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_4p0Gsps,
+	},
+	{
+		/* ((4.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 10260000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_4p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_4p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_4p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_4p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_4p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_4p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_4p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_4p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_4p5Gsps,
+	},
+	{
+		/* ((5.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 11400000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_5p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_5p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_5p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_5p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_5p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_5p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_5p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_5p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_5p0Gsps,
+	},
+	{
+		/* ((5.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 12540000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_5p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_5p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_5p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_5p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_5p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_5p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_5p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_5p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_5p5Gsps,
+	},
+	{
+		/* ((6.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 13680000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_220_6p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_220_6p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_220_6p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_220_6p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_220_6p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_220_6p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_220_6p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_220_6p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_220_6p0Gsps,
+	},
+};
+
+struct csiphy_reg_t bist_3ph_arr_2_2_0[] = {
+	{0x0230, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0234, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0238, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x023C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0258, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02C8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0248, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x024C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0250, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x025C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0630, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0634, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0638, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x063C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0658, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06C8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0648, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x064C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0650, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x065C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A30, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A34, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A38, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A3C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A58, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AC8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A48, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A4C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A50, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A5C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t bist_status_arr_2_2_0[] = {
+	{0x0344, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0744, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0B44, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x00C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x04C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x08C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x0CC0, 0x00, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct bist_reg_settings_t bist_setting_2_2_0 = {
+	.error_status_val_3ph = 0x10,
+	.error_status_val_2ph = 0x10,
+	.set_status_update_3ph_base_offset = 0x0240,
+	.set_status_update_2ph_base_offset = 0x0050,
+	.bist_status_3ph_base_offset = 0x0344,
+	.bist_status_2ph_base_offset = 0x00C0,
+	.bist_sensor_data_3ph_status_base_offset = 0x0340,
+	.bist_counter_3ph_base_offset = 0x0348,
+	.bist_counter_2ph_base_offset = 0x00C8,
+	.number_of_counters = 2,
+	.num_3ph_bist_settings = ARRAY_SIZE(bist_3ph_arr_2_2_0),
+	.bist_3ph_settings_arry = bist_3ph_arr_2_2_0,
+	.bist_2ph_settings_arry = NULL,
+	.num_2ph_bist_settings = 0,
+	.num_status_reg = ARRAY_SIZE(bist_status_arr_2_2_0),
+	.bist_status_arr = bist_status_arr_2_2_0,
+};
+
+struct data_rate_settings_t data_rate_delta_table_2_2_0 = {
+	.num_data_rate_settings = ARRAY_SIZE(data_rate_settings_2_2_0),
+	.data_rate_settings = data_rate_settings_2_2_0,
+};
+
+struct csiphy_reg_parms_t csiphy_v2_2_0 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x10B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x1058,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x1028,
+	.size_offset_betn_lanes = 0x400,
+	.status_reg_params = &status_regs_2_2_0,
+	.csiphy_common_reg_array_size = ARRAY_SIZE(csiphy_common_reg_2_2_0),
+	.csiphy_reset_enter_array_size = ARRAY_SIZE(csiphy_reset_enter_reg_2_2_0),
+	.csiphy_reset_exit_array_size = ARRAY_SIZE(csiphy_reset_exit_reg_2_2_0),
+	.csiphy_2ph_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_2_0_reg),
+	.csiphy_3ph_config_array_size = ARRAY_SIZE(csiphy_3ph_v2_2_0_reg),
+	.csiphy_2ph_combo_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_2_0_combo_mode_reg),
+	.csiphy_3ph_combo_config_array_size = 0,
+	.csiphy_2ph_3ph_config_array_size = 0,
+	.csiphy_interrupt_status_size = ARRAY_SIZE(csiphy_irq_reg_2_2_0),
+	.csiphy_num_common_status_regs = 20,
+	.aon_sel_params = &aon_cam_select_params_2_2_0,
+};
+
+struct csiphy_ctrl_t ctrl_reg_2_2_0 = {
+	.csiphy_common_reg = csiphy_common_reg_2_2_0,
+	.csiphy_2ph_reg = csiphy_2ph_v2_2_0_reg,
+	.csiphy_3ph_reg = csiphy_3ph_v2_2_0_reg,
+	.csiphy_2ph_combo_mode_reg = csiphy_2ph_v2_2_0_combo_mode_reg,
+	.csiphy_3ph_combo_reg = NULL,
+	.csiphy_2ph_3ph_mode_reg = NULL,
+	.csiphy_reg = &csiphy_v2_2_0,
+	.csiphy_irq_reg = csiphy_irq_reg_2_2_0,
+	.csiphy_reset_enter_regs = csiphy_reset_enter_reg_2_2_0,
+	.csiphy_reset_exit_regs = csiphy_reset_exit_reg_2_2_0,
+	.csiphy_lane_config_reg = csiphy_lane_en_reg_2_2_0,
+	.data_rates_settings_table = &data_rate_delta_table_2_2_0,
+	.csiphy_bist_reg = &bist_setting_2_2_0,
+	.getclockvoting = get_clk_voting_dynamic,
+};
+
+#endif /* _CAM_CSIPHY_2_2_0_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_2_1_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_2_1_hwreg.h
@@ -0,0 +1,2218 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_2_2_1_HWREG_H_
+#define _CAM_CSIPHY_2_2_1_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct cam_csiphy_aon_sel_params_t aon_cam_select_params_2_2_1 = {
+	.aon_cam_sel_offset[0] = 0x01E0,
+	.aon_cam_sel_offset[1] = 0x01E4,
+	.cam_sel_mask = BIT(0),
+	.mclk_sel_mask = BIT(8),
+};
+
+struct cam_cphy_dphy_status_reg_params_t status_regs_2_2_1 = {
+	.csiphy_3ph_status0_offset = 0x0340,
+	.csiphy_2ph_status0_offset = 0x00C0,
+	.cphy_lane_status = {0x0358, 0x0758, 0x0B58},
+	.csiphy_3ph_status_size = 24,
+	.csiphy_2ph_status_size = 20,
+};
+
+struct csiphy_reg_t csiphy_lane_en_reg_2_2_1[] = {
+	{0x1014, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+};
+
+struct csiphy_reg_t csiphy_common_reg_2_2_1[] = {
+	{0x1084, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x101C, 0x7A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1018, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_enter_reg_2_2_1[] = {
+	{0x1000, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_exit_reg_2_2_1[] = {
+	{0x1000, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x1000, 0x00, 0x00, CSIPHY_2PH_COMBO_REGS},
+	{0x1000, 0x0E, 0xBE8, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_2_2_1[] = {
+	{0x102c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1030, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1034, 0xfb, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1038, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x103c, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1040, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1044, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1048, 0xef, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x104c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1050, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1054, 0xff, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_2_1_reg[] = {
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C94, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C5C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C60, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C64, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_2_1_combo_mode_reg[] = {
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0828, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x04, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_3ph_v2_2_1_reg[] = {
+	{0x02F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0xEF, 0xD3, CSIPHY_DEFAULT_PARAMS},
+	{0x06F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0xEF, 0xD3, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AFC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0xEF, 0xD3, CSIPHY_DEFAULT_PARAMS},
+	{0x0204, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0218, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x021C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0220, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0224, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0228, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x022C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0264, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0310, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0254, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0260, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0284, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0604, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0618, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x061C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0620, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0624, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0628, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x062C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0664, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0710, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0654, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0660, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0684, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AEC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A18, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A1C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A20, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A24, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A28, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A2C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A64, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B10, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0ABC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A54, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A60, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_80Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1F, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x02, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1F, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x02, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1F, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x02, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_100Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_200Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_300Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_350Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x8A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x8A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x8A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_400Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_500Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_600Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_700Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_800Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_900Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_1p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x58, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_1p2Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_1p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x45, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_1p7Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_2p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x2E, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_2p1Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_2p35Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_2p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x20, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x05, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x03, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_2p6Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_2p8Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_3p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x17, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_3p3Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_3p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x10, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_4p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0278, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0678, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A78, 0x0C, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_4p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x06, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x06, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x06, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x3D, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x2D, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x30, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_5p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0278, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0678, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A78, 0x82, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_5p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0278, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0678, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A78, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_221_6p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0294, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0278, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0288, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0668, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0694, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0678, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0688, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A68, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A94, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x80, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A78, 0x81, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A88, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x03, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x3F, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x33, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x37, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+static struct data_rate_reg_info_t data_rate_settings_2_2_1[] = {
+	{
+		/* ((80 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 182400000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_80Msps),
+		.data_rate_reg_array[0][0] = datarate_221_80Msps,
+		.data_rate_reg_array[1][0] = datarate_221_80Msps,
+		.data_rate_reg_array[2][0] = datarate_221_80Msps,
+		.data_rate_reg_array[3][0] = datarate_221_80Msps,
+		.data_rate_reg_array[4][0] = datarate_221_80Msps,
+		.data_rate_reg_array[5][0] = datarate_221_80Msps,
+		.data_rate_reg_array[6][0] = datarate_221_80Msps,
+		.data_rate_reg_array[7][0] = datarate_221_80Msps,
+	},
+	{
+		/* ((100 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 228000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_100Msps),
+		.data_rate_reg_array[0][0] = datarate_221_100Msps,
+		.data_rate_reg_array[1][0] = datarate_221_100Msps,
+		.data_rate_reg_array[2][0] = datarate_221_100Msps,
+		.data_rate_reg_array[3][0] = datarate_221_100Msps,
+		.data_rate_reg_array[4][0] = datarate_221_100Msps,
+		.data_rate_reg_array[5][0] = datarate_221_100Msps,
+		.data_rate_reg_array[6][0] = datarate_221_100Msps,
+		.data_rate_reg_array[7][0] = datarate_221_100Msps,
+	},
+	{
+		/* ((200 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 456000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_200Msps),
+		.data_rate_reg_array[0][0] = datarate_221_200Msps,
+		.data_rate_reg_array[1][0] = datarate_221_200Msps,
+		.data_rate_reg_array[2][0] = datarate_221_200Msps,
+		.data_rate_reg_array[3][0] = datarate_221_200Msps,
+		.data_rate_reg_array[4][0] = datarate_221_200Msps,
+		.data_rate_reg_array[5][0] = datarate_221_200Msps,
+		.data_rate_reg_array[6][0] = datarate_221_200Msps,
+		.data_rate_reg_array[7][0] = datarate_221_200Msps,
+	},
+	{
+		/* ((300 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 684000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_300Msps),
+		.data_rate_reg_array[0][0] = datarate_221_300Msps,
+		.data_rate_reg_array[1][0] = datarate_221_300Msps,
+		.data_rate_reg_array[2][0] = datarate_221_300Msps,
+		.data_rate_reg_array[3][0] = datarate_221_300Msps,
+		.data_rate_reg_array[4][0] = datarate_221_300Msps,
+		.data_rate_reg_array[5][0] = datarate_221_300Msps,
+		.data_rate_reg_array[6][0] = datarate_221_300Msps,
+		.data_rate_reg_array[7][0] = datarate_221_300Msps,
+	},
+	{
+		/* ((350 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 798000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_350Msps),
+		.data_rate_reg_array[0][0] = datarate_221_350Msps,
+		.data_rate_reg_array[1][0] = datarate_221_350Msps,
+		.data_rate_reg_array[2][0] = datarate_221_350Msps,
+		.data_rate_reg_array[3][0] = datarate_221_350Msps,
+		.data_rate_reg_array[4][0] = datarate_221_350Msps,
+		.data_rate_reg_array[5][0] = datarate_221_350Msps,
+		.data_rate_reg_array[6][0] = datarate_221_350Msps,
+		.data_rate_reg_array[7][0] = datarate_221_350Msps,
+	},
+	{
+		/* ((400 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 912000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_400Msps),
+		.data_rate_reg_array[0][0] = datarate_221_400Msps,
+		.data_rate_reg_array[1][0] = datarate_221_400Msps,
+		.data_rate_reg_array[2][0] = datarate_221_400Msps,
+		.data_rate_reg_array[3][0] = datarate_221_400Msps,
+		.data_rate_reg_array[4][0] = datarate_221_400Msps,
+		.data_rate_reg_array[5][0] = datarate_221_400Msps,
+		.data_rate_reg_array[6][0] = datarate_221_400Msps,
+		.data_rate_reg_array[7][0] = datarate_221_400Msps,
+	},
+	{
+		/* ((500 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1140000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_500Msps),
+		.data_rate_reg_array[0][0] = datarate_221_500Msps,
+		.data_rate_reg_array[1][0] = datarate_221_500Msps,
+		.data_rate_reg_array[2][0] = datarate_221_500Msps,
+		.data_rate_reg_array[3][0] = datarate_221_500Msps,
+		.data_rate_reg_array[4][0] = datarate_221_500Msps,
+		.data_rate_reg_array[5][0] = datarate_221_500Msps,
+		.data_rate_reg_array[6][0] = datarate_221_500Msps,
+		.data_rate_reg_array[7][0] = datarate_221_500Msps,
+	},
+	{
+		/* ((600 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1368000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_600Msps),
+		.data_rate_reg_array[0][0] = datarate_221_600Msps,
+		.data_rate_reg_array[1][0] = datarate_221_600Msps,
+		.data_rate_reg_array[2][0] = datarate_221_600Msps,
+		.data_rate_reg_array[3][0] = datarate_221_600Msps,
+		.data_rate_reg_array[4][0] = datarate_221_600Msps,
+		.data_rate_reg_array[5][0] = datarate_221_600Msps,
+		.data_rate_reg_array[6][0] = datarate_221_600Msps,
+		.data_rate_reg_array[7][0] = datarate_221_600Msps,
+	},
+	{
+		/* ((700 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1596000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_700Msps),
+		.data_rate_reg_array[0][0] = datarate_221_700Msps,
+		.data_rate_reg_array[1][0] = datarate_221_700Msps,
+		.data_rate_reg_array[2][0] = datarate_221_700Msps,
+		.data_rate_reg_array[3][0] = datarate_221_700Msps,
+		.data_rate_reg_array[4][0] = datarate_221_700Msps,
+		.data_rate_reg_array[5][0] = datarate_221_700Msps,
+		.data_rate_reg_array[6][0] = datarate_221_700Msps,
+		.data_rate_reg_array[7][0] = datarate_221_700Msps,
+	},
+	{
+		/* ((800 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1824000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_800Msps),
+		.data_rate_reg_array[0][0] = datarate_221_800Msps,
+		.data_rate_reg_array[1][0] = datarate_221_800Msps,
+		.data_rate_reg_array[2][0] = datarate_221_800Msps,
+		.data_rate_reg_array[3][0] = datarate_221_800Msps,
+		.data_rate_reg_array[4][0] = datarate_221_800Msps,
+		.data_rate_reg_array[5][0] = datarate_221_800Msps,
+		.data_rate_reg_array[6][0] = datarate_221_800Msps,
+		.data_rate_reg_array[7][0] = datarate_221_800Msps,
+	},
+	{
+		/* ((900 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 2052000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_900Msps),
+		.data_rate_reg_array[0][0] = datarate_221_900Msps,
+		.data_rate_reg_array[1][0] = datarate_221_900Msps,
+		.data_rate_reg_array[2][0] = datarate_221_900Msps,
+		.data_rate_reg_array[3][0] = datarate_221_900Msps,
+		.data_rate_reg_array[4][0] = datarate_221_900Msps,
+		.data_rate_reg_array[5][0] = datarate_221_900Msps,
+		.data_rate_reg_array[6][0] = datarate_221_900Msps,
+		.data_rate_reg_array[7][0] = datarate_221_900Msps,
+	},
+	{
+		/* ((1000 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 2280000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_1p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_1p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_1p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_1p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_1p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_1p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_1p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_1p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_1p0Gsps,
+	},
+	{
+		/* ((1.2 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 2736000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_1p2Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_1p2Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_1p2Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_1p2Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_1p2Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_1p2Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_1p2Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_1p2Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_1p2Gsps,
+	},
+	{
+		/* ((1.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 3420000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_1p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_1p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_1p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_1p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_1p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_1p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_1p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_1p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_1p5Gsps,
+	},
+	{
+		/* ((1.7 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 3876000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_1p7Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_1p7Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_1p7Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_1p7Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_1p7Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_1p7Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_1p7Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_1p7Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_1p7Gsps,
+	},
+	{
+		/* ((2.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 4560000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_2p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_2p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_2p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_2p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_2p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_2p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_2p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_2p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_2p0Gsps,
+	},
+	{
+		/* ((2.1 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 4788000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_2p1Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_2p1Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_2p1Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_2p1Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_2p1Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_2p1Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_2p1Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_2p1Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_2p1Gsps,
+	},
+	{
+		/* ((2.35 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5358000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_2p35Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_2p35Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_2p35Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_2p35Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_2p35Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_2p35Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_2p35Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_2p35Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_2p35Gsps,
+	},
+	{
+		/* ((2.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5700000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_2p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_2p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_2p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_2p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_2p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_2p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_2p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_2p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_2p5Gsps,
+	},
+	{
+		/* ((2.6 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5928000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_2p6Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_2p6Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_2p6Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_2p6Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_2p6Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_2p6Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_2p6Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_2p6Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_2p6Gsps,
+	},
+	{
+		/* ((2.8 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6384000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_2p8Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_2p8Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_2p8Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_2p8Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_2p8Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_2p8Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_2p8Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_2p8Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_2p8Gsps,
+	},
+	{
+		/* ((3.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6840000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_3p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_3p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_3p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_3p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_3p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_3p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_3p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_3p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_3p0Gsps,
+	},
+	{
+		/* ((3.3 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7524000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_3p3Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_3p3Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_3p3Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_3p3Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_3p3Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_3p3Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_3p3Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_3p3Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_3p3Gsps,
+	},
+	{
+		/* ((3.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7980000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_3p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_3p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_3p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_3p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_3p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_3p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_3p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_3p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_3p5Gsps,
+	},
+	{
+		/* ((4.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 9120000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_4p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_4p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_4p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_4p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_4p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_4p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_4p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_4p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_4p0Gsps,
+	},
+	{
+		/* ((4.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 10260000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_4p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_4p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_4p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_4p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_4p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_4p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_4p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_4p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_4p5Gsps,
+	},
+	{
+		/* ((5.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 11400000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_5p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_5p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_5p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_5p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_5p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_5p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_5p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_5p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_5p0Gsps,
+	},
+	{
+		/* ((5.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 12540000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_5p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_5p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_5p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_5p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_5p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_5p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_5p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_5p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_5p5Gsps,
+	},
+	{
+		/* ((6.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 13680000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_221_6p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_221_6p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_221_6p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_221_6p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_221_6p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_221_6p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_221_6p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_221_6p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_221_6p0Gsps,
+	},
+};
+
+struct csiphy_reg_t bist_3ph_arr_2_2_1[] = {
+	{0x0230, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0234, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0238, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x023C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0258, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02C8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0248, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x024C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0250, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x025C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0630, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0634, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0638, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x063C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0658, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06C8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0648, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x064C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0650, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x065C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A30, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A34, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A38, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A3C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A58, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AC8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A48, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A4C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A50, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A5C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t bist_status_arr_2_2_1[] = {
+	{0x0344, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0744, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0B44, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x00C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x04C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x08C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x0CC0, 0x00, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct bist_reg_settings_t bist_setting_2_2_1 = {
+	.error_status_val_3ph = 0x10,
+	.error_status_val_2ph = 0x10,
+	.set_status_update_3ph_base_offset = 0x0240,
+	.set_status_update_2ph_base_offset = 0x0050,
+	.bist_status_3ph_base_offset = 0x0344,
+	.bist_status_2ph_base_offset = 0x00C0,
+	.bist_sensor_data_3ph_status_base_offset = 0x0340,
+	.bist_counter_3ph_base_offset = 0x0348,
+	.bist_counter_2ph_base_offset = 0x00C8,
+	.number_of_counters = 2,
+	.num_3ph_bist_settings = ARRAY_SIZE(bist_3ph_arr_2_2_1),
+	.bist_3ph_settings_arry = bist_3ph_arr_2_2_1,
+	.bist_2ph_settings_arry = NULL,
+	.num_2ph_bist_settings = 0,
+	.num_status_reg = ARRAY_SIZE(bist_status_arr_2_2_1),
+	.bist_status_arr = bist_status_arr_2_2_1,
+};
+
+struct data_rate_settings_t data_rate_delta_table_2_2_1 = {
+	.num_data_rate_settings = ARRAY_SIZE(data_rate_settings_2_2_1),
+	.data_rate_settings = data_rate_settings_2_2_1,
+};
+
+struct csiphy_reg_parms_t csiphy_v2_2_1 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x10B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x1058,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x1028,
+	.size_offset_betn_lanes = 0x400,
+	.status_reg_params = &status_regs_2_2_1,
+	.csiphy_common_reg_array_size = ARRAY_SIZE(csiphy_common_reg_2_2_1),
+	.csiphy_reset_enter_array_size = ARRAY_SIZE(csiphy_reset_enter_reg_2_2_1),
+	.csiphy_reset_exit_array_size = ARRAY_SIZE(csiphy_reset_exit_reg_2_2_1),
+	.csiphy_2ph_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_2_1_reg),
+	.csiphy_3ph_config_array_size = ARRAY_SIZE(csiphy_3ph_v2_2_1_reg),
+	.csiphy_2ph_combo_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_2_1_combo_mode_reg),
+	.csiphy_3ph_combo_config_array_size = 0,
+	.csiphy_2ph_3ph_config_array_size = 0,
+	.csiphy_interrupt_status_size = ARRAY_SIZE(csiphy_irq_reg_2_2_1),
+	.csiphy_num_common_status_regs = 20,
+	.aon_sel_params = &aon_cam_select_params_2_2_1,
+};
+
+struct csiphy_ctrl_t ctrl_reg_2_2_1 = {
+	.csiphy_common_reg = csiphy_common_reg_2_2_1,
+	.csiphy_2ph_reg = csiphy_2ph_v2_2_1_reg,
+	.csiphy_3ph_reg = csiphy_3ph_v2_2_1_reg,
+	.csiphy_2ph_combo_mode_reg = csiphy_2ph_v2_2_1_combo_mode_reg,
+	.csiphy_3ph_combo_reg = NULL,
+	.csiphy_2ph_3ph_mode_reg = NULL,
+	.csiphy_reg = &csiphy_v2_2_1,
+	.csiphy_irq_reg = csiphy_irq_reg_2_2_1,
+	.csiphy_reset_enter_regs = csiphy_reset_enter_reg_2_2_1,
+	.csiphy_reset_exit_regs = csiphy_reset_exit_reg_2_2_1,
+	.csiphy_lane_config_reg = csiphy_lane_en_reg_2_2_1,
+	.data_rates_settings_table = &data_rate_delta_table_2_2_1,
+	.csiphy_bist_reg = &bist_setting_2_2_1,
+	.getclockvoting = get_clk_voting_dynamic,
+};
+
+#endif /* _CAM_CSIPHY_2_2_1_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_3_0_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_3_0_hwreg.h
@@ -0,0 +1,2209 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_2_3_0_HWREG_H_
+#define _CAM_CSIPHY_2_3_0_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct cam_csiphy_aon_sel_params_t aon_cam_select_params_2_3_0 = {
+	.aon_cam_sel_offset[0] = 0x01E0,
+	.aon_cam_sel_offset[1] = 0x01E4,
+	.cam_sel_mask = BIT(0),
+	.mclk_sel_mask = BIT(8),
+};
+
+struct cam_cphy_dphy_status_reg_params_t status_regs_2_3_0 = {
+	.csiphy_3ph_status0_offset = 0x0340,
+	.csiphy_2ph_status0_offset = 0x00C0,
+	.cphy_lane_status = {0x0358, 0x0758, 0x0B58},
+	.csiphy_3ph_status_size = 24,
+	.csiphy_2ph_status_size = 20,
+};
+
+struct csiphy_reg_t csiphy_lane_en_reg_2_3_0[] = {
+	{0x1014, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+};
+
+struct csiphy_reg_t csiphy_common_reg_2_3_0[] = {
+	{0x1084, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x108C, 0x00, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x101C, 0x7A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1018, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_enter_reg_2_3_0[] = {
+	{0x1000, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_exit_reg_2_3_0[] = {
+	{0x1000, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x1000, 0x00, 0x00, CSIPHY_2PH_COMBO_REGS},
+	{0x1000, 0x0E, 0xBE8, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_2_3_0[] = {
+	{0x102c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1030, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1034, 0xfb, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1038, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x103c, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1040, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1044, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1048, 0xef, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x104c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1050, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1054, 0xff, 0x64, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_3_0_reg[] = {
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C94, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C5C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C60, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0C64, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_3_0_combo_mode_reg[] = {
+	{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E90, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0090, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0490, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0494, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0890, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0894, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C90, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C94, 0x07, 0xD1, CSIPHY_DEFAULT_PARAMS},
+	{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0E08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0000, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0008, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0400, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0408, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0828, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0808, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C00, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C28, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0C08, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0094, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0060, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0494, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0460, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+	{0x0894, 0xD7, 0x00, CSIPHY_SKEW_CAL},
+	{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+	{0x0860, 0xBD, 0x00, CSIPHY_SKEW_CAL},
+	{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+};
+
+struct csiphy_reg_t csiphy_3ph_v2_3_0_reg[] = {
+	{0x02F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02F0, 0xEF, 0xD3, CSIPHY_DEFAULT_PARAMS},
+	{0x06F4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06FC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06F0, 0xEF, 0xD3, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF8, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AFC, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AF0, 0xEF, 0xD3, CSIPHY_DEFAULT_PARAMS},
+	{0x0204, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0218, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x021C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0220, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0224, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0228, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x022C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0264, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0310, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0254, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0260, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0284, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0290, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0604, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0618, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x061C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0620, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0624, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0628, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x062C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0664, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0710, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06BC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0654, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0660, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0684, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0690, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AE8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AEC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A18, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A1C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A20, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A24, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A28, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A2C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A64, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB2, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0B10, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0ABC, 0xD0, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A54, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A60, 0xA8, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A90, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_80Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1F, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x02, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1F, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x02, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1F, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x02, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_100Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x00, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x00, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0xB6, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x01, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x6B, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_200Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0xE4, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_300Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x9E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_350Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x8A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x8A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x8A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_400Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x7B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_500Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x08, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x01, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x66, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_600Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x58, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_700Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x4E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_800Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x46, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_900Msps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x40, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_1p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x12, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x22, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x0A, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x3C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_1p2Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x35, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_1p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x2E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_1p7Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x2A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x09, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_2p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x27, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_2p1Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x26, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_2p35Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x23, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_2p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x1C, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x42, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x3C, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_2p6Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x22, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_2p8Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x21, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_3p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x20, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_3p3Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_3p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_4p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0278, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0678, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A78, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_STANDARD_CHANNEL_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1C, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_4p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x26, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x64, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0F, 0x00, CSIPHY_CDR_LN_SETTINGS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1B, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_5p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x36, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x36, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x66, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x66, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0A, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x36, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x36, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x66, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x66, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0A, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x36, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x36, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x66, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x66, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0A, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x1A, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_5p5Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x36, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x36, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x66, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x66, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0A, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x36, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x36, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x66, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x66, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0A, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x36, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x36, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x66, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x66, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0A, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t datarate_230_6p0Gsps[] = {
+	/* AFE Settings */
+	{0x0268, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0288, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x026C, 0x36, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x026C, 0x36, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x028C, 0x66, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x028C, 0x66, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0294, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0270, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0274, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0278, 0x0A, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0668, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0688, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x066C, 0x36, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x066C, 0x36, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x068C, 0x66, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x068C, 0x66, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0694, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0670, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0674, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0678, 0x0A, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A68, 0xF1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A88, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A6C, 0x36, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A6C, 0x36, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A8C, 0x66, 0x00, CSIPHY_SHORT_CHANNEL_PARAMS},
+	{0x0A8C, 0x66, 0x00, CSIPHY_STANDARD_CHANNEL_PARAMS},
+	{0x0A94, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A70, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A74, 0x00, 0x0A, CSIPHY_DEFAULT_PARAMS},
+	{0x0A78, 0x0A, 0x00, CSIPHY_CDR_LN_SETTINGS | CSIPHY_SHORT_CHANNEL_PARAMS},
+	/* Datarate Sensitive */
+	{0x020C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0210, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0214, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x060C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0610, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0614, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A0C, 0x19, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+	{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+	{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A14, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+static struct data_rate_reg_info_t data_rate_settings_2_3_0[] = {
+	{
+		/* ((80 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 182400000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_80Msps),
+		.data_rate_reg_array[0][0] = datarate_230_80Msps,
+		.data_rate_reg_array[1][0] = datarate_230_80Msps,
+		.data_rate_reg_array[2][0] = datarate_230_80Msps,
+		.data_rate_reg_array[3][0] = datarate_230_80Msps,
+		.data_rate_reg_array[4][0] = datarate_230_80Msps,
+		.data_rate_reg_array[5][0] = datarate_230_80Msps,
+		.data_rate_reg_array[6][0] = datarate_230_80Msps,
+		.data_rate_reg_array[7][0] = datarate_230_80Msps,
+	},
+	{
+		/* ((100 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 228000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_100Msps),
+		.data_rate_reg_array[0][0] = datarate_230_100Msps,
+		.data_rate_reg_array[1][0] = datarate_230_100Msps,
+		.data_rate_reg_array[2][0] = datarate_230_100Msps,
+		.data_rate_reg_array[3][0] = datarate_230_100Msps,
+		.data_rate_reg_array[4][0] = datarate_230_100Msps,
+		.data_rate_reg_array[5][0] = datarate_230_100Msps,
+		.data_rate_reg_array[6][0] = datarate_230_100Msps,
+		.data_rate_reg_array[7][0] = datarate_230_100Msps,
+	},
+	{
+		/* ((200 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 456000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_200Msps),
+		.data_rate_reg_array[0][0] = datarate_230_200Msps,
+		.data_rate_reg_array[1][0] = datarate_230_200Msps,
+		.data_rate_reg_array[2][0] = datarate_230_200Msps,
+		.data_rate_reg_array[3][0] = datarate_230_200Msps,
+		.data_rate_reg_array[4][0] = datarate_230_200Msps,
+		.data_rate_reg_array[5][0] = datarate_230_200Msps,
+		.data_rate_reg_array[6][0] = datarate_230_200Msps,
+		.data_rate_reg_array[7][0] = datarate_230_200Msps,
+	},
+	{
+		/* ((300 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 684000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_300Msps),
+		.data_rate_reg_array[0][0] = datarate_230_300Msps,
+		.data_rate_reg_array[1][0] = datarate_230_300Msps,
+		.data_rate_reg_array[2][0] = datarate_230_300Msps,
+		.data_rate_reg_array[3][0] = datarate_230_300Msps,
+		.data_rate_reg_array[4][0] = datarate_230_300Msps,
+		.data_rate_reg_array[5][0] = datarate_230_300Msps,
+		.data_rate_reg_array[6][0] = datarate_230_300Msps,
+		.data_rate_reg_array[7][0] = datarate_230_300Msps,
+	},
+	{
+		/* ((350 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 798000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_350Msps),
+		.data_rate_reg_array[0][0] = datarate_230_350Msps,
+		.data_rate_reg_array[1][0] = datarate_230_350Msps,
+		.data_rate_reg_array[2][0] = datarate_230_350Msps,
+		.data_rate_reg_array[3][0] = datarate_230_350Msps,
+		.data_rate_reg_array[4][0] = datarate_230_350Msps,
+		.data_rate_reg_array[5][0] = datarate_230_350Msps,
+		.data_rate_reg_array[6][0] = datarate_230_350Msps,
+		.data_rate_reg_array[7][0] = datarate_230_350Msps,
+	},
+	{
+		/* ((400 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 912000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_400Msps),
+		.data_rate_reg_array[0][0] = datarate_230_400Msps,
+		.data_rate_reg_array[1][0] = datarate_230_400Msps,
+		.data_rate_reg_array[2][0] = datarate_230_400Msps,
+		.data_rate_reg_array[3][0] = datarate_230_400Msps,
+		.data_rate_reg_array[4][0] = datarate_230_400Msps,
+		.data_rate_reg_array[5][0] = datarate_230_400Msps,
+		.data_rate_reg_array[6][0] = datarate_230_400Msps,
+		.data_rate_reg_array[7][0] = datarate_230_400Msps,
+	},
+	{
+		/* ((500 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1140000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_500Msps),
+		.data_rate_reg_array[0][0] = datarate_230_500Msps,
+		.data_rate_reg_array[1][0] = datarate_230_500Msps,
+		.data_rate_reg_array[2][0] = datarate_230_500Msps,
+		.data_rate_reg_array[3][0] = datarate_230_500Msps,
+		.data_rate_reg_array[4][0] = datarate_230_500Msps,
+		.data_rate_reg_array[5][0] = datarate_230_500Msps,
+		.data_rate_reg_array[6][0] = datarate_230_500Msps,
+		.data_rate_reg_array[7][0] = datarate_230_500Msps,
+	},
+	{
+		/* ((600 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1368000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_600Msps),
+		.data_rate_reg_array[0][0] = datarate_230_600Msps,
+		.data_rate_reg_array[1][0] = datarate_230_600Msps,
+		.data_rate_reg_array[2][0] = datarate_230_600Msps,
+		.data_rate_reg_array[3][0] = datarate_230_600Msps,
+		.data_rate_reg_array[4][0] = datarate_230_600Msps,
+		.data_rate_reg_array[5][0] = datarate_230_600Msps,
+		.data_rate_reg_array[6][0] = datarate_230_600Msps,
+		.data_rate_reg_array[7][0] = datarate_230_600Msps,
+	},
+	{
+		/* ((700 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1596000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_700Msps),
+		.data_rate_reg_array[0][0] = datarate_230_700Msps,
+		.data_rate_reg_array[1][0] = datarate_230_700Msps,
+		.data_rate_reg_array[2][0] = datarate_230_700Msps,
+		.data_rate_reg_array[3][0] = datarate_230_700Msps,
+		.data_rate_reg_array[4][0] = datarate_230_700Msps,
+		.data_rate_reg_array[5][0] = datarate_230_700Msps,
+		.data_rate_reg_array[6][0] = datarate_230_700Msps,
+		.data_rate_reg_array[7][0] = datarate_230_700Msps,
+	},
+	{
+		/* ((800 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 1824000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_800Msps),
+		.data_rate_reg_array[0][0] = datarate_230_800Msps,
+		.data_rate_reg_array[1][0] = datarate_230_800Msps,
+		.data_rate_reg_array[2][0] = datarate_230_800Msps,
+		.data_rate_reg_array[3][0] = datarate_230_800Msps,
+		.data_rate_reg_array[4][0] = datarate_230_800Msps,
+		.data_rate_reg_array[5][0] = datarate_230_800Msps,
+		.data_rate_reg_array[6][0] = datarate_230_800Msps,
+		.data_rate_reg_array[7][0] = datarate_230_800Msps,
+	},
+	{
+		/* ((900 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 2052000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_900Msps),
+		.data_rate_reg_array[0][0] = datarate_230_900Msps,
+		.data_rate_reg_array[1][0] = datarate_230_900Msps,
+		.data_rate_reg_array[2][0] = datarate_230_900Msps,
+		.data_rate_reg_array[3][0] = datarate_230_900Msps,
+		.data_rate_reg_array[4][0] = datarate_230_900Msps,
+		.data_rate_reg_array[5][0] = datarate_230_900Msps,
+		.data_rate_reg_array[6][0] = datarate_230_900Msps,
+		.data_rate_reg_array[7][0] = datarate_230_900Msps,
+	},
+	{
+		/* ((1000 MSpS) * (10^6) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 2280000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_1p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_1p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_1p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_1p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_1p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_1p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_1p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_1p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_1p0Gsps,
+	},
+	{
+		/* ((1.2 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 2736000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_1p2Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_1p2Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_1p2Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_1p2Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_1p2Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_1p2Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_1p2Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_1p2Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_1p2Gsps,
+	},
+	{
+		/* ((1.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 3420000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_1p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_1p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_1p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_1p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_1p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_1p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_1p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_1p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_1p5Gsps,
+	},
+	{
+		/* ((1.7 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 3876000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_1p7Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_1p7Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_1p7Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_1p7Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_1p7Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_1p7Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_1p7Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_1p7Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_1p7Gsps,
+	},
+	{
+		/* ((2.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 4560000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_2p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_2p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_2p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_2p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_2p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_2p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_2p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_2p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_2p0Gsps,
+	},
+	{
+		/* ((2.1 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 4788000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_2p1Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_2p1Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_2p1Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_2p1Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_2p1Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_2p1Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_2p1Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_2p1Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_2p1Gsps,
+	},
+	{
+		/* ((2.35 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5358000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_2p35Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_2p35Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_2p35Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_2p35Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_2p35Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_2p35Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_2p35Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_2p35Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_2p35Gsps,
+	},
+	{
+		/* ((2.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5700000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_2p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_2p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_2p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_2p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_2p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_2p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_2p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_2p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_2p5Gsps,
+	},
+	{
+		/* ((2.6 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 5928000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_2p6Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_2p6Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_2p6Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_2p6Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_2p6Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_2p6Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_2p6Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_2p6Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_2p6Gsps,
+	},
+	{
+		/* ((2.8 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6384000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_2p8Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_2p8Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_2p8Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_2p8Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_2p8Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_2p8Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_2p8Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_2p8Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_2p8Gsps,
+	},
+	{
+		/* ((3.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 6840000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_3p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_3p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_3p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_3p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_3p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_3p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_3p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_3p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_3p0Gsps,
+	},
+	{
+		/* ((3.3 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7524000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_3p3Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_3p3Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_3p3Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_3p3Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_3p3Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_3p3Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_3p3Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_3p3Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_3p3Gsps,
+	},
+	{
+		/* ((3.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 7980000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_3p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_3p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_3p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_3p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_3p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_3p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_3p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_3p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_3p5Gsps,
+	},
+	{
+		/* ((4.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 9120000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_4p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_4p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_4p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_4p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_4p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_4p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_4p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_4p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_4p0Gsps,
+	},
+	{
+		/* ((4.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 10260000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_4p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_4p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_4p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_4p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_4p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_4p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_4p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_4p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_4p5Gsps,
+	},
+	{
+		/* ((5.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 11400000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_5p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_5p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_5p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_5p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_5p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_5p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_5p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_5p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_5p0Gsps,
+	},
+	{
+		/* ((5.5 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 12540000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_5p5Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_5p5Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_5p5Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_5p5Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_5p5Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_5p5Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_5p5Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_5p5Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_5p5Gsps,
+	},
+	{
+		/* ((6.0 GSpS) * (10^9) * (2.28 bits/symbol)) rounded value */
+		.bandwidth = 13680000000,
+		.data_rate_reg_array_size = ARRAY_SIZE(datarate_230_6p0Gsps),
+		.data_rate_reg_array[0][0] = datarate_230_6p0Gsps,
+		.data_rate_reg_array[1][0] = datarate_230_6p0Gsps,
+		.data_rate_reg_array[2][0] = datarate_230_6p0Gsps,
+		.data_rate_reg_array[3][0] = datarate_230_6p0Gsps,
+		.data_rate_reg_array[4][0] = datarate_230_6p0Gsps,
+		.data_rate_reg_array[5][0] = datarate_230_6p0Gsps,
+		.data_rate_reg_array[6][0] = datarate_230_6p0Gsps,
+		.data_rate_reg_array[7][0] = datarate_230_6p0Gsps,
+	},
+};
+
+struct csiphy_reg_t bist_3ph_arr_2_3_0[] = {
+	{0x0230, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0234, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0238, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x023C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0258, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02C8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x02D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0248, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x024C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0250, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0244, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x025C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0240, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0630, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0634, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0638, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x063C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0658, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06C8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x06D8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0648, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x064C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0650, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0644, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x065C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0640, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A30, 0x1C, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A34, 0xFA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A38, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A3C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A58, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AC8, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD0, 0xAA, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD4, 0x64, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0AD8, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A48, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A4C, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A50, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A44, 0xB1, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A5C, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0A40, 0x85, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t bist_status_arr_2_3_0[] = {
+	{0x0344, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0744, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x0B44, 0x00, 0x00, CSIPHY_3PH_REGS},
+	{0x00C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x04C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x08C0, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x0CC0, 0x00, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct bist_reg_settings_t bist_setting_2_3_0 = {
+	.error_status_val_3ph = 0x10,
+	.error_status_val_2ph = 0x10,
+	.set_status_update_3ph_base_offset = 0x0240,
+	.set_status_update_2ph_base_offset = 0x0050,
+	.bist_status_3ph_base_offset = 0x0344,
+	.bist_status_2ph_base_offset = 0x00C0,
+	.bist_sensor_data_3ph_status_base_offset = 0x0340,
+	.bist_counter_3ph_base_offset = 0x0348,
+	.bist_counter_2ph_base_offset = 0x00C8,
+	.number_of_counters = 2,
+	.num_3ph_bist_settings = ARRAY_SIZE(bist_3ph_arr_2_3_0),
+	.bist_3ph_settings_arry = bist_3ph_arr_2_3_0,
+	.bist_2ph_settings_arry = NULL,
+	.num_2ph_bist_settings = 0,
+	.num_status_reg = ARRAY_SIZE(bist_status_arr_2_3_0),
+	.bist_status_arr = bist_status_arr_2_3_0,
+};
+
+struct data_rate_settings_t data_rate_delta_table_2_3_0 = {
+	.num_data_rate_settings = ARRAY_SIZE(data_rate_settings_2_3_0),
+	.data_rate_settings = data_rate_settings_2_3_0,
+};
+
+struct csiphy_reg_parms_t csiphy_v2_3_0 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x10B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x1058,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x1028,
+	.size_offset_betn_lanes = 0x400,
+	.status_reg_params = &status_regs_2_3_0,
+	.csiphy_common_reg_array_size = ARRAY_SIZE(csiphy_common_reg_2_3_0),
+	.csiphy_reset_enter_array_size = ARRAY_SIZE(csiphy_reset_enter_reg_2_3_0),
+	.csiphy_reset_exit_array_size = ARRAY_SIZE(csiphy_reset_exit_reg_2_3_0),
+	.csiphy_2ph_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_3_0_reg),
+	.csiphy_3ph_config_array_size = ARRAY_SIZE(csiphy_3ph_v2_3_0_reg),
+	.csiphy_2ph_combo_config_array_size = ARRAY_SIZE(csiphy_2ph_v2_3_0_combo_mode_reg),
+	.csiphy_3ph_combo_config_array_size = 0,
+	.csiphy_2ph_3ph_config_array_size = 0,
+	.csiphy_interrupt_status_size = ARRAY_SIZE(csiphy_irq_reg_2_3_0),
+	.csiphy_num_common_status_regs = 20,
+	.aon_sel_params = &aon_cam_select_params_2_3_0,
+};
+
+struct csiphy_ctrl_t ctrl_reg_2_3_0 = {
+	.csiphy_common_reg = csiphy_common_reg_2_3_0,
+	.csiphy_2ph_reg = csiphy_2ph_v2_3_0_reg,
+	.csiphy_3ph_reg = csiphy_3ph_v2_3_0_reg,
+	.csiphy_2ph_combo_mode_reg = csiphy_2ph_v2_3_0_combo_mode_reg,
+	.csiphy_3ph_combo_reg = NULL,
+	.csiphy_2ph_3ph_mode_reg = NULL,
+	.csiphy_reg = &csiphy_v2_3_0,
+	.csiphy_irq_reg = csiphy_irq_reg_2_3_0,
+	.csiphy_reset_enter_regs = csiphy_reset_enter_reg_2_3_0,
+	.csiphy_reset_exit_regs = csiphy_reset_exit_reg_2_3_0,
+	.csiphy_lane_config_reg = csiphy_lane_en_reg_2_3_0,
+	.data_rates_settings_table = &data_rate_delta_table_2_3_0,
+	.csiphy_bist_reg = &bist_setting_2_3_0,
+	.getclockvoting = get_clk_voting_dynamic,
+};
+
+#endif /* _CAM_CSIPHY_2_3_0_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
@@ -0,0 +1,1565 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/crc32.h>
+#include <media/cam_sensor.h>
+
+#include "cam_eeprom_core.h"
+#include "cam_eeprom_soc.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+
+#define MAX_READ_SIZE  0x7FFFF
+
+/**
+ * cam_eeprom_read_memory() - read map data into buffer
+ * @e_ctrl:     eeprom control struct
+ * @block:      block to be read
+ *
+ * This function iterates through blocks stored in block->map, reads each
+ * region and concatenate them into the pre-allocated block->mapdata
+ */
+static int cam_eeprom_read_memory(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_eeprom_memory_block_t *block)
+{
+	int                                rc = 0;
+	int                                j;
+	struct cam_sensor_i2c_reg_setting  i2c_reg_settings = {0};
+	struct cam_sensor_i2c_reg_array    i2c_reg_array = {0};
+	struct cam_eeprom_memory_map_t    *emap = block->map;
+	struct cam_eeprom_soc_private     *eb_info = NULL;
+	uint8_t                           *memptr = block->mapdata;
+
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "e_ctrl is NULL");
+		return -EINVAL;
+	}
+
+	eb_info = (struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+
+	for (j = 0; j < block->num_map; j++) {
+		CAM_DBG(CAM_EEPROM, "slave-addr = 0x%X", emap[j].saddr);
+		if (emap[j].saddr) {
+			eb_info->i2c_info.slave_addr = emap[j].saddr;
+			rc = cam_eeprom_update_i2c_info(e_ctrl,
+				&eb_info->i2c_info);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM,
+					"failed: to update i2c info rc %d",
+					rc);
+				return rc;
+			}
+		}
+
+		if (emap[j].page.valid_size) {
+			i2c_reg_settings.addr_type = emap[j].page.addr_type;
+			i2c_reg_settings.data_type = emap[j].page.data_type;
+			i2c_reg_settings.size = 1;
+			i2c_reg_array.reg_addr = emap[j].page.addr;
+			i2c_reg_array.reg_data = emap[j].page.data;
+			i2c_reg_array.delay = emap[j].page.delay;
+			i2c_reg_settings.reg_setting = &i2c_reg_array;
+			rc = camera_io_dev_write(&e_ctrl->io_master_info,
+				&i2c_reg_settings);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM, "page write failed rc %d",
+					rc);
+				return rc;
+			}
+		}
+
+		if (emap[j].pageen.valid_size) {
+			i2c_reg_settings.addr_type = emap[j].pageen.addr_type;
+			i2c_reg_settings.data_type = emap[j].pageen.data_type;
+			i2c_reg_settings.size = 1;
+			i2c_reg_array.reg_addr = emap[j].pageen.addr;
+			i2c_reg_array.reg_data = emap[j].pageen.data;
+			i2c_reg_array.delay = emap[j].pageen.delay;
+			i2c_reg_settings.reg_setting = &i2c_reg_array;
+			rc = camera_io_dev_write(&e_ctrl->io_master_info,
+				&i2c_reg_settings);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM, "page enable failed rc %d",
+					rc);
+				return rc;
+			}
+		}
+
+		if (emap[j].poll.valid_size) {
+			rc = camera_io_dev_poll(&e_ctrl->io_master_info,
+				emap[j].poll.addr, emap[j].poll.data,
+				0, emap[j].poll.addr_type,
+				emap[j].poll.data_type,
+				emap[j].poll.delay);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM, "poll failed rc %d",
+					rc);
+				return rc;
+			}
+		}
+
+		if (emap[j].mem.valid_size) {
+			rc = camera_io_dev_read_seq(&e_ctrl->io_master_info,
+				emap[j].mem.addr, memptr,
+				emap[j].mem.addr_type,
+				emap[j].mem.data_type,
+				emap[j].mem.valid_size);
+			if (rc < 0) {
+				CAM_ERR(CAM_EEPROM, "read failed rc %d",
+					rc);
+				return rc;
+			}
+			memptr += emap[j].mem.valid_size;
+		}
+
+		if (emap[j].pageen.valid_size) {
+			i2c_reg_settings.addr_type = emap[j].pageen.addr_type;
+			i2c_reg_settings.data_type = emap[j].pageen.data_type;
+			i2c_reg_settings.size = 1;
+			i2c_reg_array.reg_addr = emap[j].pageen.addr;
+			i2c_reg_array.reg_data = 0;
+			i2c_reg_array.delay = emap[j].pageen.delay;
+			i2c_reg_settings.reg_setting = &i2c_reg_array;
+			rc = camera_io_dev_write(&e_ctrl->io_master_info,
+				&i2c_reg_settings);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM,
+					"page disable failed rc %d",
+					rc);
+				return rc;
+			}
+		}
+	}
+	return rc;
+}
+
+/**
+ * cam_eeprom_power_up - Power up eeprom hardware
+ * @e_ctrl:     ctrl structure
+ * @power_info: power up/down info for eeprom
+ *
+ * Returns success or failure
+ */
+static int cam_eeprom_power_up(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int32_t                                 rc = 0;
+	struct cam_hw_soc_info                 *soc_info = &e_ctrl->soc_info;
+	struct completion                      *i3c_probe_completion = NULL;
+
+	/* Parse and fill vreg params for power up settings */
+	rc = msm_camera_fill_vreg_params(
+		&e_ctrl->soc_info,
+		power_info->power_setting,
+		power_info->power_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM,
+			"failed to fill power up vreg params rc:%d", rc);
+		return rc;
+	}
+
+	/* Parse and fill vreg params for power down settings*/
+	rc = msm_camera_fill_vreg_params(
+		&e_ctrl->soc_info,
+		power_info->power_down_setting,
+		power_info->power_down_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM,
+			"failed to fill power down vreg params  rc:%d", rc);
+		return rc;
+	}
+
+	power_info->dev = soc_info->dev;
+
+	if (e_ctrl->io_master_info.master_type == I3C_MASTER)
+		i3c_probe_completion = cam_eeprom_get_i3c_completion(e_ctrl->soc_info.index);
+
+	rc = cam_sensor_core_power_up(power_info, soc_info, i3c_probe_completion);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed in eeprom power up rc %d", rc);
+		return rc;
+	}
+
+	rc = camera_io_init(&(e_ctrl->io_master_info));
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "cci_init failed");
+		goto cci_failure;
+	}
+
+	return rc;
+cci_failure:
+	if (cam_sensor_util_power_down(power_info, soc_info))
+		CAM_ERR(CAM_EEPROM, "Power down failure");
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_power_down - Power down eeprom hardware
+ * @e_ctrl:    ctrl structure
+ *
+ * Returns success or failure
+ */
+static int cam_eeprom_power_down(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	struct cam_sensor_power_ctrl_t *power_info;
+	struct cam_hw_soc_info         *soc_info;
+	struct cam_eeprom_soc_private  *soc_private;
+	int                             rc = 0;
+
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "failed: e_ctrl %pK", e_ctrl);
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+	soc_info = &e_ctrl->soc_info;
+
+	if (!power_info) {
+		CAM_ERR(CAM_EEPROM, "failed: power_info %pK", power_info);
+		return -EINVAL;
+	}
+	rc = cam_sensor_util_power_down(power_info, soc_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "power down the core is failed:%d", rc);
+		return rc;
+	}
+
+	camera_io_release(&(e_ctrl->io_master_info));
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_match_id - match eeprom id
+ * @e_ctrl:     ctrl structure
+ *
+ * Returns success or failure
+ */
+static int cam_eeprom_match_id(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int                      rc;
+	struct camera_io_master *client = &e_ctrl->io_master_info;
+	uint8_t                  id[2];
+
+	rc = cam_spi_query_id(client, 0, CAMERA_SENSOR_I2C_TYPE_WORD,
+		&id[0], 2);
+	if (rc)
+		return rc;
+	CAM_DBG(CAM_EEPROM, "read 0x%x 0x%x, check 0x%x 0x%x",
+		id[0], id[1], client->spi_client->mfr_id0,
+		client->spi_client->device_id0);
+	if (id[0] != client->spi_client->mfr_id0
+		|| id[1] != client->spi_client->device_id0)
+		return -ENODEV;
+	return 0;
+}
+
+/**
+ * cam_eeprom_parse_read_memory_map - Parse memory map
+ * @of_node:    device node
+ * @e_ctrl:     ctrl structure
+ *
+ * Returns success or failure
+ */
+int32_t cam_eeprom_parse_read_memory_map(struct device_node *of_node,
+	struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int32_t                         rc = 0;
+	struct cam_eeprom_soc_private  *soc_private;
+	struct cam_sensor_power_ctrl_t *power_info;
+
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "failed: e_ctrl is NULL");
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	rc = cam_eeprom_parse_dt_memory_map(of_node, &e_ctrl->cal_data);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: eeprom dt parse rc %d", rc);
+		return rc;
+	}
+	rc = cam_eeprom_power_up(e_ctrl, power_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: eeprom power up rc %d", rc);
+		goto data_mem_free;
+	}
+
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_CONFIG;
+	if (e_ctrl->eeprom_device_type == MSM_CAMERA_SPI_DEVICE) {
+		rc = cam_eeprom_match_id(e_ctrl);
+		if (rc) {
+			CAM_DBG(CAM_EEPROM, "eeprom not matching %d", rc);
+			goto power_down;
+		}
+	}
+	rc = cam_eeprom_read_memory(e_ctrl, &e_ctrl->cal_data);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "read_eeprom_memory failed");
+		goto power_down;
+	}
+
+	rc = cam_eeprom_power_down(e_ctrl);
+	if (rc)
+		CAM_ERR(CAM_EEPROM, "failed: eeprom power down rc %d", rc);
+
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+	return rc;
+power_down:
+	cam_eeprom_power_down(e_ctrl);
+data_mem_free:
+	vfree(e_ctrl->cal_data.mapdata);
+	vfree(e_ctrl->cal_data.map);
+	e_ctrl->cal_data.num_data = 0;
+	e_ctrl->cal_data.num_map = 0;
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+	return rc;
+}
+
+/**
+ * cam_eeprom_get_dev_handle - get device handle
+ * @e_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_get_dev_handle(struct cam_eeprom_ctrl_t *e_ctrl,
+	void *arg)
+{
+	struct cam_sensor_acquire_dev    eeprom_acq_dev;
+	struct cam_create_dev_hdl        bridge_params;
+	struct cam_control              *cmd = (struct cam_control *)arg;
+
+	if (e_ctrl->bridge_intf.device_hdl != -1) {
+		CAM_ERR(CAM_EEPROM, "Device is already acquired");
+		return -EFAULT;
+	}
+	if (copy_from_user(&eeprom_acq_dev,
+		u64_to_user_ptr(cmd->handle),
+		sizeof(eeprom_acq_dev))) {
+		CAM_ERR(CAM_EEPROM,
+			"EEPROM:ACQUIRE_DEV: copy from user failed");
+		return -EFAULT;
+	}
+
+	bridge_params.session_hdl = eeprom_acq_dev.session_handle;
+	bridge_params.ops = &e_ctrl->bridge_intf.ops;
+	bridge_params.v4l2_sub_dev_flag = 0;
+	bridge_params.media_entity_flag = 0;
+	bridge_params.priv = e_ctrl;
+	bridge_params.dev_id = CAM_EEPROM;
+
+	eeprom_acq_dev.device_handle =
+		cam_create_device_hdl(&bridge_params);
+	if (eeprom_acq_dev.device_handle <= 0) {
+		CAM_ERR(CAM_EEPROM, "Can not create device handle");
+		return -EFAULT;
+	}
+	e_ctrl->bridge_intf.device_hdl = eeprom_acq_dev.device_handle;
+	e_ctrl->bridge_intf.session_hdl = eeprom_acq_dev.session_handle;
+
+	CAM_DBG(CAM_EEPROM, "Device Handle: %d", eeprom_acq_dev.device_handle);
+	if (copy_to_user(u64_to_user_ptr(cmd->handle),
+		&eeprom_acq_dev, sizeof(struct cam_sensor_acquire_dev))) {
+		CAM_ERR(CAM_EEPROM, "EEPROM:ACQUIRE_DEV: copy to user failed");
+		return -EFAULT;
+	}
+	return 0;
+}
+
+/**
+ * cam_eeprom_update_slaveInfo - Update slave info
+ * @e_ctrl:     ctrl structure
+ * @cmd_buf:    command buffer
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_update_slaveInfo(struct cam_eeprom_ctrl_t *e_ctrl,
+	void *cmd_buf)
+{
+	int32_t                         rc = 0;
+	struct cam_eeprom_soc_private  *soc_private;
+	struct cam_cmd_i2c_info        *cmd_i2c_info = NULL;
+
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	cmd_i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+	soc_private->i2c_info.slave_addr = cmd_i2c_info->slave_addr;
+	soc_private->i2c_info.i2c_freq_mode = cmd_i2c_info->i2c_freq_mode;
+
+	rc = cam_eeprom_update_i2c_info(e_ctrl,
+		&soc_private->i2c_info);
+	CAM_DBG(CAM_EEPROM, "Slave addr: 0x%x Freq Mode: %d",
+		soc_private->i2c_info.slave_addr,
+		soc_private->i2c_info.i2c_freq_mode);
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_parse_memory_map - Parse memory map info
+ * @data:             memory block data
+ * @cmd_buf:          command buffer
+ * @cmd_length:       command buffer length
+ * @num_map:          memory map size
+ * @cmd_length_bytes: command length processed in this function
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_parse_memory_map(
+	struct cam_eeprom_memory_block_t *data,
+	void *cmd_buf, int cmd_length, uint32_t *cmd_length_bytes,
+	int *num_map, size_t remain_buf_len)
+{
+	int32_t                            rc = 0;
+	int32_t                            cnt = 0;
+	int32_t                            processed_size = 0;
+	int32_t                            payload_count;
+	uint8_t                            generic_op_code;
+	struct cam_eeprom_memory_map_t    *map = data->map;
+	struct common_header              *cmm_hdr =
+		(struct common_header *)cmd_buf;
+	uint16_t                           cmd_length_in_bytes = 0;
+	struct cam_cmd_i2c_random_wr      *i2c_random_wr = NULL;
+	struct cam_cmd_i2c_continuous_rd  *i2c_cont_rd = NULL;
+	struct cam_cmd_conditional_wait   *i2c_poll = NULL;
+	struct cam_cmd_unconditional_wait *i2c_uncond_wait = NULL;
+	size_t                             validate_size = 0;
+
+	generic_op_code = cmm_hdr->fifth_byte;
+
+	if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR)
+		validate_size = sizeof(struct cam_cmd_i2c_random_wr);
+	else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD)
+		validate_size = sizeof(struct cam_cmd_i2c_continuous_rd);
+	else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)
+		validate_size = sizeof(struct cam_cmd_unconditional_wait);
+
+	if (remain_buf_len < validate_size ||
+	    *num_map >= (MSM_EEPROM_MAX_MEM_MAP_CNT *
+		MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) {
+		CAM_ERR(CAM_EEPROM, "not enough buffer");
+		return -EINVAL;
+	}
+	switch (cmm_hdr->cmd_type) {
+	case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR:
+		i2c_random_wr = (struct cam_cmd_i2c_random_wr *)cmd_buf;
+		payload_count = i2c_random_wr->header.count;
+
+		if (payload_count == 0 ||
+		    payload_count >= MSM_EEPROM_MAX_MEM_MAP_CNT ||
+		    (size_t)*num_map >= ((MSM_EEPROM_MAX_MEM_MAP_CNT *
+				MSM_EEPROM_MEMORY_MAP_MAX_SIZE) -
+				payload_count)) {
+			CAM_ERR(CAM_EEPROM, "OOB Error");
+			return -EINVAL;
+		}
+		cmd_length_in_bytes   = sizeof(struct cam_cmd_i2c_random_wr) +
+			((payload_count - 1) *
+			sizeof(struct i2c_random_wr_payload));
+
+		if (cmd_length_in_bytes > remain_buf_len) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer remaining");
+			return -EINVAL;
+		}
+		for (cnt = 0; cnt < (payload_count);
+			cnt++) {
+			map[*num_map + cnt].page.addr =
+				i2c_random_wr->random_wr_payload_flex[cnt].reg_addr;
+			map[*num_map + cnt].page.addr_type =
+				i2c_random_wr->header.addr_type;
+			map[*num_map + cnt].page.data =
+				i2c_random_wr->random_wr_payload_flex[cnt].reg_data;
+			map[*num_map + cnt].page.data_type =
+				i2c_random_wr->header.data_type;
+			map[*num_map + cnt].page.valid_size = 1;
+		}
+
+		*num_map += (payload_count - 1);
+		processed_size +=
+			cmd_length_in_bytes;
+		break;
+	case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD:
+		i2c_cont_rd = (struct cam_cmd_i2c_continuous_rd *)cmd_buf;
+		cmd_length_in_bytes = sizeof(struct cam_cmd_i2c_continuous_rd);
+		payload_count = i2c_cont_rd->header.count;
+
+		if (payload_count >= U32_MAX - data->num_data) {
+			CAM_ERR(CAM_EEPROM,
+				"int overflow on eeprom memory block");
+			return -EINVAL;
+		}
+		map[*num_map].mem.addr = i2c_cont_rd->reg_addr;
+		map[*num_map].mem.addr_type = i2c_cont_rd->header.addr_type;
+		map[*num_map].mem.data_type = i2c_cont_rd->header.data_type;
+		map[*num_map].mem.valid_size =
+		    payload_count;
+		processed_size +=
+			cmd_length_in_bytes;
+		data->num_data += map[*num_map].mem.valid_size;
+		break;
+	case CAMERA_SENSOR_CMD_TYPE_WAIT:
+		if (generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_HW_UCND ||
+			generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_SW_UCND) {
+			i2c_uncond_wait =
+				(struct cam_cmd_unconditional_wait *)cmd_buf;
+			cmd_length_in_bytes =
+				sizeof(struct cam_cmd_unconditional_wait);
+
+			if (*num_map < 1) {
+				CAM_ERR(CAM_EEPROM,
+					"invalid map number, num_map=%d",
+					*num_map);
+				return -EINVAL;
+			}
+
+			/*
+			 * Though delay is added all of them, but delay will
+			 * be applicable to only one of them as only one of
+			 * them will have valid_size set to >= 1.
+			 */
+			map[*num_map - 1].mem.delay = i2c_uncond_wait->delay;
+			map[*num_map - 1].page.delay = i2c_uncond_wait->delay;
+			map[*num_map - 1].pageen.delay = i2c_uncond_wait->delay;
+		} else if (generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_COND) {
+			i2c_poll = (struct cam_cmd_conditional_wait *)cmd_buf;
+			cmd_length_in_bytes =
+				sizeof(struct cam_cmd_conditional_wait);
+
+			map[*num_map].poll.addr = i2c_poll->reg_addr;
+			map[*num_map].poll.addr_type = i2c_poll->addr_type;
+			map[*num_map].poll.data = i2c_poll->reg_data;
+			map[*num_map].poll.data_type = i2c_poll->data_type;
+			map[*num_map].poll.delay = i2c_poll->timeout;
+			map[*num_map].poll.valid_size = 1;
+		}
+		processed_size +=
+			cmd_length_in_bytes;
+		break;
+	default:
+		break;
+	}
+
+	*cmd_length_bytes = processed_size;
+	return rc;
+}
+
+static struct i2c_settings_list*
+	cam_eeprom_get_i2c_ptr(struct i2c_settings_array *i2c_reg_settings,
+		uint32_t size)
+{
+	struct i2c_settings_list *tmp;
+
+	tmp = kzalloc(sizeof(struct i2c_settings_list), GFP_KERNEL);
+
+	if (tmp != NULL)
+		list_add_tail(&(tmp->list),
+			&(i2c_reg_settings->list_head));
+	else
+		return NULL;
+
+	tmp->seq_settings.reg_data =
+		kcalloc(size, sizeof(uint8_t), GFP_KERNEL);
+	if (tmp->seq_settings.reg_data == NULL) {
+		list_del(&(tmp->list));
+		kfree(tmp);
+		tmp = NULL;
+		return NULL;
+	}
+	tmp->seq_settings.size = size;
+
+	return tmp;
+}
+
+static int32_t cam_eeprom_handle_continuous_write(
+	struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_cmd_i2c_continuous_wr *cam_cmd_i2c_continuous_wr,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0, cnt = 0;
+
+
+	CAM_DBG(CAM_EEPROM, "Total Size: %d",
+		cam_cmd_i2c_continuous_wr->header.count);
+
+	i2c_list = cam_eeprom_get_i2c_ptr(i2c_reg_settings,
+		cam_cmd_i2c_continuous_wr->header.count);
+	if (i2c_list == NULL ||
+		i2c_list->seq_settings.reg_data == NULL) {
+		CAM_ERR(CAM_SENSOR, "Failed in allocating i2c_list");
+		kfree(i2c_list);
+		return -ENOMEM;
+	}
+
+	*cmd_length_in_bytes = (sizeof(struct i2c_rdwr_header) +
+		sizeof(cam_cmd_i2c_continuous_wr->reg_addr) +
+		sizeof(struct cam_cmd_read) *
+		(cam_cmd_i2c_continuous_wr->header.count));
+	if (cam_cmd_i2c_continuous_wr->header.op_code ==
+		CAMERA_SENSOR_I2C_OP_CONT_WR_BRST)
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_BURST;
+	else if (cam_cmd_i2c_continuous_wr->header.op_code ==
+		CAMERA_SENSOR_I2C_OP_CONT_WR_SEQN)
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_SEQ;
+	else {
+		rc = -EINVAL;
+		goto deallocate_i2c_list;
+	}
+
+	i2c_list->seq_settings.addr_type =
+		cam_cmd_i2c_continuous_wr->header.addr_type;
+
+	CAM_ERR(CAM_EEPROM, "Write Address: 0x%x",
+		cam_cmd_i2c_continuous_wr->reg_addr);
+	if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_SEQ) {
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_RANDOM;
+		e_ctrl->eebin_info.start_address =
+			cam_cmd_i2c_continuous_wr->reg_addr;
+		e_ctrl->eebin_info.size =
+			cam_cmd_i2c_continuous_wr->header.count;
+		CAM_DBG(CAM_EEPROM, "Header Count: %d",
+			cam_cmd_i2c_continuous_wr->header.count);
+		e_ctrl->eebin_info.is_valid = 1;
+
+		i2c_list->seq_settings.reg_addr =
+			cam_cmd_i2c_continuous_wr->reg_addr;
+	} else
+		CAM_ERR(CAM_EEPROM, "Burst Mode Not Supported\n");
+
+	(*offset) += cnt;
+	*list = &(i2c_list->list);
+	return rc;
+deallocate_i2c_list:
+	kfree(i2c_list->seq_settings.reg_data);
+	kfree(i2c_list);
+	return rc;
+}
+
+static int32_t cam_eeprom_handle_delay(
+	uint32_t **cmd_buf,
+	uint16_t generic_op_code,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t offset, uint32_t *byte_cnt,
+	struct list_head *list_ptr,
+	size_t remain_buf_len)
+{
+	int32_t rc = 0;
+	struct i2c_settings_list *i2c_list = NULL;
+	struct cam_cmd_unconditional_wait *cmd_uncond_wait =
+		(struct cam_cmd_unconditional_wait *) *cmd_buf;
+
+	if (remain_buf_len < (sizeof(struct cam_cmd_unconditional_wait))) {
+		CAM_ERR(CAM_EEPROM, "Not Enough buffer");
+		return -EINVAL;
+	}
+
+	if (list_ptr == NULL) {
+		CAM_ERR(CAM_SENSOR, "Invalid list ptr");
+		return -EINVAL;
+	}
+
+	if (offset > 0) {
+		i2c_list =
+			list_entry(list_ptr, struct i2c_settings_list, list);
+		if (generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_HW_UCND)
+			i2c_list->i2c_settings.reg_setting[offset - 1].delay =
+				cmd_uncond_wait->delay;
+		else
+			i2c_list->i2c_settings.delay =
+				cmd_uncond_wait->delay;
+		(*cmd_buf) +=
+			sizeof(
+			struct cam_cmd_unconditional_wait) / sizeof(uint32_t);
+		(*byte_cnt) +=
+			sizeof(
+			struct cam_cmd_unconditional_wait);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Delay Rxed before any buffer: %d", offset);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_parse_write_memory_packet - Write eeprom packet
+ * @csl_packet:   csl packet received
+ * @e_ctrl:       ctrl structure
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_parse_write_memory_packet(
+	struct cam_packet *csl_packet,
+	struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	struct cam_cmd_buf_desc        *cmd_desc = NULL;
+	uint32_t                       *offset = NULL;
+	int32_t                         i, rc = 0;
+	uint32_t                       *cmd_buf = NULL;
+	uintptr_t                       generic_pkt_addr;
+	size_t                          pkt_len = 0;
+	size_t                          remain_len = 0;
+	uint32_t                        total_cmd_buf_in_bytes = 0;
+	uint32_t                        processed_cmd_buf_in_bytes = 0;
+	struct common_header           *cmm_hdr = NULL;
+	uint32_t                        cmd_length_in_bytes = 0;
+	struct cam_cmd_i2c_info        *i2c_info = NULL;
+
+
+	offset = (uint32_t *)&csl_packet->payload_flex;
+	offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+	cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+	CAM_DBG(CAM_EEPROM, "Number of Command Buffers: %d",
+		csl_packet->num_cmd_buf);
+	for (i = 0; i < csl_packet->num_cmd_buf; i++) {
+		struct list_head               *list = NULL;
+		uint16_t                       generic_op_code;
+		uint32_t                       off = 0;
+		int                            master;
+		struct cam_sensor_cci_client   *cci;
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		total_cmd_buf_in_bytes = cmd_desc[i].length;
+		processed_cmd_buf_in_bytes = 0;
+
+		if (!total_cmd_buf_in_bytes)
+			continue;
+
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&generic_pkt_addr, &pkt_len);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "Failed to get cpu buf");
+			return rc;
+		}
+
+		cmd_buf = (uint32_t *)generic_pkt_addr;
+		if (!cmd_buf) {
+			CAM_ERR(CAM_EEPROM, "invalid cmd buf");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if ((pkt_len < sizeof(struct common_header) ||
+			(cmd_desc[i].offset) > (pkt_len -
+			sizeof(struct common_header)))) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		remain_len = pkt_len - cmd_desc[i].offset;
+		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+
+		if (total_cmd_buf_in_bytes > remain_len) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer for command");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		master = e_ctrl->io_master_info.master_type;
+		cci = e_ctrl->io_master_info.cci_client;
+		while (processed_cmd_buf_in_bytes < total_cmd_buf_in_bytes) {
+			if ((remain_len - processed_cmd_buf_in_bytes) <
+				sizeof(struct common_header)) {
+				CAM_ERR(CAM_EEPROM, "Not Enough buffer");
+				rc = -EINVAL;
+				goto end;
+			}
+			cmm_hdr = (struct common_header *)cmd_buf;
+			generic_op_code = cmm_hdr->fifth_byte;
+
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+				if ((remain_len - processed_cmd_buf_in_bytes) <
+					sizeof(struct cam_cmd_i2c_info)) {
+					CAM_ERR(CAM_EEPROM, "Not enough buf");
+					rc = -EINVAL;
+					goto end;
+				}
+				if (master == CCI_MASTER) {
+					cci->cci_i2c_master =
+						e_ctrl->cci_i2c_master;
+					cci->i2c_freq_mode =
+						i2c_info->i2c_freq_mode;
+					cci->sid =
+						i2c_info->slave_addr >> 1;
+					CAM_DBG(CAM_EEPROM,
+						"Slave addr: 0x%x Freq Mode: %d",
+						i2c_info->slave_addr,
+						i2c_info->i2c_freq_mode);
+				} else if (master == I2C_MASTER) {
+					e_ctrl->io_master_info.client->addr =
+						i2c_info->slave_addr;
+					CAM_DBG(CAM_EEPROM,
+						"Slave addr: 0x%x",
+						i2c_info->slave_addr);
+				} else if (master == SPI_MASTER) {
+					CAM_ERR(CAM_EEPROM,
+						"No Need of Slave Info");
+				} else {
+					CAM_ERR(CAM_EEPROM,
+						"Invalid Master type: %d",
+						master);
+					rc = -EINVAL;
+					goto end;
+				}
+				cmd_length_in_bytes =
+					sizeof(struct cam_cmd_i2c_info);
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/4;
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_WR: {
+				struct cam_cmd_i2c_continuous_wr
+					*cam_cmd_i2c_continuous_wr =
+					(struct cam_cmd_i2c_continuous_wr *)
+					cmd_buf;
+				if ((remain_len - processed_cmd_buf_in_bytes) <
+				sizeof(struct cam_cmd_i2c_continuous_wr)) {
+					CAM_ERR(CAM_EEPROM, "Not enough buf");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				CAM_DBG(CAM_EEPROM,
+					"CAMERA_SENSOR_CMD_TYPE_I2C_CONT_WR");
+				rc = cam_eeprom_handle_continuous_write(
+					e_ctrl,
+					cam_cmd_i2c_continuous_wr,
+					&(e_ctrl->wr_settings),
+					&cmd_length_in_bytes, &off, &list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+					"Failed in continuous write %d", rc);
+					goto end;
+				}
+
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_WAIT: {
+				CAM_DBG(CAM_EEPROM,
+					"CAMERA_SENSOR_CMD_TYPE_WAIT");
+				if (generic_op_code ==
+					CAMERA_SENSOR_WAIT_OP_HW_UCND ||
+					generic_op_code ==
+						CAMERA_SENSOR_WAIT_OP_SW_UCND) {
+
+					rc = cam_eeprom_handle_delay(
+						&cmd_buf, generic_op_code,
+						&(e_ctrl->wr_settings), off,
+						&cmd_length_in_bytes,
+						list, (remain_len -
+						processed_cmd_buf_in_bytes));
+					if (rc < 0) {
+						CAM_ERR(CAM_EEPROM,
+							"delay hdl failed: %d",
+							rc);
+						goto end;
+					}
+					processed_cmd_buf_in_bytes +=
+						cmd_length_in_bytes;
+					cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				} else {
+					CAM_ERR(CAM_EEPROM,
+						"Wrong Wait Command: %d",
+						generic_op_code);
+					rc = -EINVAL;
+					goto end;
+				}
+				break;
+			}
+			default:
+				CAM_ERR(CAM_EEPROM,
+					"Invalid Cmd_type rxed: %d\n",
+					cmm_hdr->cmd_type);
+				rc = -EINVAL;
+				break;
+			}
+		}
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+	return rc;
+end:
+	cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	return rc;
+}
+
+/**
+ * cam_eeprom_init_pkt_parser - Parse eeprom packet
+ * @e_ctrl:       ctrl structure
+ * @csl_packet:	  csl packet received
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_packet *csl_packet)
+{
+	int32_t                         rc = 0;
+	int                             i = 0;
+	struct cam_cmd_buf_desc        *cmd_desc = NULL;
+	uint32_t                       *offset = NULL;
+	uint32_t                       *cmd_buf = NULL;
+	uintptr_t                        generic_pkt_addr;
+	size_t                          pkt_len = 0;
+	size_t                          remain_len = 0;
+	uint32_t                        total_cmd_buf_in_bytes = 0;
+	uint32_t                        processed_cmd_buf_in_bytes = 0;
+	struct common_header           *cmm_hdr = NULL;
+	uint32_t                        cmd_length_in_bytes = 0;
+	struct cam_cmd_i2c_info        *i2c_info = NULL;
+	int                             num_map = -1;
+	struct cam_eeprom_memory_map_t *map = NULL;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+
+	e_ctrl->cal_data.map = vzalloc((MSM_EEPROM_MEMORY_MAP_MAX_SIZE *
+		MSM_EEPROM_MAX_MEM_MAP_CNT) *
+		(sizeof(struct cam_eeprom_memory_map_t)));
+	if (!e_ctrl->cal_data.map) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_EEPROM, "failed");
+		return rc;
+	}
+	map = e_ctrl->cal_data.map;
+
+	offset = (uint32_t *)&csl_packet->payload_flex;
+	offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+	cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+	/* Loop through multiple command buffers */
+	for (i = 0; i < csl_packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		total_cmd_buf_in_bytes = cmd_desc[i].length;
+		processed_cmd_buf_in_bytes = 0;
+		if (!total_cmd_buf_in_bytes)
+			continue;
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&generic_pkt_addr, &pkt_len);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "Failed to get cpu buf");
+			return rc;
+		}
+		cmd_buf = (uint32_t *)generic_pkt_addr;
+		if (!cmd_buf) {
+			CAM_ERR(CAM_EEPROM, "invalid cmd buf");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if ((pkt_len < sizeof(struct common_header)) ||
+			(cmd_desc[i].offset > (pkt_len -
+			sizeof(struct common_header)))) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer");
+			rc = -EINVAL;
+			goto end;
+		}
+		remain_len = pkt_len - cmd_desc[i].offset;
+		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+
+		if (total_cmd_buf_in_bytes > remain_len) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer for command");
+			rc = -EINVAL;
+			goto end;
+		}
+		/* Loop through multiple cmd formats in one cmd buffer */
+		while (processed_cmd_buf_in_bytes < total_cmd_buf_in_bytes) {
+			if ((remain_len - processed_cmd_buf_in_bytes) <
+				sizeof(struct common_header)) {
+				CAM_ERR(CAM_EEPROM, "Not enough buf");
+				rc = -EINVAL;
+				goto end;
+			}
+			cmm_hdr = (struct common_header *)cmd_buf;
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+				if ((remain_len - processed_cmd_buf_in_bytes) <
+					sizeof(struct cam_cmd_i2c_info)) {
+					CAM_ERR(CAM_EEPROM, "Not enough buf");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				if ((num_map + 1) >= (MSM_EEPROM_MAX_MEM_MAP_CNT *
+						MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) {
+					CAM_ERR(CAM_EEPROM, "OOB map read error");
+					rc = -EINVAL;
+					goto end;
+				}
+				/* Configure the following map slave address */
+
+				map[num_map + 1].saddr = i2c_info->slave_addr;
+				rc = cam_eeprom_update_slaveInfo(e_ctrl,
+					cmd_buf);
+				cmd_length_in_bytes =
+					sizeof(struct cam_cmd_i2c_info);
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/
+					sizeof(uint32_t);
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
+			case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
+				cmd_length_in_bytes = total_cmd_buf_in_bytes;
+				rc = cam_sensor_update_power_settings(cmd_buf,
+					cmd_length_in_bytes, power_info,
+					(remain_len -
+					processed_cmd_buf_in_bytes));
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/
+					sizeof(uint32_t);
+				if (rc) {
+					CAM_ERR(CAM_EEPROM, "Failed");
+					goto end;
+				}
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR:
+			case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD:
+			case CAMERA_SENSOR_CMD_TYPE_WAIT:
+				num_map++;
+				rc = cam_eeprom_parse_memory_map(
+					&e_ctrl->cal_data, cmd_buf,
+					total_cmd_buf_in_bytes,
+					&cmd_length_in_bytes, &num_map,
+					(remain_len -
+					processed_cmd_buf_in_bytes));
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/sizeof(uint32_t);
+				break;
+			default:
+				CAM_ERR(CAM_EEPROM, "Invalid cmd_type 0x%x",
+					cmm_hdr->cmd_type);
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+		e_ctrl->cal_data.num_map = num_map + 1;
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+	return rc;
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	return rc;
+}
+
+/**
+ * cam_eeprom_get_cal_data - parse the userspace IO config and
+ *                                        copy read data to share with userspace
+ * @e_ctrl:     ctrl structure
+ * @csl_packet: csl packet received
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_packet *csl_packet)
+{
+	struct cam_buf_io_cfg *io_cfg;
+	uint32_t              i = 0;
+	size_t                plane_offset;
+	int32_t               mem_handle;
+	int                   rc = 0;
+	uintptr_t              buf_addr;
+	size_t                buf_size;
+	uint8_t               *read_buffer;
+	size_t                remain_len = 0;
+
+	io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+		&csl_packet->payload_flex +
+		csl_packet->io_configs_offset);
+	plane_offset = io_cfg->offsets[0];
+	mem_handle   = io_cfg->mem_handle[0];
+
+	CAM_DBG(CAM_EEPROM, "number of IO configs: %d:",
+		csl_packet->num_io_configs);
+
+	for (i = 0; i < csl_packet->num_io_configs; i++) {
+		CAM_DBG(CAM_EEPROM, "Direction: %d:", io_cfg->direction);
+		if (io_cfg->direction == CAM_BUF_OUTPUT) {
+			rc = cam_mem_get_cpu_buf(mem_handle, 
+				&buf_addr, &buf_size);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM, "Fail in get buffer: %d",
+					rc);
+				return rc;
+			}
+			if (buf_size <= plane_offset) { 
+				CAM_ERR(CAM_EEPROM, "Not enough buffer");
+				cam_mem_put_cpu_buf(mem_handle);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			remain_len = buf_size - plane_offset; 
+			CAM_DBG(CAM_EEPROM, "buf_addr : %pK, buf_size : %zu\n",
+				(void *)buf_addr, buf_size);
+
+			read_buffer = (uint8_t *)buf_addr;
+			if (!read_buffer) {
+				CAM_ERR(CAM_EEPROM,
+					"invalid buffer to copy data");
+				cam_mem_put_cpu_buf(mem_handle);
+				rc = -EINVAL;
+				return rc;
+			}
+			read_buffer += plane_offset;
+
+			if (remain_len < e_ctrl->cal_data.num_data) {
+				CAM_ERR(CAM_EEPROM,
+					"failed to copy, Invalid size");
+				cam_mem_put_cpu_buf(mem_handle);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			CAM_DBG(CAM_EEPROM, "copy the data, len:%d",
+				e_ctrl->cal_data.num_data);
+			memcpy(read_buffer, e_ctrl->cal_data.mapdata,
+					e_ctrl->cal_data.num_data);
+			cam_mem_put_cpu_buf(mem_handle);
+		} else {
+			CAM_ERR(CAM_EEPROM, "Invalid direction");
+			rc = -EINVAL;
+		}
+	}
+
+	return rc;
+}
+
+static int32_t delete_eeprom_request(struct i2c_settings_array *i2c_array)
+{
+	struct i2c_settings_list *i2c_list = NULL, *i2c_next = NULL;
+	int32_t rc = 0;
+
+	if (i2c_array == NULL) {
+		CAM_ERR(CAM_SENSOR, "FATAL:: Invalid argument");
+		return -EINVAL;
+	}
+
+	list_for_each_entry_safe(i2c_list, i2c_next,
+		&(i2c_array->list_head), list) {
+		kfree(i2c_list->seq_settings.reg_data);
+		list_del(&(i2c_list->list));
+		kfree(i2c_list);
+	}
+	INIT_LIST_HEAD(&(i2c_array->list_head));
+	i2c_array->is_settings_valid = 0;
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_write - Write Packet
+ * @e_ctrl:     ctrl structure
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_write(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int32_t rc = 0;
+	struct i2c_settings_array *i2c_set = NULL;
+	struct i2c_settings_list *i2c_list = NULL;
+
+	i2c_set = &e_ctrl->wr_settings;
+
+	if (i2c_set->is_settings_valid == 1) {
+		list_for_each_entry(i2c_list,
+			&(i2c_set->list_head), list) {
+			rc = camera_io_dev_write_continuous(
+				&e_ctrl->io_master_info,
+				&i2c_list->i2c_settings, CAM_SENSOR_I2C_WRITE_BURST);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM,
+				"Error in EEPROM write");
+			goto del_req;
+		}
+		}
+	}
+
+del_req:
+	delete_eeprom_request(i2c_set);
+	return rc;
+}
+
+/**
+ * cam_eeprom_pkt_parse - Parse csl packet
+ * @e_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
+{
+	int32_t                         rc = 0;
+	struct cam_control             *ioctl_ctrl = NULL;
+	struct cam_config_dev_cmd       dev_config;
+	uintptr_t                        generic_pkt_addr;
+	size_t                          pkt_len;
+	size_t                          remain_len = 0;
+	struct cam_packet              *csl_packet = NULL;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+
+	ioctl_ctrl = (struct cam_control *)arg;
+
+	if (copy_from_user(&dev_config,
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(dev_config)))
+		return -EFAULT;
+	rc = cam_mem_get_cpu_buf(dev_config.packet_handle,
+		&generic_pkt_addr, &pkt_len);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM,
+			"error in converting command Handle Error: %d", rc);
+		return rc;
+	}
+
+	remain_len = pkt_len;
+	if ((sizeof(struct cam_packet) > pkt_len) ||
+		((size_t)dev_config.offset >= pkt_len -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_EEPROM,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), pkt_len);
+		rc = -EINVAL;
+		cam_mem_put_cpu_buf(dev_config.packet_handle);
+		return rc;
+	}
+
+	remain_len -= (size_t)dev_config.offset;
+	csl_packet = (struct cam_packet *)
+		(generic_pkt_addr + (uint32_t)dev_config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_EEPROM, "Invalid packet params");
+		cam_mem_put_cpu_buf(dev_config.packet_handle);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_EEPROM_PACKET_OPCODE_INIT:
+		if (e_ctrl->userspace_probe == false) {
+			rc = cam_eeprom_parse_read_memory_map(
+					e_ctrl->soc_info.dev->of_node, e_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
+				cam_mem_put_cpu_buf(dev_config.packet_handle);
+				return rc;
+			}
+			rc = cam_eeprom_get_cal_data(e_ctrl, csl_packet);
+			if (rc)
+				CAM_WARN(CAM_EEPROM, "failed to get calibration data rc %d", rc);
+
+			vfree(e_ctrl->cal_data.mapdata);
+			vfree(e_ctrl->cal_data.map);
+			e_ctrl->cal_data.num_data = 0;
+			e_ctrl->cal_data.num_map = 0;
+			CAM_DBG(CAM_EEPROM,
+				"Returning the data using kernel probe");
+			break;
+		}
+		rc = cam_eeprom_init_pkt_parser(e_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM,
+				"Failed in parsing the pkt");
+			cam_mem_put_cpu_buf(dev_config.packet_handle);
+			return rc;
+		}
+
+		e_ctrl->cal_data.mapdata =
+			vzalloc(e_ctrl->cal_data.num_data);
+		if (!e_ctrl->cal_data.mapdata) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_EEPROM, "failed");
+			goto error;
+		}
+
+		if (e_ctrl->eeprom_device_type == MSM_CAMERA_SPI_DEVICE) {
+			rc = cam_eeprom_match_id(e_ctrl);
+			if (rc) {
+				CAM_DBG(CAM_EEPROM,
+					"eeprom not matching %d", rc);
+				goto memdata_free;
+			}
+		}
+
+		rc = cam_eeprom_power_up(e_ctrl,
+			&soc_private->power_info);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "failed rc %d", rc);
+			goto memdata_free;
+		}
+
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_CONFIG;
+		rc = cam_eeprom_read_memory(e_ctrl, &e_ctrl->cal_data);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM,
+				"read_eeprom_memory failed");
+			goto power_down;
+		}
+
+		rc = cam_eeprom_get_cal_data(e_ctrl, csl_packet);
+		if (rc)
+			CAM_WARN(CAM_EEPROM, "failed to get calibration data rc %d", rc);
+
+		rc = cam_eeprom_power_down(e_ctrl);
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+		vfree(e_ctrl->cal_data.mapdata);
+		vfree(e_ctrl->cal_data.map);
+		kfree(power_info->power_setting);
+		kfree(power_info->power_down_setting);
+		power_info->power_setting = NULL;
+		power_info->power_down_setting = NULL;
+		power_info->power_setting_size = 0;
+		power_info->power_down_setting_size = 0;
+		e_ctrl->cal_data.num_data = 0;
+		e_ctrl->cal_data.num_map = 0;
+		break;
+	case CAM_EEPROM_WRITE: {
+		struct i2c_settings_array *i2c_reg_settings =
+			&e_ctrl->wr_settings;
+
+		i2c_reg_settings->is_settings_valid = 1;
+		rc = cam_eeprom_parse_write_memory_packet(
+			csl_packet, e_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
+			cam_mem_put_cpu_buf(dev_config.packet_handle);
+			return rc;
+		}
+
+		rc = cam_eeprom_power_up(e_ctrl,
+			&soc_private->power_info);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "failed power up rc %d", rc);
+			goto memdata_free;
+		}
+
+		usleep_range(10*1000, 11*1000);
+		CAM_DBG(CAM_EEPROM,
+			"Calling Erase : %d start Address: 0x%x size: %d",
+			rc, e_ctrl->eebin_info.start_address,
+			e_ctrl->eebin_info.size);
+
+		rc = camera_io_dev_erase(&e_ctrl->io_master_info,
+			e_ctrl->eebin_info.start_address,
+			e_ctrl->eebin_info.size);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "Failed in erase : %d", rc);
+			cam_mem_put_cpu_buf(dev_config.packet_handle);
+			return rc;
+		}
+
+		/* Buffer time margin */
+		usleep_range(10*1000, 11*1000);
+
+		rc = cam_eeprom_write(e_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
+			cam_mem_put_cpu_buf(dev_config.packet_handle);
+			return rc;
+		}
+
+		rc = cam_eeprom_power_down(e_ctrl);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "failed power down rc %d", rc);
+			goto memdata_free;
+		}
+
+		break;
+	}
+	default:
+		CAM_ERR(CAM_EEPROM, "Invalid op-code 0x%x",
+			csl_packet->header.op_code & 0xFFFFFF);
+		rc = -EINVAL;
+		break;
+	}
+	cam_mem_put_cpu_buf(dev_config.packet_handle);
+	return rc;
+power_down:
+	cam_eeprom_power_down(e_ctrl);
+memdata_free:
+	vfree(e_ctrl->cal_data.mapdata);
+error:
+	cam_mem_put_cpu_buf(dev_config.packet_handle);
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	vfree(e_ctrl->cal_data.map);
+	e_ctrl->cal_data.num_data = 0;
+	e_ctrl->cal_data.num_map = 0;
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+	return rc;
+}
+
+void cam_eeprom_shutdown(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int rc;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+
+	if (e_ctrl->cam_eeprom_state == CAM_EEPROM_INIT)
+		return;
+
+	if (e_ctrl->cam_eeprom_state == CAM_EEPROM_CONFIG) {
+		rc = cam_eeprom_power_down(e_ctrl);
+		if (rc < 0)
+			CAM_ERR(CAM_EEPROM, "EEPROM Power down failed");
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+	}
+
+	if (e_ctrl->cam_eeprom_state == CAM_EEPROM_ACQUIRE) {
+		rc = cam_destroy_device_hdl(e_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_EEPROM, "destroying the device hdl");
+
+		e_ctrl->bridge_intf.device_hdl = -1;
+		e_ctrl->bridge_intf.link_hdl = -1;
+		e_ctrl->bridge_intf.session_hdl = -1;
+
+		kfree(power_info->power_setting);
+		kfree(power_info->power_down_setting);
+		power_info->power_setting = NULL;
+		power_info->power_down_setting = NULL;
+		power_info->power_setting_size = 0;
+		power_info->power_down_setting_size = 0;
+	}
+
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_INIT;
+}
+
+/**
+ * cam_eeprom_driver_cmd - Handle eeprom cmds
+ * @e_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+int32_t cam_eeprom_driver_cmd(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
+{
+	int                            rc = 0;
+	struct cam_eeprom_query_cap_t  eeprom_cap = {0};
+	struct cam_control            *cmd = (struct cam_control *)arg;
+
+	if (!e_ctrl || !cmd) {
+		CAM_ERR(CAM_EEPROM, "Invalid Arguments");
+		return -EINVAL;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_EEPROM, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	switch (cmd->op_code) {
+	case CAM_QUERY_CAP:
+		eeprom_cap.slot_info = e_ctrl->soc_info.index;
+		if (e_ctrl->userspace_probe == false)
+			eeprom_cap.eeprom_kernel_probe = true;
+		else
+			eeprom_cap.eeprom_kernel_probe = false;
+
+		eeprom_cap.is_multimodule_mode =
+			e_ctrl->is_multimodule_mode;
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&eeprom_cap,
+			sizeof(struct cam_eeprom_query_cap_t))) {
+			CAM_ERR(CAM_EEPROM, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		CAM_DBG(CAM_EEPROM, "eeprom_cap: ID: %d", eeprom_cap.slot_info);
+		break;
+	case CAM_ACQUIRE_DEV:
+		rc = cam_eeprom_get_dev_handle(e_ctrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "Failed to acquire dev");
+			goto release_mutex;
+		}
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+		break;
+	case CAM_RELEASE_DEV:
+		if (e_ctrl->cam_eeprom_state != CAM_EEPROM_ACQUIRE) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_EEPROM,
+			"Not in right state to release : %d",
+			e_ctrl->cam_eeprom_state);
+			goto release_mutex;
+		}
+
+		if (e_ctrl->bridge_intf.device_hdl == -1) {
+			CAM_ERR(CAM_EEPROM,
+				"Invalid Handles: link hdl: %d device hdl: %d",
+				e_ctrl->bridge_intf.device_hdl,
+				e_ctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = cam_destroy_device_hdl(e_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_EEPROM,
+				"failed in destroying the device hdl");
+		e_ctrl->bridge_intf.device_hdl = -1;
+		e_ctrl->bridge_intf.link_hdl = -1;
+		e_ctrl->bridge_intf.session_hdl = -1;
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_INIT;
+		break;
+	case CAM_CONFIG_DEV:
+		rc = cam_eeprom_pkt_parse(e_ctrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "Failed in eeprom pkt Parsing");
+			goto release_mutex;
+		}
+		break;
+	default:
+		CAM_DBG(CAM_EEPROM, "invalid opcode");
+		break;
+	}
+
+release_mutex:
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.h
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAM_EEPROM_CORE_H_
+#define _CAM_EEPROM_CORE_H_
+
+#include "cam_eeprom_dev.h"
+
+int32_t cam_eeprom_driver_cmd(struct cam_eeprom_ctrl_t *e_ctrl, void *arg);
+int32_t cam_eeprom_parse_read_memory_map(struct device_node *of_node,
+	struct cam_eeprom_ctrl_t *e_ctrl);
+/**
+ * @e_ctrl: EEPROM ctrl structure
+ *
+ * This API handles the shutdown ioctl/close
+ */
+void cam_eeprom_shutdown(struct cam_eeprom_ctrl_t *e_ctrl);
+
+struct completion *cam_eeprom_get_i3c_completion(uint32_t index);
+
+#endif
+/* _CAM_EEPROM_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.c
@@ -0,0 +1,840 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_eeprom_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_eeprom_soc.h"
+#include "cam_eeprom_core.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+static struct cam_i3c_eeprom_data {
+	struct cam_eeprom_ctrl_t                  *e_ctrl;
+	struct completion                          probe_complete;
+} g_i3c_eeprom_data[MAX_CAMERAS];
+
+struct completion *cam_eeprom_get_i3c_completion(uint32_t index)
+{
+	return &g_i3c_eeprom_data[index].probe_complete;
+}
+
+static int cam_eeprom_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_eeprom_ctrl_t *e_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "e_ctrl ptr is NULL");
+			return -EINVAL;
+	}
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_shutdown(e_ctrl);
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+
+	return 0;
+}
+
+static int cam_eeprom_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_EEPROM, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_eeprom_subdev_close_internal(sd, fh);
+}
+
+static long cam_eeprom_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int                       rc     = 0;
+	struct cam_eeprom_ctrl_t *e_ctrl = v4l2_get_subdevdata(sd);
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_eeprom_driver_cmd(e_ctrl, arg);
+		if (rc)
+			CAM_ERR(CAM_EEPROM,
+				"Failed in Driver cmd: %d", rc);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_eeprom_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_EEPROM, "Invalid ioctl cmd: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	return rc;
+}
+
+int32_t cam_eeprom_update_i2c_info(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_eeprom_i2c_info_t *i2c_info)
+{
+	struct cam_sensor_cci_client        *cci_client = NULL;
+
+	if (e_ctrl->io_master_info.master_type == CCI_MASTER) {
+		cci_client = e_ctrl->io_master_info.cci_client;
+		if (!cci_client) {
+			CAM_ERR(CAM_EEPROM, "failed: cci_client %pK",
+				cci_client);
+			return -EINVAL;
+		}
+		cci_client->cci_i2c_master = e_ctrl->cci_i2c_master;
+		cci_client->sid = (i2c_info->slave_addr) >> 1;
+		cci_client->retries = 3;
+		cci_client->id_map = 0;
+		cci_client->i2c_freq_mode = i2c_info->i2c_freq_mode;
+	} else if (e_ctrl->io_master_info.master_type == I2C_MASTER) {
+		e_ctrl->io_master_info.client->addr = i2c_info->slave_addr;
+		CAM_DBG(CAM_EEPROM, "Slave addr: 0x%x", i2c_info->slave_addr);
+	} else if (e_ctrl->io_master_info.master_type == SPI_MASTER) {
+		CAM_ERR(CAM_EEPROM, "Slave addr: 0x%x Freq Mode: %d",
+		i2c_info->slave_addr, i2c_info->i2c_freq_mode);
+	}
+	return 0;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_eeprom_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_EEPROM,
+			"Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_eeprom_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM,
+				"Failed in eeprom suddev handling rc %d",
+				rc);
+			return rc;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_EEPROM, "Invalid compat ioctl: %d", cmd);
+		rc = -EINVAL;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_EEPROM,
+				"Failed to copy from user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+	return rc;
+}
+#endif
+
+static const struct v4l2_subdev_internal_ops cam_eeprom_internal_ops = {
+	.close = cam_eeprom_subdev_close,
+};
+
+static struct v4l2_subdev_core_ops cam_eeprom_subdev_core_ops = {
+	.ioctl = cam_eeprom_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_eeprom_init_subdev_do_ioctl,
+#endif
+};
+
+static struct v4l2_subdev_ops cam_eeprom_subdev_ops = {
+	.core = &cam_eeprom_subdev_core_ops,
+};
+
+static int cam_eeprom_init_subdev(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int rc = 0;
+
+	e_ctrl->v4l2_dev_str.internal_ops = &cam_eeprom_internal_ops;
+	e_ctrl->v4l2_dev_str.ops = &cam_eeprom_subdev_ops;
+	strscpy(e_ctrl->device_name, CAM_EEPROM_NAME,
+		sizeof(e_ctrl->device_name));
+	e_ctrl->v4l2_dev_str.name = e_ctrl->device_name;
+	e_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	e_ctrl->v4l2_dev_str.ent_function = CAM_EEPROM_DEVICE_TYPE;
+	e_ctrl->v4l2_dev_str.token = e_ctrl;
+	e_ctrl->v4l2_dev_str.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(e_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "Fail with cam_register_subdev");
+
+	return rc;
+}
+
+static int cam_eeprom_i2c_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                             rc = 0;
+	struct i2c_client              *client = NULL;
+	struct cam_eeprom_ctrl_t       *e_ctrl = NULL;
+	struct cam_eeprom_soc_private  *soc_private = NULL;
+	struct cam_hw_soc_info         *soc_info = NULL;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (client == NULL) {
+		CAM_ERR(CAM_OIS, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	e_ctrl = kzalloc(sizeof(*e_ctrl), GFP_KERNEL);
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "kzalloc failed");
+		rc = -ENOMEM;
+		goto probe_failure;
+	}
+
+	soc_private = kzalloc(sizeof(*soc_private), GFP_KERNEL);
+	if (!soc_private)
+		goto ectrl_free;
+
+	e_ctrl->soc_info.soc_private = soc_private;
+
+	i2c_set_clientdata(client, e_ctrl);
+
+	mutex_init(&(e_ctrl->eeprom_mutex));
+
+	INIT_LIST_HEAD(&(e_ctrl->wr_settings.list_head));
+	soc_info = &e_ctrl->soc_info;
+	soc_info->dev = &client->dev;
+	soc_info->dev_name = client->name;
+	e_ctrl->io_master_info.master_type = I2C_MASTER;
+	e_ctrl->io_master_info.client = client;
+	e_ctrl->eeprom_device_type = MSM_CAMERA_I2C_DEVICE;
+	e_ctrl->cal_data.mapdata = NULL;
+	e_ctrl->cal_data.map = NULL;
+	e_ctrl->userspace_probe = false;
+
+	rc = cam_eeprom_parse_dt(e_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: soc init rc %d", rc);
+		goto free_soc;
+	}
+
+	rc = cam_eeprom_update_i2c_info(e_ctrl, &soc_private->i2c_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: to update i2c info rc %d", rc);
+		goto free_soc;
+	}
+
+	rc = cam_eeprom_init_subdev(e_ctrl);
+	if (rc)
+		goto free_soc;
+
+	cam_sensor_module_add_i2c_device((void *) e_ctrl, CAM_SENSOR_EEPROM);
+
+	if (soc_private->i2c_info.slave_addr != 0)
+		e_ctrl->io_master_info.client->addr =
+			soc_private->i2c_info.slave_addr;
+
+	e_ctrl->bridge_intf.device_hdl = -1;
+	e_ctrl->bridge_intf.ops.get_dev_info = NULL;
+	e_ctrl->bridge_intf.ops.link_setup = NULL;
+	e_ctrl->bridge_intf.ops.apply_req = NULL;
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_INIT;
+
+	return rc;
+free_soc:
+	kfree(soc_private);
+ectrl_free:
+	kfree(e_ctrl);
+probe_failure:
+	return rc;
+}
+
+static void cam_eeprom_i2c_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                             i;
+	struct i2c_client              *client = NULL;
+	struct v4l2_subdev             *sd = NULL;
+	struct cam_eeprom_ctrl_t       *e_ctrl;
+	struct cam_eeprom_soc_private  *soc_private;
+	struct cam_hw_soc_info         *soc_info;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (!client) {
+		CAM_ERR(CAM_EEPROM,
+			"Failed to get i2c client");
+		return;
+	}
+
+	sd = i2c_get_clientdata(client);
+	if (!sd) {
+		CAM_ERR(CAM_EEPROM, "Subdevice is NULL");
+		return;
+	}
+
+	e_ctrl = (struct cam_eeprom_ctrl_t *)v4l2_get_subdevdata(sd);
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "eeprom device is NULL");
+		return;
+	}
+
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_EEPROM, "soc_info.soc_private is NULL");
+		return;
+	}
+
+	CAM_INFO(CAM_EEPROM, "i2c driver remove invoked");
+	soc_info = &e_ctrl->soc_info;
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_EEPROM, "%s handle is NULL skip put",
+				soc_info->clk_name[i]);
+			continue;
+		}
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+	}
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_shutdown(e_ctrl);
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_release_power_domain(e_ctrl);
+	mutex_destroy(&(e_ctrl->eeprom_mutex));
+	cam_unregister_subdev(&(e_ctrl->v4l2_dev_str));
+	kfree(soc_private);
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(e_ctrl);
+}
+
+const static struct component_ops cam_eeprom_i2c_component_ops = {
+	.bind = cam_eeprom_i2c_component_bind,
+	.unbind = cam_eeprom_i2c_component_unbind,
+};
+
+static int cam_eeprom_i2c_driver_probe(struct i2c_client *client)
+{
+	int rc = 0;
+
+	if (client == NULL) {
+		CAM_ERR(CAM_EEPROM, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_EEPROM, "%s :: i2c_check_functionality failed",
+			client->name);
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_EEPROM, "Adding sensor eeprom component");
+	rc = component_add(&client->dev, &cam_eeprom_i2c_component_ops);
+	if (rc)
+		CAM_ERR(CAM_EEPROM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_eeprom_spi_setup(struct spi_device *spi)
+{
+	struct cam_eeprom_ctrl_t       *e_ctrl = NULL;
+	struct cam_hw_soc_info         *soc_info = NULL;
+	struct cam_sensor_spi_client   *spi_client;
+	struct cam_eeprom_soc_private  *eb_info;
+	struct cam_sensor_power_ctrl_t *power_info = NULL;
+	int                             rc = 0;
+
+	e_ctrl = kzalloc(sizeof(*e_ctrl), GFP_KERNEL);
+	if (!e_ctrl)
+		return -ENOMEM;
+
+	soc_info = &e_ctrl->soc_info;
+	soc_info->dev = &spi->dev;
+	soc_info->dev_name = spi->modalias;
+
+	e_ctrl->v4l2_dev_str.ops = &cam_eeprom_subdev_ops;
+	e_ctrl->userspace_probe = false;
+	e_ctrl->cal_data.mapdata = NULL;
+	e_ctrl->cal_data.map = NULL;
+
+	spi_client = kzalloc(sizeof(*spi_client), GFP_KERNEL);
+	if (!spi_client) {
+		kfree(e_ctrl);
+		return -ENOMEM;
+	}
+
+	eb_info = kzalloc(sizeof(*eb_info), GFP_KERNEL);
+	if (!eb_info)
+		goto spi_free;
+	e_ctrl->soc_info.soc_private = eb_info;
+
+	e_ctrl->eeprom_device_type = MSM_CAMERA_SPI_DEVICE;
+	e_ctrl->io_master_info.spi_client = spi_client;
+	e_ctrl->io_master_info.master_type = SPI_MASTER;
+	spi_client->spi_master = spi;
+	INIT_LIST_HEAD(&(e_ctrl->wr_settings.list_head));
+	power_info = &eb_info->power_info;
+	power_info->dev = &spi->dev;
+
+	/* set spi instruction info */
+	spi_client->retry_delay = 1;
+	spi_client->retries = 0;
+
+	/* Initialize mutex */
+	mutex_init(&(e_ctrl->eeprom_mutex));
+
+	e_ctrl->bridge_intf.device_hdl = -1;
+	rc = cam_eeprom_parse_dt(e_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: spi soc init rc %d", rc);
+		goto board_free;
+	}
+
+	rc = cam_eeprom_spi_parse_of(spi_client);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "Device tree parsing error");
+		goto board_free;
+	}
+
+	rc = cam_eeprom_init_subdev(e_ctrl);
+	if (rc)
+		goto board_free;
+
+	e_ctrl->bridge_intf.ops.get_dev_info = NULL;
+	e_ctrl->bridge_intf.ops.link_setup = NULL;
+	e_ctrl->bridge_intf.ops.apply_req = NULL;
+
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, e_ctrl);
+	return rc;
+
+board_free:
+	kfree(e_ctrl->soc_info.soc_private);
+spi_free:
+	kfree(spi_client);
+	kfree(e_ctrl);
+	return rc;
+}
+
+static int cam_eeprom_spi_driver_probe(struct spi_device *spi)
+{
+	spi->bits_per_word = 8;
+	spi->mode = SPI_MODE_0;
+	spi_setup(spi);
+
+	CAM_DBG(CAM_EEPROM, "irq[%d] cs[%x] CPHA[%x] CPOL[%x] CS_HIGH[%x]",
+		spi->irq, spi->chip_select, (spi->mode & SPI_CPHA) ? 1 : 0,
+		(spi->mode & SPI_CPOL) ? 1 : 0,
+		(spi->mode & SPI_CS_HIGH) ? 1 : 0);
+	CAM_DBG(CAM_EEPROM, "max_speed[%u]", spi->max_speed_hz);
+
+	return cam_eeprom_spi_setup(spi);
+}
+
+int cam_eeprom_i2c_driver_remove_common(struct i2c_client *client)
+{
+	component_del(&client->dev, &cam_eeprom_i2c_component_ops);
+
+	return 0;
+}
+
+int cam_eeprom_spi_driver_remove_common(struct spi_device *sdev)
+{
+	struct v4l2_subdev             *sd = spi_get_drvdata(sdev);
+	struct cam_eeprom_ctrl_t       *e_ctrl;
+	struct cam_eeprom_soc_private  *soc_private;
+
+	if (!sd) {
+		CAM_ERR(CAM_EEPROM, "Subdevice is NULL");
+		return -EINVAL;
+	}
+
+	e_ctrl = (struct cam_eeprom_ctrl_t *)v4l2_get_subdevdata(sd);
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "eeprom device is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_shutdown(e_ctrl);
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_release_power_domain(e_ctrl);
+	mutex_destroy(&(e_ctrl->eeprom_mutex));
+	cam_unregister_subdev(&(e_ctrl->v4l2_dev_str));
+	kfree(e_ctrl->io_master_info.spi_client);
+	e_ctrl->io_master_info.spi_client = NULL;
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	if (soc_private) {
+		kfree(soc_private->power_info.gpio_num_info);
+		soc_private->power_info.gpio_num_info = NULL;
+		kfree(soc_private);
+		soc_private = NULL;
+	}
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(e_ctrl);
+	return 0;
+}
+
+static int cam_eeprom_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t                         rc = 0;
+	bool                            i3c_i2c_target;
+	struct cam_eeprom_ctrl_t       *e_ctrl = NULL;
+	struct cam_eeprom_soc_private  *soc_private = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return 0;
+
+	e_ctrl = kzalloc(sizeof(struct cam_eeprom_ctrl_t), GFP_KERNEL);
+	if (!e_ctrl)
+		return -ENOMEM;
+
+	e_ctrl->soc_info.pdev = pdev;
+	e_ctrl->soc_info.dev = &pdev->dev;
+	e_ctrl->soc_info.dev_name = pdev->name;
+	e_ctrl->eeprom_device_type = MSM_CAMERA_PLATFORM_DEVICE;
+	e_ctrl->cal_data.mapdata = NULL;
+	e_ctrl->cal_data.map = NULL;
+	e_ctrl->userspace_probe = false;
+
+	e_ctrl->io_master_info.master_type = CCI_MASTER;
+	e_ctrl->io_master_info.cci_client = kzalloc(
+		sizeof(struct cam_sensor_cci_client), GFP_KERNEL);
+	if (!e_ctrl->io_master_info.cci_client) {
+		rc = -ENOMEM;
+		goto free_e_ctrl;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_eeprom_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto free_cci_client;
+	}
+	e_ctrl->soc_info.soc_private = soc_private;
+	soc_private->power_info.dev = &pdev->dev;
+
+	/* Initialize mutex */
+	mutex_init(&(e_ctrl->eeprom_mutex));
+	rc = cam_eeprom_parse_dt(e_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: soc init rc %d", rc);
+		goto free_soc;
+	}
+	rc = cam_eeprom_update_i2c_info(e_ctrl, &soc_private->i2c_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: to update i2c info rc %d", rc);
+		goto free_soc;
+	}
+
+	INIT_LIST_HEAD(&(e_ctrl->wr_settings.list_head));
+	rc = cam_eeprom_init_subdev(e_ctrl);
+	if (rc)
+		goto free_soc;
+
+	cam_sensor_module_add_i2c_device((void *) e_ctrl, CAM_SENSOR_EEPROM);
+
+	e_ctrl->bridge_intf.device_hdl = -1;
+	e_ctrl->bridge_intf.ops.get_dev_info = NULL;
+	e_ctrl->bridge_intf.ops.link_setup = NULL;
+	e_ctrl->bridge_intf.ops.apply_req = NULL;
+	platform_set_drvdata(pdev, e_ctrl);
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_INIT;
+	CAM_DBG(CAM_EEPROM, "Component bound successfully");
+
+	g_i3c_eeprom_data[e_ctrl->soc_info.index].e_ctrl = e_ctrl;
+	init_completion(&g_i3c_eeprom_data[e_ctrl->soc_info.index].probe_complete);
+
+	return rc;
+free_soc:
+	kfree(soc_private);
+free_cci_client:
+	kfree(e_ctrl->io_master_info.cci_client);
+free_e_ctrl:
+	kfree(e_ctrl);
+
+	return rc;
+}
+
+static void cam_eeprom_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                        i;
+	bool                       i3c_i2c_target;
+	struct cam_eeprom_ctrl_t  *e_ctrl;
+	struct cam_hw_soc_info    *soc_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return;
+
+	e_ctrl = platform_get_drvdata(pdev);
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "eeprom device is NULL");
+		return;
+	}
+
+	CAM_DBG(CAM_EEPROM, "Component unbind called for: %s", pdev->name);
+	soc_info = &e_ctrl->soc_info;
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_EEPROM, "%s handle is NULL skip put",
+				soc_info->clk_name[i]);
+			continue;
+		}
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+	}
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_shutdown(e_ctrl);
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_release_power_domain(e_ctrl);
+	mutex_destroy(&(e_ctrl->eeprom_mutex));
+	cam_unregister_subdev(&(e_ctrl->v4l2_dev_str));
+	kfree(soc_info->soc_private);
+	kfree(e_ctrl->io_master_info.cci_client);
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(e_ctrl);
+}
+
+const static struct component_ops cam_eeprom_component_ops = {
+	.bind = cam_eeprom_component_bind,
+	.unbind = cam_eeprom_component_unbind,
+};
+
+static int32_t cam_eeprom_platform_driver_probe(
+	struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_EEPROM, "Adding EEPROM Sensor component");
+	rc = component_add(&pdev->dev, &cam_eeprom_component_ops);
+	if (rc)
+		CAM_ERR(CAM_EEPROM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_eeprom_platform_driver_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_eeprom_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_eeprom_dt_match[] = {
+	{ .compatible = "qcom,eeprom" },
+	{ }
+};
+
+
+MODULE_DEVICE_TABLE(of, cam_eeprom_dt_match);
+
+struct platform_driver cam_eeprom_platform_driver = {
+	.driver = {
+		.name = "qcom,eeprom",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_eeprom_dt_match,
+		.suppress_bind_attrs = true,
+	},
+	.probe = cam_eeprom_platform_driver_probe,
+	.remove = cam_eeprom_platform_driver_remove,
+};
+
+static const struct i2c_device_id cam_eeprom_i2c_id[] = {
+	{ EEPROM_DRIVER_I2C, (kernel_ulong_t)NULL},
+	{ }
+};
+
+static const struct of_device_id cam_eeprom_i2c_dt_match[] = {
+	{ .compatible = "qcom,cam-i2c-eeprom" },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(of, cam_eeprom_i2c_dt_match);
+
+struct i2c_driver cam_eeprom_i2c_driver = {
+	.id_table = cam_eeprom_i2c_id,
+	.probe  = cam_eeprom_i2c_driver_probe,
+	.remove = cam_eeprom_i2c_driver_remove,
+	.driver = {
+		.name = EEPROM_DRIVER_I2C,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_eeprom_i2c_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+static struct spi_driver cam_eeprom_spi_driver = {
+	.driver = {
+		.name = "qcom_eeprom",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_eeprom_dt_match,
+	},
+	.probe = cam_eeprom_spi_driver_probe,
+	.remove = cam_eeprom_spi_driver_remove,
+};
+
+static struct i3c_device_id eeprom_i3c_id[MAX_I3C_DEVICE_ID_ENTRIES + 1];
+
+static int cam_eeprom_i3c_driver_probe(struct i3c_device *client)
+{
+	int32_t rc = 0;
+	struct cam_eeprom_ctrl_t       *e_ctrl = NULL;
+	uint32_t                        index;
+	struct device                  *dev;
+
+	if (!client) {
+		CAM_INFO(CAM_EEPROM, "Null Client pointer");
+		return -EINVAL;
+	}
+
+	dev = &client->dev;
+
+	CAM_DBG(CAM_EEPROM, "Probe for I3C Slave %s", dev_name(dev));
+
+	rc = of_property_read_u32(dev->of_node, "cell-index", &index);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "device %s failed to read cell-index", dev_name(dev));
+		return rc;
+	}
+
+	if (index >= MAX_CAMERAS) {
+		CAM_ERR(CAM_EEPROM, "Invalid Cell-Index: %u for %s", index, dev_name(dev));
+		return -EINVAL;
+	}
+
+	e_ctrl = g_i3c_eeprom_data[index].e_ctrl;
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "e_ctrl is null. I3C Probe before platfom driver probe for %s",
+			dev_name(dev));
+		return -EINVAL;
+	}
+
+	e_ctrl->io_master_info.i3c_client = client;
+
+	complete_all(&g_i3c_eeprom_data[index].probe_complete);
+
+	CAM_DBG(CAM_EEPROM, "I3C Probe Finished for %s", dev_name(dev));
+	return rc;
+}
+
+static struct i3c_driver cam_eeprom_i3c_driver = {
+	.id_table = eeprom_i3c_id,
+	.probe = cam_eeprom_i3c_driver_probe,
+	.remove = cam_i3c_driver_remove,
+	.driver = {
+		.owner = THIS_MODULE,
+		.name = EEPROM_DRIVER_I3C,
+		.of_match_table = cam_eeprom_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_eeprom_driver_init(void)
+{
+	int rc = 0;
+	struct device_node                      *dev;
+	int num_entries = 0;
+
+	rc = platform_driver_register(&cam_eeprom_platform_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "platform_driver_register failed rc = %d",
+			rc);
+		return rc;
+	}
+
+	rc = spi_register_driver(&cam_eeprom_spi_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "spi_register_driver failed rc = %d", rc);
+		goto spi_register_err;
+	}
+
+	rc = i2c_add_driver(&cam_eeprom_i2c_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "i2c_add_driver failed rc = %d", rc);
+		goto i2c_register_err;
+	}
+
+	memset(eeprom_i3c_id, 0, sizeof(struct i3c_device_id) * (MAX_I3C_DEVICE_ID_ENTRIES + 1));
+
+	dev = of_find_node_by_name(NULL, I3C_SENSOR_DEV_ID_DT_NODE);
+	if (!dev) {
+		CAM_DBG(CAM_EEPROM, "Couldnt Find the i3c-id-table dev node");
+		return 0;
+	}
+
+	rc = cam_sensor_count_elems_i3c_device_id(dev, &num_entries,
+		"i3c-eeprom-id-table");
+	if (rc)
+		return 0;
+
+	rc = cam_sensor_fill_i3c_device_id(dev, num_entries,
+		"i3c-eeprom-id-table", eeprom_i3c_id);
+	if (rc)
+		goto i3c_register_err;
+
+	rc = i3c_driver_register_with_owner(&cam_eeprom_i3c_driver, THIS_MODULE);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "i3c_driver registration failed, rc: %d", rc);
+		goto i3c_register_err;
+	}
+
+	return 0;
+i3c_register_err:
+	i2c_del_driver(&cam_sensor_i2c_driver);
+i2c_register_err:
+	spi_unregister_driver(&cam_eeprom_spi_driver);
+spi_register_err:
+	platform_driver_unregister(&cam_sensor_platform_driver);
+
+	return rc;
+}
+
+void cam_eeprom_driver_exit(void)
+{
+	struct device_node *dev;
+
+	platform_driver_unregister(&cam_eeprom_platform_driver);
+	spi_unregister_driver(&cam_eeprom_spi_driver);
+	i2c_del_driver(&cam_eeprom_i2c_driver);
+
+	dev = of_find_node_by_name(NULL, I3C_SENSOR_DEV_ID_DT_NODE);
+	if (!dev) {
+		CAM_DBG(CAM_EEPROM, "Couldnt Find the i3c-id-table dev node");
+		return;
+	}
+
+	i3c_driver_unregister(&cam_eeprom_i3c_driver);
+}
+
+MODULE_DESCRIPTION("CAM EEPROM driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.h
@@ -0,0 +1,228 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAM_EEPROM_DEV_H_
+#define _CAM_EEPROM_DEV_H_
+
+#include <linux/i2c.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/gpio.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-ioctl.h>
+#include <cam_sensor_i2c.h>
+#include <cam_sensor_spi.h>
+#include <cam_sensor_io.h>
+#include <cam_cci_dev.h>
+#include <cam_req_mgr_util.h>
+#include <cam_req_mgr_interface.h>
+#include <cam_mem_mgr.h>
+#include <cam_subdev.h>
+#include <media/cam_sensor.h>
+#include "cam_soc_util.h"
+#include "cam_context.h"
+
+#define DEFINE_MSM_MUTEX(mutexname) \
+	static struct mutex mutexname = __MUTEX_INITIALIZER(mutexname)
+
+#define PROPERTY_MAXSIZE 32
+
+#define MSM_EEPROM_MEMORY_MAP_MAX_SIZE         80
+#define MSM_EEPROM_MAX_MEM_MAP_CNT             100
+#define MSM_EEPROM_MEM_MAP_PROPERTIES_CNT      8
+
+#define EEPROM_DRIVER_I2C                      "cam-i2c-eeprom"
+#define EEPROM_DRIVER_I3C                      "i3c_camera_eeprom"
+
+
+enum cam_eeprom_state {
+	CAM_EEPROM_INIT,
+	CAM_EEPROM_ACQUIRE,
+	CAM_EEPROM_CONFIG,
+};
+
+/**
+ * struct cam_eeprom_map_t - eeprom map
+ * @data_type       :   Data type
+ * @addr_type       :   Address type
+ * @addr            :   Address
+ * @data            :   data
+ * @delay           :   Delay
+ *
+ */
+struct cam_eeprom_map_t {
+	uint32_t valid_size;
+	uint32_t addr;
+	uint32_t addr_type;
+	uint32_t data;
+	uint32_t data_type;
+	uint32_t delay;
+};
+
+/**
+ * struct cam_eeprom_memory_map_t - eeprom memory map types
+ * @page            :   page memory
+ * @pageen          :   pageen memory
+ * @poll            :   poll memory
+ * @mem             :   mem
+ * @saddr           :   slave addr
+ *
+ */
+struct cam_eeprom_memory_map_t {
+	struct cam_eeprom_map_t page;
+	struct cam_eeprom_map_t pageen;
+	struct cam_eeprom_map_t poll;
+	struct cam_eeprom_map_t mem;
+	uint32_t saddr;
+};
+
+/**
+ * struct cam_eeprom_memory_block_t - eeprom mem block info
+ * @map             :   eeprom memory map
+ * @num_map         :   number of map blocks
+ * @mapdata         :   map data
+ * @cmd_type        :   size of total mapdata
+ *
+ */
+struct cam_eeprom_memory_block_t {
+	struct cam_eeprom_memory_map_t *map;
+	uint32_t num_map;
+	uint8_t *mapdata;
+	uint32_t num_data;
+};
+
+/**
+ * struct cam_eeprom_cmm_t - camera multimodule
+ * @cmm_support     :   cmm support flag
+ * @cmm_compression :   cmm compression flag
+ * @cmm_offset      :   cmm data start offset
+ * @cmm_size        :   cmm data size
+ *
+ */
+struct cam_eeprom_cmm_t {
+	uint32_t cmm_support;
+	uint32_t cmm_compression;
+	uint32_t cmm_offset;
+	uint32_t cmm_size;
+};
+
+/**
+ * struct cam_eeprom_i2c_info_t - I2C info
+ * @slave_addr      :   slave address
+ * @i2c_freq_mode   :   i2c frequency mode
+ *
+ */
+struct cam_eeprom_i2c_info_t {
+	uint16_t slave_addr;
+	uint8_t i2c_freq_mode;
+};
+
+/**
+ * struct cam_eeprom_soc_private - eeprom soc private data structure
+ * @eeprom_name     :   eeprom name
+ * @i2c_info        :   i2c info structure
+ * @power_info      :   eeprom power info
+ * @cmm_data        :   cmm data
+ *
+ */
+struct cam_eeprom_soc_private {
+	const char *eeprom_name;
+	struct cam_eeprom_i2c_info_t i2c_info;
+	struct cam_sensor_power_ctrl_t power_info;
+	struct cam_eeprom_cmm_t cmm_data;
+};
+
+/**
+ * struct cam_eeprom_intf_params - bridge interface params
+ * @device_hdl   : Device Handle
+ * @session_hdl  : Session Handle
+ * @ops          : KMD operations
+ * @crm_cb       : Callback API pointers
+ */
+struct cam_eeprom_intf_params {
+	int32_t device_hdl;
+	int32_t session_hdl;
+	int32_t link_hdl;
+	struct cam_req_mgr_kmd_ops ops;
+	struct cam_req_mgr_crm_cb *crm_cb;
+};
+
+struct eebin_info {
+	uint32_t start_address;
+	uint32_t size;
+	uint32_t is_valid;
+};
+
+/**
+ * struct cam_eeprom_ctrl_t - EEPROM control structure
+ * @device_name         :   Device name
+ * @pdev                :   platform device
+ * @spi                 :   spi device
+ * @eeprom_mutex        :   eeprom mutex
+ * @soc_info            :   eeprom soc related info
+ * @io_master_info      :   Information about the communication master
+ * @gpio_num_info       :   gpio info
+ * @cci_i2c_master      :   I2C structure
+ * @v4l2_dev_str        :   V4L2 device structure
+ * @is_i3c_device       :   A flag to indicate whether this eeprom is I3C device
+ * @bridge_intf         :   bridge interface params
+ * @cam_eeprom_state    :   eeprom_device_state
+ * @userspace_probe     :   flag indicates userspace or kernel probe
+ * @cal_data            :   Calibration data
+ * @device_name         :   Device name
+ * @is_multimodule_mode :   To identify multimodule node
+ * @wr_settings         :   I2C write settings
+ * @eebin_info          :   EEBIN address, size info
+ */
+struct cam_eeprom_ctrl_t {
+	char device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct platform_device *pdev;
+	struct spi_device *spi;
+	struct mutex eeprom_mutex;
+	struct cam_hw_soc_info soc_info;
+	struct camera_io_master io_master_info;
+	struct msm_camera_gpio_num_info *gpio_num_info;
+	enum cci_i2c_master_t cci_i2c_master;
+	enum cci_device_num cci_num;
+	struct cam_subdev v4l2_dev_str;
+	bool is_i3c_device;
+	struct cam_eeprom_intf_params bridge_intf;
+	enum msm_camera_device_type_t eeprom_device_type;
+	enum cam_eeprom_state cam_eeprom_state;
+	bool userspace_probe;
+	struct cam_eeprom_memory_block_t cal_data;
+	uint16_t is_multimodule_mode;
+	struct i2c_settings_array wr_settings;
+	struct eebin_info eebin_info;
+};
+
+int32_t cam_eeprom_update_i2c_info(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_eeprom_i2c_info_t *i2c_info);
+
+/**
+ * @brief : API to register EEPROM hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_eeprom_driver_init(void);
+
+/**
+ * @brief : API to remove EEPROM Hw from platform framework.
+ */
+void cam_eeprom_driver_exit(void);
+
+/**
+ * @brief : API to remove EEPROM spi driver form framework.
+ * @return : return 0 on success.
+ */
+int cam_eeprom_spi_driver_remove_common(struct spi_device *sdev);
+
+/**
+ * @brief : API to remove EEPROM i2c driver form framework.
+ * @return : return 0 on success.
+ */
+int cam_eeprom_i2c_driver_remove_common(struct i2c_client *client);
+
+#endif /*_CAM_EEPROM_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.c
@@ -0,0 +1,421 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_sensor_util.h>
+#include <cam_sensor_io.h>
+#include <cam_req_mgr_util.h>
+
+#include "cam_eeprom_soc.h"
+#include "cam_debug_util.h"
+
+#define cam_eeprom_spi_parse_cmd(spi_dev, name, out)          \
+	{                                                     \
+		spi_dev->cmd_tbl.name.opcode = out[0];        \
+		spi_dev->cmd_tbl.name.addr_len = out[1];      \
+		spi_dev->cmd_tbl.name.dummy_len = out[2];     \
+		spi_dev->cmd_tbl.name.delay_intv = out[3];    \
+		spi_dev->cmd_tbl.name.delay_count = out[4];   \
+	}
+
+int cam_eeprom_spi_parse_of(struct cam_sensor_spi_client *spi_dev)
+{
+	int rc = -EFAULT;
+	uint32_t tmp[5];
+
+	rc  = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-read", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, read, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get read data");
+		return -EFAULT;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-readseq", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, read_seq, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get readseq data");
+		return -EFAULT;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-queryid", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, query_id, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get queryid data");
+		return -EFAULT;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-pprog", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, page_program, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get page program data");
+		return -EFAULT;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-wenable", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, write_enable, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get write enable data");
+		return rc;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-readst", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, read_status, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get readdst data");
+		return rc;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-erase", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, erase, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get erase data");
+		return rc;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"eeprom-id", tmp, 2);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "Failed to get eeprom id");
+		return rc;
+	}
+
+	spi_dev->mfr_id0 = tmp[0];
+	spi_dev->device_id0 = tmp[1];
+
+	return 0;
+}
+
+/*
+ * cam_eeprom_parse_memory_map() - parse memory map in device node
+ * @of:         device node
+ * @data:       memory block for output
+ *
+ * This functions parses @of to fill @data.  It allocates map itself, parses
+ * the @of node, calculate total data length, and allocates required buffer.
+ * It only fills the map, but does not perform actual reading.
+ */
+int cam_eeprom_parse_dt_memory_map(struct device_node *node,
+	struct cam_eeprom_memory_block_t *data)
+{
+	int       i, rc = 0;
+	char      property[PROPERTY_MAXSIZE];
+	uint32_t  count = MSM_EEPROM_MEM_MAP_PROPERTIES_CNT;
+	struct    cam_eeprom_memory_map_t *map;
+
+	snprintf(property, PROPERTY_MAXSIZE, "num-blocks");
+	rc = of_property_read_u32(node, property, &data->num_map);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "failed: num-blocks not available rc %d",
+			rc);
+		return rc;
+	}
+
+	map = vzalloc((sizeof(*map) * data->num_map));
+	if (!map) {
+		rc = -ENOMEM;
+		return rc;
+	}
+	data->map = map;
+
+	for (i = 0; i < data->num_map; i++) {
+		snprintf(property, PROPERTY_MAXSIZE, "page%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].page, count);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "failed: page not available rc %d",
+				rc);
+			goto ERROR;
+		}
+
+		snprintf(property, PROPERTY_MAXSIZE, "pageen%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].pageen, count);
+		if (rc < 0)
+			CAM_DBG(CAM_EEPROM, "pageen not needed");
+
+		snprintf(property, PROPERTY_MAXSIZE, "saddr%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].saddr, 1);
+		if (rc < 0)
+			CAM_DBG(CAM_EEPROM, "saddr not needed - block %d", i);
+
+		snprintf(property, PROPERTY_MAXSIZE, "poll%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].poll, count);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "failed: poll not available rc %d",
+				rc);
+			goto ERROR;
+		}
+
+		snprintf(property, PROPERTY_MAXSIZE, "mem%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].mem, count);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "failed: mem not available rc %d",
+				rc);
+			goto ERROR;
+		}
+		data->num_data += map[i].mem.valid_size;
+	}
+
+	data->mapdata = vzalloc(data->num_data);
+	if (!data->mapdata) {
+		rc = -ENOMEM;
+		goto ERROR;
+	}
+	return rc;
+
+ERROR:
+	vfree(data->map);
+	memset(data, 0, sizeof(*data));
+	return rc;
+}
+
+/**
+ * @e_ctrl: ctrl structure
+ *
+ * Parses eeprom dt
+ */
+static int cam_eeprom_get_dt_data(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int                             rc = 0;
+	struct cam_hw_soc_info         *soc_info = &e_ctrl->soc_info;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+	struct device_node             *of_node = NULL;
+
+	of_node = soc_info->dev->of_node;
+
+	if (e_ctrl->userspace_probe == false) {
+		rc = cam_get_dt_power_setting_data(of_node,
+			soc_info, power_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "failed in getting power settings");
+			return rc;
+		}
+	}
+
+	if (!soc_info->gpio_data) {
+		CAM_INFO(CAM_EEPROM, "No GPIO found");
+		return 0;
+	}
+
+	if (!soc_info->gpio_data->cam_gpio_common_tbl_size) {
+		CAM_INFO(CAM_EEPROM, "No GPIO found");
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
+		&power_info->gpio_num_info);
+	if ((rc < 0) || (!power_info->gpio_num_info)) {
+		CAM_ERR(CAM_EEPROM, "No/Error EEPROM GPIOs");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+/**
+ * @eb_info: eeprom private data structure
+ * @of_node: eeprom device node
+ *
+ * This function parses the eeprom dt to get the MM data
+ */
+static int cam_eeprom_cmm_dts(struct cam_eeprom_soc_private *eb_info,
+	struct device_node *of_node)
+{
+	int                      rc = 0;
+	struct cam_eeprom_cmm_t *cmm_data = &eb_info->cmm_data;
+
+	cmm_data->cmm_support =
+		of_property_read_bool(of_node, "cmm-data-support");
+	if (!cmm_data->cmm_support) {
+		CAM_DBG(CAM_EEPROM, "No cmm support");
+		return 0;
+	}
+
+	cmm_data->cmm_compression =
+		of_property_read_bool(of_node, "cmm-data-compressed");
+
+	rc = of_property_read_u32(of_node, "cmm-data-offset",
+		&cmm_data->cmm_offset);
+	if (rc < 0)
+		CAM_DBG(CAM_EEPROM, "No MM offset data rc %d", rc);
+
+	rc = of_property_read_u32(of_node, "cmm-data-size",
+		&cmm_data->cmm_size);
+	if (rc < 0)
+		CAM_DBG(CAM_EEPROM, "No MM size data rc %d", rc);
+
+	CAM_DBG(CAM_EEPROM, "cmm_compr %d, cmm_offset %d, cmm_size %d",
+		cmm_data->cmm_compression, cmm_data->cmm_offset,
+		cmm_data->cmm_size);
+	return 0;
+}
+
+/**
+ * @e_ctrl: ctrl structure
+ *
+ * This function is called from cam_eeprom_platform/i2c/spi_driver_probe
+ * it parses the eeprom dt node and decides for userspace or kernel probe.
+ */
+int cam_eeprom_parse_dt(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int                             i, rc = 0;
+	struct cam_hw_soc_info         *soc_info = &e_ctrl->soc_info;
+	struct device_node             *of_node = NULL;
+	struct device_node             *of_parent = NULL;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	uint32_t                        temp;
+
+	if (!soc_info->dev) {
+		CAM_ERR(CAM_EEPROM, "Dev is NULL");
+		return -EINVAL;
+	}
+
+	e_ctrl->is_multimodule_mode = false;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "Failed to read DT properties rc : %d", rc);
+		return rc;
+	}
+
+	of_node = soc_info->dev->of_node;
+
+	rc = of_property_read_bool(of_node, "i3c-target");
+	if (rc) {
+		e_ctrl->is_i3c_device = true;
+		e_ctrl->io_master_info.master_type = I3C_MASTER;
+	}
+
+	CAM_DBG(CAM_SENSOR, "I3C Target: %s", CAM_BOOL_TO_YESNO(e_ctrl->is_i3c_device));
+
+	if (of_property_read_bool(of_node, "multimodule-support")) {
+		CAM_DBG(CAM_UTIL, "Multi Module is Supported");
+		e_ctrl->is_multimodule_mode = true;
+	}
+
+	rc = of_property_read_string(of_node, "eeprom-name",
+		&soc_private->eeprom_name);
+	if (rc < 0) {
+		CAM_DBG(CAM_EEPROM, "kernel probe is not enabled");
+		e_ctrl->userspace_probe = true;
+	}
+
+	if (e_ctrl->io_master_info.master_type == CCI_MASTER) {
+		rc = of_property_read_u32(of_node, "cci-master",
+			&e_ctrl->cci_i2c_master);
+		if (rc < 0 || (e_ctrl->cci_i2c_master >= MASTER_MAX)) {
+			CAM_DBG(CAM_EEPROM, "failed rc %d", rc);
+			rc = -EFAULT;
+			return rc;
+		}
+
+		of_parent = of_get_parent(of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&e_ctrl->cci_num) < 0)
+			/* Set default master 0 */
+			e_ctrl->cci_num = CCI_DEVICE_0;
+
+		e_ctrl->io_master_info.cci_client->cci_device = e_ctrl->cci_num;
+		CAM_DBG(CAM_EEPROM, "cci-index %d", e_ctrl->cci_num, rc);
+	}
+
+	if (e_ctrl->io_master_info.master_type == SPI_MASTER) {
+		rc = cam_eeprom_cmm_dts(soc_private, soc_info->dev->of_node);
+		if (rc < 0)
+			CAM_DBG(CAM_EEPROM, "MM data not available rc %d", rc);
+	}
+
+	rc = cam_eeprom_get_dt_data(e_ctrl);
+	if (rc < 0)
+		CAM_DBG(CAM_EEPROM, "failed: eeprom get dt data rc %d", rc);
+
+	if ((e_ctrl->userspace_probe == false) &&
+			(e_ctrl->io_master_info.master_type != SPI_MASTER)) {
+		rc = of_property_read_u32(of_node, "slave-addr", &temp);
+		if (rc < 0)
+			CAM_DBG(CAM_EEPROM, "failed: no slave-addr rc %d", rc);
+
+		soc_private->i2c_info.slave_addr = temp;
+
+		rc = of_property_read_u32(of_node, "i2c-freq-mode", &temp);
+		soc_private->i2c_info.i2c_freq_mode = temp;
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM,
+				"i2c-freq-mode read fail %d", rc);
+			soc_private->i2c_info.i2c_freq_mode = 0;
+		}
+		if (soc_private->i2c_info.i2c_freq_mode >= I2C_MAX_MODES) {
+			CAM_ERR(CAM_EEPROM, "invalid i2c_freq_mode = %d",
+				soc_private->i2c_info.i2c_freq_mode);
+			soc_private->i2c_info.i2c_freq_mode = 0;
+		}
+		CAM_DBG(CAM_EEPROM, "slave-addr = 0x%X",
+			soc_private->i2c_info.slave_addr);
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		soc_info->clk[i] = devm_clk_get(soc_info->dev,
+			soc_info->clk_name[i]);
+		if (IS_ERR(soc_info->clk[i])) {
+			CAM_ERR(CAM_EEPROM, "get failed for %s",
+				soc_info->clk_name[i]);
+			rc = -ENOENT;
+			return rc;
+		} else if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_EEPROM, "%s handle is NULL skip get",
+				soc_info->clk_name[i]);
+			continue;
+		}
+	}
+
+	/* Initialize regulators to default parameters */
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		soc_info->rgltr[i] = devm_regulator_get(soc_info->dev,
+					soc_info->rgltr_name[i]);
+		if (IS_ERR_OR_NULL(soc_info->rgltr[i])) {
+			rc = PTR_ERR(soc_info->rgltr[i]);
+			rc = rc ? rc : -EINVAL;
+			CAM_ERR(CAM_EEPROM, "get failed for regulator %s",
+				 soc_info->rgltr_name[i]);
+			return rc;
+		}
+		CAM_DBG(CAM_EEPROM, "get for regulator %s",
+			soc_info->rgltr_name[i]);
+	}
+
+	rc = cam_sensor_util_request_power_domain(soc_info);
+
+	return rc;
+}
+
+void cam_eeprom_release_power_domain(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	struct cam_hw_soc_info *soc_info = &e_ctrl->soc_info;
+
+	cam_sensor_util_release_power_domain(soc_info);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAM_EEPROM_SOC_H_
+#define _CAM_EEPROM_SOC_H_
+
+#include "cam_eeprom_dev.h"
+
+int cam_eeprom_spi_parse_of(struct cam_sensor_spi_client *client);
+
+int cam_eeprom_parse_dt_memory_map(struct device_node *of,
+	struct cam_eeprom_memory_block_t *data);
+
+int cam_eeprom_parse_dt(struct cam_eeprom_ctrl_t *e_ctrl);
+
+void cam_eeprom_release_power_domain(struct cam_eeprom_ctrl_t *e_ctrl);
+#endif/* _CAM_EEPROM_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_core.c
@@ -0,0 +1,1961 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+
+#include "cam_sensor_cmn_header.h"
+#include "cam_flash_core.h"
+#include "cam_res_mgr_api.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+
+int cam_flash_led_prepare(struct led_trigger *trigger, int options,
+	int *max_current, bool is_wled)
+{
+	int rc = 0;
+
+	if (is_wled) {
+#if IS_REACHABLE(CONFIG_BACKLIGHT_QCOM_SPMI_WLED)
+		rc = wled_flash_led_prepare(trigger, options, max_current);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "enable reg failed: rc: %d",
+				rc);
+			return rc;
+		}
+#else
+	return -EPERM;
+#endif
+	} else {
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2)
+		rc = qpnp_flash_led_prepare(trigger, options, max_current);
+#elif IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+		rc = qti_flash_led_prepare(trigger, options, max_current);
+#endif
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"Regulator enable failed rc = %d", rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_flash_pmic_flush_nrt(struct cam_flash_ctrl *fctrl)
+{
+	int j = 0;
+	struct cam_flash_frame_setting *nrt_settings;
+
+	if (!fctrl)
+		return -EINVAL;
+
+	nrt_settings = &fctrl->nrt_info;
+
+	if (nrt_settings->cmn_attr.cmd_type ==
+		CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO) {
+		fctrl->flash_init_setting.cmn_attr.is_settings_valid = false;
+	} else if ((nrt_settings->cmn_attr.cmd_type ==
+		CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET) ||
+		(nrt_settings->cmn_attr.cmd_type ==
+		CAMERA_SENSOR_FLASH_CMD_TYPE_RER) ||
+		(nrt_settings->cmn_attr.cmd_type ==
+		CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE)) {
+		fctrl->nrt_info.cmn_attr.is_settings_valid = false;
+		fctrl->nrt_info.cmn_attr.count = 0;
+		fctrl->nrt_info.num_iterations = 0;
+		fctrl->nrt_info.led_on_delay_ms = 0;
+		fctrl->nrt_info.led_off_delay_ms = 0;
+		for (j = 0; j < CAM_FLASH_MAX_LED_TRIGGERS; j++)
+			fctrl->nrt_info.led_current_ma[j] = 0;
+	}
+
+	return 0;
+}
+
+static int cam_flash_i2c_flush_nrt(struct cam_flash_ctrl *fctrl)
+{
+	int rc = 0;
+
+	if (fctrl->i2c_data.init_settings.is_settings_valid == true) {
+		rc = delete_request(&fctrl->i2c_data.init_settings);
+		if (rc) {
+			CAM_WARN(CAM_FLASH,
+				"Failed to delete Init i2c_setting: %d",
+				rc);
+			return rc;
+		}
+	}
+	if (fctrl->i2c_data.config_settings.is_settings_valid == true) {
+		rc = delete_request(&fctrl->i2c_data.config_settings);
+		if (rc) {
+			CAM_WARN(CAM_FLASH,
+				"Failed to delete NRT i2c_setting: %d",
+				rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_flash_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int rc = 0;
+
+	power_info->power_setting_size = 1;
+	power_info->power_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_setting)
+		return -ENOMEM;
+
+	power_info->power_setting[0].seq_type = SENSOR_CUSTOM_REG1;
+	power_info->power_setting[0].seq_val = CAM_V_CUSTOM1;
+	power_info->power_setting[0].config_val = 0;
+	power_info->power_setting[0].delay = 2;
+
+	power_info->power_down_setting_size = 1;
+	power_info->power_down_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_down_setting) {
+		rc = -ENOMEM;
+		goto free_power_settings;
+	}
+
+	power_info->power_down_setting[0].seq_type = SENSOR_CUSTOM_REG1;
+	power_info->power_down_setting[0].seq_val = CAM_V_CUSTOM1;
+	power_info->power_down_setting[0].config_val = 0;
+
+	return rc;
+
+free_power_settings:
+	kfree(power_info->power_setting);
+	power_info->power_setting = NULL;
+	power_info->power_setting_size = 0;
+	return rc;
+}
+
+int cam_flash_i2c_power_ops(struct cam_flash_ctrl *fctrl,
+	bool regulator_enable)
+{
+	int rc = 0;
+	struct cam_hw_soc_info *soc_info = &fctrl->soc_info;
+	struct cam_sensor_power_ctrl_t *power_info =
+		&fctrl->power_info;
+
+	if (!power_info || !soc_info) {
+		CAM_ERR(CAM_FLASH, "Power Info is NULL");
+		return -EINVAL;
+	}
+	power_info->dev = soc_info->dev;
+
+	if (regulator_enable && (fctrl->is_regulator_enabled == false)) {
+		if ((power_info->power_setting == NULL) &&
+			(power_info->power_down_setting == NULL)) {
+			CAM_INFO(CAM_FLASH,
+				"Using default power settings");
+			rc = cam_flash_construct_default_power_setting(
+					power_info);
+			if (rc < 0) {
+				CAM_ERR(CAM_FLASH,
+				"Construct default pwr setting failed rc: %d",
+				rc);
+				return rc;
+			}
+		}
+
+		rc = cam_sensor_core_power_up(power_info, soc_info, NULL);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "power up the core is failed:%d",
+				rc);
+			goto free_pwr_settings;
+		}
+
+		rc = camera_io_init(&(fctrl->io_master_info));
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "cci_init failed: rc: %d", rc);
+			cam_sensor_util_power_down(power_info, soc_info);
+			goto free_pwr_settings;
+		}
+		fctrl->is_regulator_enabled = true;
+	} else if ((!regulator_enable) &&
+		(fctrl->is_regulator_enabled == true)) {
+		rc = cam_sensor_util_power_down(power_info, soc_info);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "power down the core is failed:%d",
+				rc);
+			return rc;
+		}
+		camera_io_release(&(fctrl->io_master_info));
+		fctrl->is_regulator_enabled = false;
+		goto free_pwr_settings;
+	}
+	return rc;
+
+free_pwr_settings:
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_setting_size = 0;
+	power_info->power_down_setting_size = 0;
+
+	return rc;
+}
+
+int cam_flash_pmic_flush_request(struct cam_flash_ctrl *fctrl,
+	enum cam_flash_flush_type type, uint64_t req_id)
+{
+	int rc = 0;
+	int i = 0, j = 0;
+	int frame_offset = 0;
+	bool is_off_needed = false;
+	struct cam_flash_frame_setting *flash_data = NULL;
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	if (type == FLUSH_ALL) {
+	/* flush all requests*/
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			flash_data =
+				&fctrl->per_frame[i];
+			if ((flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_OFF) &&
+				(flash_data->cmn_attr.request_id > 0) &&
+				flash_data->cmn_attr.is_settings_valid) {
+				is_off_needed = true;
+				CAM_DBG(CAM_FLASH,
+					"FLASH_ALL: Turn off the flash for req %llu",
+					flash_data->cmn_attr.request_id);
+			}
+
+			flash_data->cmn_attr.request_id = 0;
+			flash_data->cmn_attr.is_settings_valid = false;
+			flash_data->cmn_attr.count = 0;
+			for (j = 0; j < CAM_FLASH_MAX_LED_TRIGGERS; j++)
+				flash_data->led_current_ma[j] = 0;
+		}
+
+		cam_flash_pmic_flush_nrt(fctrl);
+	} else if ((type == FLUSH_REQ) && (req_id != 0)) {
+	/* flush request with req_id*/
+		frame_offset = req_id % MAX_PER_FRAME_ARRAY;
+		flash_data =
+			&fctrl->per_frame[frame_offset];
+
+		if (flash_data->opcode ==
+			CAMERA_SENSOR_FLASH_OP_OFF) {
+			is_off_needed = true;
+			CAM_DBG(CAM_FLASH,
+				"FLASH_REQ: Turn off the flash for req %llu",
+				flash_data->cmn_attr.request_id);
+		}
+
+		flash_data->cmn_attr.request_id = 0;
+		flash_data->cmn_attr.is_settings_valid =
+			false;
+		flash_data->cmn_attr.count = 0;
+		for (i = 0; i < CAM_FLASH_MAX_LED_TRIGGERS; i++)
+			flash_data->led_current_ma[i] = 0;
+	} else if ((type == FLUSH_REQ) && (req_id == 0)) {
+		/* Handels NonRealTime usecase */
+		cam_flash_pmic_flush_nrt(fctrl);
+	} else {
+		CAM_ERR(CAM_FLASH, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (is_off_needed)
+		cam_flash_off(fctrl);
+
+	return rc;
+}
+
+int cam_flash_i2c_flush_request(struct cam_flash_ctrl *fctrl,
+	enum cam_flash_flush_type type, uint64_t req_id)
+{
+	int rc = 0;
+	int i = 0;
+	uint32_t cancel_req_id_found = 0;
+	struct i2c_settings_array *i2c_set = NULL;
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Device data is NULL");
+		return -EINVAL;
+	}
+	if ((type == FLUSH_REQ) && (req_id == 0)) {
+		/* This setting will be called only when NonRealTime
+		 * settings needs to clean.
+		 */
+		cam_flash_i2c_flush_nrt(fctrl);
+	} else {
+		/* All other usecase will be handle here */
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			i2c_set = &(fctrl->i2c_data.per_frame[i]);
+
+			if ((type == FLUSH_REQ) &&
+				(i2c_set->request_id != req_id))
+				continue;
+
+			if (i2c_set->is_settings_valid == 1) {
+				rc = delete_request(i2c_set);
+				if (rc < 0)
+					CAM_ERR(CAM_FLASH,
+						"delete request: %lld rc: %d",
+						i2c_set->request_id, rc);
+
+				if (type == FLUSH_REQ) {
+					cancel_req_id_found = 1;
+					break;
+				}
+			}
+		}
+	}
+
+	if ((type == FLUSH_REQ) && (req_id != 0) &&
+			(!cancel_req_id_found))
+		CAM_DBG(CAM_FLASH,
+			"Flush request id:%lld not found in the pending list",
+			req_id);
+
+	return rc;
+}
+
+int cam_flash_flush_request(struct cam_req_mgr_flush_request *flush)
+{
+	int rc = 0;
+	struct cam_flash_ctrl *fctrl = NULL;
+
+	fctrl = (struct cam_flash_ctrl *) cam_get_device_priv(flush->dev_hdl);
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&fctrl->flash_mutex);
+	if (fctrl->flash_state == CAM_FLASH_STATE_INIT)
+		goto end;
+
+	if (flush->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		fctrl->last_flush_req = flush->req_id;
+		CAM_DBG(CAM_FLASH, "last reqest to flush is %lld",
+			flush->req_id);
+		rc = fctrl->func_tbl.flush_req(fctrl, FLUSH_ALL, 0);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "FLUSH_TYPE_ALL failed rc: %d", rc);
+			goto end;
+		}
+	} else if (flush->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+		rc = fctrl->func_tbl.flush_req(fctrl,
+				FLUSH_REQ, flush->req_id);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "FLUSH_REQ failed rc: %d", rc);
+			goto end;
+		}
+	}
+end:
+	mutex_unlock(&fctrl->flash_mutex);
+	return rc;
+}
+
+static int cam_flash_ops(struct cam_flash_ctrl *flash_ctrl,
+	struct cam_flash_frame_setting *flash_data, enum camera_flash_opcode op)
+{
+	uint32_t curr = 0, max_current = 0;
+	struct cam_flash_private_soc *soc_private = NULL;
+	int i = 0;
+
+	if (!flash_ctrl || !flash_data) {
+		CAM_ERR(CAM_FLASH, "Fctrl or Data NULL");
+		return -EINVAL;
+	}
+
+	soc_private = (struct cam_flash_private_soc *)
+		flash_ctrl->soc_info.soc_private;
+
+	if (op == CAMERA_SENSOR_FLASH_OP_FIRELOW) {
+		for (i = 0; i < flash_ctrl->torch_num_sources; i++) {
+			if (flash_ctrl->torch_trigger[i]) {
+				max_current = soc_private->torch_max_current[i];
+				if (flash_data->led_current_ma[i] <=
+					max_current)
+					curr = flash_data->led_current_ma[i];
+				else
+					curr = max_current;
+			}
+			CAM_DBG(CAM_FLASH, "Led_Torch[%d]: Current: %d",
+				i, curr);
+			cam_res_mgr_led_trigger_event(
+				flash_ctrl->torch_trigger[i], curr);
+		}
+	} else if ((op == CAMERA_SENSOR_FLASH_OP_FIREHIGH) ||
+		(op == CAMERA_SENSOR_FLASH_OP_FIREDURATION)) {
+		for (i = 0; i < flash_ctrl->flash_num_sources; i++) {
+			if (flash_ctrl->flash_trigger[i]) {
+				max_current = soc_private->flash_max_current[i];
+				if (flash_data->led_current_ma[i] <=
+					max_current)
+					curr = flash_data->led_current_ma[i];
+				else
+					curr = max_current;
+			}
+			CAM_DBG(CAM_FLASH, "LED_Flash[%d]: Current: %d",
+				i, curr);
+			cam_res_mgr_led_trigger_event(
+				flash_ctrl->flash_trigger[i], curr);
+		}
+	} else {
+		CAM_ERR(CAM_FLASH, "Wrong Operation: %d", op);
+		return -EINVAL;
+	}
+
+	if (flash_ctrl->switch_trigger) {
+#if IS_ENABLED(CONFIG_LEDS_QTI_FLASH)
+		int rc = 0;
+
+		if (op == CAMERA_SENSOR_FLASH_OP_FIREDURATION) {
+			struct flash_led_param param;
+
+			param.off_time_ms =
+				flash_data->flash_active_time_ms;
+			param.on_time_ms = flash_data->flash_on_wait_time_ms;
+			CAM_DBG(CAM_FLASH,
+				"Precise flash_on time: %u, Precise flash_off time: %u",
+				param.on_time_ms, param.off_time_ms);
+			rc = qti_flash_led_set_param(
+				flash_ctrl->switch_trigger,
+				param);
+			if (rc) {
+				CAM_ERR(CAM_FLASH,
+					"LED set param fail rc= %d", rc);
+				return rc;
+			}
+		}
+#else
+		if (op == CAMERA_SENSOR_FLASH_OP_FIREDURATION) {
+			CAM_ERR(CAM_FLASH, "FIREDURATION op not supported");
+			return -EINVAL;
+		}
+#endif
+		cam_res_mgr_led_trigger_event(
+			flash_ctrl->switch_trigger,
+			(enum led_brightness)LED_SWITCH_ON);
+	}
+
+	return 0;
+}
+
+int cam_flash_off(struct cam_flash_ctrl *flash_ctrl)
+{
+	if (!flash_ctrl) {
+		CAM_ERR(CAM_FLASH, "Flash control Null");
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_FLASH, "Flash OFF Triggered");
+	if (flash_ctrl->switch_trigger)
+		cam_res_mgr_led_trigger_event(flash_ctrl->switch_trigger,
+			(enum led_brightness)LED_SWITCH_OFF);
+	return 0;
+}
+
+static int cam_flash_low(
+	struct cam_flash_ctrl *flash_ctrl,
+	struct cam_flash_frame_setting *flash_data)
+{
+	int i = 0, rc = 0;
+
+	if (!flash_data) {
+		CAM_ERR(CAM_FLASH, "Flash Data Null");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < flash_ctrl->flash_num_sources; i++)
+		if (flash_ctrl->flash_trigger[i])
+			cam_res_mgr_led_trigger_event(
+				flash_ctrl->flash_trigger[i],
+				LED_OFF);
+
+	rc = cam_flash_ops(flash_ctrl, flash_data,
+		CAMERA_SENSOR_FLASH_OP_FIRELOW);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Fire Torch failed: %d", rc);
+
+	return rc;
+}
+
+static int cam_flash_high(
+	struct cam_flash_ctrl *flash_ctrl,
+	struct cam_flash_frame_setting *flash_data)
+{
+	int i = 0, rc = 0;
+
+	if (!flash_data) {
+		CAM_ERR(CAM_FLASH, "Flash Data Null");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < flash_ctrl->torch_num_sources; i++)
+		if (flash_ctrl->torch_trigger[i])
+			cam_res_mgr_led_trigger_event(
+				flash_ctrl->torch_trigger[i],
+				LED_OFF);
+
+	rc = cam_flash_ops(flash_ctrl, flash_data,
+		CAMERA_SENSOR_FLASH_OP_FIREHIGH);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Fire Flash Failed: %d", rc);
+
+	return rc;
+}
+
+static int cam_flash_duration(struct cam_flash_ctrl *fctrl,
+	struct cam_flash_frame_setting *flash_data)
+{
+	int i = 0, rc = 0;
+
+	if (!flash_data) {
+		CAM_ERR(CAM_FLASH, "Flash Data NULL");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fctrl->torch_num_sources; i++)
+		if (fctrl->torch_trigger[i])
+			cam_res_mgr_led_trigger_event(
+				fctrl->torch_trigger[i],
+				LED_OFF);
+
+	rc = cam_flash_ops(fctrl, flash_data,
+		CAMERA_SENSOR_FLASH_OP_FIREDURATION);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Fire PreciseFlash Failed: %d", rc);
+
+	return rc;
+}
+
+static int cam_flash_i2c_delete_req(struct cam_flash_ctrl *fctrl,
+	uint64_t req_id)
+{
+	int i = 0, rc = 0;
+	uint64_t top = 0, del_req_id = 0;
+
+	if (req_id != 0) {
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			if ((req_id >=
+				fctrl->i2c_data.per_frame[i].request_id) &&
+				(top <
+				fctrl->i2c_data.per_frame[i].request_id) &&
+				(fctrl->i2c_data.per_frame[i].is_settings_valid
+					== 1)) {
+				del_req_id = top;
+				top = fctrl->i2c_data.per_frame[i].request_id;
+			}
+		}
+
+		if (top < req_id) {
+			if ((((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) >= BATCH_SIZE_MAX) ||
+				(((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) <= -BATCH_SIZE_MAX))
+				del_req_id = req_id;
+		}
+
+		if (!del_req_id)
+			return rc;
+
+		CAM_DBG(CAM_FLASH, "top: %llu, del_req_id:%llu",
+			top, del_req_id);
+	}
+
+	cam_flash_i2c_flush_nrt(fctrl);
+
+	return 0;
+}
+
+static int cam_flash_pmic_delete_req(struct cam_flash_ctrl *fctrl,
+	uint64_t req_id)
+{
+	int i = 0;
+	struct cam_flash_frame_setting *flash_data = NULL;
+	uint64_t top = 0, del_req_id = 0;
+	int frame_offset = 0;
+
+	if (req_id != 0) {
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			flash_data = &fctrl->per_frame[i];
+			if (req_id >= flash_data->cmn_attr.request_id &&
+				flash_data->cmn_attr.is_settings_valid
+				== 1) {
+				if (top < flash_data->cmn_attr.request_id) {
+					del_req_id = top;
+					top = flash_data->cmn_attr.request_id;
+				} else if (top >
+					flash_data->cmn_attr.request_id &&
+					del_req_id <
+					flash_data->cmn_attr.request_id) {
+					del_req_id =
+						flash_data->cmn_attr.request_id;
+				}
+			}
+		}
+
+		if (top < req_id) {
+			if ((((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) >= BATCH_SIZE_MAX) ||
+				(((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) <= -BATCH_SIZE_MAX))
+				del_req_id = req_id;
+		}
+
+		if (!del_req_id)
+			return 0;
+
+		CAM_DBG(CAM_FLASH, "top: %llu, del_req_id:%llu",
+			top, del_req_id);
+	}
+
+	/* delete the request */
+	frame_offset = del_req_id % MAX_PER_FRAME_ARRAY;
+	flash_data = &fctrl->per_frame[frame_offset];
+	flash_data->cmn_attr.request_id = 0;
+	flash_data->cmn_attr.is_settings_valid = false;
+	flash_data->cmn_attr.count = 0;
+
+	for (i = 0; i < CAM_FLASH_MAX_LED_TRIGGERS; i++)
+		flash_data->led_current_ma[i] = 0;
+
+	return 0;
+}
+
+static int32_t cam_flash_slaveInfo_pkt_parser(struct cam_flash_ctrl *fctrl,
+	uint32_t *cmd_buf, size_t len)
+{
+	int32_t rc = 0;
+	struct cam_cmd_i2c_info *i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+
+	if (len < sizeof(struct cam_cmd_i2c_info)) {
+		CAM_ERR(CAM_FLASH, "Not enough buffer");
+		return -EINVAL;
+	}
+	if (fctrl->io_master_info.master_type == CCI_MASTER) {
+		fctrl->io_master_info.cci_client->cci_i2c_master =
+			fctrl->cci_i2c_master;
+		fctrl->io_master_info.cci_client->i2c_freq_mode =
+			i2c_info->i2c_freq_mode;
+		fctrl->io_master_info.cci_client->sid =
+			i2c_info->slave_addr >> 1;
+		CAM_DBG(CAM_FLASH, "Slave addr: 0x%x Freq Mode: %d",
+			i2c_info->slave_addr, i2c_info->i2c_freq_mode);
+	} else if (fctrl->io_master_info.master_type == I2C_MASTER) {
+		fctrl->io_master_info.client->addr = i2c_info->slave_addr;
+		CAM_DBG(CAM_FLASH, "Slave addr: 0x%x", i2c_info->slave_addr);
+	} else {
+		CAM_ERR(CAM_FLASH, "Invalid Master type: %d",
+			fctrl->io_master_info.master_type);
+		 rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int cam_flash_i2c_apply_setting(struct cam_flash_ctrl *fctrl,
+	uint64_t req_id)
+{
+	struct i2c_settings_list *i2c_list;
+	struct i2c_settings_array *i2c_set = NULL;
+	int frame_offset = 0, rc = 0;
+
+	if (req_id == 0) {
+		/* NonRealTime Init settings*/
+		if (fctrl->i2c_data.init_settings.is_settings_valid == true) {
+			list_for_each_entry(i2c_list,
+				&(fctrl->i2c_data.init_settings.list_head),
+				list) {
+				rc = cam_sensor_util_i2c_apply_setting
+					(&(fctrl->io_master_info), i2c_list);
+				if ((rc == -EAGAIN) &&
+					(fctrl->io_master_info.master_type ==
+					CCI_MASTER)) {
+					CAM_WARN(CAM_FLASH,
+						"CCI HW is in reset mode: Reapplying Init settings");
+					usleep_range(1000, 1010);
+					rc = cam_sensor_util_i2c_apply_setting
+					(&(fctrl->io_master_info), i2c_list);
+				}
+
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"Failed to apply init settings: %d",
+					rc);
+					return rc;
+				}
+			}
+		}
+		/* NonRealTime (Widget/RER/INIT_FIRE settings) */
+		if (fctrl->i2c_data.config_settings.is_settings_valid == true) {
+			list_for_each_entry(i2c_list,
+				&(fctrl->i2c_data.config_settings.list_head),
+				list) {
+				rc = cam_sensor_util_i2c_apply_setting
+					(&(fctrl->io_master_info), i2c_list);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"Failed to apply NRT settings: %d", rc);
+					return rc;
+				}
+			}
+		}
+	} else {
+		/* RealTime */
+		frame_offset = req_id % MAX_PER_FRAME_ARRAY;
+		i2c_set = &fctrl->i2c_data.per_frame[frame_offset];
+		if ((i2c_set->is_settings_valid == true) &&
+			(i2c_set->request_id == req_id)) {
+			list_for_each_entry(i2c_list,
+				&(i2c_set->list_head), list) {
+				rc = cam_sensor_util_i2c_apply_setting(
+					&(fctrl->io_master_info), i2c_list);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"Failed to apply settings: %d", rc);
+					return rc;
+				}
+			}
+		}
+	}
+
+	cam_flash_i2c_delete_req(fctrl, req_id);
+	return rc;
+}
+
+int cam_flash_pmic_apply_setting(struct cam_flash_ctrl *fctrl,
+	uint64_t req_id)
+{
+	int rc = 0, i = 0;
+	int frame_offset = 0;
+	uint16_t num_iterations;
+	struct cam_flash_frame_setting *flash_data = NULL;
+
+	if (req_id == 0) {
+		if (fctrl->nrt_info.cmn_attr.cmd_type ==
+			CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE) {
+			flash_data = &fctrl->nrt_info;
+			CAM_DBG(CAM_REQ,
+				"FLASH_INIT_FIRE req_id: %u flash_opcode: %d",
+				req_id, flash_data->opcode);
+
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_FIREHIGH) {
+				if (fctrl->flash_state ==
+					CAM_FLASH_STATE_START) {
+					CAM_WARN(CAM_FLASH,
+					"Wrong state :Prev state: %d",
+					fctrl->flash_state);
+				}
+
+				rc = cam_flash_high(fctrl, flash_data);
+				if (rc)
+					CAM_ERR(CAM_FLASH,
+						"FLASH ON failed : %d", rc);
+			}
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_FIRELOW) {
+				if (fctrl->flash_state ==
+					CAM_FLASH_STATE_START) {
+					CAM_WARN(CAM_FLASH,
+					"Wrong state :Prev state: %d",
+					fctrl->flash_state);
+				}
+
+				rc = cam_flash_low(fctrl, flash_data);
+				if (rc)
+					CAM_ERR(CAM_FLASH,
+						"TORCH ON failed : %d", rc);
+			}
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_OFF) {
+				rc = cam_flash_off(fctrl);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"LED OFF FAILED: %d",
+					rc);
+					return rc;
+				}
+			}
+		} else if (fctrl->nrt_info.cmn_attr.cmd_type ==
+			CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET) {
+			flash_data = &fctrl->nrt_info;
+			CAM_DBG(CAM_REQ,
+				"FLASH_WIDGET req_id: %u flash_opcode: %d",
+				req_id, flash_data->opcode);
+
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_FIRELOW) {
+				rc = cam_flash_low(fctrl, flash_data);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Torch ON failed : %d",
+						rc);
+					goto nrt_del_req;
+				}
+			} else if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_OFF) {
+				rc = cam_flash_off(fctrl);
+				if (rc)
+					CAM_ERR(CAM_FLASH,
+					"LED off failed: %d",
+					rc);
+			}
+		} else if (fctrl->nrt_info.cmn_attr.cmd_type ==
+			CAMERA_SENSOR_FLASH_CMD_TYPE_RER) {
+			flash_data = &fctrl->nrt_info;
+			if (fctrl->flash_state != CAM_FLASH_STATE_START) {
+				rc = cam_flash_off(fctrl);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Flash off failed: %d",
+						rc);
+					goto nrt_del_req;
+				}
+			}
+			CAM_DBG(CAM_REQ, "FLASH_RER req_id: %u", req_id);
+
+			num_iterations = flash_data->num_iterations;
+			for (i = 0; i < num_iterations; i++) {
+				/* Turn On Torch */
+				if (fctrl->flash_state ==
+					CAM_FLASH_STATE_START) {
+					rc = cam_flash_low(fctrl, flash_data);
+					if (rc) {
+						CAM_ERR(CAM_FLASH,
+							"Fire Torch Failed");
+						goto nrt_del_req;
+					}
+
+					usleep_range(
+					flash_data->led_on_delay_ms * 1000,
+					flash_data->led_on_delay_ms * 1000 +
+						100);
+				}
+				/* Turn Off Torch */
+				rc = cam_flash_off(fctrl);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Flash off failed: %d", rc);
+					continue;
+				}
+				fctrl->flash_state = CAM_FLASH_STATE_START;
+				usleep_range(
+				flash_data->led_off_delay_ms * 1000,
+				flash_data->led_off_delay_ms * 1000 + 100);
+			}
+		}
+	} else {
+		frame_offset = req_id % MAX_PER_FRAME_ARRAY;
+		flash_data = &fctrl->per_frame[frame_offset];
+		CAM_DBG(CAM_REQ, "FLASH_RT req_id: %u flash_opcode: %d",
+			req_id, flash_data->opcode);
+
+		if ((flash_data->opcode == CAMERA_SENSOR_FLASH_OP_FIREHIGH) &&
+			(flash_data->cmn_attr.is_settings_valid) &&
+			(flash_data->cmn_attr.request_id == req_id)) {
+			/* Turn On Flash */
+			if (fctrl->flash_state == CAM_FLASH_STATE_START) {
+				rc = cam_flash_high(fctrl, flash_data);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Flash ON failed: rc= %d",
+						rc);
+					goto apply_setting_err;
+				}
+			}
+		} else if ((flash_data->opcode ==
+			CAMERA_SENSOR_FLASH_OP_FIRELOW) &&
+			(flash_data->cmn_attr.is_settings_valid) &&
+			(flash_data->cmn_attr.request_id == req_id)) {
+			/* Turn On Torch */
+			if (fctrl->flash_state == CAM_FLASH_STATE_START) {
+				rc = cam_flash_low(fctrl, flash_data);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Torch ON failed: rc= %d",
+						rc);
+					goto apply_setting_err;
+				}
+			}
+		} else if ((flash_data->opcode == CAMERA_SENSOR_FLASH_OP_OFF) &&
+			(flash_data->cmn_attr.is_settings_valid) &&
+			(flash_data->cmn_attr.request_id == req_id)) {
+			rc = cam_flash_off(fctrl);
+			if (rc) {
+				CAM_ERR(CAM_FLASH,
+					"Flash off failed %d", rc);
+				goto apply_setting_err;
+			}
+		} else if ((flash_data->opcode ==
+			CAMERA_SENSOR_FLASH_OP_FIREDURATION) &&
+			(flash_data->cmn_attr.is_settings_valid) &&
+			(flash_data->cmn_attr.request_id == req_id)) {
+			if (fctrl->flash_state == CAM_FLASH_STATE_START) {
+				rc = cam_flash_duration(fctrl, flash_data);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"PreciaseFlash op failed:%d",
+						rc);
+					goto apply_setting_err;
+				}
+			}
+		} else if (flash_data->opcode == CAM_PKT_NOP_OPCODE) {
+			CAM_DBG(CAM_FLASH, "NOP Packet");
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_FLASH, "Invalid opcode: %d req_id: %llu",
+				flash_data->opcode, req_id);
+			goto apply_setting_err;
+		}
+	}
+
+nrt_del_req:
+	cam_flash_pmic_delete_req(fctrl, req_id);
+apply_setting_err:
+	return rc;
+}
+
+int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
+{
+	int rc = 0, i = 0;
+	uintptr_t generic_ptr;
+	uint32_t total_cmd_buf_in_bytes = 0;
+	uint32_t *cmd_buf =  NULL;
+	uint32_t *offset = NULL;
+	uint32_t frm_offset = 0;
+	size_t len_of_buffer;
+	size_t remain_len;
+	struct cam_flash_init *flash_init = NULL;
+	struct common_header  *cmn_hdr = NULL;
+	struct cam_control *ioctl_ctrl = NULL;
+	struct cam_packet *csl_packet = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct cam_config_dev_cmd config;
+	struct cam_req_mgr_add_request add_req;
+	struct i2c_settings_array *i2c_reg_settings = NULL;
+	struct cam_sensor_power_ctrl_t *power_info = NULL;
+
+	if (!fctrl || !arg) {
+		CAM_ERR(CAM_FLASH, "fctrl/arg is NULL");
+		return -EINVAL;
+	}
+	/* getting CSL Packet */
+	ioctl_ctrl = (struct cam_control *)arg;
+
+	if (copy_from_user((&config), (void __user *) ioctl_ctrl->handle,
+		sizeof(config))) {
+		CAM_ERR(CAM_FLASH, "Copy cmd handle from user failed");
+		return -EFAULT;
+	}
+
+	rc = cam_mem_get_cpu_buf(config.packet_handle,
+		&generic_ptr, &len_of_buffer);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "Failed in getting the packet : %d", rc);
+		return rc;
+	}
+	remain_len = len_of_buffer;
+	if ((sizeof(struct cam_packet) > len_of_buffer) ||
+		((size_t)config.offset >= len_of_buffer -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_FLASH,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len_of_buffer);
+		cam_mem_put_cpu_buf(config.packet_handle);
+		return -EINVAL;
+	}
+
+	remain_len -= (size_t)config.offset;
+	/* Add offset to the flash csl header */
+	csl_packet = (struct cam_packet *)(generic_ptr + config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_FLASH, "Invalid packet params");
+		cam_mem_put_cpu_buf(config.packet_handle);
+		return -EINVAL;
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) !=
+		CAM_FLASH_PACKET_OPCODE_INIT &&
+		csl_packet->header.request_id <= fctrl->last_flush_req
+		&& fctrl->last_flush_req != 0) {
+		CAM_DBG(CAM_FLASH,
+			"reject request %lld, last request to flush %lld",
+			csl_packet->header.request_id, fctrl->last_flush_req);
+		cam_mem_put_cpu_buf(config.packet_handle);
+		return -EBADR;
+	}
+
+	if (csl_packet->header.request_id > fctrl->last_flush_req)
+		fctrl->last_flush_req = 0;
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_FLASH_PACKET_OPCODE_INIT: {
+		/* INIT packet*/
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+		/* Loop through multiple command buffers */
+		for (i = 1; i < csl_packet->num_cmd_buf; i++) {
+			rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+			if (rc)
+				return rc;
+
+			total_cmd_buf_in_bytes = cmd_desc[i].length;
+			if (!total_cmd_buf_in_bytes)
+				continue;
+			rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+				&generic_ptr, &len_of_buffer);
+			if (rc < 0) {
+				cam_mem_put_cpu_buf(config.packet_handle);
+				CAM_ERR(CAM_FLASH, "Failed to get cpu buf");
+				return rc;
+			}
+			cmd_buf = (uint32_t *)generic_ptr;
+			if (!cmd_buf) {
+				CAM_ERR(CAM_FLASH, "invalid cmd buf");
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return -EINVAL;
+			}
+
+			if ((len_of_buffer < sizeof(struct common_header)) ||
+				(cmd_desc[i].offset >
+				(len_of_buffer -
+				sizeof(struct common_header)))) {
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				CAM_ERR(CAM_FLASH, "invalid cmd buf length");
+				return -EINVAL;
+			}
+			remain_len = len_of_buffer - cmd_desc[i].offset;
+			cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+			cmn_hdr = (struct common_header *)cmd_buf;
+
+			/* Loop through cmd formats in one cmd buffer */
+			CAM_DBG(CAM_FLASH,
+				"command Type: %d,Total: %d",
+				cmn_hdr->cmd_type, total_cmd_buf_in_bytes);
+			switch (cmn_hdr->cmd_type) {
+			case CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO:
+				if (len_of_buffer <
+					sizeof(struct cam_flash_init)) {
+					CAM_ERR(CAM_FLASH, "Not enough buffer");
+					cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+					cam_mem_put_cpu_buf(config.packet_handle);
+					return -EINVAL;
+				}
+
+				flash_init = (struct cam_flash_init *)cmd_buf;
+				fctrl->flash_type = flash_init->flash_type;
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				rc = cam_flash_slaveInfo_pkt_parser(
+					fctrl, cmd_buf, remain_len);
+				if (rc < 0) {
+					CAM_ERR(CAM_FLASH,
+					"Failed parsing slave info: rc: %d",
+					rc);
+					cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+					cam_mem_put_cpu_buf(config.packet_handle);
+					return rc;
+				}
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
+			case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
+				CAM_DBG(CAM_FLASH,
+					"Received power settings");
+				rc = cam_sensor_update_power_settings(
+					cmd_buf,
+					total_cmd_buf_in_bytes,
+					&fctrl->power_info, remain_len);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"Failed update power settings");
+					cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+					cam_mem_put_cpu_buf(config.packet_handle);
+					return rc;
+				}
+				break;
+			default:
+				CAM_DBG(CAM_FLASH,
+					"Received initSettings");
+				i2c_reg_settings =
+					&fctrl->i2c_data.init_settings;
+
+				i2c_reg_settings->request_id = 0;
+				i2c_reg_settings->is_settings_valid = 1;
+				rc = cam_sensor_i2c_command_parser(
+					&fctrl->io_master_info,
+					i2c_reg_settings,
+					&cmd_desc[i], 1, NULL);
+				if (rc < 0) {
+					CAM_ERR(CAM_FLASH,
+					"pkt parsing failed: %d", rc);
+					cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+					cam_mem_put_cpu_buf(config.packet_handle);
+					return rc;
+				}
+				break;
+			}
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+		}
+		power_info = &fctrl->power_info;
+		if (!power_info) {
+			CAM_ERR(CAM_FLASH, "Power_info is NULL");
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return -EINVAL;
+		}
+
+		/* Parse and fill vreg params for power up settings */
+		rc = msm_camera_fill_vreg_params(&fctrl->soc_info,
+			power_info->power_setting,
+			power_info->power_setting_size);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"failed to fill vreg params for power up rc:%d",
+				rc);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+
+		/* Parse and fill vreg params for power down settings*/
+		rc = msm_camera_fill_vreg_params(
+			&fctrl->soc_info,
+			power_info->power_down_setting,
+			power_info->power_down_setting_size);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"failed to fill vreg params power down rc:%d",
+				rc);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+
+		rc = fctrl->func_tbl.power_ops(fctrl, true);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"Enable Regulator Failed rc = %d", rc);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+
+		rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "cannot apply settings rc = %d", rc);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+
+		fctrl->flash_state = CAM_FLASH_STATE_CONFIG;
+		break;
+	}
+	case CAM_FLASH_PACKET_OPCODE_SET_OPS: {
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		frm_offset = csl_packet->header.request_id %
+			MAX_PER_FRAME_ARRAY;
+		/* add support for handling i2c_data*/
+		i2c_reg_settings =
+			&fctrl->i2c_data.per_frame[frm_offset];
+		if (i2c_reg_settings->is_settings_valid == true) {
+			i2c_reg_settings->request_id = 0;
+			i2c_reg_settings->is_settings_valid = false;
+			goto update_req_mgr;
+		}
+		i2c_reg_settings->is_settings_valid = true;
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_sensor_i2c_command_parser(
+			&fctrl->io_master_info,
+			i2c_reg_settings, cmd_desc, 1, NULL);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+			"Failed in parsing i2c packets");
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+		break;
+	}
+	case CAM_FLASH_PACKET_OPCODE_NON_REALTIME_SET_OPS: {
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+
+		/* add support for handling i2c_data*/
+		i2c_reg_settings = &fctrl->i2c_data.config_settings;
+		if (i2c_reg_settings->is_settings_valid == true) {
+			i2c_reg_settings->request_id = 0;
+			i2c_reg_settings->is_settings_valid = false;
+
+			rc = delete_request(i2c_reg_settings);
+			if (rc) {
+				CAM_ERR(CAM_FLASH,
+				"Failed in Deleting the err: %d", rc);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+		}
+		i2c_reg_settings->is_settings_valid = true;
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_sensor_i2c_command_parser(
+			&fctrl->io_master_info,
+			i2c_reg_settings, cmd_desc, 1, NULL);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+			"Failed in parsing i2c NRT packets");
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+		rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+		if (rc)
+			CAM_ERR(CAM_FLASH,
+			"Apply setting failed: %d", rc);
+		cam_mem_put_cpu_buf(config.packet_handle);
+		return rc;
+	}
+	case CAM_PKT_NOP_OPCODE: {
+		if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_ACQUIRE)) {
+			CAM_WARN(CAM_FLASH,
+				"Rxed NOP packets without linking");
+			frm_offset = csl_packet->header.request_id %
+				MAX_PER_FRAME_ARRAY;
+			fctrl->i2c_data.per_frame[frm_offset].is_settings_valid
+				= false;
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return 0;
+		}
+
+		CAM_DBG(CAM_FLASH, "NOP Packet is Received: req_id: %u",
+			csl_packet->header.request_id);
+		goto update_req_mgr;
+	}
+	default:
+		CAM_ERR(CAM_FLASH, "Wrong Opcode : %d",
+			(csl_packet->header.op_code & 0xFFFFFF));
+		cam_mem_put_cpu_buf(config.packet_handle);
+		return -EINVAL;
+	}
+update_req_mgr:
+	if (((csl_packet->header.op_code  & 0xFFFFF) ==
+		CAM_PKT_NOP_OPCODE) ||
+		((csl_packet->header.op_code & 0xFFFFF) ==
+		CAM_FLASH_PACKET_OPCODE_SET_OPS)) {
+		memset(&add_req, 0, sizeof(add_req));
+		add_req.link_hdl = fctrl->bridge_intf.link_hdl;
+		add_req.req_id = csl_packet->header.request_id;
+		add_req.dev_hdl = fctrl->bridge_intf.device_hdl;
+
+		if ((csl_packet->header.op_code & 0xFFFFF) ==
+			CAM_FLASH_PACKET_OPCODE_SET_OPS) {
+			add_req.trigger_eof = true;
+			add_req.skip_at_sof = 1;
+		}
+
+		if (fctrl->bridge_intf.crm_cb &&
+			fctrl->bridge_intf.crm_cb->add_req) {
+			rc = fctrl->bridge_intf.crm_cb->add_req(&add_req);
+			if  (rc) {
+				if (rc == -EBADR)
+					CAM_INFO(CAM_FLASH,
+						"Failed in adding request: %llu to request manager, it has been flushed",
+						csl_packet->header.request_id);
+				else
+					CAM_ERR(CAM_FLASH,
+						"Failed in adding request: %llu to request manager",
+						csl_packet->header.request_id);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+			CAM_DBG(CAM_FLASH,
+				"add req %lld to req_mgr, trigger_eof %d",
+				add_req.req_id, add_req.trigger_eof);
+		}
+	}
+	cam_mem_put_cpu_buf(config.packet_handle);
+	return rc;
+}
+
+int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
+{
+	int rc = 0, i = 0;
+	uintptr_t generic_ptr, cmd_buf_ptr;
+	uint32_t *cmd_buf =  NULL;
+	uint32_t *offset = NULL;
+	uint32_t frm_offset = 0;
+	size_t len_of_buffer;
+	size_t remain_len;
+	struct cam_control *ioctl_ctrl = NULL;
+	struct cam_packet *csl_packet = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct common_header *cmn_hdr;
+	struct cam_config_dev_cmd config;
+	struct cam_req_mgr_add_request add_req = {0};
+	struct cam_flash_init *cam_flash_info = NULL;
+	struct cam_flash_set_rer *flash_rer_info = NULL;
+	struct cam_flash_set_on_off *flash_operation_info = NULL;
+	struct cam_flash_query_curr *flash_query_info = NULL;
+	struct cam_flash_frame_setting *flash_data = NULL;
+	struct cam_flash_private_soc *soc_private = NULL;
+
+	if (!fctrl || !arg) {
+		CAM_ERR(CAM_FLASH, "fctrl/arg is NULL");
+		return -EINVAL;
+	}
+
+	soc_private = (struct cam_flash_private_soc *)
+		fctrl->soc_info.soc_private;
+
+	/* getting CSL Packet */
+	ioctl_ctrl = (struct cam_control *)arg;
+
+	if (copy_from_user((&config),
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(config))) {
+		CAM_ERR(CAM_FLASH, "Copy cmd handle from user failed");
+		rc = -EFAULT;
+		return rc;
+	}
+
+	rc = cam_mem_get_cpu_buf(config.packet_handle,
+		&generic_ptr, &len_of_buffer);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "Failed in getting the packet: %d", rc);
+		return rc;
+	}
+
+	remain_len = len_of_buffer;
+	if ((sizeof(struct cam_packet) > len_of_buffer) ||
+		((size_t)config.offset >= len_of_buffer -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_FLASH,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len_of_buffer);
+		cam_mem_put_cpu_buf(config.packet_handle);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	remain_len -= (size_t)config.offset;
+	/* Add offset to the flash csl header */
+	csl_packet = (struct cam_packet *)(generic_ptr + config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_FLASH, "Invalid packet params");
+		cam_mem_put_cpu_buf(config.packet_handle);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) !=
+		CAM_FLASH_PACKET_OPCODE_INIT &&
+		csl_packet->header.request_id <= fctrl->last_flush_req
+		&& fctrl->last_flush_req != 0) {
+		CAM_WARN(CAM_FLASH,
+			"reject request %lld, last request to flush %d",
+			csl_packet->header.request_id, fctrl->last_flush_req);
+		cam_mem_put_cpu_buf(config.packet_handle);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (csl_packet->header.request_id > fctrl->last_flush_req)
+		fctrl->last_flush_req = 0;
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_FLASH_PACKET_OPCODE_INIT: {
+		/* INIT packet*/
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+			&cmd_buf_ptr, &len_of_buffer);
+		if (rc) {
+			cam_mem_put_cpu_buf(config.packet_handle);
+			CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
+			return rc;
+		}
+		if ((len_of_buffer < sizeof(struct cam_flash_init)) ||
+			(cmd_desc->offset >
+			(len_of_buffer - sizeof(struct cam_flash_init)))) {
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			CAM_ERR(CAM_FLASH, "Not enough buffer");
+			rc = -EINVAL;
+			return rc;
+		}
+		remain_len = len_of_buffer - cmd_desc->offset;
+		cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
+			cmd_desc->offset);
+		cam_flash_info = (struct cam_flash_init *)cmd_buf;
+
+		switch (cam_flash_info->cmd_type) {
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO: {
+			CAM_DBG(CAM_FLASH, "INIT_INFO CMD CALLED");
+			fctrl->flash_init_setting.cmn_attr.request_id = 0;
+			fctrl->flash_init_setting.cmn_attr.is_settings_valid =
+				true;
+			fctrl->flash_type = cam_flash_info->flash_type;
+			fctrl->is_regulator_enabled = false;
+			fctrl->nrt_info.cmn_attr.cmd_type =
+				CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO;
+
+			fctrl->flash_state =
+				CAM_FLASH_STATE_CONFIG;
+			break;
+		}
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE: {
+			CAM_INFO(CAM_FLASH, "INIT_FIRE Operation for dev_hdl: 0x%x",
+				fctrl->bridge_intf.device_hdl);
+
+			if (remain_len < sizeof(struct cam_flash_set_on_off)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+
+			flash_operation_info =
+				(struct cam_flash_set_on_off *) cmd_buf;
+			if (!flash_operation_info) {
+				CAM_ERR(CAM_FLASH,
+					"flash_operation_info Null");
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				rc = -EINVAL;
+				return rc;
+			}
+			if (flash_operation_info->count >
+				CAM_FLASH_MAX_LED_TRIGGERS) {
+				CAM_ERR(CAM_FLASH, "led count out of limit");
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				rc = -EINVAL;
+				return rc;
+			}
+			fctrl->nrt_info.cmn_attr.count =
+				flash_operation_info->count;
+			fctrl->nrt_info.cmn_attr.request_id = 0;
+			fctrl->nrt_info.opcode =
+				flash_operation_info->opcode;
+			fctrl->nrt_info.cmn_attr.cmd_type =
+				CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE;
+			for (i = 0;
+				i < flash_operation_info->count; i++)
+				fctrl->nrt_info.led_current_ma[i] =
+				flash_operation_info->led_current_ma[i];
+
+			rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+			if (rc)
+				CAM_ERR(CAM_FLASH,
+					"Apply setting failed: %d",
+					rc);
+			break;
+		}
+		default:
+			CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
+				cam_flash_info->cmd_type);
+			rc = -EINVAL;
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		break;
+	}
+	case CAM_FLASH_PACKET_OPCODE_SET_OPS: {
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		frm_offset = csl_packet->header.request_id %
+			MAX_PER_FRAME_ARRAY;
+		flash_data = &fctrl->per_frame[frm_offset];
+
+		if (flash_data->cmn_attr.is_settings_valid == true) {
+			flash_data->cmn_attr.request_id = 0;
+			flash_data->cmn_attr.is_settings_valid = false;
+			for (i = 0; i < flash_data->cmn_attr.count; i++)
+				flash_data->led_current_ma[i] = 0;
+		}
+
+		flash_data->cmn_attr.request_id = csl_packet->header.request_id;
+		flash_data->cmn_attr.is_settings_valid = true;
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+			&cmd_buf_ptr, &len_of_buffer);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "Fail in get buffer: 0x%x",
+				cmd_desc->mem_handle);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+
+		if ((len_of_buffer < sizeof(struct common_header)) ||
+			(cmd_desc->offset >
+			(len_of_buffer - sizeof(struct common_header)))) {
+			CAM_ERR(CAM_FLASH, "not enough buffer");
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			rc = -EINVAL;
+			return rc;
+		}
+		remain_len = len_of_buffer - cmd_desc->offset;
+
+		cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
+			cmd_desc->offset);
+		cmn_hdr = (struct common_header *)cmd_buf;
+
+		switch (cmn_hdr->cmd_type) {
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_FIRE: {
+			CAM_DBG(CAM_FLASH,
+				"CAMERA_SENSOR_FLASH_CMD_TYPE_FIRE cmd called, req:%lld",
+				csl_packet->header.request_id);
+			if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+				(fctrl->flash_state ==
+					CAM_FLASH_STATE_ACQUIRE)) {
+				CAM_WARN(CAM_FLASH,
+					"Rxed Flash fire ops without linking");
+				flash_data->cmn_attr.is_settings_valid = false;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return -EINVAL;
+			}
+			if (remain_len < sizeof(struct cam_flash_set_on_off)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+
+			flash_operation_info =
+				(struct cam_flash_set_on_off *) cmd_buf;
+			if (!flash_operation_info) {
+				CAM_ERR(CAM_FLASH,
+					"flash_operation_info Null");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+			if (flash_operation_info->count >
+				CAM_FLASH_MAX_LED_TRIGGERS) {
+				CAM_ERR(CAM_FLASH, "led count out of limit");
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			flash_data->opcode = flash_operation_info->opcode;
+			flash_data->cmn_attr.count =
+				flash_operation_info->count;
+			for (i = 0; i < flash_operation_info->count; i++)
+				flash_data->led_current_ma[i]
+				= flash_operation_info->led_current_ma[i];
+
+			CAM_DBG(CAM_FLASH,
+				"FLASH_CMD_TYPE op:%d, req:%lld",
+				flash_data->opcode, csl_packet->header.request_id);
+
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_FIREDURATION) {
+				/* Active time for the preflash */
+				flash_data->flash_active_time_ms =
+				(flash_operation_info->time_on_duration_ns)
+					/ 1000000;
+				flash_data->flash_on_wait_time_ms =
+				(flash_operation_info->led_on_wait_time_ns)
+					/ 1000000;
+				CAM_DBG(CAM_FLASH,
+					"PRECISE FLASH: active wait tme:%llu duration: %llu",
+					flash_data->flash_on_wait_time_ms,
+					flash_data->flash_active_time_ms);
+			}
+		}
+		break;
+		default:
+			CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
+				cmn_hdr->cmd_type);
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			rc = -EINVAL;
+			return rc;
+		}
+
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		break;
+	}
+	case CAM_FLASH_PACKET_OPCODE_NON_REALTIME_SET_OPS: {
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		fctrl->nrt_info.cmn_attr.is_settings_valid = true;
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+			&cmd_buf_ptr, &len_of_buffer);
+		if (rc) {
+			cam_mem_put_cpu_buf(config.packet_handle);
+			CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
+			return rc;
+		}
+
+		if ((len_of_buffer < sizeof(struct common_header)) ||
+			(cmd_desc->offset >
+			(len_of_buffer - sizeof(struct common_header)))) {
+			CAM_ERR(CAM_FLASH, "Not enough buffer");
+			rc = -EINVAL;
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+		remain_len = len_of_buffer - cmd_desc->offset;
+		cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
+			cmd_desc->offset);
+		cmn_hdr = (struct common_header *)cmd_buf;
+
+		switch (cmn_hdr->cmd_type) {
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET: {
+			CAM_DBG(CAM_FLASH, "Widget Flash Operation");
+			if (remain_len < sizeof(struct cam_flash_set_on_off)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+			flash_operation_info =
+				(struct cam_flash_set_on_off *) cmd_buf;
+			if (!flash_operation_info) {
+				CAM_ERR(CAM_FLASH,
+					"flash_operation_info Null");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+			if (flash_operation_info->count >
+				CAM_FLASH_MAX_LED_TRIGGERS) {
+				CAM_ERR(CAM_FLASH, "led count out of limit");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+
+			fctrl->nrt_info.cmn_attr.count =
+				flash_operation_info->count;
+			fctrl->nrt_info.cmn_attr.request_id = 0;
+			fctrl->nrt_info.opcode =
+				flash_operation_info->opcode;
+			fctrl->nrt_info.cmn_attr.cmd_type =
+				CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET;
+
+			for (i = 0; i < flash_operation_info->count; i++)
+				fctrl->nrt_info.led_current_ma[i] =
+					flash_operation_info->led_current_ma[i];
+
+			rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+			if (rc)
+				CAM_ERR(CAM_FLASH, "Apply setting failed: %d",
+					rc);
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_QUERYCURR: {
+			int query_curr_ma = 0;
+
+			if (remain_len < sizeof(struct cam_flash_query_curr)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+			flash_query_info =
+				(struct cam_flash_query_curr *)cmd_buf;
+#if __or(IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2), \
+			IS_REACHABLE(CONFIG_LEDS_QTI_FLASH))
+			rc = cam_flash_led_prepare(fctrl->switch_trigger,
+				QUERY_MAX_AVAIL_CURRENT, &query_curr_ma,
+				soc_private->is_wled_flash);
+
+			CAM_DBG(CAM_FLASH, "query_curr_ma = %d",
+				query_curr_ma);
+#else
+			rc = -EOPNOTSUPP;
+#endif
+
+			if (rc) {
+				CAM_ERR(CAM_FLASH,
+				"Query current failed with rc=%d", rc);
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+			flash_query_info->query_current_ma = query_curr_ma;
+			break;
+		}
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_RER: {
+			if (remain_len < sizeof(struct cam_flash_set_rer)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+			flash_rer_info = (struct cam_flash_set_rer *)cmd_buf;
+			if (!flash_rer_info) {
+				CAM_ERR(CAM_FLASH,
+					"flash_rer_info Null");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+			if (flash_rer_info->count >
+				CAM_FLASH_MAX_LED_TRIGGERS) {
+				CAM_ERR(CAM_FLASH, "led count out of limit");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+
+			fctrl->nrt_info.cmn_attr.cmd_type =
+				CAMERA_SENSOR_FLASH_CMD_TYPE_RER;
+			fctrl->nrt_info.opcode = flash_rer_info->opcode;
+			fctrl->nrt_info.cmn_attr.count = flash_rer_info->count;
+			fctrl->nrt_info.cmn_attr.request_id = 0;
+			fctrl->nrt_info.num_iterations =
+				flash_rer_info->num_iteration;
+			fctrl->nrt_info.led_on_delay_ms =
+				flash_rer_info->led_on_delay_ms;
+			fctrl->nrt_info.led_off_delay_ms =
+				flash_rer_info->led_off_delay_ms;
+
+			for (i = 0; i < flash_rer_info->count; i++)
+				fctrl->nrt_info.led_current_ma[i] =
+					flash_rer_info->led_current_ma[i];
+
+			rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+			if (rc)
+				CAM_ERR(CAM_FLASH, "apply_setting failed: %d",
+					rc);
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return rc;
+		}
+		default:
+			CAM_ERR(CAM_FLASH, "Wrong cmd_type : %d",
+				cmn_hdr->cmd_type);
+			cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+			cam_mem_put_cpu_buf(config.packet_handle);
+			rc = -EINVAL;
+			return rc;
+		}
+
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		break;
+	}
+	case CAM_PKT_NOP_OPCODE: {
+		frm_offset = csl_packet->header.request_id %
+			MAX_PER_FRAME_ARRAY;
+		if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_ACQUIRE)) {
+			CAM_WARN(CAM_FLASH,
+				"Rxed NOP packets without linking");
+			fctrl->per_frame[frm_offset].cmn_attr.is_settings_valid
+				= false;
+			cam_mem_put_cpu_buf(config.packet_handle);
+			return -EINVAL;
+		}
+
+		fctrl->per_frame[frm_offset].cmn_attr.is_settings_valid = false;
+		fctrl->per_frame[frm_offset].cmn_attr.request_id = 0;
+		fctrl->per_frame[frm_offset].opcode = CAM_PKT_NOP_OPCODE;
+		CAM_DBG(CAM_FLASH, "NOP Packet is Received: req_id: %llu",
+			csl_packet->header.request_id);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_FLASH, "Wrong Opcode : %d",
+			(csl_packet->header.op_code & 0xFFFFFF));
+		rc = -EINVAL;
+		cam_mem_put_cpu_buf(config.packet_handle);
+		return rc;
+	}
+
+	if (((csl_packet->header.op_code  & 0xFFFFF) ==
+		CAM_PKT_NOP_OPCODE) ||
+		((csl_packet->header.op_code & 0xFFFFF) ==
+		CAM_FLASH_PACKET_OPCODE_SET_OPS)) {
+		memset(&add_req, 0, sizeof(add_req));
+		add_req.link_hdl = fctrl->bridge_intf.link_hdl;
+		add_req.req_id = csl_packet->header.request_id;
+		add_req.dev_hdl = fctrl->bridge_intf.device_hdl;
+
+		if ((csl_packet->header.op_code & 0xFFFFF) ==
+			CAM_FLASH_PACKET_OPCODE_SET_OPS) {
+			add_req.trigger_eof = true;
+			if (flash_data->opcode == CAMERA_SENSOR_FLASH_OP_OFF) {
+				add_req.skip_at_sof = 1;
+				add_req.skip_at_eof = 0;
+			} else {
+				add_req.skip_at_sof = 1;
+				add_req.skip_at_eof = 0;
+			}
+		}
+
+		if (fctrl->bridge_intf.crm_cb &&
+			fctrl->bridge_intf.crm_cb->add_req) {
+			rc = fctrl->bridge_intf.crm_cb->add_req(&add_req);
+			if (rc) {
+				if (rc == -EBADR)
+					CAM_INFO(CAM_FLASH,
+						"Failed in adding request: %llu to request manager, it has been flushed",
+						csl_packet->header.request_id);
+				else
+					CAM_ERR(CAM_FLASH,
+						"Failed in adding request: %llu to request manager",
+						csl_packet->header.request_id);
+				cam_mem_put_cpu_buf(config.packet_handle);
+				return rc;
+			}
+			CAM_DBG(CAM_FLASH,
+				"add req %lld to req_mgr, trigger_eof %d",
+				add_req.req_id, add_req.trigger_eof);
+		}
+	}
+
+	cam_mem_put_cpu_buf(config.packet_handle);
+	return rc;
+}
+
+int cam_flash_publish_dev_info(struct cam_req_mgr_device_info *info)
+{
+	info->dev_id = CAM_REQ_MGR_DEVICE_FLASH;
+	strscpy(info->name, CAM_FLASH_NAME, sizeof(info->name));
+	info->p_delay = CAM_PIPELINE_DELAY_1;
+	info->m_delay = CAM_MODESWITCH_DELAY_1;
+	info->trigger = CAM_TRIGGER_POINT_SOF;
+	return 0;
+}
+
+int cam_flash_establish_link(struct cam_req_mgr_core_dev_link_setup *link)
+{
+	struct cam_flash_ctrl *fctrl = NULL;
+
+	if (!link)
+		return -EINVAL;
+
+	fctrl = (struct cam_flash_ctrl *)cam_get_device_priv(link->dev_hdl);
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, " Device data is NULL");
+		return -EINVAL;
+	}
+	mutex_lock(&fctrl->flash_mutex);
+	if (link->link_enable) {
+		fctrl->bridge_intf.link_hdl = link->link_hdl;
+		fctrl->bridge_intf.crm_cb = link->crm_cb;
+	} else {
+		fctrl->bridge_intf.link_hdl = -1;
+		fctrl->bridge_intf.crm_cb = NULL;
+	}
+	mutex_unlock(&fctrl->flash_mutex);
+
+	return 0;
+}
+
+int cam_flash_release_dev(struct cam_flash_ctrl *fctrl)
+{
+	int rc = 0;
+
+	if (fctrl->bridge_intf.device_hdl != 1) {
+		rc = cam_destroy_device_hdl(fctrl->bridge_intf.device_hdl);
+		if (rc)
+			CAM_ERR(CAM_FLASH,
+				"Failed in destroying device handle rc = %d",
+				rc);
+		fctrl->bridge_intf.device_hdl = -1;
+		fctrl->bridge_intf.link_hdl = -1;
+		fctrl->bridge_intf.session_hdl = -1;
+		fctrl->last_flush_req = 0;
+	}
+
+	return rc;
+}
+
+void cam_flash_shutdown(struct cam_flash_ctrl *fctrl)
+{
+	int rc;
+
+	if (fctrl->flash_state == CAM_FLASH_STATE_INIT)
+		return;
+
+	if ((fctrl->flash_state == CAM_FLASH_STATE_CONFIG) ||
+		(fctrl->flash_state == CAM_FLASH_STATE_START)) {
+		fctrl->func_tbl.flush_req(fctrl, FLUSH_ALL, 0);
+		rc = cam_flash_off(fctrl);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"LED OFF FAILED: %d", rc);
+		}
+		if (fctrl->func_tbl.power_ops) {
+			rc = fctrl->func_tbl.power_ops(fctrl, false);
+			if (rc)
+				CAM_ERR(CAM_FLASH, "Power Down Failed rc: %d",
+					rc);
+		}
+	}
+
+	rc = cam_flash_release_dev(fctrl);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Release failed rc: %d", rc);
+
+	fctrl->flash_state = CAM_FLASH_STATE_INIT;
+}
+
+int cam_flash_apply_request(struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_flash_ctrl *fctrl = NULL;
+
+	if (!apply)
+		return -EINVAL;
+
+	fctrl = (struct cam_flash_ctrl *) cam_get_device_priv(apply->dev_hdl);
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&fctrl->flash_mutex);
+	rc = fctrl->func_tbl.apply_setting(fctrl, apply->request_id);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "apply_setting failed with rc=%d",
+			rc);
+	mutex_unlock(&fctrl->flash_mutex);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_core.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FLASH_CORE_H_
+#define _CAM_FLASH_CORE_H_
+
+#include <media/cam_sensor.h>
+#include "cam_flash_dev.h"
+
+int cam_flash_publish_dev_info(struct cam_req_mgr_device_info *info);
+int cam_flash_establish_link(struct cam_req_mgr_core_dev_link_setup *link);
+int cam_flash_apply_request(struct cam_req_mgr_apply_request *apply);
+int cam_flash_process_evt(struct cam_req_mgr_link_evt_data *event_data);
+int cam_flash_flush_request(struct cam_req_mgr_flush_request *flush);
+int cam_flash_led_prepare(struct led_trigger *trigger, int options,
+	int *max_current, bool is_wled);
+
+
+#endif /*_CAM_FLASH_CORE_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_dev.c
@@ -0,0 +1,843 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_flash_dev.h"
+#include "cam_flash_soc.h"
+#include "cam_flash_core.h"
+#include "cam_common_util.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+static int32_t cam_flash_driver_cmd(struct cam_flash_ctrl *fctrl,
+		void *arg, struct cam_flash_private_soc *soc_private)
+{
+	int rc = 0;
+	int i = 0;
+	struct cam_control *cmd = (struct cam_control *)arg;
+
+	if (!fctrl || !arg) {
+		CAM_ERR(CAM_FLASH, "fctrl/arg is NULL with arg:%pK fctrl%pK",
+			fctrl, arg);
+		return -EINVAL;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_FLASH, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&(fctrl->flash_mutex));
+	switch (cmd->op_code) {
+	case CAM_ACQUIRE_DEV: {
+		struct cam_sensor_acquire_dev flash_acq_dev;
+		struct cam_create_dev_hdl bridge_params;
+
+		if (fctrl->flash_state != CAM_FLASH_STATE_INIT) {
+			CAM_ERR(CAM_FLASH,
+				"Cannot apply Acquire dev: Prev state: %d",
+				fctrl->flash_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (fctrl->bridge_intf.device_hdl != -1) {
+			CAM_ERR(CAM_FLASH, "Device is already acquired");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		rc = copy_from_user(&flash_acq_dev,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(flash_acq_dev));
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "Failed Copying from User");
+			goto release_mutex;
+		}
+
+		bridge_params.session_hdl = flash_acq_dev.session_handle;
+		bridge_params.ops = &fctrl->bridge_intf.ops;
+		bridge_params.v4l2_sub_dev_flag = 0;
+		bridge_params.media_entity_flag = 0;
+		bridge_params.priv = fctrl;
+		bridge_params.dev_id = CAM_FLASH;
+
+		flash_acq_dev.device_handle =
+			cam_create_device_hdl(&bridge_params);
+		if (flash_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_FLASH, "Can not create device handle");
+			goto release_mutex;
+		}
+		fctrl->bridge_intf.device_hdl =
+			flash_acq_dev.device_handle;
+		fctrl->bridge_intf.session_hdl =
+			flash_acq_dev.session_handle;
+
+		rc = copy_to_user(u64_to_user_ptr(cmd->handle),
+			&flash_acq_dev,
+			sizeof(struct cam_sensor_acquire_dev));
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "Failed Copy to User with rc = %d",
+				rc);
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		fctrl->flash_state = CAM_FLASH_STATE_ACQUIRE;
+
+		CAM_INFO(CAM_FLASH, "CAM_ACQUIRE_DEV for dev_hdl: 0x%x",
+			fctrl->bridge_intf.device_hdl);
+		break;
+	}
+	case CAM_RELEASE_DEV: {
+		CAM_INFO(CAM_FLASH, "CAM_RELEASE_DEV for dev_hdl: 0x%x",
+			fctrl->bridge_intf.device_hdl);
+		if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_START)) {
+			CAM_WARN(CAM_FLASH,
+				"Wrong state for Release dev: Prev state:%d",
+				fctrl->flash_state);
+		}
+
+		if (fctrl->bridge_intf.device_hdl == -1 &&
+			fctrl->flash_state == CAM_FLASH_STATE_ACQUIRE) {
+			CAM_ERR(CAM_FLASH,
+				"Invalid Handle: Link Hdl: %d device hdl: %d",
+				fctrl->bridge_intf.device_hdl,
+				fctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (fctrl->bridge_intf.link_hdl != -1) {
+			CAM_ERR(CAM_FLASH,
+				"Device [%d] still active on link 0x%x",
+				fctrl->flash_state,
+				fctrl->bridge_intf.link_hdl);
+			rc = -EAGAIN;
+			goto release_mutex;
+		}
+
+		if ((fctrl->flash_state == CAM_FLASH_STATE_CONFIG) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_START))
+			fctrl->func_tbl.flush_req(fctrl, FLUSH_ALL, 0);
+
+		if (cam_flash_release_dev(fctrl))
+			CAM_WARN(CAM_FLASH,
+				"Failed in destroying the device Handle");
+
+		if (fctrl->func_tbl.power_ops) {
+			if (fctrl->func_tbl.power_ops(fctrl, false))
+				CAM_WARN(CAM_FLASH, "Power Down Failed");
+		}
+
+		fctrl->flash_state = CAM_FLASH_STATE_INIT;
+		break;
+	}
+	case CAM_QUERY_CAP: {
+		struct cam_flash_query_cap_info flash_cap = {0};
+
+		CAM_DBG(CAM_FLASH, "CAM_QUERY_CAP");
+		flash_cap.slot_info = fctrl->soc_info.index;
+		for (i = 0; i < fctrl->flash_num_sources; i++) {
+			flash_cap.max_current_flash[i] =
+				soc_private->flash_max_current[i];
+			flash_cap.max_duration_flash[i] =
+				soc_private->flash_max_duration[i];
+		}
+
+		for (i = 0; i < fctrl->torch_num_sources; i++)
+			flash_cap.max_current_torch[i] =
+				soc_private->torch_max_current[i];
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&flash_cap, sizeof(struct cam_flash_query_cap_info))) {
+			CAM_ERR(CAM_FLASH, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		break;
+	}
+	case CAM_START_DEV: {
+		CAM_INFO(CAM_FLASH, "CAM_START_DEV for dev_hdl: 0x%x",
+			fctrl->bridge_intf.device_hdl);
+		if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_START)) {
+			CAM_WARN(CAM_FLASH,
+				"Cannot apply Start Dev: Prev state: %d",
+				fctrl->flash_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		fctrl->flash_state = CAM_FLASH_STATE_START;
+		break;
+	}
+	case CAM_STOP_DEV: {
+		CAM_INFO(CAM_FLASH, "CAM_STOP_DEV ENTER for dev_hdl: 0x%x",
+			fctrl->bridge_intf.device_hdl);
+		if (fctrl->flash_state != CAM_FLASH_STATE_START) {
+			CAM_WARN(CAM_FLASH,
+				"Cannot apply Stop dev: Prev state is: %d",
+				fctrl->flash_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		fctrl->func_tbl.flush_req(fctrl, FLUSH_ALL, 0);
+		fctrl->last_flush_req = 0;
+		cam_flash_off(fctrl);
+		fctrl->flash_state = CAM_FLASH_STATE_ACQUIRE;
+		break;
+	}
+	case CAM_CONFIG_DEV: {
+		CAM_DBG(CAM_FLASH, "CAM_CONFIG_DEV");
+		rc = fctrl->func_tbl.parser(fctrl, arg);
+		if (rc) {
+			if (rc == -EBADR)
+				CAM_INFO(CAM_FLASH,
+					"Failed Flash Config: rc=%d\n, it has been flushed", rc);
+			else
+				CAM_ERR(CAM_FLASH, "Failed Flash Config: rc=%d\n", rc);
+			goto release_mutex;
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_FLASH, "Invalid Opcode: %d", cmd->op_code);
+		rc = -EINVAL;
+	}
+
+release_mutex:
+	mutex_unlock(&(fctrl->flash_mutex));
+	return rc;
+}
+
+static int32_t cam_flash_init_default_params(struct cam_flash_ctrl *fctrl)
+{
+	/* Validate input parameters */
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "failed: invalid params fctrl %pK",
+			fctrl);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_FLASH,
+		"master_type: %d", fctrl->io_master_info.master_type);
+	/* Initialize cci_client */
+	if (fctrl->io_master_info.master_type == CCI_MASTER) {
+		fctrl->io_master_info.cci_client = kzalloc(sizeof(
+			struct cam_sensor_cci_client), GFP_KERNEL);
+		if (!(fctrl->io_master_info.cci_client))
+			return -ENOMEM;
+	} else if (fctrl->io_master_info.master_type == I2C_MASTER) {
+		if (!(fctrl->io_master_info.client))
+			return -EINVAL;
+	} else {
+		CAM_ERR(CAM_FLASH,
+			"Invalid master / Master type Not supported");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static const struct of_device_id cam_flash_dt_match[] = {
+	{.compatible = "qcom,camera-flash", .data = NULL},
+	{}
+};
+
+static int cam_flash_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_flash_ctrl *fctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Flash ctrl ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&fctrl->flash_mutex);
+	cam_flash_shutdown(fctrl);
+	mutex_unlock(&fctrl->flash_mutex);
+
+	return 0;
+}
+
+static int cam_flash_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_FLASH, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_flash_subdev_close_internal(sd, fh);
+}
+
+static long cam_flash_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int rc = 0;
+	struct cam_flash_ctrl *fctrl = NULL;
+	struct cam_flash_private_soc *soc_private = NULL;
+
+	CAM_DBG(CAM_FLASH, "Enter");
+
+	fctrl = v4l2_get_subdevdata(sd);
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Flash ctrl ptr is NULL");
+		return -EINVAL;
+	}
+	soc_private = fctrl->soc_info.soc_private;
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL: {
+		rc = cam_flash_driver_cmd(fctrl, arg,
+			soc_private);
+		if (rc) {
+			if (rc == -EBADR)
+				CAM_INFO(CAM_FLASH,
+					"Failed in driver cmd: %d, it has been flushed", rc);
+			else
+				CAM_ERR(CAM_FLASH,
+					"Failed in driver cmd: %d", rc);
+		}
+		break;
+	}
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_flash_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_FLASH, "Invalid ioctl cmd type");
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	CAM_DBG(CAM_FLASH, "Exit");
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_flash_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_FLASH,
+			"Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL: {
+		rc = cam_flash_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc)
+			CAM_ERR(CAM_FLASH, "cam_flash_ioctl failed");
+		break;
+	}
+	default:
+		CAM_ERR(CAM_FLASH, "Invalid compat ioctl cmd_type:%d",
+			cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_FLASH,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+static struct v4l2_subdev_core_ops cam_flash_subdev_core_ops = {
+	.ioctl = cam_flash_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_flash_subdev_do_ioctl
+#endif
+};
+
+static struct v4l2_subdev_ops cam_flash_subdev_ops = {
+	.core = &cam_flash_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cam_flash_internal_ops = {
+	.close = cam_flash_subdev_close,
+};
+
+static int cam_flash_init_subdev(struct cam_flash_ctrl *fctrl)
+{
+	int rc = 0;
+
+	strscpy(fctrl->device_name, CAM_FLASH_NAME,
+		sizeof(fctrl->device_name));
+	fctrl->v4l2_dev_str.internal_ops =
+		&cam_flash_internal_ops;
+	fctrl->v4l2_dev_str.ops = &cam_flash_subdev_ops;
+	fctrl->v4l2_dev_str.name = CAMX_FLASH_DEV_NAME;
+	fctrl->v4l2_dev_str.sd_flags =
+		V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+	fctrl->v4l2_dev_str.ent_function = CAM_FLASH_DEVICE_TYPE;
+	fctrl->v4l2_dev_str.token = fctrl;
+	fctrl->v4l2_dev_str.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(fctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Fail to create subdev with %d", rc);
+
+	return rc;
+}
+
+static int cam_flash_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t rc = 0, i = 0;
+	struct cam_flash_ctrl *fctrl = NULL;
+	struct device_node *of_parent = NULL;
+	bool i3c_i2c_target;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_FLASH, "Binding flash component");
+	if (!pdev->dev.of_node) {
+		CAM_ERR(CAM_FLASH, "of_node NULL");
+		return -EINVAL;
+	}
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return 0;
+
+	fctrl = kzalloc(sizeof(struct cam_flash_ctrl), GFP_KERNEL);
+	if (!fctrl)
+		return -ENOMEM;
+
+	fctrl->pdev = pdev;
+	fctrl->of_node = pdev->dev.of_node;
+	fctrl->soc_info.pdev = pdev;
+	fctrl->soc_info.dev = &pdev->dev;
+	fctrl->soc_info.dev_name = pdev->name;
+
+	platform_set_drvdata(pdev, fctrl);
+
+	rc = cam_flash_get_dt_data(fctrl, &fctrl->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "cam_flash_get_dt_data failed with %d", rc);
+		kfree(fctrl);
+		return -EINVAL;
+	}
+
+	if (of_find_property(pdev->dev.of_node, "cci-master", NULL)) {
+
+		/* Get CCI master */
+		if (of_property_read_u32(pdev->dev.of_node, "cci-master",
+			&fctrl->cci_i2c_master)) {
+			/* Set default master 0 */
+			fctrl->cci_i2c_master = MASTER_0;
+		}
+		CAM_DBG(CAM_FLASH, "cci-master %d",
+			fctrl->cci_i2c_master);
+
+		fctrl->io_master_info.master_type = CCI_MASTER;
+		rc = cam_flash_init_default_params(fctrl);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"failed: cam_flash_init_default_params rc %d",
+				rc);
+			return rc;
+		}
+
+		of_parent = of_get_parent(pdev->dev.of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&fctrl->cci_num) < 0)
+		/* Set default master 0 */
+			fctrl->cci_num = CCI_DEVICE_0;
+
+		fctrl->io_master_info.cci_client->cci_device = fctrl->cci_num;
+		CAM_DBG(CAM_FLASH, "cci-index %d", fctrl->cci_num, rc);
+
+		fctrl->i2c_data.per_frame =
+			kzalloc(sizeof(struct i2c_settings_array) *
+			MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+		if (fctrl->i2c_data.per_frame == NULL) {
+			CAM_ERR(CAM_FLASH, "No Memory");
+			rc = -ENOMEM;
+			goto free_cci_resource;
+		}
+
+		INIT_LIST_HEAD(&(fctrl->i2c_data.init_settings.list_head));
+		INIT_LIST_HEAD(&(fctrl->i2c_data.config_settings.list_head));
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
+			INIT_LIST_HEAD(
+				&(fctrl->i2c_data.per_frame[i].list_head));
+
+		fctrl->func_tbl.parser = cam_flash_i2c_pkt_parser;
+		fctrl->func_tbl.apply_setting = cam_flash_i2c_apply_setting;
+		fctrl->func_tbl.power_ops = cam_flash_i2c_power_ops;
+		fctrl->func_tbl.flush_req = cam_flash_i2c_flush_request;
+	} else {
+		/* PMIC Flash */
+		fctrl->func_tbl.parser = cam_flash_pmic_pkt_parser;
+		fctrl->func_tbl.apply_setting = cam_flash_pmic_apply_setting;
+		fctrl->func_tbl.power_ops = NULL;
+		fctrl->func_tbl.flush_req = cam_flash_pmic_flush_request;
+	}
+
+	rc = cam_flash_init_subdev(fctrl);
+	if (rc) {
+		if (fctrl->io_master_info.cci_client != NULL)
+			goto free_cci_resource;
+		else
+			goto free_resource;
+	}
+
+	cam_sensor_module_add_i2c_device((void *) fctrl, CAM_SENSOR_FLASH);
+
+	fctrl->bridge_intf.device_hdl = -1;
+	fctrl->bridge_intf.link_hdl = -1;
+	fctrl->bridge_intf.ops.get_dev_info = cam_flash_publish_dev_info;
+	fctrl->bridge_intf.ops.link_setup = cam_flash_establish_link;
+	fctrl->bridge_intf.ops.apply_req = cam_flash_apply_request;
+	fctrl->bridge_intf.ops.flush_req = cam_flash_flush_request;
+	fctrl->last_flush_req = 0;
+
+	mutex_init(&(fctrl->flash_mutex));
+
+	fctrl->flash_state = CAM_FLASH_STATE_INIT;
+	CAM_DBG(CAM_FLASH, "Component bound successfully");
+	return rc;
+
+free_cci_resource:
+	kfree(fctrl->io_master_info.cci_client);
+	fctrl->io_master_info.cci_client = NULL;
+free_resource:
+	kfree(fctrl->i2c_data.per_frame);
+	kfree(fctrl->soc_info.soc_private);
+	cam_soc_util_release_platform_resource(&fctrl->soc_info);
+	fctrl->i2c_data.per_frame = NULL;
+	fctrl->soc_info.soc_private = NULL;
+	kfree(fctrl);
+	fctrl = NULL;
+	return rc;
+}
+
+static void cam_flash_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_flash_ctrl *fctrl;
+	bool i3c_i2c_target;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return;
+
+	fctrl = platform_get_drvdata(pdev);
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Flash device is NULL");
+		return;
+	}
+
+	mutex_lock(&fctrl->flash_mutex);
+	cam_flash_shutdown(fctrl);
+	mutex_unlock(&fctrl->flash_mutex);
+	cam_unregister_subdev(&(fctrl->v4l2_dev_str));
+	cam_flash_put_source_node_data(fctrl);
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&fctrl->v4l2_dev_str.sd, NULL);
+	kfree(fctrl);
+	CAM_INFO(CAM_FLASH, "Flash Sensor component unbind");
+}
+
+const static struct component_ops cam_flash_component_ops = {
+	.bind = cam_flash_component_bind,
+	.unbind = cam_flash_component_unbind,
+};
+
+static int cam_flash_platform_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_flash_component_ops);
+	return 0;
+}
+
+static int32_t cam_flash_platform_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_FLASH, "Adding Flash Sensor component");
+	rc = component_add(&pdev->dev, &cam_flash_component_ops);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_flash_i2c_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t rc = 0, i = 0;
+	struct i2c_client      *client = NULL;
+	struct cam_flash_ctrl  *fctrl = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (client == NULL) {
+		CAM_ERR(CAM_FLASH, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	/* Create sensor control structure */
+	fctrl = kzalloc(sizeof(*fctrl), GFP_KERNEL);
+	if (!fctrl)
+		return -ENOMEM;
+
+	client->dev.driver_data = fctrl;
+	fctrl->io_master_info.client = client;
+	fctrl->of_node = client->dev.of_node;
+	fctrl->soc_info.dev = &client->dev;
+	fctrl->soc_info.dev_name = client->name;
+	fctrl->io_master_info.master_type = I2C_MASTER;
+
+	rc = cam_flash_get_dt_data(fctrl, &fctrl->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "failed: cam_sensor_parse_dt rc %d", rc);
+		goto free_ctrl;
+	}
+
+	rc = cam_flash_init_default_params(fctrl);
+	if (rc) {
+		CAM_ERR(CAM_FLASH,
+				"failed: cam_flash_init_default_params rc %d",
+				rc);
+		goto free_ctrl;
+	}
+
+	soc_info = &fctrl->soc_info;
+
+	/* Initalize regulators to default parameters */
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		soc_info->rgltr[i] = devm_regulator_get(soc_info->dev,
+			soc_info->rgltr_name[i]);
+		if (IS_ERR_OR_NULL(soc_info->rgltr[i])) {
+			rc = PTR_ERR(soc_info->rgltr[i]);
+			rc  = rc ? rc : -EINVAL;
+			CAM_ERR(CAM_FLASH, "get failed for regulator %s %d",
+				soc_info->rgltr_name[i], rc);
+			goto free_ctrl_cci_client;
+		}
+		CAM_DBG(CAM_FLASH, "get for regulator %s",
+			soc_info->rgltr_name[i]);
+	}
+
+	if (!soc_info->gpio_data) {
+		CAM_DBG(CAM_FLASH, "No GPIO found");
+	} else {
+		if (!soc_info->gpio_data->cam_gpio_common_tbl_size) {
+			CAM_DBG(CAM_FLASH, "No GPIO found");
+			rc = -EINVAL;
+			goto free_ctrl_cci_client;
+		}
+
+		rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
+			&fctrl->power_info.gpio_num_info);
+		if ((rc < 0) || (!fctrl->power_info.gpio_num_info)) {
+			CAM_ERR(CAM_FLASH, "No/Error Flash GPIOs");
+			rc = -EINVAL;
+			goto free_ctrl_cci_client;
+		}
+	}
+
+	rc = cam_flash_init_subdev(fctrl);
+	if (rc)
+		goto free_ctrl_cci_client;
+
+	fctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (fctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto unreg_subdev;
+	}
+
+	cam_sensor_module_add_i2c_device((void *) fctrl, CAM_SENSOR_FLASH);
+
+	INIT_LIST_HEAD(&(fctrl->i2c_data.init_settings.list_head));
+	INIT_LIST_HEAD(&(fctrl->i2c_data.config_settings.list_head));
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
+		INIT_LIST_HEAD(&(fctrl->i2c_data.per_frame[i].list_head));
+
+	fctrl->func_tbl.parser = cam_flash_i2c_pkt_parser;
+	fctrl->func_tbl.apply_setting = cam_flash_i2c_apply_setting;
+	fctrl->func_tbl.power_ops = cam_flash_i2c_power_ops;
+	fctrl->func_tbl.flush_req = cam_flash_i2c_flush_request;
+
+	fctrl->bridge_intf.device_hdl = -1;
+	fctrl->bridge_intf.link_hdl = -1;
+	fctrl->bridge_intf.ops.get_dev_info = cam_flash_publish_dev_info;
+	fctrl->bridge_intf.ops.link_setup = cam_flash_establish_link;
+	fctrl->bridge_intf.ops.apply_req = cam_flash_apply_request;
+	fctrl->bridge_intf.ops.flush_req = cam_flash_flush_request;
+	fctrl->last_flush_req = 0;
+
+	mutex_init(&(fctrl->flash_mutex));
+	fctrl->flash_state = CAM_FLASH_STATE_INIT;
+
+	return rc;
+
+unreg_subdev:
+	cam_unregister_subdev(&(fctrl->v4l2_dev_str));
+free_ctrl_cci_client:
+	kfree(fctrl->io_master_info.cci_client);
+free_ctrl:
+	kfree(fctrl);
+	fctrl = NULL;
+	return rc;
+}
+
+static void cam_flash_i2c_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct i2c_client     *client = NULL;
+	struct cam_flash_ctrl *fctrl = NULL;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (!client) {
+		CAM_ERR(CAM_FLASH,
+			"Failed to get i2c client");
+		return;
+	}
+
+	fctrl = i2c_get_clientdata(client);
+	/* Handle I2C Devices */
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Flash device is NULL");
+		return;
+	}
+
+	CAM_INFO(CAM_FLASH, "i2c driver remove invoked");
+	/*Free Allocated Mem */
+	kfree(fctrl->i2c_data.per_frame);
+	fctrl->i2c_data.per_frame = NULL;
+	kfree(fctrl);
+}
+
+const static struct component_ops cam_flash_i2c_component_ops = {
+	.bind = cam_flash_i2c_component_bind,
+	.unbind = cam_flash_i2c_component_unbind,
+};
+
+int cam_flash_i2c_driver_remove_common(struct i2c_client *client)
+{
+	component_del(&client->dev, &cam_flash_i2c_component_ops);
+
+	return 0;
+}
+
+static int32_t cam_flash_i2c_driver_probe(struct i2c_client *client)
+{
+	int rc = 0;
+
+	if (client == NULL) {
+		CAM_ERR(CAM_FLASH, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_FLASH, "%s :: i2c_check_functionality failed",
+			client->name);
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_FLASH, "Adding sensor flash component");
+	rc = component_add(&client->dev, &cam_flash_i2c_component_ops);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+MODULE_DEVICE_TABLE(of, cam_flash_dt_match);
+
+struct platform_driver cam_flash_platform_driver = {
+	.probe = cam_flash_platform_probe,
+	.remove = cam_flash_platform_remove,
+	.driver = {
+		.name = "CAM-FLASH-DRIVER",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_flash_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+static const struct of_device_id cam_flash_i2c_dt_match[] = {
+	{.compatible = "qcom,cam-i2c-flash", .data = NULL},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_flash_i2c_dt_match);
+
+static const struct i2c_device_id i2c_id[] = {
+	{FLASH_DRIVER_I2C, (kernel_ulong_t)NULL},
+	{ }
+};
+
+struct i2c_driver cam_flash_i2c_driver = {
+	.id_table = i2c_id,
+	.probe  = cam_flash_i2c_driver_probe,
+	.remove = cam_flash_i2c_driver_remove,
+	.driver = {
+		.owner = THIS_MODULE,
+		.name = FLASH_DRIVER_I2C,
+		.of_match_table = cam_flash_i2c_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int32_t cam_flash_init_module(void)
+{
+	int32_t rc = 0;
+
+	rc = platform_driver_register(&cam_flash_platform_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_FLASH, "platform probe failed rc: %d", rc);
+		return rc;
+	}
+
+	rc = i2c_add_driver(&cam_flash_i2c_driver);
+	if (rc < 0)
+		CAM_ERR(CAM_FLASH, "i2c_add_driver failed rc: %d", rc);
+
+	return rc;
+}
+
+void cam_flash_exit_module(void)
+{
+	platform_driver_unregister(&cam_flash_platform_driver);
+	i2c_del_driver(&cam_flash_i2c_driver);
+}
+
+MODULE_DESCRIPTION("CAM FLASH");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_dev.h
@@ -0,0 +1,255 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_FLASH_DEV_H_
+#define _CAM_FLASH_DEV_H_
+
+#include <linux/leds.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-event.h>
+#include <media/cam_sensor.h>
+#include <media/cam_req_mgr.h>
+
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2) || IS_REACHABLE(CONFIG_BACKLIGHT_QCOM_SPMI_WLED)
+#include <linux/leds-qpnp-flash.h>
+#endif
+#if IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+#include <linux/leds-qti-flash.h>
+#endif
+
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_interface.h"
+#include "cam_subdev.h"
+#include "cam_mem_mgr.h"
+#include "cam_sensor_cmn_header.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_sensor_io.h"
+#include "cam_flash_core.h"
+#include "cam_context.h"
+
+#define CAMX_FLASH_DEV_NAME "cam-flash-dev"
+
+#define CAM_FLASH_PIPELINE_DELAY 1
+
+#define FLASH_DRIVER_I2C "cam-i2c-flash"
+
+#define CAM_FLASH_PACKET_OPCODE_INIT                 0
+#define CAM_FLASH_PACKET_OPCODE_SET_OPS              1
+#define CAM_FLASH_PACKET_OPCODE_NON_REALTIME_SET_OPS 2
+
+struct cam_flash_ctrl;
+
+enum cam_flash_switch_trigger_ops {
+	LED_SWITCH_OFF = 0,
+	LED_SWITCH_ON,
+};
+
+enum cam_flash_state {
+	CAM_FLASH_STATE_INIT,
+	CAM_FLASH_STATE_ACQUIRE,
+	CAM_FLASH_STATE_CONFIG,
+	CAM_FLASH_STATE_START,
+};
+
+enum cam_flash_flush_type {
+	FLUSH_ALL = 0,
+	FLUSH_REQ,
+	FLUSH_MAX,
+};
+
+/**
+ * struct cam_flash_intf_params
+ * @device_hdl   : Device Handle
+ * @session_hdl  : Session Handle
+ * @link_hdl     : Link Handle
+ * @ops          : KMD operations
+ * @crm_cb       : Callback API pointers
+ */
+struct cam_flash_intf_params {
+	int32_t                     device_hdl;
+	int32_t                     session_hdl;
+	int32_t                     link_hdl;
+	struct cam_req_mgr_kmd_ops  ops;
+	struct cam_req_mgr_crm_cb  *crm_cb;
+};
+
+/**
+ * struct cam_flash_common_attr
+ * @is_settings_valid  : Notify the valid settings
+ * @request_id         : Request id provided by umd
+ * @count              : Number of led count
+ * @cmd_type           : Command buffer type
+ */
+struct cam_flash_common_attr {
+	bool      is_settings_valid;
+	uint64_t  request_id;
+	uint32_t  count;
+	uint8_t   cmd_type;
+};
+
+/**
+ * struct flash_init_packet
+ * @cmn_attr   : Provides common attributes
+ * @flash_type : Flash type(PMIC/I2C/GPIO)
+ */
+struct cam_flash_init_packet {
+	struct cam_flash_common_attr  cmn_attr;
+	uint32_t                      flash_type;
+};
+
+/**
+ * struct flash_frame_setting
+ * @cmn_attr              : Provides common attributes
+ * @num_iterations        : Iterations used to perform RER
+ * @led_on_delay_ms       : LED on time in milisec
+ * @led_off_delay_ms      : LED off time in milisec
+ * @opcode                : Command buffer opcode
+ * @led_current_ma[]      : LED current array in miliamps
+ * @flash_active_time_ms  : Flash_On time with precise flash
+ * @flash_on_wait_time_ms : Flash on wait time with precise flash
+ */
+struct cam_flash_frame_setting {
+	struct cam_flash_common_attr cmn_attr;
+	uint16_t                     num_iterations;
+	uint16_t                     led_on_delay_ms;
+	uint16_t                     led_off_delay_ms;
+	int8_t                       opcode;
+	uint32_t                     led_current_ma[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint64_t                     flash_active_time_ms;
+	uint64_t                     flash_on_wait_time_ms;
+};
+
+/**
+ *  struct cam_flash_private_soc
+ * @switch_trigger_name : Switch trigger name
+ * @flash_trigger_name  : Flash trigger name array
+ * @flash_op_current    : Flash operational current
+ * @flash_max_current   : Max supported current for LED in flash mode
+ * @flash_max_duration  : Max turn on duration for LED in Flash mode
+ * @torch_trigger_name  : Torch trigger name array
+ * @torch_op_current    : Torch operational current
+ * @torch_max_current   : Max supported current for LED in torch mode
+ * @is_wled_flash       : Detection between WLED/LED flash
+ */
+
+struct cam_flash_private_soc {
+	const char   *switch_trigger_name;
+	const char   *flash_trigger_name[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     flash_op_current[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     flash_max_current[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     flash_max_duration[CAM_FLASH_MAX_LED_TRIGGERS];
+	const char   *torch_trigger_name[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     torch_op_current[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     torch_max_current[CAM_FLASH_MAX_LED_TRIGGERS];
+	bool         is_wled_flash;
+};
+
+struct cam_flash_func_tbl {
+	int (*parser)(struct cam_flash_ctrl *fctrl, void *arg);
+	int (*apply_setting)(struct cam_flash_ctrl *fctrl, uint64_t req_id);
+	int (*power_ops)(struct cam_flash_ctrl *fctrl, bool regulator_enable);
+	int (*flush_req)(struct cam_flash_ctrl *fctrl,
+		enum cam_flash_flush_type type, uint64_t req_id);
+};
+
+/**
+ *  struct cam_flash_ctrl
+ * @device_name         : Device name
+ * @soc_info            : Soc related information
+ * @pdev                : Platform device
+ * @per_frame[]         : Per_frame setting array
+ * @nrt_info            : NonRealTime settings
+ * @of_node             : Of Node ptr
+ * @v4l2_dev_str        : V4L2 device structure
+ * @bridge_intf         : CRM interface
+ * @flash_init_setting  : Init command buffer structure
+ * @switch_trigger      : Switch trigger ptr
+ * @flash_num_sources   : Number of flash sources
+ * @torch_num_source    : Number of torch sources
+ * @flash_mutex         : Mutex for flash operations
+ * @flash_state         : Current flash state (LOW/OFF/ON/INIT)
+ * @flash_type          : Flash types (PMIC/I2C/GPIO)
+ * @is_regulator_enable : Regulator disable/enable notifier
+ * @func_tbl            : Function table for different HW
+ *	                      (e.g. i2c/pmic/gpio)
+ * @flash_trigger       : Flash trigger ptr
+ * @torch_trigger       : Torch trigger ptr
+ * @cci_i2c_master      : I2C structure
+ * @cci_device_num      : cci parent cell index
+ * @io_master_info      : Information about the communication master
+ * @i2c_data            : I2C register settings
+ * @last_flush_req      : last request to flush
+ */
+struct cam_flash_ctrl {
+	char device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct cam_hw_soc_info              soc_info;
+	struct platform_device             *pdev;
+	struct cam_sensor_power_ctrl_t      power_info;
+	struct cam_flash_frame_setting      per_frame[MAX_PER_FRAME_ARRAY];
+	struct cam_flash_frame_setting      nrt_info;
+	struct device_node                 *of_node;
+	struct cam_subdev                   v4l2_dev_str;
+	struct cam_flash_intf_params        bridge_intf;
+	struct cam_flash_init_packet        flash_init_setting;
+	struct led_trigger                 *switch_trigger;
+	uint32_t                            flash_num_sources;
+	uint32_t                            torch_num_sources;
+	struct mutex                        flash_mutex;
+	enum   cam_flash_state              flash_state;
+	uint8_t                             flash_type;
+	bool                                is_regulator_enabled;
+	struct cam_flash_func_tbl           func_tbl;
+	struct led_trigger           *flash_trigger[CAM_FLASH_MAX_LED_TRIGGERS];
+	struct led_trigger           *torch_trigger[CAM_FLASH_MAX_LED_TRIGGERS];
+/* I2C related setting */
+	enum   cci_i2c_master_t             cci_i2c_master;
+	enum   cci_device_num               cci_num;
+	struct camera_io_master             io_master_info;
+	struct i2c_data_settings            i2c_data;
+	uint32_t                            last_flush_req;
+};
+
+int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg);
+int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg);
+int cam_flash_pmic_apply_setting(struct cam_flash_ctrl *fctrl, uint64_t req_id);
+int cam_flash_i2c_apply_setting(struct cam_flash_ctrl *fctrl, uint64_t req_id);
+int cam_flash_off(struct cam_flash_ctrl *fctrl);
+int cam_flash_pmic_power_ops(struct cam_flash_ctrl *fctrl,
+	bool regulator_enable);
+int cam_flash_i2c_power_ops(struct cam_flash_ctrl *fctrl,
+	bool regulator_enable);
+int cam_flash_i2c_flush_request(struct cam_flash_ctrl *fctrl,
+	enum cam_flash_flush_type type, uint64_t req_id);
+int cam_flash_pmic_flush_request(struct cam_flash_ctrl *fctrl,
+	enum cam_flash_flush_type, uint64_t req_id);
+void cam_flash_shutdown(struct cam_flash_ctrl *fctrl);
+int cam_flash_release_dev(struct cam_flash_ctrl *fctrl);
+
+/**
+ * @brief : API to remove FLASH i2c Hw from driver framework.
+ * @return: return 0 on success.
+ */
+int cam_flash_i2c_driver_remove_common(struct i2c_client *client);
+
+/**
+ * @brief : API to register FLASH hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int32_t cam_flash_init_module(void);
+
+/**
+ * @brief : API to remove FLASH Hw from platform framework.
+ */
+void cam_flash_exit_module(void);
+#endif /*_CAM_FLASH_DEV_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_soc.c
@@ -0,0 +1,322 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include "cam_flash_soc.h"
+#include "cam_res_mgr_api.h"
+
+void cam_flash_put_source_node_data(struct cam_flash_ctrl *fctrl)
+{
+	uint32_t count = 0, i = 0;
+	struct cam_flash_private_soc *soc_private = NULL;
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "NULL flash control structure");
+		return;
+	}
+
+	soc_private = fctrl->soc_info.soc_private;
+
+	if (fctrl->switch_trigger) {
+		CAM_DBG(CAM_FLASH, "switch trigger: %s",
+			soc_private->switch_trigger_name);
+		cam_res_mgr_led_trigger_unregister(fctrl->switch_trigger);
+	}
+
+	if (fctrl->flash_num_sources) {
+		if (fctrl->flash_num_sources > CAM_FLASH_MAX_LED_TRIGGERS) {
+			CAM_ERR(CAM_FLASH, "Invalid LED count: %d", count);
+			return;
+		}
+
+		count = fctrl->flash_num_sources;
+
+		for (i = 0; i < count; i++) {
+			CAM_DBG(CAM_FLASH, "Flash default trigger %s",
+				soc_private->flash_trigger_name[i]);
+			cam_res_mgr_led_trigger_unregister(
+				fctrl->flash_trigger[i]);
+		}
+	}
+
+	if (fctrl->torch_num_sources) {
+		if (fctrl->torch_num_sources > CAM_FLASH_MAX_LED_TRIGGERS) {
+			CAM_ERR(CAM_FLASH, "Invalid LED count: %d", count);
+			return;
+		}
+
+		count = fctrl->torch_num_sources;
+
+		for (i = 0; i < count; i++) {
+			CAM_DBG(CAM_FLASH, "Flash default trigger %s",
+				soc_private->flash_trigger_name[i]);
+			cam_res_mgr_led_trigger_unregister(
+				fctrl->torch_trigger[i]);
+		}
+	}
+}
+
+#if __or(IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2), \
+			IS_REACHABLE(CONFIG_LEDS_QTI_FLASH))
+static int32_t cam_get_source_node_info(
+	struct device_node *of_node,
+	struct cam_flash_ctrl *fctrl,
+	struct cam_flash_private_soc *soc_private)
+{
+	int32_t rc = 0;
+	uint32_t count = 0, i = 0;
+	struct device_node *flash_src_node = NULL;
+	struct device_node *torch_src_node = NULL;
+	struct device_node *switch_src_node = NULL;
+
+	soc_private->is_wled_flash =
+		of_property_read_bool(of_node, "wled-flash-support");
+
+	switch_src_node = of_parse_phandle(of_node, "switch-source", 0);
+	if (!switch_src_node) {
+		CAM_WARN(CAM_FLASH, "switch_src_node NULL");
+	} else {
+		rc = of_property_read_string(switch_src_node,
+			"qcom,default-led-trigger",
+			&soc_private->switch_trigger_name);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"default-led-trigger read failed rc=%d", rc);
+		} else {
+			CAM_DBG(CAM_FLASH, "switch trigger %s",
+				soc_private->switch_trigger_name);
+			cam_res_mgr_led_trigger_register(
+				soc_private->switch_trigger_name,
+				&fctrl->switch_trigger);
+		}
+
+		of_node_put(switch_src_node);
+	}
+
+	if (of_get_property(of_node, "flash-source", &count)) {
+		count /= sizeof(uint32_t);
+
+		if (count > CAM_FLASH_MAX_LED_TRIGGERS) {
+			CAM_ERR(CAM_FLASH, "Invalid LED count: %d", count);
+			return -EINVAL;
+		}
+
+		fctrl->flash_num_sources = count;
+
+		for (i = 0; i < count; i++) {
+			flash_src_node = of_parse_phandle(of_node,
+				"flash-source", i);
+			if (!flash_src_node) {
+				CAM_WARN(CAM_FLASH, "flash_src_node NULL");
+				continue;
+			}
+
+			rc = of_property_read_string(flash_src_node,
+				"qcom,default-led-trigger",
+				&soc_private->flash_trigger_name[i]);
+			if (rc) {
+				CAM_WARN(CAM_FLASH,
+				"defalut-led-trigger read failed rc=%d", rc);
+				of_node_put(flash_src_node);
+				continue;
+			}
+
+			CAM_DBG(CAM_FLASH, "Flash default trigger %s",
+				soc_private->flash_trigger_name[i]);
+			cam_res_mgr_led_trigger_register(
+				soc_private->flash_trigger_name[i],
+				&fctrl->flash_trigger[i]);
+
+			if (soc_private->is_wled_flash) {
+				rc = cam_flash_led_prepare(
+					fctrl->flash_trigger[i],
+					QUERY_MAX_AVAIL_CURRENT,
+					&soc_private->flash_max_current[i],
+					true);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"WLED FLASH max_current read fail: %d",
+						rc);
+					of_node_put(flash_src_node);
+					rc = 0;
+					continue;
+				}
+			} else {
+				rc = of_property_read_u32(flash_src_node,
+					"qcom,max-current",
+					&soc_private->flash_max_current[i]);
+				rc &= of_property_read_u32(flash_src_node,
+					"qcom,max-current-ma",
+					&soc_private->flash_max_current[i]);
+				if (rc < 0) {
+					CAM_WARN(CAM_FLASH,
+					"LED FLASH max-current read fail: %d",
+						rc);
+					of_node_put(flash_src_node);
+					continue;
+				}
+			}
+
+			/* Read operational-current */
+			if (of_property_read_u32(flash_src_node,
+				"qcom,current-ma",
+				&soc_private->flash_op_current[i])) {
+				CAM_DBG(CAM_FLASH, "op-current: read failed");
+			}
+
+			/* Read max-duration */
+			rc = of_property_read_u32(flash_src_node,
+				"qcom,duration-ms",
+				&soc_private->flash_max_duration[i]);
+			if (rc) {
+				CAM_DBG(CAM_FLASH,
+					"max-duration prop unavailable: %d",
+					rc);
+				rc = 0;
+			}
+			of_node_put(flash_src_node);
+
+			CAM_DBG(CAM_FLASH, "MainFlashMaxCurrent[%d]: %d",
+				i, soc_private->flash_max_current[i]);
+		}
+	}
+
+	if (of_get_property(of_node, "torch-source", &count)) {
+		count /= sizeof(uint32_t);
+		if (count > CAM_FLASH_MAX_LED_TRIGGERS) {
+			CAM_ERR(CAM_FLASH, "Invalid LED count : %d", count);
+			return -EINVAL;
+		}
+
+		fctrl->torch_num_sources = count;
+
+		CAM_DBG(CAM_FLASH, "torch_num_sources = %d",
+			fctrl->torch_num_sources);
+		for (i = 0; i < count; i++) {
+			torch_src_node = of_parse_phandle(of_node,
+				"torch-source", i);
+			if (!torch_src_node) {
+				CAM_WARN(CAM_FLASH, "torch_src_node NULL");
+				continue;
+			}
+
+			rc = of_property_read_string(torch_src_node,
+				"qcom,default-led-trigger",
+				&soc_private->torch_trigger_name[i]);
+			if (rc < 0) {
+				CAM_WARN(CAM_FLASH,
+					"default-trigger read failed");
+				of_node_put(torch_src_node);
+				continue;
+			}
+
+			CAM_DBG(CAM_FLASH, "Torch default trigger %s",
+				soc_private->torch_trigger_name[i]);
+			cam_res_mgr_led_trigger_register(
+				soc_private->torch_trigger_name[i],
+				&fctrl->torch_trigger[i]);
+
+			if (soc_private->is_wled_flash) {
+				rc = cam_flash_led_prepare(
+					fctrl->torch_trigger[i],
+					QUERY_MAX_AVAIL_CURRENT,
+					&soc_private->torch_max_current[i],
+					true);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"WLED TORCH max_current read fail: %d",
+					rc);
+					of_node_put(torch_src_node);
+					continue;
+				}
+			} else {
+				rc = of_property_read_u32(torch_src_node,
+					"qcom,max-current",
+					&soc_private->torch_max_current[i]);
+				rc &= of_property_read_u32(torch_src_node,
+					"qcom,max-current-ma",
+					&soc_private->torch_max_current[i]);
+				if (rc < 0) {
+					CAM_WARN(CAM_FLASH,
+					"LED-TORCH max-current read failed: %d",
+						rc);
+					of_node_put(torch_src_node);
+					continue;
+				}
+			}
+
+			/* Read operational-current */
+			rc = of_property_read_u32(torch_src_node,
+				"qcom,current-ma",
+				&soc_private->torch_op_current[i]);
+			if (rc < 0) {
+				CAM_WARN(CAM_FLASH,
+					"op-current prop unavailable: %d", rc);
+				rc = 0;
+			}
+
+			of_node_put(torch_src_node);
+
+			CAM_DBG(CAM_FLASH, "TorchMaxCurrent[%d]: %d",
+				i, soc_private->torch_max_current[i]);
+		}
+	}
+
+	return rc;
+}
+#endif
+
+int cam_flash_get_dt_data(struct cam_flash_ctrl *fctrl,
+	struct cam_hw_soc_info *soc_info)
+{
+	int32_t rc = 0;
+	struct device_node *of_node = NULL;
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "NULL flash control structure");
+		return -EINVAL;
+	}
+
+	soc_info->soc_private =
+		kzalloc(sizeof(struct cam_flash_private_soc), GFP_KERNEL);
+	if (!soc_info->soc_private) {
+		rc = -ENOMEM;
+		goto release_soc_res;
+	}
+
+	if (fctrl->of_node == NULL) {
+		CAM_ERR(CAM_FLASH, "device node is NULL");
+		rc = -EINVAL;
+		goto free_soc_private;
+	}
+
+	of_node = fctrl->of_node;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "Get_dt_properties failed rc %d", rc);
+		goto free_soc_private;
+	}
+
+#if __or(IS_ENABLED(CONFIG_LEDS_QPNP_FLASH_V2), \
+			IS_ENABLED(CONFIG_LEDS_QTI_FLASH))
+	rc = cam_get_source_node_info(of_node, fctrl, soc_info->soc_private);
+	if (rc) {
+		CAM_ERR(CAM_FLASH,
+			"cam_flash_get_pmic_source_info failed rc %d", rc);
+		goto free_soc_private;
+	}
+#endif
+	return rc;
+
+free_soc_private:
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+release_soc_res:
+	cam_soc_util_release_platform_resource(soc_info);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_flash/cam_flash_soc.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FLASH_SOC_H_
+#define _CAM_FLASH_SOC_H_
+
+#include "cam_flash_dev.h"
+
+int cam_flash_get_dt_data(struct cam_flash_ctrl *fctrl,
+	struct cam_hw_soc_info *soc_info);
+
+void cam_flash_put_source_node_data(struct cam_flash_ctrl *fctrl);
+#endif /*_CAM_FLASH_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_core.c
@@ -0,0 +1,1808 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/firmware.h>
+
+#include "cam_sensor_cmn_header.h"
+#include "cam_ois_core.h"
+#include "cam_ois_soc.h"
+#include "cam_sensor_util.h"
+#include "cam_debug_util.h"
+#include "cam_res_mgr_api.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+
+#define CAM_OIS_FW_VERSION_CHECK_MASK 0x1
+
+static inline uint64_t swap_high_byte_and_low_byte(uint8_t *src,
+	uint8_t size_bytes)
+{
+	uint64_t ret_value = 0x00;
+	uint8_t  cycle = 0;
+
+	for (cycle = 0; cycle < size_bytes; cycle++)
+		ret_value = ((ret_value<<8) | ((*(src+cycle))&0xff));
+
+	return ret_value;
+}
+
+static inline uint64_t swap_high_word_and_low_word(uint16_t *src,
+	uint8_t size_words)
+{
+	uint64_t ret_value = 0x00;
+	uint8_t  cycle = 0;
+
+	for (cycle = 0; cycle < size_words; cycle++)
+		ret_value = ((ret_value<<16) | ((*(src+cycle))&0xffff));
+
+	return ret_value;
+}
+
+
+int32_t cam_ois_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int rc = 0;
+
+	power_info->power_setting_size = 1;
+	power_info->power_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_setting)
+		return -ENOMEM;
+
+	power_info->power_setting[0].seq_type = SENSOR_VAF;
+	power_info->power_setting[0].seq_val = CAM_VAF;
+	power_info->power_setting[0].config_val = 1;
+	power_info->power_setting[0].delay = 2;
+
+	power_info->power_down_setting_size = 1;
+	power_info->power_down_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_down_setting) {
+		rc = -ENOMEM;
+		goto free_power_settings;
+	}
+
+	power_info->power_down_setting[0].seq_type = SENSOR_VAF;
+	power_info->power_down_setting[0].seq_val = CAM_VAF;
+	power_info->power_down_setting[0].config_val = 0;
+
+	return rc;
+
+free_power_settings:
+	kfree(power_info->power_setting);
+	power_info->power_setting = NULL;
+	power_info->power_setting_size = 0;
+	return rc;
+}
+
+
+/**
+ * cam_ois_get_dev_handle - get device handle
+ * @o_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+static int cam_ois_get_dev_handle(struct cam_ois_ctrl_t *o_ctrl,
+	void *arg)
+{
+	struct cam_sensor_acquire_dev    ois_acq_dev;
+	struct cam_create_dev_hdl        bridge_params;
+	struct cam_control              *cmd = (struct cam_control *)arg;
+
+	if (o_ctrl->bridge_intf.device_hdl != -1) {
+		CAM_ERR(CAM_OIS, "Device is already acquired");
+		return -EFAULT;
+	}
+	if (copy_from_user(&ois_acq_dev, u64_to_user_ptr(cmd->handle),
+		sizeof(ois_acq_dev)))
+		return -EFAULT;
+
+	bridge_params.session_hdl = ois_acq_dev.session_handle;
+	bridge_params.ops = &o_ctrl->bridge_intf.ops;
+	bridge_params.v4l2_sub_dev_flag = 0;
+	bridge_params.media_entity_flag = 0;
+	bridge_params.priv = o_ctrl;
+	bridge_params.dev_id = CAM_OIS;
+
+	ois_acq_dev.device_handle =
+		cam_create_device_hdl(&bridge_params);
+	if (ois_acq_dev.device_handle <= 0) {
+		CAM_ERR(CAM_OIS, "Can not create device handle");
+		return -EFAULT;
+	}
+	o_ctrl->bridge_intf.device_hdl = ois_acq_dev.device_handle;
+	o_ctrl->bridge_intf.session_hdl = ois_acq_dev.session_handle;
+
+	CAM_DBG(CAM_OIS, "Device Handle: %d", ois_acq_dev.device_handle);
+	if (copy_to_user(u64_to_user_ptr(cmd->handle), &ois_acq_dev,
+		sizeof(struct cam_sensor_acquire_dev))) {
+		CAM_ERR(CAM_OIS, "ACQUIRE_DEV: copy to user failed");
+		return -EFAULT;
+	}
+	return 0;
+}
+
+static int cam_ois_power_up(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int                                     rc = 0;
+	struct cam_hw_soc_info                 *soc_info = &o_ctrl->soc_info;
+	struct cam_ois_soc_private             *soc_private;
+	struct cam_sensor_power_ctrl_t         *power_info;
+	struct completion                      *i3c_probe_completion = NULL;
+
+	soc_private = (struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	if ((power_info->power_setting == NULL) &&
+		(power_info->power_down_setting == NULL)) {
+		CAM_INFO(CAM_OIS,
+			"Using default power settings");
+		rc = cam_ois_construct_default_power_setting(power_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Construct default ois power setting failed.");
+			return rc;
+		}
+	}
+
+	/* Parse and fill vreg params for power up settings */
+	rc = msm_camera_fill_vreg_params(
+		soc_info,
+		power_info->power_setting,
+		power_info->power_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_OIS,
+			"failed to fill vreg params for power up rc:%d", rc);
+		return rc;
+	}
+
+	/* Parse and fill vreg params for power down settings*/
+	rc = msm_camera_fill_vreg_params(
+		soc_info,
+		power_info->power_down_setting,
+		power_info->power_down_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_OIS,
+			"failed to fill vreg params for power down rc:%d", rc);
+		return rc;
+	}
+
+	power_info->dev = soc_info->dev;
+
+	if (o_ctrl->io_master_info.master_type == I3C_MASTER)
+		i3c_probe_completion = cam_ois_get_i3c_completion(o_ctrl->soc_info.index);
+
+	rc = cam_sensor_core_power_up(power_info, soc_info, i3c_probe_completion);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "failed in ois power up rc %d", rc);
+		return rc;
+	}
+
+	rc = camera_io_init(&o_ctrl->io_master_info);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "cci_init failed: rc: %d", rc);
+		goto cci_failure;
+	}
+
+	return rc;
+cci_failure:
+	if (cam_sensor_util_power_down(power_info, soc_info))
+		CAM_ERR(CAM_OIS, "Power Down failed");
+
+	return rc;
+}
+
+/**
+ * cam_ois_power_down - power down OIS device
+ * @o_ctrl:     ctrl structure
+ *
+ * Returns success or failure
+ */
+static int cam_ois_power_down(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int32_t                         rc = 0;
+	struct cam_sensor_power_ctrl_t  *power_info;
+	struct cam_hw_soc_info          *soc_info =
+		&o_ctrl->soc_info;
+	struct cam_ois_soc_private *soc_private;
+
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "failed: o_ctrl %pK", o_ctrl);
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+	soc_info = &o_ctrl->soc_info;
+
+	if (!power_info) {
+		CAM_ERR(CAM_OIS, "failed: power_info %pK", power_info);
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_power_down(power_info, soc_info);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "power down the core is failed:%d", rc);
+		return rc;
+	}
+
+	camera_io_release(&o_ctrl->io_master_info);
+	o_ctrl->cam_ois_state = CAM_OIS_ACQUIRE;
+
+	return rc;
+}
+
+static int cam_ois_update_time(struct i2c_settings_array *i2c_set,
+	enum cam_endianness_type endianness)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0;
+	uint32_t size = 0;
+	uint32_t i = 0;
+	uint64_t qtime_ns = 0;
+
+	if (i2c_set == NULL) {
+		CAM_ERR(CAM_OIS, "Invalid Args");
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_get_current_qtimer_ns(&qtime_ns);
+	if (rc < 0) {
+		CAM_ERR(CAM_OIS,
+			"Failed to get current qtimer value: %d",
+			rc);
+		return rc;
+	}
+
+	if (endianness == CAM_ENDIANNESS_BIG)
+		qtime_ns = swap_high_word_and_low_word((uint16_t *)(&qtime_ns),
+					sizeof(qtime_ns) / sizeof(uint16_t));
+
+	list_for_each_entry(i2c_list,
+		&(i2c_set->list_head), list) {
+		if (i2c_list->op_code ==  CAM_SENSOR_I2C_WRITE_SEQ) {
+			size = i2c_list->i2c_settings.size;
+			/* qtimer is 8 bytes so validate here*/
+			if (size * (uint32_t)(i2c_list->i2c_settings.data_type) != 8) {
+				CAM_ERR(CAM_OIS, "Invalid write time settings");
+				return -EINVAL;
+			}
+			switch (i2c_list->i2c_settings.data_type) {
+			case CAMERA_SENSOR_I2C_TYPE_BYTE:
+				for (i = 0; i < size; i++) {
+					CAM_DBG(CAM_OIS, "time: reg_data[%d]: 0x%x",
+						i, (qtime_ns & 0xFF));
+					i2c_list->i2c_settings.reg_setting[i].reg_data =
+						(qtime_ns & 0xFF);
+					qtime_ns >>= 8;
+				}
+
+				break;
+			case CAMERA_SENSOR_I2C_TYPE_WORD:
+				for (i = 0; i < size; i++) {
+					uint16_t  data = (qtime_ns & 0xFFFF);
+					i2c_list->i2c_settings.reg_setting[i].reg_data =
+						data;
+
+					qtime_ns >>= 16;
+
+					CAM_DBG(CAM_OIS, "time: reg_data[%d]: 0x%x",
+							i, data);
+				}
+
+				break;
+			default:
+				CAM_ERR(CAM_OIS, "Unsupported reg data type");
+				return -EINVAL;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ois_apply_settings(struct cam_ois_ctrl_t *o_ctrl,
+	struct i2c_settings_array *i2c_set)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0;
+	uint32_t i, size;
+
+	if (o_ctrl == NULL || i2c_set == NULL) {
+		CAM_ERR(CAM_OIS, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (i2c_set->is_settings_valid != 1) {
+		CAM_ERR(CAM_OIS, " Invalid settings");
+		return -EINVAL;
+	}
+
+	list_for_each_entry(i2c_list,
+		&(i2c_set->list_head), list) {
+		if (i2c_list->op_code ==  CAM_SENSOR_I2C_WRITE_RANDOM) {
+			rc = camera_io_dev_write(&(o_ctrl->io_master_info),
+				&(i2c_list->i2c_settings));
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+					"Failed in Applying i2c wrt settings");
+				return rc;
+			}
+		} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_SEQ) {
+			rc = camera_io_dev_write_continuous(
+				&(o_ctrl->io_master_info),
+				&(i2c_list->i2c_settings),
+				CAM_SENSOR_I2C_WRITE_SEQ);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+					"Failed to seq write I2C settings: %d",
+					rc);
+				return rc;
+			}
+		} else if (i2c_list->op_code == CAM_SENSOR_I2C_POLL) {
+			size = i2c_list->i2c_settings.size;
+			for (i = 0; i < size; i++) {
+				rc = camera_io_dev_poll(
+				&(o_ctrl->io_master_info),
+				i2c_list->i2c_settings.reg_setting[i].reg_addr,
+				i2c_list->i2c_settings.reg_setting[i].reg_data,
+				i2c_list->i2c_settings.reg_setting[i].data_mask,
+				i2c_list->i2c_settings.addr_type,
+				i2c_list->i2c_settings.data_type,
+				i2c_list->i2c_settings.reg_setting[i].delay);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+						"i2c poll apply setting Fail");
+					return rc;
+				} else if (rc ==  I2C_COMPARE_MISMATCH) {
+					CAM_ERR(CAM_OIS, "i2c poll mismatch");
+					return rc;
+				}
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ois_slaveInfo_pkt_parser(struct cam_ois_ctrl_t *o_ctrl,
+	uint32_t *cmd_buf, size_t len)
+{
+	int32_t rc = 0;
+	struct cam_cmd_ois_info *ois_info;
+
+	if (!o_ctrl || !cmd_buf || len < sizeof(struct cam_cmd_ois_info)) {
+		CAM_ERR(CAM_OIS, "Invalid Args");
+		return -EINVAL;
+	}
+
+	ois_info = (struct cam_cmd_ois_info *)cmd_buf;
+	if (o_ctrl->io_master_info.master_type == CCI_MASTER) {
+		o_ctrl->io_master_info.cci_client->i2c_freq_mode =
+			ois_info->i2c_freq_mode;
+		o_ctrl->io_master_info.cci_client->sid =
+			ois_info->slave_addr >> 1;
+		o_ctrl->ois_fw_flag = ois_info->ois_fw_flag;
+		o_ctrl->is_ois_calib = ois_info->is_ois_calib;
+		memcpy(o_ctrl->ois_name, ois_info->ois_name, OIS_NAME_LEN);
+		o_ctrl->ois_name[OIS_NAME_LEN - 1] = '\0';
+		o_ctrl->io_master_info.cci_client->retries = 3;
+		o_ctrl->io_master_info.cci_client->id_map = 0;
+		memcpy(&(o_ctrl->opcode), &(ois_info->opcode),
+			sizeof(struct cam_ois_opcode));
+		CAM_DBG(CAM_OIS, "Slave addr: 0x%x Freq Mode: %d",
+			ois_info->slave_addr, ois_info->i2c_freq_mode);
+	} else if (o_ctrl->io_master_info.master_type == I2C_MASTER) {
+		o_ctrl->io_master_info.client->addr = ois_info->slave_addr;
+		CAM_DBG(CAM_OIS, "Slave addr: 0x%x", ois_info->slave_addr);
+	} else {
+		CAM_ERR(CAM_OIS, "Invalid Master type : %d",
+			o_ctrl->io_master_info.master_type);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_ois_parse_fw_setting(uint8_t *cmd_buf, uint32_t size,
+	struct i2c_settings_array *reg_settings)
+{
+	int32_t                 rc = 0;
+	uint32_t                byte_cnt = 0;
+	struct common_header   *cmm_hdr;
+	uint16_t                op_code;
+	uint32_t                j = 0;
+	struct list_head       *list = NULL;
+
+	while (byte_cnt < size) {
+		if ((size - byte_cnt) < sizeof(struct common_header)) {
+			CAM_ERR(CAM_OIS, "Not enough buffer");
+			rc = -EINVAL;
+			goto end;
+		}
+		cmm_hdr = (struct common_header *)cmd_buf;
+		op_code = cmm_hdr->fifth_byte;
+		CAM_DBG(CAM_OIS, "Command Type:%d, Op code:%d",
+				 cmm_hdr->cmd_type, op_code);
+
+		switch (cmm_hdr->cmd_type) {
+		case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR: {
+			uint32_t cmd_length_in_bytes = 0;
+			struct cam_cmd_i2c_random_wr
+			*cam_cmd_i2c_random_wr =
+			(struct cam_cmd_i2c_random_wr *)cmd_buf;
+
+			if ((size - byte_cnt) < sizeof(struct cam_cmd_i2c_random_wr)) {
+				CAM_ERR(CAM_OIS,
+					"Not enough buffer provided,size %d,byte_cnt %d",
+					size, byte_cnt);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			rc = cam_sensor_handle_random_write(
+				cam_cmd_i2c_random_wr,
+				reg_settings,
+				&cmd_length_in_bytes, &j, &list);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+				"Failed in random write %d", rc);
+				goto end;
+			}
+
+			byte_cnt += sizeof(struct cam_cmd_i2c_random_wr);
+			cmd_buf += sizeof(struct cam_cmd_i2c_random_wr);
+
+			break;
+		}
+		case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_WR: {
+			uint32_t cmd_length_in_bytes = 0;
+			struct cam_cmd_i2c_continuous_wr
+			*cam_cmd_i2c_continuous_wr =
+			(struct cam_cmd_i2c_continuous_wr *)cmd_buf;
+
+			if ((size - byte_cnt) < sizeof(struct cam_cmd_i2c_continuous_wr)) {
+				CAM_ERR(CAM_OIS,
+					"Not enough buffer provided,size %d,byte_cnt %d",
+					size, byte_cnt);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			rc = cam_sensor_handle_continuous_write(
+				cam_cmd_i2c_continuous_wr,
+				reg_settings,
+				&cmd_length_in_bytes, &j, &list);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+				"Failed in continuous write %d", rc);
+				goto end;
+			}
+
+			byte_cnt += sizeof(struct cam_cmd_i2c_continuous_wr);
+			cmd_buf += sizeof(struct cam_cmd_i2c_continuous_wr);
+
+			break;
+		}
+		case CAMERA_SENSOR_CMD_TYPE_WAIT: {
+			if (op_code == CAMERA_SENSOR_WAIT_OP_HW_UCND ||
+				op_code == CAMERA_SENSOR_WAIT_OP_SW_UCND) {
+				if ((size - byte_cnt) <
+					sizeof(struct cam_cmd_unconditional_wait)) {
+					CAM_ERR(CAM_OIS,
+						"Not enough buffer provided,size %d,byte_cnt %d",
+						size, byte_cnt);
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_delay(
+					(uint32_t **)(&cmd_buf), op_code,
+					reg_settings, j, &byte_cnt,
+					list);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+						"delay hdl failed: %d",
+						rc);
+					goto end;
+				}
+			} else if (op_code == CAMERA_SENSOR_WAIT_OP_COND) {
+				if ((size - byte_cnt) <
+					sizeof(struct cam_cmd_conditional_wait)) {
+					CAM_ERR(CAM_OIS,
+						"Not enough buffer provided,size %d,byte_cnt %d",
+						size, byte_cnt);
+					rc = -EINVAL;
+					goto end;
+				}
+				rc = cam_sensor_handle_poll(
+					(uint32_t **)(&cmd_buf), reg_settings,
+					&byte_cnt, &j, &list);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+						"parsing POLL fail: %d",
+						rc);
+					goto end;
+				}
+			} else {
+				CAM_ERR(CAM_OIS,
+					"Wrong Wait Command: %d",
+					op_code);
+				rc = -EINVAL;
+				goto end;
+			}
+			break;
+		}
+		case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_RD: {
+			uint16_t cmd_length_in_bytes = 0;
+			struct cam_cmd_i2c_random_rd *i2c_random_rd =
+			(struct cam_cmd_i2c_random_rd *)cmd_buf;
+
+			if ((size - byte_cnt) < sizeof(struct cam_cmd_i2c_random_rd)) {
+				CAM_ERR(CAM_OIS,
+					"Not enough buffer provided,size %d,byte_cnt %d",
+					size, byte_cnt);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			rc = cam_sensor_handle_random_read(
+				i2c_random_rd,
+				reg_settings,
+				&cmd_length_in_bytes, &j, &list,
+				NULL);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+				"Failed in random read %d", rc);
+				goto end;
+			}
+
+			byte_cnt += sizeof(struct cam_cmd_i2c_random_rd);
+			cmd_buf += sizeof(struct cam_cmd_i2c_random_rd);
+
+			break;
+		}
+		case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD: {
+			uint16_t cmd_length_in_bytes = 0;
+			struct cam_cmd_i2c_continuous_rd
+			*i2c_continuous_rd =
+			(struct cam_cmd_i2c_continuous_rd *)cmd_buf;
+
+			if ((size - byte_cnt) < sizeof(struct cam_cmd_i2c_continuous_rd)) {
+				CAM_ERR(CAM_OIS,
+					"Not enough buffer provided,size %d,byte_cnt %d",
+					size, byte_cnt);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			rc = cam_sensor_handle_continuous_read(
+				i2c_continuous_rd,
+				reg_settings,
+				&cmd_length_in_bytes, &j, &list,
+				NULL);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+				"Failed in continuous read %d", rc);
+				goto end;
+			}
+
+			byte_cnt += sizeof(struct cam_cmd_i2c_continuous_rd);
+			cmd_buf += sizeof(struct cam_cmd_i2c_continuous_rd);
+
+			break;
+		}
+		default:
+			CAM_ERR(CAM_OIS, "Invalid Command Type:%d",
+				 cmm_hdr->cmd_type);
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ois_fw_info_pkt_parser(struct cam_ois_ctrl_t *o_ctrl,
+	uint32_t *cmd_buf, size_t len)
+{
+	int32_t                         rc = 0;
+	struct cam_cmd_ois_fw_info     *ois_fw_info;
+	uint8_t                        *pSettingData = NULL;
+	uint32_t                        size = 0;
+	uint32_t                        version_size = 0;
+	struct i2c_settings_array      *reg_settings = NULL;
+	uint8_t                         count = 0;
+	uint32_t                        idx;
+
+	if (!o_ctrl || !cmd_buf || len < sizeof(struct cam_cmd_ois_fw_info)) {
+		CAM_ERR(CAM_OIS, "Invalid Args,o_ctrl %p,cmd_buf %p,len %d",
+			o_ctrl, cmd_buf, len);
+		return -EINVAL;
+	}
+
+	ois_fw_info = (struct cam_cmd_ois_fw_info *)cmd_buf;
+	CAM_DBG(CAM_OIS, "endianness %d, fw_count %d",
+		ois_fw_info->endianness, ois_fw_info->fw_count);
+
+	if (ois_fw_info->fw_count <= MAX_OIS_FW_COUNT) {
+		memcpy(&o_ctrl->fw_info, ois_fw_info, sizeof(struct cam_cmd_ois_fw_info));
+		pSettingData = (uint8_t *)cmd_buf + sizeof(struct cam_cmd_ois_fw_info);
+
+		if ((ois_fw_info->param_mask & CAM_OIS_FW_VERSION_CHECK_MASK) == 0x1) {
+			version_size = ois_fw_info->params[0];
+			CAM_DBG(CAM_OIS, "versionSize: %d", version_size);
+		}
+
+		if ((version_size != 0) && (o_ctrl->i2c_fw_version_data.is_settings_valid == 0)) {
+			reg_settings = &o_ctrl->i2c_fw_version_data;
+			reg_settings->is_settings_valid = 1;
+			rc = cam_ois_parse_fw_setting(pSettingData, version_size, reg_settings);
+			if (rc) {
+				CAM_ERR(CAM_OIS, "Failed to parse fw version settings");
+				return rc;
+			}
+
+			pSettingData += version_size;
+		}
+
+		for (count = 0; count < ois_fw_info->fw_count*2; count++) {
+			idx = count / 2;
+			/* init settings */
+			if ((count & 0x1) == 0) {
+				size = ois_fw_info->fw_param[idx].fw_init_size;
+				reg_settings = &o_ctrl->i2c_fw_init_data[idx];
+				CAM_DBG(CAM_OIS, "init size %d", size);
+			/* finalize settings */
+			} else if ((count & 0x1) == 1) {
+				size = ois_fw_info->fw_param[idx].fw_finalize_size;
+				reg_settings = &o_ctrl->i2c_fw_finalize_data[idx];
+				CAM_DBG(CAM_OIS, "finalize size %d", size);
+			} else {
+				size = 0;
+				CAM_DBG(CAM_OIS, "Unsupported case");
+				return -EINVAL;
+			}
+
+			if (size != 0) {
+				reg_settings->is_settings_valid = 1;
+				rc = cam_ois_parse_fw_setting(pSettingData, size, reg_settings);
+			}
+
+			if (rc) {
+				CAM_ERR(CAM_OIS, "Failed to parse fw setting");
+				return rc;
+			}
+
+			pSettingData += size;
+		}
+	} else {
+		CAM_ERR(CAM_OIS, "Exceed max fw count");
+	}
+
+	return rc;
+}
+
+static int cam_ois_fw_download(struct cam_ois_ctrl_t *o_ctrl)
+{
+	uint16_t                           total_bytes = 0;
+	uint8_t                           *ptr = NULL;
+	int32_t                            rc = 0, cnt;
+	uint32_t                           fw_size;
+	const struct firmware             *fw = NULL;
+	const char                        *fw_name_prog = NULL;
+	const char                        *fw_name_coeff = NULL;
+	char                               name_prog[32] = {0};
+	char                               name_coeff[32] = {0};
+	struct device                     *dev = &(o_ctrl->pdev->dev);
+	struct cam_sensor_i2c_reg_setting  i2c_reg_setting;
+	void                              *vaddr = NULL;
+
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "Invalid Args");
+		return -EINVAL;
+	}
+
+	snprintf(name_coeff, 32, "%s.coeff", o_ctrl->ois_name);
+
+	snprintf(name_prog, 32, "%s.prog", o_ctrl->ois_name);
+
+	/* cast pointer as const pointer*/
+	fw_name_prog = name_prog;
+	fw_name_coeff = name_coeff;
+
+	/* Load FW */
+	rc = request_firmware(&fw, fw_name_prog, dev);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "Failed to locate %s", fw_name_prog);
+		return rc;
+	}
+
+	total_bytes = fw->size;
+	i2c_reg_setting.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	i2c_reg_setting.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	i2c_reg_setting.size = total_bytes;
+	i2c_reg_setting.delay = 0;
+	fw_size = (sizeof(struct cam_sensor_i2c_reg_array) * total_bytes);
+	vaddr = vmalloc(fw_size);
+	if (!vaddr) {
+		CAM_ERR(CAM_OIS,
+			"Failed in allocating i2c_array: fw_size: %u", fw_size);
+		release_firmware(fw);
+		return -ENOMEM;
+	}
+
+	CAM_DBG(CAM_OIS, "FW prog size:%d.", total_bytes);
+
+	i2c_reg_setting.reg_setting = (struct cam_sensor_i2c_reg_array *) (
+		vaddr);
+
+	for (cnt = 0, ptr = (uint8_t *)fw->data; cnt < total_bytes;
+		cnt++, ptr++) {
+		i2c_reg_setting.reg_setting[cnt].reg_addr =
+			o_ctrl->opcode.prog;
+		i2c_reg_setting.reg_setting[cnt].reg_data = *ptr;
+		i2c_reg_setting.reg_setting[cnt].delay = 0;
+		i2c_reg_setting.reg_setting[cnt].data_mask = 0;
+	}
+
+	rc = camera_io_dev_write_continuous(&(o_ctrl->io_master_info),
+		&i2c_reg_setting, CAM_SENSOR_I2C_WRITE_BURST);
+	if (rc < 0) {
+		CAM_ERR(CAM_OIS, "OIS FW(prog) size(%d) download failed. %d",
+			total_bytes, rc);
+		goto release_firmware;
+	}
+	vfree(vaddr);
+	vaddr = NULL;
+	release_firmware(fw);
+
+	rc = request_firmware(&fw, fw_name_coeff, dev);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "Failed to locate %s", fw_name_coeff);
+		return rc;
+	}
+
+	total_bytes = fw->size;
+	i2c_reg_setting.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	i2c_reg_setting.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	i2c_reg_setting.size = total_bytes;
+	i2c_reg_setting.delay = 0;
+	fw_size = (sizeof(struct cam_sensor_i2c_reg_array) * total_bytes);
+	vaddr = vmalloc(fw_size);
+	if (!vaddr) {
+		CAM_ERR(CAM_OIS,
+			"Failed in allocating i2c_array: fw_size: %u", fw_size);
+		release_firmware(fw);
+		return -ENOMEM;
+	}
+
+	CAM_DBG(CAM_OIS, "FW coeff size:%d", total_bytes);
+
+	i2c_reg_setting.reg_setting = (struct cam_sensor_i2c_reg_array *) (
+		vaddr);
+
+	for (cnt = 0, ptr = (uint8_t *)fw->data; cnt < total_bytes;
+		cnt++, ptr++) {
+		i2c_reg_setting.reg_setting[cnt].reg_addr =
+			o_ctrl->opcode.coeff;
+		i2c_reg_setting.reg_setting[cnt].reg_data = *ptr;
+		i2c_reg_setting.reg_setting[cnt].delay = 0;
+		i2c_reg_setting.reg_setting[cnt].data_mask = 0;
+	}
+
+	rc = camera_io_dev_write_continuous(&(o_ctrl->io_master_info),
+		&i2c_reg_setting, CAM_SENSOR_I2C_WRITE_BURST);
+
+	if (rc < 0)
+		CAM_ERR(CAM_OIS, "OIS FW(coeff) size(%d) download failed rc: %d",
+			total_bytes, rc);
+
+release_firmware:
+	vfree(vaddr);
+	vaddr = NULL;
+	release_firmware(fw);
+	return rc;
+}
+
+static int write_ois_fw(uint8_t *fw_data, enum cam_endianness_type endianness,
+	struct cam_cmd_ois_fw_param *fw_param, struct camera_io_master io_master_info,
+	uint8_t i2c_operation)
+{
+	int32_t                             rc = 0;
+	struct cam_sensor_i2c_reg_setting   setting;
+	uint8_t                            *ptr = fw_data;
+	int32_t                             cnt = 0, wcnt = 0;
+	void                               *vaddr = NULL;
+	uint16_t                            data_type = fw_param->fw_data_type;
+	uint16_t                            len_per_write = fw_param->fw_len_per_write /
+								fw_param->fw_data_type;
+
+	vaddr = vmalloc((sizeof(struct cam_sensor_i2c_reg_array) * len_per_write));
+	if (!vaddr) {
+		CAM_ERR(CAM_OIS,
+			"Failed in allocating i2c_array: size: %u",
+			(sizeof(struct cam_sensor_i2c_reg_array) * len_per_write));
+		return -ENOMEM;
+	}
+
+	setting.reg_setting = (struct cam_sensor_i2c_reg_array *) (vaddr);
+	setting.addr_type   = fw_param->fw_addr_type;
+	setting.data_type   = fw_param->fw_data_type;
+	setting.size        = len_per_write;
+	setting.delay       = fw_param->fw_delayUs;
+
+	for (wcnt = 0; wcnt < (fw_param->fw_size/data_type); wcnt += len_per_write) {
+		for (cnt = 0; cnt < len_per_write; cnt++, ptr += data_type) {
+			setting.reg_setting[cnt].reg_addr =
+				fw_param->fw_reg_addr + wcnt + cnt;
+			/* Big */
+			if (endianness == CAM_ENDIANNESS_BIG) {
+				setting.reg_setting[cnt].reg_data =
+					(uint32_t)swap_high_byte_and_low_byte(ptr, data_type);
+			/* Little */
+			} else if (endianness == CAM_ENDIANNESS_LITTLE) {
+				switch (data_type) {
+				case CAMERA_SENSOR_I2C_TYPE_BYTE:
+					setting.reg_setting[cnt].reg_data = *((uint8_t *)ptr);
+					break;
+				case CAMERA_SENSOR_I2C_TYPE_WORD:
+					setting.reg_setting[cnt].reg_data = *((uint16_t *)ptr);
+					break;
+				default:
+					CAM_ERR(CAM_OIS,
+						"Unsupported data type");
+					rc = -EINVAL;
+					goto End;
+				}
+			}
+
+			setting.reg_setting[cnt].delay = fw_param->fw_delayUs;
+			setting.reg_setting[cnt].data_mask = 0;
+		}
+
+		if (i2c_operation == CAM_SENSOR_I2C_WRITE_RANDOM) {
+			rc = camera_io_dev_write(&(io_master_info),
+				&setting);
+		} else if (i2c_operation == CAM_SENSOR_I2C_WRITE_BURST ||
+			i2c_operation == CAM_SENSOR_I2C_WRITE_SEQ) {
+			rc = camera_io_dev_write_continuous(&io_master_info,
+				&setting, i2c_operation);
+		}
+
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Failed in Applying i2c wrt settings");
+			break;
+		}
+	}
+
+End:
+	vfree(vaddr);
+	vaddr = NULL;
+
+	return rc;
+}
+
+static int cam_ois_fw_download_v2(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int32_t                             rc = 0;
+	struct cam_cmd_ois_fw_param        *fw_param = NULL;
+	uint32_t                            fw_size;
+	uint16_t                            len_per_write = 0;
+	uint8_t                            *ptr = NULL;
+	const struct firmware              *fw = NULL;
+	struct device                      *dev = &(o_ctrl->pdev->dev);
+	uint8_t                             count = 0;
+	uint8_t                             cont_wr_flag = 0;
+
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (o_ctrl->i2c_fw_version_data.is_settings_valid == 1) {
+		CAM_DBG(CAM_OIS, "check version to decide FW download");
+		rc = cam_ois_apply_settings(o_ctrl, &o_ctrl->i2c_fw_version_data);
+		if ((rc == -EAGAIN) &&
+			(o_ctrl->io_master_info.master_type == CCI_MASTER)) {
+			CAM_WARN(CAM_OIS,
+			"CCI HW is resetting: Reapplying FW init settings");
+			usleep_range(1000, 1010);
+			rc = cam_ois_apply_settings(o_ctrl,
+				&o_ctrl->i2c_fw_version_data);
+		}
+
+		if (delete_request(&o_ctrl->i2c_fw_version_data) < 0)
+			CAM_WARN(CAM_OIS,
+				"Fail deleting i2c_fw_version_data: rc: %d", rc);
+
+		if (rc == I2C_COMPARE_MATCH) {
+			CAM_INFO(CAM_OIS,
+				"OIS FW version matched, skipping FW download");
+			return rc;
+		} else if (rc == I2C_COMPARE_MISMATCH) {
+			CAM_INFO(CAM_OIS, "OIS FW version not matched, load FW");
+		} else {
+			CAM_WARN(CAM_OIS, "OIS FW version check failed,rc=%d", rc);
+		}
+	}
+
+	for (count = 0; count < o_ctrl->fw_info.fw_count; count++) {
+		fw_param      = &o_ctrl->fw_info.fw_param[count];
+		fw_size       = fw_param->fw_size;
+		len_per_write = fw_param->fw_len_per_write / fw_param->fw_data_type;
+
+		CAM_DBG(CAM_OIS, "count: %d, fw_size: %d, data_type: %d, len_per_write: %d",
+			count, fw_size, fw_param->fw_data_type, len_per_write);
+
+		/* Load FW */
+		rc = request_firmware(&fw, fw_param->fw_name, dev);
+		if (rc) {
+			CAM_ERR(CAM_OIS, "Failed to locate %s", fw_param->fw_name);
+			return rc;
+		}
+
+		if (0 == rc && NULL != fw &&
+			(fw_size <= fw->size - fw_param->fw_start_pos)) {
+
+			/* fw init */
+			CAM_DBG(CAM_OIS, "fw init");
+			if (o_ctrl->i2c_fw_init_data[count].is_settings_valid == 1) {
+				rc = cam_ois_apply_settings(o_ctrl,
+					&o_ctrl->i2c_fw_init_data[count]);
+				if ((rc == -EAGAIN) &&
+					(o_ctrl->io_master_info.master_type == CCI_MASTER)) {
+					CAM_WARN(CAM_OIS,
+					"CCI HW is resetting: Reapplying FW init settings");
+					usleep_range(1000, 1010);
+					rc = cam_ois_apply_settings(o_ctrl,
+						&o_ctrl->i2c_fw_init_data[count]);
+				}
+				if (rc) {
+					CAM_ERR(CAM_OIS,
+						"Cannot apply FW init settings %d",
+						rc);
+					goto release_firmware;
+				} else {
+					CAM_DBG(CAM_OIS, "OIS FW init settings success");
+				}
+			}
+
+			/* send fw */
+			CAM_DBG(CAM_OIS, "send fw, operation %d", fw_param->fw_operation);
+
+			ptr = (uint8_t *)(fw->data + fw_param->fw_start_pos);
+			if (fw_param->fw_operation == CAMERA_SENSOR_I2C_OP_RNDM_WR)
+				cont_wr_flag = CAM_SENSOR_I2C_WRITE_RANDOM;
+			else if (fw_param->fw_operation == CAMERA_SENSOR_I2C_OP_CONT_WR_BRST)
+				cont_wr_flag = CAM_SENSOR_I2C_WRITE_BURST;
+			else if (fw_param->fw_operation == CAMERA_SENSOR_I2C_OP_CONT_WR_SEQN)
+				cont_wr_flag = CAM_SENSOR_I2C_WRITE_SEQ;
+
+			write_ois_fw(ptr, (o_ctrl->fw_info.endianness & OIS_ENDIANNESS_MASK_FW),
+					fw_param, o_ctrl->io_master_info, cont_wr_flag);
+
+			/* fw finalize */
+			CAM_DBG(CAM_OIS, "fw finalize");
+			if (o_ctrl->i2c_fw_finalize_data[count].is_settings_valid == 1) {
+				rc = cam_ois_apply_settings(o_ctrl,
+					&o_ctrl->i2c_fw_finalize_data[count]);
+				if ((rc == -EAGAIN) &&
+					(o_ctrl->io_master_info.master_type == CCI_MASTER)) {
+					CAM_WARN(CAM_OIS,
+					"CCI HW is resetting: Reapplying FW finalize settings");
+					usleep_range(1000, 1010);
+					rc = cam_ois_apply_settings(o_ctrl,
+						&o_ctrl->i2c_fw_finalize_data[count]);
+				}
+				if (rc) {
+					CAM_ERR(CAM_OIS,
+						"Cannot apply FW finalize settings %d",
+						rc);
+					goto release_firmware;
+				} else {
+					CAM_DBG(CAM_OIS, "OIS FW finalize settings success");
+				}
+			}
+		}
+
+		if (fw != NULL) {
+			release_firmware(fw);
+			fw = NULL;
+		}
+	}
+
+release_firmware:
+	if (fw != NULL) {
+		release_firmware(fw);
+		fw = NULL;
+	}
+
+	return rc;
+}
+
+/**
+ * cam_ois_pkt_parse - Parse csl packet
+ * @o_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
+{
+	int32_t                         rc = 0;
+	int32_t                         i = 0;
+	uint32_t                        total_cmd_buf_in_bytes = 0;
+	struct common_header           *cmm_hdr = NULL;
+	uintptr_t                       generic_ptr;
+	struct cam_control             *ioctl_ctrl = NULL;
+	struct cam_config_dev_cmd       dev_config;
+	struct i2c_settings_array      *i2c_reg_settings = NULL;
+	struct cam_cmd_buf_desc        *cmd_desc = NULL;
+	uintptr_t                       generic_pkt_addr;
+	size_t                          pkt_len;
+	size_t                          remain_len = 0;
+	struct cam_packet              *csl_packet = NULL;
+	struct cam_packet              *csl_packet_u = NULL;
+	size_t                          len_of_buff = 0;
+	uint32_t                       *offset = NULL, *cmd_buf;
+	struct cam_ois_soc_private     *soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t  *power_info = &soc_private->power_info;
+	size_t                           packet_size = 0;
+
+	ioctl_ctrl = (struct cam_control *)arg;
+	if (copy_from_user(&dev_config,
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(dev_config)))
+		return -EFAULT;
+	rc = cam_mem_get_cpu_buf(dev_config.packet_handle,
+		&generic_pkt_addr, &pkt_len);
+	if (rc) {
+		CAM_ERR(CAM_OIS,
+			"error in converting command Handle Error: %d", rc);
+		return rc;
+	}
+
+	remain_len = pkt_len;
+	if ((sizeof(struct cam_packet) > pkt_len) ||
+		((size_t)dev_config.offset >= pkt_len -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_OIS,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), pkt_len);
+		rc = -EINVAL;
+		goto put_ref;
+	}
+
+	remain_len -= (size_t)dev_config.offset;
+	csl_packet_u = (struct cam_packet *)
+		(generic_pkt_addr + (uint32_t)dev_config.offset);
+	packet_size = csl_packet_u->header.size;
+	if (packet_size <= remain_len) {
+		rc = cam_common_mem_kdup((void **)&csl_packet,
+			csl_packet_u, packet_size);
+		if (rc) {
+			CAM_ERR(CAM_OIS, "Alloc and copy request %lld packet fail",
+				csl_packet_u->header.request_id);
+			goto put_ref;
+		}
+	} else {
+		CAM_ERR(CAM_OIS, "Invalid packet header size %u",
+			packet_size);
+		rc = -EINVAL;
+		goto put_ref;
+	}
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_OIS, "Invalid packet params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_OIS_PACKET_OPCODE_INIT:
+		CAM_DBG(CAM_OIS, "CAM_OIS_PACKET_OPCODE_INIT,num_cmd_buf %d",
+			csl_packet->num_cmd_buf);
+
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+		/* Loop through multiple command buffers */
+		for (i = 0; i < csl_packet->num_cmd_buf; i++) {
+			rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+			if (rc) {
+				CAM_ERR(CAM_OIS, "Invalid cmd desc");
+				goto end;
+			}
+
+			total_cmd_buf_in_bytes = cmd_desc[i].length;
+			if (!total_cmd_buf_in_bytes)
+				continue;
+
+			rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+				&generic_ptr, &len_of_buff);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS, "Failed to get cpu buf : 0x%x",
+					cmd_desc[i].mem_handle);
+				goto end;
+			}
+			cmd_buf = (uint32_t *)generic_ptr;
+			if (!cmd_buf) {
+				CAM_ERR(CAM_OIS, "invalid cmd buf");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				goto end;
+			}
+
+			if ((len_of_buff < sizeof(struct common_header)) ||
+				(cmd_desc[i].offset > (len_of_buff -
+				sizeof(struct common_header)))) {
+				CAM_ERR(CAM_OIS,
+					"Invalid length for sensor cmd");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				goto end;
+			}
+			remain_len = len_of_buff - cmd_desc[i].offset;
+			cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+			cmm_hdr = (struct common_header *)cmd_buf;
+
+			CAM_DBG(CAM_OIS,
+					"cmm_hdr->cmd_type: %d", cmm_hdr->cmd_type);
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				rc = cam_ois_slaveInfo_pkt_parser(
+					o_ctrl, cmd_buf, remain_len);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+					"Failed in parsing slave info");
+					break;
+				}
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
+			case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
+				CAM_DBG(CAM_OIS,
+					"Received power settings buffer");
+				rc = cam_sensor_update_power_settings(
+					cmd_buf,
+					total_cmd_buf_in_bytes,
+					power_info, remain_len);
+				if (rc) {
+					CAM_ERR(CAM_OIS,
+					"Failed: parse power settings");
+					break;
+				}
+				break;
+			case CAMERA_SENSOR_OIS_CMD_TYPE_FW_INFO:
+				CAM_DBG(CAM_OIS,
+					"Received fwInfo buffer,total_cmd_buf_in_bytes: %d",
+					total_cmd_buf_in_bytes);
+				rc = cam_ois_fw_info_pkt_parser(
+					o_ctrl, cmd_buf, total_cmd_buf_in_bytes);
+				if (rc) {
+					CAM_ERR(CAM_OIS,
+					"Failed: parse fw info settings");
+					break;
+				}
+				break;
+			default:
+			if (o_ctrl->i2c_init_data.is_settings_valid == 0) {
+				CAM_DBG(CAM_OIS,
+				"Received init/config settings");
+				i2c_reg_settings =
+					&(o_ctrl->i2c_init_data);
+				i2c_reg_settings->is_settings_valid = 1;
+				i2c_reg_settings->request_id = 0;
+				rc = cam_sensor_i2c_command_parser(
+					&o_ctrl->io_master_info,
+					i2c_reg_settings,
+					&cmd_desc[i], 1, NULL);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+					"init parsing failed: %d", rc);
+					break;
+				}
+			} else if ((o_ctrl->is_ois_calib != 0) &&
+				(o_ctrl->i2c_calib_data.is_settings_valid ==
+				0)) {
+				CAM_DBG(CAM_OIS,
+					"Received calib settings");
+				i2c_reg_settings = &(o_ctrl->i2c_calib_data);
+				i2c_reg_settings->is_settings_valid = 1;
+				i2c_reg_settings->request_id = 0;
+				rc = cam_sensor_i2c_command_parser(
+					&o_ctrl->io_master_info,
+					i2c_reg_settings,
+					&cmd_desc[i], 1, NULL);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+						"Calib parsing failed: %d", rc);
+					break;
+				}
+			} else if (o_ctrl->i2c_fwinit_data.is_settings_valid == 0) {
+				CAM_DBG(CAM_OIS, "received fwinit settings");
+				i2c_reg_settings =
+					&(o_ctrl->i2c_fwinit_data);
+				i2c_reg_settings->is_settings_valid = 1;
+				i2c_reg_settings->request_id = 0;
+				rc = cam_sensor_i2c_command_parser(
+					&o_ctrl->io_master_info,
+					i2c_reg_settings,
+					&cmd_desc[i], 1, NULL);
+				if (rc < 0) {
+					CAM_DBG(CAM_OIS,
+					"fw init parsing failed: %d", rc);
+					break;
+				}
+			}
+			break;
+			}
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+
+			if (rc < 0)
+				goto end;
+		}
+
+		if (o_ctrl->cam_ois_state != CAM_OIS_CONFIG) {
+			rc = cam_ois_power_up(o_ctrl);
+			if (rc) {
+				CAM_ERR(CAM_OIS, " OIS Power up failed");
+				goto end;
+			}
+		}
+
+		CAM_DBG(CAM_OIS, "ois_fw_flag: %d", o_ctrl->ois_fw_flag);
+		if (o_ctrl->ois_fw_flag) {
+			CAM_DBG(CAM_OIS, "fw_count: %d", o_ctrl->fw_info.fw_count);
+			if (o_ctrl->fw_info.fw_count != 0) {
+				rc = cam_ois_fw_download_v2(o_ctrl);
+				if (rc) {
+					CAM_ERR(CAM_OIS, "Failed OIS FW Download v2");
+					goto pwr_dwn;
+				}
+			} else {
+				if (o_ctrl->i2c_fwinit_data.is_settings_valid == 1) {
+					rc = cam_ois_apply_settings(o_ctrl,
+						&o_ctrl->i2c_fwinit_data);
+					if ((rc == -EAGAIN) &&
+						(o_ctrl->io_master_info.master_type ==
+							CCI_MASTER)) {
+						CAM_WARN(CAM_OIS,
+							"Reapplying fwinit settings");
+						usleep_range(1000, 1010);
+						rc = cam_ois_apply_settings(o_ctrl,
+							&o_ctrl->i2c_fwinit_data);
+					}
+					if (rc) {
+						CAM_ERR(CAM_OIS,
+							"Cannot apply fwinit data %d",
+							rc);
+						goto pwr_dwn;
+					} else {
+						CAM_DBG(CAM_OIS, "OIS fwinit settings success");
+					}
+
+					rc = cam_ois_fw_download(o_ctrl);
+					if (rc) {
+						CAM_ERR(CAM_OIS, "Failed OIS FW Download");
+						goto pwr_dwn;
+					}
+				}
+			}
+		}
+
+		rc = cam_ois_apply_settings(o_ctrl, &o_ctrl->i2c_init_data);
+		if ((rc == -EAGAIN) &&
+			(o_ctrl->io_master_info.master_type == CCI_MASTER)) {
+			CAM_WARN(CAM_OIS,
+				"CCI HW is restting: Reapplying INIT settings");
+			usleep_range(1000, 1010);
+			rc = cam_ois_apply_settings(o_ctrl,
+				&o_ctrl->i2c_init_data);
+		}
+
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Cannot apply Init settings: rc = %d",
+				rc);
+			goto pwr_dwn;
+		} else {
+			CAM_DBG(CAM_OIS, "apply Init settings success");
+		}
+
+		if (o_ctrl->is_ois_calib) {
+			rc = cam_ois_apply_settings(o_ctrl,
+				&o_ctrl->i2c_calib_data);
+			if ((rc == -EAGAIN) &&
+				(o_ctrl->io_master_info.master_type == CCI_MASTER)) {
+				CAM_WARN(CAM_OIS,
+					"CCI HW is restting: Reapplying calib settings");
+				usleep_range(1000, 1010);
+				rc = cam_ois_apply_settings(o_ctrl,
+					&o_ctrl->i2c_calib_data);
+			}
+			if (rc) {
+				CAM_ERR(CAM_OIS, "Cannot apply calib data");
+				goto pwr_dwn;
+			} else {
+				CAM_DBG(CAM_OIS, "apply calib data settings success");
+			}
+		}
+
+		o_ctrl->cam_ois_state = CAM_OIS_CONFIG;
+
+		rc = delete_request(&o_ctrl->i2c_fwinit_data);
+		if (rc < 0) {
+			CAM_WARN(CAM_OIS,
+				"Fail deleting fwinit data: rc: %d", rc);
+			rc = 0;
+		}
+
+		for (i = 0; i < MAX_OIS_FW_COUNT; i++) {
+			if (o_ctrl->i2c_fw_init_data[i].is_settings_valid == 1) {
+				rc = delete_request(&o_ctrl->i2c_fw_init_data[i]);
+				if (rc < 0) {
+					CAM_WARN(CAM_OIS,
+						"Fail deleting i2c_fw_init_data: rc: %d", rc);
+					rc = 0;
+				}
+			}
+			if (o_ctrl->i2c_fw_finalize_data[i].is_settings_valid == 1) {
+				rc = delete_request(&o_ctrl->i2c_fw_finalize_data[i]);
+				if (rc < 0) {
+					CAM_WARN(CAM_OIS,
+						"Fail deleting i2c_fw_finalize_data: rc: %d", rc);
+					rc = 0;
+				}
+			}
+		}
+
+		rc = delete_request(&o_ctrl->i2c_init_data);
+		if (rc < 0) {
+			CAM_WARN(CAM_OIS,
+				"Fail deleting Init data: rc: %d", rc);
+			rc = 0;
+		}
+		rc = delete_request(&o_ctrl->i2c_calib_data);
+		if (rc < 0) {
+			CAM_WARN(CAM_OIS,
+				"Fail deleting Calibration data: rc: %d", rc);
+			rc = 0;
+		}
+		break;
+	case CAM_OIS_PACKET_OPCODE_OIS_CONTROL:
+		CAM_DBG(CAM_OIS, "CAM_OIS_PACKET_OPCODE_OIS_CONTROL");
+		if (o_ctrl->cam_ois_state < CAM_OIS_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+				"Not in right state to control OIS: %d",
+				o_ctrl->cam_ois_state);
+			goto end;
+		}
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		i2c_reg_settings = &(o_ctrl->i2c_mode_data);
+		i2c_reg_settings->is_settings_valid = 1;
+		i2c_reg_settings->request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&o_ctrl->io_master_info,
+			i2c_reg_settings,
+			cmd_desc, 1, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc);
+			goto end;
+		}
+
+		rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "Cannot apply mode settings");
+			goto end;
+		}
+
+		rc = delete_request(i2c_reg_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Fail deleting Mode data: rc: %d", rc);
+			goto end;
+		}
+		break;
+	case CAM_OIS_PACKET_OPCODE_READ: {
+		uint64_t qtime_ns;
+		struct cam_buf_io_cfg *io_cfg;
+		struct i2c_settings_array i2c_read_settings;
+
+		CAM_DBG(CAM_OIS, "CAM_OIS_PACKET_OPCODE_READ");
+
+		if (o_ctrl->cam_ois_state < CAM_OIS_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+				"Not in right state to read OIS: %d",
+				o_ctrl->cam_ois_state);
+			goto end;
+		}
+		CAM_DBG(CAM_OIS, "number of I/O configs: %d:",
+			csl_packet->num_io_configs);
+		if (csl_packet->num_io_configs == 0) {
+			CAM_ERR(CAM_OIS, "No I/O configs to process");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		INIT_LIST_HEAD(&(i2c_read_settings.list_head));
+
+		io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+			&csl_packet->payload_flex +
+			csl_packet->io_configs_offset);
+
+		/* validate read data io config */
+		if (io_cfg == NULL) {
+			CAM_ERR(CAM_OIS, "I/O config is invalid(NULL)");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		i2c_read_settings.is_settings_valid = 1;
+		i2c_read_settings.request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&o_ctrl->io_master_info,
+			&i2c_read_settings,
+			cmd_desc, 1, &io_cfg[0]);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "OIS read pkt parsing failed: %d", rc);
+			goto end;
+		}
+
+		rc = cam_sensor_util_get_current_qtimer_ns(&qtime_ns);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "failed to get qtimer rc:%d");
+			goto end;
+		}
+
+		rc = cam_sensor_i2c_read_data(
+			&i2c_read_settings,
+			&o_ctrl->io_master_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "cannot read data rc: %d", rc);
+			delete_request(&i2c_read_settings);
+			goto end;
+		}
+
+		if (csl_packet->num_io_configs > 1) {
+			rc = cam_sensor_util_write_qtimer_to_io_buffer(
+				qtime_ns, &io_cfg[1]);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+					"write qtimer failed rc: %d", rc);
+				delete_request(&i2c_read_settings);
+				goto end;
+			}
+		}
+
+		rc = delete_request(&i2c_read_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Failed in deleting the read settings");
+			goto end;
+		}
+		break;
+	}
+	case CAM_OIS_PACKET_OPCODE_WRITE_TIME: {
+		CAM_DBG(CAM_OIS,
+				"CAM_OIS_PACKET_OPCODE_WRITE_TIME");
+		if (o_ctrl->cam_ois_state < CAM_OIS_CONFIG) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_OIS,
+				"Not in right state to write time to OIS: %d",
+				o_ctrl->cam_ois_state);
+			goto end;
+		}
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		i2c_reg_settings = &(o_ctrl->i2c_time_data);
+		i2c_reg_settings->is_settings_valid = 1;
+		i2c_reg_settings->request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&o_ctrl->io_master_info,
+			i2c_reg_settings,
+			cmd_desc, 1, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc);
+			goto end;
+		}
+
+		if (o_ctrl->fw_info.fw_count > 0) {
+			uint8_t ois_endianness =
+				(o_ctrl->fw_info.endianness & OIS_ENDIANNESS_MASK_INPUTPARAM) >> 4;
+			rc = cam_ois_update_time(i2c_reg_settings, ois_endianness);
+		} else
+			rc = cam_ois_update_time(i2c_reg_settings, CAM_ENDIANNESS_LITTLE);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "Cannot update time");
+			goto end;
+		}
+
+		rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "Cannot apply mode settings");
+			goto end;
+		}
+
+		rc = delete_request(i2c_reg_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Fail deleting Mode data: rc: %d", rc);
+			goto end;
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_OIS, "Invalid Opcode: %d",
+			(csl_packet->header.op_code & 0xFFFFFF));
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!rc)
+		goto end;
+
+pwr_dwn:
+	cam_ois_power_down(o_ctrl);
+end:
+	cam_common_mem_free(csl_packet);
+put_ref:
+	cam_mem_put_cpu_buf(dev_config.packet_handle);
+	return rc;
+}
+
+void cam_ois_shutdown(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int rc = 0, i = 0;
+	struct cam_ois_soc_private *soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+
+	if (o_ctrl->cam_ois_state == CAM_OIS_INIT)
+		return;
+
+	if (o_ctrl->cam_ois_state >= CAM_OIS_CONFIG) {
+		rc = cam_ois_power_down(o_ctrl);
+		if (rc < 0)
+			CAM_ERR(CAM_OIS, "OIS Power down failed");
+	}
+
+	if (o_ctrl->cam_ois_state >= CAM_OIS_ACQUIRE) {
+		rc = cam_destroy_device_hdl(o_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_OIS, "destroying the device hdl");
+		o_ctrl->bridge_intf.device_hdl = -1;
+		o_ctrl->bridge_intf.link_hdl = -1;
+		o_ctrl->bridge_intf.session_hdl = -1;
+	}
+
+	if (o_ctrl->i2c_fwinit_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_fwinit_data);
+
+	for (i = 0; i < MAX_OIS_FW_COUNT; i++) {
+		if (o_ctrl->i2c_fw_init_data[i].is_settings_valid == 1) {
+			rc = delete_request(&o_ctrl->i2c_fw_init_data[i]);
+			if (rc < 0) {
+				CAM_WARN(CAM_OIS,
+					"Fail deleting i2c_fw_init_data: rc: %d", rc);
+				rc = 0;
+			}
+		}
+		if (o_ctrl->i2c_fw_finalize_data[i].is_settings_valid == 1) {
+			rc = delete_request(&o_ctrl->i2c_fw_finalize_data[i]);
+			if (rc < 0) {
+				CAM_WARN(CAM_OIS,
+					"Fail deleting i2c_fw_finalize_data: rc: %d", rc);
+				rc = 0;
+			}
+		}
+	}
+
+	if (o_ctrl->i2c_fw_version_data.is_settings_valid == 1) {
+		rc = delete_request(&o_ctrl->i2c_fw_version_data);
+		if (rc < 0) {
+			CAM_WARN(CAM_OIS,
+				"Fail deleting i2c_fw_version_data: rc: %d", rc);
+			rc = 0;
+		}
+	}
+
+	if (o_ctrl->i2c_mode_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_mode_data);
+
+	if (o_ctrl->i2c_calib_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_calib_data);
+
+	if (o_ctrl->i2c_init_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_init_data);
+
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_down_setting_size = 0;
+	power_info->power_setting_size = 0;
+
+	o_ctrl->cam_ois_state = CAM_OIS_INIT;
+}
+
+/**
+ * cam_ois_driver_cmd - Handle ois cmds
+ * @e_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+int cam_ois_driver_cmd(struct cam_ois_ctrl_t *o_ctrl, void *arg)
+{
+	int                              rc = 0, i = 0;
+	struct cam_ois_query_cap_t       ois_cap = {0};
+	struct cam_control              *cmd = (struct cam_control *)arg;
+	struct cam_ois_soc_private      *soc_private = NULL;
+	struct cam_sensor_power_ctrl_t  *power_info = NULL;
+
+	if (!o_ctrl || !cmd) {
+		CAM_ERR(CAM_OIS, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_OIS, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	mutex_lock(&(o_ctrl->ois_mutex));
+	switch (cmd->op_code) {
+	case CAM_QUERY_CAP:
+		ois_cap.slot_info = o_ctrl->soc_info.index;
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&ois_cap,
+			sizeof(struct cam_ois_query_cap_t))) {
+			CAM_ERR(CAM_OIS, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		CAM_DBG(CAM_OIS, "ois_cap: ID: %d", ois_cap.slot_info);
+		break;
+	case CAM_ACQUIRE_DEV:
+		rc = cam_ois_get_dev_handle(o_ctrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_OIS, "Failed to acquire dev");
+			goto release_mutex;
+		}
+
+		o_ctrl->cam_ois_state = CAM_OIS_ACQUIRE;
+		break;
+	case CAM_START_DEV:
+		if (o_ctrl->cam_ois_state != CAM_OIS_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+			"Not in right state for start : %d",
+			o_ctrl->cam_ois_state);
+			goto release_mutex;
+		}
+		o_ctrl->cam_ois_state = CAM_OIS_START;
+		break;
+	case CAM_CONFIG_DEV:
+		rc = cam_ois_pkt_parse(o_ctrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_OIS, "Failed in ois pkt Parsing");
+			goto release_mutex;
+		}
+		break;
+	case CAM_RELEASE_DEV:
+		if (o_ctrl->cam_ois_state == CAM_OIS_START) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+				"Cant release ois: in start state");
+			goto release_mutex;
+		}
+
+		if (o_ctrl->cam_ois_state == CAM_OIS_CONFIG) {
+			rc = cam_ois_power_down(o_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS, "OIS Power down failed");
+				goto release_mutex;
+			}
+		}
+
+		if (o_ctrl->bridge_intf.device_hdl == -1) {
+			CAM_ERR(CAM_OIS, "link hdl: %d device hdl: %d",
+				o_ctrl->bridge_intf.device_hdl,
+				o_ctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = cam_destroy_device_hdl(o_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_OIS, "destroying the device hdl");
+		o_ctrl->bridge_intf.device_hdl = -1;
+		o_ctrl->bridge_intf.link_hdl = -1;
+		o_ctrl->bridge_intf.session_hdl = -1;
+		o_ctrl->cam_ois_state = CAM_OIS_INIT;
+
+		kfree(power_info->power_setting);
+		kfree(power_info->power_down_setting);
+		power_info->power_setting = NULL;
+		power_info->power_down_setting = NULL;
+		power_info->power_down_setting_size = 0;
+		power_info->power_setting_size = 0;
+
+		if (o_ctrl->i2c_mode_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_mode_data);
+
+		if (o_ctrl->i2c_calib_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_calib_data);
+
+		if (o_ctrl->i2c_init_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_init_data);
+
+		if (o_ctrl->i2c_fwinit_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_fwinit_data);
+
+		for (i = 0; i < MAX_OIS_FW_COUNT; i++) {
+			if (o_ctrl->i2c_fw_init_data[i].is_settings_valid == 1) {
+				rc = delete_request(&o_ctrl->i2c_fw_init_data[i]);
+				if (rc < 0) {
+					CAM_WARN(CAM_OIS,
+						"Fail deleting i2c_fw_init_data: rc: %d", rc);
+					rc = 0;
+				}
+			}
+			if (o_ctrl->i2c_fw_finalize_data[i].is_settings_valid == 1) {
+				rc = delete_request(&o_ctrl->i2c_fw_finalize_data[i]);
+				if (rc < 0) {
+					CAM_WARN(CAM_OIS,
+						"Fail deleting i2c_fw_finalize_data: rc: %d", rc);
+					rc = 0;
+				}
+			}
+		}
+
+		break;
+	case CAM_STOP_DEV:
+		if (o_ctrl->cam_ois_state != CAM_OIS_START) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+				"Not in right state for stop : %d",
+				o_ctrl->cam_ois_state);
+			goto release_mutex;
+		}
+		o_ctrl->cam_ois_state = CAM_OIS_CONFIG;
+		break;
+	case CAM_FLUSH_REQ:
+		CAM_DBG(CAM_OIS, "Flush recveived");
+		break;
+	default:
+		CAM_ERR(CAM_OIS, "invalid opcode: %d", cmd->op_code);
+		goto release_mutex;
+	}
+release_mutex:
+	mutex_unlock(&(o_ctrl->ois_mutex));
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_core.h
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAM_OIS_CORE_H_
+#define _CAM_OIS_CORE_H_
+
+#include <linux/cma.h>
+#include "cam_ois_dev.h"
+
+#define OIS_NAME_LEN 32
+#define OIS_ENDIANNESS_MASK_FW              0x0F
+#define OIS_ENDIANNESS_MASK_INPUTPARAM      0xF0
+
+
+/**
+ * @power_info: power setting info to control the power
+ *
+ * This API construct the default ois power setting.
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int32_t cam_ois_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info);
+
+
+int cam_ois_driver_cmd(struct cam_ois_ctrl_t *e_ctrl, void *arg);
+
+/**
+ * @o_ctrl: OIS ctrl structure
+ *
+ * This API handles the shutdown ioctl/close
+ */
+void cam_ois_shutdown(struct cam_ois_ctrl_t *o_ctrl);
+
+struct completion *cam_ois_get_i3c_completion(uint32_t index);
+
+#endif
+/* _CAM_OIS_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_dev.c
@@ -0,0 +1,650 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_ois_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_ois_soc.h"
+#include "cam_ois_core.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+static struct cam_i3c_ois_data {
+	struct cam_ois_ctrl_t                       *o_ctrl;
+	struct completion                            probe_complete;
+} g_i3c_ois_data[MAX_CAMERAS];
+
+struct completion *cam_ois_get_i3c_completion(uint32_t index)
+{
+	return &g_i3c_ois_data[index].probe_complete;
+}
+
+static int cam_ois_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_ois_ctrl_t *o_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "o_ctrl ptr is NULL");
+			return -EINVAL;
+	}
+
+	mutex_lock(&(o_ctrl->ois_mutex));
+	cam_ois_shutdown(o_ctrl);
+	mutex_unlock(&(o_ctrl->ois_mutex));
+
+	return 0;
+}
+
+static int cam_ois_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_OIS, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_ois_subdev_close_internal(sd, fh);
+}
+
+static long cam_ois_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int                       rc     = 0;
+	struct cam_ois_ctrl_t *o_ctrl = v4l2_get_subdevdata(sd);
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_ois_driver_cmd(o_ctrl, arg);
+		if (rc)
+			CAM_ERR(CAM_OIS,
+				"Failed with driver cmd: %d", rc);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+		rc = cam_ois_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_OIS, "Wrong IOCTL cmd: %u", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	return rc;
+}
+
+static int32_t cam_ois_update_i2c_info(struct cam_ois_ctrl_t *o_ctrl,
+	struct cam_ois_i2c_info_t *i2c_info)
+{
+	struct cam_sensor_cci_client        *cci_client = NULL;
+
+	if (o_ctrl->io_master_info.master_type == CCI_MASTER) {
+		cci_client = o_ctrl->io_master_info.cci_client;
+		if (!cci_client) {
+			CAM_ERR(CAM_OIS, "failed: cci_client %pK",
+				cci_client);
+			return -EINVAL;
+		}
+		cci_client->cci_i2c_master = o_ctrl->cci_i2c_master;
+		cci_client->sid = (i2c_info->slave_addr) >> 1;
+		cci_client->retries = 3;
+		cci_client->id_map = 0;
+		cci_client->i2c_freq_mode = i2c_info->i2c_freq_mode;
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_ois_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_OIS,
+			"Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_ois_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc) {
+			CAM_ERR(CAM_OIS,
+				"Failed in ois suddev handling rc %d",
+				rc);
+			return rc;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_OIS, "Invalid compat ioctl: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_OIS,
+				"Failed to copy from user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+	return rc;
+}
+#endif
+
+static const struct v4l2_subdev_internal_ops cam_ois_internal_ops = {
+	.close = cam_ois_subdev_close,
+};
+
+static struct v4l2_subdev_core_ops cam_ois_subdev_core_ops = {
+	.ioctl = cam_ois_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_ois_init_subdev_do_ioctl,
+#endif
+};
+
+static struct v4l2_subdev_ops cam_ois_subdev_ops = {
+	.core = &cam_ois_subdev_core_ops,
+};
+
+static int cam_ois_init_subdev_param(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int rc = 0;
+
+	o_ctrl->v4l2_dev_str.internal_ops = &cam_ois_internal_ops;
+	o_ctrl->v4l2_dev_str.ops = &cam_ois_subdev_ops;
+	strscpy(o_ctrl->device_name, CAM_OIS_NAME,
+		sizeof(o_ctrl->device_name));
+	o_ctrl->v4l2_dev_str.name = o_ctrl->device_name;
+	o_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	o_ctrl->v4l2_dev_str.ent_function = CAM_OIS_DEVICE_TYPE;
+	o_ctrl->v4l2_dev_str.token = o_ctrl;
+	 o_ctrl->v4l2_dev_str.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(o_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_OIS, "fail to create subdev");
+
+	return rc;
+}
+
+static int cam_ois_i2c_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                          rc = 0;
+	struct i2c_client           *client = NULL;
+	struct cam_ois_ctrl_t       *o_ctrl = NULL;
+	struct cam_ois_soc_private  *soc_private = NULL;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (client == NULL) {
+		CAM_ERR(CAM_OIS, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	o_ctrl = kzalloc(sizeof(*o_ctrl), GFP_KERNEL);
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "kzalloc failed");
+		rc = -ENOMEM;
+		goto probe_failure;
+	}
+
+	i2c_set_clientdata(client, o_ctrl);
+
+	o_ctrl->soc_info.dev = &client->dev;
+	o_ctrl->soc_info.dev_name = client->name;
+	o_ctrl->ois_device_type = MSM_CAMERA_I2C_DEVICE;
+	o_ctrl->io_master_info.master_type = I2C_MASTER;
+	o_ctrl->io_master_info.client = client;
+
+	soc_private = kzalloc(sizeof(struct cam_ois_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto octrl_free;
+	}
+
+	o_ctrl->soc_info.soc_private = soc_private;
+	rc = cam_ois_driver_soc_init(o_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "failed: cam_sensor_parse_dt rc %d", rc);
+		goto soc_free;
+	}
+
+	rc = cam_ois_init_subdev_param(o_ctrl);
+	if (rc)
+		goto soc_free;
+
+	cam_sensor_module_add_i2c_device((void *) o_ctrl, CAM_SENSOR_OIS);
+
+	mutex_init(&(o_ctrl->ois_mutex));
+	o_ctrl->cam_ois_state = CAM_OIS_INIT;
+
+	return rc;
+
+soc_free:
+	kfree(soc_private);
+octrl_free:
+	kfree(o_ctrl);
+probe_failure:
+	return rc;
+}
+
+static void cam_ois_i2c_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                             i;
+	struct i2c_client              *client = NULL;
+	struct cam_ois_ctrl_t          *o_ctrl = NULL;
+	struct cam_hw_soc_info         *soc_info;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (!client) {
+		CAM_ERR(CAM_OIS,
+			"Failed to get i2c client");
+		return;
+	}
+
+	o_ctrl = i2c_get_clientdata(client);
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "ois device is NULL");
+		return;
+	}
+
+	CAM_INFO(CAM_OIS, "i2c driver remove invoked");
+	soc_info = &o_ctrl->soc_info;
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_OIS, "%s handle is NULL skip put",
+				soc_info->clk_name[i]);
+			continue;
+		}
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+	}
+
+	mutex_lock(&(o_ctrl->ois_mutex));
+	cam_ois_shutdown(o_ctrl);
+	mutex_unlock(&(o_ctrl->ois_mutex));
+	cam_unregister_subdev(&(o_ctrl->v4l2_dev_str));
+
+	kfree(o_ctrl->soc_info.soc_private);
+	v4l2_set_subdevdata(&o_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(o_ctrl);
+}
+
+const static struct component_ops cam_ois_i2c_component_ops = {
+	.bind = cam_ois_i2c_component_bind,
+	.unbind = cam_ois_i2c_component_unbind,
+};
+
+static int cam_ois_i2c_driver_probe(struct i2c_client *client)
+{
+	int rc = 0;
+
+	if (client == NULL) {
+		CAM_ERR(CAM_OIS, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_OIS, "%s :: i2c_check_functionality failed",
+			client->name);
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_OIS, "Adding sensor ois component");
+	rc = component_add(&client->dev, &cam_ois_i2c_component_ops);
+	if (rc)
+		CAM_ERR(CAM_OIS, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_ois_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t                         rc = 0, i = 0;
+	struct cam_ois_ctrl_t          *o_ctrl = NULL;
+	struct cam_ois_soc_private     *soc_private = NULL;
+	bool                            i3c_i2c_target;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return 0;
+
+	o_ctrl = kzalloc(sizeof(struct cam_ois_ctrl_t), GFP_KERNEL);
+	if (!o_ctrl)
+		return -ENOMEM;
+
+	o_ctrl->soc_info.pdev = pdev;
+	o_ctrl->pdev = pdev;
+	o_ctrl->soc_info.dev = &pdev->dev;
+	o_ctrl->soc_info.dev_name = pdev->name;
+
+	o_ctrl->ois_device_type = MSM_CAMERA_PLATFORM_DEVICE;
+
+	o_ctrl->io_master_info.master_type = CCI_MASTER;
+	o_ctrl->io_master_info.cci_client = kzalloc(
+		sizeof(struct cam_sensor_cci_client), GFP_KERNEL);
+	if (!o_ctrl->io_master_info.cci_client)
+		goto free_o_ctrl;
+
+	soc_private = kzalloc(sizeof(struct cam_ois_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto free_cci_client;
+	}
+	o_ctrl->soc_info.soc_private = soc_private;
+	soc_private->power_info.dev  = &pdev->dev;
+
+	memset(&o_ctrl->fw_info, 0, sizeof(struct cam_cmd_ois_fw_info));
+
+	INIT_LIST_HEAD(&(o_ctrl->i2c_init_data.list_head));
+	INIT_LIST_HEAD(&(o_ctrl->i2c_calib_data.list_head));
+	INIT_LIST_HEAD(&(o_ctrl->i2c_fwinit_data.list_head));
+	for (i = 0; i < MAX_OIS_FW_COUNT; i++) {
+		INIT_LIST_HEAD(&(o_ctrl->i2c_fw_init_data[i].list_head));
+		INIT_LIST_HEAD(&(o_ctrl->i2c_fw_finalize_data[i].list_head));
+	}
+	INIT_LIST_HEAD(&(o_ctrl->i2c_fw_version_data.list_head));
+	INIT_LIST_HEAD(&(o_ctrl->i2c_mode_data.list_head));
+	INIT_LIST_HEAD(&(o_ctrl->i2c_time_data.list_head));
+	mutex_init(&(o_ctrl->ois_mutex));
+	rc = cam_ois_driver_soc_init(o_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "failed: soc init rc %d", rc);
+		goto free_soc;
+	}
+
+	rc = cam_ois_init_subdev_param(o_ctrl);
+	if (rc)
+		goto free_soc;
+
+	rc = cam_ois_update_i2c_info(o_ctrl, &soc_private->i2c_info);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "failed: to update i2c info rc %d", rc);
+		goto unreg_subdev;
+	}
+	o_ctrl->bridge_intf.device_hdl = -1;
+
+	cam_sensor_module_add_i2c_device((void *) o_ctrl, CAM_SENSOR_OIS);
+
+	platform_set_drvdata(pdev, o_ctrl);
+	o_ctrl->cam_ois_state = CAM_OIS_INIT;
+
+	g_i3c_ois_data[o_ctrl->soc_info.index].o_ctrl = o_ctrl;
+	init_completion(&g_i3c_ois_data[o_ctrl->soc_info.index].probe_complete);
+
+	CAM_DBG(CAM_OIS, "Component bound successfully");
+	return rc;
+unreg_subdev:
+	cam_unregister_subdev(&(o_ctrl->v4l2_dev_str));
+free_soc:
+	kfree(soc_private);
+free_cci_client:
+	kfree(o_ctrl->io_master_info.cci_client);
+free_o_ctrl:
+	kfree(o_ctrl);
+	return rc;
+}
+
+static void cam_ois_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                             i;
+	struct cam_ois_ctrl_t          *o_ctrl;
+	struct cam_hw_soc_info         *soc_info;
+	bool                            i3c_i2c_target;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return;
+
+	o_ctrl = platform_get_drvdata(pdev);
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "ois device is NULL");
+		return;
+	}
+
+	CAM_INFO(CAM_OIS, "platform driver remove invoked");
+	soc_info = &o_ctrl->soc_info;
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_OIS, "%s handle is NULL skip put",
+				soc_info->clk_name[i]);
+			continue;
+		}
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+	}
+
+	mutex_lock(&(o_ctrl->ois_mutex));
+	cam_ois_shutdown(o_ctrl);
+	mutex_unlock(&(o_ctrl->ois_mutex));
+	cam_unregister_subdev(&(o_ctrl->v4l2_dev_str));
+
+	kfree(o_ctrl->soc_info.soc_private);
+	kfree(o_ctrl->io_master_info.cci_client);
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&o_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(o_ctrl);
+}
+
+const static struct component_ops cam_ois_component_ops = {
+	.bind = cam_ois_component_bind,
+	.unbind = cam_ois_component_unbind,
+};
+
+static int32_t cam_ois_platform_driver_probe(
+	struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_OIS, "Adding OIS Sensor component");
+	rc = component_add(&pdev->dev, &cam_ois_component_ops);
+	if (rc)
+		CAM_ERR(CAM_OIS, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_ois_i2c_driver_remove_common(struct i2c_client *client)
+{
+	component_del(&client->dev, &cam_ois_i2c_component_ops);
+
+	return 0;
+}
+
+static int cam_ois_platform_driver_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ois_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_ois_dt_match[] = {
+	{ .compatible = "qcom,ois" },
+	{ }
+};
+
+static const struct of_device_id cam_ois_i2c_dt_match[] = {
+	{ .compatible = "qcom,cam-i2c-ois" },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(of, cam_ois_dt_match);
+MODULE_DEVICE_TABLE(of, cam_ois_i2c_dt_match);
+
+struct platform_driver cam_ois_platform_driver = {
+	.driver = {
+		.name = "qcom,ois",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ois_dt_match,
+	},
+	.probe = cam_ois_platform_driver_probe,
+	.remove = cam_ois_platform_driver_remove,
+};
+static const struct i2c_device_id cam_ois_i2c_id[] = {
+	{ OIS_DRIVER_I2C, (kernel_ulong_t)NULL},
+	{ }
+};
+
+struct i2c_driver cam_ois_i2c_driver = {
+	.id_table = cam_ois_i2c_id,
+	.probe  = cam_ois_i2c_driver_probe,
+	.remove = cam_ois_i2c_driver_remove,
+	.driver = {
+		.name = OIS_DRIVER_I2C,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ois_i2c_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+static struct i3c_device_id ois_i3c_id[MAX_I3C_DEVICE_ID_ENTRIES + 1];
+
+static int cam_ois_i3c_driver_probe(struct i3c_device *client)
+{
+	int32_t rc = 0;
+	struct cam_ois_ctrl_t            *o_ctrl = NULL;
+	uint32_t                          index;
+	struct device                    *dev;
+
+	if (!client) {
+		CAM_INFO(CAM_OIS, "Null Client pointer");
+		return -EINVAL;
+	}
+
+	dev = &client->dev;
+
+	CAM_DBG(CAM_OIS, "Probe for I3C Slave %s", dev_name(dev));
+
+	rc = of_property_read_u32(dev->of_node, "cell-index", &index);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "device %s failed to read cell-index", dev_name(dev));
+		return rc;
+	}
+
+	if (index >= MAX_CAMERAS) {
+		CAM_ERR(CAM_OIS, "Invalid Cell-Index: %u for %s", index, dev_name(dev));
+		return -EINVAL;
+	}
+
+	o_ctrl = g_i3c_ois_data[index].o_ctrl;
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "o_ctrl is null. I3C Probe before platfom driver probe for %s",
+			dev_name(dev));
+		return -EINVAL;
+	}
+
+	o_ctrl->io_master_info.i3c_client = client;
+
+	complete_all(&g_i3c_ois_data[index].probe_complete);
+
+	CAM_DBG(CAM_OIS, "I3C Probe Finished for %s", dev_name(dev));
+	return rc;
+}
+
+static struct i3c_driver cam_ois_i3c_driver = {
+	.id_table = ois_i3c_id,
+	.probe = cam_ois_i3c_driver_probe,
+	.remove = cam_i3c_driver_remove,
+	.driver = {
+		.owner = THIS_MODULE,
+		.name = OIS_DRIVER_I3C,
+		.of_match_table = cam_ois_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ois_driver_init(void)
+{
+	int rc = 0;
+	struct device_node                      *dev;
+	int num_entries = 0;
+
+	rc = platform_driver_register(&cam_ois_platform_driver);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "platform_driver_register failed rc = %d", rc);
+		return rc;
+	}
+
+	rc = i2c_add_driver(&cam_ois_i2c_driver);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "i2c_add_driver failed rc = %d", rc);
+		goto i2c_register_err;
+	}
+
+	memset(ois_i3c_id, 0, sizeof(struct i3c_device_id) * (MAX_I3C_DEVICE_ID_ENTRIES + 1));
+
+	dev = of_find_node_by_name(NULL, I3C_SENSOR_DEV_ID_DT_NODE);
+	if (!dev) {
+		CAM_DBG(CAM_OIS, "Couldnt Find the i3c-id-table dev node");
+		return 0;
+	}
+
+	rc = cam_sensor_count_elems_i3c_device_id(dev, &num_entries,
+		"i3c-ois-id-table");
+	if (rc)
+		return 0;
+
+	rc = cam_sensor_fill_i3c_device_id(dev, num_entries,
+		"i3c-ois-id-table", ois_i3c_id);
+	if (rc)
+		goto i3c_register_err;
+
+	rc = i3c_driver_register_with_owner(&cam_ois_i3c_driver, THIS_MODULE);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "i3c_driver registration failed, rc: %d", rc);
+		goto i3c_register_err;
+	}
+
+	return 0;
+
+i3c_register_err:
+	i2c_del_driver(&cam_ois_i2c_driver);
+i2c_register_err:
+	platform_driver_unregister(&cam_ois_platform_driver);
+
+	return rc;
+}
+
+void cam_ois_driver_exit(void)
+{
+	struct device_node *dev;
+
+	platform_driver_unregister(&cam_ois_platform_driver);
+	i2c_del_driver(&cam_ois_i2c_driver);
+
+	dev = of_find_node_by_name(NULL, I3C_SENSOR_DEV_ID_DT_NODE);
+	if (!dev) {
+		CAM_DBG(CAM_EEPROM, "Couldnt Find the i3c-id-table dev node");
+		return;
+	}
+
+	i3c_driver_unregister(&cam_ois_i3c_driver);
+}
+
+MODULE_DESCRIPTION("CAM OIS driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_dev.h
@@ -0,0 +1,146 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAM_OIS_DEV_H_
+#define _CAM_OIS_DEV_H_
+
+#include <linux/i2c.h>
+#include <linux/gpio.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-ioctl.h>
+#include <media/cam_sensor.h>
+#include <cam_sensor_i2c.h>
+#include <cam_sensor_spi.h>
+#include <cam_sensor_io.h>
+#include <cam_cci_dev.h>
+#include <cam_req_mgr_util.h>
+#include <cam_req_mgr_interface.h>
+#include <cam_mem_mgr.h>
+#include <cam_subdev.h>
+#include "cam_soc_util.h"
+#include "cam_context.h"
+
+#define DEFINE_MSM_MUTEX(mutexname) \
+	static struct mutex mutexname = __MUTEX_INITIALIZER(mutexname)
+
+#define OIS_DRIVER_I2C "cam-i2c-ois"
+#define OIS_DRIVER_I3C "i3c_camera_ois"
+
+enum cam_ois_state {
+	CAM_OIS_INIT,
+	CAM_OIS_ACQUIRE,
+	CAM_OIS_CONFIG,
+	CAM_OIS_START,
+};
+
+/**
+ * struct cam_ois_i2c_info_t - I2C info
+ * @slave_addr      :   slave address
+ * @i2c_freq_mode   :   i2c frequency mode
+ *
+ */
+struct cam_ois_i2c_info_t {
+	uint16_t slave_addr;
+	uint8_t i2c_freq_mode;
+};
+
+/**
+ * struct cam_ois_soc_private - ois soc private data structure
+ * @ois_name        :   ois name
+ * @i2c_info        :   i2c info structure
+ * @power_info      :   ois power info
+ *
+ */
+struct cam_ois_soc_private {
+	const char *ois_name;
+	struct cam_ois_i2c_info_t i2c_info;
+	struct cam_sensor_power_ctrl_t power_info;
+};
+
+/**
+ * struct cam_ois_intf_params - bridge interface params
+ * @device_hdl   : Device Handle
+ * @session_hdl  : Session Handle
+ * @ops          : KMD operations
+ * @crm_cb       : Callback API pointers
+ */
+struct cam_ois_intf_params {
+	int32_t device_hdl;
+	int32_t session_hdl;
+	int32_t link_hdl;
+	struct cam_req_mgr_kmd_ops ops;
+	struct cam_req_mgr_crm_cb *crm_cb;
+};
+
+/**
+ * struct cam_ois_ctrl_t - OIS ctrl private data
+ * @device_name     :   ois device_name
+ * @pdev            :   platform device
+ * @ois_mutex       :   ois mutex
+ * @soc_info        :   ois soc related info
+ * @io_master_info  :   Information about the communication master
+ * @cci_i2c_master  :   I2C structure
+ * @v4l2_dev_str    :   V4L2 device structure
+ * @is_i3c_device   :   A Flag to indicate whether this OIS is I3C Device or not.
+ * @bridge_intf     :   bridge interface params
+ * @i2c_fwinit_data :   ois i2c firmware init settings
+ * @i2c_init_data   :   ois i2c init settings
+ * @i2c_mode_data   :   ois i2c mode settings
+ * @i2c_time_data   :   ois i2c time write settings
+ * @i2c_calib_data  :   ois i2c calib settings
+ * @ois_device_type :   ois device type
+ * @cam_ois_state   :   ois_device_state
+ * @ois_fw_flag     :   flag for firmware download
+ * @is_ois_calib    :   flag for Calibration data
+ * @opcode          :   ois opcode
+ * @device_name     :   Device name
+ *
+ */
+struct cam_ois_ctrl_t {
+	char device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct platform_device *pdev;
+	struct mutex ois_mutex;
+	struct cam_hw_soc_info soc_info;
+	struct camera_io_master io_master_info;
+	enum cci_i2c_master_t cci_i2c_master;
+	enum cci_device_num cci_num;
+	struct cam_subdev v4l2_dev_str;
+	bool is_i3c_device;
+	struct cam_ois_intf_params bridge_intf;
+	struct i2c_settings_array i2c_fwinit_data;
+	struct i2c_settings_array i2c_init_data;
+	struct i2c_settings_array i2c_calib_data;
+	struct i2c_settings_array i2c_mode_data;
+	struct i2c_settings_array i2c_time_data;
+	enum msm_camera_device_type_t ois_device_type;
+	enum cam_ois_state cam_ois_state;
+	char ois_name[32];
+	uint8_t ois_fw_flag;
+	uint8_t is_ois_calib;
+	struct cam_ois_opcode opcode;
+	struct cam_cmd_ois_fw_info fw_info;
+	struct i2c_settings_array i2c_fw_init_data[MAX_OIS_FW_COUNT];
+	struct i2c_settings_array i2c_fw_finalize_data[MAX_OIS_FW_COUNT];
+	struct i2c_settings_array i2c_fw_version_data;
+};
+
+/**
+ * @brief : API to remove OIS i2c HW from driver framework.
+ * @return return 0 on success.
+ */
+int cam_ois_i2c_driver_remove_common(struct i2c_client *client);
+
+/**
+ * @brief : API to register OIS hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_ois_driver_init(void);
+
+/**
+ * @brief : API to remove OIS Hw from platform framework.
+ */
+void cam_ois_driver_exit(void);
+#endif /*_CAM_OIS_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_soc.c
@@ -0,0 +1,149 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_sensor_util.h>
+#include <cam_sensor_io.h>
+#include <cam_req_mgr_util.h>
+
+#include "cam_ois_soc.h"
+#include "cam_debug_util.h"
+
+/**
+ * @e_ctrl: ctrl structure
+ *
+ * Parses ois dt
+ */
+static int cam_ois_get_dt_data(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int                             i, rc = 0;
+	struct cam_hw_soc_info         *soc_info = &o_ctrl->soc_info;
+	struct cam_ois_soc_private     *soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+	struct device_node             *of_node = NULL;
+
+	of_node = soc_info->dev->of_node;
+
+	if (!of_node) {
+		CAM_ERR(CAM_OIS, "of_node is NULL, device type %d",
+			o_ctrl->ois_device_type);
+		return -EINVAL;
+	}
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_OIS, "cam_soc_util_get_dt_properties rc %d",
+			rc);
+		return rc;
+	}
+
+	rc = of_property_read_bool(of_node, "i3c-target");
+	if (rc) {
+		o_ctrl->is_i3c_device = true;
+		o_ctrl->io_master_info.master_type = I3C_MASTER;
+	}
+
+	CAM_DBG(CAM_SENSOR, "I3C Target: %s", CAM_BOOL_TO_YESNO(o_ctrl->is_i3c_device));
+
+	/* Initialize regulators to default parameters */
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		soc_info->rgltr[i] = devm_regulator_get(soc_info->dev,
+					soc_info->rgltr_name[i]);
+		if (IS_ERR_OR_NULL(soc_info->rgltr[i])) {
+			rc = PTR_ERR(soc_info->rgltr[i]);
+			rc = rc ? rc : -EINVAL;
+			CAM_ERR(CAM_OIS, "get failed for regulator %s",
+				 soc_info->rgltr_name[i]);
+			return rc;
+		}
+		CAM_DBG(CAM_OIS, "get for regulator %s",
+			soc_info->rgltr_name[i]);
+	}
+
+	if (!soc_info->gpio_data) {
+		CAM_INFO(CAM_OIS, "No GPIO found");
+		return 0;
+	}
+
+	if (!soc_info->gpio_data->cam_gpio_common_tbl_size) {
+		CAM_INFO(CAM_OIS, "No GPIO found");
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
+		&power_info->gpio_num_info);
+	if ((rc < 0) || (!power_info->gpio_num_info)) {
+		CAM_ERR(CAM_OIS, "No/Error OIS GPIOs");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		soc_info->clk[i] = devm_clk_get(soc_info->dev,
+			soc_info->clk_name[i]);
+		if (IS_ERR(soc_info->clk[i])) {
+			CAM_ERR(CAM_OIS, "get failed for %s",
+				soc_info->clk_name[i]);
+			rc = -ENOENT;
+			return rc;
+		} else if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_OIS, "%s handle is NULL skip get",
+				soc_info->clk_name[i]);
+			continue;
+		}
+	}
+
+	return rc;
+}
+/**
+ * @o_ctrl: ctrl structure
+ *
+ * This function is called from cam_ois_platform/i2c_driver_probe, it parses
+ * the ois dt node.
+ */
+int cam_ois_driver_soc_init(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int                             rc = 0;
+	struct cam_hw_soc_info         *soc_info = &o_ctrl->soc_info;
+	struct device_node             *of_node = NULL;
+	struct device_node             *of_parent = NULL;
+
+	if (!soc_info->dev) {
+		CAM_ERR(CAM_OIS, "soc_info is not initialized");
+		return -EINVAL;
+	}
+
+	of_node = soc_info->dev->of_node;
+	if (!of_node) {
+		CAM_ERR(CAM_OIS, "dev.of_node NULL");
+		return -EINVAL;
+	}
+
+	if (o_ctrl->ois_device_type == MSM_CAMERA_PLATFORM_DEVICE) {
+		rc = of_property_read_u32(of_node, "cci-master",
+			&o_ctrl->cci_i2c_master);
+		if (rc < 0) {
+			CAM_DBG(CAM_OIS, "failed rc %d", rc);
+			return rc;
+		}
+
+		of_parent = of_get_parent(of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&o_ctrl->cci_num) < 0)
+			/* Set default master 0 */
+			o_ctrl->cci_num = CCI_DEVICE_0;
+
+		o_ctrl->io_master_info.cci_client->cci_device = o_ctrl->cci_num;
+		CAM_DBG(CAM_OIS, "cci-device %d", o_ctrl->cci_num, rc);
+	}
+
+	rc = cam_ois_get_dt_data(o_ctrl);
+	if (rc < 0)
+		CAM_DBG(CAM_OIS, "failed: ois get dt data rc %d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_ois/cam_ois_soc.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_OIS_SOC_H_
+#define _CAM_OIS_SOC_H_
+
+#include "cam_ois_dev.h"
+
+int cam_ois_driver_soc_init(struct cam_ois_ctrl_t *o_ctrl);
+
+#endif/* _CAM_OIS_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c
@@ -0,0 +1,1000 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/pinctrl/consumer.h>
+#include "cam_debug_util.h"
+#include "cam_res_mgr_api.h"
+#include "cam_res_mgr_private.h"
+#include "camera_main.h"
+
+static struct cam_res_mgr *cam_res;
+
+static void cam_res_mgr_free_res(void)
+{
+	struct cam_dev_res *dev_res, *dev_temp;
+	struct cam_gpio_res *gpio_res, *gpio_temp;
+	struct cam_flash_res *flash_res, *flash_temp;
+
+	if (!cam_res)
+		return;
+
+	mutex_lock(&cam_res->gpio_res_lock);
+	list_for_each_entry_safe(gpio_res, gpio_temp,
+		&cam_res->gpio_res_list, list) {
+		list_for_each_entry_safe(dev_res, dev_temp,
+			&gpio_res->dev_list, list) {
+			list_del_init(&dev_res->list);
+			kfree(dev_res);
+		}
+		list_del_init(&gpio_res->list);
+		kfree(gpio_res);
+	}
+	mutex_unlock(&cam_res->gpio_res_lock);
+
+	mutex_lock(&cam_res->flash_res_lock);
+	list_for_each_entry_safe(flash_res, flash_temp,
+		&cam_res->flash_res_list, list) {
+		list_del_init(&flash_res->list);
+		kfree(flash_res);
+	}
+	mutex_unlock(&cam_res->flash_res_lock);
+}
+
+void cam_res_mgr_led_trigger_register(const char *name, struct led_trigger **tp)
+{
+	bool found = false;
+	struct cam_flash_res *flash_res;
+
+	if (!cam_res) {
+		/*
+		 * If this driver not probed, then just register the
+		 * led trigger.
+		 */
+		led_trigger_register_simple(name, tp);
+		return;
+	}
+
+	mutex_lock(&cam_res->flash_res_lock);
+	list_for_each_entry(flash_res, &cam_res->flash_res_list, list) {
+		if (!strcmp(flash_res->name, name)) {
+			found = true;
+			break;
+		}
+	}
+	mutex_unlock(&cam_res->flash_res_lock);
+
+	if (found) {
+		*tp = flash_res->trigger;
+	} else {
+		flash_res = kzalloc(sizeof(struct cam_flash_res), GFP_KERNEL);
+		if (!flash_res) {
+			CAM_ERR(CAM_RES,
+				"Failed to malloc memory for flash_res:%s",
+				name);
+			*tp = NULL;
+			return;
+		}
+
+		led_trigger_register_simple(name, tp);
+		INIT_LIST_HEAD(&flash_res->list);
+		flash_res->trigger = *tp;
+		flash_res->name = name;
+
+		mutex_lock(&cam_res->flash_res_lock);
+		list_add_tail(&flash_res->list, &cam_res->flash_res_list);
+		mutex_unlock(&cam_res->flash_res_lock);
+	}
+}
+EXPORT_SYMBOL(cam_res_mgr_led_trigger_register);
+
+void cam_res_mgr_led_trigger_unregister(struct led_trigger *tp)
+{
+	bool found = false;
+	struct cam_flash_res *flash_res;
+
+	if (!cam_res) {
+		/*
+		 * If this driver not probed, then just unregister the
+		 * led trigger.
+		 */
+		led_trigger_unregister_simple(tp);
+		return;
+	}
+
+	mutex_lock(&cam_res->flash_res_lock);
+	list_for_each_entry(flash_res, &cam_res->flash_res_list, list) {
+		if (flash_res->trigger == tp) {
+			found = true;
+			break;
+		}
+	}
+
+	if (found) {
+		led_trigger_unregister_simple(tp);
+		list_del_init(&flash_res->list);
+		kfree(flash_res);
+	}
+	mutex_unlock(&cam_res->flash_res_lock);
+}
+EXPORT_SYMBOL(cam_res_mgr_led_trigger_unregister);
+
+void cam_res_mgr_led_trigger_event(struct led_trigger *trig,
+	enum led_brightness brightness)
+{
+	bool found = false;
+	struct cam_flash_res *flash_res;
+
+	if (!cam_res) {
+		/*
+		 * If this driver not probed, then just trigger
+		 * the led event.
+		 */
+		led_trigger_event(trig, brightness);
+		return;
+	}
+
+	mutex_lock(&cam_res->flash_res_lock);
+	list_for_each_entry(flash_res, &cam_res->flash_res_list, list) {
+		if (flash_res->trigger == trig) {
+			found = true;
+			break;
+		}
+	}
+	mutex_unlock(&cam_res->flash_res_lock);
+
+	if (found)
+		led_trigger_event(trig, brightness);
+}
+EXPORT_SYMBOL(cam_res_mgr_led_trigger_event);
+
+int cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(
+	uint gpio)
+{
+	int index = 0;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	for (index = 0; index < dt->num_shared_pctrl_gpio; index++) {
+		if (gpio == dt->shared_pctrl_gpio[index])
+			break;
+	}
+
+	if (index == dt->num_shared_pctrl_gpio)
+		return -EINVAL;
+
+	return index;
+}
+EXPORT_SYMBOL(cam_res_mgr_util_get_idx_from_shared_pctrl_gpio);
+
+int cam_res_mgr_util_get_idx_from_shared_gpio(
+	uint gpio)
+{
+	int index = 0;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	for (index = 0; index < dt->num_shared_gpio; index++) {
+		if (gpio == dt->shared_gpio[index])
+			break;
+	}
+
+	if (index == dt->num_shared_gpio)
+		return -EINVAL;
+
+	return index;
+}
+EXPORT_SYMBOL(cam_res_mgr_util_get_idx_from_shared_gpio);
+
+static bool cam_res_mgr_gpio_is_in_shared_pctrl_gpio(
+	uint gpio)
+{
+	int index = 0;
+	bool found = false;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	for (index = 0; index < dt->num_shared_pctrl_gpio; index++) {
+		if (gpio == dt->shared_pctrl_gpio[index]) {
+			found = true;
+			break;
+		}
+	}
+
+	return found;
+}
+
+static bool cam_res_mgr_gpio_is_in_shared_gpio(
+	uint gpio)
+{
+	int index = 0;
+	bool found = false;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	for (; index < dt->num_shared_gpio; index++) {
+		if (gpio == dt->shared_gpio[index]) {
+			found = true;
+			break;
+		}
+	}
+
+	return found;
+}
+
+int cam_res_mgr_util_shared_gpio_check_hold(uint gpio)
+{
+	int index = 0;
+	int dev_num = 0;
+	struct list_head *list;
+	struct cam_gpio_res *gpio_res = NULL;
+	struct cam_res_mgr_dt *dt =  NULL;
+	bool is_shared_gpio = false;
+	bool is_shared_pctrl_gpio = false;
+
+	if (!cam_res) {
+		CAM_DBG(CAM_RES, "res mgr is not initilized");
+		return 0;
+	}
+
+	if (!cam_res->shared_gpio_enabled) {
+		CAM_DBG(CAM_RES, "Res_mgr is not sharing any gpios");
+		return 0;
+	}
+
+	dt = &cam_res->dt;
+
+	is_shared_gpio =
+		cam_res_mgr_gpio_is_in_shared_gpio(gpio);
+	is_shared_pctrl_gpio =
+		cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio);
+
+	if (is_shared_gpio && is_shared_pctrl_gpio) {
+		CAM_ERR(CAM_RES,
+			"gpio %u cannot be shared between pinctrl and gpio");
+		return -EINVAL;
+	}
+
+	if (is_shared_gpio) {
+		index = cam_res_mgr_util_get_idx_from_shared_gpio(gpio);
+		if (index < 0) {
+			CAM_ERR(CAM_RES, "Gpio%u not found in shared gpio list",
+				gpio);
+			return -EINVAL;
+		}
+
+		list_for_each_entry(gpio_res,
+			&cam_res->gpio_res_list, list) {
+
+			if (gpio_res->gpio ==
+				dt->shared_gpio[index]) {
+				list_for_each(list, &gpio_res->dev_list)
+					dev_num++;
+
+				if (dev_num >= 2) {
+					return RES_MGR_GPIO_NEED_HOLD;
+				}
+			}
+		}
+	}
+
+	if (is_shared_pctrl_gpio) {
+		index = cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(gpio);
+		if (index < 0) {
+			CAM_ERR(CAM_RES,
+				"gpio%u not found in shared pctrl gpio list",
+				gpio);
+			return -EINVAL;
+		}
+
+		list_for_each_entry(gpio_res,
+			&cam_res->gpio_res_list, list) {
+			if (gpio_res->gpio ==
+				dt->shared_pctrl_gpio[index]) {
+				list_for_each(list, &gpio_res->dev_list)
+					dev_num++;
+
+				if (dev_num >= 2) {
+					CAM_DBG(CAM_RES,
+						"gpio: %u needs to hold", gpio);
+					return RES_MGR_GPIO_NEED_HOLD;
+				}
+			}
+		}
+	}
+
+	for (index = 0; index < dt->num_shared_gpio; index++) {
+		list_for_each_entry(gpio_res,
+			&cam_res->gpio_res_list, list) {
+
+			if (gpio_res->gpio ==
+				dt->shared_gpio[index]) {
+				list_for_each(list, &gpio_res->dev_list)
+					dev_num++;
+
+				if (dev_num >= 2) {
+					CAM_DBG(CAM_RES,
+						"gpio: %u needs to hold", gpio);
+					return RES_MGR_GPIO_NEED_HOLD;
+				}
+			}
+		}
+	}
+
+	for (index = 0; index < dt->num_shared_pctrl_gpio; index++) {
+		list_for_each_entry(gpio_res,
+			&cam_res->gpio_res_list, list) {
+
+			if (gpio_res->gpio ==
+				dt->shared_pctrl_gpio[index]) {
+				list_for_each(list, &gpio_res->dev_list)
+					dev_num++;
+
+				if (dev_num >= 2) {
+					CAM_DBG(CAM_RES,
+						"gpio: %u needs to hold", gpio);
+					return RES_MGR_GPIO_NEED_HOLD;
+				}
+			}
+		}
+	}
+
+	CAM_DBG(CAM_RES, "gpio: %u can free the resource", gpio);
+	return RES_MGR_GPIO_CAN_FREE;
+}
+EXPORT_SYMBOL(cam_res_mgr_util_shared_gpio_check_hold);
+
+static int cam_res_mgr_shared_pinctrl_select_state(
+	int idx, bool active)
+{
+	int rc = 0;
+
+	if (!cam_res || !cam_res->shared_gpio_enabled) {
+		CAM_DBG(CAM_RES, "Not support shared gpio.");
+		return 0;
+	}
+
+	if (cam_res->pctrl_res[idx].pstatus == PINCTRL_STATUS_PUT) {
+		CAM_DBG(CAM_RES, "The shared pinctrl alerady been put.!");
+		return 0;
+	}
+
+	if (active &&
+		(cam_res->pctrl_res[idx].pstatus != PINCTRL_STATUS_ACTIVE)) {
+		CAM_DBG(CAM_RES,
+			"pinctrl select state to active for the shared_pctrl_gpio idx: %d",
+			idx);
+		rc = pinctrl_select_state(cam_res->pinctrl,
+			cam_res->pctrl_res[idx].active);
+		cam_res->pctrl_res[idx].pstatus = PINCTRL_STATUS_ACTIVE;
+	} else if (!active &&
+		(cam_res->pctrl_res[idx].pstatus == PINCTRL_STATUS_ACTIVE)) {
+		CAM_DBG(CAM_RES,
+			"pinctrl select state to suspend for the shared_pctrl_gpio idx: %d",
+			idx);
+		rc = pinctrl_select_state(cam_res->pinctrl,
+			cam_res->pctrl_res[idx].suspend);
+		cam_res->pctrl_res[idx].pstatus = PINCTRL_STATUS_SUSPEND;
+	}
+
+	return rc;
+}
+
+static int cam_res_mgr_add_device(struct device *dev,
+	struct cam_gpio_res *gpio_res)
+{
+	struct cam_dev_res *dev_res = NULL;
+
+	dev_res = kzalloc(sizeof(struct cam_dev_res), GFP_KERNEL);
+	if (!dev_res)
+		return -ENOMEM;
+
+	dev_res->dev = dev;
+	INIT_LIST_HEAD(&dev_res->list);
+	list_add_tail(&dev_res->list, &gpio_res->dev_list);
+
+	return 0;
+}
+
+static struct cam_gpio_res *cam_res_mgr_find_if_gpio_in_list(uint gpio)
+{
+	struct cam_gpio_res *gpio_res = NULL;
+
+	list_for_each_entry(gpio_res, &cam_res->gpio_res_list, list) {
+		if (gpio == gpio_res->gpio)
+			return gpio_res;
+	}
+
+	return NULL;
+}
+
+static bool __cam_res_mgr_find_if_gpio_is_shared(uint gpio)
+{
+	bool found_in_shared_gpio = false;
+	bool found_in_shared_pctrl_gpio = false;
+
+	found_in_shared_gpio = cam_res_mgr_gpio_is_in_shared_gpio(gpio);
+
+	found_in_shared_pctrl_gpio =
+		cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio);
+
+	if (found_in_shared_pctrl_gpio && found_in_shared_gpio) {
+		CAM_WARN(CAM_RES, "gpio: %u cannot be shared in both list",
+			gpio);
+		return false;
+	}
+
+	if (found_in_shared_pctrl_gpio || found_in_shared_gpio)
+		return true;
+
+	return false;
+}
+
+
+int cam_res_mgr_gpio_request(struct device *dev, uint gpio,
+		unsigned long flags, const char *label)
+{
+	int                          rc = 0;
+	bool                         dev_found = false;
+	bool                         gpio_found = false;
+	int                          pctrl_idx = -1;
+	struct cam_gpio_res         *gpio_res = NULL;
+
+	mutex_lock(&cam_res->gpio_res_lock);
+	if (cam_res && cam_res->shared_gpio_enabled) {
+		gpio_res = cam_res_mgr_find_if_gpio_in_list(gpio);
+		if (gpio_res == NULL)
+			gpio_found = false;
+		else
+			gpio_found = true;
+	}
+
+	/*
+	 * gpio_found equal to false has two situation:
+	 * 1. shared gpio/pinctrl_gpio not enabled
+	 * 2. shared gpio/pinctrl_gpio enabled, but not find this gpio
+	 *    from the gpio_res_list
+	 * These two situations both need request gpio.
+	 */
+	if (!gpio_found) {
+		CAM_DBG(CAM_RES, "gpio: %u not found in gpio_res list", gpio);
+		rc = gpio_request_one(gpio, flags, label);
+		if (rc) {
+			CAM_ERR(CAM_RES, "gpio %d:%s request fails rc = %d",
+				gpio, label, rc);
+			goto end;
+		}
+	}
+
+	/*
+	 * If the gpio is in the shared list, and not find
+	 * from gpio_res_list, then insert a cam_gpio_res
+	 * to gpio_res_list.
+	 */
+	if ((!gpio_found && cam_res
+		&& cam_res->shared_gpio_enabled) &&
+		(cam_res_mgr_gpio_is_in_shared_gpio(gpio) ||
+		(cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio)))) {
+		CAM_DBG(CAM_RES, "gpio: %u is shared", gpio);
+
+		gpio_res = kzalloc(sizeof(struct cam_gpio_res), GFP_KERNEL);
+		if (!gpio_res) {
+			rc = -ENOMEM;
+			goto end;
+		}
+		gpio_res->gpio = gpio;
+		gpio_res->power_on_count = 0;
+		INIT_LIST_HEAD(&gpio_res->list);
+		INIT_LIST_HEAD(&gpio_res->dev_list);
+
+		rc = cam_res_mgr_add_device(dev, gpio_res);
+		if (rc) {
+			kfree(gpio_res);
+			goto end;
+		}
+
+		list_add_tail(&gpio_res->list, &cam_res->gpio_res_list);
+	}
+
+	/* if shared gpio is in pinctrl gpio list */
+	if (!gpio_found && cam_res
+		&& cam_res->shared_gpio_enabled &&
+		cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio)) {
+		pctrl_idx =
+			cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(gpio);
+		CAM_DBG(CAM_RES,
+			"shared_pctrl_gpio is at idx: %d", pctrl_idx);
+		if (pctrl_idx < 0) {
+			CAM_ERR(CAM_RES,
+				"pctrl_gpio: %u not found", gpio);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Update Pinctrl state to active */
+		cam_res_mgr_shared_pinctrl_select_state(pctrl_idx, true);
+	}
+
+	if (gpio_found && cam_res
+		&& cam_res->shared_gpio_enabled) {
+		struct cam_dev_res *dev_res = NULL;
+
+		list_for_each_entry(dev_res, &gpio_res->dev_list, list) {
+			if (dev_res->dev == dev) {
+				dev_found = true;
+				break;
+			}
+		}
+
+		if (!dev_found) {
+			rc = cam_res_mgr_add_device(dev, gpio_res);
+			if (rc) {
+				CAM_ERR(CAM_RES,
+					"add device to gpio res list failed rc: %d",
+					rc);
+				goto end;
+			}
+		}
+	}
+
+end:
+	mutex_unlock(&cam_res->gpio_res_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_res_mgr_gpio_request);
+
+bool cam_res_mgr_util_check_if_gpio_is_shared(
+	struct gpio *gpio_tbl, uint8_t size)
+{
+	int i = 0;
+	bool found = false;
+
+	if (!cam_res) {
+		CAM_DBG(CAM_RES, "cam_res data is not avaialbe");
+		return false;
+	}
+
+	if (!cam_res->shared_gpio_enabled) {
+		CAM_DBG(CAM_RES, "shared gpio support is not enabled");
+		return false;
+	}
+
+	for (i = 0; i < size; i++) {
+		found = __cam_res_mgr_find_if_gpio_is_shared(gpio_tbl[i].gpio);
+		if (found)
+			return found;
+	}
+
+	return false;
+}
+EXPORT_SYMBOL(cam_res_mgr_util_check_if_gpio_is_shared);
+
+static void cam_res_mgr_gpio_free(struct device *dev, uint gpio)
+{
+	bool                   gpio_found = false;
+	bool                   need_free = true;
+	int                    dev_num = 0;
+	struct cam_gpio_res   *gpio_res = NULL;
+	bool                   is_shared_pctrl_gpio = false;
+	int                    pctrl_idx = -1;
+
+	is_shared_pctrl_gpio =
+			cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio);
+
+	mutex_lock(&cam_res->gpio_res_lock);
+	if (cam_res && cam_res->shared_gpio_enabled) {
+		list_for_each_entry(gpio_res, &cam_res->gpio_res_list, list) {
+			if (gpio == gpio_res->gpio) {
+				gpio_found = true;
+				break;
+			}
+		}
+	}
+
+	if (gpio_found && cam_res
+		&& cam_res->shared_gpio_enabled) {
+		struct list_head *list;
+		struct cam_dev_res *dev_res = NULL;
+
+		/* Count the dev number in the dev_list */
+		list_for_each(list, &gpio_res->dev_list)
+			dev_num++;
+
+		/*
+		 * Need free the gpio if only has last 1 device
+		 * in the dev_list, otherwise, not free this
+		 * gpio.
+		 */
+		if (dev_num == 1) {
+			dev_res = list_first_entry(&gpio_res->dev_list,
+				struct cam_dev_res, list);
+			list_del_init(&dev_res->list);
+			kfree(dev_res);
+			list_del_init(&gpio_res->list);
+			kfree(gpio_res);
+		} else {
+			list_for_each_entry(dev_res,
+				&gpio_res->dev_list, list) {
+				if (dev_res->dev == dev) {
+					list_del_init(&dev_res->list);
+					kfree(dev_res);
+					need_free = false;
+					break;
+				}
+			}
+		}
+	}
+
+	if (need_free) {
+		if (is_shared_pctrl_gpio) {
+			pctrl_idx =
+				cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(
+					gpio);
+			if (pctrl_idx >= 0) {
+				cam_res_mgr_shared_pinctrl_select_state(
+					pctrl_idx, false);
+			}
+			else {
+				CAM_ERR(CAM_RES, "Invalid PinCtrl Idx: %d", pctrl_idx);
+			}
+		}
+
+		CAM_DBG(CAM_RES, "freeing gpio: %u", gpio);
+		gpio_free(gpio);
+	}
+
+	mutex_unlock(&cam_res->gpio_res_lock);
+}
+
+void cam_res_mgr_gpio_free_arry(struct device *dev,
+		const struct gpio *array, size_t num)
+{
+	while (num--)
+		cam_res_mgr_gpio_free(dev, (array[num]).gpio);
+}
+EXPORT_SYMBOL(cam_res_mgr_gpio_free_arry);
+
+int cam_res_mgr_gpio_set_value(unsigned int gpio, int value)
+{
+	int rc = 0;
+	bool found = false;
+	struct cam_gpio_res *gpio_res = NULL;
+
+	mutex_lock(&cam_res->gpio_res_lock);
+	if (cam_res && cam_res->shared_gpio_enabled) {
+		list_for_each_entry(gpio_res, &cam_res->gpio_res_list, list) {
+			if (gpio == gpio_res->gpio) {
+				found = true;
+				break;
+			}
+		}
+	}
+
+	/*
+	 * Set the value directly if can't find the gpio from
+	 * gpio_res_list, otherwise, need add ref count support
+	 **/
+	if (!found) {
+		gpio_set_value_cansleep(gpio, value);
+	} else {
+		if (value) {
+			gpio_res->power_on_count++;
+			if (gpio_res->power_on_count < 2) {
+				gpio_set_value_cansleep(gpio, value);
+				CAM_DBG(CAM_RES,
+					"Shared GPIO(%d) : HIGH", gpio);
+			}
+		} else {
+			gpio_res->power_on_count--;
+			if (gpio_res->power_on_count < 1) {
+				gpio_set_value_cansleep(gpio, value);
+				CAM_DBG(CAM_RES,
+					"Shared GPIO(%d) : LOW", gpio);
+			}
+		}
+	}
+
+	mutex_unlock(&cam_res->gpio_res_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_res_mgr_gpio_set_value);
+
+static int cam_res_mgr_shared_pinctrl_init(
+	struct device *dev)
+{
+	int i = 0;
+	char pctrl_active[50];
+	char pctrl_suspend[50];
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	cam_res->pinctrl = devm_pinctrl_get(dev);
+	if (IS_ERR_OR_NULL(cam_res->pinctrl)) {
+		CAM_ERR(CAM_RES, "Pinctrl not available");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < dt->num_shared_pctrl_gpio; i++) {
+		snprintf(pctrl_active, sizeof(pctrl_active),
+			"%s%s",
+			cam_res->dt.pctrl_name[i],
+			"_active");
+		CAM_DBG(CAM_RES, "pctrl_active at index: %d name: %s",
+			i, pctrl_active);
+		snprintf(pctrl_suspend, sizeof(pctrl_suspend),
+			"%s%s",
+			cam_res->dt.pctrl_name[i],
+			"_suspend");
+		CAM_DBG(CAM_RES, "pctrl_suspend at index: %d name: %s",
+			i, pctrl_suspend);
+		cam_res->pctrl_res[i].active =
+			pinctrl_lookup_state(cam_res->pinctrl,
+			pctrl_active);
+		if (IS_ERR_OR_NULL(cam_res->pctrl_res[i].active)) {
+			CAM_ERR(CAM_RES,
+				"Failed to get the active state pinctrl handle");
+			return -EINVAL;
+		}
+		cam_res->pctrl_res[i].suspend =
+			pinctrl_lookup_state(cam_res->pinctrl,
+			pctrl_suspend);
+		if (IS_ERR_OR_NULL(cam_res->pctrl_res[i].active)) {
+			CAM_ERR(CAM_RES,
+				"Failed to get the active state pinctrl handle");
+			return -EINVAL;
+		}
+		cam_res->pctrl_res[i].pstatus = PINCTRL_STATUS_GOT;
+	}
+
+	cam_res->pstatus = PINCTRL_STATUS_GOT;
+
+	return 0;
+}
+
+static int cam_res_mgr_parse_dt_shared_gpio(
+	struct device *dev)
+{
+	int rc = 0;
+	struct device_node *of_node = NULL;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	of_node = dev->of_node;
+	dt->num_shared_gpio = of_property_count_u32_elems(of_node,
+		"gpios-shared");
+
+	if (dt->num_shared_gpio <= 0) {
+		CAM_DBG(CAM_RES,
+			"Not found any shared gpio");
+		return -ENODEV;
+	}
+
+	if (dt->num_shared_gpio >= MAX_SHARED_GPIO_SIZE) {
+		CAM_ERR(CAM_RES,
+			"shared_gpio: %d max supported: %d",
+			MAX_SHARED_GPIO_SIZE,
+			dt->num_shared_gpio);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32_array(of_node, "gpios-shared",
+		dt->shared_gpio, dt->num_shared_gpio);
+	if (rc) {
+		CAM_ERR(CAM_RES, "Get shared gpio array failed.");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_res_mgr_parse_dt_shared_pinctrl_gpio(
+	struct device *dev)
+{
+	int rc = 0, i = 0;
+	int pinctrl_name_nodes = 0;
+	struct device_node *of_node = NULL;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	of_node = dev->of_node;
+	dt->num_shared_pctrl_gpio = of_property_count_u32_elems(of_node,
+		"gpios-shared-pinctrl");
+
+	if (dt->num_shared_pctrl_gpio <= 0) {
+		CAM_DBG(CAM_RES,
+			"Not found any shared pinctrl res");
+		return -ENODEV;
+	}
+
+	if (dt->num_shared_pctrl_gpio >= MAX_SHARED_PCTRL_GPIO_SIZE) {
+		CAM_ERR(CAM_RES,
+			"Invalid Pinctrl GPIO number %d. No shared gpio.",
+			dt->num_shared_pctrl_gpio);
+		return -EINVAL;
+	}
+
+	pinctrl_name_nodes = of_property_count_strings(of_node,
+		"shared-pctrl-gpio-names");
+
+	if (pinctrl_name_nodes != dt->num_shared_pctrl_gpio) {
+		CAM_ERR(CAM_RES,
+			"Mismatch between entries:: pctrl_gpio: %d and pctrl_name: %d",
+			dt->num_shared_pctrl_gpio,
+			pinctrl_name_nodes);
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_RES,
+		"number of pctrl_gpio: %d", dt->num_shared_pctrl_gpio);
+
+	rc = of_property_read_u32_array(of_node, "gpios-shared-pinctrl",
+		dt->shared_pctrl_gpio, dt->num_shared_pctrl_gpio);
+	if (rc) {
+		CAM_ERR(CAM_RES, "Get shared pinctrl gpio array failed.");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < pinctrl_name_nodes; i++) {
+		rc = of_property_read_string_index(of_node,
+			"shared-pctrl-gpio-names",
+			i, &(dt->pctrl_name[i]));
+		CAM_INFO(CAM_RES, "shared-pctrl-gpio-names[%d] = %s",
+			i, dt->pctrl_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_RES,
+				"i= %d pinctrl_name_nodes= %d reading clock-names failed",
+				i, pinctrl_name_nodes);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_res_mgr_parse_dt(struct device *dev)
+{
+	int rc = 0;
+
+	rc = cam_res_mgr_parse_dt_shared_gpio(dev);
+	if (rc) {
+		if (rc == -ENODEV) {
+			CAM_DBG(CAM_RES,
+				"Shared GPIO resources not available");
+		} else {
+			CAM_ERR(CAM_RES,
+				"Shared gpio parsing failed: rc: %d", rc);
+			return rc;
+		}
+	}
+
+	rc = cam_res_mgr_parse_dt_shared_pinctrl_gpio(dev);
+	if (rc) {
+		if (rc == -ENODEV) {
+			CAM_DBG(CAM_RES,
+				"Pinctrl shared resources not available");
+		} else {
+			CAM_ERR(CAM_RES,  "Pinctrl parsing failed: rc: %d",
+				rc);
+			return rc;
+		}
+	} else {
+		/* When shared pinctrl is detected do the init */
+		rc = cam_res_mgr_shared_pinctrl_init(dev);
+		if (rc) {
+			CAM_ERR(CAM_RES, "Pinctrl init failed rc: %d", rc);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_res_mgr_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	cam_res = kzalloc(sizeof(*cam_res), GFP_KERNEL);
+	if (!cam_res) {
+		CAM_ERR(CAM_RES, "Not Enough Mem");
+		return -ENOMEM;
+	}
+	cam_res->dev = &pdev->dev;
+
+	CAM_DBG(CAM_RES, "ENTER");
+	rc = cam_res_mgr_parse_dt(&pdev->dev);
+	if (rc) {
+		CAM_ERR(CAM_RES,
+			"Error in parsing device tree, rc: %d", rc);
+		kfree(cam_res);
+		return rc;
+	}
+
+	if (cam_res->dt.num_shared_gpio || cam_res->dt.num_shared_pctrl_gpio) {
+		CAM_DBG(CAM_RES, "Enable shared gpio support.");
+		cam_res->shared_gpio_enabled = true;
+	} else {
+		CAM_DBG(CAM_RES, "Disable shared gpio support.");
+		cam_res->shared_gpio_enabled = false;
+	}
+
+	mutex_init(&cam_res->flash_res_lock);
+	mutex_init(&cam_res->gpio_res_lock);
+
+	INIT_LIST_HEAD(&cam_res->gpio_res_list);
+	INIT_LIST_HEAD(&cam_res->flash_res_list);
+
+	CAM_DBG(CAM_RES, "Component bound successfully");
+	return 0;
+}
+
+static void cam_res_mgr_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	if (cam_res) {
+		cam_res_mgr_free_res();
+		if (cam_res->pinctrl)
+			devm_pinctrl_put(cam_res->pinctrl);
+		cam_res->pinctrl = NULL;
+		cam_res->pstatus = PINCTRL_STATUS_PUT;
+		kfree(cam_res);
+		cam_res = NULL;
+	}
+
+	CAM_DBG(CAM_RES, "Component unbound successfully");
+}
+
+const static struct component_ops cam_res_mgr_component_ops = {
+	.bind = cam_res_mgr_component_bind,
+	.unbind = cam_res_mgr_component_unbind,
+};
+
+static int cam_res_mgr_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_RES, "Adding Res mgr component");
+	rc = component_add(&pdev->dev, &cam_res_mgr_component_ops);
+	if (rc)
+		CAM_ERR(CAM_RES, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_res_mgr_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_res_mgr_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_res_mgr_dt_match[] = {
+	{.compatible = "qcom,cam-res-mgr"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_res_mgr_dt_match);
+
+struct platform_driver cam_res_mgr_driver = {
+	.probe = cam_res_mgr_probe,
+	.remove = cam_res_mgr_remove,
+	.driver = {
+		.name = "cam_res_mgr",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_res_mgr_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_res_mgr_init(void)
+{
+	return platform_driver_register(&cam_res_mgr_driver);
+}
+
+void cam_res_mgr_exit(void)
+{
+	platform_driver_unregister(&cam_res_mgr_driver);
+}
+
+MODULE_DESCRIPTION("Camera resource manager driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr_api.h
@@ -0,0 +1,135 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __CAM_RES_MGR_API_H__
+#define __CAM_RES_MGR_API_H__
+
+#include <linux/leds.h>
+
+/**
+ * @brief: Register the led trigger
+ *
+ *  The newly registered led trigger is assigned to flash_res_list.
+ *
+ * @name  : Pointer to int led trigger name
+ * @tp    : Save the returned led trigger
+ *
+ * @return None
+ */
+void cam_res_mgr_led_trigger_register(const char *name,
+	struct led_trigger **tp);
+
+/**
+ * @brief: Unregister the led trigger
+ *
+ *  Free the flash_res if this led trigger isn't used by other device .
+ *
+ * @tp : Pointer to the led trigger
+ *
+ * @return None
+ */
+void cam_res_mgr_led_trigger_unregister(struct led_trigger *tp);
+
+/**
+ * @brief: Trigger the event to led core
+ *
+ * @trig       : Pointer to the led trigger
+ * @brightness : The brightness need to fire
+ *
+ * @return None
+ */
+void cam_res_mgr_led_trigger_event(struct led_trigger *trig,
+	enum led_brightness brightness);
+
+/**
+ * @brief: Check for shared gpio
+ *
+ *  Will check whether requested device shares the gpio with other
+ *  device. This function check against gpio table from device and
+ *  shared gpio resources has been defined at res-mgr level
+ *
+ * @gpio_tbl  : The GPIO table for respective device
+ * @size      : GPIO table size
+ * @return Status of operation. False if not shared, true otherwise.
+ */
+bool cam_res_mgr_util_check_if_gpio_is_shared(
+	struct gpio *gpio_tbl, uint8_t size);
+
+/**
+ * @brief: Request a gpio
+ *
+ *  Will alloc a gpio_res for the new gpio, other find the corresponding
+ *  gpio_res.
+ *
+ * @dev   : Pointer to the device
+ * @gpio  : The GPIO number
+ * @flags : GPIO configuration as specified by GPIOF_*
+ * @label : A literal description string of this GPIO
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_res_mgr_gpio_request(struct device *dev, unsigned int gpio,
+		unsigned long flags, const char *label);
+
+/**
+ * @brief: Free a array GPIO
+ *
+ *  Free the GPIOs and release corresponding gpio_res.
+ *
+ * @dev   : Pointer to the device
+ * @gpio  : Array of the GPIO number
+ * @num   : The number of gpio
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+void cam_res_mgr_gpio_free_arry(struct device *dev,
+	const struct gpio *array, size_t num);
+
+/**
+ * @brief: Set GPIO power level
+ *
+ *  Add ref count support for shared GPIOs.
+ *
+ * @gpio   : The GPIO number
+ * @value  : The power level need to setup
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ * -EINVAL will be returned if the gpio can't be found in gpio_res_list.
+ */
+int cam_res_mgr_gpio_set_value(unsigned int gpio, int value);
+
+
+/**
+ * @brief : API to register RES_MGR to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_res_mgr_init(void);
+
+/**
+ * @brief : API to remove RES_MGR from platform framework.
+ */
+void cam_res_mgr_exit(void);
+
+/**
+ * @brief : API to get gpio idx from shared gpio list.
+ * @return idx for Success and error if gpio not found or invalid.
+ */
+int cam_res_mgr_util_get_idx_from_shared_gpio(uint gpio);
+
+/**
+ * @brief : API to get gpio idx from shared pinctrl gpio list.
+ * @return idx for Success and error if gpio not found or invalid.
+ */
+int cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(uint gpio);
+
+/**
+ * @brief : API to check whether gpio is in use or can be free.
+ * @return NEED_HOLD macro if gpio is in use CAN_FREE if gpio can be free,
+ *	error if operation is not valid, 0 in case of res_mgr is not
+ *	available.
+ */
+int cam_res_mgr_util_shared_gpio_check_hold(uint gpio);
+
+#endif /* __CAM_RES_MGR_API_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr_private.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr_private.h
@@ -0,0 +1,125 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __CAM_RES_MGR_PRIVATE_H__
+#define __CAM_RES_MGR_PRIVATE_H__
+
+#include <linux/list.h>
+#include <linux/leds.h>
+#include "cam_soc_util.h"
+#include "cam_sensor_util.h"
+
+#define MAX_SHARED_GPIO_SIZE         16
+#define MAX_SHARED_PCTRL_GPIO_SIZE   10
+
+/**
+ * enum pinctrl_status - Enum for pinctrl status
+ */
+enum pinctrl_status {
+	PINCTRL_STATUS_GOT = 0,
+	PINCTRL_STATUS_ACTIVE,
+	PINCTRL_STATUS_SUSPEND,
+	PINCTRL_STATUS_PUT,
+};
+
+/**
+ * struct cam_dev_res
+ *
+ * @list : List member used to append this node to a dev list
+ * @dev  : Device pointer associated with device
+ */
+struct cam_dev_res {
+	struct list_head list;
+	struct device    *dev;
+};
+
+/**
+ * struct cam_gpio_res
+ *
+ * @list           : List member used to append this node to a gpio list
+ * @dev_list       : List the device which request this gpio
+ * @gpio           : Gpio value
+ * @power_on_count : Record the power on times of this gpio
+ */
+struct cam_gpio_res {
+	struct list_head list;
+	struct list_head dev_list;
+	unsigned int     gpio;
+	int              power_on_count;
+};
+
+/**
+ * struct cam_pinctrl_res
+ *
+ * @list           : List member used to append this node to a linked list
+ * @name           : Pointer to the flash trigger's name.
+ * @trigger        : Pointer to the flash trigger
+ */
+struct cam_flash_res {
+	struct list_head   list;
+	const char         *name;
+	struct led_trigger *trigger;
+};
+
+/**
+ * struct cam_pinctrl_res
+ *
+ * @active         : Pinctrl state pointer for active state
+ * @suspend        : Pinctrl state pointer for suspend state
+ * @pstatus        : Pinctrl status holder
+ */
+struct cam_pinctrl_res {
+	struct pinctrl_state  *active;
+	struct pinctrl_state  *suspend;
+	enum pinctrl_status   pstatus;
+};
+
+/**
+ * struct cam_res_mgr_dt
+ *
+ * @shared_gpio            : Shared gpios list
+ * @shared_pctrl_gpio      : Shared pinctrl gpio list
+ * @num_shared_gpio        : Number of shared gpio
+ * @num_shared_pctrl_gpio  : Number of shared pinctrl gpio
+ * @pctrl_name             : Pinctrl name from shared pinctrl gpio list
+ */
+struct cam_res_mgr_dt {
+	uint                shared_gpio[MAX_SHARED_GPIO_SIZE];
+	uint                shared_pctrl_gpio[MAX_SHARED_PCTRL_GPIO_SIZE];
+	int                 num_shared_gpio;
+	int                 num_shared_pctrl_gpio;
+	const char         *pctrl_name[MAX_SHARED_PCTRL_GPIO_SIZE];
+};
+
+/**
+ * struct cam_pinctrl_res
+ *
+ * @dev                 : Pointer to the device
+ * @dt                  : Device tree resource
+ * @shared_gpio_enabled : The flag to indicate if support shared gpio
+ * @pstatus             : Top level device pinctrl status
+ * @pinctrl             : Device pinctrl pointer
+ * @pctrl_res           : Pinctrl resource array
+ * @gpio_res_list       : List head of the gpio resource
+ * @flash_res_list      : List head of the flash resource
+ * @gpio_res_lock       : GPIO resource lock
+ * @flash_res_lock      : Flash resource lock
+ */
+struct cam_res_mgr {
+	struct device          *dev;
+	struct cam_res_mgr_dt   dt;
+	bool                    shared_gpio_enabled;
+
+	enum pinctrl_status     pstatus;
+	struct pinctrl         *pinctrl;
+	struct cam_pinctrl_res  pctrl_res[MAX_SHARED_PCTRL_GPIO_SIZE];
+
+	struct list_head        gpio_res_list;
+	struct list_head        flash_res_list;
+	struct mutex            gpio_res_lock;
+	struct mutex            flash_res_lock;
+};
+
+#endif /* __CAM_RES_MGR_PRIVATE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c
@@ -0,0 +1,2279 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <cam_sensor_cmn_header.h>
+#include "cam_sensor_core.h"
+#include "cam_sensor_util.h"
+#include "cam_soc_util.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+#include "cam_req_mgr_dev.h"
+
+#define CAM_SENSOR_PIPELINE_DELAY_MASK        0xFF
+#define CAM_SENSOR_MODESWITCH_DELAY_SHIFT     8
+
+extern struct completion *cam_sensor_get_i3c_completion(uint32_t index);
+
+static int cam_sensor_notify_v4l2_error_event(
+	struct cam_sensor_ctrl_t *s_ctrl,
+	uint32_t error_type, uint32_t error_code)
+{
+	int                        rc = 0;
+	struct cam_req_mgr_message req_msg = {0};
+
+	req_msg.session_hdl = s_ctrl->bridge_intf.session_hdl;
+	req_msg.u.err_msg.device_hdl = s_ctrl->bridge_intf.device_hdl;
+	req_msg.u.err_msg.link_hdl = s_ctrl->bridge_intf.link_hdl;
+	req_msg.u.err_msg.error_type = error_type;
+	req_msg.u.err_msg.request_id = s_ctrl->last_applied_req;
+	req_msg.u.err_msg.resource_size = 0x0;
+	req_msg.u.err_msg.error_code = error_code;
+
+	CAM_DBG(CAM_SENSOR,
+		"v4l2 error event [type: %u code: %u] for req: %llu on %s",
+		error_type, error_code, s_ctrl->last_applied_req,
+		s_ctrl->sensor_name);
+
+	rc = cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_ERROR,
+		V4L_EVENT_CAM_REQ_MGR_EVENT);
+	if (rc)
+		CAM_ERR(CAM_SENSOR,
+			"Notifying v4l2 error [type: %u code: %u] failed for req id:%llu on %s",
+			error_type, error_code, s_ctrl->last_applied_req,
+			s_ctrl->sensor_name);
+
+	return rc;
+}
+
+static int cam_sensor_update_req_mgr(
+	struct cam_sensor_ctrl_t *s_ctrl,
+	struct cam_packet *csl_packet)
+{
+	int rc = 0;
+	struct cam_req_mgr_add_request add_req;
+
+	memset(&add_req, 0, sizeof(add_req));
+	add_req.link_hdl = s_ctrl->bridge_intf.link_hdl;
+	add_req.req_id = csl_packet->header.request_id;
+	CAM_DBG(CAM_SENSOR, " Rxed Req Id: %llu",
+		csl_packet->header.request_id);
+	add_req.dev_hdl = s_ctrl->bridge_intf.device_hdl;
+	if (s_ctrl->bridge_intf.crm_cb &&
+		s_ctrl->bridge_intf.crm_cb->add_req) {
+		rc = s_ctrl->bridge_intf.crm_cb->add_req(&add_req);
+		if (rc) {
+			if (rc == -EBADR)
+				CAM_INFO(CAM_SENSOR,
+					"Adding request: %llu failed with request manager rc: %d, it has been flushed",
+					csl_packet->header.request_id, rc);
+			else
+				CAM_ERR(CAM_SENSOR,
+					"Adding request: %llu failed with request manager rc: %d",
+					csl_packet->header.request_id, rc);
+			return rc;
+		}
+	}
+
+	CAM_DBG(CAM_SENSOR, "Successfully add req: %llu to req mgr",
+			add_req.req_id);
+	return rc;
+}
+
+static void cam_sensor_release_stream_rsc(
+	struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct i2c_settings_array *i2c_set = NULL;
+	int rc;
+
+	i2c_set = &(s_ctrl->i2c_data.streamoff_settings);
+	if (i2c_set->is_settings_valid == 1) {
+		i2c_set->is_settings_valid = -1;
+		rc = delete_request(i2c_set);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"failed while deleting Streamoff settings");
+	}
+
+	i2c_set = &(s_ctrl->i2c_data.streamon_settings);
+	if (i2c_set->is_settings_valid == 1) {
+		i2c_set->is_settings_valid = -1;
+		rc = delete_request(i2c_set);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"failed while deleting Streamon settings");
+	}
+}
+
+static void cam_sensor_release_per_frame_resource(
+	struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct i2c_settings_array *i2c_set = NULL;
+	int i, rc;
+
+	if (s_ctrl->i2c_data.per_frame != NULL) {
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			i2c_set = &(s_ctrl->i2c_data.per_frame[i]);
+			if (i2c_set->is_settings_valid == 1) {
+				i2c_set->is_settings_valid = -1;
+				rc = delete_request(i2c_set);
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"delete per frame setting for request: %lld rc: %d",
+						i2c_set->request_id, rc);
+			}
+		}
+	}
+
+	if (s_ctrl->i2c_data.frame_skip != NULL) {
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			i2c_set = &(s_ctrl->i2c_data.frame_skip[i]);
+			if (i2c_set->is_settings_valid == 1) {
+				i2c_set->is_settings_valid = -1;
+				rc = delete_request(i2c_set);
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"delete frame skip setting for request: %lld rc: %d",
+						i2c_set->request_id, rc);
+			}
+		}
+	}
+
+	if (s_ctrl->i2c_data.bubble_update != NULL) {
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			i2c_set = &(s_ctrl->i2c_data.bubble_update[i]);
+			if (i2c_set->is_settings_valid == 1) {
+				i2c_set->is_settings_valid = -1;
+				rc = delete_request(i2c_set);
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"delete bubble update setting for request: %lld rc: %d",
+						i2c_set->request_id, rc);
+			}
+		}
+	}
+}
+
+static int cam_sensor_handle_res_info(struct cam_sensor_res_info *res_info,
+	struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0;
+	uint32_t idx = 0;
+
+	if (!s_ctrl || !res_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid params: res_info: %s, s_ctrl: %s",
+			CAM_IS_NULL_TO_STR(res_info),
+			CAM_IS_NULL_TO_STR(s_ctrl));
+		return -EINVAL;
+	}
+
+	idx = s_ctrl->last_updated_req % MAX_PER_FRAME_ARRAY;
+
+	s_ctrl->sensor_res[idx].res_index = res_info->res_index;
+	strscpy(s_ctrl->sensor_res[idx].caps, res_info->caps,
+		sizeof(s_ctrl->sensor_res[idx].caps));
+	s_ctrl->sensor_res[idx].width = res_info->width;
+	s_ctrl->sensor_res[idx].height = res_info->height;
+	s_ctrl->sensor_res[idx].fps = res_info->fps;
+
+	if (res_info->num_valid_params > 0) {
+		if (res_info->valid_param_mask & CAM_SENSOR_FEATURE_MASK)
+			s_ctrl->sensor_res[idx].feature_mask =
+				res_info->params[0];
+
+		if (res_info->valid_param_mask & CAM_SENSOR_NUM_BATCHED_FRAMES)
+			s_ctrl->num_batched_frames = res_info->params[1];
+	}
+
+	s_ctrl->is_res_info_updated = true;
+
+	/* If request id is 0, it will be during an initial config/acquire */
+	CAM_INFO(CAM_SENSOR,
+		"Sensor[%s-%d] Feature: 0x%x updated for request id: %lu, res index: %u, width: 0x%x, height: 0x%x, capability: %s, fps: %u",
+		s_ctrl->sensor_name, s_ctrl->soc_info.index,
+		s_ctrl->sensor_res[idx].feature_mask,
+		s_ctrl->sensor_res[idx].request_id, s_ctrl->sensor_res[idx].res_index,
+		s_ctrl->sensor_res[idx].width, s_ctrl->sensor_res[idx].height,
+		s_ctrl->sensor_res[idx].caps, s_ctrl->sensor_res[idx].fps);
+
+	return rc;
+}
+
+static int32_t cam_sensor_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	int rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl =
+		(struct cam_sensor_ctrl_t *) user_data;
+
+	if (!blob_data || !blob_size) {
+		CAM_ERR(CAM_SENSOR, "Invalid blob info %pK %u", blob_data,
+			blob_size);
+		return -EINVAL;
+	}
+
+	switch (blob_type) {
+	case CAM_SENSOR_GENERIC_BLOB_RES_INFO: {
+		struct cam_sensor_res_info *res_info =
+			(struct cam_sensor_res_info *) blob_data;
+
+		if (blob_size < sizeof(struct cam_sensor_res_info)) {
+			CAM_ERR(CAM_SENSOR, "Invalid blob size expected: 0x%x actual: 0x%x",
+				sizeof(struct cam_sensor_res_info), blob_size);
+			return -EINVAL;
+		}
+
+		rc = cam_sensor_handle_res_info(res_info, s_ctrl);
+		break;
+	}
+	default:
+		CAM_WARN(CAM_SENSOR, "Invalid blob type %d", blob_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int32_t cam_sensor_pkt_parse(struct cam_sensor_ctrl_t *s_ctrl,
+	void *arg)
+{
+	int32_t rc = 0;
+	uintptr_t generic_ptr;
+	struct cam_control *ioctl_ctrl = NULL;
+	struct cam_packet *csl_packet = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct cam_buf_io_cfg *io_cfg = NULL;
+	struct i2c_settings_array *i2c_reg_settings = NULL;
+	size_t len_of_buff = 0;
+	size_t remain_len = 0;
+	uint32_t *offset = NULL;
+	int64_t prev_updated_req;
+	uint32_t cmd_buf_type, idx;
+	struct cam_config_dev_cmd config;
+	struct i2c_data_settings *i2c_data = NULL;
+
+	ioctl_ctrl = (struct cam_control *)arg;
+
+	if (ioctl_ctrl->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_SENSOR, "Invalid Handle Type");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&config,
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(config)))
+		return -EFAULT;
+
+	rc = cam_mem_get_cpu_buf(
+		config.packet_handle,
+		&generic_ptr,
+		&len_of_buff);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed in getting the packet: %d", rc);
+		return rc;
+	}
+
+	remain_len = len_of_buff;
+	if ((sizeof(struct cam_packet) > len_of_buff) ||
+		((size_t)config.offset >= len_of_buff -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_SENSOR,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len_of_buff);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	remain_len -= (size_t)config.offset;
+	csl_packet = (struct cam_packet *)(generic_ptr +
+		(uint32_t)config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_SENSOR, "Invalid packet params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) !=
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG &&
+		(csl_packet->header.op_code & 0xFFFFFF) !=
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF &&
+		csl_packet->header.request_id <= s_ctrl->last_flush_req
+		&& s_ctrl->last_flush_req != 0) {
+		CAM_ERR(CAM_SENSOR,
+			"reject request %lld, last request to flush %u",
+			csl_packet->header.request_id, s_ctrl->last_flush_req);
+		rc = -EBADR;
+		goto end;
+	}
+
+	if (csl_packet->header.request_id > s_ctrl->last_flush_req)
+		s_ctrl->last_flush_req = 0;
+
+	prev_updated_req = s_ctrl->last_updated_req;
+	s_ctrl->is_res_info_updated = false;
+
+	i2c_data = &(s_ctrl->i2c_data);
+	CAM_DBG(CAM_SENSOR, "Header OpCode: %d", csl_packet->header.op_code);
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG: {
+		i2c_reg_settings = &i2c_data->init_settings;
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_CONFIG: {
+		i2c_reg_settings = &i2c_data->config_settings;
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMON: {
+		if (s_ctrl->streamon_count > 0) {
+			delete_request(&i2c_data->streamon_settings);
+			s_ctrl->streamon_count = 0;
+		}
+
+		s_ctrl->streamon_count = s_ctrl->streamon_count + 1;
+		i2c_reg_settings = &i2c_data->streamon_settings;
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF: {
+		if (s_ctrl->streamoff_count > 0) {
+			delete_request(&i2c_data->streamoff_settings);
+			s_ctrl->streamoff_count = 0;
+		}
+
+		s_ctrl->streamoff_count = s_ctrl->streamoff_count + 1;
+		i2c_reg_settings = &i2c_data->streamoff_settings;
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_READ: {
+		i2c_reg_settings = &(i2c_data->read_settings);
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+
+		CAM_DBG(CAM_SENSOR, "number of IO configs: %d:",
+			csl_packet->num_io_configs);
+		if (csl_packet->num_io_configs == 0) {
+			CAM_ERR(CAM_SENSOR, "No I/O configs to process");
+			goto end;
+		}
+
+		io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+			&csl_packet->payload_flex +
+			csl_packet->io_configs_offset);
+
+		if (io_cfg == NULL) {
+			CAM_ERR(CAM_SENSOR, "I/O config is invalid(NULL)");
+			goto end;
+		}
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE: {
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_ACQUIRE)) {
+			CAM_WARN(CAM_SENSOR,
+				"Rxed Update packets without linking");
+			goto end;
+		}
+
+		i2c_reg_settings =
+			&i2c_data->per_frame[csl_packet->header.request_id %
+				MAX_PER_FRAME_ARRAY];
+		CAM_DBG(CAM_SENSOR, "Received Packet: %lld req: %lld",
+			csl_packet->header.request_id % MAX_PER_FRAME_ARRAY,
+			csl_packet->header.request_id);
+		if (i2c_reg_settings->is_settings_valid == 1) {
+			CAM_ERR(CAM_SENSOR,
+				"Already some pkt in offset req : %lld",
+				csl_packet->header.request_id);
+			/*
+			 * Update req mgr even in case of failure.
+			 * This will help not to wait indefinitely
+			 * and freeze. If this log is triggered then
+			 * fix it.
+			 */
+			rc = cam_sensor_update_req_mgr(s_ctrl, csl_packet);
+			if (rc)
+				CAM_ERR(CAM_SENSOR,
+					"Failed in adding request to req_mgr");
+			goto end;
+		}
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE: {
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_ACQUIRE)) {
+			CAM_WARN(CAM_SENSOR,
+				"Rxed Update packets without linking");
+			goto end;
+		}
+
+		i2c_reg_settings =
+			&i2c_data->frame_skip[csl_packet->header.request_id %
+				MAX_PER_FRAME_ARRAY];
+		CAM_DBG(CAM_SENSOR, "Received not ready packet: %lld req: %lld",
+			csl_packet->header.request_id % MAX_PER_FRAME_ARRAY,
+			csl_packet->header.request_id);
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_BUBBLE_UPDATE: {
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_ACQUIRE)) {
+			CAM_WARN(CAM_SENSOR,
+				"Rxed Update packets without linking");
+			goto end;
+		}
+
+		i2c_reg_settings =
+			&i2c_data->bubble_update[csl_packet->header.request_id %
+				MAX_PER_FRAME_ARRAY];
+		CAM_DBG(CAM_SENSOR, "Received bubble update packet: %lld req: %lld",
+			csl_packet->header.request_id % MAX_PER_FRAME_ARRAY,
+			csl_packet->header.request_id);
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_NOP: {
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_ACQUIRE)) {
+			CAM_WARN(CAM_SENSOR,
+				"Rxed NOP packets without linking");
+			goto end;
+		}
+
+		i2c_reg_settings =
+			&i2c_data->per_frame[csl_packet->header.request_id %
+				MAX_PER_FRAME_ARRAY];
+		i2c_reg_settings->request_id = csl_packet->header.request_id;
+		i2c_reg_settings->is_settings_valid = 1;
+
+		rc = cam_sensor_update_req_mgr(s_ctrl, csl_packet);
+		if (rc)
+			CAM_ERR(CAM_SENSOR,
+				"Failed in adding request to req_mgr");
+		goto end;
+	}
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Packet Header opcode: %d",
+			csl_packet->header.op_code & 0xFFFFFF);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	offset = (uint32_t *)&csl_packet->payload_flex;
+	offset += csl_packet->cmd_buf_offset / 4;
+	cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+	cmd_buf_type = cmd_desc->meta_data;
+
+	switch (cmd_buf_type) {
+	case CAM_SENSOR_PACKET_I2C_COMMANDS:
+		rc = cam_sensor_i2c_command_parser(&s_ctrl->io_master_info,
+				i2c_reg_settings, cmd_desc, 1, io_cfg);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "Fail parsing I2C Pkt: %d", rc);
+			goto end;
+		}
+		break;
+	case CAM_SENSOR_PACKET_GENERIC_BLOB:
+		if ((csl_packet->header.op_code & 0xFFFFFF) !=
+			CAM_SENSOR_PACKET_OPCODE_SENSOR_CONFIG) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_SENSOR, "Wrong packet opcode sent with blob: %u",
+				csl_packet->header.op_code & 0xFFFFFF);
+			goto end;
+		}
+
+		s_ctrl->last_updated_req = csl_packet->header.request_id;
+		idx = s_ctrl->last_updated_req % MAX_PER_FRAME_ARRAY;
+		s_ctrl->sensor_res[idx].request_id = csl_packet->header.request_id;
+
+		/**
+		 * is_settings_valid is set to false for this case, as generic
+		 * blobs are meant to be used to send debugging information
+		 * alongside actual configuration settings. As these are sent
+		 * as separate packets at present, while sharing the same CONFIG
+		 * opcode, setting this to false prevents sensor driver from
+		 * applying non-existent configuration and changing s_ctrl
+		 * state to CAM_SENSOR_CONFIG
+		 */
+		i2c_reg_settings->is_settings_valid = 0;
+
+		rc = cam_packet_util_process_generic_cmd_buffer(cmd_desc,
+			cam_sensor_generic_blob_handler, s_ctrl);
+		if (rc)
+			s_ctrl->sensor_res[idx].request_id = 0;
+
+		break;
+	}
+
+	/*
+	 * If no res info in current request, then we pick previous
+	 * resolution info as current resolution info.
+	 * Don't copy the sensor resolution info when the request id
+	 * is invalid.
+	 */
+	if ((!s_ctrl->is_res_info_updated) && (csl_packet->header.request_id != 0)) {
+		/*
+		 * Update the last updated req at two places.
+		 * 1# Got generic blob: The req id can be zero for the initial res info updating
+		 * 2# Copy previous res info: The req id can't be zero, in case some queue info
+		 * are override by slot0.
+		 */
+		s_ctrl->last_updated_req = csl_packet->header.request_id;
+		s_ctrl->sensor_res[s_ctrl->last_updated_req % MAX_PER_FRAME_ARRAY] =
+			s_ctrl->sensor_res[prev_updated_req % MAX_PER_FRAME_ARRAY];
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) ==
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE) {
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+		rc = cam_sensor_update_req_mgr(s_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed in adding request to req_mgr");
+			goto end;
+		}
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) ==
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE) {
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) ==
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_BUBBLE_UPDATE) {
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+	}
+
+end:
+	cam_mem_put_cpu_buf(config.packet_handle);
+	return rc;
+}
+
+static int32_t cam_sensor_restore_slave_info(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+
+	switch (s_ctrl->io_master_info.master_type) {
+	case CCI_MASTER:
+		s_ctrl->io_master_info.cci_client->sid =
+			(s_ctrl->sensordata->slave_info.sensor_slave_addr >> 1);
+		s_ctrl->io_master_info.cci_client->i2c_freq_mode =
+			s_ctrl->sensordata->slave_info.i2c_freq_mode;
+		break;
+
+	case I2C_MASTER:
+		s_ctrl->io_master_info.client->addr =
+			 s_ctrl->sensordata->slave_info.sensor_slave_addr;
+		break;
+
+	case SPI_MASTER:
+		break;
+
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid master type: %d",
+				s_ctrl->io_master_info.master_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int32_t cam_sensor_update_i2c_info(struct cam_cmd_i2c_info *i2c_info,
+	struct cam_sensor_ctrl_t *s_ctrl,
+	bool isInit)
+{
+	int32_t rc = 0;
+	struct cam_sensor_cci_client   *cci_client = NULL;
+
+	switch (s_ctrl->io_master_info.master_type) {
+	case CCI_MASTER:
+		cci_client = s_ctrl->io_master_info.cci_client;
+		if (!cci_client) {
+			CAM_ERR(CAM_SENSOR, "failed: cci_client %pK",
+				cci_client);
+			return -EINVAL;
+		}
+		cci_client->cci_i2c_master = s_ctrl->cci_i2c_master;
+		cci_client->sid = i2c_info->slave_addr >> 1;
+		cci_client->retries = 3;
+		cci_client->id_map = 0;
+		cci_client->i2c_freq_mode = i2c_info->i2c_freq_mode;
+		CAM_DBG(CAM_SENSOR, " Master: %d sid: 0x%x freq_mode: %d",
+			cci_client->cci_i2c_master, i2c_info->slave_addr,
+			i2c_info->i2c_freq_mode);
+		break;
+
+	case I2C_MASTER:
+		s_ctrl->io_master_info.client->addr = i2c_info->slave_addr;
+		break;
+
+	case SPI_MASTER:
+		break;
+
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid master type: %d",
+			s_ctrl->io_master_info.master_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	if (isInit) {
+		s_ctrl->sensordata->slave_info.sensor_slave_addr =
+			i2c_info->slave_addr;
+		s_ctrl->sensordata->slave_info.i2c_freq_mode =
+			i2c_info->i2c_freq_mode;
+	}
+
+	return rc;
+}
+
+static int32_t cam_sensor_i2c_modes_util(
+	struct cam_sensor_ctrl_t *s_ctrl,
+	struct i2c_settings_list *i2c_list)
+{
+	int32_t rc = 0;
+	uint32_t i, size;
+	struct camera_io_master *io_master_info;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, "Invalid args");
+		return -EINVAL;
+	}
+
+	io_master_info = &s_ctrl->io_master_info;
+
+	if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_RANDOM) {
+		rc = camera_io_dev_write(io_master_info,
+			&(i2c_list->i2c_settings));
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to random write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_SEQ) {
+		rc = camera_io_dev_write_continuous(
+			io_master_info,
+			&(i2c_list->i2c_settings),
+			CAM_SENSOR_I2C_WRITE_SEQ);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to seq write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_BURST) {
+		rc = camera_io_dev_write_continuous(
+			io_master_info,
+			&(i2c_list->i2c_settings),
+			CAM_SENSOR_I2C_WRITE_BURST);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to burst write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_POLL) {
+		size = i2c_list->i2c_settings.size;
+		for (i = 0; i < size; i++) {
+			rc = camera_io_dev_poll(
+			io_master_info,
+			i2c_list->i2c_settings.reg_setting[i].reg_addr,
+			i2c_list->i2c_settings.reg_setting[i].reg_data,
+			i2c_list->i2c_settings.reg_setting[i].data_mask,
+			i2c_list->i2c_settings.addr_type,
+			i2c_list->i2c_settings.data_type,
+			i2c_list->i2c_settings.reg_setting[i].delay);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"i2c poll apply setting Fail: %d", rc);
+				return rc;
+			}
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_SET_I2C_INFO) {
+		rc = cam_sensor_update_i2c_info(&i2c_list->slave_info,
+			s_ctrl,
+			false);
+	} else if ((i2c_list->op_code == CAM_SENSOR_I2C_READ_RANDOM) ||
+		(i2c_list->op_code == CAM_SENSOR_I2C_READ_SEQ)) {
+		rc = cam_sensor_i2c_read_data(
+			&s_ctrl->i2c_data.read_settings,
+			&s_ctrl->io_master_info);
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_READ_APPEND_WRITE) {
+		CAM_DBG(CAM_SENSOR, "Captured READ_APPEND_WRITE OPCODE");
+		rc = camera_io_dev_read_append_write(io_master_info,
+			&(i2c_list->i2c_settings));
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"i2c Read_append_write settings Failed: %d", rc);
+			return rc;
+		}
+	} else if ((i2c_list->op_code == CAM_SENSOR_I2C_SEQUENTIAL_XFER_LOCK) ||
+			(i2c_list->op_code == CAM_SENSOR_I2C_SEQUENTIAL_XFER_UNLOCK)) {
+		rc = camera_io_dev_sequential_xfer(io_master_info,
+			&(i2c_list->seq_xfer));
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"i2c Sequential Xfer settings Failed: %d", rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+int32_t cam_sensor_update_slave_info(void *probe_info,
+	uint32_t cmd, struct cam_sensor_ctrl_t *s_ctrl, uint8_t probe_ver)
+{
+	int32_t rc = 0;
+	struct cam_cmd_probe *sensor_probe_info;
+	struct cam_cmd_probe_v2 *sensor_probe_info_v2;
+
+	memset(s_ctrl->sensor_name, 0, CAM_SENSOR_NAME_MAX_SIZE);
+
+	if (probe_ver == CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE) {
+		sensor_probe_info = (struct cam_cmd_probe *)probe_info;
+		s_ctrl->sensordata->slave_info.sensor_id_reg_addr =
+			sensor_probe_info->reg_addr;
+		s_ctrl->sensordata->slave_info.sensor_id =
+			sensor_probe_info->expected_data;
+		s_ctrl->sensordata->slave_info.sensor_id_mask =
+			sensor_probe_info->data_mask;
+		s_ctrl->pipeline_delay =
+			sensor_probe_info->reserved;
+		s_ctrl->modeswitch_delay = 0;
+
+		s_ctrl->sensor_probe_addr_type = sensor_probe_info->addr_type;
+		s_ctrl->sensor_probe_data_type = sensor_probe_info->data_type;
+	} else if (probe_ver == CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE_V2) {
+		sensor_probe_info_v2 = (struct cam_cmd_probe_v2 *)probe_info;
+		s_ctrl->sensordata->slave_info.sensor_id_reg_addr =
+			sensor_probe_info_v2->reg_addr;
+		s_ctrl->sensordata->slave_info.sensor_id =
+			sensor_probe_info_v2->expected_data;
+		s_ctrl->sensordata->slave_info.sensor_id_mask =
+			sensor_probe_info_v2->data_mask;
+		s_ctrl->pipeline_delay =
+			(sensor_probe_info_v2->pipeline_delay &
+			CAM_SENSOR_PIPELINE_DELAY_MASK);
+		s_ctrl->modeswitch_delay = (sensor_probe_info_v2->pipeline_delay >>
+			CAM_SENSOR_MODESWITCH_DELAY_SHIFT);
+		s_ctrl->sensor_probe_addr_type =
+			sensor_probe_info_v2->addr_type;
+		s_ctrl->sensor_probe_data_type =
+			sensor_probe_info_v2->data_type;
+
+		memcpy(s_ctrl->sensor_name, sensor_probe_info_v2->sensor_name,
+			CAM_SENSOR_NAME_MAX_SIZE-1);
+	}
+
+	CAM_DBG(CAM_SENSOR,
+		"%s Sensor Addr: 0x%x sensor_id: 0x%x sensor_mask: 0x%x sensor_pipeline_delay:0x%x",
+		s_ctrl->sensor_name,
+		s_ctrl->sensordata->slave_info.sensor_id_reg_addr,
+		s_ctrl->sensordata->slave_info.sensor_id,
+		s_ctrl->sensordata->slave_info.sensor_id_mask,
+		s_ctrl->pipeline_delay);
+	return rc;
+}
+
+int32_t cam_handle_cmd_buffers_for_probe(void *cmd_buf,
+	struct cam_sensor_ctrl_t *s_ctrl,
+	int32_t cmd_buf_num, uint32_t cmd,
+	uint32_t cmd_buf_length, size_t remain_len,
+	uint32_t probe_ver, struct cam_cmd_buf_desc *cmd_desc)
+{
+	int32_t rc = 0;
+	size_t required_size = 0;
+
+	switch (cmd_buf_num) {
+	case 0: {
+		struct cam_cmd_i2c_info *i2c_info = NULL;
+		void *probe_info;
+
+		if (probe_ver == CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE)
+			required_size = sizeof(struct cam_cmd_i2c_info) +
+				sizeof(struct cam_cmd_probe);
+		else if(probe_ver == CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE_V2)
+			required_size = sizeof(struct cam_cmd_i2c_info) +
+				sizeof(struct cam_cmd_probe_v2);
+
+		if (remain_len < required_size) {
+			CAM_ERR(CAM_SENSOR,
+				"not enough buffer for cam_cmd_i2c_info");
+			return -EINVAL;
+		}
+		i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+		rc = cam_sensor_update_i2c_info(i2c_info, s_ctrl, true);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "Failed in Updating the i2c Info");
+			return rc;
+		}
+		probe_info = cmd_buf + sizeof(struct cam_cmd_i2c_info);
+		rc = cam_sensor_update_slave_info(probe_info, cmd, s_ctrl,
+							probe_ver);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "Updating the slave Info");
+			return rc;
+		}
+	}
+		break;
+	case 1: {
+		rc = cam_sensor_update_power_settings(cmd_buf,
+			cmd_buf_length, &s_ctrl->sensordata->power_info,
+			remain_len);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed in updating power settings");
+			return rc;
+		}
+	}
+		break;
+
+	case 2: {
+		struct i2c_settings_array *i2c_reg_settings = NULL;
+		struct i2c_data_settings *i2c_data = NULL;
+		struct cam_buf_io_cfg *io_cfg = NULL;
+
+		CAM_DBG(CAM_SENSOR, "reg_bank unlock settings");
+		i2c_data = &(s_ctrl->i2c_data);
+		i2c_reg_settings = &i2c_data->reg_bank_unlock_settings;
+		i2c_reg_settings->request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&s_ctrl->io_master_info,
+				i2c_reg_settings, cmd_desc, 1, io_cfg);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed in updating reg_bank unlock settings");
+			return rc;
+		}
+	}
+		break;
+	case 3: {
+		struct i2c_settings_array *i2c_reg_settings = NULL;
+		struct i2c_data_settings *i2c_data = NULL;
+		struct cam_buf_io_cfg *io_cfg = NULL;
+
+		CAM_DBG(CAM_SENSOR, "reg_bank lock settings");
+		i2c_data = &(s_ctrl->i2c_data);
+		i2c_reg_settings = &i2c_data->reg_bank_lock_settings;
+		i2c_reg_settings->request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&s_ctrl->io_master_info,
+				i2c_reg_settings, cmd_desc, 1, io_cfg);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed in updating reg_bank lock settings");
+			return rc;
+		}
+	}
+		break;
+
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid command buffer");
+		break;
+	}
+	return rc;
+}
+
+int32_t cam_handle_mem_ptr(uint64_t handle, uint32_t cmd,
+	struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0, i;
+	uint32_t *cmd_buf;
+	void *ptr;
+	size_t len;
+	struct cam_packet *pkt = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	uintptr_t cmd_buf1 = 0;
+	uintptr_t packet = 0;
+	size_t    remain_len = 0;
+	uint32_t probe_ver = 0;
+
+	rc = cam_mem_get_cpu_buf(handle,
+		&packet, &len);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed to get the command Buffer");
+		return -EINVAL;
+	}
+
+	pkt = (struct cam_packet *)packet;
+	if (pkt == NULL) {
+		CAM_ERR(CAM_SENSOR, "packet pos is invalid");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((len < sizeof(struct cam_packet)) ||
+		(pkt->cmd_buf_offset >= (len - sizeof(struct cam_packet)))) {
+		CAM_ERR(CAM_SENSOR, "Not enough buf provided");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *)&pkt->payload_flex + pkt->cmd_buf_offset/4);
+	if (cmd_desc == NULL) {
+		CAM_ERR(CAM_SENSOR, "command descriptor pos is invalid");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	probe_ver = pkt->header.op_code & 0xFFFFFF;
+	CAM_DBG(CAM_SENSOR, "Received Header opcode: %u", probe_ver);
+
+	for (i = 0; i < pkt->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!(cmd_desc[i].length))
+			continue;
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&cmd_buf1, &len);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to parse the command Buffer Header");
+			goto end;
+		}
+		if (cmd_desc[i].offset >= len) {
+			CAM_ERR(CAM_SENSOR,
+				"offset past length of buffer");
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+			rc = -EINVAL;
+			goto end;
+		}
+		remain_len = len - cmd_desc[i].offset;
+		if (cmd_desc[i].length > remain_len) {
+			CAM_ERR(CAM_SENSOR,
+				"Not enough buffer provided for cmd");
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+			rc = -EINVAL;
+			goto end;
+		}
+		cmd_buf = (uint32_t *)cmd_buf1;
+		cmd_buf += cmd_desc[i].offset/4;
+		ptr = (void *) cmd_buf;
+
+		rc = cam_handle_cmd_buffers_for_probe(ptr, s_ctrl,
+			i, cmd, cmd_desc[i].length, remain_len, probe_ver, &cmd_desc[i]);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to parse the command Buffer Header");
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+			goto end;
+		}
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+
+end:
+	cam_mem_put_cpu_buf(handle);
+	return rc;
+}
+
+void cam_sensor_query_cap(struct cam_sensor_ctrl_t *s_ctrl,
+	struct  cam_sensor_query_cap *query_cap)
+{
+	query_cap->pos_roll = s_ctrl->sensordata->pos_roll;
+	query_cap->pos_pitch = s_ctrl->sensordata->pos_pitch;
+	query_cap->pos_yaw = s_ctrl->sensordata->pos_yaw;
+	query_cap->secure_camera = 0;
+	query_cap->actuator_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_ACTUATOR];
+	query_cap->csiphy_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY];
+	query_cap->eeprom_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_EEPROM];
+	query_cap->flash_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_LED_FLASH];
+	query_cap->ois_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_OIS];
+	query_cap->slot_info =
+		s_ctrl->soc_info.index;
+}
+
+static uint16_t cam_sensor_id_by_mask(struct cam_sensor_ctrl_t *s_ctrl,
+	uint32_t chipid)
+{
+	uint16_t sensor_id = (uint16_t)(chipid & 0xFFFF);
+	int16_t sensor_id_mask = s_ctrl->sensordata->slave_info.sensor_id_mask;
+
+	if (!sensor_id_mask)
+		sensor_id_mask = ~sensor_id_mask;
+
+	sensor_id &= sensor_id_mask;
+	sensor_id_mask &= -sensor_id_mask;
+	sensor_id_mask -= 1;
+	while (sensor_id_mask) {
+		sensor_id_mask >>= 1;
+		sensor_id >>= 1;
+	}
+	return sensor_id;
+}
+
+void cam_sensor_shutdown(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct cam_sensor_power_ctrl_t *power_info =
+		&s_ctrl->sensordata->power_info;
+	int rc = 0;
+
+	if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) &&
+		(s_ctrl->is_probe_succeed == 0))
+		return;
+
+	cam_sensor_release_stream_rsc(s_ctrl);
+	cam_sensor_release_per_frame_resource(s_ctrl);
+
+	if (s_ctrl->sensor_state != CAM_SENSOR_INIT)
+		cam_sensor_power_down(s_ctrl);
+
+	if (s_ctrl->bridge_intf.device_hdl != -1) {
+		rc = cam_destroy_device_hdl(s_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"dhdl already destroyed: rc = %d", rc);
+	}
+
+	s_ctrl->bridge_intf.device_hdl = -1;
+	s_ctrl->bridge_intf.link_hdl = -1;
+	s_ctrl->bridge_intf.session_hdl = -1;
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_setting_size = 0;
+	power_info->power_down_setting_size = 0;
+	s_ctrl->streamon_count = 0;
+	s_ctrl->streamoff_count = 0;
+	s_ctrl->is_probe_succeed = 0;
+	s_ctrl->last_flush_req = 0;
+	s_ctrl->sensor_state = CAM_SENSOR_INIT;
+}
+
+int cam_sensor_match_id(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0;
+	uint32_t chipid = 0;
+	struct cam_camera_slave_info *slave_info;
+
+	slave_info = &(s_ctrl->sensordata->slave_info);
+
+	if (!slave_info) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK",
+			 slave_info);
+		return -EINVAL;
+	}
+
+	if (s_ctrl->hw_no_ops)
+		return rc;
+
+	rc = camera_io_dev_read(
+		&(s_ctrl->io_master_info),
+		slave_info->sensor_id_reg_addr,
+		&chipid, s_ctrl->sensor_probe_addr_type,
+		s_ctrl->sensor_probe_data_type, true);
+
+	CAM_DBG(CAM_SENSOR, "%s read id: 0x%x expected id 0x%x:",
+		s_ctrl->sensor_name, chipid, slave_info->sensor_id);
+
+	if (cam_sensor_id_by_mask(s_ctrl, chipid) != slave_info->sensor_id) {
+		CAM_WARN(CAM_SENSOR, "%s read id: 0x%x expected id 0x%x:",
+				s_ctrl->sensor_name, chipid,
+				slave_info->sensor_id);
+		return -ENODEV;
+	}
+	return rc;
+}
+
+int cam_sensor_stream_off(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int               rc = 0;
+	struct timespec64 ts;
+	uint64_t          ms, sec, min, hrs;
+
+	if (s_ctrl->sensor_state != CAM_SENSOR_START) {
+		rc = -EINVAL;
+		CAM_WARN(CAM_SENSOR,
+			"Not in right state to stop %s state: %d",
+			s_ctrl->sensor_name, s_ctrl->sensor_state);
+		goto end;
+	}
+
+	if (s_ctrl->i2c_data.streamoff_settings.is_settings_valid &&
+		(s_ctrl->i2c_data.streamoff_settings.request_id == 0)) {
+		rc = cam_sensor_apply_settings(s_ctrl, 0,
+			CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"cannot apply streamoff settings for %s",
+				s_ctrl->sensor_name);
+	}
+
+	cam_sensor_release_per_frame_resource(s_ctrl);
+	s_ctrl->last_flush_req = 0;
+	s_ctrl->sensor_state = CAM_SENSOR_ACQUIRE;
+	memset(s_ctrl->sensor_res, 0, sizeof(s_ctrl->sensor_res));
+
+	CAM_GET_TIMESTAMP(ts);
+	CAM_CONVERT_TIMESTAMP_FORMAT(ts, hrs, min, sec, ms);
+
+	CAM_INFO(CAM_SENSOR,
+		"%llu:%llu:%llu.%llu CAM_STOP_DEV Success for %s sensor_id:0x%x,sensor_slave_addr:0x%x",
+		hrs, min, sec, ms,
+		s_ctrl->sensor_name,
+		s_ctrl->sensordata->slave_info.sensor_id,
+		s_ctrl->sensordata->slave_info.sensor_slave_addr);
+
+end:
+	return rc;
+}
+
+int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl,
+	void *arg)
+{
+	int rc = 0, pkt_opcode = 0;
+	struct cam_control *cmd = (struct cam_control *)arg;
+	struct cam_sensor_power_ctrl_t *power_info = NULL;
+	struct timespec64 ts;
+	uint64_t ms, sec, min, hrs;
+
+	if (!s_ctrl || !arg) {
+		CAM_ERR(CAM_SENSOR, "s_ctrl is NULL");
+		return -EINVAL;
+	}
+
+	power_info = &s_ctrl->sensordata->power_info;
+
+	if (cmd->op_code != CAM_SENSOR_PROBE_CMD) {
+		if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+			CAM_ERR(CAM_SENSOR, "Invalid handle type: %d",
+				cmd->handle_type);
+			return -EINVAL;
+		}
+	}
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	switch (cmd->op_code) {
+	case CAM_SENSOR_PROBE_CMD: {
+		if (s_ctrl->is_probe_succeed == 1) {
+			CAM_WARN(CAM_SENSOR,
+				"Sensor %s already Probed in the slot",
+				s_ctrl->sensor_name);
+			break;
+		}
+
+		if (cmd->handle_type ==
+			CAM_HANDLE_MEM_HANDLE) {
+			rc = cam_handle_mem_ptr(cmd->handle, cmd->op_code,
+				s_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "Get Buffer Handle Failed");
+				goto release_mutex;
+			}
+		} else {
+			CAM_ERR(CAM_SENSOR, "Invalid Command Type: %d",
+				cmd->handle_type);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		/* Parse and fill vreg params for powerup settings */
+		rc = msm_camera_fill_vreg_params(
+			&s_ctrl->soc_info,
+			s_ctrl->sensordata->power_info.power_setting,
+			s_ctrl->sensordata->power_info.power_setting_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Fail in filling vreg params for %s PUP rc %d",
+				s_ctrl->sensor_name, rc);
+			goto free_power_settings;
+		}
+
+		/* Parse and fill vreg params for powerdown settings*/
+		rc = msm_camera_fill_vreg_params(
+			&s_ctrl->soc_info,
+			s_ctrl->sensordata->power_info.power_down_setting,
+			s_ctrl->sensordata->power_info.power_down_setting_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Fail in filling vreg params for %s PDOWN rc %d",
+				s_ctrl->sensor_name, rc);
+			goto free_power_settings;
+		}
+
+		/* Power up and probe sensor */
+		rc = cam_sensor_power_up(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Power up failed for %s sensor_id: 0x%x, slave_addr: 0x%x",
+				s_ctrl->sensor_name,
+				s_ctrl->sensordata->slave_info.sensor_id,
+				s_ctrl->sensordata->slave_info.sensor_slave_addr
+				);
+			goto free_power_settings;
+		}
+
+		if (s_ctrl->i2c_data.reg_bank_unlock_settings.is_settings_valid) {
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_REG_BANK_UNLOCK);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "REG_bank unlock failed");
+				cam_sensor_power_down(s_ctrl);
+				goto free_power_settings;
+			}
+			rc = delete_request(&(s_ctrl->i2c_data.reg_bank_unlock_settings));
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"failed while deleting REG_bank unlock settings");
+				cam_sensor_power_down(s_ctrl);
+				goto free_power_settings;
+			}
+		}
+
+		/* Match sensor ID */
+		rc = cam_sensor_match_id(s_ctrl);
+		if (rc < 0) {
+			CAM_INFO(CAM_SENSOR,
+				"Probe failed for %s slot:%d, slave_addr:0x%x, sensor_id:0x%x",
+				s_ctrl->sensor_name,
+				s_ctrl->soc_info.index,
+				s_ctrl->sensordata->slave_info.sensor_slave_addr,
+				s_ctrl->sensordata->slave_info.sensor_id);
+			cam_sensor_power_down(s_ctrl);
+			goto free_power_settings;
+		}
+
+		if (s_ctrl->i2c_data.reg_bank_lock_settings.is_settings_valid) {
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_REG_BANK_LOCK);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "REG_bank lock failed");
+				cam_sensor_power_down(s_ctrl);
+				goto free_power_settings;
+			}
+			rc = delete_request(&(s_ctrl->i2c_data.reg_bank_lock_settings));
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"failed while deleting REG_bank lock settings");
+				cam_sensor_power_down(s_ctrl);
+				goto free_power_settings;
+			}
+		}
+
+		rc = cam_sensor_power_down(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "Fail in %s sensor Power Down",
+				s_ctrl->sensor_name);
+			goto free_power_settings;
+		}
+
+		/*
+		 * Set probe succeeded flag to 1 so that no other camera shall
+		 * probed on this slot
+		 */
+		s_ctrl->is_probe_succeed = 1;
+		s_ctrl->sensor_state = CAM_SENSOR_INIT;
+
+		CAM_INFO(CAM_SENSOR,
+				"Probe success for %s slot:%d,slave_addr:0x%x,sensor_id:0x%x",
+				s_ctrl->sensor_name,
+				s_ctrl->soc_info.index,
+				s_ctrl->sensordata->slave_info.sensor_slave_addr,
+				s_ctrl->sensordata->slave_info.sensor_id);
+
+	}
+		break;
+	case CAM_ACQUIRE_DEV: {
+		struct cam_sensor_acquire_dev sensor_acq_dev;
+		struct cam_create_dev_hdl bridge_params;
+
+		if ((s_ctrl->is_probe_succeed == 0) ||
+			(s_ctrl->sensor_state != CAM_SENSOR_INIT)) {
+			CAM_WARN(CAM_SENSOR,
+				"Not in right state to aquire %s state: %d",
+				s_ctrl->sensor_name, s_ctrl->sensor_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (s_ctrl->bridge_intf.device_hdl != -1) {
+			CAM_ERR(CAM_SENSOR,
+				"%s Device is already acquired",
+				s_ctrl->sensor_name);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = copy_from_user(&sensor_acq_dev,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(sensor_acq_dev));
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "Failed Copying from user");
+			goto release_mutex;
+		}
+
+		bridge_params.session_hdl = sensor_acq_dev.session_handle;
+		bridge_params.ops = &s_ctrl->bridge_intf.ops;
+		bridge_params.v4l2_sub_dev_flag = 0;
+		bridge_params.media_entity_flag = 0;
+		bridge_params.priv = s_ctrl;
+		bridge_params.dev_id = CAM_SENSOR;
+
+		sensor_acq_dev.device_handle =
+			cam_create_device_hdl(&bridge_params);
+		if (sensor_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_SENSOR, "Can not create device handle");
+			goto release_mutex;
+		}
+		s_ctrl->bridge_intf.device_hdl = sensor_acq_dev.device_handle;
+		s_ctrl->bridge_intf.session_hdl = sensor_acq_dev.session_handle;
+
+		CAM_DBG(CAM_SENSOR, "%s Device Handle: %d",
+			s_ctrl->sensor_name, sensor_acq_dev.device_handle);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&sensor_acq_dev,
+			sizeof(struct cam_sensor_acquire_dev))) {
+			CAM_ERR(CAM_SENSOR, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+
+		rc = cam_sensor_power_up(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Sensor Power up failed for %s sensor_id:0x%x, slave_addr:0x%x",
+				s_ctrl->sensor_name,
+				s_ctrl->sensordata->slave_info.sensor_id,
+				s_ctrl->sensordata->slave_info.sensor_slave_addr
+				);
+			goto release_mutex;
+		}
+
+		s_ctrl->sensor_state = CAM_SENSOR_ACQUIRE;
+		s_ctrl->last_flush_req = 0;
+		s_ctrl->is_stopped_by_user = false;
+		s_ctrl->last_updated_req = 0;
+		s_ctrl->last_applied_req = 0;
+		s_ctrl->num_batched_frames = 0;
+		memset(s_ctrl->sensor_res, 0, sizeof(s_ctrl->sensor_res));
+		CAM_INFO(CAM_SENSOR,
+			"CAM_ACQUIRE_DEV Success for %s sensor_id:0x%x,sensor_slave_addr:0x%x",
+			s_ctrl->sensor_name,
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr);
+	}
+		break;
+	case CAM_RELEASE_DEV: {
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_START)) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_SENSOR,
+				"Not in right state to release %s state: %d",
+				s_ctrl->sensor_name, s_ctrl->sensor_state);
+			goto release_mutex;
+		}
+
+		if (s_ctrl->bridge_intf.link_hdl != -1) {
+			CAM_ERR(CAM_SENSOR,
+				"%s Device [%d] still active on link 0x%x",
+				s_ctrl->sensor_name,
+				s_ctrl->sensor_state,
+				s_ctrl->bridge_intf.link_hdl);
+			rc = -EAGAIN;
+			goto release_mutex;
+		}
+
+		rc = cam_sensor_power_down(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Sensor Power Down failed for %s sensor_id: 0x%x, slave_addr:0x%x",
+				s_ctrl->sensor_name,
+				s_ctrl->sensordata->slave_info.sensor_id,
+				s_ctrl->sensordata->slave_info.sensor_slave_addr
+				);
+			goto release_mutex;
+		}
+
+		cam_sensor_release_per_frame_resource(s_ctrl);
+		cam_sensor_release_stream_rsc(s_ctrl);
+		if (s_ctrl->bridge_intf.device_hdl == -1) {
+			CAM_ERR(CAM_SENSOR,
+				"Invalid Handles: %s link hdl: %d device hdl: %d",
+				s_ctrl->sensor_name,
+				s_ctrl->bridge_intf.device_hdl,
+				s_ctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = cam_destroy_device_hdl(s_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"Failed in destroying %s device hdl",
+				s_ctrl->sensor_name);
+		s_ctrl->bridge_intf.device_hdl = -1;
+		s_ctrl->bridge_intf.link_hdl = -1;
+		s_ctrl->bridge_intf.session_hdl = -1;
+
+		s_ctrl->sensor_state = CAM_SENSOR_INIT;
+		CAM_INFO(CAM_SENSOR,
+			"CAM_RELEASE_DEV Success for %s sensor_id:0x%x, slave_addr:0x%x",
+			s_ctrl->sensor_name,
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr);
+		s_ctrl->streamon_count = 0;
+		s_ctrl->streamoff_count = 0;
+		s_ctrl->last_flush_req = 0;
+	}
+		break;
+	case CAM_QUERY_CAP: {
+		struct  cam_sensor_query_cap sensor_cap;
+
+		CAM_DBG(CAM_SENSOR, "%s Sensor Queried", s_ctrl->sensor_name);
+		cam_sensor_query_cap(s_ctrl, &sensor_cap);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&sensor_cap, sizeof(struct  cam_sensor_query_cap))) {
+			CAM_ERR(CAM_SENSOR, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		break;
+	}
+	case CAM_START_DEV: {
+		struct cam_req_mgr_timer_notify timer;
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_START)) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_SENSOR,
+			"Not in right state to start %s state: %d",
+			s_ctrl->sensor_name,
+			s_ctrl->sensor_state);
+			goto release_mutex;
+		}
+
+		if (s_ctrl->i2c_data.streamon_settings.is_settings_valid &&
+			(s_ctrl->i2c_data.streamon_settings.request_id == 0)) {
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMON);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"cannot apply streamon settings for %s",
+					s_ctrl->sensor_name);
+				goto release_mutex;
+			}
+		}
+		s_ctrl->sensor_state = CAM_SENSOR_START;
+
+		if (s_ctrl->stream_off_after_eof)
+			s_ctrl->is_stopped_by_user = false;
+
+		if (s_ctrl->bridge_intf.crm_cb &&
+			s_ctrl->bridge_intf.crm_cb->notify_timer) {
+			timer.link_hdl = s_ctrl->bridge_intf.link_hdl;
+			timer.dev_hdl = s_ctrl->bridge_intf.device_hdl;
+			timer.state = true;
+			rc = s_ctrl->bridge_intf.crm_cb->notify_timer(&timer);
+			if (rc) {
+				CAM_ERR(CAM_SENSOR,
+					"%s Enable CRM SOF freeze timer failed rc: %d",
+					s_ctrl->sensor_name, rc);
+				return rc;
+			}
+		}
+
+		CAM_GET_TIMESTAMP(ts);
+		CAM_CONVERT_TIMESTAMP_FORMAT(ts, hrs, min, sec, ms);
+
+		CAM_INFO(CAM_SENSOR,
+			"%llu:%llu:%llu.%llu CAM_START_DEV Success for %s sensor_id:0x%x,sensor_slave_addr:0x%x num_batched_frames:%d",
+			hrs, min, sec, ms,
+			s_ctrl->sensor_name,
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr,
+			s_ctrl->num_batched_frames);
+	}
+		break;
+	case CAM_STOP_DEV: {
+		if (s_ctrl->stream_off_after_eof) {
+			s_ctrl->is_stopped_by_user = true;
+			CAM_DBG(CAM_SENSOR, "Ignore stop dev cmd for VFPS feature");
+			goto release_mutex;
+		}
+
+		rc = cam_sensor_stream_off(s_ctrl);
+		if (rc)
+			goto release_mutex;
+	}
+		break;
+	case CAM_CONFIG_DEV: {
+		rc = cam_sensor_pkt_parse(s_ctrl, arg);
+		if (rc < 0) {
+			if (rc == -EBADR)
+				CAM_INFO(CAM_SENSOR,
+					"%s:Failed pkt parse. rc: %d, it has been flushed",
+					s_ctrl->sensor_name, rc);
+			else
+				CAM_ERR(CAM_SENSOR,
+					"%s:Failed pkt parse. rc: %d",
+					s_ctrl->sensor_name, rc);
+			goto release_mutex;
+		}
+		if (s_ctrl->i2c_data.init_settings.is_settings_valid &&
+			(s_ctrl->i2c_data.init_settings.request_id == 0)) {
+			pkt_opcode =
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG;
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				pkt_opcode);
+
+			if ((rc == -EAGAIN) &&
+			(s_ctrl->io_master_info.master_type == CCI_MASTER)) {
+				/* If CCI hardware is resetting we need to wait
+				 * for sometime before reapply
+				 */
+				CAM_WARN(CAM_SENSOR,
+					"%s: Reapplying the Init settings due to cci hw reset",
+					s_ctrl->sensor_name);
+				usleep_range(1000, 1010);
+				rc = cam_sensor_apply_settings(s_ctrl, 0,
+					pkt_opcode);
+			}
+			s_ctrl->i2c_data.init_settings.request_id = -1;
+
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"%s: cannot apply init settings rc= %d",
+					s_ctrl->sensor_name, rc);
+				delete_request(&s_ctrl->i2c_data.init_settings);
+				goto release_mutex;
+			}
+			rc = delete_request(&s_ctrl->i2c_data.init_settings);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"%s: Fail in deleting the Init settings",
+					s_ctrl->sensor_name);
+				goto release_mutex;
+			}
+		}
+
+		if (s_ctrl->i2c_data.config_settings.is_settings_valid &&
+			(s_ctrl->i2c_data.config_settings.request_id == 0)) {
+			if (s_ctrl->sensor_state == CAM_SENSOR_START) {
+				delete_request(&s_ctrl->i2c_data.config_settings);
+				CAM_ERR(CAM_SENSOR,
+					"%s: get config setting in start state",
+					s_ctrl->sensor_name);
+					goto release_mutex;
+			}
+
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_CONFIG);
+
+			s_ctrl->i2c_data.config_settings.request_id = -1;
+
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"%s: cannot apply config settings",
+					s_ctrl->sensor_name);
+				delete_request(
+					&s_ctrl->i2c_data.config_settings);
+				goto release_mutex;
+			}
+			rc = delete_request(&s_ctrl->i2c_data.config_settings);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"%s: Fail in deleting the config settings",
+					s_ctrl->sensor_name);
+				goto release_mutex;
+			}
+			s_ctrl->sensor_state = CAM_SENSOR_CONFIG;
+		}
+
+		if (s_ctrl->i2c_data.read_settings.is_settings_valid) {
+			if (!s_ctrl->hw_no_ops)
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_READ);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"cannot apply read settings");
+				delete_request(
+					&s_ctrl->i2c_data.read_settings);
+				goto release_mutex;
+			}
+			rc = delete_request(
+				&s_ctrl->i2c_data.read_settings);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"%s: Fail in deleting the read settings",
+					s_ctrl->sensor_name);
+				goto release_mutex;
+			}
+		}
+
+		CAM_DBG(CAM_SENSOR,
+			"CAM_CONFIG_DEV done sensor_id:0x%x,sensor_slave_addr:0x%x",
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr);
+	}
+		break;
+	default:
+		CAM_ERR(CAM_SENSOR, "%s: Invalid Opcode: %d",
+			s_ctrl->sensor_name, cmd->op_code);
+		rc = -EINVAL;
+		goto release_mutex;
+	}
+
+release_mutex:
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+
+free_power_settings:
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_down_setting_size = 0;
+	power_info->power_setting_size = 0;
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+}
+
+int cam_sensor_publish_dev_info(struct cam_req_mgr_device_info *info)
+{
+	int rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+
+	if (!info)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(info->dev_hdl);
+
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	info->dev_id = CAM_REQ_MGR_DEVICE_SENSOR;
+	strscpy(info->name, CAM_SENSOR_NAME, sizeof(info->name));
+	if (s_ctrl->num_batched_frames >= 2) {
+		info->p_delay = 1;
+		info->m_delay = s_ctrl->modeswitch_delay;
+	} else if (s_ctrl->pipeline_delay >= 1 && s_ctrl->pipeline_delay <= 3) {
+		info->p_delay = s_ctrl->pipeline_delay;
+		info->m_delay = s_ctrl->modeswitch_delay;
+	} else {
+		info->p_delay = CAM_PIPELINE_DELAY_2;
+		info->m_delay = CAM_MODESWITCH_DELAY_2;
+	}
+	info->trigger = CAM_TRIGGER_POINT_SOF;
+
+	CAM_DBG(CAM_REQ, "num batched frames %d p_delay is %d",
+		s_ctrl->num_batched_frames, info->p_delay);
+
+	return rc;
+}
+
+int cam_sensor_establish_link(struct cam_req_mgr_core_dev_link_setup *link)
+{
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+
+	if (!link)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(link->dev_hdl);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&s_ctrl->cam_sensor_mutex);
+	if (link->link_enable) {
+		s_ctrl->bridge_intf.link_hdl = link->link_hdl;
+		s_ctrl->bridge_intf.crm_cb = link->crm_cb;
+	} else {
+		s_ctrl->bridge_intf.link_hdl = -1;
+		s_ctrl->bridge_intf.crm_cb = NULL;
+	}
+	mutex_unlock(&s_ctrl->cam_sensor_mutex);
+
+	return 0;
+}
+
+int cam_sensor_power(struct v4l2_subdev *sd, int on)
+{
+	struct cam_sensor_ctrl_t *s_ctrl = v4l2_get_subdevdata(sd);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "s_ctrl ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	if (!on && s_ctrl->sensor_state == CAM_SENSOR_START) {
+		cam_sensor_power_down(s_ctrl);
+		s_ctrl->sensor_state = CAM_SENSOR_ACQUIRE;
+	}
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+
+	return 0;
+}
+
+int cam_sensor_power_up(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0;
+	struct cam_sensor_power_ctrl_t *power_info;
+	struct cam_camera_slave_info   *slave_info;
+	struct cam_hw_soc_info         *soc_info = &s_ctrl->soc_info;
+	struct completion              *i3c_probe_completion = NULL;
+
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	if (s_ctrl->hw_no_ops)
+		return rc;
+
+	power_info = &s_ctrl->sensordata->power_info;
+	slave_info = &(s_ctrl->sensordata->slave_info);
+
+	if (!power_info || !slave_info) {
+		CAM_ERR(CAM_SENSOR, "failed: %pK %pK", power_info, slave_info);
+		return -EINVAL;
+	}
+
+	soc_info = &s_ctrl->soc_info;
+
+	if (s_ctrl->bob_pwm_switch) {
+		if (cam_sensor_bob_pwm_mode_switch(soc_info,
+			s_ctrl->bob_reg_index, true))
+			CAM_WARN(CAM_SENSOR, "BoB PWM setup failed");
+	}
+
+	if (s_ctrl->aon_camera_id != NOT_AON_CAM) {
+		CAM_INFO(CAM_SENSOR,
+			"Setup for Main Camera with csiphy index: %d",
+			s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY]);
+		rc = cam_sensor_util_aon_ops(true,
+			s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY]);
+		if (rc) {
+			CAM_ERR(CAM_SENSOR,
+				"Main camera access operation is not successful rc: %d",
+				rc);
+			return rc;
+		}
+	}
+
+	if (s_ctrl->io_master_info.master_type == I3C_MASTER)
+		i3c_probe_completion = cam_sensor_get_i3c_completion(s_ctrl->soc_info.index);
+
+	rc = cam_sensor_core_power_up(power_info, soc_info, i3c_probe_completion);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "core power up failed:%d", rc);
+		return rc;
+	}
+
+	rc = camera_io_init(&(s_ctrl->io_master_info));
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "cci_init failed: rc: %d", rc);
+		goto cci_failure;
+	}
+
+	return rc;
+
+cci_failure:
+	if (cam_sensor_util_power_down(power_info, soc_info))
+		CAM_ERR(CAM_SENSOR, "power down failure");
+
+	return rc;
+
+}
+
+int cam_sensor_power_down(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct cam_sensor_power_ctrl_t *power_info;
+	struct cam_hw_soc_info *soc_info;
+	int rc = 0;
+
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "failed: s_ctrl %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	if (s_ctrl->hw_no_ops)
+		return rc;
+
+	power_info = &s_ctrl->sensordata->power_info;
+	soc_info = &s_ctrl->soc_info;
+
+	if (!power_info) {
+		CAM_ERR(CAM_SENSOR, "failed: %s power_info %pK",
+			s_ctrl->sensor_name, power_info);
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_power_down(power_info, soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "%s core power down failed:%d",
+			s_ctrl->sensor_name, rc);
+		return rc;
+	}
+
+	if (s_ctrl->aon_camera_id != NOT_AON_CAM) {
+		CAM_INFO(CAM_SENSOR,
+			"Setup for AON FW with csiphy index: %d",
+			s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY]);
+		rc = cam_sensor_util_aon_ops(false,
+			s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY]);
+		if (rc) {
+			CAM_ERR(CAM_SENSOR,
+				"AON FW access operation is not successful rc: %d",
+				rc);
+			return rc;
+		}
+	}
+
+	soc_info = &s_ctrl->soc_info;
+
+	if (s_ctrl->bob_pwm_switch) {
+		rc = cam_sensor_bob_pwm_mode_switch(soc_info,
+			s_ctrl->bob_reg_index, false);
+		if (rc) {
+			CAM_WARN(CAM_SENSOR,
+				"%s BoB PWM setup failed rc: %d",
+				s_ctrl->sensor_name, rc);
+			rc = 0;
+		}
+	}
+
+	camera_io_release(&(s_ctrl->io_master_info));
+
+	return rc;
+}
+
+int cam_sensor_apply_settings(struct cam_sensor_ctrl_t *s_ctrl,
+	int64_t req_id, enum cam_sensor_packet_opcodes opcode)
+{
+	int rc = 0, offset, i;
+	uint64_t top = 0, del_req_id = 0;
+	struct i2c_settings_array *i2c_set = NULL;
+	struct i2c_settings_list *i2c_list;
+
+	if (req_id == 0) {
+		switch (opcode) {
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMON: {
+			i2c_set = &s_ctrl->i2c_data.streamon_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG: {
+			i2c_set = &s_ctrl->i2c_data.init_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_CONFIG: {
+			i2c_set = &s_ctrl->i2c_data.config_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF: {
+			i2c_set = &s_ctrl->i2c_data.streamoff_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_REG_BANK_UNLOCK: {
+			i2c_set = &s_ctrl->i2c_data.reg_bank_unlock_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_REG_BANK_LOCK: {
+			i2c_set = &s_ctrl->i2c_data.reg_bank_lock_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_READ: {
+			i2c_set = &s_ctrl->i2c_data.read_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE:
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE:
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE:
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE_V2:
+		default:
+			return 0;
+		}
+		if (i2c_set->is_settings_valid == 1) {
+			list_for_each_entry(i2c_list,
+				&(i2c_set->list_head), list) {
+				if (!s_ctrl->hw_no_ops)
+					rc = cam_sensor_i2c_modes_util(s_ctrl,
+						i2c_list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+						"Failed to apply settings: %d",
+						rc);
+					goto EXIT_RESTORE;
+				}
+			}
+		}
+	} else if (req_id > 0) {
+		offset = req_id % MAX_PER_FRAME_ARRAY;
+
+		if (opcode == CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE)
+			i2c_set = s_ctrl->i2c_data.frame_skip;
+		else if (opcode == CAM_SENSOR_PACKET_OPCODE_SENSOR_BUBBLE_UPDATE) {
+			i2c_set = s_ctrl->i2c_data.bubble_update;
+			/*
+			 * If bubble update isn't valid, then we just use
+			 * per frame update.
+			 */
+			if (!(i2c_set[offset].is_settings_valid == 1) &&
+				(i2c_set[offset].request_id == req_id))
+				i2c_set = s_ctrl->i2c_data.per_frame;
+		} else
+			i2c_set = s_ctrl->i2c_data.per_frame;
+
+		if (i2c_set[offset].is_settings_valid == 1 &&
+			i2c_set[offset].request_id == req_id) {
+			list_for_each_entry(i2c_list,
+				&(i2c_set[offset].list_head), list) {
+				if (!s_ctrl->hw_no_ops)
+					rc = cam_sensor_i2c_modes_util(s_ctrl,
+						i2c_list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+						"Failed to apply settings: %d",
+						rc);
+					goto EXIT_RESTORE;
+				}
+			}
+			CAM_DBG(CAM_SENSOR, "applied req_id: %llu", req_id);
+		} else {
+			CAM_DBG(CAM_SENSOR,
+				"Invalid/NOP request to apply: %lld", req_id);
+		}
+
+		s_ctrl->last_applied_req = req_id;
+		CAM_DBG(CAM_REQ,
+			"Sensor[%d] updating last_applied [req id: %lld last_applied: %lld] with opcode:%d",
+			s_ctrl->soc_info.index, req_id, s_ctrl->last_applied_req, opcode);
+
+		/* Change the logic dynamically */
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			if ((req_id >=
+				i2c_set[i].request_id) &&
+				(top <
+				i2c_set[i].request_id) &&
+				(i2c_set[i].is_settings_valid
+					== 1)) {
+				del_req_id = top;
+				top = i2c_set[i].request_id;
+			}
+		}
+
+		if (top < req_id) {
+			if ((((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) >= BATCH_SIZE_MAX) ||
+				(((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) <= -BATCH_SIZE_MAX))
+				del_req_id = req_id;
+		}
+
+		if (!del_req_id)
+			goto EXIT_RESTORE;
+
+		CAM_DBG(CAM_SENSOR, "top: %llu, del_req_id:%llu",
+			top, del_req_id);
+
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			if ((del_req_id >
+				 i2c_set[i].request_id) && (
+				 i2c_set[i].is_settings_valid
+					== 1)) {
+				i2c_set[i].request_id = 0;
+				rc = delete_request(
+					&(i2c_set[i]));
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"Delete request Fail:%lld rc:%d",
+						del_req_id, rc);
+			}
+		}
+
+		/*
+		 * If the op code is bubble update, then we also need to delete
+		 * req for per frame update, vice versa.
+		 */
+		if (opcode == CAM_SENSOR_PACKET_OPCODE_SENSOR_BUBBLE_UPDATE)
+			i2c_set = s_ctrl->i2c_data.per_frame;
+		else if (opcode == CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE)
+			i2c_set = s_ctrl->i2c_data.bubble_update;
+		else
+			i2c_set = NULL;
+
+		if (i2c_set) {
+			for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+				if ((del_req_id >
+					 i2c_set[i].request_id) && (
+					 i2c_set[i].is_settings_valid
+						== 1)) {
+					i2c_set[i].request_id = 0;
+					rc = delete_request(
+						&(i2c_set[i]));
+					if (rc < 0)
+						CAM_ERR(CAM_SENSOR,
+							"Delete request Fail:%lld rc:%d",
+							del_req_id, rc);
+				}
+			}
+		}
+	}
+
+EXIT_RESTORE:
+	(void)cam_sensor_restore_slave_info(s_ctrl);
+
+	return rc;
+}
+
+int32_t cam_sensor_apply_request(struct cam_req_mgr_apply_request *apply)
+{
+	int32_t rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	int32_t curr_idx, last_applied_idx;
+	enum cam_sensor_packet_opcodes opcode =
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE;
+
+	if (!apply)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(apply->dev_hdl);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	if ((apply->recovery) && (apply->request_id > 0)) {
+		if (apply->request_id <= s_ctrl->last_applied_req) {
+			/*
+			 * Use bubble update for request reapply
+			 */
+			curr_idx = apply->request_id % MAX_PER_FRAME_ARRAY;
+			last_applied_idx = s_ctrl->last_applied_req % MAX_PER_FRAME_ARRAY;
+			opcode = CAM_SENSOR_PACKET_OPCODE_SENSOR_BUBBLE_UPDATE;
+			CAM_INFO(CAM_REQ,
+				"Sensor[%d] update req id: %lld [last_applied: %lld] with opcode:%d recovery: %d last_applied_res_idx: %u current_res_idx: %u",
+				s_ctrl->soc_info.index, apply->request_id,
+				s_ctrl->last_applied_req, opcode, apply->recovery,
+				s_ctrl->sensor_res[last_applied_idx].res_index,
+				s_ctrl->sensor_res[curr_idx].res_index);
+		}
+	}
+
+	CAM_DBG(CAM_REQ,
+		"Sensor[%d] update req id: %lld [last_applied: %lld] with opcode:%d recovery: %d",
+		s_ctrl->soc_info.index, apply->request_id,
+		s_ctrl->last_applied_req, opcode, apply->recovery);
+	trace_cam_apply_req("Sensor", s_ctrl->soc_info.index, apply->request_id, apply->link_hdl);
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	rc = cam_sensor_apply_settings(s_ctrl, apply->request_id,
+		opcode);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+}
+
+int32_t cam_sensor_notify_frame_skip(struct cam_req_mgr_apply_request *apply)
+{
+	int32_t rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	enum cam_sensor_packet_opcodes opcode =
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE;
+
+	if (!apply)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(apply->dev_hdl);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_REQ, " Sensor[%d] handle frame skip for req id: %lld",
+		s_ctrl->soc_info.index, apply->request_id);
+	trace_cam_notify_frame_skip("Sensor", apply->request_id);
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	rc = cam_sensor_apply_settings(s_ctrl, apply->request_id,
+		opcode);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+}
+
+int32_t cam_sensor_flush_request(struct cam_req_mgr_flush_request *flush_req)
+{
+	int32_t rc = 0, i;
+	uint32_t cancel_req_id_found = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	struct i2c_settings_array *i2c_set = NULL;
+
+	if (!flush_req)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(flush_req->dev_hdl);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	if ((s_ctrl->sensor_state != CAM_SENSOR_START) &&
+		(s_ctrl->sensor_state != CAM_SENSOR_CONFIG)) {
+		mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+		return rc;
+	}
+
+	if (s_ctrl->i2c_data.per_frame == NULL) {
+		CAM_ERR(CAM_SENSOR, "i2c frame data is NULL");
+		mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+		return -EINVAL;
+	}
+
+	if (s_ctrl->i2c_data.frame_skip == NULL) {
+		CAM_ERR(CAM_SENSOR, "i2c not ready data is NULL");
+		mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+		return -EINVAL;
+	}
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		s_ctrl->last_flush_req = flush_req->req_id;
+		CAM_DBG(CAM_SENSOR, "last reqest to flush is %lld",
+			flush_req->req_id);
+
+		/*
+		 * Sensor can't get EOF event during flush if we do the flush
+		 * before EOF, so we need to stream off the sensor during flush
+		 * for VFPS usecase.
+		 */
+		if (s_ctrl->stream_off_after_eof) {
+			cam_sensor_stream_off(s_ctrl);
+			s_ctrl->is_stopped_by_user = false;
+		}
+	}
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		i2c_set = &(s_ctrl->i2c_data.per_frame[i]);
+
+		if ((flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ)
+				&& (i2c_set->request_id != flush_req->req_id))
+			continue;
+
+		if (i2c_set->is_settings_valid == 1) {
+			rc = delete_request(i2c_set);
+			if (rc < 0)
+				CAM_ERR(CAM_SENSOR,
+					"delete request: %lld rc: %d",
+					i2c_set->request_id, rc);
+
+			if (flush_req->type ==
+				CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+				cancel_req_id_found = 1;
+				break;
+			}
+		}
+	}
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		i2c_set = &(s_ctrl->i2c_data.frame_skip[i]);
+
+		if ((flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ)
+				&& (i2c_set->request_id != flush_req->req_id))
+			continue;
+
+		if (i2c_set->is_settings_valid == 1) {
+			rc = delete_request(i2c_set);
+			if (rc < 0)
+				CAM_ERR(CAM_SENSOR,
+					"delete request for not ready packet: %lld rc: %d",
+					i2c_set->request_id, rc);
+
+			if (flush_req->type ==
+				CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+				cancel_req_id_found = 1;
+				break;
+			}
+		}
+	}
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ &&
+		!cancel_req_id_found)
+		CAM_DBG(CAM_SENSOR,
+			"Flush request id:%lld not found in the pending list",
+			flush_req->req_id);
+
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+}
+
+int cam_sensor_process_evt(struct cam_req_mgr_link_evt_data *evt_data)
+{
+	int                       rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+
+	if (!evt_data)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(evt_data->dev_hdl);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Received evt:%d", evt_data->evt_type);
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+
+	switch (evt_data->evt_type) {
+	case CAM_REQ_MGR_LINK_EVT_EOF:
+		if (s_ctrl->stream_off_after_eof) {
+			rc = cam_sensor_stream_off(s_ctrl);
+			if (rc) {
+				CAM_ERR(CAM_SENSOR, "Failed to stream off %s",
+					s_ctrl->sensor_name);
+
+				cam_sensor_notify_v4l2_error_event(s_ctrl,
+					CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY,
+					CAM_REQ_MGR_SENSOR_STREAM_OFF_FAILED);
+			}
+		}
+		break;
+	case CAM_REQ_MGR_LINK_EVT_UPDATE_PROPERTIES:
+		if (evt_data->u.properties_mask &
+			CAM_LINK_PROPERTY_SENSOR_STANDBY_AFTER_EOF)
+			s_ctrl->stream_off_after_eof = true;
+		else
+			s_ctrl->stream_off_after_eof = false;
+
+		CAM_DBG(CAM_SENSOR, "sensor %s stream off after eof:%s",
+			s_ctrl->sensor_name,
+			CAM_BOOL_TO_YESNO(s_ctrl->stream_off_after_eof));
+		break;
+	default:
+		/* No handling */
+		break;
+	}
+
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.h
@@ -0,0 +1,101 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018,2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_CORE_H_
+#define _CAM_SENSOR_CORE_H_
+
+#include "cam_sensor_dev.h"
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * This API powers up the camera sensor module
+ */
+int cam_sensor_power_up(struct cam_sensor_ctrl_t *s_ctrl);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * This API powers down the camera sensor module
+ */
+int cam_sensor_power_down(struct cam_sensor_ctrl_t *s_ctrl);
+
+/**
+ * @sd: V4L2 subdevice
+ * @on: Turn off/on flag
+ *
+ * This API powers down the sensor module
+ */
+int cam_sensor_power(struct v4l2_subdev *sd, int on);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ * @req_id: Request id
+ * @opcode: opcode for settings
+ *
+ * This API applies the req_id settings to sensor
+ */
+int cam_sensor_apply_settings(struct cam_sensor_ctrl_t *s_ctrl, int64_t req_id,
+	enum cam_sensor_packet_opcodes opcode);
+
+/**
+ * @apply: Req mgr structure for applying request
+ *
+ * This API applies the request that is mentioned
+ */
+int cam_sensor_apply_request(struct cam_req_mgr_apply_request *apply);
+
+/**
+ * @apply: Req mgr structure for notifying frame skip
+ *
+ * This API notifies a frame is skipped
+ */
+int cam_sensor_notify_frame_skip(struct cam_req_mgr_apply_request *apply);
+
+/**
+ * @flush: Req mgr structure for flushing request
+ *
+ * This API flushes the request that is mentioned
+ */
+int cam_sensor_flush_request(struct cam_req_mgr_flush_request *flush);
+
+/**
+ * @info: Sub device info to req mgr
+ *
+ * Publish the subdevice info
+ */
+int cam_sensor_publish_dev_info(struct cam_req_mgr_device_info *info);
+
+/**
+ * @link: Link setup info
+ *
+ * This API establishes link with sensor subdevice with req mgr
+ */
+int cam_sensor_establish_link(struct cam_req_mgr_core_dev_link_setup *link);
+
+/**
+ * @evt_data: Event data info
+ *
+ * This API processes the event which is published by request mgr
+ */
+int cam_sensor_process_evt(struct cam_req_mgr_link_evt_data *evt_data);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ * @arg:    Camera control command argument
+ *
+ * This API handles the camera control argument reached to sensor
+ */
+int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl, void *arg);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * This API handles the camera sensor close/shutdown
+ */
+void cam_sensor_shutdown(struct cam_sensor_ctrl_t *s_ctrl);
+
+#endif /* _CAM_SENSOR_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.c
@@ -0,0 +1,731 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sensor_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_sensor_soc.h"
+#include "cam_sensor_core.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+static struct cam_sensor_i3c_sensor_data {
+	struct cam_sensor_ctrl_t                  *s_ctrl;
+	struct completion                          probe_complete;
+} g_i3c_sensor_data[MAX_CAMERAS];
+
+struct completion *cam_sensor_get_i3c_completion(uint32_t index)
+{
+	return &g_i3c_sensor_data[index].probe_complete;
+}
+
+static int cam_sensor_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_sensor_ctrl_t *s_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "s_ctrl ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_shutdown(s_ctrl);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+
+	return 0;
+}
+
+static int cam_sensor_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_SENSOR, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_sensor_subdev_close_internal(sd, fh);
+}
+
+static long cam_sensor_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_sensor_driver_cmd(s_ctrl, arg);
+		if (rc) {
+			if (rc == -EBADR)
+				CAM_INFO(CAM_SENSOR,
+					"Failed in Driver cmd: %d, it has been flushed", rc);
+			else if (rc != -ENODEV)
+				CAM_ERR(CAM_SENSOR,
+					"Failed in Driver cmd: %d", rc);
+		}
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_sensor_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_SENSOR, "Invalid ioctl cmd: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_sensor_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_SENSOR, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_sensor_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR, "cam_sensor_subdev_ioctl failed");
+		break;
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid compat ioctl cmd_type: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+
+#endif
+static struct v4l2_subdev_core_ops cam_sensor_subdev_core_ops = {
+	.ioctl = cam_sensor_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_sensor_init_subdev_do_ioctl,
+#endif
+	.s_power = cam_sensor_power,
+};
+
+static struct v4l2_subdev_ops cam_sensor_subdev_ops = {
+	.core = &cam_sensor_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cam_sensor_internal_ops = {
+	.close = cam_sensor_subdev_close,
+};
+
+static int cam_sensor_init_subdev_params(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0;
+
+	s_ctrl->v4l2_dev_str.internal_ops = &cam_sensor_internal_ops;
+	s_ctrl->v4l2_dev_str.ops = &cam_sensor_subdev_ops;
+	strscpy(s_ctrl->device_name, CAMX_SENSOR_DEV_NAME, CAM_CTX_DEV_NAME_MAX_LENGTH);
+	s_ctrl->v4l2_dev_str.name = s_ctrl->device_name;
+	s_ctrl->v4l2_dev_str.sd_flags = (V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	s_ctrl->v4l2_dev_str.ent_function = CAM_SENSOR_DEVICE_TYPE;
+	s_ctrl->v4l2_dev_str.token = s_ctrl;
+	s_ctrl->v4l2_dev_str.close_seq_prior = CAM_SD_CLOSE_MEDIUM_LOW_PRIORITY;
+
+	rc = cam_register_subdev(&(s_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "Fail with cam_register_subdev rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_sensor_i3c_driver_probe(struct i3c_device *client)
+{
+	int32_t rc = 0;
+	struct cam_sensor_ctrl_t       *s_ctrl = NULL;
+	uint32_t                        index;
+	struct device                  *dev;
+
+	if (!client) {
+		CAM_ERR(CAM_CSIPHY, "Invalid input args");
+		return -EINVAL;
+	}
+
+	dev = &client->dev;
+
+	CAM_DBG(CAM_SENSOR, "Probe for I3C Slave %s", dev_name(dev));
+
+	rc = of_property_read_u32(dev->of_node, "cell-index", &index);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "device %s failed to read cell-index", dev_name(dev));
+		return rc;
+	}
+
+	if (index >= MAX_CAMERAS) {
+		CAM_ERR(CAM_SENSOR, "Invalid Cell-Index: %u for %s", index, dev_name(dev));
+		return -EINVAL;
+	}
+
+	s_ctrl = g_i3c_sensor_data[index].s_ctrl;
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "S_ctrl is null. I3C Probe before platfom driver probe for %s",
+			dev_name(dev));
+		return -EINVAL;
+	}
+
+	dev->driver_data = s_ctrl;
+
+	s_ctrl->io_master_info.i3c_client = client;
+
+	complete_all(&g_i3c_sensor_data[index].probe_complete);
+
+	CAM_DBG(CAM_SENSOR, "I3C Probe Finished for %s", dev_name(dev));
+	return rc;
+}
+
+static int cam_sensor_i2c_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t                   rc = 0;
+	int                       i = 0;
+	struct i2c_client        *client = NULL;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	struct cam_hw_soc_info   *soc_info = NULL;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (client == NULL) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	/* Create sensor control structure */
+	s_ctrl = kzalloc(sizeof(*s_ctrl), GFP_KERNEL);
+	if (!s_ctrl)
+		return -ENOMEM;
+
+	i2c_set_clientdata(client, s_ctrl);
+
+	s_ctrl->io_master_info.client = client;
+	soc_info = &s_ctrl->soc_info;
+	soc_info->dev = &client->dev;
+	soc_info->dev_name = client->name;
+
+	/* Initialize sensor device type */
+	s_ctrl->of_node = client->dev.of_node;
+	s_ctrl->io_master_info.master_type = I2C_MASTER;
+	s_ctrl->is_probe_succeed = 0;
+	s_ctrl->last_flush_req = 0;
+
+	rc = cam_sensor_parse_dt(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "cam_sensor_parse_dt rc %d", rc);
+		goto free_s_ctrl;
+	}
+
+	rc = cam_sensor_init_subdev_params(s_ctrl);
+	if (rc)
+		goto free_s_ctrl;
+
+	s_ctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto unreg_subdev;
+	}
+
+	s_ctrl->i2c_data.frame_skip =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.frame_skip == NULL) {
+		rc = -ENOMEM;
+		goto free_perframe;
+	}
+
+	s_ctrl->i2c_data.bubble_update =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.bubble_update == NULL) {
+		rc = -ENOMEM;
+		goto free_frame_skip;
+	}
+
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.init_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.config_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.streamon_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.streamoff_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.reg_bank_unlock_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.reg_bank_lock_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.read_settings.list_head));
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.per_frame[i].list_head));
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.frame_skip[i].list_head));
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.bubble_update[i].list_head));
+	}
+
+	cam_sensor_module_add_i2c_device((void *) s_ctrl, CAM_SENSOR_DEVICE);
+
+	s_ctrl->bridge_intf.device_hdl = -1;
+	s_ctrl->bridge_intf.link_hdl = -1;
+	s_ctrl->bridge_intf.ops.get_dev_info = cam_sensor_publish_dev_info;
+	s_ctrl->bridge_intf.ops.link_setup = cam_sensor_establish_link;
+	s_ctrl->bridge_intf.ops.apply_req = cam_sensor_apply_request;
+	s_ctrl->bridge_intf.ops.notify_frame_skip =
+		cam_sensor_notify_frame_skip;
+	s_ctrl->bridge_intf.ops.flush_req = cam_sensor_flush_request;
+	s_ctrl->bridge_intf.ops.process_evt = cam_sensor_process_evt;
+
+	s_ctrl->sensordata->power_info.dev = soc_info->dev;
+
+	return rc;
+
+free_frame_skip:
+	kfree(s_ctrl->i2c_data.frame_skip);
+free_perframe:
+	kfree(s_ctrl->i2c_data.per_frame);
+unreg_subdev:
+	cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
+free_s_ctrl:
+	kfree(s_ctrl);
+	return rc;
+}
+
+static void cam_sensor_i2c_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct i2c_client         *client = NULL;
+	struct cam_sensor_ctrl_t  *s_ctrl = NULL;
+
+	client = container_of(dev, struct i2c_client, dev);
+	if (!client) {
+		CAM_ERR(CAM_SENSOR,
+			"Failed to get i2c client");
+		return;
+	}
+
+	s_ctrl = i2c_get_clientdata(client);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "sensor device is NULL");
+		return;
+	}
+
+	CAM_DBG(CAM_SENSOR, "i2c remove invoked");
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_shutdown(s_ctrl);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_release_power_domain(s_ctrl);
+	cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
+
+	kfree(s_ctrl->i2c_data.per_frame);
+	kfree(s_ctrl->i2c_data.frame_skip);
+	kfree(s_ctrl->i2c_data.bubble_update);
+	v4l2_set_subdevdata(&(s_ctrl->v4l2_dev_str.sd), NULL);
+	kfree(s_ctrl);
+}
+
+const static struct component_ops cam_sensor_i2c_component_ops = {
+	.bind = cam_sensor_i2c_component_bind,
+	.unbind = cam_sensor_i2c_component_unbind,
+};
+
+static int cam_sensor_i2c_driver_probe(struct i2c_client *client)
+{
+	int rc = 0;
+
+	if (client == NULL) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_SENSOR, "%s :: i2c_check_functionality failed",
+			client->name);
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Adding sensor component");
+	rc = component_add(&client->dev, &cam_sensor_i2c_component_ops);
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_sensor_i2c_driver_remove_common(struct i2c_client *client)
+{
+	component_del(&client->dev, &cam_sensor_i2c_component_ops);
+
+	return 0;
+}
+
+static int cam_sensor_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t rc = 0, i = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	bool i3c_i2c_target;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct device_node *endpoint, *remote;
+	struct device_node *deser_node;
+	u32 csiphy_sd_index;
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return 0;
+
+	/* Create sensor control structure */
+	s_ctrl = devm_kzalloc(&pdev->dev,
+		sizeof(struct cam_sensor_ctrl_t), GFP_KERNEL);
+	if (!s_ctrl)
+		return -ENOMEM;
+
+	soc_info = &s_ctrl->soc_info;
+	soc_info->pdev = pdev;
+	soc_info->dev = &pdev->dev;
+	soc_info->dev_name = pdev->name;
+
+	/* Initialize sensor device type */
+	s_ctrl->of_node = pdev->dev.of_node;
+	s_ctrl->is_probe_succeed = 0;
+	s_ctrl->last_flush_req = 0;
+
+	/*fill in platform device*/
+	s_ctrl->pdev = pdev;
+
+	s_ctrl->io_master_info.master_type = CCI_MASTER;
+
+	rc = cam_sensor_parse_dt(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed: cam_sensor_parse_dt rc %d", rc);
+		goto free_s_ctrl;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Master Type: %u", s_ctrl->io_master_info.master_type);
+
+	/* Fill platform device id*/
+	pdev->id = soc_info->index;
+
+	endpoint = of_graph_get_next_endpoint(s_ctrl->of_node, NULL);
+	if (!endpoint) {
+		CAM_DBG(CAM_SENSOR, "No local endpoint found");
+	} else {
+		remote = of_graph_get_remote_port(endpoint);
+		if (!remote) {
+			CAM_ERR(CAM_SENSOR, "No remote endpoint found");
+			of_node_put(endpoint);
+		}
+
+		deser_node = of_get_parent(remote);
+		if (!deser_node) {
+			CAM_ERR(CAM_SENSOR, "No deserializer node found");
+			of_node_put(remote);
+			of_node_put(endpoint);
+		}
+
+		rc = of_property_read_u32(deser_node, "csiphy-sd-index", &csiphy_sd_index);
+		if (rc) {
+			CAM_ERR(CAM_SENSOR, "Failed to read csiphy-sd-index");
+		} else {
+			CAM_DBG(CAM_SENSOR, "Deserializer csiphy-sd-index: %u", csiphy_sd_index);
+		}
+	}
+
+	rc = cam_sensor_init_subdev_params(s_ctrl);
+	if (rc)
+		goto free_s_ctrl;
+
+	s_ctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto unreg_subdev;
+	}
+
+	s_ctrl->i2c_data.frame_skip =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.frame_skip == NULL) {
+		rc = -ENOMEM;
+		goto free_perframe;
+	}
+
+	s_ctrl->i2c_data.bubble_update =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.bubble_update == NULL) {
+		rc = -ENOMEM;
+		goto free_frame_skip;
+	}
+
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.init_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.config_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.streamon_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.streamoff_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.reg_bank_unlock_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.reg_bank_lock_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.read_settings.list_head));
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.per_frame[i].list_head));
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.frame_skip[i].list_head));
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.bubble_update[i].list_head));
+	}
+
+	cam_sensor_module_add_i2c_device((void *) s_ctrl, CAM_SENSOR_DEVICE);
+
+	s_ctrl->bridge_intf.device_hdl = -1;
+	s_ctrl->bridge_intf.link_hdl = -1;
+	s_ctrl->bridge_intf.ops.get_dev_info = cam_sensor_publish_dev_info;
+	s_ctrl->bridge_intf.ops.link_setup = cam_sensor_establish_link;
+	s_ctrl->bridge_intf.ops.apply_req = cam_sensor_apply_request;
+	s_ctrl->bridge_intf.ops.notify_frame_skip =
+		cam_sensor_notify_frame_skip;
+	s_ctrl->bridge_intf.ops.flush_req = cam_sensor_flush_request;
+	s_ctrl->bridge_intf.ops.process_evt = cam_sensor_process_evt;
+
+	s_ctrl->sensordata->power_info.dev = &pdev->dev;
+	platform_set_drvdata(pdev, s_ctrl);
+	s_ctrl->sensor_state = CAM_SENSOR_INIT;
+	CAM_DBG(CAM_SENSOR, "Component bound successfully for %s", pdev->name);
+
+	g_i3c_sensor_data[soc_info->index].s_ctrl = s_ctrl;
+	init_completion(&g_i3c_sensor_data[soc_info->index].probe_complete);
+
+	return rc;
+
+free_frame_skip:
+	kfree(s_ctrl->i2c_data.frame_skip);
+free_perframe:
+	kfree(s_ctrl->i2c_data.per_frame);
+unreg_subdev:
+	cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
+free_s_ctrl:
+	devm_kfree(&pdev->dev, s_ctrl);
+	return rc;
+}
+
+static void cam_sensor_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                        i;
+	struct cam_sensor_ctrl_t  *s_ctrl;
+	struct cam_hw_soc_info    *soc_info;
+	bool                       i3c_i2c_target;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	i3c_i2c_target = of_property_read_bool(pdev->dev.of_node, "i3c-i2c-target");
+	if (i3c_i2c_target)
+		return;
+
+	s_ctrl = platform_get_drvdata(pdev);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "sensor device is NULL");
+		return;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Component unbind called for: %s", pdev->name);
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_shutdown(s_ctrl);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_release_power_domain(s_ctrl);
+	cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
+	soc_info = &s_ctrl->soc_info;
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_SENSOR, "%s handle is NULL skip put",
+				soc_info->clk_name[i]);
+			continue;
+		}
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+	}
+
+	kfree(s_ctrl->i2c_data.per_frame);
+	kfree(s_ctrl->i2c_data.frame_skip);
+	kfree(s_ctrl->i2c_data.bubble_update);
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&(s_ctrl->v4l2_dev_str.sd), NULL);
+	devm_kfree(&pdev->dev, s_ctrl);
+}
+
+const static struct component_ops cam_sensor_component_ops = {
+	.bind = cam_sensor_component_bind,
+	.unbind = cam_sensor_component_unbind,
+};
+
+static int cam_sensor_platform_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_sensor_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_sensor_driver_dt_match[] = {
+	{.compatible = "qcom,cam-sensor"},
+	{.compatible = "qcom,cam-gmsl-sensor"},
+    {}
+};
+MODULE_DEVICE_TABLE(of, cam_sensor_driver_dt_match);
+
+static int32_t cam_sensor_driver_platform_probe(
+	struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_SENSOR, "Adding Sensor component for %s", pdev->name);
+	rc = component_add(&pdev->dev, &cam_sensor_component_ops);
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+struct platform_driver cam_sensor_platform_driver = {
+	.probe = cam_sensor_driver_platform_probe,
+	.driver = {
+		.name = "qcom,camera",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_sensor_driver_dt_match,
+		.suppress_bind_attrs = true,
+	},
+	.remove = cam_sensor_platform_remove,
+};
+
+static const struct of_device_id cam_sensor_i2c_driver_dt_match[] = {
+	{.compatible = "qcom,cam-i2c-sensor"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_sensor_i2c_driver_dt_match);
+
+static const struct i2c_device_id i2c_id[] = {
+	{SENSOR_DRIVER_I2C, (kernel_ulong_t)NULL},
+	{ }
+};
+
+struct i2c_driver cam_sensor_i2c_driver = {
+	.id_table = i2c_id,
+	.probe = cam_sensor_i2c_driver_probe,
+	.remove = cam_sensor_i2c_driver_remove,
+	.driver = {
+		.name = SENSOR_DRIVER_I2C,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_sensor_i2c_driver_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+static struct i3c_device_id sensor_i3c_id[MAX_I3C_DEVICE_ID_ENTRIES + 1];
+
+static struct i3c_driver cam_sensor_i3c_driver = {
+	.id_table = sensor_i3c_id,
+	.probe = cam_sensor_i3c_driver_probe,
+	.remove = cam_i3c_driver_remove,
+	.driver = {
+		.owner = THIS_MODULE,
+		.name = SENSOR_DRIVER_I3C,
+		.of_match_table = cam_sensor_driver_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_sensor_driver_init(void)
+{
+	int rc;
+	struct device_node                      *dev;
+	int num_entries = 0;
+
+	rc = platform_driver_register(&cam_sensor_platform_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "platform_driver_register Failed: rc = %d", rc);
+		return rc;
+	}
+
+	rc = i2c_add_driver(&cam_sensor_i2c_driver);
+	if (rc) {
+		CAM_ERR(CAM_SENSOR, "i2c_add_driver failed rc = %d", rc);
+		goto i2c_register_err;
+	}
+
+	memset(sensor_i3c_id, 0, sizeof(struct i3c_device_id) * (MAX_I3C_DEVICE_ID_ENTRIES + 1));
+
+	dev = of_find_node_by_name(NULL, I3C_SENSOR_DEV_ID_DT_NODE);
+	if (!dev) {
+		CAM_DBG(CAM_SENSOR, "Couldnt Find the i3c-id-table dev node");
+		return 0;
+	}
+
+	rc = cam_sensor_count_elems_i3c_device_id(dev, &num_entries,
+		"i3c-sensor-id-table");
+	if (rc)
+		return 0;
+
+	rc = cam_sensor_fill_i3c_device_id(dev, num_entries,
+		"i3c-sensor-id-table", sensor_i3c_id);
+	if (rc)
+		goto i3c_register_err;
+
+	rc = i3c_driver_register_with_owner(&cam_sensor_i3c_driver, THIS_MODULE);
+	if (rc) {
+		CAM_ERR(CAM_SENSOR, "i3c_driver registration failed, rc: %d", rc);
+		goto i3c_register_err;
+	}
+
+	cam_sensor_module_debug_register();
+
+	return 0;
+
+i3c_register_err:
+	i2c_del_driver(&cam_sensor_i2c_driver);
+i2c_register_err:
+	platform_driver_unregister(&cam_sensor_platform_driver);
+
+	return rc;
+}
+
+void cam_sensor_driver_exit(void)
+{
+	struct device_node *dev;
+
+	platform_driver_unregister(&cam_sensor_platform_driver);
+	i2c_del_driver(&cam_sensor_i2c_driver);
+
+	dev = of_find_node_by_name(NULL, I3C_SENSOR_DEV_ID_DT_NODE);
+	if (!dev) {
+		CAM_DBG(CAM_ACTUATOR, "Couldnt Find the i3c-id-table dev node");
+		return;
+	}
+
+	i3c_driver_unregister(&cam_sensor_i3c_driver);
+
+	cam_sensor_module_debug_deregister();
+}
+
+MODULE_DESCRIPTION("cam_sensor_driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.h
@@ -0,0 +1,178 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_DEV_H_
+#define _CAM_SENSOR_DEV_H_
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/irqreturn.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <linux/of_graph.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <cam_cci_dev.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_subdev.h>
+#include <cam_sensor_io.h>
+#include "cam_debug_util.h"
+#include "cam_context.h"
+
+#define NUM_MASTERS 2
+#define NUM_QUEUES 2
+#define SENSOR_DRIVER_I2C                          "cam-i2c-sensor"
+#define CAMX_SENSOR_DEV_NAME                       "cam-sensor-driver"
+#define SENSOR_DRIVER_I3C                          "i3c_camera_sensor"
+
+enum cam_sensor_state_t {
+	CAM_SENSOR_INIT,
+	CAM_SENSOR_ACQUIRE,
+	CAM_SENSOR_CONFIG,
+	CAM_SENSOR_START,
+};
+
+/**
+ * struct sensor_intf_params
+ * @device_hdl: Device Handle
+ * @session_hdl: Session Handle
+ * @link_hdl: Link Handle
+ * @ops: KMD operations
+ * @crm_cb: Callback API pointers
+ */
+struct sensor_intf_params {
+	int32_t device_hdl;
+	int32_t session_hdl;
+	int32_t link_hdl;
+	struct cam_req_mgr_kmd_ops ops;
+	struct cam_req_mgr_crm_cb *crm_cb;
+};
+
+/**
+ * struct cam_sensor_dev_res_info
+ *
+ * @res_index        : The resolution index that gets updated
+ *                     during a mode switch
+ * @feature_mask     : Feature mask
+ * @fps              : Frame rate
+ * @width            : Pixel width to output to csiphy
+ * @height           : Pixel height to output to csiphy
+ * request_id        : Request Id
+ * @caps             : Specifies capability sensor is configured
+ *                     for, (eg, XCFA, HFR), num_exposures and
+ *                     PDAF type
+ */
+struct cam_sensor_dev_res_info {
+	uint16_t   res_index;
+	uint16_t   feature_mask;
+	uint32_t   fps;
+	uint32_t   width;
+	uint32_t   height;
+	int64_t    request_id;
+	char       caps[64];
+};
+
+/**
+ * struct cam_sensor_ctrl_t: Camera control structure
+ * @device_name: Sensor device name
+ * @pdev: Platform device
+ * @cam_sensor_mutex: Sensor mutex
+ * @sensordata: Sensor board Information
+ * @sensor_res: Sensor resolution index and other info
+ *              accompanying a mode index switch
+ * @cci_i2c_master: I2C structure
+ * @io_master_info: Information about the communication master
+ * @sensor_state: Sensor states
+ * @is_probe_succeed: Probe succeeded or not
+ * @id: Cell Index
+ * @is_i3c_device: A Flag to indicate whether this sensor is an I3C Device.
+ * @of_node: Of node ptr
+ * @v4l2_dev_str: V4L2 device structure
+ * @sensor_probe_addr_type: Sensor probe address type
+ * @sensor_probe_data_type: Sensor probe data type
+ * @i2c_data: Sensor I2C register settings
+ * @sensor_info: Sensor query cap structure
+ * @bridge_intf: Bridge interface structure
+ * @streamon_count: Count to hold the number of times stream on called
+ * @streamoff_count: Count to hold the number of times stream off called
+ * @bob_reg_index: Hold to BoB regulator index
+ * @bob_pwm_switch: Boolean flag to switch into PWM mode for BoB regulator
+ * @last_flush_req: Last request to flush
+ * @pipeline_delay: Sensor pipeline delay
+ * @modeswitch_delay: Mode switch delay
+ * @sensor_name: Sensor name
+ * @aon_camera_id: AON Camera ID associated with this sensor
+ * @last_applied_req: Last updated request id
+ * @last_applied_req: Last applied request id
+ * @num_batched_frames: Number batched frames
+ * @is_stopped_by_user: Indicate if sensor has been stopped by userland
+ * @stream_off_after_eof: Indicates if sensor needs to stream off after eof
+ * @is_res_info_updated: Indicate if resolution info is updated
+ * @hw_no_ops: To determine whether HW operations need to be disabled
+ */
+struct cam_sensor_ctrl_t {
+	char                           device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct platform_device        *pdev;
+	struct cam_hw_soc_info         soc_info;
+	struct mutex                   cam_sensor_mutex;
+	struct cam_sensor_board_info  *sensordata;
+	struct cam_sensor_dev_res_info sensor_res[MAX_PER_FRAME_ARRAY];
+	enum cci_i2c_master_t          cci_i2c_master;
+	enum cci_device_num            cci_num;
+	struct camera_io_master        io_master_info;
+	enum cam_sensor_state_t        sensor_state;
+	uint8_t                        is_probe_succeed;
+	uint32_t                       id;
+	bool                           is_i3c_device;
+	struct device_node            *of_node;
+	struct cam_subdev              v4l2_dev_str;
+	uint8_t                        sensor_probe_addr_type;
+	uint8_t                        sensor_probe_data_type;
+	struct i2c_data_settings       i2c_data;
+	struct  cam_sensor_query_cap   sensor_info;
+	struct sensor_intf_params      bridge_intf;
+	uint32_t                       streamon_count;
+	uint32_t                       streamoff_count;
+	int                            bob_reg_index;
+	bool                           bob_pwm_switch;
+	uint32_t                       last_flush_req;
+	uint16_t                       pipeline_delay;
+	uint16_t                       modeswitch_delay;
+	char                           sensor_name[CAM_SENSOR_NAME_MAX_SIZE];
+	uint32_t                       aon_camera_id;
+	int64_t                        last_updated_req;
+	int64_t                        last_applied_req;
+	uint32_t                       num_batched_frames;
+	bool                           is_stopped_by_user;
+	bool                           stream_off_after_eof;
+	bool                           is_res_info_updated;
+	bool                           hw_no_ops;
+};
+
+
+/**
+ * @brief : API to remove SENSOR i2c Hw from driver framework.
+ * @return : return 0 on success.
+ */
+int cam_sensor_i2c_driver_remove_common(struct i2c_client *client);
+
+/**
+ * @brief : API to register SENSOR hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_sensor_driver_init(void);
+
+/**
+ * @brief : API to remove SENSOR Hw from platform framework.
+ */
+void cam_sensor_driver_exit(void);
+
+#endif /* _CAM_SENSOR_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.c
@@ -0,0 +1,391 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_sensor_util.h>
+#include <cam_sensor_io.h>
+#include <cam_req_mgr_util.h>
+#include "cam_sensor_soc.h"
+#include "cam_soc_util.h"
+
+int32_t cam_sensor_get_sub_module_index(struct device_node *of_node,
+	struct cam_sensor_board_info *s_info)
+{
+	int rc = 0, i = 0;
+	uint32_t val = 0;
+	struct device_node *src_node = NULL;
+	struct cam_sensor_board_info *sensor_info;
+
+	sensor_info = s_info;
+
+	for (i = 0; i < SUB_MODULE_MAX; i++)
+		sensor_info->subdev_id[i] = -1;
+
+	src_node = of_parse_phandle(of_node, "actuator-src", 0);
+	if (!src_node) {
+		CAM_DBG(CAM_SENSOR, "src_node NULL");
+	} else {
+		rc = of_property_read_u32(src_node, "cell-index", &val);
+		CAM_DBG(CAM_SENSOR, "actuator cell index %d, rc %d", val, rc);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed %d", rc);
+			of_node_put(src_node);
+			return rc;
+		}
+		sensor_info->subdev_id[SUB_MODULE_ACTUATOR] = val;
+		of_node_put(src_node);
+	}
+
+	src_node = of_parse_phandle(of_node, "ois-src", 0);
+	if (!src_node) {
+		CAM_DBG(CAM_SENSOR, "src_node NULL");
+	} else {
+		rc = of_property_read_u32(src_node, "cell-index", &val);
+		CAM_DBG(CAM_SENSOR, " ois cell index %d, rc %d", val, rc);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed %d",  rc);
+			of_node_put(src_node);
+			return rc;
+		}
+		sensor_info->subdev_id[SUB_MODULE_OIS] = val;
+		of_node_put(src_node);
+	}
+
+	src_node = of_parse_phandle(of_node, "eeprom-src", 0);
+	if (!src_node) {
+		CAM_DBG(CAM_SENSOR, "eeprom src_node NULL");
+	} else {
+		rc = of_property_read_u32(src_node, "cell-index", &val);
+		CAM_DBG(CAM_SENSOR, "eeprom cell index %d, rc %d", val, rc);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed %d", rc);
+			of_node_put(src_node);
+			return rc;
+		}
+		sensor_info->subdev_id[SUB_MODULE_EEPROM] = val;
+		of_node_put(src_node);
+	}
+
+	src_node = of_parse_phandle(of_node, "led-flash-src", 0);
+	if (!src_node) {
+		CAM_DBG(CAM_SENSOR, " src_node NULL");
+	} else {
+		rc = of_property_read_u32(src_node, "cell-index", &val);
+		CAM_DBG(CAM_SENSOR, "led flash cell index %d, rc %d", val, rc);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed %d", rc);
+			of_node_put(src_node);
+			return rc;
+		}
+		sensor_info->subdev_id[SUB_MODULE_LED_FLASH] = val;
+		of_node_put(src_node);
+	}
+
+	rc = of_property_read_u32(of_node, "csiphy-sd-index", &val);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "paring the dt node for csiphy rc %d", rc);
+	else
+		sensor_info->subdev_id[SUB_MODULE_CSIPHY] = val;
+
+	return rc;
+}
+
+static int32_t cam_sensor_init_bus_params(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	/* Validate input parameters */
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "failed: invalid params s_ctrl %pK",
+			s_ctrl);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SENSOR,
+		"master_type: %d", s_ctrl->io_master_info.master_type);
+	/* Initialize cci_client */
+	if (s_ctrl->io_master_info.master_type == CCI_MASTER) {
+		s_ctrl->io_master_info.cci_client = kzalloc(sizeof(
+			struct cam_sensor_cci_client), GFP_KERNEL);
+		if (!(s_ctrl->io_master_info.cci_client)) {
+			CAM_ERR(CAM_SENSOR, "Memory allocation failed");
+			return -ENOMEM;
+		}
+	} else if (s_ctrl->io_master_info.master_type == I2C_MASTER) {
+		if (!(s_ctrl->io_master_info.client))
+			return -EINVAL;
+	} else if (s_ctrl->io_master_info.master_type == I3C_MASTER) {
+		CAM_DBG(CAM_SENSOR, "I3C Master Type");
+	} else {
+		CAM_ERR(CAM_SENSOR,
+			"Invalid master / Master type Not supported : %d",
+				s_ctrl->io_master_info.master_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int32_t cam_sensor_driver_get_dt_data(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	int i = 0;
+	struct cam_sensor_board_info *sensordata = NULL;
+	struct device_node *of_node = s_ctrl->of_node;
+	struct device_node *of_parent = NULL;
+	struct cam_hw_soc_info *soc_info = &s_ctrl->soc_info;
+
+	s_ctrl->sensordata = kzalloc(sizeof(*sensordata), GFP_KERNEL);
+	if (!s_ctrl->sensordata)
+		return -ENOMEM;
+
+	sensordata = s_ctrl->sensordata;
+
+	if (of_device_is_compatible(of_node, "qcom,cam-gmsl-sensor")) {
+		struct device_node *endpoint, *remote;
+		struct device_node *parent_node;
+
+		endpoint = of_graph_get_next_endpoint(of_node, NULL);
+		if (!endpoint) {
+			CAM_ERR(CAM_SENSOR, "No local endpoint found for GMSL sensor!");
+			return -EINVAL;
+		}
+
+		remote = of_graph_get_remote_port(endpoint);
+		if (!remote) {
+			CAM_ERR(CAM_SENSOR, "No remote endpoint found");
+			of_node_put(endpoint);
+			return -EINVAL;
+		}
+
+		parent_node = of_get_parent(remote);
+		if (!parent_node) {
+			CAM_ERR(CAM_SENSOR, "No deserializer node found");
+			of_node_put(remote);
+			of_node_put(endpoint);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_SENSOR, "This is а GMSL sensor with parent_node %px",
+			parent_node);
+
+		soc_info->is_child_node = true;
+		soc_info->parent_node = parent_node;
+	}
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed to read DT properties rc %d", rc);
+		goto FREE_SENSOR_DATA;
+	}
+
+	rc =  cam_sensor_util_init_gpio_pin_tbl(soc_info,
+			&sensordata->power_info.gpio_num_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed to read gpios %d", rc);
+		goto FREE_SENSOR_DATA;
+	}
+
+	s_ctrl->id = soc_info->index;
+
+	/* Validate cell_id */
+	if (s_ctrl->id >= MAX_CAMERAS) {
+		CAM_ERR(CAM_SENSOR, "Failed invalid cell_id %d", s_ctrl->id);
+		rc = -EINVAL;
+		goto FREE_SENSOR_DATA;
+	}
+
+	rc = of_property_read_bool(of_node, "i3c-target");
+	if (rc) {
+		CAM_INFO(CAM_SENSOR, "I3C Target");
+		s_ctrl->is_i3c_device = true;
+		s_ctrl->io_master_info.master_type = I3C_MASTER;
+	}
+
+	/* Store the index of BoB regulator if it is available */
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		if (!strcmp(soc_info->rgltr_name[i],
+			"cam_bob")) {
+			CAM_DBG(CAM_SENSOR,
+				"i: %d cam_bob", i);
+			s_ctrl->bob_reg_index = i;
+			soc_info->rgltr[i] = devm_regulator_get(soc_info->dev,
+				soc_info->rgltr_name[i]);
+			if (IS_ERR_OR_NULL(soc_info->rgltr[i])) {
+				CAM_WARN(CAM_SENSOR,
+					"Regulator: %s get failed",
+					soc_info->rgltr_name[i]);
+				soc_info->rgltr[i] = NULL;
+			} else {
+				if (!of_property_read_bool(of_node,
+					"pwm-switch")) {
+					CAM_DBG(CAM_SENSOR,
+					"No BoB PWM switch param defined");
+					s_ctrl->bob_pwm_switch = false;
+				} else {
+					s_ctrl->bob_pwm_switch = true;
+				}
+			}
+		}
+	}
+
+	/* Read subdev info */
+	rc = cam_sensor_get_sub_module_index(of_node, sensordata);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed to get sub module index, rc=%d",
+			 rc);
+		goto FREE_SENSOR_DATA;
+	}
+
+	rc = cam_sensor_init_bus_params(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,
+			"Failed in Initialize Bus params, rc %d", rc);
+		goto FREE_SENSOR_DATA;
+	}
+
+	if (s_ctrl->io_master_info.master_type == CCI_MASTER) {
+
+		struct device_node *local_of_node =
+			soc_info->is_child_node ? soc_info->parent_node : of_node;
+
+		/* Get CCI master */
+		if (of_property_read_u32(local_of_node, "cci-master",
+			&s_ctrl->cci_i2c_master)) {
+			/* Set default master 0 */
+			s_ctrl->cci_i2c_master = MASTER_0;
+		}
+		CAM_DBG(CAM_SENSOR, "cci-master %d",
+			s_ctrl->cci_i2c_master);
+
+		of_parent = of_get_parent(local_of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&s_ctrl->cci_num) < 0)
+			/* Set default master 0 */
+			s_ctrl->cci_num = CCI_DEVICE_0;
+
+		s_ctrl->io_master_info.cci_client->cci_device
+			= s_ctrl->cci_num;
+
+		CAM_DBG(CAM_SENSOR, "cci-index %d", s_ctrl->cci_num);
+	}
+
+	if (of_property_read_u32(of_node, "sensor-position-pitch",
+		&sensordata->pos_pitch) < 0) {
+		CAM_DBG(CAM_SENSOR, "Invalid sensor position");
+		sensordata->pos_pitch = 360;
+	}
+	if (of_property_read_u32(of_node, "sensor-position-roll",
+		&sensordata->pos_roll) < 0) {
+		CAM_DBG(CAM_SENSOR, "Invalid sensor position");
+		sensordata->pos_roll = 360;
+	}
+	if (of_property_read_u32(of_node, "sensor-position-yaw",
+		&sensordata->pos_yaw) < 0) {
+		CAM_DBG(CAM_SENSOR, "Invalid sensor position");
+		sensordata->pos_yaw = 360;
+	}
+
+	if (of_property_read_u32(of_node, "aon-camera-id", &s_ctrl->aon_camera_id)) {
+		CAM_DBG(CAM_SENSOR, "cell_idx: %d is not used for AON usecase", soc_info->index);
+		s_ctrl->aon_camera_id = NOT_AON_CAM;
+	} else {
+		CAM_INFO(CAM_SENSOR,
+			"AON Sensor detected in cell_idx: %d aon_camera_id: %d phy_index: %d",
+			soc_info->index, s_ctrl->aon_camera_id,
+			s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY]);
+		if ((s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY] == 2) &&
+			(s_ctrl->aon_camera_id != AON_CAM2)) {
+			CAM_ERR(CAM_SENSOR, "Incorrect AON camera id for cphy_index %d",
+				s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY]);
+			s_ctrl->aon_camera_id = NOT_AON_CAM;
+		}
+		if ((s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY] == 4) &&
+			(s_ctrl->aon_camera_id != AON_CAM1)) {
+			CAM_ERR(CAM_SENSOR, "Incorrect AON camera id for cphy_index %d",
+				s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY]);
+			s_ctrl->aon_camera_id = NOT_AON_CAM;
+		}
+	}
+
+	rc = cam_sensor_util_aon_registration(
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY],
+		s_ctrl->aon_camera_id);
+	if (rc) {
+		CAM_ERR(CAM_SENSOR, "Aon registration failed, rc: %d", rc);
+		goto FREE_SENSOR_DATA;
+	}
+
+	if (!of_property_read_bool(of_node, "hw-no-ops"))
+		s_ctrl->hw_no_ops = false;
+	else
+		s_ctrl->hw_no_ops = true;
+
+	return rc;
+
+FREE_SENSOR_DATA:
+	kfree(sensordata);
+	s_ctrl->sensordata = NULL;
+
+	return rc;
+}
+
+int32_t cam_sensor_parse_dt(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t i, rc = 0;
+	struct cam_hw_soc_info *soc_info = &s_ctrl->soc_info;
+
+	/* Parse dt information and store in sensor control structure */
+	rc = cam_sensor_driver_get_dt_data(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed to get dt data rc %d", rc);
+		return rc;
+	}
+
+	/* Initialize mutex */
+	mutex_init(&(s_ctrl->cam_sensor_mutex));
+
+	/* Initialize default parameters */
+	for (i = 0; i < soc_info->num_clk; i++) {
+		soc_info->clk[i] = devm_clk_get(soc_info->dev,
+					soc_info->clk_name[i]);
+		if (IS_ERR(soc_info->clk[i])) {
+			CAM_ERR(CAM_SENSOR, "get failed for %s",
+				 soc_info->clk_name[i]);
+			rc = -ENOENT;
+			return rc;
+		} else if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_SENSOR, "%s handle is NULL skip get",
+				soc_info->clk_name[i]);
+			continue;
+		}
+	}
+	/* Initialize regulators to default parameters */
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		soc_info->rgltr[i] = devm_regulator_get(soc_info->dev,
+					soc_info->rgltr_name[i]);
+		if (IS_ERR_OR_NULL(soc_info->rgltr[i])) {
+			rc = PTR_ERR(soc_info->rgltr[i]);
+			rc = rc ? rc : -EINVAL;
+			CAM_ERR(CAM_SENSOR, "get failed for regulator %s",
+				 soc_info->rgltr_name[i]);
+			return rc;
+		}
+		CAM_DBG(CAM_SENSOR, "get for regulator %s",
+			soc_info->rgltr_name[i]);
+	}
+
+	rc = cam_sensor_util_request_power_domain(soc_info);
+
+	return rc;
+}
+
+void cam_sensor_release_power_domain(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct cam_hw_soc_info *soc_info = &s_ctrl->soc_info;
+
+	cam_sensor_util_release_power_domain(soc_info);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_SOC_H_
+#define _CAM_SENSOR_SOC_H_
+
+#include "cam_sensor_dev.h"
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * Parses sensor dt
+ */
+int cam_sensor_parse_dt(struct cam_sensor_ctrl_t *s_ctrl);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * Release power domain
+ */
+void cam_sensor_release_power_domain(struct cam_sensor_ctrl_t *s_ctrl);
+#endif /* _CAM_SENSOR_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_cci_i2c.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_cci_i2c.c
@@ -0,0 +1,328 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2018, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sensor_cmn_header.h"
+#include "cam_sensor_i2c.h"
+#include "cam_cci_dev.h"
+
+int32_t cam_cci_i2c_read(struct cam_sensor_cci_client *cci_client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	bool is_probing)
+{
+	int32_t rc = -EINVAL;
+	unsigned char buf[CAMERA_SENSOR_I2C_TYPE_DWORD];
+	struct cam_cci_ctrl cci_ctrl;
+
+	if (addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		return rc;
+
+	cci_ctrl.is_probing = is_probing;
+	cci_ctrl.cmd = MSM_CCI_I2C_READ;
+	cci_ctrl.cci_info = cci_client;
+	cci_ctrl.cfg.cci_i2c_read_cfg.addr = addr;
+	cci_ctrl.cfg.cci_i2c_read_cfg.addr_type = addr_type;
+	cci_ctrl.cfg.cci_i2c_read_cfg.data_type = data_type;
+	cci_ctrl.cfg.cci_i2c_read_cfg.data = buf;
+	cci_ctrl.cfg.cci_i2c_read_cfg.num_byte = data_type;
+	rc = v4l2_subdev_call(cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	if (rc < 0) {
+		if (is_probing)
+			CAM_INFO(CAM_SENSOR, "rc = %d", rc);
+		else
+			CAM_ERR(CAM_SENSOR, "rc = %d", rc);
+		return rc;
+	}
+
+	rc = cci_ctrl.status;
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE)
+		*data = buf[0];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD)
+		*data = buf[0] << 8 | buf[1];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B)
+		*data = buf[0] << 16 | buf[1] << 8 | buf[2];
+	else
+		*data = buf[0] << 24 | buf[1] << 16 |
+			buf[2] << 8 | buf[3];
+
+	return rc;
+}
+
+int32_t cam_camera_cci_i2c_read_seq(struct cam_sensor_cci_client *cci_client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t num_byte)
+{
+	int32_t                    rc = -EFAULT;
+	unsigned char             *buf = NULL;
+	int                        i = 0;
+	struct cam_cci_ctrl        cci_ctrl;
+
+	if ((addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		|| (data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		|| (num_byte > I2C_REG_DATA_MAX)) {
+		CAM_ERR(CAM_SENSOR, "addr_type %d num_byte %d", addr_type,
+			num_byte);
+		return rc;
+	}
+
+	buf = kzalloc(num_byte, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	cci_ctrl.cmd = MSM_CCI_I2C_READ;
+	cci_ctrl.cci_info = cci_client;
+	cci_ctrl.cfg.cci_i2c_read_cfg.addr = addr;
+	cci_ctrl.cfg.cci_i2c_read_cfg.addr_type = addr_type;
+	cci_ctrl.cfg.cci_i2c_read_cfg.data_type = data_type;
+	cci_ctrl.cfg.cci_i2c_read_cfg.data = buf;
+	cci_ctrl.cfg.cci_i2c_read_cfg.num_byte = num_byte;
+	cci_ctrl.status = -EFAULT;
+	rc = v4l2_subdev_call(cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "CCI config failed rc = %d", rc);
+		goto end;
+	}
+	rc = cci_ctrl.status;
+	CAM_DBG(CAM_SENSOR, "addr = 0x%x, rc = %d", addr, rc);
+	for (i = 0; i < num_byte; i++) {
+		data[i] = buf[i];
+		CAM_DBG(CAM_SENSOR, "Byte %d: Data: 0x%x\n", i, data[i]);
+	}
+
+end:
+	kfree(buf);
+	return rc;
+}
+
+static int32_t cam_cci_i2c_write_table_cmd(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	enum cam_cci_cmd_type cmd)
+{
+	int32_t rc = -EINVAL;
+	struct cam_cci_ctrl cci_ctrl;
+
+	if (!client || !write_setting)
+		return rc;
+
+	if (write_setting->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| write_setting->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		return rc;
+
+	cci_ctrl.cmd = cmd;
+	cci_ctrl.cci_info = client->cci_client;
+	cci_ctrl.cfg.cci_i2c_write_cfg.reg_setting =
+		write_setting->reg_setting;
+	cci_ctrl.cfg.cci_i2c_write_cfg.data_type = write_setting->data_type;
+	cci_ctrl.cfg.cci_i2c_write_cfg.addr_type = write_setting->addr_type;
+	cci_ctrl.cfg.cci_i2c_write_cfg.size = write_setting->size;
+	rc = v4l2_subdev_call(client->cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed rc = %d", rc);
+		return rc;
+	}
+	rc = cci_ctrl.status;
+	if (write_setting->delay > 20)
+		msleep(write_setting->delay);
+	else if (write_setting->delay)
+		usleep_range(write_setting->delay * 1000, (write_setting->delay
+			* 1000) + 1000);
+
+	return rc;
+}
+
+
+int32_t cam_cci_i2c_write_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	return cam_cci_i2c_write_table_cmd(client, write_setting,
+		MSM_CCI_I2C_WRITE);
+}
+
+int32_t cam_cci_i2c_write_continuous_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag)
+{
+	int32_t rc = 0;
+
+	if (cam_sensor_i2c_write_flag == CAM_SENSOR_I2C_WRITE_BURST)
+		rc = cam_cci_i2c_write_table_cmd(client, write_setting,
+			MSM_CCI_I2C_WRITE_BURST);
+	else if (cam_sensor_i2c_write_flag == CAM_SENSOR_I2C_WRITE_SEQ)
+		rc = cam_cci_i2c_write_table_cmd(client, write_setting,
+			MSM_CCI_I2C_WRITE_SEQ);
+
+	return rc;
+}
+
+static int32_t cam_cci_i2c_compare(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type data_type,
+	enum camera_sensor_i2c_type addr_type)
+{
+	int32_t rc;
+	uint32_t reg_data = 0;
+
+	rc = cam_cci_i2c_read(client, addr, &reg_data,
+		addr_type, data_type, false);
+	if (rc < 0)
+		return rc;
+
+	reg_data = reg_data & 0xFFFF;
+	if (data == (reg_data & ~data_mask)) {
+		CAM_DBG(CAM_SENSOR,
+			"POLL Success match : Addr=0x%x reg_data 0x%x: data: 0x%x, data_mask: 0x%x",
+			addr, reg_data, data, data_mask);
+		return I2C_COMPARE_MATCH;
+	}
+	else {
+		CAM_WARN_RATE_LIMIT(CAM_SENSOR,
+			"mismatch: Addr=0x%x reg_data 0x%x: data: 0x%x, data_mask: 0x%x",
+			addr, reg_data, data, data_mask);
+		return I2C_COMPARE_MISMATCH;
+	}
+}
+
+int32_t cam_cci_i2c_poll(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type data_type,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t delay_ms)
+{
+	int32_t rc = -EINVAL;
+	int32_t i = 0;
+
+	CAM_DBG(CAM_SENSOR, "addr: 0x%x data: 0x%x dt: %d",
+		addr, data, data_type);
+
+	if (delay_ms > MAX_POLL_DELAY_MS) {
+		CAM_ERR(CAM_SENSOR, "invalid delay = %d max_delay = %d",
+			delay_ms, MAX_POLL_DELAY_MS);
+		return -EINVAL;
+	}
+	for (i = 0; i < delay_ms; i++) {
+		rc = cam_cci_i2c_compare(client,
+			addr, data, data_mask, data_type, addr_type);
+		if (!rc)
+			return rc;
+
+		usleep_range(1000, 1010);
+	}
+
+	/* If rc is 1 then read is successful but poll is failure */
+	if (rc == 1)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d(non-fatal)",	rc);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d", rc);
+
+	return rc;
+}
+
+int32_t cam_sensor_cci_i2c_util(struct camera_io_master *client,
+	uint16_t cci_cmd)
+{
+	int32_t rc = 0;
+	struct cam_cci_ctrl cci_ctrl;
+
+	if (!client) {
+		CAM_ERR(CAM_SENSOR, "Master clinet Null pointer");
+		return -EINVAL;
+	}
+
+	cci_ctrl.cmd = cci_cmd;
+	cci_ctrl.cci_info = client->cci_client;
+	rc = v4l2_subdev_call(client->cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed rc = %d", rc);
+		return rc;
+	}
+	return cci_ctrl.status;
+}
+
+int32_t cam_cci_i2c_read_append_write(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *rd_append_write_setting)
+{
+	int32_t rc = 0;
+	struct cam_cci_ctrl cci_ctrl;
+
+	if (rd_append_write_setting->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| rd_append_write_setting->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| rd_append_write_setting->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| rd_append_write_setting->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		return rc;
+
+	cci_ctrl.cmd = MSM_CCI_I2C_READ_APPEND_WRITE;
+	cci_ctrl.cci_info = client->cci_client;
+	cci_ctrl.cfg.cci_i2c_write_cfg.reg_setting =
+		rd_append_write_setting->reg_setting;
+	cci_ctrl.cfg.cci_i2c_write_cfg.data_type = rd_append_write_setting->data_type;
+	cci_ctrl.cfg.cci_i2c_write_cfg.addr_type = rd_append_write_setting->addr_type;
+	cci_ctrl.cfg.cci_i2c_write_cfg.size = rd_append_write_setting->size;
+
+	rc = v4l2_subdev_call(client->cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed rc = %d", rc);
+		return rc;
+	}
+
+	rc = cci_ctrl.status;
+	if (rd_append_write_setting->delay > 20)
+		msleep(rd_append_write_setting->delay);
+	else if (rd_append_write_setting->delay)
+		usleep_range(rd_append_write_setting->delay * 1000, (rd_append_write_setting->delay
+			* 1000) + 1000);
+
+	return rc;
+}
+
+
+int32_t cam_cci_i2c_sequential_xfer(
+	struct camera_io_master *io_master_info,
+	struct cam_cmd_i2c_sequential_xfer *seq_xfer)
+{
+	int32_t rc = 0;
+	uint32_t reg_data = 0;
+	struct cam_cci_ctrl cci_ctrl;
+
+	if (seq_xfer->cmd_type != CAMERA_SENSOR_CMD_TYPE_I2C_SEQUENTIAL_XFER_LOCK
+		&& seq_xfer->cmd_type != CAMERA_SENSOR_CMD_TYPE_I2C_SEQUENTIAL_XFER_UNLOCK) {
+			CAM_ERR(CAM_SENSOR, "Invalid cmd_type=%d", seq_xfer->cmd_type);
+		return -EINVAL;
+	}
+
+	cci_ctrl.cmd = ((seq_xfer->cmd_type == CAMERA_SENSOR_CMD_TYPE_I2C_SEQUENTIAL_XFER_LOCK) ?
+		MSM_CCI_I2C_SEQUENTIAL_XFER_LOCK : MSM_CCI_I2C_SEQUENTIAL_XFER_UNLOCK);
+	cci_ctrl.cci_info = io_master_info->cci_client;
+
+	rc = v4l2_subdev_call(io_master_info->cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed rc = %d", rc);
+		return rc;
+	}
+
+	rc = cci_ctrl.status;
+	/*Lock unlock will not have delay */
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_i2c.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_i2c.h
@@ -0,0 +1,192 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_I2C_H_
+#define _CAM_SENSOR_I2C_H_
+
+#include <linux/delay.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_sensor.h>
+#include "cam_cci_dev.h"
+#include "cam_sensor_io.h"
+
+#define I2C_POLL_TIME_MS 5
+#define MAX_POLL_DELAY_MS 250
+
+#define I2C_COMPARE_MATCH 0
+#define I2C_COMPARE_MISMATCH 1
+
+#define I2C_REG_DATA_MAX (20*1024)
+
+/**
+ * @client: CCI client structure
+ * @data: I2C data
+ * @addr_type: I2c address type
+ * @data_type: I2C data type
+ * @is_probing: Is probing a sensor
+ *
+ * This API handles CCI read
+ */
+int32_t cam_cci_i2c_read(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	bool is_probing);
+
+/**
+ * @client: CCI client structure
+ * @addr: I2c address
+ * @data: I2C data
+ * @addr_type: I2c address type
+ * @data_type: I2c data type
+ * @num_byte: number of bytes
+ *
+ * This API handles CCI sequential read
+ */
+int32_t cam_camera_cci_i2c_read_seq(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t num_byte);
+
+/**
+ * @client: CCI client structure
+ * @write_setting: I2C register setting
+ *
+ * This API handles CCI random write
+ */
+int32_t cam_cci_i2c_write_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+/**
+ * @client: CCI client structure
+ * @write_setting: I2C register setting
+ * @cam_sensor_i2c_write_flag: burst or seq write
+ *
+ * This API handles CCI continuous write
+ */
+int32_t cam_cci_i2c_write_continuous_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag);
+
+/**
+ * @client: IO_Master client structure
+ * @cci_cmd: CCI command type
+ *
+ * Does I2C call to I2C functionalities
+ */
+int32_t cam_sensor_cci_i2c_util(
+	struct camera_io_master *client,
+	uint16_t cci_cmd);
+
+/**
+ * @client: CCI client structure
+ * @addr: I2C address
+ * @data: I2C data
+ * @data_mask: I2C data mask
+ * @data_type: I2C data type
+ * @addr_type: I2C addr type
+ * @delay_ms: Delay in milli seconds
+ *
+ * This API implements CCI based I2C poll
+ */
+int32_t cam_cci_i2c_poll(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type data_type,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t delay_ms);
+
+/**
+ * @client: CCI client structure
+ * @rd_append_write_setting: I2C reg settings
+ *
+ * This API implements CCI read append write
+ */
+int32_t cam_cci_i2c_read_append_write(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *rd_append_write_setting);
+
+
+int32_t cam_cci_i2c_sequential_xfer(
+	struct camera_io_master *io_master_info,
+	struct cam_cmd_i2c_sequential_xfer *seq_xfer);
+
+/**
+ * cam_qup_i2c_read : QUP based i2c read
+ * @client    : QUP I2C client structure
+ * @data      : I2C data
+ * @addr_type : I2c address type
+ * @data_type : I2C data type
+ *
+ * This API handles QUP I2C read
+ */
+
+int32_t cam_qup_i2c_read(struct i2c_client *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type);
+
+/**
+ * cam_qup_i2c_read_seq : QUP based I2C sequential read
+ * @client    : QUP I2C client structure
+ * @data      : I2C data
+ * @addr_type : I2c address type
+ * @num_bytes : number of bytes to read
+ * This API handles QUP I2C Sequential read
+ */
+
+int32_t cam_qup_i2c_read_seq(struct i2c_client *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte);
+
+/**
+ * cam_qup_i2c_poll : QUP based I2C poll operation
+ * @client    : QUP I2C client structure
+ * @addr      : I2C address
+ * @data      : I2C data
+ * @data_mask : I2C data mask
+ * @data_type : I2C data type
+ * @addr_type : I2C addr type
+ * @delay_ms  : Delay in milli seconds
+ *
+ * This API implements QUP based I2C poll
+ */
+
+int32_t cam_qup_i2c_poll(struct i2c_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms);
+
+/**
+ * cam_qup_i2c_write_table : QUP based I2C write random
+ * @client        : QUP I2C client structure
+ * @write_setting : I2C register settings
+ *
+ * This API handles QUP I2C random write
+ */
+
+int32_t cam_qup_i2c_write_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+/**
+ * cam_qup_i2c_write_continuous_write: QUP based I2C write continuous(Burst/Seq)
+ * @client: QUP I2C client structure
+ * @write_setting: I2C register setting
+ * @cam_sensor_i2c_write_flag: burst or seq write
+ *
+ * This API handles QUP continuous write
+ */
+int32_t cam_qup_i2c_write_continuous_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag);
+
+#endif /*_CAM_SENSOR_I2C_H*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_i3c.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_i3c.h
@@ -0,0 +1,79 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_I3C_H_
+#define _CAM_SENSOR_I3C_H_
+
+#include <linux/delay.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_sensor.h>
+#include <linux/i3c/device.h>
+#include "cam_sensor_io.h"
+
+/**
+ * cam_qup_i3c_read : This API handles QUP I3C read operations
+ * @client    : QUP IeC client structure
+ * @data      : I3C data
+ * @addr_type : I3C address type
+ * @data_type : I3C data type
+ */
+
+int cam_qup_i3c_read(struct i3c_device *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type);
+
+/**
+ * cam_qup_i3c_read_seq : This API handles QUP I3C Sequential read operations
+ * @client    : QUP I3C client structure
+ * @data      : I3C data
+ * @addr_type : I3C address type
+ * @num_bytes : Number of bytes to read
+ */
+
+int cam_qup_i3c_read_seq(struct i3c_device *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte);
+
+/**
+ * cam_qup_i3c_poll : This API handles QUP based I3C poll operation
+ * @client    : QUP I3C client structure
+ * @addr      : I3C address
+ * @data      : I3C data
+ * @data_mask : I3C data mask
+ * @data_type : I3C data type
+ * @addr_type : I3C addr type
+ * @delay_ms  : Delay in milli seconds
+ */
+
+int cam_qup_i3c_poll(struct i3c_device *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms);
+
+/**
+ * cam_qup_i3c_write_table : This API Handles QUP based I3C write random operations
+ * @client        : QUP I3C client structure
+ * @write_setting : I3C register settings
+ */
+
+int cam_qup_i3c_write_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+/**
+ * cam_qup_i3c_write_continuous_write: This API Handles QUP based I3C write continuous(Burst/Seq)
+ * @client: QUP I3C client structure
+ * @write_setting: I3C register setting
+ * @cam_sensor_i3c_write_flag: burst or seq write
+ */
+int cam_qup_i3c_write_continuous_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i3c_write_flag);
+
+#endif /*_CAM_SENSOR_I3C_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.c
@@ -0,0 +1,308 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sensor_io.h"
+#include "cam_sensor_i2c.h"
+#include "cam_sensor_i3c.h"
+#include <linux/pm_runtime.h>
+
+int32_t camera_io_dev_poll(struct camera_io_master *io_master_info,
+	uint32_t addr, uint16_t data, uint32_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms)
+{
+	int16_t mask = data_mask & 0xFF;
+
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	switch (io_master_info->master_type) {
+	case CCI_MASTER:
+		return cam_cci_i2c_poll(io_master_info->cci_client,
+			addr, data, mask, data_type, addr_type, delay_ms);
+	case I2C_MASTER:
+		return cam_qup_i2c_poll(io_master_info->client,
+			addr, data, data_mask, addr_type, data_type, delay_ms);
+	case I3C_MASTER:
+		return cam_qup_i3c_poll(io_master_info->i3c_client,
+			addr, data, data_mask, addr_type, data_type, delay_ms);
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type: %d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+}
+
+int32_t camera_io_dev_erase(struct camera_io_master *io_master_info,
+	uint32_t addr, uint32_t size)
+{
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (size == 0)
+		return 0;
+
+	switch (io_master_info->master_type) {
+	case SPI_MASTER:
+		CAM_DBG(CAM_SENSOR, "Calling SPI Erase");
+		return cam_spi_erase(io_master_info, addr, CAMERA_SENSOR_I2C_TYPE_WORD, size);
+	case I2C_MASTER:
+	case CCI_MASTER:
+	case I3C_MASTER:
+		CAM_ERR(CAM_SENSOR, "Erase not supported on Master Type: %d",
+			io_master_info->master_type);
+		return -EINVAL;
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type: %d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+}
+
+int32_t camera_io_dev_read(struct camera_io_master *io_master_info,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	bool is_probing)
+{
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	switch (io_master_info->master_type) {
+	case SPI_MASTER:
+		return cam_spi_read(io_master_info, addr, data, addr_type, data_type);
+	case I2C_MASTER:
+		return cam_qup_i2c_read(io_master_info->client,
+			addr, data, addr_type, data_type);
+	case CCI_MASTER:
+		return cam_cci_i2c_read(io_master_info->cci_client,
+			addr, data, addr_type, data_type, is_probing);
+	case I3C_MASTER:
+		return cam_qup_i3c_read(io_master_info->i3c_client,
+			addr, data, addr_type, data_type);
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type: %d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+}
+
+int32_t camera_io_dev_read_seq(struct camera_io_master *io_master_info,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type, int32_t num_bytes)
+{
+	switch (io_master_info->master_type) {
+	case CCI_MASTER:
+		return cam_camera_cci_i2c_read_seq(io_master_info->cci_client,
+			addr, data, addr_type, data_type, num_bytes);
+	case I2C_MASTER:
+		return cam_qup_i2c_read_seq(io_master_info->client,
+			addr, data, addr_type, num_bytes);
+	case SPI_MASTER:
+		return cam_spi_read_seq(io_master_info, addr, data, addr_type, num_bytes);
+	case I3C_MASTER:
+		return cam_qup_i3c_read_seq(io_master_info->i3c_client,
+			addr, data, addr_type, num_bytes);
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type: %d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+}
+
+int32_t camera_io_dev_write(struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	if (!write_setting || !io_master_info) {
+		CAM_ERR(CAM_SENSOR,
+			"Input parameters not valid ws: %pK ioinfo: %pK",
+			write_setting, io_master_info);
+		return -EINVAL;
+	}
+
+	if (!write_setting->reg_setting) {
+		CAM_ERR(CAM_SENSOR, "Invalid Register Settings");
+		return -EINVAL;
+	}
+
+	switch (io_master_info->master_type) {
+	case CCI_MASTER:
+		return cam_cci_i2c_write_table(io_master_info, write_setting);
+	case I2C_MASTER:
+		return cam_qup_i2c_write_table(io_master_info, write_setting);
+	case SPI_MASTER:
+		return cam_spi_write_table(io_master_info, write_setting);
+	case I3C_MASTER:
+		return cam_qup_i3c_write_table(io_master_info, write_setting);
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type:%d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+}
+
+int32_t camera_io_dev_read_append_write(
+	struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+
+	if (!write_setting || !io_master_info) {
+		CAM_ERR(CAM_SENSOR,
+			"Input parameters not valid ws: %pK ioinfo: %pK",
+			write_setting, io_master_info);
+		return -EINVAL;
+	}
+
+	if (!write_setting->reg_setting) {
+		CAM_ERR(CAM_SENSOR, "Invalid Register Settings");
+		return -EINVAL;
+	}
+
+	switch (io_master_info->master_type) {
+	case CCI_MASTER:
+		return cam_cci_i2c_read_append_write(io_master_info, write_setting);
+	case I2C_MASTER:
+	case SPI_MASTER:
+	case I3C_MASTER:
+		CAM_ERR(CAM_SENSOR, "Read append write only supported in CCI Master");
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type:%d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+}
+
+int32_t camera_io_dev_sequential_xfer(struct camera_io_master *io_master_info,
+	struct cam_cmd_i2c_sequential_xfer *seq_xfer)
+{
+	if (!seq_xfer || !io_master_info) {
+		CAM_ERR(CAM_SENSOR,
+			"Input parameters not valid ws: %pK ioinfo: %pK",
+			seq_xfer, io_master_info);
+		return -EINVAL;
+	}
+
+	switch (io_master_info->master_type) {
+	case CCI_MASTER:
+		return cam_cci_i2c_sequential_xfer(io_master_info, seq_xfer);
+	case I2C_MASTER:
+	case SPI_MASTER:
+	case I3C_MASTER:
+		CAM_ERR(CAM_SENSOR, "Sequential Lock/Unlock only supported in CCI Master");
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type:%d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+
+}
+
+int32_t camera_io_dev_write_continuous(struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag)
+{
+	if (!write_setting || !io_master_info) {
+		CAM_ERR(CAM_SENSOR,
+			"Input parameters not valid ws: %pK ioinfo: %pK",
+			write_setting, io_master_info);
+		return -EINVAL;
+	}
+
+	if (!write_setting->reg_setting) {
+		CAM_ERR(CAM_SENSOR, "Invalid Register Settings");
+		return -EINVAL;
+	}
+
+	switch (io_master_info->master_type) {
+	case CCI_MASTER:
+		return cam_cci_i2c_write_continuous_table(io_master_info,
+			write_setting, cam_sensor_i2c_write_flag);
+	case I2C_MASTER:
+		return cam_qup_i2c_write_continuous_table(io_master_info,
+			write_setting, cam_sensor_i2c_write_flag);
+	case SPI_MASTER:
+		return cam_spi_write_table(io_master_info, write_setting);
+	case I3C_MASTER:
+		return cam_qup_i3c_write_continuous_table(io_master_info,
+			write_setting, cam_sensor_i2c_write_flag);
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type:%d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+}
+
+int32_t camera_io_init(struct camera_io_master *io_master_info)
+{
+	int rc = 0;
+
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	switch (io_master_info->master_type) {
+	case CCI_MASTER:
+		io_master_info->cci_client->cci_subdev = cam_cci_get_subdev(
+										io_master_info->cci_client->cci_device);
+		return cam_sensor_cci_i2c_util(io_master_info, MSM_CCI_INIT);
+	case I2C_MASTER:
+	case I3C_MASTER:
+		if ((io_master_info->client != NULL) &&
+			(io_master_info->client->adapter != NULL)) {
+			CAM_DBG(CAM_SENSOR, "%s:%d: Calling get_sync",
+				__func__, __LINE__);
+			rc = pm_runtime_get_sync(io_master_info->client->adapter->dev.parent);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "Failed to get sync rc: %d", rc);
+				return -EINVAL;
+			}
+		}
+		return 0;
+	case SPI_MASTER:
+		return 0;
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type:%d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+}
+
+int32_t camera_io_release(struct camera_io_master *io_master_info)
+{
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	switch (io_master_info->master_type) {
+	case CCI_MASTER:
+		return cam_sensor_cci_i2c_util(io_master_info, MSM_CCI_RELEASE);
+	case I2C_MASTER:
+	case I3C_MASTER:
+		if ((io_master_info->client != NULL) &&
+			(io_master_info->client->adapter != NULL)) {
+			CAM_DBG(CAM_SENSOR, "%s:%d: Calling put_sync",
+				__func__, __LINE__);
+			pm_runtime_put_sync(io_master_info->client->adapter->dev.parent);
+		}
+		return 0;
+	case SPI_MASTER:
+		return 0;
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Master Type:%d", io_master_info->master_type);
+	}
+
+	return -EINVAL;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.h
@@ -0,0 +1,143 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_IO_H_
+#define _CAM_SENSOR_IO_H_
+
+#include <media/cam_sensor.h>
+#include "cam_sensor_cmn_header.h"
+
+/* Master Types */
+#define CCI_MASTER           1
+#define I2C_MASTER           2
+#define SPI_MASTER           3
+#define I3C_MASTER           4
+
+/**
+ * @master_type: CCI master type
+ * @i2c_client: I2C client information structure
+ * @i3c_client: I3C client information structure
+ * @cci_client: CCI client information structure
+ * @spi_client: SPI client information structure
+ */
+struct camera_io_master {
+	int master_type;
+	struct i2c_client *client;
+	struct i3c_device *i3c_client;
+	struct cam_sensor_cci_client *cci_client;
+	struct cam_sensor_spi_client *spi_client;
+};
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @addr: I2C address
+ * @data: I2C data
+ * @addr_type: I2C addr_type
+ * @data_type: I2C data type
+ * @is_probing: Is probing a sensor
+ *
+ * This API abstracts read functionality based on master type
+ */
+int32_t camera_io_dev_read(struct camera_io_master *io_master_info,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	bool is_probing);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @addr: I2C address
+ * @data: I2C data
+ * @addr_type: I2C addr type
+ * @data_type: I2C data type
+ * @num_bytes: number of bytes
+ *
+ * This API abstracts read functionality based on master type
+ */
+int32_t camera_io_dev_read_seq(struct camera_io_master *io_master_info,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	int32_t num_bytes);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ *
+ * This API initializes the I2C/SPI master based on master type
+ */
+int32_t camera_io_init(struct camera_io_master *io_master_info);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ *
+ * This API releases the I2C/SPI master based on master type
+ */
+int32_t camera_io_release(struct camera_io_master *io_master_info);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @write_setting: write settings information
+ *
+ * This API abstracts write functionality based on master type
+ */
+int32_t camera_io_dev_write(struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @write_setting: write settings information
+ * @cam_sensor_i2c_write_flag: differentiate between burst & seq
+ *
+ * This API abstracts write functionality based on master type and
+ * write flag for continuous write
+ */
+int32_t camera_io_dev_write_continuous(struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag);
+
+int32_t camera_io_dev_erase(struct camera_io_master *io_master_info,
+	uint32_t addr, uint32_t size);
+/**
+ * @io_master_info: I2C/SPI master information
+ * @addr: I2C address
+ * @data: I2C data
+ * @data_mask: I2C data mask
+ * @data_type: I2C data type
+ * @addr_type: I2C address type
+ * @delay_ms: delay in milli seconds
+ *
+ * This API abstracts poll functionality based on master type
+ */
+int32_t camera_io_dev_poll(struct camera_io_master *io_master_info,
+	uint32_t addr, uint16_t data, uint32_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @addr: write_setting: I2C reg write settings
+ *
+ * This API abstracts dev CCI read append write
+ */
+int32_t camera_io_dev_read_append_write(
+	struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @addr: seq_xfer: I2C reg write settings
+ *
+ * This API abstracts dev CCI lock/unlock write
+ */
+int32_t camera_io_dev_sequential_xfer(struct camera_io_master *io_master_info,
+	struct cam_cmd_i2c_sequential_xfer *seq_xfer);
+
+#include "cam_sensor_i2c.h"
+#include "cam_sensor_spi.h"
+#include "cam_sensor_i3c.h"
+
+#endif /* _CAM_SENSOR_IO_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_qup_i2c.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_qup_i2c.c
@@ -0,0 +1,594 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sensor_cmn_header.h"
+#include "cam_sensor_i2c.h"
+#include "cam_sensor_io.h"
+
+#define I2C_REG_MAX_BUF_SIZE   8
+
+static int i2c_lookahead_en = 1;
+module_param(i2c_lookahead_en, uint, 0644);
+MODULE_PARM_DESC(i2c_lookahead_en,
+	"Flag to enable/disable BURST/Lookahead register packing for I2C QUP");
+
+static int32_t cam_qup_i2c_rxdata(
+	struct i2c_client *dev_client, unsigned char *rxdata,
+	enum camera_sensor_i2c_type addr_type,
+	int data_length)
+{
+	int32_t rc = 0;
+	uint16_t saddr = dev_client->addr >> 1;
+	int i2c_msg_size = 2;
+	struct i2c_msg msgs[] = {
+		{
+			.addr  = saddr,
+			.flags = 0,
+			.len   = addr_type,
+			.buf   = rxdata,
+		},
+		{
+			.addr  = saddr,
+			.flags = I2C_M_RD,
+			.len   = data_length,
+			.buf   = rxdata,
+		},
+	};
+	rc = i2c_transfer(dev_client->adapter, msgs, i2c_msg_size);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed 0x%x", saddr);
+		return rc;
+	}
+
+	if (rc == i2c_msg_size)
+		rc = 0;
+	else {
+		CAM_ERR(CAM_SENSOR, "i2c transfer failed, i2c_msg_size:%d rc:%d",
+			i2c_msg_size, rc);
+		rc = -EIO;
+	}
+
+	return rc;
+}
+
+static inline void  cam_qup_i2c_txdata_fill(
+	struct camera_io_master *dev_client, unsigned char *txdata,
+	uint16_t length, struct i2c_msg *msgs, int curr_mindx)
+{
+	msgs[curr_mindx].addr =  dev_client->client->addr >> 1;
+	msgs[curr_mindx].flags = 0;
+	msgs[curr_mindx].len = length;
+	msgs[curr_mindx].buf = txdata;
+}
+
+static int32_t cam_qup_i2c_txdata(
+	struct camera_io_master *dev_client, unsigned char *txdata,
+	uint16_t length)
+{
+	int32_t rc = 0;
+	uint16_t saddr = dev_client->client->addr >> 1;
+	int i2c_msg_size = 1;
+	struct i2c_msg msg[] = {
+		{
+			.addr = saddr,
+			.flags = 0,
+			.len = length,
+			.buf = txdata,
+		 },
+	};
+	rc = i2c_transfer(dev_client->client->adapter, msg, i2c_msg_size);
+	if (rc == i2c_msg_size)
+		rc = 0;
+	else {
+		CAM_ERR(CAM_SENSOR, "i2c transfer failed, i2c_msg_size:%d rc:%d",
+			i2c_msg_size, rc);
+		rc = -EIO;
+	}
+
+	return rc;
+}
+
+int32_t cam_qup_i2c_read(struct i2c_client *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	int32_t rc = -EINVAL;
+	unsigned char *buf = NULL;
+
+	if (addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| data_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr/data_type verfication");
+		return rc;
+	}
+
+	buf = kzalloc(addr_type + data_type, GFP_KERNEL);
+
+	if (!buf)
+		return -ENOMEM;
+
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = addr >> 8;
+		buf[1] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = addr >> 16;
+		buf[1] = addr >> 8;
+		buf[2] = addr;
+	} else {
+		buf[0] = addr >> 24;
+		buf[1] = addr >> 16;
+		buf[2] = addr >> 8;
+		buf[3] = addr;
+	}
+
+	rc = cam_qup_i2c_rxdata(client, buf, addr_type, data_type);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+		goto read_fail;
+	}
+
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE)
+		*data = buf[0];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD)
+		*data = buf[0] << 8 | buf[1];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B)
+		*data = buf[0] << 16 | buf[1] << 8 | buf[2];
+	else
+		*data = buf[0] << 24 | buf[1] << 16 |
+			buf[2] << 8 | buf[3];
+
+	CAM_DBG(CAM_SENSOR, "addr = 0x%x data: 0x%x", addr, *data);
+read_fail:
+	kfree(buf);
+	buf = NULL;
+	return rc;
+}
+
+int32_t cam_qup_i2c_read_seq(struct i2c_client *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte)
+{
+	int32_t rc = -EFAULT;
+	unsigned char *buf = NULL;
+	int i;
+
+	if (addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr_type verification");
+		return rc;
+	}
+
+	if ((num_byte == 0) || (num_byte > I2C_REG_DATA_MAX)) {
+		CAM_ERR(CAM_SENSOR, "num_byte:0x%x max supported:0x%x",
+			num_byte, I2C_REG_DATA_MAX);
+		return rc;
+	}
+
+	buf = kzalloc(addr_type + num_byte, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = addr >> BITS_PER_BYTE;
+		buf[1] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = addr >> 16;
+		buf[1] = addr >> 8;
+		buf[2] = addr;
+	} else {
+		buf[0] = addr >> 24;
+		buf[1] = addr >> 16;
+		buf[2] = addr >> 8;
+		buf[3] = addr;
+	}
+
+	rc = cam_qup_i2c_rxdata(client, buf, addr_type, num_byte);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+		goto read_seq_fail;
+	}
+
+	for (i = 0; i < num_byte; i++)
+		data[i] = buf[i];
+
+read_seq_fail:
+	kfree(buf);
+	buf = NULL;
+	return rc;
+}
+
+static int32_t cam_qup_i2c_compare(struct i2c_client *client,
+	uint32_t addr, uint32_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type data_type,
+	enum camera_sensor_i2c_type addr_type)
+{
+	int32_t rc;
+	uint32_t reg_data = 0;
+
+	rc = cam_qup_i2c_read(client, addr, &reg_data,
+		addr_type, data_type);
+	if (rc < 0)
+		return rc;
+
+	reg_data = reg_data & 0xFFFF;
+	if (data != (reg_data & ~data_mask))
+		return I2C_COMPARE_MISMATCH;
+
+	return I2C_COMPARE_MATCH;
+}
+
+int32_t cam_qup_i2c_poll(struct i2c_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms)
+{
+	int32_t rc = 0;
+	int i = 0;
+
+	if ((delay_ms > MAX_POLL_DELAY_MS) || (delay_ms == 0)) {
+		CAM_ERR(CAM_SENSOR, "invalid delay = %d max_delay = %d",
+			delay_ms, MAX_POLL_DELAY_MS);
+		return -EINVAL;
+	}
+
+	if ((addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| data_type >= CAMERA_SENSOR_I2C_TYPE_MAX))
+		return -EINVAL;
+
+	for (i = 0; i < delay_ms; i++) {
+		rc = cam_qup_i2c_compare(client,
+			addr, data, data_mask, data_type, addr_type);
+		if (rc == I2C_COMPARE_MATCH)
+			return rc;
+
+		usleep_range(1000, 1010);
+	}
+	/* If rc is MISMATCH then read is successful but poll is failure */
+	if (rc == I2C_COMPARE_MISMATCH)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d(non-fatal)", rc);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d", rc);
+
+	return rc;
+}
+
+static inline int32_t cam_qup_i2c_write_optimized(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	struct i2c_msg *msgs,
+	unsigned char *buf)
+{
+	int32_t rc = 0;
+	uint16_t len = 0;
+	struct cam_sensor_i2c_reg_array *reg_setting_previous = NULL;
+	uint16_t offset = 0;
+	struct cam_sensor_i2c_reg_array *reg_setting;
+	enum camera_sensor_i2c_type addr_type;
+	enum camera_sensor_i2c_type data_type;
+	bool isLookAhead = false;
+	int curr_mindx = 0;
+	int i = 0;
+
+	if (!client || !write_setting)
+		return -EINVAL;
+
+	reg_setting = write_setting->reg_setting;
+	addr_type =  write_setting->addr_type;
+	data_type = write_setting->data_type;
+
+	while (i < write_setting->size) {
+		CAM_DBG(CAM_SENSOR, "reg addr = 0x%x data type: %d",
+			reg_setting->reg_addr, data_type);
+
+		if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+			buf[offset] = reg_setting->reg_addr;
+			CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[offset]);
+			offset += 1;
+			len = 1;
+		} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+			buf[offset] = reg_setting->reg_addr >> 8;
+			buf[offset + 1] = reg_setting->reg_addr;
+			CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[offset]);
+			CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len+1, buf[offset+1]);
+			offset += 2;
+			len = 2;
+		} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+			buf[offset] = reg_setting->reg_addr >> 16;
+			buf[offset+1] = reg_setting->reg_addr >> 8;
+			buf[offset+2] = reg_setting->reg_addr;
+			offset += 3;
+			len = 3;
+		} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+			buf[offset] = reg_setting->reg_addr >> 24;
+			buf[offset+1] = reg_setting->reg_addr >> 16;
+			buf[offset+2] = reg_setting->reg_addr >> 8;
+			buf[offset+3] = reg_setting->reg_addr;
+			offset += 4;
+			len = 4;
+		} else {
+			CAM_ERR(CAM_SENSOR, "Invalid I2C addr type");
+			rc = -EINVAL;
+			return rc;
+		}
+
+		do {
+			CAM_DBG(CAM_SENSOR, "reg addr: 0x%x Data: 0x%x",
+				reg_setting->reg_addr, reg_setting->reg_data);
+			if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+				buf[offset] = reg_setting->reg_data;
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[offset]);
+				offset += 1;
+				len += 1;
+			} else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+				buf[offset] = reg_setting->reg_data >> 8;
+				buf[offset+1] = reg_setting->reg_data;
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[offset]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+1, buf[offset+1]);
+				offset += 2;
+				len += 2;
+			} else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+				buf[offset] = reg_setting->reg_data >> 16;
+				buf[offset + 1] = reg_setting->reg_data >> 8;
+				buf[offset + 2] = reg_setting->reg_data;
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[offset]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+1, buf[offset+1]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+2, buf[offset+2]);
+				offset += 3;
+				len += 3;
+			} else if (data_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+				buf[offset] = reg_setting->reg_data >> 24;
+				buf[offset + 1] = reg_setting->reg_data >> 16;
+				buf[offset + 2] = reg_setting->reg_data >> 8;
+				buf[offset + 3] = reg_setting->reg_data;
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[offset]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+1, buf[offset+1]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+2, buf[offset+2]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+3, buf[offset+3]);
+				offset += 4;
+				len += 4;
+			} else {
+				CAM_ERR(CAM_SENSOR, "Invalid Data Type");
+				rc = -EINVAL;
+				return rc;
+			}
+			reg_setting_previous = reg_setting;
+			i++;
+			if (i < write_setting->size) {
+				reg_setting++;
+				isLookAhead =
+					((reg_setting_previous->reg_addr + 1) ==
+					 reg_setting->reg_addr) ? true : false;
+			} else {
+				break;
+			}
+
+			if (i2c_lookahead_en == 0)
+				isLookAhead = false;
+
+		} while (isLookAhead);
+
+		CAM_DBG(CAM_SENSOR, "offset: %d len: %d curr_mindx: %d",
+			offset, len, curr_mindx);
+		cam_qup_i2c_txdata_fill(client, &buf[offset - len], len, msgs, curr_mindx);
+
+		len = 0;
+		curr_mindx++;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Original reg writes: %d optimized Writes: %d",
+		write_setting->size, curr_mindx);
+	return curr_mindx;
+}
+
+int32_t cam_qup_i2c_write_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	int32_t rc = -EINVAL;
+	struct i2c_msg *msgs = NULL;
+	unsigned char *buf = NULL;
+	int i2c_msg_size = 0;
+
+	if (!client || !write_setting)
+		return rc;
+
+	msgs = kcalloc(write_setting->size, sizeof(struct i2c_msg), GFP_KERNEL);
+	if (!msgs) {
+		CAM_ERR(CAM_SENSOR, "Message Buffer memory allocation failed");
+		return -ENOMEM;
+	}
+
+	buf = kzalloc(write_setting->size*I2C_REG_MAX_BUF_SIZE, GFP_KERNEL|GFP_DMA);
+	if (!buf) {
+		CAM_ERR(CAM_SENSOR, "Buffer memory allocation failed");
+		kfree(msgs);
+		return -ENOMEM;
+	}
+
+	if ((write_setting->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| (write_setting->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX))) {
+		rc = -EINVAL;
+		goto deallocate_buffer;
+	}
+
+	i2c_msg_size = cam_qup_i2c_write_optimized(client, write_setting, msgs, buf);
+	if (i2c_msg_size < 0) {
+		rc = i2c_msg_size;
+		goto deallocate_buffer;
+	}
+
+	rc = i2c_transfer(client->client->adapter, msgs, i2c_msg_size);
+	if (write_setting->delay > 20)
+		msleep(write_setting->delay);
+	else if (write_setting->delay)
+		usleep_range(write_setting->delay * 1000, (write_setting->delay
+			* 1000) + 1000);
+
+	if (rc == i2c_msg_size)
+		rc = 0;
+	else {
+		CAM_ERR(CAM_SENSOR, "i2c transfer failed, i2c_msg_size:%d rc:%d",
+			i2c_msg_size, rc);
+		rc = -EIO;
+	}
+
+deallocate_buffer:
+	kfree(buf);
+	kfree(msgs);
+
+	return rc;
+}
+
+static int32_t cam_qup_i2c_write_burst(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	int i;
+	int32_t rc = 0;
+	uint16_t len = 0;
+	unsigned char *buf = NULL;
+	struct cam_sensor_i2c_reg_array *reg_setting;
+	enum camera_sensor_i2c_type addr_type;
+	enum camera_sensor_i2c_type data_type;
+
+	buf = kzalloc((write_setting->addr_type +
+			(write_setting->size * write_setting->data_type)),
+			GFP_KERNEL);
+
+	if (!buf) {
+		CAM_ERR(CAM_SENSOR, "BUF is NULL");
+		return -ENOMEM;
+	}
+
+	reg_setting = write_setting->reg_setting;
+	addr_type = write_setting->addr_type;
+	data_type = write_setting->data_type;
+
+	CAM_DBG(CAM_SENSOR, "reg addr = 0x%x data type: %d",
+			reg_setting->reg_addr, data_type);
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = reg_setting->reg_addr;
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[len]);
+		len = 1;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = reg_setting->reg_addr >> 8;
+		buf[1] = reg_setting->reg_addr;
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[len]);
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len+1, buf[len+1]);
+		len = 2;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = reg_setting->reg_addr >> 16;
+		buf[1] = reg_setting->reg_addr >> 8;
+		buf[2] = reg_setting->reg_addr;
+		len = 3;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+		buf[0] = reg_setting->reg_addr >> 24;
+		buf[1] = reg_setting->reg_addr >> 16;
+		buf[2] = reg_setting->reg_addr >> 8;
+		buf[3] = reg_setting->reg_addr;
+		len = 4;
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid I2C addr type");
+		rc = -EINVAL;
+		goto free_res;
+	}
+
+	for (i = 0; i < write_setting->size; i++) {
+		if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+			buf[len] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			len += 1;
+		} else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+			buf[len] = reg_setting->reg_data >> 8;
+			buf[len+1] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+1, buf[len+1]);
+			len += 2;
+		} else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+			buf[len] = reg_setting->reg_data >> 16;
+			buf[len + 1] = reg_setting->reg_data >> 8;
+			buf[len + 2] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+1, buf[len+1]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+2, buf[len+2]);
+			len += 3;
+		} else if (data_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+			buf[len] = reg_setting->reg_data >> 24;
+			buf[len + 1] = reg_setting->reg_data >> 16;
+			buf[len + 2] = reg_setting->reg_data >> 8;
+			buf[len + 3] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+1, buf[len+1]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+2, buf[len+2]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+3, buf[len+3]);
+			len += 4;
+		} else {
+			CAM_ERR(CAM_SENSOR, "Invalid Data Type");
+			rc = -EINVAL;
+			goto free_res;
+		}
+		reg_setting++;
+	}
+
+	if (len > (write_setting->addr_type +
+		(write_setting->size * write_setting->data_type))) {
+		CAM_ERR(CAM_SENSOR, "Invalid Length: %u | Expected length: %u",
+			len, (write_setting->addr_type +
+			(write_setting->size * write_setting->data_type)));
+		rc = -EINVAL;
+		goto free_res;
+	}
+
+	rc = cam_qup_i2c_txdata(client, buf, len);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+
+free_res:
+	kfree(buf);
+	return rc;
+}
+
+int32_t cam_qup_i2c_write_continuous_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_settings,
+	uint8_t cam_sensor_i2c_write_flag)
+{
+	int32_t rc = 0;
+
+	if (!client || !write_settings)
+		return -EINVAL;
+
+	if ((write_settings->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_settings->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| (write_settings->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_settings->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)))
+		return -EINVAL;
+
+	if (cam_sensor_i2c_write_flag == CAM_SENSOR_I2C_WRITE_BURST)
+		rc = cam_qup_i2c_write_burst(client, write_settings);
+	else if (cam_sensor_i2c_write_flag == CAM_SENSOR_I2C_WRITE_SEQ)
+		rc = cam_qup_i2c_write_burst(client, write_settings);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_qup_i3c.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_qup_i3c.c
@@ -0,0 +1,593 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sensor_i3c.h"
+#include "cam_sensor_io.h"
+
+#define I3C_REG_MAX_BUF_SIZE   8
+
+static int i3c_lookahead_en = 1;
+module_param(i3c_lookahead_en, uint, 0644);
+MODULE_PARM_DESC(i3c_lookahead_en,
+	"Flag to enable/disable BURST/Lookahead register packing for I3C QUP");
+
+static int cam_qup_i3c_rxdata(struct i3c_device *dev_client, unsigned char *rxdata,
+	enum camera_sensor_i2c_type addr_type, int data_length)
+{
+	int rc;
+	uint32_t us = 0;
+	struct i3c_priv_xfer read_buf[2] = {
+		{
+			.rnw = 0,
+			.len = addr_type,
+			.data.out = rxdata,
+		},
+		{
+			.rnw = 1,
+			.len = data_length,
+			.data.in = rxdata,
+		},
+	};
+
+	rc = i3c_device_do_priv_xfers(dev_client, read_buf, ARRAY_SIZE(read_buf));
+	if (rc == -ENOTCONN) {
+		while (us < CAM_I3C_DEV_PROBE_TIMEOUT_US) {
+			usleep_range(1000, 1005);
+			rc = i3c_device_do_priv_xfers(dev_client, read_buf, ARRAY_SIZE(read_buf));
+			if (rc != -ENOTCONN)
+				break;
+			us += 1000;
+		}
+
+		if (rc)
+			CAM_ERR(CAM_SENSOR, "Retry Failed i3c_read: rc = %d, us = %d", rc, us);
+	} else if (rc)
+		CAM_ERR(CAM_SENSOR, "Failed with i3c_read: rc = %d", rc);
+
+	return rc;
+}
+
+static inline void cam_qup_i3c_txdata_fill(struct camera_io_master *dev_client,
+	unsigned char *txdata, uint16_t length,
+	struct i3c_priv_xfer *msgs, int curr_mindx)
+{
+	msgs[curr_mindx].rnw = 0;
+	msgs[curr_mindx].len = length;
+	msgs[curr_mindx].data.out = txdata;
+}
+
+static int cam_qup_i3c_txdata(struct camera_io_master *dev_client, unsigned char *txdata,
+	uint16_t length)
+{
+	int rc;
+	uint32_t us = 0;
+	struct i3c_priv_xfer write_buf = {
+		.rnw = 0,
+		.len = length,
+		.data.out = txdata,
+	};
+
+	rc = i3c_device_do_priv_xfers(dev_client->i3c_client, &write_buf, 1);
+	if (rc == -ENOTCONN) {
+		while (us < CAM_I3C_DEV_PROBE_TIMEOUT_US) {
+			usleep_range(1000, 1005);
+			rc = i3c_device_do_priv_xfers(dev_client->i3c_client, &write_buf, 1);
+			if (rc != -ENOTCONN)
+				break;
+			us += 1000;
+		}
+
+		if (rc)
+			CAM_ERR(CAM_SENSOR, "Retry Failed i3c_write: rc = %d, us = %d", rc, us);
+	} else if (rc)
+		CAM_ERR(CAM_SENSOR, "Failed with i3c_write: rc = %d", rc);
+
+	return rc;
+}
+
+int cam_qup_i3c_read(struct i3c_device *client, uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	int rc;
+	unsigned char *buf;
+
+	if ((addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		|| (data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr/data_type verfication");
+		return -EINVAL;
+	}
+
+	buf = kzalloc(addr_type + data_type, GFP_DMA | GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = addr >> 8;
+		buf[1] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = addr >> 16;
+		buf[1] = addr >> 8;
+		buf[2] = addr;
+	} else {
+		buf[0] = addr >> 24;
+		buf[1] = addr >> 16;
+		buf[2] = addr >> 8;
+		buf[3] = addr;
+	}
+
+	rc = cam_qup_i3c_rxdata(client, buf, addr_type, data_type);
+	if (rc) {
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+		goto read_fail;
+	}
+
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE)
+		*data = buf[0];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD)
+		*data = (buf[0] << 8) | buf[1];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B)
+		*data = (buf[0] << 16) | (buf[1] << 8) | buf[2];
+	else
+		*data = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
+
+	CAM_DBG(CAM_SENSOR, "addr = 0x%x data: 0x%x", addr, *data);
+read_fail:
+	kfree(buf);
+	return rc;
+}
+
+int cam_qup_i3c_read_seq(struct i3c_device *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte)
+{
+	int rc;
+	unsigned char *buf;
+	int i;
+
+	if (addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr_type verification");
+		return -EFAULT;
+	}
+
+	if ((num_byte == 0) || (num_byte > I2C_REG_DATA_MAX)) {
+		CAM_ERR(CAM_SENSOR, "num_byte:0x%x max supported:0x%x",
+			num_byte, I2C_REG_DATA_MAX);
+		return -EFAULT;
+	}
+
+	buf = kzalloc(addr_type + num_byte, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = addr >> BITS_PER_BYTE;
+		buf[1] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = addr >> 16;
+		buf[1] = addr >> 8;
+		buf[2] = addr;
+	} else {
+		buf[0] = addr >> 24;
+		buf[1] = addr >> 16;
+		buf[2] = addr >> 8;
+		buf[3] = addr;
+	}
+
+	rc = cam_qup_i3c_rxdata(client, buf, addr_type, num_byte);
+	if (rc) {
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+		goto read_seq_fail;
+	}
+
+	for (i = 0; i < num_byte; i++)
+		data[i] = buf[i];
+
+read_seq_fail:
+	kfree(buf);
+	return rc;
+}
+
+static int cam_qup_i3c_compare(struct i3c_device *client,
+	uint32_t addr, uint32_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type data_type,
+	enum camera_sensor_i2c_type addr_type)
+{
+	int rc;
+	uint32_t reg_data;
+
+	rc = cam_qup_i3c_read(client, addr, &reg_data,
+		addr_type, data_type);
+	if (rc < 0)
+		return rc;
+
+	reg_data = reg_data & 0xFFFF;
+	if (data != (reg_data & ~data_mask))
+		return I2C_COMPARE_MISMATCH;
+
+	return I2C_COMPARE_MATCH;
+}
+
+int cam_qup_i3c_poll(struct i3c_device *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms)
+{
+	int rc;
+	int i;
+
+	if ((delay_ms > MAX_POLL_DELAY_MS) || (delay_ms == 0)) {
+		CAM_ERR(CAM_SENSOR, "invalid delay = %d max_delay = %d",
+			delay_ms, MAX_POLL_DELAY_MS);
+		return -EINVAL;
+	}
+
+	if ((addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| data_type >= CAMERA_SENSOR_I2C_TYPE_MAX))
+		return -EINVAL;
+
+	for (i = 0; i < delay_ms; i++) {
+		rc = cam_qup_i3c_compare(client,
+			addr, data, data_mask, data_type, addr_type);
+		if (rc == I2C_COMPARE_MATCH)
+			return rc;
+
+		usleep_range(1000, 1010);
+	}
+	/* If rc is MISMATCH then read is successful but poll is failure */
+	if (rc == I2C_COMPARE_MISMATCH)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d(non-fatal)", rc);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d", rc);
+
+	return rc;
+}
+
+static inline int32_t cam_qup_i3c_write_optimized(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	struct i3c_priv_xfer *msgs,
+	unsigned char *buf)
+{
+	int32_t rc = 0;
+	uint16_t len = 0;
+	struct cam_sensor_i2c_reg_array *reg_setting_previous = NULL;
+	uint16_t offset = 0;
+	struct cam_sensor_i2c_reg_array *reg_setting;
+	enum camera_sensor_i2c_type addr_type;
+	enum camera_sensor_i2c_type data_type;
+	bool isLookAhead = false;
+	int curr_mindx = 0;
+	int i = 0;
+
+	if (!client || !write_setting)
+		return -EINVAL;
+
+	reg_setting = write_setting->reg_setting;
+	addr_type =  write_setting->addr_type;
+	data_type = write_setting->data_type;
+
+	while (i < write_setting->size) {
+		CAM_DBG(CAM_SENSOR, "reg addr = 0x%x data type: %d",
+			reg_setting->reg_addr, data_type);
+		if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+			buf[offset] = reg_setting->reg_addr;
+			CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[offset]);
+			offset += 1;
+			len = 1;
+		} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+			buf[offset] = reg_setting->reg_addr >> 8;
+			buf[offset + 1] = reg_setting->reg_addr;
+			CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[offset]);
+			CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len+1, buf[offset+1]);
+			offset += 2;
+			len = 2;
+		} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+			buf[offset] = reg_setting->reg_addr >> 16;
+			buf[offset+1] = reg_setting->reg_addr >> 8;
+			buf[offset+2] = reg_setting->reg_addr;
+			offset += 3;
+			len = 3;
+		} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+			buf[offset] = reg_setting->reg_addr >> 24;
+			buf[offset+1] = reg_setting->reg_addr >> 16;
+			buf[offset+2] = reg_setting->reg_addr >> 8;
+			buf[offset+3] = reg_setting->reg_addr;
+			offset += 4;
+			len = 4;
+		} else {
+			CAM_ERR(CAM_SENSOR, "Invalid I2C addr type");
+			rc = -EINVAL;
+			return rc;
+
+		}
+
+		do {
+			CAM_DBG(CAM_SENSOR, "reg addr: 0x%x Data: 0x%x",
+				reg_setting->reg_addr, reg_setting->reg_data);
+
+			if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+				buf[offset] = reg_setting->reg_data;
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[offset]);
+				offset += 1;
+				len += 1;
+			} else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+				buf[offset] = reg_setting->reg_data >> 8;
+				buf[offset+1] = reg_setting->reg_data;
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[offset]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+1, buf[offset+1]);
+				offset += 2;
+				len += 2;
+			} else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+				buf[offset] = reg_setting->reg_data >> 16;
+				buf[offset + 1] = reg_setting->reg_data >> 8;
+				buf[offset + 2] = reg_setting->reg_data;
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[offset]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+1, buf[offset+1]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+2, buf[offset+2]);
+				offset += 3;
+				len += 3;
+			} else if (data_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+				buf[offset] = reg_setting->reg_data >> 24;
+				buf[offset + 1] = reg_setting->reg_data >> 16;
+				buf[offset + 2] = reg_setting->reg_data >> 8;
+				buf[offset + 3] = reg_setting->reg_data;
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[offset]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+1, buf[offset+1]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+2, buf[offset+2]);
+				CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+3, buf[offset+3]);
+				offset += 4;
+				len += 4;
+			} else {
+				CAM_ERR(CAM_SENSOR, "Invalid Data Type");
+				rc = -EINVAL;
+				return rc;
+			}
+			reg_setting_previous = reg_setting;
+			i++;
+			if (i < write_setting->size) {
+				reg_setting++;
+				isLookAhead =
+					((reg_setting_previous->reg_addr + 1) ==
+					 reg_setting->reg_addr) ? true : false;
+			} else {
+				break;
+			}
+			if (i3c_lookahead_en == 0)
+				isLookAhead = false;
+
+		} while (isLookAhead);
+
+		CAM_DBG(CAM_SENSOR, "offset: %d len: %d curr_mindx: %d",
+			offset, len, curr_mindx);
+		cam_qup_i3c_txdata_fill(client, &buf[offset - len], len, msgs, curr_mindx);
+
+		len = 0;
+		curr_mindx++;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Original reg writes: %d optimized Writes: %d",
+		write_setting->size, curr_mindx);
+	return curr_mindx;
+}
+
+int cam_qup_i3c_write_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	int rc = -EINVAL;
+	uint32_t us = 0;
+	struct i3c_priv_xfer *msgs = NULL;
+	unsigned char *buf = NULL;
+	int i3c_msg_size = 0;
+
+	if (!client || !write_setting)
+		return -EINVAL;
+
+	msgs = kcalloc(write_setting->size, sizeof(struct i3c_priv_xfer), GFP_KERNEL);
+	if (!msgs) {
+		CAM_ERR(CAM_SENSOR, "Message Buffer memory allocation failed");
+		return -ENOMEM;
+	}
+
+	buf = kzalloc(write_setting->size*I3C_REG_MAX_BUF_SIZE, GFP_KERNEL|GFP_DMA);
+	if (!buf) {
+		CAM_ERR(CAM_SENSOR, "Buffer memory allocation failed");
+		kfree(msgs);
+		return -ENOMEM;
+	}
+
+	if ((write_setting->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| (write_setting->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX))) {
+		rc = -EINVAL;
+		goto deallocate_buffer;
+	}
+
+	i3c_msg_size = cam_qup_i3c_write_optimized(client, write_setting, msgs, buf);
+	if (i3c_msg_size < 0) {
+		rc = i3c_msg_size;
+		goto deallocate_buffer;
+	}
+
+	rc = i3c_device_do_priv_xfers(client->i3c_client, msgs, i3c_msg_size);
+	if (rc == -ENOTCONN) {
+		while (us < CAM_I3C_DEV_PROBE_TIMEOUT_US) {
+			usleep_range(1000, 1005);
+			rc = i3c_device_do_priv_xfers(client->i3c_client,
+				msgs, write_setting->size);
+			if (rc != -ENOTCONN)
+				break;
+			us += 1000;
+		}
+
+		if (rc)
+			CAM_ERR(CAM_SENSOR, "Retry Failed i3c_write: rc = %d, us = %d", rc, us);
+	} else if (rc)
+		CAM_ERR(CAM_SENSOR, "Failed with i3c_write: rc = %d", rc);
+
+	if (write_setting->delay > 20)
+		msleep(write_setting->delay);
+	else if (write_setting->delay)
+		usleep_range(write_setting->delay * 1000, (write_setting->delay
+			* 1000) + 1000);
+
+deallocate_buffer:
+	kfree(buf);
+	kfree(msgs);
+
+	return rc;
+}
+
+static int cam_qup_i3c_write_burst(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	int i;
+	int rc;
+	uint16_t len = 0;
+	unsigned char *buf;
+	struct cam_sensor_i2c_reg_array *reg_setting;
+	enum camera_sensor_i2c_type addr_type;
+	enum camera_sensor_i2c_type data_type;
+
+	buf = kzalloc((write_setting->addr_type +
+			(write_setting->size * write_setting->data_type)),
+			GFP_DMA | GFP_KERNEL);
+
+	if (!buf) {
+		CAM_ERR(CAM_SENSOR, "BUF is NULL");
+		return -ENOMEM;
+	}
+
+	reg_setting = write_setting->reg_setting;
+	addr_type = write_setting->addr_type;
+	data_type = write_setting->data_type;
+
+	CAM_DBG(CAM_SENSOR, "reg addr = 0x%x data type: %d",
+			reg_setting->reg_addr, data_type);
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = reg_setting->reg_addr;
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[len]);
+		len = 1;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = reg_setting->reg_addr >> 8;
+		buf[1] = reg_setting->reg_addr;
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[len]);
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len+1, buf[len+1]);
+		len = 2;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = reg_setting->reg_addr >> 16;
+		buf[1] = reg_setting->reg_addr >> 8;
+		buf[2] = reg_setting->reg_addr;
+		len = 3;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+		buf[0] = reg_setting->reg_addr >> 24;
+		buf[1] = reg_setting->reg_addr >> 16;
+		buf[2] = reg_setting->reg_addr >> 8;
+		buf[3] = reg_setting->reg_addr;
+		len = 4;
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid I2C addr type");
+		rc = -EINVAL;
+		goto free_res;
+	}
+
+	for (i = 0; i < write_setting->size; i++) {
+		if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+			buf[len] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			len += 1;
+		} else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+			buf[len] = reg_setting->reg_data >> 8;
+			buf[len+1] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+1, buf[len+1]);
+			len += 2;
+		} else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+			buf[len] = reg_setting->reg_data >> 16;
+			buf[len + 1] = reg_setting->reg_data >> 8;
+			buf[len + 2] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+1, buf[len+1]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+2, buf[len+2]);
+			len += 3;
+		} else if (data_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+			buf[len] = reg_setting->reg_data >> 24;
+			buf[len + 1] = reg_setting->reg_data >> 16;
+			buf[len + 2] = reg_setting->reg_data >> 8;
+			buf[len + 3] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+1, buf[len+1]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+2, buf[len+2]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+3, buf[len+3]);
+			len += 4;
+		} else {
+			CAM_ERR(CAM_SENSOR, "Invalid Data Type");
+			rc = -EINVAL;
+			goto free_res;
+		}
+		reg_setting++;
+	}
+
+	if (len > (write_setting->addr_type +
+		(write_setting->size * write_setting->data_type))) {
+		CAM_ERR(CAM_SENSOR, "Invalid Length: %u | Expected length: %u",
+			len, (write_setting->addr_type +
+			(write_setting->size * write_setting->data_type)));
+		rc = -EINVAL;
+		goto free_res;
+	}
+
+	rc = cam_qup_i3c_txdata(client, buf, len);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+
+free_res:
+	kfree(buf);
+	return rc;
+}
+
+int cam_qup_i3c_write_continuous_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_settings,
+	uint8_t cam_sensor_i2c_write_flag)
+{
+	int rc = 0;
+
+	if (!client || !write_settings)
+		return -EINVAL;
+
+	if ((write_settings->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_settings->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| (write_settings->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_settings->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)))
+		return -EINVAL;
+
+	if (cam_sensor_i2c_write_flag == CAM_SENSOR_I2C_WRITE_BURST)
+		rc = cam_qup_i3c_write_burst(client, write_settings);
+	else if (cam_sensor_i2c_write_flag == CAM_SENSOR_I2C_WRITE_SEQ)
+		rc = cam_qup_i3c_write_burst(client, write_settings);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.c
@@ -0,0 +1,625 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sensor_spi.h"
+#include "cam_debug_util.h"
+
+static int cam_spi_txfr(struct spi_device *spi, char *txbuf,
+	char *rxbuf, int num_byte)
+{
+	struct spi_transfer txfr;
+	struct spi_message msg;
+
+	memset(&txfr, 0, sizeof(txfr));
+	txfr.tx_buf = txbuf;
+	txfr.rx_buf = rxbuf;
+	txfr.len = num_byte;
+	spi_message_init(&msg);
+	spi_message_add_tail(&txfr, &msg);
+
+	return spi_sync(spi, &msg);
+}
+
+static int cam_spi_txfr_read(struct spi_device *spi, char *txbuf,
+	char *rxbuf, int txlen, int rxlen)
+{
+	struct spi_transfer tx;
+	struct spi_transfer rx;
+	struct spi_message m;
+
+	memset(&tx, 0, sizeof(tx));
+	memset(&rx, 0, sizeof(rx));
+	tx.tx_buf = txbuf;
+	rx.rx_buf = rxbuf;
+	tx.len = txlen;
+	rx.len = rxlen;
+	spi_message_init(&m);
+	spi_message_add_tail(&tx, &m);
+	spi_message_add_tail(&rx, &m);
+	return spi_sync(spi, &m);
+}
+
+/**
+ * cam_set_addr() - helper function to set transfer address
+ * @addr:	device address
+ * @addr_len:	the addr field length of an instruction
+ * @type:	type (i.e. byte-length) of @addr
+ * @str:	shifted address output, must be zeroed when passed in
+ *
+ * This helper function sets @str based on the addr field length of an
+ * instruction and the data length.
+ */
+static void cam_set_addr(uint32_t addr, uint8_t addr_len,
+	enum camera_sensor_i2c_type addr_type,
+	char *str)
+{
+	if (!addr_len)
+		return;
+
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		str[0] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		str[0] = addr >> 8;
+		str[1] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		str[0] = addr >> 16;
+		str[1] = addr >> 8;
+		str[2] = addr;
+	} else {
+		str[0] = addr >> 24;
+		str[1] = addr >> 16;
+		str[2] = addr >> 8;
+		str[3] = addr;
+	}
+}
+
+/**
+ * cam_spi_tx_helper() - wrapper for SPI transaction
+ * @client:     io client
+ * @inst:       inst of this transaction
+ * @addr:       device addr following the inst
+ * @data:       output byte array (could be NULL)
+ * @num_byte:   size of @data
+ * @tx, rx:     optional transfer buffer.  It must be at least header
+ *              + @num_byte long.
+ *
+ * This is the core function for SPI transaction, except for writes.  It first
+ * checks address type, then allocates required memory for tx/rx buffers.
+ * It sends out <opcode><addr>, and optionally receives @num_byte of response,
+ * if @data is not NULL.  This function does not check for wait conditions,
+ * and will return immediately once bus transaction finishes.
+ *
+ * This function will allocate buffers of header + @num_byte long.  For
+ * large transfers, the allocation could fail.  External buffer @tx, @rx
+ * should be passed in to bypass allocation.  The size of buffer should be
+ * at least header + num_byte long.  Since buffer is managed externally,
+ * @data will be ignored, and read results will be in @rx.
+ * @tx, @rx also can be used for repeated transfers to improve performance.
+ */
+static int32_t cam_spi_tx_helper(struct camera_io_master *client,
+	struct cam_camera_spi_inst *inst, uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte, char *tx, char *rx)
+{
+	int32_t rc = -EINVAL;
+	struct spi_device *spi = client->spi_client->spi_master;
+	struct device *dev = NULL;
+	char *ctx = NULL, *crx = NULL;
+	uint32_t len, hlen;
+	uint8_t retries = client->spi_client->retries;
+	uint32_t txr = 0, rxr = 0;
+	void  *vaddr_tx = NULL;
+	void  *vaddr_rx = NULL;
+
+	hlen = cam_camera_spi_get_hlen(inst);
+	len = hlen + num_byte;
+	dev = &(spi->dev);
+
+	if (!dev) {
+		CAM_ERR(CAM_SENSOR, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (tx) {
+		ctx = tx;
+	} else {
+		txr = len;
+		vaddr_tx = vmalloc(txr);
+		if (!vaddr_tx) {
+			CAM_ERR(CAM_SENSOR,
+				 "Fail to allocate Memory: len: %u", txr);
+			return -ENOMEM;
+		}
+
+		ctx = (char *)vaddr_tx;
+	}
+
+	if (num_byte) {
+		if (rx) {
+			crx = rx;
+		} else {
+			rxr = len;
+			vaddr_rx = vmalloc(rxr);
+			if (!vaddr_rx) {
+				if (!tx)
+					vfree(vaddr_tx);
+				CAM_ERR(CAM_SENSOR,
+					"Fail to allocate memory: len: %u",
+					rxr);
+				return -ENOMEM;
+			}
+			crx = (char *)vaddr_rx;
+		}
+	} else {
+		crx = NULL;
+	}
+
+	ctx[0] = inst->opcode;
+	cam_set_addr(addr, inst->addr_len, addr_type, ctx + 1);
+	while ((rc = cam_spi_txfr(spi, ctx, crx, len)) && retries) {
+		retries--;
+		msleep(client->spi_client->retry_delay);
+	}
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "failed: spi txfr rc %d", rc);
+		goto out;
+	}
+	if (data && num_byte && !rx)
+		memcpy(data, crx + hlen, num_byte);
+
+out:
+	if (!tx) {
+		vfree(vaddr_tx);
+		vaddr_tx = NULL;
+	}
+	if (!rx) {
+		vfree(vaddr_rx);
+		vaddr_rx = NULL;
+	}
+	return rc;
+}
+
+static int32_t cam_spi_tx_read(struct camera_io_master *client,
+	struct cam_camera_spi_inst *inst, uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte, char *tx, char *rx)
+{
+	int32_t rc = -EINVAL;
+	struct spi_device *spi = client->spi_client->spi_master;
+	char *ctx = NULL, *crx = NULL;
+	uint32_t hlen;
+	uint8_t retries = client->spi_client->retries;
+
+	hlen = cam_camera_spi_get_hlen(inst);
+	if (tx) {
+		ctx = tx;
+	} else {
+		ctx = kzalloc(hlen, GFP_KERNEL | GFP_DMA);
+		if (!ctx)
+			return -ENOMEM;
+	}
+	if (num_byte) {
+		if (rx) {
+			crx = rx;
+		} else {
+			crx = kzalloc(num_byte, GFP_KERNEL | GFP_DMA);
+			if (!crx) {
+				if (!tx)
+					kfree(ctx);
+				return -ENOMEM;
+			}
+		}
+	} else {
+		crx = NULL;
+	}
+
+	ctx[0] = inst->opcode;
+	cam_set_addr(addr, inst->addr_len, addr_type, ctx + 1);
+
+	CAM_DBG(CAM_EEPROM, "tx(%u): %02x %02x %02x %02x", hlen, ctx[0],
+		ctx[1], ctx[2],	ctx[3]);
+	while ((rc = cam_spi_txfr_read(spi, ctx, crx, hlen, num_byte))
+			&& retries) {
+		retries--;
+		msleep(client->spi_client->retry_delay);
+	}
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed %d", rc);
+		goto out;
+	}
+	if (data && num_byte && !rx)
+		memcpy(data, crx, num_byte);
+out:
+	if (!tx)
+		kfree(ctx);
+	if (!rx)
+		kfree(crx);
+	return rc;
+}
+
+int cam_spi_read(struct camera_io_master *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	int rc = -EINVAL;
+	uint8_t temp[CAMERA_SENSOR_I2C_TYPE_MAX];
+
+	if (addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| data_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr/data_type verification");
+		return rc;
+	}
+
+	rc = cam_spi_tx_read(client,
+		&client->spi_client->cmd_tbl.read, addr, &temp[0],
+		addr_type, data_type, NULL, NULL);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed %d", rc);
+		return rc;
+	}
+
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE)
+		*data = temp[0];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD)
+		*data = (temp[0] << BITS_PER_BYTE) | temp[1];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B)
+		*data = (temp[0] << 16 | temp[1] << 8 | temp[2]);
+	else
+		*data = (temp[0] << 24 | temp[1] << 16 | temp[2] << 8 |
+			temp[3]);
+
+	CAM_DBG(CAM_SENSOR, "addr 0x%x, data %u", addr, *data);
+	return rc;
+}
+
+int32_t cam_spi_read_seq(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type, int32_t num_bytes)
+{
+	if ((addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX)) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr_type verification");
+		return -EINVAL;
+	}
+
+	if (num_bytes == 0) {
+		CAM_ERR(CAM_SENSOR, "num_byte: 0x%x", num_bytes);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Read Seq addr: 0x%x NB:%d",
+		addr, num_bytes);
+	return cam_spi_tx_helper(client,
+		&client->spi_client->cmd_tbl.read_seq, addr, data,
+		addr_type, num_bytes, NULL, NULL);
+}
+
+int cam_spi_query_id(struct camera_io_master *client,
+	uint32_t addr, enum camera_sensor_i2c_type addr_type,
+	uint8_t *data, uint32_t num_byte)
+{
+	CAM_DBG(CAM_SENSOR, "SPI Queryid : 0x%x, addr: 0x%x",
+		client->spi_client->cmd_tbl.query_id, addr);
+	return cam_spi_tx_helper(client,
+		&client->spi_client->cmd_tbl.query_id,
+		addr, data, addr_type, num_byte, NULL, NULL);
+}
+
+static int32_t cam_spi_read_status_reg(
+	struct camera_io_master *client, uint8_t *status,
+	enum camera_sensor_i2c_type addr_type)
+{
+	struct cam_camera_spi_inst *rs =
+		&client->spi_client->cmd_tbl.read_status;
+
+	if (rs->addr_len != 0) {
+		CAM_ERR(CAM_SENSOR, "not implemented yet");
+		return -ENXIO;
+	}
+	return cam_spi_tx_helper(client, rs, 0, status,
+		addr_type, 1, NULL, NULL);
+}
+
+static int32_t cam_spi_device_busy(struct camera_io_master *client,
+	uint8_t *busy, enum camera_sensor_i2c_type addr_type)
+{
+	int rc;
+	uint8_t st = 0;
+
+	rc = cam_spi_read_status_reg(client, &st, addr_type);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed to read status reg");
+		return rc;
+	}
+	*busy = st & client->spi_client->busy_mask;
+	return 0;
+}
+
+static int32_t cam_spi_wait(struct camera_io_master *client,
+	struct cam_camera_spi_inst *inst,
+	enum camera_sensor_i2c_type addr_type)
+{
+	uint8_t busy;
+	int i, rc;
+
+	CAM_DBG(CAM_SENSOR, "op 0x%x wait start", inst->opcode);
+	for (i = 0; i < inst->delay_count; i++) {
+		rc = cam_spi_device_busy(client, &busy, addr_type);
+		if (rc < 0)
+			return rc;
+		if (!busy)
+			break;
+		msleep(inst->delay_intv);
+		CAM_DBG(CAM_SENSOR, "op 0x%x wait", inst->opcode);
+	}
+	if (i > inst->delay_count) {
+		CAM_ERR(CAM_SENSOR, "op %x timed out", inst->opcode);
+		return -ETIMEDOUT;
+	}
+	CAM_DBG(CAM_SENSOR, "op %x finished", inst->opcode);
+	return 0;
+}
+
+static int32_t cam_spi_write_enable(struct camera_io_master *client,
+	enum camera_sensor_i2c_type addr_type)
+{
+	struct cam_camera_spi_inst *we =
+		&client->spi_client->cmd_tbl.write_enable;
+	int rc;
+
+	if (we->opcode == 0)
+		return 0;
+	if (we->addr_len != 0) {
+		CAM_ERR(CAM_SENSOR, "not implemented yet");
+		return -EINVAL;
+	}
+	rc = cam_spi_tx_helper(client, we, 0, NULL, addr_type,
+		0, NULL, NULL);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "write enable failed");
+	return rc;
+}
+
+/**
+ * cam_spi_page_program() - core function to perform write
+ * @client: need for obtaining SPI device
+ * @addr: address to program on device
+ * @data: data to write
+ * @len: size of data
+ * @tx: tx buffer, size >= header + len
+ *
+ * This function performs SPI write, and has no boundary check.  Writing range
+ * should not cross page boundary, or data will be corrupted.  Transaction is
+ * guaranteed to be finished when it returns.  This function should never be
+ * used outside cam_spi_write_seq().
+ */
+static int32_t cam_spi_page_program(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint16_t len, uint8_t *tx)
+{
+	int rc;
+	struct cam_camera_spi_inst *pg =
+		&client->spi_client->cmd_tbl.page_program;
+	struct spi_device *spi = client->spi_client->spi_master;
+	uint8_t retries = client->spi_client->retries;
+	uint8_t header_len = sizeof(pg->opcode) + pg->addr_len + pg->dummy_len;
+
+	CAM_DBG(CAM_SENSOR, "addr 0x%x, size 0x%x", addr, len);
+	rc = cam_spi_write_enable(client, addr_type);
+	if (rc < 0)
+		return rc;
+	memset(tx, 0, header_len);
+	tx[0] = pg->opcode;
+	cam_set_addr(addr, pg->addr_len, addr_type, tx + 1);
+	memcpy(tx + header_len, data, len);
+	CAM_DBG(CAM_SENSOR, "tx(%u): %02x %02x %02x %02x",
+		len, tx[0], tx[1], tx[2], tx[3]);
+	do {
+		rc = spi_write(spi, tx, len + header_len);
+		if (rc) {
+			if (retries == 0) {
+				break;
+			} else {
+				retries--;
+				cam_spi_wait(client, pg, addr_type);
+				msleep(client->spi_client->retry_delay);
+			}
+		}
+	} while (rc);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed %d", rc);
+		return rc;
+	}
+	rc = cam_spi_wait(client, pg, addr_type);
+		return rc;
+}
+
+int cam_spi_write(struct camera_io_master *client,
+	uint32_t addr, uint32_t data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	struct cam_camera_spi_inst *pg =
+		&client->spi_client->cmd_tbl.page_program;
+	uint8_t header_len = sizeof(pg->opcode) + pg->addr_len + pg->dummy_len;
+	uint16_t len = 0;
+	char buf[CAMERA_SENSOR_I2C_TYPE_MAX];
+	char *tx;
+	int rc = -EINVAL;
+
+	if ((addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		|| (data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (data_type >= CAMERA_SENSOR_I2C_TYPE_MAX))
+		return rc;
+
+	CAM_DBG(CAM_EEPROM, "Data: 0x%x", data);
+	len = header_len + (uint8_t)data_type;
+	tx = kmalloc(len, GFP_KERNEL | GFP_DMA);
+	if (!tx)
+		goto NOMEM;
+
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = data;
+		CAM_DBG(CAM_EEPROM, "Byte %d: 0x%x", len, buf[0]);
+	} else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = (data >> BITS_PER_BYTE) & 0x00FF;
+		buf[1] = (data & 0x00FF);
+	} else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = (data >> 16) & 0x00FF;
+		buf[1] = (data >> 8) & 0x00FF;
+		buf[2] = (data & 0x00FF);
+	} else {
+		buf[0] = (data >> 24) & 0x00FF;
+		buf[1] = (data >> 16) & 0x00FF;
+		buf[2] = (data >> 8) & 0x00FF;
+		buf[3] = (data & 0x00FF);
+	}
+
+	rc = cam_spi_page_program(client, addr, buf,
+		addr_type, data_type, tx);
+	if (rc < 0)
+		goto ERROR;
+	goto OUT;
+NOMEM:
+	CAM_ERR(CAM_SENSOR, "memory allocation failed");
+	return -ENOMEM;
+ERROR:
+	CAM_ERR(CAM_SENSOR, "error write");
+OUT:
+	kfree(tx);
+	return rc;
+}
+
+int32_t cam_spi_write_seq(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type, uint32_t num_byte)
+{
+	struct cam_camera_spi_inst *pg =
+		&client->spi_client->cmd_tbl.page_program;
+	const uint32_t page_size = client->spi_client->page_size;
+	uint8_t header_len = sizeof(pg->opcode) + pg->addr_len + pg->dummy_len;
+	uint16_t len;
+	uint32_t cur_len, end;
+	char *tx, *pdata = data;
+	int rc = -EINVAL;
+
+	if ((addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) ||
+		(addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID))
+		return rc;
+    /* single page write */
+	if ((addr % page_size) + num_byte <= page_size) {
+		len = header_len + num_byte;
+		tx = kmalloc(len, GFP_KERNEL | GFP_DMA);
+		if (!tx)
+			goto NOMEM;
+		rc = cam_spi_page_program(client, addr, data, addr_type,
+			num_byte, tx);
+		if (rc < 0)
+			goto ERROR;
+		goto OUT;
+	}
+	/* multi page write */
+	len = header_len + page_size;
+	tx = kmalloc(len, GFP_KERNEL | GFP_DMA);
+	if (!tx)
+		goto NOMEM;
+	while (num_byte) {
+		end = min(page_size, (addr % page_size) + num_byte);
+		cur_len = end - (addr % page_size);
+		CAM_ERR(CAM_SENSOR, "Addr: 0x%x curr_len: 0x%x pgSize: %d",
+			addr, cur_len, page_size);
+		rc = cam_spi_page_program(client, addr, pdata, addr_type,
+			cur_len, tx);
+		if (rc < 0)
+			goto ERROR;
+		addr += cur_len;
+		pdata += cur_len;
+		num_byte -= cur_len;
+	}
+	goto OUT;
+NOMEM:
+	pr_err("%s: memory allocation failed\n", __func__);
+	return -ENOMEM;
+ERROR:
+	pr_err("%s: error write\n", __func__);
+OUT:
+	kfree(tx);
+	return rc;
+}
+
+int cam_spi_write_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	int i;
+	int rc = -EFAULT;
+	struct cam_sensor_i2c_reg_array *reg_setting;
+
+	if (!client || !write_setting)
+		return rc;
+
+	if ((write_setting->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (write_setting->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		|| (write_setting->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (write_setting->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX))
+		return rc;
+
+	reg_setting = write_setting->reg_setting;
+	for (i = 0; i < write_setting->size; i++) {
+		CAM_DBG(CAM_SENSOR, "addr %x data %x",
+			reg_setting->reg_addr, reg_setting->reg_data);
+		rc = cam_spi_write(client,
+			reg_setting->reg_addr, reg_setting->reg_data,
+			write_setting->addr_type, write_setting->data_type);
+		if (rc < 0)
+			break;
+		reg_setting++;
+	}
+		if (write_setting->delay > 20)
+			msleep(write_setting->delay);
+		else if (write_setting->delay)
+			usleep_range(write_setting->delay * 1000,
+			(write_setting->delay
+			* 1000) + 1000);
+	return rc;
+}
+
+int cam_spi_erase(struct camera_io_master *client, uint32_t addr,
+	enum camera_sensor_i2c_type addr_type, uint32_t size)
+{
+	struct cam_camera_spi_inst *se = &client->spi_client->cmd_tbl.erase;
+	int rc = 0;
+	uint32_t cur;
+	uint32_t end = addr + size;
+	uint32_t erase_size = client->spi_client->erase_size;
+
+	end = addr + size;
+	for (cur = rounddown(addr, erase_size); cur < end; cur += erase_size) {
+		CAM_ERR(CAM_SENSOR, "%s: erasing 0x%x size: %d\n",
+			__func__, cur, erase_size);
+		rc = cam_spi_write_enable(client, addr_type);
+		if (rc < 0)
+			return rc;
+		rc = cam_spi_tx_helper(client, se, cur, NULL, addr_type, 0,
+			NULL, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "%s: erase failed\n", __func__);
+			return rc;
+		}
+		rc = cam_spi_wait(client, se, addr_type);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "%s: erase timedout\n", __func__);
+			return rc;
+		}
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.h
@@ -0,0 +1,103 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_SPI_H_
+#define _CAM_SENSOR_SPI_H_
+
+#include <linux/spi/spi.h>
+#include <linux/cma.h>
+#include <media/cam_sensor.h>
+#include "cam_sensor_i2c.h"
+
+#define MAX_SPI_SIZE 110
+#define SPI_DYNAMIC_ALLOC
+
+struct cam_camera_spi_inst {
+	uint8_t opcode;
+	uint8_t addr_len;
+	uint8_t dummy_len;
+	uint8_t delay_intv;
+	uint8_t delay_count;
+};
+
+struct cam_spi_write_burst_data {
+	u8 data_msb;
+	u8 data_lsb;
+};
+
+struct cam_spi_write_burst_packet {
+	u8 cmd;
+	u8 addr_msb;
+	u8 addr_lsb;
+	struct cam_spi_write_burst_data data_arr[MAX_SPI_SIZE];
+};
+
+struct cam_camera_burst_info {
+	uint32_t burst_addr;
+	uint32_t burst_start;
+	uint32_t burst_len;
+	uint32_t chunk_size;
+};
+
+struct cam_camera_spi_inst_tbl {
+	struct cam_camera_spi_inst read;
+	struct cam_camera_spi_inst read_seq;
+	struct cam_camera_spi_inst query_id;
+	struct cam_camera_spi_inst page_program;
+	struct cam_camera_spi_inst write_enable;
+	struct cam_camera_spi_inst read_status;
+	struct cam_camera_spi_inst erase;
+};
+
+struct cam_sensor_spi_client {
+	struct spi_device *spi_master;
+	struct cam_camera_spi_inst_tbl cmd_tbl;
+	uint8_t device_id0;
+	uint8_t device_id1;
+	uint8_t mfr_id0;
+	uint8_t mfr_id1;
+	uint8_t retry_delay;
+	uint8_t retries;
+	uint8_t busy_mask;
+	uint16_t page_size;
+	uint32_t erase_size;
+};
+static __always_inline
+uint16_t cam_camera_spi_get_hlen(struct cam_camera_spi_inst *inst)
+{
+	return sizeof(inst->opcode) + inst->addr_len + inst->dummy_len;
+}
+
+int cam_spi_read(struct camera_io_master *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type);
+
+int cam_spi_read_seq(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	int32_t num_bytes);
+
+int cam_spi_query_id(struct camera_io_master *client,
+	uint32_t addr,
+	enum camera_sensor_i2c_type addr_type,
+	uint8_t *data, uint32_t num_byte);
+
+int cam_spi_write(struct camera_io_master *client,
+	uint32_t addr, uint32_t data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type);
+
+int cam_spi_write_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+int cam_spi_erase(struct camera_io_master *client,
+	uint32_t addr, enum camera_sensor_i2c_type addr_type,
+	uint32_t size);
+
+int cam_spi_write_seq(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type, uint32_t num_byte);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_module_debug.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_module_debug.c
@@ -0,0 +1,320 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <media/cam_sensor.h>
+#include "cam_debug_util.h"
+#include "cam_sensor_cmn_header.h"
+#include "cam_sensor_io.h"
+#include "cam_sensor_i2c.h"
+#include "cam_actuator_dev.h"
+#include "cam_eeprom_dev.h"
+#include "cam_flash_dev.h"
+#include "cam_ois_dev.h"
+#include "cam_sensor_dev.h"
+
+#define RW_BUFFER_SIZE          3000
+#define LINE_BUFFER_SIZE        150
+#define NUM_OF_READ_PARAMS      5
+#define NUM_OF_WRITE_PARAMS     7
+#define USAGE_STRING   "Read format: r/R, reg_addr(hex), addr_type, "\
+			       "data_type, device_type, instance_id (ID pair)\n"\
+			       "Write format: w/W, reg_addr(hex), addr_type, "\
+			       "reg_value(hex), delay, addr_type, data_type, device_type, "\
+				   "instance_id (ID pair)\n"
+
+struct cam_sensor_i2c_devices {
+	struct cam_actuator_ctrl_t *actuator[MAX_CAMERAS];
+	struct cam_eeprom_ctrl_t   *eeprom[MAX_CAMERAS];
+	struct cam_flash_ctrl      *flash[MAX_CAMERAS];
+	struct cam_ois_ctrl_t      *ois[MAX_CAMERAS];
+	struct cam_sensor_ctrl_t   *sensor[MAX_CAMERAS];
+	int num_actuator;
+	int num_eeprom;
+	int num_flash;
+	int num_ois;
+	int num_sensor;
+};
+
+static struct dentry *debugfs_root;
+static char in_buffer[RW_BUFFER_SIZE], out_buffer[RW_BUFFER_SIZE];
+static struct cam_sensor_i2c_devices devices = {0};
+
+struct camera_io_master *cam_sensor_module_get_io_master(
+	int device_type, int instance_number, bool *is_on)
+{
+	struct camera_io_master *io_master = NULL;
+	*is_on = false;
+
+	switch (device_type) {
+	case CAM_SENSOR_ACTUATOR:
+		io_master = instance_number >= devices.num_actuator ? NULL :
+			&devices.actuator[instance_number]->io_master_info;
+		if (io_master)
+			*is_on = devices.actuator[instance_number]->cam_act_state ==
+				CAM_ACTUATOR_CONFIG ? true : false;
+		break;
+	case CAM_SENSOR_EEPROM:
+		io_master = instance_number >= devices.num_eeprom ? NULL :
+			&devices.eeprom[instance_number]->io_master_info;
+		if (io_master)
+			*is_on = devices.eeprom[instance_number]->cam_eeprom_state ==
+				CAM_EEPROM_CONFIG ? true : false;
+		break;
+	case CAM_SENSOR_FLASH:
+		io_master = instance_number >= devices.num_flash ? NULL :
+			&devices.flash[instance_number]->io_master_info;
+		if (io_master)
+			*is_on = devices.flash[instance_number]->flash_state >=
+				CAM_FLASH_STATE_CONFIG ? true : false;
+		break;
+	case CAM_SENSOR_OIS:
+		io_master = instance_number >= devices.num_ois ? NULL :
+			&devices.ois[instance_number]->io_master_info;
+		if (io_master)
+			*is_on = devices.ois[instance_number]->cam_ois_state >=
+				CAM_OIS_CONFIG ? true : false;
+		break;
+	case CAM_SENSOR_DEVICE:
+		io_master = instance_number >= devices.num_sensor ? NULL :
+			&devices.sensor[instance_number]->io_master_info;
+		if (io_master)
+			*is_on = devices.sensor[instance_number]->sensor_state >=
+				CAM_SENSOR_ACQUIRE ? true : false;
+		break;
+	default:
+		CAM_WARN(CAM_SENSOR, "Unrecognized sensor device type: %d", device_type);
+		break;
+	}
+
+	return io_master;
+}
+
+static int cam_sensor_module_parse_line(const char *p_line,
+	struct cam_sensor_i2c_reg_setting *reg_list,
+	struct camera_io_master **io_master, bool *is_read,
+	bool *power_state)
+{
+	int device_type, instance_number, rc;
+	struct cam_sensor_i2c_reg_array *reg_array = reg_list->reg_setting;
+
+	if (!strlen(p_line))
+		return -EINVAL;
+
+	CAM_DBG(CAM_SENSOR, "Sensor debugfs string: %s", p_line);
+
+	if (p_line[0] == 'r' || p_line[0] == 'R') {
+		*is_read = true;
+
+		rc = sscanf(p_line+2, "%x,%d,%d,%d,%d",
+			&reg_array->reg_addr, &reg_list->addr_type, &reg_list->data_type,
+			&device_type, &instance_number);
+		if (rc == NUM_OF_READ_PARAMS) {
+			*io_master = cam_sensor_module_get_io_master(
+				device_type, instance_number, power_state);
+			return 0;
+		}
+	} else if (p_line[0] == 'w'  || p_line[0] == 'W') {
+		*is_read = false;
+
+		rc = sscanf(p_line+2, "%x,%x,%u,%d,%d,%d,%d",
+			&reg_array->reg_addr,  &reg_array->reg_data, &reg_array->delay,
+			&reg_list->addr_type, &reg_list->data_type,
+			&device_type, &instance_number);
+		if (rc == NUM_OF_WRITE_PARAMS) {
+			*io_master = cam_sensor_module_get_io_master(
+				device_type, instance_number, power_state);
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+static void cam_sensor_get_device_status(int offset)
+{
+	int i;
+	char line_buffer[LINE_BUFFER_SIZE], *start = out_buffer + offset;
+
+	for (i = 0; i < devices.num_actuator; i++) {
+		snprintf(line_buffer, LINE_BUFFER_SIZE,
+			"Device: %s, \t %u, state: %d, ID(device_type, instance_number): %d, %d\n",
+		devices.actuator[i]->device_name, devices.actuator[i]->soc_info.index,
+		devices.actuator[i]->cam_act_state, CAM_SENSOR_ACTUATOR, i);
+		strlcat(start, line_buffer, RW_BUFFER_SIZE - offset);
+	}
+	memset(line_buffer, '\0', LINE_BUFFER_SIZE);
+	for (i = 0; i < devices.num_eeprom; i++) {
+		snprintf(line_buffer, LINE_BUFFER_SIZE,
+			"Device: %s, \t\t %u, state: %d, ID(device_type, instance_number): %d, %d\n",
+		devices.eeprom[i]->device_name, devices.eeprom[i]->soc_info.index,
+		devices.eeprom[i]->cam_eeprom_state, CAM_SENSOR_EEPROM, i);
+		strlcat(start, line_buffer, RW_BUFFER_SIZE - offset);
+	}
+	memset(line_buffer, '\0', LINE_BUFFER_SIZE);
+	for (i = 0; i < devices.num_flash; i++) {
+		snprintf(line_buffer, LINE_BUFFER_SIZE,
+			"Device: %s, \t\t %u, state: %d, ID(device_type, instance_number): %d, %d\n",
+		devices.flash[i]->device_name, devices.flash[i]->soc_info.index,
+		devices.flash[i]->flash_state, CAM_SENSOR_FLASH, i);
+		strlcat(start, line_buffer, RW_BUFFER_SIZE - offset);
+	}
+	memset(line_buffer, '\0', LINE_BUFFER_SIZE);
+	for (i = 0; i < devices.num_ois; i++) {
+		snprintf(line_buffer, LINE_BUFFER_SIZE,
+			"Device: %s, \t\t %u, state: %d, ID(device_type, instance_number): %d, %d\n",
+		devices.ois[i]->device_name, devices.ois[i]->soc_info.index,
+		devices.ois[i]->cam_ois_state, CAM_SENSOR_OIS, i);
+		strlcat(start, line_buffer, RW_BUFFER_SIZE - offset);
+	}
+	memset(line_buffer, '\0', LINE_BUFFER_SIZE);
+	for (i = 0; i  < devices.num_sensor; i++) {
+		snprintf(line_buffer, LINE_BUFFER_SIZE,
+			"Device: %s, \t\t %u, state: %d, ID(device_type, instance_number): %d, %d\n",
+		devices.sensor[i]->sensor_name, devices.sensor[i]->soc_info.index,
+		devices.sensor[i]->sensor_state, CAM_SENSOR_DEVICE, i);
+		strlcat(start, line_buffer, RW_BUFFER_SIZE - offset);
+	}
+	memset(line_buffer, '\0', LINE_BUFFER_SIZE);
+}
+
+static ssize_t i2c_read(struct file *t_file, char __user *t_char,
+	size_t t_size_t, loff_t *t_loff_t)
+{
+	ssize_t count;
+
+	count = simple_read_from_buffer(t_char, t_size_t,
+		t_loff_t, out_buffer, RW_BUFFER_SIZE);
+	memset(out_buffer, '\0', RW_BUFFER_SIZE);
+
+	return count;
+}
+
+static ssize_t i2c_write(struct file *t_file, const char __user *t_char,
+	size_t t_size_t, loff_t *t_loff_t)
+{
+	ssize_t bytes_written = 0, rc = 0;
+	struct cam_sensor_i2c_reg_setting read_write;
+	struct cam_sensor_i2c_reg_array   reg_array;
+	struct camera_io_master *io_master = NULL;
+	char line_buffer[LINE_BUFFER_SIZE];
+	bool is_read, power_state;
+
+	memset(out_buffer, '\0', RW_BUFFER_SIZE);
+	memset(line_buffer, '\0', LINE_BUFFER_SIZE);
+	read_write.reg_setting = &reg_array;
+
+	bytes_written = simple_write_to_buffer(in_buffer, RW_BUFFER_SIZE - 1,
+		t_loff_t, t_char, t_size_t);
+
+	/* Turn it into a C string */
+	in_buffer[bytes_written + 1] = '\0';
+
+	rc = cam_sensor_module_parse_line(in_buffer, &read_write,
+		&io_master, &is_read, &power_state);
+
+	if (!rc) {
+		if (!power_state) {
+			snprintf(line_buffer, LINE_BUFFER_SIZE, "Dev not on");
+			goto end;
+		}
+		if (!is_read) {
+			read_write.size = 1;
+			rc = camera_io_dev_write(io_master, &read_write);
+			if (rc) {
+				snprintf(line_buffer, LINE_BUFFER_SIZE,
+					"Error: 0x%X, 0x%X, rc: %d\n",
+					read_write.reg_setting->reg_addr,
+					read_write.reg_setting->reg_data, rc);
+				strlcat(out_buffer, line_buffer, RW_BUFFER_SIZE);
+			}
+		} else {
+			rc = camera_io_dev_read(io_master,
+				read_write.reg_setting->reg_addr,
+				&read_write.reg_setting->reg_data, read_write.addr_type,
+				read_write.data_type, false);
+			if (!rc)
+				snprintf(line_buffer, LINE_BUFFER_SIZE, "Read data: 0x%X\n",
+					read_write.reg_setting->reg_data);
+			else
+				snprintf(line_buffer, LINE_BUFFER_SIZE, "Error, rc: %d\n", rc);
+			strlcat(out_buffer, line_buffer, RW_BUFFER_SIZE);
+		}
+	} else {
+		strscpy(out_buffer, USAGE_STRING, RW_BUFFER_SIZE);
+		cam_sensor_get_device_status(strlen(USAGE_STRING));
+	}
+
+end:
+	return bytes_written;
+}
+
+const struct file_operations i2c_operations = {
+	.open = simple_open,
+	.read = i2c_read,
+	.write = i2c_write,
+};
+
+void cam_sensor_module_add_i2c_device(void *ctrl_struct, int device_type)
+{
+	if (!cam_debugfs_available())
+		return;
+
+	CAM_INFO(CAM_SENSOR, "Adding device type: %d", device_type);
+
+	switch (device_type) {
+	case CAM_SENSOR_ACTUATOR:
+		devices.actuator[devices.num_actuator++] =
+			(struct cam_actuator_ctrl_t *) ctrl_struct;
+		break;
+	case CAM_SENSOR_EEPROM:
+		devices.eeprom[devices.num_eeprom++] =
+			(struct cam_eeprom_ctrl_t *) ctrl_struct;
+		break;
+	case CAM_SENSOR_FLASH:
+		devices.flash[devices.num_flash++] =
+			(struct cam_flash_ctrl *) ctrl_struct;
+		break;
+	case CAM_SENSOR_OIS:
+		devices.ois[devices.num_ois++] =
+			(struct cam_ois_ctrl_t *) ctrl_struct;
+		break;
+	case CAM_SENSOR_DEVICE:
+		devices.sensor[devices.num_sensor++] =
+			(struct cam_sensor_ctrl_t *) ctrl_struct;
+		break;
+	default:
+		CAM_WARN(CAM_SENSOR, "Unrecognized sensor device type: %d", device_type);
+		break;
+	}
+}
+
+int cam_sensor_module_debug_register(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("i2c", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+
+	debugfs_root =  dbgfileptr;
+	debugfs_create_file("i2c-rw", 0644, debugfs_root,
+		NULL, &i2c_operations);
+
+end:
+	return rc;
+}
+
+void cam_sensor_module_debug_deregister(void)
+{
+	debugfs_root = NULL;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_cmn_header.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_cmn_header.h
@@ -0,0 +1,403 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_CMN_HEADER_
+#define _CAM_SENSOR_CMN_HEADER_
+
+#include <linux/i2c.h>
+#include <linux/i3c/master.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/timer.h>
+#include <linux/delay.h>
+#include <linux/list.h>
+
+#include <dt-bindings/msm-camera.h>
+#include <media/cam_sensor.h>
+#include <media/cam_req_mgr.h>
+
+#define MAX_POWER_CONFIG                       12
+#define MAX_PER_FRAME_ARRAY                    32
+#define BATCH_SIZE_MAX                         16
+#define CAM_I3C_DEV_PROBE_TIMEOUT_MS           10
+#define CAM_I3C_DEV_PROBE_TIMEOUT_US          (CAM_I3C_DEV_PROBE_TIMEOUT_MS * 1000)
+#define I3C_SENSOR_DEV_ID_DT_NODE              "qcom,cam-i3c-id-table"
+#define MAX_I3C_DEVICE_ID_ENTRIES              (MAX_CAMERAS * 2)
+
+#define CAM_SENSOR_NAME    "cam-sensor"
+#define CAM_ACTUATOR_NAME  "cam-actuator"
+#define CAM_CSIPHY_NAME    "cam-csiphy"
+#define CAM_FLASH_NAME     "cam-flash"
+#define CAM_EEPROM_NAME    "cam-eeprom"
+#define CAM_OIS_NAME       "cam-ois"
+#define CAM_TPG_NAME       "cam-tpg"
+
+#define MAX_SYSTEM_PIPELINE_DELAY 2
+
+#define CAM_PKT_NOP_OPCODE 127
+
+enum camera_flash_opcode {
+	CAMERA_SENSOR_FLASH_OP_INVALID,
+	CAMERA_SENSOR_FLASH_OP_OFF,
+	CAMERA_SENSOR_FLASH_OP_FIRELOW,
+	CAMERA_SENSOR_FLASH_OP_FIREHIGH,
+	CAMERA_SENSOR_FLASH_OP_FIREDURATION,
+	CAMERA_SENSOR_FLASH_OP_MAX,
+};
+
+enum camera_sensor_i2c_type {
+	CAMERA_SENSOR_I2C_TYPE_INVALID,
+	CAMERA_SENSOR_I2C_TYPE_BYTE,
+	CAMERA_SENSOR_I2C_TYPE_WORD,
+	CAMERA_SENSOR_I2C_TYPE_3B,
+	CAMERA_SENSOR_I2C_TYPE_DWORD,
+	CAMERA_SENSOR_I2C_TYPE_MAX,
+};
+
+enum i2c_freq_mode {
+	I2C_STANDARD_MODE,
+	I2C_FAST_MODE,
+	I2C_CUSTOM_MODE,
+	I2C_FAST_PLUS_MODE,
+	I2C_MAX_MODES,
+};
+
+enum position_roll {
+	ROLL_0       = 0,
+	ROLL_90      = 90,
+	ROLL_180     = 180,
+	ROLL_270     = 270,
+	ROLL_INVALID = 360,
+};
+
+enum position_yaw {
+	FRONT_CAMERA_YAW = 0,
+	REAR_CAMERA_YAW  = 180,
+	INVALID_YAW      = 360,
+};
+
+enum position_pitch {
+	LEVEL_PITCH    = 0,
+	INVALID_PITCH  = 360,
+};
+
+enum sensor_sub_module {
+	SUB_MODULE_SENSOR,
+	SUB_MODULE_ACTUATOR,
+	SUB_MODULE_EEPROM,
+	SUB_MODULE_LED_FLASH,
+	SUB_MODULE_CSID,
+	SUB_MODULE_CSIPHY,
+	SUB_MODULE_OIS,
+	SUB_MODULE_EXT,
+	SUB_MODULE_MAX,
+};
+
+enum msm_camera_power_seq_type {
+	SENSOR_MCLK,
+	SENSOR_VANA,
+	SENSOR_VDIG,
+	SENSOR_VIO,
+	SENSOR_VAF,
+	SENSOR_VAF_PWDM,
+	SENSOR_CUSTOM_REG1,
+	SENSOR_CUSTOM_REG2,
+	SENSOR_RESET,
+	SENSOR_STANDBY,
+	SENSOR_CUSTOM_GPIO1,
+	SENSOR_CUSTOM_GPIO2,
+	SENSOR_VANA1,
+	SENSOR_SEQ_TYPE_MAX,
+};
+
+enum msm_bus_perf_setting {
+	S_INIT,
+	S_PREVIEW,
+	S_VIDEO,
+	S_CAPTURE,
+	S_ZSL,
+	S_STEREO_VIDEO,
+	S_STEREO_CAPTURE,
+	S_DEFAULT,
+	S_LIVESHOT,
+	S_DUAL,
+	S_EXIT
+};
+
+enum msm_camera_device_type_t {
+	MSM_CAMERA_I2C_DEVICE,
+	MSM_CAMERA_PLATFORM_DEVICE,
+	MSM_CAMERA_SPI_DEVICE,
+};
+
+enum cam_flash_device_type {
+	CAMERA_FLASH_DEVICE_TYPE_PMIC = 0,
+	CAMERA_FLASH_DEVICE_TYPE_I2C,
+	CAMERA_FLASH_DEVICE_TYPE_GPIO,
+};
+
+enum cci_i2c_master_t {
+	MASTER_0 = CCI_MASTER_0,
+	MASTER_1 = CCI_MASTER_1,
+	MASTER_MAX = CCI_MASTER_MAX,
+};
+
+enum cci_device_num {
+	CCI_DEVICE_0,
+	CCI_DEVICE_1,
+	CCI_DEVICE_MAX,
+};
+
+enum camera_vreg_type {
+	VREG_TYPE_DEFAULT,
+	VREG_TYPE_CUSTOM,
+};
+
+enum cam_sensor_i2c_cmd_type {
+	CAM_SENSOR_I2C_WRITE_RANDOM,
+	CAM_SENSOR_I2C_WRITE_BURST,
+	CAM_SENSOR_I2C_WRITE_SEQ,
+	CAM_SENSOR_I2C_READ_RANDOM,
+	CAM_SENSOR_I2C_READ_SEQ,
+	CAM_SENSOR_I2C_POLL,
+	CAM_SENSOR_I2C_SET_I2C_INFO,
+	CAM_SENSOR_I2C_READ_APPEND_WRITE,
+	CAM_SENSOR_I2C_SEQUENTIAL_XFER_LOCK,
+	CAM_SENSOR_I2C_SEQUENTIAL_XFER_UNLOCK
+};
+
+struct common_header {
+	uint32_t    first_word;
+	uint8_t     fifth_byte;
+	uint8_t     cmd_type;
+	uint16_t    reserved;
+};
+
+struct camera_vreg_t {
+	const char *reg_name;
+	int min_voltage;
+	int max_voltage;
+	int op_mode;
+	uint32_t delay;
+	const char *custom_vreg_name;
+	enum camera_vreg_type type;
+};
+
+struct msm_camera_gpio_num_info {
+	uint16_t gpio_num[SENSOR_SEQ_TYPE_MAX];
+	uint8_t valid[SENSOR_SEQ_TYPE_MAX];
+};
+
+struct msm_cam_clk_info {
+	const char *clk_name;
+	long clk_rate;
+	uint32_t delay;
+};
+
+struct msm_pinctrl_info {
+	struct pinctrl *pinctrl;
+	struct pinctrl_state *gpio_state_active;
+	struct pinctrl_state *gpio_state_suspend;
+	bool use_pinctrl;
+};
+
+struct cam_sensor_i2c_reg_array {
+	uint32_t reg_addr;
+	uint32_t reg_data;
+	uint32_t delay;
+	uint32_t data_mask;
+};
+
+enum cam_sensor_module_debugfs_device_type {
+	CAM_SENSOR_ACTUATOR,
+	CAM_SENSOR_EEPROM,
+	CAM_SENSOR_FLASH,
+	CAM_SENSOR_OIS,
+	CAM_SENSOR_DEVICE,
+	CAM_SENSOR_MAX,
+};
+
+struct cam_sensor_i2c_reg_setting {
+	struct cam_sensor_i2c_reg_array *reg_setting;
+	uint32_t size;
+	enum camera_sensor_i2c_type addr_type;
+	enum camera_sensor_i2c_type data_type;
+	unsigned short delay;
+	uint8_t *read_buff;
+	uint32_t read_buff_len;
+};
+
+struct cam_sensor_i2c_seq_reg {
+	uint32_t reg_addr;
+	uint8_t  *reg_data;
+	uint32_t size;
+	enum camera_sensor_i2c_type addr_type;
+};
+
+struct i2c_settings_list {
+	struct cam_sensor_i2c_reg_setting i2c_settings;
+	struct cam_sensor_i2c_seq_reg seq_settings;
+	struct cam_cmd_i2c_info slave_info;
+	struct cam_cmd_i2c_sequential_xfer seq_xfer;
+	enum cam_sensor_i2c_cmd_type op_code;
+	struct list_head list;
+};
+
+struct i2c_settings_array {
+	struct list_head list_head;
+	int32_t is_settings_valid;
+	int64_t request_id;
+};
+
+struct i2c_data_settings {
+	struct i2c_settings_array init_settings;
+	struct i2c_settings_array config_settings;
+	struct i2c_settings_array streamon_settings;
+	struct i2c_settings_array streamoff_settings;
+	struct i2c_settings_array read_settings;
+	struct i2c_settings_array *per_frame;
+	struct i2c_settings_array *frame_skip;
+	struct i2c_settings_array *bubble_update;
+	struct i2c_settings_array reg_bank_unlock_settings;
+	struct i2c_settings_array reg_bank_lock_settings;
+};
+
+struct cam_sensor_power_ctrl_t {
+	struct device *dev;
+	struct cam_sensor_power_setting *power_setting;
+	uint16_t power_setting_size;
+	struct cam_sensor_power_setting *power_down_setting;
+	uint16_t power_down_setting_size;
+	struct msm_camera_gpio_num_info *gpio_num_info;
+	struct msm_pinctrl_info pinctrl_info;
+	uint8_t cam_pinctrl_status;
+};
+
+struct cam_camera_slave_info {
+	uint32_t sensor_slave_addr;
+	uint32_t sensor_id_reg_addr;
+	uint32_t sensor_id;
+	uint32_t sensor_id_mask;
+	uint8_t  i2c_freq_mode;
+};
+
+struct msm_sensor_init_params {
+	int modes_supported;
+	unsigned int sensor_mount_angle;
+};
+
+enum msm_sensor_camera_id_t {
+	CAMERA_0,
+	CAMERA_1,
+	CAMERA_2,
+	CAMERA_3,
+	CAMERA_4,
+	CAMERA_5,
+	CAMERA_6,
+	CAMERA_7,
+	CAMERA_8,
+	CAMERA_9,
+	CAMERA_10,
+	CAMERA_11,
+	CAMERA_12,
+	CAMERA_13,
+	CAMERA_14,
+	CAMERA_15,
+	CAMERA_16,
+	CAMERA_17,
+	CAMERA_18,
+	CAMERA_19,
+	CAMERA_20,
+	CAMERA_21,
+	CAMERA_22,
+	CAMERA_23,
+	MAX_CAMERAS,
+};
+
+struct msm_sensor_id_info_t {
+	unsigned short sensor_id_reg_addr;
+	unsigned short sensor_id;
+	unsigned short sensor_id_mask;
+};
+
+enum msm_sensor_output_format_t {
+	MSM_SENSOR_BAYER,
+	MSM_SENSOR_YCBCR,
+	MSM_SENSOR_META,
+};
+
+struct cam_sensor_power_setting {
+	enum msm_camera_power_seq_type seq_type;
+	unsigned short seq_val;
+	long config_val;
+	unsigned short delay;
+	void *data[10];
+	bool valid_config;
+};
+
+struct cam_sensor_board_info {
+	struct cam_camera_slave_info slave_info;
+	int32_t sensor_mount_angle;
+	int32_t secure_mode;
+	int modes_supported;
+	int32_t pos_roll;
+	int32_t pos_yaw;
+	int32_t pos_pitch;
+	int32_t  subdev_id[SUB_MODULE_MAX];
+	int32_t  subdev_intf[SUB_MODULE_MAX];
+	const char *misc_regulator;
+	struct cam_sensor_power_ctrl_t power_info;
+};
+
+enum msm_camera_vreg_name_t {
+	CAM_VDIG,
+	CAM_VIO,
+	CAM_VANA,
+	CAM_VAF,
+	CAM_V_CUSTOM1,
+	CAM_V_CUSTOM2,
+	CAM_VREG_MAX,
+};
+
+struct msm_camera_gpio_conf {
+	void *cam_gpiomux_conf_tbl;
+	uint8_t cam_gpiomux_conf_tbl_size;
+	struct gpio *cam_gpio_common_tbl;
+	uint8_t cam_gpio_common_tbl_size;
+	struct gpio *cam_gpio_req_tbl;
+	uint8_t cam_gpio_req_tbl_size;
+	uint32_t gpio_no_mux;
+	uint32_t *camera_off_table;
+	uint8_t camera_off_table_size;
+	uint32_t *camera_on_table;
+	uint8_t camera_on_table_size;
+	struct msm_camera_gpio_num_info *gpio_num_info;
+};
+
+/**
+ * cam_sensor_module_add_i2c_device()
+ * @brief: Each sensor device passes its ctrl struct to a global
+ *         structure of i2c devices in cam_sensor_module_debug.c
+ * @ctrl_struct: Passed as void pointer, and recast to actual struct
+ *               based on device_type
+ * @device_type: Device type based on cam_sensor_module_debugfs_device_type
+ */
+void cam_sensor_module_add_i2c_device(void *ctrl_struct, int device_type);
+
+/**
+ * cam_sensor_module_debug_register()
+ * @brief Creates debugfs entry
+ */
+int cam_sensor_module_debug_register(void);
+
+/**
+ * cam_sensor_module_debug_deregister(void)
+ * @brief Take down debugfs entry
+ */
+void cam_sensor_module_debug_deregister(void);
+
+#endif /* _CAM_SENSOR_CMN_HEADER_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
@@ -0,0 +1,2845 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/kernel.h>
+#include <linux/pinctrl/consumer.h>
+#include <clocksource/arm_arch_timer.h>
+#include <linux/pm_domain.h>
+#include <linux/pm_runtime.h>
+#include "cam_sensor_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_res_mgr_api.h"
+
+#define CAM_SENSOR_PINCTRL_STATE_SLEEP "cam_suspend"
+#define CAM_SENSOR_PINCTRL_STATE_DEFAULT "cam_default"
+
+#define VALIDATE_VOLTAGE(min, max, config_val) ((config_val) && \
+	(config_val >= min) && (config_val <= max))
+
+int cam_sensor_count_elems_i3c_device_id(struct device_node *dev,
+	int *num_entries, char *sensor_id_table_str)
+{
+	if (!num_entries) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Num_entries ptr is null");
+		return -EINVAL;
+	}
+
+	if (!dev) {
+		CAM_ERR(CAM_SENSOR_UTIL, "dev ptr is null");
+		return -EINVAL;
+	}
+
+	if (!sensor_id_table_str) {
+		CAM_ERR(CAM_SENSOR_UTIL, "sensor_id_table_str ptr is null");
+		return -EINVAL;
+	}
+
+	*num_entries = of_property_count_u32_elems(dev, sensor_id_table_str);
+	if (*num_entries <= 0) {
+		CAM_DBG(CAM_SENSOR_UTIL,
+			"Failed while reading the property for dev: %s num_entries:%d",
+			dev->full_name, *num_entries);
+		return -ENOENT;
+	}
+
+	if (*num_entries >= MAX_I3C_DEVICE_ID_ENTRIES) {
+		CAM_ERR(CAM_SENSOR_UTIL,
+			"Num_entries are more than MAX_I3C_DEVICE_ID_ENTRIES for dev: %s",
+			dev->full_name);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+int cam_sensor_fill_i3c_device_id(struct device_node *dev, int num_entries,
+	char *sensor_id_table_str, struct i3c_device_id *sensor_i3c_device_id)
+{
+	int                                      i = 0;
+	uint8_t                                  ent_num = 0;
+	uint32_t                                 mid;
+	uint32_t                                 pid;
+	int                                      rc;
+
+	if (!dev) {
+		CAM_ERR(CAM_SENSOR_UTIL, "dev ptr is null");
+		return -EINVAL;
+	}
+
+	if (!sensor_id_table_str) {
+		CAM_ERR(CAM_SENSOR_UTIL, "sensor_id_table_str ptr is null");
+		return -EINVAL;
+	}
+
+	if (!sensor_i3c_device_id) {
+		CAM_ERR(CAM_SENSOR_UTIL, "sensor_i3c_device_id ptr is null");
+		return -EINVAL;
+	}
+
+	while (i < num_entries) {
+		if (ent_num >= MAX_I3C_DEVICE_ID_ENTRIES) {
+			CAM_WARN(CAM_SENSOR_UTIL,
+				"Num_entries are more than MAX_I3C_DEVICE_ID_ENTRIES for dev: %s",
+				dev->full_name);
+			return -ENOMEM;
+		}
+
+		rc = of_property_read_u32_index(dev, sensor_id_table_str, i, &mid);
+		if (rc) {
+			CAM_ERR(CAM_SENSOR_UTIL, "Failed in reading the MID. dev: %s rc: %d",
+				dev->full_name, rc);
+			return rc;
+		}
+		i++;
+
+		rc = of_property_read_u32_index(dev, sensor_id_table_str, i, &pid);
+		if (rc) {
+			CAM_ERR(CAM_SENSOR_UTIL, "Failed in reading the PID. dev: %s rc: %d",
+				dev->full_name, rc);
+			return rc;
+		}
+		i++;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "dev: %s PID: 0x%x, MID: 0x%x", dev->full_name, pid, mid);
+
+		sensor_i3c_device_id[ent_num].manuf_id = mid;
+		sensor_i3c_device_id[ent_num].match_flags = I3C_MATCH_MANUF_AND_PART;
+		sensor_i3c_device_id[ent_num].part_id  = pid;
+		sensor_i3c_device_id[ent_num].data     = 0;
+
+		ent_num++;
+	}
+
+	return 0;
+}
+
+
+static struct i2c_settings_list*
+	cam_sensor_get_list_ptr(void)
+{
+	struct i2c_settings_list *tmp;
+
+	tmp = kzalloc(sizeof(struct i2c_settings_list), GFP_KERNEL);
+	if (!tmp) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Not Enough memory for list");
+		return NULL;
+	}
+
+	return tmp;
+}
+
+static struct i2c_settings_list*
+	cam_sensor_get_i2c_ptr(struct i2c_settings_array *i2c_reg_settings,
+		uint32_t size)
+{
+	struct i2c_settings_list *tmp;
+
+	tmp = cam_sensor_get_list_ptr();
+
+	if (tmp != NULL)
+		list_add_tail(&(tmp->list),
+			&(i2c_reg_settings->list_head));
+	else
+		return NULL;
+
+	tmp->i2c_settings.reg_setting = (struct cam_sensor_i2c_reg_array *)
+		vzalloc(size * sizeof(struct cam_sensor_i2c_reg_array));
+	if (tmp->i2c_settings.reg_setting == NULL) {
+		list_del(&(tmp->list));
+		kfree(tmp);
+		return NULL;
+	}
+	tmp->i2c_settings.size = size;
+
+	return tmp;
+}
+
+int32_t cam_sensor_util_get_current_qtimer_ns(uint64_t *qtime_ns)
+{
+	uint64_t ticks = 0;
+	int32_t rc = 0;
+
+	ticks = arch_timer_read_counter();
+	if (ticks == 0) {
+		CAM_ERR(CAM_SENSOR_UTIL, "qtimer returned 0, rc:%d", rc);
+		return -EINVAL;
+	}
+
+	if (qtime_ns != NULL) {
+		*qtime_ns = mul_u64_u32_div(ticks,
+			QTIMER_MUL_FACTOR, QTIMER_DIV_FACTOR);
+		CAM_DBG(CAM_SENSOR_UTIL, "Qtimer time: 0x%lx", *qtime_ns);
+	} else {
+		CAM_ERR(CAM_SENSOR_UTIL, "NULL pointer passed");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int32_t delete_request(struct i2c_settings_array *i2c_array)
+{
+	struct i2c_settings_list *i2c_list = NULL, *i2c_next = NULL;
+	int32_t rc = 0;
+
+	if (i2c_array == NULL) {
+		CAM_ERR(CAM_SENSOR_UTIL, "FATAL:: Invalid argument");
+		return -EINVAL;
+	}
+
+	list_for_each_entry_safe(i2c_list, i2c_next,
+		&(i2c_array->list_head), list) {
+		vfree(i2c_list->i2c_settings.reg_setting);
+		list_del(&(i2c_list->list));
+		kfree(i2c_list);
+	}
+	INIT_LIST_HEAD(&(i2c_array->list_head));
+	i2c_array->is_settings_valid = 0;
+
+	return rc;
+}
+
+int32_t cam_sensor_handle_delay(
+	uint32_t **cmd_buf,
+	uint16_t generic_op_code,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t offset, uint32_t *byte_cnt,
+	struct list_head *list_ptr)
+{
+	int32_t rc = 0;
+	struct cam_cmd_unconditional_wait *cmd_uncond_wait =
+		(struct cam_cmd_unconditional_wait *) *cmd_buf;
+	struct i2c_settings_list *i2c_list = NULL;
+
+	if (list_ptr == NULL) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Invalid list ptr");
+		return -EINVAL;
+	}
+
+	if (offset > 0) {
+		i2c_list =
+			list_entry(list_ptr, struct i2c_settings_list, list);
+		if (generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_HW_UCND) {
+			int32_t size = i2c_list->i2c_settings.size;
+
+			if (offset >= size)
+				i2c_list->i2c_settings.reg_setting[offset - size].delay =
+					cmd_uncond_wait->delay;
+			else
+				CAM_WARN(CAM_SENSOR_UTIL, "Setting size is bigger than offset.");
+		}
+		else
+			i2c_list->i2c_settings.delay = cmd_uncond_wait->delay;
+		(*cmd_buf) +=
+			sizeof(
+			struct cam_cmd_unconditional_wait) / sizeof(uint32_t);
+		(*byte_cnt) +=
+			sizeof(
+			struct cam_cmd_unconditional_wait);
+	} else {
+		CAM_ERR(CAM_SENSOR_UTIL, "Delay Rxed Before any buffer: %d", offset);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int32_t cam_sensor_handle_poll(
+	uint32_t **cmd_buf,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *byte_cnt, int32_t *offset,
+	struct list_head **list_ptr)
+{
+	struct i2c_settings_list  *i2c_list;
+	int32_t rc = 0;
+	struct cam_cmd_conditional_wait *cond_wait
+		= (struct cam_cmd_conditional_wait *) *cmd_buf;
+
+	i2c_list =
+		cam_sensor_get_i2c_ptr(i2c_reg_settings, 1);
+	if (!i2c_list || !i2c_list->i2c_settings.reg_setting) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Failed in allocating mem for list");
+		return -ENOMEM;
+	}
+
+	i2c_list->op_code = CAM_SENSOR_I2C_POLL;
+	i2c_list->i2c_settings.data_type =
+		cond_wait->data_type;
+	i2c_list->i2c_settings.addr_type =
+		cond_wait->addr_type;
+	i2c_list->i2c_settings.reg_setting->reg_addr =
+		cond_wait->reg_addr;
+	i2c_list->i2c_settings.reg_setting->reg_data =
+		cond_wait->reg_data;
+	i2c_list->i2c_settings.reg_setting->delay =
+		cond_wait->timeout;
+	i2c_list->i2c_settings.reg_setting->data_mask =
+		cond_wait->data_mask;
+
+	(*cmd_buf) += sizeof(struct cam_cmd_conditional_wait) /
+		sizeof(uint32_t);
+	(*byte_cnt) += sizeof(struct cam_cmd_conditional_wait);
+
+	*offset = 1;
+	*list_ptr = &(i2c_list->list);
+
+	return rc;
+}
+
+int32_t cam_sensor_handle_random_write(
+	struct cam_cmd_i2c_random_wr *cam_cmd_i2c_random_wr,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list)
+{
+	struct i2c_settings_list  *i2c_list;
+	int32_t rc = 0, cnt, payload_count;
+
+	payload_count = cam_cmd_i2c_random_wr->header.count;
+	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
+						payload_count);
+	if (i2c_list == NULL ||
+		i2c_list->i2c_settings.reg_setting == NULL) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Failed in allocating i2c_list");
+		return -ENOMEM;
+	}
+
+	*cmd_length_in_bytes = (sizeof(struct i2c_rdwr_header) +
+		sizeof(struct i2c_random_wr_payload) *
+		payload_count);
+	i2c_list->op_code = CAM_SENSOR_I2C_WRITE_RANDOM;
+	i2c_list->i2c_settings.addr_type =
+		cam_cmd_i2c_random_wr->header.addr_type;
+	i2c_list->i2c_settings.data_type =
+		cam_cmd_i2c_random_wr->header.data_type;
+
+	for (cnt = 0; cnt < payload_count; cnt++) {
+		i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
+			cam_cmd_i2c_random_wr->random_wr_payload_flex[cnt].reg_addr;
+		i2c_list->i2c_settings.reg_setting[cnt].reg_data =
+			cam_cmd_i2c_random_wr->random_wr_payload_flex[cnt].reg_data;
+		i2c_list->i2c_settings.reg_setting[cnt].data_mask = 0;
+	}
+	*offset = cnt;
+	*list = &(i2c_list->list);
+
+	return rc;
+}
+
+int32_t cam_sensor_handle_continuous_write(
+	struct cam_cmd_i2c_continuous_wr *cam_cmd_i2c_continuous_wr,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0, cnt, payload_count;
+
+	payload_count = cam_cmd_i2c_continuous_wr->header.count;
+	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
+						payload_count);
+	if (i2c_list == NULL ||
+		i2c_list->i2c_settings.reg_setting == NULL) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Failed in allocating i2c_list");
+		return -ENOMEM;
+	}
+
+	*cmd_length_in_bytes = (sizeof(struct i2c_rdwr_header) +
+		sizeof(cam_cmd_i2c_continuous_wr->reg_addr) +
+		sizeof(struct cam_cmd_read) *
+		(payload_count));
+	if (cam_cmd_i2c_continuous_wr->header.op_code ==
+		CAMERA_SENSOR_I2C_OP_CONT_WR_BRST)
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_BURST;
+	else if (cam_cmd_i2c_continuous_wr->header.op_code ==
+		CAMERA_SENSOR_I2C_OP_CONT_WR_SEQN)
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_SEQ;
+	else
+		return -EINVAL;
+
+	i2c_list->i2c_settings.addr_type =
+		cam_cmd_i2c_continuous_wr->header.addr_type;
+	i2c_list->i2c_settings.data_type =
+		cam_cmd_i2c_continuous_wr->header.data_type;
+	i2c_list->i2c_settings.size =
+		cam_cmd_i2c_continuous_wr->header.count;
+
+	for (cnt = 0; cnt < payload_count; cnt++) {
+		i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
+			cam_cmd_i2c_continuous_wr->reg_addr;
+		i2c_list->i2c_settings.reg_setting[cnt].reg_data =
+			cam_cmd_i2c_continuous_wr->data_read_flex[cnt].reg_data;
+		i2c_list->i2c_settings.reg_setting[cnt].data_mask = 0;
+	}
+	*offset = cnt;
+	*list = &(i2c_list->list);
+
+	return rc;
+}
+
+static int32_t cam_sensor_get_io_buffer(
+	struct cam_buf_io_cfg *io_cfg,
+	struct cam_sensor_i2c_reg_setting *i2c_settings)
+{
+	uintptr_t buf_addr = 0x0;
+	size_t buf_size = 0;
+	int32_t rc = 0;
+
+	if (io_cfg == NULL || i2c_settings == NULL) {
+		CAM_ERR(CAM_SENSOR_UTIL,
+			"Invalid args, io buf or i2c settings is NULL");
+		return -EINVAL;
+	}
+
+	if (io_cfg->direction == CAM_BUF_OUTPUT) {
+		rc = cam_mem_get_cpu_buf(io_cfg->mem_handle[0],
+			&buf_addr, &buf_size);
+		if ((rc < 0) || (!buf_addr)) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"invalid buffer, rc: %d, buf_addr: %pK",
+				rc, buf_addr);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_SENSOR_UTIL,
+			"buf_addr: %pK, buf_size: %zu, offsetsize: %d",
+			(void *)buf_addr, buf_size, io_cfg->offsets[0]);
+		if (io_cfg->offsets[0] >= buf_size) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"invalid size:io_cfg->offsets[0]: %d, buf_size: %d",
+				io_cfg->offsets[0], buf_size);
+			cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
+			return -EINVAL;
+		}
+		i2c_settings->read_buff =
+			 (uint8_t *)buf_addr + io_cfg->offsets[0];
+		i2c_settings->read_buff_len =
+			buf_size - io_cfg->offsets[0];
+	} else {
+		CAM_ERR(CAM_SENSOR_UTIL, "Invalid direction: %d",
+			io_cfg->direction);
+		rc = -EINVAL;
+	}
+	cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
+	return rc;
+}
+
+int32_t cam_sensor_util_write_qtimer_to_io_buffer(
+	uint64_t qtime_ns, struct cam_buf_io_cfg *io_cfg)
+{
+	uintptr_t buf_addr = 0x0, target_buf = 0x0;
+	size_t buf_size = 0, target_size = 0;
+	int32_t rc = 0;
+
+	if (io_cfg == NULL) {
+		CAM_ERR(CAM_SENSOR_UTIL,
+			"Invalid args, io buf is NULL");
+		return -EINVAL;
+	}
+
+	if (io_cfg->direction == CAM_BUF_OUTPUT) {
+		rc = cam_mem_get_cpu_buf(io_cfg->mem_handle[0],
+			&buf_addr, &buf_size);
+		if ((rc < 0) || (!buf_addr)) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"invalid buffer, rc: %d, buf_addr: %pK",
+				rc, buf_addr);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_SENSOR_UTIL,
+			"buf_addr: %pK, buf_size: %zu, offsetsize: %d",
+			(void *)buf_addr, buf_size, io_cfg->offsets[0]);
+		if (io_cfg->offsets[0] >= buf_size) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"invalid size:io_cfg->offsets[0]: %d, buf_size: %d",
+				io_cfg->offsets[0], buf_size);
+			cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
+			return -EINVAL;
+		}
+
+		target_buf  = buf_addr + io_cfg->offsets[0];
+		target_size = buf_size - io_cfg->offsets[0];
+
+		if (target_size < sizeof(uint64_t)) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"not enough size for qtimer, target_size:%d",
+				target_size);
+			cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
+			return -EINVAL;
+		}
+
+		memcpy((void *)target_buf, &qtime_ns, sizeof(uint64_t));
+		cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
+	} else {
+		CAM_ERR(CAM_SENSOR_UTIL, "Invalid direction: %d",
+			io_cfg->direction);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int32_t cam_sensor_handle_random_read(
+	struct cam_cmd_i2c_random_rd *cmd_i2c_random_rd,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint16_t *cmd_length_in_bytes,
+	int32_t *offset,
+	struct list_head **list,
+	struct cam_buf_io_cfg *io_cfg)
+{
+	struct i2c_settings_list *i2c_list;
+        int32_t rc = 0, cnt = 0, payload_count = 0;
+
+        payload_count = cmd_i2c_random_rd->header.count;
+	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
+            payload_count);
+	if ((i2c_list == NULL) ||
+		(i2c_list->i2c_settings.reg_setting == NULL)) {
+		CAM_ERR(CAM_SENSOR_UTIL,
+			"Failed in allocating i2c_list: %pK",
+			i2c_list);
+		return -ENOMEM;
+	}
+
+	rc = cam_sensor_get_io_buffer(io_cfg, &(i2c_list->i2c_settings));
+	if (rc) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Failed to get read buffer: %d", rc);
+	} else {
+		*cmd_length_in_bytes = sizeof(struct i2c_rdwr_header) +
+			(sizeof(struct cam_cmd_read) *
+			payload_count);
+		i2c_list->op_code = CAM_SENSOR_I2C_READ_RANDOM;
+		i2c_list->i2c_settings.addr_type =
+			cmd_i2c_random_rd->header.addr_type;
+		i2c_list->i2c_settings.data_type =
+			cmd_i2c_random_rd->header.data_type;
+		i2c_list->i2c_settings.size =
+			cmd_i2c_random_rd->header.count;
+
+		for (cnt = 0; cnt < payload_count; cnt++) {
+			i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
+				cmd_i2c_random_rd->data_read_flex[cnt].reg_data;
+		}
+		*offset = cnt;
+		*list = &(i2c_list->list);
+	}
+
+	return rc;
+}
+
+int32_t cam_sensor_handle_continuous_read(
+	struct cam_cmd_i2c_continuous_rd *cmd_i2c_continuous_rd,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint16_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list,
+	struct cam_buf_io_cfg *io_cfg)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0, cnt = 0;
+
+	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings, 1);
+	if ((i2c_list == NULL) ||
+		(i2c_list->i2c_settings.reg_setting == NULL)) {
+		CAM_ERR(CAM_SENSOR_UTIL,
+			"Failed in allocating i2c_list: %pK",
+			i2c_list);
+		return -ENOMEM;
+	}
+
+	rc = cam_sensor_get_io_buffer(io_cfg, &(i2c_list->i2c_settings));
+	if (rc) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Failed to get read buffer: %d", rc);
+	} else {
+		*cmd_length_in_bytes = sizeof(struct cam_cmd_i2c_continuous_rd);
+		i2c_list->op_code = CAM_SENSOR_I2C_READ_SEQ;
+
+		i2c_list->i2c_settings.addr_type =
+			cmd_i2c_continuous_rd->header.addr_type;
+		i2c_list->i2c_settings.data_type =
+			cmd_i2c_continuous_rd->header.data_type;
+		i2c_list->i2c_settings.size =
+			cmd_i2c_continuous_rd->header.count;
+		i2c_list->i2c_settings.reg_setting[0].reg_addr =
+			cmd_i2c_continuous_rd->reg_addr;
+
+		*offset = cnt;
+		*list = &(i2c_list->list);
+	}
+
+	return rc;
+}
+
+static int cam_sensor_handle_slave_info(
+	uint32_t *cmd_buf,
+	struct i2c_settings_array *i2c_reg_settings,
+	struct list_head **list_ptr)
+{
+	int rc = 0;
+	struct cam_cmd_i2c_info *i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+	struct i2c_settings_list *i2c_list;
+
+	i2c_list =
+		cam_sensor_get_i2c_ptr(i2c_reg_settings, 1);
+	if (!i2c_list || !i2c_list->i2c_settings.reg_setting) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Failed in allocating mem for list");
+		return -ENOMEM;
+	}
+
+	i2c_list->op_code = CAM_SENSOR_I2C_SET_I2C_INFO;
+	i2c_list->slave_info = *i2c_info;
+
+	return rc;
+}
+
+static int cam_sensor_handle_sequential_xfer(
+	uint32_t *cmd_buf,
+	struct i2c_settings_array *i2c_reg_settings,
+	enum cam_sensor_i2c_cmd_type opcode,
+	struct list_head **list_ptr)
+{
+	int rc = 0;
+	struct cam_cmd_i2c_sequential_xfer *i2c_info =
+		(struct cam_cmd_i2c_sequential_xfer *)cmd_buf;
+	struct i2c_settings_list *i2c_list;
+
+	i2c_list =
+		cam_sensor_get_list_ptr();
+	if (!i2c_list) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Failed in allocating mem for list");
+		return -ENOMEM;
+	}
+
+	list_add_tail(&(i2c_list->list),
+		&(i2c_reg_settings->list_head));
+	if (opcode == CAMERA_SENSOR_CMD_TYPE_I2C_SEQUENTIAL_XFER_LOCK)
+		i2c_list->op_code = CAM_SENSOR_I2C_SEQUENTIAL_XFER_LOCK;
+	else
+		i2c_list->op_code = CAM_SENSOR_I2C_SEQUENTIAL_XFER_UNLOCK;
+
+	i2c_list->seq_xfer = *i2c_info;
+
+	return rc;
+}
+
+static int cam_sensor_handle_read_append_write(
+	struct cam_cmd_i2c_random_wr *cam_cmd_i2c_rd_append_wr,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0, cnt, payload_count;
+
+	payload_count = cam_cmd_i2c_rd_append_wr->header.count;
+	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
+		payload_count);
+	if (i2c_list == NULL ||
+		i2c_list->i2c_settings.reg_setting == NULL) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Failed in allocating i2c_list");
+		return -ENOMEM;
+	}
+
+	*cmd_length_in_bytes = (sizeof(struct i2c_rdwr_header) +
+		sizeof(struct i2c_random_wr_payload) *
+		payload_count);
+	i2c_list->op_code = CAM_SENSOR_I2C_READ_APPEND_WRITE;
+	i2c_list->i2c_settings.addr_type =
+		cam_cmd_i2c_rd_append_wr->header.addr_type;
+	i2c_list->i2c_settings.data_type =
+		cam_cmd_i2c_rd_append_wr->header.data_type;
+
+	for (cnt = 0; cnt < payload_count; cnt++) {
+		i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
+			cam_cmd_i2c_rd_append_wr->random_wr_payload[cnt].reg_addr;
+		i2c_list->i2c_settings.reg_setting[cnt].reg_data =
+			cam_cmd_i2c_rd_append_wr->random_wr_payload[cnt].reg_data;
+		i2c_list->i2c_settings.reg_setting[cnt].data_mask =
+			cam_cmd_i2c_rd_append_wr->random_wr_payload[cnt].mask;
+	}
+	*offset = cnt;
+	*list = &(i2c_list->list);
+
+	return rc;
+}
+
+/**
+ * Name : cam_sensor_i2c_command_parser
+ * Description : Parse CSL CCI packet and apply register settings
+ * Parameters :  io_master        input  master information
+ *               i2c_reg_settings output register settings to fill
+ *               cmd_desc         input  command description
+ *               num_cmd_buffers  input  number of command buffers to process
+ *               io_cfg           input  buffer details for read operation only
+ * Description :
+ * Handle multiple I2C RD/WR and WAIT cmd formats in one command
+ * buffer, for example, a command buffer of m x RND_WR + 1 x HW_
+ * WAIT + n x RND_WR with num_cmd_buf = 1. Do not exepect RD/WR
+ * with different cmd_type and op_code in one command buffer.
+ */
+int cam_sensor_i2c_command_parser(
+	struct camera_io_master *io_master,
+	struct i2c_settings_array *i2c_reg_settings,
+	struct cam_cmd_buf_desc   *cmd_desc,
+	int32_t num_cmd_buffers,
+	struct cam_buf_io_cfg *io_cfg)
+{
+	int16_t                   rc = 0, i = 0, xfer_lock_cnt = 0;
+	size_t                    len_of_buff = 0;
+	uintptr_t                 generic_ptr;
+	uint16_t                  cmd_length_in_bytes = 0;
+	size_t                    remain_len = 0;
+	size_t                    tot_size = 0;
+
+	for (i = 0; i < num_cmd_buffers; i++) {
+		uint32_t                  *cmd_buf = NULL;
+		struct common_header      *cmm_hdr;
+		uint16_t                  generic_op_code;
+		uint32_t                  byte_cnt = 0;
+		uint32_t                  j = 0;
+		struct list_head          *list = NULL;
+
+		/*
+		 * It is not expected the same settings to
+		 * be spread across multiple cmd buffers
+		 */
+		CAM_DBG(CAM_SENSOR_UTIL, "Total cmd Buf in Bytes: %d",
+			cmd_desc[i].length);
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&generic_ptr, &len_of_buff);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"cmd hdl failed:%d, Err: %d, Buffer_len: %zd",
+				cmd_desc[i].mem_handle, rc, len_of_buff);
+			return rc;
+		}
+
+		remain_len = len_of_buff;
+		if ((len_of_buff < sizeof(struct common_header)) ||
+			(cmd_desc[i].offset >
+			(len_of_buff - sizeof(struct common_header)))) {
+			CAM_ERR(CAM_SENSOR_UTIL, "buffer provided too small");
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+			return -EINVAL;
+		}
+		cmd_buf = (uint32_t *)generic_ptr;
+		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+
+		remain_len -= cmd_desc[i].offset;
+		if (remain_len < cmd_desc[i].length) {
+			CAM_ERR(CAM_SENSOR_UTIL, "buffer provided too small");
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+			return -EINVAL;
+		}
+
+		while (byte_cnt < cmd_desc[i].length) {
+			if ((remain_len - byte_cnt) <
+				sizeof(struct common_header)) {
+				CAM_ERR(CAM_SENSOR_UTIL, "Not enough buffer");
+				rc = -EINVAL;
+				goto end;
+			}
+			cmm_hdr = (struct common_header *)cmd_buf;
+			generic_op_code = cmm_hdr->fifth_byte;
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR: {
+				uint32_t cmd_length_in_bytes   = 0;
+				struct cam_cmd_i2c_random_wr
+					*cam_cmd_i2c_random_wr =
+					(struct cam_cmd_i2c_random_wr *)cmd_buf;
+
+				if ((remain_len - byte_cnt) <
+					sizeof(struct cam_cmd_i2c_random_wr)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+				tot_size = sizeof(struct i2c_rdwr_header) +
+					(sizeof(struct i2c_random_wr_payload) *
+					cam_cmd_i2c_random_wr->header.count);
+
+				if (tot_size > (remain_len - byte_cnt)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_random_write(
+					cam_cmd_i2c_random_wr,
+					i2c_reg_settings,
+					&cmd_length_in_bytes, &j, &list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Failed in random write %d", rc);
+					rc = -EINVAL;
+					goto end;
+				}
+
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_I2C_RD_APPEND_WR: {
+				uint32_t cmd_length_in_bytes   = 0;
+				struct cam_cmd_i2c_random_wr
+					*cam_cmd_i2c_random_wr =
+					(struct cam_cmd_i2c_random_wr *)cmd_buf;
+
+				if ((remain_len - byte_cnt) <
+					sizeof(struct cam_cmd_i2c_random_wr)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+				tot_size = sizeof(struct i2c_rdwr_header) +
+					(sizeof(struct i2c_random_wr_payload) *
+					cam_cmd_i2c_random_wr->header.count);
+
+				if (tot_size > (remain_len - byte_cnt)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_read_append_write(
+					cam_cmd_i2c_random_wr,
+					i2c_reg_settings,
+					&cmd_length_in_bytes, &j, &list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Failed in read append write %d", rc);
+					rc = -EINVAL;
+					goto end;
+				}
+
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_WR: {
+				uint32_t cmd_length_in_bytes   = 0;
+				struct cam_cmd_i2c_continuous_wr
+				*cam_cmd_i2c_continuous_wr =
+				(struct cam_cmd_i2c_continuous_wr *)
+				cmd_buf;
+
+				if ((remain_len - byte_cnt) <
+				sizeof(struct cam_cmd_i2c_continuous_wr)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				tot_size = sizeof(struct i2c_rdwr_header) +
+				sizeof(cam_cmd_i2c_continuous_wr->reg_addr) +
+				(sizeof(struct cam_cmd_read) *
+				cam_cmd_i2c_continuous_wr->header.count);
+
+				if (tot_size > (remain_len - byte_cnt)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_continuous_write(
+					cam_cmd_i2c_continuous_wr,
+					i2c_reg_settings,
+					&cmd_length_in_bytes, &j, &list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Failed in continuous write %d", rc);
+					goto end;
+				}
+
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_WAIT: {
+				if ((((generic_op_code == CAMERA_SENSOR_WAIT_OP_HW_UCND) ||
+					(generic_op_code == CAMERA_SENSOR_WAIT_OP_SW_UCND)) &&
+					((remain_len - byte_cnt) <
+					sizeof(struct cam_cmd_unconditional_wait))) ||
+					((generic_op_code == CAMERA_SENSOR_WAIT_OP_COND) &&
+					((remain_len - byte_cnt) <
+					sizeof(struct cam_cmd_conditional_wait)))) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer space");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				if (generic_op_code ==
+					CAMERA_SENSOR_WAIT_OP_HW_UCND ||
+					generic_op_code ==
+						CAMERA_SENSOR_WAIT_OP_SW_UCND) {
+					rc = cam_sensor_handle_delay(
+						&cmd_buf, generic_op_code,
+						i2c_reg_settings, j, &byte_cnt,
+						list);
+					if (rc < 0) {
+						CAM_ERR(CAM_SENSOR_UTIL,
+							"delay hdl failed: %d",
+							rc);
+						goto end;
+					}
+
+				} else if (generic_op_code ==
+					CAMERA_SENSOR_WAIT_OP_COND) {
+					rc = cam_sensor_handle_poll(
+						&cmd_buf, i2c_reg_settings,
+						&byte_cnt, &j, &list);
+					if (rc < 0) {
+						CAM_ERR(CAM_SENSOR_UTIL,
+							"Random read fail: %d",
+							rc);
+						goto end;
+					}
+				} else {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Wrong Wait Command: %d",
+						generic_op_code);
+					rc = -EINVAL;
+					goto end;
+				}
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO: {
+				if (remain_len - byte_cnt <
+					sizeof(struct cam_cmd_i2c_info)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer space");
+					rc = -EINVAL;
+					goto end;
+				}
+				rc = cam_sensor_handle_slave_info(
+					cmd_buf, i2c_reg_settings, &list);
+				if (rc) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Handle slave info failed with rc: %d",
+					rc);
+					goto end;
+				}
+				cmd_length_in_bytes =
+					sizeof(struct cam_cmd_i2c_info);
+				cmd_buf +=
+					cmd_length_in_bytes / sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+
+			case CAMERA_SENSOR_CMD_TYPE_I2C_SEQUENTIAL_XFER_LOCK:
+			case CAMERA_SENSOR_CMD_TYPE_I2C_SEQUENTIAL_XFER_UNLOCK:{
+				CAM_DBG(CAM_SENSOR_UTIL,"Handle sequential xfer cmd: %d",
+					cmm_hdr->cmd_type);
+				if (remain_len - byte_cnt <
+					sizeof(struct cam_cmd_i2c_sequential_xfer)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer space");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				/* While packaging xfer locks make sure they are in pairs*/
+				if (CAMERA_SENSOR_CMD_TYPE_I2C_SEQUENTIAL_XFER_LOCK == cmm_hdr->cmd_type) {
+					if(0 == xfer_lock_cnt) {
+						xfer_lock_cnt++;
+					} else {
+						CAM_ERR(CAM_SENSOR_UTIL, "Not expecting again lock without unlock");
+						rc = -EINVAL;
+						goto end;
+					}
+				} else {
+					if(1 == xfer_lock_cnt) {
+						xfer_lock_cnt--;
+					} else {
+						CAM_ERR(CAM_SENSOR_UTIL, "Not expecting unlock without lock");
+						rc = -EINVAL;
+						goto end;
+					}
+				}
+				rc = cam_sensor_handle_sequential_xfer(
+					cmd_buf, i2c_reg_settings, cmm_hdr->cmd_type, &list);
+				if (rc) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Handle sequential xfer failed with rc: %d",
+					rc);
+					goto end;
+				}
+				cmd_length_in_bytes =
+					sizeof(struct cam_cmd_i2c_sequential_xfer);
+				cmd_buf +=
+					cmd_length_in_bytes / sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_RD: {
+				uint16_t cmd_length_in_bytes   = 0;
+				struct cam_cmd_i2c_random_rd *i2c_random_rd =
+				(struct cam_cmd_i2c_random_rd *)cmd_buf;
+
+				if (remain_len - byte_cnt <
+					sizeof(struct cam_cmd_i2c_random_rd)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer space");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				tot_size = sizeof(struct i2c_rdwr_header) +
+					(sizeof(struct cam_cmd_read) *
+					i2c_random_rd->header.count);
+
+				if (tot_size > (remain_len - byte_cnt)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer provided %d, %d, %d",
+						tot_size, remain_len, byte_cnt);
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_random_read(
+					i2c_random_rd,
+					i2c_reg_settings,
+					&cmd_length_in_bytes, &j, &list,
+					io_cfg);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Failed in random read %d", rc);
+					goto end;
+				}
+
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD: {
+				uint16_t cmd_length_in_bytes   = 0;
+				struct cam_cmd_i2c_continuous_rd
+				*i2c_continuous_rd =
+				(struct cam_cmd_i2c_continuous_rd *)cmd_buf;
+
+				if (remain_len - byte_cnt <
+				    sizeof(struct cam_cmd_i2c_continuous_rd)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer space");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				tot_size =
+				sizeof(struct cam_cmd_i2c_continuous_rd);
+
+				if (tot_size > (remain_len - byte_cnt)) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Not enough buffer provided %d, %d, %d",
+						tot_size, remain_len, byte_cnt);
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_continuous_read(
+					i2c_continuous_rd,
+					i2c_reg_settings,
+					&cmd_length_in_bytes, &j, &list,
+					io_cfg);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Failed in continuous read %d", rc);
+					goto end;
+				}
+
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			default:
+				CAM_ERR(CAM_SENSOR_UTIL, "Invalid Command Type:%d",
+					 cmm_hdr->cmd_type);
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+		i2c_reg_settings->is_settings_valid = 1;
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+
+	if(0 != xfer_lock_cnt) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Invalid xfer_lock_cnt=%d with rc=%d",
+			xfer_lock_cnt, rc);
+		rc = -EINVAL;
+	}
+
+	return rc;
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	return rc;
+}
+
+int cam_sensor_util_i2c_apply_setting(
+	struct camera_io_master *io_master_info,
+	struct i2c_settings_list *i2c_list)
+{
+	int32_t rc = 0;
+	uint32_t i, size;
+
+	switch (i2c_list->op_code) {
+	case CAM_SENSOR_I2C_WRITE_RANDOM: {
+		rc = camera_io_dev_write(io_master_info,
+			&(i2c_list->i2c_settings));
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"Failed to random write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	break;
+	}
+	case CAM_SENSOR_I2C_WRITE_SEQ: {
+		rc = camera_io_dev_write_continuous(
+			io_master_info, &(i2c_list->i2c_settings), CAM_SENSOR_I2C_WRITE_SEQ);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"Failed to seq write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	break;
+	}
+	case CAM_SENSOR_I2C_WRITE_BURST: {
+		rc = camera_io_dev_write_continuous(
+			io_master_info, &(i2c_list->i2c_settings), CAM_SENSOR_I2C_WRITE_BURST);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"Failed to burst write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	break;
+	}
+	case CAM_SENSOR_I2C_POLL: {
+		size = i2c_list->i2c_settings.size;
+		for (i = 0; i < size; i++) {
+			rc = camera_io_dev_poll(
+			io_master_info,
+			i2c_list->i2c_settings.reg_setting[i].reg_addr,
+			i2c_list->i2c_settings.reg_setting[i].reg_data,
+			i2c_list->i2c_settings.reg_setting[i].data_mask,
+			i2c_list->i2c_settings.addr_type,
+			i2c_list->i2c_settings.data_type,
+			i2c_list->i2c_settings.reg_setting[i].delay);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+					"i2c poll apply setting Fail: %d", rc);
+				return rc;
+			}
+		}
+	break;
+	}
+	default:
+		CAM_ERR(CAM_SENSOR_UTIL, "Wrong Opcode: %d", i2c_list->op_code);
+		rc = -EINVAL;
+	break;
+	}
+
+	return rc;
+}
+
+int32_t cam_sensor_i2c_read_data(
+	struct i2c_settings_array *i2c_settings,
+	struct camera_io_master *io_master_info)
+{
+	int32_t                   rc = 0;
+	struct i2c_settings_list  *i2c_list;
+	uint32_t                  cnt = 0;
+	uint8_t                   *read_buff = NULL;
+	uint32_t                  buff_length = 0;
+	uint32_t                  read_length = 0;
+
+	list_for_each_entry(i2c_list,
+		&(i2c_settings->list_head), list) {
+		if (i2c_list->op_code == CAM_SENSOR_I2C_SET_I2C_INFO) {
+			CAM_DBG(CAM_SENSOR_UTIL,
+				"CAM_SENSOR_I2C_SET_I2C_INFO continue");
+			continue;
+		}
+
+		read_buff = i2c_list->i2c_settings.read_buff;
+		buff_length = i2c_list->i2c_settings.read_buff_len;
+		if ((read_buff == NULL) || (buff_length == 0)) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"Invalid input buffer, buffer: %pK, length: %d",
+				read_buff, buff_length);
+			return -EINVAL;
+		}
+
+		if (i2c_list->op_code == CAM_SENSOR_I2C_READ_RANDOM) {
+			read_length = i2c_list->i2c_settings.data_type *
+				i2c_list->i2c_settings.size;
+			if ((read_length > buff_length) ||
+				(read_length < i2c_list->i2c_settings.size)) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+				"Invalid size, readLen:%d, bufLen:%d, size: %d",
+				read_length, buff_length,
+				i2c_list->i2c_settings.size);
+				return -EINVAL;
+			}
+			for (cnt = 0; cnt < (i2c_list->i2c_settings.size);
+				cnt++) {
+				struct cam_sensor_i2c_reg_array *reg_setting =
+				&(i2c_list->i2c_settings.reg_setting[cnt]);
+				rc = camera_io_dev_read(io_master_info,
+					reg_setting->reg_addr,
+					&reg_setting->reg_data,
+					i2c_list->i2c_settings.addr_type,
+					i2c_list->i2c_settings.data_type,
+					false);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Failed: random read I2C settings: %d",
+					rc);
+					return rc;
+				}
+				if (i2c_list->i2c_settings.data_type <
+					CAMERA_SENSOR_I2C_TYPE_MAX) {
+					memcpy(read_buff,
+					&reg_setting->reg_data,
+					i2c_list->i2c_settings.data_type);
+					read_buff +=
+					i2c_list->i2c_settings.data_type;
+				}
+			}
+		} else if (i2c_list->op_code == CAM_SENSOR_I2C_READ_SEQ) {
+			read_length = i2c_list->i2c_settings.size;
+			if (read_length > buff_length) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+				"Invalid buffer size, readLen: %d, bufLen: %d",
+				read_length, buff_length);
+				return -EINVAL;
+			}
+			rc = camera_io_dev_read_seq(
+				io_master_info,
+				i2c_list->i2c_settings.reg_setting[0].reg_addr,
+				read_buff,
+				i2c_list->i2c_settings.addr_type,
+				i2c_list->i2c_settings.data_type,
+				i2c_list->i2c_settings.size);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+					"failed: seq read I2C settings: %d",
+					rc);
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+int32_t msm_camera_fill_vreg_params(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_sensor_power_setting *power_setting,
+	uint16_t power_setting_size)
+{
+	int32_t rc = 0, j = 0, i = 0;
+	int num_vreg;
+
+	/* Validate input parameters */
+	if (!soc_info || !power_setting) {
+		CAM_ERR(CAM_SENSOR_UTIL, "failed: soc_info %pK power_setting %pK",
+			soc_info, power_setting);
+		return -EINVAL;
+	}
+
+	num_vreg = soc_info->num_rgltr;
+
+	if ((num_vreg <= 0) || (num_vreg > CAM_SOC_MAX_REGULATOR)) {
+		CAM_ERR(CAM_SENSOR_UTIL, "failed: num_vreg %d", num_vreg);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < power_setting_size; i++) {
+
+		if (power_setting[i].seq_type < SENSOR_MCLK ||
+			power_setting[i].seq_type >= SENSOR_SEQ_TYPE_MAX) {
+			CAM_ERR(CAM_SENSOR_UTIL, "failed: Invalid Seq type: %d",
+				power_setting[i].seq_type);
+			return -EINVAL;
+		}
+
+		power_setting[i].valid_config = false;
+
+		switch (power_setting[i].seq_type) {
+		case SENSOR_VDIG:
+			for (j = 0; j < num_vreg; j++) {
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vdig")) {
+
+					CAM_DBG(CAM_SENSOR_UTIL,
+						"i: %d j: %d cam_vdig", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val))
+						power_setting[i].valid_config = true;
+
+					break;
+				}
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_VIO:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vio")) {
+					CAM_DBG(CAM_SENSOR_UTIL,
+						"i: %d j: %d cam_vio", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val))
+						power_setting[i].valid_config = true;
+
+					break;
+				}
+
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_VANA:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vana")) {
+					CAM_DBG(CAM_SENSOR_UTIL,
+						"i: %d j: %d cam_vana", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val))
+						power_setting[i].valid_config = true;
+
+					break;
+				}
+
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_VANA1:
+			for (j = 0; j < num_vreg; j++) {
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vana1")) {
+					CAM_DBG(CAM_SENSOR_UTIL,
+						"i: %d j: %d cam_vana1", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val))
+						power_setting[i].valid_config = true;
+
+					break;
+				}
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_VAF:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vaf")) {
+					CAM_DBG(CAM_SENSOR_UTIL,
+						"i: %d j: %d cam_vaf", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val))
+						power_setting[i].valid_config = true;
+
+					break;
+				}
+
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_CUSTOM_REG1:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_v_custom1")) {
+					CAM_DBG(CAM_SENSOR_UTIL,
+						"i:%d j:%d cam_vcustom1", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val))
+						power_setting[i].valid_config = true;
+
+					break;
+				}
+
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+		case SENSOR_CUSTOM_REG2:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_v_custom2")) {
+					CAM_DBG(CAM_SENSOR_UTIL,
+						"i:%d j:%d cam_vcustom2", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val))
+						power_setting[i].valid_config = true;
+
+					break;
+				}
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+		default:
+			break;
+		}
+	}
+
+	return rc;
+}
+
+int cam_sensor_util_request_gpio_table(
+		struct cam_hw_soc_info *soc_info, int gpio_en)
+{
+	int rc = 0, i = 0;
+	uint8_t size = 0;
+	struct cam_soc_gpio_data *gpio_conf =
+			soc_info->gpio_data;
+	struct gpio *gpio_tbl = NULL;
+
+	if (!gpio_conf) {
+		CAM_DBG(CAM_SENSOR_UTIL, "No GPIO data");
+		return 0;
+	}
+
+	if (gpio_conf->cam_gpio_common_tbl_size <= 0) {
+		CAM_ERR(CAM_SENSOR_UTIL, "No GPIO entry");
+		return -EINVAL;
+	}
+
+	gpio_tbl = gpio_conf->cam_gpio_req_tbl;
+	size = gpio_conf->cam_gpio_req_tbl_size;
+
+	if (!gpio_tbl || !size) {
+		CAM_ERR(CAM_SENSOR_UTIL, "invalid gpio_tbl %pK / size %d",
+			gpio_tbl, size);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < size; i++) {
+		CAM_DBG(CAM_SENSOR_UTIL, "%s%d, i: %d, gpio %d dir %lld",
+			soc_info->dev_name, soc_info->index, i,
+			gpio_tbl[i].gpio, gpio_tbl[i].flags);
+	}
+
+	if (gpio_en) {
+		for (i = 0; i < size; i++) {
+			rc = cam_res_mgr_gpio_request(soc_info->dev,
+					gpio_tbl[i].gpio,
+					gpio_tbl[i].flags, gpio_tbl[i].label);
+			if (rc) {
+				/*
+				 * After GPIO request fails, contine to
+				 * apply new gpios, outout a error message
+				 * for driver bringup debug
+				 */
+				CAM_ERR(CAM_SENSOR_UTIL, "gpio %d:%s request fails",
+					gpio_tbl[i].gpio, gpio_tbl[i].label);
+			}
+		}
+	} else {
+		cam_res_mgr_gpio_free_arry(soc_info->dev, gpio_tbl, size);
+	}
+
+	return rc;
+}
+
+bool cam_sensor_util_check_gpio_is_shared(
+	struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	uint8_t size = 0;
+	struct cam_soc_gpio_data *gpio_conf =
+			soc_info->gpio_data;
+	struct gpio *gpio_tbl = NULL;
+
+	if (!gpio_conf) {
+		CAM_DBG(CAM_SENSOR_UTIL, "No GPIO data");
+		return false;
+	}
+
+	if (gpio_conf->cam_gpio_common_tbl_size <= 0) {
+		CAM_DBG(CAM_SENSOR_UTIL, "No GPIO entry");
+		return false;
+	}
+
+	gpio_tbl = gpio_conf->cam_gpio_req_tbl;
+	size = gpio_conf->cam_gpio_req_tbl_size;
+
+	if (!gpio_tbl || !size) {
+		CAM_ERR(CAM_SENSOR_UTIL, "invalid gpio_tbl %pK / size %d",
+			gpio_tbl, size);
+		return false;
+	}
+
+	rc = cam_res_mgr_util_check_if_gpio_is_shared(
+		gpio_tbl, size);
+	if (!rc) {
+		CAM_DBG(CAM_SENSOR_UTIL,
+			"dev: %s don't have shared gpio resources",
+			soc_info->dev_name);
+		return false;
+	}
+
+	return true;
+}
+
+static int32_t cam_sensor_validate(void *ptr, size_t remain_buf)
+{
+	struct common_header *cmm_hdr = (struct common_header *)ptr;
+	size_t validate_size = 0;
+
+	if (remain_buf < sizeof(struct common_header))
+		return -EINVAL;
+
+	if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_PWR_UP ||
+		cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_PWR_DOWN)
+		validate_size = sizeof(struct cam_cmd_power);
+	else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)
+		validate_size = sizeof(struct cam_cmd_unconditional_wait);
+
+	if (remain_buf < validate_size) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Invalid cmd_buf len %zu min %zu",
+			remain_buf, validate_size);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int32_t cam_sensor_update_power_settings(void *cmd_buf,
+	uint32_t cmd_length, struct cam_sensor_power_ctrl_t *power_info,
+	size_t cmd_buf_len)
+{
+	int32_t rc = 0, tot_size = 0, last_cmd_type = 0;
+	int32_t i = 0, pwr_up = 0, pwr_down = 0;
+	struct cam_sensor_power_setting *pwr_settings;
+	void *ptr = cmd_buf, *scr;
+	struct common_header *cmm_hdr = (struct common_header *)cmd_buf;
+	struct cam_cmd_power *pwr_cmd =
+		kzalloc(sizeof(struct cam_cmd_power), GFP_KERNEL);
+	if (!pwr_cmd)
+		return -ENOMEM;
+	memcpy(pwr_cmd, cmd_buf, sizeof(struct cam_cmd_power));
+
+	if (!pwr_cmd || !cmd_length || cmd_buf_len < (size_t)cmd_length ||
+		cam_sensor_validate(cmd_buf, cmd_buf_len)) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Invalid Args: pwr_cmd %pK, cmd_length: %d",
+			pwr_cmd, cmd_length);
+		rc = -EINVAL;
+		goto free_power_command;
+	}
+
+	power_info->power_setting_size = 0;
+	power_info->power_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting) *
+			MAX_POWER_CONFIG, GFP_KERNEL);
+	if (!power_info->power_setting) {
+		rc = -ENOMEM;
+		goto free_power_command;
+	}
+
+	power_info->power_down_setting_size = 0;
+	power_info->power_down_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting) *
+			MAX_POWER_CONFIG, GFP_KERNEL);
+	if (!power_info->power_down_setting) {
+		kfree(power_info->power_setting);
+		power_info->power_setting = NULL;
+		power_info->power_setting_size = 0;
+		rc = -ENOMEM;
+		goto free_power_command;
+	}
+
+	while (tot_size < cmd_length) {
+		if (cam_sensor_validate(ptr, (cmd_length - tot_size))) {
+			rc = -EINVAL;
+			goto free_power_settings;
+		}
+		if (cmm_hdr->cmd_type ==
+			CAMERA_SENSOR_CMD_TYPE_PWR_UP) {
+			struct cam_cmd_power *pwr_cmd =
+				(struct cam_cmd_power *)ptr;
+
+			if ((U16_MAX - power_info->power_setting_size) <
+				pwr_cmd->count) {
+				CAM_ERR(CAM_SENSOR_UTIL, "ERR: Overflow occurs");
+				rc = -EINVAL;
+				goto free_power_settings;
+			}
+
+			power_info->power_setting_size += pwr_cmd->count;
+			if ((power_info->power_setting_size > MAX_POWER_CONFIG)
+				|| (pwr_cmd->count >= SENSOR_SEQ_TYPE_MAX)) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+				"pwr_up setting size %d, pwr_cmd->count: %d",
+					power_info->power_setting_size,
+					pwr_cmd->count);
+				rc = -EINVAL;
+				goto free_power_settings;
+			}
+			scr = ptr + sizeof(struct cam_cmd_power);
+			tot_size = tot_size + sizeof(struct cam_cmd_power);
+
+			if (pwr_cmd->count == 0)
+				CAM_WARN(CAM_SENSOR_UTIL, "pwr_up_size is zero");
+
+			for (i = 0; i < pwr_cmd->count; i++, pwr_up++) {
+				power_info->power_setting[pwr_up].seq_type =
+				pwr_cmd->power_settings_flex[i].power_seq_type;
+				power_info->power_setting[pwr_up].config_val =
+				pwr_cmd->power_settings_flex[i].config_val_low;
+				power_info->power_setting[pwr_up].delay = 0;
+				if (i) {
+					scr = scr +
+						sizeof(
+						struct cam_power_settings);
+					tot_size = tot_size +
+						sizeof(
+						struct cam_power_settings);
+				}
+				if (tot_size > cmd_length) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Error: Cmd Buffer is wrong");
+					rc = -EINVAL;
+					goto free_power_settings;
+				}
+				CAM_DBG(CAM_SENSOR_UTIL,
+				"Seq Type[%d]: %d Config_val: %ld", pwr_up,
+				power_info->power_setting[pwr_up].seq_type,
+				power_info->power_setting[pwr_up].config_val);
+			}
+			last_cmd_type = CAMERA_SENSOR_CMD_TYPE_PWR_UP;
+			ptr = (void *) scr;
+			cmm_hdr = (struct common_header *)ptr;
+		} else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT) {
+			struct cam_cmd_unconditional_wait *wait_cmd =
+				(struct cam_cmd_unconditional_wait *)ptr;
+			if ((wait_cmd->op_code ==
+				CAMERA_SENSOR_WAIT_OP_SW_UCND) &&
+				(last_cmd_type ==
+				CAMERA_SENSOR_CMD_TYPE_PWR_UP)) {
+				if (pwr_up > 0) {
+					pwr_settings =
+					&power_info->power_setting[pwr_up - 1];
+					pwr_settings->delay +=
+						wait_cmd->delay;
+				} else {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Delay is expected only after valid power up setting");
+				}
+			} else if ((wait_cmd->op_code ==
+				CAMERA_SENSOR_WAIT_OP_SW_UCND) &&
+				(last_cmd_type ==
+				CAMERA_SENSOR_CMD_TYPE_PWR_DOWN)) {
+				if (pwr_down > 0) {
+					pwr_settings =
+					&power_info->power_down_setting[
+						pwr_down - 1];
+					pwr_settings->delay +=
+						wait_cmd->delay;
+				} else {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Delay is expected only after valid power up setting");
+				}
+			} else {
+				CAM_DBG(CAM_SENSOR_UTIL, "Invalid op code: %d",
+					wait_cmd->op_code);
+			}
+
+			tot_size = tot_size +
+				sizeof(struct cam_cmd_unconditional_wait);
+			if (tot_size > cmd_length) {
+				CAM_ERR(CAM_SENSOR_UTIL, "Command Buffer is wrong");
+				return -EINVAL;
+			}
+			scr = (void *) (wait_cmd);
+			ptr = (void *)
+				(scr +
+				sizeof(struct cam_cmd_unconditional_wait));
+			CAM_DBG(CAM_SENSOR_UTIL, "ptr: %pK sizeof: %d Next: %pK",
+				scr, (int32_t)sizeof(
+				struct cam_cmd_unconditional_wait), ptr);
+
+			cmm_hdr = (struct common_header *)ptr;
+		} else if (cmm_hdr->cmd_type ==
+			CAMERA_SENSOR_CMD_TYPE_PWR_DOWN) {
+			struct cam_cmd_power *pwr_cmd =
+				(struct cam_cmd_power *)ptr;
+
+			scr = ptr + sizeof(struct cam_cmd_power);
+			tot_size = tot_size + sizeof(struct cam_cmd_power);
+			if ((U16_MAX - power_info->power_down_setting_size) <
+				pwr_cmd->count) {
+				CAM_ERR(CAM_SENSOR_UTIL, "ERR: Overflow");
+				rc = -EINVAL;
+				goto free_power_settings;
+			}
+
+			power_info->power_down_setting_size += pwr_cmd->count;
+			if ((power_info->power_down_setting_size >
+				MAX_POWER_CONFIG) || (pwr_cmd->count >=
+				SENSOR_SEQ_TYPE_MAX)) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+				"pwr_down_setting_size %d, pwr_cmd->count: %d",
+					power_info->power_down_setting_size,
+					pwr_cmd->count);
+				rc = -EINVAL;
+				goto free_power_settings;
+			}
+
+			if (pwr_cmd->count == 0)
+				CAM_ERR(CAM_SENSOR_UTIL, "pwr_down size is zero");
+
+			for (i = 0; i < pwr_cmd->count; i++, pwr_down++) {
+				pwr_settings =
+				&power_info->power_down_setting[pwr_down];
+				pwr_settings->seq_type =
+				pwr_cmd->power_settings_flex[i].power_seq_type;
+				pwr_settings->config_val =
+				pwr_cmd->power_settings_flex[i].config_val_low;
+				power_info->power_down_setting[pwr_down].delay
+					= 0;
+				if (i) {
+					scr = scr +
+						sizeof(
+						struct cam_power_settings);
+					tot_size =
+						tot_size +
+						sizeof(
+						struct cam_power_settings);
+				}
+				if (tot_size > cmd_length) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Command Buffer is wrong");
+					rc = -EINVAL;
+					goto free_power_settings;
+				}
+				CAM_DBG(CAM_SENSOR_UTIL,
+					"Seq Type[%d]: %d Config_val: %ld",
+					pwr_down, pwr_settings->seq_type,
+					pwr_settings->config_val);
+			}
+			last_cmd_type = CAMERA_SENSOR_CMD_TYPE_PWR_DOWN;
+			ptr = (void *) scr;
+			cmm_hdr = (struct common_header *)ptr;
+		} else {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"Error: Un expected Header Type: %d",
+				cmm_hdr->cmd_type);
+			rc = -EINVAL;
+			goto free_power_settings;
+		}
+	}
+
+	goto free_power_command;
+free_power_settings:
+	kfree(power_info->power_down_setting);
+	kfree(power_info->power_setting);
+	power_info->power_down_setting = NULL;
+	power_info->power_setting = NULL;
+	power_info->power_down_setting_size = 0;
+	power_info->power_setting_size = 0;
+free_power_command:
+	kfree(pwr_cmd);
+	pwr_cmd = NULL;
+	return rc;
+}
+
+int cam_get_dt_power_setting_data(struct device_node *of_node,
+	struct cam_hw_soc_info *soc_info,
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int rc = 0, i;
+	int count = 0;
+	const char *seq_name = NULL;
+	uint32_t *array = NULL;
+	struct cam_sensor_power_setting *ps;
+	int c, end;
+
+	if (!power_info)
+		return -EINVAL;
+
+	count = of_property_count_strings(of_node, "qcom,cam-power-seq-type");
+	power_info->power_setting_size = count;
+
+	CAM_DBG(CAM_SENSOR_UTIL, "qcom,cam-power-seq-type count %d", count);
+
+	if (count <= 0)
+		return 0;
+
+	ps = kcalloc(count, sizeof(*ps), GFP_KERNEL);
+	if (!ps)
+		return -ENOMEM;
+	power_info->power_setting = ps;
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node,
+			"qcom,cam-power-seq-type", i, &seq_name);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL, "failed");
+			goto ERROR1;
+		}
+		CAM_DBG(CAM_SENSOR_UTIL, "seq_name[%d] = %s", i, seq_name);
+		if (!strcmp(seq_name, "cam_vio")) {
+			ps[i].seq_type = SENSOR_VIO;
+		} else if (!strcmp(seq_name, "cam_vana")) {
+			ps[i].seq_type = SENSOR_VANA;
+		} else if (!strcmp(seq_name, "cam_vana1")) {
+			ps[i].seq_type = SENSOR_VANA1;
+		} else if (!strcmp(seq_name, "cam_clk")) {
+			ps[i].seq_type = SENSOR_MCLK;
+		} else {
+			CAM_ERR(CAM_SENSOR_UTIL, "unrecognized seq-type %s",
+				seq_name);
+			rc = -EILSEQ;
+			goto ERROR1;
+		}
+		CAM_DBG(CAM_SENSOR_UTIL, "seq_type[%d] %d", i, ps[i].seq_type);
+	}
+
+	array = kcalloc(count, sizeof(uint32_t), GFP_KERNEL);
+	if (!array) {
+		rc = -ENOMEM;
+		goto ERROR1;
+	}
+
+	rc = of_property_read_u32_array(of_node, "qcom,cam-power-seq-cfg-val",
+		array, count);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR_UTIL, "failed ");
+		goto ERROR2;
+	}
+
+	for (i = 0; i < count; i++) {
+		ps[i].config_val = array[i];
+		CAM_DBG(CAM_SENSOR_UTIL, "power_setting[%d].config_val = %ld", i,
+			ps[i].config_val);
+	}
+
+	rc = of_property_read_u32_array(of_node, "qcom,cam-power-seq-delay",
+		array, count);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR_UTIL, "failed");
+		goto ERROR2;
+	}
+	for (i = 0; i < count; i++) {
+		ps[i].delay = array[i];
+		CAM_DBG(CAM_SENSOR_UTIL, "power_setting[%d].delay = %d", i,
+			ps[i].delay);
+	}
+	kfree(array);
+
+	power_info->power_down_setting =
+		kcalloc(count, sizeof(*ps), GFP_KERNEL);
+
+	if (!power_info->power_down_setting) {
+		CAM_ERR(CAM_SENSOR_UTIL, "failed");
+		rc = -ENOMEM;
+		goto ERROR1;
+	}
+
+	power_info->power_down_setting_size = count;
+
+	end = count - 1;
+
+	for (c = 0; c < count; c++) {
+		power_info->power_down_setting[c] = ps[end];
+		end--;
+	}
+	return rc;
+ERROR2:
+	kfree(array);
+ERROR1:
+	kfree(ps);
+	return rc;
+}
+
+int cam_sensor_util_init_gpio_pin_tbl(
+	struct cam_hw_soc_info *soc_info,
+	struct msm_camera_gpio_num_info **pgpio_num_info)
+{
+	int rc = 0, val = 0;
+	uint32_t gpio_array_size;
+	struct device_node *of_node = NULL;
+	struct cam_soc_gpio_data *gconf = NULL;
+	struct msm_camera_gpio_num_info *gpio_num_info = NULL;
+
+	if (!soc_info->dev) {
+		CAM_ERR(CAM_SENSOR_UTIL, "device node NULL");
+		return -EINVAL;
+	}
+
+	if (soc_info->is_child_node) {
+		of_node = soc_info->parent_node;
+	} else {
+		of_node = soc_info->dev->of_node;
+	}
+
+	if (!of_node) {
+		CAM_ERR(CAM_SENSOR_UTIL, "of_node is NULL");
+		return -EINVAL;
+	}
+
+	gconf = soc_info->gpio_data;
+	if (!gconf) {
+		CAM_ERR(CAM_SENSOR_UTIL, "No gpio_common_table is found");
+		return -EINVAL;
+	}
+
+	if (!gconf->cam_gpio_common_tbl) {
+		CAM_ERR(CAM_SENSOR_UTIL, "gpio_common_table is not initialized");
+		return -EINVAL;
+	}
+
+	gpio_array_size = gconf->cam_gpio_common_tbl_size;
+
+	if (!gpio_array_size) {
+		CAM_ERR(CAM_SENSOR_UTIL, "invalid size of gpio table");
+		return -EINVAL;
+	}
+
+	*pgpio_num_info = kzalloc(sizeof(struct msm_camera_gpio_num_info),
+		GFP_KERNEL);
+	if (!*pgpio_num_info)
+		return -ENOMEM;
+	gpio_num_info = *pgpio_num_info;
+
+	rc = of_property_read_u32(of_node, "gpio-vana", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL, "read gpio-vana failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-vana invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VANA] =
+				gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VANA] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-vana %d",
+			gpio_num_info->gpio_num[SENSOR_VANA]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-vana1", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL, "read gpio-vana1 failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-vana1 invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VANA1] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VANA1] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-vana1 %d",
+			gpio_num_info->gpio_num[SENSOR_VANA1]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-vio", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL, "read gpio-vio failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-vio invalid %d", val);
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VIO] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VIO] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-vio %d",
+			gpio_num_info->gpio_num[SENSOR_VIO]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-vaf", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL, "read gpio-vaf failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-vaf invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VAF] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VAF] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-vaf %d",
+			gpio_num_info->gpio_num[SENSOR_VAF]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-vdig", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL, "read gpio-vdig failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-vdig invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VDIG] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VDIG] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-vdig %d",
+				gpio_num_info->gpio_num[SENSOR_VDIG]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-reset", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL, "read gpio-reset failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-reset invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_RESET] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_RESET] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-reset %d",
+			gpio_num_info->gpio_num[SENSOR_RESET]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-standby", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"read gpio-standby failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-standby invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_STANDBY] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_STANDBY] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-standby %d",
+			gpio_num_info->gpio_num[SENSOR_STANDBY]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-af-pwdm", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"read gpio-af-pwdm failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-af-pwdm invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VAF_PWDM] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VAF_PWDM] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-af-pwdm %d",
+			gpio_num_info->gpio_num[SENSOR_VAF_PWDM]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-custom1", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"read gpio-custom1 failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-custom1 invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_CUSTOM_GPIO1] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_CUSTOM_GPIO1] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-custom1 %d",
+			gpio_num_info->gpio_num[SENSOR_CUSTOM_GPIO1]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-custom2", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"read gpio-custom2 failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR_UTIL, "gpio-custom2 invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_CUSTOM_GPIO2] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_CUSTOM_GPIO2] = 1;
+
+		CAM_DBG(CAM_SENSOR_UTIL, "gpio-custom2 %d",
+			gpio_num_info->gpio_num[SENSOR_CUSTOM_GPIO2]);
+	} else {
+		rc = 0;
+	}
+
+	return rc;
+
+free_gpio_info:
+	kfree(gpio_num_info);
+	gpio_num_info = NULL;
+	return rc;
+}
+
+int msm_camera_pinctrl_init(
+	struct msm_pinctrl_info *sensor_pctrl, struct device *dev)
+{
+
+	sensor_pctrl->pinctrl = devm_pinctrl_get(dev);
+	if (IS_ERR_OR_NULL(sensor_pctrl->pinctrl)) {
+		CAM_DBG(CAM_SENSOR_UTIL, "Getting pinctrl handle failed");
+		return -EINVAL;
+	}
+	sensor_pctrl->gpio_state_active =
+		pinctrl_lookup_state(sensor_pctrl->pinctrl,
+				CAM_SENSOR_PINCTRL_STATE_DEFAULT);
+	if (IS_ERR_OR_NULL(sensor_pctrl->gpio_state_active)) {
+		CAM_ERR(CAM_SENSOR_UTIL,
+			"Failed to get the active state pinctrl handle");
+		return -EINVAL;
+	}
+	sensor_pctrl->gpio_state_suspend
+		= pinctrl_lookup_state(sensor_pctrl->pinctrl,
+				CAM_SENSOR_PINCTRL_STATE_SLEEP);
+	if (IS_ERR_OR_NULL(sensor_pctrl->gpio_state_suspend)) {
+		CAM_ERR(CAM_SENSOR_UTIL,
+			"Failed to get the suspend state pinctrl handle");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_sensor_bob_pwm_mode_switch(struct cam_hw_soc_info *soc_info,
+	int bob_reg_idx, bool flag)
+{
+	int rc = 0;
+	uint32_t op_current =
+		(flag == true) ? soc_info->rgltr_op_mode[bob_reg_idx] : 0;
+
+	if (soc_info->rgltr[bob_reg_idx] != NULL) {
+		rc = cam_wrapper_regulator_set_load(soc_info->rgltr[bob_reg_idx],
+			op_current);
+		if (rc)
+			CAM_WARN(CAM_SENSOR_UTIL,
+				"BoB PWM SetLoad failed rc: %d", rc);
+	}
+
+	return rc;
+}
+
+int msm_cam_sensor_handle_reg_gpio(int seq_type,
+	struct msm_camera_gpio_num_info *gpio_num_info, int val)
+{
+	int gpio_offset = -1;
+
+	if (!gpio_num_info) {
+		CAM_INFO(CAM_SENSOR_UTIL, "Input Parameters are not proper");
+		return 0;
+	}
+
+	CAM_DBG(CAM_SENSOR_UTIL, "Seq type: %d, config: %d", seq_type, val);
+
+	gpio_offset = seq_type;
+
+	if (gpio_num_info->valid[gpio_offset] == 1) {
+		CAM_DBG(CAM_SENSOR_UTIL, "VALID GPIO offset: %d, seqtype: %d",
+			 gpio_offset, seq_type);
+		cam_res_mgr_gpio_set_value(
+			gpio_num_info->gpio_num
+			[gpio_offset], val);
+	}
+
+	return 0;
+}
+
+static int cam_config_mclk_reg(struct cam_sensor_power_ctrl_t *ctrl,
+	struct cam_hw_soc_info *soc_info, int32_t index)
+{
+	int32_t num_vreg = 0, j = 0, rc = 0, idx = 0;
+	struct cam_sensor_power_setting *ps = NULL;
+	struct cam_sensor_power_setting *pd = NULL;
+
+	num_vreg = soc_info->num_rgltr;
+
+	pd = &ctrl->power_down_setting[index];
+
+	for (j = 0; j < num_vreg; j++) {
+		if (!strcmp(soc_info->rgltr_name[j], "cam_clk")) {
+			ps = NULL;
+			for (idx = 0; idx < ctrl->power_setting_size; idx++) {
+				if (ctrl->power_setting[idx].seq_type ==
+					pd->seq_type) {
+					ps = &ctrl->power_setting[idx];
+					break;
+				}
+			}
+
+			if (ps != NULL) {
+				CAM_DBG(CAM_SENSOR_UTIL, "Disable MCLK Regulator");
+				rc = cam_soc_util_regulator_disable(
+					soc_info->rgltr[j],
+					soc_info->rgltr_name[j],
+					soc_info->rgltr_min_volt[j],
+					soc_info->rgltr_max_volt[j],
+					soc_info->rgltr_op_mode[j],
+					soc_info->rgltr_delay[j]);
+
+				if (rc) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"MCLK REG DISALBE FAILED: %d",
+						rc);
+					return rc;
+				}
+
+				ps->data[0] =
+					soc_info->rgltr[j];
+			}
+		}
+	}
+
+	return rc;
+}
+
+int cam_sensor_util_request_power_domain(struct cam_hw_soc_info *soc_info)
+{
+	int i, rc = 0;
+
+	rc = cam_soc_util_configure_pd(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_SENSOR, "Failed to configure Genpd");
+		return rc;
+	}
+
+	pm_runtime_enable(soc_info->dev);
+
+	/*
+	 * Doing a pm_runtime_get_sync() and pm_runtime_put_sync() after pm_runtime_enable
+	 * makes sure that the GDSC is off and only enabled later by the usecase when there
+	 * is such a requirement.
+	 */
+	cam_soc_util_power_domain_enable_default(soc_info);
+	cam_soc_util_power_domain_disable_default(soc_info);
+
+	return rc;
+}
+
+void cam_sensor_util_release_power_domain(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+
+	pm_runtime_disable(soc_info->dev);
+
+	for (i = 0; i < soc_info->num_genpd; i++) {
+		if (!soc_info->genpd)
+			continue;
+		if (!soc_info->genpd[i])
+			continue;
+		dev_pm_domain_detach(soc_info->genpd[i], true);
+	}
+}
+
+int cam_sensor_core_power_up(struct cam_sensor_power_ctrl_t *ctrl,
+		struct cam_hw_soc_info *soc_info, struct completion *i3c_probe_status)
+{
+	int rc = 0, index = 0, no_gpio = 0, ret = 0, num_vreg, j = 0, i = 0;
+	int32_t vreg_idx = -1;
+	struct cam_sensor_power_setting *power_setting = NULL;
+	struct msm_camera_gpio_num_info *gpio_num_info = NULL;
+	long                             time_left;
+	uint32_t                         seq_min_volt = 0;
+	uint32_t                         seq_max_volt = 0;
+
+	CAM_DBG(CAM_SENSOR_UTIL, "Enter");
+	if (!ctrl) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Invalid ctrl handle");
+		return -EINVAL;
+	}
+
+	gpio_num_info = ctrl->gpio_num_info;
+	num_vreg = soc_info->num_rgltr;
+
+	if ((num_vreg <= 0) || (num_vreg > CAM_SOC_MAX_REGULATOR)) {
+		CAM_ERR(CAM_SENSOR_UTIL, "failed: num_vreg %d", num_vreg);
+		return -EINVAL;
+	}
+
+	ret = msm_camera_pinctrl_init(&(ctrl->pinctrl_info), ctrl->dev);
+	if (ret < 0) {
+		/* Some sensor subdev no pinctrl. */
+		CAM_DBG(CAM_SENSOR_UTIL, "Initialization of pinctrl failed");
+		ctrl->cam_pinctrl_status = 0;
+	} else {
+		ctrl->cam_pinctrl_status = 1;
+	}
+
+	rc = cam_sensor_util_request_gpio_table(soc_info, 1);
+	if (rc < 0) {
+		no_gpio = rc;
+	}
+
+	if (ctrl->cam_pinctrl_status) {
+		ret = pinctrl_select_state(
+			ctrl->pinctrl_info.pinctrl,
+			ctrl->pinctrl_info.gpio_state_active);
+		if (ret)
+			CAM_ERR(CAM_SENSOR_UTIL, "cannot set pin to active state");
+	}
+
+	CAM_DBG(CAM_SENSOR_UTIL, "power setting size: %d", ctrl->power_setting_size);
+
+	for (index = 0; index < ctrl->power_setting_size; index++) {
+		CAM_DBG(CAM_SENSOR_UTIL, "index: %d", index);
+		power_setting = &ctrl->power_setting[index];
+		if (!power_setting) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"Invalid power up settings for index %d",
+				index);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_SENSOR_UTIL, "seq_type %d", power_setting->seq_type);
+
+		switch (power_setting->seq_type) {
+		case SENSOR_MCLK:
+			if (power_setting->seq_val >= soc_info->num_clk) {
+				CAM_ERR(CAM_SENSOR_UTIL, "clk index %d >= max %u",
+					power_setting->seq_val,
+					soc_info->num_clk);
+				goto power_up_failed;
+			}
+			for (j = 0; j < num_vreg; j++) {
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_clk")) {
+					CAM_DBG(CAM_SENSOR_UTIL,
+						"Enable cam_clk: %d", j);
+
+					if (IS_ERR_OR_NULL(
+						soc_info->rgltr[j])) {
+						rc = PTR_ERR(
+							soc_info->rgltr[j]);
+						rc = rc ? rc : -EINVAL;
+						CAM_ERR(CAM_SENSOR_UTIL,
+							"vreg %s %d",
+							soc_info->rgltr_name[j],
+							rc);
+						goto power_up_failed;
+					}
+
+					rc =  cam_soc_util_regulator_enable(
+					soc_info->rgltr[j],
+					soc_info->rgltr_name[j],
+					soc_info->rgltr_min_volt[j],
+					soc_info->rgltr_max_volt[j],
+					soc_info->rgltr_op_mode[j],
+					soc_info->rgltr_delay[j]);
+					if (rc) {
+						CAM_ERR(CAM_SENSOR_UTIL,
+							"Reg enable failed");
+						goto power_up_failed;
+					}
+					power_setting->data[0] =
+						soc_info->rgltr[j];
+				}
+			}
+			if (power_setting->config_val)
+				soc_info->clk_rate[0][power_setting->seq_val] =
+					power_setting->config_val;
+
+			for (j = 0; j < soc_info->num_clk; j++) {
+				rc = cam_soc_util_clk_enable(soc_info, CAM_CLK_SW_CLIENT_IDX,
+					false, j, 0);
+				if (rc) {
+					CAM_ERR(CAM_UTIL,
+						"Failed in clk enable %d", i);
+					break;
+				}
+			}
+
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR_UTIL, "clk enable failed");
+				goto power_up_failed;
+			}
+			break;
+		case SENSOR_RESET:
+		case SENSOR_STANDBY:
+		case SENSOR_CUSTOM_GPIO1:
+		case SENSOR_CUSTOM_GPIO2:
+			if (no_gpio) {
+				CAM_ERR(CAM_SENSOR_UTIL, "request gpio failed");
+				goto power_up_failed;
+			}
+			if (!gpio_num_info) {
+				CAM_ERR(CAM_SENSOR_UTIL, "Invalid gpio_num_info");
+				goto power_up_failed;
+			}
+			CAM_DBG(CAM_SENSOR_UTIL, "gpio set val %d",
+				gpio_num_info->gpio_num
+				[power_setting->seq_type]);
+
+			rc = msm_cam_sensor_handle_reg_gpio(
+				power_setting->seq_type,
+				gpio_num_info,
+				(int) power_setting->config_val);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+					"Error in handling VREG GPIO");
+				goto power_up_failed;
+			}
+			break;
+		case SENSOR_VANA:
+		case SENSOR_VANA1:
+		case SENSOR_VDIG:
+		case SENSOR_VIO:
+		case SENSOR_VAF:
+		case SENSOR_VAF_PWDM:
+		case SENSOR_CUSTOM_REG1:
+		case SENSOR_CUSTOM_REG2:
+			if (power_setting->seq_val == INVALID_VREG)
+				break;
+
+			if (power_setting->seq_val >= CAM_VREG_MAX) {
+				CAM_ERR(CAM_SENSOR_UTIL, "vreg index %d >= max %d",
+					power_setting->seq_val,
+					CAM_VREG_MAX);
+				goto power_up_failed;
+			}
+			if (power_setting->seq_val < num_vreg) {
+				CAM_DBG(CAM_SENSOR_UTIL, "Enable Regulator");
+				vreg_idx = power_setting->seq_val;
+
+				if (IS_ERR_OR_NULL(
+					soc_info->rgltr[vreg_idx])) {
+					rc = PTR_ERR(soc_info->rgltr[vreg_idx]);
+					rc = rc ? rc : -EINVAL;
+
+					CAM_ERR(CAM_SENSOR_UTIL, "%s get failed %d",
+						soc_info->rgltr_name[vreg_idx],
+						rc);
+
+					goto power_up_failed;
+				}
+
+				if (power_setting->valid_config) {
+					seq_min_volt = power_setting->config_val;
+					seq_max_volt = power_setting->config_val;
+				} else {
+					seq_min_volt = soc_info->rgltr_min_volt[vreg_idx];
+					seq_max_volt = soc_info->rgltr_max_volt[vreg_idx];
+				}
+
+				rc =  cam_soc_util_regulator_enable(
+					soc_info->rgltr[vreg_idx],
+					soc_info->rgltr_name[vreg_idx],
+					seq_min_volt,
+					seq_max_volt,
+					soc_info->rgltr_op_mode[vreg_idx],
+					soc_info->rgltr_delay[vreg_idx]);
+				if (rc) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"Reg Enable failed for %s",
+						soc_info->rgltr_name[vreg_idx]);
+					goto power_up_failed;
+				}
+				power_setting->data[0] =
+						soc_info->rgltr[vreg_idx];
+			} else {
+				CAM_ERR(CAM_SENSOR_UTIL, "usr_idx:%d dts_idx:%d",
+					power_setting->seq_val, num_vreg);
+			}
+
+			rc = cam_soc_util_power_domain_enable_default(soc_info);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+					"Power domain enable failed with rc = %d", rc);
+				goto power_up_failed;
+			}
+
+			rc = msm_cam_sensor_handle_reg_gpio(
+				power_setting->seq_type,
+				gpio_num_info, 1);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+					"Error in handling VREG GPIO");
+				goto power_up_failed;
+			}
+			break;
+		default:
+			CAM_ERR(CAM_SENSOR_UTIL, "error power seq type %d",
+				power_setting->seq_type);
+			break;
+		}
+		if (power_setting->delay > 20)
+			msleep(power_setting->delay);
+		else if (power_setting->delay)
+			usleep_range(power_setting->delay * 1000,
+				(power_setting->delay * 1000) + 1000);
+	}
+
+	if (i3c_probe_status) {
+		time_left = cam_common_wait_for_completion_timeout(
+			i3c_probe_status,
+			msecs_to_jiffies(CAM_I3C_DEV_PROBE_TIMEOUT_MS));
+		if (!time_left) {
+			CAM_ERR(CAM_SENSOR_UTIL, "Wait for I3C probe timedout");
+			rc = -ETIMEDOUT;
+			goto power_up_failed;
+		}
+	}
+
+	return 0;
+power_up_failed:
+	CAM_ERR(CAM_SENSOR_UTIL, "failed. rc:%d", rc);
+	for (index--; index >= 0; index--) {
+		CAM_DBG(CAM_SENSOR_UTIL, "index %d",  index);
+		power_setting = &ctrl->power_setting[index];
+		CAM_DBG(CAM_SENSOR_UTIL, "type %d",
+			power_setting->seq_type);
+		switch (power_setting->seq_type) {
+		case SENSOR_MCLK:
+			for (i = soc_info->num_clk - 1; i >= 0; i--) {
+				cam_soc_util_clk_disable(soc_info, CAM_CLK_SW_CLIENT_IDX, false, i);
+			}
+			ret = cam_config_mclk_reg(ctrl, soc_info, index);
+			if (ret < 0) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+					"config clk reg failed rc: %d", ret);
+				continue;
+			}
+			break;
+		case SENSOR_RESET:
+		case SENSOR_STANDBY:
+		case SENSOR_CUSTOM_GPIO1:
+		case SENSOR_CUSTOM_GPIO2:
+			if (!gpio_num_info)
+				continue;
+			if (!gpio_num_info->valid
+				[power_setting->seq_type])
+				continue;
+			cam_res_mgr_gpio_set_value(
+				gpio_num_info->gpio_num
+				[power_setting->seq_type], GPIOF_OUT_INIT_LOW);
+			break;
+		case SENSOR_VANA:
+		case SENSOR_VANA1:
+		case SENSOR_VDIG:
+		case SENSOR_VIO:
+		case SENSOR_VAF:
+		case SENSOR_VAF_PWDM:
+		case SENSOR_CUSTOM_REG1:
+		case SENSOR_CUSTOM_REG2:
+			if (power_setting->seq_val < num_vreg) {
+				CAM_DBG(CAM_SENSOR_UTIL, "Disable Regulator");
+				vreg_idx = power_setting->seq_val;
+
+				rc =  cam_soc_util_regulator_disable(
+					soc_info->rgltr[vreg_idx],
+					soc_info->rgltr_name[vreg_idx],
+					soc_info->rgltr_min_volt[vreg_idx],
+					soc_info->rgltr_max_volt[vreg_idx],
+					soc_info->rgltr_op_mode[vreg_idx],
+					soc_info->rgltr_delay[vreg_idx]);
+
+				if (rc) {
+					CAM_ERR(CAM_SENSOR_UTIL,
+					"Fail to disalbe reg: %s",
+					soc_info->rgltr_name[vreg_idx]);
+					soc_info->rgltr[vreg_idx] = NULL;
+					msm_cam_sensor_handle_reg_gpio(
+						power_setting->seq_type,
+						gpio_num_info,
+						GPIOF_OUT_INIT_LOW);
+					continue;
+				}
+				power_setting->data[0] =
+						soc_info->rgltr[vreg_idx];
+
+			} else {
+				CAM_ERR(CAM_SENSOR_UTIL, "seq_val:%d > num_vreg: %d",
+					power_setting->seq_val, num_vreg);
+			}
+
+			cam_soc_util_power_domain_disable_default(soc_info);
+
+			msm_cam_sensor_handle_reg_gpio(power_setting->seq_type,
+				gpio_num_info, GPIOF_OUT_INIT_LOW);
+
+			break;
+		default:
+			CAM_ERR(CAM_SENSOR_UTIL, "error power seq type %d",
+				power_setting->seq_type);
+			break;
+		}
+		if (power_setting->delay > 20) {
+			msleep(power_setting->delay);
+		} else if (power_setting->delay) {
+			usleep_range(power_setting->delay * 1000,
+				(power_setting->delay * 1000) + 1000);
+		}
+	}
+
+	if (ctrl->cam_pinctrl_status) {
+		ret = pinctrl_select_state(
+			ctrl->pinctrl_info.pinctrl,
+			ctrl->pinctrl_info.gpio_state_suspend);
+		if (ret)
+			CAM_ERR(CAM_SENSOR_UTIL, "cannot set pin to suspend state");
+		devm_pinctrl_put(ctrl->pinctrl_info.pinctrl);
+	}
+
+	ctrl->cam_pinctrl_status = 0;
+	cam_sensor_util_request_gpio_table(soc_info, 0);
+
+	return -EINVAL;
+}
+
+static struct cam_sensor_power_setting*
+msm_camera_get_power_settings(struct cam_sensor_power_ctrl_t *ctrl,
+				enum msm_camera_power_seq_type seq_type,
+				uint16_t seq_val)
+{
+	struct cam_sensor_power_setting *power_setting, *ps = NULL;
+	int idx;
+
+	for (idx = 0; idx < ctrl->power_setting_size; idx++) {
+		power_setting = &ctrl->power_setting[idx];
+		if (power_setting->seq_type == seq_type &&
+			power_setting->seq_val ==  seq_val) {
+			ps = power_setting;
+			return ps;
+		}
+
+	}
+
+	return ps;
+}
+
+int cam_sensor_util_power_down(struct cam_sensor_power_ctrl_t *ctrl,
+		struct cam_hw_soc_info *soc_info)
+{
+	int index = 0, ret = 0, num_vreg = 0, i;
+	struct cam_sensor_power_setting *pd = NULL;
+	struct cam_sensor_power_setting *ps = NULL;
+	struct msm_camera_gpio_num_info *gpio_num_info = NULL;
+
+	CAM_DBG(CAM_SENSOR_UTIL, "Enter");
+	if (!ctrl || !soc_info) {
+		CAM_ERR(CAM_SENSOR_UTIL, "failed ctrl %pK",  ctrl);
+		return -EINVAL;
+	}
+
+	gpio_num_info = ctrl->gpio_num_info;
+	num_vreg = soc_info->num_rgltr;
+
+	if ((num_vreg <= 0) || (num_vreg > CAM_SOC_MAX_REGULATOR)) {
+		CAM_ERR(CAM_SENSOR_UTIL, "failed: num_vreg %d", num_vreg);
+		return -EINVAL;
+	}
+
+	if (ctrl->power_down_setting_size > MAX_POWER_CONFIG) {
+		CAM_ERR(CAM_SENSOR_UTIL, "Invalid: power setting size %d",
+			ctrl->power_setting_size);
+		return -EINVAL;
+	}
+
+	for (index = 0; index < ctrl->power_down_setting_size; index++) {
+		CAM_DBG(CAM_SENSOR_UTIL, "power_down_index %d",  index);
+		pd = &ctrl->power_down_setting[index];
+		if (!pd) {
+			CAM_ERR(CAM_SENSOR_UTIL,
+				"Invalid power down settings for index %d",
+				index);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_SENSOR_UTIL, "seq_type %d",  pd->seq_type);
+		switch (pd->seq_type) {
+		case SENSOR_MCLK:
+			for (i = soc_info->num_clk - 1; i >= 0; i--) {
+				cam_soc_util_clk_disable(soc_info, CAM_CLK_SW_CLIENT_IDX, false, i);
+			}
+
+			ret = cam_config_mclk_reg(ctrl, soc_info, index);
+			if (ret < 0) {
+				CAM_ERR(CAM_SENSOR_UTIL,
+					"config clk reg failed rc: %d", ret);
+				continue;
+			}
+			break;
+		case SENSOR_RESET:
+		case SENSOR_STANDBY:
+		case SENSOR_CUSTOM_GPIO1:
+		case SENSOR_CUSTOM_GPIO2:
+
+			if (!gpio_num_info->valid[pd->seq_type])
+				continue;
+
+			cam_res_mgr_gpio_set_value(
+				gpio_num_info->gpio_num
+				[pd->seq_type],
+				(int) pd->config_val);
+
+			break;
+		case SENSOR_VANA:
+		case SENSOR_VANA1:
+		case SENSOR_VDIG:
+		case SENSOR_VIO:
+		case SENSOR_VAF:
+		case SENSOR_VAF_PWDM:
+		case SENSOR_CUSTOM_REG1:
+		case SENSOR_CUSTOM_REG2:
+			if (pd->seq_val == INVALID_VREG)
+				break;
+
+			ps = msm_camera_get_power_settings(
+				ctrl, pd->seq_type,
+				pd->seq_val);
+			if (ps) {
+				if (pd->seq_val < num_vreg) {
+					CAM_DBG(CAM_SENSOR_UTIL,
+						"Disable Regulator");
+					ret =  cam_soc_util_regulator_disable(
+					soc_info->rgltr[ps->seq_val],
+					soc_info->rgltr_name[ps->seq_val],
+					soc_info->rgltr_min_volt[ps->seq_val],
+					soc_info->rgltr_max_volt[ps->seq_val],
+					soc_info->rgltr_op_mode[ps->seq_val],
+					soc_info->rgltr_delay[ps->seq_val]);
+					if (ret) {
+						CAM_ERR(CAM_SENSOR_UTIL,
+						"Reg: %s disable failed",
+						soc_info->rgltr_name[
+							ps->seq_val]);
+						msm_cam_sensor_handle_reg_gpio(
+							pd->seq_type,
+							gpio_num_info,
+							GPIOF_OUT_INIT_LOW);
+						continue;
+					}
+					ps->data[0] =
+						soc_info->rgltr[ps->seq_val];
+				} else {
+					CAM_ERR(CAM_SENSOR_UTIL,
+						"seq_val:%d > num_vreg: %d",
+						 pd->seq_val,
+						num_vreg);
+				}
+			} else
+				CAM_ERR(CAM_SENSOR_UTIL,
+					"error in power up/down seq");
+
+			cam_soc_util_power_domain_disable_default(soc_info);
+
+			ret = msm_cam_sensor_handle_reg_gpio(pd->seq_type,
+				gpio_num_info, GPIOF_OUT_INIT_LOW);
+
+			if (ret < 0)
+				CAM_ERR(CAM_SENSOR_UTIL,
+					"Error disabling VREG GPIO");
+			break;
+		default:
+			CAM_ERR(CAM_SENSOR_UTIL, "error power seq type %d",
+				pd->seq_type);
+			break;
+		}
+		if (pd->delay > 20)
+			msleep(pd->delay);
+		else if (pd->delay)
+			usleep_range(pd->delay * 1000,
+				(pd->delay * 1000) + 1000);
+	}
+
+	if (ctrl->cam_pinctrl_status) {
+		ret = pinctrl_select_state(
+				ctrl->pinctrl_info.pinctrl,
+				ctrl->pinctrl_info.gpio_state_suspend);
+		if (ret)
+			CAM_ERR(CAM_SENSOR_UTIL, "cannot set pin to suspend state");
+
+		devm_pinctrl_put(ctrl->pinctrl_info.pinctrl);
+	}
+
+	cam_sensor_util_request_gpio_table(soc_info, 0);
+	ctrl->cam_pinctrl_status = 0;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.h
@@ -0,0 +1,152 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_UTIL_H_
+#define _CAM_SENSOR_UTIL_H_
+
+#include <linux/kernel.h>
+#include <linux/regulator/consumer.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <linux/of.h>
+#include "cam_sensor_cmn_header.h"
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_interface.h"
+#include <cam_mem_mgr.h>
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_sensor_io.h"
+#include "cam_csiphy_core.h"
+
+#define INVALID_VREG 100
+#define RES_MGR_GPIO_NEED_HOLD   1
+#define RES_MGR_GPIO_CAN_FREE    2
+
+/*
+ * Constant Factors needed to change QTimer ticks to nanoseconds
+ * QTimer Freq = 19.2 MHz
+ * Time(us) = ticks/19.2
+ * Time(ns) = ticks/19.2 * 1000
+ */
+#define QTIMER_MUL_FACTOR   10000
+#define QTIMER_DIV_FACTOR   192
+
+int cam_sensor_count_elems_i3c_device_id(struct device_node *dev,
+	int *num_entries, char *sensor_id_table_str);
+
+int cam_sensor_fill_i3c_device_id(struct device_node *dev, int num_entries,
+	char *sensor_id_table_str, struct i3c_device_id *sensor_i3c_device_id);
+
+int cam_get_dt_power_setting_data(struct device_node *of_node,
+	struct cam_hw_soc_info *soc_info,
+	struct cam_sensor_power_ctrl_t *power_info);
+
+int msm_camera_pinctrl_init
+	(struct msm_pinctrl_info *sensor_pctrl, struct device *dev);
+
+int32_t cam_sensor_util_get_current_qtimer_ns(uint64_t *qtime_ns);
+
+int32_t cam_sensor_util_write_qtimer_to_io_buffer(
+	uint64_t qtime_ns, struct cam_buf_io_cfg *io_cfg);
+
+int32_t cam_sensor_handle_random_write(
+	struct cam_cmd_i2c_random_wr *cam_cmd_i2c_random_wr,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list);
+
+int32_t cam_sensor_handle_continuous_write(
+	struct cam_cmd_i2c_continuous_wr *cam_cmd_i2c_continuous_wr,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list);
+
+int32_t cam_sensor_handle_delay(
+	uint32_t **cmd_buf,
+	uint16_t generic_op_code,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t offset, uint32_t *byte_cnt,
+	struct list_head *list_ptr);
+
+int32_t cam_sensor_handle_poll(
+	uint32_t **cmd_buf,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *byte_cnt, int32_t *offset,
+	struct list_head **list_ptr);
+
+int32_t cam_sensor_handle_random_read(
+	struct cam_cmd_i2c_random_rd *cmd_i2c_random_rd,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint16_t *cmd_length_in_bytes,
+	int32_t *offset,
+	struct list_head **list,
+	struct cam_buf_io_cfg *io_cfg);
+
+int32_t cam_sensor_handle_continuous_read(
+	struct cam_cmd_i2c_continuous_rd *cmd_i2c_continuous_rd,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint16_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list,
+	struct cam_buf_io_cfg *io_cfg);
+
+int cam_sensor_i2c_command_parser(struct camera_io_master *io_master,
+	struct i2c_settings_array *i2c_reg_settings,
+	struct cam_cmd_buf_desc *cmd_desc, int32_t num_cmd_buffers,
+	struct cam_buf_io_cfg *io_cfg);
+
+int cam_sensor_util_i2c_apply_setting(struct camera_io_master *io_master_info,
+	struct i2c_settings_list *i2c_list);
+
+int32_t cam_sensor_i2c_read_data(
+	struct i2c_settings_array *i2c_settings,
+	struct camera_io_master *io_master_info);
+
+int32_t delete_request(struct i2c_settings_array *i2c_array);
+int cam_sensor_util_request_gpio_table(
+	struct cam_hw_soc_info *soc_info, int gpio_en);
+
+int cam_sensor_util_init_gpio_pin_tbl(
+	struct cam_hw_soc_info *soc_info,
+	struct msm_camera_gpio_num_info **pgpio_num_info);
+
+int cam_sensor_util_request_power_domain(
+	struct cam_hw_soc_info *soc_info);
+
+void cam_sensor_util_release_power_domain(
+	struct cam_hw_soc_info *soc_info);
+
+int cam_sensor_core_power_up(struct cam_sensor_power_ctrl_t *ctrl,
+		struct cam_hw_soc_info *soc_info, struct completion *i3c_probe_status);
+
+int cam_sensor_util_power_down(struct cam_sensor_power_ctrl_t *ctrl,
+		struct cam_hw_soc_info *soc_info);
+
+int msm_camera_fill_vreg_params(struct cam_hw_soc_info *soc_info,
+	struct cam_sensor_power_setting *power_setting,
+	uint16_t power_setting_size);
+
+int32_t cam_sensor_update_power_settings(void *cmd_buf,
+	uint32_t cmd_length, struct cam_sensor_power_ctrl_t *power_info,
+	size_t cmd_buf_len);
+
+int cam_sensor_bob_pwm_mode_switch(struct cam_hw_soc_info *soc_info,
+	int bob_reg_idx, bool flag);
+
+bool cam_sensor_util_check_gpio_is_shared(struct cam_hw_soc_info *soc_info);
+
+static inline int cam_sensor_util_aon_ops(bool get_access, uint32_t phy_idx)
+{
+	CAM_DBG(CAM_SENSOR, "Updating Main/Aon operation");
+	return cam_csiphy_util_update_aon_ops(get_access, phy_idx);
+}
+
+static inline int cam_sensor_util_aon_registration(uint32_t phy_idx, uint32_t aon_camera_id)
+{
+	CAM_DBG(CAM_SENSOR, "Register phy_idx: %u for AON_Camera_ID: %d", phy_idx, aon_camera_id);
+	return cam_csiphy_util_update_aon_registration(phy_idx, aon_camera_id);
+}
+
+#endif /* _CAM_SENSOR_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_core.c
@@ -0,0 +1,888 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_tpg_core.h"
+#include "cam_packet_util.h"
+#include <cam_mem_mgr.h>
+#include "tpg_hw/tpg_hw.h"
+
+int cam_tpg_shutdown(struct cam_tpg_device *tpg_dev)
+{
+	if (tpg_dev != NULL) {
+		CAM_INFO(CAM_TPG, "TPG[%d] shutdown cleanup.",
+				tpg_dev->soc_info.index);
+		if (!tpg_dev->hw_no_ops)
+			tpg_hw_reset(&tpg_dev->tpg_hw);
+		tpg_dev->state = CAM_TPG_STATE_INIT;
+	}
+	return 0;
+}
+
+int cam_tpg_publish_dev_info(
+	struct cam_req_mgr_device_info *info)
+{
+	int rc = 0;
+	struct cam_tpg_device *tpg_dev = NULL;
+
+	if (!info)
+		return -EINVAL;
+
+	tpg_dev = (struct cam_tpg_device *)
+		cam_get_device_priv(info->dev_hdl);
+
+	if (!tpg_dev) {
+		CAM_ERR(CAM_TPG, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	info->dev_id = CAM_REQ_MGR_DEVICE_TPG;
+	strscpy(info->name, CAM_TPG_NAME, sizeof(info->name));
+	/* Hard code for now */
+	info->p_delay = 1;
+	info->trigger = CAM_TRIGGER_POINT_SOF;
+
+	return rc;
+}
+
+int cam_tpg_setup_link(
+	struct cam_req_mgr_core_dev_link_setup *link)
+{
+	struct cam_tpg_device *tpg_dev = NULL;
+
+	if (!link)
+		return -EINVAL;
+
+	tpg_dev = (struct cam_tpg_device *)
+		cam_get_device_priv(link->dev_hdl);
+	if (!tpg_dev) {
+		CAM_ERR(CAM_TPG, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&tpg_dev->mutex);
+	if (link->link_enable) {
+		tpg_dev->crm_intf.link_hdl = link->link_hdl;
+		tpg_dev->crm_intf.crm_cb = link->crm_cb;
+		CAM_DBG(CAM_TPG, "TPG[%d] CRM enable link done", tpg_dev->soc_info.index);
+	} else {
+		tpg_dev->crm_intf.link_hdl = -1;
+		tpg_dev->crm_intf.crm_cb = NULL;
+		CAM_DBG(CAM_TPG, "TPG[%d] CRM disable link done", tpg_dev->soc_info.index);
+	}
+	mutex_unlock(&tpg_dev->mutex);
+	return 0;
+}
+
+static int cam_tpg_notify_frame_skip(
+	struct cam_req_mgr_apply_request *apply)
+{
+	struct cam_tpg_device *tpg_dev = NULL;
+
+	if (apply == NULL) {
+		CAM_ERR(CAM_TPG, "invalid parameters");
+		return -EINVAL;
+	}
+	tpg_dev = (struct cam_tpg_device *)cam_get_device_priv(apply->dev_hdl);
+	if (tpg_dev == NULL) {
+		CAM_ERR(CAM_TPG, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_TPG, "TPG[%d] Got Skip frame from crm for request %lld",
+		tpg_dev->soc_info.index,
+		apply->request_id);
+	return 0;
+}
+
+static int cam_tpg_apply_req(
+	struct cam_req_mgr_apply_request *apply)
+{
+	struct cam_tpg_device *tpg_dev = NULL;
+
+	if (!apply) {
+		CAM_ERR(CAM_TPG, "invalid parameters");
+		return -EINVAL;
+	}
+	tpg_dev = (struct cam_tpg_device *)
+		cam_get_device_priv(apply->dev_hdl);
+
+	if (tpg_dev == NULL) {
+		CAM_ERR(CAM_TPG, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_TPG, "TPG[%d] Got Apply request from crm %lld",
+		tpg_dev->soc_info.index,
+		apply->request_id);
+	mutex_lock(&tpg_dev->mutex);
+	tpg_hw_apply(&tpg_dev->tpg_hw,
+		apply->request_id);
+	mutex_unlock(&tpg_dev->mutex);
+
+	return 0;
+}
+
+static int cam_tpg_flush_req(
+	struct cam_req_mgr_flush_request *flush)
+{
+	CAM_DBG(CAM_TPG, "Got Flush request from crm");
+	return 0;
+}
+
+static int cam_tpg_process_crm_evt(
+	struct cam_req_mgr_link_evt_data *event)
+{
+
+	struct cam_tpg_device *tpg_dev = NULL;
+	if (!event) {
+		CAM_ERR(CAM_TPG, "Invalid argument");
+		return -EINVAL;
+	}
+
+	tpg_dev = cam_get_device_priv(event->dev_hdl);
+	if (!tpg_dev) {
+		CAM_ERR(CAM_TPG, "Invalid dev_hdl");
+		return -EINVAL;
+	}
+
+	switch(event->evt_type) {
+	case CAM_REQ_MGR_LINK_EVT_SOF_FREEZE:
+		if (tpg_dev->hw_no_ops) {
+			CAM_DBG(CAM_TPG, "TPG[%d] SOF Freeze hw_no_ops: %d",
+				tpg_dev->soc_info.index, tpg_dev->hw_no_ops);
+		} else
+			tpg_hw_dump_status(&tpg_dev->tpg_hw);
+		break;
+	default:
+		CAM_DBG(CAM_TPG, "Got crm event notification: %d", event->evt_type);
+		break;
+	}
+	return 0;
+}
+
+static int cam_tpg_dump_req(
+	struct cam_req_mgr_dump_info *dump_info)
+{
+	CAM_DBG(CAM_TPG, "Got dump request from CRM");
+	return 0;
+}
+
+int tpg_crm_intf_init(
+	struct cam_tpg_device *tpg_dev)
+{
+	if (tpg_dev == NULL)
+		return -EINVAL;
+
+	tpg_dev->crm_intf.device_hdl = -1;
+	tpg_dev->crm_intf.link_hdl = -1;
+	tpg_dev->crm_intf.ops.get_dev_info = cam_tpg_publish_dev_info;
+	tpg_dev->crm_intf.ops.link_setup = cam_tpg_setup_link;
+	tpg_dev->crm_intf.ops.apply_req = cam_tpg_apply_req;
+	tpg_dev->crm_intf.ops.notify_frame_skip =
+		cam_tpg_notify_frame_skip;
+	tpg_dev->crm_intf.ops.flush_req = cam_tpg_flush_req;
+	tpg_dev->crm_intf.ops.process_evt = cam_tpg_process_crm_evt;
+	tpg_dev->crm_intf.ops.dump_req = cam_tpg_dump_req;
+
+	return 0;
+}
+
+static int __cam_tpg_handle_query_cap(
+	struct cam_tpg_device *tpg_dev,
+	struct cam_tpg_query_cap *query)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+
+	if (!tpg_dev || !query) {
+		CAM_ERR(CAM_TPG, "invalid argument");
+		return -EINVAL;
+	}
+
+	soc_info = &tpg_dev->soc_info;
+	CAM_DBG(CAM_TPG, "Handling tpg query capability for %d slot: %d phy:%d",
+			soc_info->index, tpg_dev->slot_id, tpg_dev->phy_id);
+	query->slot_info = soc_info->index;
+	query->csiphy_slot_id = tpg_dev->phy_id;
+	query->version = 0x0;
+	if (tpg_dev->tpg_hw.hw_info) {
+		query->version   = tpg_dev->tpg_hw.hw_info->version;
+	} else {
+		CAM_ERR(CAM_TPG, "Invalid hw info");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int __cam_tpg_handle_acquire_dev(
+	struct cam_tpg_device *tpg_dev,
+	struct cam_tpg_acquire_dev *acquire)
+{
+	int rc = 0;
+	struct cam_create_dev_hdl crm_intf_params;
+
+	if (!tpg_dev || !acquire) {
+		CAM_ERR(CAM_TPG, "invalid input ");
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	if (tpg_dev->state != CAM_TPG_STATE_INIT) {
+		CAM_ERR(CAM_TPG, "TPG[%d] not in right state[%d] to acquire",
+				tpg_dev->soc_info.index, tpg_dev->state);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	crm_intf_params.session_hdl = acquire->session_handle;
+	crm_intf_params.ops = &tpg_dev->crm_intf.ops;
+	crm_intf_params.v4l2_sub_dev_flag = 0;
+	crm_intf_params.media_entity_flag = 0;
+	crm_intf_params.priv = tpg_dev;
+	crm_intf_params.dev_id = CAM_TPG;
+
+	acquire->device_handle =
+		cam_create_device_hdl(&crm_intf_params);
+	tpg_dev->crm_intf.device_hdl = acquire->device_handle;
+	tpg_dev->crm_intf.session_hdl = acquire->session_handle;
+	rc = tpg_hw_acquire(&tpg_dev->tpg_hw, (struct tpg_hw_acquire_args *)NULL);
+	if (rc) {
+		CAM_ERR(CAM_TPG, "TPG[%d] hw acquire failed", tpg_dev->soc_info.index);
+		cam_destroy_device_hdl(tpg_dev->crm_intf.device_hdl);
+		tpg_dev->crm_intf.device_hdl  = -1;
+		tpg_dev->crm_intf.session_hdl = -1;
+	} else {
+		tpg_dev->state = CAM_TPG_STATE_ACQUIRE;
+		CAM_INFO(CAM_TPG, "TPG[%d] Acquire Device done", tpg_dev->soc_info.index);
+	}
+exit:
+	return rc;
+}
+
+static int __cam_tpg_handle_release_dev(
+	struct cam_tpg_device *tpg_dev,
+	struct cam_release_dev_cmd *release)
+{
+	int rc = 0;
+
+	if (!release || !tpg_dev) {
+		CAM_ERR(CAM_TPG, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (release->dev_handle <= 0) {
+		CAM_ERR(CAM_TPG, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (release->session_handle <= 0) {
+		CAM_ERR(CAM_TPG, "Invalid session handle for context");
+		return -EINVAL;
+	}
+	if (tpg_dev->state == CAM_TPG_STATE_INIT) {
+		CAM_WARN(CAM_TPG, "TPG[%d] not in right state[%d] to release",
+				tpg_dev->soc_info.index, tpg_dev->state);
+		return 0;
+	}
+
+	if (tpg_dev->state == CAM_TPG_STATE_START) {
+		CAM_DBG(CAM_TPG, "TPG[%d] release from start state",
+						tpg_dev->soc_info.index);
+		if (!tpg_dev->hw_no_ops) {
+			rc = tpg_hw_stop(&tpg_dev->tpg_hw);
+			if (rc < 0) {
+				CAM_ERR(CAM_TPG, "TPG[%d] unable to stop tpg",
+						tpg_dev->soc_info.index);
+				return rc;
+			}
+		}
+	}
+	rc = tpg_hw_release(&tpg_dev->tpg_hw);
+	if (rc) {
+		CAM_ERR(CAM_TPG, "TPG[%d] hw release failed",
+						tpg_dev->soc_info.index);
+	} else {
+		cam_destroy_device_hdl(tpg_dev->crm_intf.device_hdl);
+		tpg_dev->crm_intf.device_hdl  = -1;
+		tpg_dev->crm_intf.session_hdl = -1;
+		CAM_INFO(CAM_TPG, "TPG[%d] Release Done.", tpg_dev->soc_info.index);
+		tpg_dev->state = CAM_TPG_STATE_INIT;
+	}
+
+	return rc;
+}
+
+static int __cam_tpg_handle_start_dev(
+	struct cam_tpg_device *tpg_dev,
+	struct cam_start_stop_dev_cmd *start)
+{
+	int rc = 0;
+	if (!start || !tpg_dev)
+		return -EINVAL;
+
+	if (start->dev_handle <= 0) {
+		CAM_ERR(CAM_TPG, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (start->session_handle <= 0) {
+		CAM_ERR(CAM_TPG, "Invalid session handle for context");
+		return -EINVAL;
+	}
+	if (tpg_dev->state != CAM_TPG_STATE_ACQUIRE) {
+		CAM_ERR(CAM_TPG, "TPG[%d] not in right state[%d] to start",
+				tpg_dev->soc_info.index, tpg_dev->state);
+		return -EINVAL;
+	}
+	if (!tpg_dev->hw_no_ops)
+		rc = tpg_hw_start(&tpg_dev->tpg_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_TPG, "TPG[%d] START_DEV failed hw_no_ops: %d",
+				tpg_dev->soc_info.index, tpg_dev->hw_no_ops);
+	} else {
+		tpg_dev->state = CAM_TPG_STATE_START;
+		CAM_INFO(CAM_TPG, "TPG[%d] START_DEV done hw_no_ops: %d.",
+				tpg_dev->soc_info.index, tpg_dev->hw_no_ops);
+	}
+
+	return rc;
+}
+
+static int __cam_tpg_handle_stop_dev(
+	struct cam_tpg_device *tpg_dev,
+	struct cam_start_stop_dev_cmd *stop)
+{
+	int rc = 0;
+	if (!stop || !tpg_dev)
+		return -EINVAL;
+
+	if (stop->dev_handle <= 0) {
+		CAM_ERR(CAM_TPG, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (stop->session_handle <= 0) {
+		CAM_ERR(CAM_TPG, "Invalid session handle for context");
+		return -EINVAL;
+	}
+	if (tpg_dev->state != CAM_TPG_STATE_START) {
+		CAM_WARN(CAM_TPG, "TPG[%d] not in right state[%d] to stop",
+				tpg_dev->soc_info.index, tpg_dev->state);
+	}
+	if (!tpg_dev->hw_no_ops)
+		rc = tpg_hw_stop(&tpg_dev->tpg_hw);
+	if (rc) {
+		CAM_ERR(CAM_TPG, "TPG[%d] STOP_DEV failed  hw_no_ops: %d",
+				tpg_dev->soc_info.index, tpg_dev->hw_no_ops);
+	} else {
+		tpg_dev->state = CAM_TPG_STATE_ACQUIRE;
+		CAM_INFO(CAM_TPG, "TPG[%d] STOP_DEV done hw_no_ops: %d.",
+				tpg_dev->soc_info.index, tpg_dev->hw_no_ops);
+	}
+
+	return rc;
+}
+
+static int cam_tpg_validate_cmd_descriptor(
+	struct cam_cmd_buf_desc *cmd_desc,
+	uint32_t *cmd_type, uintptr_t *cmd_addr)
+{
+	int rc = 0;
+	uintptr_t generic_ptr;
+	size_t len_of_buff = 0;
+	uint32_t                *cmd_buf = NULL;
+	struct tpg_command_header_t *cmd_header = NULL;
+
+	if (!cmd_desc || !cmd_type || !cmd_addr)
+		return -EINVAL;
+
+	rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+		&generic_ptr, &len_of_buff);
+	if (rc < 0) {
+		CAM_ERR(CAM_TPG,
+			"Failed to get cmd buf Mem address : %d", rc);
+		return rc;
+	}
+
+	cmd_buf = (uint32_t *)generic_ptr;
+	cmd_buf += cmd_desc->offset / 4;
+	cmd_header = (struct tpg_command_header_t *)cmd_buf;
+
+	if (len_of_buff < sizeof(struct tpg_command_header_t)) {
+		CAM_ERR(CAM_TPG, "Got invalid command descriptor of invalid cmd buffer size");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	switch (cmd_header->cmd_type) {
+	case TPG_CMD_TYPE_GLOBAL_CONFIG: {
+		if (cmd_header->size != sizeof(struct tpg_global_config_t)) {
+			CAM_ERR(CAM_TPG, "Got invalid global config command recv: %d exp: %d",
+					cmd_header->size,
+					sizeof(struct tpg_global_config_t));
+			rc = -EINVAL;
+			goto end;
+		}
+		CAM_INFO(CAM_TPG, "Got global config cmd");
+		*cmd_type = TPG_CMD_TYPE_GLOBAL_CONFIG;
+		break;
+	}
+	case TPG_CMD_TYPE_STREAM_CONFIG: {
+		if (cmd_header->cmd_version == 3 &&
+			cmd_header->size != sizeof(struct tpg_stream_config_v3_t)) {
+			CAM_ERR(CAM_TPG, "Got invalid stream config command recv: %d exp: %d",
+				cmd_header->size,
+				sizeof(struct tpg_stream_config_v3_t));
+
+			rc = -EINVAL;
+			goto end;
+		} else if (cmd_header->cmd_version == 2 &&
+			cmd_header->size != sizeof(struct tpg_stream_config_t)) {
+			CAM_ERR(CAM_TPG, "Got invalid stream config cmd recv: %d exp: %d",
+				cmd_header->size,
+				sizeof(struct tpg_stream_config_t));
+
+			rc = -EINVAL;
+			goto end;
+		} else if (cmd_header->cmd_version == 1 &&
+			cmd_header->size != sizeof(struct tpg_old_stream_config_t)) {
+			CAM_ERR(CAM_TPG, "Got invalid stream config cmd recv: %d exp: %d",
+				cmd_header->size,
+				sizeof(struct tpg_old_stream_config_t));
+
+			rc = -EINVAL;
+			goto end;
+		}
+		*cmd_type = TPG_CMD_TYPE_STREAM_CONFIG;
+		break;
+	}
+	case TPG_CMD_TYPE_ILLUMINATION_CONFIG: {
+		if (cmd_header->size != sizeof(struct tpg_illumination_control)) {
+			CAM_ERR(CAM_TPG, "Got invalid illumination config command");
+			rc = -EINVAL;
+			goto end;
+		}
+		*cmd_type = TPG_CMD_TYPE_ILLUMINATION_CONFIG;
+		break;
+	}
+	case TPG_CMD_TYPE_SETTINGS_CONFIG: {
+		if (cmd_header->size != sizeof(struct tpg_settings_config_t)) {
+			CAM_ERR(CAM_TPG, "Got invalid settings config command recv: %d exp: %d",
+					cmd_header->size,
+					sizeof(struct tpg_settings_config_t));
+			rc = -EINVAL;
+			goto end;
+		}
+		CAM_INFO(CAM_TPG, "Got settings config command");
+		*cmd_type = TPG_CMD_TYPE_SETTINGS_CONFIG;
+		break;
+	}
+
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_TPG, "invalid config command");
+		goto end;
+	}
+	if ((ssize_t)cmd_desc->offset > (len_of_buff - cmd_header->size)) {
+		CAM_ERR(CAM_TPG, "cmd header offset mismatch");
+		rc = -EINVAL;
+	}
+
+	*cmd_addr = (uintptr_t)cmd_header;
+end:
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+static int cam_tpg_cmd_buf_parse(
+	struct cam_tpg_device *tpg_dev,
+	struct cam_packet *packet)
+{
+	int rc = 0, i = 0;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct tpg_hw_request *req = NULL;
+
+	if (!tpg_dev || !packet)
+		return -EINVAL;
+
+	/* Allocate space for TPG requests */
+	req = tpg_hw_create_request(&tpg_dev->tpg_hw,
+			packet->header.request_id);
+	if (req == NULL) {
+		CAM_ERR(CAM_TPG, "TPG[%d] Unable to create hw request ",
+			tpg_dev->soc_info.index);
+		return -EINVAL;
+	}
+
+	rc = tpg_hw_request_set_opcode(req,
+			packet->header.op_code & 0xFF);
+	if (rc < 0)
+		goto free_request;
+
+	CAM_DBG(CAM_TPG, "Queue TPG requests for request id %lld", req->request_id);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		uint32_t cmd_type = TPG_CMD_TYPE_INVALID;
+		uintptr_t cmd_addr;
+		struct tpg_command_header_t *cmd_header = NULL;
+
+		cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint32_t *)&packet->payload_flex +
+			(packet->cmd_buf_offset / 4) +
+			(i * (sizeof(struct cam_cmd_buf_desc)/4)));
+
+		rc = cam_tpg_validate_cmd_descriptor(cmd_desc,
+				&cmd_type, &cmd_addr);
+		if (rc < 0) {
+			kfree(req);
+			goto end;
+		}
+
+		cmd_header = (struct tpg_command_header_t *)cmd_addr;
+
+		switch (cmd_type) {
+		case TPG_CMD_TYPE_GLOBAL_CONFIG:
+			/* Copy the global config to request */
+			memcpy(&req->global_config,
+				(struct tpg_global_config_t *)cmd_addr,
+				sizeof(struct tpg_global_config_t));
+			tpg_dev->tpg_hw.tpg_clock = req->global_config.tpg_clock;
+			break;
+		case TPG_CMD_TYPE_STREAM_CONFIG: {
+			if ((cmd_header->cmd_version == 3) &&
+						(!tpg_dev->hw_no_ops)) {
+				rc = tpg_hw_add_stream_v3(&tpg_dev->tpg_hw,
+					req,
+					(struct tpg_stream_config_v3_t *)cmd_addr);
+				CAM_DBG(CAM_TPG, "Stream config v3");
+			} else if ((cmd_header->cmd_version == 1 ||
+				cmd_header->cmd_version == 2) &&
+						(!tpg_dev->hw_no_ops)) {
+				rc = tpg_hw_add_stream(&tpg_dev->tpg_hw,
+					req,
+					(struct tpg_stream_config_t *)cmd_addr);
+				CAM_DBG(CAM_TPG, "Stream config");
+			}
+			if (rc < 0)
+				goto free_request;
+			break;
+		}
+		case TPG_CMD_TYPE_SETTINGS_CONFIG: {
+			CAM_DBG(CAM_TPG, "TPG[%d] Got TPG Settings Config",
+							tpg_dev->soc_info.index);
+			if (!tpg_dev->hw_no_ops)
+				rc = tpg_hw_copy_settings_config(
+				&tpg_dev->tpg_hw,
+				(struct tpg_settings_config_t *)cmd_addr);
+			break;
+		}
+		case TPG_CMD_TYPE_ILLUMINATION_CONFIG:
+			CAM_ERR(CAM_TPG, "TPG[%d] ILLUMINATION CONFIG not supported now ",
+								tpg_dev->soc_info.index);
+			break;
+		default:
+			CAM_ERR(CAM_TPG, "TPG[%d] invalid command %d",
+				tpg_dev->soc_info.index,
+				cmd_type);
+			rc = -EINVAL;
+			goto free_request;
+			break;
+		}
+	}
+	if (!tpg_dev->hw_no_ops)
+		tpg_hw_add_request(&tpg_dev->tpg_hw, req);
+end:
+	return rc;
+free_request:
+	/* free the request and return the failure */
+	tpg_hw_free_request(&tpg_dev->tpg_hw, req);
+	kfree(req);
+	return rc;
+}
+
+static int cam_tpg_packet_parse(
+	struct cam_tpg_device *tpg_dev,
+	struct cam_config_dev_cmd *config)
+{
+	int rc = 0;
+	uintptr_t generic_ptr;
+	size_t len_of_buff = 0, remain_len = 0;
+	struct cam_packet *csl_packet = NULL;
+
+	rc = cam_mem_get_cpu_buf(config->packet_handle,
+		&generic_ptr, &len_of_buff);
+	if (rc < 0) {
+		CAM_ERR(CAM_TPG, "Failed in getting the packet: %d", rc);
+		return rc;
+	}
+
+	if ((sizeof(struct cam_packet) > len_of_buff) ||
+		((size_t)config->offset >= len_of_buff -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_TPG,
+			"Inval cam_packet struct size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len_of_buff);
+		rc = -EINVAL;
+		goto end;
+	}
+	remain_len = len_of_buff;
+	remain_len -= (size_t)config->offset;
+	csl_packet = (struct cam_packet *)(generic_ptr +
+		(uint32_t)config->offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_TPG, "Invalid packet params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_TPG, "TPG[%d] "
+			"CONFIG_DEV, Packet opcode = %d num_cmds: %d num_ios: %d num_patch: %d",
+			tpg_dev->soc_info.index,
+			(csl_packet->header.op_code & 0xFF),
+			csl_packet->num_cmd_buf,
+			csl_packet->num_io_configs,
+			csl_packet->num_patches);
+	switch ((csl_packet->header.op_code & 0xFF)) {
+	case CAM_TPG_PACKET_OPCODE_INITIAL_CONFIG: {
+		if (csl_packet->num_cmd_buf <= 0) {
+			CAM_ERR(CAM_TPG, "Expecting atleast one command in Init packet");
+			rc = -EINVAL;
+			goto end;
+		}
+		rc = cam_tpg_cmd_buf_parse(tpg_dev, csl_packet);
+		if (rc < 0) {
+			CAM_ERR(CAM_TPG, "CMD buffer parse failed");
+			goto end;
+		}
+		if (!tpg_dev->hw_no_ops)
+			tpg_hw_config(&tpg_dev->tpg_hw,
+				TPG_HW_CMD_INIT_CONFIG, NULL);
+		break;
+	}
+	case CAM_TPG_PACKET_OPCODE_NOP:
+	case CAM_TPG_PACKET_OPCODE_UPDATE:
+	{
+		struct cam_req_mgr_add_request add_req = {0};
+		rc = cam_tpg_cmd_buf_parse(tpg_dev, csl_packet);
+		if (rc < 0) {
+			CAM_ERR(CAM_TPG, "CMD buffer parse failed");
+			goto end;
+		}
+
+		CAM_DBG(CAM_TPG, "TPG[%d] packet request id : %llu",
+				tpg_dev->soc_info.index,
+				csl_packet->header.request_id);
+		if ((tpg_dev->crm_intf.link_hdl != -1) &&
+			(tpg_dev->crm_intf.device_hdl != -1) &&
+			(tpg_dev->crm_intf.crm_cb != NULL)) {
+			add_req.link_hdl = tpg_dev->crm_intf.link_hdl;
+			add_req.dev_hdl  = tpg_dev->crm_intf.device_hdl;
+			add_req.req_id = csl_packet->header.request_id;
+			tpg_dev->crm_intf.crm_cb->add_req(&add_req);
+		} else {
+			CAM_ERR(CAM_TPG, "TPG[%d] add request %d failed",
+					tpg_dev->soc_info.index,
+					csl_packet->header.request_id);
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_TPG, "TPG[%d] Invalid packet %x",
+					tpg_dev->soc_info.index,
+					(csl_packet->header.op_code & 0xFF));
+		rc = -EINVAL;
+		break;
+	}
+end:
+	cam_mem_put_cpu_buf(config->packet_handle);
+	return rc;
+}
+
+static int __cam_tpg_handle_config_dev(
+	struct cam_tpg_device *tpg_dev,
+	struct cam_config_dev_cmd *config)
+{
+	int rc = 0;
+
+	if (!config || !tpg_dev)
+		return -EINVAL;
+
+	if (config->dev_handle <= 0) {
+		CAM_ERR(CAM_TPG, "TPG[%d] Invalid device handle",
+				tpg_dev->soc_info.index);
+		return -EINVAL;
+	}
+
+	if (config->session_handle <= 0) {
+		CAM_ERR(CAM_TPG, "TPG[%d] Invalid session handle",
+				tpg_dev->soc_info.index);
+		return -EINVAL;
+	}
+
+	if (tpg_dev->state < CAM_TPG_STATE_ACQUIRE) {
+		CAM_ERR(CAM_TPG, "TPG[%d] not in right state[%d] to configure",
+				tpg_dev->soc_info.index, tpg_dev->state);
+	}
+	// Handle Config Dev
+	rc = cam_tpg_packet_parse(tpg_dev, config);
+	return rc;
+}
+
+static int validate_ioctl_params(
+	struct cam_tpg_device *tpg_dev,
+	struct cam_control *cmd)
+{
+	int rc = 0;
+
+	if (!tpg_dev || !cmd) {
+		CAM_ERR(CAM_TPG, "Invalid input args");
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_TPG, "TPG[%d] Invalid handle type: %d",
+			tpg_dev->soc_info.index,
+			cmd->handle_type);
+		rc = -EINVAL;
+	}
+	CAM_DBG(CAM_TPG, "TPG[%d] Opcode: %d", tpg_dev->soc_info.index, cmd->op_code);
+exit:
+	return rc;
+}
+
+int cam_tpg_core_cfg(
+	struct cam_tpg_device *tpg_dev,
+	void *arg)
+{
+	int rc = 0;
+	struct cam_control   *cmd = (struct cam_control *)arg;
+
+	rc = validate_ioctl_params(tpg_dev, cmd);
+	if (rc < 0)
+		return rc;
+
+	mutex_lock(&tpg_dev->mutex);
+	switch (cmd->op_code) {
+	case CAM_QUERY_CAP: {
+		struct cam_tpg_query_cap query = {0};
+
+		if (copy_from_user(&query, u64_to_user_ptr(cmd->handle),
+			sizeof(query))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = __cam_tpg_handle_query_cap(tpg_dev, &query);
+		if (rc) {
+			CAM_ERR(CAM_TPG, "TPG[%d] querycap is failed(rc = %d)",
+				tpg_dev->soc_info.index,
+				rc);
+			break;
+		}
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle), &query,
+			sizeof(query)))
+			rc = -EFAULT;
+
+		break;
+	}
+	case CAM_ACQUIRE_DEV: {
+		struct cam_tpg_acquire_dev acquire = {0};
+
+		if (copy_from_user(&acquire, u64_to_user_ptr(cmd->handle),
+			sizeof(acquire))) {
+			rc = -EFAULT;
+			break;
+		}
+		rc = __cam_tpg_handle_acquire_dev(tpg_dev, &acquire);
+		if (rc) {
+			CAM_ERR(CAM_TPG, "TPG[%d] acquire device failed(rc = %d)",
+				tpg_dev->soc_info.index,
+				rc);
+			break;
+		}
+		if (copy_to_user(u64_to_user_ptr(cmd->handle), &acquire,
+			sizeof(acquire)))
+			rc = -EFAULT;
+		break;
+	}
+	case CAM_RELEASE_DEV: {
+		struct cam_release_dev_cmd release;
+
+		if (copy_from_user(&release, u64_to_user_ptr(cmd->handle),
+			sizeof(release)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_tpg_handle_release_dev(tpg_dev, &release);
+			if (rc)
+				CAM_ERR(CAM_TPG,
+					"TPG[%d] release device failed(rc = %d)",
+					tpg_dev->soc_info.index,
+					rc);
+		}
+		break;
+	}
+	case CAM_START_DEV: {
+		struct cam_start_stop_dev_cmd start;
+
+		if (copy_from_user(&start, u64_to_user_ptr(cmd->handle),
+			sizeof(start)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_tpg_handle_start_dev(tpg_dev, &start);
+			if (rc)
+				CAM_ERR(CAM_TPG,
+					"TPG[%d] start device failed(rc = %d)",
+					tpg_dev->soc_info.index,
+					rc);
+		}
+		break;
+	}
+	case CAM_STOP_DEV: {
+		struct cam_start_stop_dev_cmd stop;
+
+		if (copy_from_user(&stop, u64_to_user_ptr(cmd->handle),
+			sizeof(stop)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_tpg_handle_stop_dev(tpg_dev, &stop);
+			if (rc)
+				CAM_ERR(CAM_TPG,
+					"TPG[%d] stop device failed(rc = %d)",
+					tpg_dev->soc_info.index,
+					rc);
+		}
+		break;
+
+	}
+	case CAM_CONFIG_DEV: {
+		struct cam_config_dev_cmd config;
+
+		if (copy_from_user(&config, u64_to_user_ptr(cmd->handle),
+			sizeof(config)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_tpg_handle_config_dev(tpg_dev, &config);
+			if (rc)
+				CAM_ERR(CAM_TPG,
+					"TPG[%d] config device failed(rc = %d)",
+					tpg_dev->soc_info.index,
+					rc);
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_TPG, "Invalid ioctl : %d", cmd->op_code);
+		rc = -EINVAL;
+		break;
+	}
+	mutex_unlock(&tpg_dev->mutex);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_core.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __CAM_TPG_CORE_H__
+#define __CAM_TPG_CORE_H__
+
+#include "cam_tpg_dev.h"
+
+/**
+ * @brief : do clean up of driver on user space process restart
+ *
+ * @param tpg_dev: tpg device
+ *
+ * @return : 0 on success
+ */
+int cam_tpg_shutdown(struct cam_tpg_device *tpg_dev);
+
+/**
+ * @brief initialize crm interface
+ *
+ * @param tpg_dev: tpg device instance
+ *
+ * @return : 0 on success
+ */
+int tpg_crm_intf_init(struct cam_tpg_device *tpg_dev);
+
+/**
+ * @brief : handle tpg device configuration
+ *
+ * @param tpg_dev : tpg device instance
+ * @param arg     : configuration argument
+ *
+ * @return        : 0 on success
+ */
+int32_t cam_tpg_core_cfg(struct cam_tpg_device *tpg_dev, void *arg);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_dev.c
@@ -0,0 +1,443 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of_device.h>
+
+#include "cam_tpg_dev.h"
+#include "cam_tpg_core.h"
+#include "camera_main.h"
+#include "tpg_hw/tpg_hw_v_1_0/tpg_hw_v_1_0_data.h"
+#include "tpg_hw/tpg_hw_v_1_2/tpg_hw_v_1_2_data.h"
+#include "tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3_data.h"
+#include "tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4_data.h"
+
+static int cam_tpg_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_tpg_device *tpg_dev =
+		v4l2_get_subdevdata(sd);
+
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (!tpg_dev) {
+		CAM_ERR(CAM_TPG, "tpg_dev ptr is NULL");
+		return -EINVAL;
+	}
+
+	if (crm_active) {
+		CAM_DBG(CAM_TPG, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	mutex_lock(&tpg_dev->mutex);
+	if (tpg_dev->state == CAM_TPG_STATE_INIT) {
+		CAM_DBG(CAM_TPG, "TPG node %d is succesfully closed", tpg_dev->soc_info.index);
+		mutex_unlock(&tpg_dev->mutex);
+		return 0;
+	}
+	cam_tpg_shutdown(tpg_dev);
+	mutex_unlock(&tpg_dev->mutex);
+
+	return 0;
+}
+
+static long cam_tpg_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	struct cam_tpg_device *tpg_dev = v4l2_get_subdevdata(sd);
+	int rc = 0;
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_tpg_core_cfg(tpg_dev, arg);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+		mutex_lock(&tpg_dev->mutex);
+		cam_tpg_shutdown(tpg_dev);
+		mutex_unlock(&tpg_dev->mutex);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_TPG, "Wrong ioctl : %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	return rc;
+}
+
+
+#ifdef CONFIG_COMPAT
+static long cam_tpg_subdev_compat_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	int32_t rc = 0;
+	struct cam_control cmd_data;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_TPG, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	/* All the arguments converted to 64 bit here
+	 * Passed to the api in core.c
+	 */
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_tpg_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc)
+			CAM_ERR(CAM_TPG,
+				"Failed in subdev_ioctl: %d", rc);
+		break;
+	default:
+		CAM_ERR(CAM_TPG, "Invalid compat ioctl cmd: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_TPG,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+
+static struct v4l2_subdev_core_ops tpg_subdev_core_ops = {
+	.ioctl = cam_tpg_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_tpg_subdev_compat_ioctl,
+#endif
+};
+
+
+static const struct v4l2_subdev_ops tpg_subdev_ops = {
+	.core = &tpg_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops tpg_subdev_intern_ops = {
+	.close = cam_tpg_subdev_close,
+};
+
+static irqreturn_t cam_tpg_irq_handler(int irq_num, void *data)
+{
+	struct cam_tpg_device *tpg_dev =
+		(struct cam_tpg_device *)data;
+	struct tpg_hw *hw = &tpg_dev->tpg_hw;
+	irqreturn_t    rc = IRQ_NONE;
+
+	/* handle the registered irq handler */
+	if (hw &&
+		hw->hw_info &&
+		hw->hw_info->ops &&
+		hw->hw_info->ops->handle_irq) {
+		rc = hw->hw_info->ops->handle_irq(hw);
+	}
+
+	return rc;
+}
+
+static int tpg_subdev_init(struct cam_tpg_device *tpg_dev,
+		struct device *dev)
+{
+	int32_t rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	tpg_dev->tpg_subdev.pdev = pdev;
+	tpg_dev->tpg_subdev.internal_ops = &tpg_subdev_intern_ops;
+	tpg_dev->tpg_subdev.ops = &tpg_subdev_ops;
+	tpg_dev->tpg_subdev.name = tpg_dev->device_name;
+	tpg_dev->tpg_subdev.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	tpg_dev->tpg_subdev.ent_function = CAM_TPG_DEVICE_TYPE;
+	tpg_dev->tpg_subdev.msg_cb = NULL;
+	tpg_dev->tpg_subdev.token = tpg_dev;
+
+	rc = cam_register_subdev(&(tpg_dev->tpg_subdev));
+	if (rc)
+		CAM_ERR(CAM_TPG, "cam_register_subdev Failed rc: %d", rc);
+	else
+		CAM_DBG(CAM_TPG, "TPG subdev init done");
+	return rc;
+
+}
+
+static int tpg_soc_info_init(struct cam_tpg_device *tpg_dev,
+		struct device *dev)
+{
+	int32_t rc = 0, i;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct device_node *of_node = NULL;
+	void *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV] = {0};
+
+	if (!dev || !tpg_dev)
+		return -EINVAL;
+
+	tpg_dev->soc_info.pdev = pdev;
+	tpg_dev->soc_info.dev = &pdev->dev;
+	tpg_dev->soc_info.dev_name = pdev->name;
+
+	of_node = dev->of_node;
+
+	rc = cam_soc_util_get_dt_properties(&tpg_dev->soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "parsing common soc dt(rc %d)", rc);
+		return  rc;
+	}
+
+	rc = of_property_read_u32(of_node, "phy-id", &(tpg_dev->phy_id));
+	if (rc) {
+		CAM_ERR(CAM_TPG, "device %s failed to read phy-id",
+			tpg_dev->soc_info.dev_name);
+		return rc;
+	}
+
+	for (i = 0; i < tpg_dev->soc_info.irq_count; i++)
+		irq_data[i] = tpg_dev;
+
+	if (!of_property_read_bool(of_node, "hw-no-ops"))
+		tpg_dev->hw_no_ops = false;
+	else
+		tpg_dev->hw_no_ops = true;
+
+	if (!tpg_dev->hw_no_ops)
+		rc = cam_soc_util_request_platform_resource(
+			&tpg_dev->soc_info, cam_tpg_irq_handler,
+			&(irq_data[0]));
+	if (rc)
+		CAM_ERR(CAM_TPG, "unable to request platfrom resources");
+	else
+		CAM_DBG(CAM_TPG, "TPG dt parse done");
+
+	return rc;
+}
+
+static int tpg_register_cpas_client(struct cam_tpg_device *tpg_dev,
+		struct device *dev)
+{
+	int32_t rc = 0;
+	struct cam_cpas_register_params cpas_parms;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	cpas_parms.cam_cpas_client_cb = NULL;
+	cpas_parms.cell_index = tpg_dev->soc_info.index;
+	cpas_parms.dev = &pdev->dev;
+	cpas_parms.userdata = tpg_dev;
+
+	strscpy(cpas_parms.identifier, "tpg", CAM_HW_IDENTIFIER_LENGTH);
+
+	rc = cam_cpas_register_client(&cpas_parms);
+	if (rc) {
+		CAM_ERR(CAM_TPG, "CPAS registration failed rc: %d", rc);
+		return rc;
+	}
+
+	tpg_dev->cpas_handle = cpas_parms.client_handle;
+	CAM_DBG(CAM_TPG, "CPAS registration successful handle=%d",
+		cpas_parms.client_handle);
+
+	return rc;
+}
+
+static int cam_tpg_hw_layer_init(struct cam_tpg_device *tpg_dev,
+		struct device *dev)
+{
+	/* get top tpg hw information */
+	const struct of_device_id      *match_dev = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_TPG, "No matching table for the top tpg hw");
+		return -EINVAL;
+	}
+
+	tpg_dev->tpg_hw.hw_idx   = tpg_dev->soc_info.index;
+	tpg_dev->tpg_hw.hw_info  = (struct tpg_hw_info *)match_dev->data;
+	tpg_dev->tpg_hw.soc_info = &tpg_dev->soc_info;
+	tpg_dev->tpg_hw.cpas_handle = tpg_dev->cpas_handle;
+	spin_lock_init(&tpg_dev->tpg_hw.hw_state_lock);
+	tpg_dev->tpg_hw.state = TPG_HW_STATE_HW_DISABLED;
+	mutex_init(&tpg_dev->tpg_hw.mutex);
+	init_completion(&tpg_dev->tpg_hw.complete_rup);
+	/*Initialize the waiting queue and active queues*/
+	INIT_LIST_HEAD(&(tpg_dev->tpg_hw.waiting_request_q));
+	INIT_LIST_HEAD(&(tpg_dev->tpg_hw.active_request_q));
+	tpg_dev->tpg_hw.waiting_request_q_depth = 0;
+	tpg_dev->tpg_hw.active_request_q_depth  = 0;
+	tpg_dev->tpg_hw.settings_update         = 0;
+	tpg_dev->tpg_hw.tpg_clock               = 0;
+	tpg_dev->tpg_hw.hw_info->layer_init(&tpg_dev->tpg_hw);
+	return 0;
+}
+
+static int cam_tpg_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct cam_tpg_device  *tpg_dev = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	tpg_dev = devm_kzalloc(&pdev->dev,
+		sizeof(struct cam_tpg_device), GFP_KERNEL);
+	if (!tpg_dev) {
+		CAM_ERR(CAM_TPG, "TPG dev allocation failed");
+		return -ENOMEM;
+	}
+
+	strscpy(tpg_dev->device_name, CAMX_TPG_DEV_NAME,
+		sizeof(tpg_dev->device_name));
+	mutex_init(&tpg_dev->mutex);
+	tpg_dev->tpg_subdev.pdev = pdev;
+	tpg_dev->state = CAM_TPG_STATE_INIT;
+
+	rc = cam_tpg_hw_layer_init(tpg_dev, dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_TPG, "Hw layer init failed");
+		goto bind_error_exit;
+	}
+
+	rc = tpg_subdev_init(tpg_dev, dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_TPG, "subdev init failed");
+		goto bind_error_exit;
+	}
+
+	rc = tpg_soc_info_init(tpg_dev, dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_TPG, "soc init failed");
+		goto release_subdev;
+	}
+
+	rc = tpg_register_cpas_client(tpg_dev, dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_TPG, "cpas register failed");
+		goto release_subdev;
+	}
+	tpg_crm_intf_init(tpg_dev);
+
+	platform_set_drvdata(pdev, tpg_dev);
+
+	return rc;
+
+release_subdev:
+	cam_unregister_subdev(&(tpg_dev->tpg_subdev));
+bind_error_exit:
+	mutex_destroy(&tpg_dev->mutex);
+	return rc;
+}
+
+static void cam_tpg_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct cam_tpg_device  *tpg_dev = NULL;
+
+	tpg_dev = platform_get_drvdata(pdev);
+
+	if (!tpg_dev) {
+		CAM_ERR(CAM_TPG, "Error No data in tpg_dev");
+		return;
+	}
+
+	CAM_INFO(CAM_TPG, "Unbind TPG component");
+	cam_cpas_unregister_client(tpg_dev->cpas_handle);
+	cam_soc_util_release_platform_resource(&tpg_dev->soc_info);
+	mutex_destroy(&tpg_dev->mutex);
+	mutex_destroy(&tpg_dev->tpg_hw.mutex);
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&(tpg_dev->tpg_subdev.sd), NULL);
+	cam_unregister_subdev(&(tpg_dev->tpg_subdev));
+}
+
+const static struct component_ops cam_tpg_component_ops = {
+	.bind = cam_tpg_component_bind,
+	.unbind = cam_tpg_component_unbind,
+};
+
+static int32_t cam_tpg_platform_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_TPG, "Adding TPG component");
+	rc = component_add(&pdev->dev, &cam_tpg_component_ops);
+	if (rc)
+		CAM_ERR(CAM_TPG, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+
+static int32_t cam_tpg_device_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_tpg_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_tpg_dt_match[] = {
+	{
+		.compatible = "qcom,cam-tpg101",
+		.data = &tpg_v_1_0_hw_info,
+	},
+	{
+		.compatible = "qcom,cam-tpg102",
+		.data = &tpg_v_1_2_hw_info,
+	},
+	{
+		.compatible = "qcom,cam-tpg103",
+		.data = &tpg_v_1_3_hw_info,
+	},
+	{
+		.compatible = "qcom,cam-tpg1031",
+		.data = &tpg_v_1_3_1_hw_info,
+	},
+	{
+		.compatible = "qcom,cam-tpg104",
+		.data = &tpg_v_1_4_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_tpg_dt_match);
+
+struct platform_driver cam_tpg_driver = {
+	.probe = cam_tpg_platform_probe,
+	.remove = cam_tpg_device_remove,
+	.driver = {
+		.name = CAMX_TPG_DEV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_tpg_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int32_t cam_tpg_init_module(void)
+{
+	CAM_DBG(CAM_TPG, "tpg module init");
+	return platform_driver_register(&cam_tpg_driver);
+}
+
+void cam_tpg_exit_module(void)
+{
+	CAM_DBG(CAM_TPG, "tpg exit module");
+	platform_driver_unregister(&cam_tpg_driver);
+}
+
+MODULE_DESCRIPTION("CAM TPG driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/cam_tpg_dev.h
@@ -0,0 +1,151 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __CAM_TPG_DEV_H__
+#define __CAM_TPG_DEV_H__
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/irqreturn.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_defs.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_req_mgr_interface.h>
+#include <cam_subdev.h>
+#include <cam_io_util.h>
+#include <media/cam_defs.h>
+#include "cam_debug_util.h"
+#include "cam_context.h"
+#include "cam_soc_util.h"
+#include <cam_cpas_api.h>
+#include "tpg_hw/tpg_hw.h"
+
+#define CAMX_TPG_DEV_NAME "cam-tpg-driver"
+
+struct cam_tpg_device;
+struct tpg_hw;
+
+struct cam_tpg_ioctl_ops {
+	int (*acquire_dev)(struct cam_tpg_device *tpg_dev,
+			struct cam_acquire_dev_cmd *cmd);
+	int (*release_dev)(struct cam_tpg_device *tpg_dev,
+			struct cam_release_dev_cmd *cmd);
+	int (*config_dev)(struct cam_tpg_device *tpg_dev,
+			struct cam_config_dev_cmd *cmd);
+	int (*start_dev)(struct cam_tpg_device *tpg_dev,
+			struct cam_start_stop_dev_cmd *cmd);
+	int (*stop_dev)(struct cam_tpg_device *tpg_dev,
+			struct cam_start_stop_dev_cmd *cmd);
+	int (*flush_dev)(struct cam_tpg_device *tpg_dev,
+			struct cam_flush_dev_cmd *cmd);
+	int (*acquire_hw)(struct cam_tpg_device *tpg_dev, void *args);
+	int (*release_hw)(struct cam_tpg_device *tpg_dev, void *args);
+};
+
+struct cam_tpg_crm_ops {
+	int (*get_dev_info)(struct cam_tpg_device *tpg_dev,
+			struct cam_req_mgr_device_info *device_info);
+	int (*link)(struct cam_tpg_device *tpg_dev,
+			struct cam_req_mgr_core_dev_link_setup *link);
+	int (*unlink)(struct cam_tpg_device *tpg_dev,
+			struct cam_req_mgr_core_dev_link_setup *unlink);
+	int (*apply_req)(struct cam_tpg_device *tpg_dev,
+			struct cam_req_mgr_apply_request *apply);
+	int (*notify_frame_skip)(struct cam_tpg_device *tpg_dev,
+			struct cam_req_mgr_apply_request *apply);
+	int (*flush_req)(struct cam_tpg_device *tpg_dev,
+			struct cam_req_mgr_flush_request *flush);
+	int (*process_evt)(struct cam_tpg_device *tpg_dev,
+			struct cam_req_mgr_link_evt_data *evt_data);
+};
+
+struct tpg_device_ops {
+	struct cam_tpg_ioctl_ops ioctl_ops;
+	struct cam_tpg_crm_ops   crm_ops;
+};
+
+enum cam_tpg_state {
+	CAM_TPG_STATE_INIT,
+	CAM_TPG_STATE_ACQUIRE,
+	CAM_TPG_STATE_START,
+	CAM_TPG_STATE_STATE_MAX
+};
+
+/**
+ * struct tpg_crm_intf_params
+ * @device_hdl: Device Handle
+ * @session_hdl: Session Handle
+ * @link_hdl: Link Handle
+ * @ops: KMD operations
+ * @crm_cb: Callback API pointers
+ */
+struct tpg_crm_intf_params {
+	int32_t device_hdl;
+	int32_t session_hdl;
+	int32_t link_hdl;
+	struct cam_req_mgr_kmd_ops ops;
+	struct cam_req_mgr_crm_cb *crm_cb;
+};
+
+/**
+ * cam_tpg_device
+ *
+ * @device_name: tpg device name
+ * @mutex: mutex object for private use
+ * @tpg_subdev: tpg subdevice instance
+ * @soc_info: tpg soc infrastructure
+ * @cpas_handle: cpas handle
+ * @state_machine: tpg state machine
+ * @crm_intf: crm interface
+ * @tpg_hw  : tpg hw instance
+ * @state   : state machine states
+ * @slot_id : slot index of this tpg
+ * @phy_id  : phy index mapped to this tpg
+ * @hw_no_ops: To determine whether HW operations need to be disabled
+ * @waiting_request_q : waiting request queue
+ * @active_request_q : active request queue
+ * @tpg_irq_state : tpg irq state
+ */
+struct cam_tpg_device {
+	char                       device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct mutex               mutex;
+	struct cam_subdev          tpg_subdev;
+	struct cam_hw_soc_info     soc_info;
+	uint32_t                   cpas_handle;
+	struct tpg_device_ops      state_machine[CAM_TPG_STATE_STATE_MAX];
+	struct tpg_crm_intf_params crm_intf;
+	struct tpg_hw              tpg_hw;
+	int                        state;
+	int                        slot_id;
+	int                        phy_id;
+	bool                       hw_no_ops;
+	atomic_t                   tpg_irq_state;
+	struct list_head           waiting_request_q;
+	struct list_head           active_request_q;
+};
+
+
+/**
+ * @brief : tpg module init
+ *
+ * @return : 0 on success
+ */
+int32_t cam_tpg_init_module(void);
+
+/**
+ * @brief : tpg module exit
+ */
+void cam_tpg_exit_module(void);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw.c
@@ -0,0 +1,1456 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "tpg_hw.h"
+
+#define BYTES_PER_REGISTER           4
+#define NUM_REGISTER_PER_LINE        4
+#define REG_OFFSET(__start, __i)    ((__start) + ((__i) * BYTES_PER_REGISTER))
+#define CAM_TPG_HW_WAIT_TIMEOUT     msecs_to_jiffies(100)
+#define MAX_ACTIVE_QUEUE_DEPTH      2
+#define MAX_WAITING_QUEUE_DEPTH     32
+#define TIMEOUT_MULTIPLIER_PRESIL   5
+#define TIMEOUT_MULTIPLIER          1
+
+static int cam_io_tpg_dump(void __iomem *base_addr,
+	uint32_t start_offset, int size)
+{
+	char          line_str[128];
+	char         *p_str;
+	int           i;
+	uint32_t      data;
+
+	CAM_DBG(CAM_TPG, "addr=%pK offset=0x%x size=%d",
+		base_addr, start_offset, size);
+
+	if (!base_addr || (size <= 0))
+		return -EINVAL;
+
+	line_str[0] = '\0';
+	p_str = line_str;
+	for (i = 0; i < size; i++) {
+		if (i % NUM_REGISTER_PER_LINE == 0) {
+			snprintf(p_str, 12, "0x%08x: ",
+				REG_OFFSET(start_offset, i));
+			p_str += 11;
+		}
+		data = cam_io_r(base_addr + REG_OFFSET(start_offset, i));
+		snprintf(p_str, 9, "%08x ", data);
+		p_str += 8;
+		if ((i + 1) % NUM_REGISTER_PER_LINE == 0) {
+			CAM_DBG(CAM_TPG, "%s", line_str);
+			line_str[0] = '\0';
+			p_str = line_str;
+		}
+	}
+	if (line_str[0] != '\0')
+		CAM_ERR(CAM_TPG, "%s", line_str);
+
+	return 0;
+}
+
+int32_t cam_tpg_mem_dmp(struct cam_hw_soc_info *soc_info)
+{
+	int32_t rc = 0;
+	resource_size_t size = 0;
+	void __iomem *addr = NULL;
+
+	if (!soc_info) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_TPG, "invalid input %d", rc);
+		return rc;
+	}
+	addr = soc_info->reg_map[0].mem_base;
+	size = resource_size(soc_info->mem_block[0]);
+	rc = cam_io_tpg_dump(addr, 0, (size >> 2));
+	if (rc < 0) {
+		CAM_ERR(CAM_TPG, "generating dump failed %d", rc);
+	}
+	return rc;
+}
+
+
+#define __TPG_DEBUG_DUMP__
+#ifdef __TPG_DEBUG_DUMP__
+static const char * const tpg_phy_type_strings[] = {
+	"TPG_PHY_TYPE_INVALID",
+	"TPG_PHY_TYPE_DPHY",
+	"TPG_PHY_TYPE_CPHY",
+	"TPG_PHY_TYPE_MAX"
+};
+
+static const char * const tpg_interleaving_format_string[] = {
+	"TPG_INTERLEAVING_FORMAT_INVALID",
+	"TPG_INTERLEAVING_FORMAT_FRAME",
+	"TPG_INTERLEAVING_FORMAT_LINE",
+	"TPG_INTERLEAVING_FORMAT_SHDR",
+	"TPG_INTERLEAVING_FORMAT_SparsePD",
+	"TPG_INTERLEAVING_FORMAT_MAX"
+};
+
+static const char * const tpg_shutter_type_strings[] = {
+	"TPG_SHUTTER_TYPE_INVALID",
+	"TPG_SHUTTER_TYPE_ROLLING",
+	"TPG_SHUTTER_TYPE_GLOBAL",
+	"TPG_SHUTTER_TYPE_MAX"
+};
+
+static const char *const tpg_pattern_type_strings[] = {
+	"TPG_PATTERN_INVALID",
+	"TPG_PATTERN_REAL_IMAGE",
+	"TPG_PATTERN_RANDOM_PIXL",
+	"TPG_PATTERN_RANDOM_INCREMENTING_PIXEL",
+	"TPG_PATTERN_COLOR_BAR",
+	"TPG_PATTERN_ALTERNATING_55_AA",
+	"TPG_PATTERN_ALTERNATING_USER_DEFINED",
+	"TPG_PATTERN_MAX"
+};
+
+static const char *const tpg_color_bar_mode_strings[] = {
+	"TPG_COLOR_BAR_MODE_INVALID",
+	"TPG_COLOR_BAR_MODE_NORMAL",
+	"TPG_COLOR_BAR_MODE_SPLIT",
+	"TPG_COLOR_BAR_MODE_ROTATING",
+	"TPG_COLOR_BAR_MODE_MAX"
+};
+
+static const char *const tpg_stream_type_strings[] = {
+	"TPG_STREAM_TYPE_INVALID",
+	"TPG_STREAM_TYPE_IMAGE",
+	"TPG_STREAM_TYPE_PDAF",
+	"TPG_STREAM_TYPE_META",
+	"TPG_STREAM_TYPE_MAX"
+};
+
+static const char *const tpg_image_format_type_strings[] = {
+	"TPG_IMAGE_FORMAT_INVALID",
+	"TPG_IMAGE_FORMAT_BAYER",
+	"TPG_IMAGE_FORMAT_QCFA",
+	"TPG_IMAGE_FORMAT_YUV",
+	"TPG_IMAGE_FORMAT_JPEG",
+	"TPG_IMAGE_FORMAT_MAX"
+};
+#endif
+
+int dump_global_configs(int idx,
+		struct tpg_global_config_t *global)
+{
+#ifdef __TPG_DEBUG_DUMP__
+	CAM_DBG(CAM_TPG, "TPG[%d] phy_type            : %s",
+			idx,
+			tpg_phy_type_strings[global->phy_type]);
+	CAM_DBG(CAM_TPG, "TPG[%d] lane_count          : %d",
+			idx,
+			global->lane_count);
+	CAM_DBG(CAM_TPG, "TPG[%d] interleaving_format : %s",
+			idx,
+			tpg_interleaving_format_string[global->interleaving_format]);
+	CAM_DBG(CAM_TPG, "TPG[%d] phy_mode            : %d",
+			idx,
+			global->phy_mode);
+	CAM_DBG(CAM_TPG, "TPG[%d] shutter_type        : %s",
+			idx,
+			tpg_shutter_type_strings[global->shutter_type]);
+	CAM_DBG(CAM_TPG, "TPG[%d] skip pattern        : 0x%x",
+			idx,
+			global->skip_pattern);
+	CAM_DBG(CAM_TPG, "TPG[%d] tpg clock           : %d",
+			idx,
+			global->tpg_clock);
+#endif
+	return 0;
+}
+
+int dump_stream_configs(int hw_idx,
+		int stream_idx,
+		struct tpg_stream_config_t *stream)
+{
+#ifdef __TPG_DEBUG_DUMP__
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] pattern_type    : %s",
+			hw_idx,
+			stream_idx,
+			tpg_pattern_type_strings[stream->pattern_type]);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] cb_mode         : %s",
+			hw_idx,
+			stream_idx,
+			tpg_color_bar_mode_strings[stream->cb_mode]);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] frame_count     : %d",
+			hw_idx,
+			stream_idx,
+			stream->frame_count);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] stream_type     : %s",
+			hw_idx,
+			stream_idx,
+			tpg_stream_type_strings[stream->stream_type]);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] left            : %d",
+			hw_idx,
+			stream_idx,
+			stream->stream_dimension.left);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] top             : %d",
+			hw_idx,
+			stream_idx,
+			stream->stream_dimension.top);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] width           : %d",
+			hw_idx,
+			stream_idx,
+			stream->stream_dimension.width);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] height          : %d",
+			hw_idx,
+			stream_idx,
+			stream->stream_dimension.height);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] pixel_depth     : %d",
+			hw_idx,
+			stream_idx,
+			stream->pixel_depth);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] cfa_arrangement : %d",
+			hw_idx,
+			stream_idx,
+			stream->cfa_arrangement);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] output_format   : %s",
+			hw_idx,
+			stream_idx,
+		tpg_image_format_type_strings[stream->output_format]);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] vc              : 0x%x",
+			hw_idx,
+			stream_idx,
+			stream->vc);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] dt              : 0x%x",
+			hw_idx,
+			stream_idx,
+			stream->dt);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] hbi             : %d",
+			hw_idx,
+			stream_idx,
+			stream->hbi);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] vbi             : %d",
+			hw_idx,
+			stream_idx,
+			stream->vbi);
+#endif
+	return 0;
+}
+
+int dump_stream_configs_v3(int hw_idx,
+		int stream_idx,
+		struct tpg_stream_config_v3_t *stream)
+{
+#ifdef __TPG_DEBUG_DUMP__
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] pattern_type    : %s",
+			hw_idx,
+			stream_idx,
+			tpg_pattern_type_strings[stream->pattern_type]);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] cb_mode         : %s",
+			hw_idx,
+			stream_idx,
+			tpg_color_bar_mode_strings[stream->cb_mode]);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] frame_count     : %d",
+			hw_idx,
+			stream_idx,
+			stream->frame_count);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] stream_type     : %s",
+			hw_idx,
+			stream_idx,
+			tpg_stream_type_strings[stream->stream_type]);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] left            : %d",
+			hw_idx,
+			stream_idx,
+			stream->stream_dimension.left);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] top             : %d",
+			hw_idx,
+			stream_idx,
+			stream->stream_dimension.top);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] width           : %d",
+			hw_idx,
+			stream_idx,
+			stream->stream_dimension.width);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] height          : %d",
+			hw_idx,
+			stream_idx,
+			stream->stream_dimension.height);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] pixel_depth     : %d",
+			hw_idx,
+			stream_idx,
+			stream->pixel_depth);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] cfa_arrangement : %d",
+			hw_idx,
+			stream_idx,
+			stream->cfa_arrangement);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] output_format   : %s",
+			hw_idx,
+			stream_idx,
+		tpg_image_format_type_strings[stream->output_format]);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] vc              : 0x%x",
+			hw_idx,
+			stream_idx,
+			stream->vc);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] dt              : 0x%x",
+			hw_idx,
+			stream_idx,
+			stream->dt);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] hbi             : %d",
+			hw_idx,
+			stream_idx,
+			stream->hbi);
+	CAM_DBG(CAM_TPG, "TPG[%d][%d] vbi             : %d",
+			hw_idx,
+			stream_idx,
+			stream->vbi);
+#endif
+	return 0;
+}
+static int tpg_hw_release_vc_slots_locked(struct tpg_hw *hw,
+		struct tpg_hw_request *req)
+{
+	struct list_head *pos = NULL, *pos_next = NULL;
+	struct tpg_hw_stream *entry;
+	struct tpg_hw_stream_v3 *entry_v3;
+	int i = 0;
+
+	if (!hw || !hw->hw_info || !req) {
+		CAM_ERR(CAM_TPG, "Invalid Params");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_TPG, "TPG[%d]  req[%lld] Freeing all the streams",
+			hw->hw_idx, req->request_id);
+
+	for (i = 0; i < hw->hw_info->max_vc_channels; i++) {
+		req->vc_slots[i].slot_id      =  i;
+		req->vc_slots[i].vc           = -1;
+		req->vc_slots[i].stream_count =  0;
+		if (hw->stream_version == 1) {
+			list_for_each_safe(pos, pos_next, &req->vc_slots[i].head) {
+				entry = list_entry(pos, struct tpg_hw_stream, list);
+				list_del(pos);
+				kfree(entry);
+			}
+		} else if (hw->stream_version == 3) {
+			list_for_each_safe(pos, pos_next, &req->vc_slots[i].head) {
+				entry_v3 = list_entry(pos, struct tpg_hw_stream_v3, list);
+				list_del(pos);
+				kfree(entry_v3);
+			}
+		}
+		INIT_LIST_HEAD(&(req->vc_slots[i].head));
+	}
+
+	hw->vc_count = 0;
+	kfree(req->vc_slots);
+	kfree(req);
+
+	return 0;
+}
+
+static int tpg_hw_free_waiting_requests_locked(struct tpg_hw *hw)
+{
+	struct list_head *pos = NULL, *pos_next = NULL;
+	struct tpg_hw_request *req = NULL;
+
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "Invalid Params");
+		return -EINVAL;
+	}
+
+	/* free up the pending requests*/
+	CAM_DBG(CAM_TPG, "TPG[%d]  freeing all waiting requests",
+			hw->hw_idx);
+	list_for_each_safe(pos, pos_next, &hw->waiting_request_q) {
+		req = list_entry(pos, struct tpg_hw_request, list);
+		CAM_DBG(CAM_TPG, "TPG[%d] freeing request[%lld] ",
+				hw->hw_idx, req->request_id);
+		list_del(pos);
+		tpg_hw_release_vc_slots_locked(hw, req);
+	}
+	return 0;
+}
+
+static int tpg_hw_free_active_requests_locked(struct tpg_hw *hw)
+{
+	struct list_head *pos = NULL, *pos_next = NULL;
+	struct tpg_hw_request *req = NULL;
+
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "Invalid Params");
+		return -EINVAL;
+	}
+
+	/* free up the active requests*/
+	CAM_DBG(CAM_TPG, "TPG[%d]  freeing all active requests",
+			hw->hw_idx);
+	list_for_each_safe(pos, pos_next, &hw->active_request_q) {
+		req = list_entry(pos, struct tpg_hw_request, list);
+		CAM_DBG(CAM_TPG, "TPG[%d] freeing request[%lld] ",
+				hw->hw_idx, req->request_id);
+		list_del(pos);
+		tpg_hw_release_vc_slots_locked(hw, req);
+	}
+	return 0;
+}
+
+static int tpg_hw_soc_disable(struct tpg_hw *hw)
+{
+	int rc = 0;
+	unsigned long flags;
+
+	if (!hw || !hw->soc_info) {
+		CAM_ERR(CAM_TPG, "Error Invalid params");
+		return -EINVAL;
+	}
+
+	rc = cam_soc_util_disable_platform_resource(hw->soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		true);
+
+	if (rc) {
+		CAM_ERR(CAM_TPG, "TPG[%d] Disable platform failed %d",
+			hw->hw_idx, rc);
+		return rc;
+	}
+	if ((rc = cam_cpas_stop(hw->cpas_handle))) {
+		CAM_ERR(CAM_TPG, "TPG[%d] CPAS stop failed",
+			hw->hw_idx);
+		return rc;
+	} else {
+		spin_lock_irqsave(&hw->hw_state_lock, flags);
+		hw->state = TPG_HW_STATE_HW_DISABLED;
+		spin_unlock_irqrestore(&hw->hw_state_lock, flags);
+	}
+
+	return rc;
+}
+
+static int tpg_hw_soc_enable(
+	struct tpg_hw *hw,
+	enum cam_vote_level clk_level,
+	uint32_t enable_irq)
+{
+	int rc = 0;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	unsigned long flags;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_SVS_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	CAM_DBG(CAM_TPG, "TPG[%d] camnoc_bw:%lld mnoc_ab_bw:%lld mnoc_ib_bw:%lld ",
+		hw->hw_idx,
+		axi_vote.axi_path[0].camnoc_bw,
+		axi_vote.axi_path[0].mnoc_ab_bw,
+		axi_vote.axi_path[0].mnoc_ib_bw);
+
+	rc = cam_cpas_start(hw->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_TPG, "TPG[%d] CPAS start failed",
+			hw->hw_idx);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(hw->soc_info, CAM_CLK_SW_CLIENT_IDX, true,
+		clk_level, enable_irq);
+
+	if (rc) {
+		CAM_ERR(CAM_TPG, "TPG[%d] enable platform failed",
+			hw->hw_idx);
+		goto stop_cpas;
+	}
+
+	spin_lock_irqsave(&hw->hw_state_lock, flags);
+	/* might need to wait if in busy state */
+	hw->state = TPG_HW_STATE_READY;
+	spin_unlock_irqrestore(&hw->hw_state_lock, flags);
+
+	return rc;
+stop_cpas:
+	cam_cpas_stop(hw->cpas_handle);
+end:
+	return rc;
+}
+
+static int tpg_hw_apply_settings_to_hw_locked(struct tpg_hw *hw,
+	struct tpg_hw_request *req)
+{
+	int i = 0;
+	uint32_t stream_idx = 0;
+	int num_vcs = 0;
+	struct global_config_args globalargs = {0};
+	if (!hw ||
+		!hw->hw_info ||
+		!hw->hw_info->ops ||
+		!hw->hw_info->ops->process_cmd ||
+		!hw->soc_info ||
+		!req) {
+		CAM_ERR(CAM_TPG, "Invalid argument");
+		return -EINVAL;
+	}
+	/* If nop then skip applying and return success*/
+	if (req->request_type == TPG_HW_REQ_TYPE_NOP)
+		goto end;
+
+	dump_global_configs(hw->hw_idx, &req->global_config);
+	if (hw->stream_version == 1) {
+		for (i = 0; i < hw->hw_info->max_vc_channels; i++) {
+			int dt_slot = 0;
+			struct vc_config_args vc_config = {0};
+			struct list_head *pos = NULL, *pos_next = NULL;
+			struct tpg_hw_stream *entry = NULL, *vc_stream_entry = NULL;
+
+			if (req->vc_slots[i].vc == -1)
+				break;
+			num_vcs++;
+			vc_config.vc_slot = i;
+			vc_config.num_dts = req->vc_slots[i].stream_count;
+			vc_stream_entry = list_first_entry(&req->vc_slots[i].head,
+				struct tpg_hw_stream, list);
+			vc_config.stream  = &vc_stream_entry->stream;
+			hw->hw_info->ops->process_cmd(hw,
+					TPG_CONFIG_VC, &vc_config);
+
+			list_for_each_safe(pos, pos_next, &req->vc_slots[i].head) {
+				struct dt_config_args dt_config = {0};
+
+				entry = list_entry(pos, struct tpg_hw_stream, list);
+				dump_stream_configs(hw->hw_idx,
+					stream_idx++,
+					&entry->stream);
+				dt_config.vc_slot = i;
+				dt_config.dt_slot = dt_slot++;
+				dt_config.stream  = &entry->stream;
+				hw->hw_info->ops->process_cmd(hw, TPG_CONFIG_DT, &dt_config);
+			}
+		}
+	} else if (hw->stream_version == 3) {
+		for (i = 0; i < hw->hw_info->max_vc_channels; i++) {
+			int dt_slot = 0;
+			struct vc_config_args_v3 vc_config = {0};
+			struct list_head *pos = NULL, *pos_next = NULL;
+			struct tpg_hw_stream_v3 *entry = NULL, *vc_stream_entry = NULL;
+
+			if (req->vc_slots[i].vc == -1)
+				break;
+			num_vcs++;
+			vc_config.vc_slot = i;
+			vc_config.num_dts = req->vc_slots[i].stream_count;
+			vc_stream_entry = list_first_entry(&req->vc_slots[i].head,
+				struct tpg_hw_stream_v3, list);
+			vc_config.stream  = &vc_stream_entry->stream;
+			hw->hw_info->ops->process_cmd(hw,
+					TPG_CONFIG_VC, &vc_config);
+
+			list_for_each_safe(pos, pos_next, &req->vc_slots[i].head) {
+				struct dt_config_args_v3 dt_config = {0};
+
+				entry = list_entry(pos, struct tpg_hw_stream_v3, list);
+				dump_stream_configs_v3(hw->hw_idx,
+					stream_idx++,
+					&entry->stream);
+				dt_config.vc_slot = i;
+				dt_config.dt_slot = dt_slot++;
+				dt_config.stream  = &entry->stream;
+				hw->hw_info->ops->process_cmd(hw, TPG_CONFIG_DT, &dt_config);
+			}
+		}
+	}
+	globalargs.num_vcs      = num_vcs;
+	globalargs.globalconfig = &req->global_config;
+	hw->hw_info->ops->process_cmd(hw,
+		TPG_CONFIG_CTRL, &globalargs);
+	if (!cam_presil_mode_enabled())
+		cam_tpg_mem_dmp(hw->soc_info);
+end:
+	return 0;
+}
+
+int tpg_hw_dump_status(struct tpg_hw *hw)
+{
+	if (!hw || !hw->hw_info || !hw->hw_info->ops)
+		return -EINVAL;
+	switch (hw->hw_info->version) {
+	case TPG_HW_VERSION_1_3:
+	case TPG_HW_VERSION_1_3_1:
+	case TPG_HW_VERSION_1_4:
+		if (hw->hw_info->ops->dump_status)
+			hw->hw_info->ops->dump_status(hw, NULL);
+		break;
+	default:
+		CAM_WARN(CAM_TPG, "Hw version doesn't support status dump");
+		break;
+	}
+	return 0;
+}
+
+static int tpg_hw_check_hw_state_and_apply_settings_locked(
+	struct tpg_hw *hw,
+	struct tpg_hw_request *req)
+{
+	int rc = 0;
+	unsigned long wait_jiffies       = 0;
+	unsigned long rem_jiffies        = 0;
+	unsigned long flags;
+	int32_t       timeout_multiplier = 0;
+
+	if (!hw || !req) {
+		CAM_ERR(CAM_TPG, "Invalid param");
+		rc = -EINVAL;
+		goto end;
+	}
+	if (req->request_type != TPG_HW_REQ_TYPE_NOP) {
+		if (cam_presil_mode_enabled())
+			timeout_multiplier = TIMEOUT_MULTIPLIER_PRESIL;
+		else
+			timeout_multiplier = TIMEOUT_MULTIPLIER;
+
+		/* if hw state is not ready, wait for timeout.
+		 * if hw state becomes ready handle in follow up if.
+		 */
+		if (hw->state == TPG_HW_STATE_BUSY) {
+			wait_jiffies = CAM_TPG_HW_WAIT_TIMEOUT * timeout_multiplier;
+			reinit_completion(&hw->complete_rup);
+			rem_jiffies =
+				cam_common_wait_for_completion_timeout(&hw->complete_rup,
+					wait_jiffies);
+			if (!rem_jiffies) {
+				CAM_ERR(CAM_TPG, "TPG[%d] hw timeout %llu",
+					hw->hw_idx, rem_jiffies);
+				rc = -EBUSY;
+				goto end;
+			}
+		}
+		if (hw->state == TPG_HW_STATE_READY) {
+			hw->settings_update = 1;
+			spin_lock_irqsave(&hw->hw_state_lock, flags);
+			hw->state = TPG_HW_STATE_BUSY;
+			spin_unlock_irqrestore(&hw->hw_state_lock, flags);
+			CAM_DBG(CAM_TPG, "HW State ready to busy");
+		}
+	}
+	rc = tpg_hw_apply_settings_to_hw_locked(hw, req);
+end:
+	return rc;
+}
+
+static int tpg_hw_reapply_from_active_queue_locked(
+	struct tpg_hw *hw,
+	uint64_t request_id)
+{
+	int rc = 0;
+	struct tpg_hw_request *reapply_req = NULL;
+	struct tpg_hw_request *entry = NULL;
+	struct list_head *pos = NULL, *pos_next = NULL;
+
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "Invalid argument");
+		return -EINVAL;
+	}
+
+	list_for_each_safe(pos, pos_next, &hw->active_request_q) {
+		entry = list_entry(pos, struct tpg_hw_request, list);
+		if (entry->request_id == request_id) {
+			reapply_req = entry;
+			break;
+		}
+	}
+
+	if (reapply_req) {
+		CAM_DBG(CAM_TPG, "TPG[%d] got reapply request %d", hw->hw_idx, request_id);
+		rc = tpg_hw_check_hw_state_and_apply_settings_locked(hw, reapply_req);
+	} else {
+		CAM_ERR(CAM_TPG, "Could not find reapply request in active queue %d", request_id);
+		return -EINVAL;
+	}
+	return rc;
+}
+
+static int tpg_hw_lookup_queues_and_apply_req_locked(
+	struct tpg_hw *hw,
+	uint64_t request_id)
+{
+	int rc = 0;
+	struct tpg_hw_request *req = NULL, *active_req = NULL;
+
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "Invalid argument");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!list_empty(&hw->waiting_request_q)) {
+		req = list_first_entry(&hw->waiting_request_q,
+			struct tpg_hw_request, list);
+		if (req->request_id == request_id) {
+			CAM_DBG(CAM_TPG, "TPG[%d] request %d got matched", hw->hw_idx, request_id);
+			rc = tpg_hw_check_hw_state_and_apply_settings_locked(hw, req);
+
+			if (rc == 0) {
+				/* delete the request from waiting_q*/
+				list_del(&req->list);
+				hw->waiting_request_q_depth--;
+				/* delete active request from active q*/
+				if (!list_empty(&hw->active_request_q) &&
+					(hw->active_request_q_depth >= MAX_ACTIVE_QUEUE_DEPTH)) {
+					active_req = list_first_entry(&hw->active_request_q,
+						struct tpg_hw_request, list);
+					list_del(&active_req->list);
+					hw->active_request_q_depth--;
+
+					/* free the previously active request */
+					tpg_hw_release_vc_slots_locked(hw, active_req);
+				}
+
+				/* Add the currently applied request to active queue*/
+				list_add_tail(&req->list, &hw->active_request_q);
+				hw->active_request_q_depth++;
+			}
+		} else {
+			rc = tpg_hw_reapply_from_active_queue_locked(hw, request_id);
+		}
+	} else {
+		CAM_DBG(CAM_TPG, "TPG[%d] got apply for request %d when waiting queue is empty",
+			hw->hw_idx,
+			request_id);
+		rc = tpg_hw_reapply_from_active_queue_locked(hw, request_id);
+	}
+
+	if (rc == 0) {
+		CAM_DBG(CAM_TPG, "TPG[%d] Hw Apply done for req %lld", hw->hw_idx, request_id);
+	} else {
+		CAM_ERR(CAM_TPG, "TPG[%d] Hw Apply Failed for req %lld", hw->hw_idx, request_id);
+		rc = -EAGAIN;
+	}
+
+end:
+	return rc;
+}
+
+/* apply all pending requests sequencially */
+static int tpg_hw_apply_req_from_waiting_queue_locked(
+	struct tpg_hw *hw)
+{
+	int rc = 0;
+	struct list_head *pos = NULL, *pos_next = NULL;
+	struct tpg_hw_request *req = NULL;
+	struct tpg_hw_request *prev_req = NULL;
+
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "Invalid Params");
+		return -EINVAL;
+	}
+
+	list_for_each_safe(pos, pos_next, &hw->waiting_request_q) {
+		req = list_entry(pos, struct tpg_hw_request, list);
+		tpg_hw_apply_settings_to_hw_locked(hw, req);
+		list_del(pos);
+		hw->waiting_request_q_depth--;
+		/* free previous req if any*/
+		if (prev_req)
+			tpg_hw_release_vc_slots_locked(hw, prev_req);
+		prev_req = req;
+	}
+
+	/* last applied request in active */
+	if (prev_req != NULL) {
+		list_add_tail(&prev_req->list, &hw->active_request_q);
+		hw->active_request_q_depth++;
+	}
+	return rc;
+}
+
+int tpg_hw_start(struct tpg_hw *hw)
+{
+	int rc = 0;
+	struct tpg_reg_settings *reg_settings = NULL;
+	struct tpg_settings_config_t *config = NULL;
+	uint32_t settings_count = 0;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->ops)
+		return -EINVAL;
+
+	reg_settings = hw->register_settings;
+	config = &hw->settings_config;
+	settings_count = config->active_count;
+
+	mutex_lock(&hw->mutex);
+	switch (hw->hw_info->version) {
+	case TPG_HW_VERSION_1_0:
+	case TPG_HW_VERSION_1_1:
+		if (hw->hw_info->ops->start)
+			hw->hw_info->ops->start(hw, NULL);
+		break;
+	case TPG_HW_VERSION_1_2:
+	case TPG_HW_VERSION_1_3:
+	case TPG_HW_VERSION_1_3_1:
+	case TPG_HW_VERSION_1_4:
+		/* apply all initial requests */
+		if (hw->hw_info->ops->start)
+			hw->hw_info->ops->start(hw, NULL);
+
+		if (settings_count != 0) {
+			hw->hw_info->ops->write_settings(hw, config,
+						reg_settings);
+		} else {
+			tpg_hw_apply_req_from_waiting_queue_locked(hw);
+		}
+
+		break;
+	default:
+		CAM_ERR(CAM_TPG, "TPG[%d] Unsupported HW Version",
+			hw->hw_idx);
+		rc = -EINVAL;
+		break;
+	}
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+
+int tpg_hw_stop(struct tpg_hw *hw)
+{
+	int rc = 0;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->ops)
+		return -EINVAL;
+	mutex_lock(&hw->mutex);
+	switch (hw->hw_info->version) {
+	case TPG_HW_VERSION_1_0:
+	case TPG_HW_VERSION_1_1:
+	case TPG_HW_VERSION_1_2:
+	case TPG_HW_VERSION_1_3:
+	case TPG_HW_VERSION_1_3_1:
+	case TPG_HW_VERSION_1_4:
+		if (hw->hw_info->ops->stop) {
+			rc = hw->hw_info->ops->stop(hw, NULL);
+			if (rc) {
+				CAM_ERR(CAM_TPG, "TPG[%d] hw stop failed %d",
+					hw->hw_idx, rc);
+				break;
+			}
+		}
+		rc = tpg_hw_soc_disable(hw);
+		if (rc) {
+			CAM_ERR(CAM_TPG, "TPG[%d] hw soc disable failed %d",
+				hw->hw_idx, rc);
+			break;
+		}
+		tpg_hw_free_waiting_requests_locked(hw);
+		tpg_hw_free_active_requests_locked(hw);
+		break;
+	default:
+		CAM_ERR(CAM_TPG, "TPG[%d] Unsupported HW Version",
+			hw->hw_idx);
+		rc = -EINVAL;
+		break;
+	}
+	mutex_unlock(&hw->mutex);
+
+	return rc;
+}
+
+int tpg_hw_acquire(struct tpg_hw *hw,
+		struct tpg_hw_acquire_args *acquire)
+{
+	int rc = 0;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->ops)
+		return -EINVAL;
+
+	mutex_lock(&hw->mutex);
+	switch (hw->hw_info->version) {
+	case TPG_HW_VERSION_1_0:
+	case TPG_HW_VERSION_1_1:
+	case TPG_HW_VERSION_1_2:
+	case TPG_HW_VERSION_1_3:
+	case TPG_HW_VERSION_1_3_1:
+	case TPG_HW_VERSION_1_4:
+		// Start Cpas and enable required clocks
+		break;
+	default:
+		CAM_ERR(CAM_TPG, "TPG[%d] Unsupported HW Version",
+			hw->hw_idx);
+		rc = -EINVAL;
+		break;
+	}
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+
+int tpg_hw_release(struct tpg_hw *hw)
+{
+	int rc = 0;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->ops)
+		return -EINVAL;
+	mutex_lock(&hw->mutex);
+	switch (hw->hw_info->version) {
+	case TPG_HW_VERSION_1_0:
+	case TPG_HW_VERSION_1_1:
+	case TPG_HW_VERSION_1_2:
+	case TPG_HW_VERSION_1_3:
+	case TPG_HW_VERSION_1_3_1:
+	case TPG_HW_VERSION_1_4:
+		break;
+	default:
+		CAM_ERR(CAM_TPG, "TPG[%d] Unsupported HW Version",
+			hw->hw_idx);
+		rc = -EINVAL;
+		break;
+	}
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+
+enum cam_vote_level get_tpg_clk_level(
+		struct tpg_hw *hw)
+{
+	uint32_t cam_vote_level = 0;
+	uint32_t last_valid_vote = 0;
+	uint64_t clk = 0;
+	struct cam_hw_soc_info *soc_info;
+
+	if (!hw || !hw->soc_info)
+		return -EINVAL;
+
+	soc_info = hw->soc_info;
+	clk = hw->tpg_clock;
+
+	for (cam_vote_level = 0;
+			cam_vote_level < CAM_MAX_VOTE; cam_vote_level++) {
+		if (soc_info->clk_level_valid[cam_vote_level] != true)
+			continue;
+
+		if (soc_info->clk_rate[cam_vote_level]
+			[soc_info->src_clk_idx] >= clk) {
+			CAM_INFO(CAM_TPG,
+				"match detected %s : %llu:%d level : %d",
+				soc_info->clk_name[soc_info->src_clk_idx],
+				clk,
+				soc_info->clk_rate[cam_vote_level]
+				[soc_info->src_clk_idx],
+				cam_vote_level);
+			return cam_vote_level;
+		}
+		last_valid_vote = cam_vote_level;
+	}
+	return last_valid_vote;
+}
+
+static int tpg_hw_configure_init_settings(
+		struct tpg_hw *hw,
+		struct tpg_hw_initsettings *settings)
+{
+	int rc = 0;
+	int clk_level = 0;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->ops)
+		return -EINVAL;
+	mutex_lock(&hw->mutex);
+	switch (hw->hw_info->version) {
+	case TPG_HW_VERSION_1_0:
+	case TPG_HW_VERSION_1_1:
+	case TPG_HW_VERSION_1_2:
+	case TPG_HW_VERSION_1_3:
+	case TPG_HW_VERSION_1_3_1:
+	case TPG_HW_VERSION_1_4:
+		/* Need to handle the clock from the init config */
+		/* Need to handle this latter */
+		clk_level = get_tpg_clk_level(hw);
+		rc = tpg_hw_soc_enable(hw, clk_level, true);
+
+		if (rc) {
+			CAM_ERR(CAM_TPG, "TPG[%d] hw soc enable failed %d",
+				hw->hw_idx, rc);
+			break;
+		}
+
+		if (hw->hw_info->ops->init)
+			rc = hw->hw_info->ops->init(hw, settings);
+
+		if (rc) {
+			CAM_ERR(CAM_TPG, "TPG[%d] hw init failed %d",
+				hw->hw_idx, rc);
+		}
+		break;
+	default:
+		CAM_ERR(CAM_TPG, "TPG[%d] Unsupported HW Version",
+			hw->hw_idx);
+		rc = -EINVAL;
+		break;
+	}
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+
+static int tpg_hw_configure_init_settings_v3(
+		struct tpg_hw *hw,
+		struct tpg_hw_initsettings_v3 *settings)
+{
+	int rc = 0;
+	int clk_level = 0;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->ops)
+		return -EINVAL;
+	mutex_lock(&hw->mutex);
+	switch (hw->hw_info->version) {
+	case TPG_HW_VERSION_1_0:
+	case TPG_HW_VERSION_1_1:
+	case TPG_HW_VERSION_1_2:
+	case TPG_HW_VERSION_1_3:
+	case TPG_HW_VERSION_1_3_1:
+	case TPG_HW_VERSION_1_4:
+		clk_level = get_tpg_clk_level(hw);
+		rc = tpg_hw_soc_enable(hw, clk_level, true);
+
+		if (rc) {
+			CAM_ERR(CAM_TPG, "TPG[%d] hw soc enable failed %d",
+				hw->hw_idx, rc);
+			break;
+		}
+
+		if (hw->hw_info->ops->init)
+			rc = hw->hw_info->ops->init(hw, settings);
+
+		if (rc) {
+			CAM_ERR(CAM_TPG, "TPG[%d] hw init failed %d",
+				hw->hw_idx, rc);
+		}
+		break;
+	default:
+		CAM_ERR(CAM_TPG, "TPG[%d] Unsupported HW Version",
+			hw->hw_idx);
+		rc = -EINVAL;
+		break;
+	}
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+
+
+int tpg_hw_config(
+	struct tpg_hw *hw,
+	enum tpg_hw_cmd_t config_cmd,
+	void *config_args)
+{
+	int rc = 0;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->ops)
+		return -EINVAL;
+	switch (config_cmd) {
+	case TPG_HW_CMD_INIT_CONFIG:
+		//validate_stream_list(hw);
+		if (hw->settings_config.active_count != 0) {
+			tpg_hw_configure_init_settings_v3(hw,
+					(struct tpg_hw_initsettings_v3 *)config_args);
+		} else {
+			if (hw->stream_version == 1) {
+				tpg_hw_configure_init_settings(hw,
+					(struct tpg_hw_initsettings *)config_args);
+			} else if (hw->stream_version == 3) {
+				tpg_hw_configure_init_settings_v3(hw,
+					(struct tpg_hw_initsettings_v3 *)config_args);
+			}
+		}
+		break;
+	default:
+		CAM_ERR(CAM_TPG, "TPG[%d] Unsupported hw config command",
+			hw->hw_idx);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+int tpg_hw_copy_settings_config(
+	struct tpg_hw *hw,
+	struct tpg_settings_config_t *settings)
+{
+	struct tpg_reg_settings *reg_settings;
+	uint32_t num_settings_array;
+
+	if (!hw || !settings) {
+		CAM_ERR(CAM_TPG, "invalid parameter");
+		return -EINVAL;
+	}
+
+	num_settings_array = settings->settings_array_size;
+	hw->register_settings =
+		kzalloc(sizeof(struct tpg_reg_settings) *
+		num_settings_array, GFP_KERNEL);
+
+	if (hw->register_settings == NULL) {
+		CAM_ERR(CAM_TPG, "unable to allocate memory");
+		return -EINVAL;
+	}
+
+	reg_settings = (struct tpg_reg_settings *)
+		((uint8_t *)settings + settings->settings_array_offset);
+
+	mutex_lock(&hw->mutex);
+	memcpy(&hw->settings_config,
+		settings,
+		sizeof(struct tpg_settings_config_t));
+	memcpy(hw->register_settings,
+		reg_settings,
+		sizeof(struct tpg_reg_settings) * num_settings_array);
+	mutex_unlock(&hw->mutex);
+
+	return 0;
+}
+
+static int assign_vc_slot(
+	struct tpg_hw *hw,
+	int  vc,
+	struct tpg_hw_request *req,
+	struct tpg_hw_stream *stream
+	)
+{
+	int rc = -EINVAL, i = 0, slot_matched = 0;
+
+	if (!hw || !stream || !req) {
+		return -EINVAL;
+	}
+
+	for (i = 0; i < hw->hw_info->max_vc_channels; i++) {
+		/* Found a matching slot */
+		if (req->vc_slots[i].vc == vc) {
+			slot_matched = 1;
+			if (req->vc_slots[i].stream_count
+					< hw->hw_info->max_dt_channels_per_vc) {
+				list_add_tail(&stream->list, &req->vc_slots[i].head);
+				req->vc_slots[i].stream_count++;
+				req->vc_slots[i].vc = vc;
+				rc = 0;
+				CAM_DBG(CAM_TPG, "vc[%d]dt[%d]=>slot[%d]", vc, stream->stream.dt, i);
+				break;
+			} else {
+
+				/**
+				 * already slot was assigned for this vc
+				 * however this slot have been filled with
+				 * full streams
+				 */
+				rc = -EINVAL;
+				CAM_ERR(CAM_TPG, "vc[%d]dt[%d]=>slot[%d] is overlfown",
+						vc, stream->stream.dt, i);
+				break;
+			}
+		}
+
+		/**
+		 * none of the above slots matched, and now found an empty slot
+		 * so assigning stream to that slot
+		 */
+		if (req->vc_slots[i].vc == -1) {
+			list_add_tail(&stream->list, &req->vc_slots[i].head);
+			req->vc_slots[i].stream_count++;
+			req->vc_slots[i].vc = vc;
+			req->vc_count++;
+			rc = 0;
+			CAM_DBG(CAM_TPG, "vc[%d]dt[%d]=>slot[%d]", vc, stream->stream.dt, i);
+			break;
+		}
+	}
+	if ((slot_matched == 0) && (rc != 0)) {
+		CAM_ERR(CAM_TPG, "No slot matched");
+	}
+	return rc;
+}
+
+static int assign_vc_slot_v3(
+	struct tpg_hw *hw,
+	int  vc,
+	struct tpg_hw_request *req,
+	struct tpg_hw_stream_v3 *stream
+	)
+{
+	int rc = -EINVAL, i = 0, slot_matched = 0;
+
+	if (!hw || !stream || !req)
+		return -EINVAL;
+
+	for (i = 0; i < hw->hw_info->max_vc_channels; i++) {
+		/* Found a matching slot */
+		if (req->vc_slots[i].vc == vc) {
+			slot_matched = 1;
+			if (req->vc_slots[i].stream_count
+					< hw->hw_info->max_dt_channels_per_vc) {
+				list_add_tail(&stream->list, &req->vc_slots[i].head);
+				req->vc_slots[i].stream_count++;
+				req->vc_slots[i].vc = vc;
+				rc = 0;
+				CAM_DBG(CAM_TPG, "vc[%d]dt[%d]=>slot[%d]",
+					vc,
+					stream->stream.dt,
+					i);
+			} else {
+
+				/**
+				 * already slot was assigned for this vc
+				 * however this slot have been filled with
+				 * full streams
+				 */
+				rc = -EINVAL;
+				CAM_ERR(CAM_TPG, "vc[%d]dt[%d]=>slot[%d] is overlfown",
+					vc, stream->stream.dt, i);
+			}
+			break;
+		}
+
+		/**
+		 * none of the above slots matched, and now found an empty slot
+		 * so assigning stream to that slot
+		 */
+		if (req->vc_slots[i].vc == -1) {
+			list_add_tail(&stream->list, &req->vc_slots[i].head);
+			req->vc_slots[i].stream_count++;
+			req->vc_slots[i].vc = vc;
+			req->vc_count++;
+			rc = 0;
+			CAM_DBG(CAM_TPG, "vc[%d]dt[%d]=>slot[%d]", vc, stream->stream.dt, i);
+			break;
+		}
+	}
+	if ((slot_matched == 0) && (rc != 0))
+		CAM_ERR(CAM_TPG, "No slot matched");
+	return rc;
+}
+
+int tpg_hw_free_request(
+	struct tpg_hw *hw,
+	struct tpg_hw_request *req)
+{
+	int rc = 0;
+
+	if (!hw || !req)
+		return -EINVAL;
+
+	mutex_lock(&hw->mutex);
+	rc = tpg_hw_release_vc_slots_locked(hw, req);
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+
+int tpg_hw_reset(struct tpg_hw *hw)
+{
+	int rc = 0;
+	unsigned long flags;
+	if (!hw)
+		return -EINVAL;
+
+	CAM_DBG(CAM_TPG, "TPG HW reset");
+	/* disable the hw */
+	mutex_lock(&hw->mutex);
+
+	rc = tpg_hw_free_waiting_requests_locked(hw);
+	if (rc)
+		CAM_ERR(CAM_TPG, "TPG[%d] unable to free up the pending requests",
+				hw->hw_idx);
+
+	if (hw->state != TPG_HW_STATE_HW_DISABLED) {
+		rc = cam_soc_util_disable_platform_resource(hw->soc_info, CAM_CLK_SW_CLIENT_IDX,
+			true, false);
+		if (rc) {
+			CAM_ERR(CAM_TPG, "TPG[%d] Disable platform failed %d", hw->hw_idx, rc);
+		}
+		rc = cam_cpas_stop(hw->cpas_handle);
+		if (rc) {
+			CAM_ERR(CAM_TPG, "TPG[%d] CPAS stop failed", hw->hw_idx);
+		}
+		spin_lock_irqsave(&hw->hw_state_lock, flags);
+		hw->state =  TPG_HW_STATE_HW_DISABLED;
+		spin_unlock_irqrestore(&hw->hw_state_lock, flags);
+	}
+
+	rc = tpg_hw_free_active_requests_locked(hw);
+	if (rc) {
+		CAM_ERR(CAM_TPG, "TPG[%d] unable to free up the active requests",
+				hw->hw_idx);
+	}
+	mutex_unlock(&hw->mutex);
+
+	return rc;
+}
+
+int tpg_hw_add_stream(
+	struct tpg_hw *hw,
+	struct tpg_hw_request *req,
+	struct tpg_stream_config_t *cmd)
+{
+	int rc = 0;
+	struct tpg_hw_stream *stream = NULL;
+	if (!hw || !req || !cmd) {
+		CAM_ERR(CAM_TPG, "Invalid params");
+		return -EINVAL;
+	}
+
+	hw->stream_version = 1;
+	mutex_lock(&hw->mutex);
+	stream = kzalloc(sizeof(struct tpg_hw_stream), GFP_KERNEL);
+	if (!stream) {
+		CAM_ERR(CAM_TPG, "TPG[%d] stream allocation failed",
+			hw->hw_idx);
+		mutex_unlock(&hw->mutex);
+		return -ENOMEM;
+	}
+	memcpy(&stream->stream,
+		cmd,
+		sizeof(struct tpg_stream_config_t));
+
+	rc = assign_vc_slot(hw, stream->stream.vc, req, stream);
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+
+int tpg_hw_add_request(struct tpg_hw *hw,
+	struct tpg_hw_request *req)
+{
+	int rc = 0;
+
+	if (!hw || !req) {
+		CAM_ERR(CAM_TPG, "Invalid params");
+		return -EINVAL;
+	}
+	mutex_lock(&hw->mutex);
+	if (hw->waiting_request_q_depth <= MAX_WAITING_QUEUE_DEPTH) {
+		list_add_tail(&req->list, &hw->waiting_request_q);
+		hw->waiting_request_q_depth++;
+	} else {
+		CAM_ERR(CAM_TPG, "waiting queue size is exceed");
+	}
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+
+struct tpg_hw_request *tpg_hw_create_request(
+	struct tpg_hw *hw,
+	uint64_t request_id)
+{
+	struct tpg_hw_request *req = NULL;
+	uint32_t num_vc_channels = 0;
+	uint32_t i = 0;
+
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "Invalid params");
+		return NULL;
+	}
+
+	num_vc_channels = hw->hw_info->max_vc_channels;
+
+	/* Allocate request */
+	req = kzalloc(sizeof(struct tpg_hw_request),
+			GFP_KERNEL);
+	if (!req) {
+		CAM_ERR(CAM_TPG, "TPG[%d] request allocation failed",
+				hw->hw_idx);
+		return NULL;
+	}
+	req->request_id = request_id;
+	/* Allocate Vc slots in request */
+	req->vc_slots = kcalloc(num_vc_channels, sizeof(struct tpg_vc_slot_info),
+			GFP_KERNEL);
+
+	req->vc_count = 0;
+	if (!req->vc_slots) {
+		CAM_ERR(CAM_TPG, "TPG[%d] vc slot allocation failed",
+				hw->hw_idx);
+		goto err_exit_1;
+	}
+
+	INIT_LIST_HEAD(&req->list);
+	/* Initialize the slot variables */
+	for (i = 0; i < hw->hw_info->max_vc_channels; i++) {
+		req->vc_slots[i].slot_id      =  i;
+		req->vc_slots[i].vc           = -1;
+		req->vc_slots[i].stream_count =  0;
+		INIT_LIST_HEAD(&(req->vc_slots[i].head));
+	}
+	CAM_DBG(CAM_TPG, "TPG[%d] request(%lld) allocated success",
+			hw->hw_idx, request_id);
+	return req;
+err_exit_1:
+	kfree(req);
+	return NULL;
+}
+
+int tpg_hw_request_set_opcode(
+	struct tpg_hw_request *req,
+	uint32_t opcode)
+{
+	int rc = 0;
+
+	if (!req) {
+		CAM_ERR(CAM_TPG, "Invalid params");
+		return -EINVAL;
+	}
+	switch (opcode) {
+	case CAM_TPG_PACKET_OPCODE_INITIAL_CONFIG:
+		req->request_type = TPG_HW_REQ_TYPE_INIT;
+		break;
+	case CAM_TPG_PACKET_OPCODE_NOP:
+		req->request_type = TPG_HW_REQ_TYPE_NOP;
+		break;
+	case CAM_TPG_PACKET_OPCODE_UPDATE:
+		req->request_type = TPG_HW_REQ_TYPE_UPDATE;
+		break;
+	default:
+		req->request_type = TPG_HW_REQ_TYPE_NOP;
+		break;
+	}
+	CAM_INFO(CAM_TPG, "req[%d] type = %d",
+			req->request_id,
+			req->request_type);
+	return rc;
+}
+
+int tpg_hw_apply(
+	struct tpg_hw *hw,
+	uint64_t request_id)
+{
+	int rc = 0;
+
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "Invalid params");
+		return -EINVAL;
+	}
+	mutex_lock(&hw->mutex);
+	rc = tpg_hw_lookup_queues_and_apply_req_locked(hw, request_id);
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+int tpg_hw_add_stream_v3(
+	struct tpg_hw *hw,
+	struct tpg_hw_request *req,
+	struct tpg_stream_config_v3_t *cmd)
+{
+	int rc = 0;
+	struct tpg_hw_stream_v3 *stream = NULL;
+
+	if (!hw || !req || !cmd) {
+		CAM_ERR(CAM_TPG, "Invalid params");
+		return -EINVAL;
+	}
+
+	hw->stream_version = 3;
+	mutex_lock(&hw->mutex);
+	stream = kzalloc(sizeof(struct tpg_hw_stream_v3), GFP_KERNEL);
+	if (!stream) {
+		CAM_ERR(CAM_TPG, "TPG[%d] stream allocation failed",
+			hw->hw_idx);
+		mutex_unlock(&hw->mutex);
+		return -ENOMEM;
+	}
+	memcpy(&stream->stream,
+		cmd,
+		sizeof(struct tpg_stream_config_v3_t));
+
+	rc = assign_vc_slot_v3(hw, stream->stream.vc, req, stream);
+	mutex_unlock(&hw->mutex);
+	return rc;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw.h
@@ -0,0 +1,536 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __TPG_HW_H__
+#define __TPG_HW_H__
+
+#include <linux/kernel.h>
+#include "cam_debug_util.h"
+#include "cam_soc_util.h"
+#include <cam_cpas_api.h>
+#include <media/cam_sensor.h>
+#include <linux/spinlock.h>
+#include <linux/completion.h>
+
+#define TPG_HW_VERSION_1_0   0x10000000
+#define TPG_HW_VERSION_1_1   0x10000001
+#define TPG_HW_VERSION_1_2   0x10000002
+#define TPG_HW_VERSION_1_3   0x10000003
+#define TPG_HW_VERSION_1_3_1 0x10000004
+#define TPG_HW_VERSION_1_4   0x10000005
+
+struct tpg_hw;
+
+/**
+ * tpg_hw_ops : tpg hw operations
+ *
+ * @init        : tpg hw layer init
+ * @start       : tpg hw start stream
+ * @stop        : tpg hw stop  stream
+ * @deinit      : tpg hw deinit
+ * @read        : tpg hw read register
+ * @write       : tpg hw write register
+ * @process_cmd : tpg hw process command
+ * @dump_status : dump any status registers
+ * @write_settings : write register settings
+ */
+struct tpg_hw_ops {
+	int (*init)(struct tpg_hw *hw, void *data);
+	int (*start)(struct tpg_hw *hw, void *data);
+	int (*stop)(struct tpg_hw *hw, void *data);
+	int (*deinit)(struct tpg_hw *hw, void *data);
+	int (*read)(struct tpg_hw *hw, uint32_t  *addr, uint32_t *val);
+	int (*write)(struct tpg_hw *hw, uint32_t *addr, uint32_t *val);
+	int (*process_cmd)(struct tpg_hw *hw, uint32_t cmd, void *arg);
+	int (*dump_status)(struct tpg_hw *hw, void *data);
+	int (*write_settings)(struct tpg_hw *hw,
+		struct tpg_settings_config_t *config, struct tpg_reg_settings *settings);
+	irqreturn_t (*handle_irq)(struct tpg_hw *hw);
+};
+
+/**
+ * tpg_hw_state : tpg hw states
+ *
+ * TPG_HW_STATE_HW_DISABLED: tpg hw is not enabled yet
+ * TPG_HW_STATE_HW_ENABLED : tpg hw is enabled
+ * TPG_HW_STATE_READY      : tpg hw is ready
+ * TPG_HW_STATE_BUSY       : tpg hw is busy
+ * TPG_HW_STATE_MAX        : tp hw is max
+ */
+enum tpg_hw_state {
+	TPG_HW_STATE_HW_DISABLED,
+	TPG_HW_STATE_HW_ENABLED,
+	TPG_HW_STATE_READY,
+	TPG_HW_STATE_BUSY,
+	TPG_HW_STATE_MAX
+};
+
+#define TPG_HW_REQ_TYPE_NOP     0x00
+#define TPG_HW_REQ_TYPE_INIT    0x01
+#define TPG_HW_REQ_TYPE_UPDATE  0x02
+#define TPG_HW_REQ_TYPE_BYPASS  0x03
+
+/**
+ * tpg_hw_request : tpg hw request info
+ *
+ * @request_id        : request id
+ * @request_type      : request type
+ * @global_config     : global configuration
+ * @vc_slots          : vc slots
+ * @vc_count          : vc count
+ * @list              : list
+ */
+struct tpg_hw_request {
+	uint64_t                   request_id;
+	int                        request_type;
+	struct tpg_global_config_t global_config;
+	struct tpg_vc_slot_info    *vc_slots;
+	uint32_t                   vc_count;
+	struct list_head           list;
+};
+
+/**
+ * @brief tpg_vc_slot_info
+ * @slot_id      : slot id of this vc slot
+ * @vc           : virtual channel configured
+ * @stream_count : number of streams in this slot
+ * @head         : head pointing all data types in with this vc
+ */
+struct tpg_vc_slot_info {
+	int    slot_id;
+	int    vc;
+	int    stream_count;
+	struct list_head head;
+};
+
+/**
+ * tpg_hw_info : tpg hw layer info
+ *
+ * @version:  version of tpg hw
+ * @max_vc_channels: max number of virtual channels supported by tpg
+ * @max_dt_channels_per_vc: max dts supported in each vc
+ * @ops:   tpg hw operations
+ * @hw_data: tpg hw data
+ * @hw: hw layer initialization
+ * @xcfa_debug: for xcfa debug
+ * @shdr_overlap: for shdr overlap
+ * @shdr_offset_num_batch: for shdr offset num batch
+ * @shdr_line_offset0: for shdr line offset0
+ * @shdr_line_offset1: for shdr line offset1
+ */
+struct tpg_hw_info {
+	uint32_t          version;
+	uint32_t          max_vc_channels;
+	uint32_t          max_dt_channels_per_vc;
+	struct tpg_hw_ops *ops;
+	void              *hw_data;
+	int               (*layer_init)(struct tpg_hw *hw);
+	int               xcfa_debug;
+	int               shdr_overlap;
+	int               shdr_offset_num_batch;
+	int               shdr_line_offset0;
+	int               shdr_line_offset1;
+};
+
+
+/**
+ * tpg_hw_stream : tpg hw stream
+ *
+ * @stream : tpg stream;
+ * @list   : entry to tpg stream list
+ */
+struct tpg_hw_stream {
+	struct tpg_stream_config_t stream;
+	struct list_head list;
+};
+
+/**
+ * tpg_hw_stream_v3 : tpg hw stream version 2
+ *
+ * @stream : tpg stream version 2
+ * @list   : entry to tpg stream list
+ */
+struct tpg_hw_stream_v3 {
+	struct tpg_stream_config_v3_t stream;
+	struct list_head list;
+};
+
+
+/**
+ * tpg_hw : tpg hw
+ *
+ * @hw_idx                  : hw id
+ * @stream_version          : stream version
+ * @state                   : tpg hw state
+ * @cpas_handle             : handle to cpas
+ * @vc_count                : vc count
+ * @tpg_clock               : tpg clock
+ * @hw_info                 : tp hw info
+ * @soc_info                : soc info
+ * @mutex                   : lock
+ * @complete_rup            : rup done completion
+ * @vc_slots                : vc slots info
+ * @settings_config         : settings configuration
+ * @register_settings       : register settings info
+ * @tpg_hw_irq_handler      : handle hw irq
+ * @waiting_request_q       : queue of waiting requests to be applied
+ * @acitive_request_q       : queue of active requests being applied,
+ * @active_request_q_depth  : active request queue depth
+ * @waiting_request_q_depth : waiting request queue depth
+ * @settings update         : settings update flag
+ */
+struct tpg_hw {
+	uint32_t                     hw_idx;
+	uint32_t                     stream_version;
+	uint32_t                     state;
+	uint32_t                     cpas_handle;
+	uint32_t                     vc_count;
+	uint64_t                     tpg_clock;
+	struct tpg_hw_info           *hw_info;
+	struct cam_hw_soc_info       *soc_info;
+	struct mutex                 mutex;
+	spinlock_t                   hw_state_lock;
+	struct completion            complete_rup;
+	struct tpg_vc_slot_info      *vc_slots;
+	struct tpg_settings_config_t settings_config;
+	struct tpg_reg_settings      *register_settings;
+	int                          (*tpg_hw_irq_handler)(struct tpg_hw *hw);
+	/* Waiting and active request Queues */
+	struct list_head             waiting_request_q;
+	struct list_head             active_request_q;
+	uint32_t                     active_request_q_depth;
+	uint32_t                     waiting_request_q_depth;
+	uint32_t                     settings_update;
+};
+
+/**
+ * tpg_hw_acquire_args : tpg hw acquire arguments
+ *
+ * @resource_list  : list of resources to acquire
+ * @count          : number of resources to acquire
+ */
+struct tpg_hw_acquire_args {
+	/* Integer id of resources */
+	uint32_t *resource_list;
+	ssize_t  count;
+};
+
+enum tpg_hw_cmd_t {
+	TPG_HW_CMD_INVALID = 0,
+	TPG_HW_CMD_INIT_CONFIG,
+	TPG_HW_CMD_MAX,
+};
+
+#define TPG_HW_CONFIG_BASE 0x4000
+#define TPG_CONFIG_CTRL    (TPG_HW_CONFIG_BASE + 0)
+#define TPG_CONFIG_VC      (TPG_HW_CONFIG_BASE + 1)
+#define TPG_CONFIG_DT      (TPG_HW_CONFIG_BASE + 2)
+
+/* pixel bit width */
+#define PACK_8_BIT    8
+#define PACK_10_BIT   10
+#define PACK_12_BIT   12
+#define PACK_14_BIT   14
+#define PACK_16_BIT   16
+
+/**
+ * @vc_config_args : arguments for vc config process cmd
+ *
+ * @vc_slot : slot to configure this vc
+ * @num_dts : number of dts in this vc
+ * @stream  : output stream
+ */
+struct vc_config_args {
+	uint32_t vc_slot;
+	uint32_t num_dts;
+	struct tpg_stream_config_t *stream;
+};
+
+/**
+ * dt_config_args : arguments for dt config process cmd
+ *
+ * @vc_slot  : vc slot to configure this dt
+ * @dt_slot  : dt slot to configure this dt
+ * @stream   : stream packet to configure for this dt
+ */
+struct dt_config_args {
+	uint32_t vc_slot;
+	uint32_t dt_slot;
+	struct tpg_stream_config_t *stream;
+};
+
+/**
+ * @vc_config_args_v3 : arguments for vc config process cmd version 2
+ *
+ * @vc_slot : slot to configure this vc
+ * @num_dts : number of dts in this vc
+ * @stream  : output stream version 2
+ */
+struct vc_config_args_v3 {
+	uint32_t vc_slot;
+	uint32_t num_dts;
+	struct tpg_stream_config_v3_t *stream;
+};
+
+/**
+ * dt_config_args_v3 : arguments for dt config process cmd version 2
+ *
+ * @vc_slot  : vc slot to configure this dt
+ * @dt_slot  : dt slot to configure this dt
+ * @stream   : stream packet to configure for this dt version 2
+ */
+struct dt_config_args_v3 {
+	uint32_t vc_slot;
+	uint32_t dt_slot;
+	struct tpg_stream_config_v3_t *stream;
+};
+
+
+/**
+ * global_config_args : tpg global config args
+ *
+ * @num_vcs : number of vcs to be configured
+ * @globalconfig: global config cmd
+ */
+struct global_config_args {
+	uint32_t num_vcs;
+	struct tpg_global_config_t *globalconfig;
+};
+
+/**
+ * tpg_hw_initsettings : initial configurations
+ *
+ * @global_config : global configuration
+ * @streamconfigs : array of stream configurations
+ * @num_streams   : number of streams in strea config array
+ */
+struct tpg_hw_initsettings {
+	struct tpg_global_config_t globalconfig;
+	struct tpg_stream_config_t *streamconfigs;
+	uint32_t num_streams;
+};
+
+/**
+ * tpg_hw_initsettings_v3 : initial configurations version 2
+ *
+ * @global_config : global configuration
+ * @streamconfigs : array of stream configurations version 2
+ * @num_streams   : number of streams in strea config array
+ */
+struct tpg_hw_initsettings_v3 {
+	struct tpg_global_config_t globalconfig;
+	struct tpg_stream_config_v3_t *streamconfigs;
+	uint32_t num_streams;
+};
+
+
+/**
+ * @brief dump the tpg memory info
+ *
+ * @param soc_info: soc info for soc related info
+ *
+ * @return : 0 on succuss
+ */
+int32_t cam_tpg_mem_dmp(struct cam_hw_soc_info *soc_info);
+
+/**
+ * @brief dump global config command
+ *
+ * @param idx    : hw index
+ * @param global : global config command
+ *
+ * @return       : 0 on success
+ */
+int dump_global_configs(int idx,
+		struct tpg_global_config_t *global);
+
+/**
+ * @brief : dump stream config command
+ *
+ * @param hw_idx: hw index
+ * @param stream_idx: stream index
+ * @param stream: stream config command
+ *
+ * @return : 0 on success
+ */
+int dump_stream_configs(int hw_idx,
+		int stream_idx,
+		struct tpg_stream_config_t *stream);
+
+/**
+ * @brief : dump stream config command version 2
+ *
+ * @param hw_idx: hw index
+ * @param stream_idx: stream index
+ * @param stream: stream config command version 2
+ *
+ * @return : 0 on success
+ */
+int dump_stream_configs_v3(int hw_idx, int stream_idx, struct tpg_stream_config_v3_t *stream);
+
+
+/**
+ * @brief : dump any hw status registers
+ *
+ * @param hw: tpg hw instance
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_dump_status(struct tpg_hw *hw);
+/**
+ * @brief : start tpg hw stream
+ *
+ * @param hw: tpg hw instance
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_start(struct tpg_hw *hw);
+
+/**
+ * @brief : stop tpg hw stream
+ *
+ * @param hw: tpg hw instance
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_stop(struct tpg_hw *hw);
+
+/**
+ * @brief : tpg hw acquire
+ *
+ * @param hw: tpg hw instance
+ * @param acquire: list of resources to acquire
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_acquire(struct tpg_hw *hw,
+		struct tpg_hw_acquire_args *acquire);
+/**
+ * @brief release tpg hw
+ *
+ * @param hw: tpg hw instance
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_release(struct tpg_hw *hw);
+
+/**
+ * @brief : configure tpg hw
+ *
+ * @param hw: tpg hw instance
+ * @param cmd: configuration command
+ * @param arg: configuration command argument
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_config(struct tpg_hw *hw, enum tpg_hw_cmd_t cmd, void *arg);
+
+/**
+ * @brief : reset the tpg hw instance
+ *
+ * @param hw: tpg hw instance
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_reset(struct tpg_hw *hw);
+
+/**
+ * @brief : tp hw add stream
+ *
+ * @param hw: tpg hw instance
+ * @param req: req instance
+ * @param cmd: tpg hw command
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_add_stream(
+	struct tpg_hw *hw,
+	struct tpg_hw_request *req,
+	struct tpg_stream_config_t *cmd);
+
+/**
+ * @brief : tp hw add stream version 2
+ *
+ * @param hw: tpg hw instance
+ * @param req: req instance
+ * @param cmd: tpg hw command version 2
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_add_stream_v3(
+	struct tpg_hw *hw,
+	struct tpg_hw_request *req,
+	struct tpg_stream_config_v3_t *cmd);
+
+/**
+ * @brief : hw apply
+ *
+ * @param hw: tpg hw instance
+ * @param request_id: request id
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_apply(
+	struct tpg_hw *hw,
+	uint64_t request_id);
+
+/**
+ * @brief : create hw request
+ *
+ * @param hw: tpg hw instance
+ * @param request_id: request id
+ *
+ * @return : req on success
+ */
+struct tpg_hw_request *tpg_hw_create_request(
+	struct tpg_hw *hw,
+	uint64_t request_id);
+
+/**
+ * @brief : free hw request
+ *
+ * @param hw: tpg hw instance
+ * @param req: request instance
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_free_request(struct tpg_hw *hw,
+		struct tpg_hw_request *req);
+
+/**
+ * @brief : add hw request
+ *
+ * @param hw: tpg hw instance
+ * @param req: request instance
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_add_request(struct tpg_hw *hw,
+	struct tpg_hw_request *req);
+
+/**
+ * @brief : set opcode of request
+ *
+ * @param hw: tpg hw instance
+ * @param opcode: op code
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_request_set_opcode(
+	struct tpg_hw_request *req,
+	uint32_t opcode);
+
+/**
+ * @brief : copy settings config command
+ *
+ * @param hw: tpg hw instance
+ * @param settings: settings config command
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_copy_settings_config(struct tpg_hw *hw, struct tpg_settings_config_t *settings);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_common.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_common.c
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "tpg_hw_common.h"
+
+int tpg_hw_write_settings(struct tpg_hw *hw,
+		struct tpg_settings_config_t *config, struct tpg_reg_settings *settings)
+{
+		struct cam_hw_soc_info *soc_info = NULL;
+		int setting_index;
+		phys_addr_t size;
+		uint32_t tpg_reg_offset;
+
+		if (!hw || !config || !settings) {
+			CAM_ERR(CAM_TPG, "invalid params");
+			return -EINVAL;
+		}
+
+		soc_info = hw->soc_info;
+		size = resource_size(soc_info->mem_block[0]);
+
+		for (setting_index = 0; setting_index < config->active_count; setting_index++) {
+			tpg_reg_offset = settings->reg_offset;
+			if (tpg_reg_offset >= size) {
+				CAM_ERR(CAM_TPG, "settings reg_offset error");
+				return -EINVAL;
+			}
+			cam_io_w_mb(settings->reg_value, soc_info->reg_map[0].mem_base +
+						tpg_reg_offset);
+			settings++;
+		}
+
+		return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_common.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __TPG_HW_COMMON_H__
+#define __TPG_HW_COMMON_H__
+
+#include <linux/kernel.h>
+#include "cam_debug_util.h"
+#include "cam_soc_util.h"
+#include <cam_cpas_api.h>
+#include <media/cam_sensor.h>
+#include "tpg_hw.h"
+
+/**
+ * @brief  write register settings
+ *
+ * @param hw   : tpg hw instance
+ * @param config : argument for settings config
+ * @param settings : argument for register settings
+ *
+ * @return     : 0 on sucdess
+ */
+int tpg_hw_write_settings(struct tpg_hw *hw,
+		struct tpg_settings_config_t *config, struct tpg_reg_settings *settings);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_0/tpg_hw_v_1_0.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_0/tpg_hw_v_1_0.c
@@ -0,0 +1,283 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "tpg_hw_v_1_0.h"
+
+enum tpg_hw_encode_format_t {
+	RAW_8_BIT = 1,
+	RAW_10_BIT,
+	RAW_12_BIT,
+	RAW_14_BIT,
+	RAW_16_BIT
+};
+
+static struct cam_tpg_ver1_reg_offset cam_tpg101_reg = {
+	.tpg_hw_version     = 0x0,
+	.tpg_hw_status      = 0x4,
+	.tpg_ctrl           = 0x60,
+	.tpg_vc_cfg0        = 0x64,
+	.tpg_vc_cfg1        = 0x68,
+	.tpg_lfsr_seed      = 0x6c,
+	.tpg_dt_0_cfg_0     = 0x70,
+	.tpg_dt_1_cfg_0     = 0x74,
+	.tpg_dt_2_cfg_0     = 0x78,
+	.tpg_dt_3_cfg_0     = 0x7C,
+	.tpg_dt_0_cfg_1     = 0x80,
+	.tpg_dt_1_cfg_1     = 0x84,
+	.tpg_dt_2_cfg_1     = 0x88,
+	.tpg_dt_3_cfg_1     = 0x8C,
+	.tpg_dt_0_cfg_2     = 0x90,
+	.tpg_dt_1_cfg_2     = 0x94,
+	.tpg_dt_2_cfg_2     = 0x98,
+	.tpg_dt_3_cfg_2     = 0x9C,
+	.tpg_color_bar_cfg  = 0xA0,
+	.tpg_common_gen_cfg = 0xA4,
+	.tpg_vbi_cfg        = 0xA8,
+	.tpg_test_bus_crtl  = 0xF8,
+	.tpg_spare          = 0xFC,
+
+	/* configurations */
+	.major_version     = 1,
+	.minor_version     = 0,
+	.version_incr      = 0,
+	.tpg_en_shift_val  = 0,
+	.tpg_phy_sel_shift_val      = 3,
+	.tpg_num_active_lines_shift = 4,
+	.tpg_fe_pkt_en_shift        = 2,
+	.tpg_fs_pkt_en_shift        = 1,
+	.tpg_line_interleaving_mode_shift = 10,
+	.tpg_num_dts_shift_val            = 8,
+	.tpg_v_blank_cnt_shift            = 12,
+	.tpg_dt_encode_format_shift       = 16,
+	.tpg_payload_mode_color = 0x8,
+	.tpg_split_en_shift     = 5,
+	.top_mux_reg_offset     = 0x1C,
+};
+
+static int configure_global_configs(struct tpg_hw *hw,
+		struct tpg_global_config_t *configs)
+{
+	uint32_t val;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver1_reg_offset *tpg_reg = &cam_tpg101_reg;
+
+	if (hw == NULL) {
+		CAM_ERR(CAM_TPG, "invalid argument");
+		return -EINVAL;
+	}
+	soc_info = hw->soc_info;
+
+	val = cam_io_r_mb(soc_info->reg_map[1].mem_base +
+			tpg_reg->top_mux_reg_offset);
+	val |= (1 << hw->hw_idx);
+
+	cam_io_w_mb(val,
+			soc_info->reg_map[1].mem_base + tpg_reg->top_mux_reg_offset);
+	CAM_INFO(CAM_ISP, "TPG:%d Set top Mux: 0x%x",
+			hw->hw_idx, val);
+
+	val = ((4 - 1) <<
+			tpg_reg->tpg_num_active_lines_shift) |
+		(1 << tpg_reg->tpg_fe_pkt_en_shift) |
+		(1 << tpg_reg->tpg_fs_pkt_en_shift) |
+		(0 << tpg_reg->tpg_phy_sel_shift_val) |
+		(1 << tpg_reg->tpg_en_shift_val);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+
+	return 0;
+}
+
+static int get_tpg_encode_format(int sw_encode_format)
+{
+	switch (sw_encode_format) {
+	case PACK_8_BIT:
+		return RAW_8_BIT;
+	case PACK_10_BIT:
+		return RAW_10_BIT;
+	case PACK_12_BIT:
+		return RAW_12_BIT;
+	case PACK_14_BIT:
+		return RAW_14_BIT;
+	case PACK_16_BIT:
+		return RAW_16_BIT;
+	}
+	return RAW_8_BIT;
+}
+
+static int configure_dt(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	uint32_t       dt_slot,
+	struct tpg_stream_config_t *stream)
+{
+	uint32_t val;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver1_reg_offset *tpg_reg = &cam_tpg101_reg;
+
+	if (hw == NULL) {
+		CAM_ERR(CAM_TPG, "invalid argument");
+		return -EINVAL;
+	}
+	soc_info = hw->soc_info;
+
+	CAM_DBG(CAM_TPG, "TPG[%d] slot(%d,%d) <= dt:%d",
+			hw->hw_idx,
+			vc_slot,
+			dt_slot,
+			stream->dt);
+	/* configure width and height */
+	val = (((stream->stream_dimension.width & 0xFFFF) << 16) |
+			(stream->stream_dimension.height & 0x3FFF));
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_dt_0_cfg_0 + 0x10 * dt_slot);
+
+	/* configure data type */
+	cam_io_w_mb(stream->dt,
+			soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_dt_0_cfg_1 + 0x10 * dt_slot);
+
+	/* configure bpp */
+	val = ((get_tpg_encode_format(stream->pixel_depth) & 0xF) <<
+			tpg_reg->tpg_dt_encode_format_shift) |
+		tpg_reg->tpg_payload_mode_color;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_dt_0_cfg_2 + 0x10 * dt_slot);
+
+	return 0;
+}
+
+static int configure_vc(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	int            num_dts,
+	struct tpg_stream_config_t *stream)
+{
+	uint32_t val = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver1_reg_offset *tpg_reg = &cam_tpg101_reg;
+
+	if (hw == NULL) {
+		CAM_ERR(CAM_TPG, "invalid argument");
+		return -EINVAL;
+	}
+	soc_info = hw->soc_info;
+
+	CAM_DBG(CAM_TPG, "Configureing vc : %d at the slot : %d num_dts=%d",
+			stream->vc, vc_slot, num_dts);
+	val = ((num_dts - 1) <<
+			tpg_reg->tpg_num_dts_shift_val) | stream->vc;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc_cfg0);
+
+	cam_io_w_mb(stream->hbi,
+			soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc_cfg1);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_common_gen_cfg);
+
+	cam_io_w_mb(stream->vbi,
+			soc_info->reg_map[0].mem_base + tpg_reg->tpg_vbi_cfg);
+
+	return 0;
+}
+
+static int tpg_hw_v_1_0_reset(struct tpg_hw *hw, void *data)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	uint32_t val;
+	struct cam_tpg_ver1_reg_offset *tpg_reg = &cam_tpg101_reg;
+	if (hw == NULL) {
+		CAM_ERR(CAM_TPG, "invalid argument");
+		return -EINVAL;
+	}
+	soc_info = hw->soc_info;
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_ctrl);
+
+	/* Reset the TOP tpg mux sel*/
+	val = cam_io_r_mb(soc_info->reg_map[1].mem_base +
+			tpg_reg->top_mux_reg_offset);
+	val &= ~(1 << hw->hw_idx);
+
+	cam_io_w_mb(val,
+			soc_info->reg_map[1].mem_base + tpg_reg->top_mux_reg_offset);
+	CAM_INFO(CAM_TPG, "TPG:%d Reset Top Mux: 0x%x",
+			hw->hw_idx, val);
+
+	return 0;
+}
+
+int tpg_hw_v_1_0_process_cmd(
+	struct tpg_hw *hw,
+	uint32_t       cmd,
+	void          *arg)
+{
+
+	if (hw == NULL) {
+		CAM_ERR(CAM_TPG, "invalid argument");
+		return -EINVAL;
+	}
+	switch(cmd) {
+	case TPG_CONFIG_VC:
+	{
+		struct vc_config_args *vc_config =
+			(struct vc_config_args *)arg;
+
+		if (vc_config == NULL) {
+			CAM_ERR(CAM_TPG, "invalid argument");
+			return -EINVAL;
+		}
+		configure_vc(hw,
+			vc_config->vc_slot,
+			vc_config->num_dts,
+			vc_config->stream);
+	}
+	break;
+	case TPG_CONFIG_DT:
+	{
+		struct dt_config_args *dt_config =
+			(struct dt_config_args *)arg;
+
+		if (dt_config == NULL) {
+			CAM_ERR(CAM_TPG, "invalid argument");
+			return -EINVAL;
+		}
+		configure_dt(hw,
+			dt_config->vc_slot,
+			dt_config->dt_slot,
+			dt_config->stream);
+	}
+	break;
+	case TPG_CONFIG_CTRL:
+		configure_global_configs(hw, arg);
+	break;
+	default:
+		CAM_ERR(CAM_TPG, "invalid argument");
+		break;
+	}
+	return 0;
+}
+
+int tpg_hw_v_1_0_stop(struct tpg_hw *hw, void *data)
+{
+	CAM_INFO(CAM_TPG, "TPG V1.0 HWL stop");
+	tpg_hw_v_1_0_reset(hw, data);
+	return 0;
+}
+
+int tpg_hw_v_1_0_start(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.3 HWL start");
+	return 0;
+}
+
+int tpg_hw_v_1_0_init(struct tpg_hw *hw, void *data)
+{
+	CAM_INFO(CAM_TPG, "TPG V1.0 HWL init");
+	tpg_hw_v_1_0_reset(hw, data);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_0/tpg_hw_v_1_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_0/tpg_hw_v_1_0.h
@@ -0,0 +1,85 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __TPG_HW_V_1_0_H__
+#define __TPG_HW_V_1_0_H__
+
+#include "../tpg_hw.h"
+
+struct cam_tpg_ver1_reg_offset {
+	uint32_t tpg_hw_version;
+	uint32_t tpg_hw_status;
+	uint32_t tpg_ctrl;
+	uint32_t tpg_vc_cfg0;
+	uint32_t tpg_vc_cfg1;
+	uint32_t tpg_lfsr_seed;
+	uint32_t tpg_dt_0_cfg_0;
+	uint32_t tpg_dt_1_cfg_0;
+	uint32_t tpg_dt_2_cfg_0;
+	uint32_t tpg_dt_3_cfg_0;
+	uint32_t tpg_dt_0_cfg_1;
+	uint32_t tpg_dt_1_cfg_1;
+	uint32_t tpg_dt_2_cfg_1;
+	uint32_t tpg_dt_3_cfg_1;
+	uint32_t tpg_dt_0_cfg_2;
+	uint32_t tpg_dt_1_cfg_2;
+	uint32_t tpg_dt_2_cfg_2;
+	uint32_t tpg_dt_3_cfg_2;
+	uint32_t tpg_color_bar_cfg;
+	uint32_t tpg_common_gen_cfg;
+	uint32_t tpg_vbi_cfg;
+	uint32_t tpg_test_bus_crtl;
+	uint32_t tpg_spare;
+
+	/* configurations */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t tpg_en_shift_val;
+	uint32_t tpg_phy_sel_shift_val;
+	uint32_t tpg_num_active_lines_shift;
+	uint32_t tpg_fe_pkt_en_shift;
+	uint32_t tpg_fs_pkt_en_shift;
+	uint32_t tpg_line_interleaving_mode_shift;
+	uint32_t tpg_num_dts_shift_val;
+	uint32_t tpg_v_blank_cnt_shift;
+	uint32_t tpg_dt_encode_format_shift;
+	uint32_t tpg_payload_mode_color;
+	uint32_t tpg_split_en_shift;
+	uint32_t top_mux_reg_offset;
+};
+
+/**
+ * @brief  : initialize the tpg hw v 1.0
+ *
+ * @param hw: tpg hw instance
+ * @param data: initialize data
+ *
+ * @return : return 0 on success
+ */
+int tpg_hw_v_1_0_init(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief : start tpg hw v 1.0
+ *
+ * @param hw: tpg hw instance
+ * @param data: start argument
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_v_1_0_start(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief : stop tpg hw
+ *
+ * @param hw: tpg hw instance
+ * @param data: arguments to stop tpg hw 1.0
+ *
+ * @return : 0 on success
+ */
+int tpg_hw_v_1_0_stop(struct tpg_hw *hw, void *data);
+
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_0/tpg_hw_v_1_0_data.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_0/tpg_hw_v_1_0_data.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __TPG_HW_V_1_0_DATA_H__
+#define __TPG_HW_V_1_0_DATA_H__
+
+#include "../tpg_hw.h"
+#include "tpg_hw_v_1_0.h"
+
+struct tpg_hw_ops tpg_hw_v_1_0_ops = {
+	.start = tpg_hw_v_1_0_start,
+	.stop  = tpg_hw_v_1_0_stop,
+	.init = tpg_hw_v_1_0_init,
+};
+
+struct tpg_hw_info tpg_v_1_0_hw_info = {
+	.version = TPG_HW_VERSION_1_0,
+	.max_vc_channels = 2,
+	.max_dt_channels_per_vc = 4,
+	.ops = &tpg_hw_v_1_0_ops,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_2/tpg_hw_v_1_2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_2/tpg_hw_v_1_2.c
@@ -0,0 +1,282 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "tpg_hw_v_1_2.h"
+
+/* TPG HW IDs */
+enum cam_tpg_hw_id {
+    CAM_TPG_0 = 13,
+    CAM_TPG_1,
+    CAM_TPG_MAX,
+};
+
+static struct cam_tpg_ver_1_2_reg_offset cam_tpg102_reg = {
+	.tpg_hw_version = 0x0,
+	.tpg_hw_status = 0x4,
+	.tpg_module_cfg = 0x60,
+	.tpg_cfg0 = 0x68,
+	.tpg_cfg1 = 0x6C,
+	.tpg_cfg2 = 0x70,
+	.tpg_cfg3 = 0x74,
+	.tpg_spare = 0x1FC,
+
+	/* configurations */
+	.major_version = 1,
+	.minor_version = 0,
+	.version_incr = 2,
+	.tpg_en_shift = 0,
+	.tpg_hbi_shift = 20,
+	.tpg_dt_shift = 11,
+	.tpg_rotate_period_shift = 5,
+	.tpg_split_en_shift = 4,
+	.top_mux_reg_offset = 0x90,
+	.tpg_mux_sel_tpg_0_shift = 0,
+	.tpg_mux_sel_tpg_1_shift = 8,
+};
+
+static int configure_global_configs(
+	struct tpg_hw *hw,
+	int num_vcs,
+	struct tpg_global_config_t *configs)
+{
+	uint32_t val;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_2_reg_offset *tpg_reg = &cam_tpg102_reg;
+
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	soc_info = hw->soc_info;
+
+	if (num_vcs <= 0) {
+		CAM_ERR(CAM_TPG, "Invalid vc count");
+		return -EINVAL;
+	}
+
+	/* Program number of frames */
+	val = 0xFFFFF;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_cfg3);
+	CAM_DBG(CAM_TPG, "TPG[%d] cfg3=0x%x",
+			hw->hw_idx, val);
+
+	val = cam_io_r_mb(soc_info->reg_map[1].mem_base +
+			tpg_reg->top_mux_reg_offset);
+
+	if (hw->hw_idx == CAM_TPG_0)
+		val |= 1 << tpg_reg->tpg_mux_sel_tpg_0_shift;
+	else if (hw->hw_idx == CAM_TPG_1)
+		val |= 1 << tpg_reg->tpg_mux_sel_tpg_1_shift;
+
+	cam_io_w_mb(val,
+			soc_info->reg_map[1].mem_base + tpg_reg->top_mux_reg_offset);
+	CAM_INFO(CAM_TPG, "TPG[%d] Set CPAS top mux: 0x%x",
+			hw->hw_idx, val);
+
+	val = (1 << tpg_reg->tpg_en_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_module_cfg);
+	CAM_DBG(CAM_TPG, "TPG[%d] tpg_module_cfg=0x%x", hw->hw_idx, val);
+
+	return 0;
+}
+
+static int configure_dt(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	uint32_t       dt_slot,
+	struct tpg_stream_config_t *stream)
+{
+	uint32_t val;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_2_reg_offset *tpg_reg = &cam_tpg102_reg;
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	soc_info = hw->soc_info;
+	CAM_DBG(CAM_TPG, "TPG[%d] slot(%d,%d) <= dt:%d",
+			hw->hw_idx,
+			vc_slot,
+			dt_slot,
+			stream->dt);
+
+	val = (((stream->stream_dimension.width & 0xFFFF) << 16) |
+			(stream->stream_dimension.height & 0xFFFF));
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_cfg0);
+	CAM_DBG(CAM_TPG, "TPG[%d] cfg0=0x%x",
+			hw->hw_idx, val);
+
+	val = stream->dt << tpg_reg->tpg_dt_shift;
+	cam_io_w_mb(val,
+			soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_cfg2);
+	CAM_DBG(CAM_TPG, "TPG[%d] cfg2=0x%x",
+			hw->hw_idx, val);
+
+	return 0;
+}
+
+static int configure_vc(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	int            num_dts,
+	struct tpg_stream_config_t *stream)
+{
+	uint32_t val = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_2_reg_offset *tpg_reg = &cam_tpg102_reg;
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	soc_info = hw->soc_info;
+	if (stream->cb_mode == TPG_COLOR_BAR_MODE_SPLIT)
+		val |= (1 << tpg_reg->tpg_split_en_shift);
+
+	CAM_DBG(CAM_TPG, "TPG[%d] period: %d", hw->hw_idx, stream->rotate_period);
+	val |= ((stream->rotate_period & 0x3F) <<
+			tpg_reg->tpg_rotate_period_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_cfg2);
+	CAM_DBG(CAM_TPG, "TPG[%d] cfg2=0x%x",
+			hw->hw_idx, val);
+
+	val = stream->hbi << tpg_reg->tpg_hbi_shift | stream->vbi;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_cfg1);
+	CAM_DBG(CAM_TPG, "TPG[%d] cfg1=0x%x",
+			hw->hw_idx, val);
+
+	return 0;
+}
+
+static int tpg_hw_v_1_2_reset(
+	struct tpg_hw *hw, void *data)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	uint32_t val;
+	struct cam_tpg_ver_1_2_reg_offset *tpg_reg = &cam_tpg102_reg;
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	soc_info = hw->soc_info;
+
+	/* Clear out tpg_module_cfg before reset */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base + tpg_reg->tpg_module_cfg);
+
+	/* Read the version */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_hw_version);
+	CAM_INFO(CAM_TPG, "TPG[%d] TPG HW version: 0x%x started",
+			hw->hw_idx, val);
+	return 0;
+}
+
+int tpg_hw_v_1_2_process_cmd(
+	struct tpg_hw *hw,
+	uint32_t       cmd,
+	void          *arg)
+{
+	int rc = 0;
+	if (hw == NULL) {
+		CAM_ERR(CAM_TPG, "invalid argument");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_TPG, "TPG[%d] Cmd opcode:0x%x", hw->hw_idx, cmd);
+	switch(cmd) {
+	case TPG_CONFIG_VC:
+	{
+		struct vc_config_args *vc_config =
+			(struct vc_config_args *)arg;
+
+		if (vc_config == NULL) {
+			CAM_ERR(CAM_TPG, "invalid argument");
+			return -EINVAL;
+		}
+		rc = configure_vc(hw,
+			vc_config->vc_slot,
+			vc_config->num_dts,
+			vc_config->stream);
+	}
+	break;
+	case TPG_CONFIG_DT:
+	{
+		struct dt_config_args *dt_config =
+			(struct dt_config_args *)arg;
+
+		if (dt_config == NULL) {
+			CAM_ERR(CAM_TPG, "invalid argument");
+			return -EINVAL;
+		}
+		rc = configure_dt(hw,
+			dt_config->vc_slot,
+			dt_config->dt_slot,
+			dt_config->stream);
+	}
+	break;
+	case TPG_CONFIG_CTRL:
+	{
+		struct global_config_args *global_args =
+			(struct global_config_args *)arg;
+		rc = configure_global_configs(hw,
+				global_args->num_vcs,
+				global_args->globalconfig);
+	}
+	break;
+	default:
+		CAM_ERR(CAM_TPG, "invalid argument");
+		break;
+	}
+	return rc;
+}
+
+int tpg_hw_v_1_2_start(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.2 HWL start");
+	return 0;
+}
+
+int tpg_hw_v_1_2_stop(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.2 HWL stop");
+	tpg_hw_v_1_2_reset(hw, data);
+	return 0;
+}
+
+int tpg_hw_v_1_2_dump_status(struct tpg_hw *hw, void *data)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	uint32_t val;
+	struct cam_tpg_ver_1_2_reg_offset *tpg_reg = &cam_tpg102_reg;
+
+	if (!hw) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	soc_info = hw->soc_info;
+	CAM_DBG(CAM_TPG, "TPG V1.2 HWL status dump");
+	/* Read the version */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_hw_status);
+	CAM_INFO(CAM_TPG, "TPG[%d] TPG HW status: 0x%x started",
+			hw->hw_idx, val);
+
+	return 0;
+}
+
+int tpg_hw_v_1_2_init(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.2 HWL init");
+	tpg_hw_v_1_2_reset(hw, data);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_2/tpg_hw_v_1_2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_2/tpg_hw_v_1_2.h
@@ -0,0 +1,89 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __TPG_HW_V_1_2_H__
+#define __TPG_HW_V_1_2_H__
+
+#include "../tpg_hw.h"
+
+struct cam_tpg_ver_1_2_reg_offset {
+	uint32_t tpg_hw_version;
+	uint32_t tpg_hw_status;
+	uint32_t tpg_module_cfg;
+	uint32_t tpg_cfg0;
+	uint32_t tpg_cfg1;
+	uint32_t tpg_cfg2;
+	uint32_t tpg_cfg3;
+	uint32_t tpg_spare;
+
+	/* configurations */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t tpg_en_shift;
+	uint32_t tpg_hbi_shift;
+	uint32_t tpg_dt_shift;
+	uint32_t tpg_rotate_period_shift;
+	uint32_t tpg_split_en_shift;
+	uint32_t top_mux_reg_offset;
+	uint32_t tpg_mux_sel_tpg_0_shift;
+	uint32_t tpg_mux_sel_tpg_1_shift;
+};
+
+
+/**
+ * @brief initialize the tpg hw instance
+ *
+ * @param hw   : tpg hw instance
+ * @param data : argument for initialize
+ *
+ * @return     : 0 on success
+ */
+int tpg_hw_v_1_2_init(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief start tpg hw
+ *
+ * @param hw    : tpg hw instance
+ * @param data  : tpg hw instance data
+ *
+ * @return      : 0 on success
+ */
+int tpg_hw_v_1_2_start(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief stop tpg hw
+ *
+ * @param hw   : tpg hw instance
+ * @param data : argument for tpg hw stop
+ *
+ * @return     : 0 on success
+ */
+int tpg_hw_v_1_2_stop(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief process a command send from hw layer
+ *
+ * @param hw  : tpg hw instance
+ * @param cmd : command to process
+ * @param arg : argument corresponding to command
+ *
+ * @return    : 0 on success
+ */
+int tpg_hw_v_1_2_process_cmd(struct tpg_hw *hw,
+		uint32_t cmd, void *arg);
+
+/**
+ * @brief  dump hw status registers
+ *
+ * @param hw   : tpg hw instance
+ * @param data : argument for status dump
+ *
+ * @return     : 0 on sucdess
+ */
+int tpg_hw_v_1_2_dump_status(struct tpg_hw *hw, void *data);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_2/tpg_hw_v_1_2_data.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_2/tpg_hw_v_1_2_data.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __TPG_HW_V_1_2_DATA_H__
+#define __TPG_HW_V_1_2_DATA_H__
+
+#include "../tpg_hw.h"
+#include "tpg_hw_v_1_2.h"
+
+struct tpg_hw_ops tpg_hw_v_1_2_ops = {
+	.start = tpg_hw_v_1_2_start,
+	.stop  = tpg_hw_v_1_2_stop,
+	.init = tpg_hw_v_1_2_init,
+	.process_cmd = tpg_hw_v_1_2_process_cmd,
+	.dump_status = tpg_hw_v_1_2_dump_status,
+};
+
+struct tpg_hw_info tpg_v_1_2_hw_info = {
+	.version = TPG_HW_VERSION_1_2,
+	.max_vc_channels = 1,
+	.max_dt_channels_per_vc = 1,
+	.ops = &tpg_hw_v_1_2_ops,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3.c
@@ -0,0 +1,890 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "tpg_hw_v_1_3.h"
+
+enum tpg_hw_v_1_3_encode_fomat_t {
+	RAW_8_BIT = 1,
+	RAW_10_BIT,
+	RAW_12_BIT,
+	RAW_14_BIT,
+	RAW_16_BIT
+};
+
+
+#define  FRAME_INTERLEAVE           0x0
+#define  LINE_INTERLEAVE            0x1
+#define  SHDR_INTERLEAVE            0x2
+#define  SPARSE_PD_INTERLEAVE       0x3
+#define  CFA_PATTERN_ROW_WIDTH      8
+#define  CFA_PATTERN_BITS_PER_INDEX 2
+#define  Invalid 0x0
+#define  Red     0x0
+#define  Green   0x1
+#define  Blue    0x2
+#define  IR      0x3
+#define  Mono    0x3
+
+static int get_tpg_vc_dt_pattern_id(
+		enum tpg_interleaving_format_t vc_dt_pattern)
+{
+	switch (vc_dt_pattern) {
+	case TPG_INTERLEAVING_FORMAT_INVALID:
+	case TPG_INTERLEAVING_FORMAT_MAX:
+	case TPG_INTERLEAVING_FORMAT_FRAME:
+		return FRAME_INTERLEAVE;
+	case TPG_INTERLEAVING_FORMAT_LINE:
+		return LINE_INTERLEAVE;
+	case TPG_INTERLEAVING_FORMAT_SHDR:
+		return SHDR_INTERLEAVE;
+	case TPG_INTERLEAVING_FORMAT_SPARSE_PD:
+		return SPARSE_PD_INTERLEAVE;
+
+	}
+	return FRAME_INTERLEAVE;
+}
+
+static int configure_global_configs(
+	struct tpg_hw *hw,
+	int num_vcs,
+	struct tpg_global_config_t *configs)
+{
+	uint32_t val, phy_type = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_3_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	tpg_reg  = hw->hw_info->hw_data;
+	soc_info = hw->soc_info;
+
+	if (configs->phy_type == TPG_PHY_TYPE_CPHY)
+		phy_type = 1;
+
+	if (num_vcs <= 0) {
+		CAM_ERR(CAM_TPG, "Invalid vc count");
+		return -EINVAL;
+	}
+
+	val = configs->skip_pattern;
+	cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_throttle);
+	CAM_DBG(CAM_TPG, "tpg[%d] throttle=0x%x", hw->hw_idx, val);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_top_irq_mask);
+
+
+	val = ((num_vcs - 1) <<
+			(tpg_reg->tpg_num_active_vcs_shift) |
+			(configs->lane_count - 1) <<
+			tpg_reg->tpg_num_active_lanes_shift) |
+		get_tpg_vc_dt_pattern_id(configs->interleaving_format) <<
+		(tpg_reg->tpg_vc_dt_pattern_id_shift) |
+		(phy_type << tpg_reg->tpg_cphy_dphy_sel_shift_val) |
+		(1 << tpg_reg->tpg_en_shift_val);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+	CAM_DBG(CAM_TPG, "tpg[%d] tpg_ctrl=0x%x", hw->hw_idx, val);
+	return 0;
+}
+
+static int get_tpg_encode_format(int sw_encode_format)
+{
+	switch (sw_encode_format) {
+	case PACK_8_BIT:
+		return RAW_8_BIT;
+	case PACK_10_BIT:
+		return RAW_10_BIT;
+	case PACK_12_BIT:
+		return RAW_12_BIT;
+	case PACK_14_BIT:
+		return RAW_14_BIT;
+	case PACK_16_BIT:
+		return RAW_16_BIT;
+	}
+	return RAW_8_BIT;
+}
+
+#define  INCREMENTING       0x0
+#define  ALTERNATING_55_AA  0x1
+#define  RANDOM             0x4
+#define  USER_SPECIFIED     0x5
+#define  COLOR_BARS         0x8
+
+static int get_tpg_payload_mode(enum tpg_pattern_t pattern)
+{
+	switch (pattern) {
+	case TPG_PATTERN_INVALID:
+	case TPG_PATTERN_REAL_IMAGE:
+	case TPG_PATTERN_COLOR_BAR:
+		return COLOR_BARS;
+	case TPG_PATTERN_RANDOM_PIXL:
+	case TPG_PATTERN_RANDOM_INCREMENTING_PIXEL:
+		return RANDOM;
+	case TPG_PATTERN_ALTERNATING_55_AA:
+		return ALTERNATING_55_AA;
+	case TPG_PATTERN_ALTERNATING_USER_DEFINED:
+		return USER_SPECIFIED;
+	default:
+		return COLOR_BARS;
+	}
+	return COLOR_BARS;
+}
+
+static int get_pixel_coordinate(
+	int cfa_pattern_start_index,
+	int cfa_pattern_end_index,
+	uint32_t *val,
+	struct tpg_stream_config_v3_t *configs)
+{
+	uint32_t shift = 0;
+	int idx = 0;
+	int i = 0;
+	int j = 0;
+	*val = 0;
+	for (i = cfa_pattern_start_index; i < cfa_pattern_end_index; i++) {
+		for (j = 0; j < configs->cfa_info.pattern_width; j++) {
+			shift = ((i * CFA_PATTERN_ROW_WIDTH) + j) *
+				CFA_PATTERN_BITS_PER_INDEX;
+			idx = i * configs->cfa_info.pattern_height + j;
+			*val |= (configs->cfa_info.pixel_coordinate[idx].pixel_type) << shift;
+		}
+	}
+	return 0;
+}
+
+static int configure_xcfa_array_v3(
+	struct tpg_hw *hw,
+	struct tpg_stream_config_v3_t *configs)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_3_reg_offset *tpg_reg = NULL;
+	uint32_t val = 0;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+	switch (configs->xcfa_type) {
+	case XCFA_TYPE_RGBIR:
+		get_pixel_coordinate(0, 2, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		get_pixel_coordinate(2, configs->cfa_info.pattern_height, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		break;
+	case XCFA_TYPE_QUADCFA:
+		get_pixel_coordinate(0, 2, &val, configs);
+		CAM_DBG(CAM_TPG, "val = 0x%x", val);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		get_pixel_coordinate(2, configs->cfa_info.pattern_height, &val, configs);
+		CAM_DBG(CAM_TPG, "val = 0x%x", val);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		break;
+	case XCFA_TYPE_THREEXTHREECFA:
+		get_pixel_coordinate(0, 2, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		get_pixel_coordinate(2, 4, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		get_pixel_coordinate(4, configs->cfa_info.pattern_height, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color2);
+		break;
+	case XCFA_TYPE_FOURXFOURCFA:
+		get_pixel_coordinate(0, 2, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		get_pixel_coordinate(2, 4, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		get_pixel_coordinate(4, 6, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color2);
+		get_pixel_coordinate(6, configs->cfa_info.pattern_height, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color3);
+		break;
+	default:
+		break;
+	}
+	return 0;
+}
+
+static int configure_dt_v3(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	uint32_t       dt_slot,
+	struct tpg_stream_config_v3_t *stream)
+{
+	uint32_t val;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_3_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+	CAM_DBG(CAM_TPG, "TPG[%d] slot(%d,%d) <= dt:%d",
+			hw->hw_idx,
+			vc_slot,
+			dt_slot,
+			stream->dt);
+
+	val = (((stream->stream_dimension.width & 0xFFFF) << 16) |
+			(stream->stream_dimension.height & 0xFFFF));
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_0 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_0=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, val);
+
+	cam_io_w_mb(stream->dt,
+			soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_1 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_1=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, stream->dt);
+
+	val = ((get_tpg_encode_format(stream->pixel_depth) & 0xF) <<
+			tpg_reg->tpg_dt_encode_format_shift) |
+			get_tpg_payload_mode(stream->pattern_type);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_2 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_2=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, val);
+
+	return 0;
+}
+
+static int configure_dt(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	uint32_t       dt_slot,
+	struct tpg_stream_config_t *stream)
+{
+	uint32_t val;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_3_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+	CAM_DBG(CAM_TPG, "TPG[%d] slot(%d,%d) <= dt:%d",
+			hw->hw_idx,
+			vc_slot,
+			dt_slot,
+			stream->dt);
+
+	val = (((stream->stream_dimension.width & 0xFFFF) << 16) |
+			(stream->stream_dimension.height & 0xFFFF));
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_0 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_0=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, val);
+
+	cam_io_w_mb(stream->dt,
+			soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_1 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_1=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, stream->dt);
+
+	val = ((get_tpg_encode_format(stream->pixel_depth) & 0xF) <<
+			tpg_reg->tpg_dt_encode_format_shift) |
+		get_tpg_payload_mode(stream->pattern_type);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_2 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_2=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, val);
+
+	return 0;
+}
+
+
+
+#define VC1_GAIN   0x100
+
+static int configure_vc_v3(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	int            num_dts,
+	struct tpg_stream_config_v3_t *stream)
+{
+	uint32_t val = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_3_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+	/* Use CFA pattern here */
+	if (stream->output_format == TPG_IMAGE_FORMAT_QCFA)
+		val |= (1 << tpg_reg->tpg_color_bar_qcfa_en_shift);
+
+	if (stream->cb_mode == TPG_COLOR_BAR_MODE_SPLIT)
+		val |= (1 << tpg_reg->tpg_split_en_shift);
+
+	if (stream->cfa_info_exist != 0) {
+		val |= ((stream->cfa_info.pattern_height - 1) << tpg_reg->tpg_size_y_shift);
+		val |= ((stream->cfa_info.pattern_width - 1) << tpg_reg->tpg_size_x_shift);
+		val |= (1 << tpg_reg->tpg_xcfa_en_shift);
+		configure_xcfa_array_v3(hw, stream);
+	}
+
+	CAM_DBG(CAM_TPG, "TPG[%d] period: %d", hw->hw_idx, stream->rotate_period);
+	val |= ((stream->rotate_period & 0x3F) <<
+			tpg_reg->tpg_color_bar_qcfa_rotate_period_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_color_bar_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_color_bar_cfg=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->hbi;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_hbi_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_hbi_cfg=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->vbi;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_vbi_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_vbi_cgf=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	cam_io_w_mb(0x12345678,
+		soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_vc0_lfsr_seed + (0x60 * vc_slot));
+
+	val = ((0 << tpg_reg->tpg_num_frames_shift_val) |
+		((num_dts-1) <<	 tpg_reg->tpg_num_dts_shift_val) |
+		stream->vc);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_cfg0 + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_cfg0=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+	if (hw->hw_info->shdr_overlap == 1) {
+		cam_io_w_mb(hw->hw_info->shdr_overlap << tpg_reg->tpg_overlap_shdr_en_shift,
+			soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+	}
+	if (hw->hw_info->shdr_offset_num_batch >= 0 && vc_slot > 0)	{
+		val =  (VC1_GAIN << tpg_reg->tpg_gain_shift);
+		val |= (hw->hw_info->shdr_offset_num_batch <<
+				tpg_reg->tpg_shdr_offset_num_batch_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+					tpg_reg->tpg_vc1_gain_cfg + (0x60 * (vc_slot-1)));
+		val =  ((stream->shdr_line_offset0 * vc_slot)
+			<< tpg_reg->tpg_shdr_line_offset0_shift);
+		val |= ((stream->shdr_line_offset1 * vc_slot)
+			<< tpg_reg->tpg_shdr_line_offset1_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc1_shdr_cfg + (0x60 * (vc_slot-1)));
+		CAM_DBG(CAM_TPG, "TPG[%d] vc%d_cfg0=0x%x shdr",
+			hw->hw_idx,
+			vc_slot, val);
+	}
+
+	return 0;
+}
+
+#define RGGB_IR_0  0x00770091
+#define RGGB_IR_1  0x00770019
+#define RGGB_2x2   0x05055A5A
+#define RGGB_3x3_0 0x05400540
+#define RGGB_3x3_1 0x0a950540
+#define RGGB_3x3_2 0x0a950a95
+#define RGGB_4x4_0 0x55005500
+#define RGGB_4x4_1 0x55005500
+#define RGGB_4x4_2 0xaa55aa55
+#define RGGB_4x4_3 0xaa55aa55
+#define VC1_GAIN   0x100
+
+static int configure_xcfa_array(struct tpg_hw *hw, int config)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_3_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+	switch (config) {
+	case 1:
+		cam_io_w_mb(RGGB_IR_0,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		cam_io_w_mb(RGGB_IR_1,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		break;
+	case 2:
+		cam_io_w_mb(RGGB_2x2,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		break;
+	case 3:
+		cam_io_w_mb(RGGB_3x3_0,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		cam_io_w_mb(RGGB_3x3_1,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		cam_io_w_mb(RGGB_3x3_2,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color2);
+		break;
+	case 4:
+		cam_io_w_mb(RGGB_4x4_0,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		cam_io_w_mb(RGGB_4x4_1,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		cam_io_w_mb(RGGB_4x4_2,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color2);
+		cam_io_w_mb(RGGB_4x4_3,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color3);
+		break;
+	break;
+
+	}
+	return 0;
+}
+
+static int configure_vc(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	int            num_dts,
+	struct tpg_stream_config_t *stream)
+{
+	uint32_t val = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_3_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+	/* Use CFA pattern here */
+	if (stream->output_format == TPG_IMAGE_FORMAT_QCFA)
+		val |= (1 << tpg_reg->tpg_color_bar_qcfa_en_shift);
+
+	if (stream->cb_mode == TPG_COLOR_BAR_MODE_SPLIT)
+		val |= (1 << tpg_reg->tpg_split_en_shift);
+
+	if (stream->xcfa_debug > 0) {
+		if (stream->xcfa_debug == 1) {
+			val |= (3 << tpg_reg->tpg_size_y_shift);
+			val |= (3 << tpg_reg->tpg_size_x_shift);
+		} else {
+			val |= ((stream->xcfa_debug * 2 - 1) << tpg_reg->tpg_size_y_shift);
+			val |= ((stream->xcfa_debug * 2 - 1) << tpg_reg->tpg_size_x_shift);
+		}
+		val |= (1 << tpg_reg->tpg_xcfa_en_shift);
+		configure_xcfa_array(hw, stream->xcfa_debug);
+		CAM_DBG(CAM_TPG, "xcfa_debug = %d", stream->xcfa_debug);
+	}
+
+	CAM_DBG(CAM_TPG, "TPG[%d] period: %d", hw->hw_idx, stream->rotate_period);
+	val |= ((stream->rotate_period & 0x3F) <<
+			tpg_reg->tpg_color_bar_qcfa_rotate_period_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_color_bar_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_color_bar_cfg=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->hbi;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_hbi_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_hbi_cfg=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->vbi;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_vbi_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_vbi_cgf=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	cam_io_w_mb(0x12345678,
+		soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_vc0_lfsr_seed + (0x60 * vc_slot));
+
+	val = ((0 << tpg_reg->tpg_num_frames_shift_val) |
+		((num_dts-1) << tpg_reg->tpg_num_dts_shift_val) |
+		stream->vc);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_cfg0 + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_cfg0=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+	if (hw->hw_info->shdr_overlap == 1) {
+		cam_io_w_mb(hw->hw_info->shdr_overlap << tpg_reg->tpg_overlap_shdr_en_shift,
+			soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+	}
+	if (hw->hw_info->shdr_offset_num_batch >= 0 && vc_slot > 0) {
+		val =  (VC1_GAIN << tpg_reg->tpg_gain_shift);
+		val |= (hw->hw_info->shdr_offset_num_batch <<
+				tpg_reg->tpg_shdr_offset_num_batch_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+					tpg_reg->tpg_vc1_gain_cfg + (0x60 * (vc_slot-1)));
+		val =  ((stream->shdr_line_offset0 * vc_slot)
+			<< tpg_reg->tpg_shdr_line_offset0_shift);
+		val |= ((stream->shdr_line_offset1 * vc_slot)
+			<< tpg_reg->tpg_shdr_line_offset1_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc1_shdr_cfg + (0x60 * (vc_slot-1)));
+		CAM_DBG(CAM_TPG, "TPG[%d] vc%d_cfg0=0x%x shdr",
+			hw->hw_idx,
+			vc_slot, val);
+	}
+	return 0;
+}
+
+static int tpg_hw_v_1_3_reset(
+	struct tpg_hw *hw, void *data)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	uint32_t val;
+	struct cam_tpg_ver_1_3_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+	/* Clear out tpg_ctrl and irqs before reset */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_top_irq_mask);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_top_irq_clear);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_top_irq_cmd);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_top_clear);
+
+	/* Read the version */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_hw_version);
+	CAM_INFO(CAM_TPG, "TPG[%d] TPG HW version: 0x%x started",
+			hw->hw_idx, val);
+	return 0;
+}
+
+int tpg_hw_v_1_3_process_cmd(
+	struct tpg_hw *hw,
+	uint32_t       cmd,
+	void          *arg)
+{
+	int rc = 0;
+	if (hw == NULL) {
+		CAM_ERR(CAM_TPG, "invalid argument");
+		return -EINVAL;
+	}
+	switch(cmd) {
+	case TPG_CONFIG_VC:
+	{
+		if (hw->stream_version == 1) {
+			struct vc_config_args *vc_config =
+				(struct vc_config_args *)arg;
+
+			if (vc_config == NULL) {
+				CAM_ERR(CAM_TPG, "invalid argument");
+				return -EINVAL;
+			}
+			rc = configure_vc(hw,
+				vc_config->vc_slot,
+				vc_config->num_dts,
+				vc_config->stream);
+		} else if (hw->stream_version == 3) {
+			struct vc_config_args_v3 *vc_config_v3 =
+				(struct vc_config_args_v3 *)arg;
+
+			if (vc_config_v3 == NULL) {
+				CAM_ERR(CAM_TPG, "invalid argument");
+				return -EINVAL;
+			}
+			rc = configure_vc_v3(hw,
+				vc_config_v3->vc_slot,
+				vc_config_v3->num_dts,
+				vc_config_v3->stream);
+		}
+	}
+	break;
+	case TPG_CONFIG_DT:
+	{
+		if (hw->stream_version == 1) {
+			struct dt_config_args *dt_config =
+				(struct dt_config_args *)arg;
+
+			if (dt_config == NULL) {
+				CAM_ERR(CAM_TPG, "invalid argument");
+				return -EINVAL;
+			}
+			rc = configure_dt(hw,
+				dt_config->vc_slot,
+				dt_config->dt_slot,
+				dt_config->stream);
+		} else if (hw->stream_version == 3) {
+			struct dt_config_args_v3 *dt_config_v3 =
+				(struct dt_config_args_v3 *)arg;
+
+			if (dt_config_v3 == NULL) {
+				CAM_ERR(CAM_TPG, "invalid argument");
+				return -EINVAL;
+			}
+			rc = configure_dt_v3(hw,
+				dt_config_v3->vc_slot,
+				dt_config_v3->dt_slot,
+				dt_config_v3->stream);
+		}
+	}
+	break;
+	case TPG_CONFIG_CTRL:
+	{
+		struct global_config_args *global_args =
+			(struct global_config_args *)arg;
+		rc = configure_global_configs(hw,
+				global_args->num_vcs,
+				global_args->globalconfig);
+	}
+	break;
+	default:
+		CAM_ERR(CAM_TPG, "invalid argument");
+		break;
+	}
+	return rc;
+}
+
+int tpg_hw_v_1_3_start(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.3 HWL start");
+	return 0;
+}
+
+int tpg_hw_v_1_3_stop(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.3 HWL stop");
+	tpg_hw_v_1_3_reset(hw, data);
+	return 0;
+}
+
+int tpg_hw_v_1_3_dump_status(struct tpg_hw *hw, void *data)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	uint32_t val;
+	struct cam_tpg_ver_1_3_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+	CAM_DBG(CAM_TPG, "TPG V1.3 HWL status dump");
+	/* Read the version */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_hw_status);
+	CAM_INFO(CAM_TPG, "TPG[%d] TPG HW status: 0x%x started",
+			hw->hw_idx, val);
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_top_irq_status);
+	CAM_INFO(CAM_TPG, "TPG[%d] TPG HW irq status: 0x%x started",
+			hw->hw_idx, val);
+
+	return 0;
+}
+
+int tpg_hw_v_1_3_init(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.3 HWL init");
+	tpg_hw_v_1_3_reset(hw, data);
+	return 0;
+}
+
+static int tpg_1_3_get_xcfa_test(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get xcfa test %d", hw->hw_info->xcfa_debug);
+	*val = hw->hw_info->xcfa_debug;
+	return 0;
+}
+static int tpg_1_3_get_shdr_overlap_test(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get shdr test : %d", hw->hw_info->shdr_overlap);
+	*val = hw->hw_info->shdr_overlap;
+	return 0;
+}
+static int tpg_1_3_get_shdr_offset_num_batch(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get shdr_num_batch : %d", hw->hw_info->shdr_offset_num_batch);
+	*val = hw->hw_info->shdr_offset_num_batch;
+	return 0;
+}
+static int tpg_1_3_get_shdr_line_offset0(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get shdr_offset0 : %d", hw->hw_info->shdr_line_offset0);
+	*val = hw->hw_info->shdr_line_offset0;
+	return 0;
+}
+static int tpg_1_3_get_shdr_line_offset1(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get shdr_offset1 : %d", hw->hw_info->shdr_line_offset1);
+	*val = hw->hw_info->shdr_line_offset1;
+	return 0;
+}
+
+
+static int tpg_1_3_set_xcfa_test(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set xcfa test prev : %d", hw->hw_info->xcfa_debug);
+	hw->hw_info->xcfa_debug = val;
+	return 0;
+}
+static int tpg_1_3_set_shdr_overlap_test(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set shdr test prev : %d", hw->hw_info->shdr_overlap);
+	hw->hw_info->shdr_overlap = val;
+	return 0;
+}
+static int tpg_1_3_set_shdr_offset_num_batch(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set shdr_num_batch : %d", hw->hw_info->shdr_offset_num_batch);
+	hw->hw_info->shdr_offset_num_batch = val;
+	return 0;
+}
+static int tpg_1_3_set_shdr_line_offset0(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set shdr_offset0 : %d", hw->hw_info->shdr_line_offset0);
+	hw->hw_info->shdr_line_offset0 = val;
+	return 0;
+}
+static int tpg_1_3_set_shdr_line_offset1(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set shdr_offset1 : %d", hw->hw_info->shdr_line_offset1);
+	hw->hw_info->shdr_line_offset1 = val;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_3_xcfa_test,
+		&tpg_1_3_get_xcfa_test,
+		&tpg_1_3_set_xcfa_test,
+		"%16d");
+
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_3_shdr_overlap_test,
+		&tpg_1_3_get_shdr_overlap_test,
+		&tpg_1_3_set_shdr_overlap_test,
+		"%16d");
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_3_shdr_offset_num_batch,
+		&tpg_1_3_get_shdr_offset_num_batch,
+		&tpg_1_3_set_shdr_offset_num_batch,
+		"%16d");
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_3_shdr_line_offset0,
+		&tpg_1_3_get_shdr_line_offset0,
+		&tpg_1_3_set_shdr_line_offset0,
+		"%16d");
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_3_shdr_line_offset1,
+		&tpg_1_3_get_shdr_line_offset1,
+		&tpg_1_3_set_shdr_line_offset1,
+		"%16d");
+
+
+int tpg_1_3_layer_init(struct tpg_hw *hw)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr_parent = NULL;
+	char dir_name[160];
+
+	snprintf(dir_name, sizeof(dir_name), "tpg%d",
+		hw->hw_idx);
+
+	dbgfileptr_parent = debugfs_create_dir(dir_name, NULL);
+	if (!dbgfileptr_parent) {
+		CAM_ERR(CAM_TPG, "Debug fs could not create directory");
+		rc = -ENOENT;
+	}
+	debugfs_create_file("tpg_xcfa_test", 0644,
+		dbgfileptr_parent, hw, &tpg_1_3_xcfa_test);
+	debugfs_create_file("tpg_shdr_overlap_test", 0644,
+		dbgfileptr_parent, hw, &tpg_1_3_shdr_overlap_test);
+	debugfs_create_file("tpg_shdr_offset_num_batch", 0644,
+		dbgfileptr_parent, hw, &tpg_1_3_shdr_offset_num_batch);
+	debugfs_create_file("tpg_shdr_line_offset0", 0644,
+		dbgfileptr_parent, hw, &tpg_1_3_shdr_line_offset0);
+	debugfs_create_file("tpg_shdr_line_offset1", 0644,
+		dbgfileptr_parent, hw, &tpg_1_3_shdr_line_offset1);
+	CAM_INFO(CAM_TPG, "Layer init called");
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3.h
@@ -0,0 +1,208 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __TPG_HW_V_1_3_H__
+#define __TPG_HW_V_1_3_H__
+
+#include "../tpg_hw.h"
+
+struct cam_tpg_ver_1_3_reg_offset {
+	uint32_t tpg_hw_version;
+	uint32_t tpg_hw_status;
+	uint32_t tpg_ctrl;
+	uint32_t tpg_vc0_gain_cfg;
+	uint32_t tpg_vc0_cfg0;
+	uint32_t tpg_vc0_lfsr_seed;
+	uint32_t tpg_vc0_hbi_cfg;
+	uint32_t tpg_vc0_vbi_cfg;
+	uint32_t tpg_vc0_color_bar_cfg;
+	uint32_t tpg_vc0_dt_0_cfg_0;
+	uint32_t tpg_vc0_dt_0_cfg_1;
+	uint32_t tpg_vc0_dt_0_cfg_2;
+	uint32_t tpg_vc0_dt_1_cfg_0;
+	uint32_t tpg_vc0_dt_1_cfg_1;
+	uint32_t tpg_vc0_dt_1_cfg_2;
+	uint32_t tpg_vc0_dt_2_cfg_0;
+	uint32_t tpg_vc0_dt_2_cfg_1;
+	uint32_t tpg_vc0_dt_2_cfg_2;
+	uint32_t tpg_vc0_dt_3_cfg_0;
+	uint32_t tpg_vc0_dt_3_cfg_1;
+	uint32_t tpg_vc0_dt_3_cfg_2;
+	uint32_t tpg_vc0_color_bar_cfa_color0;
+	uint32_t tpg_vc0_color_bar_cfa_color1;
+	uint32_t tpg_vc0_color_bar_cfa_color2;
+	uint32_t tpg_vc0_color_bar_cfa_color3;
+
+	uint32_t tpg_vc1_gain_cfg;
+	uint32_t tpg_vc1_shdr_cfg;
+	uint32_t tpg_vc1_cfg0;
+	uint32_t tpg_vc1_lfsr_seed;
+	uint32_t tpg_vc1_hbi_cfg;
+	uint32_t tpg_vc1_vbi_cfg;
+	uint32_t tpg_vc1_color_bar_cfg;
+	uint32_t tpg_vc1_dt_0_cfg_0;
+	uint32_t tpg_vc1_dt_0_cfg_1;
+	uint32_t tpg_vc1_dt_0_cfg_2;
+	uint32_t tpg_vc1_dt_1_cfg_0;
+	uint32_t tpg_vc1_dt_1_cfg_1;
+	uint32_t tpg_vc1_dt_1_cfg_2;
+	uint32_t tpg_vc1_dt_2_cfg_0;
+	uint32_t tpg_vc1_dt_2_cfg_1;
+	uint32_t tpg_vc1_dt_2_cfg_2;
+	uint32_t tpg_vc1_dt_3_cfg_0;
+	uint32_t tpg_vc1_dt_3_cfg_1;
+	uint32_t tpg_vc1_dt_3_cfg_2;
+	uint32_t tpg_vc1_color_bar_cfa_color0;
+	uint32_t tpg_vc1_color_bar_cfa_color1;
+	uint32_t tpg_vc1_color_bar_cfa_color2;
+	uint32_t tpg_vc1_color_bar_cfa_color3;
+
+	uint32_t tpg_vc2_gain_cfg;
+	uint32_t tpg_vc2_shdr_cfg;
+	uint32_t tpg_vc2_cfg0;
+	uint32_t tpg_vc2_lfsr_seed;
+	uint32_t tpg_vc2_hbi_cfg;
+	uint32_t tpg_vc2_vbi_cfg;
+	uint32_t tpg_vc2_color_bar_cfg;
+	uint32_t tpg_vc2_dt_0_cfg_0;
+	uint32_t tpg_vc2_dt_0_cfg_1;
+	uint32_t tpg_vc2_dt_0_cfg_2;
+	uint32_t tpg_vc2_dt_1_cfg_0;
+	uint32_t tpg_vc2_dt_1_cfg_1;
+	uint32_t tpg_vc2_dt_1_cfg_2;
+	uint32_t tpg_vc2_dt_2_cfg_0;
+	uint32_t tpg_vc2_dt_2_cfg_1;
+	uint32_t tpg_vc2_dt_2_cfg_2;
+	uint32_t tpg_vc2_dt_3_cfg_0;
+	uint32_t tpg_vc2_dt_3_cfg_1;
+	uint32_t tpg_vc2_dt_3_cfg_2;
+	uint32_t tpg_vc2_color_bar_cfa_color0;
+	uint32_t tpg_vc2_color_bar_cfa_color1;
+	uint32_t tpg_vc2_color_bar_cfa_color2;
+	uint32_t tpg_vc2_color_bar_cfa_color3;
+
+	uint32_t tpg_vc3_gain_cfg;
+	uint32_t tpg_vc3_shdr_cfg;
+	uint32_t tpg_vc3_cfg0;
+	uint32_t tpg_vc3_lfsr_seed;
+	uint32_t tpg_vc3_hbi_cfg;
+	uint32_t tpg_vc3_vbi_cfg;
+	uint32_t tpg_vc3_color_bar_cfg;
+	uint32_t tpg_vc3_dt_0_cfg_0;
+	uint32_t tpg_vc3_dt_0_cfg_1;
+	uint32_t tpg_vc3_dt_0_cfg_2;
+	uint32_t tpg_vc3_dt_1_cfg_0;
+	uint32_t tpg_vc3_dt_1_cfg_1;
+	uint32_t tpg_vc3_dt_1_cfg_2;
+	uint32_t tpg_vc3_dt_2_cfg_0;
+	uint32_t tpg_vc3_dt_2_cfg_1;
+	uint32_t tpg_vc3_dt_2_cfg_2;
+	uint32_t tpg_vc3_dt_3_cfg_0;
+	uint32_t tpg_vc3_dt_3_cfg_1;
+	uint32_t tpg_vc3_dt_3_cfg_2;
+	uint32_t tpg_vc3_color_bar_cfa_color0;
+	uint32_t tpg_vc3_color_bar_cfa_color1;
+	uint32_t tpg_vc3_color_bar_cfa_color2;
+	uint32_t tpg_vc3_color_bar_cfa_color3;
+
+	uint32_t tpg_throttle;
+	uint32_t tpg_top_irq_status;
+	uint32_t tpg_top_irq_mask;
+	uint32_t tpg_top_irq_clear;
+	uint32_t tpg_top_irq_set;
+	uint32_t tpg_top_irq_cmd;
+	uint32_t tpg_top_clear;
+	uint32_t tpg_test_bus_crtl;
+	uint32_t tpg_spare;
+
+	/* configurations */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t tpg_en_shift_val;
+	uint32_t tpg_cphy_dphy_sel_shift_val;
+	uint32_t tpg_num_active_lanes_shift;
+	uint32_t tpg_fe_pkt_en_shift;
+	uint32_t tpg_fs_pkt_en_shift;
+	uint32_t tpg_line_interleaving_mode_shift;
+	uint32_t tpg_num_frames_shift_val;
+	uint32_t tpg_num_dts_shift_val;
+	uint32_t tpg_v_blank_cnt_shift;
+	uint32_t tpg_dt_encode_format_shift;
+	uint32_t tpg_payload_mode_color;
+	uint32_t tpg_split_en_shift;
+	uint32_t top_mux_reg_offset;
+	uint32_t tpg_vc_dt_pattern_id_shift;
+	uint32_t tpg_num_active_vcs_shift;
+	uint32_t tpg_color_bar_qcfa_en_shift;
+	uint32_t tpg_color_bar_qcfa_rotate_period_shift;
+	uint32_t tpg_overlap_shdr_en_shift;
+	uint32_t tpg_num_batch_shift;
+	uint32_t tpg_xcfa_en_shift;
+	uint32_t tpg_noise_en_shift;
+	uint32_t tpg_size_x_shift;
+	uint32_t tpg_size_y_shift;
+	uint32_t tpg_gain_shift;
+	uint32_t tpg_shdr_offset_num_batch_shift;
+	uint32_t tpg_shdr_line_offset0_shift;
+	uint32_t tpg_shdr_line_offset1_shift;
+};
+
+
+/**
+ * @brief initialize the tpg hw instance
+ *
+ * @param hw   : tpg hw instance
+ * @param data : argument for initialize
+ *
+ * @return     : 0 on success
+ */
+int tpg_hw_v_1_3_init(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief start tpg hw
+ *
+ * @param hw    : tpg hw instance
+ * @param data  : tpg hw instance data
+ *
+ * @return      : 0 on success
+ */
+int tpg_hw_v_1_3_start(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief stop tpg hw
+ *
+ * @param hw   : tpg hw instance
+ * @param data : argument for tpg hw stop
+ *
+ * @return     : 0 on success
+ */
+int tpg_hw_v_1_3_stop(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief process a command send from hw layer
+ *
+ * @param hw  : tpg hw instance
+ * @param cmd : command to process
+ * @param arg : argument corresponding to command
+ *
+ * @return    : 0 on success
+ */
+int tpg_hw_v_1_3_process_cmd(struct tpg_hw *hw,
+		uint32_t cmd, void *arg);
+
+/**
+ * @brief  dump hw status registers
+ *
+ * @param hw   : tpg hw instance
+ * @param data : argument for status dump
+ *
+ * @return     : 0 on sucdess
+ */
+int tpg_hw_v_1_3_dump_status(struct tpg_hw *hw, void *data);
+
+int tpg_1_3_layer_init(struct tpg_hw *hw);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3_0.h
@@ -0,0 +1,117 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __CAM_TPG_HW_V_1_3_0_H__
+#define __CAM_TPG_HW_V_1_3_0_H__
+
+static struct cam_tpg_ver_1_3_reg_offset cam_tpg103_reg = {
+	.tpg_hw_version        = 0x0,
+	.tpg_hw_status         = 0x4,
+	.tpg_ctrl              = 0x64,
+	.tpg_vc0_cfg0          = 0x68,
+	.tpg_vc0_lfsr_seed     = 0x6C,
+	.tpg_vc0_hbi_cfg       = 0x70,
+	.tpg_vc0_vbi_cfg       = 0x74,
+	.tpg_vc0_color_bar_cfg = 0x78,
+	.tpg_vc0_dt_0_cfg_0   = 0x7C,
+	.tpg_vc0_dt_0_cfg_1   = 0x80,
+	.tpg_vc0_dt_0_cfg_2   = 0x84,
+	.tpg_vc0_dt_1_cfg_0   = 0x88,
+	.tpg_vc0_dt_1_cfg_1   = 0x8C,
+	.tpg_vc0_dt_1_cfg_2   = 0x90,
+	.tpg_vc0_dt_2_cfg_0   = 0x94,
+	.tpg_vc0_dt_2_cfg_1   = 0x98,
+	.tpg_vc0_dt_2_cfg_2   = 0x9C,
+	.tpg_vc0_dt_3_cfg_0   = 0xA0,
+	.tpg_vc0_dt_3_cfg_1   = 0xA4,
+	.tpg_vc0_dt_3_cfg_2   = 0xA8,
+
+	.tpg_vc1_cfg0          = 0xC8,
+	.tpg_vc1_lfsr_seed     = 0xCC,
+	.tpg_vc1_hbi_cfg       = 0xD0,
+	.tpg_vc1_vbi_cfg       = 0xD4,
+	.tpg_vc1_color_bar_cfg = 0xD8,
+	.tpg_vc1_dt_0_cfg_0   = 0xDC,
+	.tpg_vc1_dt_0_cfg_1   = 0xE0,
+	.tpg_vc1_dt_0_cfg_2   = 0xE4,
+	.tpg_vc1_dt_1_cfg_0   = 0xE8,
+	.tpg_vc1_dt_1_cfg_1   = 0xEC,
+	.tpg_vc1_dt_1_cfg_2   = 0xF0,
+	.tpg_vc1_dt_2_cfg_0   = 0xF4,
+	.tpg_vc1_dt_2_cfg_1   = 0xF8,
+	.tpg_vc1_dt_2_cfg_2   = 0xFC,
+	.tpg_vc1_dt_3_cfg_0   = 0x100,
+	.tpg_vc1_dt_3_cfg_1   = 0x104,
+	.tpg_vc1_dt_3_cfg_2   = 0x108,
+
+	.tpg_vc2_cfg0          = 0x128,
+	.tpg_vc2_lfsr_seed     = 0x12C,
+	.tpg_vc2_hbi_cfg       = 0x130,
+	.tpg_vc2_vbi_cfg       = 0x134,
+	.tpg_vc2_color_bar_cfg = 0x138,
+	.tpg_vc2_dt_0_cfg_0   = 0x13C,
+	.tpg_vc2_dt_0_cfg_1   = 0x140,
+	.tpg_vc2_dt_0_cfg_2   = 0x144,
+	.tpg_vc2_dt_1_cfg_0   = 0x148,
+	.tpg_vc2_dt_1_cfg_1   = 0x14C,
+	.tpg_vc2_dt_1_cfg_2   = 0x150,
+	.tpg_vc2_dt_2_cfg_0   = 0x154,
+	.tpg_vc2_dt_2_cfg_1   = 0x158,
+	.tpg_vc2_dt_2_cfg_2   = 0x15C,
+	.tpg_vc2_dt_3_cfg_0   = 0x160,
+	.tpg_vc2_dt_3_cfg_1   = 0x164,
+	.tpg_vc2_dt_3_cfg_2   = 0x168,
+
+	.tpg_vc3_cfg0          = 0x188,
+	.tpg_vc3_lfsr_seed     = 0x18C,
+	.tpg_vc3_hbi_cfg       = 0x190,
+	.tpg_vc3_vbi_cfg       = 0x194,
+	.tpg_vc3_color_bar_cfg = 0x198,
+	.tpg_vc3_dt_0_cfg_0   = 0x19C,
+	.tpg_vc3_dt_0_cfg_1   = 0x1A0,
+	.tpg_vc3_dt_0_cfg_2   = 0x1A4,
+	.tpg_vc3_dt_1_cfg_0   = 0x1A8,
+	.tpg_vc3_dt_1_cfg_1   = 0x1AC,
+	.tpg_vc3_dt_1_cfg_2   = 0x1B0,
+	.tpg_vc3_dt_2_cfg_0   = 0x1B4,
+	.tpg_vc3_dt_2_cfg_1   = 0x1B8,
+	.tpg_vc3_dt_2_cfg_2   = 0x1BC,
+	.tpg_vc3_dt_3_cfg_0   = 0x1C0,
+	.tpg_vc3_dt_3_cfg_1   = 0x1C4,
+	.tpg_vc3_dt_3_cfg_2   = 0x1C8,
+	.tpg_throttle          = 0x1CC,
+	.tpg_top_irq_status    = 0x1E0,
+	.tpg_top_irq_mask      = 0x1E4,
+	.tpg_top_irq_clear     = 0x1E8,
+	.tpg_top_irq_set       = 0x1EC,
+	.tpg_top_irq_cmd       = 0x1F0,
+	.tpg_top_clear         = 0x1F4,
+	.tpg_test_bus_crtl     = 0x1F8,
+	.tpg_spare             = 0x1FC,
+
+	/* configurations */
+	.major_version = 2,
+	.minor_version = 0,
+	.version_incr = 0,
+	.tpg_en_shift_val = 0,
+	.tpg_cphy_dphy_sel_shift_val = 3,
+	.tpg_num_active_lanes_shift = 4,
+	.tpg_fe_pkt_en_shift = 2,
+	.tpg_fs_pkt_en_shift = 1,
+	.tpg_line_interleaving_mode_shift = 10,
+	.tpg_num_frames_shift_val = 16,
+	.tpg_num_dts_shift_val = 8,
+	.tpg_v_blank_cnt_shift = 12,
+	.tpg_dt_encode_format_shift = 20,
+	.tpg_payload_mode_color = 0x8,
+	.tpg_split_en_shift = 4,
+	.top_mux_reg_offset = 0x1C,
+	.tpg_vc_dt_pattern_id_shift = 6,
+	.tpg_num_active_vcs_shift = 30,
+	.tpg_color_bar_qcfa_en_shift = 3,
+	.tpg_color_bar_qcfa_rotate_period_shift = 8,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3_1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3_1.h
@@ -0,0 +1,152 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __CAM_TPG_HW_V_1_3_1_H__
+#define __CAM_TPG_HW_V_1_3_1_H__
+
+static struct cam_tpg_ver_1_3_reg_offset cam_tpg103_1_reg = {
+	.tpg_hw_version        = 0x0,
+	.tpg_hw_status         = 0x4,
+	.tpg_vc0_gain_cfg      = 0x60,
+	.tpg_ctrl              = 0x64,
+	.tpg_vc0_cfg0          = 0x68,
+	.tpg_vc0_lfsr_seed     = 0x6C,
+	.tpg_vc0_hbi_cfg       = 0x70,
+	.tpg_vc0_vbi_cfg       = 0x74,
+	.tpg_vc0_color_bar_cfg = 0x78,
+	.tpg_vc0_dt_0_cfg_0   = 0x7C,
+	.tpg_vc0_dt_0_cfg_1   = 0x80,
+	.tpg_vc0_dt_0_cfg_2   = 0x84,
+	.tpg_vc0_dt_1_cfg_0   = 0x88,
+	.tpg_vc0_dt_1_cfg_1   = 0x8C,
+	.tpg_vc0_dt_1_cfg_2   = 0x90,
+	.tpg_vc0_dt_2_cfg_0   = 0x94,
+	.tpg_vc0_dt_2_cfg_1   = 0x98,
+	.tpg_vc0_dt_2_cfg_2   = 0x9C,
+	.tpg_vc0_dt_3_cfg_0   = 0xA0,
+	.tpg_vc0_dt_3_cfg_1   = 0xA4,
+	.tpg_vc0_dt_3_cfg_2   = 0xA8,
+	.tpg_vc0_color_bar_cfa_color0 = 0xB0,
+	.tpg_vc0_color_bar_cfa_color1 = 0xB4,
+	.tpg_vc0_color_bar_cfa_color2 = 0xB8,
+	.tpg_vc0_color_bar_cfa_color3 = 0xBC,
+
+	.tpg_vc1_gain_cfg      = 0xC0,
+	.tpg_vc1_shdr_cfg      = 0xC4,
+	.tpg_vc1_cfg0          = 0xC8,
+	.tpg_vc1_lfsr_seed     = 0xCC,
+	.tpg_vc1_hbi_cfg       = 0xD0,
+	.tpg_vc1_vbi_cfg       = 0xD4,
+	.tpg_vc1_color_bar_cfg = 0xD8,
+	.tpg_vc1_dt_0_cfg_0   = 0xDC,
+	.tpg_vc1_dt_0_cfg_1   = 0xE0,
+	.tpg_vc1_dt_0_cfg_2   = 0xE4,
+	.tpg_vc1_dt_1_cfg_0   = 0xE8,
+	.tpg_vc1_dt_1_cfg_1   = 0xEC,
+	.tpg_vc1_dt_1_cfg_2   = 0xF0,
+	.tpg_vc1_dt_2_cfg_0   = 0xF4,
+	.tpg_vc1_dt_2_cfg_1   = 0xF8,
+	.tpg_vc1_dt_2_cfg_2   = 0xFC,
+	.tpg_vc1_dt_3_cfg_0   = 0x100,
+	.tpg_vc1_dt_3_cfg_1   = 0x104,
+	.tpg_vc1_dt_3_cfg_2   = 0x108,
+	.tpg_vc1_color_bar_cfa_color0 = 0x110,
+	.tpg_vc1_color_bar_cfa_color1 = 0x114,
+	.tpg_vc1_color_bar_cfa_color2 = 0x118,
+	.tpg_vc1_color_bar_cfa_color3 = 0x11C,
+
+	.tpg_vc2_gain_cfg      = 0x120,
+	.tpg_vc2_shdr_cfg      = 0x124,
+	.tpg_vc2_cfg0          = 0x128,
+	.tpg_vc2_lfsr_seed     = 0x12C,
+	.tpg_vc2_hbi_cfg       = 0x130,
+	.tpg_vc2_vbi_cfg       = 0x134,
+	.tpg_vc2_color_bar_cfg = 0x138,
+	.tpg_vc2_dt_0_cfg_0   = 0x13C,
+	.tpg_vc2_dt_0_cfg_1   = 0x140,
+	.tpg_vc2_dt_0_cfg_2   = 0x144,
+	.tpg_vc2_dt_1_cfg_0   = 0x148,
+	.tpg_vc2_dt_1_cfg_1   = 0x14C,
+	.tpg_vc2_dt_1_cfg_2   = 0x150,
+	.tpg_vc2_dt_2_cfg_0   = 0x154,
+	.tpg_vc2_dt_2_cfg_1   = 0x158,
+	.tpg_vc2_dt_2_cfg_2   = 0x15C,
+	.tpg_vc2_dt_3_cfg_0   = 0x160,
+	.tpg_vc2_dt_3_cfg_1   = 0x164,
+	.tpg_vc2_dt_3_cfg_2   = 0x168,
+	.tpg_vc2_color_bar_cfa_color0 = 0x170,
+	.tpg_vc2_color_bar_cfa_color1 = 0x174,
+	.tpg_vc2_color_bar_cfa_color2 = 0x178,
+	.tpg_vc2_color_bar_cfa_color3 = 0x17C,
+
+	.tpg_vc3_gain_cfg      = 0x180,
+	.tpg_vc3_shdr_cfg      = 0x184,
+	.tpg_vc3_cfg0          = 0x188,
+	.tpg_vc3_lfsr_seed     = 0x18C,
+	.tpg_vc3_hbi_cfg       = 0x190,
+	.tpg_vc3_vbi_cfg       = 0x194,
+	.tpg_vc3_color_bar_cfg = 0x198,
+	.tpg_vc3_dt_0_cfg_0   = 0x19C,
+	.tpg_vc3_dt_0_cfg_1   = 0x1A0,
+	.tpg_vc3_dt_0_cfg_2   = 0x1A4,
+	.tpg_vc3_dt_1_cfg_0   = 0x1A8,
+	.tpg_vc3_dt_1_cfg_1   = 0x1AC,
+	.tpg_vc3_dt_1_cfg_2   = 0x1B0,
+	.tpg_vc3_dt_2_cfg_0   = 0x1B4,
+	.tpg_vc3_dt_2_cfg_1   = 0x1B8,
+	.tpg_vc3_dt_2_cfg_2   = 0x1BC,
+	.tpg_vc3_dt_3_cfg_0   = 0x1C0,
+	.tpg_vc3_dt_3_cfg_1   = 0x1C4,
+	.tpg_vc3_dt_3_cfg_2   = 0x1C8,
+	.tpg_throttle          = 0x1CC,
+	.tpg_vc3_color_bar_cfa_color0 = 0x1D0,
+	.tpg_vc3_color_bar_cfa_color1 = 0x1D4,
+	.tpg_vc3_color_bar_cfa_color2 = 0x1D8,
+	.tpg_vc3_color_bar_cfa_color3 = 0x1DC,
+
+	.tpg_top_irq_status    = 0x1E0,
+	.tpg_top_irq_mask      = 0x1E4,
+	.tpg_top_irq_clear     = 0x1E8,
+	.tpg_top_irq_set       = 0x1EC,
+	.tpg_top_irq_cmd       = 0x1F0,
+	.tpg_top_clear         = 0x1F4,
+	.tpg_test_bus_crtl     = 0x1F8,
+	.tpg_spare             = 0x1FC,
+
+	/* configurations */
+	.major_version = 2,
+	.minor_version = 1,
+	.version_incr = 0,
+	.tpg_en_shift_val = 0,
+	.tpg_cphy_dphy_sel_shift_val = 3,
+	.tpg_num_active_lanes_shift = 4,
+	.tpg_fe_pkt_en_shift = 2,
+	.tpg_fs_pkt_en_shift = 1,
+	.tpg_line_interleaving_mode_shift = 10,
+	.tpg_num_frames_shift_val = 16,
+	.tpg_num_dts_shift_val = 8,
+	.tpg_v_blank_cnt_shift = 12,
+	.tpg_dt_encode_format_shift = 28,
+	.tpg_payload_mode_color = 0x8,
+	.tpg_split_en_shift = 4,
+	.top_mux_reg_offset = 0x1C,
+	.tpg_vc_dt_pattern_id_shift = 6,
+	.tpg_num_active_vcs_shift = 30,
+	.tpg_color_bar_qcfa_en_shift = 3,
+
+	.tpg_color_bar_qcfa_rotate_period_shift = 8,
+	.tpg_overlap_shdr_en_shift = 10,
+	.tpg_num_batch_shift = 12,
+	.tpg_noise_en_shift = 5,
+	.tpg_xcfa_en_shift = 16,
+	.tpg_size_x_shift = 24,
+	.tpg_size_y_shift = 28,
+	.tpg_gain_shift = 0,
+	.tpg_shdr_offset_num_batch_shift = 16,
+	.tpg_shdr_line_offset0_shift = 0,
+	.tpg_shdr_line_offset1_shift = 16,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3_data.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_3/tpg_hw_v_1_3_data.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __TPG_HW_V_1_3_DATA_H__
+#define __TPG_HW_V_1_3_DATA_H__
+
+#include "../tpg_hw.h"
+#include "../tpg_hw_common.h"
+#include "tpg_hw_v_1_3.h"
+#include "tpg_hw_v_1_3_0.h"
+#include "tpg_hw_v_1_3_1.h"
+
+struct tpg_hw_ops tpg_hw_v_1_3_ops = {
+	.start = tpg_hw_v_1_3_start,
+	.stop  = tpg_hw_v_1_3_stop,
+	.init  = tpg_hw_v_1_3_init,
+	.process_cmd = tpg_hw_v_1_3_process_cmd,
+	.dump_status = tpg_hw_v_1_3_dump_status,
+	.write_settings = tpg_hw_write_settings,
+};
+
+struct tpg_hw_info tpg_v_1_3_hw_info = {
+	.version = TPG_HW_VERSION_1_3,
+	.max_vc_channels = 4,
+	.max_dt_channels_per_vc = 4,
+	.ops = &tpg_hw_v_1_3_ops,
+	.hw_data = &cam_tpg103_reg,
+	.layer_init = &tpg_1_3_layer_init,
+	.xcfa_debug = -1,
+	.shdr_overlap = -1,
+	.shdr_offset_num_batch = 0,
+	.shdr_line_offset0 = 0x6c,
+	.shdr_line_offset1 = 0x6c,
+};
+
+struct tpg_hw_info tpg_v_1_3_1_hw_info = {
+	.version = TPG_HW_VERSION_1_3_1,
+	.max_vc_channels = 4,
+	.max_dt_channels_per_vc = 4,
+	.ops = &tpg_hw_v_1_3_ops,
+	.hw_data = &cam_tpg103_1_reg,
+	.layer_init = &tpg_1_3_layer_init,
+	.xcfa_debug = 0,
+	.shdr_overlap = 0,
+	.shdr_offset_num_batch = 0,
+	.shdr_line_offset0 = 0x6c,
+	.shdr_line_offset1 = 0x6c,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4.c
@@ -0,0 +1,958 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "tpg_hw_v_1_4.h"
+
+enum tpg_hw_v_1_4_encode_fomat_t {
+	RAW_8_BIT = 1,
+	RAW_10_BIT,
+	RAW_12_BIT,
+	RAW_14_BIT,
+	RAW_16_BIT
+};
+
+#define  CAM_TPG_HW_WAIT_TIMEOUT    msecs_to_jiffies(100)
+#define  FRAME_INTERLEAVE           0x0
+#define  LINE_INTERLEAVE            0x1
+#define  SHDR_INTERLEAVE            0x2
+#define  SPARSE_PD_INTERLEAVE       0x3
+#define  CFA_PATTERN_ROW_WIDTH      8
+#define  CFA_PATTERN_BITS_PER_INDEX 2
+#define  TIMEOUT_MULTIPLIER         1
+#define  TIMEOUT_MULTIPLIER_PRESIL  5
+#define  TPG_DISABLE                0
+
+static int get_tpg_vc_dt_pattern_id(
+		enum tpg_interleaving_format_t vc_dt_pattern)
+{
+	switch (vc_dt_pattern) {
+	case TPG_INTERLEAVING_FORMAT_INVALID:
+	case TPG_INTERLEAVING_FORMAT_MAX:
+	case TPG_INTERLEAVING_FORMAT_FRAME:
+		return FRAME_INTERLEAVE;
+	case TPG_INTERLEAVING_FORMAT_LINE:
+		return LINE_INTERLEAVE;
+	case TPG_INTERLEAVING_FORMAT_SHDR:
+		return SHDR_INTERLEAVE;
+	case TPG_INTERLEAVING_FORMAT_SPARSE_PD:
+		return SPARSE_PD_INTERLEAVE;
+
+	}
+	return FRAME_INTERLEAVE;
+}
+
+static int get_tpg_encode_format(int sw_encode_format)
+{
+	switch (sw_encode_format) {
+	case PACK_8_BIT:
+		return RAW_8_BIT;
+	case PACK_10_BIT:
+		return RAW_10_BIT;
+	case PACK_12_BIT:
+		return RAW_12_BIT;
+	case PACK_14_BIT:
+		return RAW_14_BIT;
+	case PACK_16_BIT:
+		return RAW_16_BIT;
+	}
+	return RAW_8_BIT;
+}
+
+#define  INCREMENTING       0x0
+#define  ALTERNATING_55_AA  0x1
+#define  RANDOM             0x4
+#define  USER_SPECIFIED     0x5
+#define  COLOR_BARS         0x8
+
+static int get_tpg_payload_mode(enum tpg_pattern_t pattern)
+{
+	switch (pattern) {
+	case TPG_PATTERN_INVALID:
+	case TPG_PATTERN_REAL_IMAGE:
+	case TPG_PATTERN_COLOR_BAR:
+		return COLOR_BARS;
+	case TPG_PATTERN_RANDOM_PIXL:
+	case TPG_PATTERN_RANDOM_INCREMENTING_PIXEL:
+		return RANDOM;
+	case TPG_PATTERN_ALTERNATING_55_AA:
+		return ALTERNATING_55_AA;
+	case TPG_PATTERN_ALTERNATING_USER_DEFINED:
+		return USER_SPECIFIED;
+	default:
+		return COLOR_BARS;
+	}
+	return COLOR_BARS;
+}
+
+#define RGGB_IR_0  0x00770091
+#define RGGB_IR_1  0x00770019
+#define RGGB_2x2   0x05055A5A
+#define RGGB_3x3_0 0x05400540
+#define RGGB_3x3_1 0x0a950540
+#define RGGB_3x3_2 0x0a950a95
+#define RGGB_4x4_0 0x55005500
+#define RGGB_4x4_1 0x55005500
+#define RGGB_4x4_2 0xaa55aa55
+#define RGGB_4x4_3 0xaa55aa55
+#define VC1_GAIN   0x100
+
+static int configure_xcfa_array(struct tpg_hw *hw, int config)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_4_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+	switch (config) {
+	case 1:
+		cam_io_w_mb(RGGB_IR_0,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		cam_io_w_mb(RGGB_IR_1,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		break;
+	case 2:
+		cam_io_w_mb(RGGB_2x2,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		break;
+	case 3:
+		cam_io_w_mb(RGGB_3x3_0,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		cam_io_w_mb(RGGB_3x3_1,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		cam_io_w_mb(RGGB_3x3_2,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color2);
+		break;
+	case 4:
+		cam_io_w_mb(RGGB_4x4_0,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		cam_io_w_mb(RGGB_4x4_1,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		cam_io_w_mb(RGGB_4x4_2,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color2);
+		cam_io_w_mb(RGGB_4x4_3,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color3);
+		break;
+	break;
+
+	}
+	return 0;
+}
+
+static int configure_global_configs(
+	struct tpg_hw *hw,
+	int num_vcs,
+	struct tpg_global_config_t *configs)
+{
+	uint32_t val, phy_type = 0;
+	uint32_t timeout_multiplier = -1;
+	int rc = 0;
+	unsigned long wait_jiffies = 0;
+	unsigned long rem_jiffies = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_4_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	tpg_reg  = hw->hw_info->hw_data;
+	soc_info = hw->soc_info;
+
+	if (configs->phy_type == TPG_PHY_TYPE_CPHY)
+		phy_type = 1;
+
+	if (num_vcs <= 0) {
+		CAM_ERR(CAM_TPG, "invalid vc count");
+		return -EINVAL;
+	}
+
+	val = (1 << tpg_reg->rup_done_mask_vec_shift) | (1 << tpg_reg->tpg_done_mask_vec_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				tpg_reg->top_irq_mask);
+
+	val = (num_vcs - 1) <<
+		(tpg_reg->num_active_vc_shift) |
+		(configs->lane_count - 1) << (tpg_reg->num_active_lanes_shift) |
+		(get_tpg_vc_dt_pattern_id(configs->interleaving_format)
+		 << (tpg_reg->vc_dt_pattern_id_shift)) |
+		(phy_type << tpg_reg->phy_sel_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+
+	CAM_DBG(CAM_TPG, "tpg[%d] tpg_ctrl=0x%x", hw->hw_idx, val);
+
+	/* Check with hw poc if this needs to be done perframe */
+	val = (1 << tpg_reg->test_en_cmd_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl_cmd);
+	CAM_DBG(CAM_TPG, "tpg[%d] tpg_ctrl_cmd=0x%x", hw->hw_idx, val);
+
+	if (hw->settings_update) {
+		cam_io_w_mb(TPG_DISABLE, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl_cmd);
+		if (cam_presil_mode_enabled())
+			timeout_multiplier = TIMEOUT_MULTIPLIER_PRESIL;
+		else
+			timeout_multiplier = TIMEOUT_MULTIPLIER;
+		CAM_DBG(CAM_TPG, "wait for TPG done and RUP done Interrupt");
+		wait_jiffies = CAM_TPG_HW_WAIT_TIMEOUT * timeout_multiplier;
+		reinit_completion(&hw->complete_rup);
+		rem_jiffies =
+			cam_common_wait_for_completion_timeout(&hw->complete_rup, wait_jiffies);
+		if (rem_jiffies) {
+			val = (1 << tpg_reg->test_en_cmd_shift);
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl_cmd);
+			hw->settings_update = 0;
+		} else {
+			CAM_ERR(CAM_TPG, "TPG[%d] hw timeout %llu",
+					hw->hw_idx, rem_jiffies);
+			rc = -EBUSY;
+		}
+	}
+
+	return rc;
+}
+
+static int get_pixel_coordinate(
+	int cfa_pattern_start_index,
+	int cfa_pattern_end_index,
+	uint32_t *val,
+	struct tpg_stream_config_v3_t *configs)
+{
+	uint32_t shift = 0;
+	int idx = 0;
+	int i = 0;
+	int j = 0;
+	*val = 0;
+	for (i = cfa_pattern_start_index; i < cfa_pattern_end_index; i++) {
+		for (j = 0; j < configs->cfa_info.pattern_width; j++) {
+			shift = ((i * CFA_PATTERN_ROW_WIDTH) + j) *
+				CFA_PATTERN_BITS_PER_INDEX;
+			idx = i * configs->cfa_info.pattern_height + j;
+			*val |= (configs->cfa_info.pixel_coordinate[idx].pixel_type) << shift;
+		}
+	}
+	return 0;
+}
+
+static int configure_xcfa_array_v3(
+	struct tpg_hw *hw,
+	struct tpg_stream_config_v3_t *configs)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_4_reg_offset *tpg_reg = NULL;
+	uint32_t val = 0;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+	switch (configs->xcfa_type) {
+	case XCFA_TYPE_RGBIR:
+		get_pixel_coordinate(0, 2, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		get_pixel_coordinate(2, configs->cfa_info.pattern_height, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		break;
+	case XCFA_TYPE_QUADCFA:
+		get_pixel_coordinate(0, 2, &val, configs);
+		CAM_DBG(CAM_TPG, "val = 0x%x", val);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		get_pixel_coordinate(2, configs->cfa_info.pattern_height, &val, configs);
+		CAM_DBG(CAM_TPG, "val = 0x%x", val);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		break;
+	case XCFA_TYPE_THREEXTHREECFA:
+		get_pixel_coordinate(0, 2, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		get_pixel_coordinate(2, 4, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		get_pixel_coordinate(4, configs->cfa_info.pattern_height, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color2);
+		break;
+	case XCFA_TYPE_FOURXFOURCFA:
+		get_pixel_coordinate(0, 2, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color0);
+		get_pixel_coordinate(2, 4, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color1);
+		get_pixel_coordinate(4, 6, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color2);
+		get_pixel_coordinate(6, configs->cfa_info.pattern_height, &val, configs);
+		cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc0_color_bar_cfa_color3);
+		break;
+	default:
+		break;
+	}
+	return 0;
+}
+
+static int configure_dt_v3(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	uint32_t       dt_slot,
+	struct tpg_stream_config_v3_t *stream)
+{
+	uint32_t val = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_4_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+	CAM_DBG(CAM_TPG, "TPG[%d] slot(%d,%d) <= dt:%d",
+			hw->hw_idx,
+			vc_slot,
+			dt_slot,
+			stream->dt);
+
+	val = (((stream->stream_dimension.width & 0xFFFF) << tpg_reg->frame_width_shift) |
+			(stream->stream_dimension.height & 0xFFFF << tpg_reg->frame_height_shift));
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_0 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_0=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, val);
+
+	cam_io_w_mb(stream->dt,
+			soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_1 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_1=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, stream->dt);
+
+	val = ((get_tpg_encode_format(stream->pixel_depth) & 0xF) <<
+			tpg_reg->encode_format_shift) |
+			(get_tpg_payload_mode(stream->pattern_type) << tpg_reg->pattern_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_2 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_2=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, val);
+
+	return 0;
+}
+
+static int configure_dt(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	uint32_t       dt_slot,
+	struct tpg_stream_config_t *stream)
+{
+
+	uint32_t val = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_4_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+	CAM_DBG(CAM_TPG, "TPG[%d] slot(%d,%d) <= dt:%d",
+			hw->hw_idx,
+			vc_slot,
+			dt_slot,
+			stream->dt);
+
+	val = (((stream->stream_dimension.width & 0xFFFF) << tpg_reg->frame_width_shift) |
+			(stream->stream_dimension.height & 0xFFFF) << tpg_reg->frame_height_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_0 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_0=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, val);
+
+	cam_io_w_mb(stream->dt,
+			soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_1 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_1=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, stream->dt);
+
+	val = ((get_tpg_encode_format(stream->pixel_depth) & 0xF) <<
+			tpg_reg->encode_format_shift) |
+		(get_tpg_payload_mode(stream->pattern_type) << tpg_reg->pattern_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_2 +
+			(0x60 * vc_slot) + (dt_slot * 0x0c));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_dt%d_cfg_2=0x%x",
+			hw->hw_idx,
+			vc_slot, dt_slot, val);
+
+	return 0;
+}
+
+static int configure_vc_v3(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	int            num_dts,
+	struct tpg_stream_config_v3_t *stream)
+{
+	uint32_t val = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_4_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+	/* Use CFA pattern here */
+	if (stream->output_format == TPG_IMAGE_FORMAT_QCFA)
+		val |= (1 << tpg_reg->qcfa_en_shift);
+
+	if (stream->cb_mode == TPG_COLOR_BAR_MODE_SPLIT)
+		val |= (1 << tpg_reg->split_en_shift);
+
+	if (stream->cfa_info_exist != 0) {
+		val |= ((stream->cfa_info.pattern_height - 1) << tpg_reg->size_y_shift);
+		val |= ((stream->cfa_info.pattern_width - 1) << tpg_reg->size_x_shift);
+		val |= (1 << tpg_reg->xcfa_en_shift);
+		configure_xcfa_array_v3(hw, stream);
+	}
+
+	CAM_DBG(CAM_TPG, "TPG[%d] period: %d", hw->hw_idx, stream->rotate_period);
+	val |= ((stream->rotate_period & 0x3F) <<
+			tpg_reg->rotate_period_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_color_bars_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_color_bar_cfg=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->hbi;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_hbi_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_hbi_cfg=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->vbi;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_vbi_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_vbi_cgf=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->skip_pattern;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_vc0_throttle + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_vbi_cgf=0x%x",
+		hw->hw_idx,
+			vc_slot, val);
+
+	cam_io_w_mb(0x12345678,
+		soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_vc0_lfsr_seed + (0x60 * vc_slot));
+
+	val = ((stream->frame_count << tpg_reg->num_frames_shift) |
+		((num_dts-1) <<	 tpg_reg->num_active_dt_shift) |
+		stream->vc);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_cfg0 + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_cfg0=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+	if (hw->hw_info->shdr_overlap == 1) {
+		cam_io_w_mb(hw->hw_info->shdr_overlap << tpg_reg->overlap_shdr_en_shift,
+			soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+	}
+	if (hw->hw_info->shdr_offset_num_batch >= 0 && vc_slot > 0)	{
+		val =  (VC1_GAIN << tpg_reg->gain_shift);
+		val |= (hw->hw_info->shdr_offset_num_batch <<
+				tpg_reg->shdr_offset_num_batch_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+					tpg_reg->tpg_vc1_gain_cfg + (0x60 * (vc_slot-1)));
+		val =  ((stream->shdr_line_offset0 * vc_slot)
+			<< tpg_reg->shdr_line_offset0_shift);
+		val |= ((stream->shdr_line_offset1 * vc_slot)
+			<< tpg_reg->shdr_line_offset1_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc1_shdr_cfg + (0x60 * (vc_slot-1)));
+		CAM_DBG(CAM_TPG, "TPG[%d] vc%d_cfg0=0x%x shdr",
+			hw->hw_idx,
+			vc_slot, val);
+	}
+
+	return 0;
+}
+
+static int configure_vc(
+	struct tpg_hw *hw,
+	uint32_t       vc_slot,
+	int            num_dts,
+	struct tpg_stream_config_t *stream)
+{
+	uint32_t val = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_tpg_ver_1_4_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+
+
+	if (stream->output_format == TPG_IMAGE_FORMAT_QCFA)
+		val |= (1 << tpg_reg->qcfa_en_shift);
+
+	if (stream->cb_mode == TPG_COLOR_BAR_MODE_SPLIT)
+		val |= (1 << tpg_reg->split_en_shift);
+
+	if (stream->xcfa_debug > 0) {
+		if (stream->xcfa_debug == 1) {
+			val |= (3 << tpg_reg->size_y_shift);
+			val |= (3 << tpg_reg->size_x_shift);
+		} else {
+			val |= ((stream->xcfa_debug * 2 - 1) << tpg_reg->size_y_shift);
+			val |= ((stream->xcfa_debug * 2 - 1) << tpg_reg->size_x_shift);
+		}
+		val |= (1 << tpg_reg->xcfa_en_shift);
+		configure_xcfa_array(hw, stream->xcfa_debug);
+		CAM_DBG(CAM_TPG, "xcfa_debug = %d", stream->xcfa_debug);
+	}
+
+	CAM_DBG(CAM_TPG, "TPG[%d] period: %d", hw->hw_idx, stream->rotate_period);
+	val |= ((stream->rotate_period & 0x3F) <<
+			tpg_reg->rotate_period_shift);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_color_bars_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_color_bar_cfg=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->hbi;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_hbi_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_hbi_cfg=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->vbi;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_vbi_cfg + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_vbi_cgf=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+
+	val = stream->skip_pattern;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_vc0_throttle + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_vbi_cgf=0x%x",
+		hw->hw_idx,
+			vc_slot, val);
+
+	cam_io_w_mb(0x12345678,
+		soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_vc0_lfsr_seed + (0x60 * vc_slot));
+
+	val = ((stream->frame_count << tpg_reg->num_frames_shift) |
+		((num_dts-1) <<	 tpg_reg->num_active_dt_shift) |
+		stream->vc);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_cfg0 + (0x60 * vc_slot));
+	CAM_DBG(CAM_TPG, "TPG[%d] vc%d_cfg0=0x%x",
+			hw->hw_idx,
+			vc_slot, val);
+	if (hw->hw_info->shdr_overlap == 1) {
+		cam_io_w_mb(hw->hw_info->shdr_overlap << tpg_reg->overlap_shdr_en_shift,
+			soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+	}
+	if (hw->hw_info->shdr_offset_num_batch >= 0 && vc_slot > 0)	{
+		val =  (VC1_GAIN << tpg_reg->gain_shift);
+		val |= (hw->hw_info->shdr_offset_num_batch <<
+				tpg_reg->shdr_offset_num_batch_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+					tpg_reg->tpg_vc1_gain_cfg + (0x60 * (vc_slot-1)));
+		val =  ((stream->shdr_line_offset0 * vc_slot)
+			<< tpg_reg->shdr_line_offset0_shift);
+		val |= ((stream->shdr_line_offset1 * vc_slot)
+			<< tpg_reg->shdr_line_offset1_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc1_shdr_cfg + (0x60 * (vc_slot-1)));
+		CAM_DBG(CAM_TPG, "TPG[%d] vc%d_cfg0=0x%x shdr",
+			hw->hw_idx,
+			vc_slot, val);
+	}
+
+
+	return 0;
+}
+
+static int tpg_hw_v_1_4_reset(
+	struct tpg_hw *hw, void *data)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	uint32_t val;
+	struct cam_tpg_ver_1_4_reg_offset *tpg_reg = NULL;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+	tpg_reg  = hw->hw_info->hw_data;
+
+	soc_info = hw->soc_info;
+	/* Clear out tpg_ctrl and irqs before reset */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			tpg_reg->top_irq_mask);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			tpg_reg->top_irq_clear);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			tpg_reg->irq_cmd);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_ctrl_cmd);
+
+	/* Read the version */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			tpg_reg->hw_version);
+	CAM_INFO(CAM_TPG, "TPG[%d] TPG HW version: 0x%x started",
+			hw->hw_idx, val);
+
+	return 0;
+}
+
+int tpg_hw_v_1_4_process_cmd(
+	struct tpg_hw *hw,
+	uint32_t       cmd,
+	void          *arg)
+{
+	int rc = 0;
+
+	if (hw == NULL) {
+		CAM_ERR(CAM_TPG, "invalid argument");
+		return -EINVAL;
+	}
+	switch (cmd) {
+	case TPG_CONFIG_VC:
+	{
+		if (hw->stream_version == 1) {
+			struct vc_config_args *vc_config =
+				(struct vc_config_args *)arg;
+
+			if (vc_config == NULL) {
+				CAM_ERR(CAM_TPG, "invalid argument");
+				return -EINVAL;
+			}
+			rc = configure_vc(hw,
+				vc_config->vc_slot,
+				vc_config->num_dts,
+				vc_config->stream);
+		} else if (hw->stream_version == 3) {
+			struct vc_config_args_v3 *vc_config_v3 =
+				(struct vc_config_args_v3 *)arg;
+
+			if (vc_config_v3 == NULL) {
+				CAM_ERR(CAM_TPG, "invalid argument");
+				return -EINVAL;
+			}
+			rc = configure_vc_v3(hw,
+				vc_config_v3->vc_slot,
+				vc_config_v3->num_dts,
+				vc_config_v3->stream);
+		}
+	}
+	break;
+	case TPG_CONFIG_DT:
+	{
+		if (hw->stream_version == 1) {
+			struct dt_config_args *dt_config =
+				(struct dt_config_args *)arg;
+
+			if (dt_config == NULL) {
+				CAM_ERR(CAM_TPG, "invalid argument");
+				return -EINVAL;
+			}
+			rc = configure_dt(hw,
+				dt_config->vc_slot,
+				dt_config->dt_slot,
+				dt_config->stream);
+		} else if (hw->stream_version == 3) {
+			struct dt_config_args_v3 *dt_config_v3 =
+				(struct dt_config_args_v3 *)arg;
+
+			if (dt_config_v3 == NULL) {
+				CAM_ERR(CAM_TPG, "invalid argument");
+				return -EINVAL;
+			}
+			rc = configure_dt_v3(hw,
+				dt_config_v3->vc_slot,
+				dt_config_v3->dt_slot,
+				dt_config_v3->stream);
+		}
+	}
+	break;
+	case TPG_CONFIG_CTRL:
+	{
+		struct global_config_args *global_args =
+			(struct global_config_args *)arg;
+		rc = configure_global_configs(hw,
+				global_args->num_vcs,
+				global_args->globalconfig);
+	}
+	break;
+	default:
+		CAM_ERR(CAM_TPG, "invalid argument");
+		break;
+	}
+	return rc;
+}
+
+int tpg_hw_v_1_4_start(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.4 HWL start");
+	return 0;
+}
+
+int tpg_hw_v_1_4_stop(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.4 HWL stop");
+	tpg_hw_v_1_4_reset(hw, data);
+	return 0;
+}
+
+irqreturn_t tpg_hw_v_1_4_handle_irq(struct tpg_hw *hw)
+{
+	struct cam_hw_soc_info            *soc_info = NULL;
+	uint32_t                          val;
+	unsigned long                     flags;
+	struct cam_tpg_ver_1_4_reg_offset *tpg_reg = NULL;
+	bool                              rup_done = false;
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data || !hw->soc_info) {
+		CAM_ERR(CAM_TPG, "Invalid Params");
+		return IRQ_NONE;
+	}
+
+	tpg_reg  = hw->hw_info->hw_data;
+	soc_info = hw->soc_info;
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		tpg_reg->top_irq_status);
+
+	if (val & ((1 << tpg_reg->rup_done_status_shift) |
+		(1 << tpg_reg->tpg_done_status_shift))) {
+		CAM_DBG(CAM_TPG, "Got TPG Interrupt val = 0x%x", val);
+
+		if (val & (1 << tpg_reg->rup_done_status_shift)) {
+			rup_done = true;
+			spin_lock_irqsave(&hw->hw_state_lock, flags);
+			hw->state = TPG_HW_STATE_READY;
+			spin_unlock_irqrestore(&hw->hw_state_lock, flags);
+		}
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->top_irq_clear);
+		val = (1 << tpg_reg->clear_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->irq_cmd);
+
+		if (rup_done)
+			complete(&hw->complete_rup);
+	} else {
+		CAM_ERR(CAM_TPG, "Not a valid event 0x%x", val);
+	}
+
+	return IRQ_HANDLED;
+}
+int tpg_hw_v_1_4_dump_status(struct tpg_hw *hw, void *data)
+{
+
+	if (!hw || !hw->hw_info || !hw->hw_info->hw_data) {
+		CAM_ERR(CAM_TPG, "invalid params");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_TPG, "TPG V1.4 HWL status dump");
+
+	return 0;
+}
+
+int tpg_hw_v_1_4_init(struct tpg_hw *hw, void *data)
+{
+	CAM_DBG(CAM_TPG, "TPG V1.4 HWL init");
+	tpg_hw_v_1_4_reset(hw, data);
+	return 0;
+}
+
+
+
+static int tpg_1_4_get_xcfa_test(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get xcfa test %d", hw->hw_info->xcfa_debug);
+	*val = hw->hw_info->xcfa_debug;
+	return 0;
+}
+static int tpg_1_4_get_shdr_overlap_test(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get shdr test : %d", hw->hw_info->shdr_overlap);
+	*val = hw->hw_info->shdr_overlap;
+	return 0;
+}
+static int tpg_1_4_get_shdr_offset_num_batch(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get shdr_num_batch : %d", hw->hw_info->shdr_offset_num_batch);
+	*val = hw->hw_info->shdr_offset_num_batch;
+	return 0;
+}
+static int tpg_1_4_get_shdr_line_offset0(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get shdr_offset0 : %d", hw->hw_info->shdr_line_offset0);
+	*val = hw->hw_info->shdr_line_offset0;
+	return 0;
+}
+static int tpg_1_4_get_shdr_line_offset1(void *data, u64 *val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "get shdr_offset1 : %d", hw->hw_info->shdr_line_offset1);
+	*val = hw->hw_info->shdr_line_offset1;
+	return 0;
+}
+
+
+static int tpg_1_4_set_xcfa_test(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set xcfa test prev : %d", hw->hw_info->xcfa_debug);
+	hw->hw_info->xcfa_debug = val;
+	return 0;
+}
+static int tpg_1_4_set_shdr_overlap_test(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set shdr test prev : %d", hw->hw_info->shdr_overlap);
+	hw->hw_info->shdr_overlap = val;
+	return 0;
+}
+static int tpg_1_4_set_shdr_offset_num_batch(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set shdr_num_batch : %d", hw->hw_info->shdr_offset_num_batch);
+	hw->hw_info->shdr_offset_num_batch = val;
+	return 0;
+}
+static int tpg_1_4_set_shdr_line_offset0(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set shdr_offset0 : %d", hw->hw_info->shdr_line_offset0);
+	hw->hw_info->shdr_line_offset0 = val;
+	return 0;
+}
+static int tpg_1_4_set_shdr_line_offset1(void *data, u64 val)
+{
+	struct tpg_hw *hw = (struct tpg_hw *)data;
+
+	CAM_INFO(CAM_TPG, "set shdr_offset1 : %d", hw->hw_info->shdr_line_offset1);
+	hw->hw_info->shdr_line_offset1 = val;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_4_xcfa_test,
+		&tpg_1_4_get_xcfa_test,
+		&tpg_1_4_set_xcfa_test,
+		"%16d");
+
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_4_shdr_overlap_test,
+		&tpg_1_4_get_shdr_overlap_test,
+		&tpg_1_4_set_shdr_overlap_test,
+		"%16d");
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_4_shdr_offset_num_batch,
+		&tpg_1_4_get_shdr_offset_num_batch,
+		&tpg_1_4_set_shdr_offset_num_batch,
+		"%16d");
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_4_shdr_line_offset0,
+		&tpg_1_4_get_shdr_line_offset0,
+		&tpg_1_4_set_shdr_line_offset0,
+		"%16d");
+DEFINE_SIMPLE_ATTRIBUTE(tpg_1_4_shdr_line_offset1,
+		&tpg_1_4_get_shdr_line_offset1,
+		&tpg_1_4_set_shdr_line_offset1,
+		"%16d");
+
+
+int tpg_1_4_layer_init(struct tpg_hw *hw)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr_parent = NULL;
+	char dir_name[160];
+
+	snprintf(dir_name, sizeof(dir_name), "tpg%d",
+		hw->hw_idx);
+
+	dbgfileptr_parent = debugfs_create_dir(dir_name, NULL);
+	if (!dbgfileptr_parent) {
+		CAM_ERR(CAM_TPG, "Debug fs could not create directory");
+		rc = -ENOENT;
+		return rc;
+	}
+	debugfs_create_file("tpg_xcfa_test", 0644,
+		dbgfileptr_parent, hw, &tpg_1_4_xcfa_test);
+	debugfs_create_file("tpg_shdr_overlap_test", 0644,
+		dbgfileptr_parent, hw, &tpg_1_4_shdr_overlap_test);
+	debugfs_create_file("tpg_shdr_offset_num_batch", 0644,
+		dbgfileptr_parent, hw, &tpg_1_4_shdr_offset_num_batch);
+	debugfs_create_file("tpg_shdr_line_offset0", 0644,
+		dbgfileptr_parent, hw, &tpg_1_4_shdr_line_offset0);
+	debugfs_create_file("tpg_shdr_line_offset1", 0644,
+		dbgfileptr_parent, hw, &tpg_1_4_shdr_line_offset1);
+	CAM_INFO(CAM_TPG, "Layer init called");
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4.h
@@ -0,0 +1,346 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __TPG_HW_V_1_4_H__
+#define __TPG_HW_V_1_4_H__
+
+#include "../tpg_hw.h"
+
+struct cam_tpg_ver_1_4_reg_offset {
+	/* Register offsets below */
+	int hw_version;
+	int hw_status;
+	int dmi_cfg;
+	int dmi_lut_cfg;
+	int dmi_data;
+	int dmi_data_1;
+	int dmi_data_2;
+	int dmi_data_3;
+	int dmi_data_4;
+	int dmi_data_5;
+	int dmi_data_6;
+	int dmi_data_7;
+	int dmi_data_8;
+	int dmi_data_9;
+	int dmi_data_10;
+	int dmi_data_11;
+	int dmi_data_12;
+	int dmi_data_13;
+	int dmi_data_14;
+	int dmi_data_15;
+	int dmi_cmd;
+	int dmi_status;
+	int dmi_lut_bank_cfg;
+	int module_lut_bank_cfg;
+	int tpg_vc0_gain_cfg;
+	int tpg_ctrl;
+	int tpg_vc0_cfg0;
+	int tpg_vc0_lfsr_seed;
+	int tpg_vc0_hbi_cfg;
+	int tpg_vc0_vbi_cfg;
+	int tpg_vc0_color_bars_cfg;
+	int tpg_vc0_dt_0_cfg_0;
+	int tpg_vc0_dt_0_cfg_1;
+	int tpg_vc0_dt_0_cfg_2;
+	int tpg_vc0_dt_1_cfg_0;
+	int tpg_vc0_dt_1_cfg_1;
+	int tpg_vc0_dt_1_cfg_2;
+	int tpg_vc0_dt_2_cfg_0;
+	int tpg_vc0_dt_2_cfg_1;
+	int tpg_vc0_dt_2_cfg_2;
+	int tpg_vc0_dt_3_cfg_0;
+	int tpg_vc0_dt_3_cfg_1;
+	int tpg_vc0_dt_3_cfg_2;
+	int tpg_vc0_throttle;
+	int tpg_vc0_color_bar_cfa_color0;
+	int tpg_vc0_color_bar_cfa_color1;
+	int tpg_vc0_color_bar_cfa_color2;
+	int tpg_vc0_color_bar_cfa_color3;
+	int tpg_vc1_gain_cfg;
+	int tpg_vc1_shdr_cfg;
+	int tpg_vc1_cfg0;
+	int tpg_vc1_lfsr_seed;
+	int tpg_vc1_hbi_cfg;
+	int tpg_vc1_vbi_cfg;
+	int tpg_vc1_color_bars_cfg;
+	int tpg_vc1_dt_0_cfg_0;
+	int tpg_vc1_dt_0_cfg_1;
+	int tpg_vc1_dt_0_cfg_2;
+	int tpg_vc1_dt_1_cfg_0;
+	int tpg_vc1_dt_1_cfg_1;
+	int tpg_vc1_dt_1_cfg_2;
+	int tpg_vc1_dt_2_cfg_0;
+	int tpg_vc1_dt_2_cfg_1;
+	int tpg_vc1_dt_2_cfg_2;
+	int tpg_vc1_dt_3_cfg_0;
+	int tpg_vc1_dt_3_cfg_1;
+	int tpg_vc1_dt_3_cfg_2;
+	int tpg_vc1_throttle;
+	int tpg_vc1_color_bar_cfa_color0;
+	int tpg_vc1_color_bar_cfa_color1;
+	int tpg_vc1_color_bar_cfa_color2;
+	int tpg_vc1_color_bar_cfa_color3;
+	int tpg_vc2_gain_cfg;
+	int tpg_vc2_shdr_cfg;
+	int tpg_vc2_cfg0;
+	int tpg_vc2_lfsr_seed;
+	int tpg_vc2_hbi_cfg;
+	int tpg_vc2_vbi_cfg;
+	int tpg_vc2_color_bars_cfg;
+	int tpg_vc2_dt_0_cfg_0;
+	int tpg_vc2_dt_0_cfg_1;
+	int tpg_vc2_dt_0_cfg_2;
+	int tpg_vc2_dt_1_cfg_0;
+	int tpg_vc2_dt_1_cfg_1;
+	int tpg_vc2_dt_1_cfg_2;
+	int tpg_vc2_dt_2_cfg_0;
+	int tpg_vc2_dt_2_cfg_1;
+	int tpg_vc2_dt_2_cfg_2;
+	int tpg_vc2_dt_3_cfg_0;
+	int tpg_vc2_dt_3_cfg_1;
+	int tpg_vc2_dt_3_cfg_2;
+	int tpg_vc2_throttle;
+	int tpg_vc2_color_bar_cfa_color0;
+	int tpg_vc2_color_bar_cfa_color1;
+	int tpg_vc2_color_bar_cfa_color2;
+	int tpg_vc2_color_bar_cfa_color3;
+	int tpg_vc3_gain_cfg;
+	int tpg_vc3_shdr_cfg;
+	int tpg_vc3_cfg0;
+	int tpg_vc3_lfsr_seed;
+	int tpg_vc3_hbi_cfg;
+	int tpg_vc3_vbi_cfg;
+	int tpg_vc3_color_bars_cfg;
+	int tpg_vc3_dt_0_cfg_0;
+	int tpg_vc3_dt_0_cfg_1;
+	int tpg_vc3_dt_0_cfg_2;
+	int tpg_vc3_dt_1_cfg_0;
+	int tpg_vc3_dt_1_cfg_1;
+	int tpg_vc3_dt_1_cfg_2;
+	int tpg_vc3_dt_2_cfg_0;
+	int tpg_vc3_dt_2_cfg_1;
+	int tpg_vc3_dt_2_cfg_2;
+	int tpg_vc3_dt_3_cfg_0;
+	int tpg_vc3_dt_3_cfg_1;
+	int tpg_vc3_dt_3_cfg_2;
+	int tpg_vc3_throttle;
+	int tpg_vc3_color_bar_cfa_color0;
+	int tpg_vc3_color_bar_cfa_color1;
+	int tpg_vc3_color_bar_cfa_color2;
+	int tpg_vc3_color_bar_cfa_color3;
+	int top_irq_status;
+	int top_irq_mask;
+	int top_irq_clear;
+	int top_irq_set;
+	int irq_cmd;
+	int tpg_ctrl_cmd;
+	int test_bus_ctrl;
+	int spare;
+	/* Register fields below */
+
+	int gen_shift;
+	int rev_shift;
+	int step_shift;
+	int violation_shift;
+	int auto_load_pattern_shift;
+	int auto_load_en_shift;
+	int addr_shift;
+	int lut_sel_shift;
+	int data_shift;
+	int auto_load_status_clr_shift;
+	int auto_load_cmd_shift;
+	int auto_load_done_shift;
+	int bank_sel_shift;
+	int gain_shift;
+	int num_active_vc_shift;
+	int overlap_shdr_en_shift;
+	int vc_dt_pattern_id_shift;
+	int num_active_lanes_shift;
+	int phy_sel_shift;
+	int num_frames_shift;
+	int num_batch_shift;
+	int num_active_dt_shift;
+	int fe_dis_shift;
+	int fs_dis_shift;
+	int vc_num_shift;
+	int seed_shift;
+	int hbi_clk_cnt_shift;
+	int vbi_line_cnt_shift;
+	int size_y_shift;
+	int size_x_shift;
+	int xcfa_en_shift;
+	int rotate_period_shift;
+	int pix_intl_hdr_mode_shift;
+	int noise_en_shift;
+	int split_en_shift;
+	int qcfa_en_shift;
+	int pix_pattern_shift;
+	int frame_width_shift;
+	int frame_height_shift;
+	int crc_xor_mask_shift;
+	int ecc_xor_mask_shift;
+	int nfi_ssm_mode_en_shift;
+	int data_type_shift;
+	int encode_format_shift;
+	int user_specified_payload_shift;
+	int payload_mode_shift;
+	int pattern_shift;
+	int array15_shift;
+	int array14_shift;
+	int array13_shift;
+	int array12_shift;
+	int array11_shift;
+	int array10_shift;
+	int array9_shift;
+	int array8_shift;
+	int array7_shift;
+	int array6_shift;
+	int array5_shift;
+	int array4_shift;
+	int array3_shift;
+	int array2_shift;
+	int array1_shift;
+	int array0_shift;
+	int array31_shift;
+	int array30_shift;
+	int array29_shift;
+	int array28_shift;
+	int array27_shift;
+	int array26_shift;
+	int array25_shift;
+	int array24_shift;
+	int array23_shift;
+	int array22_shift;
+	int array21_shift;
+	int array20_shift;
+	int array19_shift;
+	int array18_shift;
+	int array17_shift;
+	int array16_shift;
+	int array47_shift;
+	int array46_shift;
+	int array45_shift;
+	int array44_shift;
+	int array43_shift;
+	int array42_shift;
+	int array41_shift;
+	int array40_shift;
+	int array39_shift;
+	int array38_shift;
+	int array37_shift;
+	int array36_shift;
+	int array35_shift;
+	int array34_shift;
+	int array33_shift;
+	int array32_shift;
+	int array63_shift;
+	int array62_shift;
+	int array61_shift;
+	int array60_shift;
+	int array59_shift;
+	int array58_shift;
+	int array57_shift;
+	int array56_shift;
+	int array55_shift;
+	int array54_shift;
+	int array53_shift;
+	int array52_shift;
+	int array51_shift;
+	int array50_shift;
+	int array49_shift;
+	int array48_shift;
+	int shdr_offset_num_batch_shift;
+	int shdr_line_offset1_shift;
+	int shdr_line_offset0_shift;
+	int tpg_done_status_shift;
+	int rup_done_status_shift;
+	int status_vec_shift;
+	int rup_done_mask_vec_shift;
+	int tpg_done_mask_vec_shift;
+	int rup_done_clear_vec_shift;
+	int tpg_done_clear_vec_shift;
+	int set_vec_shift;
+	int set_shift;
+	int clear_shift;
+	int test_en_cmd_shift;
+	int hw_reset_shift;
+	int test_bus_en_shift;
+	int test_bus_sel_shift;
+	int spare_shift;
+	/* Custome Variables below */
+};
+
+/**
+ * @brief initialize the tpg hw instance
+ *
+ * @param hw   : tpg hw instance
+ * @param data : argument for initialize
+ *
+ * @return     : 0 on success
+ */
+int tpg_hw_v_1_4_init(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief start tpg hw
+ *
+ * @param hw    : tpg hw instance
+ * @param data  : tpg hw instance data
+ *
+ * @return      : 0 on success
+ */
+int tpg_hw_v_1_4_start(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief stop tpg hw
+ *
+ * @param hw   : tpg hw instance
+ * @param data : argument for tpg hw stop
+ *
+ * @return     : 0 on success
+ */
+int tpg_hw_v_1_4_stop(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief process a command send from hw layer
+ *
+ * @param hw  : tpg hw instance
+ * @param cmd : command to process
+ * @param arg : argument corresponding to command
+ *
+ * @return    : 0 on success
+ */
+int tpg_hw_v_1_4_process_cmd(struct tpg_hw *hw,
+		uint32_t cmd, void *arg);
+
+/**
+ * @brief  dump hw status registers
+ *
+ * @param hw   : tpg hw instance
+ * @param data : argument for status dump
+ *
+ * @return     : 0 on success
+ */
+int tpg_hw_v_1_4_dump_status(struct tpg_hw *hw, void *data);
+
+/**
+ * @brief  hw layer initialization
+ *
+ * @param hw   : tpg hw instance
+ *
+ * @return     : 0 on success
+ */
+int tpg_1_4_layer_init(struct tpg_hw *hw);
+
+/**
+ * @brief handle tpg irq
+ *
+ * @param hw   : tpg hw instance
+ *
+ * @return     : IRQ_HANDLED on success
+ */
+irqreturn_t tpg_hw_v_1_4_handle_irq(struct tpg_hw *hw);
+
+#endif /* __TPG_HW_V_1_4_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4_0.h
@@ -0,0 +1,275 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __TPG_HW_V_1_4_0_H__
+#define __TPG_HW_V_1_4_0_H__
+
+
+struct cam_tpg_ver_1_4_reg_offset cam_tpg104_reg = {
+	/* Register offsets below */
+	.hw_version = 0x0,
+	.hw_status = 0x4,
+	.dmi_cfg = 0x8,
+	.dmi_lut_cfg = 0xc,
+	.dmi_data = 0x10,
+	.dmi_data_1 = 0x14,
+	.dmi_data_2 = 0x18,
+	.dmi_data_3 = 0x1c,
+	.dmi_data_4 = 0x20,
+	.dmi_data_5 = 0x24,
+	.dmi_data_6 = 0x28,
+	.dmi_data_7 = 0x2c,
+	.dmi_data_8 = 0x30,
+	.dmi_data_9 = 0x34,
+	.dmi_data_10 = 0x38,
+	.dmi_data_11 = 0x3c,
+	.dmi_data_12 = 0x40,
+	.dmi_data_13 = 0x44,
+	.dmi_data_14 = 0x48,
+	.dmi_data_15 = 0x4c,
+	.dmi_cmd = 0x50,
+	.dmi_status = 0x54,
+	.dmi_lut_bank_cfg = 0x58,
+	.module_lut_bank_cfg = 0x5c,
+	.tpg_vc0_gain_cfg = 0x60,
+	.tpg_ctrl = 0x64,
+	.tpg_vc0_cfg0 = 0x68,
+	.tpg_vc0_lfsr_seed = 0x6c,
+	.tpg_vc0_hbi_cfg = 0x70,
+	.tpg_vc0_vbi_cfg = 0x74,
+	.tpg_vc0_color_bars_cfg = 0x78,
+	.tpg_vc0_dt_0_cfg_0 = 0x7c,
+	.tpg_vc0_dt_0_cfg_1 = 0x80,
+	.tpg_vc0_dt_0_cfg_2 = 0x84,
+	.tpg_vc0_dt_1_cfg_0 = 0x88,
+	.tpg_vc0_dt_1_cfg_1 = 0x8c,
+	.tpg_vc0_dt_1_cfg_2 = 0x90,
+	.tpg_vc0_dt_2_cfg_0 = 0x94,
+	.tpg_vc0_dt_2_cfg_1 = 0x98,
+	.tpg_vc0_dt_2_cfg_2 = 0x9c,
+	.tpg_vc0_dt_3_cfg_0 = 0xa0,
+	.tpg_vc0_dt_3_cfg_1 = 0xa4,
+	.tpg_vc0_dt_3_cfg_2 = 0xa8,
+	.tpg_vc0_throttle = 0xac,
+	.tpg_vc0_color_bar_cfa_color0 = 0xb0,
+	.tpg_vc0_color_bar_cfa_color1 = 0xb4,
+	.tpg_vc0_color_bar_cfa_color2 = 0xb8,
+	.tpg_vc0_color_bar_cfa_color3 = 0xbc,
+	.tpg_vc1_gain_cfg = 0xc0,
+	.tpg_vc1_shdr_cfg = 0xc4,
+	.tpg_vc1_cfg0 = 0xc8,
+	.tpg_vc1_lfsr_seed = 0xcc,
+	.tpg_vc1_hbi_cfg = 0xd0,
+	.tpg_vc1_vbi_cfg = 0xd4,
+	.tpg_vc1_color_bars_cfg = 0xd8,
+	.tpg_vc1_dt_0_cfg_0 = 0xdc,
+	.tpg_vc1_dt_0_cfg_1 = 0xe0,
+	.tpg_vc1_dt_0_cfg_2 = 0xe4,
+	.tpg_vc1_dt_1_cfg_0 = 0xe8,
+	.tpg_vc1_dt_1_cfg_1 = 0xec,
+	.tpg_vc1_dt_1_cfg_2 = 0xf0,
+	.tpg_vc1_dt_2_cfg_0 = 0xf4,
+	.tpg_vc1_dt_2_cfg_1 = 0xf8,
+	.tpg_vc1_dt_2_cfg_2 = 0xfc,
+	.tpg_vc1_dt_3_cfg_0 = 0x100,
+	.tpg_vc1_dt_3_cfg_1 = 0x104,
+	.tpg_vc1_dt_3_cfg_2 = 0x108,
+	.tpg_vc1_throttle = 0x10c,
+	.tpg_vc1_color_bar_cfa_color0 = 0x110,
+	.tpg_vc1_color_bar_cfa_color1 = 0x114,
+	.tpg_vc1_color_bar_cfa_color2 = 0x118,
+	.tpg_vc1_color_bar_cfa_color3 = 0x11c,
+	.tpg_vc2_gain_cfg = 0x120,
+	.tpg_vc2_shdr_cfg = 0x124,
+	.tpg_vc2_cfg0 = 0x128,
+	.tpg_vc2_lfsr_seed = 0x12c,
+	.tpg_vc2_hbi_cfg = 0x130,
+	.tpg_vc2_vbi_cfg = 0x134,
+	.tpg_vc2_color_bars_cfg = 0x138,
+	.tpg_vc2_dt_0_cfg_0 = 0x13c,
+	.tpg_vc2_dt_0_cfg_1 = 0x140,
+	.tpg_vc2_dt_0_cfg_2 = 0x144,
+	.tpg_vc2_dt_1_cfg_0 = 0x148,
+	.tpg_vc2_dt_1_cfg_1 = 0x14c,
+	.tpg_vc2_dt_1_cfg_2 = 0x150,
+	.tpg_vc2_dt_2_cfg_0 = 0x154,
+	.tpg_vc2_dt_2_cfg_1 = 0x158,
+	.tpg_vc2_dt_2_cfg_2 = 0x15c,
+	.tpg_vc2_dt_3_cfg_0 = 0x160,
+	.tpg_vc2_dt_3_cfg_1 = 0x164,
+	.tpg_vc2_dt_3_cfg_2 = 0x168,
+	.tpg_vc2_throttle = 0x16c,
+	.tpg_vc2_color_bar_cfa_color0 = 0x170,
+	.tpg_vc2_color_bar_cfa_color1 = 0x174,
+	.tpg_vc2_color_bar_cfa_color2 = 0x178,
+	.tpg_vc2_color_bar_cfa_color3 = 0x17c,
+	.tpg_vc3_gain_cfg = 0x180,
+	.tpg_vc3_shdr_cfg = 0x184,
+	.tpg_vc3_cfg0 = 0x188,
+	.tpg_vc3_lfsr_seed = 0x18c,
+	.tpg_vc3_hbi_cfg = 0x190,
+	.tpg_vc3_vbi_cfg = 0x194,
+	.tpg_vc3_color_bars_cfg = 0x198,
+	.tpg_vc3_dt_0_cfg_0 = 0x19c,
+	.tpg_vc3_dt_0_cfg_1 = 0x1a0,
+	.tpg_vc3_dt_0_cfg_2 = 0x1a4,
+	.tpg_vc3_dt_1_cfg_0 = 0x1a8,
+	.tpg_vc3_dt_1_cfg_1 = 0x1ac,
+	.tpg_vc3_dt_1_cfg_2 = 0x1b0,
+	.tpg_vc3_dt_2_cfg_0 = 0x1b4,
+	.tpg_vc3_dt_2_cfg_1 = 0x1b8,
+	.tpg_vc3_dt_2_cfg_2 = 0x1bc,
+	.tpg_vc3_dt_3_cfg_0 = 0x1c0,
+	.tpg_vc3_dt_3_cfg_1 = 0x1c4,
+	.tpg_vc3_dt_3_cfg_2 = 0x1c8,
+	.tpg_vc3_throttle = 0x1cc,
+	.tpg_vc3_color_bar_cfa_color0 = 0x1d0,
+	.tpg_vc3_color_bar_cfa_color1 = 0x1d4,
+	.tpg_vc3_color_bar_cfa_color2 = 0x1d8,
+	.tpg_vc3_color_bar_cfa_color3 = 0x1dc,
+	.top_irq_status = 0x1e0,
+	.top_irq_mask = 0x1e4,
+	.top_irq_clear = 0x1e8,
+	.top_irq_set = 0x1ec,
+	.irq_cmd = 0x1f0,
+	.tpg_ctrl_cmd = 0x1f4,
+	.test_bus_ctrl = 0x1f8,
+	.spare = 0x1fc,
+
+	/* Register fields below */
+	.gen_shift = 0x1c,
+	.rev_shift = 0x10,
+	.step_shift = 0x0,
+	.violation_shift = 0x0,
+	.auto_load_pattern_shift = 0x15,
+	.auto_load_en_shift = 0x14,
+	.addr_shift = 0x0,
+	.lut_sel_shift = 0x0,
+	.data_shift = 0x0,
+	.auto_load_status_clr_shift = 0x1,
+	.auto_load_cmd_shift = 0x0,
+	.auto_load_done_shift = 0x0,
+	.bank_sel_shift = 0x0,
+	.gain_shift = 0x0,
+	.num_active_vc_shift = 0x1e,
+	.overlap_shdr_en_shift = 0xa,
+	.vc_dt_pattern_id_shift = 0x6,
+	.num_active_lanes_shift = 0x4,
+	.phy_sel_shift = 0x3,
+	.num_frames_shift = 0x10,
+	.num_batch_shift = 0xc,
+	.num_active_dt_shift = 0x8,
+	.fe_dis_shift = 0x7,
+	.fs_dis_shift = 0x6,
+	.vc_num_shift = 0x0,
+	.seed_shift = 0x0,
+	.hbi_clk_cnt_shift = 0x0,
+	.vbi_line_cnt_shift = 0x0,
+	.size_y_shift = 0x1c,
+	.size_x_shift = 0x18,
+	.xcfa_en_shift = 0x10,
+	.rotate_period_shift = 0x8,
+	.pix_intl_hdr_mode_shift = 0x6,
+	.noise_en_shift = 0x5,
+	.split_en_shift = 0x4,
+	.qcfa_en_shift = 0x3,
+	.pix_pattern_shift = 0x0,
+	.frame_width_shift = 0x10,
+	.frame_height_shift = 0x0,
+	.crc_xor_mask_shift = 0x10,
+	.ecc_xor_mask_shift = 0x8,
+	.nfi_ssm_mode_en_shift = 0x7,
+	.data_type_shift = 0x0,
+	.encode_format_shift = 0x1c,
+	.user_specified_payload_shift = 0x4,
+	.payload_mode_shift = 0x0,
+	.pattern_shift = 0x0,
+	.array15_shift = 0x1e,
+	.array14_shift = 0x1c,
+	.array13_shift = 0x1a,
+	.array12_shift = 0x18,
+	.array11_shift = 0x16,
+	.array10_shift = 0x14,
+	.array9_shift = 0x12,
+	.array8_shift = 0x10,
+	.array7_shift = 0xe,
+	.array6_shift = 0xc,
+	.array5_shift = 0xa,
+	.array4_shift = 0x8,
+	.array3_shift = 0x6,
+	.array2_shift = 0x4,
+	.array1_shift = 0x2,
+	.array0_shift = 0x0,
+	.array31_shift = 0x1e,
+	.array30_shift = 0x1c,
+	.array29_shift = 0x1a,
+	.array28_shift = 0x18,
+	.array27_shift = 0x16,
+	.array26_shift = 0x14,
+	.array25_shift = 0x12,
+	.array24_shift = 0x10,
+	.array23_shift = 0xe,
+	.array22_shift = 0xc,
+	.array21_shift = 0xa,
+	.array20_shift = 0x8,
+	.array19_shift = 0x6,
+	.array18_shift = 0x4,
+	.array17_shift = 0x2,
+	.array16_shift = 0x0,
+	.array47_shift = 0x1e,
+	.array46_shift = 0x1c,
+	.array45_shift = 0x1a,
+	.array44_shift = 0x18,
+	.array43_shift = 0x16,
+	.array42_shift = 0x14,
+	.array41_shift = 0x12,
+	.array40_shift = 0x10,
+	.array39_shift = 0xe,
+	.array38_shift = 0xc,
+	.array37_shift = 0xa,
+	.array36_shift = 0x8,
+	.array35_shift = 0x6,
+	.array34_shift = 0x4,
+	.array33_shift = 0x2,
+	.array32_shift = 0x0,
+	.array63_shift = 0x1e,
+	.array62_shift = 0x1c,
+	.array61_shift = 0x1a,
+	.array60_shift = 0x18,
+	.array59_shift = 0x16,
+	.array58_shift = 0x14,
+	.array57_shift = 0x12,
+	.array56_shift = 0x10,
+	.array55_shift = 0xe,
+	.array54_shift = 0xc,
+	.array53_shift = 0xa,
+	.array52_shift = 0x8,
+	.array51_shift = 0x6,
+	.array50_shift = 0x4,
+	.array49_shift = 0x2,
+	.array48_shift = 0x0,
+	.shdr_offset_num_batch_shift = 0x10,
+	.shdr_line_offset1_shift = 0x10,
+	.shdr_line_offset0_shift = 0x0,
+	.tpg_done_status_shift = 0x0,
+	.rup_done_status_shift = 0x1,
+	.status_vec_shift = 0x0,
+	.rup_done_mask_vec_shift = 0x1,
+	.tpg_done_mask_vec_shift = 0x0,
+	.rup_done_clear_vec_shift = 0x1,
+	.tpg_done_clear_vec_shift = 0x0,
+	.set_vec_shift = 0x0,
+	.set_shift = 0x4,
+	.clear_shift = 0x0,
+	.test_en_cmd_shift = 0x4,
+	.hw_reset_shift = 0x0,
+	.test_bus_en_shift = 0x0,
+	.test_bus_sel_shift = 0x4,
+	.spare_shift = 0x0,
+
+	/* Custome Variables below */
+};
+
+#endif /* __TPG_HW_V_1_4_0_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4_data.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw_v_1_4/tpg_hw_v_1_4_data.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __TPG_HW_V_1_4_DATA_H__
+#define __TPG_HW_V_1_4_DATA_H__
+
+#include "../tpg_hw.h"
+#include "../tpg_hw_common.h"
+#include "tpg_hw_v_1_4.h"
+#include "tpg_hw_v_1_4_0.h"
+
+struct tpg_hw_ops tpg_hw_v_1_4_ops = {
+	.start = tpg_hw_v_1_4_start,
+	.stop  = tpg_hw_v_1_4_stop,
+	.init  = tpg_hw_v_1_4_init,
+	.process_cmd = tpg_hw_v_1_4_process_cmd,
+	.dump_status = tpg_hw_v_1_4_dump_status,
+	.write_settings = tpg_hw_write_settings,
+	.handle_irq  = tpg_hw_v_1_4_handle_irq,
+};
+
+struct tpg_hw_info tpg_v_1_4_hw_info = {
+	.version = TPG_HW_VERSION_1_4,
+	.max_vc_channels = 4,
+	.max_dt_channels_per_vc = 4,
+	.ops = &tpg_hw_v_1_4_ops,
+	.hw_data = &cam_tpg104_reg,
+	.layer_init = &tpg_1_4_layer_init,
+	.xcfa_debug = 0,
+	.shdr_overlap = 0,
+	.shdr_offset_num_batch = 0,
+	.shdr_line_offset0 = 0x6c,
+	.shdr_line_offset1 = 0x6c,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_smmu/cam_smmu_api.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_smmu/cam_smmu_api.c
@@ -0,0 +1,5785 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/dma-buf.h>
+#include <linux/dma-direction.h>
+#include <linux/of_platform.h>
+#include <linux/iommu.h>
+#include <linux/slab.h>
+#include <linux/dma-mapping.h>
+#include <linux/of_address.h>
+#include <linux/msm_dma_iommu_mapping.h>
+#include <linux/workqueue.h>
+#include <linux/genalloc.h>
+#include <linux/debugfs.h>
+
+#include <soc/qcom/secure_buffer.h>
+
+#include <media/cam_req_mgr.h>
+
+#include "cam_compat.h"
+#include "cam_smmu_api.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+
+#define SHARED_MEM_POOL_GRANULARITY 16
+
+#define IOMMU_INVALID_DIR -1
+#define HANDLE_INIT (-1)
+#define CAM_SMMU_CB_MAX 6
+#define CAM_SMMU_SHARED_HDL_MAX 6
+#define CAM_SMMU_MULTI_REGION_MAX 2
+
+#define GET_SMMU_HDL(x, y) (((x) << COOKIE_SIZE) | ((y) & COOKIE_MASK))
+#define GET_SMMU_MULTI_CLIENT_IDX(x) (((x) >> MULTI_CLIENT_REGION_SHIFT))
+#define CAM_SMMU_HDL_VALIDATE(x, y) ((x) != ((y) & CAM_SMMU_HDL_MASK))
+
+#define CAM_SMMU_MONITOR_MAX_ENTRIES   100
+#define CAM_SMMU_BUF_TRACKING_POOL     600
+#define CAM_SMMU_INC_MONITOR_HEAD(head, ret) \
+	div_u64_rem(atomic64_add_return(1, head),\
+	CAM_SMMU_MONITOR_MAX_ENTRIES, (ret))
+
+static int g_num_pf_handled = 1;
+module_param(g_num_pf_handled, int, 0644);
+
+struct cam_fw_alloc_info icp_fw;
+struct cam_smmu_buffer_tracker *buf_tracking_pool;
+
+struct cam_smmu_work_payload {
+	int idx;
+	struct iommu_domain *domain;
+	struct device *dev;
+	unsigned long iova;
+	int flags;
+	void *token;
+	struct list_head list;
+};
+
+enum cam_io_coherency_mode {
+	CAM_SMMU_NO_COHERENCY,
+	CAM_SMMU_DMA_COHERENT,
+	CAM_SMMU_DMA_COHERENT_HINT_CACHED,
+};
+
+enum cam_protection_type {
+	CAM_PROT_INVALID,
+	CAM_NON_SECURE,
+	CAM_SECURE,
+	CAM_PROT_MAX,
+};
+
+enum cam_iommu_type {
+	CAM_SMMU_INVALID,
+	CAM_QSMMU,
+	CAM_ARM_SMMU,
+	CAM_SMMU_MAX,
+};
+
+enum cam_smmu_buf_state {
+	CAM_SMMU_BUFF_EXIST,
+	CAM_SMMU_BUFF_NOT_EXIST,
+};
+
+enum cam_smmu_init_dir {
+	CAM_SMMU_TABLE_INIT,
+	CAM_SMMU_TABLE_DEINIT,
+};
+
+struct scratch_mapping {
+	void *bitmap;
+	size_t bits;
+	unsigned int order;
+	dma_addr_t base;
+};
+
+struct cam_smmu_monitor {
+	struct timespec64       timestamp;
+	bool                    is_map;
+
+	/* map-unmap info */
+	int                     ion_fd;
+	unsigned long           i_ino;
+	dma_addr_t              paddr;
+	size_t                  len;
+	enum cam_smmu_region_id region_id;
+};
+
+struct cam_smmu_debug {
+	struct dentry *dentry;
+	uint32_t fatal_pf_mask;
+	bool cb_dump_enable;
+	bool map_profile_enable;
+	bool disable_buf_tracking;
+};
+
+struct cam_smmu_subregion_info {
+	enum cam_smmu_subregion_id  subregion_id;
+	struct cam_smmu_region_info subregion_info;
+
+	int32_t mapped_refcnt;
+	unsigned long mapped_client_mask;
+	bool is_allocated;
+};
+
+struct cam_smmu_nested_region_info {
+	uint32_t num_subregions;
+	struct cam_smmu_subregion_info subregions[
+		CAM_SMMU_SUBREGION_MAX];
+	struct cam_smmu_region_info region_info;
+
+	int32_t mapped_refcnt;
+	unsigned long mapped_client_mask;
+	bool is_allocated;
+	bool subregion_support;
+};
+
+/*
+ * This struct holds info on multiple regions of the
+ * same type, and each such region can have multiple
+ * unique subregions
+ *
+ * A0 --> a : b : c
+ * A1 --> a : c
+ *
+ * Here A0 & A1 are 2 umbrella regions of the same type,
+ * and a, b & c are the subregions within them
+ */
+struct cam_smmu_multi_region_info {
+	int32_t num_regions;
+	struct cam_smmu_nested_region_info nested_regions[CAM_SMMU_MULTI_REGION_MAX];
+};
+
+struct cam_context_bank_info {
+	struct device *dev;
+	struct iommu_domain *domain;
+	dma_addr_t va_start;
+	size_t va_len;
+	const char *name[CAM_SMMU_SHARED_HDL_MAX];
+	bool is_secure;
+	uint8_t scratch_buf_support;
+	uint8_t firmware_support;
+	uint8_t shared_support;
+	uint8_t io_support;
+	uint8_t secheap_support;
+	uint8_t fwuncached_region_support;
+	uint8_t qdss_support;
+	uint8_t device_region_support;
+	dma_addr_t qdss_phy_addr;
+	bool is_fw_allocated;
+	bool is_secheap_allocated;
+	bool is_qdss_allocated;
+	bool non_fatal_faults_en;
+	bool stall_disable_en;
+
+	struct scratch_mapping scratch_map;
+	struct gen_pool *shared_mem_pool[CAM_SMMU_MULTI_REGION_MAX];
+
+	/* Regular singleton regions */
+	struct cam_smmu_region_info scratch_info;
+	struct cam_smmu_region_info firmware_info;
+	struct cam_smmu_region_info secheap_info;
+
+	/* Regions capable of having multiple of them */
+	struct cam_smmu_multi_region_info shared_info;
+	struct cam_smmu_multi_region_info io_info;
+	struct cam_smmu_multi_region_info fwuncached_region;
+	struct cam_smmu_multi_region_info device_region;
+	struct cam_smmu_multi_region_info qdss_info;
+
+	struct list_head smmu_buf_list;
+	struct list_head smmu_buf_kernel_list;
+	struct mutex lock;
+	int handle;
+	enum cam_smmu_ops_param state;
+
+	void (*handler[CAM_SMMU_CB_MAX]) (struct cam_smmu_pf_info  *pf_info);
+	void *token[CAM_SMMU_CB_MAX];
+	int cb_count;
+	int secure_count;
+	int pf_count;
+	size_t io_mapping_size;
+	size_t shared_mapping_size;
+	bool is_mul_client;
+	int device_count;
+	int num_shared_hdl;
+	int num_multi_regions;
+	const char *multi_region_clients[CAM_SMMU_MULTI_REGION_MAX];
+	enum cam_io_coherency_mode coherency_mode;
+
+	/* discard iova - non-zero values are valid */
+	dma_addr_t discard_iova_start;
+	size_t discard_iova_len;
+
+	atomic64_t monitor_head;
+	struct cam_smmu_monitor monitor_entries[CAM_SMMU_MONITOR_MAX_ENTRIES];
+};
+
+struct cam_iommu_cb_set {
+	struct cam_context_bank_info *cb_info;
+	u32 cb_num;
+	u32 cb_init_count;
+	struct work_struct smmu_work;
+	struct mutex payload_list_lock;
+	struct list_head payload_list;
+	struct cam_smmu_debug debug_cfg;
+	struct list_head buf_tracker_free_list;
+	struct cam_csf_version csf_version;
+	spinlock_t   s_lock;
+	bool force_cache_allocs;
+	bool need_shared_buffer_padding;
+	bool is_expanded_memory;
+	bool is_track_buf_disabled;
+};
+
+static const struct of_device_id msm_cam_smmu_dt_match[] = {
+	{ .compatible = "qcom,msm-cam-smmu", },
+	{ .compatible = "qcom,msm-cam-smmu-cb", },
+	{ .compatible = "qcom,msm-cam-smmu-fw-dev", },
+	{}
+};
+
+struct cam_dma_buff_info {
+	struct dma_buf *buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *table;
+	enum dma_data_direction dir;
+	enum cam_smmu_region_id region_id;
+	int iommu_dir;
+	int map_count;
+	struct kref ref_count;
+	dma_addr_t paddr;
+	struct list_head list;
+	int ion_fd;
+	unsigned long i_ino;
+	size_t len;
+	size_t phys_len;
+	bool is_internal;
+	struct timespec64 ts;
+};
+
+struct cam_sec_buff_info {
+	struct dma_buf *buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *table;
+	enum dma_data_direction dir;
+	int map_count;
+	struct kref ref_count;
+	dma_addr_t paddr;
+	struct list_head list;
+	int ion_fd;
+	unsigned long i_ino;
+	size_t len;
+};
+
+struct cam_smmu_mini_dump_cb_info {
+	struct cam_smmu_monitor mapping[CAM_SMMU_MONITOR_MAX_ENTRIES];
+	struct cam_smmu_region_info scratch_info;
+	struct cam_smmu_region_info firmware_info;
+	struct cam_smmu_region_info shared_info;
+	struct cam_smmu_region_info io_info;
+	struct cam_smmu_region_info secheap_info;
+	struct cam_smmu_region_info fwuncached_region;
+	struct cam_smmu_region_info device_mem_region;
+	struct cam_smmu_region_info qdss_info;
+	struct region_buf_info secheap_buf;
+	struct region_buf_info fwuncached_reg_buf;
+	char   name[CAM_SMMU_SHARED_HDL_MAX][16];
+	size_t va_len;
+	size_t io_mapping_size;
+	size_t shared_mapping_size;
+	size_t discard_iova_len;
+	int handle;
+	int device_count;
+	int num_shared_hdl;
+	int cb_count;
+	int secure_count;
+	int pf_count;
+	dma_addr_t va_start;
+	dma_addr_t discard_iova_start;
+	dma_addr_t qdss_phy_addr;
+	enum cam_io_coherency_mode coherency_mode;
+	enum cam_smmu_ops_param state;
+	uint8_t scratch_buf_support;
+	uint8_t firmware_support;
+	uint8_t shared_support;
+	uint8_t io_support;
+	uint8_t secheap_support;
+	uint8_t fwuncached_region_support;
+	uint8_t qdss_support;
+	bool is_mul_client;
+	bool is_secure;
+	bool is_fw_allocated;
+	bool is_secheap_allocated;
+	bool is_fwuncached_buf_allocated;
+	bool is_qdss_allocated;
+};
+
+struct cam_smmu_mini_dump_info {
+	uint32_t cb_num;
+	struct   cam_smmu_mini_dump_cb_info *cb;
+};
+
+static struct cam_iommu_cb_set iommu_cb_set;
+
+static enum dma_data_direction cam_smmu_translate_dir(
+	enum cam_smmu_map_dir dir);
+
+static bool cam_smmu_is_hdl_nonunique_or_null(int hdl);
+
+static int cam_smmu_create_iommu_handle(int idx);
+
+static int cam_smmu_create_add_handle_in_table(char *name,
+	int *hdl);
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_ion_index(int idx,
+	int ion_fd, struct dma_buf *dma_buf);
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_dma_buf(int idx,
+	struct dma_buf *buf);
+
+static struct cam_sec_buff_info *cam_smmu_find_mapping_by_sec_buf_idx(int idx,
+	int ion_fd, struct dma_buf *dma_buf);
+
+static int cam_smmu_init_scratch_map(struct scratch_mapping *scratch_map,
+	dma_addr_t base, size_t size,
+	int order);
+
+static int cam_smmu_alloc_scratch_va(struct scratch_mapping *mapping,
+	size_t size,
+	dma_addr_t *iova);
+
+static int cam_smmu_free_scratch_va(struct scratch_mapping *mapping,
+	dma_addr_t addr, size_t size);
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_virt_address(int idx,
+	dma_addr_t virt_addr);
+
+static int cam_smmu_map_buffer_and_add_to_list(int idx, int ion_fd,
+	bool dis_delayed_unmap, enum dma_data_direction dma_dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id, bool is_internal, struct dma_buf *dmabuf,
+	struct kref **ref_count);
+
+static int cam_smmu_map_kernel_buffer_and_add_to_list(int idx,
+	struct dma_buf *buf, enum dma_data_direction dma_dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id);
+
+static int cam_smmu_alloc_scratch_buffer_add_to_list(int idx,
+	size_t virt_len,
+	size_t phys_len,
+	unsigned int iommu_dir,
+	dma_addr_t *virt_addr);
+
+static int cam_smmu_unmap_buf_and_remove_from_list(
+	struct cam_dma_buff_info *mapping_info, int idx);
+
+static int cam_smmu_free_scratch_buffer_remove_from_list(
+	struct cam_dma_buff_info *mapping_info,
+	int idx);
+
+static void cam_smmu_clean_user_buffer_list(int idx);
+
+static void cam_smmu_clean_kernel_buffer_list(int idx);
+
+static void cam_smmu_dump_cb_info(int idx);
+
+static void cam_smmu_print_user_list(int idx);
+
+static void cam_smmu_print_kernel_list(int idx);
+
+static void cam_smmu_print_table(void);
+
+static int cam_smmu_probe(struct platform_device *pdev);
+
+static uint32_t cam_smmu_find_closest_mapping(int idx, void *vaddr, bool *in_map_region);
+
+static void cam_smmu_update_monitor_array(
+	struct cam_context_bank_info *cb_info,
+	bool is_map,
+	struct cam_dma_buff_info *mapping_info)
+{
+	int iterator;
+
+	CAM_SMMU_INC_MONITOR_HEAD(&cb_info->monitor_head, &iterator);
+
+	CAM_GET_TIMESTAMP(cb_info->monitor_entries[iterator].timestamp);
+
+	cb_info->monitor_entries[iterator].is_map = is_map;
+	cb_info->monitor_entries[iterator].ion_fd = mapping_info->ion_fd;
+	cb_info->monitor_entries[iterator].i_ino = mapping_info->i_ino;
+	cb_info->monitor_entries[iterator].paddr = mapping_info->paddr;
+	cb_info->monitor_entries[iterator].len = mapping_info->len;
+	cb_info->monitor_entries[iterator].region_id = mapping_info->region_id;
+}
+
+static void cam_smmu_dump_monitor_array(
+	struct cam_context_bank_info *cb_info)
+{
+	int i = 0;
+	int64_t state_head = 0;
+	uint32_t index, num_entries, oldest_entry;
+	uint64_t ms, hrs, min, sec;
+
+	state_head = atomic64_read(&cb_info->monitor_head);
+
+	if (state_head == -1) {
+		return;
+	} else if (state_head < CAM_SMMU_MONITOR_MAX_ENTRIES) {
+		num_entries = state_head;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_SMMU_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1,
+			CAM_SMMU_MONITOR_MAX_ENTRIES, &oldest_entry);
+	}
+
+	CAM_INFO(CAM_SMMU,
+		"========Dumping monitor information for cb %s===========",
+		cb_info->name[0]);
+
+	index = oldest_entry;
+
+	for (i = 0; i < num_entries; i++) {
+		CAM_CONVERT_TIMESTAMP_FORMAT(cb_info->monitor_entries[index].timestamp,
+			hrs, min, sec, ms);
+
+		CAM_INFO(CAM_SMMU,
+		"**** %llu:%llu:%llu.%llu : Index[%d] [%s] : ion_fd=%d i_ino=%lu start=0x%llx end=0x%llx len=%zu region=%d",
+		hrs, min, sec, ms,
+		index,
+		cb_info->monitor_entries[index].is_map ? "MAP" : "UNMAP",
+		cb_info->monitor_entries[index].ion_fd,
+		cb_info->monitor_entries[index].i_ino,
+		cb_info->monitor_entries[index].paddr,
+		cb_info->monitor_entries[index].paddr +
+		cb_info->monitor_entries[index].len,
+		cb_info->monitor_entries[index].len,
+		cb_info->monitor_entries[index].region_id);
+
+		index = (index + 1) % CAM_SMMU_MONITOR_MAX_ENTRIES;
+	}
+}
+
+bool cam_smmu_need_shared_buffer_padding(void)
+{
+	return iommu_cb_set.need_shared_buffer_padding;
+}
+
+bool cam_smmu_is_expanded_memory(void)
+{
+	return iommu_cb_set.is_expanded_memory;
+}
+
+int cam_smmu_need_force_alloc_cached(bool *force_alloc_cached)
+{
+	int idx;
+	uint32_t curr_mode = 0, final_mode = 0;
+	bool validate = false;
+
+	if (!force_alloc_cached) {
+		CAM_ERR(CAM_SMMU, "Invalid arg");
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_SMMU, "force_cache_allocs=%d",
+		iommu_cb_set.force_cache_allocs);
+
+	/*
+	 * First validate whether all SMMU CBs are properly setup to comply with
+	 * iommu_cb_set.force_alloc_cached flag.
+	 * This helps as a validation check to make sure a valid DT combination
+	 * is set for a given chipset.
+	 */
+	for (idx = 0; idx < iommu_cb_set.cb_num; idx++) {
+		/* ignore secure cb for now. need to revisit */
+		if (iommu_cb_set.cb_info[idx].is_secure)
+			continue;
+
+		curr_mode = iommu_cb_set.cb_info[idx].coherency_mode;
+
+		/*
+		 * 1. No coherency:
+		 *    We can map both CACHED and UNCACHED buffers into same CB.
+		 *    We need to allocate UNCACHED buffers for Cmdbuffers
+		 *    and Shared Buffers. UNCAHE support must exists with memory
+		 *    allocators (ion or dma-buf-heaps) for CmdBuffers,
+		 *    SharedBuffers to work - as it is difficult to do
+		 *    cache operations on these buffers in camera design.
+		 *    ImageBuffers can be CACHED or UNCACHED. If CACHED, clients
+		 *    need to make required CACHE operations.
+		 *    Cannot force all allocations to CACHE.
+		 * 2. dma-coherent:
+		 *    We cannot map CACHED and UNCACHED buffers into the same CB
+		 *    This means, we must force allocate all buffers to be
+		 *    CACHED.
+		 * 3. dma-coherent-hint-cached
+		 *    We can map both CACHED and UNCACHED buffers into the same
+		 *    CB. So any option is fine force_cache_allocs.
+		 *    Forcing to cache is preferable though.
+		 *
+		 * Other rule we are enforcing is - all camera CBs (except
+		 * secure CB) must have same coherency mode set. Assume one CB
+		 * is having no_coherency mode  and other CB is having
+		 * dma_coherent. For no_coherency CB to work - we must not force
+		 * buffers to be CACHE (exa cmd buffers), for dma_coherent mode
+		 * we must force all buffers to be CACHED. But at the time of
+		 * allocation, we dont know to which CB we will be mapping this
+		 * buffer. So it becomes difficult to generalize cache
+		 * allocations and io coherency mode that we want to support.
+		 * So, to simplify, all camera CBs will have same mode.
+		 */
+
+		CAM_DBG(CAM_SMMU, "[%s] : curr_mode=%d",
+			iommu_cb_set.cb_info[idx].name[0], curr_mode);
+
+		if (curr_mode == CAM_SMMU_NO_COHERENCY) {
+			if (iommu_cb_set.force_cache_allocs) {
+				CAM_ERR(CAM_SMMU,
+					"[%s] Can't force alloc cache with no coherency",
+					iommu_cb_set.cb_info[idx].name[0]);
+				return -EINVAL;
+			}
+		} else if (curr_mode == CAM_SMMU_DMA_COHERENT) {
+			if (!iommu_cb_set.force_cache_allocs) {
+				CAM_ERR(CAM_SMMU,
+					"[%s] Must force cache allocs for dma coherent device",
+					iommu_cb_set.cb_info[idx].name[0]);
+				return -EINVAL;
+			}
+		}
+
+		if (validate) {
+			if (curr_mode !=  final_mode) {
+				CAM_ERR(CAM_SMMU,
+					"[%s] CBs having different coherency modes final=%d, curr=%d",
+					iommu_cb_set.cb_info[idx].name[0],
+					final_mode, curr_mode);
+				return -EINVAL;
+			}
+		} else {
+			validate = true;
+			final_mode = curr_mode;
+		}
+	}
+
+	/*
+	 * To be more accurate - if this flag is TRUE and if this buffer will
+	 * be mapped to external devices like CVP - we need to ensure we do
+	 * one of below :
+	 * 1. CVP CB having dma-coherent or dma-coherent-hint-cached
+	 * 2. camera/cvp sw layers properly doing required cache operations. We
+	 *    cannot anymore assume these buffers (camera <--> cvp) are uncached
+	 */
+	*force_alloc_cached = iommu_cb_set.force_cache_allocs;
+
+	return 0;
+}
+
+static struct cam_smmu_subregion_info *cam_smmu_find_subregion(
+	enum cam_smmu_subregion_id subregion_id,
+	struct cam_smmu_subregion_info *subregions)
+{
+	int i;
+
+	for (i = 0; i < CAM_SMMU_SUBREGION_MAX; i++) {
+		if (subregions[i].subregion_id == subregion_id)
+			return &subregions[i];
+	}
+
+	return NULL;
+}
+
+static int cam_smmu_validate_nested_region_idx(
+	struct cam_context_bank_info *cb_info,
+	int32_t *nested_reg_idx, int32_t region_id)
+{
+	/* Array indexing starts from 0, subtracting number of regions by 1 */
+	switch (region_id) {
+	case CAM_SMMU_REGION_SHARED:
+		if ((*nested_reg_idx) > (cb_info->shared_info.num_regions - 1))
+			goto err;
+
+		break;
+	case CAM_SMMU_REGION_FWUNCACHED:
+		if ((*nested_reg_idx) > (cb_info->fwuncached_region.num_regions - 1))
+			goto err;
+
+		break;
+	/* For device and IO, if there is no additional region, default to index 0 */
+	case CAM_SMMU_REGION_DEVICE:
+		if ((*nested_reg_idx) > (cb_info->device_region.num_regions - 1))
+			*nested_reg_idx = 0;
+
+		break;
+	case CAM_SMMU_REGION_IO:
+		if ((*nested_reg_idx) > (cb_info->io_info.num_regions - 1))
+			*nested_reg_idx = 0;
+
+		break;
+	case CAM_SMMU_REGION_QDSS:
+		fallthrough;
+	case CAM_SMMU_REGION_SECHEAP:
+		fallthrough;
+	case CAM_SMMU_REGION_SCRATCH:
+		*nested_reg_idx = 0;
+		break;
+	default:
+		CAM_DBG(CAM_SMMU,
+			"Invalid region id=%u on cb=%s to get nested region index",
+			region_id, cb_info->name[0]);
+		break;
+	}
+
+	return 0;
+
+err:
+	CAM_ERR(CAM_SMMU,
+		"Nested region idx=%d exceeds max regions=%d for region_id=%d in cb=%s",
+		nested_reg_idx, cb_info->shared_info.num_regions, region_id, cb_info->name[0]);
+	return -EINVAL;
+}
+
+static inline int cam_smmu_get_multiregion_client_dev_idx(
+	struct cam_context_bank_info *cb_info, int32_t multi_client_device_idx,
+	int32_t region_id, int32_t *region_idx)
+{
+	if (cb_info->num_multi_regions && multi_client_device_idx) {
+		*region_idx = multi_client_device_idx;
+		return cam_smmu_validate_nested_region_idx(cb_info, region_idx, region_id);
+	}
+
+	return 0;
+}
+
+static void cam_smmu_page_fault_work(struct work_struct *work)
+{
+	int j;
+	int idx;
+	struct cam_smmu_work_payload *payload;
+	uint32_t buf_info = 0;
+	struct cam_smmu_pf_info pf_info;
+	bool in_map = false;
+
+	mutex_lock(&iommu_cb_set.payload_list_lock);
+	if (list_empty(&iommu_cb_set.payload_list)) {
+		CAM_ERR(CAM_SMMU, "Payload list empty");
+		mutex_unlock(&iommu_cb_set.payload_list_lock);
+		return;
+	}
+
+	payload = list_first_entry(&iommu_cb_set.payload_list,
+		struct cam_smmu_work_payload,
+		list);
+	list_del(&payload->list);
+	mutex_unlock(&iommu_cb_set.payload_list_lock);
+
+	cam_check_iommu_faults(payload->domain, &pf_info);
+
+	/* Dereference the payload to call the handler */
+	idx = payload->idx;
+	/* If fault address is null, found closest buffer is inaccurate */
+	if (payload->iova)
+		buf_info = cam_smmu_find_closest_mapping(idx, (void *)payload->iova, &in_map);
+
+	if (buf_info != 0)
+		CAM_INFO(CAM_SMMU, "closest buf 0x%x idx %d", buf_info, idx);
+
+	pf_info.domain = payload->domain;
+	pf_info.dev    = payload->dev;
+	pf_info.iova  = payload->iova;
+	pf_info.flags = payload->flags;
+	pf_info.buf_info = buf_info;
+	pf_info.is_secure = iommu_cb_set.cb_info[idx].is_secure;
+	pf_info.in_map_region = in_map;
+
+	for (j = 0; j < CAM_SMMU_CB_MAX; j++) {
+		if ((iommu_cb_set.cb_info[idx].handler[j])) {
+			pf_info.token = iommu_cb_set.cb_info[idx].token[j];
+			iommu_cb_set.cb_info[idx].handler[j](&pf_info);
+		}
+	}
+	cam_smmu_dump_cb_info(idx);
+	kfree(payload);
+}
+
+static void cam_smmu_dump_cb_info(int idx)
+{
+	struct cam_dma_buff_info *mapping, *mapping_temp;
+	struct cam_smmu_nested_region_info *nested_reg_info;
+	size_t shared_reg_len = 0, io_reg_len = 0;
+	size_t shared_free_len = 0, io_free_len = 0;
+	int32_t i = 0, j;
+	uint64_t ms, hrs, min, sec;
+	struct timespec64 current_ts;
+	struct cam_context_bank_info *cb_info =
+		&iommu_cb_set.cb_info[idx];
+
+	if (cb_info->shared_support) {
+		for (j = 0; j < cb_info->shared_info.num_regions; j++) {
+			nested_reg_info = &cb_info->shared_info.nested_regions[j];
+			shared_reg_len += nested_reg_info->region_info.iova_len;
+		}
+		shared_free_len = shared_reg_len - cb_info->shared_mapping_size;
+	}
+
+	if (cb_info->io_support) {
+		for (j = 0; j < cb_info->shared_info.num_regions; j++) {
+			nested_reg_info = &cb_info->io_info.nested_regions[j];
+			io_reg_len += nested_reg_info->region_info.iova_len;
+		}
+		io_free_len = io_reg_len - cb_info->io_mapping_size;
+	}
+
+	CAM_GET_TIMESTAMP(current_ts);
+	CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
+
+	CAM_ERR(CAM_SMMU,
+		"********** %llu:%llu:%llu:%llu Context bank dump for %s **********",
+		hrs, min, sec, ms, cb_info->name[0]);
+	CAM_ERR(CAM_SMMU,
+		"Usage: shared_usage=%lu io_usage=%lu shared_free=%lu io_free=%lu",
+		cb_info->shared_mapping_size, cb_info->io_mapping_size,
+		shared_free_len, io_free_len);
+
+	if (iommu_cb_set.debug_cfg.cb_dump_enable) {
+		list_for_each_entry_safe(mapping, mapping_temp,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+			i++;
+			CAM_CONVERT_TIMESTAMP_FORMAT(mapping->ts, hrs, min, sec, ms);
+			CAM_ERR(CAM_SMMU,
+				"%llu:%llu:%llu:%llu: %u ion_fd=%d i_ino=%lu start=0x%lx end=0x%lx len=%lu region=%d",
+				hrs, min, sec, ms, i, mapping->ion_fd, mapping->i_ino,
+				mapping->paddr,
+				((uint64_t)mapping->paddr + (uint64_t)mapping->len),
+				mapping->len, mapping->region_id);
+		}
+
+		cam_smmu_dump_monitor_array(&iommu_cb_set.cb_info[idx]);
+	}
+}
+
+static void cam_smmu_print_user_list(int idx)
+{
+	struct cam_dma_buff_info *mapping;
+
+	CAM_ERR(CAM_SMMU, "index = %d", idx);
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		CAM_ERR(CAM_SMMU,
+			"ion_fd = %d, i_ino=%lu, paddr= 0x%lx, len = %lu, region = %d",
+			mapping->ion_fd, mapping->i_ino, mapping->paddr, mapping->len,
+			mapping->region_id);
+	}
+}
+
+static void cam_smmu_print_kernel_list(int idx)
+{
+	struct cam_dma_buff_info *mapping;
+
+	CAM_ERR(CAM_SMMU, "index = %d", idx);
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list, list) {
+		CAM_ERR(CAM_SMMU,
+			"dma_buf = %pK, i_ino = %lu, paddr= 0x%lx, len = %lu, region = %d",
+			mapping->buf, mapping->i_ino, mapping->paddr,
+			mapping->len, mapping->region_id);
+	}
+}
+
+static void cam_smmu_print_table(void)
+{
+	int i, j;
+
+	for (i = 0; i < iommu_cb_set.cb_num; i++) {
+		for (j = 0; j < iommu_cb_set.cb_info[i].num_shared_hdl; j++) {
+			CAM_ERR(CAM_SMMU,
+				"i= %d, handle= %d, name_addr=%pK name %s",
+				i, (int)iommu_cb_set.cb_info[i].handle,
+				(void *)iommu_cb_set.cb_info[i].name[j],
+				iommu_cb_set.cb_info[i].name[j]);
+		}
+		CAM_ERR(CAM_SMMU, "dev = %pK", iommu_cb_set.cb_info[i].dev);
+	}
+}
+
+static uint32_t cam_smmu_find_closest_mapping(int idx, void *vaddr, bool *in_map_region)
+{
+	struct cam_dma_buff_info *mapping, *closest_mapping =  NULL;
+	unsigned long start_addr, end_addr, current_addr;
+	uint32_t buf_info = 0;
+
+	long delta = 0, lowest_delta = 0;
+
+	current_addr = (unsigned long)vaddr;
+	*in_map_region = false;
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		start_addr = (unsigned long)mapping->paddr;
+		end_addr = (unsigned long)mapping->paddr + mapping->len;
+
+		if (start_addr <= current_addr && current_addr <= end_addr) {
+			closest_mapping = mapping;
+			CAM_INFO(CAM_SMMU,
+				"Found va 0x%lx in:0x%lx-0x%lx, fd %d i_ino %lu cb:%s",
+				current_addr, start_addr,
+				end_addr, mapping->ion_fd, mapping->i_ino,
+				iommu_cb_set.cb_info[idx].name[0]);
+			goto end;
+		} else {
+			if (start_addr > current_addr)
+				delta =  start_addr - current_addr;
+			else
+				delta = current_addr - end_addr - 1;
+
+			if (delta < lowest_delta || lowest_delta == 0) {
+				lowest_delta = delta;
+				closest_mapping = mapping;
+			}
+			CAM_DBG(CAM_SMMU,
+				"approx va %lx not in range: %lx-%lx fd = %0x i_ino %lu",
+				current_addr, start_addr,
+				end_addr, mapping->ion_fd, mapping->i_ino);
+		}
+	}
+
+end:
+	if (closest_mapping) {
+		buf_info = closest_mapping->ion_fd;
+		start_addr = (unsigned long)closest_mapping->paddr;
+		end_addr = (unsigned long)closest_mapping->paddr + closest_mapping->len;
+		if (start_addr <= current_addr && current_addr < end_addr)
+			*in_map_region = true;
+		CAM_INFO(CAM_SMMU,
+			"Faulting addr 0x%lx closest map fd %d i_ino %lu %llu-%llu 0x%lx-0x%lx buf=%pK",
+			current_addr, closest_mapping->ion_fd, closest_mapping->i_ino,
+			mapping->len, closest_mapping->len,
+			(unsigned long)closest_mapping->paddr,
+			(unsigned long)closest_mapping->paddr + closest_mapping->len,
+			closest_mapping->buf);
+	} else
+		CAM_ERR(CAM_SMMU,
+			"Cannot find vaddr:%lx in SMMU %s virt address",
+			current_addr, iommu_cb_set.cb_info[idx].name[0]);
+
+	return buf_info;
+}
+
+void cam_smmu_set_client_page_fault_handler(int handle,
+	void (*handler_cb)(struct cam_smmu_pf_info  *pf_info), void *token)
+{
+	int idx, i = 0;
+
+	if (!token || (handle == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: token is NULL or invalid handle");
+		return;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, handle)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return;
+	}
+
+	if (handler_cb) {
+		if (iommu_cb_set.cb_info[idx].cb_count == CAM_SMMU_CB_MAX) {
+			CAM_ERR(CAM_SMMU,
+				"%s Should not regiester more handlers",
+				iommu_cb_set.cb_info[idx].name[0]);
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return;
+		}
+
+		iommu_cb_set.cb_info[idx].cb_count++;
+
+		for (i = 0; i < iommu_cb_set.cb_info[idx].cb_count; i++) {
+			if (iommu_cb_set.cb_info[idx].token[i] == NULL) {
+				iommu_cb_set.cb_info[idx].token[i] = token;
+				iommu_cb_set.cb_info[idx].handler[i] =
+					handler_cb;
+				break;
+			}
+		}
+	} else {
+		for (i = 0; i < CAM_SMMU_CB_MAX; i++) {
+			if (iommu_cb_set.cb_info[idx].token[i] == token) {
+				iommu_cb_set.cb_info[idx].token[i] = NULL;
+				iommu_cb_set.cb_info[idx].handler[i] =
+					NULL;
+				iommu_cb_set.cb_info[idx].cb_count--;
+				break;
+			}
+		}
+		if (i == CAM_SMMU_CB_MAX)
+			CAM_ERR(CAM_SMMU,
+				"Error: hdl %x no matching tokens: %s",
+				handle, iommu_cb_set.cb_info[idx].name[0]);
+	}
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+}
+
+void cam_smmu_unset_client_page_fault_handler(int handle, void *token)
+{
+	int idx, i = 0;
+
+	if (!token || (handle == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: token is NULL or invalid handle");
+		return;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, handle)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return;
+	}
+
+	for (i = 0; i < CAM_SMMU_CB_MAX; i++) {
+		if (iommu_cb_set.cb_info[idx].token[i] == token) {
+			iommu_cb_set.cb_info[idx].token[i] = NULL;
+			iommu_cb_set.cb_info[idx].handler[i] =
+				NULL;
+			iommu_cb_set.cb_info[idx].cb_count--;
+			break;
+		}
+	}
+	if (i == CAM_SMMU_CB_MAX)
+		CAM_ERR(CAM_SMMU, "Error: hdl %x no matching tokens: %s",
+			handle, iommu_cb_set.cb_info[idx].name[0]);
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+}
+
+static int cam_smmu_iommu_fault_handler(struct iommu_domain *domain,
+	struct device *dev, unsigned long iova,
+	int flags, void *token)
+{
+	char *cb_name;
+	int idx;
+	struct cam_smmu_work_payload *payload;
+
+	if (!token) {
+		CAM_ERR(CAM_SMMU,
+			"token is NULL, domain = %pK, device = %pK,iova = 0x%lx, flags = 0x%x",
+			domain, dev, iova, flags);
+		return 0;
+	}
+
+	cb_name = (char *)token;
+	/* Check whether it is in the table */
+	for (idx = 0; idx < iommu_cb_set.cb_num; idx++) {
+		if (!strcmp(iommu_cb_set.cb_info[idx].name[0], cb_name))
+			break;
+	}
+
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"index is invalid, index = %d, token = %s, cb_num = %s",
+			idx, cb_name, iommu_cb_set.cb_num);
+		return 0;
+	}
+
+	if (++iommu_cb_set.cb_info[idx].pf_count > g_num_pf_handled) {
+		CAM_INFO_RATE_LIMIT(CAM_SMMU, "PF already handled %d %d %d",
+			g_num_pf_handled, idx,
+			iommu_cb_set.cb_info[idx].pf_count);
+		return 0;
+	}
+
+	payload = kzalloc(sizeof(struct cam_smmu_work_payload), GFP_ATOMIC);
+	if (!payload)
+		return 0;
+
+	payload->domain = domain;
+	payload->dev = dev;
+	payload->iova = iova;
+	payload->flags = flags;
+	payload->token = token;
+	payload->idx = idx;
+
+	mutex_lock(&iommu_cb_set.payload_list_lock);
+	list_add_tail(&payload->list, &iommu_cb_set.payload_list);
+	mutex_unlock(&iommu_cb_set.payload_list_lock);
+
+	cam_smmu_page_fault_work(&iommu_cb_set.smmu_work);
+
+	/*
+	 * If cb has faults marked as non-fatal, but if the debugfs is set for panic
+	 * trigger a panic on fault
+	 */
+	if (iommu_cb_set.cb_info[idx].non_fatal_faults_en) {
+		if (iommu_cb_set.debug_cfg.fatal_pf_mask & BIT(idx))
+			CAM_TRIGGER_PANIC("SMMU context fault from soc: %s[cb_idx: %u]",
+				iommu_cb_set.cb_info[idx].name[0], idx);
+	}
+
+	return -ENOSYS;
+}
+
+int cam_smmu_is_cb_non_fatal_fault_en(int smmu_hdl, bool *non_fatal_en)
+{
+	int idx;
+
+	if (smmu_hdl == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Invalid iommu handle %d", smmu_hdl);
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Invalid handle or idx. idx: %d, hdl: 0x%x", idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	*non_fatal_en = iommu_cb_set.cb_info[idx].non_fatal_faults_en;
+
+	return 0;
+}
+
+void cam_smmu_reset_cb_page_fault_cnt(void)
+{
+	int idx;
+
+	for (idx = 0; idx < iommu_cb_set.cb_num; idx++)
+		iommu_cb_set.cb_info[idx].pf_count = 0;
+
+}
+
+static int cam_smmu_translate_dir_to_iommu_dir(
+	enum cam_smmu_map_dir dir)
+{
+	switch (dir) {
+	case CAM_SMMU_MAP_READ:
+		return IOMMU_READ;
+	case CAM_SMMU_MAP_WRITE:
+		return IOMMU_WRITE;
+	case CAM_SMMU_MAP_RW:
+		return IOMMU_READ|IOMMU_WRITE;
+	case CAM_SMMU_MAP_INVALID:
+	default:
+		CAM_ERR(CAM_SMMU, "Error: Direction is invalid. dir = %d", dir);
+		break;
+	}
+	return IOMMU_INVALID_DIR;
+}
+
+static enum dma_data_direction cam_smmu_translate_dir(
+	enum cam_smmu_map_dir dir)
+{
+	switch (dir) {
+	case CAM_SMMU_MAP_READ:
+		return DMA_FROM_DEVICE;
+	case CAM_SMMU_MAP_WRITE:
+		return DMA_TO_DEVICE;
+	case CAM_SMMU_MAP_RW:
+		return DMA_BIDIRECTIONAL;
+	case CAM_SMMU_MAP_INVALID:
+	default:
+		CAM_ERR(CAM_SMMU, "Error: Direction is invalid. dir = %d",
+			(int)dir);
+		break;
+	}
+	return DMA_NONE;
+}
+
+void cam_smmu_reset_iommu_table(enum cam_smmu_init_dir ops)
+{
+	unsigned int i;
+	int j = 0;
+
+	for (i = 0; i < iommu_cb_set.cb_num; i++) {
+		if (ops == CAM_SMMU_TABLE_INIT)
+			mutex_init(&iommu_cb_set.cb_info[i].lock);
+
+		mutex_lock(&iommu_cb_set.cb_info[i].lock);
+
+		iommu_cb_set.cb_info[i].handle = HANDLE_INIT;
+		INIT_LIST_HEAD(&iommu_cb_set.cb_info[i].smmu_buf_list);
+		INIT_LIST_HEAD(&iommu_cb_set.cb_info[i].smmu_buf_kernel_list);
+		iommu_cb_set.cb_info[i].state = CAM_SMMU_DETACH;
+		iommu_cb_set.cb_info[i].dev = NULL;
+		iommu_cb_set.cb_info[i].cb_count = 0;
+		iommu_cb_set.cb_info[i].pf_count = 0;
+		for (j = 0; j < CAM_SMMU_CB_MAX; j++) {
+			iommu_cb_set.cb_info[i].token[j] = NULL;
+			iommu_cb_set.cb_info[i].handler[j] = NULL;
+		}
+
+		mutex_unlock(&iommu_cb_set.cb_info[i].lock);
+
+		if (ops != CAM_SMMU_TABLE_INIT)
+			mutex_destroy(&iommu_cb_set.cb_info[i].lock);
+	}
+}
+
+static bool cam_smmu_is_hdl_nonunique_or_null(int hdl)
+{
+	int i;
+
+	if ((hdl == HANDLE_INIT) || (!hdl)) {
+		CAM_DBG(CAM_SMMU, "iommu handle: %d is not valid", hdl);
+		return 1;
+	}
+
+	for (i = 0; i < iommu_cb_set.cb_num; i++) {
+		if (iommu_cb_set.cb_info[i].handle == HANDLE_INIT)
+			continue;
+
+		if (iommu_cb_set.cb_info[i].handle == hdl) {
+			CAM_DBG(CAM_SMMU, "iommu handle %d conflicts",
+				(int)hdl);
+			return 1;
+		}
+	}
+	return 0;
+}
+
+/**
+ *  use low 2 bytes for handle cookie
+ */
+static int cam_smmu_create_iommu_handle(int idx)
+{
+	int rand, hdl = 0;
+
+	get_random_bytes(&rand, COOKIE_NUM_BYTE);
+	hdl = GET_SMMU_HDL(idx, rand);
+	CAM_DBG(CAM_SMMU, "create handle value = %x", (int)hdl);
+	return hdl;
+}
+
+static int cam_smmu_attach_device(int idx)
+{
+	int rc;
+	struct cam_context_bank_info *cb = &iommu_cb_set.cb_info[idx];
+
+	/* attach the mapping to device */
+	rc = iommu_attach_device(cb->domain, cb->dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: ARM IOMMU attach failed. ret = %d",
+			rc);
+		rc = -ENODEV;
+	}
+
+	return rc;
+}
+
+static inline void cam_smmu_update_multiregion_dev_id(
+	struct cam_context_bank_info *cb_info, char *name,
+	int *hdl)
+{
+	int k;
+
+	for (k = 0; k < cb_info->num_multi_regions; k++) {
+		if (!strcmp(cb_info->multi_region_clients[k], name)) {
+			*hdl |= ((k + 1) << MULTI_CLIENT_REGION_SHIFT);
+			CAM_DBG(CAM_SMMU, "%s got shared multi region handle 0x%x",
+				name, *hdl);
+		}
+	}
+}
+static int cam_smmu_create_add_handle_in_table(char *name,
+	int *hdl)
+{
+	int i, j, rc = -EINVAL;
+	int handle;
+
+	/* create handle and add in the iommu hardware table */
+	for (i = 0; i < iommu_cb_set.cb_num; i++) {
+		for (j = 0; j < iommu_cb_set.cb_info[i].num_shared_hdl; j++) {
+			if (strcmp(iommu_cb_set.cb_info[i].name[j], name))
+				continue;
+
+			if (iommu_cb_set.cb_info[i].handle == HANDLE_INIT) {
+				mutex_lock(&iommu_cb_set.cb_info[i].lock);
+				/* make sure handle is unique and non-zero*/
+				do {
+					handle =
+						cam_smmu_create_iommu_handle(i);
+				} while (cam_smmu_is_hdl_nonunique_or_null(
+						handle));
+
+				/* put handle in the table */
+				iommu_cb_set.cb_info[i].handle = handle;
+				iommu_cb_set.cb_info[i].cb_count = 0;
+				if (iommu_cb_set.cb_info[i].is_secure)
+					iommu_cb_set.cb_info[i].secure_count++;
+
+				if (iommu_cb_set.cb_info[i].is_mul_client)
+					iommu_cb_set.cb_info[i].device_count++;
+
+				*hdl = handle;
+				CAM_DBG(CAM_SMMU, "%s creates handle 0x%x",
+					name, handle);
+				mutex_unlock(&iommu_cb_set.cb_info[i].lock);
+				rc = 0;
+				goto end;
+			} else {
+				mutex_lock(&iommu_cb_set.cb_info[i].lock);
+				if (iommu_cb_set.cb_info[i].is_secure) {
+					iommu_cb_set.cb_info[i].secure_count++;
+					*hdl = iommu_cb_set.cb_info[i].handle;
+					mutex_unlock(
+						&iommu_cb_set.cb_info[i].lock);
+					return 0;
+				}
+
+				if (iommu_cb_set.cb_info[i].is_mul_client) {
+					iommu_cb_set.cb_info[i].device_count++;
+					*hdl = iommu_cb_set.cb_info[i].handle;
+					if (iommu_cb_set.cb_info[i].num_multi_regions) {
+						cam_smmu_update_multiregion_dev_id(
+							&iommu_cb_set.cb_info[i], name, hdl);
+					}
+					mutex_unlock(
+						&iommu_cb_set.cb_info[i].lock);
+					CAM_DBG(CAM_SMMU,
+						"%s already got handle 0x%x cb_handle 0x%x",
+						name, *hdl, iommu_cb_set.cb_info[i].handle);
+					return 0;
+				}
+
+				CAM_ERR(CAM_SMMU,
+					"Error: %s already got handle 0x%x",
+					name, iommu_cb_set.cb_info[i].handle);
+				mutex_unlock(&iommu_cb_set.cb_info[i].lock);
+				rc = -EALREADY;
+				goto end;
+			}
+		}
+	}
+
+	CAM_ERR(CAM_SMMU, "Error: Cannot find name %s or all handle exist",
+		name);
+	cam_smmu_print_table();
+end:
+	return rc;
+}
+
+static int cam_smmu_init_scratch_map(struct scratch_mapping *scratch_map,
+					dma_addr_t base, size_t size,
+					int order)
+{
+	unsigned int count = size >> (PAGE_SHIFT + order);
+	unsigned int bitmap_size = BITS_TO_LONGS(count) * sizeof(long);
+	int err = 0;
+
+	if (!count) {
+		err = -EINVAL;
+		CAM_ERR(CAM_SMMU, "Page count is zero, size passed = %zu",
+			size);
+		goto bail;
+	}
+
+	scratch_map->bitmap = kzalloc(bitmap_size, GFP_KERNEL);
+	if (!scratch_map->bitmap) {
+		err = -ENOMEM;
+		goto bail;
+	}
+
+	scratch_map->base = base;
+	scratch_map->bits = BITS_PER_BYTE * bitmap_size;
+	scratch_map->order = order;
+
+bail:
+	return err;
+}
+
+static int cam_smmu_alloc_scratch_va(struct scratch_mapping *mapping,
+	size_t size,
+	dma_addr_t *iova)
+{
+	unsigned int order = get_order(size);
+	unsigned int align = 0;
+	unsigned int count, start;
+
+	count = ((PAGE_ALIGN(size) >> PAGE_SHIFT) +
+		 (1 << mapping->order) - 1) >> mapping->order;
+
+	/*
+	 * Transparently, add a guard page to the total count of pages
+	 * to be allocated
+	 */
+	count++;
+
+	if (order > mapping->order)
+		align = (1 << (order - mapping->order)) - 1;
+
+	start = bitmap_find_next_zero_area(mapping->bitmap, mapping->bits, 0,
+					   count, align);
+
+	if (start > mapping->bits)
+		return -ENOMEM;
+
+	bitmap_set(mapping->bitmap, start, count);
+	*iova = mapping->base + (start << (mapping->order + PAGE_SHIFT));
+
+	return 0;
+}
+
+static int cam_smmu_free_scratch_va(struct scratch_mapping *mapping,
+	dma_addr_t addr, size_t size)
+{
+	unsigned int start = (addr - mapping->base) >>
+			     (mapping->order + PAGE_SHIFT);
+	unsigned int count = ((size >> PAGE_SHIFT) +
+			      (1 << mapping->order) - 1) >> mapping->order;
+
+	if (!addr) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid address");
+		return -EINVAL;
+	}
+
+	if (start + count > mapping->bits) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid page bits in scratch map");
+		return -EINVAL;
+	}
+
+	/*
+	 * Transparently, add a guard page to the total count of pages
+	 * to be freed
+	 */
+	count++;
+	bitmap_clear(mapping->bitmap, start, count);
+
+	return 0;
+}
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_virt_address(int idx,
+	dma_addr_t virt_addr)
+{
+	struct cam_dma_buff_info *mapping;
+
+	list_for_each_entry(mapping, &iommu_cb_set.cb_info[idx].smmu_buf_list,
+			list) {
+		if (mapping->paddr == virt_addr) {
+			CAM_DBG(CAM_SMMU, "Found virtual address %lx",
+				 (unsigned long)virt_addr);
+			return mapping;
+		}
+	}
+
+	CAM_ERR(CAM_SMMU, "Error: Cannot find virtual address %lx by index %d",
+		(unsigned long)virt_addr, idx);
+	return NULL;
+}
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_ion_index(int idx,
+	int ion_fd, struct dma_buf *dmabuf)
+{
+	struct cam_dma_buff_info *mapping;
+	unsigned long i_ino;
+
+	if (ion_fd < 0) {
+		CAM_ERR(CAM_SMMU, "Invalid fd %d", ion_fd);
+		return NULL;
+	}
+
+	i_ino = file_inode(dmabuf->file)->i_ino;
+
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list,
+			list) {
+		if ((mapping->ion_fd == ion_fd) && (mapping->i_ino == i_ino)) {
+			CAM_DBG(CAM_SMMU, "find ion_fd %d i_ino %lu", ion_fd, i_ino);
+			return mapping;
+		}
+	}
+
+	CAM_ERR(CAM_SMMU, "Error: Cannot find entry by index %d, fd %d i_ino %lu",
+		idx, ion_fd, i_ino);
+
+	return NULL;
+}
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_dma_buf(int idx,
+	struct dma_buf *buf)
+{
+	struct cam_dma_buff_info *mapping;
+
+	if (!buf) {
+		CAM_ERR(CAM_SMMU, "Invalid dma_buf");
+		return NULL;
+	}
+
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list,
+			list) {
+		if (mapping->buf == buf) {
+			CAM_DBG(CAM_SMMU, "find dma_buf %pK", buf);
+			return mapping;
+		}
+	}
+
+	CAM_ERR(CAM_SMMU, "Error: Cannot find entry by index %d", idx);
+
+	return NULL;
+}
+
+static struct cam_sec_buff_info *cam_smmu_find_mapping_by_sec_buf_idx(int idx,
+	int ion_fd, struct dma_buf *dmabuf)
+{
+	struct cam_sec_buff_info *mapping;
+	unsigned long i_ino;
+
+	i_ino = file_inode(dmabuf->file)->i_ino;
+
+	list_for_each_entry(mapping, &iommu_cb_set.cb_info[idx].smmu_buf_list,
+		list) {
+		if ((mapping->ion_fd == ion_fd) && (mapping->i_ino == i_ino)) {
+			CAM_DBG(CAM_SMMU, "find ion_fd %d, i_ino %lu", ion_fd, i_ino);
+			return mapping;
+		}
+	}
+	CAM_ERR(CAM_SMMU, "Error: Cannot find fd %d i_ino %lu by index %d",
+		ion_fd, i_ino, idx);
+	return NULL;
+}
+
+static void cam_smmu_clean_user_buffer_list(int idx)
+{
+	int ret;
+	struct cam_dma_buff_info *mapping_info, *temp;
+
+	list_for_each_entry_safe(mapping_info, temp,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		CAM_DBG(CAM_SMMU, "Free mapping address %pK, i = %d, fd = %d, i_ino = %lu",
+			(void *)mapping_info->paddr, idx,
+			mapping_info->ion_fd, mapping_info->i_ino);
+
+		if (mapping_info->ion_fd == 0xDEADBEEF)
+			/* Clean up scratch buffers */
+			ret = cam_smmu_free_scratch_buffer_remove_from_list(
+							mapping_info, idx);
+		else
+			/* Clean up regular mapped buffers */
+			ret = cam_smmu_unmap_buf_and_remove_from_list(
+					mapping_info,
+					idx);
+
+		if (ret < 0) {
+			CAM_ERR(CAM_SMMU, "Buffer delete failed: idx = %d",
+				idx);
+			CAM_ERR(CAM_SMMU,
+				"Buffer delete failed: addr = 0x%lx, fd = %d, i_ino = %lu",
+				mapping_info->paddr,
+				mapping_info->ion_fd, mapping_info->i_ino);
+			/*
+			 * Ignore this error and continue to delete other
+			 * buffers in the list
+			 */
+			continue;
+		}
+	}
+}
+
+static void cam_smmu_clean_kernel_buffer_list(int idx)
+{
+	int ret;
+	struct cam_dma_buff_info *mapping_info, *temp;
+
+	list_for_each_entry_safe(mapping_info, temp,
+			&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list, list) {
+		CAM_DBG(CAM_SMMU,
+			"Free mapping address %pK, i = %d, dma_buf = %pK",
+			(void *)mapping_info->paddr, idx,
+			mapping_info->buf);
+
+		/* Clean up regular mapped buffers */
+		ret = cam_smmu_unmap_buf_and_remove_from_list(
+				mapping_info,
+				idx);
+
+		if (ret < 0) {
+			CAM_ERR(CAM_SMMU,
+				"Buffer delete in kernel list failed: idx = %d",
+				idx);
+			CAM_ERR(CAM_SMMU,
+				"Buffer delete failed: addr = 0x%lx, dma_buf = %pK",
+				mapping_info->paddr, mapping_info->buf);
+			/*
+			 * Ignore this error and continue to delete other
+			 * buffers in the list
+			 */
+			continue;
+		}
+	}
+}
+
+static int cam_smmu_attach(int idx)
+{
+	int ret;
+
+	if (iommu_cb_set.cb_info[idx].state == CAM_SMMU_ATTACH) {
+		ret = -EALREADY;
+	} else if (iommu_cb_set.cb_info[idx].state == CAM_SMMU_DETACH) {
+		ret = cam_smmu_attach_device(idx);
+		if (ret < 0) {
+			CAM_ERR(CAM_SMMU, "Error: ATTACH fail");
+			return -ENODEV;
+		}
+		iommu_cb_set.cb_info[idx].state = CAM_SMMU_ATTACH;
+		ret = 0;
+	} else {
+		CAM_ERR(CAM_SMMU, "Error: Not detach/attach: %d",
+			iommu_cb_set.cb_info[idx].state);
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+static int cam_smmu_detach_device(int idx)
+{
+	int rc = 0;
+	struct cam_context_bank_info *cb = &iommu_cb_set.cb_info[idx];
+
+	/* detach the mapping to device if not already detached */
+	if (iommu_cb_set.cb_info[idx].state == CAM_SMMU_DETACH) {
+		rc = -EALREADY;
+	} else if (iommu_cb_set.cb_info[idx].state == CAM_SMMU_ATTACH) {
+		iommu_detach_device(cb->domain, cb->dev);
+		iommu_cb_set.cb_info[idx].state = CAM_SMMU_DETACH;
+	}
+
+	return rc;
+}
+
+static int cam_smmu_alloc_iova(size_t size,
+	int32_t smmu_hdl, unsigned long *iova)
+{
+	int rc = 0, shared_mem_pool_idx = 0;
+	int idx, multi_client_device_idx;
+	unsigned long vaddr = 0;
+
+	if (!iova || !size || (smmu_hdl == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: Input args are invalid");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SMMU, "Allocating iova size = %zu for smmu hdl=%X",
+		size, smmu_hdl);
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	multi_client_device_idx = GET_SMMU_MULTI_CLIENT_IDX(smmu_hdl);
+
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, smmu_hdl)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, smmu_hdl);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].shared_support) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Shared memory not supported for hdl = %X",
+			smmu_hdl);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	rc = cam_smmu_get_multiregion_client_dev_idx(&iommu_cb_set.cb_info[idx],
+		multi_client_device_idx, CAM_SMMU_REGION_SHARED, &shared_mem_pool_idx);
+	if (rc)
+		goto get_addr_end;
+
+	vaddr = gen_pool_alloc(
+		iommu_cb_set.cb_info[idx].shared_mem_pool[shared_mem_pool_idx], size);
+
+	if (!vaddr)
+		return -ENOMEM;
+
+	*iova = vaddr;
+
+get_addr_end:
+	return rc;
+}
+
+static int cam_smmu_free_iova(unsigned long iova, size_t size,
+	int32_t smmu_hdl)
+{
+	int rc = 0, idx, multi_client_device_idx;
+	int shared_mem_pool_idx = 0;
+
+	if (!size || (smmu_hdl == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: Input args are invalid");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	multi_client_device_idx = GET_SMMU_MULTI_CLIENT_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, smmu_hdl)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, smmu_hdl);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	rc = cam_smmu_get_multiregion_client_dev_idx(&iommu_cb_set.cb_info[idx],
+		multi_client_device_idx, CAM_SMMU_REGION_SHARED, &shared_mem_pool_idx);
+	if (rc)
+		goto get_addr_end;
+
+	gen_pool_free(iommu_cb_set.cb_info[idx].shared_mem_pool[shared_mem_pool_idx],
+		iova, size);
+
+get_addr_end:
+	return rc;
+}
+
+int cam_smmu_alloc_firmware(int32_t smmu_hdl,
+	dma_addr_t *iova,
+	uintptr_t *cpuva,
+	size_t *len)
+{
+	int rc;
+	int32_t idx;
+	size_t firmware_len = 0;
+	size_t firmware_start = 0;
+	struct iommu_domain *domain;
+
+	if (!iova || !len || !cpuva || (smmu_hdl == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: Input args are invalid");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].firmware_support) {
+		CAM_ERR(CAM_SMMU,
+			"Firmware memory not supported for this SMMU handle");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_fw_allocated) {
+		CAM_ERR(CAM_SMMU, "Trying to allocate twice");
+		rc = -ENOMEM;
+		goto unlock_and_end;
+	}
+
+	firmware_len = iommu_cb_set.cb_info[idx].firmware_info.iova_len;
+	firmware_start = iommu_cb_set.cb_info[idx].firmware_info.iova_start;
+	CAM_DBG(CAM_SMMU, "Firmware area len from DT = %zu", firmware_len);
+
+	rc = cam_reserve_icp_fw(&icp_fw, firmware_len);
+	if (rc)
+		goto unlock_and_end;
+	else
+		CAM_DBG(CAM_SMMU, "DMA alloc returned fw = %pK, hdl = %pK",
+			icp_fw.fw_kva, (void *)icp_fw.fw_hdl);
+
+	domain = iommu_cb_set.cb_info[idx].domain;
+
+	/*
+	 * Revisit this - what should we map this with - CACHED or UNCACHED?
+	 * chipsets using dma-coherent-hint-cached - leaving it like this is
+	 * fine as we can map both CACHED and UNCACHED on same CB.
+	 * But on chipsets which use dma-coherent - all the buffers that are
+	 * being mapped to this CB must be CACHED
+	 */
+	rc = iommu_map(domain,
+		firmware_start,
+		(phys_addr_t) icp_fw.fw_hdl,
+		firmware_len,
+		IOMMU_READ|IOMMU_WRITE|IOMMU_PRIV, GFP_KERNEL);
+
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "Failed to map FW into IOMMU");
+		rc = -ENOMEM;
+		goto alloc_fail;
+	}
+	iommu_cb_set.cb_info[idx].is_fw_allocated = true;
+
+	*iova = iommu_cb_set.cb_info[idx].firmware_info.iova_start;
+	*cpuva = (uintptr_t)icp_fw.fw_kva;
+	*len = firmware_len;
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+
+	return rc;
+
+alloc_fail:
+	cam_unreserve_icp_fw(&icp_fw, firmware_len);
+unlock_and_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+end:
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_alloc_firmware);
+
+int cam_smmu_dealloc_firmware(int32_t smmu_hdl)
+{
+	int rc = 0;
+	int32_t idx;
+	size_t firmware_len = 0;
+	size_t firmware_start = 0;
+	struct iommu_domain *domain;
+	size_t unmapped = 0;
+
+	if (smmu_hdl == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].firmware_support) {
+		CAM_ERR(CAM_SMMU,
+			"Firmware memory not supported for this SMMU handle");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (!iommu_cb_set.cb_info[idx].is_fw_allocated) {
+		CAM_ERR(CAM_SMMU,
+			"Trying to deallocate firmware that is not allocated");
+		rc = -ENOMEM;
+		goto unlock_and_end;
+	}
+
+	firmware_len = iommu_cb_set.cb_info[idx].firmware_info.iova_len;
+	firmware_start = iommu_cb_set.cb_info[idx].firmware_info.iova_start;
+	domain = iommu_cb_set.cb_info[idx].domain;
+	unmapped = iommu_unmap(domain,
+		firmware_start,
+		firmware_len);
+
+	if (unmapped != firmware_len) {
+		CAM_ERR(CAM_SMMU, "Only %zu unmapped out of total %zu",
+			unmapped,
+			firmware_len);
+		rc = -EINVAL;
+	}
+
+	cam_unreserve_icp_fw(&icp_fw, firmware_len);
+
+	icp_fw.fw_kva = NULL;
+	icp_fw.fw_hdl = 0;
+
+	iommu_cb_set.cb_info[idx].is_fw_allocated = false;
+
+unlock_and_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+end:
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_dealloc_firmware);
+
+static int cam_smmu_retrieve_region_info(
+	struct cam_context_bank_info *cb_info,
+	uint32_t region_id, uint32_t subregion_id,
+	int32_t nested_reg_idx,
+	bool *is_supported, int32_t **ref_cnt,
+	unsigned long **mapping_mask, bool **is_allocated,
+	struct cam_smmu_region_info **region_info)
+{
+	int rc = 0;
+	struct cam_smmu_subregion_info *subregion = NULL;
+
+	switch (region_id) {
+	case CAM_SMMU_REGION_QDSS: {
+		struct cam_smmu_multi_region_info *qdss_region;
+
+		qdss_region =  &cb_info->qdss_info;
+
+		/* No subregion for QDSS */
+		*is_supported = cb_info->qdss_support;
+		*is_allocated = &qdss_region->nested_regions[nested_reg_idx].is_allocated;
+		*region_info = &qdss_region->nested_regions[nested_reg_idx].region_info;
+		*ref_cnt = &qdss_region->nested_regions[nested_reg_idx].mapped_refcnt;
+		*mapping_mask =  &qdss_region->nested_regions[nested_reg_idx].mapped_client_mask;
+	}
+		break;
+	case CAM_SMMU_REGION_DEVICE: {
+		struct cam_smmu_multi_region_info *device_region;
+
+		*is_supported = cb_info->device_region_support;
+		device_region = &cb_info->device_region;
+
+		if (device_region->nested_regions[nested_reg_idx].subregion_support) {
+			subregion = cam_smmu_find_subregion(subregion_id,
+				device_region->nested_regions[nested_reg_idx].subregions);
+			if (IS_ERR_OR_NULL(subregion)) {
+				CAM_ERR(CAM_SMMU,
+					"Failed to find subregion: %d in region: %d cb: %s",
+					subregion, region_id, cb_info->name[0]);
+				rc = PTR_ERR(subregion);
+				goto end;
+			}
+
+			*is_allocated = &subregion->is_allocated;
+			*region_info = &subregion->subregion_info;
+			*ref_cnt = &subregion->mapped_refcnt;
+			*mapping_mask =  &subregion->mapped_client_mask;
+		} else {
+			*is_allocated = &device_region->nested_regions[nested_reg_idx].is_allocated;
+			*region_info = &device_region->nested_regions[nested_reg_idx].region_info;
+			*ref_cnt = &device_region->nested_regions[nested_reg_idx].mapped_refcnt;
+			*mapping_mask =
+				&device_region->nested_regions[nested_reg_idx].mapped_client_mask;
+		}
+	}
+		break;
+	case CAM_SMMU_REGION_FWUNCACHED: {
+		struct cam_smmu_multi_region_info *fw_uncached;
+
+		fw_uncached = &cb_info->fwuncached_region;
+		if (fw_uncached->nested_regions[nested_reg_idx].subregion_support) {
+			subregion = cam_smmu_find_subregion(subregion_id,
+				fw_uncached->nested_regions[nested_reg_idx].subregions);
+			if (IS_ERR_OR_NULL(subregion)) {
+				CAM_ERR(CAM_SMMU,
+					"Failed to find subregion: %d in region: %d cb: %s",
+					subregion, region_id, cb_info->name[0]);
+				rc = PTR_ERR(subregion);
+				goto end;
+			}
+
+			*is_supported = true;
+			*is_allocated = &subregion->is_allocated;
+			*region_info = &subregion->subregion_info;
+			*ref_cnt = &subregion->mapped_refcnt;
+			*mapping_mask =  &subregion->mapped_client_mask;
+		} else {
+			*is_allocated = &fw_uncached->nested_regions[nested_reg_idx].is_allocated;
+			*region_info = &fw_uncached->nested_regions[nested_reg_idx].region_info;
+			*ref_cnt = &fw_uncached->nested_regions[nested_reg_idx].mapped_refcnt;
+			*mapping_mask =
+				&fw_uncached->nested_regions[nested_reg_idx].mapped_client_mask;
+		}
+	}
+		break;
+	default:
+		CAM_ERR(CAM_SMMU,
+			"Unsupported region: %u in cb: %s for mapping known phy addr",
+			region_id, cb_info->name[0]);
+		rc = -EINVAL;
+		break;
+	}
+
+end:
+	return rc;
+}
+
+int cam_smmu_map_phy_mem_region(int32_t smmu_hdl,
+	uint32_t region_id, uint32_t subregion_id,
+	dma_addr_t *iova, size_t *len)
+{
+	int rc, idx, prot = IOMMU_READ | IOMMU_WRITE;
+	int multi_client_device_idx = 0, nested_reg_idx = 0;
+	int32_t *ref_cnt;
+	unsigned long *map_client_mask;
+	size_t region_len = 0;
+	dma_addr_t region_start;
+	bool is_supported = false;
+	bool *is_allocated;
+	struct iommu_domain *domain;
+	struct cam_context_bank_info *cb_info;
+	struct cam_smmu_region_info *region_info = NULL;
+
+	if (!iova || !len || (smmu_hdl == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: Input args are invalid");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	multi_client_device_idx = GET_SMMU_MULTI_CLIENT_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, smmu_hdl)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cb_info = &iommu_cb_set.cb_info[idx];
+	rc = cam_smmu_get_multiregion_client_dev_idx(&iommu_cb_set.cb_info[idx],
+		multi_client_device_idx, region_id, &nested_reg_idx);
+	if (rc)
+		goto end;
+
+	rc = cam_smmu_retrieve_region_info(cb_info, region_id, subregion_id,
+		nested_reg_idx, &is_supported, &ref_cnt, &map_client_mask,
+		&is_allocated, &region_info);
+	if (rc)
+		goto end;
+
+	if (!is_supported) {
+		CAM_ERR(CAM_SMMU,
+			"region: %u not supported for phy addr mapping in cb: %s",
+			region_id, cb_info->name[0]);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&cb_info->lock);
+	if ((*is_allocated)) {
+		if (test_bit(multi_client_device_idx, map_client_mask)) {
+			CAM_ERR(CAM_SMMU,
+				"Trying to allocate region: %u [subregion: %u] twice on cb: %s",
+				region_id, subregion_id, cb_info->name[0]);
+			rc = -ENOMEM;
+			goto unlock_and_end;
+		}
+
+		set_bit(multi_client_device_idx, map_client_mask);
+		(*ref_cnt)++;
+		CAM_DBG(CAM_SMMU,
+			"Trying to allocate region: %u [subregion: %u] on cb: %s for different clients: 0x%x ref_cnt: %u",
+			region_id, subregion_id, cb_info->name[0], *map_client_mask, *ref_cnt);
+
+		*iova = region_info->iova_start;
+		*len = region_info->iova_len;
+		rc = 0;
+		goto unlock_and_end;
+	}
+
+	if (!region_info->phy_addr) {
+		CAM_ERR(CAM_SMMU,
+			"Invalid phy addr for region: %u [subregion: %u] on cb: %s",
+			region_id, subregion_id, cb_info->name[0]);
+		rc = -ENOMEM;
+		goto unlock_and_end;
+	}
+
+	region_len = region_info->iova_len;
+	region_start = region_info->iova_start;
+
+	CAM_DBG(CAM_SMMU,
+		"mapping region= %u [subregion = %u] for va = 0x%x len = %zu phy = 0x%x prot=0x%x",
+		region_id, subregion_id, region_start, region_len, region_info->phy_addr, prot);
+
+	domain = cb_info->domain;
+	if (region_id == CAM_SMMU_REGION_DEVICE)
+		prot |=  IOMMU_MMIO;
+
+	/*
+	 * Revisit this - what should we map this with - CACHED or UNCACHED?
+	 * chipsets using dma-coherent-hint-cached - leaving it like this is
+	 * fine as we can map both CACHED and UNCACHED on same CB.
+	 * But on chipsets which use dma-coherent - all the buffers that are
+	 * being mapped to this CB must be CACHED
+	 */
+	rc = iommu_map(domain,
+		region_start,
+		region_info->phy_addr,
+		region_len,
+		prot,
+		GFP_KERNEL);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "Failed to map region = %u into IOMMU cb = %s",
+			region_id, cb_info->name[0]);
+		goto unlock_and_end;
+	}
+
+	*is_allocated = true;
+	(*ref_cnt)++;
+	*iova = region_info->iova_start;
+	*len = region_info->iova_len;
+	set_bit(multi_client_device_idx, map_client_mask);
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+
+	return rc;
+
+unlock_and_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+end:
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_map_phy_mem_region);
+
+int cam_smmu_unmap_phy_mem_region(int32_t smmu_hdl,
+	uint32_t region_id, uint32_t subregion_id)
+{
+	int rc = 0, idx;
+	int multi_client_device_idx = 0, nested_reg_idx = 0;
+	int32_t *ref_cnt;
+	unsigned long *map_client_mask;
+	size_t len = 0;
+	dma_addr_t start = 0;
+	struct iommu_domain *domain;
+	size_t unmapped = 0;
+	bool is_supported = false;
+	bool *is_allocated = NULL;
+	struct cam_context_bank_info *cb_info;
+	struct cam_smmu_region_info *region_info = NULL;
+
+	if (smmu_hdl == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	multi_client_device_idx = GET_SMMU_MULTI_CLIENT_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, smmu_hdl)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cb_info = &iommu_cb_set.cb_info[idx];
+	rc = cam_smmu_get_multiregion_client_dev_idx(cb_info,
+		multi_client_device_idx, region_id, &nested_reg_idx);
+	if (rc)
+		goto end;
+
+	rc = cam_smmu_retrieve_region_info(cb_info, region_id, subregion_id,
+		nested_reg_idx, &is_supported, &ref_cnt, &map_client_mask,
+		&is_allocated, &region_info);
+	if (rc)
+		goto end;
+
+	if (!is_supported) {
+		CAM_ERR(CAM_SMMU,
+			"region: %u not supported for this SMMU handle cb: %s",
+			region_id, cb_info->name[0]);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (!(*is_allocated)) {
+		CAM_ERR(CAM_SMMU,
+			"Trying to free region: %u that is not allocated on cb: %s",
+			region_id, cb_info->name[0]);
+		rc = -ENOMEM;
+		goto unlock_and_end;
+	}
+
+	(*ref_cnt)--;
+	clear_bit(multi_client_device_idx, map_client_mask);
+	if ((*ref_cnt) > 0) {
+		CAM_DBG(CAM_SMMU,
+			"Mapping for region: %u on cb: %s still in use refcnt: %d mapping_mask: 0x%x",
+			region_id, cb_info->name[0], *ref_cnt, *map_client_mask);
+		goto unlock_and_end;
+	}
+
+	len = region_info->iova_len;
+	start = region_info->iova_start;
+	domain = cb_info->domain;
+	unmapped = iommu_unmap(domain, start, len);
+
+	if (unmapped != len) {
+		CAM_ERR(CAM_SMMU, "Only %zu unmapped out of total %zu",
+			unmapped,
+			len);
+		rc = -EINVAL;
+	}
+
+	*is_allocated = false;
+	*ref_cnt = 0;
+	*map_client_mask = 0;
+
+unlock_and_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+end:
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_unmap_phy_mem_region);
+
+int cam_smmu_get_io_region_info(int32_t smmu_hdl,
+	dma_addr_t *iova, size_t *len,
+	dma_addr_t *discard_iova_start, size_t *discard_iova_len)
+{
+	int32_t idx, rc;
+	int multi_client_device_idx = 0, nested_reg_idx = 0;
+	struct cam_smmu_nested_region_info *io_region;
+
+	if (!iova || !len || !discard_iova_start || !discard_iova_len ||
+		(smmu_hdl == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: Input args are invalid");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	multi_client_device_idx = GET_SMMU_MULTI_CLIENT_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].io_support) {
+		CAM_ERR(CAM_SMMU,
+			"I/O memory not supported for this SMMU handle");
+		return -EINVAL;
+	}
+
+	rc = cam_smmu_get_multiregion_client_dev_idx(&iommu_cb_set.cb_info[idx],
+		multi_client_device_idx, CAM_SMMU_REGION_IO, &nested_reg_idx);
+	if (rc)
+		return rc;
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	io_region = &iommu_cb_set.cb_info[idx].io_info.nested_regions[nested_reg_idx];
+
+	*iova = io_region->region_info.iova_start;
+	*len = io_region->region_info.iova_len;
+	*discard_iova_start =
+		io_region->region_info.discard_iova_start;
+	*discard_iova_len =
+		io_region->region_info.discard_iova_len;
+
+	CAM_DBG(CAM_SMMU,
+		"I/O area for hdl = %x Region:[%pK %zu] Discard:[%pK %zu]",
+		smmu_hdl, *iova, *len,
+		*discard_iova_start, *discard_iova_len);
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+
+	return 0;
+}
+
+int cam_smmu_get_region_info(int32_t smmu_hdl,
+	enum cam_smmu_region_id region_id,
+	struct cam_smmu_region_info *region_info)
+{
+	int32_t idx, multi_client_device_idx = 0, nested_reg_idx = 0;
+	struct cam_context_bank_info *cb = NULL;
+
+	if (!region_info) {
+		CAM_ERR(CAM_SMMU, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (smmu_hdl == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	multi_client_device_idx = GET_SMMU_MULTI_CLIENT_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU, "Handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	if (cam_smmu_get_multiregion_client_dev_idx(&iommu_cb_set.cb_info[idx],
+		multi_client_device_idx, region_id, &nested_reg_idx))
+		return -EINVAL;
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	cb = &iommu_cb_set.cb_info[idx];
+	if (!cb) {
+		CAM_ERR(CAM_SMMU, "SMMU context bank pointer invalid");
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return -EINVAL;
+	}
+
+	switch (region_id) {
+	case CAM_SMMU_REGION_FIRMWARE:
+		if (!cb->firmware_support) {
+			CAM_ERR(CAM_SMMU, "Firmware not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+
+		region_info->iova_start = cb->firmware_info.iova_start;
+		region_info->iova_len = cb->firmware_info.iova_len;
+		break;
+	case CAM_SMMU_REGION_SHARED: {
+		struct cam_smmu_nested_region_info *nested_reg_info;
+
+		if (!cb->shared_support) {
+			CAM_ERR(CAM_SMMU, "Shared mem not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+
+		nested_reg_info = &cb->shared_info.nested_regions[nested_reg_idx];
+
+		region_info->iova_start = nested_reg_info->region_info.iova_start;
+		region_info->iova_len = nested_reg_info->region_info.iova_len;
+	}
+		break;
+	case CAM_SMMU_REGION_SCRATCH:
+		if (!cb->scratch_buf_support) {
+			CAM_ERR(CAM_SMMU, "Scratch memory not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+
+		region_info->iova_start = cb->scratch_info.iova_start;
+		region_info->iova_len = cb->scratch_info.iova_len;
+		break;
+	case CAM_SMMU_REGION_IO: {
+		struct cam_smmu_nested_region_info *nested_reg_info;
+
+		if (!cb->io_support) {
+			CAM_ERR(CAM_SMMU, "IO memory not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+
+		nested_reg_info = &cb->io_info.nested_regions[nested_reg_idx];
+
+		region_info->iova_start = nested_reg_info->region_info.iova_start;
+		region_info->iova_len = nested_reg_info->region_info.iova_len;
+	}
+		break;
+	case CAM_SMMU_REGION_SECHEAP:
+		if (!cb->secheap_support) {
+			CAM_ERR(CAM_SMMU, "Secondary heap not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+
+		region_info->iova_start = cb->secheap_info.iova_start;
+		region_info->iova_len = cb->secheap_info.iova_len;
+		break;
+	case CAM_SMMU_REGION_FWUNCACHED: {
+		struct cam_smmu_nested_region_info *nested_reg_info;
+
+		if (!cb->fwuncached_region_support) {
+			CAM_WARN(CAM_SMMU, "FW uncached region not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+
+		nested_reg_info = &cb->fwuncached_region.nested_regions[nested_reg_idx];
+
+		region_info->iova_start = nested_reg_info->region_info.iova_start;
+		region_info->iova_len = nested_reg_info->region_info.iova_len;
+	}
+		break;
+	case CAM_SMMU_REGION_DEVICE: {
+		struct cam_smmu_nested_region_info *nested_reg_info;
+
+		if (!cb->device_region_support) {
+			CAM_WARN(CAM_SMMU, "device memory region not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+
+		nested_reg_info = &cb->device_region.nested_regions[nested_reg_idx];
+
+		region_info->iova_start = nested_reg_info->region_info.iova_start;
+		region_info->iova_len = nested_reg_info->region_info.iova_len;
+	}
+		break;
+	default:
+		CAM_ERR(CAM_SMMU, "Invalid region id: %d for smmu hdl: %X",
+			smmu_hdl, region_id);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return -EINVAL;
+	}
+
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return 0;
+}
+EXPORT_SYMBOL(cam_smmu_get_region_info);
+
+int cam_smmu_reserve_buf_region(enum cam_smmu_region_id region,
+	int32_t smmu_hdl, struct dma_buf *buf, dma_addr_t *iova,
+	size_t *request_len)
+{
+	struct cam_context_bank_info *cb_info;
+	struct region_buf_info *buf_info = NULL;
+	struct cam_smmu_region_info *region_info = NULL;
+	struct cam_smmu_subregion_info *subregion_info = NULL;
+	bool *is_buf_allocated;
+	bool region_supported;
+	size_t size = 0;
+	int idx, rc = 0, multi_client_device_idx, prot, nested_reg_idx = 0;
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	multi_client_device_idx = GET_SMMU_MULTI_CLIENT_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	cb_info = &iommu_cb_set.cb_info[idx];
+	rc = cam_smmu_get_multiregion_client_dev_idx(cb_info,
+		multi_client_device_idx, region, &nested_reg_idx);
+	if (rc)
+		return rc;
+
+	if (region == CAM_SMMU_REGION_SECHEAP) {
+		region_supported = cb_info->secheap_support;
+	} else if (region == CAM_SMMU_REGION_FWUNCACHED) {
+		region_supported = cb_info->fwuncached_region_support;
+	} else {
+		CAM_ERR(CAM_SMMU, "Region not supported for reserving %d",
+			region);
+		return -EINVAL;
+	}
+
+	if (!region_supported) {
+		CAM_ERR(CAM_SMMU, "Reserve for region %d not supported",
+			region);
+		return -EINVAL;
+	}
+
+	mutex_lock(&cb_info->lock);
+
+	if (region == CAM_SMMU_REGION_SECHEAP) {
+		is_buf_allocated = &cb_info->is_secheap_allocated;
+		buf_info = &cb_info->secheap_info.buf_info;
+		region_info = &cb_info->secheap_info;
+	} else if (region == CAM_SMMU_REGION_FWUNCACHED) {
+		struct cam_smmu_nested_region_info *nested_reg_info;
+
+		nested_reg_info =
+			&cb_info->fwuncached_region.nested_regions[nested_reg_idx];
+
+		if (nested_reg_info->subregion_support) {
+			/* For FW uncached, subregion generic is to be used */
+			subregion_info = cam_smmu_find_subregion(CAM_SMMU_SUBREGION_GENERIC,
+				nested_reg_info->subregions);
+			if (IS_ERR_OR_NULL(subregion_info)) {
+				CAM_ERR(CAM_SMMU,
+					"Failed to find free uncached subregion on cb: %s",
+					cb_info->name[0]);
+				mutex_unlock(&cb_info->lock);
+				return -EINVAL;
+			}
+			region_info = &subregion_info->subregion_info;
+			buf_info = &subregion_info->subregion_info.buf_info;
+			is_buf_allocated = &subregion_info->is_allocated;
+		} else {
+			region_info = &nested_reg_info->region_info;
+			buf_info = &nested_reg_info->region_info.buf_info;
+			is_buf_allocated = &nested_reg_info->is_allocated;
+		}
+	} else {
+		CAM_ERR(CAM_SMMU, "Region not supported for reserving %d",
+			region);
+		mutex_unlock(&cb_info->lock);
+		return -EINVAL;
+	}
+
+	if ((*is_buf_allocated)) {
+		CAM_ERR(CAM_SMMU, "Trying to allocate twice for region %d",
+			region);
+		rc = -ENOMEM;
+		mutex_unlock(&cb_info->lock);
+		return rc;
+	}
+
+	if (IS_ERR_OR_NULL(buf)) {
+		rc = PTR_ERR(buf);
+		CAM_ERR(CAM_SMMU,
+			"Error: dma get buf failed. rc = %d", rc);
+		goto err_out;
+	}
+
+	CAM_DBG(CAM_SMMU, "Map region=%d iova=0x%x len=0x%x",
+		region, region_info->iova_start, region_info->iova_len);
+
+	buf_info->buf = buf;
+	buf_info->attach = dma_buf_attach(buf_info->buf,
+		cb_info->dev);
+	if (IS_ERR_OR_NULL(buf_info->attach)) {
+		rc = PTR_ERR(buf_info->attach);
+		CAM_ERR(CAM_SMMU, "Error: dma buf attach failed");
+		goto err_put;
+	}
+
+	buf_info->table = dma_buf_map_attachment(buf_info->attach,
+		DMA_BIDIRECTIONAL);
+	if (IS_ERR_OR_NULL(buf_info->table)) {
+		rc = PTR_ERR(buf_info->table);
+		CAM_ERR(CAM_SMMU, "Error: dma buf map attachment failed");
+		goto err_detach;
+	}
+
+	prot = IOMMU_READ | IOMMU_WRITE;
+	if (iommu_cb_set.force_cache_allocs)
+		prot |= IOMMU_CACHE;
+
+	size = iommu_map_sg(cb_info->domain,
+		region_info->iova_start,
+		buf_info->table->sgl,
+		buf_info->table->orig_nents,
+		prot,
+		GFP_KERNEL);
+	if (region_info->iova_len < size) {
+		CAM_ERR(CAM_SMMU,
+			"IOMMU mapping failed for size=%zu available iova_len=%zu",
+			size, region_info->iova_len);
+		rc = -EINVAL;
+		goto err_unmap_sg;
+	}
+
+	*iova = (uint32_t)region_info->iova_start;
+	/* Assign size mapped */
+	*request_len = size;
+	*is_buf_allocated = true;
+	mutex_unlock(&cb_info->lock);
+
+	return rc;
+
+err_unmap_sg:
+	dma_buf_unmap_attachment(buf_info->attach,
+		buf_info->table,
+		DMA_BIDIRECTIONAL);
+err_detach:
+	dma_buf_detach(buf_info->buf,
+		buf_info->attach);
+err_put:
+	dma_buf_put(buf_info->buf);
+err_out:
+	mutex_unlock(&cb_info->lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_reserve_buf_region);
+
+int cam_smmu_release_buf_region(enum cam_smmu_region_id region,
+	int32_t smmu_hdl)
+{
+	int idx, multi_client_device_idx, nested_reg_idx = 0;
+	size_t size = 0;
+	struct region_buf_info *buf_info = NULL;
+	struct cam_context_bank_info *cb_info;
+	bool *is_buf_allocated;
+	bool region_supported;
+	struct cam_smmu_region_info *region_info = NULL;
+	struct cam_smmu_subregion_info *subregion_info = NULL;
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	multi_client_device_idx = GET_SMMU_MULTI_CLIENT_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	cb_info = &iommu_cb_set.cb_info[idx];
+	if (cam_smmu_get_multiregion_client_dev_idx(cb_info,
+		multi_client_device_idx, region, &nested_reg_idx))
+		return -EINVAL;
+
+	if (region == CAM_SMMU_REGION_SECHEAP) {
+		region_supported = cb_info->secheap_support;
+	} else if (region == CAM_SMMU_REGION_FWUNCACHED) {
+		region_supported = cb_info->fwuncached_region_support;
+	} else {
+		CAM_ERR(CAM_SMMU, "Region not supported for release %d",
+			region);
+		return -EINVAL;
+	}
+
+	if (!region_supported) {
+		CAM_ERR(CAM_SMMU, "region: %d not supported", region);
+		return -EINVAL;
+	}
+	mutex_lock(&cb_info->lock);
+
+	if (region == CAM_SMMU_REGION_SECHEAP) {
+		is_buf_allocated = &cb_info->is_secheap_allocated;
+		buf_info = &cb_info->secheap_info.buf_info;
+		region_info = &cb_info->secheap_info;
+	} else if (region == CAM_SMMU_REGION_FWUNCACHED) {
+		struct cam_smmu_nested_region_info *nested_reg_info;
+
+		nested_reg_info =
+			&cb_info->fwuncached_region.nested_regions[nested_reg_idx];
+		if (nested_reg_info->subregion_support) {
+			subregion_info = cam_smmu_find_subregion(CAM_SMMU_SUBREGION_GENERIC,
+				nested_reg_info->subregions);
+			if (IS_ERR_OR_NULL(subregion_info)) {
+				CAM_ERR(CAM_SMMU,
+					"Failed to find uncached subregion on cb: %s",
+					cb_info->name[0]);
+				mutex_unlock(&cb_info->lock);
+				return -EINVAL;
+			}
+
+			is_buf_allocated = &subregion_info->is_allocated;
+			buf_info = &subregion_info->subregion_info.buf_info;
+			region_info = &subregion_info->subregion_info;
+		} else {
+			is_buf_allocated = &nested_reg_info->is_allocated;
+			buf_info = &nested_reg_info->region_info.buf_info;
+			region_info = &nested_reg_info->region_info;
+		}
+	} else {
+		CAM_ERR(CAM_SMMU, "Region not supported for release %d",
+			region);
+		mutex_unlock(&cb_info->lock);
+		return -EINVAL;
+	}
+
+	if (!(*is_buf_allocated)) {
+		CAM_ERR(CAM_SMMU,
+			"Trying to release freed region cb: %s region: %d",
+			cb_info->name[0], region);
+		mutex_unlock(&cb_info->lock);
+		return -ENOMEM;
+	}
+
+	size = iommu_unmap(cb_info->domain,
+		region_info->iova_start,
+		region_info->iova_len);
+	if (size != region_info->iova_len) {
+		CAM_ERR(CAM_SMMU, "Failed: Unmapped = %zu, requested = %zu",
+			size,
+			region_info->iova_len);
+	}
+
+	dma_buf_unmap_attachment(buf_info->attach,
+		buf_info->table, DMA_BIDIRECTIONAL);
+	dma_buf_detach(buf_info->buf, buf_info->attach);
+	*is_buf_allocated = false;
+	mutex_unlock(&cb_info->lock);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_smmu_release_buf_region);
+
+static int cam_smmu_util_return_map_entry(struct cam_smmu_buffer_tracker *entry)
+{
+	spin_lock_bh(&iommu_cb_set.s_lock);
+	list_add_tail(&entry->list, &iommu_cb_set.buf_tracker_free_list);
+	spin_unlock_bh(&iommu_cb_set.s_lock);
+
+	return 0;
+}
+
+void cam_smmu_buffer_tracker_putref(struct list_head *track_list)
+{
+	struct cam_smmu_buffer_tracker *buffer_tracker, *temp;
+
+	if (iommu_cb_set.is_track_buf_disabled)
+		return;
+
+	if (!track_list || list_empty(track_list))
+		return;
+
+	list_for_each_entry_safe(buffer_tracker, temp, track_list, list) {
+		if (refcount_dec_and_test(&buffer_tracker->ref_count->refcount))
+			CAM_ERR(CAM_SMMU,
+				"[SMMU_BT] Unexpected - buffer reference [fd: 0x%x ino: 0x%x cb: %s] zeroed prior to unmap invocation",
+				buffer_tracker->ion_fd, buffer_tracker->i_ino,
+				buffer_tracker->cb_name);
+		else
+			CAM_DBG(CAM_SMMU,
+				"[SMMU_BT] kref_count after put, [fd: 0x%x ino: 0x%x cb: %s], count: %d",
+				buffer_tracker->ion_fd, buffer_tracker->i_ino,
+				buffer_tracker->cb_name,
+				kref_read(buffer_tracker->ref_count));
+
+		list_del_init(&buffer_tracker->list);
+
+		cam_smmu_util_return_map_entry(buffer_tracker);
+
+	}
+}
+EXPORT_SYMBOL(cam_smmu_buffer_tracker_putref);
+
+static int cam_smmu_map_buffer_validate(struct dma_buf *buf,
+	int idx, enum dma_data_direction dma_dir, dma_addr_t *paddr_ptr,
+	size_t *len_ptr, enum cam_smmu_region_id region_id,
+	bool dis_delayed_unmap, struct cam_dma_buff_info **mapping_info)
+{
+	struct dma_buf_attachment *attach = NULL;
+	struct sg_table *table = NULL;
+	struct iommu_domain *domain;
+	size_t size = 0;
+	unsigned long iova = 0;
+	int rc = 0;
+	struct timespec64 ts1, ts2;
+	long microsec = 0;
+	int prot = 0;
+
+	if (IS_ERR_OR_NULL(buf)) {
+		rc = PTR_ERR(buf);
+		CAM_ERR(CAM_SMMU,
+			"Error: dma get buf failed. rc = %d", rc);
+		goto err_out;
+	}
+
+	if (!mapping_info) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_SMMU, "Error: mapping_info is invalid");
+		goto err_out;
+	}
+
+	if (iommu_cb_set.debug_cfg.map_profile_enable)
+		CAM_GET_TIMESTAMP(ts1);
+
+	attach = dma_buf_attach(buf, iommu_cb_set.cb_info[idx].dev);
+	if (IS_ERR_OR_NULL(attach)) {
+		rc = PTR_ERR(attach);
+		CAM_ERR(CAM_SMMU, "Error: dma buf attach failed");
+		goto err_out;
+	}
+
+	if (region_id == CAM_SMMU_REGION_SHARED) {
+		table = dma_buf_map_attachment(attach, dma_dir);
+		if (IS_ERR_OR_NULL(table)) {
+			rc = PTR_ERR(table);
+			CAM_ERR(CAM_SMMU, "Error: dma map attachment failed");
+			goto err_detach;
+		}
+
+		domain = iommu_cb_set.cb_info[idx].domain;
+		if (!domain) {
+			CAM_ERR(CAM_SMMU, "CB has no domain set");
+			goto err_unmap_sg;
+		}
+
+		rc = cam_smmu_alloc_iova(*len_ptr, iommu_cb_set.cb_info[idx].handle, &iova);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU,
+				"IOVA alloc failed for shared memory, size=%zu, idx=%d, handle=%d",
+				*len_ptr, idx,
+				iommu_cb_set.cb_info[idx].handle);
+			goto err_unmap_sg;
+		}
+
+		prot = IOMMU_READ | IOMMU_WRITE;
+		if (iommu_cb_set.force_cache_allocs)
+			prot |= IOMMU_CACHE;
+
+		size = iommu_map_sg(domain, iova, table->sgl, table->orig_nents,
+				prot, GFP_KERNEL);
+
+		if (size < 0) {
+			CAM_ERR(CAM_SMMU, "IOMMU mapping failed");
+			rc = cam_smmu_free_iova(iova,
+				size, iommu_cb_set.cb_info[idx].handle);
+			if (rc)
+				CAM_ERR(CAM_SMMU, "IOVA free failed");
+			rc = -ENOMEM;
+			goto err_unmap_sg;
+		} else {
+			CAM_DBG(CAM_SMMU,
+				"iommu_map_sg returned iova=%pK, size=%zu",
+				iova, size);
+			*paddr_ptr = iova;
+			*len_ptr = size;
+		}
+		iommu_cb_set.cb_info[idx].shared_mapping_size += *len_ptr;
+	} else if (region_id == CAM_SMMU_REGION_IO) {
+		if (!dis_delayed_unmap)
+			attach->dma_map_attrs |= DMA_ATTR_DELAYED_UNMAP;
+
+		table = dma_buf_map_attachment(attach, dma_dir);
+		if (IS_ERR_OR_NULL(table)) {
+			rc = PTR_ERR(table);
+			CAM_ERR(CAM_SMMU,
+				"Error: dma map attachment failed, size=%zu, rc %d dma_dir %d",
+				buf->size, rc, dma_dir);
+			goto err_detach;
+		}
+
+		*paddr_ptr = sg_dma_address(table->sgl);
+		*len_ptr = (size_t)buf->size;
+		iommu_cb_set.cb_info[idx].io_mapping_size += *len_ptr;
+	} else {
+		CAM_ERR(CAM_SMMU, "Error: Wrong region id passed");
+		rc = -EINVAL;
+		goto err_detach;
+	}
+
+	CAM_DBG(CAM_SMMU,
+		"iova=%pK, region_id=%d, paddr=0x%llx, len=%zu, dma_map_attrs=%d",
+		iova, region_id, *paddr_ptr, *len_ptr, attach->dma_map_attrs);
+
+	if (iommu_cb_set.debug_cfg.map_profile_enable) {
+		CAM_GET_TIMESTAMP(ts2);
+		CAM_GET_TIMESTAMP_DIFF_IN_MICRO(ts1, ts2, microsec);
+		trace_cam_log_event("SMMUMapProfile", "size and time in micro",
+			*len_ptr, microsec);
+	}
+
+	if (table->sgl) {
+		CAM_DBG(CAM_SMMU,
+			"DMA buf: %pK, device: %pK, attach: %pK, table: %pK",
+			(void *)buf,
+			(void *)iommu_cb_set.cb_info[idx].dev,
+			(void *)attach, (void *)table);
+		CAM_DBG(CAM_SMMU, "table sgl: %pK, rc: %d, dma_address: 0x%x",
+			(void *)table->sgl, rc,
+			(unsigned int)table->sgl->dma_address);
+	} else {
+		rc = -EINVAL;
+		CAM_ERR(CAM_SMMU, "Error: table sgl is null");
+		goto err_unmap_sg;
+	}
+
+	/* fill up mapping_info */
+	*mapping_info = kzalloc(sizeof(struct cam_dma_buff_info), GFP_KERNEL);
+	if (!(*mapping_info)) {
+		rc = -ENOSPC;
+		goto err_alloc;
+	}
+
+	(*mapping_info)->buf = buf;
+	(*mapping_info)->attach = attach;
+	(*mapping_info)->table = table;
+	(*mapping_info)->paddr = *paddr_ptr;
+	(*mapping_info)->len = *len_ptr;
+	(*mapping_info)->dir = dma_dir;
+	(*mapping_info)->map_count = 1;
+	(*mapping_info)->region_id = region_id;
+
+	if (!*paddr_ptr || !*len_ptr) {
+		CAM_ERR(CAM_SMMU, "Error: Space Allocation failed");
+		kfree(*mapping_info);
+		*mapping_info = NULL;
+		rc = -ENOSPC;
+		goto err_alloc;
+	}
+
+	CAM_DBG(CAM_SMMU, "idx=%d, dma_buf=%pK, dev=%pOFfp, paddr=0x%llx, len=%zu",
+		idx, buf,
+		iommu_cb_set.cb_info[idx].dev->of_node,
+		*paddr_ptr, *len_ptr);
+
+	/* Unmap the mapping in dma region as this is not used anyway */
+	if (region_id == CAM_SMMU_REGION_SHARED)
+		dma_buf_unmap_attachment(attach, table, dma_dir);
+
+	return 0;
+
+err_alloc:
+	if (region_id == CAM_SMMU_REGION_SHARED) {
+		cam_smmu_free_iova(iova,
+			size,
+			iommu_cb_set.cb_info[idx].handle);
+
+		iommu_unmap(iommu_cb_set.cb_info[idx].domain,
+			*paddr_ptr,
+			*len_ptr);
+	}
+err_unmap_sg:
+	dma_buf_unmap_attachment(attach, table, dma_dir);
+err_detach:
+	dma_buf_detach(buf, attach);
+err_out:
+	return rc;
+}
+
+
+static int cam_smmu_map_buffer_and_add_to_list(int idx, int ion_fd,
+	bool dis_delayed_unmap, enum dma_data_direction dma_dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id, bool is_internal, struct dma_buf *buf,
+	struct kref **ref_count)
+{
+	int rc = -1;
+	struct cam_dma_buff_info *mapping_info = NULL;
+
+	rc = cam_smmu_map_buffer_validate(buf, idx, dma_dir, paddr_ptr, len_ptr,
+		region_id, dis_delayed_unmap, &mapping_info);
+
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "buffer validation failure");
+		return rc;
+	}
+
+	mapping_info->ion_fd = ion_fd;
+	mapping_info->i_ino = file_inode(buf->file)->i_ino;
+	mapping_info->is_internal = is_internal;
+	kref_init(&mapping_info->ref_count);
+	*ref_count = &mapping_info->ref_count;
+	CAM_GET_TIMESTAMP(mapping_info->ts);
+	/* add to the list */
+	list_add(&mapping_info->list,
+		&iommu_cb_set.cb_info[idx].smmu_buf_list);
+
+	CAM_DBG(CAM_SMMU, "fd %d i_ino %lu dmabuf %pK", ion_fd, mapping_info->i_ino, buf);
+
+	cam_smmu_update_monitor_array(&iommu_cb_set.cb_info[idx], true,
+		mapping_info);
+
+	return 0;
+}
+
+static int cam_smmu_map_kernel_buffer_and_add_to_list(int idx,
+	struct dma_buf *buf, enum dma_data_direction dma_dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id)
+{
+	int rc = -1;
+	struct cam_dma_buff_info *mapping_info = NULL;
+
+	rc = cam_smmu_map_buffer_validate(buf, idx, dma_dir, paddr_ptr, len_ptr,
+		region_id, false, &mapping_info);
+
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "buffer validation failure");
+		return rc;
+	}
+
+	mapping_info->ion_fd = -1;
+	mapping_info->i_ino = file_inode(buf->file)->i_ino;
+	CAM_GET_TIMESTAMP(mapping_info->ts);
+
+	/* add to the list */
+	list_add(&mapping_info->list,
+		&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list);
+
+	CAM_DBG(CAM_SMMU, "fd %d i_ino %lu dmabuf %pK",
+		mapping_info->ion_fd, mapping_info->i_ino, buf);
+
+	cam_smmu_update_monitor_array(&iommu_cb_set.cb_info[idx], true,
+		mapping_info);
+
+	return 0;
+}
+
+
+static int cam_smmu_unmap_buf_and_remove_from_list(
+	struct cam_dma_buff_info *mapping_info,
+	int idx)
+{
+	int rc;
+	size_t size;
+	struct iommu_domain *domain;
+	struct timespec64 ts1, ts2;
+	long microsec = 0;
+
+	if ((!mapping_info->buf) || (!mapping_info->table) ||
+		(!mapping_info->attach)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params dev = %pK, table = %pK",
+			(void *)iommu_cb_set.cb_info[idx].dev,
+			(void *)mapping_info->table);
+		CAM_ERR(CAM_SMMU, "Error:dma_buf = %pK, attach = %pK",
+			(void *)mapping_info->buf,
+			(void *)mapping_info->attach);
+		return -EINVAL;
+	}
+
+	cam_smmu_update_monitor_array(&iommu_cb_set.cb_info[idx], false,
+		mapping_info);
+
+	CAM_DBG(CAM_SMMU,
+		"region_id=%d, paddr=0x%llx, len=%d, dma_map_attrs=%d",
+		mapping_info->region_id, mapping_info->paddr, mapping_info->len,
+		mapping_info->attach->dma_map_attrs);
+
+	if (iommu_cb_set.debug_cfg.map_profile_enable)
+		CAM_GET_TIMESTAMP(ts1);
+
+	if (mapping_info->region_id == CAM_SMMU_REGION_SHARED) {
+		CAM_DBG(CAM_SMMU,
+			"Removing SHARED buffer paddr = 0x%llx, len = %zu",
+			mapping_info->paddr, mapping_info->len);
+
+		domain = iommu_cb_set.cb_info[idx].domain;
+
+		size = iommu_unmap(domain,
+			mapping_info->paddr,
+			mapping_info->len);
+
+		if (size != mapping_info->len) {
+			CAM_ERR(CAM_SMMU, "IOMMU unmap failed");
+			CAM_ERR(CAM_SMMU, "Unmapped = %zu, requested = %zu",
+				size,
+				mapping_info->len);
+		}
+
+		rc = cam_smmu_free_iova(mapping_info->paddr,
+			mapping_info->len,
+			iommu_cb_set.cb_info[idx].handle);
+
+		if (rc)
+			CAM_ERR(CAM_SMMU, "IOVA free failed");
+
+		iommu_cb_set.cb_info[idx].shared_mapping_size -=
+			mapping_info->len;
+	} else if (mapping_info->region_id == CAM_SMMU_REGION_IO) {
+		if (mapping_info->is_internal)
+			mapping_info->attach->dma_map_attrs |=
+				DMA_ATTR_SKIP_CPU_SYNC;
+
+		dma_buf_unmap_attachment(mapping_info->attach,
+			mapping_info->table, mapping_info->dir);
+		iommu_cb_set.cb_info[idx].io_mapping_size -= mapping_info->len;
+	}
+
+
+	dma_buf_detach(mapping_info->buf, mapping_info->attach);
+
+	if (iommu_cb_set.debug_cfg.map_profile_enable) {
+		CAM_GET_TIMESTAMP(ts2);
+		CAM_GET_TIMESTAMP_DIFF_IN_MICRO(ts1, ts2, microsec);
+		trace_cam_log_event("SMMUUnmapProfile",
+			"size and time in micro", mapping_info->len, microsec);
+	}
+
+	mapping_info->buf = NULL;
+
+	list_del_init(&mapping_info->list);
+
+	/* free one buffer */
+	kfree(mapping_info);
+	return 0;
+}
+
+static int cam_smmu_util_get_free_map_entry(struct cam_smmu_buffer_tracker **entry)
+{
+	spin_lock_bh(&iommu_cb_set.s_lock);
+	if (list_empty(&iommu_cb_set.buf_tracker_free_list)) {
+		CAM_WARN(CAM_SMMU, "[SMMU_BT] Not enough mem to track buffer");
+		spin_unlock_bh(&iommu_cb_set.s_lock);
+		return -ENOMEM;
+	}
+
+	*entry = list_first_entry(&iommu_cb_set.buf_tracker_free_list,
+		struct cam_smmu_buffer_tracker, list);
+
+	list_del_init(&(*entry)->list);
+	spin_unlock_bh(&iommu_cb_set.s_lock);
+
+	return 0;
+}
+
+int cam_smmu_add_buf_to_track_list(int ion_fd, unsigned long inode,
+	struct kref **ref_count, struct list_head *buf_tracker, int idx)
+{
+	int rc = 0;
+	struct cam_smmu_buffer_tracker *buf;
+
+	if (iommu_cb_set.is_track_buf_disabled)
+		return rc;
+
+	rc = cam_smmu_util_get_free_map_entry(&buf);
+	if (rc == -ENOMEM) {
+		rc = 0;
+		return rc;
+	}
+
+	kref_get(*ref_count);
+
+	buf->ion_fd = ion_fd;
+	buf->i_ino = inode;
+	buf->ref_count = *ref_count;
+	buf->cb_name = iommu_cb_set.cb_info[idx].name[0];
+
+	CAM_DBG(CAM_SMMU,
+		"[SMMU_BT] ref_cnt increased for fd 0x%x, ino 0x%x: %d, cb: %s",
+		buf->ion_fd, buf->i_ino, kref_read(buf->ref_count), buf->cb_name);
+
+	list_add(&buf->list, buf_tracker);
+
+	return rc;
+}
+
+static enum cam_smmu_buf_state cam_smmu_check_fd_in_list(int idx,
+	int ion_fd, struct dma_buf *dmabuf, dma_addr_t *paddr_ptr, size_t *len_ptr,
+	struct timespec64 **ts_mapping, unsigned long *inode, struct kref **ref_count)
+{
+	struct cam_dma_buff_info *mapping;
+	unsigned long i_ino;
+
+	i_ino = file_inode(dmabuf->file)->i_ino;
+
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		if ((mapping->ion_fd == ion_fd) && (mapping->i_ino == i_ino)) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			*ts_mapping = &mapping->ts;
+			*inode = i_ino;
+			*ref_count = &mapping->ref_count;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+static enum cam_smmu_buf_state cam_smmu_user_reuse_fd_in_list(int idx,
+	int ion_fd, struct dma_buf *dmabuf, dma_addr_t *paddr_ptr, size_t *len_ptr,
+	struct timespec64 **ts_mapping, struct kref **ref_count)
+{
+	struct cam_dma_buff_info *mapping;
+	unsigned long i_ino;
+
+	i_ino = file_inode(dmabuf->file)->i_ino;
+
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		if ((mapping->ion_fd == ion_fd) && (mapping->i_ino == i_ino)) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			*ts_mapping = &mapping->ts;
+			mapping->map_count++;
+			*ref_count = &mapping->ref_count;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+static enum cam_smmu_buf_state cam_smmu_check_dma_buf_in_list(int idx,
+	struct dma_buf *buf, dma_addr_t *paddr_ptr, size_t *len_ptr)
+{
+	struct cam_dma_buff_info *mapping;
+
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list, list) {
+		if (mapping->buf == buf) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+static enum cam_smmu_buf_state cam_smmu_check_secure_fd_in_list(int idx,
+	int ion_fd, struct dma_buf *dmabuf, dma_addr_t *paddr_ptr, size_t *len_ptr,
+	struct kref **ref_count)
+{
+	struct cam_sec_buff_info *mapping;
+	unsigned long i_ino;
+
+	i_ino = file_inode(dmabuf->file)->i_ino;
+
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list,
+			list) {
+		if ((mapping->ion_fd == ion_fd) && (mapping->i_ino == i_ino)) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			mapping->map_count++;
+			*ref_count = &mapping->ref_count;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+static enum cam_smmu_buf_state cam_smmu_validate_secure_fd_in_list(int idx,
+	int ion_fd, struct dma_buf *dmabuf, dma_addr_t *paddr_ptr, size_t *len_ptr,
+		unsigned long *inode, struct kref **ref_count)
+{
+	struct cam_sec_buff_info *mapping;
+	unsigned long i_ino;
+
+	i_ino = file_inode(dmabuf->file)->i_ino;
+
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list,
+			list) {
+		if ((mapping->ion_fd == ion_fd) && (mapping->i_ino == i_ino)) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			*inode = i_ino;
+			*ref_count = &mapping->ref_count;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+int cam_smmu_get_handle(char *identifier, int *handle_ptr)
+{
+	int rc = 0;
+
+	if (!identifier) {
+		CAM_ERR(CAM_SMMU, "Error: iommu hardware name is NULL");
+		return -EINVAL;
+	}
+
+	if (!handle_ptr) {
+		CAM_ERR(CAM_SMMU, "Error: handle pointer is NULL");
+		return -EINVAL;
+	}
+
+	/* create and put handle in the table */
+	rc = cam_smmu_create_add_handle_in_table(identifier, handle_ptr);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "Error: %s get handle fail, rc %d",
+			identifier, rc);
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_get_handle);
+
+int cam_smmu_ops(int handle, enum cam_smmu_ops_param ops)
+{
+	int ret = 0, idx;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU, "Error: Index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return -EINVAL;
+	}
+
+	switch (ops) {
+	case CAM_SMMU_ATTACH: {
+		ret = cam_smmu_attach(idx);
+		break;
+	}
+	case CAM_SMMU_DETACH: {
+		ret = cam_smmu_detach_device(idx);
+		break;
+	}
+	case CAM_SMMU_VOTE:
+	case CAM_SMMU_DEVOTE:
+	default:
+		CAM_ERR(CAM_SMMU, "Error: idx = %d, ops = %d", idx, ops);
+		ret = -EINVAL;
+	}
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return ret;
+}
+EXPORT_SYMBOL(cam_smmu_ops);
+
+static int cam_smmu_alloc_scratch_buffer_add_to_list(int idx,
+	size_t virt_len,
+	size_t phys_len,
+	unsigned int iommu_dir,
+	dma_addr_t *virt_addr)
+{
+	unsigned long nents = virt_len / phys_len;
+	struct cam_dma_buff_info *mapping_info = NULL;
+	size_t unmapped;
+	dma_addr_t iova = 0;
+	struct scatterlist *sg;
+	int i = 0;
+	int rc;
+	struct iommu_domain *domain = NULL;
+	struct page *page;
+	struct sg_table *table = NULL;
+
+	CAM_DBG(CAM_SMMU, "nents = %lu, idx = %d, virt_len  = %zx",
+		nents, idx, virt_len);
+	CAM_DBG(CAM_SMMU, "phys_len = %zx, iommu_dir = %d, virt_addr = %pK",
+		phys_len, iommu_dir, virt_addr);
+
+	/*
+	 * This table will go inside the 'mapping' structure
+	 * where it will be held until put_scratch_buffer is called
+	 */
+	table = kzalloc(sizeof(struct sg_table), GFP_KERNEL);
+	if (!table) {
+		rc = -ENOMEM;
+		goto err_table_alloc;
+	}
+
+	rc = sg_alloc_table(table, nents, GFP_KERNEL);
+	if (rc < 0) {
+		rc = -EINVAL;
+		goto err_sg_alloc;
+	}
+
+	page = alloc_pages(GFP_KERNEL, get_order(phys_len));
+	if (!page) {
+		rc = -ENOMEM;
+		goto err_page_alloc;
+	}
+
+	/* Now we create the sg list */
+	for_each_sg(table->sgl, sg, table->nents, i)
+		sg_set_page(sg, page, phys_len, 0);
+
+
+	/* Get the domain from within our cb_set struct and map it*/
+	domain = iommu_cb_set.cb_info[idx].domain;
+
+	rc = cam_smmu_alloc_scratch_va(&iommu_cb_set.cb_info[idx].scratch_map,
+		virt_len, &iova);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"Could not find valid iova for scratch buffer");
+		goto err_iommu_map;
+	}
+
+	if (iommu_cb_set.force_cache_allocs)
+		iommu_dir |= IOMMU_CACHE;
+
+	if (iommu_map_sg(domain,
+		iova,
+		table->sgl,
+		table->nents,
+		iommu_dir, GFP_KERNEL) != virt_len) {
+		CAM_ERR(CAM_SMMU, "iommu_map_sg() failed");
+		goto err_iommu_map;
+	}
+
+	/* Now update our mapping information within the cb_set struct */
+	mapping_info = kzalloc(sizeof(struct cam_dma_buff_info), GFP_KERNEL);
+	if (!mapping_info) {
+		rc = -ENOMEM;
+		goto err_mapping_info;
+	}
+
+	mapping_info->ion_fd = 0xDEADBEEF;
+	mapping_info->i_ino = 0;
+	mapping_info->buf = NULL;
+	mapping_info->attach = NULL;
+	mapping_info->table = table;
+	mapping_info->paddr = iova;
+	mapping_info->len = virt_len;
+	mapping_info->iommu_dir = iommu_dir;
+	mapping_info->map_count = 1;
+	mapping_info->phys_len = phys_len;
+	mapping_info->region_id = CAM_SMMU_REGION_SCRATCH;
+
+	CAM_DBG(CAM_SMMU, "paddr = %pK, len = %zx, phys_len = %zx",
+		(void *)mapping_info->paddr,
+		mapping_info->len, mapping_info->phys_len);
+
+	list_add(&mapping_info->list, &iommu_cb_set.cb_info[idx].smmu_buf_list);
+
+	*virt_addr = (dma_addr_t)iova;
+
+	CAM_DBG(CAM_SMMU, "mapped virtual address = %lx",
+		(unsigned long)*virt_addr);
+	return 0;
+
+err_mapping_info:
+	unmapped = iommu_unmap(domain, iova,  virt_len);
+	if (unmapped != virt_len)
+		CAM_ERR(CAM_SMMU, "Unmapped only %zx instead of %zx",
+			unmapped, virt_len);
+err_iommu_map:
+	__free_pages(page, get_order(phys_len));
+err_page_alloc:
+	sg_free_table(table);
+err_sg_alloc:
+	kfree(table);
+err_table_alloc:
+	return rc;
+}
+
+static int cam_smmu_free_scratch_buffer_remove_from_list(
+	struct cam_dma_buff_info *mapping_info,
+	int idx)
+{
+	int rc = 0;
+	size_t unmapped;
+	struct iommu_domain *domain =
+		iommu_cb_set.cb_info[idx].domain;
+	struct scratch_mapping *scratch_map =
+		&iommu_cb_set.cb_info[idx].scratch_map;
+
+	if (!mapping_info->table) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params: dev = %pK, table = %pK",
+			(void *)iommu_cb_set.cb_info[idx].dev,
+			(void *)mapping_info->table);
+		return -EINVAL;
+	}
+
+	/* Clean up the mapping_info struct from the list */
+	unmapped = iommu_unmap(domain, mapping_info->paddr, mapping_info->len);
+	if (unmapped != mapping_info->len)
+		CAM_ERR(CAM_SMMU, "Unmapped only %zx instead of %zx",
+			unmapped, mapping_info->len);
+
+	rc = cam_smmu_free_scratch_va(scratch_map,
+		mapping_info->paddr,
+		mapping_info->len);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid iova while freeing scratch buffer");
+		rc = -EINVAL;
+	}
+
+	__free_pages(sg_page(mapping_info->table->sgl),
+			get_order(mapping_info->phys_len));
+	sg_free_table(mapping_info->table);
+	kfree(mapping_info->table);
+	list_del_init(&mapping_info->list);
+
+	kfree(mapping_info);
+	mapping_info = NULL;
+
+	return rc;
+}
+
+int cam_smmu_get_scratch_iova(int handle,
+	enum cam_smmu_map_dir dir,
+	dma_addr_t *paddr_ptr,
+	size_t virt_len,
+	size_t phys_len)
+{
+	int idx, rc;
+	unsigned int iommu_dir;
+
+	if (!paddr_ptr || !virt_len || !phys_len) {
+		CAM_ERR(CAM_SMMU, "Error: Input pointer or lengths invalid");
+		return -EINVAL;
+	}
+
+	if (virt_len < phys_len) {
+		CAM_ERR(CAM_SMMU, "Error: virt_len > phys_len");
+		return -EINVAL;
+	}
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	iommu_dir = cam_smmu_translate_dir_to_iommu_dir(dir);
+	if (iommu_dir == IOMMU_INVALID_DIR) {
+		CAM_ERR(CAM_SMMU,
+			"Error: translate direction failed. dir = %d", dir);
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].scratch_buf_support) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Context bank does not support scratch bufs");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	CAM_DBG(CAM_SMMU, "smmu handle = %x, idx = %d, dir = %d",
+		handle, idx, dir);
+	CAM_DBG(CAM_SMMU, "virt_len = %zx, phys_len  = %zx",
+		phys_len, virt_len);
+
+	if (iommu_cb_set.cb_info[idx].state != CAM_SMMU_ATTACH) {
+		CAM_ERR(CAM_SMMU,
+			"Err:Dev %s should call SMMU attach before map buffer",
+			iommu_cb_set.cb_info[idx].name[0]);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	if (!IS_ALIGNED(virt_len, PAGE_SIZE)) {
+		CAM_ERR(CAM_SMMU,
+			"Requested scratch buffer length not page aligned");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	if (!IS_ALIGNED(virt_len, phys_len)) {
+		CAM_ERR(CAM_SMMU,
+			"Requested virt length not aligned with phys length");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	rc = cam_smmu_alloc_scratch_buffer_add_to_list(idx,
+		virt_len,
+		phys_len,
+		iommu_dir,
+		paddr_ptr);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "Error: mapping or add list fail");
+
+error:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+
+int cam_smmu_put_scratch_iova(int handle,
+	dma_addr_t paddr)
+{
+	int idx;
+	int rc = -1;
+	struct cam_dma_buff_info *mapping_info;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* find index in the iommu_cb_set.cb_info */
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto handle_err;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].scratch_buf_support) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Context bank does not support scratch buffers");
+		rc = -EINVAL;
+		goto handle_err;
+	}
+
+	/* Based on virtual address and index, we can find mapping info
+	 * of the scratch buffer
+	 */
+	mapping_info = cam_smmu_find_mapping_by_virt_address(idx, paddr);
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid params");
+		rc = -ENODEV;
+		goto handle_err;
+	}
+
+	/* unmapping one buffer from device */
+	rc = cam_smmu_free_scratch_buffer_remove_from_list(mapping_info, idx);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: unmap or remove list fail");
+		goto handle_err;
+	}
+
+handle_err:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+
+static int cam_smmu_map_stage2_buffer_and_add_to_list(int idx, int ion_fd,
+	enum dma_data_direction dma_dir, dma_addr_t *paddr_ptr,
+	size_t *len_ptr, struct dma_buf *dmabuf, struct kref **ref_count)
+{
+	int rc = 0;
+	struct dma_buf_attachment *attach = NULL;
+	struct sg_table *table = NULL;
+	struct cam_sec_buff_info *mapping_info;
+
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	*len_ptr = (size_t)0;
+
+	/*
+	 * ion_phys() is deprecated. call dma_buf_attach() and
+	 * dma_buf_map_attachment() to get the buffer's physical
+	 * address.
+	 */
+	attach = dma_buf_attach(dmabuf, iommu_cb_set.cb_info[idx].dev);
+	if (IS_ERR_OR_NULL(attach)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: dma buf attach failed, idx=%d, ion_fd=%d",
+			idx, ion_fd);
+		rc = PTR_ERR(attach);
+		goto err_out;
+	}
+
+	attach->dma_map_attrs |= DMA_ATTR_SKIP_CPU_SYNC;
+
+	if (IS_CSF25(iommu_cb_set.csf_version.arch_ver,
+		iommu_cb_set.csf_version.max_ver))
+		attach->dma_map_attrs =
+			cam_update_dma_map_attributes(attach->dma_map_attrs);
+
+	table = dma_buf_map_attachment(attach, dma_dir);
+	if (IS_ERR_OR_NULL(table)) {
+		CAM_ERR(CAM_SMMU, "Error: dma buf map attachment failed");
+		rc = PTR_ERR(table);
+		goto err_detach;
+	}
+
+	/* return addr and len to client */
+	if (IS_CSF25(iommu_cb_set.csf_version.arch_ver,
+		iommu_cb_set.csf_version.max_ver))
+		*paddr_ptr = sg_dma_address(table->sgl);
+	else
+		*paddr_ptr = sg_phys(table->sgl);
+
+	*len_ptr = (size_t)sg_dma_len(table->sgl);
+
+	/* fill up mapping_info */
+	mapping_info = kzalloc(sizeof(struct cam_sec_buff_info), GFP_KERNEL);
+	if (!mapping_info) {
+		rc = -ENOMEM;
+		goto err_unmap_sg;
+	}
+
+	mapping_info->ion_fd = ion_fd;
+	mapping_info->i_ino = file_inode(dmabuf->file)->i_ino;
+	mapping_info->paddr = *paddr_ptr;
+	mapping_info->len = *len_ptr;
+	mapping_info->dir = dma_dir;
+	mapping_info->map_count = 1;
+	mapping_info->buf = dmabuf;
+	mapping_info->attach = attach;
+	mapping_info->table = table;
+
+	kref_init(&mapping_info->ref_count);
+	*ref_count = &mapping_info->ref_count;
+
+	CAM_DBG(CAM_SMMU, "idx=%d, ion_fd=%d, i_ino=%lu, dev=%pOFfp, paddr=0x%llx, len=%zu",
+		idx, ion_fd, mapping_info->i_ino,
+		iommu_cb_set.cb_info[idx].dev->of_node,
+		*paddr_ptr, *len_ptr);
+
+	/* add to the list */
+	list_add(&mapping_info->list, &iommu_cb_set.cb_info[idx].smmu_buf_list);
+
+	return 0;
+
+err_unmap_sg:
+	dma_buf_unmap_attachment(attach, table, dma_dir);
+err_detach:
+	dma_buf_detach(dmabuf, attach);
+err_out:
+	return rc;
+}
+
+int cam_smmu_map_stage2_iova(int handle, int ion_fd, struct dma_buf *dmabuf,
+	enum cam_smmu_map_dir dir, dma_addr_t *paddr_ptr, size_t *len_ptr,
+	struct kref **ref_count)
+{
+	int idx, rc;
+	enum dma_data_direction dma_dir;
+	enum cam_smmu_buf_state buf_state;
+
+	if (!paddr_ptr || !len_ptr) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid inputs, paddr_ptr:%pK, len_ptr: %pK",
+			paddr_ptr, len_ptr);
+		return -EINVAL;
+	}
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	*len_ptr = (size_t)0;
+
+	dma_dir = cam_smmu_translate_dir(dir);
+	if (dma_dir == DMA_NONE) {
+		CAM_ERR(CAM_SMMU,
+			"Error: translate direction failed. dir = %d", dir);
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if ((handle == HANDLE_INIT) ||
+		(idx < 0) ||
+		(idx >= iommu_cb_set.cb_num)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't map secure mem to non secure cb, idx=%d",
+			idx);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, handle)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, idx=%d, table_hdl=%x, hdl=%x",
+			idx, iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_check_secure_fd_in_list(idx, ion_fd, dmabuf, paddr_ptr,
+			len_ptr, ref_count);
+	if (buf_state == CAM_SMMU_BUFF_EXIST) {
+		CAM_DBG(CAM_SMMU,
+			"fd:%d already in list idx:%d, handle=%d give same addr back",
+			ion_fd, idx, handle);
+		rc = 0;
+		goto get_addr_end;
+	}
+	rc = cam_smmu_map_stage2_buffer_and_add_to_list(idx, ion_fd, dma_dir,
+			paddr_ptr, len_ptr, dmabuf, ref_count);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"Error: mapping or add list fail, idx=%d, handle=%d, fd=%d, rc=%d",
+			idx, handle, ion_fd, rc);
+		goto get_addr_end;
+	}
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_map_stage2_iova);
+
+static int cam_smmu_secure_unmap_buf_and_remove_from_list(
+		struct cam_sec_buff_info *mapping_info,
+		int idx)
+{
+	if ((!mapping_info->buf) || (!mapping_info->table) ||
+		(!mapping_info->attach)) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid params dev = %pK, table = %pK",
+			(void *)iommu_cb_set.cb_info[idx].dev,
+			(void *)mapping_info->table);
+		CAM_ERR(CAM_SMMU, "Error:dma_buf = %pK, attach = %pK\n",
+			(void *)mapping_info->buf,
+			(void *)mapping_info->attach);
+		return -EINVAL;
+	}
+
+	/* skip cache operations */
+	mapping_info->attach->dma_map_attrs |= DMA_ATTR_SKIP_CPU_SYNC;
+
+	/* iommu buffer clean up */
+	dma_buf_unmap_attachment(mapping_info->attach,
+		mapping_info->table, mapping_info->dir);
+	dma_buf_detach(mapping_info->buf, mapping_info->attach);
+	mapping_info->buf = NULL;
+
+	list_del_init(&mapping_info->list);
+
+	CAM_DBG(CAM_SMMU, "unmap fd: %d, i_ino : %lu, idx : %d",
+		mapping_info->ion_fd, mapping_info->i_ino, idx);
+
+	/* free one buffer */
+	kfree(mapping_info);
+	return 0;
+}
+
+int cam_smmu_unmap_stage2_iova(int handle, int ion_fd, struct dma_buf *dma_buf,
+	bool force_unmap)
+{
+	int idx, rc;
+	struct cam_sec_buff_info *mapping_info;
+
+	/* find index in the iommu_cb_set.cb_info */
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if ((handle == HANDLE_INIT) ||
+		(idx < 0) ||
+		(idx >= iommu_cb_set.cb_num)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't unmap secure mem from non secure cb");
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, handle)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto put_addr_end;
+	}
+
+	/* based on ion fd and index, we can find mapping info of buffer */
+	mapping_info = cam_smmu_find_mapping_by_sec_buf_idx(idx, ion_fd, dma_buf);
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params! idx = %d, fd = %d",
+			idx, ion_fd);
+		rc = -EINVAL;
+		goto put_addr_end;
+	}
+
+	mapping_info->map_count--;
+	if (mapping_info->map_count > 0) {
+		CAM_DBG(CAM_SMMU,
+			"idx: %d fd = %d map_count: %d",
+			idx, ion_fd, mapping_info->map_count);
+		rc = 0;
+		goto put_addr_end;
+	}
+	mapping_info->map_count = 0;
+	if (!force_unmap && kref_read(&mapping_info->ref_count) > 1) {
+		CAM_ERR(CAM_SMMU,
+			"[SMMU_BT] Error: can't unmap buffer as it's still active, idx: %d, cb: %s, fd: 0x%x, ino: 0x%x, ref_count: %d",
+			idx, iommu_cb_set.cb_info[idx].name[0], ion_fd, mapping_info->i_ino,
+			kref_read(&mapping_info->ref_count));
+		rc = -EPERM;
+		goto put_addr_end;
+	}
+
+	/* unmapping one buffer from device */
+	rc = cam_smmu_secure_unmap_buf_and_remove_from_list(mapping_info, idx);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "Error: unmap or remove list fail");
+		goto put_addr_end;
+	}
+
+put_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_unmap_stage2_iova);
+
+static int cam_smmu_map_iova_validate_params(int handle,
+	enum cam_smmu_map_dir dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id)
+{
+	int idx, rc = 0;
+	enum dma_data_direction dma_dir;
+
+	if (!paddr_ptr || !len_ptr) {
+		CAM_ERR(CAM_SMMU, "Input pointers are invalid");
+		return -EINVAL;
+	}
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Invalid handle");
+		return -EINVAL;
+	}
+
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	if (region_id != CAM_SMMU_REGION_SHARED)
+		*len_ptr = (size_t)0;
+
+	dma_dir = cam_smmu_translate_dir(dir);
+	if (dma_dir == DMA_NONE) {
+		CAM_ERR(CAM_SMMU, "translate direction failed. dir = %d", dir);
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU, "handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+bool cam_smmu_supports_shared_region(int handle)
+{
+	int idx = GET_SMMU_TABLE_IDX(handle);
+	bool is_shared;
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	is_shared = (iommu_cb_set.cb_info[idx].shared_support) ? true : false;
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+
+	return is_shared;
+}
+
+void cam_smmu_buffer_tracker_buffer_putref(struct cam_smmu_buffer_tracker *entry)
+{
+
+	if (!entry) {
+		CAM_WARN(CAM_ISP, "[SMMU_BT] track buffer entry is NULL");
+		return;
+	}
+
+	if (refcount_dec_and_test(&entry->ref_count->refcount))
+		CAM_ERR(CAM_SMMU,
+			"[SMMU_BT] Unexpected - buffer reference [fd: 0x%x ino: 0x%x cb: %s] zeroed prior to unmap invocation",
+			entry->ion_fd,  entry->i_ino, entry->cb_name);
+	else
+		CAM_DBG(CAM_SMMU,
+			"[SMMU_BT] kref_count after put, [fd: 0x%x ino: 0x%x cb: %s], count: %d",
+			entry->ion_fd, entry->i_ino, entry->cb_name, kref_read(entry->ref_count));
+
+
+	list_del_init(&entry->list);
+
+	cam_smmu_util_return_map_entry(entry);
+
+}
+
+int cam_smmu_map_user_iova(int handle, int ion_fd, struct dma_buf *dmabuf,
+	bool dis_delayed_unmap, enum cam_smmu_map_dir dir, dma_addr_t *paddr_ptr,
+	size_t *len_ptr, enum cam_smmu_region_id region_id,
+	bool is_internal, struct kref **ref_count)
+{
+	int idx, rc = 0;
+	struct timespec64 *ts = NULL;
+	enum cam_smmu_buf_state buf_state;
+	enum dma_data_direction dma_dir;
+
+	rc = cam_smmu_map_iova_validate_params(handle, dir, paddr_ptr,
+		len_ptr, region_id);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "initial checks failed, unable to proceed");
+		return rc;
+	}
+
+	dma_dir = (enum dma_data_direction)dir;
+	idx = GET_SMMU_TABLE_IDX(handle);
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't map non-secure mem to secure cb idx=%d",
+			idx);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, handle)) {
+		CAM_ERR(CAM_SMMU,
+			"hdl is not valid, idx=%d, table_hdl = %x, hdl = %x",
+			idx, iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].state != CAM_SMMU_ATTACH) {
+		CAM_ERR(CAM_SMMU,
+			"Err:Dev %s should call SMMU attach before map buffer",
+			iommu_cb_set.cb_info[idx].name[0]);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_user_reuse_fd_in_list(idx, ion_fd, dmabuf, paddr_ptr,
+		len_ptr, &ts, ref_count);
+	if (buf_state == CAM_SMMU_BUFF_EXIST) {
+		uint64_t ms = 0, hrs = 0, min = 0, sec = 0;
+
+		if (ts)
+			CAM_CONVERT_TIMESTAMP_FORMAT((*ts), hrs, min, sec, ms);
+		CAM_ERR(CAM_SMMU,
+			"fd=%d already in list [%llu:%llu:%lu:%llu] cb=%s idx=%d handle=%d len=%llu,give same addr back",
+			ion_fd, hrs, min, sec, ms,
+			iommu_cb_set.cb_info[idx].name[0],
+			idx, handle, *len_ptr);
+		rc = 0;
+		goto get_addr_end;
+	}
+
+	rc = cam_smmu_map_buffer_and_add_to_list(idx, ion_fd,
+		dis_delayed_unmap, dma_dir, paddr_ptr, len_ptr,
+		region_id, is_internal, dmabuf, ref_count);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"mapping or add list fail cb:%s idx=%d, fd=%d, region=%d, rc=%d",
+			iommu_cb_set.cb_info[idx].name[0], idx,
+			ion_fd, region_id, rc);
+		cam_smmu_dump_cb_info(idx);
+	}
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_map_user_iova);
+
+int cam_smmu_map_kernel_iova(int handle, struct dma_buf *buf,
+	enum cam_smmu_map_dir dir, dma_addr_t *paddr_ptr,
+	size_t *len_ptr, enum cam_smmu_region_id region_id)
+{
+	int idx, rc = 0;
+	enum cam_smmu_buf_state buf_state;
+	enum dma_data_direction dma_dir;
+
+	rc = cam_smmu_map_iova_validate_params(handle, dir, paddr_ptr,
+		len_ptr, region_id);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "initial checks failed, unable to proceed");
+		return rc;
+	}
+
+	dma_dir = cam_smmu_translate_dir(dir);
+	idx = GET_SMMU_TABLE_IDX(handle);
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't map non-secure mem to secure cb");
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU, "hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].state != CAM_SMMU_ATTACH) {
+		CAM_ERR(CAM_SMMU,
+			"Err:Dev %s should call SMMU attach before map buffer",
+			iommu_cb_set.cb_info[idx].name[0]);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_check_dma_buf_in_list(idx, buf,
+	paddr_ptr, len_ptr);
+	if (buf_state == CAM_SMMU_BUFF_EXIST) {
+		CAM_ERR(CAM_SMMU,
+			"dma_buf :%pK already in the list", buf);
+		rc = -EALREADY;
+		goto get_addr_end;
+	}
+
+	rc = cam_smmu_map_kernel_buffer_and_add_to_list(idx, buf, dma_dir,
+			paddr_ptr, len_ptr, region_id);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "mapping or add list fail");
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_map_kernel_iova);
+
+int cam_smmu_get_iova(int handle, int ion_fd, struct dma_buf *dma_buf,
+	dma_addr_t *paddr_ptr, size_t *len_ptr, struct list_head *buf_tracker,
+	struct kref **ref_count)
+{
+	int idx, rc = 0;
+	struct timespec64 *ts = NULL;
+	enum cam_smmu_buf_state buf_state;
+	unsigned long i_ino;
+
+	if (!paddr_ptr || !len_ptr) {
+		CAM_ERR(CAM_SMMU, "Error: Input pointers are invalid");
+		return -EINVAL;
+	}
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	*len_ptr = (size_t)0;
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't get non-secure mem from secure cb");
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, handle)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_check_fd_in_list(idx, ion_fd, dma_buf, paddr_ptr,
+		len_ptr, &ts, &i_ino, ref_count);
+	if (buf_state == CAM_SMMU_BUFF_NOT_EXIST) {
+		CAM_ERR(CAM_SMMU, "ion_fd:%d not in the mapped list", ion_fd);
+		rc = -EINVAL;
+		cam_smmu_dump_cb_info(idx);
+		goto get_addr_end;
+	}
+
+	if (buf_tracker)
+		rc = cam_smmu_add_buf_to_track_list(ion_fd, i_ino, ref_count, buf_tracker, idx);
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_get_iova);
+
+int cam_smmu_get_stage2_iova(int handle, int ion_fd, struct dma_buf *dma_buf,
+	dma_addr_t *paddr_ptr, size_t *len_ptr, struct list_head *buf_tracker,
+	struct kref **ref_count)
+{
+	int idx, rc = 0;
+	enum cam_smmu_buf_state buf_state;
+	unsigned long i_ino;
+
+	if (!paddr_ptr || !len_ptr) {
+		CAM_ERR(CAM_SMMU, "Error: Input pointers are invalid");
+		return -EINVAL;
+	}
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	*len_ptr = (size_t)0;
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't get secure mem from non secure cb");
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, handle)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_validate_secure_fd_in_list(idx, ion_fd, dma_buf, paddr_ptr, len_ptr,
+		&i_ino, ref_count);
+
+	if (buf_state == CAM_SMMU_BUFF_NOT_EXIST) {
+		CAM_ERR(CAM_SMMU, "ion_fd:%d not in the mapped list", ion_fd);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (buf_tracker)
+		rc = cam_smmu_add_buf_to_track_list(ion_fd, i_ino, ref_count, buf_tracker, idx);
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_get_stage2_iova);
+
+static int cam_smmu_unmap_validate_params(int handle)
+{
+	int idx;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* find index in the iommu_cb_set.cb_info */
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_smmu_unmap_user_iova(int handle,
+	int ion_fd, struct dma_buf *dma_buf, enum cam_smmu_region_id region_id,
+	bool force_unmap)
+{
+	int idx, rc;
+	struct cam_dma_buff_info *mapping_info;
+
+	rc = cam_smmu_unmap_validate_params(handle);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "unmap util validation failure");
+		return rc;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't unmap non-secure mem from secure cb");
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, handle)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	/* Based on ion_fd & index, we can find mapping info of buffer */
+	mapping_info = cam_smmu_find_mapping_by_ion_index(idx, ion_fd, dma_buf);
+
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params idx = %d, fd = %d",
+			idx, ion_fd);
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	mapping_info->map_count--;
+	if (mapping_info->map_count > 0) {
+		CAM_DBG(CAM_SMMU,
+			"idx: %d, cb: %s fd = %d , ino: 0x%x, map_count: %d, ref_count: %d",
+			idx, iommu_cb_set.cb_info[idx].name[0], ion_fd,
+			mapping_info->i_ino, mapping_info->map_count,
+			kref_read(&mapping_info->ref_count));
+		rc = 0;
+		goto unmap_end;
+	}
+	mapping_info->map_count = 0;
+	if (!force_unmap && kref_read(&mapping_info->ref_count) > 1) {
+		CAM_ERR(CAM_SMMU,
+			"[SMMU_BT] Error: can't unmap buffer as it's still active, idx: %d, cb: %s, fd: 0x%x, ino: 0x%x, ref_count: %d",
+			idx, iommu_cb_set.cb_info[idx].name[0], ion_fd, mapping_info->i_ino,
+			kref_read(&mapping_info->ref_count));
+		rc = -EPERM;
+		goto unmap_end;
+	}
+
+	/* Unmapping one buffer from device */
+	CAM_DBG(CAM_SMMU, "SMMU: removing buffer idx = %d", idx);
+	rc = cam_smmu_unmap_buf_and_remove_from_list(mapping_info, idx);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "Error: unmap or remove list fail");
+
+unmap_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_unmap_user_iova);
+
+int cam_smmu_unmap_kernel_iova(int handle,
+	struct dma_buf *buf, enum cam_smmu_region_id region_id)
+{
+	int idx, rc;
+	struct cam_dma_buff_info *mapping_info;
+
+	rc = cam_smmu_unmap_validate_params(handle);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "unmap util validation failure");
+		return rc;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't unmap non-secure mem from secure cb");
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	/* Based on dma_buf & index, we can find mapping info of buffer */
+	mapping_info = cam_smmu_find_mapping_by_dma_buf(idx, buf);
+
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params idx = %d, dma_buf = %pK",
+			idx, buf);
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	/* Unmapping one buffer from device */
+	CAM_DBG(CAM_SMMU, "SMMU: removing buffer idx = %d", idx);
+	rc = cam_smmu_unmap_buf_and_remove_from_list(mapping_info, idx);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "Error: unmap or remove list fail");
+
+unmap_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_unmap_kernel_iova);
+
+
+int cam_smmu_put_iova(int handle, int ion_fd, struct dma_buf *dma_buf)
+{
+	int idx;
+	int rc = 0;
+	struct cam_dma_buff_info *mapping_info;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* find index in the iommu_cb_set.cb_info */
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto put_addr_end;
+	}
+
+	/* based on ion fd and index, we can find mapping info of buffer */
+	mapping_info = cam_smmu_find_mapping_by_ion_index(idx, ion_fd, dma_buf);
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid params idx = %d, fd = %d",
+			idx, ion_fd);
+		rc = -EINVAL;
+		goto put_addr_end;
+	}
+
+put_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_put_iova);
+
+int cam_smmu_destroy_handle(int handle)
+{
+	int idx;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (CAM_SMMU_HDL_VALIDATE(iommu_cb_set.cb_info[idx].handle, handle)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return -EINVAL;
+	}
+
+	if (!list_empty_careful(&iommu_cb_set.cb_info[idx].smmu_buf_list)) {
+		CAM_ERR(CAM_SMMU, "UMD %s buffer list is not clean",
+			iommu_cb_set.cb_info[idx].name[0]);
+		cam_smmu_print_user_list(idx);
+		cam_smmu_clean_user_buffer_list(idx);
+	}
+
+	if (!list_empty_careful(
+		&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list)) {
+		CAM_ERR(CAM_SMMU, "KMD %s buffer list is not clean",
+			iommu_cb_set.cb_info[idx].name[0]);
+		cam_smmu_print_kernel_list(idx);
+		cam_smmu_clean_kernel_buffer_list(idx);
+	}
+
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		if (iommu_cb_set.cb_info[idx].secure_count == 0) {
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -EPERM;
+		}
+
+		iommu_cb_set.cb_info[idx].secure_count--;
+		if (iommu_cb_set.cb_info[idx].secure_count == 0) {
+			iommu_cb_set.cb_info[idx].cb_count = 0;
+			iommu_cb_set.cb_info[idx].handle = HANDLE_INIT;
+		}
+
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return 0;
+	}
+
+	if (iommu_cb_set.cb_info[idx].is_mul_client &&
+		iommu_cb_set.cb_info[idx].device_count) {
+		iommu_cb_set.cb_info[idx].device_count--;
+
+		if (!iommu_cb_set.cb_info[idx].device_count) {
+			iommu_cb_set.cb_info[idx].cb_count = 0;
+			iommu_cb_set.cb_info[idx].handle = HANDLE_INIT;
+		}
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return 0;
+	}
+
+	iommu_cb_set.cb_info[idx].device_count = 0;
+	iommu_cb_set.cb_info[idx].cb_count = 0;
+	iommu_cb_set.cb_info[idx].handle = HANDLE_INIT;
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return 0;
+}
+EXPORT_SYMBOL(cam_smmu_destroy_handle);
+
+static void cam_smmu_deinit_cb(struct cam_context_bank_info *cb)
+{
+	int i;
+
+	if (cb->io_support && cb->domain)
+		cb->domain = NULL;
+
+	if (cb->shared_support) {
+		for (i = 0; i < cb->shared_info.num_regions; i++) {
+			if (cb->shared_mem_pool[i]) {
+				gen_pool_destroy(cb->shared_mem_pool[i]);
+				cb->shared_mem_pool[i] = NULL;
+			}
+		}
+	}
+
+	if (cb->scratch_buf_support) {
+		kfree(cb->scratch_map.bitmap);
+		cb->scratch_map.bitmap = NULL;
+	}
+}
+
+static void cam_smmu_release_cb(struct platform_device *pdev)
+{
+	int i = 0;
+
+	for (i = 0; i < iommu_cb_set.cb_num; i++)
+		cam_smmu_deinit_cb(&iommu_cb_set.cb_info[i]);
+
+	devm_kfree(&pdev->dev, iommu_cb_set.cb_info);
+	iommu_cb_set.cb_num = 0;
+}
+
+static int cam_smmu_setup_cb(struct cam_context_bank_info *cb,
+	struct device *dev)
+{
+	int rc = 0, i;
+
+	if (!cb || !dev) {
+		CAM_ERR(CAM_SMMU, "Error: invalid input params");
+		return -EINVAL;
+	}
+
+	cb->dev = dev;
+	cb->is_fw_allocated = false;
+	cb->is_secheap_allocated = false;
+
+	atomic64_set(&cb->monitor_head, -1);
+
+	/* Create a pool with 64K granularity for supporting shared memory */
+	if (cb->shared_support) {
+		for (i = 0; i < cb->shared_info.num_regions; i++) {
+			cb->shared_mem_pool[i] = gen_pool_create(
+				SHARED_MEM_POOL_GRANULARITY, -1);
+
+			if (!cb->shared_mem_pool[i])
+				goto end;
+
+			rc = gen_pool_add(cb->shared_mem_pool[i],
+					cb->shared_info.nested_regions[i].region_info.iova_start,
+					cb->shared_info.nested_regions[i].region_info.iova_len,
+					-1);
+			if (rc) {
+				CAM_ERR(CAM_SMMU, "Genpool chunk creation failed");
+				gen_pool_destroy(cb->shared_mem_pool[i]);
+				cb->shared_mem_pool[i] = NULL;
+				goto end;
+			}
+
+			CAM_DBG(CAM_SMMU, "cb: %s Shared mem start->%lX len->%zu",
+				cb->name[0], (unsigned long)
+				cb->shared_info.nested_regions[i].region_info.iova_start,
+				cb->shared_info.nested_regions[i].region_info.iova_len);
+		}
+	}
+
+	if (cb->scratch_buf_support) {
+		rc = cam_smmu_init_scratch_map(&cb->scratch_map,
+			cb->scratch_info.iova_start,
+			cb->scratch_info.iova_len,
+			0);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU,
+				"Error: failed to create scratch map");
+			rc = -ENODEV;
+			goto end;
+		}
+	}
+
+	/* create a virtual mapping */
+	if (cb->io_support) {
+		cb->domain = iommu_get_domain_for_dev(dev);
+		if (IS_ERR_OR_NULL(cb->domain)) {
+			CAM_ERR(CAM_SMMU, "Error: create domain Failed");
+			rc = -ENODEV;
+			goto end;
+		}
+
+		/* Enable custom iommu features, if applicable */
+		cam_smmu_util_iommu_custom(dev, cb->discard_iova_start,
+			cb->discard_iova_len);
+
+		cb->state = CAM_SMMU_ATTACH;
+	} else {
+		CAM_ERR(CAM_SMMU, "Context bank does not have IO region");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	return rc;
+
+end:
+	if (cb->shared_support) {
+		for (--i; i >= 0; i--) {
+			if (cb->shared_mem_pool[i]) {
+				gen_pool_destroy(cb->shared_mem_pool[i]);
+				cb->shared_mem_pool[i] = NULL;
+			}
+		}
+	}
+
+	if (cb->scratch_buf_support) {
+		kfree(cb->scratch_map.bitmap);
+		cb->scratch_map.bitmap = NULL;
+	}
+
+	return rc;
+}
+
+static int cam_alloc_smmu_context_banks(struct device *dev)
+{
+	struct device_node *domains_child_node = NULL;
+
+	if (!dev) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid device");
+		return -ENODEV;
+	}
+
+	iommu_cb_set.cb_num = 0;
+
+	/* traverse thru all the child nodes and increment the cb count */
+	for_each_available_child_of_node(dev->of_node, domains_child_node) {
+		if (of_device_is_compatible(domains_child_node,
+			"qcom,msm-cam-smmu-cb"))
+			iommu_cb_set.cb_num++;
+
+		if (of_device_is_compatible(domains_child_node,
+			"qcom,qsmmu-cam-cb"))
+			iommu_cb_set.cb_num++;
+	}
+
+	if (iommu_cb_set.cb_num == 0) {
+		CAM_ERR(CAM_SMMU, "Error: no context banks present");
+		return -ENOENT;
+	}
+
+	/* allocate memory for the context banks */
+	iommu_cb_set.cb_info = devm_kzalloc(dev,
+		iommu_cb_set.cb_num * sizeof(struct cam_context_bank_info),
+		GFP_KERNEL);
+
+	if (!iommu_cb_set.cb_info) {
+		CAM_ERR(CAM_SMMU, "Error: cannot allocate context banks");
+		return -ENOMEM;
+	}
+
+	cam_smmu_reset_iommu_table(CAM_SMMU_TABLE_INIT);
+	iommu_cb_set.cb_init_count = 0;
+
+	CAM_DBG(CAM_SMMU, "no of context banks :%d", iommu_cb_set.cb_num);
+	return 0;
+}
+
+static int cam_smmu_get_discard_memory_regions(struct device_node *of_node,
+	dma_addr_t *discard_iova_start, size_t *discard_iova_len)
+{
+	uint32_t discard_iova[2] = { 0 };
+	int num_values = 0;
+	int rc = 0;
+
+	if (!discard_iova_start || !discard_iova_len)
+		return -EINVAL;
+
+	*discard_iova_start = 0;
+	*discard_iova_len = 0;
+
+	num_values = of_property_count_u32_elems(of_node,
+		"iova-region-discard");
+	if (num_values <= 0) {
+		CAM_DBG(CAM_UTIL, "No discard region specified");
+		return 0;
+	} else if (num_values != 2) {
+		CAM_ERR(CAM_UTIL, "Invalid discard region specified %d",
+			num_values);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32_array(of_node,
+		"iova-region-discard",
+		discard_iova, num_values);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Can not read discard region %d", num_values);
+		return rc;
+	} else if (!discard_iova[0] || !discard_iova[1]) {
+		CAM_ERR(CAM_UTIL,
+			"Incorrect Discard region specified [0x%x 0x%x]",
+			discard_iova[0], discard_iova[1]);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_UTIL, "Discard region [0x%x 0x%x]",
+		discard_iova[0], discard_iova[0] + discard_iova[1]);
+
+	*discard_iova_start = discard_iova[0];
+	*discard_iova_len = discard_iova[1];
+
+	return 0;
+}
+
+static int cam_smmu_get_iova_info_util(
+	struct device_node **child_node, dma_addr_t *region_start,
+	size_t *region_len, uint32_t *region_id)
+{
+	int rc;
+	uint32_t id;
+	dma_addr_t start = 0;
+	size_t len = 0;
+
+	if (iommu_cb_set.is_expanded_memory) {
+		rc = of_property_read_u64(*child_node, "iova-region-start", &start);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU, "Failed to read iova-region-start");
+			return -EINVAL;
+		}
+
+		rc = of_property_read_u64(*child_node, "iova-region-len",
+			(uint64_t *)&len);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU, "Failed to read iova-region-len");
+			return -EINVAL;
+		}
+	} else {
+		rc = of_property_read_u32(*child_node, "iova-region-start",
+			(uint32_t *)&start);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU, "Failed to read iova-region-start");
+			return -EINVAL;
+		}
+
+		rc = of_property_read_u32(*child_node, "iova-region-len",
+			(uint32_t *)&len);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU, "Failed to read iova-region-len");
+			return -EINVAL;
+		}
+	}
+
+	rc = of_property_read_u32(*child_node, "iova-region-id", &id);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Failed to read iova-region-id");
+		return -EINVAL;
+	}
+
+	*region_start = start;
+	*region_len = len;
+	*region_id = id;
+
+	return 0;
+}
+
+static int cam_smmu_get_subregions_memory_info(
+	struct device_node **of_node,
+	struct cam_smmu_nested_region_info *nested_regions,
+	struct cam_context_bank_info *cb)
+{
+	int rc;
+	uint32_t subregion_count = 0, subregion_mask = 0;
+	enum cam_smmu_subregion_id subregion_id;
+	struct device_node *sub_node = NULL;
+	const char *subregion_name;
+	dma_addr_t subregion_start = 0;
+	size_t subregion_len = 0;
+	struct cam_smmu_subregion_info *subregions = NULL;
+	struct device_node *child_node = *of_node;
+
+	/* Count number of child nodes */
+	for_each_available_child_of_node(child_node, sub_node)
+		subregion_count++;
+
+	if (subregion_count > CAM_SMMU_SUBREGION_MAX) {
+		CAM_ERR(CAM_SMMU,
+			"Invalid number of subregions max=%u count=%u cb=%s",
+			CAM_SMMU_SUBREGION_MAX, subregion_count, cb->name[0]);
+		return -EINVAL;
+	}
+
+	for_each_available_child_of_node(child_node, sub_node) {
+		subregions =
+			&nested_regions->subregions[nested_regions->num_subregions];
+
+		rc = of_property_read_string(sub_node,
+			"iova-region-name", &subregion_name);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU, "IOVA subregion not found");
+			goto err;
+		}
+
+		rc = cam_smmu_get_iova_info_util(&sub_node, &subregion_start,
+			&subregion_len, &subregion_id);
+		if (rc)
+			goto err;
+
+		switch (subregion_id) {
+		case CAM_SMMU_SUBREGION_GENERIC:
+			if (subregion_mask & BIT(subregion_id))
+				goto repeated_subregion;
+
+			subregions->subregion_id = subregion_id;
+			subregions->subregion_info.iova_len = subregion_len;
+			subregions->subregion_info.iova_start = subregion_start;
+			break;
+		case CAM_SMMU_SUBREGION_SYNX_HWMUTEX:
+			if (subregion_mask & BIT(subregion_id))
+				goto repeated_subregion;
+
+			subregions->subregion_id = subregion_id;
+			subregions->subregion_info.iova_len = subregion_len;
+			subregions->subregion_info.iova_start = subregion_start;
+			rc = of_property_read_u32(sub_node,
+				"phy-addr", (uint32_t *)&subregions->subregion_info.phy_addr);
+			if (rc < 0) {
+				CAM_ERR(CAM_SMMU, "Failed to read phy addr");
+				goto err;
+			}
+			break;
+		case CAM_SMMU_SUBREGION_IPC_HWMUTEX:
+			if (subregion_mask & BIT(subregion_id))
+				goto repeated_subregion;
+
+			subregions->subregion_id = subregion_id;
+			subregions->subregion_info.iova_len = subregion_len;
+			subregions->subregion_info.iova_start = subregion_start;
+			rc = of_property_read_u32(sub_node,
+				"phy-addr", (uint32_t *)&subregions->subregion_info.phy_addr);
+			if (rc < 0) {
+				CAM_ERR(CAM_SMMU, "Failed to read phy addr");
+				goto err;
+			}
+			break;
+		case CAM_SMMU_SUBREGION_GLOBAL_SYNC_MEM:
+			if (subregion_mask & BIT(subregion_id))
+				goto repeated_subregion;
+
+			subregions->subregion_id = subregion_id;
+			subregions->subregion_info.iova_len = subregion_len;
+			subregions->subregion_info.iova_start = subregion_start;
+			rc = of_property_read_u32(sub_node,
+				"phy-addr", (uint32_t *)&subregions->subregion_info.phy_addr);
+			if (rc < 0) {
+				CAM_ERR(CAM_SMMU, "Failed to read phy addr");
+				goto err;
+			}
+			break;
+		case CAM_SMMU_SUBREGION_GLOBAL_CNTR:
+			if (subregion_mask & BIT(subregion_id))
+				goto repeated_subregion;
+
+			subregions->subregion_id = subregion_id;
+			subregions->subregion_info.iova_len = subregion_len;
+			subregions->subregion_info.iova_start = subregion_start;
+			rc = of_property_read_u32(sub_node,
+				"phy-addr", (uint32_t *)&subregions->subregion_info.phy_addr);
+			if (rc < 0) {
+				CAM_ERR(CAM_SMMU, "Failed to read phy addr");
+				goto err;
+			}
+			break;
+		default:
+			CAM_ERR(CAM_SMMU, "Unsupported subregion_id: %d", subregion_id);
+			rc = -EINVAL;
+			goto err;
+		}
+
+		subregion_mask |= BIT(subregion_id);
+		nested_regions->num_subregions++;
+		CAM_DBG(CAM_SMMU,
+			"cb=%s region=%d iova=0x%x len=0x%x phy=0x%pK num_subregions=%u",
+			cb->name[0], subregion_id, subregions->subregion_info.iova_start,
+			subregions->subregion_info.iova_len,
+			subregions->subregion_info.phy_addr, nested_regions->num_subregions);
+	}
+
+	return 0;
+
+repeated_subregion:
+	CAM_ERR(CAM_SMMU,
+		"Subregion=%u was already populated in cb=%s subregion_mask=0x%x",
+		subregion_id, cb->name[0], subregion_mask);
+	rc = -EINVAL;
+err:
+	of_node_put(child_node);
+	return rc;
+}
+
+static int cam_smmu_validate_discard_iova_region(
+	struct cam_context_bank_info *cb,
+	struct cam_smmu_region_info *region_info)
+{
+	/* Make sure Discard region is properly specified */
+	if ((cb->discard_iova_start !=
+		region_info->discard_iova_start) ||
+		(cb->discard_iova_len !=
+		region_info->discard_iova_len)) {
+		CAM_ERR(CAM_SMMU,
+			"Mismatch Discard region specified, [0x%x 0x%x] [0x%x 0x%x]",
+			cb->discard_iova_start,
+			cb->discard_iova_len,
+			region_info->discard_iova_start,
+			region_info->discard_iova_len);
+		return -EINVAL;
+	} else if (cb->discard_iova_start && cb->discard_iova_len) {
+		if ((cb->discard_iova_start <=
+		region_info->iova_start) ||
+		(cb->discard_iova_start >=
+		region_info->iova_start + region_info->iova_len) ||
+		(cb->discard_iova_start + cb->discard_iova_len >=
+		region_info->iova_start + region_info->iova_len)) {
+			CAM_ERR(CAM_SMMU,
+			"[%s] : Incorrect Discard region specified [0x%x 0x%x] in [0x%x 0x%x]",
+			cb->name[0],
+			cb->discard_iova_start,
+			cb->discard_iova_start + cb->discard_iova_len,
+			region_info->iova_start,
+			region_info->iova_start + region_info->iova_len);
+			return -EINVAL;
+		}
+
+		CAM_INFO(CAM_SMMU,
+			"[%s] : Discard region specified [0x%x 0x%x] in [0x%x 0x%x]",
+			cb->name[0],
+			cb->discard_iova_start,
+			cb->discard_iova_start + cb->discard_iova_len,
+			region_info->iova_start,
+			region_info->iova_start + region_info->iova_len);
+	}
+
+	return 0;
+}
+
+static int cam_smmu_get_memory_regions_info(struct device_node *of_node,
+	struct cam_context_bank_info *cb)
+{
+	int rc = 0, i;
+	struct device_node *mem_map_node = NULL;
+	struct device_node *child_node = NULL;
+	dma_addr_t region_start = 0;
+	size_t region_len = 0;
+	uint32_t region_id;
+	const char *region_name;
+	int num_regions = 0;
+
+	if (!of_node || !cb) {
+		CAM_ERR(CAM_SMMU, "Invalid argument(s)");
+		return -EINVAL;
+	}
+
+	mem_map_node = of_get_child_by_name(of_node, "iova-mem-map");
+	cb->is_secure = of_property_read_bool(of_node, "qcom,secure-cb");
+
+	/*
+	 * We always expect a memory map node, except when it is a secure
+	 * context bank.
+	 */
+	if (!mem_map_node) {
+		if (cb->is_secure)
+			return 0;
+		CAM_ERR(CAM_SMMU, "iova-mem-map not present");
+		return -EINVAL;
+	}
+
+	for_each_available_child_of_node(mem_map_node, child_node) {
+		num_regions++;
+
+		rc = of_property_read_string(child_node,
+			"iova-region-name", &region_name);
+		if (rc < 0) {
+			of_node_put(mem_map_node);
+			CAM_ERR(CAM_SMMU, "IOVA region not found");
+			return -EINVAL;
+		}
+
+		rc = cam_smmu_get_iova_info_util(&child_node,
+			&region_start, &region_len, &region_id);
+		if (rc) {
+			of_node_put(mem_map_node);
+			return rc;
+		}
+
+		switch (region_id) {
+		case CAM_SMMU_REGION_FIRMWARE:
+			cb->firmware_support = 1;
+			cb->firmware_info.iova_start = region_start;
+			cb->firmware_info.iova_len = region_len;
+			break;
+		case CAM_SMMU_REGION_SHARED: {
+			int32_t num_shared_regions = cb->shared_info.num_regions;
+			struct cam_smmu_nested_region_info *nested_reg_info;
+
+			if (num_shared_regions >= CAM_SMMU_MULTI_REGION_MAX) {
+				CAM_ERR(CAM_SMMU,
+					"Exceeding max supported number of regions max: %u current: %u in cb: %s for region: %d",
+					CAM_SMMU_MULTI_REGION_MAX, num_shared_regions,
+					cb->name[0], region_id);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			nested_reg_info = &cb->shared_info.nested_regions[num_shared_regions];
+			nested_reg_info->subregion_support =
+				of_property_read_bool(child_node, "subregion_support");
+
+			if (nested_reg_info->subregion_support) {
+				rc = cam_smmu_get_subregions_memory_info(&child_node,
+					nested_reg_info, cb);
+				if (rc)
+					goto end;
+			}
+
+			nested_reg_info->region_info.iova_start = region_start;
+			nested_reg_info->region_info.iova_len = region_len;
+
+			cb->shared_info.num_regions++;
+			cb->shared_support = 1;
+		}
+			break;
+		case CAM_SMMU_REGION_SCRATCH:
+			cb->scratch_buf_support = 1;
+			cb->scratch_info.iova_start = region_start;
+			cb->scratch_info.iova_len = region_len;
+			break;
+		case CAM_SMMU_REGION_IO: {
+			int32_t num_io_regions = cb->io_info.num_regions;
+			struct cam_smmu_nested_region_info *nested_reg_info;
+
+			if (num_io_regions >= CAM_SMMU_MULTI_REGION_MAX) {
+				CAM_ERR(CAM_SMMU,
+					"Exceeding max supported number of regions max: %u current: %u in cb: %s for region: %d",
+					CAM_SMMU_MULTI_REGION_MAX, num_io_regions,
+					cb->name[0], region_id);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			nested_reg_info = &cb->io_info.nested_regions[num_io_regions];
+			nested_reg_info->subregion_support =
+				of_property_read_bool(child_node, "subregion_support");
+
+			if (nested_reg_info->subregion_support) {
+				rc = cam_smmu_get_subregions_memory_info(&child_node,
+					nested_reg_info, cb);
+				if (rc)
+					goto end;
+			}
+
+			nested_reg_info->region_info.iova_start = region_start;
+			nested_reg_info->region_info.iova_len = region_len;
+			rc = cam_smmu_get_discard_memory_regions(child_node,
+				&nested_reg_info->region_info.discard_iova_start,
+				&nested_reg_info->region_info.discard_iova_len);
+			if (rc) {
+				CAM_ERR(CAM_SMMU,
+					"Invalid Discard region specified in IO region, rc: %d cb: %s",
+					rc, cb->name[0]);
+				goto end;
+			}
+			cb->io_info.num_regions++;
+			cb->io_support = 1;
+		}
+			break;
+		case CAM_SMMU_REGION_SECHEAP:
+			cb->secheap_support = 1;
+			cb->secheap_info.iova_start = region_start;
+			cb->secheap_info.iova_len = region_len;
+			break;
+		case CAM_SMMU_REGION_FWUNCACHED:{
+			int32_t num_fwuncached_regions = cb->fwuncached_region.num_regions;
+			struct cam_smmu_nested_region_info *nested_reg_info;
+
+			if (num_fwuncached_regions >= CAM_SMMU_MULTI_REGION_MAX) {
+				CAM_ERR(CAM_SMMU,
+					"Exceeding max supported number of regions max: %u current: %u in cb: %s for region: %d",
+					CAM_SMMU_MULTI_REGION_MAX, num_fwuncached_regions,
+					cb->name[0], region_id);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			nested_reg_info =
+				&cb->fwuncached_region.nested_regions[num_fwuncached_regions];
+			nested_reg_info->subregion_support =
+				of_property_read_bool(child_node, "subregion_support");
+
+			if (nested_reg_info->subregion_support) {
+				rc = cam_smmu_get_subregions_memory_info(&child_node,
+					nested_reg_info, cb);
+				if (rc)
+					goto end;
+			}
+
+			nested_reg_info->region_info.iova_start = region_start;
+			nested_reg_info->region_info.iova_len = region_len;
+
+			cb->fwuncached_region.num_regions++;
+			cb->fwuncached_region_support = 1;
+		}
+			break;
+		case CAM_SMMU_REGION_QDSS: {
+			int32_t num_qdss_regions = cb->qdss_info.num_regions;
+			struct cam_smmu_nested_region_info *nested_reg_info;
+
+			if (num_qdss_regions >= CAM_SMMU_MULTI_REGION_MAX) {
+				CAM_ERR(CAM_SMMU,
+					"Exceeding max supported number of regions max: %u current: %u in cb: %s for region: %d",
+					CAM_SMMU_MULTI_REGION_MAX, num_qdss_regions,
+					cb->name[0], region_id);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			nested_reg_info =
+				&cb->qdss_info.nested_regions[num_qdss_regions];
+			nested_reg_info->subregion_support =
+				of_property_read_bool(child_node, "subregion_support");
+
+			if (nested_reg_info->subregion_support) {
+				CAM_ERR(CAM_SMMU,
+					"Subregion for QDSS not supported, failing cb: %s initialization",
+					cb->name[0]);
+				goto end;
+			}
+
+			nested_reg_info->region_info.iova_start = region_start;
+			nested_reg_info->region_info.iova_len = region_len;
+			/* phy-addr field is mandatory for QDSS */
+			rc = of_property_read_u32(child_node, "qdss-phy-addr",
+				(uint32_t *)&nested_reg_info->region_info.phy_addr);
+			if (rc) {
+				CAM_ERR(CAM_SMMU, "No phy-addr field for qdss in cb: %s",
+					cb->name[0]);
+				goto end;
+			}
+
+			cb->qdss_info.num_regions++;
+			cb->qdss_support = 1;
+		}
+			break;
+		case CAM_SMMU_REGION_DEVICE:{
+			int32_t num_device_regions = cb->device_region.num_regions;
+			struct cam_smmu_nested_region_info *nested_reg_info;
+
+			if (num_device_regions >= CAM_SMMU_MULTI_REGION_MAX) {
+				CAM_ERR(CAM_SMMU,
+					"Exceeding max supported number of regions max: %u current: %u in cb: %s for region: %d",
+					CAM_SMMU_MULTI_REGION_MAX, num_device_regions,
+					cb->name[0], region_id);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			nested_reg_info = &cb->device_region.nested_regions[num_device_regions];
+			nested_reg_info->subregion_support =
+				of_property_read_bool(child_node, "subregion_support");
+
+			if (nested_reg_info->subregion_support) {
+				rc = cam_smmu_get_subregions_memory_info(&child_node,
+					nested_reg_info, cb);
+				if (rc)
+					goto end;
+			}
+
+			nested_reg_info->region_info.iova_start = region_start;
+			nested_reg_info->region_info.iova_len = region_len;
+
+			rc = of_property_read_u32(child_node,
+				"phy-addr", (uint32_t *)&nested_reg_info->region_info.phy_addr);
+			if (rc) {
+				CAM_DBG(CAM_SMMU, "No phy-addr field in device in cb: %s",
+					cb->name[0]);
+				rc = 0;
+			}
+
+			cb->device_region.num_regions++;
+			cb->device_region_support = 1;
+		}
+			break;
+		default:
+			CAM_ERR(CAM_SMMU,
+				"Incorrect region id present in DT file: %d",
+				region_id);
+		}
+
+		CAM_DBG(CAM_SMMU, "Found label -> %s", cb->name[0]);
+		CAM_DBG(CAM_SMMU, "Found region -> %s", region_name);
+		CAM_DBG(CAM_SMMU, "region_start -> 0x%lx", region_start);
+		CAM_DBG(CAM_SMMU, "region_len -> 0x%lx", region_len);
+		CAM_DBG(CAM_SMMU, "region_id -> 0x%x", region_id);
+	}
+
+	if (cb->io_support) {
+		rc = cam_smmu_get_discard_memory_regions(of_node,
+			&cb->discard_iova_start,
+			&cb->discard_iova_len);
+		if (rc) {
+			CAM_ERR(CAM_SMMU,
+				"Invalid Discard region specified in CB, rc=%d",
+				rc);
+			return -EINVAL;
+		}
+
+		for (i = 0; i < cb->io_info.num_regions; i++) {
+			rc = cam_smmu_validate_discard_iova_region(cb,
+				&cb->io_info.nested_regions[i].region_info);
+			if (rc)
+				goto end;
+		}
+	}
+
+	if (!num_regions) {
+		CAM_ERR(CAM_SMMU,
+			"No memory regions found, at least one needed");
+		rc = -ENODEV;
+	}
+
+	return rc;
+
+end:
+	of_node_put(mem_map_node);
+	return rc;
+}
+
+static void cam_smmu_check_for_fault_properties(
+	const char *fault_property, struct cam_context_bank_info *cb)
+{
+	if (!strcmp(fault_property, "non-fatal"))
+		cb->non_fatal_faults_en = true;
+	else if (!strcmp(fault_property, "stall-disable"))
+		cb->stall_disable_en = true;
+
+	CAM_DBG(CAM_SMMU, "iommu fault property: %s found for cb: %s",
+		fault_property, cb->name[0]);
+}
+
+static int cam_populate_smmu_context_banks(struct device *dev,
+	enum cam_iommu_type type)
+{
+	int rc = 0, i, j, num_fault_props = 0;
+	struct cam_context_bank_info *cb;
+	struct device *ctx = NULL;
+	bool dma_coherent, dma_coherent_hint, is_found;
+
+	if (!dev) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid device");
+		return -ENODEV;
+	}
+
+	/* check the bounds */
+	if (iommu_cb_set.cb_init_count >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU, "Error: populate more than allocated cb");
+		rc = -EBADHANDLE;
+		goto cb_init_fail;
+	}
+
+	/* read the context bank from cb set */
+	cb = &iommu_cb_set.cb_info[iommu_cb_set.cb_init_count];
+
+	cb->is_mul_client =
+		of_property_read_bool(dev->of_node, "multiple-client-devices");
+	cb->num_shared_hdl = of_property_count_strings(dev->of_node,
+		"cam-smmu-label");
+
+	if (cb->num_shared_hdl >
+		CAM_SMMU_SHARED_HDL_MAX) {
+		CAM_ERR(CAM_CDM, "Invalid count of client names count=%d",
+			cb->num_shared_hdl);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	/* set the name of the context bank */
+	for (i = 0; i < cb->num_shared_hdl; i++) {
+		rc = of_property_read_string_index(dev->of_node,
+			"cam-smmu-label", i, &cb->name[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU,
+				"Error: failed to read label from sub device");
+			goto cb_init_fail;
+		}
+	}
+
+	cb->num_multi_regions = of_property_count_strings(dev->of_node,
+		"multiple-same-region-clients");
+	if (cb->num_multi_regions > CAM_SMMU_MULTI_REGION_MAX) {
+		CAM_ERR(CAM_CDM, "Invalid count of multi region clients = %d",
+			cb->num_multi_regions);
+		rc = -EINVAL;
+		goto cb_init_fail;
+	}
+
+	for (j = 0; j < cb->num_multi_regions; j++) {
+		is_found = false;
+
+		rc = of_property_read_string_index(dev->of_node,
+			"multiple-same-region-clients", j, &cb->multi_region_clients[j]);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU,
+				"Error: failed to read label from sub device");
+			goto cb_init_fail;
+		}
+
+		/* Needs to match shared hdl client list */
+		for (i = 0; i < cb->num_shared_hdl; i++) {
+			if (strcmp(cb->name[i], cb->multi_region_clients[j])) {
+				is_found = true;
+				break;
+			}
+		}
+
+		if (!is_found) {
+			CAM_ERR(CAM_SMMU,
+				"%s multi region client not found in shared client list cb = %s",
+				cb->multi_region_clients[j], cb->name[0]);
+			rc = -EINVAL;
+			goto cb_init_fail;
+		}
+	}
+
+	rc = cam_smmu_get_memory_regions_info(dev->of_node, cb);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: Getting region info");
+		return rc;
+	}
+
+	if (cb->is_secure) {
+		/* increment count to next bank */
+		cb->dev = dev;
+		iommu_cb_set.cb_init_count++;
+		return 0;
+	}
+
+	/* set up the iommu mapping for the  context bank */
+	if (type == CAM_QSMMU) {
+		CAM_ERR(CAM_SMMU, "Error: QSMMU ctx not supported for : %s",
+			cb->name[0]);
+		return -ENODEV;
+	}
+
+	ctx = dev;
+	CAM_DBG(CAM_SMMU, "getting Arm SMMU ctx : %s", cb->name[0]);
+
+	cb->coherency_mode = CAM_SMMU_NO_COHERENCY;
+
+	dma_coherent = of_property_read_bool(dev->of_node, "dma-coherent");
+	dma_coherent_hint = of_property_read_bool(dev->of_node,
+		"dma-coherent-hint-cached");
+
+	if (dma_coherent && dma_coherent_hint) {
+		CAM_ERR(CAM_SMMU,
+			"[%s] : Cannot enable both dma-coherent and dma-coherent-hint-cached",
+			cb->name[0]);
+		return -EBADR;
+	}
+
+	if (dma_coherent)
+		cb->coherency_mode = CAM_SMMU_DMA_COHERENT;
+	else if (dma_coherent_hint)
+		cb->coherency_mode = CAM_SMMU_DMA_COHERENT_HINT_CACHED;
+
+	CAM_DBG(CAM_SMMU, "[%s] : io cohereny mode %d", cb->name[0],
+		cb->coherency_mode);
+
+	rc = cam_smmu_setup_cb(cb, ctx);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: failed to setup cb : %s",
+			cb->name[0]);
+		goto cb_init_fail;
+	}
+	if (cb->io_support && cb->domain) {
+		iommu_set_fault_handler(cb->domain,
+			cam_smmu_iommu_fault_handler,
+			(void *)cb->name[0]);
+
+		num_fault_props = of_property_count_strings(dev->of_node, "qcom,iommu-faults");
+		if (num_fault_props > 0) {
+			const char *fault_property = NULL;
+
+			for (i = 0; i < num_fault_props; i++) {
+				rc = of_property_read_string_index(dev->of_node,
+					"qcom,iommu-faults", i, &fault_property);
+				if (!rc)
+					cam_smmu_check_for_fault_properties(fault_property, cb);
+			}
+			/* Missing fault property reads is not an error */
+			rc = 0;
+		}
+	}
+
+	if (!dev->dma_parms)
+		dev->dma_parms = devm_kzalloc(dev,
+			sizeof(*dev->dma_parms), GFP_KERNEL);
+
+	if (!dev->dma_parms) {
+		CAM_WARN(CAM_SMMU,
+			"Failed to allocate dma_params");
+		dev->dma_parms = NULL;
+		goto end;
+	}
+
+	dma_set_max_seg_size(dev, DMA_BIT_MASK(32));
+	dma_set_seg_boundary(dev, (unsigned long)DMA_BIT_MASK(64));
+
+	if (iommu_cb_set.is_expanded_memory) {
+		CAM_DBG(CAM_SMMU, "[%s] setting max address mask", cb->name[0]);
+		/* the largest address is the min(dma_mask, value_from_iommu-dma_addr_pool) */
+		rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+		if (rc)
+			CAM_ERR(CAM_SMMU, "[%s] Failed in setting max address mask, rc %d",
+				cb->name[0], rc);
+	}
+
+end:
+	/* increment count to next bank */
+	iommu_cb_set.cb_init_count++;
+	CAM_DBG(CAM_SMMU, "X: cb init count :%d", iommu_cb_set.cb_init_count);
+
+cb_init_fail:
+	return rc;
+}
+
+static void cam_smmu_mini_dump_entries(
+	struct cam_smmu_mini_dump_cb_info *target,
+	struct cam_context_bank_info *src)
+{
+	int i = 0;
+	int64_t state_head = 0;
+	uint32_t index, num_entries, oldest_entry;
+
+	state_head = atomic64_read(&src->monitor_head);
+
+	if (state_head == -1) {
+		return;
+	} else if (state_head < CAM_SMMU_MONITOR_MAX_ENTRIES) {
+		num_entries = state_head;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_SMMU_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1,
+			CAM_SMMU_MONITOR_MAX_ENTRIES, &oldest_entry);
+	}
+
+	index = oldest_entry;
+
+	for (i = 0; i < num_entries; i++) {
+		memcpy(&target->mapping[index],
+			&src->monitor_entries[index],
+			sizeof(struct cam_smmu_monitor));
+		index = (index + 1) % CAM_SMMU_MONITOR_MAX_ENTRIES;
+	}
+}
+
+static unsigned long cam_smmu_mini_dump_cb(void *dst, unsigned long len,
+	void *priv_data)
+{
+	struct cam_smmu_mini_dump_cb_info *cb_md;
+	struct cam_smmu_mini_dump_info     *md;
+	struct cam_context_bank_info       *cb;
+	unsigned long                       dumped_len = 0;
+	unsigned long                       remain_len = len;
+	uint32_t                            i = 0, j = 0;
+
+	if (!dst || len < sizeof(*md)) {
+		CAM_ERR(CAM_SMMU, "Invalid params dst: %pk len:%lu",
+			dst, len);
+		return 0;
+	}
+
+	md = (struct cam_smmu_mini_dump_info *)dst;
+	md->cb_num = 0;
+	md->cb = (struct cam_smmu_mini_dump_cb_info *)
+		((uint8_t *)dst + sizeof(*md));
+	dumped_len += sizeof(*md);
+	remain_len =  len - dumped_len;
+
+	for (i = 0; i < iommu_cb_set.cb_num; i++) {
+		if (remain_len < sizeof(*cb_md))
+			goto end;
+
+		cb = &iommu_cb_set.cb_info[i];
+		cb_md = &md->cb[i];
+		cb_md->is_mul_client = cb->is_mul_client;
+		cb_md->is_secure = cb->is_secure;
+		cb_md->is_fw_allocated = cb->is_fw_allocated;
+		cb_md->is_secheap_allocated = cb->is_secheap_allocated;
+		cb_md->is_qdss_allocated = cb->is_qdss_allocated;
+		cb_md->scratch_buf_support = cb->scratch_buf_support;
+		cb_md->firmware_support = cb->firmware_support;
+		cb_md->shared_support = cb->shared_support;
+		cb_md->io_support = cb->io_support;
+		cb_md->fwuncached_region_support = cb->fwuncached_region_support;
+		cb_md->qdss_support = cb->qdss_support;
+		cb_md->coherency_mode = cb->coherency_mode;
+		cb_md->state = cb->state;
+		cb_md->va_start = cb->va_start;
+		cb_md->discard_iova_start = cb->discard_iova_start;
+		cb_md->qdss_phy_addr = cb->qdss_phy_addr;
+		cb_md->va_len = cb->va_len;
+		cb_md->io_mapping_size = cb->io_mapping_size;
+		cb_md->shared_mapping_size = cb->shared_mapping_size;
+		cb_md->discard_iova_len = cb->discard_iova_len;
+		cb_md->handle = cb->handle;
+		cb_md->device_count = cb->device_count;
+		cb_md->num_shared_hdl = cb->num_shared_hdl;
+		cb_md->secure_count = cb->secure_count;
+		cb_md->cb_count = cb->cb_count;
+		cb_md->pf_count = cb->pf_count;
+		memcpy(&cb_md->scratch_info, &cb->scratch_info,
+			sizeof(struct cam_smmu_region_info));
+		memcpy(&cb_md->firmware_info, &cb->firmware_info,
+			sizeof(struct cam_smmu_region_info));
+		memcpy(&cb_md->shared_info, &cb->shared_info,
+			sizeof(struct cam_smmu_region_info));
+		memcpy(&cb_md->io_info, &cb->io_info,
+			sizeof(struct cam_smmu_region_info));
+		memcpy(&cb_md->secheap_info, &cb->secheap_info,
+			sizeof(struct cam_smmu_region_info));
+		memcpy(&cb_md->fwuncached_region, &cb->fwuncached_region,
+			sizeof(struct cam_smmu_region_info));
+		memcpy(&cb_md->qdss_info, &cb->qdss_info,
+			sizeof(struct cam_smmu_region_info));
+		memcpy(&cb_md->device_mem_region, &cb->device_region,
+			sizeof(struct cam_smmu_region_info));
+
+		for (j = 0; j < iommu_cb_set.cb_info[i].num_shared_hdl; j++)
+			scnprintf(cb_md->name[j], 16, cb->name[j]);
+
+		cam_smmu_mini_dump_entries(cb_md, cb);
+		dumped_len += sizeof(*cb_md);
+		remain_len = len - dumped_len;
+		md->cb_num++;
+	}
+end:
+	return dumped_len;
+}
+
+static int cam_smmu_set_fatal_pf_mask(void *data, u64 val)
+{
+	iommu_cb_set.debug_cfg.fatal_pf_mask = val;
+	CAM_DBG(CAM_SMMU, "Set fatal page fault value: 0x%llx",
+		iommu_cb_set.debug_cfg.fatal_pf_mask);
+	return 0;
+}
+
+static int cam_smmu_get_fatal_pf_mask(void *data, u64 *val)
+{
+	*val = iommu_cb_set.debug_cfg.fatal_pf_mask;
+	CAM_DBG(CAM_SMMU, "Get fatal page fault value: 0x%llx",
+		*val);
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_smmu_fatal_pf_mask,
+	cam_smmu_get_fatal_pf_mask, cam_smmu_set_fatal_pf_mask, "%16llu");
+
+static int cam_smmu_create_debug_fs(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("smmu", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_SMMU,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	iommu_cb_set.debug_cfg.dentry = dbgfileptr;
+
+	debugfs_create_bool("cb_dump_enable", 0644,
+		iommu_cb_set.debug_cfg.dentry, &iommu_cb_set.debug_cfg.cb_dump_enable);
+	debugfs_create_bool("map_profile_enable", 0644,
+		iommu_cb_set.debug_cfg.dentry, &iommu_cb_set.debug_cfg.map_profile_enable);
+	debugfs_create_file("fatal_pf_mask", 0644,
+		iommu_cb_set.debug_cfg.dentry, NULL, &cam_smmu_fatal_pf_mask);
+	debugfs_create_bool("disable_buf_tracking", 0644,
+		iommu_cb_set.debug_cfg.dentry, &iommu_cb_set.debug_cfg.disable_buf_tracking);
+
+end:
+	return rc;
+}
+
+int cam_smmu_driver_init(struct cam_csf_version *csf_ver, int32_t *num_cbs)
+{
+	int i;
+	/* expect inputs to be valid */
+	if (!csf_ver || !num_cbs) {
+		CAM_ERR(CAM_SMMU, "Invalid params csf: %p num_cbs: %p",
+			csf_ver, num_cbs);
+		return -EINVAL;
+	}
+
+	*num_cbs = iommu_cb_set.cb_num;
+	memcpy(csf_ver, &iommu_cb_set.csf_version, sizeof(*csf_ver));
+
+	iommu_cb_set.is_track_buf_disabled = iommu_cb_set.debug_cfg.disable_buf_tracking;
+
+	if (!iommu_cb_set.is_track_buf_disabled) {
+		buf_tracking_pool = kcalloc(CAM_SMMU_BUF_TRACKING_POOL,
+			sizeof(struct cam_smmu_buffer_tracker), GFP_KERNEL);
+
+		if (!buf_tracking_pool) {
+			CAM_WARN(CAM_SMMU, "[SMMU_BT] Not enough mem for buffer tracker pool");
+			goto end;
+		}
+
+		INIT_LIST_HEAD(&iommu_cb_set.buf_tracker_free_list);
+		for (i = 0; i < CAM_SMMU_BUF_TRACKING_POOL; i++) {
+			INIT_LIST_HEAD(&buf_tracking_pool[i].list);
+			list_add_tail(&buf_tracking_pool[i].list,
+				&iommu_cb_set.buf_tracker_free_list);
+		}
+	}
+
+end:
+	return 0;
+}
+
+void cam_smmu_driver_deinit(void)
+{
+	INIT_LIST_HEAD(&iommu_cb_set.buf_tracker_free_list);
+	kfree(buf_tracking_pool);
+}
+
+static int cam_smmu_fw_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	icp_fw.fw_dev = &pdev->dev;
+	icp_fw.fw_kva = NULL;
+	icp_fw.fw_hdl = 0;
+
+	CAM_DBG(CAM_SMMU, "FW dev component bound successfully");
+	return 0;
+}
+
+static void cam_smmu_fw_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_SMMU, "Unbinding component: %s", pdev->name);
+}
+
+const static struct component_ops cam_smmu_fw_dev_component_ops = {
+	.bind = cam_smmu_fw_dev_component_bind,
+	.unbind = cam_smmu_fw_dev_component_unbind,
+};
+
+static int cam_smmu_cb_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	rc = cam_populate_smmu_context_banks(dev, CAM_ARM_SMMU);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: populating context banks");
+		cam_smmu_release_cb(pdev);
+		return -ENOMEM;
+	}
+
+	CAM_DBG(CAM_SMMU, "CB component bound successfully");
+	return 0;
+}
+
+static void cam_smmu_cb_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_SMMU, "Unbinding component: %s", pdev->name);
+}
+
+const static struct component_ops cam_smmu_cb_component_ops = {
+	.bind = cam_smmu_cb_component_bind,
+	.unbind = cam_smmu_cb_component_unbind,
+};
+
+static int cam_smmu_cb_qsmmu_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+
+	rc = cam_populate_smmu_context_banks(dev, CAM_QSMMU);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Failed in populating context banks");
+		return -ENOMEM;
+	}
+
+	CAM_DBG(CAM_SMMU, "QSMMU CB component bound successfully");
+	return 0;
+}
+
+static void cam_smmu_cb_qsmmu_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_SMMU, "Unbinding component: %s", pdev->name);
+}
+
+const static struct component_ops cam_smmu_cb_qsmmu_component_ops = {
+	.bind = cam_smmu_cb_qsmmu_component_bind,
+	.unbind = cam_smmu_cb_qsmmu_component_unbind,
+};
+
+static int cam_smmu_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+
+	INIT_WORK(&iommu_cb_set.smmu_work, cam_smmu_page_fault_work);
+	mutex_init(&iommu_cb_set.payload_list_lock);
+	spin_lock_init(&iommu_cb_set.s_lock);
+	INIT_LIST_HEAD(&iommu_cb_set.payload_list);
+	cam_smmu_create_debug_fs();
+
+	iommu_cb_set.force_cache_allocs =
+		of_property_read_bool(dev->of_node, "force_cache_allocs");
+	iommu_cb_set.need_shared_buffer_padding =
+		of_property_read_bool(dev->of_node, "need_shared_buffer_padding");
+	iommu_cb_set.is_expanded_memory =
+		of_property_read_bool(dev->of_node, "expanded_memory");
+
+	cam_common_register_mini_dump_cb(cam_smmu_mini_dump_cb,
+		"cam_smmu", NULL);
+
+	rc = cam_smmu_fetch_csf_version(&iommu_cb_set.csf_version);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "Failed to fetch CSF version: %d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_SMMU, "Main component bound successfully");
+	return 0;
+}
+
+static void cam_smmu_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	/* release all the context banks and memory allocated */
+	cam_smmu_reset_iommu_table(CAM_SMMU_TABLE_DEINIT);
+	if (dev && dev->dma_parms) {
+		devm_kfree(dev, dev->dma_parms);
+		dev->dma_parms = NULL;
+	}
+
+	cam_smmu_release_cb(pdev);
+	iommu_cb_set.debug_cfg.dentry = NULL;
+}
+
+const static struct component_ops cam_smmu_component_ops = {
+	.bind = cam_smmu_component_bind,
+	.unbind = cam_smmu_component_unbind,
+};
+
+static int cam_smmu_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+	struct device *dev = &pdev->dev;
+
+	dev->dma_parms = NULL;
+	CAM_DBG(CAM_SMMU, "Adding SMMU component: %s", pdev->name);
+	if (of_device_is_compatible(dev->of_node, "qcom,msm-cam-smmu")) {
+		rc = cam_alloc_smmu_context_banks(dev);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU, "Failed in allocating context banks");
+			return -ENOMEM;
+		}
+
+		rc = component_add(&pdev->dev, &cam_smmu_component_ops);
+	} else if (of_device_is_compatible(dev->of_node,
+		"qcom,msm-cam-smmu-cb")) {
+		rc = component_add(&pdev->dev, &cam_smmu_cb_component_ops);
+	} else if (of_device_is_compatible(dev->of_node, "qcom,qsmmu-cam-cb")) {
+		rc = component_add(&pdev->dev,
+			&cam_smmu_cb_qsmmu_component_ops);
+	} else if (of_device_is_compatible(dev->of_node,
+		"qcom,msm-cam-smmu-fw-dev")) {
+		rc = component_add(&pdev->dev, &cam_smmu_fw_dev_component_ops);
+	} else {
+		CAM_ERR(CAM_SMMU, "Unrecognized child device: %s", pdev->name);
+		rc = -ENODEV;
+	}
+
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_smmu_remove(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+
+	CAM_DBG(CAM_SMMU, "Removing SMMU component: %s", pdev->name);
+	if (of_device_is_compatible(dev->of_node, "qcom,msm-cam-smmu")) {
+		component_del(&pdev->dev, &cam_smmu_component_ops);
+	} else if (of_device_is_compatible(dev->of_node,
+		"qcom,msm-cam-smmu-cb")) {
+		component_del(&pdev->dev, &cam_smmu_cb_component_ops);
+	} else if (of_device_is_compatible(dev->of_node, "qcom,qsmmu-cam-cb")) {
+		component_del(&pdev->dev, &cam_smmu_cb_qsmmu_component_ops);
+	} else if (of_device_is_compatible(dev->of_node,
+		"qcom,msm-cam-smmu-fw-dev")) {
+		component_del(&pdev->dev, &cam_smmu_fw_dev_component_ops);
+	} else {
+		CAM_ERR(CAM_SMMU, "Unrecognized child device: %s", pdev->name);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+struct platform_driver cam_smmu_driver = {
+	.probe = cam_smmu_probe,
+	.remove = cam_smmu_remove,
+	.driver = {
+		.name = "msm_cam_smmu",
+		.owner = THIS_MODULE,
+		.of_match_table = msm_cam_smmu_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_smmu_init_module(void)
+{
+	return platform_driver_register(&cam_smmu_driver);
+}
+
+void cam_smmu_exit_module(void)
+{
+	platform_driver_unregister(&cam_smmu_driver);
+}
+
+MODULE_DESCRIPTION("MSM Camera SMMU driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_smmu/cam_smmu_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_smmu/cam_smmu_api.h
@@ -0,0 +1,590 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SMMU_API_H_
+#define _CAM_SMMU_API_H_
+
+#include <linux/dma-direction.h>
+#include <linux/module.h>
+#include <linux/dma-buf.h>
+#include <linux/dma-direction.h>
+#include <linux/of_platform.h>
+#include <linux/iommu.h>
+#include <linux/random.h>
+#include <linux/spinlock_types.h>
+#include <linux/mutex.h>
+
+#define BYTE_SIZE 8
+#define COOKIE_NUM_BYTE 2
+#define COOKIE_SIZE (BYTE_SIZE*COOKIE_NUM_BYTE)
+#define COOKIE_MASK ((1<<COOKIE_SIZE) - 1)
+#define MULTI_CLIENT_REGION_SHIFT 28
+#define CAM_SMMU_HDL_MASK ((BIT(MULTI_CLIENT_REGION_SHIFT)) - 1)
+#define GET_SMMU_TABLE_IDX(x) ((((x) & CAM_SMMU_HDL_MASK) >> COOKIE_SIZE) & COOKIE_MASK)
+
+#define CAM_SMMU_GET_IOVA_DELTA(val1, val2)                                \
+({                                                                         \
+	(val1) > (val2) ? (val1) - (val2) : (val2) - (val1);               \
+})
+
+/*Enum for possible CAM SMMU operations */
+enum cam_smmu_ops_param {
+	CAM_SMMU_ATTACH,
+	CAM_SMMU_DETACH,
+	CAM_SMMU_VOTE,
+	CAM_SMMU_DEVOTE,
+	CAM_SMMU_OPS_INVALID
+};
+
+enum cam_smmu_map_dir {
+	CAM_SMMU_MAP_READ,
+	CAM_SMMU_MAP_WRITE,
+	CAM_SMMU_MAP_RW,
+	CAM_SMMU_MAP_INVALID
+};
+
+enum cam_smmu_region_id {
+	CAM_SMMU_REGION_FIRMWARE,
+	CAM_SMMU_REGION_SHARED,
+	CAM_SMMU_REGION_SCRATCH,
+	CAM_SMMU_REGION_IO,
+	CAM_SMMU_REGION_SECHEAP,
+	CAM_SMMU_REGION_QDSS,
+	CAM_SMMU_REGION_FWUNCACHED,
+	CAM_SMMU_REGION_DEVICE,
+};
+
+enum cam_smmu_subregion_id {
+	CAM_SMMU_SUBREGION_GENERIC,
+	CAM_SMMU_SUBREGION_SYNX_HWMUTEX,
+	CAM_SMMU_SUBREGION_IPC_HWMUTEX,
+	CAM_SMMU_SUBREGION_GLOBAL_SYNC_MEM,
+	CAM_SMMU_SUBREGION_GLOBAL_CNTR,
+	CAM_SMMU_SUBREGION_MAX,
+};
+
+/**
+ * @brief          : Represents camera security framework version
+ *
+ * @param arch_ver          : Captures the version of the high level secure
+ *                            camera architecture.
+ * @param max_ver           : Captures the version of the solution with in the
+ *                            high level architecture.
+ * @param min_ver           : Captures the version of the memory assignment
+ *                            mechanism with in the solution.
+ */
+struct cam_csf_version {
+	uint32_t              arch_ver;
+	uint32_t              max_ver;
+	uint32_t              min_ver;
+};
+
+/**
+ * @brief : cam_smmu_buffer_tracker
+ *
+ * @param: list      : list to be inserted into list of tracked buggers
+ * @param: ref_count : Ptr to kref object of a physical buffer allocated per CB
+ * @param: ion_fd    : fd of buffer
+ * @param: i_ino     : inode of buffer
+ * @param: cb_name   : CB which this buffer belongs to
+ */
+struct cam_smmu_buffer_tracker {
+	struct list_head list;
+	struct kref *ref_count;
+	int ion_fd;
+	unsigned long i_ino;
+	const char *cb_name;
+};
+
+/**
+ * @brief          : cam_smmu_pf_info
+ *
+ * @param domain           : Iommu domain received in iommu page fault handler
+ * @param dev              : Device received in iommu page fault handler
+ * @param iova             : IOVA where page fault occurred
+ * @param flags            : Flags received in iommu page fault handler
+ * @param token            : Userdata given during callback registration
+ * @param buf_info         : Closest mapped buffer info
+ * @param bid              : bus id
+ * @param pid              : unique id for hw group of ports
+ * @param mid              : port id of hw
+ * @param is_secure        : Faulted memory in secure or non-secure region
+ * @param in_map_region    : Faulted memory fall in mapped region or not
+ */
+
+struct cam_smmu_pf_info {
+	struct iommu_domain  *domain;
+	struct device        *dev;
+	unsigned long         iova;
+	int                   flags;
+	void                 *token;
+	uint32_t              buf_info;
+	uint32_t              bid;
+	uint32_t              pid;
+	uint32_t              mid;
+	bool                  is_secure;
+	bool                  in_map_region;
+};
+
+/**
+ * @brief            : Structure to store dma buf information
+ *
+ * @param buf    : dma buffer
+ * @param attach : attachment info between dma buf and device
+ * @param table  : scattered list
+ */
+struct region_buf_info {
+	struct dma_buf *buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *table;
+};
+
+/**
+ * @brief            : Structure to store region information
+ *
+ * @param iova_start         : Start address of region
+ * @param iova_len           : length of region
+ * @param discard_iova_start : iova addr start from where should not be used
+ * @param discard_iova_len   : length of discard iova region
+ * @param phy_addr           : pa to which this va is mapped to
+ */
+struct cam_smmu_region_info {
+	dma_addr_t iova_start;
+	size_t iova_len;
+	dma_addr_t discard_iova_start;
+	size_t discard_iova_len;
+	dma_addr_t phy_addr;
+	struct region_buf_info buf_info;
+};
+
+/**
+ * @brief           : Gets an smmu handle
+ *
+ * @param identifier: Unique identifier to be used by clients which they
+ *                    should get from device tree. CAM SMMU driver will
+ *                    not enforce how this string is obtained and will
+ *                    only validate this against the list of permitted
+ *                    identifiers
+ * @param handle_ptr: Based on the indentifier, CAM SMMU drivier will
+ *                    fill the handle pointed by handle_ptr
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_handle(char *identifier, int *handle_ptr);
+
+/**
+ * @brief       : Performs IOMMU operations
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param op    : Operation to be performed. Can be either CAM_SMMU_ATTACH
+ *                or CAM_SMMU_DETACH
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_ops(int handle, enum cam_smmu_ops_param op);
+
+/**
+ * @brief       : Maps user space IOVA for calling driver
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param ion_fd: ION handle identifying the memory buffer.
+ * @param dmabuf: DMA buf handle identifying the memory buffer.
+ * @param dis_delayed_unmap: Whether to disable Delayed Unmap feature
+ *                           for this mapping
+ * @dir         : Mapping direction: which will traslate toDMA_BIDIRECTIONAL,
+ *                DMA_TO_DEVICE or DMA_FROM_DEVICE
+ * @dma_addr    : Pointer to physical address where mapped address will be
+ *                returned if region_id is CAM_SMMU_REGION_IO. If region_id is
+ *                CAM_SMMU_REGION_SHARED, dma_addr is used as an input parameter
+ *                which specifies the cpu virtual address to map.
+ * @len_ptr     : Length of buffer mapped returned by CAM SMMU driver.
+ * @region_id   : Memory region identifier
+ * @is_internal: Specifies if this buffer is kernel allocated.
+ * @ref_count:   Double ptr to store ref_cnt object in memmgr.
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_map_user_iova(int handle, int ion_fd, struct dma_buf *dmabuf,
+	bool dis_delayed_unmap, enum cam_smmu_map_dir dir, dma_addr_t *dma_addr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id, bool is_internal, struct kref **ref_count);
+
+/**
+ * @brief        : Maps kernel space IOVA for calling driver
+ *
+ * @param handle : Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param buf    : dma_buf allocated for kernel usage in mem_mgr
+ * @dir          : Mapping direction: which will traslate toDMA_BIDIRECTIONAL,
+ *                 DMA_TO_DEVICE or DMA_FROM_DEVICE
+ * @dma_addr     : Pointer to physical address where mapped address will be
+ *                 returned if region_id is CAM_SMMU_REGION_IO. If region_id is
+ *                 CAM_SMMU_REGION_SHARED, dma_addr is used as an input
+ *                 parameter which specifies the cpu virtual address to map.
+ * @len_ptr      : Length of buffer mapped returned by CAM SMMU driver.
+ * @region_id    : Memory region identifier
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_map_kernel_iova(int handle,
+	struct dma_buf *buf, enum cam_smmu_map_dir dir,
+	dma_addr_t *dma_addr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id);
+
+/**
+ * @brief       : Unmaps user space IOVA for calling driver
+ *
+ * @param handle: Handle to identify the CAMSMMU client (VFE, CPP, FD etc.)
+ * @param ion_fd: ION handle identifying the memory buffer.
+ * @param dma_buf: DMA Buf handle identifying the memory buffer.
+ * @param region_id: Region id from which to unmap buffer.
+ * @param force_unmap: If this unmap operation is part of memmgr cleanup
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_unmap_user_iova(int handle,
+	int ion_fd, struct dma_buf *dma_buf, enum cam_smmu_region_id region_id,
+	bool force_unmap);
+
+/**
+ * @brief       : Unmaps kernel IOVA for calling driver
+ *
+ * @param handle: Handle to identify the CAMSMMU client (VFE, CPP, FD etc.)
+ * @param buf   : dma_buf allocated for the kernel
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_unmap_kernel_iova(int handle,
+	struct dma_buf *buf, enum cam_smmu_region_id region_id);
+
+/**
+ * @brief          : Allocates a scratch buffer
+ *
+ * This function allocates a scratch virtual buffer of length virt_len in the
+ * device virtual address space mapped to phys_len physically contiguous bytes
+ * in that device's SMMU.
+ *
+ * virt_len and phys_len are expected to be aligned to PAGE_SIZE and with each
+ * other, otherwise -EINVAL is returned.
+ *
+ * -EINVAL will be returned if virt_len is less than phys_len.
+ *
+ * Passing a too large phys_len might also cause failure if that much size is
+ * not available for allocation in a physically contiguous way.
+ *
+ * @param handle   : Handle to identify the CAMSMMU client (VFE, CPP, FD etc.)
+ * @param dir      : Direction of mapping which will translate to IOMMU_READ
+ *                   IOMMU_WRITE or a bit mask of both.
+ * @param paddr_ptr: Device virtual address that the client device will be
+ *                   able to read from/write to
+ * @param virt_len : Virtual length of the scratch buffer
+ * @param phys_len : Physical length of the scratch buffer
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+
+int cam_smmu_get_scratch_iova(int handle,
+	enum cam_smmu_map_dir dir,
+	dma_addr_t *paddr_ptr,
+	size_t virt_len,
+	size_t phys_len);
+
+/**
+ * @brief          : Frees a scratch buffer
+ *
+ * This function frees a scratch buffer and releases the corresponding SMMU
+ * mappings.
+ *
+ * @param handle   : Handle to identify the CAMSMMU client (IFE, ICP, etc.)
+ * @param paddr    : Device virtual address of client's scratch buffer that
+ *                   will be freed.
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+
+int cam_smmu_put_scratch_iova(int handle,
+	dma_addr_t paddr);
+
+/**
+ *@brief        : Destroys an smmu handle
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_destroy_handle(int handle);
+
+/**
+ * @brief       : Returns if context bank identified by handle has a shared region
+ *
+ * @param handle: Handle to identify the context bank
+ * @return      : True if context banks supports shared region, false otherwise
+ * @note        : Currently, only ICP context banks support shared regions.
+ */
+bool cam_smmu_supports_shared_region(int handle);
+
+/**
+ * @brief       : Registers smmu fault handler for client
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param handler_cb: It is triggered in IOMMU page fault
+ * @param token: It is input param when trigger page fault handler
+ */
+void cam_smmu_set_client_page_fault_handler(int handle,
+	void (*handler_cb)(struct cam_smmu_pf_info  *pf_info), void *token);
+
+/**
+ * @brief       : Unregisters smmu fault handler for client
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param token: It is input param when trigger page fault handler
+ */
+void cam_smmu_unset_client_page_fault_handler(int handle, void *token);
+
+/**
+ * @brief Maps memory from an ION fd into IOVA space
+ *
+ * @param handle: SMMU handle identifying the context bank to map to
+ * @param ion_fd: ION fd of memory to map to
+ * @param dma_buf: DMA buf of memory to map to
+ * @param paddr_ptr: Pointer IOVA address that will be returned
+ * @param len_ptr: Length of memory mapped
+ * @param buf_tracker: List to add tracked buffers to
+ * @param ref_count: Double ptr to ref_count object for memmgr table
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_iova(int handle, int ion_fd, struct dma_buf *dma_buf,
+	dma_addr_t *paddr_ptr, size_t *len_ptr, struct list_head *buf_tracker,
+	struct kref **ref_count);
+
+/**
+ * @brief Maps memory from an ION fd into IOVA space
+ *
+ * @param handle: SMMU handle identifying the secure context bank to map to
+ * @param ion_fd: ION fd of memory to map to
+ * @param dma_buf: DMA Buf of memory to map to
+ * @param paddr_ptr: Pointer IOVA address that will be returned
+ * @param len_ptr: Length of memory mapped
+ * @param buf_tracker: List to add tracked buffers to
+ * @param ref_count: Double ptr to ref_count object for memmgr table
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_stage2_iova(int handle, int ion_fd, struct dma_buf *dma_buf,
+	dma_addr_t *paddr_ptr, size_t *len_ptr, struct list_head *buf_tracker,
+	struct kref **ref_count);
+
+/**
+ * @brief Unmaps memory from context bank
+ *
+ * @param handle: SMMU handle identifying the context bank
+ * @param ion_fd: ION fd of memory to unmap
+ * @param dma_buf: DMA Buf of memory to unmap
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_put_iova(int handle, int ion_fd, struct dma_buf *dma_buf);
+
+/**
+ * @brief Maps secure memory for SMMU handle
+ *
+ * @param handle: SMMU handle identifying secure context bank
+ * @param ion_fd: ION fd to map securely
+ * @param dmabuf: DMA buf to map securely
+ * @param dir: DMA Direction for the mapping
+ * @param dma_addr: Returned IOVA address after mapping
+ * @param len_ptr: Length of memory mapped
+ * @param ref_count: Double ptr to store ref_cnt object in memmgr
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_map_stage2_iova(int handle, int ion_fd, struct dma_buf *dmabuf,
+	enum cam_smmu_map_dir dir, dma_addr_t *dma_addr, size_t *len_ptr,
+	struct kref **ref_count);
+
+/**
+ * @brief Unmaps secure memopry for SMMU handle
+ *
+ * @param handle: SMMU handle identifying secure context bank
+ * @param ion_fd: ION fd to unmap
+ * @param dma_buf: DMA Buf to unmap
+ * @param force_unmap: If this unmap operation is part of memmgr cleanup
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_unmap_stage2_iova(int handle, int ion_fd, struct dma_buf *dma_buf,
+	bool force_unmap);
+
+/**
+ * @brief Allocates firmware for context bank
+ *
+ * @param smmu_hdl: SMMU handle identifying context bank
+ * @param iova: IOVA address of allocated firmware
+ * @param kvaddr: CPU mapped address of allocated firmware
+ * @param len: Length of allocated firmware memory
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_alloc_firmware(int32_t smmu_hdl,
+	dma_addr_t *iova,
+	uintptr_t *kvaddr,
+	size_t *len);
+
+/**
+ * @brief Deallocates firmware memory for context bank
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_dealloc_firmware(int32_t smmu_hdl);
+
+/**
+ * @brief Gets region information specified by smmu handle and region id
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ * @param region_id: Region id for which information is desired
+ * @param region_info: Struct populated with region information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_region_info(int32_t smmu_hdl,
+	enum cam_smmu_region_id region_id,
+	struct cam_smmu_region_info *region_info);
+
+/**
+ * @brief Reserves a region with buffer
+ *
+ * @param region: Region id
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ * @param iova: IOVA of secondary heap after reservation has completed
+ * @param buf: Allocated dma_buf for secondary heap
+ * @param request_len: Length of secondary heap after reservation has completed
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_reserve_buf_region(enum cam_smmu_region_id region,
+	int32_t smmu_hdl, struct dma_buf *buf,
+	dma_addr_t *iova, size_t *request_len);
+
+/**
+ * @brief Releases buffer in reserved region
+ *
+ * @param region: Region id
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_release_buf_region(enum cam_smmu_region_id region,
+	int32_t smmu_hdl);
+
+/**
+ * @brief Map va for phy addr range for a given context bank
+ *
+ * @param smmu_hdl: SMMU handle identifying context bank
+ * @param region_id: Region ID
+ * @optional param subregion_id: Subregion ID
+ * @param iova: IOVA address of allocated qdss
+ * @param len: Length of allocated qdss memory
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_map_phy_mem_region(int32_t smmu_hdl,
+	uint32_t region_id, uint32_t subregion_id,
+	dma_addr_t *iova, size_t *len);
+
+/**
+ * @brief Unmap call for map_phy_mem for given context bank
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ * @param region_id: Region ID
+ * @optional param subregion_id: Subregion ID
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_unmap_phy_mem_region(int32_t smmu_hdl,
+	uint32_t region_id, uint32_t subregion_id);
+
+/**
+ * @brief Get start addr & len of I/O region for a given cb
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ * @param iova: IOVA address of allocated I/O region
+ * @param len: Length of allocated I/O memory
+ * @param discard_iova_start: Start address of io space to discard
+ * @param discard_iova_len: Length of io space to discard
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_io_region_info(int32_t smmu_hdl,
+	dma_addr_t *iova, size_t *len,
+	dma_addr_t *discard_iova_start, size_t *discard_iova_len);
+
+/**
+ * @brief : API to reset the call context bank page fault count
+ *          This should be done on the starting of new camera open
+ * @return void.
+ */
+void cam_smmu_reset_cb_page_fault_cnt(void);
+
+/**
+ * @brief : API to register SMMU hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_smmu_init_module(void);
+
+/**
+ * @brief : API to remove SMMU Hw from platform framework.
+ */
+void cam_smmu_exit_module(void);
+
+/**
+ * @brief : API to determine whether to force all allocations to CACHED
+ */
+int cam_smmu_need_force_alloc_cached(bool *force_alloc_cached);
+
+/**
+ * @brief : API to determine whether padding is needed for shared buffers
+ */
+bool cam_smmu_need_shared_buffer_padding(void);
+
+/**
+ * @brief : API to determine whether certain HW is 36-bit memory addressable
+ */
+bool cam_smmu_is_expanded_memory(void);
+
+/**
+ * @brief : API to query whether page fault non fatal is enable for a device's context bank
+ */
+int cam_smmu_is_cb_non_fatal_fault_en(int smmu_hdl, bool *non_fatal_en);
+
+/**
+ * @brief : API to initialize any SMMU config, also get any capabilities
+ * such as num banks and the CSF version in use that's received from SMMU proxy driver
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_driver_init(struct cam_csf_version *csf_ver, int32_t *num_cbs);
+
+/**
+ * @brief : API to deinitialize any initialized SMMU config
+ */
+void cam_smmu_driver_deinit(void);
+
+/**
+ * @brief : API to putref on tracked buffers whoose ref counts
+ *          are incremented
+ */
+void cam_smmu_buffer_tracker_putref(struct list_head *mapped_io_list);
+
+/**
+ * @brief : API to putref on a specific tracked buffer
+ */
+void cam_smmu_buffer_tracker_buffer_putref(struct cam_smmu_buffer_tracker *entry);
+
+/**
+ * @brief : Add tracked buffers to list that belongs to a context
+ */
+int cam_smmu_add_buf_to_track_list(int ion_fd, unsigned long inode,
+	struct kref **ref_count, struct list_head *buf_tracker, int idx);
+
+#endif /* _CAM_SMMU_API_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync.c
@@ -0,0 +1,2971 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/irqflags.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/debugfs.h>
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX) || IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+#include <synx_api.h>
+#endif
+#include "cam_sync_util.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+#include "camera_main.h"
+#include "cam_req_mgr_workq.h"
+
+struct sync_device *sync_dev;
+
+/*
+ * Flag to determine whether to enqueue cb of a
+ * signaled fence onto the workq or invoke it
+ * directly in the same context
+ */
+static bool trigger_cb_without_switch;
+unsigned long cam_sync_monitor_mask;
+
+static void cam_sync_print_fence_table(void)
+{
+	int idx;
+
+	for (idx = 0; idx < CAM_SYNC_MAX_OBJS; idx++) {
+		spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+		CAM_INFO(CAM_SYNC,
+			"index[%u]: sync_id=%d, name=%s, type=%d, state=%d, ref_cnt=%d",
+			idx,
+			sync_dev->sync_table[idx].sync_id,
+			sync_dev->sync_table[idx].name,
+			sync_dev->sync_table[idx].type,
+			sync_dev->sync_table[idx].state,
+			atomic_read(&sync_dev->sync_table[idx].ref_cnt));
+		spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+	}
+}
+
+static int cam_sync_create_util(
+	int32_t *sync_obj, const char *name,
+	struct cam_dma_fence_create_sync_obj_payload *dma_sync_create_info,
+	struct sync_synx_obj_info *synx_obj_sync_create_info)
+{
+	int rc;
+	long idx;
+	bool bit;
+	struct sync_table_row *row = NULL;
+
+	do {
+		idx = find_first_zero_bit(sync_dev->bitmap, CAM_SYNC_MAX_OBJS);
+		if (idx >= CAM_SYNC_MAX_OBJS) {
+			CAM_ERR(CAM_SYNC,
+				"Error: Unable to create sync idx = %d sync name = %s reached max!",
+				idx, name);
+			cam_sync_print_fence_table();
+			return -ENOMEM;
+		}
+
+		CAM_DBG(CAM_SYNC, "Index location available at idx: %ld", idx);
+		bit = test_and_set_bit(idx, sync_dev->bitmap);
+	} while (bit);
+
+	spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+	rc = cam_sync_init_row(sync_dev->sync_table, idx, name,
+		CAM_SYNC_TYPE_INDV);
+
+	if (rc) {
+		CAM_ERR(CAM_SYNC, "Error: Unable to init row at idx = %ld",
+			idx);
+		clear_bit(idx, sync_dev->bitmap);
+		spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+		return -EINVAL;
+	}
+
+	*sync_obj = idx;
+
+	/* Associate sync obj with synx if any holding sync lock */
+	if (synx_obj_sync_create_info) {
+		row = sync_dev->sync_table + idx;
+		row->synx_obj_info.synx_obj_row_idx =
+			synx_obj_sync_create_info->synx_obj_row_idx;
+		row->synx_obj_info.sync_created_with_synx =
+			synx_obj_sync_create_info->sync_created_with_synx;
+		row->synx_obj_info.synx_obj = synx_obj_sync_create_info->synx_obj;
+
+		set_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &row->ext_fence_mask);
+
+		CAM_DBG(CAM_SYNC, "sync_obj: %s[%d] associated with synx_obj: %d",
+			name, *sync_obj, row->synx_obj_info.synx_obj);
+	}
+
+	/* Associate sync obj with dma fence if any holding sync lock */
+	if (dma_sync_create_info) {
+		row = sync_dev->sync_table + idx;
+		row->dma_fence_info.dma_fence_fd = dma_sync_create_info->fd;
+		row->dma_fence_info.dma_fence_row_idx = dma_sync_create_info->dma_fence_row_idx;
+		row->dma_fence_info.sync_created_with_dma =
+			dma_sync_create_info->sync_created_with_dma;
+		set_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &row->ext_fence_mask);
+
+		/* Association refcnt for non-import cases */
+		if (dma_sync_create_info->sync_created_with_dma) {
+			rc = cam_dma_fence_get_put_ref(true, row->dma_fence_info.dma_fence_row_idx);
+			if (rc)
+				CAM_ERR(CAM_SYNC,
+					"Failed to getref on dma fence idx: %u fd: %d sync_obj: %d rc: %d",
+					row->dma_fence_info.dma_fence_row_idx,
+					row->dma_fence_info.dma_fence_fd,
+					*sync_obj, rc);
+			goto end;
+		}
+
+		CAM_DBG(CAM_SYNC, "sync_obj: %s[%d] associated with dma fence fd: %d",
+			name, *sync_obj, dma_sync_create_info->fd);
+		goto end;
+	}
+
+	CAM_DBG(CAM_SYNC, "sync_obj: %s[%i]", name, *sync_obj);
+
+end:
+	spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+	return rc;
+}
+
+int cam_sync_create(int32_t *sync_obj, const char *name)
+{
+	return cam_sync_create_util(sync_obj, name, NULL, NULL);
+}
+
+int cam_sync_register_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj)
+{
+	struct sync_callback_info *sync_cb;
+	struct sync_table_row *row = NULL;
+	int status = 0, rc = 0;
+
+	if ((sync_obj >= CAM_SYNC_MAX_OBJS) || (sync_obj <= 0) || (!cb_func))
+		return -EINVAL;
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj %s[%d]",
+			row->name, sync_obj);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	sync_cb = kzalloc(sizeof(*sync_cb), GFP_ATOMIC);
+	if (!sync_cb) {
+		rc = -ENOMEM;
+		goto monitor_dump;
+	}
+
+	/* Trigger callback if sync object is already in SIGNALED state */
+	if (((row->state == CAM_SYNC_STATE_SIGNALED_SUCCESS) ||
+		(row->state == CAM_SYNC_STATE_SIGNALED_ERROR) ||
+		(row->state == CAM_SYNC_STATE_SIGNALED_CANCEL)) &&
+		(!row->remaining)) {
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(sync_obj,
+				&sync_dev->table_lock, sync_dev->mon_data,
+				CAM_FENCE_OP_SKIP_REGISTER_CB);
+		if (trigger_cb_without_switch) {
+			CAM_DBG(CAM_SYNC, "Invoke callback for sync object:%s[%d]",
+				row->name,
+				sync_obj);
+			status = row->state;
+			kfree(sync_cb);
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+			cb_func(sync_obj, status, userdata);
+		} else {
+			sync_cb->callback_func = cb_func;
+			sync_cb->cb_data = userdata;
+			sync_cb->sync_obj = sync_obj;
+			INIT_WORK(&sync_cb->cb_dispatch_work,
+				cam_sync_util_cb_dispatch);
+			sync_cb->status = row->state;
+			CAM_DBG(CAM_SYNC, "Enqueue callback for sync object:%s[%d]",
+				row->name,
+				sync_cb->sync_obj);
+			sync_cb->workq_scheduled_ts = ktime_get();
+			queue_work(sync_dev->work_queue,
+				&sync_cb->cb_dispatch_work);
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		}
+
+		return 0;
+	}
+
+	sync_cb->callback_func = cb_func;
+	sync_cb->cb_data = userdata;
+	sync_cb->sync_obj = sync_obj;
+	INIT_WORK(&sync_cb->cb_dispatch_work, cam_sync_util_cb_dispatch);
+	list_add_tail(&sync_cb->list, &row->callback_list);
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ, &cam_sync_monitor_mask))
+		cam_generic_fence_update_monitor_array(sync_obj,
+			&sync_dev->table_lock, sync_dev->mon_data,
+			CAM_FENCE_OP_REGISTER_CB);
+
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+
+	return 0;
+
+monitor_dump:
+	cam_sync_dump_monitor_array(row);
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return rc;
+}
+
+int cam_sync_deregister_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+	struct sync_callback_info *sync_cb, *temp;
+	bool found = false;
+	int rc = 0;
+
+	if ((sync_obj >= CAM_SYNC_MAX_OBJS) || (sync_obj <= 0))
+		return -EINVAL;
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %s[%d]",
+			row->name, sync_obj);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	CAM_DBG(CAM_SYNC, "deregistered callback for sync object:%s[%d]",
+		row->name, sync_obj);
+	list_for_each_entry_safe(sync_cb, temp, &row->callback_list, list) {
+		if ((sync_cb->callback_func == cb_func) &&
+			(sync_cb->cb_data == userdata)) {
+			list_del_init(&sync_cb->list);
+			kfree(sync_cb);
+			found = true;
+		}
+	}
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ, &cam_sync_monitor_mask)) {
+		if (found) {
+			cam_generic_fence_update_monitor_array(sync_obj,
+				&sync_dev->table_lock, sync_dev->mon_data,
+				CAM_FENCE_OP_UNREGISTER_CB);
+		} else {
+			CAM_ERR(CAM_SYNC,
+				"Error: Callback not found sync obj = %s[%d] : sync_id %d, state %d",
+				row->name, sync_obj, row->sync_id, row->state);
+			cam_sync_dump_monitor_array(row);
+		}
+	}
+
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+
+	return found ? 0 : -ENOENT;
+
+monitor_dump:
+	cam_sync_dump_monitor_array(row);
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return rc;
+}
+
+static inline int cam_sync_signal_dma_fence_util(
+	struct sync_table_row *row, uint32_t status)
+{
+	struct cam_dma_fence_signal signal_dma_fence;
+
+	signal_dma_fence.dma_fence_fd = row->dma_fence_info.dma_fence_fd;
+
+	switch (status) {
+	case CAM_SYNC_STATE_SIGNALED_SUCCESS:
+		signal_dma_fence.status = 0;
+		break;
+	case CAM_SYNC_STATE_SIGNALED_ERROR:
+		/* Advertise error */
+		signal_dma_fence.status = -EADV;
+		break;
+	case CAM_SYNC_STATE_SIGNALED_CANCEL:
+		signal_dma_fence.status = -ECANCELED;
+		break;
+	default:
+		CAM_ERR(CAM_SYNC,
+			"Signaling undefined status: %d for sync obj: %d",
+			status, row->sync_id);
+		return -EINVAL;
+	}
+
+	return cam_dma_fence_internal_signal(row->dma_fence_info.dma_fence_row_idx,
+		&signal_dma_fence);
+}
+
+static void cam_sync_signal_parent_util(int32_t status,
+	uint32_t event_cause, struct list_head *parents_list)
+{
+	int rc;
+	struct sync_table_row *parent_row = NULL;
+	struct sync_parent_info *parent_info, *temp_parent_info;
+
+	/*
+	 * Now iterate over all parents of this object and if they too need to
+	 * be signaled dispatch cb's
+	 */
+	 list_for_each_entry_safe(parent_info, temp_parent_info,
+		parents_list, list) {
+		parent_row = sync_dev->sync_table + parent_info->sync_id;
+		spin_lock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+		parent_row->remaining--;
+
+		rc = cam_sync_util_update_parent_state(
+			parent_row,
+			status);
+		if (rc) {
+			CAM_ERR(CAM_SYNC, "Invalid parent state %d",
+				parent_row->state);
+			spin_unlock_bh(
+				&sync_dev->row_spinlocks[parent_info->sync_id]);
+			kfree(parent_info);
+			continue;
+		}
+
+		if (!parent_row->remaining)
+			cam_sync_util_dispatch_signaled_cb(
+				parent_info->sync_id, parent_row->state,
+				event_cause);
+
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(parent_info->sync_id,
+				&sync_dev->table_lock, sync_dev->mon_data,
+				CAM_FENCE_OP_SIGNAL);
+
+		spin_unlock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+		list_del_init(&parent_info->list);
+		kfree(parent_info);
+	}
+}
+
+static int cam_sync_signal_validate_util(
+	int32_t sync_obj, int32_t status)
+{
+	struct sync_table_row *row = sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %s[%d]",
+			row->name, sync_obj);
+		return -EINVAL;
+	}
+
+	if (row->type == CAM_SYNC_TYPE_GROUP) {
+		CAM_ERR(CAM_SYNC,
+			"Error: Signaling a GROUP sync object = %s[%d]",
+			row->name, sync_obj);
+		return -EINVAL;
+	}
+
+	if (row->state != CAM_SYNC_STATE_ACTIVE) {
+		CAM_ERR(CAM_SYNC,
+			"Error: Sync object already signaled sync_obj = %s[%d]",
+			row->name, sync_obj);
+		return -EALREADY;
+	}
+
+	if ((status != CAM_SYNC_STATE_SIGNALED_SUCCESS) &&
+		(status != CAM_SYNC_STATE_SIGNALED_ERROR) &&
+		(status != CAM_SYNC_STATE_SIGNALED_CANCEL)) {
+		CAM_ERR(CAM_SYNC,
+			"Error: signaling with undefined status = %d", status);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_sync_signal(int32_t sync_obj, uint32_t status, uint32_t event_cause)
+{
+	struct sync_table_row *row = NULL;
+	struct list_head parents_list;
+	int rc = 0;
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+	uint32_t synx_row_idx;
+	struct cam_synx_obj_signal signal_synx_obj;
+#endif
+
+	if ((sync_obj >= CAM_SYNC_MAX_OBJS) || (sync_obj <= 0)) {
+		CAM_ERR(CAM_SYNC, "Error: Out of range sync obj (0 <= %d < %d)",
+			sync_obj, CAM_SYNC_MAX_OBJS);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	rc = cam_sync_signal_validate_util(sync_obj, status);
+	if (rc) {
+		CAM_ERR(CAM_SYNC,
+			"Error: Failed to validate signal info for sync_obj = %s[%d] with status = %d rc = %d",
+			row->name, sync_obj, status, rc);
+		goto monitor_dump;
+	}
+
+	if (!atomic_dec_and_test(&row->ref_cnt)) {
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		return 0;
+	}
+
+	row->state = status;
+	/*
+	 * Signal associated dma fence first - external entities
+	 * waiting on this fence can start processing
+	 */
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &row->ext_fence_mask)) {
+		rc = cam_sync_signal_dma_fence_util(row, status);
+		if (rc) {
+			CAM_ERR(CAM_SYNC,
+				"Error: Failed to signal associated dma fencefd = %d for sync_obj = %s[%d]",
+				row->dma_fence_info.dma_fence_fd, row->name, sync_obj);
+			cam_sync_dump_monitor_array(row);
+		}
+	}
+
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+	/*
+	 * Signal associated synx obj prior to sync
+	 */
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &row->ext_fence_mask)) {
+		signal_synx_obj.status = status;
+		signal_synx_obj.synx_obj = row->synx_obj_info.synx_obj;
+		synx_row_idx = row->synx_obj_info.synx_obj_row_idx;
+
+		/* Release & obtain the row lock after synx signal */
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		rc = cam_synx_obj_internal_signal(synx_row_idx, &signal_synx_obj);
+		spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		if (rc) {
+			CAM_ERR(CAM_SYNC,
+				"Error: Failed to signal associated synx obj = %d for sync_obj = %d",
+				signal_synx_obj.synx_obj, sync_obj);
+			cam_sync_dump_monitor_array(row);
+		}
+	}
+#endif
+
+	cam_sync_util_dispatch_signaled_cb(sync_obj, status, event_cause);
+
+	/* copy parent list to local and release child lock */
+	INIT_LIST_HEAD(&parents_list);
+	list_splice_init(&row->parents_list, &parents_list);
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ, &cam_sync_monitor_mask))
+		cam_generic_fence_update_monitor_array(sync_obj,
+			&sync_dev->table_lock, sync_dev->mon_data,
+			CAM_FENCE_OP_SIGNAL);
+
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	if (list_empty(&parents_list))
+		return 0;
+
+	cam_sync_signal_parent_util(status, event_cause, &parents_list);
+
+	return 0;
+
+monitor_dump:
+	cam_sync_dump_monitor_array(row);
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return rc;
+}
+
+int cam_sync_merge(int32_t *sync_obj, uint32_t num_objs, int32_t *merged_obj)
+{
+	int rc, i;
+	long idx = 0;
+	bool bit;
+
+	if ((!sync_obj) || (!merged_obj)) {
+		CAM_ERR(CAM_SYNC, "Invalid pointer(s)");
+		return -EINVAL;
+	}
+
+	if (num_objs <= 1) {
+		CAM_ERR(CAM_SYNC, "Single object merge is not allowed");
+		return -EINVAL;
+	}
+
+	if (cam_common_util_remove_duplicate_arr(sync_obj, num_objs)
+		!= num_objs) {
+		CAM_ERR(CAM_SYNC, "The obj list has duplicate fence");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_objs; i++) {
+		rc = cam_sync_check_valid(sync_obj[i]);
+		if (rc) {
+			CAM_ERR(CAM_SYNC, "Sync_obj[%d] %d valid check fail",
+				i, sync_obj[i]);
+			return rc;
+		}
+	}
+	do {
+		idx = find_first_zero_bit(sync_dev->bitmap, CAM_SYNC_MAX_OBJS);
+		if (idx >= CAM_SYNC_MAX_OBJS)
+			return -ENOMEM;
+		bit = test_and_set_bit(idx, sync_dev->bitmap);
+	} while (bit);
+
+	spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+	rc = cam_sync_init_group_object(sync_dev->sync_table,
+		idx, sync_obj, num_objs);
+	if (rc < 0) {
+		CAM_ERR(CAM_SYNC, "Error: Unable to init row at idx = %ld",
+			idx);
+		clear_bit(idx, sync_dev->bitmap);
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_SYNC, "Init row at idx:%ld to merge objects", idx);
+	*merged_obj = idx;
+	spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+
+	return 0;
+}
+
+int cam_sync_get_obj_ref(int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+	int rc;
+
+	if ((sync_obj >= CAM_SYNC_MAX_OBJS) || (sync_obj <= 0))
+		return -EINVAL;
+
+	spin_lock(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	if (row->state != CAM_SYNC_STATE_ACTIVE) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %s[%d]",
+			row->name, sync_obj);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	atomic_inc(&row->ref_cnt);
+	spin_unlock(&sync_dev->row_spinlocks[sync_obj]);
+	CAM_DBG(CAM_SYNC, "get ref for obj %d", sync_obj);
+
+	return 0;
+
+monitor_dump:
+	cam_sync_dump_monitor_array(row);
+	spin_unlock(&sync_dev->row_spinlocks[sync_obj]);
+	return rc;
+}
+
+int cam_sync_put_obj_ref(int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+
+	if ((sync_obj >= CAM_SYNC_MAX_OBJS) || (sync_obj <= 0))
+		return -EINVAL;
+
+	row = sync_dev->sync_table + sync_obj;
+	atomic_dec(&row->ref_cnt);
+	CAM_DBG(CAM_SYNC, "put ref for obj %d", sync_obj);
+
+	return 0;
+}
+
+int cam_sync_destroy(int32_t sync_obj)
+{
+	return cam_sync_deinit_object(sync_dev->sync_table, sync_obj, NULL, NULL);
+}
+
+int cam_sync_check_valid(int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+	int rc;
+
+	if ((sync_obj >= CAM_SYNC_MAX_OBJS) || (sync_obj <= 0))
+		return -EINVAL;
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	if (!test_bit(sync_obj, sync_dev->bitmap)) {
+		CAM_ERR(CAM_SYNC, "Error: Released sync obj received %s[%d]",
+			row->name, sync_obj);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %s[%d]",
+			row->name, sync_obj);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return 0;
+
+monitor_dump:
+	cam_sync_dump_monitor_array(row);
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return rc;
+}
+
+int cam_sync_wait(int32_t sync_obj, uint64_t timeout_ms)
+{
+	unsigned long timeleft;
+	int rc;
+	struct sync_table_row *row = NULL;
+
+	if ((sync_obj >= CAM_SYNC_MAX_OBJS) || (sync_obj <= 0))
+		return -EINVAL;
+
+	row = sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %s[%d]",
+			row->name, sync_obj);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	timeleft = cam_common_wait_for_completion_timeout(&row->signaled,
+		msecs_to_jiffies(timeout_ms));
+
+	if (!timeleft) {
+		CAM_ERR(CAM_SYNC,
+			"Error: timed out for sync obj = %s[%d]", row->name, sync_obj);
+		rc = -ETIMEDOUT;
+		goto monitor_dump;
+	} else {
+		switch (row->state) {
+		case CAM_SYNC_STATE_INVALID:
+		case CAM_SYNC_STATE_ACTIVE:
+		case CAM_SYNC_STATE_SIGNALED_ERROR:
+		case CAM_SYNC_STATE_SIGNALED_CANCEL:
+			CAM_ERR(CAM_SYNC,
+				"Error: Wait on invalid state = %d, obj = %d, name = %s",
+				row->state, sync_obj, row->name);
+			rc = -EINVAL;
+			goto monitor_dump;
+		case CAM_SYNC_STATE_SIGNALED_SUCCESS:
+			rc = 0;
+			break;
+		default:
+			rc = -EINVAL;
+			goto monitor_dump;
+		}
+	}
+
+	return rc;
+
+monitor_dump:
+	cam_sync_dump_monitor_array(row);
+	return rc;
+}
+
+static int cam_sync_handle_create(struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_info sync_create;
+	int result;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_info))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_create,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		k_ioctl->size))
+		return -EFAULT;
+	sync_create.name[SYNC_DEBUG_NAME_LEN] = '\0';
+
+	result = cam_sync_create(&sync_create.sync_obj,
+		sync_create.name);
+
+	if (!result)
+		if (copy_to_user(
+			u64_to_user_ptr(k_ioctl->ioctl_ptr),
+			&sync_create, k_ioctl->size))
+			return -EFAULT;
+
+	return result;
+}
+
+static int cam_sync_handle_signal(struct cam_private_ioctl_arg *k_ioctl)
+{
+	int rc;
+	struct cam_sync_signal sync_signal;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_signal))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_signal,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr), k_ioctl->size))
+		return -EFAULT;
+
+	/* need to get ref for UMD signaled fences */
+	rc = cam_sync_get_obj_ref(sync_signal.sync_obj);
+	if (rc) {
+		CAM_DBG(CAM_SYNC,
+			"Error: cannot signal an uninitialized sync obj = %d",
+			sync_signal.sync_obj);
+		return rc;
+	}
+
+	return cam_sync_signal(sync_signal.sync_obj,
+		sync_signal.sync_state,
+		CAM_SYNC_COMMON_SYNC_SIGNAL_EVENT);
+}
+
+static int cam_sync_handle_merge(struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_merge sync_merge;
+	uint32_t *sync_objs;
+	uint32_t num_objs;
+	uint32_t size;
+	int result;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_merge))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_merge,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr), k_ioctl->size))
+		return -EFAULT;
+
+	if (sync_merge.num_objs >= CAM_SYNC_MAX_OBJS)
+		return -EINVAL;
+
+	size = sizeof(uint32_t) * sync_merge.num_objs;
+	sync_objs = kzalloc(size, GFP_ATOMIC);
+
+	if (!sync_objs)
+		return -ENOMEM;
+
+	if (copy_from_user(sync_objs,
+		u64_to_user_ptr(sync_merge.sync_objs),
+		sizeof(uint32_t) * sync_merge.num_objs)) {
+		kfree(sync_objs);
+		return -EFAULT;
+	}
+
+	num_objs = sync_merge.num_objs;
+
+	result = cam_sync_merge(sync_objs,
+		num_objs, &sync_merge.merged);
+
+	if (!result)
+		if (copy_to_user(
+			u64_to_user_ptr(k_ioctl->ioctl_ptr),
+			&sync_merge, k_ioctl->size)) {
+			kfree(sync_objs);
+			return -EFAULT;
+	}
+
+	kfree(sync_objs);
+
+	return result;
+}
+
+static int cam_sync_handle_wait(struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_wait sync_wait;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_wait))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_wait,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr), k_ioctl->size))
+		return -EFAULT;
+
+	k_ioctl->result = cam_sync_wait(sync_wait.sync_obj,
+		sync_wait.timeout_ms);
+
+	return 0;
+}
+
+static int cam_sync_handle_destroy(struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_info sync_create;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_info))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_create,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr), k_ioctl->size))
+		return -EFAULT;
+
+	return cam_sync_destroy(sync_create.sync_obj);
+}
+
+static int cam_sync_handle_register_user_payload(
+	struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_userpayload_info userpayload_info;
+	struct sync_user_payload *user_payload_kernel;
+	struct sync_user_payload *user_payload_iter;
+	struct sync_user_payload *temp_upayload_kernel;
+	uint32_t sync_obj;
+	struct sync_table_row *row = NULL;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_userpayload_info))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&userpayload_info,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		k_ioctl->size))
+		return -EFAULT;
+
+	sync_obj = userpayload_info.sync_obj;
+	if ((sync_obj >= CAM_SYNC_MAX_OBJS) || (sync_obj <= 0))
+		return -EINVAL;
+
+	user_payload_kernel = kzalloc(sizeof(*user_payload_kernel), GFP_KERNEL);
+	if (!user_payload_kernel)
+		return -ENOMEM;
+
+	memcpy(user_payload_kernel->payload_data,
+		userpayload_info.payload,
+		CAM_SYNC_PAYLOAD_WORDS * sizeof(__u64));
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row =  sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %s[%d]",
+			row->name, sync_obj);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		kfree(user_payload_kernel);
+		return -EINVAL;
+	}
+
+	if ((row->state == CAM_SYNC_STATE_SIGNALED_SUCCESS) ||
+		(row->state == CAM_SYNC_STATE_SIGNALED_ERROR) ||
+		(row->state == CAM_SYNC_STATE_SIGNALED_CANCEL)) {
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(sync_obj,
+				&sync_dev->table_lock, sync_dev->mon_data,
+				CAM_FENCE_OP_SKIP_REGISTER_CB);
+
+		cam_sync_util_send_v4l2_event(CAM_SYNC_V4L_EVENT_ID_CB_TRIG,
+			sync_obj, row->state,
+			user_payload_kernel->payload_data,
+			CAM_SYNC_USER_PAYLOAD_SIZE * sizeof(__u64),
+			CAM_SYNC_COMMON_REG_PAYLOAD_EVENT);
+
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		kfree(user_payload_kernel);
+		return 0;
+	}
+
+	list_for_each_entry_safe(user_payload_iter,
+		temp_upayload_kernel, &row->user_payload_list, list) {
+		if (user_payload_iter->payload_data[0] ==
+				user_payload_kernel->payload_data[0] &&
+			user_payload_iter->payload_data[1] ==
+				user_payload_kernel->payload_data[1]) {
+
+			if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ,
+				&cam_sync_monitor_mask))
+				cam_generic_fence_update_monitor_array(sync_obj,
+					&sync_dev->table_lock, sync_dev->mon_data,
+					CAM_FENCE_OP_ALREADY_REGISTERED_CB);
+
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+			kfree(user_payload_kernel);
+			return -EALREADY;
+		}
+	}
+
+	list_add_tail(&user_payload_kernel->list, &row->user_payload_list);
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ, &cam_sync_monitor_mask))
+		cam_generic_fence_update_monitor_array(sync_obj,
+			&sync_dev->table_lock, sync_dev->mon_data,
+			CAM_FENCE_OP_REGISTER_CB);
+
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return 0;
+}
+
+static int cam_sync_handle_deregister_user_payload(
+	struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_userpayload_info userpayload_info;
+	struct sync_user_payload *user_payload_kernel, *temp;
+	uint32_t sync_obj;
+	struct sync_table_row *row = NULL;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_userpayload_info)) {
+		CAM_ERR(CAM_SYNC, "Incorrect ioctl size");
+		return -EINVAL;
+	}
+
+	if (!k_ioctl->ioctl_ptr) {
+		CAM_ERR(CAM_SYNC, "Invalid embedded ioctl ptr");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&userpayload_info,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr), k_ioctl->size))
+		return -EFAULT;
+
+	sync_obj = userpayload_info.sync_obj;
+	if ((sync_obj >= CAM_SYNC_MAX_OBJS) || (sync_obj <= 0))
+		return -EINVAL;
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %s[%d]",
+			row->name,
+			sync_obj);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		return -EINVAL;
+	}
+
+	list_for_each_entry_safe(user_payload_kernel, temp,
+				&row->user_payload_list, list) {
+		if (user_payload_kernel->payload_data[0] ==
+				userpayload_info.payload[0] &&
+				user_payload_kernel->payload_data[1] ==
+				userpayload_info.payload[1]) {
+			list_del_init(&user_payload_kernel->list);
+			kfree(user_payload_kernel);
+
+			if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ,
+				&cam_sync_monitor_mask))
+				cam_generic_fence_update_monitor_array(sync_obj,
+					&sync_dev->table_lock, sync_dev->mon_data,
+					CAM_FENCE_OP_UNREGISTER_CB);
+		}
+	}
+
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return 0;
+}
+
+static int cam_sync_dma_fence_cb(
+	int32_t sync_obj,
+	struct cam_dma_fence_signal_sync_obj *signal_sync_obj)
+{
+	int32_t rc;
+	int32_t status = CAM_SYNC_STATE_SIGNALED_SUCCESS;
+	struct sync_table_row *row = NULL;
+	struct list_head parents_list;
+
+	if (!signal_sync_obj) {
+		CAM_ERR(CAM_SYNC, "Invalid signal info args");
+		return -EINVAL;
+	}
+
+	/* Validate sync object range */
+	if (!((sync_obj > 0) && (sync_obj < CAM_SYNC_MAX_OBJS))) {
+		CAM_ERR(CAM_SYNC, "Invalid sync obj: %d", sync_obj);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	/* Validate if sync obj has a dma fence association */
+	if (!test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &row->ext_fence_mask)) {
+		CAM_ERR(CAM_SYNC,
+			"sync obj = %d[%s] has no associated dma fence ext_fence_mask = 0x%x",
+			sync_obj, row->name, row->ext_fence_mask);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Validate if we are signaling the right sync obj based on dma fence fd */
+	if (row->dma_fence_info.dma_fence_fd != signal_sync_obj->fd) {
+		CAM_ERR(CAM_SYNC,
+			"sync obj: %d[%s] is associated with a different fd: %d, signaling for fd: %d",
+			sync_obj, row->name, row->dma_fence_info.dma_fence_fd, signal_sync_obj->fd);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Check for error status */
+	if (signal_sync_obj->status < 0) {
+		if (signal_sync_obj->status == -ECANCELED)
+			status = CAM_SYNC_STATE_SIGNALED_CANCEL;
+		else
+			status = CAM_SYNC_STATE_SIGNALED_ERROR;
+	}
+
+	rc = cam_sync_signal_validate_util(sync_obj, status);
+	if (rc) {
+		CAM_ERR(CAM_SYNC,
+			"Error: Failed to validate signal info for sync_obj = %d[%s] with status = %d rc = %d",
+			sync_obj, row->name, status, rc);
+		goto end;
+	}
+
+	/* Adding dma fence reference on sync */
+	atomic_inc(&row->ref_cnt);
+
+	if (!atomic_dec_and_test(&row->ref_cnt))
+		goto end;
+
+	row->state = status;
+
+	cam_sync_util_dispatch_signaled_cb(sync_obj, status, 0);
+
+	INIT_LIST_HEAD(&parents_list);
+	list_splice_init(&row->parents_list, &parents_list);
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+
+	if (list_empty(&parents_list))
+		return 0;
+
+	cam_sync_signal_parent_util(status, 0x0, &parents_list);
+	return 0;
+
+end:
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return rc;
+}
+
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+static int cam_sync_synx_obj_cb(int32_t sync_obj,
+	struct cam_synx_obj_signal_sync_obj *signal_sync_obj)
+{
+	int32_t rc;
+	struct sync_table_row *row = NULL;
+	struct list_head parents_list;
+
+	if (!signal_sync_obj) {
+		CAM_ERR(CAM_SYNC, "Invalid signal info args");
+		return -EINVAL;
+	}
+
+	/* Validate sync object range */
+	if (!((sync_obj > 0) && (sync_obj < CAM_SYNC_MAX_OBJS))) {
+		CAM_ERR(CAM_SYNC, "Invalid sync obj: %d", sync_obj);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	/* Validate if sync obj has a synx obj association */
+	if (!test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &row->ext_fence_mask)) {
+		CAM_ERR(CAM_SYNC,
+			"sync obj = %d[%s] has no associated synx obj ext_fence_mask = 0x%x",
+			sync_obj, row->name, row->ext_fence_mask);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Validate if we are signaling the right sync obj based on synx handle */
+	if (row->synx_obj_info.synx_obj != signal_sync_obj->synx_obj) {
+		CAM_ERR(CAM_SYNC,
+			"sync obj: %d[%s] is associated with a different synx obj: %d, signaling for synx obj: %d",
+			sync_obj, row->name, row->synx_obj_info.synx_obj,
+			signal_sync_obj->synx_obj);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_sync_signal_validate_util(sync_obj, signal_sync_obj->status);
+	if (rc) {
+		CAM_ERR(CAM_SYNC,
+			"Error: Failed to validate signal info for sync_obj = %d[%s] with status = %d rc = %d",
+			sync_obj, row->name, signal_sync_obj->status, rc);
+		goto end;
+	}
+
+	/* Adding synx reference on sync */
+	atomic_inc(&row->ref_cnt);
+	if (!atomic_dec_and_test(&row->ref_cnt)) {
+		CAM_DBG(CAM_SYNC, "Sync = %d[%s] fence still has references, synx_hdl = %d",
+			sync_obj, row->name, signal_sync_obj->synx_obj);
+		goto end;
+	}
+
+	row->state = signal_sync_obj->status;
+
+	cam_sync_util_dispatch_signaled_cb(sync_obj, signal_sync_obj->status, 0);
+
+	INIT_LIST_HEAD(&parents_list);
+	list_splice_init(&row->parents_list, &parents_list);
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+
+	if (list_empty(&parents_list))
+		return 0;
+
+	cam_sync_signal_parent_util(signal_sync_obj->status, 0x0, &parents_list);
+	CAM_DBG(CAM_SYNC,
+		"Successfully signaled sync obj = %d with status = %d via synx obj = %d signal callback",
+		sync_obj, signal_sync_obj->status, signal_sync_obj->synx_obj);
+
+	return 0;
+
+end:
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return rc;
+}
+#endif
+
+static int cam_generic_fence_alloc_validate_input_info_util(
+	struct cam_generic_fence_cmd_args    *fence_cmd_args,
+	struct cam_generic_fence_input_info **fence_input_info)
+{
+	int rc = 0;
+	struct cam_generic_fence_input_info *fence_input = NULL;
+	uint32_t num_fences;
+	size_t expected_size;
+
+	*fence_input_info = NULL;
+
+	if (fence_cmd_args->input_data_size <
+		sizeof(struct cam_generic_fence_input_info)) {
+		CAM_ERR(CAM_SYNC, "Size is invalid expected: 0x%llx actual: 0x%llx",
+			sizeof(struct cam_generic_fence_input_info),
+			fence_cmd_args->input_data_size);
+		return -EINVAL;
+	}
+
+	fence_input = memdup_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_cmd_args->input_data_size);
+	if (IS_ERR_OR_NULL(fence_input)) {
+		CAM_ERR(CAM_SYNC, "memdup failed for hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+		return -ENOMEM;
+	}
+
+	/* Validate num fences */
+	num_fences = fence_input->num_fences_requested;
+	if ((num_fences == 0) || (num_fences > CAM_GENERIC_FENCE_BATCH_MAX)) {
+		CAM_ERR(CAM_SYNC, "Invalid number of fences: %u for batching",
+			num_fences);
+		rc = -EINVAL;
+		goto free_mem;
+	}
+
+	/* Validate sizes */
+	expected_size = sizeof(struct cam_generic_fence_input_info) +
+		((num_fences - 1) * sizeof(struct cam_generic_fence_config));
+	if ((uint32_t)expected_size != fence_cmd_args->input_data_size) {
+		CAM_ERR(CAM_SYNC, "Invalid input size expected: 0x%x actual: 0x%x for fences: %u",
+			expected_size, fence_cmd_args->input_data_size, num_fences);
+		rc = -EINVAL;
+		goto free_mem;
+	}
+
+	*fence_input_info = fence_input;
+	return rc;
+
+free_mem:
+	kfree(fence_input);
+	return rc;
+}
+
+static void cam_generic_fence_free_input_info_util(
+	struct cam_generic_fence_input_info **fence_input_info)
+{
+	struct cam_generic_fence_input_info *fence_input = *fence_input_info;
+
+	kfree(fence_input);
+	*fence_input_info = NULL;
+}
+
+static int cam_generic_fence_handle_dma_create(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int rc, i, dma_fence_row_idx;
+	struct cam_generic_fence_input_info *fence_input_info = NULL;
+	struct cam_generic_fence_config *fence_cfg = NULL;
+
+	rc = cam_generic_fence_alloc_validate_input_info_util(fence_cmd_args, &fence_input_info);
+	if (rc || !fence_input_info) {
+		CAM_ERR(CAM_DMA_FENCE,
+			"Fence input info validation failed rc: %d fence_input_info: %pK",
+			rc, fence_input_info);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fence_input_info->num_fences_requested; i++) {
+		fence_cfg = &fence_input_info->fence_cfg_flex[i];
+		fence_input_info->num_fences_processed++;
+		fence_cfg->reason_code = 0;
+
+		rc = cam_dma_fence_create_fd(&fence_cfg->dma_fence_fd,
+			&dma_fence_row_idx, fence_cfg->name);
+		if (rc) {
+			CAM_ERR(CAM_DMA_FENCE,
+				"Failed to create dma fence at index: %d rc: %d num fences [requested: %u processed: %u]",
+				i, rc, fence_input_info->num_fences_requested,
+				fence_input_info->num_fences_processed);
+			fence_cfg->reason_code = rc;
+			goto out_copy;
+		}
+
+		CAM_DBG(CAM_DMA_FENCE,
+			"Created dma_fence @ i: %d fence fd: %d[%s] num fences [requested: %u processed: %u] ",
+			i, fence_cfg->dma_fence_fd, fence_cfg->name,
+			fence_input_info->num_fences_requested,
+			fence_input_info->num_fences_processed);
+	}
+
+out_copy:
+	if (copy_to_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_input_info, fence_cmd_args->input_data_size)) {
+		CAM_ERR(CAM_DMA_FENCE, "copy to user failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+		rc = -EFAULT;
+	}
+
+	cam_generic_fence_free_input_info_util(&fence_input_info);
+	return rc;
+}
+
+static int cam_generic_fence_handle_dma_release(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int rc, i;
+	bool failed = false;
+	struct cam_dma_fence_release_params release_params;
+	struct cam_generic_fence_input_info *fence_input_info = NULL;
+	struct cam_generic_fence_config *fence_cfg = NULL;
+
+	rc = cam_generic_fence_alloc_validate_input_info_util(fence_cmd_args, &fence_input_info);
+	if (rc || !fence_input_info) {
+		CAM_ERR(CAM_DMA_FENCE,
+			"Fence input info validation failed rc: %d fence_input_info: %pK",
+			rc, fence_input_info);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fence_input_info->num_fences_requested; i++) {
+		fence_cfg = &fence_input_info->fence_cfg_flex[i];
+		fence_input_info->num_fences_processed++;
+		fence_cfg->reason_code = 0;
+
+		release_params.use_row_idx = false;
+		release_params.u.dma_fence_fd = fence_cfg->dma_fence_fd;
+		rc = cam_dma_fence_release(&release_params);
+		if (rc) {
+			CAM_ERR(CAM_DMA_FENCE,
+				"Failed to destroy dma fence at index: %d fd: %d rc: %d num fences [requested: %u processed: %u]",
+				i, fence_cfg->dma_fence_fd, rc,
+				fence_input_info->num_fences_requested,
+				fence_input_info->num_fences_processed);
+			fence_cfg->reason_code = rc;
+			/* Continue to release other fences, but mark the call as failed */
+			failed = true;
+			continue;
+		}
+
+		CAM_DBG(CAM_DMA_FENCE,
+			"Released dma_fence @ i: %d fd: %d num fences [requested: %u processed: %u]",
+			i, fence_cfg->dma_fence_fd,
+			fence_input_info->num_fences_requested,
+			fence_input_info->num_fences_processed);
+	}
+
+	if (failed)
+		rc = -ENOMSG;
+
+	if (copy_to_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_input_info, fence_cmd_args->input_data_size)) {
+		CAM_ERR(CAM_DMA_FENCE, "copy to user failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+		rc = -EFAULT;
+	}
+
+	cam_generic_fence_free_input_info_util(&fence_input_info);
+	return rc;
+}
+
+static int cam_generic_fence_handle_dma_import(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int32_t rc, i, dma_fence_row_idx;
+	struct dma_fence *fence = NULL;
+	struct cam_dma_fence_create_sync_obj_payload dma_sync_create;
+	struct cam_generic_fence_input_info *fence_input_info = NULL;
+	struct cam_generic_fence_config *fence_cfg = NULL;
+
+	rc = cam_generic_fence_alloc_validate_input_info_util(fence_cmd_args, &fence_input_info);
+	if (rc || !fence_input_info) {
+		CAM_ERR(CAM_DMA_FENCE,
+			"Fence input info validation failed rc: %d fence_input_info: %pK",
+			rc, fence_input_info);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fence_input_info->num_fences_requested; i++) {
+		fence_cfg = &fence_input_info->fence_cfg_flex[i];
+		fence_input_info->num_fences_processed++;
+		fence_cfg->reason_code = 0;
+
+		/* Check if fd is for a valid dma fence */
+		fence = cam_dma_fence_get_fence_from_fd(fence_cfg->dma_fence_fd,
+			&dma_fence_row_idx);
+		if (IS_ERR_OR_NULL(fence)) {
+			CAM_ERR(CAM_DMA_FENCE,
+				"Invalid dma fence for fd: %d", fence_cfg->dma_fence_fd);
+			fence_cfg->reason_code = -EINVAL;
+			goto out_copy;
+		}
+
+		dma_sync_create.dma_fence_row_idx = dma_fence_row_idx;
+		dma_sync_create.fd = fence_cfg->dma_fence_fd;
+		dma_sync_create.sync_created_with_dma = false;
+
+		/* Create new sync object and associate dma fence */
+		rc = cam_sync_create_util(&fence_cfg->sync_obj, fence_cfg->name,
+			&dma_sync_create, NULL);
+		if (rc) {
+			fence_cfg->reason_code = rc;
+
+			/* put on the import refcnt */
+			cam_dma_fence_get_put_ref(false, dma_fence_row_idx);
+			goto out_copy;
+		}
+
+		/* Register a cb for dma fence */
+		rc = cam_dma_fence_register_cb(&fence_cfg->sync_obj,
+			&dma_fence_row_idx, cam_sync_dma_fence_cb);
+		if (rc) {
+			CAM_ERR(CAM_DMA_FENCE,
+				"Failed to register cb for dma fence fd: %d sync_obj: %d rc: %d",
+				fence_cfg->dma_fence_fd, fence_cfg->sync_obj, rc);
+			cam_sync_deinit_object(sync_dev->sync_table, fence_cfg->sync_obj,
+				NULL, NULL);
+			fence_cfg->reason_code = rc;
+			goto out_copy;
+		}
+
+		CAM_DBG(CAM_DMA_FENCE,
+			"dma fence fd = %d imported for sync_obj = %d[%s] num fences [requested: %u processed: %u]",
+			fence_cfg->dma_fence_fd, fence_cfg->sync_obj, fence_cfg->name,
+			fence_input_info->num_fences_requested,
+			fence_input_info->num_fences_processed);
+	}
+
+out_copy:
+	if (copy_to_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_input_info, fence_cmd_args->input_data_size)) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_DMA_FENCE, "copy to user failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+	}
+
+	cam_generic_fence_free_input_info_util(&fence_input_info);
+	return rc;
+}
+
+static int cam_generic_fence_handle_dma_signal(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	struct cam_dma_fence_signal signal_dma_fence;
+
+	if (fence_cmd_args->input_data_size != sizeof(struct cam_dma_fence_signal)) {
+		CAM_ERR(CAM_DMA_FENCE, "Size is invalid expected: 0x%llx actual: 0x%llx",
+			sizeof(struct cam_dma_fence_signal),
+			fence_cmd_args->input_data_size);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&signal_dma_fence, (void __user *)fence_cmd_args->input_handle,
+		fence_cmd_args->input_data_size))
+		return -EFAULT;
+
+	return cam_dma_fence_signal_fd(&signal_dma_fence);
+}
+
+static int cam_generic_fence_process_dma_fence_cmd(
+	uint32_t id,
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int rc = -EINVAL;
+
+	switch (id) {
+	case CAM_GENERIC_FENCE_CREATE:
+		rc = cam_generic_fence_handle_dma_create(fence_cmd_args);
+		break;
+	case CAM_GENERIC_FENCE_RELEASE:
+		rc = cam_generic_fence_handle_dma_release(fence_cmd_args);
+		break;
+	case CAM_GENERIC_FENCE_IMPORT:
+		rc = cam_generic_fence_handle_dma_import(fence_cmd_args);
+		break;
+	case CAM_GENERIC_FENCE_SIGNAL:
+		rc = cam_generic_fence_handle_dma_signal(fence_cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_DMA_FENCE, "IOCTL cmd: %u not supported for dma fence", id);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_sync_synx_core_recovery(
+	enum cam_sync_synx_supported_cores core_id)
+{
+	int rc = -EOPNOTSUPP;
+
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+	rc = cam_synx_core_recovery(core_id);
+#endif
+
+	return rc;
+}
+
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+static int cam_generic_fence_validate_signal_input_info_util(
+	int32_t fence_type,
+	struct cam_generic_fence_cmd_args *fence_cmd_args,
+	struct cam_generic_fence_signal_info **fence_signal_info,
+	void **fence_signal_data)
+{
+	int rc = 0;
+	struct cam_generic_fence_signal_info *signal_info = NULL;
+	void *signal_data;
+	uint32_t num_fences;
+	size_t expected_size;
+
+	*fence_signal_info = NULL;
+	*fence_signal_data = NULL;
+
+	if (fence_cmd_args->input_data_size !=
+		sizeof(struct cam_generic_fence_signal_info)) {
+		CAM_ERR(CAM_SYNC, "Size is invalid expected: 0x%llx actual: 0x%llx",
+			sizeof(struct cam_generic_fence_signal_info),
+			fence_cmd_args->input_data_size);
+		return -EINVAL;
+	}
+
+	signal_info = memdup_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_cmd_args->input_data_size);
+	if (IS_ERR_OR_NULL(signal_info)) {
+		CAM_ERR(CAM_SYNC, "memdup failed for hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+		return -ENOMEM;
+	}
+
+	/* Validate num fences */
+	num_fences = signal_info->num_fences_requested;
+	if ((num_fences == 0) || (num_fences > CAM_GENERIC_FENCE_BATCH_MAX)) {
+		CAM_ERR(CAM_SYNC, "Invalid number of fences: %u for batching",
+			num_fences);
+		rc = -EINVAL;
+		goto free_mem;
+	}
+
+	if (signal_info->fence_handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_SYNC, "Invalid signal handle type: %d",
+			signal_info->fence_handle_type);
+		rc = -EINVAL;
+		goto free_mem;
+	}
+
+	/* Validate sizes */
+	switch (fence_type) {
+	case CAM_GENERIC_FENCE_TYPE_SYNC_OBJ:
+		expected_size = sizeof(struct cam_sync_signal);
+		break;
+	case CAM_GENERIC_FENCE_TYPE_SYNX_OBJ:
+		expected_size = sizeof(struct cam_synx_obj_signal);
+		break;
+	case CAM_GENERIC_FENCE_TYPE_DMA_FENCE:
+		expected_size = sizeof(struct cam_dma_fence_signal);
+		break;
+	default:
+		CAM_ERR(CAM_SYNC, "Unsupported fence type: %u", fence_type);
+		rc = -EINVAL;
+		goto free_mem;
+	}
+
+	if ((signal_info->fence_data_size) != (expected_size * num_fences)) {
+		CAM_ERR(CAM_SYNC, "Invalid input size expected: 0x%x actual: 0x%x for fences: %u",
+			(expected_size * num_fences), signal_info->fence_data_size, num_fences);
+		rc = -EINVAL;
+		goto free_mem;
+	}
+
+	signal_data = memdup_user(u64_to_user_ptr(signal_info->fence_info_hdl),
+		signal_info->fence_data_size);
+	if (IS_ERR_OR_NULL(signal_data)) {
+		CAM_ERR(CAM_SYNC, "memdup failed for hdl: %d size: 0x%x",
+			signal_info->fence_info_hdl, signal_info->fence_data_size);
+		rc = -ENOMEM;
+		goto free_mem;
+	}
+
+	*fence_signal_info = signal_info;
+	*fence_signal_data = signal_data;
+	return rc;
+
+free_mem:
+	kfree(signal_info);
+	return rc;
+}
+
+static void cam_generic_fence_free_signal_input_info_util(
+	struct cam_generic_fence_signal_info **fence_signal_info,
+	void **fence_signal_data)
+{
+	void *signal_data = *fence_signal_data;
+	struct cam_generic_fence_signal_info *fence_input = *fence_signal_info;
+
+	kfree(signal_data);
+	kfree(fence_input);
+
+	*fence_signal_info = NULL;
+	*fence_signal_data = NULL;
+}
+
+static int cam_generic_fence_config_parse_params(
+	struct cam_generic_fence_config *fence_cfg,
+	int32_t requested_param_mask, int32_t *result)
+{
+	uint32_t index = 0, num_entries;
+
+	if (!result) {
+		CAM_ERR(CAM_SYNC, "Invalid result hdl : %p", result);
+		return -EINVAL;
+	}
+
+	/* Assign to 0 by default */
+	*result = 0;
+
+	if (!fence_cfg->num_valid_params || !requested_param_mask) {
+		CAM_DBG(CAM_SYNC,
+			"No params configured num_valid = %d requested_mask = 0x%x",
+			fence_cfg->num_valid_params, requested_param_mask);
+		return 0;
+	}
+
+	if (!(fence_cfg->valid_param_mask & requested_param_mask)) {
+		CAM_DBG(CAM_SYNC,
+			"Requested parameter not set in additional param mask expecting: 0x%x actual: 0x%x",
+			requested_param_mask, fence_cfg->valid_param_mask);
+		return 0;
+	}
+
+	index = ffs(requested_param_mask) - 1;
+	num_entries = ARRAY_SIZE(fence_cfg->params);
+	if (index >= num_entries) {
+		CAM_DBG(CAM_SYNC,
+			"Obtained index %u from mask: 0x%x num_param_entries: %u, index exceeding max",
+			index, requested_param_mask, num_entries);
+		return 0;
+	}
+
+	*result = fence_cfg->params[index];
+	return 0;
+}
+
+static int cam_generic_fence_handle_synx_create(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int rc, i;
+	int32_t row_idx, fence_flag;
+	struct cam_generic_fence_input_info *fence_input_info = NULL;
+	struct cam_generic_fence_config *fence_cfg = NULL;
+
+	rc = cam_generic_fence_alloc_validate_input_info_util(fence_cmd_args, &fence_input_info);
+	if (rc || !fence_input_info) {
+		CAM_ERR(CAM_SYNX,
+			"Fence input info validation failed rc: %d fence_input_info: %pK",
+			rc, fence_input_info);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fence_input_info->num_fences_requested; i++) {
+		fence_cfg = &fence_input_info->fence_cfg_flex[i];
+		fence_input_info->num_fences_processed++;
+		fence_cfg->reason_code = 0;
+		fence_flag = 0;
+
+		cam_generic_fence_config_parse_params(fence_cfg,
+			CAM_GENERIC_FENCE_CONFIG_FLAG_PARAM_INDEX, &fence_flag);
+
+		rc = cam_synx_obj_create(fence_cfg->name,
+			fence_flag, &fence_cfg->synx_obj, &row_idx);
+		if (rc) {
+			CAM_ERR(CAM_SYNX,
+				"Failed to create synx fence at index: %d rc: %d num fences [requested: %u processed: %u]",
+				i, rc, fence_input_info->num_fences_requested,
+				fence_input_info->num_fences_processed);
+			fence_cfg->reason_code = rc;
+			goto out_copy;
+		}
+
+		CAM_DBG(CAM_SYNX,
+			"Created synx fence @ i: %d synx_obj: %d[%s] num fences [requested: %u processed: %u] ",
+			i, fence_cfg->synx_obj, fence_cfg->name,
+			fence_input_info->num_fences_requested,
+			fence_input_info->num_fences_processed);
+	}
+
+out_copy:
+	if (copy_to_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_input_info, fence_cmd_args->input_data_size)) {
+		CAM_ERR(CAM_SYNX, "copy to user failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+		rc = -EFAULT;
+	}
+
+	cam_generic_fence_free_input_info_util(&fence_input_info);
+	return rc;
+}
+
+static int cam_generic_fence_handle_synx_release(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int rc, i;
+	bool failed = false;
+	struct cam_generic_fence_input_info *fence_input_info = NULL;
+	struct cam_generic_fence_config *fence_cfg = NULL;
+	struct cam_synx_obj_release_params synx_release_params;
+
+	rc = cam_generic_fence_alloc_validate_input_info_util(fence_cmd_args, &fence_input_info);
+	if (rc || !fence_input_info) {
+		CAM_ERR(CAM_SYNX,
+			"Fence input info validation failed rc: %d fence_input_info: %pK",
+			rc, fence_input_info);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fence_input_info->num_fences_requested; i++) {
+		fence_cfg = &fence_input_info->fence_cfg_flex[i];
+		fence_input_info->num_fences_processed++;
+		fence_cfg->reason_code = 0;
+
+		synx_release_params.use_row_idx = false;
+		synx_release_params.u.synx_obj = fence_cfg->synx_obj;
+
+		rc = cam_synx_obj_release(&synx_release_params);
+		if (rc) {
+			CAM_ERR(CAM_SYNX,
+				"Failed to release synx object at index: %d rc: %d num fences [requested: %u processed: %u]",
+				i, rc, fence_input_info->num_fences_requested,
+				fence_input_info->num_fences_processed);
+			fence_cfg->reason_code = rc;
+			/* Continue to release other fences, but mark the call as failed */
+			failed = true;
+			continue;
+		}
+
+		CAM_DBG(CAM_SYNX,
+			"Released synx object @ i: %d handle: %d num fences [requested: %u processed: %u]",
+			i, fence_cfg->synx_obj,
+			fence_input_info->num_fences_requested,
+			fence_input_info->num_fences_processed);
+	}
+
+	if (failed)
+		rc = -ENOMSG;
+
+	if (copy_to_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_input_info, fence_cmd_args->input_data_size)) {
+		CAM_ERR(CAM_SYNX, "copy to user failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+		rc = -EFAULT;
+	}
+
+	cam_generic_fence_free_input_info_util(&fence_input_info);
+	return rc;
+}
+
+static int cam_sync_synx_associate_obj(int32_t sync_obj, uint32_t synx_obj,
+	int32_t synx_obj_row_idx, bool *is_sync_obj_signaled)
+{
+	int rc;
+	struct sync_table_row *row = NULL;
+	struct cam_synx_obj_signal signal_synx_obj;
+
+	rc = cam_sync_check_valid(sync_obj);
+	if (rc)
+		return rc;
+
+	row = sync_dev->sync_table + sync_obj;
+	spin_lock(&sync_dev->row_spinlocks[sync_obj]);
+	if (row->state != CAM_SYNC_STATE_ACTIVE) {
+		signal_synx_obj.status = row->state;
+		signal_synx_obj.synx_obj = synx_obj;
+		*is_sync_obj_signaled = true;
+		goto signal_synx;
+	} else {
+		row->synx_obj_info.synx_obj_row_idx = synx_obj_row_idx;
+		row->synx_obj_info.sync_created_with_synx = false;
+		row->synx_obj_info.synx_obj = synx_obj;
+		set_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &row->ext_fence_mask);
+		CAM_DBG(CAM_SYNX, "sync_obj: %s[%d] associated with synx_obj: %d",
+			row->name, sync_obj, row->synx_obj_info.synx_obj);
+	}
+
+	spin_unlock(&sync_dev->row_spinlocks[sync_obj]);
+	return rc;
+
+signal_synx:
+	spin_unlock(&sync_dev->row_spinlocks[sync_obj]);
+	return cam_synx_obj_signal_obj(&signal_synx_obj);
+}
+
+static int cam_generic_fence_handle_synx_import(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int32_t rc, i, synx_obj_row_idx;
+	struct sync_synx_obj_info synx_sync_create;
+	struct cam_generic_fence_input_info *fence_input_info = NULL;
+	struct cam_generic_fence_config *fence_cfg = NULL;
+	bool is_sync_obj_signaled = false;
+	bool is_sync_obj_created = false;
+
+	rc = cam_generic_fence_alloc_validate_input_info_util(fence_cmd_args, &fence_input_info);
+	if (rc || !fence_input_info) {
+		CAM_ERR(CAM_SYNX,
+			"Fence input info validation failed rc: %d fence_input_info: %pK",
+			rc, fence_input_info);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fence_input_info->num_fences_requested; i++) {
+		fence_cfg = &fence_input_info->fence_cfg_flex[i];
+		fence_input_info->num_fences_processed++;
+		fence_cfg->reason_code = 0;
+		is_sync_obj_signaled = false;
+		is_sync_obj_created = false;
+
+		/* Check if synx handle is for a valid synx obj */
+		rc = cam_synx_obj_find_obj_in_table(fence_cfg->synx_obj,
+			&synx_obj_row_idx);
+		if (rc) {
+			CAM_ERR(CAM_SYNX,
+				"Invalid synx obj for handle: %d", fence_cfg->synx_obj);
+			fence_cfg->reason_code = -EINVAL;
+			goto out_copy;
+		}
+
+		if ((fence_cfg->sync_obj > 0) && (fence_cfg->sync_obj < CAM_SYNC_MAX_OBJS)) {
+			/* Associate synx object with existing sync object */
+			rc = cam_sync_synx_associate_obj(fence_cfg->sync_obj,
+				fence_cfg->synx_obj, synx_obj_row_idx,
+				&is_sync_obj_signaled);
+		} else {
+			/* Create new sync object and associate synx object */
+			synx_sync_create.sync_created_with_synx = false;
+			synx_sync_create.synx_obj = fence_cfg->synx_obj;
+			synx_sync_create.synx_obj_row_idx = synx_obj_row_idx;
+
+			rc = cam_sync_create_util(&fence_cfg->sync_obj, fence_cfg->name,
+				NULL, &synx_sync_create);
+			is_sync_obj_created = true;
+		}
+
+		if (rc) {
+			fence_cfg->reason_code = rc;
+			goto out_copy;
+		}
+
+		if (!is_sync_obj_signaled) {
+			/* Register a cb for synx_obj */
+			rc = cam_synx_obj_register_cb(&fence_cfg->sync_obj,
+				synx_obj_row_idx, cam_sync_synx_obj_cb);
+			if (rc) {
+				CAM_ERR(CAM_SYNX,
+					"Failed to register cb for synx_obj: %d sync_obj: %d rc: %d",
+					fence_cfg->synx_obj, fence_cfg->sync_obj, rc);
+				if (is_sync_obj_created)
+					cam_sync_deinit_object(sync_dev->sync_table,
+						fence_cfg->sync_obj, NULL, NULL);
+				fence_cfg->reason_code = rc;
+				goto out_copy;
+			}
+		}
+
+		CAM_DBG(CAM_SYNX,
+			"synx_obj handle = %d imported for dma fence fd: %d sync_obj = %d[%s] num fences [requested: %u processed: %u]",
+			fence_cfg->synx_obj, fence_cfg->dma_fence_fd,
+			fence_cfg->sync_obj, fence_cfg->name,
+			fence_input_info->num_fences_requested,
+			fence_input_info->num_fences_processed);
+	}
+
+out_copy:
+	if (copy_to_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_input_info, fence_cmd_args->input_data_size)) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_SYNX, "copy to user failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+	}
+
+	cam_generic_fence_free_input_info_util(&fence_input_info);
+	return rc;
+}
+
+static int cam_generic_fence_handle_synx_signal(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int32_t rc, i;
+	struct cam_generic_fence_signal_info *fence_signal_info;
+	struct cam_synx_obj_signal *synx_signal_info;
+
+	rc = cam_generic_fence_validate_signal_input_info_util(
+		CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, fence_cmd_args,
+		&fence_signal_info, (void **)&synx_signal_info);
+	if (rc || !fence_signal_info || !synx_signal_info) {
+		CAM_ERR(CAM_SYNX,
+			"Fence input signal info validation failed rc: %d fence_input_info: %pK synx_signal_info: %pK",
+			rc, fence_signal_info, synx_signal_info);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fence_signal_info->num_fences_requested; i++) {
+		fence_signal_info->num_fences_processed++;
+
+		rc = cam_synx_obj_signal_obj(&synx_signal_info[i]);
+		if (rc) {
+			CAM_ERR(CAM_SYNX,
+				"Failed to signal for synx_obj: %d, rc: %d, status : %d",
+				synx_signal_info[i].synx_obj, rc,
+				synx_signal_info[i].status);
+		}
+
+		synx_signal_info[i].reason_code = rc;
+	}
+
+	if (copy_to_user(u64_to_user_ptr(fence_signal_info->fence_info_hdl), synx_signal_info,
+		fence_signal_info->fence_data_size)) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_SYNX, "copy to user for signal data failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle,
+			(sizeof(struct cam_synx_obj_signal) *
+			fence_signal_info->num_fences_requested));
+		goto end;
+	}
+
+	if (copy_to_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_signal_info, sizeof(struct cam_generic_fence_signal_info))) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_SYNX, "copy to user failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle,
+			sizeof(struct cam_generic_fence_signal_info));
+}
+
+end:
+	cam_generic_fence_free_signal_input_info_util(&fence_signal_info,
+		(void **)&synx_signal_info);
+	return rc;
+}
+
+static int cam_generic_fence_process_synx_obj_cmd(
+	uint32_t id,
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int rc = -EINVAL;
+
+	switch (id) {
+	case CAM_GENERIC_FENCE_CREATE:
+		rc = cam_generic_fence_handle_synx_create(fence_cmd_args);
+		break;
+	case CAM_GENERIC_FENCE_RELEASE:
+		rc = cam_generic_fence_handle_synx_release(fence_cmd_args);
+		break;
+	case CAM_GENERIC_FENCE_IMPORT:
+		rc = cam_generic_fence_handle_synx_import(fence_cmd_args);
+		break;
+	case CAM_GENERIC_FENCE_SIGNAL:
+		rc = cam_generic_fence_handle_synx_signal(fence_cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_SYNX, "IOCTL cmd: %u not supported for synx object", id);
+		break;
+	}
+
+	return rc;
+}
+#endif
+
+static int cam_generic_fence_handle_sync_create(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int rc, i, dma_fence_row_idx;
+	bool dma_fence_created;
+	unsigned long fence_sel_mask;
+	struct cam_dma_fence_release_params release_params;
+	struct cam_dma_fence_create_sync_obj_payload dma_sync_create;
+	struct cam_generic_fence_input_info *fence_input_info = NULL;
+	struct cam_generic_fence_config *fence_cfg = NULL;
+	bool synx_obj_created = false;
+	struct sync_synx_obj_info synx_obj_create;
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+	int32_t fence_flag;
+	int32_t synx_obj_row_idx = 0;
+	struct cam_synx_obj_release_params synx_release_params;
+	struct dma_fence *dma_fence_ptr;
+#endif
+
+	rc = cam_generic_fence_alloc_validate_input_info_util(fence_cmd_args, &fence_input_info);
+	if (rc || !fence_input_info) {
+		CAM_ERR(CAM_SYNC,
+			"Fence input info validation failed rc: %d fence_input_info: %pK",
+			rc, fence_input_info);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fence_input_info->num_fences_requested; i++) {
+		fence_cfg = &fence_input_info->fence_cfg_flex[i];
+		fence_input_info->num_fences_processed++;
+		fence_cfg->reason_code = 0;
+
+		/* Reset flag */
+		dma_fence_created = false;
+		synx_obj_created = false;
+
+		fence_sel_mask = fence_cfg->fence_sel_mask;
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &fence_sel_mask)) {
+			rc = cam_dma_fence_create_fd(&fence_cfg->dma_fence_fd,
+				&dma_fence_row_idx, fence_cfg->name);
+			if (rc) {
+				CAM_ERR(CAM_SYNC,
+				"Failed to create dma fence at index: %d rc: %d num_fences: %u",
+				i, rc, fence_input_info->num_fences_requested);
+				fence_cfg->reason_code = rc;
+				goto out_copy;
+			}
+
+			dma_sync_create.dma_fence_row_idx = dma_fence_row_idx;
+			dma_sync_create.fd = fence_cfg->dma_fence_fd;
+			dma_sync_create.sync_created_with_dma = true;
+			dma_fence_created = true;
+		}
+
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+		/* Create a synx object */
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &fence_sel_mask)) {
+			if (dma_fence_created) {
+				dma_fence_ptr = cam_dma_fence_get_fence_from_fd(
+					dma_sync_create.fd, &dma_fence_row_idx);
+				rc = cam_synx_obj_import_dma_fence(fence_cfg->name,
+					fence_cfg->params[0], dma_fence_ptr,
+					&fence_cfg->synx_obj, &synx_obj_row_idx);
+			} else {
+				cam_generic_fence_config_parse_params(fence_cfg,
+					CAM_GENERIC_FENCE_CONFIG_FLAG_PARAM_INDEX, &fence_flag);
+				rc = cam_synx_obj_create(fence_cfg->name,
+					fence_flag, &fence_cfg->synx_obj,
+					&synx_obj_row_idx);
+			}
+
+			if (rc) {
+				CAM_ERR(CAM_SYNC,
+					"Failed to create/import synx obj at index: %d rc: %d num_fences: %u",
+					i, rc, fence_input_info->num_fences_requested);
+
+				/* Release dma fence */
+				if (dma_fence_created) {
+					release_params.use_row_idx = true;
+					release_params.u.dma_row_idx = dma_fence_row_idx;
+
+					cam_dma_fence_release(&release_params);
+				}
+				/* Release synx obj */
+				if (synx_obj_created) {
+					synx_release_params.use_row_idx = true;
+					synx_release_params.u.synx_row_idx = synx_obj_row_idx;
+
+					cam_synx_obj_release(&synx_release_params);
+				}
+				goto out_copy;
+			}
+
+			synx_obj_create.sync_created_with_synx = true;
+			synx_obj_create.synx_obj = fence_cfg->synx_obj;
+			synx_obj_create.synx_obj_row_idx = synx_obj_row_idx;
+			synx_obj_created = true;
+		}
+#endif
+		rc = cam_sync_create_util(&fence_cfg->sync_obj, fence_cfg->name,
+			(dma_fence_created ? &dma_sync_create : NULL),
+			(synx_obj_created ? &synx_obj_create : NULL));
+		if (rc) {
+			fence_cfg->reason_code = rc;
+
+			CAM_ERR(CAM_SYNC,
+				"Failed to create sync obj at index: %d rc: %d num_fences: %u",
+				i, rc, fence_input_info->num_fences_requested);
+			/* Release dma fence */
+			if (dma_fence_created) {
+				release_params.use_row_idx = true;
+				release_params.u.dma_row_idx = dma_fence_row_idx;
+
+				cam_dma_fence_release(&release_params);
+			}
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+			/* Release synx obj */
+			if (synx_obj_created) {
+				synx_release_params.use_row_idx = true;
+				synx_release_params.u.synx_row_idx = synx_obj_row_idx;
+
+				cam_synx_obj_release(&synx_release_params);
+			}
+#endif
+			goto out_copy;
+		}
+
+		/* Register dma fence cb */
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &fence_sel_mask)) {
+			rc = cam_dma_fence_register_cb(&fence_cfg->sync_obj,
+				&dma_fence_row_idx, cam_sync_dma_fence_cb);
+			if (rc) {
+				CAM_ERR(CAM_SYNC,
+					"Failed to register cb for dma fence fd: %d sync_obj: %d rc: %d",
+					fence_cfg->dma_fence_fd, fence_cfg->sync_obj, rc);
+
+				fence_cfg->reason_code = rc;
+				/* Destroy sync obj */
+				cam_sync_deinit_object(sync_dev->sync_table, fence_cfg->sync_obj,
+					NULL, NULL);
+				/* Release dma fence */
+				if (dma_fence_created) {
+					release_params.use_row_idx = true;
+					release_params.u.dma_row_idx = dma_fence_row_idx;
+
+					cam_dma_fence_release(&release_params);
+				}
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+				/* Release synx obj */
+				if (synx_obj_created) {
+					synx_release_params.use_row_idx = true;
+					synx_release_params.u.synx_row_idx = synx_obj_row_idx;
+
+					cam_synx_obj_release(&synx_release_params);
+				}
+#endif
+				goto out_copy;
+			}
+		}
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+		/* Register synx object callback */
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &fence_sel_mask)) {
+			rc = cam_synx_obj_register_cb(&fence_cfg->sync_obj,
+				synx_obj_row_idx, cam_sync_synx_obj_cb);
+			if (rc) {
+				CAM_ERR(CAM_SYNC,
+					"Failed to register cb for synx_obj: %d sync_obj: %d rc: %d",
+					fence_cfg->synx_obj, fence_cfg->sync_obj, rc);
+
+				fence_cfg->reason_code = rc;
+				/* Destroy sync obj */
+				cam_sync_deinit_object(sync_dev->sync_table, fence_cfg->sync_obj,
+					NULL, NULL);
+				/* Release dma fence */
+				if (dma_fence_created) {
+					release_params.use_row_idx = true;
+					release_params.u.dma_row_idx = dma_fence_row_idx;
+
+					cam_dma_fence_release(&release_params);
+				}
+				/* Release synx obj */
+				if (synx_obj_created) {
+					synx_release_params.use_row_idx = true;
+					synx_release_params.u.synx_row_idx = synx_obj_row_idx;
+
+					cam_synx_obj_release(&synx_release_params);
+				}
+				goto out_copy;
+			}
+		}
+#endif
+
+		CAM_DBG(CAM_SYNC,
+			"Created sync_obj = %d[%s] with fence_sel_mask: 0x%x dma_fence_fd: %d num fences [requested: %u processed: %u]",
+			fence_cfg->sync_obj, fence_cfg->name,
+			fence_cfg->fence_sel_mask, fence_cfg->dma_fence_fd,
+			fence_input_info->num_fences_requested,
+			fence_input_info->num_fences_processed);
+	}
+
+out_copy:
+	if (copy_to_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_input_info, fence_cmd_args->input_data_size)) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_SYNC, "copy to user failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+	}
+
+	cam_generic_fence_free_input_info_util(&fence_input_info);
+	return rc;
+}
+
+static int cam_generic_fence_handle_sync_release(
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	bool failed = false;
+	int rc, i;
+	unsigned long fence_sel_mask;
+	struct cam_sync_check_for_dma_release check_for_dma_release;
+	struct cam_dma_fence_release_params release_params;
+	struct cam_generic_fence_input_info *fence_input_info = NULL;
+	struct cam_generic_fence_config *fence_cfg = NULL;
+	struct cam_sync_check_for_synx_release check_for_synx_release;
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+	struct cam_synx_obj_release_params synx_release_params;
+#endif
+
+	rc = cam_generic_fence_alloc_validate_input_info_util(fence_cmd_args, &fence_input_info);
+	if (rc || !fence_input_info) {
+		CAM_ERR(CAM_SYNC,
+			"Fence input info validation failed rc: %d fence_input_info: %pK",
+			rc, fence_input_info);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fence_input_info->num_fences_requested; i++) {
+		fence_cfg = &fence_input_info->fence_cfg_flex[i];
+		fence_input_info->num_fences_processed++;
+		/* Reset fields */
+		fence_cfg->reason_code = 0;
+		check_for_dma_release.sync_created_with_dma = false;
+		check_for_dma_release.dma_fence_fd = fence_cfg->dma_fence_fd;
+		check_for_synx_release.sync_created_with_synx = false;
+		check_for_synx_release.synx_obj = fence_cfg->synx_obj;
+
+		rc = cam_sync_deinit_object(sync_dev->sync_table, fence_cfg->sync_obj,
+			&check_for_dma_release, &check_for_synx_release);
+		if (rc) {
+			fence_cfg->reason_code = rc;
+			failed = true;
+			CAM_ERR(CAM_SYNC,
+				"Failed to release sync obj at index: %d rc: %d num_fences [requested: %u processed: %u]",
+				i, rc, fence_input_info->num_fences_requested,
+				fence_input_info->num_fences_processed);
+		}
+
+		fence_sel_mask = fence_cfg->fence_sel_mask;
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &fence_sel_mask)) {
+			if (!check_for_dma_release.sync_created_with_dma) {
+				CAM_ERR(CAM_SYNC,
+					"Failed to release dma fence fd: %d with sync_obj: %d, not created together",
+					fence_cfg->dma_fence_fd, fence_cfg->sync_obj);
+				failed = true;
+				fence_cfg->reason_code = -EPERM;
+				continue;
+			}
+
+			release_params.use_row_idx = true;
+			release_params.u.dma_row_idx = check_for_dma_release.dma_fence_row_idx;
+			rc = cam_dma_fence_release(&release_params);
+			if (rc) {
+				CAM_ERR(CAM_SYNC,
+					"Failed to destroy dma fence at index: %d rc: %d num fences [requested: %u processed: %u]",
+					i, rc, fence_input_info->num_fences_requested,
+					fence_input_info->num_fences_processed);
+				fence_cfg->reason_code = rc;
+				failed = true;
+				continue;
+			}
+		}
+
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+		/* Release associated synx obj */
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &fence_sel_mask)) {
+			if (!check_for_synx_release.sync_created_with_synx) {
+				CAM_ERR(CAM_SYNC,
+					"Failed to release synx_obj: %d with sync_obj: %d, not created together",
+					fence_cfg->synx_obj, fence_cfg->sync_obj);
+				failed = true;
+				fence_cfg->reason_code = -EPERM;
+				continue;
+			}
+
+			synx_release_params.use_row_idx = true;
+			synx_release_params.u.synx_row_idx =
+				check_for_synx_release.synx_obj_row_idx;
+			rc = cam_synx_obj_release(&synx_release_params);
+			if (rc) {
+				CAM_ERR(CAM_SYNC,
+					"Failed to destroy synx_obj at index: %d rc: %d num fences [requested: %u processed: %u]",
+					i, rc, fence_input_info->num_fences_requested,
+					fence_input_info->num_fences_processed);
+				fence_cfg->reason_code = rc;
+				failed = true;
+				continue;
+			}
+		}
+#endif
+
+		CAM_DBG(CAM_SYNC,
+			"Released sync_obj = %d[%s] with fence_sel_mask: 0x%x dma_fence_fd: %d synx_obj: %d num fences [requested: %u processed: %u]",
+			fence_cfg->sync_obj, fence_cfg->name,
+			fence_cfg->fence_sel_mask, fence_cfg->dma_fence_fd, fence_cfg->synx_obj,
+			fence_input_info->num_fences_requested,
+			fence_input_info->num_fences_processed);
+	}
+
+	if (failed)
+		rc = -ENOMSG;
+
+	if (copy_to_user(u64_to_user_ptr(fence_cmd_args->input_handle),
+		fence_input_info, fence_cmd_args->input_data_size)) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_SYNC, "copy to user failed hdl: %d size: 0x%x",
+			fence_cmd_args->input_handle, fence_cmd_args->input_data_size);
+	}
+
+	cam_generic_fence_free_input_info_util(&fence_input_info);
+	return rc;
+}
+
+static int cam_generic_fence_process_sync_obj_cmd(
+	uint32_t id,
+	struct cam_generic_fence_cmd_args *fence_cmd_args)
+{
+	int rc = -EINVAL;
+
+	switch (id) {
+	case CAM_GENERIC_FENCE_CREATE:
+		rc = cam_generic_fence_handle_sync_create(fence_cmd_args);
+		break;
+	case CAM_GENERIC_FENCE_RELEASE:
+		rc = cam_generic_fence_handle_sync_release(fence_cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_SYNC, "IOCTL cmd: %u not supported for sync object", id);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_generic_fence_parser(
+	struct cam_private_ioctl_arg *k_ioctl)
+{
+	int rc;
+	struct cam_generic_fence_cmd_args fence_cmd_args;
+
+	if (!k_ioctl->ioctl_ptr) {
+		CAM_ERR(CAM_SYNC, "Invalid args input ptr: %p",
+			k_ioctl->ioctl_ptr);
+		return -EINVAL;
+	}
+
+	if (k_ioctl->size != sizeof(struct cam_generic_fence_cmd_args)) {
+		CAM_ERR(CAM_SYNC, "Size mismatch expected: 0x%llx actual: 0x%llx",
+			sizeof(struct cam_generic_fence_cmd_args), k_ioctl->size);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&fence_cmd_args, u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		sizeof(fence_cmd_args))) {
+		CAM_ERR(CAM_SYNC, "copy from user failed for input ptr: %pK",
+			k_ioctl->ioctl_ptr);
+		return -EFAULT;
+	}
+
+	if (fence_cmd_args.input_handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_SYNC, "Invalid handle type: %u",
+			fence_cmd_args.input_handle_type);
+		return -EINVAL;
+	}
+
+	switch (fence_cmd_args.fence_type) {
+	case CAM_GENERIC_FENCE_TYPE_SYNC_OBJ:
+		rc = cam_generic_fence_process_sync_obj_cmd(k_ioctl->id, &fence_cmd_args);
+		break;
+	case CAM_GENERIC_FENCE_TYPE_DMA_FENCE:
+		rc = cam_generic_fence_process_dma_fence_cmd(k_ioctl->id, &fence_cmd_args);
+		break;
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+	case CAM_GENERIC_FENCE_TYPE_SYNX_OBJ:
+		rc = cam_generic_fence_process_synx_obj_cmd(k_ioctl->id, &fence_cmd_args);
+		break;
+#endif
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_SYNC, "fence type: 0x%x handling not supported",
+			fence_cmd_args.fence_type);
+		break;
+	}
+
+	return rc;
+}
+
+static long cam_sync_dev_ioctl(struct file *filep, void *fh,
+		bool valid_prio, unsigned int cmd, void *arg)
+{
+	int32_t rc;
+	struct sync_device *sync_dev = video_drvdata(filep);
+	struct cam_private_ioctl_arg k_ioctl;
+
+	if (!sync_dev) {
+		CAM_ERR(CAM_SYNC, "sync_dev NULL");
+		return -EINVAL;
+	}
+
+	if (!arg)
+		return -EINVAL;
+
+	if (cmd != CAM_PRIVATE_IOCTL_CMD)
+		return -ENOIOCTLCMD;
+
+	k_ioctl = *(struct cam_private_ioctl_arg *)arg;
+
+	switch (k_ioctl.id) {
+	case CAM_SYNC_CREATE:
+		rc = cam_sync_handle_create(&k_ioctl);
+		break;
+	case CAM_SYNC_DESTROY:
+		rc = cam_sync_handle_destroy(&k_ioctl);
+		break;
+	case CAM_SYNC_REGISTER_PAYLOAD:
+		rc = cam_sync_handle_register_user_payload(
+			&k_ioctl);
+		break;
+	case CAM_SYNC_DEREGISTER_PAYLOAD:
+		rc = cam_sync_handle_deregister_user_payload(
+			&k_ioctl);
+		break;
+	case CAM_SYNC_SIGNAL:
+		rc = cam_sync_handle_signal(&k_ioctl);
+		break;
+	case CAM_SYNC_MERGE:
+		rc = cam_sync_handle_merge(&k_ioctl);
+		break;
+	case CAM_SYNC_WAIT:
+		rc = cam_sync_handle_wait(&k_ioctl);
+		((struct cam_private_ioctl_arg *)arg)->result =
+			k_ioctl.result;
+		break;
+	case CAM_GENERIC_FENCE_CREATE:
+	case CAM_GENERIC_FENCE_RELEASE:
+	case CAM_GENERIC_FENCE_IMPORT:
+	case CAM_GENERIC_FENCE_SIGNAL:
+		rc = cam_generic_fence_parser(&k_ioctl);
+		break;
+	default:
+		rc = -ENOIOCTLCMD;
+	}
+
+	return rc;
+}
+
+static unsigned int cam_sync_poll(struct file *f,
+	struct poll_table_struct *pll_table)
+{
+	int rc = 0;
+	struct v4l2_fh *eventq = f->private_data;
+
+	if (!eventq)
+		return -EINVAL;
+
+	poll_wait(f, &eventq->wait, pll_table);
+
+	if (v4l2_event_pending(eventq))
+		rc = POLLPRI;
+
+	return rc;
+}
+
+static int cam_sync_open(struct file *filep)
+{
+	int rc;
+	struct sync_device *sync_dev = video_drvdata(filep);
+
+	if (!sync_dev) {
+		CAM_ERR(CAM_SYNC, "Sync device NULL");
+		return -ENODEV;
+	}
+
+	mutex_lock(&sync_dev->table_lock);
+	if (sync_dev->open_cnt >= 1) {
+		mutex_unlock(&sync_dev->table_lock);
+		return -EALREADY;
+	}
+
+	rc = v4l2_fh_open(filep);
+	if (!rc) {
+		sync_dev->open_cnt++;
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+		cam_synx_obj_open();
+#endif
+		cam_dma_fence_open();
+		spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
+		sync_dev->cam_sync_eventq = filep->private_data;
+		spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
+	} else {
+		CAM_ERR(CAM_SYNC, "v4l2_fh_open failed : %d", rc);
+	}
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ, &cam_sync_monitor_mask)) {
+		sync_dev->mon_data = kzalloc(
+			sizeof(struct cam_generic_fence_monitor_data *) *
+			CAM_SYNC_MONITOR_TABLE_SIZE, GFP_KERNEL);
+		if (!sync_dev->mon_data) {
+			CAM_WARN(CAM_SYNC, "Failed to allocate memory %d",
+				sizeof(struct cam_generic_fence_monitor_data *) *
+				CAM_SYNC_MONITOR_TABLE_SIZE);
+		}
+	}
+
+	mutex_unlock(&sync_dev->table_lock);
+
+	return rc;
+}
+
+static int cam_sync_close(struct file *filep)
+{
+	int rc = 0, i;
+	struct sync_device *sync_dev = video_drvdata(filep);
+
+	if (!sync_dev) {
+		CAM_ERR(CAM_SYNC, "Sync device NULL");
+		rc = -ENODEV;
+		return rc;
+	}
+
+	mutex_lock(&sync_dev->table_lock);
+	sync_dev->open_cnt--;
+	if (!sync_dev->open_cnt) {
+		for (i = 1; i < CAM_SYNC_MAX_OBJS; i++) {
+			struct sync_table_row *row =
+			sync_dev->sync_table + i;
+
+			/*
+			 * Signal all ACTIVE objects as ERR, but we don't
+			 * care about the return status here apart from logging
+			 * it.
+			 */
+			if (row->state == CAM_SYNC_STATE_ACTIVE) {
+				rc = cam_sync_signal(i,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_COMMON_RELEASE_EVENT);
+				if (rc < 0)
+					CAM_ERR(CAM_SYNC,
+					  "Cleanup signal fail idx:%d", i);
+			}
+		}
+
+		/*
+		 * Flush the work queue to wait for pending signal callbacks to
+		 * finish
+		 */
+		flush_workqueue(sync_dev->work_queue);
+
+		/*
+		 * Now that all callbacks worker threads have finished,
+		 * destroy the sync objects
+		 */
+		for (i = 1; i < CAM_SYNC_MAX_OBJS; i++) {
+			struct sync_table_row *row =
+			sync_dev->sync_table + i;
+
+			if (row->state != CAM_SYNC_STATE_INVALID) {
+				rc = cam_sync_destroy(i);
+				if (rc < 0)
+					CAM_ERR(CAM_SYNC,
+					  "Cleanup destroy fail:idx:%d\n", i);
+			}
+		}
+
+		if (sync_dev->mon_data) {
+			for (i = 0; i < CAM_SYNC_MONITOR_TABLE_SIZE; i++) {
+				kfree(sync_dev->mon_data[i]);
+				sync_dev->mon_data[i] = NULL;
+			}
+		}
+		kfree(sync_dev->mon_data);
+		sync_dev->mon_data = NULL;
+	}
+
+	/* Clean dma fence table */
+	cam_dma_fence_close();
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+	/* Clean synx obj table */
+	cam_synx_obj_close();
+#endif
+	mutex_unlock(&sync_dev->table_lock);
+
+	spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
+	sync_dev->cam_sync_eventq = NULL;
+	spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
+	v4l2_fh_release(filep);
+
+	return rc;
+}
+
+static void cam_sync_event_queue_notify_error(const struct v4l2_event *old,
+	struct v4l2_event *new)
+{
+	if (sync_dev->version == CAM_SYNC_V4L_EVENT_V2) {
+		struct cam_sync_ev_header_v2 *ev_header;
+
+		ev_header = CAM_SYNC_GET_HEADER_PTR_V2((*old));
+		CAM_ERR(CAM_CRM,
+			"Failed to notify event id %d fence %d statue %d reason %u %u %u %u",
+			old->id, ev_header->sync_obj, ev_header->status,
+			ev_header->evt_param[0], ev_header->evt_param[1],
+			ev_header->evt_param[2], ev_header->evt_param[3]);
+
+	} else {
+		struct cam_sync_ev_header *ev_header;
+
+		ev_header = CAM_SYNC_GET_HEADER_PTR((*old));
+		CAM_ERR(CAM_CRM,
+			"Failed to notify event id %d fence %d statue %d",
+			old->id, ev_header->sync_obj, ev_header->status);
+	}
+}
+
+static struct v4l2_subscribed_event_ops cam_sync_v4l2_ops = {
+	.merge = cam_sync_event_queue_notify_error,
+};
+
+int cam_sync_subscribe_event(struct v4l2_fh *fh,
+	const struct v4l2_event_subscription *sub)
+{
+	if (!((sub->type == CAM_SYNC_V4L_EVENT) ||
+	(sub->type == CAM_SYNC_V4L_EVENT_V2))) {
+		CAM_ERR(CAM_SYNC, "Non supported event type 0x%x", sub->type);
+		return -EINVAL;
+	}
+
+	sync_dev->version = sub->type;
+	CAM_DBG(CAM_SYNC, "Sync event verion type 0x%x", sync_dev->version);
+	return v4l2_event_subscribe(fh, sub, CAM_SYNC_MAX_V4L2_EVENTS,
+		&cam_sync_v4l2_ops);
+}
+
+int cam_sync_unsubscribe_event(struct v4l2_fh *fh,
+	const struct v4l2_event_subscription *sub)
+{
+	if (!((sub->type == CAM_SYNC_V4L_EVENT) ||
+	(sub->type == CAM_SYNC_V4L_EVENT_V2))) {
+		CAM_ERR(CAM_SYNC, "Non supported event type 0x%x", sub->type);
+		return -EINVAL;
+	}
+
+	return v4l2_event_unsubscribe(fh, sub);
+}
+
+static const struct v4l2_ioctl_ops g_cam_sync_ioctl_ops = {
+	.vidioc_subscribe_event = cam_sync_subscribe_event,
+	.vidioc_unsubscribe_event = cam_sync_unsubscribe_event,
+	.vidioc_default = cam_sync_dev_ioctl,
+};
+
+static struct v4l2_file_operations cam_sync_v4l2_fops = {
+	.owner = THIS_MODULE,
+	.open  = cam_sync_open,
+	.release = cam_sync_close,
+	.poll = cam_sync_poll,
+	.unlocked_ioctl   = video_ioctl2,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = video_ioctl2,
+#endif
+};
+
+#if IS_REACHABLE(CONFIG_MEDIA_CONTROLLER)
+static int cam_sync_media_controller_init(struct sync_device *sync_dev,
+	struct platform_device *pdev)
+{
+	int rc;
+
+	sync_dev->v4l2_dev.mdev = kzalloc(sizeof(struct media_device),
+		GFP_KERNEL);
+	if (!sync_dev->v4l2_dev.mdev)
+		return -ENOMEM;
+
+	media_device_init(sync_dev->v4l2_dev.mdev);
+	strscpy(sync_dev->v4l2_dev.mdev->model, CAM_SYNC_DEVICE_NAME,
+			sizeof(sync_dev->v4l2_dev.mdev->model));
+	sync_dev->v4l2_dev.mdev->dev = &(pdev->dev);
+
+	rc = media_device_register(sync_dev->v4l2_dev.mdev);
+	if (rc < 0)
+		goto register_fail;
+
+	rc = media_entity_pads_init(&sync_dev->vdev->entity, 0, NULL);
+	if (rc < 0)
+		goto entity_fail;
+
+	return 0;
+
+entity_fail:
+	media_device_unregister(sync_dev->v4l2_dev.mdev);
+register_fail:
+	media_device_cleanup(sync_dev->v4l2_dev.mdev);
+	return rc;
+}
+
+static void cam_sync_media_controller_cleanup(struct sync_device *sync_dev)
+{
+	media_entity_cleanup(&sync_dev->vdev->entity);
+	media_device_unregister(sync_dev->v4l2_dev.mdev);
+	media_device_cleanup(sync_dev->v4l2_dev.mdev);
+	kfree(sync_dev->v4l2_dev.mdev);
+}
+
+static void cam_sync_init_entity(struct sync_device *sync_dev)
+{
+	sync_dev->vdev->entity.function = CAM_SYNC_DEVICE_TYPE;
+	sync_dev->vdev->entity.name =
+				video_device_node_name(sync_dev->vdev);
+}
+#else
+static int cam_sync_media_controller_init(struct sync_device *sync_dev,
+	struct platform_device *pdev)
+{
+	return 0;
+}
+
+static void cam_sync_media_controller_cleanup(struct sync_device *sync_dev)
+{
+}
+
+static void cam_sync_init_entity(struct sync_device *sync_dev)
+{
+}
+#endif
+
+static int cam_sync_create_debugfs(void)
+{
+	int rc;
+	struct dentry *dbgfileptr = NULL;
+	if (!cam_debugfs_available())
+		return 0;
+
+	rc = cam_debugfs_create_subdir("sync", &dbgfileptr);
+	if (rc) {
+		CAM_ERR(CAM_SYNC,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	sync_dev->dentry = dbgfileptr;
+
+	debugfs_create_bool("trigger_cb_without_switch", 0644,
+		sync_dev->dentry, &trigger_cb_without_switch);
+
+	debugfs_create_ulong("cam_sync_monitor_mask", 0644,
+		sync_dev->dentry, &cam_sync_monitor_mask);
+end:
+	return rc;
+}
+
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+int cam_synx_sync_signal(int32_t sync_obj, uint32_t synx_status)
+{
+	int rc;
+	uint32_t sync_status = synx_status;
+
+	switch (synx_status) {
+	case SYNX_STATE_ACTIVE:
+		sync_status = CAM_SYNC_STATE_ACTIVE;
+		break;
+	case SYNX_STATE_SIGNALED_SUCCESS:
+		sync_status = CAM_SYNC_STATE_SIGNALED_SUCCESS;
+		break;
+	case SYNX_STATE_SIGNALED_ERROR:
+		sync_status = CAM_SYNC_STATE_SIGNALED_ERROR;
+		break;
+	case 4: /* SYNX_STATE_SIGNALED_CANCEL: */
+		sync_status = CAM_SYNC_STATE_SIGNALED_CANCEL;
+		break;
+	default:
+		CAM_ERR(CAM_SYNC, "Invalid synx status %d for obj %d",
+			synx_status, sync_obj);
+		sync_status = CAM_SYNC_STATE_SIGNALED_ERROR;
+		break;
+	}
+
+	rc = cam_sync_signal(sync_obj, sync_status, CAM_SYNC_COMMON_EVENT_SYNX);
+	if (rc) {
+		CAM_ERR(CAM_SYNC,
+			"synx signal failed with %d, sync_obj=%d, synx_status=%d, sync_status=%d",
+			sync_obj, synx_status, sync_status, rc);
+	}
+
+	return rc;
+}
+
+int cam_synx_sync_register_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj)
+{
+	return cam_sync_register_callback(cb_func, userdata, sync_obj);
+}
+
+int cam_synx_sync_deregister_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj)
+{
+	return cam_sync_deregister_callback(cb_func, userdata, sync_obj);
+}
+
+static int cam_sync_register_synx_bind_ops(
+	struct synx_register_params *object)
+{
+	int rc;
+
+	rc = synx_register_ops(object);
+	if (rc)
+		CAM_ERR(CAM_SYNC, "synx registration fail with rc=%d", rc);
+
+	return rc;
+}
+
+static void cam_sync_unregister_synx_bind_ops(
+	struct synx_register_params *object)
+{
+	int rc;
+
+	rc = synx_deregister_ops(object);
+	if (rc)
+		CAM_ERR(CAM_SYNC, "sync unregistration fail with %d", rc);
+}
+
+static void cam_sync_configure_synx_obj(struct synx_register_params *object)
+{
+	struct synx_register_params *params = object;
+
+	params->name = CAM_SYNC_NAME;
+	params->type = SYNX_TYPE_CSL;
+	params->ops.register_callback = cam_synx_sync_register_callback;
+	params->ops.deregister_callback = cam_synx_sync_deregister_callback;
+	params->ops.enable_signaling = cam_sync_get_obj_ref;
+	params->ops.signal = cam_synx_sync_signal;
+}
+#endif
+
+static int cam_sync_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc, idx;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	sync_dev = kzalloc(sizeof(*sync_dev), GFP_KERNEL);
+	if (!sync_dev)
+		return -ENOMEM;
+
+	sync_dev->sync_table = vzalloc(sizeof(struct sync_table_row) * CAM_SYNC_MAX_OBJS);
+	if (!sync_dev->sync_table) {
+		CAM_ERR(CAM_SYNC, "Mem Allocation failed for sync table");
+		kfree(sync_dev);
+		return -ENOMEM;
+	}
+
+	mutex_init(&sync_dev->table_lock);
+	spin_lock_init(&sync_dev->cam_sync_eventq_lock);
+
+	for (idx = 0; idx < CAM_SYNC_MAX_OBJS; idx++)
+		spin_lock_init(&sync_dev->row_spinlocks[idx]);
+
+	sync_dev->vdev = video_device_alloc();
+	if (!sync_dev->vdev) {
+		rc = -ENOMEM;
+		goto vdev_fail;
+	}
+
+	rc = cam_sync_media_controller_init(sync_dev, pdev);
+	if (rc < 0)
+		goto mcinit_fail;
+
+	sync_dev->vdev->v4l2_dev = &sync_dev->v4l2_dev;
+
+	rc = v4l2_device_register(&(pdev->dev), sync_dev->vdev->v4l2_dev);
+	if (rc < 0)
+		goto register_fail;
+
+	strscpy(sync_dev->vdev->name, CAM_SYNC_NAME,
+				sizeof(sync_dev->vdev->name));
+	sync_dev->vdev->release  = video_device_release_empty;
+	sync_dev->vdev->fops     = &cam_sync_v4l2_fops;
+	sync_dev->vdev->ioctl_ops = &g_cam_sync_ioctl_ops;
+	sync_dev->vdev->minor     = -1;
+	sync_dev->vdev->device_caps |= V4L2_CAP_VIDEO_CAPTURE;
+	sync_dev->vdev->vfl_type  = VFL_TYPE_VIDEO;
+	rc = video_register_device(sync_dev->vdev, VFL_TYPE_VIDEO, -1);
+	if (rc < 0) {
+		CAM_ERR(CAM_SYNC,
+			"video device registration failure rc = %d, name = %s, device_caps = %d",
+			rc, sync_dev->vdev->name, sync_dev->vdev->device_caps);
+		goto v4l2_fail;
+	}
+
+	cam_sync_init_entity(sync_dev);
+	video_set_drvdata(sync_dev->vdev, sync_dev);
+	bitmap_zero(sync_dev->bitmap, CAM_SYNC_MAX_OBJS);
+
+	/*
+	 * We treat zero as invalid handle, so we will keep the 0th bit set
+	 * always
+	 */
+	set_bit(0, sync_dev->bitmap);
+
+	sync_dev->work_queue = alloc_workqueue(CAM_SYNC_WORKQUEUE_NAME,
+		WQ_HIGHPRI | WQ_UNBOUND, 1);
+
+	if (!sync_dev->work_queue) {
+		CAM_ERR(CAM_SYNC,
+			"Error: high priority work queue creation failed");
+		rc = -ENOMEM;
+		goto v4l2_fail;
+	}
+
+	/* Initialize dma fence driver */
+	rc = cam_dma_fence_driver_init();
+	if (rc) {
+		CAM_ERR(CAM_SYNC,
+			"DMA fence driver initialization failed rc: %d", rc);
+		goto workq_destroy;
+	}
+
+	trigger_cb_without_switch = false;
+	cam_sync_monitor_mask = 0;
+	cam_sync_create_debugfs();
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+	/* Initialize synx obj driver */
+	rc = cam_synx_obj_driver_init();
+	if (rc) {
+		CAM_ERR(CAM_SYNC,
+		"Synx obj driver initialization failed rc: %d", rc);
+		goto dma_driver_deinit;
+	}
+#elif IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+	CAM_DBG(CAM_SYNC, "Registering with synx driver");
+	cam_sync_configure_synx_obj(&sync_dev->params);
+	rc = cam_sync_register_synx_bind_ops(&sync_dev->params);
+	if (rc)
+		goto dma_driver_deinit;
+#endif
+	CAM_DBG(CAM_SYNC, "Component bound successfully");
+	return rc;
+
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX) || IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+dma_driver_deinit:
+	cam_dma_fence_driver_deinit();
+#endif
+workq_destroy:
+	destroy_workqueue(sync_dev->work_queue);
+v4l2_fail:
+	v4l2_device_unregister(sync_dev->vdev->v4l2_dev);
+register_fail:
+	cam_sync_media_controller_cleanup(sync_dev);
+mcinit_fail:
+	video_unregister_device(sync_dev->vdev);
+	video_device_release(sync_dev->vdev);
+vdev_fail:
+	vfree(sync_dev->sync_table);
+	mutex_destroy(&sync_dev->table_lock);
+	kfree(sync_dev);
+	return rc;
+}
+
+static void cam_sync_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+
+	v4l2_device_unregister(sync_dev->vdev->v4l2_dev);
+	cam_sync_media_controller_cleanup(sync_dev);
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+	cam_synx_obj_driver_deinit();
+#elif IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+	cam_sync_unregister_synx_bind_ops(&sync_dev->params);
+#endif
+	video_unregister_device(sync_dev->vdev);
+	video_device_release(sync_dev->vdev);
+	sync_dev->dentry = NULL;
+
+	cam_dma_fence_driver_deinit();
+	for (i = 0; i < CAM_SYNC_MAX_OBJS; i++)
+		spin_lock_init(&sync_dev->row_spinlocks[i]);
+
+	vfree(sync_dev->sync_table);
+	kfree(sync_dev);
+	sync_dev = NULL;
+}
+
+const static struct component_ops cam_sync_component_ops = {
+	.bind = cam_sync_component_bind,
+	.unbind = cam_sync_component_unbind,
+};
+
+static int cam_sync_probe(struct platform_device *pdev)
+{
+	int rc;
+
+	CAM_DBG(CAM_SYNC, "Adding Sync component");
+	rc = component_add(&pdev->dev, &cam_sync_component_ops);
+	if (rc)
+		CAM_ERR(CAM_SYNC, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_sync_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_sync_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_sync_dt_match[] = {
+	{.compatible = "qcom,cam-sync"},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_sync_dt_match);
+
+struct platform_driver cam_sync_driver = {
+	.probe = cam_sync_probe,
+	.remove = cam_sync_remove,
+	.driver = {
+		.name = "cam_sync",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_sync_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_sync_init(void)
+{
+	return platform_driver_register(&cam_sync_driver);
+}
+
+void cam_sync_exit(void)
+{
+	platform_driver_unregister(&cam_sync_driver);
+}
+
+MODULE_DESCRIPTION("Camera sync driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_api.h
@@ -0,0 +1,184 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __CAM_SYNC_API_H__
+#define __CAM_SYNC_API_H__
+
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/completion.h>
+#include <linux/videodev2.h>
+#include <media/cam_sync.h>
+
+#define SYNC_DEBUG_NAME_LEN 63
+typedef void (*sync_callback)(int32_t sync_obj, int status, void *data);
+
+enum cam_sync_synx_supported_cores {
+	CAM_ICP_0_SYNX_CORE = 1,
+	CAM_ICP_1_SYNX_CORE,
+	CAM_INVALID_SYNX_CORE,
+};
+
+/* Kernel APIs */
+
+/**
+ * @brief: Creates a sync object
+ *
+ * The newly created sync obj is assigned to sync_obj.
+ * sync object.
+ *
+ * @param sync_obj : Pointer to int referencing the sync object.
+ * @param name     : Optional parameter associating a name with the sync object for
+ * debug purposes. Only first SYNC_DEBUG_NAME_LEN bytes are accepted,
+ * rest will be ignored.
+ *
+ * @return Status of operation. Zero in case of success.
+ * -EINVAL will be returned if sync_obj is an invalid pointer.
+ * -ENOMEM will be returned if the kernel can't allocate space for
+ * sync object.
+ */
+int cam_sync_create(int32_t *sync_obj, const char *name);
+
+/**
+ * @brief: Registers a callback with a sync object
+ *
+ * @param cb_func  :  Pointer to callback to be registered
+ * @param userdata : Opaque pointer which will be passed back with callback.
+ * @param sync_obj : int referencing the sync object.
+ *
+ * @return Status of operation. Zero in case of success.
+ * -EINVAL will be returned if userdata is invalid.
+ * -ENOMEM will be returned if cb_func is invalid.
+ */
+int cam_sync_register_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj);
+
+/**
+ * @brief: De-registers a callback with a sync object
+ *
+ * @param cb_func  :  Pointer to callback to be de-registered
+ * @param userdata : Opaque pointer which will be passed back with callback.
+ * @param sync_obj : int referencing the sync object.
+ *
+ * @return Status of operation. Zero in case of success.
+ * -EINVAL will be returned if userdata is invalid.
+ * -ENOMEM will be returned if cb_func is invalid.
+ * -ENOENT will be returned if call back not found
+ */
+int cam_sync_deregister_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj);
+
+/**
+ * @brief: Signals a sync object with the status argument.
+ *
+ * This function will signal the sync object referenced by the sync_obj
+ * parameter and when doing so, will trigger callbacks in both user space and
+ * kernel. Callbacks will triggered asynchronously and their order of execution
+ * is not guaranteed. The status parameter will indicate whether the entity
+ * performing the signaling wants to convey an error case or a success case.
+ *
+ * @param sync_obj  : int referencing the sync object.
+ * @param status    : Status of the signaling. Can be either SYNC_SIGNAL_ERROR or
+ * SYNC_SIGNAL_SUCCESS.
+ * @param evt_param : Event parameter
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_signal(int32_t sync_obj, uint32_t status, uint32_t evt_param);
+
+/**
+ * @brief: Merges multiple sync objects
+ *
+ * This function will merge multiple sync objects into a sync group.
+ *
+ * @param sync_obj : pointer to a block of ints to be merged
+ * @param num_objs : Number of ints in the block
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_merge(int32_t *sync_obj, uint32_t num_objs, int32_t *merged_obj);
+
+/**
+ * @brief: get ref count of sync obj
+ *
+ * This function will increment ref count for the sync object, and the ref
+ * count will be decremented when this sync object is signaled.
+ *
+ * @param sync_obj: sync object
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_get_obj_ref(int32_t sync_obj);
+
+/**
+ * @brief: put ref count of sync obj
+ *
+ * This function will decrement ref count for the sync object.
+ *
+ * @param sync_obj: sync object
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_put_obj_ref(int32_t sync_obj);
+
+/**
+ * @brief: Destroys a sync object
+ *
+ * @param sync_obj: int referencing the sync object to be destroyed
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_destroy(int32_t sync_obj);
+
+/**
+ * @brief: Waits for a sync object synchronously
+ *
+ * Does a wait on the sync object identified by sync_obj for a maximum
+ * of timeout_ms milliseconds. Must not be called from interrupt context as
+ * this API can sleep. Should be called from process context only.
+ *
+ * @param sync_obj   : int referencing the sync object to be waited upon
+ * @param timeout_ms : Timeout in ms.
+ *
+ * @return Status of operation. Zero in case of success
+ * -EINVAL if sync object is in bad state or arguments are invalid
+ * -ETIMEDOUT if wait times out
+ */
+int cam_sync_wait(int32_t sync_obj, uint64_t timeout_ms);
+
+/**
+ * @brief: Check if sync object is valid
+ *
+ * @param sync_obj: int referencing the sync object to be checked
+ *
+ * @return Status of operation. Zero in case of success
+ * -EINVAL if sync object is in bad state or arguments are invalid
+ */
+int cam_sync_check_valid(int32_t sync_obj);
+
+/**
+ * @brief: Synx recovery for a given core
+ *
+ * @param core_id: Core ID we want to recover for
+ *
+ * @return Status of operation. Zero in case of success
+ * -EINVAL if core_id is invalid
+ */
+int cam_sync_synx_core_recovery(
+	enum cam_sync_synx_supported_cores core_id);
+
+/**
+ * @brief : API to register SYNC to platform framework.
+ *
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_sync_init(void);
+
+/**
+ * @brief : API to remove SYNC from platform framework.
+ */
+void cam_sync_exit(void);
+#endif /* __CAM_SYNC_API_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_dma_fence.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_dma_fence.c
@@ -0,0 +1,880 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sync_dma_fence.h"
+#include "cam_sync_util.h"
+
+extern unsigned long cam_sync_monitor_mask;
+
+/**
+ * struct cam_dma_fence_row - DMA fence row
+ */
+struct cam_dma_fence_row {
+	char                            name[CAM_DMA_FENCE_NAME_LEN];
+	struct dma_fence               *fence;
+	int32_t                         fd;
+	enum cam_dma_fence_state        state;
+	struct dma_fence_cb             fence_cb;
+	int32_t                         sync_obj;
+	cam_sync_callback_for_dma_fence sync_cb;
+	bool                            cb_registered_for_sync;
+	bool                            ext_dma_fence;
+	bool                            sync_signal_dma;
+};
+
+/**
+ * struct cam_dma_fence_device - DMA fence device
+ */
+struct cam_dma_fence_device {
+	uint64_t dma_fence_context;
+	struct cam_dma_fence_row rows[CAM_DMA_FENCE_MAX_FENCES];
+	spinlock_t row_spinlocks[CAM_DMA_FENCE_MAX_FENCES];
+	struct mutex dev_lock;
+	DECLARE_BITMAP(bitmap, CAM_DMA_FENCE_MAX_FENCES);
+	struct cam_generic_fence_monitor_data **monitor_data;
+};
+
+static atomic64_t g_cam_dma_fence_seq_no;
+static struct cam_dma_fence_device *g_cam_dma_fence_dev;
+
+bool __cam_dma_fence_enable_signaling(
+	struct dma_fence *fence)
+{
+	return true;
+}
+
+const char *__cam_dma_fence_get_driver_name(
+	struct dma_fence *fence)
+{
+	return "Camera DMA fence driver";
+}
+
+void __cam_dma_fence_free(struct dma_fence *fence)
+{
+	CAM_DBG(CAM_DMA_FENCE,
+		"Free memory for dma fence context: %llu seqno: %llu",
+		fence->context, fence->seqno);
+	kfree(fence->lock);
+	kfree(fence);
+}
+
+static struct dma_fence_ops cam_sync_dma_fence_ops = {
+	.enable_signaling = __cam_dma_fence_enable_signaling,
+	.get_driver_name = __cam_dma_fence_get_driver_name,
+	.get_timeline_name = __cam_dma_fence_get_driver_name,
+	.release = __cam_dma_fence_free,
+};
+
+static inline struct cam_generic_fence_monitor_entry *
+	__cam_dma_fence_get_monitor_entries(int idx)
+{
+	struct cam_generic_fence_monitor_data *monitor_data;
+
+	monitor_data = CAM_GENERIC_MONITOR_GET_DATA(g_cam_dma_fence_dev->monitor_data, idx);
+	if (monitor_data->swap_monitor_entries)
+		return monitor_data->prev_monitor_entries;
+	else
+		return monitor_data->monitor_entries;
+}
+
+static inline struct cam_generic_fence_monitor_entry *
+	__cam_dma_fence_get_prev_monitor_entries(int idx)
+{
+	struct cam_generic_fence_monitor_data *monitor_data;
+
+	monitor_data = CAM_GENERIC_MONITOR_GET_DATA(g_cam_dma_fence_dev->monitor_data, idx);
+	if (monitor_data->swap_monitor_entries)
+		return monitor_data->monitor_entries;
+	else
+		return monitor_data->prev_monitor_entries;
+}
+
+static void __cam_dma_fence_print_table(void)
+{
+	int i;
+	struct cam_dma_fence_row *row;
+	struct dma_fence *fence;
+
+	for (i = 0; i < CAM_DMA_FENCE_MAX_FENCES; i++) {
+		spin_lock_bh(&g_cam_dma_fence_dev->row_spinlocks[i]);
+		row = &g_cam_dma_fence_dev->rows[i];
+		fence = row->fence;
+		CAM_INFO(CAM_DMA_FENCE,
+			"Idx: %d seqno: %llu name: %s state: %d",
+			i, fence->seqno, row->name, row->state);
+		spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[i]);
+	}
+}
+
+static int __cam_dma_fence_find_free_idx(uint32_t *idx)
+{
+	int rc = 0;
+	bool bit;
+
+	do {
+		*idx = find_first_zero_bit(g_cam_dma_fence_dev->bitmap, CAM_DMA_FENCE_MAX_FENCES);
+		if (*idx >=  CAM_DMA_FENCE_MAX_FENCES) {
+			rc = -ENOMEM;
+			break;
+		}
+
+		bit = test_and_set_bit(*idx, g_cam_dma_fence_dev->bitmap);
+	} while (bit);
+
+	if (rc) {
+		CAM_ERR(CAM_DMA_FENCE, "No free idx, printing dma fence table......");
+		__cam_dma_fence_print_table();
+	}
+
+	return rc;
+}
+
+static struct dma_fence *__cam_dma_fence_find_fence_in_table(
+	int32_t fd, int32_t *idx)
+{
+	int i;
+	struct dma_fence *fence = NULL;
+	struct cam_dma_fence_row *row = NULL;
+
+	for (i = 0; i < CAM_DMA_FENCE_MAX_FENCES; i++) {
+		spin_lock_bh(&g_cam_dma_fence_dev->row_spinlocks[i]);
+
+		row = &g_cam_dma_fence_dev->rows[i];
+		if ((row->state != CAM_DMA_FENCE_STATE_INVALID) && (row->fd == fd)) {
+			*idx = i;
+			fence = row->fence;
+			spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[i]);
+			break;
+		}
+		spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[i]);
+	}
+
+	return fence;
+}
+
+static void __cam_dma_fence_init_row(const char *name,
+	struct dma_fence *dma_fence, int32_t fd, uint32_t idx,
+	bool ext_dma_fence)
+{
+	struct cam_dma_fence_row *row;
+
+	spin_lock_bh(&g_cam_dma_fence_dev->row_spinlocks[idx]);
+	row = &g_cam_dma_fence_dev->rows[idx];
+	row->fence = dma_fence;
+	row->fd = fd;
+	row->state = CAM_DMA_FENCE_STATE_ACTIVE;
+	row->ext_dma_fence = ext_dma_fence;
+	strscpy(row->name, name, CAM_DMA_FENCE_NAME_LEN);
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &cam_sync_monitor_mask)) {
+		cam_generic_fence_update_monitor_array(idx,
+			&g_cam_dma_fence_dev->dev_lock, g_cam_dma_fence_dev->monitor_data,
+			CAM_FENCE_OP_CREATE);
+	}
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[idx]);
+}
+
+void __cam_dma_fence_signal_cb(
+	struct dma_fence *fence, struct dma_fence_cb *cb)
+{
+	struct cam_dma_fence_signal_sync_obj signal_sync_obj;
+	struct cam_dma_fence_row *dma_fence_row =
+		container_of(cb, struct cam_dma_fence_row, fence_cb);
+	uint32_t idx;
+
+	if (dma_fence_row->state == CAM_DMA_FENCE_STATE_INVALID) {
+		CAM_ERR(CAM_DMA_FENCE, "dma fence seqno: %llu is in invalid state: %d",
+			fence->seqno, dma_fence_row->state);
+		return;
+	}
+
+	/* If this dma fence is signaled by sync obj, skip cb */
+	if (dma_fence_row->sync_signal_dma)
+		return;
+
+	CAM_DBG(CAM_DMA_FENCE, "dma fence seqno: %llu fd: %d signaled, signal sync obj: %d",
+		fence->seqno, dma_fence_row->fd, dma_fence_row->sync_obj);
+	if ((dma_fence_row->cb_registered_for_sync) && (dma_fence_row->sync_cb)) {
+		signal_sync_obj.fd = dma_fence_row->fd;
+
+		/*
+		 * Signal is invoked with the fence lock held,
+		 * lock not needed to query status
+		 */
+		signal_sync_obj.status = dma_fence_get_status_locked(fence);
+		dma_fence_row->state = CAM_DMA_FENCE_STATE_SIGNALED;
+		dma_fence_row->sync_cb(dma_fence_row->sync_obj, &signal_sync_obj);
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE,
+			&cam_sync_monitor_mask)) {
+			__cam_dma_fence_find_fence_in_table(dma_fence_row->fd, &idx);
+			cam_generic_fence_update_monitor_array(idx,
+				&g_cam_dma_fence_dev->dev_lock,
+				g_cam_dma_fence_dev->monitor_data,
+				CAM_FENCE_OP_UNREGISTER_ON_SIGNAL);
+		}
+	}
+}
+
+static void __cam_dma_fence_dump_monitor_array(int dma_row_idx)
+{
+	struct dma_fence *fence;
+	struct cam_generic_fence_monitor_obj_info obj_info;
+	struct cam_dma_fence_row *row;
+
+	if (!g_cam_dma_fence_dev->monitor_data ||
+		!test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &cam_sync_monitor_mask))
+		return;
+
+	if (!CAM_GENERIC_MONITOR_GET_DATA(g_cam_dma_fence_dev->monitor_data,
+		dma_row_idx)->prev_obj_id)
+		return;
+
+	row = &g_cam_dma_fence_dev->rows[dma_row_idx];
+	fence = row->fence;
+
+	obj_info.name = row->name;
+	obj_info.obj_id = row->fd;
+	obj_info.state = row->state;
+	obj_info.ref_cnt = kref_read(&fence->refcount);
+	obj_info.monitor_data = CAM_GENERIC_MONITOR_GET_DATA(
+		g_cam_dma_fence_dev->monitor_data, dma_row_idx);
+	obj_info.fence_type = CAM_GENERIC_FENCE_TYPE_DMA_FENCE;
+	obj_info.sync_id = row->sync_obj;
+	obj_info.monitor_entries =
+		__cam_dma_fence_get_monitor_entries(dma_row_idx);
+	obj_info.prev_monitor_entries =
+		__cam_dma_fence_get_prev_monitor_entries(dma_row_idx);
+	cam_generic_fence_dump_monitor_array(&obj_info);
+}
+
+int cam_dma_fence_get_put_ref(
+	bool get_or_put, int32_t dma_fence_row_idx)
+{
+	struct dma_fence *dma_fence;
+	struct cam_dma_fence_row *row;
+	int rc = 0;
+
+	if ((dma_fence_row_idx < 0) ||
+		(dma_fence_row_idx >= CAM_DMA_FENCE_MAX_FENCES)) {
+		CAM_ERR(CAM_DMA_FENCE, "dma fence idx: %d is invalid",
+			dma_fence_row_idx);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_fence_row_idx]);
+	row = &g_cam_dma_fence_dev->rows[dma_fence_row_idx];
+
+	if (row->state == CAM_DMA_FENCE_STATE_INVALID) {
+		CAM_ERR(CAM_DMA_FENCE,
+			"dma fence at idx: %d is in invalid state: %d",
+			dma_fence_row_idx, row->state);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	dma_fence = row->fence;
+
+	if (get_or_put)
+		dma_fence_get(dma_fence);
+	else
+		dma_fence_put(dma_fence);
+
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_fence_row_idx]);
+
+	CAM_DBG(CAM_DMA_FENCE, "Refcnt: %u after %s for dma fence with seqno: %llu",
+		kref_read(&dma_fence->refcount), (get_or_put ? "getref" : "putref"),
+		dma_fence->seqno);
+
+	return rc;
+
+monitor_dump:
+	__cam_dma_fence_dump_monitor_array(dma_fence_row_idx);
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_fence_row_idx]);
+	return rc;
+}
+
+static struct dma_fence *cam_dma_fence_get_fence_from_sync_file(
+	int32_t fd, int32_t *dma_fence_row_idx)
+{
+	uint32_t idx;
+	struct dma_fence *dma_fence = NULL;
+
+	dma_fence = sync_file_get_fence(fd);
+	if (IS_ERR_OR_NULL(dma_fence)) {
+		CAM_ERR(CAM_DMA_FENCE, "Invalid fd: %d no dma fence found", fd);
+		return ERR_PTR(-EINVAL);
+	}
+
+	if (__cam_dma_fence_find_free_idx(&idx)) {
+		CAM_ERR(CAM_DMA_FENCE, "No free idx");
+		goto end;
+	}
+
+	__cam_dma_fence_init_row(dma_fence->ops->get_driver_name(dma_fence),
+		dma_fence, fd, idx, true);
+	*dma_fence_row_idx = idx;
+	CAM_DBG(CAM_DMA_FENCE,
+		"External dma fence with fd: %d seqno: %llu ref_cnt: %u updated in tbl",
+		fd, dma_fence->seqno, kref_read(&dma_fence->refcount));
+
+	return dma_fence;
+
+end:
+	dma_fence_put(dma_fence);
+	return NULL;
+}
+
+struct dma_fence *cam_dma_fence_get_fence_from_fd(
+	int32_t fd, int32_t *dma_fence_row_idx)
+{
+	struct dma_fence *dma_fence = NULL;
+	struct cam_dma_fence_row *row;
+
+	dma_fence = __cam_dma_fence_find_fence_in_table(fd, dma_fence_row_idx);
+	if (IS_ERR_OR_NULL(dma_fence)) {
+		CAM_WARN(CAM_DMA_FENCE,
+			"dma fence with fd: %d is an external fence, querying sync file",
+			fd);
+		return cam_dma_fence_get_fence_from_sync_file(fd, dma_fence_row_idx);
+	}
+
+	spin_lock_bh(&g_cam_dma_fence_dev->row_spinlocks[*dma_fence_row_idx]);
+	row = &g_cam_dma_fence_dev->rows[*dma_fence_row_idx];
+
+	if (row->state == CAM_DMA_FENCE_STATE_INVALID) {
+		CAM_ERR(CAM_DMA_FENCE,
+			"dma fence at idx: %d is in invalid state: %d",
+			dma_fence_row_idx, row->state);
+		spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[*dma_fence_row_idx]);
+		return ERR_PTR(-EINVAL);
+	}
+
+	dma_fence_get(dma_fence);
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[*dma_fence_row_idx]);
+
+	CAM_DBG(CAM_DMA_FENCE, "dma fence found for fd: %d with seqno: %llu ref_cnt: %u",
+		fd, dma_fence->seqno, kref_read(&dma_fence->refcount));
+
+	return dma_fence;
+}
+
+int cam_dma_fence_register_cb(int32_t *sync_obj, int32_t *dma_fence_idx,
+	cam_sync_callback_for_dma_fence sync_cb)
+{
+	int rc = 0, dma_fence_row_idx;
+	struct cam_dma_fence_row *row = NULL;
+	struct dma_fence *dma_fence = NULL;
+
+	if (!sync_obj || !dma_fence_idx || !sync_cb) {
+		CAM_ERR(CAM_DMA_FENCE,
+			"Invalid args sync_obj: %p dma_fence_idx: %p sync_cb: %p",
+			sync_obj, dma_fence_idx, sync_cb);
+		return -EINVAL;
+	}
+
+	dma_fence_row_idx = *dma_fence_idx;
+	if ((dma_fence_row_idx < 0) ||
+		(dma_fence_row_idx >= CAM_DMA_FENCE_MAX_FENCES)) {
+		CAM_ERR(CAM_DMA_FENCE, "dma fence idx: %d is invalid",
+			dma_fence_row_idx);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_fence_row_idx]);
+	row = &g_cam_dma_fence_dev->rows[dma_fence_row_idx];
+	dma_fence = row->fence;
+
+	if (row->state != CAM_DMA_FENCE_STATE_ACTIVE) {
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(dma_fence_row_idx,
+				&g_cam_dma_fence_dev->dev_lock,
+				g_cam_dma_fence_dev->monitor_data,
+				CAM_FENCE_OP_SKIP_REGISTER_CB);
+		CAM_ERR(CAM_DMA_FENCE,
+			"dma fence at idx: %d fd: %d seqno: %llu is not active, current state: %d",
+			dma_fence_row_idx, row->fd, dma_fence->seqno, row->state);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	/**
+	 * If the cb is already registered, return
+	 * If a fd is closed by userspace without releasing the dma fence, it is
+	 * possible that same fd is returned to a new fence.
+	 */
+	if (row->cb_registered_for_sync) {
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(dma_fence_row_idx,
+				&g_cam_dma_fence_dev->dev_lock, g_cam_dma_fence_dev->monitor_data,
+				CAM_FENCE_OP_ALREADY_REGISTERED_CB);
+
+		CAM_WARN(CAM_DMA_FENCE,
+			"dma fence at idx: %d fd: %d seqno: %llu has already registered a cb for sync: %d - same fd for 2 fences?",
+			dma_fence_row_idx, row->fd, dma_fence->seqno, row->sync_obj);
+		goto monitor_dump;
+	}
+
+	rc = dma_fence_add_callback(row->fence, &row->fence_cb,
+		__cam_dma_fence_signal_cb);
+	if (rc) {
+		CAM_ERR(CAM_DMA_FENCE,
+			"Failed to register cb for dma fence fd: %d seqno: %llu rc: %d",
+			row->fd, dma_fence->seqno, rc);
+		goto monitor_dump;
+	}
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &cam_sync_monitor_mask))
+		cam_generic_fence_update_monitor_array(dma_fence_row_idx,
+			&g_cam_dma_fence_dev->dev_lock, g_cam_dma_fence_dev->monitor_data,
+			CAM_FENCE_OP_REGISTER_CB);
+
+	row->cb_registered_for_sync = true;
+	row->sync_obj = *sync_obj;
+	row->sync_cb = sync_cb;
+
+	CAM_DBG(CAM_DMA_FENCE,
+		"CB successfully registered for dma fence fd: %d seqno: %llu for sync_obj: %d",
+		row->fd, dma_fence->seqno, *sync_obj);
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_fence_row_idx]);
+	return rc;
+
+monitor_dump:
+	__cam_dma_fence_dump_monitor_array(dma_fence_row_idx);
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_fence_row_idx]);
+	return rc;
+}
+
+static int __cam_dma_fence_signal_fence(
+	struct dma_fence *dma_fence,
+	int32_t status)
+{
+	int rc;
+	bool fence_signaled = false;
+
+	spin_lock_bh(dma_fence->lock);
+	fence_signaled = dma_fence_is_signaled_locked(dma_fence);
+	if (fence_signaled) {
+		rc = -EPERM;
+		CAM_DBG(CAM_DMA_FENCE,
+			"dma fence seqno: %llu is already signaled",
+			dma_fence->seqno);
+		goto end;
+	}
+
+	if (status)
+		dma_fence_set_error(dma_fence, status);
+
+	rc = dma_fence_signal_locked(dma_fence);
+
+end:
+	spin_unlock_bh(dma_fence->lock);
+	return rc;
+}
+
+int cam_dma_fence_internal_signal(
+	int32_t dma_fence_row_idx,
+	struct cam_dma_fence_signal *signal_dma_fence)
+{
+	int rc;
+	struct dma_fence *dma_fence = NULL;
+	struct cam_dma_fence_row *row = NULL;
+
+	if ((dma_fence_row_idx < 0) ||
+		(dma_fence_row_idx >= CAM_DMA_FENCE_MAX_FENCES)) {
+		CAM_ERR(CAM_DMA_FENCE, "dma fence idx: %d is invalid",
+			dma_fence_row_idx);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_fence_row_idx]);
+	row = &g_cam_dma_fence_dev->rows[dma_fence_row_idx];
+
+	/* Ensures sync obj cb is not invoked */
+	row->sync_signal_dma = true;
+	dma_fence = row->fence;
+
+	if (IS_ERR_OR_NULL(dma_fence)) {
+		CAM_ERR(CAM_DMA_FENCE, "DMA fence in row: %d is invalid",
+			dma_fence_row_idx);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	if (row->state == CAM_DMA_FENCE_STATE_SIGNALED) {
+		CAM_WARN(CAM_DMA_FENCE,
+			"dma fence fd: %d[seqno: %llu] already in signaled state",
+			signal_dma_fence->dma_fence_fd, dma_fence->seqno);
+		rc = 0;
+		goto monitor_dump;
+	}
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &cam_sync_monitor_mask))
+		cam_generic_fence_update_monitor_array(dma_fence_row_idx,
+			&g_cam_dma_fence_dev->dev_lock, g_cam_dma_fence_dev->monitor_data,
+			CAM_FENCE_OP_SIGNAL);
+
+	if (row->cb_registered_for_sync) {
+		if (!dma_fence_remove_callback(row->fence, &row->fence_cb)) {
+			CAM_ERR(CAM_DMA_FENCE,
+				"Failed to remove cb for dma fence seqno: %llu fd: %d",
+				dma_fence->seqno, row->fd);
+			rc = -EINVAL;
+			goto monitor_dump;
+		}
+	}
+
+	rc = __cam_dma_fence_signal_fence(dma_fence, signal_dma_fence->status);
+	if (rc)
+		CAM_WARN(CAM_DMA_FENCE,
+			"dma fence seqno: %llu fd: %d already signaled rc: %d",
+			dma_fence->seqno, row->fd, rc);
+
+	row->state = CAM_DMA_FENCE_STATE_SIGNALED;
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_fence_row_idx]);
+
+	CAM_DBG(CAM_DMA_FENCE,
+		"dma fence fd: %d[seqno: %llu] signaled with status: %d rc: %d",
+		signal_dma_fence->dma_fence_fd, dma_fence->seqno,
+		signal_dma_fence->status, rc);
+
+	return 0;
+
+monitor_dump:
+	__cam_dma_fence_dump_monitor_array(dma_fence_row_idx);
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_fence_row_idx]);
+	return rc;
+}
+
+int cam_dma_fence_signal_fd(struct cam_dma_fence_signal *signal_dma_fence)
+{
+	uint32_t idx;
+	struct dma_fence *dma_fence = NULL;
+
+	dma_fence = __cam_dma_fence_find_fence_in_table(
+		signal_dma_fence->dma_fence_fd, &idx);
+
+	if (IS_ERR_OR_NULL(dma_fence)) {
+		CAM_ERR(CAM_DMA_FENCE, "Failed to find dma fence for fd: %d",
+			signal_dma_fence->dma_fence_fd);
+		return -EINVAL;
+	}
+
+	return cam_dma_fence_internal_signal(idx, signal_dma_fence);
+}
+
+static int __cam_dma_fence_get_fd(int32_t *row_idx,
+	const char *name)
+{
+	int fd = -1;
+	uint32_t idx;
+	struct dma_fence *dma_fence = NULL;
+	spinlock_t       *dma_fence_lock = NULL;
+	struct sync_file *sync_file = NULL;
+
+	if (__cam_dma_fence_find_free_idx(&idx))
+		goto end;
+
+	dma_fence_lock = kzalloc(sizeof(spinlock_t), GFP_KERNEL);
+	if (!dma_fence_lock)
+		goto free_idx;
+
+	dma_fence = kzalloc(sizeof(struct dma_fence), GFP_KERNEL);
+	if (!dma_fence) {
+		kfree(dma_fence_lock);
+		goto free_idx;
+	}
+
+	spin_lock_init(dma_fence_lock);
+	dma_fence_init(dma_fence, &cam_sync_dma_fence_ops, dma_fence_lock,
+		g_cam_dma_fence_dev->dma_fence_context,
+		atomic64_inc_return(&g_cam_dma_fence_seq_no));
+	fd = get_unused_fd_flags(O_CLOEXEC);
+	if (fd < 0) {
+		CAM_ERR(CAM_DMA_FENCE, "failed to get a unused fd: %d", fd);
+		dma_fence_put(dma_fence);
+		goto free_idx;
+	}
+
+	sync_file = sync_file_create(dma_fence);
+	if (!sync_file) {
+		put_unused_fd(fd);
+		fd = -1;
+		dma_fence_put(dma_fence);
+		goto free_idx;
+	}
+
+	fd_install(fd, sync_file->file);
+
+	*row_idx = idx;
+	__cam_dma_fence_init_row(name, dma_fence, fd, idx, false);
+
+	CAM_DBG(CAM_DMA_FENCE, "Created dma fence fd: %d[%s] seqno: %llu row_idx: %u ref_cnt: %u",
+		fd, name, dma_fence->seqno, idx, kref_read(&dma_fence->refcount));
+
+	return fd;
+
+free_idx:
+	clear_bit(idx, g_cam_dma_fence_dev->bitmap);
+end:
+	return fd;
+}
+
+int cam_dma_fence_create_fd(
+	int32_t *dma_fence_fd, int32_t *dma_fence_row_idx, const char *name)
+{
+	int fd = -1, rc = 0;
+
+	if (!dma_fence_fd || !dma_fence_row_idx) {
+		CAM_ERR(CAM_DMA_FENCE, "Invalid args fd: %pK dma_fence_row_idx: %pK",
+			dma_fence_fd, dma_fence_row_idx);
+		return -EINVAL;
+	}
+
+	fd = __cam_dma_fence_get_fd(dma_fence_row_idx, name);
+	if (fd < 0) {
+		rc = -EBADFD;
+		goto end;
+	}
+
+	*dma_fence_fd = fd;
+
+end:
+	return rc;
+}
+
+void __cam_dma_fence_save_previous_monitor_data(int dma_row_idx)
+{
+	struct cam_generic_fence_monitor_data *row_mon_data;
+	struct cam_dma_fence_row *row;
+
+	if (!g_cam_dma_fence_dev->monitor_data)
+		return;
+
+	row = &g_cam_dma_fence_dev->rows[dma_row_idx];
+	row_mon_data = CAM_GENERIC_MONITOR_GET_DATA(
+	g_cam_dma_fence_dev->monitor_data, dma_row_idx);
+
+	/* save current usage details into prev variables */
+	strscpy(row_mon_data->prev_name, row->name, CAM_DMA_FENCE_NAME_LEN);
+	row_mon_data->prev_obj_id          = row->fd;
+	row_mon_data->prev_sync_id         = row->sync_obj;
+	row_mon_data->prev_state           = row->state;
+	row_mon_data->swap_monitor_entries = !row_mon_data->swap_monitor_entries;
+	row_mon_data->prev_monitor_head    = atomic64_read(&row_mon_data->monitor_head);
+}
+
+static int __cam_dma_fence_release(int32_t dma_row_idx)
+{
+	struct dma_fence *dma_fence = NULL;
+	struct cam_dma_fence_row *row = NULL;
+	int rc;
+
+	spin_lock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_row_idx]);
+	row = &g_cam_dma_fence_dev->rows[dma_row_idx];
+	dma_fence = row->fence;
+
+	if (row->state == CAM_DMA_FENCE_STATE_INVALID) {
+		CAM_ERR(CAM_DMA_FENCE, "Invalid row index: %u, state: %u",
+			dma_row_idx, row->state);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	if (row->state == CAM_DMA_FENCE_STATE_ACTIVE) {
+		CAM_WARN(CAM_DMA_FENCE,
+			"Unsignaled fence being released name: %s seqno: %llu fd: %d",
+			row->name, dma_fence->seqno, row->fd);
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(dma_row_idx,
+				&g_cam_dma_fence_dev->dev_lock,
+				g_cam_dma_fence_dev->monitor_data,
+				CAM_FENCE_OP_SIGNAL);
+	}
+
+	/* Ensure dma fence is signaled prior to release */
+	if (!row->ext_dma_fence) {
+		rc = __cam_dma_fence_signal_fence(dma_fence, -ECANCELED);
+		if ((!rc) && (row->state == CAM_DMA_FENCE_STATE_SIGNALED))
+			CAM_WARN(CAM_DMA_FENCE,
+				"Unsignaled fence being released name: %s seqno: %llu fd: %d, row was marked as signaled",
+				row->name, dma_fence->seqno, row->fd);
+	}
+
+	CAM_DBG(CAM_DMA_FENCE,
+		"Releasing dma fence with fd: %d[%s] row_idx: %u current ref_cnt: %u",
+		row->fd, row->name, dma_row_idx, kref_read(&dma_fence->refcount));
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &cam_sync_monitor_mask)) {
+		/* Update monitor entries & save data before row memset to 0 */
+		cam_generic_fence_update_monitor_array(dma_row_idx,
+			&g_cam_dma_fence_dev->dev_lock, g_cam_dma_fence_dev->monitor_data,
+			CAM_FENCE_OP_DESTROY);
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE_DUMP, &cam_sync_monitor_mask))
+			__cam_dma_fence_dump_monitor_array(dma_row_idx);
+		__cam_dma_fence_save_previous_monitor_data(dma_row_idx);
+	}
+
+	/* putref on dma fence */
+	dma_fence_put(dma_fence);
+
+	/* deinit row */
+	memset(row, 0, sizeof(struct cam_dma_fence_row));
+	clear_bit(dma_row_idx, g_cam_dma_fence_dev->bitmap);
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_row_idx]);
+
+	return 0;
+
+monitor_dump:
+	__cam_dma_fence_dump_monitor_array(dma_row_idx);
+	spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[dma_row_idx]);
+	return rc;
+}
+
+static int __cam_dma_fence_release_fd(int fd)
+{
+	int32_t idx;
+	struct dma_fence *dma_fence = NULL;
+
+	dma_fence = __cam_dma_fence_find_fence_in_table(fd, &idx);
+	if (IS_ERR_OR_NULL(dma_fence)) {
+		CAM_ERR(CAM_DMA_FENCE, "Failed to find dma fence for fd: %d", fd);
+		return -EINVAL;
+	}
+
+	return __cam_dma_fence_release(idx);
+}
+
+static int __cam_dma_fence_release_row(
+	int32_t dma_fence_row_idx)
+{
+	if ((dma_fence_row_idx < 0) ||
+		(dma_fence_row_idx >= CAM_DMA_FENCE_MAX_FENCES)) {
+		CAM_ERR(CAM_DMA_FENCE, "dma fence idx: %d is invalid",
+			dma_fence_row_idx);
+		return -EINVAL;
+	}
+
+	return __cam_dma_fence_release(dma_fence_row_idx);
+}
+
+int cam_dma_fence_release(
+	struct cam_dma_fence_release_params *release_params)
+{
+	if (release_params->use_row_idx)
+		return __cam_dma_fence_release_row(release_params->u.dma_row_idx);
+	else
+		return __cam_dma_fence_release_fd(release_params->u.dma_fence_fd);
+}
+
+void cam_dma_fence_close(void)
+{
+	int i;
+	struct cam_dma_fence_row *row = NULL;
+
+	mutex_lock(&g_cam_dma_fence_dev->dev_lock);
+	for (i = 0; i < CAM_DMA_FENCE_MAX_FENCES; i++) {
+		spin_lock_bh(&g_cam_dma_fence_dev->row_spinlocks[i]);
+
+		row = &g_cam_dma_fence_dev->rows[i];
+		if (row->state != CAM_DMA_FENCE_STATE_INVALID) {
+			CAM_DBG(CAM_DMA_FENCE,
+				"Releasing dma fence seqno: %llu associated with fd: %d[%s] ref_cnt: %u",
+				row->fence->seqno, row->fd, row->name,
+				kref_read(&row->fence->refcount));
+
+			/* If registered for cb, remove cb */
+			if (row->cb_registered_for_sync) {
+				if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE,
+					&cam_sync_monitor_mask))
+					cam_generic_fence_update_monitor_array(i,
+						NULL,
+						g_cam_dma_fence_dev->monitor_data,
+						CAM_FENCE_OP_UNREGISTER_CB);
+				dma_fence_remove_callback(row->fence, &row->fence_cb);
+			}
+
+			/* Signal and put if the dma fence is created from camera */
+			if (!row->ext_dma_fence) {
+				if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE,
+					&cam_sync_monitor_mask))
+					cam_generic_fence_update_monitor_array(i,
+						NULL,
+						g_cam_dma_fence_dev->monitor_data,
+						CAM_FENCE_OP_SIGNAL);
+				__cam_dma_fence_signal_fence(row->fence, -EADV);
+			}
+			dma_fence_put(row->fence);
+			memset(row, 0, sizeof(struct cam_dma_fence_row));
+			clear_bit(i, g_cam_dma_fence_dev->bitmap);
+		}
+		spin_unlock_bh(&g_cam_dma_fence_dev->row_spinlocks[i]);
+	}
+
+	if (g_cam_dma_fence_dev->monitor_data) {
+		for (i = 0; i < CAM_DMA_FENCE_TABLE_SZ; i++) {
+			kfree(g_cam_dma_fence_dev->monitor_data[i]);
+			g_cam_dma_fence_dev->monitor_data[i] = NULL;
+		}
+	}
+	kfree(g_cam_dma_fence_dev->monitor_data);
+	g_cam_dma_fence_dev->monitor_data = NULL;
+
+	mutex_unlock(&g_cam_dma_fence_dev->dev_lock);
+	CAM_DBG(CAM_DMA_FENCE, "Close on Camera DMA fence driver");
+}
+
+void cam_dma_fence_open(void)
+{
+	mutex_lock(&g_cam_dma_fence_dev->dev_lock);
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &cam_sync_monitor_mask)) {
+		g_cam_dma_fence_dev->monitor_data = kzalloc(
+			sizeof(struct cam_generic_fence_monitor_data *) *
+			CAM_DMA_FENCE_TABLE_SZ, GFP_KERNEL);
+		if (!g_cam_dma_fence_dev->monitor_data) {
+			CAM_WARN(CAM_DMA_FENCE, "Failed to allocate memory %d",
+				sizeof(struct cam_generic_fence_monitor_data *) *
+				CAM_DMA_FENCE_TABLE_SZ);
+		}
+	}
+
+	/* DMA fence seqno reset */
+	atomic64_set(&g_cam_dma_fence_seq_no, 0);
+	mutex_unlock(&g_cam_dma_fence_dev->dev_lock);
+	CAM_DBG(CAM_DMA_FENCE, "Camera DMA fence driver opened");
+}
+
+int cam_dma_fence_driver_init(void)
+{
+	int i;
+
+	g_cam_dma_fence_dev = kzalloc(sizeof(struct cam_dma_fence_device), GFP_KERNEL);
+	if (!g_cam_dma_fence_dev)
+		return -ENOMEM;
+
+	mutex_init(&g_cam_dma_fence_dev->dev_lock);
+	for (i = 0; i < CAM_DMA_FENCE_MAX_FENCES; i++)
+		spin_lock_init(&g_cam_dma_fence_dev->row_spinlocks[i]);
+
+	bitmap_zero(g_cam_dma_fence_dev->bitmap, CAM_DMA_FENCE_MAX_FENCES);
+
+	/* zero will be considered an invalid slot */
+	set_bit(0, g_cam_dma_fence_dev->bitmap);
+
+	g_cam_dma_fence_dev->dma_fence_context = dma_fence_context_alloc(1);
+
+	CAM_DBG(CAM_DMA_FENCE, "Camera DMA fence driver initialized");
+	return 0;
+}
+
+void cam_dma_fence_driver_deinit(void)
+{
+	kfree(g_cam_dma_fence_dev);
+	g_cam_dma_fence_dev = NULL;
+	CAM_DBG(CAM_DMA_FENCE, "Camera DMA fence driver deinitialized");
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_dma_fence.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_dma_fence.h
@@ -0,0 +1,179 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __CAM_SYNC_DMA_FENCE_H__
+#define __CAM_SYNC_DMA_FENCE_H__
+
+#include <linux/dma-fence.h>
+#include <linux/spinlock_types.h>
+#include <linux/sync_file.h>
+#include <linux/file.h>
+#include <linux/bitmap.h>
+
+#include "cam_sync.h"
+#include "cam_debug_util.h"
+
+#define CAM_DMA_FENCE_MAX_FENCES  128
+#define CAM_DMA_FENCE_NAME_LEN    128
+#define CAM_DMA_FENCE_TABLE_SZ (CAM_DMA_FENCE_MAX_FENCES / CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ)
+
+/* DMA fence state */
+enum cam_dma_fence_state {
+	CAM_DMA_FENCE_STATE_INVALID,
+	CAM_DMA_FENCE_STATE_ACTIVE,
+	CAM_DMA_FENCE_STATE_SIGNALED,
+};
+
+/**
+ * struct cam_dma_fence_release_params - DMA release payload
+ *                     Based on the flag row_idx or fd is consumed
+ *
+ * @dma_row_idx      : DMA fence row idx
+ * @dma_fence_fd     : DMA fence fd
+ * @use_row_idx      : Use row idx
+ */
+struct cam_dma_fence_release_params {
+	union {
+		int32_t dma_row_idx;
+		int32_t dma_fence_fd;
+	} u;
+	bool use_row_idx;
+};
+
+/**
+ * struct cam_dma_fence_signal_sync_obj - DMA -> sync signal info
+ *                           Payload to signal sync on a dma fence
+ *                           being signaled
+ *
+ * @status                 : DMA fence status
+ * @fd                     : DMA fence fd if any
+ */
+struct cam_dma_fence_signal_sync_obj {
+	int32_t status;
+	int32_t fd;
+};
+
+/* DMA fence callback function type */
+typedef int (*cam_sync_callback_for_dma_fence)(int32_t sync_obj,
+	struct cam_dma_fence_signal_sync_obj *signal_sync_obj);
+
+/**
+ * struct cam_dma_fence_create_sync_obj_payload -
+ *                           Payload to create sync for a dma fence
+ *
+ * @dma_fence_row_idx      : DMA fence row idx
+ * @fd                     : DMA fence fd
+ * @sync_created_with_dma  : Set if dma fence and sync obj are being
+ *                           created in a single IOCTL call
+ */
+struct cam_dma_fence_create_sync_obj_payload {
+	int32_t dma_fence_row_idx;
+	int32_t fd;
+	bool    sync_created_with_dma;
+};
+
+/**
+ * @brief: Signal a dma fence fd [userspace API]
+ *
+ * @param signal_dma_fence: Info on DMA fence to be signaled
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_dma_fence_signal_fd(
+	struct cam_dma_fence_signal *signal_dma_fence);
+
+/**
+ * @brief: Signal a dma fence when sync obj is signaled
+ *
+ * @param dma_fence_row_idx : DMA fence row idx
+ * @param signal_dma_fence  : Info on DMA fence to be signaled
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_dma_fence_internal_signal(int32_t dma_fence_row_idx,
+	struct cam_dma_fence_signal *signal_dma_fence);
+
+/**
+ * @brief: Create a dma fence fd
+ *
+ * @param  name              : DMA fence name, optional param
+ *                             will accommodate names of length
+ *                             CAM_DMA_FENCE_NAME_LEN
+ * @output dma_fence_fd      : DMA fence fd
+ * @output dma_fence_row_idx : Row Idx corresponding to DMA fence in the table
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_dma_fence_create_fd(
+	int32_t *dma_fence_fd, int32_t *dma_fence_row_idx, const char *name);
+
+/**
+ * @brief: Release a dma fence
+ *
+ * @param release_params : dma fence info to be released
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_dma_fence_release(
+	struct cam_dma_fence_release_params *release_params);
+
+/**
+ * @brief: Gets the dma fence from a fd, increments refcnt
+ *
+ * @param  fd                : File descriptor
+ * @output dma_fence_row_idx : Row idx pertaining to this dma fence
+ *
+ * @return Status of operation. Error or valid fence.
+ */
+struct dma_fence *cam_dma_fence_get_fence_from_fd(int32_t fd,
+	int32_t *dma_fence_row_idx);
+
+/**
+ * @brief: DMA fence register cb
+ *
+ * @param sync_obj      : Sync object
+ * @param dma_fence_idx : DMA fence row idx
+ * @param sync_cb       : Sync object callback
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_dma_fence_register_cb(int32_t *sync_obj,
+	int32_t *dma_fence_row_idx, cam_sync_callback_for_dma_fence sync_cb);
+
+/**
+ * @brief: get/put on dma fence
+ *
+ * @get_or_put              : True for get, false for put
+ * @param dma_fence_row_idx : Idx in the dma fence table pertaining to
+ *                            the dma fence on which get/put ref is invoked
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_dma_fence_get_put_ref(bool get_or_put, int32_t dma_fence_row_idx);
+
+/**
+ * @brief: dma fence driver open
+ *
+ */
+void cam_dma_fence_open(void);
+
+/**
+ * @brief: dma fence driver close
+ *
+ */
+void cam_dma_fence_close(void);
+
+/**
+ * @brief: dma fence driver initialize
+ *
+ */
+int cam_dma_fence_driver_init(void);
+
+/**
+ * @brief: dma fence driver deinit
+ *
+ */
+void cam_dma_fence_driver_deinit(void);
+
+#endif /* __CAM_SYNC_DMA_FENCE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_private.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_private.h
@@ -0,0 +1,380 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __CAM_SYNC_PRIVATE_H__
+#define __CAM_SYNC_PRIVATE_H__
+
+#include <linux/bitmap.h>
+#include <linux/videodev2.h>
+#include <linux/workqueue.h>
+#include <linux/interrupt.h>
+#include <linux/debugfs.h>
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include "cam_sync_api.h"
+#include "cam_sync_dma_fence.h"
+
+#if IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+#include "cam_sync_synx.h"
+#endif
+
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX) || IS_ENABLED(CONFIG_TARGET_SYNX_ENABLE)
+#include <synx_api.h>
+#endif
+
+#ifdef CONFIG_CAM_SYNC_DBG
+#define CDBG(fmt, args...) pr_err(fmt, ##args)
+#else
+#define CDBG(fmt, args...) pr_debug(fmt, ##args)
+#endif
+
+#define CAM_SYNC_OBJ_NAME_LEN           64
+#define CAM_SYNC_MAX_OBJS               2048
+#define CAM_GENERIC_FENCE_BATCH_MAX     10
+#define CAM_SYNC_MAX_V4L2_EVENTS        250
+#define CAM_SYNC_DEBUG_FILENAME         "cam_debug"
+#define CAM_SYNC_DEBUG_BASEDIR          "cam"
+#define CAM_SYNC_DEBUG_BUF_SIZE         32
+#define CAM_SYNC_PAYLOAD_WORDS          2
+#define CAM_SYNC_NAME                   "cam_sync"
+#define CAM_SYNC_WORKQUEUE_NAME         "HIPRIO_SYNC_WORK_QUEUE"
+
+#define CAM_SYNC_TYPE_INDV              0
+#define CAM_SYNC_TYPE_GROUP             1
+
+/* Number of monitor table elements */
+#define CAM_SYNC_MONITOR_TABLE_SIZE     16
+/* Number of monitored objects per table entry */
+#define CAM_SYNC_MONITOR_TABLE_ENTRY_SZ (CAM_SYNC_MAX_OBJS / CAM_SYNC_MONITOR_TABLE_SIZE)
+#define CAM_SYNC_MONITOR_MAX_ENTRIES    30
+#define CAM_SYNC_INC_MONITOR_HEAD(head, ret) \
+	div_u64_rem(atomic64_add_return(1, head),\
+	CAM_SYNC_MONITOR_MAX_ENTRIES, (ret))
+#define CAM_SYNC_MONITOR_GET_DATA(idx)  \
+	(sync_dev->mon_data[idx / CAM_SYNC_MONITOR_TABLE_ENTRY_SZ] + \
+	(idx % CAM_SYNC_MONITOR_TABLE_ENTRY_SZ))
+#define CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ CAM_SYNC_MONITOR_TABLE_ENTRY_SZ
+#define CAM_GENERIC_MONITOR_GET_DATA(mon_data, idx) \
+	((mon_data)[idx / CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ] + \
+	(idx % CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ))
+
+/**
+ * Feature is enabled by setting BIT(fence_type), this will trigger the fence
+ * dumps on any error, to explicitly trigger a dump on every fence release
+ * below BIT(fence_type_dump) needs to be used at the same time
+ */
+#define CAM_GENERIC_FENCE_DUMP_ALWAYS   0x10
+#define CAM_GENERIC_FENCE_TYPE_SYNC_OBJ_DUMP \
+	(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ + (CAM_GENERIC_FENCE_DUMP_ALWAYS))
+#define CAM_GENERIC_FENCE_TYPE_DMA_FENCE_DUMP \
+	(CAM_GENERIC_FENCE_TYPE_DMA_FENCE + (CAM_GENERIC_FENCE_DUMP_ALWAYS))
+#define CAM_GENERIC_FENCE_TYPE_SYNX_OBJ_DUMP \
+	(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ + (CAM_GENERIC_FENCE_DUMP_ALWAYS))
+
+/**
+ * enum sync_type - Enum to indicate the type of sync object,
+ * i.e. individual or group.
+ *
+ * @SYNC_TYPE_INDV  : Object is an individual sync object
+ * @SYNC_TYPE_GROUP : Object is a group sync object
+ */
+enum sync_type {
+	SYNC_TYPE_INDV,
+	SYNC_TYPE_GROUP
+};
+
+/**
+ * enum sync_list_clean_type - Enum to indicate the type of list clean action
+ * to be peformed, i.e. specific sync ID or all list sync ids.
+ *
+ * @SYNC_CLEAN_ONE : Specific object to be cleaned in the list
+ * @SYNC_CLEAN_ALL : Clean all objects in the list
+ */
+enum sync_list_clean_type {
+	SYNC_LIST_CLEAN_ONE,
+	SYNC_LIST_CLEAN_ALL
+};
+
+/**
+ * struct sync_parent_info - Single node of information about a parent
+ * of a sync object, usually part of the parents linked list
+ *
+ * @sync_id  : Sync object id of parent
+ * @list     : List member used to append this node to a linked list
+ */
+struct sync_parent_info {
+	int32_t sync_id;
+	struct list_head list;
+};
+
+/**
+ * struct sync_parent_info - Single node of information about a child
+ * of a sync object, usually part of the children linked list
+ *
+ * @sync_id  : Sync object id of child
+ * @list     : List member used to append this node to a linked list
+ */
+struct sync_child_info {
+	int32_t sync_id;
+	struct list_head list;
+};
+
+
+/**
+ * struct sync_callback_info - Single node of information about a kernel
+ * callback registered on a sync object
+ *
+ * @callback_func      : Callback function, registered by client driver
+ * @cb_data            : Callback data, registered by client driver
+ * @status             : Status with which callback will be invoked in client
+ * @sync_obj           : Sync id of the object for which callback is registered
+ * @workq_scheduled_ts : workqueue scheduled timestamp
+ * @cb_dispatch_work   : Work representing the call dispatch
+ * @list               : List member used to append this node to a linked list
+ */
+struct sync_callback_info {
+	sync_callback callback_func;
+	void *cb_data;
+	int status;
+	int32_t sync_obj;
+	ktime_t workq_scheduled_ts;
+	struct work_struct cb_dispatch_work;
+	struct list_head list;
+};
+
+/**
+ * struct sync_user_payload - Single node of information about a user space
+ * payload registered from user space
+ *
+ * @payload_data    : Payload data, opaque to kernel
+ * @list            : List member used to append this node to a linked list
+ */
+struct sync_user_payload {
+	uint64_t payload_data[CAM_SYNC_PAYLOAD_WORDS];
+	struct list_head list;
+};
+
+/**
+ * struct sync_dma_fence_info - DMA fence info associated with this sync obj
+ *
+ * @dma_fence_fd          : DMA fence fd
+ * @dma_fence_row_idx     : Index of the row corresponding to this dma fence
+ *                          in the dma fence table
+ * @sync_created_with_dma : If sync obj and dma fence are created together
+ */
+struct sync_dma_fence_info {
+	int32_t dma_fence_fd;
+	int32_t dma_fence_row_idx;
+	bool    sync_created_with_dma;
+};
+
+/**
+ * enum cam_fence_op - Enum to indicate the type of operation performed
+ *
+ * @CAM_FENCE_OP_CREATE                : Created obj
+ * @CAM_FENCE_OP_REGISTER_CB           : Successful callback registration
+ * @CAM_FENCE_OP_SKIP_REGISTER_CB      : Callback registration skipped
+ * @CAM_FENCE_OP_ALREADY_REGISTERED_CB : Callback already registered
+ * @CAM_FENCE_OP_SIGNAL                : Signaled obj
+ * @CAM_FENCE_OP_UNREGISTER_ON_SIGNAL  : Callback unregistered after signaling
+ * @CAM_FENCE_OP_UNREGISTER_CB         : Callback unregistered
+ * @CAM_FENCE_OP_DESTROY               : Destroyed obj
+ */
+enum cam_fence_op {
+	CAM_FENCE_OP_CREATE,
+	CAM_FENCE_OP_REGISTER_CB,
+	CAM_FENCE_OP_SKIP_REGISTER_CB,
+	CAM_FENCE_OP_ALREADY_REGISTERED_CB,
+	CAM_FENCE_OP_SIGNAL,
+	CAM_FENCE_OP_UNREGISTER_ON_SIGNAL,
+	CAM_FENCE_OP_UNREGISTER_CB,
+	CAM_FENCE_OP_DESTROY,
+};
+
+/**
+ * struct cam_generic_fence_monitor_entry - Single operation sync data
+ *
+ * @timestamp     : Timestamp of op
+ * @op            : Operation id
+ */
+struct cam_generic_fence_monitor_entry {
+	struct timespec64 timestamp;
+	enum cam_fence_op op;
+};
+
+/**
+ * struct cam_generic_fence_monitor_data - All operations data from current &
+ *                          previous use of a fence object
+ *
+ * @monitor_head         : Executed operations count
+ * @prev_name            : Previous name of this fence obj
+ * @prev_type            : Previous type of this fence obj
+ * @prev_obj_id          : Previous handle of this fence obj
+ * @prev_sync_id         : Previous handle of this fence's associated sync obj
+ * @prev_remaining       : Previous count of remaining children that not been
+ *                         signaled
+ * @prev_state           : Previous state (INVALID, ACTIVE, SIGNALED_SUCCESS or
+ *                         SIGNALED_ERROR)
+ * @prev_monitor_head    : Previous executed ops count
+ * @swap_monitor_entries : Flag indicating which entry table should be used
+ *                         as current/previous. Used to avoid copying.
+ * @monitor_entries      : Op info entry table
+ * @prev_monitor_entries : Previous op info entry table
+ */
+struct cam_generic_fence_monitor_data {
+	atomic64_t                        monitor_head;
+	char                              prev_name[CAM_DMA_FENCE_NAME_LEN];
+	enum sync_type                    prev_type;
+	int32_t                           prev_obj_id;
+	int32_t                           prev_sync_id;
+	uint32_t                          prev_remaining;
+	uint32_t                          prev_state;
+	uint64_t                          prev_monitor_head;
+	bool                              swap_monitor_entries;
+	struct cam_generic_fence_monitor_entry monitor_entries[
+		CAM_SYNC_MONITOR_MAX_ENTRIES];
+	struct cam_generic_fence_monitor_entry prev_monitor_entries[
+		CAM_SYNC_MONITOR_MAX_ENTRIES];
+};
+
+/**
+ * struct cam_generic_fence_monitor_obj_info - Single object monitor info
+ *
+ * @name                 : Name of this fence obj
+ * @sync_type            : Type of this fence obj
+ * @obj_id               : Handle of this fence obj
+ * @sync_id              : Handle of this fence's associated sync obj
+ * @state                : Previous state (INVALID, ACTIVE, SIGNALED_SUCCESS or
+ *                         SIGNALED_ERROR)
+ * @remaining            : Count of remaining children that not been signaled
+ * @ref_cnt              : Ref count of the number of usage of the fence.
+ * @fence_type           : Fence type - DMA/Sync/Synx
+ * @monitor_data         : Fence operations data
+ * @monitor_entries      : Op info entry table
+ * @prev_monitor_entries : Previous op info entry table
+ */
+struct cam_generic_fence_monitor_obj_info {
+	char *name;
+	enum sync_type sync_type;
+	int32_t obj_id;
+	int32_t sync_id;
+	uint32_t state;
+	uint32_t remaining;
+	uint32_t ref_cnt;
+	uint32_t fence_type;
+	struct cam_generic_fence_monitor_data *monitor_data;
+	struct cam_generic_fence_monitor_entry *monitor_entries;
+	struct cam_generic_fence_monitor_entry *prev_monitor_entries;
+};
+
+/**
+ * struct sync_synx_obj_info - Synx object info associated with this sync obj
+ *
+ * @synx_obj               : Synx object handle
+ * @synx_obj_row_idx       : Index of the row corresponding to this synx obj
+ *                           in the synx obj table
+ * @sync_created_with_synx : If sync obj and synx obj are created together
+ */
+struct sync_synx_obj_info {
+	uint32_t synx_obj;
+	int32_t  synx_obj_row_idx;
+	bool     sync_created_with_synx;
+};
+
+/**
+ * struct sync_table_row - Single row of information about a sync object, used
+ * for internal book keeping in the sync driver
+ *
+ * @name               : Optional string representation of the sync object
+ * @type               : Type of the sync object (individual or group)
+ * @sync_id            : Integer id representing this sync object
+ * @parents_list       : Linked list of parents of this sync object
+ * @children_list      : Linked list of children of this sync object
+ * @state              : State (INVALID, ACTIVE, SIGNALED_SUCCESS or
+ *                       SIGNALED_ERROR)
+ * @remaining          : Count of remaining children that not been signaled
+ * @signaled           : Completion variable on which block calls will wait
+ * @callback_list      : Linked list of kernel callbacks registered
+ * @user_payload_list  : LInked list of user space payloads registered
+ * @ref_cnt            : ref count of the number of usage of the fence.
+ * @ext_fence_mask     : Mask to indicate associated external fence types
+ * @dma_fence_info     : dma fence info if associated
+ * @synx_obj_info      : synx obj info if associated
+ */
+struct sync_table_row {
+	char name[CAM_SYNC_OBJ_NAME_LEN];
+	enum sync_type type;
+	int32_t sync_id;
+	/* List of parents, which are merged objects */
+	struct list_head parents_list;
+	/* List of children, which constitute the merged object */
+	struct list_head children_list;
+	uint32_t state;
+	uint32_t remaining;
+	struct completion signaled;
+	struct list_head callback_list;
+	struct list_head user_payload_list;
+	atomic_t ref_cnt;
+	unsigned long ext_fence_mask;
+	struct sync_dma_fence_info dma_fence_info;
+	struct sync_synx_obj_info synx_obj_info;
+};
+
+/**
+ * struct cam_signalable_info - Information for a single sync object that is
+ * ready to be signaled
+ *
+ * @sync_obj : Sync object id of signalable object
+ * @status   : Status with which to signal
+ * @list     : List member used to append this node to a linked list
+ */
+struct cam_signalable_info {
+	int32_t sync_obj;
+	uint32_t status;
+	struct list_head list;
+};
+
+/**
+ * struct sync_device - Internal struct to book keep sync driver details
+ *
+ * @vdev            : Video device
+ * @v4l2_dev        : V4L2 device
+ * @sync_table      : Table of all sync objects allocated when driver initializes
+ * @row_spinlocks   : Spinlock array, one for each row in the table
+ * @table_lock      : Mutex used to lock the table
+ * @open_cnt        : Count of file open calls made on the sync driver
+ * @dentry          : Debugfs entry
+ * @work_queue      : Work queue used for dispatching kernel callbacks
+ * @cam_sync_eventq : Event queue used to dispatch user payloads to user space
+ * @bitmap          : Bitmap representation of all sync objects
+ * @mon_data        : Objects monitor data
+ * @params          : Parameters for synx call back registration
+ * @version         : version support
+ */
+struct sync_device {
+	struct video_device *vdev;
+	struct v4l2_device v4l2_dev;
+	struct sync_table_row *sync_table;
+	spinlock_t row_spinlocks[CAM_SYNC_MAX_OBJS];
+	struct mutex table_lock;
+	int open_cnt;
+	struct dentry *dentry;
+	struct workqueue_struct *work_queue;
+	struct v4l2_fh *cam_sync_eventq;
+	spinlock_t cam_sync_eventq_lock;
+	DECLARE_BITMAP(bitmap, CAM_SYNC_MAX_OBJS);
+	struct cam_generic_fence_monitor_data **mon_data;
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+	struct synx_register_params params;
+#endif
+	uint32_t version;
+};
+
+
+#endif /* __CAM_SYNC_PRIVATE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_synx.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_synx.c
@@ -0,0 +1,905 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sync_synx.h"
+#include "cam_sync_util.h"
+
+extern unsigned long cam_sync_monitor_mask;
+
+/**
+ * struct cam_synx_obj_row - Synx obj row
+ */
+struct cam_synx_obj_row {
+	char                            name[CAM_SYNX_OBJ_NAME_LEN];
+	uint32_t                        synx_obj;
+	enum cam_synx_obj_state         state;
+	cam_sync_callback_for_synx_obj  sync_cb;
+	bool                            cb_registered_for_sync;
+	bool                            sync_signal_synx;
+	int32_t                         sync_obj;
+};
+
+/**
+ * struct cam_synx_obj_device - Synx obj device
+ */
+struct cam_synx_obj_device {
+	struct cam_synx_obj_row rows[CAM_SYNX_MAX_OBJS];
+	spinlock_t row_spinlocks[CAM_SYNX_MAX_OBJS];
+	struct synx_session *session_handle;
+	struct mutex dev_lock;
+	DECLARE_BITMAP(bitmap, CAM_SYNX_MAX_OBJS);
+	struct cam_generic_fence_monitor_data **monitor_data;
+};
+
+static struct cam_synx_obj_device *g_cam_synx_obj_dev;
+static char cam_synx_session_name[64] = "Camera_Generic_Synx_Session";
+
+
+static inline struct cam_generic_fence_monitor_entry *
+	__cam_synx_obj_get_monitor_entries(int idx)
+{
+	struct cam_generic_fence_monitor_data *monitor_data;
+
+	monitor_data = CAM_GENERIC_MONITOR_GET_DATA(
+		g_cam_synx_obj_dev->monitor_data, idx);
+	if (monitor_data->swap_monitor_entries)
+		return monitor_data->prev_monitor_entries;
+	else
+		return monitor_data->monitor_entries;
+}
+
+static inline struct cam_generic_fence_monitor_entry *
+	__cam_synx_obj_get_prev_monitor_entries(int idx)
+{
+	struct cam_generic_fence_monitor_data *monitor_data;
+
+	monitor_data = CAM_GENERIC_MONITOR_GET_DATA(
+		g_cam_synx_obj_dev->monitor_data, idx);
+	if (monitor_data->swap_monitor_entries)
+		return monitor_data->monitor_entries;
+	else
+		return monitor_data->prev_monitor_entries;
+}
+
+static int __cam_synx_obj_map_sync_status_util(uint32_t sync_status,
+	uint32_t *out_synx_status)
+{
+	if (!out_synx_status)
+		return -EINVAL;
+
+	switch (sync_status) {
+	case CAM_SYNC_STATE_SIGNALED_SUCCESS:
+		*out_synx_status = SYNX_STATE_SIGNALED_SUCCESS;
+		break;
+	case CAM_SYNC_STATE_SIGNALED_CANCEL:
+	default:
+		*out_synx_status = SYNX_STATE_SIGNALED_CANCEL;
+		break;
+	}
+
+	return 0;
+}
+
+static void __cam_synx_obj_save_previous_monitor_data(int32_t row_idx)
+{
+	struct cam_generic_fence_monitor_data *row_mon_data;
+	struct cam_synx_obj_row *row;
+
+	if (!g_cam_synx_obj_dev->monitor_data)
+		return;
+
+	row = &g_cam_synx_obj_dev->rows[row_idx];
+	row_mon_data = CAM_GENERIC_MONITOR_GET_DATA(
+		g_cam_synx_obj_dev->monitor_data, row_idx);
+
+	/* save current usage details into prev variables */
+	strscpy(row_mon_data->prev_name, row->name, CAM_SYNX_OBJ_NAME_LEN);
+	row_mon_data->prev_obj_id          = row->synx_obj;
+	row_mon_data->prev_sync_id         = row->sync_obj;
+	row_mon_data->prev_state           = row->state;
+	row_mon_data->prev_monitor_head    = atomic64_read(&row_mon_data->monitor_head);
+	row_mon_data->swap_monitor_entries = !row_mon_data->swap_monitor_entries;
+}
+
+static void __cam_synx_obj_dump_monitor_array(int32_t row_idx)
+{
+	struct cam_generic_fence_monitor_obj_info obj_info;
+	struct cam_synx_obj_row *row;
+
+	if (!g_cam_synx_obj_dev->monitor_data ||
+		!test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &cam_sync_monitor_mask))
+		return;
+
+	if (!CAM_GENERIC_MONITOR_GET_DATA(g_cam_synx_obj_dev->monitor_data,
+		row_idx)->prev_obj_id)
+		return;
+
+	row = &g_cam_synx_obj_dev->rows[row_idx];
+
+	obj_info.name = row->name;
+	obj_info.obj_id = row->synx_obj;
+	obj_info.state = row->state;
+	obj_info.monitor_data = CAM_GENERIC_MONITOR_GET_DATA(
+		g_cam_synx_obj_dev->monitor_data, row_idx);
+	obj_info.fence_type = CAM_GENERIC_FENCE_TYPE_SYNX_OBJ;
+	obj_info.sync_id = row->sync_obj;
+	obj_info.monitor_entries =
+		__cam_synx_obj_get_monitor_entries(row_idx);
+	obj_info.prev_monitor_entries =
+		__cam_synx_obj_get_prev_monitor_entries(row_idx);
+	cam_generic_fence_dump_monitor_array(&obj_info);
+}
+
+static void __cam_synx_obj_signal_cb(u32 h_synx, int status, void *data)
+{
+	struct cam_synx_obj_signal_sync_obj signal_sync_obj;
+	struct cam_synx_obj_row *synx_obj_row = NULL;
+	int32_t idx;
+
+	if (!data) {
+		CAM_ERR(CAM_SYNX,
+			"Invalid data passed to synx obj : No callback function set.");
+		return;
+	}
+
+	synx_obj_row = (struct cam_synx_obj_row *)data;
+
+	/* If this synx obj is signaled by sync obj, skip cb */
+	if (synx_obj_row->sync_signal_synx)
+		return;
+
+	if (synx_obj_row->synx_obj != h_synx) {
+		CAM_ERR(CAM_SYNX,
+			"Synx obj: %d callback does not match synx obj: %d in sync table.",
+			h_synx, synx_obj_row->synx_obj);
+		return;
+	}
+
+	if (synx_obj_row->state == CAM_SYNX_OBJ_STATE_INVALID) {
+		CAM_ERR(CAM_SYNX,
+			"Synx obj :%d is in invalid state: %d",
+			synx_obj_row->synx_obj, synx_obj_row->state);
+		return;
+	}
+
+	CAM_DBG(CAM_SYNX, "Synx obj: %d signaled, signal sync obj: %d",
+		 synx_obj_row->synx_obj, synx_obj_row->sync_obj);
+
+	if ((synx_obj_row->cb_registered_for_sync) && (synx_obj_row->sync_cb)) {
+		signal_sync_obj.synx_obj = synx_obj_row->synx_obj;
+		switch (status) {
+		case SYNX_STATE_SIGNALED_SUCCESS:
+			signal_sync_obj.status = CAM_SYNC_STATE_SIGNALED_SUCCESS;
+			break;
+		case SYNX_STATE_SIGNALED_CANCEL:
+			signal_sync_obj.status = CAM_SYNC_STATE_SIGNALED_CANCEL;
+			break;
+		default:
+			CAM_WARN(CAM_SYNX,
+				"Synx signal status %d is neither SUCCESS nor CANCEL, custom code?",
+				status);
+			signal_sync_obj.status = CAM_SYNC_STATE_SIGNALED_ERROR;
+			break;
+		}
+		synx_obj_row->state = CAM_SYNX_OBJ_STATE_SIGNALED;
+		synx_obj_row->sync_cb(synx_obj_row->sync_obj, &signal_sync_obj);
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ,
+			&cam_sync_monitor_mask)) {
+			cam_synx_obj_find_obj_in_table(synx_obj_row->synx_obj, &idx);
+			cam_generic_fence_update_monitor_array(idx,
+				&g_cam_synx_obj_dev->dev_lock, g_cam_synx_obj_dev->monitor_data,
+				CAM_FENCE_OP_UNREGISTER_ON_SIGNAL);
+		}
+	}
+
+}
+
+/*
+ * Synx APIs need to be invoked in non atomic context,
+ * all these utils invoke synx driver
+ */
+static inline int __cam_synx_signal_util(
+	uint32_t synx_hdl, uint32_t signal_status)
+{
+	return synx_signal(g_cam_synx_obj_dev->session_handle, synx_hdl, signal_status);
+}
+
+static inline int __cam_synx_deregister_cb_util(
+	uint32_t synx_hdl, void *data)
+{
+	struct synx_callback_params cb_params;
+
+	cb_params.userdata = data;
+	cb_params.cancel_cb_func = NULL;
+	cb_params.h_synx = synx_hdl;
+	cb_params.cb_func = __cam_synx_obj_signal_cb;
+
+	return synx_cancel_async_wait(g_cam_synx_obj_dev->session_handle, &cb_params);
+}
+
+static inline int __cam_synx_create_hdl_util(
+	struct synx_create_params *params)
+{
+	return synx_create(g_cam_synx_obj_dev->session_handle, params);
+}
+
+static inline int __cam_synx_release_hdl_util(uint32_t synx_hdl)
+{
+	return synx_release(g_cam_synx_obj_dev->session_handle, synx_hdl);
+}
+
+static inline int __cam_synx_import_hdl_util(
+	struct synx_import_params *params)
+{
+	return synx_import(g_cam_synx_obj_dev->session_handle, params);
+}
+
+static inline int __cam_synx_register_cb_util(
+	struct synx_callback_params *cb_params)
+{
+	return synx_async_wait(g_cam_synx_obj_dev->session_handle, cb_params);
+}
+
+static int __cam_synx_obj_release(int32_t row_idx)
+{
+	int rc;
+	bool deregister_cb = false;
+	uint32_t synx_hdl = 0;
+	struct cam_synx_obj_row *row = NULL;
+
+	spin_lock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+	row = &g_cam_synx_obj_dev->rows[row_idx];
+	synx_hdl = row->synx_obj;
+
+	if (row->state == CAM_SYNX_OBJ_STATE_ACTIVE) {
+		CAM_DBG(CAM_SYNX,
+			"Unsignaled synx obj being released name: %s synx_obj:%d",
+			row->name, row->synx_obj);
+
+		if (row->cb_registered_for_sync) {
+			if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &cam_sync_monitor_mask))
+				cam_generic_fence_update_monitor_array(row_idx,
+					&g_cam_synx_obj_dev->dev_lock,
+					g_cam_synx_obj_dev->monitor_data,
+					CAM_FENCE_OP_UNREGISTER_ON_SIGNAL);
+			deregister_cb = true;
+		}
+
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(row_idx,
+				&g_cam_synx_obj_dev->dev_lock, g_cam_synx_obj_dev->monitor_data,
+				CAM_FENCE_OP_SIGNAL);
+
+		if (deregister_cb) {
+			spin_unlock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+			rc = __cam_synx_deregister_cb_util(synx_hdl, row);
+			spin_lock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+			if (rc) {
+				CAM_DBG(CAM_SYNX,
+					"Failed to deregister cb for synx hdl: %u rc: %d",
+					synx_hdl, rc);
+				__cam_synx_obj_dump_monitor_array(row_idx);
+			}
+		}
+	}
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &cam_sync_monitor_mask)) {
+		/* Update monitor entries & save data before row memset to 0 */
+		cam_generic_fence_update_monitor_array(row_idx,
+			&g_cam_synx_obj_dev->dev_lock, g_cam_synx_obj_dev->monitor_data,
+			CAM_FENCE_OP_DESTROY);
+
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ_DUMP, &cam_sync_monitor_mask))
+			__cam_synx_obj_dump_monitor_array(row_idx);
+		__cam_synx_obj_save_previous_monitor_data(row_idx);
+	}
+
+	CAM_DBG(CAM_SYNX,
+		"Releasing synx_obj: %d[%s] row_idx: %u", row->synx_obj, row->name, row_idx);
+
+	/* deinit row */
+	memset(row, 0, sizeof(struct cam_synx_obj_row));
+	clear_bit(row_idx, g_cam_synx_obj_dev->bitmap);
+	spin_unlock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+
+	return __cam_synx_release_hdl_util(synx_hdl);
+}
+
+static int __cam_synx_obj_find_free_idx(uint32_t *idx)
+{
+	int rc = 0;
+	bool bit;
+
+	do {
+		*idx = find_first_zero_bit(g_cam_synx_obj_dev->bitmap, CAM_SYNX_MAX_OBJS);
+		if (*idx >= CAM_SYNX_MAX_OBJS) {
+			CAM_ERR(CAM_SYNC,
+				"Error: Unable to create synx, no free index");
+			rc = -ENOMEM;
+			break;
+		}
+
+		bit = test_and_set_bit(*idx, g_cam_synx_obj_dev->bitmap);
+	} while (bit);
+
+	return rc;
+}
+
+static void __cam_synx_obj_init_row(uint32_t idx, const char *name,
+	uint32_t synx_obj)
+{
+	struct cam_synx_obj_row *row;
+
+	spin_lock_bh(&g_cam_synx_obj_dev->row_spinlocks[idx]);
+	row = &g_cam_synx_obj_dev->rows[idx];
+	row->synx_obj = synx_obj;
+	row->state = CAM_SYNX_OBJ_STATE_ACTIVE;
+	strscpy(row->name, name, CAM_SYNX_OBJ_NAME_LEN);
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &cam_sync_monitor_mask)) {
+		cam_generic_fence_update_monitor_array(idx,
+			&g_cam_synx_obj_dev->dev_lock, g_cam_synx_obj_dev->monitor_data,
+			CAM_FENCE_OP_CREATE);
+	}
+	spin_unlock_bh(&g_cam_synx_obj_dev->row_spinlocks[idx]);
+}
+
+static int __cam_synx_obj_release_row(int32_t row_idx)
+{
+	if ((row_idx < 0) || (row_idx >= CAM_SYNX_MAX_OBJS)) {
+		CAM_ERR(CAM_SYNX, "synx row idx: %d is invalid", row_idx);
+		return -EINVAL;
+	}
+
+	return __cam_synx_obj_release(row_idx);
+}
+
+int cam_synx_obj_find_obj_in_table(uint32_t synx_obj, int32_t *idx)
+{
+	int i, rc = -EINVAL;
+	struct cam_synx_obj_row *row = NULL;
+
+	for (i = 0; i < CAM_SYNX_MAX_OBJS; i++) {
+		spin_lock_bh(&g_cam_synx_obj_dev->row_spinlocks[i]);
+		row = &g_cam_synx_obj_dev->rows[i];
+		if ((row->state != CAM_SYNX_OBJ_STATE_INVALID) &&
+			(row->synx_obj == synx_obj)) {
+			*idx = i;
+			spin_unlock_bh(&g_cam_synx_obj_dev->row_spinlocks[i]);
+			rc = 0;
+			break;
+		}
+		spin_unlock_bh(&g_cam_synx_obj_dev->row_spinlocks[i]);
+	}
+
+	return rc;
+}
+
+static int __cam_synx_obj_release_obj(uint32_t synx_obj, int32_t *idx)
+{
+	if (cam_synx_obj_find_obj_in_table(synx_obj, idx)) {
+		CAM_ERR(CAM_SYNX, "Failed to find synx obj: %d", synx_obj);
+		return -EINVAL;
+	}
+
+	return __cam_synx_obj_release(*idx);
+}
+
+static int __cam_synx_obj_import(const char *name,
+	struct synx_import_params *params, int32_t *row_idx)
+{
+	int rc = -1;
+	uint32_t idx;
+
+	if (__cam_synx_obj_find_free_idx(&idx))
+		goto end;
+
+	rc = __cam_synx_import_hdl_util(params);
+	if (rc) {
+		CAM_ERR(CAM_SYNX, "Synx import failed for fence : %p",
+			params->indv.fence);
+		goto free_idx;
+	}
+
+	*row_idx = idx;
+	__cam_synx_obj_init_row(idx, name, *params->indv.new_h_synx);
+
+	CAM_DBG(CAM_SYNX, "Imported synx obj handle: %d[%s] row_idx: %u",
+		*params->indv.new_h_synx, name, idx);
+
+	return rc;
+
+free_idx:
+	clear_bit(idx, g_cam_synx_obj_dev->bitmap);
+end:
+	return rc;
+}
+
+static int __cam_synx_map_generic_flags_to_create(uint32_t generic_flags,
+	struct synx_create_params *params)
+{
+	if (!params) {
+		CAM_ERR(CAM_SYNX, "Create parameters missing");
+		return -EINVAL;
+	}
+
+	/*
+	 * Create Global Always - remove after userspace optimizes and
+	 * determines when global Vs local is needed
+	 */
+	params->flags |= SYNX_CREATE_GLOBAL_FENCE;
+
+	return 0;
+}
+
+static int __cam_synx_map_generic_flags_to_import(uint32_t generic_flags,
+	struct synx_import_indv_params *params)
+{
+	if (!params) {
+		CAM_ERR(CAM_SYNX, "Import parameters missing");
+		return -EINVAL;
+	}
+
+	/*
+	 * Create Global Always - remove after userspace optimizes and
+	 * determines when global Vs local is needed
+	 */
+	params->flags |= SYNX_IMPORT_GLOBAL_FENCE;
+
+	return 0;
+}
+
+int cam_synx_obj_create(const char *name, uint32_t flags, uint32_t *synx_obj,
+	int32_t *row_idx)
+{
+	int rc = -1;
+	uint32_t idx;
+	struct synx_create_params params;
+
+	if (__cam_synx_obj_find_free_idx(&idx))
+		goto end;
+
+	params.fence = NULL;
+	params.name = name;
+	params.flags = 0;
+	params.h_synx = synx_obj;
+
+	rc = __cam_synx_map_generic_flags_to_create(flags, &params);
+	if (rc) {
+		CAM_ERR(CAM_SYNX, "Failed to generate create flags");
+		goto free_idx;
+	}
+
+	rc = __cam_synx_create_hdl_util(&params);
+	if (rc) {
+		CAM_ERR(CAM_SYNX, "Failed to create new synx handle rc: %d", rc);
+		goto free_idx;
+	}
+
+	*row_idx = idx;
+	__cam_synx_obj_init_row(idx, name, *synx_obj);
+
+	CAM_DBG(CAM_SYNX, "Created synx obj handle: %d[%s] row_idx: %u",
+		*synx_obj, name, idx);
+
+	return rc;
+
+free_idx:
+	clear_bit(idx, g_cam_synx_obj_dev->bitmap);
+end:
+	return rc;
+}
+
+int cam_synx_obj_import_dma_fence(const char *name, uint32_t flags, void *fence,
+	uint32_t *synx_obj, int32_t *row_idx)
+{
+	struct synx_import_params params;
+
+	if (!fence) {
+		CAM_ERR(CAM_SYNX,
+			"Importing DMA fence failed - fence pointer is NULL");
+		return -EINVAL;
+	}
+
+	params.indv.flags = 0;
+	params.indv.fence = fence;
+	params.indv.new_h_synx = synx_obj;
+	params.type = SYNX_IMPORT_INDV_PARAMS;
+	params.indv.flags |= SYNX_IMPORT_DMA_FENCE;
+
+	if (__cam_synx_map_generic_flags_to_import(flags, &params.indv)) {
+		CAM_ERR(CAM_SYNX,
+			"Importing DMA fence failed - invalid synx import flags");
+		return -EINVAL;
+	}
+
+	return __cam_synx_obj_import(name, &params, row_idx);
+}
+
+int cam_synx_obj_internal_signal(int32_t row_idx,
+	struct cam_synx_obj_signal *signal_synx_obj)
+{
+	int rc;
+	uint32_t signal_status;
+	bool deregister_cb = false;
+	struct cam_synx_obj_row *row = NULL;
+
+	if ((row_idx < 0) || (row_idx >= CAM_SYNX_MAX_OBJS)) {
+		CAM_ERR(CAM_SYNX, "synx obj row idx: %d is invalid",
+			row_idx);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+	row = &g_cam_synx_obj_dev->rows[row_idx];
+
+	/* Ensures sync obj cb is not invoked */
+	row->sync_signal_synx = true;
+
+	if (row->state != CAM_SYNX_OBJ_STATE_ACTIVE) {
+		CAM_ERR(CAM_SYNX, "synx obj: %u not in right state: %d to signal",
+			signal_synx_obj->synx_obj, row->state);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	if (row->synx_obj != signal_synx_obj->synx_obj) {
+		CAM_WARN(CAM_SYNX,
+			"Trying to signal synx obj: %u in row: %u having a different synx obj: %u",
+			signal_synx_obj->synx_obj, row_idx, row->synx_obj);
+		rc = 0;
+		goto monitor_dump;
+	}
+
+	rc = __cam_synx_obj_map_sync_status_util(signal_synx_obj->status, &signal_status);
+	if (rc) {
+		CAM_WARN(CAM_SYNX,
+			"Signaling undefined status: %d for synx obj: %d",
+			signal_synx_obj->status, signal_synx_obj->synx_obj);
+	}
+
+	if (row->cb_registered_for_sync) {
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(row_idx,
+				&g_cam_synx_obj_dev->dev_lock, g_cam_synx_obj_dev->monitor_data,
+				CAM_FENCE_OP_UNREGISTER_ON_SIGNAL);
+		deregister_cb = true;
+	}
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &cam_sync_monitor_mask))
+		cam_generic_fence_update_monitor_array(row_idx,
+			&g_cam_synx_obj_dev->dev_lock, g_cam_synx_obj_dev->monitor_data,
+			CAM_FENCE_OP_SIGNAL);
+
+	row->state = CAM_SYNX_OBJ_STATE_SIGNALED;
+	spin_unlock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+
+	if (deregister_cb) {
+		rc = __cam_synx_deregister_cb_util(signal_synx_obj->synx_obj, row);
+		if (rc) {
+			spin_lock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+			CAM_ERR(CAM_SYNX, "Failed to deregister cb for synx: %u rc: %d",
+				signal_synx_obj->synx_obj, rc);
+			goto monitor_dump;
+		}
+	}
+
+	rc = __cam_synx_signal_util(signal_synx_obj->synx_obj, signal_status);
+	if (rc) {
+		CAM_ERR(CAM_SYNX, "Failed to signal synx hdl: %u with status: %u rc: %d",
+			signal_synx_obj->synx_obj, signal_status, rc);
+		goto end;
+	}
+
+	CAM_DBG(CAM_SYNX, "synx obj: %d signaled with status: %d rc: %d",
+		signal_synx_obj->synx_obj, signal_status, rc);
+
+	return rc;
+
+monitor_dump:
+	__cam_synx_obj_dump_monitor_array(row_idx);
+	spin_unlock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+end:
+	return rc;
+}
+
+int cam_synx_obj_release(struct cam_synx_obj_release_params *release_params)
+{
+	int rc;
+	int32_t idx = -1;
+
+	if (release_params->use_row_idx) {
+		rc = __cam_synx_obj_release_row(release_params->u.synx_row_idx);
+		if (rc < 0)
+			__cam_synx_obj_dump_monitor_array(release_params->u.synx_row_idx);
+	} else {
+		rc = __cam_synx_obj_release_obj(release_params->u.synx_obj, &idx);
+		if ((rc < 0) && (idx >= 0))
+			__cam_synx_obj_dump_monitor_array(idx);
+	}
+	return rc;
+}
+
+int cam_synx_obj_signal_obj(struct cam_synx_obj_signal *signal_synx_obj)
+{
+	int rc;
+	uint32_t idx;
+
+	rc = cam_synx_obj_find_obj_in_table(signal_synx_obj->synx_obj, &idx);
+	if (rc) {
+		CAM_ERR(CAM_SYNX, "Failed to find synx obj: %u", signal_synx_obj->synx_obj);
+		return -EINVAL;
+	}
+
+	return cam_synx_obj_internal_signal(idx, signal_synx_obj);
+}
+
+int cam_synx_obj_register_cb(int32_t *sync_obj, int32_t row_idx,
+	cam_sync_callback_for_synx_obj sync_cb)
+{
+	int rc = 0;
+	uint32_t synx_obj = 0;
+	struct cam_synx_obj_row *row = NULL;
+	struct synx_callback_params cb_params;
+
+	if (!sync_obj || !sync_cb) {
+		CAM_ERR(CAM_SYNX, "Invalid args sync_obj: %p sync_cb: %p",
+			sync_obj, sync_cb);
+		return -EINVAL;
+	}
+
+	if ((row_idx < 0) || (row_idx >= CAM_SYNX_MAX_OBJS)) {
+		CAM_ERR(CAM_SYNX, "synx obj idx: %d is invalid",
+			row_idx);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+	row = &g_cam_synx_obj_dev->rows[row_idx];
+	synx_obj = row->synx_obj;
+
+	if (row->state != CAM_SYNX_OBJ_STATE_ACTIVE) {
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(row_idx,
+				&g_cam_synx_obj_dev->dev_lock, g_cam_synx_obj_dev->monitor_data,
+				CAM_FENCE_OP_SKIP_REGISTER_CB);
+		CAM_ERR(CAM_SYNX,
+			"synx obj at idx: %d handle: %d is not active, current state: %d",
+			row_idx, row->synx_obj, row->state);
+		rc = -EINVAL;
+		goto monitor_dump;
+	}
+
+	/**
+	 * If the cb is already registered, return
+	 */
+	if (row->cb_registered_for_sync) {
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(row_idx,
+				&g_cam_synx_obj_dev->dev_lock, g_cam_synx_obj_dev->monitor_data,
+				CAM_FENCE_OP_ALREADY_REGISTERED_CB);
+		CAM_WARN(CAM_SYNX,
+			"synx obj at idx: %d handle: %d has already registered a cb for sync: %d",
+			row_idx, row->synx_obj, row->sync_obj);
+		goto monitor_dump;
+	}
+
+	row->sync_cb = sync_cb;
+	row->sync_obj = *sync_obj;
+	row->cb_registered_for_sync = true;
+
+	cb_params.userdata = row;
+	cb_params.cancel_cb_func = NULL;
+	cb_params.h_synx = synx_obj;
+	cb_params.timeout_ms = SYNX_NO_TIMEOUT;
+	cb_params.cb_func = __cam_synx_obj_signal_cb;
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &cam_sync_monitor_mask))
+		cam_generic_fence_update_monitor_array(row_idx,
+			&g_cam_synx_obj_dev->dev_lock, g_cam_synx_obj_dev->monitor_data,
+			CAM_FENCE_OP_REGISTER_CB);
+
+	spin_unlock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+
+	rc = __cam_synx_register_cb_util(&cb_params);
+	if (rc) {
+		CAM_ERR(CAM_SYNX,
+			"Failed to register cb for synx obj: %d rc: %d", synx_obj, rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_SYNX,
+		"CB successfully registered for synx obj: %d for sync_obj: %d",
+		synx_obj, *sync_obj);
+
+	return rc;
+
+monitor_dump:
+	__cam_synx_obj_dump_monitor_array(row_idx);
+	spin_unlock_bh(&g_cam_synx_obj_dev->row_spinlocks[row_idx]);
+	return rc;
+}
+
+int cam_synx_core_recovery(
+	enum cam_sync_synx_supported_cores cam_core_id)
+{
+	int rc;
+	enum synx_client_id client_id = SYNX_CLIENT_MAX;
+
+	switch (cam_core_id) {
+	case CAM_ICP_0_SYNX_CORE:
+		client_id = SYNX_CLIENT_ICP_CTX0;
+		break;
+	default:
+		rc = -EINVAL;
+		goto err;
+	}
+
+	rc = synx_recover(client_id);
+	if (rc)
+		goto err;
+
+	CAM_DBG(CAM_SYNX, "Synx recovery for synx_client: %d[%d] success",
+		client_id, cam_core_id);
+
+	return rc;
+
+err:
+	CAM_ERR(CAM_SYNX, "Failed to recover for synx_client: %d rc: %d",
+			client_id, rc);
+	return rc;
+}
+
+int __cam_synx_init_session(void)
+{
+	struct synx_queue_desc queue_desc;
+	struct synx_initialization_params params;
+
+	params.name = cam_synx_session_name;
+	params.ptr = &queue_desc;
+	params.flags = SYNX_INIT_MAX;
+	params.id = SYNX_CLIENT_NATIVE;
+	g_cam_synx_obj_dev->session_handle = synx_initialize(&params);
+
+	if (!g_cam_synx_obj_dev->session_handle) {
+		CAM_ERR(CAM_SYNX, "Synx session initialization failed");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SYNX, "Synx session initialized: %p",
+		g_cam_synx_obj_dev->session_handle);
+
+	return 0;
+}
+
+void cam_synx_obj_open(void)
+{
+	mutex_lock(&g_cam_synx_obj_dev->dev_lock);
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &cam_sync_monitor_mask)) {
+		g_cam_synx_obj_dev->monitor_data = kzalloc(
+			sizeof(struct cam_generic_fence_monitor_data *) *
+			CAM_SYNX_TABLE_SZ, GFP_KERNEL);
+		if (!g_cam_synx_obj_dev->monitor_data) {
+			CAM_WARN(CAM_DMA_FENCE, "Failed to allocate memory %d",
+				sizeof(struct cam_generic_fence_monitor_data *) *
+				CAM_SYNX_TABLE_SZ);
+		}
+	}
+	mutex_unlock(&g_cam_synx_obj_dev->dev_lock);
+}
+
+void cam_synx_obj_close(void)
+{
+	int i;
+	struct cam_synx_obj_row *row = NULL;
+
+	mutex_lock(&g_cam_synx_obj_dev->dev_lock);
+	for (i = 0; i < CAM_SYNX_MAX_OBJS; i++) {
+		row = &g_cam_synx_obj_dev->rows[i];
+		if (row->state == CAM_SYNX_OBJ_STATE_INVALID)
+			continue;
+
+		CAM_DBG(CAM_SYNX, "Releasing synx_obj: %d[%s]",
+			row->synx_obj, row->name);
+
+		/* If registered for cb, remove cb */
+		if (row->cb_registered_for_sync) {
+			if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ,
+				&cam_sync_monitor_mask))
+				cam_generic_fence_update_monitor_array(i,
+					NULL,
+					g_cam_synx_obj_dev->monitor_data,
+					CAM_FENCE_OP_UNREGISTER_CB);
+
+			__cam_synx_deregister_cb_util(row->synx_obj, row);
+		}
+
+		/* Signal and release the synx obj */
+		if (row->state != CAM_SYNX_OBJ_STATE_SIGNALED) {
+			if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ,
+				&cam_sync_monitor_mask))
+				cam_generic_fence_update_monitor_array(i,
+					NULL,
+					g_cam_synx_obj_dev->monitor_data,
+					CAM_FENCE_OP_SIGNAL);
+
+			__cam_synx_signal_util(row->synx_obj, SYNX_STATE_SIGNALED_CANCEL);
+		}
+
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(i,
+				NULL,
+				g_cam_synx_obj_dev->monitor_data,
+				CAM_FENCE_OP_DESTROY);
+
+		__cam_synx_release_hdl_util(row->synx_obj);
+		memset(row, 0, sizeof(struct cam_synx_obj_row));
+		clear_bit(i, g_cam_synx_obj_dev->bitmap);
+	}
+
+	if (g_cam_synx_obj_dev->monitor_data) {
+		for (i = 0; i < CAM_SYNX_TABLE_SZ; i++) {
+			kfree(g_cam_synx_obj_dev->monitor_data[i]);
+			g_cam_synx_obj_dev->monitor_data[i] = NULL;
+		}
+	}
+	kfree(g_cam_synx_obj_dev->monitor_data);
+	g_cam_synx_obj_dev->monitor_data = NULL;
+
+	mutex_unlock(&g_cam_synx_obj_dev->dev_lock);
+	CAM_DBG(CAM_SYNX, "Close on Camera SYNX driver");
+}
+
+int cam_synx_obj_driver_init(void)
+{
+	int i;
+
+	g_cam_synx_obj_dev = kzalloc(sizeof(struct cam_synx_obj_device), GFP_KERNEL);
+	if (!g_cam_synx_obj_dev)
+		return -ENOMEM;
+
+	if (__cam_synx_init_session())
+		goto deinit_driver;
+
+	mutex_init(&g_cam_synx_obj_dev->dev_lock);
+	for (i = 0; i < CAM_SYNX_MAX_OBJS; i++)
+		spin_lock_init(&g_cam_synx_obj_dev->row_spinlocks[i]);
+
+	memset(&g_cam_synx_obj_dev->rows, 0, sizeof(g_cam_synx_obj_dev->rows));
+	memset(&g_cam_synx_obj_dev->bitmap, 0, sizeof(g_cam_synx_obj_dev->bitmap));
+	bitmap_zero(g_cam_synx_obj_dev->bitmap, CAM_SYNX_MAX_OBJS);
+
+	/* zero will be considered an invalid slot */
+	set_bit(0, g_cam_synx_obj_dev->bitmap);
+
+	CAM_DBG(CAM_SYNX, "Camera synx obj driver initialized");
+	return 0;
+
+deinit_driver:
+	CAM_ERR(CAM_SYNX, "Camera synx obj driver initialization failed");
+	kfree(g_cam_synx_obj_dev);
+	g_cam_synx_obj_dev = NULL;
+	return -EINVAL;
+}
+
+void cam_synx_obj_driver_deinit(void)
+{
+	int rc;
+
+	if (g_cam_synx_obj_dev->session_handle) {
+		rc = synx_uninitialize(g_cam_synx_obj_dev->session_handle);
+		if (rc) {
+			CAM_ERR(CAM_SYNX,
+				"Synx failed to uninitialize session: %p, rc: %d",
+				g_cam_synx_obj_dev->session_handle, rc);
+		}
+	}
+
+	kfree(g_cam_synx_obj_dev);
+	g_cam_synx_obj_dev = NULL;
+	CAM_DBG(CAM_SYNX, "Camera synx obj driver deinitialized");
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_synx.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_synx.h
@@ -0,0 +1,177 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __CAM_SYNC_SYNX_H__
+#define __CAM_SYNC_SYNX_H__
+
+#include <linux/types.h>
+#include <linux/spinlock_types.h>
+#include <linux/bitmap.h>
+#include <synx_api.h>
+
+#include "cam_sync_api.h"
+#include "cam_sync.h"
+#include "cam_debug_util.h"
+
+#define CAM_SYNX_MAX_OBJS 256
+#define CAM_SYNX_OBJ_NAME_LEN 64
+#define CAM_SYNX_TABLE_SZ (CAM_SYNX_MAX_OBJS / CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ)
+
+/* Synx obj state */
+enum cam_synx_obj_state {
+	CAM_SYNX_OBJ_STATE_INVALID,
+	CAM_SYNX_OBJ_STATE_ACTIVE,
+	CAM_SYNX_OBJ_STATE_SIGNALED,
+};
+
+/**
+ * struct cam_synx_obj_release_params - Synx release payload
+ *                   Based on the flag row_idx or synx_obj is consumed
+ *
+ * @synx_row_idx   : Synx obj row idx
+ * @synx_obj       : Synx object handle
+ * @use_row_idx    : Use row idx
+ */
+struct cam_synx_obj_release_params {
+	union {
+		int32_t  synx_row_idx;
+		uint32_t synx_obj;
+	} u;
+	bool use_row_idx;
+};
+
+/**
+ * struct cam_synx_obj_fence_signal_sync_obj - SYNX -> sync signal info
+ *                           Payload to signal sync on a synx fence being signaled
+ *
+ * @synx_obj               : Synx object handle
+ * @status                 : Sync signal status
+ */
+struct cam_synx_obj_signal_sync_obj {
+	int32_t synx_obj;
+	int32_t status;
+};
+
+/* Synx obj callback function type */
+typedef int (*cam_sync_callback_for_synx_obj)(int32_t sync_obj,
+	struct cam_synx_obj_signal_sync_obj *signal_sync_obj);
+
+/**
+ * @brief Find the synx obj in the device's table
+ *
+ * @param synx_obj       : Synx obj
+ * @param idx            : Synx object table index
+ *
+ * @return Status of operation. Zero in case of success.
+ */
+int cam_synx_obj_find_obj_in_table(uint32_t synx_obj, int32_t *idx);
+
+/**
+ * @brief Create a synx object
+ *
+ * @param name     : Synx obj name
+ * @param flags    : Creation flags
+ * @param synx_obj : Created synx obj handle
+ * @param row_idx  : Created synx obj table row idx
+ *
+ * @return Status of operation. Zero in case of success.
+ * -EINVAL will be returned if params were invalid.
+ * -ENOMEM will be returned if the kernel can't allocate space for
+ * synx object.
+ */
+int cam_synx_obj_create(const char *name, uint32_t flags, uint32_t *synx_obj,
+	int32_t *row_idx);
+
+/**
+ * @brief Signal a synx obj when sync obj is signaled
+ *
+ * @param row_idx         : Synx obj table row index
+ * @param signal_synx_obj : Info on synx obj to be signaled
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_synx_obj_internal_signal(int32_t row_idx,
+	struct cam_synx_obj_signal *signal_synx_obj);
+
+/**
+ * @brief Import a synx obj for synchronization
+ *
+ * @param name     : Synx obj name
+ * @param flags    : Import flags
+ * @param fence    : DMA fence ptr
+ * @param synx_obj : New synx obj handle
+ * @param row_idx  : Imported obj table row idx
+ *
+ * @return Status of operation. Zero in case of success
+ * -EINVAL if synx object is bad state
+ */
+int cam_synx_obj_import_dma_fence(const char *name, uint32_t flags, void *fence,
+	uint32_t *synx_obj, int32_t *row_idx);
+
+/**
+ * @brief Release a synx object
+ *
+ * @param release_params : Synx obj release info
+ *
+ * @return Status of operation. Zero upon success. Negative value otherwise
+ */
+int cam_synx_obj_release(struct cam_synx_obj_release_params *release_params);
+
+/**
+ * @brief Signal a synx obj [userspace API]
+ *
+ * @param signal_synx_obj : Signal info
+ *
+ * @return Status of operation. Zero upon success. Negative value otherwise
+ */
+int cam_synx_obj_signal_obj(struct cam_synx_obj_signal *signal_synx_obj);
+
+/**
+ * @brief Synx obj register callback
+ *
+ * @param sync_obj : Sync object
+ * @param row_idx  : Synx obj table row idx
+ * @param sync_cb  : Sync object callback
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_synx_obj_register_cb(int32_t *sync_obj, int32_t row_idx,
+	cam_sync_callback_for_synx_obj sync_cb);
+
+/**
+ * @brief: Synx recovery for a given core
+ *
+ * @param core_id: Core ID we want to recover for
+ *
+ * @return Status of operation. Zero in case of success
+ * -EINVAL if core_id is invalid
+ */
+int cam_synx_core_recovery(
+	enum cam_sync_synx_supported_cores core_id);
+
+/**
+ * @brief: cam synx driver open
+ *
+ */
+void cam_synx_obj_open(void);
+
+/**
+ * @brief: cam synx driver close
+ *
+ */
+void cam_synx_obj_close(void);
+
+/**
+ * @brief: cam synx driver initialize
+ *
+ */
+int cam_synx_obj_driver_init(void);
+
+/**
+ * @brief: cam synx driver deinit
+ *
+ */
+void cam_synx_obj_driver_deinit(void);
+
+#endif /* __CAM_SYNC_SYNX_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_util.c
@@ -0,0 +1,828 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2018, 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sync_util.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+extern unsigned long cam_sync_monitor_mask;
+
+static int cam_generic_expand_monitor_table(int idx, struct mutex *lock,
+	struct cam_generic_fence_monitor_data **mon_data)
+{
+	struct cam_generic_fence_monitor_data *row_mon_data;
+
+	if (lock)
+		mutex_lock(lock);
+	row_mon_data = mon_data[(idx / CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ)];
+	if (!row_mon_data) {
+		row_mon_data = kzalloc(
+			sizeof(struct cam_generic_fence_monitor_data) *
+			CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ, GFP_KERNEL);
+		mon_data[(idx / CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ)] = row_mon_data;
+	}
+	if (!row_mon_data) {
+		CAM_ERR(CAM_SYNC, "Error allocating memory %d, idx %d",
+			sizeof(struct cam_generic_fence_monitor_data) *
+			CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ, idx);
+
+		if (lock)
+			mutex_unlock(lock);
+
+		return -ENOMEM;
+	}
+
+	if (lock)
+		mutex_unlock(lock);
+
+	return 0;
+}
+
+static inline struct cam_generic_fence_monitor_entry *__cam_sync_get_monitor_entries(int idx)
+{
+	struct cam_generic_fence_monitor_data *mon_data;
+
+	mon_data = CAM_SYNC_MONITOR_GET_DATA(idx);
+	if (mon_data->swap_monitor_entries)
+		return mon_data->prev_monitor_entries;
+	else
+		return mon_data->monitor_entries;
+}
+
+static inline struct cam_generic_fence_monitor_entry *__cam_sync_get_prev_monitor_entries(int idx)
+{
+	struct cam_generic_fence_monitor_data *mon_data;
+
+	mon_data = CAM_SYNC_MONITOR_GET_DATA(idx);
+	if (mon_data->swap_monitor_entries)
+		return mon_data->monitor_entries;
+	else
+		return mon_data->prev_monitor_entries;
+}
+
+const char *cam_fence_op_to_string(
+	enum cam_fence_op op)
+{
+	switch (op) {
+	case CAM_FENCE_OP_CREATE:
+		return "CREATE";
+	case CAM_FENCE_OP_REGISTER_CB:
+		return "REGISTER_CB";
+	case CAM_FENCE_OP_SIGNAL:
+		return "SIGNAL";
+	case CAM_FENCE_OP_UNREGISTER_ON_SIGNAL:
+		return "UNREGISTER_ON_SIGNAL";
+	case CAM_FENCE_OP_UNREGISTER_CB:
+		return "UNREGISTER_CB";
+	case CAM_FENCE_OP_SKIP_REGISTER_CB:
+		return "SKIP_REGISTER_CB";
+	case CAM_FENCE_OP_ALREADY_REGISTERED_CB:
+		return "ALREADY_REGISTERED_CB";
+	case CAM_FENCE_OP_DESTROY:
+		return "DESTROY";
+	default:
+		return "INVALID";
+	}
+}
+
+static void __cam_sync_save_previous_monitor_data(
+	struct sync_table_row *row)
+{
+	struct cam_generic_fence_monitor_data *row_mon_data;
+
+	if (!sync_dev->mon_data)
+		return;
+
+	row_mon_data = CAM_SYNC_MONITOR_GET_DATA(row->sync_id);
+
+	/* save current usage details into prev variables */
+	strscpy(row_mon_data->prev_name, row->name, SYNC_DEBUG_NAME_LEN);
+	row_mon_data->prev_type         = row->type;
+	row_mon_data->prev_obj_id       = row->sync_id;
+	row_mon_data->prev_state        = row->state;
+	row_mon_data->prev_remaining    = row->remaining;
+	row_mon_data->prev_monitor_head = atomic64_read(&row_mon_data->monitor_head);
+
+	/* Toggle swap flag. Avoid copying and just read/write using correct table idx */
+	row_mon_data->swap_monitor_entries = !row_mon_data->swap_monitor_entries;
+}
+
+void cam_generic_fence_update_monitor_array(int idx,
+	struct mutex *lock,
+	struct cam_generic_fence_monitor_data **mon_data,
+	enum cam_fence_op op)
+{
+	int iterator, rc;
+	struct cam_generic_fence_monitor_data *row_mon_data;
+	struct cam_generic_fence_monitor_entry *row_mon_entries;
+
+	/* Validate inputs */
+	if (!mon_data)
+		return;
+
+	row_mon_data = mon_data[(idx / CAM_GENERIC_MONITOR_TABLE_ENTRY_SZ)];
+	if (!row_mon_data) {
+		rc = cam_generic_expand_monitor_table(idx, lock, mon_data);
+		if (rc) {
+			CAM_ERR(CAM_SYNC, "Failed to expand monitor table");
+			return;
+		}
+	}
+
+	row_mon_data = CAM_GENERIC_MONITOR_GET_DATA(mon_data, idx);
+	if (op == CAM_FENCE_OP_CREATE)
+		atomic64_set(&row_mon_data->monitor_head, -1);
+	if (row_mon_data->swap_monitor_entries)
+		row_mon_entries = row_mon_data->monitor_entries;
+	else
+		row_mon_entries = row_mon_data->prev_monitor_entries;
+
+	CAM_SYNC_INC_MONITOR_HEAD(&row_mon_data->monitor_head, &iterator);
+	CAM_GET_TIMESTAMP(row_mon_entries[iterator].timestamp);
+	row_mon_entries[iterator].op = op;
+}
+
+static void __cam_generic_fence_dump_monitor_entries(
+	struct cam_generic_fence_monitor_entry *monitor_entries,
+	uint32_t index, uint32_t num_entries)
+{
+	int i = 0;
+	uint64_t ms, hrs, min, sec;
+
+	for (i = 0; i < num_entries; i++) {
+		CAM_CONVERT_TIMESTAMP_FORMAT(monitor_entries[index].timestamp,
+			hrs, min, sec, ms);
+
+		CAM_INFO(CAM_SYNC,
+			"**** %llu:%llu:%llu.%llu : Index[%d] Op[%s]",
+			hrs, min, sec, ms,
+			index,
+			cam_fence_op_to_string(monitor_entries[index].op));
+
+		index = (index + 1) % CAM_SYNC_MONITOR_MAX_ENTRIES;
+	}
+}
+
+static int __cam_generic_fence_get_monitor_entries_info(uint64_t  state_head,
+	uint32_t *oldest_entry, uint32_t *num_entries)
+{
+	*oldest_entry = 0;
+	*num_entries  = 0;
+
+	if (state_head == -1) {
+		return -EINVAL;
+	} else if (state_head < CAM_SYNC_MONITOR_MAX_ENTRIES) {
+		/* head starts from -1 */
+		*num_entries = state_head + 1;
+		*oldest_entry = 0;
+	} else {
+		*num_entries = CAM_SYNC_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1,
+			CAM_SYNC_MONITOR_MAX_ENTRIES, oldest_entry);
+	}
+
+	return 0;
+}
+
+void cam_generic_fence_dump_monitor_array(
+	struct cam_generic_fence_monitor_obj_info *obj_info)
+{
+	int rc;
+	uint32_t num_entries, oldest_entry;
+	uint64_t ms, hrs, min, sec;
+	struct timespec64 current_ts;
+	struct cam_generic_fence_monitor_data *mon_data = obj_info->monitor_data;
+
+	/* Check if there are any current entries in the monitor data */
+	rc = __cam_generic_fence_get_monitor_entries_info(
+		atomic64_read(&mon_data->monitor_head),
+		&oldest_entry, &num_entries);
+
+	if (rc)
+		return;
+
+	/* Print current monitor entries */
+	CAM_GET_TIMESTAMP(current_ts);
+	CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
+	switch (obj_info->fence_type) {
+	case CAM_GENERIC_FENCE_TYPE_SYNC_OBJ:
+		CAM_INFO(CAM_SYNC,
+			"======== %llu:%llu:%llu:%llu Dumping monitor information for sync obj %s, type %d, sync_id %d state %d remaining %d ref_cnt %d num_entries %u ===========",
+			hrs, min, sec, ms, obj_info->name, obj_info->sync_type,
+			obj_info->obj_id, obj_info->state, obj_info->remaining,
+			obj_info->ref_cnt, num_entries);
+		break;
+	case CAM_GENERIC_FENCE_TYPE_DMA_FENCE:
+		CAM_INFO(CAM_DMA_FENCE,
+			"======== %llu:%llu:%llu:%llu Dumping monitor information for dma obj %s, fd %d sync_id %d state %d ref_cnt %d num_entries %u ===========",
+			hrs, min, sec, ms, obj_info->name, obj_info->obj_id,
+			obj_info->sync_id, obj_info->state, obj_info->ref_cnt,
+			num_entries);
+		break;
+	case CAM_GENERIC_FENCE_TYPE_SYNX_OBJ:
+		CAM_INFO(CAM_SYNX,
+			"======== %llu:%llu:%llu:%llu Dumping monitor information for synx obj %s, synx_id %d sync_id %d state %d ref_cnt %d num_entries %u ===========",
+			hrs, min, sec, ms, obj_info->name, obj_info->obj_id,
+			obj_info->sync_id, obj_info->state, obj_info->ref_cnt,
+			num_entries);
+		break;
+	default:
+		break;
+	}
+
+	__cam_generic_fence_dump_monitor_entries(obj_info->monitor_entries,
+		oldest_entry, num_entries);
+
+
+	/* Check if there are any previous entries in the monitor data */
+	rc = __cam_generic_fence_get_monitor_entries_info(
+		mon_data->prev_monitor_head,
+		&oldest_entry, &num_entries);
+
+	if (rc)
+		return;
+
+	/* Print previous monitor entries */
+	CAM_GET_TIMESTAMP(current_ts);
+	CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
+	switch (obj_info->fence_type) {
+	case CAM_GENERIC_FENCE_TYPE_SYNC_OBJ:
+		CAM_INFO(CAM_SYNC,
+			"======== %llu:%llu:%llu:%llu Dumping previous monitor information for sync obj %s, type %d, sync_id %d state %d remaining %d num_entries %u ===========",
+			hrs, min, sec, ms, mon_data->prev_name, mon_data->prev_type,
+			mon_data->prev_obj_id, mon_data->prev_state, mon_data->prev_remaining,
+			num_entries);
+		break;
+	case CAM_GENERIC_FENCE_TYPE_DMA_FENCE:
+		CAM_INFO(CAM_DMA_FENCE,
+			"======== %llu:%llu:%llu:%llu Dumping previous monitor information for dma obj %s, fd %d sync_id %d state %d num_entries %u ===========",
+			hrs, min, sec, ms, mon_data->prev_name, mon_data->prev_obj_id,
+			mon_data->prev_sync_id, mon_data->prev_state,
+			num_entries);
+		break;
+	case CAM_GENERIC_FENCE_TYPE_SYNX_OBJ:
+		CAM_INFO(CAM_SYNX,
+			"======== %llu:%llu:%llu:%llu Dumping previous monitor information for synx obj %s, synx_id %d sync_id %d state %d num_entries %u ===========",
+			hrs, min, sec, ms, mon_data->prev_name, mon_data->prev_obj_id,
+			mon_data->prev_sync_id, mon_data->prev_state,
+			num_entries);
+		break;
+	default:
+		break;
+	}
+
+	__cam_generic_fence_dump_monitor_entries(obj_info->prev_monitor_entries,
+		oldest_entry, num_entries);
+
+}
+
+void cam_sync_dump_monitor_array(struct sync_table_row *row)
+{
+	struct cam_generic_fence_monitor_obj_info obj_info;
+
+	if (!sync_dev->mon_data ||
+		!test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ, &cam_sync_monitor_mask) ||
+		!(CAM_GENERIC_MONITOR_GET_DATA(sync_dev->mon_data, row->sync_id)->prev_obj_id))
+		return;
+
+	obj_info.name = row->name;
+	obj_info.sync_type = row->type;
+	obj_info.obj_id = row->sync_id;
+	obj_info.state = row->state;
+	obj_info.remaining = row->remaining;
+	obj_info.ref_cnt = atomic_read(&row->ref_cnt);
+	obj_info.monitor_data = CAM_SYNC_MONITOR_GET_DATA(row->sync_id);
+	obj_info.fence_type = CAM_GENERIC_FENCE_TYPE_SYNC_OBJ;
+	obj_info.monitor_entries =
+		__cam_sync_get_monitor_entries(row->sync_id);
+	obj_info.prev_monitor_entries =
+		__cam_sync_get_prev_monitor_entries(row->sync_id);
+	cam_generic_fence_dump_monitor_array(&obj_info);
+}
+
+int cam_sync_util_find_and_set_empty_row(struct sync_device *sync_dev,
+	long *idx)
+{
+	int rc = 0;
+
+	mutex_lock(&sync_dev->table_lock);
+
+	*idx = find_first_zero_bit(sync_dev->bitmap, CAM_SYNC_MAX_OBJS);
+
+	if (*idx < CAM_SYNC_MAX_OBJS)
+		set_bit(*idx, sync_dev->bitmap);
+	else
+		rc = -1;
+
+	mutex_unlock(&sync_dev->table_lock);
+
+	return rc;
+}
+
+int cam_sync_init_row(struct sync_table_row *table,
+	uint32_t idx, const char *name, uint32_t type)
+{
+	struct sync_table_row *row = table + idx;
+
+	if (!table || idx <= 0 || idx >= CAM_SYNC_MAX_OBJS)
+		return -EINVAL;
+
+	strscpy(row->name, name, SYNC_DEBUG_NAME_LEN);
+	INIT_LIST_HEAD(&row->parents_list);
+	INIT_LIST_HEAD(&row->children_list);
+	row->type = type;
+	row->sync_id = idx;
+	row->state = CAM_SYNC_STATE_ACTIVE;
+	row->remaining = 0;
+	atomic_set(&row->ref_cnt, 0);
+	init_completion(&row->signaled);
+	INIT_LIST_HEAD(&row->callback_list);
+	INIT_LIST_HEAD(&row->user_payload_list);
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ, &cam_sync_monitor_mask)) {
+		cam_generic_fence_update_monitor_array(idx, &sync_dev->table_lock,
+			sync_dev->mon_data,
+			CAM_FENCE_OP_CREATE);
+	}
+	CAM_DBG(CAM_SYNC,
+		"row name:%s sync_id:%i [idx:%u] row_state:%u ",
+		row->name, row->sync_id, idx, row->state);
+
+	return 0;
+}
+
+int cam_sync_init_group_object(struct sync_table_row *table,
+	uint32_t idx,
+	uint32_t *sync_objs,
+	uint32_t num_objs)
+{
+	int i, rc;
+	struct sync_child_info *child_info;
+	struct sync_parent_info *parent_info;
+	struct sync_table_row *row = table + idx;
+	struct sync_table_row *child_row = NULL;
+
+	cam_sync_init_row(table, idx, "merged_fence", CAM_SYNC_TYPE_GROUP);
+
+	/*
+	 * While traversing for children, parent's row list is updated with
+	 * child info and each child's row is updated with parent info.
+	 * If any child state is ERROR or SUCCESS, it will not be added to list.
+	 */
+	for (i = 0; i < num_objs; i++) {
+		child_row = table + sync_objs[i];
+		spin_lock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+
+		/* validate child */
+		if ((child_row->type == CAM_SYNC_TYPE_GROUP) ||
+			(child_row->state == CAM_SYNC_STATE_INVALID)) {
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			CAM_ERR(CAM_SYNC,
+				"Invalid child fence:%i state:%u type:%u",
+				child_row->sync_id, child_row->state,
+				child_row->type);
+			rc = -EINVAL;
+			goto clean_children_info;
+		}
+
+		/* check for child's state */
+		if ((child_row->state == CAM_SYNC_STATE_SIGNALED_ERROR) ||
+			(child_row->state == CAM_SYNC_STATE_SIGNALED_CANCEL)) {
+			row->state = child_row->state;
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			continue;
+		}
+		if (child_row->state != CAM_SYNC_STATE_ACTIVE) {
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			continue;
+		}
+
+		row->remaining++;
+
+		/* Add child info */
+		child_info = kzalloc(sizeof(*child_info), GFP_ATOMIC);
+		if (!child_info) {
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			rc = -ENOMEM;
+			goto clean_children_info;
+		}
+		child_info->sync_id = sync_objs[i];
+		list_add_tail(&child_info->list, &row->children_list);
+
+		/* Add parent info */
+		parent_info = kzalloc(sizeof(*parent_info), GFP_ATOMIC);
+		if (!parent_info) {
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			rc = -ENOMEM;
+			goto clean_children_info;
+		}
+		parent_info->sync_id = idx;
+		list_add_tail(&parent_info->list, &child_row->parents_list);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+	}
+
+	if (!row->remaining) {
+		if ((row->state != CAM_SYNC_STATE_SIGNALED_ERROR) &&
+			(row->state != CAM_SYNC_STATE_SIGNALED_CANCEL))
+			row->state = CAM_SYNC_STATE_SIGNALED_SUCCESS;
+		complete_all(&row->signaled);
+	}
+
+	return 0;
+
+clean_children_info:
+	row->state = CAM_SYNC_STATE_INVALID;
+	for (i = i-1; i >= 0; i--) {
+		spin_lock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+		child_row = table + sync_objs[i];
+		cam_sync_util_cleanup_parents_list(child_row,
+			SYNC_LIST_CLEAN_ONE, idx);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+	}
+
+	cam_sync_util_cleanup_children_list(row, SYNC_LIST_CLEAN_ALL, 0);
+	return rc;
+}
+
+int cam_sync_deinit_object(struct sync_table_row *table, uint32_t idx,
+	struct cam_sync_check_for_dma_release *check_for_dma_release,
+	struct cam_sync_check_for_synx_release *check_for_synx_release)
+{
+	struct sync_table_row      *row = table + idx;
+	struct sync_child_info     *child_info, *temp_child;
+	struct sync_callback_info  *sync_cb, *temp_cb;
+	struct sync_parent_info    *parent_info, *temp_parent;
+	struct sync_user_payload   *upayload_info, *temp_upayload;
+	struct sync_table_row      *child_row = NULL, *parent_row = NULL;
+	struct list_head            temp_child_list, temp_parent_list;
+
+	if (!table || (idx <= 0) || (idx >= CAM_SYNC_MAX_OBJS))
+		return -EINVAL;
+
+	CAM_DBG(CAM_SYNC,
+		"row name:%s sync_id:%i [idx:%u] row_state:%u",
+		row->name, row->sync_id, idx, row->state);
+
+	spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj: idx = %d name = %s",
+			idx,
+			row->name);
+		return -EINVAL;
+	}
+
+	if (row->state == CAM_SYNC_STATE_ACTIVE)
+		CAM_DBG(CAM_SYNC,
+			"Destroying an active sync object name:%s id:%i",
+			row->name, row->sync_id);
+
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ, &cam_sync_monitor_mask)) {
+		cam_generic_fence_update_monitor_array(idx, &sync_dev->table_lock,
+			sync_dev->mon_data,
+			CAM_FENCE_OP_DESTROY);
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ_DUMP, &cam_sync_monitor_mask))
+			cam_sync_dump_monitor_array(row);
+		__cam_sync_save_previous_monitor_data(row);
+	}
+
+	row->state = CAM_SYNC_STATE_INVALID;
+
+	/* Object's child and parent objects will be added into this list */
+	INIT_LIST_HEAD(&temp_child_list);
+	INIT_LIST_HEAD(&temp_parent_list);
+
+	list_for_each_entry_safe(child_info, temp_child, &row->children_list,
+		list) {
+		if (child_info->sync_id <= 0)
+			continue;
+
+		list_del_init(&child_info->list);
+		list_add_tail(&child_info->list, &temp_child_list);
+	}
+
+	list_for_each_entry_safe(parent_info, temp_parent, &row->parents_list,
+		list) {
+		if (parent_info->sync_id <= 0)
+			continue;
+
+		list_del_init(&parent_info->list);
+		list_add_tail(&parent_info->list, &temp_parent_list);
+	}
+
+	spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+
+	/* Cleanup the child to parent link from child list */
+	while (!list_empty(&temp_child_list)) {
+		child_info = list_first_entry(&temp_child_list,
+			struct sync_child_info, list);
+		child_row = sync_dev->sync_table + child_info->sync_id;
+
+		spin_lock_bh(&sync_dev->row_spinlocks[child_info->sync_id]);
+
+		if (child_row->state == CAM_SYNC_STATE_INVALID) {
+			list_del_init(&child_info->list);
+			spin_unlock_bh(&sync_dev->row_spinlocks[
+				child_info->sync_id]);
+			kfree(child_info);
+			continue;
+		}
+
+		if (child_row->state == CAM_SYNC_STATE_ACTIVE)
+			CAM_DBG(CAM_SYNC,
+				"Warning: destroying active child sync obj = %s[%d]",
+				child_row->name,
+				child_info->sync_id);
+
+		cam_sync_util_cleanup_parents_list(child_row,
+			SYNC_LIST_CLEAN_ONE, idx);
+
+		list_del_init(&child_info->list);
+		spin_unlock_bh(&sync_dev->row_spinlocks[child_info->sync_id]);
+		kfree(child_info);
+	}
+
+	/* Cleanup the parent to child link */
+	while (!list_empty(&temp_parent_list)) {
+		parent_info = list_first_entry(&temp_parent_list,
+			struct sync_parent_info, list);
+		parent_row = sync_dev->sync_table + parent_info->sync_id;
+
+		spin_lock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+
+		if (parent_row->state == CAM_SYNC_STATE_INVALID) {
+			list_del_init(&parent_info->list);
+			spin_unlock_bh(&sync_dev->row_spinlocks[
+				parent_info->sync_id]);
+			kfree(parent_info);
+			continue;
+		}
+
+		if (parent_row->state == CAM_SYNC_STATE_ACTIVE)
+			CAM_DBG(CAM_SYNC,
+				"Warning: destroying active parent sync obj = %s[%d]",
+				parent_row->name,
+				parent_info->sync_id);
+
+		cam_sync_util_cleanup_children_list(parent_row,
+			SYNC_LIST_CLEAN_ONE, idx);
+
+		list_del_init(&parent_info->list);
+		spin_unlock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+		kfree(parent_info);
+	}
+
+	spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+	list_for_each_entry_safe(upayload_info, temp_upayload,
+			&row->user_payload_list, list) {
+		list_del_init(&upayload_info->list);
+		kfree(upayload_info);
+	}
+
+	list_for_each_entry_safe(sync_cb, temp_cb,
+			&row->callback_list, list) {
+		list_del_init(&sync_cb->list);
+		kfree(sync_cb);
+	}
+
+	/* Decrement ref cnt for imported dma fence */
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_DMA_FENCE, &row->ext_fence_mask)) {
+		cam_dma_fence_get_put_ref(false, row->dma_fence_info.dma_fence_row_idx);
+
+		/* Check if same dma fence is being released with the sync obj */
+		if (check_for_dma_release) {
+			if (row->dma_fence_info.dma_fence_fd ==
+				check_for_dma_release->dma_fence_fd) {
+				check_for_dma_release->sync_created_with_dma =
+					row->dma_fence_info.sync_created_with_dma;
+				check_for_dma_release->dma_fence_row_idx =
+					row->dma_fence_info.dma_fence_row_idx;
+			}
+		}
+	}
+
+	/* Check if same synx obj is being released with the sync obj */
+	if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNX_OBJ, &row->ext_fence_mask)) {
+		if (check_for_synx_release) {
+			if (row->synx_obj_info.synx_obj ==
+				check_for_synx_release->synx_obj) {
+				check_for_synx_release->synx_obj_row_idx =
+					row->synx_obj_info.synx_obj_row_idx;
+				check_for_synx_release->sync_created_with_synx =
+					row->synx_obj_info.sync_created_with_synx;
+			}
+		}
+	}
+
+	memset(row, 0, sizeof(*row));
+	clear_bit(idx, sync_dev->bitmap);
+	INIT_LIST_HEAD(&row->callback_list);
+	INIT_LIST_HEAD(&row->parents_list);
+	INIT_LIST_HEAD(&row->children_list);
+	INIT_LIST_HEAD(&row->user_payload_list);
+	spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+
+	return 0;
+}
+
+void cam_sync_util_cb_dispatch(struct work_struct *cb_dispatch_work)
+{
+	struct sync_callback_info *cb_info = container_of(cb_dispatch_work,
+		struct sync_callback_info,
+		cb_dispatch_work);
+	sync_callback sync_data = cb_info->callback_func;
+	void *cb = cb_info->callback_func;
+
+	cam_common_util_thread_switch_delay_detect(
+		"cam_sync_workq", "schedule", cb,
+		cb_info->workq_scheduled_ts,
+		CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+	sync_data(cb_info->sync_obj, cb_info->status, cb_info->cb_data);
+
+	kfree(cb_info);
+}
+
+void cam_sync_util_dispatch_signaled_cb(int32_t sync_obj,
+	uint32_t status, uint32_t event_cause)
+{
+	struct sync_callback_info  *sync_cb;
+	struct sync_user_payload   *payload_info;
+	struct sync_callback_info  *temp_sync_cb;
+	struct sync_table_row      *signalable_row;
+	struct sync_user_payload   *temp_payload_info;
+
+	signalable_row = sync_dev->sync_table + sync_obj;
+	if (signalable_row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_DBG(CAM_SYNC,
+			"Accessing invalid sync object:%s[%i]", signalable_row->name,
+			sync_obj);
+		return;
+	}
+
+	/* Dispatch kernel callbacks if any were registered earlier */
+	list_for_each_entry_safe(sync_cb,
+		temp_sync_cb, &signalable_row->callback_list, list) {
+		sync_cb->status = status;
+		list_del_init(&sync_cb->list);
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(sync_obj,
+				&sync_dev->table_lock, sync_dev->mon_data,
+				CAM_FENCE_OP_UNREGISTER_ON_SIGNAL);
+		queue_work(sync_dev->work_queue,
+			&sync_cb->cb_dispatch_work);
+	}
+
+	/* Dispatch user payloads if any were registered earlier */
+	list_for_each_entry_safe(payload_info, temp_payload_info,
+		&signalable_row->user_payload_list, list) {
+		spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
+		if (!sync_dev->cam_sync_eventq) {
+			spin_unlock_bh(
+				&sync_dev->cam_sync_eventq_lock);
+			break;
+		}
+		spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
+		cam_sync_util_send_v4l2_event(
+			CAM_SYNC_V4L_EVENT_ID_CB_TRIG,
+			sync_obj,
+			status,
+			payload_info->payload_data,
+			CAM_SYNC_PAYLOAD_WORDS * sizeof(__u64),
+			event_cause);
+
+		list_del_init(&payload_info->list);
+
+		if (test_bit(CAM_GENERIC_FENCE_TYPE_SYNC_OBJ,
+			&cam_sync_monitor_mask))
+			cam_generic_fence_update_monitor_array(sync_obj,
+				&sync_dev->table_lock, sync_dev->mon_data,
+				CAM_FENCE_OP_UNREGISTER_ON_SIGNAL);
+		/*
+		 * We can free the list node here because
+		 * sending V4L event will make a deep copy
+		 * anyway
+		 */
+		kfree(payload_info);
+	}
+
+	/*
+	 * This needs to be done because we want to unblock anyone
+	 * who might be blocked and waiting on this sync object
+	 */
+	complete_all(&signalable_row->signaled);
+}
+
+void cam_sync_util_send_v4l2_event(uint32_t id,
+	uint32_t sync_obj,
+	int status,
+	void *payload,
+	int len, uint32_t event_cause)
+{
+	struct v4l2_event event;
+	__u64 *payload_data = NULL;
+
+	if (sync_dev->version == CAM_SYNC_V4L_EVENT_V2) {
+		struct cam_sync_ev_header_v2 *ev_header = NULL;
+
+		event.id = id;
+		event.type = CAM_SYNC_V4L_EVENT_V2;
+
+		ev_header = CAM_SYNC_GET_HEADER_PTR_V2(event);
+		ev_header->sync_obj = sync_obj;
+		ev_header->status = status;
+		ev_header->version = sync_dev->version;
+		ev_header->evt_param[CAM_SYNC_EVENT_REASON_CODE_INDEX] =
+			event_cause;
+		payload_data = CAM_SYNC_GET_PAYLOAD_PTR_V2(event, __u64);
+	} else {
+		struct cam_sync_ev_header *ev_header = NULL;
+
+		event.id = id;
+		event.type = CAM_SYNC_V4L_EVENT;
+
+		ev_header = CAM_SYNC_GET_HEADER_PTR(event);
+		ev_header->sync_obj = sync_obj;
+		ev_header->status = status;
+		payload_data = CAM_SYNC_GET_PAYLOAD_PTR(event, __u64);
+	}
+
+	memcpy(payload_data, payload, len);
+	v4l2_event_queue(sync_dev->vdev, &event);
+	CAM_DBG(CAM_SYNC, "send v4l2 event version %d for sync_obj :%d",
+		sync_dev->version,
+		sync_obj);
+}
+
+int cam_sync_util_update_parent_state(struct sync_table_row *parent_row,
+	int new_state)
+{
+	int rc = 0;
+
+	switch (parent_row->state) {
+	case CAM_SYNC_STATE_ACTIVE:
+	case CAM_SYNC_STATE_SIGNALED_SUCCESS:
+		parent_row->state = new_state;
+		break;
+
+	case CAM_SYNC_STATE_SIGNALED_ERROR:
+	case CAM_SYNC_STATE_SIGNALED_CANCEL:
+		break;
+
+	case CAM_SYNC_STATE_INVALID:
+	default:
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+void cam_sync_util_cleanup_children_list(struct sync_table_row *row,
+	uint32_t list_clean_type, uint32_t sync_obj)
+{
+	struct sync_child_info *child_info = NULL;
+	struct sync_child_info *temp_child_info = NULL;
+	uint32_t                curr_sync_obj;
+
+	list_for_each_entry_safe(child_info,
+			temp_child_info, &row->children_list, list) {
+		if ((list_clean_type == SYNC_LIST_CLEAN_ONE) &&
+			(child_info->sync_id != sync_obj))
+			continue;
+
+		curr_sync_obj = child_info->sync_id;
+		list_del_init(&child_info->list);
+		kfree(child_info);
+
+		if ((list_clean_type == SYNC_LIST_CLEAN_ONE) &&
+			(curr_sync_obj == sync_obj))
+			break;
+	}
+}
+
+void cam_sync_util_cleanup_parents_list(struct sync_table_row *row,
+	uint32_t list_clean_type, uint32_t sync_obj)
+{
+	struct sync_parent_info *parent_info = NULL;
+	struct sync_parent_info *temp_parent_info = NULL;
+	uint32_t                 curr_sync_obj;
+
+	list_for_each_entry_safe(parent_info,
+			temp_parent_info, &row->parents_list, list) {
+		if ((list_clean_type == SYNC_LIST_CLEAN_ONE) &&
+			(parent_info->sync_id != sync_obj))
+			continue;
+
+		curr_sync_obj = parent_info->sync_id;
+		list_del_init(&parent_info->list);
+		kfree(parent_info);
+
+		if ((list_clean_type == SYNC_LIST_CLEAN_ONE) &&
+			(curr_sync_obj == sync_obj))
+			break;
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_sync/cam_sync_util.h
@@ -0,0 +1,217 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __CAM_SYNC_UTIL_H__
+#define __CAM_SYNC_UTIL_H__
+
+
+#include "cam_sync_private.h"
+#include "cam_debug_util.h"
+
+extern struct sync_device *sync_dev;
+
+/**
+ * struct cam_sync_check_for_dma_release -
+ *                          Checks if the dma fence being released
+ *                          was created with the sync obj
+ *
+ * @dma_fence_row_idx     : Get DMA fence row idx that is associated with
+ *                          the sync obj
+ * @dma_fence_fd          : Check if DMA fence fd is associated with
+ *                          sync obj
+ * @sync_created_with_dma : Set if the dma fence fd was created
+ *                          with sync obj
+ */
+struct cam_sync_check_for_dma_release {
+	int32_t dma_fence_row_idx;
+	int32_t dma_fence_fd;
+	bool sync_created_with_dma;
+};
+
+/**
+ * struct cam_sync_check_for_synx_release -
+ *                          Checks if the synx obj being released
+ *                          was created with the sync obj
+ *
+ * @synx_obj               : Check if synx obj is associated with
+ *                           sync obj
+ * @synx_obj_row_idx       : Get synx obj row idx that is associated with
+ *                           the sync obj
+ * @sync_created_with_synx : Set if the dma fence fd was created
+ *                           with sync obj
+ */
+struct cam_sync_check_for_synx_release {
+	int32_t synx_obj;
+	int32_t synx_obj_row_idx;
+	bool sync_created_with_synx;
+};
+
+/**
+ * @brief: Finds an empty row in the sync table and sets its corresponding bit
+ * in the bit array
+ *
+ * @param sync_dev : Pointer to the sync device instance
+ * @param idx      : Pointer to an long containing the index found in the bit
+ *                   array
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_util_find_and_set_empty_row(struct sync_device *sync_dev,
+	long *idx);
+
+/**
+ * @brief: Function to initialize an empty row in the sync table. This should be
+ *         called only for individual sync objects.
+ *
+ * @param table : Pointer to the sync objects table
+ * @param idx   : Index of row to initialize
+ * @param name  : Optional string representation of the sync object. Should be
+ *                63 characters or less
+ * @param type  : type of row to be initialized
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_init_row(struct sync_table_row *table,
+	uint32_t idx, const char *name, uint32_t type);
+
+/**
+ * @brief: Function to uninitialize a row in the sync table
+ *
+ * @param table                           : Pointer to the sync objects table
+ * @param idx                             : Index of row to initialize
+ * @optional param check_for_dma_release  : checks for dma fence release
+ * @optional param check_for_synx_release : checks for synx obj release
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_deinit_object(struct sync_table_row *table, uint32_t idx,
+	struct cam_sync_check_for_dma_release *check_for_dma_release,
+	struct cam_sync_check_for_synx_release *check_for_synx_release);
+
+/**
+ * @brief: Function to initialize a row in the sync table when the object is a
+ *         group object, also known as a merged sync object
+ *
+ * @param table     : Pointer to the sync objects table
+ * @param idx       : Index of row to initialize
+ * @param sync_objs : Array of sync objects which will merged
+ *                    or grouped together
+ * @param num_objs  : Number of sync objects in the array
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_init_group_object(struct sync_table_row *table,
+	uint32_t idx,
+	uint32_t *sync_objs,
+	uint32_t num_objs);
+
+/**
+ * @brief: Function to dispatch a kernel callback for a sync callback
+ *
+ * @param cb_dispatch_work : Pointer to the work_struct that needs to be
+ *                           dispatched
+ *
+ * @return None
+ */
+void cam_sync_util_cb_dispatch(struct work_struct *cb_dispatch_work);
+
+/**
+ * @brief: Function to dispatch callbacks for a signaled sync object
+ *
+ * @sync_obj    : Sync object that is signaled
+ * @status      : Status of the signaled object
+ * @evt_param   : Event paramaeter
+ *
+ * @return None
+ */
+void cam_sync_util_dispatch_signaled_cb(int32_t sync_obj,
+	uint32_t status, uint32_t evt_param);
+
+/**
+ * @brief: Function to send V4L event to user space
+ * @param id       : V4L event id to send
+ * @param sync_obj : Sync obj for which event needs to be sent
+ * @param status   : Status of the event
+ * @payload        : Payload that needs to be sent to user space
+ * @len            : Length of the payload
+ * @evt_param      : Event Paramenter
+ *
+ * @return None
+ */
+void cam_sync_util_send_v4l2_event(uint32_t id,
+	uint32_t sync_obj,
+	int status,
+	void *payload,
+	int len,
+	uint32_t evt_param);
+
+/**
+ * @brief: Function which gets the next state of the sync object based on the
+ *         current state and the new state
+ *
+ * @param current_state : Current state of the sync object
+ * @param new_state     : New state of the sync object
+ *
+ * @return Next state of the sync object
+ */
+int cam_sync_util_update_parent_state(struct sync_table_row *parent_row,
+	int new_state);
+
+/**
+ * @brief: Function to clean up the children of a sync object
+ * @row                 : Row whose child list to clean
+ * @list_clean_type     : Clean specific object or clean all objects
+ * @sync_obj            : Sync object to be clean if list clean type is
+ *                          SYNC_LIST_CLEAN_ONE
+ *
+ * @return None
+ */
+void cam_sync_util_cleanup_children_list(struct sync_table_row *row,
+	uint32_t list_clean_type, uint32_t sync_obj);
+
+/**
+ * @brief: Function to clean up the parents of a sync object
+ * @row                 : Row whose parent list to clean
+ * @list_clean_type     : Clean specific object or clean all objects
+ * @sync_obj            : Sync object to be clean if list clean type is
+ *                          SYNC_LIST_CLEAN_ONE
+ *
+ * @return None
+ */
+void cam_sync_util_cleanup_parents_list(struct sync_table_row *row,
+	uint32_t list_clean_type, uint32_t sync_obj);
+
+/**
+ * @brief: Function to dump sync obj & monitor data
+ * @row                 : Row whose data to dump
+ *
+ * @return None
+ */
+void cam_sync_dump_monitor_array(struct sync_table_row *row);
+
+/**
+ * @brief: Function to add a new entry to the monitor table
+ * @idx                 : Index of row to update
+ * @mutex               : Mutex lock when expand monitor table
+ * @mon_data            : Pointer to the monitor data array
+ * @op                  : Operation id
+ *
+ * @return None
+ */
+void cam_generic_fence_update_monitor_array(int idx,
+	struct mutex *lock,
+	struct cam_generic_fence_monitor_data **mon_data,
+	enum cam_fence_op                op);
+
+/**
+ * @brief: Function to dump monitor array for sync/dma/synx
+ * @obj_info             : Monitor object that needs to be dumped
+ *
+ * @return None
+ */
+void cam_generic_fence_dump_monitor_array(
+	struct cam_generic_fence_monitor_obj_info *obj_info);
+
+#endif /* __CAM_SYNC_UTIL_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_cx_ipeak.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_cx_ipeak.c
@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <soc/qcom/cx_ipeak.h>
+
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+static struct cx_ipeak_client *cam_cx_ipeak;
+static int cx_ipeak_level = CAM_NOMINAL_VOTE;
+static int cx_default_ipeak_mask;
+static int cx_current_ipeak_mask;
+static int cam_cx_client_cnt;
+
+int cam_cx_ipeak_register_cx_ipeak(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	soc_info->cam_cx_ipeak_enable = true;
+	soc_info->cam_cx_ipeak_bit = 1 << cam_cx_client_cnt++;
+	cx_default_ipeak_mask |= soc_info->cam_cx_ipeak_bit;
+
+	if (cam_cx_ipeak)
+		goto exit;
+
+	cam_cx_ipeak = cx_ipeak_register(soc_info->dev->of_node,
+		"qcom,cam-cx-ipeak");
+
+	if (cam_cx_ipeak) {
+		goto exit;
+	} else {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+exit:
+	CAM_DBG(CAM_UTIL, "cam_cx_ipeak is enabled for %s\n"
+		"mask = %x cx_default_ipeak_mask = %x",
+		soc_info->dev_name, soc_info->cam_cx_ipeak_bit,
+		cx_default_ipeak_mask);
+	return rc;
+}
+
+int cam_cx_ipeak_update_vote_cx_ipeak(struct cam_hw_soc_info *soc_info,
+	int32_t apply_level)
+{
+	int32_t soc_cx_ipeak_bit = soc_info->cam_cx_ipeak_bit;
+	int ret = 0;
+
+	CAM_DBG(CAM_UTIL, "E: apply_level = %d cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x",
+			apply_level, cx_current_ipeak_mask, soc_cx_ipeak_bit);
+
+	if (apply_level < cx_ipeak_level &&
+		(cx_current_ipeak_mask & soc_cx_ipeak_bit)) {
+		if (cx_current_ipeak_mask == cx_default_ipeak_mask) {
+			ret = cx_ipeak_update(cam_cx_ipeak, false);
+			if (ret)
+				goto exit;
+			CAM_DBG(CAM_UTIL,
+				"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+				"soc_cx_ipeak_bit = %x  %s UNVOTE",
+				apply_level, cx_current_ipeak_mask,
+				soc_cx_ipeak_bit, soc_info->dev_name);
+		}
+		cx_current_ipeak_mask &= (~soc_cx_ipeak_bit);
+		CAM_DBG(CAM_UTIL,
+			"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x  %s DISABLE_BIT",
+			apply_level, cx_current_ipeak_mask,
+			soc_cx_ipeak_bit, soc_info->dev_name);
+		goto exit;
+	} else if (apply_level < cx_ipeak_level) {
+		CAM_DBG(CAM_UTIL,
+			"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x NO AI",
+			apply_level, cx_current_ipeak_mask, soc_cx_ipeak_bit);
+		goto exit;
+	}
+
+	cx_current_ipeak_mask |= soc_cx_ipeak_bit;
+	CAM_DBG(CAM_UTIL,
+		"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+		"soc_cx_ipeak_bit = %x  %s ENABLE_BIT",
+		apply_level, cx_current_ipeak_mask,
+		soc_cx_ipeak_bit, soc_info->dev_name);
+	if (cx_current_ipeak_mask == cx_default_ipeak_mask) {
+		ret = cx_ipeak_update(cam_cx_ipeak, true);
+		if (ret)
+			goto exit;
+		CAM_DBG(CAM_UTIL,
+			"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x  %s VOTE",
+			apply_level, cx_current_ipeak_mask,
+			soc_cx_ipeak_bit, soc_info->dev_name);
+	}
+
+exit:
+	return ret;
+}
+
+int cam_cx_ipeak_unvote_cx_ipeak(struct cam_hw_soc_info *soc_info)
+{
+	int32_t soc_cx_ipeak_bit = soc_info->cam_cx_ipeak_bit;
+
+	CAM_DBG(CAM_UTIL, "E:cx_current_ipeak_mask = %x\n"
+		"soc_cx_ipeak_bit = %x",
+		cx_current_ipeak_mask, soc_cx_ipeak_bit);
+	if (cx_current_ipeak_mask == cx_default_ipeak_mask) {
+		if (cam_cx_ipeak)
+			cx_ipeak_update(cam_cx_ipeak, false);
+		CAM_DBG(CAM_UTIL, "X:cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x UNVOTE",
+			cx_current_ipeak_mask, soc_cx_ipeak_bit);
+	}
+	cx_current_ipeak_mask &= (~soc_cx_ipeak_bit);
+	CAM_DBG(CAM_UTIL, "X:cx_current_ipeak_mask = %x\n"
+		"soc_cx_ipeak_bit = %x",
+		cx_current_ipeak_mask, soc_cx_ipeak_bit);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_cx_ipeak.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_cx_ipeak.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CX_IPEAK_H_
+#define _CAM_CX_IPEAK_H_
+
+#include "cam_soc_util.h"
+
+#ifndef CONFIG_QCOM_CX_IPEAK
+static inline int cam_cx_ipeak_register_cx_ipeak
+	(struct cam_hw_soc_info *soc_info)
+{
+	return 0;
+}
+
+static inline int cam_cx_ipeak_update_vote_cx_ipeak
+	(struct cam_hw_soc_info *soc_info, int32_t apply_level)
+{
+	return 0;
+}
+
+static inline int cam_cx_ipeak_unvote_cx_ipeak
+	(struct cam_hw_soc_info *soc_info)
+{
+	return 0;
+}
+#else
+int cam_cx_ipeak_register_cx_ipeak(struct cam_hw_soc_info *soc_info);
+
+int cam_cx_ipeak_update_vote_cx_ipeak(struct cam_hw_soc_info *soc_info,
+	int32_t apply_level);
+int cam_cx_ipeak_unvote_cx_ipeak(struct cam_hw_soc_info *soc_info);
+#endif
+
+#endif /* _CAM_CX_IPEAK_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_packet_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_packet_util.c
@@ -0,0 +1,830 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/types.h>
+#include <linux/slab.h>
+
+#include "cam_mem_mgr.h"
+#include "cam_packet_util.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+
+#define CAM_UNIQUE_SRC_HDL_MAX 50
+#define CAM_PRESIL_UNIQUE_HDL_MAX 50
+
+struct cam_patch_unique_src_buf_tbl {
+	int32_t       hdl;
+	dma_addr_t    iova;
+	size_t        buf_size;
+	uint32_t      flags;
+};
+
+int cam_packet_util_get_packet_addr(struct cam_packet **packet,
+	uint64_t packet_handle, uint32_t offset)
+{
+	uintptr_t          packet_addr;
+	size_t             len;
+	int                rc = 0;
+
+	if (!packet) {
+		CAM_ERR(CAM_UTIL, "Invalid parameter packet is NULL");
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(packet_handle, &packet_addr,
+		&len);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Failed to get packet address from handle: 0x%llx rc: %d",
+			packet_handle, rc);
+		*packet = NULL;
+		return rc;
+	}
+
+	*packet = (struct cam_packet *)((uint8_t *)packet_addr + offset);
+
+	return rc;
+}
+
+void cam_packet_util_put_packet_addr(uint64_t packet_handle)
+{
+	cam_mem_put_cpu_buf(packet_handle);
+}
+
+int cam_packet_util_get_cmd_mem_addr(int handle, uint32_t **buf_addr,
+	size_t *len)
+{
+	int rc = 0;
+	uintptr_t kmd_buf_addr = 0;
+
+	rc = cam_mem_get_cpu_buf(handle, &kmd_buf_addr, len);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Unable to get the virtual address %d", rc);
+		rc = -EINVAL;
+	} else {
+		if (kmd_buf_addr && *len) {
+			*buf_addr = (uint32_t *)kmd_buf_addr;
+		} else {
+			cam_mem_put_cpu_buf(handle);
+			CAM_ERR(CAM_UTIL, "Invalid addr and length :%zd", *len);
+			rc = -ENOMEM;
+		}
+	}
+	return rc;
+}
+
+int cam_packet_util_validate_cmd_desc(struct cam_cmd_buf_desc *cmd_desc)
+{
+
+	if (!cmd_desc) {
+		CAM_ERR(CAM_UTIL, "Invalid cmd desc");
+		return -EINVAL;
+	}
+
+	if ((cmd_desc->length > cmd_desc->size) ||
+		(cmd_desc->mem_handle <= 0)) {
+		CAM_ERR(CAM_UTIL, "invalid cmd arg %d %d %d %d",
+			cmd_desc->offset, cmd_desc->length,
+			cmd_desc->mem_handle, cmd_desc->size);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_packet_util_validate_packet(struct cam_packet *packet,
+	size_t remain_len)
+{
+	size_t sum_cmd_desc = 0;
+	size_t sum_io_cfgs = 0;
+	size_t sum_patch_desc = 0;
+	size_t pkt_wo_payload = 0;
+
+	if (!packet)
+		return -EINVAL;
+
+	if ((size_t)packet->header.size > remain_len) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid packet size: %zu, CPU buf length: %zu",
+			(size_t)packet->header.size, remain_len);
+		return -EINVAL;
+	}
+
+
+	CAM_DBG(CAM_UTIL, "num cmd buf:%d num of io config:%d kmd buf index:%d",
+		packet->num_cmd_buf, packet->num_io_configs,
+		packet->kmd_cmd_buf_index);
+
+	sum_cmd_desc = packet->num_cmd_buf * sizeof(struct cam_cmd_buf_desc);
+	sum_io_cfgs = packet->num_io_configs * sizeof(struct cam_buf_io_cfg);
+	sum_patch_desc = packet->num_patches * sizeof(struct cam_patch_desc);
+	pkt_wo_payload = offsetof(struct cam_packet, payload);
+
+	if ((!packet->header.size) ||
+		((size_t)packet->header.size <= pkt_wo_payload) ||
+		((pkt_wo_payload + (size_t)packet->cmd_buf_offset +
+		sum_cmd_desc) > (size_t)packet->header.size) ||
+		((pkt_wo_payload + (size_t)packet->io_configs_offset +
+		sum_io_cfgs) > (size_t)packet->header.size) ||
+		((pkt_wo_payload + (size_t)packet->patch_offset +
+		sum_patch_desc) > (size_t)packet->header.size)) {
+		CAM_ERR(CAM_UTIL, "params not within mem len:%zu %zu %zu %zu",
+			(size_t)packet->header.size, sum_cmd_desc,
+			sum_io_cfgs, sum_patch_desc);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_packet_util_get_kmd_buffer(struct cam_packet *packet,
+	struct cam_kmd_buf_info *kmd_buf)
+{
+	int                      rc = 0;
+	size_t                   len = 0;
+	size_t                   remain_len = 0;
+	struct cam_cmd_buf_desc *cmd_desc;
+	uint32_t                *cpu_addr;
+
+	if (!packet || !kmd_buf) {
+		CAM_ERR(CAM_UTIL, "Invalid arg %pK %pK", packet, kmd_buf);
+		return -EINVAL;
+	}
+
+	if (!packet->num_cmd_buf) {
+		CAM_ERR(CAM_UTIL, "Invalid num_cmd_buf = %d", packet->num_cmd_buf);
+		return -EINVAL;
+	}
+
+	if ((packet->kmd_cmd_buf_index < 0) ||
+		(packet->kmd_cmd_buf_index >= packet->num_cmd_buf)) {
+		CAM_ERR(CAM_UTIL, "Invalid kmd buf index: %d",
+			packet->kmd_cmd_buf_index);
+		return -EINVAL;
+	}
+
+	/* Take first command descriptor and add offset to it for kmd*/
+	cmd_desc = (struct cam_cmd_buf_desc *) ((uint8_t *)
+		&packet->payload_flex + packet->cmd_buf_offset);
+	cmd_desc += packet->kmd_cmd_buf_index;
+
+	rc = cam_packet_util_validate_cmd_desc(cmd_desc);
+	if (rc)
+		return rc;
+
+	rc = cam_packet_util_get_cmd_mem_addr(cmd_desc->mem_handle, &cpu_addr,
+		&len);
+	if (rc)
+		return rc;
+
+	remain_len = len;
+	if (((size_t)cmd_desc->offset >= len) ||
+		((size_t)cmd_desc->size > (len - (size_t)cmd_desc->offset))) {
+		CAM_ERR(CAM_UTIL, "invalid memory len:%zd and cmd desc size:%d",
+			len, cmd_desc->size);
+		rc = -EINVAL;
+		goto rel_kmd_buf;
+	}
+
+	remain_len -= (size_t)cmd_desc->offset;
+	if ((size_t)packet->kmd_cmd_buf_offset >= remain_len) {
+		CAM_ERR(CAM_UTIL, "Invalid kmd cmd buf offset: %zu",
+			(size_t)packet->kmd_cmd_buf_offset);
+		rc = -EINVAL;
+		goto rel_kmd_buf;
+	}
+
+	cpu_addr += (cmd_desc->offset / 4) + (packet->kmd_cmd_buf_offset / 4);
+	CAM_DBG(CAM_UTIL, "total size %d, cmd size: %d, KMD buffer size: %d",
+		cmd_desc->size, cmd_desc->length,
+		cmd_desc->size - cmd_desc->length);
+	CAM_DBG(CAM_UTIL, "hdl 0x%x, cmd offset %d, kmd offset %d, addr 0x%pK",
+		cmd_desc->mem_handle, cmd_desc->offset,
+		packet->kmd_cmd_buf_offset, cpu_addr);
+
+	kmd_buf->cpu_addr   = cpu_addr;
+	kmd_buf->handle     = cmd_desc->mem_handle;
+	kmd_buf->offset     = cmd_desc->offset + packet->kmd_cmd_buf_offset;
+	kmd_buf->size       = cmd_desc->size - cmd_desc->length;
+	kmd_buf->used_bytes = 0;
+	return rc;
+
+rel_kmd_buf:
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+void cam_packet_util_dump_patch_info(struct cam_packet *packet,
+	int32_t iommu_hdl, int32_t sec_iommu_hdl, struct cam_hw_dump_pf_args *pf_args)
+{
+	struct cam_patch_desc *patch_desc = NULL;
+	struct cam_context_pf_info *pf_context_info  = NULL;
+	dma_addr_t iova_addr;
+	size_t     dst_buf_len;
+	size_t     src_buf_size;
+	int        i, rc = 0;
+	int32_t    hdl;
+	uintptr_t  cpu_addr = 0;
+	uint32_t  *dst_cpu_addr;
+	uint32_t   flags, buf_fd;
+	uint32_t   value = 0;
+
+	if (!packet) {
+		CAM_ERR(CAM_UTIL, "Invalid packet");
+		return;
+	}
+
+	patch_desc = (struct cam_patch_desc *)
+			((uint32_t *) &packet->payload_flex +
+			packet->patch_offset/4);
+
+	if (pf_args) {
+		pf_context_info = &(pf_args->pf_context_info);
+		buf_fd = pf_args->pf_smmu_info->buf_info;
+	}
+
+	CAM_INFO(CAM_UTIL, "Total num of patches : %d",
+		packet->num_patches);
+
+	for (i = 0; i < packet->num_patches; i++) {
+		hdl = cam_mem_is_secure_buf(patch_desc[i].src_buf_hdl) ?
+			sec_iommu_hdl : iommu_hdl;
+		rc = cam_mem_get_io_buf(patch_desc[i].src_buf_hdl,
+			hdl, &iova_addr, &src_buf_size, &flags, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_UTIL,
+				"unable to get src buf address for hdl 0x%x",
+				hdl);
+			return;
+		}
+
+		if (pf_args &&
+			GET_FD_FROM_HANDLE(patch_desc[i].src_buf_hdl) == buf_fd &&
+			pf_context_info->mem_type == CAM_FAULT_BUF_NOT_FOUND) {
+			/* found PF at this hdl */
+			pf_context_info->mem_type = CAM_FAULT_PATCH_BUF;
+			pf_context_info->patch_idx = i;
+			pf_context_info->buf_hdl = patch_desc[i].src_buf_hdl;
+			pf_context_info->offset = patch_desc[i].src_offset;
+			pf_context_info->mem_flag = flags;
+			pf_context_info->delta =
+				CAM_SMMU_GET_IOVA_DELTA(pf_args->pf_smmu_info->iova, iova_addr);
+			pf_context_info->req_id = packet->header.request_id;
+			pf_context_info->ctx_found = true;
+
+			CAM_ERR(CAM_UTIL, "Found PF at patch: %d src buf hdl: 0x%llx",
+				i, patch_desc[i].src_buf_hdl);
+		}
+
+		rc = cam_mem_get_cpu_buf(patch_desc[i].dst_buf_hdl,
+			&cpu_addr, &dst_buf_len);
+		if (rc < 0 || !cpu_addr || (dst_buf_len == 0)) {
+			CAM_ERR(CAM_UTIL, "unable to get dst buf address");
+			return;
+		}
+
+		dst_cpu_addr = (uint32_t *)cpu_addr;
+		dst_cpu_addr = (uint32_t *)((uint8_t *)dst_cpu_addr +
+			patch_desc[i].dst_offset);
+		value = *dst_cpu_addr;
+		CAM_INFO(CAM_UTIL,
+			"i = %d src_buf 0x%llx src_hdl 0x%x src_buf_with_offset 0x%llx src_size 0x%llx src_flags: %x dst %p dst_offset %u dst_hdl 0x%x value 0x%x",
+			i, iova_addr, patch_desc[i].src_buf_hdl,
+			(iova_addr + patch_desc[i].src_offset),
+			src_buf_size, flags, dst_cpu_addr,
+			patch_desc[i].dst_offset,
+			patch_desc[i].dst_buf_hdl, value);
+
+		if (!(*dst_cpu_addr))
+			CAM_ERR(CAM_ICP, "Null at dst addr %p", dst_cpu_addr);
+
+		cam_mem_put_cpu_buf(patch_desc[i].dst_buf_hdl);
+	}
+}
+
+static int cam_packet_util_get_patch_iova(
+	struct cam_patch_unique_src_buf_tbl *tbl,
+	int32_t hdl, uint32_t buf_hdl, dma_addr_t *iova,
+	size_t *buf_size, uint32_t *flags, struct list_head *mapped_io_list)
+{
+	int idx = 0;
+	int rc = 0;
+	size_t src_buf_size;
+	dma_addr_t iova_addr;
+	bool is_found = false;
+
+	for (idx = 0; idx < CAM_UNIQUE_SRC_HDL_MAX; idx++) {
+		if (buf_hdl == tbl[idx].hdl) {
+			CAM_DBG(CAM_UTIL,
+				"Matched entry for src_buf_hdl: 0x%x with src_hdl[%d]: 0x%x",
+				buf_hdl, idx, tbl[idx].hdl);
+			*iova = tbl[idx].iova;
+			*buf_size = tbl[idx].buf_size;
+			*flags = tbl[idx].flags;
+			is_found = true;
+			break;
+		} else if ((tbl[idx].hdl == 0) || (tbl[idx].iova == 0)) {
+			CAM_DBG(CAM_UTIL, "New src handle detected 0x%x", buf_hdl);
+			is_found = false;
+			break;
+		}
+		CAM_DBG(CAM_UTIL,
+			"Index: %d is filled with differnt src_hdl: 0x%x",
+			idx, buf_hdl);
+	}
+
+	if (!is_found) {
+		CAM_DBG(CAM_UTIL, "src_hdl 0x%x not found in table entries",
+			buf_hdl);
+		rc = cam_mem_get_io_buf(buf_hdl, hdl, &iova_addr, &src_buf_size, flags,
+			mapped_io_list);
+		if (rc < 0) {
+			CAM_ERR(CAM_UTIL,
+				"unable to get iova for src_hdl: 0x%x",
+				buf_hdl);
+			return rc;
+		}
+		/* Update the table entry with unique src buf handle */
+		if (idx < CAM_UNIQUE_SRC_HDL_MAX && tbl[idx].hdl == 0) {
+			tbl[idx].buf_size = src_buf_size;
+			tbl[idx].iova = iova_addr;
+			tbl[idx].hdl = buf_hdl;
+			tbl[idx].flags = *flags;
+			CAM_DBG(CAM_UTIL,
+				"Updated table index: %d with src_buf_hdl: 0x%x flags: %x",
+				idx, tbl[idx].hdl, *flags);
+		}
+		*iova = iova_addr;
+		*buf_size = src_buf_size;
+	}
+
+	return rc;
+}
+
+int cam_packet_util_process_patches(struct cam_packet *packet,
+	struct list_head *mapped_io_list, int32_t iommu_hdl, int32_t sec_mmu_hdl,
+	bool exp_mem)
+{
+	struct cam_patch_desc *patch_desc = NULL;
+	dma_addr_t iova_addr;
+	uintptr_t  cpu_addr = 0;
+	dma_addr_t temp;
+	uint32_t  *dst_cpu_addr;
+	size_t     dst_buf_len;
+	size_t     src_buf_size;
+	int        i  = 0;
+	int        rc = 0;
+	uint32_t   flags = 0;
+	int32_t hdl;
+	struct cam_patch_unique_src_buf_tbl
+		tbl[CAM_UNIQUE_SRC_HDL_MAX];
+
+	memset(tbl, 0, CAM_UNIQUE_SRC_HDL_MAX *
+		sizeof(struct cam_patch_unique_src_buf_tbl));
+
+	/* process patch descriptor */
+	patch_desc = (struct cam_patch_desc *)
+			((uint32_t *) &packet->payload_flex +
+			packet->patch_offset/4);
+	CAM_DBG(CAM_UTIL, "packet = %pK patch_desc = %pK size = %lu",
+			(void *)packet, (void *)patch_desc,
+			sizeof(struct cam_patch_desc));
+
+	for (i = 0; i < packet->num_patches; i++) {
+		hdl = cam_mem_is_secure_buf(patch_desc[i].src_buf_hdl) ?
+			sec_mmu_hdl : iommu_hdl;
+
+		rc = cam_packet_util_get_patch_iova(&tbl[0], hdl, patch_desc[i].src_buf_hdl,
+			&iova_addr, &src_buf_size, &flags, mapped_io_list);
+
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"get_iova failed for patch[%d], src_buf_hdl: 0x%x: rc: %d",
+				i, patch_desc[i].src_buf_hdl, rc);
+			return rc;
+		}
+
+		if ((size_t)patch_desc[i].src_offset >= src_buf_size) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid src buf patch offset: patch:src_offset: 0x%x, src_buf_size: %zu",
+				patch_desc[i].src_offset, src_buf_size);
+			return -EINVAL;
+		}
+
+		temp = iova_addr;
+
+		rc = cam_mem_get_cpu_buf(patch_desc[i].dst_buf_hdl,
+			&cpu_addr, &dst_buf_len);
+		if (rc < 0 || !cpu_addr || (dst_buf_len == 0)) {
+			CAM_ERR(CAM_UTIL, "unable to get dst buf address");
+			return rc;
+		}
+		dst_cpu_addr = (uint32_t *)cpu_addr;
+
+		CAM_DBG(CAM_UTIL, "i = %d patch info = %x %x %x %x", i,
+			patch_desc[i].dst_buf_hdl, patch_desc[i].dst_offset,
+			patch_desc[i].src_buf_hdl, patch_desc[i].src_offset);
+
+		if ((dst_buf_len < sizeof(void *)) ||
+			((dst_buf_len - sizeof(void *)) <
+			(size_t)patch_desc[i].dst_offset)) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid dst buf patch offset");
+			cam_mem_put_cpu_buf((int32_t)patch_desc[i].dst_buf_hdl);
+			return -EINVAL;
+		}
+
+		dst_cpu_addr = (uint32_t *)((uint8_t *)dst_cpu_addr +
+			patch_desc[i].dst_offset);
+		temp += patch_desc[i].src_offset;
+
+		if (exp_mem && cam_smmu_is_expanded_memory()) {
+			if ((flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) ||
+				(flags & CAM_MEM_FLAG_CMD_BUF_TYPE)) {
+				*dst_cpu_addr = temp;
+			} else {
+				if (CAM_36BIT_INTF_GET_IOVA_OFFSET(temp))
+					CAM_ERR(CAM_UTIL,
+						"Buffer address 0x%lx not aligned to 256bytes",
+						temp);
+
+				*dst_cpu_addr = CAM_36BIT_INTF_GET_IOVA_BASE(temp);
+			}
+		} else {
+			*dst_cpu_addr = temp;
+		}
+
+		CAM_DBG(CAM_UTIL,
+			"patch is done for dst %pK with base iova 0x%lx final iova 0x%lx patched value 0x%x, shared=%s, cmd=%s, HwAndCDM %s",
+			dst_cpu_addr, iova_addr, temp, *dst_cpu_addr,
+			CAM_BOOL_TO_YESNO(flags & CAM_MEM_FLAG_HW_SHARED_ACCESS),
+			CAM_BOOL_TO_YESNO(flags & CAM_MEM_FLAG_CMD_BUF_TYPE),
+			CAM_BOOL_TO_YESNO(flags & CAM_MEM_FLAG_HW_AND_CDM_OR_SHARED));
+		cam_mem_put_cpu_buf((int32_t)patch_desc[i].dst_buf_hdl);
+	}
+
+	return rc;
+}
+
+void cam_packet_util_dump_io_bufs(struct cam_packet *packet,
+	int32_t iommu_hdl, int32_t sec_mmu_hdl,
+	struct cam_hw_dump_pf_args *pf_args, bool res_id_support)
+{
+	struct cam_buf_io_cfg      *io_cfg;
+	struct cam_context_pf_info *pf_context_info;
+	int32_t        mmu_hdl, buf_fd;
+	dma_addr_t     iova_addr;
+	size_t         src_buf_size;
+	int            i, j, rc = 0;
+	uint32_t       resource_type;
+
+	if (!packet) {
+		CAM_ERR(CAM_UTIL, "Invalid packet");
+		return;
+	}
+
+	io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload_flex +
+		packet->io_configs_offset / 4);
+
+	buf_fd = pf_args->pf_smmu_info->buf_info;
+	pf_context_info = &(pf_args->pf_context_info);
+	resource_type = pf_context_info->resource_type;
+
+	for (i = 0; i < packet->num_io_configs; i++) {
+		if (res_id_support && io_cfg[i].resource_type !=
+			pf_context_info->resource_type)
+			continue;
+
+		for (j = 0; j < CAM_PACKET_MAX_PLANES; j++) {
+			if (!io_cfg[i].mem_handle[j])
+				break;
+
+			CAM_INFO(CAM_UTIL, "port: 0x%x f: %u format: %d dir %d",
+				io_cfg[i].resource_type,
+				io_cfg[i].fence,
+				io_cfg[i].format,
+				io_cfg[i].direction);
+
+			mmu_hdl = cam_mem_is_secure_buf(
+				io_cfg[i].mem_handle[j]) ? sec_mmu_hdl :
+				iommu_hdl;
+			rc = cam_mem_get_io_buf(io_cfg[i].mem_handle[j],
+				mmu_hdl, &iova_addr, &src_buf_size, NULL, NULL);
+			if (rc < 0) {
+				CAM_ERR(CAM_UTIL,
+					"get src buf address fail mem_handle 0x%x",
+					io_cfg[i].mem_handle[j]);
+				continue;
+			}
+			if (GET_FD_FROM_HANDLE(io_cfg[i].mem_handle[j]) == buf_fd) {
+				pf_context_info->mem_type = CAM_FAULT_IO_CFG_BUF;
+				pf_context_info->buf_hdl = io_cfg[i].mem_handle[j];
+				pf_context_info->offset = io_cfg[i].offsets[j];
+				pf_context_info->resource_type = io_cfg[i].resource_type;
+				pf_context_info->delta =
+					CAM_SMMU_GET_IOVA_DELTA(pf_args->pf_smmu_info->iova,
+						iova_addr);
+				pf_context_info->req_id = packet->header.request_id;
+				pf_context_info->ctx_found = true;
+
+				resource_type = pf_context_info->resource_type;
+				CAM_INFO(CAM_UTIL,
+					"Found PF at port: 0x%x mem 0x%x fd: %d plane id: %d delta: %llu",
+					io_cfg[i].resource_type,
+					io_cfg[i].mem_handle[j],
+					buf_fd,
+					j, pf_context_info->delta);
+			}
+			CAM_INFO(CAM_UTIL,
+				"pln %d w %d h %d s %u size %zu addr 0x%llx end_addr 0x%llx offset %u memh 0x%x",
+				j, io_cfg[i].planes[j].width,
+				io_cfg[i].planes[j].height,
+				io_cfg[i].planes[j].plane_stride,
+				src_buf_size, iova_addr,
+				iova_addr + src_buf_size,
+				io_cfg[i].offsets[j],
+				io_cfg[i].mem_handle[j]);
+		}
+
+		if (res_id_support)
+			return;
+	}
+
+	if (res_id_support)
+		CAM_ERR(CAM_UTIL,
+			"getting io port for mid resource id failed req id: %llu res id: 0x%x",
+			packet->header.request_id, resource_type);
+
+}
+
+int cam_packet_util_process_generic_cmd_buffer(
+	struct cam_cmd_buf_desc *cmd_buf,
+	cam_packet_generic_blob_handler blob_handler_cb, void *user_data)
+{
+	int       rc = 0;
+	uintptr_t  cpu_addr = 0;
+	size_t    buf_size;
+	size_t    remain_len = 0;
+	uint32_t *blob_ptr;
+	uint32_t  blob_type, blob_size, blob_block_size, len_read;
+
+	if (!cmd_buf || !blob_handler_cb) {
+		CAM_ERR(CAM_UTIL, "Invalid args %pK %pK",
+			cmd_buf, blob_handler_cb);
+		return -EINVAL;
+	}
+
+	if (!cmd_buf->length || !cmd_buf->size) {
+		CAM_ERR(CAM_UTIL, "Invalid cmd buf size %d %d",
+			cmd_buf->length, cmd_buf->size);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(cmd_buf->mem_handle, &cpu_addr, &buf_size);
+	if (rc || !cpu_addr || (buf_size == 0)) {
+		CAM_ERR(CAM_UTIL, "Failed in Get cpu addr, rc=%d, cpu_addr=%pK",
+			rc, (void *)cpu_addr);
+		return rc;
+	}
+
+	remain_len = buf_size;
+	if ((buf_size < sizeof(uint32_t)) ||
+		((size_t)cmd_buf->offset > (buf_size - sizeof(uint32_t)))) {
+		CAM_ERR(CAM_UTIL, "Invalid offset for cmd buf: %zu",
+			(size_t)cmd_buf->offset);
+		rc = -EINVAL;
+		goto end;
+	}
+	remain_len -= (size_t)cmd_buf->offset;
+
+	if (remain_len < (size_t)cmd_buf->length) {
+		CAM_ERR(CAM_UTIL, "Invalid length for cmd buf: %zu",
+			(size_t)cmd_buf->length);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	blob_ptr = (uint32_t *)(((uint8_t *)cpu_addr) +
+		cmd_buf->offset);
+
+	CAM_DBG(CAM_UTIL,
+		"GenericCmdBuffer cpuaddr=%pK, blobptr=%pK, len=%d",
+		(void *)cpu_addr, (void *)blob_ptr, cmd_buf->length);
+
+	len_read = 0;
+	while (len_read < cmd_buf->length) {
+		blob_type =
+			((*blob_ptr) & CAM_GENERIC_BLOB_CMDBUFFER_TYPE_MASK) >>
+			CAM_GENERIC_BLOB_CMDBUFFER_TYPE_SHIFT;
+		blob_size =
+			((*blob_ptr) & CAM_GENERIC_BLOB_CMDBUFFER_SIZE_MASK) >>
+			CAM_GENERIC_BLOB_CMDBUFFER_SIZE_SHIFT;
+
+		blob_block_size = sizeof(uint32_t) +
+			(((blob_size + sizeof(uint32_t) - 1) /
+			sizeof(uint32_t)) * sizeof(uint32_t));
+
+		CAM_DBG(CAM_UTIL,
+			"Blob type=%d size=%d block_size=%d len_read=%d total=%d",
+			blob_type, blob_size, blob_block_size, len_read,
+			cmd_buf->length);
+
+		if (len_read + blob_block_size > cmd_buf->length) {
+			CAM_ERR(CAM_UTIL, "Invalid Blob %d %d %d %d",
+				blob_type, blob_size, len_read,
+				cmd_buf->length);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		len_read += blob_block_size;
+
+		rc = blob_handler_cb(user_data, blob_type, blob_size,
+			(uint8_t *)(blob_ptr + 1));
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Error in handling blob type %d %d",
+				blob_type, blob_size);
+			goto end;
+		}
+
+		blob_ptr += (blob_block_size / sizeof(uint32_t));
+	}
+
+end:
+	cam_mem_put_cpu_buf(cmd_buf->mem_handle);
+	return rc;
+}
+
+int cam_presil_retrieve_buffers_from_packet(struct cam_packet *packet, int iommu_hdl,
+	int out_res_id)
+{
+	int rc = 0, i, j;
+	struct cam_buf_io_cfg   *io_cfg = NULL;
+	dma_addr_t               io_addr[CAM_PACKET_MAX_PLANES];
+	size_t                   size;
+
+	if (!packet || (iommu_hdl < 0)) {
+		CAM_ERR(CAM_PRESIL, "Invalid params packet %pK iommu_hdl: %d", packet, iommu_hdl);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_PRESIL, "Retrieving output buffer corresponding to res: 0x%x", out_res_id);
+	io_cfg = (struct cam_buf_io_cfg *)((uint8_t *)&packet->payload_flex +
+		packet->io_configs_offset);
+	for (i = 0; i < packet->num_io_configs; i++) {
+		if ((io_cfg[i].direction != CAM_BUF_OUTPUT) ||
+			(io_cfg[i].resource_type != out_res_id))
+			continue;
+
+		memset(io_addr, 0, sizeof(io_addr));
+		for (j = 0; j < CAM_PACKET_MAX_PLANES; j++) {
+			if (!io_cfg[i].mem_handle[j])
+				break;
+
+			rc = cam_mem_get_io_buf(io_cfg[i].mem_handle[j], iommu_hdl, &io_addr[j],
+				&size, NULL, NULL);
+			if (rc) {
+				CAM_ERR(CAM_PRESIL, "no io addr for plane%d", j);
+				rc = -ENOMEM;
+				return rc;
+			}
+
+			/* For presil, address should be within 32 bit */
+			if (io_addr[j] >> 32) {
+				CAM_ERR(CAM_PRESIL,
+					"Invalid address, presil mapped address should be 32 bit");
+				rc = -EINVAL;
+				return rc;
+			}
+
+			CAM_INFO(CAM_PRESIL,
+				"Retrieving IO CFG buffer:%d addr: 0x%x offset 0x%x res_id: 0x%x",
+				io_cfg[i].mem_handle[j], io_addr[j], io_cfg[i].offsets[j],
+				io_cfg[i].resource_type);
+			cam_mem_mgr_retrieve_buffer_from_presil(io_cfg[i].mem_handle[j], size,
+				io_cfg[i].offsets[j], iommu_hdl);
+		}
+	}
+
+	return rc;
+}
+
+static void cam_presil_add_unique_buf_hdl_to_list(int32_t buf_hdl,
+	int32_t *hdl_list, int *num_hdls, int max_handles)
+{
+	int k;
+	bool hdl_found = false;
+
+	if (!buf_hdl)
+		return;
+
+	if (*num_hdls >= max_handles) {
+		CAM_ERR(CAM_PRESIL, "Failed to add entry num_hdls: %d max_handles:%d", *num_hdls,
+			max_handles);
+		return;
+	}
+
+	for (k = 0; k < *num_hdls; k++) {
+		if (hdl_list[k] == buf_hdl) {
+			hdl_found = true;
+			break;
+		}
+	}
+
+	if (!hdl_found)
+		hdl_list[(*num_hdls)++] = buf_hdl;
+}
+
+int cam_presil_send_buffers_from_packet(struct cam_packet *packet, int img_iommu_hdl,
+	int cdm_iommu_hdl)
+{
+	struct cam_buf_io_cfg   *io_cfg = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct cam_patch_desc *patch_desc = NULL;
+	int  i, j, rc = 0;
+	int32_t unique_img_buffers[CAM_PRESIL_UNIQUE_HDL_MAX] = {0};
+	int32_t unique_cmd_buffers[CAM_PRESIL_UNIQUE_HDL_MAX] = {0};
+	int num_img_handles = 0, num_cmd_handles = 0;
+
+	if(!packet) {
+		CAM_ERR(CAM_PRESIL, "Packet is NULL");
+		return -EINVAL;
+	}
+
+	if (img_iommu_hdl == -1) {
+		goto send_cmd_buffers;
+	}
+
+	/* Adding IO config buffer handles to list*/
+	io_cfg = (struct cam_buf_io_cfg *)((uint8_t *)&packet->payload_flex +
+		packet->io_configs_offset);
+	for (i = 0; i < packet->num_io_configs; i++) {
+		if (io_cfg[i].direction == CAM_BUF_OUTPUT)
+			continue;
+
+		for (j = 0; j < CAM_PACKET_MAX_PLANES; j++) {
+			if (!io_cfg[i].mem_handle[j])
+				break;
+
+			CAM_DBG(CAM_PRESIL, "Adding IO CFG buffer:%d", io_cfg[i].mem_handle[j]);
+			cam_presil_add_unique_buf_hdl_to_list(io_cfg[i].mem_handle[j],
+				unique_img_buffers, &num_img_handles, CAM_PRESIL_UNIQUE_HDL_MAX);
+		}
+	}
+
+	for (i = 0; i < num_img_handles; i++) {
+		CAM_DBG(CAM_PRESIL, "Sending Image buffer i:%d mem_handle:%d", i,
+			unique_img_buffers[i]);
+		rc = cam_mem_mgr_send_buffer_to_presil(img_iommu_hdl,
+			unique_img_buffers[i]);
+		if (rc) {
+			CAM_ERR(CAM_PRESIL, "Failed to send buffer i:%d mem_handle:%d rc:%d",
+					i, unique_img_buffers[i], rc);
+			return rc;
+		}
+	}
+
+send_cmd_buffers:
+	if (cdm_iommu_hdl == -1) {
+		goto end;
+	}
+
+	/* Adding CMD buffer handles to list*/
+	cmd_desc = (struct cam_cmd_buf_desc *) ((uint8_t *)&packet->payload_flex +
+		packet->cmd_buf_offset);
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		CAM_DBG(CAM_PRESIL, "Adding CMD buffer:%d", cmd_desc[i].mem_handle);
+		cam_presil_add_unique_buf_hdl_to_list(cmd_desc[i].mem_handle,
+				unique_cmd_buffers, &num_cmd_handles, CAM_PRESIL_UNIQUE_HDL_MAX);
+	}
+
+	/* Adding Patch src buffer handles to list */
+	patch_desc = (struct cam_patch_desc *) ((uint8_t *)&packet->payload_flex +
+		packet->patch_offset);
+	for (i = 0; i < packet->num_patches; i++) {
+		CAM_DBG(CAM_PRESIL, "Adding Patch src buffer:%d", patch_desc[i].src_buf_hdl);
+		cam_presil_add_unique_buf_hdl_to_list(patch_desc[i].src_buf_hdl,
+				unique_cmd_buffers, &num_cmd_handles, CAM_PRESIL_UNIQUE_HDL_MAX);
+	}
+
+	for (i = 0; i < num_cmd_handles; i++) {
+		CAM_DBG(CAM_PRESIL, "Sending Command buffer i:%d mem_handle:%d", i,
+			unique_cmd_buffers[i]);
+		rc = cam_mem_mgr_send_buffer_to_presil(cdm_iommu_hdl,
+			unique_cmd_buffers[i]);
+		if (rc) {
+			CAM_ERR(CAM_PRESIL, "Failed to send buffer i:%d mem_handle:%d rc:%d",
+					i, unique_cmd_buffers[i], rc);
+			return rc;
+		}
+	}
+
+end:
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_packet_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_packet_util.h
@@ -0,0 +1,208 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_PACKET_UTIL_H_
+#define _CAM_PACKET_UTIL_H_
+
+#include <media/cam_defs.h>
+#include "cam_hw_mgr_intf.h"
+
+/**
+ * @brief                  KMD scratch buffer information
+ *
+ * @handle:                Memory handle
+ * @cpu_addr:              Cpu address
+ * @offset:                Offset from the start of the buffer
+ * @size:                  Size of the buffer in bytes
+ * @used_bytes:            Used memory in bytes
+ *
+ */
+struct cam_kmd_buf_info {
+	int        handle;
+	uint32_t  *cpu_addr;
+	uint32_t   offset;
+	uint32_t   size;
+	uint32_t   used_bytes;
+};
+
+/* Generic Cmd Buffer blob callback function type */
+typedef int (*cam_packet_generic_blob_handler)(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data);
+
+/**
+ * @brief                  Get packet buffer address
+ *
+ * @packet:                Pointer to packet to be retrieved
+ * @packet_handle:         Buffer handle of the packet
+ * @offset:                offset to packet start address
+ *
+ * @return:                0 for success
+ */
+int cam_packet_util_get_packet_addr(struct cam_packet **packet,
+	uint64_t packet_handle, uint32_t offset);
+
+
+/**
+ * @brief                  Put packet buffer address
+ *
+ * @packet_handle:         Buffer handle of the packet
+ */
+void cam_packet_util_put_packet_addr(uint64_t packet_handle);
+
+/**
+ * cam_packet_util_get_cmd_mem_addr()
+ *
+ * @brief                  Get command buffer address
+ *
+ * @handle:                Command buffer memory handle
+ * @buf_addr:              Command buffer cpu mapped address
+ * @len:                   Command buffer length
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_packet_util_get_cmd_mem_addr(int handle, uint32_t **buf_addr,
+	size_t *len);
+
+/**
+ * cam_packet_util_validate_packet()
+ *
+ * @brief                  Validate the packet
+ *
+ * @packet:                Packet to be validated
+ *
+ * @remain_len:            CPU buff length after config offset
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_packet_util_validate_packet(struct cam_packet *packet,
+	size_t remain_len);
+
+/**
+ * cam_packet_util_validate_cmd_desc()
+ *
+ * @brief                  Validate the packet
+ *
+ * @cmd_desc:              Command descriptor to be validated
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_packet_util_validate_cmd_desc(struct cam_cmd_buf_desc *cmd_desc);
+
+/**
+ * cam_packet_util_get_kmd_buffer()
+ *
+ * @brief                  Get the kmd buffer from the packet command descriptor
+ *
+ * @packet:                Packet data
+ * @kmd_buf:               Extracted the KMD buffer information
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_packet_util_get_kmd_buffer(struct cam_packet *packet,
+	struct cam_kmd_buf_info *kmd_buf_info);
+
+/**
+ * cam_packet_util_dump_patch_info()
+ *
+ * @brief:              Dump patch info in case of page fault
+ *
+ * @packet:             Input packet containing Command Buffers and Patches
+ * @iommu_hdl:          IOMMU handle of the HW Device that received the packet
+ * @sec_iommu_hdl:      Secure IOMMU handle of the HW Device that
+ *                      received the packet
+ * @pf_args:            Page fault arguments
+ *
+ */
+void cam_packet_util_dump_patch_info(struct cam_packet *packet,
+	int32_t iommu_hdl, int32_t sec_iommu_hdl, struct cam_hw_dump_pf_args *pf_args);
+
+/**
+ * cam_packet_util_process_patches()
+ *
+ * @brief:              Replace the handle in Packet to Address using the
+ *                      information from patches.
+ *
+ * @packet:             Input packet containing Command Buffers and Patches
+ * @mapped_io_list:     List in to add patches/buffers to for reference counting
+ * @iommu_hdl:          IOMMU handle of the HW Device that received the packet
+ * @sec_iommu_hdl:      Secure IOMMU handle of the HW Device that
+ *                      received the packet
+ * @exp_mem:            Boolean to know if patched address is in expanded memory range
+ *                      or within default 32-bit address space.
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_packet_util_process_patches(struct cam_packet *packet,
+	struct list_head *mapped_io_list,  int32_t iommu_hdl, int32_t sec_mmu_hdl,
+	bool exp_mem);
+
+/**
+ * cam_packet_util_dump_io_bufs()
+ *
+ * @brief:              Search for faulted io buffer in packet and print io buffers info
+ *
+ * @packet:             Input packet containing io buffers
+ * @iommu_hdl:          IOMMU handle of the HW Device that received the packet
+ * @sec_iommu_hdl:      Secure IOMMU handle of the HW Device that
+ *                      received the packet
+ * @pf_args:            Pault Fault related info
+ * @res_id_support:     if the specific device has knowledge of the resource id for hw
+ */
+
+void cam_packet_util_dump_io_bufs(struct cam_packet *packet,
+	int32_t iommu_hdl, int32_t sec_mmu_hdl,
+	struct cam_hw_dump_pf_args *pf_args, bool res_id_support);
+
+/**
+ * cam_packet_util_process_generic_cmd_buffer()
+ *
+ * @brief:              Process Generic Blob command buffer. This utility
+ *                      function process the command buffer and calls the
+ *                      blob_handle_cb callback for each blob that exists
+ *                      in the command buffer.
+ *
+ * @cmd_buf:            Generic Blob Cmd Buffer handle
+ * @blob_handler_cb:    Callback pointer to call for each blob exists in the
+ *                      command buffer
+ * @user_data:          User data to be passed while callback
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_packet_util_process_generic_cmd_buffer(
+	struct cam_cmd_buf_desc *cmd_buf,
+	cam_packet_generic_blob_handler blob_handler_cb, void *user_data);
+
+/**
+ * @brief :            API to retrieve image buffers from presil after processing is
+ *                     done,using packet from request
+ *
+ * @packet:            Packet pointer for current request
+ * @iommu_hdl:         IOMMU hdl for Image buffers
+ * @out_res_id:        Resource ID corresponding to the output buffer
+ *
+ * @return:            Success or Failure
+ */
+int cam_presil_retrieve_buffers_from_packet(struct cam_packet *packet, int iommu_hdl,
+	int out_res_id);
+
+/**
+ * @brief : API to send relevant buffers to presil
+ *
+ * @packet :            Packet pointer for current request
+ * @img_iommu_hdl:      IOMMU hdl for Image buffers
+ * @cdm_iommu_hdl:      IOMMU hdl for cdm buffers
+ *
+ */
+int cam_presil_send_buffers_from_packet(struct cam_packet *packet, int img_iommu_hdl,
+	int cdm_iommu_hdl);
+
+#endif /* _CAM_PACKET_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_soc_bus.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_soc_bus.c
@@ -0,0 +1,234 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/msm-bus.h>
+#include "cam_soc_bus.h"
+
+/**
+ * struct cam_soc_bus_client_data : Bus client data
+ *
+ * @pdata: Bus pdata information
+ * @client_id: Bus client id
+ * @num_paths: Number of paths for this client
+ * @curr_vote_level: current voted index
+ * @dyn_vote: whether dynamic voting enabled
+ */
+struct cam_soc_bus_client_data {
+	struct msm_bus_scale_pdata *pdata;
+	uint32_t client_id;
+	int num_paths;
+	unsigned int curr_vote_level;
+	bool dyn_vote;
+};
+
+int cam_soc_bus_client_update_request(void *client, unsigned int idx)
+{
+	int rc = 0;
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) client;
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+
+	if (bus_client_data->dyn_vote) {
+		CAM_ERR(CAM_UTIL,
+			"Dyn update not allowed client[%d][%s], dyn_vote: %d",
+			bus_client_data->client_id,
+			bus_client->common_data->name,
+			bus_client_data->dyn_vote);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (idx >= bus_client->common_data->num_usecases) {
+		CAM_ERR(CAM_UTIL, "Invalid vote level=%d, usecases=%d", idx,
+			bus_client->common_data->num_usecases);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_PERF, "Bus client=[%d][%s] index[%d]",
+		bus_client_data->client_id, bus_client->common_data->name, idx);
+
+	rc = msm_bus_scale_client_update_request(bus_client_data->client_id,
+		idx);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Update request failed, client[%d][%s], idx: %d",
+			bus_client_data->client_id,
+			bus_client->common_data->name, idx);
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+int cam_soc_bus_client_update_bw(void *client, uint64_t ab, uint64_t ib,
+	enum cam_soc_bus_path_data bus_path_data)
+{
+	int idx = 0;
+	struct msm_bus_paths *path;
+	struct msm_bus_scale_pdata *pdata;
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) client;
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+	int rc = 0;
+
+	if ((bus_client->common_data->num_usecases != 2) ||
+		(bus_client_data->num_paths != 1) ||
+		(!bus_client_data->dyn_vote)) {
+		CAM_ERR(CAM_UTIL,
+			"dynamic update not allowed Bus client=[%d][%s], %d %d %d",
+			bus_client_data->client_id,
+			bus_client->common_data->name,
+			bus_client->common_data->num_usecases,
+			bus_client_data->num_paths,
+			bus_client_data->dyn_vote);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	idx = bus_client_data->curr_vote_level;
+	idx = 1 - idx;
+	bus_client_data->curr_vote_level = idx;
+
+	pdata = bus_client_data->pdata;
+	path = &(pdata->usecase[idx]);
+	path->vectors[0].ab = ab;
+	path->vectors[0].ib = ib;
+
+	CAM_DBG(CAM_PERF, "Bus client=[%d][%s] :ab[%llu] ib[%llu], index[%d]",
+		bus_client_data->client_id, bus_client->common_data->name, ab,
+		ib, idx);
+	rc = msm_bus_scale_client_update_request(bus_client_data->client_id,
+		idx);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Update request failed, client[%d][%s], idx: %d",
+			bus_client_data->client_id,
+			bus_client->common_data->name, idx);
+		return rc;
+	}
+
+end:
+	return rc;
+}
+
+int cam_soc_bus_client_register(struct platform_device *pdev,
+	struct device_node *dev_node, void **client,
+	struct cam_soc_bus_client_common_data *common_data, bool use_path_name)
+{
+	struct msm_bus_scale_pdata *pdata = NULL;
+	struct cam_soc_bus_client *bus_client = NULL;
+	struct cam_soc_bus_client_data *bus_client_data = NULL;
+	uint32_t client_id;
+	int rc;
+
+	bus_client = kzalloc(sizeof(struct cam_soc_bus_client), GFP_KERNEL);
+	if (!bus_client) {
+		CAM_ERR(CAM_UTIL, "Non Enought Memroy");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	*client = bus_client;
+
+	bus_client_data = kzalloc(sizeof(struct cam_soc_bus_client_data),
+		GFP_KERNEL);
+	if (!bus_client_data) {
+		kfree(bus_client);
+		*client = NULL;
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_client->client_data = bus_client_data;
+	pdata = msm_bus_pdata_from_node(pdev,
+		dev_node);
+	if (!pdata) {
+		CAM_ERR(CAM_UTIL, "failed get_pdata");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	if ((pdata->num_usecases == 0) ||
+		(pdata->usecase[0].num_paths == 0)) {
+		CAM_ERR(CAM_UTIL, "usecase=%d", pdata->num_usecases);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	client_id = msm_bus_scale_register_client(pdata);
+	if (!client_id) {
+		CAM_ERR(CAM_UTIL, "failed in register bus client_data");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	bus_client->common_data = common_data;
+
+	bus_client_data->dyn_vote = of_property_read_bool(dev_node,
+		"qcom,msm-bus-vector-dyn-vote");
+
+	if (bus_client_data->dyn_vote && (pdata->num_usecases != 2)) {
+		CAM_ERR(CAM_UTIL, "Excess or less vectors %d",
+			pdata->num_usecases);
+		rc = -EINVAL;
+		goto fail_unregister_client;
+	}
+
+	rc = msm_bus_scale_client_update_request(client_id, 0);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Bus client update request failed, rc = %d",
+			rc);
+		goto fail_unregister_client;
+	}
+
+	bus_client->common_data->src_id = pdata->usecase[0].vectors[0].src;
+	bus_client->common_data->dst_id = pdata->usecase[0].vectors[0].dst;
+	bus_client_data->pdata = pdata;
+	bus_client_data->client_id = client_id;
+	bus_client->common_data->num_usecases = pdata->num_usecases;
+	bus_client_data->num_paths = pdata->usecase[0].num_paths;
+	bus_client->common_data->name = pdata->name;
+
+	CAM_DBG(CAM_PERF, "Register Bus Client=[%d][%s] : src=%d, dst=%d",
+		bus_client_data->client_id, bus_client->common_data->name,
+		bus_client->common_data->src_id,
+		bus_client->common_data->dst_id);
+
+	return 0;
+fail_unregister_client:
+	msm_bus_scale_unregister_client(bus_client_data->client_id);
+error:
+	kfree(bus_client_data);
+	bus_client->client_data = NULL;
+	kfree(bus_client);
+	*client = NULL;
+end:
+	return rc;
+
+}
+
+void cam_soc_bus_client_unregister(void **client)
+{
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) (*client);
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+
+	if (bus_client_data->dyn_vote)
+		cam_soc_bus_client_update_bw(bus_client, 0, 0);
+	else
+		cam_soc_bus_client_update_request(bus_client, 0);
+
+	msm_bus_scale_unregister_client(bus_client_data->client_id);
+	kfree(bus_client_data);
+	bus_client->client_data = NULL;
+	kfree(bus_client);
+	*client = NULL;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_soc_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_soc_util.c
@@ -0,0 +1,4652 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/clk.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <linux/pm_domain.h>
+#include <linux/pm_runtime.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/pm_opp.h>
+
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_cx_ipeak.h"
+#include "cam_mem_mgr.h"
+#include "cam_presil_hw_access.h"
+#include "cam_compat.h"
+
+#if IS_ENABLED(CONFIG_QCOM_CRM)
+#include <soc/qcom/crm.h>
+#include <linux/clk/qcom.h>
+#endif
+
+#define CAM_TO_MASK(bitn)          (1 << (int)(bitn))
+#define CAM_IS_BIT_SET(mask, bit)  ((mask) & CAM_TO_MASK(bit))
+#define CAM_SET_BIT(mask, bit)     ((mask) |= CAM_TO_MASK(bit))
+#define CAM_CLEAR_BIT(mask, bit)   ((mask) &= ~CAM_TO_MASK(bit))
+
+#define CAM_SS_START_PRESIL 0x08c00000
+#define CAM_SS_START        0x0ac00000
+
+#define CAM_CLK_DIRNAME "clk"
+
+static uint skip_mmrm_set_rate;
+module_param(skip_mmrm_set_rate, uint, 0644);
+
+/**
+ * struct cam_clk_wrapper_clk: This represents an entry corresponding to a
+ *                             shared clock in Clk wrapper. Clients that share
+ *                             the same clock are registered to this clk entry
+ *                             and set rate from them is consolidated before
+ *                             setting it to clk driver.
+ *
+ * @list:           List pointer to point to next shared clk entry
+ * @clk_id:         Clk Id of this clock
+ * @curr_clk_rate:  Current clock rate set for this clock
+ * @client_list:    List of clients registered to this shared clock entry
+ * @num_clients:    Number of registered clients
+ * @active_clients: Number of active clients
+ * @mmrm_client:    MMRM Client handle for src clock
+ * @soc_info:       soc_info of client with which mmrm handle is created.
+ *                  This is used as unique identifier for a client and mmrm
+ *                  callback data. When client corresponds to this soc_info is
+ *                  unregistered, need to unregister mmrm handle as well.
+ * @is_nrt_dev:     Whether this clock corresponds to NRT device
+ * @min_clk_rate:   Minimum clk rate that this clock supports
+ **/
+struct cam_clk_wrapper_clk {
+	struct list_head list;
+	uint32_t clk_id;
+	int64_t curr_clk_rate;
+	struct list_head client_list;
+	uint32_t num_clients;
+	uint32_t active_clients;
+	void *mmrm_handle;
+	struct cam_hw_soc_info *soc_info;
+	bool is_nrt_dev;
+	int64_t min_clk_rate;
+};
+
+/**
+ * struct cam_clk_wrapper_client: This represents a client (device) that wants
+ *                                to share the clock with some other client.
+ *
+ * @list:           List pointer to point to next client that share the
+ *                  same clock
+ * @soc_info:       soc_info of client. This is used as unique identifier
+ *                  for a client
+ * @clk:            Clk handle
+ * @curr_clk_rate:  Current clock rate set for this client
+ **/
+struct cam_clk_wrapper_client {
+	struct list_head list;
+	struct cam_hw_soc_info *soc_info;
+	struct clk *clk;
+	int64_t curr_clk_rate;
+};
+
+static char supported_clk_info[256];
+
+static DEFINE_MUTEX(wrapper_lock);
+static LIST_HEAD(wrapper_clk_list);
+
+#define CAM_IS_VALID_CESTA_IDX(idx) ((idx >= 0) && (idx < CAM_CESTA_MAX_CLIENTS))
+
+#define CAM_CRM_DEV_IDENTIFIER "cam_crm"
+
+const struct device *cam_cesta_crm_dev;
+
+#if IS_ENABLED(CONFIG_QCOM_CRM) && IS_ENABLED(CONFIG_SPECTRA_USE_CLK_CRM_API)
+static int cam_soc_util_set_hw_client_rate_through_mmrm(
+	void *mmrm_handle, long low_val, long high_val,
+	uint32_t num_hw_blocks, int cesta_client_idx);
+#endif
+
+#if IS_ENABLED(CONFIG_QCOM_CRM)
+static inline const struct device *cam_wrapper_crm_get_device(
+	const char *name)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CESTA) {
+		CAM_WARN(CAM_UTIL, "Bypass crm get device");
+		return (const struct device *)BYPASS_VALUE;
+	}
+
+	return crm_get_device(name);
+}
+
+static inline int cam_wrapper_crm_write_pwr_states(const struct device *dev,
+	u32 drv_id)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CESTA) {
+		CAM_WARN(CAM_UTIL, "Bypass crm write pwr states");
+		return 0;
+	}
+
+	return crm_write_pwr_states(cam_cesta_crm_dev, drv_id);
+}
+
+#endif
+
+#if IS_ENABLED(CONFIG_QCOM_CRM) && IS_ENABLED(CONFIG_SPECTRA_USE_CLK_CRM_API)
+static inline int cam_wrapper_qcom_clk_crm_set_rate(struct clk *clk,
+	enum crm_drv_type client_type, u32 client_idx,
+	u32 pwr_st, unsigned long rate)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CESTA) {
+		CAM_WARN(CAM_UTIL, "Bypass qcom clk crm set rate");
+		return 0;
+	}
+
+	return qcom_clk_crm_set_rate(clk, client_type, client_idx, pwr_st, rate);
+}
+#endif
+
+static inline int cam_wrapper_clk_set_rate(struct clk *clk, unsigned long rate)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass clk set rate");
+		return 0;
+	}
+
+	return clk_set_rate(clk, rate);
+}
+
+static inline long cam_wrapper_clk_round_rate(struct clk *clk, unsigned long rate)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass clk round rate");
+		return rate;
+	}
+
+	return clk_round_rate(clk, rate);
+}
+
+inline unsigned long cam_wrapper_clk_get_rate(struct clk *clk)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass clk get rate");
+		return DEFAULT_CLK_VALUE;
+	}
+
+	return clk_get_rate(clk);
+}
+
+static inline struct clk *cam_wrapper_clk_get(struct device *dev, const char *id)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass clk get");
+		return (struct clk *)BYPASS_VALUE;
+	}
+
+	return clk_get(dev, id);
+}
+
+static inline void cam_wrapper_clk_put(struct clk *clk)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass clk put");
+		return;
+	}
+
+	clk_put(clk);
+}
+
+static inline struct clk *cam_wrapper_of_clk_get_from_provider(
+	struct of_phandle_args *clkspec)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass of clk get from provider");
+		return (struct clk *)BYPASS_VALUE;
+	}
+
+	return of_clk_get_from_provider(clkspec);
+}
+
+static inline int cam_wrapper_clk_prepare_enable(struct clk *clk)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass clk prepare enable");
+		return 0;
+	}
+
+	return clk_prepare_enable(clk);
+}
+
+static inline void cam_wrapper_clk_disable_unprepare(struct clk *clk)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass clk disable unprepare");
+		return;
+	}
+
+	clk_disable_unprepare(clk);
+}
+
+static inline struct regulator *cam_wrapper_regulator_get(struct device *dev,
+	const char *id)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_RGLTR) {
+		CAM_WARN(CAM_UTIL, "Bypass regulator get");
+		return (struct regulator *)BYPASS_VALUE;
+	}
+
+	return regulator_get(dev, id);
+}
+
+static inline void cam_wrapper_regulator_put(struct regulator *regulator)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_RGLTR) {
+		CAM_WARN(CAM_UTIL, "Bypass regulator put");
+		return;
+	}
+
+	regulator_put(regulator);
+}
+
+static inline int cam_wrapper_regulator_disable(struct regulator *regulator)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_RGLTR) {
+		CAM_WARN(CAM_UTIL, "Bypass regulator disable");
+		return 0;
+	}
+
+	return regulator_disable(regulator);
+}
+
+static inline int cam_wrapper_regulator_enable(struct regulator *regulator)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_RGLTR) {
+		CAM_WARN(CAM_UTIL, "Bypass regulator enable");
+		return 0;
+	}
+
+	return regulator_enable(regulator);
+}
+
+static inline int cam_wrapper_regulator_set_voltage(
+	struct regulator *regulator, int min_uV, int max_uV)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_RGLTR) {
+		CAM_WARN(CAM_UTIL, "Bypass regulator set voltage");
+		return 0;
+	}
+
+	return regulator_set_voltage(regulator, min_uV, max_uV);
+}
+
+static inline int cam_wrapper_regulator_count_voltages(
+	struct regulator *regulator)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_RGLTR) {
+		CAM_WARN(CAM_UTIL, "Bypass regulator count voltages");
+		return 0;
+	}
+
+	return regulator_count_voltages(regulator);
+}
+
+inline int cam_wrapper_regulator_set_load(
+	struct regulator *regulator, int uA_load)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_RGLTR) {
+		CAM_WARN(CAM_UTIL, "Bypass regulator set load");
+		return 0;
+	}
+
+	return regulator_set_load(regulator, uA_load);
+}
+
+inline int cam_wrapper_regulator_set_mode(
+	struct regulator *regulator, unsigned int mode)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_RGLTR_MODE) {
+		CAM_WARN(CAM_UTIL, "Bypass regulator set mode");
+		return 0;
+}
+
+	return regulator_set_mode(regulator, mode);
+}
+
+static inline int cam_wrapper_regulator_is_enabled(
+	struct regulator *regulator)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_RGLTR) {
+		CAM_WARN(CAM_UTIL, "Bypass regulator is enabled");
+		return 0;
+	}
+
+	return regulator_is_enabled(regulator);
+}
+
+inline void cam_soc_util_set_bypass_drivers(
+	uint32_t bypass_drivers)
+{
+	debug_bypass_drivers = bypass_drivers;
+	CAM_INFO(CAM_UTIL, "bypass drivers %d", debug_bypass_drivers);
+}
+
+#if IS_ENABLED(CONFIG_QCOM_CRM)
+inline int cam_soc_util_cesta_populate_crm_device(void)
+{
+	cam_cesta_crm_dev =  cam_wrapper_crm_get_device(CAM_CRM_DEV_IDENTIFIER);
+	if (!cam_cesta_crm_dev) {
+		CAM_ERR(CAM_UTIL, "Failed to get cesta crm dev for %s", CAM_CRM_DEV_IDENTIFIER);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+int cam_soc_util_cesta_channel_switch(uint32_t cesta_client_idx, const char *identifier)
+{
+	int rc = 0;
+
+	if (!cam_cesta_crm_dev) {
+		CAM_ERR(CAM_UTIL, "camera cesta crm device is null");
+		return -EINVAL;
+	}
+
+	if (!CAM_IS_VALID_CESTA_IDX(cesta_client_idx)) {
+		CAM_ERR(CAM_UTIL, "Invalid client index for camera cesta idx: %d max: %d",
+			cesta_client_idx, CAM_CESTA_MAX_CLIENTS);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_PERF, "CESTA Channel switch : hw client idx %d identifier=%s",
+		cesta_client_idx, identifier);
+
+	rc = cam_wrapper_crm_write_pwr_states(cam_cesta_crm_dev, cesta_client_idx);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Failed to trigger cesta channel switch cesta_client_idx: %u rc: %d",
+			cesta_client_idx, rc);
+		return rc;
+	}
+
+	return rc;
+}
+#else
+inline int cam_soc_util_cesta_populate_crm_device(void)
+{
+	CAM_ERR(CAM_UTIL, "Not supported");
+
+	return -EOPNOTSUPP;
+}
+
+inline int cam_soc_util_cesta_channel_switch(uint32_t cesta_client_idx, const char *identifier)
+{
+	CAM_ERR(CAM_UTIL, "Not supported, cesta_client_idx=%d, identifier=%s",
+		cesta_client_idx, identifier);
+
+	return -EOPNOTSUPP;
+}
+#endif
+
+#if IS_ENABLED(CONFIG_QCOM_CRM) && IS_ENABLED(CONFIG_SPECTRA_USE_CLK_CRM_API)
+static int cam_soc_util_set_cesta_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t cesta_client_idx, unsigned long high_val, unsigned long low_val,
+	unsigned long *applied_high_val, unsigned long *applied_low_val)
+{
+	int32_t src_clk_idx;
+	struct clk *clk = NULL;
+	int rc = 0;
+
+	if (!soc_info || (soc_info->src_clk_idx < 0) ||
+		(soc_info->src_clk_idx >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "Invalid src_clk_idx: %d",
+			soc_info ? soc_info->src_clk_idx : -1);
+		return -EINVAL;
+	}
+
+	if (!CAM_IS_VALID_CESTA_IDX(cesta_client_idx)) {
+		CAM_ERR(CAM_UTIL, "Invalid client index for camera cesta idx: %d max: %d",
+			cesta_client_idx, CAM_CESTA_MAX_CLIENTS);
+		return -EINVAL;
+	}
+
+	/* Only source clocks are supported by this API to set HW client clock votes */
+	src_clk_idx = soc_info->src_clk_idx;
+	clk = soc_info->clk[src_clk_idx];
+
+	if (!skip_mmrm_set_rate && soc_info->mmrm_handle) {
+		CAM_DBG(CAM_UTIL, "cesta mmrm hw client: set %s, high-rate %lld low-rate %lld",
+			soc_info->clk_name[src_clk_idx], high_val, low_val);
+
+		rc = cam_soc_util_set_hw_client_rate_through_mmrm(
+			soc_info->mmrm_handle, low_val, high_val, 1,
+			cesta_client_idx);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"set_sw_client_rate through mmrm failed on %s clk_id %d low_val %llu high_val %llu client idx=%d",
+				soc_info->clk_name[src_clk_idx], soc_info->clk_id[src_clk_idx],
+				low_val, high_val, cesta_client_idx);
+			return rc;
+		}
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL, "%s Requested clk rate [high low]: [%llu %llu] cesta_client_idx: %d",
+		soc_info->clk_name[src_clk_idx], high_val, low_val, cesta_client_idx);
+
+	rc = cam_wrapper_qcom_clk_crm_set_rate(
+		clk, CRM_HW_DRV, cesta_client_idx, CRM_PWR_STATE1, high_val);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Failed in setting cesta high clk rate, client idx: %u pwr state: %u clk_val: %llu rc: %d",
+			cesta_client_idx, CRM_PWR_STATE1, high_val, rc);
+		return rc;
+	}
+
+	rc = cam_wrapper_qcom_clk_crm_set_rate(
+		clk, CRM_HW_DRV, cesta_client_idx, CRM_PWR_STATE0, low_val);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Failed in setting cesta low clk rate, client idx: %u pwr state: %u clk_val: %llu rc: %d",
+			cesta_client_idx, CRM_PWR_STATE0, low_val, rc);
+		return rc;
+	}
+
+end:
+	if (applied_high_val)
+		*applied_high_val = high_val;
+
+	if (applied_low_val)
+		*applied_low_val = low_val;
+
+	return rc;
+}
+
+#if IS_REACHABLE(CONFIG_MSM_MMRM)
+int cam_soc_util_set_hw_client_rate_through_mmrm(
+	void *mmrm_handle, long low_val, long high_val,
+	uint32_t num_hw_blocks, int cesta_client_idx)
+{
+	int rc = 0;
+	struct mmrm_client_data client_data;
+
+	client_data.num_hw_blocks = num_hw_blocks;
+	client_data.crm_drv_idx = cesta_client_idx;
+	client_data.drv_type = MMRM_CRM_HW_DRV;
+	client_data.pwr_st = CRM_PWR_STATE1;
+	client_data.flags = 0;
+
+	CAM_DBG(CAM_UTIL,
+		"hw client mmrm=%pK, high_val %ld, low_val %ld, num_blocks=%d, pwr_state: %u, client_idx: %d",
+		mmrm_handle, high_val, low_val, num_hw_blocks, CRM_PWR_STATE1, cesta_client_idx);
+
+	rc = mmrm_client_set_value((struct mmrm_client *)mmrm_handle,
+		&client_data, high_val);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Set high rate failed rate %ld rc %d",
+			high_val, rc);
+		return rc;
+	}
+
+	/* We vote a second time for pwr_st = low */
+	client_data.pwr_st = CRM_PWR_STATE0;
+
+	rc = mmrm_client_set_value((struct mmrm_client *)mmrm_handle,
+		&client_data, low_val);
+	if (rc)
+		CAM_ERR(CAM_UTIL, "Set low rate failed rate %ld rc %d", low_val, rc);
+
+	return rc;
+}
+
+#else
+int cam_soc_util_set_hw_client_rate_through_mmrm(
+	void *mmrm_handle, long low_val, long high_val,
+	uint32_t num_hw_blocks, int cesta_client_idx)
+{
+	return 0;
+}
+#endif
+
+#else
+static inline int cam_soc_util_set_cesta_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t cesta_client_idx, unsigned long high_val, unsigned long low_val,
+	unsigned long *applied_high_val, unsigned long *applied_low_val)
+{
+	CAM_ERR(CAM_UTIL, "Not supported, dev=%s, cesta_client_idx=%d, high_val=%ld, low_val=%ld",
+		soc_info->dev_name, cesta_client_idx, high_val, low_val);
+
+	return -EOPNOTSUPP;
+}
+#endif
+
+#if IS_REACHABLE(CONFIG_MSM_MMRM)
+bool cam_is_mmrm_supported_on_current_chip(void)
+{
+	bool is_supported;
+
+	is_supported = mmrm_client_check_scaling_supported(MMRM_CLIENT_CLOCK,
+			MMRM_CLIENT_DOMAIN_CAMERA);
+	CAM_DBG(CAM_UTIL, "is mmrm supported: %s",
+			CAM_BOOL_TO_YESNO(is_supported));;
+
+	return is_supported;
+}
+
+int cam_mmrm_notifier_callback(
+	struct mmrm_client_notifier_data *notifier_data)
+{
+	if (!notifier_data) {
+		CAM_ERR(CAM_UTIL, "Invalid notifier data");
+		return -EBADR;
+	}
+
+	if (notifier_data->cb_type == MMRM_CLIENT_RESOURCE_VALUE_CHANGE) {
+		struct cam_hw_soc_info *soc_info = notifier_data->pvt_data;
+
+		CAM_WARN(CAM_UTIL, "Dev %s Clk %s value change from %ld to %ld",
+			soc_info->dev_name,
+			(soc_info->src_clk_idx == -1) ? "No src clk" :
+			soc_info->clk_name[soc_info->src_clk_idx],
+			notifier_data->cb_data.val_chng.old_val,
+			notifier_data->cb_data.val_chng.new_val);
+	}
+
+	return 0;
+}
+
+int cam_soc_util_register_mmrm_client(
+	uint32_t clk_id, struct clk *clk, bool is_nrt_dev,
+	struct cam_hw_soc_info *soc_info, const char *clk_name,
+	void **mmrm_handle)
+{
+	struct mmrm_client *mmrm_client;
+	struct mmrm_client_desc desc = { };
+
+	if (!mmrm_handle) {
+		CAM_ERR(CAM_UTIL, "Invalid mmrm input");
+		return -EINVAL;
+	}
+
+	*mmrm_handle = (void *)NULL;
+
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass register mmrm client");
+		return 0;
+	}
+
+	if (!cam_is_mmrm_supported_on_current_chip())
+		return 0;
+
+	desc.client_type = MMRM_CLIENT_CLOCK;
+	desc.client_info.desc.client_domain = MMRM_CLIENT_DOMAIN_CAMERA;
+	desc.client_info.desc.client_id = clk_id;
+	desc.client_info.desc.clk = clk;
+
+#if IS_ENABLED(CONFIG_QCOM_CRM) && IS_ENABLED(CONFIG_SPECTRA_USE_CLK_CRM_API)
+	if (soc_info->is_clk_drv_en) {
+		desc.client_info.desc.hw_drv_instances = CAM_CESTA_MAX_CLIENTS;
+		desc.client_info.desc.num_pwr_states = CAM_NUM_PWR_STATES;
+	} else {
+		desc.client_info.desc.hw_drv_instances = 0;
+		desc.client_info.desc.num_pwr_states = 0;
+	}
+#endif
+
+	snprintf((char *)desc.client_info.desc.name,
+		sizeof(desc.client_info.desc.name), "%s_%s",
+		soc_info->dev_name, clk_name);
+
+	desc.priority = is_nrt_dev ?
+		MMRM_CLIENT_PRIOR_LOW : MMRM_CLIENT_PRIOR_HIGH;
+	desc.pvt_data = soc_info;
+	desc.notifier_callback_fn = cam_mmrm_notifier_callback;
+
+	mmrm_client = mmrm_client_register(&desc);
+	if (!mmrm_client) {
+		CAM_ERR(CAM_UTIL, "MMRM Register failed Dev %s clk %s id %d",
+			soc_info->dev_name, clk_name, clk_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_UTIL,
+		"MMRM Register success Dev %s is_nrt_dev %d clk %s id %d handle=%pK",
+		soc_info->dev_name, is_nrt_dev, clk_name, clk_id, mmrm_client);
+
+	*mmrm_handle = (void *)mmrm_client;
+
+	return 0;
+}
+
+int cam_soc_util_unregister_mmrm_client(
+	void *mmrm_handle)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_UTIL, "MMRM UnRegister handle=%pK", mmrm_handle);
+
+	if (mmrm_handle) {
+		rc = mmrm_client_deregister((struct mmrm_client *)mmrm_handle);
+		if (rc)
+			CAM_ERR(CAM_UTIL,
+				"Failed in deregister handle=%pK, rc %d",
+				mmrm_handle, rc);
+	}
+
+	return rc;
+}
+
+static int cam_soc_util_set_sw_client_rate_through_mmrm(
+	void *mmrm_handle, bool is_nrt_dev, long min_rate,
+	long req_rate, uint32_t num_hw_blocks)
+{
+	int rc = 0;
+	struct mmrm_client_data client_data;
+	struct mmrm_client_res_value val;
+
+	client_data.num_hw_blocks = num_hw_blocks;
+	client_data.flags = 0;
+
+#if IS_ENABLED(CONFIG_QCOM_CRM) && IS_ENABLED(CONFIG_SPECTRA_USE_CLK_CRM_API)
+	client_data.drv_type = MMRM_CRM_SW_DRV;
+#endif
+
+	CAM_DBG(CAM_UTIL,
+		"sw client mmrm=%pK, nrt=%d, min_rate=%ld req_rate %ld, num_blocks=%d",
+		mmrm_handle, is_nrt_dev, min_rate, req_rate, num_hw_blocks);
+
+	if (is_nrt_dev) {
+		val.min = min_rate;
+		val.cur = req_rate;
+
+		rc = mmrm_client_set_value_in_range(
+			(struct mmrm_client *)mmrm_handle, &client_data, &val);
+	} else {
+		rc = mmrm_client_set_value(
+			(struct mmrm_client *)mmrm_handle,
+			&client_data, req_rate);
+	}
+
+	if (rc)
+		CAM_ERR(CAM_UTIL, "Set rate failed rate %ld rc %d",
+			req_rate, rc);
+
+	return rc;
+}
+#else
+int cam_soc_util_register_mmrm_client(
+	uint32_t clk_id, struct clk *clk, bool is_nrt_dev,
+	struct cam_hw_soc_info *soc_info, const char *clk_name,
+	void **mmrm_handle)
+{
+	if (!mmrm_handle) {
+		CAM_ERR(CAM_UTIL, "Invalid mmrm input");
+		return -EINVAL;
+	}
+
+	*mmrm_handle = NULL;
+
+	return 0;
+}
+
+int cam_soc_util_unregister_mmrm_client(
+	void *mmrm_handle)
+{
+	return 0;
+}
+
+static int cam_soc_util_set_sw_client_rate_through_mmrm(
+	void *mmrm_handle, bool is_nrt_dev, long min_rate,
+	long req_rate, uint32_t num_hw_blocks)
+{
+	return 0;
+}
+#endif
+
+static int cam_soc_util_clk_wrapper_register_entry(
+	uint32_t clk_id, struct clk *clk, bool is_src_clk,
+	struct cam_hw_soc_info *soc_info, int64_t min_clk_rate,
+	const char *clk_name)
+{
+	struct cam_clk_wrapper_clk *wrapper_clk;
+	struct cam_clk_wrapper_client *wrapper_client;
+	bool clock_found = false;
+	int rc = 0;
+
+	mutex_lock(&wrapper_lock);
+
+	list_for_each_entry(wrapper_clk, &wrapper_clk_list, list) {
+		CAM_DBG(CAM_UTIL, "Clk list id %d num clients %d",
+			wrapper_clk->clk_id, wrapper_clk->num_clients);
+
+		if (wrapper_clk->clk_id == clk_id) {
+			clock_found = true;
+			list_for_each_entry(wrapper_client,
+				&wrapper_clk->client_list, list) {
+				CAM_DBG(CAM_UTIL,
+					"Clk id %d entry client %s",
+					wrapper_clk->clk_id,
+					wrapper_client->soc_info->dev_name);
+				if (wrapper_client->soc_info == soc_info) {
+					CAM_ERR(CAM_UTIL,
+						"Register with same soc info, clk id %d, client %s",
+						clk_id, soc_info->dev_name);
+					rc = -EINVAL;
+					goto end;
+				}
+			}
+			break;
+		}
+	}
+
+	if (!clock_found) {
+		CAM_DBG(CAM_UTIL, "Adding new entry for clk id %d", clk_id);
+		wrapper_clk = kzalloc(sizeof(struct cam_clk_wrapper_clk),
+			GFP_KERNEL);
+		if (!wrapper_clk) {
+			CAM_ERR(CAM_UTIL,
+				"Failed in allocating new clk entry %d",
+				clk_id);
+			rc = -ENOMEM;
+			goto end;
+		}
+
+		wrapper_clk->clk_id = clk_id;
+		INIT_LIST_HEAD(&wrapper_clk->list);
+		INIT_LIST_HEAD(&wrapper_clk->client_list);
+		list_add_tail(&wrapper_clk->list, &wrapper_clk_list);
+	}
+	wrapper_client = kzalloc(sizeof(struct cam_clk_wrapper_client),
+		GFP_KERNEL);
+	if (!wrapper_client) {
+		CAM_ERR(CAM_UTIL, "Failed in allocating new client entry %d",
+			clk_id);
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	wrapper_client->soc_info = soc_info;
+	wrapper_client->clk = clk;
+
+	if (is_src_clk && !wrapper_clk->mmrm_handle) {
+		wrapper_clk->is_nrt_dev = soc_info->is_nrt_dev;
+		wrapper_clk->min_clk_rate = min_clk_rate;
+		wrapper_clk->soc_info = soc_info;
+
+		rc = cam_soc_util_register_mmrm_client(clk_id, clk,
+			wrapper_clk->is_nrt_dev, soc_info, clk_name,
+			&wrapper_clk->mmrm_handle);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"Failed in register mmrm client Dev %s clk id %d",
+				soc_info->dev_name, clk_id);
+			kfree(wrapper_client);
+			goto end;
+		}
+	}
+
+	INIT_LIST_HEAD(&wrapper_client->list);
+	list_add_tail(&wrapper_client->list, &wrapper_clk->client_list);
+	wrapper_clk->num_clients++;
+
+	CAM_DBG(CAM_UTIL,
+		"Adding new client %s for clk[%s] id %d, num clients %d",
+		soc_info->dev_name, clk_name, clk_id, wrapper_clk->num_clients);
+
+end:
+	mutex_unlock(&wrapper_lock);
+	return rc;
+}
+
+static int cam_soc_util_clk_wrapper_unregister_entry(
+	uint32_t clk_id, struct cam_hw_soc_info *soc_info)
+{
+	struct cam_clk_wrapper_clk *wrapper_clk;
+	struct cam_clk_wrapper_client *wrapper_client;
+	bool clock_found = false;
+	bool client_found = false;
+	int rc = 0;
+
+	mutex_lock(&wrapper_lock);
+
+	list_for_each_entry(wrapper_clk, &wrapper_clk_list, list) {
+		CAM_DBG(CAM_UTIL, "Clk list id %d num clients %d",
+			wrapper_clk->clk_id, wrapper_clk->num_clients);
+
+		if (wrapper_clk->clk_id == clk_id) {
+			clock_found = true;
+			list_for_each_entry(wrapper_client,
+				&wrapper_clk->client_list, list) {
+				CAM_DBG(CAM_UTIL, "Clk id %d entry client %s",
+					wrapper_clk->clk_id,
+					wrapper_client->soc_info->dev_name);
+				if (wrapper_client->soc_info == soc_info) {
+					client_found = true;
+					break;
+				}
+			}
+			break;
+		}
+	}
+
+	if (!clock_found) {
+		CAM_ERR(CAM_UTIL, "Shared clk id %d entry not found", clk_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!client_found) {
+		CAM_ERR(CAM_UTIL,
+			"Client %pK for Shared clk id %d entry not found",
+			soc_info, clk_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	wrapper_clk->num_clients--;
+	if (wrapper_clk->mmrm_handle && (wrapper_clk->soc_info == soc_info)) {
+		cam_soc_util_unregister_mmrm_client(wrapper_clk->mmrm_handle);
+		wrapper_clk->mmrm_handle = NULL;
+		wrapper_clk->soc_info = NULL;
+	}
+
+	list_del_init(&wrapper_client->list);
+	kfree(wrapper_client);
+
+	CAM_DBG(CAM_UTIL, "Unregister client %s for clk id %d, num clients %d",
+		soc_info->dev_name, clk_id, wrapper_clk->num_clients);
+
+	if (!wrapper_clk->num_clients) {
+		list_del_init(&wrapper_clk->list);
+		kfree(wrapper_clk);
+	}
+end:
+	mutex_unlock(&wrapper_lock);
+	return rc;
+}
+
+static int cam_soc_util_clk_wrapper_set_clk_rate(
+	uint32_t clk_id, struct cam_hw_soc_info *soc_info,
+	struct clk *clk, int64_t clk_rate)
+{
+	struct cam_clk_wrapper_clk *wrapper_clk;
+	struct cam_clk_wrapper_client *wrapper_client;
+	bool clk_found = false;
+	bool client_found = false;
+	int rc = 0;
+	int64_t final_clk_rate = 0;
+	uint32_t active_clients = 0;
+
+	if (!soc_info || !clk) {
+		CAM_ERR(CAM_UTIL, "Invalid param soc_info %pK clk %pK",
+			soc_info, clk);
+		return -EINVAL;
+	}
+
+	mutex_lock(&wrapper_lock);
+
+	list_for_each_entry(wrapper_clk, &wrapper_clk_list, list) {
+		CAM_DBG(CAM_UTIL, "Clk list id %d num clients %d",
+			wrapper_clk->clk_id, wrapper_clk->num_clients);
+		if (wrapper_clk->clk_id == clk_id) {
+			clk_found = true;
+			break;
+		}
+	}
+
+	if (!clk_found) {
+		CAM_ERR(CAM_UTIL, "Clk entry not found id %d client %s",
+			clk_id, soc_info->dev_name);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	list_for_each_entry(wrapper_client, &wrapper_clk->client_list, list) {
+		CAM_DBG(CAM_UTIL, "Clk id %d client %s, clk rate %lld",
+			wrapper_clk->clk_id, wrapper_client->soc_info->dev_name,
+			wrapper_client->curr_clk_rate);
+		if (wrapper_client->soc_info == soc_info) {
+			client_found = true;
+			CAM_DBG(CAM_UTIL,
+				"Clk enable clk id %d, client %s curr %ld new %ld",
+				clk_id, wrapper_client->soc_info->dev_name,
+				wrapper_client->curr_clk_rate, clk_rate);
+
+			wrapper_client->curr_clk_rate = clk_rate;
+		}
+
+		if (wrapper_client->curr_clk_rate > 0)
+			active_clients++;
+
+		if (final_clk_rate < wrapper_client->curr_clk_rate)
+			final_clk_rate = wrapper_client->curr_clk_rate;
+	}
+
+	if (!client_found) {
+		CAM_ERR(CAM_UTIL,
+			"Wrapper clk enable without client entry clk id %d client %s",
+			clk_id, soc_info->dev_name);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL,
+		"Clk id %d, client %s, clients rate %ld, curr %ld final %ld",
+		wrapper_clk->clk_id, soc_info->dev_name, clk_rate,
+		wrapper_clk->curr_clk_rate, final_clk_rate);
+
+	if ((final_clk_rate != wrapper_clk->curr_clk_rate) ||
+		(active_clients != wrapper_clk->active_clients)) {
+		bool set_rate_finish = false;
+
+		if (!skip_mmrm_set_rate && wrapper_clk->mmrm_handle) {
+			rc = cam_soc_util_set_sw_client_rate_through_mmrm(
+				wrapper_clk->mmrm_handle,
+				wrapper_clk->is_nrt_dev,
+				wrapper_clk->min_clk_rate,
+				final_clk_rate, active_clients);
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"set_sw_client_rate through mmrm failed clk_id %d, rate=%ld",
+					wrapper_clk->clk_id, final_clk_rate);
+				goto end;
+			}
+
+			set_rate_finish = true;
+		}
+
+		if (!set_rate_finish && final_clk_rate &&
+			(final_clk_rate != wrapper_clk->curr_clk_rate)) {
+			rc = cam_wrapper_clk_set_rate(clk, final_clk_rate);
+			if (rc) {
+				CAM_ERR(CAM_UTIL, "set_rate failed on clk %d",
+					wrapper_clk->clk_id);
+				goto end;
+			}
+		}
+
+		wrapper_clk->curr_clk_rate = final_clk_rate;
+		wrapper_clk->active_clients = active_clients;
+	}
+
+end:
+	mutex_unlock(&wrapper_lock);
+	return rc;
+}
+
+int cam_soc_util_get_clk_level(struct cam_hw_soc_info *soc_info,
+	int64_t clk_rate, int clk_idx, int32_t *clk_lvl)
+{
+	int i;
+	long clk_rate_round;
+
+	if (!soc_info || (clk_idx < 0) || (clk_idx >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "Invalid src_clk_idx: %d", clk_idx);
+		*clk_lvl = -1;
+		return -EINVAL;
+	}
+
+	clk_rate_round = cam_wrapper_clk_round_rate(
+		soc_info->clk[clk_idx], clk_rate);
+	if (clk_rate_round < 0) {
+		CAM_ERR(CAM_UTIL, "round failed rc = %ld",
+			clk_rate_round);
+		*clk_lvl = -1;
+		return -EINVAL;
+	}
+
+	if (debug_bypass_drivers & CAM_BYPASS_CLKS) {
+		CAM_WARN(CAM_UTIL, "Bypass get clk level");
+		*clk_lvl = CAM_NOMINAL_VOTE;
+		return 0;
+	}
+
+	for (i = 0; i < CAM_MAX_VOTE; i++) {
+		if ((soc_info->clk_level_valid[i]) &&
+			(soc_info->clk_rate[i][clk_idx] >=
+			clk_rate_round)) {
+			CAM_DBG(CAM_UTIL,
+				"soc = %d round rate = %ld actual = %lld",
+				soc_info->clk_rate[i][clk_idx],
+				clk_rate_round, clk_rate);
+			*clk_lvl = i;
+			return 0;
+		}
+	}
+
+	CAM_WARN(CAM_UTIL, "Invalid clock rate %ld", clk_rate_round);
+	*clk_lvl = -1;
+	return -EINVAL;
+}
+
+const char *cam_soc_util_get_string_from_level(enum cam_vote_level level)
+{
+	switch (level) {
+	case CAM_SUSPEND_VOTE:
+		return "";
+	case CAM_MINSVS_VOTE:
+		return "MINSVS[1]";
+	case CAM_LOWSVS_D1_VOTE:
+		return "LOWSVSD1[2]";
+	case CAM_LOWSVS_VOTE:
+		return "LOWSVS[3]";
+	case CAM_SVS_VOTE:
+		return "SVS[4]";
+	case CAM_SVSL1_VOTE:
+		return "SVSL1[5]";
+	case CAM_NOMINAL_VOTE:
+		return "NOM[6]";
+	case CAM_NOMINALL1_VOTE:
+		return "NOML1[7]";
+	case CAM_TURBO_VOTE:
+		return "TURBO[8]";
+	default:
+		return "";
+	}
+}
+
+/**
+ * cam_soc_util_get_supported_clk_levels()
+ *
+ * @brief:      Returns the string of all the supported clk levels for
+ *              the given device
+ *
+ * @soc_info:   Device soc information
+ *
+ * @return:     String containing all supported clk levels
+ */
+static const char *cam_soc_util_get_supported_clk_levels(
+	struct cam_hw_soc_info *soc_info)
+{
+	int i = 0;
+
+	scnprintf(supported_clk_info, sizeof(supported_clk_info), "Supported levels: ");
+
+	for (i = 0; i < CAM_MAX_VOTE; i++) {
+		if (soc_info->clk_level_valid[i] == true) {
+			strlcat(supported_clk_info,
+				cam_soc_util_get_string_from_level(i),
+				sizeof(supported_clk_info));
+			strlcat(supported_clk_info, " ",
+				sizeof(supported_clk_info));
+		}
+	}
+
+	strlcat(supported_clk_info, "\n", sizeof(supported_clk_info));
+	return supported_clk_info;
+}
+
+static int cam_soc_util_clk_lvl_options_open(struct inode *inode,
+	struct file *file)
+{
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+static ssize_t cam_soc_util_clk_lvl_options_read(struct file *file,
+	char __user *clk_info, size_t size_t, loff_t *loff_t)
+{
+	struct cam_hw_soc_info *soc_info =
+		(struct cam_hw_soc_info *)file->private_data;
+	const char *display_string =
+		cam_soc_util_get_supported_clk_levels(soc_info);
+
+	return simple_read_from_buffer(clk_info, size_t, loff_t, display_string,
+		strlen(display_string));
+}
+
+static const struct file_operations cam_soc_util_clk_lvl_options = {
+	.open = cam_soc_util_clk_lvl_options_open,
+	.read = cam_soc_util_clk_lvl_options_read,
+};
+
+static int cam_soc_util_set_clk_lvl_override(void *data, u64 val)
+{
+	struct cam_hw_soc_info *soc_info = (struct cam_hw_soc_info *)data;
+
+	if ((val <= CAM_SUSPEND_VOTE) || (val >= CAM_MAX_VOTE)) {
+		CAM_WARN(CAM_UTIL, "Invalid clk lvl override %d", val);
+		return 0;
+	}
+
+	if (soc_info->clk_level_valid[val])
+		soc_info->clk_level_override_high = val;
+	else
+		soc_info->clk_level_override_high = 0;
+
+	return 0;
+}
+
+static int cam_soc_util_get_clk_lvl_override(void *data, u64 *val)
+{
+	struct cam_hw_soc_info *soc_info = (struct cam_hw_soc_info *)data;
+
+	*val = soc_info->clk_level_override_high;
+
+	return 0;
+}
+
+static int cam_soc_util_set_clk_lvl_override_low(void *data, u64 val)
+{
+	struct cam_hw_soc_info *soc_info = (struct cam_hw_soc_info *)data;
+
+	if ((val <= CAM_SUSPEND_VOTE) || (val >= CAM_MAX_VOTE)) {
+		CAM_WARN(CAM_UTIL, "Invalid clk lvl override %d", val);
+		return 0;
+	}
+
+	if (soc_info->clk_level_valid[val])
+		soc_info->clk_level_override_low = val;
+	else
+		soc_info->clk_level_override_low = 0;
+
+	return 0;
+}
+
+static int cam_soc_util_get_clk_lvl_override_low(void *data, u64 *val)
+{
+	struct cam_hw_soc_info *soc_info = (struct cam_hw_soc_info *)data;
+
+	*val = soc_info->clk_level_override_low;
+
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_soc_util_clk_lvl_control,
+	cam_soc_util_get_clk_lvl_override, cam_soc_util_set_clk_lvl_override, "%08llu");
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_soc_util_clk_lvl_control_low,
+	cam_soc_util_get_clk_lvl_override_low, cam_soc_util_set_clk_lvl_override_low, "%08llu");
+
+
+/**
+ * cam_soc_util_create_clk_lvl_debugfs()
+ *
+ * @brief:      Creates debugfs files to view/control device clk rates
+ *
+ * @soc_info:   Device soc information
+ *
+ * @return:     Success or failure
+ */
+static int cam_soc_util_create_clk_lvl_debugfs(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct dentry *clkdirptr = NULL;
+
+	if (!cam_debugfs_available())
+		return 0;
+
+	if (soc_info->dentry) {
+		CAM_DBG(CAM_UTIL, "Debugfs entry for %s already exists",
+			soc_info->dev_name);
+		goto end;
+	}
+
+	rc = cam_debugfs_lookup_subdir(CAM_CLK_DIRNAME, &clkdirptr);
+	if (rc) {
+		rc = cam_debugfs_create_subdir(CAM_CLK_DIRNAME, &clkdirptr);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "DebugFS could not create clk directory!");
+			rc = -ENOENT;
+			goto end;
+		}
+	}
+
+	soc_info->dentry = debugfs_create_dir(soc_info->dev_name, clkdirptr);
+	if (IS_ERR_OR_NULL(soc_info->dentry)) {
+		CAM_ERR(CAM_UTIL, "DebugFS could not create directory for dev:%s!",
+			soc_info->dev_name);
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	debugfs_create_file("clk_lvl_options", 0444,
+		soc_info->dentry, soc_info, &cam_soc_util_clk_lvl_options);
+	debugfs_create_file("clk_lvl_control", 0644,
+		soc_info->dentry, soc_info, &cam_soc_util_clk_lvl_control);
+	debugfs_create_file("clk_lvl_control_low", 0644,
+		soc_info->dentry, soc_info, &cam_soc_util_clk_lvl_control_low);
+end:
+	return rc;
+}
+
+int cam_soc_util_get_level_from_string(const char *string,
+	enum cam_vote_level *level)
+{
+	if (!level)
+		return -EINVAL;
+
+	if (!strcmp(string, "suspend")) {
+		*level = CAM_SUSPEND_VOTE;
+	} else if (!strcmp(string, "minsvs")) {
+		*level = CAM_MINSVS_VOTE;
+	} else if (!strcmp(string, "lowsvsd1")) {
+		*level = CAM_LOWSVS_D1_VOTE;
+	} else if (!strcmp(string, "lowsvs")) {
+		*level = CAM_LOWSVS_VOTE;
+	} else if (!strcmp(string, "svs")) {
+		*level = CAM_SVS_VOTE;
+	} else if (!strcmp(string, "svs_l1")) {
+		*level = CAM_SVSL1_VOTE;
+	} else if (!strcmp(string, "nominal")) {
+		*level = CAM_NOMINAL_VOTE;
+	} else if (!strcmp(string, "nominal_l1")) {
+		*level = CAM_NOMINALL1_VOTE;
+	} else if (!strcmp(string, "turbo")) {
+		*level = CAM_TURBO_VOTE;
+	} else {
+		CAM_ERR(CAM_UTIL, "Invalid string %s", string);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * cam_soc_util_get_clk_level_to_apply()
+ *
+ * @brief:              Get the clock level to apply. If the requested level
+ *                      is not valid, bump the level to next available valid
+ *                      level. If no higher level found, return failure.
+ *
+ * @soc_info:           Device soc struct to be populated
+ * @req_level:          Requested level
+ * @apply_level         Level to apply
+ *
+ * @return:             success or failure
+ */
+static int cam_soc_util_get_clk_level_to_apply(
+	struct cam_hw_soc_info *soc_info, enum cam_vote_level req_level,
+	enum cam_vote_level *apply_level)
+{
+	if (req_level >= CAM_MAX_VOTE) {
+		CAM_ERR(CAM_UTIL, "Invalid clock level parameter %d",
+			req_level);
+		return -EINVAL;
+	}
+
+	if (soc_info->clk_level_valid[req_level] == true) {
+		*apply_level = req_level;
+	} else {
+		int i;
+
+		for (i = (req_level + 1); i < CAM_MAX_VOTE; i++)
+			if (soc_info->clk_level_valid[i] == true) {
+				*apply_level = i;
+				break;
+			}
+
+		if (i == CAM_MAX_VOTE) {
+			CAM_ERR(CAM_UTIL,
+				"No valid clock level found to apply, req=%d",
+				req_level);
+			return -EINVAL;
+		}
+	}
+
+	CAM_DBG(CAM_UTIL, "Req level %s, Applying %s",
+		cam_soc_util_get_string_from_level(req_level),
+		cam_soc_util_get_string_from_level(*apply_level));
+
+	return 0;
+}
+
+unsigned long cam_soc_util_get_clk_rate_applied(
+	struct cam_hw_soc_info *soc_info, int32_t index, bool is_src,
+	enum cam_vote_level clk_level)
+{
+	unsigned long clk_rate = 0;
+	struct clk *clk = NULL;
+	int rc = 0;
+	enum cam_vote_level apply_level;
+
+	if (is_src) {
+		clk = soc_info->clk[index];
+		clk_rate = cam_wrapper_clk_get_rate(clk);
+	} else {
+		rc = cam_soc_util_get_clk_level_to_apply(soc_info, clk_level,
+			&apply_level);
+		if (rc)
+			return rc;
+		if (soc_info->clk_rate[apply_level][index] > 0) {
+			clk = soc_info->clk[index];
+			clk_rate = cam_wrapper_clk_get_rate(clk);
+		}
+	}
+	return clk_rate;
+}
+
+int cam_soc_util_irq_enable(struct cam_hw_soc_info *soc_info)
+{
+	int i, rc = 0;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_UTIL, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->irq_count; i++) {
+		if (soc_info->irq_num[i] < 0) {
+			CAM_ERR(CAM_UTIL, "No IRQ line available for irq: %s dev: %s",
+				soc_info->irq_name[i], soc_info->dev_name);
+			rc = -ENODEV;
+			goto disable_irq;
+		}
+
+		enable_irq(soc_info->irq_num[i]);
+	}
+
+	return rc;
+
+disable_irq:
+	for (i = i - 1; i >= 0; i--)
+		disable_irq(soc_info->irq_num[i]);
+
+	return rc;
+}
+
+int cam_soc_util_irq_disable(struct cam_hw_soc_info *soc_info)
+{
+	int i, rc = 0;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_UTIL, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->irq_count; i++) {
+		if (soc_info->irq_num[i] < 0) {
+			CAM_ERR(CAM_UTIL, "No IRQ line available irq: %s dev:",
+				soc_info->irq_name[i], soc_info->dev_name);
+			rc = -ENODEV;
+			continue;
+		}
+
+		disable_irq(soc_info->irq_num[i]);
+	}
+
+	return rc;
+}
+
+long cam_soc_util_get_clk_round_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_index, unsigned long clk_rate)
+{
+	if (!soc_info || (clk_index >= soc_info->num_clk) || (clk_rate == 0)) {
+		CAM_ERR(CAM_UTIL, "Invalid input params %pK, %d %lu",
+			soc_info, clk_index, clk_rate);
+		return clk_rate;
+	}
+
+	return cam_wrapper_clk_round_rate(soc_info->clk[clk_index], clk_rate);
+}
+
+/**
+ * cam_soc_util_set_clk_rate()
+ *
+ * @brief:            Sets the given rate for the clk requested for
+ *
+ * @clk:              Clock structure information for which rate is to be set
+ * @clk_name:         Name of the clock for which rate is being set
+ * @clk_rate:         Clock rate to be set
+ * @shared_clk:       Whether this is a shared clk
+ * @is_src_clk:       Whether this is source clk
+ * @clk_id:           Clock ID
+ * @applied_clk_rate: Final clock rate set to the clk
+ *
+ * @return:         Success or failure
+ */
+static int cam_soc_util_set_clk_rate(struct cam_hw_soc_info *soc_info,
+	struct clk *clk, const char *clk_name,
+	int64_t clk_rate, bool shared_clk, bool is_src_clk, uint32_t clk_id,
+	unsigned long *applied_clk_rate)
+{
+	int rc = 0;
+	long clk_rate_round = -1;
+	bool set_rate = false;
+
+	if (!clk_name) {
+		CAM_ERR(CAM_UTIL, "Invalid input clk %pK clk_name %pK",
+			clk, clk_name);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_UTIL, "set %s, rate %lld", clk_name, clk_rate);
+	if (!clk)
+		return 0;
+	if (clk_rate > 0) {
+		clk_rate_round = cam_wrapper_clk_round_rate(clk, clk_rate);
+		CAM_DBG(CAM_UTIL, "new_rate %ld", clk_rate_round);
+		if (clk_rate_round < 0) {
+			CAM_ERR(CAM_UTIL, "round failed for clock %s rc = %ld",
+				clk_name, clk_rate_round);
+			return clk_rate_round;
+		}
+		set_rate = true;
+	} else if (clk_rate == INIT_RATE) {
+		clk_rate_round = cam_wrapper_clk_get_rate(clk);
+		CAM_DBG(CAM_UTIL, "init new_rate %ld", clk_rate_round);
+		if (clk_rate_round == 0) {
+			clk_rate_round = cam_wrapper_clk_round_rate(clk, 0);
+			if (clk_rate_round <= 0) {
+				CAM_ERR(CAM_UTIL, "round rate failed on %s",
+					clk_name);
+				return clk_rate_round;
+			}
+		}
+		set_rate = true;
+	}
+
+	if (set_rate) {
+		if (shared_clk) {
+			CAM_DBG(CAM_UTIL,
+				"Dev %s clk %s id %d Set Shared clk %ld",
+				soc_info->dev_name, clk_name, clk_id,
+				clk_rate_round);
+			cam_soc_util_clk_wrapper_set_clk_rate(
+				clk_id, soc_info, clk, clk_rate_round);
+		} else {
+			bool set_rate_finish = false;
+
+			CAM_DBG(CAM_UTIL,
+				"Dev %s clk %s clk_id %d src_idx %d src_clk_id %d",
+				soc_info->dev_name, clk_name, clk_id,
+				soc_info->src_clk_idx,
+				(soc_info->src_clk_idx == -1) ? -1 :
+				soc_info->clk_id[soc_info->src_clk_idx]);
+
+			if (is_src_clk && soc_info->mmrm_handle &&
+				!skip_mmrm_set_rate) {
+				uint32_t idx = soc_info->src_clk_idx;
+				uint32_t min_level = soc_info->lowest_clk_level;
+
+				rc = cam_soc_util_set_sw_client_rate_through_mmrm(
+					soc_info->mmrm_handle,
+					soc_info->is_nrt_dev,
+					soc_info->clk_rate[min_level][idx],
+					clk_rate_round, 1);
+
+				if (rc) {
+					CAM_ERR(CAM_UTIL,
+						"set_sw_client_rate through mmrm failed on %s clk_id %d, rate=%ld",
+						clk_name, clk_id, clk_rate_round);
+					return rc;
+				}
+				set_rate_finish = true;
+			}
+
+			if (!set_rate_finish) {
+				rc = cam_wrapper_clk_set_rate(clk, clk_rate_round);
+				if (rc) {
+					CAM_ERR(CAM_UTIL, "set_rate failed on %s", clk_name);
+					return rc;
+				}
+			}
+		}
+	}
+
+	if (applied_clk_rate)
+		*applied_clk_rate = clk_rate_round;
+
+	return rc;
+}
+
+int cam_soc_util_set_src_clk_rate(struct cam_hw_soc_info *soc_info, int cesta_client_idx,
+	unsigned long clk_rate_high, unsigned long clk_rate_low)
+{
+	int rc = 0;
+	int i = 0;
+	int32_t src_clk_idx;
+	int32_t scl_clk_idx;
+	struct clk *clk = NULL;
+	int32_t apply_level;
+	uint32_t clk_level_override_high = 0, clk_level_override_low = 0;
+
+	if (!soc_info || (soc_info->src_clk_idx < 0) ||
+		(soc_info->src_clk_idx >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "Invalid src_clk_idx: %d",
+			soc_info ? soc_info->src_clk_idx : -1);
+		return -EINVAL;
+	}
+
+	src_clk_idx = soc_info->src_clk_idx;
+	clk_level_override_high = soc_info->clk_level_override_high;
+	clk_level_override_low = soc_info->clk_level_override_low;
+
+	if (clk_level_override_high && clk_rate_high)
+		clk_rate_high = soc_info->clk_rate[clk_level_override_high][src_clk_idx];
+
+	if (clk_level_override_low && clk_rate_low)
+		clk_rate_low = soc_info->clk_rate[clk_level_override_low][src_clk_idx];
+
+	clk = soc_info->clk[src_clk_idx];
+	rc = cam_soc_util_get_clk_level(soc_info, clk_rate_high, src_clk_idx,
+		&apply_level);
+	if (rc || (apply_level < 0) || (apply_level >= CAM_MAX_VOTE)) {
+		CAM_ERR(CAM_UTIL,
+			"set %s, rate %lld dev_name = %s apply level = %d",
+			soc_info->clk_name[src_clk_idx], clk_rate_high,
+			soc_info->dev_name, apply_level);
+			return -EINVAL;
+	}
+
+	CAM_DBG(CAM_UTIL,
+		"set %s, cesta_client_idx: %d rate [%ld %ld] dev_name = %s apply level = %d",
+		soc_info->clk_name[src_clk_idx], cesta_client_idx, clk_rate_high, clk_rate_low,
+		soc_info->dev_name, apply_level);
+
+	if ((soc_info->cam_cx_ipeak_enable) && (clk_rate_high > 0)) {
+		cam_cx_ipeak_update_vote_cx_ipeak(soc_info,
+			apply_level);
+	}
+
+	rc = dev_pm_opp_set_rate(soc_info->dev,
+			  soc_info->clk_rate[apply_level][soc_info->src_clk_idx]);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Unable to set operating point for dev %s clk_name %s rc %d",
+			soc_info->dev_name, soc_info->clk_name[soc_info->src_clk_idx],
+			rc);
+		return rc;
+	}
+
+	if (soc_info->is_clk_drv_en && CAM_IS_VALID_CESTA_IDX(cesta_client_idx)) {
+		rc = cam_soc_util_set_cesta_clk_rate(soc_info, cesta_client_idx, clk_rate_high,
+			clk_rate_low,
+			&soc_info->applied_src_clk_rates.hw_client[cesta_client_idx].high,
+			&soc_info->applied_src_clk_rates.hw_client[cesta_client_idx].low);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"Failed in setting cesta clk rates[high low]:[%ld %ld] client_idx:%d rc:%d",
+				clk_rate_high, clk_rate_low, cesta_client_idx, rc);
+			return rc;
+		}
+		goto end;
+	}
+
+	rc = cam_soc_util_set_clk_rate(soc_info, clk,
+		soc_info->clk_name[src_clk_idx], clk_rate_high,
+		CAM_IS_BIT_SET(soc_info->shared_clk_mask, src_clk_idx),
+		true, soc_info->clk_id[src_clk_idx],
+		&soc_info->applied_src_clk_rates.sw_client);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"SET_RATE Failed: src clk: %s, rate %lld, dev_name = %s rc: %d",
+			soc_info->clk_name[src_clk_idx], clk_rate_high,
+			soc_info->dev_name, rc);
+		return rc;
+	}
+
+	/* set clk rate for scalable clk if available */
+
+	for (i = 0; i < soc_info->scl_clk_count; i++) {
+		scl_clk_idx = soc_info->scl_clk_idx[i];
+		if (scl_clk_idx < 0) {
+			CAM_DBG(CAM_UTIL, "Scl clk index invalid");
+			continue;
+		}
+		clk = soc_info->clk[scl_clk_idx];
+		rc = cam_soc_util_set_clk_rate(soc_info, clk,
+			soc_info->clk_name[scl_clk_idx],
+			soc_info->clk_rate[apply_level][scl_clk_idx],
+			CAM_IS_BIT_SET(soc_info->shared_clk_mask, scl_clk_idx),
+			false, soc_info->clk_id[scl_clk_idx],
+			NULL);
+		if (rc) {
+			CAM_WARN(CAM_UTIL,
+			"SET_RATE Failed: scl clk: %s, rate %d dev_name = %s, rc: %d",
+			soc_info->clk_name[scl_clk_idx],
+			soc_info->clk_rate[apply_level][scl_clk_idx],
+			soc_info->dev_name, rc);
+		}
+	}
+
+end:
+	return 0;
+}
+
+int cam_soc_util_put_optional_clk(struct cam_hw_soc_info *soc_info,
+	int32_t clk_indx)
+{
+	if (clk_indx < 0) {
+		CAM_ERR(CAM_UTIL, "Invalid params clk %d", clk_indx);
+		return -EINVAL;
+	}
+
+	if (CAM_IS_BIT_SET(soc_info->optional_shared_clk_mask, clk_indx))
+		cam_soc_util_clk_wrapper_unregister_entry(
+			soc_info->optional_clk_id[clk_indx], soc_info);
+
+	cam_wrapper_clk_put(soc_info->optional_clk[clk_indx]);
+	soc_info->optional_clk[clk_indx] = NULL;
+
+	return 0;
+}
+
+static struct clk *cam_soc_util_option_clk_get(struct device_node *np,
+	int index, uint32_t *clk_id)
+{
+	struct of_phandle_args clkspec;
+	struct clk *clk;
+	int rc;
+
+	if (index < 0)
+		return ERR_PTR(-EINVAL);
+
+	rc = of_parse_phandle_with_args(np, "clocks-option", "#clock-cells",
+		index, &clkspec);
+	if (rc)
+		return ERR_PTR(rc);
+
+	clk = cam_wrapper_of_clk_get_from_provider(&clkspec);
+
+	*clk_id = clkspec.args[0];
+	of_node_put(clkspec.np);
+
+	return clk;
+}
+
+int cam_soc_util_get_option_clk_by_name(struct cam_hw_soc_info *soc_info,
+	const char *clk_name, int32_t *clk_index)
+{
+	int index = 0;
+	int rc = 0;
+	struct device_node *of_node = NULL;
+	uint32_t shared_clk_val;
+
+	if (!soc_info || !clk_name || !clk_index) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid params soc_info %pK clk_name %s clk_index %pK",
+			soc_info, clk_name, clk_index);
+		return -EINVAL;
+	}
+
+	of_node = soc_info->dev->of_node;
+
+	index = of_property_match_string(of_node, "clock-names-option",
+		clk_name);
+	if (index < 0) {
+		CAM_DBG(CAM_UTIL, "No clk data for %s", clk_name);
+		*clk_index = -1;
+		return -EINVAL;
+	}
+
+	if (index >= CAM_SOC_MAX_OPT_CLK) {
+		CAM_ERR(CAM_UTIL, "Insufficient optional clk entries %d %d",
+			index, CAM_SOC_MAX_OPT_CLK);
+		return -EINVAL;
+	}
+
+	of_property_read_string_index(of_node, "clock-names-option",
+		index, &(soc_info->optional_clk_name[index]));
+
+	soc_info->optional_clk[index] = cam_soc_util_option_clk_get(of_node,
+		index, &soc_info->optional_clk_id[index]);
+	if (IS_ERR(soc_info->optional_clk[index])) {
+		CAM_ERR(CAM_UTIL, "No clk named %s found. Dev %s", clk_name,
+			soc_info->dev_name);
+		*clk_index = -1;
+		return -EFAULT;
+	}
+	*clk_index = index;
+
+	rc = of_property_read_u32_index(of_node, "clock-rates-option",
+		index, &soc_info->optional_clk_rate[index]);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Error reading clock-rates clk_name %s index %d",
+			clk_name, index);
+		goto error;
+	}
+
+	/*
+	 * Option clocks are assumed to be available to single Device here.
+	 * Hence use INIT_RATE instead of NO_SET_RATE.
+	 */
+	soc_info->optional_clk_rate[index] =
+		(soc_info->optional_clk_rate[index] == 0) ?
+		(int32_t)INIT_RATE : soc_info->optional_clk_rate[index];
+
+	CAM_DBG(CAM_UTIL, "clk_name %s index %d clk_rate %d",
+		clk_name, *clk_index, soc_info->optional_clk_rate[index]);
+
+	rc = of_property_read_u32_index(of_node, "shared-clks-option",
+		index, &shared_clk_val);
+	if (rc) {
+		CAM_DBG(CAM_UTIL, "Not shared clk  %s index %d",
+			clk_name, index);
+	} else if (shared_clk_val > 1) {
+		CAM_WARN(CAM_UTIL, "Invalid shared clk val %d", shared_clk_val);
+	} else {
+		CAM_DBG(CAM_UTIL,
+			"Dev %s shared clk  %s index %d, clk id %d, shared_clk_val %d",
+			soc_info->dev_name, clk_name, index,
+			soc_info->optional_clk_id[index], shared_clk_val);
+
+		if (shared_clk_val) {
+			CAM_SET_BIT(soc_info->optional_shared_clk_mask, index);
+
+			/* Create a wrapper entry if this is a shared clock */
+			CAM_DBG(CAM_UTIL,
+				"Dev %s, clk %s, id %d register wrapper entry for shared clk",
+				soc_info->dev_name,
+				soc_info->optional_clk_name[index],
+				soc_info->optional_clk_id[index]);
+
+			rc = cam_soc_util_clk_wrapper_register_entry(
+				soc_info->optional_clk_id[index],
+				soc_info->optional_clk[index], false,
+				soc_info,
+				soc_info->optional_clk_rate[index],
+				soc_info->optional_clk_name[index]);
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Failed in registering shared clk Dev %s id %d",
+					soc_info->dev_name,
+					soc_info->optional_clk_id[index]);
+				goto error;
+			}
+		}
+	}
+
+	return 0;
+error:
+	cam_wrapper_clk_put(soc_info->optional_clk[index]);
+	soc_info->optional_clk_rate[index] = 0;
+	soc_info->optional_clk[index] = NULL;
+	*clk_index = -1;
+
+	return rc;
+}
+
+int cam_soc_util_clk_enable(struct cam_hw_soc_info *soc_info, int cesta_client_idx,
+	bool optional_clk, int32_t clk_idx, int32_t apply_level)
+{
+	int rc = 0;
+	struct clk *clk;
+	const char *clk_name;
+	unsigned long clk_rate;
+	uint32_t shared_clk_mask;
+	uint32_t clk_id;
+	bool is_src_clk = false;
+
+	if (!soc_info || (clk_idx < 0) || (apply_level >= CAM_MAX_VOTE)) {
+		CAM_ERR(CAM_UTIL, "Invalid param %d %d", clk_idx, apply_level);
+		return -EINVAL;
+	}
+
+	if (optional_clk) {
+		clk = soc_info->optional_clk[clk_idx];
+		clk_name = soc_info->optional_clk_name[clk_idx];
+		clk_rate = (apply_level == -1) ?
+			0 : soc_info->optional_clk_rate[clk_idx];
+		shared_clk_mask = soc_info->optional_shared_clk_mask;
+		clk_id = soc_info->optional_clk_id[clk_idx];
+	} else {
+		clk = soc_info->clk[clk_idx];
+		clk_name = soc_info->clk_name[clk_idx];
+		clk_rate = (apply_level == -1) ?
+			0 : soc_info->clk_rate[apply_level][clk_idx];
+		shared_clk_mask = soc_info->shared_clk_mask;
+		clk_id = soc_info->clk_id[clk_idx];
+		if (clk_idx == soc_info->src_clk_idx)
+			is_src_clk = true;
+	}
+	if (!clk)
+		return 0;
+
+	if (is_src_clk && soc_info->is_clk_drv_en && CAM_IS_VALID_CESTA_IDX(cesta_client_idx)) {
+		rc = cam_soc_util_set_cesta_clk_rate(soc_info, cesta_client_idx, clk_rate, clk_rate,
+			&soc_info->applied_src_clk_rates.hw_client[cesta_client_idx].high,
+			&soc_info->applied_src_clk_rates.hw_client[cesta_client_idx].low);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"[%s] Failed in setting cesta clk rates[high low]:[%ld %ld] client_idx:%d rc:%d",
+				soc_info->dev_name, clk_rate, clk_rate, cesta_client_idx, rc);
+			return rc;
+		}
+
+		rc = cam_soc_util_cesta_channel_switch(cesta_client_idx, soc_info->dev_name);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"[%s] Failed to apply power states for cesta client:%d rc:%d",
+				soc_info->dev_name, cesta_client_idx, rc);
+			return rc;
+		}
+	} else {
+		rc = cam_soc_util_set_clk_rate(soc_info, clk, clk_name, clk_rate,
+			CAM_IS_BIT_SET(shared_clk_mask, clk_idx), is_src_clk, clk_id,
+			&soc_info->applied_src_clk_rates.sw_client);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "[%s] Failed in setting clk rate %ld rc:%d",
+				soc_info->dev_name, clk_rate, rc);
+			return rc;
+		}
+	}
+
+	CAM_DBG(CAM_UTIL, "[%s] : clk enable %s", soc_info->dev_name, clk_name);
+	rc = cam_wrapper_clk_prepare_enable(clk);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "enable failed for %s: rc(%d)", clk_name, rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_soc_util_clk_disable(struct cam_hw_soc_info *soc_info, int cesta_client_idx,
+	bool optional_clk, int32_t clk_idx)
+{
+	int rc = 0;
+	struct clk *clk;
+	const char *clk_name;
+	uint32_t shared_clk_mask;
+	uint32_t clk_id;
+
+	if (!soc_info || (clk_idx < 0)) {
+		CAM_ERR(CAM_UTIL, "Invalid param %d", clk_idx);
+		return -EINVAL;
+	}
+
+	if (optional_clk) {
+		clk = soc_info->optional_clk[clk_idx];
+		clk_name = soc_info->optional_clk_name[clk_idx];
+		shared_clk_mask = soc_info->optional_shared_clk_mask;
+		clk_id = soc_info->optional_clk_id[clk_idx];
+	} else {
+		clk = soc_info->clk[clk_idx];
+		clk_name = soc_info->clk_name[clk_idx];
+		shared_clk_mask = soc_info->shared_clk_mask;
+		clk_id = soc_info->clk_id[clk_idx];
+	}
+
+	CAM_DBG(CAM_UTIL, "disable %s", clk_name);
+	if (!clk)
+		return 0;
+
+	cam_wrapper_clk_disable_unprepare(clk);
+
+	if ((clk_idx == soc_info->src_clk_idx) && soc_info->is_clk_drv_en &&
+		CAM_IS_VALID_CESTA_IDX(cesta_client_idx)) {
+		rc = cam_soc_util_set_cesta_clk_rate(soc_info, cesta_client_idx, 0, 0,
+			&soc_info->applied_src_clk_rates.hw_client[cesta_client_idx].high,
+			&soc_info->applied_src_clk_rates.hw_client[cesta_client_idx].low);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"Failed in setting cesta clk rates[high low]:[0 0] client_idx:%d rc:%d",
+				cesta_client_idx, rc);
+			return rc;
+		}
+
+		rc = cam_soc_util_cesta_channel_switch(cesta_client_idx, soc_info->dev_name);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY,
+				"Failed to apply power states for cesta_client_idx:%d rc:%d",
+				cesta_client_idx, rc);
+			return rc;
+		}
+	} else {
+		if (CAM_IS_BIT_SET(shared_clk_mask, clk_idx)) {
+			CAM_DBG(CAM_UTIL,
+				"Dev %s clk %s Disabling Shared clk, set 0 rate",
+				soc_info->dev_name, clk_name);
+			cam_soc_util_clk_wrapper_set_clk_rate(clk_id, soc_info, clk, 0);
+		} else if (soc_info->mmrm_handle && (!skip_mmrm_set_rate) &&
+				(soc_info->src_clk_idx == clk_idx)) {
+			CAM_DBG(CAM_UTIL, "Dev %s Disabling %s clk, set 0 rate",
+				soc_info->dev_name, clk_name);
+			cam_soc_util_set_sw_client_rate_through_mmrm(
+				soc_info->mmrm_handle,
+				soc_info->is_nrt_dev,
+				0, 0, 1);
+		}
+	}
+
+	return 0;
+}
+
+void cam_soc_util_power_domain_disable_default(
+	struct cam_hw_soc_info *soc_info)
+{
+	int i, ret = 0, num_pds = soc_info->num_genpd;
+
+	if (num_pds < 1) {
+		CAM_DBG(CAM_UTIL,
+			"power-domains not defined for dev %s num_pds = %d",
+			num_pds, soc_info->dev_name);
+		return;
+	}
+
+	if (num_pds == 1) {
+		dev_pm_genpd_set_performance_state(soc_info->dev, 0);
+		ret = pm_runtime_put_sync(soc_info->dev);
+		CAM_DBG(CAM_UTIL,
+			"power-domain disabled for dev %s ret %d",
+			soc_info->dev_name, ret);
+		return;
+	}
+
+	for (i = num_pds - 1; i >= 0; i--) {
+		if (!soc_info->genpd)
+			continue;
+
+		if (!soc_info->genpd[i])
+			continue;
+
+		dev_pm_genpd_set_performance_state(soc_info->genpd[i], 0);
+		pm_runtime_put(soc_info->genpd[i]);
+	}
+}
+
+/**
+ * cam_soc_util_clk_enable_default()
+ *
+ * @brief:              This function enables the default clocks present
+ *                      in soc_info
+ *
+ * @soc_info:           Device soc struct to be populated
+ * @cesta_client_idx:   CESTA Client idx for hw client based src clocks
+ * @clk_level:          Clk level to apply while enabling
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_clk_enable_default(struct cam_hw_soc_info *soc_info,
+	int cesta_client_idx, enum cam_vote_level clk_level)
+{
+	int                          i, rc = 0;
+	enum cam_vote_level          apply_level;
+
+	if ((soc_info->num_clk == 0) ||
+		(soc_info->num_clk >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "Invalid number of clock %d",
+			soc_info->num_clk);
+		return -EINVAL;
+	}
+
+	rc = cam_soc_util_get_clk_level_to_apply(soc_info, clk_level,
+		&apply_level);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "[%s] : failed to get level clk_level=%d, rc=%d",
+			soc_info->dev_name, clk_level, rc);
+		return rc;
+	}
+
+	if (soc_info->cam_cx_ipeak_enable)
+		cam_cx_ipeak_update_vote_cx_ipeak(soc_info, apply_level);
+
+	rc = dev_pm_opp_set_rate(soc_info->dev,
+			soc_info->clk_rate[apply_level][soc_info->src_clk_idx]);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Unable to set operating point for dev %s clk_name %s rc %d",
+			soc_info->dev_name, soc_info->clk_name[soc_info->src_clk_idx],
+			rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_UTIL, "Dev[%s] : cesta client %d, request level %s, apply level %s",
+		soc_info->dev_name, cesta_client_idx,
+		cam_soc_util_get_string_from_level(clk_level),
+		cam_soc_util_get_string_from_level(apply_level));
+
+	memset(&soc_info->applied_src_clk_rates, 0, sizeof(struct cam_soc_util_clk_rates));
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		rc = cam_soc_util_clk_enable(soc_info, cesta_client_idx, false, i, apply_level);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"[%s] : failed to enable clk apply_level=%d, rc=%d, cesta_client_idx=%d",
+				soc_info->dev_name, apply_level, rc, cesta_client_idx);
+			goto clk_disable;
+		}
+
+		if (soc_info->cam_cx_ipeak_enable)
+			CAM_DBG(CAM_UTIL,
+				"dev name = %s clk name = %s idx = %d apply_level = %d clc idx = %d",
+				soc_info->dev_name, soc_info->clk_name[i], i, apply_level, i);
+	}
+
+	return rc;
+
+clk_disable:
+	if (soc_info->cam_cx_ipeak_enable)
+		cam_cx_ipeak_update_vote_cx_ipeak(soc_info, 0);
+	for (i--; i >= 0; i--) {
+		cam_soc_util_clk_disable(soc_info, cesta_client_idx, false, i);
+	}
+
+	return rc;
+}
+
+/**
+ * cam_soc_util_clk_disable_default()
+ *
+ * @brief:              This function disables the default clocks present
+ *                      in soc_info
+ *
+ * @soc_info:           device soc struct to be populated
+ * @cesta_client_idx:   CESTA Client idx for hw client based src clocks
+ *
+ * @return:             success or failure
+ */
+void cam_soc_util_clk_disable_default(struct cam_hw_soc_info *soc_info,
+	int cesta_client_idx)
+{
+	int i;
+
+	if (soc_info->num_clk == 0)
+		return;
+
+	if (soc_info->cam_cx_ipeak_enable)
+		cam_cx_ipeak_unvote_cx_ipeak(soc_info);
+
+	dev_pm_opp_set_rate(soc_info->dev, 0);
+
+	for (i = soc_info->num_clk - 1; i >= 0; i--)
+		cam_soc_util_clk_disable(soc_info, cesta_client_idx, false, i);
+}
+
+/**
+ * cam_soc_util_get_dt_clk_info()
+ *
+ * @brief:              Parse the DT and populate the Clock properties
+ *
+ * @soc_info:           device soc struct to be populated
+ * @src_clk_str         name of src clock that has rate control
+ *
+ * @return:             success or failure
+ */
+static int cam_soc_util_get_dt_clk_info(struct cam_hw_soc_info *soc_info)
+{
+	struct device_node *of_node = NULL;
+	int count;
+	int num_clk_rates, num_clk_levels;
+	int i, j, rc;
+	int32_t num_clk_level_strings;
+	const char *src_clk_str = NULL;
+	const char *scl_clk_str = NULL;
+	const char *clk_control_debugfs = NULL;
+	const char *clk_cntl_lvl_string = NULL;
+	enum cam_vote_level level;
+	int shared_clk_cnt;
+	struct of_phandle_args clk_args = {0};
+
+	if (!soc_info || !soc_info->dev)
+		return -EINVAL;
+
+	of_node = soc_info->dev->of_node;
+
+	if (!of_property_read_bool(of_node, "use-shared-clk")) {
+		CAM_DBG(CAM_UTIL, "No shared clk parameter defined");
+		soc_info->use_shared_clk = false;
+	} else {
+		soc_info->use_shared_clk = true;
+	}
+
+	count = of_property_count_strings(of_node, "clock-names");
+
+	CAM_DBG(CAM_UTIL, "E: dev_name = %s count = %d",
+		soc_info->dev_name, count);
+	if (count > CAM_SOC_MAX_CLK) {
+		CAM_ERR(CAM_UTIL, "invalid count of clocks, count=%d", count);
+		rc = -EINVAL;
+		return rc;
+	}
+	if (count <= 0) {
+		CAM_DBG(CAM_UTIL, "No clock-names found");
+		count = 0;
+		soc_info->num_clk = count;
+		return 0;
+	}
+	soc_info->num_clk = count;
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node, "clock-names",
+				i, &(soc_info->clk_name[i]));
+		CAM_DBG(CAM_UTIL, "clock-names[%d] = %s",
+			i, soc_info->clk_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"i= %d count= %d reading clock-names failed",
+				i, count);
+			return rc;
+		}
+	}
+
+	num_clk_rates = of_property_count_u32_elems(of_node, "clock-rates");
+	if (num_clk_rates <= 0) {
+		CAM_ERR(CAM_UTIL, "reading clock-rates count failed");
+		return -EINVAL;
+	}
+
+	if ((num_clk_rates % soc_info->num_clk) != 0) {
+		CAM_ERR(CAM_UTIL,
+			"mismatch clk/rates, No of clocks=%d, No of rates=%d",
+			soc_info->num_clk, num_clk_rates);
+		return -EINVAL;
+	}
+
+	num_clk_levels = (num_clk_rates / soc_info->num_clk);
+
+	num_clk_level_strings = of_property_count_strings(of_node,
+		"clock-cntl-level");
+	if (num_clk_level_strings != num_clk_levels) {
+		CAM_ERR(CAM_UTIL,
+			"Mismatch No of levels=%d, No of level string=%d",
+			num_clk_levels, num_clk_level_strings);
+		return -EINVAL;
+	}
+
+	soc_info->lowest_clk_level = CAM_TURBO_VOTE;
+
+	for (i = 0; i < num_clk_levels; i++) {
+		rc = of_property_read_string_index(of_node,
+			"clock-cntl-level", i, &clk_cntl_lvl_string);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"Error reading clock-cntl-level, rc=%d", rc);
+			return rc;
+		}
+
+		rc = cam_soc_util_get_level_from_string(clk_cntl_lvl_string,
+			&level);
+		if (rc)
+			return rc;
+
+		CAM_DBG(CAM_UTIL,
+			"[%d] : %s %d", i, clk_cntl_lvl_string, level);
+		soc_info->clk_level_valid[level] = true;
+		for (j = 0; j < soc_info->num_clk; j++) {
+			rc = of_property_read_u32_index(of_node, "clock-rates",
+				((i * soc_info->num_clk) + j),
+				&soc_info->clk_rate[level][j]);
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Error reading clock-rates, rc=%d",
+					rc);
+				return rc;
+			}
+
+			soc_info->clk_rate[level][j] =
+				(soc_info->clk_rate[level][j] == 0) ?
+				(int32_t)NO_SET_RATE :
+				soc_info->clk_rate[level][j];
+
+			CAM_DBG(CAM_UTIL, "soc_info->clk_rate[%d][%d] = %d",
+				level, j,
+				soc_info->clk_rate[level][j]);
+		}
+
+		if ((level > CAM_MINSVS_VOTE) &&
+			(level < soc_info->lowest_clk_level))
+			soc_info->lowest_clk_level = level;
+	}
+
+	soc_info->src_clk_idx = -1;
+	rc = of_property_read_string_index(of_node, "src-clock-name", 0,
+		&src_clk_str);
+	if (rc || !src_clk_str) {
+		CAM_DBG(CAM_UTIL, "No src_clk_str found");
+		rc = 0;
+		goto end;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (strcmp(soc_info->clk_name[i], src_clk_str) == 0) {
+			soc_info->src_clk_idx = i;
+			CAM_DBG(CAM_UTIL, "src clock = %s, index = %d",
+				src_clk_str, i);
+		}
+
+		rc = of_parse_phandle_with_args(of_node, "clocks",
+			"#clock-cells", i, &clk_args);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"failed to clock info rc=%d", rc);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		soc_info->clk_id[i] = clk_args.args[0];
+		of_node_put(clk_args.np);
+
+		CAM_DBG(CAM_UTIL, "Dev %s clk %s id %d",
+			soc_info->dev_name, soc_info->clk_name[i],
+			soc_info->clk_id[i]);
+	}
+
+	CAM_DBG(CAM_UTIL, "Dev %s src_clk_idx %d, lowest_clk_level %d",
+		soc_info->dev_name, soc_info->src_clk_idx,
+		soc_info->lowest_clk_level);
+
+	soc_info->shared_clk_mask = 0;
+	shared_clk_cnt = of_property_count_u32_elems(of_node, "shared-clks");
+	if (shared_clk_cnt <= 0) {
+		CAM_DBG(CAM_UTIL, "Dev %s, no shared clks", soc_info->dev_name);
+	} else if (shared_clk_cnt != count) {
+		CAM_ERR(CAM_UTIL, "Dev %s, incorrect shared clock count %d %d",
+			soc_info->dev_name, shared_clk_cnt, count);
+		rc = -EINVAL;
+		goto end;
+	} else {
+		uint32_t shared_clk_val;
+
+		for (i = 0; i < shared_clk_cnt; i++) {
+			rc = of_property_read_u32_index(of_node,
+				"shared-clks", i, &shared_clk_val);
+			if (rc || (shared_clk_val > 1)) {
+				CAM_ERR(CAM_UTIL,
+					"Incorrect shared clk info at %d, val=%d, count=%d",
+					i, shared_clk_val, shared_clk_cnt);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			if (shared_clk_val)
+				CAM_SET_BIT(soc_info->shared_clk_mask, i);
+		}
+
+		CAM_DBG(CAM_UTIL, "Dev %s shared clk mask 0x%x",
+			soc_info->dev_name, soc_info->shared_clk_mask);
+	}
+
+	/* scalable clk info parsing */
+	soc_info->scl_clk_count = 0;
+	soc_info->scl_clk_count = of_property_count_strings(of_node,
+		"scl-clk-names");
+	if ((soc_info->scl_clk_count <= 0) ||
+		(soc_info->scl_clk_count > CAM_SOC_MAX_CLK)) {
+		if (soc_info->scl_clk_count == -EINVAL) {
+			CAM_DBG(CAM_UTIL, "scl_clk_name prop not avialable");
+		} else if ((soc_info->scl_clk_count == -ENODATA) ||
+			(soc_info->scl_clk_count > CAM_SOC_MAX_CLK)) {
+			CAM_ERR(CAM_UTIL, "Invalid scl_clk_count: %d",
+				soc_info->scl_clk_count);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_UTIL, "Invalid scl_clk count: %d",
+			soc_info->scl_clk_count);
+		soc_info->scl_clk_count = -1;
+	} else {
+		CAM_DBG(CAM_UTIL, "No of scalable clocks: %d",
+			soc_info->scl_clk_count);
+		for (i = 0; i < soc_info->scl_clk_count; i++) {
+			rc = of_property_read_string_index(of_node,
+				"scl-clk-names", i,
+				(const char **)&scl_clk_str);
+			if (rc || !scl_clk_str) {
+				CAM_WARN(CAM_UTIL, "scl_clk_str is NULL");
+				soc_info->scl_clk_idx[i] = -1;
+				continue;
+			}
+			for (j = 0; j < soc_info->num_clk; j++) {
+				if (strnstr(scl_clk_str, soc_info->clk_name[j],
+					strlen(scl_clk_str))) {
+					soc_info->scl_clk_idx[i] = j;
+					CAM_DBG(CAM_UTIL,
+						"scl clock = %s, index = %d",
+						scl_clk_str, j);
+					break;
+				}
+			}
+		}
+	}
+
+	rc = of_property_read_string_index(of_node,
+		"clock-control-debugfs", 0, &clk_control_debugfs);
+	if (rc || !clk_control_debugfs) {
+		CAM_DBG(CAM_UTIL, "No clock_control_debugfs property found");
+		rc = 0;
+		goto end;
+	}
+
+	if (strcmp("true", clk_control_debugfs) == 0)
+		soc_info->clk_control_enable = true;
+
+	CAM_DBG(CAM_UTIL, "X: dev_name = %s count = %d",
+		soc_info->dev_name, count);
+end:
+	return rc;
+}
+
+int cam_soc_util_set_clk_rate_level(struct cam_hw_soc_info *soc_info,
+	int cesta_client_idx, enum cam_vote_level clk_level_high,
+	enum cam_vote_level clk_level_low, bool do_not_set_src_clk)
+{
+	int i, rc = 0;
+	enum cam_vote_level apply_level_high;
+	enum cam_vote_level apply_level_low = soc_info->lowest_clk_level;
+	unsigned long applied_clk_rate;
+
+	if ((soc_info->num_clk == 0) ||
+		(soc_info->num_clk >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "Invalid number of clock %d", soc_info->num_clk);
+		return -EINVAL;
+	}
+
+	rc = cam_soc_util_get_clk_level_to_apply(soc_info, clk_level_high,
+		&apply_level_high);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "[%s] : failed to get level clk_level_high=%d, rc=%d",
+			soc_info->dev_name, clk_level_high, rc);
+		return rc;
+	}
+
+	if (soc_info->is_clk_drv_en && CAM_IS_VALID_CESTA_IDX(cesta_client_idx)) {
+		rc = cam_soc_util_get_clk_level_to_apply(soc_info, clk_level_low,
+			&apply_level_low);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "[%s] : failed to get level clk_level_low=%d, rc=%d",
+				soc_info->dev_name, clk_level_low, rc);
+			return rc;
+		}
+	}
+
+	if (soc_info->cam_cx_ipeak_enable)
+		cam_cx_ipeak_update_vote_cx_ipeak(soc_info, apply_level_high);
+
+	rc = dev_pm_opp_set_rate(soc_info->dev,
+			  soc_info->clk_rate[apply_level_high][soc_info->src_clk_idx]);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Unable to set operating point for dev %s clk_name %s rc %d",
+			soc_info->dev_name, soc_info->clk_name[soc_info->src_clk_idx],
+			rc);
+		return rc;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (do_not_set_src_clk && (i == soc_info->src_clk_idx)) {
+			CAM_DBG(CAM_UTIL, "Skipping set rate for src clk %s",
+				soc_info->clk_name[i]);
+			continue;
+		}
+
+		if (soc_info->is_clk_drv_en && CAM_IS_VALID_CESTA_IDX(cesta_client_idx) &&
+			(i == soc_info->src_clk_idx)) {
+			rc = cam_soc_util_set_cesta_clk_rate(soc_info, cesta_client_idx,
+				soc_info->clk_rate[apply_level_high][i],
+				soc_info->clk_rate[apply_level_low][i],
+				&soc_info->applied_src_clk_rates.hw_client[cesta_client_idx].high,
+				&soc_info->applied_src_clk_rates.hw_client[cesta_client_idx].low);
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Failed to set the req clk level[high low]: [%s %s] cesta_client_idx: %d",
+					cam_soc_util_get_string_from_level(apply_level_high),
+					cam_soc_util_get_string_from_level(apply_level_low),
+					cesta_client_idx);
+				break;
+			}
+
+			continue;
+		}
+
+		CAM_DBG(CAM_UTIL, "Set rate for clk %s rate %d", soc_info->clk_name[i],
+			soc_info->clk_rate[apply_level_high][i]);
+
+		rc = cam_soc_util_set_clk_rate(soc_info, soc_info->clk[i],
+			soc_info->clk_name[i],
+			soc_info->clk_rate[apply_level_high][i],
+			CAM_IS_BIT_SET(soc_info->shared_clk_mask, i),
+			(i == soc_info->src_clk_idx) ? true : false,
+			soc_info->clk_id[i],
+			&applied_clk_rate);
+		if (rc < 0) {
+			CAM_DBG(CAM_UTIL,
+				"dev name = %s clk_name = %s idx = %d apply_level = %s",
+				soc_info->dev_name, soc_info->clk_name[i],
+				i, cam_soc_util_get_string_from_level(apply_level_high));
+			if (soc_info->cam_cx_ipeak_enable)
+				cam_cx_ipeak_update_vote_cx_ipeak(soc_info, 0);
+			break;
+		}
+
+		if (i == soc_info->src_clk_idx)
+			soc_info->applied_src_clk_rates.sw_client = applied_clk_rate;
+	}
+
+	return rc;
+};
+
+int cam_soc_util_dump_clk(struct cam_hw_soc_info *soc_info)
+{
+	int i, rc = 0;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		CAM_INFO(CAM_UTIL, "Dumping clock = %s", soc_info->clk_name[i]);
+		qcom_clk_dump(soc_info->clk[i], NULL, false);
+	}
+
+	return rc;
+}
+
+static int cam_soc_util_get_dt_gpio_req_tbl(struct device_node *of_node,
+	struct cam_soc_gpio_data *gconf, uint16_t *gpio_array,
+	uint16_t gpio_array_size)
+{
+	int32_t rc = 0, i = 0;
+	uint32_t count = 0;
+	uint32_t *val_array = NULL;
+
+	if (!of_get_property(of_node, "gpio-req-tbl-num", &count))
+		return 0;
+
+	count /= sizeof(uint32_t);
+	if (!count) {
+		CAM_ERR(CAM_UTIL, "gpio-req-tbl-num 0");
+		return 0;
+	}
+
+	val_array = kcalloc(count, sizeof(uint32_t), GFP_KERNEL);
+	if (!val_array)
+		return -ENOMEM;
+
+	gconf->cam_gpio_req_tbl = kcalloc(count, sizeof(struct gpio),
+		GFP_KERNEL);
+	if (!gconf->cam_gpio_req_tbl) {
+		rc = -ENOMEM;
+		goto free_val_array;
+	}
+	gconf->cam_gpio_req_tbl_size = count;
+
+	rc = of_property_read_u32_array(of_node, "gpio-req-tbl-num",
+		val_array, count);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "failed in reading gpio-req-tbl-num, rc = %d",
+			rc);
+		goto free_gpio_req_tbl;
+	}
+
+	for (i = 0; i < count; i++) {
+		if (val_array[i] >= gpio_array_size) {
+			CAM_ERR(CAM_UTIL, "gpio req tbl index %d invalid",
+				val_array[i]);
+			goto free_gpio_req_tbl;
+		}
+		gconf->cam_gpio_req_tbl[i].gpio = gpio_array[val_array[i]];
+		CAM_DBG(CAM_UTIL, "cam_gpio_req_tbl[%d].gpio = %d", i,
+			gconf->cam_gpio_req_tbl[i].gpio);
+	}
+
+	rc = of_property_read_u32_array(of_node, "gpio-req-tbl-flags",
+		val_array, count);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Failed in gpio-req-tbl-flags, rc %d", rc);
+		goto free_gpio_req_tbl;
+	}
+
+	for (i = 0; i < count; i++) {
+		gconf->cam_gpio_req_tbl[i].flags = val_array[i];
+		CAM_DBG(CAM_UTIL, "cam_gpio_req_tbl[%d].flags = %ld", i,
+			gconf->cam_gpio_req_tbl[i].flags);
+	}
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node,
+			"gpio-req-tbl-label", i,
+			&gconf->cam_gpio_req_tbl[i].label);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Failed rc %d", rc);
+			goto free_gpio_req_tbl;
+		}
+		CAM_DBG(CAM_UTIL, "cam_gpio_req_tbl[%d].label = %s", i,
+			gconf->cam_gpio_req_tbl[i].label);
+	}
+
+	kfree(val_array);
+
+	return rc;
+
+free_gpio_req_tbl:
+	kfree(gconf->cam_gpio_req_tbl);
+free_val_array:
+	kfree(val_array);
+	gconf->cam_gpio_req_tbl_size = 0;
+
+	return rc;
+}
+
+static int cam_soc_util_get_gpio_info(struct cam_hw_soc_info *soc_info)
+{
+	int32_t rc = 0, i = 0;
+	uint16_t *gpio_array = NULL;
+	int16_t gpio_array_size = 0;
+	struct cam_soc_gpio_data *gconf = NULL;
+	struct device_node *of_node = NULL;
+
+	if (!soc_info || !soc_info->dev)
+		return -EINVAL;
+
+	if (soc_info->is_child_node) {
+		of_node = soc_info->parent_node;
+	} else {
+		of_node = soc_info->dev->of_node;
+	}
+
+	if (!of_node) {
+		CAM_ERR(CAM_UTIL, "of_node is NULL");
+		return -EINVAL;
+	}
+
+	/* Validate input parameters */
+	if (!of_node) {
+		CAM_ERR(CAM_UTIL, "Invalid param of_node");
+		return -EINVAL;
+	}
+
+	gpio_array_size = of_count_phandle_with_args(of_node, "gpios", "#gpio-cells");
+
+	if (gpio_array_size <= 0)
+		return 0;
+
+	CAM_DBG(CAM_UTIL, "gpio count %d", gpio_array_size);
+
+	gpio_array = kcalloc(gpio_array_size, sizeof(uint16_t), GFP_KERNEL);
+	if (!gpio_array) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < gpio_array_size; i++) {
+		gpio_array[i] = of_get_named_gpio(of_node, "gpios", i);
+		CAM_DBG(CAM_UTIL, "gpio_array[%d] = %d", i, gpio_array[i]);
+	}
+
+	gconf = kzalloc(sizeof(*gconf), GFP_KERNEL);
+	if (!gconf) {
+		rc = -ENOMEM;
+		goto free_gpio_array;
+	}
+
+	rc = cam_soc_util_get_dt_gpio_req_tbl(of_node, gconf, gpio_array,
+		gpio_array_size);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "failed in msm_camera_get_dt_gpio_req_tbl");
+		goto free_gpio_conf;
+	}
+
+	gconf->cam_gpio_common_tbl = kcalloc(gpio_array_size,
+				sizeof(struct gpio), GFP_KERNEL);
+	if (!gconf->cam_gpio_common_tbl) {
+		rc = -ENOMEM;
+		goto free_gpio_conf;
+	}
+
+	for (i = 0; i < gpio_array_size; i++)
+		gconf->cam_gpio_common_tbl[i].gpio = gpio_array[i];
+
+	gconf->cam_gpio_common_tbl_size = gpio_array_size;
+	soc_info->gpio_data = gconf;
+	kfree(gpio_array);
+
+	return rc;
+
+free_gpio_conf:
+	kfree(gconf);
+free_gpio_array:
+	kfree(gpio_array);
+err:
+	soc_info->gpio_data = NULL;
+
+	return rc;
+}
+
+static int cam_soc_util_request_gpio_table(
+	struct cam_hw_soc_info *soc_info, bool gpio_en)
+{
+	int rc = 0, i = 0;
+	uint8_t size = 0;
+	struct cam_soc_gpio_data *gpio_conf =
+			soc_info->gpio_data;
+	struct gpio *gpio_tbl = NULL;
+
+
+	if (!gpio_conf) {
+		CAM_DBG(CAM_UTIL, "No GPIO entry");
+		return 0;
+	}
+	if (gpio_conf->cam_gpio_common_tbl_size <= 0) {
+		CAM_ERR(CAM_UTIL, "GPIO table size is invalid");
+		return -EINVAL;
+	}
+	size = gpio_conf->cam_gpio_req_tbl_size;
+	gpio_tbl = gpio_conf->cam_gpio_req_tbl;
+
+	if (!gpio_tbl || !size) {
+		CAM_ERR(CAM_UTIL, "Invalid gpio_tbl %pK / size %d",
+			gpio_tbl, size);
+		return -EINVAL;
+	}
+	for (i = 0; i < size; i++) {
+		CAM_DBG(CAM_UTIL, "i=%d, gpio=%d dir=%ld", i,
+			gpio_tbl[i].gpio, gpio_tbl[i].flags);
+	}
+	if (gpio_en) {
+		for (i = 0; i < size; i++) {
+			rc = gpio_request_one(gpio_tbl[i].gpio,
+				gpio_tbl[i].flags, gpio_tbl[i].label);
+			if (rc) {
+				/*
+				 * After GPIO request fails, contine to
+				 * apply new gpios, outout a error message
+				 * for driver bringup debug
+				 */
+				CAM_ERR(CAM_UTIL, "gpio %d:%s request fails",
+					gpio_tbl[i].gpio, gpio_tbl[i].label);
+			}
+		}
+	} else {
+		gpio_free_array(gpio_tbl, size);
+	}
+
+	return rc;
+}
+
+static int cam_soc_util_get_dt_regulator_info
+	(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0, count = 0, i = 0;
+	struct device_node *of_node = NULL;
+
+	if (!soc_info || !soc_info->dev) {
+		CAM_ERR(CAM_UTIL, "Invalid parameters");
+		return -EINVAL;
+	}
+
+	if (soc_info->is_child_node) {
+		of_node = soc_info->parent_node;
+	} else {
+		of_node = soc_info->dev->of_node;
+	}
+
+	if (!of_node) {
+		CAM_ERR(CAM_UTIL, "of_node is NULL");
+		return -EINVAL;
+	}
+
+	soc_info->num_rgltr = 0;
+	count = of_property_count_strings(of_node, "regulator-names");
+	if (count != -EINVAL) {
+		if (count <= 0) {
+			CAM_ERR(CAM_UTIL, "no regulators found");
+			return -EINVAL;
+		}
+
+		soc_info->num_rgltr = count;
+
+	} else {
+		CAM_DBG(CAM_UTIL, "No regulators node found");
+		return 0;
+	}
+
+	if (soc_info->num_rgltr > CAM_SOC_MAX_REGULATOR) {
+		CAM_ERR(CAM_UTIL, "Invalid regulator count:%d",
+			soc_info->num_rgltr);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = of_property_read_string_index(of_node,
+			"regulator-names", i, &soc_info->rgltr_name[i]);
+		CAM_DBG(CAM_UTIL, "rgltr_name[%d] = %s",
+			i, soc_info->rgltr_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "no regulator resource at cnt=%d", i);
+			return -ENODEV;
+		}
+	}
+
+	if (!of_property_read_bool(of_node, "rgltr-cntrl-support")) {
+		CAM_DBG(CAM_UTIL, "No regulator control parameter defined");
+		soc_info->rgltr_ctrl_support = false;
+		return 0;
+	}
+
+	soc_info->rgltr_ctrl_support = true;
+
+	rc = of_property_read_u32_array(of_node, "rgltr-min-voltage",
+		soc_info->rgltr_min_volt, soc_info->num_rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "No minimum volatage value found, rc=%d", rc);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32_array(of_node, "rgltr-max-voltage",
+		soc_info->rgltr_max_volt, soc_info->num_rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "No maximum volatage value found, rc=%d", rc);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32_array(of_node, "rgltr-load-current",
+		soc_info->rgltr_op_mode, soc_info->num_rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "No Load curent found rc=%d", rc);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+#ifdef CONFIG_CAM_PRESIL
+static uint32_t next_dummy_irq_line_num = 0x000f;
+struct resource dummy_irq_line[512];
+#endif
+
+int cam_soc_util_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	struct device_node *of_node = NULL;
+	int count = 0, i = 0, rc = 0;
+
+	if (!soc_info || !soc_info->dev)
+		return -EINVAL;
+
+	of_node = soc_info->dev->of_node;
+
+	rc = of_property_read_u32(of_node, "cell-index", &soc_info->index);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "device %s failed to read cell-index",
+			soc_info->dev_name);
+		return rc;
+	}
+
+	count = of_property_count_strings(of_node, "reg-names");
+	if (count <= 0) {
+		CAM_DBG(CAM_UTIL, "no reg-names found for: %s",
+			soc_info->dev_name);
+		count = 0;
+	}
+	soc_info->num_mem_block = count;
+
+	for (i = 0; i < soc_info->num_mem_block; i++) {
+		rc = of_property_read_string_index(of_node, "reg-names", i,
+			&soc_info->mem_block_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "failed to read reg-names at %d", i);
+			return rc;
+		}
+		soc_info->mem_block[i] =
+			platform_get_resource_byname(soc_info->pdev,
+			IORESOURCE_MEM, soc_info->mem_block_name[i]);
+
+		if (!soc_info->mem_block[i]) {
+			CAM_ERR(CAM_UTIL, "no mem resource by name %s",
+				soc_info->mem_block_name[i]);
+			rc = -ENODEV;
+			return rc;
+		}
+	}
+
+	rc = of_property_read_string(of_node, "label", &soc_info->label_name);
+	if (rc)
+		CAM_DBG(CAM_UTIL, "Label is not available in the node: %d", rc);
+
+	if (soc_info->num_mem_block > 0) {
+		rc = of_property_read_u32_array(of_node, "reg-cam-base",
+			soc_info->mem_block_cam_base, soc_info->num_mem_block);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Error reading register offsets");
+			return rc;
+		}
+	}
+
+	count = of_property_count_strings(of_node, "interrupt-names");
+	if (count <= 0) {
+		CAM_DBG(CAM_UTIL, "No interrupt line present for: %s", soc_info->dev_name);
+		soc_info->irq_count = 0;
+	} else {
+		if (count > CAM_SOC_MAX_IRQ_LINES_PER_DEV) {
+			CAM_ERR(CAM_UTIL,
+				"Number of interrupt: %d exceeds maximum allowable interrupts: %d",
+				count, CAM_SOC_MAX_IRQ_LINES_PER_DEV);
+			return -EINVAL;
+		}
+
+		soc_info->irq_count = count;
+		for (i = 0; i < soc_info->irq_count; i++) {
+			rc = of_property_read_string_index(of_node, "interrupt-names",
+				i, &soc_info->irq_name[i]);
+			if (rc) {
+				CAM_ERR(CAM_UTIL, "failed to read interrupt name at %d", i);
+				return rc;
+			}
+		}
+
+		rc = cam_compat_util_get_irq(soc_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_UTIL, "get irq resource failed: %d for: %s",
+				rc, soc_info->dev_name);
+#ifndef CONFIG_CAM_PRESIL
+			return rc;
+#else
+			/* Pre-sil for new devices not present on old */
+			for (i = 0; i < soc_info->irq_count; i++) {
+				soc_info->irq_line[i] =
+					&dummy_irq_line[next_dummy_irq_line_num++];
+				CAM_DBG(CAM_PRESIL,
+					"interrupt line for dev %s irq name %s number %d",
+					soc_info->dev_name, soc_info->irq_name[i],
+					soc_info->irq_line[i]->start);
+			}
+#endif
+		}
+	}
+
+	rc = of_property_read_string_index(of_node, "compatible", 0,
+		(const char **)&soc_info->compatible);
+	if (rc)
+		CAM_DBG(CAM_UTIL, "No compatible string present for: %s",
+			soc_info->dev_name);
+
+	soc_info->is_nrt_dev = false;
+	if (of_property_read_bool(of_node, "nrt-device"))
+		soc_info->is_nrt_dev = true;
+	CAM_DBG(CAM_UTIL, "Dev %s, nrt_dev %d",
+		soc_info->dev_name, soc_info->is_nrt_dev);
+
+	rc = cam_soc_util_get_dt_regulator_info(soc_info);
+	if (rc)
+		return rc;
+
+	rc = cam_soc_util_get_dt_clk_info(soc_info);
+	if (rc)
+		return rc;
+
+	rc = cam_soc_util_get_gpio_info(soc_info);
+	if (rc)
+		return rc;
+
+	if (of_find_property(of_node, "qcom,cam-cx-ipeak", NULL))
+		rc = cam_cx_ipeak_register_cx_ipeak(soc_info);
+
+	return rc;
+}
+
+/**
+ * cam_soc_util_get_regulator()
+ *
+ * @brief:              Get regulator resource named vdd
+ *
+ * @dev:                Device associated with regulator
+ * @reg:                Return pointer to be filled with regulator on success
+ * @rgltr_name:         Name of regulator to get
+ *
+ * @return:             0 for Success, negative value for failure
+ */
+static int cam_soc_util_get_regulator(struct device *dev,
+	struct regulator **reg, const char *rgltr_name)
+{
+	int rc = 0;
+	*reg = cam_wrapper_regulator_get(dev, rgltr_name);
+	if (IS_ERR_OR_NULL(*reg)) {
+		rc = PTR_ERR(*reg);
+		rc = rc ? rc : -EINVAL;
+		CAM_ERR(CAM_UTIL, "Regulator %s get failed %d", rgltr_name, rc);
+		*reg = NULL;
+	}
+	return rc;
+}
+
+int cam_soc_util_regulator_disable(struct regulator *rgltr,
+	const char *rgltr_name, uint32_t rgltr_min_volt,
+	uint32_t rgltr_max_volt, uint32_t rgltr_op_mode,
+	uint32_t rgltr_delay_ms)
+{
+	int32_t rc = 0;
+
+	if (!rgltr) {
+		CAM_ERR(CAM_UTIL, "Invalid NULL parameter");
+		return -EINVAL;
+	}
+
+	rc = cam_wrapper_regulator_disable(rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "%s regulator disable failed", rgltr_name);
+		return rc;
+	}
+
+	if (rgltr_delay_ms > 20)
+		msleep(rgltr_delay_ms);
+	else if (rgltr_delay_ms)
+		usleep_range(rgltr_delay_ms * 1000,
+			(rgltr_delay_ms * 1000) + 1000);
+
+	if (cam_wrapper_regulator_count_voltages(rgltr) > 0) {
+		cam_wrapper_regulator_set_load(rgltr, 0);
+		cam_wrapper_regulator_set_voltage(rgltr, 0, rgltr_max_volt);
+	}
+
+	return rc;
+}
+
+
+int cam_soc_util_regulator_enable(struct regulator *rgltr,
+	const char *rgltr_name,
+	uint32_t rgltr_min_volt, uint32_t rgltr_max_volt,
+	uint32_t rgltr_op_mode, uint32_t rgltr_delay)
+{
+	int32_t rc = 0;
+
+	if (!rgltr) {
+		CAM_ERR(CAM_UTIL, "Invalid NULL parameter");
+		return -EINVAL;
+	}
+
+	if (cam_wrapper_regulator_count_voltages(rgltr) > 0) {
+		CAM_DBG(CAM_UTIL, "[%s] voltage min=%d, max=%d",
+			rgltr_name, rgltr_min_volt, rgltr_max_volt);
+
+		rc = cam_wrapper_regulator_set_voltage(
+			rgltr, rgltr_min_volt, rgltr_max_volt);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "%s set voltage failed", rgltr_name);
+			return rc;
+		}
+
+		rc = cam_wrapper_regulator_set_load(rgltr, rgltr_op_mode);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "%s set optimum mode failed",
+				rgltr_name);
+			return rc;
+		}
+	}
+
+	rc = cam_wrapper_regulator_enable(rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "%s regulator_enable failed", rgltr_name);
+		return rc;
+	}
+
+	if (rgltr_delay > 20)
+		msleep(rgltr_delay);
+	else if (rgltr_delay)
+		usleep_range(rgltr_delay * 1000,
+			(rgltr_delay * 1000) + 1000);
+
+	return rc;
+}
+
+int cam_soc_util_select_pinctrl_state(struct cam_hw_soc_info *soc_info,
+	int pctrl_idx, bool active)
+{
+	int rc = 0;
+
+	struct cam_soc_pinctrl_info *pctrl_info = &soc_info->pinctrl_info;
+
+	if (pctrl_idx >= CAM_SOC_MAX_PINCTRL_MAP) {
+		CAM_ERR(CAM_UTIL, "Invalid Map idx: %d max supported: %d",
+			pctrl_idx, CAM_SOC_MAX_PINCTRL_MAP);
+		return -EINVAL;
+	}
+
+	if (pctrl_info->pctrl_state[pctrl_idx].gpio_state_active &&
+		active &&
+		!pctrl_info->pctrl_state[pctrl_idx].is_active) {
+		rc = pinctrl_select_state(pctrl_info->pinctrl,
+			pctrl_info->pctrl_state[pctrl_idx].gpio_state_active);
+		if (rc)
+			CAM_ERR(CAM_UTIL,
+				"Pinctrl active state transition failed: rc: %d",
+				rc);
+		else {
+			pctrl_info->pctrl_state[pctrl_idx].is_active = true;
+			CAM_DBG(CAM_UTIL, "Pctrl_idx: %d is in active state",
+				pctrl_idx);
+		}
+	}
+
+	if (pctrl_info->pctrl_state[pctrl_idx].gpio_state_suspend &&
+		!active &&
+		pctrl_info->pctrl_state[pctrl_idx].is_active) {
+		rc = pinctrl_select_state(pctrl_info->pinctrl,
+			pctrl_info->pctrl_state[pctrl_idx].gpio_state_suspend);
+		if (rc)
+			CAM_ERR(CAM_UTIL,
+				"Pinctrl suspend state transition failed: rc: %d",
+				rc);
+		else {
+			pctrl_info->pctrl_state[pctrl_idx].is_active = false;
+			CAM_DBG(CAM_UTIL, "Pctrl_idx: %d is in suspend state",
+				pctrl_idx);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_soc_util_request_pinctrl(
+	struct cam_hw_soc_info *soc_info)
+{
+	struct cam_soc_pinctrl_info *device_pctrl = &soc_info->pinctrl_info;
+	struct device *dev = soc_info->dev;
+	struct device_node *of_node = dev->of_node;
+	uint32_t i = 0;
+	int rc = 0;
+	const char *name;
+	uint32_t idx;
+	char pctrl_active[50];
+	char pctrl_suspend[50];
+	int32_t num_of_map_idx = 0;
+	int32_t num_of_string = 0;
+
+	device_pctrl->pinctrl = devm_pinctrl_get(dev);
+	if (IS_ERR_OR_NULL(device_pctrl->pinctrl)) {
+		CAM_DBG(CAM_UTIL, "Pinctrl not available");
+		device_pctrl->pinctrl = NULL;
+		return 0;
+	}
+
+	num_of_map_idx = of_property_count_u32_elems(
+		of_node, "pctrl-idx-mapping");
+	if (num_of_map_idx <= 0) {
+		CAM_ERR(CAM_UTIL,
+			"Reading pctrl-idx-mapping failed");
+		return -EINVAL;
+	}
+
+	num_of_string = of_property_count_strings(
+		of_node, "pctrl-map-names");
+	if (num_of_string <= 0) {
+		CAM_ERR(CAM_UTIL, "no pinctrl-mapping found for: %s",
+			soc_info->dev_name);
+		device_pctrl->pinctrl = NULL;
+		return -EINVAL;
+	}
+
+	if (num_of_map_idx != num_of_string) {
+		CAM_ERR(CAM_UTIL,
+			"Incorrect inputs mapping-idx count: %d mapping-names: %d",
+			num_of_map_idx, num_of_string);
+		device_pctrl->pinctrl = NULL;
+		return -EINVAL;
+	}
+
+	if (num_of_map_idx > CAM_SOC_MAX_PINCTRL_MAP) {
+		CAM_ERR(CAM_UTIL, "Invalid mapping %u max supported: %d",
+			num_of_map_idx, CAM_SOC_MAX_PINCTRL_MAP);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_of_map_idx; i++) {
+		of_property_read_u32_index(of_node,
+			"pctrl-idx-mapping", i, &idx);
+
+		if (idx >= CAM_SOC_MAX_PINCTRL_MAP) {
+			CAM_ERR(CAM_UTIL, "Invalid Index: %d max supported: %d",
+				idx, CAM_SOC_MAX_PINCTRL_MAP);
+			return -EINVAL;
+		}
+
+		rc = of_property_read_string_index(
+			of_node, "pctrl-map-names", i, &name);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"failed to read pinctrl-mapping at %d", i);
+			return rc;
+		}
+
+		snprintf(pctrl_active, sizeof(pctrl_active),
+			"%s%s",	name, "_active");
+		CAM_DBG(CAM_UTIL, "pctrl_active at index: %d name: %s",
+			i, pctrl_active);
+		snprintf(pctrl_suspend, sizeof(pctrl_suspend),
+			"%s%s", name, "_suspend");
+		CAM_DBG(CAM_UTIL, "pctrl_suspend at index: %d name: %s",
+			i, pctrl_suspend);
+
+		device_pctrl->pctrl_state[idx].gpio_state_active =
+			pinctrl_lookup_state(device_pctrl->pinctrl,
+			pctrl_active);
+		if (IS_ERR_OR_NULL(
+			device_pctrl->pctrl_state[idx].gpio_state_active)) {
+			CAM_ERR(CAM_UTIL,
+				"Failed to get the active state pinctrl handle");
+			device_pctrl->pctrl_state[idx].gpio_state_active =
+				NULL;
+			return -EINVAL;
+		}
+		device_pctrl->pctrl_state[idx].gpio_state_suspend =
+			pinctrl_lookup_state(device_pctrl->pinctrl,
+			pctrl_suspend);
+		if (IS_ERR_OR_NULL(
+			device_pctrl->pctrl_state[idx].gpio_state_suspend)) {
+			CAM_ERR(CAM_UTIL,
+				"Failed to get the active state pinctrl handle");
+			device_pctrl->pctrl_state[idx].gpio_state_suspend = NULL;
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static void cam_soc_util_release_pinctrl(struct cam_hw_soc_info *soc_info)
+{
+	if (soc_info->pinctrl_info.pinctrl)
+		devm_pinctrl_put(soc_info->pinctrl_info.pinctrl);
+}
+
+static void cam_soc_util_regulator_disable_default(
+	struct cam_hw_soc_info *soc_info)
+{
+	int j = 0;
+	uint32_t num_rgltr = soc_info->num_rgltr;
+
+	for (j = num_rgltr-1; j >= 0; j--) {
+		if (soc_info->rgltr_ctrl_support == true) {
+			cam_soc_util_regulator_disable(soc_info->rgltr[j],
+				soc_info->rgltr_name[j],
+				soc_info->rgltr_min_volt[j],
+				soc_info->rgltr_max_volt[j],
+				soc_info->rgltr_op_mode[j],
+				soc_info->rgltr_delay[j]);
+		} else {
+			if (soc_info->rgltr[j])
+				cam_wrapper_regulator_disable(soc_info->rgltr[j]);
+		}
+	}
+}
+
+static int cam_soc_util_regulator_enable_default(
+	struct cam_hw_soc_info *soc_info)
+{
+	int j = 0, rc = 0;
+	uint32_t num_rgltr = soc_info->num_rgltr;
+
+	if (num_rgltr > CAM_SOC_MAX_REGULATOR) {
+		CAM_ERR(CAM_UTIL,
+			"%s has invalid regulator number %d",
+			soc_info->dev_name, num_rgltr);
+		return -EINVAL;
+	}
+
+	for (j = 0; j < num_rgltr; j++) {
+		CAM_DBG(CAM_UTIL, "[%s] : start regulator %s enable, rgltr_ctrl_support %d",
+			soc_info->dev_name, soc_info->rgltr_name[j], soc_info->rgltr_ctrl_support);
+		if (soc_info->rgltr_ctrl_support == true) {
+			rc = cam_soc_util_regulator_enable(soc_info->rgltr[j],
+				soc_info->rgltr_name[j],
+				soc_info->rgltr_min_volt[j],
+				soc_info->rgltr_max_volt[j],
+				soc_info->rgltr_op_mode[j],
+				soc_info->rgltr_delay[j]);
+		} else {
+			if (soc_info->rgltr[j])
+				rc = cam_wrapper_regulator_enable(soc_info->rgltr[j]);
+		}
+
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "%s enable failed",
+				soc_info->rgltr_name[j]);
+			goto disable_rgltr;
+		}
+	}
+
+	return rc;
+disable_rgltr:
+
+	for (j--; j >= 0; j--) {
+		if (soc_info->rgltr_ctrl_support == true) {
+			cam_soc_util_regulator_disable(soc_info->rgltr[j],
+				soc_info->rgltr_name[j],
+				soc_info->rgltr_min_volt[j],
+				soc_info->rgltr_max_volt[j],
+				soc_info->rgltr_op_mode[j],
+				soc_info->rgltr_delay[j]);
+		} else {
+			if (soc_info->rgltr[j])
+				cam_wrapper_regulator_disable(soc_info->rgltr[j]);
+		}
+	}
+
+	return rc;
+}
+
+static bool cam_soc_util_is_presil_address_space(unsigned long mem_block_start)
+{
+	if(mem_block_start >= CAM_SS_START_PRESIL && mem_block_start < CAM_SS_START)
+		return true;
+
+	return false;
+}
+
+#ifndef CONFIG_CAM_PRESIL
+void __iomem * cam_soc_util_get_mem_base(
+	unsigned long mem_block_start,
+	unsigned long mem_block_size,
+	const char *mem_block_name,
+	uint32_t reserve_mem)
+{
+	void __iomem * mem_base;
+
+	if (reserve_mem) {
+		if (!request_mem_region(mem_block_start,
+			mem_block_size,
+			mem_block_name)) {
+			CAM_ERR(CAM_UTIL,
+				"Error Mem region request Failed:%s",
+				mem_block_name);
+			return NULL;
+		}
+	}
+
+	mem_base = ioremap(mem_block_start, mem_block_size);
+
+	if (!mem_base) {
+		CAM_ERR(CAM_UTIL, "get mem base failed");
+	}
+
+	return mem_base;
+}
+
+int cam_soc_util_request_irq(struct device *dev,
+	unsigned int irq_line_start,
+	irq_handler_t handler,
+	unsigned long irqflags,
+	const char *irq_name,
+	void *irq_data,
+	unsigned long mem_block_start)
+{
+	int rc;
+
+	rc = devm_request_irq(dev,
+		irq_line_start,
+		handler,
+		IRQF_TRIGGER_RISING,
+		irq_name,
+		irq_data);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "irq request fail rc %d", rc);
+		return -EBUSY;
+	}
+
+	disable_irq(irq_line_start);
+
+	return rc;
+}
+
+#else
+void __iomem * cam_soc_util_get_mem_base(
+	unsigned long mem_block_start,
+	unsigned long mem_block_size,
+	const char *mem_block_name,
+	uint32_t reserve_mem)
+{
+	void __iomem * mem_base;
+
+	if(cam_soc_util_is_presil_address_space(mem_block_start))
+		mem_base = (void __iomem *)mem_block_start;
+	else {
+		if (reserve_mem) {
+			if (!request_mem_region(mem_block_start,
+				mem_block_size,
+				mem_block_name)) {
+				CAM_ERR(CAM_UTIL,
+					"Error Mem region request Failed:%s",
+					mem_block_name);
+				return NULL;
+			}
+		}
+
+		mem_base = ioremap(mem_block_start, mem_block_size);
+	}
+
+	if (!mem_base) {
+		CAM_ERR(CAM_UTIL, "get mem base failed");
+	}
+
+	return mem_base;
+}
+
+int cam_soc_util_request_irq(struct device *dev,
+	unsigned int irq_line_start,
+	irq_handler_t handler,
+	unsigned long irqflags,
+	const char *irq_name,
+	void *irq_data,
+	unsigned long mem_block_start)
+{
+	int rc;
+
+	if(cam_soc_util_is_presil_address_space(mem_block_start)) {
+		rc = devm_request_irq(dev,
+			irq_line_start,
+			handler,
+			irqflags,
+			irq_name,
+			irq_data);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "presil irq request fail");
+			return -EBUSY;
+		}
+
+		disable_irq(irq_line_start);
+
+		rc = !(cam_presil_subscribe_device_irq(irq_line_start,
+			handler, irq_data, irq_name));
+		CAM_DBG(CAM_PRESIL, "Subscribe presil IRQ: rc=%d NUM=%d Name=%s handler=0x%x",
+			rc, irq_line_start, irq_name, handler);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "presil irq request fail");
+			return -EBUSY;
+		}
+	} else {
+		rc = devm_request_irq(dev,
+			irq_line_start,
+			handler,
+			irqflags,
+			irq_name,
+			irq_data);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "irq request fail");
+			return -EBUSY;
+		}
+		disable_irq(irq_line_start);
+		CAM_INFO(CAM_UTIL, "Subscribe for non-presil IRQ success");
+	}
+
+	CAM_INFO(CAM_UTIL, "returning IRQ for mem_block_start 0x%0x rc %d",
+		mem_block_start, rc);
+
+	return rc;
+}
+#endif
+
+int cam_soc_util_power_domain_enable_default(
+	struct cam_hw_soc_info *soc_info)
+{
+	int i = 0, ret = 0;
+	int32_t num_pds = soc_info->num_genpd;
+
+	if (num_pds < 1) {
+		CAM_DBG(CAM_UTIL,
+			"power-domains not defined for dev %s num_pds = %d",
+			num_pds, soc_info->dev_name);
+		goto end;
+	}
+
+	if (num_pds == 1) {
+		dev_pm_genpd_set_performance_state(soc_info->dev, INT_MAX);
+		ret = pm_runtime_get_sync(soc_info->dev);
+		CAM_DBG(CAM_UTIL,
+			"power-domain enabled for dev %s ret %d",
+			soc_info->dev_name, ret);
+
+		if (ret < 0) {
+			CAM_ERR(CAM_UTIL,
+				"power-domain enable failed for dev %s ret %d",
+				soc_info->dev_name, ret);
+			pm_runtime_put(soc_info->dev);
+			dev_pm_genpd_set_performance_state(soc_info->dev, 0);
+		}
+
+		goto end;
+	}
+
+	for (i = 0; i < num_pds; i++) {
+		if (!soc_info->genpd)
+			continue;
+
+		if (!soc_info->genpd[i])
+			continue;
+
+		dev_pm_genpd_set_performance_state(soc_info->genpd[i], INT_MAX);
+		ret = pm_runtime_get_sync(soc_info->genpd[i]);
+		if (ret < 0) {
+			CAM_ERR(CAM_UTIL,
+				"power-domain enable failed for dev %s ret %d i %d",
+				soc_info->dev_name, ret, i);
+			goto disable_pds;
+		}
+	}
+
+	goto end;
+
+disable_pds:
+	for (i--; i >= 0; i--) {
+		if (!soc_info->genpd[i])
+			continue;
+
+		dev_pm_genpd_set_performance_state(soc_info->genpd[i], 0);
+		pm_runtime_put(soc_info->genpd[i]);
+	}
+end:
+	return ret;
+}
+
+int cam_soc_util_configure_pd(struct cam_hw_soc_info *soc_info)
+{
+	int i, ret = 0;
+
+	soc_info->num_genpd = of_count_phandle_with_args(soc_info->dev->of_node,
+							"power-domains",
+							"#power-domain-cells");
+	if (soc_info->num_genpd < 1) {
+		CAM_WARN(CAM_UTIL,
+			"DBG: power-domains not defined for %s",
+			soc_info->dev_name);
+		soc_info->num_genpd = 0;
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL,
+		"num_genpd defined for dev %s: %d",
+		soc_info->dev_name, soc_info->num_genpd);
+	/*
+	 * With only one power domain defined there is no need to have
+	 * references of genpd devices as the genpd attach will happen
+	 * during probe with dev_pm_domain_attach().
+	 */
+	if (soc_info->num_genpd == 1) {
+		goto end;
+	}
+
+	soc_info->genpd = devm_kmalloc_array(soc_info->dev, soc_info->num_genpd,
+					     sizeof(struct device), GFP_KERNEL);
+	if (!soc_info->genpd) {
+		CAM_ERR(CAM_UTIL,
+			"devm_kmalloc_array failed for dev %s, num_genpd %d",
+			soc_info->dev_name, soc_info->num_genpd);
+		ret = -ENOMEM;
+		goto end;
+	}
+
+	for (i = 0; i < soc_info->num_genpd; i++) {
+		soc_info->genpd[i] = dev_pm_domain_attach_by_id(soc_info->dev, i);
+		if (IS_ERR(soc_info->genpd[i])) {
+			CAM_ERR(CAM_UTIL,
+				"Error in pm_domain_attach");
+			ret = PTR_ERR(soc_info->genpd[i]);
+			goto fail_pm;
+		}
+	}
+
+	goto end;
+
+fail_pm:
+	for (--i ; i >= 0; i--)
+		dev_pm_domain_detach(soc_info->genpd[i], true);
+end:
+	return ret;
+}
+
+int cam_soc_util_configure_opp(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = devm_pm_opp_set_clkname(soc_info->dev, soc_info->clk_name[soc_info->src_clk_idx]);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"OPP set_clkname failed for dev %s clk_name %s rc %d",
+			soc_info->dev_name, soc_info->clk_name[soc_info->src_clk_idx], rc);
+		return rc;
+	}
+
+	rc = devm_pm_opp_of_add_table(soc_info->dev);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"OPP add_table failed for dev %s rc %d",
+			soc_info->dev_name, rc);
+	}
+	return rc;
+}
+
+int cam_soc_util_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t handler, void **irq_data)
+{
+	int i = 0, rc = 0;
+
+	if (!soc_info || !soc_info->dev) {
+		CAM_ERR(CAM_UTIL, "Invalid parameters");
+		return -EINVAL;
+	}
+
+	if (unlikely(soc_info->irq_count > CAM_SOC_MAX_IRQ_LINES_PER_DEV)) {
+		CAM_ERR(CAM_UTIL, "Invalid irq count: %u Max IRQ per device: %d",
+			soc_info->irq_count, CAM_SOC_MAX_IRQ_LINES_PER_DEV);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->num_mem_block; i++) {
+
+		soc_info->reg_map[i].mem_base = cam_soc_util_get_mem_base(
+			soc_info->mem_block[i]->start,
+			resource_size(soc_info->mem_block[i]),
+			soc_info->mem_block_name[i],
+			soc_info->reserve_mem);
+
+		if (!soc_info->reg_map[i].mem_base) {
+			CAM_ERR(CAM_UTIL, "i= %d base NULL", i);
+			rc = -ENOMEM;
+			goto unmap_base;
+		}
+
+		soc_info->reg_map[i].mem_cam_base =
+			soc_info->mem_block_cam_base[i];
+		soc_info->reg_map[i].size =
+			resource_size(soc_info->mem_block[i]);
+
+		soc_info->num_reg_map++;
+	}
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		if (soc_info->rgltr_name[i] == NULL) {
+			CAM_ERR(CAM_UTIL, "can't find regulator name");
+			goto put_regulator;
+		}
+
+		rc = cam_soc_util_get_regulator(soc_info->dev,
+			&soc_info->rgltr[i],
+			soc_info->rgltr_name[i]);
+		if (rc)
+			goto put_regulator;
+	}
+
+	rc = cam_soc_util_configure_pd(soc_info);
+	if (rc)
+		goto put_regulator;
+
+	pm_runtime_enable(soc_info->dev);
+
+	/*
+	 * Doing a pm_runtime_get_sync() and pm_runtime_put_sync() after pm_runtime_enable
+	 * makes sure that the GDSC is off and only enabled later by the usecase when there
+	 * is such a requirement.
+	 */
+	cam_soc_util_power_domain_enable_default(soc_info);
+	cam_soc_util_power_domain_disable_default(soc_info);
+
+
+	for (i = 0; i < soc_info->irq_count; i++) {
+		rc = cam_soc_util_request_irq(soc_info->dev, soc_info->irq_num[i],
+			handler, IRQF_TRIGGER_RISING, soc_info->irq_name[i],
+				irq_data[i], soc_info->mem_block[0]->start);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "irq request fail for irq name: %s dev: %s",
+				soc_info->irq_name[i], soc_info->dev_name);
+			rc = -EBUSY;
+			goto put_irq;
+		}
+
+		soc_info->irq_data[i] = irq_data[i];
+	}
+
+	/* Get Clock */
+	for (i = 0; i < soc_info->num_clk; i++) {
+		soc_info->clk[i] = cam_wrapper_clk_get(soc_info->dev,
+			soc_info->clk_name[i]);
+		if (IS_ERR(soc_info->clk[i])) {
+			CAM_ERR(CAM_UTIL, "get failed for %s",
+				soc_info->clk_name[i]);
+			rc = -ENOENT;
+			goto put_clk;
+		} else if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_UTIL, "%s handle is NULL skip get",
+				soc_info->clk_name[i]);
+			continue;
+		}
+
+		/* Create a wrapper entry if this is a shared clock */
+		if (CAM_IS_BIT_SET(soc_info->shared_clk_mask, i)) {
+			uint32_t min_level = soc_info->lowest_clk_level;
+
+			CAM_DBG(CAM_UTIL,
+				"Dev %s, clk %s, id %d register wrapper entry for shared clk",
+				soc_info->dev_name, soc_info->clk_name[i],
+				soc_info->clk_id[i]);
+
+			rc = cam_soc_util_clk_wrapper_register_entry(
+				soc_info->clk_id[i], soc_info->clk[i],
+				(i == soc_info->src_clk_idx) ? true : false,
+				soc_info, soc_info->clk_rate[min_level][i],
+				soc_info->clk_name[i]);
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Failed in registering shared clk Dev %s id %d",
+					soc_info->dev_name,
+					soc_info->clk_id[i]);
+				cam_wrapper_clk_put(soc_info->clk[i]);
+				soc_info->clk[i] = NULL;
+				goto put_clk;
+			}
+		} else if (i == soc_info->src_clk_idx) {
+			rc = cam_soc_util_register_mmrm_client(
+				soc_info->clk_id[i], soc_info->clk[i],
+				soc_info->is_nrt_dev,
+				soc_info, soc_info->clk_name[i],
+				&soc_info->mmrm_handle);
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Failed in register mmrm client Dev %s clk id %d",
+					soc_info->dev_name,
+					soc_info->clk_id[i]);
+				cam_wrapper_clk_put(soc_info->clk[i]);
+				soc_info->clk[i] = NULL;
+				goto put_clk;
+			}
+		}
+	}
+
+	rc = cam_soc_util_configure_opp(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Failed to configure OPP");
+		goto put_clk;
+	}
+
+	rc = cam_soc_util_request_pinctrl(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Failed in requesting Pinctrl, rc: %d", rc);
+		goto put_clk;
+	}
+
+	rc = cam_soc_util_request_gpio_table(soc_info, true);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Failed in request gpio table, rc=%d", rc);
+		goto put_clk;
+	}
+
+	if (soc_info->clk_control_enable)
+		cam_soc_util_create_clk_lvl_debugfs(soc_info);
+
+	return rc;
+
+put_clk:
+
+	if (soc_info->mmrm_handle) {
+		cam_soc_util_unregister_mmrm_client(soc_info->mmrm_handle);
+		soc_info->mmrm_handle = NULL;
+	}
+
+	for (i = i - 1; i >= 0; i--) {
+		if (soc_info->clk[i]) {
+			if (CAM_IS_BIT_SET(soc_info->shared_clk_mask, i))
+				cam_soc_util_clk_wrapper_unregister_entry(
+					soc_info->clk_id[i], soc_info);
+
+			cam_wrapper_clk_put(soc_info->clk[i]);
+			soc_info->clk[i] = NULL;
+		}
+	}
+
+put_irq:
+	if (i == -1)
+		i = soc_info->irq_count;
+	for (i = i - 1; i >= 0; i--) {
+		if (soc_info->irq_num[i] > 0)
+			disable_irq(soc_info->irq_num[i]);
+	}
+
+put_regulator:
+	if (i == -1)
+		i = soc_info->num_rgltr;
+	for (i = i - 1; i >= 0; i--) {
+		if (soc_info->rgltr[i]) {
+			cam_wrapper_regulator_disable(soc_info->rgltr[i]);
+			cam_wrapper_regulator_put(soc_info->rgltr[i]);
+			soc_info->rgltr[i] = NULL;
+		}
+	}
+
+unmap_base:
+	if (i == -1)
+		i = soc_info->num_reg_map;
+	for (i = i - 1; i >= 0; i--) {
+		if (soc_info->reserve_mem)
+			release_mem_region(soc_info->mem_block[i]->start,
+				resource_size(soc_info->mem_block[i]));
+		iounmap(soc_info->reg_map[i].mem_base);
+		soc_info->reg_map[i].mem_base = NULL;
+		soc_info->reg_map[i].size = 0;
+	}
+
+	return rc;
+}
+
+int cam_soc_util_release_platform_resource(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	bool b_ret = false;
+
+	if (!soc_info || !soc_info->dev) {
+		CAM_ERR(CAM_UTIL, "Invalid parameter");
+		return -EINVAL;
+	}
+
+	if (soc_info->mmrm_handle) {
+		cam_soc_util_unregister_mmrm_client(soc_info->mmrm_handle);
+		soc_info->mmrm_handle = NULL;
+	}
+
+	for (i = soc_info->num_clk - 1; i >= 0; i--) {
+		if (CAM_IS_BIT_SET(soc_info->shared_clk_mask, i))
+			cam_soc_util_clk_wrapper_unregister_entry(
+				soc_info->clk_id[i], soc_info);
+		if (!soc_info->clk[i]) {
+			CAM_DBG(CAM_UTIL, "%s handle is NULL skip put",
+				soc_info->clk_name[i]);
+			continue;
+		}
+		cam_wrapper_clk_put(soc_info->clk[i]);
+		soc_info->clk[i] = NULL;
+	}
+
+	for (i = soc_info->num_rgltr - 1; i >= 0; i--) {
+		if (soc_info->rgltr[i]) {
+			cam_wrapper_regulator_put(soc_info->rgltr[i]);
+			soc_info->rgltr[i] = NULL;
+		}
+	}
+
+	pm_runtime_disable(soc_info->dev);
+	for (i = 0; i < soc_info->num_genpd; i++) {
+		if (!soc_info->genpd)
+			continue;
+		if (!soc_info->genpd[i])
+			continue;
+		dev_pm_domain_detach(soc_info->genpd[i], true);
+	}
+
+	for (i = soc_info->num_reg_map - 1; i >= 0; i--) {
+		iounmap(soc_info->reg_map[i].mem_base);
+		soc_info->reg_map[i].mem_base = NULL;
+		soc_info->reg_map[i].size = 0;
+	}
+
+	for (i = soc_info->irq_count; i >= 0; i--) {
+		if (soc_info->irq_num[i] > 0) {
+			if (cam_presil_mode_enabled()) {
+				if (cam_soc_util_is_presil_address_space(
+					soc_info->mem_block[0]->start)) {
+					b_ret = cam_presil_unsubscribe_device_irq(
+						soc_info->irq_line[i]->start);
+					CAM_DBG(CAM_PRESIL,
+						"UnSubscribe IRQ: Ret=%d NUM=%d Name=%s",
+						b_ret, soc_info->irq_line[i]->start,
+						soc_info->irq_name[i]);
+				}
+			}
+
+			disable_irq(soc_info->irq_num[i]);
+		}
+	}
+
+	cam_soc_util_release_pinctrl(soc_info);
+
+	/* release for gpio */
+	cam_soc_util_request_gpio_table(soc_info, false);
+
+	soc_info->dentry = NULL;
+
+	return 0;
+}
+
+int cam_soc_util_enable_platform_resource(struct cam_hw_soc_info *soc_info,
+	int cesta_client_idx, bool enable_clocks, enum cam_vote_level clk_level,
+	bool irq_enable)
+{
+	int rc = 0, i;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	rc = cam_soc_util_regulator_enable_default(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Regulators enable failed");
+		return rc;
+	}
+
+	rc = cam_soc_util_power_domain_enable_default(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_UTIL, "Power domains enable failed");
+		goto disable_regulator;
+	}
+
+	if (enable_clocks) {
+		rc = cam_soc_util_clk_enable_default(soc_info, cesta_client_idx, clk_level);
+		if (rc)
+			goto disable_power_domain;
+	}
+
+	if (irq_enable) {
+		for (i = 0; i < soc_info->irq_count; i++) {
+			if (soc_info->irq_num[i] < 0) {
+				CAM_ERR(CAM_UTIL, "No IRQ line available for irq: %s dev: %s",
+					soc_info->irq_name[i], soc_info->dev_name);
+				rc = -ENODEV;
+				goto disable_irq;
+			}
+
+			enable_irq(soc_info->irq_num[i]);
+		}
+	}
+
+	return rc;
+
+disable_irq:
+	if (irq_enable) {
+		for (i = i - 1; i >= 0; i--)
+			disable_irq(soc_info->irq_num[i]);
+	}
+
+	if (enable_clocks)
+		cam_soc_util_clk_disable_default(soc_info, cesta_client_idx);
+
+disable_power_domain:
+	cam_soc_util_power_domain_disable_default(soc_info);
+
+disable_regulator:
+	cam_soc_util_regulator_disable_default(soc_info);
+
+	return rc;
+}
+
+int cam_soc_util_disable_platform_resource(struct cam_hw_soc_info *soc_info,
+	int cesta_client_idx, bool disable_clocks, bool disable_irq)
+{
+	int rc = 0;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	if (disable_irq)
+		rc |= cam_soc_util_irq_disable(soc_info);
+
+	if (disable_clocks)
+		cam_soc_util_clk_disable_default(soc_info, cesta_client_idx);
+
+	cam_soc_util_power_domain_disable_default(soc_info);
+
+	cam_soc_util_regulator_disable_default(soc_info);
+
+	return rc;
+}
+
+int cam_soc_util_reg_dump(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset, int size)
+{
+	void __iomem     *base_addr = NULL;
+
+	CAM_DBG(CAM_UTIL, "base_idx %u size=%d", base_index, size);
+
+	if (!soc_info || base_index >= soc_info->num_reg_map ||
+		size <= 0 || (offset + size) >=
+		CAM_SOC_GET_REG_MAP_SIZE(soc_info, base_index))
+		return -EINVAL;
+
+	base_addr = CAM_SOC_GET_REG_MAP_START(soc_info, base_index);
+
+	/*
+	 * All error checking already done above,
+	 * hence ignoring the return value below.
+	 */
+	cam_io_dump(base_addr, offset, size);
+
+	return 0;
+}
+
+static inline int cam_soc_util_reg_addr_validation(
+	uint32_t reg_map_size, uint32_t offset, char *reg_unit)
+{
+	if (!IS_ALIGNED(offset, 4)) {
+		CAM_ERR(CAM_UTIL, "Offset: 0x%X of %s is not memory aligned",
+			offset, reg_unit);
+		return -EINVAL;
+	} else if (offset > reg_map_size) {
+		CAM_ERR(CAM_UTIL,
+			"Reg offset: 0x%X of %s out of range, reg_map size: 0x%X",
+			offset, reg_unit, reg_map_size);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_soc_util_dump_cont_reg_range(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_reg_range_read_desc *reg_read, uint32_t base_idx,
+	struct cam_reg_dump_out_buffer *dump_out_buf, uintptr_t cmd_buf_end)
+{
+	int         i = 0, rc = 0;
+	uint32_t    write_idx = 0, reg_map_size;
+
+	if (!soc_info || !dump_out_buf || !reg_read || !cmd_buf_end) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input args soc_info: %pK, dump_out_buffer: %pK reg_read: %pK cmd_buf_end: %pK",
+			soc_info, dump_out_buf, reg_read, cmd_buf_end);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((reg_read->num_values) && ((reg_read->num_values > U32_MAX / 2) ||
+		(sizeof(uint32_t) > ((U32_MAX -
+		sizeof(struct cam_reg_dump_out_buffer) -
+		dump_out_buf->bytes_written) /
+		(reg_read->num_values * 2))))) {
+		CAM_ERR(CAM_UTIL,
+			"Integer Overflow bytes_written: [%u] num_values: [%u]",
+			dump_out_buf->bytes_written, reg_read->num_values);
+		rc = -EOVERFLOW;
+		goto end;
+	}
+
+	if ((cmd_buf_end - (uintptr_t)dump_out_buf) <=
+		(uintptr_t)(sizeof(struct cam_reg_dump_out_buffer)
+		- sizeof(uint32_t) + dump_out_buf->bytes_written +
+		(reg_read->num_values * 2 * sizeof(uint32_t)))) {
+		CAM_ERR(CAM_UTIL,
+			"Insufficient space in out buffer num_values: [%d] cmd_buf_end: %pK dump_out_buf: %pK",
+			reg_read->num_values, cmd_buf_end,
+			(uintptr_t)dump_out_buf);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	write_idx = dump_out_buf->bytes_written / sizeof(uint32_t);
+	reg_map_size = (uint32_t)soc_info->reg_map[base_idx].size;
+	for (i = 0; i < reg_read->num_values; i++) {
+		rc = cam_soc_util_reg_addr_validation(reg_map_size,
+			reg_read->offset + (i * sizeof(uint32_t)),
+			"cont_reg_range");
+		if (rc)
+			continue;
+
+		dump_out_buf->dump_data_flex[write_idx++] = reg_read->offset +
+			(i * sizeof(uint32_t));
+		dump_out_buf->dump_data_flex[write_idx++] =
+			cam_soc_util_r(soc_info, base_idx,
+			(reg_read->offset + (i * sizeof(uint32_t))));
+		dump_out_buf->bytes_written += (2 * sizeof(uint32_t));
+	}
+
+end:
+	return rc;
+}
+
+static int cam_soc_util_dump_dmi_reg_range(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_dmi_read_desc *dmi_read, uint32_t base_idx,
+	struct cam_reg_dump_out_buffer *dump_out_buf, uintptr_t cmd_buf_end)
+{
+	int        i = 0, rc = 0;
+	uint32_t   write_idx = 0, reg_map_size;
+
+	if (!soc_info || !dump_out_buf || !dmi_read || !cmd_buf_end) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input args soc_info: %pK, dump_out_buffer: %pK",
+			soc_info, dump_out_buf);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (dmi_read->num_pre_writes > CAM_REG_DUMP_DMI_CONFIG_MAX ||
+		dmi_read->num_post_writes > CAM_REG_DUMP_DMI_CONFIG_MAX) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid number of requested writes, pre: %d post: %d",
+			dmi_read->num_pre_writes, dmi_read->num_post_writes);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((dmi_read->num_pre_writes + dmi_read->dmi_data_read.num_values)
+		&& ((dmi_read->num_pre_writes > U32_MAX / 2) ||
+		(dmi_read->dmi_data_read.num_values > U32_MAX / 2) ||
+		((dmi_read->num_pre_writes * 2) > U32_MAX -
+		(dmi_read->dmi_data_read.num_values * 2)) ||
+		(sizeof(uint32_t) > ((U32_MAX -
+		sizeof(struct cam_reg_dump_out_buffer) -
+		dump_out_buf->bytes_written) / ((dmi_read->num_pre_writes +
+		dmi_read->dmi_data_read.num_values) * 2))))) {
+		CAM_ERR(CAM_UTIL,
+			"Integer Overflow bytes_written: [%u] num_pre_writes: [%u] num_values: [%u]",
+			dump_out_buf->bytes_written, dmi_read->num_pre_writes,
+			dmi_read->dmi_data_read.num_values);
+		rc = -EOVERFLOW;
+		goto end;
+	}
+
+	if ((cmd_buf_end - (uintptr_t)dump_out_buf) <=
+		(uintptr_t)(
+		sizeof(struct cam_reg_dump_out_buffer) - sizeof(uint32_t) +
+		(dump_out_buf->bytes_written +
+		(dmi_read->num_pre_writes * 2 * sizeof(uint32_t)) +
+		(dmi_read->dmi_data_read.num_values * 2 *
+		sizeof(uint32_t))))) {
+		CAM_ERR(CAM_UTIL,
+			"Insufficient space in out buffer num_read_val: [%d] num_write_val: [%d] cmd_buf_end: %pK dump_out_buf: %pK",
+			dmi_read->dmi_data_read.num_values,
+			dmi_read->num_pre_writes, cmd_buf_end,
+			(uintptr_t)dump_out_buf);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	write_idx = dump_out_buf->bytes_written / sizeof(uint32_t);
+	reg_map_size = (uint32_t)soc_info->reg_map[base_idx].size;
+	for (i = 0; i < dmi_read->num_pre_writes; i++) {
+		rc = cam_soc_util_reg_addr_validation(reg_map_size,
+			dmi_read->pre_read_config[i].offset,
+			"pre_read_config");
+		if (rc)
+			continue;
+
+		cam_soc_util_w_mb(soc_info, base_idx,
+			dmi_read->pre_read_config[i].offset,
+			dmi_read->pre_read_config[i].value);
+		dump_out_buf->dump_data_flex[write_idx++] =
+			dmi_read->pre_read_config[i].offset;
+		dump_out_buf->dump_data_flex[write_idx++] =
+			dmi_read->pre_read_config[i].value;
+		dump_out_buf->bytes_written += (2 * sizeof(uint32_t));
+	}
+
+	rc = cam_soc_util_reg_addr_validation(reg_map_size,
+		dmi_read->dmi_data_read.offset,
+		"dmi_data_read");
+	if (!rc) {
+		for (i = 0; i < dmi_read->dmi_data_read.num_values; i++) {
+			dump_out_buf->dump_data_flex[write_idx++] =
+				dmi_read->dmi_data_read.offset;
+			dump_out_buf->dump_data_flex[write_idx++] =
+				cam_soc_util_r_mb(soc_info, base_idx,
+				dmi_read->dmi_data_read.offset);
+			dump_out_buf->bytes_written += (2 * sizeof(uint32_t));
+		}
+	}
+
+	for (i = 0; i < dmi_read->num_post_writes; i++) {
+		rc = cam_soc_util_reg_addr_validation(reg_map_size,
+			dmi_read->post_read_config[i].offset,
+			"post_read_config");
+		if (rc)
+			continue;
+
+		cam_soc_util_w_mb(soc_info, base_idx,
+			dmi_read->post_read_config[i].offset,
+			dmi_read->post_read_config[i].value);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_soc_util_dump_dmi_reg_range_user_buf(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_dmi_read_desc *dmi_read, uint32_t base_idx,
+	struct cam_hw_soc_dump_args *dump_args)
+{
+	int                            i;
+	int                            rc;
+	size_t                         buf_len = 0;
+	uint8_t                       *dst;
+	size_t                         remain_len;
+	uint32_t                       min_len, reg_map_size;
+	uint32_t                      *waddr, *start;
+	uintptr_t                      cpu_addr;
+	struct cam_hw_soc_dump_header *hdr;
+
+	if (!soc_info || !dump_args || !dmi_read) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input args soc_info: %pK, dump_args: %pK",
+			soc_info, dump_args);
+		return -EINVAL;
+	}
+
+	if (dmi_read->num_pre_writes > CAM_REG_DUMP_DMI_CONFIG_MAX ||
+		dmi_read->num_post_writes > CAM_REG_DUMP_DMI_CONFIG_MAX) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid number of requested writes, pre: %d post: %d",
+			dmi_read->num_pre_writes, dmi_read->num_post_writes);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(dump_args->buf_handle, &cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+
+	if (buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_UTIL, "Dump offset overshoot offset %zu len %zu",
+			dump_args->offset, buf_len);
+		rc = -ENOSPC;
+		goto end;
+	}
+	remain_len = buf_len - dump_args->offset;
+	min_len = (dmi_read->num_pre_writes * 2 * sizeof(uint32_t)) +
+		(dmi_read->dmi_data_read.num_values * 2 * sizeof(uint32_t)) +
+		sizeof(uint32_t);
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_UTIL,
+			"Dump Buffer exhaust read %d write %d remain %zu min %u",
+			dmi_read->dmi_data_read.num_values,
+			dmi_read->num_pre_writes, remain_len,
+			min_len);
+		rc = -ENOSPC;
+		goto end;
+	}
+
+	dst = (uint8_t *)cpu_addr + dump_args->offset;
+	hdr = (struct cam_hw_soc_dump_header *)dst;
+	memset(hdr, 0, sizeof(struct cam_hw_soc_dump_header));
+	scnprintf(hdr->tag, CAM_SOC_HW_DUMP_TAG_MAX_LEN,
+		"DMI_DUMP:");
+	waddr = (uint32_t *)(dst + sizeof(struct cam_hw_soc_dump_header));
+	start = waddr;
+	hdr->word_size = sizeof(uint32_t);
+	*waddr = soc_info->index;
+	waddr++;
+
+	reg_map_size = (uint32_t)soc_info->reg_map[base_idx].size;
+	for (i = 0; i < dmi_read->num_pre_writes; i++) {
+		rc = cam_soc_util_reg_addr_validation(reg_map_size,
+			dmi_read->pre_read_config[i].offset,
+			"pre_read_config");
+		if (rc)
+			continue;
+
+		cam_soc_util_w_mb(soc_info, base_idx,
+			dmi_read->pre_read_config[i].offset,
+			dmi_read->pre_read_config[i].value);
+		*waddr++ = dmi_read->pre_read_config[i].offset;
+		*waddr++ = dmi_read->pre_read_config[i].value;
+	}
+
+	rc = cam_soc_util_reg_addr_validation(reg_map_size,
+		dmi_read->dmi_data_read.offset,
+		"dmi_data_read");
+	if (!rc) {
+		for (i = 0; i < dmi_read->dmi_data_read.num_values; i++) {
+			*waddr++ = dmi_read->dmi_data_read.offset;
+			*waddr++ = cam_soc_util_r_mb(soc_info, base_idx,
+				dmi_read->dmi_data_read.offset);
+		}
+	}
+
+	for (i = 0; i < dmi_read->num_post_writes; i++) {
+		rc = cam_soc_util_reg_addr_validation(reg_map_size,
+			dmi_read->post_read_config[i].offset,
+			"post_read_config");
+		if (rc)
+			continue;
+
+		cam_soc_util_w_mb(soc_info, base_idx,
+			dmi_read->post_read_config[i].offset,
+			dmi_read->post_read_config[i].value);
+	}
+	hdr->size = (waddr - start) * hdr->word_size;
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_hw_soc_dump_header);
+
+end:
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_soc_util_dump_cont_reg_range_user_buf(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_reg_range_read_desc *reg_read,
+	uint32_t base_idx,
+	struct cam_hw_soc_dump_args *dump_args)
+{
+	int                            i;
+	int                            rc = 0;
+	size_t                         buf_len;
+	uint8_t                       *dst;
+	size_t                         remain_len;
+	uint32_t                       min_len, reg_map_size;
+	uint32_t                      *waddr, *start;
+	uintptr_t                      cpu_addr;
+	struct cam_hw_soc_dump_header  *hdr;
+
+	if (!soc_info || !dump_args || !reg_read) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input args soc_info: %pK, dump_out_buffer: %pK reg_read: %pK",
+			soc_info, dump_args, reg_read);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(dump_args->buf_handle, &cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+	if (buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_UTIL, "Dump offset overshoot %zu %zu",
+			dump_args->offset, buf_len);
+		rc = -ENOSPC;
+		goto end;
+	}
+	remain_len = buf_len - dump_args->offset;
+	min_len = (reg_read->num_values * 2 * sizeof(uint32_t)) +
+		sizeof(struct cam_hw_soc_dump_header) + sizeof(uint32_t);
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_UTIL,
+			"Dump Buffer exhaust read_values %d remain %zu min %u",
+			reg_read->num_values,
+			remain_len,
+			min_len);
+		rc = -ENOSPC;
+		goto end;
+	}
+	dst = (uint8_t *)cpu_addr + dump_args->offset;
+	hdr = (struct cam_hw_soc_dump_header *)dst;
+	memset(hdr, 0, sizeof(struct cam_hw_soc_dump_header));
+	scnprintf(hdr->tag, CAM_SOC_HW_DUMP_TAG_MAX_LEN, "%s_REG:",
+		soc_info->dev_name);
+	waddr = (uint32_t *)(dst + sizeof(struct cam_hw_soc_dump_header));
+	start = waddr;
+	hdr->word_size = sizeof(uint32_t);
+	*waddr = soc_info->index;
+	waddr++;
+
+	reg_map_size = (uint32_t)soc_info->reg_map[base_idx].size;
+	for (i = 0; i < reg_read->num_values; i++) {
+		rc = cam_soc_util_reg_addr_validation(reg_map_size,
+			reg_read->offset + (i * sizeof(uint32_t)),
+			"cont_reg_range_user_buf");
+		if (rc)
+			continue;
+
+		waddr[0] = reg_read->offset + (i * sizeof(uint32_t));
+		waddr[1] = cam_soc_util_r(soc_info, base_idx,
+			(reg_read->offset + (i * sizeof(uint32_t))));
+		waddr += 2;
+	}
+	hdr->size = (waddr - start) * hdr->word_size;
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_hw_soc_dump_header);
+end:
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_soc_util_user_reg_dump(
+	struct cam_reg_dump_desc *reg_dump_desc,
+	struct cam_hw_soc_dump_args *dump_args,
+	struct cam_hw_soc_info *soc_info,
+	uint32_t reg_base_idx)
+{
+	int rc = 0;
+	int i;
+	struct cam_reg_read_info  *reg_read_info = NULL;
+
+	if (!dump_args || !reg_dump_desc || !soc_info) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input parameters %pK %pK %pK",
+			dump_args, reg_dump_desc, soc_info);
+		return -EINVAL;
+	}
+	for (i = 0; i < reg_dump_desc->num_read_range; i++) {
+
+		reg_read_info = &reg_dump_desc->read_range_flex[i];
+		if (reg_read_info->type ==
+				CAM_REG_DUMP_READ_TYPE_CONT_RANGE) {
+			rc = cam_soc_util_dump_cont_reg_range_user_buf(
+				soc_info,
+				&reg_read_info->reg_read,
+				reg_base_idx,
+				dump_args);
+		} else if (reg_read_info->type ==
+				CAM_REG_DUMP_READ_TYPE_DMI) {
+			rc = cam_soc_util_dump_dmi_reg_range_user_buf(
+				soc_info,
+				&reg_read_info->dmi_read,
+				reg_base_idx,
+				dump_args);
+		} else {
+			CAM_ERR(CAM_UTIL,
+					"Invalid Reg dump read type: %d",
+					reg_read_info->type);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"Reg range read failed rc: %d reg_base_idx: %d",
+				rc, reg_base_idx);
+			goto end;
+		}
+	}
+end:
+	return rc;
+}
+
+int cam_soc_util_reg_dump_to_cmd_buf(void *ctx,
+	struct cam_cmd_buf_desc *cmd_desc, uint64_t req_id,
+	cam_soc_util_regspace_data_cb reg_data_cb,
+	struct cam_hw_soc_dump_args *soc_dump_args,
+	bool user_triggered_dump)
+{
+	int                               rc = 0, i, j;
+	uintptr_t                         cpu_addr = 0;
+	uintptr_t                         cmd_buf_start = 0;
+	uintptr_t                         cmd_in_data_end = 0;
+	uintptr_t                         cmd_buf_end = 0;
+	uint32_t                          reg_base_type = 0;
+	size_t                            buf_size = 0, remain_len = 0;
+	struct cam_reg_dump_input_info   *reg_input_info = NULL;
+	struct cam_reg_dump_desc         *reg_dump_desc = NULL;
+	struct cam_reg_dump_out_buffer   *dump_out_buf = NULL;
+	struct cam_reg_read_info         *reg_read_info = NULL;
+	struct cam_hw_soc_info           *soc_info;
+	uint32_t                          reg_base_idx = 0;
+
+	if (!ctx || !cmd_desc || !reg_data_cb) {
+		CAM_ERR(CAM_UTIL, "Invalid args to reg dump [%pK] [%pK]",
+			cmd_desc, reg_data_cb);
+		return -EINVAL;
+	}
+
+	if (!cmd_desc->length || !cmd_desc->size) {
+		CAM_ERR(CAM_UTIL, "Invalid cmd buf size %d %d",
+			cmd_desc->length, cmd_desc->size);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle, &cpu_addr, &buf_size);
+	if (rc || !cpu_addr || (buf_size == 0)) {
+		CAM_ERR(CAM_UTIL, "Failed in Get cpu addr, rc=%d, cpu_addr=%pK",
+			rc, (void *)cpu_addr);
+		if (rc)
+			return rc;
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL, "Get cpu buf success req_id: %llu buf_size: %zu",
+		req_id, buf_size);
+	if ((buf_size < sizeof(uint32_t)) ||
+		((size_t)cmd_desc->offset > (buf_size - sizeof(uint32_t)))) {
+		CAM_ERR(CAM_UTIL, "Invalid offset for cmd buf: %zu",
+			(size_t)cmd_desc->offset);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	remain_len = buf_size - (size_t)cmd_desc->offset;
+	if ((remain_len < (size_t)cmd_desc->size) || (cmd_desc->size <
+		cmd_desc->length)) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid params for cmd buf len: %zu size: %zu remain_len: %zu",
+			(size_t)cmd_desc->length, (size_t)cmd_desc->length,
+			remain_len);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cmd_buf_start = cpu_addr + (uintptr_t)cmd_desc->offset;
+	cmd_in_data_end = cmd_buf_start + (uintptr_t)cmd_desc->length;
+	cmd_buf_end = cmd_buf_start + (uintptr_t)cmd_desc->size;
+	if ((cmd_buf_end <= cmd_buf_start) ||
+		(cmd_in_data_end <= cmd_buf_start)) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid length or size for cmd buf: [%zu] [%zu]",
+			(size_t)cmd_desc->length, (size_t)cmd_desc->size);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL,
+		"Buffer params start [%pK] input_end [%pK] buf_end [%pK]",
+		cmd_buf_start, cmd_in_data_end, cmd_buf_end);
+	reg_input_info = (struct cam_reg_dump_input_info *) cmd_buf_start;
+	if ((reg_input_info->num_dump_sets > 1) && (sizeof(uint32_t) >
+		((U32_MAX - sizeof(struct cam_reg_dump_input_info)) /
+		(reg_input_info->num_dump_sets - 1)))) {
+		CAM_ERR(CAM_UTIL,
+			"Integer Overflow req_id: [%llu] num_dump_sets: [%u]",
+			req_id, reg_input_info->num_dump_sets);
+		rc = -EOVERFLOW;
+		goto end;
+	}
+
+	if ((!reg_input_info->num_dump_sets) ||
+		((cmd_in_data_end - cmd_buf_start) <= (uintptr_t)
+		(sizeof(struct cam_reg_dump_input_info) +
+		((reg_input_info->num_dump_sets - 1) * sizeof(uint32_t))))) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid number of dump sets, req_id: [%llu] num_dump_sets: [%u]",
+			req_id, reg_input_info->num_dump_sets);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL,
+		"reg_input_info req_id: %llu ctx %pK num_dump_sets: %d",
+		req_id, ctx, reg_input_info->num_dump_sets);
+	for (i = 0; i < reg_input_info->num_dump_sets; i++) {
+		if ((cmd_in_data_end - cmd_buf_start) <= (uintptr_t)
+			reg_input_info->dump_set_offsets_flex[i]) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid dump set offset: [%pK], cmd_buf_start: [%pK] cmd_in_data_end: [%pK]",
+				(uintptr_t)reg_input_info->dump_set_offsets_flex[i],
+				cmd_buf_start, cmd_in_data_end);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		reg_dump_desc = (struct cam_reg_dump_desc *)
+			(cmd_buf_start +
+			(uintptr_t)reg_input_info->dump_set_offsets_flex[i]);
+		if ((reg_dump_desc->num_read_range > 1) &&
+			(sizeof(struct cam_reg_read_info) > ((U32_MAX -
+			sizeof(struct cam_reg_dump_desc)) /
+			(reg_dump_desc->num_read_range - 1)))) {
+			CAM_ERR(CAM_UTIL,
+				"Integer Overflow req_id: [%llu] num_read_range: [%u]",
+				req_id, reg_dump_desc->num_read_range);
+			rc = -EOVERFLOW;
+			goto end;
+		}
+
+		if ((!reg_dump_desc->num_read_range) ||
+			((cmd_in_data_end - (uintptr_t)reg_dump_desc) <=
+			(uintptr_t)(sizeof(struct cam_reg_dump_desc) +
+			((reg_dump_desc->num_read_range - 1) *
+			sizeof(struct cam_reg_read_info))))) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid number of read ranges, req_id: [%llu] num_read_range: [%d]",
+				req_id, reg_dump_desc->num_read_range);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if ((cmd_buf_end - cmd_buf_start) <= (uintptr_t)
+			(reg_dump_desc->dump_buffer_offset +
+			sizeof(struct cam_reg_dump_out_buffer))) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid out buffer offset: [%pK],  cmd_buf_start: [%pK] cmd_buf_end: [%pK]",
+				(uintptr_t)reg_dump_desc->dump_buffer_offset,
+				cmd_buf_start, cmd_buf_end);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		reg_base_type = reg_dump_desc->reg_base_type;
+		if (reg_base_type == 0 || reg_base_type >
+			CAM_REG_DUMP_BASE_TYPE_SFE_RIGHT) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid Reg dump base type: %d",
+				reg_base_type);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		rc = reg_data_cb(reg_base_type, ctx, &soc_info, &reg_base_idx);
+		if (rc || !soc_info) {
+			CAM_ERR(CAM_UTIL,
+				"Reg space data callback failed rc: %d soc_info: [%pK]",
+				rc, soc_info);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (reg_base_idx > soc_info->num_reg_map) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid reg base idx: %d num reg map: %d",
+				reg_base_idx, soc_info->num_reg_map);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		CAM_DBG(CAM_UTIL,
+			"Reg data callback success req_id: %llu base_type: %d base_idx: %d num_read_range: %d",
+			req_id, reg_base_type, reg_base_idx,
+			reg_dump_desc->num_read_range);
+
+		/* If the dump request is triggered by user space
+		 * buffer will be different from the buffer which is received
+		 * in init packet. In this case, dump the data to the
+		 * user provided buffer and exit.
+		 */
+		if (user_triggered_dump) {
+			rc = cam_soc_util_user_reg_dump(reg_dump_desc,
+				soc_dump_args, soc_info, reg_base_idx);
+			CAM_INFO(CAM_UTIL,
+				"%s reg_base_idx %d dumped offset %u",
+				soc_info->dev_name, reg_base_idx,
+				soc_dump_args->offset);
+			goto end;
+		}
+
+		/* Below code is executed when data is dumped to the
+		 * out buffer received in init packet
+		 */
+		dump_out_buf = (struct cam_reg_dump_out_buffer *)
+			(cmd_buf_start +
+			(uintptr_t)reg_dump_desc->dump_buffer_offset);
+		dump_out_buf->req_id = req_id;
+		dump_out_buf->bytes_written = 0;
+
+		for (j = 0; j < reg_dump_desc->num_read_range; j++) {
+			CAM_DBG(CAM_UTIL,
+				"Number of bytes written to cmd buffer: %u req_id: %llu",
+				dump_out_buf->bytes_written, req_id);
+			reg_read_info = &reg_dump_desc->read_range_flex[j];
+			if (reg_read_info->type ==
+				CAM_REG_DUMP_READ_TYPE_CONT_RANGE) {
+				rc = cam_soc_util_dump_cont_reg_range(soc_info,
+					&reg_read_info->reg_read, reg_base_idx,
+					dump_out_buf, cmd_buf_end);
+			} else if (reg_read_info->type ==
+				CAM_REG_DUMP_READ_TYPE_DMI) {
+				rc = cam_soc_util_dump_dmi_reg_range(soc_info,
+					&reg_read_info->dmi_read, reg_base_idx,
+					dump_out_buf, cmd_buf_end);
+			} else {
+				CAM_ERR(CAM_UTIL,
+					"Invalid Reg dump read type: %d",
+					reg_read_info->type);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Reg range read failed rc: %d reg_base_idx: %d dump_out_buf: %pK",
+					rc, reg_base_idx, dump_out_buf);
+				goto end;
+			}
+		}
+	}
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+/**
+ * cam_soc_util_print_clk_freq()
+ *
+ * @brief:              This function gets the clk rates for each clk from clk
+ *                      driver and prints in log
+ *
+ * @soc_info:           Device soc struct to be populated
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_print_clk_freq(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	unsigned long clk_rate = 0;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_UTIL, "Invalid soc info");
+		return -EINVAL;
+	}
+
+	if ((soc_info->num_clk == 0) ||
+		(soc_info->num_clk >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "[%s] Invalid number of clock %d",
+			soc_info->dev_name, soc_info->num_clk);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		clk_rate = cam_wrapper_clk_get_rate(soc_info->clk[i]);
+
+		CAM_INFO(CAM_UTIL,
+			"[%s] idx = %d clk name = %s clk_rate=%lld",
+			soc_info->dev_name, i, soc_info->clk_name[i],
+			clk_rate);
+	}
+
+	return 0;
+}
+
+inline unsigned long cam_soc_util_get_applied_src_clk(
+	struct cam_hw_soc_info *soc_info, bool is_max)
+{
+	unsigned long clk_rate;
+
+	/*
+	 * For CRMC type, exa - ife, csid, cphy
+	 *     final clk = max(hw_client_0, hw_client_1, hw_client_2, sw_client)
+	 * For CRMB type, exa - camnoc axi
+	 *     final clk = max(hw_client_0 + hw_client_1 + hw_client_2, sw_client)
+	 */
+
+	if (is_max) {
+		clk_rate = max(soc_info->applied_src_clk_rates.hw_client[0].high,
+			soc_info->applied_src_clk_rates.hw_client[1].high);
+		clk_rate = max(clk_rate, soc_info->applied_src_clk_rates.hw_client[2].high);
+		clk_rate = max(clk_rate, soc_info->applied_src_clk_rates.sw_client);
+	} else {
+		clk_rate = max((soc_info->applied_src_clk_rates.hw_client[0].high +
+			soc_info->applied_src_clk_rates.hw_client[1].high +
+			soc_info->applied_src_clk_rates.hw_client[2].high),
+			soc_info->applied_src_clk_rates.sw_client);
+	}
+
+	return clk_rate;
+}
+
+int cam_soc_util_regulators_enabled(struct cam_hw_soc_info *soc_info)
+{
+	int j = 0, rc = 0;
+	int enabled_cnt = 0;
+
+	for (j = 0; j < soc_info->num_rgltr; j++) {
+		if (soc_info->rgltr[j]) {
+			rc = cam_wrapper_regulator_is_enabled(soc_info->rgltr[j]);
+			if (rc < 0) {
+				CAM_ERR(CAM_UTIL, "%s regulator_is_enabled failed",
+					soc_info->rgltr_name[j]);
+			} else if (rc > 0) {
+				CAM_DBG(CAM_UTIL, "%s regulator enabled",
+					soc_info->rgltr_name[j]);
+				enabled_cnt++;
+			} else {
+				CAM_DBG(CAM_UTIL, "%s regulator is disabled",
+					soc_info->rgltr_name[j]);
+			}
+		}
+	}
+
+	return enabled_cnt;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_soc_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_soc_util.h
@@ -0,0 +1,1010 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SOC_UTIL_H_
+#define _CAM_SOC_UTIL_H_
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/clk.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/regulator/consumer.h>
+#include <linux/debugfs.h>
+#include <linux/of_fdt.h>
+
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include <media/cam_defs.h>
+
+#if IS_REACHABLE(CONFIG_MSM_MMRM)
+#include <linux/soc/qcom/msm_mmrm.h>
+#endif
+
+#define NO_SET_RATE  -1
+#define INIT_RATE    -2
+
+/* maximum number of device block */
+#define CAM_SOC_MAX_BLOCK           8
+
+/* maximum number of device base */
+#define CAM_SOC_MAX_BASE            CAM_SOC_MAX_BLOCK
+
+/* maximum number of device regulator */
+#define CAM_SOC_MAX_REGULATOR       10
+
+/* maximum number of device clock */
+#define CAM_SOC_MAX_CLK             32
+
+/* maximum number of optional device clock */
+#define CAM_SOC_MAX_OPT_CLK    7
+
+/* maximum number of pinctrl mapping */
+#define CAM_SOC_MAX_PINCTRL_MAP     2
+
+/* maximum number of irq per device */
+#define CAM_SOC_MAX_IRQ_LINES_PER_DEV 2
+
+/* DDR device types */
+#define DDR_TYPE_LPDDR4        6
+#define DDR_TYPE_LPDDR4X       7
+#define DDR_TYPE_LPDDR5        8
+#define DDR_TYPE_LPDDR5X       9
+
+/* Maximum length of tag while dumping */
+#define CAM_SOC_HW_DUMP_TAG_MAX_LEN 128
+
+/* Client index to be used to vote clk frequency through sw client */
+#define CAM_CLK_SW_CLIENT_IDX -1
+
+/**
+ * enum cam_vote_level - Enum for voting level
+ *
+ * @CAM_SUSPEND_VOTE   : Suspend vote
+ * @CAM_MINSVS_VOTE    : Min SVS vote
+ * @CAM_LOWSVS_D1_VOTE : Low SVS D1 vote
+ * @CAM_LOWSVS_VOTE    : Low SVS vote
+ * @CAM_SVS_VOTE       : SVS vote
+ * @CAM_SVSL1_VOTE     : SVS Plus vote
+ * @CAM_NOMINAL_VOTE   : Nominal vote
+ * @CAM_NOMINALL1_VOTE : Nominal plus vote
+ * @CAM_TURBO_VOTE     : Turbo vote
+ * @CAM_MAX_VOTE       : Max voting level, This is invalid level.
+ */
+enum cam_vote_level {
+	CAM_SUSPEND_VOTE,
+	CAM_MINSVS_VOTE,
+	CAM_LOWSVS_D1_VOTE,
+	CAM_LOWSVS_VOTE,
+	CAM_SVS_VOTE,
+	CAM_SVSL1_VOTE,
+	CAM_NOMINAL_VOTE,
+	CAM_NOMINALL1_VOTE,
+	CAM_TURBO_VOTE,
+	CAM_MAX_VOTE,
+};
+
+/* pinctrl states */
+#define CAM_SOC_PINCTRL_STATE_SLEEP "cam_suspend"
+#define CAM_SOC_PINCTRL_STATE_DEFAULT "cam_default"
+
+#define CAM_CESTA_MAX_CLIENTS       3
+#define CAM_NUM_PWR_STATES          2
+
+/**
+ * struct cam_soc_util_hw_client_clk_rates:   Information about HW client clock vote
+ *
+ * @high:               HW client clock vote high value
+ * @low:                HW client clock vote low value
+ **/
+struct cam_soc_util_hw_client_clk_rates {
+	unsigned long high;
+	unsigned long low;
+};
+
+/**
+ * struct cam_soc_util_clk_rates:   Information about clock vote for SW and HW clients
+ *
+ * @sw_client:               SW client clock vote
+ * @hw_client:               HW client clock vote
+ **/
+struct cam_soc_util_clk_rates {
+	unsigned long sw_client;
+	struct cam_soc_util_hw_client_clk_rates hw_client[CAM_CESTA_MAX_CLIENTS];
+};
+
+/**
+ * struct cam_soc_reg_map:   Information about the mapped register space
+ *
+ * @mem_base:               Starting location of MAPPED register space
+ * @mem_cam_base:           Starting offset of this register space compared
+ *                          to ENTIRE Camera register space
+ * @size:                   Size of register space
+ **/
+struct cam_soc_reg_map {
+	void __iomem                   *mem_base;
+	uint32_t                        mem_cam_base;
+	resource_size_t                 size;
+};
+
+/**
+ * struct cam_soc_pinctrl_state:   Information about pinctrl state
+ *
+ * @gpio_state_active:     default pinctrl state
+ * @gpio_state_suspend:    suspend state of pinctrl
+ * @is_active:             to identify if pinctrl is in use.
+ **/
+struct cam_soc_pinctrl_state {
+	struct pinctrl_state *gpio_state_active;
+	struct pinctrl_state *gpio_state_suspend;
+	bool is_active;
+};
+
+/**
+ * struct cam_soc_pinctrl_info:   Information about pinctrl data
+ *
+ * @pinctrl:               pintrl object
+ * @pctrl_state:           pinctrl state montior map
+ **/
+struct cam_soc_pinctrl_info {
+	struct pinctrl *pinctrl;
+	struct cam_soc_pinctrl_state pctrl_state[
+		CAM_SOC_MAX_PINCTRL_MAP];
+};
+
+/**
+ * struct cam_soc_gpio_data:   Information about the gpio pins
+ *
+ * @cam_gpio_common_tbl:       It is list of al the gpios present in gpios node
+ * @cam_gpio_common_tbl_size:  It is equal to number of gpios prsent in
+ *                             gpios node in DTSI
+ * @cam_gpio_req_tbl            It is list of al the requesetd gpios
+ * @cam_gpio_req_tbl_size:      It is size of requested gpios
+ **/
+struct cam_soc_gpio_data {
+	struct gpio *cam_gpio_common_tbl;
+	uint8_t cam_gpio_common_tbl_size;
+	struct gpio *cam_gpio_req_tbl;
+	uint8_t cam_gpio_req_tbl_size;
+};
+
+/**
+ * struct cam_hw_soc_info:  Soc information pertaining to specific instance of
+ *                          Camera hardware driver module
+ *
+ * @pdev:                   Platform device pointer
+ * @device:                 Device pointer
+ * @hw_version:             Camera device version
+ * @index:                  Instance id for the camera device
+ * @dev_name:               Device Name
+ * @is_nrt_dev:             Whether this is a non-real time device
+ * @irq_name:               Array of irq name associated with the device
+ * @label_name:             label name
+ * @irq_line:               Array of Irq resources
+ * @irq_num:                Array of Irq numbers
+ * @irq_data:               Array of Irq Private data that are passed when IRQs are requested
+ * @irq_count:              The number of IRQ lines associated with the device
+ * @compatible:             Compatible string associated with the device
+ * @num_mem_block:          Number of entry in the "reg-names"
+ * @mem_block_name:         Array of the reg block name
+ * @mem_block_cam_base:     Array of offset of this register space compared
+ *                          to ENTIRE Camera register space
+ * @mem_block:              Associated resource structs
+ * @reg_map:                Array of Mapped register info for the "reg-names"
+ * @num_reg_map:            Number of mapped register space associated
+ *                          with mem_block. num_reg_map = num_mem_block in
+ *                          most cases
+ * @reserve_mem:            Whether to reserve memory for Mem blocks
+ * @num_rgltr:              Number of regulators
+ * @rgltr_name:             Array of regulator names
+ * @rgltr_ctrl_support:     Whether regulator control is supported
+ * @rgltr_min_volt:         Array of minimum regulator voltage
+ * @rgltr_max_volt:         Array of maximum regulator voltage
+ * @rgltr_op_mode:          Array of regulator operation mode
+ * @rgltr_type:             Array of regulator names
+ * @rgltr:                  Array of associated regulator resources
+ * @rgltr_delay:            Array of regulator delay values
+ * @num_clk:                Number of clocks
+ * @clk_name:               Array of clock names
+ * @clk:                    Array of associated clock resources
+ * @clk_rate:               2D array of clock rates representing clock rate
+ *                          values at different vote levels
+ * @clk_id                  Clock IDs
+ * @shared_clk_mask         Mask indicating which of the clocks are shared with
+ *                          other devices. Set rate on these clocks needs to go
+ *                          through camera clk wrapper for aggregation.
+ * @prev_clk_level          Last vote level
+ * @src_clk_idx:            Source clock index that is rate-controllable
+ * @applied_src_clk_rates:  Applied src clock rates for SW and HW client
+ * @clk_level_valid:        Indicates whether corresponding level is valid
+ * @lowest_clk_level:       Lowest clock level that has valid freq info
+ * @scl_clk_count:          Number of scalable clocks present
+ * @scl_clk_idx:            Index of scalable clocks
+ * @optional_clk_name:      Array of clock names
+ * @optional_clk:           Array of associated clock resources
+ * @optional_clk_rate:      Optional clock's clk rate
+ * @optional_clk_id         Clock IDs
+ * @optional_shared_clk_mask Mask indicating which of the clocks are shared with
+ *                           other devices. Set rate on these clocks needs to go
+ *                           through camera clk wrapper for aggregation.
+ * @gpio_data:              Pointer to gpio info
+ * @mmrm_handle:            MMRM Client handle for src clock
+ * @is_clk_drv_en:          If clock drv is enabled in hw
+ * @pinctrl_info:           Pointer to pinctrl info
+ * @dentry:                 Debugfs entry
+ * @clk_level_override_high:Clk level set from debugfs. When cesta is enabled, used to override
+ *                          high clk value
+ * @clk_level_override_high:Low clk level set from debugfs when cesta is enabled, used to override
+ *                          low clk value
+ * @clk_control:            Enable/disable clk rate control through debugfs
+ * @cam_cx_ipeak_enable     cx-ipeak enable/disable flag
+ * @cam_cx_ipeak_bit        cx-ipeak mask for driver
+ * @is_child_node:          If this node is a child to a parent device
+ * @parent_node             The parent node to inherit data from
+ * @soc_private:            Soc private data
+ */
+struct cam_hw_soc_info {
+	struct platform_device         *pdev;
+	struct device                  *dev;
+	uint32_t                        hw_version;
+	uint32_t                        index;
+	const char                     *dev_name;
+	bool                            is_nrt_dev;
+	const char                     *irq_name[CAM_SOC_MAX_IRQ_LINES_PER_DEV];
+	const char                     *label_name;
+	struct resource                *irq_line[CAM_SOC_MAX_IRQ_LINES_PER_DEV];
+	int                             irq_num[CAM_SOC_MAX_IRQ_LINES_PER_DEV];
+	void                           *irq_data[CAM_SOC_MAX_IRQ_LINES_PER_DEV];
+	uint32_t                        irq_count;
+	const char                     *compatible;
+
+	uint32_t                        num_mem_block;
+	const char                     *mem_block_name[CAM_SOC_MAX_BLOCK];
+	uint32_t                        mem_block_cam_base[CAM_SOC_MAX_BLOCK];
+	struct resource                *mem_block[CAM_SOC_MAX_BLOCK];
+	struct cam_soc_reg_map          reg_map[CAM_SOC_MAX_BASE];
+	uint32_t                        num_reg_map;
+	uint32_t                        reserve_mem;
+
+	uint32_t                        num_rgltr;
+	const char                     *rgltr_name[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_ctrl_support;
+	uint32_t                        rgltr_min_volt[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_max_volt[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_op_mode[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_type[CAM_SOC_MAX_REGULATOR];
+	struct regulator               *rgltr[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_delay[CAM_SOC_MAX_REGULATOR];
+
+	int32_t                         num_genpd;
+	struct device                 **genpd;
+
+	uint32_t                        use_shared_clk;
+	uint32_t                        num_clk;
+	const char                     *clk_name[CAM_SOC_MAX_CLK];
+	struct clk                     *clk[CAM_SOC_MAX_CLK];
+	int32_t                         clk_rate[CAM_MAX_VOTE][CAM_SOC_MAX_CLK];
+	uint32_t                        clk_id[CAM_SOC_MAX_CLK];
+	uint32_t                        shared_clk_mask;
+	int32_t                         prev_clk_level;
+	int32_t                         src_clk_idx;
+	struct cam_soc_util_clk_rates   applied_src_clk_rates;
+	bool                            clk_level_valid[CAM_MAX_VOTE];
+	uint32_t                        lowest_clk_level;
+	int32_t                         scl_clk_count;
+	int32_t                         scl_clk_idx[CAM_SOC_MAX_CLK];
+	const char                     *optional_clk_name[CAM_SOC_MAX_OPT_CLK];
+	struct clk                     *optional_clk[CAM_SOC_MAX_OPT_CLK];
+	int32_t                         optional_clk_rate[CAM_SOC_MAX_OPT_CLK];
+	uint32_t                        optional_clk_id[CAM_SOC_MAX_OPT_CLK];
+	uint32_t                        optional_shared_clk_mask;
+
+	void                           *mmrm_handle;
+
+	bool                            is_clk_drv_en;
+
+	struct cam_soc_gpio_data       *gpio_data;
+	struct cam_soc_pinctrl_info     pinctrl_info;
+
+	struct dentry                  *dentry;
+	uint32_t                        clk_level_override_high;
+	uint32_t                        clk_level_override_low;
+	bool                            clk_control_enable;
+	bool                            cam_cx_ipeak_enable;
+	int32_t                         cam_cx_ipeak_bit;
+	bool                            is_child_node;
+	struct device_node             *parent_node;
+
+	void                           *soc_private;
+};
+
+/**
+ * struct cam_hw_soc_dump_header - SOC dump header
+ *
+ * @Brief:        soc hw dump header
+ *
+ * @tag:          Tag name for the header
+ * @word_size:    Size of each word
+ * @size:         Total size of dumped data
+ */
+struct cam_hw_soc_dump_header {
+	uint8_t   tag[CAM_SOC_HW_DUMP_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * struct cam_hw_soc_dump_args:   SOC Dump args
+ *
+ * @request_id:          Issue request id
+ * @offset:              Buffer offset, updated as the informaton is dumped
+ * @buf_handle:          Buffer handle of the out buffer
+ */
+struct cam_hw_soc_dump_args {
+	uint64_t             request_id;
+	size_t               offset;
+	uint32_t             buf_handle;
+};
+
+/*
+ * CAM_SOC_GET_REG_MAP_START
+ *
+ * @brief:              This MACRO will get the mapped starting address
+ *                      where the register space can be accessed
+ *
+ * @__soc_info:         Device soc information
+ * @__base_index:       Index of register space in the HW block
+ *
+ * @return:             Returns a pointer to the mapped register memory
+ */
+#define CAM_SOC_GET_REG_MAP_START(__soc_info, __base_index)          \
+	((!__soc_info || __base_index >= __soc_info->num_reg_map) ?  \
+		NULL : __soc_info->reg_map[__base_index].mem_base)
+
+/*
+ * CAM_SOC_GET_REG_MAP_CAM_BASE
+ *
+ * @brief:              This MACRO will get the cam_base of the
+ *                      register space
+ *
+ * @__soc_info:         Device soc information
+ * @__base_index:       Index of register space in the HW block
+ *
+ * @return:             Returns an int32_t value.
+ *                        Failure: -1
+ *                        Success: Starting offset of register space compared
+ *                                 to entire Camera Register Map
+ */
+#define CAM_SOC_GET_REG_MAP_CAM_BASE(__soc_info, __base_index)       \
+	((!__soc_info || __base_index >= __soc_info->num_reg_map) ?  \
+		-1 : __soc_info->reg_map[__base_index].mem_cam_base)
+
+/*
+ * CAM_SOC_GET_REG_MAP_SIZE
+ *
+ * @brief:              This MACRO will get the size of the mapped
+ *                      register space
+ *
+ * @__soc_info:         Device soc information
+ * @__base_index:       Index of register space in the HW block
+ *
+ * @return:             Returns a uint32_t value.
+ *                        Failure: 0
+ *                        Success: Non-zero size of mapped register space
+ */
+#define CAM_SOC_GET_REG_MAP_SIZE(__soc_info, __base_index)           \
+	((!__soc_info || __base_index >= __soc_info->num_reg_map) ?  \
+		0 : __soc_info->reg_map[__base_index].size)
+
+/**
+ * cam_soc_util_get_level_from_string()
+ *
+ * @brief:              Get the associated vote level for the input string
+ *
+ * @string:             Input string to compare with.
+ * @level:              Vote level corresponds to input string.
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_get_level_from_string(const char *string,
+	enum cam_vote_level *level);
+
+/**
+ * cam_soc_util_get_dt_properties()
+ *
+ * @brief:              Parse the DT and populate the common properties that
+ *                      are part of the soc_info structure - register map,
+ *                      clocks, regulators, irq, etc.
+ *
+ * @soc_info:           Device soc struct to be populated
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_get_dt_properties(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_request_platform_resource()
+ *
+ * @brief:              Request regulator, irq, and clock resources
+ *
+ * @soc_info:           Device soc information
+ * @handler:            Irq handler function pointer
+ * @irq_data:           Irq handler function CB data
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_request_platform_resource(struct cam_hw_soc_info *soc_info,
+	irq_handler_t handler, void **irq_data);
+
+/**
+ * cam_soc_util_release_platform_resource()
+ *
+ * @brief:              Release regulator, irq, and clock resources
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_release_platform_resource(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_enable_platform_resource()
+ *
+ * @brief:              Enable regulator, irq resources
+ *
+ * @soc_info:           Device soc information
+ * @cesta_client_idx:   CESTA Client idx for hw client based src clocks
+ * @enable_clocks:      Boolean flag:
+ *                          TRUE: Enable all clocks in soc_info Now.
+ *                          False: Don't enable clocks Now. Driver will
+ *                                 enable independently.
+ * @clk_level:          Clock level to be applied.
+ *                      Applicable only if enable_clocks is true
+ *                          Valid range : 0 to (CAM_MAX_VOTE - 1)
+ * @irq_enable:         Boolean flag:
+ *                          TRUE: Enable IRQ in soc_info Now.
+ *                          False: Don't enable IRQ Now. Driver will
+ *                                 enable independently.
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_enable_platform_resource(struct cam_hw_soc_info *soc_info,
+	int cesta_client_idx, bool enable_clocks, enum cam_vote_level clk_level,
+	bool irq_enable);
+
+/**
+ * cam_soc_util_disable_platform_resource()
+ *
+ * @brief:              Disable regulator, irq resources
+ *
+ * @soc_info:           Device soc information
+ * @cesta_client_idx:   CESTA Client idx for hw client based src clocks
+ * @disable_irq:        Boolean flag:
+ *                          TRUE: Disable IRQ in soc_info Now.
+ *                          False: Don't disable IRQ Now. Driver will
+ *                                 disable independently.
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_disable_platform_resource(struct cam_hw_soc_info *soc_info,
+	int cesta_client_idx, bool disable_clocks, bool disable_irq);
+
+/**
+ * cam_soc_util_get_clk_round_rate()
+ *
+ * @brief:              Get the rounded clock rate for the given clock's
+ *                      clock rate value
+ *
+ * @soc_info:           Device soc information
+ * @clk_index:          Clock index in soc_info for which round rate is needed
+ * @clk_rate:           Input clock rate for which rounded rate is needed
+ *
+ * @return:             Rounded clock rate
+ */
+long cam_soc_util_get_clk_round_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_index, unsigned long clk_rate);
+
+/**
+ * cam_soc_util_set_src_clk_rate()
+ *
+ * @brief:              Set the rate on the source clock for sw or hw clients. Requires a valid
+ *                      CESTA client idx for hw client voting.
+ *
+ * @soc_info:           Device soc information
+ * @cesta_client_idx:   CESTA client idx if src clock belongs to cesta client, otherwise -1
+ * @clk_rate_high:      High clock rate associated with the src clk, applies to sw client vote
+ *                      if not cesta client
+ * @clk_rate_low:       Low clock rate associated with the src clk, only applies to cesta based
+ *                      hw client vote
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_set_src_clk_rate(struct cam_hw_soc_info *soc_info, int cesta_client_idx,
+	unsigned long clk_rate_high, unsigned long clk_rate_low);
+
+
+/**
+ * cam_soc_util_get_option_clk_by_name()
+ *
+ * @brief:              Get reference to optional clk using name
+ *
+ * @soc_info:           Device soc information
+ * @clk_name:           Name of clock to find reference for
+ * @clk_index:          Clk index in the option clk array to be returned
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_soc_util_get_option_clk_by_name(struct cam_hw_soc_info *soc_info,
+	const char *clk_name, int32_t *clk_index);
+
+/**
+ * cam_soc_util_put_optional_clk()
+ *
+ * @brief:              Put clock corresponding to index specified in params
+ *
+ * @soc_info:           Device soc information
+ * @clk_idx:            Clock index in optional clocks to put
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_put_optional_clk(struct cam_hw_soc_info *soc_info,
+	int32_t clk_idx);
+
+/**
+ * cam_soc_util_clk_enable()
+ *
+ * @brief:              Enable clock specified in params
+ *
+ * @soc_info:           Device soc information
+ * @cesta_client_idx:   CESTA Client idx for hw client based src clocks
+ * @optional_clk:       Whether to set optional clk or normal clk with
+ *                      the idx given
+ * @clk_idx:            Clock index to set
+ * @apply_level:        Apply level.
+ *                      -1 for 0 rate
+ *                      any other value indicate level for normal clocks
+ *                      For optional clocks any other value means the rate saved
+ *                      in soc_info
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_clk_enable(struct cam_hw_soc_info *soc_info, int cesta_client_idx,
+	bool optional_clk, int32_t clk_idx, int32_t apply_level);
+
+/**
+ * cam_soc_util_set_clk_rate_level()
+ *
+ * @brief:              Apply clock rates for the requested level.
+ *                      This applies the new requested level for all
+ *                      the clocks listed in DT based on their values.
+ *
+ * @soc_info:           Device soc information
+ * @cesta_client_idx:   CESTA client idx for HW client based src clocks
+ * @clk_level_high:     Clock level number to set, high value if crm based src clock
+ * @clk_level_low:      Low clock level value if crm based src clock
+ * @do_not_set_src_clk: If true, set clock rates except the src clk
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_set_clk_rate_level(struct cam_hw_soc_info *soc_info,
+	int cesta_client_idx, enum cam_vote_level clk_level_high,
+	enum cam_vote_level clk_level_low, bool do_not_set_src_clk);
+
+/**
+ * cam_soc_util_clk_disable()
+ *
+ * @brief:              Disable clock specified in params
+ *
+ * @soc_info:           Device soc information
+ * @cesta_client_idx:   CESTA Client idx for hw client based src clocks
+ * @optional_clk:       Whether to set optional clk or normal clk with
+ *                      the idx given
+ * @clk_idx:            Clock index to disable
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_clk_disable(struct cam_hw_soc_info *soc_info, int cesta_client_idx,
+	bool optional_clk, int32_t clk_idx);
+
+/**
+ * cam_soc_util_dump_clk()
+ *
+ * @brief:              Dumps all the clocks of the caller hw, using
+ *                      clock api.
+ *
+ * @soc_info:           Device soc information
+ * @return:             Success or failure
+ */
+
+int cam_soc_util_dump_clk(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_irq_enable()
+ *
+ * @brief:              Enable IRQ in SOC
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_irq_enable(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_irq_disable()
+ *
+ * @brief:              Disable IRQ in SOC
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_irq_disable(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_regulator_enable()
+ *
+ * @brief:              Enable single regulator
+ *
+ * @rgltr               Regulator that needs to be turned ON
+ * @rgltr_name          Associated Regulator name
+ * @rgltr_min_volt:     Requested minimum volatage
+ * @rgltr_max_volt:     Requested maximum volatage
+ * @rgltr_op_mode:      Requested Load
+ * @rgltr_delay:        Requested delay needed aaftre enabling regulator
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_regulator_enable(struct regulator *rgltr,
+	const char *rgltr_name,
+	uint32_t rgltr_min_volt, uint32_t rgltr_max_volt,
+	uint32_t rgltr_op_mode, uint32_t rgltr_delay);
+
+/**
+ * cam_soc_util_regulator_enable()
+ *
+ * @brief:              Disable single regulator
+ *
+ * @rgltr               Regulator that needs to be turned ON
+ * @rgltr_name          Associated Regulator name
+ * @rgltr_min_volt:     Requested minimum volatage
+ * @rgltr_max_volt:     Requested maximum volatage
+ * @rgltr_op_mode:      Requested Load
+ * @rgltr_delay:        Requested delay needed aaftre enabling regulator
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_regulator_disable(struct regulator *rgltr,
+	const char *rgltr_name,
+	uint32_t rgltr_min_volt, uint32_t rgltr_max_volt,
+	uint32_t rgltr_op_mode, uint32_t rgltr_delay);
+
+
+/**
+ * cam_soc_util_configure_pd()
+ *
+ * @brief:              Configure power domain
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_configure_pd(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_power_domain_enable_default()
+ *
+ * @brief:              Enable power domain
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_power_domain_enable_default(
+	struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_power_domain_disable_default()
+ *
+ * @brief:              Disable power domain
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Null
+ */
+void cam_soc_util_power_domain_disable_default(
+	struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_w()
+ *
+ * @brief:              Camera SOC util for register write
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Offset of register to be writen
+ * @data:               Value to be written
+ *
+ * @return:             Success or Failure
+ */
+static inline int cam_soc_util_w(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset, uint32_t data)
+{
+	if (!CAM_SOC_GET_REG_MAP_START(soc_info, base_index)) {
+		CAM_ERR(CAM_UTIL, "No valid mapped starting address found");
+		return -EINVAL;
+	}
+	return cam_io_w(data,
+		CAM_SOC_GET_REG_MAP_START(soc_info, base_index) + offset);
+}
+
+/**
+ * cam_soc_util_w_mb()
+ *
+ * @brief:              Camera SOC util for register write with memory barrier.
+ *                      Memory Barrier is only before the write to ensure the
+ *                      order. If need to ensure this write is also flushed
+ *                      call wmb() independently in the caller.
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Offset of register to be writen
+ * @data:               Value to be written
+ *
+ * @return:             Success or Failure
+ */
+static inline int cam_soc_util_w_mb(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset, uint32_t data)
+{
+	if (!CAM_SOC_GET_REG_MAP_START(soc_info, base_index)) {
+		CAM_ERR(CAM_UTIL, "No valid mapped starting address found");
+		return -EINVAL;
+	}
+	return cam_io_w_mb(data,
+		CAM_SOC_GET_REG_MAP_START(soc_info, base_index) + offset);
+}
+
+/**
+ * cam_soc_util_r()
+ *
+ * @brief:              Camera SOC util for register read
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Offset of register to be read
+ *
+ * @return:             Value read from the register address
+ */
+static inline uint32_t cam_soc_util_r(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset)
+{
+	if (!CAM_SOC_GET_REG_MAP_START(soc_info, base_index)) {
+		CAM_ERR(CAM_UTIL, "No valid mapped starting address found");
+		return 0;
+	}
+	return cam_io_r(
+		CAM_SOC_GET_REG_MAP_START(soc_info, base_index) + offset);
+}
+
+/**
+ * cam_soc_util_r_mb()
+ *
+ * @brief:              Camera SOC util for register read with memory barrier.
+ *                      Memory Barrier is only before the write to ensure the
+ *                      order. If need to ensure this write is also flushed
+ *                      call rmb() independently in the caller.
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Offset of register to be read
+ *
+ * @return:             Value read from the register address
+ */
+static inline uint32_t cam_soc_util_r_mb(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset)
+{
+	if (!CAM_SOC_GET_REG_MAP_START(soc_info, base_index)) {
+		CAM_ERR(CAM_UTIL, "No valid mapped starting address found");
+		return 0;
+	}
+	return cam_io_r_mb(
+		CAM_SOC_GET_REG_MAP_START(soc_info, base_index) + offset);
+}
+
+/**
+ * cam_soc_util_reg_dump()
+ *
+ * @brief:              Camera SOC util for dumping a range of register
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Start register offset for the dump
+ * @size:               Size specifying the range for dump
+ *
+ * @return:             Success or Failure
+ */
+int cam_soc_util_reg_dump(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset, int size);
+
+void cam_soc_util_clk_disable_default(struct cam_hw_soc_info *soc_info,
+	int cesta_client_idx);
+
+int cam_soc_util_clk_enable_default(struct cam_hw_soc_info *soc_info, int cesta_client_idx,
+	enum cam_vote_level clk_level);
+
+int cam_soc_util_get_clk_level(struct cam_hw_soc_info *soc_info,
+	int64_t clk_rate, int clk_idx, int32_t *clk_lvl);
+
+unsigned long cam_soc_util_get_clk_rate_applied(
+	struct cam_hw_soc_info *soc_info, int32_t index, bool is_src,
+	enum cam_vote_level clk_level);
+
+/* Callback to get reg space data for specific HW */
+typedef int (*cam_soc_util_regspace_data_cb)(uint32_t reg_base_type,
+	void *ctx, struct cam_hw_soc_info **soc_info_ptr,
+	uint32_t *reg_base_idx);
+
+/**
+ * cam_soc_util_reg_dump_to_cmd_buf()
+ *
+ * @brief:                 Camera SOC util for dumping sets of register ranges
+ *                         command buffer
+ *
+ * @ctx:                   Context info from specific hardware manager
+ * @cmd_desc:              Command buffer descriptor
+ * @req_id:                Last applied req id for which reg dump is required
+ * @reg_data_cb:           Callback function to get reg space info based on type
+ *                         in command buffer
+ * @soc_dump_args:         Dump buffer args to dump the soc information.
+ * @user_triggered_dump:   Flag to indicate if the dump request is issued by
+ *                         user.
+ * @return:                Success or Failure
+ */
+int cam_soc_util_reg_dump_to_cmd_buf(void *ctx,
+	struct cam_cmd_buf_desc *cmd_desc, uint64_t req_id,
+	cam_soc_util_regspace_data_cb reg_data_cb,
+	struct cam_hw_soc_dump_args *soc_dump_args,
+	bool user_triggered_dump);
+
+/**
+ * cam_soc_util_print_clk_freq()
+ *
+ * @brief:              This function gets the clk rates for each clk from clk
+ *                      driver and prints in log
+ *
+ * @soc_info:           Device soc struct to be populated
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_print_clk_freq(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_select_pinctrl_state()
+ *
+ * @brief:              This function gets the pinctrl handle
+ *
+ * @soc_info:           Device soc struct to be populated
+ * @active:             True for active and false for suspend state
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_select_pinctrl_state(
+	struct cam_hw_soc_info *soc_info, int idx, bool active);
+
+/**
+ * cam_soc_util_print_clk_freq()
+ *
+ * @brief:              This function checks whether regulators of this device are enabled at this
+ *                      time.
+ *
+ * @soc_info:           Device soc struct to be populated
+ *
+ * @return:             Number of regulators enabled
+ */
+int cam_soc_util_regulators_enabled(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_cesta_populate_crm_device()
+ *
+ * @brief:              This function populates the camera cesta crm device in soc util
+ *
+ * @return:             success or failure
+ */
+inline int cam_soc_util_cesta_populate_crm_device(void);
+
+/**
+ * cam_soc_util_cesta_channel_switch()
+ *
+ * @brief:              This function triggers the application of power states to crm
+ *                      and channel switch operation in hw. Also, for camera it applies
+ *                      the high vote of the active channel
+ * @cesta_client_idx:   CESTA client index through which power states need to be applied
+ * @identifier:         Identifying the caller triggerring channel switch
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_cesta_channel_switch(uint32_t cesta_client_idx, const char *identifier);
+
+/**
+ * cam_soc_util_get_applied_src_clk()
+ *
+ * @brief:              Inline function to get applied src clk rate.
+
+ * @soc_info:           Device soc struct to be populated
+ * @is_max:             Is max of all hw clients if cesta is enabled
+ *
+ * @return:             success or failure
+ */
+inline unsigned long cam_soc_util_get_applied_src_clk(
+	struct cam_hw_soc_info *soc_info, bool is_max);
+
+/**
+ * cam_soc_util_get_string_from_level()
+ *
+ * @brief:     Returns the string for a given clk level
+ *
+ * @level:     Clock level
+ *
+ * @return:    String corresponding to the clk level
+ */
+const char *cam_soc_util_get_string_from_level(enum cam_vote_level level);
+
+/**
+ * cam_wrapper_clk_get_rate()
+ *
+ * @brief:     Wrapper for clk get rate
+ *
+ * @clk:       Clock
+ *
+ * @return:    Clock rate
+ */
+inline unsigned long cam_wrapper_clk_get_rate(struct clk *clk);
+
+/**
+ * cam_wrapper_regulator_set_load()
+ *
+ * @brief:     Wrapper for regulator set load
+ *
+ * @regulator: Regulator
+ *
+ * @uA_load:   Load current
+ *
+ * @return:    Success or failure
+ */
+inline int cam_wrapper_regulator_set_load(
+	struct regulator *regulator, int uA_load);
+
+/**
+ * cam_wrapper_regulator_set_mode()
+ *
+ * @brief:     Wrapper for regulator set mode
+ *
+ * @regulator: Regulator
+ *
+ * @mode:      Mode
+ *
+ * @return:    Success or failure
+ */
+inline int cam_wrapper_regulator_set_mode(
+	struct regulator *regulator, unsigned int mode);
+
+/**
+ * cam_soc_util_set_bypass_drivers()
+ *
+ * @brief:          Set bypass drivers
+ *
+ * @bypass_drivers: Bypass drivers
+ *
+ * @return:         Void
+ */
+inline void cam_soc_util_set_bypass_drivers(
+	uint32_t bypass_drivers);
+
+#endif /* _CAM_SOC_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_trace.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_trace.c
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+/* Instantiate tracepoints */
+#define CREATE_TRACE_POINTS
+#include "cam_trace.h"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_trace.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/cam_utils/cam_trace.h
@@ -0,0 +1,436 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#if !defined(_CAM_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _CAM_TRACE_H
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM camera
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE ./cam_trace
+
+#include <linux/tracepoint.h>
+#include <media/cam_req_mgr.h>
+#include "cam_req_mgr_core.h"
+#include "cam_req_mgr_interface.h"
+#include "cam_context.h"
+
+#define CAM_DEFAULT_VALUE 0xFF
+#define CAM_TRACE_PRINT_MAX_LEN 512
+
+TRACE_EVENT(cam_context_state,
+	TP_PROTO(const char *name, struct cam_context *ctx),
+	TP_ARGS(name, ctx),
+	TP_STRUCT__entry(
+		__field(void*, ctx)
+		__field(uint32_t, state)
+		__string(name, name)
+	),
+	TP_fast_assign(
+		__entry->ctx = ctx;
+		__entry->state = ctx->state;
+		__assign_str(name, name);
+	),
+	TP_printk(
+		"%s: State ctx=%p ctx_state=%u",
+			__get_str(name), __entry->ctx, __entry->state
+	)
+);
+
+TRACE_EVENT(cam_isp_activated_irq,
+	TP_PROTO(struct cam_context *ctx, unsigned int substate,
+		unsigned int event, uint64_t timestamp),
+	TP_ARGS(ctx, substate, event, timestamp),
+	TP_STRUCT__entry(
+		__field(void*, ctx)
+		__field(uint32_t, state)
+		__field(uint32_t, substate)
+		__field(uint32_t, event)
+		__field(uint64_t, ts)
+		__field(int32_t, link_hdl)
+	),
+	TP_fast_assign(
+		__entry->ctx = ctx;
+		__entry->state = ctx->state;
+		__entry->substate = substate;
+		__entry->event = event;
+		__entry->ts = timestamp;
+		__entry->link_hdl = ctx->link_hdl;
+
+	),
+	TP_printk(
+		"ISP: IRQ ctx=%p ctx_state=%u substate=%u event=%u ts=%llu link_hdl=0x%x",
+			__entry->ctx, __entry->state, __entry->substate,
+			__entry->event, __entry->ts, __entry->link_hdl
+	)
+);
+
+TRACE_EVENT(cam_log_event,
+	TP_PROTO(const char *string1, const char *string2,
+		uint64_t val1, uint64_t val2),
+	TP_ARGS(string1, string2, val1, val2),
+	TP_STRUCT__entry(
+		__string(string1, string1)
+		__string(string2, string2)
+		__field(uint64_t, val1)
+		__field(uint64_t, val2)
+	),
+	TP_fast_assign(
+		__assign_str(string1, string1);
+		__assign_str(string2, string2);
+		__entry->val1 = val1;
+		__entry->val2 = val2;
+	),
+	TP_printk(
+		"%s: %s val1=%llu val2=%llu",
+			__get_str(string1), __get_str(string2),
+			__entry->val1, __entry->val2
+	)
+);
+
+TRACE_EVENT(cam_log_debug,
+	TP_PROTO(const char *fmt, va_list *args),
+	TP_ARGS(fmt, args),
+	TP_STRUCT__entry(
+		__dynamic_array(char, msg, CAM_TRACE_PRINT_MAX_LEN)
+	),
+	TP_fast_assign(
+		va_list ap;
+
+		va_copy(ap, *args);
+		vsnprintf(__get_dynamic_array(msg), CAM_TRACE_PRINT_MAX_LEN, fmt, ap);
+		va_end(ap);
+	),
+	TP_printk("%s", __get_str(msg))
+);
+
+
+TRACE_EVENT(cam_icp_fw_dbg,
+	TP_PROTO(char *dbg_message, uint64_t timestamp, char *dev_name),
+	TP_ARGS(dbg_message, timestamp, dev_name),
+	TP_STRUCT__entry(
+		__string(dbg_message, dbg_message)
+		__field(uint64_t, timestamp)
+		__string(dev_name, dev_name)
+	),
+	TP_fast_assign(
+		__assign_str(dbg_message, dbg_message);
+		__entry->timestamp = timestamp;
+		__assign_str(dev_name, dev_name);
+	),
+	TP_printk(
+		"[%s] %llu %s: ",
+		__get_str(dev_name), __entry->timestamp, __get_str(dbg_message)
+	)
+);
+
+TRACE_EVENT(cam_buf_done,
+	TP_PROTO(const char *ctx_type, struct cam_context *ctx,
+		struct cam_ctx_request *req),
+	TP_ARGS(ctx_type, ctx, req),
+	TP_STRUCT__entry(
+		__string(ctx_type, ctx_type)
+		__field(void*, ctx)
+		__field(int32_t, link_hdl)
+		__field(uint64_t, request)
+	),
+	TP_fast_assign(
+		__assign_str(ctx_type, ctx_type);
+		__entry->ctx = ctx;
+		__entry->link_hdl = ctx->link_hdl;
+		__entry->request = req->request_id;
+	),
+	TP_printk(
+		"%5s: BufDone ctx=%p request=%llu link_hdl=0x%x",
+			__get_str(ctx_type), __entry->ctx, __entry->request, __entry->link_hdl
+	)
+);
+
+TRACE_EVENT(cam_apply_req,
+	TP_PROTO(const char *entity, uint32_t id, uint64_t req_id,int32_t link_hdl),
+	TP_ARGS(entity, id, req_id, link_hdl),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint32_t, id)
+		__field(uint64_t, req_id)
+		__field(int32_t, link_hdl)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->id = id;
+		__entry->req_id = req_id;
+		__entry->link_hdl = link_hdl;
+	),
+	TP_printk(
+		"%8s: ApplyRequest id=%u request=%llu link_hdl=0x%x",
+			__get_str(entity), __entry->id, __entry->req_id, __entry->link_hdl
+	)
+);
+
+TRACE_EVENT(cam_notify_frame_skip,
+	TP_PROTO(const char *entity, uint64_t req_id),
+	TP_ARGS(entity, req_id),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint64_t, req_id)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->req_id = req_id;
+	),
+	TP_printk(
+		"%8s: NotifyFrameSkip request=%llu",
+			__get_str(entity), __entry->req_id
+	)
+);
+
+TRACE_EVENT(cam_flush_req,
+	TP_PROTO(struct cam_req_mgr_core_link *link,
+		struct cam_req_mgr_flush_info *info),
+	TP_ARGS(link, info),
+	TP_STRUCT__entry(
+		__field(uint32_t, type)
+		__field(int64_t, req_id)
+		__field(void*, link)
+		__field(void*, session)
+	),
+	TP_fast_assign(
+		__entry->type    = info->flush_type;
+		__entry->req_id  = info->req_id;
+		__entry->link    = link;
+		__entry->session = link->parent;
+	),
+	TP_printk(
+		"FlushRequest type=%u request=%llu link=%pK session=%pK",
+			__entry->type, __entry->req_id, __entry->link,
+			__entry->session
+	)
+);
+
+TRACE_EVENT(cam_req_mgr_connect_device,
+	TP_PROTO(struct cam_req_mgr_core_link *link,
+		struct cam_req_mgr_device_info *info),
+	TP_ARGS(link, info),
+	TP_STRUCT__entry(
+		__string(name, info->name)
+		__field(uint32_t, id)
+		__field(uint32_t, delay)
+		__field(void*, link)
+		__field(void*, session)
+	),
+	TP_fast_assign(
+		__assign_str(name, info->name);
+		__entry->id      = info->dev_id;
+		__entry->delay   = info->p_delay;
+		__entry->link    = link;
+		__entry->session = link->parent;
+	),
+	TP_printk(
+		"ReqMgr Connect name=%s id=%u pd=%d link=%pK session=%pK",
+			__get_str(name), __entry->id, __entry->delay,
+			__entry->link, __entry->session
+	)
+);
+
+TRACE_EVENT(cam_req_mgr_apply_request,
+	TP_PROTO(struct cam_req_mgr_core_link *link,
+		struct cam_req_mgr_apply_request *req,
+		struct cam_req_mgr_connected_device *dev),
+	TP_ARGS(link, req, dev),
+	TP_STRUCT__entry(
+		__string(name, dev->dev_info.name)
+		__field(uint32_t, dev_id)
+		__field(uint64_t, req_id)
+		__field(int32_t, link_hdl)
+		__field(void*, link)
+		__field(void*, session)
+	),
+	TP_fast_assign(
+		__assign_str(name, dev->dev_info.name);
+		__entry->dev_id  = dev->dev_info.dev_id;
+		__entry->req_id  = req->request_id;
+		__entry->link    = link;
+		__entry->session = link->parent;
+		__entry->link_hdl = req->link_hdl;
+	),
+	TP_printk(
+		"ReqMgr ApplyRequest devname=%s devid=%u request=%lld link=%pK session=%pK link_hdl=0x%x",
+			__get_str(name), __entry->dev_id, __entry->req_id,
+			__entry->link, __entry->session, __entry->link_hdl
+	)
+);
+
+TRACE_EVENT(cam_req_mgr_add_req,
+	TP_PROTO(struct cam_req_mgr_core_link *link,
+		int idx, struct cam_req_mgr_add_request *add_req,
+		struct cam_req_mgr_req_tbl *tbl,
+		struct cam_req_mgr_connected_device *dev),
+	TP_ARGS(link, idx, add_req, tbl, dev),
+	TP_STRUCT__entry(
+		__string(name, dev->dev_info.name)
+		__field(uint32_t, dev_id)
+		__field(uint64_t, req_id)
+		__field(uint32_t, slot_id)
+		__field(uint32_t, delay)
+		__field(uint32_t, readymap)
+		__field(uint32_t, devicemap)
+		__field(void*, link)
+		__field(void*, session)
+		__field(int32_t, link_hdl)
+	),
+	TP_fast_assign(
+		__assign_str(name, dev->dev_info.name);
+		__entry->dev_id    = dev->dev_info.dev_id;
+		__entry->req_id    = add_req->req_id;
+		__entry->slot_id   = idx;
+		__entry->delay     = tbl->pd;
+		__entry->readymap  = tbl->slot[idx].req_ready_map;
+		__entry->devicemap = tbl->dev_mask;
+		__entry->link      = link;
+		__entry->link_hdl  = link->link_hdl;
+		__entry->session   = link->parent;
+	),
+	TP_printk(
+		"ReqMgr AddRequest devname=%s devid=%d request=%lld slot=%d pd=%d readymap=%x devicemap=%d link=%pK session=%pK link_hdl=0x%x",
+			__get_str(name), __entry->dev_id, __entry->req_id,
+			__entry->slot_id, __entry->delay, __entry->readymap,
+			__entry->devicemap, __entry->link, __entry->session,
+			__entry->link_hdl
+	)
+);
+
+TRACE_EVENT(cam_delay_detect,
+	TP_PROTO(const char *entity,
+		const char *text, uint64_t req_id,
+		uint32_t ctx_id, int32_t link_hdl,
+		int32_t session_hdl, int rc),
+	TP_ARGS(entity, text, req_id, ctx_id,
+		link_hdl, session_hdl, rc),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__string(text, text)
+		__field(uint64_t, req_id)
+		__field(uint64_t, ctx_id)
+		__field(int32_t, link_hdl)
+		__field(int32_t, session_hdl)
+		__field(int32_t, rc)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__assign_str(text, text);
+		__entry->req_id      = req_id;
+		__entry->ctx_id      = ctx_id;
+		__entry->link_hdl    = link_hdl;
+		__entry->session_hdl = session_hdl;
+		__entry->rc          = rc;
+	),
+	TP_printk(
+		"%s: %s request=%lld ctx_id=%d link_hdl=0x%x session_hdl=0x%x rc=%d",
+			__get_str(entity), __get_str(text), __entry->req_id,
+			__entry->ctx_id, __entry->link_hdl,
+			__entry->session_hdl, __entry->rc
+	)
+);
+
+TRACE_EVENT(cam_submit_to_hw,
+	TP_PROTO(const char *entity, uint64_t req_id),
+	TP_ARGS(entity, req_id),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint64_t, req_id)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->req_id = req_id;
+	),
+	TP_printk(
+		"%8s: submit request=%llu",
+			__get_str(entity), __entry->req_id
+	)
+);
+
+TRACE_EVENT(cam_irq_activated,
+	TP_PROTO(const char *entity, uint32_t irq_type),
+	TP_ARGS(entity, irq_type),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint32_t, irq_type)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->irq_type = irq_type;
+	),
+	TP_printk(
+		"%8s: got irq type=%d",
+			__get_str(entity), __entry->irq_type
+	)
+);
+
+TRACE_EVENT(cam_irq_handled,
+	TP_PROTO(const char *entity, uint32_t irq_type),
+	TP_ARGS(entity, irq_type),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint32_t, irq_type)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->irq_type = irq_type;
+	),
+	TP_printk(
+		"%8s: handled irq type=%d",
+			__get_str(entity), __entry->irq_type
+	)
+);
+
+TRACE_EVENT(cam_cdm_cb,
+	TP_PROTO(const char *entity, uint32_t status),
+	TP_ARGS(entity, status),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint32_t, status)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->status = status;
+	),
+	TP_printk(
+		"%8s: cdm cb status=%d",
+			__get_str(entity), __entry->status
+	)
+);
+
+TRACE_EVENT(cam_cci_burst,
+	TP_PROTO(const int32_t idx, int32_t m,
+		int32_t q, const char *msg,
+		uint32_t val),
+	TP_ARGS(idx, m, q, msg, val),
+	TP_STRUCT__entry(
+		__field(int32_t, index)
+		__field(int32_t, master)
+		__field(int32_t, queue)
+		__string(msg, msg)
+		__field(uint32_t, value)
+	),
+	TP_fast_assign(
+		__entry->index = idx;
+		__entry->master = m;
+		__entry->queue = q;
+		__assign_str(msg, msg);
+		__entry->value = val;
+	),
+	TP_printk(
+		"CCI%d_M%d_Q%d %s : 0x%x",
+		__entry->index, __entry->master, __entry->queue, __get_str(msg), __entry->value
+	)
+);
+
+#endif /* _CAM_TRACE_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/camera_main.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/camera_main.c
@@ -0,0 +1,334 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/module.h>
+#include <linux/build_bug.h>
+
+#include "cam_req_mgr_dev.h"
+#include "cam_sync_api.h"
+#include "cam_smmu_api.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cdm_intf_api.h"
+
+#include "cam_ife_csid_dev.h"
+#include "cam_vfe.h"
+#include "cam_sfe_dev.h"
+#include "cam_isp_dev.h"
+
+#include "cam_res_mgr_api.h"
+#include "cam_cci_dev.h"
+#include "cam_sensor_dev.h"
+#include "cam_actuator_dev.h"
+#include "cam_csiphy_dev.h"
+#include "cam_eeprom_dev.h"
+#include "cam_ois_dev.h"
+#include "cam_tpg_dev.h"
+#include "cam_flash_dev.h"
+
+#include "cam_icp_v1_dev.h"
+#include "cam_icp_v2_dev.h"
+#include "ipe_core.h"
+#include "bps_core.h"
+#include "ofe_core.h"
+#include "cam_icp_subdev.h"
+
+#include "jpeg_dma_core.h"
+#include "jpeg_enc_core.h"
+#include "cam_jpeg_dev.h"
+
+#include "cre_core.h"
+#include "cam_cre_dev.h"
+
+#include "cam_fd_hw_intf.h"
+#include "cam_fd_dev.h"
+
+#include "cam_lrme_hw_intf.h"
+#include "cam_lrme_dev.h"
+
+#include "cam_custom_dev.h"
+#include "cam_custom_csid_dev.h"
+#include "cam_custom_sub_mod_dev.h"
+
+#include "cam_debug_util.h"
+
+#include "ope_dev_intf.h"
+#include "cre_dev_intf.h"
+
+#include "cam_tfe_dev.h"
+#include "cam_tfe_csid.h"
+#include "cam_csid_ppi100.h"
+#include "camera_main.h"
+
+#ifdef CONFIG_CAM_PRESIL
+extern int cam_presil_framework_dev_init_from_main(void);
+extern void cam_presil_framework_dev_exit_from_main(void);
+#endif
+
+struct camera_submodule_component {
+	int (*init)(void);
+	void (*exit)(void);
+};
+
+struct camera_submodule {
+	char *name;
+	uint num_component;
+	const struct camera_submodule_component *component;
+};
+
+static const struct camera_submodule_component camera_base[] = {
+    {.init = &cam_req_mgr_init, .exit = &cam_req_mgr_exit},
+    {.init = &cam_sync_init, .exit = &cam_sync_exit},
+    {.init = &cam_smmu_init_module, .exit = &cam_smmu_exit_module},
+    {.init = &cam_cpas_dev_init_module, .exit = &cam_cpas_dev_exit_module},
+    {.init = &cam_cdm_intf_init_module, .exit = &cam_cdm_intf_exit_module},
+    {.init = &cam_hw_cdm_init_module, .exit = &cam_hw_cdm_exit_module},
+};
+
+static const struct camera_submodule_component camera_tfe[] = {
+#ifdef CONFIG_SPECTRA_TFE
+	{.init = &cam_csid_ppi100_init_module, .exit = &cam_csid_ppi100_exit_module},
+	{.init = &cam_tfe_init_module, .exit = &cam_tfe_exit_module},
+	{.init = &cam_tfe_csid_init_module, .exit = &cam_tfe_csid_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_isp[] = {
+#ifdef CONFIG_SPECTRA_ISP
+	{.init = &cam_ife_csid_init_module, .exit = &cam_ife_csid_exit_module},
+	{.init = &cam_ife_csid_lite_init_module, .exit = &cam_ife_csid_lite_exit_module},
+	{.init = &cam_vfe_init_module, .exit = &cam_vfe_exit_module},
+	{.init = &cam_sfe_init_module, .exit = &cam_sfe_exit_module},
+	{.init = &cam_isp_dev_init_module, .exit = &cam_isp_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_sensor[] = {
+#ifdef CONFIG_SPECTRA_SENSOR
+	{.init = &cam_res_mgr_init, .exit = &cam_res_mgr_exit},
+	{.init = &cam_cci_init_module, .exit = &cam_cci_exit_module},
+	{.init = &cam_csiphy_init_module, .exit = &cam_csiphy_exit_module},
+	{.init = &cam_tpg_init_module, .exit = &cam_tpg_exit_module},
+	{.init = &cam_actuator_driver_init, .exit = &cam_actuator_driver_exit},
+	{.init = &cam_sensor_driver_init, .exit = &cam_sensor_driver_exit},
+	{.init = &cam_eeprom_driver_init, .exit = &cam_eeprom_driver_exit},
+	{.init = &cam_ois_driver_init, .exit = &cam_ois_driver_exit},
+	{.init = &cam_flash_init_module, .exit = &cam_flash_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_icp[] = {
+#ifdef CONFIG_SPECTRA_ICP
+	{.init = &cam_icp_v1_init_module, .exit = &cam_icp_v1_exit_module},
+	{.init = &cam_icp_v2_init_module, .exit = &cam_icp_v2_exit_module},
+	{.init = &cam_ipe_init_module, .exit = &cam_ipe_exit_module},
+	{.init = &cam_bps_init_module, .exit = &cam_bps_exit_module},
+	{.init = &cam_ofe_init_module, .exit = &cam_ofe_exit_module},
+	{.init = &cam_icp_init_module, .exit = &cam_icp_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_ope[] = {
+#ifdef CONFIG_SPECTRA_OPE
+	{.init = &cam_ope_init_module, .exit = &cam_ope_exit_module},
+	{.init = &cam_ope_subdev_init_module, .exit = &cam_ope_subdev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_cre[] = {
+#ifdef CONFIG_SPECTRA_CRE
+	{.init = &cam_cre_init_module, .exit = &cam_cre_exit_module},
+	{.init = &cam_cre_subdev_init_module, .exit = &cam_cre_subdev_exit_module},
+#endif
+};
+static const struct camera_submodule_component camera_jpeg[] = {
+#ifdef CONFIG_SPECTRA_JPEG
+	{.init = &cam_jpeg_enc_init_module, .exit = &cam_jpeg_enc_exit_module},
+	{.init = &cam_jpeg_dma_init_module, .exit = &cam_jpeg_dma_exit_module},
+	{.init = &cam_jpeg_dev_init_module, .exit = &cam_jpeg_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_fd[] = {
+#ifdef CONFIG_SPECTRA_FD
+	{.init = &cam_fd_hw_init_module, .exit = &cam_fd_hw_exit_module},
+	{.init = &cam_fd_dev_init_module, .exit = &cam_fd_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_lrme[] = {
+#ifdef CONFIG_SPECTRA_LRME
+	{.init = &cam_lrme_hw_init_module, .exit = &cam_lrme_hw_exit_module},
+	{.init = &cam_lrme_dev_init_module, .exit = &cam_lrme_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_custom[] = {
+#ifdef CONFIG_SPECTRA_CUSTOM
+	{.init = &cam_custom_hw_sub_module_init, .exit = &cam_custom_hw_sub_module_exit},
+	{.init = &cam_custom_csid_driver_init, .exit = &cam_custom_csid_driver_exit},
+	{.init = &cam_custom_dev_init_module, .exit = &cam_custom_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_presil[] = {
+#ifdef CONFIG_CAM_PRESIL
+	{.init = &cam_presil_framework_dev_init_from_main,
+	 .exit = &cam_presil_framework_dev_exit_from_main},
+#endif
+};
+
+static const struct camera_submodule submodule_table[] = {
+	{
+		.name = "Camera BASE",
+		.num_component = ARRAY_SIZE(camera_base),
+		.component = camera_base,
+	},
+	{
+		.name = "Camera TFE",
+		.num_component = ARRAY_SIZE(camera_tfe),
+		.component = camera_tfe,
+	},
+	{
+		.name = "Camera ISP",
+		.num_component = ARRAY_SIZE(camera_isp),
+		.component = camera_isp,
+	},
+	{
+		.name = "Camera SENSOR",
+		.num_component = ARRAY_SIZE(camera_sensor),
+		.component = camera_sensor
+	},
+	{
+		.name = "Camera ICP",
+		.num_component = ARRAY_SIZE(camera_icp),
+		.component = camera_icp,
+	},
+	{
+		.name = "Camera OPE",
+		.num_component = ARRAY_SIZE(camera_ope),
+		.component = camera_ope,
+	},
+	{
+		.name = "Camera JPEG",
+		.num_component = ARRAY_SIZE(camera_jpeg),
+		.component = camera_jpeg,
+	},
+	{
+		.name = "Camera FD",
+		.num_component = ARRAY_SIZE(camera_fd),
+		.component = camera_fd,
+	},
+	{
+		.name = "Camera LRME",
+		.num_component = ARRAY_SIZE(camera_lrme),
+		.component = camera_lrme,
+	},
+	{
+		.name = "Camera CRE",
+		.num_component = ARRAY_SIZE(camera_cre),
+		.component = camera_cre,
+	},
+	{
+		.name = "Camera CUSTOM",
+		.num_component = ARRAY_SIZE(camera_custom),
+		.component = camera_custom,
+	},
+	{
+		.name = "Camera Presil",
+		.num_component = ARRAY_SIZE(camera_presil),
+		.component = camera_presil,
+	}
+};
+
+static int camera_verify_submodules(void)
+{
+	int rc = 0;
+	int i, j, num_components;
+
+	for (i = 0; i < ARRAY_SIZE(submodule_table); i++) {
+		num_components = submodule_table[i].num_component;
+		for (j = 0; j < num_components; j++) {
+			if (!submodule_table[i].component[j].init ||
+				!submodule_table[i].component[j].exit) {
+				CAM_ERR(CAM_UTIL,
+					"%s module has init = %ps, exit = %ps",
+					submodule_table[i].name,
+					submodule_table[i].component[j].init,
+					submodule_table[i].component[j].exit);
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+	}
+
+end:
+	return rc;
+}
+
+static void __camera_exit(int i, int j)
+{
+	uint num_exits;
+
+	/* Exit from current submodule */
+	for (j -= 1; j >= 0; j--)
+		submodule_table[i].component[j].exit();
+
+	/* Exit remaining submodules */
+	for (i -= 1; i >= 0; i--) {
+		num_exits = submodule_table[i].num_component;
+		for (j = num_exits - 1; j >= 0; j--)
+			submodule_table[i].component[j].exit();
+	}
+}
+
+static int camera_init(void)
+{
+	int rc;
+	uint i, j, num_inits;
+
+	rc = camera_verify_submodules();
+	if (rc)
+		goto end_init;
+
+	cam_debugfs_init();
+
+	/* For Probing all available submodules */
+	for (i = 0; i < ARRAY_SIZE(submodule_table); i++) {
+		num_inits = submodule_table[i].num_component;
+		CAM_DBG(CAM_UTIL, "Number of %s components: %u",
+			submodule_table[i].name, num_inits);
+		for (j = 0; j < num_inits; j++) {
+			rc = submodule_table[i].component[j].init();
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"%s module failure at %ps rc = %d",
+					submodule_table[i].name,
+					submodule_table[i].component[j].init,
+					rc);
+				__camera_exit(i, j);
+				goto end_init;
+			}
+		}
+	}
+
+	CAM_DBG(CAM_UTIL, "Camera initcalls done");
+
+end_init:
+	return rc;
+}
+
+static void camera_exit(void)
+{
+	__camera_exit(ARRAY_SIZE(submodule_table), 0);
+	cam_debugfs_deinit();
+
+	CAM_INFO(CAM_UTIL, "Spectra camera driver exited!");
+}
+
+module_init(camera_init);
+module_exit(camera_exit);
+
+MODULE_DESCRIPTION("Spectra camera driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/drivers/camera_main.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/drivers/camera_main.h
@@ -0,0 +1,169 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAMERA_MAIN_H
+#define CAMERA_MAIN_H
+
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/component.h>
+
+extern struct platform_driver cam_sync_driver;
+extern struct platform_driver cam_smmu_driver;
+extern struct platform_driver cam_cpas_driver;
+extern struct platform_driver cam_cdm_intf_driver;
+extern struct platform_driver cam_hw_cdm_driver;
+#ifdef CONFIG_SPECTRA_ISP
+extern struct platform_driver cam_ife_csid_driver;
+extern struct platform_driver cam_ife_csid_lite_driver;
+extern struct platform_driver cam_vfe_driver;
+extern struct platform_driver cam_sfe_driver;
+extern struct platform_driver isp_driver;
+#endif
+#ifdef CONFIG_SPECTRA_TFE
+extern struct platform_driver cam_csid_ppi100_driver;
+extern struct platform_driver cam_tfe_driver;
+extern struct platform_driver cam_tfe_csid_driver;
+#endif
+#ifdef CONFIG_SPECTRA_SENSOR
+extern struct platform_driver cam_res_mgr_driver;
+extern struct platform_driver cci_driver;
+extern struct platform_driver csiphy_driver;
+extern struct platform_driver cam_actuator_platform_driver;
+extern struct platform_driver cam_sensor_platform_driver;
+extern struct platform_driver cam_eeprom_platform_driver;
+extern struct platform_driver cam_ois_platform_driver;
+extern struct platform_driver cam_tpg_driver;
+extern struct i2c_driver cam_actuator_i2c_driver;
+extern struct i2c_driver cam_flash_i2c_driver;
+extern struct i2c_driver cam_ois_i2c_driver;
+extern struct i2c_driver cam_eeprom_i2c_driver;
+extern struct i2c_driver cam_sensor_i2c_driver;
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2) || \
+	IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+extern struct platform_driver cam_flash_platform_driver;
+#endif
+#endif
+#ifdef CONFIG_SPECTRA_ICP
+extern struct platform_driver cam_icp_v1_driver;
+extern struct platform_driver cam_icp_v2_driver;
+extern struct platform_driver cam_ipe_driver;
+extern struct platform_driver cam_bps_driver;
+extern struct platform_driver cam_ofe_driver;
+extern struct platform_driver cam_icp_driver;
+#endif
+#ifdef CONFIG_SPECTRA_OPE
+extern struct platform_driver cam_ope_driver;
+extern struct platform_driver cam_ope_subdev_driver;
+#endif
+#ifdef CONFIG_SPECTRA_CRE
+extern struct platform_driver cam_cre_driver;
+extern struct platform_driver cam_cre_subdev_driver;
+#endif
+#ifdef CONFIG_SPECTRA_JPEG
+extern struct platform_driver cam_jpeg_enc_driver;
+extern struct platform_driver cam_jpeg_dma_driver;
+extern struct platform_driver jpeg_driver;
+#endif
+#ifdef CONFIG_SPECTRA_FD
+extern struct platform_driver cam_fd_hw_driver;
+extern struct platform_driver cam_fd_driver;
+#endif
+#ifdef CONFIG_SPECTRA_LRME
+extern struct platform_driver cam_lrme_hw_driver;
+extern struct platform_driver cam_lrme_driver;
+#endif
+#ifdef CONFIG_SPECTRA_CUSTOM
+extern struct platform_driver cam_custom_hw_sub_mod_driver;
+extern struct platform_driver cam_custom_csid_driver;
+extern struct platform_driver custom_driver;
+#endif
+
+/*
+ * Drivers to be bound by component framework in this order with
+ * CRM as master
+ */
+static struct platform_driver *const cam_component_platform_drivers[] = {
+/* BASE */
+	&cam_sync_driver,
+	&cam_smmu_driver,
+	&cam_cpas_driver,
+	&cam_cdm_intf_driver,
+	&cam_hw_cdm_driver,
+#ifdef CONFIG_SPECTRA_TFE
+	&cam_csid_ppi100_driver,
+	&cam_tfe_driver,
+	&cam_tfe_csid_driver,
+#endif
+#ifdef CONFIG_SPECTRA_ISP
+	&cam_ife_csid_driver,
+	&cam_ife_csid_lite_driver,
+	&cam_vfe_driver,
+	&cam_sfe_driver,
+	&isp_driver,
+#endif
+#ifdef CONFIG_SPECTRA_SENSOR
+	&cam_res_mgr_driver,
+	&cci_driver,
+	&csiphy_driver,
+	&cam_actuator_platform_driver,
+	&cam_sensor_platform_driver,
+	&cam_eeprom_platform_driver,
+	&cam_ois_platform_driver,
+	&cam_tpg_driver,
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2) || \
+	IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+	&cam_flash_platform_driver,
+#endif
+#endif
+#ifdef CONFIG_SPECTRA_ICP
+	&cam_icp_v1_driver,
+	&cam_icp_v2_driver,
+	&cam_ipe_driver,
+	&cam_bps_driver,
+	&cam_ofe_driver,
+	&cam_icp_driver,
+#endif
+#ifdef CONFIG_SPECTRA_OPE
+	&cam_ope_driver,
+	&cam_ope_subdev_driver,
+#endif
+#ifdef CONFIG_SPECTRA_JPEG
+	&cam_jpeg_enc_driver,
+	&cam_jpeg_dma_driver,
+	&jpeg_driver,
+#endif
+#ifdef CONFIG_SPECTRA_CRE
+	&cam_cre_driver,
+	&cam_cre_subdev_driver,
+#endif
+#ifdef CONFIG_SPECTRA_FD
+	&cam_fd_hw_driver,
+	&cam_fd_driver,
+#endif
+#ifdef CONFIG_SPECTRA_LRME
+	&cam_lrme_hw_driver,
+	&cam_lrme_driver,
+#endif
+#ifdef CONFIG_SPECTRA_CUSTOM
+	&cam_custom_hw_sub_mod_driver,
+	&cam_custom_csid_driver,
+	&custom_driver,
+#endif
+};
+
+
+static struct i2c_driver *const cam_component_i2c_drivers[] = {
+#ifdef CONFIG_SPECTRA_SENSOR
+	&cam_actuator_i2c_driver,
+	&cam_flash_i2c_driver,
+	&cam_ois_i2c_driver,
+	&cam_eeprom_i2c_driver,
+	&cam_sensor_i2c_driver,
+#endif
+};
+
+#endif /* CAMERA_MAIN_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/dt-bindings/msm-camera.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/dt-bindings/msm-camera.h
@@ -0,0 +1,156 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __MSM_CAMERA_H
+#define __MSM_CAMERA_H
+
+/* CPAS path data types */
+#define CAM_CPAS_PATH_DATA_IFE_START_OFFSET 0
+#define CAM_CPAS_PATH_DATA_IFE_LINEAR (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_IFE_VID (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_IFE_DISP (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_IFE_STATS (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_IFE_RDI0 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_IFE_RDI1 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_IFE_RDI2 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_IFE_RDI3 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 7)
+#define CAM_CPAS_PATH_DATA_IFE_PDAF (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 8)
+#define CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW \
+	(CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 9)
+#define CAM_CPAS_PATH_DATA_IFE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_IPE_START_OFFSET 32
+#define CAM_CPAS_PATH_DATA_IPE_RD_IN (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_IPE_RD_REF (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_IPE_WR_VID (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_IPE_WR_DISP (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_IPE_WR_REF (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_IPE_WR_APP (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_IPE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_OPE_START_OFFSET 64
+#define CAM_CPAS_PATH_DATA_OPE_RD_IN (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_OPE_RD_REF (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_OPE_WR_VID (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_OPE_WR_DISP (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_OPE_WR_REF (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_OPE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_SFE_START_OFFSET 96
+#define CAM_CPAS_PATH_DATA_SFE_NRDI    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_SFE_RDI0    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_SFE_RDI1    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_SFE_RDI2    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_SFE_RDI3    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_SFE_RDI4    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_SFE_STATS   (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_SFE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_CRE_START_OFFSET    (CAM_CPAS_PATH_DATA_SFE_MAX_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_CRE_RD_IN           (CAM_CPAS_PATH_DATA_CRE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_CRE_WR_OUT          (CAM_CPAS_PATH_DATA_CRE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_CRE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_CRE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_OFE_START_OFFSET (CAM_CPAS_PATH_DATA_CRE_MAX_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_OFE_RD_EXT       (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_OFE_RD_INT_PDI   (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_OFE_RD_INT_HDR   (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_OFE_WR_VID       (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_OFE_WR_DISP      (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_OFE_WR_IR        (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_OFE_WR_HDR_LTM   (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_OFE_WR_DC4       (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 7)
+#define CAM_CPAS_PATH_DATA_OFE_WR_AI        (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 8)
+#define CAM_CPAS_PATH_DATA_OFE_WR_PDI       (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 9)
+#define CAM_CPAS_PATH_DATA_OFE_WR_IDEALRAW  (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 10)
+#define CAM_CPAS_PATH_DATA_OFE_WR_STATS     (CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 11)
+#define CAM_CPAS_PATH_DATA_OFE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_OFE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_CONSO_OFFSET 256
+#define CAM_CPAS_PATH_DATA_ALL (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 0)
+
+/* IFE consolidated paths */
+#define CAM_CPAS_PATH_DATA_IFE_LINEAR_PDAF (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_IFE_UBWC_STATS (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_IFE_PIXEL_ALL (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_IFE_RDI_ALL (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_IFE_UBWC (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_IFE_LINEAR_STATS (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 7)
+#define CAM_CPAS_PATH_DATA_IFE_UBWC_LINEAR (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 8)
+#define CAM_CPAS_PATH_DATA_IFE_PDAF_LINEAR (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 9)
+
+/* IPE Consolidated paths */
+#define CAM_CPAS_PATH_DATA_IPE_WR_VID_DISP (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 1)
+
+/* CPAS transaction types */
+#define CAM_CPAS_TRANSACTION_READ 0
+#define CAM_CPAS_TRANSACTION_WRITE 1
+
+/* CPAS traffic merge types */
+#define CAM_CPAS_TRAFFIC_MERGE_SUM 0
+#define CAM_CPAS_TRAFFIC_MERGE_SUM_INTERLEAVE 1
+
+/* Feature bit type */
+#define CAM_CPAS_FEATURE_TYPE_DISABLE 0
+#define CAM_CPAS_FEATURE_TYPE_ENABLE 1
+#define CAM_CPAS_FEATURE_TYPE_VALUE 2
+
+/* Feature support bit positions in feature fuse register*/
+#define CAM_CPAS_QCFA_BINNING_ENABLE 0
+#define CAM_CPAS_SECURE_CAMERA_ENABLE 1
+#define CAM_CPAS_MF_HDR_ENABLE 2
+#define CAM_CPAS_MP_LIMIT_FUSE 3
+#define CAM_CPAS_ISP_FUSE      4
+#define CAM_CPAS_ISP_PIX_FUSE  5
+#define CAM_CPAS_ISP_LITE_FUSE 6
+#define CAM_CPAS_CSIPHY_FUSE   7
+#define CAM_CPAS_IPE_VID_OUT_8BPP_LIMIT_ENABLE 8
+#define CAM_CPAS_SFE_FUSE 9
+#define CAM_CPAS_CUSTOM_FUSE 10
+#define CAM_CPAS_CAM_FUSE 11
+#define CAM_CPAS_SHDR_FUSE 12
+#define CAM_CPAS_FUSE_FEATURE_MAX 13
+
+#define CCI_MASTER_0         0
+#define CCI_MASTER_1         1
+#define CCI_MASTER_MAX       2
+
+/* AON Camera IDs*/
+#define AON_CAM1             0
+#define AON_CAM2             1
+#define MAX_AON_CAM          2
+#define NOT_AON_CAM          255
+
+/* Camera DRV enable masks */
+#define CAM_DDR_DRV    0x1
+#define CAM_CLK_DRV    0x2
+
+/* Port index for BW voting */
+#define CAM_CPAS_PORT_HLOS_DRV    0
+#define CAM_CPAS_PORT_DRV_0       1
+#define CAM_CPAS_PORT_DRV_1       2
+#define CAM_CPAS_PORT_DRV_2       3
+#define CAM_CPAS_PORT_DRV_DYN     32
+
+/* Domain ID types */
+#define CAM_CPAS_NON_SECURE_DOMAIN  0
+#define CAM_CPAS_SECURE_DOMAIN      1
+
+/* Debug bypass driver */
+#define CAM_BYPASS_RGLTR      0x1
+#define CAM_BYPASS_RGLTR_MODE 0x2
+#define CAM_BYPASS_CLKS       0x4
+#define CAM_BYPASS_CESTA      0x8
+#define CAM_BYPASS_ICC        0x10
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_cpas.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_cpas.h
@@ -0,0 +1,294 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_CPAS_H__
+#define __UAPI_CAM_CPAS_H__
+
+#include <media/cam_defs.h>
+
+#define CAM_FAMILY_CAMERA_SS     1
+#define CAM_FAMILY_CPAS_SS       2
+
+/* AXI BW Voting Version */
+#define CAM_AXI_BW_VOTING_V2                2
+
+/* AXI BW Voting Transaction Type */
+#define CAM_AXI_TRANSACTION_READ            0
+#define CAM_AXI_TRANSACTION_WRITE           1
+
+/* AXI BW Voting Path Data Type */
+#define CAM_AXI_PATH_DATA_IFE_START_OFFSET 0
+#define CAM_AXI_PATH_DATA_IFE_LINEAR    (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_IFE_VID       (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_IFE_DISP      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 2)
+#define CAM_AXI_PATH_DATA_IFE_STATS     (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 3)
+#define CAM_AXI_PATH_DATA_IFE_RDI0      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 4)
+#define CAM_AXI_PATH_DATA_IFE_RDI1      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 5)
+#define CAM_AXI_PATH_DATA_IFE_RDI2      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 6)
+#define CAM_AXI_PATH_DATA_IFE_RDI3      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 7)
+#define CAM_AXI_PATH_DATA_IFE_PDAF      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 8)
+#define CAM_AXI_PATH_DATA_IFE_PIXEL_RAW \
+	(CAM_AXI_PATH_DATA_IFE_START_OFFSET + 9)
+#define CAM_AXI_PATH_DATA_IFE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_IFE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_IPE_START_OFFSET 32
+#define CAM_AXI_PATH_DATA_IPE_RD_IN     (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_IPE_RD_REF    (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_IPE_WR_VID    (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 2)
+#define CAM_AXI_PATH_DATA_IPE_WR_DISP   (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 3)
+#define CAM_AXI_PATH_DATA_IPE_WR_REF    (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 4)
+#define CAM_AXI_PATH_DATA_IPE_WR_APP    (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 5)
+#define CAM_AXI_PATH_DATA_IPE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_IPE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_OPE_START_OFFSET 64
+#define CAM_AXI_PATH_DATA_OPE_RD_IN     (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_OPE_RD_REF    (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_OPE_WR_VID    (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 2)
+#define CAM_AXI_PATH_DATA_OPE_WR_DISP   (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 3)
+#define CAM_AXI_PATH_DATA_OPE_WR_REF    (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 4)
+#define CAM_AXI_PATH_DATA_OPE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_OPE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_SFE_START_OFFSET 96
+#define CAM_AXI_PATH_DATA_SFE_NRDI      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_SFE_RDI0      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_SFE_RDI1      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 2)
+#define CAM_AXI_PATH_DATA_SFE_RDI2      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 3)
+#define CAM_AXI_PATH_DATA_SFE_RDI3      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 4)
+#define CAM_AXI_PATH_DATA_SFE_RDI4      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 5)
+#define CAM_AXI_PATH_DATA_SFE_STATS     (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 6)
+#define CAM_AXI_PATH_DATA_SFE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_SFE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_CRE_START_OFFSET    (CAM_AXI_PATH_DATA_SFE_MAX_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_CRE_RD_IN           (CAM_AXI_PATH_DATA_CRE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_CRE_WR_OUT          (CAM_AXI_PATH_DATA_CRE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_CRE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_CRE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_OFE_START_OFFSET    (CAM_AXI_PATH_DATA_CRE_MAX_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_OFE_RD_EXT          (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_OFE_RD_INT_PDI      (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_OFE_RD_INT_HDR      (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 2)
+#define CAM_AXI_PATH_DATA_OFE_WR_VID          (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 3)
+#define CAM_AXI_PATH_DATA_OFE_WR_DISP         (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 4)
+#define CAM_AXI_PATH_DATA_OFE_WR_IR           (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 5)
+#define CAM_AXI_PATH_DATA_OFE_WR_HDR_LTM      (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 6)
+#define CAM_AXI_PATH_DATA_OFE_WR_DC4          (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 7)
+#define CAM_AXI_PATH_DATA_OFE_WR_AI           (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 8)
+#define CAM_AXI_PATH_DATA_OFE_WR_PDI          (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 9)
+#define CAM_AXI_PATH_DATA_OFE_WR_IDEALRAW     (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 10)
+#define CAM_AXI_PATH_DATA_OFE_WR_STATS        (CAM_AXI_PATH_DATA_OFE_START_OFFSET + 11)
+#define CAM_AXI_PATH_DATA_OFE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_OFE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_ALL  256
+#define CAM_CPAS_FUSES_MAX     32
+#define CAM_CPAS_DOMAIN_ID_MAX 5
+
+/* DRV Vote level */
+#define CAM_CPAS_VOTE_LEVEL_HIGH   1
+#define CAM_CPAS_VOTE_LEVEL_LOW    2
+
+/* Domain id types */
+#define CAM_CPAS_NON_SECURE_DOMAIN  0
+#define CAM_CPAS_SECURE_DOMAIN      1
+
+/* sysfs entry of camera subparts info */
+#define CAM_SYSFS_SUBPARTS_INFO_FILENAME "subparts_info"
+
+/**
+ * struct cam_cpas_fuse_value - CPAS fuse value
+ *
+ * @fuse_id     : Camera fuse identification
+ * @fuse_val    : Camera Fuse Value
+ */
+struct cam_cpas_fuse_value {
+	__u32 fuse_id;
+	__u32 fuse_val;
+};
+
+/**
+ * struct cam_cpas_fuse_info - CPAS fuse info
+ *
+ * @num_fuses     : Number of fuses
+ * @fuse_val      : Array of different fuse info.
+ */
+struct cam_cpas_fuse_info {
+	__u32  num_fuses;
+	struct cam_cpas_fuse_value fuse_val[CAM_CPAS_FUSES_MAX];
+};
+
+/**
+ * struct cam_cpas_domain_id_pairing - CPAS domain id mapping
+ *
+ * @domain_type    : Domain type
+ * @mapping_id     : ID of domain type
+ */
+struct cam_cpas_domain_id_pairing {
+	__u32 domain_type;
+	__u32 mapping_id;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[4];
+};
+
+/**
+ * struct cam_cpas_domain_id_caps - CPAS domain id info
+ *
+ * @is_supported      : If domain id is supported on target
+ * @num_mapping       : Number of domain id types supported, if any
+ * @entries           : Stores mapping between domain type and its ID
+ * @num_valid_params  : Number of valid params
+ * @valid_param_mask  : Valid param mask
+ * @params            : These fields are reserved for future extensions
+ *                      to this structure.
+ */
+struct cam_cpas_domain_id_caps {
+	__u32  is_supported;
+	__u32  num_mapping;
+	struct cam_cpas_domain_id_pairing entries[CAM_CPAS_DOMAIN_ID_MAX];
+	__u32  num_valid_params;
+	__u32  valid_param_mask;
+	__u32  params[6];
+};
+
+
+/**
+ * struct cam_cpas_query_cap - CPAS query device capability payload
+ *
+ * @camera_family     : Camera family type
+ * @reserved          : Reserved field for alignment
+ * @camera_version    : Camera platform version
+ * @cpas_version      : Camera CPAS version within camera platform
+ *
+ */
+struct cam_cpas_query_cap {
+	__u32                 camera_family;
+	__u32                 reserved;
+	struct cam_hw_version camera_version;
+	struct cam_hw_version cpas_version;
+};
+
+/**
+ * struct cam_cpas_query_cap - CPAS query device capability payload
+ *
+ * @camera_family     : Camera family type
+ * @reserved          : Reserved field for alignment
+ * @camera_version    : Camera platform version
+ * @cpas_version      : Camera CPAS version within camera platform
+ * @fuse_info         : Camera fuse info
+ *
+ */
+struct cam_cpas_query_cap_v2 {
+	__u32                     camera_family;
+	__u32                     reserved;
+	struct cam_hw_version     camera_version;
+	struct cam_hw_version     cpas_version;
+	struct cam_cpas_fuse_info fuse_info;
+};
+
+/**
+ * struct cam_cpas_query_cap - CPAS query device capability payload
+ *
+ * @version           : Struct version
+ * @camera_family     : Camera family type
+ * @camera_caps       : Camera capability
+ * @camera_version    : Camera platform version
+ * @cpas_version      : Camera CPAS version within camera platform
+ * @fuse_info         : Camera fuse info
+ * @domain_id_info    : Domain id info
+ * @num_valid_params  : Number of valid params
+ * @valid_param_mask  : Valid param mask
+ * @params            : Reserved fields to make this query cap
+ *                      extendable in the future
+ */
+struct cam_cpas_query_cap_v3 {
+	__u32                             version;
+	__u32                             camera_family;
+	__u32                             camera_caps;
+	struct cam_hw_version             camera_version;
+	struct cam_hw_version             cpas_version;
+	struct cam_cpas_fuse_info         fuse_info;
+	struct cam_cpas_domain_id_caps    domain_id_info;
+	__u32                             num_valid_params;
+	__u32                             valid_param_mask;
+	__u32                             params[10];
+};
+
+/**
+ * struct cam_axi_per_path_bw_vote_v2 - Per path bandwidth vote information
+ *
+ * @usage_data:              client usage data (left/right/rdi)
+ * @transac_type:            Transaction type on the path (read/write)
+ * @path_data_type:          Path for which vote is given (video, display, rdi)
+ * @vote_level:              Vote level for this path
+ * @camnoc_bw:               CAMNOC bw for this path
+ * @mnoc_ab_bw:              MNOC AB bw for this path
+ * @mnoc_ib_bw:              MNOC IB bw for this path
+ * @ddr_ab_bw:               DDR AB bw for this path
+ * @ddr_ib_bw:               DDR IB bw for this path
+ * @num_valid_params:        Number of valid params
+ * @valid_param_mask:        Valid param mask
+ * @params:                  params
+ */
+struct cam_axi_per_path_bw_vote_v2 {
+	__u32                      usage_data;
+	__u32                      transac_type;
+	__u32                      path_data_type;
+	__u32                      vote_level;
+	__u64                      camnoc_bw;
+	__u64                      mnoc_ab_bw;
+	__u64                      mnoc_ib_bw;
+	__u64                      ddr_ab_bw;
+	__u64                      ddr_ib_bw;
+	__u32                      num_valid_params;
+	__u32                      valid_param_mask;
+	__u32                      params[4];
+};
+
+/**
+ * struct cam_axi_per_path_bw_vote - Per path bandwidth vote information
+ *
+ * @usage_data               client usage data (left/right/rdi)
+ * @transac_type             Transaction type on the path (read/write)
+ * @path_data_type           Path for which vote is given (video, display, rdi)
+ * @reserved                 Reserved for alignment
+ * @camnoc_bw                CAMNOC bw for this path
+ * @mnoc_ab_bw               MNOC AB bw for this path
+ * @mnoc_ib_bw               MNOC IB bw for this path
+ * @ddr_ab_bw                DDR AB bw for this path
+ * @ddr_ib_bw                DDR IB bw for this path
+ */
+struct cam_axi_per_path_bw_vote {
+	__u32                      usage_data;
+	__u32                      transac_type;
+	__u32                      path_data_type;
+	__u32                      reserved;
+	__u64                      camnoc_bw;
+	__u64                      mnoc_ab_bw;
+	__u64                      mnoc_ib_bw;
+	__u64                      ddr_ab_bw;
+	__u64                      ddr_ib_bw;
+};
+
+#define CAM_CPAS_CUSTOM_CMD_FD_PORT_CFG 0
+
+/**
+ * struct cam_cpas_fd_port_config : CPAS custom cmd struct for updating FD
+ *                                  port config
+ *
+ * @is_secure                Security mode of the FD port
+ * @reserved                 Reserved for alignment
+ */
+struct cam_cpas_fd_port_config {
+	__u32 is_secure;
+	__u32 reserved;
+};
+
+#endif /* __UAPI_CAM_CPAS_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_cre.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_cre.h
@@ -0,0 +1,140 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_CRE_H__
+#define __UAPI_CAM_CRE_H__
+
+#include <media/cam_defs.h>
+#include <media/cam_cpas.h>
+
+#define CAM_CRE_DEV_NAME_SIZE     128
+
+/* CRE HW TYPE */
+#define CAM_CRE_HW_TYPE_CRE       0x1
+#define CAM_CRE_HW_TYPE_MAX       0x1
+
+/* packet opcode types */
+#define CAM_CRE_OPCODE_CONFIG     0x1
+
+/* input port resource type */
+#define CAM_CRE_INPUT_IMAGE       0x1
+#define CAM_CRE_INPUT_IMAGES_MAX  (CAM_CRE_INPUT_IMAGE + 1)
+
+/* output port resource type */
+#define CAM_CRE_OUTPUT_IMAGE      0x1
+#define CAM_CRE_OUTPUT_IMAGES_MAX (CAM_CRE_OUTPUT_IMAGE + 1)
+
+#define CAM_CRE_MAX_PLANES        0x2
+#define CRE_MAX_BATCH_SIZE        0x10
+
+/* definitions needed for cre aquire device */
+#define CAM_CRE_DEV_TYPE_NRT      0x1
+#define CAM_CRE_DEV_TYPE_RT       0x2
+#define CAM_CRE_DEV_TYPE_MAX      0x3
+
+#define CAM_CRE_CMD_META_GENERIC_BLOB     0x1
+/* Clock blob */
+#define CAM_CRE_CMD_GENERIC_BLOB_CLK_V2   0x1
+
+/**
+ * struct cam_cre_hw_ver - Device information for particular hw type
+ *
+ * This is used to get device version info of CRE
+ * from hardware and use this info in CAM_QUERY_CAP IOCTL
+ *
+ * @hw_ver:    Major, minor and incr values of a device version
+ */
+struct cam_cre_hw_ver {
+	struct cam_hw_version hw_ver;
+};
+
+/**
+ * struct cam_cre_query_cap_cmd - CRE query device capability payload
+ *
+ * @dev_iommu_handle: CRE iommu handles for secure/non secure modes
+ * @num_dev:          Number of cre
+ * @reserved:         Reserved field
+ * @dev_ver:          Returned device capability array
+ */
+struct cam_cre_query_cap_cmd {
+	struct cam_iommu_handle dev_iommu_handle;
+	__u32                   num_dev;
+	__u32                   reserved;
+	struct cam_cre_hw_ver   dev_ver[CAM_CRE_HW_TYPE_MAX];
+};
+
+/**
+ * struct cam_cre_io_buf_info - CRE IO buffers meta
+ *
+ * @direction:     Direction of a buffer of a port(Input/Output)
+ * @res_id:        Resource ID
+ * @num_planes:    Number of planes
+ * @width:         Height of a plane buffer
+ * @height:        Height of a plane buffer
+ * @stride:        Plane stride
+ * @format:        unpacker format for FE, packer format for WE
+ * @alignment:     Alignment
+ * @reserved:      Reserved field 0
+ */
+struct cam_cre_io_buf_info {
+	__u32 direction;
+	__u32 res_id;
+	__u32 num_planes;
+	__u32 width;
+	__u32 height;
+	__u32 stride;
+	__u32 fence;
+	__u32 format;
+	__u32 alignment;
+	__u32 reserved;
+};
+
+/**
+ * struct cam_cre_acquire_dev_info - An CRE device info
+ *
+ * @dev_type:      NRT/RT Acquire
+ * @dev_name:      Device name (CRE)
+ * @secure_mode:   Tells if CRE will process the secure buff or not.
+ * @batch_size:    Batch size
+ * @num_in_res:    Number of In resources
+ * @num_out_res:   Number of Out resources
+ * @reserved:      Reserved field 0
+ * @in_res:        In resource info
+ * @in_res:        Out resource info
+ */
+struct cam_cre_acquire_dev_info {
+	char                       dev_name[CAM_CRE_DEV_NAME_SIZE];
+	__u32                      dev_type;
+	__u32                      secure_mode;
+	__u32                      batch_size;
+	__u32                      num_in_res;
+	__u32                      num_out_res;
+	__u32                      reserved;
+	struct cam_cre_io_buf_info in_res[CAM_CRE_INPUT_IMAGES_MAX];
+	struct cam_cre_io_buf_info out_res[CAM_CRE_OUTPUT_IMAGES_MAX];
+}__attribute__((__packed__));
+
+/**
+ * struct cre_clk_bw_request_v2
+ *
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @reserved:      Reserved field 0
+ * @num_path:      Number of AXI Paths
+ */
+struct cre_clk_bw_request_v2 {
+	__u64  budget_ns;
+	__u32  frame_cycles;
+	__u32  rt_flag;
+	__u32  reserved;
+	__u32  num_paths;
+	union {
+		struct cam_axi_per_path_bw_vote axi_path[1];
+		__DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+	};
+};
+#endif /* __UAPI_CAM_CRE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_custom.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_custom.h
@@ -0,0 +1,219 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_CUSTOM_H__
+#define __UAPI_CAM_CUSTOM_H__
+
+#include <media/cam_defs.h>
+
+/* Custom driver name */
+#define CAM_CUSTOM_DEV_NAME                    "cam-custom"
+
+#define CAM_CUSTOM_NUM_SUB_DEVICES             2
+
+/* HW type */
+#define CAM_CUSTOM_HW1                         0
+#define CAM_CUSTOM_HW2                         1
+
+/* output path resource id's */
+#define CAM_CUSTOM_OUT_RES_UDI_0               1
+#define CAM_CUSTOM_OUT_RES_UDI_1               2
+#define CAM_CUSTOM_OUT_RES_UDI_2               3
+
+/* input resource for custom hw */
+#define CAM_CUSTOM_IN_RES_UDI_0                1
+
+/* Resource ID */
+#define CAM_CUSTOM_RES_ID_PORT                 0
+
+/* Packet opcode for Custom */
+#define CAM_CUSTOM_PACKET_OP_BASE              0
+#define CAM_CUSTOM_PACKET_INIT_DEV             1
+#define CAM_CUSTOM_PACKET_UPDATE_DEV           2
+#define CAM_CUSTOM_PACKET_OP_MAX               3
+
+/* max number of vc-dt cfg for a given input */
+#define CAM_CUSTOM_VC_DT_CFG_MAX               4
+
+/* phy input resource types */
+#define CAM_CUSTOM_IN_RES_BASE                0x5000
+#define CAM_CUSTOM_IN_RES_PHY_0               (CAM_CUSTOM_IN_RES_BASE + 1)
+#define CAM_CUSTOM_IN_RES_PHY_1               (CAM_CUSTOM_IN_RES_BASE + 2)
+#define CAM_CUSTOM_IN_RES_PHY_2               (CAM_CUSTOM_IN_RES_BASE + 3)
+#define CAM_CUSTOM_IN_RES_PHY_3               (CAM_CUSTOM_IN_RES_BASE + 4)
+
+/* Query devices */
+/**
+ * struct cam_custom_dev_cap_info - A cap info for particular hw type
+ *
+ * @hw_type:            Custom HW type
+ * @hw_version:         Hardware version
+ *
+ */
+struct cam_custom_dev_cap_info {
+	__u32              hw_type;
+	__u32              hw_version;
+};
+
+/**
+ * struct cam_custom_query_cap_cmd - Custom HW query device capability payload
+ *
+ * @device_iommu:               returned iommu handles for device
+ * @cdm_iommu:                  returned iommu handles for cdm
+ * @num_dev:                    returned number of device capabilities
+ * @reserved:                   reserved field for alignment
+ * @dev_caps:                   returned device capability array
+ *
+ */
+struct cam_custom_query_cap_cmd {
+	struct cam_iommu_handle        device_iommu;
+	struct cam_iommu_handle        cdm_iommu;
+	__s32                          num_dev;
+	__u32                          reserved;
+	struct cam_custom_dev_cap_info dev_caps[CAM_CUSTOM_NUM_SUB_DEVICES];
+};
+
+/* Acquire Device */
+/**
+ * struct cam_custom_out_port_info - An output port resource info
+ *
+ * @res_type:              output resource type
+ * @format:                output format of the resource
+ * @custom_info 1-3:       custom params
+ * @reserved:              reserved field for alignment
+ *
+ */
+struct cam_custom_out_port_info {
+	__u32                res_type;
+	__u32                format;
+	__u32                custom_info1;
+	__u32                custom_info2;
+	__u32                custom_info3;
+	__u32                reserved;
+};
+
+/**
+ * struct cam_custom_in_port_info - An input port resource info
+ *
+ * @res_type:                   input resource type
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @num_valid_vc_dt:            number of valid vc-dt
+ * @format:                     input format
+ * @test_pattern:               test pattern for the testgen
+ * @usage_type:                 whether dual vfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_stop:                  left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ * @right_stop:                 right input stop offset in pixels.
+ * @right_width:                right input width in pixels.
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @pixel_clk;                  sensor output clock
+ * @num_out_byte:               number of valid output bytes per cycle
+ * @custom_info1:               custom_info1
+ * @custom_info2:               custom info 2
+ * @num_out_res:                number of the output resource associated
+ * @data:                       payload that contains the output resources
+ *
+ */
+struct cam_custom_in_port_info {
+	__u32                           res_type;
+	__u32                           lane_type;
+	__u32                           lane_num;
+	__u32                           lane_cfg;
+	__u32                           vc[CAM_CUSTOM_VC_DT_CFG_MAX];
+	__u32                           dt[CAM_CUSTOM_VC_DT_CFG_MAX];
+	__u32                           num_valid_vc_dt;
+	__u32                           format;
+	__u32                           test_pattern;
+	__u32                           usage_type;
+	__u32                           left_start;
+	__u32                           left_stop;
+	__u32                           left_width;
+	__u32                           right_start;
+	__u32                           right_stop;
+	__u32                           right_width;
+	__u32                           line_start;
+	__u32                           line_stop;
+	__u32                           height;
+	__u32                           pixel_clk;
+	__u32                           num_bytes_out;
+	__u32                           custom_info1;
+	__u32                           custom_info2;
+	__u32                           num_out_res;
+	union {
+		struct cam_custom_out_port_info data[1];
+		__DECLARE_FLEX_ARRAY(struct cam_custom_out_port_info, data_flex);
+	};
+};
+
+/**
+ * struct cam_custom_resource - A resource bundle
+ *
+ * @resoruce_id:                resource id for the resource bundle
+ * @length:                     length of the while resource blob
+ * @handle_type:                type of the resource handle
+ * @reserved:                   reserved field for alignment
+ * @res_hdl:                    resource handle that points to the
+ *                              resource array;
+ */
+struct cam_custom_resource {
+	__u32                       resource_id;
+	__u32                       length;
+	__u32                       handle_type;
+	__u32                       reserved;
+	__u64                       res_hdl;
+};
+
+/**
+ * struct cam_custom_acquire_hw_info - Custom acquire HW params
+ *
+ * @num_inputs           : Number of inputs
+ * @input_info_size      : Size of input info struct used
+ * @input_info_offset    : Offset of input info from start of data
+ * @reserved             : reserved
+ * @data                 : Start of data region
+ */
+struct cam_custom_acquire_hw_info {
+	__u32                num_inputs;
+	__u32                input_info_size;
+	__u32                input_info_offset;
+	__u32                reserved;
+	__u64                data;
+};
+
+/**
+ * struct cam_custom_cmd_buf_type_1 - cmd buf type 1
+ *
+ * @custom_info:                custom info
+ * @reserved:                   reserved
+ */
+struct cam_custom_cmd_buf_type_1 {
+	__u32                       custom_info;
+	__u32                       reserved;
+};
+
+/**
+ * struct cam_custom_cmd_buf_type_2 - cmd buf type 2
+ *
+ * @custom_info1:               Custom info 1
+ * @custom_info2:               Custom info 2
+ * @custom_info3:               Custom info 3
+ * @reserved:                   reserved
+ */
+struct cam_custom_cmd_buf_type_2 {
+	__u32                       custom_info1;
+	__u32                       custom_info2;
+	__u32                       custom_info3;
+	__u32                       reserved;
+};
+#endif /* __UAPI_CAM_CUSTOM_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_defs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_defs.h
@@ -0,0 +1,1052 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_DEFS_H__
+#define __UAPI_CAM_DEFS_H__
+
+#include <linux/videodev2.h>
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+
+/* camera op codes */
+#define CAM_COMMON_OPCODE_BASE                  0x100
+#define CAM_QUERY_CAP                           (CAM_COMMON_OPCODE_BASE + 0x1)
+#define CAM_ACQUIRE_DEV                         (CAM_COMMON_OPCODE_BASE + 0x2)
+#define CAM_START_DEV                           (CAM_COMMON_OPCODE_BASE + 0x3)
+#define CAM_STOP_DEV                            (CAM_COMMON_OPCODE_BASE + 0x4)
+#define CAM_CONFIG_DEV                          (CAM_COMMON_OPCODE_BASE + 0x5)
+#define CAM_RELEASE_DEV                         (CAM_COMMON_OPCODE_BASE + 0x6)
+#define CAM_SD_SHUTDOWN                         (CAM_COMMON_OPCODE_BASE + 0x7)
+#define CAM_FLUSH_REQ                           (CAM_COMMON_OPCODE_BASE + 0x8)
+#define CAM_QUERY_CAP_V2                        (CAM_COMMON_OPCODE_BASE + 0x9)
+#define CAM_COMMON_OPCODE_MAX                   (CAM_COMMON_OPCODE_BASE + 0xa)
+
+#define CAM_COMMON_OPCODE_BASE_v2           0x150
+#define CAM_ACQUIRE_HW                      (CAM_COMMON_OPCODE_BASE_v2 + 0x1)
+#define CAM_RELEASE_HW                      (CAM_COMMON_OPCODE_BASE_v2 + 0x2)
+#define CAM_DUMP_REQ                        (CAM_COMMON_OPCODE_BASE_v2 + 0x3)
+#define CAM_QUERY_CAP_V3                    (CAM_COMMON_OPCODE_BASE_v2 + 0x4)
+#define CAM_SYNX_TEST_TRIGGER               (CAM_COMMON_OPCODE_BASE_v2 + 0x5)
+#define CAM_CUSTOM_DEV_CONFIG               (CAM_COMMON_OPCODE_BASE_v2 + 0x6)
+#define CAM_UPDATE_SENSOR_STREAM_CONFIG     (CAM_COMMON_OPCODE_BASE_v2 + 0x7)
+
+
+#define CAM_EXT_OPCODE_BASE                     0x200
+#define CAM_CONFIG_DEV_EXTERNAL                 (CAM_EXT_OPCODE_BASE + 0x1)
+
+/* camera handle type */
+#define CAM_HANDLE_USER_POINTER                 1
+#define CAM_HANDLE_MEM_HANDLE                   2
+
+/* Generic Blob CmdBuffer header properties */
+#define CAM_GENERIC_BLOB_CMDBUFFER_SIZE_MASK    0xFFFFFF00
+#define CAM_GENERIC_BLOB_CMDBUFFER_SIZE_SHIFT   8
+#define CAM_GENERIC_BLOB_CMDBUFFER_TYPE_MASK    0xFF
+#define CAM_GENERIC_BLOB_CMDBUFFER_TYPE_SHIFT   0
+
+/* Command Buffer Types */
+#define CAM_CMD_BUF_DMI                     0x1
+#define CAM_CMD_BUF_DMI16                   0x2
+#define CAM_CMD_BUF_DMI32                   0x3
+#define CAM_CMD_BUF_DMI64                   0x4
+#define CAM_CMD_BUF_DIRECT                  0x5
+#define CAM_CMD_BUF_INDIRECT                0x6
+#define CAM_CMD_BUF_I2C                     0x7
+#define CAM_CMD_BUF_FW                      0x8
+#define CAM_CMD_BUF_GENERIC                 0x9
+#define CAM_CMD_BUF_LEGACY                  0xA
+
+/* UBWC API Version */
+#define CAM_UBWC_CFG_VERSION_1              1
+#define CAM_UBWC_CFG_VERSION_2              2
+
+#define CAM_MAX_ACQ_RES    5
+#define CAM_MAX_HW_SPLIT   3
+
+
+/**
+ * enum flush_type_t - Identifies the various flush types
+ *
+ * @CAM_FLUSH_TYPE_REQ:    Flush specific request
+ * @CAM_FLUSH_TYPE_ALL:    Flush all requests belonging to a context
+ * @CAM_FLUSH_TYPE_MAX:    Max enum to validate flush type
+ *
+ */
+enum flush_type_t {
+	CAM_FLUSH_TYPE_REQ,
+	CAM_FLUSH_TYPE_ALL,
+	CAM_FLUSH_TYPE_MAX
+};
+
+/**
+ * struct cam_control - Structure used by ioctl control for camera
+ *
+ * @op_code:            This is the op code for camera control
+ * @size:               Control command size
+ * @handle_type:        User pointer or shared memory handle
+ * @reserved:           Reserved field for 64 bit alignment
+ * @handle:             Control command payload
+ */
+struct cam_control {
+	__u32        op_code;
+	__u32        size;
+	__u32        handle_type;
+	__u32        reserved;
+	__u64        handle;
+};
+
+/**
+ * struct cam_custom_cmd - Structure used by ioctl control for camera
+ *                         devices to send custom commands.
+ *
+ * @cmd_type:           Command type
+ * @size:               Size of the data
+ * @handle:             Pointer to the command data
+ */
+struct cam_custom_cmd {
+	__u32        cmd_type;
+	__u32        size;
+	__u64        handle;
+};
+
+/* camera IOCTL */
+#define VIDIOC_CAM_CONTROL \
+	_IOWR('V', BASE_VIDIOC_PRIVATE, struct cam_control)
+
+/**
+ * struct cam_hw_version - Structure for HW version of camera devices
+ *
+ * @major    : Hardware version major
+ * @minor    : Hardware version minor
+ * @incr     : Hardware version increment
+ * @reserved : Reserved for 64 bit aligngment
+ */
+struct cam_hw_version {
+	__u32 major;
+	__u32 minor;
+	__u32 incr;
+	__u32 reserved;
+};
+
+/**
+ * struct cam_iommu_handle - Structure for IOMMU handles of camera hw devices
+ *
+ * @non_secure: Device Non Secure IOMMU handle
+ * @secure:     Device Secure IOMMU handle
+ *
+ */
+struct cam_iommu_handle {
+	__s32 non_secure;
+	__s32 secure;
+};
+
+/* camera secure mode */
+#define CAM_SECURE_MODE_NON_SECURE             0
+#define CAM_SECURE_MODE_SECURE                 1
+
+/* Camera Format Type */
+#define CAM_FORMAT_BASE                         0
+#define CAM_FORMAT_MIPI_RAW_6                   1
+#define CAM_FORMAT_MIPI_RAW_8                   2
+#define CAM_FORMAT_MIPI_RAW_10                  3
+#define CAM_FORMAT_MIPI_RAW_12                  4
+#define CAM_FORMAT_MIPI_RAW_14                  5
+#define CAM_FORMAT_MIPI_RAW_16                  6
+#define CAM_FORMAT_MIPI_RAW_20                  7
+#define CAM_FORMAT_QTI_RAW_8                    8
+#define CAM_FORMAT_QTI_RAW_10                   9
+#define CAM_FORMAT_QTI_RAW_12                   10
+#define CAM_FORMAT_QTI_RAW_14                   11
+#define CAM_FORMAT_PLAIN8                       12
+#define CAM_FORMAT_PLAIN16_8                    13
+#define CAM_FORMAT_PLAIN16_10                   14
+#define CAM_FORMAT_PLAIN16_12                   15
+#define CAM_FORMAT_PLAIN16_14                   16
+#define CAM_FORMAT_PLAIN16_16                   17
+#define CAM_FORMAT_PLAIN32_20                   18
+#define CAM_FORMAT_PLAIN64                      19
+#define CAM_FORMAT_PLAIN128                     20
+#define CAM_FORMAT_ARGB                         21
+#define CAM_FORMAT_ARGB_10                      22
+#define CAM_FORMAT_ARGB_12                      23
+#define CAM_FORMAT_ARGB_14                      24
+#define CAM_FORMAT_DPCM_10_6_10                 25
+#define CAM_FORMAT_DPCM_10_8_10                 26
+#define CAM_FORMAT_DPCM_12_6_12                 27
+#define CAM_FORMAT_DPCM_12_8_12                 28
+#define CAM_FORMAT_DPCM_14_8_14                 29
+#define CAM_FORMAT_DPCM_14_10_14                30
+#define CAM_FORMAT_NV21                         31
+#define CAM_FORMAT_NV12                         32
+#define CAM_FORMAT_TP10                         33
+#define CAM_FORMAT_YUV422                       34
+#define CAM_FORMAT_PD8                          35
+#define CAM_FORMAT_PD10                         36
+#define CAM_FORMAT_UBWC_NV12                    37
+#define CAM_FORMAT_UBWC_NV12_4R                 38
+#define CAM_FORMAT_UBWC_TP10                    39
+#define CAM_FORMAT_UBWC_P010                    40
+#define CAM_FORMAT_PLAIN8_SWAP                  41
+#define CAM_FORMAT_PLAIN8_10                    42
+#define CAM_FORMAT_PLAIN8_10_SWAP               43
+#define CAM_FORMAT_YV12                         44
+#define CAM_FORMAT_Y_ONLY                       45
+#define CAM_FORMAT_DPCM_12_10_12                46
+#define CAM_FORMAT_PLAIN32                      47
+#define CAM_FORMAT_ARGB_16                      48
+#define CAM_FORMAT_PLAIN16_10_LSB               49
+#define CAM_FORMAT_YUV422_10                    50
+#define CAM_FORMAT_GBR_UBWC_TP10                51
+#define CAM_FORMAT_GBR_TP10                     52
+#define CAM_FORMAT_UBWC_P016                    53
+#define CAM_FORMAT_BAYER_UBWC_TP10              54
+
+/* This macro is deprecated and no longer needed */
+#define CAM_FORMAT_MAX                          51
+
+/* Pixel Patterns */
+#define PIXEL_PATTERN_RGRGRG                    0x0
+#define PIXEL_PATTERN_GRGRGR                    0x1
+#define PIXEL_PATTERN_BGBGBG                    0x2
+#define PIXEL_PATTERN_GBGBGB                    0x3
+#define PIXEL_PATTERN_YCBYCR                    0x4
+#define PIXEL_PATTERN_YCRYCB                    0x5
+#define PIXEL_PATTERN_CBYCRY                    0x6
+#define PIXEL_PATTERN_CRYCBY                    0x7
+
+/* camera rotaion */
+#define CAM_ROTATE_CW_0_DEGREE                  0
+#define CAM_ROTATE_CW_90_DEGREE                 1
+#define CAM_RORATE_CW_180_DEGREE                2
+#define CAM_ROTATE_CW_270_DEGREE                3
+
+/* camera Color Space */
+#define CAM_COLOR_SPACE_BASE                    0
+#define CAM_COLOR_SPACE_BT601_FULL              1
+#define CAM_COLOR_SPACE_BT601625                2
+#define CAM_COLOR_SPACE_BT601525                3
+#define CAM_COLOR_SPACE_BT709                   4
+#define CAM_COLOR_SPACE_DEPTH                   5
+#define CAM_COLOR_SPACE_MAX                     6
+
+/* camera buffer direction */
+#define CAM_BUF_INPUT                           1
+#define CAM_BUF_OUTPUT                          2
+#define CAM_BUF_IN_OUT                          3
+
+/* camera packet device Type */
+#define CAM_PACKET_DEV_BASE                     0
+#define CAM_PACKET_DEV_IMG_SENSOR               1
+#define CAM_PACKET_DEV_ACTUATOR                 2
+#define CAM_PACKET_DEV_COMPANION                3
+#define CAM_PACKET_DEV_EEPOM                    4
+#define CAM_PACKET_DEV_CSIPHY                   5
+#define CAM_PACKET_DEV_OIS                      6
+#define CAM_PACKET_DEV_FLASH                    7
+#define CAM_PACKET_DEV_FD                       8
+#define CAM_PACKET_DEV_JPEG_ENC                 9
+#define CAM_PACKET_DEV_JPEG_DEC                 10
+#define CAM_PACKET_DEV_VFE                      11
+#define CAM_PACKET_DEV_CPP                      12
+#define CAM_PACKET_DEV_CSID                     13
+#define CAM_PACKET_DEV_ISPIF                    14
+#define CAM_PACKET_DEV_IFE                      15
+#define CAM_PACKET_DEV_ICP                      16
+#define CAM_PACKET_DEV_LRME                     17
+#define CAM_PACKET_DEV_TFE                      18
+#define CAM_PACKET_DEV_OPE                      19
+#define CAM_PACKET_DEV_MAX                      20
+
+/* Register base type */
+#define CAM_REG_DUMP_BASE_TYPE_ISP_LEFT         1
+#define CAM_REG_DUMP_BASE_TYPE_ISP_RIGHT        2
+#define CAM_REG_DUMP_BASE_TYPE_CAMNOC           3
+#define CAM_REG_DUMP_BASE_TYPE_CSID_WRAPPER     4
+#define CAM_REG_DUMP_BASE_TYPE_CSID_LEFT        5
+#define CAM_REG_DUMP_BASE_TYPE_CSID_RIGHT       6
+#define CAM_REG_DUMP_BASE_TYPE_SFE_LEFT         7
+#define CAM_REG_DUMP_BASE_TYPE_SFE_RIGHT        8
+
+/* Register dump read type */
+#define CAM_REG_DUMP_READ_TYPE_CONT_RANGE       1
+#define CAM_REG_DUMP_READ_TYPE_DMI              2
+
+/* Max number of config writes to read from DMI */
+#define CAM_REG_DUMP_DMI_CONFIG_MAX             5
+
+
+/* constants */
+#define CAM_PACKET_MAX_PLANES                   3
+
+/* synx test cmd types */
+#define CAM_SYNX_TEST_CMD_TYPE_CORE_CTRL       1
+#define CAM_SYNX_TEST_CMD_TYPE_SYNX_CMD        2
+
+/**
+ * struct cam_plane_cfg - Plane configuration info
+ *
+ * @width:                      Plane width in pixels
+ * @height:                     Plane height in lines
+ * @plane_stride:               Plane stride in pixel
+ * @slice_height:               Slice height in line (not used by ISP)
+ * @meta_stride:                UBWC metadata stride
+ * @meta_size:                  UBWC metadata plane size
+ * @meta_offset:                UBWC metadata offset
+ * @packer_config:              UBWC packer config
+ * @mode_config:                UBWC mode config
+ * @tile_config:                UBWC tile config
+ * @h_init:                     UBWC horizontal initial coordinate in pixels
+ * @v_init:                     UBWC vertical initial coordinate in lines
+ *
+ */
+struct cam_plane_cfg {
+	__u32                width;
+	__u32                height;
+	__u32                plane_stride;
+	__u32                slice_height;
+	__u32                meta_stride;
+	__u32                meta_size;
+	__u32                meta_offset;
+	__u32                packer_config;
+	__u32                mode_config;
+	__u32                tile_config;
+	__u32                h_init;
+	__u32                v_init;
+};
+
+/**
+ * struct cam_ubwc_plane_cfg_v1 - UBWC Plane configuration info
+ *
+ * @port_type:                  Port Type
+ * @meta_stride:                UBWC metadata stride
+ * @meta_size:                  UBWC metadata plane size
+ * @meta_offset:                UBWC metadata offset
+ * @packer_config:              UBWC packer config
+ * @mode_config_0:              UBWC mode config 0
+ * @mode_config_1:              UBWC 3 mode config 1
+ * @tile_config:                UBWC tile config
+ * @h_init:                     UBWC horizontal initial coordinate in pixels
+ * @v_init:                     UBWC vertical initial coordinate in lines
+ *
+ */
+struct cam_ubwc_plane_cfg_v1 {
+	__u32                port_type;
+	__u32                meta_stride;
+	__u32                meta_size;
+	__u32                meta_offset;
+	__u32                packer_config;
+	__u32                mode_config_0;
+	__u32                mode_config_1;
+	__u32                tile_config;
+	__u32                h_init;
+	__u32                v_init;
+};
+
+/**
+ * struct cam_ubwc_plane_cfg_v2 - UBWC Plane configuration info
+ *
+ * @port_type:                  Port Type
+ * @meta_stride:                UBWC metadata stride
+ * @meta_size:                  UBWC metadata plane size
+ * @meta_offset:                UBWC metadata offset
+ * @packer_config:              UBWC packer config
+ * @mode_config:                UBWC mode config
+ * @static ctrl:                UBWC static ctrl
+ * @ctrl_2:                     UBWC ctrl 2
+ * @tile_config:                UBWC tile config
+ * @h_init:                     UBWC horizontal initial coordinate in pixels
+ * @v_init:                     UBWC vertical initial coordinate in lines
+ * @stats_ctrl_2:               UBWC stats control
+ * @lossy_threshold0            UBWC lossy threshold 0
+ * @lossy_threshold1            UBWC lossy threshold 1
+ * @lossy_var_offset            UBWC offset variance thrshold
+ * @bandwidth_limit:            BW counter limit
+ *                              BW limiter config skipped if value is 0xFFFF or more
+ *                              If skipped here, use generic BW limiter blob to
+ *                              configure the appropriate value.
+ *
+ */
+struct cam_ubwc_plane_cfg_v2 {
+	__u32                port_type;
+	__u32                meta_stride;
+	__u32                meta_size;
+	__u32                meta_offset;
+	__u32                packer_config;
+	__u32                mode_config_0;
+	__u32                mode_config_1;
+	__u32                tile_config;
+	__u32                h_init;
+	__u32                v_init;
+	__u32                static_ctrl;
+	__u32                ctrl_2;
+	__u32                stats_ctrl_2;
+	__u32                lossy_threshold_0;
+	__u32                lossy_threshold_1;
+	__u32                lossy_var_offset;
+	__u32                bandwidth_limit;
+	__u32                reserved[3];
+};
+/**
+ * struct cam_cmd_buf_desc - Command buffer descriptor
+ *
+ * @mem_handle:                 Command buffer handle
+ * @offset:                     Command start offset
+ * @size:                       Size of the command buffer in bytes
+ * @length:                     Used memory in command buffer in bytes
+ * @type:                       Type of the command buffer
+ * @meta_data:                  Data type for private command buffer
+ *                              Between UMD and KMD
+ *
+ */
+struct cam_cmd_buf_desc {
+	__s32                mem_handle;
+	__u32                offset;
+	__u32                size;
+	__u32                length;
+	__u32                type;
+	__u32                meta_data;
+};
+
+/**
+ * struct cam_buf_io_cfg - Buffer io configuration for buffers
+ *
+ * @mem_handle:                 Mem_handle array for the buffers.
+ * @offsets:                    Offsets for each planes in the buffer
+ * @planes:                     Per plane information
+ * @width:                      Main plane width in pixel
+ * @height:                     Main plane height in lines
+ * @format:                     Format of the buffer
+ * @color_space:                Color space for the buffer
+ * @color_pattern:              Color pattern in the buffer
+ * @bpp:                        Bit per pixel
+ * @rotation:                   Rotation information for the buffer
+ * @resource_type:              Resource type associated with the buffer
+ * @fence:                      Fence handle
+ * @early_fence:                Fence handle for early signal
+ * @aux_cmd_buf:                An auxiliary command buffer that may be
+ *                              used for programming the IO
+ * @direction:                  Direction of the config
+ * @batch_size:                 Batch size in HFR mode
+ * @subsample_pattern:          Subsample pattern. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @subsample_period:           Subsample period. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @framedrop_pattern:          Framedrop pattern
+ * @framedrop_period:           Framedrop period
+ * @flag:                       Flags for extra information
+ *                              for acquired version 3--> corresponds to context_id
+ * @direction:                  Buffer direction: input or output
+ * @padding:                    Padding for the structure
+ *
+ */
+struct cam_buf_io_cfg {
+	__s32                   mem_handle[CAM_PACKET_MAX_PLANES];
+	__u32                   offsets[CAM_PACKET_MAX_PLANES];
+	struct cam_plane_cfg    planes[CAM_PACKET_MAX_PLANES];
+	__u32                   format;
+	__u32                   color_space;
+	__u32                   color_pattern;
+	__u32                   bpp;
+	__u32                   rotation;
+	__u32                   resource_type;
+	__s32                   fence;
+	__s32                   early_fence;
+	struct cam_cmd_buf_desc aux_cmd_buf;
+	__u32                   direction;
+	__u32                   batch_size;
+	__u32                   subsample_pattern;
+	__u32                   subsample_period;
+	__u32                   framedrop_pattern;
+	__u32                   framedrop_period;
+	__u32                   flag;
+	__u32                   padding;
+};
+
+/**
+ * struct cam_packet_header - Camera packet header
+ *
+ * @op_code:                    Camera packet opcode
+ * @size:                       Size of the camera packet in bytes
+ * @request_id:                 Request id for this camera packet
+ * @flags:                      Flags for the camera packet
+ * @padding:                    Padding
+ *
+ */
+struct cam_packet_header {
+	__u32                op_code;
+	__u32                size;
+	__u64                request_id;
+	__u32                flags;
+	__u32                padding;
+};
+
+/**
+ * struct cam_patch_desc - Patch structure
+ *
+ * @dst_buf_hdl:                Memory handle for the dest buffer
+ * @dst_offset:                 Offset byte in the dest buffer
+ * @src_buf_hdl:                Memory handle for the source buffer
+ * @src_offset:                 Offset byte in the source buffer
+ *
+ */
+struct cam_patch_desc {
+	__s32                dst_buf_hdl;
+	__u32                dst_offset;
+	__s32                src_buf_hdl;
+	__u32                src_offset;
+};
+
+/**
+ * struct cam_packet - Camera packet structure
+ *
+ * @header:                     Camera packet header
+ * @cmd_buf_offset:             Command buffer start offset
+ * @num_cmd_buf:                Number of the command buffer in the packet
+ * @io_config_offset:           Buffer io configuration start offset
+ * @num_io_configs:             Number of the buffer io configurations
+ * @patch_offset:               Patch offset for the patch structure
+ * @num_patches:                Number of the patch structure
+ * @kmd_cmd_buf_index:          Command buffer index which contains extra
+ *                              space for the KMD buffer
+ * @kmd_cmd_buf_offset:         Offset from the beginning of the command
+ *                              buffer for KMD usage.
+ * @payload:                    Camera packet payload
+ *
+ */
+struct cam_packet {
+	struct cam_packet_header     header;
+	__u32                        cmd_buf_offset;
+	__u32                        num_cmd_buf;
+	__u32                        io_configs_offset;
+	__u32                        num_io_configs;
+	__u32                        patch_offset;
+	__u32                        num_patches;
+	__u32                        kmd_cmd_buf_index;
+	__u32                        kmd_cmd_buf_offset;
+	union {
+		__u64                    payload[1];
+		__DECLARE_FLEX_ARRAY(__u64, payload_flex);
+	};
+
+};
+
+/**
+ * struct cam_release_dev_cmd - Control payload for release devices
+ *
+ * @session_handle:             Session handle for the release
+ * @dev_handle:                 Device handle for the release
+ */
+struct cam_release_dev_cmd {
+	__s32                 session_handle;
+	__s32                 dev_handle;
+};
+
+/**
+ * struct cam_start_stop_dev_cmd - Control payload for start/stop device
+ *
+ * @session_handle:             Session handle for the start/stop command
+ * @dev_handle:                 Device handle for the start/stop command
+ *
+ */
+struct cam_start_stop_dev_cmd {
+	__s32                 session_handle;
+	__s32                 dev_handle;
+};
+
+/**
+ * struct cam_config_dev_cmd - Command payload for configure device
+ *
+ * @session_handle:             Session handle for the command
+ * @dev_handle:                 Device handle for the command
+ * @offset:                     Offset byte in the packet handle.
+ * @packet_handle:              Packet memory handle for the actual packet:
+ *                              struct cam_packet.
+ *
+ */
+struct cam_config_dev_cmd {
+	__s32                session_handle;
+	__s32                dev_handle;
+	__u64                offset;
+	__u64                packet_handle;
+};
+
+/**
+ * struct cam_query_cap_cmd - Payload for query device capability
+ *
+ * @size:               Handle size
+ * @handle_type:        User pointer or shared memory handle
+ * @caps_handle:        Device specific query command payload
+ *
+ */
+struct cam_query_cap_cmd {
+	__u32        size;
+	__u32        handle_type;
+	__u64        caps_handle;
+};
+
+/**
+ * struct cam_acquire_dev_cmd - Control payload for acquire devices
+ *
+ * @session_handle:     Session handle for the acquire command
+ * @dev_handle:         Device handle to be returned
+ * @handle_type:        Resource handle type:
+ *                      1 = user pointer, 2 = mem handle
+ * @num_resources:      Number of the resources to be acquired
+ * @resources_hdl:      Resource handle that refers to the actual
+ *                      resource array. Each item in this
+ *                      array is device specific resource structure
+ *
+ */
+struct cam_acquire_dev_cmd {
+	__s32        session_handle;
+	__s32        dev_handle;
+	__u32        handle_type;
+	__u32        num_resources;
+	__u64        resource_hdl;
+};
+
+/*
+ * In old version, while acquiring device the num_resources in
+ * struct cam_acquire_dev_cmd will be a valid value. During ACQUIRE_DEV
+ * KMD driver will return dev_handle as well as associate HW to handle.
+ * If num_resources is set to the constant below, we are using
+ * the new version and we do not acquire HW in ACQUIRE_DEV IOCTL.
+ * ACQUIRE_DEV will only return handle and we should receive
+ * ACQUIRE_HW IOCTL after ACQUIRE_DEV and that is when the HW
+ * is associated with the dev_handle.
+ *
+ * (Data type): __u32
+ */
+#define CAM_API_COMPAT_CONSTANT                   0xFEFEFEFE
+
+#define CAM_ACQUIRE_HW_STRUCT_VERSION_1           1
+#define CAM_ACQUIRE_HW_STRUCT_VERSION_2           2
+
+/**
+ * struct cam_acquire_hw_cmd_v1 - Control payload for acquire HW IOCTL (Ver 1)
+ *
+ * @struct_version:     = CAM_ACQUIRE_HW_STRUCT_VERSION_1 for this struct
+ *                      This value should be the first 32-bits in any structure
+ *                      related to this IOCTL. So that if the struct needs to
+ *                      change, we can first read the starting 32-bits, get the
+ *                      version number and then typecast the data to struct
+ *                      accordingly.
+ * @reserved:           Reserved field for 64-bit alignment
+ * @session_handle:     Session handle for the acquire command
+ * @dev_handle:         Device handle to be returned
+ * @handle_type:        Tells you how to interpret the variable resource_hdl-
+ *                      1 = user pointer, 2 = mem handle
+ * @data_size:          Total size of data contained in memory pointed
+ *                      to by resource_hdl
+ * @resource_hdl:       Resource handle that refers to the actual
+ *                      resource data.
+ */
+struct cam_acquire_hw_cmd_v1 {
+	__u32        struct_version;
+	__u32        reserved;
+	__s32        session_handle;
+	__s32        dev_handle;
+	__u32        handle_type;
+	__u32        data_size;
+	__u64        resource_hdl;
+};
+
+/**
+ * struct cam_acquired_hw_info - Update the acquired hardware info
+ *
+ * @acquired_hw_id:     Acquired hardware mask
+ * @acquired_hw_path:   Acquired path mask for an input
+ *                      if input splits into multiple paths,
+ *                      its updated per hardware
+ * valid_acquired_hw:   Valid num of acquired hardware
+ */
+struct cam_acquired_hw_info {
+	__u32    acquired_hw_id[CAM_MAX_ACQ_RES];
+	__u32    acquired_hw_path[CAM_MAX_ACQ_RES][CAM_MAX_HW_SPLIT];
+	__u32    valid_acquired_hw;
+};
+
+/**
+ * struct cam_acquire_hw_cmd_v2 - Control payload for acquire HW IOCTL (Ver 2)
+ *
+ * @struct_version:     = CAM_ACQUIRE_HW_STRUCT_VERSION_2 for this struct
+ *                      This value should be the first 32-bits in any structure
+ *                      related to this IOCTL. So that if the struct needs to
+ *                      change, we can first read the starting 32-bits, get the
+ *                      version number and then typecast the data to struct
+ *                      accordingly.
+ * @reserved:           Reserved field for 64-bit alignment
+ * @session_handle:     Session handle for the acquire command
+ * @dev_handle:         Device handle to be returned
+ * @handle_type:        Tells you how to interpret the variable resource_hdl-
+ *                      1 = user pointer, 2 = mem handle
+ * @data_size:          Total size of data contained in memory pointed
+ *                      to by resource_hdl
+ * @resource_hdl:       Resource handle that refers to the actual
+ *                      resource data.
+ */
+struct cam_acquire_hw_cmd_v2 {
+	__u32                    struct_version;
+	__u32                    reserved;
+	__s32                    session_handle;
+	__s32                    dev_handle;
+	__u32                    handle_type;
+	__u32                    data_size;
+	__u64                    resource_hdl;
+	struct cam_acquired_hw_info hw_info;
+};
+
+#define CAM_RELEASE_HW_STRUCT_VERSION_1           1
+
+/**
+ * struct cam_release_hw_cmd_v1 - Control payload for release HW IOCTL (Ver 1)
+ *
+ * @struct_version:     = CAM_RELEASE_HW_STRUCT_VERSION_1 for this struct
+ *                      This value should be the first 32-bits in any structure
+ *                      related to this IOCTL. So that if the struct needs to
+ *                      change, we can first read the starting 32-bits, get the
+ *                      version number and then typecast the data to struct
+ *                      accordingly.
+ * @reserved:           Reserved field for 64-bit alignment
+ * @session_handle:     Session handle for the release
+ * @dev_handle:         Device handle for the release
+ */
+struct cam_release_hw_cmd_v1 {
+	__u32                struct_version;
+	__u32                reserved;
+	__s32                session_handle;
+	__s32                dev_handle;
+};
+
+/**
+ * struct cam_flush_dev_cmd - Control payload for flush devices
+ *
+ * @version:           Version
+ * @session_handle:    Session handle for the acquire command
+ * @dev_handle:        Device handle to be returned
+ * @flush_type:        Flush type:
+ *                     0 = flush specific request
+ *                     1 = flush all
+ * @reserved:          Reserved for 64 bit aligngment
+ * @req_id:            Request id that needs to cancel
+ *
+ */
+struct cam_flush_dev_cmd {
+	__u64       version;
+	__s32       session_handle;
+	__s32       dev_handle;
+	__u32       flush_type;
+	__u32       reserved;
+	__s64       req_id;
+};
+
+/**
+ * struct cam_ubwc_config - UBWC Configuration Payload
+ *
+ * @api_version:         UBWC config api version
+ * @num_ports:           Number of ports to be configured
+ * @ubwc_plane_config:   Array of UBWC configurations per port
+ *                       Size [CAM_PACKET_MAX_PLANES - 1] per port
+ *                       as UBWC is supported on Y & C planes
+ *                       and therefore a max size of 2 planes
+ *
+ */
+struct cam_ubwc_config {
+	__u32   api_version;
+	__u32   num_ports;
+	union {
+		struct cam_ubwc_plane_cfg_v1
+			ubwc_plane_cfg[1][CAM_PACKET_MAX_PLANES - 1];
+		struct {
+			struct { } __empty_ubwc_plane_cfg_array_flex;
+			struct cam_ubwc_plane_cfg_v1
+				ubwc_plane_cfg_array_flex[][CAM_PACKET_MAX_PLANES - 1];
+		};
+	};
+};
+
+/**
+ * struct cam_ubwc_config_v2 - UBWC Configuration Payload
+ *
+ * @api_version:         UBWC config api version
+ * @num_ports:           Number of ports to be configured
+ * @ubwc_plane_config:   Array of UBWC configurations per port
+ *                       Size [CAM_PACKET_MAX_PLANES - 1] per port
+ *                       as UBWC is supported on Y & C planes
+ *                       and therefore a max size of 2 planes
+ *
+ */
+struct cam_ubwc_config_v2 {
+	__u32   api_version;
+	__u32   num_ports;
+	union {
+		struct cam_ubwc_plane_cfg_v2
+			ubwc_plane_cfg[1][CAM_PACKET_MAX_PLANES - 1];
+		struct {
+			struct { } __empty_ubwc_plane_cfg_array_flex;
+			struct cam_ubwc_plane_cfg_v2
+				ubwc_plane_cfg_array_flex[][CAM_PACKET_MAX_PLANES - 1];
+		};
+	};
+};
+
+/**
+ * struct cam_cmd_mem_region_info -
+ *              Cmd buffer region info
+ *
+ * @mem_handle : Memory handle of the region
+ * @offset     : Offset if any
+ * @size       : Size of the region
+ * @flags      : Flags if any
+ */
+struct cam_cmd_mem_region_info {
+	__s32 mem_handle;
+	__u32 offset;
+	__u32 size;
+	__u32 flags;
+};
+
+/**
+ * struct cam_cmd_mem_regions -
+ *        List of multiple memory descriptors of
+ *        of different regions
+ *
+ * @version        : Version number
+ * @num_regions    : Number of regions
+ * @map_info_array : Array of all the regions
+ */
+struct cam_cmd_mem_regions {
+	__u32 version;
+	__u32 num_regions;
+	union {
+		struct cam_cmd_mem_region_info map_info_array[1];
+		__DECLARE_FLEX_ARRAY(struct cam_cmd_mem_region_info, map_info_array_flex);
+	};
+};
+
+/**
+ * struct cam_reg_write_desc - Register write descriptor
+ *
+ * @offset               : Register offset at which 'value' needs to written
+ * @value                : Register value to write
+ */
+struct cam_reg_write_desc {
+	__u32 offset;
+	__u32 value;
+};
+
+/**
+ * struct cam_reg_range_read_desc - Descriptor to provide read info
+ *
+ * @offset               : Register offset address to start with
+ * @num_values           : Number of values to read
+ */
+struct cam_reg_range_read_desc {
+	__u32   offset;
+	__u32   num_values;
+};
+
+/**
+ * struct cam_dmi_read_desc - Descriptor to provide DMI read info
+ *
+ * @num_pre_writes       : Number of registers to write before reading DMI data
+ * @num_post_writes      : Number of registers to write after reading DMI data
+ * @pre_read_config      : Registers to write before reading DMI data
+ * @dmi_data_read        : DMI Register, number of values to read to dump
+ *                         DMI data
+ * @post_read_config     : Registers to write after reading DMI data
+ */
+struct cam_dmi_read_desc {
+	__u32                         num_pre_writes;
+	__u32                         num_post_writes;
+	struct cam_reg_write_desc        pre_read_config[
+						CAM_REG_DUMP_DMI_CONFIG_MAX];
+	struct cam_reg_range_read_desc   dmi_data_read;
+	struct cam_reg_write_desc        post_read_config[
+						CAM_REG_DUMP_DMI_CONFIG_MAX];
+};
+
+/**
+ * struct cam_reg_read_info - Register read info for both reg continuous read
+ *                            or DMI read
+ *
+ * @type                 : Whether Register range read or DMI read
+ * @reserved             : For acquired version 3, this corresponds to context_id
+ * @reg_read             : Range of registers to read
+ * @dmi_read             : DMI data to read
+ */
+struct cam_reg_read_info {
+	__u32                                  type;
+	__u32                                  reserved;
+	union {
+		struct cam_reg_range_read_desc reg_read;
+		struct cam_dmi_read_desc       dmi_read;
+	};
+};
+
+/**
+ * struct cam_reg_dump_out_buffer -Buffer info for dump data to be provided
+ *
+ * @req_id               : Request ID corresponding to reg dump data
+ * @bytes_written        : Number of bytes written
+ * @dump_data            : Register dump data
+ */
+struct cam_reg_dump_out_buffer {
+	__u64   req_id;
+	__u32   bytes_written;
+	union {
+		__u32   dump_data[1];
+		__DECLARE_FLEX_ARRAY(__u32, dump_data_flex);
+	};
+};
+
+/**
+ * struct cam_reg_dump_desc - Descriptor to provide dump info
+ *
+ * @reg_base_type        : Register base type, e.g. ISP_LEFT, ISP_RIGHT, CAMNOC
+ * @dump_buffer_offset   : Offset from base of mem_handle at which Register dump
+ *                         will be written for this set
+ * @dump_buffer_size     : Available size in bytes for writing dump values
+ * @num_read_range       : Number register range reads (Continuous + DMI)
+ * @read_range           : Read range info
+ */
+struct cam_reg_dump_desc {
+	__u32                    reg_base_type;
+	__u32                    dump_buffer_offset;
+	__u32                    dump_buffer_size;
+	__u32                    num_read_range;
+	union {
+		struct cam_reg_read_info read_range[1];
+		__DECLARE_FLEX_ARRAY(struct cam_reg_read_info, read_range_flex);
+	};
+};
+
+/**
+ * struct cam_reg_dump_input_info - Info about required dump sets
+ *
+ * @num_dump_sets        : Number of different dump sets (base types) given
+ * @dump_set_offsets     : Points to the given dump description structures
+ *                         (cam_reg_dump_desc)
+ */
+struct cam_reg_dump_input_info {
+	__u32                   num_dump_sets;
+	union {
+		__u32                   dump_set_offsets[1];
+		__DECLARE_FLEX_ARRAY(__u32, dump_set_offsets_flex);
+	};
+};
+
+/**
+ * struct cam_dump_req_cmd -
+ *        Dump the information of issue req id
+ *
+ * @issue_req_id   : Issue Request Id
+ * @offset         : Offset for the buffer
+ * @buf_handle     : Buffer Handle
+ * @error_type     : Error type, using it, dumping information can be extended
+ * @session_handle : Session Handle
+ * @link_hdl       : link handle
+ * @dev_handle     : Device Handle
+ */
+struct cam_dump_req_cmd {
+	__u64           issue_req_id;
+	__kernel_size_t offset;
+	__u32           buf_handle;
+	__u32           error_type;
+	__s32           session_handle;
+	__s32           link_hdl;
+	__s32           dev_handle;
+};
+
+/**
+ * struct cam_synx_test_cmd - Synx test cmds
+ *
+ * @version: Struct version
+ * @ip_mem_hdl: Input buf mem handle
+ *              corresponds to synx test inputs to the
+ *              fencing core
+ * @op_mem_hdl: Output buf mem handle
+ *              corresponds to synx output generated by
+ *              the fencing core
+ * @num_valid_params: Num valid params
+ * @valid_param_mask: Valid param mask
+ * @params: additional params
+ */
+struct cam_synx_test_cmd {
+	__u32 version;
+	__s32 ip_mem_hdl;
+	__s32 op_mem_hdl;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[5];
+};
+
+/**
+ * struct cam_synx_core_control - Synx core ctrl
+ *
+ * @version: Struct version
+ * @core_control: Set for resume, unset for collapse
+ * @num_valid_params: Num valid params
+ * @valid_param_mask: Valid param mask
+ * @params: additional params
+ */
+struct cam_synx_core_control {
+	__u32 version;
+	__u32 core_control;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[4];
+};
+
+
+/**
+ * struct cam_synx_test_params - Synx test params
+ *
+ * A test sequence could include creating and signaling
+ * synx handle between ICP <-> APPs. These test params
+ * would be cmds such as session initialize, synx create,
+ * synx async wait, synx signal and so on
+ *
+ * @version: Struct version
+ * @cmd_type: Type of test cmd - core control/synx cmd/...
+ * @num_valid_params: Num valid params
+ * @valid_param_mask: Valid param mask
+ * @params: additional params
+ * @test_cmd: Synx test cmd forwarded to the core
+ * @core_ctrl: Synx test cmd to control fencing core
+ */
+struct cam_synx_test_params {
+	__u32 version;
+	__u32 cmd_type;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[4];
+	union {
+		struct cam_synx_test_cmd test_cmd;
+		struct cam_synx_core_control core_ctrl;
+	} u;
+} __attribute__((__packed__));
+
+/**
+ * struct cam_update_sensor_stream_cfg_cmd -
+ *        Information of group stream sensor configurations
+ *
+ * @size:               Handle size
+ * @handle_type:        User pointer or shared memory handle
+ * @cfg_handle:         Sensor specific configurations payload
+ * @reserved:           reserved field for alignment
+ */
+ struct cam_update_sensor_stream_cfg_cmd {
+	__u32        size;
+	__u32        handle_type;
+	__u64        cfg_handle;
+	__u64        reserved;
+};
+
+#endif /* __UAPI_CAM_DEFS_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_fd.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_fd.h
@@ -0,0 +1,132 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_FD_H__
+#define __UAPI_CAM_FD_H__
+
+#include <media/cam_defs.h>
+
+#define CAM_FD_MAX_FACES                       35
+#define CAM_FD_RAW_RESULT_ENTRIES              512
+
+/* FD Op Codes */
+#define CAM_PACKET_OPCODES_FD_FRAME_UPDATE     0x0
+
+/* FD Command Buffer identifiers */
+#define CAM_FD_CMD_BUFFER_ID_GENERIC           0x0
+#define CAM_FD_CMD_BUFFER_ID_CDM               0x1
+#define CAM_FD_CMD_BUFFER_ID_MAX               0x2
+
+/* FD Blob types */
+#define CAM_FD_BLOB_TYPE_SOC_CLOCK_BW_REQUEST  0x0
+#define CAM_FD_BLOB_TYPE_RAW_RESULTS_REQUIRED  0x1
+
+/* FD Resource IDs */
+#define CAM_FD_INPUT_PORT_ID_IMAGE             0x0
+#define CAM_FD_INPUT_PORT_ID_MAX               0x1
+
+#define CAM_FD_OUTPUT_PORT_ID_RESULTS          0x0
+#define CAM_FD_OUTPUT_PORT_ID_RAW_RESULTS      0x1
+#define CAM_FD_OUTPUT_PORT_ID_WORK_BUFFER      0x2
+#define CAM_FD_OUTPUT_PORT_ID_MAX              0x3
+
+/**
+ * struct cam_fd_soc_clock_bw_request - SOC clock, bandwidth request info
+ *
+ * @clock_rate : Clock rate required while processing frame
+ * @bandwidth  : Bandwidth required while processing frame
+ * @reserved   : Reserved for future use
+ */
+struct cam_fd_soc_clock_bw_request {
+	__u64    clock_rate;
+	__u64    bandwidth;
+	__u64    reserved[4];
+};
+
+/**
+ * struct cam_fd_face - Face properties
+ *
+ * @prop1 : Property 1 of face
+ * @prop2 : Property 2 of face
+ * @prop3 : Property 3 of face
+ * @prop4 : Property 4 of face
+ *
+ * Do not change this layout, this is inline with how HW writes
+ * these values directly when the buffer is programmed to HW
+ */
+struct cam_fd_face {
+	__u32    prop1;
+	__u32    prop2;
+	__u32    prop3;
+	__u32    prop4;
+};
+
+/**
+ * struct cam_fd_results - FD results layout
+ *
+ * @faces      : Array of faces with face properties
+ * @face_count : Number of faces detected
+ * @reserved   : Reserved for alignment
+ *
+ * Do not change this layout, this is inline with how HW writes
+ * these values directly when the buffer is programmed to HW
+ */
+struct cam_fd_results {
+	struct cam_fd_face faces[CAM_FD_MAX_FACES];
+	__u32              face_count;
+	__u32              reserved[3];
+};
+
+/**
+ * struct cam_fd_hw_caps - Face properties
+ *
+ * @core_version          : FD core version
+ * @wrapper_version       : FD wrapper version
+ * @raw_results_available : Whether raw results are available on this HW
+ * @supported_modes       : Modes supported by this HW.
+ * @reserved              : Reserved for future use
+ */
+struct cam_fd_hw_caps {
+	struct cam_hw_version core_version;
+	struct cam_hw_version wrapper_version;
+	__u32                 raw_results_available;
+	__u32                 supported_modes;
+	__u64                 reserved;
+};
+
+/**
+ * struct cam_fd_query_cap_cmd - FD Query capabilities information
+ *
+ * @device_iommu : FD IOMMU handles
+ * @cdm_iommu    : CDM iommu handles
+ * @hw_caps      : FD HW capabilities
+ * @reserved     : Reserved for alignment
+ */
+struct cam_fd_query_cap_cmd {
+	struct cam_iommu_handle device_iommu;
+	struct cam_iommu_handle cdm_iommu;
+	struct cam_fd_hw_caps   hw_caps;
+	__u64                   reserved;
+};
+
+/**
+ * struct cam_fd_acquire_dev_info - FD acquire device information
+ *
+ * @clk_bw_request  : SOC clock, bandwidth request
+ * @priority        : Priority for this acquire
+ * @mode            : Mode in which to run FD HW.
+ * @get_raw_results : Whether this acquire needs face raw results
+ *                    while frame processing
+ * @reserved        : Reserved field for 64 bit alignment
+ */
+struct cam_fd_acquire_dev_info {
+	struct cam_fd_soc_clock_bw_request clk_bw_request;
+	__u32                              priority;
+	__u32                              mode;
+	__u32                              get_raw_results;
+	__u32                              reserved[13];
+};
+
+#endif /* __UAPI_CAM_FD_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_icp.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_icp.h
@@ -0,0 +1,295 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ICP_H__
+#define __UAPI_CAM_ICP_H__
+
+#include <media/cam_defs.h>
+#include <media/cam_cpas.h>
+
+/* icp, ipe, bps, cdm(ipe/bps) are used in querycap */
+#define CAM_ICP_DEV_TYPE_A5      1
+#define CAM_ICP_DEV_TYPE_IPE     2
+#define CAM_ICP_DEV_TYPE_BPS     3
+#define CAM_ICP_DEV_TYPE_IPE_CDM 4
+#define CAM_ICP_DEV_TYPE_BPS_CDM 5
+/**
+ * This macro is deprecated; a device type max is not necessary.
+ * The new macro CAM_ICP_MAX_NUM_OF_DEV_TYPES will dictate
+ * max number of different types of devices supported by a single
+ * instance of the ICP device.
+ */
+#define CAM_ICP_DEV_TYPE_MAX     5
+
+/* ICP and OFE types added to indicate capability to userspace */
+#define CAM_ICP_DEV_TYPE_ICP     6
+#define CAM_ICP_DEV_TYPE_OFE     7
+
+/* definitions needed for icp aquire device */
+#define CAM_ICP_RES_TYPE_BPS         1
+#define CAM_ICP_RES_TYPE_IPE_RT      2
+#define CAM_ICP_RES_TYPE_IPE         3
+#define CAM_ICP_RES_TYPE_IPE_SEMI_RT 4
+#define CAM_ICP_RES_TYPE_BPS_RT      5
+#define CAM_ICP_RES_TYPE_BPS_SEMI_RT 6
+
+/* This macro is deprecated and no longer needed */
+#define CAM_ICP_RES_TYPE_MAX         7
+
+#define CAM_ICP_RES_TYPE_OFE_RT      7
+#define CAM_ICP_RES_TYPE_OFE         8
+#define CAM_ICP_RES_TYPE_OFE_SEMI_RT 9
+
+/* packet opcode types */
+#define CAM_ICP_OPCODE_IPE_UPDATE   0
+#define CAM_ICP_OPCODE_BPS_UPDATE   1
+#define CAM_ICP_OPCODE_IPE_SETTINGS 2
+#define CAM_ICP_OPCODE_BPS_SETTINGS 3
+#define CAM_ICP_OPCODE_OFE_UPDATE   4
+#define CAM_ICP_OPCODE_OFE_SETTINGS 5
+
+
+/* IPE input port resource type */
+#define CAM_ICP_IPE_INPUT_IMAGE_FULL            0x0
+#define CAM_ICP_IPE_INPUT_IMAGE_DS4             0x1
+#define CAM_ICP_IPE_INPUT_IMAGE_DS16            0x2
+#define CAM_ICP_IPE_INPUT_IMAGE_DS64            0x3
+#define CAM_ICP_IPE_INPUT_IMAGE_FULL_REF        0x4
+#define CAM_ICP_IPE_INPUT_IMAGE_DS4_REF         0x5
+#define CAM_ICP_IPE_INPUT_IMAGE_DS16_REF        0x6
+#define CAM_ICP_IPE_INPUT_IMAGE_DS64_REF        0x7
+
+/* IPE output port resource type */
+#define CAM_ICP_IPE_OUTPUT_IMAGE_DISPLAY        0x8
+#define CAM_ICP_IPE_OUTPUT_IMAGE_VIDEO          0x9
+#define CAM_ICP_IPE_OUTPUT_IMAGE_FULL_REF       0xA
+#define CAM_ICP_IPE_OUTPUT_IMAGE_DS4_REF        0xB
+#define CAM_ICP_IPE_OUTPUT_IMAGE_DS16_REF       0xC
+#define CAM_ICP_IPE_OUTPUT_IMAGE_DS64_REF       0xD
+#define CAM_ICP_IPE_OUTPUT_IMAGE_FD             0x33
+#define CAM_ICP_IPE_OUTPUT_IMAGE_STATS_IHIST    0x3D
+
+#define CAM_ICP_IPE_IMAGE_MAX         (CAM_ICP_IPE_OUTPUT_IMAGE_STATS_IHIST + 1)
+
+/* BPS input port resource type */
+#define CAM_ICP_BPS_INPUT_IMAGE                 0x0
+
+/* BPS output port resource type */
+#define CAM_ICP_BPS_OUTPUT_IMAGE_FULL           0x1
+#define CAM_ICP_BPS_OUTPUT_IMAGE_DS4            0x2
+#define CAM_ICP_BPS_OUTPUT_IMAGE_DS16           0x3
+#define CAM_ICP_BPS_OUTPUT_IMAGE_DS64           0x4
+#define CAM_ICP_BPS_OUTPUT_IMAGE_STATS_BG       0x5
+#define CAM_ICP_BPS_OUTPUT_IMAGE_STATS_BHIST    0x6
+#define CAM_ICP_BPS_OUTPUT_IMAGE_REG1           0x7
+#define CAM_ICP_BPS_OUTPUT_IMAGE_REG2           0x8
+
+#define CAM_ICP_BPS_IO_IMAGES_MAX               0x9
+
+/* Command meta types */
+#define CAM_ICP_CMD_META_GENERIC_BLOB           0x1
+
+/* Generic blob types */
+#define CAM_ICP_CMD_GENERIC_BLOB_CLK              0x1
+#define CAM_ICP_CMD_GENERIC_BLOB_CFG_IO           0x2
+#define CAM_ICP_CMD_GENERIC_BLOB_FW_MEM_MAP       0x3
+#define CAM_ICP_CMD_GENERIC_BLOB_FW_MEM_UNMAP     0x4
+#define CAM_ICP_CMD_GENERIC_BLOB_CLK_V2           0x5
+#define CAM_ICP_CMD_GENERIC_BLOB_PRESIL_HANGDUMP  0x6
+
+/* Max number of device types supported per ICP instance */
+#define CAM_ICP_MAX_NUM_OF_DEV_TYPES              0x5
+
+/**
+ * struct cam_icp_clk_bw_request_v2
+ *
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @reserved: For memory alignment
+ * @num_paths: Number of axi paths in bw request
+ * @axi_path: Per path vote info for IPE/BPS
+ */
+struct cam_icp_clk_bw_request_v2 {
+	__u64                           budget_ns;
+	__u32                           frame_cycles;
+	__u32                           rt_flag;
+	__u32                           reserved;
+	__u32                           num_paths;
+	union {
+		struct cam_axi_per_path_bw_vote axi_path[1];
+		__DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+	};
+};
+
+/**
+ * struct cam_icp_clk_bw_request
+ *
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @uncompressed_bw: Bandwidth required to process frame
+ * @compressed_bw: Compressed bandwidth to process frame
+ */
+struct cam_icp_clk_bw_request {
+	__u64 budget_ns;
+	__u32 frame_cycles;
+	__u32 rt_flag;
+	__u64 uncompressed_bw;
+	__u64 compressed_bw;
+};
+
+/**
+ * struct cam_icp_dev_ver - Device information for particular hw type
+ *
+ * This is used to get device version info of
+ * ICP, IPE, BPS and CDM related IPE and BPS from firmware
+ * and use this info in CAM_QUERY_CAP IOCTL
+ *
+ * @dev_type: hardware type for the cap info(icp, ipe, bps, cdm(ipe/bps))
+ * @reserved: reserved field
+ * @hw_ver: major, minor and incr values of a device version
+ */
+struct cam_icp_dev_ver {
+	__u32                 dev_type;
+	__u32                 reserved;
+	struct cam_hw_version hw_ver;
+};
+
+/**
+ * struct cam_icp_ver - ICP version info
+ *
+ * This strcuture is used for fw and api version
+ * this is used to get firmware version and api version from firmware
+ * and use this info in CAM_QUERY_CAP IOCTL
+ *
+ * @major: FW version major
+ * @minor: FW version minor
+ * @revision: FW version increment
+ */
+struct cam_icp_ver {
+	__u32 major;
+	__u32 minor;
+	__u32 revision;
+	__u32 reserved;
+};
+
+/**
+ * struct cam_icp_query_cap_cmd - ICP query device capability payload
+ *
+ * @dev_iommu_handle: icp iommu handles for secure/non secure modes
+ * @cdm_iommu_handle: iommu handles for secure/non secure modes
+ * @fw_version: firmware version info
+ * @api_version: api version info
+ * @num_ipe: number of ipes
+ * @num_bps: number of bps
+ * @dev_ver: returned device capability array
+ */
+struct cam_icp_query_cap_cmd {
+	struct cam_iommu_handle dev_iommu_handle;
+	struct cam_iommu_handle cdm_iommu_handle;
+	struct cam_icp_ver      fw_version;
+	struct cam_icp_ver      api_version;
+	__u32                   num_ipe;
+	__u32                   num_bps;
+	struct cam_icp_dev_ver  dev_ver[CAM_ICP_DEV_TYPE_MAX];
+};
+
+/**
+ * struct cam_icp_device_info - ICP device info
+ *
+ * @dev_type:          type of the device (IPE/BPS/..)
+ * @num_devices:       number of such devices
+ * @dev_version:       device HW version
+ * @num_valid_params:  number of valid params
+ * @valid_param_mask:  valid param mask
+ * @params:            additional parameters for future usage
+ */
+struct cam_icp_device_info  {
+	__u32 dev_type;
+	__u32 num_devices;
+	struct cam_hw_version dev_version;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[6];
+};
+
+/**
+ * struct cam_icp_query_cap_cmd_v2 - ICP query device capability payload
+ *
+ * @version:              struct version
+ * @dev_iommu_handle:     icp iommu handles for secure/non secure modes
+ * @cdm_iommu_handle:     iommu handles for secure/non secure modes
+ * @fw_version:           firmware version info
+ * @num_dev_info:         number of devices present in this queried subdevice
+ * @dev_info:             returned icp devices capability array
+ * @hw_fence_info_size:   size of the data pointed to by hw_fence_info_hdl
+ *                        if the size is 0, hw fence info will not be populated
+ *                        treated as non-fatal
+ * @hw_fence_info_hdl:    Handle to the hw fence session data if applicable
+ * @num_valid_params:     number of valid params
+ * @valid_param_mask:     valid param mask
+ * @params:               additional parameters for future usage
+ */
+
+struct cam_icp_query_cap_cmd_v2 {
+	__u32                            version;
+	struct cam_iommu_handle          dev_iommu_handle;
+	struct cam_iommu_handle          cdm_iommu_handle;
+	struct cam_icp_ver               fw_version;
+	__u32                            num_dev_info;
+	struct cam_icp_device_info       dev_info[CAM_ICP_MAX_NUM_OF_DEV_TYPES];
+	__u32                            hw_fence_info_size;
+	__u64                            hw_fence_info_hdl;
+	__u32                            num_valid_params;
+	__u32                            valid_param_mask;
+	__u32                            params[5];
+};
+
+/**
+ * struct cam_icp_res_info - ICP output resource info
+ *
+ * @format: format of the resource
+ * @width:  width in pixels
+ * @height: height in lines
+ * @fps:  fps
+ */
+struct cam_icp_res_info {
+	__u32 format;
+	__u32 width;
+	__u32 height;
+	__u32 fps;
+};
+
+/**
+ * struct cam_icp_acquire_dev_info - An ICP device info
+ *
+ * @scratch_mem_size: Output param - size of scratch memory
+ * @dev_type: device type (IPE_RT/IPE_NON_RT/BPS)
+ * @io_config_cmd_size: size of IO config command
+ * @io_config_cmd_handle: IO config command for each acquire
+ * @secure_mode: camera mode (secure/non secure)
+ * @chain_info: chaining info of FW device handles
+ * @in_res: resource info used for clock and bandwidth calculation
+ * @num_out_res: number of output resources
+ * @out_res: output resource
+ */
+struct cam_icp_acquire_dev_info {
+	__u32                   scratch_mem_size;
+	__u32                   dev_type;
+	__u32                   io_config_cmd_size;
+	__s32                   io_config_cmd_handle;
+	__u32                   secure_mode;
+	__s32                   chain_info;
+	struct cam_icp_res_info in_res;
+	__u32                   num_out_res;
+	union {
+		struct cam_icp_res_info out_res[1];
+		__DECLARE_FLEX_ARRAY(struct cam_icp_res_info, out_res_flex);
+	};
+} __attribute__((__packed__));
+
+#endif /* __UAPI_CAM_ICP_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp.h
@@ -0,0 +1,1560 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_H__
+#define __UAPI_CAM_ISP_H__
+
+#include <media/cam_defs.h>
+#include <media/cam_isp_vfe.h>
+#include <media/cam_isp_ife.h>
+#include <media/cam_isp_sfe.h>
+#include <media/cam_cpas.h>
+
+/* ISP driver name */
+#define CAM_ISP_DEV_NAME                        "cam-isp"
+
+/* HW type */
+#define CAM_ISP_HW_BASE                         0
+#define CAM_ISP_HW_CSID                         1
+#define CAM_ISP_HW_VFE                          2
+#define CAM_ISP_HW_IFE                          3
+#define CAM_ISP_HW_ISPIF                        4
+#define CAM_ISP_HW_IFE_LITE                     5
+#define CAM_ISP_HW_CSID_LITE                    6
+#define CAM_ISP_HW_SFE                          7
+#define CAM_ISP_HW_MC_TFE                       8
+#define CAM_ISP_HW_MAX                          9
+
+/* Color Pattern */
+#define CAM_ISP_PATTERN_BAYER_RGRGRG            0
+#define CAM_ISP_PATTERN_BAYER_GRGRGR            1
+#define CAM_ISP_PATTERN_BAYER_BGBGBG            2
+#define CAM_ISP_PATTERN_BAYER_GBGBGB            3
+#define CAM_ISP_PATTERN_YUV_YCBYCR              4
+#define CAM_ISP_PATTERN_YUV_YCRYCB              5
+#define CAM_ISP_PATTERN_YUV_CBYCRY              6
+#define CAM_ISP_PATTERN_YUV_CRYCBY              7
+#define CAM_ISP_PATTERN_MAX                     8
+
+/* Usage Type */
+#define CAM_ISP_RES_USAGE_SINGLE                0
+#define CAM_ISP_RES_USAGE_DUAL                  1
+#define CAM_ISP_RES_USAGE_MAX                   2
+
+/* Resource ID */
+#define CAM_ISP_RES_ID_PORT                     0
+#define CAM_ISP_RES_ID_CLK                      1
+#define CAM_ISP_RES_ID_MAX                      2
+
+/* Resource Type - Type of resource for the resource id
+ * defined in cam_isp_vfe.h, cam_isp_ife.h
+ */
+
+/* Lane Type in input resource for Port */
+#define CAM_ISP_LANE_TYPE_DPHY                  0
+#define CAM_ISP_LANE_TYPE_CPHY                  1
+#define CAM_ISP_LANE_TYPE_MAX                   2
+
+/* ISP Resurce Composite Group ID */
+#define CAM_ISP_RES_COMP_GROUP_NONE             0
+#define CAM_ISP_RES_COMP_GROUP_ID_0             1
+#define CAM_ISP_RES_COMP_GROUP_ID_1             2
+#define CAM_ISP_RES_COMP_GROUP_ID_2             3
+#define CAM_ISP_RES_COMP_GROUP_ID_3             4
+#define CAM_ISP_RES_COMP_GROUP_ID_4             5
+#define CAM_ISP_RES_COMP_GROUP_ID_5             6
+#define CAM_ISP_RES_COMP_GROUP_ID_MAX           6
+
+/* ISP packet opcode for ISP */
+#define CAM_ISP_PACKET_OP_BASE                  0
+#define CAM_ISP_PACKET_INIT_DEV                 1
+#define CAM_ISP_PACKET_UPDATE_DEV               2
+#define CAM_ISP_PACKET_OP_MAX                   3
+
+/* ISP packet meta_data type for command buffer */
+#define CAM_ISP_PACKET_META_BASE                  0
+#define CAM_ISP_PACKET_META_LEFT                  1
+#define CAM_ISP_PACKET_META_RIGHT                 2
+#define CAM_ISP_PACKET_META_COMMON                3
+#define CAM_ISP_PACKET_META_DMI_LEFT              4
+#define CAM_ISP_PACKET_META_DMI_RIGHT             5
+#define CAM_ISP_PACKET_META_DMI_COMMON            6
+#define CAM_ISP_PACKET_META_CLOCK                 7
+#define CAM_ISP_PACKET_META_CSID                  8
+#define CAM_ISP_PACKET_META_DUAL_CONFIG           9
+#define CAM_ISP_PACKET_META_GENERIC_BLOB_LEFT     10
+#define CAM_ISP_PACKET_META_GENERIC_BLOB_RIGHT    11
+#define CAM_ISP_PACKET_META_GENERIC_BLOB_COMMON   12
+#define CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST  13
+#define CAM_ISP_PACKET_META_REG_DUMP_ON_FLUSH     14
+#define CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR     15
+#define CAM_ISP_PACKET_META_CSID_LEFT             16
+#define CAM_ISP_PACKET_META_CSID_RIGHT            17
+#define CAM_ISP_PACKET_META_CSID_COMMON           18
+
+/* SFE packet meta_data type for command buffer */
+#define CAM_ISP_SFE_PACKET_META_LEFT              0x15
+#define CAM_ISP_SFE_PACKET_META_RIGHT             0x16
+#define CAM_ISP_SFE_PACKET_META_COMMON            0x17
+#define CAM_ISP_SFE_PACKET_META_DUAL_CONFIG       0x18
+
+/* DSP mode */
+#define CAM_ISP_DSP_MODE_NONE                   0
+#define CAM_ISP_DSP_MODE_ONE_WAY                1
+#define CAM_ISP_DSP_MODE_ROUND                  2
+
+/* ISP Generic Cmd Buffer Blob types */
+#define CAM_ISP_GENERIC_BLOB_TYPE_HFR_CONFIG                0
+#define CAM_ISP_GENERIC_BLOB_TYPE_CLOCK_CONFIG              1
+#define CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG                 2
+#define CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG               3
+#define CAM_ISP_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG         4
+#define CAM_ISP_GENERIC_BLOB_TYPE_FE_CONFIG                 5
+#define CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG_V2            6
+#define CAM_ISP_GENERIC_BLOB_TYPE_IFE_CORE_CONFIG           7
+#define CAM_ISP_GENERIC_BLOB_TYPE_VFE_OUT_CONFIG            8
+#define CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V2              9
+#define CAM_ISP_GENERIC_BLOB_TYPE_DISCARD_INITIAL_FRAMES    10
+#define CAM_ISP_GENERIC_BLOB_TYPE_SENSOR_DIMENSION_CONFIG   11
+#define CAM_ISP_GENERIC_BLOB_TYPE_CSID_QCFA_CONFIG          12
+#define CAM_ISP_GENERIC_BLOB_TYPE_SENSOR_BLANKING_CONFIG    13
+#define CAM_ISP_GENERIC_BLOB_TYPE_TPG_CORE_CONFIG           14
+#define CAM_ISP_GENERIC_BLOB_TYPE_DYNAMIC_MODE_SWITCH       15
+#define CAM_ISP_GENERIC_BLOB_TYPE_BW_LIMITER_CFG            16
+#define CAM_ISP_GENERIC_BLOB_TYPE_FPS_CONFIG                17
+#define CAM_ISP_GENERIC_BLOB_TYPE_INIT_CONFIG               18
+#define CAM_ISP_GENERIC_BLOB_TYPE_RDI_LCR_CONFIG            19
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_FCG_CFG               20
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_CLOCK_CONFIG          21
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_CORE_CONFIG           22
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_OUT_CONFIG            23
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_HFR_CONFIG            24
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_FE_CONFIG             25
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_SCRATCH_BUF_CFG       26
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_EXP_ORDER_CFG         27
+#define CAM_ISP_GENERIC_BLOB_TYPE_DRV_CONFIG                28
+#define CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V3              29
+#define CAM_ISP_GENERIC_BLOB_TYPE_NFI_MODE_SWITCH           30
+#define CAM_ISP_GENERIC_BLOB_TYPE_IRQ_COMP_CFG              31
+#define CAM_ISP_GENERIC_BLOB_TYPE_VFE_OUT_CONFIG_V2         32
+#define CAM_ISP_GENERIC_BLOB_TYPE_IFE_FCG_CFG               33
+
+#define CAM_ISP_VC_DT_CFG    4
+
+#define CAM_ISP_IFE0_HW          0x1
+#define CAM_ISP_IFE1_HW          0x2
+#define CAM_ISP_IFE0_LITE_HW     0x4
+#define CAM_ISP_IFE1_LITE_HW     0x8
+#define CAM_ISP_IFE2_LITE_HW     0x10
+#define CAM_ISP_IFE3_LITE_HW     0x20
+#define CAM_ISP_IFE4_LITE_HW     0x40
+#define CAM_ISP_IFE2_HW          0x100
+#define CAM_ISP_SFE0_HW          0x1000
+#define CAM_ISP_SFE1_HW          0x2000
+#define CAM_ISP_SFE2_HW          0x4000
+
+#define CAM_ISP_PXL_PATH          0x1
+#define CAM_ISP_PPP_PATH          0x2
+#define CAM_ISP_LCR_PATH          0x4
+#define CAM_ISP_RDI0_PATH         0x8
+#define CAM_ISP_RDI1_PATH         0x10
+#define CAM_ISP_RDI2_PATH         0x20
+#define CAM_ISP_RDI3_PATH         0x40
+#define CAM_ISP_RDI4_PATH         0x80
+#define CAM_ISP_PXL1_PATH         0x100
+#define CAM_ISP_PXL2_PATH         0x200
+#define CAM_ISP_RDI5_PATH         0x400
+
+#define CAM_ISP_VIRTUAL_RDI0_PATH 0x800
+#define CAM_ISP_VIRTUAL_RDI1_PATH 0x1000
+#define CAM_ISP_VIRTUAL_RDI2_PATH 0x2000
+#define CAM_ISP_VIRTUAL_RDI3_PATH 0x4000
+#define CAM_ISP_VIRTUAL_RDI4_PATH 0x8000
+#define CAM_ISP_VIRTUAL_RDI5_PATH 0x10000
+
+/*
+ * Multi Context Mask
+ */
+#define  CAM_ISP_MULTI_CTXT0_MASK 0x1
+#define  CAM_ISP_MULTI_CTXT1_MASK 0x2
+#define  CAM_ISP_MULTI_CTXT2_MASK 0x4
+
+/* Per Path Usage Data */
+#define CAM_ISP_USAGE_INVALID     0
+#define CAM_ISP_USAGE_LEFT_PX     1
+#define CAM_ISP_USAGE_RIGHT_PX    2
+#define CAM_ISP_USAGE_RDI         3
+#define CAM_ISP_USAGE_SFE_LEFT    4
+#define CAM_ISP_USAGE_SFE_RIGHT   5
+#define CAM_ISP_USAGE_SFE_RDI     6
+
+/* Acquire with custom hw */
+#define CAM_ISP_ACQ_CUSTOM_NONE       0
+#define CAM_ISP_ACQ_CUSTOM_PRIMARY    1
+#define CAM_ISP_ACQ_CUSTOM_SECONDARY  2
+
+#define CAM_IFE_CSID_RDI_MAX          5
+
+/* Feature Flag indicators */
+#define CAM_ISP_PARAM_FETCH_SECURITY_MODE      BIT(0)
+#define CAM_ISP_CAN_USE_LITE_MODE              BIT(1)
+#define CAM_ISP_DYNAMIC_SENOR_SWITCH_EN        BIT(2)
+#define CAM_ISP_SFE_BINNED_EPOCH_CFG_ENABLE    BIT(3)
+#define CAM_ISP_EPD_SUPPORT                    BIT(4)
+#define CAM_ISP_SFE_FS_MODE_EN                 BIT(5)
+#define CAM_ISP_SFE_SHDR_MODE_EN               BIT(6)
+#define CAM_ISP_AEB_MODE_EN                    BIT(7)
+#define CAM_ISP_HDR_MODE_DYNAMIC_SWITCH_EN     BIT(8)
+#define CAM_ISP_NFI_BASED_MODE_SWITCH_EN       BIT(9)
+#define CAM_ISP_YUV_CHROMA_CONVERSION_DS_EN    BIT(10)
+
+/* ISP core cfg flag params */
+#define CAM_ISP_PARAM_CORE_CFG_HDR_MUX_SEL BIT(0)
+#define CAM_ISP_PARAM_CORE_CFG_PP_FORMAT   BIT(16)
+
+/* Indicate which module is configured for FCG */
+#define CAM_ISP_FCG_ENABLE_PHASE         BIT(0)
+#define CAM_ISP_FCG_ENABLE_STATS         BIT(1)
+
+/*
+ * Indicate which channel is configured for FCG
+ * For SFE, channel 1/2 are used on demand
+ * For IFE, treat it as channel 0
+ * For TFE, use Multi Context Mask to indicate the path
+ */
+#define CAM_ISP_FCG_MASK_CH0                 0x1
+#define CAM_ISP_FCG_MASK_CH1                 0x2
+#define CAM_ISP_FCG_MASK_CH2                 0x4
+
+/**
+ * Decode format1 Support for multi VCDT use case.
+ * Format type is packed in 8 bits. BIT(0-7) is
+ * format and BIT(8-15) is format1 type in the format
+ * variable
+ */
+#define CAM_IFE_DECODE_FORMAT_MASK      0xFF
+#define CAM_IFE_DECODE_FORMAT_SHIFT_VAL 8
+
+/*
+ * to indicate if packing is to be done at Bus side.
+ * CSID gives the plain data and packed at bus.
+ * This mask reserves the param_mask for cam_isp_out_port_info_v3.
+ *
+ */
+#define CAM_IFE_USE_WM_PACK                  BIT(0)
+
+/*
+ * to indicate if RCS to be enabled.
+ */
+#define CAM_IFE_WM_RCS_EN                    BIT(1)
+
+/* ISP stream config params */
+#define CAM_ISP_STREAM_GROUP_CFG_MAX   12
+
+/*Perport in Lemans is supported for ife lites, no ife full support hence
+ *6 rdi paths for ife_lite
+ */
+#define CAM_ISP_STREAM_CFG_MAX         6
+
+/**
+ * struct cam_isp_irq_comp_cfg - CSID composite config for MC-based TFE
+ *        Contains information regarding active contexts in CSID CAMIF
+ *        and active contexts in write engine TFE
+ *
+ * @ipp_src_ctxt_mask : Active paths in CSID CAMIF
+ * @ipp_dst_comp_mask : Active paths in TFE
+ * @num_valid_params  : Number of valid params
+ * @valid_param_mask  : Valid param mask
+ * @params            : params
+ */
+struct cam_isp_irq_comp_cfg {
+	__u32   ipp_src_ctxt_mask;
+	__u32   ipp_dst_comp_mask;
+	__u32   num_valid_params;
+	__u32   valid_param_mask;
+	__u32   params[4];
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_drv_config - CSID config for DRV
+ *        Enables DRV and provides worst case timeout value in INIT packet,
+ *        provides path_idle_en and timeout updates (if any) in UPDATE packet
+ *
+ * @drv_en            : Enables DRV block
+ * @timeout_val       : Timeout value from SOF to trigger vote up,
+ *                      given in number of Global Counter cycles.
+ * @path_idle_en      : Mask for paths to be considered for consolidated IDLE signal.
+ *                      When paths matching the mask go idle, BW is voted down.
+ * @num_valid_params  : Number of valid params
+ * @valid_param_mask  : Valid param mask
+ * @params            : params
+ */
+struct cam_isp_drv_config {
+	__u32    drv_en;
+	__u32    timeout_val;
+	__u32    path_idle_en;
+	__u32    num_valid_params;
+	__u32    valid_param_mask;
+	__u32    params[5];
+} __attribute__((packed));
+
+
+/* Query devices */
+/**
+ * struct cam_isp_dev_cap_info - A cap info for particular hw type
+ *
+ * @hw_type:            Hardware type for the cap info
+ * @num_hw:             Number of HW of type @hw_type
+ * @hw_version:         Hardware version
+ *
+ */
+struct cam_isp_dev_cap_info {
+	__u32              hw_type;
+	__u32              num_hw;
+	struct cam_hw_version hw_version;
+};
+
+/**
+ * struct cam_isp_query_cap_cmd - ISP query device capability payload
+ *
+ * @device_iommu:               returned iommu handles for device
+ * @cdm_iommu:                  returned iommu handles for cdm
+ * @num_dev:                    returned number of device capabilities
+ * @reserved:                   reserved field for alignment
+ * @dev_caps:                   returned device capability array
+ *
+ */
+struct cam_isp_query_cap_cmd {
+	struct cam_iommu_handle     device_iommu;
+	struct cam_iommu_handle     cdm_iommu;
+	__s32                       num_dev;
+	__u32                       reserved;
+	struct cam_isp_dev_cap_info dev_caps[CAM_ISP_HW_MAX];
+};
+
+/* Acquire Device */
+/**
+ * struct cam_isp_out_port_info - An output port resource info
+ *
+ * @res_type:                   output resource type defined in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @format:                     output format of the resource
+ * @wdith:                      output width in pixels
+ * @height:                     output height in lines
+ * @comp_grp_id:                composite group id for the resource.
+ * @split_point:                split point in pixels for the dual VFE.
+ * @secure_mode:                flag to tell if output should be run in secure
+ *                              mode or not. See cam_defs.h for definition
+ * @reserved:                   reserved field for alignment
+ *
+ */
+struct cam_isp_out_port_info {
+	__u32                res_type;
+	__u32                format;
+	__u32                width;
+	__u32                height;
+	__u32                comp_grp_id;
+	__u32                split_point;
+	__u32                secure_mode;
+	__u32                reserved;
+};
+
+/**
+ * struct cam_isp_out_port_info_v2 - An output port resource info
+ *
+ * @res_type:                   output resource type defined in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @format:                     output format of the resource
+ * @wdith:                      output width in pixels
+ * @height:                     output height in lines
+ * @comp_grp_id:                composite group id for the resource.
+ * @split_point:                split point in pixels for the dual VFE.
+ * @secure_mode:                flag to tell if output should be run in secure
+ *                              mode or not. See cam_defs.h for definition
+ * @wm_mode:                    WM mode
+ * @out_port_res1:              Output reserved field
+ * @out_port_res2:              Output reserved field
+ *
+ */
+struct cam_isp_out_port_info_v2 {
+	__u32                res_type;
+	__u32                format;
+	__u32                width;
+	__u32                height;
+	__u32                comp_grp_id;
+	__u32                split_point;
+	__u32                secure_mode;
+	__u32                wm_mode;
+	__u32                out_port_res1;
+	__u32                out_port_res2;
+};
+
+/**
+ * struct cam_isp_in_port_info - An input port resource info
+ *
+ * @res_type:                   input resource type define in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @format:                     input format
+ * @test_pattern:               test pattern for the testgen
+ * @usage_type:                 whether dual vfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_stop:                  left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ *                              Only for Dual VFE
+ * @right_stop:                 right input stop offset in pixels.
+ *                              Only for Dual VFE
+ * @right_width:                right input width in pixels.
+ *                              Only for dual VFE
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @pixel_clk;                  sensor output clock
+ * @batch_size:                 batch size for HFR mode
+ * @dsp_mode:                   DSP stream mode (Defines as CAM_ISP_DSP_MODE_*)
+ * @hbi_cnt:                    HBI count for the camif input
+ * @reserved:                   Reserved field for alignment
+ * @num_out_res:                number of the output resource associated
+ * @data:                       payload that contains the output resources
+ *
+ */
+struct cam_isp_in_port_info {
+	__u32                        res_type;
+	__u32                        lane_type;
+	__u32                        lane_num;
+	__u32                        lane_cfg;
+	__u32                        vc;
+	__u32                        dt;
+	__u32                        format;
+	__u32                        test_pattern;
+	__u32                        usage_type;
+	__u32                        left_start;
+	__u32                        left_stop;
+	__u32                        left_width;
+	__u32                        right_start;
+	__u32                        right_stop;
+	__u32                        right_width;
+	__u32                        line_start;
+	__u32                        line_stop;
+	__u32                        height;
+	__u32                        pixel_clk;
+	__u32                        batch_size;
+	__u32                        dsp_mode;
+	__u32                        hbi_cnt;
+	__u32                        reserved;
+	__u32                        num_out_res;
+	union {
+		struct cam_isp_out_port_info data[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_out_port_info, data_flex);
+	};
+};
+
+/**
+ * struct cam_isp_in_port_info_v2 - An input port resource info
+ *
+ * @res_type:                   input resource type define in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @num_valid_vc_dt:            valid vc and dt in array
+ * @format:                     input format
+ * @test_pattern:               test pattern for the testgen
+ * @usage_type:                 whether dual vfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_stop:                  left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ *                              Only for Dual VFE
+ * @right_stop:                 right input stop offset in pixels.
+ *                              only for Dual VFE
+ * @right_width:                right input width in pixels.
+ *                              only for dual VFE
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @pixel_clk;                  sensor output clock
+ * @batch_size:                 batch size for HFR mode
+ * @dsp_mode:                   DSP stream mode (Defines as CAM_ISP_DSP_MODE_*)
+ * @hbi_cnt:                    HBI count for the camif input
+ * @cust_node:                  if any custom HW block is present before IFE
+ * @num_out_res:                number of the output resource associated
+ * @bidirectional_bin:          [0  : 15] - Set 1 for Horizontal binning
+ *                              [16 : 31] - Set 1 for Vertical binning
+ * @qcfa_bin:                   Quadra Binning info
+ * @sfe_in_path_type:           SFE input path type
+ *                              0:15 - refer to cam_isp_sfe.h for SFE paths
+ *                              16:31 - Corresponding IFE i/p path type
+ *                              Example:((CAM_ISP_PXL_PATH << 16) |
+ *                                        CAM_ISP_SFE_INLINE_PIX)
+ *                              This will acquire SFE inline IPP and IFE IPP
+ *                              PPP is an exception CSID PPP -> IFE PPP
+ * @feature_flag:               See the macros defined under feature flag above
+ * @ife_res_1:                  payload for future use.
+ * @sensor_id:                  Sensor id for pipeline.
+ * @data:                       payload that contains the output resources
+ *
+ */
+struct cam_isp_in_port_info_v2 {
+	__u32                           res_type;
+	__u32                           lane_type;
+	__u32                           lane_num;
+	__u32                           lane_cfg;
+	__u32                           vc[CAM_ISP_VC_DT_CFG];
+	__u32                           dt[CAM_ISP_VC_DT_CFG];
+	__u32                           num_valid_vc_dt;
+	__u32                           format;
+	__u32                           test_pattern;
+	__u32                           usage_type;
+	__u32                           left_start;
+	__u32                           left_stop;
+	__u32                           left_width;
+	__u32                           right_start;
+	__u32                           right_stop;
+	__u32                           right_width;
+	__u32                           line_start;
+	__u32                           line_stop;
+	__u32                           height;
+	__u32                           pixel_clk;
+	__u32                           batch_size;
+	__u32                           dsp_mode;
+	__u32                           hbi_cnt;
+	__u32                           cust_node;
+	__u32                           num_out_res;
+	__u32                           offline_mode;
+	__u32                           bidirectional_bin;
+	__u32                           qcfa_bin;
+	__u32                           sfe_in_path_type;
+	__u32                           feature_flag;
+	__u32                           ife_res_1;
+	__u32                           sensor_id;
+	union {
+		struct cam_isp_out_port_info_v2 data[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_out_port_info_v2, data_flex);
+	};
+};
+
+/**
+ * struct cam_isp_in_port_phy_info - CSID in port PHY info
+ *
+ * @res_type:   input resource for the stream
+ * @lane_type:  Lane type--> C-Phy/ D-Phy
+ * @lane_num:   Number of lanes
+ * @lane_cfg:   Lane Configuraion
+ */
+struct cam_isp_in_port_phy_info {
+	__u32                           res_type;
+	__u32                           lane_type;
+	__u32                           lane_num;
+	__u32                           lane_cfg;
+};
+
+/**
+ * struct cam_isp_in_port_csid_info - CSID in port info
+ *
+ * @vc:                Virtual Channel for the incoming stream
+ * @dt:                Data type for the incoming stream
+ * @num_valid_vc_dt    Number of valid vc dt in case of multi vc dt on a single path
+ * @format:            Incoming format for this input
+ * @width:             Width of incoming stream
+ * @height:            Height of incoming stream
+ * @path_id:           CSID IPP Path to be acquired
+ * @param_mask:        Reserved field to add new features
+ * @params:            Reserved fields
+ */
+struct cam_isp_in_port_csid_info {
+	__u32                             vc[CAM_ISP_VC_DT_CFG];
+	__u32                             dt[CAM_ISP_VC_DT_CFG];
+	__u32                             num_valid_vc_dt;
+	__u32                             format;
+	__u32                             width;
+	__u32                             height;
+	__u32                             path_id;
+	__u32                             param_mask;
+	__u32                             params[7];
+};
+
+/**
+ * struct cam_isp_out_port_info_v3 - An output port resource info
+ *
+ * @res_type:                   output resource type defined in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @format:                     output format of the resource
+ * @width:                      output width in pixels
+ * @height:                     output height in lines
+ * @comp_grp_id:                composite group id for the resource.
+ * @split_point:                split point in pixels for the dual VFE.
+ * @secure_mode:                flag to tell if output should be run in secure
+ *                              mode or not. See cam_defs.h for definition
+ * @wm_mode:                    WM mode
+ * @context_id:                 Context ID in case of multi context
+ * @param_mask:                 Reserved field to add new features
+ * @params:                     Reserved fields
+ */
+struct cam_isp_out_port_info_v3 {
+	__u32                res_type;
+	__u32                format;
+	__u32                width;
+	__u32                height;
+	__u32                comp_grp_id;
+	__u32                split_point;
+	__u32                secure_mode;
+	__u32                wm_mode;
+	__u32                context_id;
+	__u32                param_mask;
+	__u32                params[6];
+};
+/**
+ * struct cam_isp_in_port_info_v3 - A resource bundle
+ *
+ * @csid_info:                resource id for the resource bundle
+ * @phy_info:                 length of the while resource blob
+ * @num_contexts              Num of contexts in case of multi context
+ * @feature_mask:             Feature mask to store bit fields for any specific use case
+ * @data:                     Pointer to out resource data
+ */
+struct cam_isp_in_port_info_v3 {
+	struct cam_isp_in_port_csid_info csid_info;
+	struct cam_isp_in_port_phy_info  phy_info;
+	__u32                            num_contexts;
+	__u32                            feature_mask;
+	__u32                            num_out_res;
+	union {
+		struct cam_isp_out_port_info_v3  data[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_out_port_info_v3, data_flex);
+	};
+};
+
+/**
+ * struct cam_isp_resource - A resource bundle
+ *
+ * @resoruce_id:                resource id for the resource bundle
+ * @length:                     length of the while resource blob
+ * @handle_type:                type of the resource handle
+ * @reserved:                   reserved field for alignment
+ * @res_hdl:                    resource handle that points to the
+ *                                     resource array;
+ *
+ */
+struct cam_isp_resource {
+	__u32                       resource_id;
+	__u32                       length;
+	__u32                       handle_type;
+	__u32                       reserved;
+	__u64                       res_hdl;
+};
+
+/**
+ * struct cam_isp_port_hfr_config - HFR configuration for this port
+ *
+ * @resource_type:              Resource type
+ * @subsample_pattern:          Subsample pattern. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @subsample_period:           Subsample period. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @framedrop_pattern:          Framedrop pattern
+ * @framedrop_period:           Framedrop period
+ * @reserved:                   Reserved for alignment
+ */
+struct cam_isp_port_hfr_config {
+	__u32                       resource_type;
+	__u32                       subsample_pattern;
+	__u32                       subsample_period;
+	__u32                       framedrop_pattern;
+	__u32                       framedrop_period;
+	__u32                       reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_resource_hfr_config - Resource HFR configuration
+ *
+ * @num_ports:                  Number of ports
+ * @reserved:                   Reserved for alignment
+ * @port_hfr_config:            HFR configuration for each IO port
+ */
+struct cam_isp_resource_hfr_config {
+	__u32                          num_ports;
+	__u32                          reserved;
+	union {
+		struct cam_isp_port_hfr_config port_hfr_config[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_port_hfr_config, port_hfr_config_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_dual_split_params - dual isp spilt parameters
+ *
+ * @split_point:                Split point information x, where (0 < x < width)
+ *                              left ISP's input ends at x + righ padding and
+ *                              Right ISP's input starts at x - left padding
+ * @right_padding:              Padding added past the split point for left
+ *                              ISP's input
+ * @left_padding:               Padding added before split point for right
+ *                              ISP's input
+ * @reserved:                   Reserved filed for alignment
+ *
+ */
+struct cam_isp_dual_split_params {
+	__u32                       split_point;
+	__u32                       right_padding;
+	__u32                       left_padding;
+	__u32                       reserved;
+};
+
+/**
+ * struct cam_isp_dual_stripe_config - stripe config per bus client
+ *
+ * @offset:                     Start horizontal offset relative to
+ *                              output buffer
+ *                              In UBWC mode, this value indicates the H_INIT
+ *                              value in pixel
+ * @width:                      Width of the stripe in bytes
+ * @tileconfig                  Ubwc meta tile config. Contain the partial
+ *                              tile info
+ * @port_id:                    port id of ISP output
+ *
+ */
+struct cam_isp_dual_stripe_config {
+	__u32                       offset;
+	__u32                       width;
+	__u32                       tileconfig;
+	__u32                       port_id;
+};
+
+/**
+ * struct cam_isp_dual_config - dual isp configuration
+ *
+ * @num_ports                   Number of isp output ports
+ * @reserved                    Reserved field for alignment
+ * @split_params:               Inpput split parameters
+ * @stripes:                    Stripe information
+ *
+ */
+struct cam_isp_dual_config {
+	__u32                             num_ports;
+	__u32                             reserved;
+	struct cam_isp_dual_split_params  split_params;
+	union {
+		struct cam_isp_dual_stripe_config stripes[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_dual_stripe_config, stripes_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_clock_config - Clock configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_rdi:                    Number of RDI votes
+ * @left_pix_hz:                Pixel Clock for Left ISP
+ * @right_pix_hz:               Pixel Clock for Right ISP, valid only if Dual
+ * @rdi_hz:                     RDI Clock. ISP clock will be max of RDI and
+ *                              PIX clocks. For a particular context which ISP
+ *                              HW the RDI is allocated to is not known to UMD.
+ *                              Hence pass the clock and let KMD decide.
+ */
+struct cam_isp_clock_config {
+	__u32                       usage_type;
+	__u32                       num_rdi;
+	__u64                       left_pix_hz;
+	__u64                       right_pix_hz;
+	union {
+		__u64                   rdi_hz[1];
+		__DECLARE_FLEX_ARRAY(__u64, rdi_hz_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_csid_clock_config - CSID clock configuration
+ *
+ * @csid_clock                  CSID clock
+ */
+struct cam_isp_csid_clock_config {
+	__u64                       csid_clock;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_csid_qcfa_config - CSID qcfa binning support configuration
+ *
+ * @csid_binning                CSID binning
+ */
+struct cam_isp_csid_qcfa_config {
+	__u32                       csid_binning;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_bw_vote - Bandwidth vote information
+ *
+ * @resource_id:                Resource ID
+ * @reserved:                   Reserved field for alignment
+ * @cam_bw_bps:                 Bandwidth vote for CAMNOC
+ * @ext_bw_bps:                 Bandwidth vote for path-to-DDR after CAMNOC
+ */
+struct cam_isp_bw_vote {
+	__u32                       resource_id;
+	__u32                       reserved;
+	__u64                       cam_bw_bps;
+	__u64                       ext_bw_bps;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_bw_config - Bandwidth configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_rdi:                    Number of RDI votes
+ * @left_pix_vote:              Bandwidth vote for left ISP
+ * @right_pix_vote:             Bandwidth vote for right ISP
+ * @rdi_vote:                   RDI bandwidth requirements
+ */
+struct cam_isp_bw_config {
+	__u32                       usage_type;
+	__u32                       num_rdi;
+	struct cam_isp_bw_vote      left_pix_vote;
+	struct cam_isp_bw_vote      right_pix_vote;
+	union {
+		struct cam_isp_bw_vote      rdi_vote[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_bw_vote, rdi_vote_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_bw_config_v2 - Bandwidth configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_paths:                  Number of axi data paths
+ * @axi_path                    Per path vote info
+ */
+struct cam_isp_bw_config_v2 {
+	__u32                             usage_type;
+	__u32                             num_paths;
+	union {
+		struct cam_axi_per_path_bw_vote   axi_path[1];
+		__DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_bw_config_v3 - Bandwidth configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_paths:                  Number of axi data paths
+ * @num_valid_params:           Number of valid params
+ * @valid_param_mask:           Valid param mask
+ * @params:                     params
+ * @axi_path:                   Per path vote info v2
+ */
+struct cam_isp_bw_config_v3 {
+	__u32                                usage_type;
+	__u32                                num_paths;
+	__u32                                num_valid_params;
+	__u32                                valid_param_mask;
+	__u32                                params[4];
+	union {
+		struct cam_axi_per_path_bw_vote_v2   axi_path[1];
+		__DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote_v2, axi_path_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_fe_config - Fetch Engine configuration
+ *
+ * @version:                    fetch engine veriosn
+ * @min_vbi:                    require min vbi
+ * @fs_mode:                    indicates if fs mode enabled
+ * @fs_line_sync_en:            frame level sync or line level
+ *                              sync for fetch engine
+ * @hbi_count:                  hbi count
+ * @fs_sync_enable:             indicates if fetch engine working
+ *                              wokring in sync with write engine
+ * @go_cmd_sel:                 softwrae go_cmd or hw go_cmd
+ * @client_enable:              enable read engine
+ * @source_addr:                adrress of buffer to read from
+ * @width:                      buffer width
+ * @height:                     buffer height
+ * @stride:                     buffer stride (here equal to width)
+ * @format:                     format of image in buffer
+ * @unpacker_cfg:               unpacker config type
+ * @latency_buf_size:           latency buffer for read engine
+ */
+struct cam_fe_config {
+	__u64    version;
+	__u32    min_vbi;
+	__u32    fs_mode;
+	__u32    fs_line_sync_en;
+	__u32    hbi_count;
+	__u32    fs_sync_enable;
+	__u32    go_cmd_sel;
+	__u32    client_enable;
+	__u32    source_addr;
+	__u32    width;
+	__u32    height;
+	__u32    stride;
+	__u32    format;
+	__u32    unpacker_cfg;
+	__u32    latency_buf_size;
+} __attribute__((packed));
+
+
+/**
+ * struct cam_isp_sensor_path_dimension
+ *
+ * @width             expected width
+ * @height            expected height
+ * @measure_enabled   flag to indicate if pixel measurement is to be enabled
+ */
+struct cam_isp_sensor_dimension {
+	__u32 width;
+	__u32 height;
+	__u32 measure_enabled;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sensor_blanking_config
+ *
+ * @hbi             HBI value
+ * @vbi             VBI value
+ */
+struct cam_isp_sensor_blanking_config {
+	__u32 hbi;
+	__u32 vbi;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sensor_config - Sensor Dimension configuration
+ *
+ * @ppp_path:                   expected ppp path configuration
+ * @ipp_path:                   expected ipp path configuration
+ * @rdi_path:                   expected rdi path configuration
+ * @hbi:                        HBI value
+ * @vbi:                        VBI value
+ */
+struct cam_isp_sensor_config {
+	struct cam_isp_sensor_dimension  ppp_path;
+	struct cam_isp_sensor_dimension  ipp_path;
+	struct cam_isp_sensor_dimension  rdi_path[CAM_IFE_CSID_RDI_MAX];
+	__u32                   hbi;
+	__u32                   vbi;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_core_config - ISP core registers configuration
+ *
+ * @version:                    Version info
+ * @vid_ds16_r2pd:              Enables Y and C merging PD output for video DS16
+ * @vid_ds4_r2pd:               Enables Y and C merging PD output for video DS4
+ * @disp_ds16_r2pd:             Enables Y and C merging PD output for disp DS16
+ * @disp_ds4_r2pd:              Enables Y and C merging PD output for disp DS4
+ * @dsp_streaming_tap_point:    This selects source for DSP streaming interface
+ * @ihist_src_sel:              Selects input for IHIST module
+ * @hdr_be_src_sel:             Selects input for HDR BE module
+ * @hdr_bhist_src_sel:          Selects input for HDR BHIST module
+ * @input_mux_sel_pdaf:         Selects input for PDAF
+ * @input_mux_sel_pp:           Selects input for Pixel Pipe
+ * @core_cfg_flag:              Core config flag to set HDR mux/PP
+ *                              input format type
+ */
+struct cam_isp_core_config {
+	__u32     version;
+	__u32     vid_ds16_r2pd;
+	__u32     vid_ds4_r2pd;
+	__u32     disp_ds16_r2pd;
+	__u32     disp_ds4_r2pd;
+	__u32     dsp_streaming_tap_point;
+	__u32     ihist_src_sel;
+	__u32     hdr_be_src_sel;
+	__u32     hdr_bhist_src_sel;
+	__u32     input_mux_sel_pdaf;
+	__u32     input_mux_sel_pp;
+	__u32     core_cfg_flag;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sfe_core_config - SFE core registers configuration
+ *
+ * @version       : Version info
+ * @mode_sel      : Selects core for sHDR/non-sHDR mode
+ * @ops_mode_cfg  : Selects core if is inline/offline mode
+ * @fs_mode_cfg   : Selects output in fast shutter mode
+ * @sfe_params    : SFE params for future use
+ */
+struct cam_isp_sfe_core_config {
+	__u32   version;
+	__u32   mode_sel;
+	__u32   ops_mode_cfg;
+	__u32   fs_mode_cfg;
+	__u32   sfe_params[6];
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sfe_scratch_buf_info - Scratch buf info
+ *
+ * @mem_handle             : Scratch buffer handle
+ * @offset                 : Offset to the buffer
+ * @width                  : Width in pixels
+ * @height                 : Height in pixels
+ * @stride                 : Stride in pixels
+ * @slice_height           : Slice height in lines
+ * @resource_type          : rsrc type
+ * @scratch_buf_params     : for future use
+ */
+struct cam_isp_sfe_scratch_buf_info {
+	__s32     mem_handle;
+	__u32     offset;
+	__u32     width;
+	__u32     height;
+	__u32     stride;
+	__u32     slice_height;
+	__u32     resource_type;
+	__u32     scratch_buf_params[5];
+};
+
+/**
+ * struct cam_isp_sfe_init_scratch_buf_config - SFE init buffer cfg
+ *        Provides scratch buffer info for SFE ports
+ *        as part of INIT packet
+ *
+ * @num_ports         : Number of ports
+ * @reserved          : reserved
+ * @port_scratch_cfg  : scratch buffer info
+ */
+struct cam_isp_sfe_init_scratch_buf_config {
+	__u32  num_ports;
+	__u32  reserved;
+	union {
+		struct cam_isp_sfe_scratch_buf_info port_scratch_cfg[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_sfe_scratch_buf_info, port_scratch_cfg_flex);
+	};
+};
+
+/**
+ * struct cam_isp_predict_fcg_config - FCG config in a single prediction
+ *
+ * @version:                    Version Info
+ * @phase_index_g:              Starting index of LUT for G channel in phase
+ * @phase_index_r:              Starting index of LUT for R channel in phase
+ * @phase_index_b:              Starting index of LUT for B channel in phase
+ * @stats_index_g:              Starting index of LUT for G channel in stats
+ * @stats_index_r:              Starting index of LUT for R channel in stats
+ * @stats_index_b:              Starting index of LUT for B channel in stats
+ * @num_valid_params:           Number of valid params being used
+ * @valid_param_mask:           Indicate the exact params being used
+ * @params:                     Params for future change
+ */
+struct cam_isp_predict_fcg_config {
+	__u32                                   version;
+	__u32                                   phase_index_g;
+	__u32                                   phase_index_r;
+	__u32                                   phase_index_b;
+	__u32                                   stats_index_g;
+	__u32                                   stats_index_r;
+	__u32                                   stats_index_b;
+	__u32                                   num_valid_params;
+	__u32                                   valid_param_mask;
+	__u32                                   params[5];
+};
+
+/**
+ * struct cam_isp_ch_ctx_fcg_config - FCG config in a single channel for SFE/IFE
+ *                                    or in a single context in TFE
+ *
+ * @version:                    Version Info
+ * @fcg_ch_ctx_id:              Index of the channel to be configured that FCG
+ *                              blocks reside on. If one wants to config FCG
+ *                              block for IFE/SFE, CAM_ISP_FCG_MASK_CH0/1/2 is
+ *                              used. If one wants to config FCG block for TFE,
+ *                              multi context mask is used.
+ * @fcg_enable_mask:            Indicate which module will be enabled for
+ *                              FCG. For example, if one wants to config
+ *                              SFE FCG STATS module, CAM_ISP_FCG_ENABLE_STATS
+ *                              will be set in mask
+ * @num_valid_params:           Number of valid params being used
+ * @valid_param_mask:           Indicate the exact params being used
+ * @params:                     Params for future change
+ * @predicted_fcg_configs:      Pointer to fcg config for each prediction of
+ *                              the channel in serial order
+ */
+struct cam_isp_ch_ctx_fcg_config {
+	__u32                                   version;
+	__u32                                   fcg_ch_ctx_id;
+	__u32                                   fcg_enable_mask;
+	__u32                                   num_valid_params;
+	__u32                                   valid_param_mask;
+	__u32                                   params[5];
+	union {
+		struct cam_isp_predict_fcg_config   predicted_fcg_configs[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_predict_fcg_config, predicted_fcg_configs_flex);
+	};
+};
+
+/**
+ * struct cam_isp_generic_fcg_config - FCG config for a frame
+ *
+ * @version:                    Version info
+ * @size:                       Size for the whole FCG configurations
+ * @num_ch_ctx:                 Number of channels for fcg config in SFE/IFE
+ *                              or number of contexts in TFE
+ * @num_predictions:            Number of predictions for each channel
+ *                              in SFE/IFE or for each context in TFE
+ * @num_valid_params:           Number of valid params being used
+ * @valid_param_mask:           Indicate the exact params being used
+ * @params:                     Params for future change
+ * @ch_ctx_fcg_configs:         Pointer to fcg config for each channel in
+ *                              SFE/IFE or for each context in TFE
+ */
+struct cam_isp_generic_fcg_config {
+	__u32                                  version;
+	__u32                                  size;
+	__u32                                  num_ch_ctx;
+	__u32                                  num_predictions;
+	__u32                                  num_valid_params;
+	__u32                                  valid_params_mask;
+	__u32                                  params[4];
+	union {
+		struct cam_isp_ch_ctx_fcg_config   ch_ctx_fcg_configs[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_ch_ctx_fcg_config, ch_ctx_fcg_configs_flex);
+	};
+};
+
+/**
+ * struct cam_isp_tpg_core_config - TPG core registers configuration
+ *
+ * @version          : Version info
+ * @vc_dt_pattern_id : TPG pattern - SparsePD, sHDR etc.
+ * @qcfa_en          : Selects qcfa in color bar
+ * @pix_pattern      : Pix pattern color bar cfg
+ * @hbi_clk_cnt      : Number of HBI # of cycles
+ * @vbi_clk_cnt      : Number of VBI # of cycles
+ * @throttle_pattern : Defines bubble pattern in throttler
+ * @tpg_params       : TPG params for future use
+ */
+struct cam_isp_tpg_core_config {
+	__u32   version;
+	__u32   vc_dt_pattern_id;
+	__u32   qcfa_en;
+	__u32   pix_pattern;
+	__u32   hbi_clk_cnt;
+	__u32   vbi_clk_cnt;
+	__u32   throttle_pattern;
+	__u32   tpg_params[3];
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sensor_stream_config  -  camera sensor stream configurations
+ *
+ * @version                     : version details
+ * @sensor_id                   : camera sensor unique index
+ * @context_id                  : sensor context id to which this vc/dt belongs to
+ * @vc                          : input virtual channel number
+ * @dt                          : input data type number
+ * @color_filter_arrangement    : indicates YUV CHROMA Downscale conversion enabled
+ * @decode_format               : input data format
+ * @path_id                     : indicates pxl or rdi path
+ * @error_threshold             : Error Threshold
+ * @syncId                      : if sensors are in sync then it indicates which
+                                  all sensors are in sync, sharing same sync id.
+                                  syncid = -1 indicates sensor is not in sync mode
+ * @frame_freeze_count          : if calculated CRC value is same for consecutive
+                                  frames then it is frame freeze.
+                                  frame freeze count indicates tolerable rate for
+                                  consecutive frame freezes
+ * @reserved                    : Reserved field for allignment
+ */
+struct cam_isp_sensor_stream_config {
+	__u32     version;
+	__u32     sensor_id;
+	__u32     context_id;
+	__u32     vc;
+	__u32     dt;
+	__u32     color_filter_arrangement;
+	__u32     decode_format;
+	__u32     path_id;
+	__u32     error_threshold;
+	__u32     sync_id;
+	__u32     frame_freeze_count;
+	__u64     reserved;
+};
+
+/**
+ * struct cam_isp_stream_grp_config  -  camera sensor stream group configurations
+ *
+ * @version                     : version details
+ * @res_type                    : input resource type
+ * @lane_type                   : lane type: c-phy or d-phy.
+ * @lane_num                    : active lane number
+ * @lane_cfg                    : lane configurations: 4 bits per lane
+ * @feature_mask                : feature flag
+ * @stream_cfg_cnt              : count of number of sensor configurations
+ * @enable_error_recovery       : indicates error recovery is enabled/disabled
+ * @recovery_threshold          : indicates recovery threshold.
+ * @reserved                    : Reserved field for allignment
+ * @stream_cfg                  : stream config data
+ */
+struct cam_isp_stream_grp_config {
+	__u32                                 version;
+	__u32                                 res_type;
+	__u32                                 lane_type;
+	__u32                                 lane_num;
+	__u32                                 lane_cfg;
+	__u32                                 feature_mask;
+	__u32                                 stream_cfg_cnt;
+	bool                                  enable_error_recovery;
+	__u32                                 recovery_threshold;
+	__u32                                 reserved;
+	struct cam_isp_sensor_stream_config   stream_cfg[CAM_ISP_STREAM_CFG_MAX];
+};
+
+/**
+ * struct cam_isp_sensor_group_config  -  sensor group configurations
+ *
+ * @version                     : version details
+ * @num_grp_cfg                 : count of total active group configs
+ * @stream_grp_cfg              : stream group data
+ */
+struct cam_isp_sensor_group_config {
+	__u32                             version;
+	__u32                             num_grp_cfg;
+	struct cam_isp_stream_grp_config  stream_grp_cfg[CAM_ISP_STREAM_GROUP_CFG_MAX];
+};
+
+/**
+ * struct cam_isp_acquire_hw_info - ISP acquire HW params
+ *
+ * @common_info_version  : Version of common info struct used
+ * @common_info_size     : Size of common info struct used
+ * @common_info_offset   : Offset of common info from start of data
+ * @num_inputs           : Number of inputs
+ * @input_info_version   : Version of input info struct used
+ * @input_info_size      : Size of input info struct used
+ * @input_info_offset    : Offset of input info from start of data
+ * @data                 : Start of data region
+ */
+struct cam_isp_acquire_hw_info {
+	__u16             common_info_version;
+	__u16             common_info_size;
+	__u32             common_info_offset;
+	__u32             num_inputs;
+	__u32             input_info_version;
+	__u32             input_info_size;
+	__u32             input_info_offset;
+	__u64             data;
+};
+
+/**
+ * struct cam_isp_vfe_wm_config  -  VFE write master config per port
+ *
+ * @port_type        : Unique ID of output port
+ * @wm_mode          : Write master mode
+ *                     0x0 - Line based mode
+ *                     0x1 - Frame based mode
+ *                     0x2 - Index based mode, valid for BAF only
+ * @h_init           : Horizontal starting coordinate in pixels. Must be a
+ *                     multiple of 3 for TP10 format
+ * @height           : Height in pixels
+ * @width            : Width in pixels
+ * @virtual_frame_en : Enabling virtual frame will prevent actual request from
+ *                     being sent to NOC
+ * @stride           : Write master stride
+ * @offset           : Write master offset
+ * @addr_reuse_en    : Enabling addr-reuse will write output to the same addr
+ *                     after the last addr that was read from FIFO.
+ * @packer_format    : Update packer format for Write master config
+ * @reserved_3       : Reserved field for Write master config
+ *                     For acquired version 3-->corresponds to context_id_mask
+ * @reserved_4       : Reserved field for Write master config
+ */
+struct cam_isp_vfe_wm_config {
+	__u32                      port_type;
+	__u32                      wm_mode;
+	__u32                      h_init;
+	__u32                      height;
+	__u32                      width;
+	__u32                      virtual_frame_en;
+	__u32                      stride;
+	__u32                      offset;
+	__u32                      addr_reuse_en;
+	__u32                      packer_format;
+	__u32                      reserved_3;
+	__u32                      reserved_4;
+};
+
+/**
+ * struct cam_isp_vfe_wm_config_v2  -  VFE write master config per port
+ *
+ * @version          : Version for this structure
+ * @port_type        : Unique ID of output port
+ * @wm_mode          : Write master mode
+ *                     0x0 - Line based mode
+ *                     0x1 - Frame based mode
+ *                     0x2 - Index based mode, valid for BAF only
+ * @h_init           : Horizontal starting coordinate in pixels. Must be a
+ *                     multiple of 3 for TP10 format
+ * @height           : Height in pixels
+ * @width            : Width in pixels
+ * @virtual_frame_en : Enabling virtual frame will prevent actual request from
+ *                     being sent to NOC
+ * @stride           : Write master stride
+ * @offset           : Write master offset
+ * @addr_reuse_en    : Enabling addr-reuse will write output to the same addr
+ *                     after the last addr that was read from FIFO.
+ * @packer_format    : Update packer format for Write master config
+ * @offset_in_bytes  : Offest in bytes
+ * @context_id_mask  : context id mask in case of multi context
+ * @use_pack         : Hint to use WM pack in case of per frame changes
+ * @enable           : Enable/Disable WM at run time
+ * @params           : Indicate params supported, to accommodate future changes
+ * @param_mask       : Indicate params supported, to accommodate future changes
+ */
+struct cam_isp_vfe_wm_config_v2 {
+	__u32                      version;
+	__u32                      port_type;
+	__u32                      wm_mode;
+	__u32                      h_init;
+	__u32                      height;
+	__u32                      width;
+	__u32                      virtual_frame_en;
+	__u32                      stride;
+	__u32                      offset;
+	__u32                      addr_reuse_en;
+	__u32                      packer_format;
+	__u32                      offset_in_bytes;
+	__u32                      context_id_mask;
+	__u32                      use_pack;
+	__u32                      enable;
+	__u32                      param_mask;
+	__u32                      params[5];
+};
+
+/**
+ * struct cam_isp_vfe_out_config_v2  -  VFE write master config
+ *
+ * @version        : Version for this structure
+ * @num_ports      : Number of ports
+ * @reserved       : Reserved field
+ * @wm_config      : VFE out config
+ * @params         : Indicate params supported, to accommodate future changes
+ * @param_mask     : Indicate params supported, to accommodate future changes
+ */
+struct cam_isp_vfe_out_config_v2 {
+	__u32                           version;
+	__u32                           num_ports;
+	__u32                           reserved;
+	struct cam_isp_vfe_wm_config_v2 wm_config[1];
+	__u32                           param_mask;
+	__u32                           params[5];
+};
+
+/**
+ * struct cam_isp_vfe_out_config  -  VFE write master config
+ *
+ * @num_ports      : Number of ports
+ * @reserved       : Reserved field
+ * @wm_config      : VFE out config
+ */
+struct cam_isp_vfe_out_config {
+	__u32                        num_ports;
+	__u32                        reserved;
+	union {
+		struct cam_isp_vfe_wm_config wm_config[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_vfe_wm_config, wm_config_flex);
+	};
+};
+
+/**
+ * struct cam_isp_mode_switch_info  -  Dynamic mode switch info
+ *
+ * @mup                     : MUP for incoming VC of next frame
+ * @num_expoures            : Number of exposures
+ * @reserved                : Reserved
+ */
+struct cam_isp_mode_switch_info{
+	__u32                                mup;
+	__u32                                num_expoures;
+	__u32                                reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_nfi_mode_switch_info - New Frame ID (NFI) Based Switching Scheme info
+ *
+ * @version                 : Version info
+ * @mode_id                 : Mode ID value for the next frame
+ * @modeid_vc               : The VC with which the embedded packet with MODE ID comes with.
+ * @x_offset                : X offset of MODE ID location in horizontal
+ *                            direction within single EBD line packet, unit is byte.
+ * @y_offset                : Y offset of MODE ID location in vertical direction
+ *                            within EBD Lines, unit is line packet.
+ * @reg_length              : Number of bytes for each MODE ID
+ * @num_valid_params        : Number of valid params
+ * @param_mask              : Mask to indicate fields in params
+ * @params                  : Additional Params
+ */
+struct cam_isp_nfi_mode_switch_info {
+	__u32                                version;
+	__u32                                mode_id;
+	__u32                                modeid_vc;
+	__u32                                x_offset;
+	__u32                                y_offset;
+	__u32                                reg_length;
+	__u32                                num_valid_params;
+	__u32                                param_mask;
+	__u32                                params[4];
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sfe_wm_exp_order_config - SFE write master
+ *                                          exposure order config
+ *
+ *    This config will reflect for corresponding RM as well
+ *
+ * @res_type          : output resource type defined in file
+ *                      cam_isp_sfe.h or cam_isp_ife.h
+ * @additional_params : Params for future use
+ */
+struct cam_isp_sfe_wm_exp_order_config {
+	__u32         res_type;
+	__u32         additional_params[5];
+};
+
+/**
+ * struct cam_isp_sfe_exp_config - SFE out exposure config
+ *
+ *    Exp order is determined by it's index in wm_config[]
+ *    The last resource in the array will be considered as
+ *    last [shortest] exposure.
+ *
+ * @num_ports      : Number of ports
+ * @reserved       : Reserved field
+ * @wm_config      : WM exp config
+ */
+struct cam_isp_sfe_exp_config {
+	__u32                                   num_ports;
+	__u32                                   reserved;
+	union {
+		struct cam_isp_sfe_wm_exp_order_config  wm_config[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_sfe_wm_exp_order_config, wm_config_flex);
+	};
+};
+
+/**
+ * struct cam_isp_discard_initial_frames - Discard init frames
+ *
+ *   Some sensors require discarding the initial frames
+ *   after the sensor is streamed on. The discard would be
+ *   applied on all paths [IPP/PPP/RDIx] for the given
+ *   pipeline.
+ *
+ * @num_frames              : Number of frames to be discarded
+ * @discard_params          : Params for future use
+ */
+struct cam_isp_discard_initial_frames {
+	__u32                    num_frames;
+	__u32                    discard_params[5];
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_wm_bw_limiter_config - ISP write master
+ *                                       BW limter config
+ *
+ *
+ * @res_type          : output resource type defined in file
+ *                      cam_isp_sfe.h or cam_isp_ife.h
+ * @enable_limiter    : 0 for disable else enabled
+ * @counter_limit     : Max counter value
+ * @additional_params : Params for future use
+ */
+struct cam_isp_wm_bw_limiter_config {
+	__u32         res_type;
+	__u32         enable_limiter;
+	__u32         counter_limit[CAM_PACKET_MAX_PLANES];
+	__u32         additional_params[5];
+};
+
+/**
+ * struct cam_isp_out_rsrc_bw_limiter_config - ISP out rsrc BW limiter config
+ *
+ *    Configure BW limiter for ISP WMs
+ *
+ * @num_ports        : Number of ports
+ * @reserved         : Reserved field
+ * @bw_limit_config  : WM BW limiter config
+ */
+struct cam_isp_out_rsrc_bw_limiter_config {
+	__u32                                   num_ports;
+	__u32                                   reserved;
+	union {
+		struct cam_isp_wm_bw_limiter_config     bw_limiter_config[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_wm_bw_limiter_config, bw_limiter_config_flex);
+	};
+};
+
+/**
+ * struct cam_isp_init_config - Init config for IFE/CSID/SFE
+ *
+ *    Any configurations to be consumed by KMD
+ *    prior to stream on - one time configuration per stream.
+ *    This blob is expected only in INIT packet. Per frame
+ *    dynamic settings will not be part of this blob.
+ *
+ * @epoch_factor       : % factor for epoch config with respect to frame height
+ *                       If factor is 60, epoch will be configured to 3/5th of
+ *                       the frame height. If this field is 0,
+ *                       KMD will configure default 50% of the height
+ * @additional_params  : Reserved fields for future use
+ */
+struct cam_isp_init_config {
+	struct cam_isp_epoch_height_config {
+	__u32             epoch_factor;
+	} epoch_cfg;
+
+	__u32             additional_params[19];
+};
+
+/**
+ * struct cam_isp_lcr_rdi_config - RDI res id to be muxed to LCR
+ *
+ *    Configure RDI Res id for LCR
+ *
+ * @res_id                   : Out port Res id, it is same as the out port
+ *                             configured during acquire. It would vary
+ *                             as per SFE or IFE. Based on this res id,
+ *                             Mux register in IFE will be programmed.
+ *                             Examples:
+ *                             IFE:
+ *                             CAM_ISP_IFE_OUT_RES_RDI_0
+ *                             SFE:
+ *                             CAM_ISP_SFE_OUT_RES_RDI_0
+ *                             This blob is expected as a part of init packet for
+ *                             all LCR cases. For SHDR-LCR cases, this can be used
+ *                             per request. For non-shdr cases, this blob is not
+ *                             expected as the input to LCR will remain same throughout
+ *                             the session
+ * @reserved                 : Reserved field
+ */
+struct cam_isp_lcr_rdi_config {
+	__u32                                   res_id;
+	__u32                                   reserved[5];
+};
+
+#define CAM_ISP_ACQUIRE_COMMON_VER0         0x1000
+
+#define CAM_ISP_ACQUIRE_COMMON_SIZE_VER0    0x0
+
+#define CAM_ISP_ACQUIRE_INPUT_VER0          0x2000
+
+#define CAM_ISP_ACQUIRE_INPUT_SIZE_VER0     sizeof(struct cam_isp_in_port_info)
+
+#define CAM_ISP_ACQUIRE_OUT_VER0            0x3000
+
+#define CAM_ISP_ACQUIRE_OUT_SIZE_VER0       sizeof(struct cam_isp_out_port_info)
+
+#endif /* __UAPI_CAM_ISP_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_ife.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_ife.h
@@ -0,0 +1,84 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_IFE_H__
+#define __UAPI_CAM_ISP_IFE_H__
+
+/* IFE output port resource type (global unique)*/
+#define CAM_ISP_IFE_OUT_RES_BASE               0x3000
+
+#define CAM_ISP_IFE_OUT_RES_FULL                 (CAM_ISP_IFE_OUT_RES_BASE + 0)
+#define CAM_ISP_IFE_OUT_RES_DS4                  (CAM_ISP_IFE_OUT_RES_BASE + 1)
+#define CAM_ISP_IFE_OUT_RES_DS16                 (CAM_ISP_IFE_OUT_RES_BASE + 2)
+#define CAM_ISP_IFE_OUT_RES_RAW_DUMP             (CAM_ISP_IFE_OUT_RES_BASE + 3)
+#define CAM_ISP_IFE_OUT_RES_FD                   (CAM_ISP_IFE_OUT_RES_BASE + 4)
+#define CAM_ISP_IFE_OUT_RES_PDAF                 (CAM_ISP_IFE_OUT_RES_BASE + 5)
+#define CAM_ISP_IFE_OUT_RES_RDI_0                (CAM_ISP_IFE_OUT_RES_BASE + 6)
+#define CAM_ISP_IFE_OUT_RES_RDI_1                (CAM_ISP_IFE_OUT_RES_BASE + 7)
+#define CAM_ISP_IFE_OUT_RES_RDI_2                (CAM_ISP_IFE_OUT_RES_BASE + 8)
+#define CAM_ISP_IFE_OUT_RES_RDI_3                (CAM_ISP_IFE_OUT_RES_BASE + 9)
+#define CAM_ISP_IFE_OUT_RES_STATS_HDR_BE         (CAM_ISP_IFE_OUT_RES_BASE + 10)
+#define CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST      (CAM_ISP_IFE_OUT_RES_BASE + 11)
+#define CAM_ISP_IFE_OUT_RES_STATS_TL_BG          (CAM_ISP_IFE_OUT_RES_BASE + 12)
+#define CAM_ISP_IFE_OUT_RES_STATS_BF             (CAM_ISP_IFE_OUT_RES_BASE + 13)
+#define CAM_ISP_IFE_OUT_RES_STATS_AWB_BG         (CAM_ISP_IFE_OUT_RES_BASE + 14)
+#define CAM_ISP_IFE_OUT_RES_STATS_BHIST          (CAM_ISP_IFE_OUT_RES_BASE + 15)
+#define CAM_ISP_IFE_OUT_RES_STATS_RS             (CAM_ISP_IFE_OUT_RES_BASE + 16)
+#define CAM_ISP_IFE_OUT_RES_STATS_CS             (CAM_ISP_IFE_OUT_RES_BASE + 17)
+#define CAM_ISP_IFE_OUT_RES_STATS_IHIST          (CAM_ISP_IFE_OUT_RES_BASE + 18)
+#define CAM_ISP_IFE_OUT_RES_FULL_DISP            (CAM_ISP_IFE_OUT_RES_BASE + 19)
+#define CAM_ISP_IFE_OUT_RES_DS4_DISP             (CAM_ISP_IFE_OUT_RES_BASE + 20)
+#define CAM_ISP_IFE_OUT_RES_DS16_DISP            (CAM_ISP_IFE_OUT_RES_BASE + 21)
+#define CAM_ISP_IFE_OUT_RES_2PD                  (CAM_ISP_IFE_OUT_RES_BASE + 22)
+#define CAM_ISP_IFE_OUT_RES_RDI_RD               (CAM_ISP_IFE_OUT_RES_BASE + 23)
+#define CAM_ISP_IFE_OUT_RES_LCR                  (CAM_ISP_IFE_OUT_RES_BASE + 24)
+#define CAM_ISP_IFE_OUT_RES_SPARSE_PD            (CAM_ISP_IFE_OUT_RES_BASE + 25)
+#define CAM_ISP_IFE_OUT_RES_PREPROCESS_2PD       (CAM_ISP_IFE_OUT_RES_BASE + 26)
+#define CAM_ISP_IFE_OUT_RES_AWB_BFW              (CAM_ISP_IFE_OUT_RES_BASE + 27)
+#define CAM_ISP_IFE_OUT_RES_STATS_AEC_BE         (CAM_ISP_IFE_OUT_RES_BASE + 28)
+#define CAM_ISP_IFE_OUT_RES_LTM_STATS            (CAM_ISP_IFE_OUT_RES_BASE + 29)
+#define CAM_ISP_IFE_OUT_RES_STATS_GTM_BHIST      (CAM_ISP_IFE_OUT_RES_BASE + 30)
+#define CAM_ISP_IFE_LITE_OUT_RES_STATS_BG        (CAM_ISP_IFE_OUT_RES_BASE + 31)
+#define CAM_ISP_IFE_LITE_OUT_RES_PREPROCESS_RAW  (CAM_ISP_IFE_OUT_RES_BASE + 32)
+#define CAM_ISP_IFE_OUT_RES_STATS_CAF            (CAM_ISP_IFE_OUT_RES_BASE + 33)
+#define CAM_ISP_IFE_OUT_RES_STATS_BAYER_RS       (CAM_ISP_IFE_OUT_RES_BASE + 34)
+#define CAM_ISP_IFE_OUT_RES_PDAF_PARSED_DATA     (CAM_ISP_IFE_OUT_RES_BASE + 35)
+#define CAM_ISP_IFE_OUT_RES_STATS_ALSC           (CAM_ISP_IFE_OUT_RES_BASE + 36)
+#define CAM_ISP_IFE_OUT_RES_DS2                  (CAM_ISP_IFE_OUT_RES_BASE + 37)
+#define CAM_ISP_IFE_OUT_RES_IR                   (CAM_ISP_IFE_OUT_RES_BASE + 38)
+#define CAM_ISP_IFE_OUT_RES_RDI_4                (CAM_ISP_IFE_OUT_RES_BASE + 39)
+#define CAM_ISP_IFE_OUT_RES_STATS_TMC_BHIST      (CAM_ISP_IFE_OUT_RES_BASE + 40)
+#define CAM_ISP_IFE_OUT_RES_STATS_AF_BHIST       (CAM_ISP_IFE_OUT_RES_BASE + 41)
+#define CAM_ISP_IFE_OUT_RES_STATS_AEC_BHIST      (CAM_ISP_IFE_OUT_RES_BASE + 42)
+#define CAM_ISP_IFE_OUT_RES_RDI_5                (CAM_ISP_IFE_OUT_RES_BASE + 43)
+#define CAM_ISP_IFE_OUT_RES_AI_OUT_1             (CAM_ISP_IFE_OUT_RES_BASE + 44)
+#define CAM_ISP_IFE_OUT_RES_AI_OUT_2             (CAM_ISP_IFE_OUT_RES_BASE + 45)
+#define CAM_ISP_IFE_OUT_RES_STATS_IR_BG          (CAM_ISP_IFE_OUT_RES_BASE + 46)
+#define CAM_ISP_IFE_OUT_RES_STATS_IR_BHIST       (CAM_ISP_IFE_OUT_RES_BASE + 47)
+#define CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI0         (CAM_ISP_IFE_OUT_RES_BASE + 48)
+#define CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI1         (CAM_ISP_IFE_OUT_RES_BASE + 49)
+#define CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI2         (CAM_ISP_IFE_OUT_RES_BASE + 50)
+#define CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI3         (CAM_ISP_IFE_OUT_RES_BASE + 51)
+#define CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI4         (CAM_ISP_IFE_OUT_RES_BASE + 52)
+#define CAM_ISP_IFE_OUT_RES_VIRTUAL_RDI5         (CAM_ISP_IFE_OUT_RES_BASE + 53)
+
+/* IFE input port resource type (global unique) */
+#define CAM_ISP_IFE_IN_RES_BASE                 0x4000
+
+#define CAM_ISP_IFE_IN_RES_TPG                 (CAM_ISP_IFE_IN_RES_BASE + 0)
+#define CAM_ISP_IFE_IN_RES_PHY_0               (CAM_ISP_IFE_IN_RES_BASE + 1)
+#define CAM_ISP_IFE_IN_RES_PHY_1               (CAM_ISP_IFE_IN_RES_BASE + 2)
+#define CAM_ISP_IFE_IN_RES_PHY_2               (CAM_ISP_IFE_IN_RES_BASE + 3)
+#define CAM_ISP_IFE_IN_RES_PHY_3               (CAM_ISP_IFE_IN_RES_BASE + 4)
+#define CAM_ISP_IFE_IN_RES_PHY_4               (CAM_ISP_IFE_IN_RES_BASE + 5)
+#define CAM_ISP_IFE_IN_RES_PHY_5               (CAM_ISP_IFE_IN_RES_BASE + 6)
+#define CAM_ISP_IFE_IN_RES_RD                  (CAM_ISP_IFE_IN_RES_BASE + 7)
+#define CAM_ISP_IFE_IN_RES_CPHY_TPG_0          (CAM_ISP_IFE_IN_RES_BASE + 8)
+#define CAM_ISP_IFE_IN_RES_CPHY_TPG_1          (CAM_ISP_IFE_IN_RES_BASE + 9)
+#define CAM_ISP_IFE_IN_RES_CPHY_TPG_2          (CAM_ISP_IFE_IN_RES_BASE + 10)
+#define CAM_ISP_IFE_IN_RES_MAX                 (CAM_ISP_IFE_IN_RES_BASE + 11)
+
+#endif /* __UAPI_CAM_ISP_IFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_sfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_sfe.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_SFE_H__
+#define __UAPI_CAM_ISP_SFE_H__
+
+/* SFE output port resource type */
+#define CAM_ISP_SFE_OUT_RES_BASE              0x6000
+
+#define CAM_ISP_SFE_OUT_RES_RDI_0             (CAM_ISP_SFE_OUT_RES_BASE + 0)
+#define CAM_ISP_SFE_OUT_RES_RDI_1             (CAM_ISP_SFE_OUT_RES_BASE + 1)
+#define CAM_ISP_SFE_OUT_RES_RDI_2             (CAM_ISP_SFE_OUT_RES_BASE + 2)
+#define CAM_ISP_SFE_OUT_RES_RDI_3             (CAM_ISP_SFE_OUT_RES_BASE + 3)
+#define CAM_ISP_SFE_OUT_RES_RDI_4             (CAM_ISP_SFE_OUT_RES_BASE + 4)
+#define CAM_ISP_SFE_OUT_BE_STATS_0            (CAM_ISP_SFE_OUT_RES_BASE + 5)
+#define CAM_ISP_SFE_OUT_BHIST_STATS_0         (CAM_ISP_SFE_OUT_RES_BASE + 6)
+#define CAM_ISP_SFE_OUT_BE_STATS_1            (CAM_ISP_SFE_OUT_RES_BASE + 7)
+#define CAM_ISP_SFE_OUT_BHIST_STATS_1         (CAM_ISP_SFE_OUT_RES_BASE + 8)
+#define CAM_ISP_SFE_OUT_BE_STATS_2            (CAM_ISP_SFE_OUT_RES_BASE + 9)
+#define CAM_ISP_SFE_OUT_BHIST_STATS_2         (CAM_ISP_SFE_OUT_RES_BASE + 10)
+#define CAM_ISP_SFE_OUT_RES_LCR               (CAM_ISP_SFE_OUT_RES_BASE + 11)
+#define CAM_ISP_SFE_OUT_RES_RAW_DUMP          (CAM_ISP_SFE_OUT_RES_BASE + 12)
+#define CAM_ISP_SFE_OUT_RES_IR                (CAM_ISP_SFE_OUT_RES_BASE + 13)
+#define CAM_ISP_SFE_OUT_BAYER_RS_STATS_0      (CAM_ISP_SFE_OUT_RES_BASE + 14)
+#define CAM_ISP_SFE_OUT_BAYER_RS_STATS_1      (CAM_ISP_SFE_OUT_RES_BASE + 15)
+#define CAM_ISP_SFE_OUT_BAYER_RS_STATS_2      (CAM_ISP_SFE_OUT_RES_BASE + 16)
+#define CAM_ISP_SFE_OUT_HDR_STATS             (CAM_ISP_SFE_OUT_RES_BASE + 17)
+
+/* This Macro is deprecated and shall not be used */
+#define CAM_ISP_SFE_OUT_RES_MAX               (CAM_ISP_SFE_OUT_RES_BASE + 17)
+
+/* SFE input port resource type */
+#define CAM_ISP_SFE_IN_RES_BASE               0x5000
+
+#define CAM_ISP_SFE_INLINE_PIX                (CAM_ISP_SFE_IN_RES_BASE + 0)
+#define CAM_ISP_SFE_IN_RD_0                   (CAM_ISP_SFE_IN_RES_BASE + 1)
+#define CAM_ISP_SFE_IN_RD_1                   (CAM_ISP_SFE_IN_RES_BASE + 2)
+#define CAM_ISP_SFE_IN_RD_2                   (CAM_ISP_SFE_IN_RES_BASE + 3)
+#define CAM_ISP_SFE_IN_RES_MAX                (CAM_ISP_SFE_IN_RES_BASE + 4)
+
+#endif /* __UAPI_CAM_ISP_SFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_tfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_tfe.h
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_TFE_H__
+#define __UAPI_CAM_ISP_TFE_H__
+
+/* TFE output port resource id number */
+#define CAM_ISP_TFE_OUT_RES_BASE               0x1
+
+#define CAM_ISP_TFE_OUT_RES_FULL               (CAM_ISP_TFE_OUT_RES_BASE + 0)
+#define CAM_ISP_TFE_OUT_RES_RAW_DUMP           (CAM_ISP_TFE_OUT_RES_BASE + 1)
+#define CAM_ISP_TFE_OUT_RES_PDAF               (CAM_ISP_TFE_OUT_RES_BASE + 2)
+#define CAM_ISP_TFE_OUT_RES_RDI_0              (CAM_ISP_TFE_OUT_RES_BASE + 3)
+#define CAM_ISP_TFE_OUT_RES_RDI_1              (CAM_ISP_TFE_OUT_RES_BASE + 4)
+#define CAM_ISP_TFE_OUT_RES_RDI_2              (CAM_ISP_TFE_OUT_RES_BASE + 5)
+#define CAM_ISP_TFE_OUT_RES_STATS_HDR_BE       (CAM_ISP_TFE_OUT_RES_BASE + 6)
+#define CAM_ISP_TFE_OUT_RES_STATS_HDR_BHIST    (CAM_ISP_TFE_OUT_RES_BASE + 7)
+#define CAM_ISP_TFE_OUT_RES_STATS_TL_BG        (CAM_ISP_TFE_OUT_RES_BASE + 8)
+#define CAM_ISP_TFE_OUT_RES_STATS_BF           (CAM_ISP_TFE_OUT_RES_BASE + 9)
+#define CAM_ISP_TFE_OUT_RES_STATS_AWB_BG       (CAM_ISP_TFE_OUT_RES_BASE + 10)
+#define CAM_ISP_TFE_OUT_RES_STATS_RS           (CAM_ISP_TFE_OUT_RES_BASE + 11)
+#define CAM_ISP_TFE_OUT_RES_DS4                (CAM_ISP_TFE_OUT_RES_BASE + 12)
+#define CAM_ISP_TFE_OUT_RES_DS16               (CAM_ISP_TFE_OUT_RES_BASE + 13)
+#define CAM_ISP_TFE_OUT_RES_AI                 (CAM_ISP_TFE_OUT_RES_BASE + 14)
+#define CAM_ISP_TFE_OUT_RES_PD_LCR_STATS       (CAM_ISP_TFE_OUT_RES_BASE + 15)
+#define CAM_ISP_TFE_OUT_RES_PD_PREPROCESSED    (CAM_ISP_TFE_OUT_RES_BASE + 16)
+#define CAM_ISP_TFE_OUT_RES_PD_PARSED          (CAM_ISP_TFE_OUT_RES_BASE + 17)
+#define CAM_ISP_TFE_OUT_RES_MAX                (CAM_ISP_TFE_OUT_RES_BASE + 18)
+
+
+/* TFE input port resource type */
+#define CAM_ISP_TFE_IN_RES_BASE                 0x1
+
+#define CAM_ISP_TFE_IN_RES_TPG                 (CAM_ISP_TFE_IN_RES_BASE + 0)
+#define CAM_ISP_TFE_IN_RES_PHY_0               (CAM_ISP_TFE_IN_RES_BASE + 1)
+#define CAM_ISP_TFE_IN_RES_PHY_1               (CAM_ISP_TFE_IN_RES_BASE + 2)
+#define CAM_ISP_TFE_IN_RES_PHY_2               (CAM_ISP_TFE_IN_RES_BASE + 3)
+#define CAM_ISP_TFE_IN_RES_PHY_3               (CAM_ISP_TFE_IN_RES_BASE + 4)
+#define CAM_ISP_TFE_IN_RES_CPHY_TPG_0          (CAM_ISP_TFE_IN_RES_BASE + 8)
+#define CAM_ISP_TFE_IN_RES_CPHY_TPG_1          (CAM_ISP_TFE_IN_RES_BASE + 9)
+#define CAM_ISP_TFE_IN_RES_CPHY_TPG_2          (CAM_ISP_TFE_IN_RES_BASE + 10)
+#define CAM_ISP_TFE_IN_RES_MAX                 (CAM_ISP_TFE_IN_RES_BASE + 11)
+
+#endif /* __UAPI_CAM_ISP_TFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_vfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_isp_vfe.h
@@ -0,0 +1,51 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_VFE_H__
+#define __UAPI_CAM_ISP_VFE_H__
+
+/* VFE output port resource type  (global unique)  */
+#define CAM_ISP_VFE_OUT_RES_BASE               0x1000
+
+#define CAM_ISP_VFE_OUT_RES_ENC                (CAM_ISP_VFE_OUT_RES_BASE + 0)
+#define CAM_ISP_VFE_OUT_RES_VIEW               (CAM_ISP_VFE_OUT_RES_BASE + 1)
+#define CAM_ISP_VFE_OUT_RES_VID                (CAM_ISP_VFE_OUT_RES_BASE + 2)
+#define CAM_ISP_VFE_OUT_RES_RDI_0              (CAM_ISP_VFE_OUT_RES_BASE + 3)
+#define CAM_ISP_VFE_OUT_RES_RDI_1              (CAM_ISP_VFE_OUT_RES_BASE + 4)
+#define CAM_ISP_VFE_OUT_RES_RDI_2              (CAM_ISP_VFE_OUT_RES_BASE + 5)
+#define CAM_ISP_VFE_OUT_RES_RDI_3              (CAM_ISP_VFE_OUT_RES_BASE + 6)
+#define CAM_ISP_VFE_OUT_RES_STATS_AEC          (CAM_ISP_VFE_OUT_RES_BASE + 7)
+#define CAM_ISP_VFE_OUT_RES_STATS_AF           (CAM_ISP_VFE_OUT_RES_BASE + 8)
+#define CAM_ISP_VFE_OUT_RES_STATS_AWB          (CAM_ISP_VFE_OUT_RES_BASE + 9)
+#define CAM_ISP_VFE_OUT_RES_STATS_RS           (CAM_ISP_VFE_OUT_RES_BASE + 10)
+#define CAM_ISP_VFE_OUT_RES_STATS_CS           (CAM_ISP_VFE_OUT_RES_BASE + 11)
+#define CAM_ISP_VFE_OUT_RES_STATS_IHIST        (CAM_ISP_VFE_OUT_RES_BASE + 12)
+#define CAM_ISP_VFE_OUT_RES_STATS_SKIN         (CAM_ISP_VFE_OUT_RES_BASE + 13)
+#define CAM_ISP_VFE_OUT_RES_STATS_BG           (CAM_ISP_VFE_OUT_RES_BASE + 14)
+#define CAM_ISP_VFE_OUT_RES_STATS_BF           (CAM_ISP_VFE_OUT_RES_BASE + 15)
+#define CAM_ISP_VFE_OUT_RES_STATS_BE           (CAM_ISP_VFE_OUT_RES_BASE + 16)
+#define CAM_ISP_VFE_OUT_RES_STATS_BHIST        (CAM_ISP_VFE_OUT_RES_BASE + 17)
+#define CAM_ISP_VFE_OUT_RES_STATS_BF_SCALE     (CAM_ISP_VFE_OUT_RES_BASE + 18)
+#define CAM_ISP_VFE_OUT_RES_STATS_HDR_BE       (CAM_ISP_VFE_OUT_RES_BASE + 19)
+#define CAM_ISP_VFE_OUT_RES_STATS_HDR_BHIST    (CAM_ISP_VFE_OUT_RES_BASE + 20)
+#define CAM_ISP_VFE_OUT_RES_STATS_AEC_BG       (CAM_ISP_VFE_OUT_RES_BASE + 21)
+#define CAM_ISP_VFE_OUT_RES_CAMIF_RAW          (CAM_ISP_VFE_OUT_RES_BASE + 22)
+#define CAM_ISP_VFE_OUT_RES_IDEAL_RAW          (CAM_ISP_VFE_OUT_RES_BASE + 23)
+#define CAM_ISP_VFE_OUT_RES_MAX                (CAM_ISP_VFE_OUT_RES_BASE + 24)
+
+/* VFE input port_ resource type (global unique) */
+#define CAM_ISP_VFE_IN_RES_BASE                0x2000
+
+#define CAM_ISP_VFE_IN_RES_TPG                 (CAM_ISP_VFE_IN_RES_BASE + 0)
+#define CAM_ISP_VFE_IN_RES_PHY_0               (CAM_ISP_VFE_IN_RES_BASE + 1)
+#define CAM_ISP_VFE_IN_RES_PHY_1               (CAM_ISP_VFE_IN_RES_BASE + 2)
+#define CAM_ISP_VFE_IN_RES_PHY_2               (CAM_ISP_VFE_IN_RES_BASE + 3)
+#define CAM_ISP_VFE_IN_RES_PHY_3               (CAM_ISP_VFE_IN_RES_BASE + 4)
+#define CAM_ISP_VFE_IN_RES_PHY_4               (CAM_ISP_VFE_IN_RES_BASE + 5)
+#define CAM_ISP_VFE_IN_RES_PHY_5               (CAM_ISP_VFE_IN_RES_BASE + 6)
+#define CAM_ISP_VFE_IN_RES_FE                  (CAM_ISP_VFE_IN_RES_BASE + 7)
+#define CAM_ISP_VFE_IN_RES_MAX                 (CAM_ISP_VFE_IN_RES_BASE + 8)
+
+#endif /* __UAPI_CAM_ISP_VFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_jpeg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_jpeg.h
@@ -0,0 +1,143 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_JPEG_H__
+#define __UAPI_CAM_JPEG_H__
+
+#include <media/cam_defs.h>
+
+/* enc, dma, cdm(enc/dma) are used in querycap */
+#define CAM_JPEG_DEV_TYPE_ENC                                 0
+#define CAM_JPEG_DEV_TYPE_DMA                                 1
+#define CAM_JPEG_DEV_TYPE_MAX                                 2
+
+#define CAM_JPEG_NUM_DEV_PER_RES_MAX                          1
+
+/* definitions needed for jpeg aquire device */
+#define CAM_JPEG_RES_TYPE_ENC                                 0
+#define CAM_JPEG_RES_TYPE_DMA                                 1
+#define CAM_JPEG_RES_TYPE_MAX                                 2
+
+/* packet opcode types */
+#define CAM_JPEG_OPCODE_ENC_UPDATE                            0
+#define CAM_JPEG_OPCODE_DMA_UPDATE                            1
+
+/* ENC input port resource type */
+#define CAM_JPEG_ENC_INPUT_IMAGE                              0x0
+/* ENC output port resource type */
+#define CAM_JPEG_ENC_OUTPUT_IMAGE                             0x1
+#define CAM_JPEG_ENC_IO_IMAGES_MAX                            0x2
+
+/* DMA input port resource type */
+#define CAM_JPEG_DMA_INPUT_IMAGE                              0x0
+/* DMA output port resource type */
+#define CAM_JPEG_DMA_OUTPUT_IMAGE                             0x1
+#define CAM_JPEG_DMA_IO_IMAGES_MAX                            0x2
+
+#define CAM_JPEG_IMAGE_MAX                                    0x2
+
+/*JPEG Command Buffer Metadata types*/
+#define CAM_JPEG_ENC_PACKET_CONFIG_DATA                       0x00
+#define CAM_JPEG_DMA_PACKET_PLANE0_CONFIG_DATA                0x01
+#define CAM_JPEG_DMA_PACKET_PLANE1_CONFIG_DATA                0x02
+#define CAM_JPEG_PACKET_INOUT_PARAM                           0x03
+#define CAM_JPEG_PACKET_GENERIC_BLOB                          0x04
+
+/*JPEG Generic Blob Command buffer type*/
+#define CAM_JPEG_THUMBNAIL_SIZE_BLOB                          0x01
+
+/**
+ * struct cam_jpeg_thumbnail_size_blob - Blob containing information about maximum size of the
+ *                                       thumbnail image
+ *
+ * This blob contains information about the maximum size of the encoded thumbnail image that is
+ * considered valid.
+ *
+ * @threshold_size : Size threshold for the encoded Thumbnail image
+ * @reserved       : Reserved field
+ */
+struct cam_jpeg_thumbnail_size_blob {
+	__u32                 threshold_size;
+	__u32                 reserved[3];
+};
+
+/**
+ * struct cam_jpeg_dev_ver - Device information for particular hw type
+ *
+ * This is used to get device version info of JPEG ENC, JPEG DMA
+ * from hardware and use this info in CAM_QUERY_CAP IOCTL
+ *
+ * @size      : Size of struct passed
+ * @dev_type  : Hardware type for the cap info(jpeg enc, jpeg dma)
+ * @hw_ver    : Major, minor and incr values of a device version
+ */
+struct cam_jpeg_dev_ver {
+	__u32                 size;
+	__u32                 dev_type;
+	struct cam_hw_version hw_ver;
+};
+
+/**
+ * struct cam_jpeg_query_cap_cmd - JPEG query device capability payload
+ *
+ * @dev_iommu_handle : Jpeg iommu handles for secure/non secure
+ *      modes
+ * @cdm_iommu_handle : Iommu handles for secure/non secure modes
+ * @num_enc          : Number of encoder
+ * @num_dma          : Number of dma
+ * @dev_ver          : Returned device capability array
+ */
+struct cam_jpeg_query_cap_cmd {
+	struct cam_iommu_handle dev_iommu_handle;
+	struct cam_iommu_handle cdm_iommu_handle;
+	__u32                   num_enc;
+	__u32                   num_dma;
+	struct cam_jpeg_dev_ver dev_ver[CAM_JPEG_DEV_TYPE_MAX];
+};
+
+/**
+ * struct cam_jpeg_res_info - JPEG output resource info
+ *
+ * @format   : Format of the resource
+ * @width    : Width in pixels
+ * @height   : Height in lines
+ * @fps      : Fps
+ */
+struct cam_jpeg_res_info {
+	__u32 format;
+	__u32 width;
+	__u32 height;
+	__u32 fps;
+};
+
+/**
+ * struct cam_jpeg_acquire_dev_info - An JPEG device info
+ *
+ * @dev_type : Device type (ENC/DMA)
+ * @reserved : Reserved Bytes
+ * @in_res   : In resource info
+ * @in_res   : Iut resource info
+ */
+struct cam_jpeg_acquire_dev_info {
+	__u32                    dev_type;
+	__u32                    reserved;
+	struct cam_jpeg_res_info in_res;
+	struct cam_jpeg_res_info out_res;
+};
+
+/**
+ * struct cam_jpeg_config_inout_param_info - JPEG Config time
+ *     input output params
+ *
+ * @clk_index  : Input Param- clock selection index.(-1 default)
+ * @output_size: Output Param - jpeg encode/dma output size in
+ *     bytes
+ */
+struct cam_jpeg_config_inout_param_info {
+	__s32 clk_index;
+	__s32 output_size;
+};
+
+#endif /* __UAPI_CAM_JPEG_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_lrme.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_lrme.h
@@ -0,0 +1,69 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_LRME_H__
+#define __UAPI_CAM_LRME_H__
+
+#include <media/cam_defs.h>
+
+/* LRME Resource Types */
+
+enum CAM_LRME_IO_TYPE {
+	CAM_LRME_IO_TYPE_TAR,
+	CAM_LRME_IO_TYPE_REF,
+	CAM_LRME_IO_TYPE_RES,
+	CAM_LRME_IO_TYPE_DS2,
+};
+
+#define CAM_LRME_INPUT_PORT_TYPE_TAR (1 << 0)
+#define CAM_LRME_INPUT_PORT_TYPE_REF (1 << 1)
+
+#define CAM_LRME_OUTPUT_PORT_TYPE_DS2 (1 << 0)
+#define CAM_LRME_OUTPUT_PORT_TYPE_RES (1 << 1)
+
+#define CAM_LRME_DEV_MAX 1
+
+
+struct cam_lrme_hw_version {
+	__u32 gen;
+	__u32 rev;
+	__u32 step;
+};
+
+struct cam_lrme_dev_cap {
+	struct cam_lrme_hw_version clc_hw_version;
+	struct cam_lrme_hw_version bus_rd_hw_version;
+	struct cam_lrme_hw_version bus_wr_hw_version;
+	struct cam_lrme_hw_version top_hw_version;
+	struct cam_lrme_hw_version top_titan_version;
+};
+
+/**
+ * struct cam_lrme_query_cap_cmd - LRME query device capability payload
+ *
+ * @dev_iommu_handle: LRME iommu handles for secure/non secure
+ *      modes
+ * @cdm_iommu_handle: Iommu handles for secure/non secure modes
+ * @num_devices: number of hardware devices
+ * @dev_caps: Returned device capability array
+ */
+struct cam_lrme_query_cap_cmd {
+	struct cam_iommu_handle device_iommu;
+	struct cam_iommu_handle cdm_iommu;
+	__u32                   num_devices;
+	struct cam_lrme_dev_cap dev_caps[CAM_LRME_DEV_MAX];
+};
+
+struct cam_lrme_soc_info {
+	__u64 clock_rate;
+	__u64 bandwidth;
+	__u64 reserved[4];
+};
+
+struct cam_lrme_acquire_args {
+	struct cam_lrme_soc_info lrme_soc_info;
+};
+
+#endif /* __UAPI_CAM_LRME_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_ope.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_ope.h
@@ -0,0 +1,339 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_OPE_H__
+#define __UAPI_OPE_H__
+
+#include <media/cam_defs.h>
+#include <media/cam_cpas.h>
+
+#define OPE_DEV_NAME_SIZE                  128
+
+/* OPE HW TYPE */
+#define OPE_HW_TYPE_OPE                     0x1
+#define OPE_HW_TYPE_OPE_CDM                 0x2
+#define OPE_HW_TYPE_MAX                     0x3
+
+/* OPE Device type */
+#define OPE_DEV_TYPE_OPE_RT                 0x1
+#define OPE_DEV_TYPE_OPE_NRT                0x2
+#define OPE_DEV_TYPE_OPE_SEMI_RT            0x3
+#define OPE_DEV_TYPE_MAX                    0x4
+
+/* OPE Input Res Ports */
+#define OPE_IN_RES_FULL                     0x1
+#define OPE_IN_RES_MAX                      OPE_IN_RES_FULL
+
+/* OPE Output Res Ports */
+#define OPE_OUT_RES_VIDEO                   0x1
+#define OPE_OUT_RES_DISP                    0x2
+#define OPE_OUT_RES_ARGB                    0x3
+#define OPE_OUT_RES_STATS_RS                0x4
+#define OPE_OUT_RES_STATS_IHIST             0x5
+#define OPE_OUT_RES_STATS_LTM               0x6
+#define OPE_OUT_RES_MAX                     OPE_OUT_RES_STATS_LTM
+
+/* OPE packet opcodes */
+#define OPE_OPCODE_CONFIG                   0x1
+
+/* OPE Command Buffer Scope */
+#define OPE_CMD_BUF_SCOPE_BATCH             0x1
+#define OPE_CMD_BUF_SCOPE_FRAME             0x2
+#define OPE_CMD_BUF_SCOPE_PASS              0x3
+#define OPE_CMD_BUF_SCOPE_STRIPE            0x4
+
+/* OPE Command Buffer Types */
+#define OPE_CMD_BUF_TYPE_DIRECT             0x1
+#define OPE_CMD_BUF_TYPE_INDIRECT           0x2
+
+/* OPE Command Buffer Usage */
+#define OPE_CMD_BUF_UMD                     0x1
+#define OPE_CMD_BUF_KMD                     0x2
+#define OPE_CMD_BUF_DEBUG                   0x3
+
+/* OPE Single/Double Buffered */
+#define OPE_CMD_BUF_SINGLE_BUFFERED         0x1
+#define OPE_CMD_BUF_DOUBLE_BUFFERED         0x2
+
+/* Command meta types */
+#define OPE_CMD_META_GENERIC_BLOB           0x1
+
+/* Generic blob types */
+#define OPE_CMD_GENERIC_BLOB_CLK_V2         0x1
+
+/* Stripe location */
+#define OPE_STRIPE_FULL                     0x0
+#define OPE_STRIPE_LEFT                     0x1
+#define OPE_STRIPE_RIGHT                    0x2
+#define OPE_STRIPE_MIDDLE                   0x3
+
+#define OPE_MAX_CMD_BUFS                    64
+#define OPE_MAX_IO_BUFS                     (OPE_OUT_RES_MAX + OPE_IN_RES_MAX)
+#define OPE_MAX_PASS                        1
+#define OPE_MAX_PLANES                      2
+#define OPE_MAX_STRIPES                     64
+#define OPE_MAX_BATCH_SIZE                  16
+
+/**
+ * struct ope_stripe_info - OPE stripe Info
+ *
+ * @offset:          Offset in Bytes
+ * @x_init:          X_init
+ * @stripe_location: Stripe location (OPE_STRIPE_XXX)
+ * @width:           Width of a stripe
+ * @height:          Height of a stripe
+ * @disable_bus:     Flag to disable BUS master
+ * @reserved:        Reserved
+ *
+ */
+struct ope_stripe_info {
+	__u32 offset;
+	__u32 x_init;
+	__u32 stripe_location;
+	__u32 width;
+	__u32 height;
+	__u32 disable_bus;
+	__u32 reserved;
+};
+
+/**
+ * struct ope_io_buf_info - OPE IO buffers meta
+ *
+ * @direction:     Direction of a buffer of a port(Input/Output)
+ * @resource_type: Port type
+ * @num_planes:    Number of planes for a port
+ * @pix_pattern:   Pixel pattern for raw input
+ * @num_stripes:   Stripes per plane
+ * @mem_handle:    Memhandles of each Input/Output Port
+ * @plane_offset:  Offsets of planes
+ * @length:        Length of a plane buffer
+ * @plane_stride:  Plane stride
+ * @height:        Height of a plane buffer
+ * @format:        Format
+ * @fence:         Fence of a Port
+ * @stripe_info:   Stripe Info
+ *
+ */
+struct ope_io_buf_info {
+	__u32 direction;
+	__u32 resource_type;
+	__u32 num_planes;
+	__u32 pix_pattern;
+	__u32 num_stripes[OPE_MAX_PLANES];
+	__u32 mem_handle[OPE_MAX_PLANES];
+	__u32 plane_offset[OPE_MAX_PLANES];
+	__u32 length[OPE_MAX_PLANES];
+	__u32 plane_stride[OPE_MAX_PLANES];
+	__u32 height[OPE_MAX_PLANES];
+	__u32 format;
+	__u32 fence;
+	struct ope_stripe_info stripe_info[OPE_MAX_PLANES][OPE_MAX_STRIPES];
+};
+
+/**
+ * struct ope_frame_set - OPE frameset
+ *
+ * @num_io_bufs: Number of I/O buffers
+ * @reserved:    Reserved
+ * @io_buf:      IO buffer info for all Input and Output ports
+ *
+ */
+struct ope_frame_set {
+	__u32 num_io_bufs;
+	__u32 reserved;
+	struct ope_io_buf_info io_buf[OPE_MAX_IO_BUFS];
+};
+
+/**
+ * struct ope_cmd_buf_info - OPE command buffer meta
+ *
+ * @mem_handle:              Memory handle for command buffer
+ * @offset:                  Offset of a command buffer
+ * @size:                    Size of command buffer
+ * @length:                  Length of a command buffer
+ * @cmd_buf_scope :          Scope of a command buffer (OPE_CMD_BUF_SCOPE_XXX)
+ * @type:                    Command buffer type (OPE_CMD_BUF_TYPE_XXX)
+ * @cmd_buf_usage:           Usage of command buffer ( OPE_CMD_BUF_USAGE_XXX)
+ * @stripe_idx:              Stripe index in a req, It is valid for SCOPE_STRIPE
+ * @cmd_buf_pass_idx:        Pass index
+ * @prefetch_disable:        Prefecth disable flag
+ *
+ */
+
+struct ope_cmd_buf_info {
+	__u32 mem_handle;
+	__u32 offset;
+	__u32 size;
+	__u32 length;
+	__u32 cmd_buf_scope;
+	__u32 type;
+	__u32 cmd_buf_usage;
+	__u32 cmd_buf_buffered;
+	__u32 stripe_idx;
+	__u32 cmd_buf_pass_idx;
+	__u32 prefetch_disable;
+};
+
+/**
+ * struct ope_packet_payload - payload for a request
+ *
+ * @num_cmd_bufs:         Number of command buffers
+ * @batch_size:           Batch size in HFR mode
+ * @ope_cmd_buf_info:     Command buffer meta data
+ * @ope_io_buf_info:      Io buffer Info
+ *
+ */
+struct ope_frame_process {
+	__u32 num_cmd_bufs[OPE_MAX_BATCH_SIZE];
+	__u32 batch_size;
+	struct ope_cmd_buf_info cmd_buf[OPE_MAX_BATCH_SIZE][OPE_MAX_CMD_BUFS];
+	struct ope_frame_set frame_set[OPE_MAX_BATCH_SIZE];
+};
+
+/**
+ * struct ope_clk_bw_request_v2 - clock and bandwidth for a request
+ *
+ * @budget_ns:       Time required to process frame
+ * @frame_cycles:    Frame cycles needed to process the frame
+ * @rt_flag:         Flag to indicate real time stream
+ * @reserved:        For memory alignment
+ * @axi_path:        Per path vote info for OPE
+ *
+ */
+struct ope_clk_bw_request_v2 {
+	__u64 budget_ns;
+	__u32 frame_cycles;
+	__u32 rt_flag;
+	__u32 reserved;
+	__u32 num_paths;
+	union {
+		struct cam_axi_per_path_bw_vote   axi_path[1];
+		__DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+	};
+};
+
+/**
+ * struct ope_hw_ver - Device information for OPE
+ *
+ * This is used to get device version info of
+ * OPE, CDM and use this info in CAM_QUERY_CAP IOCTL
+ *
+ * @hw_type:  Hardware type for the cap info(OPE_HW_TYPE_XXX)
+ * @reserved: Reserved field
+ * @hw_ver:   Major, minor and incr values of a hardware version
+ *
+ */
+struct ope_hw_ver {
+	__u32 hw_type;
+	__u32 reserved;
+	struct cam_hw_version hw_ver;
+};
+
+/**
+ * struct ope_query_cap_cmd - OPE query device capability payload
+ *
+ * @dev_iommu_handle: OPE iommu handles for secure/non secure modes
+ * @cdm_iommu_handle: CDM iommu handles for secure/non secure modes
+ * @num_ope:          Number of OPEs
+ * @reserved:         Reserved Parameter
+ * @hw_ver:           Hardware capability array
+ */
+struct ope_query_cap_cmd {
+	struct cam_iommu_handle dev_iommu_handle;
+	struct cam_iommu_handle cdm_iommu_handle;
+	__u32 num_ope;
+	__u32 reserved;
+	struct ope_hw_ver hw_ver[OPE_DEV_TYPE_MAX];
+};
+
+/**
+ * struct ope_out_res_info - OPE Output resource info
+ *
+ * @res_id:            Resource ID
+ * @format:            Output resource format
+ * @width:             Output width
+ * @height:            Output Height
+ * @alignment:         Alignment
+ * @packer_format:     Packer format
+ * @subsample_period:  Subsample period in HFR
+ * @subsample_pattern: Subsample pattern in HFR
+ * @pixel_pattern:     Pixel pattern
+ * @reserved:          Reserved Parameter
+ *
+ */
+struct ope_out_res_info {
+	__u32 res_id;
+	__u32 format;
+	__u32 width;
+	__u32 height;
+	__u32 alignment;
+	__u32 packer_format;
+	__u32 subsample_period;
+	__u32 subsample_pattern;
+	__u32 pixel_pattern;
+	__u32 reserved;
+};
+
+/**
+ * struct ope_in_res_info - OPE Input resource info
+ *
+ * @res_id:           Resource ID
+ * @format:           Input resource format
+ * @width:            Input width
+ * @height:           Input Height
+ * @pixel_pattern:    Pixel pattern
+ * @alignment:        Alignment
+ * @unpacker_format:  Unpacker format
+ * @max_stripe_size:  Max stripe size supported for this instance configuration
+ * @fps:              Frames per second
+ * @reserved:         Reserved Parameter
+ *
+ */
+struct ope_in_res_info {
+	__u32 res_id;
+	__u32 format;
+	__u32 width;
+	__u32 height;
+	__u32 pixel_pattern;
+	__u32 alignment;
+	__u32 unpacker_format;
+	__u32 max_stripe_size;
+	__u32 fps;
+	__u32 reserved;
+};
+
+/**
+ * struct ope_acquire_dev_info - OPE Acquire Info
+ *
+ * @hw_type:             OPE HW Types (OPE)
+ * @dev_type:            Nature of Device Instance (RT/NRT)
+ * @dev_name:            Name of Device Instance
+ * @nrt_stripes_for_arb: Program num stripes in OPE CDM for NRT device
+ *                       before setting ARB bit
+ * @secure_mode:         Mode of Device operation (Secure or Non Secure)
+ * @batch_size:          Batch size
+ * @num_in_res:          Number of input resources (OPE_IN_RES_XXX)
+ * @in_res:              Input resource info
+ * @num_out_res:         Number of output resources (OPE_OUT_RES_XXX)
+ * @reserved:            Reserved Parameter
+ * @out_res:             Output resource info
+ *
+ */
+struct ope_acquire_dev_info {
+	__u32                   hw_type;
+	__u32                   dev_type;
+	char                    dev_name[OPE_DEV_NAME_SIZE];
+	__u32                   nrt_stripes_for_arb;
+	__u32                   secure_mode;
+	__u32                   batch_size;
+	__u32                   num_in_res;
+	struct ope_in_res_info  in_res[OPE_IN_RES_MAX];
+	__u32                   num_out_res;
+	__u32                   reserved;
+	struct ope_out_res_info out_res[OPE_OUT_RES_MAX];
+} __attribute__((__packed__));
+
+#endif /* __UAPI_OPE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_req_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_req_mgr.h
@@ -0,0 +1,910 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_LINUX_CAM_REQ_MGR_H
+#define __UAPI_LINUX_CAM_REQ_MGR_H
+
+#include <linux/videodev2.h>
+#include <linux/types.h>
+#include <linux/ioctl.h>
+#include <linux/media.h>
+#include <media/cam_defs.h>
+
+#define CAM_REQ_MGR_VNODE_NAME "cam-req-mgr-devnode"
+
+#define CAM_DEVICE_TYPE_BASE      (MEDIA_ENT_F_OLD_BASE)
+#define CAM_VNODE_DEVICE_TYPE     (CAM_DEVICE_TYPE_BASE)
+#define CAM_SENSOR_DEVICE_TYPE    (CAM_DEVICE_TYPE_BASE + 1)
+#define CAM_IFE_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 2)
+#define CAM_ICP_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 3)
+#define CAM_LRME_DEVICE_TYPE      (CAM_DEVICE_TYPE_BASE + 4)
+#define CAM_JPEG_DEVICE_TYPE      (CAM_DEVICE_TYPE_BASE + 5)
+#define CAM_FD_DEVICE_TYPE        (CAM_DEVICE_TYPE_BASE + 6)
+#define CAM_CPAS_DEVICE_TYPE      (CAM_DEVICE_TYPE_BASE + 7)
+#define CAM_CSIPHY_DEVICE_TYPE    (CAM_DEVICE_TYPE_BASE + 8)
+#define CAM_ACTUATOR_DEVICE_TYPE  (CAM_DEVICE_TYPE_BASE + 9)
+#define CAM_CCI_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 10)
+#define CAM_FLASH_DEVICE_TYPE     (CAM_DEVICE_TYPE_BASE + 11)
+#define CAM_EEPROM_DEVICE_TYPE    (CAM_DEVICE_TYPE_BASE + 12)
+#define CAM_OIS_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 13)
+#define CAM_CUSTOM_DEVICE_TYPE    (CAM_DEVICE_TYPE_BASE + 14)
+#define CAM_OPE_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 15)
+#define CAM_TFE_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 16)
+#define CAM_CRE_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 17)
+#define CAM_TPG_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 18)
+#define CAM_TFE_MC_DEVICE_TYPE    (CAM_DEVICE_TYPE_BASE + 19)
+
+/* cam_req_mgr hdl info */
+#define CAM_REQ_MGR_HDL_IDX_POS           8
+#define CAM_REQ_MGR_HDL_IDX_MASK          ((1 << CAM_REQ_MGR_HDL_IDX_POS) - 1)
+#define CAM_REQ_MGR_GET_HDL_IDX(hdl)      (hdl & CAM_REQ_MGR_HDL_IDX_MASK)
+
+/**
+ * Max handles supported by cam_req_mgr
+ * It includes both session and device handles
+ */
+#define CAM_REQ_MGR_MAX_HANDLES           64
+#define CAM_REQ_MGR_MAX_HANDLES_V2        256
+#define MAX_LINKS_PER_SESSION             2
+
+/* Interval for cam_info_rate_limit_custom() */
+#define CAM_RATE_LIMIT_INTERVAL_5SEC 5
+
+/* V4L event type which user space will subscribe to */
+#define V4L_EVENT_CAM_REQ_MGR_EVENT       (V4L2_EVENT_PRIVATE_START + 0)
+
+/* Specific event ids to get notified in user space */
+#define V4L_EVENT_CAM_REQ_MGR_SOF                                       0
+#define V4L_EVENT_CAM_REQ_MGR_ERROR                                     1
+#define V4L_EVENT_CAM_REQ_MGR_SOF_BOOT_TS                               2
+#define V4L_EVENT_CAM_REQ_MGR_CUSTOM_EVT                                3
+#define V4L_EVENT_CAM_REQ_MGR_NODE_EVENT                                4
+#define V4L_EVENT_CAM_REQ_MGR_SOF_UNIFIED_TS                            5
+#define V4L_EVENT_CAM_REQ_MGR_PF_ERROR                                  6
+
+/* SOF Event status */
+#define CAM_REQ_MGR_SOF_EVENT_SUCCESS           0
+#define CAM_REQ_MGR_SOF_EVENT_ERROR             1
+
+/* Link control operations */
+#define CAM_REQ_MGR_LINK_ACTIVATE               0
+#define CAM_REQ_MGR_LINK_DEACTIVATE             1
+
+/* DMA buffer name length */
+#define CAM_DMA_BUF_NAME_LEN                    128
+#define CAM_REQ_MGR_ALLOC_BUF_WITH_NAME         1
+
+/**
+ * Request Manager : flush_type
+ * @CAM_REQ_MGR_FLUSH_TYPE_ALL: Req mgr will remove all the pending
+ * requests from input/processing queue.
+ * @CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ: Req mgr will remove only particular
+ * request id from input/processing queue.
+ * @CAM_REQ_MGR_FLUSH_TYPE_MAX: Max number of the flush type
+ * @opcode: CAM_REQ_MGR_FLUSH_REQ
+ */
+#define CAM_REQ_MGR_FLUSH_TYPE_ALL          0
+#define CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ   1
+#define CAM_REQ_MGR_FLUSH_TYPE_MAX          2
+
+/**
+ * Request Manager : Sync Mode type
+ * @CAM_REQ_MGR_SYNC_MODE_NO_SYNC: Req mgr will apply non-sync mode for this
+ * request.
+ * @CAM_REQ_MGR_SYNC_MODE_SYNC: Req mgr will apply sync mode for this request.
+ */
+#define CAM_REQ_MGR_SYNC_MODE_NO_SYNC   0
+#define CAM_REQ_MGR_SYNC_MODE_SYNC      1
+
+/**
+ * struct cam_req_mgr_event_data
+ * @session_hdl: session handle
+ * @link_hdl: link handle
+ * @frame_id: frame id
+ * @reserved: reserved for 64 bit aligngment
+ * @req_id: request id
+ * @tv_sec: timestamp in seconds
+ * @tv_usec: timestamp in micro seconds
+ */
+struct cam_req_mgr_event_data {
+	__s32   session_hdl;
+	__s32   link_hdl;
+	__s32   frame_id;
+	__s32   reserved;
+	__s64   req_id;
+	__u64  tv_sec;
+	__u64  tv_usec;
+};
+
+/**
+ * struct cam_req_mgr_session_info
+ * @session_hdl: In/Output param - session_handle
+ * @opcode1: CAM_REQ_MGR_CREATE_SESSION
+ * @opcode2: CAM_REQ_MGR_DESTROY_SESSION
+ */
+struct cam_req_mgr_session_info {
+	__s32 session_hdl;
+	__s32 reserved;
+};
+
+/**
+ * struct cam_req_mgr_link_info
+ * @session_hdl: Input param - Identifier for CSL session
+ * @num_devices: Input Param - Num of devices to be linked
+ * @dev_hdls: Input param - List of device handles to be linked
+ * @link_hdl: Output Param -Identifier for link
+ * @opcode: CAM_REQ_MGR_LINK
+ */
+struct cam_req_mgr_link_info {
+	__s32 session_hdl;
+	__u32 num_devices;
+	__s32 dev_hdls[CAM_REQ_MGR_MAX_HANDLES];
+	__s32 link_hdl;
+};
+
+struct cam_req_mgr_link_info_v2 {
+	__s32 session_hdl;
+	__u32 num_devices;
+	__s32 dev_hdls[CAM_REQ_MGR_MAX_HANDLES_V2];
+	__s32 link_hdl;
+};
+
+struct cam_req_mgr_ver_info {
+	__u32 version;
+	union {
+		struct cam_req_mgr_link_info link_info_v1;
+		struct cam_req_mgr_link_info_v2 link_info_v2;
+	} u;
+};
+/**
+ * struct cam_req_mgr_unlink_info
+ * @session_hdl: input param - session handle
+ * @link_hdl: input param - link handle
+ * @opcode: CAM_REQ_MGR_UNLINK
+ */
+struct cam_req_mgr_unlink_info {
+	__s32 session_hdl;
+	__s32 link_hdl;
+};
+
+/**
+ * struct cam_req_mgr_flush_info
+ * @brief: User can tell drivers to flush a particular request id or
+ * flush all requests from its pending processing queue. Flush is a
+ * blocking call and driver shall ensure all requests are flushed
+ * before returning.
+ * @session_hdl: Input param - Identifier for CSL session
+ * @link_hdl: Input Param -Identifier for link
+ * @flush_type: User can cancel a particular req id or can flush
+ * all requests in queue
+ * @reserved: reserved for 64 bit aligngment
+ * @req_id: field is valid only if flush type is cancel request
+ * for flush all this field value is not considered.
+ * @opcode: CAM_REQ_MGR_FLUSH_REQ
+ */
+struct cam_req_mgr_flush_info {
+	__s32 session_hdl;
+	__s32 link_hdl;
+	__u32 flush_type;
+	__u32 reserved;
+	__s64 req_id;
+};
+
+/** struct cam_req_mgr_sched_request
+ * @session_hdl: Input param - Identifier for CSL session
+ * @link_hdl: Input Param -Identifier for link
+ * inluding itself.
+ * @bubble_enable: Input Param - Cam req mgr will do bubble recovery if this
+ * flag is set.
+ * @sync_mode: Type of Sync mode for this request
+ * @additional_timeout: Additional timeout value (in ms) associated with
+ * this request. This value needs to be 0 in cases where long exposure is
+ * not configured for the sensor.The max timeout that will be supported
+ * is 50000 ms
+ * @reserved: Reserved
+ * @req_id: Input Param - Request Id from which all requests will be flushed
+ */
+struct cam_req_mgr_sched_request {
+	__s32 session_hdl;
+	__s32 link_hdl;
+	__s32 bubble_enable;
+	__s32 sync_mode;
+	__s32 additional_timeout;
+	__s32 reserved;
+	__s64 req_id;
+};
+
+/** struct cam_req_mgr_sched_request_v2
+ * @version: Version number
+ * @session_hdl: Input param - Identifier for CSL session
+ * @link_hdl: Input Param -Identifier for link including itself.
+ * @bubble_enable: Input Param - Cam req mgr will do bubble recovery if this
+ * flag is set.
+ * @sync_mode: Type of Sync mode for this request
+ * @additional_timeout: Additional timeout value (in ms) associated with
+ * this request. This value needs to be 0 in cases where long exposure is
+ * not configured for the sensor.The max timeout that will be supported
+ * is 50000 ms
+ * @num_links: Input Param - Num of links for sync
+ * @num_valid_params: Number of valid params
+ * @req_id: Input Param - Request Id from which all requests will be flushed
+ * @link_hdls: Input Param - Array of link handles to be for sync
+ * @param_mask: mask to indicate what the parameters are
+ * @params: parameters passed from user space
+ */
+struct cam_req_mgr_sched_request_v2 {
+	__s32 version;
+	__s32 session_hdl;
+	__s32 link_hdl;
+	__s32 bubble_enable;
+	__s32 sync_mode;
+	__s32 additional_timeout;
+	__s32 num_links;
+	__s32 num_valid_params;
+	__s64 req_id;
+	__s32 link_hdls[MAX_LINKS_PER_SESSION];
+	__s32 param_mask;
+	__s32 params[5];
+};
+
+/**
+ * struct cam_req_mgr_sync_mode
+ * @session_hdl:         Input param - Identifier for CSL session
+ * @sync_mode:           Input Param - Type of sync mode
+ * @num_links:           Input Param - Num of links in sync mode (Valid only
+ *                             when sync_mode is one of SYNC enabled modes)
+ * @link_hdls:           Input Param - Array of link handles to be in sync mode
+ *                             (Valid only when sync_mode is one of SYNC
+ *                             enabled modes)
+ * @master_link_hdl:     Input Param - To dictate which link's SOF drives system
+ *                             (Valid only when sync_mode is one of SYNC
+ *                             enabled modes)
+ *
+ * @opcode: CAM_REQ_MGR_SYNC_MODE
+ */
+struct cam_req_mgr_sync_mode {
+	__s32 session_hdl;
+	__s32 sync_mode;
+	__s32 num_links;
+	__s32 link_hdls[MAX_LINKS_PER_SESSION];
+	__s32 master_link_hdl;
+	__s32 reserved;
+};
+
+/**
+ * struct cam_req_mgr_link_control
+ * @ops:                 Link operations: activate/deactive
+ * @session_hdl:         Input param - Identifier for CSL session
+ * @num_links:           Input Param - Num of links
+ * @reserved:            reserved field
+ * @init_timeout:        To account for INIT exposure settings (ms)
+ *                       If there is no change in exp settings
+ *                       field needs to assigned to 0ms.
+ * @link_hdls:           Input Param - Links to be activated/deactivated
+ *
+ * @opcode: CAM_REQ_MGR_LINK_CONTROL
+ */
+struct cam_req_mgr_link_control {
+	__s32 ops;
+	__s32 session_hdl;
+	__s32 num_links;
+	__s32 reserved;
+	__s32 init_timeout[MAX_LINKS_PER_SESSION];
+	__s32 link_hdls[MAX_LINKS_PER_SESSION];
+};
+
+/**
+ * struct cam_req_mgr_link_properties
+ * @version: Input param - Version number
+ * @session_hdl: Input param - Identifier for CSL session
+ * @link_hdl: Input Param - Identifier for link
+ * @properties_mask: Input Param - Properties mask to indicate if current
+ *                   link enables some special properties
+ * @num_valid_params: Input Param - Number of valid params
+ * @param_mask: Input Param - Mask to indicate what are the parameters
+ * @params: Input Param - Parameters passed from user space
+ */
+/* CAM_REQ_MGR_LINK_PROPERTIES */
+struct cam_req_mgr_link_properties {
+	__s32 version;
+	__s32 session_hdl;
+	__s32 link_hdl;
+	__u32 properties_mask;
+	__s32 num_valid_params;
+	__u32 param_mask;
+	__s32 params[6];
+};
+
+/**
+ * Request Manager : Link properties codes
+ * @CAM_LINK_PROPERTY_NONE                     : No special property
+ * @CAM_LINK_PROPERTY_SENSOR_STANDBY_AFTER_EOF : Standby the sensor after EOF
+ */
+#define CAM_LINK_PROPERTY_NONE                      0
+#define CAM_LINK_PROPERTY_SENSOR_STANDBY_AFTER_EOF  BIT(0)
+
+/**
+ * cam_req_mgr specific opcode ids
+ */
+#define CAM_REQ_MGR_CREATE_DEV_NODES            (CAM_COMMON_OPCODE_MAX + 1)
+#define CAM_REQ_MGR_CREATE_SESSION              (CAM_COMMON_OPCODE_MAX + 2)
+#define CAM_REQ_MGR_DESTROY_SESSION             (CAM_COMMON_OPCODE_MAX + 3)
+#define CAM_REQ_MGR_LINK                        (CAM_COMMON_OPCODE_MAX + 4)
+#define CAM_REQ_MGR_UNLINK                      (CAM_COMMON_OPCODE_MAX + 5)
+#define CAM_REQ_MGR_SCHED_REQ                   (CAM_COMMON_OPCODE_MAX + 6)
+#define CAM_REQ_MGR_FLUSH_REQ                   (CAM_COMMON_OPCODE_MAX + 7)
+#define CAM_REQ_MGR_SYNC_MODE                   (CAM_COMMON_OPCODE_MAX + 8)
+#define CAM_REQ_MGR_ALLOC_BUF                   (CAM_COMMON_OPCODE_MAX + 9)
+#define CAM_REQ_MGR_MAP_BUF                     (CAM_COMMON_OPCODE_MAX + 10)
+#define CAM_REQ_MGR_RELEASE_BUF                 (CAM_COMMON_OPCODE_MAX + 11)
+#define CAM_REQ_MGR_CACHE_OPS                   (CAM_COMMON_OPCODE_MAX + 12)
+#define CAM_REQ_MGR_LINK_CONTROL                (CAM_COMMON_OPCODE_MAX + 13)
+#define CAM_REQ_MGR_LINK_V2                     (CAM_COMMON_OPCODE_MAX + 14)
+#define CAM_REQ_MGR_REQUEST_DUMP                (CAM_COMMON_OPCODE_MAX + 15)
+#define CAM_REQ_MGR_SCHED_REQ_V2                (CAM_COMMON_OPCODE_MAX + 16)
+#define CAM_REQ_MGR_LINK_PROPERTIES             (CAM_COMMON_OPCODE_MAX + 17)
+#define CAM_REQ_MGR_ALLOC_BUF_V2                (CAM_COMMON_OPCODE_MAX + 18)
+#define CAM_REQ_MGR_MAP_BUF_V2                  (CAM_COMMON_OPCODE_MAX + 19)
+#define CAM_REQ_MGR_MEM_CPU_ACCESS_OP           (CAM_COMMON_OPCODE_MAX + 20)
+#define CAM_REQ_MGR_QUERY_CAP                   (CAM_COMMON_OPCODE_MAX + 21)
+
+/* end of cam_req_mgr opcodes */
+
+#define CAM_MEM_FLAG_HW_READ_WRITE              (1<<0)
+#define CAM_MEM_FLAG_HW_READ_ONLY               (1<<1)
+#define CAM_MEM_FLAG_HW_WRITE_ONLY              (1<<2)
+#define CAM_MEM_FLAG_KMD_ACCESS                 (1<<3)
+#define CAM_MEM_FLAG_UMD_ACCESS                 (1<<4)
+#define CAM_MEM_FLAG_PROTECTED_MODE             (1<<5)
+#define CAM_MEM_FLAG_CMD_BUF_TYPE               (1<<6)
+#define CAM_MEM_FLAG_PIXEL_BUF_TYPE             (1<<7)
+#define CAM_MEM_FLAG_STATS_BUF_TYPE             (1<<8)
+#define CAM_MEM_FLAG_PACKET_BUF_TYPE            (1<<9)
+#define CAM_MEM_FLAG_CACHE                      (1<<10)
+#define CAM_MEM_FLAG_HW_SHARED_ACCESS           (1<<11)
+#define CAM_MEM_FLAG_CDSP_OUTPUT                (1<<12)
+#define CAM_MEM_FLAG_DISABLE_DELAYED_UNMAP      (1<<13)
+#define CAM_MEM_FLAG_KMD_DEBUG_FLAG             (1<<14)
+#define CAM_MEM_FLAG_EVA_NOPIXEL                (1<<15)
+#define CAM_MEM_FLAG_HW_AND_CDM_OR_SHARED       (1<<16)
+#define CAM_MEM_FLAG_UBWC_P_HEAP                (1<<17)
+/* Allocation forced to camera heap */
+#define CAM_MEM_FLAG_USE_CAMERA_HEAP_ONLY       (1<<18)
+
+/* Allocation forced to system heap */
+#define CAM_MEM_FLAG_USE_SYS_HEAP_ONLY          (1<<19)
+
+#define CAM_MEM_MMU_MAX_HANDLE                  16
+
+/* Maximum allowed buffers in existence */
+#define CAM_MEM_BUFQ_MAX                        2048
+
+#define CAM_MEM_MGR_SECURE_BIT_POS              15
+#define CAM_MEM_MGR_HDL_IDX_SIZE                15
+#define CAM_MEM_MGR_HDL_FD_SIZE                 16
+#define CAM_MEM_MGR_HDL_IDX_END_POS             16
+#define CAM_MEM_MGR_HDL_FD_END_POS              32
+
+#define CAM_MEM_MGR_HDL_IDX_MASK      ((1 << CAM_MEM_MGR_HDL_IDX_SIZE) - 1)
+
+#define GET_MEM_HANDLE(idx, fd) \
+	((idx & CAM_MEM_MGR_HDL_IDX_MASK) | \
+	(fd << (CAM_MEM_MGR_HDL_FD_END_POS - CAM_MEM_MGR_HDL_FD_SIZE))) \
+
+#define GET_FD_FROM_HANDLE(hdl) \
+	(hdl >> (CAM_MEM_MGR_HDL_FD_END_POS - CAM_MEM_MGR_HDL_FD_SIZE)) \
+
+#define CAM_MEM_MGR_GET_HDL_IDX(hdl) (hdl & CAM_MEM_MGR_HDL_IDX_MASK)
+
+#define CAM_MEM_MGR_SET_SECURE_HDL(hdl, flag) \
+	((flag) ? (hdl |= (1 << CAM_MEM_MGR_SECURE_BIT_POS)) : \
+	((hdl) &= ~(1 << CAM_MEM_MGR_SECURE_BIT_POS)))
+
+#define CAM_MEM_MGR_IS_SECURE_HDL(hdl) \
+	(((hdl) & \
+	(1<<CAM_MEM_MGR_SECURE_BIT_POS)) >> CAM_MEM_MGR_SECURE_BIT_POS)
+
+/**
+ * memory allocation type
+ */
+#define CAM_MEM_DMA_NONE                        0
+#define CAM_MEM_DMA_BIDIRECTIONAL               1
+#define CAM_MEM_DMA_TO_DEVICE                   2
+#define CAM_MEM_DMA_FROM_DEVICE                 3
+
+/**
+ * memory cache operation
+ */
+#define CAM_MEM_CLEAN_CACHE                     1
+#define CAM_MEM_INV_CACHE                       2
+#define CAM_MEM_CLEAN_INV_CACHE                 3
+
+/**
+ * memory CPU access operation
+ */
+#define CAM_MEM_BEGIN_CPU_ACCESS                BIT(0)
+#define CAM_MEM_END_CPU_ACCESS                  BIT(1)
+
+/**
+ * memory CPU access type
+ */
+#define CAM_MEM_CPU_ACCESS_READ                 BIT(0)
+#define CAM_MEM_CPU_ACCESS_WRITE                BIT(1)
+
+/**
+ * Feature mask returned in query_cap
+ */
+#define CAM_REQ_MGR_MEM_UBWC_P_HEAP_SUPPORTED   BIT(0)
+#define CAM_REQ_MGR_MEM_CAMERA_HEAP_SUPPORTED   BIT(1)
+
+/**
+ * struct cam_req_mgr_query_cap
+ * @version:          Struct version
+ * @feature_mask      Supported features
+ * @num_valid_params: Valid number of params being used
+ * @valid_param_mask: Mask to indicate the field types in params
+ * @params:           Additional params
+ */
+struct cam_req_mgr_query_cap {
+	__u32   version;
+	__u64   feature_mask;
+	__u32   num_valid_params;
+	__u32   valid_param_mask;
+	__s32   params[5];
+};
+
+/**
+ * struct cam_mem_alloc_out_params
+ * @buf_handle: buffer handle
+ * @fd: output buffer file descriptor
+ * @vaddr: virtual address pointer
+ */
+struct cam_mem_alloc_out_params {
+	__u32 buf_handle;
+	__s32 fd;
+	__u64 vaddr;
+};
+
+/**
+ * struct cam_mem_map_out_params
+ * @buf_handle: buffer handle
+ * @size: size of the buffer being mapped
+ * @vaddr: virtual address pointer
+ */
+struct cam_mem_map_out_params {
+	__u32 buf_handle;
+	__u32 size;
+	__u64 vaddr;
+};
+
+/**
+ * struct cam_mem_mgr_alloc_cmd
+ * @len: size of buffer to allocate
+ * @align: alignment of the buffer
+ * @mmu_hdls: array of mmu handles
+ * @num_hdl: number of handles
+ * @flags: flags of the buffer
+ * @out: out params
+ */
+/* CAM_REQ_MGR_ALLOC_BUF */
+struct cam_mem_mgr_alloc_cmd {
+	__u64                           len;
+	__u64                           align;
+	__s32                           mmu_hdls[CAM_MEM_MMU_MAX_HANDLE];
+	__u32                           num_hdl;
+	__u32                           flags;
+	struct cam_mem_alloc_out_params out;
+};
+
+/**
+ * struct cam_mem_mgr_alloc_cmd_v2
+ * @version: Struct version
+ * @num_hdl: number of handles
+ * @mmu_hdls: array of mmu handles
+ * @len: size of buffer to allocate
+ * @align: alignment of the buffer
+ * @vmids: reserved
+ * @buf_name: DMA buffer name
+ * @flags: flags of the buffer
+ * @num_valid_params: Valid number of params being used
+ * @valid_param_mask: Mask to indicate the field types in params
+ * @params: Additional params
+ * @out: out params
+ */
+/* CAM_REQ_MGR_ALLOC_BUF_V2 */
+struct cam_mem_mgr_alloc_cmd_v2 {
+	__u32                           version;
+	__u32                           num_hdl;
+	__s32                           mmu_hdls[CAM_MEM_MMU_MAX_HANDLE];
+	__u64                           len;
+	__u64                           align;
+	__u64                           vmids;
+	char                            buf_name[CAM_DMA_BUF_NAME_LEN];
+	__u32                           flags;
+	__u32                           num_valid_params;
+	__u32                           valid_param_mask;
+	__s32                           params[5];
+	struct cam_mem_alloc_out_params out;
+};
+
+/**
+ * struct cam_mem_mgr_map_cmd
+ * @mmu_hdls: array of mmu handles
+ * @num_hdl: number of handles
+ * @flags: flags of the buffer
+ * @fd: output buffer file descriptor
+ * @reserved: reserved field
+ * @out: out params
+ */
+
+/* CAM_REQ_MGR_MAP_BUF */
+struct cam_mem_mgr_map_cmd {
+	__s32                         mmu_hdls[CAM_MEM_MMU_MAX_HANDLE];
+	__u32                         num_hdl;
+	__u32                         flags;
+	__s32                         fd;
+	__u32                         reserved;
+	struct cam_mem_map_out_params out;
+};
+
+/**
+ * struct cam_mem_mgr_map_cmd_v2
+ * @version: Struct version
+ * @fd: output buffer file descriptor
+ * @mmu_hdls: array of mmu handles
+ * @num_hdl: number of handles
+ * @flags: flags of the buffer
+ * @vmids: reserved
+ * @buf_name: DMA buffer name
+ * @num_valid_params: Valid number of params being used
+ * @valid_param_mask: Mask to indicate the field types in params
+ * @params: Additional params
+ * @out: out params
+ */
+
+/* CAM_REQ_MGR_MAP_BUF_V2 */
+struct cam_mem_mgr_map_cmd_v2 {
+	__u32                         version;
+	__s32                         fd;
+	__s32                         mmu_hdls[CAM_MEM_MMU_MAX_HANDLE];
+	__u32                         num_hdl;
+	__u32                         flags;
+	__u64                         vmids;
+	char                          buf_name[CAM_DMA_BUF_NAME_LEN];
+	__u32                         num_valid_params;
+	__u32                         valid_param_mask;
+	__s32                         params[4];
+	struct cam_mem_map_out_params out;
+};
+
+
+/**
+ * struct cam_mem_mgr_map_cmd
+ * @buf_handle: buffer handle
+ * @reserved: reserved field
+ */
+/* CAM_REQ_MGR_RELEASE_BUF */
+struct cam_mem_mgr_release_cmd {
+	__s32 buf_handle;
+	__u32 reserved;
+};
+
+/**
+ * struct cam_mem_mgr_map_cmd
+ * @buf_handle: buffer handle
+ * @ops: cache operations
+ */
+/* CAM_REQ_MGR_CACHE_OPS */
+struct cam_mem_cache_ops_cmd {
+	__s32 buf_handle;
+	__u32 mem_cache_ops;
+};
+
+/**
+ * struct cam_mem_cpu_access_op
+ * @version:          Struct version
+ * @buf_handle:       buffer handle
+ * @access:           CPU access operation. Allowed params :
+ *                    CAM_MEM_BEGIN_CPU_ACCESS
+ *                    CAM_MEM_END_CPU_ACCESS
+ *                    both
+ * @access_type:      CPU access type. Allowed params :
+ *                    CAM_MEM_CPU_ACCESS_READ
+ *                    CAM_MEM_CPU_ACCESS_WRITE
+ *                    both
+ * @num_valid_params: Valid number of params being used
+ * @valid_param_mask: Mask to indicate the field types in params
+ * @params:           Additional params
+ */
+/* CAM_REQ_MGR_MEM_CPU_ACCESS_OP */
+struct cam_mem_cpu_access_op {
+	__u32   version;
+	__s32   buf_handle;
+	__u32   access;
+	__u32   access_type;
+	__u32   num_valid_params;
+	__u32   valid_param_mask;
+	__s32   params[4];
+};
+
+/**
+ * Request Manager : error message type
+ * @CAM_REQ_MGR_ERROR_TYPE_DEVICE: Device error message, fatal to session
+ * @CAM_REQ_MGR_ERROR_TYPE_REQUEST: Error on a single request, not fatal
+ * @CAM_REQ_MGR_ERROR_TYPE_BUFFER: Buffer was not filled, not fatal
+ * @CAM_REQ_MGR_ERROR_TYPE_RECOVERY: Fatal error, can be recovered
+ * @CAM_REQ_MGR_ERROR_TYPE_SOF_FREEZE: SOF freeze, can be recovered
+ * @CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY: Full recovery, can be recovered
+ * @CAM_REQ_MGR_ERROR_TYPE_PAGE_FAULT: page fault, can be recovered
+ * @CAM_REQ_MGR_WARN_TYPE_KMD_RECOVERY: Do internal overflow recovery, notify UMD
+ */
+#define CAM_REQ_MGR_ERROR_TYPE_DEVICE           0
+#define CAM_REQ_MGR_ERROR_TYPE_REQUEST          1
+#define CAM_REQ_MGR_ERROR_TYPE_BUFFER           2
+#define CAM_REQ_MGR_ERROR_TYPE_RECOVERY         3
+#define CAM_REQ_MGR_ERROR_TYPE_SOF_FREEZE       4
+#define CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY    5
+#define CAM_REQ_MGR_ERROR_TYPE_PAGE_FAULT       6
+#define CAM_REQ_MGR_WARN_TYPE_KMD_RECOVERY      7
+
+/**
+ * Request Manager : Error codes
+ * @CAM_REQ_MGR_ISP_UNREPORTED_ERROR           : No Error Code reported
+ * @CAM_REQ_MGR_LINK_STALLED_ERROR             : Unable to apply requests on link
+ * @CAM_REQ_MGR_CSID_FATAL_ERROR               : CSID FATAL Error
+ * @CAM_REQ_MGR_CSID_FIFO_OVERFLOW_ERROR       : CSID OutputFIFO Overflow
+ * @CAM_REQ_MGR_CSID_RECOVERY_OVERFLOW_ERROR   : CSID Recovery Overflow
+ * @CAM_REQ_MGR_CSID_LANE_FIFO_OVERFLOW_ERROR  : CSID Lane fifo overflow
+ * @CAM_REQ_MGR_CSID_PIXEL_COUNT_MISMATCH      : CSID Pixel Count Mismatch
+ * @CAM_REQ_MGR_CSID_RX_PKT_HDR_CORRUPTION     : Packet header received by the csid rx is corrupted
+ * @CAM_REQ_MGR_CSID_MISSING_PKT_HDR_DATA      : Lesser data received in packet header than expected
+ * @CAM_REQ_MGR_CSID_ERR_ON_SENSOR_SWITCHING   : Fatal Error encountered while switching the sensors
+ * @CAM_REQ_MGR_CSID_UNBOUNDED_FRAME           : No EOF in the frame or the frame started with eof
+ * @CAM_REQ_MGR_ICP_NO_MEMORY                  : ICP No Memory
+ * @CAM_REQ_MGR_ICP_ERROR_SYSTEM_FAILURE       : ICP system failure
+ * @CAM_REQ_MGR_CSID_MISSING_EOT               : CSID is missing EOT on one or more lanes
+ * @CAM_REQ_MGR_CSID_RX_PKT_PAYLOAD_CORRUPTION : CSID long packet payload CRC mismatch
+ * @CAM_REQ_MGR_SENSOR_STREAM_OFF_FAILED       : Failed to stream off sensor
+ * @CAM_REQ_MGR_VALID_SHUTTER_DROPPED          : Valid shutter dropped
+ * @CAM_REQ_MGR_ISP_ERR_HWPD_VIOLATION         : HWPD image size violation
+ */
+#define CAM_REQ_MGR_ISP_UNREPORTED_ERROR                 0
+#define CAM_REQ_MGR_LINK_STALLED_ERROR                   BIT(0)
+#define CAM_REQ_MGR_CSID_FATAL_ERROR                     BIT(1)
+#define CAM_REQ_MGR_CSID_FIFO_OVERFLOW_ERROR             BIT(2)
+#define CAM_REQ_MGR_CSID_RECOVERY_OVERFLOW_ERROR         BIT(3)
+#define CAM_REQ_MGR_CSID_LANE_FIFO_OVERFLOW_ERROR        BIT(4)
+#define CAM_REQ_MGR_CSID_PIXEL_COUNT_MISMATCH            BIT(5)
+#define CAM_REQ_MGR_CSID_RX_PKT_HDR_CORRUPTION           BIT(6)
+#define CAM_REQ_MGR_CSID_MISSING_PKT_HDR_DATA            BIT(7)
+#define CAM_REQ_MGR_CSID_ERR_ON_SENSOR_SWITCHING         BIT(8)
+#define CAM_REQ_MGR_CSID_UNBOUNDED_FRAME                 BIT(9)
+#define CAM_REQ_MGR_ICP_NO_MEMORY                        BIT(10)
+#define CAM_REQ_MGR_ICP_SYSTEM_FAILURE                   BIT(11)
+#define CAM_REQ_MGR_CSID_MISSING_EOT                     BIT(12)
+#define CAM_REQ_MGR_CSID_RX_PKT_PAYLOAD_CORRUPTION       BIT(13)
+#define CAM_REQ_MGR_SENSOR_STREAM_OFF_FAILED             BIT(14)
+#define CAM_REQ_MGR_VALID_SHUTTER_DROPPED                BIT(15)
+#define CAM_REQ_MGR_ISP_ERR_HWPD_VIOLATION               BIT(16)
+
+/**
+ * struct cam_req_mgr_error_msg
+ * @error_type: type of error
+ * @request_id: request id of frame
+ * @device_hdl: device handle
+ * @linke_hdl: link_hdl
+ * @resource_size: size of the resource
+ * @error_code: Error code reported by the event.
+ *              Note: This field is a bit field.
+ */
+struct cam_req_mgr_error_msg {
+	__u32 error_type;
+	__u32 request_id;
+	__s32 device_hdl;
+	__s32 link_hdl;
+	__u32 resource_size;
+	__u32 error_code;
+};
+
+/**
+ * struct cam_req_mgr_frame_msg
+ * @request_id: request id of the frame
+ * @frame_id: frame id of the frame
+ * @timestamp: timestamp of the frame
+ * @link_hdl: link handle associated with this message
+ * @sof_status: sof status success or fail
+ * @frame_id_meta: refers to the meta for
+ *                that frame in specific usecases
+ * @reserved: reserved
+ */
+struct cam_req_mgr_frame_msg {
+	__u64 request_id;
+	__u64 frame_id;
+	__u64 timestamp;
+	__s32 link_hdl;
+	__u32 sof_status;
+	__u32 frame_id_meta;
+	__u32 reserved;
+};
+
+/**
+ * enum cam_req_msg_timestamp_type - Identifies index of timestamps
+ *
+ * @CAM_REQ_SOF_QTIMER_TIMESTAMP:  SOF qtimer timestamp
+ * @CAM_REQ_BOOT_TIMESTAMP:        SOF boot timestamp
+ * @CAM_REQ_TIMESTAMP_TYPE:        Max enum index for timestamp type
+ *
+ */
+enum cam_req_msg_timestamp_type {
+	CAM_REQ_SOF_QTIMER_TIMESTAMP = 0,
+	CAM_REQ_BOOT_TIMESTAMP,
+	CAM_REQ_TIMESTAMP_MAX
+};
+
+/**
+ * struct cam_req_mgr_frame_msg
+ * @request_id: request id of the frame
+ * @frame_id: frame id of the frame
+ * @timestamps: array for all the supported timestamps
+ * @link_hdl: link handle associated with this message
+ * @frame_id_meta: refers to the meta for
+ *                that frame in specific usecases
+ * @reserved: reserved for future addtions and max size for structure can be 64 bytes
+ */
+struct cam_req_mgr_frame_msg_v2 {
+	__u64 request_id;
+	__u64 frame_id;
+	__u64 timestamps[CAM_REQ_TIMESTAMP_MAX];
+	__s32 link_hdl;
+	__u32 frame_id_meta;
+	__u32 reserved[4];
+};
+
+/**
+ * struct cam_req_mgr_custom_msg
+ * @custom_type: custom type
+ * @request_id: request id of the frame
+ * @frame_id: frame id of the frame
+ * @timestamp: timestamp of the frame
+ * @link_hdl: link handle associated with this message
+ * @custom_data: custom data
+ */
+struct cam_req_mgr_custom_msg {
+	__u32 custom_type;
+	__u64 request_id;
+	__u64 frame_id;
+	__u64 timestamp;
+	__s32 link_hdl;
+	__u64 custom_data;
+};
+
+/**
+ * Request Manager Node Msg Event Types
+ * @CAM_REQ_MGR_NO_EVENT                    : Event type not reported by the hardware
+ * @CAM_REQ_MGR_RETRY_EVENT                 : Retry request reported from the hardware
+ */
+#define CAM_REQ_MGR_NO_EVENT                             0
+#define CAM_REQ_MGR_RETRY_EVENT                          1
+
+/**
+ * Request Manager Node Msg Event Cause
+ * @CAM_REQ_MGR_CAUSE_UNREPORTED           : Event cause not reported by the hardware
+ * @CAM_REQ_MGR_JPEG_THUBNAIL_SIZE_ERROR   : JPEG Thumbnail encode size exceeds the threshold size
+ */
+#define CAM_REQ_MGR_CAUSE_UNREPORTED                     0
+#define CAM_REQ_MGR_JPEG_THUBNAIL_SIZE_ERROR             1
+
+/**
+* struct cam_req_mgr_node_msg
+* @device_hdl          : Device handle of the device reporting the error
+* @link_hdl            : link hdl for real time devices
+* @event_type          : Type of the event
+* @event_cause         : Cause of the event
+* @request_id          : Request id
+* @custom_data         : custom data
+* @reserved            : Reserved field
+*/
+struct cam_req_mgr_node_msg {
+	__s32 device_hdl;
+	__s32 link_hdl;
+	__u32 event_type;
+	__u32 event_cause;
+	__u64 request_id;
+	__u64 custom_data;
+	__u32 reserved[2];
+};
+
+/**
+ * Request Manager Msg Page Fault event
+ * @CAM_REQ_MGR_PF_EVT_BUF_NOT_FOUND          : Faulted buffer not found
+ * @CAM_REQ_MGR_PF_EVT_BUF_FOUND_IO_CFG       : Faulted buffer from io_cfg found
+ * @CAM_REQ_MGR_PF_EVT_BUF_FOUND_REF_BUF      : Faulted io region buffer in Patch found
+ * @CAM_REQ_MGR_PF_EVT_BUF_FOUND_CDM          : Fault in cmd buffer
+ * @CAM_REQ_MGR_PF_EVT_BUF_FOUND_SHARED       : Fault in shared region buffer
+ */
+#define CAM_REQ_MGR_PF_EVT_BUF_NOT_FOUND            0
+#define CAM_REQ_MGR_PF_EVT_BUF_FOUND_IO_CFG         1
+#define CAM_REQ_MGR_PF_EVT_BUF_FOUND_REF_BUF        2
+#define CAM_REQ_MGR_PF_EVT_BUF_FOUND_CDM            3
+#define CAM_REQ_MGR_PF_EVT_BUF_FOUND_SHARED         4
+
+/**
+ * Faulted Memory Type
+ * @CAM_REQ_MGR_PF_TYPE_NULL               : Fault on NULL
+ * @CAM_REQ_MGR_PF_TYPE_OUT_OF_BOUND       : Fault on address outside of any mapped buffer
+ * @CAM_REQ_MGR_PF_TYPE_MAPPED_REGION      : Fault on address within a mapped buffer
+ */
+#define CAM_REQ_MGR_PF_TYPE_NULL            0
+#define CAM_REQ_MGR_PF_TYPE_OUT_OF_BOUND    1
+#define CAM_REQ_MGR_PF_TYPE_MAPPED_REGION   2
+
+/**
+ * Faulted Memory stage
+ * @CAM_REQ_MGR_STAGE1_FAULT     : Faulted memory in non-secure stage
+ * @CAM_REQ_MGR_STAGE2_FAULT     : Faulted memory in secure stage
+ */
+#define CAM_REQ_MGR_STAGE1_FAULT     0
+#define CAM_REQ_MGR_STAGE2_FAULT     1
+
+/**
+ * struct cam_req_mgr_pf_err_msg
+ * @device_hdl          : device handle of the device reporting the error
+ * @link_hdl            : link hdl for real time devices
+ * @pf_evt              : indicates if no faulted buffer found or found
+ *                        io cfg faulted buffer or found ref faulted buffer
+ *                        or found cdm shared fautled buffer
+ * @pf_type             : indicates if page fault type is fault on NULL or
+ *                        fault out of bound or fault within mapped region
+ * @pf_stage            : indicates if faulted memory is from secure or non-secure region
+ * @patch_id            : index to which patch in the packet is faulted
+ * @buf_hdl             : faulted buffer memory handle
+ * @offset              : offset provided in the packet
+ * @port_id             : resource type of the io cfg in packet
+ * @far_delta           : memory gab between faulted addr and closest
+ *                        buffer's starting address
+ * @req_id              : request id for the faulted request
+ * @bid                 : bus id
+ * @pid                 : unique id for hw group of ports
+ * @mid                 : port id of hw
+ * @reserved            : reserved fields
+ */
+struct cam_req_mgr_pf_err_msg {
+	__s32 device_hdl;
+	__s32 link_hdl;
+	__u8 pf_evt;
+	__u8 pf_type;
+	__u8 pf_stage;
+	__u8 patch_id;
+	__s32 buf_hdl;
+	__u32 offset;
+	__u32 port_id;
+	__u64 far_delta;
+	__u64 req_id;
+	__u8 bid;
+	__u8 pid;
+	__u16 mid;
+	__u32 reserved[3];
+};
+
+/**
+ * struct cam_req_mgr_message - 64 bytes is the max size that can be sent as v4l2 evt
+ * @session_hdl: session to which the frame belongs to
+ * @reserved: reserved field
+ * @u: union which can either be error/frame/custom/node message/page fault message
+ */
+struct cam_req_mgr_message {
+	__s32 session_hdl;
+	__s32 reserved;
+	union {
+		struct cam_req_mgr_error_msg err_msg;
+		struct cam_req_mgr_frame_msg frame_msg;
+		struct cam_req_mgr_frame_msg_v2 frame_msg_v2;
+		struct cam_req_mgr_custom_msg custom_msg;
+		struct cam_req_mgr_node_msg node_msg;
+		struct cam_req_mgr_pf_err_msg pf_err_msg;
+	} u;
+};
+#endif /* __UAPI_LINUX_CAM_REQ_MGR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_sensor.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_sensor.h
@@ -0,0 +1,1278 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_SENSOR_H__
+#define __UAPI_CAM_SENSOR_H__
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+#include <media/cam_defs.h>
+
+#define CAM_SENSOR_PROBE_CMD      (CAM_COMMON_OPCODE_MAX + 1)
+#define CAM_FLASH_MAX_LED_TRIGGERS 2
+#define MAX_OIS_NAME_SIZE 32
+#define MAX_OIS_FW_COUNT  2
+#define CAM_CSIPHY_SECURE_MODE_ENABLED 1
+#define CAM_SENSOR_NAME_MAX_SIZE 32
+
+#define SKEW_CAL_MASK             BIT(1)
+#define PREAMBLE_PATTEN_CAL_MASK  BIT(2)
+
+/* CSIPHY driver cmd buffer meta types */
+#define CAM_CSIPHY_PACKET_META_LANE_INFO           0
+#define CAM_CSIPHY_PACKET_META_GENERIC_BLOB        1
+#define CAM_CSIPHY_PACKET_META_LANE_INFO_V2        2
+
+/* CSIPHY blob types */
+#define CAM_CSIPHY_GENERIC_BLOB_TYPE_CDR_CONFIG    0
+#define CAM_CSIPHY_GENERIC_BLOB_TYPE_AUX_CONFIG    1
+
+/* CSIPHY CDR tolerance operations */
+#define CAM_CSIPHY_CDR_ADD_TOLERANCE               1
+#define CAM_CSIPHY_CDR_SUB_TOLERANCE               2
+
+/* SENSOR driver cmd buffer meta types */
+#define CAM_SENSOR_PACKET_I2C_COMMANDS             0
+#define CAM_SENSOR_PACKET_GENERIC_BLOB             1
+
+/* SENSOR blob types */
+#define CAM_SENSOR_GENERIC_BLOB_RES_INFO           0
+
+enum camera_sensor_cmd_type {
+	CAMERA_SENSOR_CMD_TYPE_INVALID,
+	CAMERA_SENSOR_CMD_TYPE_PROBE,
+	CAMERA_SENSOR_CMD_TYPE_PWR_UP,
+	CAMERA_SENSOR_CMD_TYPE_PWR_DOWN,
+	CAMERA_SENSOR_CMD_TYPE_I2C_INFO,
+	CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR,
+	CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_RD,
+	CAMERA_SENSOR_CMD_TYPE_I2C_CONT_WR,
+	CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD,
+	CAMERA_SENSOR_CMD_TYPE_WAIT,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_FIRE,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_RER,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_QUERYCURR,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET,
+	CAMERA_SENSOR_CMD_TYPE_RD_DATA,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE,
+	CAMERA_SENSOR_OIS_CMD_TYPE_FW_INFO,
+	CAMERA_SENSOR_CMD_TYPE_RES_INFO,
+	CAMERA_SENSOR_CMD_TYPE_I2C_RD_APPEND_WR,
+	CAMERA_SENSOR_CMD_TYPE_I2C_SEQUENTIAL_XFER_LOCK,
+	CAMERA_SENSOR_CMD_TYPE_I2C_SEQUENTIAL_XFER_UNLOCK,
+	CAMERA_SENSOR_CMD_TYPE_MAX,
+};
+
+enum cam_actuator_packet_opcodes {
+	CAM_ACTUATOR_PACKET_OPCODE_INIT,
+	CAM_ACTUATOR_PACKET_AUTO_MOVE_LENS,
+	CAM_ACTUATOR_PACKET_MANUAL_MOVE_LENS,
+	CAM_ACTUATOR_PACKET_OPCODE_READ,
+	CAM_ACTUATOR_PACKET_NOP_OPCODE = 127
+};
+
+enum cam_eeprom_packet_opcodes {
+	CAM_EEPROM_PACKET_OPCODE_INIT,
+	CAM_EEPROM_WRITE
+};
+
+enum cam_ois_packet_opcodes {
+	CAM_OIS_PACKET_OPCODE_INIT,
+	CAM_OIS_PACKET_OPCODE_OIS_CONTROL,
+	CAM_OIS_PACKET_OPCODE_READ,
+	CAM_OIS_PACKET_OPCODE_WRITE_TIME
+};
+
+enum camera_sensor_i2c_op_code {
+	CAMERA_SENSOR_I2C_OP_INVALID,
+	CAMERA_SENSOR_I2C_OP_RNDM_WR,
+	CAMERA_SENSOR_I2C_OP_RNDM_WR_VERF,
+	CAMERA_SENSOR_I2C_OP_CONT_WR_BRST,
+	CAMERA_SENSOR_I2C_OP_CONT_WR_BRST_VERF,
+	CAMERA_SENSOR_I2C_OP_CONT_WR_SEQN,
+	CAMERA_SENSOR_I2C_OP_CONT_WR_SEQN_VERF,
+	CAMERA_SENSOR_I2C_OP_RNDM_RD,
+	CAMERA_SENSOR_I2C_OP_CONT_RD,
+	CAMERA_SENSOR_I2C_OP_RD_APPEND_WR,
+	CAMERA_SENSOR_I2C_OP_SEQUENTIAL_XFER_LOCK,
+	CAMERA_SENSOR_I2C_OP_SEQUENTIAL_XFER_UNLOCK,
+	CAMERA_SENSOR_I2C_OP_MAX,
+};
+
+enum camera_sensor_wait_op_code {
+	CAMERA_SENSOR_WAIT_OP_INVALID,
+	CAMERA_SENSOR_WAIT_OP_COND,
+	CAMERA_SENSOR_WAIT_OP_HW_UCND,
+	CAMERA_SENSOR_WAIT_OP_SW_UCND,
+	CAMERA_SENSOR_WAIT_OP_MAX,
+};
+
+enum cam_tpg_packet_opcodes {
+	CAM_TPG_PACKET_OPCODE_INVALID = 0,
+	CAM_TPG_PACKET_OPCODE_INITIAL_CONFIG,
+	CAM_TPG_PACKET_OPCODE_NOP,
+	CAM_TPG_PACKET_OPCODE_UPDATE,
+	CAM_TPG_PACKET_OPCODE_MAX,
+};
+
+enum cam_sensor_packet_opcodes {
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMON,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_CONFIG,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_READ,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE_V2,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_REG_BANK_UNLOCK,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_REG_BANK_LOCK,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_BUBBLE_UPDATE,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_NOP = 127,
+};
+
+enum cam_endianness_type {
+	CAM_ENDIANNESS_BIG,
+	CAM_ENDIANNESS_LITTLE,
+};
+
+enum tpg_command_type_t {
+	TPG_CMD_TYPE_INVALID = 0,
+	TPG_CMD_TYPE_GLOBAL_CONFIG,
+	TPG_CMD_TYPE_STREAM_CONFIG,
+	TPG_CMD_TYPE_ILLUMINATION_CONFIG,
+	TPG_CMD_TYPE_SETTINGS_CONFIG,
+	TPG_CMD_TYPE_MAX,
+};
+
+enum tpg_pattern_t {
+	TPG_PATTERN_INVALID = 0,
+	TPG_PATTERN_REAL_IMAGE,
+	TPG_PATTERN_RANDOM_PIXL,
+	TPG_PATTERN_RANDOM_INCREMENTING_PIXEL,
+	TPG_PATTERN_COLOR_BAR,
+	TPG_PATTERN_ALTERNATING_55_AA,
+	TPG_PATTERN_ALTERNATING_USER_DEFINED,
+	TPG_PATTERN_MAX,
+};
+
+enum tpg_color_bar_mode_t {
+	TPG_COLOR_BAR_MODE_INVALID = 0,
+	TPG_COLOR_BAR_MODE_NORMAL,
+	TPG_COLOR_BAR_MODE_SPLIT,
+	TPG_COLOR_BAR_MODE_ROTATING,
+	TPG_COLOR_BAR_MODE_MAX,
+};
+
+enum tpg_image_format_t {
+	TPG_IMAGE_FORMAT_INVALID = 0,
+	TPG_IMAGE_FORMAT_BAYER,
+	TPG_IMAGE_FORMAT_QCFA,
+	TPG_IMAGE_FORMAT_YUV,
+	TPG_IMAGE_FORMAT_JPEG,
+	TPG_IMAGE_FORMAT_MAX,
+};
+
+enum tpg_phy_type_t {
+	TPG_PHY_TYPE_INVALID = 0,
+	TPG_PHY_TYPE_DPHY,
+	TPG_PHY_TYPE_CPHY,
+	TPG_PHY_TYPE_MAX,
+};
+
+enum tpg_pixel_type_t {
+	TPG_PIXEL_TYPE_INVALID = 0,
+	TPG_PIXEL_TYPE_RED,
+	TPG_PIXEL_TYPE_GREEN,
+	TPG_PIXEL_TYPE_BLUE,
+	TPG_PIXEL_TYPE_IR,
+	TPG_PIXEL_TYPE_MONO,
+};
+
+enum tpg_exposure_type_t {
+	TPG_EXPOSUREL_TYPE_INVALID = 0,
+	TPG_EXPOSURE_TYPE_LONG,
+	TPG_EXPOSURE_TYPE_MIDDLE,
+	TPG_EXPOSURE_TYPE_SHORT,
+};
+
+enum xcfa_type_t {
+	XCFA_TYPE_BAYER = 0,
+	XCFA_TYPE_QUADCFA,
+	XCFA_TYPE_THREEXTHREECFA,
+	XCFA_TYPE_FOURXFOURCFA,
+	XCFA_TYPE_RGBIR,
+	XCFA_TYPE_RGBWC,
+	XCFA_TYPE_RGBWK,
+	XCFA_TYPE_UNCONVENTIONAL_BAYER,
+};
+
+enum tpg_interleaving_format_t {
+	TPG_INTERLEAVING_FORMAT_INVALID = 0,
+	TPG_INTERLEAVING_FORMAT_FRAME,
+	TPG_INTERLEAVING_FORMAT_LINE,
+	TPG_INTERLEAVING_FORMAT_SHDR,
+	TPG_INTERLEAVING_FORMAT_SPARSE_PD,
+	TPG_INTERLEAVING_FORMAT_MAX,
+};
+
+enum tpg_shutter_t {
+	TPG_SHUTTER_TYPE_INVALID = 0,
+	TPG_SHUTTER_TYPE_ROLLING,
+	TPG_SHUTTER_TYPE_GLOBAL,
+	TPG_SHUTTER_TYPE_MAX,
+};
+
+enum tpg_stream_t {
+	TPG_STREAM_TYPE_INVALID = 0,
+	TPG_STREAM_TYPE_IMAGE,
+	TPG_STREAM_TYPE_PDAF,
+	TPG_STREAM_TYPE_META,
+	TPG_STREAM_TYPE_MAX,
+};
+
+enum tpg_cfa_arrangement_t {
+	TPG_CFA_ARRANGEMENT_TYPE_INVALID = 0,
+	TPG_CFA_ARRANGEMENT_TYPE_MAX,
+};
+
+/**
+ * struct cam_sensor_query_cap - capabilities info for sensor
+ *
+ * @slot_info        :  Indicates about the slotId or cell Index
+ * @secure_camera    :  Camera is in secure/Non-secure mode
+ * @pos_pitch        :  Sensor position pitch
+ * @pos_roll         :  Sensor position roll
+ * @pos_yaw          :  Sensor position yaw
+ * @actuator_slot_id :  Actuator slot id which connected to sensor
+ * @eeprom_slot_id   :  EEPROM slot id which connected to sensor
+ * @ois_slot_id      :  OIS slot id which connected to sensor
+ * @flash_slot_id    :  Flash slot id which connected to sensor
+ * @csiphy_slot_id   :  CSIphy slot id which connected to sensor
+ *
+ */
+struct  cam_sensor_query_cap {
+	__u32        slot_info;
+	__u32        secure_camera;
+	__u32        pos_pitch;
+	__u32        pos_roll;
+	__u32        pos_yaw;
+	__u32        actuator_slot_id;
+	__u32        eeprom_slot_id;
+	__u32        ois_slot_id;
+	__u32        flash_slot_id;
+	__u32        csiphy_slot_id;
+} __attribute__((packed));
+
+/**
+ * struct cam_csiphy_query_cap - capabilities info for csiphy
+ *
+ * @slot_info        :  Indicates about the slotId or cell Index
+ * @version          :  CSIphy version
+ * @clk lane         :  Of the 5 lanes, informs lane configured
+ *                      as clock lane
+ * @reserved
+ */
+struct cam_csiphy_query_cap {
+	__u32            slot_info;
+	__u32            version;
+	__u32            clk_lane;
+	__u32            reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_actuator_query_cap - capabilities info for actuator
+ *
+ * @slot_info        :  Indicates about the slotId or cell Index
+ * @reserved
+ */
+struct cam_actuator_query_cap {
+	__u32            slot_info;
+	__u32            reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_eeprom_query_cap_t - capabilities info for eeprom
+ *
+ * @slot_info                  :  Indicates about the slotId or cell Index
+ * @eeprom_kernel_probe        :  Indicates about the kernel or userspace probe
+ */
+struct cam_eeprom_query_cap_t {
+	__u32            slot_info;
+	__u16            eeprom_kernel_probe;
+	__u16            is_multimodule_mode;
+} __attribute__((packed));
+
+/**
+ * struct cam_ois_query_cap_t - capabilities info for ois
+ *
+ * @slot_info                  :  Indicates about the slotId or cell Index
+ */
+struct cam_ois_query_cap_t {
+	__u32            slot_info;
+	__u16            reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_tpg_query_cap - capabilities info for tpg
+ *
+ * @slot_info        :  Indicates about the slotId or cell Index
+ * @version          :  TPG version , in msb
+ * @reserved         :  Reserved for future Use
+ * @secure_camera    :  Camera is in secure/Non-secure mode
+ * @csiphy_slot_id   :  CSIphy slot id which connected to sensor
+ */
+struct cam_tpg_query_cap {
+	__u32        slot_info;
+	__u32        version;
+	__u32        secure_camera;
+	__u32        csiphy_slot_id;
+	__u32        reserved[2];
+} __attribute__((packed));
+
+
+/**
+ * struct cam_cmd_i2c_info - Contains slave I2C related info
+ *
+ * @slave_addr      :    Slave address
+ * @i2c_freq_mode   :    4 bits are used for I2c freq mode
+ * @cmd_type        :    Explains type of command
+ */
+struct cam_cmd_i2c_info {
+	__u32    slave_addr;
+	__u8     i2c_freq_mode;
+	__u8     cmd_type;
+	__u16    reserved;
+} __attribute__((packed));
+
+/**
+ * Below macro definition is the param mask for
+ * cam_cmd_sensor_res_info.
+ */
+#define CAM_SENSOR_FEATURE_MASK                    BIT(0)
+#define CAM_SENSOR_NUM_BATCHED_FRAMES              BIT(1)
+
+/* Below macro definition is the sub definition for CAM_SENSOR_FEATURE_MASK */
+#define CAM_SENSOR_FEATURE_NONE                    0
+#define CAM_SENSOR_FEATURE_AEB_ON                  BIT(0)
+#define CAM_SENSOR_FEATURE_AEB_UPDATE              BIT(1)
+#define CAM_SENSOR_FEATURE_AEB_OFF                 BIT(2)
+#define CAM_SENSOR_FEATURE_INSENSOR_HDR_3EXP_ON    BIT(3)
+#define CAM_SENSOR_FEATURE_INSENSOR_HDR_3EXP_OFF   BIT(4)
+
+/**
+ * struct cam_cmd_sensor_res_info - Contains sensor res info
+ *
+ * res_index is the key property, it specifies the
+ * combinations of other properties enclosed in this
+ * structure.
+ *
+ * @res_index        : The resolution index that gets updated
+ *                     during a mode switch
+ * @fps              : Frame rate
+ * @width            : Pixel width to output to csiphy
+ * @height           : Pixel height to output to csiphy
+ * @caps             : Specifies capability sensor is configured
+ *                     for, (eg, XCFA, HFR), num_exposures and
+ *                     PDAF type
+ * @num_valid_params : Number of valid params
+ * @valid_param_mask : Valid param mask
+ * @params           : params
+ */
+struct cam_sensor_res_info {
+	__u16 res_index;
+	__u32 fps;
+	__u32 width;
+	__u32 height;
+	char  caps[64];
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u16 params[3];
+} __attribute__((packed));
+
+/**
+ * struct cam_ois_opcode - Contains OIS opcode
+ *
+ * @prog            :    OIS FW prog register address
+ * @coeff           :    OIS FW coeff register address
+ * @pheripheral     :    OIS pheripheral
+ * @memory          :    OIS memory
+ */
+struct cam_ois_opcode {
+	__u32 prog;
+	__u32 coeff;
+	__u32 pheripheral;
+	__u32 memory;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_ois_info - Contains OIS slave info
+ *
+ * @slave_addr            :    OIS i2c slave address
+ * @i2c_freq_mode         :    i2c frequency mode
+ * @cmd_type              :    Explains type of command
+ * @ois_fw_flag           :    indicates if fw is present or not
+ * @is_ois_calib          :    indicates the calibration data is available
+ * @ois_name              :    OIS name
+ * @opcode                :    opcode
+ */
+struct cam_cmd_ois_info {
+	__u32                 slave_addr;
+	__u8                  i2c_freq_mode;
+	__u8                  cmd_type;
+	__u8                  ois_fw_flag;
+	__u8                  is_ois_calib;
+	char                  ois_name[MAX_OIS_NAME_SIZE];
+	struct cam_ois_opcode opcode;
+} __attribute__((packed));
+
+
+/**
+ * struct cam_cmd_ois_fw_param - Contains OIS firmware param
+ *
+ * NOTE: if this struct is updated,
+ * please also update version in struct cam_cmd_ois_fw_info
+ *
+ * @fw_name         :       firmware file name
+ * @fw_start_pos    :       data start position in file
+ * @fw_size         :       firmware size
+ * @fw_len_per_write:       data length per write in bytes
+ * @fw_addr_type    :       addr type
+ * @fw_data_type    :       data type
+ * @fw_operation    :       type of operation
+ * @reserved        :       reserved for 32-bit alignment
+ * @fw_delayUs      :       delay in cci write
+ * @fw_reg_addr     :       start register addr to write
+ * @fw_init_size    :       size of fw download init settings
+ * @fw_finalize_size:       size of fw download finalize settings
+ */
+struct cam_cmd_ois_fw_param {
+	char        fw_name[MAX_OIS_NAME_SIZE];
+	__u32       fw_start_pos;
+	__u32       fw_size;
+	__u32       fw_len_per_write;
+	__u8        fw_addr_type;
+	__u8        fw_data_type;
+	__u8        fw_operation;
+	__u8        reserved;
+	__u32       fw_delayUs;
+	__u32       fw_reg_addr;
+	__u32       fw_init_size;
+	__u32       fw_finalize_size;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_ois_fw_info - Contains OIS firmware info
+ *
+ * @version         :       version info
+ *                          NOTE: if struct cam_cmd_ois_fw_param is updated,
+ *                          version here needs to be updated too.
+ * @reserved        :       reserved
+ * @cmd_type        :       Explains type of command
+ * @fw_count        :       firmware count
+ * @endianness      :       endianness combo:
+ *                          bit[3:0] firmware data's endianness
+ *                          bit[7:4] endian type of input parameter to ois driver, say QTime
+ * @fw_param        :       includes firmware parameters
+ * @num_valid_params:       Number of valid params
+ * @param_mask      :       Mask to indicate fields in params
+ * @params          :       Additional Params
+ */
+struct cam_cmd_ois_fw_info {
+	__u32                           version;
+	__u8                            reserved;
+	__u8                            cmd_type;
+	__u8                            fw_count;
+	__u8                            endianness;
+	struct cam_cmd_ois_fw_param     fw_param[MAX_OIS_FW_COUNT];
+	__u32                           num_valid_params;
+	__u32                           param_mask;
+	__u32                           params[4];
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_probe - Contains sensor slave info
+ *
+ * @data_type       :   Slave register data type
+ * @addr_type       :   Slave register address type
+ * @op_code         :   Don't Care
+ * @cmd_type        :   Explains type of command
+ * @reg_addr        :   Slave register address
+ * @expected_data   :   Data expected at slave register address
+ * @data_mask       :   Data mask if only few bits are valid
+ * @camera_id       :   Indicates the slot to which camera
+ *                      needs to be probed
+ * @reserved
+ */
+struct cam_cmd_probe {
+	__u8     data_type;
+	__u8     addr_type;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u32    reg_addr;
+	__u32    expected_data;
+	__u32    data_mask;
+	__u16    camera_id;
+	__u16    reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_probe_v2 - Contains sensor slave info version 2
+ *
+ * @data_type         :   Slave register data type
+ * @addr_type         :   Slave register address type
+ * @op_code           :   Don't Care
+ * @cmd_type          :   Explains type of command
+ * @reg_addr          :   Slave register address
+ * @expected_data     :   Data expected at slave register address
+ * @data_mask         :   Data mask if only few bits are valid
+ * @camera_id         :   Indicates the slot to which camera
+ *                      needs to be probed
+ * @pipeline_delay    :   Pipeline delay
+ * @logical_camera_id :   Logical Camera ID
+ * @sensor_name       :   Sensor's name
+ * @reserved
+ */
+struct cam_cmd_probe_v2 {
+	__u8     data_type;
+	__u8     addr_type;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u32    reg_addr;
+	__u32    expected_data;
+	__u32    data_mask;
+	__u16    camera_id;
+	__u16    pipeline_delay;
+	__u32    logical_camera_id;
+	char     sensor_name[CAM_SENSOR_NAME_MAX_SIZE];
+	__u32    reserved[4];
+} __attribute__((packed));
+
+/**
+ * struct cam_power_settings - Contains sensor power setting info
+ *
+ * @power_seq_type  :   Type of power sequence
+ * @reserved
+ * @config_val_low  :   Lower 32 bit value configuration value
+ * @config_val_high :   Higher 32 bit value configuration value
+ *
+ */
+struct cam_power_settings {
+	__u16    power_seq_type;
+	__u16    reserved;
+	__u32    config_val_low;
+	__u32    config_val_high;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_power - Explains about the power settings
+ *
+ * @count           :    Number of power settings follows
+ * @reserved
+ * @cmd_type        :    Explains type of command
+ * @power_settings  :    Contains power setting info
+ */
+struct cam_cmd_power {
+	__u32                       count;
+	__u8                        reserved;
+	__u8                        cmd_type;
+	__u16                       more_reserved;
+	union {
+		struct cam_power_settings   power_settings[1];
+		__DECLARE_FLEX_ARRAY(struct cam_power_settings, power_settings_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct i2c_rdwr_header - header of READ/WRITE I2C command
+ *
+ * @ count           :   Number of registers / data / reg-data pairs
+ * @ op_code         :   Operation code
+ * @ cmd_type        :   Command buffer type
+ * @ data_type       :   I2C data type
+ * @ addr_type       :   I2C address type
+ * @ reserved
+ */
+struct i2c_rdwr_header {
+	__u32    count;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u8     data_type;
+	__u8     addr_type;
+} __attribute__((packed));
+
+/**
+ * struct i2c_random_wr_payload - payload for I2C random write
+ *
+ * @ reg_addr        :   Register address
+ * @ reg_data        :   Register data
+ * @ mask            :   mask value
+ *
+ */
+struct i2c_random_wr_payload {
+	__u32     reg_addr;
+	__u32     reg_data;
+	__u32     mask;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_random_wr - I2C random write command
+ * @ header            :   header of READ/WRITE I2C command
+ * @ random_wr_payload :   payload for I2C random write
+ */
+struct cam_cmd_i2c_random_wr {
+	struct i2c_rdwr_header       header;
+	union {
+		struct i2c_random_wr_payload random_wr_payload[1];
+		__DECLARE_FLEX_ARRAY(struct i2c_random_wr_payload, random_wr_payload_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_read - I2C read command
+ * @ reg_data        :   Register data
+ * @ reserved
+ */
+struct cam_cmd_read {
+	__u32                reg_data;
+	__u32                reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_continuous_wr - I2C continuous write command
+ * @ header          :   header of READ/WRITE I2C command
+ * @ reg_addr        :   Register address
+ * @ data_read       :   I2C read command
+ */
+struct cam_cmd_i2c_continuous_wr {
+	struct i2c_rdwr_header header;
+	__u32                  reg_addr;
+	union {
+		struct cam_cmd_read    data_read[1];
+		__DECLARE_FLEX_ARRAY(struct cam_cmd_read, data_read_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_random_rd - I2C random read command
+ * @ header          :   header of READ/WRITE I2C command
+ * @ data_read       :   I2C read command
+ */
+struct cam_cmd_i2c_random_rd {
+	struct i2c_rdwr_header header;
+	union {
+		struct cam_cmd_read    data_read[1];
+		__DECLARE_FLEX_ARRAY(struct cam_cmd_read, data_read_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_continuous_rd - I2C continuous continuous read command
+ * @ header          :   header of READ/WRITE I2C command
+ * @ reg_addr        :   Register address
+ *
+ */
+struct cam_cmd_i2c_continuous_rd {
+	struct i2c_rdwr_header header;
+	__u32                  reg_addr;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_continuous_rd - I2C continuous continuous read command
+ * @ header          :   header of READ/WRITE I2C command
+ * @ reserved        :
+ * @ op_code         :   Opcode
+ * @ cmd_type        :   Explains type of command
+ * @ lock            :   lock or unlock
+ *
+ */
+struct cam_cmd_i2c_sequential_xfer {
+	struct i2c_rdwr_header header;
+	__u16    reserved;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u32    lock;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_conditional_wait - Conditional wait command
+ * @data_type       :   Data type
+ * @addr_type       :   Address type
+ * @op_code         :   Opcode
+ * @cmd_type        :   Explains type of command
+ * @timeout         :   Timeout for retries
+ * @reserved
+ * @reg_addr        :   Register Address
+ * @reg_data        :   Register data
+ * @data_mask       :   Data mask if only few bits are valid
+ * @camera_id       :   Indicates the slot to which camera
+ *                      needs to be probed
+ *
+ */
+struct cam_cmd_conditional_wait {
+	__u8     data_type;
+	__u8     addr_type;
+	__u16    reserved;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u16    timeout;
+	__u32    reg_addr;
+	__u32    reg_data;
+	__u32    data_mask;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_unconditional_wait - Un-conditional wait command
+ * @delay           :   Delay
+ * @op_code         :   Opcode
+ * @cmd_type        :   Explains type of command
+ */
+struct cam_cmd_unconditional_wait {
+	__s16    delay;
+	__s16    reserved;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u16    reserved1;
+} __attribute__((packed));
+
+/**
+ * cam_csiphy_cdr_sweep_params : Provides cdr blob structre
+ *
+ * @cdr_tolerance        : CDR tolerance param
+ * @tolerance_op_type    : Determines if the tolerance needs to be added/subtracted
+ *                         from default CDR value
+ * @configured_cdr       : Configured CDR value for all the lanes for the
+ *                         selected data rate, default +/- tolerance,
+ *                         this is the output
+ * @num_valid_params     : Number of valid params
+ * @valid_param_mask     : Valid param mask
+ * @params               : params
+ *
+ */
+struct cam_csiphy_cdr_sweep_params {
+	__u32 cdr_tolerance;
+	__u32 tolerance_op_type;
+	__u32 configured_cdr;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[3];
+};
+
+/**
+ * cam_csiphy_aux_settings_params : Provides aux blob structre
+ *
+ * @data_rate_aux_mask : Auxiliary settings update for different data rates,
+ *                       this is the output
+ * @num_valid_params   : Number of valid params
+ * @valid_param_mask   : Valid param mask
+ * @params             : params
+ *
+ */
+struct cam_csiphy_aux_settings_params {
+	__u64 data_rate_aux_mask;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[2];
+};
+
+/**
+ * cam_csiphy_info       : Provides cmdbuffer structre
+ * @lane_assign          : Lane sensor will be using
+ * @mipi_flags           : Phy flags for different calibration operations
+ * @lane_cnt             : Total number of lanes
+ * @secure_mode          : Secure mode flag to enable / disable
+ * @settle_time          : Settling time in ms
+ * @data_rate            : Data rate
+ *
+ */
+struct cam_csiphy_info {
+	__u16    reserved;
+	__u16    lane_assign;
+	__u16    mipi_flags;
+	__u8     lane_cnt;
+	__u8     secure_mode;
+	__u64    settle_time;
+	__u64    data_rate;
+} __attribute__((packed));
+
+/**
+ * cam_csiphy_info_v2    : Provides cmdbuffer structre
+ * @version              : Version number
+ * @lane_assign          : Lane sensor will be using
+ * @mipi_flags           : Phy flags for different calibration operations
+ * @lane_cnt             : Total number of lanes
+ * @secure_mode          : Secure mode flag to enable / disable
+ * @settle_time          : Settling time in ms
+ * @data_rate            : Data rate
+ * @channel_type         : Channel type indicates apply which channel settings
+ * @num_valid_params     : Number of valid params
+ * @param_mask           : Mask to indicate what the parameters are
+ * @params               : Additional params
+ */
+struct cam_csiphy_info_v2 {
+	__u16    version;
+	__u16    lane_assign;
+	__u16    mipi_flags;
+	__u8     lane_cnt;
+	__u8     secure_mode;
+	__u64    settle_time;
+	__u64    data_rate;
+	__u32    channel_type;
+	__u32    num_vaild_params;
+	__u32    param_mask;
+	__u32    params[5];
+} __attribute__((packed));
+
+/**
+ * cam_csiphy_acquire_dev_info : Information needed for
+ *                               csiphy at the time of acquire
+ * @combo_mode                 : Indicates the device mode of operation
+ * @cphy_dphy_combo_mode       : Info regarding cphy_dphy_combo mode
+ * @csiphy_3phase              : Details whether 3Phase / 2Phase operation
+ * @reserve
+ *
+ */
+struct cam_csiphy_acquire_dev_info {
+	__u32    combo_mode;
+	__u16    cphy_dphy_combo_mode;
+	__u8     csiphy_3phase;
+	__u8     reserve;
+} __attribute__((packed));
+
+/**
+ * cam_sensor_acquire_dev : Updates sensor acuire cmd
+ * @device_handle  :    Updates device handle
+ * @session_handle :    Session handle for acquiring device
+ * @handle_type    :    Resource handle type
+ * @reserved
+ * @info_handle    :    Handle to additional info
+ *                      needed for sensor sub modules
+ *
+ */
+struct cam_sensor_acquire_dev {
+	__u32    session_handle;
+	__u32    device_handle;
+	__u32    handle_type;
+	__u32    reserved;
+	__u64    info_handle;
+} __attribute__((packed));
+
+/**
+ * cam_tpg_acquire_dev : Updates tpg acuire cmd
+ * @device_handle  :    Updates device handle
+ * @session_handle :    Session handle for acquiring device
+ * @handle_type    :    Resource handle type
+ * @reserved
+ * @info_handle    :    Handle to additional info
+ *                      needed for sensor sub modules
+ */
+struct cam_tpg_acquire_dev {
+	__u32    session_handle;
+	__u32    device_handle;
+	__u32    handle_type;
+	__u32    reserved;
+	__u64    info_handle;
+} __attribute__((packed));
+
+/**
+ * cam_sensor_streamon_dev : StreamOn command for the sensor
+ * @session_handle :    Session handle for acquiring device
+ * @device_handle  :    Updates device handle
+ * @handle_type    :    Resource handle type
+ * @reserved
+ * @info_handle    :    Information Needed at the time of streamOn
+ *
+ */
+struct cam_sensor_streamon_dev {
+	__u32    session_handle;
+	__u32    device_handle;
+	__u32    handle_type;
+	__u32    reserved;
+	__u64    info_handle;
+} __attribute__((packed));
+
+
+/**
+ * stream_dimension : Stream dimension
+ *
+ * @left   : left pixel locaiton of stream
+ * @top    : top  pixel location of stream
+ * @width  : width of the image stream
+ * @height : Height of the image stream
+ */
+struct stream_dimension {
+	uint32_t left;
+	uint32_t top;
+	uint32_t width;
+	uint32_t height;
+};
+
+/**
+ * tpg_command_header_t : tpg command common header
+ *
+ * @cmd_type    : command type
+ * @size        : size of the command including header
+ * @cmd_version : version of the command associated
+ */
+struct tpg_command_header_t {
+	__u32 cmd_type;
+	ssize_t  size;
+	uint32_t cmd_version;
+} __attribute__((packed));
+
+/**
+ * tpg_pixel_coordinate_t : pixel coordinate structure
+ *
+ * @xcoordinate           : X coordinate
+ * @ycoordinate           : Y coordiante
+ * @pixel_type            : red green blue ir mono
+ */
+struct tpg_pixel_coordinate_t {
+	uint32_t xcoordinate;
+	uint32_t ycoordinate;
+	uint32_t exposure_type;
+	uint32_t pixel_type;
+} __attribute__((packed));
+
+/**
+ * tpg_cfa_information_t      : tpg cfa information structure
+ *
+ * @number_of_pixel_per_color : number of pixel per color
+ * @pattern_width             : pattern width
+ * @pattern_height            : pattern height
+ * @pixel_coordinate_count    : pixel coordinate count
+ * @pixel_coordinate          : pixel coordinate array
+ */
+struct tpg_cfa_information_t {
+	uint32_t number_of_pixel_per_color;
+	uint32_t pattern_width;
+	uint32_t pattern_height;
+	uint32_t pixel_coordinate_count;
+	struct tpg_pixel_coordinate_t pixel_coordinate[64];
+} __attribute__((packed));
+
+/**
+ * tpg_reg_settings : TPG register settings
+ *
+ * @reg_offset : register offset
+ * @reg_value  : register value
+ * @operation  : operation
+ * @delay_us   : delay in micro second
+ */
+struct tpg_reg_settings {
+	uint32_t reg_offset;
+	uint32_t reg_value;
+	uint32_t operation;
+	uint32_t delay_us;
+	uint32_t reserved[4];
+} __attribute__((packed));
+
+/**
+ * tpg_settings_config_t : settings configuration command structure
+ *
+ * @header                : common header
+ * @settings_array_offset : settings array offset
+ * @settings_array_size   : settings array size
+ * @active_count          : active count
+ * @param_mask            : Mask to indicate fields in params
+ * @params                : Additional Params
+ */
+struct tpg_settings_config_t {
+	struct tpg_command_header_t header;
+	uint32_t settings_array_offset;
+	uint32_t settings_array_size;
+	uint32_t active_count;
+	uint32_t param_mask;
+	uint32_t params[4];
+} __attribute__((packed));
+
+/**
+ * tpg_global_config_t : global configuration command structure
+ *
+ * @header              : common header
+ * @phy_type            : phy type , cpy , dphy
+ * @lane_count          : number of lanes used
+ * @interleaving_format : interleaving format used
+ * @phy_mode            : phy mode of operation
+ * @shutter_type        : shutter type
+ * @mode                : if any specific mode needs to configured
+ * @hbi                 : horizontal blanking intervel
+ * @vbi                 : vertical blanking intervel
+ * @skip_pattern        : frame skip pattern
+ * @tpg_clock           : tpg clock
+ * @reserved            : reserved for future use
+ */
+struct tpg_global_config_t {
+	struct tpg_command_header_t header;
+	enum tpg_phy_type_t phy_type;
+	uint8_t lane_count;
+	enum tpg_interleaving_format_t interleaving_format;
+	uint8_t phy_mode;
+	enum tpg_shutter_t shutter_type;
+	uint32_t mode;
+	uint32_t hbi;
+	uint32_t vbi;
+	uint32_t skip_pattern;
+	uint64_t tpg_clock;
+	uint32_t reserved[4];
+} __attribute__((packed));
+
+/**
+ * tpg_old_stream_config_t : stream configuration command
+ *
+ * @header:  common tpg command header
+ * @pattern_type     : tpg pattern type used in this stream
+ * @cb_mode          : tpg color bar mode used in this stream
+ * @frame_count      : frame count in case of trigger burst mode
+ * @stream_type      : type of stream like image pdaf etc
+ * @stream_dimension : Dimension of the stream
+ * @pixel_depth      : bits per each pixel
+ * @cfa_arrangement  : color filter arragement
+ * @output_format    : output image format
+ * @hbi              : horizontal blanking intervel
+ * @vbi              : vertical   blanking intervel
+ * @vc               : virtual channel of this stream
+ * @dt               : data type of this stream
+ * @skip_pattern     : skip pattern for this stream
+ * @rotate_period    : rotate period for this stream
+ * @reserved         : reserved for future use
+ */
+struct tpg_old_stream_config_t {
+	struct tpg_command_header_t header;
+	enum tpg_pattern_t pattern_type;
+	enum tpg_color_bar_mode_t cb_mode;
+	uint32_t frame_count;
+	enum tpg_stream_t stream_type;
+	struct stream_dimension stream_dimension;
+	uint8_t pixel_depth;
+	enum tpg_cfa_arrangement_t cfa_arrangement;
+	enum tpg_image_format_t output_format;
+	uint32_t hbi;
+	uint32_t vbi;
+	uint16_t vc;
+	uint16_t dt;
+	uint32_t skip_pattern;
+	uint32_t rotate_period;
+	uint32_t reserved[4];
+} __attribute__((packed));
+
+/**
+ * tpg_stream_config_t : stream configuration command
+ *
+ * @header:  common tpg command header
+ * @pattern_type     : tpg pattern type used in this stream
+ * @cb_mode          : tpg color bar mode used in this stream
+ * @frame_count      : frame count in case of trigger burst mode
+ * @stream_type      : type of stream like image pdaf etc
+ * @stream_dimension : Dimension of the stream
+ * @pixel_depth      : bits per each pixel
+ * @cfa_arrangement  : color filter arragement
+ * @output_format    : output image format
+ * @hbi              : horizontal blanking intervel
+ * @vbi              : vertical   blanking intervel
+ * @vc               : virtual channel of this stream
+ * @dt               : data type of this stream
+ * @skip_pattern     : skip pattern for this stream
+ * @rotate_period    : rotate period for this stream
+ * @xcfa_debug       : for xcfa debug;
+ * @shdr_line_offset0 : for shdr line offset0
+ * @shdr_line_offset1 : for shdr line offset1
+ * @reserved         : reserved for future use
+ */
+struct tpg_stream_config_t {
+	struct tpg_command_header_t header;
+	enum tpg_pattern_t pattern_type;
+	enum tpg_color_bar_mode_t cb_mode;
+	uint32_t frame_count;
+	enum tpg_stream_t stream_type;
+	struct stream_dimension stream_dimension;
+	uint8_t pixel_depth;
+	enum tpg_cfa_arrangement_t cfa_arrangement;
+	enum tpg_image_format_t output_format;
+	uint32_t hbi;
+	uint32_t vbi;
+	uint16_t vc;
+	uint16_t dt;
+	uint32_t skip_pattern;
+	uint32_t rotate_period;
+	uint32_t xcfa_debug;
+	uint32_t shdr_line_offset0;
+	uint32_t shdr_line_offset1;
+	uint32_t reserved[4];
+} __attribute__((packed));
+
+/**
+ * tpg_stream_config_t : stream configuration command
+ *
+ * @header:  common tpg command header
+ * @pattern_type     : tpg pattern type used in this stream
+ * @cb_mode          : tpg color bar mode used in this stream
+ * @frame_count      : frame count in case of trigger burst mode
+ * @stream_type      : type of stream like image pdaf etc
+ * @stream_dimension : Dimension of the stream
+ * @pixel_depth      : bits per each pixel
+ * @cfa_arrangement  : color filter arragement
+ * @output_format    : output image format
+ * @hbi              : horizontal blanking intervel
+ * @vbi              : vertical   blanking intervel
+ * @vc               : virtual channel of this stream
+ * @dt               : data type of this stream
+ * @skip_pattern     : skip pattern for this stream
+ * @rotate_period    : rotate period for this stream
+ * @shdr_line_offset0 : for shdr line offset0
+ * @shdr_line_offset1 : for shdr line offset1
+ * @cfa_info_exist    : cfa info exists
+ * @cfa_info          : cfa information
+ * @xcfa_type         : xcfa type
+ * @reserved          : reserved for future use
+ */
+struct tpg_stream_config_v3_t {
+	struct tpg_command_header_t header;
+	uint32_t pattern_type;
+	uint32_t cb_mode;
+	uint32_t frame_count;
+	uint32_t stream_type;
+	struct stream_dimension stream_dimension;
+	uint32_t pixel_depth;
+	uint32_t cfa_arrangement;
+	uint32_t output_format;
+	uint32_t hbi;
+	uint32_t vbi;
+	uint16_t vc;
+	uint16_t dt;
+	uint32_t skip_pattern;
+	uint32_t rotate_period;
+	uint32_t xcfa_debug;
+	uint32_t shdr_line_offset0;
+	uint32_t shdr_line_offset1;
+	uint32_t cfa_info_exist;
+	struct tpg_cfa_information_t cfa_info;
+	uint32_t xcfa_type;
+	uint32_t reserved[5];
+} __attribute__((packed));
+
+/**
+ * tpg_illumination_control : illumianation control command
+ *
+ * @header         : common header for tpg command
+ * @vc             : virtual channel to identify the stream
+ * @dt             : dt to identify the stream
+ * @exposure_short : short exposure time
+ * @exposure_mid   : mid exposure time
+ * @exposure_long  : long exposure time
+ * @r_gain         : r channel gain
+ * @g_gain         : g channel gain
+ * @b_gain         : b channel gain
+ * @reserved       : reserved for future use
+ */
+struct tpg_illumination_control {
+	struct tpg_command_header_t header;
+	uint16_t vc;
+	uint16_t dt;
+	uint32_t exposure_short;
+	uint32_t exposure_mid;
+	uint32_t exposure_long;
+	uint16_t r_gain;
+	uint16_t g_gain;
+	uint16_t b_gain;
+	uint32_t reserved[4];
+} __attribute__((packed));
+
+/**
+ * struct cam_flash_init : Init command for the flash
+ * @flash_type  :    flash hw type
+ * @reserved
+ * @cmd_type    :    command buffer type
+ */
+struct cam_flash_init {
+	__u32    flash_type;
+	__u8     reserved;
+	__u8     cmd_type;
+	__u16    reserved1;
+} __attribute__((packed));
+
+/**
+ * struct cam_flash_set_rer : RedEyeReduction command buffer
+ *
+ * @count             :   Number of flash leds
+ * @opcode            :   Command buffer opcode
+ *			CAM_FLASH_FIRE_RER
+ * @cmd_type          :   command buffer operation type
+ * @num_iteration     :   Number of led turn on/off sequence
+ * @reserved
+ * @led_on_delay_ms   :   flash led turn on time in ms
+ * @led_off_delay_ms  :   flash led turn off time in ms
+ * @led_current_ma    :   flash led current in ma
+ *
+ */
+struct cam_flash_set_rer {
+	__u32    count;
+	__u8     opcode;
+	__u8     cmd_type;
+	__u16    num_iteration;
+	__u32    led_on_delay_ms;
+	__u32    led_off_delay_ms;
+	__u32    led_current_ma[CAM_FLASH_MAX_LED_TRIGGERS];
+} __attribute__((packed));
+
+/**
+ * struct cam_flash_set_on_off : led turn on/off command buffer
+ *
+ * @count                  : Number of Flash leds
+ * @opcode                 : Command buffer opcodes
+ *			     CAM_FLASH_FIRE_LOW
+ *			     CAM_FLASH_FIRE_HIGH
+ *			     CAM_FLASH_OFF
+ * @cmd_type               : Command buffer operation type
+ * @led_current_ma         : Flash led current in ma
+ * @time_on_duration_ns    : Flash time on duration in ns
+ * @led_on_wait_time_ns    : Flash led turn on wait time in ns
+ *
+ */
+struct cam_flash_set_on_off {
+	__u32    count;
+	__u8     opcode;
+	__u8     cmd_type;
+	__u16    reserved;
+	__u32    led_current_ma[CAM_FLASH_MAX_LED_TRIGGERS];
+	__u64    time_on_duration_ns;
+	__u64    led_on_wait_time_ns;
+} __attribute__((packed));
+
+/**
+ * struct cam_flash_query_curr : query current command buffer
+ *
+ * @reserved
+ * @opcode            :   command buffer opcode
+ * @cmd_type          :   command buffer operation type
+ * @query_current_ma  :   battery current in ma
+ *
+ */
+struct cam_flash_query_curr {
+	__u16    reserved;
+	__u8     opcode;
+	__u8     cmd_type;
+	__u32    query_current_ma;
+} __attribute__ ((packed));
+
+/**
+ * struct cam_flash_query_cap  :  capabilities info for flash
+ *
+ * @slot_info           :  Indicates about the slotId or cell Index
+ * @max_current_flash   :  max supported current for flash
+ * @max_duration_flash  :  max flash turn on duration
+ * @max_current_torch   :  max supported current for torch
+ *
+ */
+struct cam_flash_query_cap_info {
+	__u32    slot_info;
+	__u32    max_current_flash[CAM_FLASH_MAX_LED_TRIGGERS];
+	__u32    max_duration_flash[CAM_FLASH_MAX_LED_TRIGGERS];
+	__u32    max_current_torch[CAM_FLASH_MAX_LED_TRIGGERS];
+} __attribute__ ((packed));
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_sync.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_sync.h
@@ -0,0 +1,448 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_SYNC_H__
+#define __UAPI_CAM_SYNC_H__
+
+#include <linux/videodev2.h>
+#include <linux/types.h>
+#include <linux/ioctl.h>
+#include <linux/media.h>
+
+#define CAM_SYNC_DEVICE_NAME                     "cam_sync_device"
+
+/* V4L event which user space will subscribe to */
+#define CAM_SYNC_V4L_EVENT                       (V4L2_EVENT_PRIVATE_START + 0)
+#define CAM_SYNC_V4L_EVENT_V2                    (V4L2_EVENT_PRIVATE_START + 1)
+
+/* Specific event ids to get notified in user space */
+#define CAM_SYNC_V4L_EVENT_ID_CB_TRIG            0
+
+/* Size of opaque payload sent to kernel for safekeeping until signal time */
+#define CAM_SYNC_USER_PAYLOAD_SIZE               2
+
+/* Device type for sync device needed for device discovery */
+#define CAM_SYNC_DEVICE_TYPE                     (MEDIA_ENT_F_OLD_BASE)
+
+#define CAM_SYNC_GET_PAYLOAD_PTR(ev, type)       \
+	(type *)((char *)ev.u.data + sizeof(struct cam_sync_ev_header))
+
+#define CAM_SYNC_GET_HEADER_PTR(ev)              \
+	((struct cam_sync_ev_header *)ev.u.data)
+
+#define CAM_SYNC_GET_PAYLOAD_PTR_V2(ev, type)       \
+	(type *)((char *)ev.u.data + sizeof(struct cam_sync_ev_header_v2))
+
+#define CAM_SYNC_GET_HEADER_PTR_V2(ev)              \
+	((struct cam_sync_ev_header_v2 *)ev.u.data)
+
+#define CAM_SYNC_STATE_INVALID                   0
+#define CAM_SYNC_STATE_ACTIVE                    1
+#define CAM_SYNC_STATE_SIGNALED_SUCCESS          2
+#define CAM_SYNC_STATE_SIGNALED_ERROR            3
+#define CAM_SYNC_STATE_SIGNALED_CANCEL           4
+
+/* Top level common sync event reason types */
+#define CAM_SYNC_COMMON_EVENT_START       0
+#define CAM_SYNC_COMMON_EVENT_UNUSED      (CAM_SYNC_COMMON_EVENT_START + 0)
+#define CAM_SYNC_COMMON_EVENT_SUCCESS     (CAM_SYNC_COMMON_EVENT_START + 1)
+#define CAM_SYNC_COMMON_EVENT_FLUSH       (CAM_SYNC_COMMON_EVENT_START + 2)
+#define CAM_SYNC_COMMON_EVENT_STOP        (CAM_SYNC_COMMON_EVENT_START + 3)
+#define CAM_SYNC_COMMON_EVENT_SYNX        (CAM_SYNC_COMMON_EVENT_START + 4)
+#define CAM_SYNC_COMMON_REG_PAYLOAD_EVENT (CAM_SYNC_COMMON_EVENT_START + 5)
+#define CAM_SYNC_COMMON_SYNC_SIGNAL_EVENT (CAM_SYNC_COMMON_EVENT_START + 6)
+#define CAM_SYNC_COMMON_RELEASE_EVENT     (CAM_SYNC_COMMON_EVENT_START + 7)
+#define CAM_SYNC_COMMON_EVENT_END         (CAM_SYNC_COMMON_EVENT_START + 50)
+
+/* ISP Sync event reason types */
+#define CAM_SYNC_ISP_EVENT_START                     (CAM_SYNC_COMMON_EVENT_END + 1)
+#define CAM_SYNC_ISP_EVENT_UNKNOWN                   (CAM_SYNC_ISP_EVENT_START + 0)
+#define CAM_SYNC_ISP_EVENT_BUBBLE                    (CAM_SYNC_ISP_EVENT_START + 1)
+#define CAM_SYNC_ISP_EVENT_OVERFLOW                  (CAM_SYNC_ISP_EVENT_START + 2)
+#define CAM_SYNC_ISP_EVENT_P2I_ERROR                 (CAM_SYNC_ISP_EVENT_START + 3)
+#define CAM_SYNC_ISP_EVENT_VIOLATION                 (CAM_SYNC_ISP_EVENT_START + 4)
+#define CAM_SYNC_ISP_EVENT_BUSIF_OVERFLOW            (CAM_SYNC_ISP_EVENT_START + 5)
+#define CAM_SYNC_ISP_EVENT_FLUSH                     (CAM_SYNC_ISP_EVENT_START + 6)
+#define CAM_SYNC_ISP_EVENT_HW_STOP                   (CAM_SYNC_ISP_EVENT_START + 7)
+#define CAM_SYNC_ISP_EVENT_RECOVERY_OVERFLOW         (CAM_SYNC_ISP_EVENT_START + 8)
+#define CAM_SYNC_ISP_EVENT_CSID_OUTPUT_FIFO_OVERFLOW (CAM_SYNC_ISP_EVENT_START + 9)
+#define CAM_SYNC_ISP_EVENT_CSID_RX_ERROR             (CAM_SYNC_ISP_EVENT_START + 10)
+#define CAM_SYNC_ISP_EVENT_CSID_SENSOR_SWITCH_ERROR  (CAM_SYNC_ISP_EVENT_START + 11)
+#define CAM_SYNC_ISP_EVENT_END                       (CAM_SYNC_ISP_EVENT_START + 50)
+
+/* ICP Sync event reason types */
+#define CAM_SYNC_ICP_EVENT_START                 (CAM_SYNC_ISP_EVENT_END + 1)
+#define CAM_SYNC_ICP_EVENT_UNKNOWN               (CAM_SYNC_ICP_EVENT_START + 0)
+#define CAM_SYNC_ICP_EVENT_FRAME_PROCESS_FAILURE (CAM_SYNC_ICP_EVENT_START + 1)
+#define CAM_SYNC_ICP_EVENT_CONFIG_ERR            (CAM_SYNC_ICP_EVENT_START + 2)
+#define CAM_SYNC_ICP_EVENT_NO_MEMORY             (CAM_SYNC_ICP_EVENT_START + 3)
+#define CAM_SYNC_ICP_EVENT_BAD_STATE             (CAM_SYNC_ICP_EVENT_START + 4)
+#define CAM_SYNC_ICP_EVENT_BAD_PARAM             (CAM_SYNC_ICP_EVENT_START + 5)
+#define CAM_SYNC_ICP_EVENT_BAD_ITEM              (CAM_SYNC_ICP_EVENT_START + 6)
+#define CAM_SYNC_ICP_EVENT_INVALID_FORMAT        (CAM_SYNC_ICP_EVENT_START + 7)
+#define CAM_SYNC_ICP_EVENT_UNSUPPORTED           (CAM_SYNC_ICP_EVENT_START + 8)
+#define CAM_SYNC_ICP_EVENT_OUT_OF_BOUND          (CAM_SYNC_ICP_EVENT_START + 9)
+#define CAM_SYNC_ICP_EVENT_TIME_OUT              (CAM_SYNC_ICP_EVENT_START + 10)
+#define CAM_SYNC_ICP_EVENT_ABORTED               (CAM_SYNC_ICP_EVENT_START + 11)
+#define CAM_SYNC_ICP_EVENT_HW_VIOLATION          (CAM_SYNC_ICP_EVENT_START + 12)
+#define CAM_SYNC_ICP_EVENT_CMD_ERROR             (CAM_SYNC_ICP_EVENT_START + 13)
+#define CAM_SYNC_ICP_EVENT_HFI_ERR_COMMAND_SIZE  (CAM_SYNC_ICP_EVENT_START + 14)
+#define CAM_SYNC_ICP_EVENT_HFI_ERR_MESSAGE_SIZE  (CAM_SYNC_ICP_EVENT_START + 15)
+#define CAM_SYNC_ICP_EVENT_HFI_ERR_QUEUE_EMPTY   (CAM_SYNC_ICP_EVENT_START + 16)
+#define CAM_SYNC_ICP_EVENT_HFI_ERR_QUEUE_FULL    (CAM_SYNC_ICP_EVENT_START + 17)
+#define CAM_SYNC_ICP_EVENT_END                   (CAM_SYNC_ICP_EVENT_START + 50)
+
+/* JPEG Sync event reason types */
+#define CAM_SYNC_JPEG_EVENT_START               (CAM_SYNC_ICP_EVENT_END + 1)
+#define CAM_SYNC_JPEG_EVENT_UNKNOWN             (CAM_SYNC_JPEG_EVENT_START + 0)
+#define CAM_SYNC_JPEG_EVENT_INVLD_CMD           (CAM_SYNC_JPEG_EVENT_START + 1)
+#define CAM_SYNC_JPEG_EVENT_SET_IRQ_CB          (CAM_SYNC_JPEG_EVENT_START + 2)
+#define CAM_SYNC_JPEG_EVENT_HW_RESET_FAILED     (CAM_SYNC_JPEG_EVENT_START + 3)
+#define CAM_SYNC_JPEG_EVENT_CDM_CHANGE_BASE_ERR (CAM_SYNC_JPEG_EVENT_START + 4)
+#define CAM_SYNC_JPEG_EVENT_CDM_CONFIG_ERR      (CAM_SYNC_JPEG_EVENT_START + 5)
+#define CAM_SYNC_JPEG_EVENT_START_HW_ERR        (CAM_SYNC_JPEG_EVENT_START + 6)
+#define CAM_SYNC_JPEG_EVENT_START_HW_HANG       (CAM_SYNC_JPEG_EVENT_START + 7)
+#define CAM_SYNC_JPEG_EVENT_MISR_CONFIG_ERR     (CAM_SYNC_JPEG_EVENT_START + 8)
+#define CAM_SYNC_JPEG_EVENT_END                 (CAM_SYNC_JPEG_EVENT_START + 50)
+
+/* FD Sync event reason types */
+#define CAM_SYNC_FD_EVENT_START           (CAM_SYNC_JPEG_EVENT_END + 1)
+#define CAM_SYNC_FD_EVENT_UNKNOWN         (CAM_SYNC_FD_EVENT_START + 0)
+#define CAM_SYNC_FD_EVENT_IRQ_FRAME_DONE  (CAM_SYNC_FD_EVENT_START + 1)
+#define CAM_SYNC_FD_EVENT_IRQ_RESET_DONE  (CAM_SYNC_FD_EVENT_START + 2)
+#define CAM_SYNC_FD_EVENT_HALT            (CAM_SYNC_FD_EVENT_START + 3)
+#define CAM_SYNC_FD_EVENT_END             (CAM_SYNC_FD_EVENT_START + 50)
+
+/* LRME Sync event reason types */
+#define CAM_SYNC_LRME_EVENT_START           (CAM_SYNC_FD_EVENT_END + 1)
+#define CAM_SYNC_LRME_EVENT_UNKNOWN         (CAM_SYNC_LRME_EVENT_START + 0)
+#define CAM_SYNC_LRME_EVENT_CB_ERROR        (CAM_SYNC_LRME_EVENT_START + 1)
+#define CAM_SYNC_LRME_EVENT_END             (CAM_SYNC_LRME_EVENT_START + 50)
+
+/* OPE Sync event reason types */
+#define CAM_SYNC_OPE_EVENT_START              (CAM_SYNC_LRME_EVENT_END + 1)
+#define CAM_SYNC_OPE_EVENT_UNKNOWN            (CAM_SYNC_OPE_EVENT_START + 0)
+#define CAM_SYNC_OPE_EVENT_PAGE_FAULT         (CAM_SYNC_OPE_EVENT_START + 1)
+#define CAM_SYNC_OPE_EVENT_HW_HANG            (CAM_SYNC_OPE_EVENT_START + 2)
+#define CAM_SYNC_OPE_EVENT_HALT               (CAM_SYNC_OPE_EVENT_START + 3)
+#define CAM_SYNC_OPE_EVENT_CONFIG_ERR         (CAM_SYNC_OPE_EVENT_START + 4)
+#define CAM_SYNC_OPE_EVENT_HW_FLUSH           (CAM_SYNC_OPE_EVENT_START + 5)
+#define CAM_SYNC_OPE_EVENT_HW_RESUBMIT        (CAM_SYNC_OPE_EVENT_START + 6)
+#define CAM_SYNC_OPE_EVENT_HW_RESET_DONE      (CAM_SYNC_OPE_EVENT_START + 7)
+#define CAM_SYNC_OPE_EVENT_HW_ERROR           (CAM_SYNC_OPE_EVENT_START + 8)
+#define CAM_SYNC_OPE_EVENT_INVLD_CMD          (CAM_SYNC_OPE_EVENT_START + 9)
+#define CAM_SYNC_OPE_EVENT_HW_RESET_FAILED    (CAM_SYNC_OPE_EVENT_START + 10)
+#define CAM_SYNC_OPE_EVENT_END                (CAM_SYNC_OPE_EVENT_START + 50)
+
+/* CRE Sync event reason types */
+#define CAM_SYNC_CRE_EVENT_START               (CAM_SYNC_OPE_EVENT_END + 1)
+#define CAM_SYNC_CRE_EVENT_UNKNOWN             (CAM_SYNC_CRE_EVENT_START + 0)
+#define CAM_SYNC_CRE_EVENT_CONFIG_ERR          (CAM_SYNC_CRE_EVENT_START + 1)
+#define CAM_SYNC_CRE_EVENT_INVLD_CMD           (CAM_SYNC_CRE_EVENT_START + 2)
+#define CAM_SYNC_CRE_EVENT_SET_IRQ_CB          (CAM_SYNC_CRE_EVENT_START + 3)
+#define CAM_SYNC_CRE_EVENT_HW_RESET_FAILED     (CAM_SYNC_CRE_EVENT_START + 4)
+#define CAM_SYNC_CRE_EVENT_HW_ERR              (CAM_SYNC_CRE_EVENT_START + 5)
+#define CAM_SYNC_CRE_EVENT_END                 (CAM_SYNC_CRE_EVENT_START + 50)
+
+#define CAM_SYNC_EVENT_MAX         8
+#define CAM_SYNC_EVENT_REASON_CODE_INDEX  0
+
+/* Fence types supported by the driver, when used in the fence mask it
+ * represents bit position, for masks it needs to be set as
+ * BIT(fence_type) on other occasions use as is.
+ */
+#define CAM_GENERIC_FENCE_TYPE_SYNC_OBJ     0x1
+#define CAM_GENERIC_FENCE_TYPE_DMA_FENCE    0x2
+#define CAM_GENERIC_FENCE_TYPE_SYNX_OBJ     0x3
+
+/* Additional param index for cam_generic_fence_config */
+#define CAM_GENERIC_FENCE_CONFIG_FLAG_PARAM_INDEX BIT(0)
+
+/* Flag fields for cam_generic_fence_config */
+#define CAM_GENERIC_FENCE_FLAG_IS_GLOBAL_SYNX_OBJ BIT(0)
+
+/**
+ * struct cam_sync_ev_header - Event header for sync event notification
+ *
+ * @sync_obj: Sync object
+ * @status:   Status of the object
+ */
+struct cam_sync_ev_header {
+	__s32 sync_obj;
+	__s32 status;
+};
+
+/**
+ * struct cam_sync_ev_header_v2 - Event header for sync event notification
+ *
+ * @sync_obj:    Sync object
+ * @status:      Status of the object
+ * @version:     sync driver version
+ * @evt_param:   event parameter
+ */
+struct cam_sync_ev_header_v2 {
+	__s32 sync_obj;
+	__s32 status;
+	uint32_t version;
+	uint32_t evt_param[CAM_SYNC_EVENT_MAX];
+};
+
+/**
+ * struct cam_sync_info - Sync object creation information
+ *
+ * @name:       Optional string representation of the sync object
+ * @sync_obj:   Sync object returned after creation in kernel
+ */
+struct cam_sync_info {
+	char  name[64];
+	__s32 sync_obj;
+};
+
+/**
+ * struct cam_sync_signal - Sync object signaling struct
+ *
+ * @sync_obj:   Sync object to be signaled
+ * @sync_state: State of the sync object to which it should be signaled
+ */
+struct cam_sync_signal {
+	__s32 sync_obj;
+	__u32 sync_state;
+};
+
+/**
+ * struct cam_sync_merge - Merge information for sync objects
+ *
+ * @sync_objs:  Pointer to sync objects
+ * @num_objs:   Number of objects in the array
+ * @merged:     Merged sync object
+ */
+struct cam_sync_merge {
+	__u64 sync_objs;
+	__u32 num_objs;
+	__s32 merged;
+};
+
+/**
+ * struct cam_sync_userpayload_info - Payload info from user space
+ *
+ * @sync_obj:   Sync object for which payload has to be registered for
+ * @reserved:   Reserved
+ * @payload:    Pointer to user payload
+ */
+struct cam_sync_userpayload_info {
+	__s32 sync_obj;
+	__u32 reserved;
+	__u64 payload[CAM_SYNC_USER_PAYLOAD_SIZE];
+};
+
+/**
+ * struct cam_sync_wait - Sync object wait information
+ *
+ * @sync_obj:   Sync object to wait on
+ * @reserved:   Reserved
+ * @timeout_ms: Timeout in milliseconds
+ */
+struct cam_sync_wait {
+	__s32    sync_obj;
+	__u32    reserved;
+	uint64_t timeout_ms;
+};
+
+/**
+ * struct cam_generic_fence_config - Fence config
+ *                    Based on the operation, fields could be
+ *                    input/output
+ *
+ * @version:          Struct version
+ * @name:             Optional string representation [used for create/import]
+ * @fence_sel_mask:   Fence select mask, if set for fence types other than the type
+ *                    this input is processed for, the corresponding types would be
+ *                    processed as well. For example if one wants to import a sync
+ *                    object for an existing dma fence, set bit with index
+ *                    CAM_GENERIC_FENCE_TYPE_SYNC_OBJ in mask,
+ *                    a new sync object would be returned in sync_obj linked to an
+ *                    existing dma_fence_fd.
+ * @sync_obj:         Sync object
+ * @dma_fence_fd:     DMA fence fd
+ * @synx_obj:         Synx object
+ * @reason_code:      Indicates if the operation was successful or not
+ *                    for this set of fences. It is the responsibility of
+ *                    the caller to clean up any partially processed batched
+ *                    fences
+ * @num_valid_params: Valid number of params being used
+ * @valid_param_mask: Mask to indicate the field types in params
+ * @params:           Additional params
+ */
+struct cam_generic_fence_config {
+	__u32 version;
+	char name[64];
+	__u32 fence_sel_mask;
+	__s32 sync_obj;
+	__s32 dma_fence_fd;
+	__s32 synx_obj;
+	__s32 reason_code;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[4];
+};
+
+/**
+ * struct cam_generic_fence_signal_info - Fence signaling info
+ *
+ * @version:                Struct version
+ * @num_fences_requested:   Number of fences to process
+ * @num_fences_processed:   Number of fences processed by the driver
+ * @fence_handle_type:      Type of the fence signal handle [user handle is expected]
+ * @fence_data_size:        Size of the data pointed to by fence_info_hdl,
+ *                          it should be the consolidated size of
+ *                          total fences to process * size of the corresponding signaling
+ *                          input structure
+ * @fence_info_hdl:         Handle to the fence signal data (synx/dma)
+ * @num_valid_params:       Valid number of params being used
+ * @valid_param_mask:       Mask to indicate the field types in params
+ * @params:                 Additional params
+ */
+struct cam_generic_fence_signal_info {
+	__u32 version;
+	__u32 num_fences_requested;
+	__u32 num_fences_processed;
+	__u32 fence_handle_type;
+	__u32 fence_data_size;
+	__u64 fence_info_hdl;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__s32 params[3];
+};
+
+/**
+ * struct cam_dma_fence_signal - DMA fence signaling info
+ *
+ * @version:          Struct version
+ * @dma_fence_fd:     DMA fence to be signaled
+ * @status:           Any status if applicable, 0 for success
+ * @num_valid_params: Valid number of params being used
+ * @valid_param_mask: Mask to indicate the field types in params
+ * @params:           Additional params
+ */
+struct cam_dma_fence_signal {
+	__u32 version;
+	__s32 dma_fence_fd;
+	__s32 status;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__s32 params[3];
+};
+
+/**
+ * struct cam_synx_obj_signal - Synx object signaling info
+ *
+ * @version:          Struct version
+ * @synx_obj:         Synx object to be signaled
+ * @status:           Fence status
+ * @reason_code:      Indicates if the operation was successful or not
+ * @num_valid_params: Valid number of params being used
+ * @valid_param_mask: Mask to indicate the field types in params
+ * @params:           Additional params
+ */
+struct cam_synx_obj_signal {
+	__u32 version;
+	__u32 synx_obj;
+	__u32 status;
+	__s32 reason_code;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__s32 params[4];
+};
+
+/**
+ * struct cam_generic_fence_input_info - Parent structure that
+ *                    provides info on fence batching
+ *
+ * @version:                Struct version
+ * @num_fences_requested:   Number of fences to process
+ * @num_fences_processed:   Number of fences processed
+ *                          If userland requests 5 fences to be created
+ *                          and it fails on the 3rd, num processed will be
+ *                          3. This can be used by userspace to clean
+ *                          partially batched fences
+ * @num_valid_params:       Valid number of params being used
+ * @valid_param_mask:       Mask to indicate the field types in params
+ * @params:                 Additional params
+ * @fence_info:             Variable length fence info input based on num_fences
+ */
+struct cam_generic_fence_input_info {
+	__u32 version;
+	__u32 num_fences_requested;
+	__u32 num_fences_processed;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__s32 params[3];
+	union {
+		struct cam_generic_fence_config fence_cfg[1];
+		__DECLARE_FLEX_ARRAY(struct cam_generic_fence_config, fence_cfg_flex);
+	};
+};
+
+/**
+ * struct cam_generic_fence_cmd_args - Generic fence cmd args
+ *
+ * @version:           Struct version
+ * @fence_type:        Type of fence the ioctl cmd is for [dma/sync/synx]
+ * @input_handle_type: Type of the fence input handle [user handle is expected]
+ * @input_data_size:   Size of the data pointed to by input_handle
+ * @input_handle:      Handle to the fence input data [create/signal/import...]
+ *                     corresponding to the fence_type
+ * @num_valid_params:  Valid number of reserved params being used
+ * @valid_param_mask:  Mask to indicate the field types in params
+ * @params:            Additional params
+ */
+struct cam_generic_fence_cmd_args {
+	__u32 version;
+	__u32 fence_type;
+	__u32 input_handle_type;
+	__u32 input_data_size;
+	__u64 input_handle;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[6];
+};
+
+/**
+ * struct cam_private_ioctl_arg - Sync driver ioctl argument
+ *
+ * @id:         IOCTL command id
+ * @size:       Size of command payload
+ * @result:     Result of command execution
+ * @reserved:   Reserved
+ * @ioctl_ptr:  Pointer to user data
+ */
+struct cam_private_ioctl_arg {
+	__u32 id;
+	__u32 size;
+	__u32 result;
+	__u32 reserved;
+	__u64 ioctl_ptr;
+};
+
+#define CAM_PRIVATE_IOCTL_CMD \
+	_IOWR('V', BASE_VIDIOC_PRIVATE, struct cam_private_ioctl_arg)
+
+/* Exclusive sync object IOCTL cmds */
+#define CAM_SYNC_CREATE                          0
+#define CAM_SYNC_DESTROY                         1
+#define CAM_SYNC_SIGNAL                          2
+#define CAM_SYNC_MERGE                           3
+#define CAM_SYNC_REGISTER_PAYLOAD                4
+#define CAM_SYNC_DEREGISTER_PAYLOAD              5
+#define CAM_SYNC_WAIT                            6
+
+/* Generic fence [sync/dma/synx] IOCTL cmds */
+#define CAM_GENERIC_FENCE_CREATE                 11
+#define CAM_GENERIC_FENCE_RELEASE                12
+#define CAM_GENERIC_FENCE_IMPORT                 13
+#define CAM_GENERIC_FENCE_SIGNAL                 14
+
+#endif /* __UAPI_CAM_SYNC_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_tfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera/include/uapi/camera/media/cam_tfe.h
@@ -0,0 +1,649 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_TFE_H__
+#define __UAPI_CAM_TFE_H__
+
+#include <media/cam_defs.h>
+#include <media/cam_isp_tfe.h>
+#include <media/cam_cpas.h>
+
+
+/* ISP TFE driver name */
+#define CAM_ISP_TFE_DEV_NAME                        "cam-isp"
+
+/* HW type */
+#define CAM_ISP_TFE_HW_BASE                         0
+#define CAM_ISP_TFE_HW_CSID                         1
+#define CAM_ISP_TFE_HW_TFE                          2
+#define CAM_ISP_TFE_HW_MAX                          3
+
+/* Color Pattern */
+#define CAM_ISP_TFE_PATTERN_BAYER_RGRGRG            0
+#define CAM_ISP_TFE_PATTERN_BAYER_GRGRGR            1
+#define CAM_ISP_TFE_PATTERN_BAYER_BGBGBG            2
+#define CAM_ISP_TFE_PATTERN_BAYER_GBGBGB            3
+#define CAM_ISP_TFE_PATTERN_YUV_YCBYCR              4
+#define CAM_ISP_TFE_PATTERN_YUV_YCRYCB              5
+#define CAM_ISP_TFE_PATTERN_YUV_CBYCRY              6
+#define CAM_ISP_TFE_PATTERN_YUV_CRYCBY              7
+#define CAM_ISP_TFE_PATTERN_MAX                     8
+
+/* Usage Type */
+#define CAM_ISP_TFE_IN_RES_USAGE_SINGLE             0
+#define CAM_ISP_TFE_IN_RES_USAGE_DUAL               1
+#define CAM_ISP_TFE_IN_RES_USAGE_MAX                2
+
+/* Resource ID */
+#define CAM_ISP_TFE_RES_ID_PORT                     0
+#define CAM_ISP_TFE_RES_ID_MAX                      1
+
+/* Resource Type - Type of resource for the resource id
+ * defined in cam_isp_tfe.h
+ */
+
+/* Lane Type in input resource for Port */
+#define CAM_ISP_TFE_IN_LANE_TYPE_DPHY               0
+#define CAM_ISP_TFE_IN_LANE_TYPE_CPHY               1
+#define CAM_ISP_TFE_IN_LANE_TYPE_MAX                2
+
+/* ISP TFE packet opcode */
+#define CAM_ISP_TFE_PACKET_OP_BASE                  0
+#define CAM_ISP_TFE_PACKET_INIT_DEV                 1
+#define CAM_ISP_TFE_PACKET_CONFIG_DEV               2
+#define CAM_ISP_TFE_PACKET_OP_MAX                   3
+
+/* ISP TFE packet meta_data type for command buffer */
+#define CAM_ISP_TFE_PACKET_META_BASE                  0
+#define CAM_ISP_TFE_PACKET_META_LEFT                  1
+#define CAM_ISP_TFE_PACKET_META_RIGHT                 2
+#define CAM_ISP_TFE_PACKET_META_COMMON                3
+#define CAM_ISP_TFE_PACKET_META_DUAL_CONFIG           4
+#define CAM_ISP_TFE_PACKET_META_GENERIC_BLOB_COMMON   5
+#define CAM_ISP_TFE_PACKET_META_REG_DUMP_PER_REQUEST  6
+#define CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_FLUSH     7
+#define CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR     8
+#define CAM_ISP_TFE_PACKET_META_GENERIC_BLOB_LEFT     9
+#define CAM_ISP_TFE_PACKET_META_GENERIC_BLOB_RIGHT    10
+
+/* ISP TFE Generic Cmd Buffer Blob types */
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_HFR_CONFIG              0
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_CLOCK_CONFIG            1
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_BW_CONFIG_V2            2
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG       3
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_INIT_CONFIG             4
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_DYNAMIC_MODE_SWITCH     15
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_BW_LIMITER_CFG          16
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_ALIGNMENT_OFFSET_INFO   17
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_UPDATE_OUT_RES          18
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_DISCARD_INITIAL_FRAMES  19
+
+/* DSP mode */
+#define CAM_ISP_TFE_DSP_MODE_NONE                   0
+#define CAM_ISP_TFE_DSP_MODE_ONE_WAY                1
+#define CAM_ISP_TFE_DSP_MODE_ROUND                  2
+
+/* Per Path Usage Data */
+#define CAM_ISP_TFE_USAGE_INVALID     0
+#define CAM_ISP_TFE_USAGE_LEFT_PX     1
+#define CAM_ISP_TFE_USAGE_RIGHT_PX    2
+#define CAM_ISP_TFE_USAGE_RDI         3
+
+/* Bus write master modes */
+#define CAM_ISP_TFE_WM_FRAME_BASED_MODE    0
+#define CAM_ISP_TFE_WM_LINE_BASED_MODE     1
+#define CAM_ISP_TFE_WM_INDEX_BASED_MODE    2
+
+#define CAM_ISP_TFE_VC_DT_CFG              2
+
+/* Feature Flag indicators */
+#define CAM_ISP_TFE_FLAG_QCFA_BIN                        BIT(0)
+#define CAM_ISP_TFE_FLAG_BAYER_BIN                       BIT(1)
+#define CAM_ISP_TFE_FLAG_SHDR_MASTER_EN                  BIT(2)
+#define CAM_ISP_TFE_FLAG_SHDR_SLAVE_EN                   BIT(3)
+#define CAM_ISP_TFE_FLAG_EPD_SUPPORT                     BIT(4)
+
+/* Query devices */
+/**
+ * struct cam_isp_tfe_dev_cap_info - A cap info for particular hw type
+ *
+ * @hw_type:            Hardware type for the cap info
+ * @reserved:           reserved field for alignment
+ * @hw_version:         Hardware version
+ *
+ */
+struct cam_isp_tfe_dev_cap_info {
+	__u32                 hw_type;
+	__u32                 reserved;
+	struct cam_hw_version hw_version;
+};
+
+/**
+ * struct cam_isp_tfe_query_cap_cmd - ISP TFE query device
+ * capability payload
+ *
+ * @device_iommu:               returned iommu handles for device
+ * @cdm_iommu:                  returned iommu handles for cdm
+ * @num_dev:                    returned number of device capabilities
+ * @reserved:                   reserved field for alignment
+ * @dev_caps:                   returned device capability array
+ *
+ */
+struct cam_isp_tfe_query_cap_cmd {
+	struct cam_iommu_handle         device_iommu;
+	struct cam_iommu_handle         cdm_iommu;
+	__s32                           num_dev;
+	__u32                           reserved;
+	struct cam_isp_tfe_dev_cap_info dev_caps[CAM_ISP_TFE_HW_MAX];
+};
+
+/**
+ * struct cam_isp_tfe_query_cap_cmd_v2 - ISP TFE query device
+ * capability payload
+ *
+ * @version                     returned query cap cmd api version
+ * @num_dev:                    returned number of device capabilities
+ * @device_iommu:               returned iommu handles for device
+ * @cdm_iommu:                  returned iommu handles for cdm
+ * @dev_caps:                   returned device capability array
+ *
+ */
+struct cam_isp_tfe_query_cap_cmd_v2 {
+	__u32                           version;
+	__s32                           num_dev;
+	struct cam_iommu_handle         device_iommu;
+	struct cam_iommu_handle         cdm_iommu;
+	struct cam_isp_tfe_dev_cap_info dev_caps[1];
+};
+
+/* Acquire Device */
+/**
+ * struct cam_isp_tfe_out_port_info - An output port resource info
+ *
+ * @res_id:                     output resource id defined in file
+ *                              cam_isp_tfe.h
+ * @format:                     output format of the resource
+ * @width:                      output width in pixels
+ * @height:                     output height in lines
+ * @stride:                     output stride
+ * @comp_grp_id:                composite group id for the resource.
+ * @secure_mode:                flag to tell if output should be run in secure
+ *                              mode or not. See cam_defs.h for definition
+ * @wm_mode:                    wm mode
+ * @reserved:                   reserved field for alignment
+ *
+ */
+struct cam_isp_tfe_out_port_info {
+	__u32                res_id;
+	__u32                format;
+	__u32                width;
+	__u32                height;
+	__u32                stride;
+	__u32                comp_grp_id;
+	__u32                secure_mode;
+	__u32                wm_mode;
+	__u32                reserved;
+};
+
+/**
+ * struct cam_isp_tfe_in_port_info - An input port resource info
+ *
+ * @res_id:                     input resource id CAM_ISP_TFE_IN_RES_XXX
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @format:                     input format
+ * @pix_pattern:                pixel pattern
+ * @usage_type:                 whether dual tfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_end:                   left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ *                              Only for Dual TFE
+ * @right_end:                  right input stop offset in
+ *                              pixels. Only for Dual TFE
+ * @right_width:                right input width in pixels.
+ *                              Only for dual TFE
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @batch_size:                 batch size for HFR mode
+ * @dsp_mode:                   DSP stream mode(Defines as
+ *                               CAM_ISP_TFE_DSP_MODE_*)
+ * @sensor_width:               sensor width
+ * @sensor_height:              sensor height
+ * @hbi_value:                  sensor HBI value
+ * @vbi_value:                  sensor VBI value
+ * @sensor_fps:                 sensor fps
+ * @init_frame_drop             init frame drop value.
+ * @num_out_res:                number of the output resource associated
+ * @data:                       payload that contains the output resources,
+ *                              array of cam_isp_tfe_out_port_info data
+ *
+ */
+struct cam_isp_tfe_in_port_info {
+	__u32                            res_id;
+	__u32                            lane_type;
+	__u32                            lane_num;
+	__u32                            lane_cfg;
+	__u32                            vc;
+	__u32                            dt;
+	__u32                            format;
+	__u32                            pix_pattern;
+	__u32                            usage_type;
+	__u32                            left_start;
+	__u32                            left_end;
+	__u32                            left_width;
+	__u32                            right_start;
+	__u32                            right_end;
+	__u32                            right_width;
+	__u32                            line_start;
+	__u32                            line_end;
+	__u32                            height;
+	__u32                            batch_size;
+	__u32                            dsp_mode;
+	__u32                            sensor_width;
+	__u32                            sensor_height;
+	__u32                            sensor_hbi;
+	__u32                            sensor_vbi;
+	__u32                            sensor_fps;
+	__u32                            init_frame_drop;
+	__u32                            num_out_res;
+	union {
+		struct cam_isp_tfe_out_port_info data[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_tfe_out_port_info, data_flex);
+	};
+};
+
+/**
+ * struct cam_isp_tfe_in_port_info_v2 - An input port resource info
+ *
+ * @res_id:                     input resource id CAM_ISP_TFE_IN_RES_XXX
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @format:                     input format
+ * @pix_pattern:                pixel pattern
+ * @usage_type:                 whether dual tfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_end:                   left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ *                              Only for Dual TFE
+ * @right_end:                  right input stop offset in
+ *                              pixels. Only for Dual TFE
+ * @right_width:                right input width in pixels.
+ *                              Only for dual TFE
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @batch_size:                 batch size for HFR mode
+ * @dsp_mode:                   DSP stream mode(Defines as
+ *                              CAM_ISP_TFE_DSP_MODE_*)
+ * @sensor_width:               sensor width
+ * @sensor_height:              sensor height
+ * @sensor_hbi:                 sensor HBI value
+ * @sensor_vbi:                 sensor VBI value
+ * @sensor_fps:                 sensor fps
+ * @init_frame_drop             init frame drop value.
+ * @num_out_res:                number of the output resource associated
+ * @feature_flag:               Feature flags for indicating QCFA, Bayer bin
+ * @core_cfg:                   Core configuration
+ * @reserve_field_1:            Reserve field 1
+ * @reserve_field_2:            Reserve field 2
+ * @reserve_field_3:            Reserve field 3
+ * @reserve_field_4:            Reserve field 4
+ * @reserve_field_5:            Reserve field 5
+ * @reserve_field_6:            Reserve filed 6
+ * @data:                       payload that contains the output resources,
+ *                              array of cam_isp_tfe_out_port_info data
+ *
+ */
+struct cam_isp_tfe_in_port_info_v2 {
+	__u32                            res_id;
+	__u32                            lane_type;
+	__u32                            lane_num;
+	__u32                            lane_cfg;
+	__u32                            vc[CAM_ISP_TFE_VC_DT_CFG];
+	__u32                            dt[CAM_ISP_TFE_VC_DT_CFG];
+	__u32                            num_valid_vc_dt;
+	__u32                            format;
+	__u32                            pix_pattern;
+	__u32                            usage_type;
+	__u32                            left_start;
+	__u32                            left_end;
+	__u32                            left_width;
+	__u32                            right_start;
+	__u32                            right_end;
+	__u32                            right_width;
+	__u32                            line_start;
+	__u32                            line_end;
+	__u32                            height;
+	__u32                            batch_size;
+	__u32                            dsp_mode;
+	__u32                            sensor_width;
+	__u32                            sensor_height;
+	__u32                            sensor_hbi;
+	__u32                            sensor_vbi;
+	__u32                            sensor_fps;
+	__u32                            init_frame_drop;
+	__u32                            num_out_res;
+	__u32                            feature_flag;
+	__u32                            core_cfg;
+	__u32                            reserve_field_1;
+	__u32                            reserve_field_2;
+	__u32                            reserve_field_3;
+	__u32                            reserve_field_4;
+	__u32                            reserve_field_5;
+	__u32                            reserve_field_6;
+	union {
+		struct cam_isp_tfe_out_port_info data[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_tfe_out_port_info, data_flex);
+	};
+};
+
+/**
+ * struct cam_isp_tfe_resource - A resource bundle
+ *
+ * @resoruce_id:                resource id for the resource bundle
+ * @length:                     length of the while resource blob
+ * @handle_type:                type of the resource handle
+ * @reserved:                   reserved field for alignment
+ * @res_hdl:                    resource handle that points to the
+ *                              resource array
+ *
+ */
+struct cam_isp_tfe_resource {
+	__u32                       resource_id;
+	__u32                       length;
+	__u32                       handle_type;
+	__u32                       reserved;
+	__u64                       res_hdl;
+};
+
+/**
+ * struct cam_isp_tfe_port_hfr_config - HFR configuration for
+ * this port
+ *
+ * @resource_type:              Resource type
+ * @subsample_pattern:          Subsample pattern. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @subsample_period:           Subsample period. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @framedrop_pattern:          Framedrop pattern
+ * @framedrop_period:           Framedrop period
+ * @reserved:                   Reserved for alignment
+ */
+struct cam_isp_tfe_port_hfr_config {
+	__u32                       resource_type;
+	__u32                       subsample_pattern;
+	__u32                       subsample_period;
+	__u32                       framedrop_pattern;
+	__u32                       framedrop_period;
+	__u32                       reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_resource_hfr_config - Resource HFR
+ * configuration
+ *
+ * @num_ports:                  Number of ports
+ * @reserved:                   Reserved for alignment
+ * @port_hfr_config:            HFR configuration for each IO port
+ */
+struct cam_isp_tfe_resource_hfr_config {
+	__u32                              num_ports;
+	__u32                              reserved;
+	union {
+		struct cam_isp_tfe_port_hfr_config port_hfr_config[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_tfe_port_hfr_config, port_hfr_config_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_dual_stripe_config - stripe config per bus
+ * client
+ *
+ * @offset:                     Start horizontal offset relative to
+ *                              output buffer
+ * @width:                      Width of the stripe in pixels
+ * @port_id:                    Port id of ISP TFE output
+ * @reserved:                   Reserved for alignment
+ *
+ */
+struct cam_isp_tfe_dual_stripe_config {
+	__u32                       offset;
+	__u32                       width;
+	__u32                       port_id;
+	__u32                       reserved;
+};
+
+/**
+ * struct cam_isp_tfe_dual_config - dual isp configuration
+ *
+ * @num_ports                   Number of isp output ports
+ * @reserved                    Reserved field for alignment
+ * @stripes:                    Stripe information
+ *
+ */
+struct cam_isp_tfe_dual_config {
+	__u32                                 num_ports;
+	__u32                                 reserved;
+	union {
+		struct cam_isp_tfe_dual_stripe_config stripes[1];
+		__DECLARE_FLEX_ARRAY(struct cam_isp_tfe_dual_stripe_config, stripes_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_clock_config - Clock configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_rdi:                    Number of RDI votes
+ * @left_pix_hz:                Pixel Clock for Left ISP
+ * @right_pix_hz:               Pixel Clock for Right ISP
+ *                              valid only if Dual
+ * @rdi_hz:                     RDI Clock. ISP TFE clock will be
+ *                              max of RDI and PIX clocks. For a
+ *                              particular context which ISP TFE
+ *                              HW the RDI is allocated to is
+ *                              not known to UMD. Hence pass the
+ *                              clock and let KMD decide.
+ */
+struct cam_isp_tfe_clock_config {
+	__u32                       usage_type;
+	__u32                       num_rdi;
+	__u64                       left_pix_hz;
+	__u64                       right_pix_hz;
+	union {
+		__u64                   rdi_hz[1];
+		__DECLARE_FLEX_ARRAY(__u64, rdi_hz_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_csid_clock_config - CSID clock
+ * configuration
+ *
+ * @csid_clock                  CSID clock
+ * @csi_phy_clock               Phy clock valid if tpg is selected
+ */
+struct cam_isp_tfe_csid_clock_config {
+	__u64                       csid_clock;
+	__u64                       phy_clock;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_bw_config_v2 - Bandwidth configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_paths:                  Number of axi data paths
+ * @axi_path                    Per path vote info
+ */
+struct cam_isp_tfe_bw_config_v2 {
+	__u32                             usage_type;
+	__u32                             num_paths;
+	union {
+		struct cam_axi_per_path_bw_vote   axi_path[1];
+		__DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+	};
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_acquire_hw_info - ISP TFE acquire HW params
+ *
+ * @common_info_version  : Version of common info struct used
+ * @common_info_size     : Size of common info struct used
+ * @common_info_offset   : Offset of common info from start of data
+ * @num_inputs           : Number of inputs
+ * @input_info_version   : Version of input info struct used
+ * @input_info_size      : Size of input info struct used
+ * @input_info_offset    : Offset of input info from start of data
+ * @data                 : Data pointer to point the cam_isp_tfe_in_port_info
+ *                         structure
+ */
+struct cam_isp_tfe_acquire_hw_info {
+	__u16                common_info_version;
+	__u16                common_info_size;
+	__u32                common_info_offset;
+	__u32                num_inputs;
+	__u32                input_info_version;
+	__u32                input_info_size;
+	__u32                input_info_offset;
+	__u64                data;
+};
+
+/**
+ * struct cam_isp_tfe_wm_bw_limiter_config - ISP TFE write master
+ *                                       BW limter config
+ *
+ *
+ * @res_type          : output resource type defined in file cam_isp_tfe.h
+ * @enable_limiter    : 0 for disable else enabled
+ * @counter_limit     : Max counter value
+ */
+struct cam_isp_tfe_wm_bw_limiter_config {
+	__u32         res_type;
+	__u32         enable_limiter;
+	__u32         counter_limit[CAM_PACKET_MAX_PLANES];
+};
+
+/**
+ * struct cam_isp_tfe_out_rsrc_bw_limiter_config - ISP TFE out rsrc BW limiter config
+ *
+ *    Configure BW limiter for ISP TFE WMs
+ *
+ * @version          : Version field
+ * @num_ports        : Number of ports
+ * @bw_limit_config  : WM BW limiter config
+ */
+struct cam_isp_tfe_out_rsrc_bw_limiter_config {
+	__u32                                       version;
+	__u32                                       num_ports;
+	union {
+		struct cam_isp_tfe_wm_bw_limiter_config     bw_limiter_config[1];
+		__DECLARE_FLEX_ARRAY(
+			struct cam_isp_tfe_wm_bw_limiter_config, bw_limiter_config_flex);
+	};
+};
+
+/**
+ * struct cam_isp_tfe_alignment_offset_config - ISP TFE buffer alignment config
+ *
+ * @resource_type:         Resourse type
+ * @x_offset:              Offset of the buffer from x-axies
+ * @y_offset:              Offset of the buffer from y-axies
+ * @width:                 Width of out resource
+ * @height:                Height of out resource
+ * @stride:                Stride of out resource
+ *
+ */
+struct cam_isp_tfe_alignment_offset_config {
+	__u32                       resource_type;
+	__u32                       x_offset;
+	__u32                       y_offset;
+	__u32                       width;
+	__u32                       height;
+	__u32                       stride;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_alignment_resource_info - ISP TFE Resource Alignment
+ *
+ * @version:                  Alignment api version
+ * @num_ports:                Number of ports
+ * @port_alignment_cfg:       Buffer alignment for each IO port
+ */
+struct cam_isp_tfe_alignment_resource_info {
+	__u32                                        version;
+	__u32                                        num_ports;
+	struct cam_isp_tfe_alignment_offset_config   port_alignment_cfg[1];
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_wm_dimension_config - ISP TFE res Dimension config
+ *
+ * @res_id      : Resource id
+ * @mode        : Mode of out resource
+ * @height      : Out resource height
+ * @width       : Out resource width
+ *
+ */
+struct cam_isp_tfe_wm_dimension_config {
+	__u32                    res_id;
+	__u32                    mode;
+	__u32                    height;
+	__u32                    width;
+};
+
+/**
+ * struct cam_isp_tfe_out_resource_config - ISP TFE out config
+ *
+ * @num_ports             : Num of out res
+ * @reserved              : Reserved field
+ * @dimention_config      : Out resource dimension config
+ */
+struct cam_isp_tfe_out_resource_config {
+	__u32                                       num_ports;
+	__u32                                       reserved;
+	struct cam_isp_tfe_wm_dimension_config      dimension_config[1];
+};
+
+/**
+ * struct cam_isp_tfe_discard_initial_frames - Discard init frames
+ *
+ *   Some sensors require discarding the initial frames
+ *   after the sensor is streamed on. The discard would be
+ *   applied on all paths [IPP/PPP/RDIx] for the given
+ *   pipeline.
+ *
+ * @version                 : Version field
+ * @num_frames              : Number of frames to be discarded
+ */
+struct cam_isp_tfe_discard_initial_frames {
+	__u32                    version;
+	__u32                    num_frames;
+} __attribute__((packed));
+
+#define CAM_TFE_ACQUIRE_COMMON_VER0         0x1000
+
+#define CAM_TFE_ACQUIRE_COMMON_SIZE_VER0    0x0
+
+#define CAM_TFE_ACQUIRE_INPUT_VER0          0x2000
+
+#define CAM_TFE_ACQUIRE_INPUT_SIZE_VER0 sizeof(struct cam_isp_tfe_in_port_info)
+
+#define CAM_TFE_ACQUIRE_OUT_VER0            0x3000
+
+#define CAM_TFE_ACQUIRE_OUT_SIZE_VER0  sizeof(struct cam_isp_tfe_out_port_info)
+
+#endif /* __UAPI_CAM_TFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm.h
@@ -0,0 +1,580 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_H_
+#define _CAM_CDM_H_
+
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/random.h>
+#include <linux/spinlock_types.h>
+#include <linux/mutex.h>
+#include <linux/workqueue.h>
+#include <linux/bug.h>
+
+#include "cam_cdm_intf_api.h"
+#include "cam_soc_util.h"
+#include "cam_cpas_api.h"
+#include "cam_hw_intf.h"
+#include "cam_hw.h"
+#include "cam_debug_util.h"
+
+#define CAM_MAX_SW_CDM_VERSION_SUPPORTED  1
+#define CAM_SW_CDM_INDEX                  0
+#define CAM_CDM_INFLIGHT_WORKS            5
+#define CAM_CDM_HW_RESET_TIMEOUT          300
+
+/*
+ * Macros to get prepare and get information
+ * from client CDM handles.
+ */
+
+#define CAM_CDM_HW_ID_MASK      0xF
+#define CAM_CDM_HW_ID_SHIFT     0x10
+
+#define CAM_CDM_CLIENTS_ID_MASK 0xFF
+
+#define CAM_CDM_BL_FIFO_ID_MASK 0xF
+#define CAM_CDM_BL_FIFO_ID_SHIFT 0x8
+
+#define CAM_CDM_GET_HW_IDX(x) (((x) >> CAM_CDM_HW_ID_SHIFT) & \
+	CAM_CDM_HW_ID_MASK)
+
+#define CAM_CDM_GET_BLFIFO_IDX(x) (((x) >> CAM_CDM_BL_FIFO_ID_SHIFT) & \
+	CAM_CDM_BL_FIFO_ID_MASK)
+
+#define CAM_CDM_CREATE_CLIENT_HANDLE(hw_idx, priority, client_idx) \
+	((((hw_idx) & CAM_CDM_HW_ID_MASK) << CAM_CDM_HW_ID_SHIFT) | \
+	(((priority) & CAM_CDM_BL_FIFO_ID_MASK) << CAM_CDM_BL_FIFO_ID_SHIFT)| \
+	 ((client_idx) & CAM_CDM_CLIENTS_ID_MASK))
+#define CAM_CDM_GET_CLIENT_IDX(x) ((x) & CAM_CDM_CLIENTS_ID_MASK)
+#define CAM_PER_CDM_MAX_REGISTERED_CLIENTS (CAM_CDM_CLIENTS_ID_MASK + 1)
+#define CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM (CAM_CDM_HW_ID_MASK + 1)
+
+/* Number of FIFO supported on CDM */
+#define CAM_CDM_NUM_BL_FIFO 0x4
+
+/* Max number of register set for different CDM */
+#define CAM_CDM_BL_FIFO_REG_NUM 0x4
+#define CAM_CDM_BL_FIFO_IRQ_REG_NUM 0x4
+#define CAM_CDM_BL_FIFO_PENDING_REQ_REG_NUM 0x2
+#define CAM_CDM_SCRATCH_REG_NUM 0xc
+#define CAM_CDM_COMP_WAIT_STATUS_REG_NUM 0x2
+#define CAM_CDM_PERF_MON_REG_NUM 0x2
+
+/* BL_FIFO configurations*/
+#define CAM_CDM_BL_FIFO_LENGTH_MAX_DEFAULT 0x40
+#define CAM_CDM_BL_FIFO_LENGTH_CFG_SHIFT 0x10
+#define CAM_CDM_BL_FIFO_FLUSH_SHIFT 0x3
+#define CAM_CDM_BL_FIFO_BOUNDARY_CHECK \
+	(CAM_CDM_BL_FIFO_LENGTH_MAX_DEFAULT / 2)
+
+#define CAM_CDM_BL_FIFO_REQ_SIZE_MAX 0x00
+#define CAM_CDM_BL_FIFO_REQ_SIZE_MAX_DIV2 0x01
+#define CAM_CDM_BL_FIFO_REQ_SIZE_MAX_DIV4 0x10
+#define CAM_CDM_BL_FIFO_REQ_SIZE_MAX_DIV8 0x11
+
+/* CDM core status bitmap */
+#define CAM_CDM_HW_INIT_STATUS 0x0
+#define CAM_CDM_FIFO_0_BLDONE_STATUS 0x0
+#define CAM_CDM_FIFO_1_BLDONE_STATUS 0x1
+#define CAM_CDM_FIFO_2_BLDONE_STATUS 0x2
+#define CAM_CDM_FIFO_3_BLDONE_STATUS 0x3
+#define CAM_CDM_RESET_HW_STATUS 0x4
+#define CAM_CDM_ERROR_HW_STATUS 0x5
+#define CAM_CDM_FLUSH_HW_STATUS 0x6
+#define CAM_CDM_RESET_ERR_STATUS 0x7
+
+/* Curent BL command masks and shifts */
+#define CAM_CDM_CURRENT_BL_LEN   0xFFFFF
+#define CAM_CDM_CURRENT_BL_ARB   0x100000
+#define CAM_CDM_CURRENT_BL_FIFO  0xC00000
+#define CAM_CDM_CURRENT_BL_TAG   0xFF000000
+
+#define CAM_CDM_CURRENT_BL_ARB_SHIFT   0x14
+#define CAM_CDM_CURRENT_BL_FIFO_SHIFT  0x16
+#define CAM_CDM_CURRENT_BL_TAG_SHIFT   0x18
+
+/* IRQ bit-masks */
+#define CAM_CDM_IRQ_STATUS_RST_DONE_MASK 0x1
+#define CAM_CDM_IRQ_STATUS_INLINE_IRQ_MASK 0x2
+#define CAM_CDM_IRQ_STATUS_BL_DONE_MASK 0x4
+#define CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK 0x10000
+#define CAM_CDM_IRQ_STATUS_ERROR_OVER_FLOW_MASK 0x20000
+#define CAM_CDM_IRQ_STATUS_ERROR_AHB_BUS_MASK 0x40000
+#define CAM_CDM_IRQ_STATUS_USR_DATA_MASK 0xFF
+
+#define CAM_CDM_IRQ_STATUS_ERRORS \
+	(CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK | \
+	 CAM_CDM_IRQ_STATUS_ERROR_OVER_FLOW_MASK | \
+	 CAM_CDM_IRQ_STATUS_ERROR_AHB_BUS_MASK)
+
+
+struct cam_cdm_pid_mid_data {
+	int cdm_pid;
+	int cdm_mid;
+	int ope_cdm_pid;
+	int ope_cdm_mid;
+};
+
+/* Structure to store hw version info */
+struct cam_version_reg {
+	uint32_t hw_version;
+};
+
+/**
+ * struct cam_cdm_irq_regs - CDM IRQ registers
+ *
+ * @irq_mask:        register offset for irq_mask
+ * @irq_clear:       register offset for irq_clear
+ * @irq_clear_cmd:   register offset to initiate irq clear
+ * @irq_set:         register offset to set irq
+ * @irq_set_cmd:     register offset to issue set_irq from irq_set
+ * @irq_status:      register offset to look which irq is received
+ */
+struct cam_cdm_irq_regs {
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_clear_cmd;
+	uint32_t irq_set;
+	uint32_t irq_set_cmd;
+	uint32_t irq_status;
+};
+
+/**
+ * struct cam_cdm_bl_fifo_regs - BL_FIFO registers
+ *
+ * @bl_fifo_base:    register offset to write bl_cmd base address
+ * @bl_fifo_len:     register offset to write bl_cmd length
+ * @bl_fifo_store:   register offset to commit the BL cmd
+ * @bl_fifo_cfg:     register offset to config BL_FIFO depth, etc.
+ */
+struct cam_cdm_bl_fifo_regs {
+	uint32_t bl_fifo_base;
+	uint32_t bl_fifo_len;
+	uint32_t bl_fifo_store;
+	uint32_t bl_fifo_cfg;
+};
+
+/**
+ * struct cam_cdm_bl_pending_req_reg_params - BL_FIFO pending registers
+ *
+ * @rb_offset:          register offset pending bl request in BL_FIFO
+ * @rb_mask:            mask to get number of pending BLs in BL_FIFO
+ * @rb_num_fifo:        number of BL_FIFO's information in the register
+ * @rb_next_fifo_shift: shift to get next fifo's pending BLs.
+ */
+struct cam_cdm_bl_pending_req_reg_params {
+	uint32_t rb_offset;
+	uint32_t rb_mask;
+	uint32_t rb_num_fifo;
+	uint32_t rb_next_fifo_shift;
+};
+
+/**
+ * struct cam_cdm_scratch_reg - scratch register
+ *
+ * @scratch_reg:        offset of scratch register
+ */
+struct cam_cdm_scratch_reg {
+	uint32_t scratch_reg;
+};
+
+/* struct cam_cdm_perf_mon_regs - perf_mon registers */
+struct cam_cdm_perf_mon_regs {
+	uint32_t perf_mon_ctrl;
+	uint32_t perf_mon_0;
+	uint32_t perf_mon_1;
+	uint32_t perf_mon_2;
+};
+
+/**
+ * struct cam_cdm_perf_mon_regs - perf mon counter's registers
+ *
+ * @count_cfg_0:         register offset to configure perf measures
+ * @always_count_val:    register offset for always count value
+ * @busy_count_val:      register offset to get busy count
+ * @stall_axi_count_val: register offset to get axi stall counts
+ * @count_status:        register offset to know if count status finished
+ *                       for stall, busy and always.
+ */
+struct cam_cdm_perf_regs {
+	uint32_t count_cfg_0;
+	uint32_t always_count_val;
+	uint32_t busy_count_val;
+	uint32_t stall_axi_count_val;
+	uint32_t count_status;
+};
+
+/**
+ * struct cam_cdm_icl_data_regs - CDM icl data registers
+ *
+ * @icl_last_data_0:     register offset to log last known good command
+ * @icl_last_data_1:     register offset to log last known good command 1
+ * @icl_last_data_2:     register offset to log last known good command 2
+ * @icl_inv_data:        register offset to log CDM cmd that triggered
+ *                       invalid command.
+ */
+struct cam_cdm_icl_data_regs {
+	uint32_t icl_last_data_0;
+	uint32_t icl_last_data_1;
+	uint32_t icl_last_data_2;
+	uint32_t icl_inv_data;
+};
+
+/**
+ * struct cam_cdm_icl_misc_regs - CDM icl misc registers
+ *
+ * @icl_inv_bl_addr:     register offset to give address of bl_cmd that
+ *                       gave invalid command
+ * @icl_status:          register offset for context that gave good BL
+ *                       command and invalid command.
+ */
+struct cam_cdm_icl_misc_regs {
+	uint32_t icl_inv_bl_addr;
+	uint32_t icl_status;
+};
+
+/**
+ * struct cam_cdm_icl_regs - CDM icl registers
+ *
+ * @data_regs:           structure with registers of all cdm good and invalid
+ *                       BL command information.
+ * @misc_regs:           structure with registers for invalid command address
+ *                       and context
+ */
+struct cam_cdm_icl_regs {
+	struct cam_cdm_icl_data_regs *data_regs;
+	struct cam_cdm_icl_misc_regs *misc_regs;
+};
+
+/**
+ * struct cam_cdm_comp_wait_status - BL_FIFO comp_event status register
+ *
+ * @comp_wait_status:    register offset to give information on whether the
+ *                       CDM is waiting for an event from another module
+ */
+struct cam_cdm_comp_wait_status {
+	uint32_t comp_wait_status;
+};
+
+/**
+ * struct cam_cdm_common_reg_data - structure for register data
+ *
+ * @num_bl_fifo:            number of FIFO are there in CDM
+ * @num_bl_fifo_irq:        number of FIFO irqs in CDM
+ * @num_bl_pending_req_reg: number of pending_requests register in CDM
+ * @num_scratch_reg:        number of scratch registers in CDM
+ */
+struct cam_cdm_common_reg_data {
+	uint32_t num_bl_fifo;
+	uint32_t num_bl_fifo_irq;
+	uint32_t num_bl_pending_req_reg;
+	uint32_t num_scratch_reg;
+};
+
+/**
+ * struct cam_cdm_common_regs - common structure to get common registers
+ *                       of CDM
+ *
+ * @cdm_hw_version:      offset to read cdm_hw_version
+ * @cam_version:         offset to read the camera Titan architecture version
+ * @rst_cmd:             offset to reset the CDM
+ * @cgc_cfg:             offset to configure CDM CGC logic
+ * @core_cfg:            offset to configure CDM core with ARB_SEL, implicit
+ *                       wait, etc.
+ * @core_en:             offset to pause/enable CDM
+ * @fe_cfg:              offset to configure CDM fetch engine
+ * @irq_context_status   offset to read back irq context status
+ * @bl_fifo_rb:          offset to set BL_FIFO read back
+ * @bl_fifo_base_rb:     offset to read back base address on offset set by
+ *                       bl_fifo_rb
+ * @bl_fifo_len_rb:      offset to read back base len and tag on offset set by
+ *                       bl_fifo_rb
+ * @usr_data:            offset to read user data from GEN_IRQ commands
+ * @wait_status:         offset to read status for last WAIT command
+ * @last_ahb_addr:       offset to read back last AHB address generated by CDM
+ * @last_ahb_data:       offset to read back last AHB data generated by CDM
+ * @core_debug:          offset to configure CDM debug bus and debug features
+ * @last_ahb_err_addr:   offset to read back last AHB Error address generated
+ *                       by CDM
+ * @last_ahb_err_data:   offset to read back last AHB Error data generated
+ *                       by CDM
+ * @current_bl_base:     offset to read back current command buffer BASE address
+ *                       value out of BL_FIFO
+ * @current_bl_len:      offset to read back current command buffer len, TAG,
+ *                       context ID ARB value out of BL_FIFO
+ * @current_used_ahb_base: offset to read back current base address used by
+ *                       CDM to access camera register
+ * @debug_status:        offset to read back current CDM status
+ * @bus_misr_cfg0:       offset to enable bus MISR and configure sampling mode
+ * @bus_misr_cfg1:       offset to select from one of the six MISR's for reading
+ *                       signature value
+ * @bus_misr_rd_val:     offset to read MISR signature
+ * @pending_req:         registers to read pending request in FIFO
+ * @comp_wait:           registers to read comp_event CDM is waiting for
+ * @perf_mon:            registers to read perf_mon information
+ * @scratch:             registers to read scratch register value
+ * @perf_reg:            registers to read performance counters value
+ * @icl_reg:             registers to read information related to good
+ *                       and invalid commands in FIFO
+ * @spare:               spare register
+ * @priority_group_bit_offset offset of priority group bits
+ *
+ */
+struct cam_cdm_common_regs {
+	uint32_t cdm_hw_version;
+	const struct cam_version_reg *cam_version;
+	uint32_t rst_cmd;
+	uint32_t cgc_cfg;
+	uint32_t core_cfg;
+	uint32_t core_en;
+	uint32_t fe_cfg;
+	uint32_t irq_context_status;
+	uint32_t bl_fifo_rb;
+	uint32_t bl_fifo_base_rb;
+	uint32_t bl_fifo_len_rb;
+	uint32_t usr_data;
+	uint32_t wait_status;
+	uint32_t last_ahb_addr;
+	uint32_t last_ahb_data;
+	uint32_t core_debug;
+	uint32_t last_ahb_err_addr;
+	uint32_t last_ahb_err_data;
+	uint32_t current_bl_base;
+	uint32_t current_bl_len;
+	uint32_t current_used_ahb_base;
+	uint32_t debug_status;
+	uint32_t bus_misr_cfg0;
+	uint32_t bus_misr_cfg1;
+	uint32_t bus_misr_rd_val;
+	const struct cam_cdm_bl_pending_req_reg_params
+		*pending_req[CAM_CDM_BL_FIFO_PENDING_REQ_REG_NUM];
+	const struct cam_cdm_comp_wait_status
+		*comp_wait[CAM_CDM_COMP_WAIT_STATUS_REG_NUM];
+	const struct cam_cdm_perf_mon_regs
+		*perf_mon[CAM_CDM_PERF_MON_REG_NUM];
+	const struct cam_cdm_scratch_reg
+		*scratch[CAM_CDM_SCRATCH_REG_NUM];
+	const struct cam_cdm_perf_regs *perf_reg;
+	const struct cam_cdm_icl_regs *icl_reg;
+	uint32_t spare;
+	uint32_t priority_group_bit_offset;
+	struct cam_cdm_pid_mid_data *cdm_pid_mid_info;
+};
+
+/**
+ * struct cam_cdm_hw_reg_offset - BL_FIFO comp_event status register
+ *
+ * @cmn_reg:             pointer to structure to get common registers of a CDM
+ * @bl_fifo_reg:         pointer to structure to get BL_FIFO registers of a CDM
+ * @irq_reg:             pointer to structure to get IRQ registers of a CDM
+ * @reg_data:            pointer to structure to reg_data related to CDM
+ *                       registers
+ */
+struct cam_cdm_hw_reg_offset {
+	const struct cam_cdm_common_regs *cmn_reg;
+	const struct cam_cdm_bl_fifo_regs *bl_fifo_reg[CAM_CDM_BL_FIFO_REG_NUM];
+	const struct cam_cdm_irq_regs *irq_reg[CAM_CDM_BL_FIFO_IRQ_REG_NUM];
+	const struct cam_cdm_common_reg_data *reg_data;
+};
+
+/* enum cam_cdm_hw_process_intf_cmd - interface commands.*/
+enum cam_cdm_hw_process_intf_cmd {
+	CAM_CDM_HW_INTF_CMD_ACQUIRE,
+	CAM_CDM_HW_INTF_CMD_RELEASE,
+	CAM_CDM_HW_INTF_CMD_SUBMIT_BL,
+	CAM_CDM_HW_INTF_CMD_RESET_HW,
+	CAM_CDM_HW_INTF_CMD_FLUSH_HW,
+	CAM_CDM_HW_INTF_CMD_HANDLE_ERROR,
+	CAM_CDM_HW_INTF_CMD_HANG_DETECT,
+	CAM_CDM_HW_INTF_DUMP_DBG_REGS,
+	CAM_CDM_HW_INTF_CMD_INVALID,
+};
+
+/* enum cam_cdm_flags - Bit fields for CDM flags used */
+enum cam_cdm_flags {
+	CAM_CDM_FLAG_SHARED_CDM,
+	CAM_CDM_FLAG_PRIVATE_CDM,
+};
+
+/* enum cam_cdm_type - Enum for possible CAM CDM types */
+enum cam_cdm_type {
+	CAM_VIRTUAL_CDM,
+	CAM_HW_CDM,
+};
+
+/* enum cam_cdm_mem_base_index - Enum for possible CAM CDM types */
+enum cam_cdm_mem_base_index {
+	CAM_HW_CDM_BASE_INDEX,
+	CAM_HW_CDM_MAX_INDEX = CAM_SOC_MAX_BLOCK,
+};
+
+/* enum cam_cdm_bl_cb_type - Enum for possible CAM CDM cb request types */
+enum cam_cdm_bl_cb_type {
+	CAM_HW_CDM_BL_CB_CLIENT = 1,
+	CAM_HW_CDM_BL_CB_INTERNAL,
+};
+
+/* enum cam_cdm_arbitration - Enum type of arbitration */
+enum cam_cdm_arbitration {
+	CAM_CDM_ARBITRATION_NONE,
+	CAM_CDM_ARBITRATION_ROUND_ROBIN,
+	CAM_CDM_ARBITRATION_PRIORITY_BASED,
+	CAM_CDM_ARBITRATION_MAX,
+};
+
+enum cam_cdm_hw_version {
+	CAM_CDM_VERSION = 0,
+	CAM_CDM_VERSION_1_0 = 0x10000000,
+	CAM_CDM_VERSION_1_1 = 0x10010000,
+	CAM_CDM_VERSION_1_2 = 0x10020000,
+	CAM_CDM_VERSION_2_0 = 0x20000000,
+	CAM_CDM_VERSION_2_1 = 0x20010000,
+	CAM_CDM_VERSION_MAX,
+};
+
+/* struct cam_cdm_client - struct for cdm clients data.*/
+struct cam_cdm_client {
+	struct cam_cdm_acquire_data data;
+	void __iomem  *changebase_addr;
+	uint32_t stream_on;
+	uint32_t refcount;
+	struct mutex lock;
+	uint32_t handle;
+};
+
+/* struct cam_cdm_work_payload - struct for cdm work payload data.*/
+struct cam_cdm_work_payload {
+	struct cam_hw_info *hw;
+	uint32_t irq_status;
+	uint32_t irq_data;
+	int fifo_idx;
+	ktime_t workq_scheduled_ts;
+	struct work_struct work;
+};
+
+/* struct cam_cdm_bl_cb_request_entry - callback entry for work to process.*/
+struct cam_cdm_bl_cb_request_entry {
+	uint8_t bl_tag;
+	enum cam_cdm_bl_cb_type request_type;
+	uint32_t client_hdl;
+	void *userdata;
+	uint32_t cookie;
+	struct list_head entry;
+};
+
+/* struct cam_cdm_hw_intf_cmd_submit_bl - cdm interface submit command.*/
+struct cam_cdm_hw_intf_cmd_submit_bl {
+	uint32_t handle;
+	struct cam_cdm_bl_request *data;
+};
+
+/* struct cam_cdm_hw_mem - CDM hw memory struct */
+struct cam_cdm_hw_mem {
+	int32_t handle;
+	uint32_t vaddr;
+	uintptr_t kmdvaddr;
+	size_t size;
+};
+
+/* struct cam_cdm_bl_fifo - CDM hw memory struct */
+struct cam_cdm_bl_fifo {
+	struct completion bl_complete;
+	struct workqueue_struct *work_queue;
+	struct list_head bl_request_list;
+	struct mutex fifo_lock;
+	uint8_t bl_tag;
+	uint32_t bl_depth;
+	uint8_t last_bl_tag_done;
+	atomic_t work_record;
+};
+
+/**
+ * struct cam_cdm - CDM hw device struct
+ *
+ * @index:               index of CDM hardware
+ * @name:                cdm_name
+ * @id:                  enum for possible CDM hardwares
+ * @flags:               enum to tell if CDM is private of shared
+ * @reset_complete:      completion event to make CDM wait for reset
+ * @work_queue:          workqueue to schedule work for virtual CDM
+ * @bl_request_list:     bl_request list for submitted commands in
+ *                       virtual CDM
+ * @version:             CDM version with major, minor, incr and reserved
+ * @hw_version:          CDM version as read from the cdm_version register
+ * @hw_family_version:   version of hw family the CDM belongs to
+ * @iommu_hdl:           CDM iommu handle
+ * @offsets:             pointer to structure of CDM registers
+ * @ops:                 CDM ops for generating cdm commands
+ * @clients:             CDM clients array currently active on CDM
+ * @bl_fifo:             structure with per fifo related attributes
+ * @cdm_status:          bitfield with bits assigned for different cdm status
+ * @bl_tag:              slot value at which the next bl cmd will be written
+ *                       in case of virtual CDM
+ * @gen_irq:             memory region in which gen_irq command will be written
+ * @cpas_handle:         handle for cpas driver
+ * @arbitration:         type of arbitration to be used for the CDM
+ */
+struct cam_cdm {
+	uint32_t index;
+	char name[128];
+	enum cam_cdm_id id;
+	enum cam_cdm_flags flags;
+	struct completion reset_complete;
+	struct workqueue_struct *work_queue;
+	struct list_head bl_request_list;
+	struct cam_hw_version version;
+	uint32_t hw_version;
+	uint32_t hw_family_version;
+	struct cam_iommu_handle iommu_hdl;
+	struct cam_cdm_hw_reg_offset *offsets;
+	struct cam_cdm_utils_ops *ops;
+	struct cam_cdm_client *clients[CAM_PER_CDM_MAX_REGISTERED_CLIENTS];
+	struct cam_cdm_bl_fifo bl_fifo[CAM_CDM_BL_FIFO_MAX];
+	unsigned long cdm_status;
+	uint8_t bl_tag;
+	struct cam_cdm_hw_mem gen_irq[CAM_CDM_BL_FIFO_MAX];
+	uint32_t cpas_handle;
+	enum cam_cdm_arbitration arbitration;
+};
+
+/* struct cam_cdm_private_dt_data - CDM hw custom dt data */
+struct cam_cdm_private_dt_data {
+	bool dt_cdm_shared;
+	bool config_fifo;
+	bool is_single_ctx_cdm;
+	uint8_t priority_group;
+	uint32_t fifo_depth[CAM_CDM_BL_FIFO_MAX];
+	uint32_t dt_num_supported_clients;
+	const char *dt_cdm_client_name[CAM_PER_CDM_MAX_REGISTERED_CLIENTS];
+};
+
+/* struct cam_cdm_intf_devices - CDM mgr interface devices */
+struct cam_cdm_intf_devices {
+	struct mutex lock;
+	uint32_t refcount;
+	struct cam_hw_intf *device;
+	struct cam_cdm_private_dt_data *data;
+};
+
+/* struct cam_cdm_intf_mgr - CDM mgr interface device struct */
+struct cam_cdm_intf_mgr {
+	bool probe_done;
+	uint32_t cdm_count;
+	uint32_t dt_supported_hw_cdm;
+	int32_t refcount;
+	struct cam_cdm_intf_devices nodes[CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM];
+};
+
+int cam_cdm_intf_register_hw_cdm(struct cam_hw_intf *hw,
+	struct cam_cdm_private_dt_data *data, enum cam_cdm_type type,
+	uint32_t *index);
+int cam_cdm_intf_deregister_hw_cdm(struct cam_hw_intf *hw,
+	struct cam_cdm_private_dt_data *data, enum cam_cdm_type type,
+	uint32_t index);
+
+#endif /* _CAM_CDM_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_core_common.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_core_common.c
@@ -0,0 +1,843 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include "cam_soc_util.h"
+#include "cam_smmu_api.h"
+#include "cam_io_util.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm.h"
+#include "cam_cdm_soc.h"
+#include "cam_cdm_core_common.h"
+
+static void cam_cdm_get_client_refcount(struct cam_cdm_client *client)
+{
+	mutex_lock(&client->lock);
+	CAM_DBG(CAM_CDM, "CDM client get refcount=%d",
+		client->refcount);
+	client->refcount++;
+	mutex_unlock(&client->lock);
+}
+
+static void cam_cdm_put_client_refcount(struct cam_cdm_client *client)
+{
+	mutex_lock(&client->lock);
+	CAM_DBG(CAM_CDM, "CDM client put refcount=%d",
+		client->refcount);
+	if (client->refcount > 0) {
+		client->refcount--;
+	} else {
+		CAM_ERR(CAM_CDM, "Refcount put when zero");
+		WARN_ON(1);
+	}
+	mutex_unlock(&client->lock);
+}
+
+bool cam_cdm_set_cam_hw_version(
+	uint32_t ver, struct cam_hw_version *cam_version)
+{
+	switch (ver) {
+	case CAM_CDM100_VERSION:
+	case CAM_CDM110_VERSION:
+	case CAM_CDM120_VERSION:
+	case CAM_CDM200_VERSION:
+	case CAM_CDM210_VERSION:
+		cam_version->major    = (ver & 0xF0000000);
+		cam_version->minor    = (ver & 0xFFF0000);
+		cam_version->incr     = (ver & 0xFFFF);
+		cam_version->reserved = 0;
+		return true;
+	default:
+		CAM_ERR(CAM_CDM, "CDM Version=%x not supported in util", ver);
+	break;
+	}
+	return false;
+}
+
+bool cam_cdm_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	if (!irq_data)
+		return false;
+
+	CAM_DBG(CAM_CDM, "CPAS error callback type=%d", irq_data->irq_type);
+
+	return false;
+}
+
+struct cam_cdm_utils_ops *cam_cdm_get_ops(
+	uint32_t ver, struct cam_hw_version *cam_version, bool by_cam_version)
+{
+	if (by_cam_version == false) {
+		switch (ver) {
+		case CAM_CDM100_VERSION:
+		case CAM_CDM110_VERSION:
+		case CAM_CDM120_VERSION:
+		case CAM_CDM200_VERSION:
+		case CAM_CDM210_VERSION:
+			return &CDM170_ops;
+		default:
+			CAM_ERR(CAM_CDM, "CDM Version=%x not supported in util",
+				ver);
+		}
+	} else if (cam_version) {
+		if (((cam_version->major == 1) &&
+			(cam_version->minor == 0) &&
+			(cam_version->incr == 0)) ||
+			((cam_version->major == 1) &&
+			(cam_version->minor == 1) &&
+			(cam_version->incr == 0)) ||
+			((cam_version->major == 1) &&
+			(cam_version->minor == 2) &&
+			(cam_version->incr == 0))) {
+
+			CAM_DBG(CAM_CDM,
+				"cam_hw_version=%x:%x:%x supported",
+				cam_version->major, cam_version->minor,
+				cam_version->incr);
+			return &CDM170_ops;
+		}
+
+		CAM_ERR(CAM_CDM, "cam_hw_version=%x:%x:%x not supported",
+			cam_version->major, cam_version->minor,
+			cam_version->incr);
+	}
+
+	return NULL;
+}
+
+struct cam_cdm_bl_cb_request_entry *cam_cdm_find_request_by_bl_tag(
+	uint32_t tag, struct list_head *bl_list)
+{
+	struct cam_cdm_bl_cb_request_entry *node;
+
+	list_for_each_entry(node, bl_list, entry) {
+		if (node->bl_tag == tag)
+			return node;
+	}
+	CAM_ERR(CAM_CDM, "Could not find the bl request for tag=%x", tag);
+
+	return NULL;
+}
+
+int cam_cdm_get_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_cdm *cdm_core;
+
+	if ((cdm_hw) && (cdm_hw->core_info) && (get_hw_cap_args) &&
+		(sizeof(struct cam_iommu_handle) == arg_size)) {
+		cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+		*((struct cam_iommu_handle *)get_hw_cap_args) =
+			cdm_core->iommu_hdl;
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static int cam_cdm_find_free_client_slot(struct cam_cdm *hw)
+{
+	int i;
+
+	for (i = 0; i < CAM_PER_CDM_MAX_REGISTERED_CLIENTS; i++) {
+		if (hw->clients[i] == NULL) {
+			CAM_DBG(CAM_CDM, "Found client slot %d", i);
+			return i;
+		}
+	}
+	CAM_ERR(CAM_CDM, "No more client slots");
+
+	return -EBUSY;
+}
+
+
+void cam_cdm_notify_clients(struct cam_hw_info *cdm_hw,
+	enum cam_cdm_cb_status status, void *data)
+{
+	int i;
+	struct cam_cdm *core = NULL;
+	struct cam_cdm_client *client = NULL;
+
+	if (!cdm_hw) {
+		CAM_ERR(CAM_CDM, "CDM Notify called with NULL hw info");
+		return;
+	}
+	core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (status == CAM_CDM_CB_STATUS_BL_SUCCESS) {
+		int client_idx;
+		struct cam_cdm_bl_cb_request_entry *node =
+			(struct cam_cdm_bl_cb_request_entry *)data;
+
+		client_idx = CAM_CDM_GET_CLIENT_IDX(node->client_hdl);
+		client = core->clients[client_idx];
+		if ((!client) || (client->handle != node->client_hdl)) {
+			CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client,
+				node->client_hdl);
+			return;
+		}
+		cam_cdm_get_client_refcount(client);
+		mutex_lock(&client->lock);
+		if (client->data.cam_cdm_callback) {
+			CAM_DBG(CAM_CDM, "Calling client=%s cb cookie=%d",
+				client->data.identifier, node->cookie);
+			client->data.cam_cdm_callback(node->client_hdl,
+				node->userdata, CAM_CDM_CB_STATUS_BL_SUCCESS,
+				node->cookie);
+			CAM_DBG(CAM_CDM, "Exit client cb cookie=%d",
+				node->cookie);
+		} else {
+			CAM_ERR(CAM_CDM, "No cb registered for client hdl=%x",
+				node->client_hdl);
+		}
+		mutex_unlock(&client->lock);
+		cam_cdm_put_client_refcount(client);
+		return;
+	} else if (status == CAM_CDM_CB_STATUS_HW_RESET_DONE ||
+			status == CAM_CDM_CB_STATUS_HW_FLUSH ||
+			status == CAM_CDM_CB_STATUS_HW_RESUBMIT ||
+			status == CAM_CDM_CB_STATUS_INVALID_BL_CMD ||
+			status == CAM_CDM_CB_STATUS_HW_ERROR) {
+		int client_idx;
+		struct cam_cdm_bl_cb_request_entry *node =
+			(struct cam_cdm_bl_cb_request_entry *)data;
+
+		client_idx = CAM_CDM_GET_CLIENT_IDX(node->client_hdl);
+		client = core->clients[client_idx];
+		if ((!client) || (client->handle != node->client_hdl)) {
+			CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client,
+				node->client_hdl);
+			return;
+		}
+		cam_cdm_get_client_refcount(client);
+		mutex_lock(&client->lock);
+		if (client->data.cam_cdm_callback) {
+			client->data.cam_cdm_callback(
+				client->handle,
+				client->data.userdata,
+				status,
+				node->cookie);
+		} else {
+			CAM_ERR(CAM_CDM,
+				"No cb registered for client: name %s, hdl=%x",
+				client->data.identifier, client->handle);
+		}
+		mutex_unlock(&client->lock);
+		cam_cdm_put_client_refcount(client);
+		return;
+	}
+
+	for (i = 0; i < CAM_PER_CDM_MAX_REGISTERED_CLIENTS; i++) {
+		if (core->clients[i] != NULL) {
+			client = core->clients[i];
+			cam_cdm_get_client_refcount(client);
+			mutex_lock(&client->lock);
+			CAM_DBG(CAM_CDM, "Found client slot %d", i);
+			if (client->data.cam_cdm_callback) {
+				if (status == CAM_CDM_CB_STATUS_PAGEFAULT) {
+					unsigned long iova =
+						(unsigned long)data;
+
+					client->data.cam_cdm_callback(
+						client->handle,
+						client->data.userdata,
+						CAM_CDM_CB_STATUS_PAGEFAULT,
+						(iova & 0xFFFFFFFF));
+				}
+			} else {
+				CAM_ERR(CAM_CDM,
+					"No cb registered for client hdl=%x",
+					client->handle);
+			}
+			mutex_unlock(&client->lock);
+			cam_cdm_put_client_refcount(client);
+		}
+	}
+}
+
+static int cam_cdm_stream_handle_init(void *hw_priv, bool init)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_cdm *core = NULL;
+	int rc = -EPERM;
+
+	core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (init) {
+		rc = cam_hw_cdm_init(hw_priv, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_CDM, "CDM HW init failed");
+			return rc;
+		}
+
+		if (core->arbitration !=
+			CAM_CDM_ARBITRATION_PRIORITY_BASED) {
+			rc = cam_hw_cdm_alloc_genirq_mem(
+				hw_priv);
+			if (rc) {
+				CAM_ERR(CAM_CDM,
+					"Genirqalloc failed");
+				cam_hw_cdm_deinit(hw_priv,
+					NULL, 0);
+			}
+		}
+	} else {
+		rc = cam_hw_cdm_deinit(hw_priv, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_CDM, "Deinit failed in streamoff");
+
+		if (core->arbitration !=
+			CAM_CDM_ARBITRATION_PRIORITY_BASED) {
+			if (cam_hw_cdm_release_genirq_mem(hw_priv))
+				CAM_ERR(CAM_CDM, "Genirq release fail");
+		}
+	}
+
+	return rc;
+}
+
+int cam_cdm_stream_ops_internal(void *hw_priv,
+	void *start_args, bool operation)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_cdm *core = NULL;
+	int rc = -EPERM;
+	int client_idx;
+	struct cam_cdm_client *client;
+	uint32_t *handle = start_args;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	core = (struct cam_cdm *)cdm_hw->core_info;
+	mutex_lock(&cdm_hw->hw_mutex);
+	client_idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+	client = core->clients[client_idx];
+	if (!client) {
+		CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client, *handle);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		return -EINVAL;
+	}
+	cam_cdm_get_client_refcount(client);
+	if (*handle != client->handle) {
+		CAM_ERR(CAM_CDM, "client id given handle=%x invalid", *handle);
+		rc = -EINVAL;
+		goto end;
+	}
+	if (operation == true) {
+		if (true == client->stream_on) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM client is already streamed ON");
+			goto end;
+		}
+	} else {
+		if (client->stream_on == false) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM client is already streamed Off");
+			goto end;
+		}
+	}
+
+	if (operation == true) {
+		if (!cdm_hw->open_count) {
+			struct cam_ahb_vote ahb_vote;
+			struct cam_axi_vote axi_vote = {0};
+
+			ahb_vote.type = CAM_VOTE_ABSOLUTE;
+			ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+			axi_vote.num_paths = 1;
+			axi_vote.axi_path[0].path_data_type =
+				CAM_AXI_PATH_DATA_ALL;
+			axi_vote.axi_path[0].transac_type =
+				CAM_AXI_TRANSACTION_READ;
+			axi_vote.axi_path[0].camnoc_bw =
+				CAM_CPAS_DEFAULT_AXI_BW;
+			axi_vote.axi_path[0].mnoc_ab_bw =
+				CAM_CPAS_DEFAULT_AXI_BW;
+			axi_vote.axi_path[0].mnoc_ib_bw =
+				CAM_CPAS_DEFAULT_AXI_BW;
+
+			rc = cam_cpas_start(core->cpas_handle,
+				&ahb_vote, &axi_vote);
+			if (rc != 0) {
+				CAM_ERR(CAM_CDM, "CPAS start failed");
+				goto end;
+			}
+			CAM_DBG(CAM_CDM, "CDM init first time");
+			if (core->id == CAM_CDM_VIRTUAL) {
+				CAM_DBG(CAM_CDM,
+					"Virtual CDM HW init first time");
+				rc = 0;
+			} else {
+				CAM_DBG(CAM_CDM, "CDM HW init first time");
+				rc = cam_cdm_stream_handle_init(hw_priv, true);
+			}
+			if (rc == 0) {
+				cdm_hw->open_count++;
+				client->stream_on = true;
+			} else {
+				if (cam_cpas_stop(core->cpas_handle))
+					CAM_ERR(CAM_CDM, "CPAS stop failed");
+			}
+		} else {
+			cdm_hw->open_count++;
+			CAM_DBG(CAM_CDM, "CDM HW already ON count=%d",
+				cdm_hw->open_count);
+			rc = 0;
+			client->stream_on = true;
+		}
+	} else {
+		if (cdm_hw->open_count) {
+			cdm_hw->open_count--;
+			CAM_DBG(CAM_CDM, "stream OFF CDM %d",
+				cdm_hw->open_count);
+			if (!cdm_hw->open_count) {
+				CAM_DBG(CAM_CDM, "CDM Deinit now");
+				if (core->id == CAM_CDM_VIRTUAL) {
+					CAM_DBG(CAM_CDM,
+						"Virtual CDM HW Deinit");
+					rc = 0;
+				} else {
+					CAM_DBG(CAM_CDM, "CDM HW Deinit now");
+					rc = cam_cdm_stream_handle_init(hw_priv,
+						false);
+				}
+				if (rc == 0) {
+					client->stream_on = false;
+					rc = cam_cpas_stop(core->cpas_handle);
+					if (rc)
+						CAM_ERR(CAM_CDM,
+							"CPAS stop failed");
+				}
+			} else {
+				client->stream_on = false;
+				rc = 0;
+				CAM_DBG(CAM_CDM,
+					"Client stream off success =%d",
+					cdm_hw->open_count);
+			}
+		} else {
+			CAM_DBG(CAM_CDM, "stream OFF CDM Invalid %d",
+				cdm_hw->open_count);
+			rc = -ENXIO;
+		}
+	}
+end:
+	cam_cdm_put_client_refcount(client);
+	mutex_unlock(&cdm_hw->hw_mutex);
+	return rc;
+}
+
+int cam_cdm_stream_start(void *hw_priv,
+	void *start_args, uint32_t size)
+{
+	int rc = 0;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	rc = cam_cdm_stream_ops_internal(hw_priv, start_args, true);
+	return rc;
+
+}
+
+int cam_cdm_stream_stop(void *hw_priv,
+	void *start_args, uint32_t size)
+{
+	int rc = 0;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	rc = cam_cdm_stream_ops_internal(hw_priv, start_args, false);
+	return rc;
+
+}
+
+int cam_cdm_process_cmd(void *hw_priv,
+	uint32_t cmd, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_hw_soc_info *soc_data = NULL;
+	struct cam_cdm *core = NULL;
+	int rc = -EINVAL;
+
+	if ((!hw_priv) || (!cmd_args) ||
+		(cmd >= CAM_CDM_HW_INTF_CMD_INVALID))
+		return rc;
+
+	soc_data = &cdm_hw->soc_info;
+	core = (struct cam_cdm *)cdm_hw->core_info;
+	switch (cmd) {
+	case CAM_CDM_HW_INTF_CMD_SUBMIT_BL: {
+		struct cam_cdm_hw_intf_cmd_submit_bl *req;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(struct cam_cdm_hw_intf_cmd_submit_bl) != arg_size) {
+			CAM_ERR(CAM_CDM, "Invalid CDM cmd %d arg size=%x", cmd,
+				arg_size);
+			break;
+		}
+		req = (struct cam_cdm_hw_intf_cmd_submit_bl *)cmd_args;
+		if ((req->data->type < 0) ||
+			(req->data->type > CAM_CDM_BL_CMD_TYPE_KERNEL_IOVA)) {
+			CAM_ERR(CAM_CDM, "Invalid req bl cmd addr type=%d",
+				req->data->type);
+			break;
+		}
+		idx = CAM_CDM_GET_CLIENT_IDX(req->handle);
+		client = core->clients[idx];
+		if ((!client) || (req->handle != client->handle)) {
+			CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client,
+				req->handle);
+			break;
+		}
+		cam_cdm_get_client_refcount(client);
+		if ((req->data->flag == true) &&
+			(!client->data.cam_cdm_callback)) {
+			CAM_ERR(CAM_CDM,
+				"CDM request cb without registering cb");
+			cam_cdm_put_client_refcount(client);
+			break;
+		}
+		if (client->stream_on != true) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM needs to be streamed ON first");
+			cam_cdm_put_client_refcount(client);
+			break;
+		}
+		if (core->id == CAM_CDM_VIRTUAL)
+			rc = cam_virtual_cdm_submit_bl(cdm_hw, req, client);
+		else
+			rc = cam_hw_cdm_submit_bl(cdm_hw, req, client);
+
+		cam_cdm_put_client_refcount(client);
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_ACQUIRE: {
+		struct cam_cdm_acquire_data *data;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(struct cam_cdm_acquire_data) != arg_size) {
+			CAM_ERR(CAM_CDM, "Invalid CDM cmd %d arg size=%x", cmd,
+				arg_size);
+			break;
+		}
+
+		mutex_lock(&cdm_hw->hw_mutex);
+		data = (struct cam_cdm_acquire_data *)cmd_args;
+		CAM_DBG(CAM_CDM, "Trying to acquire client=%s in hw idx=%d",
+			data->identifier, core->index);
+
+		if (data->priority >= CAM_CDM_BL_FIFO_MAX) {
+			mutex_unlock(&cdm_hw->hw_mutex);
+			CAM_ERR(CAM_CDM,
+				"Invalid priority requested %d",
+				data->priority);
+			rc = -EINVAL;
+			break;
+		}
+
+		if (core->id != CAM_CDM_VIRTUAL &&
+				core->bl_fifo[data->priority].bl_depth == 0) {
+			mutex_unlock(&cdm_hw->hw_mutex);
+			CAM_ERR(CAM_CDM,
+				"FIFO %d not supported for core %d",
+				data->priority,
+				core->id);
+			rc = -EINVAL;
+			break;
+		}
+
+		idx = cam_cdm_find_free_client_slot(core);
+		if ((idx < 0) || (core->clients[idx])) {
+			mutex_unlock(&cdm_hw->hw_mutex);
+			CAM_ERR(CAM_CDM,
+				"Fail to client slots, client=%s in hw idx=%d",
+			data->identifier, core->index);
+			break;
+		}
+		core->clients[idx] = kzalloc(sizeof(struct cam_cdm_client),
+			GFP_KERNEL);
+		if (!core->clients[idx]) {
+			mutex_unlock(&cdm_hw->hw_mutex);
+			rc = -ENOMEM;
+			break;
+		}
+
+		mutex_unlock(&cdm_hw->hw_mutex);
+		client = core->clients[idx];
+		mutex_init(&client->lock);
+		data->ops = core->ops;
+		if (core->id == CAM_CDM_VIRTUAL) {
+			data->cdm_version.major = 1;
+			data->cdm_version.minor = 0;
+			data->cdm_version.incr = 0;
+			data->cdm_version.reserved = 0;
+			data->ops = cam_cdm_get_ops(0,
+					&data->cdm_version, true);
+			if (!data->ops) {
+				mutex_destroy(&client->lock);
+				mutex_lock(&cdm_hw->hw_mutex);
+				kfree(core->clients[idx]);
+				core->clients[idx] = NULL;
+				mutex_unlock(
+					&cdm_hw->hw_mutex);
+				rc = -EPERM;
+				CAM_ERR(CAM_CDM, "Invalid ops for virtual cdm");
+				break;
+			}
+		} else {
+			data->cdm_version = core->version;
+		}
+
+		cam_cdm_get_client_refcount(client);
+		mutex_lock(&client->lock);
+		memcpy(&client->data, data,
+			sizeof(struct cam_cdm_acquire_data));
+		client->handle = CAM_CDM_CREATE_CLIENT_HANDLE(
+					core->index,
+					data->priority,
+					idx);
+		client->stream_on = false;
+		data->handle = client->handle;
+		CAM_DBG(CAM_CDM, "Acquired client=%s in hwidx=%d",
+			data->identifier, core->index);
+		mutex_unlock(&client->lock);
+		rc = 0;
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_RELEASE: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+			return -EINVAL;
+		}
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		mutex_lock(&cdm_hw->hw_mutex);
+		client = core->clients[idx];
+		if ((!client) || (*handle != client->handle)) {
+			CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x",
+				client, *handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+		cam_cdm_put_client_refcount(client);
+		mutex_lock(&client->lock);
+		if (client->refcount != 0) {
+			CAM_ERR(CAM_CDM, "CDM Client refcount not zero %d",
+				client->refcount);
+			rc = -EPERM;
+			mutex_unlock(&client->lock);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+		core->clients[idx] = NULL;
+		mutex_unlock(&client->lock);
+		mutex_destroy(&client->lock);
+		kfree(client);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		rc = 0;
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_RESET_HW: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		mutex_lock(&cdm_hw->hw_mutex);
+		client = core->clients[idx];
+		if (!client) {
+			CAM_ERR(CAM_CDM,
+				"Client not present for handle %d",
+				*handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+
+		if (*handle != client->handle) {
+			CAM_ERR(CAM_CDM,
+				"handle mismatch, client handle %d index %d received handle %d",
+				client->handle, idx, *handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+		rc = cam_hw_cdm_reset_hw(cdm_hw, *handle);
+		if (rc) {
+			CAM_ERR(CAM_CDM,
+				"CDM HW reset failed for handle 0x%x rc = %d",
+				*handle, rc);
+		} else {
+			CAM_INFO_RATE_LIMIT(CAM_CDM,
+				"CDM HW reset done for handle 0x%x",
+				*handle);
+		}
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_FLUSH_HW: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		mutex_lock(&cdm_hw->hw_mutex);
+		client = core->clients[idx];
+		if (!client) {
+			CAM_ERR(CAM_CDM,
+				"Client not present for handle %d",
+				*handle);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+		}
+
+		if (*handle != client->handle) {
+			CAM_ERR(CAM_CDM,
+				"handle mismatch, client handle %d index %d received handle %d",
+				client->handle, idx, *handle);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+		}
+
+		rc = cam_hw_cdm_flush_hw(cdm_hw, *handle);
+		if (rc) {
+			CAM_ERR(CAM_CDM,
+				"CDM HW flush failed for handle 0x%x rc = %d",
+				*handle, rc);
+		} else {
+			CAM_INFO_RATE_LIMIT(CAM_CDM,
+				"CDM HW flush done for handle 0x%x",
+				*handle);
+		}
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_HANDLE_ERROR: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		mutex_lock(&cdm_hw->hw_mutex);
+		client = core->clients[idx];
+		if (!client) {
+			CAM_ERR(CAM_CDM,
+				"Client not present for handle %d",
+				*handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+
+		if (*handle != client->handle) {
+			CAM_ERR(CAM_CDM,
+				"handle mismatch, client handle %d index %d received handle %d",
+				client->handle, idx, *handle);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			break;
+		}
+
+		rc = cam_hw_cdm_handle_error(cdm_hw, *handle);
+		if (rc) {
+			CAM_ERR(CAM_CDM,
+				"CDM HW handle error failed for handle 0x%x rc = %d",
+				*handle, rc);
+		} else {
+			CAM_INFO_RATE_LIMIT(CAM_CDM,
+				"CDM HW handle error done for handle 0x%x",
+				*handle);
+		}
+
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+	}
+	case CAM_CDM_HW_INTF_CMD_HANG_DETECT: {
+		uint32_t *handle = cmd_args;
+		int idx;
+		struct cam_cdm_client *client;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+
+		idx = CAM_CDM_GET_CLIENT_IDX(*handle);
+		client = core->clients[idx];
+		if (!client) {
+			CAM_ERR(CAM_CDM,
+				"Client not present for handle %d",
+				*handle);
+			break;
+		}
+
+		if (*handle != client->handle) {
+			CAM_ERR(CAM_CDM,
+				"handle mismatch, client handle %d index %d received handle %d",
+				client->handle, idx, *handle);
+			break;
+		}
+
+		rc = cam_hw_cdm_hang_detect(cdm_hw, *handle);
+		break;
+	}
+	case CAM_CDM_HW_INTF_DUMP_DBG_REGS:
+	{
+		uint32_t *handle = cmd_args;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CDM,
+				"Invalid CDM cmd %d size=%x for handle=0x%x",
+				cmd, arg_size, *handle);
+				return -EINVAL;
+		}
+
+		mutex_lock(&cdm_hw->hw_mutex);
+		cam_hw_cdm_dump_core_debug_registers(cdm_hw, true);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_CDM, "CDM HW intf command not valid =%d", cmd);
+		break;
+	}
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_core_common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_core_common.h
@@ -0,0 +1,62 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_CORE_COMMON_H_
+#define _CAM_CDM_CORE_COMMON_H_
+
+#include "cam_mem_mgr.h"
+
+#define CAM_CDM100_VERSION 0x10000000
+#define CAM_CDM110_VERSION 0x10010000
+#define CAM_CDM120_VERSION 0x10020000
+#define CAM_CDM200_VERSION 0x20000000
+#define CAM_CDM210_VERSION 0x20010000
+
+#define CAM_CDM_AHB_BURST_LEN_1  (BIT(1) - 1)
+#define CAM_CDM_AHB_BURST_LEN_4  (BIT(2) - 1)
+#define CAM_CDM_AHB_BURST_LEN_8  (BIT(3) - 1)
+#define CAM_CDM_AHB_BURST_LEN_16 (BIT(4) - 1)
+#define CAM_CDM_AHB_BURST_EN      BIT(4)
+#define CAM_CDM_AHB_STOP_ON_ERROR BIT(8)
+#define CAM_CDM_ARB_SEL_RR        BIT(16)
+#define CAM_CDM_IMPLICIT_WAIT_EN  BIT(17)
+
+extern struct cam_cdm_utils_ops CDM170_ops;
+
+int cam_hw_cdm_init(void *hw_priv, void *init_hw_args, uint32_t arg_size);
+int cam_hw_cdm_deinit(void *hw_priv, void *init_hw_args, uint32_t arg_size);
+int cam_hw_cdm_alloc_genirq_mem(void *hw_priv);
+int cam_hw_cdm_release_genirq_mem(void *hw_priv);
+int cam_cdm_get_caps(void *hw_priv, void *get_hw_cap_args, uint32_t arg_size);
+int cam_cdm_stream_ops_internal(void *hw_priv, void *start_args,
+	bool operation);
+int cam_cdm_stream_start(void *hw_priv, void *start_args, uint32_t size);
+int cam_cdm_stream_stop(void *hw_priv, void *start_args, uint32_t size);
+int cam_cdm_process_cmd(void *hw_priv, uint32_t cmd, void *cmd_args,
+	uint32_t arg_size);
+bool cam_cdm_set_cam_hw_version(
+	uint32_t ver, struct cam_hw_version *cam_version);
+bool cam_cdm_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data);
+struct cam_cdm_utils_ops *cam_cdm_get_ops(
+	uint32_t ver, struct cam_hw_version *cam_version, bool by_cam_version);
+int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	struct cam_cdm_client *client);
+int cam_hw_cdm_submit_bl(struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	struct cam_cdm_client *client);
+int cam_hw_cdm_reset_hw(struct cam_hw_info *cdm_hw, uint32_t handle);
+int cam_hw_cdm_flush_hw(struct cam_hw_info *cdm_hw, uint32_t handle);
+int cam_hw_cdm_handle_error(struct cam_hw_info *cdm_hw, uint32_t handle);
+int cam_hw_cdm_hang_detect(struct cam_hw_info *cdm_hw, uint32_t handle);
+struct cam_cdm_bl_cb_request_entry *cam_cdm_find_request_by_bl_tag(
+	uint32_t tag, struct list_head *bl_list);
+void cam_cdm_notify_clients(struct cam_hw_info *cdm_hw,
+	enum cam_cdm_cb_status status, void *data);
+void cam_hw_cdm_dump_core_debug_registers(
+	struct cam_hw_info *cdm_hw, bool pause_core);
+
+#endif /* _CAM_CDM_CORE_COMMON_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_core.c
@@ -0,0 +1,2539 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include <media/cam_req_mgr.h>
+#include "cam_soc_util.h"
+#include "cam_smmu_api.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm.h"
+#include "cam_cdm_core_common.h"
+#include "cam_cdm_soc.h"
+#include "cam_io_util.h"
+#include "cam_cdm_hw_reg_1_0.h"
+#include "cam_cdm_hw_reg_1_1.h"
+#include "cam_cdm_hw_reg_1_2.h"
+#include "cam_cdm_hw_reg_2_0.h"
+#include "cam_cdm_hw_reg_2_1.h"
+#include "camera_main.h"
+#include "cam_trace.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+#define CAM_CDM_BL_FIFO_WAIT_TIMEOUT 2000
+#define CAM_CDM_DBG_GEN_IRQ_USR_DATA 0xff
+
+static void cam_hw_cdm_dump_scratch_registors(struct cam_hw_info *cdm_hw) __attribute__((unused));
+static void cam_hw_cdm_work(struct work_struct *work);
+
+/* DT match table entry for all CDM variants*/
+static const struct of_device_id msm_cam_hw_cdm_dt_match[] = {
+	{
+		.compatible = CAM_HW_CDM_CPAS_0_NAME,
+		.data = &cam_cdm_1_0_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_1_0,
+		.data = &cam_cdm_1_0_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_1_1,
+		.data = &cam_cdm_1_1_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_1_2,
+		.data = &cam_cdm_1_2_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_IFE_NAME_1_2,
+		.data = &cam_cdm_1_2_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_2_0,
+		.data = &cam_cdm_2_0_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_OPE_NAME_2_0,
+		.data = &cam_cdm_2_0_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_CPAS_NAME_2_1,
+		.data = &cam_cdm_2_1_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_RT_NAME_2_1,
+		.data = &cam_cdm_2_1_reg_offset,
+	},
+	{
+		.compatible = CAM_HW_CDM_OPE_NAME_2_1,
+		.data = &cam_cdm_2_1_reg_offset,
+	},
+	{},
+};
+
+static enum cam_cdm_id cam_hw_cdm_get_id_by_name(char *name)
+{
+	if (strnstr(name, CAM_HW_CDM_CPAS_0_NAME,
+			strlen(CAM_HW_CDM_CPAS_0_NAME)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_1_0,
+			strlen(CAM_HW_CDM_CPAS_NAME_1_0)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_1_1,
+			strlen(CAM_HW_CDM_CPAS_NAME_1_1)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_1_2,
+			strlen(CAM_HW_CDM_CPAS_NAME_1_2)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_IFE_NAME_1_2,
+			strlen(CAM_HW_CDM_IFE_NAME_1_2)))
+		return CAM_CDM_IFE;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_2_0,
+			strlen(CAM_HW_CDM_CPAS_NAME_2_0)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_OPE_NAME_2_0,
+			strlen(CAM_HW_CDM_OPE_NAME_2_0)))
+		return CAM_CDM_OPE;
+	if (strnstr(name, CAM_HW_CDM_CPAS_NAME_2_1,
+			strlen(CAM_HW_CDM_CPAS_NAME_2_1)))
+		return CAM_CDM_CPAS;
+	if (strnstr(name, CAM_HW_CDM_RT_NAME_2_1,
+			strlen(CAM_HW_CDM_RT_NAME_2_1)))
+		return CAM_CDM_RT;
+	if (strnstr(name, CAM_HW_CDM_OPE_NAME_2_1,
+			strlen(CAM_HW_CDM_OPE_NAME_2_1)))
+		return CAM_CDM_OPE;
+
+	return CAM_CDM_MAX;
+}
+
+static int cam_hw_cdm_enable_bl_done_irq(struct cam_hw_info *cdm_hw,
+	bool enable, uint32_t fifo_idx)
+{
+	int rc = -EIO;
+	uint32_t irq_mask = 0;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[fifo_idx]->irq_mask,
+			&irq_mask)) {
+		CAM_ERR(CAM_CDM, "Failed to read CDM IRQ mask");
+		return rc;
+	}
+
+	if (enable == true) {
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				core->offsets->irq_reg[fifo_idx]->irq_mask,
+				(irq_mask | 0x4))) {
+			CAM_ERR(CAM_CDM, "Write failed to enable BL done irq");
+		} else {
+			set_bit(fifo_idx, &core->cdm_status);
+			rc = 0;
+			CAM_DBG(CAM_CDM, "BL done irq enabled =%d",
+				test_bit(fifo_idx, &core->cdm_status));
+		}
+	} else {
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				core->offsets->irq_reg[fifo_idx]->irq_mask,
+				(irq_mask & 0x70003))) {
+			CAM_ERR(CAM_CDM, "Write failed to disable BL done irq");
+		} else {
+			clear_bit(fifo_idx, &core->cdm_status);
+			rc = 0;
+			CAM_DBG(CAM_CDM, "BL done irq disable =%d",
+				test_bit(fifo_idx, &core->cdm_status));
+		}
+	}
+	return rc;
+}
+
+static int cam_hw_cdm_pause_core(struct cam_hw_info *cdm_hw, bool pause)
+{
+	int rc = 0;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	uint32_t val = 0x1;
+
+	if (pause)
+		val |= 0x2;
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->core_en, val)) {
+		CAM_ERR(CAM_CDM, "Failed to Write core_en for %s%u",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		rc = -EIO;
+	}
+
+	return rc;
+}
+
+static int cam_hw_cdm_enable_core_dbg(struct cam_hw_info *cdm_hw, uint32_t value)
+{
+	int rc = 0;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->core_debug,
+			value)) {
+		CAM_ERR(CAM_CDM, "Failed to Write CDM HW core debug");
+		rc = -EIO;
+	}
+
+	return rc;
+}
+
+static int cam_hw_cdm_disable_core_dbg(struct cam_hw_info *cdm_hw)
+{
+	int rc = 0;
+	struct cam_cdm *cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->core_debug, 0)) {
+		CAM_ERR(CAM_CDM, "Failed to Write CDM HW core debug");
+		rc = -EIO;
+	}
+
+	return rc;
+}
+
+static void cam_hw_cdm_dump_scratch_registors(struct cam_hw_info *cdm_hw)
+{
+	uint32_t dump_reg = 0;
+	int i;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->core_en, &dump_reg);
+	CAM_ERR(CAM_CDM, "dump core en=%x", dump_reg);
+
+	for (i = 0; i < core->offsets->reg_data->num_scratch_reg; i++) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->scratch[i]->scratch_reg,
+			&dump_reg);
+		CAM_ERR(CAM_CDM, "dump scratch%d=%x", i, dump_reg);
+	}
+}
+
+static int cam_hw_cdm_bl_fifo_pending_bl_rb_in_fifo(
+	struct cam_hw_info *cdm_hw,
+	uint32_t fifo_idx,
+	uint32_t *pending_bl_req)
+{
+	int rc = 0;
+	uint32_t fifo_reg;
+	uint32_t fifo_id;
+
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (fifo_idx >= CAM_CDM_BL_FIFO_REG_NUM) {
+		CAM_ERR(CAM_CDM,
+			"BL_FIFO index is wrong. fifo_idx %d",
+			fifo_idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	fifo_reg = fifo_idx / 2;
+	fifo_id = fifo_idx % 2;
+
+	if (core->offsets->cmn_reg->pending_req[fifo_reg]) {
+		if (cam_cdm_read_hw_reg(cdm_hw,
+				core->offsets->cmn_reg->pending_req
+					[fifo_reg]->rb_offset,
+				pending_bl_req)) {
+			CAM_ERR(CAM_CDM, "Error reading CDM register");
+			rc = -EIO;
+			goto end;
+		}
+
+		*pending_bl_req = (*pending_bl_req >> (
+			core->offsets->cmn_reg->pending_req
+				[fifo_reg]->rb_next_fifo_shift *
+			fifo_id)) & core->offsets->cmn_reg->pending_req
+				[fifo_reg]->rb_mask;
+		rc = 0;
+	}
+
+	CAM_DBG(CAM_CDM, "pending_bl_req %d fifo_reg %d, fifo_id %d",
+			*pending_bl_req, fifo_reg, fifo_id);
+
+end:
+	return rc;
+}
+
+static void cam_hw_cdm_dump_bl_fifo_data(struct cam_hw_info *cdm_hw)
+{
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	int i, j;
+	uint32_t num_pending_req = 0, dump_reg;
+
+	for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++) {
+		cam_hw_cdm_bl_fifo_pending_bl_rb_in_fifo(cdm_hw,
+			i, &num_pending_req);
+		for (j = 0; j < num_pending_req ; j++) {
+			cam_cdm_write_hw_reg(cdm_hw,
+				core->offsets->cmn_reg->bl_fifo_rb, j);
+			cam_cdm_read_hw_reg(cdm_hw,
+				core->offsets->cmn_reg->bl_fifo_base_rb,
+				&dump_reg);
+			CAM_INFO(CAM_CDM, "BL(%d) base addr =%x", j, dump_reg);
+			cam_cdm_read_hw_reg(cdm_hw,
+				core->offsets->cmn_reg->bl_fifo_len_rb,
+				&dump_reg);
+			CAM_INFO(CAM_CDM,
+				"CDM HW current BL len=%d ARB %d tag=%d, ",
+				(dump_reg & CAM_CDM_CURRENT_BL_LEN),
+				(dump_reg & CAM_CDM_CURRENT_BL_ARB) >>
+					CAM_CDM_CURRENT_BL_ARB_SHIFT,
+				(dump_reg & CAM_CDM_CURRENT_BL_TAG) >>
+					CAM_CDM_CURRENT_BL_TAG_SHIFT);
+		}
+	}
+}
+
+void cam_hw_cdm_dump_core_debug_registers(struct cam_hw_info *cdm_hw,
+	bool pause_core)
+{
+	uint32_t dump_reg[4], core_dbg = 0x100;
+	int i;
+	bool is_core_paused_already;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	const struct cam_cdm_icl_regs *inv_cmd_log =
+		core->offsets->cmn_reg->icl_reg;
+
+	cam_cdm_read_hw_reg(cdm_hw, core->offsets->cmn_reg->core_en,
+		&dump_reg[0]);
+
+	if (pause_core) {
+		cam_hw_cdm_pause_core(cdm_hw, true);
+		usleep_range(1000, 1010);
+	}
+	cam_hw_cdm_enable_core_dbg(cdm_hw, core_dbg);
+
+	cam_cdm_read_hw_reg(cdm_hw, core->offsets->cmn_reg->usr_data,
+		&dump_reg[1]);
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->debug_status,
+		&dump_reg[2]);
+	CAM_INFO(CAM_CDM, "Dumping debug data for %s%u",
+		cdm_hw->soc_info.label_name, cdm_hw->soc_info.index);
+
+	CAM_INFO(CAM_CDM, "Core stat 0x%x udata 0x%x dbg_stat 0x%x",
+			dump_reg[0], dump_reg[1], dump_reg[2]);
+
+	if (core_dbg & 0x100) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->last_ahb_addr,
+			&dump_reg[0]);
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->last_ahb_data,
+			&dump_reg[1]);
+		CAM_INFO(CAM_CDM, "AHB dump lastaddr=0x%x lastdata=0x%x",
+			dump_reg[0], dump_reg[1]);
+	} else {
+		CAM_INFO(CAM_CDM, "CDM HW AHB dump not enable");
+	}
+
+	if (inv_cmd_log) {
+		if (inv_cmd_log->misc_regs) {
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->misc_regs->icl_status,
+				&dump_reg[0]);
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->misc_regs->icl_inv_bl_addr,
+				&dump_reg[1]);
+			CAM_INFO(CAM_CDM,
+				"Last Inv Cmd Log(ICL)Status: 0x%x bl_addr: 0x%x",
+				dump_reg[0], dump_reg[1]);
+		}
+		if (inv_cmd_log->data_regs) {
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->data_regs->icl_inv_data,
+				&dump_reg[0]);
+			CAM_INFO(CAM_CDM, "First word of Last Inv cmd: 0x%x",
+				dump_reg[0]);
+
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->data_regs->icl_last_data_0,
+				&dump_reg[0]);
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->data_regs->icl_last_data_1,
+				&dump_reg[1]);
+			cam_cdm_read_hw_reg(cdm_hw,
+				inv_cmd_log->data_regs->icl_last_data_2,
+				&dump_reg[2]);
+
+
+			CAM_INFO(CAM_CDM, "Last good cmd word 0x%x 0x%x 0x%x",
+					dump_reg[0], dump_reg[1], dump_reg[2]);
+		}
+	}
+
+	if (core_dbg & 0x10000) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->core_en, &dump_reg[0]);
+		is_core_paused_already = (bool)(dump_reg[0] & 0x20);
+		if (!is_core_paused_already) {
+			cam_hw_cdm_pause_core(cdm_hw, true);
+			usleep_range(1000, 1010);
+		}
+
+		cam_hw_cdm_dump_bl_fifo_data(cdm_hw);
+
+		if (!is_core_paused_already)
+			cam_hw_cdm_pause_core(cdm_hw, false);
+	}
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->core_cfg, &dump_reg[0]);
+	CAM_INFO(CAM_CDM, "CDM HW core cfg=0x%x", dump_reg[0]);
+
+	for (i = 0; i < core->offsets->reg_data->num_bl_fifo_irq; i++) {
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_status, &dump_reg[0]);
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_set, &dump_reg[1]);
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_mask, &dump_reg[2]);
+		cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_clear, &dump_reg[3]);
+
+		CAM_INFO(CAM_CDM,
+			"cnt %d irq status 0x%x set 0x%x mask 0x%x clear 0x%x",
+			i, dump_reg[0], dump_reg[1], dump_reg[2], dump_reg[3]);
+	}
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->current_bl_base, &dump_reg[0]);
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->current_used_ahb_base, &dump_reg[1]);
+	CAM_INFO(CAM_CDM, "curr BL base 0x%x AHB base 0x%x",
+		dump_reg[0], dump_reg[1]);
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->wait_status, &dump_reg[0]);
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->comp_wait[0]->comp_wait_status,
+		&dump_reg[1]);
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->comp_wait[1]->comp_wait_status,
+		&dump_reg[2]);
+	CAM_INFO(CAM_CDM, "wait status 0x%x comp wait status 0x%x: 0x%x",
+		dump_reg[0], dump_reg[1], dump_reg[2]);
+
+	cam_cdm_read_hw_reg(cdm_hw,
+		core->offsets->cmn_reg->current_bl_len, &dump_reg[0]);
+	CAM_INFO(CAM_CDM,
+		"CDM HW current BL len=%d ARB %d FIFO %d tag=%d, ",
+		(dump_reg[0] & CAM_CDM_CURRENT_BL_LEN),
+		(dump_reg[0] & CAM_CDM_CURRENT_BL_ARB) >>
+			CAM_CDM_CURRENT_BL_ARB_SHIFT,
+		(dump_reg[0] & CAM_CDM_CURRENT_BL_FIFO) >>
+			CAM_CDM_CURRENT_BL_FIFO_SHIFT,
+		(dump_reg[0] & CAM_CDM_CURRENT_BL_TAG) >>
+			CAM_CDM_CURRENT_BL_TAG_SHIFT);
+
+	cam_hw_cdm_disable_core_dbg(cdm_hw);
+	if (pause_core)
+		cam_hw_cdm_pause_core(cdm_hw, false);
+}
+
+static enum cam_cdm_arbitration cam_cdm_get_arbitration_type(
+		uint32_t cdm_version,
+		enum cam_cdm_id id)
+{
+	enum cam_cdm_arbitration arbitration;
+
+	if (cdm_version < CAM_CDM_VERSION_2_0) {
+		arbitration = CAM_CDM_ARBITRATION_NONE;
+		goto end;
+	}
+	switch (id) {
+	case CAM_CDM_CPAS:
+		arbitration = CAM_CDM_ARBITRATION_ROUND_ROBIN;
+		break;
+	default:
+		arbitration = CAM_CDM_ARBITRATION_PRIORITY_BASED;
+		break;
+	}
+end:
+	return arbitration;
+}
+
+static int cam_hw_cdm_set_cdm_blfifo_cfg(struct cam_hw_info *cdm_hw)
+{
+	int rc = 0, i;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	for (i = 0; i < core->offsets->reg_data->num_bl_fifo_irq; i++) {
+		if (!core->bl_fifo[i].bl_depth)
+			continue;
+
+		rc = cam_cdm_write_hw_reg(cdm_hw,
+			core->offsets->irq_reg[i]->irq_mask, 0x70003);
+		if (rc) {
+			CAM_ERR(CAM_CDM,
+				"Unable to write to %s%u irq mask register",
+				cdm_hw->soc_info.label_name,
+				cdm_hw->soc_info.index);
+			rc = -EIO;
+			goto end;
+		}
+	}
+
+	if (core->hw_version >= CAM_CDM_VERSION_2_0) {
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++) {
+			rc = cam_cdm_write_hw_reg(cdm_hw,
+				core->offsets->bl_fifo_reg[i]->bl_fifo_cfg,
+				core->bl_fifo[i].bl_depth
+				<< CAM_CDM_BL_FIFO_LENGTH_CFG_SHIFT);
+			if (rc) {
+				CAM_ERR(CAM_CDM,
+					"Unable to write to %s%u irq mask register",
+					cdm_hw->soc_info.label_name,
+					cdm_hw->soc_info.index);
+				rc = -EIO;
+				goto end;
+			}
+		}
+	}
+end:
+	return rc;
+}
+
+static int cam_hw_cdm_set_cdm_core_cfg(struct cam_hw_info *cdm_hw)
+{
+	uint32_t cdm_version;
+	uint32_t cfg_mask = 0;
+	int rc;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	struct cam_cdm_private_dt_data *pvt_data =
+		(struct cam_cdm_private_dt_data *)cdm_hw->soc_info.soc_private;
+
+	cfg_mask = cfg_mask |
+			CAM_CDM_AHB_STOP_ON_ERROR|
+			CAM_CDM_AHB_BURST_EN|
+			CAM_CDM_AHB_BURST_LEN_16;
+
+	/* use version from cdm_core structure. */
+	if (cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->cdm_hw_version,
+			&cdm_version)) {
+		CAM_ERR(CAM_CDM, "Error reading %s%u register",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		rc = -EIO;
+		goto end;
+	}
+
+	if (cdm_version >= CAM_CDM_VERSION_2_0) {
+		if (core->id != CAM_CDM_CPAS &&
+			(!pvt_data->is_single_ctx_cdm))
+			cfg_mask = cfg_mask | CAM_CDM_IMPLICIT_WAIT_EN;
+
+		if (core->arbitration == CAM_CDM_ARBITRATION_ROUND_ROBIN)
+			cfg_mask = cfg_mask | CAM_CDM_ARB_SEL_RR;
+
+	}
+
+	if (cdm_version >= CAM_CDM_VERSION_2_1) {
+		cfg_mask = cfg_mask | ((uint32_t)pvt_data->priority_group <<
+			core->offsets->cmn_reg->priority_group_bit_offset);
+	}
+
+	rc = cam_cdm_write_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->core_cfg, cfg_mask);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Error writing %s%u core cfg",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		rc = -EIO;
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_hw_cdm_wait_for_bl_fifo(
+		struct cam_hw_info *cdm_hw,
+		uint32_t            bl_count,
+		uint32_t            fifo_idx)
+{
+	uint32_t pending_bl = 0;
+	int32_t available_bl_slots = 0;
+	int rc = -EIO;
+	long time_left;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	struct cam_cdm_bl_fifo *bl_fifo = NULL;
+
+	if (fifo_idx >= CAM_CDM_BL_FIFO_MAX) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CDM,
+			"Invalid fifo index %d rc = %d",
+			fifo_idx, rc);
+		goto end;
+	}
+
+	bl_fifo = &core->bl_fifo[fifo_idx];
+
+	do {
+		if (cam_hw_cdm_bl_fifo_pending_bl_rb_in_fifo(
+				cdm_hw, fifo_idx, &pending_bl)) {
+			CAM_ERR(CAM_CDM, "Failed to read CDM pending BL's");
+			rc = -EIO;
+			break;
+		}
+		available_bl_slots = bl_fifo->bl_depth - pending_bl;
+		if (available_bl_slots < 0) {
+			CAM_ERR(CAM_CDM, "Invalid available slots %d:%d:%d",
+				available_bl_slots, bl_fifo->bl_depth,
+				pending_bl);
+			break;
+		}
+		if (0 == (available_bl_slots - 1)) {
+			reinit_completion(&core->bl_fifo[fifo_idx].bl_complete);
+
+			rc = cam_hw_cdm_enable_bl_done_irq(cdm_hw,
+				true, fifo_idx);
+			if (rc) {
+				CAM_ERR(CAM_CDM, "Enable BL done irq failed");
+				break;
+			}
+			time_left = wait_for_completion_timeout(
+				&core->bl_fifo[fifo_idx].bl_complete,
+				msecs_to_jiffies(
+				CAM_CDM_BL_FIFO_WAIT_TIMEOUT));
+			if (time_left <= 0) {
+				CAM_ERR(CAM_CDM,
+					"CDM HW BL Wait timed out failed");
+				if (cam_hw_cdm_enable_bl_done_irq(cdm_hw,
+					false, fifo_idx))
+					CAM_ERR(CAM_CDM,
+						"Disable BL done irq failed");
+				rc = -EIO;
+				break;
+			}
+			if (cam_hw_cdm_enable_bl_done_irq(cdm_hw,
+					false, fifo_idx))
+				CAM_ERR(CAM_CDM, "Disable BL done irq failed");
+			rc = 1;
+			CAM_DBG(CAM_CDM, "CDM HW is ready for data");
+		} else {
+			CAM_DBG(CAM_CDM,
+				"BL slot available_cnt=%d requested=%d",
+				(available_bl_slots - 1), bl_count);
+			rc = available_bl_slots - 1;
+			break;
+		}
+	} while (1);
+
+end:
+
+	return rc;
+}
+
+static bool cam_hw_cdm_bl_write(
+		struct cam_hw_info *cdm_hw, uint32_t src,
+		uint32_t len, uint32_t tag, bool set_arb,
+		uint32_t fifo_idx)
+{
+	struct cam_cdm *cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+		cdm_core->offsets->bl_fifo_reg[fifo_idx]->bl_fifo_base,
+		src)) {
+		CAM_ERR(CAM_CDM, "Failed to write CDM base to BL base");
+		return true;
+	}
+	if (cam_cdm_write_hw_reg(cdm_hw,
+		cdm_core->offsets->bl_fifo_reg[fifo_idx]->bl_fifo_len,
+		((len & 0xFFFFF) | ((tag & 0xFF) << 24)) |
+		((set_arb) ? (1 << 20) : (0)))) {
+		CAM_ERR(CAM_CDM, "Failed to write CDM BL len");
+		return true;
+	}
+	return false;
+}
+
+static bool cam_hw_cdm_commit_bl_write(struct cam_hw_info *cdm_hw, uint32_t fifo_idx)
+{
+	struct cam_cdm *cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+		cdm_core->offsets->bl_fifo_reg[fifo_idx]->bl_fifo_store,
+		1)) {
+		CAM_ERR(CAM_CDM, "Failed to write CDM commit BL");
+		return true;
+	}
+	return false;
+}
+
+static int cam_hw_cdm_submit_gen_irq(
+	struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	uint32_t fifo_idx, bool set_arb)
+{
+	struct cam_cdm_bl_cb_request_entry *node;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	uint32_t len;
+	int rc;
+	bool bit_wr_enable = false;
+
+	if (core->bl_fifo[fifo_idx].bl_tag >
+		(core->bl_fifo[fifo_idx].bl_depth - 1)) {
+		CAM_ERR(CAM_CDM,
+			"Invalid bl_tag=%d bl_depth=%d fifo_idx=%d",
+			core->bl_fifo[fifo_idx].bl_tag,
+			core->bl_fifo[fifo_idx].bl_depth,
+			fifo_idx);
+		rc = -EINVAL;
+		goto end;
+	}
+	CAM_DBG(CAM_CDM, "CDM write BL last cmd tag=%x total=%d cookie=%d",
+		core->bl_fifo[fifo_idx].bl_tag,
+		req->data->cmd_arrary_count,
+		req->data->cookie);
+
+	node = kzalloc(sizeof(struct cam_cdm_bl_cb_request_entry),
+			GFP_KERNEL);
+	if (!node) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	if (core->offsets->reg_data->num_bl_fifo > 1)
+		bit_wr_enable = true;
+
+	node->request_type = CAM_HW_CDM_BL_CB_CLIENT;
+	node->client_hdl = req->handle;
+	node->cookie = req->data->cookie;
+	node->bl_tag = core->bl_fifo[fifo_idx].bl_tag;
+	node->userdata = req->data->userdata;
+	list_add_tail(&node->entry, &core->bl_fifo[fifo_idx].bl_request_list);
+	len = core->ops->cdm_required_size_genirq() *
+		core->bl_fifo[fifo_idx].bl_tag;
+	core->ops->cdm_write_genirq(
+		((uint32_t *)core->gen_irq[fifo_idx].kmdvaddr + len),
+		core->bl_fifo[fifo_idx].bl_tag,
+		bit_wr_enable, fifo_idx);
+	rc = cam_hw_cdm_bl_write(cdm_hw,
+		(core->gen_irq[fifo_idx].vaddr + (4*len)),
+		((4 * core->ops->cdm_required_size_genirq()) - 1),
+		core->bl_fifo[fifo_idx].bl_tag,
+		set_arb, fifo_idx);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CDM hw bl write failed for gen irq bltag=%d",
+			core->bl_fifo[fifo_idx].bl_tag);
+		list_del_init(&node->entry);
+		kfree(node);
+		node = NULL;
+		rc = -EIO;
+		goto end;
+	}
+
+	if (cam_hw_cdm_commit_bl_write(cdm_hw, fifo_idx)) {
+		CAM_ERR(CAM_CDM,
+			"Cannot commit the genirq BL with tag tag=%d",
+			core->bl_fifo[fifo_idx].bl_tag);
+		list_del_init(&node->entry);
+		kfree(node);
+		node = NULL;
+		rc = -EIO;
+	}
+
+	trace_cam_log_event("CDM_START", "CDM_START_IRQ", req->data->cookie, 0);
+
+end:
+	return rc;
+}
+
+static int cam_hw_cdm_submit_debug_gen_irq(
+	struct cam_hw_info *cdm_hw,
+	uint32_t            fifo_idx)
+{
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	uint32_t len;
+	int rc;
+	bool bit_wr_enable = false;
+
+	CAM_DBG(CAM_CDM,
+		"CDM write BL last cmd tag=0x%x",
+		core->bl_fifo[fifo_idx].bl_tag);
+
+	if (core->offsets->reg_data->num_bl_fifo > 1)
+		bit_wr_enable = true;
+
+	len = core->ops->cdm_required_size_genirq() *
+		core->bl_fifo[fifo_idx].bl_tag;
+	core->ops->cdm_write_genirq(
+		((uint32_t *)core->gen_irq[fifo_idx].kmdvaddr + len),
+		CAM_CDM_DBG_GEN_IRQ_USR_DATA, bit_wr_enable, fifo_idx);
+	rc = cam_hw_cdm_bl_write(cdm_hw,
+		(core->gen_irq[fifo_idx].vaddr + (4*len)),
+		((4 * core->ops->cdm_required_size_genirq()) - 1),
+		core->bl_fifo[fifo_idx].bl_tag,
+		false, fifo_idx);
+	if (rc) {
+		CAM_ERR(CAM_CDM,
+			"CDM hw bl write failed for dbggenirq USRdata=%d tag 0x%x",
+			CAM_CDM_DBG_GEN_IRQ_USR_DATA,
+			core->bl_fifo[fifo_idx].bl_tag);
+		rc = -EIO;
+		goto end;
+	}
+	if (cam_hw_cdm_commit_bl_write(cdm_hw, fifo_idx)) {
+		CAM_ERR(CAM_CDM,
+			"Cannot commit the dbggenirq BL with tag tag=0x%x",
+			core->bl_fifo[fifo_idx].bl_tag);
+		rc = -EIO;
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_hw_cdm_arb_submit_bl(struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req, int i,
+	uint32_t fifo_idx, dma_addr_t hw_vaddr_ptr)
+{
+	struct cam_cdm_bl_request *cdm_cmd = req->data;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	uintptr_t cpu_addr;
+	struct cam_cdm_bl_cb_request_entry *node;
+	int rc = 0;
+	size_t len = 0;
+
+	node = kzalloc(sizeof(
+		struct cam_cdm_bl_cb_request_entry),
+		GFP_KERNEL);
+	if (!node)
+		return -ENOMEM;
+
+	node->request_type = CAM_HW_CDM_BL_CB_CLIENT;
+	node->client_hdl = req->handle;
+	node->cookie = req->data->cookie;
+	node->bl_tag = core->bl_fifo[fifo_idx].bl_tag -
+		1;
+	node->userdata = req->data->userdata;
+	list_add_tail(&node->entry,
+		&core->bl_fifo[fifo_idx]
+		.bl_request_list);
+	cdm_cmd->cmd[i].arbitrate = true;
+	rc = cam_mem_get_cpu_buf(
+		cdm_cmd->cmd[i].bl_addr.mem_handle,
+		&cpu_addr, &len);
+	if (rc || !cpu_addr) {
+		CAM_ERR(CAM_OPE, "get cmd buffailed %x",
+			cdm_cmd->cmd[i].bl_addr
+			.mem_handle);
+		return rc;
+	}
+	core->ops->cdm_write_genirq(
+		((uint32_t *)cpu_addr +
+		cdm_cmd->cmd[i].offset / 4 +
+		cdm_cmd->cmd[i].len / 4),
+		core->bl_fifo[fifo_idx].bl_tag - 1,
+		1, fifo_idx);
+	rc = cam_hw_cdm_bl_write(cdm_hw,
+		(uint32_t)hw_vaddr_ptr +
+		cdm_cmd->cmd[i].offset,
+		cdm_cmd->cmd[i].len + 7,
+		core->bl_fifo[fifo_idx].bl_tag - 1,
+		1, fifo_idx);
+	if (rc) {
+		CAM_ERR(CAM_CDM,
+			"CDM hw bl write failed tag=%d",
+			core->bl_fifo[fifo_idx].bl_tag -
+			1);
+			cam_mem_put_cpu_buf(cdm_cmd->cmd[i].bl_addr.mem_handle);
+			list_del_init(&node->entry);
+			kfree(node);
+			return -EIO;
+	}
+	rc = cam_hw_cdm_commit_bl_write(cdm_hw,
+		fifo_idx);
+	if (rc) {
+		CAM_ERR(CAM_CDM,
+			"CDM hw commit failed tag=%d",
+			core->bl_fifo[fifo_idx].bl_tag -
+			1);
+			cam_mem_put_cpu_buf(cdm_cmd->cmd[i].bl_addr.mem_handle);
+			list_del_init(&node->entry);
+			kfree(node);
+			return -EIO;
+	}
+	cam_mem_put_cpu_buf(cdm_cmd->cmd[i].bl_addr.mem_handle);
+	return 0;
+}
+
+int cam_hw_cdm_submit_bl(struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	struct cam_cdm_client *client)
+{
+	int i, rc;
+	struct cam_cdm_bl_request *cdm_cmd = req->data;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	struct cam_cdm_bl_fifo *bl_fifo = NULL;
+	uint32_t pending_bl = 0, fifo_idx = 0;
+	int write_count = 0;
+
+	fifo_idx = CAM_CDM_GET_BLFIFO_IDX(client->handle);
+
+	CAM_DBG(CAM_CDM, "Submit bl to %s%u", cdm_hw->soc_info.label_name,
+		cdm_hw->soc_info.index);
+	if (fifo_idx >= CAM_CDM_BL_FIFO_MAX) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CDM, "Invalid handle 0x%x, rc = %d",
+			client->handle, rc);
+		goto end;
+	}
+
+	bl_fifo = &core->bl_fifo[fifo_idx];
+
+	if (req->data->cmd_arrary_count > bl_fifo->bl_depth) {
+		CAM_INFO(CAM_CDM,
+			"requested BL more than max size, cnt=%d max=%d",
+			req->data->cmd_arrary_count,
+			bl_fifo->bl_depth);
+	}
+
+
+	mutex_lock(&core->bl_fifo[fifo_idx].fifo_lock);
+	mutex_lock(&client->lock);
+
+	if (test_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status) ||
+			test_bit(CAM_CDM_RESET_HW_STATUS, &core->cdm_status)) {
+		mutex_unlock(&client->lock);
+		mutex_unlock(&core->bl_fifo[fifo_idx].fifo_lock);
+		return -EAGAIN;
+	}
+
+	rc = cam_hw_cdm_bl_fifo_pending_bl_rb_in_fifo(cdm_hw,
+		fifo_idx, &pending_bl);
+
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Cannot read the current BL depth");
+		mutex_unlock(&client->lock);
+		mutex_unlock(&core->bl_fifo[fifo_idx].fifo_lock);
+		return rc;
+	}
+
+	for (i = 0; i < req->data->cmd_arrary_count ; i++) {
+		dma_addr_t hw_vaddr_ptr = 0;
+		size_t len = 0;
+
+		if ((!cdm_cmd->cmd_flex[i].len) &&
+			(cdm_cmd->cmd_flex[i].len > 0x100000)) {
+			CAM_ERR(CAM_CDM,
+				"cmd len(%d) is invalid cnt=%d total cnt=%d",
+				cdm_cmd->cmd_flex[i].len, i,
+				req->data->cmd_arrary_count);
+			rc = -EINVAL;
+			break;
+		}
+		if (test_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status) ||
+				test_bit(CAM_CDM_RESET_HW_STATUS,
+					&core->cdm_status)) {
+			CAM_ERR_RATE_LIMIT(CAM_CDM,
+				"In error/reset state cnt=%d total cnt=%d cdm_status 0x%lx",
+				i, req->data->cmd_arrary_count,
+				core->cdm_status);
+			rc = -EAGAIN;
+			break;
+		}
+		if (write_count == 0) {
+			write_count = cam_hw_cdm_wait_for_bl_fifo(cdm_hw,
+				(req->data->cmd_arrary_count - i), fifo_idx);
+			if (write_count < 0) {
+				CAM_ERR(CAM_CDM,
+					"wait for bl fifo failed %d:%d",
+					i, req->data->cmd_arrary_count);
+				rc = -EIO;
+				break;
+			}
+		}
+
+		if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE) {
+			rc = cam_mem_get_io_buf(
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle,
+				core->iommu_hdl.non_secure, &hw_vaddr_ptr,
+				&len);
+		} else if (req->data->type == CAM_CDM_BL_CMD_TYPE_HW_IOVA) {
+			if (!cdm_cmd->cmd_flex[i].bl_addr.hw_iova) {
+				CAM_ERR(CAM_CDM,
+					"Hw bl hw_iova is invalid %d:%d",
+					i, req->data->cmd_arrary_count);
+				rc = -EINVAL;
+				break;
+			}
+			rc = 0;
+			hw_vaddr_ptr =
+				(uint64_t)cdm_cmd->cmd_flex[i].bl_addr.hw_iova;
+			len = cdm_cmd->cmd_flex[i].len + cdm_cmd->cmd_flex[i].offset;
+		} else {
+			CAM_ERR(CAM_CDM,
+				"Only mem hdl/hw va type is supported %d",
+				req->data->type);
+			rc = -EINVAL;
+			break;
+		}
+
+		if ((!rc) && (hw_vaddr_ptr) && (len) &&
+			(len >= cdm_cmd->cmd_flex[i].offset)) {
+
+			if ((len - cdm_cmd->cmd_flex[i].offset) <
+				cdm_cmd->cmd_flex[i].len) {
+				CAM_ERR(CAM_CDM,
+					"Not enough buffer cmd offset: %u cmd length: %u",
+					cdm_cmd->cmd_flex[i].offset,
+					cdm_cmd->cmd_flex[i].len);
+				rc = -EINVAL;
+				break;
+			}
+
+			CAM_DBG(CAM_CDM, "Got the HW VA");
+			if (core->bl_fifo[fifo_idx].bl_tag >=
+				(bl_fifo->bl_depth - 1))
+				core->bl_fifo[fifo_idx].bl_tag = 0;
+			if (core->arbitration ==
+				CAM_CDM_ARBITRATION_PRIORITY_BASED &&
+				(req->data->flag == true) &&
+				(i == (req->data->cmd_arrary_count -
+				1))) {
+				CAM_DBG(CAM_CDM,
+					"GenIRQ in same bl, will sumbit later");
+			} else {
+				rc = cam_hw_cdm_bl_write(cdm_hw,
+					((uint32_t)hw_vaddr_ptr +
+						cdm_cmd->cmd_flex[i].offset),
+					(cdm_cmd->cmd_flex[i].len - 1),
+					core->bl_fifo[fifo_idx].bl_tag,
+					cdm_cmd->cmd_flex[i].arbitrate,
+					fifo_idx);
+				if (rc) {
+					CAM_ERR(CAM_CDM,
+						"Hw bl write failed %d:%d",
+						i, req->data->cmd_arrary_count);
+					rc = -EIO;
+					break;
+				}
+			}
+		} else {
+			CAM_ERR(CAM_CDM,
+				"Sanity check failed for hdl=%x len=%zu:%d",
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle, len,
+				cdm_cmd->cmd_flex[i].offset);
+			CAM_ERR(CAM_CDM, "Sanity check failed for %d:%d",
+				i, req->data->cmd_arrary_count);
+			rc = -EINVAL;
+			break;
+		}
+
+		if (!rc) {
+			CAM_DBG(CAM_CDM,
+				"write BL done cnt=%d with tag=%d total_cnt=%d",
+				i, core->bl_fifo[fifo_idx].bl_tag,
+				req->data->cmd_arrary_count);
+
+			if (core->arbitration ==
+				CAM_CDM_ARBITRATION_PRIORITY_BASED &&
+				(req->data->flag == true) &&
+				(i == (req->data->cmd_arrary_count -
+				1))) {
+				CAM_DBG(CAM_CDM,
+					"GenIRQ in same blcommit later");
+			} else {
+				CAM_DBG(CAM_CDM, "Now commit the BL");
+				if (cam_hw_cdm_commit_bl_write(cdm_hw,
+					fifo_idx)) {
+					CAM_ERR(CAM_CDM,
+						"commit failed BL %d tag=%d",
+						i, core->bl_fifo[fifo_idx]
+						.bl_tag);
+					rc = -EIO;
+					break;
+				}
+				write_count--;
+				CAM_DBG(CAM_CDM, "commit success BL %d tag=%d",
+					i, core->bl_fifo[fifo_idx].bl_tag);
+			}
+			core->bl_fifo[fifo_idx].bl_tag++;
+
+			if (cdm_cmd->cmd_flex[i].enable_debug_gen_irq) {
+				if (write_count == 0) {
+					write_count =
+						cam_hw_cdm_wait_for_bl_fifo(
+						cdm_hw, 1, fifo_idx);
+					if (write_count < 0) {
+						CAM_ERR(CAM_CDM,
+						"wait for bl fifo failed %d:%d",
+						i, req->data->cmd_arrary_count);
+						rc = -EIO;
+						break;
+					}
+				}
+
+				rc = cam_hw_cdm_submit_debug_gen_irq(cdm_hw,
+					fifo_idx);
+				if (rc == 0) {
+					write_count--;
+					core->bl_fifo[fifo_idx].bl_tag++;
+				}
+				if (core->bl_fifo[fifo_idx].bl_tag >=
+						(bl_fifo->bl_depth -
+						1))
+					core->bl_fifo[fifo_idx].bl_tag = 0;
+			}
+
+			if ((!rc) && (req->data->flag == true) &&
+				(i == (req->data->cmd_arrary_count -
+				1))) {
+
+				if (write_count == 0) {
+					write_count =
+						cam_hw_cdm_wait_for_bl_fifo(
+						cdm_hw, 1, fifo_idx);
+					if (write_count < 0) {
+						CAM_ERR(CAM_CDM,
+						"wait for bl fifo failed %d:%d",
+						i, req->data->cmd_arrary_count);
+						rc = -EIO;
+						break;
+					}
+				}
+
+				if (core->arbitration !=
+					CAM_CDM_ARBITRATION_PRIORITY_BASED) {
+
+					rc = cam_hw_cdm_submit_gen_irq(
+						cdm_hw, req, fifo_idx,
+						cdm_cmd->gen_irq_arb);
+					if (rc == 0)
+						core->bl_fifo[fifo_idx]
+						.bl_tag++;
+					break;
+				}
+
+				rc = cam_hw_cdm_arb_submit_bl(cdm_hw, req, i,
+					fifo_idx, hw_vaddr_ptr);
+				if (rc)
+					break;
+			}
+		}
+	}
+	mutex_unlock(&client->lock);
+	mutex_unlock(&core->bl_fifo[fifo_idx].fifo_lock);
+
+end:
+	return rc;
+
+}
+
+static void cam_hw_cdm_reset_cleanup(
+	struct cam_hw_info *cdm_hw,
+	uint32_t            handle)
+{
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+	int i;
+	struct cam_cdm_bl_cb_request_entry *node, *tnode;
+	bool flush_hw = false;
+	bool reset_err = false;
+
+	if (test_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status) ||
+		test_bit(CAM_CDM_FLUSH_HW_STATUS, &core->cdm_status))
+		flush_hw = true;
+
+	if (test_bit(CAM_CDM_RESET_ERR_STATUS, &core->cdm_status))
+		reset_err = true;
+
+	for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++) {
+		list_for_each_entry_safe(node, tnode,
+			&core->bl_fifo[i].bl_request_list, entry) {
+			if (node->request_type ==
+					CAM_HW_CDM_BL_CB_CLIENT) {
+				CAM_DBG(CAM_CDM,
+					"Notifying client %d for tag %d",
+					node->client_hdl, node->bl_tag);
+				if (flush_hw) {
+					enum cam_cdm_cb_status status;
+
+					status = reset_err ?
+						CAM_CDM_CB_STATUS_HW_ERROR :
+						CAM_CDM_CB_STATUS_HW_RESUBMIT;
+
+					cam_cdm_notify_clients(cdm_hw,
+						(node->client_hdl == handle) ?
+						CAM_CDM_CB_STATUS_HW_FLUSH :
+						status,
+						(void *)node);
+				}
+				else
+					cam_cdm_notify_clients(cdm_hw,
+						CAM_CDM_CB_STATUS_HW_RESET_DONE,
+						(void *)node);
+			}
+			list_del_init(&node->entry);
+			kfree(node);
+			node = NULL;
+		}
+		core->bl_fifo[i].bl_tag = 0;
+		core->bl_fifo[i].last_bl_tag_done = -1;
+		atomic_set(&core->bl_fifo[i].work_record, 0);
+	}
+}
+
+static void cam_hw_cdm_work(struct work_struct *work)
+{
+	struct cam_cdm_work_payload *payload;
+	struct cam_hw_info *cdm_hw;
+	struct cam_cdm *core;
+	int i, fifo_idx;
+	struct cam_cdm_bl_cb_request_entry *tnode = NULL;
+	struct cam_cdm_bl_cb_request_entry *node = NULL;
+
+	payload = container_of(work, struct cam_cdm_work_payload, work);
+	if (!payload) {
+		CAM_ERR(CAM_CDM, "NULL payload");
+		return;
+	}
+
+	cdm_hw = payload->hw;
+	core = (struct cam_cdm *)cdm_hw->core_info;
+	fifo_idx = payload->fifo_idx;
+	if (fifo_idx >= core->offsets->reg_data->num_bl_fifo) {
+		CAM_ERR(CAM_CDM, "Invalid fifo idx %d",
+			fifo_idx);
+		kfree(payload);
+		payload = NULL;
+		return;
+	}
+
+	cam_common_util_thread_switch_delay_detect(
+		"CDM workq schedule",
+		payload->workq_scheduled_ts,
+		CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+
+	CAM_DBG(CAM_CDM, "IRQ status=0x%x", payload->irq_status);
+	if (payload->irq_status &
+		CAM_CDM_IRQ_STATUS_INLINE_IRQ_MASK) {
+		CAM_DBG(CAM_CDM, "inline IRQ data=0x%x last tag: 0x%x",
+			payload->irq_data,
+			core->bl_fifo[payload->fifo_idx]
+				.last_bl_tag_done);
+
+		if (payload->irq_data == 0xff) {
+			CAM_INFO(CAM_CDM, "%s%u Debug genirq received",
+				cdm_hw->soc_info.label_name,
+				cdm_hw->soc_info.index);
+			kfree(payload);
+			payload = NULL;
+			return;
+		}
+
+		mutex_lock(&cdm_hw->hw_mutex);
+		mutex_lock(&core->bl_fifo[fifo_idx].fifo_lock);
+
+		if (atomic_read(&core->bl_fifo[fifo_idx].work_record))
+			atomic_dec(&core->bl_fifo[fifo_idx].work_record);
+
+		if (list_empty(&core->bl_fifo[fifo_idx]
+				.bl_request_list)) {
+			CAM_INFO(CAM_CDM,
+				"Fifo list empty, idx %d tag %d arb %d",
+				fifo_idx, payload->irq_data,
+				core->arbitration);
+			mutex_unlock(&core->bl_fifo[fifo_idx]
+					.fifo_lock);
+			mutex_unlock(&cdm_hw->hw_mutex);
+			return;
+		}
+
+		if (core->bl_fifo[fifo_idx].last_bl_tag_done !=
+			payload->irq_data) {
+			core->bl_fifo[fifo_idx].last_bl_tag_done =
+				payload->irq_data;
+			list_for_each_entry_safe(node, tnode,
+				&core->bl_fifo[fifo_idx].bl_request_list,
+				entry) {
+				if ((node->bl_tag <= payload->irq_data) ||
+					((node->bl_tag - payload->irq_data) >
+					CAM_CDM_BL_FIFO_BOUNDARY_CHECK)) {
+					if (node->request_type ==
+						CAM_HW_CDM_BL_CB_CLIENT) {
+						cam_cdm_notify_clients(cdm_hw,
+						CAM_CDM_CB_STATUS_BL_SUCCESS,
+						(void *)node);
+					} else if (node->request_type ==
+						CAM_HW_CDM_BL_CB_INTERNAL) {
+						CAM_ERR(CAM_CDM,
+							"Invalid node=%pK %d",
+							node,
+							node->request_type);
+					}
+					list_del_init(&node->entry);
+					if (node->bl_tag == payload->irq_data) {
+						kfree(node);
+						node = NULL;
+						break;
+					}
+					kfree(node);
+					node = NULL;
+				}
+			}
+		} else {
+			CAM_INFO(CAM_CDM,
+				"Skip GenIRQ, tag 0x%x fifo %d",
+				payload->irq_data, payload->fifo_idx);
+		}
+		mutex_unlock(&core->bl_fifo[payload->fifo_idx]
+			.fifo_lock);
+		mutex_unlock(&cdm_hw->hw_mutex);
+	}
+
+	if (payload->irq_status &
+		CAM_CDM_IRQ_STATUS_BL_DONE_MASK) {
+		if (test_bit(payload->fifo_idx, &core->cdm_status)) {
+			CAM_DBG(CAM_CDM, "%s%u HW BL done IRQ",
+				cdm_hw->soc_info.label_name,
+				cdm_hw->soc_info.index);
+			complete(&core->bl_fifo[payload->fifo_idx]
+				.bl_complete);
+		}
+	}
+	if (payload->irq_status &
+		CAM_CDM_IRQ_STATUS_ERRORS) {
+		int reset_hw_hdl = 0x0;
+
+		CAM_ERR_RATE_LIMIT(CAM_CDM,
+			"%s%u Error IRQ status %d\n",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index, payload->irq_status);
+		set_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status);
+		mutex_lock(&cdm_hw->hw_mutex);
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo;
+				i++)
+			mutex_lock(&core->bl_fifo[i].fifo_lock);
+		/*
+		 * First pause CDM, If it fails still proceed
+		 * to dump debug info
+		 */
+		cam_hw_cdm_pause_core(cdm_hw, true);
+		cam_hw_cdm_dump_core_debug_registers(cdm_hw, true);
+
+		if (payload->irq_status &
+		CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK) {
+			node = list_first_entry_or_null(
+			&core->bl_fifo[payload->fifo_idx].bl_request_list,
+			struct cam_cdm_bl_cb_request_entry, entry);
+
+			if (node != NULL) {
+				if (node->request_type ==
+					CAM_HW_CDM_BL_CB_CLIENT) {
+					cam_cdm_notify_clients(cdm_hw,
+					CAM_CDM_CB_STATUS_INVALID_BL_CMD,
+						(void *)node);
+				} else if (node->request_type ==
+					CAM_HW_CDM_BL_CB_INTERNAL) {
+					CAM_ERR(CAM_CDM,
+						"Invalid node=%pK %d", node,
+						node->request_type);
+				}
+				list_del_init(&node->entry);
+				kfree(node);
+			}
+		}
+		/* Resume CDM back */
+		cam_hw_cdm_pause_core(cdm_hw, false);
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo;
+				i++)
+			mutex_unlock(&core->bl_fifo[i].fifo_lock);
+
+		if (payload->irq_status &
+			CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK)
+			cam_hw_cdm_reset_hw(cdm_hw, reset_hw_hdl);
+
+		mutex_unlock(&cdm_hw->hw_mutex);
+		if (!(payload->irq_status &
+				CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK))
+			clear_bit(CAM_CDM_ERROR_HW_STATUS,
+				&core->cdm_status);
+	}
+	kfree(payload);
+	payload = NULL;
+
+}
+
+static void cam_hw_cdm_iommu_fault_handler(struct cam_smmu_pf_info *pf_info)
+{
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_cdm *core = NULL;
+	struct cam_cdm_pid_mid_data *pid_mid_info = NULL;
+	int i;
+
+	if (pf_info->token) {
+		cdm_hw = (struct cam_hw_info *)pf_info->token;
+		core = (struct cam_cdm *)cdm_hw->core_info;
+		pid_mid_info = core->offsets->cmn_reg->cdm_pid_mid_info;
+		CAM_ERR_RATE_LIMIT(CAM_CDM, "Page fault iova addr %pK\n",
+			(void *)pf_info->iova);
+
+		if (pid_mid_info) {
+			/*
+			 * If its CDM or OPE CDM then only handle the pf for CDM
+			 * else return.
+			 */
+			if (((pf_info->pid == pid_mid_info->cdm_pid) &&
+				(pf_info->mid == pid_mid_info->cdm_mid)) ||
+				((pf_info->pid == pid_mid_info->ope_cdm_pid) &&
+				(pf_info->mid == pid_mid_info->ope_cdm_mid)))
+				goto handle_cdm_pf;
+			else
+				return;
+		}
+
+handle_cdm_pf:
+		set_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status);
+		mutex_lock(&cdm_hw->hw_mutex);
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++)
+			mutex_lock(&core->bl_fifo[i].fifo_lock);
+		if (cdm_hw->hw_state == CAM_HW_STATE_POWER_UP) {
+			cam_hw_cdm_dump_core_debug_registers(cdm_hw, true);
+		} else
+			CAM_INFO(CAM_CDM, "%s%u hw is power in off state",
+				cdm_hw->soc_info.label_name,
+				cdm_hw->soc_info.index);
+		for (i = 0; i < core->offsets->reg_data->num_bl_fifo; i++)
+			mutex_unlock(&core->bl_fifo[i].fifo_lock);
+		cam_cdm_notify_clients(cdm_hw, CAM_CDM_CB_STATUS_PAGEFAULT,
+			(void *)pf_info->iova);
+		mutex_unlock(&cdm_hw->hw_mutex);
+		clear_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status);
+	} else {
+		CAM_ERR(CAM_CDM, "Invalid token");
+	}
+}
+
+static irqreturn_t cam_hw_cdm_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *cdm_hw = data;
+	struct cam_hw_soc_info *soc_info = &cdm_hw->soc_info;
+	struct cam_cdm *cdm_core = cdm_hw->core_info;
+	struct cam_cdm_work_payload *payload[CAM_CDM_BL_FIFO_MAX] = {0};
+	uint8_t rst_done_cnt = 0;
+	uint32_t user_data = 0;
+	uint32_t irq_status[CAM_CDM_BL_FIFO_MAX] = {0};
+	uint32_t irq_context_summary = 0xF;
+	bool work_status;
+	int i;
+
+	CAM_DBG(CAM_CDM, "Got irq hw_version 0x%x from %s%u",
+		cdm_core->hw_version, soc_info->label_name,
+		soc_info->index);
+	spin_lock(&cdm_hw->hw_lock);
+	if (cdm_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_DBG(CAM_CDM, "CDM is in power down state");
+		spin_unlock(&cdm_hw->hw_lock);
+		return IRQ_HANDLED;
+	}
+	if (cdm_core->hw_version >= CAM_CDM_VERSION_2_1) {
+		if (cam_cdm_read_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->irq_context_status,
+			&irq_context_summary)) {
+			CAM_ERR(CAM_CDM, "Failed to read CDM HW IRQ status");
+		}
+	}
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo_irq; i++) {
+		if (!(BIT(i) & irq_context_summary)) {
+			continue;
+		}
+		if (cam_cdm_read_hw_reg(cdm_hw,
+			cdm_core->offsets->irq_reg[i]->irq_status,
+			&irq_status[i])) {
+			CAM_ERR(CAM_CDM, "Failed to read %s%u HW IRQ status",
+				soc_info->label_name,
+				soc_info->index);
+		}
+		if (cam_cdm_write_hw_reg(cdm_hw,
+			cdm_core->offsets->irq_reg[i]->irq_clear,
+			irq_status[i])) {
+			CAM_ERR(CAM_CDM, "Failed to Write %s%u HW IRQ Clear",
+				soc_info->label_name,
+				soc_info->index);
+		}
+	}
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+		cdm_core->offsets->irq_reg[0]->irq_clear_cmd, 0x01))
+		CAM_ERR(CAM_CDM, "Failed to Write %s%u HW IRQ clr cmd",
+				soc_info->label_name,
+				soc_info->index);
+	if (cam_cdm_read_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->usr_data,
+			&user_data))
+		CAM_ERR(CAM_CDM, "Failed to read %s%u HW IRQ data",
+				soc_info->label_name,
+				soc_info->index);
+	spin_unlock(&cdm_hw->hw_lock);
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo_irq; i++) {
+		if (!irq_status[i])
+			continue;
+
+		if (irq_status[i] & CAM_CDM_IRQ_STATUS_RST_DONE_MASK) {
+			rst_done_cnt++;
+			continue;
+		}
+
+		payload[i] = kzalloc(sizeof(struct cam_cdm_work_payload),
+			GFP_ATOMIC);
+
+		if (!payload[i]) {
+			CAM_ERR(CAM_CDM,
+				"failed to allocate memory for fifo %d payload",
+				i);
+			continue;
+		}
+
+		if (irq_status[i] & CAM_CDM_IRQ_STATUS_INLINE_IRQ_MASK) {
+
+			payload[i]->irq_data = (user_data >> (i * 0x8)) &
+				CAM_CDM_IRQ_STATUS_USR_DATA_MASK;
+
+			if (payload[i]->irq_data ==
+				CAM_CDM_DBG_GEN_IRQ_USR_DATA)
+				CAM_INFO(CAM_CDM, "Debug gen_irq received");
+
+			atomic_inc(&cdm_core->bl_fifo[i].work_record);
+		}
+
+		CAM_DBG(CAM_CDM,
+			"Rcvd of fifo %d userdata 0x%x tag 0x%x irq_stat 0x%x",
+			i, user_data, payload[i]->irq_data, irq_status[i]);
+
+		payload[i]->fifo_idx = i;
+		payload[i]->irq_status = irq_status[i];
+		payload[i]->hw = cdm_hw;
+
+		INIT_WORK((struct work_struct *)&payload[i]->work,
+			cam_hw_cdm_work);
+
+		trace_cam_log_event("CDM_DONE", "CDM_DONE_IRQ",
+			payload[i]->irq_status,
+			cdm_hw->soc_info.index);
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				cdm_core->offsets->irq_reg[i]->irq_clear,
+				payload[i]->irq_status)) {
+			CAM_ERR(CAM_CDM, "Failed to Write %s%u HW IRQ Clear",
+				soc_info->label_name,
+				soc_info->index);
+			kfree(payload[i]);
+			return IRQ_HANDLED;
+		}
+
+		payload[i]->workq_scheduled_ts = ktime_get();
+
+		work_status = queue_work(
+			cdm_core->bl_fifo[i].work_queue,
+			&payload[i]->work);
+
+		if (work_status == false) {
+			CAM_ERR(CAM_CDM,
+				"Failed to queue work for FIFO: %d irq=0x%x",
+				i, payload[i]->irq_status);
+			kfree(payload[i]);
+			payload[i] = NULL;
+		}
+	}
+	if (rst_done_cnt == cdm_core->offsets->reg_data->num_bl_fifo_irq) {
+		CAM_DBG(CAM_CDM, "%s%u HW reset done IRQ",
+			soc_info->label_name,
+			soc_info->index);
+		complete(&cdm_core->reset_complete);
+	}
+	if (rst_done_cnt &&
+		(rst_done_cnt != cdm_core->offsets->reg_data->num_bl_fifo_irq))
+		CAM_INFO(CAM_CDM,
+			"%s%u Reset IRQ received for %d fifos instead of %d",
+			soc_info->label_name,
+			soc_info->index, rst_done_cnt,
+			cdm_core->offsets->reg_data->num_bl_fifo_irq);
+	return IRQ_HANDLED;
+}
+
+int cam_hw_cdm_alloc_genirq_mem(void *hw_priv)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_mem_mgr_request_desc genirq_alloc_cmd;
+	struct cam_mem_mgr_memory_desc genirq_alloc_out;
+	struct cam_cdm *cdm_core = NULL;
+	int rc = -EINVAL, i;
+
+	if (!hw_priv)
+		return rc;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+	genirq_alloc_cmd.align = 0;
+	genirq_alloc_cmd.smmu_hdl = cdm_core->iommu_hdl.non_secure;
+	genirq_alloc_cmd.flags = CAM_MEM_FLAG_HW_READ_WRITE;
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		if (!cdm_core->bl_fifo[i].bl_depth)
+			continue;
+
+		genirq_alloc_cmd.size = (8 *
+				cdm_core->bl_fifo[i].bl_depth);
+		rc = cam_mem_mgr_request_mem(&genirq_alloc_cmd,
+				&genirq_alloc_out);
+		if (rc) {
+			CAM_ERR(CAM_CDM,
+				"Failed to get genirq cmd space rc=%d",
+				rc);
+			goto end;
+		}
+		cdm_core->gen_irq[i].handle = genirq_alloc_out.mem_handle;
+		cdm_core->gen_irq[i].vaddr = (genirq_alloc_out.iova &
+			0xFFFFFFFF);
+		cdm_core->gen_irq[i].kmdvaddr = genirq_alloc_out.kva;
+		cdm_core->gen_irq[i].size = genirq_alloc_out.len;
+	}
+end:
+	return rc;
+}
+
+int cam_hw_cdm_release_genirq_mem(void *hw_priv)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_mem_mgr_memory_desc genirq_release_cmd;
+	int rc = -EINVAL, i;
+
+	if (!hw_priv)
+		return rc;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		genirq_release_cmd.mem_handle = cdm_core->gen_irq[i].handle;
+		rc = cam_mem_mgr_release_mem(&genirq_release_cmd);
+		if (rc)
+			CAM_ERR(CAM_CDM,
+				"Failed to put genirq cmd space for hw rc %d",
+				rc);
+	}
+
+	return rc;
+}
+
+int cam_hw_cdm_reset_hw(struct cam_hw_info *cdm_hw, uint32_t handle)
+{
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_hw_soc_info *soc_info = &cdm_hw->soc_info;
+	long time_left;
+	int i, rc = -EIO;
+	int reset_val = 1;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_lock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	set_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+
+	reinit_completion(&cdm_core->reset_complete);
+
+	/* First pause CDM, If it fails still proceed to reset CDM HW */
+	cam_hw_cdm_pause_core(cdm_hw, true);
+	usleep_range(1000, 1010);
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		if (!cdm_core->bl_fifo[i].bl_depth)
+			continue;
+
+		reset_val = reset_val |
+			(1 << (i + CAM_CDM_BL_FIFO_FLUSH_SHIFT));
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				cdm_core->offsets->irq_reg[i]->irq_mask,
+				0x70003)) {
+			CAM_ERR(CAM_CDM, "Failed to Write %s%u HW IRQ mask",
+				soc_info->label_name,
+				soc_info->index);
+			goto end;
+		}
+	}
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->rst_cmd, reset_val)) {
+		CAM_ERR(CAM_CDM, "Failed to Write %s%u HW reset",
+			soc_info->label_name,
+			soc_info->index);
+		goto end;
+	}
+
+	CAM_DBG(CAM_CDM, "Waiting for %s%u HW reset done",
+		soc_info->label_name, soc_info->index);
+	time_left = wait_for_completion_timeout(&cdm_core->reset_complete,
+		msecs_to_jiffies(CAM_CDM_HW_RESET_TIMEOUT));
+
+	if (time_left <= 0) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_CDM, "%s%u HW reset Wait failed rc=%d",
+			soc_info->label_name,
+			soc_info->index, rc);
+		goto end;
+	}
+
+	rc = cam_hw_cdm_set_cdm_core_cfg(cdm_hw);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to configure %s%u rc=%d",
+			soc_info->label_name,
+			soc_info->index, rc);
+		goto end;
+	}
+
+	rc = cam_hw_cdm_set_cdm_blfifo_cfg(cdm_hw);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to configure %s%u fifo rc=%d",
+			soc_info->label_name,
+			soc_info->index, rc);
+		goto end;
+	}
+
+	cam_hw_cdm_reset_cleanup(cdm_hw, handle);
+end:
+	clear_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_unlock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	return rc;
+}
+
+static int cam_hw_cdm_handle_error_info(
+	struct cam_hw_info *cdm_hw,
+	uint32_t            handle)
+{
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_cdm_bl_cb_request_entry *node = NULL;
+	long time_left;
+	int i, rc = -EIO, reset_hw_hdl = 0x0;
+	uint32_t current_bl_data = 0, current_fifo = 0, current_tag = 0;
+	int reset_val = 1;
+	struct cam_hw_soc_info *soc_info = &cdm_hw->soc_info;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_lock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	reinit_completion(&cdm_core->reset_complete);
+	set_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	set_bit(CAM_CDM_FLUSH_HW_STATUS, &cdm_core->cdm_status);
+
+	if (cdm_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_CDM, "CDM is in power down state");
+		goto end;
+	}
+
+	/* First pause CDM, If it fails still proceed to dump debug info */
+	cam_hw_cdm_pause_core(cdm_hw, true);
+
+	rc = cam_cdm_read_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->current_bl_len,
+			&current_bl_data);
+
+	current_fifo = ((CAM_CDM_CURRENT_BL_FIFO & current_bl_data)
+		>> CAM_CDM_CURRENT_BL_FIFO_SHIFT);
+	current_tag = ((CAM_CDM_CURRENT_BL_TAG & current_bl_data)
+		>> CAM_CDM_CURRENT_BL_TAG_SHIFT);
+
+	if (current_fifo >= CAM_CDM_BL_FIFO_MAX) {
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_ERR(CAM_CDM, "Hang detected for %s%u's fifo %d with tag 0x%x",
+		soc_info->label_name, soc_info->index,
+		current_fifo, current_tag);
+
+	/* dump cdm registers for further debug */
+	cam_hw_cdm_dump_core_debug_registers(cdm_hw, false);
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		if (!cdm_core->bl_fifo[i].bl_depth)
+			continue;
+
+		reset_val = reset_val |
+			(1 << (i + CAM_CDM_BL_FIFO_FLUSH_SHIFT));
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				cdm_core->offsets->irq_reg[i]->irq_mask,
+				0x70003)) {
+			CAM_ERR(CAM_CDM, "Failed to Write CDM HW IRQ mask");
+			goto end;
+		}
+	}
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->rst_cmd, reset_val)) {
+		CAM_ERR(CAM_CDM, "Failed to Write CDM HW reset");
+		goto end;
+	}
+
+	CAM_DBG(CAM_CDM, "Waiting for CDM HW resetdone");
+	time_left = wait_for_completion_timeout(&cdm_core->reset_complete,
+		msecs_to_jiffies(CAM_CDM_HW_RESET_TIMEOUT));
+
+	if (time_left <= 0) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_CDM, "CDM HW reset Wait failed rc=%d", rc);
+		set_bit(CAM_CDM_RESET_ERR_STATUS, &cdm_core->cdm_status);
+	}
+
+	rc = cam_hw_cdm_set_cdm_core_cfg(cdm_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to configure CDM rc=%d", rc);
+		goto end;
+	}
+
+	rc = cam_hw_cdm_set_cdm_blfifo_cfg(cdm_hw);
+
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to configure CDM fifo rc=%d", rc);
+		goto end;
+	}
+
+	node = list_first_entry_or_null(
+			&cdm_core->bl_fifo[current_fifo].bl_request_list,
+			struct cam_cdm_bl_cb_request_entry, entry);
+
+	if (node != NULL) {
+		if (node->request_type == CAM_HW_CDM_BL_CB_CLIENT) {
+			cam_cdm_notify_clients(cdm_hw,
+					CAM_CDM_CB_STATUS_HW_ERROR,
+					(void *)node);
+		} else if (node->request_type == CAM_HW_CDM_BL_CB_INTERNAL) {
+			CAM_ERR(CAM_CDM, "Invalid node=%pK %d", node,
+					node->request_type);
+		}
+		list_del_init(&node->entry);
+		kfree(node);
+		node = NULL;
+	}
+
+	cam_hw_cdm_reset_cleanup(cdm_hw, reset_hw_hdl);
+end:
+	clear_bit(CAM_CDM_FLUSH_HW_STATUS, &cdm_core->cdm_status);
+	clear_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	clear_bit(CAM_CDM_RESET_ERR_STATUS, &cdm_core->cdm_status);
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_unlock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	return rc;
+}
+
+int cam_hw_cdm_flush_hw(struct cam_hw_info *cdm_hw, uint32_t handle)
+{
+	struct cam_cdm *cdm_core = NULL;
+	int rc = 0;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	set_bit(CAM_CDM_FLUSH_HW_STATUS, &cdm_core->cdm_status);
+	rc = cam_hw_cdm_reset_hw(cdm_hw, handle);
+	clear_bit(CAM_CDM_FLUSH_HW_STATUS, &cdm_core->cdm_status);
+
+	return rc;
+}
+
+int cam_hw_cdm_handle_error(
+	struct cam_hw_info *cdm_hw,
+	uint32_t            handle)
+{
+	struct cam_cdm *cdm_core = NULL;
+	int rc = 0;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	rc = cam_hw_cdm_handle_error_info(cdm_hw, handle);
+
+	return rc;
+}
+
+int cam_hw_cdm_hang_detect(
+	struct cam_hw_info *cdm_hw,
+	uint32_t            handle)
+{
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_hw_soc_info *soc_info;
+	int i, rc = -1;
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+	soc_info = &cdm_hw->soc_info;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		if (atomic_read(&cdm_core->bl_fifo[i].work_record)) {
+			CAM_WARN(CAM_CDM,
+				"workqueue got delayed for %s%u, work_record :%u",
+				soc_info->label_name, soc_info->index,
+				atomic_read(&cdm_core->bl_fifo[i].work_record));
+			rc = 0;
+			break;
+		}
+
+	return rc;
+}
+
+static int cam_hw_cdm_get_cdm_config(struct cam_hw_info *cdm_hw)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cdm *core = NULL;
+	int rc = 0;
+
+	core = (struct cam_cdm *)cdm_hw->core_info;
+	soc_info = &cdm_hw->soc_info;
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+			CAM_SVS_VOTE, true);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Enable platform failed for dev %s",
+				soc_info->dev_name);
+		goto end;
+	} else {
+		CAM_DBG(CAM_CDM, "%s%u init success",
+			soc_info->label_name, soc_info->index);
+		cdm_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	}
+
+	if (cam_cdm_read_hw_reg(cdm_hw,
+			core->offsets->cmn_reg->cdm_hw_version,
+			&core->hw_version)) {
+		CAM_ERR(CAM_CDM, "Failed to read HW Version for %s%u",
+			soc_info->label_name, soc_info->index);
+		rc = -EIO;
+		goto disable_platform_resource;
+	}
+
+	if (core->offsets->cmn_reg->cam_version) {
+		if (cam_cdm_read_hw_reg(cdm_hw,
+				core->offsets->cmn_reg->cam_version->hw_version,
+				&core->hw_family_version)) {
+			CAM_ERR(CAM_CDM, "Failed to read %s%d family Version",
+				soc_info->label_name, soc_info->index);
+			rc = -EIO;
+			goto disable_platform_resource;
+		}
+	}
+
+	CAM_DBG(CAM_CDM,
+		"%s%d Hw version read success family =%x hw =%x",
+		soc_info->label_name, soc_info->index,
+		core->hw_family_version, core->hw_version);
+
+	core->ops = cam_cdm_get_ops(core->hw_version, NULL,
+		false);
+
+	if (!core->ops) {
+		CAM_ERR(CAM_CDM, "Failed to util ops for cdm hw name %s",
+			core->name);
+		rc = -EINVAL;
+		goto disable_platform_resource;
+	}
+
+disable_platform_resource:
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+
+	if (rc) {
+		CAM_ERR(CAM_CDM, "disable platform failed for dev %s",
+				soc_info->dev_name);
+	} else {
+		CAM_DBG(CAM_CDM, "%s%d Deinit success",
+			soc_info->label_name, soc_info->index);
+		cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	}
+end:
+	return rc;
+}
+
+int cam_hw_cdm_init(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	int rc, i, reset_hw_hdl = 0x0;
+	unsigned long flags;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	soc_info = &cdm_hw->soc_info;
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_SVS_VOTE, true);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Enable platform failed for %s%d",
+			soc_info->label_name, soc_info->index);
+		goto end;
+	}
+	spin_lock_irqsave(&cdm_hw->hw_lock, flags);
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	spin_unlock_irqrestore(&cdm_hw->hw_lock, flags);
+
+	CAM_DBG(CAM_CDM, "Enable soc done for %s%d",
+		soc_info->label_name, soc_info->index);
+
+/* Before triggering the reset to HW, clear the reset complete */
+	clear_bit(CAM_CDM_ERROR_HW_STATUS, &cdm_core->cdm_status);
+
+	for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+		clear_bit(i, &cdm_core->cdm_status);
+		reinit_completion(&cdm_core->bl_fifo[i].bl_complete);
+	}
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		cdm_core->bl_fifo[i].last_bl_tag_done = -1;
+		atomic_set(&cdm_core->bl_fifo[i].work_record, 0);
+	}
+
+	rc = cam_hw_cdm_reset_hw(cdm_hw, reset_hw_hdl);
+
+	if (rc) {
+		CAM_ERR(CAM_CDM, "%s%u HW reset Wait failed rc=%d",
+			soc_info->label_name,
+			soc_info->index, rc);
+		goto disable_return;
+	} else {
+		CAM_DBG(CAM_CDM, "%s%u Init success",
+			soc_info->label_name, soc_info->index);
+		for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+			if (!cdm_core->bl_fifo[i].bl_depth)
+				continue;
+
+			cam_cdm_write_hw_reg(cdm_hw,
+					cdm_core->offsets->irq_reg[i]->irq_mask,
+					0x70003);
+		}
+		rc = 0;
+		goto end;
+	}
+
+disable_return:
+	rc = -EIO;
+	spin_lock_irqsave(&cdm_hw->hw_lock, flags);
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	spin_unlock_irqrestore(&cdm_hw->hw_lock, flags);
+	cam_soc_util_disable_platform_resource(soc_info, true, true);
+end:
+	return rc;
+}
+
+int cam_hw_cdm_deinit(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cdm_hw = hw_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_cdm_bl_cb_request_entry *node, *tnode;
+	int rc = 0, i;
+	uint32_t reset_val = 1;
+	long time_left;
+	unsigned long                             flags;
+
+	if (!hw_priv)
+		return -EINVAL;
+
+	soc_info = &cdm_hw->soc_info;
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_lock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	/*clear bl request */
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		list_for_each_entry_safe(node, tnode,
+			&cdm_core->bl_fifo[i].bl_request_list, entry) {
+			list_del_init(&node->entry);
+			kfree(node);
+			node = NULL;
+		}
+	}
+
+	set_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	reinit_completion(&cdm_core->reset_complete);
+
+	/* First pause CDM, If it fails still proceed to reset CDM HW */
+	cam_hw_cdm_pause_core(cdm_hw, true);
+	usleep_range(1000, 1010);
+
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++) {
+		if (!cdm_core->bl_fifo[i].bl_depth)
+			continue;
+
+		reset_val = reset_val |
+			(1 << (i + CAM_CDM_BL_FIFO_FLUSH_SHIFT));
+		if (cam_cdm_write_hw_reg(cdm_hw,
+				cdm_core->offsets->irq_reg[i]->irq_mask,
+				0x70003)) {
+			CAM_ERR(CAM_CDM, "Failed to Write CDM HW IRQ mask");
+		}
+	}
+
+	if (cam_cdm_write_hw_reg(cdm_hw,
+			cdm_core->offsets->cmn_reg->rst_cmd, reset_val)) {
+		CAM_ERR(CAM_CDM, "Failed to Write CDM HW reset");
+	}
+
+	CAM_DBG(CAM_CDM, "Waiting for %s%u HW reset done",
+		soc_info->label_name, soc_info->index);
+	time_left = wait_for_completion_timeout(&cdm_core->reset_complete,
+		msecs_to_jiffies(CAM_CDM_HW_RESET_TIMEOUT));
+
+	if (time_left <= 0) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_CDM, "%s%u HW reset Wait failed rc=%d",
+		soc_info->label_name, soc_info->index, rc);
+	}
+
+	clear_bit(CAM_CDM_RESET_HW_STATUS, &cdm_core->cdm_status);
+	for (i = 0; i < cdm_core->offsets->reg_data->num_bl_fifo; i++)
+		mutex_unlock(&cdm_core->bl_fifo[i].fifo_lock);
+
+	spin_lock_irqsave(&cdm_hw->hw_lock, flags);
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	spin_unlock_irqrestore(&cdm_hw->hw_lock, flags);
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "disable platform failed for %s%u",
+			soc_info->label_name, soc_info->index);
+	} else {
+		CAM_DBG(CAM_CDM, "%s%u Deinit success",
+			soc_info->label_name, soc_info->index);
+	}
+
+	return rc;
+}
+
+static int cam_hw_cdm_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc, len = 0, i, j;
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_hw_intf *cdm_hw_intf = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_cdm_private_dt_data *soc_private = NULL;
+	struct cam_cpas_register_params cpas_parms;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	char cdm_name[128], work_q_name[128];
+	struct platform_device *pdev = to_platform_device(dev);
+
+	cdm_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!cdm_hw_intf)
+		return -ENOMEM;
+
+	cdm_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!cdm_hw) {
+		kfree(cdm_hw_intf);
+		cdm_hw_intf = NULL;
+		return -ENOMEM;
+	}
+
+	cdm_hw->core_info = kzalloc(sizeof(struct cam_cdm), GFP_KERNEL);
+	if (!cdm_hw->core_info) {
+		kfree(cdm_hw);
+		cdm_hw = NULL;
+		kfree(cdm_hw_intf);
+		cdm_hw_intf = NULL;
+		return -ENOMEM;
+	}
+
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	cdm_hw->soc_info.pdev = pdev;
+	cdm_hw->soc_info.dev = &pdev->dev;
+	cdm_hw->soc_info.dev_name = pdev->name;
+	cdm_hw_intf->hw_type = CAM_HW_CDM;
+	cdm_hw->open_count = 0;
+	mutex_init(&cdm_hw->hw_mutex);
+	spin_lock_init(&cdm_hw->hw_lock);
+	init_completion(&cdm_hw->hw_complete);
+
+	rc = cam_hw_cdm_soc_get_dt_properties(cdm_hw, msm_cam_hw_cdm_dt_match);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to get dt properties");
+		goto release_mem;
+	}
+	cdm_hw_intf->hw_idx = cdm_hw->soc_info.index;
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+	soc_private = (struct cam_cdm_private_dt_data *)
+		cdm_hw->soc_info.soc_private;
+	if (soc_private->dt_cdm_shared == true)
+		cdm_core->flags = CAM_CDM_FLAG_SHARED_CDM;
+	else
+		cdm_core->flags = CAM_CDM_FLAG_PRIVATE_CDM;
+
+	cdm_core->id = cam_hw_cdm_get_id_by_name(cdm_core->name);
+
+	CAM_DBG(CAM_CDM, "cdm_name %s", cdm_core->name);
+
+	if (cdm_core->id >= CAM_CDM_MAX) {
+		CAM_ERR(CAM_CDM, "Failed to get CDM HW name for %s",
+			cdm_core->name);
+		goto release_private_mem;
+	}
+
+	init_completion(&cdm_core->reset_complete);
+	cdm_hw_intf->hw_priv = cdm_hw;
+	cdm_hw_intf->hw_ops.get_hw_caps = cam_cdm_get_caps;
+	cdm_hw_intf->hw_ops.init = cam_hw_cdm_init;
+	cdm_hw_intf->hw_ops.deinit = cam_hw_cdm_deinit;
+	cdm_hw_intf->hw_ops.start = cam_cdm_stream_start;
+	cdm_hw_intf->hw_ops.stop = cam_cdm_stream_stop;
+	cdm_hw_intf->hw_ops.read = NULL;
+	cdm_hw_intf->hw_ops.write = NULL;
+	cdm_hw_intf->hw_ops.process_cmd = cam_cdm_process_cmd;
+	mutex_lock(&cdm_hw->hw_mutex);
+
+	CAM_DBG(CAM_CDM, "type %d index %d", cdm_hw_intf->hw_type,
+		cdm_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, cdm_hw_intf);
+
+	snprintf(cdm_name, sizeof(cdm_name), "%s", cdm_hw->soc_info.label_name);
+
+	rc = cam_smmu_get_handle(cdm_name, &cdm_core->iommu_hdl.non_secure);
+	if (rc < 0) {
+		if (rc != -EALREADY) {
+			CAM_ERR(CAM_CDM,
+				"%s get iommu handle failed, rc = %d",
+				cdm_name, rc);
+			goto unlock_release_mem;
+		}
+		rc = 0;
+	}
+
+	cam_smmu_set_client_page_fault_handler(cdm_core->iommu_hdl.non_secure,
+		cam_hw_cdm_iommu_fault_handler, cdm_hw);
+
+	cdm_core->iommu_hdl.secure = -1;
+
+	for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+		INIT_LIST_HEAD(&cdm_core->bl_fifo[i].bl_request_list);
+
+		mutex_init(&cdm_core->bl_fifo[i].fifo_lock);
+
+		init_completion(&cdm_core->bl_fifo[i].bl_complete);
+
+		len = strscpy(work_q_name, cdm_core->name,
+			      sizeof(cdm_core->name));
+		snprintf(work_q_name + len, sizeof(work_q_name) - len, "%d", i);
+		cdm_core->bl_fifo[i].work_queue = alloc_workqueue(work_q_name,
+				WQ_UNBOUND | WQ_MEM_RECLAIM | WQ_SYSFS,
+				CAM_CDM_INFLIGHT_WORKS);
+		if (!cdm_core->bl_fifo[i].work_queue) {
+			CAM_ERR(CAM_CDM,
+				"Workqueue allocation failed for FIFO %d, cdm %s",
+				i, cdm_core->name);
+			goto failed_workq_create;
+		}
+
+		CAM_DBG(CAM_CDM, "wq %s", work_q_name);
+	}
+
+	rc = cam_soc_util_request_platform_resource(&cdm_hw->soc_info,
+			cam_hw_cdm_irq, cdm_hw);
+	if (rc) {
+		CAM_ERR(CAM_CDM,
+			"Failed to request platform resource for %s%u",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		goto destroy_non_secure_hdl;
+	}
+	cpas_parms.cam_cpas_client_cb = cam_cdm_cpas_cb;
+	cpas_parms.cell_index = cdm_hw->soc_info.index;
+	cpas_parms.dev = &pdev->dev;
+	cpas_parms.userdata = cdm_hw_intf;
+	strscpy(cpas_parms.identifier, cdm_hw->soc_info.label_name,
+		CAM_HW_IDENTIFIER_LENGTH);
+	rc = cam_cpas_register_client(&cpas_parms);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Virtual CDM CPAS registration failed");
+		goto release_platform_resource;
+	}
+	CAM_DBG(CAM_CDM, "CPAS registration successful handle=%d",
+		cpas_parms.client_handle);
+	cdm_core->cpas_handle = cpas_parms.client_handle;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(cdm_core->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CPAS start failed");
+		goto cpas_unregister;
+	}
+
+	rc = cam_hw_cdm_get_cdm_config(cdm_hw);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to get cdm configuration rc = %d", rc);
+		goto cpas_stop;
+	}
+
+	if (cdm_core->hw_version < CAM_CDM_VERSION_2_0) {
+		for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+			cdm_core->bl_fifo[i].bl_depth =
+				CAM_CDM_BL_FIFO_LENGTH_MAX_DEFAULT;
+			CAM_DBG(CAM_CDM, "Setting FIFO%d length to %d",
+				i, cdm_core->bl_fifo[i].bl_depth);
+		}
+	} else {
+		for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+			cdm_core->bl_fifo[i].bl_depth =
+				soc_private->fifo_depth[i];
+			CAM_DBG(CAM_CDM, "Setting FIFO%d length to %d",
+				i, cdm_core->bl_fifo[i].bl_depth);
+		}
+	}
+
+	cdm_core->arbitration = cam_cdm_get_arbitration_type(
+		cdm_core->hw_version, cdm_core->id);
+
+	cdm_core->cdm_status = CAM_CDM_HW_INIT_STATUS;
+
+	rc = cam_hw_cdm_init(cdm_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to Init %s%u HW",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		goto cpas_stop;
+	}
+	cdm_hw->open_count++;
+
+	cdm_core->ops = cam_cdm_get_ops(cdm_core->hw_version, NULL,
+		false);
+
+	if (!cdm_core->ops) {
+		CAM_ERR(CAM_CDM, "Failed to util ops for %s%u HW",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		rc = -EINVAL;
+		goto deinit;
+	}
+
+	if (!cam_cdm_set_cam_hw_version(cdm_core->hw_version,
+		&cdm_core->version)) {
+		CAM_ERR(CAM_CDM, "Failed to set cam hw version for hw");
+		rc = -EINVAL;
+		goto deinit;
+	}
+
+	rc = cam_hw_cdm_deinit(cdm_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to Deinit %s%u HW",
+			cdm_hw->soc_info.label_name,
+			cdm_hw->soc_info.index);
+		cdm_hw->open_count--;
+		goto cpas_stop;
+	}
+
+	rc = cam_cpas_stop(cdm_core->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CPAS stop failed");
+		cdm_hw->open_count--;
+		goto cpas_unregister;
+	}
+
+	rc = cam_cdm_intf_register_hw_cdm(cdm_hw_intf,
+		soc_private, CAM_HW_CDM, &cdm_core->index);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "HW CDM Interface registration failed");
+		cdm_hw->open_count--;
+		goto cpas_unregister;
+	}
+	cdm_hw->open_count--;
+	mutex_unlock(&cdm_hw->hw_mutex);
+
+	CAM_DBG(CAM_CDM, "%s component bound successfully", cdm_core->name);
+
+	return rc;
+
+deinit:
+	if (cam_hw_cdm_deinit(cdm_hw, NULL, 0))
+		CAM_ERR(CAM_CDM, "Deinit failed for hw");
+	cdm_hw->open_count--;
+cpas_stop:
+	if (cam_cpas_stop(cdm_core->cpas_handle))
+		CAM_ERR(CAM_CDM, "CPAS stop failed");
+cpas_unregister:
+	if (cam_cpas_unregister_client(cdm_core->cpas_handle))
+		CAM_ERR(CAM_CDM, "CPAS unregister failed");
+release_platform_resource:
+	if (cam_soc_util_release_platform_resource(&cdm_hw->soc_info))
+		CAM_ERR(CAM_CDM, "Release platform resource failed");
+failed_workq_create:
+	for (j = 0; j < i; j++) {
+		flush_workqueue(cdm_core->bl_fifo[j].work_queue);
+		destroy_workqueue(cdm_core->bl_fifo[j].work_queue);
+	}
+destroy_non_secure_hdl:
+	cam_smmu_set_client_page_fault_handler(cdm_core->iommu_hdl.non_secure,
+		NULL, cdm_hw);
+	if (cam_smmu_destroy_handle(cdm_core->iommu_hdl.non_secure))
+		CAM_ERR(CAM_CDM, "Release iommu secure hdl failed");
+unlock_release_mem:
+	mutex_unlock(&cdm_hw->hw_mutex);
+release_private_mem:
+	kfree(cdm_hw->soc_info.soc_private);
+	cdm_hw->soc_info.soc_private = NULL;
+release_mem:
+	mutex_destroy(&cdm_hw->hw_mutex);
+	kfree(cdm_hw_intf);
+	cdm_hw_intf = NULL;
+	kfree(cdm_hw->core_info);
+	cdm_hw->core_info = NULL;
+	kfree(cdm_hw);
+	cdm_hw = NULL;
+	return rc;
+}
+
+static void cam_hw_cdm_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = -EBUSY, i;
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_hw_intf *cdm_hw_intf = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	cdm_hw_intf = platform_get_drvdata(pdev);
+	if (!cdm_hw_intf) {
+		CAM_ERR(CAM_CDM, "Failed to get dev private data");
+		return;
+	}
+
+	cdm_hw = cdm_hw_intf->hw_priv;
+	if (!cdm_hw) {
+		CAM_ERR(CAM_CDM,
+			"Failed to get hw private data for type=%d idx=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx);
+		return;
+	}
+
+	cdm_core = cdm_hw->core_info;
+	if (!cdm_core) {
+		CAM_ERR(CAM_CDM,
+			"Failed to get hw core data for type=%d idx=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx);
+		return;
+	}
+
+	if (cdm_hw->open_count != 0) {
+		CAM_ERR(CAM_CDM, "Hw open count invalid type=%d idx=%d cnt=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx,
+			cdm_hw->open_count);
+		return;
+	}
+
+	if (cdm_hw->hw_state == CAM_HW_STATE_POWER_UP) {
+		rc = cam_hw_cdm_deinit(cdm_hw, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_CDM, "Deinit failed for hw");
+			return;
+		}
+	}
+
+	rc = cam_cdm_intf_deregister_hw_cdm(cdm_hw_intf,
+		cdm_hw->soc_info.soc_private, CAM_HW_CDM, cdm_core->index);
+	if (rc) {
+		CAM_ERR(CAM_CDM,
+			"HW_CDM interface deregistration failed: rd: %d", rc);
+	}
+
+	rc = cam_cpas_unregister_client(cdm_core->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CPAS unregister failed");
+		return;
+	}
+
+	if (cam_soc_util_release_platform_resource(&cdm_hw->soc_info))
+		CAM_ERR(CAM_CDM, "Release platform resource failed");
+
+	for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+		flush_workqueue(cdm_core->bl_fifo[i].work_queue);
+		destroy_workqueue(cdm_core->bl_fifo[i].work_queue);
+	}
+
+	cam_smmu_unset_client_page_fault_handler(
+		cdm_core->iommu_hdl.non_secure, cdm_hw);
+	if (cam_smmu_destroy_handle(cdm_core->iommu_hdl.non_secure))
+		CAM_ERR(CAM_CDM, "Release iommu secure hdl failed");
+
+	mutex_destroy(&cdm_hw->hw_mutex);
+	kfree(cdm_hw->soc_info.soc_private);
+	cdm_hw->soc_info.soc_private = NULL;
+	kfree(cdm_hw_intf);
+	cdm_hw_intf = NULL;
+	kfree(cdm_hw->core_info);
+	cdm_hw->core_info = NULL;
+	kfree(cdm_hw);
+	cdm_hw = NULL;
+}
+
+const static struct component_ops cam_hw_cdm_component_ops = {
+	.bind = cam_hw_cdm_component_bind,
+	.unbind = cam_hw_cdm_component_unbind,
+};
+
+static int cam_hw_cdm_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CDM, "Adding HW CDM component");
+	rc = component_add(&pdev->dev, &cam_hw_cdm_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CDM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_hw_cdm_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_hw_cdm_component_ops);
+	return 0;
+}
+
+struct platform_driver cam_hw_cdm_driver = {
+	.probe = cam_hw_cdm_probe,
+	.remove = cam_hw_cdm_remove,
+	.driver = {
+		.name = "msm_cam_cdm",
+		.owner = THIS_MODULE,
+		.of_match_table = msm_cam_hw_cdm_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_hw_cdm_init_module(void)
+{
+	return platform_driver_register(&cam_hw_cdm_driver);
+}
+
+void cam_hw_cdm_exit_module(void)
+{
+	platform_driver_unregister(&cam_hw_cdm_driver);
+}
+
+MODULE_DESCRIPTION("MSM Camera HW CDM driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_1_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_1_0.h
@@ -0,0 +1,160 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+static struct cam_version_reg cdm_hw_1_0_titan_version = {
+	.hw_version = 0x4,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_1_0_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x7F,
+	.rb_num_fifo = 0x1,
+	.rb_next_fifo_shift = 0x0,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_1_0_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_1_0_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_0_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_1_0_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_0_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_0_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_common_regs cdm_hw_1_0_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = &cdm_hw_1_0_titan_version,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_1_0_bl_pending_req0,
+			NULL,
+		},
+	.comp_wait = {
+			&cdm_1_0_comp_wait_status0,
+			&cdm_1_0_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_1_0_perf_mon0,
+			NULL,
+		},
+	.scratch = {
+			&cdm_1_0_scratch_reg0,
+			&cdm_1_0_scratch_reg1,
+			&cdm_1_0_scratch_reg2,
+			&cdm_1_0_scratch_reg3,
+			&cdm_1_0_scratch_reg4,
+			&cdm_1_0_scratch_reg5,
+			&cdm_1_0_scratch_reg6,
+			&cdm_1_0_scratch_reg7,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.perf_reg = NULL,
+	.icl_reg = NULL,
+	.spare = 0x200,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_1_0_cmn_reg_data = {
+	.num_bl_fifo = 0x1,
+	.num_bl_fifo_irq = 0x1,
+	.num_bl_pending_req_reg = 0x1,
+	.num_scratch_reg = 0x8,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_1_0_reg_offset = {
+	.cmn_reg = &cdm_hw_1_0_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_1_0_bl_fifo0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.irq_reg = {
+			&cdm_hw_1_0_irq0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.reg_data = &cdm_hw_1_0_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_1_1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_1_1.h
@@ -0,0 +1,160 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+static struct cam_version_reg cdm_hw_1_1_titan_version = {
+	.hw_version = 0x4,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_1_1_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x7f,
+	.rb_num_fifo = 0x1,
+	.rb_next_fifo_shift = 0x0,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_1_1_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_1_1_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_1_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_1_1_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_1_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_1_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_common_regs cdm_hw_1_1_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = &cdm_hw_1_1_titan_version,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_1_1_bl_pending_req0,
+			NULL,
+		},
+	.comp_wait = {
+			&cdm_1_1_comp_wait_status0,
+			&cdm_1_1_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_1_1_perf_mon0,
+			NULL,
+		},
+	.scratch = {
+			&cdm_1_1_scratch_reg0,
+			&cdm_1_1_scratch_reg1,
+			&cdm_1_1_scratch_reg2,
+			&cdm_1_1_scratch_reg3,
+			&cdm_1_1_scratch_reg4,
+			&cdm_1_1_scratch_reg5,
+			&cdm_1_1_scratch_reg6,
+			&cdm_1_1_scratch_reg7,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.perf_reg = NULL,
+	.icl_reg = NULL,
+	.spare = 0x1fc,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_1_1_cmn_reg_data = {
+	.num_bl_fifo = 0x1,
+	.num_bl_fifo_irq = 0x1,
+	.num_bl_pending_req_reg = 0x1,
+	.num_scratch_reg = 0x8,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_1_1_reg_offset = {
+	.cmn_reg = &cdm_hw_1_1_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_1_1_bl_fifo0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.irq_reg = {
+			&cdm_hw_1_1_irq0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.reg_data = &cdm_hw_1_1_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_1_2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_1_2.h
@@ -0,0 +1,180 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+static struct cam_version_reg cdm_hw_1_2_titan_version = {
+	.hw_version = 0x4,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_1_2_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x7f,
+	.rb_num_fifo = 0x1,
+	.rb_next_fifo_shift = 0x0,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_1_2_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_1_2_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_1_2_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_1_2_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_2_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_1_2_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_perf_regs cdm_1_2_perf = {
+	.count_cfg_0 = 0x180,
+	.always_count_val = 0x184,
+	.busy_count_val = 0x188,
+	.stall_axi_count_val = 0x18c,
+	.count_status = 0x190,
+};
+
+static struct cam_cdm_icl_data_regs cdm_1_2_icl_data = {
+	.icl_last_data_0 = 0x1c0,
+	.icl_last_data_1 = 0x1c4,
+	.icl_last_data_2 = 0x1c8,
+	.icl_inv_data = 0x1cc,
+};
+
+static struct cam_cdm_icl_regs cdm_1_2_icl = {
+	.data_regs = &cdm_1_2_icl_data,
+	.misc_regs = NULL,
+};
+
+static struct cam_cdm_common_regs cdm_hw_1_2_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = &cdm_hw_1_2_titan_version,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_1_2_bl_pending_req0,
+			NULL,
+		},
+	.comp_wait = {
+			&cdm_1_2_comp_wait_status0,
+			&cdm_1_2_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_1_2_perf_mon0,
+			NULL,
+		},
+	.scratch = {
+			&cdm_1_2_scratch_reg0,
+			&cdm_1_2_scratch_reg1,
+			&cdm_1_2_scratch_reg2,
+			&cdm_1_2_scratch_reg3,
+			&cdm_1_2_scratch_reg4,
+			&cdm_1_2_scratch_reg5,
+			&cdm_1_2_scratch_reg6,
+			&cdm_1_2_scratch_reg7,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.perf_reg = &cdm_1_2_perf,
+	.icl_reg = &cdm_1_2_icl,
+	.spare = 0x1fc,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_1_2_cmn_reg_data = {
+	.num_bl_fifo = 0x1,
+	.num_bl_fifo_irq = 0x1,
+	.num_bl_pending_req_reg = 0x1,
+	.num_scratch_reg = 0x8,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_1_2_reg_offset = {
+	.cmn_reg = &cdm_hw_1_2_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_1_2_bl_fifo0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.irq_reg = {
+			&cdm_hw_1_2_irq0,
+			NULL,
+			NULL,
+			NULL,
+		},
+	.reg_data = &cdm_hw_1_2_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_2_0.h
@@ -0,0 +1,251 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_0_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_0_bl_pending_req1 = {
+	.rb_offset = 0x70,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_0_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_0_irq1 = {
+	.irq_mask = 0x130,
+	.irq_clear = 0x134,
+	.irq_clear_cmd = 0x138,
+	.irq_set = 0x13c,
+	.irq_set_cmd = 0x140,
+	.irq_status = 0x144,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_0_irq2 = {
+	.irq_mask = 0x230,
+	.irq_clear = 0x234,
+	.irq_clear_cmd = 0x238,
+	.irq_set = 0x23c,
+	.irq_set_cmd = 0x240,
+	.irq_status = 0x244,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_0_irq3 = {
+	.irq_mask = 0x330,
+	.irq_clear = 0x334,
+	.irq_clear_cmd = 0x338,
+	.irq_set = 0x33c,
+	.irq_set_cmd = 0x340,
+	.irq_status = 0x344,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_0_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_0_bl_fifo1 = {
+	.bl_fifo_base = 0x150,
+	.bl_fifo_len = 0x154,
+	.bl_fifo_store = 0x158,
+	.bl_fifo_cfg = 0x15c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_0_bl_fifo2 = {
+	.bl_fifo_base = 0x250,
+	.bl_fifo_len = 0x254,
+	.bl_fifo_store = 0x258,
+	.bl_fifo_cfg = 0x25c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_0_bl_fifo3 = {
+	.bl_fifo_base = 0x350,
+	.bl_fifo_len = 0x354,
+	.bl_fifo_store = 0x358,
+	.bl_fifo_cfg = 0x35c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg8 = {
+	.scratch_reg = 0xb0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg9 = {
+	.scratch_reg = 0xb4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg10  = {
+	.scratch_reg = 0xb8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_0_scratch_reg11  = {
+	.scratch_reg = 0xbc,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_0_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_0_perf_mon1 = {
+	.perf_mon_ctrl = 0x120,
+	.perf_mon_0 = 0x124,
+	.perf_mon_1 = 0x128,
+	.perf_mon_2 = 0x12c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_0_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_0_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_icl_data_regs cdm_2_0_icl_data = {
+	.icl_last_data_0 = 0x1c0,
+	.icl_last_data_1 = 0x1c4,
+	.icl_last_data_2 = 0x1c8,
+	.icl_inv_data = 0x1cc,
+};
+
+static struct cam_cdm_icl_misc_regs cdm_2_0_icl_misc = {
+	.icl_inv_bl_addr = 0x1d0,
+	.icl_status = 0x1d4,
+};
+
+static struct cam_cdm_icl_regs cdm_2_0_icl = {
+	.data_regs = &cdm_2_0_icl_data,
+	.misc_regs = &cdm_2_0_icl_misc,
+};
+
+static struct cam_cdm_common_regs cdm_hw_2_0_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = NULL,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_2_0_bl_pending_req0,
+			&cdm_hw_2_0_bl_pending_req1,
+		},
+	.comp_wait = {
+			&cdm_2_0_comp_wait_status0,
+			&cdm_2_0_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_2_0_perf_mon0,
+			&cdm_2_0_perf_mon1,
+		},
+	.scratch = {
+			&cdm_2_0_scratch_reg0,
+			&cdm_2_0_scratch_reg1,
+			&cdm_2_0_scratch_reg2,
+			&cdm_2_0_scratch_reg3,
+			&cdm_2_0_scratch_reg4,
+			&cdm_2_0_scratch_reg5,
+			&cdm_2_0_scratch_reg6,
+			&cdm_2_0_scratch_reg7,
+			&cdm_2_0_scratch_reg8,
+			&cdm_2_0_scratch_reg9,
+			&cdm_2_0_scratch_reg10,
+			&cdm_2_0_scratch_reg11,
+		},
+	.perf_reg = NULL,
+	.icl_reg = &cdm_2_0_icl,
+	.spare = 0x1fc,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_2_0_cmn_reg_data = {
+	.num_bl_fifo = 0x4,
+	.num_bl_fifo_irq = 0x4,
+	.num_bl_pending_req_reg = 0x2,
+	.num_scratch_reg = 0xc,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_2_0_reg_offset = {
+	.cmn_reg = &cdm_hw_2_0_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_2_0_bl_fifo0,
+			&cdm_hw_2_0_bl_fifo1,
+			&cdm_hw_2_0_bl_fifo2,
+			&cdm_hw_2_0_bl_fifo3,
+		},
+	.irq_reg = {
+			&cdm_hw_2_0_irq0,
+			&cdm_hw_2_0_irq1,
+			&cdm_hw_2_0_irq2,
+			&cdm_hw_2_0_irq3,
+		},
+	.reg_data = &cdm_hw_2_0_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_2_1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_hw_reg_2_1.h
@@ -0,0 +1,261 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_cdm.h"
+
+struct cam_cdm_pid_mid_data cdm_hw_2_1_pid_mid_data = {
+	.cdm_pid = 2,
+	.cdm_mid = 0,
+	.ope_cdm_pid = 0,
+	.ope_cdm_mid = 2,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_1_bl_pending_req0 = {
+	.rb_offset = 0x6c,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+struct cam_cdm_bl_pending_req_reg_params cdm_hw_2_1_bl_pending_req1 = {
+	.rb_offset = 0x70,
+	.rb_mask = 0x1ff,
+	.rb_num_fifo = 0x2,
+	.rb_next_fifo_shift = 0x10,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_1_irq0 = {
+	.irq_mask = 0x30,
+	.irq_clear = 0x34,
+	.irq_clear_cmd = 0x38,
+	.irq_set = 0x3c,
+	.irq_set_cmd = 0x40,
+	.irq_status = 0x44,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_1_irq1 = {
+	.irq_mask = 0x130,
+	.irq_clear = 0x134,
+	.irq_clear_cmd = 0x138,
+	.irq_set = 0x13c,
+	.irq_set_cmd = 0x140,
+	.irq_status = 0x144,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_1_irq2 = {
+	.irq_mask = 0x230,
+	.irq_clear = 0x234,
+	.irq_clear_cmd = 0x238,
+	.irq_set = 0x23c,
+	.irq_set_cmd = 0x240,
+	.irq_status = 0x244,
+};
+
+static struct cam_cdm_irq_regs cdm_hw_2_1_irq3 = {
+	.irq_mask = 0x330,
+	.irq_clear = 0x334,
+	.irq_clear_cmd = 0x338,
+	.irq_set = 0x33c,
+	.irq_set_cmd = 0x340,
+	.irq_status = 0x344,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_1_bl_fifo0 = {
+	.bl_fifo_base = 0x50,
+	.bl_fifo_len = 0x54,
+	.bl_fifo_store = 0x58,
+	.bl_fifo_cfg = 0x5c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_1_bl_fifo1 = {
+	.bl_fifo_base = 0x150,
+	.bl_fifo_len = 0x154,
+	.bl_fifo_store = 0x158,
+	.bl_fifo_cfg = 0x15c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_1_bl_fifo2 = {
+	.bl_fifo_base = 0x250,
+	.bl_fifo_len = 0x254,
+	.bl_fifo_store = 0x258,
+	.bl_fifo_cfg = 0x25c,
+};
+
+static struct cam_cdm_bl_fifo_regs cdm_hw_2_1_bl_fifo3 = {
+	.bl_fifo_base = 0x350,
+	.bl_fifo_len = 0x354,
+	.bl_fifo_store = 0x358,
+	.bl_fifo_cfg = 0x35c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg0 = {
+	.scratch_reg = 0x90,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg1 = {
+	.scratch_reg = 0x94,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg2 = {
+	.scratch_reg = 0x98,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg3 = {
+	.scratch_reg = 0x9c,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg4 = {
+	.scratch_reg = 0xa0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg5 = {
+	.scratch_reg = 0xa4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg6 = {
+	.scratch_reg = 0xa8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg7 = {
+	.scratch_reg = 0xac,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg8 = {
+	.scratch_reg = 0xb0,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg9 = {
+	.scratch_reg = 0xb4,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg10  = {
+	.scratch_reg = 0xb8,
+};
+
+static struct cam_cdm_scratch_reg cdm_2_1_scratch_reg11  = {
+	.scratch_reg = 0xbc,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_1_perf_mon0 = {
+	.perf_mon_ctrl = 0x110,
+	.perf_mon_0 = 0x114,
+	.perf_mon_1 = 0x118,
+	.perf_mon_2 = 0x11c,
+};
+
+static struct cam_cdm_perf_mon_regs cdm_2_1_perf_mon1 = {
+	.perf_mon_ctrl = 0x120,
+	.perf_mon_0 = 0x124,
+	.perf_mon_1 = 0x128,
+	.perf_mon_2 = 0x12c,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_1_comp_wait_status0 = {
+	.comp_wait_status = 0x88,
+};
+
+static struct cam_cdm_comp_wait_status cdm_2_1_comp_wait_status1 = {
+	.comp_wait_status = 0x8c,
+};
+
+static struct cam_cdm_icl_data_regs cdm_2_1_icl_data = {
+	.icl_last_data_0 = 0x1c0,
+	.icl_last_data_1 = 0x1c4,
+	.icl_last_data_2 = 0x1c8,
+	.icl_inv_data = 0x1cc,
+};
+
+static struct cam_cdm_icl_misc_regs cdm_2_1_icl_misc = {
+	.icl_inv_bl_addr = 0x1d0,
+	.icl_status = 0x1d8,
+};
+
+static struct cam_cdm_icl_regs cdm_2_1_icl = {
+	.data_regs = &cdm_2_1_icl_data,
+	.misc_regs = &cdm_2_1_icl_misc,
+};
+
+static struct cam_cdm_common_regs cdm_hw_2_1_cmn_reg_offset = {
+	.cdm_hw_version = 0x0,
+	.cam_version = NULL,
+	.rst_cmd = 0x10,
+	.cgc_cfg = 0x14,
+	.core_cfg = 0x18,
+	.core_en = 0x1c,
+	.fe_cfg = 0x20,
+	.irq_context_status = 0x2c,
+	.bl_fifo_rb = 0x60,
+	.bl_fifo_base_rb = 0x64,
+	.bl_fifo_len_rb = 0x68,
+	.usr_data = 0x80,
+	.wait_status = 0x84,
+	.last_ahb_addr = 0xd0,
+	.last_ahb_data = 0xd4,
+	.core_debug = 0xd8,
+	.last_ahb_err_addr = 0xe0,
+	.last_ahb_err_data = 0xe4,
+	.current_bl_base = 0xe8,
+	.current_bl_len = 0xec,
+	.current_used_ahb_base = 0xf0,
+	.debug_status = 0xf4,
+	.bus_misr_cfg0 = 0x100,
+	.bus_misr_cfg1 = 0x104,
+	.bus_misr_rd_val = 0x108,
+	.pending_req = {
+			&cdm_hw_2_1_bl_pending_req0,
+			&cdm_hw_2_1_bl_pending_req1,
+		},
+	.comp_wait = {
+			&cdm_2_1_comp_wait_status0,
+			&cdm_2_1_comp_wait_status1,
+		},
+	.perf_mon = {
+			&cdm_2_1_perf_mon0,
+			&cdm_2_1_perf_mon1,
+		},
+	.scratch = {
+			&cdm_2_1_scratch_reg0,
+			&cdm_2_1_scratch_reg1,
+			&cdm_2_1_scratch_reg2,
+			&cdm_2_1_scratch_reg3,
+			&cdm_2_1_scratch_reg4,
+			&cdm_2_1_scratch_reg5,
+			&cdm_2_1_scratch_reg6,
+			&cdm_2_1_scratch_reg7,
+			&cdm_2_1_scratch_reg8,
+			&cdm_2_1_scratch_reg9,
+			&cdm_2_1_scratch_reg10,
+			&cdm_2_1_scratch_reg11,
+		},
+	.perf_reg = NULL,
+	.icl_reg = &cdm_2_1_icl,
+	.spare = 0x3fc,
+	.priority_group_bit_offset = 20,
+	.cdm_pid_mid_info = &cdm_hw_2_1_pid_mid_data,
+};
+
+static struct cam_cdm_common_reg_data cdm_hw_2_1_cmn_reg_data = {
+	.num_bl_fifo = 0x4,
+	.num_bl_fifo_irq = 0x4,
+	.num_bl_pending_req_reg = 0x2,
+	.num_scratch_reg = 0xc,
+};
+
+struct cam_cdm_hw_reg_offset cam_cdm_2_1_reg_offset = {
+	.cmn_reg = &cdm_hw_2_1_cmn_reg_offset,
+	.bl_fifo_reg = {
+			&cdm_hw_2_1_bl_fifo0,
+			&cdm_hw_2_1_bl_fifo1,
+			&cdm_hw_2_1_bl_fifo2,
+			&cdm_hw_2_1_bl_fifo3,
+		},
+	.irq_reg = {
+			&cdm_hw_2_1_irq0,
+			&cdm_hw_2_1_irq1,
+			&cdm_hw_2_1_irq2,
+			&cdm_hw_2_1_irq3,
+		},
+	.reg_data = &cdm_hw_2_1_cmn_reg_data,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_intf.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_intf.c
@@ -0,0 +1,749 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm.h"
+#include "cam_cdm_virtual.h"
+#include "cam_soc_util.h"
+#include "cam_cdm_soc.h"
+#include "cam_cdm_core_common.h"
+#include "camera_main.h"
+
+static struct cam_cdm_intf_mgr cdm_mgr;
+static DEFINE_MUTEX(cam_cdm_mgr_lock);
+
+static const struct of_device_id msm_cam_cdm_intf_dt_match[] = {
+	{ .compatible = "qcom,cam-cdm-intf", },
+	{}
+};
+
+static int get_cdm_mgr_refcount(void)
+{
+	int rc = 0;
+
+	mutex_lock(&cam_cdm_mgr_lock);
+	if (cdm_mgr.probe_done == false) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr not probed yet");
+		rc = -EPERM;
+	} else {
+		CAM_DBG(CAM_CDM, "CDM intf mgr get refcount=%d",
+			cdm_mgr.refcount);
+		cdm_mgr.refcount++;
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+	return rc;
+}
+
+static void put_cdm_mgr_refcount(void)
+{
+	mutex_lock(&cam_cdm_mgr_lock);
+	if (cdm_mgr.probe_done == false) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr not probed yet");
+	} else {
+		CAM_DBG(CAM_CDM, "CDM intf mgr put refcount=%d",
+			cdm_mgr.refcount);
+		if (cdm_mgr.refcount > 0) {
+			cdm_mgr.refcount--;
+		} else {
+			CAM_ERR(CAM_CDM, "Refcount put when zero");
+			WARN_ON(1);
+		}
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+}
+
+static int get_cdm_iommu_handle(struct cam_iommu_handle *cdm_handles,
+	uint32_t hw_idx)
+{
+	int rc = -EPERM;
+	struct cam_hw_intf *hw = cdm_mgr.nodes[hw_idx].device;
+
+	if (hw->hw_ops.get_hw_caps) {
+		rc = hw->hw_ops.get_hw_caps(hw->hw_priv, cdm_handles,
+			sizeof(struct cam_iommu_handle));
+	}
+
+	return rc;
+}
+
+static int get_cdm_index_by_id(char *identifier,
+	uint32_t cell_index, uint32_t *hw_index)
+{
+	int rc = -EPERM, i, j;
+	char client_name[128], name_index[160];
+
+	snprintf(client_name, sizeof(client_name), "%s", identifier);
+	snprintf(name_index, sizeof(name_index), "%s%d",
+		identifier, cell_index);
+
+	CAM_DBG(CAM_CDM,
+		"Looking for HW id of =%s or %s and index=%d cdm_count %d",
+		identifier, name_index, cell_index, cdm_mgr.cdm_count);
+	mutex_lock(&cam_cdm_mgr_lock);
+	for (i = 0; i < cdm_mgr.cdm_count; i++) {
+		mutex_lock(&cdm_mgr.nodes[i].lock);
+		CAM_DBG(CAM_CDM, "dt_num_supported_clients=%d",
+			cdm_mgr.nodes[i].data->dt_num_supported_clients);
+
+		for (j = 0; j <
+			cdm_mgr.nodes[i].data->dt_num_supported_clients; j++) {
+			CAM_DBG(CAM_CDM, "client name:%s dev Index: %d",
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				i);
+			if (!strcmp(
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				client_name) || !strcmp(
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				name_index)) {
+				rc = 0;
+				*hw_index = i;
+				break;
+			}
+		}
+		mutex_unlock(&cdm_mgr.nodes[i].lock);
+		if (rc == 0)
+			break;
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+
+	return rc;
+}
+
+int cam_cdm_get_iommu_handle(char *identifier,
+	struct cam_iommu_handle *cdm_handles)
+{
+	int i, j, rc = -EPERM;
+
+	if ((!identifier) || (!cdm_handles))
+		return -EINVAL;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return rc;
+	}
+	CAM_DBG(CAM_CDM, "Looking for Iommu handle of %s", identifier);
+
+	for (i = 0; i < cdm_mgr.cdm_count; i++) {
+		mutex_lock(&cdm_mgr.nodes[i].lock);
+		if (!cdm_mgr.nodes[i].data) {
+			mutex_unlock(&cdm_mgr.nodes[i].lock);
+			continue;
+		}
+		CAM_DBG(CAM_CDM, "dt_num_supported_clients=%d",
+			cdm_mgr.nodes[i].data->dt_num_supported_clients);
+		for (j = 0; j <
+			 cdm_mgr.nodes[i].data->dt_num_supported_clients;
+			j++) {
+			CAM_DBG(CAM_CDM, "client name:%s dev Index: %d",
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				i);
+			if (!strcmp(
+				cdm_mgr.nodes[i].data->dt_cdm_client_name[j],
+				identifier)) {
+				rc = get_cdm_iommu_handle(cdm_handles, i);
+				break;
+			}
+		}
+		mutex_unlock(&cdm_mgr.nodes[i].lock);
+		if (rc == 0)
+			break;
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_get_iommu_handle);
+
+int cam_cdm_acquire(struct cam_cdm_acquire_data *data)
+{
+	int rc = -EPERM;
+	struct cam_hw_intf *hw;
+	struct cam_hw_info *cdm_hw;
+	struct cam_cdm *core = NULL;
+	uint32_t hw_index = 0;
+
+	if ((!data) || (!data->base_array_cnt))
+		return -EINVAL;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return rc;
+	}
+
+	if (data->id > CAM_CDM_HW_ANY) {
+		CAM_ERR(CAM_CDM,
+			"only CAM_CDM_VIRTUAL/CAM_CDM_HW_ANY is supported");
+		rc = -EPERM;
+		goto end;
+	}
+	rc = get_cdm_index_by_id(data->identifier, data->cell_index,
+		&hw_index);
+	if ((rc < 0) && (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM)) {
+		CAM_ERR(CAM_CDM, "Failed to identify associated hw id");
+		goto end;
+	} else {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			cdm_hw = hw->hw_priv;
+			core = (struct cam_cdm *)cdm_hw->core_info;
+			data->id = core->id;
+			CAM_DBG(CAM_CDM,
+				"Device = %s, hw_index = %d, CDM id = %d",
+				data->identifier, hw_index, data->id);
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_ACQUIRE, data,
+				sizeof(struct cam_cdm_acquire_data));
+			if (rc < 0) {
+				CAM_ERR(CAM_CDM, "CDM hw acquire failed");
+				goto end;
+			}
+		} else {
+			CAM_ERR(CAM_CDM, "idx %d doesn't have acquire ops",
+				hw_index);
+			rc = -EPERM;
+		}
+	}
+end:
+	if (rc < 0) {
+		CAM_ERR(CAM_CDM, "CDM acquire failed for id=%d name=%s, idx=%d",
+			data->id, data->identifier, data->cell_index);
+		put_cdm_mgr_refcount();
+	}
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_acquire);
+
+struct cam_cdm_utils_ops *cam_cdm_publish_ops(void)
+{
+	struct cam_hw_version cdm_version;
+
+	cdm_version.major = 1;
+	cdm_version.minor = 0;
+	cdm_version.incr = 0;
+	cdm_version.reserved = 0;
+
+	return cam_cdm_get_ops(0, &cdm_version, true);
+}
+EXPORT_SYMBOL(cam_cdm_publish_ops);
+
+int cam_cdm_release(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EPERM;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+					CAM_CDM_HW_INTF_CMD_RELEASE, &handle,
+					sizeof(handle));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"hw release failed for handle=%x",
+					handle);
+		} else
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have release ops",
+				hw_index);
+	}
+	put_cdm_mgr_refcount();
+	if (rc == 0)
+		put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_release);
+
+
+int cam_cdm_submit_bls(uint32_t handle, struct cam_cdm_bl_request *data)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (!data)
+		return rc;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		struct cam_cdm_hw_intf_cmd_submit_bl req;
+
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			req.data = data;
+			req.handle = handle;
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_SUBMIT_BL, &req,
+				sizeof(struct cam_cdm_hw_intf_cmd_submit_bl));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"hw submit bl failed for handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have submit ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_submit_bls);
+
+int cam_cdm_stream_on(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+			if (hw && hw->hw_ops.start) {
+				rc = hw->hw_ops.start(hw->hw_priv, &handle,
+						sizeof(uint32_t));
+				if (rc < 0)
+					CAM_ERR(CAM_CDM,
+						"hw start failed handle=%x",
+						handle);
+			} else {
+				CAM_ERR(CAM_CDM,
+					"hw idx %d doesn't have start ops",
+					hw_index);
+			}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_stream_on);
+
+int cam_cdm_stream_off(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.stop) {
+			rc = hw->hw_ops.stop(hw->hw_priv, &handle,
+					sizeof(uint32_t));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM, "hw stop failed handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have stop ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_stream_off);
+
+int cam_cdm_reset_hw(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+					CAM_CDM_HW_INTF_CMD_RESET_HW, &handle,
+					sizeof(handle));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"CDM hw release failed for handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have release ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_reset_hw);
+
+int cam_cdm_flush_hw(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_FLUSH_HW, &handle,
+				sizeof(handle));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"CDM hw release failed for handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have release ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_flush_hw);
+
+int cam_cdm_handle_error(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd) {
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_HANDLE_ERROR,
+				&handle,
+				sizeof(handle));
+			if (rc < 0)
+				CAM_ERR(CAM_CDM,
+					"CDM hw release failed for handle=%x",
+					handle);
+		} else {
+			CAM_ERR(CAM_CDM, "hw idx %d doesn't have release ops",
+				hw_index);
+		}
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_handle_error);
+
+int cam_cdm_detect_hang_error(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd)
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_CMD_HANG_DETECT,
+				&handle,
+				sizeof(handle));
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cdm_detect_hang_error);
+
+int cam_cdm_dump_debug_registers(uint32_t handle)
+{
+	uint32_t hw_index;
+	int rc = -EINVAL;
+	struct cam_hw_intf *hw;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	hw_index = CAM_CDM_GET_HW_IDX(handle);
+	if (hw_index < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM) {
+		hw = cdm_mgr.nodes[hw_index].device;
+		if (hw && hw->hw_ops.process_cmd)
+			rc = hw->hw_ops.process_cmd(hw->hw_priv,
+				CAM_CDM_HW_INTF_DUMP_DBG_REGS,
+				&handle,
+				sizeof(handle));
+	}
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+
+int cam_cdm_intf_register_hw_cdm(struct cam_hw_intf *hw,
+	struct cam_cdm_private_dt_data *data, enum cam_cdm_type type,
+	uint32_t *index)
+{
+	int rc = -EINVAL;
+
+	if ((!hw) || (!data) || (!index))
+		return rc;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return rc;
+	}
+
+	mutex_lock(&cam_cdm_mgr_lock);
+	if ((type == CAM_VIRTUAL_CDM) &&
+		(!cdm_mgr.nodes[CAM_SW_CDM_INDEX].device)) {
+		mutex_lock(&cdm_mgr.nodes[CAM_SW_CDM_INDEX].lock);
+		cdm_mgr.nodes[CAM_SW_CDM_INDEX].device = hw;
+		cdm_mgr.nodes[CAM_SW_CDM_INDEX].data = data;
+		*index = cdm_mgr.cdm_count;
+		mutex_unlock(&cdm_mgr.nodes[CAM_SW_CDM_INDEX].lock);
+		cdm_mgr.cdm_count++;
+		rc = 0;
+	} else if ((type == CAM_HW_CDM) && (cdm_mgr.cdm_count > 0)) {
+		mutex_lock(&cdm_mgr.nodes[cdm_mgr.cdm_count].lock);
+		cdm_mgr.nodes[cdm_mgr.cdm_count].device = hw;
+		cdm_mgr.nodes[cdm_mgr.cdm_count].data = data;
+		*index = cdm_mgr.cdm_count;
+		mutex_unlock(&cdm_mgr.nodes[cdm_mgr.cdm_count].lock);
+		cdm_mgr.cdm_count++;
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_CDM, "CDM registration failed type=%d count=%d",
+			type, cdm_mgr.cdm_count);
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+
+int cam_cdm_intf_deregister_hw_cdm(struct cam_hw_intf *hw,
+	struct cam_cdm_private_dt_data *data, enum cam_cdm_type type,
+	uint32_t index)
+{
+	int rc = -EINVAL;
+
+	if ((!hw) || (!data))
+		return rc;
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		rc = -EPERM;
+		return rc;
+	}
+
+	mutex_lock(&cam_cdm_mgr_lock);
+	if ((type == CAM_VIRTUAL_CDM) &&
+		(hw == cdm_mgr.nodes[CAM_SW_CDM_INDEX].device) &&
+		(index == CAM_SW_CDM_INDEX)) {
+		mutex_lock(&cdm_mgr.nodes[cdm_mgr.cdm_count].lock);
+		cdm_mgr.nodes[CAM_SW_CDM_INDEX].device = NULL;
+		cdm_mgr.nodes[CAM_SW_CDM_INDEX].data = NULL;
+		mutex_unlock(&cdm_mgr.nodes[cdm_mgr.cdm_count].lock);
+		rc = 0;
+	} else if ((type == CAM_HW_CDM) &&
+		(hw == cdm_mgr.nodes[index].device)) {
+		mutex_lock(&cdm_mgr.nodes[index].lock);
+		cdm_mgr.nodes[index].device = NULL;
+		cdm_mgr.nodes[index].data = NULL;
+		mutex_unlock(&cdm_mgr.nodes[index].lock);
+		cdm_mgr.cdm_count--;
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_CDM, "CDM Deregistration failed type=%d index=%d",
+			type, index);
+	}
+	mutex_unlock(&cam_cdm_mgr_lock);
+	put_cdm_mgr_refcount();
+
+	return rc;
+}
+
+static int cam_cdm_intf_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i, rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	rc = cam_cdm_intf_mgr_soc_get_dt_properties(pdev, &cdm_mgr);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to get dt properties");
+		return rc;
+	}
+	mutex_lock(&cam_cdm_mgr_lock);
+	for (i = 0 ; i < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM; i++) {
+		mutex_init(&cdm_mgr.nodes[i].lock);
+		cdm_mgr.nodes[i].device = NULL;
+		cdm_mgr.nodes[i].data = NULL;
+		cdm_mgr.nodes[i].refcount = 0;
+	}
+	cdm_mgr.probe_done = true;
+	cdm_mgr.refcount = 0;
+	mutex_unlock(&cam_cdm_mgr_lock);
+	rc = cam_virtual_cdm_probe(pdev);
+	if (rc) {
+		mutex_lock(&cam_cdm_mgr_lock);
+		cdm_mgr.probe_done = false;
+		for (i = 0 ; i < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM; i++) {
+			if (cdm_mgr.nodes[i].device || cdm_mgr.nodes[i].data ||
+				(cdm_mgr.nodes[i].refcount != 0))
+				CAM_ERR(CAM_CDM,
+					"Valid node present in index=%d", i);
+			mutex_destroy(&cdm_mgr.nodes[i].lock);
+			cdm_mgr.nodes[i].device = NULL;
+			cdm_mgr.nodes[i].data = NULL;
+			cdm_mgr.nodes[i].refcount = 0;
+		}
+		mutex_unlock(&cam_cdm_mgr_lock);
+	}
+
+	CAM_DBG(CAM_CDM, "CDM Intf component bound successfully");
+
+	return rc;
+}
+
+static void cam_cdm_intf_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	if (get_cdm_mgr_refcount()) {
+		CAM_ERR(CAM_CDM, "CDM intf mgr get refcount failed");
+		return;
+	}
+
+	if (cam_virtual_cdm_remove(pdev)) {
+		CAM_ERR(CAM_CDM, "Virtual CDM remove failed");
+		return;
+	}
+	put_cdm_mgr_refcount();
+
+	mutex_lock(&cam_cdm_mgr_lock);
+	if (cdm_mgr.refcount != 0) {
+		CAM_ERR(CAM_CDM, "cdm manger refcount not zero %d",
+			cdm_mgr.refcount);
+		goto end;
+	}
+
+	for (i = 0 ; i < CAM_CDM_INTF_MGR_MAX_SUPPORTED_CDM; i++) {
+		if (cdm_mgr.nodes[i].device || cdm_mgr.nodes[i].data ||
+			(cdm_mgr.nodes[i].refcount != 0)) {
+			CAM_ERR(CAM_CDM, "Valid node present in index=%d", i);
+			goto end;
+		}
+		mutex_destroy(&cdm_mgr.nodes[i].lock);
+		cdm_mgr.nodes[i].device = NULL;
+		cdm_mgr.nodes[i].data = NULL;
+		cdm_mgr.nodes[i].refcount = 0;
+	}
+	cdm_mgr.probe_done = false;
+
+end:
+	mutex_unlock(&cam_cdm_mgr_lock);
+}
+
+const static struct component_ops cam_cdm_intf_component_ops = {
+	.bind = cam_cdm_intf_component_bind,
+	.unbind = cam_cdm_intf_component_unbind,
+};
+
+static int cam_cdm_intf_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CDM, "Adding CDM INTF component");
+	rc = component_add(&pdev->dev, &cam_cdm_intf_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CDM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_cdm_intf_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_cdm_intf_component_ops);
+	return 0;
+}
+
+struct platform_driver cam_cdm_intf_driver = {
+	.probe = cam_cdm_intf_probe,
+	.remove = cam_cdm_intf_remove,
+	.driver = {
+		.name = "msm_cam_cdm_intf",
+		.owner = THIS_MODULE,
+		.of_match_table = msm_cam_cdm_intf_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_cdm_intf_init_module(void)
+{
+	return platform_driver_register(&cam_cdm_intf_driver);
+}
+
+void cam_cdm_intf_exit_module(void)
+{
+	platform_driver_unregister(&cam_cdm_intf_driver);
+}
+
+MODULE_DESCRIPTION("MSM Camera CDM Intf driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_intf_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_intf_api.h
@@ -0,0 +1,342 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAM_CDM_API_H_
+#define _CAM_CDM_API_H_
+
+#include <media/cam_defs.h>
+#include "cam_cdm_util.h"
+#include "cam_soc_util.h"
+
+#define CAM_CDM_BL_CMD_MAX  25
+
+/* enum cam_cdm_id - Enum for possible CAM CDM hardwares */
+enum cam_cdm_id {
+	CAM_CDM_VIRTUAL,
+	CAM_CDM_HW_ANY,
+	CAM_CDM_CPAS,
+	CAM_CDM_IFE,
+	CAM_CDM_TFE,
+	CAM_CDM_OPE,
+	CAM_CDM_IPE0,
+	CAM_CDM_IPE1,
+	CAM_CDM_BPS,
+	CAM_CDM_VFE,
+	CAM_CDM_RT,
+	CAM_CDM_MAX
+};
+
+/* enum cam_cdm_cb_status - Enum for possible CAM CDM callback */
+enum cam_cdm_cb_status {
+	CAM_CDM_CB_STATUS_BL_SUCCESS,
+	CAM_CDM_CB_STATUS_INVALID_BL_CMD,
+	CAM_CDM_CB_STATUS_PAGEFAULT,
+	CAM_CDM_CB_STATUS_HW_RESET_ONGOING,
+	CAM_CDM_CB_STATUS_HW_RESET_DONE,
+	CAM_CDM_CB_STATUS_HW_FLUSH,
+	CAM_CDM_CB_STATUS_HW_RESUBMIT,
+	CAM_CDM_CB_STATUS_HW_ERROR,
+	CAM_CDM_CB_STATUS_UNKNOWN_ERROR,
+};
+
+/* enum cam_cdm_bl_cmd_addr_type - Enum for possible CDM bl cmd addr types */
+enum cam_cdm_bl_cmd_addr_type {
+	CAM_CDM_BL_CMD_TYPE_MEM_HANDLE,
+	CAM_CDM_BL_CMD_TYPE_HW_IOVA,
+	CAM_CDM_BL_CMD_TYPE_KERNEL_IOVA,
+};
+
+/* enum cam_cdm_bl_fifo - interface commands.*/
+enum cam_cdm_bl_fifo_queue {
+	CAM_CDM_BL_FIFO_0,
+	CAM_CDM_BL_FIFO_1,
+	CAM_CDM_BL_FIFO_2,
+	CAM_CDM_BL_FIFO_3,
+	CAM_CDM_BL_FIFO_MAX,
+};
+
+/**
+ * struct cam_cdm_acquire_data - Cam CDM acquire data structure
+ *
+ * @identifier : Input identifier string which is the device label from dt
+ *                     like vfe, ife, jpeg etc
+ * @cell_index : Input integer identifier pointing to the cell index from dt
+ *                     of the device. This can be used to form a unique string
+ *                     with @identifier like vfe0, ife1, jpeg0 etc
+ * @id : ID of a specific or any CDM HW which needs to be acquired.
+ * @userdata : Input private data which will be returned as part
+ *                     of callback.
+ * @cam_cdm_callback : Input callback pointer for triggering the
+ *                     callbacks from CDM driver
+ *                     @handle : CDM Client handle
+ *                     @userdata : Private data given at the time of acquire
+ *                     @status : Callback status
+ *                     @cookie : Cookie if the callback is gen irq status
+ * @base_array_cnt : Input number of ioremapped address pair pointing
+ *                     in base_array, needed only if selected cdm is a virtual.
+ * @base_array : Input pointer to ioremapped address pair arrary
+ *                     needed only if selected cdm is a virtual.
+ * @priority : Priority of the client.
+ * @cdm_version : CDM version is output while acquiring HW cdm and
+ *                     it is Input while acquiring virtual cdm.
+ *                     Currently fixing it to one version below
+ *                     acquire API.
+ * @ops : Output pointer updated by cdm driver to the CDM
+ *                     util ops for this HW version of CDM acquired.
+ * @handle  : Output Unique handle generated for this acquire
+ *
+ */
+struct cam_cdm_acquire_data {
+	char identifier[128];
+	uint32_t cell_index;
+	enum cam_cdm_id id;
+	void *userdata;
+	void (*cam_cdm_callback)(uint32_t handle, void *userdata,
+		enum cam_cdm_cb_status status, uint64_t cookie);
+	uint32_t base_array_cnt;
+	struct cam_soc_reg_map *base_array[CAM_SOC_MAX_BLOCK];
+	enum cam_cdm_bl_fifo_queue priority;
+	struct cam_hw_version cdm_version;
+	struct cam_cdm_utils_ops *ops;
+	uint32_t handle;
+};
+
+/**
+ * struct cam_cdm_bl_cmd - Cam CDM HW bl command
+ *
+ * @bl_addr : Union of all three type for CDM BL commands
+ * @mem_handle : Input mem handle of bl cmd
+ * @offset : Input offset of the actual bl cmd in the memory pointed
+ *           by mem_handle
+ * @len : Input length of the BL command, Cannot be more than 1MB and
+ *           this is will be validated with offset+size of the memory pointed
+ *           by mem_handle
+ * @enable_debug_gen_irq : bool flag to submit extra gen_irq afteR bl_command
+ * @arbitrate : bool flag to arbitrate on submitted BL boundary
+ */
+struct cam_cdm_bl_cmd {
+	union {
+		int32_t mem_handle;
+		uint32_t *hw_iova;
+		uintptr_t kernel_iova;
+	} bl_addr;
+	uint32_t offset;
+	uint32_t len;
+	bool enable_debug_gen_irq;
+	bool arbitrate;
+};
+
+/**
+ * struct cam_cdm_bl_request - Cam CDM HW base & length (BL) request
+ *
+ * @flag : 1 for callback needed and 0 for no callback when this BL
+ *            request is done
+ * @userdata :Input private data which will be returned as part
+ *             of callback if request for this bl request in flags.
+ * @cookie : Cookie if the callback is gen irq status
+ * @type : type of the submitted bl cmd address.
+ * @cmd_arrary_count : Input number of BL commands to be submitted to CDM
+ * @gen_irq_arb : enum for setting arbitration in gen_irq
+ * @bl_cmd_array     : Input payload holding the BL cmd's arrary
+ *                     to be sumbitted.
+ *
+ */
+struct cam_cdm_bl_request {
+	int flag;
+	void *userdata;
+	uint64_t cookie;
+	enum cam_cdm_bl_cmd_addr_type type;
+	uint32_t cmd_arrary_count;
+	bool gen_irq_arb;
+    union {
+        struct cam_cdm_bl_cmd cmd[1];
+        __DECLARE_FLEX_ARRAY(struct cam_cdm_bl_cmd, cmd_flex);
+    };
+};
+
+/**
+ * struct cam_cdm_bl_data - last submiited CDM BL data
+ *
+ * @mem_handle : Input mem handle of bl cmd
+ * @hw_addr    : Hw address of submitted Bl command
+ * @offset     : Input offset of the actual bl cmd in the memory pointed
+ *               by mem_handle
+ * @len        : length of submitted Bl command to CDM.
+ * @input_len  : Input length of the BL command, Cannot be more than 1MB and
+ *           this is will be validated with offset+size of the memory pointed
+ *           by mem_handle
+ * @type       :  CDM bl cmd addr types.
+ */
+struct cam_cdm_bl_data {
+	int32_t mem_handle;
+	dma_addr_t hw_addr;
+	uint32_t offset;
+	size_t len;
+	uint32_t  input_len;
+	enum cam_cdm_bl_cmd_addr_type type;
+};
+
+/**
+ * struct cam_cdm_bl_info
+ *
+ * @bl_count   : No. of Bl commands submiited to CDM.
+ * @cmd        : payload holding the BL cmd's arrary
+ *               that is sumbitted.
+ *
+ */
+struct cam_cdm_bl_info {
+	int32_t bl_count;
+	struct cam_cdm_bl_data cmd[CAM_CDM_BL_CMD_MAX];
+};
+
+/**
+ * @brief : API to get the CDM capabilities for a camera device type
+ *
+ * @identifier : Input pointer to a string which is the device label from dt
+ *                   like vfe, ife, jpeg etc, We do not need cell index
+ *                   assuming all devices of a single type maps to one SMMU
+ *                   client
+ * @cdm_handles : Input iommu handle memory pointer to update handles
+ *
+ * @return 0 on success
+ */
+int cam_cdm_get_iommu_handle(char *identifier,
+	struct cam_iommu_handle *cdm_handles);
+
+/**
+ * @brief : API to acquire a CDM
+ *
+ * @data : Input data for the CDM to be acquired
+ *
+ * @return 0 on success
+ */
+int cam_cdm_acquire(struct cam_cdm_acquire_data *data);
+
+/**
+ * @brief : API to release a previously acquired CDM
+ *
+ * @handle : Input handle for the CDM to be released
+ *
+ * @return 0 on success
+ */
+int cam_cdm_release(uint32_t handle);
+
+/**
+ * @brief : API to submit the base & length (BL's) for acquired CDM
+ *
+ * @handle : Input cdm handle to which the BL's needs to be sumbitted.
+ * @data   : Input pointer to the BL's to be sumbitted
+ *
+ * @return 0 on success
+ */
+int cam_cdm_submit_bls(uint32_t handle, struct cam_cdm_bl_request *data);
+
+/**
+ * @brief : API to stream ON a previously acquired CDM,
+ *          during this we turn on/off clocks/power based on active clients.
+ *
+ * @handle : Input handle for the CDM to be released
+ *
+ * @return 0 on success
+ */
+int cam_cdm_stream_on(uint32_t handle);
+
+/**
+ * @brief : API to stream OFF a previously acquired CDM,
+ *          during this we turn on/off clocks/power based on active clients.
+ *
+ * @handle : Input handle for the CDM to be released
+ *
+ * @return 0 on success
+ */
+int cam_cdm_stream_off(uint32_t handle);
+
+/**
+ * @brief : API to reset previously acquired CDM,
+ *          this should be only performed only if the CDM is private.
+ *
+ * @handle : Input handle of the CDM to reset
+ *
+ * @return 0 on success
+ */
+int cam_cdm_reset_hw(uint32_t handle);
+
+/**
+ * @brief : API to publish CDM ops to HW blocks like IFE
+ *
+ * @return : CDM operations
+ *
+ */
+struct cam_cdm_utils_ops *cam_cdm_publish_ops(void);
+
+/**
+ * @brief : API to register CDM hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_hw_cdm_init_module(void);
+
+/**
+ * @brief : API to register CDM interface to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_cdm_intf_init_module(void);
+
+/**
+ * @brief : API to remove CDM interface from platform framework.
+ */
+void cam_cdm_intf_exit_module(void);
+
+/**
+ * @brief : API to remove CDM hw from platform framework.
+ */
+void cam_hw_cdm_exit_module(void);
+
+/**
+ * @brief : API to flush previously acquired CDM,
+ *          this should be only performed only if the CDM is private.
+ *
+ * @handle : Input handle of the CDM to reset
+ *
+ * @return 0 on success
+ */
+int cam_cdm_flush_hw(uint32_t handle);
+
+/**
+ * @brief : API to detect culprit bl_tag in previously acquired CDM,
+ *          this should be only performed only if the CDM is private.
+ *
+ * @handle : Input handle of the CDM to reset
+ *
+ * @return 0 on success
+ */
+int cam_cdm_handle_error(uint32_t handle);
+
+/**
+ * @brief : API get CDM ops
+ *
+ * @return : CDM operations
+ *
+ */
+struct cam_cdm_utils_ops *cam_cdm_publish_ops(void);
+
+/**
+ * @brief : API to detect hang in previously acquired CDM,
+ *          this should be only performed only if the CDM is private.
+ *
+ * @handle : Input handle of the CDM to detect hang
+ *
+ * @return 0 on success
+ */
+int cam_cdm_detect_hang_error(uint32_t handle);
+
+/**
+ * @brief : API to dump the CDM Debug registers
+ *
+ * @handle : Input handle of the CDM to dump the registers
+ *
+ * @return 0 on success
+ */
+int cam_cdm_dump_debug_registers(uint32_t handle);
+#endif /* _CAM_CDM_API_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_soc.c
@@ -0,0 +1,235 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include "cam_soc_util.h"
+#include "cam_smmu_api.h"
+#include "cam_cdm.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cdm_soc.h"
+
+#define CAM_CDM_OFFSET_FROM_REG(x, y) ((x)->offsets[y].offset)
+#define CAM_CDM_ATTR_FROM_REG(x, y) ((x)->offsets[y].attribute)
+
+bool cam_cdm_read_hw_reg(struct cam_hw_info *cdm_hw,
+	uint32_t reg, uint32_t *value)
+{
+	void __iomem *reg_addr;
+	void __iomem *base =
+		cdm_hw->soc_info.reg_map[CAM_HW_CDM_BASE_INDEX].mem_base;
+	resource_size_t mem_len =
+		cdm_hw->soc_info.reg_map[CAM_HW_CDM_BASE_INDEX].size;
+
+	CAM_DBG(CAM_CDM, "E: b=%pK blen=%d off=%x", (void __iomem *)base,
+		(int)mem_len, reg);
+
+	reg_addr = (base + reg);
+	if (reg_addr > (base + mem_len)) {
+		CAM_ERR_RATE_LIMIT(CAM_CDM,
+			"Invalid mapped region %d", reg);
+		goto permission_error;
+	}
+	*value = cam_io_r_mb(reg_addr);
+	CAM_DBG(CAM_CDM, "X b=%pK off=%x val=%x",
+		(void __iomem *)base, reg,
+		*value);
+	return false;
+
+permission_error:
+	*value = 0;
+	return true;
+
+}
+
+bool cam_cdm_write_hw_reg(struct cam_hw_info *cdm_hw,
+	uint32_t reg, uint32_t value)
+{
+	void __iomem *reg_addr;
+	void __iomem *base =
+		cdm_hw->soc_info.reg_map[CAM_HW_CDM_BASE_INDEX].mem_base;
+	resource_size_t mem_len =
+		cdm_hw->soc_info.reg_map[CAM_HW_CDM_BASE_INDEX].size;
+
+	CAM_DBG(CAM_CDM, "E: b=%pK off=%x val=%x", (void __iomem *)base,
+		reg, value);
+
+	reg_addr = (base + reg);
+	if (reg_addr > (base + mem_len)) {
+		CAM_ERR_RATE_LIMIT(CAM_CDM,
+			"Accessing invalid region:%d\n",
+			reg);
+		goto permission_error;
+	}
+	cam_io_w_mb(value, reg_addr);
+	return false;
+
+permission_error:
+	return true;
+
+}
+
+int cam_cdm_soc_load_dt_private(struct platform_device *pdev,
+	struct cam_cdm_private_dt_data *cdm_pvt_data)
+{
+	int i, rc = -EINVAL, num_fifo_entries = 0, num_clients = 0;
+
+	num_clients = of_property_count_strings(
+			pdev->dev.of_node, "cdm-client-names");
+	if ((num_clients <= 0) ||
+		(num_clients > CAM_PER_CDM_MAX_REGISTERED_CLIENTS)) {
+		CAM_ERR(CAM_CDM, "Invalid count of client names count=%d",
+			num_clients);
+
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cdm_pvt_data->dt_num_supported_clients = (uint32_t)num_clients;
+	CAM_DBG(CAM_CDM, "Num supported cdm_client = %u",
+		cdm_pvt_data->dt_num_supported_clients);
+
+	cdm_pvt_data->dt_cdm_shared = true;
+
+	for (i = 0; i < cdm_pvt_data->dt_num_supported_clients; i++) {
+		rc = of_property_read_string_index(pdev->dev.of_node,
+			"cdm-client-names", i,
+			&(cdm_pvt_data->dt_cdm_client_name[i]));
+		CAM_DBG(CAM_CDM, "cdm-client-names[%d] = %s", i,
+			cdm_pvt_data->dt_cdm_client_name[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_CDM,
+				"Reading cdm-client-names failed for client: %d",
+				i);
+			goto end;
+		}
+
+	}
+
+	cdm_pvt_data->is_single_ctx_cdm =
+		of_property_read_bool(pdev->dev.of_node,
+			"single-context-cdm");
+
+	rc = of_property_read_u8(pdev->dev.of_node, "cdm-priority-group",
+			&cdm_pvt_data->priority_group);
+	if (rc < 0) {
+		cdm_pvt_data->priority_group = 0;
+		rc = 0;
+	}
+
+	cdm_pvt_data->config_fifo = of_property_read_bool(pdev->dev.of_node,
+		"config-fifo");
+	if (cdm_pvt_data->config_fifo) {
+		num_fifo_entries = of_property_count_u32_elems(
+			pdev->dev.of_node,
+			"fifo-depths");
+		if (num_fifo_entries != CAM_CDM_NUM_BL_FIFO) {
+			CAM_ERR(CAM_CDM,
+				"Wrong number of configurable FIFOs %d",
+				num_fifo_entries);
+			rc = -EINVAL;
+			goto end;
+		}
+		for (i = 0; i < num_fifo_entries; i++) {
+			rc = of_property_read_u32_index(pdev->dev.of_node,
+				"fifo-depths", i, &cdm_pvt_data->fifo_depth[i]);
+			if (rc < 0) {
+				CAM_ERR(CAM_CDM,
+					"Unable to read fifo-depth rc %d",
+					rc);
+				goto end;
+			}
+			CAM_DBG(CAM_CDM, "FIFO%d depth is %d",
+				i, cdm_pvt_data->fifo_depth[i]);
+		}
+	} else {
+		for (i = 0; i < CAM_CDM_BL_FIFO_MAX; i++) {
+			cdm_pvt_data->fifo_depth[i] =
+				CAM_CDM_BL_FIFO_LENGTH_MAX_DEFAULT;
+			CAM_DBG(CAM_CDM, "FIFO%d depth is %d",
+				i, cdm_pvt_data->fifo_depth[i]);
+		}
+	}
+end:
+	return rc;
+}
+
+int cam_hw_cdm_soc_get_dt_properties(struct cam_hw_info *cdm_hw,
+	const struct of_device_id *table)
+{
+	int rc;
+	struct cam_hw_soc_info *soc_ptr;
+	const struct of_device_id *id;
+	struct cam_cdm *cdm_core = NULL;
+
+	if (!cdm_hw  || (cdm_hw->soc_info.soc_private)
+		|| !(cdm_hw->soc_info.pdev))
+		return -EINVAL;
+
+	cdm_core = cdm_hw->core_info;
+	soc_ptr = &cdm_hw->soc_info;
+
+	rc = cam_soc_util_get_dt_properties(soc_ptr);
+	if (rc != 0) {
+		CAM_ERR(CAM_CDM, "Failed to retrieve the CDM dt properties");
+		goto end;
+	}
+
+	soc_ptr->soc_private = kzalloc(
+			sizeof(struct cam_cdm_private_dt_data),
+			GFP_KERNEL);
+	if (!soc_ptr->soc_private)
+		return -ENOMEM;
+
+	rc = cam_cdm_soc_load_dt_private(soc_ptr->pdev,
+		soc_ptr->soc_private);
+	if (rc != 0) {
+		CAM_ERR(CAM_CDM, "Failed to load CDM dt private data");
+		goto error;
+	}
+
+	id = of_match_node(table, soc_ptr->pdev->dev.of_node);
+	if ((!id) || !(id->data)) {
+		CAM_ERR(CAM_CDM, "Failed to retrieve the CDM id table");
+		goto error;
+	}
+	cdm_core->offsets =
+		(struct cam_cdm_hw_reg_offset *)id->data;
+
+	CAM_DBG(CAM_CDM, "name %s", cdm_core->name);
+
+	snprintf(cdm_core->name, sizeof(cdm_core->name), "%s%d",
+		id->compatible, soc_ptr->index);
+
+	CAM_DBG(CAM_CDM, "name %s", cdm_core->name);
+
+	goto end;
+
+error:
+	rc = -EINVAL;
+	kfree(soc_ptr->soc_private);
+	soc_ptr->soc_private = NULL;
+end:
+	return rc;
+}
+
+int cam_cdm_intf_mgr_soc_get_dt_properties(
+	struct platform_device *pdev, struct cam_cdm_intf_mgr *mgr)
+{
+	int rc;
+
+	rc = of_property_read_u32(pdev->dev.of_node,
+		"num-hw-cdm", &mgr->dt_supported_hw_cdm);
+	CAM_DBG(CAM_CDM, "Number of HW cdm supported =%d",
+		mgr->dt_supported_hw_cdm);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_soc.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_SOC_H_
+#define _CAM_CDM_SOC_H_
+
+#define CAM_HW_CDM_CPAS_0_NAME   "qcom,cam170-cpas-cdm0"
+#define CAM_HW_CDM_CPAS_NAME_1_0 "qcom,cam-cpas-cdm1_0"
+#define CAM_HW_CDM_CPAS_NAME_1_1 "qcom,cam-cpas-cdm1_1"
+#define CAM_HW_CDM_CPAS_NAME_1_2 "qcom,cam-cpas-cdm1_2"
+#define CAM_HW_CDM_IFE_NAME_1_2  "qcom,cam-ife-cdm1_2"
+#define CAM_HW_CDM_CPAS_NAME_2_0 "qcom,cam-cpas-cdm2_0"
+#define CAM_HW_CDM_OPE_NAME_2_0  "qcom,cam-ope-cdm2_0"
+#define CAM_HW_CDM_CPAS_NAME_2_1 "qcom,cam-cpas-cdm2_1"
+#define CAM_HW_CDM_RT_NAME_2_1   "qcom,cam-rt-cdm2_1"
+#define CAM_HW_CDM_OPE_NAME_2_1  "qcom,cam-ope-cdm2_1"
+
+int cam_hw_cdm_soc_get_dt_properties(struct cam_hw_info *cdm_hw,
+	const struct of_device_id *table);
+bool cam_cdm_read_hw_reg(struct cam_hw_info *cdm_hw,
+	uint32_t reg, uint32_t *value);
+bool cam_cdm_write_hw_reg(struct cam_hw_info *cdm_hw,
+	uint32_t reg, uint32_t value);
+int cam_cdm_intf_mgr_soc_get_dt_properties(
+	struct platform_device *pdev,
+	struct cam_cdm_intf_mgr *mgr);
+int cam_cdm_soc_load_dt_private(struct platform_device *pdev,
+	struct cam_cdm_private_dt_data *ptr);
+
+#endif /* _CAM_CDM_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_util.c
@@ -0,0 +1,1099 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/bug.h>
+
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm_util.h"
+#include "cam_cdm.h"
+#include "cam_io_util.h"
+
+#include "cam_cdm_virtual.h"
+
+#define CAM_CDM_DWORD 4
+
+#define CAM_CDM_SW_CMD_COUNT    2
+#define CAM_CMD_LENGTH_MASK     0xFFFF
+#define CAM_CDM_COMMAND_OFFSET  24
+#define CAM_CDM_REG_OFFSET_MASK 0x00FFFFFF
+
+#define CAM_CDM_DMI_DATA_HI_OFFSET   8
+#define CAM_CDM_DMI_DATA_OFFSET      8
+#define CAM_CDM_DMI_DATA_LO_OFFSET   12
+
+static unsigned int CDMCmdHeaderSizes[
+	CAM_CDM_CMD_PRIVATE_BASE + CAM_CDM_SW_CMD_COUNT] = {
+	0, /* UNUSED*/
+	3, /* DMI*/
+	0, /* UNUSED*/
+	2, /* RegContinuous*/
+	1, /* RegRandom*/
+	2, /* BUFFER_INDIREC*/
+	2, /* GenerateIRQ*/
+	3, /* WaitForEvent*/
+	1, /* ChangeBase*/
+	1, /* PERF_CONTROL*/
+	3, /* DMI32*/
+	3, /* DMI64*/
+	3, /* WaitCompEvent*/
+	3, /* ClearCompEvent*/
+	3, /* WaitPrefetchDisable*/
+};
+
+/**
+ * struct cdm_regrandom_cmd - Definition for CDM random register command.
+ * @count: Number of register writes
+ * @reserved: reserved bits
+ * @cmd: Command ID (CDMCmd)
+ */
+struct cdm_regrandom_cmd {
+	unsigned int count    : 16;
+	unsigned int reserved : 8;
+	unsigned int cmd      : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_regcontinuous_cmd - Definition for a CDM register range command.
+ * @count: Number of register writes
+ * @reserved0: reserved bits
+ * @cmd: Command ID (CDMCmd)
+ * @offset: Start address of the range of registers
+ * @reserved1: reserved bits
+ */
+struct cdm_regcontinuous_cmd {
+	unsigned int count     : 16;
+	unsigned int reserved0 : 8;
+	unsigned int cmd       : 8;
+	unsigned int offset    : 24;
+	unsigned int reserved1 : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_dmi_cmd - Definition for a CDM DMI command.
+ * @length: Number of bytes in LUT - 1
+ * @reserved: reserved bits
+ * @cmd: Command ID (CDMCmd)
+ * @addr: Address of the LUT in memory
+ * @DMIAddr: Address of the target DMI config register
+ * @DMISel: DMI identifier
+ */
+struct cdm_dmi_cmd {
+	unsigned int length   : 16;
+	unsigned int reserved : 8;
+	unsigned int cmd      : 8;
+	unsigned int addr;
+	unsigned int DMIAddr  : 24;
+	unsigned int DMISel   : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_indirect_cmd - Definition for a CDM indirect buffer command.
+ * @length: Number of bytes in buffer - 1
+ * @reserved: reserved bits
+ * @cmd: Command ID (CDMCmd)
+ * @addr:  Device address of the indirect buffer
+ */
+struct cdm_indirect_cmd {
+	unsigned int length     : 16;
+	unsigned int reserved   : 8;
+	unsigned int cmd        : 8;
+	unsigned int addr;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_changebase_cmd - Definition for CDM base address change command.
+ * @base: Base address to be changed to
+ * @cmd:Command ID (CDMCmd)
+ */
+struct cdm_changebase_cmd {
+	unsigned int base   : 24;
+	unsigned int cmd    : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_wait_event_cmd - Definition for a CDM Gen IRQ command.
+ * @mask: Mask for the events
+ * @id: ID to read back for debug
+ * @iw_reserved: reserved bits
+ * @iw: iw AHB write bit
+ * @cmd:Command ID (CDMCmd)
+ * @offset: Offset to where data is written
+ * @offset_reserved: reserved bits
+ * @data: data returned in IRQ_USR_DATA
+ */
+struct cdm_wait_event_cmd {
+	unsigned int mask             : 8;
+	unsigned int id               : 8;
+	unsigned int iw_reserved      : 7;
+	unsigned int iw               : 1;
+	unsigned int cmd              : 8;
+	unsigned int offset           : 24;
+	unsigned int offset_reserved  : 8;
+	unsigned int data;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_genirq_cmd - Definition for a CDM Wait event command.
+ * @reserved: reserved bits
+ * @cmd:Command ID (CDMCmd)
+ * @userdata: userdata returned in IRQ_USR_DATA
+ */
+struct cdm_genirq_cmd {
+	unsigned int reserved   : 24;
+	unsigned int cmd        : 8;
+	unsigned int userdata;
+} __attribute__((__packed__));
+
+/**
+ * struct cdm_perf_ctrl_cmd_t - Definition for CDM perf control command.
+ * @perf: perf command
+ * @reserved: reserved bits
+ * @cmd:Command ID (CDMCmd)
+ */
+struct cdm_perf_ctrl_cmd {
+	unsigned int perf     : 2;
+	unsigned int reserved : 22;
+	unsigned int cmd      : 8;
+} __attribute__((__packed__));
+
+struct cdm_wait_comp_event_cmd {
+	unsigned int reserved   : 8;
+	unsigned int id         : 8;
+	unsigned int id_reserved: 8;
+	unsigned int cmd        : 8;
+	unsigned int mask1;
+	unsigned int mask2;
+} __attribute__((__packed__));
+
+struct cdm_clear_comp_event_cmd {
+	unsigned int reserved   : 8;
+	unsigned int id         : 8;
+	unsigned int id_reserved: 8;
+	unsigned int cmd        : 8;
+	unsigned int mask1;
+	unsigned int mask2;
+} __attribute__((__packed__));
+
+struct cdm_prefetch_disable_event_cmd {
+	unsigned int reserved   : 8;
+	unsigned int id         : 8;
+	unsigned int id_reserved: 8;
+	unsigned int cmd        : 8;
+	unsigned int mask1;
+	unsigned int mask2;
+} __attribute__((__packed__));
+
+static uint32_t cdm_get_cmd_header_size(unsigned int command)
+{
+	return CDMCmdHeaderSizes[command];
+}
+
+static uint32_t cdm_required_size_dmi(void)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_CMD_DMI);
+}
+
+static uint32_t cdm_required_size_reg_continuous(uint32_t  numVals)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT) + numVals;
+}
+
+static uint32_t cdm_required_size_reg_random(uint32_t numRegVals)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM) +
+		(2 * numRegVals);
+}
+
+static uint32_t cdm_required_size_indirect(void)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_CMD_BUFF_INDIRECT);
+}
+
+static uint32_t cdm_required_size_genirq(void)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_CMD_GEN_IRQ);
+}
+
+static uint32_t cdm_required_size_wait_event(void)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_CMD_WAIT_EVENT);
+}
+
+static uint32_t cdm_required_size_changebase(void)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_CMD_CHANGE_BASE);
+}
+
+static uint32_t cdm_required_size_comp_wait(void)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_CMD_COMP_WAIT);
+}
+
+static uint32_t cdm_required_size_clear_comp_event(void)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_CLEAR_COMP_WAIT);
+}
+
+static uint32_t cdm_required_size_prefetch_disable(void)
+{
+	return cdm_get_cmd_header_size(CAM_CDM_WAIT_PREFETCH_DISABLE);
+}
+
+static uint32_t cdm_offsetof_dmi_addr(void)
+{
+	return offsetof(struct cdm_dmi_cmd, addr);
+}
+
+static uint32_t cdm_offsetof_indirect_addr(void)
+{
+	return offsetof(struct cdm_indirect_cmd, addr);
+}
+
+static uint32_t *cdm_write_dmi(uint32_t *pCmdBuffer, uint8_t dmiCmd,
+	uint32_t DMIAddr, uint8_t DMISel, uint32_t dmiBufferAddr,
+	uint32_t length)
+{
+	struct cdm_dmi_cmd *pHeader = (struct cdm_dmi_cmd *)pCmdBuffer;
+
+	pHeader->cmd        = CAM_CDM_CMD_DMI;
+	pHeader->addr = dmiBufferAddr;
+	pHeader->length = length;
+	pHeader->DMIAddr = DMIAddr;
+	pHeader->DMISel = DMISel;
+
+	pCmdBuffer += cdm_get_cmd_header_size(CAM_CDM_CMD_DMI);
+
+	return pCmdBuffer;
+}
+
+static uint32_t *cdm_write_regcontinuous(uint32_t *pCmdBuffer, uint32_t reg,
+	uint32_t numVals, uint32_t *pVals)
+{
+	uint32_t i;
+	struct cdm_regcontinuous_cmd *pHeader =
+		(struct cdm_regcontinuous_cmd *)pCmdBuffer;
+
+	pHeader->count = numVals;
+	pHeader->cmd = CAM_CDM_CMD_REG_CONT;
+	pHeader->reserved0 = 0;
+	pHeader->reserved1 = 0;
+	pHeader->offset = reg;
+
+	pCmdBuffer += cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT);
+
+	for (i = 0; i < numVals; i++)
+		(((uint32_t *)pCmdBuffer)[i]) = (((uint32_t *)pVals)[i]);
+
+	pCmdBuffer += numVals;
+
+	return pCmdBuffer;
+}
+
+static uint32_t *cdm_write_regrandom(uint32_t *pCmdBuffer, uint32_t numRegVals,
+	uint32_t *pRegVals)
+{
+	uint32_t i;
+	uint32_t *dst, *src;
+	struct cdm_regrandom_cmd *pHeader =
+		(struct cdm_regrandom_cmd *)pCmdBuffer;
+
+	pHeader->count = numRegVals;
+	pHeader->cmd = CAM_CDM_CMD_REG_RANDOM;
+	pHeader->reserved = 0;
+
+	pCmdBuffer += cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+	dst = pCmdBuffer;
+	src = pRegVals;
+	for (i = 0; i < numRegVals; i++) {
+		*dst++ = *src++;
+		*dst++ = *src++;
+	}
+
+	return dst;
+}
+
+static uint32_t *cdm_write_indirect(uint32_t *pCmdBuffer, uint32_t indirectBufAddr,
+	uint32_t length)
+{
+	struct cdm_indirect_cmd *pHeader =
+		(struct cdm_indirect_cmd *)pCmdBuffer;
+
+	pHeader->cmd = CAM_CDM_CMD_BUFF_INDIRECT;
+	pHeader->addr = indirectBufAddr;
+	pHeader->length = length - 1;
+
+	pCmdBuffer += cdm_get_cmd_header_size(CAM_CDM_CMD_BUFF_INDIRECT);
+
+	return pCmdBuffer;
+}
+
+static void cdm_write_genirq(uint32_t *pCmdBuffer, uint32_t userdata,
+		bool bit_wr_enable, uint32_t fifo_idx)
+{
+	struct cdm_genirq_cmd *pHeader = (struct cdm_genirq_cmd *)pCmdBuffer;
+
+	CAM_DBG(CAM_CDM, "userdata 0x%x, fifo_idx %d",
+		userdata, fifo_idx);
+
+	if (bit_wr_enable)
+		pHeader->reserved = (unsigned int)((fifo_idx << 1)
+			| (unsigned int)(bit_wr_enable));
+
+	pHeader->cmd = CAM_CDM_CMD_GEN_IRQ;
+	pHeader->userdata = (userdata << (8 * fifo_idx));
+}
+
+static uint32_t *cdm_write_wait_event(uint32_t *pcmdbuffer, uint32_t iw,
+	uint32_t id, uint32_t mask,
+	uint32_t offset, uint32_t data)
+{
+	struct cdm_wait_event_cmd *pheader =
+		(struct cdm_wait_event_cmd *)pcmdbuffer;
+
+	pheader->cmd = CAM_CDM_CMD_WAIT_EVENT;
+	pheader->mask = mask;
+	pheader->data = data;
+	pheader->id = id;
+	pheader->iw = iw;
+	pheader->offset = offset;
+	pheader->iw_reserved = 0;
+	pheader->offset_reserved = 0;
+
+	pcmdbuffer += cdm_get_cmd_header_size(CAM_CDM_CMD_WAIT_EVENT);
+
+	return pcmdbuffer;
+}
+
+static uint32_t *cdm_write_changebase(uint32_t *pCmdBuffer, uint32_t base)
+{
+	struct cdm_changebase_cmd *pHeader =
+		(struct cdm_changebase_cmd *)pCmdBuffer;
+
+	CAM_DBG(CAM_CDM, "Change to base 0x%x", base);
+
+	pHeader->cmd = CAM_CDM_CMD_CHANGE_BASE;
+	pHeader->base = base;
+	pCmdBuffer += cdm_get_cmd_header_size(CAM_CDM_CMD_CHANGE_BASE);
+
+	return pCmdBuffer;
+}
+
+static uint32_t *cdm_write_wait_comp_event(
+	uint32_t *pCmdBuffer, uint32_t mask1, uint32_t mask2)
+{
+	struct cdm_wait_comp_event_cmd *pHeader =
+		(struct cdm_wait_comp_event_cmd *)pCmdBuffer;
+
+	pHeader->cmd = CAM_CDM_CMD_COMP_WAIT;
+	pHeader->mask1 = mask1;
+	pHeader->mask2 = mask2;
+
+	pCmdBuffer += cdm_get_cmd_header_size(CAM_CDM_CMD_COMP_WAIT);
+
+	return pCmdBuffer;
+}
+
+static uint32_t *cdm_write_clear_comp_event(
+	uint32_t *pCmdBuffer, uint32_t mask1, uint32_t mask2)
+{
+	struct cdm_clear_comp_event_cmd *pHeader =
+		(struct cdm_clear_comp_event_cmd *)pCmdBuffer;
+
+	pHeader->cmd = CAM_CDM_CLEAR_COMP_WAIT;
+	pHeader->mask1 = mask1;
+	pHeader->mask2 = mask2;
+
+	pCmdBuffer += cdm_get_cmd_header_size(CAM_CDM_CLEAR_COMP_WAIT);
+
+	return pCmdBuffer;
+}
+
+static uint32_t *cdm_write_wait_prefetch_disable(
+	uint32_t                   *pCmdBuffer,
+	uint32_t                    id,
+	uint32_t                    mask1,
+	uint32_t                    mask2)
+{
+	struct cdm_prefetch_disable_event_cmd *pHeader =
+		(struct cdm_prefetch_disable_event_cmd *)pCmdBuffer;
+
+	pHeader->cmd = CAM_CDM_WAIT_PREFETCH_DISABLE;
+	pHeader->id  = id;
+	pHeader->mask1 = mask1;
+	pHeader->mask2 = mask2;
+
+	pCmdBuffer += cdm_get_cmd_header_size(CAM_CDM_WAIT_PREFETCH_DISABLE);
+
+	return pCmdBuffer;
+}
+
+struct cam_cdm_utils_ops CDM170_ops = {
+	cdm_get_cmd_header_size,
+	cdm_required_size_dmi,
+	cdm_required_size_reg_continuous,
+	cdm_required_size_reg_random,
+	cdm_required_size_indirect,
+	cdm_required_size_genirq,
+	cdm_required_size_wait_event,
+	cdm_required_size_changebase,
+	cdm_required_size_comp_wait,
+	cdm_required_size_clear_comp_event,
+	cdm_required_size_prefetch_disable,
+	cdm_offsetof_dmi_addr,
+	cdm_offsetof_indirect_addr,
+	cdm_write_dmi,
+	cdm_write_regcontinuous,
+	cdm_write_regrandom,
+	cdm_write_indirect,
+	cdm_write_genirq,
+	cdm_write_wait_event,
+	cdm_write_changebase,
+	cdm_write_wait_comp_event,
+	cdm_write_clear_comp_event,
+	cdm_write_wait_prefetch_disable,
+};
+
+static int cam_cdm_get_ioremap_from_base(uint32_t hw_base,
+	uint32_t base_array_size,
+	struct cam_soc_reg_map *base_table[CAM_SOC_MAX_BLOCK],
+	void __iomem **device_base)
+{
+	int ret = -EINVAL, i;
+
+	for (i = 0; i < base_array_size; i++) {
+		if (base_table[i])
+			CAM_DBG(CAM_CDM, "In loop %d ioremap for %x addr=%x",
+			i, (base_table[i])->mem_cam_base, hw_base);
+		if ((base_table[i]) &&
+			((base_table[i])->mem_cam_base == hw_base)) {
+			*device_base = (base_table[i])->mem_base;
+			ret = 0;
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static int cam_cdm_util_reg_cont_write(void __iomem *base_addr,
+	uint32_t *cmd_buf, uint32_t cmd_buf_size, uint32_t *used_bytes)
+{
+	int ret = 0;
+	uint32_t *data;
+	struct cdm_regcontinuous_cmd *reg_cont;
+
+	if ((cmd_buf_size < cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT)) ||
+		(!base_addr)) {
+		CAM_ERR(CAM_CDM, "invalid base addr and data length  %d %pK",
+			cmd_buf_size, base_addr);
+		return -EINVAL;
+	}
+
+	reg_cont = (struct cdm_regcontinuous_cmd *)cmd_buf;
+	if ((!reg_cont->count) || (reg_cont->count > 0x10000) ||
+		(((reg_cont->count * sizeof(uint32_t)) +
+			cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT)) >
+			cmd_buf_size)) {
+		CAM_ERR(CAM_CDM, "buffer size %d is not sufficient for count%d",
+			cmd_buf_size, reg_cont->count);
+		return -EINVAL;
+	}
+	data = cmd_buf + cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT);
+	cam_io_memcpy(base_addr + reg_cont->offset,	data,
+		reg_cont->count * sizeof(uint32_t));
+
+	*used_bytes = (reg_cont->count * sizeof(uint32_t)) +
+		(4 * cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT));
+
+	return ret;
+}
+
+static int cam_cdm_util_reg_random_write(void __iomem *base_addr,
+	uint32_t *cmd_buf, uint32_t cmd_buf_size, uint32_t *used_bytes)
+{
+	uint32_t i;
+	struct cdm_regrandom_cmd *reg_random;
+	uint32_t *data;
+
+	if (!base_addr) {
+		CAM_ERR(CAM_CDM, "invalid base address");
+		return -EINVAL;
+	}
+
+	reg_random = (struct cdm_regrandom_cmd *) cmd_buf;
+	if ((!reg_random->count) || (reg_random->count > 0x10000) ||
+		(((reg_random->count * (sizeof(uint32_t) * 2)) +
+		cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM)) >
+			cmd_buf_size)) {
+		CAM_ERR(CAM_CDM, "invalid reg_count  %d cmd_buf_size %d",
+			reg_random->count, cmd_buf_size);
+		return -EINVAL;
+	}
+	data = cmd_buf + cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+
+	for (i = 0; i < reg_random->count; i++) {
+		CAM_DBG(CAM_CDM, "reg random: offset %pK, value 0x%x",
+			((void __iomem *)(base_addr + data[0])),
+			data[1]);
+		cam_io_w(data[1], base_addr + data[0]);
+		data += 2;
+	}
+
+	*used_bytes = ((reg_random->count * (sizeof(uint32_t) * 2)) +
+		(4 * cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM)));
+
+	return 0;
+}
+
+static int cam_cdm_util_swd_dmi_write(uint32_t cdm_cmd_type,
+	void __iomem *base_addr, uint32_t *cmd_buf, uint32_t cmd_buf_size,
+	uint32_t *used_bytes)
+{
+	uint32_t i;
+	struct cdm_dmi_cmd *swd_dmi;
+	uint32_t *data;
+
+	swd_dmi = (struct cdm_dmi_cmd *)cmd_buf;
+
+	if (cmd_buf_size < (cdm_required_size_dmi() + swd_dmi->length + 1)) {
+		CAM_ERR(CAM_CDM, "invalid CDM_SWD_DMI length %d",
+			swd_dmi->length + 1);
+		return -EINVAL;
+	}
+	data = cmd_buf + cdm_required_size_dmi();
+
+	if (cdm_cmd_type == CAM_CDM_CMD_SWD_DMI_64) {
+		for (i = 0; i < (swd_dmi->length + 1)/8; i++) {
+			cam_io_w_mb(data[0], base_addr +
+				swd_dmi->DMIAddr + CAM_CDM_DMI_DATA_LO_OFFSET);
+			cam_io_w_mb(data[1], base_addr +
+				swd_dmi->DMIAddr + CAM_CDM_DMI_DATA_HI_OFFSET);
+			data += 2;
+		}
+	} else if (cdm_cmd_type == CAM_CDM_CMD_DMI) {
+		for (i = 0; i < (swd_dmi->length + 1)/4; i++) {
+			cam_io_w_mb(data[0], base_addr +
+				swd_dmi->DMIAddr + CAM_CDM_DMI_DATA_OFFSET);
+			data += 1;
+		}
+	} else {
+		for (i = 0; i < (swd_dmi->length + 1)/4; i++) {
+			cam_io_w_mb(data[0], base_addr +
+				swd_dmi->DMIAddr + CAM_CDM_DMI_DATA_LO_OFFSET);
+			data += 1;
+		}
+	}
+	*used_bytes = (4 * cdm_required_size_dmi()) + swd_dmi->length + 1;
+
+	return 0;
+}
+
+int cam_cdm_util_cmd_buf_write(void __iomem **current_device_base,
+	uint32_t *cmd_buf, uint32_t cmd_buf_size,
+	struct cam_soc_reg_map *base_table[CAM_SOC_MAX_BLOCK],
+	uint32_t base_array_size, uint8_t bl_tag)
+{
+	int ret = 0;
+	uint32_t cdm_cmd_type = 0, total_cmd_buf_size = 0;
+	uint32_t used_bytes = 0;
+
+	total_cmd_buf_size = cmd_buf_size;
+
+	while (cmd_buf_size > 0) {
+		CAM_DBG(CAM_CDM, "cmd data=%x", *cmd_buf);
+		cdm_cmd_type = (*cmd_buf >> CAM_CDM_COMMAND_OFFSET);
+		switch (cdm_cmd_type) {
+		case CAM_CDM_CMD_REG_CONT: {
+			ret = cam_cdm_util_reg_cont_write(*current_device_base,
+				cmd_buf, cmd_buf_size, &used_bytes);
+			if (ret)
+				break;
+
+			if (used_bytes > 0) {
+				cmd_buf_size -= used_bytes;
+				cmd_buf += used_bytes/4;
+			}
+			}
+			break;
+		case CAM_CDM_CMD_REG_RANDOM: {
+			ret = cam_cdm_util_reg_random_write(
+				*current_device_base, cmd_buf, cmd_buf_size,
+				&used_bytes);
+			if (ret)
+				break;
+
+			if (used_bytes > 0) {
+				cmd_buf_size -= used_bytes;
+				cmd_buf += used_bytes / 4;
+			}
+			}
+			break;
+		case CAM_CDM_CMD_DMI:
+		case CAM_CDM_CMD_SWD_DMI_32:
+		case CAM_CDM_CMD_SWD_DMI_64: {
+			if (*current_device_base == 0) {
+				CAM_ERR(CAM_CDM,
+					"Got SWI DMI cmd =%d for invalid hw",
+					cdm_cmd_type);
+				ret = -EINVAL;
+				break;
+			}
+			ret = cam_cdm_util_swd_dmi_write(cdm_cmd_type,
+				*current_device_base, cmd_buf, cmd_buf_size,
+				&used_bytes);
+			if (ret)
+				break;
+
+			if (used_bytes > 0) {
+				cmd_buf_size -= used_bytes;
+				cmd_buf += used_bytes / 4;
+			}
+			}
+			break;
+		case CAM_CDM_CMD_CHANGE_BASE: {
+			struct cdm_changebase_cmd *change_base_cmd =
+				(struct cdm_changebase_cmd *)cmd_buf;
+
+			ret = cam_cdm_get_ioremap_from_base(
+				change_base_cmd->base, base_array_size,
+				base_table, current_device_base);
+			if (ret != 0) {
+				CAM_ERR(CAM_CDM,
+					"Get ioremap change base failed %x",
+					change_base_cmd->base);
+				break;
+			}
+			CAM_DBG(CAM_CDM, "Got ioremap for %x addr=%pK",
+				change_base_cmd->base,
+				current_device_base);
+			cmd_buf_size -= (4 *
+				cdm_required_size_changebase());
+			cmd_buf += cdm_required_size_changebase();
+			}
+			break;
+		default:
+			CAM_ERR(CAM_CDM, "unsupported cdm_cmd_type type 0%x",
+			cdm_cmd_type);
+			ret = -EINVAL;
+			break;
+		}
+
+		if (ret < 0)
+			break;
+	}
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_dmi_cmd(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	long ret = 0;
+	struct cdm_dmi_cmd *p_dmi_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+
+	p_dmi_cmd = (struct cdm_dmi_cmd *)cmd_buf_addr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_DMI];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_DMI];
+
+	if (temp_ptr > cmd_buf_addr_end)
+		CAM_ERR(CAM_CDM,
+			"Invalid cmd start addr:%pK end addr:%pK",
+			temp_ptr, cmd_buf_addr_end);
+
+	CAM_INFO(CAM_CDM,
+		"DMI: LEN: %u DMIAddr: 0x%X DMISel: 0x%X LUT_addr: 0x%X",
+		p_dmi_cmd->length, p_dmi_cmd->DMIAddr,
+		p_dmi_cmd->DMISel, p_dmi_cmd->addr);
+	return ret;
+}
+
+static long cam_cdm_util_dump_buff_indirect(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	long ret = 0;
+	struct cdm_indirect_cmd *p_indirect_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+
+	p_indirect_cmd = (struct cdm_indirect_cmd *)cmd_buf_addr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_BUFF_INDIRECT];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_BUFF_INDIRECT];
+
+	if (temp_ptr > cmd_buf_addr_end)
+		CAM_ERR(CAM_CDM,
+			"Invalid cmd start addr:%pK end addr:%pK",
+			temp_ptr, cmd_buf_addr_end);
+
+	CAM_INFO(CAM_CDM,
+		"Buff Indirect: LEN: %u addr: 0x%X",
+		p_indirect_cmd->length, p_indirect_cmd->addr);
+	return ret;
+}
+
+static long cam_cdm_util_dump_reg_cont_cmd(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	long ret = 0;
+	struct cdm_regcontinuous_cmd *p_regcont_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+	int i = 0;
+
+	p_regcont_cmd = (struct cdm_regcontinuous_cmd *)temp_ptr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_CONT];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_CONT];
+
+	CAM_INFO(CAM_CDM, "REG_CONT: COUNT: %u OFFSET: 0x%X",
+		p_regcont_cmd->count, p_regcont_cmd->offset);
+
+	for (i = 0; i < p_regcont_cmd->count; i++) {
+		if (temp_ptr > cmd_buf_addr_end) {
+			CAM_ERR(CAM_CDM,
+				"Invalid cmd(%d) start addr:%pK end addr:%pK",
+				i, temp_ptr, cmd_buf_addr_end);
+			break;
+		}
+		CAM_INFO(CAM_CDM, "DATA_%d: 0x%X", i,
+			*temp_ptr);
+		temp_ptr++;
+		ret++;
+	}
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_reg_random_cmd(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	struct cdm_regrandom_cmd *p_regrand_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+	long ret = 0;
+	int i = 0;
+
+	p_regrand_cmd = (struct cdm_regrandom_cmd *)temp_ptr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_RANDOM];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_REG_RANDOM];
+
+	CAM_INFO(CAM_CDM, "REG_RAND: COUNT: %u",
+		p_regrand_cmd->count);
+
+	for (i = 0; i < p_regrand_cmd->count; i++) {
+		if (temp_ptr > cmd_buf_addr_end) {
+			CAM_ERR(CAM_CDM,
+				"Invalid cmd(%d) start addr:%pK end addr:%pK",
+				i, temp_ptr, cmd_buf_addr_end);
+			break;
+		}
+		CAM_INFO(CAM_CDM, "OFFSET_%d: 0x%X DATA_%d: 0x%X",
+			i, *temp_ptr & CAM_CDM_REG_OFFSET_MASK, i,
+			*(temp_ptr + 1));
+		temp_ptr += 2;
+		ret += 2;
+	}
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_gen_irq_cmd(uint32_t *cmd_buf_addr)
+{
+	long ret = 0;
+
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_GEN_IRQ];
+
+	CAM_INFO(CAM_CDM, "GEN_IRQ");
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_wait_event_cmd(uint32_t *cmd_buf_addr)
+{
+	long ret = 0;
+
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_WAIT_EVENT];
+
+	CAM_INFO(CAM_CDM, "WAIT_EVENT");
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_change_base_cmd(uint32_t *cmd_buf_addr,
+	uint32_t *cmd_buf_addr_end)
+{
+	long ret = 0;
+	struct cdm_changebase_cmd *p_cbase_cmd;
+	uint32_t *temp_ptr = cmd_buf_addr;
+
+	p_cbase_cmd = (struct cdm_changebase_cmd *)temp_ptr;
+	temp_ptr += CDMCmdHeaderSizes[CAM_CDM_CMD_CHANGE_BASE];
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_CHANGE_BASE];
+
+	if (temp_ptr > cmd_buf_addr_end)
+		CAM_ERR(CAM_CDM,
+			"Invalid cmd start addr:%pK end addr:%pK",
+			temp_ptr, cmd_buf_addr_end);
+
+	CAM_INFO(CAM_CDM, "CHANGE_BASE: 0x%X",
+		p_cbase_cmd->base);
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_comp_wait_event_cmd(uint32_t *cmd_buf_addr)
+{
+	long ret = 0;
+
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_COMP_WAIT];
+
+	CAM_INFO(CAM_CDM, "WAIT_EVENT");
+
+	return ret;
+}
+
+static long cam_cdm_util_dump_perf_ctrl_cmd(uint32_t *cmd_buf_addr)
+{
+	long ret = 0;
+
+	ret += CDMCmdHeaderSizes[CAM_CDM_CMD_PERF_CTRL];
+
+	CAM_INFO(CAM_CDM, "PERF_CTRL");
+
+	return ret;
+}
+
+void cam_cdm_util_dump_cmd_buf(
+	uint32_t *cmd_buf_start, uint32_t *cmd_buf_end)
+{
+	uint32_t *buf_now = cmd_buf_start;
+	uint32_t *buf_end = cmd_buf_end;
+	uint32_t cmd = 0;
+
+	if (!cmd_buf_start || !cmd_buf_end) {
+		CAM_ERR(CAM_CDM, "Invalid args");
+		return;
+	}
+
+	do {
+		cmd = *buf_now;
+		cmd = cmd >> CAM_CDM_COMMAND_OFFSET;
+
+		switch (cmd) {
+		case CAM_CDM_CMD_DMI:
+		case CAM_CDM_CMD_DMI_32:
+		case CAM_CDM_CMD_DMI_64:
+			buf_now += cam_cdm_util_dump_dmi_cmd(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_REG_CONT:
+			buf_now += cam_cdm_util_dump_reg_cont_cmd(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_REG_RANDOM:
+			buf_now += cam_cdm_util_dump_reg_random_cmd(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_BUFF_INDIRECT:
+			buf_now += cam_cdm_util_dump_buff_indirect(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_GEN_IRQ:
+			buf_now += cam_cdm_util_dump_gen_irq_cmd(buf_now);
+			break;
+		case CAM_CDM_CMD_WAIT_EVENT:
+			buf_now += cam_cdm_util_dump_wait_event_cmd(buf_now);
+			break;
+		case CAM_CDM_CMD_CHANGE_BASE:
+			buf_now += cam_cdm_util_dump_change_base_cmd(buf_now,
+				buf_end);
+			break;
+		case CAM_CDM_CMD_PERF_CTRL:
+			buf_now += cam_cdm_util_dump_perf_ctrl_cmd(buf_now);
+			break;
+		case CAM_CDM_CMD_COMP_WAIT:
+			buf_now +=
+				cam_cdm_util_dump_comp_wait_event_cmd(buf_now);
+			break;
+		default:
+			CAM_ERR(CAM_CDM, "Invalid CMD: 0x%x buf 0x%x",
+				cmd, *buf_now);
+			buf_now++;
+			break;
+		}
+	} while (buf_now <= cmd_buf_end);
+}
+
+static uint32_t cam_cdm_util_dump_reg_cont_cmd_v2(
+	uint32_t                         *cmd_buf_addr,
+	struct cam_cdm_cmd_buf_dump_info *dump_info)
+{
+	int                             i;
+	long                            ret;
+	uint8_t                        *dst;
+	size_t                          remain_len;
+	uint32_t                       *temp_ptr = cmd_buf_addr;
+	uint32_t                       *addr, *start;
+	uint32_t                        min_len;
+	struct cdm_regcontinuous_cmd   *p_regcont_cmd;
+	struct cam_cdm_cmd_dump_header *hdr;
+
+	p_regcont_cmd = (struct cdm_regcontinuous_cmd *)temp_ptr;
+	temp_ptr += cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT);
+	ret = cdm_get_cmd_header_size(CAM_CDM_CMD_REG_CONT);
+
+	min_len = (sizeof(uint32_t) * p_regcont_cmd->count) +
+		sizeof(struct cam_cdm_cmd_dump_header) +
+		(2 * sizeof(uint32_t));
+	remain_len = dump_info->dst_max_size - dump_info->dst_offset;
+
+	if (remain_len < min_len) {
+		CAM_WARN_RATE_LIMIT(CAM_CDM,
+			"Dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		return ret;
+	}
+
+	dst = (char *)dump_info->dst_start + dump_info->dst_offset;
+	hdr = (struct cam_cdm_cmd_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_CDM_CMD_TAG_MAX_LEN, "CDM_REG_CONT:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_cdm_cmd_dump_header));
+	start = addr;
+	*addr++ = p_regcont_cmd->offset;
+	*addr++ = p_regcont_cmd->count;
+	for (i = 0; i < p_regcont_cmd->count; i++) {
+		*addr = *temp_ptr;
+		temp_ptr++;
+		addr++;
+		ret++;
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_info->dst_offset += hdr->size +
+		sizeof(struct cam_cdm_cmd_dump_header);
+
+	return ret;
+}
+
+static uint32_t cam_cdm_util_dump_reg_random_cmd_v2(
+	uint32_t                         *cmd_buf_addr,
+	struct cam_cdm_cmd_buf_dump_info *dump_info)
+{
+	int                             i;
+	long                            ret;
+	uint8_t                        *dst;
+	uint32_t                       *temp_ptr = cmd_buf_addr;
+	uint32_t                       *addr, *start;
+	size_t                          remain_len;
+	uint32_t                        min_len;
+	struct cdm_regrandom_cmd       *p_regrand_cmd;
+	struct cam_cdm_cmd_dump_header *hdr;
+
+	p_regrand_cmd = (struct cdm_regrandom_cmd *)temp_ptr;
+	temp_ptr += cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+	ret = cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+
+	min_len = (2 * sizeof(uint32_t) * p_regrand_cmd->count) +
+		sizeof(struct cam_cdm_cmd_dump_header) + sizeof(uint32_t);
+	remain_len = dump_info->dst_max_size - dump_info->dst_offset;
+
+	if (remain_len < min_len) {
+		CAM_WARN_RATE_LIMIT(CAM_CDM,
+			"Dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		return ret;
+	}
+
+	dst = (char *)dump_info->dst_start + dump_info->dst_offset;
+	hdr = (struct cam_cdm_cmd_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_CDM_CMD_TAG_MAX_LEN, "CDM_REG_RANDOM:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_cdm_cmd_dump_header));
+	start = addr;
+	*addr++ = p_regrand_cmd->count;
+	for (i = 0; i < p_regrand_cmd->count; i++) {
+		addr[0] = temp_ptr[0] & CAM_CDM_REG_OFFSET_MASK;
+		addr[1] = temp_ptr[1];
+		temp_ptr += 2;
+		addr += 2;
+		ret += 2;
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_info->dst_offset += hdr->size +
+		sizeof(struct cam_cdm_cmd_dump_header);
+	return ret;
+}
+
+int cam_cdm_util_dump_cmd_bufs_v2(
+	struct cam_cdm_cmd_buf_dump_info *dump_info)
+{
+	uint32_t  cmd;
+	uint32_t *buf_now;
+	int rc = 0;
+
+	if (!dump_info || !dump_info->src_start || !dump_info->src_end ||
+		!dump_info->dst_start) {
+		CAM_INFO(CAM_CDM, "Invalid args");
+		return -EINVAL;
+	}
+
+	buf_now = dump_info->src_start;
+	do {
+		if (dump_info->dst_offset >= dump_info->dst_max_size) {
+			CAM_WARN(CAM_CDM,
+				"Dump overshoot offset %zu size %zu",
+				dump_info->dst_offset,
+				dump_info->dst_max_size);
+			return -ENOSPC;
+		}
+		cmd = *buf_now;
+		cmd = cmd >> CAM_CDM_COMMAND_OFFSET;
+
+		switch (cmd) {
+		case CAM_CDM_CMD_DMI:
+		case CAM_CDM_CMD_DMI_32:
+		case CAM_CDM_CMD_DMI_64:
+			buf_now += cdm_get_cmd_header_size(CAM_CDM_CMD_DMI);
+			break;
+		case CAM_CDM_CMD_REG_CONT:
+			buf_now += cam_cdm_util_dump_reg_cont_cmd_v2(buf_now,
+				dump_info);
+			break;
+		case CAM_CDM_CMD_REG_RANDOM:
+			buf_now += cam_cdm_util_dump_reg_random_cmd_v2(buf_now,
+				dump_info);
+			break;
+		case CAM_CDM_CMD_BUFF_INDIRECT:
+			buf_now += cdm_get_cmd_header_size(
+				CAM_CDM_CMD_BUFF_INDIRECT);
+			break;
+		case CAM_CDM_CMD_GEN_IRQ:
+			buf_now += cdm_get_cmd_header_size(
+				CAM_CDM_CMD_GEN_IRQ);
+			break;
+		case CAM_CDM_CMD_WAIT_EVENT:
+			buf_now += cdm_get_cmd_header_size(
+				CAM_CDM_CMD_WAIT_EVENT);
+			break;
+		case CAM_CDM_CMD_CHANGE_BASE:
+			buf_now += cdm_get_cmd_header_size(
+				CAM_CDM_CMD_CHANGE_BASE);
+			break;
+		case CAM_CDM_CMD_PERF_CTRL:
+			buf_now += cdm_get_cmd_header_size(
+				CAM_CDM_CMD_PERF_CTRL);
+			break;
+		case CAM_CDM_CMD_COMP_WAIT:
+			buf_now += cdm_get_cmd_header_size(
+				CAM_CDM_CMD_COMP_WAIT);
+			break;
+		default:
+			CAM_ERR(CAM_CDM, "Invalid CMD: 0x%x", cmd);
+			buf_now++;
+			break;
+		}
+	} while (buf_now <= dump_info->src_end);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_util.h
@@ -0,0 +1,255 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_UTIL_H_
+#define _CAM_CDM_UTIL_H_
+
+/* Max len for tag name for header while dumping cmd buffer*/
+#define CAM_CDM_CMD_TAG_MAX_LEN 32
+
+#include <linux/types.h>
+
+enum cam_cdm_command {
+	CAM_CDM_CMD_UNUSED = 0x0,
+	CAM_CDM_CMD_DMI = 0x1,
+	CAM_CDM_CMD_NOT_DEFINED = 0x2,
+	CAM_CDM_CMD_REG_CONT = 0x3,
+	CAM_CDM_CMD_REG_RANDOM = 0x4,
+	CAM_CDM_CMD_BUFF_INDIRECT = 0x5,
+	CAM_CDM_CMD_GEN_IRQ = 0x6,
+	CAM_CDM_CMD_WAIT_EVENT = 0x7,
+	CAM_CDM_CMD_CHANGE_BASE = 0x8,
+	CAM_CDM_CMD_PERF_CTRL = 0x9,
+	CAM_CDM_CMD_DMI_32 = 0xa,
+	CAM_CDM_CMD_DMI_64 = 0xb,
+	CAM_CDM_CMD_COMP_WAIT = 0xc,
+	CAM_CDM_CLEAR_COMP_WAIT = 0xd,
+	CAM_CDM_WAIT_PREFETCH_DISABLE = 0xe,
+	CAM_CDM_CMD_PRIVATE_BASE = 0xf,
+	CAM_CDM_CMD_SWD_DMI_32 = (CAM_CDM_CMD_PRIVATE_BASE + 0x64),
+	CAM_CDM_CMD_SWD_DMI_64 = (CAM_CDM_CMD_PRIVATE_BASE + 0x65),
+	CAM_CDM_CMD_PRIVATE_BASE_MAX = 0x7F,
+};
+
+/**
+ * struct cam_cdm_utils_ops - Camera CDM util ops
+ *
+ * @cdm_get_cmd_header_size: Returns the size of the given command header
+ *                           in DWORDs.
+ *      @command Command ID
+ *      @return Size of the command in DWORDs
+ *
+ * @cdm_required_size_reg_continuous: Calculates the size of a reg-continuous
+ *                                    command in dwords.
+ *      @numVals Number of continuous values
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_reg_random: Calculates the size of a reg-random command
+ *                                in dwords.
+ *      @numRegVals  Number of register/value pairs
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_dmi: Calculates the size of a DMI command in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_genirq: Calculates size of a Genirq command in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_indirect: Calculates the size of an indirect command
+ *                              in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_comp_wait: Calculates the size of a comp-wait command
+ *                                in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_clear_comp_event: Calculates the size of clear-comp-event
+ *                                      command in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_required_size_changebase: Calculates the size of a change-base command
+ *                                in dwords.
+ *      @return Size in dwords
+ *
+ * @cdm_offsetof_dmi_addr: Returns the offset of address field in the DMI
+ *                         command header.
+ *      @return Offset of addr field
+ *
+ * @cdm_offsetof_indirect_addr: Returns the offset of address field in the
+ *                              indirect command header.
+ *      @return Offset of addr field
+ *
+ * @cdm_write_regcontinuous: Writes a command into the command buffer.
+ *      @pCmdBuffer:  Pointer to command buffer
+ *      @reg: Beginning of the register address range where
+ *            values will be written.
+ *      @numVals: Number of values (registers) that will be written
+ *      @pVals : An array of values that will be written
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_regrandom: Writes a command into the command buffer in
+ *                       register/value pairs.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @numRegVals: Number of register/value pairs that will be written
+ *      @pRegVals: An array of register/value pairs that will be written
+ *                 The even indices are registers and the odd indices
+ *                 arevalues, e.g., {reg1, val1, reg2, val2, ...}.
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_dmi: Writes a DMI command into the command bufferM.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @dmiCmd: DMI command
+ *      @DMIAddr: Address of the DMI
+ *      @DMISel: Selected bank that the DMI will write to
+ *      @length: Size of data in bytes
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_indirect: Writes a indirect command into the command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @indirectBufferAddr: Device address of the indirect cmd buffer.
+ *      @length: Size of data in bytes
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_changebase: Writes a changing CDM (address) base command into
+ *                        the command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @base: New base (device) address
+ *      @return Pointer in command buffer pointing past the written commands
+ *
+ * @cdm_write_genirq: Writes a gen irq command into the command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @userdata: userdata or cookie return by hardware during irq.
+ *
+ * @cdm_write_wait_comp_event: Writes a wait comp event cmd into the
+ *                             command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @mask1: This value decides which comp events to wait (0 - 31).
+ *      @mask2: This value decides which comp events to wait (32 - 65).
+ *
+ * @cdm_write_clear_comp_event: Writes a clear comp event cmd into the
+ *                             command buffer.
+ *      @pCmdBuffer: Pointer to command buffer
+ *      @mask1: This value decides which comp events to clear (0 - 31).
+ *      @mask2: This value decides which comp events to clear (32 - 65).
+ */
+struct cam_cdm_utils_ops {
+uint32_t (*cdm_get_cmd_header_size)(unsigned int command);
+uint32_t (*cdm_required_size_dmi)(void);
+uint32_t (*cdm_required_size_reg_continuous)(uint32_t  numVals);
+uint32_t (*cdm_required_size_reg_random)(uint32_t numRegVals);
+uint32_t (*cdm_required_size_indirect)(void);
+uint32_t (*cdm_required_size_genirq)(void);
+uint32_t (*cdm_required_size_wait_event)(void);
+uint32_t (*cdm_required_size_changebase)(void);
+uint32_t (*cdm_required_size_comp_wait)(void);
+uint32_t (*cdm_required_size_clear_comp_event)(void);
+uint32_t (*cdm_required_size_prefetch_disable)(void);
+uint32_t (*cdm_offsetof_dmi_addr)(void);
+uint32_t (*cdm_offsetof_indirect_addr)(void);
+uint32_t *(*cdm_write_dmi)(
+	uint32_t *pCmdBuffer,
+	uint8_t   dmiCmd,
+	uint32_t  DMIAddr,
+	uint8_t   DMISel,
+	uint32_t  dmiBufferAddr,
+	uint32_t  length);
+uint32_t* (*cdm_write_regcontinuous)(
+	uint32_t *pCmdBuffer,
+	uint32_t  reg,
+	uint32_t  numVals,
+	uint32_t *pVals);
+uint32_t *(*cdm_write_regrandom)(
+	uint32_t *pCmdBuffer,
+	uint32_t  numRegVals,
+	uint32_t *pRegVals);
+uint32_t *(*cdm_write_indirect)(
+	uint32_t *pCmdBuffer,
+	uint32_t  indirectBufferAddr,
+	uint32_t  length);
+void (*cdm_write_genirq)(
+	uint32_t *pCmdBuffer,
+	uint32_t  userdata,
+	bool      bit_wr_enable,
+	uint32_t  fifo_idx);
+uint32_t *(*cdm_write_wait_event)(
+	uint32_t *pCmdBuffer,
+	uint32_t  iw,
+	uint32_t  id,
+	uint32_t  mask,
+	uint32_t  offset,
+	uint32_t  data);
+uint32_t *(*cdm_write_changebase)(
+	uint32_t *pCmdBuffer,
+	uint32_t  base);
+uint32_t *(*cdm_write_wait_comp_event)(
+	uint32_t *pCmdBuffer,
+	uint32_t  mask1,
+	uint32_t  mask2);
+uint32_t *(*cdm_write_clear_comp_event)(
+	uint32_t *pCmdBuffer,
+	uint32_t  mask1,
+	uint32_t  mask2);
+uint32_t *(*cdm_write_wait_prefetch_disable)(
+	uint32_t *pCmdBuffer,
+	uint32_t  id,
+	uint32_t  mask1,
+	uint32_t  mask2);
+};
+
+/**
+ * struct cam_cdm_cmd_buf_dump_info; - Camera CDM dump info
+ * @dst_offset:      dst offset
+ * @dst_max_size     max size of destination buffer
+ * @src_start:       source start address
+ * @src_end:         source end   address
+ * @dst_start:       dst start address
+ */
+struct cam_cdm_cmd_buf_dump_info {
+	size_t    dst_offset;
+	size_t    dst_max_size;
+	uint32_t *src_start;
+	uint32_t *src_end;
+	uintptr_t dst_start;
+};
+
+/**
+ * struct cam_cdm_cmd_dump_header- Camera CDM dump header
+ * @tag:       tag name for header
+ * @size:      size of data
+ * @word_size: size of each word
+ */
+struct cam_cdm_cmd_dump_header {
+	uint8_t   tag[CAM_CDM_CMD_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * cam_cdm_util_log_cmd_bufs()
+ *
+ * @brief:            Util function to log cdm command buffers
+ *
+ * @cmd_buffer_start: Pointer to start of cmd buffer
+ * @cmd_buffer_end:   Pointer to end of cmd buffer
+ *
+ */
+void cam_cdm_util_dump_cmd_buf(
+	uint32_t *cmd_buffer_start, uint32_t *cmd_buffer_end);
+
+/**
+ * cam_cdm_util_dump_cmd_bufs_v2()
+ *
+ * @brief:        Util function to cdm command buffers
+ *                to a buffer
+ *
+ * @dump_info:    Information about source and destination buffers
+ *
+ * return SUCCESS/FAILURE
+ */
+int cam_cdm_util_dump_cmd_bufs_v2(
+	struct cam_cdm_cmd_buf_dump_info *dump_info);
+
+
+#endif /* _CAM_CDM_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_virtual.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_virtual.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CDM_VIRTUAL_H_
+#define _CAM_CDM_VIRTUAL_H_
+
+#include "cam_cdm_intf_api.h"
+
+int cam_virtual_cdm_probe(struct platform_device *pdev);
+int cam_virtual_cdm_remove(struct platform_device *pdev);
+int cam_cdm_util_cmd_buf_write(void __iomem **current_device_base,
+	uint32_t *cmd_buf, uint32_t cmd_buf_size,
+	struct cam_soc_reg_map *base_table[CAM_SOC_MAX_BLOCK],
+	uint32_t base_array_size, uint8_t bl_tag);
+
+#endif /* _CAM_CDM_VIRTUAL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_virtual_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cdm/cam_cdm_virtual_core.c
@@ -0,0 +1,404 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021,  The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include "cam_soc_util.h"
+#include "cam_smmu_api.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm.h"
+#include "cam_cdm_util.h"
+#include "cam_cdm_virtual.h"
+#include "cam_cdm_core_common.h"
+#include "cam_cdm_soc.h"
+#include "cam_io_util.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+#define CAM_CDM_VIRTUAL_NAME "qcom,cam_virtual_cdm"
+
+static void cam_virtual_cdm_work(struct work_struct *work)
+{
+	struct cam_cdm_work_payload *payload;
+	struct cam_hw_info *cdm_hw;
+	struct cam_cdm *core;
+
+	payload = container_of(work, struct cam_cdm_work_payload, work);
+	if (payload) {
+		cdm_hw = payload->hw;
+		core = (struct cam_cdm *)cdm_hw->core_info;
+
+		cam_common_util_thread_switch_delay_detect(
+			"Virtual CDM workq schedule",
+			payload->workq_scheduled_ts,
+			CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+
+		if (payload->irq_status & 0x2) {
+			struct cam_cdm_bl_cb_request_entry *node;
+
+			CAM_DBG(CAM_CDM, "CDM HW Gen/inline IRQ with data=%x",
+				payload->irq_data);
+			mutex_lock(&cdm_hw->hw_mutex);
+			node = cam_cdm_find_request_by_bl_tag(
+				payload->irq_data,
+				&core->bl_request_list);
+			if (node) {
+				if (node->request_type ==
+					CAM_HW_CDM_BL_CB_CLIENT) {
+					cam_cdm_notify_clients(cdm_hw,
+						CAM_CDM_CB_STATUS_BL_SUCCESS,
+						(void *)node);
+				} else if (node->request_type ==
+					CAM_HW_CDM_BL_CB_INTERNAL) {
+					CAM_ERR(CAM_CDM, "Invalid node=%pK %d",
+						node, node->request_type);
+				}
+				list_del_init(&node->entry);
+				kfree(node);
+			} else {
+				CAM_ERR(CAM_CDM, "Invalid node for inline irq");
+			}
+			mutex_unlock(&cdm_hw->hw_mutex);
+		}
+		if (payload->irq_status & 0x1) {
+			CAM_DBG(CAM_CDM, "CDM HW reset done IRQ");
+			complete(&core->reset_complete);
+		}
+		kfree(payload);
+	}
+
+}
+
+int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw,
+	struct cam_cdm_hw_intf_cmd_submit_bl *req,
+	struct cam_cdm_client *client)
+{
+	int i, rc = -EINVAL;
+	struct cam_cdm_bl_request *cdm_cmd = req->data;
+	struct cam_cdm *core = (struct cam_cdm *)cdm_hw->core_info;
+
+	mutex_lock(&client->lock);
+	for (i = 0; i < req->data->cmd_arrary_count ; i++) {
+		uintptr_t vaddr_ptr = 0;
+		size_t len = 0;
+
+		if ((!cdm_cmd->cmd_flex[i].len) &&
+			(cdm_cmd->cmd_flex[i].len > 0x100000)) {
+			CAM_ERR(CAM_CDM,
+				"len(%d) is invalid count=%d total cnt=%d",
+				cdm_cmd->cmd_flex[i].len, i,
+				req->data->cmd_arrary_count);
+			rc = -EINVAL;
+			break;
+		}
+		if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE) {
+			rc = cam_mem_get_cpu_buf(
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle, &vaddr_ptr,
+				&len);
+		} else if (req->data->type ==
+			CAM_CDM_BL_CMD_TYPE_KERNEL_IOVA) {
+			rc = 0;
+			vaddr_ptr = cdm_cmd->cmd_flex[i].bl_addr.kernel_iova;
+			len = cdm_cmd->cmd_flex[i].offset + cdm_cmd->cmd_flex[i].len;
+		} else {
+			CAM_ERR(CAM_CDM,
+				"Only mem hdl/Kernel va type is supported %d",
+				req->data->type);
+			rc = -EINVAL;
+			break;
+		}
+
+		if ((!rc) && (vaddr_ptr) && (len) &&
+			(len >= cdm_cmd->cmd_flex[i].offset)) {
+
+
+			if ((len - cdm_cmd->cmd_flex[i].offset) <
+				cdm_cmd->cmd_flex[i].len) {
+				CAM_ERR(CAM_CDM, "Not enough buffer");
+				rc = -EINVAL;
+				goto end;
+			}
+			CAM_DBG(CAM_CDM,
+				"hdl=%x vaddr=%pK offset=%d cmdlen=%d:%zu",
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle,
+				(void *)vaddr_ptr, cdm_cmd->cmd_flex[i].offset,
+				cdm_cmd->cmd_flex[i].len, len);
+			rc = cam_cdm_util_cmd_buf_write(
+				&client->changebase_addr,
+				((uint32_t *)vaddr_ptr +
+					((cdm_cmd->cmd_flex[i].offset)/4)),
+				cdm_cmd->cmd_flex[i].len, client->data.base_array,
+				client->data.base_array_cnt, core->bl_tag);
+			if (rc) {
+				CAM_ERR(CAM_CDM,
+					"write failed for cnt=%d:%d len %u",
+					i, req->data->cmd_arrary_count,
+					cdm_cmd->cmd_flex[i].len);
+				goto end;
+			}
+		} else {
+			CAM_ERR(CAM_CDM,
+				"Sanity check failed for hdl=%x len=%zu:%d",
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle, len,
+				cdm_cmd->cmd_flex[i].offset);
+			CAM_ERR(CAM_CDM,
+				"Sanity check failed for cmd_count=%d cnt=%d",
+				i, req->data->cmd_arrary_count);
+			rc = -EINVAL;
+			goto end;
+		}
+		if (!rc) {
+			struct cam_cdm_work_payload *payload;
+
+			CAM_DBG(CAM_CDM,
+				"write BL success for cnt=%d with tag=%d",
+				i, core->bl_tag);
+			if ((true == req->data->flag) &&
+				(i == req->data->cmd_arrary_count)) {
+				struct cam_cdm_bl_cb_request_entry *node;
+
+				node = kzalloc(sizeof(
+					struct cam_cdm_bl_cb_request_entry),
+					GFP_KERNEL);
+				if (!node) {
+					rc = -ENOMEM;
+					goto end;
+				}
+				node->request_type = CAM_HW_CDM_BL_CB_CLIENT;
+				node->client_hdl = req->handle;
+				node->cookie = req->data->cookie;
+				node->bl_tag = core->bl_tag;
+				node->userdata = req->data->userdata;
+				mutex_lock(&cdm_hw->hw_mutex);
+				list_add_tail(&node->entry,
+					&core->bl_request_list);
+				mutex_unlock(&cdm_hw->hw_mutex);
+
+				payload = kzalloc(sizeof(
+					struct cam_cdm_work_payload),
+					GFP_ATOMIC);
+				if (payload) {
+					payload->irq_status = 0x2;
+					payload->irq_data = core->bl_tag;
+					payload->hw = cdm_hw;
+					INIT_WORK((struct work_struct *)
+						&payload->work,
+						cam_virtual_cdm_work);
+					payload->workq_scheduled_ts =
+						ktime_get();
+					queue_work(core->work_queue,
+						&payload->work);
+				}
+			}
+			core->bl_tag++;
+			CAM_DBG(CAM_CDM,
+				"Now commit the BL nothing for virtual");
+			if (!rc && (core->bl_tag == 63))
+				core->bl_tag = 0;
+		}
+
+		if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE)
+			cam_mem_put_cpu_buf(cdm_cmd->cmd_flex[i].bl_addr.mem_handle);
+	}
+	mutex_unlock(&client->lock);
+	return rc;
+
+end:
+	if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE)
+		cam_mem_put_cpu_buf(cdm_cmd->cmd_flex[i].bl_addr.mem_handle);
+
+	mutex_unlock(&client->lock);
+	return rc;
+
+}
+
+int cam_virtual_cdm_probe(struct platform_device *pdev)
+{
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_hw_intf *cdm_hw_intf = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	struct cam_cdm_private_dt_data *soc_private = NULL;
+	int rc;
+	struct cam_cpas_register_params cpas_parms;
+
+	cdm_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!cdm_hw_intf)
+		return -ENOMEM;
+
+	cdm_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!cdm_hw) {
+		kfree(cdm_hw_intf);
+		return -ENOMEM;
+	}
+
+	cdm_hw->core_info = kzalloc(sizeof(struct cam_cdm), GFP_KERNEL);
+	if (!cdm_hw->core_info) {
+		kfree(cdm_hw);
+		kfree(cdm_hw_intf);
+		return -ENOMEM;
+	}
+	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	cdm_hw->soc_info.pdev = pdev;
+	cdm_hw_intf->hw_type = CAM_VIRTUAL_CDM;
+	cdm_hw->soc_info.soc_private = kzalloc(
+			sizeof(struct cam_cdm_private_dt_data), GFP_KERNEL);
+	if (!cdm_hw->soc_info.soc_private) {
+		rc = -ENOMEM;
+		goto soc_load_failed;
+	}
+
+	rc = cam_cdm_soc_load_dt_private(pdev, cdm_hw->soc_info.soc_private);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Failed to load CDM dt private data");
+		kfree(cdm_hw->soc_info.soc_private);
+		cdm_hw->soc_info.soc_private = NULL;
+		goto soc_load_failed;
+	}
+
+	cdm_core = (struct cam_cdm *)cdm_hw->core_info;
+	soc_private = (struct cam_cdm_private_dt_data *)
+					cdm_hw->soc_info.soc_private;
+	if (soc_private->dt_cdm_shared == true)
+		cdm_core->flags = CAM_CDM_FLAG_SHARED_CDM;
+	else
+		cdm_core->flags = CAM_CDM_FLAG_PRIVATE_CDM;
+
+	cdm_core->bl_tag = 0;
+	INIT_LIST_HEAD(&cdm_core->bl_request_list);
+	init_completion(&cdm_core->reset_complete);
+	cdm_hw_intf->hw_priv = cdm_hw;
+	cdm_hw_intf->hw_ops.get_hw_caps = cam_cdm_get_caps;
+	cdm_hw_intf->hw_ops.init = NULL;
+	cdm_hw_intf->hw_ops.deinit = NULL;
+	cdm_hw_intf->hw_ops.start = cam_cdm_stream_start;
+	cdm_hw_intf->hw_ops.stop = cam_cdm_stream_stop;
+	cdm_hw_intf->hw_ops.read = NULL;
+	cdm_hw_intf->hw_ops.write = NULL;
+	cdm_hw_intf->hw_ops.process_cmd = cam_cdm_process_cmd;
+
+	CAM_DBG(CAM_CDM, "type %d index %d", cdm_hw_intf->hw_type,
+		cdm_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, cdm_hw_intf);
+
+	cdm_hw->open_count = 0;
+	cdm_core->iommu_hdl.non_secure = -1;
+	cdm_core->iommu_hdl.secure = -1;
+	mutex_init(&cdm_hw->hw_mutex);
+	spin_lock_init(&cdm_hw->hw_lock);
+	init_completion(&cdm_hw->hw_complete);
+	mutex_lock(&cdm_hw->hw_mutex);
+	cdm_core->id = CAM_CDM_VIRTUAL;
+	memcpy(cdm_core->name, CAM_CDM_VIRTUAL_NAME,
+		sizeof(CAM_CDM_VIRTUAL_NAME));
+	cdm_core->work_queue = alloc_workqueue(cdm_core->name,
+		WQ_UNBOUND | WQ_MEM_RECLAIM | WQ_SYSFS,
+		CAM_CDM_INFLIGHT_WORKS);
+	cdm_core->ops = NULL;
+
+	cpas_parms.cam_cpas_client_cb = cam_cdm_cpas_cb;
+	cpas_parms.cell_index = cdm_hw->soc_info.index;
+	cpas_parms.dev = &pdev->dev;
+	cpas_parms.userdata = cdm_hw_intf;
+	strscpy(cpas_parms.identifier, "cam-cdm-intf",
+		CAM_HW_IDENTIFIER_LENGTH);
+	rc = cam_cpas_register_client(&cpas_parms);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Virtual CDM CPAS registration failed");
+		goto cpas_registration_failed;
+	}
+	CAM_DBG(CAM_CDM, "CPAS registration successful handle=%d",
+		cpas_parms.client_handle);
+	cdm_core->cpas_handle = cpas_parms.client_handle;
+
+	CAM_DBG(CAM_CDM, "CDM%d probe successful", cdm_hw_intf->hw_idx);
+
+	rc = cam_cdm_intf_register_hw_cdm(cdm_hw_intf,
+			soc_private, CAM_VIRTUAL_CDM, &cdm_core->index);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "Virtual CDM Interface registration failed");
+		goto intf_registration_failed;
+	}
+	CAM_DBG(CAM_CDM, "CDM%d registered to intf successful",
+		cdm_hw_intf->hw_idx);
+	mutex_unlock(&cdm_hw->hw_mutex);
+
+	return 0;
+intf_registration_failed:
+	cam_cpas_unregister_client(cdm_core->cpas_handle);
+cpas_registration_failed:
+	kfree(cdm_hw->soc_info.soc_private);
+	flush_workqueue(cdm_core->work_queue);
+	destroy_workqueue(cdm_core->work_queue);
+	mutex_unlock(&cdm_hw->hw_mutex);
+	mutex_destroy(&cdm_hw->hw_mutex);
+soc_load_failed:
+	kfree(cdm_hw->core_info);
+	kfree(cdm_hw);
+	kfree(cdm_hw_intf);
+	return rc;
+}
+
+int cam_virtual_cdm_remove(struct platform_device *pdev)
+{
+	struct cam_hw_info *cdm_hw = NULL;
+	struct cam_hw_intf *cdm_hw_intf = NULL;
+	struct cam_cdm *cdm_core = NULL;
+	int rc = -EBUSY;
+
+	cdm_hw_intf = platform_get_drvdata(pdev);
+	if (!cdm_hw_intf) {
+		CAM_ERR(CAM_CDM, "Failed to get dev private data");
+		return rc;
+	}
+
+	cdm_hw = cdm_hw_intf->hw_priv;
+	if (!cdm_hw) {
+		CAM_ERR(CAM_CDM,
+			"Failed to get virtual private data for type=%d idx=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx);
+		return rc;
+	}
+
+	cdm_core = cdm_hw->core_info;
+	if (!cdm_core) {
+		CAM_ERR(CAM_CDM,
+			"Failed to get virtual core data for type=%d idx=%d",
+			cdm_hw_intf->hw_type, cdm_hw_intf->hw_idx);
+		return rc;
+	}
+
+	rc = cam_cpas_unregister_client(cdm_core->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_CDM, "CPAS unregister failed");
+		return rc;
+	}
+
+	rc = cam_cdm_intf_deregister_hw_cdm(cdm_hw_intf,
+			cdm_hw->soc_info.soc_private, CAM_VIRTUAL_CDM,
+			cdm_core->index);
+	if (rc) {
+		CAM_ERR(CAM_CDM,
+			"Virtual CDM Interface de-registration failed");
+		return rc;
+	}
+
+	flush_workqueue(cdm_core->work_queue);
+	destroy_workqueue(cdm_core->work_queue);
+	mutex_destroy(&cdm_hw->hw_mutex);
+	kfree(cdm_hw->soc_info.soc_private);
+	kfree(cdm_hw->core_info);
+	kfree(cdm_hw);
+	kfree(cdm_hw_intf);
+	rc = 0;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_context.c
@@ -0,0 +1,746 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/refcount.h>
+
+#include "cam_context.h"
+#include "cam_debug_util.h"
+#include "cam_node.h"
+
+static int cam_context_handle_hw_event(void *context, uint32_t evt_id,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_context *ctx = (struct cam_context *)context;
+
+	if (!ctx || !ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (ctx->state_machine[ctx->state].irq_ops)
+		rc = ctx->state_machine[ctx->state].irq_ops(ctx, evt_id,
+			evt_data);
+	else
+		CAM_DBG(CAM_CORE,
+			"No function to handle event %d in dev %d, state %d",
+			evt_id, ctx->dev_hdl, ctx->state);
+	return rc;
+}
+
+int cam_context_shutdown(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_release_dev_cmd cmd;
+
+	if (ctx->state > CAM_CTX_AVAILABLE && ctx->state < CAM_CTX_STATE_MAX) {
+		cmd.session_handle = ctx->session_hdl;
+		cmd.dev_handle = ctx->dev_hdl;
+		rc = cam_context_handle_release_dev(ctx, &cmd);
+		if (rc)
+			CAM_ERR(CAM_CORE,
+				"context release failed for dev_name %s",
+				ctx->dev_name);
+		else
+			cam_context_putref(ctx);
+	} else {
+		CAM_WARN(CAM_CORE,
+			"dev %s context id %u state %d invalid to release hdl",
+			ctx->dev_name, ctx->ctx_id, ctx->state);
+		rc = -EINVAL;
+	}
+
+	if (ctx->dev_hdl != -1) {
+		rc = cam_destroy_device_hdl(ctx->dev_hdl);
+		if (rc)
+			CAM_ERR(CAM_CORE,
+				"destroy device hdl failed for node %s",
+				ctx->dev_name);
+		else
+			ctx->dev_hdl = -1;
+	}
+
+	return rc;
+}
+
+int cam_context_handle_crm_get_dev_info(struct cam_context *ctx,
+	struct cam_req_mgr_device_info *info)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!info) {
+		CAM_ERR(CAM_CORE, "Invalid get device info payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.get_dev_info) {
+		rc = ctx->state_machine[ctx->state].crm_ops.get_dev_info(
+			ctx, info);
+	} else {
+		CAM_ERR(CAM_CORE, "No get device info in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_link(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *link)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!link) {
+		CAM_ERR(CAM_CORE, "Invalid link payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.link) {
+		rc = ctx->state_machine[ctx->state].crm_ops.link(ctx, link);
+	} else {
+		CAM_ERR(CAM_CORE, "No crm link in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_unlink(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!unlink) {
+		CAM_ERR(CAM_CORE, "Invalid unlink payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.unlink) {
+		rc = ctx->state_machine[ctx->state].crm_ops.unlink(
+			ctx, unlink);
+	} else {
+		CAM_ERR(CAM_CORE, "No crm unlink in dev %d, name %s, state %d",
+			ctx->dev_hdl, ctx->dev_name, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_apply_req(struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!apply) {
+		CAM_ERR(CAM_CORE, "Invalid apply request payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.apply_req) {
+		rc = ctx->state_machine[ctx->state].crm_ops.apply_req(ctx,
+			apply);
+	} else {
+		CAM_ERR(CAM_CORE, "No crm apply req in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_notify_frame_skip(
+	struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!apply) {
+		CAM_ERR(CAM_CORE, "Invalid apply request payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.notify_frame_skip)
+		rc = ctx->state_machine[ctx->state].crm_ops.notify_frame_skip(
+			ctx, apply);
+	else
+		CAM_DBG(CAM_CORE,
+			"No crm notify_frame_skip in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_flush_req(struct cam_context *ctx,
+	struct cam_req_mgr_flush_request *flush)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state != CAM_CTX_FLUSHED) {
+		if (ctx->state_machine[ctx->state].crm_ops.flush_req) {
+			rc = ctx->state_machine[ctx->state].crm_ops.flush_req(ctx,
+				flush);
+		} else {
+			CAM_INFO(CAM_CORE, "No crm flush req in dev %d, state %d, name %s",
+				ctx->dev_hdl, ctx->state, ctx->dev_name);
+			rc = -EPROTO;
+		}
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_process_evt(struct cam_context *ctx,
+	struct cam_req_mgr_link_evt_data *process_evt)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].crm_ops.process_evt) {
+		rc = ctx->state_machine[ctx->state].crm_ops.process_evt(ctx,
+			process_evt);
+	} else {
+		/* handling of this message is optional */
+		CAM_DBG(CAM_CORE, "No crm process evt in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_crm_dump_req(struct cam_context *ctx,
+	struct cam_req_mgr_dump_info *dump)
+{
+	int rc = 0;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Invalid Context");
+		return -EINVAL;
+	}
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context %s ctx_id %d is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EINVAL;
+	}
+	mutex_lock(&ctx->ctx_mutex);
+
+	if (ctx->state_machine[ctx->state].crm_ops.dump_req)
+		rc = ctx->state_machine[ctx->state].crm_ops.dump_req(ctx,
+			dump);
+	else
+		CAM_ERR(CAM_CORE, "No crm dump req for %s dev %d, state %d",
+			ctx->dev_name, ctx->dev_hdl, ctx->state);
+
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_dump_pf_info(struct cam_context *ctx,
+	struct cam_smmu_pf_info *pf_info)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if ((ctx->state > CAM_CTX_AVAILABLE) &&
+		(ctx->state < CAM_CTX_STATE_MAX)) {
+		if (ctx->state_machine[ctx->state].pagefault_ops) {
+			rc = ctx->state_machine[ctx->state].pagefault_ops(
+				ctx, pf_info);
+		} else {
+			CAM_WARN(CAM_CORE, "No dump ctx in dev %d, state %d",
+				ctx->dev_hdl, ctx->state);
+		}
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_message(struct cam_context *ctx,
+	uint32_t msg_type, uint32_t *data)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if ((ctx->state > CAM_CTX_AVAILABLE) &&
+		(ctx->state < CAM_CTX_STATE_MAX)) {
+		if (ctx->state_machine[ctx->state].msg_cb_ops) {
+			rc = ctx->state_machine[ctx->state].msg_cb_ops(
+				ctx, msg_type, data);
+		} else {
+			CAM_WARN(CAM_CORE,
+				"No message handler for ctx %d, state %d msg_type :%d",
+				ctx->dev_hdl, ctx->state, msg_type);
+		}
+	}
+
+	return rc;
+}
+
+int cam_context_handle_acquire_dev(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+	int i;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid acquire device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.acquire_dev) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.acquire_dev(
+			ctx, cmd);
+	} else {
+		CAM_ERR(CAM_CORE, "No acquire device in dev %d, state %d",
+			cmd->dev_handle, ctx->state);
+		rc = -EPROTO;
+	}
+
+	INIT_LIST_HEAD(&ctx->active_req_list);
+	INIT_LIST_HEAD(&ctx->wait_req_list);
+	INIT_LIST_HEAD(&ctx->pending_req_list);
+	INIT_LIST_HEAD(&ctx->free_req_list);
+
+	for (i = 0; i < ctx->req_size; i++) {
+		INIT_LIST_HEAD(&ctx->req_list[i].list);
+		list_add_tail(&ctx->req_list[i].list, &ctx->free_req_list);
+	}
+
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_acquire_hw(struct cam_context *ctx,
+	void *args)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!args) {
+		CAM_ERR(CAM_CORE, "Invalid acquire device hw command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.acquire_hw) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.acquire_hw(
+			ctx, args);
+	} else {
+		CAM_ERR(CAM_CORE, "No acquire hw for dev %s, state %d",
+			ctx->dev_name, ctx->state);
+		rc = -EPROTO;
+	}
+
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_release_dev(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid release device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.release_dev) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.release_dev(
+			ctx, cmd);
+	} else {
+		CAM_ERR(CAM_CORE, "No release device in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_release_hw(struct cam_context *ctx,
+	void *args)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!args) {
+		CAM_ERR(CAM_CORE, "Invalid release HW command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.release_hw) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.release_hw(
+			ctx, args);
+	} else {
+		CAM_ERR(CAM_CORE, "No release hw for dev %s, state %d",
+			ctx->dev_name, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_flush_dev(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid flush device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.flush_dev) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.flush_dev(
+			ctx, cmd);
+	} else {
+		CAM_WARN(CAM_CORE, "No flush device in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_config_dev(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid config device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.config_dev) {
+		rc = ctx->state_machine[ctx->state].ioctl_ops.config_dev(
+			ctx, cmd);
+	} else {
+		CAM_ERR(CAM_CORE, "No config device in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+		rc = -EPROTO;
+	}
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_start_dev(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	if (!ctx || !ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid start device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.start_dev)
+		rc = ctx->state_machine[ctx->state].ioctl_ops.start_dev(
+			ctx, cmd);
+	else
+		/* start device can be optional for some driver */
+		CAM_DBG(CAM_CORE, "No start device in dev %d, state %d",
+			ctx->dev_hdl, ctx->state);
+
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_stop_dev(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	if (!ctx || !ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE, "Invalid stop device command payload");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].ioctl_ops.stop_dev)
+		rc = ctx->state_machine[ctx->state].ioctl_ops.stop_dev(
+			ctx, cmd);
+	else
+		/* stop device can be optional for some driver */
+		CAM_WARN(CAM_CORE, "No stop device in dev %d, name %s state %d",
+			ctx->dev_hdl, ctx->dev_name, ctx->state);
+
+	ctx->last_flush_req = 0;
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_handle_info_dump(void *context,
+	enum cam_context_dump_id id)
+{
+	int rc = 0;
+	struct cam_context *ctx = (struct cam_context *)context;
+
+	if (!ctx || !ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context is not ready");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->state_machine[ctx->state].dumpinfo_ops)
+		rc = ctx->state_machine[ctx->state].dumpinfo_ops(ctx,
+			id);
+	mutex_unlock(&ctx->ctx_mutex);
+
+	if (rc)
+		CAM_WARN(CAM_CORE,
+			"Dump for id %u failed on ctx_id %u name %s state %d",
+			id, ctx->ctx_id, ctx->dev_name, ctx->state);
+
+	return rc;
+}
+
+int cam_context_handle_dump_dev(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc = 0;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Invalid Context");
+		return -EINVAL;
+	}
+
+	if (!ctx->state_machine) {
+		CAM_ERR(CAM_CORE, "Context %s ctx_id %d is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_CORE,
+			"Context %s ctx_id %d Invalid dump command payload",
+			ctx->dev_name, ctx->ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx->ctx_mutex);
+	CAM_DBG(CAM_CORE, "dump device in dev %d, name %s state %d",
+		ctx->dev_hdl, ctx->dev_name, ctx->state);
+	if (ctx->state_machine[ctx->state].ioctl_ops.dump_dev)
+		rc = ctx->state_machine[ctx->state].ioctl_ops.dump_dev(
+			ctx, cmd);
+	else
+		CAM_WARN(CAM_CORE, "No dump device in dev %d, name %s state %d",
+			ctx->dev_hdl, ctx->dev_name, ctx->state);
+	mutex_unlock(&ctx->ctx_mutex);
+
+	return rc;
+}
+
+int cam_context_init(struct cam_context *ctx,
+	const char *dev_name,
+	uint64_t dev_id,
+	uint32_t ctx_id,
+	struct cam_req_mgr_kmd_ops *crm_node_intf,
+	struct cam_hw_mgr_intf *hw_mgr_intf,
+	struct cam_ctx_request *req_list,
+	uint32_t req_size)
+{
+	int i;
+
+	/* crm_node_intf is optinal */
+	if (!ctx || !hw_mgr_intf || !req_list) {
+		CAM_ERR(CAM_CORE, "Invalid input parameters");
+		return -EINVAL;
+	}
+
+	memset(ctx, 0, sizeof(*ctx));
+	ctx->dev_hdl = -1;
+	ctx->link_hdl = -1;
+	ctx->session_hdl = -1;
+	INIT_LIST_HEAD(&ctx->list);
+	mutex_init(&ctx->ctx_mutex);
+	mutex_init(&ctx->sync_mutex);
+	spin_lock_init(&ctx->lock);
+
+	strscpy(ctx->dev_name, dev_name, CAM_CTX_DEV_NAME_MAX_LENGTH);
+	ctx->dev_id = dev_id;
+	ctx->ctx_id = ctx_id;
+	ctx->last_flush_req = 0;
+	ctx->ctx_crm_intf = NULL;
+	ctx->crm_ctx_intf = crm_node_intf;
+	ctx->hw_mgr_intf = hw_mgr_intf;
+	ctx->irq_cb_intf = cam_context_handle_hw_event;
+
+	INIT_LIST_HEAD(&ctx->active_req_list);
+	INIT_LIST_HEAD(&ctx->wait_req_list);
+	INIT_LIST_HEAD(&ctx->pending_req_list);
+	INIT_LIST_HEAD(&ctx->free_req_list);
+	ctx->req_list = req_list;
+	ctx->req_size = req_size;
+	for (i = 0; i < req_size; i++) {
+		INIT_LIST_HEAD(&ctx->req_list[i].list);
+		list_add_tail(&ctx->req_list[i].list, &ctx->free_req_list);
+		ctx->req_list[i].ctx = ctx;
+	}
+	ctx->state = CAM_CTX_AVAILABLE;
+	ctx->state_machine = NULL;
+	ctx->ctx_priv = NULL;
+
+	return 0;
+}
+
+int cam_context_deinit(struct cam_context *ctx)
+{
+	if (!ctx)
+		return -EINVAL;
+
+	/**
+	 * This is called from platform device remove.
+	 * Everyting should be released at this moment.
+	 * so we just free the memory for the context
+	 */
+	if (ctx->state != CAM_CTX_AVAILABLE)
+		CAM_ERR(CAM_CORE, "Device did not shutdown cleanly");
+
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
+
+void cam_context_putref(struct cam_context *ctx)
+{
+	if (kref_read(&ctx->refcount))
+		kref_put(&ctx->refcount, cam_node_put_ctxt_to_free_list);
+	else
+		WARN(1, "ctx %s %d state %d devhdl %X\n", ctx->dev_name,
+			ctx->ctx_id, ctx->state, ctx->dev_hdl);
+
+	CAM_DBG(CAM_CORE,
+		"ctx device hdl %ld, ref count %d, dev_name %s",
+		ctx->dev_hdl, refcount_read(&(ctx->refcount.refcount)),
+		ctx->dev_name);
+}
+
+void cam_context_getref(struct cam_context *ctx)
+{
+	if (kref_get_unless_zero(&ctx->refcount) == 0) {
+		/* should never happen */
+		WARN(1, "%s fail\n", __func__);
+	}
+	CAM_DBG(CAM_CORE,
+		"ctx device hdl %ld, ref count %d, dev_name %s",
+		ctx->dev_hdl, refcount_read(&(ctx->refcount.refcount)),
+		ctx->dev_name);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_context.h
@@ -0,0 +1,562 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CONTEXT_H_
+#define _CAM_CONTEXT_H_
+
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
+#include <linux/kref.h>
+#include <media/v4l2-subdev.h>
+#include "cam_req_mgr_interface.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_smmu_api.h"
+
+/* Forward declarations */
+struct cam_context;
+
+/* max device name string length*/
+#define CAM_CTX_DEV_NAME_MAX_LENGTH 20
+
+/* max request number */
+#define CAM_CTX_REQ_MAX              20
+#define CAM_CTX_ICP_REQ_MAX          40
+#define CAM_CTX_CFG_MAX              20
+#define CAM_CTX_RES_MAX              20
+
+/* max tag  dump header string length*/
+#define CAM_CTXT_DUMP_TAG_MAX_LEN 32
+
+/* Number of words to be dumped for context*/
+#define CAM_CTXT_DUMP_NUM_WORDS 10
+
+/**
+ * enum cam_ctx_state -  context top level states
+ *
+ */
+enum cam_context_state {
+	CAM_CTX_UNINIT               = 0,
+	CAM_CTX_AVAILABLE            = 1,
+	CAM_CTX_ACQUIRED             = 2,
+	CAM_CTX_READY                = 3,
+	CAM_CTX_FLUSHED              = 4,
+	CAM_CTX_ACTIVATED            = 5,
+	CAM_CTX_STATE_MAX            = 6,
+};
+
+/**
+ * struct cam_ctx_request - Common request structure for the context
+ *
+ * @list:                  Link list entry
+ * @status:                Request status
+ * @request_id:            Request id
+ * @req_priv:              Derived request object
+ * @hw_update_entries:     Hardware update entries
+ * @num_hw_update_entries: Number of hardware update entries
+ * @in_map_entries:        Entries for in fences
+ * @num_in_map_entries:    Number of in map entries
+ * @out_map_entries:       Entries for out fences
+ * @num_out_map_entries:   Number of out map entries
+ * @num_in_acked:          Number of in fence acked
+ * @num_out_acked:         Number of out fence acked
+ * @flushed:               Request is flushed
+ * @ctx:                   The context to which this request belongs
+ * @pf_data                page fault debug data
+ *
+ */
+struct cam_ctx_request {
+	struct list_head               list;
+	uint32_t                       status;
+	uint64_t                       request_id;
+	void                          *req_priv;
+	struct cam_hw_update_entry     hw_update_entries[CAM_CTX_CFG_MAX];
+	uint32_t                       num_hw_update_entries;
+	struct cam_hw_fence_map_entry  in_map_entries[CAM_CTX_CFG_MAX];
+	uint32_t                       num_in_map_entries;
+	struct cam_hw_fence_map_entry  out_map_entries[CAM_CTX_CFG_MAX];
+	uint32_t                       num_out_map_entries;
+	atomic_t                       num_in_acked;
+	uint32_t                       num_out_acked;
+	int                            flushed;
+	struct cam_context            *ctx;
+	struct cam_hw_mgr_dump_pf_data pf_data;
+};
+
+/**
+ * struct cam_ctx_ioctl_ops - Function table for handling IOCTL calls
+ *
+ * @acquire_dev:           Function pointer for acquire device
+ * @release_dev:           Function pointer for release device
+ * @config_dev:            Function pointer for config device
+ * @start_dev:             Function pointer for start device
+ * @stop_dev:              Function pointer for stop device
+ * @flush_dev:             Function pointer for flush device
+ * @acquire_hw:            Function pointer for acquire hw
+ * @release_hw:            Function pointer for release hw
+ * @dump_dev:              Function pointer for dump dev
+ *
+ */
+struct cam_ctx_ioctl_ops {
+	int (*acquire_dev)(struct cam_context *ctx,
+			struct cam_acquire_dev_cmd *cmd);
+	int (*release_dev)(struct cam_context *ctx,
+			struct cam_release_dev_cmd *cmd);
+	int (*config_dev)(struct cam_context *ctx,
+			struct cam_config_dev_cmd *cmd);
+	int (*start_dev)(struct cam_context *ctx,
+			struct cam_start_stop_dev_cmd *cmd);
+	int (*stop_dev)(struct cam_context *ctx,
+			struct cam_start_stop_dev_cmd *cmd);
+	int (*flush_dev)(struct cam_context *ctx,
+			struct cam_flush_dev_cmd *cmd);
+	int (*acquire_hw)(struct cam_context *ctx, void *args);
+	int (*release_hw)(struct cam_context *ctx, void *args);
+	int (*dump_dev)(struct cam_context *ctx,
+			struct cam_dump_req_cmd *cmd);
+};
+
+/**
+ * struct cam_ctx_crm_ops -  Function table for handling CRM to context calls
+ *
+ * @get_dev_info:          Get device informaiton
+ * @link:                  Link the context
+ * @unlink:                Unlink the context
+ * @apply_req:             Apply setting for the context
+ * @notify_frame_skip:     Notify device that a frame is skipped
+ * @flush_req:             Flush request to remove request ids
+ * @process_evt:           Handle event notification from CRM.(optional)
+ * @dump_req:              Dump information for the issue request
+ *
+ */
+struct cam_ctx_crm_ops {
+	int (*get_dev_info)(struct cam_context *ctx,
+			struct cam_req_mgr_device_info *device_info);
+	int (*link)(struct cam_context *ctx,
+			struct cam_req_mgr_core_dev_link_setup *link);
+	int (*unlink)(struct cam_context *ctx,
+			struct cam_req_mgr_core_dev_link_setup *unlink);
+	int (*apply_req)(struct cam_context *ctx,
+			struct cam_req_mgr_apply_request *apply);
+	int (*notify_frame_skip)(struct cam_context *ctx,
+			struct cam_req_mgr_apply_request *apply);
+	int (*flush_req)(struct cam_context *ctx,
+			struct cam_req_mgr_flush_request *flush);
+	int (*process_evt)(struct cam_context *ctx,
+			struct cam_req_mgr_link_evt_data *evt_data);
+	int (*dump_req)(struct cam_context *ctx,
+			struct cam_req_mgr_dump_info *dump);
+};
+
+
+/**
+ * struct cam_ctx_ops - Collection of the interface funciton tables
+ *
+ * @ioctl_ops:             Ioctl funciton table
+ * @crm_ops:               CRM to context interface function table
+ * @irq_ops:               Hardware event handle function
+ * @pagefault_ops:         Function to be called on page fault
+ * @dumpinfo_ops:          Function to be invoked for dumping any
+ *                         context info
+ * @msg_cb_ops:            Function to be called on any message from
+ *                         other subdev notifications
+ *
+ */
+struct cam_ctx_ops {
+	struct cam_ctx_ioctl_ops      ioctl_ops;
+	struct cam_ctx_crm_ops        crm_ops;
+	cam_hw_event_cb_func          irq_ops;
+	cam_hw_pagefault_cb_func      pagefault_ops;
+	cam_ctx_info_dump_cb_func     dumpinfo_ops;
+	cam_ctx_message_cb_func       msg_cb_ops;
+};
+
+/**
+ * struct cam_context - camera context object for the subdevice node
+ *
+ * @dev_name:              String giving name of device associated
+ * @dev_id:                ID of device associated
+ * @ctx_id:                ID for this context
+ * @list:                  Link list entry
+ * @sessoin_hdl:           Session handle
+ * @dev_hdl:               Device handle
+ * @link_hdl:              Link handle
+ * @ctx_mutex:             Mutex for ioctl calls
+ * @lock:                  Spin lock
+ * @active_req_list:       Requests pending for done event
+ * @pending_req_list:      Requests pending for reg upd event
+ * @wait_req_list:         Requests waiting for apply
+ * @free_req_list:         Requests that are free
+ * @req_list:              Reference to the request storage
+ * @req_size:              Size of the request storage
+ * @hw_mgr_intf:           Context to HW interface
+ * @ctx_crm_intf:          Context to CRM interface
+ * @crm_ctx_intf:          CRM to context interface
+ * @irq_cb_intf:           HW to context callback interface
+ * @state:                 Current state for top level state machine
+ * @state_machine:         Top level state machine
+ * @ctx_priv:              Private context pointer
+ * @ctxt_to_hw_map:        Context to hardware mapping pointer
+ * @refcount:              Context object refcount
+ * @node:                  The main node to which this context belongs
+ * @sync_mutex:            mutex to sync with sync cb thread
+ * @last_flush_req:        Last request to flush
+ *
+ */
+struct cam_context {
+	char                         dev_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	uint64_t                     dev_id;
+	uint32_t                     ctx_id;
+	struct list_head             list;
+	int32_t                      session_hdl;
+	int32_t                      dev_hdl;
+	int32_t                      link_hdl;
+
+	struct mutex                 ctx_mutex;
+	spinlock_t                   lock;
+
+	struct list_head             active_req_list;
+	struct list_head             pending_req_list;
+	struct list_head             wait_req_list;
+	struct list_head             free_req_list;
+	struct cam_ctx_request      *req_list;
+	uint32_t                     req_size;
+
+	struct cam_hw_mgr_intf      *hw_mgr_intf;
+	struct cam_req_mgr_crm_cb   *ctx_crm_intf;
+	struct cam_req_mgr_kmd_ops  *crm_ctx_intf;
+	cam_hw_event_cb_func         irq_cb_intf;
+
+	enum cam_context_state       state;
+	struct cam_ctx_ops          *state_machine;
+
+	void                        *ctx_priv;
+	void                        *ctxt_to_hw_map;
+
+	struct kref                  refcount;
+	void                        *node;
+	struct mutex                 sync_mutex;
+	uint32_t                     last_flush_req;
+};
+
+/**
+ * struct cam_context_dump_header -  Function for context dump header
+ *
+ * @tag         :    Tag for context dump header
+ * @size        :    Size of data
+ * @word_size   :    Word size of data
+ */
+struct cam_context_dump_header {
+	uint8_t   tag[CAM_CTXT_DUMP_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * cam_context_shutdown()
+ *
+ * @brief:        Calls while device close or shutdown
+ *
+ * @ctx:          Object pointer for cam_context
+ *
+ */
+int cam_context_shutdown(struct cam_context *ctx);
+
+/**
+ * cam_context_handle_crm_get_dev_info()
+ *
+ * @brief:        Handle get device information command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @info:         Device information returned
+ *
+ */
+int cam_context_handle_crm_get_dev_info(struct cam_context *ctx,
+		struct cam_req_mgr_device_info *info);
+
+/**
+ * cam_context_handle_crm_link()
+ *
+ * @brief:        Handle link command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @link:         Link command payload
+ *
+ */
+int cam_context_handle_crm_link(struct cam_context *ctx,
+		struct cam_req_mgr_core_dev_link_setup *link);
+
+/**
+ * cam_context_handle_crm_unlink()
+ *
+ * @brief:        Handle unlink command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @unlink:       Unlink command payload
+ *
+ */
+int cam_context_handle_crm_unlink(struct cam_context *ctx,
+		struct cam_req_mgr_core_dev_link_setup *unlink);
+
+/**
+ * cam_context_handle_crm_apply_req()
+ *
+ * @brief:        Handle apply request command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @apply:        Apply request command payload
+ *
+ */
+int cam_context_handle_crm_apply_req(struct cam_context *ctx,
+		struct cam_req_mgr_apply_request *apply);
+
+/**
+ * cam_context_handle_crm_notify_frame_skip()
+ *
+ * @brief:        Handle notify frame skip command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @apply:        Notify frame skip command payload
+ *
+ */
+int cam_context_handle_crm_notify_frame_skip(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply);
+
+/**
+ * cam_context_handle_crm_flush_req()
+ *
+ * @brief:        Handle flush request command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @apply:        Flush request command payload
+ *
+ */
+int cam_context_handle_crm_flush_req(struct cam_context *ctx,
+		struct cam_req_mgr_flush_request *apply);
+
+/**
+ * cam_context_handle_crm_process_evt()
+ *
+ * @brief:        Handle process event command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @process_evt:  process event command payload
+ *
+ */
+int cam_context_handle_crm_process_evt(struct cam_context *ctx,
+	struct cam_req_mgr_link_evt_data *process_evt);
+
+/**
+ * cam_context_handle_crm_dump_req()
+ *
+ * @brief:        Handle CRM dump request
+ *
+ * @ctx:          Object pointer for cam_context
+ * @dump:         Dump request command payload
+ *
+ */
+int cam_context_handle_crm_dump_req(struct cam_context *ctx,
+	struct cam_req_mgr_dump_info *dump);
+
+/**
+ * cam_context_dump_pf_info()
+ *
+ * @brief:        Handle dump active request request command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @pf_info:      Smmu page fault info
+ *
+ */
+int cam_context_dump_pf_info(struct cam_context *ctx,
+	struct cam_smmu_pf_info *pf_info);
+
+/**
+ * cam_context_handle_message()
+ *
+ * @brief:        Handle message callback command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @msg_type:     message type sent from other subdev
+ * @data:         data from other subdev
+ *
+ */
+int cam_context_handle_message(struct cam_context *ctx,
+	uint32_t msg_type, uint32_t *data);
+
+/**
+ * cam_context_handle_acquire_dev()
+ *
+ * @brief:        Handle acquire device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Acquire device command payload
+ *
+ */
+int cam_context_handle_acquire_dev(struct cam_context *ctx,
+		struct cam_acquire_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_acquire_hw()
+ *
+ * @brief:        Handle acquire HW command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Acquire HW command payload
+ *
+ */
+int cam_context_handle_acquire_hw(struct cam_context *ctx,
+		void *cmd);
+
+/**
+ * cam_context_handle_release_dev()
+ *
+ * @brief:        Handle release device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Release device command payload
+ *
+ */
+int cam_context_handle_release_dev(struct cam_context *ctx,
+		struct cam_release_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_release_hw()
+ *
+ * @brief:        Handle release HW command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Release HW command payload
+ *
+ */
+int cam_context_handle_release_hw(struct cam_context *ctx,
+		void *cmd);
+
+/**
+ * cam_context_handle_config_dev()
+ *
+ * @brief:        Handle config device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Config device command payload
+ *
+ */
+int cam_context_handle_config_dev(struct cam_context *ctx,
+		struct cam_config_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_flush_dev()
+ *
+ * @brief:        Handle flush device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Flush device command payload
+ *
+ */
+int cam_context_handle_flush_dev(struct cam_context *ctx,
+		struct cam_flush_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_start_dev()
+ *
+ * @brief:        Handle start device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Start device command payload
+ *
+ */
+int cam_context_handle_start_dev(struct cam_context *ctx,
+		struct cam_start_stop_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_stop_dev()
+ *
+ * @brief:        Handle stop device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Stop device command payload
+ *
+ */
+int cam_context_handle_stop_dev(struct cam_context *ctx,
+		struct cam_start_stop_dev_cmd *cmd);
+
+/**
+ * cam_context_handle_dump_dev()
+ *
+ * @brief:        Handle dump device command
+ *
+ * @ctx:          Object pointer for cam_context
+ * @cmd:          Dump device command payload
+ *
+ */
+int cam_context_handle_dump_dev(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd);
+
+/**
+ * cam_context_handle_info_dump()
+ *
+ * @brief:        Handle any dump info for the context
+ *
+ * @ctx:          Object pointer for cam_context
+ * @id:           To indicate which info pertaining
+ *                to that ctx needs to be dumped
+ *
+ */
+int cam_context_handle_info_dump(void *context,
+	enum cam_context_dump_id id);
+
+/**
+ * cam_context_deinit()
+ *
+ * @brief:        Camera context deinitialize function
+ *
+ * @ctx:          Object pointer for cam_context
+ *
+ */
+int cam_context_deinit(struct cam_context *ctx);
+
+/**
+ * cam_context_init()
+ *
+ * @brief:        Camera context initialize function
+ *
+ * @ctx:                   Object pointer for cam_context
+ * @dev_name:              String giving name of device associated
+ * @dev_id:                ID of the device associated
+ * @ctx_id:                ID for this context
+ * @crm_node_intf:         Function table for crm to context interface
+ * @hw_mgr_intf:           Function table for context to hw interface
+ * @req_list:              Requests storage
+ * @req_size:              Size of the request storage
+ *
+ */
+int cam_context_init(struct cam_context *ctx,
+		const char *dev_name,
+		uint64_t dev_id,
+		uint32_t ctx_id,
+		struct cam_req_mgr_kmd_ops *crm_node_intf,
+		struct cam_hw_mgr_intf *hw_mgr_intf,
+		struct cam_ctx_request *req_list,
+		uint32_t req_size);
+
+/**
+ * cam_context_putref()
+ *
+ * @brief:       Put back context reference.
+ *
+ * @ctx:                  Context for which ref is returned
+ *
+ */
+void cam_context_putref(struct cam_context *ctx);
+
+/**
+ * cam_context_getref()
+ *
+ * @brief:       Get back context reference.
+ *
+ * @ctx:                  Context for which ref is taken
+ *
+ */
+void cam_context_getref(struct cam_context *ctx);
+
+#endif  /* _CAM_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_context_utils.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_context_utils.c
@@ -0,0 +1,1204 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <media/cam_sync.h>
+#include <media/cam_defs.h>
+
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_mem_mgr.h"
+#include "cam_node.h"
+#include "cam_req_mgr_util.h"
+#include "cam_sync_api.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+
+static uint cam_debug_ctx_req_list;
+module_param(cam_debug_ctx_req_list, uint, 0644);
+
+static inline int cam_context_validate_thread(void)
+{
+	if (in_interrupt()) {
+		WARN(1, "Invalid execution context\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int cam_context_buf_done_from_hw(struct cam_context *ctx,
+	void *done_event_data, uint32_t evt_id)
+{
+	int j;
+	int result;
+	struct cam_ctx_request *req;
+	struct cam_hw_done_event_data *done =
+		(struct cam_hw_done_event_data *)done_event_data;
+	int rc;
+
+	if (!ctx || !done) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, done);
+		return -EINVAL;
+	}
+
+	rc = cam_context_validate_thread();
+	if (rc)
+		return rc;
+
+	spin_lock(&ctx->lock);
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] no active request",
+			ctx->dev_name, ctx->ctx_id);
+		spin_unlock(&ctx->lock);
+		return -EIO;
+	}
+	req = list_first_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+
+	trace_cam_buf_done("UTILS", ctx, req);
+
+	if (done->request_id != req->request_id) {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] mismatch: done req[%lld], active req[%lld]",
+			ctx->dev_name, ctx->ctx_id,
+			done->request_id, req->request_id);
+		spin_unlock(&ctx->lock);
+		return -EIO;
+	}
+
+	if (!req->num_out_map_entries) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] no output fence to signal",
+			ctx->dev_name, ctx->ctx_id);
+		spin_unlock(&ctx->lock);
+		return -EIO;
+	}
+
+	/*
+	 * since another thread may be adding/removing from active
+	 * list, so hold the lock
+	 */
+	list_del_init(&req->list);
+	spin_unlock(&ctx->lock);
+	if (evt_id == CAM_CTX_EVT_ID_SUCCESS)
+		result = CAM_SYNC_STATE_SIGNALED_SUCCESS;
+	else  if (evt_id == CAM_CTX_EVT_ID_CANCEL)
+		result = CAM_SYNC_STATE_SIGNALED_CANCEL;
+	else
+		result = CAM_SYNC_STATE_SIGNALED_ERROR;
+
+	CAM_DBG(CAM_REQ,
+		"[%s][ctx_id %d] : req[%llu] : Signaling %d",
+		ctx->dev_name, ctx->ctx_id, req->request_id, result);
+
+	for (j = 0; j < req->num_out_map_entries; j++) {
+		CAM_DBG(CAM_REQ, "fence %d signal with %d",
+			req->out_map_entries[j].sync_id, result);
+		cam_sync_signal(req->out_map_entries[j].sync_id, result,
+			done->evt_param);
+		req->out_map_entries[j].sync_id = -1;
+	}
+
+	if (cam_debug_ctx_req_list & ctx->dev_id)
+		CAM_INFO(CAM_CTXT,
+			"[%s][%d] : Moving req[%llu] from active_list to free_list",
+			ctx->dev_name, ctx->ctx_id, req->request_id);
+
+	/*
+	 * another thread may be adding/removing from free list,
+	 * so hold the lock
+	 */
+	spin_lock(&ctx->lock);
+	list_add_tail(&req->list, &ctx->free_req_list);
+	req->ctx = NULL;
+	spin_unlock(&ctx->lock);
+
+	return 0;
+}
+
+static int cam_context_apply_req_to_hw(struct cam_ctx_request *req,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_context *ctx = req->ctx;
+	struct cam_hw_config_args cfg;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	spin_lock(&ctx->lock);
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->active_req_list);
+	spin_unlock(&ctx->lock);
+
+	if (cam_debug_ctx_req_list & ctx->dev_id)
+		CAM_INFO(CAM_CTXT,
+			"[%s][%d] : Moving req[%llu] from pending_list to active_list",
+			ctx->dev_name, ctx->ctx_id, req->request_id);
+
+	cfg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	cfg.request_id = req->request_id;
+	cfg.hw_update_entries = req->hw_update_entries;
+	cfg.num_hw_update_entries = req->num_hw_update_entries;
+	cfg.out_map_entries = req->out_map_entries;
+	cfg.num_out_map_entries = req->num_out_map_entries;
+	cfg.priv = req->req_priv;
+
+	rc = ctx->hw_mgr_intf->hw_config(ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc) {
+		spin_lock(&ctx->lock);
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->free_req_list);
+		spin_unlock(&ctx->lock);
+
+		if (cam_debug_ctx_req_list & ctx->dev_id)
+			CAM_INFO(CAM_CTXT,
+				"[%s][%d] : Moving req[%llu] from active_list to free_list",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+	}
+
+end:
+	return rc;
+}
+
+static void cam_context_sync_callback(int32_t sync_obj, int status, void *data)
+{
+	struct cam_ctx_request *req = data;
+	struct cam_context *ctx = NULL;
+	struct cam_flush_dev_cmd flush_cmd;
+	struct cam_req_mgr_apply_request apply;
+	int rc;
+
+	if (!req) {
+		CAM_ERR(CAM_CTXT, "Invalid input param");
+		return;
+	}
+	rc = cam_context_validate_thread();
+	if (rc)
+		return;
+
+	ctx = req->ctx;
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid ctx for req %llu", req->request_id);
+		return;
+	}
+
+	if (atomic_inc_return(&req->num_in_acked) == req->num_in_map_entries) {
+		apply.request_id = req->request_id;
+		/*
+		 * take mutex to ensure that another thread does
+		 * not flush the request while this
+		 * thread is submitting it to h/w. The submit to
+		 * h/w and adding to the active list should happen
+		 * in a critical section which is provided by this
+		 * mutex.
+		 */
+		if ((status == CAM_SYNC_STATE_SIGNALED_ERROR) ||
+			(status == CAM_SYNC_STATE_SIGNALED_CANCEL)) {
+			CAM_DBG(CAM_CTXT, "fence error: %d on obj %d",
+				status, sync_obj);
+			flush_cmd.req_id = req->request_id;
+			cam_context_flush_req_to_hw(ctx, &flush_cmd);
+		}
+
+		mutex_lock(&ctx->sync_mutex);
+		if (!req->flushed) {
+			cam_context_apply_req_to_hw(req, &apply);
+			mutex_unlock(&ctx->sync_mutex);
+		} else {
+			req->flushed = 0;
+			req->ctx = NULL;
+			mutex_unlock(&ctx->sync_mutex);
+			spin_lock(&ctx->lock);
+			list_del_init(&req->list);
+			list_add_tail(&req->list, &ctx->free_req_list);
+			spin_unlock(&ctx->lock);
+
+			if (cam_debug_ctx_req_list & ctx->dev_id)
+				CAM_INFO(CAM_CTXT,
+					"[%s][%d] : Moving req[%llu] from pending_list to free_list",
+					ctx->dev_name, ctx->ctx_id,
+					req->request_id);
+		}
+	}
+	cam_context_putref(ctx);
+}
+
+int32_t cam_context_release_dev_to_hw(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	struct cam_hw_release_args arg;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid input param");
+		return -EINVAL;
+	}
+
+	if ((!ctx->hw_mgr_intf) || (!ctx->hw_mgr_intf->hw_release)) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EINVAL;
+	}
+
+	arg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	arg.active_req = false;
+
+	ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv, &arg);
+	ctx->ctxt_to_hw_map = NULL;
+
+	ctx->session_hdl = -1;
+	ctx->dev_hdl = -1;
+	ctx->link_hdl = -1;
+
+	return 0;
+}
+
+int32_t cam_context_config_dev_to_hw(
+	struct cam_context *ctx, struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	size_t len;
+	struct cam_hw_stream_setttings cfg;
+	uintptr_t packet_addr;
+	struct cam_packet *packet;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		return -EINVAL;
+	}
+
+	if (!ctx->hw_mgr_intf->hw_config_stream_settings) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		return rc;
+	}
+
+	rc = cam_context_validate_thread();
+	if (rc) {
+		CAM_ERR(CAM_CTXT,
+			"Not executing in the right context");
+		return rc;
+	}
+
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] Can not get packet address",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	packet = (struct cam_packet *) ((uint8_t *)packet_addr +
+		(uint32_t)cmd->offset);
+
+	memset(&cfg, 0, sizeof(cfg));
+	cfg.packet = packet;
+	cfg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	cfg.priv = NULL;
+
+	CAM_DBG(CAM_CTXT, "Processing config settings");
+	rc = ctx->hw_mgr_intf->hw_config_stream_settings(
+		ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc) {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] Config failed stream settings",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+	}
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+}
+
+int32_t cam_context_prepare_dev_to_hw(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_ctx_request *req = NULL;
+	struct cam_hw_prepare_update_args cfg;
+	uintptr_t packet_addr;
+	struct cam_packet *packet;
+	size_t len = 0;
+	size_t remain_len = 0;
+	int32_t i = 0, j = 0;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		return -EINVAL;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EFAULT;
+	}
+	rc = cam_context_validate_thread();
+	if (rc)
+		return rc;
+
+	spin_lock(&ctx->lock);
+	if (!list_empty(&ctx->free_req_list)) {
+		req = list_first_entry(&ctx->free_req_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+	}
+	spin_unlock(&ctx->lock);
+
+	if (!req) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] No more request obj free",
+			ctx->dev_name, ctx->ctx_id);
+		return -ENOMEM;
+	}
+
+	memset(req, 0, sizeof(*req));
+	INIT_LIST_HEAD(&req->list);
+	req->ctx = ctx;
+
+	/* for config dev, only memory handle is supported */
+	/* map packet from the memhandle */
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc != 0) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] Can not get packet address",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		goto free_req;
+	}
+
+	if ((len < sizeof(struct cam_packet)) ||
+		(cmd->offset >= (len - sizeof(struct cam_packet)))) {
+		CAM_ERR(CAM_CTXT, "Not enough buf");
+		cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+		return -EINVAL;
+
+	}
+	remain_len = len;
+	if ((len < sizeof(struct cam_packet)) ||
+		((size_t)cmd->offset >= len - sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_CTXT, "invalid buff length: %zu or offset", len);
+		rc = -EINVAL;
+		goto free_req;
+	}
+
+	remain_len -= (size_t)cmd->offset;
+	packet = (struct cam_packet *) ((uint8_t *)packet_addr +
+		(uint32_t)cmd->offset);
+
+	if (packet->header.request_id <= ctx->last_flush_req) {
+		CAM_ERR(CAM_CORE,
+			"request %lld has been flushed, reject packet last %u",
+			packet->header.request_id, ctx->last_flush_req);
+		rc = -EBADR;
+		goto free_req;
+	}
+
+	if (packet->header.request_id > ctx->last_flush_req)
+		ctx->last_flush_req = 0;
+
+	/* preprocess the configuration */
+	memset(&cfg, 0, sizeof(cfg));
+	cfg.packet = packet;
+	cfg.remain_len = remain_len;
+	cfg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	cfg.max_hw_update_entries = CAM_CTX_CFG_MAX;
+	cfg.num_hw_update_entries = req->num_hw_update_entries;
+	cfg.hw_update_entries = req->hw_update_entries;
+	cfg.max_out_map_entries = CAM_CTX_CFG_MAX;
+	cfg.out_map_entries = req->out_map_entries;
+	cfg.max_in_map_entries = CAM_CTX_CFG_MAX;
+	cfg.in_map_entries = req->in_map_entries;
+	cfg.pf_data = &(req->pf_data);
+
+	rc = ctx->hw_mgr_intf->hw_prepare_update(
+		ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc != 0) {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] Prepare config packet failed in HW layer",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto free_req;
+	}
+	req->num_hw_update_entries = cfg.num_hw_update_entries;
+	req->num_out_map_entries = cfg.num_out_map_entries;
+	req->num_in_map_entries = cfg.num_in_map_entries;
+	atomic_set(&req->num_in_acked, 0);
+	req->request_id = packet->header.request_id;
+	req->status = 1;
+	req->req_priv = cfg.priv;
+
+	for (i = 0; i < req->num_out_map_entries; i++) {
+		rc = cam_sync_get_obj_ref(req->out_map_entries[i].sync_id);
+		if (rc) {
+			CAM_ERR(CAM_CTXT, "Can't get ref for sync %d",
+				req->out_map_entries[i].sync_id);
+			goto put_ref;
+		}
+	}
+
+	if (req->num_in_map_entries > 0) {
+		spin_lock(&ctx->lock);
+		list_add_tail(&req->list, &ctx->pending_req_list);
+		spin_unlock(&ctx->lock);
+
+		if (cam_debug_ctx_req_list & ctx->dev_id)
+			CAM_INFO(CAM_CTXT,
+				"[%s][%d] : Moving req[%llu] from free_list to pending_list",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+
+		for (j = 0; j < req->num_in_map_entries; j++) {
+			rc = cam_sync_check_valid(
+				req->in_map_entries[j].sync_id);
+			if (rc) {
+				spin_lock(&ctx->lock);
+				list_del_init(&req->list);
+				spin_unlock(&ctx->lock);
+				CAM_ERR(CAM_CTXT,
+					"invalid in map sync object %d",
+					req->in_map_entries[j].sync_id);
+				goto put_ref;
+			}
+		}
+
+		for (j = 0; j < req->num_in_map_entries; j++) {
+			cam_context_getref(ctx);
+			rc = cam_sync_register_callback(
+					cam_context_sync_callback,
+					(void *)req,
+					req->in_map_entries[j].sync_id);
+			if (rc) {
+				CAM_ERR(CAM_CTXT,
+					"[%s][%d] Failed register fence cb: %d ret = %d",
+					ctx->dev_name, ctx->ctx_id,
+					req->in_map_entries[j].sync_id, rc);
+				spin_lock(&ctx->lock);
+				list_del_init(&req->list);
+				spin_unlock(&ctx->lock);
+
+				if (cam_debug_ctx_req_list & ctx->dev_id)
+					CAM_INFO(CAM_CTXT,
+						"[%s][%d] : Moving req[%llu] from pending_list to free_list",
+						ctx->dev_name, ctx->ctx_id,
+						req->request_id);
+
+				cam_context_putref(ctx);
+				goto put_ref;
+			}
+			CAM_DBG(CAM_CTXT, "register in fence cb: %d ret = %d",
+				req->in_map_entries[j].sync_id, rc);
+		}
+	}
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+put_ref:
+	for (--i; i >= 0; i--) {
+		if (cam_sync_put_obj_ref(req->out_map_entries[i].sync_id))
+			CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d",
+				req->out_map_entries[i].sync_id);
+	}
+free_req:
+	spin_lock(&ctx->lock);
+	list_add_tail(&req->list, &ctx->free_req_list);
+	req->ctx = NULL;
+	spin_unlock(&ctx->lock);
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+}
+
+int32_t cam_context_acquire_dev_to_hw(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_hw_acquire_args param;
+	struct cam_create_dev_hdl req_hdl_param;
+	struct cam_hw_release_args release;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_CTXT, "ses hdl: %x, num_res: %d, type: %d, res: %lld",
+		cmd->session_handle, cmd->num_resources, cmd->handle_type,
+		cmd->resource_hdl);
+
+	if (cmd->num_resources > CAM_CTX_RES_MAX) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] resource[%d] limit exceeded",
+			ctx->dev_name, ctx->ctx_id, cmd->num_resources);
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	/* for now we only support user pointer */
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_CTXT, "[%s][%d] Only user pointer is supported",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* fill in parameters */
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.num_acq = cmd->num_resources;
+	param.acquire_info = cmd->resource_hdl;
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] Acquire device failed",
+			ctx->dev_name, ctx->ctx_id);
+		goto end;
+	}
+
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+
+	/* if hw resource acquire successful, acquire dev handle */
+	req_hdl_param.session_hdl = cmd->session_handle;
+	/* bridge is not ready for these flags. so false for now */
+	req_hdl_param.v4l2_sub_dev_flag = 0;
+	req_hdl_param.media_entity_flag = 0;
+	req_hdl_param.priv = ctx;
+	req_hdl_param.ops = ctx->crm_ctx_intf;
+	req_hdl_param.dev_id = ctx->dev_id;
+	ctx->dev_hdl = cam_create_device_hdl(&req_hdl_param);
+	if (ctx->dev_hdl <= 0) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_CTXT, "[%s][%d] Can not create device handle",
+			ctx->dev_name, ctx->ctx_id);
+		goto free_hw;
+	}
+	cmd->dev_handle = ctx->dev_hdl;
+
+	/* store session information */
+	ctx->session_hdl = cmd->session_handle;
+
+	return rc;
+
+free_hw:
+	release.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+	ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv, &release);
+	ctx->ctxt_to_hw_map = NULL;
+	ctx->dev_hdl = -1;
+end:
+	return rc;
+}
+
+int32_t cam_context_flush_ctx_to_hw(struct cam_context *ctx)
+{
+	struct cam_hw_flush_args flush_args;
+	struct list_head temp_list;
+	struct cam_ctx_request *req;
+	uint32_t i;
+	int rc = 0;
+	bool free_req;
+
+	CAM_DBG(CAM_CTXT, "[%s] E: NRT flush ctx", ctx->dev_name);
+	memset(&flush_args, 0, sizeof(flush_args));
+
+	/*
+	 * flush pending requests, take the sync lock to synchronize with the
+	 * sync callback thread so that the sync cb thread does not try to
+	 * submit request to h/w while the request is being flushed
+	 */
+	mutex_lock(&ctx->sync_mutex);
+	INIT_LIST_HEAD(&temp_list);
+	spin_lock(&ctx->lock);
+	list_splice_init(&ctx->pending_req_list, &temp_list);
+	spin_unlock(&ctx->lock);
+
+	if (cam_debug_ctx_req_list & ctx->dev_id)
+		CAM_INFO(CAM_CTXT,
+			"[%s][%d] : Moving all pending requests from pending_list to temp_list",
+			ctx->dev_name, ctx->ctx_id);
+
+	flush_args.num_req_pending = 0;
+	flush_args.last_flush_req = ctx->last_flush_req;
+	while (true) {
+		spin_lock(&ctx->lock);
+		if (list_empty(&temp_list)) {
+			spin_unlock(&ctx->lock);
+			break;
+		}
+
+		req = list_first_entry(&temp_list,
+				struct cam_ctx_request, list);
+
+		list_del_init(&req->list);
+		spin_unlock(&ctx->lock);
+		req->flushed = 1;
+
+		flush_args.flush_req_pending[flush_args.num_req_pending++] =
+			req->req_priv;
+
+		free_req = false;
+		for (i = 0; i < req->num_in_map_entries; i++) {
+			rc = cam_sync_deregister_callback(
+				cam_context_sync_callback,
+				(void *)req,
+				req->in_map_entries[i].sync_id);
+			if (!rc) {
+				cam_context_putref(ctx);
+				if (atomic_inc_return(&req->num_in_acked) ==
+					req->num_in_map_entries)
+					free_req = true;
+			}
+		}
+
+		for (i = 0; i < req->num_out_map_entries; i++) {
+			if (req->out_map_entries[i].sync_id != -1) {
+				rc = cam_sync_signal(
+					req->out_map_entries[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_FLUSH);
+				if (rc == -EALREADY) {
+					CAM_ERR(CAM_CTXT,
+					"Req: %llu already signalled, sync_id:%d",
+					req->request_id,
+					req->out_map_entries[i].sync_id);
+					break;
+				}
+			}
+		}
+
+		/*
+		 * If we have deregistered the last sync callback, req will
+		 * not be put on the free list. So put it on the free list here
+		 */
+		if (free_req) {
+			req->ctx = NULL;
+			spin_lock(&ctx->lock);
+			list_add_tail(&req->list, &ctx->free_req_list);
+			spin_unlock(&ctx->lock);
+		}
+
+		if (cam_debug_ctx_req_list & ctx->dev_id)
+			CAM_INFO(CAM_CTXT,
+				"[%s][%d] : Deleting req[%llu] from temp_list",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+	}
+	mutex_unlock(&ctx->sync_mutex);
+
+	if (ctx->hw_mgr_intf->hw_flush) {
+		flush_args.num_req_active = 0;
+		spin_lock(&ctx->lock);
+		list_for_each_entry(req, &ctx->active_req_list, list) {
+			flush_args.flush_req_active[flush_args.num_req_active++]
+				= req->req_priv;
+		}
+		spin_unlock(&ctx->lock);
+
+		if (flush_args.num_req_pending || flush_args.num_req_active) {
+			flush_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+			flush_args.flush_type = CAM_FLUSH_TYPE_ALL;
+			ctx->hw_mgr_intf->hw_flush(
+				ctx->hw_mgr_intf->hw_mgr_priv, &flush_args);
+		}
+	}
+
+	INIT_LIST_HEAD(&temp_list);
+	spin_lock(&ctx->lock);
+	list_splice_init(&ctx->active_req_list, &temp_list);
+	INIT_LIST_HEAD(&ctx->active_req_list);
+	spin_unlock(&ctx->lock);
+
+	if (cam_debug_ctx_req_list & ctx->dev_id)
+		CAM_INFO(CAM_CTXT,
+			"[%s][%d] : Moving all requests from active_list to temp_list",
+			ctx->dev_name, ctx->ctx_id);
+
+	while (true) {
+		spin_lock(&ctx->lock);
+		if (list_empty(&temp_list)) {
+			spin_unlock(&ctx->lock);
+			break;
+		}
+		req = list_first_entry(&temp_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		spin_unlock(&ctx->lock);
+
+		for (i = 0; i < req->num_out_map_entries; i++) {
+			if (req->out_map_entries[i].sync_id != -1) {
+				rc = cam_sync_signal(
+					req->out_map_entries[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_FLUSH);
+				if (rc == -EALREADY) {
+					CAM_ERR(CAM_CTXT,
+						"Req: %llu already signalled ctx: %pK dev_name: %s dev_handle: %d ctx_state: %d",
+						req->request_id, req->ctx,
+						req->ctx->dev_name,
+						req->ctx->dev_hdl,
+						req->ctx->state);
+					break;
+				}
+			}
+		}
+
+		spin_lock(&ctx->lock);
+		list_add_tail(&req->list, &ctx->free_req_list);
+		spin_unlock(&ctx->lock);
+		req->ctx = NULL;
+
+		if (cam_debug_ctx_req_list & ctx->dev_id)
+			CAM_INFO(CAM_CTXT,
+				"[%s][%d] : Moving req[%llu] from temp_list to free_list",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+	}
+
+	CAM_DBG(CAM_CTXT, "[%s] X: NRT flush ctx", ctx->dev_name);
+
+	return 0;
+}
+
+int32_t cam_context_flush_req_to_hw(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	struct cam_ctx_request *req = NULL;
+	struct cam_hw_flush_args flush_args;
+	uint32_t i;
+	int32_t sync_id = 0;
+	int rc = 0;
+	bool free_req = false;
+
+	CAM_DBG(CAM_CTXT, "[%s] E: NRT flush req", ctx->dev_name);
+
+	memset(&flush_args, 0, sizeof(flush_args));
+	flush_args.num_req_pending = 0;
+	flush_args.num_req_active = 0;
+	mutex_lock(&ctx->sync_mutex);
+	spin_lock(&ctx->lock);
+	list_for_each_entry(req, &ctx->pending_req_list, list) {
+		if (req->request_id != cmd->req_id)
+			continue;
+
+		if (cam_debug_ctx_req_list & ctx->dev_id)
+			CAM_INFO(CAM_CTXT,
+				"[%s][%d] : Deleting req[%llu] from pending_list",
+				ctx->dev_name, ctx->ctx_id, req->request_id);
+
+		list_del_init(&req->list);
+		req->flushed = 1;
+
+		flush_args.flush_req_pending[flush_args.num_req_pending++] =
+			req->req_priv;
+		break;
+	}
+	spin_unlock(&ctx->lock);
+	mutex_unlock(&ctx->sync_mutex);
+
+	if (ctx->hw_mgr_intf->hw_flush) {
+		if (!flush_args.num_req_pending) {
+			spin_lock(&ctx->lock);
+			list_for_each_entry(req, &ctx->active_req_list, list) {
+				if (req->request_id != cmd->req_id)
+					continue;
+
+				list_del_init(&req->list);
+
+				flush_args.flush_req_active[
+					flush_args.num_req_active++] =
+					req->req_priv;
+				break;
+			}
+			spin_unlock(&ctx->lock);
+		}
+
+		if (flush_args.num_req_pending || flush_args.num_req_active) {
+			flush_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+			flush_args.flush_type = CAM_FLUSH_TYPE_REQ;
+			ctx->hw_mgr_intf->hw_flush(
+				ctx->hw_mgr_intf->hw_mgr_priv, &flush_args);
+		}
+	}
+
+	if (req) {
+		if (flush_args.num_req_pending) {
+			for (i = 0; i < req->num_in_map_entries; i++) {
+				rc = cam_sync_deregister_callback(
+					cam_context_sync_callback,
+					(void *)req,
+					req->in_map_entries[i].sync_id);
+				if (rc)
+					continue;
+
+				cam_context_putref(ctx);
+				if (atomic_inc_return(&req->num_in_acked) ==
+					req->num_in_map_entries)
+					free_req = true;
+			}
+		}
+
+		if (flush_args.num_req_pending || flush_args.num_req_active) {
+			for (i = 0; i < req->num_out_map_entries; i++) {
+				sync_id =
+					req->out_map_entries[i].sync_id;
+				if (sync_id != -1) {
+					rc = cam_sync_signal(sync_id,
+						CAM_SYNC_STATE_SIGNALED_CANCEL,
+						CAM_SYNC_COMMON_EVENT_FLUSH);
+					if (rc == -EALREADY) {
+						CAM_ERR(CAM_CTXT,
+						"Req: %llu already signalled, sync_id:%d",
+						req->request_id, sync_id);
+						break;
+					}
+				}
+			}
+			if (flush_args.num_req_active || free_req) {
+				req->ctx = NULL;
+				spin_lock(&ctx->lock);
+				list_add_tail(&req->list, &ctx->free_req_list);
+				spin_unlock(&ctx->lock);
+
+				if (cam_debug_ctx_req_list & ctx->dev_id)
+					CAM_INFO(CAM_CTXT,
+						"[%s][%d] : Moving req[%llu] from %s to free_list",
+						ctx->dev_name, ctx->ctx_id,
+						req->request_id,
+						flush_args.num_req_active ?
+							"active_list" :
+							"pending_list");
+			}
+		}
+	}
+	CAM_DBG(CAM_CTXT, "[%s] X: NRT flush req", ctx->dev_name);
+
+	return 0;
+}
+
+int32_t cam_context_flush_dev_to_hw(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+
+	int rc = 0;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (cmd->flush_type == CAM_FLUSH_TYPE_ALL) {
+		ctx->last_flush_req = cmd->req_id;
+		rc = cam_context_flush_ctx_to_hw(ctx);
+	} else if (cmd->flush_type == CAM_FLUSH_TYPE_REQ)
+		rc = cam_context_flush_req_to_hw(ctx, cmd);
+	else {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CORE, "[%s][%d] Invalid flush type %d",
+			ctx->dev_name, ctx->ctx_id, cmd->flush_type);
+	}
+
+end:
+	return rc;
+}
+
+int32_t cam_context_start_dev_to_hw(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_hw_start_args arg;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if ((cmd->session_handle != ctx->session_hdl) ||
+		(cmd->dev_handle != ctx->dev_hdl)) {
+		CAM_ERR(CAM_CTXT,
+			"[%s][%d] Invalid session hdl[%d], dev_handle[%d]",
+			ctx->dev_name, ctx->ctx_id,
+			cmd->session_handle, cmd->dev_handle);
+		rc = -EPERM;
+		goto end;
+	}
+
+	if (ctx->hw_mgr_intf->hw_start) {
+		arg.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		rc = ctx->hw_mgr_intf->hw_start(ctx->hw_mgr_intf->hw_mgr_priv,
+				&arg);
+		if (rc) {
+			/* HW failure. user need to clean up the resource */
+			CAM_ERR(CAM_CTXT, "[%s][%d] Start HW failed",
+				ctx->dev_name, ctx->ctx_id);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+int32_t cam_context_stop_dev_to_hw(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_hw_stop_args stop;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid input param");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_context_validate_thread();
+	if (rc)
+		goto end;
+
+	rc = cam_context_flush_ctx_to_hw(ctx);
+	if (rc)
+		goto end;
+
+	/* stop hw first */
+	if (ctx->hw_mgr_intf->hw_stop) {
+		stop.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		ctx->hw_mgr_intf->hw_stop(ctx->hw_mgr_intf->hw_mgr_priv,
+			&stop);
+	}
+
+end:
+	return rc;
+}
+
+int32_t cam_context_dump_pf_info_to_hw(struct cam_context *ctx,
+	struct cam_hw_mgr_dump_pf_data *pf_data, bool *mem_found, bool *ctx_found,
+	uint32_t  *resource_type, struct cam_smmu_pf_info *pf_info)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args cmd_args;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK ", ctx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (ctx->hw_mgr_intf->hw_cmd) {
+		cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		cmd_args.cmd_type = CAM_HW_MGR_CMD_DUMP_PF_INFO;
+		cmd_args.u.pf_args.pf_data = *pf_data;
+		cmd_args.u.pf_args.iova = pf_info->iova;
+		cmd_args.u.pf_args.buf_info = pf_info->buf_info;
+		cmd_args.u.pf_args.mem_found = mem_found;
+		cmd_args.u.pf_args.ctx_found = ctx_found;
+		cmd_args.u.pf_args.resource_type = resource_type;
+		cmd_args.u.pf_args.bid = pf_info->bid;
+		cmd_args.u.pf_args.pid = pf_info->pid;
+		cmd_args.u.pf_args.mid = pf_info->mid;
+		ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&cmd_args);
+	}
+
+end:
+	return rc;
+}
+
+int32_t cam_context_dump_hw_acq_info(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args cmd_args;
+
+	if (!ctx) {
+		CAM_ERR(CAM_CTXT, "Invalid input params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (ctx->hw_mgr_intf->hw_cmd) {
+		cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		cmd_args.cmd_type = CAM_HW_MGR_CMD_DUMP_ACQ_INFO;
+		ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&cmd_args);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_context_dump_context(struct cam_context *ctx,
+	struct cam_hw_dump_args *dump_args)
+{
+	int                             rc;
+	int                             i;
+	size_t                          buf_len;
+	size_t                          remain_len;
+	uint8_t                        *dst;
+	uint64_t                       *addr, *start;
+	uint32_t                        min_len;
+	uintptr_t                       cpu_addr;
+	struct cam_ctx_request         *req;
+	struct cam_context_dump_header *hdr;
+
+	if (!ctx || !dump_args) {
+		CAM_ERR(CAM_CORE, "Invalid parameters %pK %pK",
+			ctx, dump_args);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] no active request",
+			ctx->dev_name, ctx->ctx_id);
+		spin_unlock_bh(&ctx->lock);
+		return -EIO;
+	}
+	req = list_first_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+	spin_unlock_bh(&ctx->lock);
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_CTXT, "Invalid hdl %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+	if (dump_args->offset >= buf_len) {
+		CAM_WARN(CAM_CTXT, "dump buffer overshoot offset %zu len %zu",
+			dump_args->offset, buf_len);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	remain_len = buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_context_dump_header) +
+		    (CAM_CTXT_DUMP_NUM_WORDS + req->num_in_map_entries +
+		    (req->num_out_map_entries * 2)) * sizeof(uint64_t);
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_CTXT, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+	dst = (uint8_t *)cpu_addr + dump_args->offset;
+	hdr = (struct cam_context_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_CTXT_DUMP_TAG_MAX_LEN,
+		"%s_CTXT_DUMP:", ctx->dev_name);
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_context_dump_header));
+	start = addr;
+	*addr++ = ctx->ctx_id;
+	*addr++ = refcount_read(&(ctx->refcount.refcount));
+	*addr++ = ctx->last_flush_req;
+	*addr++ = ctx->state;
+	*addr++ = req->num_out_map_entries;
+	for (i = 0; i < req->num_out_map_entries; i++) {
+		*addr++ = req->out_map_entries[i].resource_handle;
+		*addr++ = req->out_map_entries[i].sync_id;
+	}
+	*addr++ = req->num_in_map_entries;
+	for (i = 0; i < req->num_in_map_entries; i++)
+		*addr++ = req->in_map_entries[i].sync_id;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_context_dump_header);
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return 0;
+}
+
+int32_t cam_context_dump_dev_to_hw(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int                     rc = 0;
+	struct cam_hw_dump_args dump_args;
+
+	if (!ctx || !cmd) {
+		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
+		return -EINVAL;
+	}
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CTXT, "[%s][%d] HW interface is not ready",
+			ctx->dev_name, ctx->ctx_id);
+		return -EFAULT;
+	}
+	memset(&dump_args, 0, sizeof(dump_args));
+	if (ctx->hw_mgr_intf->hw_dump) {
+		dump_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		dump_args.buf_handle = cmd->buf_handle;
+		dump_args.offset = cmd->offset;
+		dump_args.request_id = cmd->issue_req_id;
+		dump_args.error_type = cmd->error_type;
+		rc  = ctx->hw_mgr_intf->hw_dump(
+			ctx->hw_mgr_intf->hw_mgr_priv,
+			&dump_args);
+		if (rc) {
+			CAM_ERR(CAM_CTXT, "[%s][%d] handle[%u] failed",
+			    ctx->dev_name, ctx->ctx_id, dump_args.buf_handle);
+			return rc;
+		}
+		/* Offset will change if the issue request id is found with
+		 * the hw and has been lying with it beyond threshold time.
+		 * If offset does not change, do not dump the context
+		 * information as the current context has no problem with
+		 * the provided request id.
+		 */
+		if (dump_args.offset > cmd->offset) {
+			cam_context_dump_context(ctx, &dump_args);
+			CAM_INFO(CAM_CTXT, "[%s] ctx: %d Filled Length %zu",
+				 ctx->dev_name, ctx->ctx_id,
+				 dump_args.offset - cmd->offset);
+			cmd->offset  = dump_args.offset;
+		}
+	} else {
+		CAM_DBG(CAM_CTXT, "%s hw dump not registered", ctx->dev_name);
+	}
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_context_utils.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_context_utils.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CONTEXT_UTILS_H_
+#define _CAM_CONTEXT_UTILS_H_
+
+#include <linux/types.h>
+#include "cam_smmu_api.h"
+
+int cam_context_buf_done_from_hw(struct cam_context *ctx,
+	void *done_event_data, uint32_t evt_id);
+int32_t cam_context_release_dev_to_hw(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd);
+int32_t cam_context_prepare_dev_to_hw(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd);
+int32_t cam_context_config_dev_to_hw(
+	struct cam_context *ctx, struct cam_config_dev_cmd *cmd);
+int32_t cam_context_acquire_dev_to_hw(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd);
+int32_t cam_context_start_dev_to_hw(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd);
+int32_t cam_context_stop_dev_to_hw(struct cam_context *ctx);
+int32_t cam_context_flush_dev_to_hw(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd);
+int32_t cam_context_flush_ctx_to_hw(struct cam_context *ctx);
+int32_t cam_context_flush_req_to_hw(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd);
+int32_t cam_context_dump_pf_info_to_hw(struct cam_context *ctx,
+	struct cam_hw_mgr_dump_pf_data *pf_data, bool *mem_found, bool *ctx_found,
+	uint32_t  *resource_type,
+	struct cam_smmu_pf_info *pf_info);
+int32_t cam_context_dump_hw_acq_info(struct cam_context *ctx);
+int32_t cam_context_dump_dev_to_hw(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd);
+#endif /* _CAM_CONTEXT_UTILS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_hw.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_HW_H_
+#define _CAM_HW_H_
+
+#include "cam_soc_util.h"
+
+/*
+ * This file declares Enums, Structures and APIs to be used as template
+ * when writing any HW driver in the camera subsystem.
+ */
+
+/* Hardware state enum */
+enum cam_hw_state {
+	CAM_HW_STATE_POWER_DOWN,
+	CAM_HW_STATE_POWER_UP,
+};
+
+/**
+ * struct cam_hw_info - Common hardware information
+ *
+ * @hw_mutex:              Hardware mutex
+ * @hw_lock:               Hardware spinlock
+ * @hw_complete:           Hardware Completion
+ * @open_count:            Count to track the HW enable from the client
+ * @hw_state:              Hardware state
+ * @soc_info:              Platform SOC properties for hardware
+ * @node_info:             Private HW data related to nodes
+ * @core_info:             Private HW data related to core logic
+ *
+ */
+struct cam_hw_info {
+	struct mutex                    hw_mutex;
+	spinlock_t                      hw_lock;
+	struct completion               hw_complete;
+	uint32_t                        open_count;
+	enum cam_hw_state               hw_state;
+	struct cam_hw_soc_info          soc_info;
+	void                           *node_info;
+	void                           *core_info;
+};
+
+#endif /* _CAM_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_hw_intf.h
@@ -0,0 +1,80 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_HW_INTF_H_
+#define _CAM_HW_INTF_H_
+
+#include <linux/types.h>
+
+/*
+ * This file declares Constants, Enums, Structures and APIs to be used as
+ * Interface between HW driver and HW Manager.
+ */
+
+/**
+ * struct cam_hw_ops - Hardware layer interface functions
+ *
+ * @get_hw_caps:           Function pointer for get hw caps
+ * @init:                  Function poniter for initialize hardware
+ * @deinit:                Function pointer for deinitialize hardware
+ * @reset:                 Function pointer for reset hardware
+ * @reserve:               Function pointer for reserve hardware
+ * @release:               Function pointer for release hardware
+ * @start:                 Function pointer for start hardware
+ * @stop:                  Function pointer for stop hardware
+ * @read:                  Function pointer for read hardware registers
+ * @write:                 Function pointer for Write hardware registers
+ * @process_cmd:           Function pointer for additional hardware controls
+ * @flush_cmd:             Function pointer for flush requests
+ *
+ */
+struct cam_hw_ops {
+	int (*get_hw_caps)(void *hw_priv,
+		void *get_hw_cap_args, uint32_t arg_size);
+	int (*init)(void *hw_priv,
+		void *init_hw_args, uint32_t arg_size);
+	int (*deinit)(void *hw_priv,
+		void *init_hw_args, uint32_t arg_size);
+	int (*reset)(void *hw_priv,
+		void *reset_core_args, uint32_t arg_size);
+	int (*reserve)(void *hw_priv,
+		void *reserve_args, uint32_t arg_size);
+	int (*release)(void *hw_priv,
+		void *release_args, uint32_t arg_size);
+	int (*start)(void *hw_priv,
+		void *start_args, uint32_t arg_size);
+	int (*stop)(void *hw_priv,
+		void *stop_args, uint32_t arg_size);
+	int (*read)(void *hw_priv,
+		void *read_args, uint32_t arg_size);
+	int (*write)(void *hw_priv,
+		void *write_args, uint32_t arg_size);
+	int (*process_cmd)(void *hw_priv,
+		uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+	int (*flush)(void *hw_priv,
+		void *flush_args, uint32_t arg_size);
+};
+
+/**
+ * struct cam_hw_intf - Common hardware node
+ *
+ * @hw_type:               Hardware type
+ * @hw_idx:                Hardware ID
+ * @hw_ops:                Hardware interface function table
+ * @hw_priv:               Private hardware node pointer
+ *
+ */
+struct cam_hw_intf {
+	uint32_t                     hw_type;
+	uint32_t                     hw_idx;
+	struct cam_hw_ops            hw_ops;
+	void                        *hw_priv;
+};
+
+/* hardware event callback function type */
+typedef int (*cam_hw_mgr_event_cb_func)(void *priv, uint32_t evt_id,
+	void *evt_data);
+
+#endif /* _CAM_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_hw_mgr_intf.h
@@ -0,0 +1,508 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_HW_MGR_INTF_H_
+#define _CAM_HW_MGR_INTF_H_
+
+#include <linux/time.h>
+#include <linux/types.h>
+#include <media/cam_defs.h>
+#include "cam_smmu_api.h"
+
+/*
+ * This file declares Constants, Enums, Structures and APIs to be used as
+ * Interface between HW Manager and Context.
+ */
+
+
+/* maximum context numbers */
+#define CAM_CTX_MAX                         8
+
+/* maximum buf done irqs */
+#define CAM_NUM_OUT_PER_COMP_IRQ_MAX        12
+
+/* Maximum reg dump cmd buffer entries in a context */
+#define CAM_REG_DUMP_MAX_BUF_ENTRIES        10
+
+/**
+ * enum cam_context_dump_id -
+ *              context dump type
+ *
+ */
+enum cam_context_dump_id {
+	CAM_CTX_DUMP_TYPE_NONE,
+	CAM_CTX_DUMP_ACQ_INFO,
+	CAM_CTX_DUMP_TYPE_MAX,
+};
+
+#define CAM_CTX_EVT_ID_SUCCESS 0
+#define CAM_CTX_EVT_ID_ERROR   1
+#define CAM_CTX_EVT_ID_CANCEL  2
+
+/* hardware event callback function type */
+typedef int (*cam_hw_event_cb_func)(void *context, uint32_t evt_id,
+	void *evt_data);
+
+/* hardware page fault callback function type */
+typedef int (*cam_hw_pagefault_cb_func)(void *context,
+	struct cam_smmu_pf_info *pf_info);
+
+/* ctx dump callback function type */
+typedef int (*cam_ctx_info_dump_cb_func)(void *context,
+	enum cam_context_dump_id dump_id);
+
+/* message callback function type */
+typedef int (*cam_ctx_message_cb_func)(void *context,
+	uint32_t message_type, uint32_t *data);
+/**
+ * struct cam_hw_update_entry - Entry for hardware config
+ *
+ * @handle:                Memory handle for the configuration
+ * @offset:                Memory offset
+ * @len:                   Size of the configuration
+ * @flags:                 Flags for the config entry(eg. DMI)
+ * @addr:                  Address of hardware update entry
+ *
+ */
+struct cam_hw_update_entry {
+	int                handle;
+	uint32_t           offset;
+	uint32_t           len;
+	uint32_t           flags;
+	uintptr_t          addr;
+};
+
+/**
+ * struct cam_hw_fence_map_entry - Entry for the resource to sync id map
+ *
+ * @resrouce_handle:       Resource port id for the buffer
+ * @sync_id:               Sync id
+ * @image_buf_addr:        Image buffer address array
+ *
+ */
+struct cam_hw_fence_map_entry {
+	uint32_t           resource_handle;
+	int32_t            sync_id;
+	int32_t            image_buf_addr[CAM_PACKET_MAX_PLANES];
+};
+
+/**
+ * struct cam_hw_done_event_data - Payload for hw done event
+ *
+ * @num_handles:           number of handles in the event
+ * @resrouce_handle:       list of the resource handle
+ * @timestamp:             time stamp
+ * @request_id:            request identifier
+ * @evt_param:             event parameter
+ *
+ */
+struct cam_hw_done_event_data {
+	uint32_t           num_handles;
+	uint32_t           resource_handle[CAM_NUM_OUT_PER_COMP_IRQ_MAX];
+	struct timespec64  timestamp;
+	uint64_t           request_id;
+	uint32_t           evt_param;
+};
+
+/**
+ * struct cam_hw_acquire_args - Payload for acquire command
+ *
+ * @context_data:          Context data pointer for the callback function
+ * @event_cb:              Callback function array
+ * @num_acq:               Total number of acquire in the payload
+ * @acquire_info:          Acquired resource array pointer
+ * @ctxt_to_hw_map:        HW context (returned)
+ * @custom_enabled:        ctx has custom enabled
+ * @use_frame_header_ts:   Use frame header for qtimer ts
+ * @support_consumed_addr: The platform has last consumed addr register
+ * @acquired_hw_id:        Acquired hardware mask
+ * @acquired_hw_path:      Acquired path mask for an input
+ *                         if input splits into multiple paths,
+ *                         its updated per hardware
+ * valid_acquired_hw:      Valid num of acquired hardware
+ *
+ */
+struct cam_hw_acquire_args {
+	void                        *context_data;
+	cam_hw_event_cb_func         event_cb;
+	uint32_t                     num_acq;
+	uint32_t                     acquire_info_size;
+	uintptr_t                    acquire_info;
+	void                        *ctxt_to_hw_map;
+	bool                         custom_enabled;
+	bool                         use_frame_header_ts;
+	bool                         support_consumed_addr;
+
+	uint32_t    acquired_hw_id[CAM_MAX_ACQ_RES];
+	uint32_t    acquired_hw_path[CAM_MAX_ACQ_RES][CAM_MAX_HW_SPLIT];
+	uint32_t    valid_acquired_hw;
+};
+
+/**
+ * struct cam_hw_release_args - Payload for release command
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @active_req:            Active request flag
+ *
+ */
+struct cam_hw_release_args {
+	void              *ctxt_to_hw_map;
+	bool               active_req;
+};
+
+/**
+ * struct cam_hw_start_args - Payload for start command
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @num_hw_update_entries: Number of Hardware configuration
+ * @hw_update_entries:     Hardware configuration list
+ *
+ */
+struct cam_hw_start_args {
+	void                        *ctxt_to_hw_map;
+	uint32_t                     num_hw_update_entries;
+	struct cam_hw_update_entry  *hw_update_entries;
+};
+
+/**
+ * struct cam_hw_stop_args - Payload for stop command
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @args:                  Arguments to pass for stop
+ *
+ */
+struct cam_hw_stop_args {
+	void              *ctxt_to_hw_map;
+	void              *args;
+};
+
+
+/**
+ * struct cam_hw_mgr_dump_pf_data - page fault debug data
+ *
+ * @packet:     pointer to packet
+ * @req:        pointer to req (HW specific)
+ */
+struct cam_hw_mgr_dump_pf_data {
+	void    *packet;
+	void    *req;
+};
+
+/**
+ * struct cam_hw_prepare_update_args - Payload for prepare command
+ *
+ * @packet:                CSL packet from user mode driver
+ * @remain_len             Remaining length of CPU buffer after config offset
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @max_hw_update_entries: Maximum hardware update entries supported
+ * @hw_update_entries:     Actual hardware update configuration (returned)
+ * @num_hw_update_entries: Number of actual hardware update entries (returned)
+ * @max_out_map_entries:   Maximum output fence mapping supported
+ * @out_map_entries:       Actual output fence mapping list (returned)
+ * @num_out_map_entries:   Number of actual output fence mapping (returned)
+ * @max_in_map_entries:    Maximum input fence mapping supported
+ * @in_map_entries:        Actual input fence mapping list (returned)
+ * @num_in_map_entries:    Number of acutal input fence mapping (returned)
+ * @reg_dump_buf_desc:     cmd buffer descriptors for reg dump
+ * @num_reg_dump_buf:      Count of descriptors in reg_dump_buf_desc
+ * @priv:                  Private pointer of hw update
+ * @pf_data:               Debug data for page fault
+ *
+ */
+struct cam_hw_prepare_update_args {
+	struct cam_packet              *packet;
+	size_t                          remain_len;
+	void                           *ctxt_to_hw_map;
+	uint32_t                        max_hw_update_entries;
+	struct cam_hw_update_entry     *hw_update_entries;
+	uint32_t                        num_hw_update_entries;
+	uint32_t                        max_out_map_entries;
+	struct cam_hw_fence_map_entry  *out_map_entries;
+	uint32_t                        num_out_map_entries;
+	uint32_t                        max_in_map_entries;
+	struct cam_hw_fence_map_entry  *in_map_entries;
+	uint32_t                        num_in_map_entries;
+	struct cam_cmd_buf_desc         reg_dump_buf_desc[
+					CAM_REG_DUMP_MAX_BUF_ENTRIES];
+	uint32_t                        num_reg_dump_buf;
+	void                           *priv;
+	struct cam_hw_mgr_dump_pf_data *pf_data;
+};
+
+/**
+ * struct cam_hw_stream_setttings - Payload for config stream command
+ *
+ * @packet:                CSL packet from user mode driver
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @priv:                  Private pointer of hw update
+ *
+ */
+struct cam_hw_stream_setttings {
+	struct cam_packet              *packet;
+	void                           *ctxt_to_hw_map;
+	void                           *priv;
+};
+
+/**
+ * struct cam_hw_config_args - Payload for config command
+ *
+ * @ctxt_to_hw_map:            HW context from the acquire
+ * @num_hw_update_entries:     Number of hardware update entries
+ * @hw_update_entries:         Hardware update list
+ * @out_map_entries:           Out map info
+ * @num_out_map_entries:       Number of out map entries
+ * @priv:                      Private pointer
+ * @request_id:                Request ID
+ * @reapply:                   True if reapplying after bubble
+ * @cdm_reset_before_apply:    True is need to reset CDM before re-apply bubble
+ *                             request
+ *
+ */
+struct cam_hw_config_args {
+	void                           *ctxt_to_hw_map;
+	uint32_t                        num_hw_update_entries;
+	struct cam_hw_update_entry     *hw_update_entries;
+	struct cam_hw_fence_map_entry  *out_map_entries;
+	uint32_t                        num_out_map_entries;
+	void                           *priv;
+	uint64_t                        request_id;
+	bool                            init_packet;
+	bool                            reapply;
+	bool                            cdm_reset_before_apply;
+};
+
+/**
+ * struct cam_hw_flush_args - Flush arguments
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @num_req_pending:       Num request to flush, valid when flush type is REQ
+ * @flush_req_pending:     Request pending pointers to flush
+ * @num_req_active:        Num request to flush, valid when flush type is REQ
+ * @flush_req_active:      Request active pointers to flush
+ * @flush_type:            The flush type
+ * @last_flush_req:        last flush req_id notified to hw_mgr for the
+ *                         given stream
+ *
+ */
+struct cam_hw_flush_args {
+	void                           *ctxt_to_hw_map;
+	uint32_t                        num_req_pending;
+	void                           *flush_req_pending[20];
+	uint32_t                        num_req_active;
+	void                           *flush_req_active[20];
+	enum flush_type_t               flush_type;
+	uint32_t                        last_flush_req;
+};
+
+/**
+ * struct cam_hw_dump_pf_args - Payload for dump pf info command
+ *
+ * @pf_data:               Debug data for page fault
+ * @iova:                  Page fault address
+ * @buf_info:              Info about memory buffer where page
+ *                               fault occurred
+ * @mem_found:             If fault memory found in current
+ *                               request
+ * @ctx_found              If fault pid found in context acquired hardware
+ * @resource_type          Resource type of the port which caused pf
+ * @bid:                   Indicate the bus id
+ * @pid:                   Indicates unique hw group ports
+ * @mid:                   Indicates port id of the camera hw
+ *
+ */
+struct cam_hw_dump_pf_args {
+	struct cam_hw_mgr_dump_pf_data  pf_data;
+	unsigned long                   iova;
+	uint32_t                        buf_info;
+	bool                           *mem_found;
+	bool                           *ctx_found;
+	uint32_t                       *resource_type;
+	uint32_t                        bid;
+	uint32_t                        pid;
+	uint32_t                        mid;
+};
+
+/**
+ * struct cam_hw_reset_args -hw reset arguments
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ *
+ */
+struct cam_hw_reset_args {
+	void                           *ctxt_to_hw_map;
+};
+
+/**
+ * struct cam_hw_dump_args - Dump arguments
+ *
+ * @request_id:            request_id
+ * @offset:                Buffer offset. This is updated by the drivers.
+ * @buf_handle:            Buffer handle
+ * @error_type:            Error type, to be used to extend dump information
+ * @ctxt_to_hw_map:        HW context from the acquire
+ */
+struct cam_hw_dump_args {
+	uint64_t          request_id;
+	size_t            offset;
+	uint32_t          buf_handle;
+	uint32_t          error_type;
+	void             *ctxt_to_hw_map;
+};
+
+/* enum cam_hw_mgr_command - Hardware manager command type */
+enum cam_hw_mgr_command {
+	CAM_HW_MGR_CMD_INTERNAL,
+	CAM_HW_MGR_CMD_DUMP_PF_INFO,
+	CAM_HW_MGR_CMD_REG_DUMP_ON_FLUSH,
+	CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR,
+	CAM_HW_MGR_CMD_DUMP_ACQ_INFO,
+};
+
+/**
+ * struct cam_hw_cmd_args - Payload for hw manager command
+ *
+ * @ctxt_to_hw_map:        HW context from the acquire
+ * @cmd_type               HW command type
+ * @internal_args          Arguments for internal command
+ * @pf_args                Arguments for Dump PF info command
+ *
+ */
+struct cam_hw_cmd_args {
+	void                               *ctxt_to_hw_map;
+	uint32_t                            cmd_type;
+	union {
+		void                       *internal_args;
+		struct cam_hw_dump_pf_args  pf_args;
+	} u;
+};
+
+/**
+ * cam_hw_inject_err_evt_param - error evt injection parameters
+ *
+ * @err_type:         error type for the injected err evt
+ * @err_code:         error code for the injected err evt
+ */
+struct cam_hw_inject_err_evt_param {
+	uint32_t err_type;
+	uint32_t err_code;
+};
+
+/**
+ * cam_hw_inject_node_evt_param - node evt injection parameters
+ * @event_type:       event type for the injected node evt
+ * @event_cause:      event cause for the injected node evt
+ */
+struct cam_hw_inject_node_evt_param {
+	uint32_t event_type;
+	uint32_t event_cause;
+};
+
+/**
+ * cam_hw_inject_pf_evt_param - pf evt injection parameters
+ *
+ * @ctx_found:        flag to indicate if page fault notification sent with ctx or not
+ */
+struct cam_hw_inject_pf_evt_param {
+	bool ctx_found;
+};
+
+/**
+ * cam_hw_inject_evt_notification_param - notify event parameters
+ *
+ * @evt_notify_type:   type of event notification
+ * @u:                 union which can be either error event/Page Fault event/Node event
+ */
+
+struct cam_hw_inject_evt_notification_param {
+	uint32_t evt_notify_type;
+	union {
+		struct cam_hw_inject_err_evt_param  err_evt_params;
+		struct cam_hw_inject_pf_evt_param   pf_evt_params;
+		struct cam_hw_inject_node_evt_param node_evt_params;
+	} u;
+};
+
+/**
+ * cam_hw_inject_buffer_error_param - buffer error injection parameters
+ *
+ * @sync_error:        sync error code
+ */
+struct cam_hw_inject_buffer_error_param {
+	uint32_t sync_error;
+};
+
+/**
+ * cam_hw_inject_evt_param - CRM event injection parameters
+ *
+ * @inject_id:        generic inject identifier
+ * @req_id:           Req Id for which the event is injected
+ * @u:                union which can be either buffer done error/event notification
+ * @is_valid:         bool flag to indicate if event injection is enabled for a context
+ */
+struct cam_hw_inject_evt_param {
+	uint8_t inject_id;
+	uint64_t req_id;
+	union {
+		struct cam_hw_inject_buffer_error_param buf_err_evt;
+		struct cam_hw_inject_evt_notification_param evt_notify;
+	} u;
+	bool is_valid;
+};
+
+/**
+ * cam_hw_mgr_intf - HW manager interface
+ *
+ * @hw_mgr_priv:               HW manager object
+ * @hw_get_caps:               Function pointer for get hw caps
+ *                               args = cam_query_cap_cmd
+ * @hw_acquire:                Function poniter for acquire hw resources
+ *                               args = cam_hw_acquire_args
+ * @hw_release:                Function pointer for release hw device resource
+ *                               args = cam_hw_release_args
+ * @hw_start:                  Function pointer for start hw devices
+ *                               args = cam_hw_start_args
+ * @hw_stop:                   Function pointer for stop hw devices
+ *                               args = cam_hw_stop_args
+ * @hw_prepare_update:         Function pointer for prepare hw update for hw
+ *                             devices args = cam_hw_prepare_update_args
+ * @hw_config_stream_settings: Function pointer for configure stream for hw
+ *                             devices args = cam_hw_stream_setttings
+ * @hw_config:                 Function pointer for configure hw devices
+ *                               args = cam_hw_config_args
+ * @hw_read:                   Function pointer for read hardware registers
+ * @hw_write:                  Function pointer for Write hardware registers
+ * @hw_cmd:                    Function pointer for any customized commands for
+ *                             the hardware manager
+ * @hw_open:                   Function pointer for HW init
+ * @hw_close:                  Function pointer for HW deinit
+ * @hw_flush:                  Function pointer for HW flush
+ * @hw_reset:                  Function pointer for HW reset
+ * @hw_dump:                   Function pointer for HW dump
+ *
+ */
+struct cam_hw_mgr_intf {
+	void *hw_mgr_priv;
+
+	int (*hw_get_caps)(void *hw_priv, void *hw_caps_args);
+	int (*hw_acquire)(void *hw_priv, void *hw_acquire_args);
+	int (*hw_release)(void *hw_priv, void *hw_release_args);
+	int (*hw_start)(void *hw_priv, void *hw_start_args);
+	int (*hw_stop)(void *hw_priv, void *hw_stop_args);
+	int (*hw_prepare_update)(void *hw_priv, void *hw_prepare_update_args);
+	int (*hw_config_stream_settings)(void *hw_priv,
+		void *hw_stream_settings);
+	int (*hw_config)(void *hw_priv, void *hw_config_args);
+	int (*hw_read)(void *hw_priv, void *read_args);
+	int (*hw_write)(void *hw_priv, void *write_args);
+	int (*hw_cmd)(void *hw_priv, void *write_args);
+	int (*hw_open)(void *hw_priv, void *fw_download_args);
+	int (*hw_close)(void *hw_priv, void *hw_close_args);
+	int (*hw_flush)(void *hw_priv, void *hw_flush_args);
+	int (*hw_reset)(void *hw_priv, void *hw_reset_args);
+	int (*hw_dump)(void *hw_priv, void *hw_dump_args);
+};
+
+#endif /* _CAM_HW_MGR_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_node.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_node.c
@@ -0,0 +1,995 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+
+#include "cam_node.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+
+static void cam_node_print_ctx_state(
+	struct cam_node *node)
+{
+	int i;
+	struct cam_context *ctx;
+
+	CAM_INFO(CAM_CORE, "[%s] state=%d, ctx_size %d",
+		node->name, node->state, node->ctx_size);
+
+	mutex_lock(&node->list_mutex);
+	for (i = 0; i < node->ctx_size; i++) {
+		ctx = &node->ctx_list[i];
+
+		spin_lock_bh(&ctx->lock);
+		CAM_INFO(CAM_CORE,
+			"[%s][%d] : state=%d, refcount=%d, active_req_list=%d, pending_req_list=%d, wait_req_list=%d, free_req_list=%d",
+			ctx->dev_name,
+			i, ctx->state,
+			atomic_read(&(ctx->refcount.refcount.refs)),
+			list_empty(&ctx->active_req_list),
+			list_empty(&ctx->pending_req_list),
+			list_empty(&ctx->wait_req_list),
+			list_empty(&ctx->free_req_list));
+		spin_unlock_bh(&ctx->lock);
+	}
+	mutex_unlock(&node->list_mutex);
+}
+
+static struct cam_context *cam_node_get_ctxt_from_free_list(
+		struct cam_node *node)
+{
+	struct cam_context *ctx = NULL;
+
+	mutex_lock(&node->list_mutex);
+	if (!list_empty(&node->free_ctx_list)) {
+		ctx = list_first_entry(&node->free_ctx_list,
+			struct cam_context, list);
+		list_del_init(&ctx->list);
+	}
+	mutex_unlock(&node->list_mutex);
+	if (ctx)
+		kref_init(&ctx->refcount);
+	return ctx;
+}
+
+void cam_node_put_ctxt_to_free_list(struct kref *ref)
+{
+	struct cam_context *ctx =
+		container_of(ref, struct cam_context, refcount);
+	struct cam_node *node = ctx->node;
+
+	mutex_lock(&node->list_mutex);
+	list_add_tail(&ctx->list, &node->free_ctx_list);
+	mutex_unlock(&node->list_mutex);
+}
+
+static int __cam_node_handle_query_cap(struct cam_node *node,
+	struct cam_query_cap_cmd *query)
+{
+	int rc = -EFAULT;
+
+	if (!query) {
+		CAM_ERR(CAM_CORE, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (node->hw_mgr_intf.hw_get_caps) {
+		rc = node->hw_mgr_intf.hw_get_caps(
+			node->hw_mgr_intf.hw_mgr_priv, query);
+	}
+
+	return rc;
+}
+
+static int __cam_node_handle_acquire_dev(struct cam_node *node,
+	struct cam_acquire_dev_cmd *acquire)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!acquire)
+		return -EINVAL;
+
+	ctx = cam_node_get_ctxt_from_free_list(node);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE,
+			"No free ctx in free list node %s with size:%d",
+			node->name, node->ctx_size);
+		cam_node_print_ctx_state(node);
+
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	ctx->last_flush_req = 0;
+	rc = cam_context_handle_acquire_dev(ctx, acquire);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Acquire device failed for node %s",
+			node->name);
+		goto free_ctx;
+	}
+
+	CAM_DBG(CAM_CORE, "[%s] Acquire ctx_id %d",
+		node->name, ctx->ctx_id);
+
+	return 0;
+free_ctx:
+	cam_context_putref(ctx);
+err:
+	return rc;
+}
+
+static void __cam_node_handle_acquired_hw_dump(
+	struct cam_node *node)
+{
+	int i;
+
+	for (i = 0; i < node->ctx_size; i++)
+		cam_context_handle_info_dump(&(node->ctx_list[i]),
+			CAM_CTX_DUMP_ACQ_INFO);
+}
+
+static int __cam_node_handle_acquire_hw_v1(struct cam_node *node,
+	struct cam_acquire_hw_cmd_v1 *acquire)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!acquire)
+		return -EINVAL;
+
+	if (acquire->dev_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (acquire->session_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(acquire->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			acquire->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_acquire_hw(ctx, acquire);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Acquire device failed for node %s",
+			node->name);
+		__cam_node_handle_acquired_hw_dump(node);
+		return rc;
+	}
+
+	CAM_DBG(CAM_CORE, "[%s] Acquire ctx_id %d",
+		node->name, ctx->ctx_id);
+
+	return 0;
+}
+
+static int __cam_node_handle_acquire_hw_v2(struct cam_node *node,
+	struct cam_acquire_hw_cmd_v2 *acquire)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!acquire)
+		return -EINVAL;
+
+	if (acquire->dev_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (acquire->session_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(acquire->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			acquire->dev_handle);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_acquire_hw(ctx, acquire);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Acquire device failed for node %s",
+			node->name);
+		__cam_node_handle_acquired_hw_dump(node);
+		return rc;
+	}
+
+	CAM_DBG(CAM_CORE, "[%s] Acquire ctx_id %d",
+		node->name, ctx->ctx_id);
+
+	return 0;
+}
+
+static int __cam_node_handle_start_dev(struct cam_node *node,
+	struct cam_start_stop_dev_cmd *start)
+{
+	struct cam_context *ctx = NULL;
+	int rc;
+
+	if (!start)
+		return -EINVAL;
+
+	if (start->dev_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (start->session_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(start->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			start->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_start_dev(ctx, start);
+	if (rc)
+		CAM_ERR(CAM_CORE, "Start failure for node %s", node->name);
+
+	return rc;
+}
+
+static int __cam_node_handle_stop_dev(struct cam_node *node,
+	struct cam_start_stop_dev_cmd *stop)
+{
+	struct cam_context *ctx = NULL;
+	int rc;
+
+	if (!stop)
+		return -EINVAL;
+
+	if (stop->dev_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (stop->session_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(stop->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			stop->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_stop_dev(ctx, stop);
+	if (rc)
+		CAM_ERR(CAM_CORE, "Stop failure for node %s", node->name);
+
+	return rc;
+}
+
+static int __cam_node_handle_config_dev(struct cam_node *node,
+	struct cam_config_dev_cmd *config)
+{
+	struct cam_context *ctx = NULL;
+	int rc;
+
+	if (!config)
+		return -EINVAL;
+
+	if (config->dev_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (config->session_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(config->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			config->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_config_dev(ctx, config);
+	if (rc)
+		CAM_ERR(CAM_CORE, "Config failure for node %s", node->name);
+
+	return rc;
+}
+
+static int __cam_node_handle_flush_dev(struct cam_node *node,
+	struct cam_flush_dev_cmd *flush)
+{
+	struct cam_context *ctx = NULL;
+	int rc;
+
+	if (!flush)
+		return -EINVAL;
+
+	if (flush->dev_handle <= 0) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (flush->session_handle <= 0) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(flush->dev_handle);
+	if (!ctx) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Can not get context for handle %d",
+			flush->dev_handle);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_flush_dev(ctx, flush);
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Flush failure for node %s", node->name);
+
+	return rc;
+}
+
+static int __cam_node_handle_release_dev(struct cam_node *node,
+	struct cam_release_dev_cmd *release)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!release)
+		return -EINVAL;
+
+	if (release->dev_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (release->session_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(release->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d node %s",
+			release->dev_handle, node->name);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	if (ctx->state > CAM_CTX_UNINIT && ctx->state < CAM_CTX_STATE_MAX) {
+		rc = cam_context_handle_release_dev(ctx, release);
+		if (rc)
+			CAM_ERR(CAM_CORE, "context release failed for node %s",
+				node->name);
+	} else {
+		CAM_WARN(CAM_CORE,
+			"node %s context id %u state %d invalid to release hdl",
+			node->name, ctx->ctx_id, ctx->state);
+		goto destroy_dev_hdl;
+	}
+
+	cam_context_putref(ctx);
+
+destroy_dev_hdl:
+	rc = cam_destroy_device_hdl(release->dev_handle);
+	if (rc)
+		CAM_ERR(CAM_CORE, "destroy device hdl failed for node %s",
+			node->name);
+	else
+		ctx->dev_hdl = -1;
+
+	CAM_DBG(CAM_CORE, "[%s] Release ctx_id=%d, refcount=%d",
+		node->name, ctx->ctx_id,
+		atomic_read(&(ctx->refcount.refcount.refs)));
+
+	return rc;
+}
+
+static int __cam_node_handle_dump_dev(struct cam_node *node,
+	struct cam_dump_req_cmd *dump)
+{
+	int                 rc;
+	struct cam_context *ctx = NULL;
+
+	if (!dump)
+		return -EINVAL;
+
+	if (dump->dev_handle <= 0) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (dump->session_handle <= 0) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(dump->dev_handle);
+	if (!ctx) {
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Can not get context for handle %d",
+			dump->dev_handle);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_dump_dev(ctx, dump);
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_CORE,
+			"Dump failure for node %s", node->name);
+
+	return rc;
+}
+
+static int __cam_node_handle_release_hw_v1(struct cam_node *node,
+	struct cam_release_hw_cmd_v1 *release)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!release)
+		return -EINVAL;
+
+	if (release->dev_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (release->session_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(release->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d node %s",
+			release->dev_handle, node->name);
+		return -EINVAL;
+	}
+
+	if (strcmp(node->name, ctx->dev_name)) {
+		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
+			node->name, ctx->dev_name);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_release_hw(ctx, release);
+	if (rc)
+		CAM_ERR(CAM_CORE, "context release failed node %s", node->name);
+
+	CAM_DBG(CAM_CORE, "[%s] Release ctx_id=%d, refcount=%d",
+		node->name, ctx->ctx_id,
+		atomic_read(&(ctx->refcount.refcount.refs)));
+
+	return rc;
+}
+
+static int __cam_node_crm_get_dev_info(struct cam_req_mgr_device_info *info)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!info)
+		return -EINVAL;
+
+	ctx = (struct cam_context *) cam_get_device_priv(info->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context  for handle %d",
+			info->dev_hdl);
+		return -EINVAL;
+	}
+	return cam_context_handle_crm_get_dev_info(ctx, info);
+}
+
+static int __cam_node_crm_link_setup(
+	struct cam_req_mgr_core_dev_link_setup *setup)
+{
+	int rc;
+	struct cam_context *ctx = NULL;
+
+	if (!setup)
+		return -EINVAL;
+
+	ctx = (struct cam_context *) cam_get_device_priv(setup->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			setup->dev_hdl);
+		return -EINVAL;
+	}
+
+	if (setup->link_enable)
+		rc = cam_context_handle_crm_link(ctx, setup);
+	else
+		rc = cam_context_handle_crm_unlink(ctx, setup);
+
+	return rc;
+}
+
+static int __cam_node_crm_apply_req(struct cam_req_mgr_apply_request *apply)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!apply)
+		return -EINVAL;
+
+	ctx = (struct cam_context *) cam_get_device_priv(apply->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			apply->dev_hdl);
+		return -EINVAL;
+	}
+
+	trace_cam_apply_req("Node", apply->request_id);
+
+	return cam_context_handle_crm_apply_req(ctx, apply);
+}
+
+static int __cam_node_crm_notify_frame_skip(
+	struct cam_req_mgr_apply_request *apply)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!apply)
+		return -EINVAL;
+
+	ctx = (struct cam_context *) cam_get_device_priv(apply->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			apply->dev_hdl);
+		return -EINVAL;
+	}
+
+	trace_cam_apply_req("Node", apply->request_id);
+
+	return cam_context_handle_crm_notify_frame_skip(ctx, apply);
+}
+
+static int __cam_node_crm_flush_req(struct cam_req_mgr_flush_request *flush)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!flush) {
+		CAM_ERR(CAM_CORE, "Invalid flush request payload");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *) cam_get_device_priv(flush->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			flush->dev_hdl);
+		return -EINVAL;
+	}
+
+	return cam_context_handle_crm_flush_req(ctx, flush);
+}
+
+static int __cam_node_crm_process_evt(
+	struct cam_req_mgr_link_evt_data *evt_data)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_CORE, "Invalid process event request payload");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *) cam_get_device_priv(evt_data->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			evt_data->dev_hdl);
+		return -EINVAL;
+	}
+	return cam_context_handle_crm_process_evt(ctx, evt_data);
+}
+
+static int __cam_node_crm_dump_req(struct cam_req_mgr_dump_info *dump)
+{
+	struct cam_context *ctx = NULL;
+
+	if (!dump) {
+		CAM_ERR(CAM_CORE, "Invalid dump request payload");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *) cam_get_device_priv(dump->dev_hdl);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			dump->dev_hdl);
+		return -EINVAL;
+	}
+
+	return cam_context_handle_crm_dump_req(ctx, dump);
+}
+
+int cam_node_deinit(struct cam_node *node)
+{
+	if (node)
+		memset(node, 0, sizeof(*node));
+
+	CAM_DBG(CAM_CORE, "deinit complete");
+
+	return 0;
+}
+
+int cam_node_shutdown(struct cam_node *node)
+{
+	int i = 0;
+	int rc = 0;
+
+	if (!node)
+		return -EINVAL;
+
+	for (i = 0; i < node->ctx_size; i++) {
+		if (node->ctx_list[i].dev_hdl > 0) {
+			CAM_DBG(CAM_CORE,
+				"Node [%s] invoking shutdown on context [%d]",
+				node->name, i);
+			rc = cam_context_shutdown(&(node->ctx_list[i]));
+		}
+	}
+
+	if (node->hw_mgr_intf.hw_close)
+		node->hw_mgr_intf.hw_close(node->hw_mgr_intf.hw_mgr_priv,
+			NULL);
+
+	return 0;
+}
+
+int cam_node_init(struct cam_node *node, struct cam_hw_mgr_intf *hw_mgr_intf,
+	struct cam_context *ctx_list, uint32_t ctx_size, char *name)
+{
+	int rc = 0;
+	int i;
+
+	if (!node || !hw_mgr_intf ||
+		sizeof(node->hw_mgr_intf) != sizeof(*hw_mgr_intf)) {
+		return -EINVAL;
+	}
+
+	memset(node, 0, sizeof(*node));
+
+	strscpy(node->name, name, sizeof(node->name));
+
+	memcpy(&node->hw_mgr_intf, hw_mgr_intf, sizeof(node->hw_mgr_intf));
+	node->crm_node_intf.apply_req = __cam_node_crm_apply_req;
+	node->crm_node_intf.get_dev_info = __cam_node_crm_get_dev_info;
+	node->crm_node_intf.link_setup = __cam_node_crm_link_setup;
+	node->crm_node_intf.flush_req = __cam_node_crm_flush_req;
+	node->crm_node_intf.process_evt = __cam_node_crm_process_evt;
+	node->crm_node_intf.dump_req = __cam_node_crm_dump_req;
+	node->crm_node_intf.notify_frame_skip =
+		__cam_node_crm_notify_frame_skip;
+
+	mutex_init(&node->list_mutex);
+	INIT_LIST_HEAD(&node->free_ctx_list);
+	node->ctx_list = ctx_list;
+	node->ctx_size = ctx_size;
+	for (i = 0; i < ctx_size; i++) {
+		if (!ctx_list[i].state_machine) {
+			CAM_ERR(CAM_CORE,
+				"camera context %d is not initialized", i);
+			rc = -1;
+			goto err;
+		}
+		INIT_LIST_HEAD(&ctx_list[i].list);
+		list_add_tail(&ctx_list[i].list, &node->free_ctx_list);
+		ctx_list[i].node = node;
+	}
+
+	node->state = CAM_NODE_STATE_INIT;
+err:
+	CAM_DBG(CAM_CORE, "Exit. (rc = %d)", rc);
+	return rc;
+}
+
+int cam_node_handle_ioctl(struct cam_node *node, struct cam_control *cmd)
+{
+	int rc = 0;
+
+	if (!cmd)
+		return -EINVAL;
+
+	CAM_DBG(CAM_CORE, "handle cmd %d", cmd->op_code);
+
+	switch (cmd->op_code) {
+	case CAM_QUERY_CAP: {
+		struct cam_query_cap_cmd query;
+
+		if (copy_from_user(&query, u64_to_user_ptr(cmd->handle),
+			sizeof(query))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = __cam_node_handle_query_cap(node, &query);
+		if (rc) {
+			CAM_ERR(CAM_CORE, "querycap is failed(rc = %d)",
+				rc);
+			break;
+		}
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle), &query,
+			sizeof(query)))
+			rc = -EFAULT;
+
+		break;
+	}
+	case CAM_ACQUIRE_DEV: {
+		struct cam_acquire_dev_cmd acquire;
+
+		if (copy_from_user(&acquire, u64_to_user_ptr(cmd->handle),
+			sizeof(acquire))) {
+			rc = -EFAULT;
+			break;
+		}
+		rc = __cam_node_handle_acquire_dev(node, &acquire);
+		if (rc) {
+			CAM_ERR(CAM_CORE, "acquire device failed(rc = %d)",
+				rc);
+			break;
+		}
+		if (copy_to_user(u64_to_user_ptr(cmd->handle), &acquire,
+			sizeof(acquire)))
+			rc = -EFAULT;
+		break;
+	}
+	case CAM_ACQUIRE_HW: {
+		uint32_t api_version;
+		void *acquire_ptr = NULL;
+		size_t acquire_size;
+
+		if (copy_from_user(&api_version, (void __user *)cmd->handle,
+			sizeof(api_version))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		if (api_version == 1) {
+			acquire_size = sizeof(struct cam_acquire_hw_cmd_v1);
+		} else if (api_version == 2) {
+			acquire_size = sizeof(struct cam_acquire_hw_cmd_v2);
+		} else {
+			CAM_ERR(CAM_CORE, "Unsupported api version %d",
+				api_version);
+			rc = -EINVAL;
+			break;
+		}
+
+		acquire_ptr = kzalloc(acquire_size, GFP_KERNEL);
+		if (!acquire_ptr) {
+			CAM_ERR(CAM_CORE, "No memory for acquire HW");
+			rc = -ENOMEM;
+			break;
+		}
+
+		if (copy_from_user(acquire_ptr, (void __user *)cmd->handle,
+			acquire_size)) {
+			rc = -EFAULT;
+			goto acquire_kfree;
+		}
+
+		if (api_version == 1) {
+			rc = __cam_node_handle_acquire_hw_v1(node, acquire_ptr);
+			if (rc) {
+				CAM_ERR(CAM_CORE,
+					"acquire hw failed(rc = %d)", rc);
+				goto acquire_kfree;
+			}
+		} else if (api_version == 2) {
+			rc = __cam_node_handle_acquire_hw_v2(node, acquire_ptr);
+			if (rc) {
+				CAM_ERR(CAM_CORE,
+					"acquire hw failed(rc = %d)", rc);
+				goto acquire_kfree;
+			}
+		}
+
+		if (copy_to_user((void __user *)cmd->handle, acquire_ptr,
+			acquire_size))
+			rc = -EFAULT;
+
+acquire_kfree:
+		kfree(acquire_ptr);
+		break;
+	}
+	case CAM_START_DEV: {
+		struct cam_start_stop_dev_cmd start;
+
+		if (copy_from_user(&start, u64_to_user_ptr(cmd->handle),
+			sizeof(start)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_start_dev(node, &start);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"start device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_STOP_DEV: {
+		struct cam_start_stop_dev_cmd stop;
+
+		if (copy_from_user(&stop, u64_to_user_ptr(cmd->handle),
+			sizeof(stop)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_stop_dev(node, &stop);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"stop device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_CONFIG_DEV: {
+		struct cam_config_dev_cmd config;
+
+		if (copy_from_user(&config, u64_to_user_ptr(cmd->handle),
+			sizeof(config)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_config_dev(node, &config);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"config device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_RELEASE_DEV: {
+		struct cam_release_dev_cmd release;
+
+		if (copy_from_user(&release, u64_to_user_ptr(cmd->handle),
+			sizeof(release)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_release_dev(node, &release);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"release device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_RELEASE_HW: {
+		uint32_t api_version;
+		size_t release_size;
+		void *release_ptr = NULL;
+
+		if (copy_from_user(&api_version, (void __user *)cmd->handle,
+			sizeof(api_version))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		if (api_version == 1) {
+			release_size = sizeof(struct cam_release_hw_cmd_v1);
+		} else {
+			CAM_ERR(CAM_CORE, "Unsupported api version %d",
+				api_version);
+			rc = -EINVAL;
+			break;
+		}
+
+		release_ptr = kzalloc(release_size, GFP_KERNEL);
+		if (!release_ptr) {
+			CAM_ERR(CAM_CORE, "No memory for release HW");
+			rc = -ENOMEM;
+			break;
+		}
+
+		if (copy_from_user(release_ptr, (void __user *)cmd->handle,
+			release_size)) {
+			rc = -EFAULT;
+			goto release_kfree;
+		}
+
+		if (api_version == 1) {
+			rc = __cam_node_handle_release_hw_v1(node, release_ptr);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"release device failed(rc = %d)", rc);
+		}
+
+release_kfree:
+		kfree(release_ptr);
+		break;
+	}
+	case CAM_FLUSH_REQ: {
+		struct cam_flush_dev_cmd flush;
+
+		if (copy_from_user(&flush, u64_to_user_ptr(cmd->handle),
+			sizeof(flush)))
+			rc = -EFAULT;
+		else {
+			rc = __cam_node_handle_flush_dev(node, &flush);
+			if (rc)
+				CAM_ERR(CAM_CORE,
+					"flush device failed(rc = %d)", rc);
+		}
+		break;
+	}
+	case CAM_DUMP_REQ: {
+		struct cam_dump_req_cmd dump;
+
+		if (copy_from_user(&dump, u64_to_user_ptr(cmd->handle),
+			sizeof(dump))) {
+			rc = -EFAULT;
+			break;
+		}
+		rc = __cam_node_handle_dump_dev(node, &dump);
+		if (rc) {
+			CAM_ERR(CAM_CORE,
+			    "Dump device %s failed(rc = %d) ",
+			    node->name, rc);
+			break;
+		}
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&dump, sizeof(dump))) {
+			CAM_ERR(CAM_CORE,
+			    "Dump device %s copy_to_user fail",
+			    node->name);
+			rc = -EFAULT;
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_CORE, "Unknown op code %d", cmd->op_code);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_node.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_node.h
@@ -0,0 +1,120 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_NODE_H_
+#define _CAM_NODE_H_
+
+#include <linux/kref.h>
+#include "cam_context.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_interface.h"
+
+
+#define CAM_NODE_STATE_UNINIT           0
+#define CAM_NODE_STATE_INIT             1
+
+/**
+ * struct cam_node - Singleton Node for camera HW devices
+ *
+ * @name:                  Name for struct cam_node
+ * @state:                 Node state:
+ *                            0 = uninitialized, 1 = initialized
+ * @list_mutex:            Mutex for the context pool
+ * @free_ctx_list:         Free context pool list
+ * @ctx_list:              Context list
+ * @ctx_size:              Context list size
+ * @hw_mgr_intf:           Interface for cam_node to HW
+ * @crm_node_intf:         Interface for the CRM to cam_node
+ * @sd_handler:            Shutdown handler for this subdev
+ *
+ */
+struct cam_node {
+	char                              name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	uint32_t                          state;
+
+	/* context pool */
+	struct mutex                      list_mutex;
+	struct list_head                  free_ctx_list;
+	struct cam_context               *ctx_list;
+	uint32_t                          ctx_size;
+
+	/* interfaces */
+	struct cam_hw_mgr_intf            hw_mgr_intf;
+	struct cam_req_mgr_kmd_ops        crm_node_intf;
+
+	int (*sd_handler)(struct v4l2_subdev *sd,
+		struct v4l2_subdev_fh *fh);
+};
+
+/**
+ * cam_node_handle_ioctl()
+ *
+ * @brief:       Handle ioctl commands
+ *
+ * @node:                  Node handle
+ * @cmd:                   IOCTL command
+ *
+ */
+int cam_node_handle_ioctl(struct cam_node *node, struct cam_control *cmd);
+
+/**
+ * cam_node_deinit()
+ *
+ * @brief:       Deinitialization function for the Node interface
+ *
+ * @node:                  Node handle
+ *
+ */
+int cam_node_deinit(struct cam_node *node);
+
+/**
+ * cam_node_shutdown()
+ *
+ * @brief:       Shutdowns/Closes the cam node.
+ *
+ * @node:                  Cam_node pointer
+ *
+ */
+int cam_node_shutdown(struct cam_node *node);
+
+/**
+ * cam_node_init()
+ *
+ * @brief:       Initialization function for the Node interface.
+ *
+ * @node:                  Cam_node pointer
+ * @hw_mgr_intf:           HW manager interface blob
+ * @ctx_list:              List of cam_contexts to be added
+ * @ctx_size:              Size of the cam_context
+ * @name:                  Name for the node
+ *
+ */
+int cam_node_init(struct cam_node *node, struct cam_hw_mgr_intf *hw_mgr_intf,
+	struct cam_context *ctx_list, uint32_t ctx_size, char *name);
+
+/**
+ * cam_node_put_ctxt_to_free_list()
+ *
+ * @brief:       Put context in node free list.
+ *
+ * @ref:         Context's kref object
+ *
+ */
+void cam_node_put_ctxt_to_free_list(struct kref *ref);
+
+/**
+ * cam_get_dev_handle_info()
+ *
+ * @brief:       provides the active dev index.
+ *
+ * @handle:      pointer to struct v4l2_dev
+ * @ctx:         pointer to struct cam_context
+ * @dev_index:   dev index
+ *
+ */
+int32_t cam_get_dev_handle_info(uint64_t handle,
+	struct cam_context **ctx, int32_t dev_index);
+
+#endif /* _CAM_NODE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_subdev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_core/cam_subdev.c
@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_debug_util.h"
+
+/**
+ * cam_subdev_subscribe_event()
+ *
+ * @brief: function to subscribe to v4l2 events
+ *
+ * @sd:                    Pointer to struct v4l2_subdev.
+ * @fh:                    Pointer to struct v4l2_fh.
+ * @sub:                   Pointer to struct v4l2_event_subscription.
+ */
+static int cam_subdev_subscribe_event(struct v4l2_subdev *sd,
+	struct v4l2_fh *fh,
+	struct v4l2_event_subscription *sub)
+{
+	return v4l2_event_subscribe(fh, sub, CAM_SUBDEVICE_EVENT_MAX, NULL);
+}
+
+/**
+ * cam_subdev_unsubscribe_event()
+ *
+ * @brief: function to unsubscribe from v4l2 events
+ *
+ * @sd:                    Pointer to struct v4l2_subdev.
+ * @fh:                    Pointer to struct v4l2_fh.
+ * @sub:                   Pointer to struct v4l2_event_subscription.
+ */
+static int cam_subdev_unsubscribe_event(struct v4l2_subdev *sd,
+	struct v4l2_fh *fh,
+	struct v4l2_event_subscription *sub)
+{
+	return v4l2_event_unsubscribe(fh, sub);
+}
+
+static long cam_subdev_ioctl(struct v4l2_subdev *sd, unsigned int cmd,
+	void *arg)
+{
+	long rc;
+	struct cam_node *node =
+		(struct cam_node *) v4l2_get_subdevdata(sd);
+	struct v4l2_subdev_fh *fh = (struct v4l2_subdev_fh *)arg;
+
+	if (!node || node->state == CAM_NODE_STATE_UNINIT) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+		rc = cam_node_handle_ioctl(node,
+			(struct cam_control *) arg);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_WARN(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		if (!node->sd_handler) {
+			CAM_ERR(CAM_CORE,
+				"No shutdown routine for %s", node->name);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		CAM_DBG(CAM_CORE, "Shutdown for %s from media device", node->name);
+		rc = node->sd_handler(sd, fh);
+		if (rc)
+			CAM_ERR(CAM_CORE,
+				"shutdown device failed(rc = %d) for %s",
+				rc, node->name);
+		break;
+	default:
+		CAM_ERR(CAM_CORE, "Invalid command %d for %s from pid %d comm %s", cmd,
+			node->name, current->tgid, current->comm);
+		rc = -EINVAL;
+	}
+end:
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_subdev_compat_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int rc;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_CORE, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+	rc = cam_subdev_ioctl(sd, cmd, &cmd_data);
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_CORE,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+const struct v4l2_subdev_core_ops cam_subdev_core_ops = {
+	.ioctl = cam_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_subdev_compat_ioctl,
+#endif
+	.subscribe_event = cam_subdev_subscribe_event,
+	.unsubscribe_event = cam_subdev_unsubscribe_event,
+};
+
+static const struct v4l2_subdev_ops cam_subdev_ops = {
+	.core = &cam_subdev_core_ops,
+};
+
+int cam_subdev_remove(struct cam_subdev *sd)
+{
+	if (!sd)
+		return -EINVAL;
+
+	cam_unregister_subdev(sd);
+	cam_node_deinit((struct cam_node *)sd->token);
+	kfree(sd->token);
+
+	return 0;
+}
+
+int cam_subdev_probe(struct cam_subdev *sd, struct platform_device *pdev,
+	char *name, uint32_t dev_type)
+{
+	int rc = 0;
+	struct cam_node *node = NULL;
+
+	if (!sd || !pdev || !name) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	node = kzalloc(sizeof(*node), GFP_KERNEL);
+	if (!node) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	/* Setup camera v4l2 subdevice */
+	sd->pdev = pdev;
+	sd->name = name;
+	sd->ops = &cam_subdev_ops;
+	sd->token = node;
+	sd->sd_flags =
+		V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+	sd->ent_function = dev_type;
+end:
+	return rc;
+}
+
+int cam_subdev_register(struct cam_subdev *sd, struct platform_device *pdev)
+{
+	int rc;
+
+	if (!sd || !pdev)
+		return -EINVAL;
+
+	rc = cam_register_subdev(sd);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "cam_register_subdev() failed for dev: %s",
+			sd->name);
+		goto end;
+	}
+	platform_set_drvdata(sd->pdev, sd);
+end:
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_hw.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_hw.c
@@ -0,0 +1,2628 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/pm_opp.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+
+#include "cam_cpas_hw.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_soc.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_smmu_api.h"
+#include "cam_compat.h"
+
+static uint cam_min_camnoc_ib_bw;
+module_param(cam_min_camnoc_ib_bw, uint, 0644);
+
+static void cam_cpas_update_monitor_array(struct cam_hw_info *cpas_hw,
+	const char *identifier_string, int32_t identifier_value);
+static void cam_cpas_dump_monitor_array(
+	struct cam_cpas *cpas_core);
+
+static void cam_cpas_process_bw_overrides(
+	struct cam_cpas_bus_client *bus_client, uint64_t *ab, uint64_t *ib,
+	const struct cam_cpas_debug_settings *cpas_settings)
+{
+	uint64_t curr_ab = *ab;
+	uint64_t curr_ib = *ib;
+	size_t name_len = strlen(bus_client->common_data.name);
+
+	if (!cpas_settings) {
+		CAM_ERR(CAM_CPAS, "Invalid cpas debug settings");
+		return;
+	}
+
+	if (strnstr(bus_client->common_data.name, "cam_hf_0", name_len)) {
+		if (cpas_settings->mnoc_hf_0_ab_bw)
+			*ab = cpas_settings->mnoc_hf_0_ab_bw;
+		if (cpas_settings->mnoc_hf_0_ib_bw)
+			*ib = cpas_settings->mnoc_hf_0_ib_bw;
+	} else if (strnstr(bus_client->common_data.name, "cam_hf_1",
+		name_len)) {
+		if (cpas_settings->mnoc_hf_1_ab_bw)
+			*ab = cpas_settings->mnoc_hf_1_ab_bw;
+		if (cpas_settings->mnoc_hf_0_ib_bw)
+			*ib = cpas_settings->mnoc_hf_1_ib_bw;
+	} else if (strnstr(bus_client->common_data.name, "cam_sf_0",
+		name_len)) {
+		if (cpas_settings->mnoc_sf_0_ab_bw)
+			*ab = cpas_settings->mnoc_sf_0_ab_bw;
+		if (cpas_settings->mnoc_sf_0_ib_bw)
+			*ib = cpas_settings->mnoc_sf_0_ib_bw;
+	} else if (strnstr(bus_client->common_data.name, "cam_sf_1",
+		name_len)) {
+		if (cpas_settings->mnoc_sf_1_ab_bw)
+			*ab = cpas_settings->mnoc_sf_1_ab_bw;
+		if (cpas_settings->mnoc_sf_1_ib_bw)
+			*ib = cpas_settings->mnoc_sf_1_ib_bw;
+	} else if (strnstr(bus_client->common_data.name, "cam_sf_icp",
+		name_len)) {
+		if (cpas_settings->mnoc_sf_icp_ab_bw)
+			*ab = cpas_settings->mnoc_sf_icp_ab_bw;
+		if (cpas_settings->mnoc_sf_icp_ib_bw)
+			*ib = cpas_settings->mnoc_sf_icp_ib_bw;
+	} else {
+		CAM_ERR(CAM_CPAS, "unknown mnoc port: %s, bw override failed",
+			bus_client->common_data.name);
+		return;
+	}
+
+	CAM_INFO(CAM_CPAS,
+		"Overriding mnoc bw for: %s with ab: %llu, ib: %llu, curr_ab: %llu, curr_ib: %llu",
+		bus_client->common_data.name, *ab, *ib, curr_ab, curr_ib);
+}
+
+int cam_cpas_util_reg_read(struct cam_hw_info *cpas_hw,
+	enum cam_cpas_reg_base reg_base, struct cam_cpas_reg *reg_info)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	uint32_t value;
+	int reg_base_index;
+
+	if (!reg_info->enable)
+		return 0;
+
+	reg_base_index = cpas_core->regbase_index[reg_base];
+	if (reg_base_index == -1)
+		return -EINVAL;
+
+	value = cam_io_r_mb(
+		soc_info->reg_map[reg_base_index].mem_base + reg_info->offset);
+
+	CAM_INFO(CAM_CPAS, "Base[%d] Offset[0x%08x] Value[0x%08x]",
+		reg_base, reg_info->offset, value);
+
+	return 0;
+}
+
+int cam_cpas_util_reg_update(struct cam_hw_info *cpas_hw,
+	enum cam_cpas_reg_base reg_base, struct cam_cpas_reg *reg_info)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	uint32_t value;
+	int reg_base_index;
+
+	if (reg_info->enable == false)
+		return 0;
+
+	if (reg_info->is_fuse_based &&
+		!cam_cpas_is_feature_supported(CAM_CPAS_RT_OT_FUSE, 0xFF, 0))
+		return 0;
+
+	reg_base_index = cpas_core->regbase_index[reg_base];
+	if (reg_base_index == -1)
+		return -EINVAL;
+
+	if (reg_info->masked_value) {
+		value = cam_io_r_mb(
+			soc_info->reg_map[reg_base_index].mem_base +
+			reg_info->offset);
+		value = value & (~reg_info->mask);
+		value = value | (reg_info->value << reg_info->shift);
+	} else {
+		value = reg_info->value;
+	}
+
+	CAM_DBG(CAM_CPAS, "Base[%d] Offset[0x%08x] Value[0x%08x]",
+		reg_base, reg_info->offset, value);
+
+	cam_io_w_mb(value, soc_info->reg_map[reg_base_index].mem_base +
+		reg_info->offset);
+
+	return 0;
+}
+
+static int cam_cpas_util_vote_bus_client_level(
+	struct cam_cpas_bus_client *bus_client, unsigned int level)
+{
+	int rc = 0;
+
+	if (!bus_client->valid) {
+		CAM_ERR(CAM_CPAS, "bus client not valid");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (level >= CAM_MAX_VOTE) {
+		CAM_ERR(CAM_CPAS,
+			"Invalid votelevel=%d,usecases=%d,Bus client=[%s]",
+			level, bus_client->common_data.num_usecases,
+			bus_client->common_data.name);
+		return -EINVAL;
+	}
+
+	if (level == bus_client->curr_vote_level)
+		goto end;
+
+	rc = cam_soc_bus_client_update_request(bus_client->soc_bus_client,
+		level);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Client: %s update request failed rc: %d",
+			bus_client->common_data.name, rc);
+		goto end;
+	}
+	bus_client->curr_vote_level = level;
+
+end:
+	return rc;
+}
+
+static int cam_cpas_util_vote_bus_client_bw(
+	struct cam_cpas_bus_client *bus_client, uint64_t ab, uint64_t ib,
+	bool camnoc_bw, uint64_t *applied_ab, uint64_t *applied_ib)
+{
+	int rc = 0;
+	uint64_t min_camnoc_ib_bw = CAM_CPAS_AXI_MIN_CAMNOC_IB_BW;
+	const struct camera_debug_settings *cam_debug = NULL;
+
+	if (!bus_client->valid) {
+		CAM_ERR(CAM_CPAS, "bus client: %s not valid",
+			bus_client->common_data.name);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cam_min_camnoc_ib_bw > 0)
+		min_camnoc_ib_bw = (uint64_t)cam_min_camnoc_ib_bw * 1000000L;
+
+	CAM_DBG(CAM_CPAS,
+		"Bus_client: %s, cam_min_camnoc_ib_bw = %d, min_camnoc_ib_bw=%llu",
+		bus_client->common_data.name, cam_min_camnoc_ib_bw,
+		min_camnoc_ib_bw);
+
+	mutex_lock(&bus_client->lock);
+	if (camnoc_bw) {
+		if ((ab > 0) && (ab < CAM_CPAS_AXI_MIN_CAMNOC_AB_BW))
+			ab = CAM_CPAS_AXI_MIN_CAMNOC_AB_BW;
+
+		if ((ib > 0) && (ib < min_camnoc_ib_bw))
+			ib = min_camnoc_ib_bw;
+	} else {
+		if ((ab > 0) && (ab < CAM_CPAS_AXI_MIN_MNOC_AB_BW))
+			ab = CAM_CPAS_AXI_MIN_MNOC_AB_BW;
+
+		if ((ib > 0) && (ib < CAM_CPAS_AXI_MIN_MNOC_IB_BW))
+			ib = CAM_CPAS_AXI_MIN_MNOC_IB_BW;
+	}
+
+	cam_debug = cam_debug_get_settings();
+
+	if (cam_debug && (cam_debug->cpas_settings.mnoc_hf_0_ab_bw ||
+		cam_debug->cpas_settings.mnoc_hf_0_ib_bw ||
+		cam_debug->cpas_settings.mnoc_hf_1_ab_bw ||
+		cam_debug->cpas_settings.mnoc_hf_1_ib_bw ||
+		cam_debug->cpas_settings.mnoc_sf_0_ab_bw ||
+		cam_debug->cpas_settings.mnoc_sf_0_ib_bw ||
+		cam_debug->cpas_settings.mnoc_sf_1_ab_bw ||
+		cam_debug->cpas_settings.mnoc_sf_1_ib_bw ||
+		cam_debug->cpas_settings.mnoc_sf_icp_ab_bw ||
+		cam_debug->cpas_settings.mnoc_sf_icp_ib_bw))
+		cam_cpas_process_bw_overrides(bus_client, &ab, &ib,
+			&cam_debug->cpas_settings);
+
+	rc = cam_soc_bus_client_update_bw(bus_client->soc_bus_client, ab, ib);
+	if (rc) {
+		CAM_ERR(CAM_CPAS,
+			"Update bw failed, ab[%llu] ib[%llu]",
+			ab, ib);
+		goto unlock_client;
+	}
+
+	if (applied_ab)
+		*applied_ab = ab;
+	if (applied_ib)
+		*applied_ib = ib;
+
+unlock_client:
+	mutex_unlock(&bus_client->lock);
+end:
+	return rc;
+}
+
+static int cam_cpas_util_register_bus_client(
+	struct cam_hw_soc_info *soc_info, struct device_node *dev_node,
+	struct cam_cpas_bus_client *bus_client)
+{
+	int rc = 0;
+
+	rc = cam_soc_bus_client_register(soc_info->pdev, dev_node,
+		&bus_client->soc_bus_client, &bus_client->common_data);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Bus client: %s registertion failed ,rc: %d",
+			bus_client->common_data.name, rc);
+		return rc;
+	}
+	bus_client->curr_vote_level = 0;
+	bus_client->valid = true;
+	mutex_init(&bus_client->lock);
+
+	return 0;
+}
+
+static int cam_cpas_util_unregister_bus_client(
+	struct cam_cpas_bus_client *bus_client)
+{
+	if (!bus_client->valid) {
+		CAM_ERR(CAM_CPAS, "bus client not valid");
+		return -EINVAL;
+	}
+
+	cam_soc_bus_client_unregister(&bus_client->soc_bus_client);
+	bus_client->curr_vote_level = 0;
+	bus_client->valid = false;
+	mutex_destroy(&bus_client->lock);
+
+	return 0;
+}
+
+static int cam_cpas_util_axi_cleanup(struct cam_cpas *cpas_core,
+	struct cam_hw_soc_info *soc_info)
+{
+	int i = 0;
+
+	if (cpas_core->num_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_axi_ports: %d",
+			cpas_core->num_axi_ports);
+		return -EINVAL;
+	}
+
+	if (cpas_core->num_camnoc_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_camnoc_axi_ports: %d",
+			cpas_core->num_camnoc_axi_ports);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		cam_cpas_util_unregister_bus_client(
+			&cpas_core->axi_port[i].bus_client);
+		of_node_put(cpas_core->axi_port[i].axi_port_node);
+		cpas_core->axi_port[i].axi_port_node = NULL;
+	}
+
+	for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+		cam_cpas_util_unregister_bus_client(
+			&cpas_core->camnoc_axi_port[i].bus_client);
+		of_node_put(cpas_core->camnoc_axi_port[i].axi_port_node);
+		cpas_core->camnoc_axi_port[i].axi_port_node = NULL;
+	}
+
+	return 0;
+}
+
+static int cam_cpas_util_axi_setup(struct cam_cpas *cpas_core,
+	struct cam_hw_soc_info *soc_info)
+{
+	int i = 0, rc = 0;
+	struct device_node *axi_port_mnoc_node = NULL;
+	struct device_node *axi_port_camnoc_node = NULL;
+
+	if (cpas_core->num_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_axi_ports: %d",
+			cpas_core->num_axi_ports);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		axi_port_mnoc_node = cpas_core->axi_port[i].axi_port_node;
+		rc = cam_cpas_util_register_bus_client(soc_info,
+			axi_port_mnoc_node, &cpas_core->axi_port[i].bus_client);
+		if (rc)
+			goto bus_register_fail;
+	}
+	for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+		axi_port_camnoc_node =
+			cpas_core->camnoc_axi_port[i].axi_port_node;
+		rc = cam_cpas_util_register_bus_client(soc_info,
+			axi_port_camnoc_node,
+			&cpas_core->camnoc_axi_port[i].bus_client);
+		if (rc)
+			goto bus_register_fail;
+	}
+
+	return 0;
+bus_register_fail:
+	of_node_put(cpas_core->axi_port[i].axi_port_node);
+	return rc;
+}
+
+static int cam_cpas_util_vote_default_ahb_axi(struct cam_hw_info *cpas_hw,
+	int enable)
+{
+	int rc, i = 0;
+	struct cam_cpas *cpas_core = (struct cam_cpas *)cpas_hw->core_info;
+	uint64_t ab_bw, ib_bw;
+	uint64_t applied_ab_bw = 0, applied_ib_bw = 0;
+
+	rc = cam_cpas_util_vote_bus_client_level(&cpas_core->ahb_bus_client,
+		(enable == true) ? CAM_SVS_VOTE : CAM_SUSPEND_VOTE);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed in AHB vote, enable=%d, rc=%d",
+			enable, rc);
+		return rc;
+	}
+
+	if (enable) {
+		ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	} else {
+		ab_bw = 0;
+		ib_bw = 0;
+	}
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		rc = cam_cpas_util_vote_bus_client_bw(
+			&cpas_core->axi_port[i].bus_client,
+			ab_bw, ib_bw, false, &applied_ab_bw, &applied_ib_bw);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in mnoc vote, enable=%d, rc=%d",
+				enable, rc);
+			goto remove_ahb_vote;
+		}
+		cpas_core->axi_port[i].applied_ab_bw = applied_ab_bw;
+		cpas_core->axi_port[i].applied_ib_bw = applied_ib_bw;
+	}
+
+	return 0;
+remove_ahb_vote:
+	cam_cpas_util_vote_bus_client_level(&cpas_core->ahb_bus_client,
+		CAM_SUSPEND_VOTE);
+	return rc;
+}
+
+static int cam_cpas_hw_reg_write(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle, enum cam_cpas_reg_base reg_base,
+	uint32_t offset, bool mb, uint32_t value)
+{
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_client *cpas_client = NULL;
+	int reg_base_index = cpas_core->regbase_index[reg_base];
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (reg_base_index < 0 || reg_base_index >= soc_info->num_reg_map) {
+		CAM_ERR(CAM_CPAS,
+			"Invalid reg_base=%d, reg_base_index=%d, num_map=%d",
+			reg_base, reg_base_index, soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] has not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto unlock_client;
+	}
+
+	if (mb)
+		cam_io_w_mb(value,
+			soc_info->reg_map[reg_base_index].mem_base + offset);
+	else
+		cam_io_w(value,
+			soc_info->reg_map[reg_base_index].mem_base + offset);
+
+unlock_client:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	return rc;
+}
+
+static int cam_cpas_hw_reg_read(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle, enum cam_cpas_reg_base reg_base,
+	uint32_t offset, bool mb, uint32_t *value)
+{
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_client *cpas_client = NULL;
+	int reg_base_index = cpas_core->regbase_index[reg_base];
+	uint32_t reg_value;
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (!value)
+		return -EINVAL;
+
+	if (reg_base_index < 0 || reg_base_index >= soc_info->num_reg_map) {
+		CAM_ERR(CAM_CPAS,
+			"Invalid reg_base=%d, reg_base_index=%d, num_map=%d",
+			reg_base, reg_base_index, soc_info->num_reg_map);
+		return -EINVAL;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] has not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		return -EPERM;
+	}
+
+	if (mb)
+		reg_value = cam_io_r_mb(
+			soc_info->reg_map[reg_base_index].mem_base + offset);
+	else
+		reg_value = cam_io_r(
+			soc_info->reg_map[reg_base_index].mem_base + offset);
+
+	*value = reg_value;
+
+	return rc;
+}
+
+static int cam_cpas_util_set_camnoc_axi_clk_rate(
+	struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_tree_node *tree_node = NULL;
+	int rc = 0, i = 0;
+	const struct camera_debug_settings *cam_debug = NULL;
+
+
+	CAM_DBG(CAM_CPAS, "control_camnoc_axi_clk=%d",
+		soc_private->control_camnoc_axi_clk);
+
+	if (soc_private->control_camnoc_axi_clk) {
+		struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+		uint64_t required_camnoc_bw = 0, intermediate_result = 0;
+		int64_t clk_rate = 0;
+
+		for (i = 0; i < CAM_CPAS_MAX_TREE_NODES; i++) {
+			tree_node = soc_private->tree_node[i];
+			if (!tree_node ||
+				!tree_node->camnoc_max_needed)
+				continue;
+
+			if (required_camnoc_bw < (tree_node->camnoc_bw *
+				tree_node->bus_width_factor)) {
+				required_camnoc_bw = tree_node->camnoc_bw *
+					tree_node->bus_width_factor;
+			}
+		}
+
+		intermediate_result = required_camnoc_bw *
+			soc_private->camnoc_axi_clk_bw_margin;
+		do_div(intermediate_result, 100);
+		required_camnoc_bw += intermediate_result;
+
+		if (cpas_core->streamon_clients && (required_camnoc_bw == 0)) {
+			CAM_DBG(CAM_CPAS,
+				"Set min vote if streamon_clients is non-zero : streamon_clients=%d",
+				cpas_core->streamon_clients);
+			required_camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		}
+
+		if ((required_camnoc_bw > 0) &&
+			(required_camnoc_bw <
+			soc_private->camnoc_axi_min_ib_bw))
+			required_camnoc_bw = soc_private->camnoc_axi_min_ib_bw;
+
+		cam_debug = cam_debug_get_settings();
+		if (cam_debug && cam_debug->cpas_settings.camnoc_bw) {
+			if (cam_debug->cpas_settings.camnoc_bw <
+				soc_private->camnoc_bus_width)
+				required_camnoc_bw =
+					soc_private->camnoc_bus_width;
+			else
+				required_camnoc_bw =
+					cam_debug->cpas_settings.camnoc_bw;
+			CAM_INFO(CAM_CPAS, "Overriding camnoc bw: %llu",
+				required_camnoc_bw);
+		}
+
+		intermediate_result = required_camnoc_bw;
+		do_div(intermediate_result, soc_private->camnoc_bus_width);
+		clk_rate = intermediate_result;
+
+		CAM_DBG(CAM_CPAS, "Setting camnoc axi clk rate : %llu %lld",
+			required_camnoc_bw, clk_rate);
+
+		/*
+		 * CPAS hw is not powered on for the first client.
+		 * Also, clk_rate will be overwritten with default
+		 * value while power on. So, skipping this for first
+		 * client.
+		 */
+		if (cpas_core->streamon_clients) {
+			rc = cam_soc_util_set_src_clk_rate(soc_info, clk_rate);
+			if (rc)
+				CAM_ERR(CAM_CPAS,
+				"Failed in setting camnoc axi clk %llu %lld %d",
+				required_camnoc_bw, clk_rate, rc);
+
+			cpas_core->applied_camnoc_axi_rate = clk_rate;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_cpas_util_translate_client_paths(
+	struct cam_axi_vote *axi_vote)
+{
+	int i;
+	uint32_t *path_data_type = NULL;
+
+	if (!axi_vote)
+		return -EINVAL;
+
+	for (i = 0; i < axi_vote->num_paths; i++) {
+		path_data_type = &axi_vote->axi_path[i].path_data_type;
+		/* Update path_data_type from UAPI value to internal value */
+		if (*path_data_type >= CAM_CPAS_PATH_DATA_CONSO_OFFSET)
+			*path_data_type = CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT +
+				(*path_data_type %
+				CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT);
+		else
+			*path_data_type %= CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT;
+
+		if (*path_data_type >= CAM_CPAS_PATH_DATA_MAX) {
+			CAM_ERR(CAM_CPAS, "index Invalid: %d", *path_data_type);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cpas_axi_consolidate_path_votes(
+	struct cam_cpas_client *cpas_client,
+	struct cam_axi_vote *axi_vote)
+{
+	int rc = 0, i, k, l;
+	struct cam_axi_vote *con_axi_vote = &cpas_client->axi_vote;
+	bool path_found = false, cons_entry_found;
+	struct cam_cpas_tree_node *curr_tree_node = NULL;
+	struct cam_cpas_tree_node *sum_tree_node = NULL;
+	uint32_t transac_type;
+	uint32_t path_data_type;
+	struct cam_axi_per_path_bw_vote *axi_path;
+
+	con_axi_vote->num_paths = 0;
+
+	for (i = 0; i < axi_vote->num_paths; i++) {
+		path_found = false;
+		path_data_type = axi_vote->axi_path[i].path_data_type;
+		transac_type = axi_vote->axi_path[i].transac_type;
+
+		if ((path_data_type >= CAM_CPAS_PATH_DATA_MAX) ||
+			(transac_type >= CAM_CPAS_TRANSACTION_MAX)) {
+			CAM_ERR(CAM_CPAS, "Invalid path or transac type: %d %d",
+				path_data_type, transac_type);
+			return -EINVAL;
+		}
+
+		axi_path = &con_axi_vote->axi_path[con_axi_vote->num_paths];
+
+		curr_tree_node =
+			cpas_client->tree_node[path_data_type][transac_type];
+		if (curr_tree_node) {
+			path_found = true;
+			memcpy(axi_path, &axi_vote->axi_path[i],
+				sizeof(struct cam_axi_per_path_bw_vote));
+			con_axi_vote->num_paths++;
+			continue;
+		}
+
+		for (k = 0; k < CAM_CPAS_PATH_DATA_MAX; k++) {
+			sum_tree_node = cpas_client->tree_node[k][transac_type];
+
+			if (!sum_tree_node)
+				continue;
+
+			if (sum_tree_node->constituent_paths[path_data_type]) {
+				path_found = true;
+				/*
+				 * Check if corresponding consolidated path
+				 * entry is already added into consolidated list
+				 */
+				cons_entry_found = false;
+				for (l = 0; l < con_axi_vote->num_paths; l++) {
+					if ((con_axi_vote->axi_path[l]
+					.path_data_type == k) &&
+					(con_axi_vote->axi_path[l]
+					.transac_type == transac_type)) {
+						cons_entry_found = true;
+						con_axi_vote->axi_path[l]
+						.camnoc_bw +=
+						axi_vote->axi_path[i]
+						.camnoc_bw;
+
+						con_axi_vote->axi_path[l]
+						.mnoc_ab_bw +=
+						axi_vote->axi_path[i]
+						.mnoc_ab_bw;
+
+						con_axi_vote->axi_path[l]
+						.mnoc_ib_bw +=
+						axi_vote->axi_path[i]
+						.mnoc_ib_bw;
+						break;
+					}
+				}
+
+				/* If not found, add a new entry */
+				if (!cons_entry_found) {
+					axi_path->path_data_type = k;
+					axi_path->transac_type = transac_type;
+					axi_path->camnoc_bw =
+					axi_vote->axi_path[i].camnoc_bw;
+					axi_path->mnoc_ab_bw =
+					axi_vote->axi_path[i].mnoc_ab_bw;
+					axi_path->mnoc_ib_bw =
+					axi_vote->axi_path[i].mnoc_ib_bw;
+					con_axi_vote->num_paths++;
+				}
+				break;
+			}
+		}
+
+		if (!path_found) {
+			CAM_ERR(CAM_CPAS,
+				"Client [%s][%d] Consolidated path not found for path=%d, transac=%d",
+				cpas_client->data.identifier,
+				cpas_client->data.cell_index,
+				path_data_type, transac_type);
+			return -EINVAL;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_cpas_update_axi_vote_bw(
+	struct cam_hw_info *cpas_hw,
+	struct cam_cpas_tree_node *cpas_tree_node,
+	bool   *mnoc_axi_port_updated,
+	bool   *camnoc_axi_port_updated)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+
+	if (cpas_tree_node->axi_port_idx >= CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid axi_port_idx: %d",
+			cpas_tree_node->axi_port_idx);
+		return -EINVAL;
+	}
+
+	cpas_core->axi_port[cpas_tree_node->axi_port_idx].ab_bw =
+		cpas_tree_node->mnoc_ab_bw;
+	cpas_core->axi_port[cpas_tree_node->axi_port_idx].ib_bw =
+		cpas_tree_node->mnoc_ib_bw;
+	mnoc_axi_port_updated[cpas_tree_node->axi_port_idx] = true;
+
+	if (soc_private->control_camnoc_axi_clk)
+		return 0;
+
+	cpas_core->camnoc_axi_port[cpas_tree_node->axi_port_idx].camnoc_bw =
+		cpas_tree_node->camnoc_bw;
+	camnoc_axi_port_updated[cpas_tree_node->camnoc_axi_port_idx] = true;
+	return 0;
+}
+
+static int cam_cpas_camnoc_set_vote_axi_clk_rate(
+	struct cam_hw_info *cpas_hw,
+	bool   *camnoc_axi_port_updated)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	int i;
+	int rc = 0;
+	struct cam_cpas_axi_port *camnoc_axi_port = NULL;
+	uint64_t camnoc_bw;
+	uint64_t applied_ab = 0, applied_ib = 0;
+
+	if (soc_private->control_camnoc_axi_clk) {
+		rc = cam_cpas_util_set_camnoc_axi_clk_rate(cpas_hw);
+		if (rc)
+			CAM_ERR(CAM_CPAS,
+				"Failed in setting axi clk rate rc=%d", rc);
+		return rc;
+	}
+
+	/* Below code is executed if we just vote and do not set the clk rate
+	 * for camnoc
+	 */
+
+	if (cpas_core->num_camnoc_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_camnoc_axi_ports: %d",
+			cpas_core->num_camnoc_axi_ports);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+		if (camnoc_axi_port_updated[i])
+			camnoc_axi_port = &cpas_core->camnoc_axi_port[i];
+		else
+			continue;
+
+		CAM_DBG(CAM_PERF, "Port[%s] : camnoc_bw=%lld",
+			camnoc_axi_port->axi_port_name,
+			camnoc_axi_port->camnoc_bw);
+
+		if (camnoc_axi_port->camnoc_bw)
+			camnoc_bw = camnoc_axi_port->camnoc_bw;
+		else if (camnoc_axi_port->additional_bw)
+			camnoc_bw = camnoc_axi_port->additional_bw;
+		else if (cpas_core->streamon_clients)
+			camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		else
+			camnoc_bw = 0;
+
+		rc = cam_cpas_util_vote_bus_client_bw(
+			&camnoc_axi_port->bus_client,
+			0, camnoc_bw, true, &applied_ab, &applied_ib);
+
+		CAM_DBG(CAM_CPAS,
+			"camnoc vote camnoc_bw[%llu] rc=%d %s",
+			camnoc_bw, rc, camnoc_axi_port->axi_port_name);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in camnoc vote camnoc_bw[%llu] rc=%d",
+				camnoc_bw, rc);
+			break;
+		}
+		camnoc_axi_port->applied_ab_bw = applied_ab;
+		camnoc_axi_port->applied_ib_bw = applied_ib;
+	}
+	return rc;
+}
+
+static int cam_cpas_util_apply_client_axi_vote(
+	struct cam_hw_info *cpas_hw,
+	struct cam_cpas_client *cpas_client,
+	struct cam_axi_vote *axi_vote)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_axi_vote *con_axi_vote = NULL;
+	struct cam_cpas_axi_port *mnoc_axi_port = NULL;
+	struct cam_cpas_tree_node *curr_tree_node = NULL;
+	struct cam_cpas_tree_node *par_tree_node = NULL;
+	uint32_t transac_type;
+	uint32_t path_data_type;
+	bool mnoc_axi_port_updated[CAM_CPAS_MAX_AXI_PORTS] = {false};
+	bool camnoc_axi_port_updated[CAM_CPAS_MAX_AXI_PORTS] = {false};
+	uint64_t mnoc_ab_bw = 0, mnoc_ib_bw = 0,
+		curr_camnoc_old = 0, curr_mnoc_ab_old = 0, curr_mnoc_ib_old = 0,
+		par_camnoc_old = 0, par_mnoc_ab_old = 0, par_mnoc_ib_old = 0;
+	int rc = 0, i = 0;
+	uint64_t applied_ab = 0, applied_ib = 0;
+
+	mutex_lock(&cpas_core->tree_lock);
+	if (!cpas_client->tree_node_valid) {
+		/*
+		 * This is by assuming apply_client_axi_vote is called
+		 * for these clients from only cpas_start, cpas_stop.
+		 * not called from hw_update_axi_vote
+		 */
+		for (i = 0; i < cpas_core->num_axi_ports; i++) {
+			if (axi_vote->axi_path[0].mnoc_ab_bw) {
+				/* start case */
+				cpas_core->axi_port[i].additional_bw +=
+					CAM_CPAS_DEFAULT_AXI_BW;
+			} else {
+				/* stop case */
+				cpas_core->axi_port[i].additional_bw -=
+					CAM_CPAS_DEFAULT_AXI_BW;
+			}
+			mnoc_axi_port_updated[i] = true;
+		}
+
+		for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+			if (axi_vote->axi_path[0].camnoc_bw) {
+				/* start case */
+				cpas_core->camnoc_axi_port[i].additional_bw +=
+					CAM_CPAS_DEFAULT_AXI_BW;
+			} else {
+				/* stop case */
+				cpas_core->camnoc_axi_port[i].additional_bw -=
+					CAM_CPAS_DEFAULT_AXI_BW;
+			}
+			camnoc_axi_port_updated[i] = true;
+		}
+
+		goto vote_start_clients;
+	}
+
+	rc = cam_cpas_axi_consolidate_path_votes(cpas_client, axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_PERF, "Failed in bw consolidation, Client [%s][%d]",
+			cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		goto unlock_tree;
+	}
+
+	con_axi_vote = &cpas_client->axi_vote;
+
+	cam_cpas_dump_axi_vote_info(cpas_client, "Consolidated Vote",
+		con_axi_vote);
+
+	/* Traverse through node tree and update bw vote values */
+	for (i = 0; i < con_axi_vote->num_paths; i++) {
+		path_data_type =
+		con_axi_vote->axi_path[i].path_data_type;
+		transac_type =
+		con_axi_vote->axi_path[i].transac_type;
+		curr_tree_node = cpas_client->tree_node[path_data_type]
+			[transac_type];
+
+		if (con_axi_vote->axi_path[i].mnoc_ab_bw == 0)
+			con_axi_vote->axi_path[i].mnoc_ab_bw =
+				con_axi_vote->axi_path[i].camnoc_bw;
+
+		if (con_axi_vote->axi_path[i].camnoc_bw == 0)
+			con_axi_vote->axi_path[i].camnoc_bw =
+				con_axi_vote->axi_path[i].mnoc_ab_bw;
+
+		if ((curr_tree_node->camnoc_bw ==
+			con_axi_vote->axi_path[i].camnoc_bw) &&
+			(curr_tree_node->mnoc_ab_bw ==
+			con_axi_vote->axi_path[i].mnoc_ab_bw) &&
+			(curr_tree_node->mnoc_ib_bw ==
+			con_axi_vote->axi_path[i].mnoc_ib_bw))
+			continue;
+
+		curr_camnoc_old = curr_tree_node->camnoc_bw;
+		curr_mnoc_ab_old = curr_tree_node->mnoc_ab_bw;
+		curr_mnoc_ib_old = curr_tree_node->mnoc_ib_bw;
+		curr_tree_node->camnoc_bw =
+			con_axi_vote->axi_path[i].camnoc_bw;
+		curr_tree_node->mnoc_ab_bw =
+			con_axi_vote->axi_path[i].mnoc_ab_bw;
+		curr_tree_node->mnoc_ib_bw =
+			con_axi_vote->axi_path[i].mnoc_ib_bw;
+
+		while (curr_tree_node->parent_node) {
+			par_tree_node = curr_tree_node->parent_node;
+			par_camnoc_old = par_tree_node->camnoc_bw;
+			par_mnoc_ab_old = par_tree_node->mnoc_ab_bw;
+			par_mnoc_ib_old = par_tree_node->mnoc_ib_bw;
+			par_tree_node->mnoc_ab_bw -= curr_mnoc_ab_old;
+			par_tree_node->mnoc_ab_bw += curr_tree_node->mnoc_ab_bw;
+			par_tree_node->mnoc_ib_bw -= curr_mnoc_ib_old;
+			par_tree_node->mnoc_ib_bw += curr_tree_node->mnoc_ib_bw;
+
+			if (par_tree_node->merge_type ==
+				CAM_CPAS_TRAFFIC_MERGE_SUM) {
+				par_tree_node->camnoc_bw -=
+					curr_camnoc_old;
+				par_tree_node->camnoc_bw +=
+					curr_tree_node->camnoc_bw;
+			} else if (par_tree_node->merge_type ==
+				CAM_CPAS_TRAFFIC_MERGE_SUM_INTERLEAVE) {
+				par_tree_node->camnoc_bw -=
+					(curr_camnoc_old / 2);
+				par_tree_node->camnoc_bw +=
+					(curr_tree_node->camnoc_bw / 2);
+			} else {
+				CAM_ERR(CAM_CPAS, "Invalid Merge type");
+				rc = -EINVAL;
+				goto unlock_tree;
+			}
+
+			if (!par_tree_node->parent_node) {
+				if ((par_tree_node->axi_port_idx < 0) ||
+					(par_tree_node->axi_port_idx >=
+					CAM_CPAS_MAX_AXI_PORTS)) {
+					CAM_ERR(CAM_CPAS,
+					"AXI port index invalid");
+					rc = -EINVAL;
+					goto unlock_tree;
+				}
+				rc = cam_cpas_update_axi_vote_bw(cpas_hw,
+					par_tree_node,
+					mnoc_axi_port_updated,
+					camnoc_axi_port_updated);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+						"Update Vote failed");
+					goto unlock_tree;
+				}
+			}
+
+			curr_tree_node = par_tree_node;
+			curr_camnoc_old = par_camnoc_old;
+			curr_mnoc_ab_old = par_mnoc_ab_old;
+			curr_mnoc_ib_old = par_mnoc_ib_old;
+		}
+	}
+
+	if (!par_tree_node) {
+		CAM_DBG(CAM_CPAS, "No change in BW for all paths");
+		rc = 0;
+		goto unlock_tree;
+	}
+
+vote_start_clients:
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		if (mnoc_axi_port_updated[i])
+			mnoc_axi_port = &cpas_core->axi_port[i];
+		else
+			continue;
+
+		CAM_DBG(CAM_PERF,
+			"Port[%s] : ab=%lld ib=%lld additional=%lld, streamon_clients=%d",
+			mnoc_axi_port->axi_port_name, mnoc_axi_port->ab_bw,
+			mnoc_axi_port->ib_bw, mnoc_axi_port->additional_bw,
+			cpas_core->streamon_clients);
+
+		if (mnoc_axi_port->ab_bw)
+			mnoc_ab_bw = mnoc_axi_port->ab_bw;
+		else if (mnoc_axi_port->additional_bw)
+			mnoc_ab_bw = mnoc_axi_port->additional_bw;
+		else if (cpas_core->streamon_clients)
+			mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		else
+			mnoc_ab_bw = 0;
+
+		if (cpas_core->axi_port[i].ib_bw_voting_needed)
+			mnoc_ib_bw = mnoc_axi_port->ib_bw;
+		else
+			mnoc_ib_bw = 0;
+
+		rc = cam_cpas_util_vote_bus_client_bw(
+			&mnoc_axi_port->bus_client,
+			mnoc_ab_bw, mnoc_ib_bw, false, &applied_ab,
+			&applied_ib);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in mnoc vote ab[%llu] ib[%llu] rc=%d",
+				mnoc_ab_bw, mnoc_ib_bw, rc);
+			goto unlock_tree;
+		}
+		mnoc_axi_port->applied_ab_bw = applied_ab;
+		mnoc_axi_port->applied_ib_bw = applied_ib;
+	}
+	rc = cam_cpas_camnoc_set_vote_axi_clk_rate(
+		cpas_hw, camnoc_axi_port_updated);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "Failed in setting axi clk rate rc=%d", rc);
+
+unlock_tree:
+	mutex_unlock(&cpas_core->tree_lock);
+	return rc;
+}
+
+static int cam_cpas_util_apply_default_axi_vote(
+	struct cam_hw_info *cpas_hw, bool enable)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_axi_port *axi_port = NULL;
+	uint64_t mnoc_ab_bw = 0, mnoc_ib_bw = 0;
+	uint64_t applied_ab_bw = 0, applied_ib_bw = 0;
+	int rc = 0, i = 0;
+
+	mutex_lock(&cpas_core->tree_lock);
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		if (!cpas_core->axi_port[i].ab_bw ||
+			!cpas_core->axi_port[i].ib_bw)
+			axi_port = &cpas_core->axi_port[i];
+		else
+			continue;
+
+		if (enable)
+			mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		else
+			mnoc_ib_bw = 0;
+
+		CAM_DBG(CAM_CPAS, "Port=[%s] :ab[%llu] ib[%llu]",
+			axi_port->axi_port_name, mnoc_ab_bw, mnoc_ib_bw);
+
+		rc = cam_cpas_util_vote_bus_client_bw(&axi_port->bus_client,
+			mnoc_ab_bw, mnoc_ib_bw, false, &axi_port->applied_ab_bw,
+			&axi_port->applied_ib_bw);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in mnoc vote ab[%llu] ib[%llu] rc=%d",
+				mnoc_ab_bw, mnoc_ib_bw, rc);
+			goto unlock_tree;
+		}
+		cpas_core->axi_port[i].applied_ab_bw = applied_ab_bw;
+		cpas_core->axi_port[i].applied_ib_bw = applied_ib_bw;
+	}
+
+unlock_tree:
+	mutex_unlock(&cpas_core->tree_lock);
+	return rc;
+}
+
+static int cam_cpas_hw_update_axi_vote(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle, struct cam_axi_vote *client_axi_vote)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_client *cpas_client = NULL;
+	struct cam_axi_vote *axi_vote = NULL;
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (!client_axi_vote) {
+		CAM_ERR(CAM_CPAS, "Invalid arg, client_handle=%d",
+			client_handle);
+		return -EINVAL;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+
+	axi_vote = kmemdup(client_axi_vote, sizeof(struct cam_axi_vote),
+		GFP_KERNEL);
+	if (!axi_vote) {
+		CAM_ERR(CAM_CPAS, "Out of memory");
+		mutex_unlock(&cpas_core->client_mutex[client_indx]);
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return -ENOMEM;
+	}
+
+	cam_cpas_dump_axi_vote_info(cpas_core->cpas_client[client_indx],
+		"Incoming Vote", axi_vote);
+
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] has not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto unlock_client;
+	}
+
+	rc = cam_cpas_util_translate_client_paths(axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CPAS,
+			"Unable to translate per path votes rc: %d", rc);
+		goto unlock_client;
+	}
+
+	cam_cpas_dump_axi_vote_info(cpas_core->cpas_client[client_indx],
+		"Translated Vote", axi_vote);
+
+	rc = cam_cpas_util_apply_client_axi_vote(cpas_hw,
+		cpas_core->cpas_client[client_indx], axi_vote);
+
+	/* Log an entry whenever there is an AXI update - after updating */
+	cam_cpas_update_monitor_array(cpas_hw, "CPAS AXI post-update",
+		client_indx);
+unlock_client:
+	cam_free_clear((void *)axi_vote);
+	axi_vote = NULL;
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_util_get_ahb_level(struct cam_hw_info *cpas_hw,
+	struct device *dev, unsigned long freq, enum cam_vote_level *req_level)
+{
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct dev_pm_opp *opp;
+	unsigned int corner;
+	enum cam_vote_level level = CAM_SVS_VOTE;
+	unsigned long corner_freq = freq;
+	int i;
+
+	if (!dev || !req_level) {
+		CAM_ERR(CAM_CPAS, "Invalid params %pK, %pK", dev, req_level);
+		return -EINVAL;
+	}
+
+	opp = dev_pm_opp_find_freq_ceil(dev, &corner_freq);
+	if (IS_ERR(opp)) {
+		CAM_DBG(CAM_CPAS, "OPP Ceil not available for freq :%ld, %pK",
+			corner_freq, opp);
+		*req_level = CAM_TURBO_VOTE;
+		return 0;
+	}
+
+	corner = dev_pm_opp_get_voltage(opp);
+
+	for (i = 0; i < soc_private->num_vdd_ahb_mapping; i++)
+		if (corner == soc_private->vdd_ahb[i].vdd_corner)
+			level = soc_private->vdd_ahb[i].ahb_level;
+
+	CAM_DBG(CAM_CPAS,
+		"From OPP table : freq=[%ld][%ld], corner=%d, level=%d",
+		freq, corner_freq, corner, level);
+
+	*req_level = level;
+
+	return 0;
+}
+
+static int cam_cpas_util_apply_client_ahb_vote(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_client *cpas_client, struct cam_ahb_vote *ahb_vote,
+	enum cam_vote_level *applied_level)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_bus_client *ahb_bus_client = &cpas_core->ahb_bus_client;
+	enum cam_vote_level required_level;
+	enum cam_vote_level highest_level;
+	int i, rc = 0;
+
+	if (!ahb_bus_client->valid) {
+		CAM_ERR(CAM_CPAS, "AHB Bus client not valid");
+		return -EINVAL;
+	}
+
+	if (ahb_vote->type == CAM_VOTE_DYNAMIC) {
+		rc = cam_cpas_util_get_ahb_level(cpas_hw, cpas_client->data.dev,
+			ahb_vote->vote.freq, &required_level);
+		if (rc)
+			return rc;
+	} else {
+		required_level = ahb_vote->vote.level;
+	}
+
+	if (cpas_client->ahb_level == required_level)
+		return 0;
+
+	mutex_lock(&ahb_bus_client->lock);
+	cpas_client->ahb_level = required_level;
+
+	CAM_DBG(CAM_CPAS, "Client[%s] required level[%d], curr_level[%d]",
+		ahb_bus_client->common_data.name, required_level,
+		ahb_bus_client->curr_vote_level);
+
+	if (required_level == ahb_bus_client->curr_vote_level)
+		goto unlock_bus_client;
+
+	highest_level = required_level;
+	for (i = 0; i < cpas_core->num_clients; i++) {
+		if (cpas_core->cpas_client[i] && (highest_level <
+			cpas_core->cpas_client[i]->ahb_level))
+			highest_level = cpas_core->cpas_client[i]->ahb_level;
+	}
+
+	CAM_DBG(CAM_CPAS, "Required highest_level[%d]", highest_level);
+
+	if (!cpas_core->ahb_bus_scaling_disable) {
+		rc = cam_cpas_util_vote_bus_client_level(ahb_bus_client,
+			highest_level);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in ahb vote, level=%d, rc=%d",
+				highest_level, rc);
+			goto unlock_bus_client;
+		}
+	}
+
+	if (cpas_core->streamon_clients) {
+		rc = cam_soc_util_set_clk_rate_level(&cpas_hw->soc_info,
+			highest_level, true);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"Failed in scaling clock rate level %d for AHB",
+				highest_level);
+			goto unlock_bus_client;
+		}
+	}
+
+	if (applied_level)
+		*applied_level = highest_level;
+
+unlock_bus_client:
+	mutex_unlock(&ahb_bus_client->lock);
+	return rc;
+}
+
+static int cam_cpas_hw_update_ahb_vote(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle, struct cam_ahb_vote *client_ahb_vote)
+{
+	struct cam_ahb_vote ahb_vote;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_client *cpas_client = NULL;
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (!client_ahb_vote) {
+		CAM_ERR(CAM_CPAS, "Invalid input arg");
+		return -EINVAL;
+	}
+
+	ahb_vote = *client_ahb_vote;
+
+	if (ahb_vote.vote.level == 0) {
+		CAM_DBG(CAM_CPAS, "0 ahb vote from client %d",
+			client_handle);
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = CAM_SVS_VOTE;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] has not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto unlock_client;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"client=[%d][%s][%d] : type[%d], level[%d], freq[%ld], applied[%d]",
+		client_indx, cpas_client->data.identifier,
+		cpas_client->data.cell_index, ahb_vote.type,
+		ahb_vote.vote.level, ahb_vote.vote.freq,
+		cpas_core->cpas_client[client_indx]->ahb_level);
+
+	rc = cam_cpas_util_apply_client_ahb_vote(cpas_hw,
+		cpas_core->cpas_client[client_indx], &ahb_vote, NULL);
+
+unlock_client:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_util_create_vote_all_paths(
+	struct cam_cpas_client *cpas_client,
+	struct cam_axi_vote *axi_vote)
+{
+	int i, j;
+	uint64_t camnoc_bw, mnoc_ab_bw, mnoc_ib_bw;
+	struct cam_axi_per_path_bw_vote *axi_path;
+
+	if (!cpas_client || !axi_vote)
+		return -EINVAL;
+
+	camnoc_bw = axi_vote->axi_path[0].camnoc_bw;
+	mnoc_ab_bw = axi_vote->axi_path[0].mnoc_ab_bw;
+	mnoc_ib_bw = axi_vote->axi_path[0].mnoc_ib_bw;
+
+	axi_vote->num_paths = 0;
+
+	for (i = 0; i < CAM_CPAS_TRANSACTION_MAX; i++) {
+		for (j = 0; j < CAM_CPAS_PATH_DATA_MAX; j++) {
+			if (cpas_client->tree_node[j][i]) {
+				axi_path =
+				&axi_vote->axi_path[axi_vote->num_paths];
+
+				axi_path->path_data_type = j;
+				axi_path->transac_type = i;
+				axi_path->camnoc_bw = camnoc_bw;
+				axi_path->mnoc_ab_bw = mnoc_ab_bw;
+				axi_path->mnoc_ib_bw = mnoc_ib_bw;
+
+				axi_vote->num_paths++;
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cpas_hw_start(void *hw_priv, void *start_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	uint32_t client_indx;
+	struct cam_cpas_hw_cmd_start *cmd_hw_start;
+	struct cam_cpas_client *cpas_client;
+	struct cam_ahb_vote *ahb_vote;
+	struct cam_ahb_vote remove_ahb;
+	struct cam_axi_vote axi_vote = {0};
+	enum cam_vote_level applied_level = CAM_SVS_VOTE;
+	int rc, i = 0;
+	struct cam_cpas_private_soc *soc_private = NULL;
+	bool invalid_start = true;
+
+	if (!hw_priv || !start_args) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK",
+			hw_priv, start_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_cpas_hw_cmd_start) != arg_size) {
+		CAM_ERR(CAM_CPAS, "HW_CAPS size mismatch %zd %d",
+			sizeof(struct cam_cpas_hw_cmd_start), arg_size);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)hw_priv;
+	cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+	cmd_hw_start = (struct cam_cpas_hw_cmd_start *)start_args;
+	client_indx = CAM_CPAS_GET_CLIENT_IDX(cmd_hw_start->client_handle);
+	ahb_vote = cmd_hw_start->ahb_vote;
+
+	if (!ahb_vote || !cmd_hw_start->axi_vote)
+		return -EINVAL;
+
+	if (!ahb_vote->vote.level) {
+		CAM_ERR(CAM_CPAS, "Invalid vote ahb[%d]",
+			ahb_vote->vote.level);
+		return -EINVAL;
+	}
+
+	memcpy(&axi_vote, cmd_hw_start->axi_vote, sizeof(struct cam_axi_vote));
+	for (i = 0; i < axi_vote.num_paths; i++) {
+		if ((axi_vote.axi_path[i].camnoc_bw != 0) ||
+			(axi_vote.axi_path[i].mnoc_ab_bw != 0) ||
+			(axi_vote.axi_path[i].mnoc_ib_bw != 0)) {
+			invalid_start = false;
+			break;
+		}
+	}
+
+	if (invalid_start) {
+		CAM_ERR(CAM_CPAS, "Zero start vote");
+		return -EINVAL;
+	}
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	if (!CAM_CPAS_CLIENT_REGISTERED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d] is not registered",
+			client_indx);
+		rc = -EPERM;
+		goto error;
+	}
+
+	if (CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "client=[%d][%s][%d] is in start state",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto error;
+	}
+
+	CAM_DBG(CAM_CPAS,
+		"AHB :client=[%d][%s][%d] type[%d], level[%d], applied[%d]",
+		client_indx, cpas_client->data.identifier,
+		cpas_client->data.cell_index,
+		ahb_vote->type, ahb_vote->vote.level, cpas_client->ahb_level);
+	rc = cam_cpas_util_apply_client_ahb_vote(cpas_hw, cpas_client,
+		ahb_vote, &applied_level);
+	if (rc)
+		goto error;
+
+	cam_cpas_dump_axi_vote_info(cpas_client, "CPAS Start Vote",
+		&axi_vote);
+
+	/*
+	 * If client has indicated start bw to be applied on all paths
+	 * of client, apply that otherwise apply whatever the client supplies
+	 * for specific paths
+	 */
+	if (axi_vote.axi_path[0].path_data_type ==
+		CAM_CPAS_API_PATH_DATA_STD_START) {
+		rc = cam_cpas_util_create_vote_all_paths(cpas_client,
+			&axi_vote);
+	} else {
+		rc = cam_cpas_util_translate_client_paths(&axi_vote);
+	}
+
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Unable to create or translate paths rc: %d",
+			rc);
+		goto remove_ahb_vote;
+	}
+
+	cam_cpas_dump_axi_vote_info(cpas_client, "CPAS Start Translated Vote",
+		&axi_vote);
+
+	rc = cam_cpas_util_apply_client_axi_vote(cpas_hw,
+		cpas_client, &axi_vote);
+	if (rc)
+		goto remove_ahb_vote;
+
+	if (cpas_core->streamon_clients == 0) {
+		rc = cam_cpas_util_apply_default_axi_vote(cpas_hw, true);
+		if (rc)
+			goto remove_ahb_vote;
+
+		atomic_set(&cpas_core->irq_count, 1);
+		rc = cam_cpas_soc_enable_resources(&cpas_hw->soc_info,
+			applied_level);
+		if (rc) {
+			atomic_set(&cpas_core->irq_count, 0);
+			CAM_ERR(CAM_CPAS, "enable_resorce failed, rc=%d", rc);
+			goto remove_axi_vote;
+		}
+
+		if (cpas_core->internal_ops.power_on) {
+			rc = cpas_core->internal_ops.power_on(cpas_hw);
+			if (rc) {
+				atomic_set(&cpas_core->irq_count, 0);
+				cam_cpas_soc_disable_resources(
+					&cpas_hw->soc_info, true, true);
+				CAM_ERR(CAM_CPAS,
+					"failed in power_on settings rc=%d",
+					rc);
+				goto remove_axi_vote;
+			}
+		}
+		CAM_DBG(CAM_CPAS, "irq_count=%d\n",
+			atomic_read(&cpas_core->irq_count));
+
+		cam_smmu_reset_cb_page_fault_cnt();
+		cpas_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	}
+
+	cpas_client->started = true;
+	cpas_core->streamon_clients++;
+
+	CAM_DBG(CAM_CPAS, "client=[%d][%s][%d] streamon_clients=%d",
+		client_indx, cpas_client->data.identifier,
+		cpas_client->data.cell_index, cpas_core->streamon_clients);
+
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+
+remove_axi_vote:
+	memset(&axi_vote, 0x0, sizeof(struct cam_axi_vote));
+	rc = cam_cpas_util_create_vote_all_paths(cpas_client, &axi_vote);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "Unable to create per path votes rc: %d", rc);
+
+	cam_cpas_dump_axi_vote_info(cpas_client, "CPAS Start fail Vote",
+		&axi_vote);
+
+	rc = cam_cpas_util_apply_client_axi_vote(cpas_hw,
+		cpas_client, &axi_vote);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "Unable remove votes rc: %d", rc);
+
+remove_ahb_vote:
+	remove_ahb.type = CAM_VOTE_ABSOLUTE;
+	remove_ahb.vote.level = CAM_SUSPEND_VOTE;
+	rc = cam_cpas_util_apply_client_ahb_vote(cpas_hw, cpas_client,
+		&remove_ahb, NULL);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "Removing AHB vote failed, rc=%d", rc);
+
+error:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int _check_irq_count(struct cam_cpas *cpas_core)
+{
+	return (atomic_read(&cpas_core->irq_count) > 0) ? 0 : 1;
+}
+
+static int cam_cpas_hw_stop(void *hw_priv, void *stop_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	uint32_t client_indx;
+	struct cam_cpas_hw_cmd_stop *cmd_hw_stop;
+	struct cam_cpas_client *cpas_client;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	struct cam_cpas_private_soc *soc_private = NULL;
+	int rc = 0;
+	long result;
+	int retry_camnoc_idle = 0;
+
+	if (!hw_priv || !stop_args) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK",
+			hw_priv, stop_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_cpas_hw_cmd_stop) != arg_size) {
+		CAM_ERR(CAM_CPAS, "HW_CAPS size mismatch %zd %d",
+			sizeof(struct cam_cpas_hw_cmd_stop), arg_size);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)hw_priv;
+	cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+	cmd_hw_stop = (struct cam_cpas_hw_cmd_stop *)stop_args;
+	client_indx = CAM_CPAS_GET_CLIENT_IDX(cmd_hw_stop->client_handle);
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+	cpas_client = cpas_core->cpas_client[client_indx];
+
+	CAM_DBG(CAM_CPAS, "Client=[%d][%s][%d] streamon_clients=%d",
+		client_indx, cpas_client->data.identifier,
+		cpas_client->data.cell_index, cpas_core->streamon_clients);
+
+	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "Client=[%d][%s][%d] is not started",
+			client_indx, cpas_client->data.identifier,
+			cpas_client->data.cell_index);
+		rc = -EPERM;
+		goto done;
+	}
+
+	cpas_client->started = false;
+	cpas_core->streamon_clients--;
+
+	if (cpas_core->streamon_clients == 0) {
+		if (cpas_core->internal_ops.power_off) {
+			rc = cpas_core->internal_ops.power_off(cpas_hw);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"failed in power_off settings rc=%d",
+					rc);
+				/* Do not return error, passthrough */
+			}
+		}
+
+		if (cpas_core->internal_ops.qchannel_handshake) {
+			rc = cpas_core->internal_ops.qchannel_handshake(
+				cpas_hw, false);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"failed in qchannel_handshake rc=%d",
+					rc);
+				retry_camnoc_idle = 1;
+				/* Do not return error, passthrough */
+			}
+		}
+
+		rc = cam_cpas_soc_disable_irq(&cpas_hw->soc_info);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "disable_irq failed, rc=%d", rc);
+			goto done;
+		}
+
+		/* Wait for any IRQs still being handled */
+		atomic_dec(&cpas_core->irq_count);
+		result = wait_event_timeout(cpas_core->irq_count_wq,
+			_check_irq_count(cpas_core), HZ);
+		if (result == 0) {
+			CAM_ERR(CAM_CPAS, "Wait failed: irq_count=%d",
+				atomic_read(&cpas_core->irq_count));
+		}
+
+		/* try again incase camnoc is still not idle */
+		if (cpas_core->internal_ops.qchannel_handshake &&
+			retry_camnoc_idle) {
+			rc = cpas_core->internal_ops.qchannel_handshake(
+				cpas_hw, false);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"failed in qchannel_handshake rc=%d",
+					rc);
+				/* Do not return error, passthrough */
+			}
+		}
+
+		rc = cam_cpas_soc_disable_resources(&cpas_hw->soc_info,
+			true, false);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "disable_resorce failed, rc=%d", rc);
+			goto done;
+		}
+		CAM_DBG(CAM_CPAS, "Disabled all the resources: irq_count=%d",
+			atomic_read(&cpas_core->irq_count));
+		cpas_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	}
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_SUSPEND_VOTE;
+	rc = cam_cpas_util_apply_client_ahb_vote(cpas_hw, cpas_client,
+		&ahb_vote, NULL);
+	if (rc)
+		goto done;
+
+	rc = cam_cpas_util_create_vote_all_paths(cpas_client, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Unable to create per path votes rc: %d", rc);
+		goto done;
+	}
+
+	cam_cpas_dump_axi_vote_info(cpas_client, "CPAS Stop Vote", &axi_vote);
+
+	rc = cam_cpas_util_apply_client_axi_vote(cpas_hw,
+		cpas_client, &axi_vote);
+	if (rc)
+		goto done;
+
+	if (cpas_core->streamon_clients == 0)
+		rc = cam_cpas_util_apply_default_axi_vote(cpas_hw, false);
+done:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_hw_init(void *hw_priv, void *init_hw_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	int rc = 0;
+
+	if (!hw_priv || !init_hw_args) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK",
+			hw_priv, init_hw_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_cpas_hw_caps) != arg_size) {
+		CAM_ERR(CAM_CPAS, "INIT HW size mismatch %zd %d",
+			sizeof(struct cam_cpas_hw_caps), arg_size);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)hw_priv;
+	cpas_core = (struct cam_cpas *)cpas_hw->core_info;
+
+	if (cpas_core->internal_ops.init_hw_version) {
+		rc = cpas_core->internal_ops.init_hw_version(cpas_hw,
+			(struct cam_cpas_hw_caps *)init_hw_args);
+	}
+
+	return rc;
+}
+
+static int cam_cpas_hw_register_client(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_register_params *register_params)
+{
+	int rc;
+	char client_name[CAM_HW_IDENTIFIER_LENGTH + 3];
+	int32_t client_indx = -1;
+	struct cam_cpas *cpas_core = (struct cam_cpas *)cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+
+	if ((!register_params) ||
+		(strlen(register_params->identifier) < 1)) {
+		CAM_ERR(CAM_CPAS, "Invalid cpas client identifier");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CPAS, "Register params : identifier=%s, cell_index=%d",
+		register_params->identifier, register_params->cell_index);
+
+	if (soc_private->client_id_based)
+		snprintf(client_name, sizeof(client_name), "%s%d",
+			register_params->identifier,
+			register_params->cell_index);
+	else
+		snprintf(client_name, sizeof(client_name), "%s",
+			register_params->identifier);
+
+	mutex_lock(&cpas_hw->hw_mutex);
+
+	rc = cam_common_util_get_string_index(soc_private->client_name,
+		soc_private->num_clients, client_name, &client_indx);
+
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+
+	if (rc || !CAM_CPAS_CLIENT_VALID(client_indx) ||
+		CAM_CPAS_CLIENT_REGISTERED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS,
+			"Inval client %s %d : %d %d %pK %d",
+			register_params->identifier,
+			register_params->cell_index,
+			CAM_CPAS_CLIENT_VALID(client_indx),
+			CAM_CPAS_CLIENT_REGISTERED(cpas_core, client_indx),
+			cpas_core->cpas_client[client_indx], rc);
+		mutex_unlock(&cpas_core->client_mutex[client_indx]);
+		mutex_unlock(&cpas_hw->hw_mutex);
+		return -EPERM;
+	}
+
+	register_params->client_handle =
+		CAM_CPAS_GET_CLIENT_HANDLE(client_indx);
+	memcpy(&cpas_core->cpas_client[client_indx]->data, register_params,
+		sizeof(struct cam_cpas_register_params));
+	cpas_core->registered_clients++;
+	cpas_core->cpas_client[client_indx]->registered = true;
+
+	CAM_DBG(CAM_CPAS, "client=[%d][%s][%d], registered_clients=%d",
+		client_indx,
+		cpas_core->cpas_client[client_indx]->data.identifier,
+		cpas_core->cpas_client[client_indx]->data.cell_index,
+		cpas_core->registered_clients);
+
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+
+	return 0;
+}
+
+static int cam_cpas_hw_unregister_client(struct cam_hw_info *cpas_hw,
+	uint32_t client_handle)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	uint32_t client_indx = CAM_CPAS_GET_CLIENT_IDX(client_handle);
+	int rc = 0;
+
+	if (!CAM_CPAS_CLIENT_VALID(client_indx))
+		return -EINVAL;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+	mutex_lock(&cpas_core->client_mutex[client_indx]);
+
+	if (!CAM_CPAS_CLIENT_REGISTERED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "Client=[%d][%s][%d] not registered",
+			client_indx,
+			cpas_core->cpas_client[client_indx]->data.identifier,
+			cpas_core->cpas_client[client_indx]->data.cell_index);
+		rc = -EPERM;
+		goto done;
+	}
+
+	if (CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
+		CAM_ERR(CAM_CPAS, "Client=[%d][%s][%d] is not stopped",
+			client_indx,
+			cpas_core->cpas_client[client_indx]->data.identifier,
+			cpas_core->cpas_client[client_indx]->data.cell_index);
+
+		rc = -EPERM;
+		goto done;
+	}
+
+	CAM_DBG(CAM_CPAS, "client=[%d][%s][%d], registered_clients=%d",
+		client_indx,
+		cpas_core->cpas_client[client_indx]->data.identifier,
+		cpas_core->cpas_client[client_indx]->data.cell_index,
+		cpas_core->registered_clients);
+
+	cpas_core->cpas_client[client_indx]->registered = false;
+	cpas_core->registered_clients--;
+done:
+	mutex_unlock(&cpas_core->client_mutex[client_indx]);
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_hw_get_hw_info(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	struct cam_cpas_hw_caps *hw_caps;
+	struct cam_cpas_private_soc *soc_private;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK",
+			hw_priv, get_hw_cap_args);
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_cpas_hw_caps) != arg_size) {
+		CAM_ERR(CAM_CPAS, "HW_CAPS size mismatch %zd %d",
+			sizeof(struct cam_cpas_hw_caps), arg_size);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)hw_priv;
+	cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	hw_caps = (struct cam_cpas_hw_caps *)get_hw_cap_args;
+	*hw_caps = cpas_core->hw_caps;
+
+	/*Extract Fuse Info*/
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+
+	hw_caps->fuse_info = soc_private->fuse_info;
+	CAM_INFO(CAM_CPAS, "fuse info->num_fuses %d",
+		hw_caps->fuse_info.num_fuses);
+
+	return 0;
+}
+
+static int cam_cpas_log_vote(struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	uint32_t i;
+	struct cam_cpas_tree_node *curr_node;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+
+	/*
+	 * First print rpmh registers as early as possible to catch nearest
+	 * state of rpmh after an issue (overflow) occurs.
+	 */
+	if ((cpas_core->streamon_clients > 0) &&
+		(cpas_core->regbase_index[CAM_CPAS_REG_RPMH] != -1)) {
+		int reg_base_index =
+			cpas_core->regbase_index[CAM_CPAS_REG_RPMH];
+		void __iomem *rpmh_base =
+			soc_info->reg_map[reg_base_index].mem_base;
+		uint32_t offset_fe, offset_be;
+		uint32_t fe_val, be_val;
+		uint32_t *rpmh_info = &soc_private->rpmh_info[0];
+		uint32_t ddr_bcm_index =
+			soc_private->rpmh_info[CAM_RPMH_BCM_DDR_INDEX];
+		uint32_t mnoc_bcm_index =
+			soc_private->rpmh_info[CAM_RPMH_BCM_MNOC_INDEX];
+
+		/*
+		 * print 12 registers from 0x4, 0x800 offsets -
+		 * this will give ddr, mmnoc and other BCM info.
+		 * i=0 for DDR, i=4 for mnoc, but double check for each chipset.
+		 */
+		for (i = 0; i < rpmh_info[CAM_RPMH_NUMBER_OF_BCMS]; i++) {
+			if ((!cpas_core->full_state_dump) &&
+				(i != ddr_bcm_index) &&
+				(i != mnoc_bcm_index))
+				continue;
+
+			offset_fe = rpmh_info[CAM_RPMH_BCM_FE_OFFSET] +
+				(i * 0x4);
+			offset_be = rpmh_info[CAM_RPMH_BCM_BE_OFFSET] +
+				(i * 0x4);
+
+			fe_val = cam_io_r_mb(rpmh_base + offset_fe);
+			be_val = cam_io_r_mb(rpmh_base + offset_be);
+
+			CAM_INFO(CAM_CPAS,
+				"i=%d, FE[offset=0x%x, value=0x%x] BE[offset=0x%x, value=0x%x]",
+				i, offset_fe, fe_val, offset_be, be_val);
+		}
+	}
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		CAM_INFO(CAM_CPAS,
+			"[%s] ab_bw[%lld] ib_bw[%lld] additional_bw[%lld] applied_ab[%lld] applied_ib[%lld]",
+			cpas_core->axi_port[i].axi_port_name,
+			cpas_core->axi_port[i].ab_bw,
+			cpas_core->axi_port[i].ib_bw,
+			cpas_core->axi_port[i].additional_bw,
+			cpas_core->axi_port[i].applied_ab_bw,
+			cpas_core->axi_port[i].applied_ib_bw);
+	}
+
+	if (soc_private->control_camnoc_axi_clk) {
+		CAM_INFO(CAM_CPAS, "applied camnoc axi clk[%lld]",
+			cpas_core->applied_camnoc_axi_rate);
+	} else {
+		for (i = 0; i < cpas_core->num_camnoc_axi_ports; i++) {
+			CAM_INFO(CAM_CPAS,
+				"[%s] ab_bw[%lld] ib_bw[%lld] additional_bw[%lld] applied_ab[%lld] applied_ib[%lld]",
+				cpas_core->camnoc_axi_port[i].axi_port_name,
+				cpas_core->camnoc_axi_port[i].ab_bw,
+				cpas_core->camnoc_axi_port[i].ib_bw,
+				cpas_core->camnoc_axi_port[i].additional_bw,
+				cpas_core->camnoc_axi_port[i].applied_ab_bw,
+				cpas_core->camnoc_axi_port[i].applied_ib_bw);
+		}
+	}
+
+	CAM_INFO(CAM_CPAS, "ahb client curr vote level[%d]",
+		cpas_core->ahb_bus_client.curr_vote_level);
+
+	if (!cpas_core->full_state_dump) {
+		CAM_DBG(CAM_CPAS, "CPAS full state dump not enabled");
+		return 0;
+	}
+
+	/* This will traverse through all nodes in the tree and print stats*/
+	for (i = 0; i < CAM_CPAS_MAX_TREE_NODES; i++) {
+		if (!soc_private->tree_node[i])
+			continue;
+		curr_node = soc_private->tree_node[i];
+
+		CAM_INFO(CAM_CPAS,
+			"[%s] Cell[%d] level[%d] PortIdx[%d][%d] camnoc_bw[%d %d %lld %lld] mnoc_bw[%lld %lld]",
+			curr_node->node_name, curr_node->cell_idx,
+			curr_node->level_idx, curr_node->axi_port_idx,
+			curr_node->camnoc_axi_port_idx,
+			curr_node->camnoc_max_needed,
+			curr_node->bus_width_factor,
+			curr_node->camnoc_bw,
+			curr_node->camnoc_bw * curr_node->bus_width_factor,
+			curr_node->mnoc_ab_bw, curr_node->mnoc_ib_bw);
+	}
+
+	cam_cpas_dump_monitor_array(cpas_core);
+
+	if (cpas_core->internal_ops.print_poweron_settings)
+		cpas_core->internal_ops.print_poweron_settings(cpas_hw);
+	else
+		CAM_DBG(CAM_CPAS, "No ops for print_poweron_settings");
+
+	return 0;
+}
+
+static void cam_cpas_update_monitor_array(struct cam_hw_info *cpas_hw,
+	const char *identifier_string, int32_t identifier_value)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	struct cam_cpas_private_soc *soc_private =
+		(struct cam_cpas_private_soc *) cpas_hw->soc_info.soc_private;
+	struct cam_cpas_monitor *entry;
+	int iterator;
+	int i;
+	int reg_camnoc = cpas_core->regbase_index[CAM_CPAS_REG_CAMNOC];
+
+	CAM_CPAS_INC_MONITOR_HEAD(&cpas_core->monitor_head, &iterator);
+
+	entry = &cpas_core->monitor_entries[iterator];
+
+	ktime_get_real_ts64(&entry->timestamp);
+	strscpy(entry->identifier_string, identifier_string,
+		sizeof(entry->identifier_string));
+
+	entry->identifier_value = identifier_value;
+
+	for (i = 0; i < cpas_core->num_axi_ports; i++) {
+		entry->axi_info[i].axi_port_name =
+			cpas_core->axi_port[i].axi_port_name;
+		entry->axi_info[i].ab_bw = cpas_core->axi_port[i].ab_bw;
+		entry->axi_info[i].ib_bw = cpas_core->axi_port[i].ib_bw;
+		entry->axi_info[i].camnoc_bw = cpas_core->axi_port[i].camnoc_bw;
+		entry->axi_info[i].applied_ab_bw =
+			cpas_core->axi_port[i].applied_ab_bw;
+		entry->axi_info[i].applied_ib_bw =
+			cpas_core->axi_port[i].applied_ib_bw;
+	}
+
+	entry->applied_camnoc_clk = cpas_core->applied_camnoc_axi_rate;
+	entry->applied_ahb_level = cpas_core->ahb_bus_client.curr_vote_level;
+
+	if ((cpas_core->streamon_clients > 0) &&
+		(cpas_core->regbase_index[CAM_CPAS_REG_RPMH] != -1) &&
+		soc_private->rpmh_info[CAM_RPMH_NUMBER_OF_BCMS]) {
+		int reg_base_index =
+			cpas_core->regbase_index[CAM_CPAS_REG_RPMH];
+		void __iomem *rpmh_base =
+			soc_info->reg_map[reg_base_index].mem_base;
+		uint32_t fe_ddr_offset =
+			soc_private->rpmh_info[CAM_RPMH_BCM_FE_OFFSET] +
+			(0x4 * soc_private->rpmh_info[CAM_RPMH_BCM_DDR_INDEX]);
+		uint32_t fe_mnoc_offset =
+			soc_private->rpmh_info[CAM_RPMH_BCM_FE_OFFSET] +
+			(0x4 * soc_private->rpmh_info[CAM_RPMH_BCM_MNOC_INDEX]);
+		uint32_t be_ddr_offset =
+			soc_private->rpmh_info[CAM_RPMH_BCM_BE_OFFSET] +
+			(0x4 * soc_private->rpmh_info[CAM_RPMH_BCM_DDR_INDEX]);
+		uint32_t be_mnoc_offset =
+			soc_private->rpmh_info[CAM_RPMH_BCM_BE_OFFSET] +
+			(0x4 * soc_private->rpmh_info[CAM_RPMH_BCM_MNOC_INDEX]);
+
+		/*
+		 * 0x4, 0x800 - DDR
+		 * 0x800, 0x810 - mmnoc
+		 */
+		entry->fe_ddr = cam_io_r_mb(rpmh_base + fe_ddr_offset);
+		entry->fe_mnoc = cam_io_r_mb(rpmh_base + fe_mnoc_offset);
+		entry->be_ddr = cam_io_r_mb(rpmh_base + be_ddr_offset);
+		entry->be_mnoc = cam_io_r_mb(rpmh_base + be_mnoc_offset);
+	}
+
+	entry->camnoc_fill_level[0] = cam_io_r_mb(
+		soc_info->reg_map[reg_camnoc].mem_base + 0xA20);
+	entry->camnoc_fill_level[1] = cam_io_r_mb(
+		soc_info->reg_map[reg_camnoc].mem_base + 0x1420);
+	entry->camnoc_fill_level[2] = cam_io_r_mb(
+		soc_info->reg_map[reg_camnoc].mem_base + 0x1A20);
+
+	if (cpas_hw->soc_info.hw_version == CAM_CPAS_TITAN_580_V100) {
+		entry->camnoc_fill_level[3] = cam_io_r_mb(
+			soc_info->reg_map[reg_camnoc].mem_base + 0x7620);
+		entry->camnoc_fill_level[4] = cam_io_r_mb(
+			soc_info->reg_map[reg_camnoc].mem_base + 0x7420);
+	}
+}
+
+static void cam_cpas_dump_monitor_array(
+	struct cam_cpas *cpas_core)
+{
+	int i = 0, j = 0;
+	int64_t state_head = 0;
+	uint32_t index, num_entries, oldest_entry;
+	uint64_t ms, tmp, hrs, min, sec;
+	struct cam_cpas_monitor *entry;
+	struct timespec64 curr_timestamp;
+
+	if (!cpas_core->full_state_dump)
+		return;
+
+	state_head = atomic64_read(&cpas_core->monitor_head);
+
+	if (state_head == -1) {
+		CAM_WARN(CAM_CPAS, "No valid entries in cpas monitor array");
+		return;
+	} else if (state_head < CAM_CPAS_MONITOR_MAX_ENTRIES) {
+		num_entries = state_head;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_CPAS_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1,
+			CAM_CPAS_MONITOR_MAX_ENTRIES, &oldest_entry);
+	}
+
+
+	ktime_get_real_ts64(&curr_timestamp);
+	tmp = curr_timestamp.tv_sec;
+	ms = (curr_timestamp.tv_nsec) / 1000000;
+	sec = do_div(tmp, 60);
+	min = do_div(tmp, 60);
+	hrs = do_div(tmp, 24);
+
+	CAM_INFO(CAM_CPAS,
+		"**** %llu:%llu:%llu.%llu : ======== Dumping monitor information ===========",
+		hrs, min, sec, ms);
+
+	index = oldest_entry;
+
+	for (i = 0; i < num_entries; i++) {
+		entry = &cpas_core->monitor_entries[index];
+		tmp = entry->timestamp.tv_sec;
+		ms = (entry->timestamp.tv_nsec) / 1000000;
+		sec = do_div(tmp, 60);
+		min = do_div(tmp, 60);
+		hrs = do_div(tmp, 24);
+
+		CAM_INFO(CAM_CPAS,
+			"**** %llu:%llu:%llu.%llu : Index[%d] Identifier[%s][%d] camnoc=%lld, ahb=%d",
+			hrs, min, sec, ms,
+			index,
+			entry->identifier_string, entry->identifier_value,
+			entry->applied_camnoc_clk, entry->applied_ahb_level);
+
+		for (j = 0; j < cpas_core->num_axi_ports; j++) {
+			CAM_INFO(CAM_CPAS,
+				"MNOC BW [%s] : ab=%lld, ib=%lld, camnoc=%lld",
+				entry->axi_info[j].axi_port_name,
+				entry->axi_info[j].applied_ab_bw,
+				entry->axi_info[j].applied_ib_bw,
+				entry->axi_info[j].camnoc_bw);
+		}
+
+		if (cpas_core->regbase_index[CAM_CPAS_REG_RPMH] != -1) {
+			CAM_INFO(CAM_CPAS,
+				"fe_ddr=0x%x, fe_mnoc=0x%x, be_ddr=0x%x, be_mnoc=0x%x",
+				entry->fe_ddr, entry->fe_mnoc,
+				entry->be_ddr, entry->be_mnoc);
+		}
+
+		CAM_INFO(CAM_CPAS,
+			"CAMNOC REG[Queued Pending] linear[%d %d] rdi0_wr[%d %d] ubwc_stats0[%d %d] ubwc_stats1[%d %d] rdi1_wr[%d %d]",
+			(entry->camnoc_fill_level[0] & 0x7FF),
+			(entry->camnoc_fill_level[0] & 0x7F0000) >> 16,
+			(entry->camnoc_fill_level[1] & 0x7FF),
+			(entry->camnoc_fill_level[1] & 0x7F0000) >> 16,
+			(entry->camnoc_fill_level[2] & 0x7FF),
+			(entry->camnoc_fill_level[2] & 0x7F0000) >> 16,
+			(entry->camnoc_fill_level[3] & 0x7FF),
+			(entry->camnoc_fill_level[3] & 0x7F0000) >> 16,
+			(entry->camnoc_fill_level[4] & 0x7FF),
+			(entry->camnoc_fill_level[4] & 0x7F0000) >> 16);
+
+		index = (index + 1) % CAM_CPAS_MONITOR_MAX_ENTRIES;
+	}
+}
+
+static int cam_cpas_log_event(struct cam_hw_info *cpas_hw,
+	const char *identifier_string, int32_t identifier_value)
+{
+	cam_cpas_update_monitor_array(cpas_hw, identifier_string,
+		identifier_value);
+
+	return 0;
+}
+
+static int cam_cpas_select_qos(struct cam_hw_info *cpas_hw,
+	uint32_t selection_mask)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int rc = 0;
+
+	mutex_lock(&cpas_hw->hw_mutex);
+
+	if (cpas_hw->hw_state == CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_CPAS,
+			"Hw already in power up state, can't change QoS settings");
+		rc = -EINVAL;
+		goto done;
+	}
+
+	if (cpas_core->internal_ops.setup_qos_settings) {
+		rc = cpas_core->internal_ops.setup_qos_settings(cpas_hw,
+			selection_mask);
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in changing QoS %d", rc);
+	} else {
+		CAM_WARN(CAM_CPAS, "No ops for qos_settings");
+	}
+
+done:
+	mutex_unlock(&cpas_hw->hw_mutex);
+	return rc;
+}
+
+static int cam_cpas_hw_process_cmd(void *hw_priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!hw_priv || !cmd_args ||
+		(cmd_type >= CAM_CPAS_HW_CMD_INVALID)) {
+		CAM_ERR(CAM_CPAS, "Invalid arguments %pK %pK %d",
+			hw_priv, cmd_args, cmd_type);
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_CPAS_HW_CMD_REGISTER_CLIENT: {
+		struct cam_cpas_register_params *register_params;
+
+		if (sizeof(struct cam_cpas_register_params) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		register_params = (struct cam_cpas_register_params *)cmd_args;
+		rc = cam_cpas_hw_register_client(hw_priv, register_params);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_UNREGISTER_CLIENT: {
+		uint32_t *client_handle;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		client_handle = (uint32_t *)cmd_args;
+		rc = cam_cpas_hw_unregister_client(hw_priv, *client_handle);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_REG_WRITE: {
+		struct cam_cpas_hw_cmd_reg_read_write *reg_write;
+
+		if (sizeof(struct cam_cpas_hw_cmd_reg_read_write) !=
+			arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		reg_write =
+			(struct cam_cpas_hw_cmd_reg_read_write *)cmd_args;
+		rc = cam_cpas_hw_reg_write(hw_priv, reg_write->client_handle,
+			reg_write->reg_base, reg_write->offset, reg_write->mb,
+			reg_write->value);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_REG_READ: {
+		struct cam_cpas_hw_cmd_reg_read_write *reg_read;
+
+		if (sizeof(struct cam_cpas_hw_cmd_reg_read_write) !=
+			arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		reg_read =
+			(struct cam_cpas_hw_cmd_reg_read_write *)cmd_args;
+		rc = cam_cpas_hw_reg_read(hw_priv,
+			reg_read->client_handle, reg_read->reg_base,
+			reg_read->offset, reg_read->mb, &reg_read->value);
+
+		break;
+	}
+	case CAM_CPAS_HW_CMD_AHB_VOTE: {
+		struct cam_cpas_hw_cmd_ahb_vote *cmd_ahb_vote;
+
+		if (sizeof(struct cam_cpas_hw_cmd_ahb_vote) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		cmd_ahb_vote = (struct cam_cpas_hw_cmd_ahb_vote *)cmd_args;
+		rc = cam_cpas_hw_update_ahb_vote(hw_priv,
+			cmd_ahb_vote->client_handle, cmd_ahb_vote->ahb_vote);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_AXI_VOTE: {
+		struct cam_cpas_hw_cmd_axi_vote *cmd_axi_vote;
+
+		if (sizeof(struct cam_cpas_hw_cmd_axi_vote) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		cmd_axi_vote = (struct cam_cpas_hw_cmd_axi_vote *)cmd_args;
+		rc = cam_cpas_hw_update_axi_vote(hw_priv,
+			cmd_axi_vote->client_handle, cmd_axi_vote->axi_vote);
+		break;
+	}
+	case CAM_CPAS_HW_CMD_LOG_VOTE: {
+		rc = cam_cpas_log_vote(hw_priv);
+		break;
+	}
+
+	case CAM_CPAS_HW_CMD_LOG_EVENT: {
+		struct cam_cpas_hw_cmd_notify_event *event;
+
+		if (sizeof(struct cam_cpas_hw_cmd_notify_event) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		event = (struct cam_cpas_hw_cmd_notify_event *)cmd_args;
+
+		rc = cam_cpas_log_event(hw_priv, event->identifier_string,
+			event->identifier_value);
+		break;
+	}
+
+	case CAM_CPAS_HW_CMD_SELECT_QOS: {
+		uint32_t *selection_mask;
+
+		if (sizeof(uint32_t) != arg_size) {
+			CAM_ERR(CAM_CPAS, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		selection_mask = (uint32_t *)cmd_args;
+		rc = cam_cpas_select_qos(hw_priv, *selection_mask);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_CPAS, "CPAS HW command not valid =%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_cpas_util_client_setup(struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int i;
+
+	for (i = 0; i < CAM_CPAS_MAX_CLIENTS; i++) {
+		mutex_init(&cpas_core->client_mutex[i]);
+	}
+
+	return 0;
+}
+
+int cam_cpas_util_client_cleanup(struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	int i;
+
+	for (i = 0; i < CAM_CPAS_MAX_CLIENTS; i++) {
+		if (cpas_core->cpas_client[i] &&
+			cpas_core->cpas_client[i]->registered) {
+			cam_cpas_hw_unregister_client(cpas_hw, i);
+		}
+		kfree(cpas_core->cpas_client[i]);
+		cpas_core->cpas_client[i] = NULL;
+		mutex_destroy(&cpas_core->client_mutex[i]);
+	}
+
+	return 0;
+}
+
+static int cam_cpas_util_get_internal_ops(struct platform_device *pdev,
+	struct cam_hw_intf *hw_intf, struct cam_cpas_internal_ops *internal_ops)
+{
+	struct device_node *of_node = pdev->dev.of_node;
+	int rc;
+	const char *compat_str = NULL;
+
+	rc = of_property_read_string_index(of_node, "arch-compat", 0,
+		(const char **)&compat_str);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed to get arch-compat rc=%d", rc);
+		return -EINVAL;
+	}
+
+	if (strnstr(compat_str, "camss_top", strlen(compat_str))) {
+		hw_intf->hw_type = CAM_HW_CAMSSTOP;
+		rc = cam_camsstop_get_internal_ops(internal_ops);
+	} else if (strnstr(compat_str, "cpas_top", strlen(compat_str))) {
+		hw_intf->hw_type = CAM_HW_CPASTOP;
+		rc = cam_cpastop_get_internal_ops(internal_ops);
+	} else {
+		CAM_ERR(CAM_CPAS, "arch-compat %s not supported", compat_str);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_cpas_util_create_debugfs(struct cam_cpas *cpas_core)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_cpas", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_CPAS,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	cpas_core->dentry = dbgfileptr;
+
+	debugfs_create_bool("ahb_bus_scaling_disable", 0644,
+		cpas_core->dentry, &cpas_core->ahb_bus_scaling_disable);
+
+	debugfs_create_bool("full_state_dump", 0644,
+		cpas_core->dentry, &cpas_core->full_state_dump);
+
+end:
+	return rc;
+}
+
+int cam_cpas_hw_probe(struct platform_device *pdev,
+	struct cam_hw_intf **hw_intf)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_info *cpas_hw = NULL;
+	struct cam_hw_intf *cpas_hw_intf = NULL;
+	struct cam_cpas *cpas_core = NULL;
+	struct cam_cpas_private_soc *soc_private;
+	struct cam_cpas_internal_ops *internal_ops;
+
+	cpas_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!cpas_hw_intf)
+		return -ENOMEM;
+
+	cpas_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!cpas_hw) {
+		kfree(cpas_hw_intf);
+		return -ENOMEM;
+	}
+
+	cpas_core = kzalloc(sizeof(struct cam_cpas), GFP_KERNEL);
+	if (!cpas_core) {
+		kfree(cpas_hw);
+		kfree(cpas_hw_intf);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < CAM_CPAS_REG_MAX; i++)
+		cpas_core->regbase_index[i] = -1;
+
+	cpas_hw_intf->hw_priv = cpas_hw;
+	cpas_hw->core_info = cpas_core;
+
+	cpas_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	cpas_hw->soc_info.pdev = pdev;
+	cpas_hw->soc_info.dev = &pdev->dev;
+	cpas_hw->soc_info.dev_name = pdev->name;
+	cpas_hw->open_count = 0;
+	cpas_core->ahb_bus_scaling_disable = false;
+	cpas_core->full_state_dump = false;
+
+	atomic64_set(&cpas_core->monitor_head, -1);
+
+	mutex_init(&cpas_hw->hw_mutex);
+	spin_lock_init(&cpas_hw->hw_lock);
+	init_completion(&cpas_hw->hw_complete);
+
+	cpas_hw_intf->hw_ops.get_hw_caps = cam_cpas_hw_get_hw_info;
+	cpas_hw_intf->hw_ops.init = cam_cpas_hw_init;
+	cpas_hw_intf->hw_ops.deinit = NULL;
+	cpas_hw_intf->hw_ops.reset = NULL;
+	cpas_hw_intf->hw_ops.reserve = NULL;
+	cpas_hw_intf->hw_ops.release = NULL;
+	cpas_hw_intf->hw_ops.start = cam_cpas_hw_start;
+	cpas_hw_intf->hw_ops.stop = cam_cpas_hw_stop;
+	cpas_hw_intf->hw_ops.read = NULL;
+	cpas_hw_intf->hw_ops.write = NULL;
+	cpas_hw_intf->hw_ops.process_cmd = cam_cpas_hw_process_cmd;
+
+	cpas_core->work_queue = alloc_workqueue("cam-cpas",
+		WQ_UNBOUND | WQ_MEM_RECLAIM, CAM_CPAS_INFLIGHT_WORKS);
+	if (!cpas_core->work_queue) {
+		rc = -ENOMEM;
+		goto release_mem;
+	}
+
+	internal_ops = &cpas_core->internal_ops;
+	rc = cam_cpas_util_get_internal_ops(pdev, cpas_hw_intf, internal_ops);
+	if (rc)
+		goto release_workq;
+
+	rc = cam_cpas_soc_init_resources(&cpas_hw->soc_info,
+		internal_ops->handle_irq, cpas_hw);
+	if (rc)
+		goto release_workq;
+
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+	cpas_core->num_clients = soc_private->num_clients;
+	atomic_set(&cpas_core->irq_count, 0);
+	init_waitqueue_head(&cpas_core->irq_count_wq);
+
+	if (internal_ops->setup_regbase) {
+		rc = internal_ops->setup_regbase(&cpas_hw->soc_info,
+			cpas_core->regbase_index, CAM_CPAS_REG_MAX);
+		if (rc)
+			goto deinit_platform_res;
+	}
+
+	rc = cam_cpas_util_client_setup(cpas_hw);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in client setup, rc=%d", rc);
+		goto deinit_platform_res;
+	}
+
+	rc = cam_cpas_util_register_bus_client(&cpas_hw->soc_info,
+		cpas_hw->soc_info.pdev->dev.of_node,
+		&cpas_core->ahb_bus_client);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in ahb setup, rc=%d", rc);
+		goto client_cleanup;
+	}
+
+	rc = cam_cpas_util_axi_setup(cpas_core, &cpas_hw->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in axi setup, rc=%d", rc);
+		goto ahb_cleanup;
+	}
+
+	/* Need to vote first before enabling clocks */
+	rc = cam_cpas_util_vote_default_ahb_axi(cpas_hw, true);
+	if (rc)
+		goto axi_cleanup;
+
+	rc = cam_cpas_soc_enable_resources(&cpas_hw->soc_info, CAM_SVS_VOTE);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in soc_enable_resources, rc=%d", rc);
+		goto remove_default_vote;
+	}
+
+	if (internal_ops->get_hw_info) {
+		rc = internal_ops->get_hw_info(cpas_hw, &cpas_core->hw_caps);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "failed in get_hw_info, rc=%d", rc);
+			goto disable_soc_res;
+		}
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid get_hw_info");
+		goto disable_soc_res;
+	}
+
+	rc = cam_cpas_hw_init(cpas_hw_intf->hw_priv,
+		&cpas_core->hw_caps, sizeof(struct cam_cpas_hw_caps));
+	if (rc)
+		goto disable_soc_res;
+
+	rc = cam_cpas_soc_disable_resources(&cpas_hw->soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in soc_disable_resources, rc=%d", rc);
+		goto remove_default_vote;
+	}
+
+	rc = cam_cpas_util_vote_default_ahb_axi(cpas_hw, false);
+	if (rc)
+		goto axi_cleanup;
+
+	rc = cam_cpas_util_create_debugfs(cpas_core);
+
+	*hw_intf = cpas_hw_intf;
+	return 0;
+
+disable_soc_res:
+	cam_cpas_soc_disable_resources(&cpas_hw->soc_info, true, true);
+remove_default_vote:
+	cam_cpas_util_vote_default_ahb_axi(cpas_hw, false);
+axi_cleanup:
+	cam_cpas_util_axi_cleanup(cpas_core, &cpas_hw->soc_info);
+ahb_cleanup:
+	cam_cpas_util_unregister_bus_client(&cpas_core->ahb_bus_client);
+client_cleanup:
+	cam_cpas_util_client_cleanup(cpas_hw);
+	cam_cpas_node_tree_cleanup(cpas_core, cpas_hw->soc_info.soc_private);
+deinit_platform_res:
+	cam_cpas_soc_deinit_resources(&cpas_hw->soc_info);
+release_workq:
+	flush_workqueue(cpas_core->work_queue);
+	destroy_workqueue(cpas_core->work_queue);
+release_mem:
+	mutex_destroy(&cpas_hw->hw_mutex);
+	kfree(cpas_core);
+	kfree(cpas_hw);
+	kfree(cpas_hw_intf);
+	CAM_ERR(CAM_CPAS, "failed in hw probe");
+	return rc;
+}
+
+int cam_cpas_hw_remove(struct cam_hw_intf *cpas_hw_intf)
+{
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+
+	if (!cpas_hw_intf) {
+		CAM_ERR(CAM_CPAS, "cpas interface not initialized");
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info *)cpas_hw_intf->hw_priv;
+	cpas_core = (struct cam_cpas *)cpas_hw->core_info;
+
+	if (cpas_hw->hw_state == CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_CPAS, "cpas hw is in power up state");
+		return -EINVAL;
+	}
+
+	cam_cpas_util_axi_cleanup(cpas_core, &cpas_hw->soc_info);
+	cam_cpas_node_tree_cleanup(cpas_core, cpas_hw->soc_info.soc_private);
+	cam_cpas_util_unregister_bus_client(&cpas_core->ahb_bus_client);
+	cam_cpas_util_client_cleanup(cpas_hw);
+	cam_cpas_soc_deinit_resources(&cpas_hw->soc_info);
+	debugfs_remove_recursive(cpas_core->dentry);
+	cpas_core->dentry = NULL;
+	flush_workqueue(cpas_core->work_queue);
+	destroy_workqueue(cpas_core->work_queue);
+	mutex_destroy(&cpas_hw->hw_mutex);
+	kfree(cpas_core);
+	kfree(cpas_hw);
+	kfree(cpas_hw_intf);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_hw.h
@@ -0,0 +1,302 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CPAS_HW_H_
+#define _CAM_CPAS_HW_H_
+
+#include <dt-bindings/msm-camera.h>
+#include "cam_cpas_api.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_common_util.h"
+#include "cam_soc_bus.h"
+
+#define CAM_CPAS_INFLIGHT_WORKS              5
+#define CAM_CPAS_MAX_CLIENTS                 40
+#define CAM_CPAS_MAX_AXI_PORTS               6
+#define CAM_CPAS_MAX_TREE_LEVELS             4
+#define CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT   32
+#define CAM_CPAS_PATH_DATA_MAX               38
+#define CAM_CPAS_TRANSACTION_MAX             2
+
+#define CAM_CPAS_AXI_MIN_MNOC_AB_BW   (2048 * 1024)
+#define CAM_CPAS_AXI_MIN_MNOC_IB_BW   (2048 * 1024)
+#define CAM_CPAS_AXI_MIN_CAMNOC_AB_BW (2048 * 1024)
+#define CAM_CPAS_AXI_MIN_CAMNOC_IB_BW (3000000000UL)
+
+#define CAM_CPAS_GET_CLIENT_IDX(handle) (handle)
+#define CAM_CPAS_GET_CLIENT_HANDLE(indx) (indx)
+
+#define CAM_CPAS_CLIENT_VALID(indx) \
+	((indx >= 0) && (indx < CAM_CPAS_MAX_CLIENTS))
+#define CAM_CPAS_CLIENT_REGISTERED(cpas_core, indx)        \
+	((CAM_CPAS_CLIENT_VALID(indx)) && \
+	(cpas_core->cpas_client[indx]->registered))
+#define CAM_CPAS_CLIENT_STARTED(cpas_core, indx)          \
+	((CAM_CPAS_CLIENT_REGISTERED(cpas_core, indx)) && \
+	(cpas_core->cpas_client[indx]->started))
+
+/* Array indices to represent corresponding RPMH BCM info */
+#define CAM_RPMH_NUMBER_OF_BCMS 0
+#define CAM_RPMH_BCM_FE_OFFSET  1
+#define CAM_RPMH_BCM_BE_OFFSET  2
+#define CAM_RPMH_BCM_DDR_INDEX  3
+#define CAM_RPMH_BCM_MNOC_INDEX 4
+#define CAM_RPMH_BCM_INFO_MAX   5
+
+#define CAM_CPAS_MONITOR_MAX_ENTRIES   60
+#define CAM_CPAS_INC_MONITOR_HEAD(head, ret) \
+	div_u64_rem(atomic64_add_return(1, head),\
+	CAM_CPAS_MONITOR_MAX_ENTRIES, (ret))
+
+/**
+ * enum cam_cpas_access_type - Enum for Register access type
+ */
+enum cam_cpas_access_type {
+	CAM_REG_TYPE_READ,
+	CAM_REG_TYPE_WRITE,
+	CAM_REG_TYPE_READ_WRITE,
+};
+
+/**
+ * struct cam_cpas_internal_ops - CPAS Hardware layer internal ops
+ *
+ * @get_hw_info: Function pointer for get hw info
+ * @init_hw_version: Function pointer for hw init based on version
+ * @handle_irq: Function poniter for irq handling
+ * @setup_regbase: Function pointer for setup rebase indices
+ * @power_on: Function pointer for hw core specific power on settings
+ * @power_off: Function pointer for hw core specific power off settings
+ * @setup_qos_settings: Function pointer for hw to select a specific qos header
+ * @print_poweron_settings: Function pointer for hw to print poweron settings
+ * @qchannel_handshake: Function pointer for hw core specific qchannel
+ *                      handshake settings
+ *
+ */
+struct cam_cpas_internal_ops {
+	int (*get_hw_info)(struct cam_hw_info *cpas_hw,
+		struct cam_cpas_hw_caps *hw_caps);
+	int (*init_hw_version)(struct cam_hw_info *cpas_hw,
+		struct cam_cpas_hw_caps *hw_caps);
+	irqreturn_t (*handle_irq)(int irq_num, void *data);
+	int (*setup_regbase)(struct cam_hw_soc_info *soc_info,
+		int32_t regbase_index[], int32_t num_reg_map);
+	int (*power_on)(struct cam_hw_info *cpas_hw);
+	int (*power_off)(struct cam_hw_info *cpas_hw);
+	int (*setup_qos_settings)(struct cam_hw_info *cpas_hw,
+		uint32_t selection_mask);
+	int (*print_poweron_settings)(struct cam_hw_info *cpas_hw);
+	int (*qchannel_handshake)(struct cam_hw_info *cpas_hw, bool power_on);
+};
+
+/**
+ * struct cam_cpas_reg : CPAS register info
+ *
+ * @enable: Whether this reg info need to be enabled
+ * @is_fuse_based : Whether this reg info need to be enabled based on fuse
+ * @access_type: Register access type
+ * @masked_value: Whether this register write/read is based on mask, shift
+ * @mask: Mask for this register value
+ * @shift: Shift for this register value
+ * @value: Register value
+ *
+ */
+struct cam_cpas_reg {
+	bool enable;
+	bool is_fuse_based;
+	enum cam_cpas_access_type access_type;
+	bool masked_value;
+	uint32_t offset;
+	uint32_t mask;
+	uint32_t shift;
+	uint32_t value;
+};
+
+/**
+ * struct cam_cpas_client : CPAS Client structure info
+ *
+ * @data: Client register params
+ * @registered: Whether client has registered with cpas
+ * @started: Whether client has streamed on
+ * @tree_node_valid: Indicates whether tree node has at least one valid node
+ * @ahb_level: Determined/Applied ahb level for the client
+ * @axi_vote: Determined/Applied axi vote for the client
+ * @axi_port: Client's parent axi port
+ * @tree_node: All granular path voting nodes for the client
+ *
+ */
+struct cam_cpas_client {
+	struct cam_cpas_register_params data;
+	bool registered;
+	bool started;
+	bool tree_node_valid;
+	enum cam_vote_level ahb_level;
+	struct cam_axi_vote axi_vote;
+	struct cam_cpas_axi_port *axi_port;
+	struct cam_cpas_tree_node *tree_node[CAM_CPAS_PATH_DATA_MAX]
+		[CAM_CPAS_TRANSACTION_MAX];
+};
+
+/**
+ * struct cam_cpas_bus_client : Bus client information
+ *
+ * @valid: Whether bus client is valid
+ * @name: Name of the bus client
+ * @lock: Mutex lock used while voting on this client
+ * @curr_vote_level: current voted index
+ * @common_data: Common data fields for bus client
+ * @soc_bus_client: Bus client private information
+ */
+struct cam_cpas_bus_client {
+	bool valid;
+	struct mutex lock;
+	unsigned int curr_vote_level;
+	struct cam_soc_bus_client_common_data common_data;
+	void *soc_bus_client;
+};
+
+/**
+ * struct cam_cpas_axi_port : AXI port information
+ *
+ * @axi_port_name: Name of this AXI port
+ * @bus_client: bus client info for this port
+ * @ib_bw_voting_needed: if this port can update ib bw dynamically
+ * @axi_port_node: Node representing AXI Port info in device tree
+ * @ab_bw: AB bw value for this port
+ * @ib_bw: IB bw value for this port
+ * @camnoc_bw: CAMNOC bw value for this port
+ * @additional_bw: Additional bandwidth to cover non-hw cpas clients
+ * @applied_ab_bw: applied ab bw for this port
+ * @applied_ib_bw: applied ib bw for this port
+ */
+struct cam_cpas_axi_port {
+	const char *axi_port_name;
+	struct cam_cpas_bus_client bus_client;
+	bool ib_bw_voting_needed;
+	struct device_node *axi_port_node;
+	uint64_t ab_bw;
+	uint64_t ib_bw;
+	uint64_t camnoc_bw;
+	uint64_t additional_bw;
+	uint64_t applied_ab_bw;
+	uint64_t applied_ib_bw;
+};
+
+/**
+ * struct cam_cpas_axi_port_debug_info : AXI port information
+ *
+ * @axi_port_name: Name of this AXI port
+ * @ab_bw: AB bw value for this port
+ * @ib_bw: IB bw value for this port
+ * @camnoc_bw: CAMNOC bw value for this port
+ * @applied_ab_bw: applied ab bw for this port
+ * @applied_ib_bw: applied ib bw for this port
+ */
+struct cam_cpas_axi_port_debug_info {
+	const char *axi_port_name;
+	uint64_t ab_bw;
+	uint64_t ib_bw;
+	uint64_t camnoc_bw;
+	uint64_t applied_ab_bw;
+	uint64_t applied_ib_bw;
+};
+
+/**
+ * struct cam_cpas_monitor : CPAS monitor array
+ *
+ * @timestamp: Timestamp at which this monitor entry is saved
+ * @axi_info: AXI port information
+ * @identifier_string: String passed by caller
+ * @identifier_value: Identifier value passed by caller
+ * @applied_camnoc_clk: Applied camnoc axi clock rate
+ * @applied_ahb_level: Applied camcc ahb level
+ * @fe_ddr: RPMH DDR BCM FE (front-end) status register value.
+ *          This indicates requested clock plan
+ * @be_ddr: RPMH DDR BCM BE (back-end) status register value.
+ *          This indicates actual current clock plan
+ * @fe_mnoc: RPMH MNOC BCM FE (front-end) status register value.
+ *           This indicates requested clock plan
+ * @be_mnoc: RPMH MNOC BCM BE (back-end) status register value.
+ *           This indicates actual current clock plan
+ * @camnoc_fill_level: Camnoc fill level register info
+ */
+struct cam_cpas_monitor {
+	struct timespec64                   timestamp;
+	char                                identifier_string[128];
+	int32_t                             identifier_value;
+	struct cam_cpas_axi_port_debug_info axi_info[CAM_CPAS_MAX_AXI_PORTS];
+	uint64_t                            applied_camnoc_clk;
+	unsigned int                        applied_ahb_level;
+	uint32_t                            fe_ddr;
+	uint32_t                            be_ddr;
+	uint32_t                            fe_mnoc;
+	uint32_t                            be_mnoc;
+	uint32_t                            camnoc_fill_level[5];
+};
+
+/**
+ * struct cam_cpas : CPAS core data structure info
+ *
+ * @hw_caps: CPAS hw capabilities
+ * @cpas_client: Array of pointers to CPAS clients info
+ * @client_mutex: Mutex for accessing client info
+ * @tree_lock: Mutex lock for accessing CPAS node tree
+ * @num_clients: Total number of clients that CPAS supports
+ * @num_axi_ports: Total number of axi ports found in device tree
+ * @num_camnoc_axi_ports: Total number of camnoc axi ports found in device tree
+ * @registered_clients: Number of Clients registered currently
+ * @streamon_clients: Number of Clients that are in start state currently
+ * @regbase_index: Register base indices for CPAS register base IDs
+ * @ahb_bus_client: AHB Bus client info
+ * @axi_port: AXI port info for a specific axi index
+ * @camnoc_axi_port: CAMNOC AXI port info for a specific camnoc axi index
+ * @internal_ops: CPAS HW internal ops
+ * @work_queue: Work queue handle
+ * @irq_count: atomic irq count
+ * @irq_count_wq: wait variable to ensure all irq's are handled
+ * @dentry: debugfs file entry
+ * @ahb_bus_scaling_disable: ahb scaling based on src clk corner for bus
+ * @applied_camnoc_axi_rate: applied camnoc axi clock rate
+ * @monitor_head: Monitor array head
+ * @monitor_entries: cpas monitor array
+ * @full_state_dump: Whether to enable full cpas state dump or not
+ */
+struct cam_cpas {
+	struct cam_cpas_hw_caps hw_caps;
+	struct cam_cpas_client *cpas_client[CAM_CPAS_MAX_CLIENTS];
+	struct mutex client_mutex[CAM_CPAS_MAX_CLIENTS];
+	struct mutex tree_lock;
+	uint32_t num_clients;
+	uint32_t num_axi_ports;
+	uint32_t num_camnoc_axi_ports;
+	uint32_t registered_clients;
+	uint32_t streamon_clients;
+	int32_t regbase_index[CAM_CPAS_REG_MAX];
+	struct cam_cpas_bus_client ahb_bus_client;
+	struct cam_cpas_axi_port axi_port[CAM_CPAS_MAX_AXI_PORTS];
+	struct cam_cpas_axi_port camnoc_axi_port[CAM_CPAS_MAX_AXI_PORTS];
+	struct cam_cpas_internal_ops internal_ops;
+	struct workqueue_struct *work_queue;
+	atomic_t irq_count;
+	wait_queue_head_t irq_count_wq;
+	struct dentry *dentry;
+	bool ahb_bus_scaling_disable;
+	uint64_t applied_camnoc_axi_rate;
+	atomic64_t  monitor_head;
+	struct cam_cpas_monitor monitor_entries[CAM_CPAS_MONITOR_MAX_ENTRIES];
+	bool full_state_dump;
+};
+
+int cam_camsstop_get_internal_ops(struct cam_cpas_internal_ops *internal_ops);
+int cam_cpastop_get_internal_ops(struct cam_cpas_internal_ops *internal_ops);
+
+int cam_cpas_util_reg_update(struct cam_hw_info *cpas_hw,
+	enum cam_cpas_reg_base reg_base, struct cam_cpas_reg *reg_info);
+int cam_cpas_util_reg_read(struct cam_hw_info *cpas_hw,
+	enum cam_cpas_reg_base reg_base, struct cam_cpas_reg *reg_info);
+
+int cam_cpas_util_client_cleanup(struct cam_hw_info *cpas_hw);
+
+#endif /* _CAM_CPAS_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_hw_intf.h
@@ -0,0 +1,157 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CPAS_HW_INTF_H_
+#define _CAM_CPAS_HW_INTF_H_
+
+#include <linux/platform_device.h>
+
+#include "cam_cpas_api.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_debug_util.h"
+
+/* Number of times to retry while polling */
+#define CAM_CPAS_POLL_RETRY_CNT 5
+/* Minimum usecs to sleep while polling */
+#define CAM_CPAS_POLL_MIN_USECS 200
+/* Maximum usecs to sleep while polling */
+#define CAM_CPAS_POLL_MAX_USECS 250
+/* Number of times to retry while polling */
+#define CAM_CPAS_POLL_QH_RETRY_CNT 50
+
+/**
+ * enum cam_cpas_hw_type - Enum for CPAS HW type
+ */
+enum cam_cpas_hw_type {
+	CAM_HW_CPASTOP,
+	CAM_HW_CAMSSTOP,
+};
+
+/**
+ * enum cam_cpas_hw_cmd_process - Enum for CPAS HW process command type
+ */
+enum cam_cpas_hw_cmd_process {
+	CAM_CPAS_HW_CMD_REGISTER_CLIENT,
+	CAM_CPAS_HW_CMD_UNREGISTER_CLIENT,
+	CAM_CPAS_HW_CMD_REG_WRITE,
+	CAM_CPAS_HW_CMD_REG_READ,
+	CAM_CPAS_HW_CMD_AHB_VOTE,
+	CAM_CPAS_HW_CMD_AXI_VOTE,
+	CAM_CPAS_HW_CMD_LOG_VOTE,
+	CAM_CPAS_HW_CMD_SELECT_QOS,
+	CAM_CPAS_HW_CMD_LOG_EVENT,
+	CAM_CPAS_HW_CMD_INVALID,
+};
+
+/**
+ * struct cam_cpas_hw_cmd_reg_read_write : CPAS cmd struct for reg read, write
+ *
+ * @client_handle: Client handle
+ * @reg_base: Register base type
+ * @offset: Register offset
+ * @value: Register value
+ * @mb: Whether to do operation with memory barrier
+ *
+ */
+struct cam_cpas_hw_cmd_reg_read_write {
+	uint32_t client_handle;
+	enum cam_cpas_reg_base reg_base;
+	uint32_t offset;
+	uint32_t value;
+	bool mb;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_ahb_vote : CPAS cmd struct for AHB vote
+ *
+ * @client_handle: Client handle
+ * @ahb_vote: AHB voting info
+ *
+ */
+struct cam_cpas_hw_cmd_ahb_vote {
+	uint32_t client_handle;
+	struct cam_ahb_vote *ahb_vote;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_axi_vote : CPAS cmd struct for AXI vote
+ *
+ * @client_handle: Client handle
+ * @axi_vote: axi bandwidth vote
+ *
+ */
+struct cam_cpas_hw_cmd_axi_vote {
+	uint32_t client_handle;
+	struct cam_axi_vote *axi_vote;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_start : CPAS cmd struct for start
+ *
+ * @client_handle: Client handle
+ *
+ */
+struct cam_cpas_hw_cmd_start {
+	uint32_t client_handle;
+	struct cam_ahb_vote *ahb_vote;
+	struct cam_axi_vote *axi_vote;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_stop : CPAS cmd struct for stop
+ *
+ * @client_handle: Client handle
+ *
+ */
+struct cam_cpas_hw_cmd_stop {
+	uint32_t client_handle;
+};
+
+/**
+ * struct cam_cpas_hw_cmd_notify_event : CPAS cmd struct for notify event
+ *
+ * @identifier_string: Identifier string passed by caller
+ * @identifier_value: Identifier value passed by caller
+ *
+ */
+struct cam_cpas_hw_cmd_notify_event {
+	const char *identifier_string;
+	int32_t identifier_value;
+};
+
+/**
+ * struct cam_cpas_hw_caps : CPAS HW capabilities
+ *
+ * @camera_family: Camera family type
+ * @camera_version: Camera version
+ * @cpas_version: CPAS version
+ * @camera_capability: Camera hw capabilities
+ * @fuse_info: Fuse information
+ *
+ */
+struct cam_cpas_hw_caps {
+	uint32_t camera_family;
+	struct cam_hw_version camera_version;
+	struct cam_hw_version cpas_version;
+	uint32_t camera_capability;
+	struct cam_cpas_fuse_info fuse_info;
+};
+
+int cam_cpas_hw_probe(struct platform_device *pdev,
+	struct cam_hw_intf **hw_intf);
+int cam_cpas_hw_remove(struct cam_hw_intf *cpas_hw_intf);
+
+/**
+ * @brief : API to register CPAS hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_cpas_dev_init_module(void);
+
+/**
+ * @brief : API to remove CPAS interface from platform framework.
+ */
+void cam_cpas_dev_exit_module(void);
+#endif /* _CAM_CPAS_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_intf.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_intf.c
@@ -0,0 +1,984 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_subdev.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_soc.h"
+#include "camera_main.h"
+#include "cam_cpas_api.h"
+
+#define CAM_CPAS_DEV_NAME    "cam-cpas"
+#define CAM_CPAS_INTF_INITIALIZED() (g_cpas_intf && g_cpas_intf->probe_done)
+
+/**
+ * struct cam_cpas_intf : CPAS interface
+ *
+ * @pdev: Platform device
+ * @subdev: Subdev info
+ * @hw_intf: CPAS HW interface
+ * @hw_caps: CPAS HW capabilities
+ * @intf_lock: CPAS interface mutex
+ * @open_cnt: CPAS subdev open count
+ * @probe_done: Whether CPAS prove completed
+ *
+ */
+struct cam_cpas_intf {
+	struct platform_device *pdev;
+	struct cam_subdev subdev;
+	struct cam_hw_intf *hw_intf;
+	struct cam_cpas_hw_caps hw_caps;
+	struct mutex intf_lock;
+	uint32_t open_cnt;
+	bool probe_done;
+};
+
+static struct cam_cpas_intf *g_cpas_intf;
+
+const char *cam_cpas_axi_util_path_type_to_string(
+	uint32_t path_data_type)
+{
+	switch (path_data_type) {
+	/* IFE Paths */
+	case CAM_AXI_PATH_DATA_IFE_LINEAR:
+		return "IFE_LINEAR";
+	case CAM_AXI_PATH_DATA_IFE_VID:
+		return "IFE_VID";
+	case CAM_AXI_PATH_DATA_IFE_DISP:
+		return "IFE_DISP";
+	case CAM_AXI_PATH_DATA_IFE_STATS:
+		return "IFE_STATS";
+	case CAM_AXI_PATH_DATA_IFE_RDI0:
+		return "IFE_RDI0";
+	case CAM_AXI_PATH_DATA_IFE_RDI1:
+		return "IFE_RDI1";
+	case CAM_AXI_PATH_DATA_IFE_RDI2:
+		return "IFE_RDI2";
+	case CAM_AXI_PATH_DATA_IFE_RDI3:
+		return "IFE_RDI3";
+	case CAM_AXI_PATH_DATA_IFE_PDAF:
+		return "IFE_PDAF";
+	case CAM_AXI_PATH_DATA_IFE_PIXEL_RAW:
+		return "IFE_PIXEL_RAW";
+
+	/* IPE Paths */
+	case CAM_AXI_PATH_DATA_IPE_RD_IN:
+		return "IPE_RD_IN";
+	case CAM_AXI_PATH_DATA_IPE_RD_REF:
+		return "IPE_RD_REF";
+	case CAM_AXI_PATH_DATA_IPE_WR_VID:
+		return "IPE_WR_VID";
+	case CAM_AXI_PATH_DATA_IPE_WR_DISP:
+		return "IPE_WR_DISP";
+	case CAM_AXI_PATH_DATA_IPE_WR_REF:
+		return "IPE_WR_REF";
+
+	/* OPE Paths */
+	case CAM_AXI_PATH_DATA_OPE_RD_IN:
+		return "OPE_RD_IN";
+	case CAM_AXI_PATH_DATA_OPE_RD_REF:
+		return "OPE_RD_REF";
+	case CAM_AXI_PATH_DATA_OPE_WR_VID:
+		return "OPE_WR_VID";
+	case CAM_AXI_PATH_DATA_OPE_WR_DISP:
+		return "OPE_WR_DISP";
+	case CAM_AXI_PATH_DATA_OPE_WR_REF:
+		return "OPE_WR_REF";
+
+	/* SFE Paths */
+	case CAM_AXI_PATH_DATA_SFE_NRDI:
+		return "SFE_NRDI";
+	case CAM_AXI_PATH_DATA_SFE_RDI0:
+		return "IFE_RDI0";
+	case CAM_AXI_PATH_DATA_SFE_RDI1:
+		return "IFE_RDI1";
+	case CAM_AXI_PATH_DATA_SFE_RDI2:
+		return "IFE_RDI2";
+	case CAM_AXI_PATH_DATA_SFE_RDI3:
+		return "IFE_RDI3";
+	case CAM_AXI_PATH_DATA_SFE_RDI4:
+		return "IFE_RDI4";
+	case CAM_AXI_PATH_DATA_SFE_STATS:
+		return "SFE_STATS";
+
+	/* Common Paths */
+	case CAM_AXI_PATH_DATA_ALL:
+		return "DATA_ALL";
+	default:
+		return "IFE_PATH_INVALID";
+	}
+}
+EXPORT_SYMBOL(cam_cpas_axi_util_path_type_to_string);
+
+const char *cam_cpas_axi_util_trans_type_to_string(
+	uint32_t transac_type)
+{
+	switch (transac_type) {
+	case CAM_AXI_TRANSACTION_READ:
+		return "TRANSAC_READ";
+	case CAM_AXI_TRANSACTION_WRITE:
+		return "TRANSAC_WRITE";
+	default:
+		return "TRANSAC_INVALID";
+	}
+}
+EXPORT_SYMBOL(cam_cpas_axi_util_trans_type_to_string);
+
+bool cam_cpas_is_feature_supported(uint32_t flag, uint32_t hw_map,
+	uint32_t *fuse_val)
+{
+	struct cam_hw_info *cpas_hw = NULL;
+	struct cam_cpas_private_soc *soc_private = NULL;
+	bool supported = true;
+	int32_t i;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return false;
+	}
+
+	cpas_hw = (struct cam_hw_info *) g_cpas_intf->hw_intf->hw_priv;
+	soc_private =
+		(struct cam_cpas_private_soc *)cpas_hw->soc_info.soc_private;
+
+	if (flag >= CAM_CPAS_FUSE_FEATURE_MAX) {
+		CAM_ERR(CAM_CPAS, "Unknown feature flag %x", flag);
+		return false;
+	}
+
+	for (i = 0; i < soc_private->num_feature_info; i++)
+		if (soc_private->feature_info[i].feature == flag)
+			break;
+
+	if (i == soc_private->num_feature_info)
+		goto end;
+
+	if (soc_private->feature_info[i].type == CAM_CPAS_FEATURE_TYPE_DISABLE
+		|| (soc_private->feature_info[i].type ==
+		CAM_CPAS_FEATURE_TYPE_ENABLE)) {
+		if ((soc_private->feature_info[i].hw_map & hw_map) == hw_map)
+			supported = soc_private->feature_info[i].enable;
+	} else {
+		if (!fuse_val) {
+			CAM_ERR(CAM_CPAS,
+				"Invalid arg fuse_val");
+		} else {
+			*fuse_val = soc_private->feature_info[i].value;
+		}
+	}
+
+end:
+	return supported;
+}
+EXPORT_SYMBOL(cam_cpas_is_feature_supported);
+
+int cam_cpas_get_cpas_hw_version(uint32_t *hw_version)
+{
+	struct cam_hw_info *cpas_hw = NULL;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!hw_version) {
+		CAM_ERR(CAM_CPAS, "invalid input %pK", hw_version);
+		return -EINVAL;
+	}
+
+	cpas_hw = (struct cam_hw_info  *) g_cpas_intf->hw_intf->hw_priv;
+
+	*hw_version = cpas_hw->soc_info.hw_version;
+
+	if (*hw_version == CAM_CPAS_TITAN_NONE) {
+		CAM_DBG(CAM_CPAS, "Didn't find a valid HW Version %d",
+			*hw_version);
+	}
+
+	return 0;
+}
+
+int cam_cpas_get_camnoc_fifo_fill_level_info(
+	uint32_t cpas_version,
+	uint32_t client_handle)
+{
+	int rc = 0;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_hw_get_camnoc_fill_level_info(cpas_version,
+		client_handle);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "Failed to dump fifo reg rc %d", rc);
+
+	return rc;
+}
+
+int cam_cpas_get_hw_info(uint32_t *camera_family,
+	struct cam_hw_version *camera_version,
+	struct cam_hw_version *cpas_version,
+	uint32_t *cam_caps,
+	struct cam_cpas_fuse_info *cam_fuse_info)
+{
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!camera_family || !camera_version || !cpas_version || !cam_caps) {
+		CAM_ERR(CAM_CPAS, "invalid input %pK %pK %pK %pK",
+			camera_family, camera_version, cpas_version, cam_caps);
+		return -EINVAL;
+	}
+
+	*camera_family  = g_cpas_intf->hw_caps.camera_family;
+	*camera_version = g_cpas_intf->hw_caps.camera_version;
+	*cpas_version   = g_cpas_intf->hw_caps.cpas_version;
+	*cam_caps       = g_cpas_intf->hw_caps.camera_capability;
+	if (cam_fuse_info)
+		*cam_fuse_info  = g_cpas_intf->hw_caps.fuse_info;
+
+	CAM_DBG(CAM_CPAS, "Family %d, version %d.%d cam_caps %d",
+		*camera_family, camera_version->major,
+		camera_version->minor, *cam_caps);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_cpas_get_hw_info);
+
+int cam_cpas_reg_write(uint32_t client_handle,
+	enum cam_cpas_reg_base reg_base, uint32_t offset, bool mb,
+	uint32_t value)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_reg_read_write cmd_reg_write;
+
+		cmd_reg_write.client_handle = client_handle;
+		cmd_reg_write.reg_base = reg_base;
+		cmd_reg_write.offset = offset;
+		cmd_reg_write.value = value;
+		cmd_reg_write.mb = mb;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_REG_WRITE, &cmd_reg_write,
+			sizeof(struct cam_cpas_hw_cmd_reg_read_write));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_reg_write);
+
+int cam_cpas_reg_read(uint32_t client_handle,
+	enum cam_cpas_reg_base reg_base, uint32_t offset, bool mb,
+	uint32_t *value)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!value) {
+		CAM_ERR(CAM_CPAS, "Invalid arg value");
+		return -EINVAL;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_reg_read_write cmd_reg_read;
+
+		cmd_reg_read.client_handle = client_handle;
+		cmd_reg_read.reg_base = reg_base;
+		cmd_reg_read.offset = offset;
+		cmd_reg_read.mb = mb;
+		cmd_reg_read.value = 0;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_REG_READ, &cmd_reg_read,
+			sizeof(struct cam_cpas_hw_cmd_reg_read_write));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+			return rc;
+		}
+
+		*value = cmd_reg_read.value;
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_reg_read);
+
+int cam_cpas_update_axi_vote(uint32_t client_handle,
+	struct cam_axi_vote *axi_vote)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!axi_vote) {
+		CAM_ERR(CAM_CPAS, "NULL axi vote");
+		return -EINVAL;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_axi_vote cmd_axi_vote;
+
+		cmd_axi_vote.client_handle = client_handle;
+		cmd_axi_vote.axi_vote = axi_vote;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_AXI_VOTE, &cmd_axi_vote,
+			sizeof(struct cam_cpas_hw_cmd_axi_vote));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_update_axi_vote);
+
+int cam_cpas_update_ahb_vote(uint32_t client_handle,
+	struct cam_ahb_vote *ahb_vote)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_ahb_vote cmd_ahb_vote;
+
+		cmd_ahb_vote.client_handle = client_handle;
+		cmd_ahb_vote.ahb_vote = ahb_vote;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_AHB_VOTE, &cmd_ahb_vote,
+			sizeof(struct cam_cpas_hw_cmd_ahb_vote));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_update_ahb_vote);
+
+int cam_cpas_stop(uint32_t client_handle)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.stop) {
+		struct cam_cpas_hw_cmd_stop cmd_hw_stop;
+
+		cmd_hw_stop.client_handle = client_handle;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.stop(
+			g_cpas_intf->hw_intf->hw_priv, &cmd_hw_stop,
+			sizeof(struct cam_cpas_hw_cmd_stop));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in stop, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid stop ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_stop);
+
+int cam_cpas_start(uint32_t client_handle,
+	struct cam_ahb_vote *ahb_vote, struct cam_axi_vote *axi_vote)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (!axi_vote) {
+		CAM_ERR(CAM_CPAS, "NULL axi vote");
+		return -EINVAL;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.start) {
+		struct cam_cpas_hw_cmd_start cmd_hw_start;
+
+		cmd_hw_start.client_handle = client_handle;
+		cmd_hw_start.ahb_vote = ahb_vote;
+		cmd_hw_start.axi_vote = axi_vote;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.start(
+			g_cpas_intf->hw_intf->hw_priv, &cmd_hw_start,
+			sizeof(struct cam_cpas_hw_cmd_start));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in start, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid start ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_start);
+
+void cam_cpas_log_votes(void)
+{
+	uint32_t dummy_args;
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_LOG_VOTE, &dummy_args,
+			sizeof(dummy_args));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+	}
+
+}
+EXPORT_SYMBOL(cam_cpas_log_votes);
+
+int cam_cpas_select_qos_settings(uint32_t selection_mask)
+{
+	int rc = 0;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -EBADR;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_SELECT_QOS, &selection_mask,
+			sizeof(selection_mask));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EBADR;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_select_qos_settings);
+
+int cam_cpas_notify_event(const char *identifier_string,
+	int32_t identifier_value)
+{
+	int rc = 0;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -EBADR;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		struct cam_cpas_hw_cmd_notify_event event = { 0 };
+
+		event.identifier_string = identifier_string;
+		event.identifier_value = identifier_value;
+
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_LOG_EVENT, &event,
+			sizeof(event));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EBADR;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_notify_event);
+
+int cam_cpas_unregister_client(uint32_t client_handle)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_UNREGISTER_CLIENT,
+			&client_handle, sizeof(uint32_t));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_unregister_client);
+
+int cam_cpas_register_client(
+	struct cam_cpas_register_params *register_params)
+{
+	int rc;
+
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return -ENODEV;
+	}
+
+	if (g_cpas_intf->hw_intf->hw_ops.process_cmd) {
+		rc = g_cpas_intf->hw_intf->hw_ops.process_cmd(
+			g_cpas_intf->hw_intf->hw_priv,
+			CAM_CPAS_HW_CMD_REGISTER_CLIENT, register_params,
+			sizeof(struct cam_cpas_register_params));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in process_cmd, rc=%d", rc);
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid process_cmd ops");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_cpas_register_client);
+
+static int cam_cpas_subdev_cmd(struct cam_cpas_intf *cpas_intf,
+	struct cam_control *cmd)
+{
+	int rc = 0;
+
+	if (!cmd) {
+		CAM_ERR(CAM_CPAS, "Invalid input cmd");
+		return -EINVAL;
+	}
+
+	switch (cmd->op_code) {
+	case CAM_QUERY_CAP: {
+		struct cam_cpas_query_cap query;
+
+		rc = copy_from_user(&query, u64_to_user_ptr(cmd->handle),
+			sizeof(query));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in copy from user, rc=%d",
+				rc);
+			break;
+		}
+
+		rc = cam_cpas_get_hw_info(&query.camera_family,
+			&query.camera_version, &query.cpas_version,
+			&query.reserved, NULL);
+		if (rc)
+			break;
+
+		rc = copy_to_user(u64_to_user_ptr(cmd->handle), &query,
+			sizeof(query));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in copy to user, rc=%d", rc);
+
+		break;
+	}
+	case CAM_QUERY_CAP_V2: {
+		struct cam_cpas_query_cap_v2 query;
+
+		rc = copy_from_user(&query, u64_to_user_ptr(cmd->handle),
+			sizeof(query));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in copy from user, rc=%d",
+				rc);
+			break;
+		}
+
+		rc = cam_cpas_get_hw_info(&query.camera_family,
+			&query.camera_version, &query.cpas_version,
+			&query.reserved,
+			&query.fuse_info);
+		if (rc)
+			break;
+
+		rc = copy_to_user(u64_to_user_ptr(cmd->handle), &query,
+			sizeof(query));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in copy to user, rc=%d", rc);
+
+		break;
+	}
+	case CAM_SD_SHUTDOWN:
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Unknown op code %d for CPAS", cmd->op_code);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_cpas_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_cpas_intf *cpas_intf = v4l2_get_subdevdata(sd);
+
+	if (!cpas_intf || !cpas_intf->probe_done) {
+		CAM_ERR(CAM_CPAS, "CPAS not initialized");
+		return -ENODEV;
+	}
+
+	mutex_lock(&cpas_intf->intf_lock);
+	cpas_intf->open_cnt++;
+	CAM_DBG(CAM_CPAS, "CPAS Subdev open count %d", cpas_intf->open_cnt);
+	mutex_unlock(&cpas_intf->intf_lock);
+
+	return 0;
+}
+
+static int __cam_cpas_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_cpas_intf *cpas_intf = v4l2_get_subdevdata(sd);
+
+	if (!cpas_intf || !cpas_intf->probe_done) {
+		CAM_ERR(CAM_CPAS, "CPAS not initialized");
+		return -ENODEV;
+	}
+
+	mutex_lock(&cpas_intf->intf_lock);
+	if (cpas_intf->open_cnt <= 0) {
+		CAM_WARN(CAM_CPAS, "device already closed, open_cnt: %d", cpas_intf->open_cnt);
+		mutex_unlock(&cpas_intf->intf_lock);
+		return 0;
+	}
+	cpas_intf->open_cnt--;
+	CAM_DBG(CAM_CPAS, "CPAS Subdev close count %d", cpas_intf->open_cnt);
+	mutex_unlock(&cpas_intf->intf_lock);
+
+	return 0;
+}
+
+static int cam_cpas_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_CPAS, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return __cam_cpas_subdev_close(sd, fh);
+}
+
+static long cam_cpas_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int32_t rc;
+	struct cam_cpas_intf *cpas_intf = v4l2_get_subdevdata(sd);
+
+	if (!cpas_intf || !cpas_intf->probe_done) {
+		CAM_ERR(CAM_CPAS, "CPAS not initialized");
+		return -ENODEV;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_cpas_subdev_cmd(cpas_intf, (struct cam_control *) arg);
+		break;
+	case CAM_SD_SHUTDOWN:
+		rc = __cam_cpas_subdev_close(sd, NULL);
+		break;
+	default:
+		CAM_ERR(CAM_CPAS,
+			"Invalid command %d for CPAS! from pid %d, comm %s",
+			cmd, current->tgid, current->comm);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_cpas_subdev_compat_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc;
+	struct cam_cpas_intf *cpas_intf = v4l2_get_subdevdata(sd);
+
+	if (!cpas_intf || !cpas_intf->probe_done) {
+		CAM_ERR(CAM_CPAS, "CPAS not initialized");
+		return -ENODEV;
+	}
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_CPAS, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_cpas_subdev_cmd(cpas_intf, &cmd_data);
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Invalid command %d for CPAS!", cmd);
+		rc = -EINVAL;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_CPAS,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+static struct v4l2_subdev_core_ops cpas_subdev_core_ops = {
+	.ioctl = cam_cpas_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_cpas_subdev_compat_ioctl,
+#endif
+};
+
+static const struct v4l2_subdev_ops cpas_subdev_ops = {
+	.core = &cpas_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cpas_subdev_intern_ops = {
+	.open = cam_cpas_subdev_open,
+	.close = cam_cpas_subdev_close,
+};
+
+static int cam_cpas_subdev_register(struct platform_device *pdev)
+{
+	int rc;
+	struct cam_subdev *subdev;
+
+	if (!g_cpas_intf)
+		return -EINVAL;
+
+	subdev = &g_cpas_intf->subdev;
+
+	subdev->name = CAM_CPAS_DEV_NAME;
+	subdev->pdev = pdev;
+	subdev->ops = &cpas_subdev_ops;
+	subdev->internal_ops = &cpas_subdev_intern_ops;
+	subdev->token = g_cpas_intf;
+	subdev->sd_flags =
+		V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+	subdev->ent_function = CAM_CPAS_DEVICE_TYPE;
+	subdev->close_seq_prior = CAM_SD_CLOSE_LOW_PRIORITY;
+
+	rc = cam_register_subdev(subdev);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed register subdev: %s!",
+			CAM_CPAS_DEV_NAME);
+		return rc;
+	}
+
+	platform_set_drvdata(g_cpas_intf->pdev, g_cpas_intf);
+	return rc;
+}
+
+static int cam_cpas_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_cpas_hw_caps *hw_caps;
+	struct cam_hw_intf *hw_intf;
+	int rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	if (g_cpas_intf) {
+		CAM_ERR(CAM_CPAS, "cpas component already binded");
+		return -EALREADY;
+	}
+
+	g_cpas_intf = kzalloc(sizeof(*g_cpas_intf), GFP_KERNEL);
+	if (!g_cpas_intf)
+		return -ENOMEM;
+
+	mutex_init(&g_cpas_intf->intf_lock);
+	g_cpas_intf->pdev = pdev;
+
+	rc = cam_cpas_hw_probe(pdev, &g_cpas_intf->hw_intf);
+	if (rc || (g_cpas_intf->hw_intf == NULL)) {
+		CAM_ERR(CAM_CPAS, "Failed in hw probe, rc=%d", rc);
+		goto error_destroy_mem;
+	}
+
+	hw_intf = g_cpas_intf->hw_intf;
+	hw_caps = &g_cpas_intf->hw_caps;
+
+	if (hw_intf->hw_ops.get_hw_caps) {
+		rc = hw_intf->hw_ops.get_hw_caps(hw_intf->hw_priv,
+			hw_caps, sizeof(struct cam_cpas_hw_caps));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in get_hw_caps, rc=%d", rc);
+			goto error_hw_remove;
+		}
+	} else {
+		CAM_ERR(CAM_CPAS, "Invalid get_hw_caps ops");
+		goto error_hw_remove;
+	}
+
+	rc = cam_cpas_subdev_register(pdev);
+	if (rc)
+		goto error_hw_remove;
+
+	g_cpas_intf->probe_done = true;
+	CAM_DBG(CAM_CPAS,
+		"Component bound successfully %d, %d.%d.%d, %d.%d.%d, 0x%x",
+		hw_caps->camera_family, hw_caps->camera_version.major,
+		hw_caps->camera_version.minor, hw_caps->camera_version.incr,
+		hw_caps->cpas_version.major, hw_caps->cpas_version.minor,
+		hw_caps->cpas_version.incr, hw_caps->camera_capability);
+
+	return rc;
+
+error_hw_remove:
+	cam_cpas_hw_remove(g_cpas_intf->hw_intf);
+error_destroy_mem:
+	mutex_destroy(&g_cpas_intf->intf_lock);
+	kfree(g_cpas_intf);
+	g_cpas_intf = NULL;
+	CAM_ERR(CAM_CPAS, "CPAS component bind failed");
+	return rc;
+}
+
+static void cam_cpas_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	if (!CAM_CPAS_INTF_INITIALIZED()) {
+		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
+		return;
+	}
+
+	mutex_lock(&g_cpas_intf->intf_lock);
+	g_cpas_intf->probe_done = false;
+	cam_unregister_subdev(&g_cpas_intf->subdev);
+	cam_cpas_hw_remove(g_cpas_intf->hw_intf);
+	mutex_unlock(&g_cpas_intf->intf_lock);
+	mutex_destroy(&g_cpas_intf->intf_lock);
+	kfree(g_cpas_intf);
+	g_cpas_intf = NULL;
+}
+
+const static struct component_ops cam_cpas_dev_component_ops = {
+	.bind = cam_cpas_dev_component_bind,
+	.unbind = cam_cpas_dev_component_unbind,
+};
+
+static int cam_cpas_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CPAS, "Adding CPAS INTF component");
+	rc = component_add(&pdev->dev, &cam_cpas_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_cpas_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_cpas_dev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_cpas_dt_match[] = {
+	{.compatible = "qcom,cam-cpas"},
+	{}
+};
+
+struct platform_driver cam_cpas_driver = {
+	.probe = cam_cpas_dev_probe,
+	.remove = cam_cpas_dev_remove,
+	.driver = {
+		.name = CAM_CPAS_DEV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_cpas_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_cpas_dev_init_module(void)
+{
+	return platform_driver_register(&cam_cpas_driver);
+}
+
+void cam_cpas_dev_exit_module(void)
+{
+	platform_driver_unregister(&cam_cpas_driver);
+}
+
+MODULE_DESCRIPTION("MSM CPAS driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_soc.c
@@ -0,0 +1,1040 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+
+#include "cam_cpas_api.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_hw.h"
+#include "cam_cpas_soc.h"
+
+static uint cpas_dump;
+module_param(cpas_dump, uint, 0644);
+
+void cam_cpas_dump_axi_vote_info(
+	const struct cam_cpas_client *cpas_client,
+	const char *identifier,
+	struct cam_axi_vote *axi_vote)
+{
+	int i;
+
+	if (!cpas_dump)
+		return;
+
+	if (!axi_vote || (axi_vote->num_paths >
+		CAM_CPAS_MAX_PATHS_PER_CLIENT)) {
+		CAM_ERR(CAM_PERF, "Invalid num_paths %d",
+			axi_vote ? axi_vote->num_paths : -1);
+		return;
+	}
+
+	for (i = 0; i < axi_vote->num_paths; i++) {
+		CAM_INFO(CAM_PERF,
+		"Client [%s][%d] : [%s], Path=[%d] [%d], camnoc[%llu], mnoc_ab[%llu], mnoc_ib[%llu]",
+		cpas_client->data.identifier, cpas_client->data.cell_index,
+		identifier,
+		axi_vote->axi_path[i].path_data_type,
+		axi_vote->axi_path[i].transac_type,
+		axi_vote->axi_path[i].camnoc_bw,
+		axi_vote->axi_path[i].mnoc_ab_bw,
+		axi_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+}
+
+void cam_cpas_util_debug_parse_data(
+	struct cam_cpas_private_soc *soc_private)
+{
+	int i, j;
+	struct cam_cpas_tree_node *curr_node = NULL;
+
+	if (!cpas_dump)
+		return;
+
+	for (i = 0; i < CAM_CPAS_MAX_TREE_NODES; i++) {
+		if (!soc_private->tree_node[i])
+			break;
+
+		curr_node = soc_private->tree_node[i];
+		CAM_INFO(CAM_CPAS,
+			"NODE cell_idx: %d, level: %d, name: %s, axi_port_idx: %d, merge_type: %d, parent_name: %s",
+			curr_node->cell_idx, curr_node->level_idx,
+			curr_node->node_name, curr_node->axi_port_idx,
+			curr_node->merge_type, curr_node->parent_node ?
+			curr_node->parent_node->node_name : "no parent");
+
+		if (curr_node->level_idx)
+			continue;
+
+		CAM_INFO(CAM_CPAS, "path_type: %d, transac_type: %s",
+			curr_node->path_data_type,
+			cam_cpas_axi_util_trans_type_to_string(
+			curr_node->path_trans_type));
+
+		for (j = 0; j < CAM_CPAS_PATH_DATA_MAX; j++) {
+			CAM_INFO(CAM_CPAS, "Constituent path: %d",
+				curr_node->constituent_paths[j] ? j : -1);
+		}
+	}
+
+	CAM_INFO(CAM_CPAS, "NUMBER OF NODES PARSED: %d", i);
+}
+
+int cam_cpas_node_tree_cleanup(struct cam_cpas *cpas_core,
+	struct cam_cpas_private_soc *soc_private)
+{
+	int i = 0;
+
+	for (i = 0; i < CAM_CPAS_MAX_TREE_NODES; i++) {
+		if (soc_private->tree_node[i]) {
+			of_node_put(soc_private->tree_node[i]->tree_dev_node);
+			kfree(soc_private->tree_node[i]);
+			soc_private->tree_node[i] = NULL;
+		}
+	}
+
+	for (i = 0; i < CAM_CPAS_MAX_TREE_LEVELS; i++) {
+		if (soc_private->level_node[i]) {
+			of_node_put(soc_private->level_node[i]);
+			soc_private->level_node[i] = NULL;
+		}
+	}
+
+	if (soc_private->camera_bus_node) {
+		of_node_put(soc_private->camera_bus_node);
+		soc_private->camera_bus_node = NULL;
+	}
+
+	mutex_destroy(&cpas_core->tree_lock);
+
+	return 0;
+}
+
+static int cam_cpas_util_path_type_to_idx(uint32_t *path_data_type)
+{
+	if (*path_data_type >= CAM_CPAS_PATH_DATA_CONSO_OFFSET)
+		*path_data_type = CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT +
+			(*path_data_type % CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT);
+	else
+		*path_data_type %= CAM_CPAS_MAX_GRAN_PATHS_PER_CLIENT;
+
+	if (*path_data_type >= CAM_CPAS_PATH_DATA_MAX) {
+		CAM_ERR(CAM_CPAS, "index Invalid: %d", *path_data_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_cpas_update_camnoc_node(struct cam_cpas *cpas_core,
+	struct device_node *curr_node,
+	struct cam_cpas_tree_node *cpas_node_ptr,
+	int *camnoc_idx)
+
+{
+	struct device_node *camnoc_node;
+	int rc;
+
+	camnoc_node = of_find_node_by_name(curr_node,
+			"qcom,axi-port-camnoc");
+	if (camnoc_node) {
+
+		if (*camnoc_idx >=
+			CAM_CPAS_MAX_AXI_PORTS) {
+			CAM_ERR(CAM_CPAS, "CAMNOC axi index overshoot %d",
+				*camnoc_idx);
+			return -EINVAL;
+		}
+
+		cpas_core->camnoc_axi_port[*camnoc_idx]
+			.axi_port_node = camnoc_node;
+		rc = of_property_read_string(
+			curr_node,
+			"qcom,axi-port-name",
+			&cpas_core->camnoc_axi_port[*camnoc_idx]
+			.axi_port_name);
+
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"fail to read camnoc-port-name rc=%d",
+				rc);
+			return rc;
+		}
+		cpas_node_ptr->camnoc_axi_port_idx = *camnoc_idx;
+		cpas_core->num_camnoc_axi_ports++;
+		(*camnoc_idx)++;
+	}
+	return 0;
+}
+
+static int cam_cpas_parse_node_tree(struct cam_cpas *cpas_core,
+	struct device_node *of_node, struct cam_cpas_private_soc *soc_private)
+{
+	struct device_node *camera_bus_node;
+	struct device_node *level_node;
+	struct device_node *curr_node;
+	struct device_node *parent_node;
+	struct device_node *mnoc_node;
+	int mnoc_idx = 0, camnoc_idx = 0;
+	uint32_t path_idx;
+	bool camnoc_max_needed = false;
+	struct cam_cpas_tree_node *curr_node_ptr = NULL;
+	struct cam_cpas_client *curr_client = NULL;
+	const char *client_name = NULL;
+	uint32_t client_idx = 0, cell_idx = 0, level_idx = 0;
+	int rc = 0, count = 0, i;
+
+	camera_bus_node = of_find_node_by_name(of_node, "camera-bus-nodes");
+	if (!camera_bus_node) {
+		CAM_ERR(CAM_CPAS, "Camera Bus node not found in cpas DT node");
+		return -EINVAL;
+	}
+
+	soc_private->camera_bus_node = camera_bus_node;
+
+	for_each_available_child_of_node(camera_bus_node, level_node) {
+		rc = of_property_read_u32(level_node, "level-index",
+			&level_idx);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Error reading level idx rc: %d", rc);
+			return rc;
+		}
+		if (level_idx >= CAM_CPAS_MAX_TREE_LEVELS) {
+			CAM_ERR(CAM_CPAS, "Invalid level idx: %d", level_idx);
+			return -EINVAL;
+		}
+
+		soc_private->level_node[level_idx] = level_node;
+		camnoc_max_needed = of_property_read_bool(level_node,
+			"camnoc-max-needed");
+
+		for_each_available_child_of_node(level_node, curr_node) {
+			curr_node_ptr =
+				kzalloc(sizeof(struct cam_cpas_tree_node),
+				GFP_KERNEL);
+			if (!curr_node_ptr)
+				return -ENOMEM;
+
+			curr_node_ptr->tree_dev_node = curr_node;
+			rc = of_property_read_u32(curr_node, "cell-index",
+				&curr_node_ptr->cell_idx);
+			if (rc) {
+				CAM_ERR(CAM_CPAS, "Node index not found");
+				return rc;
+			}
+
+			if (curr_node_ptr->cell_idx >=
+				CAM_CPAS_MAX_TREE_NODES) {
+				CAM_ERR(CAM_CPAS, "Invalid cell idx: %d",
+					cell_idx);
+				return -EINVAL;
+			}
+
+			soc_private->tree_node[curr_node_ptr->cell_idx] =
+				curr_node_ptr;
+			curr_node_ptr->level_idx = level_idx;
+
+			rc = of_property_read_string(curr_node, "node-name",
+				&curr_node_ptr->node_name);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"failed to read node-name rc=%d",
+					rc);
+				return rc;
+			}
+
+			curr_node_ptr->camnoc_max_needed = camnoc_max_needed;
+			rc = of_property_read_u32(curr_node, "bus-width-factor",
+				&curr_node_ptr->bus_width_factor);
+			if (rc)
+				curr_node_ptr->bus_width_factor = 1;
+
+			rc = of_property_read_u32(curr_node,
+				"traffic-merge-type",
+				&curr_node_ptr->merge_type);
+
+			curr_node_ptr->axi_port_idx = -1;
+			mnoc_node = of_find_node_by_name(curr_node,
+				"qcom,axi-port-mnoc");
+			if (mnoc_node) {
+				if (mnoc_idx >= CAM_CPAS_MAX_AXI_PORTS)
+					return -EINVAL;
+
+				cpas_core->axi_port[mnoc_idx].axi_port_node
+					= mnoc_node;
+				if (soc_private->bus_icc_based) {
+					struct of_phandle_args src_args = {0},
+						dst_args = {0};
+
+					rc = of_property_read_string(mnoc_node,
+						"interconnect-names",
+						&cpas_core->axi_port[mnoc_idx]
+						.bus_client.common_data.name);
+					if (rc) {
+						CAM_ERR(CAM_CPAS,
+							"failed to read interconnect-names rc=%d",
+							rc);
+						return rc;
+					}
+
+					rc = of_parse_phandle_with_args(
+						mnoc_node, "interconnects",
+						"#interconnect-cells", 0,
+						&src_args);
+					if (rc) {
+						CAM_ERR(CAM_CPAS,
+							"failed to read axi bus src info rc=%d",
+							rc);
+						return -EINVAL;
+					}
+
+					of_node_put(src_args.np);
+					if (src_args.args_count != 2) {
+						CAM_ERR(CAM_CPAS,
+							"Invalid number of axi src args: %d",
+							src_args.args_count);
+						return -EINVAL;
+					}
+
+					cpas_core->axi_port[mnoc_idx].bus_client
+					.common_data.src_id = src_args.args[0];
+
+					rc = of_parse_phandle_with_args(
+						mnoc_node, "interconnects",
+						"#interconnect-cells", 1,
+						&dst_args);
+					if (rc) {
+						CAM_ERR(CAM_CPAS,
+							"failed to read axi bus dst info rc=%d",
+							rc);
+						return -EINVAL;
+					}
+
+					of_node_put(dst_args.np);
+					if (dst_args.args_count != 2) {
+						CAM_ERR(CAM_CPAS,
+							"Invalid number of axi dst args: %d",
+							dst_args.args_count);
+						return -EINVAL;
+					}
+
+					cpas_core->axi_port[mnoc_idx].bus_client
+					.common_data.dst_id = dst_args.args[0];
+					cpas_core->axi_port[mnoc_idx].bus_client
+						.common_data.num_usecases = 2;
+				} else {
+					rc =  of_property_read_string(
+						curr_node, "qcom,axi-port-name",
+						&cpas_core->axi_port[mnoc_idx]
+						.bus_client.common_data.name);
+					if (rc) {
+						CAM_ERR(CAM_CPAS,
+							"failed to read mnoc-port-name rc=%d",
+							rc);
+						return rc;
+					}
+				}
+
+				cpas_core->axi_port[mnoc_idx].axi_port_name =
+					cpas_core->axi_port[mnoc_idx]
+						.bus_client.common_data.name;
+				cpas_core->axi_port
+					[mnoc_idx].ib_bw_voting_needed
+					= of_property_read_bool(curr_node,
+					"ib-bw-voting-needed");
+				curr_node_ptr->axi_port_idx = mnoc_idx;
+				mnoc_idx++;
+				cpas_core->num_axi_ports++;
+			}
+
+			if (!soc_private->control_camnoc_axi_clk) {
+				rc = cam_cpas_update_camnoc_node(
+					cpas_core, curr_node, curr_node_ptr,
+					&camnoc_idx);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+						"Parse Camnoc port fail");
+					return rc;
+				}
+			}
+
+			rc = of_property_read_string(curr_node,
+				"client-name", &client_name);
+			if (!rc) {
+				rc = of_property_read_u32(curr_node,
+				"traffic-data", &curr_node_ptr->path_data_type);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+						"Path Data type not found");
+					return rc;
+				}
+
+				rc = cam_cpas_util_path_type_to_idx(
+					&curr_node_ptr->path_data_type);
+				if (rc)
+					return rc;
+
+				rc = of_property_read_u32(curr_node,
+					"traffic-transaction-type",
+					&curr_node_ptr->path_trans_type);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+						"Path Transac type not found");
+					return rc;
+				}
+
+				if (curr_node_ptr->path_trans_type >=
+					CAM_CPAS_TRANSACTION_MAX) {
+					CAM_ERR(CAM_CPAS,
+						"Invalid transac type: %d",
+						curr_node_ptr->path_trans_type);
+					return -EINVAL;
+				}
+
+				count = of_property_count_u32_elems(curr_node,
+					"constituent-paths");
+				for (i = 0; i < count; i++) {
+					rc = of_property_read_u32_index(
+						curr_node, "constituent-paths",
+						i, &path_idx);
+					if (rc) {
+						CAM_ERR(CAM_CPAS,
+						"No constituent path at %d", i);
+						return rc;
+					}
+
+					rc = cam_cpas_util_path_type_to_idx(
+						&path_idx);
+					if (rc)
+						return rc;
+
+					curr_node_ptr->constituent_paths
+						[path_idx] = true;
+				}
+
+				rc = cam_common_util_get_string_index(
+					soc_private->client_name,
+					soc_private->num_clients,
+					client_name, &client_idx);
+				if (rc) {
+					CAM_ERR(CAM_CPAS,
+					"client name not found in list: %s",
+					client_name);
+					return rc;
+				}
+
+				if (client_idx >= CAM_CPAS_MAX_CLIENTS)
+					return -EINVAL;
+
+				curr_client =
+					cpas_core->cpas_client[client_idx];
+				curr_client->tree_node_valid = true;
+				curr_client->tree_node
+					[curr_node_ptr->path_data_type]
+					[curr_node_ptr->path_trans_type] =
+					curr_node_ptr;
+				CAM_DBG(CAM_CPAS,
+					"CLIENT NODE ADDED: %d %d %s",
+					curr_node_ptr->path_data_type,
+					curr_node_ptr->path_trans_type,
+					client_name);
+			}
+
+			parent_node = of_parse_phandle(curr_node,
+				"parent-node", 0);
+			if (parent_node) {
+				of_property_read_u32(parent_node, "cell-index",
+					&cell_idx);
+				curr_node_ptr->parent_node =
+					soc_private->tree_node[cell_idx];
+			} else {
+				CAM_DBG(CAM_CPAS,
+					"no parent node at this level");
+			}
+		}
+	}
+	mutex_init(&cpas_core->tree_lock);
+	cam_cpas_util_debug_parse_data(soc_private);
+
+	return 0;
+}
+
+static int cam_cpas_get_hw_features(struct platform_device *pdev,
+	struct cam_cpas_private_soc *soc_private)
+{
+	struct device_node *of_node;
+	void *fuse;
+	uint32_t fuse_addr, fuse_mask, fuse_shift;
+	uint32_t val = 0, fuse_val = 0, feature;
+	uint32_t enable_type = 0, hw_map = 0;
+	int count = 0, i = 0, j = 0,  num_feature = 0, num_fuse = 0;
+	struct cam_cpas_feature_info *feature_info;
+
+	of_node = pdev->dev.of_node;
+	count = of_property_count_u32_elems(of_node, "cam_hw_fuse");
+
+	CAM_DBG(CAM_CPAS, "fuse info elements count %d", count);
+
+	if (count <= 0) {
+		CAM_INFO(CAM_CPAS, "No or invalid fuse entries count: %d",
+			count);
+		goto end;
+	} else if (count%5 != 0) {
+		CAM_INFO(CAM_CPAS, "fuse entries should be multiple of 5 %d",
+			count);
+		goto end;
+	}
+
+	for (i = 0; (i + 5) <= count; i = i + 5) {
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i,
+				&feature);
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i + 1,
+				&fuse_addr);
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i + 2,
+				&fuse_mask);
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i + 3,
+				&enable_type);
+		of_property_read_u32_index(of_node, "cam_hw_fuse", i + 4,
+				&hw_map);
+		val = ffs(fuse_mask);
+		if (val == 0) {
+			CAM_ERR(CAM_CPAS, "fuse_mask not valid 0x%x",
+				fuse_mask);
+			fuse_shift = 0;
+		} else {
+			fuse_shift = val - 1;
+		}
+		CAM_INFO(CAM_CPAS,
+			"feature 0x%x addr 0x%x, mask 0x%x, shift 0x%x type 0x%x hw_map 0x%x",
+			feature, fuse_addr, fuse_mask, fuse_shift, enable_type,
+			hw_map);
+
+		fuse = ioremap(fuse_addr, 4);
+		if (fuse) {
+			fuse_val = cam_io_r(fuse);
+			for (j = 0; (j < num_fuse) && (j < CAM_CPAS_FUSES_MAX);
+				j++) {
+				if (soc_private->fuse_info.fuse_val[j].fuse_id
+					== fuse_addr)
+					break;
+			}
+			if (j >= CAM_CPAS_FUSES_MAX) {
+				CAM_ERR(CAM_CPAS,
+					"fuse_info array overflow! %d", j);
+				goto end;
+			}
+			if (j == num_fuse) {
+				soc_private->fuse_info.fuse_val[j].fuse_id =
+					fuse_addr;
+				soc_private->fuse_info.fuse_val[j].fuse_val =
+					fuse_val;
+				CAM_INFO(CAM_CPAS,
+					"fuse_addr 0x%x, fuse_val %x",
+					fuse_addr, fuse_val);
+				num_fuse++;
+			}
+		} else {
+			/* if fuse ioremap is failed, disable the feature */
+			CAM_ERR(CAM_CPAS,
+				"fuse register io remap failed fuse_addr:0x%x feature0x%x ",
+				fuse_addr, feature);
+
+			if (enable_type == CAM_CPAS_FEATURE_TYPE_ENABLE ||
+				enable_type == CAM_CPAS_FEATURE_TYPE_DISABLE)
+				fuse_val = (enable_type) ? ~fuse_mask :
+					fuse_mask;
+			else
+				fuse_val = 0;
+		}
+
+		if (num_feature >= CAM_CPAS_MAX_FUSE_FEATURE) {
+			CAM_ERR(CAM_CPAS, "feature_info array overflow %d",
+				num_feature);
+			goto end;
+		}
+
+		soc_private->feature_info[num_feature].feature =
+			feature;
+		soc_private->feature_info[num_feature].hw_map = hw_map;
+		soc_private->feature_info[num_feature].type = enable_type;
+		feature_info = &soc_private->feature_info[num_feature];
+
+		if (enable_type != CAM_CPAS_FEATURE_TYPE_VALUE) {
+			if (enable_type == CAM_CPAS_FEATURE_TYPE_ENABLE) {
+				/*
+				 * fuse is for enable feature
+				 * if fust bit is set means feature is enabled
+				 * or HW is enabled
+				 */
+				if (fuse_val & fuse_mask)
+					feature_info->enable = true;
+				else
+					feature_info->enable = false;
+			} else if (enable_type ==
+				CAM_CPAS_FEATURE_TYPE_DISABLE){
+				/*
+				 * fuse is for disable feature
+				 * if fust bit is set means feature is disabled
+				 * or HW is disabled
+				 */
+				if (fuse_val & fuse_mask)
+					feature_info->enable = false;
+				else
+					feature_info->enable = true;
+			} else {
+				CAM_ERR(CAM_CPAS,
+					"Feature type not valid, type: %d",
+					enable_type);
+				goto end;
+			}
+			CAM_INFO(CAM_CPAS,
+				"feature 0x%x enable=%d hw_map=0x%x",
+				feature_info->feature, feature_info->enable,
+				feature_info->hw_map);
+		} else {
+			feature_info->value =
+				(fuse_val & fuse_mask) >> fuse_shift;
+			CAM_INFO(CAM_CPAS,
+				"feature 0x%x value=0x%x hw_map=0x%x",
+				feature_info->feature, feature_info->value,
+				feature_info->hw_map);
+		}
+		num_feature++;
+		iounmap(fuse);
+	}
+
+end:
+	soc_private->fuse_info.num_fuses = num_fuse;
+	soc_private->num_feature_info = num_feature;
+	return 0;
+}
+
+static int cam_cpas_get_custom_dt_info(struct cam_hw_info *cpas_hw,
+	struct platform_device *pdev, struct cam_cpas_private_soc *soc_private)
+{
+	struct device_node *of_node;
+	struct of_phandle_args src_args = {0}, dst_args = {0};
+	int count = 0, i = 0, rc = 0, num_bw_values = 0, num_levels = 0;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+
+	if (!soc_private || !pdev) {
+		CAM_ERR(CAM_CPAS, "invalid input arg %pK %pK",
+			soc_private, pdev);
+		return -EINVAL;
+	}
+
+	of_node = pdev->dev.of_node;
+
+	rc = of_property_read_string(of_node, "arch-compat",
+		&soc_private->arch_compat);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "device %s failed to read arch-compat",
+			pdev->name);
+		return rc;
+	}
+
+	cam_cpas_get_hw_features(pdev, soc_private);
+
+	soc_private->camnoc_axi_min_ib_bw = 0;
+	rc = of_property_read_u64(of_node,
+		"camnoc-axi-min-ib-bw",
+		&soc_private->camnoc_axi_min_ib_bw);
+	if (rc == -EOVERFLOW) {
+		soc_private->camnoc_axi_min_ib_bw = 0;
+		rc = of_property_read_u32(of_node,
+			"camnoc-axi-min-ib-bw",
+			(u32 *)&soc_private->camnoc_axi_min_ib_bw);
+	}
+
+	if (rc) {
+		CAM_DBG(CAM_CPAS,
+			"failed to read camnoc-axi-min-ib-bw rc:%d", rc);
+		soc_private->camnoc_axi_min_ib_bw =
+			CAM_CPAS_AXI_MIN_CAMNOC_IB_BW;
+	}
+
+	CAM_DBG(CAM_CPAS, "camnoc-axi-min-ib-bw = %llu",
+		soc_private->camnoc_axi_min_ib_bw);
+
+	soc_private->client_id_based = of_property_read_bool(of_node,
+		"client-id-based");
+	soc_private->bus_icc_based = of_property_read_bool(of_node,
+		"interconnects");
+
+	if (soc_private->bus_icc_based) {
+		rc = of_property_read_string(of_node, "interconnect-names",
+			&cpas_core->ahb_bus_client.common_data.name);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"device %s failed to read interconnect-names",
+				pdev->name);
+			return rc;
+		}
+
+		rc = of_parse_phandle_with_args(of_node, "interconnects",
+			"#interconnect-cells", 0, &src_args);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"device %s failed to read ahb bus src info",
+				pdev->name);
+			return rc;
+		}
+
+		of_node_put(src_args.np);
+		if (src_args.args_count != 2) {
+			CAM_ERR(CAM_CPAS,
+				"Invalid number of ahb src args: %d",
+				src_args.args_count);
+			return -EINVAL;
+		}
+
+		cpas_core->ahb_bus_client.common_data.src_id = src_args.args[0];
+
+		rc = of_parse_phandle_with_args(of_node, "interconnects",
+			"#interconnect-cells", 1, &dst_args);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"device %s failed to read ahb bus dst info",
+				pdev->name);
+			return rc;
+		}
+
+		of_node_put(dst_args.np);
+		if (dst_args.args_count != 2) {
+			CAM_ERR(CAM_CPAS,
+				"Invalid number of ahb dst args: %d",
+				dst_args.args_count);
+			return -EINVAL;
+		}
+
+		cpas_core->ahb_bus_client.common_data.dst_id = dst_args.args[0];
+
+		rc = of_property_read_u32(of_node, "cam-ahb-num-cases",
+			&cpas_core->ahb_bus_client.common_data.num_usecases);
+		if (rc) {
+			CAM_ERR(CAM_CPAS,
+				"device %s failed to read ahb num usecases",
+				pdev->name);
+			return rc;
+		}
+
+		if (cpas_core->ahb_bus_client.common_data.num_usecases >
+			CAM_SOC_BUS_MAX_NUM_USECASES) {
+			CAM_ERR(CAM_UTIL, "Invalid number of usecases: %d",
+				cpas_core->ahb_bus_client.common_data
+				.num_usecases);
+			return -EINVAL;
+		}
+
+		num_bw_values = of_property_count_u32_elems(of_node,
+			"cam-ahb-bw-KBps");
+		if (num_bw_values <= 0) {
+			CAM_ERR(CAM_UTIL, "Error counting ahb bw values");
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_CPAS, "AHB: num bw values %d", num_bw_values);
+		num_levels = (num_bw_values / 2);
+
+		if (num_levels !=
+			cpas_core->ahb_bus_client.common_data.num_usecases) {
+			CAM_ERR(CAM_UTIL, "Invalid number of levels: %d",
+				num_bw_values/2);
+			return -EINVAL;
+		}
+
+		for (i = 0; i < num_levels; i++) {
+			rc = of_property_read_u32_index(of_node,
+				"cam-ahb-bw-KBps",
+				(i * 2),
+				(uint32_t *) &cpas_core->ahb_bus_client
+				.common_data.bw_pair[i].ab);
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Error reading ab bw value, rc=%d",
+					rc);
+				return rc;
+			}
+
+			rc = of_property_read_u32_index(of_node,
+				"cam-ahb-bw-KBps",
+				((i * 2) + 1),
+				(uint32_t *) &cpas_core->ahb_bus_client
+				.common_data.bw_pair[i].ib);
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Error reading ib bw value, rc=%d",
+					rc);
+				return rc;
+			}
+
+			CAM_DBG(CAM_CPAS,
+				"AHB: Level: %d, ab_value %llu, ib_value: %llu",
+				i, cpas_core->ahb_bus_client.common_data
+				.bw_pair[i].ab, cpas_core->ahb_bus_client
+				.common_data.bw_pair[i].ib);
+		}
+	}
+
+	count = of_property_count_strings(of_node, "client-names");
+	if (count <= 0) {
+		CAM_ERR(CAM_CPAS, "no client-names found");
+		count = 0;
+		return -EINVAL;
+	} else if (count > CAM_CPAS_MAX_CLIENTS) {
+		CAM_ERR(CAM_CPAS, "Number of clients %d greater than max %d",
+			count, CAM_CPAS_MAX_CLIENTS);
+		count = 0;
+		return -EINVAL;
+	}
+
+	soc_private->num_clients = count;
+	CAM_DBG(CAM_CPAS,
+		"arch-compat=%s, client_id_based = %d, num_clients=%d",
+		soc_private->arch_compat, soc_private->client_id_based,
+		soc_private->num_clients);
+
+	for (i = 0; i < soc_private->num_clients; i++) {
+		rc = of_property_read_string_index(of_node,
+			"client-names", i, &soc_private->client_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "no client-name at cnt=%d", i);
+			return -EINVAL;
+		}
+
+		cpas_core->cpas_client[i] =
+			kzalloc(sizeof(struct cam_cpas_client), GFP_KERNEL);
+		if (!cpas_core->cpas_client[i]) {
+			rc = -ENOMEM;
+			goto cleanup_clients;
+		}
+
+		CAM_DBG(CAM_CPAS, "Client[%d] : %s", i,
+			soc_private->client_name[i]);
+	}
+
+	soc_private->control_camnoc_axi_clk = of_property_read_bool(of_node,
+		"control-camnoc-axi-clk");
+
+	if (soc_private->control_camnoc_axi_clk == true) {
+		rc = of_property_read_u32(of_node, "camnoc-bus-width",
+			&soc_private->camnoc_bus_width);
+		if (rc || (soc_private->camnoc_bus_width == 0)) {
+			CAM_ERR(CAM_CPAS, "Bus width not found rc=%d, %d",
+				rc, soc_private->camnoc_bus_width);
+			goto cleanup_clients;
+		}
+
+		rc = of_property_read_u32(of_node,
+			"camnoc-axi-clk-bw-margin-perc",
+			&soc_private->camnoc_axi_clk_bw_margin);
+
+		if (rc) {
+			/* this is not fatal, overwrite rc */
+			rc = 0;
+			soc_private->camnoc_axi_clk_bw_margin = 0;
+		}
+	}
+
+	CAM_DBG(CAM_CPAS,
+		"control_camnoc_axi_clk=%d, width=%d, margin=%d",
+		soc_private->control_camnoc_axi_clk,
+		soc_private->camnoc_bus_width,
+		soc_private->camnoc_axi_clk_bw_margin);
+
+	count = of_property_count_u32_elems(of_node, "vdd-corners");
+	if ((count > 0) && (count <= CAM_REGULATOR_LEVEL_MAX) &&
+		(of_property_count_strings(of_node, "vdd-corner-ahb-mapping") ==
+		count)) {
+		const char *ahb_string;
+
+		for (i = 0; i < count; i++) {
+			rc = of_property_read_u32_index(of_node, "vdd-corners",
+				i, &soc_private->vdd_ahb[i].vdd_corner);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"vdd-corners failed at index=%d", i);
+				rc = -ENODEV;
+				goto cleanup_clients;
+			}
+
+			rc = of_property_read_string_index(of_node,
+				"vdd-corner-ahb-mapping", i, &ahb_string);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"no ahb-mapping at index=%d", i);
+				rc = -ENODEV;
+				goto cleanup_clients;
+			}
+
+			rc = cam_soc_util_get_level_from_string(ahb_string,
+				&soc_private->vdd_ahb[i].ahb_level);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"invalid ahb-string at index=%d", i);
+				rc = -EINVAL;
+				goto cleanup_clients;
+			}
+
+			CAM_DBG(CAM_CPAS,
+				"Vdd-AHB mapping [%d] : [%d] [%s] [%d]", i,
+				soc_private->vdd_ahb[i].vdd_corner,
+				ahb_string, soc_private->vdd_ahb[i].ahb_level);
+		}
+
+		soc_private->num_vdd_ahb_mapping = count;
+	}
+
+	rc = cam_cpas_parse_node_tree(cpas_core, of_node, soc_private);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Node tree parsing failed rc: %d", rc);
+		goto cleanup_tree;
+	}
+
+	/* Optional rpmh bcm info */
+	count = of_property_count_u32_elems(of_node, "rpmh-bcm-info");
+	/*
+	 * We expect count=5(CAM_RPMH_BCM_INFO_MAX) if valid rpmh bcm info
+	 * is available.
+	 * 0 - Total number of BCMs
+	 * 1 - First BCM FE (front-end) register offset.
+	 *     These represent requested clk plan by sw
+	 * 2 - First BCM BE (back-end) register offset.
+	 *     These represent actual clk plan at hw
+	 * 3 - DDR BCM index
+	 * 4 - MMNOC BCM index
+	 */
+	if (count == CAM_RPMH_BCM_INFO_MAX) {
+		for (i = 0; i < count; i++) {
+			rc = of_property_read_u32_index(of_node,
+				"rpmh-bcm-info", i, &soc_private->rpmh_info[i]);
+			if (rc) {
+				CAM_ERR(CAM_CPAS,
+					"Incorrect rpmh info at %d, count=%d",
+					i, count);
+				break;
+			}
+			CAM_DBG(CAM_CPAS, "RPMH BCM Info [%d]=0x%x",
+				i, soc_private->rpmh_info[i]);
+		}
+
+		if (rc)
+			soc_private->rpmh_info[CAM_RPMH_NUMBER_OF_BCMS] = 0;
+	} else {
+		CAM_DBG(CAM_CPAS, "RPMH BCM info not available in DT, count=%d",
+			count);
+	}
+	return 0;
+
+cleanup_tree:
+	cam_cpas_node_tree_cleanup(cpas_core, soc_private);
+cleanup_clients:
+	cam_cpas_util_client_cleanup(cpas_hw);
+	return rc;
+}
+
+int cam_cpas_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, struct cam_hw_info *cpas_hw)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in get_dt_properties, rc=%d", rc);
+		return rc;
+	}
+
+	if ((soc_info->irq_num > 0) && !irq_handler) {
+		CAM_ERR(CAM_CPAS, "Invalid IRQ handler");
+		return -EINVAL;
+	}
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler,
+		cpas_hw);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in request_platform_resource, rc=%d",
+			rc);
+		return rc;
+	}
+
+	soc_info->soc_private = kzalloc(sizeof(struct cam_cpas_private_soc),
+		GFP_KERNEL);
+	if (!soc_info->soc_private) {
+		rc = -ENOMEM;
+		goto release_res;
+	}
+
+	rc = cam_cpas_get_custom_dt_info(cpas_hw, soc_info->pdev,
+		soc_info->soc_private);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "failed in get_custom_info, rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	return rc;
+
+free_soc_private:
+	kfree(soc_info->soc_private);
+release_res:
+	cam_soc_util_release_platform_resource(soc_info);
+	return rc;
+}
+
+int cam_cpas_soc_deinit_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "release platform failed, rc=%d", rc);
+
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+
+	return rc;
+}
+
+int cam_cpas_soc_enable_resources(struct cam_hw_soc_info *soc_info,
+	enum cam_vote_level default_level)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		default_level, true);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "enable platform resource failed, rc=%d", rc);
+
+	return rc;
+}
+
+int cam_cpas_soc_disable_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clocks, bool disable_irq)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info,
+		disable_clocks, disable_irq);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "disable platform failed, rc=%d", rc);
+
+	return rc;
+}
+
+int cam_cpas_soc_disable_irq(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_irq_disable(soc_info);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "disable irq failed, rc=%d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cam_cpas_soc.h
@@ -0,0 +1,152 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CPAS_SOC_H_
+#define _CAM_CPAS_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_cpas_hw.h"
+
+#define CAM_REGULATOR_LEVEL_MAX 16
+#define CAM_CPAS_MAX_TREE_NODES 50
+#define CAM_CPAS_MAX_FUSE_FEATURE 10
+
+/**
+ * struct cam_cpas_vdd_ahb_mapping : Voltage to ahb level mapping
+ *
+ * @vdd_corner : Voltage corner value
+ * @ahb_level : AHB vote level corresponds to this vdd_corner
+ *
+ */
+struct cam_cpas_vdd_ahb_mapping {
+	unsigned int vdd_corner;
+	enum cam_vote_level ahb_level;
+};
+
+/**
+ * struct cpas_tree_node: Generic cpas tree node for BW voting
+ *
+ * @cell_idx: Index to identify node from device tree and its parent
+ * @level_idx: Index to identify at what level the node is present
+ * @axi_port_idx: Index to identify which axi port to vote the consolidated bw
+ * @camnoc_axi_port_idx: Index to find which axi port to vote consolidated bw
+ * @path_data_type: Traffic type info from device tree (ife-vid, ife-disp etc)
+ * @path_trans_type: Transaction type info from device tree (rd, wr)
+ * @merge_type: Traffic merge type (calculation info) from device tree
+ * @bus_width_factor: Factor for accounting bus width in CAMNOC bw calculation
+ * @camnoc_bw: CAMNOC bw value at current node
+ * @mnoc_ab_bw: MNOC AB bw value at current node
+ * @mnoc_ib_bw: MNOC IB bw value at current node
+ * @ddr_ab_bw: DDR AB bw value at current node
+ * @ddr_ib_bw: DDR IB bw value at current node
+ * @camnoc_max_needed: If node is needed for CAMNOC BW calculation then true
+ * @constituent_paths: Constituent paths presence info from device tree
+ *     Ex: For CAM_CPAS_PATH_DATA_IFE_UBWC_STATS, index corresponding to
+ *     CAM_CPAS_PATH_DATA_IFE_VID, CAM_CPAS_PATH_DATA_IFE_DISP and
+ *     CAM_CPAS_PATH_DATA_IFE_STATS
+ * @tree_dev_node: Device node from devicetree for current tree node
+ * @parent_node: Pointer to node one or more level above the current level
+ *     (starting from end node of cpas client)
+ *
+ */
+struct cam_cpas_tree_node {
+	uint32_t cell_idx;
+	uint32_t level_idx;
+	int axi_port_idx;
+	int camnoc_axi_port_idx;
+	const char *node_name;
+	uint32_t path_data_type;
+	uint32_t path_trans_type;
+	uint32_t merge_type;
+	uint32_t bus_width_factor;
+	uint64_t camnoc_bw;
+	uint64_t mnoc_ab_bw;
+	uint64_t mnoc_ib_bw;
+	uint64_t ddr_ab_bw;
+	uint64_t ddr_ib_bw;
+	bool camnoc_max_needed;
+	bool constituent_paths[CAM_CPAS_PATH_DATA_MAX];
+	struct device_node *tree_dev_node;
+	struct cam_cpas_tree_node *parent_node;
+};
+
+/**
+ * struct cam_cpas_feature_info : CPAS fuse feature info
+ * @feature: Identifier for feature
+ * @type: Type of feature
+ * @value: Fuse value
+ * @enable: Feature enable or disable
+ * @hw_map: Each bit position indicates if the hw_id for the feature
+ */
+
+struct cam_cpas_feature_info {
+	uint32_t feature;
+	uint32_t type;
+	uint32_t value;
+	bool enable;
+	uint32_t hw_map;
+};
+
+/**
+ * struct cam_cpas_private_soc : CPAS private DT info
+ *
+ * @arch_compat: ARCH compatible string
+ * @client_id_based: Whether clients are id based
+ * @bus_icc_based: Interconnect based bus interaction
+ * @num_clients: Number of clients supported
+ * @client_name: Client names
+ * @tree_node: Array of pointers to all tree nodes required to calculate
+ *      axi bw, arranged with help of cell index in device tree
+ * @camera_bus_node: Device tree node from cpas node
+ * @level_node: Device tree node for each level in camera_bus_node
+ * @num_vdd_ahb_mapping : Number of vdd to ahb level mapping supported
+ * @vdd_ahb : AHB level mapping info for the supported vdd levels
+ * @control_camnoc_axi_clk : Whether CPAS driver need to set camnoc axi clk freq
+ * @camnoc_bus_width : CAMNOC Bus width
+ * @camnoc_axi_clk_bw_margin : BW Margin in percentage to add while calculating
+ *      camnoc axi clock
+ * @camnoc_axi_min_ib_bw: Min camnoc BW which varies based on target
+ * @fuse_info: fuse information
+ * @rpmh_info: RPMH BCM info
+ * @num_feature_info: number of feature_info entries
+ * @feature_info: Structure for storing feature information
+ */
+struct cam_cpas_private_soc {
+	const char *arch_compat;
+	bool client_id_based;
+	bool bus_icc_based;
+	uint32_t num_clients;
+	const char *client_name[CAM_CPAS_MAX_CLIENTS];
+	struct cam_cpas_tree_node *tree_node[CAM_CPAS_MAX_TREE_NODES];
+	struct device_node *camera_bus_node;
+	struct device_node *level_node[CAM_CPAS_MAX_TREE_LEVELS];
+	uint32_t num_vdd_ahb_mapping;
+	struct cam_cpas_vdd_ahb_mapping vdd_ahb[CAM_REGULATOR_LEVEL_MAX];
+	bool control_camnoc_axi_clk;
+	uint32_t camnoc_bus_width;
+	uint32_t camnoc_axi_clk_bw_margin;
+	uint64_t camnoc_axi_min_ib_bw;
+	struct cam_cpas_fuse_info fuse_info;
+	uint32_t rpmh_info[CAM_RPMH_BCM_INFO_MAX];
+	uint32_t num_feature_info;
+	struct cam_cpas_feature_info  feature_info[CAM_CPAS_MAX_FUSE_FEATURE];
+};
+
+void cam_cpas_util_debug_parse_data(struct cam_cpas_private_soc *soc_private);
+void cam_cpas_dump_axi_vote_info(
+	const struct cam_cpas_client *cpas_client,
+	const char *identifier,
+	struct cam_axi_vote *axi_vote);
+int cam_cpas_node_tree_cleanup(struct cam_cpas *cpas_core,
+	struct cam_cpas_private_soc *soc_private);
+int cam_cpas_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t vfe_irq_handler, struct cam_hw_info *cpas_hw);
+int cam_cpas_soc_deinit_resources(struct cam_hw_soc_info *soc_info);
+int cam_cpas_soc_enable_resources(struct cam_hw_soc_info *soc_info,
+	enum cam_vote_level default_level);
+int cam_cpas_soc_disable_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clocks, bool disable_irq);
+int cam_cpas_soc_disable_irq(struct cam_hw_soc_info *soc_info);
+#endif /* _CAM_CPAS_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/camss_top/cam_camsstop_hw.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/camss_top/cam_camsstop_hw.c
@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2018, 2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_hw.h"
+#include "cam_cpas_soc.h"
+
+static int cam_camsstop_get_hw_info(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_hw_caps *hw_caps)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int32_t reg_indx = cpas_core->regbase_index[CAM_CPAS_REG_CAMSS];
+	uint32_t reg_value;
+
+	if (reg_indx == -1)
+		return -EINVAL;
+
+	hw_caps->camera_family = CAM_FAMILY_CAMERA_SS;
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base + 0x0);
+	hw_caps->camera_version.major =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1c);
+	hw_caps->camera_version.minor =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->camera_version.incr =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	CAM_DBG(CAM_FD, "Family %d, version %d.%d.%d",
+		hw_caps->camera_family, hw_caps->camera_version.major,
+		hw_caps->camera_version.minor, hw_caps->camera_version.incr);
+
+	return 0;
+}
+
+static int cam_camsstop_setup_regbase_indices(struct cam_hw_soc_info *soc_info,
+	int32_t regbase_index[], int32_t num_reg_map)
+{
+	uint32_t index;
+	int rc;
+
+	if (num_reg_map > CAM_CPAS_REG_MAX) {
+		CAM_ERR(CAM_CPAS, "invalid num_reg_map=%d", num_reg_map);
+		return -EINVAL;
+	}
+
+	if (soc_info->num_mem_block > CAM_SOC_MAX_BLOCK) {
+		CAM_ERR(CAM_CPAS, "invalid num_mem_block=%d",
+			soc_info->num_mem_block);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_camss", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_CAMSS] = index;
+	} else {
+		CAM_ERR(CAM_CPAS, "regbase not found for CAM_CPAS_REG_CAMSS");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_camsstop_get_internal_ops(struct cam_cpas_internal_ops *internal_ops)
+{
+	if (!internal_ops) {
+		CAM_ERR(CAM_CPAS, "invalid NULL param");
+		return -EINVAL;
+	}
+
+	internal_ops->get_hw_info = cam_camsstop_get_hw_info;
+	internal_ops->init_hw_version = NULL;
+	internal_ops->handle_irq = NULL;
+	internal_ops->setup_regbase = cam_camsstop_setup_regbase_indices;
+	internal_ops->power_on = NULL;
+	internal_ops->power_off = NULL;
+	internal_ops->setup_qos_settings = NULL;
+	internal_ops->print_poweron_settings = NULL;
+	internal_ops->qchannel_handshake = NULL;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cam_cpastop_hw.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cam_cpastop_hw.c
@@ -0,0 +1,1166 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/slab.h>
+
+#include "cam_compat.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cpas_hw.h"
+#include "cam_cpastop_hw.h"
+#include "cam_io_util.h"
+#include "cam_cpas_soc.h"
+#include "cpastop100.h"
+#include "cpastop_v150_100.h"
+#include "cpastop_v170_200.h"
+#include "cpastop_v170_110.h"
+#include "cpastop_v175_100.h"
+#include "cpastop_v175_101.h"
+#include "cpastop_v175_120.h"
+#include "cpastop_v175_130.h"
+#include "cpastop_v480_100.h"
+#include "cpastop_v480_custom.h"
+#include "cpastop_v580_100.h"
+#include "cpastop_v580_custom.h"
+#include "cpastop_v540_100.h"
+#include "cpastop_v520_100.h"
+#include "cpastop_v520_110.h"
+#include "cpastop_v545_100.h"
+#include "cpastop_v545_110.h"
+#include "cpastop_v570_200.h"
+#include "cpastop_v680_100.h"
+#include "cpastop_v165_100.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+struct cam_camnoc_info *camnoc_info;
+struct cam_cpas_camnoc_qchannel *qchannel_info;
+
+
+#define CAMNOC_SLAVE_MAX_ERR_CODE 7
+static const char * const camnoc_salve_err_code[] = {
+	"Target Error",              /* err code 0 */
+	"Address decode error",      /* err code 1 */
+	"Unsupported request",       /* err code 2 */
+	"Disconnected target",       /* err code 3 */
+	"Security violation",        /* err code 4 */
+	"Hidden security violation", /* err code 5 */
+	"Timeout Error",             /* err code 6 */
+	"Unknown Error",             /* unknown err code */
+};
+
+static const uint32_t cam_cpas_hw_version_map
+	[CAM_CPAS_CAMERA_VERSION_ID_MAX][CAM_CPAS_VERSION_ID_MAX] = {
+	/* for camera_150 */
+	{
+		CAM_CPAS_TITAN_150_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_170 */
+	{
+		CAM_CPAS_TITAN_170_V100,
+		0,
+		CAM_CPAS_TITAN_170_V110,
+		CAM_CPAS_TITAN_170_V120,
+		0,
+		CAM_CPAS_TITAN_170_V200,
+	},
+	/* for camera_175 */
+	{
+		CAM_CPAS_TITAN_175_V100,
+		CAM_CPAS_TITAN_175_V101,
+		0,
+		CAM_CPAS_TITAN_175_V120,
+		CAM_CPAS_TITAN_175_V130,
+		0,
+	},
+	/* for camera_480 */
+	{
+		CAM_CPAS_TITAN_480_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_580 */
+	{
+		CAM_CPAS_TITAN_580_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_520 */
+	{
+		CAM_CPAS_TITAN_520_V100,
+		0,
+		CAM_CPAS_TITAN_520_V110,
+		0,
+		0,
+		0,
+
+	},
+	/* for camera_540 */
+	{
+		CAM_CPAS_TITAN_540_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_545 */
+	{
+		CAM_CPAS_TITAN_545_V100,
+		0,
+		CAM_CPAS_TITAN_545_V110,
+		0,
+		0,
+		0,
+	},
+	/* for camera_570 */
+	{
+		0,
+		0,
+		0,
+		0,
+		0,
+		CAM_CPAS_TITAN_570_V200,
+	},
+	/* for camera_680 */
+	{
+		CAM_CPAS_TITAN_680_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+	/* for camera_165 */
+	{
+		CAM_CPAS_TITAN_165_V100,
+		0,
+		0,
+		0,
+		0,
+		0,
+	},
+};
+
+static int cam_cpas_translate_camera_cpas_version_id(
+	uint32_t cam_version,
+	uint32_t cpas_version,
+	uint32_t *cam_version_id,
+	uint32_t *cpas_version_id)
+{
+
+	switch (cam_version) {
+
+	case CAM_CPAS_CAMERA_VERSION_150:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_150;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_170:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_170;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_175:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_175;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_480:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_480;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_520:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_520;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_540:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_540;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_580:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_580;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_545:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_545;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_570:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_570;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_680:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_680;
+		break;
+
+	case CAM_CPAS_CAMERA_VERSION_165:
+		*cam_version_id = CAM_CPAS_CAMERA_VERSION_ID_165;
+		break;
+
+	default:
+		CAM_ERR(CAM_CPAS, "Invalid cam version %u",
+			cam_version);
+		return -EINVAL;
+	}
+
+	switch (cpas_version) {
+
+	case CAM_CPAS_VERSION_100:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_100;
+		break;
+
+	case CAM_CPAS_VERSION_101:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_101;
+		break;
+	case CAM_CPAS_VERSION_110:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_110;
+		break;
+
+	case CAM_CPAS_VERSION_120:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_120;
+		break;
+
+	case CAM_CPAS_VERSION_130:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_130;
+		break;
+
+	case CAM_CPAS_VERSION_200:
+		*cpas_version_id = CAM_CPAS_VERSION_ID_200;
+		break;
+
+	default:
+		CAM_ERR(CAM_CPAS, "Invalid cpas version %u",
+			cpas_version);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int cam_cpastop_get_hw_info(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_hw_caps *hw_caps)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int32_t reg_indx = cpas_core->regbase_index[CAM_CPAS_REG_CPASTOP];
+	uint32_t reg_value;
+	uint32_t cam_version, cpas_version;
+	uint32_t cam_version_id, cpas_version_id;
+	int rc;
+
+	if (reg_indx == -1)
+		return -EINVAL;
+
+	hw_caps->camera_family = CAM_FAMILY_CPAS_SS;
+
+	cam_version = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base + 0x0);
+	hw_caps->camera_version.major =
+		CAM_BITS_MASK_SHIFT(cam_version, 0xff0000, 0x10);
+	hw_caps->camera_version.minor =
+		CAM_BITS_MASK_SHIFT(cam_version, 0xff00, 0x8);
+	hw_caps->camera_version.incr =
+		CAM_BITS_MASK_SHIFT(cam_version, 0xff, 0x0);
+
+	cpas_version = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base + 0x4);
+	hw_caps->cpas_version.major =
+		CAM_BITS_MASK_SHIFT(cpas_version, 0xf0000000, 0x1c);
+	hw_caps->cpas_version.minor =
+		CAM_BITS_MASK_SHIFT(cpas_version, 0xfff0000, 0x10);
+	hw_caps->cpas_version.incr =
+		CAM_BITS_MASK_SHIFT(cpas_version, 0xffff, 0x0);
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base + 0x8);
+	hw_caps->camera_capability = reg_value;
+
+	CAM_DBG(CAM_FD, "Family %d, version %d.%d.%d, cpas %d.%d.%d, cap 0x%x",
+		hw_caps->camera_family, hw_caps->camera_version.major,
+		hw_caps->camera_version.minor, hw_caps->camera_version.incr,
+		hw_caps->cpas_version.major, hw_caps->cpas_version.minor,
+		hw_caps->cpas_version.incr, hw_caps->camera_capability);
+
+	soc_info->hw_version = CAM_CPAS_TITAN_NONE;
+	rc  = cam_cpas_translate_camera_cpas_version_id(cam_version,
+		cpas_version, &cam_version_id, &cpas_version_id);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Invalid Version, Camera: 0x%x CPAS: 0x%x",
+			cam_version, cpas_version);
+		return -EINVAL;
+	}
+
+	soc_info->hw_version =
+		cam_cpas_hw_version_map[cam_version_id][cpas_version_id];
+	CAM_DBG(CAM_CPAS, "CPAS HW VERSION %x", soc_info->hw_version);
+
+	return 0;
+}
+
+static int cam_cpastop_setup_regbase_indices(struct cam_hw_soc_info *soc_info,
+	int32_t regbase_index[], int32_t num_reg_map)
+{
+	uint32_t index;
+	int rc;
+
+	if (num_reg_map > CAM_CPAS_REG_MAX) {
+		CAM_ERR(CAM_CPAS, "invalid num_reg_map=%d", num_reg_map);
+		return -EINVAL;
+	}
+
+	if (soc_info->num_mem_block > CAM_SOC_MAX_BLOCK) {
+		CAM_ERR(CAM_CPAS, "invalid num_mem_block=%d",
+			soc_info->num_mem_block);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_cpas_top", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_CPASTOP] = index;
+	} else if (rc) {
+		CAM_ERR(CAM_CPAS, "failed to get index for CPASTOP rc=%d", rc);
+		return rc;
+	} else {
+		CAM_ERR(CAM_CPAS, "regbase not found for CPASTOP, rc=%d, %d %d",
+			rc, index, num_reg_map);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_camnoc", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_CAMNOC] = index;
+	} else if (rc) {
+		CAM_ERR(CAM_CPAS, "failed to get index for CAMNOC rc=%d", rc);
+		return rc;
+	} else {
+		CAM_ERR(CAM_CPAS, "regbase not found for CAMNOC, rc=%d, %d %d",
+			rc, index, num_reg_map);
+		return -EINVAL;
+	}
+
+	/* optional - rpmh register map */
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "cam_rpmh", &index);
+	if ((rc == 0) && (index < num_reg_map)) {
+		regbase_index[CAM_CPAS_REG_RPMH] = index;
+		CAM_DBG(CAM_CPAS, "regbase found for RPMH, rc=%d, %d %d",
+			rc, index, num_reg_map);
+	} else {
+		CAM_DBG(CAM_CPAS, "regbase not found for RPMH, rc=%d, %d %d",
+			rc, index, num_reg_map);
+		regbase_index[CAM_CPAS_REG_RPMH] = -1;
+	}
+
+	return 0;
+}
+
+static int cam_cpastop_handle_errlogger(struct cam_cpas *cpas_core,
+	struct cam_hw_soc_info *soc_info,
+	struct cam_camnoc_irq_slave_err_data *slave_err)
+{
+	int camnoc_index = cpas_core->regbase_index[CAM_CPAS_REG_CAMNOC];
+	int err_code_index = 0;
+
+	if (!camnoc_info->err_logger) {
+		CAM_ERR_RATE_LIMIT(CAM_CPAS, "Invalid err logger info");
+		return -EINVAL;
+	}
+
+	slave_err->mainctrl.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->mainctrl);
+
+	slave_err->errvld.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->errvld);
+
+	slave_err->errlog0_low.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->errlog0_low);
+
+	slave_err->errlog0_high.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->errlog0_high);
+
+	slave_err->errlog1_low.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->errlog1_low);
+
+	slave_err->errlog1_high.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->errlog1_high);
+
+	slave_err->errlog2_low.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->errlog2_low);
+
+	slave_err->errlog2_high.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->errlog2_high);
+
+	slave_err->errlog3_low.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->errlog3_low);
+
+	slave_err->errlog3_high.value = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->err_logger->errlog3_high);
+
+	CAM_ERR_RATE_LIMIT(CAM_CPAS,
+		"Possible memory configuration issue, fault at SMMU raised as CAMNOC SLAVE_IRQ");
+
+	CAM_ERR_RATE_LIMIT(CAM_CPAS,
+		"mainctrl[0x%x 0x%x] errvld[0x%x 0x%x] stall_en=%d, fault_en=%d, err_vld=%d",
+		camnoc_info->err_logger->mainctrl,
+		slave_err->mainctrl.value,
+		camnoc_info->err_logger->errvld,
+		slave_err->errvld.value,
+		slave_err->mainctrl.stall_en,
+		slave_err->mainctrl.fault_en,
+		slave_err->errvld.err_vld);
+
+	err_code_index = slave_err->errlog0_low.err_code;
+	if (err_code_index > CAMNOC_SLAVE_MAX_ERR_CODE)
+		err_code_index = CAMNOC_SLAVE_MAX_ERR_CODE;
+
+	CAM_ERR_RATE_LIMIT(CAM_CPAS,
+		"errlog0 low[0x%x 0x%x] high[0x%x 0x%x] loginfo_vld=%d, word_error=%d, non_secure=%d, device=%d, opc=%d, err_code=%d(%s) sizef=%d, addr_space=%d, len1=%d",
+		camnoc_info->err_logger->errlog0_low,
+		slave_err->errlog0_low.value,
+		camnoc_info->err_logger->errlog0_high,
+		slave_err->errlog0_high.value,
+		slave_err->errlog0_low.loginfo_vld,
+		slave_err->errlog0_low.word_error,
+		slave_err->errlog0_low.non_secure,
+		slave_err->errlog0_low.device,
+		slave_err->errlog0_low.opc,
+		slave_err->errlog0_low.err_code,
+		camnoc_salve_err_code[err_code_index],
+		slave_err->errlog0_low.sizef,
+		slave_err->errlog0_low.addr_space,
+		slave_err->errlog0_high.len1);
+
+	CAM_ERR_RATE_LIMIT(CAM_CPAS,
+		"errlog1_low[0x%x 0x%x]  errlog1_high[0x%x 0x%x] errlog2_low[0x%x 0x%x]  errlog2_high[0x%x 0x%x] errlog3_low[0x%x 0x%x]  errlog3_high[0x%x 0x%x]",
+		camnoc_info->err_logger->errlog1_low,
+		slave_err->errlog1_low.value,
+		camnoc_info->err_logger->errlog1_high,
+		slave_err->errlog1_high.value,
+		camnoc_info->err_logger->errlog2_low,
+		slave_err->errlog2_low.value,
+		camnoc_info->err_logger->errlog2_high,
+		slave_err->errlog2_high.value,
+		camnoc_info->err_logger->errlog3_low,
+		slave_err->errlog3_low.value,
+		camnoc_info->err_logger->errlog3_high,
+		slave_err->errlog3_high.value);
+
+	return 0;
+}
+
+static int cam_cpastop_handle_ubwc_enc_err(struct cam_cpas *cpas_core,
+	struct cam_hw_soc_info *soc_info, int i,
+	struct cam_camnoc_irq_ubwc_enc_data *enc_err)
+{
+	int camnoc_index = cpas_core->regbase_index[CAM_CPAS_REG_CAMNOC];
+
+	enc_err->encerr_status.value =
+		cam_io_r_mb(soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->irq_err[i].err_status.offset);
+
+	/* Let clients handle the UBWC errors */
+	CAM_DBG(CAM_CPAS,
+		"ubwc enc err [%d]: offset[0x%x] value[0x%x]",
+		i, camnoc_info->irq_err[i].err_status.offset,
+		enc_err->encerr_status.value);
+
+	return 0;
+}
+
+static int cam_cpastop_handle_ubwc_dec_err(struct cam_cpas *cpas_core,
+	struct cam_hw_soc_info *soc_info, int i,
+	struct cam_camnoc_irq_ubwc_dec_data *dec_err)
+{
+	int camnoc_index = cpas_core->regbase_index[CAM_CPAS_REG_CAMNOC];
+
+	dec_err->decerr_status.value =
+		cam_io_r_mb(soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->irq_err[i].err_status.offset);
+
+	/* Let clients handle the UBWC errors */
+	CAM_DBG(CAM_CPAS,
+		"ubwc dec err status [%d]: offset[0x%x] value[0x%x] thr_err=%d, fcl_err=%d, len_md_err=%d, format_err=%d",
+		i, camnoc_info->irq_err[i].err_status.offset,
+		dec_err->decerr_status.value,
+		dec_err->decerr_status.thr_err,
+		dec_err->decerr_status.fcl_err,
+		dec_err->decerr_status.len_md_err,
+		dec_err->decerr_status.format_err);
+
+	return 0;
+}
+
+static int cam_cpastop_handle_ahb_timeout_err(struct cam_hw_info *cpas_hw,
+	struct cam_camnoc_irq_ahb_timeout_data *ahb_err)
+{
+	CAM_ERR_RATE_LIMIT(CAM_CPAS, "ahb timeout error");
+
+	return 0;
+}
+
+static int cam_cpastop_disable_test_irq(struct cam_hw_info *cpas_hw)
+{
+	camnoc_info->irq_sbm->sbm_clear.value &= ~0x4;
+	camnoc_info->irq_sbm->sbm_enable.value &= ~0x100;
+	camnoc_info->irq_err[CAM_CAMNOC_HW_IRQ_CAMNOC_TEST].enable = false;
+
+	return 0;
+}
+
+static int cam_cpastop_reset_irq(struct cam_hw_info *cpas_hw)
+{
+	int i;
+
+	if (camnoc_info->irq_sbm->sbm_enable.enable == false)
+		return 0;
+
+	cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+		&camnoc_info->irq_sbm->sbm_clear);
+	for (i = 0; i < camnoc_info->irq_err_size; i++) {
+		if (camnoc_info->irq_err[i].enable)
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->irq_err[i].err_clear);
+	}
+
+	cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+		&camnoc_info->irq_sbm->sbm_enable);
+	for (i = 0; i < camnoc_info->irq_err_size; i++) {
+		if (camnoc_info->irq_err[i].enable)
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->irq_err[i].err_enable);
+	}
+
+	return 0;
+}
+
+static void cam_cpastop_notify_clients(struct cam_cpas *cpas_core,
+	struct cam_cpas_irq_data *irq_data)
+{
+	int i;
+	struct cam_cpas_client *cpas_client;
+	bool error_handled = false;
+
+	CAM_DBG(CAM_CPAS,
+		"Notify CB : num_clients=%d, registered=%d, started=%d",
+		cpas_core->num_clients, cpas_core->registered_clients,
+		cpas_core->streamon_clients);
+
+	for (i = 0; i < cpas_core->num_clients; i++) {
+		if (CAM_CPAS_CLIENT_STARTED(cpas_core, i)) {
+			cpas_client = cpas_core->cpas_client[i];
+			if (cpas_client->data.cam_cpas_client_cb) {
+				CAM_DBG(CAM_CPAS,
+					"Calling client CB %d : %d",
+					i, irq_data->irq_type);
+				error_handled =
+					cpas_client->data.cam_cpas_client_cb(
+					cpas_client->data.client_handle,
+					cpas_client->data.userdata,
+					irq_data);
+				if (error_handled)
+					break;
+			}
+		}
+	}
+}
+
+static void cam_cpastop_work(struct work_struct *work)
+{
+	struct cam_cpas_work_payload *payload;
+	struct cam_hw_info *cpas_hw;
+	struct cam_cpas *cpas_core;
+	struct cam_hw_soc_info *soc_info;
+	int i;
+	enum cam_camnoc_hw_irq_type irq_type;
+	struct cam_cpas_irq_data irq_data;
+
+	payload = container_of(work, struct cam_cpas_work_payload, work);
+	if (!payload) {
+		CAM_ERR(CAM_CPAS, "NULL payload");
+		return;
+	}
+
+	cam_common_util_thread_switch_delay_detect(
+		"CPAS workq schedule",
+		payload->workq_scheduled_ts,
+		CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+
+	cpas_hw = payload->hw;
+	cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	soc_info = &cpas_hw->soc_info;
+
+	if (!atomic_inc_not_zero(&cpas_core->irq_count)) {
+		CAM_ERR(CAM_CPAS, "CPAS off");
+		return;
+	}
+
+	for (i = 0; i < camnoc_info->irq_err_size; i++) {
+		if ((payload->irq_status & camnoc_info->irq_err[i].sbm_port) &&
+			(camnoc_info->irq_err[i].enable)) {
+			irq_type = camnoc_info->irq_err[i].irq_type;
+			CAM_ERR_RATE_LIMIT(CAM_CPAS,
+				"Error occurred, type=%d", irq_type);
+			memset(&irq_data, 0x0, sizeof(irq_data));
+			irq_data.irq_type = (enum cam_camnoc_irq_type)irq_type;
+
+			switch (irq_type) {
+			case CAM_CAMNOC_HW_IRQ_SLAVE_ERROR:
+				cam_cpastop_handle_errlogger(
+					cpas_core, soc_info,
+					&irq_data.u.slave_err);
+				break;
+			case CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR:
+				cam_cpastop_handle_ubwc_enc_err(
+					cpas_core, soc_info, i,
+					&irq_data.u.enc_err);
+				break;
+			case CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR:
+			case CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR:
+				cam_cpastop_handle_ubwc_dec_err(
+					cpas_core, soc_info, i,
+					&irq_data.u.dec_err);
+				break;
+			case CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT:
+				cam_cpastop_handle_ahb_timeout_err(
+					cpas_hw, &irq_data.u.ahb_err);
+				break;
+			case CAM_CAMNOC_HW_IRQ_CAMNOC_TEST:
+				CAM_DBG(CAM_CPAS, "TEST IRQ");
+				break;
+			default:
+				CAM_ERR(CAM_CPAS, "Invalid IRQ type");
+				break;
+			}
+
+			cam_cpastop_notify_clients(cpas_core, &irq_data);
+
+			payload->irq_status &=
+				~camnoc_info->irq_err[i].sbm_port;
+		}
+	}
+	atomic_dec(&cpas_core->irq_count);
+	wake_up(&cpas_core->irq_count_wq);
+	CAM_DBG(CAM_CPAS, "irq_count=%d\n", atomic_read(&cpas_core->irq_count));
+
+	if (payload->irq_status)
+		CAM_ERR(CAM_CPAS, "IRQ not handled irq_status=0x%x",
+			payload->irq_status);
+
+	kfree(payload);
+}
+
+static irqreturn_t cam_cpastop_handle_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *cpas_hw = (struct cam_hw_info *)data;
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int camnoc_index = cpas_core->regbase_index[CAM_CPAS_REG_CAMNOC];
+	struct cam_cpas_work_payload *payload;
+
+	if (!atomic_inc_not_zero(&cpas_core->irq_count)) {
+		CAM_ERR(CAM_CPAS, "CPAS off");
+		return IRQ_HANDLED;
+	}
+
+	payload = kzalloc(sizeof(struct cam_cpas_work_payload), GFP_ATOMIC);
+	if (!payload)
+		goto done;
+
+	payload->irq_status = cam_io_r_mb(
+		soc_info->reg_map[camnoc_index].mem_base +
+		camnoc_info->irq_sbm->sbm_status.offset);
+
+	CAM_DBG(CAM_CPAS, "IRQ callback, irq_status=0x%x", payload->irq_status);
+
+	payload->hw = cpas_hw;
+	INIT_WORK((struct work_struct *)&payload->work, cam_cpastop_work);
+
+	if (TEST_IRQ_ENABLE)
+		cam_cpastop_disable_test_irq(cpas_hw);
+
+	cam_cpastop_reset_irq(cpas_hw);
+
+	payload->workq_scheduled_ts = ktime_get();
+	queue_work(cpas_core->work_queue, &payload->work);
+done:
+	atomic_dec(&cpas_core->irq_count);
+	wake_up(&cpas_core->irq_count_wq);
+
+	return IRQ_HANDLED;
+}
+
+static int cam_cpastop_print_poweron_settings(struct cam_hw_info *cpas_hw)
+{
+	int i;
+
+	for (i = 0; i < camnoc_info->specific_size; i++) {
+		if (camnoc_info->specific[i].enable) {
+			CAM_INFO(CAM_CPAS, "Reading QoS settings for %d",
+				camnoc_info->specific[i].port_type);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].priority_lut_low);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].priority_lut_high);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].urgency);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].danger_lut);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].safe_lut);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].ubwc_ctl);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].flag_out_set0_low);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].qosgen_mainctl);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].qosgen_shaping_low);
+			cam_cpas_util_reg_read(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].qosgen_shaping_high);
+		}
+	}
+
+	return 0;
+}
+
+static int cam_cpastop_poweron(struct cam_hw_info *cpas_hw)
+{
+	int i;
+	struct cam_cpas_hw_errata_wa_list *errata_wa_list =
+		camnoc_info->errata_wa_list;
+
+	CAM_DBG(CAM_CPAS, "errata_wa_list %pK", errata_wa_list);
+	cam_cpastop_reset_irq(cpas_hw);
+	for (i = 0; i < camnoc_info->specific_size; i++) {
+		if (camnoc_info->specific[i].enable) {
+			CAM_DBG(CAM_CPAS, "Updating QoS settings for %d",
+				camnoc_info->specific[i].port_type);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].priority_lut_low);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].priority_lut_high);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].urgency);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].danger_lut);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].safe_lut);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].ubwc_ctl);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].flag_out_set0_low);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].qosgen_mainctl);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].qosgen_shaping_low);
+			cam_cpas_util_reg_update(cpas_hw, CAM_CPAS_REG_CAMNOC,
+				&camnoc_info->specific[i].qosgen_shaping_high);
+		}
+	}
+
+#ifdef CONFIG_SPECTRA_SECURE
+	struct cam_cpas_hw_errata_wa *errata_wa;
+
+	if (errata_wa_list) {
+		errata_wa = &errata_wa_list->tcsr_camera_hf_sf_ares_glitch;
+		if (errata_wa->enable)
+			cam_cpastop_scm_write(errata_wa);
+	}
+#endif /* CONFIG_SPECTRA_SECURE */
+
+	return 0;
+}
+
+static int cam_cpastop_poweroff(struct cam_hw_info *cpas_hw)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int camnoc_index = cpas_core->regbase_index[CAM_CPAS_REG_CAMNOC];
+	int rc = 0;
+	struct cam_cpas_hw_errata_wa_list *errata_wa_list =
+		camnoc_info->errata_wa_list;
+
+	if (!errata_wa_list)
+		return 0;
+
+	if (errata_wa_list->camnoc_flush_slave_pending_trans.enable) {
+		struct cam_cpas_hw_errata_wa *errata_wa =
+			&errata_wa_list->camnoc_flush_slave_pending_trans;
+
+		rc = cam_io_poll_value_wmask(
+			soc_info->reg_map[camnoc_index].mem_base +
+			errata_wa->data.reg_info.offset,
+			errata_wa->data.reg_info.value,
+			errata_wa->data.reg_info.mask,
+			CAM_CPAS_POLL_RETRY_CNT,
+			CAM_CPAS_POLL_MIN_USECS, CAM_CPAS_POLL_MAX_USECS);
+		if (rc) {
+			CAM_DBG(CAM_CPAS,
+				"camnoc flush slave pending trans failed");
+			/* Do not return error, passthrough */
+			rc = 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_cpastop_qchannel_handshake(struct cam_hw_info *cpas_hw,
+	bool power_on)
+{
+	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	int32_t reg_indx = cpas_core->regbase_index[CAM_CPAS_REG_CPASTOP];
+	uint32_t mask = 0;
+	uint32_t wait_data, qchannel_status, qdeny;
+	int rc = 0;
+
+	if (reg_indx == -1)
+		return -EINVAL;
+
+	if (!qchannel_info)
+		return 0;
+
+	if (power_on) {
+		/* wait for QACCEPTN in QCHANNEL status*/
+		mask = BIT(0);
+		wait_data = 1;
+	} else {
+		/* Clear the quiecience request in QCHANNEL ctrl*/
+		cam_io_w_mb(0, soc_info->reg_map[reg_indx].mem_base +
+			qchannel_info->qchannel_ctrl);
+		/* wait for QACCEPTN and QDENY in QCHANNEL status*/
+		mask = BIT(1) | BIT(0);
+		wait_data = 0;
+	}
+
+	rc = cam_io_poll_value_wmask(
+		soc_info->reg_map[reg_indx].mem_base +
+		qchannel_info->qchannel_status,
+		wait_data, mask, CAM_CPAS_POLL_QH_RETRY_CNT,
+		CAM_CPAS_POLL_MIN_USECS, CAM_CPAS_POLL_MAX_USECS);
+	if (rc) {
+		CAM_ERR(CAM_CPAS,
+			"camnoc idle sequence failed, qstat 0x%x",
+			cam_io_r(soc_info->reg_map[reg_indx].mem_base +
+			qchannel_info->qchannel_status));
+		/* Do not return error, passthrough */
+		rc = 0;
+	}
+
+	/* check if deny bit is set */
+	qchannel_status = cam_io_r_mb(soc_info->reg_map[reg_indx].mem_base +
+				qchannel_info->qchannel_status);
+	qdeny = (qchannel_status & BIT(1));
+	if (!power_on && qdeny)
+		rc = -EBUSY;
+
+	return rc;
+}
+
+static int cam_cpastop_init_hw_version(struct cam_hw_info *cpas_hw,
+	struct cam_cpas_hw_caps *hw_caps)
+{
+	int rc = 0;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+	qchannel_info = NULL;
+
+	CAM_DBG(CAM_CPAS,
+		"hw_version=0x%x Camera Version %d.%d.%d, cpas version %d.%d.%d",
+		soc_info->hw_version,
+		hw_caps->camera_version.major,
+		hw_caps->camera_version.minor,
+		hw_caps->camera_version.incr,
+		hw_caps->cpas_version.major,
+		hw_caps->cpas_version.minor,
+		hw_caps->cpas_version.incr);
+
+	switch (soc_info->hw_version) {
+	case CAM_CPAS_TITAN_170_V100:
+		camnoc_info = &cam170_cpas100_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_170_V110:
+		camnoc_info = &cam170_cpas110_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_170_V200:
+		camnoc_info = &cam170_cpas200_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_175_V100:
+		camnoc_info = &cam175_cpas100_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_175_V101:
+		camnoc_info = &cam175_cpas101_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_175_V120:
+		camnoc_info = &cam175_cpas120_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_175_V130:
+		camnoc_info = &cam175_cpas130_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_150_V100:
+		camnoc_info = &cam150_cpas100_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_480_V100:
+		camnoc_info = &cam480_cpas100_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_580_V100:
+		camnoc_info = &cam580_cpas100_camnoc_info;
+		qchannel_info = &cam580_cpas100_qchannel_info;
+		break;
+	case CAM_CPAS_TITAN_540_V100:
+		camnoc_info = &cam540_cpas100_camnoc_info;
+		qchannel_info = &cam540_cpas100_qchannel_info;
+		break;
+	case CAM_CPAS_TITAN_520_V100:
+		camnoc_info = &cam520_cpas100_camnoc_info;
+		qchannel_info = &cam520_cpas100_qchannel_info;
+		break;
+	case CAM_CPAS_TITAN_520_V110:
+		camnoc_info = &cam520_cpas110_camnoc_info;
+		qchannel_info = &cam520_cpas110_qchannel_info;
+		break;
+	case CAM_CPAS_TITAN_545_V100:
+		camnoc_info = &cam545_cpas100_camnoc_info;
+		qchannel_info = &cam545_cpas100_qchannel_info;
+		break;
+	case CAM_CPAS_TITAN_545_V110:
+		camnoc_info = &cam545_cpas110_camnoc_info;
+		qchannel_info = &cam545_cpas110_qchannel_info;
+		break;
+	case CAM_CPAS_TITAN_570_V200:
+		camnoc_info = &cam570_cpas200_camnoc_info;
+		qchannel_info = &cam570_cpas200_qchannel_info;
+		break;
+	case CAM_CPAS_TITAN_680_V100:
+		camnoc_info = &cam680_cpas100_camnoc_info;
+		break;
+	case CAM_CPAS_TITAN_165_V100:
+		camnoc_info = &cam165_cpas100_camnoc_info;
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Camera Version not supported %d.%d.%d",
+			hw_caps->camera_version.major,
+			hw_caps->camera_version.minor,
+			hw_caps->camera_version.incr);
+		rc = -EINVAL;
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_cpastop_setup_qos_settings(struct cam_hw_info *cpas_hw,
+	uint32_t selection_mask)
+{
+	int rc = 0;
+	struct cam_hw_soc_info *soc_info = &cpas_hw->soc_info;
+
+	CAM_DBG(CAM_CPAS,
+		"QoS selection : hw_version=0x%x selection_mask 0x%x",
+		soc_info->hw_version,
+		selection_mask);
+
+	switch (soc_info->hw_version) {
+	case CAM_CPAS_TITAN_480_V100:
+		if (selection_mask & CAM_CPAS_QOS_CUSTOM_SETTINGS_MASK)
+			camnoc_info = &cam480_custom_camnoc_info;
+		else if (selection_mask & CAM_CPAS_QOS_DEFAULT_SETTINGS_MASK)
+			camnoc_info = &cam480_cpas100_camnoc_info;
+		else
+			CAM_ERR(CAM_CPAS, "Invalid selection mask 0x%x",
+				selection_mask);
+		break;
+	case CAM_CPAS_TITAN_580_V100:
+		if (selection_mask & CAM_CPAS_QOS_CUSTOM_SETTINGS_MASK)
+			camnoc_info = &cam580_custom_camnoc_info;
+		else if (selection_mask & CAM_CPAS_QOS_DEFAULT_SETTINGS_MASK)
+			camnoc_info = &cam580_cpas100_camnoc_info;
+		else
+			CAM_ERR(CAM_CPAS,
+				"Invalid selection mask 0x%x for hw 0x%x",
+				selection_mask, soc_info->hw_version);
+		break;
+	case CAM_CPAS_TITAN_680_V100:
+		if ((selection_mask & CAM_CPAS_QOS_CUSTOM_SETTINGS_MASK) ||
+			(selection_mask & CAM_CPAS_QOS_DEFAULT_SETTINGS_MASK))
+			camnoc_info = &cam680_cpas100_camnoc_info;
+		else
+			CAM_ERR(CAM_CPAS,
+				"Invalid selection mask 0x%x for hw 0x%x",
+				selection_mask, soc_info->hw_version);
+		break;
+	default:
+		CAM_WARN(CAM_CPAS, "QoS selection not supported for 0x%x",
+			soc_info->hw_version);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int cam_cpas_hw_get_camnoc_fill_level_info(
+	uint32_t cpas_version,
+	uint32_t client_handle)
+{
+	struct cam_camnoc_fifo_lvl_info *camnoc_reg_info;
+	uint32_t val;
+
+	if (!camnoc_info->fill_lvl_register)
+		return -EFAULT;
+
+	camnoc_reg_info = camnoc_info->fill_lvl_register;
+
+	switch (cpas_version) {
+	case CAM_CPAS_TITAN_175_V120:
+	case CAM_CPAS_TITAN_175_V130:
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC,
+			camnoc_reg_info->IFE0_nRDI_maxwr_offset,
+			true, &val);
+		CAM_INFO(CAM_CPAS, "IFE0_nRDI_MAXWR_LOW offset 0x%x val 0x%x",
+			camnoc_reg_info->IFE0_nRDI_maxwr_offset,
+			val);
+
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC,
+			camnoc_reg_info->IFE1_nRDI_maxwr_offset,
+			true, &val);
+		CAM_INFO(CAM_CPAS, "IFE1_nRDI_MAXWR_LOW offset 0x%x val 0x%x",
+			camnoc_reg_info->IFE1_nRDI_maxwr_offset,
+			val);
+
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC,
+			camnoc_reg_info->IFE0123_RDI_maxwr_offset,
+			true, &val);
+		CAM_INFO(CAM_CPAS, "IFE0_nRDI_MAXWR_LOW offset 0x%x val 0x%x",
+			camnoc_reg_info->IFE0123_RDI_maxwr_offset,
+			val);
+		break;
+	case CAM_CPAS_TITAN_480_V100:
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC, camnoc_reg_info->ife_linear,
+			true, &val);
+		CAM_INFO(CAM_CPAS, "ife_linear offset 0x%x val 0x%x",
+			camnoc_reg_info->ife_linear,
+			val);
+
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC, camnoc_reg_info->ife_rdi_wr,
+			true, &val);
+		CAM_INFO(CAM_CPAS, "ife_rdi_wr offset 0x%x val 0x%x",
+			camnoc_reg_info->ife_rdi_wr,
+			val);
+
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC, camnoc_reg_info->ife_ubwc_stats,
+			true, &val);
+		CAM_INFO(CAM_CPAS, "ife_ubwc_stats offset 0x%x val 0x%x",
+			camnoc_reg_info->ife_ubwc_stats,
+			val);
+
+		break;
+	case CAM_CPAS_TITAN_170_V200:
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC, camnoc_reg_info->IFE01_MAXWR_LOW,
+			true, &val);
+		CAM_INFO(CAM_ISP, "IFE01_MAXWR_LOW offset 0x%x val 0x%x",
+			camnoc_reg_info->IFE01_MAXWR_LOW,
+			val);
+
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC, camnoc_reg_info->IFE23_MAXWR_LOW,
+			true, &val);
+		CAM_INFO(CAM_ISP, "IFE23_MAXWR_LOW offset 0x%x val 0x%x",
+			camnoc_reg_info->IFE23_MAXWR_LOW,
+			val);
+
+		break;
+	case CAM_CPAS_TITAN_165_V100:
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC, camnoc_reg_info->IFE0_MAXWR_LOW,
+			true, &val);
+		CAM_INFO(CAM_ISP, "IFE0_MAXWR_LOW offset 0x%x val 0x%x",
+			camnoc_reg_info->IFE0_MAXWR_LOW,
+			val);
+
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC, camnoc_reg_info->IFE1_MAXWR_LOW,
+			true, &val);
+		CAM_INFO(CAM_ISP, "IFE1_MAXWR_LOW offset 0x%x val 0x%x",
+			camnoc_reg_info->IFE1_MAXWR_LOW,
+			val);
+		break;
+	case CAM_CPAS_TITAN_150_V100:
+	case CAM_CPAS_TITAN_170_V100:
+	case CAM_CPAS_TITAN_170_V110:
+	case CAM_CPAS_TITAN_170_V120:
+	case CAM_CPAS_TITAN_175_V100:
+	case CAM_CPAS_TITAN_175_V101:
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC, camnoc_reg_info->IFE02_MAXWR_LOW,
+			true, &val);
+		CAM_INFO(CAM_ISP, "IFE02_MAXWR_LOW offset 0x%x val 0x%x",
+			camnoc_reg_info->IFE02_MAXWR_LOW,
+			val);
+
+		cam_cpas_reg_read(client_handle,
+			CAM_CPAS_REG_CAMNOC, camnoc_reg_info->IFE13_MAXWR_LOW,
+			true, &val);
+		CAM_INFO(CAM_ISP, "IFE13_MAXWR_LOW offset 0x%x val 0x%x",
+			camnoc_reg_info->IFE13_MAXWR_LOW,
+			val);
+		break;
+	default:
+		CAM_ERR(CAM_CPAS, "Camera version not supported %d",
+			cpas_version);
+		break;
+	}
+	return 0;
+}
+
+int cam_cpastop_get_internal_ops(struct cam_cpas_internal_ops *internal_ops)
+{
+	if (!internal_ops) {
+		CAM_ERR(CAM_CPAS, "invalid NULL param");
+		return -EINVAL;
+	}
+
+	internal_ops->get_hw_info = cam_cpastop_get_hw_info;
+	internal_ops->init_hw_version = cam_cpastop_init_hw_version;
+	internal_ops->handle_irq = cam_cpastop_handle_irq;
+	internal_ops->setup_regbase = cam_cpastop_setup_regbase_indices;
+	internal_ops->power_on = cam_cpastop_poweron;
+	internal_ops->power_off = cam_cpastop_poweroff;
+	internal_ops->setup_qos_settings = cam_cpastop_setup_qos_settings;
+	internal_ops->print_poweron_settings =
+		cam_cpastop_print_poweron_settings;
+	internal_ops->qchannel_handshake = cam_cpastop_qchannel_handshake;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cam_cpastop_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cam_cpastop_hw.h
@@ -0,0 +1,401 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CPASTOP_HW_H_
+#define _CAM_CPASTOP_HW_H_
+
+#include "cam_cpas_api.h"
+#include "cam_cpas_hw.h"
+
+/**
+ * enum cam_camnoc_hw_irq_type - Enum for camnoc error types
+ *
+ * @CAM_CAMNOC_HW_IRQ_SLAVE_ERROR                  : Each slave port in CAMNOC
+ *                                                  (3 QSB ports and 1 QHB port)
+ *                                                   has an error logger. The
+ *                                                   error observed at any slave
+ *                                                   port is logged into the
+ *                                                   error logger register and
+ *                                                   an IRQ is triggered
+ * @CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR        : Triggered if any error
+ *                                                   detected in the IFE UBWC
+ *                                                   encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR  : Triggered if any error
+ *                                                   detected in the IFE UBWC-
+ *                                                   Stats encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR: Triggered if any error
+ *                                                   detected in the IFE UBWC-
+ *                                                   Stats 1 encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR      : Triggered if any error
+ *                                                   detected in the IFE0 UBWC
+ *                                                   encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR      : Triggered if any error
+ *                                                   detected in the IFE1 or
+ *                                                   IFE3 UBWC encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR       : Triggered if any UBWC error
+ *                                                   is detected in IFE0 write
+ *                                                   path
+ * @CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR : Triggered if any UBWC error
+ *                                                   is detected in IFE1 write
+ *                                                   path slave  times out after
+ *                                                   4000 AHB cycles
+ * @CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR        : Triggered if any error
+ *                                                   detected in the IPE
+ *                                                   UBWC encoder instance
+ * @CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR        : Triggered if any error
+ *                                                   detected in the BPS
+ *                                                   UBWC encoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR   : Triggered if any error
+ *                                                   detected in the IPE1/BPS
+ *                                                   read path decoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR       : Triggered if any error
+ *                                                   detected in the IPE0 read
+ *                                                   path decoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR       : Triggered if any error
+ *                                                   detected in the IPE1 read
+ *                                                   path decoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR    : Triggered if any error
+ *                                                   detected in the IPE/BPS
+ *                                                   UBWC decoder instance
+ * @CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR    : Triggered if any error
+ *                                                   detected in the IPE/BPS
+ *                                                   UBWC encoder instance
+ * @CAM_CAMNOC_HW_IRQ_RESERVED1                    : Reserved
+ * @CAM_CAMNOC_HW_IRQ_RESERVED2                    : Reserved
+ * @CAM_CAMNOC_HW_IRQ_CAMNOC_TEST                  : To test the IRQ logic
+ */
+enum cam_camnoc_hw_irq_type {
+	CAM_CAMNOC_HW_IRQ_SLAVE_ERROR =
+		CAM_CAMNOC_IRQ_SLAVE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE0_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_BPS_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE0_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE1_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR =
+		CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT =
+		CAM_CAMNOC_IRQ_AHB_TIMEOUT,
+	CAM_CAMNOC_HW_IRQ_RESERVED1,
+	CAM_CAMNOC_HW_IRQ_RESERVED2,
+	CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+};
+
+/**
+ * enum cam_camnoc_port_type - Enum for different camnoc hw ports. All CAMNOC
+ *         settings like QoS, LUT mappings need to be configured for
+ *         each of these ports.
+ *
+ * @CAM_CAMNOC_CDM: Indicates CDM HW connection to camnoc
+ * @CAM_CAMNOC_SFE_RD: Indicates read data from all SFEs to cammnoc
+ * @CAM_CAMNOC_IFE02: Indicates IFE0, IFE2 HW connection to camnoc
+ * @CAM_CAMNOC_IFE13: Indicates IFE1, IFE3 HW connection to camnoc
+ * @CAM_CAMNOC_IFE_LITE: Indicates all IFE lites connection to camnoc
+ * @CAM_CAMNOC_IFE_LINEAR: Indicates linear data from all IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_LINEAR_STATS: Indicates linear and stats data from certan
+ *         IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_LINEAR_STATS_1: Indicates linear and stats data from certan
+ *         IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_PDAF: Indicates pdaf data from all IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_UBWC: Indicates ubwc from all IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_UBWC_STATS: Indicates ubwc+stats from certain IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_UBWC_STATS_1: Indicates ubwc+stats from certain
+ *         IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_RDI_WR: Indicates RDI write data from certain IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_RDI_WR_1: Indicates RDI write data from certain
+ *         IFEs to cammnoc
+ * @CAM_CAMNOC_IFE_RDI_RD: Indicates RDI read data from all IFEs to cammnoc
+ * @CAM_CAMNOC_IFE0123_RDI_WRITE: RDI write only for all IFEx
+ * @CAM_CAMNOC_IFE0_NRDI_WRITE: IFE0 non-RDI write
+ * @CAM_CAMNOC_IFE01_RDI_READ: IFE0/1 RDI READ
+ * @CAM_CAMNOC_IFE1_NRDI_WRITE: IFE1 non-RDI write
+ * @CAM_CAMNOC_IPE_BPS_LRME_READ: Indicates IPE, BPS, LRME Read HW
+ *         connection to camnoc
+ * @CAM_CAMNOC_IPE_BPS_LRME_WRITE: Indicates IPE, BPS, LRME Write HW
+ *         connection to camnoc
+ * @CAM_CAMNOC_IPE_VID_DISP_WRITE: Indicates IPE's VID/DISP Wrire HW
+ *         connection to camnoc
+ * @CAM_CAMNOC_IPE_WR: Indicates IPE HW's write connection to camnoc
+ * @CAM_CAMNOC_IPE0_RD: Indicates IPE's Read0 HW connection to camnoc
+ * @CAM_CAMNOC_IPE1_RD: Indicates IPE's Read1 HW connection to camnoc
+ * @CAM_CAMNOC_IPE1_BPS_RD: Indicates IPE's Read1 + BPS Read HW connection
+ *         to camnoc
+ * @CAM_CAMNOC_IPE_BPS_WR: Indicates IPE+BPS Write HW connection to camnoc
+ * @CAM_CAMNOC_BPS_WR: Indicates BPS HW's write connection to camnoc
+ * @CAM_CAMNOC_BPS_RD: Indicates BPS HW's read connection to camnoc
+ * @CAM_CAMNOC_JPEG: Indicates JPEG HW connection to camnoc
+ * @CAM_CAMNOC_FD: Indicates FD HW connection to camnoc
+ * @CAM_CAMNOC_ICP: Indicates ICP HW connection to camnoc
+ * @CAM_CAMNOC_TFE: Indicates TFE0 HW connection to camnoc
+ * @CAM_CAMNOC_TFE_1: Indicates TFE1 HW connection to camnoc
+ * @CAM_CAMNOC_TFE_2: Indicates TFE2 HW connection to camnoc
+ * @CAM_CAMNOC_OPE: Indicates OPE HW connection to camnoc
+ */
+enum cam_camnoc_port_type {
+	CAM_CAMNOC_CDM,
+	CAM_CAMNOC_SFE_RD,
+	CAM_CAMNOC_IFE02,
+	CAM_CAMNOC_IFE13,
+	CAM_CAMNOC_IFE_LITE,
+	CAM_CAMNOC_IFE_LINEAR,
+	CAM_CAMNOC_IFE_LINEAR_STATS,
+	CAM_CAMNOC_IFE_LINEAR_STATS_1,
+	CAM_CAMNOC_IFE_PDAF,
+	CAM_CAMNOC_IFE_UBWC,
+	CAM_CAMNOC_IFE_UBWC_STATS,
+	CAM_CAMNOC_IFE_UBWC_STATS_1,
+	CAM_CAMNOC_IFE_RDI_WR,
+	CAM_CAMNOC_IFE_RDI_WR_1,
+	CAM_CAMNOC_IFE_RDI_RD,
+	CAM_CAMNOC_IFE0123_RDI_WRITE,
+	CAM_CAMNOC_IFE0_NRDI_WRITE,
+	CAM_CAMNOC_IFE01_RDI_READ,
+	CAM_CAMNOC_IFE1_NRDI_WRITE,
+	CAM_CAMNOC_IPE_BPS_LRME_READ,
+	CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+	CAM_CAMNOC_IPE_VID_DISP_WRITE,
+	CAM_CAMNOC_IPE_WR,
+	CAM_CAMNOC_IPE0_RD,
+	CAM_CAMNOC_IPE1_RD,
+	CAM_CAMNOC_IPE1_BPS_RD,
+	CAM_CAMNOC_IPE_BPS_WR,
+	CAM_CAMNOC_BPS_WR,
+	CAM_CAMNOC_BPS_RD,
+	CAM_CAMNOC_JPEG,
+	CAM_CAMNOC_FD,
+	CAM_CAMNOC_ICP,
+	CAM_CAMNOC_TFE,
+	CAM_CAMNOC_TFE_1,
+	CAM_CAMNOC_TFE_2,
+	CAM_CAMNOC_OPE,
+	CAM_CAMNOC_IFE01234_RDI_WRITE,
+	CAM_CAMNOC_IFE01_NRDI_WRITE,
+	CAM_CAMNOC_IFE2_NRDI_WRITE,
+};
+
+/**
+ * struct cam_camnoc_specific : CPAS camnoc specific settings
+ *
+ * @port_type: Port type
+ * @enable: Whether to enable settings for this connection
+ * @priority_lut_low: Priority Low LUT mapping for this connection
+ * @priority_lut_high: Priority High LUT mapping for this connection
+ * @urgency: Urgency (QoS) settings for this connection
+ * @danger_lut: Danger LUT mapping for this connection
+ * @safe_lut: Safe LUT mapping for this connection
+ * @ubwc_ctl: UBWC control settings for this connection
+ * @qosgen_mainctl: qosgen shaping control configuration for this connection
+ * @qosgen_shaping_low: qosgen shaping low configuration for this connection
+ * @qosgen_shaping_high: qosgen shaping high configuration for this connection
+ *
+ */
+struct cam_camnoc_specific {
+	enum cam_camnoc_port_type port_type;
+	bool enable;
+	struct cam_cpas_reg priority_lut_low;
+	struct cam_cpas_reg priority_lut_high;
+	struct cam_cpas_reg urgency;
+	struct cam_cpas_reg danger_lut;
+	struct cam_cpas_reg safe_lut;
+	struct cam_cpas_reg ubwc_ctl;
+	struct cam_cpas_reg flag_out_set0_low;
+	struct cam_cpas_reg qosgen_mainctl;
+	struct cam_cpas_reg qosgen_shaping_low;
+	struct cam_cpas_reg qosgen_shaping_high;
+};
+
+/**
+ * struct cam_camnoc_irq_sbm : Sideband manager settings for all CAMNOC IRQs
+ *
+ * @sbm_enable: SBM settings for IRQ enable
+ * @sbm_status: SBM settings for IRQ status
+ * @sbm_clear: SBM settings for IRQ clear
+ *
+ */
+struct cam_camnoc_irq_sbm {
+	struct cam_cpas_reg sbm_enable;
+	struct cam_cpas_reg sbm_status;
+	struct cam_cpas_reg sbm_clear;
+};
+
+/**
+ * struct cam_camnoc_irq_err : Error settings specific to each CAMNOC IRQ
+ *
+ * @irq_type: Type of IRQ
+ * @enable: Whether to enable error settings for this IRQ
+ * @sbm_port: Corresponding SBM port for this IRQ
+ * @err_enable: Error enable settings for this IRQ
+ * @err_status: Error status settings for this IRQ
+ * @err_clear: Error clear settings for this IRQ
+ *
+ */
+struct cam_camnoc_irq_err {
+	enum cam_camnoc_hw_irq_type irq_type;
+	bool enable;
+	uint32_t sbm_port;
+	struct cam_cpas_reg err_enable;
+	struct cam_cpas_reg err_status;
+	struct cam_cpas_reg err_clear;
+};
+
+/**
+ * struct cam_cpas_hw_errata_wa : Struct for HW errata workaround info
+ *
+ * @enable: Whether to enable this errata workround
+ * @data: HW Errata workaround data
+ *
+ */
+struct cam_cpas_hw_errata_wa {
+	bool enable;
+	union {
+		struct cam_cpas_reg reg_info;
+	} data;
+};
+
+/**
+ * struct cam_cpas_hw_errata_wa_list : List of HW Errata workaround info
+ *
+ * @camnoc_flush_slave_pending_trans: Errata workaround info for flushing
+ *         camnoc slave pending transactions before turning off CPAS_TOP gdsc
+ * @tcsr_camera_hf_sf_ares_glitch: Errata workaround info from ignoring
+ *         erroneous signals at camera start
+ */
+struct cam_cpas_hw_errata_wa_list {
+	struct cam_cpas_hw_errata_wa camnoc_flush_slave_pending_trans;
+	struct cam_cpas_hw_errata_wa tcsr_camera_hf_sf_ares_glitch;
+};
+
+/**
+ * struct cam_camnoc_err_logger_info : CAMNOC error logger register offsets
+ *
+ * @mainctrl: Register offset for mainctrl
+ * @errvld: Register offset for errvld
+ * @errlog0_low: Register offset for errlog0_low
+ * @errlog0_high: Register offset for errlog0_high
+ * @errlog1_low: Register offset for errlog1_low
+ * @errlog1_high: Register offset for errlog1_high
+ * @errlog2_low: Register offset for errlog2_low
+ * @errlog2_high: Register offset for errlog2_high
+ * @errlog3_low: Register offset for errlog3_low
+ * @errlog3_high: Register offset for errlog3_high
+ *
+ */
+struct cam_camnoc_err_logger_info {
+	uint32_t mainctrl;
+	uint32_t errvld;
+	uint32_t errlog0_low;
+	uint32_t errlog0_high;
+	uint32_t errlog1_low;
+	uint32_t errlog1_high;
+	uint32_t errlog2_low;
+	uint32_t errlog2_high;
+	uint32_t errlog3_low;
+	uint32_t errlog3_high;
+};
+
+/**
+ * struct cam_camnoc_fifo_lvl_info : Struct for fifo fill level registers
+ * @IFE0_nRDI_maxwr_offset: Register offset for fill level for IFE0
+ * @IFE1_nRDI_maxwr_offset: Register offset for fill level for IFE1
+ * @IFE0123_RDI_maxwr_low_offset: Register offset for RDI
+ * @ife_linear: Register offset for ife linear
+ * @ife_rdi_wr: Register offset for rdi wr
+ * @ife_ubwc_stats: Register offset for ubwc stats
+ * @IFE02_MAXWR_LOW: Register offset for IFE02
+ * @IFE13_MAXWR_LOW: Register offset for IFE13
+ * @IFE01_MAXWR_LOW: Register offset for IFE01
+ * @IFE23_MAXWR_LOW: Register offset for IFE23
+ */
+struct cam_camnoc_fifo_lvl_info {
+	uint32_t IFE0_nRDI_maxwr_offset;
+	uint32_t IFE1_nRDI_maxwr_offset;
+	uint32_t IFE0123_RDI_maxwr_offset;
+	uint32_t ife_linear;
+	uint32_t ife_rdi_wr;
+	uint32_t ife_ubwc_stats;
+	uint32_t IFE02_MAXWR_LOW;
+	uint32_t IFE13_MAXWR_LOW;
+	uint32_t IFE01_MAXWR_LOW;
+	uint32_t IFE23_MAXWR_LOW;
+	uint32_t IFE0_MAXWR_LOW;
+	uint32_t IFE1_MAXWR_LOW;
+};
+
+/**
+ * struct cam_camnoc_info : Overall CAMNOC settings info
+ *
+ * @specific: Pointer to CAMNOC SPECIFICTONTTPTR settings
+ * @specific_size: Array size of SPECIFICTONTTPTR settings
+ * @irq_sbm: Pointer to CAMNOC IRQ SBM settings
+ * @irq_err: Pointer to CAMNOC IRQ Error settings
+ * @irq_err_size: Array size of IRQ Error settings
+ * @err_logger: Pointer to CAMNOC IRQ Error logger read registers
+ * @errata_wa_list: HW Errata workaround info
+ * @fill_level_register: Fill level registers
+ *
+ */
+struct cam_camnoc_info {
+	struct cam_camnoc_specific *specific;
+	int specific_size;
+	struct cam_camnoc_irq_sbm *irq_sbm;
+	struct cam_camnoc_irq_err *irq_err;
+	int irq_err_size;
+	struct cam_camnoc_err_logger_info *err_logger;
+	struct cam_cpas_hw_errata_wa_list *errata_wa_list;
+	struct cam_camnoc_fifo_lvl_info *fill_lvl_register;
+};
+
+/**
+ * struct cam_cpas_work_payload : Struct for cpas work payload data
+ *
+ * @hw: Pointer to HW info
+ * @irq_status: IRQ status value
+ * @irq_data: IRQ data
+ * @workq_scheduled_ts: workqueue scheduled timestamp
+ * @work: Work handle
+ *
+ */
+struct cam_cpas_work_payload {
+	struct cam_hw_info *hw;
+	uint32_t irq_status;
+	uint32_t irq_data;
+	ktime_t workq_scheduled_ts;
+	struct work_struct work;
+};
+
+/**
+ * struct cam_cpas_camnoc_qchannel : Cpas camnoc qchannel info
+ *
+ * @qchannel_ctrl: offset to configure to control camnoc qchannel interface
+ * @qchannel_status: offset to read camnoc qchannel interface status
+ *
+ */
+struct cam_cpas_camnoc_qchannel {
+	uint32_t qchannel_ctrl;
+	uint32_t qchannel_status;
+};
+
+#endif /* _CAM_CPASTOP_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop100.h
@@ -0,0 +1,566 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP100_H_
+#define _CPASTOP100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x3,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x3,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = false,
+	}
+};
+
+static struct cam_camnoc_err_logger_info cam170_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam170_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = true,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+struct cam_camnoc_info cam170_cpas100_camnoc_info = {
+	.specific = &cam_cpas100_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas100_camnoc_specific) /
+		sizeof(cam_cpas100_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas100_irq_sbm,
+	.irq_err = &cam_cpas100_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas100_irq_err) /
+		sizeof(cam_cpas100_irq_err[0]),
+	.err_logger = &cam170_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam170_cpas100_errata_wa_list,
+};
+
+#endif /* _CPASTOP100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v150_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v150_100.h
@@ -0,0 +1,569 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V150_100_H_
+#define _CPASTOP_V150_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v150_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v150_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v150_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 0x5,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam150_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam150_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+struct cam_camnoc_fifo_lvl_info cam150_cpas100_camnoc_fifo_info = {
+	.IFE02_MAXWR_LOW = 0x420,
+	.IFE13_MAXWR_LOW = 0x820,
+};
+
+static struct cam_camnoc_info cam150_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v150_100_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas_v150_100_camnoc_specific) /
+		sizeof(cam_cpas_v150_100_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas_v150_100_irq_sbm,
+	.irq_err = &cam_cpas_v150_100_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas_v150_100_irq_err) /
+		sizeof(cam_cpas_v150_100_irq_err[0]),
+	.err_logger = &cam150_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam150_cpas100_errata_wa_list,
+	.fill_lvl_register = &cam150_cpas100_camnoc_fifo_info,
+};
+
+#endif /* _CPASTOP_V150_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v165_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v165_100.h
@@ -0,0 +1,722 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+ #ifndef _CPASTOP_V165_100_H_
+ #define _CPASTOP_V165_100_H_
+
+ #define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v165_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2240, /* SBM_FAULTINEN0_LOW */
+		.value =  0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2248, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2280, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v165_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x4F08, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x4F10, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x4F18, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3BA0, /* SPECIFIC_IFE0_MAIN_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3B90,
+			/* SPECIFIC_IFE0_MAIN_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x3B98, /* SPECIFIC_IFE0_MAIN_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x55A0, /* SPECIFIC_IFE1_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5590, /* SPECIFIC_IFE1_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5598, /* SPECIFIC_IFE1_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2F20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2F10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2F18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2BA0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2B90,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2B98, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v165_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4230, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4234, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0, /* CDM_Urgency_Low */
+			.offset = 0x4238,
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4240, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4248, /* CDM_SAFELUT_LOW */
+			.value = 0xFFFF,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE01234_RDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3630, /* IFE01234_RDI_PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3634, /* IFE01234_RDI_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3638, /* IFE01234_RDI_LINEAR_URGENCY_LOW */
+			.mask = 0x1FF0,
+			.shift = 0x4,
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3640, /* IFE01234_RDI_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3648, /* IFE01234_RDI_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4808, /* IFE01234_RDI_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4820, /* IFE01234_RDI_QOSGEN_SHAPING_LOW */
+			.value = 0x07070707,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4824, /* IFE01234_RDI_QOSGEN_SHAPING_HIGH */
+			.value = 0x07070707,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE01_NRDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A30, /* IFE01_NRDI_PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A34, /* IFE01_NRDI_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3A38, /* IFE01_NRDI_URGENCY_LOW */
+			/* IFE01_NRDI_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x1FF0,
+			/* IFE01_NRDI_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A40, /* IFE01_NRDI_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A48, /* IFE01_NRDI_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		/* no reg for this */
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3B88, /* IFE01_NRDI_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4708, /* IFE01_NRDI_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4720, /* IFE01_NRDI_QOSGEN_SHAPING_LOW */
+			.value = 0x07070707,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4724, /* IFE01_NRDI_QOSGEN_SHAPING_HIGH */
+			.value = 0x07070707,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE2_NRDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5430, /* IFE2_NDRI_PRIORITYLUT_LOW */
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* IFE2_NRDI_PRIORITYLUT_HIGH */
+			.offset = 0x5434,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x5438, /* IFE2_NRDI_URGENCY_LOW */
+			/* IFE2_NRDI_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x1FF0,
+			/* IFE2_NRDI_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5440, /* IFE2_NRDI_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5448, /* IFE2_NRDI_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5588, /* IFE2_NRDI_ENCCTL_LOW */
+			.value = 0,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5188, /* IFE2_NRDI_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x51A0, /* IFE2_NRDI_QOSGEN_SHAPING_LOW */
+			.value = 0x07070707,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x51A4, /* IFE2_NRDI_QOSGEN_SHAPING_HIGH */
+			.value = 0x07070707,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* IPE_BPS_LRME_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333, /*Value is 0 in excel sheet */
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* IPE_BPS_LRME_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333, /*Value is 0 in excel sheet */
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2E38, /* IPE_BPS_LRME_RD_URGENCY_LOW */
+			/* IPE_BPS_LRME_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* IPE_BPS_LRME_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* IPE_BPS_LRME_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* IPE_BPS_LRME_RD_SAFELUT_LOW */
+			.value = 0xFFFF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2F08, /* IPE_BPS_LRME_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A30, /* IPE_BPS_LRME_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A34, /* IPE_BPS_LRME_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2A38, /* IPE_BPS_LRME_WR_URGENCY_LOW */
+			/* IPE_BPS_LRME_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* IPE_BPS_LRME_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A40, /* IPE_BPS_LRME_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A48, /* IPE_BPS_LRME_WR_SAFELUT_LOW */
+			.value = 0xFFFF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2B88, /* IPE_BPS_LRME_WR_ENCCTL_LOW */
+			.value = 0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2630, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2634, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2638, /* JPEG_URGENCY_LOW */
+			.mask = 0x3F,
+			.shift = 0x0,
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2640, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2648, /* JPEG_SAFELUT_LOW */
+			.value = 0xFFFF,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		/*SidebandManager_main_SidebandManager_FlagOutSet0_Low*/
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = false,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x5088,
+			.value = 0x50,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam165_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x4F08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x4F10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x4F20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x4F24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x4F28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x4F2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x4F30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x4F34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x4F38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x4F3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam165_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+struct cam_camnoc_fifo_lvl_info cam165_cpas100_camnoc_fifo_info = {
+	.IFE0_MAXWR_LOW = 0x3A20,
+	.IFE1_MAXWR_LOW = 0x5420,
+};
+
+static struct cam_camnoc_info cam165_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v165_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v165_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v165_100_irq_sbm,
+	.irq_err = &cam_cpas_v165_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v165_100_irq_err),
+	.err_logger = &cam165_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam165_cpas100_errata_wa_list,
+	.fill_lvl_register = &cam165_cpas100_camnoc_fifo_info,
+};
+
+#endif /* _CPASTOP_V165_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v170_110.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v170_110.h
@@ -0,0 +1,580 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V170_110_H_
+#define _CPASTOP_V170_110_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas110_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas110_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas110_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam170_cpas110_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam170_cpas110_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+struct cam_camnoc_fifo_lvl_info cam170_cpas110_camnoc_fifo_info = {
+	.IFE02_MAXWR_LOW = 0x420,
+	.IFE13_MAXWR_LOW = 0x820,
+};
+
+static struct cam_camnoc_info cam170_cpas110_camnoc_info = {
+	.specific = &cam_cpas110_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas110_camnoc_specific) /
+		sizeof(cam_cpas110_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas110_irq_sbm,
+	.irq_err = &cam_cpas110_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas110_irq_err) /
+		sizeof(cam_cpas110_irq_err[0]),
+	.err_logger = &cam170_cpas110_err_logger_offsets,
+	.errata_wa_list = &cam170_cpas110_errata_wa_list,
+	.fill_lvl_register = &cam170_cpas110_camnoc_fifo_info,
+};
+
+#endif /* _CPASTOP_V170_110_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v170_200.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v170_200.h
@@ -0,0 +1,581 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V170_200_H_
+#define _CPASTOP_V170_200_H_
+
+#define TEST_IRQ_ENABLE 0
+#define TCSR_CONN_RESET 0x0
+#define TCSR_CONN_SET  0x3
+
+static struct cam_camnoc_irq_sbm cam_cpas_v170_200_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v170_200_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v170_200_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam170_cpas200_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam170_cpas200_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+struct cam_camnoc_fifo_lvl_info cam170_cpas200_camnoc_fifo_info = {
+	.IFE01_MAXWR_LOW = 0x2420,
+	.IFE23_MAXWR_LOW = 0x2620,
+};
+
+static struct cam_camnoc_info cam170_cpas200_camnoc_info = {
+	.specific = &cam_cpas_v170_200_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v170_200_camnoc_specific),
+	.irq_sbm = &cam_cpas_v170_200_irq_sbm,
+	.irq_err = &cam_cpas_v170_200_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v170_200_irq_err),
+	.err_logger = &cam170_cpas200_err_logger_offsets,
+	.errata_wa_list = &cam170_cpas200_errata_wa_list,
+	.fill_lvl_register = &cam170_cpas200_camnoc_fifo_info,
+};
+
+#endif /* _CPASTOP_V170_200_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v175_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v175_100.h
@@ -0,0 +1,601 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V175_100_H_
+#define _CPASTOP_V175_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v175_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v175_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v175_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam175_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam175_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+struct cam_camnoc_fifo_lvl_info cam175_cpas100_camnoc_fifo_info = {
+	.IFE02_MAXWR_LOW = 0x420,
+	.IFE13_MAXWR_LOW = 0x820,
+};
+
+static struct cam_camnoc_info cam175_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v175_100_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas_v175_100_camnoc_specific) /
+		sizeof(cam_cpas_v175_100_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas_v175_100_irq_sbm,
+	.irq_err = &cam_cpas_v175_100_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas_v175_100_irq_err) /
+		sizeof(cam_cpas_v175_100_irq_err[0]),
+	.err_logger = &cam175_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam175_cpas100_errata_wa_list,
+	.fill_lvl_register = &cam175_cpas100_camnoc_fifo_info,
+};
+
+#endif /* _CPASTOP_V175_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v175_101.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v175_101.h
@@ -0,0 +1,601 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V175_101_H_
+#define _CPASTOP_V175_101_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v175_101_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2040, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2048, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2080, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v175_101_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2708, /* ERRLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2710, /* ERRLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2718, /* ERRLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE02_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5a0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x590, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x598, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE13_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x9a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x990, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x998, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xd20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xd10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xd18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x11a0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1190,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1198, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2088, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2090, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v175_101_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x38, /* SPECIFIC_CDM_URGENCY_LOW */
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE02,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* SPECIFIC_IFE02_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* SPECIFIC_IFE02_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x438, /* SPECIFIC_IFE02_URGENCY_LOW */
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE02_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* SPECIFIC_IFE02_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* SPECIFIC_IFE02_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x588, /* SPECIFIC_IFE02_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE13,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x830, /* SPECIFIC_IFE13_PRIORITYLUT_LOW */
+			.value = 0x66666543,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x834, /* SPECIFIC_IFE13_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x838, /* SPECIFIC_IFE13_URGENCY_LOW */
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE13_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x840, /* SPECIFIC_IFE13_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x848, /* SPECIFIC_IFE13_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x988, /* SPECIFIC_IFE13_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0xc38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xc48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xd08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x1038, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1040, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1048, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1188, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1440, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1448, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = false,
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam175_cpas101_err_logger_offsets = {
+	.mainctrl     =  0x2708, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2710, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2720, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2724, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2728, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x272c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2730, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2734, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2738, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x273c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam175_cpas101_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+struct cam_camnoc_fifo_lvl_info cam175_cpas101_camnoc_fifo_info = {
+	.IFE02_MAXWR_LOW = 0x420,
+	.IFE13_MAXWR_LOW = 0x820,
+};
+
+static struct cam_camnoc_info cam175_cpas101_camnoc_info = {
+	.specific = &cam_cpas_v175_101_camnoc_specific[0],
+	.specific_size = sizeof(cam_cpas_v175_101_camnoc_specific) /
+		sizeof(cam_cpas_v175_101_camnoc_specific[0]),
+	.irq_sbm = &cam_cpas_v175_101_irq_sbm,
+	.irq_err = &cam_cpas_v175_101_irq_err[0],
+	.irq_err_size = sizeof(cam_cpas_v175_101_irq_err) /
+		sizeof(cam_cpas_v175_101_irq_err[0]),
+	.err_logger = &cam175_cpas101_err_logger_offsets,
+	.errata_wa_list = &cam175_cpas101_errata_wa_list,
+	.fill_lvl_register = &cam175_cpas101_camnoc_fifo_info,
+};
+
+#endif /* _CPASTOP_V175_101_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v175_120.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v175_120.h
@@ -0,0 +1,828 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V175_120_H_
+#define _CPASTOP_V175_120_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v175_120_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2240, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2248, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2280, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v175_120_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x4F08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x4F10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x4F18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3BA0, /* SPECIFIC_IFE02_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3B90, /* SPECIFIC_IFE02_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x3B98, /* SPECIFIC_IFE02_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x55a0, /* SPECIFIC_IFE13_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5590, /* SPECIFIC_IFE13_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5598, /* SPECIFIC_IFE13_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2F20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2F10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2F18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2Ba0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2B90,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2B98, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v175_120_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4230, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4234, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			/* cdm_main_SpecificToNttpTr_Urgency_Low */
+			.offset = 0x4238,
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4240, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4248, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE0123_RDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE0123_PRIORITYLUT_LOW */
+			.offset = 0x3630,
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE0123_PRIORITYLUT_HIGH */
+			.offset = 0x3634,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3638, /* SPECIFIC_IFE0123_URGENCY_LOW */
+			/* SPECIFIC_IFE0123_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE0123_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3640, /* SPECIFIC_IFE0123_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3648, /* SPECIFIC_IFE0123_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE0_NRDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A30, /* SPECIFIC_IFE0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A34, /* SPECIFIC_IFE0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3A38, /* SPECIFIC_IFE0_URGENCY_LOW */
+			/* SPECIFIC_IFE0_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE0_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A40, /* SPECIFIC_IFE0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A48, /* SPECIFIC_IFE0_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3B88, /* SPECIFIC_IFE0_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		/* IFE0/1 RDI READ PATH */
+		.port_type = CAM_CAMNOC_IFE01_RDI_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3230, /* SPECIFIC_IFE1_PRIORITYLUT_LOW */
+			.value = 0x44443333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3234, /* SPECIFIC_IFE1_PRIORITYLUT_HIGH */
+			.value = 0x66665555,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3238, /* SPECIFIC_IFE1_URGENCY_LOW */
+			/* SPECIFIC_IFE1_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IFE1_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3240, /* SPECIFIC_IFE1_DANGERLUT_LOW */
+			.value = 0x00000000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3248, /* SPECIFIC_IFE1_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE1_NRDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5430, /* SPECIFIC_IFE1_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE1_WR_PRIORITYLUT_HIGH */
+			.offset = 0x5434,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x5438, /* SPECIFIC_IFE1_WR_URGENCY_LOW */
+			/* SPECIFIC_IFE1_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE1_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5440, /* SPECIFIC_IFE1_WR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5448, /* SPECIFIC_IFE1_WR_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5588, /* SPECIFIC_IFE1_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2E38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2F08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A30, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A34, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2A38, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A40, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A48, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2B88, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_VID_DISP_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_PRIORITYLUT_LOW */
+			.offset = 0x5E30,
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_PRIORITYLUT_HIGH */
+			.offset = 0x5E34,
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW */
+			.offset = 0x5E38,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW_READ_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC__IPE_VID_DISP_DANGERLUT_LOW */
+			.offset = 0x5E40,
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_SAFELUT_LOW */
+			.offset = 0x5E48,
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5F88, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2630, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2634, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2638, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2640, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2648, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E30, /* SPECIFIC_FD_PRIORITYLUT_LOW */
+			.value = 0x44444444,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E34, /* SPECIFIC_FD_PRIORITYLUT_HIGH */
+			.value = 0x44444444,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E38, /* SPECIFIC_FD_URGENCY_LOW */
+			.value = 0x44,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E40, /* SPECIFIC_FD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E48, /* SPECIFIC_FD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+
+	},
+	{
+		/*SidebandManager_main_SidebandManager_FlagOutSet0_Low*/
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2288,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam175_cpas120_err_logger_offsets = {
+	.mainctrl     =  0x4F08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x4F10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x4F20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x4F24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x4F28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x4F2c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x4F30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x4F34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x4F38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x4F3c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam175_cpas120_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_fifo_lvl_info cam175_cpas120_camnoc_fifo_info = {
+	.IFE0_nRDI_maxwr_offset = 0x3A20,
+	.IFE1_nRDI_maxwr_offset = 0x5420,
+	.IFE0123_RDI_maxwr_offset = 0x3620,
+};
+
+static struct cam_camnoc_info cam175_cpas120_camnoc_info = {
+	.specific = &cam_cpas_v175_120_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v175_120_camnoc_specific),
+	.irq_sbm = &cam_cpas_v175_120_irq_sbm,
+	.irq_err = &cam_cpas_v175_120_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v175_120_irq_err),
+	.err_logger = &cam175_cpas120_err_logger_offsets,
+	.errata_wa_list = &cam175_cpas120_errata_wa_list,
+	.fill_lvl_register = &cam175_cpas120_camnoc_fifo_info,
+};
+
+#endif /* _CPASTOP_V175_120_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v175_130.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v175_130.h
@@ -0,0 +1,841 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V175_130_H_
+#define _CPASTOP_V175_130_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v175_130_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2240, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 | /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x100 : /* SBM_FAULTINEN0_LOW_PORT8_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2248, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2280, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x6 : 0x2,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v175_130_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x4F08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x4F10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x4F18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE0_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3BA0, /* SPECIFIC_IFE0_MAIN_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			/* SPECIFIC_IFE0_MAIN_ENCERRSTATUS_LOW */
+			.offset = 0x3B90,
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x3B98, /* SPECIFIC_IFE0_MAIN_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x55A0, /* SPECIFIC_IFE1_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			/* SPECIFIC_IFE1_WR_ENCERRSTATUS_LOW */
+			.offset = 0x5590,
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5598, /* SPECIFIC_IFE1_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2F20, /* SPECIFIC_IBL_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2F10, /* SPECIFIC_IBL_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2F18, /* SPECIFIC_IBL_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2BA0, /* SPECIFIC_IBL_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2B90,
+			/* SPECIFIC_IBL_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2B98, /* SPECIFIC_IBL_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x100, /* SBM_FAULTINSTATUS0_LOW_PORT8_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v175_130_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4230, /* SPECIFIC_CDM_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4234, /* SPECIFIC_CDM_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			/* cdm_main_SpecificToNttpTr_Urgency_Low */
+			.offset = 0x4238,
+			.mask = 0x7, /* SPECIFIC_CDM_URGENCY_LOW_READ_MASK */
+			.shift = 0x0, /* SPECIFIC_CDM_URGENCY_LOW_READ_SHIFT */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4240, /* SPECIFIC_CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4248, /* SPECIFIC_CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE0123_RDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE0123_PRIORITYLUT_LOW */
+			.offset = 0x3630,
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE0123_PRIORITYLUT_HIGH */
+			.offset = 0x3634,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3638, /* SPECIFIC_IFE0123_URGENCY_LOW */
+			/* SPECIFIC_IFE0123_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE0123_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3640, /* SPECIFIC_IFE0123_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3648, /* SPECIFIC_IFE0123_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE0_NRDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A30, /* SPECIFIC_IFE0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3A34, /* SPECIFIC_IFE0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3A38, /* SPECIFIC_IFE0_URGENCY_LOW */
+			/* SPECIFIC_IFE0_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE0_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A40, /* SPECIFIC_IFE0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3A48, /* SPECIFIC_IFE0_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3B88, /* SPECIFIC_IFE0_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		/* IFE0/1 RDI READ PATH */
+		.port_type = CAM_CAMNOC_IFE01_RDI_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3230, /* SPECIFIC_IFE1_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3234, /* SPECIFIC_IFE1_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x3238, /* SPECIFIC_IFE1_URGENCY_LOW */
+			/* SPECIFIC_IFE1_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IFE1_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x0,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3240, /* SPECIFIC_IFE1_DANGERLUT_LOW */
+			.value = 0x00000000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x3248, /* SPECIFIC_IFE1_SAFELUT_LOW */
+			.value = 0xFFFFFFFF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE1_NRDI_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5430, /* SPECIFIC_IFE1_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IFE1_WR_PRIORITYLUT_HIGH */
+			.offset = 0x5434,
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x5438, /* SPECIFIC_IFE1_WR_URGENCY_LOW */
+			/* SPECIFIC_IFE1_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IFE1_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5440, /* SPECIFIC_IFE1_WR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5448, /* SPECIFIC_IFE1_WR_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5588, /* SPECIFIC_IFE1_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_READ,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* SPECIFIC_IBL_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* SPECIFIC_IBL_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2E38, /* SPECIFIC_IBL_RD_URGENCY_LOW */
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_MASK */
+			.mask = 0x7,
+			/* SPECIFIC_IBL_RD_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x0,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* SPECIFIC_IBL_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* SPECIFIC_IBL_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2F08, /* SPECIFIC_IBL_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_LRME_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A30, /* SPECIFIC_IBL_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A34, /* SPECIFIC_IBL_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			.offset = 0x2A38, /* SPECIFIC_IBL_WR_URGENCY_LOW */
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IBL_WR_URGENCY_LOW_WRITE_SHIFT */
+			.shift = 0x4,
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A40, /* SPECIFIC_IBL_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2A48, /* SPECIFIC_IBL_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2B88, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_VID_DISP_WRITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_PRIORITYLUT_LOW */
+			.offset = 0x5E30,
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_PRIORITYLUT_HIGH */
+			.offset = 0x5E34,
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 1,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW */
+			.offset = 0x5E38,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW_READ_MASK */
+			.mask = 0x70,
+			/* SPECIFIC_IPE_VID_DISP_URGENCY_LOW_READ_SHIFT */
+			.shift = 0x4,
+			.value = 3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC__IPE_VID_DISP_DANGERLUT_LOW */
+			.offset = 0x5E40,
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* SPECIFIC_IPE_VID_DISP_SAFELUT_LOW */
+			.offset = 0x5E48,
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5F88, /* SPECIFIC_IBL_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2630, /* SPECIFIC_JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2634, /* SPECIFIC_JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2638, /* SPECIFIC_JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2640, /* SPECIFIC_JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2648, /* SPECIFIC_JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E30, /* SPECIFIC_FD_PRIORITYLUT_LOW */
+			.value = 0x44444444,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E34, /* SPECIFIC_FD_PRIORITYLUT_HIGH */
+			.value = 0x44444444,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E38, /* SPECIFIC_FD_URGENCY_LOW */
+			.value = 0x44,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E40, /* SPECIFIC_FD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3E48, /* SPECIFIC_FD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+
+	},
+	{
+		/*SidebandManager_main_SidebandManager_FlagOutSet0_Low*/
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2288,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam175_cpas130_err_logger_offsets = {
+	.mainctrl     =  0x4F08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x4F10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x4F20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x4F24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x4F28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x4F2c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x4F30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x4F34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x4F38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x4F3c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam175_cpas130_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+	/* TZ owned register */
+	.tcsr_camera_hf_sf_ares_glitch = {
+		.enable = true,
+		.data.reg_info = {
+			.enable = true,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			/* TCSR_CAMERA_HF_SF_ARES_GLITCH_MASK */
+			.offset = 0x01FCA08C,
+			.value = 0x4, /* set bit[2] to 1 */
+		},
+	},
+};
+
+static struct cam_camnoc_fifo_lvl_info cam175_cpas130_camnoc_fifo_info = {
+	.IFE0_nRDI_maxwr_offset = 0x3A20,
+	.IFE1_nRDI_maxwr_offset = 0x5420,
+	.IFE0123_RDI_maxwr_offset = 0x3620,
+};
+
+static struct cam_camnoc_info cam175_cpas130_camnoc_info = {
+	.specific = &cam_cpas_v175_130_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v175_130_camnoc_specific),
+	.irq_sbm = &cam_cpas_v175_130_irq_sbm,
+	.irq_err = &cam_cpas_v175_130_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v175_130_irq_err),
+	.err_logger = &cam175_cpas130_err_logger_offsets,
+	.errata_wa_list = &cam175_cpas130_errata_wa_list,
+	.fill_lvl_register = &cam175_cpas130_camnoc_fifo_info,
+};
+
+#endif /* _CPASTOP_V175_130_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v480_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v480_100.h
@@ -0,0 +1,779 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V480_100_H_
+#define _CPASTOP_V480_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v480_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x40 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v480_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90, /* IFE_UBWC_STATS_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v480_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x630, /* FD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x634, /* FD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x638, /* FD_URGENCY_LOW */
+			.value = 0x33,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x640, /* FD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x648, /* FD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34, /* IFE_UBWC_STATS_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam480_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam480_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2100, /* SidebandManager_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+struct cam_camnoc_fifo_lvl_info cam480_cpas100_camnoc_fifo_info = {
+	.ife_linear = 0xA20,
+	.ife_rdi_wr = 0x1420,
+	.ife_ubwc_stats = 0x1A20,
+};
+
+static struct cam_camnoc_info cam480_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v480_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v480_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v480_100_irq_sbm,
+	.irq_err = &cam_cpas_v480_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v480_100_irq_err),
+	.err_logger = &cam480_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam480_cpas100_errata_wa_list,
+	.fill_lvl_register = &cam480_cpas100_camnoc_fifo_info,
+};
+
+#endif /* _CPASTOP_V480_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v480_custom.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v480_custom.h
@@ -0,0 +1,760 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V480_CUSTOM_H_
+#define _CPASTOP_V480_CUSTOM_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v480_custom_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x40 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v480_custom_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90, /* IFE_UBWC_STATS_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v480_custom_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_FD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x630, /* FD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x634, /* FD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x638, /* FD_URGENCY_LOW */
+			.value = 0x33,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x640, /* FD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x648, /* FD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_URGENCY_LOW */
+			.value = 0x1070,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_DANGERLUT_LOW */
+			.value = 0xFFFFFFF0,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_SAFELUT_LOW */
+			.value = 0x1,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34, /* IFE_UBWC_STATS_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2088,
+			.value = 0x100000,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam480_custom_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_camnoc_info cam480_custom_camnoc_info = {
+	.specific = &cam_cpas_v480_custom_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v480_custom_camnoc_specific),
+	.irq_sbm = &cam_cpas_v480_custom_irq_sbm,
+	.irq_err = &cam_cpas_v480_custom_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v480_custom_irq_err),
+	.err_logger = &cam480_custom_err_logger_offsets,
+	.errata_wa_list = &cam480_cpas100_errata_wa_list,
+};
+
+#endif /* _CPASTOP_V480_CUSTOM_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v520_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v520_100.h
@@ -0,0 +1,262 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V520_100_H_
+#define _CPASTOP_V520_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v520_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0xA40, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			(TEST_IRQ_ENABLE ?
+			0x2 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0) /* SBM_FAULTINEN0_LOW_PORT1_MASK */,
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0xA48, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0xA80, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x3 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v520_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xD08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xD10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xD18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xA88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xA90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+
+static struct cam_camnoc_specific
+	cam_cpas_v520_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE38, /* CDM_URGENCY_LOW */
+			.value = 0x00000003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x30,
+			.value = 0x44443333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x34,
+			.value = 0x66665555,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x40, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x48, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* OPE_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* OPE_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x438, /* OPE_URGENCY_LOW */
+			.value = 0x00000033,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* OPE_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* OPE_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam520_cpas100_err_logger_offsets = {
+	.mainctrl     =  0xD08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0xD10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0xD20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0xD24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0xD28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0xD2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0xD30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0xD34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0xD38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0xD3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_camnoc_info cam520_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v520_100_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v520_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v520_100_irq_sbm,
+	.irq_err = &cam_cpas_v520_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v520_100_irq_err),
+	.err_logger = &cam520_cpas100_err_logger_offsets,
+	.errata_wa_list = NULL,
+};
+
+static struct cam_cpas_camnoc_qchannel cam520_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+#endif /* _CPASTOP_V520_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v520_110.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v520_110.h
@@ -0,0 +1,262 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V520_110_H_
+#define _CPASTOP_V520_110_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v520_110_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0xA40, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			(TEST_IRQ_ENABLE ?
+			0x2 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0) /* SBM_FAULTINEN0_LOW_PORT1_MASK */,
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0xA48, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0xA80, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x3 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v520_110_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xD08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xD10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xD18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xA88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xA90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+
+static struct cam_camnoc_specific
+	cam_cpas_v520_110_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE38, /* CDM_URGENCY_LOW */
+			.value = 0x00000003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x30,
+			.value = 0x44443333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x34,
+			.value = 0x66665555,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x40, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x48, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* OPE_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* OPE_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x438, /* OPE_URGENCY_LOW */
+			.value = 0x00000033,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* OPE_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* OPE_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam520_cpas110_err_logger_offsets = {
+	.mainctrl     =  0xD08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0xD10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0xD20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0xD24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0xD28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0xD2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0xD30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0xD34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0xD38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0xD3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_camnoc_info cam520_cpas110_camnoc_info = {
+	.specific = &cam_cpas_v520_110_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v520_110_camnoc_specific),
+	.irq_sbm = &cam_cpas_v520_110_irq_sbm,
+	.irq_err = &cam_cpas_v520_110_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v520_110_irq_err),
+	.err_logger = &cam520_cpas110_err_logger_offsets,
+	.errata_wa_list = NULL,
+};
+
+static struct cam_cpas_camnoc_qchannel cam520_cpas110_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+#endif /* _CPASTOP_V520_110_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v540_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v540_100.h
@@ -0,0 +1,263 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V540_100_H_
+#define _CPASTOP_V540_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v540_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0xA40, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			(TEST_IRQ_ENABLE ?
+			0x2 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0) /* SBM_FAULTINEN0_LOW_PORT1_MASK */,
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0xA48, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0xA80, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x3 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v540_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xD08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xD10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xD18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xA88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xA90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+
+// TODO: Need to update cam_cpas_v540_100_camnoc_specific values based on QoS
+static struct cam_camnoc_specific
+	cam_cpas_v540_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE38, /* CDM_URGENCY_LOW */
+			.value = 0x00000003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x30,
+			.value = 0x44443333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x34,
+			.value = 0x66665555,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x40, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x48, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* OPE_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* OPE_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x438, /* OPE_URGENCY_LOW */
+			.value = 0x00000033,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* OPE_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* OPE_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam540_cpas100_err_logger_offsets = {
+	.mainctrl     =  0xD08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0xD10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0xD20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0xD24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0xD28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0xD2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0xD30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0xD34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0xD38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0xD3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_camnoc_info cam540_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v540_100_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v540_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v540_100_irq_sbm,
+	.irq_err = &cam_cpas_v540_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v540_100_irq_err),
+	.err_logger = &cam540_cpas100_err_logger_offsets,
+	.errata_wa_list = NULL,
+};
+
+static struct cam_cpas_camnoc_qchannel cam540_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+#endif /* _CPASTOP_V540_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v545_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v545_100.h
@@ -0,0 +1,350 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V545_100_H_
+#define _CPASTOP_V545_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v545_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0xA40, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			(TEST_IRQ_ENABLE ?
+			0x2 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0) /* SBM_FAULTINEN0_LOW_PORT1_MASK */,
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0xA48, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0xA80, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x3 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v545_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xD08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xD10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xD18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xA88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xA90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+
+static struct cam_camnoc_specific
+	cam_cpas_v545_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE38, /* CDM_URGENCY_LOW */
+			.value = 0x00000003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x30,
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x34,
+			.value = 0x66666655,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x40, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x48, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_1,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x4030,
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x4034,
+			.value = 0x66666655,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4038, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x4040, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x4048, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_2,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x5030,
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x5034,
+			.value = 0x66666655,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5038, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5040, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5048, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* OPE_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* OPE_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x438, /* OPE_URGENCY_LOW */
+			.value = 0x00000033,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* OPE_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* OPE_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam545_cpas100_err_logger_offsets = {
+	.mainctrl     =  0xD08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0xD10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0xD20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0xD24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0xD28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0xD2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0xD30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0xD34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0xD38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0xD3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_camnoc_info cam545_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v545_100_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v545_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v545_100_irq_sbm,
+	.irq_err = &cam_cpas_v545_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v545_100_irq_err),
+	.err_logger = &cam545_cpas100_err_logger_offsets,
+	.errata_wa_list = NULL,
+};
+
+static struct cam_cpas_camnoc_qchannel cam545_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+#endif /* _CPASTOP_V545_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v545_110.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v545_110.h
@@ -0,0 +1,350 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V545_110_H_
+#define _CPASTOP_V545_110_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v545_110_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0xA40, /* SBM_FAULTINEN0_LOW */
+		.value = 0x1 | /* SBM_FAULTINEN0_LOW_PORT0_MASK*/
+			(TEST_IRQ_ENABLE ?
+			0x2 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0) /* SBM_FAULTINEN0_LOW_PORT1_MASK */,
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0xA48, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0xA80, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x3 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v545_110_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xD08, /* ERRORLOGGER_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xD10, /* ERRORLOGGER_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0xD18, /* ERRORLOGGER_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0xA88, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0xA90, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+
+static struct cam_camnoc_specific
+	cam_cpas_v545_110_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE38, /* CDM_URGENCY_LOW */
+			.value = 0x00000003,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x30,
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x34,
+			.value = 0x66666655,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x40, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x48, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_1,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x4030,
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x4034,
+			.value = 0x66666655,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4038, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x4040, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x4048, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_TFE_2,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_LOW */
+			.offset = 0x5030,
+			.value = 0x55554433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			/* TFE_PRIORITYLUT_HIGH */
+			.offset = 0x5034,
+			.value = 0x66666655,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5038, /* TFE_URGENCY_LOW */
+			.value = 0x00001030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5040, /* TFE_DANGERLUT_LOW */
+			.value = 0xffff0000,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x5048, /* TFE_SAFELUT_LOW */
+			.value = 0x00000003,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_OPE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x430, /* OPE_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x434, /* OPE_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x438, /* OPE_URGENCY_LOW */
+			.value = 0x00000033,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x440, /* OPE_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x448, /* OPE_SAFELUT_LOW */
+			.value = 0xF,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam545_cpas110_err_logger_offsets = {
+	.mainctrl     =  0xD08, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0xD10, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0xD20, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0xD24, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0xD28, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0xD2C, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0xD30, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0xD34, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0xD38, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0xD3C, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_camnoc_info cam545_cpas110_camnoc_info = {
+	.specific = &cam_cpas_v545_110_camnoc_specific[0],
+	.specific_size =  ARRAY_SIZE(cam_cpas_v545_110_camnoc_specific),
+	.irq_sbm = &cam_cpas_v545_110_irq_sbm,
+	.irq_err = &cam_cpas_v545_110_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v545_110_irq_err),
+	.err_logger = &cam545_cpas110_err_logger_offsets,
+	.errata_wa_list = NULL,
+};
+
+static struct cam_cpas_camnoc_qchannel cam545_cpas110_qchannel_info = {
+	.qchannel_ctrl   = 0x14,
+	.qchannel_status = 0x18,
+};
+#endif /* _CPASTOP_V545_110_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v570_200.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v570_200.h
@@ -0,0 +1,974 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V570_200_H_
+#define _CPASTOP_V570_200_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v570_200_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x1000 | /* SBM_FAULTINEN0_LOW_PORT12_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x40 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v570_200_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_0_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90,
+			/* IFE_UBWC_STATS_0_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_0_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v570_200_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x408, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x420, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x424, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE08, /* IFE_LINEAR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE20, /* IFE_LINEAR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE24, /* IFE_LINEAR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF08, /* IFE_RDI_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF20, /* IFE_RDI_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF24, /* IFE_RDI_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_0_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1808, /* IFE_RDI_WR_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1820, /* IFE_RDI_WR_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1824, /* IFE_RDI_WR_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_0_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34,
+			/* IFE_UBWC_STATS_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_UBWC_STATS_0_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1908, /* IFE_UBWC_STATS_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1920,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1924,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2208, /* IPE0_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2220, /* IPE0_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x12121212,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2224, /* IPE0_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x12121212,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2308, /* IPE1_BPS_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		//  TITAN_A_CAMNOC_cam_noc_amm_nrt_niu_0_qosgen_Shaping_Low
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2320, /* IPE1_BPS_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x23232323,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2324, /* IPE1_BPS_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x23232323,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C08, /* IPE_BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C20, /* IPE_BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C24, /* IPE_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D08, /* JPEG_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D20, /* JPEG_QOSGEN_SHAPING_LOW */
+			.value = 0xA0A0A0A,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D24, /* JPEG_QOSGEN_SHAPING_HIGH */
+			.value = 0xA0A0A0A,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x3888,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3488, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam570_cpas200_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam570_cpas200_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x3900, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam570_cpas200_camnoc_info = {
+	.specific = &cam_cpas_v570_200_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v570_200_camnoc_specific),
+	.irq_sbm = &cam_cpas_v570_200_irq_sbm,
+	.irq_err = &cam_cpas_v570_200_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v570_200_irq_err),
+	.err_logger = &cam570_cpas200_err_logger_offsets,
+	.errata_wa_list = &cam570_cpas200_errata_wa_list,
+};
+
+static struct cam_cpas_camnoc_qchannel cam570_cpas200_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+#endif /* _CPASTOP_V570_200_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v580_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v580_100.h
@@ -0,0 +1,1154 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V580_100_H_
+#define _CPASTOP_V580_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v580_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x1000 | /* SBM_FAULTINEN0_LOW_PORT12_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x40 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v580_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_0_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90,
+			/* IFE_UBWC_STATS_0_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_0_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1000, /* SBM_FAULTINSTATUS0_LOW_PORT12_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x77A0, /* IFE_UBWC_STATS_1_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7790,
+			/* IFE_UBWC_STATS_1_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7798, /* IFE_UBWC_STATS_1_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v580_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x408, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x420, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x424, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE08, /* IFE_LINEAR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE20, /* IFE_LINEAR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE24, /* IFE_LINEAR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF08, /* IFE_RDI_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF20, /* IFE_RDI_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF24, /* IFE_RDI_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1808, /* IFE_RDI_WR_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1820, /* IFE_RDI_WR_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1824, /* IFE_RDI_WR_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR_1,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7430, /* IFE_RDI_WR_1_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7434, /* IFE_RDI_WR_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7438, /* IFE_RDI_WR_1_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7440, /* IFE_RDI_WR_1_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7448, /* IFE_RDI_WR_1_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C08, /* IFE_RDI_WR_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C20, /* IFE_RDI_WR_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C24, /* IFE_RDI_WR_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34,
+			/* IFE_UBWC_STATS_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_UBWC_STATS_0_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1908, /* IFE_UBWC_STATS_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1920,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1924,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS_1,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7630, /* IFE_UBWC_STATS_1_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7634,
+			/* IFE_UBWC_STATS_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7638, /* IFE_UBWC_STATS_1_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7640, /* IFE_UBWC_STATS_1_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7648, /* IFE_UBWC_STATS_1_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7788, /* IFE_UBWC_STATS_1_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C88, /* IFE_UBWC_STATS_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7CA0,
+			/* IFE_UBWC_STATS_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7CA4,
+			/* IFE_UBWC_STATS_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2208, /* IPE0_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2220, /* IPE0_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x13131313,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2224, /* IPE0_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x13131313,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2308, /* IPE1_BPS_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2320, /* IPE1_BPS_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x24242424,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2324, /* IPE1_BPS_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x24242424,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C08, /* IPE_BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C20, /* IPE_BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C24, /* IPE_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D08, /* JPEG_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D20, /* JPEG_QOSGEN_SHAPING_LOW */
+			.value = 0x10101010,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D24, /* JPEG_QOSGEN_SHAPING_HIGH */
+			.value = 0x10101010,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x3888,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3488, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam580_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam580_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x3900, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam580_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v580_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v580_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v580_100_irq_sbm,
+	.irq_err = &cam_cpas_v580_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v580_100_irq_err),
+	.err_logger = &cam580_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam580_cpas100_errata_wa_list,
+};
+
+static struct cam_cpas_camnoc_qchannel cam580_cpas100_qchannel_info = {
+	.qchannel_ctrl   = 0x5C,
+	.qchannel_status = 0x60,
+};
+#endif /* _CPASTOP_V580_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v580_custom.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v580_custom.h
@@ -0,0 +1,1150 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V580_CUSTOM_H_
+#define _CPASTOP_V580_CUSTOM_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v580_custom_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x3840, /* SBM_FAULTINEN0_LOW */
+		.value = 0x2 | /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x4 | /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x8 | /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 | /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x1000 | /* SBM_FAULTINEN0_LOW_PORT12_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x40 : /* SBM_FAULTINEN0_LOW_PORT6_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x3848, /* SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x3880, /* SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v580_custom_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7008, /* ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7010, /* ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7018, /* ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1BA0, /* IFE_UBWC_STATS_0_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1B90,
+			/* IFE_UBWC_STATS_0_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1B98, /* IFE_UBWC_STATS_0_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2520, /* IPE1_BPS_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2510, /* IPE1_BPS_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2518, /* IPE1_BPS_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x1F20, /* IPE0_RD_DECERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x1F10, /* IPE0_RD_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x1F18, /* IPE0_RD_DECERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x29A0, /* IPE_BPS_WR_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2990,
+			/* IPE_BPS_WR_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2998, /* IPE_BPS_WR_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x3888, /* SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x3890, /* SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x1000, /* SBM_FAULTINSTATUS0_LOW_PORT12_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x77A0, /* IFE_UBWC_STATS_1_ENCERREN_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x7790,
+			/* IFE_UBWC_STATS_1_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x7798, /* IFE_UBWC_STATS_1_ENCERRCLR_LOW */
+			.value = 1,
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v580_custom_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* CDM_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x408, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x420, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x424, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA30, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA34, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xA38, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA40, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0xA48, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE08, /* IFE_LINEAR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE20, /* IFE_LINEAR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xE24, /* IFE_LINEAR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1030, /* IFE_RDI_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1034, /* IFE_RDI_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1038, /* IFE_RDI_RD_URGENCY_LOW */
+			.value = 0x2,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1040, /* IFE_RDI_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1048, /* IFE_RDI_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF08, /* IFE_RDI_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF20, /* IFE_RDI_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0xF24, /* IFE_RDI_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1430, /* IFE_RDI_WR_0_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1434, /* IFE_RDI_WR_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1438, /* IFE_RDI_WR_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1440, /* IFE_RDI_WR_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1448, /* IFE_RDI_WR_0_SAFELUT_LOW */
+			.value = 0x0000,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1808, /* IFE_RDI_WR_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1820, /* IFE_RDI_WR_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1824, /* IFE_RDI_WR_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR_1,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7430, /* IFE_RDI_WR_1_PRIORITYLUT_LOW */
+			.value = 0x66666666,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7434, /* IFE_RDI_WR_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7438, /* IFE_RDI_WR_1_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7440, /* IFE_RDI_WR_1_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7448, /* IFE_RDI_WR_1_SAFELUT_LOW */
+			.value = 0x0000,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C08, /* IFE_RDI_WR_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C20, /* IFE_RDI_WR_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C24, /* IFE_RDI_WR_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A30, /* IFE_UBWC_STATS_0_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A34,
+			/* IFE_UBWC_STATS_0_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1A38, /* IFE_UBWC_STATS_0_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A40, /* IFE_UBWC_STATS_0_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x1A48, /* IFE_UBWC_STATS_0_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1B88, /* IFE_UBWC_STATS_0_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1908, /* IFE_UBWC_STATS_0_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1920,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1924,
+			/* IFE_UBWC_STATS_0_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC_STATS_1,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7630, /* IFE_UBWC_STATS_1_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7634,
+			/* IFE_UBWC_STATS_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7638, /* IFE_UBWC_STATS_1_URGENCY_LOW */
+			.value = 0x1030,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7640, /* IFE_UBWC_STATS_1_DANGERLUT_LOW */
+			.value = 0xFFFFFF00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.offset = 0x7648, /* IFE_UBWC_STATS_1_SAFELUT_LOW */
+			.value = 0x000F,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7788, /* IFE_UBWC_STATS_1_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7C88, /* IFE_UBWC_STATS_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7CA0,
+			/* IFE_UBWC_STATS_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7CA4,
+			/* IFE_UBWC_STATS_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x1F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2208, /* IPE0_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2220, /* IPE0_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x13131313,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2224, /* IPE0_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x13131313,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_BPS_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2430, /* IPE1_BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2434, /* IPE1_BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2438, /* IPE1_BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2440, /* IPE1_BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2448, /* IPE1_BPS_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2508, /* IPE1_BPS_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2308, /* IPE1_BPS_RD_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2320, /* IPE1_BPS_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x24242424,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2324, /* IPE1_BPS_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x24242424,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_BPS_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2830, /* IPE_BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2834, /* IPE_BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2838, /* IPE_BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2840, /* IPE_BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2848, /* IPE_BPS_WR_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2988, /* IPE_BPS_WR_ENCCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C08, /* IPE_BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C20, /* IPE_BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2C24, /* IPE_BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2E48, /* JPEG_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D08, /* JPEG_QOSGEN_MAINCTL */
+			.value = 0x2,
+		},
+		.qosgen_shaping_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D20, /* JPEG_QOSGEN_SHAPING_LOW */
+			.value = 0x10101010,
+		},
+		.qosgen_shaping_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x2D24, /* JPEG_QOSGEN_SHAPING_HIGH */
+			.value = 0x10101010,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x3888,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3488, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam580_custom_err_logger_offsets = {
+	.mainctrl     =  0x7008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x7010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x7020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x7024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x7028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x702c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x7030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x7034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x7038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x703c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam580_custom_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x3900, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam580_custom_camnoc_info = {
+	.specific = &cam_cpas_v580_custom_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v580_custom_camnoc_specific),
+	.irq_sbm = &cam_cpas_v580_custom_irq_sbm,
+	.irq_err = &cam_cpas_v580_custom_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v580_custom_irq_err),
+	.err_logger = &cam580_custom_err_logger_offsets,
+	.errata_wa_list = &cam580_custom_errata_wa_list,
+};
+
+#endif /* _CPASTOP_V580_CUSTOM_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v680_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/cpas_top/cpastop_v680_100.h
@@ -0,0 +1,1343 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CPASTOP_V680_100_H_
+#define _CPASTOP_V680_100_H_
+
+#define TEST_IRQ_ENABLE 0
+
+static struct cam_camnoc_irq_sbm cam_cpas_v680_100_irq_sbm = {
+	.sbm_enable = {
+		.access_type = CAM_REG_TYPE_READ_WRITE,
+		.enable = true,
+		.offset = 0x2240, /* CAM_NOC_SBM_FAULTINEN0_LOW */
+		.value = 0x2 |    /* SBM_FAULTINEN0_LOW_PORT1_MASK */
+			0x04 |     /* SBM_FAULTINEN0_LOW_PORT2_MASK */
+			0x08 |     /* SBM_FAULTINEN0_LOW_PORT3_MASK */
+			0x10 |    /* SBM_FAULTINEN0_LOW_PORT4_MASK */
+			0x20 |    /* SBM_FAULTINEN0_LOW_PORT5_MASK */
+			(TEST_IRQ_ENABLE ?
+			0x80 :    /* SBM_FAULTINEN0_LOW_PORT7_MASK */
+			0x0),
+	},
+	.sbm_status = {
+		.access_type = CAM_REG_TYPE_READ,
+		.enable = true,
+		.offset = 0x2248, /* CAM_NOC_SBM_FAULTINSTATUS0_LOW */
+	},
+	.sbm_clear = {
+		.access_type = CAM_REG_TYPE_WRITE,
+		.enable = true,
+		.offset = 0x2280, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		.value = TEST_IRQ_ENABLE ? 0x5 : 0x1,
+	}
+};
+
+static struct cam_camnoc_irq_err
+	cam_cpas_v680_100_irq_err[] = {
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_SLAVE_ERROR,
+		.enable = false,
+		.sbm_port = 0x1, /* SBM_FAULTINSTATUS0_LOW_PORT0_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2008, /* CAM_NOC_ERL_MAINCTL_LOW */
+			.value = 1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2010, /* CAM_NOC_ERL_ERRVLD_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x2018, /* CAM_NOC_ERL_ERRCLR_LOW */
+			.value = 1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IFE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x20, /* SBM_FAULTINSTATUS0_LOW_PORT5_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x59A0, /* IFE_UBWC_NIU_ENCERREN_LOW */
+			.value = 0xF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5990, /* IFE_UBWC_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5998, /* IFE_UBWC_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_BPS_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x2, /* SBM_FAULTINSTATUS0_LOW_PORT1_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x7A0, /* CAM_NOC_BPS_WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x790, /* CAM_NOC_BPS_WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x798, /* CAM_NOC_BPS_WR_NIU_ENCERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE0_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x4, /* SBM_FAULTINSTATUS0_LOW_PORT2_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x5F20, /* CAM_NOC_IPE_0_RD_NIU_DECERREN_LOW */
+			.value = 0xFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x5F10, /* CAM_NOC_IPE_0_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x5F18, /* CAM_NOC_IPE_0_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE1_UBWC_DECODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x8, /* SBM_FAULTINSTATUS0_LOW_PORT3_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6520, /* CAM_NOC_IPE_1_RD_NIU_DECERREN_LOW */
+			.value = 0XFF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6510, /* CAM_NOC_IPE_1_RD_NIU_DECERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6518, /* CAM_NOC_IPE_1_RD_NIU_DECERRCLR_LOW */
+			.value = 0X1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_IPE_UBWC_ENCODE_ERROR,
+		.enable = true,
+		.sbm_port = 0x10, /* SBM_FAULTINSTATUS0_LOW_PORT4_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x6BA0, /* CAM_NOC_IPE_WR_NIU_ENCERREN_LOW */
+			.value = 0XF,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x6B90, /* CAM_NOC_IPE_WR_NIU_ENCERRSTATUS_LOW */
+		},
+		.err_clear = {
+			.access_type = CAM_REG_TYPE_WRITE,
+			.enable = true,
+			.offset = 0x6B98, /* CAM_NOC_IPE_WR_NIU_ENCERRCLR_LOW */
+			.value = 0x1,
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_AHB_TIMEOUT,
+		.enable = false,
+		.sbm_port = 0x40, /* SBM_FAULTINSTATUS0_LOW_PORT6_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x1,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED1,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_RESERVED2,
+		.enable = false,
+	},
+	{
+		.irq_type = CAM_CAMNOC_HW_IRQ_CAMNOC_TEST,
+		.enable = TEST_IRQ_ENABLE ? true : false,
+		.sbm_port = 0x80, /* SBM_FAULTINSTATUS0_LOW_PORT7_MASK */
+		.err_enable = {
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.enable = true,
+			.offset = 0x2288, /* CAM_NOC_SBM_FLAGOUTSET0_LOW */
+			.value = 0x5,
+		},
+		.err_status = {
+			.access_type = CAM_REG_TYPE_READ,
+			.enable = true,
+			.offset = 0x2290, /* CAM_NOC_SBM_FLAGOUTSTATUS0_LOW */
+		},
+		.err_clear = {
+			.enable = false, /* CAM_NOC_SBM_FLAGOUTCLR0_LOW */
+		},
+	},
+};
+
+static struct cam_camnoc_specific
+	cam_cpas_v680_100_camnoc_specific[] = {
+	{
+		.port_type = CAM_CAMNOC_IFE_UBWC,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5830, /* IFE_UBWC_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5834, /* IFE_UBWC_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5838, /* IFE_UBWC_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5840, /* IFE_UBWC_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5848, /* IFE_UBWC_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A08, /* IFE_UBWC_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A20, /* IFE_UBWC_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5A24, /* IFE_UBWC_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_RDI_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5230, /* IFE_RDI_WR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5234, /* IFE_RDI_WR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5238, /* IFE_RDI_WR_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5240, /* IFE_RDI_WR_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5248, /* IFE_RDI_WR_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5408, /* IFE_RDI_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5420, /* IFE_RDI_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5424, /* IFE_RDI_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_PDAF,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c30, /* IFE_PDAF_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c34, /* IFE_PDAF_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c38, /* IFE_PDAF_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c40, /* IFE_PDAF_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4c48, /* IFE_PDAF_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4e08, /* IFE_PDAF_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4e20, /* IFE_PDAF_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4e24, /* IFE_PDAF_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR_STATS,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4030, /* IFE_LINEAR_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4034, /* IFE_LINEAR_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4038, /* IFE_LINEAR_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4040, /* IFE_LINEAR_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4048, /* IFE_LINEAR_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4208, /* IFE_LINEAR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4220, /* IFE_LINEAR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4224, /* IFE_LINEAR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LINEAR_STATS_1,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8230, /* IFE_LINEAR_1_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8234, /* IFE_LINEAR_1_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8238, /* IFE_LINEAR_1_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8240, /* IFE_LINEAR_1_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8248, /* IFE_LINEAR_1_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8408, /* IFE_LINEAR_1_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8420, /* IFE_LINEAR_1_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x8424, /* IFE_LINEAR_1_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IFE_LITE,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4630, /* IFE_LITE_PRIORITYLUT_LOW */
+			.value = 0x66665433,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4634, /* IFE_LITE_PRIORITYLUT_HIGH */
+			.value = 0x66666666,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4638, /* IFE_LITE_URGENCY_LOW */
+			.value = 0x1B30,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4640, /* IFE_LITE_DANGERLUT_LOW */
+			.value = 0xffffff00,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4648, /* IFE_LITE_SAFELUT_LOW */
+			.value = 0x000f,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4808, /* IFE_LITE_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4820, /* IFE_LITE_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x4824, /* IFE_LITE_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_SFE_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7030, /* SFE_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7034, /* SFE_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7038, /* SFE_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7040, /* SFE_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7048, /* SFE_RD_SAFELUT_LOW */
+			.value = 0x0,
+		},
+		.ubwc_ctl = {
+			/*
+			 * Do not explicitly set ubwc config register.
+			 * Power on default values are taking care of required
+			 * register settings.
+			 */
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7208, /* SFE_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7220, /* SFE_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7224, /* SFE_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a30, /* IPE_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a34, /* IPE_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a38, /* IPE_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a40, /* IPE_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6a48, /* IPE_WR_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6c08, /* IPE_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6c20, /* IPE_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6c24, /* IPE_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_BPS_WR,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x630, /* BPS_WR_PRIORITYLUT_LOW */
+			.value = 0x33333333,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x634, /* BPS_WR_PRIORITYLUT_HIGH */
+			.value = 0x33333333,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x638, /* BPS_WR_URGENCY_LOW */
+			.value = 0x30,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x640, /* BPS_WR_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x648, /* BPS_WR_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x808, /* BPS_WR_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x820, /* BPS_WR_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x824, /* BPS_WR_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_BPS_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x30, /* BPS_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x34, /* BPS_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x38, /* BPS_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x40, /* BPS_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x48, /* BPS_RD_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x208, /* BPS_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x220, /* BPS_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x224, /* BPS_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_JPEG,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c30, /* JPEG_PRIORITYLUT_LOW */
+			.value = 0x22222222,
+		},
+		.priority_lut_high = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c34, /* JPEG_PRIORITYLUT_HIGH */
+			.value = 0x22222222,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c38, /* JPEG_URGENCY_LOW */
+			.value = 0x22,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c40, /* JPEG_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7c48, /* JPEG_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7e08, /* JPEG_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7e20, /* JPEG_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7e24, /* JPEG_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE0_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E30, /* IPE0_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E34, /* IPE0_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E38, /* IPE0_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E40, /* IPE0_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5E48, /* IPE0_RD_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x5F08, /* IPE0_RD_DECCTL_LOW */
+			.value = 1,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6008, /* IPE0_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6020, /* IPE0_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6024, /* IPE0_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_IPE1_RD,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6430, /* IPE1_RD_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6434, /* IPE1_RD_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6438, /* IPE1_RD_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6440, /* IPE1_RD_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6448, /* IPE1_RD_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6608, /* IPE1_RD_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6620, /* IPE1_RD_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x6624, /* IPE1_RD_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_CDM,
+		.enable = true,
+		.priority_lut_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3830, /* CDM_PRIORITYLUT_LOW */
+			.value = 0x0,
+		},
+		.priority_lut_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3834, /* CDM_PRIORITYLUT_HIGH */
+			.value = 0x0,
+		},
+		.urgency = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3838, /* CDM_URGENCY_LOW */
+			.value = 0x3,
+		},
+		.danger_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3840, /* CDM_DANGERLUT_LOW */
+			.value = 0x0,
+		},
+		.safe_lut = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3848, /* CDM_SAFELUT_LOW */
+			.value = 0xffff,
+		},
+		.ubwc_ctl = {
+			.enable = false,
+			.is_fuse_based = false,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3a08, /* CDM_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3a20, /* CDM_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x3a24, /* CDM_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+	{
+		.port_type = CAM_CAMNOC_ICP,
+		.enable = true,
+		.flag_out_set0_low = {
+			.enable = true,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_WRITE,
+			.masked_value = 0,
+			.offset = 0x2288,
+			.value = 0x100000,
+		},
+		.qosgen_mainctl = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x7688, /* ICP_QOSGEN_MAINCTL */
+			.value = 0x0,
+		},
+		.qosgen_shaping_low = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x76A0, /* ICP_QOSGEN_SHAPING_LOW */
+			.value = 0x0,
+		},
+		.qosgen_shaping_high = {
+			.enable = false,
+			.is_fuse_based = false,
+			.access_type = CAM_REG_TYPE_READ_WRITE,
+			.masked_value = 0,
+			.offset = 0x76A4, /* ICP_QOSGEN_SHAPING_HIGH */
+			.value = 0x0,
+		},
+	},
+};
+
+static struct cam_camnoc_err_logger_info cam680_cpas100_err_logger_offsets = {
+	.mainctrl     =  0x2008, /* ERRLOGGER_MAINCTL_LOW */
+	.errvld       =  0x2010, /* ERRLOGGER_ERRVLD_LOW */
+	.errlog0_low  =  0x2020, /* ERRLOGGER_ERRLOG0_LOW */
+	.errlog0_high =  0x2024, /* ERRLOGGER_ERRLOG0_HIGH */
+	.errlog1_low  =  0x2028, /* ERRLOGGER_ERRLOG1_LOW */
+	.errlog1_high =  0x202c, /* ERRLOGGER_ERRLOG1_HIGH */
+	.errlog2_low  =  0x2030, /* ERRLOGGER_ERRLOG2_LOW */
+	.errlog2_high =  0x2034, /* ERRLOGGER_ERRLOG2_HIGH */
+	.errlog3_low  =  0x2038, /* ERRLOGGER_ERRLOG3_LOW */
+	.errlog3_high =  0x203c, /* ERRLOGGER_ERRLOG3_HIGH */
+};
+
+static struct cam_cpas_hw_errata_wa_list cam680_cpas100_errata_wa_list = {
+	.camnoc_flush_slave_pending_trans = {
+		.enable = false,
+		.data.reg_info = {
+			.access_type = CAM_REG_TYPE_READ,
+			.offset = 0x2300, /* sbm_SenseIn0_Low */
+			.mask = 0xE0000, /* Bits 17, 18, 19 */
+			.value = 0, /* expected to be 0 */
+		},
+	},
+};
+
+static struct cam_camnoc_info cam680_cpas100_camnoc_info = {
+	.specific = &cam_cpas_v680_100_camnoc_specific[0],
+	.specific_size = ARRAY_SIZE(cam_cpas_v680_100_camnoc_specific),
+	.irq_sbm = &cam_cpas_v680_100_irq_sbm,
+	.irq_err = &cam_cpas_v680_100_irq_err[0],
+	.irq_err_size = ARRAY_SIZE(cam_cpas_v680_100_irq_err),
+	.err_logger = &cam680_cpas100_err_logger_offsets,
+	.errata_wa_list = &cam680_cpas100_errata_wa_list,
+};
+
+#endif /* _CPASTOP_V680_100_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/include/cam_cpas_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cpas/include/cam_cpas_api.h
@@ -0,0 +1,753 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CPAS_API_H_
+#define _CAM_CPAS_API_H_
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+
+#include <media/cam_cpas.h>
+#include "cam_soc_util.h"
+
+#define CAM_HW_IDENTIFIER_LENGTH 128
+
+/* Default AXI Bandwidth vote */
+#define CAM_CPAS_DEFAULT_AXI_BW 1024
+
+#define CAM_CPAS_MAX_PATHS_PER_CLIENT 15
+#define CAM_CPAS_API_PATH_DATA_STD_START 512
+
+/* Qos Selection mask */
+#define CAM_CPAS_QOS_DEFAULT_SETTINGS_MASK 0x1
+#define CAM_CPAS_QOS_CUSTOM_SETTINGS_MASK  0x2
+
+/**
+ * enum cam_cpas_reg_base - Enum for register base identifier. These
+ *                          are the identifiers used in generic register
+ *                          write/read APIs provided by cpas driver.
+ */
+enum cam_cpas_reg_base {
+	CAM_CPAS_REG_CPASTOP,
+	CAM_CPAS_REG_CAMNOC,
+	CAM_CPAS_REG_CAMSS,
+	CAM_CPAS_REG_RPMH,
+	CAM_CPAS_REG_MAX
+};
+
+/**
+ * enum cam_cpas_hw_index  - Enum for identify HW index
+ */
+enum cam_cpas_hw_index {
+	CAM_CPAS_HW_IDX_ANY = 0,
+	CAM_CPAS_HW_IDX_0 = 1<<0,
+	CAM_CPAS_HW_IDX_1 = 1<<1,
+	CAM_CPAS_HW_IDX_2 = 1<<2,
+	CAM_CPAS_HW_IDX_3 = 1<<3,
+	CAM_CPAS_HW_IDX_4 = 1<<4,
+	CAM_CPAS_HW_IDX_5 = 1<<5,
+	CAM_CPAS_HW_IDX_6 = 1<<6,
+	CAM_CPAS_HW_IDX_7 = 1<<7,
+	CAM_CPAS_HW_IDX_MAX = 1<<8
+};
+
+/**
+ * enum cam_cpas_camera_version Enum for Titan Camera Versions
+ */
+enum cam_cpas_camera_version {
+	CAM_CPAS_CAMERA_VERSION_NONE = 0,
+	CAM_CPAS_CAMERA_VERSION_150  = 0x00010500,
+	CAM_CPAS_CAMERA_VERSION_170  = 0x00010700,
+	CAM_CPAS_CAMERA_VERSION_175  = 0x00010705,
+	CAM_CPAS_CAMERA_VERSION_480  = 0x00040800,
+	CAM_CPAS_CAMERA_VERSION_520  = 0x00050200,
+	CAM_CPAS_CAMERA_VERSION_540  = 0x00050400,
+	CAM_CPAS_CAMERA_VERSION_580  = 0x00050800,
+	CAM_CPAS_CAMERA_VERSION_545  = 0x00050405,
+	CAM_CPAS_CAMERA_VERSION_570  = 0x00050700,
+	CAM_CPAS_CAMERA_VERSION_680  = 0x00060800,
+	CAM_CPAS_CAMERA_VERSION_165  = 0x00010605,
+	CAM_CPAS_CAMERA_VERSION_MAX
+};
+
+/**
+ * enum cam_cpas_version Enum for Titan CPAS Versions
+ */
+enum cam_cpas_version {
+	CAM_CPAS_VERSION_NONE = 0,
+	CAM_CPAS_VERSION_100  = 0x10000000,
+	CAM_CPAS_VERSION_101  = 0x10000001,
+	CAM_CPAS_VERSION_110  = 0x10010000,
+	CAM_CPAS_VERSION_120  = 0x10020000,
+	CAM_CPAS_VERSION_130  = 0x10030000,
+	CAM_CPAS_VERSION_200  = 0x20000000,
+	CAM_CPAS_VERSION_MAX
+};
+
+/**
+ * enum cam_cpas_camera_version_map_id Enum for camera version map id
+ * This enum is mapped with cam_cpas_camera_version
+ */
+enum cam_cpas_camera_version_map_id {
+	CAM_CPAS_CAMERA_VERSION_ID_150  = 0x0,
+	CAM_CPAS_CAMERA_VERSION_ID_170  = 0x1,
+	CAM_CPAS_CAMERA_VERSION_ID_175  = 0x2,
+	CAM_CPAS_CAMERA_VERSION_ID_480  = 0x3,
+	CAM_CPAS_CAMERA_VERSION_ID_580  = 0x4,
+	CAM_CPAS_CAMERA_VERSION_ID_520  = 0x5,
+	CAM_CPAS_CAMERA_VERSION_ID_540  = 0x6,
+	CAM_CPAS_CAMERA_VERSION_ID_545  = 0x7,
+	CAM_CPAS_CAMERA_VERSION_ID_570  = 0x8,
+	CAM_CPAS_CAMERA_VERSION_ID_680  = 0x9,
+	CAM_CPAS_CAMERA_VERSION_ID_165  = 0xA,
+	CAM_CPAS_CAMERA_VERSION_ID_MAX
+};
+
+/**
+ * enum cam_cpas_version_map_id Enum for cpas version map id
+ * This enum is mapped with cam_cpas_version
+ */
+enum cam_cpas_version_map_id {
+	CAM_CPAS_VERSION_ID_100  = 0x0,
+	CAM_CPAS_VERSION_ID_101  = 0x1,
+	CAM_CPAS_VERSION_ID_110  = 0x2,
+	CAM_CPAS_VERSION_ID_120  = 0x3,
+	CAM_CPAS_VERSION_ID_130  = 0x4,
+	CAM_CPAS_VERSION_ID_200  = 0x5,
+	CAM_CPAS_VERSION_ID_MAX
+};
+
+/**
+ * enum cam_cpas_hw_version - Enum for Titan CPAS HW Versions
+ */
+enum cam_cpas_hw_version {
+	CAM_CPAS_TITAN_NONE = 0,
+	CAM_CPAS_TITAN_150_V100 = 0x150100,
+	CAM_CPAS_TITAN_165_V100 = 0x165100,
+	CAM_CPAS_TITAN_170_V100 = 0x170100,
+	CAM_CPAS_TITAN_170_V110 = 0x170110,
+	CAM_CPAS_TITAN_170_V120 = 0x170120,
+	CAM_CPAS_TITAN_170_V200 = 0x170200,
+	CAM_CPAS_TITAN_175_V100 = 0x175100,
+	CAM_CPAS_TITAN_175_V101 = 0x175101,
+	CAM_CPAS_TITAN_175_V120 = 0x175120,
+	CAM_CPAS_TITAN_175_V130 = 0x175130,
+	CAM_CPAS_TITAN_480_V100 = 0x480100,
+	CAM_CPAS_TITAN_580_V100 = 0x580100,
+	CAM_CPAS_TITAN_540_V100 = 0x540100,
+	CAM_CPAS_TITAN_520_V100 = 0x520100,
+	CAM_CPAS_TITAN_520_V110 = 0x520110,
+	CAM_CPAS_TITAN_545_V100 = 0x545100,
+	CAM_CPAS_TITAN_545_V110 = 0x545110,
+	CAM_CPAS_TITAN_570_V200 = 0x570200,
+	CAM_CPAS_TITAN_680_V100 = 0x680100,
+	CAM_CPAS_TITAN_MAX
+};
+
+/**
+ * enum cam_camnoc_irq_type - Enum for camnoc irq types
+ *
+ * @CAM_CAMNOC_IRQ_SLAVE_ERROR: Each slave port in CAMNOC (3 QSB ports and
+ *                              1 QHB port) has an error logger. The error
+ *                              observed at any slave port is logged into
+ *                              the error logger register and an IRQ is
+ *                              triggered
+ * @CAM_CAMNOC_IRQ_IFE_UBWC_ENCODE_ERROR      : Triggered if any error detected
+ *                                              in the IFE UBWC encoder instance
+ * @CAM_CAMNOC_IRQ_IFE_UBWC_STATS_ENCODE_ERROR: Triggered if any error detected
+ *                                              in the IFE UBWC-Stats encoder
+ *                                              instance
+ * @CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR  : Triggered if any error detected
+ *                                            in the IFE0 UBWC encoder instance
+ * @CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR  : Triggered if any error detected
+ *                                            in the IFE1 or IFE3 UBWC encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_IFE0_UBWC_ENCODE_ERROR   : Triggered if any error detected
+ *                                            in the IFE0 UBWC encoder instance
+ * @CAM_CAMNOC_IRQ_IFE1_WR_UBWC_ENCODE_ERROR  : Triggered if any error detected
+ *                                            in the IFE1 UBWC encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_IPE_UBWC_ENCODE_ERROR    : Triggered if any error detected
+ *                                            in the IPE write path encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_BPS_UBWC_ENCODE_ERROR    : Triggered if any error detected
+ *                                            in the BPS write path encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_IPE1_BPS_UBWC_DECODE_ERROR: Triggered if any error detected
+ *                                             in the IPE1/BPS read path decoder
+ *                                             instance
+ * @CAM_CAMNOC_IRQ_IPE0_UBWC_DECODE_ERROR    : Triggered if any error detected
+ *                                             in the IPE0 read path decoder
+ *                                             instance
+ * @CAM_CAMNOC_IRQ_IPE1_UBWC_DECODE_ERROR    : Triggered if any error detected
+ *                                             in the IPE1 read path decoder
+ *                                             instance
+ * @CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR: Triggered if any error detected
+ *                                            in the IPE/BPS UBWC decoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR: Triggered if any error detected
+ *                                            in the IPE/BPS UBWC encoder
+ *                                            instance
+ * @CAM_CAMNOC_IRQ_AHB_TIMEOUT              : Triggered when the QHS_ICP slave
+ *                                            times out after 4000 AHB cycles
+ */
+enum cam_camnoc_irq_type {
+	CAM_CAMNOC_IRQ_SLAVE_ERROR,
+	CAM_CAMNOC_IRQ_IFE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE_UBWC_STATS_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE_UBWC_STATS_1_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE0_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_BPS_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE1_BPS_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE0_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE1_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR,
+	CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR,
+	CAM_CAMNOC_IRQ_AHB_TIMEOUT,
+};
+
+/**
+ * struct cam_camnoc_irq_slave_err_data : Data for Slave error.
+ *
+ * @mainctrl     : Err logger mainctrl info
+ * @errvld       : Err logger errvld info
+ * @errlog0_low  : Err logger errlog0_low info
+ * @errlog0_high : Err logger errlog0_high info
+ * @errlog1_low  : Err logger errlog1_low info
+ * @errlog1_high : Err logger errlog1_high info
+ * @errlog2_low  : Err logger errlog2_low info
+ * @errlog2_high : Err logger errlog2_high info
+ * @errlog3_low  : Err logger errlog3_low info
+ * @errlog3_high : Err logger errlog3_high info
+ *
+ */
+struct cam_camnoc_irq_slave_err_data {
+	union {
+		struct {
+			uint32_t stall_en : 1; /* bit 0 */
+			uint32_t fault_en : 1; /* bit 1 */
+			uint32_t rsv      : 30; /* bits 2-31 */
+		};
+		uint32_t value;
+	} mainctrl;
+	union {
+		struct {
+			uint32_t err_vld : 1; /* bit 0 */
+			uint32_t rsv     : 31; /* bits 1-31 */
+		};
+		uint32_t value;
+	} errvld;
+	union {
+		struct {
+			uint32_t loginfo_vld : 1; /* bit 0 */
+			uint32_t word_error  : 1; /* bit 1 */
+			uint32_t non_secure  : 1; /* bit 2 */
+			uint32_t device      : 1; /* bit 3 */
+			uint32_t opc         : 3; /* bits 4 - 6 */
+			uint32_t rsv0        : 1; /* bit 7 */
+			uint32_t err_code    : 3; /* bits 8 - 10 */
+			uint32_t sizef       : 3; /* bits 11 - 13 */
+			uint32_t rsv1        : 2; /* bits 14 - 15 */
+			uint32_t addr_space  : 6; /* bits 16 - 21 */
+			uint32_t rsv2        : 10; /* bits 22 - 31 */
+		};
+		uint32_t value;
+	}  errlog0_low;
+	union {
+		struct {
+			uint32_t len1 : 10; /* bits 0 - 9 */
+			uint32_t rsv  : 22; /* bits 10 - 31 */
+		};
+		uint32_t value;
+	} errlog0_high;
+	union {
+		struct {
+			uint32_t path : 16; /* bits 0 - 15 */
+			uint32_t rsv  : 16; /* bits 16 - 31 */
+		};
+		uint32_t value;
+	} errlog1_low;
+	union {
+		struct {
+			uint32_t extid : 18; /* bits 0 - 17 */
+			uint32_t rsv   : 14; /* bits 18 - 31 */
+		};
+		uint32_t value;
+	} errlog1_high;
+	union {
+		struct {
+			uint32_t errlog2_lsb : 32; /* bits 0 - 31 */
+		};
+		uint32_t value;
+	} errlog2_low;
+	union {
+		struct {
+			uint32_t errlog2_msb : 16; /* bits 0 - 16 */
+			uint32_t rsv         : 16; /* bits 16 - 31 */
+		};
+		uint32_t value;
+	} errlog2_high;
+	union {
+		struct {
+			uint32_t errlog3_lsb : 32; /* bits 0 - 31 */
+		};
+		uint32_t value;
+	} errlog3_low;
+	union {
+		struct {
+			uint32_t errlog3_msb : 32; /* bits 0 - 31 */
+		};
+		uint32_t value;
+	} errlog3_high;
+};
+
+/**
+ * struct cam_camnoc_irq_ubwc_enc_data : Data for UBWC Encode error.
+ *
+ * @encerr_status : Encode error status
+ *
+ */
+struct cam_camnoc_irq_ubwc_enc_data {
+	union {
+		struct {
+			uint32_t encerrstatus : 3; /* bits 0 - 2 */
+			uint32_t rsv          : 29; /* bits 3 - 31 */
+		};
+		uint32_t value;
+	} encerr_status;
+};
+
+/**
+ * struct cam_camnoc_irq_ubwc_dec_data : Data for UBWC Decode error.
+ *
+ * @decerr_status : Decoder error status
+ * @thr_err       : Set to 1 if
+ *                  At least one of the bflc_len fields in the bit steam exceeds
+ *                  its threshold value. This error is possible only for
+ *                  RGBA1010102, TP10, and RGB565 formats
+ * @fcl_err       : Set to 1 if
+ *                  Fast clear with a legal non-RGB format
+ * @len_md_err    : Set to 1 if
+ *                  The calculated burst length does not match burst length
+ *                  specified by the metadata value
+ * @format_err    : Set to 1 if
+ *                  Illegal format
+ *                  1. bad format :2,3,6
+ *                  2. For 32B MAL, metadata=6
+ *                  3. For 32B MAL RGB565, Metadata != 0,1,7
+ *                  4. For 64B MAL RGB565, metadata[3:1] == 1,2
+ *
+ */
+struct cam_camnoc_irq_ubwc_dec_data {
+	union {
+		struct {
+			uint32_t thr_err    : 1; /* bit 0 */
+			uint32_t fcl_err    : 1; /* bit 1 */
+			uint32_t len_md_err : 1; /* bit 2 */
+			uint32_t format_err : 1; /* bit 3 */
+			uint32_t rsv        : 28; /* bits 4 - 31 */
+		};
+		uint32_t value;
+	} decerr_status;
+};
+
+struct cam_camnoc_irq_ahb_timeout_data {
+	uint32_t data;
+};
+
+/**
+ * struct cam_cpas_irq_data : CAMNOC IRQ data
+ *
+ * @irq_type  : To identify the type of IRQ
+ * @u         : Union of irq err data information
+ * @slave_err : Data for Slave error.
+ *              Valid if type is CAM_CAMNOC_IRQ_SLAVE_ERROR
+ * @enc_err   : Data for UBWC Encode error.
+ *              Valid if type is one of below:
+ *              CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR
+ *              CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR
+ *              CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR
+ * @dec_err   : Data for UBWC Decode error.
+ *              Valid if type is CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR
+ * @ahb_err   : Data for Slave error.
+ *              Valid if type is CAM_CAMNOC_IRQ_AHB_TIMEOUT
+ *
+ */
+struct cam_cpas_irq_data {
+	enum cam_camnoc_irq_type irq_type;
+	union {
+		struct cam_camnoc_irq_slave_err_data   slave_err;
+		struct cam_camnoc_irq_ubwc_enc_data    enc_err;
+		struct cam_camnoc_irq_ubwc_dec_data    dec_err;
+		struct cam_camnoc_irq_ahb_timeout_data ahb_err;
+	} u;
+};
+
+/**
+ * struct cam_cpas_register_params : Register params for cpas client
+ *
+ * @identifier        : Input identifier string which is the device label
+ *                      from dt like vfe, ife, jpeg etc
+ * @cell_index        : Input integer identifier pointing to the cell index
+ *                      from dt of the device. This can be used to form a
+ *                      unique string with @identifier like vfe0, ife1,
+ *                      jpeg0, etc
+ * @dev               : device handle
+ * @userdata          : Input private data which will be passed as
+ *                      an argument while callback.
+ * @cam_cpas_callback : Input callback pointer for triggering the
+ *                      callbacks from CPAS driver.
+ *                      @client_handle : CPAS client handle
+ *                      @userdata    : User data given at the time of register
+ *                      @event_type  : event type
+ *                      @event_data  : event data
+ * @client_handle       : Output Unique handle generated for this register
+ *
+ */
+struct cam_cpas_register_params {
+	char            identifier[CAM_HW_IDENTIFIER_LENGTH];
+	uint32_t        cell_index;
+	struct device  *dev;
+	void           *userdata;
+	bool          (*cam_cpas_client_cb)(
+			uint32_t                  client_handle,
+			void                     *userdata,
+			struct cam_cpas_irq_data *irq_data);
+	uint32_t        client_handle;
+};
+
+/**
+ * enum cam_vote_type - Enum for voting type
+ *
+ * @CAM_VOTE_ABSOLUTE : Absolute vote
+ * @CAM_VOTE_DYNAMIC  : Dynamic vote
+ */
+enum cam_vote_type {
+	CAM_VOTE_ABSOLUTE,
+	CAM_VOTE_DYNAMIC,
+};
+
+/**
+ * struct cam_ahb_vote : AHB vote
+ *
+ * @type  : AHB voting type.
+ *          CAM_VOTE_ABSOLUTE : vote based on the value 'level' is set
+ *          CAM_VOTE_DYNAMIC  : vote calculated dynamically using 'freq'
+ *                              and 'dev' handle is set
+ * @level : AHB vote level
+ * @freq  : AHB vote dynamic frequency
+ *
+ */
+struct cam_ahb_vote {
+	enum cam_vote_type   type;
+	union {
+		enum cam_vote_level  level;
+		unsigned long        freq;
+	} vote;
+};
+
+/**
+ * struct cam_axi_vote : AXI vote
+ *
+ * @num_paths: Number of paths on which BW vote is sent to CPAS
+ * @axi_path: Per path BW vote info
+ *
+ */
+struct cam_axi_vote {
+	uint32_t num_paths;
+	struct cam_axi_per_path_bw_vote axi_path[CAM_CPAS_MAX_PATHS_PER_CLIENT];
+};
+
+/**
+ * cam_cpas_register_client()
+ *
+ * @brief: API to register cpas client
+ *
+ * @register_params: Input params to register as a client to CPAS
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_register_client(
+	struct cam_cpas_register_params *register_params);
+
+/**
+ * cam_cpas_unregister_client()
+ *
+ * @brief: API to unregister cpas client
+ *
+ * @client_handle: Client handle to be unregistered
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_unregister_client(uint32_t client_handle);
+
+/**
+ * cam_cpas_start()
+ *
+ * @brief: API to start cpas client hw. Clients have to vote for minimal
+ *     bandwidth requirements for AHB, AXI. Use cam_cpas_update_ahb_vote
+ *     to scale bandwidth after start.
+ *
+ * @client_handle: client cpas handle
+ * @ahb_vote     : Pointer to ahb vote info
+ * @axi_vote     : Pointer to axi bandwidth vote info
+ *
+ * If AXI vote is not applicable to a particular client, use the value exposed
+ * by CAM_CPAS_DEFAULT_AXI_BW as the default vote request.
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_start(
+	uint32_t               client_handle,
+	struct cam_ahb_vote   *ahb_vote,
+	struct cam_axi_vote   *axi_vote);
+
+/**
+ * cam_cpas_stop()
+ *
+ * @brief: API to stop cpas client hw. Bandwidth for AHB, AXI votes
+ *     would be removed for this client on this call. Clients should not
+ *     use cam_cpas_update_ahb_vote or cam_cpas_update_axi_vote
+ *     to remove their bandwidth vote.
+ *
+ * @client_handle: client cpas handle
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_stop(uint32_t client_handle);
+
+/**
+ * cam_cpas_update_ahb_vote()
+ *
+ * @brief: API to update AHB vote requirement. Use this function only
+ *     between cam_cpas_start and cam_cpas_stop in case clients wants
+ *     to scale to different vote level. Do not use this function to de-vote,
+ *     removing client's vote is implicit on cam_cpas_stop
+ *
+ * @client_handle : Client cpas handle
+ * @ahb_vote      : Pointer to ahb vote info
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_update_ahb_vote(
+	uint32_t               client_handle,
+	struct cam_ahb_vote   *ahb_vote);
+
+/**
+ * cam_cpas_update_axi_vote()
+ *
+ * @brief: API to update AXI vote requirement. Use this function only
+ *     between cam_cpas_start and cam_cpas_stop in case clients wants
+ *     to scale to different vote level. Do not use this function to de-vote,
+ *     removing client's vote is implicit on cam_cpas_stop
+ *
+ * @client_handle : Client cpas handle
+ * @axi_vote      : Pointer to axi bandwidth vote info
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_update_axi_vote(
+	uint32_t             client_handle,
+	struct cam_axi_vote *axi_vote);
+
+/**
+ * cam_cpas_reg_write()
+ *
+ * @brief: API to write a register value in CPAS register space
+ *
+ * @client_handle : Client cpas handle
+ * @reg_base      : Register base identifier
+ * @offset        : Offset from the register base address
+ * @mb            : Whether to do reg write with memory barrier
+ * @value         : Value to be written in register
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_reg_write(
+	uint32_t                  client_handle,
+	enum cam_cpas_reg_base    reg_base,
+	uint32_t                  offset,
+	bool                      mb,
+	uint32_t                  value);
+
+/**
+ * cam_cpas_reg_read()
+ *
+ * @brief: API to read a register value from CPAS register space
+ *
+ * @client_handle : Client cpas handle
+ * @reg_base      : Register base identifier
+ * @offset        : Offset from the register base address
+ * @mb            : Whether to do reg read with memory barrier
+ * @value         : Value to be red from register
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_reg_read(
+	uint32_t                  client_handle,
+	enum cam_cpas_reg_base    reg_base,
+	uint32_t                  offset,
+	bool                      mb,
+	uint32_t                 *value);
+
+/**
+ * cam_cpas_get_hw_info()
+ *
+ * @brief: API to get camera hw information
+ *
+ * @camera_family  : Camera family type. One of
+ *                   CAM_FAMILY_CAMERA_SS
+ *                   CAM_FAMILY_CPAS_SS
+ * @camera_version : Camera platform version
+ * @cpas_version   : Camera cpas version
+ * @cam_caps       : Camera capability
+ * @cam_fuse_info  : Camera fuse info
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_get_hw_info(
+	uint32_t                  *camera_family,
+	struct cam_hw_version     *camera_version,
+	struct cam_hw_version     *cpas_version,
+	uint32_t                  *cam_caps,
+	struct cam_cpas_fuse_info *cam_fuse_info);
+
+/**
+ * cam_cpas_get_cpas_hw_version()
+ *
+ * @brief: API to get camera cpas hw version
+ *
+ * @hw_version  : Camera cpas hw version
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_get_cpas_hw_version(
+	uint32_t				 *hw_version);
+
+/**
+ * cam_cpas_get_camnoc_fifo_fill_level_info()
+ *
+ * @brief: API to get camera camnoc hw version
+ *
+ * @cpas_version: hw version
+ * @client_handle: cpas client handle
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_get_camnoc_fifo_fill_level_info(
+	uint32_t                               cpas_version,
+	uint32_t                               client_handle);
+
+/**
+ * cam_cpas_is_feature_supported()
+ *
+ * @brief: API to get camera features
+ *
+ * @flag  : Camera hw features to check
+ *
+ * @hw_map : To indicate which HWs are supported
+ *
+ * @fule_val : Return fule value in case of value type feature
+ *
+ * @return 1 if feature is supported
+ *
+ */
+bool cam_cpas_is_feature_supported(uint32_t flag, uint32_t hw_map,
+	uint32_t *fuse_val);
+
+/**
+ * cam_cpas_axi_util_path_type_to_string()
+ *
+ * @brief: API to get string for given path type
+ *
+ * @path_data_type  : Path type
+ *
+ * @return string.
+ *
+ */
+const char *cam_cpas_axi_util_path_type_to_string(
+	uint32_t path_data_type);
+
+/**
+ * cam_cpas_axi_util_trans_type_to_string()
+ *
+ * @brief: API to get string for given transaction type
+ *
+ * @path_data_type  : Transaction type
+ *
+ * @return string.
+ *
+ */
+const char *cam_cpas_axi_util_trans_type_to_string(
+	uint32_t path_data_type);
+
+/**
+ * cam_cpas_log_votes()
+ *
+ * @brief: API to print the all bw votes of axi client. It also print the
+ *     applied camnoc axi clock vote value and ahb vote value
+ *
+ * @return 0 on success.
+ *
+ */
+void cam_cpas_log_votes(void);
+
+/**
+ * cam_cpas_select_qos_settings()
+ *
+ * @brief: API to select specific qos settings based on usecase requirements
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_select_qos_settings(uint32_t selection_mask);
+
+/**
+ * cam_cpas_notify_event()
+ *
+ * @brief: API that clients can notify about their events. CPAS save the event
+ *         and any other useful information related to this event. This will
+ *         be printed while cpas state dump - cam_cpas_log_votes.
+ *         One such example is IFE notifiying SOF or EPOCH to cpas and cpas
+ *         saving axi clock information (camnoc_axi, mnoc_hf) at that point
+ *         and printing latest history on IFE overflow.
+ *
+ * @identifier_string: Identifier string passed by caller
+ * @identifier_value: Identifier value passed by caller
+ */
+int cam_cpas_notify_event(const char *identifier_string,
+	int32_t identifier_value);
+
+/*
+ * cam_cpas_hw_get_camnoc_fill_level_info()
+ *
+ * @brief: API to get camnoc info
+ *
+ * @cpas_version: cpas hw version
+ * @client_handle: cpas client handle
+ *
+ * @return 0 on success.
+ *
+ */
+int cam_cpas_hw_get_camnoc_fill_level_info(
+	uint32_t cpas_version,
+	uint32_t client_handle);
+
+#endif /* _CAM_CPAS_API_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_context.c
@@ -0,0 +1,1745 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/ratelimit.h>
+
+#include "cam_mem_mgr.h"
+#include "cam_sync_api.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+#include "cam_context_utils.h"
+#include "cam_custom_context.h"
+#include "cam_common_util.h"
+
+static const char custom_dev_name[] = "cam-custom";
+
+static int __cam_custom_ctx_handle_irq_in_activated(
+	void *context, uint32_t evt_id, void *evt_data);
+
+static int __cam_custom_ctx_start_dev_in_ready(
+	struct cam_context *ctx, struct cam_start_stop_dev_cmd *cmd);
+
+static int __cam_custom_ctx_apply_req_in_activated_state(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply,
+	uint32_t next_state);
+
+static int __cam_custom_ctx_apply_default_settings(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply);
+
+static int __cam_custom_ctx_apply_req_in_activated(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	rc = __cam_custom_ctx_apply_req_in_activated_state(
+		ctx, apply, CAM_CUSTOM_CTX_ACTIVATED_APPLIED);
+	CAM_DBG(CAM_CUSTOM, "new substate %d", custom_ctx->substate_activated);
+
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Apply failed in state %d rc %d",
+			custom_ctx->substate_activated, rc);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_handle_error(
+	struct cam_custom_context *custom_ctx, void *evt_data)
+{
+	/*
+	 * Handle any HW error scenerios here, all the
+	 * requests in all the lists can be signaled error.
+	 * Notify UMD about this error if needed.
+	 */
+
+	return 0;
+}
+
+static int __cam_custom_ctx_reg_upd_in_sof(
+	struct cam_custom_context *custom_ctx, void *evt_data)
+{
+	struct cam_ctx_request *req = NULL;
+	struct cam_custom_dev_ctx_req *req_custom;
+	struct cam_context *ctx = custom_ctx->base;
+
+	custom_ctx->frame_id++;
+
+	/*
+	 * This is for the first update before streamon.
+	 * The initial setting will cause the reg_upd in the
+	 * first frame.
+	 */
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		if (req_custom->num_fence_map_out == req_custom->num_acked) {
+			list_add_tail(&req->list, &ctx->free_req_list);
+		} else {
+			list_add_tail(&req->list, &ctx->active_req_list);
+			custom_ctx->active_req_cnt++;
+			CAM_DBG(CAM_REQ,
+				"move request %lld to active list(cnt = %d), ctx %u",
+				req->request_id, custom_ctx->active_req_cnt,
+				ctx->ctx_id);
+		}
+	}
+
+	return 0;
+}
+
+static int __cam_custom_ctx_reg_upd_in_applied_state(
+	struct cam_custom_context *custom_ctx, void *evt_data)
+{
+	struct cam_ctx_request         *req;
+	struct cam_context             *ctx = custom_ctx->base;
+	struct cam_custom_dev_ctx_req  *req_custom;
+
+	custom_ctx->frame_id++;
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_CUSTOM,
+				"Reg upd ack with no waiting request");
+		goto end;
+	}
+	req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+	list_del_init(&req->list);
+
+	req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+	if (req_custom->num_fence_map_out != 0) {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		custom_ctx->active_req_cnt++;
+		CAM_DBG(CAM_REQ,
+			"move request %lld to active list(cnt = %d), ctx %u",
+			req->request_id, custom_ctx->active_req_cnt,
+			ctx->ctx_id);
+	} else {
+		/* no io config, so the request is completed. */
+		list_add_tail(&req->list, &ctx->free_req_list);
+		CAM_DBG(CAM_ISP,
+			"move active request %lld to free list(cnt = %d), ctx %u",
+			req->request_id, custom_ctx->active_req_cnt,
+			ctx->ctx_id);
+	}
+
+	custom_ctx->substate_activated = CAM_CUSTOM_CTX_ACTIVATED_SOF;
+	CAM_DBG(CAM_CUSTOM, "next substate %d", custom_ctx->substate_activated);
+
+end:
+	return 0;
+}
+
+static int __cam_custom_ctx_frame_done(
+	struct cam_custom_context *custom_ctx, void *evt_data)
+{
+	int rc = 0, i, j;
+	uint64_t frame_done_req_id;
+	struct cam_ctx_request  *req;
+	struct cam_custom_dev_ctx_req  *req_custom;
+	struct cam_context *ctx = custom_ctx->base;
+	struct cam_custom_hw_done_event_data *done_data =
+		(struct cam_custom_hw_done_event_data *)evt_data;
+
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_DBG(CAM_CUSTOM, "Frame done with no active request");
+		return 0;
+	}
+
+	req = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+	req_custom = req->req_priv;
+
+	for (i = 0; i < done_data->num_handles; i++) {
+		for (j = 0; j < req_custom->num_fence_map_out; j++) {
+			if (done_data->resource_handle[i] ==
+				req_custom->fence_map_out[j].resource_handle)
+				break;
+		}
+
+		if (j == req_custom->num_fence_map_out) {
+			CAM_ERR(CAM_CUSTOM,
+				"Can not find matching rsrc handle 0x%x!",
+				done_data->resource_handle[i]);
+			rc = -EINVAL;
+			continue;
+		}
+
+		if (req_custom->fence_map_out[j].sync_id == -1) {
+			CAM_WARN(CAM_CUSTOM,
+				"Duplicate frame done for req %lld",
+				req->request_id);
+			continue;
+		}
+
+		if (!req_custom->bubble_detected) {
+			rc = cam_sync_signal(
+				req_custom->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_SUCCESS,
+				CAM_SYNC_COMMON_EVENT_SUCCESS);
+			if (rc)
+				CAM_ERR(CAM_CUSTOM,
+					"Sync failed with rc = %d", rc);
+		} else if (!req_custom->bubble_report) {
+			rc = cam_sync_signal(
+				req_custom->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_ERROR,
+				CAM_SYNC_ISP_EVENT_BUBBLE);
+			if (rc)
+				CAM_ERR(CAM_CUSTOM,
+					"Sync failed with rc = %d", rc);
+		} else {
+			req_custom->num_acked++;
+			CAM_DBG(CAM_CUSTOM, "frame done with bubble for %llu",
+				req->request_id);
+			continue;
+		}
+
+		req_custom->num_acked++;
+		req_custom->fence_map_out[j].sync_id = -1;
+	}
+
+	if (req_custom->num_acked > req_custom->num_fence_map_out) {
+		CAM_ERR(CAM_CUSTOM,
+			"WARNING: req_id %lld num_acked %d > map_out %d, ctx %u",
+			req->request_id, req_custom->num_acked,
+			req_custom->num_fence_map_out, ctx->ctx_id);
+	}
+
+	if (req_custom->num_acked != req_custom->num_fence_map_out)
+		return rc;
+
+	custom_ctx->active_req_cnt--;
+	frame_done_req_id = req->request_id;
+	if (req_custom->bubble_detected && req_custom->bubble_report) {
+		req_custom->num_acked = 0;
+		req_custom->bubble_detected = false;
+		list_del_init(&req->list);
+		if (frame_done_req_id <= ctx->last_flush_req) {
+			for (i = 0; i < req_custom->num_fence_map_out; i++)
+				rc = cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+
+			list_add_tail(&req->list, &ctx->free_req_list);
+			atomic_set(&custom_ctx->process_bubble, 0);
+			CAM_DBG(CAM_REQ,
+				"Move active request %lld to free list(cnt = %d) [flushed], ctx %u",
+				frame_done_req_id, custom_ctx->active_req_cnt,
+				ctx->ctx_id);
+		} else {
+			list_add(&req->list, &ctx->pending_req_list);
+			atomic_set(&custom_ctx->process_bubble, 0);
+			CAM_DBG(CAM_REQ,
+				"Move active request %lld to pending list in ctx %u",
+				frame_done_req_id, ctx->ctx_id);
+		}
+	} else {
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->free_req_list);
+		CAM_DBG(CAM_REQ,
+			"Move active request %lld to free list(cnt = %d) [all fences done], ctx %u",
+			frame_done_req_id,
+			custom_ctx->active_req_cnt,
+			ctx->ctx_id);
+	}
+
+	return rc;
+}
+
+static int __cam_custom_ctx_handle_bubble(
+	struct cam_context *ctx, uint64_t req_id)
+{
+	int                              rc = -EINVAL;
+	bool                             found = false;
+	struct cam_ctx_request          *req = NULL;
+	struct cam_ctx_request          *req_temp;
+	struct cam_custom_dev_ctx_req   *req_custom;
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->wait_req_list, list) {
+		if (req->request_id == req_id) {
+			req_custom =
+				(struct cam_custom_dev_ctx_req *)req->req_priv;
+			if (!req_custom->bubble_report) {
+				CAM_DBG(CAM_CUSTOM,
+					"Skip bubble recovery for %llu",
+					req_id);
+				goto end;
+			}
+
+			req_custom->bubble_detected = true;
+			found = true;
+			CAM_DBG(CAM_CUSTOM,
+				"Found bubbled req %llu in wait list",
+				req_id);
+		}
+	}
+
+	if (found) {
+		rc = 0;
+		goto end;
+	}
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->active_req_list, list) {
+		if (req->request_id == req_id) {
+			req_custom =
+				(struct cam_custom_dev_ctx_req *)req->req_priv;
+			if (!req_custom->bubble_report) {
+				CAM_DBG(CAM_CUSTOM,
+					"Skip bubble recovery for %llu",
+					req_id);
+				goto end;
+			}
+
+			req_custom->bubble_detected = true;
+			found = true;
+			CAM_DBG(CAM_CUSTOM,
+				"Found bubbled req %llu in active list",
+				req_id);
+		}
+	}
+
+	if (found)
+		rc = 0;
+	else
+		CAM_ERR(CAM_CUSTOM,
+			"req %llu not found in wait or active list bubble recovery failed ctx: %u",
+			req_id, ctx->ctx_id);
+
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_handle_evt(
+	struct cam_context *ctx,
+	struct cam_req_mgr_link_evt_data *evt_data)
+{
+	int rc = -1;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (evt_data->u.error == CRM_KMD_ERR_BUBBLE) {
+		rc = __cam_custom_ctx_handle_bubble(ctx, evt_data->req_id);
+		if (rc)
+			return rc;
+	} else {
+		CAM_WARN(CAM_CUSTOM, "Unsupported error type %d",
+			evt_data->u.error);
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Set bubble flag for req %llu in ctx %u",
+		evt_data->req_id, ctx->ctx_id);
+	atomic_set(&custom_ctx->process_bubble, 1);
+	return 0;
+}
+
+static struct cam_ctx_ops
+	cam_custom_ctx_activated_state_machine
+	[CAM_CUSTOM_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_custom_ctx_apply_req_in_activated,
+			.notify_frame_skip =
+				__cam_custom_ctx_apply_default_settings,
+		},
+		.irq_ops = NULL,
+	},
+	/* APPLIED */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_custom_ctx_apply_req_in_activated,
+			.notify_frame_skip =
+				__cam_custom_ctx_apply_default_settings,
+		},
+		.irq_ops = NULL,
+	},
+	/* HW ERROR */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HALT */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+};
+
+static struct cam_custom_ctx_irq_ops
+	cam_custom_ctx_activated_state_machine_irq
+	[CAM_CUSTOM_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			__cam_custom_ctx_handle_error,
+			__cam_custom_ctx_reg_upd_in_sof,
+			__cam_custom_ctx_frame_done,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_custom_ctx_handle_error,
+			__cam_custom_ctx_reg_upd_in_applied_state,
+			__cam_custom_ctx_frame_done,
+		},
+	},
+	/* HW ERROR */
+	{
+		.irq_ops = {
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* HALT */
+	{
+	},
+};
+
+static int __cam_custom_ctx_enqueue_request_in_order(
+	struct cam_context *ctx, struct cam_ctx_request *req)
+{
+	struct cam_ctx_request           *req_current;
+	struct cam_ctx_request           *req_prev;
+	struct list_head                  temp_list;
+
+	INIT_LIST_HEAD(&temp_list);
+	spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->pending_req_list)) {
+		list_add_tail(&req->list, &ctx->pending_req_list);
+	} else {
+		list_for_each_entry_safe_reverse(
+			req_current, req_prev, &ctx->pending_req_list, list) {
+			if (req->request_id < req_current->request_id) {
+				list_del_init(&req_current->list);
+				list_add(&req_current->list, &temp_list);
+				continue;
+			} else if (req->request_id == req_current->request_id) {
+				CAM_WARN(CAM_CUSTOM,
+					"Received duplicated request %lld",
+					req->request_id);
+			}
+			break;
+		}
+		list_add_tail(&req->list, &ctx->pending_req_list);
+
+		if (!list_empty(&temp_list)) {
+			list_for_each_entry_safe(
+				req_current, req_prev, &temp_list, list) {
+				list_del_init(&req_current->list);
+				list_add_tail(&req_current->list,
+					&ctx->pending_req_list);
+			}
+		}
+	}
+	spin_unlock_bh(&ctx->lock);
+	return 0;
+}
+
+static int __cam_custom_ctx_flush_req(struct cam_context *ctx,
+	struct list_head *req_list, struct cam_req_mgr_flush_request *flush_req)
+{
+	int i, rc;
+	uint32_t cancel_req_id_found = 0;
+	struct cam_ctx_request           *req;
+	struct cam_ctx_request           *req_temp;
+	struct cam_custom_dev_ctx_req    *req_custom;
+	struct list_head                  flush_list;
+
+	INIT_LIST_HEAD(&flush_list);
+	if (list_empty(req_list)) {
+		CAM_DBG(CAM_CUSTOM, "request list is empty");
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			CAM_ERR(CAM_CUSTOM, "no request to cancel");
+			return -EINVAL;
+		} else {
+			return 0;
+		}
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Flush [%u] in progress for req_id %llu",
+		flush_req->type, flush_req->req_id);
+	list_for_each_entry_safe(req, req_temp, req_list, list) {
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			if (req->request_id != flush_req->req_id) {
+				continue;
+			} else {
+				list_del_init(&req->list);
+				list_add_tail(&req->list, &flush_list);
+				cancel_req_id_found = 1;
+				break;
+			}
+		}
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &flush_list);
+	}
+
+	list_for_each_entry_safe(req, req_temp, &flush_list, list) {
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		for (i = 0; i < req_custom->num_fence_map_out; i++) {
+			if (req_custom->fence_map_out[i].sync_id != -1) {
+				CAM_DBG(CAM_CUSTOM,
+					"Flush req 0x%llx, fence %d",
+					 req->request_id,
+					req_custom->fence_map_out[i].sync_id);
+				rc = cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_FLUSH);
+				if (rc)
+					CAM_ERR_RATE_LIMIT(CAM_CUSTOM,
+						"signal fence failed\n");
+				req_custom->fence_map_out[i].sync_id = -1;
+			}
+		}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ &&
+		!cancel_req_id_found)
+		CAM_DBG(CAM_CUSTOM,
+			"Flush request id:%lld is not found in the list",
+			flush_req->req_id);
+
+	return 0;
+}
+
+static int __cam_custom_ctx_unlink_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+
+	return 0;
+}
+
+static int __cam_custom_ctx_unlink_in_ready(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	return 0;
+}
+
+static int __cam_custom_ctx_get_dev_info_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_device_info *dev_info)
+{
+	dev_info->dev_hdl = ctx->dev_hdl;
+	strscpy(dev_info->name, CAM_CUSTOM_DEV_NAME, sizeof(dev_info->name));
+	dev_info->dev_id = CAM_REQ_MGR_DEVICE_CUSTOM_HW;
+	dev_info->p_delay = 1;
+	dev_info->trigger = CAM_TRIGGER_POINT_SOF;
+
+	return 0;
+}
+
+static int __cam_custom_ctx_flush_req_in_top_state(
+	struct cam_context *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	int rc = 0;
+	struct cam_custom_context      *custom_ctx;
+	struct cam_hw_reset_args        reset_args;
+	struct cam_hw_stop_args         stop_args;
+	struct cam_custom_stop_args     custom_stop;
+
+	custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_CUSTOM, "Flushing pending list");
+	spin_lock_bh(&ctx->lock);
+	__cam_custom_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
+	spin_unlock_bh(&ctx->lock);
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		if (ctx->state <= CAM_CTX_READY) {
+			ctx->state = CAM_CTX_ACQUIRED;
+			goto end;
+		}
+
+		spin_lock_bh(&ctx->lock);
+		ctx->state = CAM_CTX_FLUSHED;
+		spin_unlock_bh(&ctx->lock);
+
+		CAM_INFO(CAM_CUSTOM, "Last request id to flush is %lld",
+			flush_req->req_id);
+		ctx->last_flush_req = flush_req->req_id;
+
+		/* stop hw first */
+		if (ctx->hw_mgr_intf->hw_stop) {
+			custom_stop.stop_only = true;
+			stop_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+			stop_args.args = (void *) &custom_stop;
+			rc = ctx->hw_mgr_intf->hw_stop(
+				ctx->hw_mgr_intf->hw_mgr_priv, &stop_args);
+			if (rc)
+				CAM_ERR(CAM_CUSTOM,
+					"HW stop failed in flush rc %d", rc);
+		}
+
+		spin_lock_bh(&ctx->lock);
+		if (!list_empty(&ctx->wait_req_list))
+			__cam_custom_ctx_flush_req(ctx, &ctx->wait_req_list,
+			flush_req);
+
+		if (!list_empty(&ctx->active_req_list))
+			__cam_custom_ctx_flush_req(ctx, &ctx->active_req_list,
+			flush_req);
+
+		custom_ctx->active_req_cnt = 0;
+		spin_unlock_bh(&ctx->lock);
+
+		reset_args.ctxt_to_hw_map = custom_ctx->hw_ctx;
+		rc = ctx->hw_mgr_intf->hw_reset(ctx->hw_mgr_intf->hw_mgr_priv,
+			&reset_args);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM,
+				"Reset HW failed in flush rc %d", rc);
+
+		custom_ctx->init_received = false;
+	}
+
+end:
+	atomic_set(&custom_ctx->process_bubble, 0);
+	return rc;
+}
+
+static int __cam_custom_ctx_flush_req_in_ready(
+	struct cam_context *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	int rc = 0;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_CUSTOM, "try to flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_custom_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
+
+	/* if nothing is in pending req list, change state to acquire */
+	if (list_empty(&ctx->pending_req_list))
+		ctx->state = CAM_CTX_ACQUIRED;
+	spin_unlock_bh(&ctx->lock);
+
+	atomic_set(&custom_ctx->process_bubble, 0);
+	CAM_DBG(CAM_CUSTOM, "Flush request in ready state. next state %d",
+		 ctx->state);
+	return rc;
+}
+
+static int __cam_custom_stop_dev_core(
+	struct cam_context *ctx, struct cam_start_stop_dev_cmd *stop_cmd)
+{
+	int rc = 0;
+	uint32_t i;
+	struct cam_custom_context          *ctx_custom =
+		(struct cam_custom_context *)   ctx->ctx_priv;
+	struct cam_ctx_request             *req;
+	struct cam_custom_dev_ctx_req      *req_custom;
+	struct cam_hw_stop_args             stop;
+	struct cam_custom_stop_args         custom_stop;
+
+	if ((ctx->state != CAM_CTX_FLUSHED) && (ctx_custom->hw_ctx) &&
+		(ctx->hw_mgr_intf->hw_stop)) {
+		custom_stop.stop_only = false;
+		stop.ctxt_to_hw_map = ctx_custom->hw_ctx;
+		stop.args = (void *) &custom_stop;
+		rc = ctx->hw_mgr_intf->hw_stop(ctx->hw_mgr_intf->hw_mgr_priv,
+			&stop);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "HW stop failed rc %d", rc);
+	}
+
+	while (!list_empty(&ctx->pending_req_list)) {
+		req = list_first_entry(&ctx->pending_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_CUSTOM,
+			"signal fence in pending list. fence num %d",
+			 req_custom->num_fence_map_out);
+		for (i = 0; i < req_custom->num_fence_map_out; i++)
+			if (req_custom->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_STOP);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	while (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_CUSTOM, "signal fence in wait list. fence num %d",
+			 req_custom->num_fence_map_out);
+		for (i = 0; i < req_custom->num_fence_map_out; i++)
+			if (req_custom->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_STOP);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	while (!list_empty(&ctx->active_req_list)) {
+		req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_CUSTOM, "signal fence in active list. fence num %d",
+			 req_custom->num_fence_map_out);
+		for (i = 0; i < req_custom->num_fence_map_out; i++)
+			if (req_custom->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_custom->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_COMMON_EVENT_STOP);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+	ctx_custom->frame_id = 0;
+	ctx_custom->active_req_cnt = 0;
+
+	CAM_DBG(CAM_CUSTOM, "Stop device success next state %d on ctx %u",
+		ctx->state, ctx->ctx_id);
+
+	if (!stop_cmd) {
+		rc = __cam_custom_ctx_unlink_in_ready(ctx, NULL);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "Unlink failed rc=%d", rc);
+	}
+	return rc;
+}
+
+static int __cam_custom_stop_dev_in_activated(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	struct cam_custom_context *ctx_custom =
+		(struct cam_custom_context *)ctx->ctx_priv;
+
+	__cam_custom_stop_dev_core(ctx, cmd);
+	ctx_custom->init_received = false;
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	return 0;
+}
+
+static int __cam_custom_ctx_release_hw_in_top_state(
+	struct cam_context *ctx, void *cmd)
+{
+	int rc = 0;
+	struct cam_hw_release_args        rel_arg;
+	struct cam_req_mgr_flush_request  flush_req;
+	struct cam_custom_context        *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (custom_ctx->hw_ctx) {
+		rel_arg.ctxt_to_hw_map = custom_ctx->hw_ctx;
+		rc = ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv,
+			&rel_arg);
+		custom_ctx->hw_ctx = NULL;
+		if (rc)
+			CAM_ERR(CAM_CUSTOM,
+				"Failed to release HW for ctx:%u", ctx->ctx_id);
+	} else {
+		CAM_ERR(CAM_CUSTOM, "No HW resources acquired for this ctx");
+	}
+
+	ctx->last_flush_req = 0;
+	custom_ctx->frame_id = 0;
+	custom_ctx->active_req_cnt = 0;
+	custom_ctx->hw_acquired = false;
+	custom_ctx->init_received = false;
+
+	/* check for active requests as well */
+	flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_ALL;
+	flush_req.link_hdl = ctx->link_hdl;
+	flush_req.dev_hdl = ctx->dev_hdl;
+	flush_req.req_id = 0;
+
+	CAM_DBG(CAM_CUSTOM, "try to flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_custom_ctx_flush_req(ctx, &ctx->pending_req_list,
+		&flush_req);
+	spin_unlock_bh(&ctx->lock);
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	CAM_DBG(CAM_CUSTOM, "Release HW success[%u] next state %d",
+		ctx->ctx_id, ctx->state);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_release_hw_in_activated_state(
+	struct cam_context *ctx, void *cmd)
+{
+	int rc = 0;
+
+	rc = __cam_custom_stop_dev_in_activated(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Stop device failed rc=%d", rc);
+
+	rc = __cam_custom_ctx_release_hw_in_top_state(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Release hw failed rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_custom_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+	struct cam_custom_context *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+	struct cam_req_mgr_flush_request flush_req;
+
+	if (cmd && ctx_custom->hw_ctx) {
+		CAM_ERR(CAM_CUSTOM, "releasing hw");
+		__cam_custom_ctx_release_hw_in_top_state(ctx, NULL);
+	}
+
+	ctx->ctx_crm_intf = NULL;
+	ctx->last_flush_req = 0;
+	ctx_custom->frame_id = 0;
+	ctx_custom->active_req_cnt = 0;
+	ctx_custom->hw_acquired = false;
+	ctx_custom->init_received = false;
+
+	if (!list_empty(&ctx->active_req_list))
+		CAM_ERR(CAM_CUSTOM, "Active list is not empty");
+
+	/* Flush all the pending request list  */
+	flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_ALL;
+	flush_req.link_hdl = ctx->link_hdl;
+	flush_req.dev_hdl = ctx->dev_hdl;
+	flush_req.req_id = 0;
+
+	CAM_DBG(CAM_CUSTOM, "try to flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_custom_ctx_flush_req(ctx, &ctx->pending_req_list,
+		&flush_req);
+	spin_unlock_bh(&ctx->lock);
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	CAM_DBG(CAM_CUSTOM, "Release device success[%u] next state %d",
+		ctx->ctx_id, ctx->state);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_apply_default_settings(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args        hw_cmd_args;
+	struct cam_custom_hw_cmd_args custom_hw_cmd_args;
+
+	hw_cmd_args.ctxt_to_hw_map = custom_ctx->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	custom_hw_cmd_args.cmd_type =
+		CAM_CUSTOM_HW_MGR_PROG_DEFAULT_CONFIG;
+	hw_cmd_args.u.internal_args = (void *)&custom_hw_cmd_args;
+
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&hw_cmd_args);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM,
+			"Failed to apply default settings rc %d", rc);
+	else
+		CAM_DBG(CAM_CUSTOM, "Applied default settings rc %d", rc);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_apply_req_in_activated_state(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply,
+	uint32_t next_state)
+{
+	int rc = 0;
+	struct cam_ctx_request          *req;
+	struct cam_custom_dev_ctx_req   *req_custom;
+	struct cam_custom_context       *custom_ctx = NULL;
+	struct cam_hw_config_args        cfg;
+
+	if (atomic_read(&custom_ctx->process_bubble)) {
+		CAM_WARN(CAM_CUSTOM,
+			"ctx_id:%d Processing bubble cannot apply Request Id %llu",
+			ctx->ctx_id, apply->request_id);
+		rc = -EAGAIN;
+		goto end;
+	}
+
+	if (list_empty(&ctx->pending_req_list)) {
+		CAM_ERR(CAM_CUSTOM, "No available request for Apply id %lld",
+			apply->request_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (!list_empty(&ctx->wait_req_list))
+		CAM_WARN(CAM_CUSTOM, "Apply invoked with a req in wait list");
+
+	custom_ctx = (struct cam_custom_context *) ctx->ctx_priv;
+	spin_lock_bh(&ctx->lock);
+	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+		list);
+	spin_unlock_bh(&ctx->lock);
+
+	/*
+	 * Check whether the request id is matching the tip
+	 */
+	if (req->request_id != apply->request_id) {
+		CAM_ERR_RATE_LIMIT(CAM_CUSTOM,
+			"Invalid Request Id asking %llu existing %llu",
+			apply->request_id, req->request_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+	req_custom->bubble_report = apply->report_if_bubble;
+	cfg.ctxt_to_hw_map = custom_ctx->hw_ctx;
+	cfg.request_id = req->request_id;
+	cfg.hw_update_entries = req_custom->cfg;
+	cfg.num_hw_update_entries = req_custom->num_cfg;
+	cfg.priv  = &req_custom->hw_update_data;
+	cfg.init_packet = 0;
+
+	rc = ctx->hw_mgr_intf->hw_config(ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_CUSTOM,
+			"Can not apply the configuration");
+	} else {
+		spin_lock_bh(&ctx->lock);
+		custom_ctx->substate_activated = next_state;
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->wait_req_list);
+		spin_unlock_bh(&ctx->lock);
+	}
+
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_acquire_hw_v1(
+	struct cam_context *ctx, void *args)
+{
+	int rc = 0;
+	struct cam_acquire_hw_cmd_v1 *cmd =
+		(struct cam_acquire_hw_cmd_v1 *)args;
+	struct cam_hw_acquire_args         param;
+	struct cam_custom_context         *ctx_custom =
+		(struct cam_custom_context *)  ctx->ctx_priv;
+	struct cam_custom_acquire_hw_info *acquire_hw_info = NULL;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CUSTOM, "HW interface is not ready");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_CUSTOM,
+		"session_hdl 0x%x, hdl type %d, res %lld",
+		cmd->session_handle, cmd->handle_type, cmd->resource_hdl);
+
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_CUSTOM, "Only user pointer is supported");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cmd->data_size < sizeof(*acquire_hw_info)) {
+		CAM_ERR(CAM_CUSTOM, "data_size is not a valid value");
+		goto end;
+	}
+
+	acquire_hw_info = kzalloc(cmd->data_size, GFP_KERNEL);
+	if (!acquire_hw_info) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "start copy resources from user");
+
+	if (copy_from_user(acquire_hw_info, (void __user *)cmd->resource_hdl,
+		cmd->data_size)) {
+		rc = -EFAULT;
+		goto free_res;
+	}
+
+	memset(&param, 0, sizeof(param));
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.acquire_info_size = cmd->data_size;
+	param.acquire_info = (uint64_t) acquire_hw_info;
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_CUSTOM, "Acquire HW failed");
+		goto free_res;
+	}
+
+	ctx_custom->substate_machine_irq =
+		cam_custom_ctx_activated_state_machine_irq;
+	ctx_custom->substate_machine =
+		cam_custom_ctx_activated_state_machine;
+	ctx_custom->hw_ctx = param.ctxt_to_hw_map;
+	ctx_custom->hw_acquired = true;
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Acquire HW success on session_hdl 0x%xs for ctx_id %u",
+		ctx->session_hdl, ctx->ctx_id);
+
+	kfree(acquire_hw_info);
+	return rc;
+
+free_res:
+	kfree(acquire_hw_info);
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_acquire_dev_in_available(
+	struct cam_context *ctx, struct cam_acquire_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_create_dev_hdl  req_hdl_param;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_CUSTOM, "HW interface is not ready");
+		rc = -EFAULT;
+		return rc;
+	}
+
+	CAM_DBG(CAM_CUSTOM,
+		"session_hdl 0x%x, num_resources %d, hdl type %d, res %lld",
+		cmd->session_handle, cmd->num_resources,
+		cmd->handle_type, cmd->resource_hdl);
+
+	if (cmd->num_resources != CAM_API_COMPAT_CONSTANT) {
+		CAM_ERR(CAM_CUSTOM, "Invalid num_resources 0x%x",
+			cmd->num_resources);
+		return -EINVAL;
+	}
+
+	req_hdl_param.session_hdl = cmd->session_handle;
+	req_hdl_param.v4l2_sub_dev_flag = 0;
+	req_hdl_param.media_entity_flag = 0;
+	req_hdl_param.ops = ctx->crm_ctx_intf;
+	req_hdl_param.priv = ctx;
+
+	CAM_DBG(CAM_CUSTOM, "get device handle from bridge");
+	ctx->dev_hdl = cam_create_device_hdl(&req_hdl_param);
+	if (ctx->dev_hdl <= 0) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_CUSTOM, "Can not create device handle");
+		return rc;
+	}
+
+	cmd->dev_handle = ctx->dev_hdl;
+	ctx->session_hdl = cmd->session_handle;
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Acquire dev success on session_hdl 0x%x for ctx %u",
+		cmd->session_handle, ctx->ctx_id);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_enqueue_init_request(
+	struct cam_context *ctx, struct cam_ctx_request *req)
+{
+	int rc = 0;
+	struct cam_ctx_request           *req_old;
+	struct cam_custom_dev_ctx_req    *req_custom_old;
+	struct cam_custom_dev_ctx_req    *req_custom_new;
+
+	spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->pending_req_list)) {
+		list_add_tail(&req->list, &ctx->pending_req_list);
+		goto end;
+	}
+
+	req_old = list_first_entry(&ctx->pending_req_list,
+		struct cam_ctx_request, list);
+	req_custom_old = (struct cam_custom_dev_ctx_req *) req_old->req_priv;
+	req_custom_new = (struct cam_custom_dev_ctx_req *) req->req_priv;
+	if (req_custom_old->hw_update_data.packet_opcode_type ==
+		CAM_CUSTOM_PACKET_INIT_DEV) {
+		if ((req_custom_old->num_cfg + req_custom_new->num_cfg) >=
+			CAM_CUSTOM_CTX_CFG_MAX) {
+			CAM_WARN(CAM_CUSTOM, "Can not merge INIT pkt");
+			rc = -ENOMEM;
+		}
+
+		if (req_custom_old->num_fence_map_out != 0 ||
+			req_custom_old->num_fence_map_in != 0) {
+			CAM_WARN(CAM_CUSTOM, "Invalid INIT pkt sequence");
+			rc = -EINVAL;
+		}
+
+		if (!rc) {
+			memcpy(req_custom_old->fence_map_out,
+				req_custom_new->fence_map_out,
+				sizeof(req_custom_new->fence_map_out[0])*
+				req_custom_new->num_fence_map_out);
+			req_custom_old->num_fence_map_out =
+				req_custom_new->num_fence_map_out;
+
+			memcpy(req_custom_old->fence_map_in,
+				req_custom_new->fence_map_in,
+				sizeof(req_custom_new->fence_map_in[0])*
+				req_custom_new->num_fence_map_in);
+			req_custom_old->num_fence_map_in =
+				req_custom_new->num_fence_map_in;
+
+			memcpy(&req_custom_old->cfg[req_custom_old->num_cfg],
+				req_custom_new->cfg,
+				sizeof(req_custom_new->cfg[0])*
+				req_custom_new->num_cfg);
+			req_custom_old->num_cfg += req_custom_new->num_cfg;
+
+			req_old->request_id = req->request_id;
+
+			list_add_tail(&req->list, &ctx->free_req_list);
+		}
+	} else {
+		CAM_WARN(CAM_CUSTOM,
+			"Received Update pkt before INIT pkt. req_id= %lld",
+			req->request_id);
+		rc = -EINVAL;
+	}
+end:
+	spin_unlock_bh(&ctx->lock);
+	return rc;
+}
+
+static int __cam_custom_ctx_config_dev(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0, i;
+	struct cam_ctx_request           *req = NULL;
+	struct cam_custom_dev_ctx_req    *req_custom;
+	uintptr_t                         packet_addr;
+	struct cam_packet                *packet;
+	size_t                            len = 0;
+	struct cam_hw_prepare_update_args cfg;
+	struct cam_req_mgr_add_request    add_req;
+	struct cam_custom_context        *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	/* get free request */
+	spin_lock_bh(&ctx->lock);
+	if (!list_empty(&ctx->free_req_list)) {
+		req = list_first_entry(&ctx->free_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+	}
+	spin_unlock_bh(&ctx->lock);
+
+	if (!req) {
+		CAM_ERR(CAM_CUSTOM, "No more request obj free");
+		return -ENOMEM;
+	}
+
+	req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+
+	/* for config dev, only memory handle is supported */
+	/* map packet from the memhandle */
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc != 0) {
+		CAM_ERR(CAM_CUSTOM, "Can not get packet address");
+		rc = -EINVAL;
+		goto free_req;
+	}
+
+	packet = (struct cam_packet *)(packet_addr + (uint32_t)cmd->offset);
+	CAM_DBG(CAM_CUSTOM, "pack_handle %llx", cmd->packet_handle);
+	CAM_DBG(CAM_CUSTOM, "packet address is 0x%zx", packet_addr);
+	CAM_DBG(CAM_CUSTOM, "packet with length %zu, offset 0x%llx",
+		len, cmd->offset);
+	CAM_DBG(CAM_CUSTOM, "Packet request id %lld",
+		packet->header.request_id);
+	CAM_DBG(CAM_CUSTOM, "Packet size 0x%x", packet->header.size);
+	CAM_DBG(CAM_CUSTOM, "packet op %d", packet->header.op_code);
+
+	if ((((packet->header.op_code) & 0xF) ==
+		CAM_CUSTOM_PACKET_UPDATE_DEV)
+		&& (packet->header.request_id <= ctx->last_flush_req)) {
+		CAM_DBG(CAM_CUSTOM,
+			"request %lld has been flushed, reject packet",
+			packet->header.request_id);
+		rc = -EINVAL;
+		goto free_req;
+	}
+
+	/* preprocess the configuration */
+	memset(&cfg, 0, sizeof(cfg));
+	cfg.packet = packet;
+	cfg.ctxt_to_hw_map = ctx_custom->hw_ctx;
+	cfg.out_map_entries = req_custom->fence_map_out;
+	cfg.max_out_map_entries = CAM_CUSTOM_DEV_CTX_RES_MAX;
+	cfg.in_map_entries = req_custom->fence_map_in;
+	cfg.max_in_map_entries = CAM_CUSTOM_DEV_CTX_RES_MAX;
+	cfg.priv  = &req_custom->hw_update_data;
+	cfg.pf_data = &(req->pf_data);
+
+	rc = ctx->hw_mgr_intf->hw_prepare_update(
+		ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc != 0) {
+		CAM_ERR(CAM_CUSTOM, "Prepare config packet failed in HW layer");
+		rc = -EFAULT;
+		goto free_req;
+	}
+
+	req_custom->num_cfg = cfg.num_hw_update_entries;
+	req_custom->num_fence_map_out = cfg.num_out_map_entries;
+	req_custom->num_fence_map_in = cfg.num_in_map_entries;
+	req_custom->num_acked = 0;
+	req_custom->hw_update_data.num_cfg = cfg.num_out_map_entries;
+
+	for (i = 0; i < req_custom->num_fence_map_out; i++) {
+		rc = cam_sync_get_obj_ref(req_custom->fence_map_out[i].sync_id);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can't get ref for fence %d",
+				req_custom->fence_map_out[i].sync_id);
+			goto put_ref;
+		}
+	}
+
+	CAM_DBG(CAM_CUSTOM,
+		"num_entry: %d, num fence out: %d, num fence in: %d",
+		req_custom->num_cfg, req_custom->num_fence_map_out,
+		req_custom->num_fence_map_in);
+
+	req->request_id = packet->header.request_id;
+	req->status = 1;
+
+	CAM_DBG(CAM_CUSTOM, "Packet request id %lld packet opcode:%d",
+		packet->header.request_id,
+		req_custom->hw_update_data.packet_opcode_type);
+
+	if (req_custom->hw_update_data.packet_opcode_type ==
+		CAM_CUSTOM_PACKET_INIT_DEV) {
+		if (ctx->state < CAM_CTX_ACTIVATED) {
+			rc = __cam_custom_ctx_enqueue_init_request(ctx, req);
+			if (rc)
+				CAM_ERR(CAM_CUSTOM, "Enqueue INIT pkt failed");
+			ctx_custom->init_received = true;
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_CUSTOM, "Recevied INIT pkt in wrong state");
+		}
+	} else {
+		if ((ctx->state != CAM_CTX_FLUSHED) &&
+			(ctx->state >= CAM_CTX_READY) &&
+			(ctx->ctx_crm_intf->add_req)) {
+			memset(&add_req, 0, sizeof(add_req));
+			add_req.link_hdl = ctx->link_hdl;
+			add_req.dev_hdl  = ctx->dev_hdl;
+			add_req.req_id   = req->request_id;
+			rc = ctx->ctx_crm_intf->add_req(&add_req);
+			if (rc) {
+				CAM_ERR(CAM_CUSTOM,
+					"Add req failed: req id=%llu",
+					req->request_id);
+			} else {
+				__cam_custom_ctx_enqueue_request_in_order(
+					ctx, req);
+			}
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_CUSTOM, "Recevied Update in wrong state");
+		}
+	}
+
+	if (rc)
+		goto put_ref;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Preprocessing Config req_id %lld successful on ctx %u",
+		req->request_id, ctx->ctx_id);
+
+	return rc;
+
+put_ref:
+	for (--i; i >= 0; i--) {
+		if (cam_sync_put_obj_ref(req_custom->fence_map_out[i].sync_id))
+			CAM_ERR(CAM_CUSTOM, "Failed to put ref of fence %d",
+				req_custom->fence_map_out[i].sync_id);
+	}
+free_req:
+	spin_lock_bh(&ctx->lock);
+	list_add_tail(&req->list, &ctx->free_req_list);
+	spin_unlock_bh(&ctx->lock);
+
+	return rc;
+
+}
+
+static int __cam_custom_ctx_config_dev_in_flushed(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_start_stop_dev_cmd start_cmd;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (!custom_ctx->hw_acquired) {
+		CAM_ERR(CAM_CUSTOM, "HW is not acquired, reject packet");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = __cam_custom_ctx_config_dev(ctx, cmd);
+	if (rc)
+		goto end;
+
+	if (!custom_ctx->init_received) {
+		CAM_WARN(CAM_CUSTOM,
+			"Received update packet in flushed state, skip start");
+		goto end;
+	}
+
+	start_cmd.dev_handle = cmd->dev_handle;
+	start_cmd.session_handle = cmd->session_handle;
+	rc = __cam_custom_ctx_start_dev_in_ready(ctx, &start_cmd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM,
+			"Failed to re-start HW after flush rc: %d", rc);
+	else
+		CAM_INFO(CAM_CUSTOM,
+			"Received init after flush. Re-start HW complete.");
+
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_config_dev_in_acquired(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_custom_context        *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (!ctx_custom->hw_acquired) {
+		CAM_ERR(CAM_CUSTOM, "HW not acquired, reject config packet");
+		return -EAGAIN;
+	}
+
+	rc = __cam_custom_ctx_config_dev(ctx, cmd);
+
+	if (!rc && (ctx->link_hdl >= 0))
+		ctx->state = CAM_CTX_READY;
+
+	return rc;
+}
+
+static int __cam_custom_ctx_link_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *link)
+{
+	struct cam_custom_context *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	ctx->link_hdl = link->link_hdl;
+	ctx->ctx_crm_intf = link->crm_cb;
+
+	/* change state only if we had the init config */
+	if (ctx_custom->init_received)
+		ctx->state = CAM_CTX_READY;
+
+	CAM_DBG(CAM_CUSTOM, "next state %d", ctx->state);
+
+	return 0;
+}
+
+static int __cam_custom_ctx_start_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_custom_start_args     custom_start;
+	struct cam_ctx_request          *req;
+	struct cam_custom_dev_ctx_req   *req_custom;
+	struct cam_custom_context       *ctx_custom =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	if (cmd->session_handle != ctx->session_hdl ||
+		cmd->dev_handle != ctx->dev_hdl) {
+		rc = -EPERM;
+		goto end;
+	}
+
+	if (list_empty(&ctx->pending_req_list)) {
+		/* should never happen */
+		CAM_ERR(CAM_CUSTOM, "Start device with empty configuration");
+		rc = -EFAULT;
+		goto end;
+	} else {
+		req = list_first_entry(&ctx->pending_req_list,
+			struct cam_ctx_request, list);
+	}
+	req_custom = (struct cam_custom_dev_ctx_req *) req->req_priv;
+
+	if (!ctx_custom->hw_ctx) {
+		CAM_ERR(CAM_CUSTOM, "Wrong hw context pointer.");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	custom_start.hw_config.ctxt_to_hw_map = ctx_custom->hw_ctx;
+	custom_start.hw_config.request_id = req->request_id;
+	custom_start.hw_config.hw_update_entries = req_custom->cfg;
+	custom_start.hw_config.num_hw_update_entries = req_custom->num_cfg;
+	custom_start.hw_config.priv  = &req_custom->hw_update_data;
+	custom_start.hw_config.init_packet = 1;
+	if (ctx->state == CAM_CTX_FLUSHED)
+		custom_start.start_only = true;
+	else
+		custom_start.start_only = false;
+
+	ctx_custom->frame_id = 0;
+	ctx_custom->active_req_cnt = 0;
+	atomic_set(&ctx_custom->process_bubble, 0);
+	ctx_custom->substate_activated =
+		(req_custom->num_fence_map_out) ?
+		CAM_CUSTOM_CTX_ACTIVATED_APPLIED :
+		CAM_CUSTOM_CTX_ACTIVATED_SOF;
+
+	ctx->state = CAM_CTX_ACTIVATED;
+	rc = ctx->hw_mgr_intf->hw_start(ctx->hw_mgr_intf->hw_mgr_priv,
+		&custom_start);
+	if (rc) {
+		/* HW failure. User need to clean up the resource */
+		CAM_ERR(CAM_CUSTOM, "Start HW failed");
+		ctx->state = CAM_CTX_READY;
+		goto end;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "start device success ctx %u",
+		ctx->ctx_id);
+
+	spin_lock_bh(&ctx->lock);
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->wait_req_list);
+	spin_unlock_bh(&ctx->lock);
+
+end:
+	return rc;
+}
+
+static int __cam_custom_ctx_release_dev_in_activated(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	rc = __cam_custom_stop_dev_core(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Stop device failed rc=%d", rc);
+
+	rc = __cam_custom_release_dev_in_acquired(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Release device failed rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_unlink_in_activated(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc = 0;
+
+	CAM_WARN(CAM_CUSTOM,
+		"Received unlink in activated state. It's unexpected");
+
+	rc = __cam_custom_stop_dev_in_activated(ctx, NULL);
+	if (rc)
+		CAM_WARN(CAM_CUSTOM, "Stop device failed rc=%d", rc);
+
+	rc = __cam_custom_ctx_unlink_in_ready(ctx, unlink);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Unlink failed rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_handle_irq_in_activated(void *context,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc = 0;
+	struct cam_custom_ctx_irq_ops *custom_irq_ops = NULL;
+	struct cam_context *ctx = (struct cam_context *)context;
+	struct cam_custom_context *ctx_custom =
+		(struct cam_custom_context *)ctx->ctx_priv;
+
+	spin_lock(&ctx->lock);
+	CAM_DBG(CAM_CUSTOM, "Enter: State %d, Substate %d, evt id %d",
+		 ctx->state, ctx_custom->substate_activated, evt_id);
+	custom_irq_ops = &ctx_custom->substate_machine_irq[
+				ctx_custom->substate_activated];
+	if (custom_irq_ops->irq_ops[evt_id])
+		rc = custom_irq_ops->irq_ops[evt_id](ctx_custom,
+			evt_data);
+	else
+		CAM_DBG(CAM_CUSTOM, "No handle function for substate %d",
+			ctx_custom->substate_activated);
+
+	CAM_DBG(CAM_CUSTOM, "Exit: State %d Substate %d",
+		 ctx->state, ctx_custom->substate_activated);
+
+	spin_unlock(&ctx->lock);
+	return rc;
+}
+
+static int __cam_custom_ctx_acquire_hw_in_acquired(
+	struct cam_context *ctx, void *args)
+{
+	int rc = -EINVAL;
+	uint32_t api_version;
+
+	if (!ctx || !args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input pointer");
+		return rc;
+	}
+
+	api_version = *((uint32_t *)args);
+	if (api_version == 1)
+		rc = __cam_custom_ctx_acquire_hw_v1(ctx, args);
+	else
+		CAM_ERR(CAM_CUSTOM, "Unsupported api version %d",
+			api_version);
+
+	return rc;
+}
+
+static int __cam_custom_ctx_apply_req(struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_ctx_ops *ctx_ops = NULL;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Enter: apply req in Substate %d request _id:%lld",
+		 custom_ctx->substate_activated, apply->request_id);
+
+	ctx_ops = &custom_ctx->substate_machine[
+		custom_ctx->substate_activated];
+	if (ctx_ops->crm_ops.apply_req) {
+		rc = ctx_ops->crm_ops.apply_req(ctx, apply);
+	} else {
+		CAM_WARN_RATE_LIMIT(CAM_CUSTOM,
+			"No handle function in activated substate %d",
+			custom_ctx->substate_activated);
+		rc = -EFAULT;
+	}
+
+	if (rc)
+		CAM_WARN_RATE_LIMIT(CAM_CUSTOM,
+			"Apply failed in active substate %d rc %d",
+			custom_ctx->substate_activated, rc);
+	return rc;
+}
+
+static int __cam_custom_ctx_apply_default_req(
+	struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_ctx_ops *ctx_ops = NULL;
+	struct cam_custom_context *custom_ctx =
+		(struct cam_custom_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_CUSTOM,
+		"Enter: apply req in Substate %d request _id:%lld",
+		 custom_ctx->substate_activated, apply->request_id);
+
+	ctx_ops = &custom_ctx->substate_machine[
+		custom_ctx->substate_activated];
+	if (ctx_ops->crm_ops.notify_frame_skip) {
+		rc = ctx_ops->crm_ops.notify_frame_skip(ctx, apply);
+	} else {
+		CAM_WARN_RATE_LIMIT(CAM_CUSTOM,
+			"No handle function in activated substate %d",
+			custom_ctx->substate_activated);
+		rc = -EFAULT;
+	}
+
+	if (rc)
+		CAM_WARN_RATE_LIMIT(CAM_CUSTOM,
+			"Apply default failed in active substate %d rc %d",
+			custom_ctx->substate_activated, rc);
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_custom_dev_ctx_top_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev =
+				__cam_custom_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.acquire_hw = __cam_custom_ctx_acquire_hw_in_acquired,
+			.release_dev = __cam_custom_release_dev_in_acquired,
+			.config_dev = __cam_custom_ctx_config_dev_in_acquired,
+			.release_hw = __cam_custom_ctx_release_hw_in_top_state,
+		},
+		.crm_ops = {
+			.link = __cam_custom_ctx_link_in_acquired,
+			.unlink = __cam_custom_ctx_unlink_in_acquired,
+			.get_dev_info =
+				__cam_custom_ctx_get_dev_info_in_acquired,
+			.flush_req = __cam_custom_ctx_flush_req_in_top_state,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = NULL,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {
+			.start_dev = __cam_custom_ctx_start_dev_in_ready,
+			.release_dev = __cam_custom_release_dev_in_acquired,
+			.config_dev = __cam_custom_ctx_config_dev,
+			.release_hw = __cam_custom_ctx_release_hw_in_top_state,
+		},
+		.crm_ops = {
+			.unlink = __cam_custom_ctx_unlink_in_ready,
+			.flush_req = __cam_custom_ctx_flush_req_in_ready,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = NULL,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_custom_stop_dev_in_activated,
+			.release_dev =
+				__cam_custom_ctx_release_dev_in_activated,
+			.config_dev = __cam_custom_ctx_config_dev_in_flushed,
+			.release_hw =
+				__cam_custom_ctx_release_hw_in_activated_state,
+		},
+		.crm_ops = {
+			.unlink = __cam_custom_ctx_unlink_in_ready,
+			.process_evt = __cam_custom_ctx_handle_evt,
+		},
+		.irq_ops = NULL,
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_custom_stop_dev_in_activated,
+			.release_dev =
+				__cam_custom_ctx_release_dev_in_activated,
+			.config_dev = __cam_custom_ctx_config_dev,
+			.release_hw =
+				__cam_custom_ctx_release_hw_in_activated_state,
+		},
+		.crm_ops = {
+			.unlink = __cam_custom_ctx_unlink_in_activated,
+			.apply_req = __cam_custom_ctx_apply_req,
+			.notify_frame_skip =
+				__cam_custom_ctx_apply_default_req,
+			.flush_req = __cam_custom_ctx_flush_req_in_top_state,
+			.process_evt = __cam_custom_ctx_handle_evt,
+		},
+		.irq_ops = __cam_custom_ctx_handle_irq_in_activated,
+		.pagefault_ops = NULL,
+	},
+};
+
+int cam_custom_dev_context_init(struct cam_custom_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_req_mgr_kmd_ops *crm_node_intf,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id)
+{
+	int rc = -1, i = 0;
+
+	if (!ctx || !ctx_base) {
+		CAM_ERR(CAM_CUSTOM, "Invalid Context");
+		return -EINVAL;
+	}
+
+	/* Custom HW context setup */
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->base = ctx_base;
+	ctx->frame_id = 0;
+	ctx->active_req_cnt = 0;
+	ctx->hw_ctx = NULL;
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		ctx->req_base[i].req_priv = &ctx->req_custom[i];
+		ctx->req_custom[i].base = &ctx->req_base[i];
+	}
+
+	/* camera context setup */
+	rc = cam_context_init(ctx_base, custom_dev_name, CAM_CUSTOM, ctx_id,
+		crm_node_intf, hw_intf, ctx->req_base, CAM_CTX_REQ_MAX);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Camera Context Base init failed");
+		return rc;
+	}
+
+	/* link camera context with custom HW context */
+	ctx_base->state_machine = cam_custom_dev_ctx_top_state_machine;
+	ctx_base->ctx_priv = ctx;
+
+	return rc;
+}
+
+int cam_custom_dev_context_deinit(struct cam_custom_context *ctx)
+{
+	if (ctx->base)
+		cam_context_deinit(ctx->base);
+
+	memset(ctx, 0, sizeof(*ctx));
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_context.h
@@ -0,0 +1,153 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_CONTEXT_H_
+#define _CAM_CUSTOM_CONTEXT_H_
+
+#include <linux/spinlock.h>
+
+#include <media/cam_custom.h>
+#include <media/cam_defs.h>
+
+#include "cam_context.h"
+#include "cam_custom_hw_mgr_intf.h"
+
+/*
+ * Maximum hw resource - This number is based on the maximum
+ * output port resource. The current maximum resource number
+ * is 2.
+ */
+#define CAM_CUSTOM_DEV_CTX_RES_MAX                     1
+
+#define CAM_CUSTOM_CTX_CFG_MAX                         8
+
+/* forward declaration */
+struct cam_custom_context;
+
+/* cam custom context irq handling function type */
+typedef int (*cam_custom_hw_event_cb_func)(
+	struct cam_custom_context *custom_ctx, void *evt_data);
+
+/**
+ * enum cam_custom_ctx_activated_substate - sub states for activated
+ *
+ */
+enum cam_custom_ctx_activated_substate {
+	CAM_CUSTOM_CTX_ACTIVATED_SOF,
+	CAM_CUSTOM_CTX_ACTIVATED_APPLIED,
+	CAM_CUSTOM_CTX_ACTIVATED_HW_ERROR,
+	CAM_CUSTOM_CTX_ACTIVATED_HALT,
+	CAM_CUSTOM_CTX_ACTIVATED_MAX,
+};
+
+/**
+ * struct cam_custom_ctx_irq_ops - Function table for handling IRQ callbacks
+ *
+ * @irq_ops:               Array of handle function pointers.
+ *
+ */
+struct cam_custom_ctx_irq_ops {
+	cam_custom_hw_event_cb_func         irq_ops[CAM_CUSTOM_HW_EVENT_MAX];
+};
+
+/**
+ * struct cam_custom_dev_ctx_req - Custom context request object
+ *
+ * @base:                  Common request object pointer
+ * @cfg:                   Custom hardware configuration array
+ * @num_cfg:               Number of custom hardware configuration entries
+ * @fence_map_out:         Output fence mapping array
+ * @num_fence_map_out:     Number of the output fence map
+ * @fence_map_in:          Input fence mapping array
+ * @num_fence_map_in:      Number of input fence map
+ * @num_acked:             Count to track acked entried for output.
+ *                         If count equals the number of fence out, it means
+ *                         the request has been completed.
+ * @bubble_report:         If bubble recovery is needed
+ * @bubble_detected:       request has bubbled
+ * @hw_update_data:        HW update data for this request
+ *
+ */
+struct cam_custom_dev_ctx_req {
+	struct cam_ctx_request                  *base;
+	struct cam_hw_update_entry               cfg
+						[CAM_CUSTOM_CTX_CFG_MAX];
+	uint32_t                                 num_cfg;
+	struct cam_hw_fence_map_entry            fence_map_out
+						[CAM_CUSTOM_DEV_CTX_RES_MAX];
+	uint32_t                                 num_fence_map_out;
+	struct cam_hw_fence_map_entry            fence_map_in
+						[CAM_CUSTOM_DEV_CTX_RES_MAX];
+	uint32_t                                 num_fence_map_in;
+	uint32_t                                 num_acked;
+	int32_t                                  bubble_report;
+	bool                                     bubble_detected;
+	struct cam_custom_prepare_hw_update_data hw_update_data;
+};
+
+/**
+ * struct cam_custom_context - Custom device context
+ * @base: custom device context object
+ * @state_machine: state machine for Custom device context
+ * @state: Common context state
+ * @hw_ctx: HW object returned by the acquire device command
+ * @init_received: Indicate whether init config packet is received
+ * @active_req_cnt: Counter for the active request
+ * @frame_id: Frame id tracking for the custom context
+ * @hw_acquired: Flag to indicate if HW is acquired for this context
+ * @process_bubble: If ctx currently processing bubble
+ * @substate_actiavted: Current substate for the activated state.
+ * @substate_machine: Custom substate machine for external interface
+ * @substate_machine_irq: Custom substate machine for irq handling
+ * @req_base: common request structure
+ * @req_custom: custom request structure
+ *
+ */
+struct cam_custom_context {
+	struct cam_context            *base;
+	struct cam_ctx_ops            *state_machine;
+	uint32_t                       state;
+	void                          *hw_ctx;
+	bool                           init_received;
+	uint32_t                       active_req_cnt;
+	int64_t                        frame_id;
+	bool                           hw_acquired;
+	uint32_t                       substate_activated;
+	atomic_t                       process_bubble;
+	struct cam_ctx_ops            *substate_machine;
+	struct cam_custom_ctx_irq_ops *substate_machine_irq;
+	struct cam_ctx_request         req_base[CAM_CTX_REQ_MAX];
+	struct cam_custom_dev_ctx_req  req_custom[CAM_CTX_REQ_MAX];
+};
+
+
+/**
+ * cam_custom_dev_context_init()
+ *
+ * @brief:              Initialization function for the custom context
+ *
+ * @ctx:                Custom context obj to be initialized
+ * @bridge_ops:         Bridge call back funciton
+ * @hw_intf:            Cust hw manager interface
+ * @ctx_id:             ID for this context
+ *
+ */
+int cam_custom_dev_context_init(struct cam_custom_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_req_mgr_kmd_ops *bridge_ops,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id);
+
+/**
+ * cam_custom_dev_context_deinit()
+ *
+ * @brief:               Deinitialize function for the Custom context
+ *
+ * @ctx:                 Custom context obj to be deinitialized
+ *
+ */
+int cam_custom_dev_context_deinit(struct cam_custom_context *ctx);
+
+#endif  /* _CAM_CUSTOM_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_dev.c
@@ -0,0 +1,241 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/ion.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include <media/cam_req_mgr.h>
+
+#include "cam_custom_dev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_custom_hw_mgr_intf.h"
+#include "cam_node.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+
+static struct cam_custom_dev g_custom_dev;
+
+static void cam_custom_dev_iommu_fault_handler(
+	struct cam_smmu_pf_info *pf_info)
+{
+	int i = 0;
+	struct cam_node *node = NULL;
+
+	if (!pf_info || !pf_info->token) {
+		CAM_ERR(CAM_CUSTOM, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_info->token;
+
+	for (i = 0; i < node->ctx_size; i++)
+		cam_context_dump_pf_info(&(node->ctx_list[i]), pf_info);
+}
+
+static const struct of_device_id cam_custom_dt_match[] = {
+	{
+		.compatible = "qcom,cam-custom"
+	},
+	{}
+};
+
+static int cam_custom_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	mutex_lock(&g_custom_dev.custom_dev_mutex);
+	g_custom_dev.open_cnt++;
+	mutex_unlock(&g_custom_dev.custom_dev_mutex);
+
+	return 0;
+}
+
+static int cam_custom_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&g_custom_dev.custom_dev_mutex);
+	if (g_custom_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_CUSTOM, "Custom subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	g_custom_dev.open_cnt--;
+	if (!node) {
+		CAM_ERR(CAM_CUSTOM, "Node ptr is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (g_custom_dev.open_cnt == 0)
+		cam_node_shutdown(node);
+
+end:
+	mutex_unlock(&g_custom_dev.custom_dev_mutex);
+	return rc;
+}
+
+static int cam_custom_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_CUSTOM, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_custom_subdev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_custom_subdev_internal_ops = {
+	.close = cam_custom_subdev_close,
+	.open = cam_custom_subdev_open,
+};
+
+static int cam_custom_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = -EINVAL;
+	int i;
+	struct cam_hw_mgr_intf         hw_mgr_intf;
+	struct cam_node                *node;
+	int iommu_hdl = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	g_custom_dev.sd.internal_ops = &cam_custom_subdev_internal_ops;
+	g_custom_dev.sd.close_seq_prior = CAM_SD_CLOSE_HIGH_PRIORITY;
+
+	rc = cam_subdev_probe(&g_custom_dev.sd, pdev, CAM_CUSTOM_DEV_NAME,
+		CAM_CUSTOM_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Custom device cam_subdev_probe failed!");
+		goto err;
+	}
+	node = (struct cam_node *) g_custom_dev.sd.token;
+
+	memset(&hw_mgr_intf, 0, sizeof(hw_mgr_intf));
+	rc = cam_custom_hw_mgr_init(pdev->dev.of_node,
+		&hw_mgr_intf, &iommu_hdl);
+	if (rc != 0) {
+		CAM_ERR(CAM_CUSTOM, "Can not initialized Custom HW manager!");
+		goto unregister;
+	}
+
+	for (i = 0; i < CAM_CUSTOM_HW_MAX_INSTANCES; i++) {
+		rc = cam_custom_dev_context_init(&g_custom_dev.ctx_custom[i],
+			&g_custom_dev.ctx[i],
+			&node->crm_node_intf,
+			&node->hw_mgr_intf,
+			i);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Custom context init failed!");
+			goto unregister;
+		}
+	}
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_custom_dev.ctx,
+		CAM_CUSTOM_HW_MAX_INSTANCES, CAM_CUSTOM_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Custom HW node init failed!");
+		goto unregister;
+	}
+
+	node->sd_handler = cam_custom_subdev_close_internal;
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_custom_dev_iommu_fault_handler, node);
+
+	mutex_init(&g_custom_dev.custom_dev_mutex);
+
+	rc = cam_subdev_register(&g_custom_dev.sd, pdev);
+	CAM_DBG(CAM_CUSTOM, "%s component bound successfully", pdev->name);
+
+	return rc;
+unregister:
+	rc = cam_subdev_remove(&g_custom_dev.sd);
+err:
+	return rc;
+}
+
+static void cam_custom_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	int i;
+
+	/* clean up resources */
+	for (i = 0; i < CAM_CUSTOM_HW_MAX_INSTANCES; i++) {
+		rc = cam_custom_dev_context_deinit(&g_custom_dev.ctx_custom[i]);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM,
+				"Custom context %d deinit failed", i);
+	}
+
+	rc = cam_unregister_subdev(&g_custom_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Unregister failed");
+
+	rc = cam_subdev_remove(&g_custom_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Subdev remove failed");
+
+	memset(&g_custom_dev, 0, sizeof(g_custom_dev));
+}
+
+const static struct component_ops cam_custom_component_ops = {
+	.bind = cam_custom_component_bind,
+	.unbind = cam_custom_component_unbind,
+};
+
+static int cam_custom_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_custom_component_ops);
+	return 0;
+}
+
+static int cam_custom_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CUSTOM, "Adding Custom HW component");
+	rc = component_add(&pdev->dev, &cam_custom_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+struct platform_driver custom_driver = {
+	.probe = cam_custom_dev_probe,
+	.remove = cam_custom_dev_remove,
+	.driver = {
+		.name = "cam_custom",
+		.of_match_table = cam_custom_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_custom_dev_init_module(void)
+{
+	return platform_driver_register(&custom_driver);
+}
+
+void cam_custom_dev_exit_module(void)
+{
+	platform_driver_unregister(&custom_driver);
+}
+
+MODULE_DESCRIPTION("MSM CUSTOM driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_dev.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_DEV_H_
+#define _CAM_CUSTOM_DEV_H_
+
+#include "cam_subdev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_custom_hw_mgr.h"
+#include "cam_context.h"
+#include "cam_custom_context.h"
+
+#define CAM_CUSTOM_HW_MAX_INSTANCES 3
+
+/**
+ * struct cam_custom_dev - Camera Custom V4l2 device node
+ *
+ * @sd:                    Common camera subdevice node
+ * @ctx:                   Custom base context storage
+ * @ctx_custom:            Custom private context storage
+ * @custom_dev_mutex:      Custom dev mutex
+ * @open_cnt:              Open device count
+ */
+struct cam_custom_dev {
+	struct cam_subdev          sd;
+	struct cam_context         ctx[CAM_CUSTOM_HW_MAX_INSTANCES];
+	struct cam_custom_context  ctx_custom[CAM_CUSTOM_HW_MAX_INSTANCES];
+	struct mutex               custom_dev_mutex;
+	int32_t                    open_cnt;
+};
+
+/**
+ * @brief : API to register Custom hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_custom_dev_init_module(void);
+
+/**
+ * @brief : API to remove Custom hw interface from platform framework.
+ */
+void cam_custom_dev_exit_module(void);
+#endif /* _CAM_CUSTOM_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid480.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid480.h
@@ -0,0 +1,272 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_CSID_480_H_
+#define _CAM_CUSTOM_CSID_480_H_
+
+#include "cam_ife_csid_core.h"
+
+#define CAM_CSID_VERSION_V480                 0x40080000
+
+static struct cam_ife_csid_udi_reg_offset
+	cam_custom_csid_480_udi_0_reg_offset = {
+	.csid_udi_irq_status_addr                 = 0x30,
+	.csid_udi_irq_mask_addr                   = 0x34,
+	.csid_udi_irq_clear_addr                  = 0x38,
+	.csid_udi_irq_set_addr                    = 0x3c,
+	.csid_udi_cfg0_addr                       = 0x200,
+	.csid_udi_cfg1_addr                       = 0x204,
+	.csid_udi_ctrl_addr                       = 0x208,
+	.csid_udi_frm_drop_pattern_addr           = 0x20c,
+	.csid_udi_frm_drop_period_addr            = 0x210,
+	.csid_udi_irq_subsample_pattern_addr      = 0x214,
+	.csid_udi_irq_subsample_period_addr       = 0x218,
+	.csid_udi_rpp_hcrop_addr                  = 0x21c,
+	.csid_udi_rpp_vcrop_addr                  = 0x220,
+	.csid_udi_rpp_pix_drop_pattern_addr       = 0x224,
+	.csid_udi_rpp_pix_drop_period_addr        = 0x228,
+	.csid_udi_rpp_line_drop_pattern_addr      = 0x22c,
+	.csid_udi_rpp_line_drop_period_addr       = 0x230,
+	.csid_udi_rst_strobes_addr                = 0x240,
+	.csid_udi_status_addr                     = 0x250,
+	.csid_udi_misr_val0_addr                  = 0x254,
+	.csid_udi_misr_val1_addr                  = 0x258,
+	.csid_udi_misr_val2_addr                  = 0x25c,
+	.csid_udi_misr_val3_addr                  = 0x260,
+	.csid_udi_format_measure_cfg0_addr        = 0x270,
+	.csid_udi_format_measure_cfg1_addr        = 0x274,
+	.csid_udi_format_measure0_addr            = 0x278,
+	.csid_udi_format_measure1_addr            = 0x27c,
+	.csid_udi_format_measure2_addr            = 0x280,
+	.csid_udi_timestamp_curr0_sof_addr        = 0x290,
+	.csid_udi_timestamp_curr1_sof_addr        = 0x294,
+	.csid_udi_timestamp_prev0_sof_addr        = 0x298,
+	.csid_udi_timestamp_prev1_sof_addr        = 0x29c,
+	.csid_udi_timestamp_curr0_eof_addr        = 0x2a0,
+	.csid_udi_timestamp_curr1_eof_addr        = 0x2a4,
+	.csid_udi_timestamp_prev0_eof_addr        = 0x2a8,
+	.csid_udi_timestamp_prev1_eof_addr        = 0x2ac,
+	.csid_udi_err_recovery_cfg0_addr          = 0x2b0,
+	.csid_udi_err_recovery_cfg1_addr          = 0x2b4,
+	.csid_udi_err_recovery_cfg2_addr          = 0x2b8,
+	.csid_udi_multi_vcdt_cfg0_addr            = 0x2bc,
+	.csid_udi_byte_cntr_ping_addr             = 0x2e0,
+	.csid_udi_byte_cntr_pong_addr             = 0x2e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 0,
+};
+
+static struct cam_ife_csid_udi_reg_offset
+	cam_custom_csid_480_udi_1_reg_offset = {
+	.csid_udi_irq_status_addr                 = 0x40,
+	.csid_udi_irq_mask_addr                   = 0x44,
+	.csid_udi_irq_clear_addr                  = 0x48,
+	.csid_udi_irq_set_addr                    = 0x4c,
+	.csid_udi_cfg0_addr                       = 0x300,
+	.csid_udi_cfg1_addr                       = 0x304,
+	.csid_udi_ctrl_addr                       = 0x308,
+	.csid_udi_frm_drop_pattern_addr           = 0x30c,
+	.csid_udi_frm_drop_period_addr            = 0x310,
+	.csid_udi_irq_subsample_pattern_addr      = 0x314,
+	.csid_udi_irq_subsample_period_addr       = 0x318,
+	.csid_udi_rpp_hcrop_addr                  = 0x31c,
+	.csid_udi_rpp_vcrop_addr                  = 0x320,
+	.csid_udi_rpp_pix_drop_pattern_addr       = 0x324,
+	.csid_udi_rpp_pix_drop_period_addr        = 0x328,
+	.csid_udi_rpp_line_drop_pattern_addr      = 0x32c,
+	.csid_udi_rpp_line_drop_period_addr       = 0x330,
+	.csid_udi_rst_strobes_addr                = 0x340,
+	.csid_udi_status_addr                     = 0x350,
+	.csid_udi_misr_val0_addr                  = 0x354,
+	.csid_udi_misr_val1_addr                  = 0x358,
+	.csid_udi_misr_val2_addr                  = 0x35c,
+	.csid_udi_misr_val3_addr                  = 0x360,
+	.csid_udi_format_measure_cfg0_addr        = 0x370,
+	.csid_udi_format_measure_cfg1_addr        = 0x374,
+	.csid_udi_format_measure0_addr            = 0x378,
+	.csid_udi_format_measure1_addr            = 0x37c,
+	.csid_udi_format_measure2_addr            = 0x380,
+	.csid_udi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_udi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_udi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_udi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_udi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_udi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_udi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_udi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_udi_err_recovery_cfg0_addr          = 0x3b0,
+	.csid_udi_err_recovery_cfg1_addr          = 0x3b4,
+	.csid_udi_err_recovery_cfg2_addr          = 0x3b8,
+	.csid_udi_multi_vcdt_cfg0_addr            = 0x3bc,
+	.csid_udi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_udi_byte_cntr_pong_addr             = 0x3e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 0,
+};
+
+static struct cam_ife_csid_udi_reg_offset
+	cam_custom_csid_480_udi_2_reg_offset = {
+	.csid_udi_irq_status_addr                 = 0x50,
+	.csid_udi_irq_mask_addr                   = 0x54,
+	.csid_udi_irq_clear_addr                  = 0x58,
+	.csid_udi_irq_set_addr                    = 0x5c,
+	.csid_udi_cfg0_addr                       = 0x400,
+	.csid_udi_cfg1_addr                       = 0x404,
+	.csid_udi_ctrl_addr                       = 0x408,
+	.csid_udi_frm_drop_pattern_addr           = 0x40c,
+	.csid_udi_frm_drop_period_addr            = 0x410,
+	.csid_udi_irq_subsample_pattern_addr      = 0x414,
+	.csid_udi_irq_subsample_period_addr       = 0x418,
+	.csid_udi_rpp_hcrop_addr                  = 0x41c,
+	.csid_udi_rpp_vcrop_addr                  = 0x420,
+	.csid_udi_rpp_pix_drop_pattern_addr       = 0x424,
+	.csid_udi_rpp_pix_drop_period_addr        = 0x428,
+	.csid_udi_rpp_line_drop_pattern_addr      = 0x42c,
+	.csid_udi_rpp_line_drop_period_addr       = 0x430,
+	.csid_udi_yuv_chroma_conversion_addr      = 0x434,
+	.csid_udi_rst_strobes_addr                = 0x440,
+	.csid_udi_status_addr                     = 0x450,
+	.csid_udi_misr_val0_addr                  = 0x454,
+	.csid_udi_misr_val1_addr                  = 0x458,
+	.csid_udi_misr_val2_addr                  = 0x45c,
+	.csid_udi_misr_val3_addr                  = 0x460,
+	.csid_udi_format_measure_cfg0_addr        = 0x470,
+	.csid_udi_format_measure_cfg1_addr        = 0x474,
+	.csid_udi_format_measure0_addr            = 0x478,
+	.csid_udi_format_measure1_addr            = 0x47c,
+	.csid_udi_format_measure2_addr            = 0x480,
+	.csid_udi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_udi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_udi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_udi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_udi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_udi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_udi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_udi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_udi_err_recovery_cfg0_addr          = 0x4b0,
+	.csid_udi_err_recovery_cfg1_addr          = 0x4b4,
+	.csid_udi_err_recovery_cfg2_addr          = 0x4b8,
+	.csid_udi_multi_vcdt_cfg0_addr            = 0x4bc,
+	.csid_udi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_udi_byte_cntr_pong_addr             = 0x4e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 0,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_offset
+			cam_custom_csid_480_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_de_scramble_cfg0_addr           = 0x114,
+	.csid_csi2_rx_de_scramble_cfg1_addr           = 0x118,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_lane0_misr_addr                 = 0x150,
+	.csid_csi2_rx_lane1_misr_addr                 = 0x154,
+	.csid_csi2_rx_lane2_misr_addr                 = 0x158,
+	.csid_csi2_rx_lane3_misr_addr                 = 0x15c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 15,
+	.csi2_capture_cphy_pkt_dt_shift               = 20,
+	.csi2_capture_cphy_pkt_vc_shift               = 26,
+	.csi2_rx_phy_num_mask                         = 0x3,
+};
+
+static struct cam_ife_csid_common_reg_offset
+			cam_custom_csid_480_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_reset_addr                              = 0xc,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 1,
+	.minor_version                                = 7,
+	.version_incr                                 = 0,
+	.num_udis                                     = 3,
+	.num_rdis                                     = 0,
+	.num_pix                                      = 0,
+	.num_ppp                                      = 0,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.path_rst_stb_all                             = 0x7f,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0,
+	.rdi_irq_mask_all                             = 0,
+	.ppp_irq_mask_all                             = 0,
+	.udi_irq_mask_all                             = 0x7FFF,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xC,
+	.format_measure_en_val                        = 1,
+	.num_bytes_out_shift_val                      = 3,
+};
+
+static struct cam_ife_csid_reg_offset cam_custom_csid_480_reg_offset = {
+	.cmn_reg          = &cam_custom_csid_480_cmn_reg_offset,
+	.csi2_reg         = &cam_custom_csid_480_csi2_reg_offset,
+	.ipp_reg          = NULL,
+	.ppp_reg          = NULL,
+	.rdi_reg = {
+		NULL,
+		NULL,
+		NULL,
+		NULL,
+	},
+	.udi_reg = {
+		&cam_custom_csid_480_udi_0_reg_offset,
+		&cam_custom_csid_480_udi_1_reg_offset,
+		&cam_custom_csid_480_udi_2_reg_offset,
+	},
+	.tpg_reg = NULL,
+};
+
+#endif /*_CAM_IFE_CSID_480_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.c
@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include "linux/module.h"
+#include "cam_custom_csid_dev.h"
+#include "cam_ife_csid_core.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_custom_csid480.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+#define CAM_CUSTOM_CSID_DRV_NAME  "custom_csid"
+
+static struct cam_hw_intf *cam_custom_csid_hw_list[CAM_IFE_CSID_HW_NUM_MAX] = {
+	0, 0, 0, 0};
+
+static char csid_dev_name[16];
+
+static struct cam_ife_csid_hw_info cam_custom_csid480_hw_info = {
+	.csid_reg = &cam_custom_csid_480_reg_offset,
+	.hw_dts_version = CAM_CSID_VERSION_V480,
+};
+
+static int cam_custom_csid_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+
+	struct cam_hw_intf	       *csid_hw_intf;
+	struct cam_hw_info	       *csid_hw_info;
+	struct cam_ife_csid_hw	       *csid_dev = NULL;
+	const struct of_device_id      *match_dev = NULL;
+	struct cam_ife_csid_hw_info    *csid_hw_data = NULL;
+	uint32_t			csid_dev_idx;
+	int				rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	csid_hw_intf = kzalloc(sizeof(*csid_hw_intf), GFP_KERNEL);
+	if (!csid_hw_intf) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	csid_hw_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!csid_hw_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	csid_dev = kzalloc(sizeof(struct cam_ife_csid_hw), GFP_KERNEL);
+	if (!csid_dev) {
+		rc = -ENOMEM;
+		goto free_hw_info;
+	}
+
+	/* get custom csid hw index */
+	of_property_read_u32(pdev->dev.of_node, "cell-index", &csid_dev_idx);
+	/* get custom csid hw information */
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_CUSTOM,
+			"No matching table for the CUSTOM CSID HW!");
+		rc = -EINVAL;
+		goto free_dev;
+	}
+
+	memset(csid_dev_name, 0, sizeof(csid_dev_name));
+	snprintf(csid_dev_name, sizeof(csid_dev_name),
+		"csid-custom%1u", csid_dev_idx);
+
+	csid_hw_intf->hw_idx = csid_dev_idx;
+	csid_hw_intf->hw_type = CAM_ISP_HW_TYPE_IFE_CSID;
+	csid_hw_intf->hw_priv = csid_hw_info;
+
+	csid_hw_info->core_info = csid_dev;
+	csid_hw_info->soc_info.pdev = pdev;
+	csid_hw_info->soc_info.dev = &pdev->dev;
+	csid_hw_info->soc_info.dev_name = csid_dev_name;
+	csid_hw_info->soc_info.index = csid_dev_idx;
+
+	csid_hw_data = (struct cam_ife_csid_hw_info  *)match_dev->data;
+	csid_dev->csid_info = csid_hw_data;
+
+	rc = cam_ife_csid_hw_probe_init(csid_hw_intf, csid_dev_idx, true);
+	if (rc)
+		goto free_dev;
+
+	platform_set_drvdata(pdev, csid_dev);
+
+	if (csid_hw_intf->hw_idx < CAM_IFE_CSID_HW_NUM_MAX)
+		cam_custom_csid_hw_list[csid_hw_intf->hw_idx] = csid_hw_intf;
+	else
+		goto free_dev;
+
+	CAM_DBG(CAM_CUSTOM, "CSID:%d component bound successfully",
+		csid_hw_intf->hw_idx);
+
+	return 0;
+
+free_dev:
+	kfree(csid_dev);
+free_hw_info:
+	kfree(csid_hw_info);
+free_hw_intf:
+	kfree(csid_hw_intf);
+err:
+	return rc;
+}
+
+static void cam_custom_csid_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_ife_csid_hw         *csid_dev = NULL;
+	struct cam_hw_intf             *csid_hw_intf;
+	struct cam_hw_info             *csid_hw_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	csid_dev = (struct cam_ife_csid_hw *)platform_get_drvdata(pdev);
+	csid_hw_intf = csid_dev->hw_intf;
+	csid_hw_info = csid_dev->hw_info;
+
+	CAM_DBG(CAM_CUSTOM, "CSID:%d component unbind",
+		csid_dev->hw_intf->hw_idx);
+
+	cam_ife_csid_hw_deinit(csid_dev);
+
+	/*release the csid device memory */
+	kfree(csid_dev);
+	kfree(csid_hw_info);
+	kfree(csid_hw_intf);
+}
+
+const static struct component_ops cam_custom_csid_component_ops = {
+	.bind = cam_custom_csid_component_bind,
+	.unbind = cam_custom_csid_component_unbind,
+};
+
+static int cam_custom_csid_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CUSTOM, "Adding Custom CSID component");
+	rc = component_add(&pdev->dev, &cam_custom_csid_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_custom_csid_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_custom_csid_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_custom_csid_dt_match[] = {
+	{
+		.compatible = "qcom,csid-custom480",
+		.data = &cam_custom_csid480_hw_info
+	},
+	{
+		.compatible = "qcom,csid-custom580",
+		.data = &cam_custom_csid480_hw_info
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_custom_csid_dt_match);
+
+struct platform_driver cam_custom_csid_driver = {
+	.probe = cam_custom_csid_probe,
+	.driver = {
+		.name = "qcom,custom-csid",
+		.of_match_table = cam_custom_csid_dt_match,
+		.suppress_bind_attrs = true,
+	},
+	.remove = cam_custom_csid_remove,
+};
+
+int cam_custom_csid_driver_init(void)
+{
+	int32_t rc = 0;
+
+	rc = platform_driver_register(&cam_custom_csid_driver);
+	if (rc < 0)
+		CAM_ERR(CAM_CUSTOM, "platform_driver_register Failed: rc = %d",
+			rc);
+
+	return rc;
+}
+
+int cam_custom_csid_hw_init(struct cam_hw_intf **custom_csid_hw,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_custom_csid_hw_list[hw_idx]) {
+		*custom_csid_hw = cam_custom_csid_hw_list[hw_idx];
+	} else {
+		*custom_csid_hw = NULL;
+		rc = -1;
+	}
+
+	return rc;
+}
+
+void cam_custom_csid_driver_exit(void)
+{
+	platform_driver_unregister(&cam_custom_csid_driver);
+}
+
+MODULE_DESCRIPTION("cam_custom_csid_driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_csid/cam_custom_csid_dev.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_CSID_DEV_H_
+#define _CAM_CUSTOM_CSID_DEV_H_
+
+#include "cam_debug_util.h"
+#include "cam_custom_hw_mgr_intf.h"
+
+/**
+ * @brief : API to register Custom CSID hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_custom_csid_driver_init(void);
+
+/**
+ * @brief : API to remove Custom CSID hw interface from platform framework.
+ */
+void cam_custom_csid_driver_exit(void);
+
+#endif /*_CAM_CUSTOM_CSID_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.c
@@ -0,0 +1,335 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/timer.h>
+#include <linux/ratelimit.h>
+#include "cam_custom_sub_mod_core.h"
+
+int cam_custom_hw_sub_mod_get_hw_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+	/* Add HW Capabilities to be published */
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_custom_resource_node   *custom_res = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	custom_hw->open_count++;
+	if (custom_hw->open_count > 1) {
+		mutex_unlock(&custom_hw->hw_mutex);
+		CAM_DBG(CAM_CUSTOM,
+			"Cam Custom has already been initialized cnt %d",
+			custom_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	soc_info = &custom_hw->soc_info;
+
+	/* Turn ON Regulators, Clocks and other SOC resources */
+	rc = cam_custom_hw_sub_mod_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Enable SOC failed");
+		rc = -EFAULT;
+		goto decrement_open_cnt;
+	}
+
+	custom_res   = (struct cam_custom_resource_node *)init_hw_args;
+	if (custom_res && custom_res->init) {
+		rc = custom_res->init(custom_res, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "init Failed rc=%d", rc);
+			goto decrement_open_cnt;
+		}
+	}
+
+	rc = cam_custom_hw_sub_mod_reset(hw_priv, NULL, 0);
+	if (rc < 0) {
+		CAM_ERR(CAM_CUSTOM, "Custom HW reset failed : %d", rc);
+		goto decrement_open_cnt;
+	}
+	/* Initialize all resources here */
+	custom_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	return rc;
+
+decrement_open_cnt:
+	mutex_lock(&custom_hw->hw_mutex);
+	custom_hw->open_count--;
+	mutex_unlock(&custom_hw->hw_mutex);
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_custom_resource_node   *custom_res = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	if (!custom_hw->open_count) {
+		mutex_unlock(&custom_hw->hw_mutex);
+		CAM_ERR(CAM_CUSTOM, "Error! Unbalanced deinit");
+		return -EFAULT;
+	}
+	custom_hw->open_count--;
+	if (custom_hw->open_count) {
+		mutex_unlock(&custom_hw->hw_mutex);
+		CAM_DBG(CAM_CUSTOM,
+			"open_cnt non-zero =%d", custom_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	soc_info = &custom_hw->soc_info;
+
+	custom_res   = (struct cam_custom_resource_node *)deinit_hw_args;
+	if (custom_res && custom_res->deinit) {
+		rc = custom_res->deinit(custom_res, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "deinit failed");
+	}
+
+	rc = cam_custom_hw_sub_mod_reset(hw_priv, NULL, 0);
+
+	/* Turn OFF Regulators, Clocks and other SOC resources */
+	CAM_DBG(CAM_CUSTOM, "Disable SOC resource");
+	rc = cam_custom_hw_sub_mod_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "Disable SOC failed");
+
+	custom_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_reset(void *hw_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw  = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &custom_hw->soc_info;
+	/* Do Reset of HW */
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_reserve(void *hw_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	int rc = 0;
+
+	if (!hw_priv || !reserve_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	/*Reserve Args */
+	return rc;
+}
+
+
+int cam_custom_hw_sub_mod_release(void *hw_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw  = hw_priv;
+	int rc = 0;
+
+	if (!hw_priv || !release_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	/* Release Resources */
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	return rc;
+}
+
+
+int cam_custom_hw_sub_mod_start(void *hw_priv,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw  = hw_priv;
+	int rc = 0;
+
+	if (!hw_priv || !start_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	/* Start HW -- Stream On*/
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_stop(void *hw_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *custom_hw  = hw_priv;
+	int rc = 0;
+
+	if (!hw_priv || !stop_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&custom_hw->hw_mutex);
+	/* Stop HW */
+	mutex_unlock(&custom_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_read(void *hw_priv,
+	void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_custom_hw_sub_mod_write(void *hw_priv,
+	void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_custom_hw_submit_req(void *hw_priv, void *hw_submit_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info			         *custom_dev = hw_priv;
+	struct cam_custom_sub_mod_req_to_dev *submit_req =
+		(struct cam_custom_sub_mod_req_to_dev *)hw_submit_args;
+	struct cam_custom_sub_mod_core_info  *core_info = NULL;
+
+	core_info =
+		(struct cam_custom_sub_mod_core_info *)custom_dev->core_info;
+
+	spin_lock(&custom_dev->hw_lock);
+	if (core_info->curr_req) {
+		CAM_WARN(CAM_CUSTOM, "Req %lld still processed by %s",
+			core_info->curr_req->req_id,
+			custom_dev->soc_info.dev_name);
+		spin_unlock(&custom_dev->hw_lock);
+		return -EAGAIN;
+	}
+
+	core_info->curr_req = submit_req;
+	spin_unlock(&custom_dev->hw_lock);
+
+	/* Do other submit procedures */
+	return 0;
+}
+
+irqreturn_t cam_custom_hw_sub_mod_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *custom_dev = data;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_custom_hw_cb_args cb_args;
+	struct cam_custom_sub_mod_core_info *core_info = NULL;
+	uint32_t irq_status = 0;
+
+	if (!data) {
+		CAM_ERR(CAM_CUSTOM, "Invalid custom_dev_info");
+		return IRQ_HANDLED;
+	}
+
+	soc_info = &custom_dev->soc_info;
+	core_info =
+		(struct cam_custom_sub_mod_core_info *)custom_dev->core_info;
+
+	irq_status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				core_info->device_hw_info->irq_status);
+
+	cam_io_w_mb(irq_status,
+			soc_info->reg_map[0].mem_base +
+			core_info->device_hw_info->irq_clear);
+
+	spin_lock(&custom_dev->hw_lock);
+	core_info->curr_req = NULL;
+	if (core_info->irq_cb.custom_hw_mgr_cb)
+		core_info->irq_cb.custom_hw_mgr_cb(
+			core_info->irq_cb.data, &cb_args);
+	spin_unlock(&custom_dev->hw_lock);
+
+	return IRQ_HANDLED;
+}
+
+int cam_custom_hw_sub_mod_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                  *hw = hw_priv;
+	struct cam_hw_soc_info              *soc_info = NULL;
+	struct cam_custom_sub_mod_core_info *core_info = NULL;
+	unsigned long flag = 0;
+	int rc = 0;
+
+	if (!hw_priv || !cmd_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &hw->soc_info;
+	core_info = hw->core_info;
+	/* Handle any custom process cmds */
+
+	switch (cmd_type) {
+	case CAM_CUSTOM_SET_IRQ_CB: {
+		struct cam_custom_sub_mod_set_irq_cb *irq_cb = cmd_args;
+		/* This can be deprecated */
+		CAM_DBG(CAM_CUSTOM, "Setting irq cb");
+		spin_lock_irqsave(&hw->hw_lock, flag);
+		core_info->irq_cb.custom_hw_mgr_cb = irq_cb->custom_hw_mgr_cb;
+		core_info->irq_cb.data = irq_cb->data;
+		spin_unlock_irqrestore(&hw->hw_lock, flag);
+		break;
+	}
+	case CAM_CUSTOM_SUBMIT_REQ: {
+		rc = cam_custom_hw_submit_req(hw_priv, cmd_args, arg_size);
+		break;
+	}
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_core.h
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_SUB_MOD_CORE_H_
+#define _CAM_CUSTOM_SUB_MOD_CORE_H_
+
+#include "cam_debug_util.h"
+#include "cam_custom_hw.h"
+#include "cam_custom_sub_mod_soc.h"
+#include "cam_custom_hw_mgr_intf.h"
+
+struct cam_custom_sub_mod_set_irq_cb {
+	int32_t (*custom_hw_mgr_cb)(void *data,
+		struct cam_custom_hw_cb_args *cb_args);
+	void *data;
+};
+
+struct cam_custom_sub_mod_req_to_dev {
+	uint64_t req_id;
+	uint32_t ctx_idx;
+	uint32_t dev_idx;
+};
+
+struct cam_custom_device_hw_info {
+	uint32_t hw_ver;
+	uint32_t irq_status;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+};
+
+struct cam_custom_sub_mod_core_info {
+	uint32_t cpas_handle;
+	bool cpas_start;
+	bool clk_enable;
+	struct cam_custom_sub_mod_set_irq_cb irq_cb;
+	struct cam_custom_sub_mod_req_to_dev *curr_req;
+	struct cam_custom_device_hw_info *device_hw_info;
+	struct cam_hw_info *custom_hw_info;
+};
+
+enum cam_custom_hw_resource_type {
+	CAM_CUSTOM_HW_RESOURCE_UNINT,
+	CAM_CUSTOM_HW_RESOURCE_SRC,
+	CAM_CUSTOM_HW_RESOURCE_MAX,
+};
+
+struct cam_custom_sub_mod_acq {
+	enum cam_custom_hw_resource_type   rsrc_type;
+	int32_t                            acq;
+	cam_hw_mgr_event_cb_func           event_cb;
+	void                              *priv;
+	struct cam_custom_resource_node   *rsrc_node;
+};
+
+int cam_custom_hw_sub_mod_get_hw_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_reset(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_reserve(void *hw_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_release(void *hw_priv,
+	void *release_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_start(void *hw_priv,
+	void *start_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_stop(void *hw_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_read(void *hw_priv,
+	void *read_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_write(void *hw_priv,
+	void *write_args, uint32_t arg_size);
+int cam_custom_hw_sub_mod_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+irqreturn_t cam_custom_hw_sub_mod_irq(int irq_num, void *data);
+
+#endif /* _CAM_CUSTOM_SUB_MOD_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.c
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of_device.h>
+#include "cam_custom_sub_mod_dev.h"
+#include "cam_custom_sub_mod_core.h"
+#include "cam_custom_sub_mod_soc.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_hw_intf *cam_custom_hw_sub_mod_list
+	[CAM_CUSTOM_SUB_MOD_MAX_INSTANCES] = {0, 0};
+
+static char cam_custom_hw_sub_mod_name[8];
+
+struct cam_custom_device_hw_info cam_custom_hw_info = {
+	.hw_ver = 0x0,
+	.irq_status = 0x0,
+	.irq_mask = 0x0,
+	.irq_clear = 0x0,
+};
+EXPORT_SYMBOL(cam_custom_hw_info);
+
+int cam_custom_hw_sub_mod_init(struct cam_hw_intf **custom_hw, uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_custom_hw_sub_mod_list[hw_idx]) {
+		*custom_hw = cam_custom_hw_sub_mod_list[hw_idx];
+		rc = 0;
+	} else {
+		*custom_hw = NULL;
+		rc = -ENODEV;
+	}
+	return 0;
+}
+
+static int cam_custom_hw_sub_mod_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info		    *hw = NULL;
+	struct cam_hw_intf		    *hw_intf = NULL;
+	struct cam_custom_sub_mod_core_info *core_info = NULL;
+	int				   rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!hw_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &hw_intf->hw_idx);
+
+	hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!hw) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	memset(cam_custom_hw_sub_mod_name, 0,
+		sizeof(cam_custom_hw_sub_mod_name));
+	snprintf(cam_custom_hw_sub_mod_name, sizeof(cam_custom_hw_sub_mod_name),
+		"custom_hw%1u", hw_intf->hw_idx);
+
+	hw->soc_info.pdev = pdev;
+	hw->soc_info.dev = &pdev->dev;
+	hw->soc_info.dev_name = cam_custom_hw_sub_mod_name;
+	hw_intf->hw_priv = hw;
+	hw_intf->hw_ops.get_hw_caps = cam_custom_hw_sub_mod_get_hw_caps;
+	hw_intf->hw_ops.init = cam_custom_hw_sub_mod_init_hw;
+	hw_intf->hw_ops.deinit = cam_custom_hw_sub_mod_deinit_hw;
+	hw_intf->hw_ops.reset = cam_custom_hw_sub_mod_reset;
+	hw_intf->hw_ops.reserve = cam_custom_hw_sub_mod_reserve;
+	hw_intf->hw_ops.release = cam_custom_hw_sub_mod_release;
+	hw_intf->hw_ops.start = cam_custom_hw_sub_mod_start;
+	hw_intf->hw_ops.stop = cam_custom_hw_sub_mod_stop;
+	hw_intf->hw_ops.read = cam_custom_hw_sub_mod_read;
+	hw_intf->hw_ops.write = cam_custom_hw_sub_mod_write;
+	hw_intf->hw_ops.process_cmd = cam_custom_hw_sub_mod_process_cmd;
+	hw_intf->hw_type = CAM_CUSTOM_HW_TYPE_1;
+
+	platform_set_drvdata(pdev, hw_intf);
+
+	hw->core_info = kzalloc(sizeof(struct cam_custom_sub_mod_core_info),
+		GFP_KERNEL);
+	if (!hw->core_info) {
+		CAM_DBG(CAM_CUSTOM, "Failed to alloc for core");
+		rc = -ENOMEM;
+		goto free_hw;
+	}
+	core_info = (struct cam_custom_sub_mod_core_info *)hw->core_info;
+
+	core_info->custom_hw_info = hw;
+
+	rc = cam_custom_hw_sub_mod_init_soc_resources(&hw->soc_info,
+		cam_custom_hw_sub_mod_irq, hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_CUSTOM, "Failed to init soc rc=%d", rc);
+		goto free_core_info;
+	}
+
+	/* Initialize HW */
+
+	hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&hw->hw_mutex);
+	spin_lock_init(&hw->hw_lock);
+	init_completion(&hw->hw_complete);
+
+	if (hw_intf->hw_idx < CAM_CUSTOM_HW_SUB_MOD_MAX)
+		cam_custom_hw_sub_mod_list[hw_intf->hw_idx] = hw_intf;
+
+	/* needs to be invoked when custom hw is in place */
+	//cam_custom_hw_sub_mod_init_hw(hw, NULL, 0);
+
+	CAM_DBG(CAM_CUSTOM, "HW idx:%d component bound successfully",
+		hw_intf->hw_idx);
+	return rc;
+
+free_core_info:
+	kfree(hw->core_info);
+free_hw:
+	kfree(hw);
+free_hw_intf:
+	kfree(hw_intf);
+	return rc;
+}
+
+static void cam_custom_hw_sub_mod_component_unbind(
+	struct device *dev, struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_CUSTOM, "Unbinding component: %s", pdev->name);
+}
+
+const static struct component_ops cam_custom_hw_sub_mod_component_ops = {
+	.bind = cam_custom_hw_sub_mod_component_bind,
+	.unbind = cam_custom_hw_sub_mod_component_unbind,
+};
+
+int cam_custom_hw_sub_mod_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CUSTOM, "Adding Custom HW sub module component");
+	rc = component_add(&pdev->dev, &cam_custom_hw_sub_mod_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static const struct of_device_id cam_custom_hw_sub_mod_dt_match[] = {
+	{
+		.compatible = "qcom,cam_custom_hw_sub_mod",
+		.data = &cam_custom_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_custom_hw_sub_mod_dt_match);
+
+struct platform_driver cam_custom_hw_sub_mod_driver = {
+	.probe = cam_custom_hw_sub_mod_probe,
+	.driver = {
+		.name = CAM_CUSTOM_SUB_MOD_NAME,
+		.of_match_table = cam_custom_hw_sub_mod_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_custom_hw_sub_module_init(void)
+{
+	return platform_driver_register(&cam_custom_hw_sub_mod_driver);
+}
+
+void cam_custom_hw_sub_module_exit(void)
+{
+	platform_driver_unregister(&cam_custom_hw_sub_mod_driver);
+}
+
+MODULE_DESCRIPTION("CAM CUSTOM HW SUB MODULE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_dev.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_SUB_MOD_DEV_H_
+#define _CAM_CUSTOM_SUB_MOD_DEV_H_
+
+#include "cam_custom_hw_mgr_intf.h"
+
+#define CAM_CUSTOM_SUB_MOD_NAME "cam_custom_sub_mod"
+
+#define CAM_CUSTOM_SUB_MOD_MAX_INSTANCES                   2
+
+/**
+ * @brief : API to register Custom submodule to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_custom_hw_sub_module_init(void);
+
+/**
+ * @brief : API to remove Custom submodule interface from platform framework.
+ */
+void cam_custom_hw_sub_module_exit(void);
+#endif /* _CAM_CUSTOM_SUB_MOD_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.c
@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_cpas_api.h"
+#include "cam_custom_sub_mod_soc.h"
+#include "cam_debug_util.h"
+
+int cam_custom_hw_sub_mod_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *irq_data)
+{
+	int                               rc = 0;
+	struct cam_custom_hw_soc_private *soc_private = NULL;
+	struct cam_cpas_register_params   cpas_register_param;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_CUSTOM,
+			"Error! Get DT properties failed rc=%d", rc);
+		/* For Test Purposes */
+		return 0;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_custom_hw_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_CUSTOM, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler,
+		irq_data);
+	if (rc < 0) {
+		CAM_ERR(CAM_CUSTOM,
+			"Error! Request platform resources failed rc=%d", rc);
+		return rc;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+
+	strscpy(cpas_register_param.identifier, "custom",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	cpas_register_param.cam_cpas_client_cb = NULL;
+	cpas_register_param.userdata = soc_info;
+
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc < 0)
+		goto release_soc;
+
+	soc_private->cpas_handle =
+		cpas_register_param.client_handle;
+
+	rc = cam_cpas_select_qos_settings(CAM_CPAS_QOS_CUSTOM_SETTINGS_MASK);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Custom QoS selection failed %d", rc);
+		goto unregister_cpas;
+	}
+
+	return rc;
+
+unregister_cpas:
+	if (cam_cpas_unregister_client(soc_private->cpas_handle))
+		CAM_ERR(CAM_CUSTOM, "CPAS0 unregistration failed");
+release_soc:
+	if (cam_soc_util_release_platform_resource(soc_info))
+		CAM_ERR(CAM_CUSTOM, "CPAS0 release resource failed");
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_custom_hw_soc_private *soc_private = NULL;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_CUSTOM, "Error! soc_info NULL");
+		return -ENODEV;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_CUSTOM, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_CUSTOM, "CPAS0 unregistration failed rc=%d", rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_CUSTOM,
+			"Error! Release platform resources failed rc=%d", rc);
+
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_custom_hw_soc_private *soc_private = soc_info->soc_private;
+	struct cam_ahb_vote               ahb_vote;
+	struct cam_axi_vote axi_vote =    {0};
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ib_bw = 7200000;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = 512000000;
+	axi_vote.axi_path[1].mnoc_ab_bw = 512000000;
+	axi_vote.axi_path[1].mnoc_ib_bw = 512000000;
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Error! CPAS0 start failed rc=%d", rc);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_TURBO_VOTE, true);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Error! enable platform failed rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return 0;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_custom_hw_sub_mod_disable_soc_resources(
+	struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_custom_hw_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_CUSTOM, "Error! Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Disable platform failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Error! CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw1/cam_custom_sub_mod_soc.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_HW_SUB_MOD_SOC_H_
+#define _CAM_CUSTOM_HW_SUB_MOD_SOC_H_
+
+#include "cam_soc_util.h"
+/*
+ * struct cam_custom_hw_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to Custom HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ */
+struct cam_custom_hw_soc_private {
+	uint32_t    cpas_handle;
+};
+
+int cam_custom_hw_sub_mod_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *irq_data);
+
+int cam_custom_hw_sub_mod_deinit_soc_resources(
+	struct cam_hw_soc_info *soc_info);
+
+int cam_custom_hw_sub_mod_enable_soc_resources(
+	struct cam_hw_soc_info *soc_info);
+
+int cam_custom_hw_sub_mod_disable_soc_resources(
+	struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_CUSTOM_HW_SUB_MOD_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.c
@@ -0,0 +1,1559 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+
+#include <media/cam_custom.h>
+#include <media/cam_sync.h>
+
+#include "cam_compat.h"
+#include "cam_sync_api.h"
+#include "cam_smmu_api.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_custom_hw_mgr.h"
+#include "cam_packet_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_common_util.h"
+#include "cam_hw.h"
+
+static struct cam_custom_hw_mgr g_custom_hw_mgr;
+
+static int cam_custom_mgr_get_hw_caps(void *hw_mgr_priv,
+	void *hw_caps_args)
+{
+	int rc = 0;
+	struct cam_custom_hw_mgr          *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd          *query = hw_caps_args;
+	struct cam_custom_query_cap_cmd    custom_hw_cap;
+	struct cam_hw_info                *cam_custom_hw;
+	struct cam_hw_soc_info            *soc_info_hw;
+
+	cam_custom_hw = (struct cam_hw_info *)
+		g_custom_hw_mgr.custom_hw[0]->hw_priv;
+	if (cam_custom_hw)
+		soc_info_hw = &cam_custom_hw->soc_info;
+
+	CAM_DBG(CAM_CUSTOM, "enter");
+
+	if (query->handle_type != CAM_HANDLE_USER_POINTER)
+		CAM_ERR(CAM_CUSTOM, "Wrong Args");
+
+	if (copy_from_user(&custom_hw_cap,
+		u64_to_user_ptr(query->caps_handle),
+		sizeof(struct cam_custom_query_cap_cmd))) {
+		rc = -EFAULT;
+		return rc;
+	}
+
+	custom_hw_cap.device_iommu.non_secure = hw_mgr->img_iommu_hdl;
+	custom_hw_cap.device_iommu.secure = -1;
+
+	/* Initializing cdm handles to -1 */
+	custom_hw_cap.cdm_iommu.non_secure = -1;
+	custom_hw_cap.cdm_iommu.secure = -1;
+
+	custom_hw_cap.num_dev = 1;
+	custom_hw_cap.dev_caps[0].hw_type = 0;
+	custom_hw_cap.dev_caps[0].hw_version = 0;
+
+	if (copy_to_user(u64_to_user_ptr(query->caps_handle),
+		&custom_hw_cap, sizeof(struct cam_custom_query_cap_cmd)))
+		rc = -EFAULT;
+
+	CAM_DBG(CAM_CUSTOM, "exit rc :%d", rc);
+	return rc;
+}
+
+enum cam_custom_hw_resource_state
+	cam_custom_hw_mgr_get_custom_res_state(
+	uint32_t						in_rsrc_state)
+{
+	enum cam_custom_hw_resource_state     rsrc_state;
+
+	CAM_DBG(CAM_CUSTOM, "rsrc_state %x", in_rsrc_state);
+
+	switch (in_rsrc_state) {
+	case CAM_ISP_RESOURCE_STATE_UNAVAILABLE:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_UNAVAILABLE;
+		break;
+	case CAM_ISP_RESOURCE_STATE_AVAILABLE:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_AVAILABLE;
+		break;
+	case CAM_ISP_RESOURCE_STATE_RESERVED:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_RESERVED;
+		break;
+	case CAM_ISP_RESOURCE_STATE_INIT_HW:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_INIT_HW;
+		break;
+	case CAM_ISP_RESOURCE_STATE_STREAMING:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_STREAMING;
+		break;
+	default:
+		rsrc_state = CAM_CUSTOM_HW_RESOURCE_STATE_UNAVAILABLE;
+		CAM_DBG(CAM_CUSTOM, "invalid rsrc type");
+		break;
+	}
+
+	return rsrc_state;
+}
+
+enum cam_isp_resource_state
+	cam_custom_hw_mgr_get_isp_res_state(
+	uint32_t						in_rsrc_state)
+{
+	enum cam_isp_resource_state     rsrc_state;
+
+	CAM_DBG(CAM_CUSTOM, "rsrc_state %x", in_rsrc_state);
+
+	switch (in_rsrc_state) {
+	case CAM_CUSTOM_HW_RESOURCE_STATE_UNAVAILABLE:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+		break;
+	case CAM_CUSTOM_HW_RESOURCE_STATE_AVAILABLE:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		break;
+	case CAM_CUSTOM_HW_RESOURCE_STATE_RESERVED:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+		break;
+	case CAM_CUSTOM_HW_RESOURCE_STATE_INIT_HW:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+		break;
+	case CAM_CUSTOM_HW_RESOURCE_STATE_STREAMING:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+		break;
+	default:
+		rsrc_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+		CAM_DBG(CAM_CUSTOM, "invalid rsrc type");
+		break;
+	}
+
+	return rsrc_state;
+}
+
+enum cam_isp_resource_type
+	cam_custom_hw_mgr_get_isp_res_type(
+	enum cam_custom_hw_mgr_res_type res_type)
+{
+	switch (res_type) {
+	case CAM_CUSTOM_CID_HW:
+		return CAM_ISP_RESOURCE_CID;
+	case CAM_CUSTOM_CSID_HW:
+		return CAM_ISP_RESOURCE_PIX_PATH;
+	default:
+		return CAM_ISP_RESOURCE_MAX;
+	}
+}
+
+static int cam_custom_hw_mgr_deinit_hw_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.deinit) {
+		CAM_DBG(CAM_CUSTOM, "DEINIT HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.deinit(hw_intf->hw_priv,
+			isp_rsrc_node, sizeof(struct cam_isp_resource_node));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_DBG(CAM_CUSTOM, "DEINIT HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_hw_mgr_stop_hw_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_csid_hw_stop_args  stop_cmd;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.stop) {
+		CAM_DBG(CAM_CUSTOM, "STOP HW for res_id:%u",
+			hw_mgr_res->res_id);
+		stop_cmd.num_res = 1;
+		stop_cmd.node_res = &isp_rsrc_node;
+		stop_cmd.stop_cmd = CAM_CSID_HALT_AT_FRAME_BOUNDARY;
+		rc = hw_intf->hw_ops.stop(hw_intf->hw_priv,
+			&stop_cmd, sizeof(struct cam_csid_hw_stop_args));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_DBG(CAM_CUSTOM, "STOP HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_mgr_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_custom_stop_args      *custom_args;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_custom_hw_mgr_res     *hw_mgr_res;
+	struct cam_custom_hw_mgr_ctx     *ctx;
+
+	if (!hw_mgr_priv || !stop_hw_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	custom_args = (struct cam_custom_stop_args *)stop_args->args;
+	ctx = (struct cam_custom_hw_mgr_ctx *)
+		stop_args->ctxt_to_hw_map;
+
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_CUSTOM, " Enter...ctx id:%d", ctx->ctx_index);
+
+	/* Stop custom cid here */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_stop_hw_res(hw_mgr_res);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "failed to stop hw %d",
+				hw_mgr_res->res_id);
+	}
+
+	/* Stop custom csid here */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_stop_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "failed to stop hw %d",
+				hw_mgr_res->res_id);
+		}
+	}
+
+
+	/* stop custom hw here */
+
+	if (custom_args->stop_only)
+		goto end;
+
+	/* Deinit custom cid here */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_deinit_hw_res(hw_mgr_res);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "failed to stop hw %d",
+			hw_mgr_res->res_id);
+	}
+
+	/* Deinit custom csid here */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_deinit_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "failed to stop hw %d",
+				hw_mgr_res->res_id);
+		}
+	}
+
+	/* deinit custom rsrc */
+
+end:
+	return rc;
+}
+
+static int cam_custom_hw_mgr_init_hw_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.init) {
+		CAM_DBG(CAM_CUSTOM, "INIT HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.init(hw_intf->hw_priv,
+			isp_rsrc_node, sizeof(struct cam_isp_resource_node));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_DBG(CAM_CUSTOM, "INIT HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_hw_mgr_start_hw_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.start) {
+		CAM_DBG(CAM_CUSTOM, "Start HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.start(hw_intf->hw_priv,
+			isp_rsrc_node, sizeof(struct cam_isp_resource_node));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_DBG(CAM_CUSTOM, "START HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_mgr_start_hw(void *hw_mgr_priv,
+	void *start_hw_args)
+{
+	int                                      rc = 0;
+	struct cam_hw_config_args               *hw_config;
+	struct cam_hw_stop_args                  stop_args;
+	struct cam_custom_hw_mgr_res            *hw_mgr_res;
+	struct cam_custom_hw_mgr_ctx            *ctx;
+	struct cam_custom_stop_args              custom_stop_args;
+	struct cam_custom_start_args            *custom_args;
+
+	if (!hw_mgr_priv || !start_hw_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	custom_args =
+		(struct cam_custom_start_args *)start_hw_args;
+
+	hw_config = (struct cam_hw_config_args *)
+		&custom_args->hw_config;
+
+	ctx = (struct cam_custom_hw_mgr_ctx *)
+		hw_config->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Enter... ctx id:%d",
+		ctx->ctx_index);
+
+	if (custom_args->start_only)
+		goto start_only;
+
+	/* Init custom cid */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can not INIT CID(id :%d)",
+				hw_mgr_res->res_id);
+			goto deinit_hw;
+		}
+	}
+
+	/* Init custom csid */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can not INIT CSID(id :%d)",
+				hw_mgr_res->res_id);
+			goto deinit_hw;
+		}
+	}
+
+
+	/* Init custom hw here */
+
+	/* Apply init config */
+
+start_only:
+
+	/* Start custom HW first */
+	if (rc < 0)
+		goto err;
+
+	/* Start custom csid */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_start_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can not START CSID(id :%d)",
+				hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	/* Start custom cid */
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_start_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "Can not START CID(id :%d)",
+				hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Start success for ctx id:%d", ctx->ctx_index);
+	return 0;
+
+err:
+	custom_stop_args.stop_only = false;
+	stop_args.args = (void *) &custom_stop_args;
+	stop_args.ctxt_to_hw_map = hw_config->ctxt_to_hw_map;
+	cam_custom_mgr_stop_hw(hw_mgr_priv, &stop_args);
+deinit_hw:
+	/* deinit the hw previously initialized */
+	CAM_DBG(CAM_CUSTOM, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static int cam_custom_mgr_read(void *hw_mgr_priv, void *read_args)
+{
+	return -EPERM;
+}
+
+static int cam_custom_mgr_write(void *hw_mgr_priv, void *write_args)
+{
+	return -EPERM;
+}
+
+static int cam_custom_hw_mgr_notify(
+	uint32_t evt_id,
+	struct cam_custom_hw_mgr_ctx *custom_ctx,
+	struct cam_custom_hw_event_info *evt_info)
+{
+	int rc = 0;
+	struct cam_custom_hw_reg_update_event_data reg_upd_data;
+	struct cam_custom_hw_done_event_data done_evt_data;
+	struct cam_custom_hw_error_event_data err_evt_data;
+
+	switch (evt_id) {
+	case CAM_CUSTOM_HW_EVENT_RUP_DONE:
+		CAM_DBG(CAM_CUSTOM, "Notify RUP for ctx %u",
+			custom_ctx->ctx_index);
+		/* fill the evt data struct */
+		custom_ctx->event_cb(custom_ctx->cb_priv,
+			CAM_CUSTOM_HW_EVENT_RUP_DONE, &reg_upd_data);
+		break;
+	case CAM_CUSTOM_HW_EVENT_FRAME_DONE:
+		CAM_DBG(CAM_CUSTOM, "Notify FRAME DONE for ctx %u",
+			custom_ctx->ctx_index);
+		/* fill the evt data struct */
+		done_evt_data.num_handles = 1;
+		custom_ctx->event_cb(custom_ctx->cb_priv,
+			CAM_CUSTOM_HW_EVENT_RUP_DONE, &done_evt_data);
+		break;
+	case CAM_CUSTOM_HW_EVENT_ERROR:
+		CAM_DBG(CAM_CUSTOM, "Notify ERROR for ctx %u",
+			custom_ctx->ctx_index);
+		/* fill the evt data struct */
+		custom_ctx->event_cb(custom_ctx->cb_priv,
+			CAM_CUSTOM_HW_EVENT_RUP_DONE, &err_evt_data);
+		break;
+	default:
+		CAM_ERR(CAM_CUSTOM, "Invalid evt_id %u", evt_id);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_custom_hw_mgr_evt_handler(
+	void *priv, uint32_t evt_id, void *hw_evt_info)
+{
+	int                              rc = 0;
+	struct cam_custom_hw_mgr_ctx    *custom_ctx = NULL;
+	struct cam_custom_hw_mgr_ctx    *custom_ctx_tmp = NULL;
+	struct cam_custom_hw_event_info *evt_info = NULL;
+	struct cam_custom_hw_mgr        *hw_mgr = &g_custom_hw_mgr;
+	bool                             ctx_found = false;
+
+	if (!hw_evt_info) {
+		CAM_ERR(CAM_CUSTOM, "invalid evt info");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Invoked for HW Event ID 0x%x",
+		evt_id);
+	evt_info = (struct cam_custom_hw_event_info *)hw_evt_info;
+
+	list_for_each_entry_safe(custom_ctx, custom_ctx_tmp,
+		&hw_mgr->used_ctx_list, list) {
+		if (custom_ctx->task_type  == evt_info->task_type) {
+			ctx_found = true;
+			rc = cam_custom_hw_mgr_notify(evt_id, custom_ctx,
+				evt_info);
+			if (rc) {
+				CAM_ERR(CAM_CUSTOM, "Failed to notify");
+				return rc;
+			}
+			break;
+		}
+	}
+
+	if (!ctx_found)
+		CAM_DBG(CAM_CUSTOM, "Failed to find affected ctx");
+
+	return rc;
+}
+
+static int cam_custom_hw_mgr_put_ctx(
+	struct list_head                 *src_list,
+	struct cam_custom_hw_mgr_ctx    **custom_ctx)
+{
+	struct cam_custom_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	ctx_ptr = *custom_ctx;
+	if (ctx_ptr)
+		list_add_tail(&ctx_ptr->list, src_list);
+	*custom_ctx = NULL;
+	return 0;
+}
+
+static int cam_custom_hw_mgr_get_ctx(
+	struct list_head                *src_list,
+	struct cam_custom_hw_mgr_ctx       **custom_ctx)
+{
+	struct cam_custom_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	if (!list_empty(src_list)) {
+		ctx_ptr = list_first_entry(src_list,
+			struct cam_custom_hw_mgr_ctx, list);
+		list_del_init(&ctx_ptr->list);
+	} else {
+		CAM_ERR(CAM_CUSTOM, "No more free custom hw mgr ctx");
+		return -EINVAL;
+	}
+	*custom_ctx = ctx_ptr;
+	memset(ctx_ptr->sub_hw_list, 0,
+		sizeof(struct cam_custom_hw_mgr_res) *
+		CAM_CUSTOM_HW_RES_MAX);
+
+	return 0;
+}
+
+static int cam_custom_hw_mgr_put_res(
+	struct list_head                *src_list,
+	struct cam_custom_hw_mgr_res   **res)
+{
+	struct cam_custom_hw_mgr_res *res_ptr = NULL;
+
+	res_ptr = *res;
+	if (res_ptr)
+		list_add_tail(&res_ptr->list, src_list);
+
+	return 0;
+}
+
+static int cam_custom_hw_mgr_get_res(
+	struct list_head                *src_list,
+	struct cam_custom_hw_mgr_res   **res)
+{
+	int rc = 0;
+	struct cam_custom_hw_mgr_res *res_ptr = NULL;
+
+	if (!list_empty(src_list)) {
+		res_ptr = list_first_entry(src_list,
+			struct cam_custom_hw_mgr_res, list);
+		list_del_init(&res_ptr->list);
+	} else {
+		CAM_ERR(CAM_CUSTOM, "No more free custom ctx rsrc");
+		rc = -1;
+	}
+	*res = res_ptr;
+
+	return rc;
+}
+
+static enum cam_ife_pix_path_res_id
+	cam_custom_hw_mgr_get_csid_res_type(
+	uint32_t						out_port_type,
+	struct cam_custom_hw_mgr_ctx   *custom_ctx)
+{
+	enum cam_ife_pix_path_res_id path_id;
+
+	CAM_DBG(CAM_CUSTOM, "out_port_type %x", out_port_type);
+
+	switch (out_port_type) {
+	case CAM_CUSTOM_OUT_RES_UDI_0:
+		path_id = CAM_IFE_PIX_PATH_RES_UDI_0;
+		break;
+	case CAM_CUSTOM_OUT_RES_UDI_1:
+		path_id = CAM_IFE_PIX_PATH_RES_UDI_1;
+		custom_ctx->task_type = CAM_CUSTOM_EVENT_TASK2;
+		break;
+	case CAM_CUSTOM_OUT_RES_UDI_2:
+		path_id = CAM_IFE_PIX_PATH_RES_UDI_2;
+		custom_ctx->task_type = CAM_CUSTOM_EVENT_TASK3;
+		break;
+	default:
+		path_id = CAM_IFE_PIX_PATH_RES_MAX;
+		CAM_DBG(CAM_CUSTOM, "maximum rdi output type exceeded");
+		break;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "out_port %x path_id %d", out_port_type, path_id);
+
+	return path_id;
+}
+
+static int cam_custom_hw_mgr_acquire_cid_res(
+	struct cam_custom_hw_mgr_ctx           *custom_ctx,
+	struct cam_isp_in_port_generic_info    *in_port,
+	struct cam_custom_hw_mgr_res          **cid_res,
+	enum cam_ife_pix_path_res_id            path_res_id,
+	struct cam_isp_resource_node          **cid_rsrc_node)
+{
+	int rc = -1;
+	int i;
+	struct cam_custom_hw_mgr             *custom_hw_mgr;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_custom_hw_mgr_res         *cid_res_temp;
+	struct cam_csid_hw_reserve_resource_args  csid_acquire;
+	struct cam_isp_resource_node          *isp_rsrc_node;
+	struct cam_isp_out_port_generic_info *out_port = NULL;
+
+	custom_hw_mgr = custom_ctx->hw_mgr;
+	*cid_res = NULL;
+
+	rc = cam_custom_hw_mgr_get_res(
+		&custom_ctx->free_res_list, cid_res);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "No more free hw mgr resource");
+		goto end;
+	}
+
+	memset(&csid_acquire, 0, sizeof(csid_acquire));
+	cid_res_temp = *cid_res;
+	csid_acquire.res_type = CAM_ISP_RESOURCE_CID;
+	csid_acquire.in_port = in_port;
+	csid_acquire.res_id =  path_res_id;
+	csid_acquire.node_res = NULL;
+	CAM_DBG(CAM_CUSTOM, "path_res_id %d", path_res_id);
+
+	if (in_port->num_out_res)
+		out_port = &(in_port->data[0]);
+
+	for (i = 0; i < CAM_CUSTOM_CSID_HW_MAX; i++) {
+		if (!custom_hw_mgr->csid_devices[i])
+			continue;
+
+		hw_intf = custom_hw_mgr->csid_devices[i];
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+		/* since there is a need of 1 cid at this stage */
+			if (rc)
+				continue;
+			else
+				break;
+
+	}
+
+	if (!csid_acquire.node_res) {
+		CAM_ERR(CAM_CUSTOM,
+			"Can not acquire custom cid resource for path %d",
+			path_res_id);
+		rc = -EAGAIN;
+		goto put_res;
+	}
+
+	*cid_rsrc_node = csid_acquire.node_res;
+	isp_rsrc_node = csid_acquire.node_res;
+	cid_res_temp->rsrc_node = isp_rsrc_node;
+	cid_res_temp->res_type = CAM_CUSTOM_CID_HW;
+	cid_res_temp->res_id = isp_rsrc_node->res_id;
+	cam_custom_hw_mgr_put_res(&custom_ctx->res_list_custom_cid,
+		&cid_res_temp);
+
+	CAM_DBG(CAM_CUSTOM, "CID acquired successfully %u",
+		isp_rsrc_node->res_id);
+
+	return 0;
+
+put_res:
+	cam_custom_hw_mgr_put_res(&custom_ctx->free_res_list, cid_res);
+end:
+	return rc;
+
+}
+
+static int cam_custom_hw_mgr_acquire_csid_res(
+	struct cam_custom_hw_mgr_ctx        *custom_ctx,
+	struct cam_isp_in_port_generic_info *in_port_info)
+{
+	int rc = 0, i = 0;
+	struct cam_custom_hw_mgr                *custom_hw_mgr;
+	struct cam_isp_out_port_generic_info    *out_port;
+	struct cam_custom_hw_mgr_res            *custom_csid_res;
+	struct cam_custom_hw_mgr_res            *custom_cid_res;
+	struct cam_hw_intf                      *hw_intf;
+	struct cam_csid_hw_reserve_resource_args custom_csid_acquire;
+	enum cam_ife_pix_path_res_id             path_res_id;
+	struct cam_isp_resource_node            *isp_rsrc_node;
+	struct cam_isp_resource_node            *cid_rsrc_node = NULL;
+
+	custom_hw_mgr = custom_ctx->hw_mgr;
+
+	for (i = 0; i < in_port_info->num_out_res; i++) {
+		out_port = &in_port_info->data[i];
+		path_res_id = cam_custom_hw_mgr_get_csid_res_type(
+			out_port->res_type, custom_ctx);
+
+		if (path_res_id == CAM_IFE_PIX_PATH_RES_MAX) {
+			CAM_WARN(CAM_CUSTOM, "Invalid out port res_type %u",
+				out_port->res_type);
+			continue;
+		}
+
+		rc = cam_custom_hw_mgr_acquire_cid_res(custom_ctx, in_port_info,
+			&custom_cid_res, path_res_id, &cid_rsrc_node);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "No free cid rsrc %d", rc);
+			goto end;
+		}
+
+		rc = cam_custom_hw_mgr_get_res(&custom_ctx->free_res_list,
+			&custom_csid_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "No more free hw mgr rsrc");
+			goto end;
+		}
+
+		memset(&custom_csid_acquire, 0, sizeof(custom_csid_acquire));
+		custom_csid_acquire.res_id = path_res_id;
+		custom_csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		custom_csid_acquire.cid = cid_rsrc_node->res_id;
+		custom_csid_acquire.in_port = in_port_info;
+		custom_csid_acquire.out_port = out_port;
+		custom_csid_acquire.sync_mode = 0;
+		custom_csid_acquire.node_res = NULL;
+
+		hw_intf = cid_rsrc_node->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&custom_csid_acquire, sizeof(custom_csid_acquire));
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM,
+				"Custom csid acquire failed for hw_idx %u rc %d",
+				hw_intf->hw_idx, rc);
+			goto put_res;
+		}
+
+		if (custom_csid_acquire.node_res == NULL) {
+			CAM_ERR(CAM_CUSTOM, "Acquire custom csid failed");
+			rc = -EAGAIN;
+			goto put_res;
+		}
+
+		isp_rsrc_node = custom_csid_acquire.node_res;
+		custom_csid_res->rsrc_node = isp_rsrc_node;
+		custom_csid_res->res_type = CAM_CUSTOM_CSID_HW;
+		custom_csid_res->res_id = custom_csid_acquire.res_id;
+		cam_custom_hw_mgr_put_res(
+			&custom_ctx->res_list_custom_csid,
+			&custom_csid_res);
+		CAM_DBG(CAM_CUSTOM, "Custom CSID acquired for path %d",
+			path_res_id);
+	}
+
+	return 0;
+
+put_res:
+	cam_custom_hw_mgr_put_res(&custom_ctx->free_res_list,
+		&custom_csid_res);
+end:
+	return rc;
+}
+
+static int cam_custom_hw_mgr_free_hw_res(
+	struct cam_custom_hw_mgr_res   *hw_mgr_res)
+{
+	int rc = 0;
+	struct cam_isp_resource_node *isp_rsrc_node = NULL;
+	struct cam_hw_intf			 *hw_intf = NULL;
+
+	isp_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!isp_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_intf = isp_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.release) {
+		CAM_DBG(CAM_CUSTOM, "RELEASE HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.release(hw_intf->hw_priv,
+			isp_rsrc_node, sizeof(struct cam_isp_resource_node));
+		if (rc)
+			CAM_ERR(CAM_CUSTOM,
+				"Release HW failed for hw_idx %d",
+				hw_intf->hw_idx);
+	}
+
+	/* caller should make sure the resource is in a list */
+	list_del_init(&hw_mgr_res->list);
+	memset(hw_mgr_res, 0, sizeof(*hw_mgr_res));
+	INIT_LIST_HEAD(&hw_mgr_res->list);
+
+	return 0;
+}
+
+static int cam_custom_hw_mgr_release_hw_for_ctx(
+	struct cam_custom_hw_mgr_ctx *custom_ctx)
+{
+	int rc = -1;
+	struct cam_custom_hw_mgr_res     *hw_mgr_res;
+	struct cam_custom_hw_mgr_res	 *hw_mgr_res_temp;
+
+	/* Release custom cid */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&custom_ctx->res_list_custom_cid, list) {
+		rc = cam_custom_hw_mgr_free_hw_res(hw_mgr_res);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "Can not release CID(id :%d)",
+				hw_mgr_res->res_id);
+		cam_custom_hw_mgr_put_res(
+			&custom_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* Release custom csid */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&custom_ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_free_hw_res(hw_mgr_res);
+		if (rc)
+			CAM_ERR(CAM_CUSTOM, "Can not release CSID(id :%d)",
+				hw_mgr_res->res_id);
+		cam_custom_hw_mgr_put_res(
+			&custom_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* Release custom HW Here */
+
+	return 0;
+}
+static int cam_custom_mgr_release_hw(void *hw_mgr_priv,
+	void *release_hw_args)
+{
+	int                               rc           = 0;
+	struct cam_hw_release_args       *release_args = release_hw_args;
+	struct cam_custom_hw_mgr_ctx     *custom_ctx;
+
+	if (!hw_mgr_priv || !release_hw_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	custom_ctx =
+		(struct cam_custom_hw_mgr_ctx *)release_args->ctxt_to_hw_map;
+	if (!custom_ctx || !custom_ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Enter...ctx id:%d",
+		custom_ctx->ctx_index);
+
+	cam_custom_hw_mgr_release_hw_for_ctx(custom_ctx);
+	list_del_init(&custom_ctx->list);
+	custom_ctx->scratch_buffer_addr = 0;
+	custom_ctx->ctx_in_use = 0;
+	custom_ctx->task_type = CAM_CUSTOM_EVENT_INVALID;
+	cam_custom_hw_mgr_put_ctx(&g_custom_hw_mgr.free_ctx_list, &custom_ctx);
+	CAM_DBG(CAM_CUSTOM, "Release Exit..");
+	return rc;
+}
+
+static int cam_custom_hw_mgr_acquire_get_unified_dev_str(
+	struct cam_custom_acquire_hw_info *acquire_hw_info,
+	uint32_t *input_size,
+	struct cam_isp_in_port_generic_info **gen_port_info)
+{
+	int32_t rc = 0, i;
+	uint32_t in_port_length = 0;
+	struct cam_custom_in_port_info *in = NULL;
+	struct cam_isp_in_port_generic_info *port_info = NULL;
+
+	in = (struct cam_custom_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset + *input_size);
+
+	in_port_length = sizeof(struct cam_custom_in_port_info) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_custom_out_port_info);
+
+	*input_size += in_port_length;
+
+	if ((*input_size) > acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_CUSTOM, "Input is not proper");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	port_info = kzalloc(
+		sizeof(struct cam_isp_in_port_generic_info), GFP_KERNEL);
+
+	if (!port_info)
+		return -ENOMEM;
+
+	port_info->res_type        =  in->res_type +
+		CAM_ISP_IFE_IN_RES_BASE - CAM_CUSTOM_IN_RES_BASE;
+	port_info->lane_type       =  in->lane_type;
+	port_info->lane_num        =  in->lane_num;
+	port_info->lane_cfg        =  in->lane_cfg;
+	port_info->vc[0]           =  in->vc[0];
+	port_info->dt[0]           =  in->dt[0];
+	port_info->num_valid_vc_dt =  in->num_valid_vc_dt;
+	port_info->format          =  in->format;
+	port_info->test_pattern    =  in->test_pattern;
+	port_info->usage_type      =  in->usage_type;
+	port_info->left_start      =  in->left_start;
+	port_info->left_stop       =  in->left_stop;
+	port_info->left_width      =  in->left_width;
+	port_info->right_start     =  in->right_start;
+	port_info->right_stop      =  in->right_stop;
+	port_info->right_width     =  in->right_width;
+	port_info->line_start      =  in->line_start;
+	port_info->line_stop       =  in->line_stop;
+	port_info->height          =  in->height;
+	port_info->pixel_clk       =  in->pixel_clk;
+	port_info->cust_node       =  1;
+	port_info->num_out_res     =  in->num_out_res;
+	port_info->num_bytes_out   =  in->num_bytes_out;
+
+	port_info->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_out_port_generic_info),
+		GFP_KERNEL);
+	if (port_info->data == NULL) {
+		rc = -ENOMEM;
+		goto release_port_mem;
+	}
+
+	for (i = 0; i < in->num_out_res; i++) {
+		port_info->data[i].res_type     = in->data_flex[i].res_type;
+		port_info->data[i].format       = in->data_flex[i].format;
+	}
+
+	*gen_port_info = port_info;
+	return 0;
+
+release_port_mem:
+	kfree(port_info);
+	return rc;
+}
+
+static int cam_custom_mgr_acquire_hw_for_ctx(
+	struct cam_custom_hw_mgr_ctx           *custom_ctx,
+	struct cam_isp_in_port_generic_info    *in_port_info,
+	uint32_t *acquired_hw_id, uint32_t *acquired_hw_path)
+{
+	int rc = 0, i = 0;
+	struct cam_hw_intf            *hw_intf;
+	struct cam_custom_hw_mgr      *custom_hw_mgr;
+	struct cam_custom_sub_mod_acq acq;
+
+	custom_hw_mgr = custom_ctx->hw_mgr;
+
+	/* Acquire custom csid */
+	rc = cam_custom_hw_mgr_acquire_csid_res(custom_ctx, in_port_info);
+	if (rc) {
+		CAM_ERR(CAM_CUSTOM, "Custom csid acquire failed rc %d");
+		goto err;
+	}
+
+	/* Acquire custom hw */
+	for (i = 0; i < CAM_CUSTOM_HW_SUB_MOD_MAX; i++) {
+		hw_intf = custom_hw_mgr->custom_hw[i];
+		if (!hw_intf)
+			continue;
+
+		acq.event_cb = cam_custom_hw_mgr_evt_handler;
+		acq.priv = custom_ctx;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&acq, sizeof(acq));
+		if (rc) {
+			CAM_DBG(CAM_CUSTOM,
+				"No custom resource from hw %d",
+				hw_intf->hw_idx);
+			continue;
+		}
+		/* need to be set in reserve based on HW being acquired */
+		//custom_ctx->sub_hw_list[i].hw_res = acq.rsrc_node;
+		//custom_ctx->sub_hw_list[i].res_type = <res_type>
+		//custom_ctx->sub_hw_list[i].res_id = <res_id>;
+		break;
+	}
+
+err:
+	return rc;
+}
+
+static int cam_custom_mgr_acquire_hw(
+	void *hw_mgr_priv,
+	void *acquire_hw_args)
+{
+	int rc = -1, i;
+	uint32_t                             input_size = 0;
+	struct cam_custom_hw_mgr_ctx        *custom_ctx;
+	struct cam_custom_hw_mgr            *custom_hw_mgr;
+	struct cam_custom_acquire_hw_info   *acquire_hw_info = NULL;
+	struct cam_isp_in_port_generic_info *gen_port_info = NULL;
+	struct cam_hw_acquire_args          *acquire_args =
+		(struct cam_hw_acquire_args *)acquire_hw_args;
+
+	if (!hw_mgr_priv || !acquire_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid params");
+		return -EINVAL;
+	}
+
+	custom_hw_mgr = (struct cam_custom_hw_mgr *) hw_mgr_priv;
+	mutex_lock(&g_custom_hw_mgr.ctx_mutex);
+	rc = cam_custom_hw_mgr_get_ctx(
+		&custom_hw_mgr->free_ctx_list, &custom_ctx);
+	if (rc || !custom_ctx) {
+		CAM_ERR(CAM_CUSTOM, "Get custom hw context failed");
+		mutex_unlock(&g_custom_hw_mgr.ctx_mutex);
+		goto err;
+	}
+	mutex_unlock(&g_custom_hw_mgr.ctx_mutex);
+
+	custom_ctx->hw_mgr = custom_hw_mgr;
+	custom_ctx->cb_priv = acquire_args->context_data;
+	custom_ctx->event_cb = acquire_args->event_cb;
+
+	acquire_hw_info =
+		(struct cam_custom_acquire_hw_info *)acquire_args->acquire_info;
+
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		rc = cam_custom_hw_mgr_acquire_get_unified_dev_str(
+			acquire_hw_info, &input_size, &gen_port_info);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_CUSTOM, "Failed in parsing: %d", rc);
+			goto free_res;
+		}
+
+		CAM_DBG(CAM_CUSTOM, "in_res_type %x", gen_port_info->res_type);
+		rc = cam_custom_mgr_acquire_hw_for_ctx(custom_ctx,
+			gen_port_info, &acquire_args->acquired_hw_id[i],
+			acquire_args->acquired_hw_path[i]);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM, "can not acquire resource");
+			goto free_mem;
+		}
+
+		kfree(gen_port_info->data);
+		kfree(gen_port_info);
+		gen_port_info = NULL;
+	}
+
+	custom_ctx->ctx_in_use = 1;
+	custom_ctx->scratch_buffer_addr = 0;
+	acquire_args->ctxt_to_hw_map = custom_ctx;
+	cam_custom_hw_mgr_put_ctx(&custom_hw_mgr->used_ctx_list, &custom_ctx);
+	CAM_DBG(CAM_CUSTOM, "Exit...(success)");
+	return 0;
+
+free_mem:
+	kfree(gen_port_info->data);
+	kfree(gen_port_info);
+free_res:
+	cam_custom_hw_mgr_release_hw_for_ctx(custom_ctx);
+	cam_custom_hw_mgr_put_ctx(&custom_hw_mgr->free_ctx_list, &custom_ctx);
+err:
+	CAM_DBG(CAM_CUSTOM, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static int cam_custom_add_io_buffers(
+	int                                   iommu_hdl,
+	struct cam_hw_prepare_update_args    *prepare)
+{
+	int rc = 0, i = 0, num_out_buf = 0;
+	int32_t                             hdl;
+	uint32_t                            plane_id;
+	size_t                              size;
+	struct cam_buf_io_cfg              *io_cfg;
+	struct cam_hw_fence_map_entry      *out_map_entries;
+	struct cam_custom_prepare_hw_update_data *prepare_hw_data;
+	bool                                is_buf_secure;
+
+	io_cfg = (struct cam_buf_io_cfg *)((uint8_t *)
+			&prepare->packet->payload_flex +
+			prepare->packet->io_configs_offset);
+	prepare_hw_data =
+			(struct cam_custom_prepare_hw_update_data *)
+			prepare->priv;
+
+	/* Validate hw update entries */
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		CAM_DBG(CAM_CUSTOM, "======= io config idx %d ============", i);
+		CAM_DBG(CAM_CUSTOM,
+			"i %d req_id %llu resource_type:%d fence:%d direction %d",
+			i, prepare->packet->header.request_id,
+			io_cfg[i].resource_type, io_cfg[i].fence,
+			io_cfg[i].direction);
+
+		CAM_DBG(CAM_CUSTOM, "format: %d", io_cfg[i].format);
+
+		if (io_cfg[i].direction == CAM_BUF_OUTPUT) {
+			CAM_DBG(CAM_CUSTOM,
+				"output fence 0x%x", io_cfg[i].fence);
+			out_map_entries =
+				&prepare->out_map_entries[num_out_buf];
+			if (num_out_buf < prepare->max_out_map_entries) {
+				out_map_entries->resource_handle =
+					io_cfg[i].resource_type;
+				out_map_entries->sync_id =
+					io_cfg[i].fence;
+				num_out_buf++;
+			} else {
+				CAM_ERR(CAM_CUSTOM, "out: %d max: %d",
+					num_out_buf,
+					prepare->max_out_map_entries);
+				return -EINVAL;
+			}
+		} else if (io_cfg[i].direction == CAM_BUF_INPUT) {
+			CAM_DBG(CAM_CUSTOM,
+				"input fence 0x%x", io_cfg[i].fence);
+			return -EINVAL;
+		} else {
+			CAM_ERR(CAM_CUSTOM, "Invalid io config direction :%d",
+				io_cfg[i].direction);
+			return -EINVAL;
+		}
+
+		if (io_cfg[i].direction == CAM_BUF_OUTPUT) {
+			for (plane_id = 0; plane_id < CAM_PACKET_MAX_PLANES;
+				plane_id++) {
+				/* for custom HW it's one plane only */
+				if (!io_cfg[i].mem_handle[plane_id])
+					continue;
+
+				hdl = io_cfg[i].mem_handle[plane_id];
+				is_buf_secure = cam_mem_is_secure_buf(hdl);
+				if (is_buf_secure) {
+					CAM_ERR(CAM_CUSTOM,
+						"secure buffer not supported");
+					return -EINVAL;
+				}
+
+				rc = cam_mem_get_io_buf(
+					io_cfg[i].mem_handle[plane_id],
+					iommu_hdl,
+					&prepare_hw_data->io_addr[plane_id],
+					&size);
+				if (rc) {
+					CAM_ERR(CAM_CUSTOM,
+						"No io addr for plane: %d",
+						plane_id);
+					return -EINVAL;
+				}
+
+				prepare_hw_data->io_addr[plane_id] +=
+					io_cfg[i].offsets[plane_id];
+				CAM_DBG(CAM_CUSTOM,
+					"handle 0x%x for plane %d addr %pK",
+					hdl, plane_id,
+					prepare_hw_data->io_addr[plane_id]);
+			}
+		}
+	}
+
+	prepare->num_out_map_entries = num_out_buf;
+	prepare->num_in_map_entries = 0;
+	return rc;
+}
+
+static int cam_custom_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int rc = 0;
+	struct cam_hw_prepare_update_args        *prepare;
+	struct cam_cmd_buf_desc                  *cmd_desc = NULL;
+	struct cam_custom_prepare_hw_update_data *prepare_hw_data;
+	struct cam_custom_hw_mgr                 *hw_mgr;
+	struct cam_custom_hw_mgr_ctx             *ctx = NULL;
+	uint32_t                                 *ptr;
+	size_t                                    len;
+	struct cam_custom_cmd_buf_type_1         *custom_buf_type1;
+
+	if (!hw_mgr_priv || !prepare_hw_update_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	hw_mgr = (struct cam_custom_hw_mgr *) hw_mgr_priv;
+	prepare =
+		(struct cam_hw_prepare_update_args *) prepare_hw_update_args;
+
+	CAM_DBG(CAM_CUSTOM, "Enter for req_id %lld",
+		prepare->packet->header.request_id);
+
+	/* Prepare packet */
+	prepare_hw_data =
+		(struct cam_custom_prepare_hw_update_data *)prepare->priv;
+	prepare_hw_data->packet_opcode_type =
+		(prepare->packet->header.op_code & 0xFFF);
+	ctx = (struct cam_custom_hw_mgr_ctx *) prepare->ctxt_to_hw_map;
+
+	prepare->num_hw_update_entries = 0;
+	prepare->num_in_map_entries = 0;
+	prepare->num_out_map_entries = 0;
+
+	/* Test purposes-check the data in cmd buffer */
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint8_t *)&prepare->packet->payload_flex +
+		prepare->packet->cmd_buf_offset);
+	rc = cam_packet_util_get_cmd_mem_addr(
+			cmd_desc->mem_handle, &ptr, &len);
+	if (!rc) {
+		ptr += (cmd_desc->offset / 4);
+		custom_buf_type1 =
+			(struct cam_custom_cmd_buf_type_1 *)ptr;
+		CAM_DBG(CAM_CUSTOM, "frame num %u",
+			custom_buf_type1->custom_info);
+	}
+
+	/*
+	 * Populate scratch buffer addr here based on INIT
+	 */
+	ctx->scratch_buffer_addr = 0x0;
+	prepare_hw_data->num_cfg = 0;
+	cam_custom_add_io_buffers(hw_mgr->img_iommu_hdl, prepare);
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return 0;
+}
+
+static int cam_custom_hw_mgr_reset_csid_res(
+	struct cam_custom_hw_mgr_res *hw_mgr_res)
+{
+	int rc = -1;
+	struct cam_csid_reset_cfg_args  csid_reset_args;
+	struct cam_isp_resource_node *custom_rsrc_node = NULL;
+	struct cam_hw_intf *hw_intf = NULL;
+
+	custom_rsrc_node =
+		(struct cam_isp_resource_node *)hw_mgr_res->rsrc_node;
+	if (!custom_rsrc_node) {
+		CAM_ERR(CAM_CUSTOM, "Invalid args");
+		return -EINVAL;
+	}
+
+	csid_reset_args.reset_type = CAM_IFE_CSID_RESET_PATH;
+	csid_reset_args.node_res = custom_rsrc_node;
+	hw_intf = custom_rsrc_node->hw_intf;
+	if (hw_intf->hw_ops.reset) {
+		CAM_DBG(CAM_CUSTOM, "RESET HW for res_id:%u",
+			hw_mgr_res->res_id);
+		rc = hw_intf->hw_ops.reset(hw_intf->hw_priv,
+			&csid_reset_args,
+			sizeof(struct cam_csid_reset_cfg_args));
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+
+err:
+	CAM_ERR(CAM_CUSTOM,
+		"RESET HW failed for res_id:%u",
+		hw_mgr_res->res_id);
+	return rc;
+}
+
+static int cam_custom_hw_mgr_reset(
+	void *hw_mgr_priv, void *hw_reset_args)
+{
+	struct cam_hw_reset_args         *reset_args =
+		hw_reset_args;
+	struct cam_custom_hw_mgr_ctx     *ctx;
+	struct cam_custom_hw_mgr_res     *hw_mgr_res;
+	int                               rc = 0;
+
+	if (!hw_mgr_priv || !hw_reset_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_custom_hw_mgr_ctx *)
+		reset_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_CUSTOM, "Reset SBI CSID and SBI core");
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_custom_csid, list) {
+		rc = cam_custom_hw_mgr_reset_csid_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_CUSTOM,
+				"Failed to reset CSID:%d rc: %d",
+				hw_mgr_res->res_id, rc);
+			goto end;
+		}
+	}
+
+	/* Reset SBI HW */
+
+end:
+	return rc;
+}
+
+static int cam_custom_mgr_config_hw(void *hw_mgr_priv,
+	void *hw_config_args)
+{
+	int rc = 0;
+	int i = 0;
+	struct cam_custom_hw_mgr_ctx *custom_ctx;
+	struct cam_custom_hw_mgr_res *res;
+	struct cam_hw_config_args    *cfg;
+	struct cam_hw_intf           *hw_intf = NULL;
+	struct cam_custom_prepare_hw_update_data *prepare_hw_data;
+
+	CAM_DBG(CAM_CUSTOM, "Enter");
+	if (!hw_mgr_priv || !hw_config_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	cfg =
+		(struct cam_hw_config_args *)hw_config_args;
+	custom_ctx = cfg->ctxt_to_hw_map;
+
+	if (!custom_ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Invalid context parameters");
+		return -EPERM;
+	}
+
+	prepare_hw_data =
+		(struct cam_custom_prepare_hw_update_data *)
+		cfg->priv;
+	for (i = 0; i < prepare_hw_data->num_cfg; i++) {
+		CAM_DBG(CAM_CUSTOM, "plane %d io_addr %pK",
+			i, prepare_hw_data->io_addr[i]);
+	}
+
+	prepare_hw_data =
+		(struct cam_custom_prepare_hw_update_data *)cfg->priv;
+	for (i = 0; i < prepare_hw_data->num_cfg; i++) {
+		CAM_DBG(CAM_CUSTOM, "plane %d io_addr %p cfg %u", i,
+			prepare_hw_data->io_addr[i],
+			prepare_hw_data->num_cfg);
+		/* this will be ZSLBuffer addr */
+	}
+
+	for (i = 0; i < CAM_CUSTOM_HW_SUB_MOD_MAX; i++) {
+		res = &custom_ctx->sub_hw_list[i];
+		if (res->hw_res) {
+			hw_intf = res->hw_res->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				struct cam_custom_sub_mod_req_to_dev req_to_dev;
+
+				req_to_dev.ctx_idx = custom_ctx->ctx_index;
+				req_to_dev.dev_idx = i;
+				req_to_dev.req_id = cfg->request_id;
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_CUSTOM_SUBMIT_REQ,
+					&req_to_dev, sizeof(req_to_dev));
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_custom_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args        *hw_cmd_args = cmd_args;
+	struct cam_custom_hw_cmd_args *custom_hw_cmd_args;
+	struct cam_custom_hw_mgr_ctx  *custom_ctx = NULL;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_CUSTOM, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	custom_ctx =
+		(struct cam_custom_hw_mgr_ctx *)
+		hw_cmd_args->ctxt_to_hw_map;
+
+	if (!custom_ctx || !custom_ctx->ctx_in_use) {
+		CAM_ERR(CAM_CUSTOM, "Fatal: Invalid context is used");
+		return -EPERM;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_INTERNAL:
+		if (!hw_cmd_args->u.internal_args) {
+			CAM_ERR(CAM_CUSTOM, "Invalid cmd arguments");
+			return -EINVAL;
+		}
+
+		custom_hw_cmd_args = (struct cam_custom_hw_cmd_args *)
+					hw_cmd_args->u.internal_args;
+
+		switch (custom_hw_cmd_args->cmd_type) {
+		case CAM_CUSTOM_HW_MGR_PROG_DEFAULT_CONFIG:
+			CAM_DBG(CAM_CUSTOM, "configure RUP and scratch buffer");
+			//use custom_ctx->scratch_buffer_addr
+			break;
+		default:
+			CAM_ERR(CAM_CUSTOM, "Invalid HW mgr command:0x%x",
+				hw_cmd_args->cmd_type);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	default:
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int cam_custom_hw_mgr_init(struct device_node *of_node,
+	struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl)
+{
+	int rc = 0;
+	int i, j;
+	struct cam_custom_hw_mgr_ctx *ctx_pool;
+
+	memset(&g_custom_hw_mgr, 0, sizeof(g_custom_hw_mgr));
+	mutex_init(&g_custom_hw_mgr.ctx_mutex);
+
+	/* fill custom hw intf information */
+	for (i = 0; i < CAM_CUSTOM_HW_SUB_MOD_MAX; i++) {
+		/* Initialize sub modules */
+		rc = cam_custom_hw_sub_mod_init(
+				&g_custom_hw_mgr.custom_hw[i], i);
+	}
+
+	for (i = 0; i < CAM_CUSTOM_CSID_HW_MAX; i++) {
+		/* Initialize csid custom modules */
+		rc = cam_custom_csid_hw_init(
+			&g_custom_hw_mgr.csid_devices[i], i);
+	}
+
+	INIT_LIST_HEAD(&g_custom_hw_mgr.free_ctx_list);
+	INIT_LIST_HEAD(&g_custom_hw_mgr.used_ctx_list);
+
+	/*
+	 *  for now, we only support one iommu handle. later
+	 *  we will need to setup more iommu handle for other
+	 *  use cases.
+	 *  Also, we have to release them once we have the
+	 *  deinit support
+	 */
+	if (cam_smmu_get_handle("custom",
+		&g_custom_hw_mgr.img_iommu_hdl)) {
+		CAM_ERR(CAM_CUSTOM, "Can not get iommu handle");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		memset(&g_custom_hw_mgr.ctx_pool[i], 0,
+			sizeof(g_custom_hw_mgr.ctx_pool[i]));
+		INIT_LIST_HEAD(&g_custom_hw_mgr.ctx_pool[i].list);
+
+		ctx_pool = &g_custom_hw_mgr.ctx_pool[i];
+
+		/* init context pool */
+		INIT_LIST_HEAD(&g_custom_hw_mgr.ctx_pool[i].free_res_list);
+		INIT_LIST_HEAD(
+			&g_custom_hw_mgr.ctx_pool[i].res_list_custom_csid);
+		INIT_LIST_HEAD(
+			&g_custom_hw_mgr.ctx_pool[i].res_list_custom_cid);
+		for (j = 0; j < CAM_CUSTOM_HW_RES_MAX; j++) {
+			INIT_LIST_HEAD(
+				&g_custom_hw_mgr.ctx_pool[i].res_pool[j].list);
+			list_add_tail(
+				&g_custom_hw_mgr.ctx_pool[i].res_pool[j].list,
+				&g_custom_hw_mgr.ctx_pool[i].free_res_list);
+		}
+
+		g_custom_hw_mgr.ctx_pool[i].ctx_index = i;
+		g_custom_hw_mgr.ctx_pool[i].hw_mgr = &g_custom_hw_mgr;
+
+		list_add_tail(&g_custom_hw_mgr.ctx_pool[i].list,
+			&g_custom_hw_mgr.free_ctx_list);
+	}
+
+	/* fill return structure */
+	hw_mgr_intf->hw_mgr_priv = &g_custom_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_custom_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire = cam_custom_mgr_acquire_hw;
+	hw_mgr_intf->hw_start = cam_custom_mgr_start_hw;
+	hw_mgr_intf->hw_stop = cam_custom_mgr_stop_hw;
+	hw_mgr_intf->hw_read = cam_custom_mgr_read;
+	hw_mgr_intf->hw_write = cam_custom_mgr_write;
+	hw_mgr_intf->hw_release = cam_custom_mgr_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_custom_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config = cam_custom_mgr_config_hw;
+	hw_mgr_intf->hw_reset = cam_custom_hw_mgr_reset;
+	hw_mgr_intf->hw_cmd = cam_custom_mgr_cmd;
+
+	if (iommu_hdl)
+		*iommu_hdl = g_custom_hw_mgr.img_iommu_hdl;
+
+	CAM_DBG(CAM_CUSTOM, "HW manager initialized");
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.h
@@ -0,0 +1,185 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_HW_MGR_H_
+#define _CAM_CUSTOM_HW_MGR_H_
+
+#include <linux/completion.h>
+#include "cam_custom_hw_mgr_intf.h"
+#include "cam_custom_sub_mod_core.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_custom_hw.h"
+
+#include <media/cam_defs.h>
+#include <media/cam_custom.h>
+
+enum cam_custom_hw_mgr_res_type {
+	CAM_CUSTOM_HW_SUB_MODULE,
+	CAM_CUSTOM_CID_HW,
+	CAM_CUSTOM_CSID_HW,
+	CAM_CUSTOM_HW_MAX,
+};
+
+/* Needs to be suitably defined */
+#define CAM_CUSTOM_HW_OUT_RES_MAX 1
+
+/**
+ * struct cam_custom_hw_mgr_res - HW resources for the Custom manager
+ *
+ * @list:                used by the resource list
+ * @res_type:            Custom manager resource type
+ * @res_id:              resource id based on the resource type for root or
+ *                       leaf resource, it matches the KMD interface port id.
+ *                       For branch resource, it is defined by the Custom HW
+ *                       layer
+ * @rsrc_node:           isp hw layer resource for csid/cid
+ * @hw_res:              hw layer resource array.
+ */
+struct cam_custom_hw_mgr_res {
+	struct list_head                 list;
+	enum cam_custom_hw_mgr_res_type  res_type;
+	uint32_t                         res_id;
+	void                            *rsrc_node;
+	struct cam_custom_resource_node *hw_res;
+};
+
+
+/**
+ * struct ctx_base_info - Base hardware information for the context
+ *
+ * @idx:                  Base resource index
+ *
+ */
+struct ctx_base_info {
+	uint32_t                       idx;
+};
+
+
+/**
+ * struct cam_custom_hw_mgr_ctx - Custom HW manager ctx object
+ *
+ * @list:                   used by the ctx list.
+ * @ctx_index:              acquired context id.
+ * @hw_mgr:                 Custom hw mgr which owns this context
+ * @ctx_in_use:             flag to tell whether context is active
+ * @res_list_custom_csid:   custom csid modules for this context
+ * @res_list_custom_cid:    custom cid modules for this context
+ * @sub_hw_list:            HW submodules for this context
+ * @free_res_list:          Free resources list for the branch node
+ * @res_pool:               memory storage for the free resource list
+ * @base:                   device base index array contain the all
+ *                          Custom HW instance associated with this ctx.
+ * @num_base:               number of valid base data in the base array
+ * @init_done:              indicate whether init hw is done
+ * @event_cb:               event_cb to ctx
+ * @scratch_buffer_addr:    scratch buffer address
+ * @task_type:              Custom HW task type
+ * @cb_priv:                data sent back with event_cb
+ *
+ */
+struct cam_custom_hw_mgr_ctx {
+	struct list_head                list;
+
+	uint32_t                        ctx_index;
+	struct cam_custom_hw_mgr       *hw_mgr;
+	uint32_t                        ctx_in_use;
+
+	struct list_head                res_list_custom_csid;
+	struct list_head                res_list_custom_cid;
+	struct cam_custom_hw_mgr_res    sub_hw_list[
+		CAM_CUSTOM_HW_RES_MAX];
+
+	struct list_head                free_res_list;
+	struct cam_custom_hw_mgr_res    res_pool[CAM_CUSTOM_HW_RES_MAX];
+	struct ctx_base_info            base[CAM_CUSTOM_HW_SUB_MOD_MAX];
+	uint32_t                        num_base;
+	bool                            init_done;
+	cam_hw_event_cb_func            event_cb;
+	uint64_t                        scratch_buffer_addr;
+	enum cam_custom_hw_task_type    task_type;
+	void                           *cb_priv;
+};
+
+/**
+ * struct cam_custom_hw_mgr - Custom HW Manager
+ *
+ * @img_iommu_hdl:         iommu handle
+ * @custom_hw:             Custom device instances array. This will be filled by
+ *                         HW layer during initialization
+ * @csid_devices:          Custom csid device instance array
+ * @ctx_mutex:             mutex for the hw context pool
+ * @free_ctx_list:         free hw context list
+ * @used_ctx_list:         used hw context list
+ * @ctx_pool:              context storage
+ *
+ */
+struct cam_custom_hw_mgr {
+	int                            img_iommu_hdl;
+	struct cam_hw_intf            *custom_hw[CAM_CUSTOM_HW_SUB_MOD_MAX];
+	struct cam_hw_intf            *csid_devices[CAM_CUSTOM_CSID_HW_MAX];
+	struct mutex                   ctx_mutex;
+	struct list_head               free_ctx_list;
+	struct list_head               used_ctx_list;
+	struct cam_custom_hw_mgr_ctx   ctx_pool[CAM_CTX_MAX];
+};
+
+/**
+ * cam_custom_hw_mgr_init()
+ *
+ * @brief:              Initialize the Custom hardware manger. This is the
+ *                      etnry functinon for the Cust HW manager.
+ *
+ * @of_node:            Device node
+ * @hw_mgr_intf:        Custom hardware manager object returned
+ * @iommu_hdl:          Iommu handle to be returned
+ *
+ */
+int cam_custom_hw_mgr_init(struct device_node *of_node,
+	struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl);
+
+
+/* Utility APIs */
+
+/**
+ * cam_custom_hw_mgr_get_custom_res_state()
+ *
+ * @brief:              Obtain equivalent custom rsrc state
+ *                      from isp rsrc state
+ *
+ * @in_rsrc_state:      isp rsrc state
+ *
+ */
+enum cam_custom_hw_resource_state
+	cam_custom_hw_mgr_get_custom_res_state(
+	uint32_t in_rsrc_state);
+
+/**
+ * cam_custom_hw_mgr_get_isp_res_state()
+ *
+ * @brief:              Obtain equivalent isp rsrc state
+ *                      from custom rsrc state
+ *
+ * @in_rsrc_state:      custom rsrc state
+ *
+ */
+enum cam_isp_resource_state
+	cam_custom_hw_mgr_get_isp_res_state(
+	uint32_t in_rsrc_state);
+
+/**
+ * cam_custom_hw_mgr_get_isp_res_type()
+ *
+ * @brief:         Obtain equivalent isp rsrc type
+ *                 from custom rsrc type
+ *
+ * @res_type:      custom rsrc type
+ *
+ */
+enum cam_isp_resource_type
+	cam_custom_hw_mgr_get_isp_res_type(
+	enum cam_custom_hw_mgr_res_type res_type);
+
+#endif /* _CAM_CUSTOM_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/include/cam_custom_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/include/cam_custom_hw.h
@@ -0,0 +1,80 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_HW_H_
+#define _CAM_CUSTOM_HW_H_
+
+#include <linux/of.h>
+#include <linux/time.h>
+#include <linux/list.h>
+
+#include <media/cam_custom.h>
+
+enum cam_custom_hw_resource_state {
+	CAM_CUSTOM_HW_RESOURCE_STATE_UNAVAILABLE   = 0,
+	CAM_CUSTOM_HW_RESOURCE_STATE_AVAILABLE     = 1,
+	CAM_CUSTOM_HW_RESOURCE_STATE_RESERVED      = 2,
+	CAM_CUSTOM_HW_RESOURCE_STATE_INIT_HW       = 3,
+	CAM_CUSTOM_HW_RESOURCE_STATE_STREAMING     = 4,
+};
+
+enum cam_custom_hw_task_type {
+	CAM_CUSTOM_EVENT_INVALID,
+	CAM_CUSTOM_EVENT_TASK1,
+	CAM_CUSTOM_EVENT_TASK2,
+	CAM_CUSTOM_EVENT_TASK3,
+	CAM_CUSTOM_EVENT_MAX,
+};
+
+/*
+ * struct cam_custom_hw_event_info:
+ *
+ * @Brief:          Structure to pass event details to hw mgr
+ *
+ * @task_type:      Type of CUSTOM HW Task
+ * @err_type:       Error type if any
+ *
+ */
+struct cam_custom_hw_event_info {
+	enum cam_custom_hw_task_type  task_type;
+	uint32_t                      err_type;
+};
+
+/*
+ * struct cam_custom_resource_node:
+ *
+ * @Brief:                        Structure representing HW resource object
+ *
+ * @res_id:                       Unique resource ID within res_type objects
+ *                                for a particular HW
+ * @res_state:                    State of the resource
+ * @hw_intf:                      HW Interface of HW to which this resource
+ *                                belongs
+ * @res_priv:                     Private data of the resource
+ * @irq_handle:                   handle returned on subscribing for IRQ event
+ * @init:                         function pointer to init the HW resource
+ * @deinit:                       function pointer to deinit the HW resource
+ * @start:                        function pointer to start the HW resource
+ * @stop:                         function pointer to stop the HW resource
+ * @process_cmd:                  function pointer for processing commands
+ *                                specific to the resource
+ */
+struct cam_custom_resource_node {
+	uint32_t                          res_id;
+	enum cam_custom_hw_resource_state res_state;
+	struct cam_hw_intf               *hw_intf;
+	void                             *res_priv;
+	int                               irq_handle;
+
+	int (*init)(struct cam_custom_resource_node *rsrc_node,
+		void *init_args, uint32_t arg_size);
+	int (*deinit)(struct cam_custom_resource_node *rsrc_node,
+		void *deinit_args, uint32_t arg_size);
+	int (*start)(struct cam_custom_resource_node *rsrc_node);
+	int (*stop)(struct cam_custom_resource_node *rsrc_node);
+	int (*process_cmd)(struct cam_custom_resource_node *rsrc_node,
+		uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+};
+#endif /* _CAM_CUSTOM_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/include/cam_custom_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_cust/cam_custom_hw_mgr/include/cam_custom_hw_mgr_intf.h
@@ -0,0 +1,172 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CUSTOM_HW_MGR_INTF_H_
+#define _CAM_CUSTOM_HW_MGR_INTF_H_
+
+#include <linux/of.h>
+#include <linux/time.h>
+#include <linux/list.h>
+#include <media/cam_custom.h>
+#include "cam_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_custom_hw.h"
+
+#define CAM_CUSTOM_HW_TYPE_1   1
+
+#define CAM_CUSTOM_HW_RES_MAX 32
+
+#define CAM_CUSTOM_HW_SUB_MOD_MAX 1
+#define CAM_CUSTOM_CSID_HW_MAX    1
+
+enum cam_custom_hw_event_type {
+	CAM_CUSTOM_HW_EVENT_ERROR,
+	CAM_CUSTOM_HW_EVENT_RUP_DONE,
+	CAM_CUSTOM_HW_EVENT_FRAME_DONE,
+	CAM_CUSTOM_HW_EVENT_MAX
+};
+
+enum cam_custom_cmd_types {
+	CAM_CUSTOM_CMD_NONE,
+	CAM_CUSTOM_SET_IRQ_CB,
+	CAM_CUSTOM_SUBMIT_REQ,
+};
+
+enum cam_custom_hw_mgr_cmd {
+	CAM_CUSTOM_HW_MGR_CMD_NONE,
+	CAM_CUSTOM_HW_MGR_PROG_DEFAULT_CONFIG,
+};
+
+/**
+ * struct cam_custom_hw_cmd_args - Payload for hw manager command
+ *
+ * @cmd_type               HW command type
+ * @reserved               any other required data
+ */
+struct cam_custom_hw_cmd_args {
+	uint32_t                   cmd_type;
+	uint32_t                   reserved;
+};
+
+/**
+ * struct cam_custom_hw_sof_event_data - Event payload for CAM_HW_EVENT_SOF
+ *
+ * @timestamp:   Time stamp for the sof event
+ * @boot_time:   Boot time stamp for the sof event
+ *
+ */
+struct cam_custom_hw_sof_event_data {
+	uint64_t       timestamp;
+	uint64_t       boot_time;
+};
+
+/**
+ * struct cam_custom_hw_reg_update_event_data - Event payload for
+ *                         CAM_HW_EVENT_REG_UPDATE
+ *
+ * @timestamp:     Time stamp for the reg update event
+ *
+ */
+struct cam_custom_hw_reg_update_event_data {
+	uint64_t       timestamp;
+};
+
+/**
+ * struct cam_custom_hw_done_event_data - Event payload for CAM_HW_EVENT_DONE
+ *
+ * @num_handles:           Number of resource handeles
+ * @resource_handle:       Resource handle array
+ *
+ */
+struct cam_custom_hw_done_event_data {
+	uint32_t             num_handles;
+	uint32_t             resource_handle[CAM_NUM_OUT_PER_COMP_IRQ_MAX];
+};
+
+/**
+ * struct cam_custom_hw_error_event_data - Event payload for CAM_HW_EVENT_ERROR
+ *
+ * @error_type:            Error type for the error event
+ * @timestamp:             Timestamp for the error event
+ */
+struct cam_custom_hw_error_event_data {
+	uint32_t             error_type;
+	uint64_t             timestamp;
+};
+
+/**
+ * struct cam_custom_stop_args - hardware stop arguments
+ *
+ * @stop_only                  Send stop only to hw drivers. No Deinit to be
+ *                             done.
+ */
+struct cam_custom_stop_args {
+	bool                          stop_only;
+};
+
+/**
+ * struct cam_custom_start_args - custom hardware start arguments
+ *
+ * @hw_config:                 Hardware configuration commands.
+ * @start_only                 Send start only to hw drivers. No init to
+ *                             be done.
+ *
+ */
+struct cam_custom_start_args {
+	struct cam_hw_config_args     hw_config;
+	bool                          start_only;
+};
+
+/**
+ * struct cam_custom_prepare_hw_update_data - hw prepare data
+ *
+ * @packet_opcode_type:     Packet header opcode in the packet header
+ *                          this opcode defines, packet is init packet or
+ *                          update packet
+ * @buffer_addr:            IO Buffer address
+ *
+ */
+struct cam_custom_prepare_hw_update_data {
+	uint32_t                    packet_opcode_type;
+	uint32_t                    num_cfg;
+	uint64_t                    io_addr[CAM_PACKET_MAX_PLANES];
+};
+
+/**
+ * struct cam_custom_hw_cb_args : HW manager callback args
+ *
+ * @res_type : resource type
+ * @err_type : error type
+ */
+struct cam_custom_hw_cb_args {
+	uint32_t                              res_type;
+	uint32_t                              err_type;
+};
+
+/**
+ * cam_custom_hw_sub_mod_init()
+ *
+ * @Brief:                  Initialize Custom HW device
+ *
+ * @custom_hw:              cust_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of Custom HW
+ */
+int cam_custom_hw_sub_mod_init(struct cam_hw_intf **custom_hw, uint32_t hw_idx);
+
+/**
+ * cam_custom_csid_hw_init()
+ *
+ * @Brief:                  Initialize Custom HW device
+ *
+ * @custom_hw:              cust_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of Custom HW
+ */
+int cam_custom_csid_hw_init(
+	struct cam_hw_intf **custom_hw, uint32_t hw_idx);
+
+#endif /* _CAM_CUSTOM_HW_MGR_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/cam_fd_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/cam_fd_context.c
@@ -0,0 +1,267 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_debug_util.h"
+#include "cam_fd_context.h"
+#include "cam_trace.h"
+
+static const char fd_dev_name[] = "cam-fd";
+
+/* Functions in Available state */
+static int __cam_fd_ctx_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Acquire dev, rc=%d", rc);
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("FD", ctx);
+
+	return rc;
+}
+
+/* Functions in Acquired state */
+static int __cam_fd_ctx_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Release dev, rc=%d", rc);
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_AVAILABLE;
+	trace_cam_context_state("FD", ctx);
+
+	return rc;
+}
+
+static int __cam_fd_ctx_config_dev_in_acquired(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Prepare dev, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __cam_fd_ctx_start_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_start_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Start dev, rc=%d", rc);
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACTIVATED;
+	trace_cam_context_state("FD", ctx);
+
+	return rc;
+}
+
+/* Functions in Activated state */
+static int __cam_fd_ctx_stop_dev_in_activated(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Stop dev, rc=%d", rc);
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("FD", ctx);
+
+	return rc;
+}
+
+static int __cam_fd_ctx_release_dev_in_activated(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = __cam_fd_ctx_stop_dev_in_activated(ctx, NULL);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Stop dev, rc=%d", rc);
+		return rc;
+	}
+
+	rc = __cam_fd_ctx_release_dev_in_acquired(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Release dev, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __cam_fd_ctx_dump_dev_in_activated(
+	struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed to dump device, rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_fd_ctx_flush_dev_in_activated(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_flush_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to flush device, rc=%d", rc);
+
+	return rc;
+}
+static int __cam_fd_ctx_config_dev_in_activated(
+	struct cam_context *ctx, struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in Prepare dev, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __cam_fd_ctx_handle_irq_in_activated(void *context,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc;
+
+	rc = cam_context_buf_done_from_hw(context, evt_data, evt_id);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in buf done, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_fd_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_fd_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.release_dev = __cam_fd_ctx_release_dev_in_acquired,
+			.config_dev = __cam_fd_ctx_config_dev_in_acquired,
+			.start_dev = __cam_fd_ctx_start_dev_in_acquired,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_fd_ctx_stop_dev_in_activated,
+			.release_dev = __cam_fd_ctx_release_dev_in_activated,
+			.config_dev = __cam_fd_ctx_config_dev_in_activated,
+			.flush_dev = __cam_fd_ctx_flush_dev_in_activated,
+			.dump_dev = __cam_fd_ctx_dump_dev_in_activated,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_fd_ctx_handle_irq_in_activated,
+	},
+};
+
+
+int cam_fd_context_init(struct cam_fd_context *fd_ctx,
+	struct cam_context *base_ctx, struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id)
+{
+	int rc;
+
+	if (!base_ctx || !fd_ctx) {
+		CAM_ERR(CAM_FD, "Invalid Context %pK %pK", base_ctx, fd_ctx);
+		return -EINVAL;
+	}
+
+	memset(fd_ctx, 0, sizeof(*fd_ctx));
+
+	rc = cam_context_init(base_ctx, fd_dev_name, CAM_FD, ctx_id,
+		NULL, hw_intf, fd_ctx->req_base, CAM_CTX_REQ_MAX);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Camera Context Base init failed, rc=%d", rc);
+		return rc;
+	}
+
+	fd_ctx->base = base_ctx;
+	base_ctx->ctx_priv = fd_ctx;
+	base_ctx->state_machine = cam_fd_ctx_state_machine;
+
+	return rc;
+}
+
+int cam_fd_context_deinit(struct cam_fd_context *fd_ctx)
+{
+	int rc = 0;
+
+	if (!fd_ctx || !fd_ctx->base) {
+		CAM_ERR(CAM_FD, "Invalid inputs %pK", fd_ctx);
+		return -EINVAL;
+	}
+
+	rc = cam_context_deinit(fd_ctx->base);
+	if (rc)
+		CAM_ERR(CAM_FD, "Error in base deinit, rc=%d", rc);
+
+	memset(fd_ctx, 0, sizeof(*fd_ctx));
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/cam_fd_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/cam_fd_context.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_CONTEXT_H_
+#define _CAM_FD_CONTEXT_H_
+
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_interface.h"
+
+/**
+ * struct cam_fd_context - Face Detection context information
+ *
+ * @base     : Base context pointer for this FD context
+ * @req_base : List of base requests for this FD context
+ */
+struct cam_fd_context {
+	struct cam_context       *base;
+	struct cam_ctx_request    req_base[CAM_CTX_REQ_MAX];
+};
+
+int cam_fd_context_init(struct cam_fd_context *fd_ctx,
+	struct cam_context *base_ctx, struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id);
+int cam_fd_context_deinit(struct cam_fd_context *ctx);
+
+#endif /* _CAM_FD_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/cam_fd_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/cam_fd_dev.c
@@ -0,0 +1,261 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_fd_context.h"
+#include "cam_fd_hw_mgr.h"
+#include "cam_fd_hw_mgr_intf.h"
+#include "camera_main.h"
+
+#define CAM_FD_DEV_NAME "cam-fd"
+
+/**
+ * struct cam_fd_dev - FD device information
+ *
+ * @sd:         Subdev information
+ * @base_ctx:   List of base contexts
+ * @fd_ctx:     List of FD contexts
+ * @lock:       Mutex handle
+ * @open_cnt:   FD subdev open count
+ * @probe_done: Whether FD probe is completed
+ */
+struct cam_fd_dev {
+	struct cam_subdev     sd;
+	struct cam_context    base_ctx[CAM_CTX_MAX];
+	struct cam_fd_context fd_ctx[CAM_CTX_MAX];
+	struct mutex          lock;
+	uint32_t              open_cnt;
+	bool                  probe_done;
+};
+
+static struct cam_fd_dev g_fd_dev;
+
+static int cam_fd_dev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_fd_dev *fd_dev = &g_fd_dev;
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
+	if (!fd_dev->probe_done) {
+		CAM_ERR(CAM_FD, "FD Dev not initialized, fd_dev=%pK", fd_dev);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+		return -ENODEV;
+	}
+
+	mutex_lock(&fd_dev->lock);
+	fd_dev->open_cnt++;
+	CAM_DBG(CAM_FD, "FD Subdev open count %d", fd_dev->open_cnt);
+	mutex_unlock(&fd_dev->lock);
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
+	return 0;
+}
+
+int cam_fd_dev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_fd_dev *fd_dev = &g_fd_dev;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	if (!fd_dev->probe_done) {
+		CAM_ERR(CAM_FD, "FD Dev not initialized, fd_dev=%pK", fd_dev);
+		return -ENODEV;
+	}
+
+	mutex_lock(&fd_dev->lock);
+	if (fd_dev->open_cnt == 0) {
+		CAM_WARN(CAM_FD, "device already closed");
+		mutex_unlock(&fd_dev->lock);
+		return 0;
+	}
+	fd_dev->open_cnt--;
+	CAM_DBG(CAM_FD, "FD Subdev open count %d", fd_dev->open_cnt);
+	mutex_unlock(&fd_dev->lock);
+
+	if (!node) {
+		CAM_ERR(CAM_FD, "Node ptr is NULL");
+		return -EINVAL;
+	}
+
+	cam_node_shutdown(node);
+
+	return 0;
+}
+
+static int cam_fd_dev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_FD, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_fd_dev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_fd_subdev_internal_ops = {
+	.open = cam_fd_dev_open,
+	.close = cam_fd_dev_close,
+};
+
+static int cam_fd_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+	int i;
+	struct cam_hw_mgr_intf hw_mgr_intf;
+	struct cam_node *node;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	g_fd_dev.sd.internal_ops = &cam_fd_subdev_internal_ops;
+	g_fd_dev.sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	/* Initialize the v4l2 subdevice first. (create cam_node) */
+	rc = cam_subdev_probe(&g_fd_dev.sd, pdev, CAM_FD_DEV_NAME,
+		CAM_FD_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_FD, "FD cam_subdev_probe failed, rc=%d", rc);
+		return rc;
+	}
+	node = (struct cam_node *) g_fd_dev.sd.token;
+
+	rc = cam_fd_hw_mgr_init(pdev->dev.of_node, &hw_mgr_intf);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in initializing FD HW manager, rc=%d",
+			rc);
+		goto unregister_subdev;
+	}
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_fd_context_init(&g_fd_dev.fd_ctx[i],
+			&g_fd_dev.base_ctx[i], &node->hw_mgr_intf, i);
+		if (rc) {
+			CAM_ERR(CAM_FD, "FD context init failed i=%d, rc=%d",
+				i, rc);
+			goto deinit_ctx;
+		}
+	}
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_fd_dev.base_ctx, CAM_CTX_MAX,
+		CAM_FD_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_FD, "FD node init failed, rc=%d", rc);
+		goto deinit_ctx;
+	}
+
+	node->sd_handler = cam_fd_dev_close_internal;
+	mutex_init(&g_fd_dev.lock);
+	rc = cam_subdev_register(&g_fd_dev.sd, pdev);
+	g_fd_dev.probe_done = true;
+	CAM_DBG(CAM_FD, "Component bound successfully");
+
+	return rc;
+
+deinit_ctx:
+	for (--i; i >= 0; i--) {
+		if (cam_fd_context_deinit(&g_fd_dev.fd_ctx[i]))
+			CAM_ERR(CAM_FD, "FD context %d deinit failed", i);
+	}
+unregister_subdev:
+	if (cam_subdev_remove(&g_fd_dev.sd))
+		CAM_ERR(CAM_FD, "Failed in subdev remove");
+
+	return rc;
+}
+
+static void cam_fd_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i, rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_fd_context_deinit(&g_fd_dev.fd_ctx[i]);
+		if (rc)
+			CAM_ERR(CAM_FD, "FD context %d deinit failed, rc=%d",
+				i, rc);
+	}
+
+	rc = cam_fd_hw_mgr_deinit(pdev->dev.of_node);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed in hw mgr deinit, rc=%d", rc);
+
+	rc = cam_unregister_subdev(&g_fd_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_FD, "Unregister failed, rc=%d", rc);
+
+	rc = cam_subdev_remove(&g_fd_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_FD, "Subdev remove failed, rc=%d", rc);
+
+	mutex_destroy(&g_fd_dev.lock);
+	g_fd_dev.probe_done = false;
+}
+
+const static struct component_ops cam_fd_dev_component_ops = {
+	.bind = cam_fd_dev_component_bind,
+	.unbind = cam_fd_dev_component_unbind,
+};
+
+static int cam_fd_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_FD, "Adding FD dev component");
+	rc = component_add(&pdev->dev, &cam_fd_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_FD, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_fd_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_fd_dev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_fd_dt_match[] = {
+	{
+		.compatible = "qcom,cam-fd"
+	},
+	{}
+};
+
+struct platform_driver cam_fd_driver = {
+	.probe = cam_fd_dev_probe,
+	.remove = cam_fd_dev_remove,
+	.driver = {
+		.name = "cam_fd",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_fd_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_fd_dev_init_module(void)
+{
+	return platform_driver_register(&cam_fd_driver);
+}
+
+void cam_fd_dev_exit_module(void)
+{
+	platform_driver_unregister(&cam_fd_driver);
+}
+
+MODULE_DESCRIPTION("MSM FD driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/cam_fd_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/cam_fd_dev.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_DEV_H_
+#define _CAM_FD_DEV_H_
+
+/**
+ * @brief : API to register FD Dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_fd_dev_init_module(void);
+
+/**
+ * @brief : API to remove FD Dev interface from platform framework.
+ */
+void cam_fd_dev_exit_module(void);
+
+#endif /* _CAM_FD_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
@@ -0,0 +1,2194 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_sync.h>
+
+#include "cam_io_util.h"
+#include "cam_soc_util.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_smmu_api.h"
+#include "cam_packet_util.h"
+#include "cam_fd_context.h"
+#include "cam_fd_hw_intf.h"
+#include "cam_fd_hw_core.h"
+#include "cam_fd_hw_soc.h"
+#include "cam_fd_hw_mgr_intf.h"
+#include "cam_fd_hw_mgr.h"
+#include "cam_trace.h"
+
+static struct cam_fd_hw_mgr g_fd_hw_mgr;
+
+static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet,
+	size_t remain_len)
+{
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	int i, rc;
+
+	if (!packet)
+		return -EINVAL;
+
+	CAM_DBG(CAM_FD, "Packet request=%d, op_code=0x%x, size=%d, flags=%d",
+		packet->header.request_id, packet->header.op_code,
+		packet->header.size, packet->header.flags);
+	CAM_DBG(CAM_FD,
+		"Packet cmdbuf(offset=%d, num=%d) io(offset=%d, num=%d)",
+		packet->cmd_buf_offset, packet->num_cmd_buf,
+		packet->io_configs_offset, packet->num_io_configs);
+	CAM_DBG(CAM_FD,
+		"Packet Patch(offset=%d, num=%d) kmd(offset=%d, num=%d)",
+		packet->patch_offset, packet->num_patches,
+		packet->kmd_cmd_buf_offset, packet->kmd_cmd_buf_index);
+
+	if (cam_packet_util_validate_packet(packet, remain_len)) {
+		CAM_ERR(CAM_FD, "invalid packet:%d %d %d %d %d",
+			packet->kmd_cmd_buf_index,
+			packet->num_cmd_buf, packet->cmd_buf_offset,
+			packet->io_configs_offset, packet->header.size);
+		return -EINVAL;
+	}
+
+	/* All buffers must come through io config, do not support patching */
+	if (packet->num_patches || !packet->num_io_configs || !packet->num_cmd_buf) {
+		CAM_ERR(CAM_FD, "wrong number of cmd/patch info: %u %u",
+			packet->num_cmd_buf, packet->num_patches);
+		return -EINVAL;
+	}
+
+	/* KMD Buf index can never be greater than or equal to num cmd bufs */
+	if (packet->kmd_cmd_buf_index >= packet->num_cmd_buf) {
+		CAM_ERR(CAM_FD, "Invalid kmd index %d (%d)",
+			packet->kmd_cmd_buf_index, packet->num_cmd_buf);
+		return -EINVAL;
+	}
+
+	if ((packet->header.op_code & 0xff) !=
+		CAM_PACKET_OPCODES_FD_FRAME_UPDATE) {
+		CAM_ERR(CAM_FD, "Invalid op_code %u",
+			packet->header.op_code & 0xff);
+		return -EINVAL;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *) ((uint8_t *)&packet->payload_flex +
+		packet->cmd_buf_offset);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		/*
+		 * We can allow 0 length cmd buffer. This can happen in case
+		 * umd gives an empty cmd buffer as kmd buffer
+		 */
+		if (!cmd_desc[i].length)
+			continue;
+
+		if ((cmd_desc[i].meta_data != CAM_FD_CMD_BUFFER_ID_GENERIC) &&
+			(cmd_desc[i].meta_data != CAM_FD_CMD_BUFFER_ID_CDM)) {
+			CAM_ERR(CAM_FD, "Invalid meta_data [%d] %u", i,
+				cmd_desc[i].meta_data);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_FD,
+			"CmdBuf[%d] hdl=%d, offset=%d, size=%d, len=%d, type=%d, meta_data=%d",
+			i,
+			cmd_desc[i].mem_handle, cmd_desc[i].offset,
+			cmd_desc[i].size, cmd_desc[i].length, cmd_desc[i].type,
+			cmd_desc[i].meta_data);
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc) {
+			CAM_ERR(CAM_FD, "Invalid cmd buffer %d", i);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_fd_mgr_util_put_ctx(
+	struct list_head *src_list,
+	struct cam_fd_hw_mgr_ctx **fd_ctx)
+{
+	int rc = 0;
+	struct cam_fd_hw_mgr_ctx *ctx_ptr = NULL;
+
+	mutex_lock(&g_fd_hw_mgr.ctx_mutex);
+	ctx_ptr = *fd_ctx;
+	if (ctx_ptr)
+		list_add_tail(&ctx_ptr->list, src_list);
+	*fd_ctx = NULL;
+	mutex_unlock(&g_fd_hw_mgr.ctx_mutex);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_get_ctx(
+	struct list_head *src_list,
+	struct cam_fd_hw_mgr_ctx **fd_ctx)
+{
+	int rc = 0;
+	struct cam_fd_hw_mgr_ctx *ctx_ptr = NULL;
+
+	mutex_lock(&g_fd_hw_mgr.ctx_mutex);
+	if (!list_empty(src_list)) {
+		ctx_ptr = list_first_entry(src_list,
+			struct cam_fd_hw_mgr_ctx, list);
+		list_del_init(&ctx_ptr->list);
+	} else {
+		CAM_ERR(CAM_FD, "No more free fd hw mgr ctx");
+		rc = -1;
+	}
+	*fd_ctx = ctx_ptr;
+	mutex_unlock(&g_fd_hw_mgr.ctx_mutex);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_put_frame_req(
+	struct list_head *src_list,
+	struct cam_fd_mgr_frame_request **frame_req)
+{
+	int rc = 0;
+	struct cam_fd_mgr_frame_request *req_ptr = NULL;
+
+	mutex_lock(&g_fd_hw_mgr.frame_req_mutex);
+	req_ptr = *frame_req;
+	if (req_ptr) {
+		list_del_init(&req_ptr->list);
+		list_add_tail(&req_ptr->list, src_list);
+	}
+	*frame_req = NULL;
+	mutex_unlock(&g_fd_hw_mgr.frame_req_mutex);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_get_frame_req(
+	struct list_head *src_list,
+	struct cam_fd_mgr_frame_request **frame_req)
+{
+	int rc = 0;
+	struct cam_fd_mgr_frame_request *req_ptr = NULL;
+
+	mutex_lock(&g_fd_hw_mgr.frame_req_mutex);
+	if (!list_empty(src_list)) {
+		req_ptr = list_first_entry(src_list,
+			struct cam_fd_mgr_frame_request, list);
+		list_del_init(&req_ptr->list);
+	} else {
+		CAM_DBG(CAM_FD, "Frame req not available");
+		rc = -EPERM;
+	}
+	*frame_req = req_ptr;
+	mutex_unlock(&g_fd_hw_mgr.frame_req_mutex);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_get_device(struct cam_fd_hw_mgr *hw_mgr,
+	struct cam_fd_hw_mgr_ctx *hw_ctx, struct cam_fd_device **hw_device)
+{
+	if (!hw_mgr || !hw_ctx || !hw_device) {
+		CAM_ERR(CAM_FD, "Invalid input %pK %pK %pK", hw_mgr, hw_ctx,
+			hw_device);
+		return -EINVAL;
+	}
+
+	if ((hw_ctx->device_index < 0) ||
+		(hw_ctx->device_index >= CAM_FD_HW_MAX)) {
+		CAM_ERR(CAM_FD, "Invalid device indx %d", hw_ctx->device_index);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_FD, "ctx_index=%u, hw_ctx=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	*hw_device = &hw_mgr->hw_device[hw_ctx->device_index];
+
+	return 0;
+}
+
+static int cam_fd_mgr_util_release_device(struct cam_fd_hw_mgr *hw_mgr,
+	struct cam_fd_hw_mgr_ctx *hw_ctx)
+{
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_release_args hw_release_args;
+	int rc;
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	if (hw_device->hw_intf->hw_ops.release) {
+		hw_release_args.hw_ctx = hw_ctx;
+		hw_release_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+		rc = hw_device->hw_intf->hw_ops.release(
+			hw_device->hw_intf->hw_priv, &hw_release_args,
+			sizeof(hw_release_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW release %d", rc);
+			return rc;
+		}
+	} else {
+		CAM_ERR(CAM_FD, "Invalid release function");
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	hw_device->num_ctxts--;
+
+	if (!hw_device->num_ctxts) {
+		mutex_lock(&hw_device->lock);
+		hw_device->ready_to_process = true;
+		hw_device->req_id = -1;
+		hw_device->cur_hw_ctx = NULL;
+		mutex_unlock(&hw_device->lock);
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	hw_ctx->device_index = -1;
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_select_device(struct cam_fd_hw_mgr *hw_mgr,
+	struct cam_fd_hw_mgr_ctx *hw_ctx,
+	struct cam_fd_acquire_dev_info *fd_acquire_args)
+{
+	int i, rc;
+	struct cam_fd_hw_reserve_args hw_reserve_args;
+	struct cam_fd_device *hw_device = NULL;
+
+	if (!hw_mgr || !hw_ctx || !fd_acquire_args) {
+		CAM_ERR(CAM_FD, "Invalid input %pK %pK %pK", hw_mgr, hw_ctx,
+			fd_acquire_args);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	/* Check if a device is free which can satisfy the requirements */
+	for (i = 0; i < hw_mgr->num_devices; i++) {
+		hw_device = &hw_mgr->hw_device[i];
+		CAM_DBG(CAM_FD,
+			"[%d] : num_ctxts=%d, modes=%d, raw_results=%d",
+			i, hw_device->num_ctxts,
+			hw_device->hw_caps.supported_modes,
+			hw_device->hw_caps.raw_results_available);
+		if ((hw_device->num_ctxts == 0) &&
+			(fd_acquire_args->mode &
+			hw_device->hw_caps.supported_modes) &&
+			(!fd_acquire_args->get_raw_results ||
+			hw_device->hw_caps.raw_results_available)) {
+			CAM_DBG(CAM_FD, "Found dedicated HW Index=%d", i);
+			mutex_lock(&hw_device->lock);
+			hw_device->ready_to_process = true;
+			hw_device->req_id = -1;
+			hw_device->cur_hw_ctx = NULL;
+			mutex_unlock(&hw_device->lock);
+			hw_device->num_ctxts++;
+			break;
+		}
+	}
+
+	/*
+	 * We couldn't find a free HW which meets requirement, now check if
+	 * there is a HW which meets acquire requirements
+	 */
+	if (i == hw_mgr->num_devices) {
+		for (i = 0; i < hw_mgr->num_devices; i++) {
+			hw_device = &hw_mgr->hw_device[i];
+			if ((fd_acquire_args->mode &
+				hw_device->hw_caps.supported_modes) &&
+				(!fd_acquire_args->get_raw_results ||
+				hw_device->hw_caps.raw_results_available)) {
+				hw_device->num_ctxts++;
+				CAM_DBG(CAM_FD,
+					"Found sharing HW Index=%d, num_ctxts=%d",
+					i, hw_device->num_ctxts);
+				break;
+			}
+		}
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	if ((i == hw_mgr->num_devices) || !hw_device) {
+		CAM_ERR(CAM_FD, "Couldn't acquire HW %d %d",
+			fd_acquire_args->mode,
+			fd_acquire_args->get_raw_results);
+		return -EBUSY;
+	}
+
+	CAM_DBG(CAM_FD, "Device index %d selected for this acquire", i);
+
+	/* Check if we can reserve this HW */
+	if (hw_device->hw_intf->hw_ops.reserve) {
+		hw_reserve_args.hw_ctx = hw_ctx;
+		hw_reserve_args.mode = fd_acquire_args->mode;
+		rc = hw_device->hw_intf->hw_ops.reserve(
+			hw_device->hw_intf->hw_priv, &hw_reserve_args,
+			sizeof(hw_reserve_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW reserve %d", rc);
+			return rc;
+		}
+		hw_ctx->ctx_hw_private = hw_reserve_args.ctx_hw_private;
+	} else {
+		CAM_ERR(CAM_FD, "Invalid reserve function");
+		return -EPERM;
+	}
+
+	/* Update required info in hw context */
+	hw_ctx->device_index = i;
+
+	CAM_DBG(CAM_FD, "ctx index=%u, device_index=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	return 0;
+}
+
+static int cam_fd_mgr_util_pdev_get_hw_intf(struct device_node *of_node,
+	int i, struct cam_hw_intf **device_hw_intf)
+{
+	struct device_node *device_node = NULL;
+	struct platform_device *child_pdev = NULL;
+	struct cam_hw_intf *hw_intf = NULL;
+	const char *name = NULL;
+	int rc;
+
+	rc = of_property_read_string_index(of_node, "compat-hw-name", i, &name);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Getting dev object name failed %d %d", i, rc);
+		goto put_node;
+	}
+
+	device_node = of_find_node_by_name(NULL, name);
+	if (!device_node) {
+		CAM_ERR(CAM_FD, "Cannot find node in dtsi %s", name);
+		return -ENODEV;
+	}
+
+	child_pdev = of_find_device_by_node(device_node);
+	if (!child_pdev) {
+		CAM_ERR(CAM_FD, "Failed to find device on bus %s",
+			device_node->name);
+		rc = -ENODEV;
+		goto put_node;
+	}
+
+	hw_intf = (struct cam_hw_intf *)platform_get_drvdata(child_pdev);
+	if (!hw_intf) {
+		CAM_ERR(CAM_FD, "No driver data for child device");
+		rc = -ENODEV;
+		goto put_node;
+	}
+
+	CAM_DBG(CAM_FD, "child type %d index %d child_intf %pK",
+		hw_intf->hw_type, hw_intf->hw_idx, hw_intf);
+
+	if (hw_intf->hw_idx >= CAM_FD_HW_MAX) {
+		CAM_ERR(CAM_FD, "hw_idx invalid %d", hw_intf->hw_idx);
+		rc = -ENODEV;
+		goto put_node;
+	}
+
+	rc = 0;
+	*device_hw_intf = hw_intf;
+
+put_node:
+	of_node_put(device_node);
+
+	return rc;
+}
+
+static int cam_fd_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	struct cam_fd_hw_cmd_prestart_args *prestart_args =
+		(struct cam_fd_hw_cmd_prestart_args *)user_data;
+
+	if (!blob_data || (blob_size == 0)) {
+		CAM_ERR(CAM_FD, "Invalid blob info %pK %u", blob_data,
+			blob_size);
+		return -EINVAL;
+	}
+
+	if (!prestart_args) {
+		CAM_ERR(CAM_FD, "Invalid user data");
+		return -EINVAL;
+	}
+
+	switch (blob_type) {
+	case CAM_FD_BLOB_TYPE_RAW_RESULTS_REQUIRED: {
+		uint32_t *get_raw_results = (uint32_t *)blob_data;
+
+		if (sizeof(uint32_t) != blob_size) {
+			CAM_ERR(CAM_FD, "Invalid blob size %zu %u",
+				sizeof(uint32_t), blob_size);
+			return -EINVAL;
+		}
+
+		prestart_args->get_raw_results = *get_raw_results;
+		break;
+	}
+	case CAM_FD_BLOB_TYPE_SOC_CLOCK_BW_REQUEST: {
+		struct cam_fd_soc_clock_bw_request *clk_req =
+			(struct cam_fd_soc_clock_bw_request *)blob_data;
+
+		if (sizeof(struct cam_fd_soc_clock_bw_request) != blob_size) {
+			CAM_ERR(CAM_FD, "Invalid blob size %zu %u",
+				sizeof(struct cam_fd_soc_clock_bw_request),
+				blob_size);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_FD, "SOC Clk Request clock=%lld, bw=%lld",
+			clk_req->clock_rate, clk_req->bandwidth);
+
+		break;
+	}
+	default:
+		CAM_WARN(CAM_FD, "Unknown blob type %d", blob_type);
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_fd_mgr_util_parse_generic_cmd_buffer(
+	struct cam_fd_hw_mgr_ctx *hw_ctx, struct cam_packet *packet,
+	struct cam_fd_hw_cmd_prestart_args *prestart_args)
+{
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	int i, rc = 0;
+
+	cmd_desc = (struct cam_cmd_buf_desc *) ((uint8_t *)&packet->payload_flex +
+		packet->cmd_buf_offset);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data == CAM_FD_CMD_BUFFER_ID_CDM)
+			continue;
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+			cam_fd_packet_generic_blob_handler, prestart_args);
+		if (rc)
+			CAM_ERR(CAM_FD, "Failed in processing blobs %d", rc);
+
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_get_buf_map_requirement(uint32_t direction,
+	uint32_t resource_type, bool *need_io_map, bool *need_cpu_map)
+{
+	if (!need_io_map || !need_cpu_map) {
+		CAM_ERR(CAM_FD, "Invalid input pointers %pK %pK", need_io_map,
+			need_cpu_map);
+		return -EINVAL;
+	}
+
+	if (direction == CAM_BUF_INPUT) {
+		switch (resource_type) {
+		case CAM_FD_INPUT_PORT_ID_IMAGE:
+			*need_io_map = true;
+			*need_cpu_map = false;
+			break;
+		default:
+			CAM_WARN(CAM_FD, "Invalid port: dir %d, id %d",
+				direction, resource_type);
+			return -EINVAL;
+		}
+	} else if (direction == CAM_BUF_OUTPUT) {
+		switch (resource_type) {
+		case CAM_FD_OUTPUT_PORT_ID_RESULTS:
+			*need_io_map = true;
+			*need_cpu_map = true;
+			break;
+		case CAM_FD_OUTPUT_PORT_ID_RAW_RESULTS:
+			*need_io_map = true;
+			*need_cpu_map = true;
+			break;
+		case CAM_FD_OUTPUT_PORT_ID_WORK_BUFFER:
+			*need_io_map = true;
+			*need_cpu_map = false;
+			break;
+		default:
+			CAM_WARN(CAM_FD, "Invalid port: dir %d, id %d",
+				direction, resource_type);
+			return -EINVAL;
+		}
+	} else {
+		CAM_WARN(CAM_FD, "Invalid direction %d", direction);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_fd_mgr_put_cpu_buf(struct cam_hw_prepare_update_args *prepare)
+{
+	int i, rc;
+	uint32_t plane;
+	bool need_io_map, need_cpu_map;
+	struct cam_buf_io_cfg *io_cfg;
+
+	io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+		&prepare->packet->payload_flex + prepare->packet->io_configs_offset);
+
+	if (!io_cfg)
+		return -EINVAL;
+
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		rc = cam_fd_mgr_util_get_buf_map_requirement(
+			io_cfg[i].direction, io_cfg[i].resource_type,
+			&need_io_map, &need_cpu_map);
+
+		if (rc || !need_cpu_map)
+			continue;
+
+		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++)
+			cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane]);
+	}
+	return 0;
+}
+
+static int cam_fd_mgr_util_prepare_io_buf_info(int32_t iommu_hdl,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_fd_hw_io_buffer *input_buf,
+	struct cam_fd_hw_io_buffer *output_buf, uint32_t io_buf_size)
+{
+	int rc = -EINVAL;
+	uint32_t plane, num_out_buf, num_in_buf;
+	int i, j;
+	struct cam_buf_io_cfg *io_cfg;
+	dma_addr_t io_addr[CAM_PACKET_MAX_PLANES];
+	uintptr_t cpu_addr[CAM_PACKET_MAX_PLANES];
+	size_t size;
+	bool need_io_map, need_cpu_map;
+
+	/* Get IO Buf information */
+	num_out_buf = 0;
+	num_in_buf  = 0;
+	io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+		&prepare->packet->payload_flex + prepare->packet->io_configs_offset);
+
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		CAM_DBG(CAM_FD,
+			"IOConfig[%d] : handle[%d] Dir[%d] Res[%d] Fence[%d], Format[%d]",
+			i, io_cfg[i].mem_handle[0], io_cfg[i].direction,
+			io_cfg[i].resource_type,
+			io_cfg[i].fence, io_cfg[i].format);
+
+		if ((num_in_buf >= io_buf_size) ||
+			(num_out_buf >= io_buf_size)) {
+			CAM_ERR(CAM_FD, "Invalid number of buffers %d %d %d",
+				num_in_buf, num_out_buf, io_buf_size);
+			return -EINVAL;
+		}
+
+		rc = cam_fd_mgr_util_get_buf_map_requirement(
+			io_cfg[i].direction, io_cfg[i].resource_type,
+			&need_io_map, &need_cpu_map);
+		if (rc) {
+			CAM_WARN(CAM_FD, "Invalid io buff [%d] : %d %d %d",
+				i, io_cfg[i].direction,
+				io_cfg[i].resource_type, rc);
+			continue;
+		}
+
+		memset(io_addr, 0x0, sizeof(io_addr));
+		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {
+			if (!io_cfg[i].mem_handle[plane])
+				break;
+
+			io_addr[plane] = 0x0;
+			cpu_addr[plane] = 0x0;
+
+			if (need_io_map) {
+				rc = cam_mem_get_io_buf(
+					io_cfg[i].mem_handle[plane],
+					iommu_hdl, &io_addr[plane], &size);
+				if (rc) {
+					CAM_ERR(CAM_FD,
+						"Failed to get io buf %u %u %u %d",
+						io_cfg[i].direction,
+						io_cfg[i].resource_type, plane,
+						rc);
+					return -ENOMEM;
+				}
+
+				if (io_cfg[i].offsets[plane] >= size) {
+					CAM_ERR(CAM_FD,
+						"Invalid io buf %u %u %u %d %u %zu",
+						io_cfg[i].direction,
+						io_cfg[i].resource_type, plane,
+						i, io_cfg[i].offsets[plane],
+						size);
+					return -EINVAL;
+				}
+
+				io_addr[plane] += io_cfg[i].offsets[plane];
+			}
+
+			if (need_cpu_map) {
+				rc = cam_mem_get_cpu_buf(
+					io_cfg[i].mem_handle[plane],
+					&cpu_addr[plane], &size);
+				if (rc || ((io_addr[plane] & 0xFFFFFFFF)
+					!= io_addr[plane])) {
+					CAM_ERR(CAM_FD,
+						"Invalid cpu buf %d %d %d %d",
+						io_cfg[i].direction,
+						io_cfg[i].resource_type, plane,
+						rc);
+					return rc;
+				}
+				if (io_cfg[i].offsets[plane] >= size) {
+					CAM_ERR(CAM_FD,
+						"Invalid cpu buf %d %d %d",
+						io_cfg[i].direction,
+						io_cfg[i].resource_type, plane);
+					cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane]);
+					rc = -EINVAL;
+					return rc;
+				}
+				cpu_addr[plane] += io_cfg[i].offsets[plane];
+			}
+
+			CAM_DBG(CAM_FD, "IO Address[%d][%d] : %pK, %pK",
+				io_cfg[i].direction, plane, io_addr[plane],
+				cpu_addr[plane]);
+		}
+
+		switch (io_cfg[i].direction) {
+		case CAM_BUF_INPUT: {
+			prepare->in_map_entries[num_in_buf].resource_handle =
+				io_cfg[i].resource_type;
+			prepare->in_map_entries[num_in_buf].sync_id =
+				io_cfg[i].fence;
+
+			input_buf[num_in_buf].valid = true;
+			for (j = 0; j < plane; j++) {
+				input_buf[num_in_buf].io_addr[j] = io_addr[j];
+				input_buf[num_in_buf].cpu_addr[j] = cpu_addr[j];
+			}
+			input_buf[num_in_buf].num_buf = plane;
+			input_buf[num_in_buf].io_cfg = &io_cfg[i];
+
+			num_in_buf++;
+			break;
+		}
+		case CAM_BUF_OUTPUT: {
+			prepare->out_map_entries[num_out_buf].resource_handle =
+				io_cfg[i].resource_type;
+			prepare->out_map_entries[num_out_buf].sync_id =
+				io_cfg[i].fence;
+
+			output_buf[num_out_buf].valid = true;
+			for (j = 0; j < plane; j++) {
+				output_buf[num_out_buf].io_addr[j] = io_addr[j];
+				output_buf[num_out_buf].cpu_addr[j] =
+					cpu_addr[j];
+			}
+			output_buf[num_out_buf].num_buf = plane;
+			output_buf[num_out_buf].io_cfg = &io_cfg[i];
+
+			num_out_buf++;
+			break;
+		}
+		default:
+			CAM_ERR(CAM_FD, "Unsupported io direction %d",
+				io_cfg[i].direction);
+			rc = -EINVAL;
+			break;
+		}
+	}
+
+	prepare->num_in_map_entries  = num_in_buf;
+	prepare->num_out_map_entries = num_out_buf;
+	return rc;
+}
+
+static int cam_fd_mgr_util_prepare_hw_update_entries(
+	struct cam_fd_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_fd_hw_cmd_prestart_args *prestart_args,
+	struct cam_kmd_buf_info *kmd_buf_info)
+{
+	int i, rc;
+	struct cam_hw_update_entry *hw_entry;
+	uint32_t num_ent;
+	struct cam_fd_hw_mgr_ctx *hw_ctx =
+		(struct cam_fd_hw_mgr_ctx *)prepare->ctxt_to_hw_map;
+	struct cam_fd_device *hw_device;
+	uint32_t kmd_buf_max_size, kmd_buf_used_bytes = 0;
+	uint32_t *kmd_buf_addr;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	kmd_buf_addr = (uint32_t *)((uint8_t *)kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes);
+	kmd_buf_max_size = kmd_buf_info->size - kmd_buf_info->used_bytes;
+
+	prestart_args->cmd_buf_addr = kmd_buf_addr;
+	prestart_args->size  = kmd_buf_max_size;
+	prestart_args->pre_config_buf_size = 0;
+	prestart_args->post_config_buf_size = 0;
+
+	if (hw_device->hw_intf->hw_ops.process_cmd) {
+		rc = hw_device->hw_intf->hw_ops.process_cmd(
+			hw_device->hw_intf->hw_priv, CAM_FD_HW_CMD_PRESTART,
+			prestart_args,
+			sizeof(struct cam_fd_hw_cmd_prestart_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in CMD_PRESTART %d", rc);
+			return rc;
+		}
+	}
+
+	kmd_buf_used_bytes += prestart_args->pre_config_buf_size;
+	kmd_buf_used_bytes += prestart_args->post_config_buf_size;
+
+	/* HW layer is expected to add commands */
+	if (!kmd_buf_used_bytes || (kmd_buf_used_bytes > kmd_buf_max_size)) {
+		CAM_ERR(CAM_FD, "Invalid kmd used bytes %d (%d)",
+			kmd_buf_used_bytes, kmd_buf_max_size);
+		return -ENOMEM;
+	}
+
+	hw_entry = prepare->hw_update_entries;
+	num_ent = 0;
+
+	if (prestart_args->pre_config_buf_size) {
+		if ((num_ent + 1) >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_FD, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		hw_entry[num_ent].handle = kmd_buf_info->handle;
+		hw_entry[num_ent].len  = prestart_args->pre_config_buf_size;
+		hw_entry[num_ent].offset = kmd_buf_info->offset;
+
+		kmd_buf_info->used_bytes += prestart_args->pre_config_buf_size;
+		kmd_buf_info->offset += prestart_args->pre_config_buf_size;
+		num_ent++;
+	}
+
+	/*
+	 * set the cmd_desc to point the first command descriptor in the
+	 * packet and update hw entries with CDM command buffers
+	 */
+	cmd_desc = (struct cam_cmd_buf_desc *)((uint8_t *)
+		&prepare->packet->payload_flex + prepare->packet->cmd_buf_offset);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data != CAM_FD_CMD_BUFFER_ID_CDM)
+			continue;
+
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_FD, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		hw_entry[num_ent].handle = cmd_desc[i].mem_handle;
+		hw_entry[num_ent].len = cmd_desc[i].length;
+		hw_entry[num_ent].offset = cmd_desc[i].offset;
+		num_ent++;
+	}
+
+	if (prestart_args->post_config_buf_size) {
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_FD, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		hw_entry[num_ent].handle = kmd_buf_info->handle;
+		hw_entry[num_ent].len    = prestart_args->post_config_buf_size;
+		hw_entry[num_ent].offset = kmd_buf_info->offset;
+
+		kmd_buf_info->used_bytes += prestart_args->post_config_buf_size;
+		kmd_buf_info->offset     += prestart_args->post_config_buf_size;
+
+		num_ent++;
+	}
+
+	prepare->num_hw_update_entries = num_ent;
+
+	CAM_DBG(CAM_FD, "FinalConfig : hw_entries=%d, Sync(in=%d, out=%d)",
+		prepare->num_hw_update_entries, prepare->num_in_map_entries,
+		prepare->num_out_map_entries);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_submit_frame(void *priv, void *data)
+{
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_mgr *hw_mgr;
+	struct cam_fd_mgr_frame_request *frame_req;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_hw_cmd_start_args start_args;
+	int rc;
+
+	if (!priv) {
+		CAM_ERR(CAM_FD, "Invalid data");
+		return -EINVAL;
+	}
+
+	hw_mgr = (struct cam_fd_hw_mgr *)priv;
+	mutex_lock(&hw_mgr->frame_req_mutex);
+
+	/* Check if we have any frames pending in high priority list */
+	if (!list_empty(&hw_mgr->frame_pending_list_high)) {
+		CAM_DBG(CAM_FD, "Pending frames in high priority list");
+		frame_req = list_first_entry(&hw_mgr->frame_pending_list_high,
+			struct cam_fd_mgr_frame_request, list);
+	} else if (!list_empty(&hw_mgr->frame_pending_list_normal)) {
+		CAM_DBG(CAM_FD, "Pending frames in normal priority list");
+		frame_req = list_first_entry(&hw_mgr->frame_pending_list_normal,
+			struct cam_fd_mgr_frame_request, list);
+	} else {
+		mutex_unlock(&hw_mgr->frame_req_mutex);
+		CAM_DBG(CAM_FD, "No pending frames");
+		return 0;
+	}
+
+	CAM_DBG(CAM_FD, "FrameSubmit : Frame[%lld]", frame_req->request_id);
+	hw_ctx = frame_req->hw_ctx;
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		mutex_unlock(&hw_mgr->frame_req_mutex);
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&hw_device->lock);
+	if (hw_device->ready_to_process == false) {
+		if (hw_mgr->num_pending_frames > 6) {
+			CAM_WARN(CAM_FD,
+				"Device busy for longer time with cur_hw_ctx=%pK, ReqId=%lld",
+				hw_device->cur_hw_ctx, hw_device->req_id);
+		}
+		mutex_unlock(&hw_device->lock);
+		mutex_unlock(&hw_mgr->frame_req_mutex);
+		return -EBUSY;
+	}
+
+	trace_cam_submit_to_hw("FD", frame_req->request_id);
+
+	list_del_init(&frame_req->list);
+	hw_mgr->num_pending_frames--;
+	list_add_tail(&frame_req->list, &hw_mgr->frame_processing_list);
+
+	if (hw_device->hw_intf->hw_ops.start) {
+		start_args.hw_ctx = hw_ctx;
+		start_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+		start_args.hw_req_private = &frame_req->hw_req_private;
+		start_args.hw_update_entries = frame_req->hw_update_entries;
+		start_args.num_hw_update_entries =
+			frame_req->num_hw_update_entries;
+
+		rc = hw_device->hw_intf->hw_ops.start(
+			hw_device->hw_intf->hw_priv, &start_args,
+			sizeof(start_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW Start %d", rc);
+			list_del_init(&frame_req->list);
+			mutex_unlock(&hw_device->lock);
+			mutex_unlock(&hw_mgr->frame_req_mutex);
+			goto put_req_into_free_list;
+		}
+	} else {
+		CAM_ERR(CAM_FD, "Invalid hw_ops.start");
+		list_del_init(&frame_req->list);
+		mutex_unlock(&hw_device->lock);
+		mutex_unlock(&hw_mgr->frame_req_mutex);
+		rc = -EPERM;
+		goto put_req_into_free_list;
+	}
+
+	hw_device->ready_to_process = false;
+	hw_device->cur_hw_ctx = hw_ctx;
+	hw_device->req_id = frame_req->request_id;
+	mutex_unlock(&hw_device->lock);
+	mutex_unlock(&hw_mgr->frame_req_mutex);
+
+	return rc;
+put_req_into_free_list:
+	cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list, &frame_req);
+
+	return rc;
+}
+
+static int cam_fd_mgr_util_schedule_frame_worker_task(
+	struct cam_fd_hw_mgr *hw_mgr)
+{
+	int32_t rc = 0;
+	struct crm_workq_task *task;
+	struct cam_fd_mgr_work_data *work_data;
+
+	task = cam_req_mgr_workq_get_task(hw_mgr->work);
+	if (!task) {
+		CAM_ERR(CAM_FD, "no empty task available");
+		return -ENOMEM;
+	}
+
+	work_data = (struct cam_fd_mgr_work_data *)task->payload;
+	work_data->type = CAM_FD_WORK_FRAME;
+
+	task->process_cb = cam_fd_mgr_util_submit_frame;
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr, CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int32_t cam_fd_mgr_workq_irq_cb(void *priv, void *data)
+{
+	struct cam_fd_device *hw_device = NULL;
+	struct cam_fd_hw_mgr *hw_mgr;
+	struct cam_fd_mgr_work_data *work_data;
+	struct cam_fd_mgr_frame_request *frame_req = NULL;
+	enum cam_fd_hw_irq_type irq_type;
+	uint32_t evt_id = CAM_CTX_EVT_ID_ERROR;
+	int rc;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_FD, "Invalid data %pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	hw_mgr = (struct cam_fd_hw_mgr *)priv;
+	work_data = (struct cam_fd_mgr_work_data *)data;
+	irq_type = work_data->irq_type;
+
+	CAM_DBG(CAM_FD, "FD IRQ type=%d", irq_type);
+
+	if (irq_type == CAM_FD_IRQ_HALT_DONE) {
+		/* HALT would be followed by a RESET, ignore this */
+		CAM_DBG(CAM_FD, "HALT IRQ callback");
+		return 0;
+	}
+
+	/* Get the frame from processing list */
+	rc = cam_fd_mgr_util_get_frame_req(&hw_mgr->frame_processing_list,
+		&frame_req);
+	if (rc || !frame_req) {
+		/*
+		 * This can happen if reset is triggered while no frames
+		 * were pending, so not an error, just continue to check if
+		 * there are any pending frames and submit
+		 */
+		CAM_DBG(CAM_FD, "No Frame in processing list, rc=%d", rc);
+		goto submit_next_frame;
+	}
+
+	if (!frame_req->hw_ctx) {
+		CAM_ERR(CAM_FD, "Invalid Frame request %lld",
+			frame_req->request_id);
+		goto put_req_in_free_list;
+	}
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, frame_req->hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		goto put_req_in_free_list;
+	}
+
+	/* Read frame results first */
+	if (irq_type == CAM_FD_IRQ_FRAME_DONE) {
+		struct cam_fd_hw_frame_done_args frame_done_args;
+
+		CAM_DBG(CAM_FD, "FrameDone : Frame[%lld]",
+			frame_req->request_id);
+
+		frame_done_args.hw_ctx = frame_req->hw_ctx;
+		frame_done_args.ctx_hw_private =
+			frame_req->hw_ctx->ctx_hw_private;
+		frame_done_args.request_id = frame_req->request_id;
+		frame_done_args.hw_req_private = &frame_req->hw_req_private;
+
+		if (hw_device->hw_intf->hw_ops.process_cmd) {
+			rc = hw_device->hw_intf->hw_ops.process_cmd(
+				hw_device->hw_intf->hw_priv,
+				CAM_FD_HW_CMD_FRAME_DONE,
+				&frame_done_args, sizeof(frame_done_args));
+			if (rc) {
+				CAM_ERR(CAM_FD, "Failed in CMD_PRESTART %d",
+					rc);
+				goto notify_context;
+			}
+		}
+
+		evt_id = CAM_CTX_EVT_ID_SUCCESS;
+	}
+
+	trace_cam_irq_handled("FD", irq_type);
+
+notify_context:
+	/* Do a callback to inform frame done or stop done */
+	if (frame_req->hw_ctx->event_cb) {
+		struct cam_hw_done_event_data buf_data;
+
+		CAM_DBG(CAM_FD, "FrameHALT : Frame[%lld]",
+			frame_req->request_id);
+
+		buf_data.num_handles = frame_req->num_hw_update_entries;
+		buf_data.request_id = frame_req->request_id;
+		buf_data.evt_param = (irq_type == CAM_FD_IRQ_FRAME_DONE) ?
+			CAM_SYNC_FD_EVENT_IRQ_FRAME_DONE :
+			CAM_SYNC_FD_EVENT_IRQ_RESET_DONE;
+
+		rc = frame_req->hw_ctx->event_cb(frame_req->hw_ctx->cb_priv,
+			evt_id, &buf_data);
+		if (rc)
+			CAM_ERR(CAM_FD, "Error in event cb handling %d", rc);
+	}
+
+	/*
+	 * Now we can set hw device is free to process further frames.
+	 * Note - Do not change state to IDLE until we read the frame results,
+	 * Otherwise, other thread may schedule frame processing before
+	 * reading current frame's results. Also, we need to set to IDLE state
+	 * in case some error happens after getting this irq callback
+	 */
+	mutex_lock(&hw_device->lock);
+	hw_device->ready_to_process = true;
+	hw_device->req_id = -1;
+	hw_device->cur_hw_ctx = NULL;
+	CAM_DBG(CAM_FD, "ready_to_process=%d", hw_device->ready_to_process);
+	mutex_unlock(&hw_device->lock);
+
+put_req_in_free_list:
+	rc = cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+		&frame_req);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in putting frame req in free list");
+		/* continue */
+	}
+
+submit_next_frame:
+	/* Check if there are any frames pending for processing and submit */
+	rc = cam_fd_mgr_util_submit_frame(hw_mgr, NULL);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error while submit frame, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_irq_cb(void *data, enum cam_fd_hw_irq_type irq_type)
+{
+	struct cam_fd_hw_mgr *hw_mgr = &g_fd_hw_mgr;
+	int rc = 0;
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct cam_fd_mgr_work_data *work_data;
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_slock, flags);
+	task = cam_req_mgr_workq_get_task(hw_mgr->work);
+	if (!task) {
+		CAM_ERR(CAM_FD, "no empty task available");
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_slock, flags);
+		return -ENOMEM;
+	}
+
+	work_data = (struct cam_fd_mgr_work_data *)task->payload;
+	work_data->type = CAM_FD_WORK_IRQ;
+	work_data->irq_type = irq_type;
+
+	task->process_cb = cam_fd_mgr_workq_irq_cb;
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr, CRM_TASK_PRIORITY_0);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed in enqueue work task, rc=%d", rc);
+
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_slock, flags);
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_get_caps(void *hw_mgr_priv, void *hw_get_caps_args)
+{
+	int rc = 0;
+	struct cam_fd_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd *query = hw_get_caps_args;
+	struct cam_fd_query_cap_cmd query_fd;
+	void __user *caps_handle =
+		u64_to_user_ptr(query->caps_handle);
+
+	if (copy_from_user(&query_fd, caps_handle,
+		sizeof(struct cam_fd_query_cap_cmd))) {
+		CAM_ERR(CAM_FD, "Failed in copy from user, rc=%d", rc);
+		return -EFAULT;
+	}
+
+	query_fd  = hw_mgr->fd_caps;
+
+	CAM_DBG(CAM_FD,
+		"IOMMU device(%d, %d), CDM(%d, %d), versions %d.%d, %d.%d",
+		query_fd.device_iommu.secure, query_fd.device_iommu.non_secure,
+		query_fd.cdm_iommu.secure, query_fd.cdm_iommu.non_secure,
+		query_fd.hw_caps.core_version.major,
+		query_fd.hw_caps.core_version.minor,
+		query_fd.hw_caps.wrapper_version.major,
+		query_fd.hw_caps.wrapper_version.minor);
+
+	if (copy_to_user(caps_handle, &query_fd,
+		sizeof(struct cam_fd_query_cap_cmd)))
+		rc = -EFAULT;
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_acquire(void *hw_mgr_priv, void *hw_acquire_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args =
+		(struct cam_hw_acquire_args *)hw_acquire_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_acquire_dev_info fd_acquire_args;
+	int rc;
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_FD, "Invalid acquire args %pK", acquire_args);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&fd_acquire_args,
+		(void __user *)acquire_args->acquire_info,
+		sizeof(struct cam_fd_acquire_dev_info))) {
+		CAM_ERR(CAM_FD, "Copy from user failed");
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_FD, "Acquire : mode=%d, get_raw_results=%d, priority=%d",
+		fd_acquire_args.mode, fd_acquire_args.get_raw_results,
+		fd_acquire_args.priority);
+
+	/* get a free fd hw mgr ctx */
+	rc = cam_fd_mgr_util_get_ctx(&hw_mgr->free_ctx_list, &hw_ctx);
+	if (rc || !hw_ctx) {
+		CAM_ERR(CAM_FD, "Get hw context failed, rc=%d, hw_ctx=%pK",
+			rc, hw_ctx);
+		return -EINVAL;
+	}
+
+	if (fd_acquire_args.get_raw_results && !hw_mgr->raw_results_available) {
+		CAM_ERR(CAM_FD, "HW cannot support raw results %d (%d)",
+			fd_acquire_args.get_raw_results,
+			hw_mgr->raw_results_available);
+		goto put_ctx;
+	}
+
+	if (!(fd_acquire_args.mode & hw_mgr->supported_modes)) {
+		CAM_ERR(CAM_FD, "HW cannot support requested mode 0x%x (0x%x)",
+			fd_acquire_args.mode, hw_mgr->supported_modes);
+		rc = -EPERM;
+		goto put_ctx;
+	}
+
+	rc = cam_fd_mgr_util_select_device(hw_mgr, hw_ctx, &fd_acquire_args);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in selecting device, rc=%d", rc);
+		goto put_ctx;
+	}
+
+	hw_ctx->ctx_in_use = true;
+	hw_ctx->hw_mgr = hw_mgr;
+	hw_ctx->get_raw_results = fd_acquire_args.get_raw_results;
+	hw_ctx->mode = fd_acquire_args.mode;
+
+	/* Save incoming cam core info into hw ctx*/
+	hw_ctx->cb_priv = acquire_args->context_data;
+	hw_ctx->event_cb = acquire_args->event_cb;
+
+	/* Update out args */
+	acquire_args->ctxt_to_hw_map = hw_ctx;
+
+	cam_fd_mgr_util_put_ctx(&hw_mgr->used_ctx_list, &hw_ctx);
+
+	return 0;
+put_ctx:
+	list_del_init(&hw_ctx->list);
+	cam_fd_mgr_util_put_ctx(&hw_mgr->free_ctx_list, &hw_ctx);
+	return rc;
+}
+
+static int cam_fd_mgr_hw_release(void *hw_mgr_priv, void *hw_release_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_release_args *release_args = hw_release_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	int rc;
+
+	if (!hw_mgr_priv || !hw_release_args) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK, %pK",
+			hw_mgr_priv, hw_release_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)release_args->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+
+	rc = cam_fd_mgr_util_release_device(hw_mgr, hw_ctx);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed in release device, rc=%d", rc);
+
+	hw_ctx->ctx_in_use = false;
+	list_del_init(&hw_ctx->list);
+	cam_fd_mgr_util_put_ctx(&hw_mgr->free_ctx_list, &hw_ctx);
+
+	return 0;
+}
+
+static int cam_fd_mgr_hw_start(void *hw_mgr_priv, void *mgr_start_args)
+{
+	int rc = 0;
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_start_args *hw_mgr_start_args =
+		(struct cam_hw_start_args *)mgr_start_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_init_args hw_init_args;
+	struct cam_hw_info *fd_hw;
+	struct cam_fd_core *fd_core;
+
+	if (!hw_mgr_priv || !hw_mgr_start_args) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK",
+			hw_mgr_priv, hw_mgr_start_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)hw_mgr_start_args->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_FD, "ctx index=%u, device_index=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	fd_hw = (struct cam_hw_info *)hw_device->hw_intf->hw_priv;
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+
+	if (hw_device->hw_intf->hw_ops.init) {
+		hw_init_args.hw_ctx = hw_ctx;
+		hw_init_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+		hw_init_args.is_hw_reset = false;
+		if (fd_core->hw_static_info->enable_errata_wa.skip_reset)
+			hw_init_args.reset_required = false;
+		else
+			hw_init_args.reset_required = true;
+
+		rc = hw_device->hw_intf->hw_ops.init(
+			hw_device->hw_intf->hw_priv, &hw_init_args,
+			sizeof(hw_init_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW Init %d", rc);
+			return rc;
+		}
+
+		if (hw_init_args.is_hw_reset) {
+			mutex_lock(&hw_device->lock);
+			hw_device->ready_to_process = true;
+			hw_device->req_id = -1;
+			hw_device->cur_hw_ctx = NULL;
+			mutex_unlock(&hw_device->lock);
+		}
+	} else {
+		CAM_ERR(CAM_FD, "Invalid init function");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_flush_req(void *hw_mgr_priv,
+	struct cam_hw_flush_args *flush_args)
+{
+	int rc = 0;
+	struct cam_fd_mgr_frame_request *frame_req, *req_temp, *flush_req;
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_stop_args hw_stop_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	uint32_t i = 0;
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)flush_args->ctxt_to_hw_map;
+
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+	CAM_DBG(CAM_FD, "ctx index=%u, hw_ctx=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&hw_mgr->frame_req_mutex);
+	for (i = 0; i < flush_args->num_req_active; i++) {
+		flush_req = (struct cam_fd_mgr_frame_request *)
+			flush_args->flush_req_active[i];
+
+		list_for_each_entry_safe(frame_req, req_temp,
+			&hw_mgr->frame_pending_list_high, list) {
+			if (frame_req->hw_ctx != hw_ctx)
+				continue;
+
+			if (frame_req->request_id != flush_req->request_id)
+				continue;
+
+			hw_mgr->num_pending_frames--;
+			list_del_init(&frame_req->list);
+			break;
+		}
+
+		list_for_each_entry_safe(frame_req, req_temp,
+			&hw_mgr->frame_pending_list_normal, list) {
+			if (frame_req->hw_ctx != hw_ctx)
+				continue;
+
+			if (frame_req->request_id != flush_req->request_id)
+				continue;
+
+			hw_mgr->num_pending_frames--;
+			list_del_init(&frame_req->list);
+			break;
+		}
+
+		list_for_each_entry_safe(frame_req, req_temp,
+			&hw_mgr->frame_processing_list, list) {
+			if (frame_req->hw_ctx != hw_ctx)
+				continue;
+
+			if (frame_req->request_id != flush_req->request_id)
+				continue;
+
+			list_del_init(&frame_req->list);
+
+			mutex_lock(&hw_device->lock);
+			if ((hw_device->ready_to_process == true) ||
+				(hw_device->cur_hw_ctx != hw_ctx))
+				goto unlock_dev_flush_req;
+
+			if (hw_device->hw_intf->hw_ops.stop) {
+				hw_stop_args.hw_ctx = hw_ctx;
+				rc = hw_device->hw_intf->hw_ops.stop(
+					hw_device->hw_intf->hw_priv,
+					&hw_stop_args,
+					sizeof(hw_stop_args));
+				if (rc) {
+					CAM_ERR(CAM_FD,
+						"Failed in HW Stop %d", rc);
+					goto unlock_dev_flush_req;
+				}
+				hw_device->ready_to_process = true;
+			}
+
+unlock_dev_flush_req:
+			mutex_unlock(&hw_device->lock);
+			break;
+		}
+	}
+	mutex_unlock(&hw_mgr->frame_req_mutex);
+
+	for (i = 0; i < flush_args->num_req_pending; i++) {
+		flush_req = (struct cam_fd_mgr_frame_request *)
+			flush_args->flush_req_pending[i];
+		cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+			&flush_req);
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_flush_ctx(void *hw_mgr_priv,
+	struct cam_hw_flush_args *flush_args)
+{
+	int rc = 0;
+	struct cam_fd_mgr_frame_request *frame_req, *req_temp, *flush_req;
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_stop_args hw_stop_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	uint32_t i = 0;
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)flush_args->ctxt_to_hw_map;
+
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+	CAM_DBG(CAM_FD, "ctx index=%u, hw_ctx=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&hw_mgr->frame_req_mutex);
+	list_for_each_entry_safe(frame_req, req_temp,
+		&hw_mgr->frame_pending_list_high, list) {
+		if (frame_req->hw_ctx != hw_ctx)
+			continue;
+
+		hw_mgr->num_pending_frames--;
+		list_del_init(&frame_req->list);
+	}
+
+	list_for_each_entry_safe(frame_req, req_temp,
+		&hw_mgr->frame_pending_list_normal, list) {
+		if (frame_req->hw_ctx != hw_ctx)
+			continue;
+
+		hw_mgr->num_pending_frames--;
+		list_del_init(&frame_req->list);
+	}
+
+	list_for_each_entry_safe(frame_req, req_temp,
+		&hw_mgr->frame_processing_list, list) {
+		if (frame_req->hw_ctx != hw_ctx)
+			continue;
+
+		list_del_init(&frame_req->list);
+		mutex_lock(&hw_device->lock);
+		if ((hw_device->ready_to_process == true) ||
+			(hw_device->cur_hw_ctx != hw_ctx))
+			goto unlock_dev_flush_ctx;
+
+		if (hw_device->hw_intf->hw_ops.stop) {
+			hw_stop_args.hw_ctx = hw_ctx;
+			rc = hw_device->hw_intf->hw_ops.stop(
+				hw_device->hw_intf->hw_priv, &hw_stop_args,
+				sizeof(hw_stop_args));
+			if (rc) {
+				CAM_ERR(CAM_FD, "Failed in HW Stop %d", rc);
+				goto unlock_dev_flush_ctx;
+			}
+			hw_device->ready_to_process = true;
+		}
+
+unlock_dev_flush_ctx:
+	mutex_unlock(&hw_device->lock);
+	}
+	mutex_unlock(&hw_mgr->frame_req_mutex);
+
+	for (i = 0; i < flush_args->num_req_pending; i++) {
+		flush_req = (struct cam_fd_mgr_frame_request *)
+			flush_args->flush_req_pending[i];
+		CAM_DBG(CAM_FD, "flush pending req %llu",
+			flush_req->request_id);
+		cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+			&flush_req);
+	}
+
+	for (i = 0; i < flush_args->num_req_active; i++) {
+		flush_req = (struct cam_fd_mgr_frame_request *)
+			flush_args->flush_req_active[i];
+		CAM_DBG(CAM_FD, "flush active req %llu", flush_req->request_id);
+		cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+			&flush_req);
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_flush(void *hw_mgr_priv,
+	void *hw_flush_args)
+{
+	int rc = 0;
+	struct cam_hw_flush_args *flush_args =
+		(struct cam_hw_flush_args *)hw_flush_args;
+
+	if (!hw_mgr_priv || !hw_flush_args) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK",
+			hw_mgr_priv, hw_flush_args);
+		return -EINVAL;
+	}
+
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_REQ:
+		rc = cam_fd_mgr_hw_flush_req(hw_mgr_priv, flush_args);
+		break;
+	case CAM_FLUSH_TYPE_ALL:
+		rc = cam_fd_mgr_hw_flush_ctx(hw_mgr_priv, flush_args);
+		break;
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_FD, "Invalid flush type %d",
+			flush_args->flush_type);
+		break;
+	}
+	return rc;
+}
+
+static int cam_fd_mgr_hw_dump(
+	void *hw_mgr_priv,
+	void *hw_dump_args)
+{
+	int                              rc;
+	uint8_t                         *dst;
+	ktime_t                          cur_time;
+	size_t                           remain_len;
+	uint32_t                         min_len;
+	uint64_t                         diff;
+	uint64_t                        *addr, *start;
+	struct timespec64                cur_ts;
+	struct timespec64                req_ts;
+	struct cam_fd_hw_mgr            *hw_mgr;
+	struct cam_hw_dump_args         *dump_args;
+	struct cam_fd_hw_mgr_ctx        *hw_ctx;
+	struct cam_fd_device            *hw_device;
+	struct cam_fd_hw_dump_args       fd_dump_args;
+	struct cam_fd_hw_dump_header    *hdr;
+	struct cam_fd_mgr_frame_request *frame_req, *req_temp;
+
+	hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	dump_args = (struct cam_hw_dump_args *)hw_dump_args;
+	if (!hw_mgr || !dump_args) {
+		CAM_ERR(CAM_FD, "Invalid args %pK %pK",
+			hw_mgr, dump_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)dump_args->ctxt_to_hw_map;
+
+	if (!hw_ctx) {
+		CAM_ERR(CAM_FD, "Invalid ctx");
+		return -EINVAL;
+	}
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	list_for_each_entry_safe(frame_req, req_temp,
+		&hw_mgr->frame_processing_list, list) {
+		if (frame_req->request_id == dump_args->request_id)
+			goto hw_dump;
+	}
+
+	CAM_DBG(CAM_FD, "fd dump cannot find req %llu",
+		dump_args->request_id);
+	return rc;
+hw_dump:
+	cur_time = ktime_get();
+	diff = ktime_us_delta(frame_req->submit_timestamp, cur_time);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(frame_req->submit_timestamp);
+	if (diff < CAM_FD_RESPONSE_TIME_THRESHOLD) {
+		CAM_INFO(CAM_FD, "No Error req %lld %ld:%06ld %ld:%06ld",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		return 0;
+	}
+	CAM_INFO(CAM_FD, "Error req %lld %ld:%06ld %ld:%06ld",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&fd_dump_args.cpu_addr, &fd_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+	if (fd_dump_args.buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_FD, "dump offset overshoot len %zu offset %zu",
+			fd_dump_args.buf_len, dump_args->offset);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+	remain_len = fd_dump_args.buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_fd_hw_dump_header) +
+		(CAM_FD_HW_DUMP_NUM_WORDS * sizeof(uint64_t));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_FD, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)fd_dump_args.cpu_addr + dump_args->offset;
+	hdr = (struct cam_fd_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_FD_HW_DUMP_TAG_MAX_LEN,
+		"FD_REQ:");
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_fd_hw_dump_header));
+	start = addr;
+	*addr++ = frame_req->request_id;
+	*addr++ = req_ts.tv_sec;
+	*addr++ = req_ts.tv_nsec/NSEC_PER_USEC;
+	*addr++ = cur_ts.tv_sec;
+	*addr++ = cur_ts.tv_nsec/NSEC_PER_USEC;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_fd_hw_dump_header);
+
+	fd_dump_args.request_id = dump_args->request_id;
+	fd_dump_args.offset = dump_args->offset;
+	if (hw_device->hw_intf->hw_ops.process_cmd) {
+		rc = hw_device->hw_intf->hw_ops.process_cmd(
+			hw_device->hw_intf->hw_priv,
+			CAM_FD_HW_CMD_HW_DUMP,
+			&fd_dump_args,
+			sizeof(struct
+			cam_fd_hw_dump_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Hw Dump cmd fails req %lld rc %d",
+				frame_req->request_id, rc);
+			cam_mem_put_cpu_buf(dump_args->buf_handle);
+			return rc;
+		}
+	}
+	CAM_DBG(CAM_FD, "Offset before %zu after %zu",
+		dump_args->offset, fd_dump_args.offset);
+	dump_args->offset = fd_dump_args.offset;
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_fd_mgr_hw_stop(void *hw_mgr_priv, void *mgr_stop_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_stop_args *hw_mgr_stop_args =
+		(struct cam_hw_stop_args *)mgr_stop_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_hw_deinit_args hw_deinit_args;
+	int rc = 0;
+
+	if (!hw_mgr_priv || !hw_mgr_stop_args) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK",
+			hw_mgr_priv, hw_mgr_stop_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)hw_mgr_stop_args->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+	CAM_DBG(CAM_FD, "ctx index=%u, hw_ctx=%d", hw_ctx->ctx_index,
+		hw_ctx->device_index);
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_FD, "FD Device ready_to_process = %d",
+		hw_device->ready_to_process);
+
+	if (hw_device->hw_intf->hw_ops.deinit) {
+		hw_deinit_args.hw_ctx = hw_ctx;
+		hw_deinit_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+		rc = hw_device->hw_intf->hw_ops.deinit(
+			hw_device->hw_intf->hw_priv, &hw_deinit_args,
+			sizeof(hw_deinit_args));
+		if (rc) {
+			CAM_ERR(CAM_FD, "Failed in HW DeInit %d", rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_fd_mgr_hw_prepare_update(void *hw_mgr_priv,
+	void *hw_prepare_update_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_prepare_update_args *prepare =
+		(struct cam_hw_prepare_update_args *) hw_prepare_update_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_device *hw_device;
+	struct cam_kmd_buf_info kmd_buf;
+	int rc;
+	struct cam_fd_hw_cmd_prestart_args prestart_args;
+	struct cam_fd_mgr_frame_request *frame_req;
+
+	if (!hw_mgr_priv || !hw_prepare_update_args) {
+		CAM_ERR(CAM_FD, "Invalid args %pK %pK",
+			hw_mgr_priv, hw_prepare_update_args);
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)prepare->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+
+	rc = cam_fd_mgr_util_get_device(hw_mgr, hw_ctx, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in getting device %d", rc);
+		goto error;
+	}
+
+	rc = cam_fd_mgr_util_packet_validate(prepare->packet,
+		prepare->remain_len);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in packet validation %d", rc);
+		goto error;
+	}
+
+	rc = cam_packet_util_get_kmd_buffer(prepare->packet, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in get kmd buf buffer %d", rc);
+		goto error;
+	}
+
+	CAM_DBG(CAM_FD,
+		"KMD Buf : hdl=%d, cpu_addr=%pK, offset=%d, size=%d, used=%d",
+		kmd_buf.handle, kmd_buf.cpu_addr, kmd_buf.offset,
+		kmd_buf.size, kmd_buf.used_bytes);
+
+	/* We do not expect any patching, but just do it anyway */
+	rc = cam_packet_util_process_patches(prepare->packet,
+		hw_mgr->device_iommu.non_secure, -1);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Patch FD packet failed, rc=%d", rc);
+		return rc;
+	}
+
+	memset(&prestart_args, 0x0, sizeof(prestart_args));
+	prestart_args.ctx_hw_private = hw_ctx->ctx_hw_private;
+	prestart_args.hw_ctx = hw_ctx;
+	prestart_args.request_id = prepare->packet->header.request_id;
+
+	rc = cam_fd_mgr_util_parse_generic_cmd_buffer(hw_ctx, prepare->packet,
+		&prestart_args);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in parsing gerneric cmd buffer %d", rc);
+		goto error;
+	}
+
+	rc = cam_fd_mgr_util_prepare_io_buf_info(
+		hw_mgr->device_iommu.non_secure, prepare,
+		prestart_args.input_buf, prestart_args.output_buf,
+		CAM_FD_MAX_IO_BUFFERS);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in prepare IO Buf %d", rc);
+		goto error;
+	}
+
+	rc = cam_fd_mgr_util_prepare_hw_update_entries(hw_mgr, prepare,
+		&prestart_args, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in hw update entries %d", rc);
+		goto put_cpu_buf;
+	}
+
+	/* get a free frame req from free list */
+	rc = cam_fd_mgr_util_get_frame_req(&hw_mgr->frame_free_list,
+		&frame_req);
+	if (rc || !frame_req) {
+		CAM_ERR(CAM_FD, "Get frame_req failed, rc=%d, hw_ctx=%pK",
+			rc, hw_ctx);
+		rc = -ENOMEM;
+		goto put_cpu_buf;
+	}
+
+	/* Setup frame request info and queue to pending list */
+	frame_req->hw_ctx = hw_ctx;
+	frame_req->request_id = prepare->packet->header.request_id;
+	/* This has to be passed to HW while calling hw_ops->start */
+	frame_req->hw_req_private = prestart_args.hw_req_private;
+
+	/*
+	 * Save the current frame_req into priv,
+	 * this will come as priv while hw_config
+	 */
+	prepare->priv = frame_req;
+
+	cam_fd_mgr_put_cpu_buf(prepare);
+	CAM_DBG(CAM_FD, "FramePrepare : Frame[%lld]", frame_req->request_id);
+
+	return 0;
+
+put_cpu_buf:
+	cam_fd_mgr_put_cpu_buf(prepare);
+error:
+	return rc;
+}
+
+static int cam_fd_mgr_hw_config(void *hw_mgr_priv, void *hw_config_args)
+{
+	struct cam_fd_hw_mgr *hw_mgr = (struct cam_fd_hw_mgr *)hw_mgr_priv;
+	struct cam_hw_config_args *config =
+		(struct cam_hw_config_args *) hw_config_args;
+	struct cam_fd_hw_mgr_ctx *hw_ctx;
+	struct cam_fd_mgr_frame_request *frame_req;
+	int rc;
+	int i;
+	uint64_t req_id;
+
+	if (!hw_mgr || !config) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK", hw_mgr, config);
+		return -EINVAL;
+	}
+
+	if (!config->num_hw_update_entries) {
+		CAM_ERR(CAM_FD, "No hw update enteries are available");
+		return -EINVAL;
+	}
+
+	hw_ctx = (struct cam_fd_hw_mgr_ctx *)config->ctxt_to_hw_map;
+	if (!hw_ctx || !hw_ctx->ctx_in_use) {
+		CAM_ERR(CAM_FD, "Invalid context is used, hw_ctx=%pK", hw_ctx);
+		return -EPERM;
+	}
+
+	frame_req = config->priv;
+	req_id = frame_req->request_id;
+
+	trace_cam_apply_req("FD", frame_req->request_id);
+	CAM_DBG(CAM_FD, "FrameHWConfig : Frame[%lld]", frame_req->request_id);
+
+	frame_req->num_hw_update_entries = config->num_hw_update_entries;
+	for (i = 0; i < config->num_hw_update_entries; i++) {
+		frame_req->hw_update_entries[i] = config->hw_update_entries[i];
+		CAM_DBG(CAM_FD, "PreStart HWEntry[%d] : %d %d %d %d %pK",
+			frame_req->hw_update_entries[i].handle,
+			frame_req->hw_update_entries[i].offset,
+			frame_req->hw_update_entries[i].len,
+			frame_req->hw_update_entries[i].flags,
+			frame_req->hw_update_entries[i].addr);
+	}
+
+	if (hw_ctx->priority == CAM_FD_PRIORITY_HIGH) {
+		CAM_DBG(CAM_FD, "Insert frame into prio0 queue");
+		rc = cam_fd_mgr_util_put_frame_req(
+			&hw_mgr->frame_pending_list_high, &frame_req);
+	} else {
+		CAM_DBG(CAM_FD, "Insert frame into prio1 queue");
+		rc = cam_fd_mgr_util_put_frame_req(
+			&hw_mgr->frame_pending_list_normal, &frame_req);
+	}
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in queuing frame req, rc=%d", rc);
+		goto put_free_list;
+	}
+
+	mutex_lock(&g_fd_hw_mgr.frame_req_mutex);
+	hw_mgr->num_pending_frames++;
+	CAM_DBG(CAM_FD,
+		"Adding ctx[%pK] Req[%llu] : Total number of pending frames %d",
+		hw_ctx, req_id, hw_mgr->num_pending_frames);
+	mutex_unlock(&g_fd_hw_mgr.frame_req_mutex);
+
+	rc = cam_fd_mgr_util_schedule_frame_worker_task(hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Worker task scheduling failed %d", rc);
+		goto remove_and_put_free_list;
+	}
+
+	return 0;
+
+remove_and_put_free_list:
+
+	if (hw_ctx->priority == CAM_FD_PRIORITY_HIGH) {
+		CAM_DBG(CAM_FD, "Removing frame into prio0 queue");
+		cam_fd_mgr_util_get_frame_req(
+			&hw_mgr->frame_pending_list_high, &frame_req);
+	} else {
+		CAM_DBG(CAM_FD, "Removing frame into prio1 queue");
+		cam_fd_mgr_util_get_frame_req(
+			&hw_mgr->frame_pending_list_normal, &frame_req);
+	}
+
+	mutex_lock(&g_fd_hw_mgr.frame_req_mutex);
+	hw_mgr->num_pending_frames--;
+	mutex_unlock(&g_fd_hw_mgr.frame_req_mutex);
+put_free_list:
+	cam_fd_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+		&frame_req);
+
+	return rc;
+}
+
+int cam_fd_hw_mgr_deinit(struct device_node *of_node)
+{
+	CAM_DBG(CAM_FD, "HW Mgr Deinit");
+
+	cam_req_mgr_workq_destroy(&g_fd_hw_mgr.work);
+
+	cam_smmu_destroy_handle(g_fd_hw_mgr.device_iommu.non_secure);
+	g_fd_hw_mgr.device_iommu.non_secure = -1;
+
+	mutex_destroy(&g_fd_hw_mgr.ctx_mutex);
+	mutex_destroy(&g_fd_hw_mgr.frame_req_mutex);
+	mutex_destroy(&g_fd_hw_mgr.hw_mgr_mutex);
+
+	return 0;
+}
+
+static void cam_req_mgr_process_workq_cam_fd_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+int cam_fd_hw_mgr_init(struct device_node *of_node,
+	struct cam_hw_mgr_intf *hw_mgr_intf)
+{
+	int count, i, rc = 0;
+	struct cam_hw_intf *hw_intf = NULL;
+	struct cam_fd_hw_mgr_ctx *hw_mgr_ctx;
+	struct cam_fd_device *hw_device;
+	struct cam_fd_mgr_frame_request *frame_req;
+
+	if (!of_node || !hw_mgr_intf) {
+		CAM_ERR(CAM_FD, "Invalid args of_node %pK hw_mgr_intf %pK",
+			of_node, hw_mgr_intf);
+		return -EINVAL;
+	}
+
+	memset(&g_fd_hw_mgr, 0x0, sizeof(g_fd_hw_mgr));
+	memset(hw_mgr_intf, 0x0, sizeof(*hw_mgr_intf));
+
+	mutex_init(&g_fd_hw_mgr.ctx_mutex);
+	mutex_init(&g_fd_hw_mgr.frame_req_mutex);
+	mutex_init(&g_fd_hw_mgr.hw_mgr_mutex);
+	spin_lock_init(&g_fd_hw_mgr.hw_mgr_slock);
+
+	count = of_property_count_strings(of_node, "compat-hw-name");
+	if (!count || (count > CAM_FD_HW_MAX)) {
+		CAM_ERR(CAM_FD, "Invalid compat names in dev tree %d", count);
+		return -EINVAL;
+	}
+	g_fd_hw_mgr.num_devices = count;
+
+	g_fd_hw_mgr.raw_results_available = false;
+	g_fd_hw_mgr.supported_modes = 0;
+
+	for (i = 0; i < count; i++) {
+		hw_device = &g_fd_hw_mgr.hw_device[i];
+
+		rc = cam_fd_mgr_util_pdev_get_hw_intf(of_node, i, &hw_intf);
+		if (rc) {
+			CAM_ERR(CAM_FD, "hw intf from pdev failed, rc=%d", rc);
+			return rc;
+		}
+
+		mutex_init(&hw_device->lock);
+
+		hw_device->valid = true;
+		hw_device->hw_intf = hw_intf;
+		hw_device->ready_to_process = true;
+		hw_device->req_id = -1;
+		hw_device->cur_hw_ctx = NULL;
+
+		if (hw_device->hw_intf->hw_ops.process_cmd) {
+			struct cam_fd_hw_cmd_set_irq_cb irq_cb_args;
+
+			irq_cb_args.cam_fd_hw_mgr_cb = cam_fd_mgr_irq_cb;
+			irq_cb_args.data = hw_device;
+
+			rc = hw_device->hw_intf->hw_ops.process_cmd(
+				hw_device->hw_intf->hw_priv,
+				CAM_FD_HW_CMD_REGISTER_CALLBACK,
+				&irq_cb_args, sizeof(irq_cb_args));
+			if (rc) {
+				CAM_ERR(CAM_FD,
+					"Failed in REGISTER_CALLBACK %d", rc);
+				return rc;
+			}
+		}
+
+		if (hw_device->hw_intf->hw_ops.get_hw_caps) {
+			rc = hw_device->hw_intf->hw_ops.get_hw_caps(
+				hw_intf->hw_priv, &hw_device->hw_caps,
+				sizeof(hw_device->hw_caps));
+			if (rc) {
+				CAM_ERR(CAM_FD, "Failed in get_hw_caps %d", rc);
+				return rc;
+			}
+
+			g_fd_hw_mgr.raw_results_available |=
+				hw_device->hw_caps.raw_results_available;
+			g_fd_hw_mgr.supported_modes |=
+				hw_device->hw_caps.supported_modes;
+
+			CAM_DBG(CAM_FD,
+				"Device[mode=%d, raw=%d], Mgr[mode=%d, raw=%d]",
+				hw_device->hw_caps.supported_modes,
+				hw_device->hw_caps.raw_results_available,
+				g_fd_hw_mgr.supported_modes,
+				g_fd_hw_mgr.raw_results_available);
+		}
+	}
+
+	INIT_LIST_HEAD(&g_fd_hw_mgr.free_ctx_list);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.used_ctx_list);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.frame_free_list);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.frame_pending_list_high);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.frame_pending_list_normal);
+	INIT_LIST_HEAD(&g_fd_hw_mgr.frame_processing_list);
+
+	g_fd_hw_mgr.device_iommu.non_secure = -1;
+	g_fd_hw_mgr.device_iommu.secure = -1;
+	g_fd_hw_mgr.cdm_iommu.non_secure = -1;
+	g_fd_hw_mgr.cdm_iommu.secure = -1;
+	g_fd_hw_mgr.num_pending_frames = 0;
+
+	rc = cam_smmu_get_handle("fd",
+		&g_fd_hw_mgr.device_iommu.non_secure);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Get iommu handle failed, rc=%d", rc);
+		goto destroy_mutex;
+	}
+
+	rc = cam_cdm_get_iommu_handle("fd", &g_fd_hw_mgr.cdm_iommu);
+	if (rc)
+		CAM_DBG(CAM_FD, "Failed to acquire the CDM iommu handles");
+
+	CAM_DBG(CAM_FD, "iommu handles : device(%d, %d), cdm(%d, %d)",
+		g_fd_hw_mgr.device_iommu.non_secure,
+		g_fd_hw_mgr.device_iommu.secure,
+		g_fd_hw_mgr.cdm_iommu.non_secure,
+		g_fd_hw_mgr.cdm_iommu.secure);
+
+	/* Init hw mgr contexts and add to free list */
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		hw_mgr_ctx = &g_fd_hw_mgr.ctx_pool[i];
+
+		memset(hw_mgr_ctx, 0x0, sizeof(*hw_mgr_ctx));
+		INIT_LIST_HEAD(&hw_mgr_ctx->list);
+
+		hw_mgr_ctx->ctx_index = i;
+		hw_mgr_ctx->device_index = -1;
+		hw_mgr_ctx->hw_mgr = &g_fd_hw_mgr;
+
+		list_add_tail(&hw_mgr_ctx->list, &g_fd_hw_mgr.free_ctx_list);
+	}
+
+	/* Init hw mgr frame requests and add to free list */
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		frame_req = &g_fd_hw_mgr.frame_req[i];
+
+		memset(frame_req, 0x0, sizeof(*frame_req));
+		INIT_LIST_HEAD(&frame_req->list);
+
+		list_add_tail(&frame_req->list, &g_fd_hw_mgr.frame_free_list);
+	}
+
+	rc = cam_req_mgr_workq_create("cam_fd_worker", CAM_FD_WORKQ_NUM_TASK,
+		&g_fd_hw_mgr.work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_cam_fd_worker);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Unable to create a worker, rc=%d", rc);
+		goto detach_smmu;
+	}
+
+	g_fd_hw_mgr.work_data = kcalloc(CAM_FD_WORKQ_NUM_TASK,
+		sizeof(struct cam_fd_mgr_work_data), GFP_KERNEL);
+
+	for (i = 0; i < CAM_FD_WORKQ_NUM_TASK; i++)
+		g_fd_hw_mgr.work->task.pool[i].payload =
+			&g_fd_hw_mgr.work_data[i];
+
+	/* Setup hw cap so that we can just return the info when requested */
+	memset(&g_fd_hw_mgr.fd_caps, 0, sizeof(g_fd_hw_mgr.fd_caps));
+	g_fd_hw_mgr.fd_caps.device_iommu = g_fd_hw_mgr.device_iommu;
+	g_fd_hw_mgr.fd_caps.cdm_iommu = g_fd_hw_mgr.cdm_iommu;
+	g_fd_hw_mgr.fd_caps.hw_caps = g_fd_hw_mgr.hw_device[0].hw_caps;
+
+	CAM_DBG(CAM_FD,
+		"IOMMU device(%d, %d), CDM(%d, %d) versions core[%d.%d], wrapper[%d.%d]",
+		g_fd_hw_mgr.fd_caps.device_iommu.secure,
+		g_fd_hw_mgr.fd_caps.device_iommu.non_secure,
+		g_fd_hw_mgr.fd_caps.cdm_iommu.secure,
+		g_fd_hw_mgr.fd_caps.cdm_iommu.non_secure,
+		g_fd_hw_mgr.fd_caps.hw_caps.core_version.major,
+		g_fd_hw_mgr.fd_caps.hw_caps.core_version.minor,
+		g_fd_hw_mgr.fd_caps.hw_caps.wrapper_version.major,
+		g_fd_hw_mgr.fd_caps.hw_caps.wrapper_version.minor);
+
+	hw_mgr_intf->hw_mgr_priv = &g_fd_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_fd_mgr_hw_get_caps;
+	hw_mgr_intf->hw_acquire = cam_fd_mgr_hw_acquire;
+	hw_mgr_intf->hw_release = cam_fd_mgr_hw_release;
+	hw_mgr_intf->hw_start = cam_fd_mgr_hw_start;
+	hw_mgr_intf->hw_stop = cam_fd_mgr_hw_stop;
+	hw_mgr_intf->hw_prepare_update = cam_fd_mgr_hw_prepare_update;
+	hw_mgr_intf->hw_config = cam_fd_mgr_hw_config;
+	hw_mgr_intf->hw_read = NULL;
+	hw_mgr_intf->hw_write = NULL;
+	hw_mgr_intf->hw_close = NULL;
+	hw_mgr_intf->hw_flush = cam_fd_mgr_hw_flush;
+	hw_mgr_intf->hw_dump = cam_fd_mgr_hw_dump;
+
+	return rc;
+
+detach_smmu:
+	cam_smmu_destroy_handle(g_fd_hw_mgr.device_iommu.non_secure);
+	g_fd_hw_mgr.device_iommu.non_secure = -1;
+destroy_mutex:
+	mutex_destroy(&g_fd_hw_mgr.ctx_mutex);
+	mutex_destroy(&g_fd_hw_mgr.frame_req_mutex);
+	mutex_destroy(&g_fd_hw_mgr.hw_mgr_mutex);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.h
@@ -0,0 +1,190 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_MGR_H_
+#define _CAM_FD_HW_MGR_H_
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include <media/cam_fd.h>
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_fd_hw_intf.h"
+
+#define CAM_FD_HW_MAX            1
+#define CAM_FD_WORKQ_NUM_TASK    10
+
+/*
+ * Response time threshold in ms beyond which a request is not expected to be
+ * with FD hw
+ */
+#define CAM_FD_RESPONSE_TIME_THRESHOLD   100000
+
+struct cam_fd_hw_mgr;
+
+/**
+ * enum cam_fd_mgr_work_type - Type of worker task
+ *
+ * @CAM_FD_WORK_FRAME : Work type indicating frame task
+ * @CAM_FD_WORK_IRQ   : Work type indicating irq task
+ */
+enum cam_fd_mgr_work_type {
+	CAM_FD_WORK_FRAME,
+	CAM_FD_WORK_IRQ,
+};
+
+/**
+ * struct cam_fd_hw_mgr_ctx : FD HW Mgr context
+ *
+ * @list            : List pointer used to maintain this context
+ *                    in free, used list
+ * @ctx_index       : Index of this context
+ * @ctx_in_use      : Whether this context is in use
+ * @event_cb        : Event callback pointer to notify cam core context
+ * @cb_priv         : Event callback private pointer
+ * @hw_mgr          : Pointer to hw manager
+ * @get_raw_results : Whether this context needs raw results
+ * @mode            : Mode in which this context runs
+ * @device_index    : HW Device used by this context
+ * @ctx_hw_private  : HW layer's private context pointer for this context
+ * @priority        : Priority of this context
+ */
+struct cam_fd_hw_mgr_ctx {
+	struct list_head               list;
+	uint32_t                       ctx_index;
+	bool                           ctx_in_use;
+	cam_hw_event_cb_func           event_cb;
+	void                          *cb_priv;
+	struct cam_fd_hw_mgr          *hw_mgr;
+	bool                           get_raw_results;
+	enum cam_fd_hw_mode            mode;
+	int32_t                        device_index;
+	void                          *ctx_hw_private;
+	uint32_t                       priority;
+};
+
+/**
+ * struct cam_fd_device : FD HW Device
+ *
+ * @hw_caps          : This FD device's capabilities
+ * @hw_intf          : FD device's interface information
+ * @ready_to_process : Whether this device is ready to process next frame
+ * @num_ctxts        : Number of context currently running on this device
+ * @valid            : Whether this device is valid
+ * @lock             : Lock used for protectin
+ * @cur_hw_ctx       : current hw context running in the device
+ * @req_id           : current processing req id
+ */
+struct cam_fd_device {
+	struct cam_fd_hw_caps     hw_caps;
+	struct cam_hw_intf       *hw_intf;
+	bool                      ready_to_process;
+	uint32_t                  num_ctxts;
+	bool                      valid;
+	struct mutex              lock;
+	struct cam_fd_hw_mgr_ctx *cur_hw_ctx;
+	int64_t                   req_id;
+};
+
+/**
+ * struct cam_fd_mgr_frame_request : Frame request information maintained
+ *                                   in HW Mgr layer
+ *
+ * @list                  : List pointer used to maintain this request in
+ *                          free, pending, processing request lists
+ * @request_id            : Request ID corresponding to this request
+ * @hw_ctx                : HW context from which this request is coming
+ * @hw_req_private        : HW layer's private information specific to
+ *                          this request
+ * @hw_update_entries     : HW update entries corresponding to this request
+ *                          which needs to be submitted to HW through CDM
+ * @num_hw_update_entries : Number of HW update entries
+ * @submit_timestamp      : Time stamp for submit req with hw
+ */
+struct cam_fd_mgr_frame_request {
+	struct list_head               list;
+	uint64_t                       request_id;
+	struct cam_fd_hw_mgr_ctx      *hw_ctx;
+	struct cam_fd_hw_req_private   hw_req_private;
+	struct cam_hw_update_entry     hw_update_entries[CAM_FD_MAX_HW_ENTRIES];
+	uint32_t                       num_hw_update_entries;
+	ktime_t                        submit_timestamp;
+};
+
+/**
+ * struct cam_fd_mgr_work_data : HW Mgr work data information
+ *
+ * @type     : Type of work
+ * @irq_type : IRQ type when this work is queued because of irq callback
+ */
+struct cam_fd_mgr_work_data {
+	enum cam_fd_mgr_work_type      type;
+	enum cam_fd_hw_irq_type        irq_type;
+};
+
+/**
+ * struct cam_fd_hw_mgr : FD HW Mgr information
+ *
+ * @free_ctx_list             : List of free contexts available for acquire
+ * @used_ctx_list             : List of contexts that are acquired
+ * @frame_free_list           : List of free frame requests available
+ * @frame_pending_list_high   : List of high priority frame requests pending
+ *                              for processing
+ * @frame_pending_list_normal : List of normal priority frame requests pending
+ *                              for processing
+ * @frame_processing_list     : List of frame requests currently being
+ *                              processed currently. Generally maximum one
+ *                              request would be present in this list
+ * @hw_mgr_mutex              : Mutex to protect hw mgr data when accessed
+ *                              from multiple threads
+ * @hw_mgr_slock              : Spin lock to protect hw mgr data when accessed
+ *                              from multiple threads
+ * @ctx_mutex                 : Mutex to protect context list
+ * @frame_req_mutex           : Mutex to protect frame request list
+ * @device_iommu              : Device IOMMU information
+ * @cdm_iommu                 : CDM IOMMU information
+ * @hw_device                 : Underlying HW device information
+ * @num_devices               : Number of HW devices available
+ * @raw_results_available     : Whether raw results available in this driver
+ * @supported_modes           : Supported modes by this driver
+ * @ctx_pool                  : List of context
+ * @frame_req                 : List of frame requests
+ * @work                      : Worker handle
+ * @work_data                 : Worker data
+ * @fd_caps                   : FD driver capabilities
+ * @num_pending_frames        : Number of total frames pending for processing
+ *                              across contexts
+ */
+struct cam_fd_hw_mgr {
+	struct list_head                   free_ctx_list;
+	struct list_head                   used_ctx_list;
+	struct list_head                   frame_free_list;
+	struct list_head                   frame_pending_list_high;
+	struct list_head                   frame_pending_list_normal;
+	struct list_head                   frame_processing_list;
+	struct mutex                       hw_mgr_mutex;
+	spinlock_t                         hw_mgr_slock;
+	struct mutex                       ctx_mutex;
+	struct mutex                       frame_req_mutex;
+	struct cam_iommu_handle            device_iommu;
+	struct cam_iommu_handle            cdm_iommu;
+	struct cam_fd_device               hw_device[CAM_FD_HW_MAX];
+	uint32_t                           num_devices;
+	bool                               raw_results_available;
+	uint32_t                           supported_modes;
+	struct cam_fd_hw_mgr_ctx           ctx_pool[CAM_CTX_MAX];
+	struct cam_fd_mgr_frame_request    frame_req[CAM_CTX_REQ_MAX];
+	struct cam_req_mgr_core_workq     *work;
+	struct cam_fd_mgr_work_data        *work_data;
+	struct cam_fd_query_cap_cmd        fd_caps;
+	uint32_t                           num_pending_frames;
+};
+
+#endif /* _CAM_FD_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr_intf.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_MGR_INTF_H_
+#define _CAM_FD_HW_MGR_INTF_H_
+
+#include <linux/of.h>
+
+#include "cam_debug_util.h"
+#include "cam_hw_mgr_intf.h"
+
+int cam_fd_hw_mgr_init(struct device_node *of_node,
+	struct cam_hw_mgr_intf *hw_mgr_intf);
+int cam_fd_hw_mgr_deinit(struct device_node *of_node);
+
+#endif /* _CAM_FD_HW_MGR_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.c
@@ -0,0 +1,1250 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_fd_hw_core.h"
+#include "cam_fd_hw_soc.h"
+#include "cam_trace.h"
+
+#define CAM_FD_REG_VAL_PAIR_SIZE 256
+
+static uint32_t cam_fd_cdm_write_reg_val_pair(uint32_t *buffer,
+	uint32_t index, uint32_t reg_offset, uint32_t reg_value)
+{
+	buffer[index++] = reg_offset;
+	buffer[index++] = reg_value;
+
+	CAM_DBG(CAM_FD, "FD_CDM_CMD: Base[FD_CORE] Offset[0x%8x] Value[0x%8x]",
+		reg_offset, reg_value);
+
+	return index;
+}
+
+static void cam_fd_hw_util_cdm_callback(uint32_t handle, void *userdata,
+	enum cam_cdm_cb_status status, uint64_t cookie)
+{
+	trace_cam_cdm_cb("FD", status);
+	CAM_DBG(CAM_FD, "CDM hdl=%x, udata=%pK, status=%d, cookie=%llu",
+		handle, userdata, status, cookie);
+}
+
+static void cam_fd_hw_util_enable_power_on_settings(struct cam_hw_info *fd_hw)
+{
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	struct cam_fd_hw_static_info *hw_static_info =
+		((struct cam_fd_core *)fd_hw->core_info)->hw_static_info;
+
+	if (hw_static_info->enable_errata_wa.single_irq_only == false) {
+		/* Enable IRQs here */
+		cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+			hw_static_info->wrapper_regs.irq_mask,
+			hw_static_info->irq_mask);
+	}
+
+	/* QoS settings */
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.vbif_req_priority,
+		hw_static_info->qos_priority);
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.vbif_priority_level,
+		hw_static_info->qos_priority_level);
+}
+
+int cam_fd_hw_util_get_hw_caps(struct cam_hw_info *fd_hw,
+	struct cam_fd_hw_caps *hw_caps)
+{
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	struct cam_fd_hw_static_info *hw_static_info =
+		((struct cam_fd_core *)fd_hw->core_info)->hw_static_info;
+	uint32_t reg_value;
+
+	if (!hw_static_info) {
+		CAM_ERR(CAM_FD, "Invalid hw info data");
+		return -EINVAL;
+	}
+
+	reg_value = cam_fd_soc_register_read(soc_info, CAM_FD_REG_CORE,
+		hw_static_info->core_regs.version);
+	hw_caps->core_version.major =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf00, 0x8);
+	hw_caps->core_version.minor =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0, 0x4);
+	hw_caps->core_version.incr =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf, 0x0);
+
+	reg_value = cam_fd_soc_register_read(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.wrapper_version);
+	hw_caps->wrapper_version.major =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1c);
+	hw_caps->wrapper_version.minor =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->wrapper_version.incr =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	hw_caps->raw_results_available =
+		hw_static_info->results.raw_results_available;
+	hw_caps->supported_modes = hw_static_info->supported_modes;
+
+	CAM_DBG(CAM_FD, "core:%d.%d.%d wrapper:%d.%d.%d intermediate:%d",
+		hw_caps->core_version.major, hw_caps->core_version.minor,
+		hw_caps->core_version.incr, hw_caps->wrapper_version.major,
+		hw_caps->wrapper_version.minor, hw_caps->wrapper_version.incr,
+		hw_caps->raw_results_available);
+
+	return 0;
+}
+
+static int cam_fd_hw_util_fdwrapper_sync_reset(struct cam_hw_info *fd_hw)
+{
+	struct cam_fd_core *fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	struct cam_fd_hw_static_info *hw_static_info = fd_core->hw_static_info;
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	long time_left;
+
+	/* Before triggering reset to HW, clear the reset complete */
+	reinit_completion(&fd_core->reset_complete);
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_CORE,
+		hw_static_info->core_regs.control, 0x1);
+
+	if (hw_static_info->enable_errata_wa.single_irq_only) {
+		cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+			hw_static_info->wrapper_regs.irq_mask,
+			CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE));
+	}
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.sw_reset, 0x1);
+
+	time_left = wait_for_completion_timeout(&fd_core->reset_complete,
+		msecs_to_jiffies(CAM_FD_HW_HALT_RESET_TIMEOUT));
+	if (time_left <= 0)
+		CAM_WARN(CAM_FD, "HW reset timeout time_left=%ld", time_left);
+
+	CAM_DBG(CAM_FD, "FD Wrapper SW Sync Reset complete");
+
+	return 0;
+}
+
+
+static int cam_fd_hw_util_fdwrapper_halt(struct cam_hw_info *fd_hw)
+{
+	struct cam_fd_core *fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	struct cam_fd_hw_static_info *hw_static_info = fd_core->hw_static_info;
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	long time_left;
+
+	/* Before triggering halt to HW, clear halt complete */
+	reinit_completion(&fd_core->halt_complete);
+
+	if (hw_static_info->enable_errata_wa.single_irq_only) {
+		cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+			hw_static_info->wrapper_regs.irq_mask,
+			CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE));
+	}
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.hw_stop, 0x1);
+
+	time_left = wait_for_completion_timeout(&fd_core->halt_complete,
+		msecs_to_jiffies(CAM_FD_HW_HALT_RESET_TIMEOUT));
+	if (time_left <= 0)
+		CAM_WARN(CAM_FD, "HW halt timeout time_left=%ld", time_left);
+
+	CAM_DBG(CAM_FD, "FD Wrapper Halt complete");
+
+	return 0;
+}
+
+static int cam_fd_hw_util_processcmd_prestart(struct cam_hw_info *fd_hw,
+	struct cam_fd_hw_cmd_prestart_args *prestart_args)
+{
+	struct cam_hw_soc_info *soc_info = &fd_hw->soc_info;
+	struct cam_fd_hw_static_info *hw_static_info =
+		((struct cam_fd_core *)fd_hw->core_info)->hw_static_info;
+	struct cam_fd_ctx_hw_private *ctx_hw_private =
+		prestart_args->ctx_hw_private;
+	uint32_t size, size_required = 0;
+	uint32_t mem_base;
+	uint32_t *cmd_buf_addr = prestart_args->cmd_buf_addr;
+	uint32_t reg_val_pair[CAM_FD_REG_VAL_PAIR_SIZE];
+	uint32_t num_cmds = 0;
+	int i;
+	struct cam_fd_hw_io_buffer *io_buf;
+	struct cam_fd_hw_req_private *req_private;
+	uint32_t available_size = prestart_args->size;
+	bool work_buffer_configured = false;
+
+	if (!ctx_hw_private || !cmd_buf_addr) {
+		CAM_ERR(CAM_FD, "Invalid input prestart args %pK %pK",
+			ctx_hw_private, cmd_buf_addr);
+		return -EINVAL;
+	}
+
+	if (prestart_args->get_raw_results &&
+		!hw_static_info->results.raw_results_available) {
+		CAM_ERR(CAM_FD, "Raw results not supported %d %d",
+			prestart_args->get_raw_results,
+			hw_static_info->results.raw_results_available);
+		return -EINVAL;
+	}
+
+	req_private = &prestart_args->hw_req_private;
+	req_private->ctx_hw_private = prestart_args->ctx_hw_private;
+	req_private->request_id = prestart_args->request_id;
+	req_private->get_raw_results = prestart_args->get_raw_results;
+	req_private->fd_results = NULL;
+	req_private->raw_results = NULL;
+
+	/* Start preparing CDM register values that KMD has to insert */
+	num_cmds = cam_fd_cdm_write_reg_val_pair(reg_val_pair, num_cmds,
+		hw_static_info->core_regs.control, 0x1);
+	num_cmds = cam_fd_cdm_write_reg_val_pair(reg_val_pair, num_cmds,
+		hw_static_info->core_regs.control, 0x0);
+
+	for (i = 0; i < CAM_FD_MAX_IO_BUFFERS; i++) {
+		io_buf = &prestart_args->input_buf[i];
+
+		if (io_buf->valid == false)
+			break;
+
+		if (io_buf->io_cfg->direction != CAM_BUF_INPUT) {
+			CAM_ERR(CAM_FD, "Incorrect direction %d %d",
+				io_buf->io_cfg->direction, CAM_BUF_INPUT);
+			return -EINVAL;
+		}
+
+		switch (io_buf->io_cfg->resource_type) {
+		case CAM_FD_INPUT_PORT_ID_IMAGE: {
+			if ((num_cmds + 2) > CAM_FD_REG_VAL_PAIR_SIZE) {
+				CAM_ERR(CAM_FD,
+					"Invalid reg_val pair size %d, %d",
+					num_cmds, CAM_FD_REG_VAL_PAIR_SIZE);
+				return -EINVAL;
+			}
+
+			num_cmds = cam_fd_cdm_write_reg_val_pair(
+				reg_val_pair, num_cmds,
+				hw_static_info->core_regs.image_addr,
+				io_buf->io_addr[0]);
+			break;
+		}
+		default:
+			CAM_ERR(CAM_FD, "Invalid resource type %d",
+				io_buf->io_cfg->resource_type);
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < CAM_FD_MAX_IO_BUFFERS; i++) {
+		io_buf = &prestart_args->output_buf[i];
+
+		if (io_buf->valid == false)
+			break;
+
+		if (io_buf->io_cfg->direction != CAM_BUF_OUTPUT) {
+			CAM_ERR(CAM_FD, "Incorrect direction %d %d",
+				io_buf->io_cfg->direction, CAM_BUF_INPUT);
+			return -EINVAL;
+		}
+
+		switch (io_buf->io_cfg->resource_type) {
+		case CAM_FD_OUTPUT_PORT_ID_RESULTS: {
+			uint32_t face_results_offset;
+
+			size_required = hw_static_info->results.max_faces *
+				hw_static_info->results.per_face_entries * 4;
+
+			if (io_buf->io_cfg->planes[0].plane_stride <
+				size_required) {
+				CAM_ERR(CAM_FD, "Invalid results size %d %d",
+					io_buf->io_cfg->planes[0].plane_stride,
+					size_required);
+				return -EINVAL;
+			}
+
+			req_private->fd_results =
+				(struct cam_fd_results *)io_buf->cpu_addr[0];
+
+			face_results_offset =
+				(uint8_t *)&req_private->fd_results->faces[0] -
+				(uint8_t *)req_private->fd_results;
+
+			if (hw_static_info->ro_mode_supported) {
+				if ((num_cmds + 4) > CAM_FD_REG_VAL_PAIR_SIZE) {
+					CAM_ERR(CAM_FD,
+						"Invalid reg_val size %d, %d",
+						num_cmds,
+						CAM_FD_REG_VAL_PAIR_SIZE);
+					return -EINVAL;
+				}
+				/*
+				 * Face data actually starts 16bytes later in
+				 * the io buffer  Check cam_fd_results.
+				 */
+				num_cmds = cam_fd_cdm_write_reg_val_pair(
+					reg_val_pair, num_cmds,
+					hw_static_info->core_regs.result_addr,
+					io_buf->io_addr[0] +
+					face_results_offset);
+				num_cmds = cam_fd_cdm_write_reg_val_pair(
+					reg_val_pair, num_cmds,
+					hw_static_info->core_regs.ro_mode,
+					0x1);
+
+				req_private->ro_mode_enabled = true;
+			} else {
+				req_private->ro_mode_enabled = false;
+			}
+			break;
+		}
+		case CAM_FD_OUTPUT_PORT_ID_RAW_RESULTS: {
+			size_required =
+				hw_static_info->results.raw_results_entries *
+				sizeof(uint32_t);
+
+			if (io_buf->io_cfg->planes[0].plane_stride <
+				size_required) {
+				CAM_ERR(CAM_FD, "Invalid results size %d %d",
+					io_buf->io_cfg->planes[0].plane_stride,
+					size_required);
+				return -EINVAL;
+			}
+
+			req_private->raw_results =
+				(uint32_t *)io_buf->cpu_addr[0];
+			break;
+		}
+		case CAM_FD_OUTPUT_PORT_ID_WORK_BUFFER: {
+			if ((num_cmds + 2) > CAM_FD_REG_VAL_PAIR_SIZE) {
+				CAM_ERR(CAM_FD,
+					"Invalid reg_val pair size %d, %d",
+					num_cmds, CAM_FD_REG_VAL_PAIR_SIZE);
+				return -EINVAL;
+			}
+
+			num_cmds = cam_fd_cdm_write_reg_val_pair(
+				reg_val_pair, num_cmds,
+				hw_static_info->core_regs.work_addr,
+				io_buf->io_addr[0]);
+
+			work_buffer_configured = true;
+			break;
+		}
+		default:
+			CAM_ERR(CAM_FD, "Invalid resource type %d",
+				io_buf->io_cfg->resource_type);
+			return -EINVAL;
+		}
+	}
+
+	if (!req_private->fd_results || !work_buffer_configured) {
+		CAM_ERR(CAM_FD, "Invalid IO Buffers results=%pK work=%d",
+			req_private->fd_results, work_buffer_configured);
+		return -EINVAL;
+	}
+
+	/* First insert CHANGE_BASE command */
+	size = ctx_hw_private->cdm_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > available_size) {
+		CAM_ERR(CAM_FD, "buf size:%d is not sufficient, expected: %d",
+			prestart_args->size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(soc_info,
+		((struct cam_fd_soc_private *)soc_info->soc_private)->
+		regbase_index[CAM_FD_REG_CORE]);
+
+	ctx_hw_private->cdm_ops->cdm_write_changebase(cmd_buf_addr, mem_base);
+	cmd_buf_addr += size;
+	available_size -= (size * 4);
+
+	size = ctx_hw_private->cdm_ops->cdm_required_size_reg_random(
+		num_cmds/2);
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > available_size) {
+		CAM_ERR(CAM_FD, "Insufficient size:%d , expected size:%d",
+			available_size, size);
+		return -ENOMEM;
+	}
+	ctx_hw_private->cdm_ops->cdm_write_regrandom(cmd_buf_addr, num_cmds/2,
+		reg_val_pair);
+	cmd_buf_addr += size;
+	available_size -= (size * 4);
+
+	/* Update pre_config_buf_size in bytes */
+	prestart_args->pre_config_buf_size =
+		prestart_args->size - available_size;
+
+	/* Insert start trigger command into CDM as post config commands. */
+	num_cmds = cam_fd_cdm_write_reg_val_pair(reg_val_pair, 0,
+		hw_static_info->core_regs.control, 0x2);
+	size = ctx_hw_private->cdm_ops->cdm_required_size_reg_random(
+		num_cmds/2);
+	if ((size * 4) > available_size) {
+		CAM_ERR(CAM_FD, "Insufficient size:%d , expected size:%d",
+			available_size, size);
+		return -ENOMEM;
+	}
+	ctx_hw_private->cdm_ops->cdm_write_regrandom(cmd_buf_addr, num_cmds/2,
+		reg_val_pair);
+	cmd_buf_addr += size;
+	available_size -= (size * 4);
+
+	prestart_args->post_config_buf_size = size * 4;
+
+	CAM_DBG(CAM_FD, "PreConfig [%pK %d], PostConfig[%pK %d]",
+		prestart_args->cmd_buf_addr, prestart_args->pre_config_buf_size,
+		cmd_buf_addr, prestart_args->post_config_buf_size);
+
+	for (i = 0; i < (prestart_args->pre_config_buf_size +
+		prestart_args->post_config_buf_size) / 4; i++)
+		CAM_DBG(CAM_FD, "CDM KMD Commands [%d] : [%pK] [0x%x]", i,
+			&prestart_args->cmd_buf_addr[i],
+			prestart_args->cmd_buf_addr[i]);
+
+	return 0;
+}
+
+static int cam_fd_hw_util_processcmd_frame_done(struct cam_hw_info *fd_hw,
+	struct cam_fd_hw_frame_done_args *frame_done_args)
+{
+	struct cam_fd_core *fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	struct cam_fd_hw_static_info *hw_static_info = fd_core->hw_static_info;
+	struct cam_fd_hw_req_private *req_private;
+	uint32_t base, face_cnt;
+	uint32_t *buffer;
+	unsigned long flags;
+	int i;
+
+	mutex_lock(&fd_hw->hw_mutex);
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	if ((fd_core->core_state != CAM_FD_CORE_STATE_IDLE) ||
+		(fd_core->results_valid == false) ||
+		!fd_core->hw_req_private) {
+		CAM_ERR(CAM_FD,
+			"Invalid state for results state=%d, results=%d %pK",
+			fd_core->core_state, fd_core->results_valid,
+			fd_core->hw_req_private);
+		spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+		mutex_unlock(&fd_hw->hw_mutex);
+		return -EINVAL;
+	}
+	fd_core->core_state = CAM_FD_CORE_STATE_READING_RESULTS;
+	req_private = fd_core->hw_req_private;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	/*
+	 * Copy the register value as is into output buffers.
+	 * Wehter we are copying the output data by reading registers or
+	 * programming output buffer directly to HW must be transparent to UMD.
+	 * In case HW supports writing face count value directly into
+	 * DDR memory in future, these values should match.
+	 */
+	req_private->fd_results->face_count =
+		cam_fd_soc_register_read(&fd_hw->soc_info, CAM_FD_REG_CORE,
+		hw_static_info->core_regs.result_cnt);
+
+	face_cnt = req_private->fd_results->face_count & 0x3F;
+
+	if (face_cnt > hw_static_info->results.max_faces) {
+		CAM_WARN(CAM_FD, "Face count greater than max %d %d",
+			face_cnt, hw_static_info->results.max_faces);
+		face_cnt = hw_static_info->results.max_faces;
+	}
+
+	CAM_DBG(CAM_FD, "ReqID[%lld] Faces Detected = %d",
+		req_private->request_id, face_cnt);
+
+	/*
+	 * We need to read the face data information from registers only
+	 * if one of below is true
+	 * 1. RO mode is not set. i.e FD HW doesn't write face data into
+	 *    DDR memory
+	 * 2. On the current chipset, results written into DDR memory by FD HW
+	 *    are not gauranteed to be correct
+	 */
+	if (!req_private->ro_mode_enabled ||
+		hw_static_info->enable_errata_wa.ro_mode_results_invalid) {
+		buffer = (uint32_t *)&req_private->fd_results->faces[0];
+		base = hw_static_info->core_regs.results_reg_base;
+
+		/*
+		 * Write register values as is into face data buffer.  Its UMD
+		 * driver responsibility to interpret the data and extract face
+		 * properties from output buffer. Think in case output buffer
+		 * is directly programmed to HW, then KMD has no control to
+		 * extract the face properties and UMD anyway has to extract
+		 * face properties. So we follow the same approach and keep
+		 * this transparent to UMD.
+		 */
+		for (i = 0;
+			i < (face_cnt *
+			hw_static_info->results.per_face_entries); i++) {
+			*buffer = cam_fd_soc_register_read(&fd_hw->soc_info,
+				CAM_FD_REG_CORE, base + (i * 0x4));
+			CAM_DBG(CAM_FD, "FaceData[%d] : 0x%x", i / 4, *buffer);
+			buffer++;
+		}
+	}
+
+	if (req_private->get_raw_results &&
+		req_private->raw_results &&
+		hw_static_info->results.raw_results_available) {
+		buffer = req_private->raw_results;
+		base = hw_static_info->core_regs.raw_results_reg_base;
+
+		for (i = 0;
+			i < hw_static_info->results.raw_results_entries;
+			i++) {
+			*buffer = cam_fd_soc_register_read(&fd_hw->soc_info,
+				CAM_FD_REG_CORE, base + (i * 0x4));
+			CAM_DBG(CAM_FD, "RawData[%d] : 0x%x", i, *buffer);
+			buffer++;
+		}
+	}
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->hw_req_private = NULL;
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+	mutex_unlock(&fd_hw->hw_mutex);
+
+	return 0;
+}
+
+static int cam_fd_hw_util_processcmd_hw_dump(
+	struct cam_hw_info *fd_hw,
+	void               *args)
+{
+	int                            i, j;
+	uint8_t                       *dst;
+	uint32_t                      *addr, *start;
+	uint32_t                       num_reg, min_len;
+	uint64_t                       remain_len;
+	struct cam_hw_soc_info        *soc_info;
+	struct cam_fd_hw_dump_header  *hdr;
+	struct cam_fd_hw_dump_args    *dump_args;
+
+	if (!fd_hw || !args) {
+		CAM_ERR(CAM_FD, "Invalid args %pK %pK",
+			fd_hw, args);
+		return -EINVAL;
+	}
+
+	mutex_lock(&fd_hw->hw_mutex);
+
+	if (fd_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_INFO(CAM_FD, "power off state");
+		mutex_unlock(&fd_hw->hw_mutex);
+		return 0;
+	}
+
+	dump_args = (struct cam_fd_hw_dump_args *)args;
+	soc_info = &fd_hw->soc_info;
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_FD, "dump offset overshoot len %zu offset %zu",
+			dump_args->buf_len, dump_args->offset);
+		mutex_unlock(&fd_hw->hw_mutex);
+		return -ENOSPC;
+	}
+
+	remain_len = dump_args->buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_fd_hw_dump_header) +
+		    soc_info->reg_map[0].size + sizeof(uint32_t);
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_FD, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		mutex_unlock(&fd_hw->hw_mutex);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_fd_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_FD_HW_DUMP_TAG_MAX_LEN,
+		"FD_REG:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_fd_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+
+	for (j = 0; j < soc_info->num_reg_map; j++) {
+		num_reg = soc_info->reg_map[j].size/4;
+		for (i = 0; i < num_reg; i++) {
+			*addr++ = soc_info->mem_block[j]->start + i*4;
+			*addr++ = cam_io_r(soc_info->reg_map[j].mem_base +
+				(i*4));
+		}
+	}
+
+	mutex_unlock(&fd_hw->hw_mutex);
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_fd_hw_dump_header);
+	CAM_DBG(CAM_FD, "%zu", dump_args->offset);
+	return 0;
+}
+
+irqreturn_t cam_fd_hw_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)data;
+	struct cam_fd_core *fd_core;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_fd_hw_static_info *hw_static_info;
+	uint32_t reg_value;
+	enum cam_fd_hw_irq_type irq_type = CAM_FD_IRQ_FRAME_DONE;
+	uint32_t num_irqs = 0;
+
+	if (!fd_hw) {
+		CAM_ERR(CAM_FD, "Invalid data in IRQ callback");
+		return IRQ_NONE;
+	}
+
+	fd_core = (struct cam_fd_core *) fd_hw->core_info;
+	soc_info = &fd_hw->soc_info;
+	hw_static_info = fd_core->hw_static_info;
+
+	reg_value = cam_fd_soc_register_read(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.irq_status);
+
+	CAM_DBG(CAM_FD, "FD IRQ status 0x%x", reg_value);
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.irq_clear,
+		reg_value);
+
+	if (reg_value & CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE)) {
+		complete_all(&fd_core->halt_complete);
+		irq_type = CAM_FD_IRQ_HALT_DONE;
+		num_irqs++;
+	}
+
+	if (reg_value & CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE)) {
+		complete_all(&fd_core->reset_complete);
+		irq_type = CAM_FD_IRQ_RESET_DONE;
+		num_irqs++;
+	}
+
+	if (reg_value & CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE)) {
+		complete_all(&fd_core->processing_complete);
+		irq_type = CAM_FD_IRQ_FRAME_DONE;
+		num_irqs++;
+	}
+
+	/*
+	 * We should never get an IRQ callback with no or more than one mask.
+	 * Validate first to make sure nothing going wrong.
+	 */
+	if (num_irqs != 1) {
+		CAM_ERR(CAM_FD,
+			"Invalid number of IRQs, value=0x%x, num_irqs=%d",
+			reg_value, num_irqs);
+		return IRQ_NONE;
+	}
+
+	trace_cam_irq_activated("FD", irq_type);
+
+	if (irq_type == CAM_FD_IRQ_HALT_DONE) {
+		/*
+		 * Do not send HALT IRQ callback to Hw Mgr,
+		 * a reset would always follow
+		 */
+		return IRQ_HANDLED;
+	}
+
+	spin_lock(&fd_core->spin_lock);
+	/* Do not change state to IDLE on HALT IRQ. Reset must follow halt */
+	if ((irq_type == CAM_FD_IRQ_RESET_DONE) ||
+		(irq_type == CAM_FD_IRQ_FRAME_DONE)) {
+
+		fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+		if (irq_type == CAM_FD_IRQ_FRAME_DONE)
+			fd_core->results_valid = true;
+
+		CAM_DBG(CAM_FD, "FD IRQ type %d, state=%d",
+			irq_type, fd_core->core_state);
+	}
+	spin_unlock(&fd_core->spin_lock);
+
+	if (fd_core->irq_cb.cam_fd_hw_mgr_cb)
+		fd_core->irq_cb.cam_fd_hw_mgr_cb(fd_core->irq_cb.data,
+			irq_type);
+
+	return IRQ_HANDLED;
+}
+
+int cam_fd_hw_get_hw_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_caps *fd_hw_caps =
+		(struct cam_fd_hw_caps *)get_hw_cap_args;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_FD, "Invalid input pointers %pK %pK",
+			hw_priv, get_hw_cap_args);
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	*fd_hw_caps = fd_core->hw_caps;
+
+	CAM_DBG(CAM_FD, "core:%d.%d wrapper:%d.%d mode:%d, raw:%d",
+		fd_hw_caps->core_version.major,
+		fd_hw_caps->core_version.minor,
+		fd_hw_caps->wrapper_version.major,
+		fd_hw_caps->wrapper_version.minor,
+		fd_hw_caps->supported_modes,
+		fd_hw_caps->raw_results_available);
+
+	return 0;
+}
+
+int cam_fd_hw_init(void *hw_priv, void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_init_args *init_args =
+		(struct cam_fd_hw_init_args *)init_hw_args;
+	int rc = 0;
+	unsigned long flags;
+
+	if (!fd_hw || !init_args) {
+		CAM_ERR(CAM_FD, "Invalid argument %pK %pK", fd_hw, init_args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_init_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_init_args));
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+
+	mutex_lock(&fd_hw->hw_mutex);
+	CAM_DBG(CAM_FD, "FD HW Init ref count before %d", fd_hw->open_count);
+
+	if (fd_hw->open_count > 0) {
+		rc = 0;
+		goto cdm_streamon;
+	}
+
+	rc = cam_fd_soc_enable_resources(&fd_hw->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Enable SOC failed, rc=%d", rc);
+		goto unlock_return;
+	}
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	if (init_args->reset_required) {
+		rc = cam_fd_hw_reset(hw_priv, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_FD, "Reset Failed, rc=%d", rc);
+			goto disable_soc;
+		}
+		init_args->is_hw_reset = true;
+	}
+
+	cam_fd_hw_util_enable_power_on_settings(fd_hw);
+
+cdm_streamon:
+	fd_hw->open_count++;
+	CAM_DBG(CAM_FD, "FD HW Init ref count after %d", fd_hw->open_count);
+
+	if (init_args->ctx_hw_private) {
+		struct cam_fd_ctx_hw_private *ctx_hw_private =
+			init_args->ctx_hw_private;
+
+		rc = cam_cdm_stream_on(ctx_hw_private->cdm_handle);
+		if (rc) {
+			CAM_ERR(CAM_FD, "CDM StreamOn fail :handle=0x%x, rc=%d",
+				ctx_hw_private->cdm_handle, rc);
+			fd_hw->open_count--;
+			if (!fd_hw->open_count)
+				goto disable_soc;
+		}
+	}
+
+	mutex_unlock(&fd_hw->hw_mutex);
+
+	return rc;
+
+disable_soc:
+	if (cam_fd_soc_disable_resources(&fd_hw->soc_info))
+		CAM_ERR(CAM_FD, "Error in disable soc resources");
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	fd_core->core_state = CAM_FD_CORE_STATE_POWERDOWN;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+unlock_return:
+	mutex_unlock(&fd_hw->hw_mutex);
+	return rc;
+}
+
+int cam_fd_hw_deinit(void *hw_priv, void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = hw_priv;
+	struct cam_fd_core *fd_core = NULL;
+	struct cam_fd_hw_deinit_args *deinit_args =
+		(struct cam_fd_hw_deinit_args *)deinit_hw_args;
+	int rc = 0;
+	unsigned long flags;
+
+	if (!fd_hw || !deinit_hw_args) {
+		CAM_ERR(CAM_FD, "Invalid argument");
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_deinit_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_deinit_args));
+		return -EINVAL;
+	}
+
+	mutex_lock(&fd_hw->hw_mutex);
+	if (fd_hw->open_count == 0) {
+		mutex_unlock(&fd_hw->hw_mutex);
+		CAM_ERR(CAM_FD, "Error Unbalanced deinit");
+		return -EFAULT;
+	}
+
+	fd_hw->open_count--;
+	CAM_DBG(CAM_FD, "FD HW ref count=%d", fd_hw->open_count);
+
+	if (fd_hw->open_count > 0) {
+		rc = 0;
+		goto positive_ref_cnt;
+	}
+
+	rc = cam_fd_soc_disable_resources(&fd_hw->soc_info);
+	if (rc)
+		CAM_ERR(CAM_FD, "Failed in Disable SOC, rc=%d", rc);
+
+	fd_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+
+	/* With the ref_cnt correct, this should never happen */
+	WARN_ON(!fd_core);
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->core_state = CAM_FD_CORE_STATE_POWERDOWN;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+positive_ref_cnt:
+	if (deinit_args->ctx_hw_private) {
+		struct cam_fd_ctx_hw_private *ctx_hw_private =
+			deinit_args->ctx_hw_private;
+
+		rc = cam_cdm_stream_off(ctx_hw_private->cdm_handle);
+		if (rc) {
+			CAM_ERR(CAM_FD,
+				"Failed in CDM StreamOff, handle=0x%x, rc=%d",
+				ctx_hw_private->cdm_handle, rc);
+		}
+	}
+
+	mutex_unlock(&fd_hw->hw_mutex);
+	return rc;
+}
+
+int cam_fd_hw_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_static_info *hw_static_info;
+	struct cam_hw_soc_info *soc_info;
+	unsigned long flags;
+	int rc;
+
+	if (!fd_hw) {
+		CAM_ERR(CAM_FD, "Invalid input handle");
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	hw_static_info = fd_core->hw_static_info;
+	soc_info = &fd_hw->soc_info;
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	if ((fd_core->core_state == CAM_FD_CORE_STATE_POWERDOWN) ||
+		(fd_core->core_state == CAM_FD_CORE_STATE_RESET_PROGRESS)) {
+		CAM_ERR(CAM_FD, "Reset not allowed in %d state",
+			fd_core->core_state);
+		spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+		return -EINVAL;
+	}
+
+	fd_core->results_valid = false;
+	fd_core->core_state = CAM_FD_CORE_STATE_RESET_PROGRESS;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.cgc_disable, 0x1);
+
+	rc = cam_fd_hw_util_fdwrapper_halt(fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in HALT rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_fd_hw_util_fdwrapper_sync_reset(fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in RESET rc=%d", rc);
+		return rc;
+	}
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.cgc_disable, 0x0);
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	return rc;
+}
+
+int cam_fd_hw_start(void *hw_priv, void *hw_start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_static_info *hw_static_info;
+	struct cam_fd_hw_cmd_start_args *start_args =
+		(struct cam_fd_hw_cmd_start_args *)hw_start_args;
+	struct cam_fd_ctx_hw_private *ctx_hw_private;
+	unsigned long flags;
+	int rc;
+
+	if (!hw_priv || !start_args) {
+		CAM_ERR(CAM_FD, "Invalid input args %pK %pK", hw_priv,
+			start_args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_cmd_start_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_cmd_start_args));
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	hw_static_info = fd_core->hw_static_info;
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	if (fd_core->core_state != CAM_FD_CORE_STATE_IDLE) {
+		CAM_ERR(CAM_FD, "Cannot start in %d state",
+			fd_core->core_state);
+		spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+		return -EINVAL;
+	}
+
+	/*
+	 * We are about to start FD HW processing, save the request
+	 * private data which is being processed by HW. Once the frame
+	 * processing is finished, process_cmd(FRAME_DONE) should be called
+	 * with same hw_req_private as input.
+	 */
+	fd_core->hw_req_private = start_args->hw_req_private;
+	fd_core->core_state = CAM_FD_CORE_STATE_PROCESSING;
+	fd_core->results_valid = false;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	ctx_hw_private = start_args->ctx_hw_private;
+
+	/* Before starting HW process, clear processing complete */
+	reinit_completion(&fd_core->processing_complete);
+
+	if (hw_static_info->enable_errata_wa.single_irq_only) {
+		cam_fd_soc_register_write(&fd_hw->soc_info, CAM_FD_REG_WRAPPER,
+			hw_static_info->wrapper_regs.irq_mask,
+			CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE));
+	}
+
+	if (start_args->num_hw_update_entries > 0) {
+		struct cam_cdm_bl_request *cdm_cmd = ctx_hw_private->cdm_cmd;
+		struct cam_hw_update_entry *cmd;
+		int i;
+
+		cdm_cmd->cmd_arrary_count = start_args->num_hw_update_entries;
+		cdm_cmd->type = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+		cdm_cmd->flag = false;
+		cdm_cmd->userdata = NULL;
+		cdm_cmd->cookie = 0;
+		cdm_cmd->gen_irq_arb = false;
+
+		for (i = 0 ; i <= start_args->num_hw_update_entries; i++) {
+			cmd = (start_args->hw_update_entries + i);
+			cdm_cmd->cmd_flex[i].bl_addr.mem_handle = cmd->handle;
+			cdm_cmd->cmd_flex[i].offset = cmd->offset;
+			cdm_cmd->cmd_flex[i].len = cmd->len;
+			cdm_cmd->cmd_flex[i].arbitrate = false;
+		}
+
+		rc = cam_cdm_submit_bls(ctx_hw_private->cdm_handle, cdm_cmd);
+		if (rc) {
+			CAM_ERR(CAM_FD,
+				"Failed to submit cdm commands, rc=%d", rc);
+			goto error;
+		}
+	} else {
+		CAM_ERR(CAM_FD, "Invalid number of hw update entries");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	return 0;
+error:
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	return rc;
+}
+
+int cam_fd_hw_halt_reset(void *hw_priv, void *stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_fd_core *fd_core;
+	struct cam_fd_hw_static_info *hw_static_info;
+	struct cam_hw_soc_info *soc_info;
+	unsigned long flags;
+	int rc;
+
+	if (!fd_hw) {
+		CAM_ERR(CAM_FD, "Invalid input handle");
+		return -EINVAL;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	hw_static_info = fd_core->hw_static_info;
+	soc_info = &fd_hw->soc_info;
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	if ((fd_core->core_state == CAM_FD_CORE_STATE_POWERDOWN) ||
+		(fd_core->core_state == CAM_FD_CORE_STATE_RESET_PROGRESS)) {
+		CAM_ERR(CAM_FD, "Reset not allowed in %d state",
+			fd_core->core_state);
+		spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+		return -EINVAL;
+	}
+
+	fd_core->results_valid = false;
+	fd_core->core_state = CAM_FD_CORE_STATE_RESET_PROGRESS;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.cgc_disable, 0x1);
+
+	rc = cam_fd_hw_util_fdwrapper_halt(fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in HALT rc=%d", rc);
+		return rc;
+	}
+
+	/* HALT must be followed by RESET */
+	rc = cam_fd_hw_util_fdwrapper_sync_reset(fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in RESET rc=%d", rc);
+		return rc;
+	}
+
+	cam_fd_soc_register_write(soc_info, CAM_FD_REG_WRAPPER,
+		hw_static_info->wrapper_regs.cgc_disable, 0x0);
+
+	spin_lock_irqsave(&fd_core->spin_lock, flags);
+	fd_core->core_state = CAM_FD_CORE_STATE_IDLE;
+	spin_unlock_irqrestore(&fd_core->spin_lock, flags);
+
+	return rc;
+}
+
+int cam_fd_hw_reserve(void *hw_priv, void *hw_reserve_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	int rc = -EINVAL;
+	struct cam_fd_ctx_hw_private *ctx_hw_private;
+	struct cam_fd_hw_reserve_args *reserve_args =
+		(struct cam_fd_hw_reserve_args *)hw_reserve_args;
+	struct cam_cdm_acquire_data cdm_acquire;
+	struct cam_cdm_bl_request *cdm_cmd;
+	int i;
+
+	if (!fd_hw || !reserve_args) {
+		CAM_ERR(CAM_FD, "Invalid input %pK, %pK", fd_hw, reserve_args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_reserve_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_reserve_args));
+		return -EINVAL;
+	}
+
+	cdm_cmd = kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+			((CAM_FD_MAX_HW_ENTRIES - 1) *
+			sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+	if (!cdm_cmd)
+		return -ENOMEM;
+
+	ctx_hw_private = kzalloc(sizeof(struct cam_fd_ctx_hw_private),
+		GFP_KERNEL);
+	if (!ctx_hw_private) {
+		kfree(cdm_cmd);
+		return -ENOMEM;
+	}
+
+	memset(&cdm_acquire, 0, sizeof(cdm_acquire));
+	strscpy(cdm_acquire.identifier, "fd", sizeof("fd"));
+	cdm_acquire.cell_index = fd_hw->soc_info.index;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = ctx_hw_private;
+	cdm_acquire.cam_cdm_callback = cam_fd_hw_util_cdm_callback;
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.base_array_cnt = fd_hw->soc_info.num_reg_map;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	for (i = 0; i < fd_hw->soc_info.num_reg_map; i++)
+		cdm_acquire.base_array[i] = &fd_hw->soc_info.reg_map[i];
+
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to acquire the CDM HW");
+		goto error;
+	}
+
+	ctx_hw_private->hw_ctx = reserve_args->hw_ctx;
+	ctx_hw_private->fd_hw = fd_hw;
+	ctx_hw_private->mode = reserve_args->mode;
+	ctx_hw_private->cdm_handle = cdm_acquire.handle;
+	ctx_hw_private->cdm_ops = cdm_acquire.ops;
+	ctx_hw_private->cdm_cmd = cdm_cmd;
+
+	reserve_args->ctx_hw_private = ctx_hw_private;
+
+	CAM_DBG(CAM_FD, "private=%pK, hw_ctx=%pK, mode=%d, cdm_handle=0x%x",
+		ctx_hw_private, ctx_hw_private->hw_ctx, ctx_hw_private->mode,
+		ctx_hw_private->cdm_handle);
+
+	return 0;
+error:
+	kfree(ctx_hw_private);
+	kfree(cdm_cmd);
+	return rc;
+}
+
+int cam_fd_hw_release(void *hw_priv, void *hw_release_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	int rc = -EINVAL;
+	struct cam_fd_ctx_hw_private *ctx_hw_private;
+	struct cam_fd_hw_release_args *release_args =
+		(struct cam_fd_hw_release_args *)hw_release_args;
+
+	if (!fd_hw || !release_args) {
+		CAM_ERR(CAM_FD, "Invalid input %pK, %pK", fd_hw, release_args);
+		return -EINVAL;
+	}
+
+	if (arg_size != sizeof(struct cam_fd_hw_release_args)) {
+		CAM_ERR(CAM_FD, "Invalid arg size %u, %zu", arg_size,
+			sizeof(struct cam_fd_hw_release_args));
+		return -EINVAL;
+	}
+
+	ctx_hw_private =
+		(struct cam_fd_ctx_hw_private *)release_args->ctx_hw_private;
+
+	rc = cam_cdm_release(ctx_hw_private->cdm_handle);
+	if (rc)
+		CAM_ERR(CAM_FD, "Release cdm handle failed, handle=0x%x, rc=%d",
+			ctx_hw_private->cdm_handle, rc);
+
+	kfree(ctx_hw_private->cdm_cmd);
+	kfree(ctx_hw_private);
+	release_args->ctx_hw_private = NULL;
+
+	return 0;
+}
+
+int cam_fd_hw_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *fd_hw = (struct cam_hw_info *)hw_priv;
+	int rc = -EINVAL;
+
+	if (!hw_priv || !cmd_args ||
+		(cmd_type >= CAM_FD_HW_CMD_MAX)) {
+		CAM_ERR(CAM_FD, "Invalid arguments %pK %pK %d", hw_priv,
+			cmd_args, cmd_type);
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_FD_HW_CMD_REGISTER_CALLBACK: {
+		struct cam_fd_hw_cmd_set_irq_cb *irq_cb_args;
+		struct cam_fd_core *fd_core =
+			(struct cam_fd_core *)fd_hw->core_info;
+
+		if (sizeof(struct cam_fd_hw_cmd_set_irq_cb) != arg_size) {
+			CAM_ERR(CAM_FD, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		irq_cb_args = (struct cam_fd_hw_cmd_set_irq_cb *)cmd_args;
+		fd_core->irq_cb.cam_fd_hw_mgr_cb =
+			irq_cb_args->cam_fd_hw_mgr_cb;
+		fd_core->irq_cb.data = irq_cb_args->data;
+		rc = 0;
+		break;
+	}
+	case CAM_FD_HW_CMD_PRESTART: {
+		struct cam_fd_hw_cmd_prestart_args *prestart_args;
+
+		if (sizeof(struct cam_fd_hw_cmd_prestart_args) != arg_size) {
+			CAM_ERR(CAM_FD, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		prestart_args = (struct cam_fd_hw_cmd_prestart_args *)cmd_args;
+		rc = cam_fd_hw_util_processcmd_prestart(fd_hw, prestart_args);
+		break;
+	}
+	case CAM_FD_HW_CMD_FRAME_DONE: {
+		struct cam_fd_hw_frame_done_args *cmd_frame_results;
+
+		if (sizeof(struct cam_fd_hw_frame_done_args) !=
+			arg_size) {
+			CAM_ERR(CAM_FD, "cmd_type %d, size mismatch %d",
+				cmd_type, arg_size);
+			break;
+		}
+
+		cmd_frame_results =
+			(struct cam_fd_hw_frame_done_args *)cmd_args;
+		rc = cam_fd_hw_util_processcmd_frame_done(fd_hw,
+			cmd_frame_results);
+		break;
+	}
+	case CAM_FD_HW_CMD_HW_DUMP: {
+		rc = cam_fd_hw_util_processcmd_hw_dump(fd_hw,
+			cmd_args);
+		break;
+	}
+	default:
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_core.h
@@ -0,0 +1,239 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_CORE_H_
+#define _CAM_FD_HW_CORE_H_
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_defs.h>
+#include <media/cam_fd.h>
+
+#include "cam_common_util.h"
+#include "cam_debug_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_fd_hw_intf.h"
+#include "cam_fd_hw_soc.h"
+
+#define CAM_FD_IRQ_TO_MASK(irq)        (1 << (irq))
+#define CAM_FD_MASK_TO_IRQ(mask, irq)  ((mask) >> (irq))
+
+#define CAM_FD_HW_HALT_RESET_TIMEOUT   750
+
+/**
+ * enum cam_fd_core_state - FD Core internal states
+ *
+ * @CAM_FD_CORE_STATE_POWERDOWN       : Indicates FD core is powered down
+ * @CAM_FD_CORE_STATE_IDLE            : Indicates FD HW is in idle state.
+ *                                      Core can be in this state when it is
+ *                                      ready to process frames or when
+ *                                      processing is finished and results are
+ *                                      available
+ * @CAM_FD_CORE_STATE_PROCESSING      : Indicates FD core is processing frame
+ * @CAM_FD_CORE_STATE_READING_RESULTS : Indicates results are being read from
+ *                                      FD core
+ * @CAM_FD_CORE_STATE_RESET_PROGRESS  :  Indicates FD Core is in reset state
+ */
+enum cam_fd_core_state {
+	CAM_FD_CORE_STATE_POWERDOWN,
+	CAM_FD_CORE_STATE_IDLE,
+	CAM_FD_CORE_STATE_PROCESSING,
+	CAM_FD_CORE_STATE_READING_RESULTS,
+	CAM_FD_CORE_STATE_RESET_PROGRESS,
+};
+
+/**
+ * struct cam_fd_ctx_hw_private : HW private information for a specific hw ctx.
+ *                                This information is populated by HW layer on
+ *                                reserve() and given back to HW Mgr as private
+ *                                data for the hw context. This private_data
+ *                                has to be passed by HW Mgr layer while
+ *                                further HW layer calls
+ *
+ * @hw_ctx           : Corresponding hw_ctx pointer
+ * @fd_hw            : FD HW info pointer
+ * @cdm_handle       : CDM Handle for this context
+ * @cdm_ops          : CDM Ops
+ * @cdm_cmd          : CDM command pointer
+ * @mode             : Mode this context is running
+ * @curr_req_private : Current Request information
+ *
+ */
+struct cam_fd_ctx_hw_private {
+	void                          *hw_ctx;
+	struct cam_hw_info            *fd_hw;
+	uint32_t                       cdm_handle;
+	struct cam_cdm_utils_ops      *cdm_ops;
+	struct cam_cdm_bl_request     *cdm_cmd;
+	enum cam_fd_hw_mode            mode;
+	struct cam_fd_hw_req_private  *curr_req_private;
+};
+
+/**
+ * struct cam_fd_core_regs : FD HW Core register offsets info
+ *
+ * @version              : Offset of version register
+ * @control              : Offset of control register
+ * @result_cnt           : Offset of result count register
+ * @result_addr          : Offset of results address register
+ * @image_addr           : Offset of image address register
+ * @work_addr            : Offset of work address register
+ * @ro_mode              : Offset of ro_mode register
+ * @results_reg_base     : Offset of results_reg_base register
+ * @raw_results_reg_base : Offset of raw_results_reg_base register
+ *
+ */
+struct cam_fd_core_regs {
+	uint32_t       version;
+	uint32_t       control;
+	uint32_t       result_cnt;
+	uint32_t       result_addr;
+	uint32_t       image_addr;
+	uint32_t       work_addr;
+	uint32_t       ro_mode;
+	uint32_t       results_reg_base;
+	uint32_t       raw_results_reg_base;
+};
+
+/**
+ * struct cam_fd_core_regs : FD HW Wrapper register offsets info
+ *
+ * @wrapper_version     : Offset of wrapper_version register
+ * @cgc_disable         : Offset of cgc_disable register
+ * @hw_stop             : Offset of hw_stop register
+ * @sw_reset            : Offset of sw_reset register
+ * @vbif_req_priority   : Offset of vbif_req_priority register
+ * @vbif_priority_level : Offset of vbif_priority_level register
+ * @vbif_done_status    : Offset of vbif_done_status register
+ * @irq_mask            : Offset of irq mask register
+ * @irq_status          : Offset of irq status register
+ * @irq_clear           : Offset of irq clear register
+ *
+ */
+struct cam_fd_wrapper_regs {
+	uint32_t       wrapper_version;
+	uint32_t       cgc_disable;
+	uint32_t       hw_stop;
+	uint32_t       sw_reset;
+	uint32_t       vbif_req_priority;
+	uint32_t       vbif_priority_level;
+	uint32_t       vbif_done_status;
+	uint32_t       irq_mask;
+	uint32_t       irq_status;
+	uint32_t       irq_clear;
+};
+
+/**
+ * struct cam_fd_hw_errata_wa : FD HW Errata workaround enable/dsiable info
+ *
+ * @single_irq_only         : Whether to enable only one irq at any time
+ * @ro_mode_enable_always   : Whether to enable ro mode always
+ * @ro_mode_results_invalid : Whether results written directly into output
+ *                            memory by HW are valid or not
+ * @skip_reset              : Whether to skip reset during init
+ */
+struct cam_fd_hw_errata_wa {
+	bool   single_irq_only;
+	bool   ro_mode_enable_always;
+	bool   ro_mode_results_invalid;
+	bool   skip_reset;
+};
+
+/**
+ * struct cam_fd_hw_results_prop : FD HW Results properties
+ *
+ * @max_faces             : Maximum number of faces supported
+ * @per_face_entries      : Number of register with properties for each face
+ * @raw_results_entries   : Number of raw results entries for the full search
+ * @raw_results_available : Whether raw results available on this HW
+ *
+ */
+struct cam_fd_hw_results_prop {
+	uint32_t       max_faces;
+	uint32_t       per_face_entries;
+	uint32_t       raw_results_entries;
+	bool           raw_results_available;
+};
+
+/**
+ * struct cam_fd_hw_static_info : FD HW information based on HW version
+ *
+ * @core_version       : Core version of FD HW
+ * @wrapper_version    : Wrapper version of FD HW
+ * @core_regs          : Register offset information for core registers
+ * @wrapper_regs       : Register offset information for wrapper registers
+ * @results            : Information about results available on this HW
+ * @enable_errata_wa   : Errata workaround information
+ * @irq_mask           : IRQ mask to enable
+ * @qos_priority       : QoS priority setting for this chipset
+ * @qos_priority_level : QoS priority level setting for this chipset
+ * @supported_modes    : Supported HW modes on this HW version
+ * @ro_mode_supported  : Whether RO mode is supported on this HW
+ *
+ */
+struct cam_fd_hw_static_info {
+	struct cam_hw_version          core_version;
+	struct cam_hw_version          wrapper_version;
+	struct cam_fd_core_regs        core_regs;
+	struct cam_fd_wrapper_regs     wrapper_regs;
+	struct cam_fd_hw_results_prop  results;
+	struct cam_fd_hw_errata_wa     enable_errata_wa;
+	uint32_t                       irq_mask;
+	uint32_t                       qos_priority;
+	uint32_t                       qos_priority_level;
+	uint32_t                       supported_modes;
+	bool                           ro_mode_supported;
+};
+
+/**
+ * struct cam_fd_core : FD HW core data structure
+ *
+ * @hw_static_info      : HW information specific to version
+ * @hw_caps             : HW capabilities
+ * @core_state          : Current HW state
+ * @processing_complete : Whether processing is complete
+ * @reset_complete      : Whether reset is complete
+ * @halt_complete       : Whether halt is complete
+ * @hw_req_private      : Request that is being currently processed by HW
+ * @results_valid       : Whether HW frame results are available to get
+ * @spin_lock           : Mutex to protect shared data in hw layer
+ * @irq_cb              : HW Manager callback information
+ *
+ */
+struct cam_fd_core {
+	struct cam_fd_hw_static_info   *hw_static_info;
+	struct cam_fd_hw_caps           hw_caps;
+	enum cam_fd_core_state          core_state;
+	struct completion               processing_complete;
+	struct completion               reset_complete;
+	struct completion               halt_complete;
+	struct cam_fd_hw_req_private   *hw_req_private;
+	bool                            results_valid;
+	spinlock_t                      spin_lock;
+	struct cam_fd_hw_cmd_set_irq_cb irq_cb;
+};
+
+int cam_fd_hw_util_get_hw_caps(struct cam_hw_info *fd_hw,
+	struct cam_fd_hw_caps *hw_caps);
+irqreturn_t cam_fd_hw_irq(int irq_num, void *data);
+
+int cam_fd_hw_get_hw_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size);
+int cam_fd_hw_init(void *hw_priv, void *init_hw_args, uint32_t arg_size);
+int cam_fd_hw_deinit(void *hw_priv, void *deinit_hw_args, uint32_t arg_size);
+int cam_fd_hw_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size);
+int cam_fd_hw_reserve(void *hw_priv, void *hw_reserve_args, uint32_t arg_size);
+int cam_fd_hw_release(void *hw_priv, void *hw_release_args, uint32_t arg_size);
+int cam_fd_hw_start(void *hw_priv, void *hw_start_args, uint32_t arg_size);
+int cam_fd_hw_halt_reset(void *hw_priv, void *stop_args, uint32_t arg_size);
+int cam_fd_hw_read(void *hw_priv, void *read_args, uint32_t arg_size);
+int cam_fd_hw_write(void *hw_priv, void *write_args, uint32_t arg_size);
+int cam_fd_hw_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+#endif /* _CAM_FD_HW_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_dev.c
@@ -0,0 +1,259 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_subdev.h"
+#include "cam_fd_hw_intf.h"
+#include "cam_fd_hw_core.h"
+#include "cam_fd_hw_soc.h"
+#include "cam_fd_hw_v41.h"
+#include "cam_fd_hw_v501.h"
+#include "cam_fd_hw_v600.h"
+#include "camera_main.h"
+
+static char fd_dev_name[8];
+
+static int cam_fd_hw_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *fd_hw;
+	struct cam_hw_intf *fd_hw_intf;
+	struct cam_fd_core *fd_core;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_fd_hw_static_info *hw_static_info = NULL;
+	int rc = 0;
+	uint32_t hw_idx;
+	struct cam_fd_hw_init_args init_args;
+	struct cam_fd_hw_deinit_args deinit_args;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	fd_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!fd_hw_intf)
+		return -ENOMEM;
+
+	fd_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!fd_hw) {
+		kfree(fd_hw_intf);
+		return -ENOMEM;
+	}
+
+	fd_core = kzalloc(sizeof(struct cam_fd_core), GFP_KERNEL);
+	if (!fd_core) {
+		kfree(fd_hw);
+		kfree(fd_hw_intf);
+		return -ENOMEM;
+	}
+	of_property_read_u32(pdev->dev.of_node,
+			"cell-index", &hw_idx);
+
+	fd_hw_intf->hw_priv = fd_hw;
+	fd_hw->core_info = fd_core;
+	fd_hw_intf->hw_idx = hw_idx;
+
+	memset(fd_dev_name, 0, sizeof(fd_dev_name));
+	snprintf(fd_dev_name, sizeof(fd_dev_name),
+		"fd%1u", fd_hw_intf->hw_idx);
+
+	fd_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	fd_hw->soc_info.pdev = pdev;
+	fd_hw->soc_info.dev = &pdev->dev;
+	fd_hw->soc_info.dev_name = fd_dev_name;
+	fd_hw->open_count = 0;
+	mutex_init(&fd_hw->hw_mutex);
+	spin_lock_init(&fd_hw->hw_lock);
+	init_completion(&fd_hw->hw_complete);
+
+	spin_lock_init(&fd_core->spin_lock);
+	init_completion(&fd_core->processing_complete);
+	init_completion(&fd_core->halt_complete);
+	init_completion(&fd_core->reset_complete);
+
+	fd_hw_intf->hw_ops.get_hw_caps = cam_fd_hw_get_hw_caps;
+	fd_hw_intf->hw_ops.init = cam_fd_hw_init;
+	fd_hw_intf->hw_ops.deinit = cam_fd_hw_deinit;
+	fd_hw_intf->hw_ops.reset = cam_fd_hw_reset;
+	fd_hw_intf->hw_ops.reserve = cam_fd_hw_reserve;
+	fd_hw_intf->hw_ops.release = cam_fd_hw_release;
+	fd_hw_intf->hw_ops.start = cam_fd_hw_start;
+	fd_hw_intf->hw_ops.stop = cam_fd_hw_halt_reset;
+	fd_hw_intf->hw_ops.read = NULL;
+	fd_hw_intf->hw_ops.write = NULL;
+	fd_hw_intf->hw_ops.process_cmd = cam_fd_hw_process_cmd;
+	fd_hw_intf->hw_type = CAM_HW_FD;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev || !match_dev->data) {
+		CAM_ERR(CAM_FD, "No Of_match data, %pK", match_dev);
+		rc = -EINVAL;
+		goto free_memory;
+	}
+	hw_static_info = (struct cam_fd_hw_static_info *)match_dev->data;
+	fd_core->hw_static_info = hw_static_info;
+
+	CAM_DBG(CAM_FD, "HW Static Info : version core[%d.%d] wrapper[%d.%d]",
+		hw_static_info->core_version.major,
+		hw_static_info->core_version.minor,
+		hw_static_info->wrapper_version.major,
+		hw_static_info->wrapper_version.minor);
+
+	rc = cam_fd_soc_init_resources(&fd_hw->soc_info, cam_fd_hw_irq, fd_hw);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to init soc, rc=%d", rc);
+		goto free_memory;
+	}
+
+	memset(&init_args, 0x0, sizeof(init_args));
+	memset(&deinit_args, 0x0, sizeof(deinit_args));
+	init_args.reset_required = true;
+	rc = cam_fd_hw_init(fd_hw, &init_args, sizeof(init_args));
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to hw init, rc=%d", rc);
+		goto deinit_platform_res;
+	}
+
+	rc = cam_fd_hw_util_get_hw_caps(fd_hw, &fd_core->hw_caps);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to get hw caps, rc=%d", rc);
+		goto deinit_hw;
+	}
+
+	rc = cam_fd_hw_deinit(fd_hw, &deinit_args, sizeof(deinit_args));
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed to deinit hw, rc=%d", rc);
+		goto deinit_platform_res;
+	}
+
+	platform_set_drvdata(pdev, fd_hw_intf);
+	CAM_DBG(CAM_FD, "FD:%d component bound successfully",
+		fd_hw_intf->hw_idx);
+
+	return rc;
+
+deinit_hw:
+	if (cam_fd_hw_deinit(fd_hw, &deinit_args, sizeof(deinit_args)))
+		CAM_ERR(CAM_FD, "Failed in hw deinit");
+deinit_platform_res:
+	if (cam_fd_soc_deinit_resources(&fd_hw->soc_info))
+		CAM_ERR(CAM_FD, "Failed in soc deinit");
+	mutex_destroy(&fd_hw->hw_mutex);
+free_memory:
+	kfree(fd_hw);
+	kfree(fd_hw_intf);
+	kfree(fd_core);
+
+	return rc;
+}
+
+static void cam_fd_hw_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct cam_hw_intf *fd_hw_intf;
+	struct cam_hw_info *fd_hw;
+	struct cam_fd_core *fd_core;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	fd_hw_intf = platform_get_drvdata(pdev);
+	if (!fd_hw_intf) {
+		CAM_ERR(CAM_FD, "Invalid fd_hw_intf from pdev");
+		return;
+	}
+
+	fd_hw = fd_hw_intf->hw_priv;
+	if (!fd_hw) {
+		CAM_ERR(CAM_FD, "Invalid fd_hw from fd_hw_intf");
+		goto free_fd_hw_intf;
+	}
+
+	fd_core = (struct cam_fd_core *)fd_hw->core_info;
+	if (!fd_core) {
+		CAM_ERR(CAM_FD, "Invalid fd_core from fd_hw");
+		goto deinit_platform_res;
+	}
+
+	kfree(fd_core);
+
+deinit_platform_res:
+	rc = cam_fd_soc_deinit_resources(&fd_hw->soc_info);
+	if (rc)
+		CAM_ERR(CAM_FD, "Error in FD soc deinit, rc=%d", rc);
+
+	mutex_destroy(&fd_hw->hw_mutex);
+	kfree(fd_hw);
+
+free_fd_hw_intf:
+	kfree(fd_hw_intf);
+}
+
+const static struct component_ops cam_fd_hw_dev_component_ops = {
+	.bind = cam_fd_hw_dev_component_bind,
+	.unbind = cam_fd_hw_dev_component_unbind,
+};
+
+static int cam_fd_hw_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_FD, "Adding FD HW dev component");
+	rc = component_add(&pdev->dev, &cam_fd_hw_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_FD, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_fd_hw_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_fd_hw_dev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_fd_hw_dt_match[] = {
+	{
+		.compatible = "qcom,fd41",
+		.data = &cam_fd_wrapper120_core410_info,
+	},
+	{
+		.compatible = "qcom,fd501",
+		.data = &cam_fd_wrapper200_core501_info,
+	},
+	{
+		.compatible = "qcom,fd600",
+		.data = &cam_fd_wrapper200_core600_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_fd_hw_dt_match);
+
+struct platform_driver cam_fd_hw_driver = {
+	.probe = cam_fd_hw_dev_probe,
+	.remove = cam_fd_hw_dev_remove,
+	.driver = {
+		.name = "cam_fd_hw",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_fd_hw_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_fd_hw_init_module(void)
+{
+	return platform_driver_register(&cam_fd_hw_driver);
+}
+
+void cam_fd_hw_exit_module(void)
+{
+	platform_driver_unregister(&cam_fd_hw_driver);
+}
+
+MODULE_DESCRIPTION("CAM FD HW driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_intf.h
@@ -0,0 +1,330 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_INTF_H_
+#define _CAM_FD_HW_INTF_H_
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_fd.h>
+
+#include "cam_io_util.h"
+#include "cam_soc_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_subdev.h"
+#include "cam_cpas_api.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+
+#define CAM_FD_MAX_IO_BUFFERS        5
+#define CAM_FD_MAX_HW_ENTRIES        5
+#define CAM_FD_HW_DUMP_TAG_MAX_LEN   32
+#define CAM_FD_HW_DUMP_NUM_WORDS     5
+
+/**
+ * enum cam_fd_hw_type - Enum for FD HW type
+ *
+ * @CAM_HW_FD : FaceDetection HW type
+ */
+enum cam_fd_hw_type {
+	CAM_HW_FD,
+};
+
+/**
+ * enum cam_fd_hw_mode - Mode in which HW can run
+ *
+ * @CAM_FD_MODE_FACEDETECTION : Face Detection mode in which face search
+ *                              is done on the given frame
+ * @CAM_FD_MODE_PYRAMID       : Pyramid mode where a pyramid image is generated
+ *                              from an input image
+ */
+enum cam_fd_hw_mode {
+	CAM_FD_MODE_FACEDETECTION    = 0x1,
+	CAM_FD_MODE_PYRAMID          = 0x2,
+};
+
+/**
+ * enum cam_fd_priority - FD priority levels
+ *
+ * @CAM_FD_PRIORITY_HIGH   : Indicates high priority client, driver prioritizes
+ *                           frame requests coming from contexts with HIGH
+ *                           priority compared to context with normal priority
+ * @CAM_FD_PRIORITY_NORMAL : Indicates normal priority client
+ */
+enum cam_fd_priority {
+	CAM_FD_PRIORITY_HIGH         = 0x0,
+	CAM_FD_PRIORITY_NORMAL,
+};
+
+/**
+ * enum cam_fd_hw_irq_type - FD HW IRQ types
+ *
+ * @CAM_FD_IRQ_FRAME_DONE : Indicates frame processing is finished
+ * @CAM_FD_IRQ_HALT_DONE  : Indicates HW halt is finished
+ * @CAM_FD_IRQ_RESET_DONE : Indicates HW reset is finished
+ */
+enum cam_fd_hw_irq_type {
+	CAM_FD_IRQ_FRAME_DONE,
+	CAM_FD_IRQ_HALT_DONE,
+	CAM_FD_IRQ_RESET_DONE,
+};
+
+/**
+ * enum cam_fd_hw_cmd_type - FD HW layer custom commands
+ *
+ * @CAM_FD_HW_CMD_PRESTART          : Command to process pre-start settings
+ * @CAM_FD_HW_CMD_FRAME_DONE        : Command to process frame done settings
+ * @CAM_FD_HW_CMD_UPDATE_SOC        : Command to process soc update
+ * @CAM_FD_HW_CMD_REGISTER_CALLBACK : Command to set hw mgr callback
+ * @CAM_FD_HW_CMD_MAX               : Indicates max cmd
+ * @CAM_FD_HW_CMD_HW_DUMP           : Command to dump fd hw information
+ */
+enum cam_fd_hw_cmd_type {
+	CAM_FD_HW_CMD_PRESTART,
+	CAM_FD_HW_CMD_FRAME_DONE,
+	CAM_FD_HW_CMD_UPDATE_SOC,
+	CAM_FD_HW_CMD_REGISTER_CALLBACK,
+	CAM_FD_HW_CMD_HW_DUMP,
+	CAM_FD_HW_CMD_MAX,
+};
+
+/**
+ * struct cam_fd_hw_io_buffer : FD HW IO Buffer information
+ *
+ * @valid    : Whether this IO Buf configuration is valid
+ * @io_cfg   : IO Configuration information
+ * @num_buf  : Number planes in io_addr, cpu_addr array
+ * @io_addr  : Array of IO address information for planes
+ * @cpu_addr : Array of CPU address information for planes
+ */
+struct cam_fd_hw_io_buffer {
+	bool                   valid;
+	struct cam_buf_io_cfg *io_cfg;
+	uint32_t               num_buf;
+	uint64_t               io_addr[CAM_PACKET_MAX_PLANES];
+	uintptr_t              cpu_addr[CAM_PACKET_MAX_PLANES];
+};
+
+/**
+ * struct cam_fd_hw_req_private : FD HW layer's private information
+ *               specific to a request
+ *
+ * @ctx_hw_private  : FD HW layer's ctx specific private data
+ * @request_id      : Request ID corresponding to this private information
+ * @get_raw_results : Whether to get raw results for this request
+ * @ro_mode_enabled : Whether RO mode is enabled for this request
+ * @fd_results      : Pointer to save face detection results
+ * @raw_results     : Pointer to save face detection raw results
+ */
+struct cam_fd_hw_req_private {
+	void                  *ctx_hw_private;
+	uint64_t               request_id;
+	bool                   get_raw_results;
+	bool                   ro_mode_enabled;
+	struct cam_fd_results *fd_results;
+	uint32_t              *raw_results;
+};
+
+/**
+ * struct cam_fd_hw_reserve_args : Reserve args for this HW context
+ *
+ * @hw_ctx         : HW context for which reserve is requested
+ * @mode           : Mode for which this reserve is requested
+ * @ctx_hw_private : Pointer to save HW layer's private information specific
+ *                   to this hw context. This has to be passed while calling
+ *                   further HW layer calls
+ */
+struct cam_fd_hw_reserve_args {
+	void                  *hw_ctx;
+	enum cam_fd_hw_mode    mode;
+	void                  *ctx_hw_private;
+};
+
+/**
+ * struct cam_fd_hw_release_args : Release args for this HW context
+ *
+ * @hw_ctx         : HW context for which release is requested
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ */
+struct cam_fd_hw_release_args {
+	void    *hw_ctx;
+	void    *ctx_hw_private;
+};
+
+/**
+ * struct cam_fd_hw_init_args : Init args for this HW context
+ *
+ * @hw_ctx         : HW context for which init is requested
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ * @reset_required : Indicates if the reset is required during init or not
+ * @is_hw_reset    : Output from hw layer, whether hw is reset on this init
+ */
+struct cam_fd_hw_init_args {
+	void    *hw_ctx;
+	void    *ctx_hw_private;
+	bool     reset_required;
+	bool     is_hw_reset;
+};
+
+/**
+ * struct cam_fd_hw_deinit_args : Deinit args for this HW context
+ *
+ * @hw_ctx         : HW context for which deinit is requested
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ */
+struct cam_fd_hw_deinit_args {
+	void    *hw_ctx;
+	void    *ctx_hw_private;
+};
+
+/**
+ * struct cam_fd_hw_cmd_prestart_args : Prestart command args
+ *
+ * @hw_ctx               : HW context which submitted this prestart
+ * @ctx_hw_private       : HW layer's private information specific to
+ *                         this hw context
+ * @request_id           : Request ID corresponds to this pre-start command
+ * @get_raw_results      : Whether to get raw results for this request
+ * @input_buf            : Input IO Buffer information for this request
+ * @output_buf           : Output IO Buffer information for this request
+ * @cmd_buf_addr         : Command buffer address to fill kmd commands
+ * @size                 : Size available in command buffer
+ * @pre_config_buf_size  : Buffer size filled with commands by KMD that has
+ *                         to be inserted before umd commands
+ * @post_config_buf_size : Buffer size filled with commands by KMD that has
+ *                         to be inserted after umd commands
+ * @hw_req_private       : HW layer's private information specific to
+ *                         this request
+ */
+struct cam_fd_hw_cmd_prestart_args {
+	void                         *hw_ctx;
+	void                         *ctx_hw_private;
+	uint64_t                      request_id;
+	bool                          get_raw_results;
+	struct cam_fd_hw_io_buffer    input_buf[CAM_FD_MAX_IO_BUFFERS];
+	struct cam_fd_hw_io_buffer    output_buf[CAM_FD_MAX_IO_BUFFERS];
+	uint32_t                     *cmd_buf_addr;
+	uint32_t                      size;
+	uint32_t                      pre_config_buf_size;
+	uint32_t                      post_config_buf_size;
+	struct cam_fd_hw_req_private  hw_req_private;
+};
+
+/**
+ * struct cam_fd_hw_cmd_start_args : Start command args
+ *
+ * @hw_ctx                : HW context which submitting start command
+ * @ctx_hw_private        : HW layer's private information specific to
+ *                            this hw context
+ * @hw_req_private        : HW layer's private information specific to
+ *          this request
+ * @hw_update_entries     : HW update entries corresponds to this request
+ * @num_hw_update_entries : Number of hw update entries
+ */
+struct cam_fd_hw_cmd_start_args {
+	void                          *hw_ctx;
+	void                          *ctx_hw_private;
+	struct cam_fd_hw_req_private  *hw_req_private;
+	struct cam_hw_update_entry    *hw_update_entries;
+	uint32_t                       num_hw_update_entries;
+};
+
+/**
+ * struct cam_fd_hw_stop_args : Stop command args
+ *
+ * @hw_ctx         : HW context which submitting stop command
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ * @request_id     : Request ID that need to be stopped
+ * @hw_req_private : HW layer's private information specific to this request
+ */
+struct cam_fd_hw_stop_args {
+	void                         *hw_ctx;
+	void                         *ctx_hw_private;
+	uint64_t                      request_id;
+	struct cam_fd_hw_req_private *hw_req_private;
+};
+
+/**
+ * struct cam_fd_hw_frame_done_args : Frame done command args
+ *
+ * @hw_ctx         : HW context which submitting frame done request
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ * @request_id     : Request ID that need to be stopped
+ * @hw_req_private : HW layer's private information specific to this request
+ */
+struct cam_fd_hw_frame_done_args {
+	void                         *hw_ctx;
+	void                         *ctx_hw_private;
+	uint64_t                      request_id;
+	struct cam_fd_hw_req_private *hw_req_private;
+};
+
+/**
+ * struct cam_fd_hw_reset_args : Reset command args
+ *
+ * @hw_ctx         : HW context which submitting reset command
+ * @ctx_hw_private : HW layer's private information specific to this hw context
+ */
+struct cam_fd_hw_reset_args {
+	void    *hw_ctx;
+	void    *ctx_hw_private;
+};
+
+/**
+ * struct cam_fd_hw_cmd_set_irq_cb : Set IRQ callback command args
+ *
+ * @cam_fd_hw_mgr_cb : HW Mgr's callback pointer
+ * @data             : HW Mgr's private data
+ */
+struct cam_fd_hw_cmd_set_irq_cb {
+	int (*cam_fd_hw_mgr_cb)(void *data, enum cam_fd_hw_irq_type irq_type);
+	void *data;
+};
+
+/**
+ * struct cam_fd_hw_dump_args : Args for dump request
+ *
+ * @request_id   : Issue request id
+ * @offset       : offset of the buffer
+ * @buf_len      : Length of target buffer
+ * @cpu_addr     : start address of the target buffer
+ */
+struct cam_fd_hw_dump_args {
+	uint64_t  request_id;
+	size_t    offset;
+	size_t    buf_len;
+	uintptr_t cpu_addr;
+};
+
+/**
+ * struct cam_fd_hw_dump_header : fd hw dump header
+ *
+ * @tag       : fd hw dump header tag
+ * @size      : Size of data
+ * @word_size : size of each word
+ */
+struct cam_fd_hw_dump_header {
+	uint8_t  tag[CAM_FD_HW_DUMP_TAG_MAX_LEN];
+	uint64_t size;
+	uint32_t word_size;
+};
+
+/**
+ * @brief : API to register FD Hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_fd_hw_init_module(void);
+
+/**
+ * @brief : API to remove FD Hw interface from platform framework.
+ */
+void cam_fd_hw_exit_module(void);
+
+#endif /* _CAM_FD_HW_INTF_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.c
@@ -0,0 +1,257 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/clk/qcom.h>
+
+#include "cam_fd_hw_core.h"
+#include "cam_fd_hw_soc.h"
+
+static bool cam_fd_hw_util_cpas_callback(uint32_t handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	if (!irq_data)
+		return false;
+
+	CAM_DBG(CAM_FD, "CPAS hdl=%d, udata=%pK, irq_type=%d",
+		handle, userdata, irq_data->irq_type);
+
+	return false;
+}
+
+static int cam_fd_hw_soc_util_setup_regbase_indices(
+	struct cam_hw_soc_info *soc_info)
+{
+	struct cam_fd_soc_private *soc_private =
+		(struct cam_fd_soc_private *)soc_info->soc_private;
+	uint32_t index;
+	int rc, i;
+
+	for (i = 0; i < CAM_FD_REG_MAX; i++)
+		soc_private->regbase_index[i] = -1;
+
+	if ((soc_info->num_mem_block > CAM_SOC_MAX_BLOCK) ||
+		(soc_info->num_mem_block != CAM_FD_REG_MAX)) {
+		CAM_ERR(CAM_FD, "Invalid num_mem_block=%d",
+			soc_info->num_mem_block);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "fd_core", &index);
+	if ((rc == 0) && (index < CAM_FD_REG_MAX)) {
+		soc_private->regbase_index[CAM_FD_REG_CORE] = index;
+	} else {
+		CAM_ERR(CAM_FD, "regbase not found for FD_CORE, rc=%d, %d %d",
+			rc, index, CAM_FD_REG_MAX);
+		return -EINVAL;
+	}
+
+	rc = cam_common_util_get_string_index(soc_info->mem_block_name,
+		soc_info->num_mem_block, "fd_wrapper", &index);
+	if ((rc == 0) && (index < CAM_FD_REG_MAX)) {
+		soc_private->regbase_index[CAM_FD_REG_WRAPPER] = index;
+	} else {
+		CAM_ERR(CAM_FD, "regbase not found FD_WRAPPER, rc=%d, %d %d",
+			rc, index, CAM_FD_REG_MAX);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_FD, "Reg indices : CORE=%d, WRAPPER=%d",
+		soc_private->regbase_index[CAM_FD_REG_CORE],
+		soc_private->regbase_index[CAM_FD_REG_WRAPPER]);
+
+	return 0;
+}
+
+void cam_fd_soc_register_write(struct cam_hw_soc_info *soc_info,
+	enum cam_fd_reg_base reg_base, uint32_t reg_offset, uint32_t reg_value)
+{
+	struct cam_fd_soc_private *soc_private =
+		(struct cam_fd_soc_private *)soc_info->soc_private;
+	int32_t reg_index = soc_private->regbase_index[reg_base];
+
+	CAM_DBG(CAM_FD, "FD_REG_WRITE: Base[%d] Offset[0x%8x] Value[0x%8x]",
+		reg_base, reg_offset, reg_value);
+
+	cam_io_w_mb(reg_value,
+		soc_info->reg_map[reg_index].mem_base + reg_offset);
+}
+
+uint32_t cam_fd_soc_register_read(struct cam_hw_soc_info *soc_info,
+	enum cam_fd_reg_base reg_base, uint32_t reg_offset)
+{
+	struct cam_fd_soc_private *soc_private =
+		(struct cam_fd_soc_private *)soc_info->soc_private;
+	int32_t reg_index = soc_private->regbase_index[reg_base];
+	uint32_t reg_value;
+
+	reg_value = cam_io_r_mb(
+		soc_info->reg_map[reg_index].mem_base + reg_offset);
+
+	CAM_DBG(CAM_FD, "FD_REG_READ: Base[%d] Offset[0x%8x] Value[0x%8x]",
+		reg_base, reg_offset, reg_value);
+
+	return reg_value;
+}
+
+int cam_fd_soc_enable_resources(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_fd_soc_private *soc_private = soc_info->soc_private;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	int rc;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ib_bw = 7200000;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = 7200000;
+	axi_vote.axi_path[1].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[1].mnoc_ib_bw = 7200000;
+
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in CPAS START, rc=%d", rc);
+		return -EFAULT;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true, CAM_SVS_VOTE,
+		true);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error enable platform failed, rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	if (cam_cpas_stop(soc_private->cpas_handle))
+		CAM_ERR(CAM_FD, "Error in CPAS STOP");
+
+	return rc;
+}
+
+
+int cam_fd_soc_disable_resources(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_fd_soc_private *soc_private;
+	int rc = 0;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_FD, "Invalid soc_info param");
+		return -EINVAL;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_FD, "disable platform resources failed, rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Error in CPAS STOP, handle=0x%x, rc=%d",
+			soc_private->cpas_handle, rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_fd_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *private_data)
+{
+	struct cam_fd_soc_private *soc_private;
+	struct cam_cpas_register_params cpas_register_param;
+	int rc;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in get_dt_properties, rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler,
+		private_data);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in request_platform_resource rc=%d",
+			rc);
+		return rc;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_fd_soc_private), GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto release_res;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_fd_hw_soc_util_setup_regbase_indices(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FD, "Failed in setup regbase, rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "fd",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = &soc_info->pdev->dev;
+	cpas_register_param.userdata = private_data;
+	cpas_register_param.cam_cpas_client_cb = cam_fd_hw_util_cpas_callback;
+
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_FD, "CPAS registration failed");
+		goto free_soc_private;
+	}
+	soc_private->cpas_handle = cpas_register_param.client_handle;
+	CAM_DBG(CAM_FD, "CPAS handle=%d", soc_private->cpas_handle);
+
+	return rc;
+
+free_soc_private:
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+release_res:
+	cam_soc_util_release_platform_resource(soc_info);
+
+	return rc;
+}
+
+int cam_fd_soc_deinit_resources(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_fd_soc_private *soc_private =
+		(struct cam_fd_soc_private *)soc_info->soc_private;
+	int rc;
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_FD, "Unregister cpas failed, handle=%d, rc=%d",
+			soc_private->cpas_handle, rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_FD, "release platform failed, rc=%d", rc);
+
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_soc.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_SOC_H_
+#define _CAM_FD_HW_SOC_H_
+
+#include "cam_soc_util.h"
+
+/**
+ * enum cam_fd_reg_base - Enum for FD register sets
+ *
+ * @CAM_FD_REG_CORE    : Indicates FD Core register space
+ * @CAM_FD_REG_WRAPPER : Indicates FD Wrapper register space
+ * @CAM_FD_REG_MAX     : Max number of register sets supported
+ */
+enum cam_fd_reg_base {
+	CAM_FD_REG_CORE,
+	CAM_FD_REG_WRAPPER,
+	CAM_FD_REG_MAX
+};
+
+/**
+ * struct cam_fd_soc_private : FD private SOC information
+ *
+ * @regbase_index : Mapping between Register base enum to register index in SOC
+ * @cpas_handle   : CPAS handle
+ *
+ */
+struct cam_fd_soc_private {
+	int32_t        regbase_index[CAM_FD_REG_MAX];
+	uint32_t       cpas_handle;
+};
+
+int cam_fd_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *private_data);
+int cam_fd_soc_deinit_resources(struct cam_hw_soc_info *soc_info);
+int cam_fd_soc_enable_resources(struct cam_hw_soc_info *soc_info);
+int cam_fd_soc_disable_resources(struct cam_hw_soc_info *soc_info);
+uint32_t cam_fd_soc_register_read(struct cam_hw_soc_info *soc_info,
+	enum cam_fd_reg_base reg_base, uint32_t reg_offset);
+void cam_fd_soc_register_write(struct cam_hw_soc_info *soc_info,
+	enum cam_fd_reg_base reg_base, uint32_t reg_offset, uint32_t reg_value);
+
+#endif /* _CAM_FD_HW_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v41.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v41.h
@@ -0,0 +1,63 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_V41_H_
+#define _CAM_FD_HW_V41_H_
+
+static struct cam_fd_hw_static_info cam_fd_wrapper120_core410_info = {
+	.core_version = {
+		.major  = 4,
+		.minor  = 1,
+		.incr   = 0,
+	},
+	.wrapper_version = {
+		.major  = 1,
+		.minor  = 2,
+		.incr   = 0,
+	},
+	.core_regs = {
+		.version               = 0x38,
+		.control               = 0x0,
+		.result_cnt            = 0x4,
+		.result_addr           = 0x20,
+		.image_addr            = 0x24,
+		.work_addr             = 0x28,
+		.ro_mode               = 0x34,
+		.results_reg_base      = 0x400,
+		.raw_results_reg_base  = 0x800,
+	},
+	.wrapper_regs = {
+		.wrapper_version       = 0x0,
+		.cgc_disable           = 0x4,
+		.hw_stop               = 0x8,
+		.sw_reset              = 0x10,
+		.vbif_req_priority     = 0x20,
+		.vbif_priority_level   = 0x24,
+		.vbif_done_status      = 0x34,
+		.irq_mask              = 0x50,
+		.irq_status            = 0x54,
+		.irq_clear             = 0x58,
+	},
+	.results = {
+		.max_faces             = 35,
+		.per_face_entries      = 4,
+		.raw_results_available = true,
+		.raw_results_entries   = 512,
+	},
+	.enable_errata_wa = {
+		.single_irq_only         = true,
+		.ro_mode_enable_always   = true,
+		.ro_mode_results_invalid = true,
+	},
+	.irq_mask = CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE),
+	.qos_priority       = 4,
+	.qos_priority_level = 4,
+	.supported_modes    = CAM_FD_MODE_FACEDETECTION | CAM_FD_MODE_PYRAMID,
+	.ro_mode_supported  = true,
+};
+
+#endif /* _CAM_FD_HW_V41_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v501.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v501.h
@@ -0,0 +1,64 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_V501_H_
+#define _CAM_FD_HW_V501_H_
+
+static struct cam_fd_hw_static_info cam_fd_wrapper200_core501_info = {
+	.core_version = {
+		.major  = 5,
+		.minor  = 0,
+		.incr   = 1,
+	},
+	.wrapper_version = {
+		.major  = 2,
+		.minor  = 0,
+		.incr   = 0,
+	},
+	.core_regs = {
+		.version               = 0x38,
+		.control               = 0x0,
+		.result_cnt            = 0x4,
+		.result_addr           = 0x20,
+		.image_addr            = 0x24,
+		.work_addr             = 0x28,
+		.ro_mode               = 0x34,
+		.results_reg_base      = 0x400,
+		.raw_results_reg_base  = 0x800,
+	},
+	.wrapper_regs = {
+		.wrapper_version       = 0x0,
+		.cgc_disable           = 0x4,
+		.hw_stop               = 0x8,
+		.sw_reset              = 0x10,
+		.vbif_req_priority     = 0x20,
+		.vbif_priority_level   = 0x24,
+		.vbif_done_status      = 0x34,
+		.irq_mask              = 0x50,
+		.irq_status            = 0x54,
+		.irq_clear             = 0x58,
+	},
+	.results = {
+		.max_faces             = 35,
+		.per_face_entries      = 4,
+		.raw_results_available = true,
+		.raw_results_entries   = 512,
+	},
+	.enable_errata_wa = {
+		.single_irq_only         = true,
+		.ro_mode_enable_always   = true,
+		.ro_mode_results_invalid = true,
+		.skip_reset              = true,
+	},
+	.irq_mask = CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE),
+	.qos_priority       = 4,
+	.qos_priority_level = 4,
+	.supported_modes    = CAM_FD_MODE_FACEDETECTION | CAM_FD_MODE_PYRAMID,
+	.ro_mode_supported  = true,
+};
+
+#endif /* _CAM_FD_HW_V501_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v600.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_fd/fd_hw_mgr/fd_hw/cam_fd_hw_v600.h
@@ -0,0 +1,61 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FD_HW_V600_H_
+#define _CAM_FD_HW_V600_H_
+
+static struct cam_fd_hw_static_info cam_fd_wrapper200_core600_info = {
+	.core_version = {
+		.major  = 6,
+		.minor  = 0,
+		.incr   = 0,
+	},
+	.wrapper_version = {
+		.major  = 2,
+		.minor  = 0,
+		.incr   = 0,
+	},
+	.core_regs = {
+		.version               = 0x38,
+		.control               = 0x0,
+		.result_cnt            = 0x4,
+		.result_addr           = 0x20,
+		.image_addr            = 0x24,
+		.work_addr             = 0x28,
+		.ro_mode               = 0x34,
+		.results_reg_base      = 0x400,
+	},
+	.wrapper_regs = {
+		.wrapper_version       = 0x0,
+		.cgc_disable           = 0x4,
+		.hw_stop               = 0x8,
+		.sw_reset              = 0x10,
+		.vbif_req_priority     = 0x20,
+		.vbif_priority_level   = 0x24,
+		.vbif_done_status      = 0x34,
+		.irq_mask              = 0x50,
+		.irq_status            = 0x54,
+		.irq_clear             = 0x58,
+	},
+	.results = {
+		.max_faces             = 35,
+		.per_face_entries      = 4,
+		.raw_results_available = false,
+	},
+	.enable_errata_wa = {
+		.single_irq_only         = true,
+		.ro_mode_enable_always   = true,
+		.ro_mode_results_invalid = true,
+	},
+	.irq_mask = CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_FRAME_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_HALT_DONE) |
+		CAM_FD_IRQ_TO_MASK(CAM_FD_IRQ_RESET_DONE),
+	.qos_priority       = 4,
+	.qos_priority_level = 4,
+	.supported_modes    = CAM_FD_MODE_FACEDETECTION | CAM_FD_MODE_PYRAMID,
+	.ro_mode_supported  = true,
+};
+
+#endif /* _CAM_FD_HW_V600_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/cam_icp_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/cam_icp_context.c
@@ -0,0 +1,320 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <media/cam_sync.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "cam_node.h"
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_icp_context.h"
+#include "cam_req_mgr_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+
+static const char icp_dev_name[] = "cam-icp";
+
+static int cam_icp_context_dump_active_request(void *data,
+	struct cam_smmu_pf_info *pf_info)
+{
+	struct cam_context *ctx = (struct cam_context *)data;
+	struct cam_ctx_request          *req = NULL;
+	struct cam_ctx_request          *req_temp = NULL;
+	struct cam_hw_mgr_dump_pf_data  *pf_dbg_entry = NULL;
+	uint32_t  resource_type = 0;
+	int rc = 0;
+	bool b_mem_found = false, b_ctx_found = false;
+
+	if (!ctx) {
+		CAM_ERR(CAM_ICP, "Invalid ctx");
+		return -EINVAL;
+	}
+
+	if (ctx->state < CAM_CTX_ACQUIRED || ctx->state > CAM_CTX_ACTIVATED) {
+		CAM_ERR(CAM_ICP, "Invalid state icp ctx %d state %d",
+			ctx->ctx_id, ctx->state);
+		goto end;
+	}
+
+	CAM_INFO(CAM_ICP, "iommu fault for icp ctx %d state %d",
+		ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+			&ctx->active_req_list, list) {
+		pf_dbg_entry = &(req->pf_data);
+		CAM_INFO(CAM_ICP, "req_id : %lld", req->request_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_dbg_entry,
+			&b_mem_found, &b_ctx_found, &resource_type, pf_info);
+		if (rc)
+			CAM_ERR(CAM_ICP, "Failed to dump pf info");
+
+		if (b_mem_found)
+			CAM_ERR(CAM_ICP, "Found page fault in req %lld %d",
+				req->request_id, rc);
+	}
+
+end:
+	return rc;
+}
+
+static int __cam_icp_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (!rc) {
+		ctx->state = CAM_CTX_ACQUIRED;
+		trace_cam_context_state("ICP", ctx);
+	}
+
+	return rc;
+}
+
+static int __cam_icp_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Unable to release device");
+
+	ctx->state = CAM_CTX_AVAILABLE;
+	trace_cam_context_state("ICP", ctx);
+	return rc;
+}
+
+static int __cam_icp_start_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_start_dev_to_hw(ctx, cmd);
+	if (!rc) {
+		ctx->state = CAM_CTX_READY;
+		trace_cam_context_state("ICP", ctx);
+	}
+
+	return rc;
+}
+
+static int __cam_icp_dump_dev_in_ready(
+	struct cam_context      *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to dump device");
+
+	return rc;
+}
+
+static int __cam_icp_flush_dev_in_ready(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_flush_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to flush device");
+
+	return rc;
+}
+
+static int __cam_icp_config_dev_in_ready(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+	size_t len;
+	uintptr_t packet_addr;
+	struct cam_packet *packet;
+	size_t remain_len = 0;
+
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "[%s][%d] Can not get packet address",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	remain_len = len;
+	if ((len < sizeof(struct cam_packet)) ||
+		(cmd->offset >= (len - sizeof(struct cam_packet)))) {
+		CAM_ERR(CAM_CTXT,
+			"Invalid offset, len: %zu cmd offset: %llu sizeof packet: %zu",
+			len, cmd->offset, sizeof(struct cam_packet));
+		cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+		return -EINVAL;
+	}
+
+	remain_len -= (size_t)cmd->offset;
+	packet = (struct cam_packet *) ((uint8_t *)packet_addr +
+		(uint32_t)cmd->offset);
+
+	rc = cam_packet_util_validate_packet(packet, remain_len);
+	if (rc) {
+		CAM_ERR(CAM_CTXT, "Invalid packet params, remain length: %zu",
+			remain_len);
+		cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+		return rc;
+	}
+
+	if (((packet->header.op_code & 0xff) ==
+		CAM_ICP_OPCODE_IPE_SETTINGS) ||
+		((packet->header.op_code & 0xff) ==
+		CAM_ICP_OPCODE_BPS_SETTINGS))
+		rc = cam_context_config_dev_to_hw(ctx, cmd);
+	else
+		rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to prepare device");
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+}
+
+static int __cam_icp_stop_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to stop device");
+
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("ICP", ctx);
+	return rc;
+}
+
+static int __cam_icp_release_dev_in_ready(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = __cam_icp_stop_dev_in_ready(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to stop device");
+
+	rc = __cam_icp_release_dev_in_acquired(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to release device");
+
+	return rc;
+}
+
+static int __cam_icp_handle_buf_done_in_ready(void *ctx,
+	uint32_t evt_id, void *done)
+{
+	return cam_context_buf_done_from_hw(ctx, done, evt_id);
+}
+
+static struct cam_ctx_ops
+	cam_icp_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_icp_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.release_dev = __cam_icp_release_dev_in_acquired,
+			.start_dev = __cam_icp_start_dev_in_acquired,
+			.config_dev = __cam_icp_config_dev_in_ready,
+			.flush_dev = __cam_icp_flush_dev_in_ready,
+			.dump_dev = __cam_icp_dump_dev_in_ready,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_icp_handle_buf_done_in_ready,
+		.pagefault_ops = cam_icp_context_dump_active_request,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_icp_stop_dev_in_ready,
+			.release_dev = __cam_icp_release_dev_in_ready,
+			.config_dev = __cam_icp_config_dev_in_ready,
+			.flush_dev = __cam_icp_flush_dev_in_ready,
+			.dump_dev = __cam_icp_dump_dev_in_ready,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_icp_handle_buf_done_in_ready,
+		.pagefault_ops = cam_icp_context_dump_active_request,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_icp_context_dump_active_request,
+	},
+};
+
+int cam_icp_context_init(struct cam_icp_context *ctx,
+	struct cam_hw_mgr_intf *hw_intf, uint32_t ctx_id)
+{
+	int rc;
+
+	if ((!ctx) || (!ctx->base) || (!hw_intf)) {
+		CAM_ERR(CAM_ICP, "Invalid params: %pK %pK", ctx, hw_intf);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	rc = cam_context_init(ctx->base, icp_dev_name, CAM_ICP, ctx_id,
+		NULL, hw_intf, ctx->req_base, CAM_CTX_ICP_REQ_MAX);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Camera Context Base init failed");
+		goto err;
+	}
+
+	ctx->base->state_machine = cam_icp_ctx_state_machine;
+	ctx->base->ctx_priv = ctx;
+	ctx->ctxt_to_hw_map = NULL;
+
+err:
+	return rc;
+}
+
+int cam_icp_context_deinit(struct cam_icp_context *ctx)
+{
+	if ((!ctx) || (!ctx->base)) {
+		CAM_ERR(CAM_ICP, "Invalid params: %pK", ctx);
+		return -EINVAL;
+	}
+
+	cam_context_deinit(ctx->base);
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/cam_icp_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/cam_icp_context.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_CONTEXT_H_
+#define _CAM_ICP_CONTEXT_H_
+
+#include "cam_context.h"
+
+/**
+ * struct cam_icp_context - icp context
+ * @base: icp context object
+ * @state_machine: state machine for ICP context
+ * @req_base: common request structure
+ * @state: icp context state
+ * @ctxt_to_hw_map: context to FW handle mapping
+ */
+struct cam_icp_context {
+	struct cam_context *base;
+	struct cam_ctx_ops *state_machine;
+	struct cam_ctx_request req_base[CAM_CTX_ICP_REQ_MAX];
+	uint32_t state;
+	void *ctxt_to_hw_map;
+};
+
+/**
+ * cam_icp_context_init() - ICP context init
+ * @ctx: Pointer to context
+ * @hw_intf: Pointer to ICP hardware interface
+ * @ctx_id: ID for this context
+ */
+int cam_icp_context_init(struct cam_icp_context *ctx,
+	struct cam_hw_mgr_intf *hw_intf, uint32_t ctx_id);
+
+/**
+ * cam_icp_context_deinit() - ICP context deinit
+ * @ctx: Pointer to context
+ */
+int cam_icp_context_deinit(struct cam_icp_context *ctx);
+
+#endif /* _CAM_ICP_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/cam_icp_subdev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/cam_icp_subdev.c
@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/platform_device.h>
+#include <linux/videodev2.h>
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+
+#include "cam_icp_subdev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_context.h"
+#include "cam_icp_context.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+
+#define CAM_ICP_DEV_NAME        "cam-icp"
+
+struct cam_icp_subdev {
+	struct cam_subdev sd;
+	struct cam_node *node;
+	struct cam_context ctx[CAM_ICP_CTX_MAX];
+	struct cam_icp_context ctx_icp[CAM_ICP_CTX_MAX];
+	struct mutex icp_lock;
+	int32_t open_cnt;
+	int32_t reserved;
+};
+
+static struct cam_icp_subdev g_icp_dev;
+
+static const struct of_device_id cam_icp_dt_match[] = {
+	{.compatible = "qcom,cam-icp"},
+	{}
+};
+
+static void cam_icp_dev_iommu_fault_handler(struct cam_smmu_pf_info *pf_info)
+{
+	int i = 0;
+	struct cam_node *node = NULL;
+
+	if (!pf_info || !pf_info->token) {
+		CAM_ERR(CAM_ISP, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_info->token;
+
+	for (i = 0; i < node->ctx_size; i++)
+		cam_context_dump_pf_info(&(node->ctx_list[i]), pf_info);
+}
+
+static int cam_icp_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_hw_mgr_intf *hw_mgr_intf = NULL;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+	int rc = 0;
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
+	mutex_lock(&g_icp_dev.icp_lock);
+	if (g_icp_dev.open_cnt >= 1) {
+		CAM_ERR(CAM_ICP, "ICP subdev is already opened");
+		rc = -EALREADY;
+		goto end;
+	}
+
+	if (!node) {
+		CAM_ERR(CAM_ICP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	hw_mgr_intf = &node->hw_mgr_intf;
+	rc = hw_mgr_intf->hw_open(hw_mgr_intf->hw_mgr_priv, NULL);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "FW download failed");
+		goto end;
+	}
+	g_icp_dev.open_cnt++;
+end:
+	mutex_unlock(&g_icp_dev.icp_lock);
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+	return rc;
+}
+
+static int cam_icp_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_hw_mgr_intf *hw_mgr_intf = NULL;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&g_icp_dev.icp_lock);
+	if (g_icp_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_ICP, "ICP subdev is already closed");
+		goto end;
+	}
+	g_icp_dev.open_cnt--;
+	if (!node) {
+		CAM_ERR(CAM_ICP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	hw_mgr_intf = &node->hw_mgr_intf;
+	if (!hw_mgr_intf) {
+		CAM_ERR(CAM_ICP, "hw_mgr_intf is not initialized");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_node_shutdown(node);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "HW close failed");
+		goto end;
+	}
+
+end:
+	mutex_unlock(&g_icp_dev.icp_lock);
+	return rc;
+}
+
+static int cam_icp_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_ICP, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_icp_subdev_close_internal(sd, fh);
+}
+
+const struct v4l2_subdev_internal_ops cam_icp_subdev_internal_ops = {
+	.open = cam_icp_subdev_open,
+	.close = cam_icp_subdev_close,
+};
+
+static int cam_icp_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0, i = 0;
+	struct cam_node *node;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	int iommu_hdl = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	if (!pdev) {
+		CAM_ERR(CAM_ICP, "pdev is NULL");
+		return -EINVAL;
+	}
+
+	g_icp_dev.sd.pdev = pdev;
+	g_icp_dev.sd.internal_ops = &cam_icp_subdev_internal_ops;
+	g_icp_dev.sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+	rc = cam_subdev_probe(&g_icp_dev.sd, pdev, CAM_ICP_DEV_NAME,
+		CAM_ICP_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "ICP cam_subdev_probe failed");
+		goto probe_fail;
+	}
+
+	node = (struct cam_node *) g_icp_dev.sd.token;
+
+	hw_mgr_intf = kzalloc(sizeof(*hw_mgr_intf), GFP_KERNEL);
+	if (!hw_mgr_intf) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_ICP, "Memory allocation fail");
+		goto hw_alloc_fail;
+	}
+
+	rc = cam_icp_hw_mgr_init(pdev->dev.of_node, (uint64_t *)hw_mgr_intf,
+		&iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "ICP HW manager init failed: %d", rc);
+		goto hw_init_fail;
+	}
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		g_icp_dev.ctx_icp[i].base = &g_icp_dev.ctx[i];
+		rc = cam_icp_context_init(&g_icp_dev.ctx_icp[i],
+					hw_mgr_intf, i);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "ICP context init failed");
+			goto ctx_fail;
+		}
+	}
+
+	rc = cam_node_init(node, hw_mgr_intf, g_icp_dev.ctx,
+				CAM_ICP_CTX_MAX, CAM_ICP_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "ICP node init failed");
+		goto ctx_fail;
+	}
+
+	node->sd_handler = cam_icp_subdev_close_internal;
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_icp_dev_iommu_fault_handler, node);
+
+	g_icp_dev.open_cnt = 0;
+	mutex_init(&g_icp_dev.icp_lock);
+
+	rc = cam_subdev_register(&g_icp_dev.sd, pdev);
+	CAM_DBG(CAM_ICP, "Component bound successfully");
+
+	return rc;
+
+ctx_fail:
+	for (--i; i >= 0; i--)
+		cam_icp_context_deinit(&g_icp_dev.ctx_icp[i]);
+hw_init_fail:
+	kfree(hw_mgr_intf);
+hw_alloc_fail:
+	cam_subdev_remove(&g_icp_dev.sd);
+probe_fail:
+	return rc;
+}
+
+static void cam_icp_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+	struct v4l2_subdev *sd;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	if (!pdev) {
+		CAM_ERR(CAM_ICP, "pdev is NULL");
+		return;
+	}
+
+	sd = platform_get_drvdata(pdev);
+	if (!sd) {
+		CAM_ERR(CAM_ICP, "V4l2 subdev is NULL");
+		return;
+	}
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++)
+		cam_icp_context_deinit(&g_icp_dev.ctx_icp[i]);
+
+	cam_icp_hw_mgr_deinit();
+	cam_node_deinit(g_icp_dev.node);
+	cam_unregister_subdev(&g_icp_dev.sd);
+	cam_subdev_remove(&g_icp_dev.sd);
+	mutex_destroy(&g_icp_dev.icp_lock);
+}
+
+const static struct component_ops cam_icp_component_ops = {
+	.bind = cam_icp_component_bind,
+	.unbind = cam_icp_component_unbind,
+};
+
+static int cam_icp_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "Adding ICP component");
+	rc = component_add(&pdev->dev, &cam_icp_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_icp_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_icp_component_ops);
+	return 0;
+}
+
+struct platform_driver cam_icp_driver = {
+	.probe = cam_icp_probe,
+	.remove = cam_icp_remove,
+	.driver = {
+		.name = "cam_icp",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_icp_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_icp_init_module(void)
+{
+	return platform_driver_register(&cam_icp_driver);
+}
+
+void cam_icp_exit_module(void)
+{
+	platform_driver_unregister(&cam_icp_driver);
+}
+
+MODULE_DESCRIPTION("MSM ICP driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/cam_icp_subdev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/cam_icp_subdev.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ICP_SUBDEV_H_
+#define _CAM_ICP_SUBDEV_H_
+
+/**
+ * @brief : API to register ICP subdev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_icp_init_module(void);
+
+/**
+ * @brief : API to remove ICP subdev from platform framework.
+ */
+void cam_icp_exit_module(void);
+
+#endif /* _CAM_ICP_SUBDEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/fw_inc/hfi_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/fw_inc/hfi_intf.h
@@ -0,0 +1,165 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _HFI_INTF_H_
+#define _HFI_INTF_H_
+
+#include <linux/types.h>
+
+/**
+ * struct hfi_mem
+ * @len: length of memory
+ * @kva: kernel virtual address
+ * @iova: IO virtual address
+ * @reserved: reserved field
+ */
+struct hfi_mem {
+	uint64_t  len;
+	uintptr_t kva;
+	uint32_t  iova;
+	uint32_t  reserved;
+};
+
+/**
+ * struct hfi_mem_info
+ * @qtbl: qtable hfi memory
+ * @cmd_q: command queue hfi memory for host to firmware communication
+ * @msg_q: message queue hfi memory for firmware to host communication
+ * @dbg_q: debug queue hfi memory for firmware debug information
+ * @sfr_buf: buffer for subsystem failure reason[SFR]
+ * @sec_heap: secondary heap hfi memory for firmware
+ * @qdss: qdss mapped memory for fw
+ * @io_mem: io memory info
+ * @io_mem2: 2nd io memory info
+ */
+struct hfi_mem_info {
+	struct hfi_mem qtbl;
+	struct hfi_mem cmd_q;
+	struct hfi_mem msg_q;
+	struct hfi_mem dbg_q;
+	struct hfi_mem sfr_buf;
+	struct hfi_mem sec_heap;
+	struct hfi_mem shmem;
+	struct hfi_mem qdss;
+	struct hfi_mem io_mem;
+	struct hfi_mem io_mem2;
+};
+
+/**
+ * struct hfi_ops
+ * @irq_raise: called to raise H2ICP interrupt
+ * @irq_enable: called to enable interrupts from ICP
+ * @iface_addr: called to get interface registers base address
+ */
+struct hfi_ops {
+	void (*irq_raise)(void *data);
+	void (*irq_enable)(void *data);
+	void __iomem *(*iface_addr)(void *data);
+};
+
+/**
+ * hfi_write_cmd() - function for hfi write
+ * @cmd_ptr: pointer to command data for hfi write
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_write_cmd(void *cmd_ptr);
+
+/**
+ * hfi_read_message() - function for hfi read
+ * @pmsg: buffer to place read message for hfi queue
+ * @q_id: queue id
+ * @words_read: total number of words read from the queue
+ *              returned as output to the caller
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_read_message(uint32_t *pmsg, uint8_t q_id, uint32_t *words_read);
+
+/**
+ * hfi_init() - function initialize hfi after firmware download
+ * @hfi_mem: hfi memory info
+ * @hfi_ops: processor-specific hfi ops
+ * @priv: device private data
+ * @event_driven_mode: event mode
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int cam_hfi_init(struct hfi_mem_info *hfi_mem, const struct hfi_ops *hfi_ops,
+		void *priv, uint8_t event_driven_mode);
+
+/**
+ * hfi_get_hw_caps() - hardware capabilities from firmware
+ * @query_caps: holds query information from hfi
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int hfi_get_hw_caps(void *query_caps);
+
+/**
+ * hfi_send_system_cmd() - send hfi system command to firmware
+ * @type: type of system command
+ * @data: command data
+ * @size: size of command data
+ */
+void hfi_send_system_cmd(uint32_t type, uint64_t data, uint32_t size);
+
+/**
+ * cam_hfi_deinit() - cleanup HFI
+ */
+void cam_hfi_deinit(void);
+/**
+ * hfi_set_debug_level() - set debug level
+ * @icp_dbg_type: 1 for debug_q & 2 for qdss
+ * @lvl: FW debug message level
+ */
+int hfi_set_debug_level(u64 icp_dbg_type, uint32_t lvl);
+
+/**
+ * hfi_set_fw_dump_level() - set firmware dump level
+ * @lvl: level of firmware dump level
+ */
+int hfi_set_fw_dump_level(uint32_t lvl);
+
+/**
+ * hfi_enable_ipe_bps_pc() - Enable interframe pc
+ * Host sends a command to firmware to enable interframe
+ * power collapse for IPE and BPS hardware.
+ *
+ * @enable: flag to enable/disable
+ * @core_info: Core information to firmware
+ */
+int hfi_enable_ipe_bps_pc(bool enable, uint32_t core_info);
+
+/**
+ * hfi_cmd_ubwc_config_ext() - UBWC configuration to firmware
+ * @ubwc_ipe_cfg: UBWC ipe fetch/write configuration params
+ * @ubwc_bps_cfg: UBWC bps fetch/write configuration params
+ */
+int hfi_cmd_ubwc_config_ext(uint32_t *ubwc_ipe_cfg,
+	uint32_t *ubwc_bps_cfg);
+
+/**
+ * hfi_cmd_ubwc_config() - UBWC configuration to firmware
+ *                         for older targets
+ * @ubwc_cfg: UBWC configuration parameters
+ */
+int hfi_cmd_ubwc_config(uint32_t *ubwc_cfg);
+
+/**
+ * cam_hfi_resume() - function to resume
+ * @hfi_mem: hfi memory info
+ *
+ * Returns success(zero)/failure(non zero)
+ */
+int cam_hfi_resume(struct hfi_mem_info *hfi_mem);
+
+/**
+ * cam_hfi_queue_dump() - utility function to dump hfi queues
+ */
+void cam_hfi_queue_dump(void);
+
+
+#endif /* _HFI_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/fw_inc/hfi_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/fw_inc/hfi_reg.h
@@ -0,0 +1,294 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_HFI_REG_H_
+#define _CAM_HFI_REG_H_
+
+#include <linux/types.h>
+#include "hfi_intf.h"
+
+/* general purpose registers */
+#define GEN_PURPOSE_REG(n)              (n * 4)
+
+#define HFI_REG_FW_VERSION              GEN_PURPOSE_REG(1)
+#define HFI_REG_HOST_ICP_INIT_REQUEST   GEN_PURPOSE_REG(2)
+#define HFI_REG_ICP_HOST_INIT_RESPONSE  GEN_PURPOSE_REG(3)
+#define HFI_REG_SHARED_MEM_PTR          GEN_PURPOSE_REG(4)
+#define HFI_REG_SHARED_MEM_SIZE         GEN_PURPOSE_REG(5)
+#define HFI_REG_QTBL_PTR                GEN_PURPOSE_REG(6)
+#define HFI_REG_UNCACHED_HEAP_PTR       GEN_PURPOSE_REG(7)
+#define HFI_REG_UNCACHED_HEAP_SIZE      GEN_PURPOSE_REG(8)
+#define HFI_REG_SFR_PTR                 GEN_PURPOSE_REG(10)
+#define HFI_REG_QDSS_IOVA               GEN_PURPOSE_REG(11)
+#define HFI_REG_QDSS_IOVA_SIZE          GEN_PURPOSE_REG(12)
+#define HFI_REG_IO_REGION_IOVA          GEN_PURPOSE_REG(13)
+#define HFI_REG_IO_REGION_SIZE          GEN_PURPOSE_REG(14)
+#define HFI_REG_IO2_REGION_IOVA         GEN_PURPOSE_REG(15)
+#define HFI_REG_IO2_REGION_SIZE         GEN_PURPOSE_REG(16)
+
+/* start of Queue table and queues */
+#define MAX_ICP_HFI_QUEUES                      4
+#define ICP_QHDR_TX_TYPE_MASK                   0xFF000000
+#define ICP_QHDR_RX_TYPE_MASK                   0x00FF0000
+#define ICP_QHDR_PRI_TYPE_MASK                  0x0000FF00
+#define ICP_QHDR_Q_ID_MASK                      0x000000FF
+
+#define ICP_CMD_Q_SIZE_IN_BYTES                 4096
+#define ICP_MSG_Q_SIZE_IN_BYTES                 4096
+#define ICP_DBG_Q_SIZE_IN_BYTES                 102400
+#define ICP_MSG_SFR_SIZE_IN_BYTES               4096
+
+#define ICP_SHARED_MEM_IN_BYTES                 (1024 * 1024)
+#define ICP_UNCACHED_HEAP_SIZE_IN_BYTES         (2 * 1024 * 1024)
+#define ICP_HFI_MAX_PKT_SIZE_IN_WORDS           25600
+#define ICP_HFI_MAX_PKT_SIZE_MSGQ_IN_WORDS      1024
+
+#define ICP_HFI_QTBL_HOSTID1                    0x01000000
+#define ICP_HFI_QTBL_STATUS_ENABLED             0x00000001
+#define ICP_HFI_NUMBER_OF_QS                    3
+#define ICP_HFI_NUMBER_OF_ACTIVE_QS             3
+#define ICP_HFI_QTBL_OFFSET                     0
+#define ICP_HFI_VAR_SIZE_PKT                    0
+#define ICP_HFI_MAX_MSG_SIZE_IN_WORDS           128
+
+
+/* Queue Header type masks. Use these to access bitfields in qhdr_type */
+#define HFI_MASK_QHDR_TX_TYPE                   0xFF000000
+#define HFI_MASK_QHDR_RX_TYPE                   0x00FF0000
+#define HFI_MASK_QHDR_PRI_TYPE                  0x0000FF00
+#define HFI_MASK_QHDR_Q_ID_TYPE                 0x000000FF
+
+
+#define TX_EVENT_DRIVEN_MODE_1                  0
+#define RX_EVENT_DRIVEN_MODE_1                  0
+#define TX_EVENT_DRIVEN_MODE_2                  0x01000000
+#define RX_EVENT_DRIVEN_MODE_2                  0x00010000
+#define TX_EVENT_POLL_MODE_2                    0x02000000
+#define RX_EVENT_POLL_MODE_2                    0x00020000
+#define U32_OFFSET                              0x1
+#define BYTE_WORD_SHIFT                         2
+
+/**
+ * @INVALID: Invalid state
+ * @HFI_DEINIT: HFI is not initialized yet
+ * @HFI_INIT: HFI is initialized
+ * @HFI_READY: HFI is ready to send/receive commands/messages
+ */
+enum hfi_state {
+	HFI_DEINIT,
+	HFI_INIT,
+	HFI_READY
+};
+
+/**
+ * @RESET: init success
+ * @SET: init failed
+ */
+enum reg_settings {
+	RESET,
+	SET,
+	SET_WM = 1024
+};
+
+/**
+ * @ICP_INIT_RESP_RESET: reset init state
+ * @ICP_INIT_RESP_SUCCESS: init success
+ * @ICP_INIT_RESP_FAILED: init failed
+ */
+enum host_init_resp {
+	ICP_INIT_RESP_RESET,
+	ICP_INIT_RESP_SUCCESS,
+	ICP_INIT_RESP_FAILED
+};
+
+/**
+ * @ICP_INIT_REQUEST_RESET: reset init request
+ * @ICP_INIT_REQUEST_SET: set init request
+ */
+enum host_init_request {
+	ICP_INIT_REQUEST_RESET,
+	ICP_INIT_REQUEST_SET
+};
+
+/**
+ * @QHDR_INACTIVE: Queue is inactive
+ * @QHDR_ACTIVE: Queue is active
+ */
+enum qhdr_status {
+	QHDR_INACTIVE,
+	QHDR_ACTIVE
+};
+
+/**
+ * @INTR_MODE: event driven mode 1, each send and receive generates interrupt
+ * @WM_MODE: event driven mode 2, interrupts based on watermark mechanism
+ * @POLL_MODE: poll method
+ */
+enum qhdr_event_drv_type {
+	INTR_MODE,
+	WM_MODE,
+	POLL_MODE
+};
+
+/**
+ * @TX_INT: event driven mode 1, each send and receive generates interrupt
+ * @TX_INT_WM: event driven mode 2, interrupts based on watermark mechanism
+ * @TX_POLL: poll method
+ * @ICP_QHDR_TX_TYPE_MASK defines position in qhdr_type
+ */
+enum qhdr_tx_type {
+	TX_INT,
+	TX_INT_WM,
+	TX_POLL
+};
+
+/**
+ * @RX_INT: event driven mode 1, each send and receive generates interrupt
+ * @RX_INT_WM: event driven mode 2, interrupts based on watermark mechanism
+ * @RX_POLL: poll method
+ * @ICP_QHDR_RX_TYPE_MASK defines position in qhdr_type
+ */
+enum qhdr_rx_type {
+	RX_INT,
+	RX_INT_WM,
+	RX_POLL
+};
+
+/**
+ * @Q_CMD: Host to FW command queue
+ * @Q_MSG: FW to Host message queue
+ * @Q_DEBUG: FW to Host debug queue
+ * @ICP_QHDR_Q_ID_MASK defines position in qhdr_type
+ */
+enum qhdr_q_id {
+	Q_CMD,
+	Q_MSG,
+	Q_DBG
+};
+
+/**
+ * struct hfi_qtbl_hdr
+ * @qtbl_version: Queue table version number
+ *                Higher 16 bits: Major version
+ *                Lower 16 bits: Minor version
+ * @qtbl_size: Queue table size from version to last parametr in qhdr entry
+ * @qtbl_qhdr0_offset: Offset to the start of first qhdr
+ * @qtbl_qhdr_size: Queue header size in bytes
+ * @qtbl_num_q: Total number of queues in Queue table
+ * @qtbl_num_active_q: Total number of active queues
+ */
+struct hfi_qtbl_hdr {
+	uint32_t qtbl_version;
+	uint32_t qtbl_size;
+	uint32_t qtbl_qhdr0_offset;
+	uint32_t qtbl_qhdr_size;
+	uint32_t qtbl_num_q;
+	uint32_t qtbl_num_active_q;
+} __packed;
+
+/**
+ * struct hfi_q_hdr
+ * @qhdr_status: Queue status, qhdr_state define possible status
+ * @qhdr_start_addr: Queue start address in non cached memory
+ * @qhdr_type: qhdr_tx, qhdr_rx, qhdr_q_id and priority defines qhdr type
+ * @qhdr_q_size: Queue size
+ *		Number of queue packets if qhdr_pkt_size is non-zero
+ *		Queue size in bytes if qhdr_pkt_size is zero
+ * @qhdr_pkt_size: Size of queue packet entries
+ *		0x0: variable queue packet size
+ *		non zero: size of queue packet entry, fixed
+ * @qhdr_pkt_drop_cnt: Number of packets dropped by sender
+ * @qhdr_rx_wm: Receiver watermark, applicable in event driven mode
+ * @qhdr_tx_wm: Sender watermark, applicable in event driven mode
+ * @qhdr_rx_req: Receiver sets this bit if queue is empty
+ * @qhdr_tx_req: Sender sets this bit if queue is full
+ * @qhdr_rx_irq_status: Receiver sets this bit and triggers an interrupt to
+ *		the sender after packets are dequeued. Sender clears this bit
+ * @qhdr_tx_irq_status: Sender sets this bit and triggers an interrupt to
+ *		the receiver after packets are queued. Receiver clears this bit
+ * @qhdr_read_idx: Read index
+ * @qhdr_write_idx: Write index
+ */
+struct hfi_q_hdr {
+	uint32_t dummy[15];
+	uint32_t qhdr_status;
+	uint32_t dummy1[15];
+	uint32_t qhdr_start_addr;
+	uint32_t dummy2[15];
+	uint32_t qhdr_type;
+	uint32_t dummy3[15];
+	uint32_t qhdr_q_size;
+	uint32_t dummy4[15];
+	uint32_t qhdr_pkt_size;
+	uint32_t dummy5[15];
+	uint32_t qhdr_pkt_drop_cnt;
+	uint32_t dummy6[15];
+	uint32_t qhdr_rx_wm;
+	uint32_t dummy7[15];
+	uint32_t qhdr_tx_wm;
+	uint32_t dummy8[15];
+	uint32_t qhdr_rx_req;
+	uint32_t dummy9[15];
+	uint32_t qhdr_tx_req;
+	uint32_t dummy10[15];
+	uint32_t qhdr_rx_irq_status;
+	uint32_t dummy11[15];
+	uint32_t qhdr_tx_irq_status;
+	uint32_t dummy12[15];
+	uint32_t qhdr_read_idx;
+	uint32_t dummy13[15];
+	uint32_t qhdr_write_idx;
+	uint32_t dummy14[15];
+};
+
+/**
+ * struct sfr_buf
+ * @size: Number of characters
+ * @msg : Subsystem failure reason
+ */
+struct sfr_buf {
+	uint32_t size;
+	char msg[ICP_MSG_SFR_SIZE_IN_BYTES];
+};
+
+/**
+ * struct hfi_q_tbl
+ * @q_tbl_hdr: Queue table header
+ * @q_hdr: Queue header info, it holds info of cmd, msg and debug queues
+ */
+struct hfi_qtbl {
+	struct hfi_qtbl_hdr q_tbl_hdr;
+	struct hfi_q_hdr q_hdr[MAX_ICP_HFI_QUEUES];
+};
+
+/**
+ * struct hfi_info
+ * @map: Hfi shared memory info
+ * @ops: processor-specific ops
+ * @smem_size: Shared memory size
+ * @uncachedheap_size: uncached heap size
+ * @msgpacket_buf: message buffer
+ * @hfi_state: State machine for hfi
+ * @cmd_q_lock: Lock for command queue
+ * @cmd_q_state: State of command queue
+ * @mutex msg_q_lock: Lock for message queue
+ * @msg_q_state: State of message queue
+ * @priv: device private data
+ */
+struct hfi_info {
+	struct hfi_mem_info map;
+	struct hfi_ops ops;
+	uint32_t smem_size;
+	uint32_t uncachedheap_size;
+	uint32_t msgpacket_buf[ICP_HFI_MAX_MSG_SIZE_IN_WORDS];
+	uint8_t hfi_state;
+	struct mutex cmd_q_lock;
+	bool cmd_q_state;
+	struct mutex msg_q_lock;
+	bool msg_q_state;
+	void *priv;
+};
+
+#endif /* _CAM_HFI_REG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/fw_inc/hfi_session_defs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/fw_inc/hfi_session_defs.h
@@ -0,0 +1,594 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_HFI_SESSION_DEFS_H
+#define _CAM_HFI_SESSION_DEFS_H
+
+#include <linux/types.h>
+
+#define HFI_IPEBPS_CMD_OPCODE_BPS_CONFIG_IO             0x1
+#define HFI_IPEBPS_CMD_OPCODE_BPS_FRAME_PROCESS         0x2
+#define HFI_IPEBPS_CMD_OPCODE_BPS_ABORT                 0x3
+#define HFI_IPEBPS_CMD_OPCODE_BPS_DESTROY               0x4
+
+#define HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO             0x5
+#define HFI_IPEBPS_CMD_OPCODE_IPE_FRAME_PROCESS         0x6
+#define HFI_IPEBPS_CMD_OPCODE_IPE_ABORT                 0x7
+#define HFI_IPEBPS_CMD_OPCODE_IPE_DESTROY               0x8
+
+#define HFI_IPEBPS_CMD_OPCODE_BPS_WAIT_FOR_IPE          0x9
+#define HFI_IPEBPS_CMD_OPCODE_BPS_WAIT_FOR_BPS          0xa
+#define HFI_IPEBPS_CMD_OPCODE_IPE_WAIT_FOR_BPS          0xb
+#define HFI_IPEBPS_CMD_OPCODE_IPE_WAIT_FOR_IPE          0xc
+
+#define HFI_IPEBPS_CMD_OPCODE_MEM_MAP                   0xe
+#define HFI_IPEBPS_CMD_OPCODE_MEM_UNMAP                 0xf
+
+#define HFI_IPEBPS_HANDLE_TYPE_BPS                      0x1
+#define HFI_IPEBPS_HANDLE_TYPE_IPE_RT                   0x2
+#define HFI_IPEBPS_HANDLE_TYPE_IPE_NON_RT               0x3
+
+/**
+ * struct mem_map_region_data
+ * @start_addr: cmd buffer region start addr
+ * @len       : length of the region
+ *
+ * create mem_map_region_data
+ */
+struct mem_map_region_data {
+	uint32_t               start_addr;
+	uint32_t               len;
+};
+
+/**
+ * struct hfi_cmd_ipe_bps_map
+ * @user_data          : user arg
+ * @mem_map_request_num: number of mappings
+ * @mem_map_region_sets: array of all map/unmap info
+ *
+ * create hfi_cmd_ipe_bps_map
+ */
+struct hfi_cmd_ipe_bps_map {
+	uint64_t                   user_data;
+	uint32_t                   mem_map_request_num;
+    union {
+        struct mem_map_region_data mem_map_region_sets[1];
+        __DECLARE_FLEX_ARRAY(struct mem_map_region_data, mem_map_region_sets_flex);
+    };
+} __packed;
+
+/**
+ * struct hfi_cmd_ipe_bps_map_ack
+ * @rc       : Async return code
+ * @user_data: user_arg
+ *
+ * create hfi_cmd_ipe_bps_map_ack
+ */
+struct hfi_cmd_ipe_bps_map_ack {
+	uint32_t            rc;
+	uint64_t            user_data;
+};
+
+/**
+ * struct abort_data
+ * @num_req_ids: Number of req ids
+ * @num_req_id: point to specific req id
+ *
+ * create abort data
+ */
+struct abort_data {
+	uint32_t num_req_ids;
+    union {
+        uint32_t num_req_id[1];
+        __DECLARE_FLEX_ARRAY(uint32_t, num_req_id_flex);
+    };
+};
+
+/**
+ * struct hfi_cmd_data
+ * @abort: abort data
+ * @user data: user supplied argument
+ *
+ * create session abort data
+ */
+struct hfi_cmd_abort {
+	struct abort_data abort;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_abort_destroy
+ * @user_data: user supplied data
+ *
+ * IPE/BPS destroy/abort command
+ * @HFI_IPEBPS_CMD_OPCODE_IPE_ABORT
+ * @HFI_IPEBPS_CMD_OPCODE_BPS_ABORT
+ * @HFI_IPEBPS_CMD_OPCODE_IPE_DESTROY
+ * @HFI_IPEBPS_CMD_OPCODE_BPS_DESTROY
+ */
+struct hfi_cmd_abort_destroy {
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_chaining_ops
+ * @wait_hdl: current session handle waits on wait_hdl to complete operation
+ * @user_data: user supplied argument
+ *
+ * this structure for chaining opcodes
+ * BPS_WAITS_FOR_IPE
+ * BPS_WAITS_FOR_BPS
+ * IPE_WAITS_FOR_BPS
+ * IPE_WAITS_FOR_IPE
+ */
+struct hfi_cmd_chaining_ops {
+	uint32_t wait_hdl;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_create_handle
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @handle_type: IPE/BPS firmware session handle type
+ * @user_data1: caller provided data1
+ * @user_data2: caller provided data2
+ *
+ * create firmware session handle
+ */
+struct hfi_cmd_create_handle {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t handle_type;
+	uint64_t user_data1;
+	uint64_t user_data2;
+} __packed;
+
+/**
+ * struct hfi_cmd_ipebps_async
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @opcode: opcode for IPE/BPS async operation
+ *          CONFIG_IO: configures I/O for IPE/BPS handle
+ *          FRAME_PROCESS: image frame to be processed by IPE/BPS
+ *          ABORT: abort all processing frames of IPE/BPS handle
+ *          DESTROY: destroy earlier created IPE/BPS handle
+ *          BPS_WAITS_FOR_IPE: sync for BPS to wait for IPE
+ *          BPS_WAITS_FOR_BPS: sync for BPS to wait for BPS
+ *          IPE_WAITS_FOR_IPE: sync for IPE to wait for IPE
+ *          IPE_WAITS_FOR_BPS: sync for IPE to wait for BPS
+ * @num_fw_handles: number of IPE/BPS firmware handles in fw_handles array
+ * @fw_handles: IPE/BPS handles array
+ * @payload: command payload for IPE/BPS opcodes
+ * @direct: points to actual payload
+ * @indirect: points to address of payload
+ *
+ * sends async command to the earlier created IPE or BPS handle
+ * for asynchronous operation.
+ */
+struct hfi_cmd_ipebps_async {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t opcode;
+	uint64_t user_data1;
+	uint64_t user_data2;
+	uint32_t num_fw_handles;
+    union {
+        uint32_t fw_handles[1];
+        __DECLARE_FLEX_ARRAY(uint32_t, fw_handles_flex);
+    };
+    union {
+        union {
+            uint32_t direct[1];
+            __DECLARE_FLEX_ARRAY(uint32_t, direct_flex);
+        };
+        uint32_t indirect;
+    } payload;
+} __packed;
+
+/**
+ * struct hfi_msg_create_handle_ack
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @err_type: error code
+ * @fw_handle: output param for IPE/BPS handle
+ * @user_data1: user provided data1
+ * @user_data2: user provided data2
+ *
+ * ack for create handle command of IPE/BPS
+ * @HFI_MSG_IPEBPS_CREATE_HANDLE_ACK
+ */
+struct hfi_msg_create_handle_ack {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t err_type;
+	uint32_t fw_handle;
+	uint64_t user_data1;
+	uint64_t user_data2;
+} __packed;
+
+/**
+ * struct hfi_msg_ipebps_async
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @opcode: opcode of IPE/BPS async operation
+ * @user_data1: user provided data1
+ * @user_data2: user provided data2
+ * @err_type: error code
+ * @msg_data: IPE/BPS async done message data
+ *
+ * result of IPE/BPS async command
+ * @HFI_MSG_IPEBPS_ASYNC_COMMAND_ACK
+ */
+struct hfi_msg_ipebps_async_ack {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t opcode;
+	uint64_t user_data1;
+	uint64_t user_data2;
+	uint32_t err_type;
+    union {
+        uint32_t msg_data[1];
+        __DECLARE_FLEX_ARRAY(uint32_t, msg_data_flex);
+    };
+} __packed;
+
+/**
+ * struct hfi_msg_frame_process_done
+ * @result: result of frame process command
+ * @scratch_buffer_address: address of scratch buffer
+ */
+struct hfi_msg_frame_process_done {
+	uint32_t result;
+	uint32_t scratch_buffer_address;
+};
+
+/**
+ * struct hfi_msg_chaining_op
+ * @status: return status
+ * @user_data: user data provided as part of chaining ops
+ *
+ * IPE/BPS wait response
+ */
+struct hfi_msg_chaining_op {
+	uint32_t status;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_msg_abort_destroy
+ * @status: return status
+ * @user_data: user data provided as part of abort/destroy ops
+ *
+ * IPE/BPS abort/destroy response
+ */
+struct hfi_msg_abort_destroy {
+	uint32_t status;
+	uint64_t user_data;
+} __packed;
+
+#define MAX_NUM_OF_IMAGE_PLANES	2
+#define MAX_HFR_GROUP          16
+
+enum hfi_ipe_io_images {
+	IPE_INPUT_IMAGE_FULL,
+	IPE_INPUT_IMAGE_DS4,
+	IPE_INPUT_IMAGE_DS16,
+	IPE_INPUT_IMAGE_DS64,
+	IPE_INPUT_IMAGE_FULL_REF,
+	IPE_INPUT_IMAGE_DS4_REF,
+	IPE_INPUT_IMAGE_DS16_REF,
+	IPE_INPUT_IMAGE_DS64_REF,
+	IPE_OUTPUT_IMAGE_DISPLAY,
+	IPE_OUTPUT_IMAGE_VIDEO,
+	IPE_OUTPUT_IMAGE_FULL_REF,
+	IPE_OUTPUT_IMAGE_DS4_REF,
+	IPE_OUTPUT_IMAGE_DS16_REF,
+	IPE_OUTPUT_IMAGE_DS64_REF,
+	IPE_INPUT2_IMAGE_FULL,
+	IPE_INPUT2_IMAGE_DSX,
+	IPE_INPUT_OUTPUT_SCRATCHBUFFER,
+	IPE_INPUT_IMAGE_FIRST = IPE_INPUT_IMAGE_FULL,
+	IPE_INPUT_IMAGE_LAST = IPE_INPUT_IMAGE_DS64_REF,
+	IPE_INPUT_IMAGE_REF_FIRST = IPE_INPUT_IMAGE_FULL_REF,
+	IPE_INPUT_IMAGE_REF_LAST = IPE_INPUT_IMAGE_DS64_REF,
+	IPE_OUTPUT_IMAGE_FIRST = IPE_OUTPUT_IMAGE_DISPLAY,
+	IPE_OUTPUT_IMAGE_LAST = IPE_OUTPUT_IMAGE_DS64_REF,
+	IPE_OUTPUT_IMAGE_REF_FIRST = IPE_OUTPUT_IMAGE_FULL_REF,
+	IPE_OUTPUT_IMAGE_REF_LAST = IPE_OUTPUT_IMAGE_DS64_REF,
+	IPE_INPUT2_IMAGE_FIRST = IPE_INPUT2_IMAGE_FULL,
+	IPE_INPUT2_IMAGE_LAST = IPE_INPUT2_IMAGE_DSX,
+	IPE_INPUT_OUTPUT_IMAGE_LAST = IPE_INPUT_OUTPUT_SCRATCHBUFFER,
+	IPE_IO_IMAGES_MAX
+};
+
+enum bps_io_images {
+	BPS_INPUT_IMAGE,
+	BPS_OUTPUT_IMAGE_FULL,
+	BPS_OUTPUT_IMAGE_DS4,
+	BPS_OUTPUT_IMAGE_DS16,
+	BPS_OUTPUT_IMAGE_DS64,
+	BPS_OUTPUT_IMAGE_STATS_BG,
+	BPS_OUTPUT_IMAGE_STATS_BHIST,
+	BPS_OUTPUT_IMAGE_REG1,
+	BPS_OUTPUT_IMAGE_REG2,
+	BPS_OUTPUT_IMAGE_FIRST = BPS_OUTPUT_IMAGE_FULL,
+	BPS_OUTPUT_IMAGE_LAST = BPS_OUTPUT_IMAGE_REG2,
+	BPS_IO_IMAGES_MAX
+};
+
+struct frame_buffer {
+	uint32_t buf_ptr[MAX_NUM_OF_IMAGE_PLANES];
+	uint32_t meta_buf_ptr[MAX_NUM_OF_IMAGE_PLANES];
+} __packed;
+
+struct bps_frame_process_data {
+	uint32_t max_num_cores;
+	uint32_t target_time;
+	uint32_t ubwc_stats_buffer_addr;
+	uint32_t ubwc_stats_buffer_size;
+	uint32_t cdm_buffer_addr;
+	uint32_t cdm_buffer_size;
+	uint32_t iq_settings_addr;
+	uint32_t strip_lib_out_addr;
+	uint32_t cdm_prog_addr;
+	uint32_t request_id;
+	struct frame_buffer buffers[BPS_IO_IMAGES_MAX];
+};
+
+enum hfi_ipe_image_format {
+	IMAGE_FORMAT_INVALID,
+	IMAGE_FORMAT_MIPI_8,
+	IMAGE_FORMAT_MIPI_10,
+	IMAGE_FORMAT_MIPI_12,
+	IMAGE_FORMAT_MIPI_14,
+	IMAGE_FORMAT_BAYER_8,
+	IMAGE_FORMAT_BAYER_10,
+	IMAGE_FORMAT_BAYER_12,
+	IMAGE_FORMAT_BAYER_14,
+	IMAGE_FORMAT_PDI_10,
+	IMAGE_FORMAT_PD_10,
+	IMAGE_FORMAT_PD_8,
+	IMAGE_FORMAT_INDICATIONS,
+	IMAGE_FORMAT_REFINEMENT,
+	IMAGE_FORMAT_UBWC_TP_10,
+	IMAGE_FORMAT_UBWC_NV_12,
+	IMAGE_FORMAT_UBWC_NV12_4R,
+	IMAGE_FORMAT_UBWC_P010,
+	IMAGE_FORMAT_LINEAR_TP_10,
+	IMAGE_FORMAT_LINEAR_P010,
+	IMAGE_FORMAT_LINEAR_NV12,
+	IMAGE_FORMAT_LINEAR_PLAIN_16,
+	IMAGE_FORMAT_YUV422_8,
+	IMAGE_FORMAT_YUV422_10,
+	IMAGE_FORMAT_STATISTICS_BAYER_GRID,
+	IMAGE_FORMAT_STATISTICS_BAYER_HISTOGRAM,
+	IMAGE_FORMAT_MAX
+};
+
+enum hfi_ipe_plane_format {
+	PLANE_FORMAT_INVALID = 0,
+	PLANE_FORMAT_MIPI_8,
+	PLANE_FORMAT_MIPI_10,
+	PLANE_FORMAT_MIPI_12,
+	PLANE_FORMAT_MIPI_14,
+	PLANE_FORMAT_BAYER_8,
+	PLANE_FORMAT_BAYER_10,
+	PLANE_FORMAT_BAYER_12,
+	PLANE_FORMAT_BAYER_14,
+	PLANE_FORMAT_PDI_10,
+	PLANE_FORMAT_PD_10,
+	PLANE_FORMAT_PD_8,
+	PLANE_FORMAT_INDICATIONS,
+	PLANE_FORMAT_REFINEMENT,
+	PLANE_FORMAT_UBWC_TP_10_Y,
+	PLANE_FORMAT_UBWC_TP_10_C,
+	PLANE_FORMAT_UBWC_NV_12_Y,
+	PLANE_FORMAT_UBWC_NV_12_C,
+	PLANE_FORMAT_UBWC_NV_12_4R_Y,
+	PLANE_FORMAT_UBWC_NV_12_4R_C,
+	PLANE_FORMAT_UBWC_P010_Y,
+	PLANE_FORMAT_UBWC_P010_C,
+	PLANE_FORMAT_LINEAR_TP_10_Y,
+	PLANE_FORMAT_LINEAR_TP_10_C,
+	PLANE_FORMAT_LINEAR_P010_Y,
+	PLANE_FORMAT_LINEAR_P010_C,
+	PLANE_FORMAT_LINEAR_NV12_Y,
+	PLANE_FORMAT_LINEAR_NV12_C,
+	PLANE_FORMAT_LINEAR_PLAIN_16_Y,
+	PLANE_FORMAT_LINEAR_PLAIN_16_C,
+	PLANE_FORMAT_YUV422_8,
+	PLANE_FORMAT_YUV422_10,
+	PLANE_FORMAT_STATISTICS_BAYER_GRID,
+	PLANE_FORMAT_STATISTICS_BAYER_HISTOGRAM,
+	PLANE_FORMAT_MAX
+};
+
+enum hfi_ipe_bayer_pixel_order {
+	FIRST_PIXEL_R,
+	FIRST_PIXEL_GR,
+	FIRST_PIXEL_B,
+	FIRST_PIXEL_GB,
+	FIRST_PIXEL_MAX
+};
+
+enum hfi_ipe_pixel_pack_alignment {
+	PIXEL_LSB_ALIGNED,
+	PIXEL_MSB_ALIGNED,
+};
+
+enum hfi_ipe_yuv_422_order {
+	PIXEL_ORDER_Y_U_Y_V,
+	PIXEL_ORDER_Y_V_Y_U,
+	PIXEL_ORDER_U_Y_V_Y,
+	PIXEL_ORDER_V_Y_U_Y,
+	PIXEL_ORDER_YUV422_MAX
+};
+
+enum ubwc_write_client {
+	IPE_WR_CLIENT_0 = 0,
+	IPE_WR_CLIENT_1,
+	IPE_WR_CLIENT_5,
+	IPE_WR_CLIENT_6,
+	IPE_WR_CLIENT_7,
+	IPE_WR_CLIENT_8,
+	IPE_WR_CLIENT_MAX
+};
+
+/**
+ * struct image_info
+ * @format: image format
+ * @img_width: image width
+ * @img_height: image height
+ * @bayer_order: pixel order
+ * @pix_align: alignment
+ * @yuv422_order: YUV order
+ * @byte_swap: byte swap
+ */
+struct image_info {
+	enum hfi_ipe_image_format format;
+	uint32_t img_width;
+	uint32_t img_height;
+	enum hfi_ipe_bayer_pixel_order bayer_order;
+	enum hfi_ipe_pixel_pack_alignment pix_align;
+	enum hfi_ipe_yuv_422_order yuv422_order;
+	uint32_t byte_swap;
+} __packed;
+
+/**
+ * struct buffer_layout
+ * @buf_stride: buffer stride
+ * @buf_height: buffer height
+ */
+struct buffer_layout {
+	uint32_t buf_stride;
+	uint32_t buf_height;
+} __packed;
+
+/**
+ * struct image_desc
+ * @info: image info
+ * @buf_layout: buffer layout
+ * @meta_buf_layout: meta buffer layout
+ */
+struct image_desc {
+	struct image_info info;
+	struct buffer_layout buf_layout[MAX_NUM_OF_IMAGE_PLANES];
+	struct buffer_layout meta_buf_layout[MAX_NUM_OF_IMAGE_PLANES];
+} __packed;
+
+struct ica_stab_coeff {
+	uint32_t coeffs[8];
+} __packed;
+
+struct ica_stab_params {
+	uint32_t mode;
+	struct ica_stab_coeff transforms[3];
+} __packed;
+
+struct frame_set {
+	struct frame_buffer buffers[IPE_IO_IMAGES_MAX];
+	uint32_t cdm_ica1_addr;
+	uint32_t cdm_ica2_addr;
+} __packed;
+
+struct ipe_frame_process_data {
+	uint32_t strip_lib_out_addr;
+	uint32_t iq_settings_addr;
+	uint32_t scratch_buffer_addr;
+	uint32_t scratch_buffer_size;
+	uint32_t ubwc_stats_buffer_addr;
+	uint32_t ubwc_stats_buffer_size;
+	uint32_t cdm_buffer_addr;
+	uint32_t cdm_buffer_size;
+	uint32_t max_num_cores;
+	uint32_t target_time;
+	uint32_t cdm_prog_base;
+	uint32_t cdm_pre_ltm;
+	uint32_t cdm_post_ltm;
+	uint32_t cdm_anr_full_pass;
+	uint32_t cdm_anr_ds4;
+	uint32_t cdm_anr_ds16;
+	uint32_t cdm_anr_ds64;
+	uint32_t cdm_tf_full_pass;
+	uint32_t cdm_tf_ds4;
+	uint32_t cdm_tf_ds16;
+	uint32_t cdm_tf_ds64;
+	uint32_t cdm_dsx_dc4;
+	uint32_t cdm_dsx_dc16;
+	uint32_t cdm_dsz_dc64;
+	uint32_t cdm_mfhdr_full_pass;
+	uint32_t cdm_mfhdr_dcx;
+	uint32_t request_id;
+	uint32_t frames_in_batch;
+	struct frame_set framesets[MAX_HFR_GROUP];
+} __packed;
+
+/**
+ * struct hfi_cmd_ipe_config
+ * @images: images descreptions
+ * @user_data: user supplied data
+ *
+ * payload for IPE async command
+ */
+struct hfi_cmd_ipe_config {
+	struct image_desc images[IPE_IO_IMAGES_MAX];
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct frame_buffers
+ * @buf_ptr: buffer pointers for all planes
+ * @meta_buf_ptr: meta buffer pointers for all planes
+ */
+struct frame_buffers {
+	uint32_t buf_ptr[MAX_NUM_OF_IMAGE_PLANES];
+	uint32_t meta_buf_ptr[MAX_NUM_OF_IMAGE_PLANES];
+} __packed;
+
+/**
+ * struct hfi_msg_ipe_config
+ * @rc: result of ipe config command
+ * @scratch_mem_size: scratch mem size for a config
+ * @user_data: user data
+ */
+struct hfi_msg_ipe_config {
+	uint32_t rc;
+	uint32_t scratch_mem_size;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_msg_bps_common
+ * @rc: result of ipe config command
+ * @user_data: user data
+ */
+struct hfi_msg_bps_common {
+	uint32_t rc;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct ipe_bps_destroy
+ * @user_data: user data
+ */
+struct ipe_bps_destroy {
+	uint64_t userdata;
+};
+
+/**
+ * struct hfi_msg_ipe_frame_process
+ * @status: result of ipe frame process command
+ * @scratch_buf_addr: address of scratch buffer
+ * @user_data: user data
+ */
+struct hfi_msg_ipe_frame_process {
+	uint32_t status;
+	uint32_t scratch_buf_addr;
+	uint64_t user_data;
+} __packed;
+
+#endif /* _CAM_HFI_SESSION_DEFS_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/fw_inc/hfi_sys_defs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/fw_inc/hfi_sys_defs.h
@@ -0,0 +1,586 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ *  Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ *  Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _HFI_DEFS_H_
+#define _HFI_DEFS_H_
+
+#include <linux/types.h>
+
+/*
+ * Following base acts as common starting points
+ * for all enumerations.
+ */
+#define HFI_COMMON_BASE                 0x0
+
+/* HFI Domain base offset for commands and messages */
+#define HFI_DOMAIN_SHFT                 (24)
+#define HFI_DOMAIN_BMSK                 (0x7 << HFI_DOMAIN_SHFT)
+#define HFI_DOMAIN_BASE_ICP             (0x0 << HFI_DOMAIN_SHFT)
+#define HFI_DOMAIN_BASE_IPE_BPS         (0x1 << HFI_DOMAIN_SHFT)
+#define HFI_DOMAIN_BASE_CDM             (0x2 << HFI_DOMAIN_SHFT)
+#define HFI_DOMAIN_BASE_DBG             (0x3 << HFI_DOMAIN_SHFT)
+
+/* Command base offset for commands */
+#define HFI_CMD_START_OFFSET            0x10000
+
+/* Command base offset for messages */
+#define HFI_MSG_START_OFFSET            0x20000
+
+/* System Level Error types */
+#define HFI_ERR_SYS_NONE                (HFI_COMMON_BASE)
+#define HFI_ERR_SYS_FATAL               (HFI_COMMON_BASE + 0x1)
+#define HFI_ERR_SYS_VERSION_MISMATCH    (HFI_COMMON_BASE + 0x2)
+#define HFI_ERR_SYS_UNSUPPORTED_DOMAIN  (HFI_COMMON_BASE + 0x3)
+#define HFI_ERR_SYS_UNSUPPORT_CMD       (HFI_COMMON_BASE + 0x4)
+#define HFI_ERR_SYS_CMDFAILED           (HFI_COMMON_BASE + 0x5)
+#define HFI_ERR_SYS_CMDSIZE             (HFI_COMMON_BASE + 0x6)
+
+/* System Level Event types */
+#define HFI_EVENT_SYS_ERROR             (HFI_COMMON_BASE + 0x1)
+#define HFI_EVENT_ICP_ERROR             (HFI_COMMON_BASE + 0x2)
+#define HFI_EVENT_IPE_BPS_ERROR         (HFI_COMMON_BASE + 0x3)
+#define HFI_EVENT_CDM_ERROR             (HFI_COMMON_BASE + 0x4)
+#define HFI_EVENT_DBG_ERROR             (HFI_COMMON_BASE + 0x5)
+
+/* Core level start Ranges for errors */
+#define HFI_ERR_ICP_START               (HFI_COMMON_BASE + 0x64)
+#define HFI_ERR_IPE_BPS_START           (HFI_ERR_ICP_START + 0x64)
+#define HFI_ERR_CDM_START               (HFI_ERR_IPE_BPS_START + 0x64)
+#define HFI_ERR_DBG_START               (HFI_ERR_CDM_START + 0x64)
+
+/*ICP Core level  error messages */
+#define HFI_ERR_NO_RES                  (HFI_ERR_ICP_START + 0x1)
+#define HFI_ERR_UNSUPPORTED_RES         (HFI_ERR_ICP_START + 0x2)
+#define HFI_ERR_UNSUPPORTED_PROP        (HFI_ERR_ICP_START + 0x3)
+#define HFI_ERR_INIT_EXPECTED           (HFI_ERR_ICP_START + 0x4)
+#define HFI_ERR_INIT_IGNORED            (HFI_ERR_ICP_START + 0x5)
+
+/* System level commands */
+#define HFI_CMD_COMMON_START \
+		(HFI_DOMAIN_BASE_ICP + HFI_CMD_START_OFFSET + 0x0)
+#define HFI_CMD_SYS_INIT               (HFI_CMD_COMMON_START + 0x1)
+#define HFI_CMD_SYS_PC_PREP            (HFI_CMD_COMMON_START + 0x2)
+#define HFI_CMD_SYS_SET_PROPERTY       (HFI_CMD_COMMON_START + 0x3)
+#define HFI_CMD_SYS_GET_PROPERTY       (HFI_CMD_COMMON_START + 0x4)
+#define HFI_CMD_SYS_PING               (HFI_CMD_COMMON_START + 0x5)
+#define HFI_CMD_SYS_RESET              (HFI_CMD_COMMON_START + 0x6)
+
+/* General Frame process errors */
+#define CAMERAICP_SUCCESS              0
+#define CAMERAICP_EFAILED              1
+#define CAMERAICP_ENOMEMORY            2
+#define CAMERAICP_EBADSTATE            3
+#define CAMERAICP_EBADPARM             4
+#define CAMERAICP_EBADITEM             5
+#define CAMERAICP_EINVALIDFORMAT       6
+#define CAMERAICP_EUNSUPPORTED         7
+#define CAMERAICP_EOUTOFBOUND          8
+#define CAMERAICP_ETIMEDOUT            9
+#define CAMERAICP_EABORTED             10
+#define CAMERAICP_EHWVIOLATION         11
+#define CAMERAICP_ECDMERROR            12
+
+/* HFI Specific errors. */
+#define CAMERAICP_HFI_ERR_COMMAND_SIZE 1000
+#define CAMERAICP_HFI_ERR_MESSAGE_SIZE 1001
+#define CAMERAICP_HFI_QUEUE_EMPTY      1002
+#define CAMERAICP_HFI_QUEUE_FULL       1003
+
+/* Core level commands */
+/* IPE/BPS core Commands */
+#define HFI_CMD_IPE_BPS_COMMON_START \
+		(HFI_DOMAIN_BASE_IPE_BPS + HFI_CMD_START_OFFSET + 0x0)
+#define HFI_CMD_IPEBPS_CREATE_HANDLE \
+		(HFI_CMD_IPE_BPS_COMMON_START + 0x8)
+#define HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT \
+		(HFI_CMD_IPE_BPS_COMMON_START + 0xa)
+#define HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT \
+		(HFI_CMD_IPE_BPS_COMMON_START + 0xe)
+
+/* CDM core Commands */
+#define HFI_CMD_CDM_COMMON_START \
+		(HFI_DOMAIN_BASE_CDM + HFI_CMD_START_OFFSET + 0x0)
+#define HFI_CMD_CDM_TEST_START (HFI_CMD_CDM_COMMON_START + 0x800)
+#define HFI_CMD_CDM_END        (HFI_CMD_CDM_COMMON_START + 0xFFF)
+
+/* Debug/Test Commands */
+#define HFI_CMD_DBG_COMMON_START \
+		(HFI_DOMAIN_BASE_DBG + HFI_CMD_START_OFFSET + 0x0)
+#define HFI_CMD_DBG_TEST_START  (HFI_CMD_DBG_COMMON_START + 0x800)
+#define HFI_CMD_DBG_END         (HFI_CMD_DBG_COMMON_START + 0xFFF)
+
+/* System level messages */
+#define HFI_MSG_ICP_COMMON_START \
+		(HFI_DOMAIN_BASE_ICP + HFI_MSG_START_OFFSET + 0x0)
+#define HFI_MSG_SYS_INIT_DONE           (HFI_MSG_ICP_COMMON_START + 0x1)
+#define HFI_MSG_SYS_PC_PREP_DONE        (HFI_MSG_ICP_COMMON_START + 0x2)
+#define HFI_MSG_SYS_DEBUG               (HFI_MSG_ICP_COMMON_START + 0x3)
+#define HFI_MSG_SYS_IDLE                (HFI_MSG_ICP_COMMON_START + 0x4)
+#define HFI_MSG_SYS_PROPERTY_INFO       (HFI_MSG_ICP_COMMON_START + 0x5)
+#define HFI_MSG_SYS_PING_ACK            (HFI_MSG_ICP_COMMON_START + 0x6)
+#define HFI_MSG_SYS_RESET_ACK           (HFI_MSG_ICP_COMMON_START + 0x7)
+#define HFI_MSG_EVENT_NOTIFY            (HFI_MSG_ICP_COMMON_START + 0x8)
+
+/* Core level Messages */
+/* IPE/BPS core Messages */
+#define HFI_MSG_IPE_BPS_COMMON_START \
+		(HFI_DOMAIN_BASE_IPE_BPS + HFI_MSG_START_OFFSET + 0x0)
+#define HFI_MSG_IPEBPS_CREATE_HANDLE_ACK \
+		(HFI_MSG_IPE_BPS_COMMON_START + 0x08)
+#define HFI_MSG_IPEBPS_ASYNC_COMMAND_DIRECT_ACK \
+		(HFI_MSG_IPE_BPS_COMMON_START + 0x0a)
+#define HFI_MSG_IPEBPS_ASYNC_COMMAND_INDIRECT_ACK \
+		(HFI_MSG_IPE_BPS_COMMON_START + 0x0e)
+#define HFI_MSG_IPE_BPS_TEST_START	\
+		(HFI_MSG_IPE_BPS_COMMON_START + 0x800)
+#define HFI_MSG_IPE_BPS_END \
+		(HFI_MSG_IPE_BPS_COMMON_START + 0xFFF)
+
+/* CDM core Messages */
+#define HFI_MSG_CDM_COMMON_START \
+		(HFI_DOMAIN_BASE_CDM + HFI_MSG_START_OFFSET + 0x0)
+#define  HFI_MSG_PRI_CDM_PAYLOAD_ACK    (HFI_MSG_CDM_COMMON_START + 0xa)
+#define  HFI_MSG_PRI_LLD_PAYLOAD_ACK    (HFI_MSG_CDM_COMMON_START + 0xb)
+#define HFI_MSG_CDM_TEST_START          (HFI_MSG_CDM_COMMON_START + 0x800)
+#define HFI_MSG_CDM_END                 (HFI_MSG_CDM_COMMON_START + 0xFFF)
+
+/* core level test command ranges */
+/* ICP core level test command range */
+#define HFI_CMD_ICP_TEST_START          (HFI_CMD_ICP_COMMON_START + 0x800)
+#define HFI_CMD_ICP_END                 (HFI_CMD_ICP_COMMON_START + 0xFFF)
+
+/* IPE/BPS core level test command range */
+#define HFI_CMD_IPE_BPS_TEST_START \
+		(HFI_CMD_IPE_BPS_COMMON_START + 0x800)
+#define HFI_CMD_IPE_BPS_END (HFI_CMD_IPE_BPS_COMMON_START + 0xFFF)
+
+/* ICP core level test message range */
+#define HFI_MSG_ICP_TEST_START  (HFI_MSG_ICP_COMMON_START + 0x800)
+#define HFI_MSG_ICP_END         (HFI_MSG_ICP_COMMON_START + 0xFFF)
+
+/* ICP core level Debug test message range */
+#define HFI_MSG_DBG_COMMON_START \
+		(HFI_DOMAIN_BASE_DBG + 0x0)
+#define HFI_MSG_DBG_TEST_START  (HFI_MSG_DBG_COMMON_START + 0x800)
+#define HFI_MSG_DBG_END         (HFI_MSG_DBG_COMMON_START + 0xFFF)
+
+/* System  level property base offset */
+#define HFI_PROPERTY_ICP_COMMON_START  (HFI_DOMAIN_BASE_ICP + 0x0)
+
+#define HFI_PROP_SYS_DEBUG_CFG           (HFI_PROPERTY_ICP_COMMON_START + 0x1)
+#define HFI_PROP_SYS_UBWC_CFG            (HFI_PROPERTY_ICP_COMMON_START + 0x2)
+#define HFI_PROP_SYS_IMAGE_VER           (HFI_PROPERTY_ICP_COMMON_START + 0x3)
+#define HFI_PROP_SYS_SUPPORTED           (HFI_PROPERTY_ICP_COMMON_START + 0x4)
+#define HFI_PROP_SYS_IPEBPS_PC           (HFI_PROPERTY_ICP_COMMON_START + 0x5)
+#define HFI_PROP_SYS_FW_DUMP_CFG         (HFI_PROPERTY_ICP_COMMON_START + 0x8)
+#define HFI_PROPERTY_SYS_UBWC_CONFIG_EX  (HFI_PROPERTY_ICP_COMMON_START + 0x9)
+
+/* Capabilities reported at sys init */
+#define HFI_CAPS_PLACEHOLDER_1         (HFI_COMMON_BASE + 0x1)
+#define HFI_CAPS_PLACEHOLDER_2         (HFI_COMMON_BASE + 0x2)
+
+/* Section describes different debug levels (HFI_DEBUG_MSG_X)
+ * available for debug messages from FW
+ */
+#define  HFI_DEBUG_MSG_LOW      0x00000001
+#define  HFI_DEBUG_MSG_MEDIUM   0x00000002
+#define  HFI_DEBUG_MSG_HIGH     0x00000004
+#define  HFI_DEBUG_MSG_ERROR    0x00000008
+#define  HFI_DEBUG_MSG_FATAL    0x00000010
+/* Messages containing performance data */
+#define  HFI_DEBUG_MSG_PERF     0x00000020
+/* Disable ARM9 WFI in low power mode. */
+#define  HFI_DEBUG_CFG_WFI      0x01000000
+/* Disable ARM9 watchdog. */
+#define  HFI_DEBUG_CFG_ARM9WD   0x10000000
+
+
+/*
+ * HFI_FW_DUMP levels
+ * HFI_FW_DUMP_xx
+ */
+#define HFI_FW_DUMP_DISABLED    0x00000000
+#define HFI_FW_DUMP_ON_FAILURE  0x00000001
+#define HFI_FW_DUMP_ALWAYS      0x00000002
+
+/* Number of available dump levels. */
+#define NUM_HFI_DUMP_LVL        0x00000003
+
+/* Debug Msg Communication types:
+ * Section describes different modes (HFI_DEBUG_MODE_X)
+ * available to communicate the debug messages
+ */
+ /* Debug message output through the interface debug queue. */
+#define HFI_DEBUG_MODE_QUEUE     0x00000001
+ /* Debug message output through QDSS. */
+#define HFI_DEBUG_MODE_QDSS      0x00000002
+ /* Number of debug modes available. */
+#define NUM_HFI_DEBUG_MODE       0x00000002
+
+#define HFI_DEBUG_MSG_LOW        0x00000001
+#define HFI_DEBUG_MSG_MEDIUM     0x00000002
+#define HFI_DEBUG_MSG_HIGH       0x00000004
+#define HFI_DEBUG_MSG_ERROR      0x00000008
+#define HFI_DEBUG_MSG_FATAL      0x00000010
+#define HFI_DEBUG_MSG_PERF       0x00000020
+#define HFI_DEBUG_CFG_WFI        0x01000000
+#define HFI_DEBUG_CFG_ARM9WD     0x10000000
+
+#define HFI_DEV_VERSION_MAX      0x5
+
+/**
+ * start of sys command packet types
+ * These commands are used to get system level information
+ * from firmware
+ */
+
+/**
+ * struct hfi_caps_support
+ * payload to report caps through HFI_PROPERTY_PARAM_CAPABILITY_SUPPORTED
+ * @type: capability type
+ * @min: minimum supported value for the capability
+ * @max: maximum supported value for the capability
+ * @step_size: supported steps between min-max
+ */
+struct hfi_caps_support {
+	uint32_t type;
+	uint32_t min;
+	uint32_t max;
+	uint32_t step_size;
+} __packed;
+
+/**
+ * struct hfi_caps_support_info
+ * capability report through HFI_PROPERTY_PARAM_CAPABILITY_SUPPORTED
+ * @num_caps: number of capabilities listed
+ * @caps_data: capabilities info array
+ */
+struct hfi_caps_support_info {
+	uint32_t num_caps;
+    union {
+        struct hfi_caps_support caps_data[1];
+        __DECLARE_FLEX_ARRAY(struct hfi_caps_support, caps_data_flex);
+    };
+} __packed;
+
+/**
+ * struct hfi_debug
+ * payload structure to configure HFI_PROPERTY_SYS_DEBUG_CONFIG
+ * @debug_config: it is a result of HFI_DEBUG_MSG_X values that
+ *                are OR-ed together to specify the debug message types
+ *                to otput
+ * @debug_mode: debug message output through debug queue/qdss
+ * @HFI_PROPERTY_SYS_DEBUG_CONFIG
+ */
+struct hfi_debug {
+	uint32_t debug_config;
+	uint32_t debug_mode;
+} __packed;
+
+/**
+ * struct hfi_ipe_bps_pc
+ * payload structure to configure HFI_PROPERTY_SYS_IPEBPS_PC
+ * @enable: Flag to enable IPE, BPS interfrane power collapse
+ * @core_info: Core information to firmware
+ */
+struct hfi_ipe_bps_pc {
+	uint32_t enable;
+	uint32_t core_info;
+} __packed;
+
+/**
+ * struct hfi_cmd_ubwc_cfg
+ * Payload structure to configure HFI_PROP_SYS_UBWC_CFG
+ * @ubwc_fetch_cfg: UBWC configuration for fecth
+ * @ubwc_write_cfg: UBWC configuration for write
+ */
+struct hfi_cmd_ubwc_cfg {
+	uint32_t ubwc_fetch_cfg;
+	uint32_t ubwc_write_cfg;
+} __packed;
+
+/**
+ * struct hfi_cmd_ubwc_cfg_ext
+ * Payload structure to configure HFI_UBWC_CFG_TYPE_EXT
+ * @bps: UBWC configuration for bps
+ * @ipe: UBWC configuration for ipe
+ */
+struct hfi_cmd_ubwc_cfg_ext {
+	struct hfi_cmd_ubwc_cfg bps;
+	struct hfi_cmd_ubwc_cfg ipe;
+} __packed;
+
+/**
+ * struct hfi_cmd_sys_init
+ * command to initialization of system session
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @HFI_CMD_SYS_INIT
+ */
+struct hfi_cmd_sys_init {
+	uint32_t size;
+	uint32_t pkt_type;
+} __packed;
+
+/**
+ * struct hfi_cmd_pc_prep
+ * command to firmware to prepare for power collapse
+ * @eize: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @HFI_CMD_SYS_PC_PREP
+ */
+struct hfi_cmd_pc_prep {
+	uint32_t size;
+	uint32_t pkt_type;
+} __packed;
+
+/**
+ * struct hfi_cmd_prop
+ * command to get/set properties of firmware
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @num_prop: number of properties queried/set
+ * @prop_data: array of property IDs being queried. size depends on num_prop
+ *             array of property IDs and associated structure pairs in set
+ * @HFI_CMD_SYS_GET_PROPERTY
+ * @HFI_CMD_SYS_SET_PROPERTY
+ */
+struct hfi_cmd_prop {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t num_prop;
+    union {
+        uint32_t prop_data[1];
+        __DECLARE_FLEX_ARRAY(uint32_t, prop_data_flex);
+    };
+} __packed;
+
+/**
+ * struct hfi_cmd_ping_pkt
+ * ping command pings the firmware to confirm whether
+ * it is alive.
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @user_data: client data, firmware returns this data
+ *             as part of HFI_MSG_SYS_PING_ACK
+ * @HFI_CMD_SYS_PING
+ */
+struct hfi_cmd_ping_pkt {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_cmd_sys_reset_pkt
+ * sends the reset command to FW. FW responds in the same type
+ * of packet. so can be used for reset_ack_pkt type also
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @user_data: client data, firmware returns this data
+ *             as part of HFI_MSG_SYS_RESET_ACK
+ * @HFI_CMD_SYS_RESET
+ */
+
+struct hfi_cmd_sys_reset_pkt {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint64_t user_data;
+} __packed;
+
+/* end of sys command packet types */
+
+/* start of sys message packet types */
+
+/**
+ * struct hfi_prop
+ * structure to report maximum supported features of firmware.
+ */
+struct hfi_sys_support {
+	uint32_t place_holder;
+} __packed;
+
+/**
+ * struct hfi_supported_prop
+ * structure to report HFI_PROPERTY_PARAM_PROPERTIES_SUPPORTED
+ * for a session
+ * @num_prop: number of properties supported
+ * @prop_data: array of supported property IDs
+ */
+struct hfi_supported_prop {
+    uint32_t num_prop;
+    union {
+        uint32_t prop_data[1];
+        __DECLARE_FLEX_ARRAY(uint32_t, prop_data_flex);
+    };
+} __packed;
+
+/**
+ * struct hfi_image_version
+ * system image version
+ * @major: major version number
+ * @minor: minor version number
+ * @ver_name_size: size of version name
+ * @ver_name: image version name
+ */
+struct hfi_image_version {
+    uint32_t major;
+    uint32_t minor;
+    uint32_t ver_name_size;
+    union {
+        uint8_t ver_name[1];
+        __DECLARE_FLEX_ARRAY(uint8_t, ver_name_flex);
+    };
+} __packed;
+
+/**
+ * struct hfi_msg_init_done_data
+ * @api_ver:    Firmware API version
+ * @dev_ver:    Device version
+ * @num_icp_hw: Number of ICP hardware information
+ * @dev_hw_ver: Supported hardware version information
+ * @reserved:   Reserved field
+ */
+struct hfi_msg_init_done_data {
+	uint32_t api_ver;
+	uint32_t dev_ver;
+	uint32_t num_icp_hw;
+	uint32_t dev_hw_ver[HFI_DEV_VERSION_MAX];
+	uint32_t reserved;
+};
+
+/**
+ * struct hfi_msg_init_done
+ * system init done message from firmware. Many system level properties
+ * are returned with the packet
+ * @size:      Packet size in bytes
+ * @pkt_type:  Opcode of a packet
+ * @err_type:  Error code associated with response
+ * @num_prop:  Number of default capability info
+ * @prop_data: Array of property ids and corresponding structure pairs
+ */
+struct hfi_msg_init_done {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t err_type;
+	uint32_t num_prop;
+    union {
+        uint32_t prop_data[1];
+        __DECLARE_FLEX_ARRAY(uint32_t, prop_data_flex);
+    };
+} __packed;
+
+/**
+ * struct hfi_msg_pc_prep_done
+ * system power collapse preparation done message
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @err_type: error code associated with the response
+ */
+struct hfi_msg_pc_prep_done {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t err_type;
+} __packed;
+
+/**
+ * struct hfi_msg_prop
+ * system property info from firmware
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @num_prop: number of property info structures
+ * @prop_data: array of property IDs and associated structure pairs
+ */
+struct hfi_msg_prop {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t num_prop;
+    union {
+        uint32_t prop_data[1];
+        __DECLARE_FLEX_ARRAY(uint32_t, prop_data_flex);
+    };
+} __packed;
+
+/**
+ * struct hfi_msg_idle
+ * system idle message from firmware
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ */
+struct hfi_msg_idle {
+	uint32_t size;
+	uint32_t pkt_type;
+} __packed;
+
+/**
+ * struct hfi_msg_ping_ack
+ * system ping ack message
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @user_data: this data is sent as part of ping command from host
+ */
+struct hfi_msg_ping_ack {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint64_t user_data;
+} __packed;
+
+/**
+ * struct hfi_msg_debug
+ * system debug message defination
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @msg_type: debug message type
+ * @msg_size: size of debug message in bytes
+ * @timestamp_hi: most significant 32 bits of the 64 bit timestamp field.
+ *                timestamp shall be interpreted as a signed 64-bit value
+ *                representing microseconds.
+ * @timestamp_lo: least significant 32 bits of the 64 bit timestamp field.
+ *                timestamp shall be interpreted as a signed 64-bit value
+ *                representing microseconds.
+ * @msg_data: message data in string form
+ */
+struct hfi_msg_debug {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t msg_type;
+	uint32_t msg_size;
+	uint32_t timestamp_hi;
+	uint32_t timestamp_lo;
+    union {
+        uint8_t  msg_data[1];
+        __DECLARE_FLEX_ARRAY(uint8_t, msg_data_flex);
+    };
+} __packed;
+/**
+ * struct hfi_msg_event_notify
+ * event notify message
+ * @size: packet size in bytes
+ * @pkt_type: opcode of a packet
+ * @fw_handle: firmware session handle
+ * @event_id: session event id
+ * @event_data1: event data corresponding to event ID
+ * @event_data2: event data corresponding to event ID
+ * @ext_event_data: info array, interpreted based on event_data1
+ * and event_data2
+ */
+struct hfi_msg_event_notify {
+	uint32_t size;
+	uint32_t pkt_type;
+	uint32_t fw_handle;
+	uint32_t event_id;
+	uint32_t event_data1;
+	uint32_t event_data2;
+    union {
+        uint32_t ext_event_data[1];
+        __DECLARE_FLEX_ARRAY(uint32_t, ext_event_data_flex);
+    };
+} __packed;
+/**
+ * end of sys message packet types
+ */
+
+#endif /* _HFI_DEFS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/hfi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/hfi.c
@@ -0,0 +1,914 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <asm/errno.h>
+#include <linux/timer.h>
+#include <media/cam_icp.h>
+#include <linux/iopoll.h>
+
+#include "cam_io_util.h"
+#include "hfi_reg.h"
+#include "hfi_sys_defs.h"
+#include "hfi_session_defs.h"
+#include "hfi_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+#include "cam_compat.h"
+
+#define HFI_VERSION_INFO_MAJOR_VAL  1
+#define HFI_VERSION_INFO_MINOR_VAL  1
+#define HFI_VERSION_INFO_STEP_VAL   0
+#define HFI_VERSION_INFO_STEP_VAL   0
+#define HFI_VERSION_INFO_MAJOR_BMSK  0xFF000000
+#define HFI_VERSION_INFO_MAJOR_SHFT  24
+#define HFI_VERSION_INFO_MINOR_BMSK  0xFFFF00
+#define HFI_VERSION_INFO_MINOR_SHFT  8
+#define HFI_VERSION_INFO_STEP_BMSK   0xFF
+#define HFI_VERSION_INFO_STEP_SHFT  0
+
+#define HFI_MAX_POLL_TRY 5
+#define HFI_POLL_DELAY_US 100
+#define HFI_POLL_TIMEOUT_US 10000
+
+static struct hfi_info *g_hfi;
+unsigned int g_icp_mmu_hdl;
+static DEFINE_MUTEX(hfi_cmd_q_mutex);
+static DEFINE_MUTEX(hfi_msg_q_mutex);
+
+static void hfi_irq_raise(struct hfi_info *hfi)
+{
+	if (hfi->ops.irq_raise)
+		hfi->ops.irq_raise(hfi->priv);
+}
+
+static void hfi_irq_enable(struct hfi_info *hfi)
+{
+	if (hfi->ops.irq_enable)
+		hfi->ops.irq_enable(hfi->priv);
+}
+
+static void __iomem *hfi_iface_addr(struct hfi_info *hfi)
+{
+	void __iomem *ret = NULL;
+
+	if (hfi->ops.iface_addr)
+		ret = hfi->ops.iface_addr(hfi->priv);
+
+	return IS_ERR_OR_NULL(ret) ? NULL : ret;
+}
+
+static void hfi_queue_dump(uint32_t *dwords, int count)
+{
+	int i;
+	int rows;
+	int remaining;
+
+	rows = count / 4;
+	remaining = count % 4;
+
+	for (i = 0; i < rows; i++, dwords += 4)
+		CAM_DBG(CAM_HFI,
+			"word[%04d]: 0x%08x 0x%08x 0x%08x 0x%08x",
+			i * 4, dwords[0], dwords[1], dwords[2], dwords[3]);
+
+	if (remaining == 1)
+		CAM_DBG(CAM_HFI, "word[%04d]: 0x%08x", rows * 4, dwords[0]);
+	else if (remaining == 2)
+		CAM_DBG(CAM_HFI, "word[%04d]: 0x%08x 0x%08x",
+			rows * 4, dwords[0], dwords[1]);
+	else if (remaining == 3)
+		CAM_DBG(CAM_HFI, "word[%04d]: 0x%08x 0x%08x 0x%08x",
+			rows * 4, dwords[0], dwords[1], dwords[2]);
+}
+
+void cam_hfi_queue_dump(void)
+{
+	struct hfi_mem_info *hfi_mem = &g_hfi->map;
+	struct hfi_qtbl *qtbl;
+	struct hfi_q_hdr *q_hdr;
+	uint32_t *dwords;
+	int num_dwords;
+
+	if (!hfi_mem) {
+		CAM_ERR(CAM_HFI, "hfi mem info NULL... unable to dump queues");
+		return;
+	}
+
+	qtbl = (struct hfi_qtbl *)hfi_mem->qtbl.kva;
+	CAM_DBG(CAM_HFI,
+		"qtbl header: version=0x%08x tbl_size=%u numq=%u qhdr_size=%u",
+		qtbl->q_tbl_hdr.qtbl_version,
+		qtbl->q_tbl_hdr.qtbl_size,
+		qtbl->q_tbl_hdr.qtbl_num_q,
+		qtbl->q_tbl_hdr.qtbl_qhdr_size);
+
+	q_hdr = &qtbl->q_hdr[Q_CMD];
+	CAM_DBG(CAM_HFI,
+		"cmd_q: addr=0x%08x size=%u read_idx=%u write_idx=%u",
+		hfi_mem->cmd_q.iova,
+		q_hdr->qhdr_q_size,
+		q_hdr->qhdr_read_idx,
+		q_hdr->qhdr_write_idx);
+
+	dwords = (uint32_t *)hfi_mem->cmd_q.kva;
+	num_dwords = ICP_CMD_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+
+	hfi_queue_dump(dwords, num_dwords);
+
+	q_hdr = &qtbl->q_hdr[Q_MSG];
+	CAM_DBG(CAM_HFI,
+		"msg_q: addr=0x%08x size=%u read_idx=%u write_idx=%u",
+		hfi_mem->msg_q.iova,
+		q_hdr->qhdr_q_size,
+		q_hdr->qhdr_read_idx,
+		q_hdr->qhdr_write_idx);
+
+	dwords = (uint32_t *)hfi_mem->msg_q.kva;
+	num_dwords = ICP_MSG_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+
+	hfi_queue_dump(dwords, num_dwords);
+}
+
+int hfi_write_cmd(void *cmd_ptr)
+{
+	uint32_t size_in_words, empty_space, new_write_idx, read_idx, temp;
+	uint32_t *write_q, *write_ptr;
+	struct hfi_qtbl *q_tbl;
+	struct hfi_q_hdr *q;
+	int rc = 0;
+
+	if (!cmd_ptr) {
+		CAM_ERR(CAM_HFI, "command is null");
+		return -EINVAL;
+	}
+
+	mutex_lock(&hfi_cmd_q_mutex);
+	if (!g_hfi) {
+		CAM_ERR(CAM_HFI, "HFI interface not setup");
+		rc = -ENODEV;
+		goto err;
+	}
+
+	if (g_hfi->hfi_state != HFI_READY ||
+		!g_hfi->cmd_q_state) {
+		CAM_ERR(CAM_HFI, "HFI state: %u, cmd q state: %u",
+			g_hfi->hfi_state, g_hfi->cmd_q_state);
+		rc = -ENODEV;
+		goto err;
+	}
+
+	q_tbl = (struct hfi_qtbl *)g_hfi->map.qtbl.kva;
+	q = &q_tbl->q_hdr[Q_CMD];
+
+	write_q = (uint32_t *)g_hfi->map.cmd_q.kva;
+
+	size_in_words = (*(uint32_t *)cmd_ptr) >> BYTE_WORD_SHIFT;
+	if (!size_in_words) {
+		CAM_DBG(CAM_HFI, "failed");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	read_idx = q->qhdr_read_idx;
+	empty_space = (q->qhdr_write_idx >= read_idx) ?
+		(q->qhdr_q_size - (q->qhdr_write_idx - read_idx)) :
+		(read_idx - q->qhdr_write_idx);
+	if (empty_space <= size_in_words) {
+		CAM_ERR(CAM_HFI, "failed: empty space %u, size_in_words %u",
+			empty_space, size_in_words);
+		rc = -EIO;
+		goto err;
+	}
+
+	new_write_idx = q->qhdr_write_idx + size_in_words;
+	write_ptr = (uint32_t *)(write_q + q->qhdr_write_idx);
+
+	if (new_write_idx < q->qhdr_q_size) {
+		memcpy(write_ptr, (uint8_t *)cmd_ptr,
+			size_in_words << BYTE_WORD_SHIFT);
+	} else {
+		new_write_idx -= q->qhdr_q_size;
+		temp = (size_in_words - new_write_idx) << BYTE_WORD_SHIFT;
+		memcpy(write_ptr, (uint8_t *)cmd_ptr, temp);
+		memcpy(write_q, (uint8_t *)cmd_ptr + temp,
+			new_write_idx << BYTE_WORD_SHIFT);
+	}
+
+	/*
+	 * To make sure command data in a command queue before
+	 * updating write index
+	 */
+	wmb();
+
+	q->qhdr_write_idx = new_write_idx;
+
+	/*
+	 * Before raising interrupt make sure command data is ready for
+	 * firmware to process
+	 */
+	wmb();
+	hfi_irq_raise(g_hfi);
+err:
+	mutex_unlock(&hfi_cmd_q_mutex);
+	return rc;
+}
+
+int hfi_read_message(uint32_t *pmsg, uint8_t q_id,
+	uint32_t *words_read)
+{
+	struct hfi_qtbl *q_tbl_ptr;
+	struct hfi_q_hdr *q;
+	uint32_t new_read_idx, size_in_words, word_diff, temp;
+	uint32_t *read_q, *read_ptr, *write_ptr;
+	uint32_t size_upper_bound = 0;
+	int rc = 0;
+
+	if (!pmsg) {
+		CAM_ERR(CAM_HFI, "Invalid msg");
+		return -EINVAL;
+	}
+
+	if (q_id > Q_DBG) {
+		CAM_ERR(CAM_HFI, "Invalid q :%u", q_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hfi_msg_q_mutex);
+	if (!g_hfi) {
+		CAM_ERR(CAM_HFI, "hfi not set up yet");
+		rc = -ENODEV;
+		goto err;
+	}
+
+	if ((g_hfi->hfi_state != HFI_READY) ||
+		!g_hfi->msg_q_state) {
+		CAM_ERR(CAM_HFI, "hfi state: %u, msg q state: %u",
+			g_hfi->hfi_state, g_hfi->msg_q_state);
+		rc = -ENODEV;
+		goto err;
+	}
+
+	q_tbl_ptr = (struct hfi_qtbl *)g_hfi->map.qtbl.kva;
+	q = &q_tbl_ptr->q_hdr[q_id];
+
+	if (q->qhdr_read_idx == q->qhdr_write_idx) {
+		CAM_DBG(CAM_HFI, "Q not ready, state:%u, r idx:%u, w idx:%u",
+			g_hfi->hfi_state, q->qhdr_read_idx, q->qhdr_write_idx);
+		rc = -EIO;
+		goto err;
+	}
+
+	if (q_id == Q_MSG) {
+		read_q = (uint32_t *)g_hfi->map.msg_q.kva;
+		size_upper_bound = ICP_HFI_MAX_PKT_SIZE_MSGQ_IN_WORDS;
+	} else {
+		read_q = (uint32_t *)g_hfi->map.dbg_q.kva;
+		size_upper_bound = ICP_HFI_MAX_PKT_SIZE_IN_WORDS;
+	}
+
+	read_ptr = (uint32_t *)(read_q + q->qhdr_read_idx);
+	write_ptr = (uint32_t *)(read_q + q->qhdr_write_idx);
+
+	if (write_ptr > read_ptr)
+		size_in_words = write_ptr - read_ptr;
+	else {
+		word_diff = read_ptr - write_ptr;
+		if (q_id == Q_MSG)
+			size_in_words = (ICP_MSG_Q_SIZE_IN_BYTES >>
+			BYTE_WORD_SHIFT) - word_diff;
+		else
+			size_in_words = (ICP_DBG_Q_SIZE_IN_BYTES >>
+			BYTE_WORD_SHIFT) - word_diff;
+	}
+
+	if ((size_in_words == 0) ||
+		(size_in_words > size_upper_bound)) {
+		CAM_ERR(CAM_HFI, "invalid HFI message packet size - 0x%08x",
+			size_in_words << BYTE_WORD_SHIFT);
+		q->qhdr_read_idx = q->qhdr_write_idx;
+		rc = -EIO;
+		goto err;
+	}
+
+	new_read_idx = q->qhdr_read_idx + size_in_words;
+
+	if (new_read_idx < q->qhdr_q_size) {
+		memcpy(pmsg, read_ptr, size_in_words << BYTE_WORD_SHIFT);
+	} else {
+		new_read_idx -= q->qhdr_q_size;
+		temp = (size_in_words - new_read_idx) << BYTE_WORD_SHIFT;
+		memcpy(pmsg, read_ptr, temp);
+		memcpy((uint8_t *)pmsg + temp, read_q,
+			new_read_idx << BYTE_WORD_SHIFT);
+	}
+
+	q->qhdr_read_idx = new_read_idx;
+	*words_read = size_in_words;
+	/* Memory Barrier to make sure message
+	 * queue parameters are updated after read
+	 */
+	wmb();
+err:
+	mutex_unlock(&hfi_msg_q_mutex);
+	return rc;
+}
+
+int hfi_cmd_ubwc_config(uint32_t *ubwc_cfg)
+{
+	uint8_t *prop;
+	struct hfi_cmd_prop *dbg_prop;
+	uint32_t size = 0;
+
+	size = sizeof(struct hfi_cmd_prop) +
+		sizeof(struct hfi_cmd_ubwc_cfg);
+
+	CAM_DBG(CAM_HFI,
+		"size of ubwc %u, ubwc_cfg [rd-0x%x,wr-0x%x]",
+		size, ubwc_cfg[0],  ubwc_cfg[1]);
+
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	dbg_prop = (struct hfi_cmd_prop *)prop;
+	dbg_prop->size = size;
+	dbg_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	dbg_prop->num_prop = 1;
+	dbg_prop->prop_data_flex[0] = HFI_PROP_SYS_UBWC_CFG;
+	dbg_prop->prop_data_flex[1] = ubwc_cfg[0];
+	dbg_prop->prop_data_flex[2] = ubwc_cfg[1];
+
+	hfi_write_cmd(prop);
+	kfree(prop);
+
+	return 0;
+}
+
+int hfi_cmd_ubwc_config_ext(uint32_t *ubwc_ipe_cfg,
+	uint32_t *ubwc_bps_cfg)
+{
+	uint8_t *prop;
+	struct hfi_cmd_prop *dbg_prop;
+	uint32_t size = 0;
+
+	size = sizeof(struct hfi_cmd_prop) +
+		sizeof(struct hfi_cmd_ubwc_cfg_ext);
+
+	CAM_DBG(CAM_HFI,
+		"size of ubwc %u, ubwc_ipe_cfg[rd-0x%x,wr-0x%x] ubwc_bps_cfg[rd-0x%x,wr-0x%x]",
+		size, ubwc_ipe_cfg[0], ubwc_ipe_cfg[1],
+		ubwc_bps_cfg[0], ubwc_bps_cfg[1]);
+
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	dbg_prop = (struct hfi_cmd_prop *)prop;
+	dbg_prop->size = size;
+	dbg_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	dbg_prop->num_prop = 1;
+	dbg_prop->prop_data_flex[0] = HFI_PROPERTY_SYS_UBWC_CONFIG_EX;
+	dbg_prop->prop_data_flex[1] = ubwc_bps_cfg[0];
+	dbg_prop->prop_data_flex[2] = ubwc_bps_cfg[1];
+	dbg_prop->prop_data_flex[3] = ubwc_ipe_cfg[0];
+	dbg_prop->prop_data_flex[4] = ubwc_ipe_cfg[1];
+
+	hfi_write_cmd(prop);
+	kfree(prop);
+
+	return 0;
+}
+
+
+int hfi_enable_ipe_bps_pc(bool enable, uint32_t core_info)
+{
+	uint8_t *prop;
+	struct hfi_cmd_prop *dbg_prop;
+	uint32_t size = 0;
+
+	size = sizeof(struct hfi_cmd_prop) +
+		sizeof(struct hfi_ipe_bps_pc);
+
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	dbg_prop = (struct hfi_cmd_prop *)prop;
+	dbg_prop->size = size;
+	dbg_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	dbg_prop->num_prop = 1;
+	dbg_prop->prop_data_flex[0] = HFI_PROP_SYS_IPEBPS_PC;
+	dbg_prop->prop_data_flex[1] = enable;
+	dbg_prop->prop_data_flex[2] = core_info;
+
+	hfi_write_cmd(prop);
+	kfree(prop);
+
+	return 0;
+}
+
+int hfi_set_debug_level(u64 icp_dbg_type, uint32_t lvl)
+{
+	uint8_t *prop;
+	struct hfi_cmd_prop *dbg_prop;
+	uint32_t size = 0, val;
+
+	val = HFI_DEBUG_MSG_LOW |
+		HFI_DEBUG_MSG_MEDIUM |
+		HFI_DEBUG_MSG_HIGH |
+		HFI_DEBUG_MSG_ERROR |
+		HFI_DEBUG_MSG_FATAL |
+		HFI_DEBUG_MSG_PERF |
+		HFI_DEBUG_CFG_WFI |
+		HFI_DEBUG_CFG_ARM9WD;
+
+	if (lvl > val)
+		return -EINVAL;
+
+	size = sizeof(struct hfi_cmd_prop) +
+		sizeof(struct hfi_debug);
+
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	dbg_prop = (struct hfi_cmd_prop *)prop;
+	dbg_prop->size = size;
+	dbg_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	dbg_prop->num_prop = 1;
+	dbg_prop->prop_data_flex[0] = HFI_PROP_SYS_DEBUG_CFG;
+	dbg_prop->prop_data_flex[1] = lvl;
+	dbg_prop->prop_data_flex[2] = icp_dbg_type;
+	hfi_write_cmd(prop);
+
+	kfree(prop);
+
+	return 0;
+}
+
+int hfi_set_fw_dump_level(uint32_t lvl)
+{
+	uint8_t *prop = NULL;
+	struct hfi_cmd_prop *fw_dump_level_switch_prop = NULL;
+	uint32_t size = 0;
+
+	CAM_DBG(CAM_HFI, "fw dump ENTER");
+
+	size = sizeof(struct hfi_cmd_prop) + sizeof(lvl);
+	prop = kzalloc(size, GFP_KERNEL);
+	if (!prop)
+		return -ENOMEM;
+
+	fw_dump_level_switch_prop = (struct hfi_cmd_prop *)prop;
+	fw_dump_level_switch_prop->size = size;
+	fw_dump_level_switch_prop->pkt_type = HFI_CMD_SYS_SET_PROPERTY;
+	fw_dump_level_switch_prop->num_prop = 1;
+	fw_dump_level_switch_prop->prop_data_flex[0] = HFI_PROP_SYS_FW_DUMP_CFG;
+	fw_dump_level_switch_prop->prop_data_flex[1] = lvl;
+
+	CAM_DBG(CAM_HFI, "prop->size = %d\n"
+			 "prop->pkt_type = %d\n"
+			 "prop->num_prop = %d\n"
+			 "prop->prop_data[0] = %d\n"
+			 "prop->prop_data[1] = %d\n",
+			 fw_dump_level_switch_prop->size,
+			 fw_dump_level_switch_prop->pkt_type,
+			 fw_dump_level_switch_prop->num_prop,
+			 fw_dump_level_switch_prop->prop_data_flex[0],
+			 fw_dump_level_switch_prop->prop_data_flex[1]);
+
+	hfi_write_cmd(prop);
+	kfree(prop);
+	return 0;
+}
+
+void hfi_send_system_cmd(uint32_t type, uint64_t data, uint32_t size)
+{
+	switch (type) {
+	case HFI_CMD_SYS_INIT: {
+		struct hfi_cmd_sys_init init;
+
+		memset(&init, 0, sizeof(init));
+
+		init.size = sizeof(struct hfi_cmd_sys_init);
+		init.pkt_type = type;
+		hfi_write_cmd(&init);
+	}
+		break;
+	case HFI_CMD_SYS_PC_PREP: {
+		struct hfi_cmd_pc_prep prep;
+
+		prep.size = sizeof(struct hfi_cmd_pc_prep);
+		prep.pkt_type = type;
+		hfi_write_cmd(&prep);
+	}
+		break;
+	case HFI_CMD_SYS_SET_PROPERTY: {
+		struct hfi_cmd_prop prop;
+
+		if ((uint32_t)data == (uint32_t)HFI_PROP_SYS_DEBUG_CFG) {
+			prop.size = sizeof(struct hfi_cmd_prop);
+			prop.pkt_type = type;
+			prop.num_prop = 1;
+			prop.prop_data_flex[0] = HFI_PROP_SYS_DEBUG_CFG;
+			hfi_write_cmd(&prop);
+		}
+	}
+		break;
+	case HFI_CMD_SYS_GET_PROPERTY:
+		break;
+	case HFI_CMD_SYS_PING: {
+		struct hfi_cmd_ping_pkt ping;
+
+		ping.size = sizeof(struct hfi_cmd_ping_pkt);
+		ping.pkt_type = type;
+		ping.user_data = (uint64_t)data;
+		hfi_write_cmd(&ping);
+	}
+		break;
+	case HFI_CMD_SYS_RESET: {
+		struct hfi_cmd_sys_reset_pkt reset;
+
+		reset.size = sizeof(struct hfi_cmd_sys_reset_pkt);
+		reset.pkt_type = type;
+		reset.user_data = (uint64_t)data;
+		hfi_write_cmd(&reset);
+	}
+		break;
+	case HFI_CMD_IPEBPS_CREATE_HANDLE: {
+		struct hfi_cmd_create_handle handle;
+
+		handle.size = sizeof(struct hfi_cmd_create_handle);
+		handle.pkt_type = type;
+		handle.handle_type = (uint32_t)data;
+		handle.user_data1 = 0;
+		hfi_write_cmd(&handle);
+	}
+		break;
+	case HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT:
+		break;
+	default:
+		CAM_ERR(CAM_HFI, "command not supported :%d", type);
+		break;
+	}
+}
+
+
+int hfi_get_hw_caps(void *query_buf)
+{
+	int i = 0;
+	struct cam_icp_query_cap_cmd *query_cmd = NULL;
+
+	if (!query_buf) {
+		CAM_ERR(CAM_HFI, "query buf is NULL");
+		return -EINVAL;
+	}
+
+	query_cmd = (struct cam_icp_query_cap_cmd *)query_buf;
+	query_cmd->fw_version.major = 0x12;
+	query_cmd->fw_version.minor = 0x12;
+	query_cmd->fw_version.revision = 0x12;
+
+	query_cmd->api_version.major = 0x13;
+	query_cmd->api_version.minor = 0x13;
+	query_cmd->api_version.revision = 0x13;
+
+	query_cmd->num_ipe = 2;
+	query_cmd->num_bps = 1;
+
+	for (i = 0; i < CAM_ICP_DEV_TYPE_MAX; i++) {
+		query_cmd->dev_ver[i].dev_type = i;
+		query_cmd->dev_ver[i].hw_ver.major = 0x34 + i;
+		query_cmd->dev_ver[i].hw_ver.minor = 0x34 + i;
+		query_cmd->dev_ver[i].hw_ver.incr = 0x34 + i;
+	}
+	return 0;
+}
+
+int cam_hfi_resume(struct hfi_mem_info *hfi_mem)
+{
+	int rc = 0;
+	uint32_t fw_version, status = 0;
+	void __iomem *icp_base = hfi_iface_addr(g_hfi);
+
+	if (!icp_base) {
+		CAM_ERR(CAM_HFI, "invalid HFI interface address");
+		return -EINVAL;
+	}
+
+	if (readl_poll_timeout(icp_base + HFI_REG_ICP_HOST_INIT_RESPONSE,
+			       status, status == ICP_INIT_RESP_SUCCESS,
+			       HFI_POLL_DELAY_US, HFI_POLL_TIMEOUT_US)) {
+		CAM_ERR(CAM_HFI, "response poll timed out: status=0x%08x",
+			status);
+		return -ETIMEDOUT;
+	}
+
+	hfi_irq_enable(g_hfi);
+
+	fw_version = cam_io_r(icp_base + HFI_REG_FW_VERSION);
+	CAM_DBG(CAM_HFI, "fw version : [%x]", fw_version);
+
+	cam_io_w_mb((uint32_t)hfi_mem->qtbl.iova, icp_base + HFI_REG_QTBL_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->sfr_buf.iova,
+		icp_base + HFI_REG_SFR_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->shmem.iova,
+		icp_base + HFI_REG_SHARED_MEM_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->shmem.len,
+		icp_base + HFI_REG_SHARED_MEM_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->sec_heap.iova,
+		icp_base + HFI_REG_UNCACHED_HEAP_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->sec_heap.len,
+		icp_base + HFI_REG_UNCACHED_HEAP_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->qdss.iova,
+		icp_base + HFI_REG_QDSS_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->qdss.len,
+		icp_base + HFI_REG_QDSS_IOVA_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem.iova,
+		icp_base + HFI_REG_IO_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem.len,
+		icp_base + HFI_REG_IO_REGION_SIZE);
+
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem2.iova,
+		icp_base + HFI_REG_IO2_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem2.len,
+		icp_base + HFI_REG_IO2_REGION_SIZE);
+
+	CAM_INFO(CAM_HFI, "Resume IO1 : [0x%x 0x%llx] IO2 [0x%x 0x%llx]",
+		hfi_mem->io_mem.iova, hfi_mem->io_mem.len,
+		hfi_mem->io_mem2.iova, hfi_mem->io_mem2.len);
+
+	return rc;
+}
+
+int cam_hfi_init(struct hfi_mem_info *hfi_mem, const struct hfi_ops *hfi_ops,
+		void *priv, uint8_t event_driven_mode)
+{
+	int rc = 0;
+	struct hfi_qtbl *qtbl;
+	struct hfi_qtbl_hdr *qtbl_hdr;
+	struct hfi_q_hdr *cmd_q_hdr, *msg_q_hdr, *dbg_q_hdr;
+	uint32_t fw_version, status = 0;
+	uint32_t retry_cnt = 0;
+	struct sfr_buf *sfr_buffer;
+	void __iomem *icp_base;
+
+	if (!hfi_mem || !hfi_ops || !priv) {
+		CAM_ERR(CAM_HFI,
+			"invalid arg: hfi_mem=%pK hfi_ops=%pK priv=%pK",
+			hfi_mem, hfi_ops, priv);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hfi_cmd_q_mutex);
+	mutex_lock(&hfi_msg_q_mutex);
+
+	if (!g_hfi) {
+		g_hfi = kzalloc(sizeof(struct hfi_info), GFP_KERNEL);
+		if (!g_hfi) {
+			rc = -ENOMEM;
+			goto alloc_fail;
+		}
+	}
+
+	if (g_hfi->hfi_state != HFI_DEINIT) {
+		CAM_ERR(CAM_HFI, "hfi_init: invalid state");
+		rc = -EINVAL;
+		goto regions_fail;
+	}
+
+	memcpy(&g_hfi->map, hfi_mem, sizeof(g_hfi->map));
+	g_hfi->hfi_state = HFI_DEINIT;
+
+	qtbl = (struct hfi_qtbl *)hfi_mem->qtbl.kva;
+	qtbl_hdr = &qtbl->q_tbl_hdr;
+	qtbl_hdr->qtbl_version = 0xFFFFFFFF;
+	qtbl_hdr->qtbl_size = sizeof(struct hfi_qtbl);
+	qtbl_hdr->qtbl_qhdr0_offset = sizeof(struct hfi_qtbl_hdr);
+	qtbl_hdr->qtbl_qhdr_size = sizeof(struct hfi_q_hdr);
+	qtbl_hdr->qtbl_num_q = ICP_HFI_NUMBER_OF_QS;
+	qtbl_hdr->qtbl_num_active_q = ICP_HFI_NUMBER_OF_QS;
+
+	/* setup host-to-firmware command queue */
+	cmd_q_hdr = &qtbl->q_hdr[Q_CMD];
+	cmd_q_hdr->qhdr_status = QHDR_ACTIVE;
+	cmd_q_hdr->qhdr_start_addr = hfi_mem->cmd_q.iova;
+	cmd_q_hdr->qhdr_q_size =  ICP_CMD_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+	cmd_q_hdr->qhdr_pkt_size = ICP_HFI_VAR_SIZE_PKT;
+	cmd_q_hdr->qhdr_pkt_drop_cnt = RESET;
+	cmd_q_hdr->qhdr_read_idx = RESET;
+	cmd_q_hdr->qhdr_write_idx = RESET;
+
+	/* setup firmware-to-Host message queue */
+	msg_q_hdr = &qtbl->q_hdr[Q_MSG];
+	msg_q_hdr->qhdr_status = QHDR_ACTIVE;
+	msg_q_hdr->qhdr_start_addr = hfi_mem->msg_q.iova;
+	msg_q_hdr->qhdr_q_size = ICP_MSG_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+	msg_q_hdr->qhdr_pkt_size = ICP_HFI_VAR_SIZE_PKT;
+	msg_q_hdr->qhdr_pkt_drop_cnt = RESET;
+	msg_q_hdr->qhdr_read_idx = RESET;
+	msg_q_hdr->qhdr_write_idx = RESET;
+
+	/* setup firmware-to-Host message queue */
+	dbg_q_hdr = &qtbl->q_hdr[Q_DBG];
+	dbg_q_hdr->qhdr_status = QHDR_ACTIVE;
+	dbg_q_hdr->qhdr_start_addr = hfi_mem->dbg_q.iova;
+	dbg_q_hdr->qhdr_q_size = ICP_DBG_Q_SIZE_IN_BYTES >> BYTE_WORD_SHIFT;
+	dbg_q_hdr->qhdr_pkt_size = ICP_HFI_VAR_SIZE_PKT;
+	dbg_q_hdr->qhdr_pkt_drop_cnt = RESET;
+	dbg_q_hdr->qhdr_read_idx = RESET;
+	dbg_q_hdr->qhdr_write_idx = RESET;
+
+	sfr_buffer = (struct sfr_buf *)hfi_mem->sfr_buf.kva;
+	sfr_buffer->size = ICP_MSG_SFR_SIZE_IN_BYTES;
+
+	switch (event_driven_mode) {
+	case INTR_MODE:
+		cmd_q_hdr->qhdr_type = Q_CMD;
+		cmd_q_hdr->qhdr_rx_wm = SET;
+		cmd_q_hdr->qhdr_tx_wm = SET;
+		cmd_q_hdr->qhdr_rx_req = SET;
+		cmd_q_hdr->qhdr_tx_req = RESET;
+		cmd_q_hdr->qhdr_rx_irq_status = RESET;
+		cmd_q_hdr->qhdr_tx_irq_status = RESET;
+
+		msg_q_hdr->qhdr_type = Q_MSG;
+		msg_q_hdr->qhdr_rx_wm = SET;
+		msg_q_hdr->qhdr_tx_wm = SET;
+		msg_q_hdr->qhdr_rx_req = SET;
+		msg_q_hdr->qhdr_tx_req = RESET;
+		msg_q_hdr->qhdr_rx_irq_status = RESET;
+		msg_q_hdr->qhdr_tx_irq_status = RESET;
+
+		dbg_q_hdr->qhdr_type = Q_DBG;
+		dbg_q_hdr->qhdr_rx_wm = SET;
+		dbg_q_hdr->qhdr_tx_wm = SET_WM;
+		dbg_q_hdr->qhdr_rx_req = RESET;
+		dbg_q_hdr->qhdr_tx_req = RESET;
+		dbg_q_hdr->qhdr_rx_irq_status = RESET;
+		dbg_q_hdr->qhdr_tx_irq_status = RESET;
+
+		break;
+
+	case POLL_MODE:
+		cmd_q_hdr->qhdr_type = Q_CMD | TX_EVENT_POLL_MODE_2 |
+			RX_EVENT_POLL_MODE_2;
+		msg_q_hdr->qhdr_type = Q_MSG | TX_EVENT_POLL_MODE_2 |
+			RX_EVENT_POLL_MODE_2;
+		dbg_q_hdr->qhdr_type = Q_DBG | TX_EVENT_POLL_MODE_2 |
+			RX_EVENT_POLL_MODE_2;
+		break;
+
+	case WM_MODE:
+		cmd_q_hdr->qhdr_type = Q_CMD | TX_EVENT_DRIVEN_MODE_2 |
+			RX_EVENT_DRIVEN_MODE_2;
+		cmd_q_hdr->qhdr_rx_wm = SET;
+		cmd_q_hdr->qhdr_tx_wm = SET;
+		cmd_q_hdr->qhdr_rx_req = RESET;
+		cmd_q_hdr->qhdr_tx_req = SET;
+		cmd_q_hdr->qhdr_rx_irq_status = RESET;
+		cmd_q_hdr->qhdr_tx_irq_status = RESET;
+
+		msg_q_hdr->qhdr_type = Q_MSG | TX_EVENT_DRIVEN_MODE_2 |
+			RX_EVENT_DRIVEN_MODE_2;
+		msg_q_hdr->qhdr_rx_wm = SET;
+		msg_q_hdr->qhdr_tx_wm = SET;
+		msg_q_hdr->qhdr_rx_req = SET;
+		msg_q_hdr->qhdr_tx_req = RESET;
+		msg_q_hdr->qhdr_rx_irq_status = RESET;
+		msg_q_hdr->qhdr_tx_irq_status = RESET;
+
+		dbg_q_hdr->qhdr_type = Q_DBG | TX_EVENT_DRIVEN_MODE_2 |
+			RX_EVENT_DRIVEN_MODE_2;
+		dbg_q_hdr->qhdr_rx_wm = SET;
+		dbg_q_hdr->qhdr_tx_wm = SET_WM;
+		dbg_q_hdr->qhdr_rx_req = RESET;
+		dbg_q_hdr->qhdr_tx_req = RESET;
+		dbg_q_hdr->qhdr_rx_irq_status = RESET;
+		dbg_q_hdr->qhdr_tx_irq_status = RESET;
+		break;
+
+	default:
+		CAM_ERR(CAM_HFI, "Invalid event driven mode :%u",
+			event_driven_mode);
+		break;
+	}
+
+	g_hfi->ops = *hfi_ops;
+	g_hfi->priv = priv;
+
+	icp_base = hfi_iface_addr(g_hfi);
+	if (!icp_base) {
+		CAM_ERR(CAM_HFI, "invalid HFI interface address");
+		rc = -EINVAL;
+		goto regions_fail;
+	}
+
+	cam_io_w_mb((uint32_t)hfi_mem->qtbl.iova,
+		icp_base + HFI_REG_QTBL_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->sfr_buf.iova,
+		icp_base + HFI_REG_SFR_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->shmem.iova,
+		icp_base + HFI_REG_SHARED_MEM_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->shmem.len,
+		icp_base + HFI_REG_SHARED_MEM_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->sec_heap.iova,
+		icp_base + HFI_REG_UNCACHED_HEAP_PTR);
+	cam_io_w_mb((uint32_t)hfi_mem->sec_heap.len,
+		icp_base + HFI_REG_UNCACHED_HEAP_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->qdss.iova,
+		icp_base + HFI_REG_QDSS_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->qdss.len,
+		icp_base + HFI_REG_QDSS_IOVA_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem.iova,
+		icp_base + HFI_REG_IO_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem.len,
+		icp_base + HFI_REG_IO_REGION_SIZE);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem2.iova,
+		icp_base + HFI_REG_IO2_REGION_IOVA);
+	cam_io_w_mb((uint32_t)hfi_mem->io_mem2.len,
+		icp_base + HFI_REG_IO2_REGION_SIZE);
+	cam_io_w_mb((uint32_t)ICP_INIT_REQUEST_SET,
+		icp_base + HFI_REG_HOST_ICP_INIT_REQUEST);
+
+	CAM_INFO(CAM_HFI, "Init IO1 : [0x%x 0x%llx] IO2 [0x%x 0x%llx]",
+		hfi_mem->io_mem.iova, hfi_mem->io_mem.len,
+		hfi_mem->io_mem2.iova, hfi_mem->io_mem2.len);
+
+	fw_version = cam_io_r(icp_base + HFI_REG_FW_VERSION);
+
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		readw_poll_timeout((icp_base + HFI_REG_ICP_HOST_INIT_RESPONSE),
+			       status, status == ICP_INIT_RESP_SUCCESS,
+			       HFI_POLL_DELAY_US, HFI_POLL_TIMEOUT_US);
+		CAM_DBG(CAM_HFI, "1: status = %u rc = %d", status, rc);
+		status = cam_io_r_mb(icp_base + HFI_REG_ICP_HOST_INIT_RESPONSE);
+		CAM_DBG(CAM_HFI, "2: status = %u rc = %d", status, rc);
+		if (status == ICP_INIT_RESP_SUCCESS)
+			break;
+
+		if (status == ICP_INIT_RESP_FAILED) {
+			CAM_ERR(CAM_HFI,
+				"ICP Init Failed. status %u fw version :[%x]",
+				status, fw_version);
+			goto regions_fail;
+		}
+		retry_cnt++;
+	}
+
+	if ((retry_cnt == HFI_MAX_POLL_TRY) &&
+		(status != ICP_INIT_RESP_SUCCESS)) {
+		CAM_ERR(CAM_HFI,
+			"Reached Max retries. status = %u fw version : [%x]",
+				status, fw_version);
+		goto regions_fail;
+	}
+
+	CAM_INFO(CAM_HFI, "fw version : [%x]", fw_version);
+
+	g_hfi->hfi_state = HFI_READY;
+	g_hfi->cmd_q_state = true;
+	g_hfi->msg_q_state = true;
+
+	hfi_irq_enable(g_hfi);
+
+	mutex_unlock(&hfi_cmd_q_mutex);
+	mutex_unlock(&hfi_msg_q_mutex);
+
+	return rc;
+regions_fail:
+	kfree(g_hfi);
+	g_hfi = NULL;
+alloc_fail:
+	mutex_unlock(&hfi_cmd_q_mutex);
+	mutex_unlock(&hfi_msg_q_mutex);
+	return rc;
+}
+
+void cam_hfi_deinit(void)
+{
+	mutex_lock(&hfi_cmd_q_mutex);
+	mutex_lock(&hfi_msg_q_mutex);
+
+	if (!g_hfi) {
+		CAM_ERR(CAM_HFI, "hfi path not established yet");
+		goto err;
+	}
+
+	g_hfi->cmd_q_state = false;
+	g_hfi->msg_q_state = false;
+
+	cam_free_clear((void *)g_hfi);
+	g_hfi = NULL;
+
+err:
+	mutex_unlock(&hfi_cmd_q_mutex);
+	mutex_unlock(&hfi_msg_q_mutex);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_core.c
@@ -0,0 +1,770 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/elf.h>
+#include <linux/iopoll.h>
+#include <media/cam_icp.h>
+#include "cam_io_util.h"
+#include "cam_a5_hw_intf.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "a5_core.h"
+#include "a5_reg.h"
+#include "a5_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "hfi_intf.h"
+#include "hfi_sys_defs.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_compat.h"
+
+#define PC_POLL_DELAY_US 100
+#define PC_POLL_TIMEOUT_US 10000
+
+#define A5_GEN_PURPOSE_REG_OFFSET 0x40
+
+static int cam_a5_cpas_vote(struct cam_a5_device_core_info *core_info,
+	struct cam_icp_cpas_vote *cpas_vote)
+{
+	int rc = 0;
+
+	if (cpas_vote->ahb_vote_valid)
+		rc = cam_cpas_update_ahb_vote(core_info->cpas_handle,
+			&cpas_vote->ahb_vote);
+
+	if (cpas_vote->axi_vote_valid)
+		rc = cam_cpas_update_axi_vote(core_info->cpas_handle,
+			&cpas_vote->axi_vote);
+
+	if (rc)
+		CAM_ERR(CAM_ICP, "cpas vote is failed: %d", rc);
+
+	return rc;
+}
+
+static int32_t cam_icp_validate_fw(const uint8_t *elf)
+{
+	struct elf32_hdr *elf_hdr;
+
+	if (!elf) {
+		CAM_ERR(CAM_ICP, "Invalid params");
+		return -EINVAL;
+	}
+
+	elf_hdr = (struct elf32_hdr *)elf;
+
+	if (memcmp(elf_hdr->e_ident, ELFMAG, SELFMAG)) {
+		CAM_ERR(CAM_ICP, "ICP elf identifier is failed");
+		return -EINVAL;
+	}
+
+	/* check architecture */
+	if (elf_hdr->e_machine != EM_ARM) {
+		CAM_ERR(CAM_ICP, "unsupported arch");
+		return -EINVAL;
+	}
+
+	/* check elf bit format */
+	if (elf_hdr->e_ident[EI_CLASS] != ELFCLASS32) {
+		CAM_ERR(CAM_ICP, "elf doesn't support 32 bit format");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int32_t cam_icp_get_fw_size(const uint8_t *elf, uint32_t *fw_size)
+{
+	int32_t rc = 0;
+	int32_t i = 0;
+	uint32_t num_prg_hdrs;
+	unsigned char *icp_prg_hdr_tbl;
+	uint32_t seg_mem_size = 0;
+	struct elf32_hdr *elf_hdr;
+	struct elf32_phdr *prg_hdr;
+
+	if (!elf || !fw_size) {
+		CAM_ERR(CAM_ICP, "invalid args");
+		return -EINVAL;
+	}
+
+	*fw_size = 0;
+
+	elf_hdr = (struct elf32_hdr *)elf;
+	num_prg_hdrs = elf_hdr->e_phnum;
+	icp_prg_hdr_tbl = (unsigned char *)elf + elf_hdr->e_phoff;
+	prg_hdr = (struct elf32_phdr *)&icp_prg_hdr_tbl[0];
+
+	if (!prg_hdr) {
+		CAM_ERR(CAM_ICP, "failed to get elf program header attr");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "num_prg_hdrs = %d", num_prg_hdrs);
+	for (i = 0; i < num_prg_hdrs; i++, prg_hdr++) {
+		if (prg_hdr->p_flags == 0)
+			continue;
+
+		seg_mem_size = (prg_hdr->p_memsz + prg_hdr->p_align - 1) &
+					~(prg_hdr->p_align - 1);
+		seg_mem_size += prg_hdr->p_vaddr;
+		CAM_DBG(CAM_ICP, "memsz:%x align:%x addr:%x seg_mem_size:%x",
+			(int)prg_hdr->p_memsz, (int)prg_hdr->p_align,
+			(int)prg_hdr->p_vaddr, (int)seg_mem_size);
+		if (*fw_size < seg_mem_size)
+			*fw_size = seg_mem_size;
+
+	}
+
+	if (*fw_size == 0) {
+		CAM_ERR(CAM_ICP, "invalid elf fw file");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int32_t cam_icp_program_fw(const uint8_t *elf,
+		struct cam_a5_device_core_info *core_info)
+{
+	int32_t rc = 0;
+	uint32_t num_prg_hdrs;
+	unsigned char *icp_prg_hdr_tbl;
+	int32_t i = 0;
+	u8 *dest;
+	u8 *src;
+	struct elf32_hdr *elf_hdr;
+	struct elf32_phdr *prg_hdr;
+
+	elf_hdr = (struct elf32_hdr *)elf;
+	num_prg_hdrs = elf_hdr->e_phnum;
+	icp_prg_hdr_tbl = (unsigned char *)elf + elf_hdr->e_phoff;
+	prg_hdr = (struct elf32_phdr *)&icp_prg_hdr_tbl[0];
+
+	if (!prg_hdr) {
+		CAM_ERR(CAM_ICP, "failed to get elf program header attr");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_prg_hdrs; i++, prg_hdr++) {
+		if (prg_hdr->p_flags == 0)
+			continue;
+
+		CAM_DBG(CAM_ICP, "Loading FW header size: %u",
+			prg_hdr->p_filesz);
+		if (prg_hdr->p_filesz != 0) {
+			src = (u8 *)((u8 *)elf + prg_hdr->p_offset);
+			dest = (u8 *)(((u8 *)core_info->fw_kva_addr) +
+				prg_hdr->p_vaddr);
+
+			memcpy_toio(dest, src, prg_hdr->p_filesz);
+		}
+	}
+
+	return rc;
+}
+
+static int32_t cam_a5_download_fw(void *device_priv)
+{
+	int32_t rc = 0;
+	uint32_t fw_size;
+	const uint8_t *fw_start = NULL;
+	struct cam_hw_info *a5_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_a5_device_core_info *core_info = NULL;
+	struct cam_a5_device_hw_info *hw_info = NULL;
+	struct platform_device         *pdev = NULL;
+	struct a5_soc_info *cam_a5_soc_info = NULL;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &a5_dev->soc_info;
+	core_info = (struct cam_a5_device_core_info *)a5_dev->core_info;
+	hw_info = core_info->a5_hw_info;
+	pdev = soc_info->pdev;
+	cam_a5_soc_info = soc_info->soc_private;
+
+	if (cam_a5_soc_info->fw_name) {
+		CAM_INFO(CAM_ICP, "Downloading firmware %s",
+			cam_a5_soc_info->fw_name);
+		rc = request_firmware(&core_info->fw_elf,
+				cam_a5_soc_info->fw_name, &pdev->dev);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Failed to locate fw: %d", rc);
+			return rc;
+		}
+	} else {
+		rc = request_firmware(&core_info->fw_elf,
+				"CAMERA_ICP.elf", &pdev->dev);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Failed to locate fw: %d", rc);
+			return rc;
+		}
+	}
+
+	if (!core_info->fw_elf) {
+		CAM_ERR(CAM_ICP, "Invalid elf size");
+		rc = -EINVAL;
+		goto fw_download_failed;
+	}
+
+	fw_start = core_info->fw_elf->data;
+	rc = cam_icp_validate_fw(fw_start);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "fw elf validation failed");
+		goto fw_download_failed;
+	}
+
+	rc = cam_icp_get_fw_size(fw_start, &fw_size);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "unable to get fw size");
+		goto fw_download_failed;
+	}
+
+	if (core_info->fw_buf_len < fw_size) {
+		CAM_ERR(CAM_ICP, "mismatch in fw size: %u %llu",
+			fw_size, core_info->fw_buf_len);
+		rc = -EINVAL;
+		goto fw_download_failed;
+	}
+
+	rc = cam_icp_program_fw(fw_start, core_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "fw program is failed");
+		goto fw_download_failed;
+	}
+
+fw_download_failed:
+	release_firmware(core_info->fw_elf);
+	return rc;
+}
+
+static int cam_a5_fw_dump(
+	struct cam_icp_hw_dump_args    *dump_args,
+	struct cam_a5_device_core_info *core_info)
+{
+	u8                         *dest;
+	u8                         *src;
+	uint64_t                    size_required;
+	struct cam_icp_dump_header *hdr;
+
+	if (!core_info || !dump_args) {
+		CAM_ERR(CAM_ICP, "invalid params %pK %pK",
+		    core_info, dump_args);
+		return -EINVAL;
+	}
+	if (!core_info->fw_kva_addr || !dump_args->cpu_addr) {
+		CAM_ERR(CAM_ICP, "invalid params %pK, 0x%zx",
+		    (void *)core_info->fw_kva_addr, dump_args->cpu_addr);
+		return -EINVAL;
+	}
+
+	size_required = core_info->fw_buf_len +
+		sizeof(struct cam_icp_dump_header);
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ICP, "Dump offset overshoot len %zu offset %zu",
+			dump_args->buf_len, dump_args->offset);
+		return -ENOSPC;
+	}
+
+	if ((dump_args->buf_len - dump_args->offset) < size_required) {
+		CAM_WARN(CAM_ICP, "Dump buffer exhaust required %llu len %llu",
+			size_required, core_info->fw_buf_len);
+		return -ENOSPC;
+	}
+
+	dest = (u8 *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_icp_dump_header *)dest;
+	scnprintf(hdr->tag, CAM_ICP_DUMP_TAG_MAX_LEN, "ICP_FW:");
+	hdr->word_size = sizeof(u8);
+	hdr->size = core_info->fw_buf_len;
+	src = (u8 *)core_info->fw_kva_addr;
+	dest = (u8 *)dest + sizeof(struct cam_icp_dump_header);
+	memcpy_fromio(dest, src, core_info->fw_buf_len);
+	dump_args->offset += hdr->size + sizeof(struct cam_icp_dump_header);
+	return 0;
+}
+
+int cam_a5_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *a5_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_a5_device_core_info *core_info = NULL;
+	struct a5_soc_info *a5_soc_info;
+	struct cam_icp_cpas_vote cpas_vote;
+	unsigned long flags;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &a5_dev->soc_info;
+	core_info = (struct cam_a5_device_core_info *)a5_dev->core_info;
+
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info: %pK core_info: %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	a5_soc_info = soc_info->soc_private;
+
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_ICP_DEFAULT_AXI_PATH;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_ICP_DEFAULT_AXI_TRANSAC;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_ICP_A5_BW_BYTES_VOTE;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_ICP_A5_BW_BYTES_VOTE;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_ICP_A5_BW_BYTES_VOTE;
+	cpas_vote.axi_vote.axi_path[0].ddr_ab_bw =
+		CAM_ICP_A5_BW_BYTES_VOTE;
+	cpas_vote.axi_vote.axi_path[0].ddr_ib_bw =
+		CAM_ICP_A5_BW_BYTES_VOTE;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cpas start failed: %d", rc);
+		goto error;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_a5_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "soc enable is failed: %d", rc);
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	} else {
+		CAM_DBG(CAM_ICP, "a5_qos %d", a5_soc_info->a5_qos_val);
+		if (a5_soc_info->a5_qos_val)
+			cam_io_w_mb(a5_soc_info->a5_qos_val,
+				soc_info->reg_map[A5_SIERRA_BASE].mem_base +
+				ICP_SIERRA_A5_CSR_ACCESS);
+	}
+
+	spin_lock_irqsave(&a5_dev->hw_lock, flags);
+	a5_dev->hw_state = CAM_HW_STATE_POWER_UP;
+	spin_unlock_irqrestore(&a5_dev->hw_lock, flags);
+
+error:
+	return rc;
+}
+
+int cam_a5_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *a5_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_a5_device_core_info *core_info = NULL;
+	unsigned long flags;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &a5_dev->soc_info;
+	core_info = (struct cam_a5_device_core_info *)a5_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&a5_dev->hw_lock, flags);
+	a5_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	spin_unlock_irqrestore(&a5_dev->hw_lock, flags);
+
+	rc = cam_a5_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ICP, "soc disable is failed: %d", rc);
+
+	if (core_info->cpas_start) {
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	}
+
+	return rc;
+}
+
+static int cam_a5_power_resume(struct cam_hw_info *a5_info, bool debug_enabled)
+{
+	uint32_t val = A5_CSR_FULL_CPU_EN;
+	void __iomem *base;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct a5_soc_info *a5_soc_info;
+
+	if (!a5_info) {
+		CAM_ERR(CAM_ICP, "invalid A5 device info");
+		return -EINVAL;
+	}
+
+	base = a5_info->soc_info.reg_map[A5_SIERRA_BASE].mem_base;
+	soc_info = &a5_info->soc_info;
+	a5_soc_info = soc_info->soc_private;
+
+	cam_io_w_mb(A5_CSR_A5_CPU_EN, base + ICP_SIERRA_A5_CSR_A5_CONTROL);
+	cam_io_w_mb(A5_CSR_FUNC_RESET, base + ICP_SIERRA_A5_CSR_NSEC_RESET);
+
+	if (debug_enabled)
+		val |= A5_CSR_FULL_DBG_EN;
+
+	cam_io_w_mb(val, base + ICP_SIERRA_A5_CSR_A5_CONTROL);
+	cam_io_w_mb(a5_soc_info->a5_qos_val,
+		base + ICP_SIERRA_A5_CSR_ACCESS);
+
+	CAM_DBG(CAM_ICP, "a5 qos-val : 0x%x",
+		cam_io_r_mb(base + ICP_SIERRA_A5_CSR_ACCESS));
+
+	return 0;
+}
+
+static int cam_a5_power_collapse(struct cam_hw_info *a5_info)
+{
+	uint32_t val, status = 0;
+	void __iomem *base;
+
+	if (!a5_info) {
+		CAM_ERR(CAM_ICP, "invalid A5 device info");
+		return -EINVAL;
+	}
+
+	base = a5_info->soc_info.reg_map[A5_SIERRA_BASE].mem_base;
+
+	/**
+	 * Need to poll here to confirm that FW has triggered WFI
+	 * and Host can then proceed. No interrupt is expected
+	 * from FW at this time.
+	 */
+	if (readl_poll_timeout(base + ICP_SIERRA_A5_CSR_A5_STATUS,
+				status, status & A5_CSR_A5_STANDBYWFI,
+				PC_POLL_DELAY_US, PC_POLL_TIMEOUT_US)) {
+		CAM_ERR(CAM_ICP, "WFI poll timed out: status=0x%08x", status);
+		return -ETIMEDOUT;
+	}
+
+	val = cam_io_r(base + ICP_SIERRA_A5_CSR_A5_CONTROL);
+	val &= ~(A5_CSR_A5_CPU_EN | A5_CSR_WAKE_UP_EN);
+	cam_io_w_mb(val, base + ICP_SIERRA_A5_CSR_A5_CONTROL);
+
+	return 0;
+}
+
+irqreturn_t cam_a5_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *a5_dev = data;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_a5_device_core_info *core_info = NULL;
+	struct cam_a5_device_hw_info *hw_info = NULL;
+	uint32_t irq_status = 0;
+
+	if (!data) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info or query_cap args");
+		return IRQ_HANDLED;
+	}
+
+	spin_lock(&a5_dev->hw_lock);
+	if (a5_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ICP, "ICP HW powered off");
+		spin_unlock(&a5_dev->hw_lock);
+		return IRQ_HANDLED;
+	}
+	spin_unlock(&a5_dev->hw_lock);
+
+	soc_info = &a5_dev->soc_info;
+	core_info = (struct cam_a5_device_core_info *)a5_dev->core_info;
+	hw_info = core_info->a5_hw_info;
+
+	irq_status = cam_io_r_mb(soc_info->reg_map[A5_SIERRA_BASE].mem_base +
+				core_info->a5_hw_info->a5_host_int_status);
+
+	cam_io_w_mb(irq_status,
+			soc_info->reg_map[A5_SIERRA_BASE].mem_base +
+			core_info->a5_hw_info->a5_host_int_clr);
+
+	if ((irq_status & A5_WDT_0) ||
+		(irq_status & A5_WDT_1)) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP, "watch dog interrupt from A5");
+	}
+
+	spin_lock(&a5_dev->hw_lock);
+	if (core_info->irq_cb.icp_hw_mgr_cb)
+		core_info->irq_cb.icp_hw_mgr_cb(irq_status,
+					core_info->irq_cb.data);
+	spin_unlock(&a5_dev->hw_lock);
+
+	return IRQ_HANDLED;
+}
+
+void cam_a5_irq_raise(void *priv)
+{
+	struct cam_hw_info *a5_info = priv;
+
+	if (!a5_info) {
+		CAM_ERR(CAM_ICP, "invalid A5 device info");
+		return;
+	}
+
+	cam_io_w_mb(A5_HOSTINT,
+		a5_info->soc_info.reg_map[A5_SIERRA_BASE].mem_base +
+		ICP_SIERRA_A5_CSR_HOST2ICPINT);
+}
+
+void cam_a5_irq_enable(void *priv)
+{
+	struct cam_hw_info *a5_info = priv;
+
+	if (!a5_info) {
+		CAM_ERR(CAM_ICP, "invalid A5 device info");
+		return;
+	}
+
+	cam_io_w_mb(A5_WDT_WS0EN | A5_A2HOSTINTEN,
+		a5_info->soc_info.reg_map[A5_SIERRA_BASE].mem_base +
+		ICP_SIERRA_A5_CSR_A2HOSTINTEN);
+}
+
+void __iomem *cam_a5_iface_addr(void *priv)
+{
+	struct cam_hw_info *a5_info = priv;
+	void __iomem *base;
+
+	if (!a5_info) {
+		CAM_ERR(CAM_ICP, "invalid A5 device info");
+		return ERR_PTR(-EINVAL);
+	}
+
+	base = a5_info->soc_info.reg_map[A5_SIERRA_BASE].mem_base;
+
+	return base + A5_GEN_PURPOSE_REG_OFFSET;
+}
+
+int cam_a5_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *a5_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_a5_device_core_info *core_info = NULL;
+	struct cam_a5_device_hw_info *hw_info = NULL;
+	struct a5_soc_info *a5_soc = NULL;
+	unsigned long flags;
+	uint32_t ubwc_ipe_cfg[ICP_UBWC_MAX] = {0};
+	uint32_t ubwc_bps_cfg[ICP_UBWC_MAX] = {0};
+	uint32_t index = 0;
+	int rc = 0, ddr_type = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_ICP_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &a5_dev->soc_info;
+	core_info = (struct cam_a5_device_core_info *)a5_dev->core_info;
+	hw_info = core_info->a5_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ICP_CMD_FW_DOWNLOAD:
+		rc = cam_a5_download_fw(device_priv);
+		break;
+	case CAM_ICP_CMD_POWER_COLLAPSE:
+		rc = cam_a5_power_collapse(a5_dev);
+		break;
+	case CAM_ICP_CMD_POWER_RESUME:
+		rc = cam_a5_power_resume(a5_dev, *((bool *)cmd_args));
+		break;
+	case CAM_ICP_CMD_SET_FW_BUF: {
+		struct cam_icp_a5_set_fw_buf_info *fw_buf_info = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		core_info->fw_buf = fw_buf_info->iova;
+		core_info->fw_kva_addr = fw_buf_info->kva;
+		core_info->fw_buf_len = fw_buf_info->len;
+
+		CAM_DBG(CAM_ICP, "fw buf info = %x %llx %lld",
+			core_info->fw_buf, core_info->fw_kva_addr,
+			core_info->fw_buf_len);
+		break;
+	}
+	case CAM_ICP_SET_IRQ_CB: {
+		struct cam_icp_set_irq_cb *irq_cb = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		spin_lock_irqsave(&a5_dev->hw_lock, flags);
+		core_info->irq_cb.icp_hw_mgr_cb = irq_cb->icp_hw_mgr_cb;
+		core_info->irq_cb.data = irq_cb->data;
+		spin_unlock_irqrestore(&a5_dev->hw_lock, flags);
+		break;
+	}
+
+	case CAM_ICP_SEND_INIT:
+		hfi_send_system_cmd(HFI_CMD_SYS_INIT, 0, 0);
+		break;
+
+	case CAM_ICP_CMD_PC_PREP:
+		hfi_send_system_cmd(HFI_CMD_SYS_PC_PREP, 0, 0);
+		break;
+
+	case CAM_ICP_CMD_VOTE_CPAS: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		cam_a5_cpas_vote(core_info, cpas_vote);
+		break;
+	}
+
+	case CAM_ICP_CMD_CPAS_START: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		if (!core_info->cpas_start) {
+			rc = cam_cpas_start(core_info->cpas_handle,
+					&cpas_vote->ahb_vote,
+					&cpas_vote->axi_vote);
+			core_info->cpas_start = true;
+		}
+		break;
+	}
+
+	case CAM_ICP_CMD_CPAS_STOP:
+		if (core_info->cpas_start) {
+			cam_cpas_stop(core_info->cpas_handle);
+			core_info->cpas_start = false;
+		}
+		break;
+	case CAM_ICP_CMD_UBWC_CFG: {
+		struct a5_ubwc_cfg_ext *ubwc_cfg_ext = NULL;
+		uint32_t *disable_ubwc_comp;
+
+		a5_soc = soc_info->soc_private;
+		if (!a5_soc) {
+			CAM_ERR(CAM_ICP, "A5 private soc info is NULL");
+			return -EINVAL;
+		}
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "Invalid args");
+			return -EINVAL;
+		}
+
+		disable_ubwc_comp = (uint32_t *)cmd_args;
+
+		if (a5_soc->ubwc_config_ext) {
+			/* Invoke kernel API to determine DDR type */
+			ddr_type = cam_get_ddr_type();
+			if ((ddr_type == DDR_TYPE_LPDDR5) ||
+				(ddr_type == DDR_TYPE_LPDDR5X))
+				index = 1;
+
+			ubwc_cfg_ext = &a5_soc->uconfig.ubwc_cfg_ext;
+			ubwc_ipe_cfg[0] =
+				ubwc_cfg_ext->ubwc_ipe_fetch_cfg[index];
+			ubwc_ipe_cfg[1] =
+				ubwc_cfg_ext->ubwc_ipe_write_cfg[index];
+			ubwc_bps_cfg[0] =
+				ubwc_cfg_ext->ubwc_bps_fetch_cfg[index];
+			ubwc_bps_cfg[1] =
+				ubwc_cfg_ext->ubwc_bps_write_cfg[index];
+			if (*disable_ubwc_comp) {
+				ubwc_ipe_cfg[1] &= ~CAM_ICP_UBWC_COMP_EN;
+				ubwc_bps_cfg[1] &= ~CAM_ICP_UBWC_COMP_EN;
+				CAM_DBG(CAM_ICP,
+					"Force disable UBWC compression, ubwc_ipe_cfg: 0x%x, ubwc_bps_cfg: 0x%x",
+					ubwc_ipe_cfg[1], ubwc_bps_cfg[1]);
+			}
+			rc = hfi_cmd_ubwc_config_ext(&ubwc_ipe_cfg[0],
+					&ubwc_bps_cfg[0]);
+		} else {
+			rc = hfi_cmd_ubwc_config(a5_soc->uconfig.ubwc_cfg);
+		}
+
+		break;
+	}
+	case CAM_ICP_CMD_CLK_UPDATE: {
+		int32_t clk_level = 0;
+		struct cam_ahb_vote ahb_vote;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "Invalid args");
+			return -EINVAL;
+		}
+
+		clk_level = *((int32_t *)cmd_args);
+		CAM_DBG(CAM_ICP,
+			"Update ICP clock to level [%d]", clk_level);
+		rc = cam_a5_update_clk_rate(soc_info, clk_level);
+		if (rc)
+			CAM_ERR(CAM_ICP,
+				"Failed to update clk to level: %d rc: %d",
+				clk_level, rc);
+
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = clk_level;
+		cam_cpas_update_ahb_vote(
+			core_info->cpas_handle, &ahb_vote);
+		break;
+	}
+	case CAM_ICP_CMD_HW_DUMP: {
+		struct cam_icp_hw_dump_args *dump_args = cmd_args;
+
+		rc = cam_a5_fw_dump(dump_args, core_info);
+		break;
+	}
+	default:
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_core.h
@@ -0,0 +1,98 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_A5_CORE_H
+#define CAM_A5_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include "cam_a5_hw_intf.h"
+
+#define A5_QGIC_BASE            0
+#define A5_SIERRA_BASE          1
+#define A5_CSR_BASE             2
+
+#define A5_HOST_INT             0x1
+#define A5_WDT_0                0x2
+#define A5_WDT_1                0x4
+
+#define ICP_SIERRA_A5_CSR_ACCESS 0x3C
+
+#define ELF_GUARD_PAGE          (2 * 1024 * 1024)
+
+struct cam_a5_device_hw_info {
+	uint32_t hw_ver;
+	uint32_t nsec_reset;
+	uint32_t a5_control;
+	uint32_t a5_host_int_en;
+	uint32_t a5_host_int;
+	uint32_t a5_host_int_clr;
+	uint32_t a5_host_int_status;
+	uint32_t a5_host_int_set;
+	uint32_t host_a5_int;
+	uint32_t fw_version;
+	uint32_t init_req;
+	uint32_t init_response;
+	uint32_t shared_mem_ptr;
+	uint32_t shared_mem_size;
+	uint32_t qtbl_ptr;
+	uint32_t uncached_heap_ptr;
+	uint32_t uncached_heap_size;
+	uint32_t a5_status;
+};
+
+/**
+ * struct cam_a5_device_hw_info
+ * @a5_hw_info: A5 hardware info
+ * @fw_elf: start address of fw start with elf header
+ * @fw: start address of fw blob
+ * @fw_buf: smmu alloc/mapped fw buffer
+ * @fw_buf_len: fw buffer length
+ * @query_cap: A5 query info from firmware
+ * @a5_acquire: Acquire information of A5
+ * @irq_cb: IRQ callback
+ * @cpas_handle: CPAS handle for A5
+ * @cpast_start: state variable for cpas
+ */
+struct cam_a5_device_core_info {
+	struct cam_a5_device_hw_info *a5_hw_info;
+	const struct firmware *fw_elf;
+	void *fw;
+	uint32_t fw_buf;
+	uintptr_t fw_kva_addr;
+	uint64_t fw_buf_len;
+	struct cam_icp_a5_query_cap query_cap;
+	struct cam_icp_a5_acquire_dev a5_acquire[8];
+	struct cam_icp_set_irq_cb irq_cb;
+	uint32_t cpas_handle;
+	bool cpas_start;
+};
+
+int cam_a5_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_a5_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_a5_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+irqreturn_t cam_a5_irq(int irq_num, void *data);
+
+void cam_a5_irq_raise(void *priv);
+void cam_a5_irq_enable(void *priv);
+void __iomem *cam_a5_iface_addr(void *priv);
+
+/**
+ * @brief : API to register a5 hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_a5_init_module(void);
+
+/**
+ * @brief : API to remove a5 hw from platform framework.
+ */
+void cam_a5_exit_module(void);
+#endif /* CAM_A5_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_dev.c
@@ -0,0 +1,276 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+#include "a5_core.h"
+#include "a5_soc.h"
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_a5_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+struct a5_soc_info cam_a5_soc_info;
+EXPORT_SYMBOL(cam_a5_soc_info);
+
+struct cam_a5_device_hw_info cam_a5_hw_info = {
+	.hw_ver = 0x0,
+	.nsec_reset = 0x4,
+	.a5_control = 0x8,
+	.a5_host_int_en = 0x10,
+	.a5_host_int = 0x14,
+	.a5_host_int_clr = 0x18,
+	.a5_host_int_status = 0x1c,
+	.a5_host_int_set = 0x20,
+	.host_a5_int = 0x30,
+	.fw_version = 0x44,
+	.init_req = 0x48,
+	.init_response = 0x4c,
+	.shared_mem_ptr = 0x50,
+	.shared_mem_size = 0x54,
+	.qtbl_ptr = 0x58,
+	.uncached_heap_ptr = 0x5c,
+	.uncached_heap_size = 0x60,
+	.a5_status = 0x200,
+};
+EXPORT_SYMBOL(cam_a5_hw_info);
+
+static bool cam_a5_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool error_handled = false;
+
+	if (!irq_data)
+		return error_handled;
+
+	switch (irq_data->irq_type) {
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC Decode error type=%d status=%x thr_err=%d, fcl_err=%d, len_md_err=%d, format_err=%d",
+			irq_data->irq_type,
+			irq_data->u.dec_err.decerr_status.value,
+			irq_data->u.dec_err.decerr_status.thr_err,
+			irq_data->u.dec_err.decerr_status.fcl_err,
+			irq_data->u.dec_err.decerr_status.len_md_err,
+			irq_data->u.dec_err.decerr_status.format_err);
+		error_handled = true;
+		break;
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC Encode error type=%d status=%x",
+			irq_data->irq_type,
+			irq_data->u.enc_err.encerr_status.value);
+		error_handled = true;
+		break;
+	default:
+		break;
+	}
+
+	return error_handled;
+}
+
+static int cam_a5_register_cpas(struct cam_hw_soc_info *soc_info,
+			struct cam_a5_device_core_info *core_info,
+			uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "icp", sizeof("icp"));
+	cpas_register_params.cam_cpas_client_cb = cam_a5_cpas_cb;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed: %d", rc);
+		return rc;
+	}
+
+	core_info->cpas_handle = cpas_register_params.client_handle;
+	return rc;
+}
+
+static int cam_a5_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct cam_hw_info *a5_dev = NULL;
+	struct cam_hw_intf *a5_dev_intf = NULL;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_a5_device_core_info *core_info = NULL;
+	struct cam_a5_device_hw_info *hw_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	a5_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!a5_dev_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &a5_dev_intf->hw_idx);
+
+	a5_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!a5_dev) {
+		rc = -ENOMEM;
+		goto a5_dev_alloc_failure;
+	}
+
+	a5_dev->soc_info.pdev = pdev;
+	a5_dev->soc_info.dev = &pdev->dev;
+	a5_dev->soc_info.dev_name = pdev->name;
+	a5_dev_intf->hw_priv = a5_dev;
+	a5_dev_intf->hw_ops.init = cam_a5_init_hw;
+	a5_dev_intf->hw_ops.deinit = cam_a5_deinit_hw;
+	a5_dev_intf->hw_ops.process_cmd = cam_a5_process_cmd;
+	a5_dev_intf->hw_type = CAM_ICP_DEV_A5;
+
+	CAM_DBG(CAM_ICP, "type %d index %d",
+		a5_dev_intf->hw_type,
+		a5_dev_intf->hw_idx);
+
+	platform_set_drvdata(pdev, a5_dev_intf);
+
+	a5_dev->core_info = kzalloc(sizeof(struct cam_a5_device_core_info),
+					GFP_KERNEL);
+	if (!a5_dev->core_info) {
+		rc = -ENOMEM;
+		goto core_info_alloc_failure;
+	}
+	core_info = (struct cam_a5_device_core_info *)a5_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ICP, "No a5 hardware info");
+		rc = -EINVAL;
+		goto match_err;
+	}
+	hw_info = (struct cam_a5_device_hw_info *)match_dev->data;
+	core_info->a5_hw_info = hw_info;
+
+	a5_dev->soc_info.soc_private = &cam_a5_soc_info;
+
+	rc = cam_a5_init_soc_resources(&a5_dev->soc_info, cam_a5_irq,
+		a5_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed to init_soc");
+		goto init_soc_failure;
+	}
+
+	CAM_DBG(CAM_ICP, "soc info : %pK",
+			(void *)&a5_dev->soc_info);
+	rc = cam_a5_register_cpas(&a5_dev->soc_info,
+			core_info, a5_dev_intf->hw_idx);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "a5 cpas registration failed");
+		goto cpas_reg_failed;
+	}
+	a5_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&a5_dev->hw_mutex);
+	spin_lock_init(&a5_dev->hw_lock);
+	init_completion(&a5_dev->hw_complete);
+
+	CAM_DBG(CAM_ICP, "A5:%d component bound successfully",
+		a5_dev_intf->hw_idx);
+	return 0;
+
+cpas_reg_failed:
+	cam_a5_deinit_soc_resources(&a5_dev->soc_info);
+init_soc_failure:
+match_err:
+	kfree(a5_dev->core_info);
+core_info_alloc_failure:
+	kfree(a5_dev);
+a5_dev_alloc_failure:
+	kfree(a5_dev_intf);
+
+	return rc;
+
+}
+
+static void cam_a5_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *a5_dev = NULL;
+	struct cam_hw_intf *a5_dev_intf = NULL;
+	struct cam_a5_device_core_info *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	a5_dev_intf = platform_get_drvdata(pdev);
+	a5_dev = a5_dev_intf->hw_priv;
+	core_info = (struct cam_a5_device_core_info *)a5_dev->core_info;
+	cam_cpas_unregister_client(core_info->cpas_handle);
+	cam_a5_deinit_soc_resources(&a5_dev->soc_info);
+	memset(&cam_a5_soc_info, 0, sizeof(struct a5_soc_info));
+	kfree(a5_dev->core_info);
+	a5_dev->core_info = NULL;
+	kfree(a5_dev);
+	kfree(a5_dev_intf);
+}
+
+const static struct component_ops cam_a5_component_ops = {
+	.bind = cam_a5_component_bind,
+	.unbind = cam_a5_component_unbind,
+};
+
+static int cam_a5_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "Adding A5 component");
+	rc = component_add(&pdev->dev, &cam_a5_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_a5_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_a5_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_a5_dt_match[] = {
+	{
+		.compatible = "qcom,cam-a5",
+		.data = &cam_a5_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_a5_dt_match);
+
+struct platform_driver cam_a5_driver = {
+	.probe = cam_a5_probe,
+	.remove = cam_a5_remove,
+	.driver = {
+		.name = "cam-a5",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_a5_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_a5_init_module(void)
+{
+	return platform_driver_register(&cam_a5_driver);
+}
+
+void cam_a5_exit_module(void)
+{
+	platform_driver_unregister(&cam_a5_driver);
+}
+
+MODULE_DESCRIPTION("CAM A5 driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_reg.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_A5_REG_H_
+#define _CAM_A5_REG_H_
+
+#define ICP_SIERRA_A5_CSR_NSEC_RESET    0x4
+#define A5_CSR_FUNC_RESET               (1 << 4)
+#define A5_CSR_DBG_RESET                (1 << 3)
+#define A5_CSR_CPU_RESET                (1 << 2)
+
+#define ICP_SIERRA_A5_CSR_A5_CONTROL    0x8
+#define A5_CSR_DBGSWENABLE              (1 << 22)
+#define A5_CSR_EDBGRQ                   (1 << 14)
+#define A5_CSR_EN_CLKGATE_WFI           (1 << 12)
+#define A5_CSR_A5_CPU_EN                (1 << 9)
+#define A5_CSR_WAKE_UP_EN               (1 << 4)
+
+#define A5_CSR_FULL_DBG_EN      (A5_CSR_DBGSWENABLE | A5_CSR_EDBGRQ)
+#define A5_CSR_FULL_CPU_EN      (A5_CSR_A5_CPU_EN | \
+				A5_CSR_WAKE_UP_EN | \
+				A5_CSR_EN_CLKGATE_WFI)
+
+#define ICP_SIERRA_A5_CSR_A2HOSTINTEN   0x10
+#define A5_WDT_WS1EN                    (1 << 2)
+#define A5_WDT_WS0EN                    (1 << 1)
+#define A5_A2HOSTINTEN                  (1 << 0)
+
+#define ICP_SIERRA_A5_CSR_HOST2ICPINT   0x30
+#define A5_HOSTINT                      (1 << 0)
+
+#define ICP_SIERRA_A5_CSR_A5_STATUS     0x200
+#define A5_CSR_A5_STANDBYWFI            (1 << 7)
+
+#endif /* _CAM_A5_REG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_soc.c
@@ -0,0 +1,252 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "a5_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+static int cam_a5_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0, i;
+	const char *fw_name;
+	struct a5_soc_info *a5_soc_info;
+	struct device_node *of_node = NULL;
+	struct platform_device *pdev = NULL;
+	struct a5_ubwc_cfg_ext *ubwc_cfg_ext = NULL;
+	int num_ubwc_cfg;
+
+	pdev = soc_info->pdev;
+	of_node = pdev->dev.of_node;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "get a5 dt prop is failed");
+		return rc;
+	}
+
+	a5_soc_info = soc_info->soc_private;
+
+	rc = of_property_read_string(of_node, "fw_name", &fw_name);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "fw_name read failed");
+		goto end;
+	}
+
+	a5_soc_info->fw_name = fw_name;
+
+	rc = of_property_read_u32(of_node, "qos-val",
+		&a5_soc_info->a5_qos_val);
+	if (rc < 0) {
+		CAM_WARN(CAM_ICP, "QoS need not be set");
+		a5_soc_info->a5_qos_val = 0;
+	}
+
+	ubwc_cfg_ext = &a5_soc_info->uconfig.ubwc_cfg_ext;
+	num_ubwc_cfg = of_property_count_u32_elems(of_node,
+		"ubwc-ipe-fetch-cfg");
+	if ((num_ubwc_cfg < 0) || (num_ubwc_cfg > ICP_UBWC_MAX)) {
+		CAM_DBG(CAM_ICP, "wrong ubwc_ipe_fetch_cfg: %d", num_ubwc_cfg);
+		rc = num_ubwc_cfg;
+		goto ubwc_ex_cfg;
+	}
+
+	for (i = 0; i < num_ubwc_cfg; i++) {
+		rc = of_property_read_u32_index(of_node, "ubwc-ipe-fetch-cfg",
+			i, &ubwc_cfg_ext->ubwc_ipe_fetch_cfg[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ICP,
+				"unable to read ubwc_ipe_fetch_cfg values");
+			goto end;
+		}
+	}
+
+	num_ubwc_cfg = of_property_count_u32_elems(of_node,
+		"ubwc-ipe-write-cfg");
+	if ((num_ubwc_cfg < 0) || (num_ubwc_cfg > ICP_UBWC_MAX)) {
+		CAM_ERR(CAM_ICP, "wrong ubwc_ipe_write_cfg: %d", num_ubwc_cfg);
+		rc = num_ubwc_cfg;
+		goto end;
+	}
+
+	for (i = 0; i < num_ubwc_cfg; i++) {
+		rc = of_property_read_u32_index(of_node, "ubwc-ipe-write-cfg",
+				i, &ubwc_cfg_ext->ubwc_ipe_write_cfg[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ICP,
+				"unable to read ubwc_ipe_write_cfg values");
+			goto end;
+		}
+	}
+
+	num_ubwc_cfg = of_property_count_u32_elems(of_node,
+		"ubwc-bps-fetch-cfg");
+	if ((num_ubwc_cfg < 0) || (num_ubwc_cfg > ICP_UBWC_MAX)) {
+		CAM_ERR(CAM_ICP, "wrong ubwc_bps_fetch_cfg: %d", num_ubwc_cfg);
+		rc = num_ubwc_cfg;
+		goto end;
+	}
+
+	for (i = 0; i < num_ubwc_cfg; i++) {
+		rc = of_property_read_u32_index(of_node, "ubwc-bps-fetch-cfg",
+			i, &ubwc_cfg_ext->ubwc_bps_fetch_cfg[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ICP,
+				"unable to read ubwc_bps_fetch_cfg values");
+			goto end;
+		}
+	}
+
+	num_ubwc_cfg = of_property_count_u32_elems(of_node,
+		"ubwc-bps-write-cfg");
+	if ((num_ubwc_cfg < 0) || (num_ubwc_cfg > ICP_UBWC_MAX)) {
+		CAM_ERR(CAM_ICP, "wrong ubwc_bps_write_cfg: %d", num_ubwc_cfg);
+		rc = num_ubwc_cfg;
+		goto end;
+	}
+
+	for (i = 0; i < num_ubwc_cfg; i++) {
+		rc = of_property_read_u32_index(of_node, "ubwc-bps-write-cfg",
+			i, &ubwc_cfg_ext->ubwc_bps_write_cfg[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ICP,
+				"unable to read ubwc_bps_write_cfg values");
+			goto end;
+		}
+	}
+
+	a5_soc_info->ubwc_config_ext = true;
+	CAM_DBG(CAM_ICP, "read ubwc_cfg_ext for ipe/bps");
+	return rc;
+
+ubwc_ex_cfg:
+	num_ubwc_cfg = of_property_count_u32_elems(of_node, "ubwc-cfg");
+	if ((num_ubwc_cfg < 0) || (num_ubwc_cfg > ICP_UBWC_MAX)) {
+		CAM_ERR(CAM_ICP, "wrong ubwc_cfg: %d", num_ubwc_cfg);
+		rc = num_ubwc_cfg;
+		goto end;
+	}
+
+	for (i = 0; i < num_ubwc_cfg; i++) {
+		rc = of_property_read_u32_index(of_node, "ubwc-cfg",
+			i, &a5_soc_info->uconfig.ubwc_cfg[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ICP, "unable to read ubwc_cfg values");
+			break;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_a5_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t a5_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, a5_irq_handler,
+		irq_data);
+
+	return rc;
+}
+
+int cam_a5_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t a5_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_a5_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_a5_request_platform_resource(soc_info, a5_irq_handler,
+		irq_data);
+	if (rc < 0)
+		return rc;
+
+	return rc;
+}
+
+void cam_a5_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_WARN(CAM_ICP, "release platform resources fail");
+}
+
+int cam_a5_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_SVS_VOTE, true);
+	if (rc)
+		CAM_ERR(CAM_ICP, "enable platform failed");
+
+	return rc;
+}
+
+int cam_a5_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc)
+		CAM_ERR(CAM_ICP, "disable platform failed");
+
+	return rc;
+}
+
+int cam_a5_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	int32_t clk_level)
+{
+	int32_t src_clk_idx = 0;
+	int32_t clk_rate = 0;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ICP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if ((clk_level < 0) || (clk_level >= CAM_MAX_VOTE)) {
+		CAM_ERR(CAM_ICP, "clock level %d is not valid",
+			clk_level);
+		return -EINVAL;
+	}
+
+	if (!soc_info->clk_level_valid[clk_level]) {
+		CAM_ERR(CAM_ICP,
+			"Clock level %d not supported",
+			clk_level);
+		return -EINVAL;
+	}
+
+	src_clk_idx = soc_info->src_clk_idx;
+	if ((src_clk_idx < 0) || (src_clk_idx >= CAM_SOC_MAX_CLK)) {
+		CAM_WARN(CAM_ICP, "src_clk not defined for %s",
+			soc_info->dev_name);
+		return -EINVAL;
+	}
+
+	clk_rate = soc_info->clk_rate[clk_level][src_clk_idx];
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE]) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_ICP, "clk_rate %d greater than max, reset to %d",
+			clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	return cam_soc_util_set_src_clk_rate(soc_info, clk_rate);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/a5_hw/a5_soc.h
@@ -0,0 +1,41 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_A5_SOC_H
+#define CAM_A5_SOC_H
+
+#include "cam_soc_util.h"
+
+#define ICP_UBWC_MAX 2
+
+struct a5_ubwc_cfg_ext {
+	uint32_t ubwc_ipe_fetch_cfg[ICP_UBWC_MAX];
+	uint32_t ubwc_ipe_write_cfg[ICP_UBWC_MAX];
+	uint32_t ubwc_bps_fetch_cfg[ICP_UBWC_MAX];
+	uint32_t ubwc_bps_write_cfg[ICP_UBWC_MAX];
+};
+
+struct a5_soc_info {
+	const char *fw_name;
+	bool ubwc_config_ext;
+	uint32_t a5_qos_val;
+	union {
+		uint32_t ubwc_cfg[ICP_UBWC_MAX];
+		struct a5_ubwc_cfg_ext ubwc_cfg_ext;
+	} uconfig;
+};
+
+int cam_a5_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t a5_irq_handler, void *irq_data);
+
+void cam_a5_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_a5_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_a5_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_a5_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	int32_t clk_level);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_core.c
@@ -0,0 +1,476 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "bps_core.h"
+#include "bps_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_bps_hw_intf.h"
+#include "cam_icp_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "hfi_reg.h"
+
+#define HFI_MAX_POLL_TRY 5
+
+static int cam_bps_cpas_vote(struct cam_bps_device_core_info *core_info,
+			struct cam_icp_cpas_vote *cpas_vote)
+{
+	int rc = 0;
+
+	if (cpas_vote->ahb_vote_valid)
+		rc = cam_cpas_update_ahb_vote(core_info->cpas_handle,
+				&cpas_vote->ahb_vote);
+	if (cpas_vote->axi_vote_valid)
+		rc = cam_cpas_update_axi_vote(core_info->cpas_handle,
+				&cpas_vote->axi_vote);
+
+	if (rc < 0)
+		CAM_ERR(CAM_PERF, "cpas vote is failed: %d", rc);
+
+	return rc;
+}
+
+
+int cam_bps_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *bps_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	struct cam_icp_cpas_vote cpas_vote;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_BPS_DEFAULT_AXI_PATH;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_BPS_DEFAULT_AXI_TRANSAC;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].ddr_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].ddr_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+			&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cpas start failed: %d", rc);
+		goto error;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_bps_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "soc enable is failed: %d", rc);
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	} else {
+		core_info->clk_enable = true;
+	}
+
+error:
+	return rc;
+}
+
+int cam_bps_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *bps_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	rc = cam_bps_disable_soc_resources(soc_info, core_info->clk_enable);
+	if (rc)
+		CAM_ERR(CAM_ICP, "soc disable is failed: %d", rc);
+	core_info->clk_enable = false;
+
+	if (core_info->cpas_start) {
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	}
+
+	return rc;
+}
+
+static int cam_bps_handle_pc(struct cam_hw_info *bps_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	struct cam_bps_device_hw_info *hw_info = NULL;
+	int rc = 0;
+	int pwr_ctrl;
+	int pwr_status;
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	hw_info = core_info->bps_hw_info;
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (!(pwr_ctrl & BPS_COLLAPSE_MASK)) {
+		rc = cam_cpas_reg_read(core_info->cpas_handle,
+				CAM_CPAS_REG_CPASTOP, hw_info->pwr_status,
+				true, &pwr_status);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+			return rc;
+		}
+
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP,
+			hw_info->pwr_ctrl, true, 0x1);
+
+		if ((pwr_status >> BPS_PWR_ON_MASK))
+			CAM_WARN(CAM_PERF, "BPS: pwr_status(%x):pwr_ctrl(%x)",
+				pwr_status, pwr_ctrl);
+	}
+
+	rc = cam_bps_get_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_status,
+			true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return 0;
+}
+
+static int cam_bps_handle_resume(struct cam_hw_info *bps_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	struct cam_bps_device_hw_info *hw_info = NULL;
+	int pwr_ctrl;
+	int pwr_status;
+	int rc = 0;
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	hw_info = core_info->bps_hw_info;
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (pwr_ctrl & BPS_COLLAPSE_MASK) {
+		CAM_DBG(CAM_PERF, "BPS: pwr_ctrl set(%x)", pwr_ctrl);
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP,
+			hw_info->pwr_ctrl, true, 0);
+	}
+
+	rc = cam_bps_transfer_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to transfer gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_status,
+			true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return rc;
+}
+
+static int cam_bps_cmd_reset(struct cam_hw_soc_info *soc_info,
+	struct cam_bps_device_core_info *core_info)
+{
+	uint32_t retry_cnt = 0;
+	uint32_t status = 0;
+	int pwr_ctrl, pwr_status, rc = 0;
+	bool reset_bps_cdm_fail = false;
+	bool reset_bps_top_fail = false;
+
+	CAM_DBG(CAM_ICP, "CAM_ICP_BPS_CMD_RESET");
+
+	if (!core_info->clk_enable || !core_info->cpas_start) {
+		CAM_ERR(CAM_ICP, "BPS reset failed. clk_en %d cpas_start %d",
+				core_info->clk_enable, core_info->cpas_start);
+		return -EINVAL;
+	}
+
+	/* Reset BPS CDM core*/
+	cam_io_w_mb((uint32_t)0xF,
+		soc_info->reg_map[0].mem_base + BPS_CDM_RST_CMD);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		readw_poll_timeout((soc_info->reg_map[0].mem_base +
+			BPS_CDM_IRQ_STATUS),
+			status, ((status & BPS_RST_DONE_IRQ_STATUS_BIT) == 0x1),
+			100, 10000);
+
+		CAM_DBG(CAM_ICP, "bps_cdm_irq_status = %u", status);
+
+		if ((status & BPS_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+	status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		BPS_CDM_IRQ_STATUS);
+	if ((status & BPS_RST_DONE_IRQ_STATUS_BIT) != 0x1) {
+		CAM_ERR(CAM_ICP, "BPS CDM rst failed status 0x%x", status);
+		reset_bps_cdm_fail = true;
+	}
+
+	/* Reset BPS core*/
+	status = 0;
+	cam_io_w_mb((uint32_t)0x3,
+		soc_info->reg_map[0].mem_base + BPS_TOP_RST_CMD);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		readw_poll_timeout((soc_info->reg_map[0].mem_base +
+			BPS_TOP_IRQ_STATUS),
+			status, ((status & BPS_RST_DONE_IRQ_STATUS_BIT) == 0x1),
+			100, 10000);
+
+		CAM_DBG(CAM_ICP, "bps_top_irq_status = %u", status);
+
+		if ((status & BPS_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+	status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		BPS_TOP_IRQ_STATUS);
+	if ((status & BPS_RST_DONE_IRQ_STATUS_BIT) != 0x1) {
+		CAM_ERR(CAM_ICP, "BPS top rst failed status 0x%x", status);
+		reset_bps_top_fail = true;
+	}
+
+	cam_bps_get_gdsc_control(soc_info);
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REG_CPASTOP, core_info->bps_hw_info->pwr_ctrl,
+		true, &pwr_ctrl);
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REG_CPASTOP, core_info->bps_hw_info->pwr_status,
+		true, &pwr_status);
+	CAM_DBG(CAM_ICP, "(After) pwr_ctrl = %x pwr_status = %x",
+		pwr_ctrl, pwr_status);
+
+	if (reset_bps_cdm_fail || reset_bps_top_fail)
+		rc = -EAGAIN;
+
+	return rc;
+}
+
+int cam_bps_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *bps_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_bps_device_core_info *core_info = NULL;
+	struct cam_bps_device_hw_info *hw_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_ICP_BPS_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &bps_dev->soc_info;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	hw_info = core_info->bps_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ICP_BPS_CMD_VOTE_CPAS: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		cam_bps_cpas_vote(core_info, cpas_vote);
+		break;
+	}
+
+	case CAM_ICP_BPS_CMD_CPAS_START: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_ICP, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		if (!core_info->cpas_start) {
+			rc = cam_cpas_start(core_info->cpas_handle,
+					&cpas_vote->ahb_vote,
+					&cpas_vote->axi_vote);
+			core_info->cpas_start = true;
+		}
+		break;
+	}
+
+	case CAM_ICP_BPS_CMD_CPAS_STOP:
+		if (core_info->cpas_start) {
+			cam_cpas_stop(core_info->cpas_handle);
+			core_info->cpas_start = false;
+		}
+		break;
+	case CAM_ICP_BPS_CMD_POWER_COLLAPSE:
+		rc = cam_bps_handle_pc(bps_dev);
+		break;
+	case CAM_ICP_BPS_CMD_POWER_RESUME:
+		rc = cam_bps_handle_resume(bps_dev);
+		break;
+	case CAM_ICP_BPS_CMD_UPDATE_CLK: {
+		struct cam_icp_clk_update_cmd *clk_upd_cmd = cmd_args;
+		struct cam_ahb_vote ahb_vote;
+		uint32_t clk_rate = clk_upd_cmd->curr_clk_rate;
+		int32_t clk_level  = 0, err = 0;
+
+		CAM_DBG(CAM_PERF, "bps_src_clk rate = %d", (int)clk_rate);
+
+		if (!core_info->clk_enable) {
+			if (clk_upd_cmd->ipe_bps_pc_enable) {
+				cam_bps_handle_pc(bps_dev);
+				cam_cpas_reg_write(core_info->cpas_handle,
+					CAM_CPAS_REG_CPASTOP,
+					hw_info->pwr_ctrl, true, 0x0);
+			}
+			rc = cam_bps_toggle_clk(soc_info, true);
+			if (rc)
+				CAM_ERR(CAM_ICP, "Enable failed");
+			else
+				core_info->clk_enable = true;
+			if (clk_upd_cmd->ipe_bps_pc_enable) {
+				rc = cam_bps_handle_resume(bps_dev);
+				if (rc)
+					CAM_ERR(CAM_ICP, "BPS resume failed");
+			}
+		}
+		CAM_DBG(CAM_PERF, "clock rate %d", clk_rate);
+		rc = cam_bps_update_clk_rate(soc_info, clk_rate);
+		if (rc)
+			CAM_ERR(CAM_PERF, "Failed to update clk %d", clk_rate);
+
+		err = cam_soc_util_get_clk_level(soc_info,
+			clk_rate, soc_info->src_clk_idx,
+			&clk_level);
+
+		if (!err) {
+			ahb_vote.type = CAM_VOTE_ABSOLUTE;
+			ahb_vote.vote.level = clk_level;
+			cam_cpas_update_ahb_vote(
+				core_info->cpas_handle,
+				&ahb_vote);
+		}
+		break;
+	}
+	case CAM_ICP_BPS_CMD_DISABLE_CLK:
+		if (core_info->clk_enable == true)
+			cam_bps_toggle_clk(soc_info, false);
+		core_info->clk_enable = false;
+		break;
+	case CAM_ICP_BPS_CMD_RESET:
+		rc = cam_bps_cmd_reset(soc_info, core_info);
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid Cmd Type:%u", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+irqreturn_t cam_bps_irq(int irq_num, void *data)
+{
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_core.h
@@ -0,0 +1,50 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_BPS_CORE_H
+#define CAM_BPS_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#define BPS_COLLAPSE_MASK 0x1
+#define BPS_PWR_ON_MASK   0x2
+
+struct cam_bps_device_hw_info {
+	uint32_t hw_idx;
+	uint32_t pwr_ctrl;
+	uint32_t pwr_status;
+	uint32_t reserved;
+};
+
+struct cam_bps_device_core_info {
+	struct cam_bps_device_hw_info *bps_hw_info;
+	uint32_t cpas_handle;
+	bool cpas_start;
+	bool clk_enable;
+};
+
+int cam_bps_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_bps_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_bps_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+irqreturn_t cam_bps_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register BPS hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_bps_init_module(void);
+
+/**
+ * @brief : API to remove BPS Hw from platform framework.
+ */
+void cam_bps_exit_module(void);
+#endif /* CAM_BPS_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_dev.c
@@ -0,0 +1,252 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+#include "bps_core.h"
+#include "bps_soc.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_icp_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_bps_device_hw_info cam_bps_hw_info = {
+	.hw_idx = 0,
+	.pwr_ctrl = 0x5c,
+	.pwr_status = 0x58,
+	.reserved = 0,
+};
+
+static char bps_dev_name[8];
+
+static bool cam_bps_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool error_handled = false;
+
+	if (!irq_data)
+		return error_handled;
+
+	switch (irq_data->irq_type) {
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_DECODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC Decode error type=%d status=%x thr_err=%d, fcl_err=%d, len_md_err=%d, format_err=%d",
+			irq_data->irq_type,
+			irq_data->u.dec_err.decerr_status.value,
+			irq_data->u.dec_err.decerr_status.thr_err,
+			irq_data->u.dec_err.decerr_status.fcl_err,
+			irq_data->u.dec_err.decerr_status.len_md_err,
+			irq_data->u.dec_err.decerr_status.format_err);
+		error_handled = true;
+		break;
+	case CAM_CAMNOC_IRQ_IPE_BPS_UBWC_ENCODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IPE/BPS UBWC Encode error type=%d status=%x",
+			irq_data->irq_type,
+			irq_data->u.enc_err.encerr_status.value);
+		error_handled = true;
+		break;
+	default:
+		break;
+	}
+
+	return error_handled;
+}
+
+static int cam_bps_register_cpas(struct cam_hw_soc_info *soc_info,
+			struct cam_bps_device_core_info *core_info,
+			uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "bps", sizeof("bps"));
+	cpas_register_params.cam_cpas_client_cb = cam_bps_cpas_cb;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_bps_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info            *bps_dev = NULL;
+	struct cam_hw_intf            *bps_dev_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_bps_device_core_info   *core_info = NULL;
+	struct cam_bps_device_hw_info     *hw_info = NULL;
+	int                                rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	bps_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!bps_dev_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &bps_dev_intf->hw_idx);
+
+	bps_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!bps_dev) {
+		kfree(bps_dev_intf);
+		return -ENOMEM;
+	}
+
+	memset(bps_dev_name, 0, sizeof(bps_dev_name));
+	snprintf(bps_dev_name, sizeof(bps_dev_name),
+		"bps%1u", bps_dev_intf->hw_idx);
+
+	bps_dev->soc_info.pdev = pdev;
+	bps_dev->soc_info.dev = &pdev->dev;
+	bps_dev->soc_info.dev_name = bps_dev_name;
+	bps_dev_intf->hw_priv = bps_dev;
+	bps_dev_intf->hw_ops.init = cam_bps_init_hw;
+	bps_dev_intf->hw_ops.deinit = cam_bps_deinit_hw;
+	bps_dev_intf->hw_ops.process_cmd = cam_bps_process_cmd;
+	bps_dev_intf->hw_type = CAM_ICP_DEV_BPS;
+	platform_set_drvdata(pdev, bps_dev_intf);
+	bps_dev->core_info = kzalloc(sizeof(struct cam_bps_device_core_info),
+					GFP_KERNEL);
+	if (!bps_dev->core_info) {
+		kfree(bps_dev);
+		kfree(bps_dev_intf);
+		return -ENOMEM;
+	}
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ICP, "No bps hardware info");
+		kfree(bps_dev->core_info);
+		kfree(bps_dev);
+		kfree(bps_dev_intf);
+		rc = -EINVAL;
+		return rc;
+	}
+	hw_info = &cam_bps_hw_info;
+	core_info->bps_hw_info = hw_info;
+
+	rc = cam_bps_init_soc_resources(&bps_dev->soc_info, cam_bps_irq,
+		bps_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed to init_soc");
+		kfree(bps_dev->core_info);
+		kfree(bps_dev);
+		kfree(bps_dev_intf);
+		return rc;
+	}
+	CAM_DBG(CAM_ICP, "soc info : %pK",
+		(void *)&bps_dev->soc_info);
+
+	rc = cam_bps_register_cpas(&bps_dev->soc_info,
+			core_info, bps_dev_intf->hw_idx);
+	if (rc < 0) {
+		kfree(bps_dev->core_info);
+		kfree(bps_dev);
+		kfree(bps_dev_intf);
+		return rc;
+	}
+	bps_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&bps_dev->hw_mutex);
+	spin_lock_init(&bps_dev->hw_lock);
+	init_completion(&bps_dev->hw_complete);
+	CAM_DBG(CAM_ICP, "BPS:%d component bound successfully",
+		bps_dev_intf->hw_idx);
+
+	return rc;
+}
+
+static void cam_bps_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info            *bps_dev = NULL;
+	struct cam_hw_intf            *bps_dev_intf = NULL;
+	struct cam_bps_device_core_info   *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ICP, "Unbinding component: %s", pdev->name);
+	bps_dev_intf = platform_get_drvdata(pdev);
+	bps_dev = bps_dev_intf->hw_priv;
+	core_info = (struct cam_bps_device_core_info *)bps_dev->core_info;
+	cam_cpas_unregister_client(core_info->cpas_handle);
+	cam_bps_deinit_soc_resources(&bps_dev->soc_info);
+
+	kfree(bps_dev->core_info);
+	kfree(bps_dev);
+	kfree(bps_dev_intf);
+}
+
+const static struct component_ops cam_bps_component_ops = {
+	.bind = cam_bps_component_bind,
+	.unbind = cam_bps_component_unbind,
+};
+
+static int cam_bps_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "Adding BPS component");
+	rc = component_add(&pdev->dev, &cam_bps_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_bps_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_bps_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_bps_dt_match[] = {
+	{
+		.compatible = "qcom,cam-bps",
+		.data = &cam_bps_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_bps_dt_match);
+
+struct platform_driver cam_bps_driver = {
+	.probe = cam_bps_probe,
+	.remove = cam_bps_remove,
+	.driver = {
+		.name = "cam-bps",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_bps_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_bps_init_module(void)
+{
+	return platform_driver_register(&cam_bps_driver);
+}
+
+void cam_bps_exit_module(void)
+{
+	platform_driver_unregister(&cam_bps_driver);
+}
+
+MODULE_DESCRIPTION("CAM BPS driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_soc.c
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "bps_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+static int cam_bps_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ICP, "get bps dt prop is failed");
+
+	return rc;
+}
+
+static int cam_bps_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t bps_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, bps_irq_handler,
+		irq_data);
+
+	return rc;
+}
+
+int cam_bps_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t bps_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_bps_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_bps_request_platform_resource(soc_info, bps_irq_handler,
+		irq_data);
+	if (rc < 0)
+		return rc;
+
+	return rc;
+}
+
+void cam_bps_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_WARN(CAM_ICP, "release platform resources fail");
+}
+
+int cam_bps_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_SVS_VOTE, false);
+	if (rc)
+		CAM_ERR(CAM_ICP, "enable platform failed");
+
+	return rc;
+}
+
+int cam_bps_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, disable_clk,
+		false);
+	if (rc)
+		CAM_ERR(CAM_ICP, "disable platform failed");
+
+	return rc;
+}
+
+int cam_bps_transfer_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	int rc;
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = regulator_set_mode(soc_info->rgltr[i],
+			REGULATOR_MODE_FAST);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Regulator set mode %s failed",
+				soc_info->rgltr_name[i]);
+			goto rgltr_set_mode_failed;
+		}
+	}
+	return 0;
+
+rgltr_set_mode_failed:
+	for (i = i - 1; i >= 0; i--)
+		if (soc_info->rgltr[i])
+			regulator_set_mode(soc_info->rgltr[i],
+					REGULATOR_MODE_NORMAL);
+
+	return rc;
+}
+
+int cam_bps_get_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	int rc;
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = regulator_set_mode(soc_info->rgltr[i],
+			REGULATOR_MODE_NORMAL);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Regulator set mode %s failed",
+				soc_info->rgltr_name[i]);
+			goto rgltr_set_mode_failed;
+		}
+	}
+	return 0;
+
+rgltr_set_mode_failed:
+	for (i = i - 1; i >= 0; i--)
+		if (soc_info->rgltr[i])
+			regulator_set_mode(soc_info->rgltr[i],
+					REGULATOR_MODE_FAST);
+
+	return rc;
+}
+
+int cam_bps_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate)
+{
+	int32_t src_clk_idx;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE] == true) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_PERF, "clk_rate %d greater than max, reset to %d",
+			clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	return cam_soc_util_set_src_clk_rate(soc_info, clk_rate);
+}
+
+int cam_bps_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable)
+{
+	int rc = 0;
+
+	if (clk_enable)
+		rc = cam_soc_util_clk_enable_default(soc_info, CAM_SVS_VOTE);
+	else
+		cam_soc_util_clk_disable_default(soc_info);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/bps_hw/bps_soc.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_BPS_SOC_H_
+#define _CAM_BPS_SOC_H_
+
+#include "cam_soc_util.h"
+
+int cam_bps_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t bps_irq_handler, void *irq_data);
+
+int cam_bps_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_bps_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk);
+
+int cam_bps_get_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_bps_transfer_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_bps_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate);
+int cam_bps_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable);
+void cam_bps_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+#endif /* _CAM_BPS_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
@@ -0,0 +1,6273 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/uaccess.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/io.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+#include <linux/timer.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <linux/debugfs.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include <media/cam_cpas.h>
+
+#include "cam_sync_api.h"
+#include "cam_packet_util.h"
+#include "cam_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_icp_hw_mgr.h"
+#include "cam_a5_hw_intf.h"
+#include "cam_bps_hw_intf.h"
+#include "cam_ipe_hw_intf.h"
+#include "cam_smmu_api.h"
+#include "cam_mem_mgr.h"
+#include "hfi_intf.h"
+#include "hfi_reg.h"
+#include "hfi_session_defs.h"
+#include "hfi_sys_defs.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "a5_core.h"
+#include "hfi_sys_defs.h"
+#include "cam_debug_util.h"
+#include "cam_soc_util.h"
+#include "cam_trace.h"
+#include "cam_cpas_api.h"
+#include "cam_common_util.h"
+
+#define ICP_WORKQ_TASK_CMD_TYPE 1
+#define ICP_WORKQ_TASK_MSG_TYPE 2
+
+#define ICP_DEV_TYPE_TO_CLK_TYPE(dev_type) \
+	((dev_type == CAM_ICP_RES_TYPE_BPS) ? ICP_CLK_HW_BPS : ICP_CLK_HW_IPE)
+
+#define ICP_DEVICE_IDLE_TIMEOUT 400
+
+static const struct hfi_ops hfi_a5_ops = {
+	.irq_raise = cam_a5_irq_raise,
+	.irq_enable = cam_a5_irq_enable,
+	.iface_addr = cam_a5_iface_addr,
+};
+
+static struct cam_icp_hw_mgr icp_hw_mgr;
+
+static void cam_icp_mgr_process_dbg_buf(unsigned int debug_lvl);
+
+static int cam_icp_dump_io_cfg(struct cam_icp_hw_ctx_data *ctx_data,
+	int32_t buf_handle, uint32_t size)
+{
+	uintptr_t vaddr_ptr;
+	uint32_t  *ptr;
+	uint32_t  io_size;
+	size_t    len;
+	int       rc, i;
+	char      buf[512];
+	int       used = 0;
+
+	rc = cam_mem_get_cpu_buf(buf_handle, &vaddr_ptr, &len);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to get io_cfg buf address for %d",
+			ctx_data->ctx_id);
+		return rc;
+	}
+
+	io_size = size / sizeof(uint32_t);
+	ptr = (uint32_t *)vaddr_ptr;
+	for (i = 0; i < io_size; i++) {
+		used += snprintf(buf + used,
+			sizeof(buf) - used, "0X%08X-", ptr[i]);
+		if (!(i % 8)) {
+			CAM_DBG(CAM_ICP, "%s: %s", __func__, buf);
+			used = 0;
+		}
+	}
+	cam_mem_put_cpu_buf(buf_handle);
+	return rc;
+}
+
+static const char *cam_icp_dev_type_to_name(
+	uint32_t dev_type)
+{
+	switch (dev_type) {
+	case CAM_ICP_RES_TYPE_BPS:
+		return "BPS";
+	case CAM_ICP_RES_TYPE_IPE_RT:
+		return "IPE_RT";
+	case CAM_ICP_RES_TYPE_IPE:
+		return "IPE";
+	default:
+		return "Invalid dev type";
+	}
+}
+
+static int cam_icp_send_ubwc_cfg(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	int rc;
+	uint32_t disable_ubwc_comp = 0;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is NULL");
+		return -EINVAL;
+	}
+
+	disable_ubwc_comp = hw_mgr->disable_ubwc_comp;
+
+	rc = icp_dev_intf->hw_ops.process_cmd(
+		icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_UBWC_CFG, (void *)&disable_ubwc_comp,
+		sizeof(disable_ubwc_comp));
+	if (rc)
+		CAM_ERR(CAM_ICP, "CAM_ICP_CMD_UBWC_CFG is failed");
+
+	return rc;
+}
+
+static void cam_icp_hw_mgr_clk_info_update(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct cam_icp_clk_info *hw_mgr_clk_info;
+
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
+		hw_mgr_clk_info = &hw_mgr->clk_info[ICP_CLK_HW_BPS];
+	else
+		hw_mgr_clk_info = &hw_mgr->clk_info[ICP_CLK_HW_IPE];
+
+	if (hw_mgr_clk_info->base_clk >= ctx_data->clk_info.base_clk)
+		hw_mgr_clk_info->base_clk -= ctx_data->clk_info.base_clk;
+}
+
+static void cam_icp_hw_mgr_reset_clk_info(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int i;
+
+	for (i = 0; i < ICP_CLK_HW_MAX; i++) {
+		hw_mgr->clk_info[i].base_clk = 0;
+		hw_mgr->clk_info[i].curr_clk = ICP_CLK_SVS_HZ;
+		hw_mgr->clk_info[i].threshold = ICP_OVER_CLK_THRESHOLD;
+		hw_mgr->clk_info[i].over_clked = 0;
+		hw_mgr->clk_info[i].uncompressed_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		hw_mgr->clk_info[i].compressed_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	}
+	hw_mgr->icp_default_clk = ICP_CLK_SVS_HZ;
+}
+
+static int cam_icp_get_actual_clk_rate_idx(
+	struct cam_icp_hw_ctx_data *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return i;
+
+	/*
+	 * Caller has to ensure returned index is within array
+	 * size bounds while accessing that index.
+	 */
+
+	return i;
+}
+
+static bool cam_icp_is_over_clk(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info)
+{
+	int base_clk_idx;
+	int curr_clk_idx;
+
+	base_clk_idx = cam_icp_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->base_clk);
+
+	curr_clk_idx = cam_icp_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->curr_clk);
+
+	CAM_DBG(CAM_PERF, "bc_idx = %d cc_idx = %d %d %d",
+		base_clk_idx, curr_clk_idx, hw_mgr_clk_info->base_clk,
+		hw_mgr_clk_info->curr_clk);
+
+	if (curr_clk_idx > base_clk_idx)
+		return true;
+
+	return false;
+}
+
+static int cam_icp_get_lower_clk_rate(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_icp_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	if (i > 0)
+		return ctx_data->clk_info.clk_rate[i - 1];
+
+	CAM_DBG(CAM_PERF, "Already clk at lower level");
+	return base_clk;
+}
+
+static int cam_icp_get_next_clk_rate(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_icp_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	if (i < CAM_MAX_VOTE - 1)
+		return ctx_data->clk_info.clk_rate[i + 1];
+
+	CAM_DBG(CAM_PERF, "Already clk at higher level");
+
+	return base_clk;
+}
+
+static int cam_icp_get_actual_clk_rate(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return ctx_data->clk_info.clk_rate[i];
+
+	return base_clk;
+}
+
+static int cam_icp_supported_clk_rates(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int i;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_hw_info *dev = NULL;
+
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
+		dev_intf = hw_mgr->bps_dev_intf;
+	else
+		dev_intf = hw_mgr->ipe0_dev_intf;
+
+	if (!dev_intf) {
+		CAM_ERR(CAM_ICP, "dev_intf is invalid");
+		return -EINVAL;
+	}
+	dev = (struct cam_hw_info *)dev_intf->hw_priv;
+	soc_info = &dev->soc_info;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++) {
+		ctx_data->clk_info.clk_rate[i] =
+			soc_info->clk_rate[i][soc_info->src_clk_idx];
+		CAM_DBG(CAM_PERF, "clk_info[%d] = %d",
+			i, ctx_data->clk_info.clk_rate[i]);
+	}
+
+	return 0;
+}
+
+static int cam_icp_clk_idx_from_req_id(struct cam_icp_hw_ctx_data *ctx_data,
+	uint64_t req_id)
+{
+	struct hfi_frame_process_info *frame_process;
+	int i;
+
+	frame_process = &ctx_data->hfi_frame_process;
+
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++)
+		if (frame_process->request_id[i] == req_id)
+			return i;
+
+	return 0;
+}
+
+static int cam_icp_ctx_clk_info_init(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int i;
+
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+	ctx_data->clk_info.uncompressed_bw = 0;
+	ctx_data->clk_info.compressed_bw = 0;
+	for (i = 0; i < CAM_ICP_MAX_PER_PATH_VOTES; i++) {
+		ctx_data->clk_info.axi_path[i].camnoc_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ab_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ib_bw = 0;
+	}
+
+	cam_icp_supported_clk_rates(&icp_hw_mgr, ctx_data);
+
+	return 0;
+}
+
+static bool cam_icp_frame_pending(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	return !bitmap_empty(ctx_data->hfi_frame_process.bitmap,
+			CAM_FRAME_CMD_MAX);
+}
+
+static int cam_icp_ctx_timer_reset(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	if (ctx_data && ctx_data->watch_dog) {
+		ctx_data->watch_dog_reset_counter++;
+		CAM_DBG(CAM_PERF, "reset timer : ctx_id = %d, counter=%d",
+			ctx_data->ctx_id, ctx_data->watch_dog_reset_counter);
+		crm_timer_reset(ctx_data->watch_dog);
+	}
+
+	return 0;
+}
+
+static void cam_icp_device_timer_reset(struct cam_icp_hw_mgr *hw_mgr,
+	int device_index)
+{
+	if ((device_index >= ICP_CLK_HW_MAX) || (!hw_mgr))
+		return;
+
+	if (hw_mgr->clk_info[device_index].watch_dog) {
+		CAM_DBG(CAM_PERF, "reset timer : device_index = %d",
+			device_index);
+		crm_timer_reset(hw_mgr->clk_info[device_index].watch_dog);
+		hw_mgr->clk_info[device_index].watch_dog_reset_counter++;
+	}
+}
+
+static int32_t cam_icp_deinit_idle_clk(void *priv, void *data)
+{
+	struct cam_icp_hw_mgr *hw_mgr = (struct cam_icp_hw_mgr *)priv;
+	struct clk_work_data *task_data = (struct clk_work_data *)data;
+	struct cam_icp_clk_info *clk_info =
+		(struct cam_icp_clk_info *)task_data->data;
+	uint32_t id;
+	uint32_t i;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	struct cam_hw_intf *ipe0_dev_intf = NULL;
+	struct cam_hw_intf *ipe1_dev_intf = NULL;
+	struct cam_hw_intf *bps_dev_intf = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_icp_clk_update_cmd clk_upd_cmd;
+	int rc = 0;
+	bool busy = false;
+
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+
+	clk_info->base_clk = 0;
+	clk_info->curr_clk = 0;
+	clk_info->over_clked = 0;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx_data[i];
+		mutex_lock(&ctx_data->ctx_mutex);
+		if ((ctx_data->state == CAM_ICP_CTX_STATE_ACQUIRED) &&
+			(ICP_DEV_TYPE_TO_CLK_TYPE(
+			ctx_data->icp_dev_acquire_info->dev_type)
+			== clk_info->hw_type)) {
+			busy = cam_icp_frame_pending(ctx_data);
+			if (busy) {
+				mutex_unlock(&ctx_data->ctx_mutex);
+				break;
+			}
+			cam_icp_ctx_clk_info_init(ctx_data);
+		}
+		mutex_unlock(&ctx_data->ctx_mutex);
+	}
+
+	if (busy) {
+		cam_icp_device_timer_reset(hw_mgr, clk_info->hw_type);
+		rc = -EBUSY;
+		goto done;
+	}
+
+	if ((!ipe0_dev_intf) || (!bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong, failed to update clk");
+		rc = -EINVAL;
+		goto done;
+	}
+
+	if (clk_info->hw_type == ICP_CLK_HW_BPS) {
+		dev_intf = bps_dev_intf;
+		id = CAM_ICP_BPS_CMD_DISABLE_CLK;
+	} else if (clk_info->hw_type == ICP_CLK_HW_IPE) {
+		dev_intf = ipe0_dev_intf;
+		id = CAM_ICP_IPE_CMD_DISABLE_CLK;
+	} else {
+		CAM_ERR(CAM_ICP, "Error");
+		goto done;
+	}
+
+	CAM_DBG(CAM_PERF, "Disable %d", clk_info->hw_type);
+
+	clk_upd_cmd.ipe_bps_pc_enable = icp_hw_mgr.ipe_bps_pc_flag;
+
+	dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, id,
+		&clk_upd_cmd, sizeof(clk_upd_cmd));
+
+	if (clk_info->hw_type != ICP_CLK_HW_BPS)
+		if (ipe1_dev_intf)
+			ipe1_dev_intf->hw_ops.process_cmd(
+				ipe1_dev_intf->hw_priv, id,
+				&clk_upd_cmd, sizeof(clk_upd_cmd));
+
+done:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_icp_remove_ctx_bw(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+	struct cam_hw_intf *dev_intf = NULL;
+	uint32_t id;
+	uint64_t temp;
+	struct cam_icp_clk_info *clk_info;
+	struct cam_icp_cpas_vote clk_update;
+	int i = 0;
+	int device_share_ratio = 1;
+	uint64_t total_ab_bw = 0;
+
+	if (!ctx_data->icp_dev_acquire_info) {
+		CAM_WARN(CAM_ICP, "NULL acquire info");
+		return -EINVAL;
+	}
+
+	if ((!hw_mgr->ipe0_dev_intf) || (!hw_mgr->bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong, failed to update clk");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_PERF,
+		"ctx_id = %d ubw = %lld cbw = %lld curr_fc = %u bc = %u",
+		ctx_data->ctx_id,
+		ctx_data->clk_info.uncompressed_bw,
+		ctx_data->clk_info.compressed_bw,
+		ctx_data->clk_info.curr_fc, ctx_data->clk_info.base_clk);
+
+	if (!ctx_data->clk_info.bw_included) {
+		CAM_DBG(CAM_PERF, "ctx_id = %d BW vote already removed",
+			ctx_data->ctx_id);
+		return 0;
+	}
+
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS) {
+		dev_intf = hw_mgr->bps_dev_intf;
+		clk_info = &hw_mgr->clk_info[ICP_CLK_HW_BPS];
+		id = CAM_ICP_BPS_CMD_VOTE_CPAS;
+	} else {
+		dev_intf = hw_mgr->ipe0_dev_intf;
+		clk_info = &hw_mgr->clk_info[ICP_CLK_HW_IPE];
+		id = CAM_ICP_IPE_CMD_VOTE_CPAS;
+	}
+
+	/*
+	 * Since there are 2 devices, we assume the load is evenly shared
+	 * between HWs and corresponding AXI paths. So divide total bw by half
+	 * to vote on each device
+	 */
+	if ((ctx_data->icp_dev_acquire_info->dev_type !=
+		CAM_ICP_RES_TYPE_BPS) && (hw_mgr->ipe1_dev_intf))
+		device_share_ratio = 2;
+
+	if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_V1) {
+		clk_update.axi_vote.num_paths = 1;
+		if (ctx_data->icp_dev_acquire_info->dev_type ==
+			CAM_ICP_RES_TYPE_BPS) {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_BPS_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_BPS_DEFAULT_AXI_TRANSAC;
+		} else {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_IPE_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_IPE_DEFAULT_AXI_TRANSAC;
+		}
+
+		clk_info->compressed_bw -= ctx_data->clk_info.compressed_bw;
+		clk_info->uncompressed_bw -= ctx_data->clk_info.uncompressed_bw;
+
+		total_ab_bw = clk_info->compressed_bw;
+
+		ctx_data->clk_info.uncompressed_bw = 0;
+		ctx_data->clk_info.compressed_bw = 0;
+		ctx_data->clk_info.curr_fc = 0;
+		ctx_data->clk_info.base_clk = 0;
+
+		clk_update.axi_vote.num_paths = 1;
+
+		temp = clk_info->uncompressed_bw;
+		do_div(temp, device_share_ratio);
+		clk_update.axi_vote.axi_path[0].camnoc_bw = temp;
+
+		temp = clk_info->compressed_bw;
+		do_div(temp, device_share_ratio);
+		clk_update.axi_vote.axi_path[0].mnoc_ab_bw = temp;
+		clk_update.axi_vote.axi_path[0].mnoc_ib_bw = temp;
+		clk_update.axi_vote.axi_path[0].ddr_ab_bw = temp;
+		clk_update.axi_vote.axi_path[0].ddr_ib_bw = temp;
+	} else {
+		int path_index;
+
+		/*
+		 * Remove previous vote of this context from hw mgr first.
+		 * hw_mgr_clk_info has all valid paths, with each path in its
+		 * own index. BW that we wanted to vote now is after removing
+		 * current context's vote from hw mgr consolidated vote
+		 */
+		for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+			if (ctx_data->icp_dev_acquire_info->dev_type ==
+				CAM_ICP_RES_TYPE_BPS) {
+				/*
+				 * By assuming BPS has Read-All, Write-All
+				 * votes only.
+				 */
+				path_index =
+				ctx_data->clk_info.axi_path[i].transac_type -
+				CAM_AXI_TRANSACTION_READ;
+			} else {
+				path_index =
+				ctx_data->clk_info.axi_path[i].path_data_type -
+				CAM_AXI_PATH_DATA_IPE_START_OFFSET;
+			}
+
+			if (path_index >= CAM_ICP_MAX_PER_PATH_VOTES) {
+				CAM_WARN(CAM_PERF,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_IPE_START_OFFSET,
+				CAM_ICP_MAX_PER_PATH_VOTES);
+				continue;
+			}
+
+			clk_info->axi_path[path_index].camnoc_bw -=
+				ctx_data->clk_info.axi_path[i].camnoc_bw;
+			clk_info->axi_path[path_index].mnoc_ab_bw -=
+				ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+			clk_info->axi_path[path_index].mnoc_ib_bw -=
+				ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+			clk_info->axi_path[path_index].ddr_ab_bw -=
+				ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+			clk_info->axi_path[path_index].ddr_ib_bw -=
+				ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+
+			total_ab_bw +=
+				clk_info->axi_path[path_index].mnoc_ab_bw;
+
+			CAM_DBG(CAM_PERF,
+				"Removing ctx bw from path_type: %s, transac_type: %s, camnoc_bw = %lld mnoc_ab_bw = %lld, mnoc_ib_bw = %lld, device: %s",
+				cam_cpas_axi_util_path_type_to_string(
+				ctx_data->clk_info.axi_path[i].path_data_type),
+				cam_cpas_axi_util_trans_type_to_string(
+				ctx_data->clk_info.axi_path[i].transac_type),
+				ctx_data->clk_info.axi_path[i].camnoc_bw,
+				ctx_data->clk_info.axi_path[i].mnoc_ab_bw,
+				ctx_data->clk_info.axi_path[i].mnoc_ib_bw,
+				cam_icp_dev_type_to_name(
+				ctx_data->icp_dev_acquire_info->dev_type));
+
+			CAM_DBG(CAM_PERF,
+				"Final HW bw for path_type: %s, transac_type: %s, camnoc_bw = %lld mnoc_ab_bw = %lld, mnoc_ib_bw = %lld, device: %s",
+				cam_cpas_axi_util_path_type_to_string(
+				clk_info->axi_path[i].path_data_type),
+				cam_cpas_axi_util_trans_type_to_string(
+				clk_info->axi_path[i].transac_type),
+				clk_info->axi_path[i].camnoc_bw,
+				clk_info->axi_path[i].mnoc_ab_bw,
+				clk_info->axi_path[i].mnoc_ib_bw,
+				cam_icp_dev_type_to_name(
+				ctx_data->icp_dev_acquire_info->dev_type));
+		}
+
+		memset(&ctx_data->clk_info.axi_path[0], 0,
+			CAM_ICP_MAX_PER_PATH_VOTES *
+			sizeof(struct cam_axi_per_path_bw_vote));
+		ctx_data->clk_info.curr_fc = 0;
+		ctx_data->clk_info.base_clk = 0;
+
+		clk_update.axi_vote.num_paths = clk_info->num_paths;
+		memcpy(&clk_update.axi_vote.axi_path[0],
+			&clk_info->axi_path[0],
+			clk_update.axi_vote.num_paths *
+			sizeof(struct cam_axi_per_path_bw_vote));
+
+		if (device_share_ratio > 1) {
+			for (i = 0; i < clk_update.axi_vote.num_paths; i++) {
+				do_div(
+				clk_update.axi_vote.axi_path[i].camnoc_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].mnoc_ab_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].mnoc_ib_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].ddr_ab_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].ddr_ib_bw,
+					device_share_ratio);
+			}
+		}
+	}
+
+	clk_update.axi_vote_valid = true;
+
+	if (total_ab_bw == 0) {
+		/* If no more contexts are active, reduce AHB vote to minimum */
+		clk_update.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		clk_update.ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+		clk_update.ahb_vote_valid = true;
+	} else {
+		clk_update.ahb_vote_valid = false;
+	}
+
+	rc = dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, id,
+		&clk_update, sizeof(clk_update));
+	if (rc)
+		CAM_ERR(CAM_PERF, "Failed in updating cpas vote, rc=%d", rc);
+
+	/*
+	 * Vote half bandwidth each on both devices.
+	 * Total bw at mnoc - CPAS will take care of adding up.
+	 * camnoc clk calculate is more accurate this way.
+	 */
+	if ((!rc) && (hw_mgr->ipe1_dev_intf) &&
+		(ctx_data->icp_dev_acquire_info->dev_type !=
+		CAM_ICP_RES_TYPE_BPS)) {
+		dev_intf = hw_mgr->ipe1_dev_intf;
+		rc = dev_intf->hw_ops.process_cmd(dev_intf->hw_priv,
+			id, &clk_update, sizeof(clk_update));
+		if (rc)
+			CAM_ERR(CAM_PERF,
+				"Failed in updating cpas vote for ipe 2, rc=%d",
+				rc);
+	}
+
+	ctx_data->clk_info.bw_included = false;
+
+	CAM_DBG(CAM_PERF, "X :ctx_id = %d curr_fc = %u bc = %u",
+		ctx_data->ctx_id, ctx_data->clk_info.curr_fc,
+		ctx_data->clk_info.base_clk);
+
+	return rc;
+
+}
+
+
+static int32_t cam_icp_ctx_timer(void *priv, void *data)
+{
+	struct clk_work_data *task_data = (struct clk_work_data *)data;
+	struct cam_icp_hw_ctx_data *ctx_data =
+		(struct cam_icp_hw_ctx_data *)task_data->data;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "ctx_data is NULL, failed to update clk");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+
+	CAM_DBG(CAM_PERF,
+		"ctx_id = %d ubw = %lld cbw = %lld curr_fc = %u bc = %u",
+		ctx_data->ctx_id,
+		ctx_data->clk_info.uncompressed_bw,
+		ctx_data->clk_info.compressed_bw,
+		ctx_data->clk_info.curr_fc,
+		ctx_data->clk_info.base_clk);
+
+	if ((ctx_data->state != CAM_ICP_CTX_STATE_ACQUIRED) ||
+		(ctx_data->watch_dog_reset_counter == 0)) {
+		CAM_DBG(CAM_PERF, "state %d, counter=%d",
+			ctx_data->state, ctx_data->watch_dog_reset_counter);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return 0;
+	}
+
+	if (cam_icp_frame_pending(ctx_data)) {
+		cam_icp_ctx_timer_reset(ctx_data);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return -EBUSY;
+	}
+
+	cam_icp_remove_ctx_bw(&icp_hw_mgr, ctx_data);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return 0;
+}
+
+static void cam_icp_ctx_timer_cb(struct timer_list *timer_data)
+{
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct clk_work_data *task_data;
+	struct cam_req_mgr_timer *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+
+	spin_lock_irqsave(&icp_hw_mgr.hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.timer_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "no empty task");
+		spin_unlock_irqrestore(&icp_hw_mgr.hw_mgr_lock, flags);
+		return;
+	}
+
+	task_data = (struct clk_work_data *)task->payload;
+	task_data->data = timer->parent;
+	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_icp_ctx_timer;
+	cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&icp_hw_mgr.hw_mgr_lock, flags);
+}
+
+static void cam_icp_device_timer_cb(struct timer_list *timer_data)
+{
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct clk_work_data *task_data;
+	struct cam_req_mgr_timer *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+
+	spin_lock_irqsave(&icp_hw_mgr.hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.timer_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "no empty task");
+		spin_unlock_irqrestore(&icp_hw_mgr.hw_mgr_lock, flags);
+		return;
+	}
+
+	task_data = (struct clk_work_data *)task->payload;
+	task_data->data = timer->parent;
+	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_icp_deinit_idle_clk;
+	cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&icp_hw_mgr.hw_mgr_lock, flags);
+}
+
+static int cam_icp_clk_info_init(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int i, j;
+
+	for (i = 0; i < ICP_CLK_HW_MAX; i++) {
+		hw_mgr->clk_info[i].base_clk = ICP_CLK_SVS_HZ;
+		hw_mgr->clk_info[i].curr_clk = ICP_CLK_SVS_HZ;
+		hw_mgr->clk_info[i].threshold = ICP_OVER_CLK_THRESHOLD;
+		hw_mgr->clk_info[i].over_clked = 0;
+		hw_mgr->clk_info[i].uncompressed_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		hw_mgr->clk_info[i].compressed_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		for (j = 0; j < CAM_ICP_MAX_PER_PATH_VOTES; j++) {
+			hw_mgr->clk_info[i].axi_path[j].path_data_type = 0;
+			hw_mgr->clk_info[i].axi_path[j].transac_type = 0;
+			hw_mgr->clk_info[i].axi_path[j].camnoc_bw = 0;
+			hw_mgr->clk_info[i].axi_path[j].mnoc_ab_bw = 0;
+			hw_mgr->clk_info[i].axi_path[j].mnoc_ib_bw = 0;
+		}
+
+		hw_mgr->clk_info[i].hw_type = i;
+		hw_mgr->clk_info[i].watch_dog_reset_counter = 0;
+	}
+
+	hw_mgr->icp_default_clk = ICP_CLK_SVS_HZ;
+
+	return 0;
+}
+
+static int cam_icp_ctx_timer_start(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+
+	rc = crm_timer_init(&ctx_data->watch_dog,
+		200, ctx_data, &cam_icp_ctx_timer_cb);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to start timer");
+
+	ctx_data->watch_dog_reset_counter = 0;
+
+	CAM_DBG(CAM_PERF, "start timer : ctx_id = %d", ctx_data->ctx_id);
+	return rc;
+}
+
+static int cam_icp_device_timer_start(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	int i;
+
+	for (i = 0; i < ICP_CLK_HW_MAX; i++)  {
+		if (!hw_mgr->clk_info[i].watch_dog) {
+			rc = crm_timer_init(&hw_mgr->clk_info[i].watch_dog,
+				ICP_DEVICE_IDLE_TIMEOUT, &hw_mgr->clk_info[i],
+				&cam_icp_device_timer_cb);
+
+			if (rc)
+				CAM_ERR(CAM_ICP, "Failed to start timer %d", i);
+
+			hw_mgr->clk_info[i].watch_dog_reset_counter = 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_icp_ctx_timer_stop(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	if (ctx_data->watch_dog) {
+		CAM_DBG(CAM_PERF, "stop timer : ctx_id = %d", ctx_data->ctx_id);
+		ctx_data->watch_dog_reset_counter = 0;
+		crm_timer_exit(&ctx_data->watch_dog);
+		ctx_data->watch_dog = NULL;
+	}
+
+	return 0;
+}
+
+static void cam_icp_device_timer_stop(struct cam_icp_hw_mgr *hw_mgr)
+{
+	if (!hw_mgr->bps_ctxt_cnt &&
+		hw_mgr->clk_info[ICP_CLK_HW_BPS].watch_dog) {
+		hw_mgr->clk_info[ICP_CLK_HW_BPS].watch_dog_reset_counter = 0;
+		crm_timer_exit(&hw_mgr->clk_info[ICP_CLK_HW_BPS].watch_dog);
+		hw_mgr->clk_info[ICP_CLK_HW_BPS].watch_dog = NULL;
+	}
+
+	if (!hw_mgr->ipe_ctxt_cnt &&
+		hw_mgr->clk_info[ICP_CLK_HW_IPE].watch_dog) {
+		hw_mgr->clk_info[ICP_CLK_HW_IPE].watch_dog_reset_counter = 0;
+		crm_timer_exit(&hw_mgr->clk_info[ICP_CLK_HW_IPE].watch_dog);
+		hw_mgr->clk_info[ICP_CLK_HW_IPE].watch_dog = NULL;
+	}
+}
+
+static uint32_t cam_icp_mgr_calc_base_clk(uint32_t frame_cycles,
+	uint64_t budget)
+{
+	uint64_t base_clk;
+	uint64_t mul = 1000000000;
+
+	base_clk = frame_cycles * mul;
+	do_div(base_clk, budget);
+
+	CAM_DBG(CAM_PERF, "budget = %lld fc = %d ib = %lld base_clk = %lld",
+		budget, frame_cycles,
+		(long long)(frame_cycles * mul), base_clk);
+
+	return base_clk;
+}
+
+static bool cam_icp_busy_prev_reqs(struct hfi_frame_process_info *frm_process,
+	uint64_t req_id)
+{
+	int i;
+	int cnt;
+
+	for (i = 0, cnt = 0; i < CAM_FRAME_CMD_MAX; i++) {
+		if (frm_process->request_id[i]) {
+			if (frm_process->fw_process_flag[i]) {
+				CAM_DBG(CAM_PERF, "r id = %lld busy = %d",
+					frm_process->request_id[i],
+					frm_process->fw_process_flag[i]);
+				cnt++;
+			}
+		}
+	}
+	if (cnt > 1)
+		return true;
+
+	return false;
+}
+
+static int cam_icp_calc_total_clk(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_clk_info *hw_mgr_clk_info, uint32_t dev_type)
+{
+	int i;
+	struct cam_icp_hw_ctx_data *ctx_data;
+
+	hw_mgr_clk_info->base_clk = 0;
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx_data[i];
+		if (ctx_data->state == CAM_ICP_CTX_STATE_ACQUIRED &&
+			ICP_DEV_TYPE_TO_CLK_TYPE(
+			ctx_data->icp_dev_acquire_info->dev_type) ==
+			ICP_DEV_TYPE_TO_CLK_TYPE(dev_type))
+			hw_mgr_clk_info->base_clk +=
+				ctx_data->clk_info.base_clk;
+	}
+
+	return 0;
+}
+
+static bool cam_icp_update_clk_busy(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info,
+	struct cam_icp_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	uint32_t next_clk_level;
+	uint32_t actual_clk;
+	bool rc = false;
+
+	/* 1. if current request frame cycles(fc) are more than previous
+	 *      frame fc
+	 *      Calculate the new base clock.
+	 *      if sum of base clocks are more than next available clk level
+	 *       Update clock rate, change curr_clk_rate to sum of base clock
+	 *       rates and make over_clked to zero
+	 *      else
+	 *       Update clock rate to next level, update curr_clk_rate and make
+	 *       overclked cnt to zero
+	 * 2. if current fc is less than or equal to previous  frame fc
+	 *      Still Bump up the clock to next available level
+	 *      if it is available, then update clock, make overclk cnt to
+	 *      zero. If the clock is already at highest clock rate then
+	 *      no need to update the clock
+	 */
+	ctx_data->clk_info.base_clk = base_clk;
+	hw_mgr_clk_info->over_clked = 0;
+	if (clk_info->frame_cycles > ctx_data->clk_info.curr_fc) {
+		cam_icp_calc_total_clk(hw_mgr, hw_mgr_clk_info,
+			ctx_data->icp_dev_acquire_info->dev_type);
+		actual_clk = cam_icp_get_actual_clk_rate(hw_mgr,
+			ctx_data, base_clk);
+		if (hw_mgr_clk_info->base_clk > actual_clk) {
+			hw_mgr_clk_info->curr_clk = hw_mgr_clk_info->base_clk;
+		} else {
+			next_clk_level = cam_icp_get_next_clk_rate(hw_mgr,
+				ctx_data, hw_mgr_clk_info->curr_clk);
+			hw_mgr_clk_info->curr_clk = next_clk_level;
+		}
+		rc = true;
+	} else {
+		next_clk_level =
+			cam_icp_get_next_clk_rate(hw_mgr, ctx_data,
+			hw_mgr_clk_info->curr_clk);
+		if (hw_mgr_clk_info->curr_clk < next_clk_level) {
+			hw_mgr_clk_info->curr_clk = next_clk_level;
+			rc = true;
+		}
+	}
+	ctx_data->clk_info.curr_fc = clk_info->frame_cycles;
+
+	return rc;
+}
+
+static bool cam_icp_update_clk_overclk_free(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info,
+	struct cam_icp_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	int rc = false;
+
+	/*
+	 * In caseof no pending packets case
+	 *    1. In caseof overclk cnt is less than threshold, increase
+	 *       overclk count and no update in the clock rate
+	 *    2. In caseof overclk cnt is greater than or equal to threshold
+	 *       then lower clock rate by one level and update hw_mgr current
+	 *       clock value.
+	 *        a. In case of new clock rate greater than sum of clock
+	 *           rates, reset overclk count value to zero if it is
+	 *           overclock
+	 *        b. if it is less than sum of base clocks then go to next
+	 *           level of clock and make overclk count to zero
+	 *        c. if it is same as sum of base clock rates update overclock
+	 *           cnt to 0
+	 */
+	if (hw_mgr_clk_info->over_clked < hw_mgr_clk_info->threshold) {
+		hw_mgr_clk_info->over_clked++;
+		rc = false;
+	} else {
+		hw_mgr_clk_info->curr_clk =
+			cam_icp_get_lower_clk_rate(hw_mgr, ctx_data,
+			hw_mgr_clk_info->curr_clk);
+		if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk) {
+			if (cam_icp_is_over_clk(hw_mgr, ctx_data,
+				hw_mgr_clk_info))
+				hw_mgr_clk_info->over_clked = 0;
+		} else if (hw_mgr_clk_info->curr_clk <
+			hw_mgr_clk_info->base_clk) {
+			hw_mgr_clk_info->curr_clk =
+				cam_icp_get_next_clk_rate(hw_mgr, ctx_data,
+				hw_mgr_clk_info->curr_clk);
+				hw_mgr_clk_info->over_clked = 0;
+		} else if (hw_mgr_clk_info->curr_clk ==
+			hw_mgr_clk_info->base_clk) {
+			hw_mgr_clk_info->over_clked = 0;
+		}
+		rc = true;
+	}
+
+	return rc;
+}
+
+static bool cam_icp_update_clk_free(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info,
+	struct cam_icp_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	int rc = false;
+	bool over_clocked = false;
+
+	ctx_data->clk_info.curr_fc = clk_info->frame_cycles;
+	ctx_data->clk_info.base_clk = base_clk;
+	cam_icp_calc_total_clk(hw_mgr, hw_mgr_clk_info,
+		ctx_data->icp_dev_acquire_info->dev_type);
+
+	/*
+	 * Current clock is not always sum of base clocks, due to
+	 * clock scales update to next higher or lower levels, it
+	 * equals to one of discrete clock values supported by hardware.
+	 * So even current clock is higher than sum of base clocks, we
+	 * can not consider it is over clocked. if it is greater than
+	 * discrete clock level then only it is considered as over clock.
+	 * 1. Handle over clock case
+	 * 2. If current clock is less than sum of base clocks
+	 *    update current clock
+	 * 3. If current clock is same as sum of base clocks no action
+	 */
+
+	over_clocked = cam_icp_is_over_clk(hw_mgr, ctx_data,
+		hw_mgr_clk_info);
+
+	if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk &&
+		over_clocked) {
+		rc = cam_icp_update_clk_overclk_free(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+	} else if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->over_clked = 0;
+		rc = false;
+	}  else if (hw_mgr_clk_info->curr_clk < hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->curr_clk = cam_icp_get_actual_clk_rate(hw_mgr,
+			ctx_data, hw_mgr_clk_info->base_clk);
+		rc = true;
+	}
+
+	return rc;
+}
+
+static bool cam_icp_debug_clk_update(struct cam_icp_clk_info *hw_mgr_clk_info)
+{
+	if (icp_hw_mgr.icp_debug_clk &&
+		icp_hw_mgr.icp_debug_clk != hw_mgr_clk_info->curr_clk) {
+		hw_mgr_clk_info->base_clk = icp_hw_mgr.icp_debug_clk;
+		hw_mgr_clk_info->curr_clk = icp_hw_mgr.icp_debug_clk;
+		hw_mgr_clk_info->uncompressed_bw = icp_hw_mgr.icp_debug_clk;
+		hw_mgr_clk_info->compressed_bw = icp_hw_mgr.icp_debug_clk;
+		CAM_DBG(CAM_PERF, "bc = %d cc = %d",
+			hw_mgr_clk_info->base_clk, hw_mgr_clk_info->curr_clk);
+		return true;
+	}
+
+	return false;
+}
+
+static bool cam_icp_default_clk_update(struct cam_icp_clk_info *hw_mgr_clk_info)
+{
+	if (icp_hw_mgr.icp_default_clk != hw_mgr_clk_info->curr_clk) {
+		hw_mgr_clk_info->base_clk = icp_hw_mgr.icp_default_clk;
+		hw_mgr_clk_info->curr_clk = icp_hw_mgr.icp_default_clk;
+		hw_mgr_clk_info->uncompressed_bw = icp_hw_mgr.icp_default_clk;
+		hw_mgr_clk_info->compressed_bw = icp_hw_mgr.icp_default_clk;
+		CAM_DBG(CAM_PERF, "bc = %d cc = %d",
+			hw_mgr_clk_info->base_clk, hw_mgr_clk_info->curr_clk);
+		return true;
+	}
+
+	return false;
+}
+
+static bool cam_icp_update_bw_v2(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info,
+	struct cam_icp_clk_bw_req_internal_v2 *clk_info,
+	bool busy)
+{
+	uint32_t i, path_index;
+	bool update_required = true;
+
+	/*
+	 * If current request bandwidth is different from previous frames, then
+	 * recalculate bandwidth of all contexts of same hardware and update
+	 * voting of bandwidth
+	 */
+
+	for (i = 0; i < clk_info->num_paths; i++)
+		CAM_DBG(CAM_PERF, "clk_info camnoc = %lld busy = %d",
+			clk_info->axi_path[i].camnoc_bw, busy);
+
+	if (clk_info->num_paths == ctx_data->clk_info.num_paths) {
+		update_required = false;
+		for (i = 0; i < clk_info->num_paths; i++) {
+			if ((clk_info->axi_path[i].transac_type ==
+			ctx_data->clk_info.axi_path[i].transac_type) &&
+			(clk_info->axi_path[i].path_data_type ==
+			ctx_data->clk_info.axi_path[i].path_data_type) &&
+			(clk_info->axi_path[i].camnoc_bw ==
+			ctx_data->clk_info.axi_path[i].camnoc_bw) &&
+			(clk_info->axi_path[i].mnoc_ab_bw ==
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw)) {
+				continue;
+			} else {
+				update_required = true;
+				break;
+			}
+		}
+	}
+
+	if (!update_required) {
+		CAM_DBG(CAM_PERF,
+			"Incoming BW hasn't changed, no update required, num_paths=%d",
+			clk_info->num_paths);
+		return false;
+	}
+
+	if (busy) {
+		for (i = 0; i < clk_info->num_paths; i++) {
+			if (ctx_data->clk_info.axi_path[i].camnoc_bw >
+				clk_info->axi_path[i].camnoc_bw)
+				return false;
+		}
+	}
+
+	/*
+	 * Remove previous vote of this context from hw mgr first.
+	 * hw_mgr_clk_info has all valid paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		if (ctx_data->icp_dev_acquire_info->dev_type ==
+			CAM_ICP_RES_TYPE_BPS) {
+			/* By assuming BPS has Read-All, Write-All votes only */
+			path_index =
+				ctx_data->clk_info.axi_path[i].transac_type -
+				CAM_AXI_TRANSACTION_READ;
+		} else {
+			path_index =
+				ctx_data->clk_info.axi_path[i].path_data_type -
+				CAM_AXI_PATH_DATA_IPE_START_OFFSET;
+		}
+
+		if (path_index >= CAM_ICP_MAX_PER_PATH_VOTES) {
+			CAM_WARN(CAM_PERF,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_IPE_START_OFFSET,
+				CAM_ICP_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw -=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ab_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ib_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+	}
+
+	ctx_data->clk_info.num_paths = clk_info->num_paths;
+
+	memcpy(&ctx_data->clk_info.axi_path[0],
+		&clk_info->axi_path[0],
+		clk_info->num_paths * sizeof(struct cam_axi_per_path_bw_vote));
+
+	/*
+	 * Add new vote of this context in hw mgr.
+	 * hw_mgr_clk_info has all paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		if (ctx_data->icp_dev_acquire_info->dev_type ==
+			CAM_ICP_RES_TYPE_BPS) {
+			/* By assuming BPS has Read-All, Write-All votes only */
+			path_index =
+				ctx_data->clk_info.axi_path[i].transac_type -
+				CAM_AXI_TRANSACTION_READ;
+		} else {
+			path_index =
+				ctx_data->clk_info.axi_path[i].path_data_type -
+				CAM_AXI_PATH_DATA_IPE_START_OFFSET;
+		}
+
+		if (path_index >= CAM_ICP_MAX_PER_PATH_VOTES) {
+			CAM_WARN(CAM_PERF,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_IPE_START_OFFSET,
+				CAM_ICP_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		hw_mgr_clk_info->axi_path[path_index].path_data_type =
+			ctx_data->clk_info.axi_path[i].path_data_type;
+		hw_mgr_clk_info->axi_path[path_index].transac_type =
+			ctx_data->clk_info.axi_path[i].transac_type;
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw +=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ab_bw +=
+			ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ib_bw +=
+			ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+
+		CAM_DBG(CAM_PERF,
+			"Consolidate Path Vote : Dev[%s] i[%d] path_idx[%d] : [%s %s] [%lld %lld]",
+			cam_icp_dev_type_to_name(
+			ctx_data->icp_dev_acquire_info->dev_type),
+			i, path_index,
+			cam_cpas_axi_util_trans_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].transac_type),
+			cam_cpas_axi_util_path_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].path_data_type),
+			hw_mgr_clk_info->axi_path[path_index].camnoc_bw,
+			hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw);
+	}
+
+	ctx_data->clk_info.bw_included = true;
+
+	if (hw_mgr_clk_info->num_paths < ctx_data->clk_info.num_paths)
+		hw_mgr_clk_info->num_paths = ctx_data->clk_info.num_paths;
+
+	return true;
+}
+
+static bool cam_icp_update_bw(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_icp_clk_info *hw_mgr_clk_info,
+	struct cam_icp_clk_bw_request *clk_info,
+	bool busy)
+{
+	int i;
+	struct cam_icp_hw_ctx_data *ctx;
+
+	/*
+	 * If current request bandwidth is different from previous frames, then
+	 * recalculate bandwidth of all contexts of same hardware and update
+	 * voting of bandwidth
+	 */
+	CAM_DBG(CAM_PERF, "ubw ctx = %lld clk_info ubw = %lld busy = %d",
+		ctx_data->clk_info.uncompressed_bw,
+		clk_info->uncompressed_bw, busy);
+
+	if ((clk_info->uncompressed_bw == ctx_data->clk_info.uncompressed_bw) &&
+		(ctx_data->clk_info.uncompressed_bw ==
+		hw_mgr_clk_info->uncompressed_bw)) {
+		CAM_DBG(CAM_PERF, "Update not required bw=%lld",
+			ctx_data->clk_info.uncompressed_bw);
+		return false;
+	}
+
+	if (busy &&
+		(ctx_data->clk_info.uncompressed_bw >
+		clk_info->uncompressed_bw)) {
+		CAM_DBG(CAM_PERF,
+			"Busy, Update not req existing=%lld, new=%lld",
+			ctx_data->clk_info.uncompressed_bw,
+			clk_info->uncompressed_bw);
+		return false;
+	}
+
+	ctx_data->clk_info.uncompressed_bw = clk_info->uncompressed_bw;
+	ctx_data->clk_info.compressed_bw = clk_info->compressed_bw;
+	hw_mgr_clk_info->uncompressed_bw = 0;
+	hw_mgr_clk_info->compressed_bw = 0;
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		ctx = &hw_mgr->ctx_data[i];
+		if (ctx->state == CAM_ICP_CTX_STATE_ACQUIRED &&
+			ICP_DEV_TYPE_TO_CLK_TYPE(
+			ctx->icp_dev_acquire_info->dev_type) ==
+			ICP_DEV_TYPE_TO_CLK_TYPE(
+			ctx_data->icp_dev_acquire_info->dev_type)) {
+			hw_mgr_clk_info->uncompressed_bw +=
+				ctx->clk_info.uncompressed_bw;
+			hw_mgr_clk_info->compressed_bw +=
+				ctx->clk_info.compressed_bw;
+			CAM_DBG(CAM_PERF,
+				"Current context=[%lld %lld] Total=[%lld %lld]",
+				ctx->clk_info.uncompressed_bw,
+				ctx->clk_info.compressed_bw,
+				hw_mgr_clk_info->uncompressed_bw,
+				hw_mgr_clk_info->compressed_bw);
+		}
+	}
+
+	ctx_data->clk_info.bw_included = true;
+
+	return true;
+}
+
+static bool cam_icp_check_clk_update(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, int idx)
+{
+	bool busy, rc = false;
+	uint32_t base_clk;
+	struct cam_icp_clk_bw_request *clk_info;
+	struct hfi_frame_process_info *frame_info;
+	uint64_t req_id;
+	struct cam_icp_clk_info *hw_mgr_clk_info;
+
+	cam_icp_ctx_timer_reset(ctx_data);
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS) {
+		cam_icp_device_timer_reset(hw_mgr, ICP_CLK_HW_BPS);
+		hw_mgr_clk_info = &hw_mgr->clk_info[ICP_CLK_HW_BPS];
+		CAM_DBG(CAM_PERF, "Reset bps timer");
+	} else {
+		cam_icp_device_timer_reset(hw_mgr, ICP_CLK_HW_IPE);
+		hw_mgr_clk_info = &hw_mgr->clk_info[ICP_CLK_HW_IPE];
+		CAM_DBG(CAM_PERF, "Reset ipe timer");
+	}
+
+	if (icp_hw_mgr.icp_debug_clk)
+		return cam_icp_debug_clk_update(hw_mgr_clk_info);
+
+	/* Check is there any pending frames in this context */
+	frame_info = &ctx_data->hfi_frame_process;
+	req_id = frame_info->request_id[idx];
+	busy = cam_icp_busy_prev_reqs(frame_info, req_id);
+	CAM_DBG(CAM_PERF, "busy = %d req_id = %lld", busy, req_id);
+
+	clk_info = &ctx_data->hfi_frame_process.clk_info[idx];
+	if (!clk_info->frame_cycles)
+		return cam_icp_default_clk_update(hw_mgr_clk_info);
+
+	ctx_data->clk_info.rt_flag = clk_info->rt_flag;
+
+	/* Override base clock to max or calculate base clk rate */
+	if (!ctx_data->clk_info.rt_flag &&
+		(ctx_data->icp_dev_acquire_info->dev_type !=
+		CAM_ICP_RES_TYPE_BPS))
+		base_clk = ctx_data->clk_info.clk_rate[CAM_MAX_VOTE-1];
+	else
+		base_clk = cam_icp_mgr_calc_base_clk(clk_info->frame_cycles,
+				clk_info->budget_ns);
+
+	if (busy)
+		rc = cam_icp_update_clk_busy(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+	else
+		rc = cam_icp_update_clk_free(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+
+	CAM_DBG(CAM_PERF, "bc = %d cc = %d busy = %d overclk = %d uc = %d",
+		hw_mgr_clk_info->base_clk, hw_mgr_clk_info->curr_clk,
+		busy, hw_mgr_clk_info->over_clked, rc);
+
+	return rc;
+}
+
+static bool cam_icp_check_bw_update(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, int idx)
+{
+	bool busy, bw_updated = false;
+	int i;
+	struct cam_icp_clk_bw_request *clk_info;
+	struct cam_icp_clk_bw_req_internal_v2 *clk_info_v2;
+	struct cam_icp_clk_info *hw_mgr_clk_info;
+	struct hfi_frame_process_info *frame_info;
+	uint64_t req_id;
+
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
+		hw_mgr_clk_info = &hw_mgr->clk_info[ICP_CLK_HW_BPS];
+	else
+		hw_mgr_clk_info = &hw_mgr->clk_info[ICP_CLK_HW_IPE];
+
+	frame_info = &ctx_data->hfi_frame_process;
+	req_id = frame_info->request_id[idx];
+	busy = cam_icp_busy_prev_reqs(frame_info, req_id);
+
+	if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_V1) {
+		clk_info = &ctx_data->hfi_frame_process.clk_info[idx];
+
+		CAM_DBG(CAM_PERF,
+			"Ctx[%pK][%d] Req[%lld] Current camno=%lld, mnoc=%lld",
+			ctx_data, ctx_data->ctx_id, req_id,
+			hw_mgr_clk_info->uncompressed_bw,
+			hw_mgr_clk_info->compressed_bw);
+
+		bw_updated = cam_icp_update_bw(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, busy);
+	} else if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_V2) {
+		clk_info_v2 = &ctx_data->hfi_frame_process.clk_info_v2[idx];
+
+		CAM_DBG(CAM_PERF, "index=%d, num_paths=%d, ctx_data=%pK",
+			idx, clk_info_v2->num_paths, ctx_data);
+
+		bw_updated = cam_icp_update_bw_v2(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info_v2, busy);
+
+		for (i = 0; i < hw_mgr_clk_info->num_paths; i++) {
+			CAM_DBG(CAM_PERF,
+				"Final path_type: %s, transac_type: %s, camnoc_bw = %lld mnoc_ab_bw = %lld, mnoc_ib_bw = %lld, device: %s",
+				cam_cpas_axi_util_path_type_to_string(
+				hw_mgr_clk_info->axi_path[i].path_data_type),
+				cam_cpas_axi_util_trans_type_to_string(
+				hw_mgr_clk_info->axi_path[i].transac_type),
+				hw_mgr_clk_info->axi_path[i].camnoc_bw,
+				hw_mgr_clk_info->axi_path[i].mnoc_ab_bw,
+				hw_mgr_clk_info->axi_path[i].mnoc_ib_bw,
+				cam_icp_dev_type_to_name(
+				ctx_data->icp_dev_acquire_info->dev_type));
+		}
+	} else {
+		CAM_ERR(CAM_PERF, "Invalid bw config version: %d",
+			ctx_data->bw_config_version);
+		return false;
+	}
+
+	return bw_updated;
+}
+
+static int cam_icp_update_clk_rate(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	uint32_t id;
+	uint32_t curr_clk_rate;
+	struct cam_hw_intf *ipe0_dev_intf = NULL;
+	struct cam_hw_intf *ipe1_dev_intf = NULL;
+	struct cam_hw_intf *bps_dev_intf = NULL;
+	struct cam_hw_intf *icp_dev_intf = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_icp_clk_update_cmd clk_upd_cmd;
+
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+	icp_dev_intf = hw_mgr->icp_dev_intf;
+
+
+	if ((!ipe0_dev_intf) || (!bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong, failed to update clk");
+		return -EINVAL;
+	}
+
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS) {
+		dev_intf = bps_dev_intf;
+		curr_clk_rate = hw_mgr->clk_info[ICP_CLK_HW_BPS].curr_clk;
+		id = CAM_ICP_BPS_CMD_UPDATE_CLK;
+	} else {
+		dev_intf = ipe0_dev_intf;
+		curr_clk_rate = hw_mgr->clk_info[ICP_CLK_HW_IPE].curr_clk;
+		id = CAM_ICP_IPE_CMD_UPDATE_CLK;
+	}
+
+	CAM_DBG(CAM_PERF, "clk_rate %u for dev_type %d", curr_clk_rate,
+		ctx_data->icp_dev_acquire_info->dev_type);
+	clk_upd_cmd.curr_clk_rate = curr_clk_rate;
+	clk_upd_cmd.ipe_bps_pc_enable = icp_hw_mgr.ipe_bps_pc_flag;
+	clk_upd_cmd.clk_level = -1;
+
+	dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, id,
+		&clk_upd_cmd, sizeof(clk_upd_cmd));
+
+	if (ctx_data->icp_dev_acquire_info->dev_type != CAM_ICP_RES_TYPE_BPS) {
+		if (ipe1_dev_intf) {
+			ipe1_dev_intf->hw_ops.process_cmd(
+				ipe1_dev_intf->hw_priv, id,
+				&clk_upd_cmd, sizeof(clk_upd_cmd));
+		}
+
+		/* update a5 clock */
+		CAM_DBG(CAM_PERF, "Update ICP clk to level [%d]",
+			clk_upd_cmd.clk_level);
+		icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+			CAM_ICP_CMD_CLK_UPDATE, &clk_upd_cmd.clk_level,
+			sizeof(clk_upd_cmd.clk_level));
+	}
+
+	return 0;
+}
+
+static int cam_icp_update_cpas_vote(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+	uint32_t id;
+	uint64_t temp;
+	int i = 0;
+	struct cam_hw_intf *ipe0_dev_intf = NULL;
+	struct cam_hw_intf *ipe1_dev_intf = NULL;
+	struct cam_hw_intf *bps_dev_intf = NULL;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_icp_clk_info *clk_info;
+	struct cam_icp_cpas_vote clk_update = {{0}, {0}, 0, 0};
+	int device_share_ratio = 1;
+
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+
+	if ((!ipe0_dev_intf) || (!bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong, failed to update clk");
+		return -EINVAL;
+	}
+
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS) {
+		dev_intf = bps_dev_intf;
+		clk_info = &hw_mgr->clk_info[ICP_CLK_HW_BPS];
+		id = CAM_ICP_BPS_CMD_VOTE_CPAS;
+	} else {
+		dev_intf = ipe0_dev_intf;
+		clk_info = &hw_mgr->clk_info[ICP_CLK_HW_IPE];
+		id = CAM_ICP_IPE_CMD_VOTE_CPAS;
+	}
+
+	/*
+	 * Since there are 2 devices, we assume the load is evenly shared
+	 * between HWs and corresponding AXI paths. So divide total bw by half
+	 * to vote on each device
+	 */
+	if ((ctx_data->icp_dev_acquire_info->dev_type !=
+		CAM_ICP_RES_TYPE_BPS) && (ipe1_dev_intf))
+		device_share_ratio = 2;
+
+	clk_update.ahb_vote.type = CAM_VOTE_DYNAMIC;
+	clk_update.ahb_vote.vote.freq = 0;
+	clk_update.ahb_vote_valid = false;
+
+	if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_V1) {
+		clk_update.axi_vote.num_paths = 1;
+		if (ctx_data->icp_dev_acquire_info->dev_type ==
+			CAM_ICP_RES_TYPE_BPS) {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_BPS_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_BPS_DEFAULT_AXI_TRANSAC;
+		} else {
+			clk_update.axi_vote.axi_path[0].path_data_type =
+				CAM_IPE_DEFAULT_AXI_PATH;
+			clk_update.axi_vote.axi_path[0].transac_type =
+				CAM_IPE_DEFAULT_AXI_TRANSAC;
+		}
+
+		temp = clk_info->uncompressed_bw;
+		do_div(temp, device_share_ratio);
+		clk_update.axi_vote.axi_path[0].camnoc_bw = temp;
+
+		temp = clk_info->compressed_bw;
+		do_div(temp, device_share_ratio);
+		clk_update.axi_vote.axi_path[0].mnoc_ab_bw = temp;
+		clk_update.axi_vote.axi_path[0].mnoc_ib_bw = temp;
+		clk_update.axi_vote.axi_path[0].ddr_ab_bw = temp;
+		clk_update.axi_vote.axi_path[0].ddr_ib_bw = temp;
+	} else {
+		clk_update.axi_vote.num_paths = clk_info->num_paths;
+		memcpy(&clk_update.axi_vote.axi_path[0],
+			&clk_info->axi_path[0],
+			clk_update.axi_vote.num_paths *
+			sizeof(struct cam_axi_per_path_bw_vote));
+
+		if (device_share_ratio > 1) {
+			for (i = 0; i < clk_update.axi_vote.num_paths; i++) {
+				do_div(
+				clk_update.axi_vote.axi_path[i].camnoc_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].mnoc_ab_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].mnoc_ib_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].ddr_ab_bw,
+					device_share_ratio);
+				do_div(
+				clk_update.axi_vote.axi_path[i].ddr_ib_bw,
+					device_share_ratio);
+			}
+		}
+	}
+
+	clk_update.axi_vote_valid = true;
+	rc = dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, id,
+		&clk_update, sizeof(clk_update));
+	if (rc)
+		CAM_ERR(CAM_PERF, "Failed in updating cpas vote, rc=%d", rc);
+
+	/*
+	 * Vote half bandwidth each on both devices.
+	 * Total bw at mnoc - CPAS will take care of adding up.
+	 * camnoc clk calculate is more accurate this way.
+	 */
+	if ((ctx_data->icp_dev_acquire_info->dev_type !=
+		CAM_ICP_RES_TYPE_BPS) && (ipe1_dev_intf)) {
+		rc = ipe1_dev_intf->hw_ops.process_cmd(ipe1_dev_intf->hw_priv,
+			id, &clk_update, sizeof(clk_update));
+		if (rc)
+			CAM_ERR(CAM_PERF,
+				"Failed in updating cpas vote for ipe 2, rc=%d",
+				rc);
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_ipe_bps_clk_update(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, int idx)
+{
+	int rc = 0;
+
+	if (cam_icp_check_clk_update(hw_mgr, ctx_data, idx))
+		rc = cam_icp_update_clk_rate(hw_mgr, ctx_data);
+
+	if (cam_icp_check_bw_update(hw_mgr, ctx_data, idx))
+		rc |= cam_icp_update_cpas_vote(hw_mgr, ctx_data);
+
+	return rc;
+}
+
+static int cam_icp_mgr_ipe_bps_resume(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct cam_hw_intf *ipe0_dev_intf = NULL;
+	struct cam_hw_intf *ipe1_dev_intf = NULL;
+	struct cam_hw_intf *bps_dev_intf = NULL;
+	uint32_t core_info_mask = 0;
+	int rc = 0;
+
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+
+	if ((!ipe0_dev_intf) || (!bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong, failed to close");
+		return -EINVAL;
+	}
+
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS) {
+		if (hw_mgr->bps_ctxt_cnt++)
+			goto end;
+		if (!hw_mgr->bps_clk_state) {
+			bps_dev_intf->hw_ops.init(
+				bps_dev_intf->hw_priv, NULL, 0);
+			hw_mgr->bps_clk_state = true;
+		}
+		if (icp_hw_mgr.ipe_bps_pc_flag) {
+			bps_dev_intf->hw_ops.process_cmd(
+				bps_dev_intf->hw_priv,
+				CAM_ICP_BPS_CMD_POWER_RESUME, NULL, 0);
+		}
+		core_info_mask = ICP_PWR_CLP_BPS;
+	} else {
+		if (hw_mgr->ipe_ctxt_cnt++)
+			goto end;
+		if (!hw_mgr->ipe_clk_state)
+			ipe0_dev_intf->hw_ops.init(
+				ipe0_dev_intf->hw_priv, NULL, 0);
+		if (icp_hw_mgr.ipe_bps_pc_flag) {
+			ipe0_dev_intf->hw_ops.process_cmd(
+				ipe0_dev_intf->hw_priv,
+				CAM_ICP_IPE_CMD_POWER_RESUME, NULL, 0);
+		}
+
+		if ((icp_hw_mgr.ipe1_enable) &&
+			(ipe1_dev_intf) &&
+			(!hw_mgr->ipe_clk_state)) {
+			ipe1_dev_intf->hw_ops.init(ipe1_dev_intf->hw_priv,
+				NULL, 0);
+
+			if (icp_hw_mgr.ipe_bps_pc_flag) {
+				ipe1_dev_intf->hw_ops.process_cmd(
+					ipe1_dev_intf->hw_priv,
+					CAM_ICP_IPE_CMD_POWER_RESUME,
+					NULL, 0);
+			}
+		}
+		hw_mgr->ipe_clk_state = true;
+
+		if ((icp_hw_mgr.ipe1_enable) &&
+			(ipe1_dev_intf))
+			core_info_mask = (ICP_PWR_CLP_IPE0 |
+				ICP_PWR_CLP_IPE1);
+		else
+			core_info_mask = ICP_PWR_CLP_IPE0;
+	}
+
+	CAM_DBG(CAM_PERF, "core_info %X", core_info_mask);
+	if (icp_hw_mgr.ipe_bps_pc_flag)
+		rc = hfi_enable_ipe_bps_pc(true, core_info_mask);
+	else
+		rc = hfi_enable_ipe_bps_pc(false, core_info_mask);
+end:
+	return rc;
+}
+
+static int cam_icp_mgr_ipe_bps_power_collapse(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data, int dev_type)
+{
+	int rc = 0, dev;
+	struct cam_hw_intf *ipe0_dev_intf = NULL;
+	struct cam_hw_intf *ipe1_dev_intf = NULL;
+	struct cam_hw_intf *bps_dev_intf = NULL;
+
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+
+	if ((!ipe0_dev_intf) || (!bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong, failed to close");
+		return -EINVAL;
+	}
+
+	if (!ctx_data)
+		dev = dev_type;
+	else
+		dev = ctx_data->icp_dev_acquire_info->dev_type;
+
+	if (dev == CAM_ICP_RES_TYPE_BPS) {
+		CAM_DBG(CAM_PERF, "bps ctx cnt %d", hw_mgr->bps_ctxt_cnt);
+		if (ctx_data)
+			--hw_mgr->bps_ctxt_cnt;
+
+		if (hw_mgr->bps_ctxt_cnt)
+			goto end;
+
+		if (icp_hw_mgr.ipe_bps_pc_flag &&
+			!atomic_read(&hw_mgr->recovery)) {
+			rc = bps_dev_intf->hw_ops.process_cmd(
+				bps_dev_intf->hw_priv,
+				CAM_ICP_BPS_CMD_POWER_COLLAPSE,
+				NULL, 0);
+		}
+
+		if (hw_mgr->bps_clk_state) {
+			bps_dev_intf->hw_ops.deinit
+				(bps_dev_intf->hw_priv, NULL, 0);
+			hw_mgr->bps_clk_state = false;
+		}
+	} else {
+		CAM_DBG(CAM_PERF, "ipe ctx cnt %d", hw_mgr->ipe_ctxt_cnt);
+		if (ctx_data)
+			--hw_mgr->ipe_ctxt_cnt;
+
+		if (hw_mgr->ipe_ctxt_cnt)
+			goto end;
+
+		if (icp_hw_mgr.ipe_bps_pc_flag &&
+			!atomic_read(&hw_mgr->recovery)) {
+			rc = ipe0_dev_intf->hw_ops.process_cmd(
+				ipe0_dev_intf->hw_priv,
+				CAM_ICP_IPE_CMD_POWER_COLLAPSE, NULL, 0);
+		}
+
+		if (hw_mgr->ipe_clk_state)
+			ipe0_dev_intf->hw_ops.deinit(
+				ipe0_dev_intf->hw_priv, NULL, 0);
+
+		if (ipe1_dev_intf) {
+			if (icp_hw_mgr.ipe_bps_pc_flag &&
+				!atomic_read(&hw_mgr->recovery)) {
+				rc = ipe1_dev_intf->hw_ops.process_cmd(
+					ipe1_dev_intf->hw_priv,
+					CAM_ICP_IPE_CMD_POWER_COLLAPSE,
+					NULL, 0);
+			}
+
+		if (hw_mgr->ipe_clk_state)
+			ipe1_dev_intf->hw_ops.deinit(ipe1_dev_intf->hw_priv,
+				NULL, 0);
+		}
+
+		hw_mgr->ipe_clk_state = false;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_icp_mgr_ipe_bps_get_gdsc_control(
+	struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	struct cam_hw_intf *ipe0_dev_intf = NULL;
+	struct cam_hw_intf *ipe1_dev_intf = NULL;
+	struct cam_hw_intf *bps_dev_intf = NULL;
+
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+
+	if ((!ipe0_dev_intf) || (!bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong");
+		return -EINVAL;
+	}
+
+	if (icp_hw_mgr.ipe_bps_pc_flag) {
+		rc = bps_dev_intf->hw_ops.process_cmd(
+			bps_dev_intf->hw_priv,
+			CAM_ICP_BPS_CMD_POWER_COLLAPSE,
+			NULL, 0);
+
+		rc = ipe0_dev_intf->hw_ops.process_cmd(
+			ipe0_dev_intf->hw_priv,
+			CAM_ICP_IPE_CMD_POWER_COLLAPSE, NULL, 0);
+
+		if (ipe1_dev_intf) {
+			rc = ipe1_dev_intf->hw_ops.process_cmd(
+				ipe1_dev_intf->hw_priv,
+				CAM_ICP_IPE_CMD_POWER_COLLAPSE,
+				NULL, 0);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_icp_set_dbg_default_clk(void *data, u64 val)
+{
+	icp_hw_mgr.icp_debug_clk = val;
+	return 0;
+}
+
+static int cam_icp_get_dbg_default_clk(void *data, u64 *val)
+{
+	*val = icp_hw_mgr.icp_debug_clk;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_icp_debug_default_clk,
+	cam_icp_get_dbg_default_clk,
+	cam_icp_set_dbg_default_clk, "%16llu");
+
+static int cam_icp_set_icp_dbg_lvl(void *data, u64 val)
+{
+	icp_hw_mgr.icp_dbg_lvl = val;
+	return 0;
+}
+
+static int cam_icp_get_icp_dbg_lvl(void *data, u64 *val)
+{
+	*val = icp_hw_mgr.icp_dbg_lvl;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_icp_debug_fs, cam_icp_get_icp_dbg_lvl,
+	cam_icp_set_icp_dbg_lvl, "%08llu");
+
+static int cam_icp_set_icp_dbg_type(void *data, u64 val)
+{
+	if (val <= NUM_HFI_DEBUG_MODE)
+		icp_hw_mgr.icp_debug_type = val;
+	return 0;
+}
+
+static int cam_icp_get_icp_dbg_type(void *data, u64 *val)
+{
+	*val = icp_hw_mgr.icp_debug_type;
+	return 0;
+}
+
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_icp_debug_type_fs, cam_icp_get_icp_dbg_type,
+	cam_icp_set_icp_dbg_type, "%08llu");
+
+static int cam_icp_set_icp_fw_dump_lvl(void *data, u64 val)
+{
+	if (val < NUM_HFI_DUMP_LVL)
+		icp_hw_mgr.icp_fw_dump_lvl = val;
+	return 0;
+}
+
+static int cam_icp_get_icp_fw_dump_lvl(void *data, u64 *val)
+{
+	*val = icp_hw_mgr.icp_fw_dump_lvl;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_icp_debug_fw_dump, cam_icp_get_icp_fw_dump_lvl,
+	cam_icp_set_icp_fw_dump_lvl, "%08llu");
+
+static int cam_icp_hw_mgr_create_debugfs_entry(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_icp", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_ICP,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	icp_hw_mgr.dentry = dbgfileptr;
+
+	debugfs_create_bool("icp_pc", 0644, icp_hw_mgr.dentry,
+		&icp_hw_mgr.icp_pc_flag);
+
+	debugfs_create_bool("ipe_bps_pc", 0644, icp_hw_mgr.dentry,
+		&icp_hw_mgr.ipe_bps_pc_flag);
+
+	debugfs_create_file("icp_debug_clk", 0644,
+		icp_hw_mgr.dentry, NULL, &cam_icp_debug_default_clk);
+
+	debugfs_create_bool("icp_jtag_debug", 0644,
+		icp_hw_mgr.dentry, &icp_hw_mgr.icp_jtag_debug);
+
+	debugfs_create_file("icp_debug_type", 0644,
+		icp_hw_mgr.dentry, NULL, &cam_icp_debug_type_fs);
+
+	debugfs_create_file("icp_debug_lvl", 0644,
+		icp_hw_mgr.dentry, NULL, &cam_icp_debug_fs);
+
+	debugfs_create_file("icp_fw_dump_lvl", 0644,
+		icp_hw_mgr.dentry, NULL, &cam_icp_debug_fw_dump);
+
+	debugfs_create_bool("disable_ubwc_comp", 0644,
+		icp_hw_mgr.dentry, &icp_hw_mgr.disable_ubwc_comp);
+
+end:
+	/* Set default hang dump lvl */
+	icp_hw_mgr.icp_fw_dump_lvl = HFI_FW_DUMP_ON_FAILURE;
+	return rc;
+}
+
+static int cam_icp_mgr_process_cmd(void *priv, void *data)
+{
+	int rc;
+	struct hfi_cmd_work_data *task_data = NULL;
+	struct cam_icp_hw_mgr *hw_mgr;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_ICP, "Invalid params%pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	hw_mgr = priv;
+	task_data = (struct hfi_cmd_work_data *)data;
+
+	rc = hfi_write_cmd(task_data->data);
+
+	return rc;
+}
+
+static int cam_icp_mgr_cleanup_ctx(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int i;
+	struct hfi_frame_process_info *hfi_frame_process;
+	struct cam_hw_done_event_data buf_data;
+
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++) {
+		if (!hfi_frame_process->request_id[i])
+			continue;
+		buf_data.request_id = hfi_frame_process->request_id[i];
+		ctx_data->ctxt_event_cb(ctx_data->context_priv,
+			CAM_CTX_EVT_ID_SUCCESS, &buf_data);
+		hfi_frame_process->request_id[i] = 0;
+		if (ctx_data->hfi_frame_process.in_resource[i] > 0) {
+			CAM_DBG(CAM_ICP, "Delete merged sync in object: %d",
+				ctx_data->hfi_frame_process.in_resource[i]);
+			cam_sync_destroy(
+				ctx_data->hfi_frame_process.in_resource[i]);
+			ctx_data->hfi_frame_process.in_resource[i] = 0;
+		}
+		hfi_frame_process->fw_process_flag[i] = false;
+		clear_bit(i, ctx_data->hfi_frame_process.bitmap);
+	}
+
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++) {
+		if (!hfi_frame_process->in_free_resource[i])
+			continue;
+
+		CAM_DBG(CAM_ICP, "Delete merged sync in object: %d",
+			ctx_data->hfi_frame_process.in_free_resource[i]);
+		cam_sync_destroy(
+			ctx_data->hfi_frame_process.in_free_resource[i]);
+		ctx_data->hfi_frame_process.in_free_resource[i] = 0;
+	}
+
+	return 0;
+}
+
+static const char *cam_icp_error_handle_id_to_type(
+	uint32_t error_handle)
+{
+	const char *name = NULL;
+
+	switch (error_handle) {
+	case CAMERAICP_SUCCESS:
+		name = "SUCCESS";
+		break;
+	case CAMERAICP_EFAILED:
+		name = "EFAILED";
+		break;
+	case CAMERAICP_ENOMEMORY:
+		name = "ENOMEMORY";
+		break;
+	case CAMERAICP_EBADSTATE:
+		name = "EBADSTATE";
+		break;
+	case CAMERAICP_EBADPARM:
+		name = "EBADPARM";
+		break;
+	case CAMERAICP_EBADITEM:
+		name = "EBADITEM";
+		break;
+	case CAMERAICP_EINVALIDFORMAT:
+		name = "EINVALIDFORMAT";
+		break;
+	case CAMERAICP_EUNSUPPORTED:
+		name = "EUNSUPPORTED";
+		break;
+	case CAMERAICP_EOUTOFBOUND:
+		name = "EOUTOFBOUND";
+		break;
+	case CAMERAICP_ETIMEDOUT:
+		name = "ETIMEDOUT";
+		break;
+	case CAMERAICP_EABORTED:
+		name = "EABORTED";
+		break;
+	case CAMERAICP_EHWVIOLATION:
+		name = "EHWVIOLATION";
+		break;
+	case CAMERAICP_ECDMERROR:
+		name = "ECDMERROR";
+		break;
+	case CAMERAICP_HFI_ERR_COMMAND_SIZE:
+		name = "HFI_ERR_COMMAND_SIZE";
+		break;
+	case CAMERAICP_HFI_ERR_MESSAGE_SIZE:
+		name = "HFI_ERR_MESSAGE_SIZE";
+		break;
+	case CAMERAICP_HFI_QUEUE_EMPTY:
+		name = "HFI_QUEUE_EMPTY";
+		break;
+	case CAMERAICP_HFI_QUEUE_FULL:
+		name = "HFI_QUEUE_FULL";
+		break;
+	default:
+		name = NULL;
+		break;
+	}
+	return name;
+}
+
+static int cam_icp_mgr_handle_frame_process(uint32_t *msg_ptr, int flag)
+{
+	int i;
+	uint32_t idx;
+	uint64_t request_id;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct hfi_msg_ipebps_async_ack *ioconfig_ack = NULL;
+	struct hfi_frame_process_info *hfi_frame_process;
+	struct cam_hw_done_event_data buf_data;
+	uint32_t clk_type;
+	uint32_t event_id;
+
+	ioconfig_ack = (struct hfi_msg_ipebps_async_ack *)msg_ptr;
+	request_id = ioconfig_ack->user_data2;
+	ctx_data = (struct cam_icp_hw_ctx_data *)
+		U64_TO_PTR(ioconfig_ack->user_data1);
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Invalid Context req %llu", request_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	cam_icp_ctx_timer_reset(ctx_data);
+	if (ctx_data->state != CAM_ICP_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_ICP, "ctx %u is in %d state",
+			ctx_data->ctx_id, ctx_data->state);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return 0;
+	}
+
+	CAM_DBG(CAM_REQ,
+		"ctx_id : %u, request_id :%lld dev_type: %d",
+		ctx_data->ctx_id, request_id,
+		ctx_data->icp_dev_acquire_info->dev_type);
+
+	clk_type = ICP_DEV_TYPE_TO_CLK_TYPE(
+			ctx_data->icp_dev_acquire_info->dev_type);
+	cam_icp_device_timer_reset(&icp_hw_mgr, clk_type);
+
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++)
+		if (hfi_frame_process->request_id[i] == request_id)
+			break;
+
+	if (i >= CAM_FRAME_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "pkt not found in ctx data for req_id =%lld",
+			request_id);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return -EINVAL;
+	}
+	idx = i;
+
+	if (flag == ICP_FRAME_PROCESS_FAILURE) {
+		buf_data.evt_param = CAM_SYNC_ICP_EVENT_FRAME_PROCESS_FAILURE;
+		if (ioconfig_ack->err_type == CAMERAICP_EABORTED) {
+			CAM_WARN(CAM_ICP,
+				"ctx_id %d req %llu dev %d has been aborted[flushed]",
+				ctx_data->ctx_id, request_id,
+				ctx_data->icp_dev_acquire_info->dev_type);
+			event_id = CAM_CTX_EVT_ID_CANCEL;
+		} else {
+			CAM_ERR(CAM_ICP,
+				"Done with error: %u err_type= [%s] on ctx_id %d dev %d for req %llu",
+				ioconfig_ack->err_type,
+				cam_icp_error_handle_id_to_type(
+				ioconfig_ack->err_type),
+				ctx_data->ctx_id,
+				ctx_data->icp_dev_acquire_info->dev_type,
+				request_id);
+			event_id = CAM_CTX_EVT_ID_ERROR;
+		}
+	} else {
+		event_id = CAM_CTX_EVT_ID_SUCCESS;
+	}
+
+	buf_data.request_id = hfi_frame_process->request_id[idx];
+	ctx_data->ctxt_event_cb(ctx_data->context_priv, event_id, &buf_data);
+	hfi_frame_process->request_id[idx] = 0;
+	if (ctx_data->hfi_frame_process.in_resource[idx] > 0) {
+		CAM_DBG(CAM_ICP, "Delete merged sync in object: %d",
+			ctx_data->hfi_frame_process.in_resource[idx]);
+		cam_sync_destroy(ctx_data->hfi_frame_process.in_resource[idx]);
+		ctx_data->hfi_frame_process.in_resource[idx] = 0;
+	}
+	clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+	hfi_frame_process->fw_process_flag[idx] = false;
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return 0;
+}
+
+static int cam_icp_mgr_process_msg_frame_process(uint32_t *msg_ptr)
+{
+	struct hfi_msg_ipebps_async_ack *ioconfig_ack = NULL;
+	struct hfi_msg_frame_process_done *frame_done;
+
+	if (!msg_ptr) {
+		CAM_ERR(CAM_ICP, "msg ptr is NULL");
+		return -EINVAL;
+	}
+
+	ioconfig_ack = (struct hfi_msg_ipebps_async_ack *)msg_ptr;
+	if (ioconfig_ack->err_type != CAMERAICP_SUCCESS) {
+		cam_icp_mgr_handle_frame_process(msg_ptr,
+			ICP_FRAME_PROCESS_FAILURE);
+		return -EIO;
+	}
+
+	frame_done =
+		(struct hfi_msg_frame_process_done *)ioconfig_ack->msg_data_flex;
+	if (!frame_done) {
+		cam_icp_mgr_handle_frame_process(msg_ptr,
+			ICP_FRAME_PROCESS_FAILURE);
+		return -EINVAL;
+	}
+
+	if (frame_done->result)
+		return cam_icp_mgr_handle_frame_process(msg_ptr,
+			ICP_FRAME_PROCESS_FAILURE);
+	else
+		return cam_icp_mgr_handle_frame_process(msg_ptr,
+			ICP_FRAME_PROCESS_SUCCESS);
+}
+
+static int cam_icp_mgr_process_msg_config_io(uint32_t *msg_ptr)
+{
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct hfi_msg_ipebps_async_ack *ioconfig_ack = NULL;
+	struct hfi_msg_ipe_config *ipe_config_ack = NULL;
+	struct hfi_msg_bps_common *bps_config_ack = NULL;
+
+	if (!msg_ptr) {
+		CAM_ERR(CAM_ICP, "msg ptr is NULL");
+		return -EINVAL;
+	}
+
+	ioconfig_ack = (struct hfi_msg_ipebps_async_ack *)msg_ptr;
+
+	if (ioconfig_ack->opcode == HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO) {
+		ipe_config_ack =
+			(struct hfi_msg_ipe_config *)(ioconfig_ack->msg_data_flex);
+		if (ipe_config_ack->rc) {
+			CAM_ERR(CAM_ICP, "rc = %d failed with\n"
+				"err_no = [%u] err_type = [%s]",
+				ipe_config_ack->rc,
+				ioconfig_ack->err_type,
+				cam_icp_error_handle_id_to_type(
+				ioconfig_ack->err_type));
+
+			return -EIO;
+		}
+		ctx_data = (struct cam_icp_hw_ctx_data *)
+			U64_TO_PTR(ioconfig_ack->user_data1);
+		if (!ctx_data) {
+			CAM_ERR(CAM_ICP, "wrong ctx data from IPE response");
+			return -EINVAL;
+		}
+		ctx_data->scratch_mem_size = ipe_config_ack->scratch_mem_size;
+	} else {
+		bps_config_ack =
+			(struct hfi_msg_bps_common *)(ioconfig_ack->msg_data_flex);
+		if (bps_config_ack->rc) {
+			CAM_ERR(CAM_ICP, "rc : %u, opcode :%u",
+				bps_config_ack->rc, ioconfig_ack->opcode);
+			return -EIO;
+		}
+		ctx_data = (struct cam_icp_hw_ctx_data *)
+			U64_TO_PTR(ioconfig_ack->user_data1);
+		if (!ctx_data) {
+			CAM_ERR(CAM_ICP, "wrong ctx data from BPS response");
+			return -EINVAL;
+		}
+	}
+	complete(&ctx_data->wait_complete);
+
+	return 0;
+}
+
+static int cam_icp_mgr_process_msg_create_handle(uint32_t *msg_ptr)
+{
+	struct hfi_msg_create_handle_ack *create_handle_ack = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	int rc = 0;
+
+	create_handle_ack = (struct hfi_msg_create_handle_ack *)msg_ptr;
+	if (!create_handle_ack) {
+		CAM_ERR(CAM_ICP, "Invalid create_handle_ack");
+		return -EINVAL;
+	}
+
+	ctx_data =
+		(struct cam_icp_hw_ctx_data *)(uintptr_t)
+		create_handle_ack->user_data1;
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Invalid ctx_data");
+		return -EINVAL;
+	}
+
+	if (ctx_data->state == CAM_ICP_CTX_STATE_IN_USE) {
+		ctx_data->fw_handle = create_handle_ack->fw_handle;
+		CAM_DBG(CAM_ICP, "fw_handle = %x", ctx_data->fw_handle);
+	} else {
+		CAM_WARN(CAM_ICP,
+			"This ctx is no longer in use current state: %d",
+			ctx_data->state);
+		ctx_data->fw_handle = 0;
+		rc = -EPERM;
+	}
+	complete(&ctx_data->wait_complete);
+	return rc;
+}
+
+static int cam_icp_mgr_process_msg_ping_ack(uint32_t *msg_ptr)
+{
+	struct hfi_msg_ping_ack *ping_ack = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+
+	ping_ack = (struct hfi_msg_ping_ack *)msg_ptr;
+	if (!ping_ack) {
+		CAM_ERR(CAM_ICP, "Empty ping ack message");
+		return -EINVAL;
+	}
+
+	ctx_data = (struct cam_icp_hw_ctx_data *)
+		U64_TO_PTR(ping_ack->user_data);
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Invalid ctx_data");
+		return -EINVAL;
+	}
+
+	if (ctx_data->state == CAM_ICP_CTX_STATE_IN_USE)
+		complete(&ctx_data->wait_complete);
+
+	return 0;
+}
+
+static int cam_icp_mgr_process_indirect_ack_msg(uint32_t *msg_ptr)
+{
+	int rc;
+
+	if (!msg_ptr) {
+		CAM_ERR(CAM_ICP, "msg ptr is NULL");
+		return -EINVAL;
+	}
+
+	switch (msg_ptr[ICP_PACKET_OPCODE]) {
+	case HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO:
+	case HFI_IPEBPS_CMD_OPCODE_BPS_CONFIG_IO:
+		CAM_DBG(CAM_ICP, "received IPE/BPS_CONFIG_IO:");
+		rc = cam_icp_mgr_process_msg_config_io(msg_ptr);
+		if (rc)
+			return rc;
+		break;
+
+	case HFI_IPEBPS_CMD_OPCODE_IPE_FRAME_PROCESS:
+	case HFI_IPEBPS_CMD_OPCODE_BPS_FRAME_PROCESS:
+		rc = cam_icp_mgr_process_msg_frame_process(msg_ptr);
+		if (rc)
+			return rc;
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid opcode : %u",
+			msg_ptr[ICP_PACKET_OPCODE]);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_process_direct_ack_msg(uint32_t *msg_ptr)
+{
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct hfi_msg_ipebps_async_ack *ioconfig_ack = NULL;
+	int rc = 0;
+
+	if (!msg_ptr)
+		return -EINVAL;
+
+	switch (msg_ptr[ICP_PACKET_OPCODE]) {
+	case HFI_IPEBPS_CMD_OPCODE_IPE_ABORT:
+	case HFI_IPEBPS_CMD_OPCODE_BPS_ABORT:
+		ioconfig_ack = (struct hfi_msg_ipebps_async_ack *)msg_ptr;
+		ctx_data = (struct cam_icp_hw_ctx_data *)
+			U64_TO_PTR(ioconfig_ack->user_data1);
+		if (ctx_data->state != CAM_ICP_CTX_STATE_FREE)
+			complete(&ctx_data->wait_complete);
+		CAM_DBG(CAM_ICP, "received IPE/BPS/ ABORT: ctx_state =%d",
+			ctx_data->state);
+		break;
+	case HFI_IPEBPS_CMD_OPCODE_IPE_DESTROY:
+	case HFI_IPEBPS_CMD_OPCODE_BPS_DESTROY:
+		ioconfig_ack = (struct hfi_msg_ipebps_async_ack *)msg_ptr;
+		ctx_data = (struct cam_icp_hw_ctx_data *)
+			U64_TO_PTR(ioconfig_ack->user_data1);
+		if ((ctx_data->state == CAM_ICP_CTX_STATE_RELEASE) ||
+			(ctx_data->state == CAM_ICP_CTX_STATE_IN_USE)) {
+			complete(&ctx_data->wait_complete);
+		}
+		CAM_DBG(CAM_ICP, "received IPE/BPS/ DESTROY: ctx_state =%d",
+			ctx_data->state);
+		break;
+	case HFI_IPEBPS_CMD_OPCODE_MEM_MAP:
+		ioconfig_ack = (struct hfi_msg_ipebps_async_ack *)msg_ptr;
+		ctx_data =
+			(struct cam_icp_hw_ctx_data *)ioconfig_ack->user_data1;
+		if (ctx_data->state != CAM_ICP_CTX_STATE_FREE)
+			complete(&ctx_data->wait_complete);
+		CAM_DBG(CAM_ICP, "received IPE/BPS\n"
+			"MAP ACK:ctx_state =%d\n"
+			"failed with err_no = [%u] err_type = [%s]",
+			ctx_data->state,
+			ioconfig_ack->err_type,
+			cam_icp_error_handle_id_to_type(
+			ioconfig_ack->err_type));
+		break;
+	case HFI_IPEBPS_CMD_OPCODE_MEM_UNMAP:
+		ioconfig_ack = (struct hfi_msg_ipebps_async_ack *)msg_ptr;
+		ctx_data =
+			(struct cam_icp_hw_ctx_data *)ioconfig_ack->user_data1;
+		if (ctx_data->state != CAM_ICP_CTX_STATE_FREE)
+			complete(&ctx_data->wait_complete);
+		CAM_DBG(CAM_ICP,
+			"received IPE/BPS UNMAP ACK:ctx_state =%d\n"
+			"failed with err_no = [%u] err_type = [%s]",
+			ctx_data->state,
+			ioconfig_ack->err_type,
+			cam_icp_error_handle_id_to_type(
+			ioconfig_ack->err_type));
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid opcode : %u",
+			msg_ptr[ICP_PACKET_OPCODE]);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int cam_icp_ipebps_reset(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	struct cam_hw_intf *ipe0_dev_intf;
+	struct cam_hw_intf *ipe1_dev_intf;
+	struct cam_hw_intf *bps_dev_intf;
+
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+
+	if (hw_mgr->bps_ctxt_cnt) {
+		rc = bps_dev_intf->hw_ops.process_cmd(
+			bps_dev_intf->hw_priv,
+			CAM_ICP_BPS_CMD_RESET,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_ICP, "bps reset failed");
+	}
+
+	if (hw_mgr->ipe_ctxt_cnt) {
+		rc = ipe0_dev_intf->hw_ops.process_cmd(
+			ipe0_dev_intf->hw_priv,
+			CAM_ICP_IPE_CMD_RESET,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_ICP, "ipe0 reset failed");
+
+		if (ipe1_dev_intf) {
+			rc = ipe1_dev_intf->hw_ops.process_cmd(
+				ipe1_dev_intf->hw_priv,
+				CAM_ICP_IPE_CMD_RESET,
+				NULL, 0);
+			if (rc)
+				CAM_ERR(CAM_ICP, "ipe1 reset failed");
+		}
+	}
+
+	return 0;
+}
+
+static int cam_icp_mgr_trigger_recovery(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	struct sfr_buf *sfr_buffer = NULL;
+
+	CAM_DBG(CAM_ICP, "Enter");
+
+	if (atomic_read(&hw_mgr->recovery)) {
+		CAM_ERR(CAM_ICP, "Recovery is set");
+		return rc;
+	}
+
+	sfr_buffer = (struct sfr_buf *)icp_hw_mgr.hfi_mem.sfr_buf.kva;
+	CAM_WARN(CAM_ICP, "SFR:%s", sfr_buffer->msg);
+
+	cam_icp_mgr_ipe_bps_get_gdsc_control(hw_mgr);
+	cam_icp_ipebps_reset(hw_mgr);
+
+	atomic_set(&hw_mgr->recovery, 1);
+	CAM_DBG(CAM_ICP, "Done");
+	return rc;
+}
+static int cam_icp_mgr_process_fatal_error(
+	struct cam_icp_hw_mgr *hw_mgr, uint32_t *msg_ptr)
+{
+	struct hfi_msg_event_notify *event_notify;
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "Enter");
+
+	event_notify = (struct hfi_msg_event_notify *)msg_ptr;
+	if (!event_notify) {
+		CAM_ERR(CAM_ICP, "Empty event message");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "evt_id: %u evt_data1: %u evt_data2: %u",
+		event_notify->event_id,
+		event_notify->event_data1,
+		event_notify->event_data2);
+
+	if (event_notify->event_id == HFI_EVENT_SYS_ERROR) {
+		CAM_INFO(CAM_ICP, "received HFI_EVENT_SYS_ERROR");
+		if (event_notify->event_data1 == HFI_ERR_SYS_FATAL) {
+			CAM_ERR(CAM_ICP, "received HFI_ERR_SYS_FATAL");
+			BUG();
+		}
+		rc = cam_icp_mgr_trigger_recovery(hw_mgr);
+		cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+	}
+
+	return rc;
+}
+
+static void cam_icp_mgr_process_dbg_buf(unsigned int debug_lvl)
+{
+	uint32_t *msg_ptr = NULL, *pkt_ptr = NULL;
+	struct hfi_msg_debug *dbg_msg;
+	uint32_t read_len, size_processed = 0;
+	uint64_t timestamp = 0;
+	char *dbg_buf;
+	int rc = 0;
+
+	rc = hfi_read_message(icp_hw_mgr.dbg_buf, Q_DBG, &read_len);
+	if (rc)
+		return;
+
+	msg_ptr = (uint32_t *)icp_hw_mgr.dbg_buf;
+	while (true) {
+		pkt_ptr = msg_ptr;
+		if (pkt_ptr[ICP_PACKET_TYPE] == HFI_MSG_SYS_DEBUG) {
+			dbg_msg = (struct hfi_msg_debug *)pkt_ptr;
+			dbg_buf = (char *)&dbg_msg->msg_data_flex;
+			timestamp = ((((uint64_t)(dbg_msg->timestamp_hi) << 32)
+				| dbg_msg->timestamp_lo) >> 16);
+			trace_cam_icp_fw_dbg(dbg_buf, timestamp/2);
+			if (!debug_lvl)
+				CAM_INFO(CAM_ICP, "FW_DBG:%s", dbg_buf);
+		}
+		size_processed += (pkt_ptr[ICP_PACKET_SIZE] >>
+			BYTE_WORD_SHIFT);
+		if (size_processed >= read_len)
+			return;
+		msg_ptr += (pkt_ptr[ICP_PACKET_SIZE] >>
+		BYTE_WORD_SHIFT);
+		pkt_ptr = NULL;
+		dbg_msg = NULL;
+		dbg_buf = NULL;
+	}
+}
+
+static int cam_icp_process_msg_pkt_type(
+	struct cam_icp_hw_mgr *hw_mgr,
+	uint32_t *msg_ptr,
+	uint32_t *msg_processed_len)
+{
+	int rc = 0;
+	int size_processed = 0;
+
+	switch (msg_ptr[ICP_PACKET_TYPE]) {
+	case HFI_MSG_SYS_INIT_DONE:
+		CAM_DBG(CAM_ICP, "received SYS_INIT_DONE");
+		complete(&hw_mgr->icp_complete);
+		size_processed = (
+			(struct hfi_msg_init_done *)msg_ptr)->size;
+		break;
+
+	case HFI_MSG_SYS_PC_PREP_DONE:
+		CAM_DBG(CAM_ICP, "HFI_MSG_SYS_PC_PREP_DONE is received\n");
+		complete(&hw_mgr->icp_complete);
+		size_processed = sizeof(struct hfi_msg_pc_prep_done);
+		break;
+
+	case HFI_MSG_SYS_PING_ACK:
+		CAM_DBG(CAM_ICP, "received SYS_PING_ACK");
+		rc = cam_icp_mgr_process_msg_ping_ack(msg_ptr);
+		size_processed = sizeof(struct hfi_msg_ping_ack);
+		break;
+
+	case HFI_MSG_IPEBPS_CREATE_HANDLE_ACK:
+		CAM_DBG(CAM_ICP, "received IPEBPS_CREATE_HANDLE_ACK");
+		rc = cam_icp_mgr_process_msg_create_handle(msg_ptr);
+		size_processed = sizeof(struct hfi_msg_create_handle_ack);
+		break;
+
+	case HFI_MSG_IPEBPS_ASYNC_COMMAND_INDIRECT_ACK:
+		CAM_DBG(CAM_ICP, "received ASYNC_INDIRECT_ACK");
+		rc = cam_icp_mgr_process_indirect_ack_msg(msg_ptr);
+		size_processed = (
+			(struct hfi_msg_ipebps_async_ack *)msg_ptr)->size;
+		break;
+
+	case  HFI_MSG_IPEBPS_ASYNC_COMMAND_DIRECT_ACK:
+		CAM_DBG(CAM_ICP, "received ASYNC_DIRECT_ACK");
+		rc = cam_icp_mgr_process_direct_ack_msg(msg_ptr);
+		size_processed = (
+			(struct hfi_msg_ipebps_async_ack *)msg_ptr)->size;
+		break;
+
+	case HFI_MSG_EVENT_NOTIFY:
+		CAM_DBG(CAM_ICP, "received EVENT_NOTIFY");
+		size_processed = (
+			(struct hfi_msg_event_notify *)msg_ptr)->size;
+		rc = cam_icp_mgr_process_fatal_error(hw_mgr, msg_ptr);
+		if (rc)
+			CAM_ERR(CAM_ICP, "failed in processing evt notify");
+
+		break;
+
+	default:
+		CAM_ERR(CAM_ICP, "invalid msg : %u",
+			msg_ptr[ICP_PACKET_TYPE]);
+		rc = -EINVAL;
+		break;
+	}
+
+	*msg_processed_len = size_processed;
+	return rc;
+}
+
+static int32_t cam_icp_mgr_process_msg(void *priv, void *data)
+{
+	uint32_t read_len, msg_processed_len;
+	uint32_t *msg_ptr = NULL;
+	struct hfi_msg_work_data *task_data;
+	struct cam_icp_hw_mgr *hw_mgr;
+	int rc = 0;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_ICP, "Invalid data");
+		return -EINVAL;
+	}
+
+	task_data = data;
+	hw_mgr = priv;
+
+	rc = hfi_read_message(icp_hw_mgr.msg_buf, Q_MSG, &read_len);
+	if (rc) {
+		CAM_DBG(CAM_ICP, "Unable to read msg q rc %d", rc);
+	} else {
+		read_len = read_len << BYTE_WORD_SHIFT;
+		msg_ptr = (uint32_t *)icp_hw_mgr.msg_buf;
+		while (true) {
+			cam_icp_process_msg_pkt_type(hw_mgr, msg_ptr,
+				&msg_processed_len);
+
+			if (!msg_processed_len) {
+				CAM_ERR(CAM_ICP, "Failed to read");
+				rc = -EINVAL;
+				break;
+			}
+
+			read_len -= msg_processed_len;
+			if (read_len > 0) {
+				msg_ptr += (msg_processed_len >>
+				BYTE_WORD_SHIFT);
+				msg_processed_len = 0;
+			} else {
+				break;
+			}
+		}
+	}
+
+	cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+
+	if ((task_data->irq_status & A5_WDT_0) ||
+		(task_data->irq_status & A5_WDT_1)) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP, "watch dog interrupt from A5");
+
+		rc = cam_icp_mgr_trigger_recovery(hw_mgr);
+	}
+
+	return rc;
+}
+
+static int32_t cam_icp_hw_mgr_cb(uint32_t irq_status, void *data)
+{
+	int32_t rc = 0;
+	unsigned long flags;
+	struct cam_icp_hw_mgr *hw_mgr = data;
+	struct crm_workq_task *task;
+	struct hfi_msg_work_data *task_data;
+
+	if (!data) {
+		CAM_ERR(CAM_ICP, "irq cb data is NULL");
+		return rc;
+	}
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.msg_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "no empty task");
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+		return -ENOMEM;
+	}
+
+	task_data = (struct hfi_msg_work_data *)task->payload;
+	task_data->data = hw_mgr;
+	task_data->irq_status = irq_status;
+	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_icp_mgr_process_msg;
+	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+
+	return rc;
+}
+
+static void cam_icp_free_hfi_mem(void)
+{
+	int rc;
+
+	cam_smmu_dealloc_firmware(icp_hw_mgr.iommu_hdl);
+	rc = cam_mem_mgr_free_memory_region(&icp_hw_mgr.hfi_mem.sec_heap);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to unreserve sec heap");
+
+	cam_smmu_dealloc_qdss(icp_hw_mgr.iommu_hdl);
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.qtbl);
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.cmd_q);
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.msg_q);
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.dbg_q);
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.sfr_buf);
+}
+
+static int cam_icp_alloc_secheap_mem(struct cam_mem_mgr_memory_desc *secheap)
+{
+	int rc;
+	struct cam_mem_mgr_request_desc alloc;
+	struct cam_mem_mgr_memory_desc out;
+	struct cam_smmu_region_info secheap_info;
+
+	memset(&alloc, 0, sizeof(alloc));
+	memset(&out, 0, sizeof(out));
+
+	rc = cam_smmu_get_region_info(icp_hw_mgr.iommu_hdl,
+		CAM_SMMU_REGION_SECHEAP,
+		&secheap_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to get secheap memory info");
+		return rc;
+	}
+
+	alloc.size = secheap_info.iova_len;
+	alloc.align = 0;
+	alloc.flags = 0;
+	alloc.smmu_hdl = icp_hw_mgr.iommu_hdl;
+	rc = cam_mem_mgr_reserve_memory_region(&alloc,
+		CAM_SMMU_REGION_SECHEAP,
+		&out);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to reserve secheap memory");
+		return rc;
+	}
+
+	*secheap = out;
+	CAM_DBG(CAM_ICP, "kva: %llX, iova: %x, hdl: %x, len: %lld",
+		out.kva, out.iova, out.mem_handle, out.len);
+
+	return rc;
+}
+
+static int cam_icp_alloc_sfr_mem(struct cam_mem_mgr_memory_desc *sfr)
+{
+	int rc;
+	struct cam_mem_mgr_request_desc alloc;
+	struct cam_mem_mgr_memory_desc out;
+
+	memset(&alloc, 0, sizeof(alloc));
+	memset(&out, 0, sizeof(out));
+	alloc.size = SZ_8K;
+	alloc.align = 0;
+	alloc.flags = CAM_MEM_FLAG_HW_READ_WRITE |
+		CAM_MEM_FLAG_HW_SHARED_ACCESS;
+
+	alloc.smmu_hdl = icp_hw_mgr.iommu_hdl;
+	rc = cam_mem_mgr_request_mem(&alloc, &out);
+	if (rc)
+		return rc;
+
+	*sfr = out;
+	CAM_DBG(CAM_ICP, "kva: %llX, iova: %x, hdl: %x, len: %lld",
+		out.kva, out.iova, out.mem_handle, out.len);
+
+	return rc;
+}
+
+static int cam_icp_alloc_shared_mem(struct cam_mem_mgr_memory_desc *qtbl)
+{
+	int rc;
+	struct cam_mem_mgr_request_desc alloc;
+	struct cam_mem_mgr_memory_desc out;
+
+	memset(&alloc, 0, sizeof(alloc));
+	memset(&out, 0, sizeof(out));
+	alloc.size = SZ_1M;
+	alloc.align = 0;
+	alloc.flags = CAM_MEM_FLAG_HW_READ_WRITE |
+		CAM_MEM_FLAG_HW_SHARED_ACCESS;
+	alloc.smmu_hdl = icp_hw_mgr.iommu_hdl;
+	rc = cam_mem_mgr_request_mem(&alloc, &out);
+	if (rc)
+		return rc;
+
+	*qtbl = out;
+	CAM_DBG(CAM_ICP, "kva: %llX, iova: %x, hdl: %x, len: %lld",
+		out.kva, out.iova, out.mem_handle, out.len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_fw_mem(void)
+{
+	int rc;
+	uintptr_t kvaddr;
+	size_t len;
+	dma_addr_t iova;
+
+	rc = cam_smmu_alloc_firmware(icp_hw_mgr.iommu_hdl,
+		&iova, &kvaddr, &len);
+	if (rc)
+		return -ENOMEM;
+
+	icp_hw_mgr.hfi_mem.fw_buf.len = len;
+	icp_hw_mgr.hfi_mem.fw_buf.kva = kvaddr;
+	icp_hw_mgr.hfi_mem.fw_buf.iova = iova;
+	icp_hw_mgr.hfi_mem.fw_buf.smmu_hdl = icp_hw_mgr.iommu_hdl;
+
+	CAM_DBG(CAM_ICP, "kva: %zX, iova: %llx, len: %zu",
+		kvaddr, iova, len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_qdss_mem(void)
+{
+	int rc;
+	size_t len;
+	dma_addr_t iova;
+
+	rc = cam_smmu_alloc_qdss(icp_hw_mgr.iommu_hdl,
+		&iova, &len);
+	if (rc)
+		return rc;
+
+	icp_hw_mgr.hfi_mem.qdss_buf.len = len;
+	icp_hw_mgr.hfi_mem.qdss_buf.iova = iova;
+	icp_hw_mgr.hfi_mem.qdss_buf.smmu_hdl = icp_hw_mgr.iommu_hdl;
+
+	CAM_DBG(CAM_ICP, "iova: %llx, len: %zu", iova, len);
+
+	return rc;
+}
+
+static int cam_icp_get_io_mem_info(void)
+{
+	int rc;
+	size_t len, discard_iova_len;
+	dma_addr_t iova, discard_iova_start;
+
+	rc = cam_smmu_get_io_region_info(icp_hw_mgr.iommu_hdl,
+		&iova, &len, &discard_iova_start, &discard_iova_len);
+	if (rc)
+		return rc;
+
+	icp_hw_mgr.hfi_mem.io_mem.iova_len = len;
+	icp_hw_mgr.hfi_mem.io_mem.iova_start = iova;
+	icp_hw_mgr.hfi_mem.io_mem.discard_iova_start = discard_iova_start;
+	icp_hw_mgr.hfi_mem.io_mem.discard_iova_len = discard_iova_len;
+
+	CAM_DBG(CAM_ICP, "iova: %llx, len: %zu discard iova %llx len %llx",
+		iova, len, discard_iova_start, discard_iova_len);
+
+	return rc;
+}
+
+static int cam_icp_allocate_hfi_mem(void)
+{
+	int rc;
+
+	rc = cam_smmu_get_region_info(icp_hw_mgr.iommu_hdl,
+		CAM_SMMU_REGION_SHARED,
+		&icp_hw_mgr.hfi_mem.shmem);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to get shared memory info");
+		return rc;
+	}
+
+	rc = cam_icp_allocate_fw_mem();
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to allocate FW memory");
+		return rc;
+	}
+
+	rc = cam_icp_allocate_qdss_mem();
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to allocate qdss memory");
+		goto fw_alloc_failed;
+	}
+
+	rc = cam_icp_alloc_shared_mem(&icp_hw_mgr.hfi_mem.qtbl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to allocate qtbl memory");
+		goto qtbl_alloc_failed;
+	}
+
+	rc = cam_icp_alloc_shared_mem(&icp_hw_mgr.hfi_mem.cmd_q);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to allocate cmd q memory");
+		goto cmd_q_alloc_failed;
+	}
+
+	rc = cam_icp_alloc_shared_mem(&icp_hw_mgr.hfi_mem.msg_q);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to allocate msg q memory");
+		goto msg_q_alloc_failed;
+	}
+
+	rc = cam_icp_alloc_shared_mem(&icp_hw_mgr.hfi_mem.dbg_q);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to allocate dbg q memory");
+		goto dbg_q_alloc_failed;
+	}
+
+	rc = cam_icp_alloc_sfr_mem(&icp_hw_mgr.hfi_mem.sfr_buf);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to allocate sfr buffer");
+		goto sfr_buf_alloc_failed;
+	}
+
+	rc = cam_icp_alloc_secheap_mem(&icp_hw_mgr.hfi_mem.sec_heap);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to allocate sec heap memory");
+		goto sec_heap_alloc_failed;
+	}
+
+	rc = cam_icp_get_io_mem_info();
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Unable to get I/O region info");
+		goto get_io_mem_failed;
+	}
+
+	return rc;
+get_io_mem_failed:
+	cam_mem_mgr_free_memory_region(&icp_hw_mgr.hfi_mem.sec_heap);
+sec_heap_alloc_failed:
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.sfr_buf);
+sfr_buf_alloc_failed:
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.dbg_q);
+dbg_q_alloc_failed:
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.msg_q);
+msg_q_alloc_failed:
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.cmd_q);
+cmd_q_alloc_failed:
+	cam_mem_mgr_release_mem(&icp_hw_mgr.hfi_mem.qtbl);
+qtbl_alloc_failed:
+	cam_smmu_dealloc_qdss(icp_hw_mgr.iommu_hdl);
+fw_alloc_failed:
+	cam_smmu_dealloc_firmware(icp_hw_mgr.iommu_hdl);
+	return rc;
+}
+
+static int cam_icp_mgr_get_free_ctx(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int i = 0;
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++) {
+		mutex_lock(&hw_mgr->ctx_data[i].ctx_mutex);
+		if (hw_mgr->ctx_data[i].state == CAM_ICP_CTX_STATE_FREE) {
+			hw_mgr->ctx_data[i].state = CAM_ICP_CTX_STATE_IN_USE;
+			mutex_unlock(&hw_mgr->ctx_data[i].ctx_mutex);
+			break;
+		}
+		mutex_unlock(&hw_mgr->ctx_data[i].ctx_mutex);
+	}
+
+	return i;
+}
+
+static void cam_icp_mgr_put_ctx(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	ctx_data->state = CAM_ICP_CTX_STATE_FREE;
+}
+
+static int cam_icp_mgr_send_pc_prep(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is NULL");
+		return -EINVAL;
+	}
+
+	reinit_completion(&hw_mgr->icp_complete);
+	CAM_DBG(CAM_ICP, "Sending HFI init command");
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+					CAM_ICP_CMD_PC_PREP, NULL, 0);
+	if (rc)
+		return rc;
+
+	CAM_DBG(CAM_ICP, "Wait for PC_PREP_DONE Message\n");
+	rem_jiffies = wait_for_completion_timeout(&icp_hw_mgr.icp_complete,
+		msecs_to_jiffies((timeout)));
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_ICP, "PC_PREP response timed out %d\n", rc);
+	}
+	CAM_DBG(CAM_ICP, "Done Waiting for PC_PREP Message\n");
+
+	return rc;
+}
+
+static int cam_ipe_bps_deint(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *ipe0_dev_intf = NULL;
+	struct cam_hw_intf *ipe1_dev_intf = NULL;
+	struct cam_hw_intf *bps_dev_intf = NULL;
+
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+	if ((!ipe0_dev_intf) || (!bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong, failed to close");
+		return 0;
+	}
+
+	if (ipe1_dev_intf && hw_mgr->ipe_clk_state) {
+		ipe1_dev_intf->hw_ops.deinit(ipe1_dev_intf->hw_priv,
+				NULL, 0);
+	}
+
+	if (hw_mgr->ipe_clk_state)
+		ipe0_dev_intf->hw_ops.deinit(ipe0_dev_intf->hw_priv, NULL, 0);
+	if (hw_mgr->bps_clk_state)
+		bps_dev_intf->hw_ops.deinit(bps_dev_intf->hw_priv, NULL, 0);
+
+
+	hw_mgr->bps_clk_state = false;
+	hw_mgr->ipe_clk_state = false;
+
+	return 0;
+}
+
+static int cam_icp_mgr_hw_close_u(void *hw_priv, void *hw_close_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_priv;
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "UMD calls close");
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Null hw mgr");
+		return 0;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	rc = cam_icp_mgr_hw_close(hw_mgr, NULL);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_icp_mgr_hw_close_k(void *hw_priv, void *hw_close_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_priv;
+
+	CAM_DBG(CAM_ICP, "KMD calls close");
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Null hw mgr");
+		return 0;
+	}
+
+	return cam_icp_mgr_hw_close(hw_mgr, NULL);
+
+}
+
+static int cam_icp_mgr_proc_resume(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+
+	if (!icp_dev_intf)
+		return -EINVAL;
+
+	return icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+						CAM_ICP_CMD_POWER_RESUME,
+						&hw_mgr->icp_jtag_debug,
+						sizeof(hw_mgr->icp_jtag_debug));
+}
+
+static void cam_icp_mgr_proc_suspend(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+
+	if (!icp_dev_intf)
+		return;
+
+	icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+					CAM_ICP_CMD_POWER_COLLAPSE,
+					NULL, 0);
+}
+
+static int __power_collapse(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+
+	if (!hw_mgr->icp_pc_flag || atomic_read(&hw_mgr->recovery)) {
+		cam_icp_mgr_proc_suspend(hw_mgr);
+		rc = cam_icp_mgr_hw_close_k(hw_mgr, NULL);
+	} else {
+		CAM_DBG(CAM_PERF, "Sending PC prep ICP PC enabled");
+		rc = cam_icp_mgr_send_pc_prep(hw_mgr);
+		cam_icp_mgr_proc_suspend(hw_mgr);
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_icp_power_collapse(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	int rc;
+
+	CAM_DBG(CAM_PERF, "ENTER");
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is NULL");
+		return -EINVAL;
+	}
+
+	rc = __power_collapse(hw_mgr);
+
+	icp_dev_intf->hw_ops.deinit(icp_dev_intf->hw_priv, NULL, 0);
+
+	CAM_DBG(CAM_PERF, "EXIT");
+
+	return rc;
+}
+
+static int cam_icp_mgr_hfi_resume(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct hfi_mem_info hfi_mem;
+
+	hfi_mem.qtbl.kva = icp_hw_mgr.hfi_mem.qtbl.kva;
+	hfi_mem.qtbl.iova = icp_hw_mgr.hfi_mem.qtbl.iova;
+	hfi_mem.qtbl.len = icp_hw_mgr.hfi_mem.qtbl.len;
+	CAM_DBG(CAM_ICP, "qtbl kva = %llX IOVA = %X length = %lld\n",
+		hfi_mem.qtbl.kva, hfi_mem.qtbl.iova, hfi_mem.qtbl.len);
+
+	hfi_mem.cmd_q.kva = icp_hw_mgr.hfi_mem.cmd_q.kva;
+	hfi_mem.cmd_q.iova = icp_hw_mgr.hfi_mem.cmd_q.iova;
+	hfi_mem.cmd_q.len = icp_hw_mgr.hfi_mem.cmd_q.len;
+	CAM_DBG(CAM_ICP, "cmd_q kva = %llX IOVA = %X length = %lld\n",
+		hfi_mem.cmd_q.kva, hfi_mem.cmd_q.iova, hfi_mem.cmd_q.len);
+
+	hfi_mem.msg_q.kva = icp_hw_mgr.hfi_mem.msg_q.kva;
+	hfi_mem.msg_q.iova = icp_hw_mgr.hfi_mem.msg_q.iova;
+	hfi_mem.msg_q.len = icp_hw_mgr.hfi_mem.msg_q.len;
+	CAM_DBG(CAM_ICP, "msg_q kva = %llX IOVA = %X length = %lld\n",
+		hfi_mem.msg_q.kva, hfi_mem.msg_q.iova, hfi_mem.msg_q.len);
+
+	hfi_mem.dbg_q.kva = icp_hw_mgr.hfi_mem.dbg_q.kva;
+	hfi_mem.dbg_q.iova = icp_hw_mgr.hfi_mem.dbg_q.iova;
+	hfi_mem.dbg_q.len = icp_hw_mgr.hfi_mem.dbg_q.len;
+	CAM_DBG(CAM_ICP, "dbg_q kva = %llX IOVA = %X length = %lld\n",
+		hfi_mem.dbg_q.kva, hfi_mem.dbg_q.iova, hfi_mem.dbg_q.len);
+
+	hfi_mem.sfr_buf.kva = icp_hw_mgr.hfi_mem.sfr_buf.kva;
+	hfi_mem.sfr_buf.iova = icp_hw_mgr.hfi_mem.sfr_buf.iova;
+	hfi_mem.sfr_buf.len = icp_hw_mgr.hfi_mem.sfr_buf.len;
+	CAM_DBG(CAM_ICP, "sfr_buf kva = %llX IOVA = %X length = %lld\n",
+		hfi_mem.sfr_buf.kva, hfi_mem.sfr_buf.iova,
+		hfi_mem.sfr_buf.len);
+
+	hfi_mem.sec_heap.kva = icp_hw_mgr.hfi_mem.sec_heap.kva;
+	hfi_mem.sec_heap.iova = icp_hw_mgr.hfi_mem.sec_heap.iova;
+	hfi_mem.sec_heap.len = icp_hw_mgr.hfi_mem.sec_heap.len;
+	CAM_DBG(CAM_ICP, "sec_heap kva = %llX IOVA = %X length = %lld\n",
+		hfi_mem.sec_heap.kva, hfi_mem.sec_heap.iova,
+		hfi_mem.sec_heap.len);
+
+	hfi_mem.shmem.iova = icp_hw_mgr.hfi_mem.shmem.iova_start;
+	hfi_mem.shmem.len = icp_hw_mgr.hfi_mem.shmem.iova_len;
+
+	hfi_mem.qdss.iova = icp_hw_mgr.hfi_mem.qdss_buf.iova;
+	hfi_mem.qdss.len = icp_hw_mgr.hfi_mem.qdss_buf.len;
+
+	if (icp_hw_mgr.hfi_mem.io_mem.discard_iova_start &&
+		icp_hw_mgr.hfi_mem.io_mem.discard_iova_len) {
+		/* IO Region 1 */
+		hfi_mem.io_mem.iova = icp_hw_mgr.hfi_mem.io_mem.iova_start;
+		hfi_mem.io_mem.len =
+			icp_hw_mgr.hfi_mem.io_mem.discard_iova_start -
+			icp_hw_mgr.hfi_mem.io_mem.iova_start;
+
+		/* IO Region 2 */
+		hfi_mem.io_mem2.iova =
+			icp_hw_mgr.hfi_mem.io_mem.discard_iova_start +
+			icp_hw_mgr.hfi_mem.io_mem.discard_iova_len;
+		hfi_mem.io_mem2.len =
+			icp_hw_mgr.hfi_mem.io_mem.iova_start +
+			icp_hw_mgr.hfi_mem.io_mem.iova_len   -
+			hfi_mem.io_mem2.iova;
+	} else {
+		/* IO Region 1 */
+		hfi_mem.io_mem.iova = icp_hw_mgr.hfi_mem.io_mem.iova_start;
+		hfi_mem.io_mem.len = icp_hw_mgr.hfi_mem.io_mem.iova_len;
+
+		/* IO Region 2 */
+		hfi_mem.io_mem2.iova = 0x0;
+		hfi_mem.io_mem2.len = 0x0;
+	}
+
+	CAM_DBG(CAM_ICP,
+		"IO region1 IOVA = %X length = %lld, IO region2 IOVA = %X length = %lld",
+		hfi_mem.io_mem.iova,
+		hfi_mem.io_mem.len,
+		hfi_mem.io_mem2.iova,
+		hfi_mem.io_mem2.len);
+
+	return cam_hfi_resume(&hfi_mem);
+}
+
+static int cam_icp_retry_wait_for_abort(
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int retry_cnt = 1;
+	unsigned long rem_jiffies;
+	int timeout = 1000;
+
+	CAM_WARN(CAM_ICP, "FW timeout in abort ctx: %u retry_left: %d",
+		ctx_data->ctx_id, retry_cnt);
+	while (retry_cnt > 0) {
+		rem_jiffies = wait_for_completion_timeout(
+			&ctx_data->wait_complete,
+			msecs_to_jiffies((timeout)));
+		if (!rem_jiffies) {
+			retry_cnt--;
+			if (retry_cnt > 0) {
+				CAM_WARN(CAM_ICP,
+					"FW timeout in abort ctx: %u retry_left: %u",
+					ctx_data->ctx_id, retry_cnt);
+				continue;
+			}
+		}
+
+		if (retry_cnt > 0)
+			return 0;
+	}
+
+	return -ETIMEDOUT;
+}
+
+static int cam_icp_mgr_abort_handle_wq(
+	void *priv, void *data)
+{
+	int rc;
+	size_t packet_size;
+	struct hfi_cmd_work_data   *task_data = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	struct hfi_cmd_ipebps_async *abort_cmd;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_ICP, "Invalid params %pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	task_data = (struct hfi_cmd_work_data *)data;
+	ctx_data =
+		(struct cam_icp_hw_ctx_data *)task_data->data;
+	packet_size =
+		sizeof(struct hfi_cmd_ipebps_async) +
+		sizeof(struct hfi_cmd_abort) -
+		sizeof(((struct hfi_cmd_ipebps_async *)0)->payload.direct);
+	abort_cmd = kzalloc(packet_size, GFP_KERNEL);
+	CAM_DBG(CAM_ICP, "abort pkt size = %d", (int) packet_size);
+	if (!abort_cmd) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	abort_cmd->size = packet_size;
+	abort_cmd->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
+		abort_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_BPS_ABORT;
+	else
+		abort_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_IPE_ABORT;
+
+	abort_cmd->num_fw_handles = 1;
+	abort_cmd->fw_handles_flex[0] = ctx_data->fw_handle;
+	abort_cmd->user_data1 = PTR_TO_U64(ctx_data);
+	abort_cmd->user_data2 = (uint64_t)0x0;
+
+	rc = hfi_write_cmd(abort_cmd);
+	if (rc) {
+		kfree(abort_cmd);
+		return rc;
+	}
+	CAM_DBG(CAM_ICP, "fw_handle = %x ctx_data = %pK ctx_id %d",
+		ctx_data->fw_handle, ctx_data, ctx_data->ctx_id);
+
+	kfree(abort_cmd);
+	return rc;
+}
+
+static int cam_icp_mgr_abort_handle(
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+	unsigned long rem_jiffies = 0;
+	size_t packet_size;
+	int timeout = 1000;
+	struct hfi_cmd_ipebps_async *abort_cmd;
+
+	packet_size =
+		sizeof(struct hfi_cmd_ipebps_async) +
+		sizeof(struct hfi_cmd_abort) -
+		sizeof(((struct hfi_cmd_ipebps_async *)0)->payload.direct);
+	abort_cmd = kzalloc(packet_size, GFP_KERNEL);
+	CAM_DBG(CAM_ICP, "abort pkt size = %d", (int) packet_size);
+	if (!abort_cmd) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	abort_cmd->size = packet_size;
+	abort_cmd->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
+		abort_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_BPS_ABORT;
+	else
+		abort_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_IPE_ABORT;
+
+	reinit_completion(&ctx_data->wait_complete);
+	abort_cmd->num_fw_handles = 1;
+	abort_cmd->fw_handles[0] = ctx_data->fw_handle;
+	abort_cmd->user_data1 = PTR_TO_U64(ctx_data);
+	abort_cmd->user_data2 = (uint64_t)0x0;
+
+	rc = hfi_write_cmd(abort_cmd);
+	if (rc) {
+		kfree(abort_cmd);
+		return rc;
+	}
+	CAM_DBG(CAM_ICP, "fw_handle = %x ctx_data = %pK",
+		ctx_data->fw_handle, ctx_data);
+	rem_jiffies = wait_for_completion_timeout(&ctx_data->wait_complete,
+			msecs_to_jiffies((timeout)));
+	if (!rem_jiffies) {
+		rc = cam_icp_retry_wait_for_abort(ctx_data);
+		if (rc) {
+			CAM_ERR(CAM_ICP,
+				"FW timeout/err in abort handle command ctx: %u",
+				ctx_data->ctx_id);
+			cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+			cam_hfi_queue_dump();
+		}
+	}
+
+	kfree(abort_cmd);
+	return rc;
+}
+
+static int cam_icp_mgr_destroy_handle(
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+	int timeout = 1000;
+	unsigned long rem_jiffies;
+	size_t packet_size;
+	struct hfi_cmd_ipebps_async *destroy_cmd;
+
+	packet_size =
+		sizeof(struct hfi_cmd_ipebps_async) +
+		sizeof(struct hfi_cmd_abort_destroy) -
+		sizeof(((struct hfi_cmd_ipebps_async *)0)->payload.direct);
+	destroy_cmd = kzalloc(packet_size, GFP_KERNEL);
+	if (!destroy_cmd) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	destroy_cmd->size = packet_size;
+	destroy_cmd->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
+		destroy_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_BPS_DESTROY;
+	else
+		destroy_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_IPE_DESTROY;
+
+	reinit_completion(&ctx_data->wait_complete);
+	destroy_cmd->num_fw_handles = 1;
+	destroy_cmd->fw_handles_flex[0] = ctx_data->fw_handle;
+	destroy_cmd->user_data1 = PTR_TO_U64(ctx_data);
+	destroy_cmd->user_data2 = (uint64_t)0x0;
+
+	rc = hfi_write_cmd(destroy_cmd);
+	if (rc) {
+		kfree(destroy_cmd);
+		return rc;
+	}
+	CAM_DBG(CAM_ICP, "fw_handle = %x ctx_data = %pK",
+		ctx_data->fw_handle, ctx_data);
+	rem_jiffies = wait_for_completion_timeout(&ctx_data->wait_complete,
+			msecs_to_jiffies((timeout)));
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_ICP, "FW response timeout: %d for %u",
+			rc, ctx_data->ctx_id);
+		cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+		cam_hfi_queue_dump();
+	}
+	kfree(destroy_cmd);
+	return rc;
+}
+
+static int cam_icp_mgr_release_ctx(struct cam_icp_hw_mgr *hw_mgr, int ctx_id)
+{
+	int i = 0;
+
+	if (ctx_id >= CAM_ICP_CTX_MAX) {
+		CAM_ERR(CAM_ICP, "ctx_id is wrong: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+	cam_icp_remove_ctx_bw(hw_mgr, &hw_mgr->ctx_data[ctx_id]);
+	if (hw_mgr->ctx_data[ctx_id].state !=
+		CAM_ICP_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+		CAM_DBG(CAM_ICP,
+			"ctx with id: %d not in right state to release: %d",
+			ctx_id, hw_mgr->ctx_data[ctx_id].state);
+		return 0;
+	}
+	cam_icp_mgr_ipe_bps_power_collapse(hw_mgr,
+		&hw_mgr->ctx_data[ctx_id], 0);
+	hw_mgr->ctx_data[ctx_id].state = CAM_ICP_CTX_STATE_RELEASE;
+	CAM_DBG(CAM_ICP, "E: ctx_id = %d recovery = %d",
+		ctx_id, atomic_read(&hw_mgr->recovery));
+	cam_icp_mgr_abort_handle(&hw_mgr->ctx_data[ctx_id]);
+	cam_icp_mgr_destroy_handle(&hw_mgr->ctx_data[ctx_id]);
+	cam_icp_mgr_cleanup_ctx(&hw_mgr->ctx_data[ctx_id]);
+
+	hw_mgr->ctx_data[ctx_id].fw_handle = 0;
+	hw_mgr->ctx_data[ctx_id].scratch_mem_size = 0;
+	hw_mgr->ctx_data[ctx_id].last_flush_req = 0;
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++)
+		clear_bit(i, hw_mgr->ctx_data[ctx_id].hfi_frame_process.bitmap);
+	kfree(hw_mgr->ctx_data[ctx_id].hfi_frame_process.bitmap);
+	hw_mgr->ctx_data[ctx_id].hfi_frame_process.bitmap = NULL;
+	cam_icp_hw_mgr_clk_info_update(hw_mgr, &hw_mgr->ctx_data[ctx_id]);
+	hw_mgr->ctx_data[ctx_id].clk_info.curr_fc = 0;
+	hw_mgr->ctx_data[ctx_id].clk_info.base_clk = 0;
+	hw_mgr->ctxt_cnt--;
+	kfree(hw_mgr->ctx_data[ctx_id].icp_dev_acquire_info);
+	hw_mgr->ctx_data[ctx_id].icp_dev_acquire_info = NULL;
+	hw_mgr->ctx_data[ctx_id].state = CAM_ICP_CTX_STATE_FREE;
+	cam_icp_ctx_timer_stop(&hw_mgr->ctx_data[ctx_id]);
+	mutex_unlock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+
+	CAM_DBG(CAM_ICP, "X: ctx_id = %d", ctx_id);
+	return 0;
+}
+
+static void cam_icp_mgr_device_deinit(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = NULL;
+	struct cam_hw_intf *ipe0_dev_intf = NULL;
+	struct cam_hw_intf *ipe1_dev_intf = NULL;
+	struct cam_hw_intf *bps_dev_intf = NULL;
+
+	icp_dev_intf = hw_mgr->icp_dev_intf;
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+
+	if ((!icp_dev_intf) || (!ipe0_dev_intf) || (!bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong, failed to close");
+		return;
+	}
+
+	if (ipe1_dev_intf)
+		ipe1_dev_intf->hw_ops.deinit(ipe1_dev_intf->hw_priv, NULL, 0);
+	ipe0_dev_intf->hw_ops.deinit(ipe0_dev_intf->hw_priv, NULL, 0);
+	bps_dev_intf->hw_ops.deinit(bps_dev_intf->hw_priv, NULL, 0);
+	icp_dev_intf->hw_ops.deinit(icp_dev_intf->hw_priv, NULL, 0);
+	hw_mgr->bps_clk_state = false;
+	hw_mgr->ipe_clk_state = false;
+}
+
+static int cam_icp_mgr_hw_close(void *hw_priv, void *hw_close_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_intf *icp_dev_intf = NULL;
+	struct cam_icp_set_irq_cb irq_cb;
+	struct cam_icp_a5_set_fw_buf_info fw_buf_info;
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "E");
+	if (hw_mgr->fw_download == false) {
+		CAM_DBG(CAM_ICP, "hw mgr is already closed");
+		return 0;
+	}
+
+	icp_dev_intf = hw_mgr->icp_dev_intf;
+	if (!icp_dev_intf) {
+		CAM_DBG(CAM_ICP, "ICP device interface is NULL");
+		return -EINVAL;
+	}
+
+	fw_buf_info.kva = 0;
+	fw_buf_info.iova = 0;
+	fw_buf_info.len = 0;
+	rc = icp_dev_intf->hw_ops.process_cmd(
+		icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_SET_FW_BUF,
+		&fw_buf_info,
+		sizeof(fw_buf_info));
+	if (rc)
+		CAM_ERR(CAM_ICP, "nullify the fw buf failed");
+
+	cam_hfi_deinit();
+
+	irq_cb.icp_hw_mgr_cb = NULL;
+	irq_cb.data = NULL;
+	rc = icp_dev_intf->hw_ops.process_cmd(
+		icp_dev_intf->hw_priv,
+		CAM_ICP_SET_IRQ_CB,
+		&irq_cb, sizeof(irq_cb));
+	if (rc)
+		CAM_ERR(CAM_ICP, "deregister irq call back failed");
+
+	cam_icp_free_hfi_mem();
+	hw_mgr->fw_download = false;
+
+	CAM_DBG(CAM_ICP, "Exit");
+	return rc;
+}
+
+static int cam_icp_mgr_device_init(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	struct cam_hw_intf *icp_dev_intf = NULL;
+	struct cam_hw_intf *ipe0_dev_intf = NULL;
+	struct cam_hw_intf *ipe1_dev_intf = NULL;
+	struct cam_hw_intf *bps_dev_intf = NULL;
+
+	icp_dev_intf = hw_mgr->icp_dev_intf;
+	ipe0_dev_intf = hw_mgr->ipe0_dev_intf;
+	ipe1_dev_intf = hw_mgr->ipe1_dev_intf;
+	bps_dev_intf = hw_mgr->bps_dev_intf;
+
+	if ((!icp_dev_intf) || (!ipe0_dev_intf) || (!bps_dev_intf)) {
+		CAM_ERR(CAM_ICP, "dev intfs are wrong");
+		return -EINVAL;
+	}
+
+	rc = icp_dev_intf->hw_ops.init(icp_dev_intf->hw_priv, NULL, 0);
+	if (rc)
+		goto icp_dev_init_failed;
+
+	rc = bps_dev_intf->hw_ops.init(bps_dev_intf->hw_priv, NULL, 0);
+	if (rc)
+		goto bps_dev_init_failed;
+
+	rc = ipe0_dev_intf->hw_ops.init(ipe0_dev_intf->hw_priv, NULL, 0);
+	if (rc)
+		goto ipe0_dev_init_failed;
+
+	if (ipe1_dev_intf) {
+		rc = ipe1_dev_intf->hw_ops.init(ipe1_dev_intf->hw_priv,
+						NULL, 0);
+		if (rc)
+			goto ipe1_dev_init_failed;
+	}
+
+	hw_mgr->bps_clk_state = true;
+	hw_mgr->ipe_clk_state = true;
+
+	return rc;
+ipe1_dev_init_failed:
+	ipe0_dev_intf->hw_ops.deinit(ipe0_dev_intf->hw_priv, NULL, 0);
+	hw_mgr->ipe_clk_state = false;
+ipe0_dev_init_failed:
+	bps_dev_intf->hw_ops.deinit(bps_dev_intf->hw_priv, NULL, 0);
+	hw_mgr->bps_clk_state = false;
+bps_dev_init_failed:
+	icp_dev_intf->hw_ops.deinit(icp_dev_intf->hw_priv, NULL, 0);
+icp_dev_init_failed:
+	return rc;
+}
+
+static int cam_icp_mgr_fw_download(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	struct cam_hw_intf *icp_dev_intf = NULL;
+	struct cam_icp_set_irq_cb irq_cb;
+	struct cam_icp_a5_set_fw_buf_info fw_buf_info;
+
+	icp_dev_intf = hw_mgr->icp_dev_intf;
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is invalid");
+		return -EINVAL;
+	}
+
+	irq_cb.icp_hw_mgr_cb = cam_icp_hw_mgr_cb;
+	irq_cb.data = hw_mgr;
+	rc = icp_dev_intf->hw_ops.process_cmd(
+		icp_dev_intf->hw_priv,
+		CAM_ICP_SET_IRQ_CB,
+		&irq_cb, sizeof(irq_cb));
+	if (rc)
+		return rc;
+
+	fw_buf_info.kva = icp_hw_mgr.hfi_mem.fw_buf.kva;
+	fw_buf_info.iova = icp_hw_mgr.hfi_mem.fw_buf.iova;
+	fw_buf_info.len = icp_hw_mgr.hfi_mem.fw_buf.len;
+
+	rc = icp_dev_intf->hw_ops.process_cmd(
+		icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_SET_FW_BUF,
+		&fw_buf_info, sizeof(fw_buf_info));
+	if (rc)
+		return rc;
+
+	rc = icp_dev_intf->hw_ops.process_cmd(
+		icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_FW_DOWNLOAD,
+		NULL, 0);
+	if (rc)
+		return rc;
+
+	return cam_icp_mgr_proc_resume(hw_mgr);
+}
+
+static int cam_icp_mgr_hfi_init(struct cam_icp_hw_mgr *hw_mgr)
+{
+	struct cam_hw_intf *icp_dev_intf = NULL;
+	struct cam_hw_info *icp_dev = NULL;
+	struct hfi_mem_info hfi_mem;
+	const struct hfi_ops *hfi_ops;
+
+	icp_dev_intf = hw_mgr->icp_dev_intf;
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is invalid");
+		return -EINVAL;
+	}
+	icp_dev = (struct cam_hw_info *)icp_dev_intf->hw_priv;
+
+	hfi_mem.qtbl.kva = icp_hw_mgr.hfi_mem.qtbl.kva;
+	hfi_mem.qtbl.iova = icp_hw_mgr.hfi_mem.qtbl.iova;
+	hfi_mem.qtbl.len = icp_hw_mgr.hfi_mem.qtbl.len;
+
+	hfi_mem.cmd_q.kva = icp_hw_mgr.hfi_mem.cmd_q.kva;
+	hfi_mem.cmd_q.iova = icp_hw_mgr.hfi_mem.cmd_q.iova;
+	hfi_mem.cmd_q.len = icp_hw_mgr.hfi_mem.cmd_q.len;
+
+	hfi_mem.msg_q.kva = icp_hw_mgr.hfi_mem.msg_q.kva;
+	hfi_mem.msg_q.iova = icp_hw_mgr.hfi_mem.msg_q.iova;
+	hfi_mem.msg_q.len = icp_hw_mgr.hfi_mem.msg_q.len;
+
+	hfi_mem.dbg_q.kva = icp_hw_mgr.hfi_mem.dbg_q.kva;
+	hfi_mem.dbg_q.iova = icp_hw_mgr.hfi_mem.dbg_q.iova;
+	hfi_mem.dbg_q.len = icp_hw_mgr.hfi_mem.dbg_q.len;
+
+	hfi_mem.sfr_buf.kva = icp_hw_mgr.hfi_mem.sfr_buf.kva;
+	hfi_mem.sfr_buf.iova = icp_hw_mgr.hfi_mem.sfr_buf.iova;
+	hfi_mem.sfr_buf.len = icp_hw_mgr.hfi_mem.sfr_buf.len;
+
+	hfi_mem.sec_heap.kva = icp_hw_mgr.hfi_mem.sec_heap.kva;
+	hfi_mem.sec_heap.iova = icp_hw_mgr.hfi_mem.sec_heap.iova;
+	hfi_mem.sec_heap.len = icp_hw_mgr.hfi_mem.sec_heap.len;
+
+	hfi_mem.shmem.iova = icp_hw_mgr.hfi_mem.shmem.iova_start;
+	hfi_mem.shmem.len = icp_hw_mgr.hfi_mem.shmem.iova_len;
+
+	hfi_mem.qdss.iova = icp_hw_mgr.hfi_mem.qdss_buf.iova;
+	hfi_mem.qdss.len = icp_hw_mgr.hfi_mem.qdss_buf.len;
+
+	if (icp_hw_mgr.hfi_mem.io_mem.discard_iova_start &&
+		icp_hw_mgr.hfi_mem.io_mem.discard_iova_len) {
+		/* IO Region 1 */
+		hfi_mem.io_mem.iova = icp_hw_mgr.hfi_mem.io_mem.iova_start;
+		hfi_mem.io_mem.len =
+			icp_hw_mgr.hfi_mem.io_mem.discard_iova_start -
+			icp_hw_mgr.hfi_mem.io_mem.iova_start;
+
+		/* IO Region 2 */
+		hfi_mem.io_mem2.iova =
+			icp_hw_mgr.hfi_mem.io_mem.discard_iova_start +
+			icp_hw_mgr.hfi_mem.io_mem.discard_iova_len;
+		hfi_mem.io_mem2.len =
+			icp_hw_mgr.hfi_mem.io_mem.iova_start +
+			icp_hw_mgr.hfi_mem.io_mem.iova_len   -
+			hfi_mem.io_mem2.iova;
+	} else {
+		/* IO Region 1 */
+		hfi_mem.io_mem.iova = icp_hw_mgr.hfi_mem.io_mem.iova_start;
+		hfi_mem.io_mem.len = icp_hw_mgr.hfi_mem.io_mem.iova_len;
+
+		/* IO Region 2 */
+		hfi_mem.io_mem2.iova = 0x0;
+		hfi_mem.io_mem2.len = 0x0;
+	}
+
+	hfi_ops = &hfi_a5_ops;
+
+	return cam_hfi_init(&hfi_mem, hfi_ops, icp_dev, 0);
+}
+
+static int cam_icp_mgr_send_fw_init(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc;
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is NULL");
+		return -EINVAL;
+	}
+
+	reinit_completion(&hw_mgr->icp_complete);
+	CAM_DBG(CAM_ICP, "Sending HFI init command");
+	rc = icp_dev_intf->hw_ops.process_cmd(icp_dev_intf->hw_priv,
+					CAM_ICP_SEND_INIT, NULL, 0);
+	if (rc)
+		return rc;
+
+	rem_jiffies = wait_for_completion_timeout(&icp_hw_mgr.icp_complete,
+		msecs_to_jiffies((timeout)));
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_ICP, "FW response timed out %d", rc);
+		cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+		cam_hfi_queue_dump();
+	}
+	CAM_DBG(CAM_ICP, "Done Waiting for INIT DONE Message");
+
+	return rc;
+}
+
+static int cam_icp_mgr_hw_open_u(void *hw_mgr_priv, void *download_fw_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	int rc = 0;
+
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Null hw mgr");
+		return 0;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	rc = cam_icp_mgr_hw_open(hw_mgr, download_fw_args);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_icp_mgr_hw_open_k(void *hw_mgr_priv, void *download_fw_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "Null hw mgr");
+		return 0;
+	}
+
+	return cam_icp_mgr_hw_open(hw_mgr, download_fw_args);
+}
+
+static int cam_icp_mgr_icp_resume(struct cam_icp_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	struct cam_hw_intf *icp_dev_intf = hw_mgr->icp_dev_intf;
+	bool downloadFromResume = true;
+
+	CAM_DBG(CAM_ICP, "Enter");
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is NULL");
+		return -EINVAL;
+	}
+
+	if (hw_mgr->fw_download  == false) {
+		CAM_DBG(CAM_ICP, "Downloading FW");
+		rc = cam_icp_mgr_hw_open_k(hw_mgr, &downloadFromResume);
+		CAM_DBG(CAM_ICP, "FW Download Done Exit");
+		return rc;
+	}
+
+	rc = icp_dev_intf->hw_ops.init(icp_dev_intf->hw_priv, NULL, 0);
+	if (rc)
+		return -EINVAL;
+
+	rc = cam_icp_mgr_proc_resume(hw_mgr);
+	if (rc)
+		goto hw_deinit;
+
+	rc = cam_icp_mgr_hfi_resume(hw_mgr);
+	if (rc)
+		goto power_collapse;
+
+	CAM_DBG(CAM_ICP, "Exit");
+	return rc;
+
+power_collapse:
+	__power_collapse(hw_mgr);
+hw_deinit:
+	icp_dev_intf->hw_ops.deinit(icp_dev_intf->hw_priv, NULL, 0);
+
+	return rc;
+}
+
+static int cam_icp_mgr_hw_open(void *hw_mgr_priv, void *download_fw_args)
+{
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	bool icp_pc = false;
+	int rc = 0;
+
+	if (!hw_mgr) {
+		CAM_ERR(CAM_ICP, "hw_mgr is NULL");
+		return -EINVAL;
+	}
+
+	if (hw_mgr->fw_download) {
+		CAM_DBG(CAM_ICP, "FW already downloaded");
+		return rc;
+	}
+
+	if (!hw_mgr->icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is invalid");
+		return -EINVAL;
+	}
+
+	rc = cam_icp_allocate_hfi_mem();
+	if (rc)
+		goto alloc_hfi_mem_failed;
+
+	rc = cam_icp_mgr_device_init(hw_mgr);
+	if (rc)
+		goto dev_init_fail;
+
+	rc = cam_icp_mgr_fw_download(hw_mgr);
+	if (rc)
+		goto fw_download_failed;
+
+	rc = cam_icp_mgr_hfi_init(hw_mgr);
+	if (rc)
+		goto hfi_init_failed;
+
+	rc = cam_icp_mgr_send_fw_init(hw_mgr);
+	if (rc)
+		goto fw_init_failed;
+
+	hw_mgr->ctxt_cnt = 0;
+	hw_mgr->fw_download = true;
+	atomic_set(&hw_mgr->recovery, 0);
+
+	CAM_INFO(CAM_ICP, "FW download done successfully");
+
+	rc = cam_ipe_bps_deint(hw_mgr);
+	if (download_fw_args)
+		icp_pc = *((bool *)download_fw_args);
+
+	if (download_fw_args && icp_pc == true && hw_mgr->icp_pc_flag) {
+		rc = cam_ipe_bps_deint(hw_mgr);
+		CAM_DBG(CAM_ICP, "deinit all clocks");
+	}
+
+	if (download_fw_args && icp_pc == true)
+		return rc;
+
+	rc = cam_ipe_bps_deint(hw_mgr);
+	rc = cam_icp_mgr_icp_power_collapse(hw_mgr);
+	CAM_DBG(CAM_ICP, "deinit all clocks at boot up");
+
+	return rc;
+
+fw_init_failed:
+	cam_hfi_deinit();
+hfi_init_failed:
+	cam_icp_mgr_proc_suspend(hw_mgr);
+fw_download_failed:
+	cam_icp_mgr_device_deinit(hw_mgr);
+dev_init_fail:
+	cam_icp_free_hfi_mem();
+alloc_hfi_mem_failed:
+	return rc;
+}
+
+static int cam_icp_mgr_handle_config_err(
+	struct cam_hw_config_args *config_args,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	int idx)
+{
+	struct cam_hw_done_event_data buf_data;
+
+	buf_data.request_id = *(uint64_t *)config_args->priv;
+	buf_data.evt_param = CAM_SYNC_ICP_EVENT_CONFIG_ERR;
+	ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_CTX_EVT_ID_SUCCESS,
+		&buf_data);
+
+	ctx_data->hfi_frame_process.request_id[idx] = 0;
+	ctx_data->hfi_frame_process.fw_process_flag[idx] = false;
+	clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+
+	return 0;
+}
+
+static int cam_icp_mgr_enqueue_config(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_hw_config_args *config_args)
+{
+	int rc = 0;
+	uint64_t request_id = 0;
+	struct crm_workq_task *task;
+	struct hfi_cmd_work_data *task_data;
+	struct hfi_cmd_ipebps_async *hfi_cmd;
+	struct cam_hw_update_entry *hw_update_entries;
+	struct icp_frame_info *frame_info = NULL;
+
+	frame_info = (struct icp_frame_info *)config_args->priv;
+	request_id = frame_info->request_id;
+	hw_update_entries = config_args->hw_update_entries;
+	CAM_DBG(CAM_ICP, "req_id = %lld %pK", request_id, config_args->priv);
+
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "no empty task");
+		return -ENOMEM;
+	}
+
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)hw_update_entries->addr;
+	hfi_cmd = (struct hfi_cmd_ipebps_async *)hw_update_entries->addr;
+	task_data->request_id = request_id;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_icp_mgr_send_config_io(struct cam_icp_hw_ctx_data *ctx_data,
+	uint32_t io_buf_addr)
+{
+	int rc = 0;
+	struct hfi_cmd_work_data *task_data;
+	struct hfi_cmd_ipebps_async ioconfig_cmd;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+	struct crm_workq_task *task;
+	uint32_t size_in_words;
+
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.cmd_work);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"No free task ctx id:%d dev hdl:0x%x session hdl:0x%x dev_type:%d",
+			ctx_data->ctx_id, ctx_data->acquire_dev_cmd.dev_handle,
+			ctx_data->acquire_dev_cmd.session_handle,
+			ctx_data->icp_dev_acquire_info->dev_type);
+		return -ENOMEM;
+	}
+
+	ioconfig_cmd.size = sizeof(struct hfi_cmd_ipebps_async);
+	ioconfig_cmd.pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT;
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
+		ioconfig_cmd.opcode = HFI_IPEBPS_CMD_OPCODE_BPS_CONFIG_IO;
+	else
+		ioconfig_cmd.opcode = HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO;
+
+	reinit_completion(&ctx_data->wait_complete);
+
+	ioconfig_cmd.num_fw_handles = 1;
+	ioconfig_cmd.fw_handles_flex[0] = ctx_data->fw_handle;
+	ioconfig_cmd.payload.indirect = io_buf_addr;
+	ioconfig_cmd.user_data1 = PTR_TO_U64(ctx_data);
+	ioconfig_cmd.user_data2 = (uint64_t)0x0;
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)&ioconfig_cmd;
+	task_data->request_id = 0;
+	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+	size_in_words = (*(uint32_t *)task_data->data) >> 2;
+	CAM_DBG(CAM_ICP, "size_in_words %u", size_in_words);
+	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"Enqueue task failed ctx id:%d dev hdl:0x%x session hdl:0x%x dev_type:%d",
+			ctx_data->ctx_id, ctx_data->acquire_dev_cmd.dev_handle,
+			ctx_data->acquire_dev_cmd.session_handle,
+			ctx_data->icp_dev_acquire_info->dev_type);
+		return rc;
+	}
+
+	rem_jiffies = wait_for_completion_timeout(&ctx_data->wait_complete,
+		msecs_to_jiffies((timeout)));
+	if (!rem_jiffies) {
+		/* send specific error for io config failure */
+		rc = -EREMOTEIO;
+		CAM_ERR(CAM_ICP,
+			"FW response timed out %d ctx id:%d dev hdl:0x%x session hdl:0x%x dev_type:%d",
+			rc,
+			ctx_data->ctx_id, ctx_data->acquire_dev_cmd.dev_handle,
+			ctx_data->acquire_dev_cmd.session_handle,
+			ctx_data->icp_dev_acquire_info->dev_type);
+		cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+		cam_hfi_queue_dump();
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_send_recfg_io(struct cam_icp_hw_ctx_data *ctx_data,
+	struct hfi_cmd_ipebps_async *ioconfig_cmd, uint64_t req_id)
+{
+	int rc = 0;
+	struct hfi_cmd_work_data *task_data;
+	struct crm_workq_task *task;
+
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.cmd_work);
+	if (!task)
+		return -ENOMEM;
+
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)ioconfig_cmd;
+	task_data->request_id = req_id;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int cam_icp_mgr_config_hw(void *hw_mgr_priv, void *config_hw_args)
+{
+	int rc = 0;
+	int idx;
+	uint64_t req_id;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_config_args *config_args = config_hw_args;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct icp_frame_info *frame_info = NULL;
+
+	if (!hw_mgr || !config_args) {
+		CAM_ERR(CAM_ICP, "Invalid arguments %pK %pK",
+			hw_mgr, config_args);
+		return -EINVAL;
+	}
+
+	if (!config_args->num_hw_update_entries) {
+		CAM_ERR(CAM_ICP, "No hw update enteries are available");
+		return -EINVAL;
+	}
+
+	ctx_data = config_args->ctxt_to_hw_map;
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->state != CAM_ICP_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_ICP, "ctx id :%u is not in use",
+			ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	frame_info = (struct icp_frame_info *)config_args->priv;
+	req_id = frame_info->request_id;
+	idx = cam_icp_clk_idx_from_req_id(ctx_data, req_id);
+
+	cam_icp_mgr_ipe_bps_clk_update(hw_mgr, ctx_data, idx);
+	ctx_data->hfi_frame_process.fw_process_flag[idx] = true;
+	ctx_data->hfi_frame_process.submit_timestamp[idx] = ktime_get();
+
+	CAM_DBG(CAM_ICP, "req_id %llu, io config %llu", req_id,
+		frame_info->io_config);
+
+	if (frame_info->io_config != 0) {
+		CAM_INFO(CAM_ICP, "Send recfg io");
+		rc = cam_icp_mgr_send_recfg_io(ctx_data,
+			&frame_info->hfi_cfg_io_cmd, req_id);
+		if (rc)
+			CAM_ERR(CAM_ICP, "Fail to send reconfig io cmd");
+	}
+
+	if (req_id <= ctx_data->last_flush_req)
+		CAM_WARN(CAM_ICP,
+			"Anomaly submitting flushed req %llu [last_flush %llu] in ctx %u",
+			req_id, ctx_data->last_flush_req, ctx_data->ctx_id);
+
+	rc = cam_icp_mgr_enqueue_config(hw_mgr, config_args);
+	if (rc)
+		goto config_err;
+	CAM_DBG(CAM_REQ,
+		"req_id = %lld on ctx_id %u for dev %d queued to FW",
+		req_id, ctx_data->ctx_id,
+		ctx_data->icp_dev_acquire_info->dev_type);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return 0;
+config_err:
+	cam_icp_mgr_handle_config_err(config_args, ctx_data, idx);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_prepare_frame_process_cmd(
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct hfi_cmd_ipebps_async *hfi_cmd,
+	uint64_t request_id,
+	uint32_t fw_cmd_buf_iova_addr)
+{
+	hfi_cmd->size = sizeof(struct hfi_cmd_ipebps_async);
+	hfi_cmd->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT;
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
+		hfi_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_BPS_FRAME_PROCESS;
+	else
+		hfi_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_IPE_FRAME_PROCESS;
+	hfi_cmd->num_fw_handles = 1;
+	hfi_cmd->fw_handles_flex[0] = ctx_data->fw_handle;
+	hfi_cmd->payload.indirect = fw_cmd_buf_iova_addr;
+	hfi_cmd->user_data1 = PTR_TO_U64(ctx_data);
+	hfi_cmd->user_data2 = request_id;
+
+	CAM_DBG(CAM_ICP, "ctx_data : %pK, request_id :%lld cmd_buf %x",
+		(void *)ctx_data->context_priv, request_id,
+		fw_cmd_buf_iova_addr);
+
+	return 0;
+}
+
+static bool cam_icp_mgr_is_valid_inconfig(struct cam_packet *packet)
+{
+	int i, num_in_map_entries = 0;
+	bool in_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+					packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT)
+			num_in_map_entries++;
+
+	if (num_in_map_entries <= CAM_MAX_IN_RES) {
+		in_config_valid = true;
+	} else {
+		CAM_ERR(CAM_ICP, "In config entries(%u) more than allowed(%u)",
+				num_in_map_entries, CAM_MAX_IN_RES);
+	}
+
+	CAM_DBG(CAM_ICP, "number of in_config info: %u %u %u %u",
+			packet->num_io_configs, IPE_IO_IMAGES_MAX,
+			num_in_map_entries, CAM_MAX_IN_RES);
+
+	return in_config_valid;
+}
+
+static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet)
+{
+	int i, num_out_map_entries = 0;
+	bool out_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+					packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+	    if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||
+		(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT))
+			num_out_map_entries++;
+
+	if (num_out_map_entries <= CAM_MAX_OUT_RES) {
+		out_config_valid = true;
+	} else {
+		CAM_ERR(CAM_ICP, "Out config entries(%u) more than allowed(%u)",
+				num_out_map_entries, CAM_MAX_OUT_RES);
+	}
+
+	CAM_DBG(CAM_ICP, "number of out_config info: %u %u %u %u",
+			packet->num_io_configs, IPE_IO_IMAGES_MAX,
+			num_out_map_entries, CAM_MAX_OUT_RES);
+
+	return out_config_valid;
+}
+
+static int cam_icp_mgr_pkt_validation(struct cam_packet *packet)
+{
+	if (((packet->header.op_code & 0xff) !=
+		CAM_ICP_OPCODE_IPE_UPDATE) &&
+		((packet->header.op_code & 0xff) !=
+		CAM_ICP_OPCODE_BPS_UPDATE)) {
+		CAM_ERR(CAM_ICP, "Invalid Opcode in pkt: %d",
+			packet->header.op_code & 0xff);
+		return -EINVAL;
+	}
+
+	if (!packet->num_io_configs || packet->num_io_configs > IPE_IO_IMAGES_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid number of io configs: %d %d",
+			IPE_IO_IMAGES_MAX, packet->num_io_configs);
+		return -EINVAL;
+	}
+
+	if (!packet->num_cmd_buf || packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) {
+		CAM_ERR(CAM_ICP, "Invalid number of cmd buffers: %d %d",
+			CAM_ICP_CTX_MAX_CMD_BUFFERS, packet->num_cmd_buf);
+		return -EINVAL;
+	}
+
+	if (!cam_icp_mgr_is_valid_inconfig(packet) ||
+		!cam_icp_mgr_is_valid_outconfig(packet)) {
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "number of cmd/patch info: %u %u %u %u",
+			packet->num_cmd_buf,
+			packet->num_io_configs, IPE_IO_IMAGES_MAX,
+			packet->num_patches);
+	return 0;
+}
+
+static int cam_icp_mgr_process_cmd_desc(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_packet *packet, struct cam_icp_hw_ctx_data *ctx_data,
+	uint32_t *fw_cmd_buf_iova_addr)
+{
+	int rc = 0;
+	int i;
+	int num_cmd_buf = 0;
+	dma_addr_t addr;
+	size_t len;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	uintptr_t cpu_addr = 0;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+	rc = cam_packet_util_validate_cmd_desc(cmd_desc);
+	if (rc)
+		return rc;
+
+	*fw_cmd_buf_iova_addr = 0;
+	for (i = 0; i < packet->num_cmd_buf; i++, num_cmd_buf++) {
+		if (cmd_desc[i].type == CAM_CMD_BUF_FW) {
+			rc = cam_mem_get_io_buf(cmd_desc[i].mem_handle,
+				hw_mgr->iommu_hdl, &addr, &len);
+			if (rc) {
+				CAM_ERR(CAM_ICP, "get cmd buf failed %x",
+					hw_mgr->iommu_hdl);
+
+				if (num_cmd_buf > 0)
+					num_cmd_buf--;
+				return rc;
+			}
+			*fw_cmd_buf_iova_addr = addr;
+
+			if ((cmd_desc[i].offset >= len) ||
+				((len - cmd_desc[i].offset) <
+				cmd_desc[i].size)){
+				CAM_ERR(CAM_ICP,
+					"Invalid offset, i: %d offset: %u len: %zu size: %zu",
+					i, cmd_desc[i].offset,
+					len, cmd_desc[i].size);
+				return -EINVAL;
+			}
+
+			*fw_cmd_buf_iova_addr =
+				(*fw_cmd_buf_iova_addr + cmd_desc[i].offset);
+
+			rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+				&cpu_addr, &len);
+			if (rc || !cpu_addr) {
+				CAM_ERR(CAM_ICP, "get cmd buf failed %x",
+					hw_mgr->iommu_hdl);
+				*fw_cmd_buf_iova_addr = 0;
+
+				if (num_cmd_buf > 0)
+					num_cmd_buf--;
+				return rc;
+			}
+			if ((len <= cmd_desc[i].offset) ||
+				(cmd_desc[i].size < cmd_desc[i].length) ||
+				((len - cmd_desc[i].offset) <
+				cmd_desc[i].length)) {
+				CAM_ERR(CAM_ICP, "Invalid offset or length");
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				return -EINVAL;
+			}
+			cpu_addr = cpu_addr + cmd_desc[i].offset;
+
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+		}
+	}
+
+	if (!cpu_addr) {
+		CAM_ERR(CAM_ICP, "invalid number of cmd buf");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prepare_args,
+	int32_t index)
+{
+	int i, j, k, rc = 0;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+	int32_t sync_in_obj[CAM_MAX_IN_RES];
+	int32_t merged_sync_in_obj;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+				packet->io_configs_offset/4);
+	prepare_args->num_out_map_entries = 0;
+	prepare_args->num_in_map_entries = 0;
+
+	for (i = 0, j = 0, k = 0; i < packet->num_io_configs; i++) {
+		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) {
+			sync_in_obj[j++] = io_cfg_ptr[i].fence;
+			prepare_args->num_in_map_entries++;
+		} else if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||
+		    (io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) {
+			prepare_args->out_map_entries[k++].sync_id =
+				io_cfg_ptr[i].fence;
+			prepare_args->num_out_map_entries++;
+		} else {
+		    CAM_ERR(CAM_ICP, "dir: %d, max_out:%u, out %u",
+			io_cfg_ptr[i].direction,
+			prepare_args->max_out_map_entries,
+			prepare_args->num_out_map_entries);
+		return -EINVAL;
+		}
+		CAM_DBG(CAM_REQ,
+			"ctx_id: %u req_id: %llu dir[%d]: %u, fence: %u resource_type = %u memh %x",
+			ctx_data->ctx_id, packet->header.request_id, i,
+			io_cfg_ptr[i].direction, io_cfg_ptr[i].fence,
+			io_cfg_ptr[i].resource_type,
+			io_cfg_ptr[i].mem_handle[0]);
+	}
+
+	if (prepare_args->num_in_map_entries > 1)
+		prepare_args->num_in_map_entries =
+			cam_common_util_remove_duplicate_arr(
+			sync_in_obj, prepare_args->num_in_map_entries);
+
+	if (prepare_args->num_in_map_entries > 1) {
+		rc = cam_sync_merge(&sync_in_obj[0],
+			prepare_args->num_in_map_entries, &merged_sync_in_obj);
+		if (rc) {
+			prepare_args->num_out_map_entries = 0;
+			prepare_args->num_in_map_entries = 0;
+			return rc;
+		}
+
+		ctx_data->hfi_frame_process.in_resource[index] =
+			merged_sync_in_obj;
+		prepare_args->in_map_entries[0].sync_id = merged_sync_in_obj;
+		prepare_args->num_in_map_entries = 1;
+		CAM_DBG(CAM_REQ, "ctx_id: %u req_id: %llu Merged Sync obj: %d",
+			ctx_data->ctx_id, packet->header.request_id,
+			merged_sync_in_obj);
+	} else if (prepare_args->num_in_map_entries == 1) {
+		prepare_args->in_map_entries[0].sync_id = sync_in_obj[0];
+		prepare_args->num_in_map_entries = 1;
+		ctx_data->hfi_frame_process.in_resource[index] = 0;
+	} else {
+		CAM_ERR(CAM_ICP, "No input fences");
+		prepare_args->num_in_map_entries = 0;
+		ctx_data->hfi_frame_process.in_resource[index] = 0;
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_icp_process_stream_settings(
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_cmd_mem_regions *cmd_mem_regions,
+	bool map_unmap)
+{
+	int rc = 0, i = 0;
+	size_t packet_size, map_cmd_size, len;
+	dma_addr_t iova;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+	struct hfi_cmd_ipe_bps_map  *map_cmd;
+	struct hfi_cmd_ipebps_async *async_direct;
+
+	map_cmd_size =
+		sizeof(struct hfi_cmd_ipe_bps_map) +
+		((cmd_mem_regions->num_regions - 1) *
+		sizeof(struct mem_map_region_data));
+
+	map_cmd = kzalloc(map_cmd_size, GFP_KERNEL);
+	if (!map_cmd)
+		return -ENOMEM;
+
+	for (i = 0; i < cmd_mem_regions->num_regions; i++) {
+		rc = cam_mem_get_io_buf(
+			cmd_mem_regions->map_info_array_flex[i].mem_handle,
+			icp_hw_mgr.iommu_hdl, &iova, &len);
+		if (rc) {
+			CAM_ERR(CAM_ICP,
+				"Failed to get cmd region iova for handle %u",
+				cmd_mem_regions->map_info_array_flex[i].mem_handle);
+			kfree(map_cmd);
+			return -EINVAL;
+		}
+
+		map_cmd->mem_map_region_sets_flex[i].start_addr = (uint32_t)iova +
+			(cmd_mem_regions->map_info_array_flex[i].offset);
+		map_cmd->mem_map_region_sets_flex[i].len = (uint32_t) len;
+
+		CAM_DBG(CAM_ICP, "Region %u mem_handle %d iova %pK len %u",
+			(i+1), cmd_mem_regions->map_info_array_flex[i].mem_handle,
+			(uint32_t)iova, (uint32_t)len);
+	}
+
+	map_cmd->mem_map_request_num = cmd_mem_regions->num_regions;
+	map_cmd->user_data = 0;
+
+	packet_size =
+		sizeof(struct hfi_cmd_ipebps_async) +
+		(sizeof(struct hfi_cmd_ipe_bps_map) +
+		((cmd_mem_regions->num_regions - 1) *
+		sizeof(struct mem_map_region_data))) -
+		sizeof(((struct hfi_cmd_ipebps_async *)0)->payload.direct);
+
+	async_direct = kzalloc(packet_size, GFP_KERNEL);
+	if (!async_direct) {
+		kfree(map_cmd);
+		return -ENOMEM;
+	}
+
+	async_direct->size = packet_size;
+	async_direct->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
+	if (map_unmap)
+		async_direct->opcode = HFI_IPEBPS_CMD_OPCODE_MEM_MAP;
+	else
+		async_direct->opcode = HFI_IPEBPS_CMD_OPCODE_MEM_UNMAP;
+	async_direct->num_fw_handles = 1;
+	async_direct->fw_handles_flex[0] = ctx_data->fw_handle;
+	async_direct->user_data1 = (uint64_t)ctx_data;
+	async_direct->user_data2 = (uint64_t)0x0;
+	memcpy(async_direct->payload.direct_flex, map_cmd,
+		map_cmd_size);
+
+	reinit_completion(&ctx_data->wait_complete);
+	rc = hfi_write_cmd(async_direct);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "hfi write failed  rc %d", rc);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ICP, "Sent FW %s cmd",
+		map_unmap ? "Map" : "Unmap");
+
+	rem_jiffies = wait_for_completion_timeout(&ctx_data->wait_complete,
+		msecs_to_jiffies((timeout)));
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_ICP, "FW response timed out %d", rc);
+		cam_hfi_queue_dump();
+	}
+
+end:
+	kfree(map_cmd);
+	kfree(async_direct);
+	return rc;
+}
+
+static int cam_icp_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	struct cam_icp_clk_bw_request *soc_req;
+	struct cam_icp_clk_bw_request *clk_info;
+	struct cam_icp_clk_bw_request_v2 *soc_req_v2;
+	struct cam_icp_clk_bw_req_internal_v2 *clk_info_v2;
+	struct cam_cmd_mem_regions *cmd_mem_regions;
+	struct icp_cmd_generic_blob *blob;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	uint32_t index;
+	size_t io_buf_size, clk_update_size;
+	int rc = 0;
+	uintptr_t pResource;
+	uint32_t i = 0;
+
+	if (!blob_data || (blob_size == 0)) {
+		CAM_ERR(CAM_ICP, "Invalid blob info %pK %d", blob_data,
+			blob_size);
+		return -EINVAL;
+	}
+
+	blob = (struct icp_cmd_generic_blob *)user_data;
+	ctx_data = blob->ctx;
+	index = blob->frame_info_idx;
+
+	switch (blob_type) {
+	case CAM_ICP_CMD_GENERIC_BLOB_CLK:
+		CAM_WARN_RATE_LIMIT_CUSTOM(CAM_PERF, 300, 1,
+			"Using deprecated blob type GENERIC_BLOB_CLK");
+		if (blob_size != sizeof(struct cam_icp_clk_bw_request)) {
+			CAM_ERR(CAM_ICP, "Mismatch blob size %d expected %lu",
+				blob_size,
+				sizeof(struct cam_icp_clk_bw_request));
+			return -EINVAL;
+		}
+
+		if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_UNKNOWN) {
+			ctx_data->bw_config_version = CAM_ICP_BW_CONFIG_V1;
+		} else if (ctx_data->bw_config_version !=
+			CAM_ICP_BW_CONFIG_V1) {
+			CAM_ERR(CAM_ICP,
+				"Mismatch blob versions %d expected v1 %d, blob_type=%d",
+				ctx_data->bw_config_version,
+				CAM_ICP_BW_CONFIG_V1, blob_type);
+			return -EINVAL;
+		}
+
+		clk_info = &ctx_data->hfi_frame_process.clk_info[index];
+
+		soc_req = (struct cam_icp_clk_bw_request *)blob_data;
+		*clk_info = *soc_req;
+		CAM_DBG(CAM_PERF, "budget:%llu fc: %llu %d BW %lld %lld",
+			clk_info->budget_ns, clk_info->frame_cycles,
+			clk_info->rt_flag, clk_info->uncompressed_bw,
+			clk_info->compressed_bw);
+		break;
+
+	case CAM_ICP_CMD_GENERIC_BLOB_CLK_V2:
+		if (blob_size < sizeof(struct cam_icp_clk_bw_request_v2)) {
+			CAM_ERR(CAM_ICP, "Mismatch blob size %d expected %lu",
+				blob_size,
+				sizeof(struct cam_icp_clk_bw_request_v2));
+			return -EINVAL;
+		}
+
+		if (ctx_data->bw_config_version == CAM_ICP_BW_CONFIG_UNKNOWN) {
+			ctx_data->bw_config_version = CAM_ICP_BW_CONFIG_V2;
+		} else if (ctx_data->bw_config_version !=
+			CAM_ICP_BW_CONFIG_V2) {
+			CAM_ERR(CAM_ICP,
+				"Mismatch blob versions %d expected v2 %d, blob_type=%d",
+				ctx_data->bw_config_version,
+				CAM_ICP_BW_CONFIG_V2, blob_type);
+			return -EINVAL;
+		}
+
+		soc_req_v2 = (struct cam_icp_clk_bw_request_v2 *)blob_data;
+		if (soc_req_v2->num_paths > CAM_ICP_MAX_PER_PATH_VOTES) {
+			CAM_ERR(CAM_PERF, "Invalid num paths: %d",
+				soc_req_v2->num_paths);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (soc_req_v2->num_paths != 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote) >
+				((UINT_MAX -
+				sizeof(struct cam_icp_clk_bw_request_v2)) /
+				(soc_req_v2->num_paths - 1))) {
+				CAM_ERR(CAM_ICP,
+					"Size exceeds limit paths:%u size per path:%lu",
+					soc_req_v2->num_paths - 1,
+					sizeof(
+					struct cam_axi_per_path_bw_vote));
+				return -EINVAL;
+			}
+		}
+
+		clk_update_size = sizeof(struct cam_icp_clk_bw_request_v2) +
+			((soc_req_v2->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote));
+		if (blob_size < clk_update_size) {
+			CAM_ERR(CAM_ICP, "Invalid blob size: %u",
+				blob_size);
+			return -EINVAL;
+		}
+
+		clk_info = &ctx_data->hfi_frame_process.clk_info[index];
+		clk_info_v2 = &ctx_data->hfi_frame_process.clk_info_v2[index];
+
+		memcpy(clk_info_v2, soc_req_v2, clk_update_size);
+
+		/* Use v1 structure for clk fields */
+		clk_info->budget_ns = clk_info_v2->budget_ns;
+		clk_info->frame_cycles = clk_info_v2->frame_cycles;
+		clk_info->rt_flag = clk_info_v2->rt_flag;
+
+		CAM_DBG(CAM_PERF,
+			"budget=%llu, frame_cycle=%llu, rt_flag=%d, num_paths=%d, clk_update_size=%d, index=%d, ctx_data=%pK",
+			clk_info_v2->budget_ns, clk_info_v2->frame_cycles,
+			clk_info_v2->rt_flag,
+			clk_info_v2->num_paths,
+			clk_update_size,
+			index,
+			ctx_data);
+
+		for (i = 0; i < clk_info_v2->num_paths; i++) {
+			CAM_DBG(CAM_PERF,
+				"[%d] : path_type=%d, trans_type=%d, camnoc=%lld, mnoc_ab=%lld, mnoc_ib=%lld",
+				i,
+				clk_info_v2->axi_path_flex[i].path_data_type,
+				clk_info_v2->axi_path_flex[i].transac_type,
+				clk_info_v2->axi_path_flex[i].camnoc_bw,
+				clk_info_v2->axi_path_flex[i].mnoc_ab_bw,
+				clk_info_v2->axi_path_flex[i].mnoc_ib_bw);
+		}
+
+		break;
+
+	case CAM_ICP_CMD_GENERIC_BLOB_CFG_IO:
+		CAM_DBG(CAM_ICP, "CAM_ICP_CMD_GENERIC_BLOB_CFG_IO");
+		pResource = *((uint32_t *)blob_data);
+		if (copy_from_user(&ctx_data->icp_dev_io_info,
+			(void __user *)pResource,
+			sizeof(struct cam_icp_acquire_dev_info))) {
+			CAM_ERR(CAM_ICP, "Failed in copy from user");
+			return -EFAULT;
+		}
+		CAM_DBG(CAM_ICP, "buf handle %d",
+			ctx_data->icp_dev_io_info.io_config_cmd_handle);
+		rc = cam_mem_get_io_buf(
+			ctx_data->icp_dev_io_info.io_config_cmd_handle,
+			icp_hw_mgr.iommu_hdl,
+			blob->io_buf_addr, &io_buf_size);
+		if (rc)
+			CAM_ERR(CAM_ICP, "Failed in blob update");
+		else
+			CAM_DBG(CAM_ICP, "io buf addr %llu",
+				*blob->io_buf_addr);
+		break;
+
+	case CAM_ICP_CMD_GENERIC_BLOB_FW_MEM_MAP:
+		cmd_mem_regions =
+			(struct cam_cmd_mem_regions *)blob_data;
+		if (cmd_mem_regions->num_regions <= 0) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_ICP,
+				"Invalid number of regions for FW map %u",
+				cmd_mem_regions->num_regions);
+		} else {
+			CAM_DBG(CAM_ICP,
+				"Processing blob for mapping %u regions",
+				cmd_mem_regions->num_regions);
+			rc = cam_icp_process_stream_settings(ctx_data,
+				cmd_mem_regions, true);
+		}
+		break;
+
+	case CAM_ICP_CMD_GENERIC_BLOB_FW_MEM_UNMAP:
+		cmd_mem_regions =
+			(struct cam_cmd_mem_regions *)blob_data;
+		if (cmd_mem_regions->num_regions <= 0) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_ICP,
+				"Invalid number of regions for FW unmap %u",
+				cmd_mem_regions->num_regions);
+		} else {
+			CAM_DBG(CAM_ICP,
+				"Processing blob for unmapping %u regions",
+				cmd_mem_regions->num_regions);
+			rc = cam_icp_process_stream_settings(ctx_data,
+				cmd_mem_regions, false);
+		}
+		break;
+
+	default:
+		CAM_WARN(CAM_ICP, "Invalid blob type %d", blob_type);
+		break;
+	}
+	return rc;
+}
+
+static int cam_icp_process_generic_cmd_buffer(
+	struct cam_packet *packet,
+	struct cam_icp_hw_ctx_data *ctx_data,
+	int32_t index,
+	dma_addr_t *io_buf_addr)
+{
+	int i, rc = 0;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct icp_cmd_generic_blob cmd_generic_blob;
+
+	cmd_generic_blob.ctx = ctx_data;
+	cmd_generic_blob.frame_info_idx = index;
+	cmd_generic_blob.io_buf_addr = io_buf_addr;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data != CAM_ICP_CMD_META_GENERIC_BLOB)
+			continue;
+
+		rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+			cam_icp_packet_generic_blob_handler, &cmd_generic_blob);
+		if (rc)
+			CAM_ERR(CAM_ICP, "Failed in processing blobs %d", rc);
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_process_cfg_io_cmd(
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct hfi_cmd_ipebps_async *ioconfig_cmd,
+	uint64_t request_id,
+	uint64_t io_config)
+{
+	ioconfig_cmd->size = sizeof(struct hfi_cmd_ipebps_async);
+	ioconfig_cmd->pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_INDIRECT;
+	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
+		ioconfig_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_BPS_CONFIG_IO;
+	else
+		ioconfig_cmd->opcode = HFI_IPEBPS_CMD_OPCODE_IPE_CONFIG_IO;
+
+	ioconfig_cmd->num_fw_handles = 1;
+	ioconfig_cmd->fw_handles_flex[0] = ctx_data->fw_handle;
+	ioconfig_cmd->payload.indirect = io_config;
+	ioconfig_cmd->user_data1 = PTR_TO_U64(ctx_data);
+	ioconfig_cmd->user_data2 = request_id;
+
+	return 0;
+}
+
+static int cam_icp_mgr_update_hfi_frame_process(
+	struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prepare_args,
+	int32_t *idx)
+{
+	int32_t index, rc;
+	struct hfi_cmd_ipebps_async *hfi_cmd = NULL;
+
+	index = find_first_zero_bit(ctx_data->hfi_frame_process.bitmap,
+		ctx_data->hfi_frame_process.bits);
+	if (index < 0 || index >= CAM_FRAME_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "request idx is wrong: %d", index);
+		return -EINVAL;
+	}
+	set_bit(index, ctx_data->hfi_frame_process.bitmap);
+
+	ctx_data->hfi_frame_process.request_id[index] =
+		packet->header.request_id;
+	ctx_data->hfi_frame_process.frame_info[index].request_id =
+		packet->header.request_id;
+	ctx_data->hfi_frame_process.frame_info[index].io_config = 0;
+	rc = cam_icp_process_generic_cmd_buffer(packet, ctx_data, index,
+		&ctx_data->hfi_frame_process.frame_info[index].io_config);
+	if (rc) {
+		clear_bit(index, ctx_data->hfi_frame_process.bitmap);
+		ctx_data->hfi_frame_process.request_id[index] = -1;
+		return rc;
+	}
+
+	if (ctx_data->hfi_frame_process.frame_info[index].io_config)  {
+		hfi_cmd = (struct hfi_cmd_ipebps_async *)
+		&ctx_data->hfi_frame_process.frame_info[index].hfi_cfg_io_cmd;
+		rc = cam_icp_mgr_process_cfg_io_cmd(ctx_data, hfi_cmd,
+			packet->header.request_id,
+		ctx_data->hfi_frame_process.frame_info[index].io_config);
+	}
+	*idx = index;
+
+	return rc;
+}
+
+static void cam_icp_mgr_print_io_bufs(struct cam_packet *packet,
+	int32_t iommu_hdl, int32_t sec_mmu_hdl, uint32_t pf_buf_info,
+	bool *mem_found)
+{
+	dma_addr_t   iova_addr;
+	size_t     src_buf_size;
+	int        i;
+	int        j;
+	int        rc = 0;
+	int32_t    mmu_hdl;
+
+	struct cam_buf_io_cfg  *io_cfg = NULL;
+
+	if (mem_found)
+		*mem_found = false;
+
+	io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload +
+		packet->io_configs_offset / 4);
+
+	for (i = 0; i < packet->num_io_configs; i++) {
+		for (j = 0; j < CAM_PACKET_MAX_PLANES; j++) {
+			if (!io_cfg[i].mem_handle[j])
+				break;
+
+			if (GET_FD_FROM_HANDLE(io_cfg[i].mem_handle[j]) ==
+				GET_FD_FROM_HANDLE(pf_buf_info)) {
+				CAM_INFO(CAM_ICP,
+					"Found PF at port: %d mem %x fd: %x",
+					io_cfg[i].resource_type,
+					io_cfg[i].mem_handle[j],
+					pf_buf_info);
+				if (mem_found)
+					*mem_found = true;
+			}
+
+			CAM_INFO(CAM_ICP, "port: %d f: %u format: %d dir %d",
+				io_cfg[i].resource_type,
+				io_cfg[i].fence,
+				io_cfg[i].format,
+				io_cfg[i].direction);
+
+			mmu_hdl = cam_mem_is_secure_buf(
+				io_cfg[i].mem_handle[j]) ? sec_mmu_hdl :
+				iommu_hdl;
+			rc = cam_mem_get_io_buf(io_cfg[i].mem_handle[j],
+				mmu_hdl, &iova_addr, &src_buf_size);
+			if (rc < 0) {
+				CAM_ERR(CAM_UTIL,
+					"get src buf address fail rc %d", rc);
+				continue;
+			}
+			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {
+				CAM_ERR(CAM_ICP, "Invalid mapped address");
+				rc = -EINVAL;
+				continue;
+			}
+
+			CAM_INFO(CAM_ICP,
+				"pln %d dir %d w %d h %d s %u sh %u sz %d addr 0x%x off 0x%x memh %x",
+				j, io_cfg[i].direction,
+				io_cfg[i].planes[j].width,
+				io_cfg[i].planes[j].height,
+				io_cfg[i].planes[j].plane_stride,
+				io_cfg[i].planes[j].slice_height,
+				(int32_t)src_buf_size,
+				(unsigned int)iova_addr,
+				io_cfg[i].offsets[j],
+				io_cfg[i].mem_handle[j]);
+
+			iova_addr += io_cfg[i].offsets[j];
+
+		}
+	}
+	cam_packet_dump_patch_info(packet, icp_hw_mgr.iommu_hdl,
+		icp_hw_mgr.iommu_sec_hdl);
+}
+
+static int cam_icp_mgr_config_stream_settings(
+	void *hw_mgr_priv, void *hw_stream_settings)
+{
+	int        rc = 0;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct cam_packet *packet = NULL;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct icp_cmd_generic_blob cmd_generic_blob;
+	struct cam_hw_stream_setttings *config_args =
+		hw_stream_settings;
+
+	if ((!hw_stream_settings) ||
+		(!hw_mgr) || (!config_args->packet)) {
+		CAM_ERR(CAM_ICP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	ctx_data = config_args->ctxt_to_hw_map;
+	mutex_lock(&ctx_data->ctx_mutex);
+	packet = config_args->packet;
+
+	cmd_generic_blob.ctx = ctx_data;
+	cmd_generic_blob.frame_info_idx = -1;
+	cmd_generic_blob.io_buf_addr = NULL;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+
+	rc = cam_packet_util_validate_cmd_desc(cmd_desc);
+	if (rc)
+		return rc;
+
+	if (!cmd_desc[0].length ||
+		cmd_desc[0].meta_data != CAM_ICP_CMD_META_GENERIC_BLOB) {
+		CAM_ERR(CAM_ICP, "Invalid cmd buffer length/metadata");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[0],
+		cam_icp_packet_generic_blob_handler, &cmd_generic_blob);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed in processing cmd mem blob %d", rc);
+
+end:
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int        rc = 0;
+	int32_t    idx;
+	uint32_t   fw_cmd_buf_iova_addr;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct cam_packet *packet = NULL;
+	struct hfi_cmd_ipebps_async *hfi_cmd = NULL;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_prepare_update_args *prepare_args =
+		prepare_hw_update_args;
+
+	if ((!prepare_args) || (!hw_mgr) || (!prepare_args->packet)) {
+		CAM_ERR(CAM_ICP, "Invalid args");
+		return -EINVAL;
+	}
+
+	ctx_data = prepare_args->ctxt_to_hw_map;
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->state != CAM_ICP_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_ICP, "ctx id: %u is not in use",
+			ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	packet = prepare_args->packet;
+
+	if (cam_packet_util_validate_packet(packet, prepare_args->remain_len))
+		return -EINVAL;
+
+	rc = cam_icp_mgr_pkt_validation(packet);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	rc = cam_icp_mgr_process_cmd_desc(hw_mgr, packet,
+		ctx_data, &fw_cmd_buf_iova_addr);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	prepare_args->pf_data->packet = packet;
+
+	CAM_DBG(CAM_REQ, "req id = %lld for ctx = %u",
+		packet->header.request_id, ctx_data->ctx_id);
+	/* Update Buffer Address from handles and patch information */
+	rc = cam_packet_util_process_patches(packet, hw_mgr->iommu_hdl,
+		hw_mgr->iommu_sec_hdl);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	rc = cam_icp_mgr_update_hfi_frame_process(ctx_data, packet,
+		prepare_args, &idx);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	rc = cam_icp_mgr_process_io_cfg(hw_mgr, ctx_data,
+		packet, prepare_args, idx);
+	if (rc) {
+		if (ctx_data->hfi_frame_process.in_resource[idx] > 0)
+			cam_sync_destroy(
+				ctx_data->hfi_frame_process.in_resource[idx]);
+		clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+		ctx_data->hfi_frame_process.request_id[idx] = -1;
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return rc;
+	}
+
+	hfi_cmd = (struct hfi_cmd_ipebps_async *)
+			&ctx_data->hfi_frame_process.hfi_frame_cmd[idx];
+	cam_icp_mgr_prepare_frame_process_cmd(
+		ctx_data, hfi_cmd, packet->header.request_id,
+		fw_cmd_buf_iova_addr);
+
+	prepare_args->num_hw_update_entries = 1;
+	prepare_args->hw_update_entries[0].addr = (uintptr_t)hfi_cmd;
+	prepare_args->priv = &ctx_data->hfi_frame_process.frame_info[idx];
+
+	CAM_DBG(CAM_ICP, "X: req id = %lld ctx_id = %u",
+		packet->header.request_id, ctx_data->ctx_id);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_send_abort_status(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct hfi_frame_process_info *hfi_frame_process;
+	int idx;
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	for (idx = 0; idx < CAM_FRAME_CMD_MAX; idx++) {
+		if (!hfi_frame_process->request_id[idx])
+			continue;
+
+		ctx_data->ctxt_event_cb(ctx_data->context_priv,
+			CAM_CTX_EVT_ID_CANCEL,
+			&hfi_frame_process->request_id[idx]);
+
+		/* now release memory for hfi frame process command */
+		hfi_frame_process->request_id[idx] = 0;
+		if (ctx_data->hfi_frame_process.in_resource[idx] > 0) {
+			CAM_DBG(CAM_ICP, "Delete merged sync in object: %d",
+				ctx_data->hfi_frame_process.in_resource[idx]);
+			cam_sync_destroy(
+				ctx_data->hfi_frame_process.in_resource[idx]);
+			ctx_data->hfi_frame_process.in_resource[idx] = 0;
+	}
+		clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+	}
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return 0;
+}
+
+static int cam_icp_mgr_delete_sync(void *priv, void *data)
+{
+	struct hfi_cmd_work_data *task_data = NULL;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	struct hfi_frame_process_info *hfi_frame_process;
+	int idx;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_ICP, "Invalid params%pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	task_data = (struct hfi_cmd_work_data *)data;
+	ctx_data = task_data->data;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Null Context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	for (idx = 0; idx < CAM_FRAME_CMD_MAX; idx++) {
+		if (!hfi_frame_process->in_free_resource[idx])
+			continue;
+		//cam_sync_destroy(
+			//ctx_data->hfi_frame_process.in_free_resource[idx]);
+		ctx_data->hfi_frame_process.in_resource[idx] = 0;
+	}
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return 0;
+}
+
+static int cam_icp_mgr_delete_sync_obj(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int rc = 0;
+	struct crm_workq_task *task;
+	struct hfi_cmd_work_data *task_data;
+
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "no empty task");
+		return -ENOMEM;
+	}
+
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)ctx_data;
+	task_data->request_id = 0;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_delete_sync;
+	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_icp_mgr_flush_all(struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	struct hfi_frame_process_info *hfi_frame_process;
+	int idx;
+	bool clear_in_resource = false;
+
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	for (idx = 0; idx < CAM_FRAME_CMD_MAX; idx++) {
+		if (!hfi_frame_process->request_id[idx])
+			continue;
+
+		/* now release memory for hfi frame process command */
+		hfi_frame_process->request_id[idx] = 0;
+		if (ctx_data->hfi_frame_process.in_resource[idx] > 0) {
+			ctx_data->hfi_frame_process.in_free_resource[idx] =
+				ctx_data->hfi_frame_process.in_resource[idx];
+			ctx_data->hfi_frame_process.in_resource[idx] = 0;
+		}
+		clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+		clear_in_resource = true;
+	}
+
+	if (clear_in_resource)
+		cam_icp_mgr_delete_sync_obj(ctx_data);
+
+	return 0;
+}
+
+static int cam_icp_mgr_flush_req(struct cam_icp_hw_ctx_data *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	int64_t request_id;
+	struct hfi_frame_process_info *hfi_frame_process;
+	int idx;
+	bool clear_in_resource = false;
+
+	hfi_frame_process = &ctx_data->hfi_frame_process;
+	request_id = *(int64_t *)flush_args->flush_req_pending[0];
+	for (idx = 0; idx < CAM_FRAME_CMD_MAX; idx++) {
+		if (!hfi_frame_process->request_id[idx])
+			continue;
+
+		if (hfi_frame_process->request_id[idx] != request_id)
+			continue;
+
+		/* now release memory for hfi frame process command */
+		hfi_frame_process->request_id[idx] = 0;
+		if (ctx_data->hfi_frame_process.in_resource[idx] > 0) {
+			ctx_data->hfi_frame_process.in_free_resource[idx] =
+				ctx_data->hfi_frame_process.in_resource[idx];
+			ctx_data->hfi_frame_process.in_resource[idx] = 0;
+		}
+		clear_bit(idx, ctx_data->hfi_frame_process.bitmap);
+		clear_in_resource = true;
+	}
+
+	if (clear_in_resource)
+		cam_icp_mgr_delete_sync_obj(ctx_data);
+
+	return 0;
+}
+
+static void cam_icp_mgr_flush_info_dump(
+	struct cam_hw_flush_args *flush_args, uint32_t ctx_id)
+{
+	int i;
+
+	for (i = 0; i < flush_args->num_req_active; i++) {
+		CAM_DBG(CAM_ICP, "Flushing active request %lld in ctx %u",
+			*(int64_t *)flush_args->flush_req_active[i],
+			ctx_id);
+	}
+
+	for (i = 0; i < flush_args->num_req_pending; i++) {
+		CAM_DBG(CAM_ICP, "Flushing pending request %lld in ctx %u",
+			*(int64_t *)flush_args->flush_req_pending[i],
+			ctx_id);
+	}
+}
+
+static int cam_icp_mgr_enqueue_abort(
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int timeout = 1000, rc;
+	unsigned long rem_jiffies = 0;
+	struct hfi_cmd_work_data *task_data;
+	struct crm_workq_task *task;
+
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "no empty task");
+		return -ENOMEM;
+	}
+
+	reinit_completion(&ctx_data->wait_complete);
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)ctx_data;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_abort_handle_wq;
+	cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+
+	rem_jiffies = wait_for_completion_timeout(&ctx_data->wait_complete,
+		msecs_to_jiffies((timeout)));
+	if (!rem_jiffies) {
+		rc = cam_icp_retry_wait_for_abort(ctx_data);
+		if (rc) {
+			CAM_ERR(CAM_ICP,
+				"FW timeout/err in abort handle command ctx: %u",
+				ctx_data->ctx_id);
+			cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+			cam_hfi_queue_dump();
+			return rc;
+		}
+	}
+
+	CAM_DBG(CAM_ICP, "Abort after flush is success");
+	return 0;
+}
+
+static int cam_icp_mgr_hw_dump(void *hw_priv, void *hw_dump_args)
+{
+	int                              rc;
+	int                              i;
+	size_t                           remain_len;
+	uint8_t                         *dst;
+	uint32_t                         min_len;
+	uint64_t                         diff;
+	uint64_t                        *addr, *start;
+	struct timespec64                cur_ts;
+	struct timespec64                req_ts;
+	ktime_t                          cur_time;
+	struct cam_hw_intf              *icp_dev_intf;
+	struct cam_icp_hw_mgr           *hw_mgr;
+	struct cam_hw_dump_args         *dump_args;
+	struct cam_icp_hw_ctx_data      *ctx_data;
+	struct cam_icp_dump_header      *hdr;
+	struct cam_icp_hw_dump_args      icp_dump_args;
+	struct hfi_frame_process_info   *frm_process;
+
+	if ((!hw_priv) || (!hw_dump_args)) {
+		CAM_ERR(CAM_ICP, "Invalid params %pK %pK",
+			hw_priv, hw_dump_args);
+		return -EINVAL;
+	}
+
+	dump_args = (struct cam_hw_dump_args *)hw_dump_args;
+	hw_mgr = hw_priv;
+	ctx_data = dump_args->ctxt_to_hw_map;
+	CAM_DBG(CAM_ICP, "Req %lld", dump_args->request_id);
+	frm_process = &ctx_data->hfi_frame_process;
+	for (i = 0; i < CAM_FRAME_CMD_MAX; i++) {
+		if ((frm_process->request_id[i] ==
+			dump_args->request_id) &&
+			frm_process->fw_process_flag[i])
+			goto hw_dump;
+	}
+	return 0;
+hw_dump:
+	cur_time = ktime_get();
+	diff = ktime_us_delta(frm_process->submit_timestamp[i], cur_time);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(frm_process->submit_timestamp[i]);
+
+	if (diff < CAM_ICP_CTX_RESPONSE_TIME_THRESHOLD) {
+		CAM_INFO(CAM_ICP, "No Error req %lld %ld:%06ld %ld:%06ld",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		return 0;
+	}
+
+	CAM_INFO(CAM_ICP, "Error req %lld %ld:%06ld %ld:%06ld",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&icp_dump_args.cpu_addr, &icp_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "Invalid addr %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+	if (icp_dump_args.buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ICP, "dump buffer overshoot len %zu offset %zu",
+			icp_dump_args.buf_len, dump_args->offset);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	remain_len = icp_dump_args.buf_len - dump_args->offset;
+	min_len = sizeof(struct cam_icp_dump_header) +
+			(CAM_ICP_DUMP_NUM_WORDS * sizeof(uint64_t));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ICP, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)icp_dump_args.cpu_addr + dump_args->offset;
+	hdr = (struct cam_icp_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ICP_DUMP_TAG_MAX_LEN, "ICP_REQ:");
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_icp_dump_header));
+	start = addr;
+	*addr++ = frm_process->request_id[i];
+	*addr++ = req_ts.tv_sec;
+	*addr++ = req_ts.tv_nsec/NSEC_PER_USEC;
+	*addr++ = cur_ts.tv_sec;
+	*addr++ = cur_ts.tv_nsec/NSEC_PER_USEC;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += (hdr->size + sizeof(struct cam_icp_dump_header));
+	/* Dumping the fw image*/
+	icp_dump_args.offset = dump_args->offset;
+	icp_dev_intf = hw_mgr->icp_dev_intf;
+
+	if (!icp_dev_intf) {
+		CAM_ERR(CAM_ICP, "ICP device interface is NULL");
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -EINVAL;
+	}
+
+	rc = icp_dev_intf->hw_ops.process_cmd(
+		icp_dev_intf->hw_priv,
+		CAM_ICP_CMD_HW_DUMP, &icp_dump_args,
+		sizeof(struct cam_icp_hw_dump_args));
+	CAM_DBG(CAM_ICP, "Offset before %zu after %zu",
+		dump_args->offset, icp_dump_args.offset);
+	dump_args->offset = icp_dump_args.offset;
+
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_icp_mgr_hw_flush(void *hw_priv, void *hw_flush_args)
+{
+	struct cam_hw_flush_args *flush_args = hw_flush_args;
+	struct cam_icp_hw_ctx_data *ctx_data;
+	struct cam_icp_hw_mgr *hw_mgr = hw_priv;
+
+	if ((!hw_priv) || (!hw_flush_args)) {
+		CAM_ERR(CAM_ICP, "Input params are Null:");
+		return -EINVAL;
+	}
+
+	ctx_data = flush_args->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "Ctx data is NULL");
+		return -EINVAL;
+	}
+
+	if ((flush_args->flush_type >= CAM_FLUSH_TYPE_MAX) ||
+		(flush_args->flush_type < CAM_FLUSH_TYPE_REQ)) {
+		CAM_ERR(CAM_ICP, "Invalid lush type: %d",
+			flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	ctx_data->last_flush_req = flush_args->last_flush_req;
+	CAM_DBG(CAM_REQ, "ctx_id %d Flush type %d last_flush_req %u",
+		ctx_data->ctx_id, flush_args->flush_type,
+		ctx_data->last_flush_req);
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_ALL:
+		mutex_lock(&hw_mgr->hw_mgr_mutex);
+		if (!atomic_read(&hw_mgr->recovery)
+			&& flush_args->num_req_active) {
+			mutex_unlock(&hw_mgr->hw_mgr_mutex);
+			cam_icp_mgr_flush_info_dump(flush_args,
+				ctx_data->ctx_id);
+			cam_icp_mgr_enqueue_abort(ctx_data);
+		} else {
+			mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		}
+		mutex_lock(&ctx_data->ctx_mutex);
+		cam_icp_mgr_flush_all(ctx_data, flush_args);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		break;
+	case CAM_FLUSH_TYPE_REQ:
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (flush_args->num_req_active) {
+			CAM_ERR(CAM_ICP, "Flush request is not supported");
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return -EINVAL;
+		}
+		if (flush_args->num_req_pending)
+			cam_icp_mgr_flush_req(ctx_data, flush_args);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid flush type: %d",
+			flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_icp_mgr_release_hw(void *hw_mgr_priv, void *release_hw_args)
+{
+	int rc = 0;
+	int ctx_id = 0;
+	struct cam_hw_release_args *release_hw = release_hw_args;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+
+	if (!release_hw || !hw_mgr) {
+		CAM_ERR(CAM_ICP, "Invalid args: %pK %pK", release_hw, hw_mgr);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "Enter recovery set %d",
+		atomic_read(&hw_mgr->recovery));
+	ctx_data = release_hw->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_ICP, "NULL ctx data");
+		return -EINVAL;
+	}
+
+	ctx_id = ctx_data->ctx_id;
+	if (ctx_id < 0 || ctx_id >= CAM_ICP_CTX_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid ctx id: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+	if (hw_mgr->ctx_data[ctx_id].state != CAM_ICP_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_ICP, "ctx is not in use: %d", ctx_id);
+		mutex_unlock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(&hw_mgr->ctx_data[ctx_id].ctx_mutex);
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (!atomic_read(&hw_mgr->recovery) && release_hw->active_req) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		cam_icp_mgr_abort_handle(ctx_data);
+		cam_icp_mgr_send_abort_status(ctx_data);
+	} else {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	rc = cam_icp_mgr_release_ctx(hw_mgr, ctx_id);
+	if (!hw_mgr->ctxt_cnt) {
+		CAM_DBG(CAM_ICP, "Last Release");
+		cam_icp_mgr_icp_power_collapse(hw_mgr);
+		cam_icp_hw_mgr_reset_clk_info(hw_mgr);
+		rc = cam_ipe_bps_deint(hw_mgr);
+	}
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	if ((!hw_mgr->bps_ctxt_cnt || !hw_mgr->ipe_ctxt_cnt))
+		cam_icp_device_timer_stop(hw_mgr);
+
+	CAM_DBG(CAM_ICP, "Release done for ctx_id %d", ctx_id);
+	return rc;
+}
+
+static int cam_icp_mgr_create_handle(uint32_t dev_type,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct hfi_cmd_create_handle create_handle;
+	struct hfi_cmd_work_data *task_data;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+	struct crm_workq_task *task;
+	int rc = 0;
+
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.cmd_work);
+	if (!task)
+		return -ENOMEM;
+
+	create_handle.size = sizeof(struct hfi_cmd_create_handle);
+	create_handle.pkt_type = HFI_CMD_IPEBPS_CREATE_HANDLE;
+	create_handle.handle_type = dev_type;
+	create_handle.user_data1 = PTR_TO_U64(ctx_data);
+	reinit_completion(&ctx_data->wait_complete);
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)&create_handle;
+	task_data->request_id = 0;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc)
+		return rc;
+
+	rem_jiffies = wait_for_completion_timeout(&ctx_data->wait_complete,
+			msecs_to_jiffies((timeout)));
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_ICP, "FW response timed out %d", rc);
+		cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+		cam_hfi_queue_dump();
+	}
+
+	if (ctx_data->fw_handle == 0) {
+		CAM_ERR(CAM_ICP, "Invalid handle created");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_icp_mgr_send_ping(struct cam_icp_hw_ctx_data *ctx_data)
+{
+	struct hfi_cmd_ping_pkt ping_pkt;
+	struct hfi_cmd_work_data *task_data;
+	unsigned long rem_jiffies;
+	int timeout = 5000;
+	struct crm_workq_task *task;
+	int rc = 0;
+
+	task = cam_req_mgr_workq_get_task(icp_hw_mgr.cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_ICP, "No free task to send ping command");
+		return -ENOMEM;
+	}
+
+	ping_pkt.size = sizeof(struct hfi_cmd_ping_pkt);
+	ping_pkt.pkt_type = HFI_CMD_SYS_PING;
+	ping_pkt.user_data = PTR_TO_U64(ctx_data);
+	init_completion(&ctx_data->wait_complete);
+	task_data = (struct hfi_cmd_work_data *)task->payload;
+	task_data->data = (void *)&ping_pkt;
+	task_data->request_id = 0;
+	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_icp_mgr_process_cmd;
+
+	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc)
+		return rc;
+
+	rem_jiffies = wait_for_completion_timeout(&ctx_data->wait_complete,
+			msecs_to_jiffies((timeout)));
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_ICP, "FW response timed out %d", rc);
+		cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+		cam_hfi_queue_dump();
+	}
+
+	return rc;
+}
+
+static int cam_icp_get_acquire_info(struct cam_icp_hw_mgr *hw_mgr,
+	struct cam_hw_acquire_args *args,
+	struct cam_icp_hw_ctx_data *ctx_data)
+{
+	int i;
+	int acquire_size;
+	struct cam_icp_acquire_dev_info icp_dev_acquire_info;
+	struct cam_icp_res_info *p_icp_out = NULL;
+
+	if (copy_from_user(&icp_dev_acquire_info,
+		(void __user *)args->acquire_info,
+		sizeof(struct cam_icp_acquire_dev_info))) {
+		CAM_ERR(CAM_ICP, "Failed in acquire");
+		return -EFAULT;
+	}
+
+	if (icp_dev_acquire_info.secure_mode > CAM_SECURE_MODE_SECURE) {
+		CAM_ERR(CAM_ICP, "Invalid mode:%d",
+			icp_dev_acquire_info.secure_mode);
+		return -EINVAL;
+	}
+
+	if ((icp_dev_acquire_info.num_out_res > ICP_MAX_OUTPUT_SUPPORTED) ||
+		(icp_dev_acquire_info.num_out_res <= 0)) {
+		CAM_ERR(CAM_ICP, "Invalid num of out resources: %u",
+			icp_dev_acquire_info.num_out_res);
+		return -EINVAL;
+	}
+
+	if (icp_dev_acquire_info.dev_type >= CAM_ICP_RES_TYPE_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid device type: %d",
+			icp_dev_acquire_info.dev_type);
+		return -EFAULT;
+	}
+
+	acquire_size = sizeof(struct cam_icp_acquire_dev_info) +
+		((icp_dev_acquire_info.num_out_res - 1) *
+		sizeof(struct cam_icp_res_info));
+	ctx_data->icp_dev_acquire_info = kzalloc(acquire_size, GFP_KERNEL);
+	if (!ctx_data->icp_dev_acquire_info)
+		return -ENOMEM;
+
+	if (copy_from_user(ctx_data->icp_dev_acquire_info,
+		(void __user *)args->acquire_info, acquire_size)) {
+		CAM_ERR(CAM_ICP, "Failed in acquire: size = %d", acquire_size);
+		kfree(ctx_data->icp_dev_acquire_info);
+		ctx_data->icp_dev_acquire_info = NULL;
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_ICP, "%x %x %x %x %x %x %x",
+		ctx_data->icp_dev_acquire_info->dev_type,
+		ctx_data->icp_dev_acquire_info->in_res.format,
+		ctx_data->icp_dev_acquire_info->in_res.width,
+		ctx_data->icp_dev_acquire_info->in_res.height,
+		ctx_data->icp_dev_acquire_info->in_res.fps,
+		ctx_data->icp_dev_acquire_info->num_out_res,
+		ctx_data->icp_dev_acquire_info->scratch_mem_size);
+
+	p_icp_out = ctx_data->icp_dev_acquire_info->out_res_flex;
+	for (i = 0; i < icp_dev_acquire_info.num_out_res; i++)
+		CAM_DBG(CAM_ICP, "out[i] %x %x %x %x",
+			p_icp_out[i].format,
+			p_icp_out[i].width,
+			p_icp_out[i].height,
+			p_icp_out[i].fps);
+
+	return 0;
+}
+
+static uint32_t cam_icp_unify_dev_type(
+	uint32_t dev_type)
+{
+	switch (dev_type) {
+	case CAM_ICP_RES_TYPE_BPS:
+		return CAM_ICP_RES_TYPE_BPS;
+	case CAM_ICP_RES_TYPE_BPS_RT:
+		return CAM_ICP_RES_TYPE_BPS;
+	case CAM_ICP_RES_TYPE_BPS_SEMI_RT:
+		return CAM_ICP_RES_TYPE_BPS;
+	case CAM_ICP_RES_TYPE_IPE:
+		return CAM_ICP_RES_TYPE_IPE;
+	case CAM_ICP_RES_TYPE_IPE_RT:
+		return CAM_ICP_RES_TYPE_IPE;
+	case CAM_ICP_RES_TYPE_IPE_SEMI_RT:
+		return CAM_ICP_RES_TYPE_IPE;
+	default:
+		return CAM_ICP_RES_TYPE_MAX;
+	}
+}
+
+static int cam_icp_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	int rc = 0, bitmap_size = 0;
+	uint32_t ctx_id = 0, dev_type;
+	dma_addr_t io_buf_addr;
+	size_t io_buf_size;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_icp_hw_ctx_data *ctx_data = NULL;
+	struct cam_hw_acquire_args *args = acquire_hw_args;
+	struct cam_icp_acquire_dev_info *icp_dev_acquire_info;
+	struct cam_cmd_mem_regions cmd_mem_region;
+
+	if ((!hw_mgr_priv) || (!acquire_hw_args)) {
+		CAM_ERR(CAM_ICP, "Invalid params: %pK %pK", hw_mgr_priv,
+			acquire_hw_args);
+		return -EINVAL;
+	}
+
+	if (args->num_acq > 1) {
+		CAM_ERR(CAM_ICP, "number of resources are wrong: %u",
+			args->num_acq);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ICP, "ENTER");
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	ctx_id = cam_icp_mgr_get_free_ctx(hw_mgr);
+	if (ctx_id >= CAM_ICP_CTX_MAX) {
+		CAM_ERR(CAM_ICP, "No free ctx space in hw_mgr");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -ENOSPC;
+	}
+	ctx_data = &hw_mgr->ctx_data[ctx_id];
+	ctx_data->ctx_id = ctx_id;
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	rc = cam_icp_get_acquire_info(hw_mgr, args, ctx_data);
+	if (rc)
+		goto acquire_info_failed;
+
+	icp_dev_acquire_info = ctx_data->icp_dev_acquire_info;
+	dev_type = icp_dev_acquire_info->dev_type;
+	icp_dev_acquire_info->dev_type =
+		cam_icp_unify_dev_type(dev_type);
+
+	CAM_DBG(CAM_ICP, "acquire io buf handle %d",
+		icp_dev_acquire_info->io_config_cmd_handle);
+	rc = cam_mem_get_io_buf(
+		icp_dev_acquire_info->io_config_cmd_handle,
+		hw_mgr->iommu_hdl,
+		&io_buf_addr, &io_buf_size);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "unable to get src buf info from io desc");
+		goto get_io_buf_failed;
+	}
+
+	CAM_DBG(CAM_ICP, "hdl: %d, addr: %pK, size: %zu",
+		icp_dev_acquire_info->io_config_cmd_handle,
+		(void *)io_buf_addr, io_buf_size);
+
+	if (!hw_mgr->ctxt_cnt) {
+		rc = cam_icp_clk_info_init(hw_mgr, ctx_data);
+		if (rc)
+			goto get_io_buf_failed;
+
+		rc = cam_icp_mgr_icp_resume(hw_mgr);
+		if (rc)
+			goto get_io_buf_failed;
+
+		if (icp_hw_mgr.icp_debug_type)
+			hfi_set_debug_level(icp_hw_mgr.icp_debug_type,
+				icp_hw_mgr.icp_dbg_lvl);
+
+		hfi_set_fw_dump_level(icp_hw_mgr.icp_fw_dump_lvl);
+
+		rc = cam_icp_send_ubwc_cfg(hw_mgr);
+		if (rc)
+			goto ubwc_cfg_failed;
+	}
+
+
+	rc = cam_icp_mgr_ipe_bps_resume(hw_mgr, ctx_data);
+	if (rc)
+		goto ipe_bps_resume_failed;
+
+	rc = cam_icp_mgr_send_ping(ctx_data);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "ping ack not received");
+		goto send_ping_failed;
+	}
+	CAM_DBG(CAM_ICP, "ping ack received");
+
+	rc = cam_icp_mgr_create_handle(dev_type,
+		ctx_data);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "create handle failed");
+		goto create_handle_failed;
+	}
+
+	CAM_DBG(CAM_ICP,
+		"created stream handle for dev_type %u",
+		dev_type);
+
+	cmd_mem_region.num_regions = 1;
+	cmd_mem_region.map_info_array_flex[0].mem_handle =
+		icp_dev_acquire_info->io_config_cmd_handle;
+	cmd_mem_region.map_info_array_flex[0].offset = 0;
+	cmd_mem_region.map_info_array_flex[0].size =
+		icp_dev_acquire_info->io_config_cmd_size;
+	cmd_mem_region.map_info_array_flex[0].flags = 0;
+
+	rc = cam_icp_process_stream_settings(ctx_data,
+		&cmd_mem_region, true);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"sending config io mapping failed rc %d", rc);
+		goto send_map_info_failed;
+	}
+
+	rc = cam_icp_mgr_send_config_io(ctx_data, io_buf_addr);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"IO Config command failed %d size:%d",
+			rc, icp_dev_acquire_info->io_config_cmd_size);
+		cam_icp_dump_io_cfg(ctx_data,
+			icp_dev_acquire_info->io_config_cmd_handle,
+			icp_dev_acquire_info->io_config_cmd_size);
+		goto ioconfig_failed;
+	}
+
+	rc = cam_icp_process_stream_settings(ctx_data,
+		&cmd_mem_region, false);
+	if (rc) {
+		CAM_ERR(CAM_ICP,
+			"sending config io unmapping failed %d", rc);
+		goto send_map_info_failed;
+	}
+
+	ctx_data->context_priv = args->context_data;
+	args->ctxt_to_hw_map = ctx_data;
+
+	bitmap_size = BITS_TO_LONGS(CAM_FRAME_CMD_MAX) * sizeof(long);
+	ctx_data->hfi_frame_process.bitmap =
+			kzalloc(bitmap_size, GFP_KERNEL);
+	if (!ctx_data->hfi_frame_process.bitmap) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"hfi frame bitmap failed ctx id:%d dev hdl:0x%x session hdl:0x%x dev type %d",
+			ctx_data->ctx_id, ctx_data->acquire_dev_cmd.dev_handle,
+			ctx_data->acquire_dev_cmd.session_handle,
+			ctx_data->icp_dev_acquire_info->dev_type);
+		goto ioconfig_failed;
+	}
+
+	ctx_data->hfi_frame_process.bits = bitmap_size * BITS_PER_BYTE;
+	hw_mgr->ctx_data[ctx_id].ctxt_event_cb = args->event_cb;
+	icp_dev_acquire_info->scratch_mem_size = ctx_data->scratch_mem_size;
+
+	if (copy_to_user((void __user *)args->acquire_info,
+		icp_dev_acquire_info,
+		sizeof(struct cam_icp_acquire_dev_info))) {
+		CAM_ERR_RATE_LIMIT(CAM_ICP,
+			"copy from user failed ctx id:%d dev hdl:0x%x session hdl:0x%x dev type %d",
+			ctx_data->ctx_id, ctx_data->acquire_dev_cmd.dev_handle,
+			ctx_data->acquire_dev_cmd.session_handle,
+			ctx_data->icp_dev_acquire_info->dev_type);
+		goto copy_to_user_failed;
+	}
+
+	cam_icp_ctx_clk_info_init(ctx_data);
+	ctx_data->state = CAM_ICP_CTX_STATE_ACQUIRED;
+	mutex_unlock(&ctx_data->ctx_mutex);
+	CAM_DBG(CAM_ICP, "scratch size = %x fw_handle = %x",
+			(unsigned int)icp_dev_acquire_info->scratch_mem_size,
+			(unsigned int)ctx_data->fw_handle);
+	/* Start device timer*/
+	if (((hw_mgr->bps_ctxt_cnt == 1) || (hw_mgr->ipe_ctxt_cnt == 1)))
+		cam_icp_device_timer_start(hw_mgr);
+	/* Start context timer*/
+	cam_icp_ctx_timer_start(ctx_data);
+	hw_mgr->ctxt_cnt++;
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_ICP, "Acquire Done for ctx_id %u dev type %d",
+		ctx_data->ctx_id,
+		ctx_data->icp_dev_acquire_info->dev_type);
+
+	return 0;
+
+copy_to_user_failed:
+	kfree(ctx_data->hfi_frame_process.bitmap);
+	ctx_data->hfi_frame_process.bitmap = NULL;
+ioconfig_failed:
+	cam_icp_process_stream_settings(ctx_data,
+		&cmd_mem_region, false);
+send_map_info_failed:
+	cam_icp_mgr_destroy_handle(ctx_data);
+create_handle_failed:
+send_ping_failed:
+	cam_icp_mgr_ipe_bps_power_collapse(hw_mgr, ctx_data, 0);
+ipe_bps_resume_failed:
+ubwc_cfg_failed:
+	if (!hw_mgr->ctxt_cnt)
+		cam_icp_mgr_icp_power_collapse(hw_mgr);
+get_io_buf_failed:
+	kfree(hw_mgr->ctx_data[ctx_id].icp_dev_acquire_info);
+	hw_mgr->ctx_data[ctx_id].icp_dev_acquire_info = NULL;
+acquire_info_failed:
+	cam_icp_mgr_put_ctx(ctx_data);
+	cam_icp_mgr_process_dbg_buf(icp_hw_mgr.icp_dbg_lvl);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_get_hw_caps(void *hw_mgr_priv, void *hw_caps_args)
+{
+	int rc = 0;
+	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd *query_cap = hw_caps_args;
+
+	if ((!hw_mgr_priv) || (!hw_caps_args)) {
+		CAM_ERR(CAM_ICP, "Invalid params: %pK %pK",
+			hw_mgr_priv, hw_caps_args);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (copy_from_user(&icp_hw_mgr.icp_caps,
+		u64_to_user_ptr(query_cap->caps_handle),
+		sizeof(struct cam_icp_query_cap_cmd))) {
+		CAM_ERR(CAM_ICP, "copy_from_user failed");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = hfi_get_hw_caps(&icp_hw_mgr.icp_caps);
+	if (rc)
+		goto end;
+
+	icp_hw_mgr.icp_caps.dev_iommu_handle.non_secure = hw_mgr->iommu_hdl;
+	icp_hw_mgr.icp_caps.dev_iommu_handle.secure = hw_mgr->iommu_sec_hdl;
+
+	if (copy_to_user(u64_to_user_ptr(query_cap->caps_handle),
+		&icp_hw_mgr.icp_caps, sizeof(struct cam_icp_query_cap_cmd))) {
+		CAM_ERR(CAM_ICP, "copy_to_user failed");
+		rc = -EFAULT;
+	}
+end:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_icp_mgr_alloc_devs(struct device_node *of_node)
+{
+	int rc;
+	uint32_t num_dev;
+
+	rc = of_property_read_u32(of_node, "num-a5", &num_dev);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "getting num of a5 failed");
+		goto num_a5_failed;
+	}
+
+	icp_hw_mgr.devices[CAM_ICP_DEV_A5] = kzalloc(
+		sizeof(struct cam_hw_intf *) * num_dev, GFP_KERNEL);
+	if (!icp_hw_mgr.devices[CAM_ICP_DEV_A5]) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_ICP, "a5 allocation fail: rc = %d", rc);
+		goto num_a5_failed;
+	}
+
+	rc = of_property_read_u32(of_node, "num-ipe", &num_dev);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "getting number of ipe dev nodes failed");
+		goto num_ipe_failed;
+	}
+
+	if (!icp_hw_mgr.ipe1_enable)
+		num_dev = 1;
+
+	icp_hw_mgr.devices[CAM_ICP_DEV_IPE] = kcalloc(num_dev,
+		sizeof(struct cam_hw_intf *), GFP_KERNEL);
+	if (!icp_hw_mgr.devices[CAM_ICP_DEV_IPE]) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_ICP, "ipe device allocation fail : rc= %d", rc);
+		goto num_ipe_failed;
+	}
+
+	rc = of_property_read_u32(of_node, "num-bps", &num_dev);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "read num bps devices failed");
+		goto num_bps_failed;
+	}
+	icp_hw_mgr.devices[CAM_ICP_DEV_BPS] = kcalloc(num_dev,
+		sizeof(struct cam_hw_intf *), GFP_KERNEL);
+	if (!icp_hw_mgr.devices[CAM_ICP_DEV_BPS]) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_ICP, "bps device allocation fail : rc= %d", rc);
+		goto num_bps_failed;
+	}
+
+	icp_hw_mgr.ipe_bps_pc_flag = of_property_read_bool(of_node,
+		"ipe_bps_pc_en");
+
+	icp_hw_mgr.icp_pc_flag = of_property_read_bool(of_node,
+		"icp_pc_en");
+
+	return 0;
+num_bps_failed:
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_IPE]);
+num_ipe_failed:
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_A5]);
+num_a5_failed:
+	return rc;
+}
+
+static int cam_icp_mgr_init_devs(struct device_node *of_node)
+{
+	int rc = 0;
+	int count, i;
+	const char *name = NULL;
+	struct device_node *child_node = NULL;
+	struct platform_device *child_pdev = NULL;
+	struct cam_hw_intf *child_dev_intf = NULL;
+
+	rc = cam_icp_mgr_alloc_devs(of_node);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "alloc_devs fail : rc = %d", rc);
+		return rc;
+	}
+	count = of_property_count_strings(of_node, "compat-hw-name");
+	if (!count) {
+		CAM_ERR(CAM_ICP, "no compat hw found in dev tree, cnt = %d",
+			count);
+		rc = -EINVAL;
+		goto compat_hw_name_failed;
+	}
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node, "compat-hw-name",
+			i, &name);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "getting dev object name failed");
+			goto compat_hw_name_failed;
+		}
+
+		child_node = of_find_node_by_name(NULL, name);
+		if (!child_node) {
+			CAM_ERR(CAM_ICP, "Cannot find node in dtsi %s", name);
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+
+		child_pdev = of_find_device_by_node(child_node);
+		if (!child_pdev) {
+			CAM_ERR(CAM_ICP, "failed to find device on bus %s",
+				child_node->name);
+			rc = -ENODEV;
+			of_node_put(child_node);
+			goto compat_hw_name_failed;
+		}
+
+		child_dev_intf = (struct cam_hw_intf *)platform_get_drvdata(
+			child_pdev);
+		if (!child_dev_intf) {
+			CAM_ERR(CAM_ICP, "no child device");
+			of_node_put(child_node);
+			if (!icp_hw_mgr.ipe1_enable)
+				continue;
+			goto compat_hw_name_failed;
+		}
+		icp_hw_mgr.devices[child_dev_intf->hw_type]
+			[child_dev_intf->hw_idx] = child_dev_intf;
+
+		if (!child_dev_intf->hw_ops.process_cmd)
+			goto compat_hw_name_failed;
+
+		of_node_put(child_node);
+	}
+
+	icp_hw_mgr.icp_dev_intf = icp_hw_mgr.devices[CAM_ICP_DEV_A5][0];
+	icp_hw_mgr.bps_dev_intf = icp_hw_mgr.devices[CAM_ICP_DEV_BPS][0];
+	icp_hw_mgr.ipe0_dev_intf = icp_hw_mgr.devices[CAM_ICP_DEV_IPE][0];
+	if (icp_hw_mgr.ipe1_enable)
+		icp_hw_mgr.ipe1_dev_intf =
+			icp_hw_mgr.devices[CAM_ICP_DEV_IPE][1];
+
+	return 0;
+compat_hw_name_failed:
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_BPS]);
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_IPE]);
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_A5]);
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_icp_command_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_workq_icp_message_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_workq_icp_timer_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int cam_icp_mgr_create_wq(void)
+{
+	int rc;
+	int i;
+
+	rc = cam_req_mgr_workq_create("icp_command_queue", ICP_WORKQ_NUM_TASK,
+		&icp_hw_mgr.cmd_work, CRM_WORKQ_USAGE_NON_IRQ, 0,
+		cam_req_mgr_process_workq_icp_command_queue);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "unable to create a command worker");
+		goto cmd_work_failed;
+	}
+
+	rc = cam_req_mgr_workq_create("icp_message_queue", ICP_WORKQ_NUM_TASK,
+		&icp_hw_mgr.msg_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_icp_message_queue);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "unable to create a message worker");
+		goto msg_work_failed;
+	}
+
+	rc = cam_req_mgr_workq_create("icp_timer_queue", ICP_WORKQ_NUM_TASK,
+		&icp_hw_mgr.timer_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_icp_timer_queue);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "unable to create a timer worker");
+		goto timer_work_failed;
+	}
+
+	icp_hw_mgr.cmd_work_data =
+		kzalloc(sizeof(struct hfi_cmd_work_data) * ICP_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!icp_hw_mgr.cmd_work_data) {
+		CAM_ERR(CAM_ICP, "Mem reservation fail for cmd_work_data");
+		goto cmd_work_data_failed;
+	}
+	icp_hw_mgr.msg_work_data =
+		kzalloc(sizeof(struct hfi_msg_work_data) * ICP_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!icp_hw_mgr.msg_work_data) {
+		CAM_ERR(CAM_ICP, "Mem reservation fail for msg_work_data");
+		goto msg_work_data_failed;
+	}
+
+	icp_hw_mgr.timer_work_data =
+		kzalloc(sizeof(struct hfi_msg_work_data) * ICP_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!icp_hw_mgr.timer_work_data) {
+		CAM_ERR(CAM_ICP, "Mem reservation fail for timer_work_data");
+		goto timer_work_data_failed;
+	}
+
+	rc = cam_icp_hw_mgr_create_debugfs_entry();
+	if (rc)
+		goto debugfs_create_failed;
+
+	for (i = 0; i < ICP_WORKQ_NUM_TASK; i++)
+		icp_hw_mgr.msg_work->task.pool[i].payload =
+				&icp_hw_mgr.msg_work_data[i];
+
+	for (i = 0; i < ICP_WORKQ_NUM_TASK; i++)
+		icp_hw_mgr.cmd_work->task.pool[i].payload =
+				&icp_hw_mgr.cmd_work_data[i];
+
+	for (i = 0; i < ICP_WORKQ_NUM_TASK; i++)
+		icp_hw_mgr.timer_work->task.pool[i].payload =
+				&icp_hw_mgr.timer_work_data[i];
+	return 0;
+
+debugfs_create_failed:
+	kfree(icp_hw_mgr.timer_work_data);
+timer_work_data_failed:
+	kfree(icp_hw_mgr.msg_work_data);
+msg_work_data_failed:
+	kfree(icp_hw_mgr.cmd_work_data);
+cmd_work_data_failed:
+	cam_req_mgr_workq_destroy(&icp_hw_mgr.timer_work);
+timer_work_failed:
+	cam_req_mgr_workq_destroy(&icp_hw_mgr.msg_work);
+msg_work_failed:
+	cam_req_mgr_workq_destroy(&icp_hw_mgr.cmd_work);
+cmd_work_failed:
+	return rc;
+}
+
+static void cam_icp_mgr_destroy_wq(void)
+{
+	cam_req_mgr_workq_destroy(&icp_hw_mgr.timer_work);
+	cam_req_mgr_workq_destroy(&icp_hw_mgr.msg_work);
+	cam_req_mgr_workq_destroy(&icp_hw_mgr.cmd_work);
+}
+
+static int cam_icp_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_icp_hw_mgr  *hw_mgr = hw_mgr_priv;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_ICP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_icp_mgr_print_io_bufs(
+			hw_cmd_args->u.pf_args.pf_data.packet,
+			hw_mgr->iommu_hdl,
+			hw_mgr->iommu_sec_hdl,
+			hw_cmd_args->u.pf_args.buf_info,
+			hw_cmd_args->u.pf_args.mem_found);
+
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid cmd");
+	}
+
+	return rc;
+}
+
+int cam_icp_hw_mgr_init(struct device_node *of_node, uint64_t *hw_mgr_hdl,
+	int *iommu_hdl)
+{
+	int i, rc = 0;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	struct cam_cpas_query_cap query;
+	uint32_t cam_caps, camera_hw_version;
+
+	hw_mgr_intf = (struct cam_hw_mgr_intf *)hw_mgr_hdl;
+	if (!of_node || !hw_mgr_intf) {
+		CAM_ERR(CAM_ICP, "Invalid args of_node %pK hw_mgr %pK",
+			of_node, hw_mgr_intf);
+		return -EINVAL;
+	}
+
+	hw_mgr_intf->hw_mgr_priv = &icp_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_icp_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire = cam_icp_mgr_acquire_hw;
+	hw_mgr_intf->hw_release = cam_icp_mgr_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_icp_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config_stream_settings =
+		cam_icp_mgr_config_stream_settings;
+	hw_mgr_intf->hw_config = cam_icp_mgr_config_hw;
+	hw_mgr_intf->hw_open = cam_icp_mgr_hw_open_u;
+	hw_mgr_intf->hw_close = cam_icp_mgr_hw_close_u;
+	hw_mgr_intf->hw_flush = cam_icp_mgr_hw_flush;
+	hw_mgr_intf->hw_cmd = cam_icp_mgr_cmd;
+	hw_mgr_intf->hw_dump = cam_icp_mgr_hw_dump;
+
+	icp_hw_mgr.secure_mode = CAM_SECURE_MODE_NON_SECURE;
+	mutex_init(&icp_hw_mgr.hw_mgr_mutex);
+	spin_lock_init(&icp_hw_mgr.hw_mgr_lock);
+
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++)
+		mutex_init(&icp_hw_mgr.ctx_data[i].ctx_mutex);
+
+	rc = cam_cpas_get_hw_info(&query.camera_family,
+			&query.camera_version, &query.cpas_version,
+			&cam_caps, NULL);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get hw info rc=%d", rc);
+		goto destroy_mutex;
+	}
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get hw version rc=%d", rc);
+		goto destroy_mutex;
+	}
+
+	if ((camera_hw_version == CAM_CPAS_TITAN_480_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_580_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_570_V200)) {
+		if (cam_caps & CPAS_TITAN_480_IPE0_BIT)
+			icp_hw_mgr.ipe0_enable = true;
+		if (cam_caps & CPAS_BPS_BIT)
+			icp_hw_mgr.bps_enable = true;
+	} else {
+		if (cam_caps & CPAS_IPE0_BIT)
+			icp_hw_mgr.ipe0_enable = true;
+		if (cam_caps & CPAS_IPE1_BIT)
+			icp_hw_mgr.ipe1_enable = true;
+		if (cam_caps & CPAS_BPS_BIT)
+			icp_hw_mgr.bps_enable = true;
+	}
+
+	rc = cam_icp_mgr_init_devs(of_node);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cam_icp_mgr_init_devs fail: rc: %d", rc);
+		goto destroy_mutex;
+	}
+	rc = cam_smmu_get_handle("icp", &icp_hw_mgr.iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "get mmu handle failed: %d", rc);
+		goto icp_get_hdl_failed;
+	}
+
+	rc = cam_smmu_get_handle("cam-secure", &icp_hw_mgr.iommu_sec_hdl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "get secure mmu handle failed: %d", rc);
+		goto secure_hdl_failed;
+	}
+
+	rc = cam_icp_mgr_create_wq();
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cam_icp_mgr_create_wq fail: rc=%d", rc);
+		goto icp_wq_create_failed;
+	}
+
+	if (iommu_hdl)
+		*iommu_hdl = icp_hw_mgr.iommu_hdl;
+
+	init_completion(&icp_hw_mgr.icp_complete);
+	return rc;
+
+icp_wq_create_failed:
+	cam_smmu_destroy_handle(icp_hw_mgr.iommu_sec_hdl);
+	icp_hw_mgr.iommu_sec_hdl = -1;
+secure_hdl_failed:
+	cam_smmu_destroy_handle(icp_hw_mgr.iommu_hdl);
+	icp_hw_mgr.iommu_hdl = -1;
+icp_get_hdl_failed:
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_BPS]);
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_IPE]);
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_A5]);
+destroy_mutex:
+	mutex_destroy(&icp_hw_mgr.hw_mgr_mutex);
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++)
+		mutex_destroy(&icp_hw_mgr.ctx_data[i].ctx_mutex);
+
+	return rc;
+}
+
+void cam_icp_hw_mgr_deinit(void)
+{
+	int i = 0;
+
+	debugfs_remove_recursive(icp_hw_mgr.dentry);
+	icp_hw_mgr.dentry = NULL;
+	cam_icp_mgr_destroy_wq();
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_BPS]);
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_IPE]);
+	kfree(icp_hw_mgr.devices[CAM_ICP_DEV_A5]);
+	mutex_destroy(&icp_hw_mgr.hw_mgr_mutex);
+	for (i = 0; i < CAM_ICP_CTX_MAX; i++)
+		mutex_destroy(&icp_hw_mgr.ctx_data[i].ctx_mutex);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
@@ -0,0 +1,414 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAM_ICP_HW_MGR_H
+#define CAM_ICP_HW_MGR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_icp.h>
+#include "cam_icp_hw_intf.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_a5_hw_intf.h"
+#include "hfi_session_defs.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_smmu_api.h"
+#include "cam_soc_util.h"
+#include "cam_req_mgr_timer.h"
+
+#define CAM_ICP_ROLE_PARENT     1
+#define CAM_ICP_ROLE_CHILD      2
+
+#define CAM_FRAME_CMD_MAX       40
+
+#define CAM_MAX_OUT_RES         6
+#define CAM_MAX_IN_RES          8
+
+#define ICP_WORKQ_NUM_TASK      100
+#define ICP_WORKQ_TASK_CMD_TYPE 1
+#define ICP_WORKQ_TASK_MSG_TYPE 2
+
+#define ICP_PACKET_SIZE         0
+#define ICP_PACKET_TYPE         1
+#define ICP_PACKET_OPCODE       2
+#define ICP_MAX_OUTPUT_SUPPORTED 6
+
+#define ICP_FRAME_PROCESS_SUCCESS 0
+#define ICP_FRAME_PROCESS_FAILURE 1
+#define ICP_MSG_BUF_SIZE        256
+#define ICP_DBG_BUF_SIZE        102400
+
+#define ICP_CLK_HW_IPE          0x0
+#define ICP_CLK_HW_BPS          0x1
+#define ICP_CLK_HW_MAX          0x2
+
+#define ICP_OVER_CLK_THRESHOLD  5
+
+#define CPAS_IPE0_BIT           0x1000
+#define CPAS_IPE1_BIT           0x2000
+#define CPAS_BPS_BIT            0x400
+#define CPAS_TITAN_480_IPE0_BIT 0x800
+
+#define ICP_PWR_CLP_BPS         0x00000001
+#define ICP_PWR_CLP_IPE0        0x00010000
+#define ICP_PWR_CLP_IPE1        0x00020000
+
+#define CAM_ICP_CTX_STATE_FREE      0x0
+#define CAM_ICP_CTX_STATE_IN_USE    0x1
+#define CAM_ICP_CTX_STATE_ACQUIRED  0x2
+#define CAM_ICP_CTX_STATE_RELEASE   0x3
+
+#define CAM_ICP_CTX_MAX_CMD_BUFFERS 0x2
+
+/* Current appliacble vote paths, based on number of UAPI definitions */
+#define CAM_ICP_MAX_PER_PATH_VOTES 6
+
+/*
+ * Response time threshold in ms beyond which a request is not expected
+ * to be with ICP hw
+ */
+#define CAM_ICP_CTX_RESPONSE_TIME_THRESHOLD   300000
+
+/**
+ * struct icp_hfi_mem_info
+ * @qtbl: Memory info of queue table
+ * @cmd_q: Memory info of command queue
+ * @msg_q: Memory info of message queue
+ * @dbg_q: Memory info of debug queue
+ * @sec_heap: Memory info of secondary heap
+ * @fw_buf: Memory info of firmware
+ * @qdss_buf: Memory info of qdss
+ * @sfr_buf: Memory info for sfr buffer
+ * @shmem: Memory info for shared region
+ * @io_mem: Memory info for io region
+ */
+struct icp_hfi_mem_info {
+	struct cam_mem_mgr_memory_desc qtbl;
+	struct cam_mem_mgr_memory_desc cmd_q;
+	struct cam_mem_mgr_memory_desc msg_q;
+	struct cam_mem_mgr_memory_desc dbg_q;
+	struct cam_mem_mgr_memory_desc sec_heap;
+	struct cam_mem_mgr_memory_desc fw_buf;
+	struct cam_mem_mgr_memory_desc qdss_buf;
+	struct cam_mem_mgr_memory_desc sfr_buf;
+	struct cam_smmu_region_info shmem;
+	struct cam_smmu_region_info io_mem;
+};
+
+/**
+ * struct hfi_cmd_work_data
+ * @type: Task type
+ * @data: Pointer to command data
+ * @request_id: Request id
+ */
+struct hfi_cmd_work_data {
+	uint32_t type;
+	void *data;
+	int32_t request_id;
+};
+
+/**
+ * struct hfi_msg_work_data
+ * @type: Task type
+ * @data: Pointer to message data
+ * @irq_status: IRQ status
+ */
+struct hfi_msg_work_data {
+	uint32_t type;
+	void *data;
+	uint32_t irq_status;
+};
+
+/**
+ * struct clk_work_data
+ * @type: Task type
+ * @data: Pointer to clock info
+ */
+struct clk_work_data {
+	uint32_t type;
+	void *data;
+};
+
+/*
+ * struct icp_frame_info
+ * @request_id: request id
+ * @io_config: the address of io config
+ * @hfi_cfg_io_cmd: command struct to be sent to hfi
+ */
+struct icp_frame_info {
+	uint64_t request_id;
+	dma_addr_t io_config;
+	struct hfi_cmd_ipebps_async hfi_cfg_io_cmd;
+};
+
+/**
+ * struct cam_icp_clk_bw_request_v2
+ *
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @reserved: Reserved filed.
+ * @num_paths: Number of paths for per path bw vote
+ * @axi_path: Per path vote info for IPE/BPS
+ */
+struct cam_icp_clk_bw_req_internal_v2 {
+	uint64_t budget_ns;
+	uint32_t frame_cycles;
+	uint32_t rt_flag;
+	uint32_t reserved;
+	uint32_t num_paths;
+	union {
+		struct cam_axi_per_path_bw_vote axi_path[CAM_ICP_MAX_PER_PATH_VOTES];
+		__DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+	};
+};
+
+/**
+ * struct hfi_frame_process_info
+ * @hfi_frame_cmd: Frame process command info
+ * @bitmap: Bitmap for hfi_frame_cmd
+ * @bits: Used in hfi_frame_cmd bitmap
+ * @lock: Lock for hfi_frame_cmd
+ * @request_id: Request id list
+ * @num_out_resources: Number of out syncs
+ * @out_resource: Out sync info
+ * @fw_process_flag: Frame process flag
+ * @clk_info: Clock information for a request
+ * @clk_info_v2: Clock info for AXI bw voting v2
+ * @frame_info: information needed to process request
+ * @submit_timestamp: Submit timestamp to hw
+ */
+struct hfi_frame_process_info {
+	struct hfi_cmd_ipebps_async hfi_frame_cmd[CAM_FRAME_CMD_MAX];
+	void *bitmap;
+	size_t bits;
+	struct mutex lock;
+	uint64_t request_id[CAM_FRAME_CMD_MAX];
+	uint32_t num_out_resources[CAM_FRAME_CMD_MAX];
+	uint32_t out_resource[CAM_FRAME_CMD_MAX][CAM_MAX_OUT_RES];
+	uint32_t in_resource[CAM_FRAME_CMD_MAX];
+	uint32_t in_free_resource[CAM_FRAME_CMD_MAX];
+	uint32_t fw_process_flag[CAM_FRAME_CMD_MAX];
+	struct cam_icp_clk_bw_request clk_info[CAM_FRAME_CMD_MAX];
+	struct cam_icp_clk_bw_req_internal_v2 clk_info_v2[CAM_FRAME_CMD_MAX];
+	struct icp_frame_info frame_info[CAM_FRAME_CMD_MAX];
+	ktime_t submit_timestamp[CAM_FRAME_CMD_MAX];
+};
+
+/**
+ * struct cam_ctx_clk_info
+ * @curr_fc: Context latest request frame cycles
+ * @rt_flag: Flag to indicate real time request
+ * @base_clk: Base clock to process the request
+ * @reserved: Reserved field
+ * #uncompressed_bw: Current bandwidth voting
+ * @compressed_bw: Current compressed bandwidth voting
+ * @clk_rate: Supported clock rates for the context
+ * @num_paths: Number of valid AXI paths
+ * @axi_path: ctx based per path bw vote
+ * @bw_included: Whether bw of this context is included in overal voting
+ */
+struct cam_ctx_clk_info {
+	uint32_t curr_fc;
+	uint32_t rt_flag;
+	uint32_t base_clk;
+	uint32_t reserved;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+	int32_t clk_rate[CAM_MAX_VOTE];
+	uint32_t num_paths;
+	struct cam_axi_per_path_bw_vote axi_path[CAM_ICP_MAX_PER_PATH_VOTES];
+	bool bw_included;
+};
+/**
+ * struct cam_icp_hw_ctx_data
+ * @context_priv: Context private data
+ * @ctx_mutex: Mutex for context
+ * @fw_handle: Firmware handle
+ * @scratch_mem_size: Scratch memory size
+ * @acquire_dev_cmd: Acquire command
+ * @icp_dev_acquire_info: Acquire device info
+ * @ctxt_event_cb: Context callback function
+ * @state: context state
+ * @role: Role of a context in case of chaining
+ * @chain_ctx: Peer context
+ * @hfi_frame_process: Frame process command
+ * @wait_complete: Completion info
+ * @ctx_id: Context Id
+ * @bw_config_version: BW config version indicator
+ * @clk_info: Current clock info of a context
+ * @watch_dog: watchdog timer handle
+ * @watch_dog_reset_counter: Counter for watch dog reset
+ * @icp_dev_io_info: io config resource
+ * @last_flush_req: last flush req for this ctx
+ */
+struct cam_icp_hw_ctx_data {
+	void *context_priv;
+	struct mutex ctx_mutex;
+	uint32_t fw_handle;
+	uint32_t scratch_mem_size;
+	struct cam_acquire_dev_cmd acquire_dev_cmd;
+	struct cam_icp_acquire_dev_info *icp_dev_acquire_info;
+	cam_hw_event_cb_func ctxt_event_cb;
+	uint32_t state;
+	uint32_t role;
+	struct cam_icp_hw_ctx_data *chain_ctx;
+	struct hfi_frame_process_info hfi_frame_process;
+	struct completion wait_complete;
+	uint32_t ctx_id;
+	uint32_t bw_config_version;
+	struct cam_ctx_clk_info clk_info;
+	struct cam_req_mgr_timer *watch_dog;
+	uint32_t watch_dog_reset_counter;
+	struct cam_icp_acquire_dev_info icp_dev_io_info;
+	uint64_t last_flush_req;
+};
+
+/**
+ * struct icp_cmd_generic_blob
+ * @ctx: Current context info
+ * @frame_info_idx: Index used for frame process info
+ * @io_buf_addr: pointer to io buffer address
+ */
+struct icp_cmd_generic_blob {
+	struct cam_icp_hw_ctx_data *ctx;
+	uint32_t frame_info_idx;
+	dma_addr_t *io_buf_addr;
+};
+
+/**
+ * struct cam_icp_clk_info
+ * @base_clk: Base clock to process request
+ * @curr_clk: Current clock of hadrware
+ * @threshold: Threshold for overclk count
+ * @over_clked: Over clock count
+ * @uncompressed_bw: Current bandwidth voting
+ * @compressed_bw: Current compressed bandwidth voting
+ * @num_paths: Number of AXI vote paths
+ * @axi_path: Current per path bw vote info
+ * @hw_type: IPE/BPS device type
+ * @watch_dog: watchdog timer handle
+ * @watch_dog_reset_counter: Counter for watch dog reset
+ */
+struct cam_icp_clk_info {
+	uint32_t base_clk;
+	uint32_t curr_clk;
+	uint32_t threshold;
+	uint32_t over_clked;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+	uint32_t num_paths;
+	struct cam_axi_per_path_bw_vote axi_path[CAM_ICP_MAX_PER_PATH_VOTES];
+	uint32_t hw_type;
+	struct cam_req_mgr_timer *watch_dog;
+	uint32_t watch_dog_reset_counter;
+};
+
+/**
+ * struct cam_icp_hw_mgr
+ * @hw_mgr_mutex: Mutex for ICP hardware manager
+ * @hw_mgr_lock: Spinlock for ICP hardware manager
+ * @devices: Devices of ICP hardware manager
+ * @ctx_data: Context data
+ * @icp_caps: ICP capabilities
+ * @fw_download: Firmware download state
+ * @iommu_hdl: Non secure IOMMU handle
+ * @iommu_sec_hdl: Secure IOMMU handle
+ * @hfi_mem: Memory for hfi
+ * @cmd_work: Work queue for hfi commands
+ * @msg_work: Work queue for hfi messages
+ * @timer_work: Work queue for timer watchdog
+ * @msg_buf: Buffer for message data from firmware
+ * @dbg_buf: Buffer for debug data from firmware
+ * @a5_complete: Completion info
+ * @cmd_work_data: Pointer to command work queue task
+ * @msg_work_data: Pointer to message work queue task
+ * @timer_work_data: Pointer to timer work queue task
+ * @ctxt_cnt: Active context count
+ * @ipe_ctxt_cnt: IPE Active context count
+ * @bps_ctxt_cnt: BPS Active context count
+ * @dentry: Debugfs entry
+ * @a5_debug: A5 debug flag
+ * @icp_pc_flag: Flag to enable/disable power collapse
+ * @ipe_bps_pc_flag: Flag to enable/disable
+ *                   power collapse for ipe & bps
+ * @icp_debug_clk: Set clock based on debug value
+ * @icp_default_clk: Set this clok if user doesn't supply
+ * @clk_info: Clock info of hardware
+ * @secure_mode: Flag to enable/disable secure camera
+ * @a5_jtag_debug: entry to enable A5 JTAG debugging
+ * @a5_debug_type : entry to enable FW debug message/qdss
+ * @a5_dbg_lvl : debug level set to FW.
+ * @a5_fw_dump_lvl : level set for dumping the FW data
+ * @ipe0_enable: Flag for IPE0
+ * @ipe1_enable: Flag for IPE1
+ * @bps_enable: Flag for BPS
+ * @a5_dev_intf : Device interface for A5
+ * @ipe0_dev_intf: Device interface for IPE0
+ * @ipe1_dev_intf: Device interface for IPE1
+ * @bps_dev_intf: Device interface for BPS
+ * @ipe_clk_state: IPE clock state flag
+ * @bps_clk_state: BPS clock state flag
+ * @disable_ubwc_comp: Disable UBWC compression
+ * @recovery: Flag to validate if in previous session FW
+ *            reported a fatal error or wdt. If set FW is
+ *            re-downloaded for new camera session.
+ */
+struct cam_icp_hw_mgr {
+	struct mutex hw_mgr_mutex;
+	spinlock_t hw_mgr_lock;
+
+	struct cam_hw_intf **devices[CAM_ICP_DEV_MAX];
+	struct cam_icp_hw_ctx_data ctx_data[CAM_ICP_CTX_MAX];
+	struct cam_icp_query_cap_cmd icp_caps;
+
+	bool fw_download;
+	int32_t iommu_hdl;
+	int32_t iommu_sec_hdl;
+	struct icp_hfi_mem_info hfi_mem;
+	struct cam_req_mgr_core_workq *cmd_work;
+	struct cam_req_mgr_core_workq *msg_work;
+	struct cam_req_mgr_core_workq *timer_work;
+	uint32_t msg_buf[ICP_MSG_BUF_SIZE];
+	uint32_t dbg_buf[ICP_DBG_BUF_SIZE];
+	struct completion icp_complete;
+	struct hfi_cmd_work_data *cmd_work_data;
+	struct hfi_msg_work_data *msg_work_data;
+	struct hfi_msg_work_data *timer_work_data;
+	uint32_t ctxt_cnt;
+	uint32_t ipe_ctxt_cnt;
+	uint32_t bps_ctxt_cnt;
+	struct dentry *dentry;
+	bool icp_pc_flag;
+	bool ipe_bps_pc_flag;
+	uint64_t icp_debug_clk;
+	uint64_t icp_default_clk;
+	struct cam_icp_clk_info clk_info[ICP_CLK_HW_MAX];
+	bool secure_mode;
+	bool icp_jtag_debug;
+	u64 icp_debug_type;
+	u64 icp_dbg_lvl;
+	u64 icp_fw_dump_lvl;
+	bool ipe0_enable;
+	bool ipe1_enable;
+	bool bps_enable;
+	struct cam_hw_intf *icp_dev_intf;
+	struct cam_hw_intf *ipe0_dev_intf;
+	struct cam_hw_intf *ipe1_dev_intf;
+	struct cam_hw_intf *bps_dev_intf;
+	bool ipe_clk_state;
+	bool bps_clk_state;
+	bool disable_ubwc_comp;
+	atomic_t recovery;
+};
+
+static int cam_icp_mgr_hw_close(void *hw_priv, void *hw_close_args);
+static int cam_icp_mgr_hw_open(void *hw_mgr_priv, void *download_fw_args);
+static int cam_icp_mgr_icp_resume(struct cam_icp_hw_mgr *hw_mgr);
+static int cam_icp_mgr_icp_power_collapse(struct cam_icp_hw_mgr *hw_mgr);
+#endif /* CAM_ICP_HW_MGR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_a5_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_a5_hw_intf.h
@@ -0,0 +1,52 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_A5_HW_INTF_H
+#define CAM_A5_HW_INTF_H
+
+#include <linux/timer.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_intf.h"
+
+struct cam_icp_a5_set_fw_buf_info {
+	uint32_t iova;
+	uint64_t kva;
+	uint64_t len;
+};
+
+/**
+ * struct cam_icp_a5_query_cap - ICP query device capability payload
+ * @fw_version: firmware version info
+ * @api_version: api version info
+ * @num_ipe: number of ipes
+ * @num_bps: number of bps
+ * @num_dev: number of device capabilities in dev_caps
+ * @reserved: reserved
+ * @dev_ver: returned device capability array
+ * @CAM_QUERY_CAP IOCTL
+ */
+struct cam_icp_a5_query_cap {
+	struct cam_icp_ver fw_version;
+	struct cam_icp_ver api_version;
+	uint32_t num_ipe;
+	uint32_t num_bps;
+	uint32_t num_dev;
+	uint32_t reserved;
+	struct cam_icp_dev_ver dev_ver[CAM_ICP_DEV_TYPE_MAX];
+};
+
+struct cam_icp_a5_acquire_dev {
+	uint32_t ctx_id;
+	struct cam_icp_acquire_dev_info icp_acquire_info;
+	struct cam_icp_res_info icp_out_acquire_info[2];
+	uint32_t fw_handle;
+};
+
+struct cam_icp_a5_test_irq {
+	uint32_t test_irq;
+};
+#endif /* CAM_A5_HW_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_bps_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_bps_hw_intf.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_BPS_HW_INTF_H
+#define CAM_BPS_HW_INTF_H
+
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_intf.h"
+
+/* BPS register */
+#define BPS_TOP_RST_CMD              0x1008
+#define BPS_CDM_RST_CMD              0x10
+#define BPS_CDM_IRQ_STATUS           0x44
+#define BPS_TOP_IRQ_STATUS           0x100C
+
+/* BPS CDM/TOP status register */
+#define BPS_RST_DONE_IRQ_STATUS_BIT  0x1
+
+enum cam_icp_bps_cmd_type {
+	CAM_ICP_BPS_CMD_FW_DOWNLOAD,
+	CAM_ICP_BPS_CMD_POWER_COLLAPSE,
+	CAM_ICP_BPS_CMD_POWER_RESUME,
+	CAM_ICP_BPS_CMD_SET_FW_BUF,
+	CAM_ICP_BPS_CMD_VOTE_CPAS,
+	CAM_ICP_BPS_CMD_CPAS_START,
+	CAM_ICP_BPS_CMD_CPAS_STOP,
+	CAM_ICP_BPS_CMD_UPDATE_CLK,
+	CAM_ICP_BPS_CMD_DISABLE_CLK,
+	CAM_ICP_BPS_CMD_RESET,
+	CAM_ICP_BPS_CMD_MAX,
+};
+
+#endif /* CAM_BPS_HW_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_icp_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_icp_hw_intf.h
@@ -0,0 +1,64 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_ICP_HW_INTF_H
+#define CAM_ICP_HW_INTF_H
+
+#define CAM_ICP_CMD_BUF_MAX_SIZE     128
+#define CAM_ICP_MSG_BUF_MAX_SIZE     CAM_ICP_CMD_BUF_MAX_SIZE
+
+#define CAM_ICP_BW_CONFIG_UNKNOWN 0
+#define CAM_ICP_BW_CONFIG_V1      1
+#define CAM_ICP_BW_CONFIG_V2      2
+
+#define CAM_ICP_UBWC_COMP_EN      BIT(1)
+
+enum cam_icp_hw_type {
+	CAM_ICP_DEV_A5,
+	CAM_ICP_DEV_IPE,
+	CAM_ICP_DEV_BPS,
+	CAM_ICP_DEV_MAX,
+};
+
+enum cam_icp_cmd_type {
+	CAM_ICP_CMD_FW_DOWNLOAD,
+	CAM_ICP_CMD_POWER_COLLAPSE,
+	CAM_ICP_CMD_POWER_RESUME,
+	CAM_ICP_CMD_SET_FW_BUF,
+	CAM_ICP_CMD_ACQUIRE,
+	CAM_ICP_SET_IRQ_CB,
+	CAM_ICP_TEST_IRQ,
+	CAM_ICP_SEND_INIT,
+	CAM_ICP_CMD_VOTE_CPAS,
+	CAM_ICP_CMD_CPAS_START,
+	CAM_ICP_CMD_CPAS_STOP,
+	CAM_ICP_CMD_UBWC_CFG,
+	CAM_ICP_CMD_PC_PREP,
+	CAM_ICP_CMD_CLK_UPDATE,
+	CAM_ICP_CMD_HW_DUMP,
+	CAM_ICP_CMD_MAX,
+};
+
+struct cam_icp_set_irq_cb {
+	int32_t (*icp_hw_mgr_cb)(uint32_t irq_status, void *data);
+	void *data;
+};
+
+/**
+ * struct cam_icp_clk_update_cmd - Payload for hw manager command
+ *
+ * @curr_clk_rate:        clk rate to HW
+ * @ipe_bps_pc_enable     power collpase enable flag
+ * @clk_level:            clk level corresponding to the clk rate
+ *                        populated as output while the clk is being
+ *                        updated to the given rate
+ */
+struct cam_icp_clk_update_cmd {
+	uint32_t  curr_clk_rate;
+	bool  ipe_bps_pc_enable;
+	int32_t clk_level;
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_ipe_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/icp_hw_mgr/include/cam_ipe_hw_intf.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_IPE_HW_INTF_H
+#define CAM_IPE_HW_INTF_H
+
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "cam_hw_mgr_intf.h"
+#include "cam_icp_hw_intf.h"
+
+/* IPE registers */
+#define IPE_TOP_RST_CMD              0x1008
+#define IPE_CDM_RST_CMD              0x10
+#define IPE_CDM_IRQ_STATUS           0x44
+#define IPE_TOP_IRQ_STATUS           0x100C
+
+/* IPE CDM/TOP status register */
+#define IPE_RST_DONE_IRQ_STATUS_BIT  0x1
+
+enum cam_icp_ipe_cmd_type {
+	CAM_ICP_IPE_CMD_FW_DOWNLOAD,
+	CAM_ICP_IPE_CMD_POWER_COLLAPSE,
+	CAM_ICP_IPE_CMD_POWER_RESUME,
+	CAM_ICP_IPE_CMD_SET_FW_BUF,
+	CAM_ICP_IPE_CMD_VOTE_CPAS,
+	CAM_ICP_IPE_CMD_CPAS_START,
+	CAM_ICP_IPE_CMD_CPAS_STOP,
+	CAM_ICP_IPE_CMD_UPDATE_CLK,
+	CAM_ICP_IPE_CMD_DISABLE_CLK,
+	CAM_ICP_IPE_CMD_RESET,
+	CAM_ICP_IPE_CMD_MAX,
+};
+
+#endif /* CAM_IPE_HW_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/include/cam_icp_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/include/cam_icp_hw_mgr_intf.h
@@ -0,0 +1,76 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_ICP_HW_MGR_INTF_H
+#define CAM_ICP_HW_MGR_INTF_H
+
+#include <linux/of.h>
+#include <media/cam_icp.h>
+#include <media/cam_defs.h>
+#include "cam_cpas_api.h"
+
+#define ICP_CLK_TURBO_HZ         600000000
+#define ICP_CLK_SVS_HZ           400000000
+
+#define CAM_ICP_A5_BW_BYTES_VOTE 40000000
+
+#define CAM_ICP_CTX_MAX          54
+
+#define CPAS_IPE1_BIT            0x2000
+
+#define CAM_IPE_DEFAULT_AXI_PATH    CAM_AXI_PATH_DATA_IPE_WR_VID
+#define CAM_IPE_DEFAULT_AXI_TRANSAC CAM_AXI_TRANSACTION_WRITE
+#define CAM_BPS_DEFAULT_AXI_PATH    CAM_AXI_PATH_DATA_ALL
+#define CAM_BPS_DEFAULT_AXI_TRANSAC CAM_AXI_TRANSACTION_WRITE
+#define CAM_ICP_DEFAULT_AXI_PATH    CAM_AXI_PATH_DATA_ALL
+#define CAM_ICP_DEFAULT_AXI_TRANSAC CAM_AXI_TRANSACTION_READ
+
+#define CAM_ICP_DUMP_TAG_MAX_LEN 32
+#define CAM_ICP_DUMP_NUM_WORDS   5
+
+int cam_icp_hw_mgr_init(struct device_node *of_node,
+	uint64_t *hw_mgr_hdl, int *iommu_hdl);
+
+void cam_icp_hw_mgr_deinit(void);
+
+/**
+ * struct cam_icp_cpas_vote
+ * @ahb_vote: AHB vote info
+ * @axi_vote: AXI vote info
+ * @ahb_vote_valid: Flag for ahb vote data
+ * @axi_vote_valid: flag for axi vote data
+ */
+struct cam_icp_cpas_vote {
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote;
+	uint32_t ahb_vote_valid;
+	uint32_t axi_vote_valid;
+};
+
+/**
+ * struct cam_icp_hw_dump_args
+ * @cpu_addr: kernel vaddr
+ * @buf_len:  buffer length
+ * @offset:   offset
+ */
+struct cam_icp_hw_dump_args {
+	uintptr_t  cpu_addr;
+	size_t     buf_len;
+	size_t     offset;
+};
+
+/**
+ * struct cam_icp_dump_header
+ * @tag:        tag of the packet
+ * @size:       size of data in packet
+ * @word_size:  size of each word in packet
+ */
+struct cam_icp_dump_header {
+	uint8_t    tag[CAM_ICP_DUMP_TAG_MAX_LEN];
+	uint64_t   size;
+	int32_t    word_size;
+};
+
+#endif /* CAM_ICP_HW_MGR_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.c
@@ -0,0 +1,470 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ipe_core.h"
+#include "ipe_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_ipe_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "hfi_reg.h"
+
+#define HFI_MAX_POLL_TRY 5
+
+static int cam_ipe_cpas_vote(struct cam_ipe_device_core_info *core_info,
+	struct cam_icp_cpas_vote *cpas_vote)
+{
+	int rc = 0;
+
+	if (cpas_vote->ahb_vote_valid)
+		rc = cam_cpas_update_ahb_vote(core_info->cpas_handle,
+			&cpas_vote->ahb_vote);
+	if (cpas_vote->axi_vote_valid)
+		rc = cam_cpas_update_axi_vote(core_info->cpas_handle,
+			&cpas_vote->axi_vote);
+
+	if (rc)
+		CAM_ERR(CAM_PERF, "cpas vote is failed: %d", rc);
+
+	return rc;
+}
+
+int cam_ipe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ipe_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	struct cam_icp_cpas_vote cpas_vote;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_IPE_DEFAULT_AXI_PATH;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_IPE_DEFAULT_AXI_TRANSAC;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].ddr_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].ddr_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "cpas start failed: %d", rc);
+		goto error;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_ipe_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "soc enable is failed : %d", rc);
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	} else {
+		core_info->clk_enable = true;
+	}
+
+error:
+	return rc;
+}
+
+int cam_ipe_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ipe_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_ICP, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	rc = cam_ipe_disable_soc_resources(soc_info, core_info->clk_enable);
+	if (rc)
+		CAM_ERR(CAM_ICP, "soc disable is failed : %d", rc);
+	core_info->clk_enable = false;
+
+	if (core_info->cpas_start) {
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_ICP, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	}
+
+	return rc;
+}
+
+static int cam_ipe_handle_pc(struct cam_hw_info *ipe_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	struct cam_ipe_device_hw_info *hw_info = NULL;
+	int rc = 0;
+	int pwr_ctrl;
+	int pwr_status;
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	hw_info = core_info->ipe_hw_info;
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (!(pwr_ctrl & IPE_COLLAPSE_MASK)) {
+		rc = cam_cpas_reg_read(core_info->cpas_handle,
+				CAM_CPAS_REG_CPASTOP, hw_info->pwr_status,
+				true, &pwr_status);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+			return rc;
+		}
+
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP,
+			hw_info->pwr_ctrl, true, 0x1);
+
+		if (pwr_status >> IPE_PWR_ON_MASK)
+			CAM_WARN(CAM_PERF, "BPS: pwr_status(%x):pwr_ctrl(%x)",
+				pwr_status, pwr_ctrl);
+
+	}
+
+	rc = cam_ipe_get_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_status,
+			true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return 0;
+}
+
+static int cam_ipe_handle_resume(struct cam_hw_info *ipe_dev)
+{
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	struct cam_ipe_device_hw_info *hw_info = NULL;
+	int pwr_ctrl;
+	int pwr_status;
+	int rc = 0;
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	hw_info = core_info->ipe_hw_info;
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	if (pwr_ctrl & IPE_COLLAPSE_MASK) {
+		CAM_DBG(CAM_PERF, "IPE pwr_ctrl set(%x)", pwr_ctrl);
+		cam_cpas_reg_write(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP,
+			hw_info->pwr_ctrl, true, 0);
+	}
+
+	rc = cam_ipe_transfer_gdsc_control(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to transfer gdsc control rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_ctrl,
+			true, &pwr_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power ctrl read failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_reg_read(core_info->cpas_handle,
+			CAM_CPAS_REG_CPASTOP, hw_info->pwr_status,
+			true, &pwr_status);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "power status read failed rc=%d", rc);
+		return rc;
+	}
+
+	CAM_DBG(CAM_PERF, "pwr_ctrl=%x pwr_status=%x", pwr_ctrl, pwr_status);
+
+	return rc;
+}
+
+static int cam_ipe_cmd_reset(struct cam_hw_soc_info *soc_info,
+	struct cam_ipe_device_core_info *core_info)
+{
+	int pwr_ctrl, pwr_status, rc = 0;
+	uint32_t status = 0, retry_cnt = 0;
+	bool reset_ipe_cdm_fail = false;
+	bool reset_ipe_top_fail = false;
+
+	CAM_DBG(CAM_ICP, "CAM_ICP_IPE_CMD_RESET");
+	if (!core_info->clk_enable || !core_info->cpas_start) {
+		CAM_ERR(CAM_HFI, "IPE reset failed. clk_en %d cpas_start %d",
+				core_info->clk_enable, core_info->cpas_start);
+		return -EINVAL;
+	}
+
+	/* IPE CDM core reset*/
+	cam_io_w_mb((uint32_t)0xF,
+		soc_info->reg_map[0].mem_base + IPE_CDM_RST_CMD);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		readw_poll_timeout((soc_info->reg_map[0].mem_base +
+			IPE_CDM_IRQ_STATUS),
+			status, ((status & IPE_RST_DONE_IRQ_STATUS_BIT) == 0x1),
+			100, 10000);
+
+		CAM_DBG(CAM_HFI, "ipe_cdm_irq_status = %u", status);
+
+		if ((status & IPE_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+	status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		IPE_CDM_IRQ_STATUS);
+	if ((status & IPE_RST_DONE_IRQ_STATUS_BIT) != 0x1) {
+		CAM_ERR(CAM_ICP, "IPE CDM rst failed status 0x%x", status);
+		reset_ipe_cdm_fail = true;
+	}
+
+	/* IPE reset*/
+	status = 0;
+	cam_io_w_mb((uint32_t)0x3,
+		soc_info->reg_map[0].mem_base + IPE_TOP_RST_CMD);
+	while (retry_cnt < HFI_MAX_POLL_TRY) {
+		readw_poll_timeout((soc_info->reg_map[0].mem_base +
+			IPE_TOP_IRQ_STATUS),
+			status, ((status & IPE_RST_DONE_IRQ_STATUS_BIT) == 0x1),
+			100, 10000);
+
+		CAM_DBG(CAM_HFI, "ipe_top_irq_status = %u", status);
+
+
+		if ((status & IPE_RST_DONE_IRQ_STATUS_BIT) == 0x1)
+			break;
+		retry_cnt++;
+	}
+	status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		IPE_TOP_IRQ_STATUS);
+	if ((status & IPE_RST_DONE_IRQ_STATUS_BIT) != 0x1) {
+		CAM_ERR(CAM_ICP, "IPE top rst failed status 0x%x", status);
+		reset_ipe_top_fail = true;
+	}
+
+	cam_ipe_get_gdsc_control(soc_info);
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REG_CPASTOP, core_info->ipe_hw_info->pwr_ctrl,
+		true, &pwr_ctrl);
+	cam_cpas_reg_read(core_info->cpas_handle,
+		CAM_CPAS_REG_CPASTOP, core_info->ipe_hw_info->pwr_status,
+		true, &pwr_status);
+	CAM_DBG(CAM_ICP, "(After)pwr_ctrl = %x pwr_status = %x",
+		pwr_ctrl, pwr_status);
+
+	if (reset_ipe_cdm_fail || reset_ipe_top_fail)
+		rc = -EAGAIN;
+
+	return rc;
+}
+
+int cam_ipe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ipe_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ipe_device_core_info *core_info = NULL;
+	struct cam_ipe_device_hw_info *hw_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_ICP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_ICP_IPE_CMD_MAX) {
+		CAM_ERR(CAM_ICP, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &ipe_dev->soc_info;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	hw_info = core_info->ipe_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ICP_IPE_CMD_VOTE_CPAS: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args)
+			return -EINVAL;
+
+		cam_ipe_cpas_vote(core_info, cpas_vote);
+		break;
+	}
+
+	case CAM_ICP_IPE_CMD_CPAS_START: {
+		struct cam_icp_cpas_vote *cpas_vote = cmd_args;
+
+		if (!cmd_args)
+			return -EINVAL;
+
+		if (!core_info->cpas_start) {
+			rc = cam_cpas_start(core_info->cpas_handle,
+				&cpas_vote->ahb_vote, &cpas_vote->axi_vote);
+			core_info->cpas_start = true;
+		}
+		break;
+	}
+
+	case CAM_ICP_IPE_CMD_CPAS_STOP:
+		if (core_info->cpas_start) {
+			cam_cpas_stop(core_info->cpas_handle);
+			core_info->cpas_start = false;
+		}
+		break;
+	case CAM_ICP_IPE_CMD_POWER_COLLAPSE:
+		rc = cam_ipe_handle_pc(ipe_dev);
+		break;
+	case CAM_ICP_IPE_CMD_POWER_RESUME:
+		rc = cam_ipe_handle_resume(ipe_dev);
+		break;
+	case CAM_ICP_IPE_CMD_UPDATE_CLK: {
+		struct cam_icp_clk_update_cmd *clk_upd_cmd = cmd_args;
+		struct cam_ahb_vote ahb_vote;
+		uint32_t clk_rate = clk_upd_cmd->curr_clk_rate;
+		int32_t clk_level  = 0, err = 0;
+
+		CAM_DBG(CAM_PERF, "ipe_src_clk rate = %d", (int)clk_rate);
+		if (!core_info->clk_enable) {
+			if (clk_upd_cmd->ipe_bps_pc_enable) {
+				cam_ipe_handle_pc(ipe_dev);
+				cam_cpas_reg_write(core_info->cpas_handle,
+					CAM_CPAS_REG_CPASTOP,
+					hw_info->pwr_ctrl, true, 0x0);
+			}
+			rc = cam_ipe_toggle_clk(soc_info, true);
+			if (rc)
+				CAM_ERR(CAM_ICP, "Enable failed");
+			else
+				core_info->clk_enable = true;
+			if (clk_upd_cmd->ipe_bps_pc_enable) {
+				rc = cam_ipe_handle_resume(ipe_dev);
+				if (rc)
+					CAM_ERR(CAM_ICP, "bps resume failed");
+			}
+		}
+		CAM_DBG(CAM_PERF, "clock rate %d", clk_rate);
+
+		rc = cam_ipe_update_clk_rate(soc_info, &clk_rate);
+		if (rc)
+			CAM_ERR(CAM_PERF, "Failed to update clk %d", clk_rate);
+
+		err = cam_soc_util_get_clk_level(soc_info,
+			clk_rate, soc_info->src_clk_idx,
+			&clk_level);
+
+		if (!err) {
+			clk_upd_cmd->clk_level = clk_level;
+			ahb_vote.type = CAM_VOTE_ABSOLUTE;
+			ahb_vote.vote.level = clk_level;
+			cam_cpas_update_ahb_vote(
+				core_info->cpas_handle,
+				&ahb_vote);
+		}
+		break;
+	}
+	case CAM_ICP_IPE_CMD_DISABLE_CLK:
+		if (core_info->clk_enable == true)
+			cam_ipe_toggle_clk(soc_info, false);
+		core_info->clk_enable = false;
+		break;
+	case CAM_ICP_IPE_CMD_RESET:
+		rc = cam_ipe_cmd_reset(soc_info, core_info);
+		break;
+	default:
+		CAM_ERR(CAM_ICP, "Invalid Cmd Type:%u", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+irqreturn_t cam_ipe_irq(int irq_num, void *data)
+{
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_core.h
@@ -0,0 +1,49 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_IPE_CORE_H
+#define CAM_IPE_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#define IPE_COLLAPSE_MASK 0x1
+#define IPE_PWR_ON_MASK   0x2
+
+struct cam_ipe_device_hw_info {
+	uint32_t hw_idx;
+	uint32_t pwr_ctrl;
+	uint32_t pwr_status;
+	uint32_t reserved;
+};
+
+struct cam_ipe_device_core_info {
+	struct cam_ipe_device_hw_info *ipe_hw_info;
+	uint32_t cpas_handle;
+	bool cpas_start;
+	bool clk_enable;
+};
+
+int cam_ipe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ipe_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ipe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+irqreturn_t cam_ipe_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register IPE hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_ipe_init_module(void);
+
+/**
+ * @brief : API to remove IPE Hw from platform framework.
+ */
+void cam_ipe_exit_module(void);
+#endif /* CAM_IPE_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_dev.c
@@ -0,0 +1,250 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+#include "ipe_core.h"
+#include "ipe_soc.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_icp_hw_intf.h"
+#include "cam_icp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_ipe_device_hw_info cam_ipe_hw_info[] = {
+	{
+		.hw_idx = 0,
+		.pwr_ctrl = 0x4c,
+		.pwr_status = 0x48,
+		.reserved = 0,
+	},
+	{
+		.hw_idx = 1,
+		.pwr_ctrl = 0x54,
+		.pwr_status = 0x50,
+		.reserved = 0,
+	},
+};
+
+static char ipe_dev_name[8];
+
+static int cam_ipe_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_ipe_device_core_info *core_info,
+	uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "ipe", sizeof("ipe"));
+	cpas_register_params.cam_cpas_client_cb = NULL;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_ipe_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info            *ipe_dev = NULL;
+	struct cam_hw_intf            *ipe_dev_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_ipe_device_core_info   *core_info = NULL;
+	struct cam_ipe_device_hw_info     *hw_info = NULL;
+	int                                rc = 0;
+	struct cam_cpas_query_cap query;
+	uint32_t cam_caps;
+	uint32_t hw_idx;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &hw_idx);
+
+	rc = cam_cpas_get_hw_info(&query.camera_family,
+			&query.camera_version, &query.cpas_version,
+			&cam_caps, NULL);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "failed to get hw info rc=%d", rc);
+		return rc;
+	}
+
+	if ((!(cam_caps & CPAS_IPE1_BIT)) && (hw_idx)) {
+		CAM_ERR(CAM_ICP, "IPE1 hw idx = %d\n", hw_idx);
+		return -EINVAL;
+	}
+
+	ipe_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!ipe_dev_intf)
+		return -ENOMEM;
+
+	ipe_dev_intf->hw_idx = hw_idx;
+	ipe_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!ipe_dev) {
+		kfree(ipe_dev_intf);
+		return -ENOMEM;
+	}
+
+	memset(ipe_dev_name, 0, sizeof(ipe_dev_name));
+	snprintf(ipe_dev_name, sizeof(ipe_dev_name),
+		"ipe%1u", ipe_dev_intf->hw_idx);
+
+	ipe_dev->soc_info.pdev = pdev;
+	ipe_dev->soc_info.dev = &pdev->dev;
+	ipe_dev->soc_info.dev_name = ipe_dev_name;
+	ipe_dev_intf->hw_priv = ipe_dev;
+	ipe_dev_intf->hw_ops.init = cam_ipe_init_hw;
+	ipe_dev_intf->hw_ops.deinit = cam_ipe_deinit_hw;
+	ipe_dev_intf->hw_ops.process_cmd = cam_ipe_process_cmd;
+	ipe_dev_intf->hw_type = CAM_ICP_DEV_IPE;
+
+	CAM_DBG(CAM_ICP, "IPE component bind type %d index %d",
+		ipe_dev_intf->hw_type,
+		ipe_dev_intf->hw_idx);
+
+	platform_set_drvdata(pdev, ipe_dev_intf);
+
+	ipe_dev->core_info = kzalloc(sizeof(struct cam_ipe_device_core_info),
+		GFP_KERNEL);
+	if (!ipe_dev->core_info) {
+		kfree(ipe_dev);
+		kfree(ipe_dev_intf);
+		return -ENOMEM;
+	}
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_DBG(CAM_ICP, "No ipe hardware info");
+		kfree(ipe_dev->core_info);
+		kfree(ipe_dev);
+		kfree(ipe_dev_intf);
+		rc = -EINVAL;
+		return rc;
+	}
+	hw_info = &cam_ipe_hw_info[ipe_dev_intf->hw_idx];
+	core_info->ipe_hw_info = hw_info;
+
+	rc = cam_ipe_init_soc_resources(&ipe_dev->soc_info, cam_ipe_irq,
+		ipe_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_ICP, "failed to init_soc");
+		kfree(ipe_dev->core_info);
+		kfree(ipe_dev);
+		kfree(ipe_dev_intf);
+		return rc;
+	}
+
+	CAM_DBG(CAM_ICP, "cam_ipe_init_soc_resources : %pK",
+		(void *)&ipe_dev->soc_info);
+	rc = cam_ipe_register_cpas(&ipe_dev->soc_info,
+		core_info, ipe_dev_intf->hw_idx);
+	if (rc < 0) {
+		kfree(ipe_dev->core_info);
+		kfree(ipe_dev);
+		kfree(ipe_dev_intf);
+		return rc;
+	}
+	ipe_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&ipe_dev->hw_mutex);
+	spin_lock_init(&ipe_dev->hw_lock);
+	init_completion(&ipe_dev->hw_complete);
+
+	CAM_DBG(CAM_ICP, "IPE:%d component bound successfully",
+		ipe_dev_intf->hw_idx);
+
+	return rc;
+}
+
+static void cam_ipe_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info            *ipe_dev = NULL;
+	struct cam_hw_intf            *ipe_dev_intf = NULL;
+	struct cam_ipe_device_core_info   *core_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ICP, "Unbinding component: %s", pdev->name);
+	ipe_dev_intf = platform_get_drvdata(pdev);
+	ipe_dev = ipe_dev_intf->hw_priv;
+	core_info = (struct cam_ipe_device_core_info *)ipe_dev->core_info;
+	cam_cpas_unregister_client(core_info->cpas_handle);
+	cam_ipe_deinit_soc_resources(&ipe_dev->soc_info);
+	kfree(ipe_dev->core_info);
+	kfree(ipe_dev);
+	kfree(ipe_dev_intf);
+}
+
+
+const static struct component_ops cam_ipe_component_ops = {
+	.bind = cam_ipe_component_bind,
+	.unbind = cam_ipe_component_unbind,
+};
+
+static int cam_ipe_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ICP, "Adding IPE component");
+	rc = component_add(&pdev->dev, &cam_ipe_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_ipe_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ipe_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_ipe_dt_match[] = {
+	{
+		.compatible = "qcom,cam-ipe",
+		.data = &cam_ipe_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_ipe_dt_match);
+
+struct platform_driver cam_ipe_driver = {
+	.probe = cam_ipe_probe,
+	.remove = cam_ipe_remove,
+	.driver = {
+		.name = "cam-ipe",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ipe_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ipe_init_module(void)
+{
+	return platform_driver_register(&cam_ipe_driver);
+}
+
+void cam_ipe_exit_module(void)
+{
+	platform_driver_unregister(&cam_ipe_driver);
+}
+
+MODULE_DESCRIPTION("CAM IPE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.c
@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_icp.h>
+#include "ipe_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+
+int cam_ipe_transfer_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	int rc;
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = regulator_set_mode(soc_info->rgltr[i],
+			REGULATOR_MODE_FAST);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Regulator set mode %s failed",
+				soc_info->rgltr_name[i]);
+			goto rgltr_set_mode_failed;
+		}
+	}
+	return 0;
+
+rgltr_set_mode_failed:
+	for (i = i - 1; i >= 0; i--)
+		if (soc_info->rgltr[i])
+			regulator_set_mode(soc_info->rgltr[i],
+				REGULATOR_MODE_NORMAL);
+
+	return rc;
+}
+
+int cam_ipe_get_gdsc_control(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	int rc;
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = regulator_set_mode(soc_info->rgltr[i],
+					REGULATOR_MODE_NORMAL);
+		if (rc) {
+			CAM_ERR(CAM_ICP, "Regulator set mode %s failed",
+				soc_info->rgltr_name[i]);
+			goto rgltr_set_mode_failed;
+		}
+	}
+	return 0;
+
+rgltr_set_mode_failed:
+	for (i = i - 1; i >= 0; i--)
+		if (soc_info->rgltr[i])
+			regulator_set_mode(soc_info->rgltr[i],
+					REGULATOR_MODE_FAST);
+
+	return rc;
+}
+
+static int cam_ipe_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ICP, "get ipe dt prop is failed");
+
+	return rc;
+}
+
+static int cam_ipe_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t ipe_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, ipe_irq_handler,
+		irq_data);
+
+	return rc;
+}
+
+int cam_ipe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ipe_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_ipe_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_ipe_request_platform_resource(soc_info, ipe_irq_handler,
+		irq_data);
+	if (rc < 0)
+		return rc;
+
+	return rc;
+}
+
+void cam_ipe_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_WARN(CAM_ICP, "release platform resources fail");
+}
+
+int cam_ipe_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_SVS_VOTE, false);
+	if (rc) {
+		CAM_ERR(CAM_ICP, "enable platform failed");
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_ipe_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, disable_clk,
+		false);
+	if (rc)
+		CAM_ERR(CAM_ICP, "enable platform failed");
+
+	return rc;
+}
+
+int cam_ipe_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t *clk_rate)
+{
+	int32_t src_clk_idx;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE] == true) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(*clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_PERF, "clk_rate %d greater than max, reset to %d",
+			*clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		*clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	return cam_soc_util_set_src_clk_rate(soc_info, *clk_rate);
+}
+
+int cam_ipe_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable)
+{
+	int rc = 0;
+
+	if (clk_enable)
+		rc = cam_soc_util_clk_enable_default(soc_info, CAM_SVS_VOTE);
+	else
+		cam_soc_util_clk_disable_default(soc_info);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_icp/icp_hw/ipe_hw/ipe_soc.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_IPE_SOC_H
+#define CAM_IPE_SOC_H
+
+#include "cam_soc_util.h"
+
+int cam_ipe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ipe_irq_handler, void *irq_data);
+
+int cam_ipe_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_ipe_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk);
+
+int cam_ipe_get_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_ipe_transfer_gdsc_control(struct cam_hw_soc_info *soc_info);
+
+int cam_ipe_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t *clk_rate);
+int cam_ipe_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable);
+void cam_ipe_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+#endif /* CAM_IPE_SOC_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/cam_isp_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/cam_isp_context.c
@@ -0,0 +1,6438 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/ratelimit.h>
+
+#include "cam_mem_mgr.h"
+#include "cam_sync_api.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+#include "cam_context_utils.h"
+#include "cam_cdm_util.h"
+#include "cam_isp_context.h"
+#include "cam_common_util.h"
+#include "cam_req_mgr_debug.h"
+#include "cam_cpas_api.h"
+#include "cam_subdev.h"
+
+static const char isp_dev_name[] = "cam-isp";
+
+static struct cam_isp_ctx_debug isp_ctx_debug;
+
+#define INC_HEAD(head, max_entries, ret) \
+	div_u64_rem(atomic64_add_return(1, head),\
+	max_entries, (ret))
+
+static int cam_isp_context_dump_requests(void *data,
+	struct cam_smmu_pf_info *pf_info);
+
+static int cam_isp_context_handle_message(void *context,
+	uint32_t msg_type, uint32_t *data);
+
+static int __cam_isp_ctx_start_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd);
+
+static const char *__cam_isp_evt_val_to_type(
+	uint32_t evt_id)
+{
+	switch (evt_id) {
+	case CAM_ISP_CTX_EVENT_SUBMIT:
+		return "SUBMIT";
+	case CAM_ISP_CTX_EVENT_APPLY:
+		return "APPLY";
+	case CAM_ISP_CTX_EVENT_EPOCH:
+		return "EPOCH";
+	case CAM_ISP_CTX_EVENT_RUP:
+		return "RUP";
+	case CAM_ISP_CTX_EVENT_BUFDONE:
+		return "BUFDONE";
+	default:
+		return "CAM_ISP_EVENT_INVALID";
+	}
+}
+
+static void __cam_isp_ctx_update_event_record(
+	struct cam_isp_context *ctx_isp,
+	enum cam_isp_ctx_event  event,
+	struct cam_ctx_request *req)
+{
+	int                      iterator = 0;
+	ktime_t                  cur_time;
+	struct cam_isp_ctx_req  *req_isp;
+
+	if (!ctx_isp) {
+		CAM_ERR(CAM_ISP, "Invalid Args");
+		return;
+	}
+	switch (event) {
+	case CAM_ISP_CTX_EVENT_EPOCH:
+	case CAM_ISP_CTX_EVENT_RUP:
+	case CAM_ISP_CTX_EVENT_BUFDONE:
+		break;
+	case CAM_ISP_CTX_EVENT_SUBMIT:
+	case CAM_ISP_CTX_EVENT_APPLY:
+		if (!req) {
+			CAM_ERR(CAM_ISP, "Invalid arg for event %d", event);
+			return;
+		}
+		break;
+	default:
+		break;
+	}
+
+	INC_HEAD(&ctx_isp->event_record_head[event],
+		CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES, &iterator);
+	cur_time = ktime_get();
+	if (req) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		ctx_isp->event_record[event][iterator].req_id =
+			req->request_id;
+		req_isp->event_timestamp[event] = cur_time;
+	} else {
+		ctx_isp->event_record[event][iterator].req_id = 0;
+	}
+	ctx_isp->event_record[event][iterator].timestamp  = cur_time;
+}
+
+static int __cam_isp_ctx_dump_event_record(
+	struct cam_isp_context *ctx_isp,
+	uintptr_t               cpu_addr,
+	size_t                  buf_len,
+	size_t                 *offset)
+{
+	int                                  i, j;
+	int                                  index;
+	size_t                               remain_len;
+	uint8_t                             *dst;
+	uint32_t                             oldest_entry, num_entries;
+	uint32_t                             min_len;
+	uint64_t                            *addr, *start;
+	uint64_t                             state_head;
+	struct timespec64                    ts;
+	struct cam_isp_context_dump_header  *hdr;
+	struct cam_isp_context_event_record *record;
+
+	if (!cpu_addr || !buf_len || !offset || !ctx_isp) {
+		CAM_ERR(CAM_ISP, "Invalid args %pK %zu %pK %pK",
+			cpu_addr, buf_len, offset, ctx_isp);
+		return -EINVAL;
+	}
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++) {
+		state_head = atomic64_read(&ctx_isp->event_record_head[i]);
+
+		if (state_head == -1) {
+			return 0;
+		} else if (state_head < CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES) {
+			num_entries = state_head + 1;
+			oldest_entry = 0;
+		} else {
+			num_entries = CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES;
+			div_u64_rem(state_head + 1,
+				CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES,
+				&oldest_entry);
+		}
+		index = oldest_entry;
+
+		if (buf_len <= *offset) {
+			CAM_WARN(CAM_ISP,
+				"Dump buffer overshoot len %zu offset %zu",
+				buf_len, *offset);
+			return -ENOSPC;
+		}
+
+		min_len = sizeof(struct cam_isp_context_dump_header) +
+			((num_entries * CAM_ISP_CTX_DUMP_EVENT_NUM_WORDS) *
+			sizeof(uint64_t));
+		remain_len = buf_len - *offset;
+
+		if (remain_len < min_len) {
+			CAM_WARN(CAM_ISP,
+				"Dump buffer exhaust remain %zu min %u",
+				remain_len, min_len);
+			return -ENOSPC;
+		}
+		dst = (uint8_t *)cpu_addr + *offset;
+		hdr = (struct cam_isp_context_dump_header *)dst;
+		scnprintf(hdr->tag,
+			CAM_ISP_CONTEXT_DUMP_TAG_MAX_LEN, "ISP_EVT_%s:",
+			__cam_isp_evt_val_to_type(i));
+		hdr->word_size = sizeof(uint64_t);
+		addr = (uint64_t *)(dst +
+			sizeof(struct cam_isp_context_dump_header));
+		start = addr;
+		for (j = 0; j <  num_entries; j++) {
+			record  = &ctx_isp->event_record[i][index];
+			ts      = ktime_to_timespec64(record->timestamp);
+			*addr++ = record->req_id;
+			*addr++ = ts.tv_sec;
+			*addr++ = ts.tv_nsec/NSEC_PER_USEC;
+			index = (index + 1) %
+				CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES;
+		}
+		hdr->size = hdr->word_size * (addr - start);
+		*offset += hdr->size +
+			sizeof(struct cam_isp_context_dump_header);
+	}
+	return 0;
+}
+
+static void __cam_isp_ctx_update_state_monitor_array(
+	struct cam_isp_context *ctx_isp,
+	enum cam_isp_state_change_trigger trigger_type,
+	uint64_t req_id)
+{
+	int iterator;
+
+	INC_HEAD(&ctx_isp->state_monitor_head,
+		CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES, &iterator);
+
+	ctx_isp->cam_isp_ctx_state_monitor[iterator].curr_state =
+		ctx_isp->substate_activated;
+	ctx_isp->cam_isp_ctx_state_monitor[iterator].frame_id =
+		ctx_isp->frame_id;
+	ctx_isp->cam_isp_ctx_state_monitor[iterator].trigger =
+		trigger_type;
+	ctx_isp->cam_isp_ctx_state_monitor[iterator].req_id =
+		req_id;
+	ctx_isp->cam_isp_ctx_state_monitor[iterator].evt_time_stamp =
+		jiffies_to_msecs(jiffies) - ctx_isp->init_timestamp;
+}
+
+static const char *__cam_isp_ctx_substate_val_to_type(
+	enum cam_isp_ctx_activated_substate type)
+{
+	switch (type) {
+	case CAM_ISP_CTX_ACTIVATED_SOF:
+		return "SOF";
+	case CAM_ISP_CTX_ACTIVATED_APPLIED:
+		return "APPLIED";
+	case CAM_ISP_CTX_ACTIVATED_EPOCH:
+		return "EPOCH";
+	case CAM_ISP_CTX_ACTIVATED_BUBBLE:
+		return "BUBBLE";
+	case CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED:
+		return "BUBBLE_APPLIED";
+	case CAM_ISP_CTX_ACTIVATED_HW_ERROR:
+		return "HW_ERROR";
+	case CAM_ISP_CTX_ACTIVATED_HALT:
+		return "HALT";
+	default:
+		return "INVALID";
+	}
+}
+
+static const char *__cam_isp_hw_evt_val_to_type(
+	uint32_t evt_id)
+{
+	switch (evt_id) {
+	case CAM_ISP_STATE_CHANGE_TRIGGER_ERROR:
+		return "ERROR";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_APPLIED:
+		return "APPLIED";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_SOF:
+		return "SOF";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE:
+		return "REG_UPDATE";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH:
+		return "EPOCH";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_EOF:
+		return "EOF";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_DONE:
+		return "DONE";
+	case CAM_ISP_STATE_CHANGE_TRIGGER_FLUSH:
+		return "FLUSH";
+	default:
+		return "CAM_ISP_EVENT_INVALID";
+	}
+}
+
+static void __cam_isp_ctx_dump_state_monitor_array(
+	struct cam_isp_context *ctx_isp)
+{
+	int i = 0;
+	int64_t state_head = 0;
+	uint32_t index, num_entries, oldest_entry;
+
+	state_head = atomic64_read(&ctx_isp->state_monitor_head);
+
+	if (state_head == -1) {
+		return;
+	} else if (state_head < CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES) {
+		num_entries = state_head;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1,
+			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES, &oldest_entry);
+	}
+
+	CAM_ERR(CAM_ISP,
+		"Dumping state information for preceding requests");
+
+	index = oldest_entry;
+
+	for (i = 0; i < num_entries; i++) {
+		CAM_ERR(CAM_ISP,
+		"Index[%d] time[%d] : Substate[%s] Frame[%lld] ReqId[%llu] evt_type[%s]",
+		index,
+		ctx_isp->cam_isp_ctx_state_monitor[index].evt_time_stamp,
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->cam_isp_ctx_state_monitor[index].curr_state),
+		ctx_isp->cam_isp_ctx_state_monitor[index].frame_id,
+		ctx_isp->cam_isp_ctx_state_monitor[index].req_id,
+		__cam_isp_hw_evt_val_to_type(
+		ctx_isp->cam_isp_ctx_state_monitor[index].trigger));
+
+		index = (index + 1) % CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES;
+	}
+}
+
+static int cam_isp_context_info_dump(void *context,
+	enum cam_context_dump_id id)
+{
+	struct cam_context *ctx = (struct cam_context *)context;
+
+	switch (id) {
+	case CAM_CTX_DUMP_ACQ_INFO: {
+		cam_context_dump_hw_acq_info(ctx);
+		break;
+	}
+	default:
+		CAM_DBG(CAM_ISP, "DUMP id not valid %u", id);
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_isp_ctx_dump_req(
+	struct cam_isp_ctx_req  *req_isp,
+	uintptr_t                cpu_addr,
+	size_t                   buf_len,
+	size_t                  *offset,
+	bool                     dump_to_buff)
+{
+	int i, rc = 0;
+	size_t len = 0;
+	uint32_t *buf_addr;
+	uint32_t *buf_start, *buf_end;
+	size_t remain_len = 0;
+	struct cam_cdm_cmd_buf_dump_info dump_info;
+
+	for (i = 0; i < req_isp->num_cfg; i++) {
+		rc = cam_packet_util_get_cmd_mem_addr(
+			req_isp->cfg[i].handle, &buf_addr, &len);
+		if (rc) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"Failed to get_cmd_mem_addr, rc=%d",
+				rc);
+		} else {
+			if (req_isp->cfg[i].offset >= ((uint32_t)len)) {
+				CAM_ERR(CAM_ISP,
+					"Invalid offset exp %u actual %u",
+					req_isp->cfg[i].offset, (uint32_t)len);
+				cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
+				return -EINVAL;
+			}
+			remain_len = len - req_isp->cfg[i].offset;
+
+			if (req_isp->cfg[i].len >
+				((uint32_t)remain_len)) {
+				CAM_ERR(CAM_ISP,
+					"Invalid len exp %u remain_len %u",
+					req_isp->cfg[i].len,
+					(uint32_t)remain_len);
+				cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
+				return -EINVAL;
+			}
+
+			buf_start = (uint32_t *)((uint8_t *) buf_addr +
+				req_isp->cfg[i].offset);
+			buf_end = (uint32_t *)((uint8_t *) buf_start +
+				req_isp->cfg[i].len - 1);
+
+			if (dump_to_buff) {
+				if (!cpu_addr || !offset || !buf_len) {
+					CAM_ERR(CAM_ISP, "Invalid args");
+					break;
+				}
+				dump_info.src_start = buf_start;
+				dump_info.src_end =   buf_end;
+				dump_info.dst_start = cpu_addr;
+				dump_info.dst_offset = *offset;
+				dump_info.dst_max_size = buf_len;
+				rc = cam_cdm_util_dump_cmd_bufs_v2(
+					&dump_info);
+				*offset = dump_info.dst_offset;
+				if (rc)
+					return rc;
+			} else
+				cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
+			cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
+		}
+	}
+	return rc;
+}
+
+static int __cam_isp_ctx_enqueue_request_in_order(
+	struct cam_context *ctx, struct cam_ctx_request *req)
+{
+	struct cam_ctx_request           *req_current;
+	struct cam_ctx_request           *req_prev;
+	struct list_head                  temp_list;
+	struct cam_isp_context           *ctx_isp;
+
+	INIT_LIST_HEAD(&temp_list);
+	spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->pending_req_list)) {
+		list_add_tail(&req->list, &ctx->pending_req_list);
+	} else {
+		list_for_each_entry_safe_reverse(
+			req_current, req_prev, &ctx->pending_req_list, list) {
+			if (req->request_id < req_current->request_id) {
+				list_del_init(&req_current->list);
+				list_add(&req_current->list, &temp_list);
+				continue;
+			} else if (req->request_id == req_current->request_id) {
+				CAM_WARN(CAM_ISP,
+					"Received duplicated request %lld",
+					req->request_id);
+			}
+			break;
+		}
+		list_add_tail(&req->list, &ctx->pending_req_list);
+
+		if (!list_empty(&temp_list)) {
+			list_for_each_entry_safe(
+				req_current, req_prev, &temp_list, list) {
+				list_del_init(&req_current->list);
+				list_add_tail(&req_current->list,
+					&ctx->pending_req_list);
+			}
+		}
+	}
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_SUBMIT, req);
+	spin_unlock_bh(&ctx->lock);
+	return 0;
+}
+
+static int __cam_isp_ctx_enqueue_init_request(
+	struct cam_context *ctx, struct cam_ctx_request *req)
+{
+	int rc = 0;
+	struct cam_ctx_request                *req_old;
+	struct cam_isp_ctx_req                *req_isp_old;
+	struct cam_isp_ctx_req                *req_isp_new;
+	struct cam_isp_prepare_hw_update_data *req_update_old;
+	struct cam_isp_prepare_hw_update_data *req_update_new;
+	struct cam_isp_prepare_hw_update_data *hw_update_data;
+
+	spin_lock_bh(&ctx->lock);
+	if (list_empty(&ctx->pending_req_list)) {
+		list_add_tail(&req->list, &ctx->pending_req_list);
+		CAM_DBG(CAM_ISP, "INIT packet added req id= %d",
+			req->request_id);
+		goto end;
+	}
+
+	req_old = list_first_entry(&ctx->pending_req_list,
+		struct cam_ctx_request, list);
+	req_isp_old = (struct cam_isp_ctx_req *) req_old->req_priv;
+	req_isp_new = (struct cam_isp_ctx_req *) req->req_priv;
+	if (req_isp_old->hw_update_data.packet_opcode_type ==
+		CAM_ISP_PACKET_INIT_DEV) {
+		if ((req_isp_old->num_cfg + req_isp_new->num_cfg) >=
+			CAM_ISP_CTX_CFG_MAX) {
+			CAM_WARN(CAM_ISP,
+				"Can not merge INIT pkt num_cfgs = %d",
+				(req_isp_old->num_cfg +
+					req_isp_new->num_cfg));
+			rc = -ENOMEM;
+		}
+
+		if (req_isp_old->num_fence_map_out != 0 ||
+			req_isp_old->num_fence_map_in != 0) {
+			CAM_WARN(CAM_ISP, "Invalid INIT pkt sequence");
+			rc = -EINVAL;
+		}
+
+		if (!rc) {
+			memcpy(req_isp_old->fence_map_out,
+				req_isp_new->fence_map_out,
+				sizeof(req_isp_new->fence_map_out[0])*
+				req_isp_new->num_fence_map_out);
+			req_isp_old->num_fence_map_out =
+				req_isp_new->num_fence_map_out;
+
+			memcpy(req_isp_old->fence_map_in,
+				req_isp_new->fence_map_in,
+				sizeof(req_isp_new->fence_map_in[0])*
+				req_isp_new->num_fence_map_in);
+			req_isp_old->num_fence_map_in =
+				req_isp_new->num_fence_map_in;
+
+			memcpy(&req_isp_old->cfg[req_isp_old->num_cfg],
+				req_isp_new->cfg,
+				sizeof(req_isp_new->cfg[0]) *
+				req_isp_new->num_cfg);
+			req_isp_old->num_cfg += req_isp_new->num_cfg;
+
+			memcpy(&req_old->pf_data, &req->pf_data,
+				sizeof(struct cam_hw_mgr_dump_pf_data));
+
+			if (req_isp_new->hw_update_data.num_reg_dump_buf) {
+				req_update_new = &req_isp_new->hw_update_data;
+				req_update_old = &req_isp_old->hw_update_data;
+				memcpy(&req_update_old->reg_dump_buf_desc,
+					&req_update_new->reg_dump_buf_desc,
+					sizeof(struct cam_cmd_buf_desc) *
+					req_update_new->num_reg_dump_buf);
+				req_update_old->num_reg_dump_buf =
+					req_update_new->num_reg_dump_buf;
+			}
+
+			/* Update frame header params for EPCR */
+			hw_update_data = &req_isp_new->hw_update_data;
+			req_isp_old->hw_update_data.frame_header_res_id =
+				req_isp_new->hw_update_data.frame_header_res_id;
+			req_isp_old->hw_update_data.frame_header_cpu_addr =
+				hw_update_data->frame_header_cpu_addr;
+
+			req_old->request_id = req->request_id;
+
+			list_add_tail(&req->list, &ctx->free_req_list);
+		}
+	} else {
+		CAM_WARN(CAM_ISP,
+			"Received Update pkt before INIT pkt. req_id= %lld",
+			req->request_id);
+		rc = -EINVAL;
+	}
+end:
+	spin_unlock_bh(&ctx->lock);
+	return rc;
+}
+
+static const char *__cam_isp_resource_handle_id_to_type(
+	uint32_t resource_handle)
+{
+	switch (resource_handle) {
+	case CAM_ISP_IFE_OUT_RES_FULL:
+		return "FULL";
+	case CAM_ISP_IFE_OUT_RES_DS4:
+		return "DS4";
+	case CAM_ISP_IFE_OUT_RES_DS16:
+		return "DS16";
+	case CAM_ISP_IFE_OUT_RES_RAW_DUMP:
+		return "RAW_DUMP";
+	case CAM_ISP_IFE_OUT_RES_FD:
+		return "FD";
+	case CAM_ISP_IFE_OUT_RES_PDAF:
+		return "PDAF";
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+		return "RDI_0";
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+		return "RDI_1";
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+		return "RDI_2";
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+		return "RDI_3";
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BE:
+		return "STATS_HDR_BE";
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST:
+		return "STATS_HDR_BHIST";
+	case CAM_ISP_IFE_OUT_RES_STATS_TL_BG:
+		return "STATS_TL_BG";
+	case CAM_ISP_IFE_OUT_RES_STATS_BF:
+		return "STATS_BF";
+	case CAM_ISP_IFE_OUT_RES_STATS_AWB_BG:
+		return "STATS_AWB_BG";
+	case CAM_ISP_IFE_OUT_RES_STATS_BHIST:
+		return "STATS_BHIST";
+	case CAM_ISP_IFE_OUT_RES_STATS_RS:
+		return "STATS_RS";
+	case CAM_ISP_IFE_OUT_RES_STATS_CS:
+		return "STATS_CS";
+	case CAM_ISP_IFE_OUT_RES_STATS_IHIST:
+		return "STATS_IHIST";
+	case CAM_ISP_IFE_OUT_RES_FULL_DISP:
+		return "FULL_DISP";
+	case CAM_ISP_IFE_OUT_RES_DS4_DISP:
+		return "DS4_DISP";
+	case CAM_ISP_IFE_OUT_RES_DS16_DISP:
+		return "DS16_DISP";
+	case CAM_ISP_IFE_OUT_RES_2PD:
+		return "2PD";
+	case CAM_ISP_IFE_OUT_RES_RDI_RD:
+		return "RDI_RD";
+	case CAM_ISP_IFE_OUT_RES_LCR:
+		return "LCR";
+	case CAM_ISP_IFE_OUT_RES_AWB_BFW:
+		return "AWB_BFW";
+	case CAM_ISP_IFE_OUT_RES_2PD_STATS:
+		return "2PD_STATS";
+	case CAM_ISP_IFE_OUT_RES_STATS_AEC_BE:
+		return "STATS_AEC_BE";
+	case CAM_ISP_IFE_OUT_RES_LTM_STATS:
+		return "LTM_STATS";
+	case CAM_ISP_IFE_OUT_RES_STATS_GTM_BHIST:
+		return "STATS_GTM_BHIST";
+	case CAM_ISP_IFE_LITE_OUT_RES_STATS_BE:
+		return "STATS_BE";
+	case CAM_ISP_IFE_LITE_OUT_RES_GAMMA:
+		return "GAMMA";
+	default:
+		return "CAM_ISP_Invalid_Resource_Type";
+	}
+}
+
+static const char *__cam_isp_tfe_resource_handle_id_to_type(
+	uint32_t resource_handle)
+{
+
+	switch (resource_handle) {
+	case CAM_ISP_TFE_OUT_RES_FULL:
+		return "FULL";
+	case CAM_ISP_TFE_OUT_RES_RAW_DUMP:
+		return "RAW_DUMP";
+	case CAM_ISP_TFE_OUT_RES_PDAF:
+		return "PDAF";
+	case CAM_ISP_TFE_OUT_RES_RDI_0:
+		return "RDI_0";
+	case CAM_ISP_TFE_OUT_RES_RDI_1:
+		return "RDI_1";
+	case CAM_ISP_TFE_OUT_RES_RDI_2:
+		return "RDI_2";
+	case CAM_ISP_TFE_OUT_RES_STATS_HDR_BE:
+		return "STATS_HDR_BE";
+	case CAM_ISP_TFE_OUT_RES_STATS_HDR_BHIST:
+		return "STATS_HDR_BHIST";
+	case CAM_ISP_TFE_OUT_RES_STATS_TL_BG:
+		return "STATS_TL_BG";
+	case CAM_ISP_TFE_OUT_RES_STATS_BF:
+		return "STATS_BF";
+	case CAM_ISP_TFE_OUT_RES_STATS_AWB_BG:
+		return "STATS_AWB_BG";
+	default:
+		return "CAM_ISP_Invalid_Resource_Type";
+	}
+}
+
+static uint64_t __cam_isp_ctx_get_event_ts(uint32_t evt_id, void *evt_data)
+{
+	uint64_t ts = 0;
+
+	if (!evt_data)
+		return 0;
+
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_ERROR:
+		ts = ((struct cam_isp_hw_error_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_SOF:
+		ts = ((struct cam_isp_hw_sof_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		ts = ((struct cam_isp_hw_reg_update_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_EPOCH:
+		ts = ((struct cam_isp_hw_epoch_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_EOF:
+		ts = ((struct cam_isp_hw_eof_event_data *)evt_data)->
+			timestamp;
+		break;
+	case CAM_ISP_HW_EVENT_DONE:
+		break;
+	default:
+		CAM_DBG(CAM_ISP, "Invalid Event Type %d", evt_id);
+	}
+
+	return ts;
+}
+
+static void __cam_isp_ctx_send_sof_boot_timestamp(
+	struct cam_isp_context *ctx_isp, uint64_t request_id,
+	uint32_t sof_event_status)
+{
+	struct cam_req_mgr_message   req_msg;
+
+	req_msg.session_hdl = ctx_isp->base->session_hdl;
+	req_msg.u.frame_msg.frame_id = ctx_isp->frame_id;
+	req_msg.u.frame_msg.request_id = request_id;
+	req_msg.u.frame_msg.timestamp = ctx_isp->boot_timestamp;
+	req_msg.u.frame_msg.link_hdl = ctx_isp->base->link_hdl;
+	req_msg.u.frame_msg.sof_status = sof_event_status;
+	req_msg.u.frame_msg.frame_id_meta = ctx_isp->frame_id_meta;
+
+	CAM_DBG(CAM_ISP,
+		"request id:%lld frame number:%lld boot time stamp:0x%llx status:%u",
+		 request_id, ctx_isp->frame_id,
+		 ctx_isp->boot_timestamp, sof_event_status);
+
+	if (cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_SOF_BOOT_TS,
+		V4L_EVENT_CAM_REQ_MGR_EVENT))
+		CAM_ERR(CAM_ISP,
+			"Error in notifying the boot time for req id:%lld",
+			request_id);
+}
+
+static void __cam_isp_ctx_send_sof_timestamp_frame_header(
+	struct cam_isp_context *ctx_isp, uint32_t *frame_header_cpu_addr,
+	uint64_t request_id, uint32_t sof_event_status)
+{
+	uint32_t *time32 = NULL;
+	uint64_t timestamp = 0;
+	struct cam_req_mgr_message   req_msg;
+
+	time32 = frame_header_cpu_addr;
+	timestamp = (uint64_t) time32[1];
+	timestamp = timestamp << 24;
+	timestamp |= (uint64_t)(time32[0] >> 8);
+	timestamp = mul_u64_u32_div(timestamp,
+			CAM_IFE_QTIMER_MUL_FACTOR,
+			CAM_IFE_QTIMER_DIV_FACTOR);
+
+	ctx_isp->sof_timestamp_val = timestamp;
+	req_msg.session_hdl = ctx_isp->base->session_hdl;
+	req_msg.u.frame_msg.frame_id = ctx_isp->frame_id;
+	req_msg.u.frame_msg.request_id = request_id;
+	req_msg.u.frame_msg.timestamp = ctx_isp->sof_timestamp_val;
+	req_msg.u.frame_msg.link_hdl = ctx_isp->base->link_hdl;
+	req_msg.u.frame_msg.sof_status = sof_event_status;
+
+	CAM_DBG(CAM_ISP,
+		"request id:%lld frame number:%lld SOF time stamp:0x%llx status:%u",
+		 request_id, ctx_isp->frame_id,
+		ctx_isp->sof_timestamp_val, sof_event_status);
+
+	if (cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_SOF, V4L_EVENT_CAM_REQ_MGR_EVENT))
+		CAM_ERR(CAM_ISP,
+			"Error in notifying the sof time for req id:%lld",
+			request_id);
+}
+
+static void __cam_isp_ctx_send_sof_timestamp(
+	struct cam_isp_context *ctx_isp, uint64_t request_id,
+	uint32_t sof_event_status)
+{
+	struct cam_req_mgr_message   req_msg;
+
+	if ((ctx_isp->use_frame_header_ts) || (request_id == 0))
+		goto end;
+
+	req_msg.session_hdl = ctx_isp->base->session_hdl;
+	req_msg.u.frame_msg.frame_id = ctx_isp->frame_id;
+	req_msg.u.frame_msg.request_id = request_id;
+	req_msg.u.frame_msg.timestamp = ctx_isp->sof_timestamp_val;
+	req_msg.u.frame_msg.link_hdl = ctx_isp->base->link_hdl;
+	req_msg.u.frame_msg.sof_status = sof_event_status;
+	req_msg.u.frame_msg.frame_id_meta = ctx_isp->frame_id_meta;
+
+	CAM_DBG(CAM_ISP,
+		"request id:%lld frame number:%lld SOF time stamp:0x%llx status:%u",
+		 request_id, ctx_isp->frame_id,
+		ctx_isp->sof_timestamp_val, sof_event_status);
+
+	if (cam_req_mgr_notify_message(&req_msg,
+		V4L_EVENT_CAM_REQ_MGR_SOF, V4L_EVENT_CAM_REQ_MGR_EVENT))
+		CAM_ERR(CAM_ISP,
+			"Error in notifying the sof time for req id:%lld",
+			request_id);
+
+end:
+	__cam_isp_ctx_send_sof_boot_timestamp(ctx_isp,
+		request_id, sof_event_status);
+}
+
+static void __cam_isp_ctx_handle_buf_done_fail_log(
+	uint64_t request_id, struct cam_isp_ctx_req *req_isp,
+	uint32_t isp_device_type)
+{
+	int i;
+	const char *handle_type;
+
+	if (req_isp->num_fence_map_out >= CAM_ISP_CTX_RES_MAX) {
+		CAM_ERR(CAM_ISP,
+			"Num Resources exceed mMAX %d >= %d ",
+			req_isp->num_fence_map_out, CAM_ISP_CTX_RES_MAX);
+		return;
+	}
+
+	CAM_WARN_RATE_LIMIT(CAM_ISP,
+		"Prev Req[%lld] : num_out=%d, num_acked=%d, bubble : report=%d, detected=%d",
+		request_id, req_isp->num_fence_map_out, req_isp->num_acked,
+		req_isp->bubble_report, req_isp->bubble_detected);
+	CAM_WARN_RATE_LIMIT(CAM_ISP,
+		"Resource Handles that fail to generate buf_done in prev frame");
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		if (req_isp->fence_map_out[i].sync_id != -1) {
+			if (isp_device_type == CAM_IFE_DEVICE_TYPE) {
+				handle_type =
+				__cam_isp_resource_handle_id_to_type(
+				req_isp->fence_map_out[i].resource_handle);
+
+				trace_cam_log_event("Buf_done Congestion",
+				__cam_isp_resource_handle_id_to_type(
+				req_isp->fence_map_out[i].resource_handle),
+				request_id, req_isp->fence_map_out[i].sync_id);
+			} else {
+				handle_type =
+				__cam_isp_tfe_resource_handle_id_to_type(
+				req_isp->fence_map_out[i].resource_handle);
+
+				trace_cam_log_event("Buf_done Congestion",
+				__cam_isp_tfe_resource_handle_id_to_type(
+				req_isp->fence_map_out[i].resource_handle),
+				request_id, req_isp->fence_map_out[i].sync_id);
+			}
+
+			CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Resource_Handle: [%s][0x%x] Sync_ID: [0x%x]",
+			handle_type,
+			req_isp->fence_map_out[i].resource_handle,
+			req_isp->fence_map_out[i].sync_id);
+		}
+	}
+}
+
+static int __cam_isp_ctx_handle_buf_done_for_req_list(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request *req)
+{
+	int rc = 0, i;
+	uint64_t buf_done_req_id;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	ctx_isp->active_req_cnt--;
+	buf_done_req_id = req->request_id;
+
+	if (req_isp->bubble_detected && req_isp->bubble_report) {
+		req_isp->num_acked = 0;
+		req_isp->num_deferred_acks = 0;
+		req_isp->bubble_detected = false;
+		list_del_init(&req->list);
+		atomic_set(&ctx_isp->process_bubble, 0);
+		req_isp->cdm_reset_before_apply = false;
+		ctx_isp->bubble_frame_cnt = 0;
+
+		if (buf_done_req_id <= ctx->last_flush_req) {
+			for (i = 0; i < req_isp->num_fence_map_out; i++)
+				rc = cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+
+			list_add_tail(&req->list, &ctx->free_req_list);
+			CAM_DBG(CAM_REQ,
+				"Move active request %lld to free list(cnt = %d) [flushed], ctx %u",
+				buf_done_req_id, ctx_isp->active_req_cnt,
+				ctx->ctx_id);
+			ctx_isp->last_bufdone_err_apply_req_id = 0;
+		} else {
+			list_add(&req->list, &ctx->pending_req_list);
+			CAM_DBG(CAM_REQ,
+				"Move active request %lld to pending list(cnt = %d) [bubble recovery], ctx %u",
+				req->request_id, ctx_isp->active_req_cnt,
+				ctx->ctx_id);
+		}
+	} else {
+		if (!ctx_isp->use_frame_header_ts) {
+			if (ctx_isp->reported_req_id < buf_done_req_id) {
+				ctx_isp->reported_req_id = buf_done_req_id;
+				__cam_isp_ctx_send_sof_timestamp(ctx_isp,
+					buf_done_req_id,
+					CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+			}
+		}
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->free_req_list);
+		req_isp->reapply = false;
+		req_isp->cdm_reset_before_apply = false;
+		req_isp->num_acked = 0;
+		req_isp->num_deferred_acks = 0;
+		/*
+		 * Only update the process_bubble and bubble_frame_cnt
+		 * when bubble is detected on this req, in case the other
+		 * request is processing bubble.
+		 */
+		if (req_isp->bubble_detected) {
+			atomic_set(&ctx_isp->process_bubble, 0);
+			ctx_isp->bubble_frame_cnt = 0;
+			req_isp->bubble_detected = false;
+		}
+
+		CAM_DBG(CAM_REQ,
+			"Move active request %lld to free list(cnt = %d) [all fences done], ctx %u",
+			buf_done_req_id, ctx_isp->active_req_cnt, ctx->ctx_id);
+		ctx_isp->req_info.last_bufdone_req_id = req->request_id;
+		ctx_isp->last_bufdone_err_apply_req_id = 0;
+	}
+
+	cam_cpas_notify_event("IFE BufDone", buf_done_req_id);
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_DONE, buf_done_req_id);
+
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_BUFDONE, req);
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_early_buf_done(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request  *req)
+{
+	int i, rc = 0;
+
+	struct cam_isp_ctx_req *req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	struct cam_context *ctx = ctx_isp->base;
+
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		if (req_isp->early_fence_map_index[i] == 1) {
+			rc = cam_sync_signal(req_isp->fence_map_out[i].sync_id,
+				CAM_SYNC_STATE_SIGNALED_SUCCESS,
+				CAM_SYNC_COMMON_EVENT_SUCCESS);
+			req_isp->early_fence_map_index[i] = 0;
+			req_isp->fence_map_out[i].sync_id = -1;
+			CAM_DBG(CAM_ISP,
+				"Sync :req %lld res 0x%x fd 0x%x idx %d ctx %u",
+				req->request_id,
+				req_isp->fence_map_out[i].resource_handle,
+				req_isp->fence_map_out[i].sync_id, i,
+				ctx->ctx_id);
+			req_isp->flag_sync_set = true;
+		}
+	}
+	return rc;
+}
+static int __cam_isp_ctx_handle_buf_done_for_request(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request  *req,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state,
+	struct cam_isp_hw_done_event_data *done_next_req)
+{
+	int rc = 0;
+	int i, j;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+	const char *handle_type;
+
+	trace_cam_buf_done("ISP", ctx, req);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	CAM_DBG(CAM_ISP,
+		"Enter with bubble_state %d, req_bubble_detected %d evt_param = %d",
+		bubble_state, req_isp->bubble_detected, done->evt_param);
+
+	done_next_req->num_handles = 0;
+	done_next_req->timestamp = done->timestamp;
+
+	for (i = 0; i < done->num_handles; i++) {
+		for (j = 0; j < req_isp->num_fence_map_out; j++) {
+			if (done->resource_handle[i] ==
+				req_isp->fence_map_out[j].resource_handle)
+				break;
+		}
+
+		if (j == req_isp->num_fence_map_out) {
+			/*
+			 * If not found in current request, it could be
+			 * belonging to next request, this can happen if
+			 * IRQ delay happens. It is only valid when the
+			 * platform doesn't have last consumed address.
+			 */
+			CAM_WARN(CAM_ISP,
+				"BUF_DONE for res %s not found in Req %lld ",
+				__cam_isp_resource_handle_id_to_type(
+				done->resource_handle[i]),
+				req->request_id);
+
+			done_next_req->resource_handle
+				[done_next_req->num_handles++] =
+				done->resource_handle[i];
+			continue;
+		}
+
+		if (req_isp->fence_map_out[j].sync_id == -1) {
+			if (ctx_isp->isp_device_type == CAM_IFE_DEVICE_TYPE)
+				handle_type =
+				__cam_isp_resource_handle_id_to_type(
+				req_isp->fence_map_out[i].resource_handle);
+			else
+				handle_type =
+				__cam_isp_tfe_resource_handle_id_to_type(
+				req_isp->fence_map_out[i].resource_handle);
+
+			CAM_WARN(CAM_ISP,
+				"Duplicate BUF_DONE for req %lld : i=%d, j=%d, res=%s",
+				req->request_id, i, j, handle_type);
+
+			trace_cam_log_event("Duplicate BufDone",
+				handle_type, req->request_id, ctx->ctx_id);
+
+			done_next_req->resource_handle
+				[done_next_req->num_handles++] =
+				done->resource_handle[i];
+			continue;
+		}
+
+		if (!req_isp->bubble_detected) {
+			/* Signal fence for early bufdones got during reapply of a bubble req*/
+			if ((req_isp->num_acked != 0) && (!req_isp->flag_sync_set)) {
+				rc = __cam_isp_ctx_handle_early_buf_done(ctx_isp, req);
+				if (rc)
+					CAM_ERR(CAM_ISP, "Sync early bufdone failed rc=%d", rc);
+			}
+
+			CAM_DBG(CAM_ISP,
+				"Sync with success: req %lld res 0x%x fd 0x%x, ctx %u, Bad_frame %u",
+				req->request_id,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id,
+				ctx->ctx_id, done->evt_param);
+
+			if (done->evt_param == 1) {
+
+				CAM_WARN(CAM_ISP,
+					"Bad frame Sync with success: req %lld res 0x%x fd 0x%x, ctx %u",
+					req->request_id,
+					req_isp->fence_map_out[j].resource_handle,
+					req_isp->fence_map_out[j].sync_id,
+					ctx->ctx_id);
+				rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+					CAM_SYNC_STATE_SIGNALED_SUCCESS,
+					CAM_SYNC_ISP_EVENT_BAD_FRAME);
+			} else {
+				rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+					CAM_SYNC_STATE_SIGNALED_SUCCESS,
+					CAM_SYNC_COMMON_EVENT_SUCCESS);
+			}
+			if (rc)
+				CAM_DBG(CAM_ISP, "Sync failed with rc = %d",
+					rc);
+		} else if (!req_isp->bubble_report) {
+			CAM_DBG(CAM_ISP,
+				"Sync with failure: req %lld res 0x%x fd 0x%x, ctx %u",
+				req->request_id,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id,
+				ctx->ctx_id);
+
+			rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_ERROR,
+				CAM_SYNC_ISP_EVENT_BUBBLE);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Sync failed with rc = %d",
+					rc);
+		} else {
+			/*
+			 * Ignore the buffer done if bubble detect is on
+			 * Increment the ack number here, and queue the
+			 * request back to pending list whenever all the
+			 * buffers are done.
+			 */
+			req_isp->num_acked++;
+			CAM_DBG(CAM_ISP,
+				"buf done with bubble state %d recovery %d num_acked %d ctx %u",
+				bubble_state, req_isp->bubble_report,
+				req_isp->num_acked, ctx->ctx_id);
+			continue;
+		}
+
+		if (!rc) {
+			req_isp->num_acked++;
+			req_isp->fence_map_out[j].sync_id = -1;
+		}
+		CAM_DBG(CAM_ISP, "rc %d num_acked %d req %lld, reset sync id 0x%x ctx %u",
+			rc, req_isp->num_acked, req->request_id,
+			req_isp->fence_map_out[j].sync_id, ctx->ctx_id);
+
+		if ((ctx_isp->use_frame_header_ts) &&
+			(req_isp->hw_update_data.frame_header_res_id ==
+			req_isp->fence_map_out[j].resource_handle))
+			__cam_isp_ctx_send_sof_timestamp_frame_header(
+				ctx_isp,
+				req_isp->hw_update_data.frame_header_cpu_addr,
+				req->request_id, CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	}
+
+	if (req_isp->num_acked > req_isp->num_fence_map_out) {
+		/* Should not happen */
+		CAM_ERR(CAM_ISP,
+			"WARNING: req_id %lld num_acked %d > map_out %d, ctx %u",
+			req->request_id, req_isp->num_acked,
+			req_isp->num_fence_map_out, ctx->ctx_id);
+		WARN_ON(req_isp->num_acked > req_isp->num_fence_map_out);
+	}
+
+	if (req_isp->num_acked != req_isp->num_fence_map_out)
+		return rc;
+
+	rc = __cam_isp_ctx_handle_buf_done_for_req_list(ctx_isp, req);
+	return rc;
+}
+
+static int __cam_isp_handle_deferred_buf_done(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request  *req,
+	bool bubble_handling,
+	uint32_t status, uint32_t event_cause)
+{
+	int i, j;
+	int rc = 0;
+	struct cam_isp_ctx_req *req_isp =
+		(struct cam_isp_ctx_req *) req->req_priv;
+	struct cam_context *ctx = ctx_isp->base;
+
+	CAM_DBG(CAM_ISP,
+		"ctx[%d] : Req %llu : Handling %d deferred buf_dones num_acked=%d, bubble_handling=%d",
+		ctx->ctx_id, req->request_id, req_isp->num_deferred_acks,
+		req_isp->num_acked, bubble_handling);
+
+	for (i = 0; i < req_isp->num_deferred_acks; i++) {
+		j = req_isp->deferred_fence_map_index[i];
+
+		CAM_DBG(CAM_ISP,
+			"ctx[%d] : Sync with status=%d, event_cause=%d: req %lld res 0x%x sync_id 0x%x",
+			ctx->ctx_id, status, event_cause,
+			req->request_id,
+			req_isp->fence_map_out[j].resource_handle,
+			req_isp->fence_map_out[j].sync_id);
+
+		if (req_isp->fence_map_out[j].sync_id == -1) {
+			CAM_WARN(CAM_ISP,
+				"ctx[%d Deferred buf_done already signalled, req_id=%llu, j=%d, res=0x%x",
+				ctx->ctx_id, req->request_id, j,
+				req_isp->fence_map_out[j].resource_handle);
+			continue;
+		}
+
+		if (!bubble_handling) {
+			CAM_WARN(CAM_ISP,
+				"ctx[%d] : Req %llu, status=%d res=0x%x should never happen",
+				ctx->ctx_id, req->request_id, status,
+				req_isp->fence_map_out[j].resource_handle);
+
+			rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+				status, event_cause);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"ctx[%d] : Sync signal for Req %llu, sync_id %d status=%d failed with rc = %d",
+					ctx->ctx_id, req->request_id,
+					req_isp->fence_map_out[j].sync_id,
+					status, rc);
+			} else {
+				req_isp->num_acked++;
+				req_isp->fence_map_out[j].sync_id = -1;
+			}
+		} else {
+			req_isp->num_acked++;
+		}
+	}
+
+	req_isp->num_deferred_acks = 0;
+
+	return rc;
+}
+static int __cam_isp_ctx_handle_buf_done_for_request_verify_addr(
+	struct cam_isp_context *ctx_isp,
+	struct cam_ctx_request  *req,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state,
+	bool verify_consumed_addr,
+	bool defer_buf_done)
+{
+	int rc = 0;
+	int i, j;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+	const char *handle_type;
+	uint32_t event_cause = CAM_SYNC_COMMON_EVENT_SUCCESS;
+
+	trace_cam_buf_done("ISP", ctx, req);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	CAM_DBG(CAM_ISP,
+		"Enter with bubble_state %d, req_bubble_detected %d evt_param %d",
+		bubble_state, req_isp->bubble_detected, done->evt_param);
+
+	for (i = 0; i < done->num_handles; i++) {
+		for (j = 0; j < req_isp->num_fence_map_out; j++) {
+			if (verify_consumed_addr &&
+				(done->last_consumed_addr[i] !=
+				 req_isp->fence_map_out[j].image_buf_addr[0]))
+				continue;
+
+			if (done->resource_handle[i] ==
+				req_isp->fence_map_out[j].resource_handle)
+				break;
+		}
+
+		if (j == req_isp->num_fence_map_out) {
+			/*
+			 * If not found in current request, it could be
+			 * belonging to next request, this can happen if
+			 * IRQ delay happens. It is only valid when the
+			 * platform doesn't have last consumed address.
+			 */
+			CAM_DBG(CAM_ISP,
+				"BUF_DONE for res %s not found in Req %lld ",
+				__cam_isp_resource_handle_id_to_type(
+				done->resource_handle[i]),
+				req->request_id);
+			continue;
+		}
+
+		if (req_isp->fence_map_out[j].sync_id == -1) {
+			if (ctx_isp->isp_device_type == CAM_IFE_DEVICE_TYPE)
+				handle_type =
+				__cam_isp_resource_handle_id_to_type(
+				req_isp->fence_map_out[i].resource_handle);
+			else
+				handle_type =
+				__cam_isp_tfe_resource_handle_id_to_type(
+				req_isp->fence_map_out[i].resource_handle);
+
+			CAM_WARN(CAM_ISP,
+				"Duplicate BUF_DONE for req %lld : i=%d, j=%d, res=%s",
+				req->request_id, i, j, handle_type);
+
+			trace_cam_log_event("Duplicate BufDone",
+				handle_type, req->request_id, ctx->ctx_id);
+			continue;
+		}
+
+		if (defer_buf_done) {
+			uint32_t deferred_indx = req_isp->num_deferred_acks;
+
+			/*
+			 * If we are handling this BUF_DONE event for a request
+			 * that is still in wait_list, do not signal now,
+			 * instead mark it as done and handle it later -
+			 * if this request is going into BUBBLE state later
+			 * it will automatically be re-applied. If this is not
+			 * going into BUBBLE, signal fences later.
+			 * Note - we will come here only if the last consumed
+			 * address matches with this ports buffer.
+			 */
+			req_isp->deferred_fence_map_index[deferred_indx] = j;
+			req_isp->num_deferred_acks++;
+			CAM_DBG(CAM_ISP,
+				"ctx[%d] : Deferred buf done for %llu with bubble state %d recovery %d",
+				ctx->ctx_id, req->request_id, bubble_state,
+				req_isp->bubble_report);
+			CAM_DBG(CAM_ISP,
+				"ctx[%d] : Deferred info : num_acks=%d, fence_map_index=%d, resource_handle=0x%x, sync_id=%d",
+				ctx->ctx_id, req_isp->num_deferred_acks, j,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id);
+			continue;
+		} else if (!req_isp->bubble_detected) {
+			CAM_DBG(CAM_ISP,
+				"Sync with success: req %lld res 0x%x fd 0x%x, ctx %u isBadFrame %u",
+				req->request_id,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id,
+				ctx->ctx_id, done->evt_param);
+			if (done->evt_param == 1) {
+				CAM_WARN(CAM_ISP,
+					"Bad Frame Sync with success: req %lld res 0x%x fd 0x%x, ctx %u",
+					req->request_id,
+					req_isp->fence_map_out[j].resource_handle,
+					req_isp->fence_map_out[j].sync_id,
+					ctx->ctx_id);
+				rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+					CAM_SYNC_STATE_SIGNALED_SUCCESS,
+					CAM_SYNC_ISP_EVENT_BAD_FRAME);
+				event_cause = CAM_SYNC_ISP_EVENT_BAD_FRAME;
+			} else {
+				rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+					CAM_SYNC_STATE_SIGNALED_SUCCESS,
+					CAM_SYNC_COMMON_EVENT_SUCCESS);
+				event_cause = CAM_SYNC_COMMON_EVENT_SUCCESS;
+			}
+			if (rc) {
+				CAM_DBG(CAM_ISP, "Sync failed with rc = %d",
+				 rc);
+			} else if (req_isp->num_deferred_acks) {
+				/* Process deferred buf_done acks */
+				__cam_isp_handle_deferred_buf_done(ctx_isp,
+					req, false,
+					CAM_SYNC_STATE_SIGNALED_SUCCESS,
+					event_cause);
+			}
+		} else if (!req_isp->bubble_report) {
+			CAM_DBG(CAM_ISP,
+				"Sync with failure: req %lld res 0x%x fd 0x%x, ctx %u",
+				req->request_id,
+				req_isp->fence_map_out[j].resource_handle,
+				req_isp->fence_map_out[j].sync_id,
+				ctx->ctx_id);
+
+			rc = cam_sync_signal(req_isp->fence_map_out[j].sync_id,
+				CAM_SYNC_STATE_SIGNALED_ERROR,
+				CAM_SYNC_ISP_EVENT_BUBBLE);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Sync failed with rc = %d",
+					rc);
+			} else if (req_isp->num_deferred_acks) {
+				/* Process deferred buf_done acks */
+				__cam_isp_handle_deferred_buf_done(ctx_isp, req,
+					false,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+			}
+		} else {
+			/*
+			 * Ignore the buffer done if bubble detect is on
+			 * Increment the ack number here, and queue the
+			 * request back to pending list whenever all the
+			 * buffers are done.
+			 */
+			req_isp->num_acked++;
+			CAM_DBG(CAM_ISP,
+				"num_acked %d buf done with bubble state %d recovery %d ctx %d",
+				req_isp->num_acked, bubble_state,
+				req_isp->bubble_report,
+				ctx->ctx_id);
+				/* Process deferred buf_done acks */
+
+			if (req_isp->num_deferred_acks)
+				__cam_isp_handle_deferred_buf_done(ctx_isp, req,
+					true,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+
+			continue;
+		}
+
+		if (!rc) {
+			req_isp->num_acked++;
+			req_isp->fence_map_out[j].sync_id = -1;
+		}
+		CAM_DBG(CAM_ISP, "num_acked %d req %lld, reset sync id 0x%x ctx %u",
+			req_isp->num_acked, req->request_id,
+			req_isp->fence_map_out[j].sync_id, ctx->ctx_id);
+
+		if ((ctx_isp->use_frame_header_ts) &&
+			(req_isp->hw_update_data.frame_header_res_id ==
+			req_isp->fence_map_out[j].resource_handle))
+			__cam_isp_ctx_send_sof_timestamp_frame_header(
+				ctx_isp,
+				req_isp->hw_update_data.frame_header_cpu_addr,
+				req->request_id, CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	}
+
+	if (req_isp->num_acked > req_isp->num_fence_map_out) {
+		/* Should not happen */
+		CAM_ERR(CAM_ISP,
+			"WARNING: req_id %lld num_acked %d > map_out %d, ctx %u",
+			req->request_id, req_isp->num_acked,
+			req_isp->num_fence_map_out, ctx->ctx_id);
+	}
+
+	if (req_isp->num_acked != req_isp->num_fence_map_out)
+		return rc;
+
+	rc = __cam_isp_ctx_handle_buf_done_for_req_list(ctx_isp, req);
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_buf_done(
+	struct cam_isp_context *ctx_isp,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state)
+{
+	int rc = 0;
+	struct cam_ctx_request *req;
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_isp_hw_done_event_data done_next_req;
+	int i, j;
+
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_WARN(CAM_ISP, "Buf done with no active request");
+
+		if (!list_empty(&ctx->wait_req_list)) {
+			struct cam_isp_ctx_req *req_isp;
+
+			req = list_first_entry(&ctx->wait_req_list,
+					struct cam_ctx_request, list);
+
+			if (ctx_isp->last_applied_req_id !=
+				ctx_isp->last_bufdone_err_apply_req_id) {
+				CAM_WARN(CAM_ISP,
+					"Buf done with req %llu in wait list apply id:%lld last err id:%lld",
+					req->request_id,
+					ctx_isp->last_applied_req_id,
+					ctx_isp->last_bufdone_err_apply_req_id);
+				ctx_isp->last_bufdone_err_apply_req_id =
+					ctx_isp->last_applied_req_id;
+			}
+
+			req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+			/*
+			 * do not signal the fence as this request may go into
+			 * Bubble state eventually.
+			 */
+			for (i = 0; i < done->num_handles; i++) {
+				for (j = 0; j < req_isp->num_fence_map_out; j++) {
+					if (done->resource_handle[i] ==
+						req_isp->fence_map_out[j].resource_handle) {
+						req_isp->num_acked++;
+						/*
+						 * save the fence map out index for signalling
+						 * fence during re-apply of bubble request.
+						 */
+						req_isp->early_fence_map_index[j]++;
+
+						CAM_WARN(CAM_ISP, "Early done req %lld res 0x%x",
+							req->request_id,
+							done->resource_handle[i]);
+
+						CAM_WARN(CAM_ISP, "ctx %u ack %d total %d idx %d",
+							ctx->ctx_id,
+							req_isp->num_acked,
+							req_isp->num_fence_map_out, j);
+						break;
+					}
+				}
+			}
+		} else {
+			CAM_WARN(CAM_ISP, "Buf done with no request in wait as well");
+		}
+		return 0;
+	}
+
+	req = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+
+	rc = __cam_isp_ctx_handle_buf_done_for_request(ctx_isp, req, done,
+		bubble_state, &done_next_req);
+
+	if (done_next_req.num_handles) {
+		struct cam_isp_hw_done_event_data unhandled_res;
+		struct cam_ctx_request  *next_req = list_last_entry(
+			&ctx->active_req_list, struct cam_ctx_request, list);
+
+		if (next_req->request_id != req->request_id) {
+			/*
+			 * Few resource handles are already signalled in the
+			 * current request, lets check if there is another
+			 * request waiting for these resources. This can
+			 * happen if handling some of next request's buf done
+			 * events are happening first before handling current
+			 * request's remaining buf dones due to IRQ scheduling.
+			 * Lets check only one more request as we will have
+			 * maximum of 2 requests in active_list at any time.
+			 */
+
+			CAM_WARN(CAM_ISP,
+				"Unhandled buf done resources for req %lld, trying next request %lld in active_list",
+				req->request_id, next_req->request_id);
+
+			__cam_isp_ctx_handle_buf_done_for_request(ctx_isp,
+				next_req, &done_next_req,
+				bubble_state, &unhandled_res);
+
+			if (unhandled_res.num_handles == 0)
+				CAM_INFO(CAM_ISP,
+					"BUF Done event handed for next request %lld",
+					next_req->request_id);
+			else
+				CAM_ERR(CAM_ISP,
+					"BUF Done not handled for next request %lld",
+					next_req->request_id);
+		} else {
+			CAM_WARN(CAM_ISP,
+				"Req %lld only active request, spurious buf_done rxd",
+				req->request_id);
+		}
+	}
+
+	return rc;
+}
+
+static void __cam_isp_ctx_buf_done_match_req(
+	struct cam_ctx_request *req,
+	struct cam_isp_hw_done_event_data *done,
+	bool *irq_delay_detected)
+{
+	int i, j;
+	uint32_t match_count = 0;
+	struct cam_isp_ctx_req *req_isp;
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	for (i = 0; i < done->num_handles; i++) {
+		for (j = 0; j < req_isp->num_fence_map_out; j++) {
+			if ((done->resource_handle[i] ==
+				 req_isp->fence_map_out[j].resource_handle) &&
+				(done->last_consumed_addr[i] ==
+				 req_isp->fence_map_out[j].image_buf_addr[0])) {
+				match_count++;
+				break;
+			}
+		}
+	}
+
+	if (match_count > 0)
+		*irq_delay_detected = true;
+	else
+		*irq_delay_detected = false;
+
+	CAM_DBG(CAM_ISP,
+		"buf done num handles %d match count %d for next req:%lld",
+		done->num_handles, match_count, req->request_id);
+	CAM_DBG(CAM_ISP,
+		"irq_delay_detected %d", *irq_delay_detected);
+}
+
+static int __cam_isp_ctx_handle_buf_done_verify_addr(
+	struct cam_isp_context *ctx_isp,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state)
+{
+	int rc = 0;
+	bool irq_delay_detected = false;
+	struct cam_ctx_request *req;
+	struct cam_ctx_request *next_req = NULL;
+	struct cam_context *ctx = ctx_isp->base;
+	bool  req_in_wait_list = false;
+
+	if (list_empty(&ctx->active_req_list)) {
+
+		if (!list_empty(&ctx->wait_req_list)) {
+			struct cam_isp_ctx_req *req_isp;
+
+			req = list_first_entry(&ctx->wait_req_list,
+				struct cam_ctx_request, list);
+
+			req_in_wait_list = true;
+			if (ctx_isp->last_applied_req_id !=
+				ctx_isp->last_bufdone_err_apply_req_id) {
+				CAM_WARN(CAM_ISP,
+					"Buf done with no active request but with req in wait list, req %llu last apply id:%lld last err id:%lld",
+					req->request_id,
+					ctx_isp->last_applied_req_id,
+					ctx_isp->last_bufdone_err_apply_req_id);
+				ctx_isp->last_bufdone_err_apply_req_id =
+					ctx_isp->last_applied_req_id;
+			}
+
+			req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+			/*
+			 * Verify consumed address for this request to make sure
+			 * we are handling the buf_done for the correct
+			 * buffer. Also defer actual buf_done handling, i.e
+			 * do not signal the fence as this request may go into
+			 * Bubble state eventully.
+			 */
+			rc =
+			__cam_isp_ctx_handle_buf_done_for_request_verify_addr(
+				ctx_isp, req, done, bubble_state, true, true);
+		}
+
+		if (!req_in_wait_list  && (ctx_isp->last_applied_req_id !=
+			ctx_isp->last_bufdone_err_apply_req_id)) {
+			CAM_WARN(CAM_ISP,
+				"Buf done with no active request bubble_state=%d last_applied_req_id:%lld ",
+				bubble_state, ctx_isp->last_applied_req_id);
+			ctx_isp->last_bufdone_err_apply_req_id =
+					ctx_isp->last_applied_req_id;
+		}
+		return 0;
+	}
+
+	req = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+
+	if (ctx_isp->active_req_cnt > 1) {
+		next_req = list_last_entry(
+			&ctx->active_req_list,
+			struct cam_ctx_request, list);
+
+		if (next_req->request_id != req->request_id)
+			__cam_isp_ctx_buf_done_match_req(next_req, done,
+				&irq_delay_detected);
+		else
+			CAM_WARN(CAM_ISP,
+				"Req %lld only active request, spurious buf_done rxd",
+				req->request_id);
+	}
+
+	/*
+	 * If irq delay isn't detected, then we need to verify
+	 * the consumed address for current req, otherwise, we
+	 * can't verify the consumed address.
+	 */
+	rc = __cam_isp_ctx_handle_buf_done_for_request_verify_addr(
+		ctx_isp, req, done, bubble_state,
+		!irq_delay_detected, false);
+
+	/*
+	 * Verify the consumed address for next req all the time,
+	 * since the reported buf done event may belong to current
+	 * req, then we can't signal this event for next req.
+	 */
+	if (!rc && irq_delay_detected)
+		rc = __cam_isp_ctx_handle_buf_done_for_request_verify_addr(
+			ctx_isp, next_req, done,
+			bubble_state, true, false);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_buf_done_in_activated_state(
+	struct cam_isp_context *ctx_isp,
+	struct cam_isp_hw_done_event_data *done,
+	uint32_t bubble_state)
+{
+	int rc = 0;
+
+	if (ctx_isp->support_consumed_addr)
+		rc = __cam_isp_ctx_handle_buf_done_verify_addr(
+			ctx_isp, done, bubble_state);
+	else
+		rc = __cam_isp_ctx_handle_buf_done(
+			ctx_isp, done, bubble_state);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_req_offline(
+	void *priv, void *data)
+{
+	int rc = 0;
+	int64_t prev_applied_req;
+	struct cam_context *ctx = NULL;
+	struct cam_isp_context *ctx_isp = priv;
+	struct cam_ctx_request *req;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_hw_config_args cfg;
+
+	if (!ctx_isp) {
+		CAM_ERR(CAM_ISP, "Invalid ctx_isp:%pK", ctx);
+		rc = -EINVAL;
+		goto end;
+	}
+	ctx = ctx_isp->base;
+
+	if (list_empty(&ctx->pending_req_list)) {
+		CAM_DBG(CAM_ISP, "No pending requests to apply");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if ((ctx->state != CAM_CTX_ACTIVATED) ||
+		(!atomic_read(&ctx_isp->rxd_epoch)) ||
+		(ctx_isp->substate_activated == CAM_ISP_CTX_ACTIVATED_APPLIED))
+		goto end;
+
+	if (ctx_isp->active_req_cnt >= 2)
+		goto end;
+
+	spin_lock_bh(&ctx->lock);
+	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+		list);
+	spin_unlock_bh(&ctx->lock);
+
+	CAM_DBG(CAM_REQ, "Apply request %lld in substate %d ctx %u",
+		req->request_id, ctx_isp->substate_activated, ctx->ctx_id);
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	memset(&cfg, 0, sizeof(cfg));
+
+	cfg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	cfg.request_id = req->request_id;
+	cfg.hw_update_entries = req_isp->cfg;
+	cfg.num_hw_update_entries = req_isp->num_cfg;
+	cfg.priv  = &req_isp->hw_update_data;
+	cfg.init_packet = 0;
+
+	/*
+	 * Offline mode may receive the SOF and REG_UPD earlier than
+	 * CDM processing return back, so we set the substate before
+	 * apply setting.
+	 */
+	spin_lock_bh(&ctx->lock);
+
+	atomic_set(&ctx_isp->rxd_epoch, 0);
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_APPLIED;
+	prev_applied_req = ctx_isp->last_applied_req_id;
+	ctx_isp->last_applied_req_id = req->request_id;
+	atomic_set(&ctx_isp->apply_in_progress, 1);
+
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->wait_req_list);
+
+	spin_unlock_bh(&ctx->lock);
+
+	rc = ctx->hw_mgr_intf->hw_config(ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Can not apply the configuration");
+		spin_lock_bh(&ctx->lock);
+
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+		ctx_isp->last_applied_req_id = prev_applied_req;
+		atomic_set(&ctx_isp->apply_in_progress, 0);
+
+		list_del_init(&req->list);
+		list_add(&req->list, &ctx->pending_req_list);
+
+		spin_unlock_bh(&ctx->lock);
+	} else {
+		atomic_set(&ctx_isp->apply_in_progress, 0);
+		CAM_DBG(CAM_ISP, "New substate state %d, applied req %lld",
+			CAM_ISP_CTX_ACTIVATED_APPLIED,
+			ctx_isp->last_applied_req_id);
+
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_APPLIED,
+			req->request_id);
+	}
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_schedule_apply_req_offline(
+	struct cam_isp_context *ctx_isp)
+{
+	int rc = 0;
+	struct crm_workq_task *task;
+
+	task = cam_req_mgr_workq_get_task(ctx_isp->workq);
+	if (!task) {
+		CAM_ERR(CAM_ISP, "No task for worker");
+		return -ENOMEM;
+	}
+
+	task->process_cb = __cam_isp_ctx_apply_req_offline;
+	rc = cam_req_mgr_workq_enqueue_task(task, ctx_isp, CRM_TASK_PRIORITY_0);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to schedule task rc:%d", rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_offline_epoch_in_activated_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_ctx_request *req, *req_temp;
+	uint64_t request_id = 0;
+
+	atomic_set(&ctx_isp->rxd_epoch, 1);
+
+	CAM_DBG(CAM_ISP, "SOF frame %lld ctx %u", ctx_isp->frame_id,
+		ctx->ctx_id);
+
+	list_for_each_entry_safe(req, req_temp, &ctx->active_req_list, list) {
+		if (req->request_id > ctx_isp->reported_req_id) {
+			request_id = req->request_id;
+			ctx_isp->reported_req_id = request_id;
+			break;
+		}
+	}
+
+	__cam_isp_ctx_schedule_apply_req_offline(ctx_isp);
+
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH,
+		request_id);
+
+	return 0;
+}
+
+static int __cam_isp_ctx_reg_upd_in_epoch_bubble_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	if (ctx_isp->frame_id == 1)
+		CAM_DBG(CAM_ISP, "Reg update in Substate[%s] for early PCR",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated));
+	else
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%d Unexpected reg update in activated Substate[%s] for frame_id:%lld",
+			ctx_isp->base->ctx_id,
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated),
+			ctx_isp->frame_id);
+	return 0;
+}
+
+static int __cam_isp_ctx_reg_upd_in_applied_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_ctx_request  *req;
+	struct cam_context      *ctx = ctx_isp->base;
+	struct cam_isp_ctx_req  *req_isp;
+	uint64_t                 request_id = 0;
+
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request");
+		goto end;
+	}
+	req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+	list_del_init(&req->list);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	if (req_isp->num_fence_map_out != 0) {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		request_id = req->request_id;
+		CAM_DBG(CAM_REQ,
+			"move request %lld to active list(cnt = %d), ctx %u",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_RUP, req);
+	} else {
+		/* no io config, so the request is completed. */
+		list_add_tail(&req->list, &ctx->free_req_list);
+		CAM_DBG(CAM_ISP,
+			"move active request %lld to free list(cnt = %d), ctx %u",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
+	}
+
+	/*
+	 * This function only called directly from applied and bubble applied
+	 * state so change substate here.
+	 */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE, request_id);
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_notify_sof_in_activated_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	uint64_t  request_id  = 0;
+	struct cam_req_mgr_trigger_notify  notify;
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_ctx_request  *req;
+	struct cam_isp_ctx_req  *req_isp;
+	struct cam_hw_cmd_args   hw_cmd_args;
+	struct cam_isp_hw_cmd_args  isp_hw_cmd_args;
+	uint64_t last_cdm_done_req = 0;
+	struct cam_isp_hw_epoch_event_data *epoch_done_event_data =
+			(struct cam_isp_hw_epoch_event_data *)evt_data;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "invalid event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id_meta = epoch_done_event_data->frame_id_meta;
+
+	if (atomic_read(&ctx_isp->process_bubble)) {
+		if (list_empty(&ctx->active_req_list)) {
+			CAM_ERR(CAM_ISP,
+				"No available active req in bubble");
+			atomic_set(&ctx_isp->process_bubble, 0);
+			ctx_isp->bubble_frame_cnt = 0;
+			rc = -EINVAL;
+			return rc;
+		}
+
+		if (ctx_isp->last_sof_timestamp ==
+			ctx_isp->sof_timestamp_val) {
+			CAM_DBG(CAM_ISP,
+				"Tasklet delay detected! Bubble frame check skipped, sof_timestamp: %lld",
+				ctx_isp->sof_timestamp_val);
+			goto notify_only;
+		}
+
+		req = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+		if (ctx_isp->bubble_frame_cnt >= 1 &&
+			req_isp->bubble_detected) {
+			hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+			hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+			isp_hw_cmd_args.cmd_type =
+				CAM_ISP_HW_MGR_GET_LAST_CDM_DONE;
+			hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+			rc = ctx->hw_mgr_intf->hw_cmd(
+				ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "HW command failed");
+				return rc;
+			}
+
+			last_cdm_done_req = isp_hw_cmd_args.u.last_cdm_done;
+			CAM_DBG(CAM_ISP, "last_cdm_done req: %d",
+				last_cdm_done_req);
+
+			if (last_cdm_done_req >= req->request_id) {
+				CAM_DBG(CAM_ISP,
+					"CDM callback detected for req: %lld, possible buf_done delay, waiting for buf_done",
+					req->request_id);
+				ctx_isp->bubble_frame_cnt = 0;
+			} else {
+				CAM_DBG(CAM_ISP,
+					"CDM callback not happened for req: %lld, possible CDM stuck or workqueue delay",
+					req->request_id);
+				req_isp->num_acked = 0;
+				req_isp->num_deferred_acks = 0;
+				ctx_isp->bubble_frame_cnt = 0;
+				req_isp->bubble_detected = false;
+				req_isp->cdm_reset_before_apply = true;
+				list_del_init(&req->list);
+				list_add(&req->list, &ctx->pending_req_list);
+				atomic_set(&ctx_isp->process_bubble, 0);
+				ctx_isp->active_req_cnt--;
+				CAM_DBG(CAM_REQ,
+					"Move active req: %lld to pending list(cnt = %d) [bubble re-apply],ctx %u",
+					req->request_id,
+					ctx_isp->active_req_cnt, ctx->ctx_id);
+			}
+		} else if (req_isp->bubble_detected) {
+			ctx_isp->bubble_frame_cnt++;
+			CAM_DBG(CAM_ISP,
+				"Waiting on bufdone for bubble req: %lld, since frame_cnt = %lld",
+				req->request_id,
+				ctx_isp->bubble_frame_cnt);
+		} else {
+			CAM_DBG(CAM_ISP, "Delayed bufdone for req: %lld",
+				req->request_id);
+		}
+	}
+
+notify_only:
+	/*
+	 * notify reqmgr with sof signal. Note, due to scheduling delay
+	 * we can run into situation that two active requests has already
+	 * be in the active queue while we try to do the notification.
+	 * In this case, we need to skip the current notification. This
+	 * helps the state machine to catch up the delay.
+	 */
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger &&
+		ctx_isp->active_req_cnt <= 2) {
+		if (ctx_isp->subscribe_event & CAM_TRIGGER_POINT_SOF) {
+			notify.link_hdl = ctx->link_hdl;
+			notify.dev_hdl = ctx->dev_hdl;
+			notify.frame_id = ctx_isp->frame_id;
+			notify.trigger = CAM_TRIGGER_POINT_SOF;
+			notify.req_id = ctx_isp->req_info.last_bufdone_req_id;
+			notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+			notify.trigger_id = ctx_isp->trigger_id;
+
+			ctx->ctx_crm_intf->notify_trigger(&notify);
+			CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld ctx %u",
+				ctx_isp->frame_id, ctx->ctx_id);
+		}
+
+		list_for_each_entry(req, &ctx->active_req_list, list) {
+			req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+			if ((!req_isp->bubble_detected) &&
+				(req->request_id > ctx_isp->reported_req_id)) {
+				request_id = req->request_id;
+				__cam_isp_ctx_update_event_record(ctx_isp,
+					CAM_ISP_CTX_EVENT_EPOCH, req);
+				break;
+			}
+		}
+
+		if (ctx_isp->substate_activated == CAM_ISP_CTX_ACTIVATED_BUBBLE)
+			request_id = 0;
+
+		if (request_id != 0)
+			ctx_isp->reported_req_id = request_id;
+
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH,
+			request_id);
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"Can not notify SOF to CRM for ctx %u",
+			ctx->ctx_id);
+		rc = -EFAULT;
+	}
+	ctx_isp->last_sof_timestamp = ctx_isp->sof_timestamp_val;
+	return 0;
+}
+
+static int __cam_isp_ctx_notify_eof_in_activated_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_req_mgr_trigger_notify  notify;
+	struct cam_context *ctx = ctx_isp->base;
+
+	if (!(ctx_isp->subscribe_event & CAM_TRIGGER_POINT_EOF))
+		return rc;
+
+	/* notify reqmgr with eof signal */
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger) {
+		notify.link_hdl = ctx->link_hdl;
+		notify.dev_hdl = ctx->dev_hdl;
+		notify.frame_id = ctx_isp->frame_id;
+		notify.trigger = CAM_TRIGGER_POINT_EOF;
+		notify.trigger_id = ctx_isp->trigger_id;
+
+		ctx->ctx_crm_intf->notify_trigger(&notify);
+		CAM_DBG(CAM_ISP, "Notify CRM EOF frame %lld ctx %u",
+			ctx_isp->frame_id, ctx->ctx_id);
+
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EOF, 0);
+	} else {
+		CAM_ERR(CAM_ISP, "Can not notify EOF to CRM for ctx %u",
+			ctx->ctx_id);
+		rc = -EFAULT;
+	}
+
+	return rc;
+}
+
+static int __cam_isp_ctx_reg_upd_in_hw_error(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+	return 0;
+}
+
+static int __cam_isp_ctx_sof_in_activated_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	struct cam_ctx_request *req = NULL;
+	struct cam_context *ctx = ctx_isp->base;
+	uint64_t request_id = 0;
+
+	/* First check if there is a valid request in active list */
+	list_for_each_entry(req, &ctx->active_req_list, list) {
+		if (req->request_id > ctx_isp->reported_req_id) {
+			request_id = req->request_id;
+			break;
+		}
+	}
+
+	/*
+	 * If nothing in active list, current request might have not moved
+	 * from wait to active list. This could happen if REG_UPDATE to sw
+	 * is coming immediately after SOF
+	 */
+	if (request_id == 0) {
+		req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+		if (req)
+			request_id = req->request_id;
+	}
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id++;
+	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
+	ctx_isp->boot_timestamp = sof_event_data->boot_time;
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_SOF, request_id);
+
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx, ctx %u",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val, ctx->ctx_id);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_reg_upd_in_sof(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_ctx_request *req = NULL;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+
+	if (ctx->state != CAM_CTX_ACTIVATED && ctx_isp->frame_id > 1) {
+		CAM_DBG(CAM_ISP, "invalid RUP");
+		goto end;
+	}
+
+	/*
+	 * This is for the first update. The initial setting will
+	 * cause the reg_upd in the first frame.
+	 */
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if (req_isp->num_fence_map_out == req_isp->num_acked)
+			list_add_tail(&req->list, &ctx->free_req_list);
+		else
+			CAM_ERR(CAM_ISP,
+				"receive rup in unexpected state");
+	}
+	if (req != NULL) {
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE,
+			req->request_id);
+	}
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_epoch_in_applied(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	uint64_t request_id = 0;
+	uint32_t i;
+	uint32_t sof_event_status = CAM_REQ_MGR_SOF_EVENT_SUCCESS;
+	struct cam_req_mgr_trigger_notify   notify;
+	struct cam_ctx_request             *req;
+	struct cam_isp_ctx_req             *req_isp;
+	struct cam_context                 *ctx = ctx_isp->base;
+	struct cam_isp_hw_epoch_event_data *epoch_done_event_data =
+		(struct cam_isp_hw_epoch_event_data *)evt_data;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "invalid event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id_meta = epoch_done_event_data->frame_id_meta;
+	if (list_empty(&ctx->wait_req_list)) {
+		/*
+		 * If no wait req in epoch, this is an error case.
+		 * The recovery is to go back to sof state
+		 */
+		CAM_ERR(CAM_ISP, "Ctx:%d No wait request", ctx->ctx_id);
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+
+		/* Send SOF event as empty frame*/
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_EPOCH, NULL);
+		goto end;
+	}
+
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
+		list);
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	req_isp->bubble_detected = true;
+	req_isp->reapply = true;
+	req_isp->cdm_reset_before_apply = false;
+
+	/* reset early_fence_map_index array */
+	for (i = 0; i < req_isp->num_fence_map_out; i++)
+		req_isp->early_fence_map_index[i] = 0;
+
+	CAM_INFO_RATE_LIMIT(CAM_ISP, "ctx:%d Report Bubble flag %d req id:%lld",
+		ctx->ctx_id, req_isp->bubble_report, req->request_id);
+	if (req_isp->bubble_report && ctx->ctx_crm_intf &&
+		ctx->ctx_crm_intf->notify_err) {
+		struct cam_req_mgr_error_notify notify;
+
+		notify.link_hdl = ctx->link_hdl;
+		notify.dev_hdl = ctx->dev_hdl;
+		notify.req_id = req->request_id;
+		notify.error = CRM_KMD_ERR_BUBBLE;
+		notify.trigger = 0;
+		if (ctx_isp->subscribe_event & CAM_TRIGGER_POINT_SOF)
+			notify.trigger = CAM_TRIGGER_POINT_SOF;
+		notify.frame_id = ctx_isp->frame_id;
+		notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Notify CRM about Bubble req %lld frame %lld, ctx %u",
+			req->request_id, ctx_isp->frame_id, ctx->ctx_id);
+		trace_cam_log_event("Bubble", "Rcvd epoch in applied state",
+			req->request_id, ctx->ctx_id);
+		ctx->ctx_crm_intf->notify_err(&notify);
+		atomic_set(&ctx_isp->process_bubble, 1);
+	} else {
+		req_isp->bubble_report = 0;
+		CAM_DBG(CAM_ISP, "Skip bubble recovery for req %lld ctx %u",
+			req->request_id, ctx->ctx_id);
+		if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger &&
+			ctx_isp->active_req_cnt <= 1) {
+			if (ctx_isp->subscribe_event & CAM_TRIGGER_POINT_SOF) {
+				notify.link_hdl = ctx->link_hdl;
+				notify.dev_hdl = ctx->dev_hdl;
+				notify.frame_id = ctx_isp->frame_id;
+				notify.trigger = CAM_TRIGGER_POINT_SOF;
+				notify.req_id =
+					ctx_isp->req_info.last_bufdone_req_id;
+				notify.sof_timestamp_val =
+					ctx_isp->sof_timestamp_val;
+				notify.trigger_id = ctx_isp->trigger_id;
+
+				ctx->ctx_crm_intf->notify_trigger(&notify);
+				CAM_DBG(CAM_ISP,
+					"Notify CRM  SOF frame %lld ctx %u",
+					ctx_isp->frame_id, ctx->ctx_id);
+			}
+		}
+		atomic_set(&ctx_isp->process_bubble, 1);
+	}
+
+	/*
+	 * Always move the request to active list. Let buf done
+	 * function handles the rest.
+	 */
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->active_req_list);
+	ctx_isp->active_req_cnt++;
+	CAM_DBG(CAM_REQ, "move request %lld to active list(cnt = %d), ctx %u",
+		req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
+
+	/*
+	 * Update the record before req pointer to
+	 * other invalid req.
+	 */
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_EPOCH, req);
+
+	/*
+	 * Get the req again from active_req_list in case
+	 * the active req cnt is 2.
+	 */
+	list_for_each_entry(req, &ctx->active_req_list, list) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if ((!req_isp->bubble_report) &&
+			(req->request_id > ctx_isp->reported_req_id)) {
+			request_id = req->request_id;
+			ctx_isp->reported_req_id = request_id;
+			CAM_DBG(CAM_ISP,
+				"ctx %d reported_req_id update to %lld",
+				ctx->ctx_id, ctx_isp->reported_req_id);
+			break;
+		}
+	}
+
+	if ((request_id != 0) && req_isp->bubble_detected)
+		sof_event_status = CAM_REQ_MGR_SOF_EVENT_ERROR;
+
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		sof_event_status);
+
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	cam_req_mgr_debug_delay_detect();
+	trace_cam_delay_detect("ISP",
+		"bubble epoch_in_applied", req->request_id,
+		ctx->ctx_id, ctx->link_hdl, ctx->session_hdl,
+		CAM_DEFAULT_VALUE);
+end:
+	if (request_id == 0) {
+		req = list_last_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, req->request_id);
+	} else {
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, request_id);
+	}
+	return 0;
+}
+
+
+static int __cam_isp_ctx_buf_done_in_applied(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 0);
+	return rc;
+}
+
+
+static int __cam_isp_ctx_sof_in_epoch(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_context                    *ctx = ctx_isp->base;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	struct cam_ctx_request *req;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data");
+		return -EINVAL;
+	}
+
+	if (atomic_read(&ctx_isp->apply_in_progress))
+		CAM_INFO(CAM_ISP, "Apply is in progress at the time of SOF");
+
+	ctx_isp->frame_id++;
+	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
+	ctx_isp->boot_timestamp = sof_event_data->boot_time;
+
+	if (list_empty(&ctx->active_req_list))
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+	else
+		CAM_DBG(CAM_ISP, "Still need to wait for the buf done");
+
+	req = list_last_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+	if (req)
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_SOF,
+			req->request_id);
+
+	if (ctx_isp->frame_id == 1)
+		CAM_INFO(CAM_ISP,
+			"First SOF in EPCR ctx:%d frame_id:%lld next substate %s",
+			ctx->ctx_id, ctx_isp->frame_id,
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated));
+
+	CAM_DBG(CAM_ISP, "SOF in epoch ctx:%d frame_id:%lld next substate:%s",
+		ctx->ctx_id, ctx_isp->frame_id,
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	return rc;
+}
+
+static int __cam_isp_ctx_buf_done_in_epoch(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 0);
+	return rc;
+}
+
+static int __cam_isp_ctx_buf_done_in_bubble(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 1);
+	return rc;
+}
+
+static int __cam_isp_ctx_epoch_in_bubble_applied(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	uint64_t  request_id = 0;
+	struct cam_req_mgr_trigger_notify   notify;
+	struct cam_ctx_request             *req;
+	struct cam_isp_ctx_req             *req_isp;
+	struct cam_context                 *ctx = ctx_isp->base;
+	struct cam_isp_hw_epoch_event_data *epoch_done_event_data =
+		(struct cam_isp_hw_epoch_event_data *)evt_data;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "invalid event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id_meta = epoch_done_event_data->frame_id_meta;
+
+	/*
+	 * This means we missed the reg upd ack. So we need to
+	 * transition to BUBBLE state again.
+	 */
+
+	if (list_empty(&ctx->wait_req_list)) {
+		/*
+		 * If no pending req in epoch, this is an error case.
+		 * Just go back to the bubble state.
+		 */
+		CAM_ERR(CAM_ISP, "ctx:%d No pending request.", ctx->ctx_id);
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_EPOCH, NULL);
+
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+		goto end;
+	}
+
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
+		list);
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	req_isp->bubble_detected = true;
+	CAM_INFO_RATE_LIMIT(CAM_ISP, "Ctx:%d Report Bubble flag %d req id:%lld",
+		ctx->ctx_id, req_isp->bubble_report, req->request_id);
+	req_isp->reapply = true;
+	req_isp->cdm_reset_before_apply = false;
+
+	if (req_isp->bubble_report && ctx->ctx_crm_intf &&
+		ctx->ctx_crm_intf->notify_err) {
+		struct cam_req_mgr_error_notify notify;
+
+		notify.link_hdl = ctx->link_hdl;
+		notify.dev_hdl = ctx->dev_hdl;
+		notify.req_id = req->request_id;
+		notify.error = CRM_KMD_ERR_BUBBLE;
+		notify.trigger = 0;
+		if (ctx_isp->subscribe_event & CAM_TRIGGER_POINT_SOF)
+			notify.trigger = CAM_TRIGGER_POINT_SOF;
+		notify.frame_id = ctx_isp->frame_id;
+		notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+		CAM_WARN_RATE_LIMIT(CAM_REQ,
+			"Notify CRM about Bubble req_id %llu frame %lld, ctx %u",
+			req->request_id, ctx_isp->frame_id, ctx->ctx_id);
+		ctx->ctx_crm_intf->notify_err(&notify);
+		atomic_set(&ctx_isp->process_bubble, 1);
+	} else {
+		req_isp->bubble_report = 0;
+		CAM_DBG(CAM_ISP, "Skip bubble recovery for req %lld ctx %u",
+			req->request_id, ctx->ctx_id);
+		if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger &&
+			ctx_isp->active_req_cnt <= 1) {
+			if (ctx_isp->subscribe_event & CAM_TRIGGER_POINT_SOF) {
+				notify.link_hdl = ctx->link_hdl;
+				notify.dev_hdl = ctx->dev_hdl;
+				notify.frame_id = ctx_isp->frame_id;
+				notify.trigger = CAM_TRIGGER_POINT_SOF;
+				notify.req_id =
+					ctx_isp->req_info.last_bufdone_req_id;
+				notify.sof_timestamp_val =
+					ctx_isp->sof_timestamp_val;
+				notify.trigger_id = ctx_isp->trigger_id;
+
+				ctx->ctx_crm_intf->notify_trigger(&notify);
+				CAM_DBG(CAM_ISP,
+					"Notify CRM  SOF frame %lld ctx %u",
+					ctx_isp->frame_id, ctx->ctx_id);
+			}
+		}
+		atomic_set(&ctx_isp->process_bubble, 1);
+	}
+
+	/*
+	 * Always move the request to active list. Let buf done
+	 * function handles the rest.
+	 */
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->active_req_list);
+	ctx_isp->active_req_cnt++;
+	CAM_DBG(CAM_ISP, "move request %lld to active list(cnt = %d) ctx %u",
+		req->request_id, ctx_isp->active_req_cnt);
+
+	if (!req_isp->bubble_report) {
+		if (req->request_id > ctx_isp->reported_req_id) {
+			request_id = req->request_id;
+			ctx_isp->reported_req_id = request_id;
+			__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_ERROR);
+
+			__cam_isp_ctx_update_event_record(ctx_isp,
+				CAM_ISP_CTX_EVENT_EPOCH, req);
+		} else {
+			__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+				CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+			__cam_isp_ctx_update_event_record(ctx_isp,
+				CAM_ISP_CTX_EVENT_EPOCH, NULL);
+		}
+	} else {
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_EPOCH, NULL);
+	}
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	cam_req_mgr_debug_delay_detect();
+	trace_cam_delay_detect("ISP",
+		"bubble epoch_in_bubble_applied",
+		req->request_id, ctx->ctx_id,
+		ctx->link_hdl, ctx->session_hdl,
+		CAM_DEFAULT_VALUE);
+end:
+	req = list_last_entry(&ctx->active_req_list, struct cam_ctx_request,
+		list);
+	if (req)
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, req->request_id);
+	return 0;
+}
+
+static int __cam_isp_ctx_buf_done_in_bubble_applied(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 1);
+
+	return rc;
+}
+
+static uint32_t get_evt_param(uint32_t error_type)
+{
+	switch (error_type) {
+	case CAM_ISP_HW_ERROR_OVERFLOW:
+		return CAM_SYNC_ISP_EVENT_OVERFLOW;
+	case CAM_ISP_HW_ERROR_P2I_ERROR:
+		return CAM_SYNC_ISP_EVENT_P2I_ERROR;
+	case CAM_ISP_HW_ERROR_VIOLATION:
+		return CAM_SYNC_ISP_EVENT_VIOLATION;
+	case CAM_ISP_HW_ERROR_BUSIF_OVERFLOW:
+		return CAM_SYNC_ISP_EVENT_BUSIF_OVERFLOW;
+	default:
+		return CAM_SYNC_ISP_EVENT_UNKNOWN;
+	}
+}
+
+static int __cam_isp_ctx_handle_error(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int                              rc = 0;
+	uint32_t                         i = 0;
+	bool                             found = 0;
+	struct cam_ctx_request          *req = NULL;
+	struct cam_ctx_request          *req_to_report = NULL;
+	struct cam_ctx_request          *req_to_dump = NULL;
+	struct cam_ctx_request          *req_temp;
+	struct cam_isp_ctx_req          *req_isp = NULL;
+	struct cam_isp_ctx_req          *req_isp_to_report = NULL;
+	struct cam_req_mgr_error_notify  notify = {};
+	uint64_t                         error_request_id;
+	struct cam_hw_fence_map_entry   *fence_map_out = NULL;
+	struct cam_req_mgr_message       req_msg;
+	uint32_t                         evt_param;
+
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_isp_hw_error_event_data  *error_event_data =
+			(struct cam_isp_hw_error_event_data *)evt_data;
+
+	uint32_t error_type = error_event_data->error_type;
+
+	CAM_DBG(CAM_ISP, "Enter error_type = %d", error_type);
+
+	if ((error_type == CAM_ISP_HW_ERROR_OVERFLOW) ||
+		(error_type == CAM_ISP_HW_ERROR_BUSIF_OVERFLOW) ||
+		(error_type == CAM_ISP_HW_ERROR_VIOLATION)) {
+		struct cam_hw_cmd_args hw_cmd_args;
+
+		memset(&hw_cmd_args, 0, sizeof(hw_cmd_args));
+		hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR;
+		rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&hw_cmd_args);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Reg dump on error failed rc: %d", rc);
+			rc = 0;
+		}
+	}
+
+	evt_param = get_evt_param(error_type);
+
+	/*
+	 * The error is likely caused by first request on the active list.
+	 * If active list is empty check wait list (maybe error hit as soon
+	 * as RUP and we handle error before RUP.
+	 */
+	if (list_empty(&ctx->active_req_list)) {
+		CAM_DBG(CAM_ISP,
+			"handling error with no active request");
+		if (list_empty(&ctx->wait_req_list)) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"Error with no active/wait request");
+			goto end;
+		} else {
+			req_to_dump = list_first_entry(&ctx->wait_req_list,
+				struct cam_ctx_request, list);
+		}
+	} else {
+		req_to_dump = list_first_entry(&ctx->active_req_list,
+			struct cam_ctx_request, list);
+	}
+
+	req_isp = (struct cam_isp_ctx_req *) req_to_dump->req_priv;
+
+	if (error_event_data->enable_req_dump)
+		rc = cam_isp_ctx_dump_req(req_isp, 0, 0, NULL, false);
+
+	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+		CAM_ISP_STATE_CHANGE_TRIGGER_ERROR, req_to_dump->request_id);
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->active_req_list, list) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if (!req_isp->bubble_report) {
+			for (i = 0; i < req_isp->num_fence_map_out; i++) {
+				fence_map_out =
+					&req_isp->fence_map_out[i];
+				CAM_ERR(CAM_ISP,
+					"req %llu, Sync fd 0x%x ctx %u",
+					req->request_id,
+					req_isp->fence_map_out[i].sync_id,
+					ctx->ctx_id);
+				if (req_isp->fence_map_out[i].sync_id != -1) {
+					rc = cam_sync_signal(
+						fence_map_out->sync_id,
+						CAM_SYNC_STATE_SIGNALED_ERROR,
+						evt_param);
+					fence_map_out->sync_id = -1;
+				}
+			}
+			list_del_init(&req->list);
+			list_add_tail(&req->list, &ctx->free_req_list);
+			ctx_isp->active_req_cnt--;
+		} else {
+			found = 1;
+			break;
+		}
+	}
+
+	if (found)
+		goto move_to_pending;
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->wait_req_list, list) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if (!req_isp->bubble_report) {
+			for (i = 0; i < req_isp->num_fence_map_out; i++) {
+				fence_map_out =
+					&req_isp->fence_map_out[i];
+				CAM_ERR(CAM_ISP,
+					"req %llu, Sync fd 0x%x ctx %u",
+					req->request_id,
+					req_isp->fence_map_out[i].sync_id,
+					ctx->ctx_id);
+				if (req_isp->fence_map_out[i].sync_id != -1) {
+					rc = cam_sync_signal(
+						fence_map_out->sync_id,
+						CAM_SYNC_STATE_SIGNALED_ERROR,
+						evt_param);
+					fence_map_out->sync_id = -1;
+				}
+			}
+			list_del_init(&req->list);
+			list_add_tail(&req->list, &ctx->free_req_list);
+			ctx_isp->active_req_cnt--;
+		} else {
+			found = 1;
+			break;
+		}
+	}
+
+move_to_pending:
+	/*
+	 * If bubble recovery is enabled on any request we need to move that
+	 * request and all the subsequent requests to the pending list.
+	 * Note:
+	 * We need to traverse the active list in reverse order and add
+	 * to head of pending list.
+	 * e.g. pending current state: 10, 11 | active current state: 8, 9
+	 * intermittent for loop iteration- pending: 9, 10, 11 | active: 8
+	 * final state - pending: 8, 9, 10, 11 | active: NULL
+	 */
+	if (found) {
+		list_for_each_entry_safe_reverse(req, req_temp,
+			&ctx->active_req_list, list) {
+			req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+			list_del_init(&req->list);
+			list_add(&req->list, &ctx->pending_req_list);
+			ctx_isp->active_req_cnt--;
+		}
+		list_for_each_entry_safe_reverse(req, req_temp,
+			&ctx->wait_req_list, list) {
+			req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+			list_del_init(&req->list);
+			list_add(&req->list, &ctx->pending_req_list);
+			ctx_isp->active_req_cnt--;
+		}
+	}
+
+end:
+	do {
+		if (list_empty(&ctx->pending_req_list)) {
+			error_request_id = ctx_isp->last_applied_req_id;
+			req_isp = NULL;
+			break;
+		}
+		req = list_first_entry(&ctx->pending_req_list,
+			struct cam_ctx_request, list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		error_request_id = ctx_isp->last_applied_req_id;
+
+		if (req_isp->bubble_report) {
+			req_to_report = req;
+			req_isp_to_report = req_to_report->req_priv;
+			break;
+		}
+
+		for (i = 0; i < req_isp->num_fence_map_out; i++) {
+			if (req_isp->fence_map_out[i].sync_id != -1)
+				rc = cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					evt_param);
+			req_isp->fence_map_out[i].sync_id = -1;
+		}
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->free_req_list);
+
+	} while (req->request_id < ctx_isp->last_applied_req_id);
+
+	if (ctx_isp->offline_context)
+		goto exit;
+
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_err) {
+		notify.link_hdl = ctx->link_hdl;
+		notify.dev_hdl = ctx->dev_hdl;
+		notify.req_id = error_request_id;
+		notify.error = CRM_KMD_ERR_FATAL;
+
+		if (req_isp_to_report && req_isp_to_report->bubble_report)
+			if (error_event_data->recovery_enabled)
+				notify.error = CRM_KMD_ERR_BUBBLE;
+
+		CAM_WARN(CAM_ISP,
+			"Notify CRM: req %lld, frame %lld ctx %u, error %d",
+			error_request_id, ctx_isp->frame_id, ctx->ctx_id,
+			notify.error);
+
+		ctx->ctx_crm_intf->notify_err(&notify);
+
+		/*
+		 * Need to send error occurred in KMD
+		 * This will help UMD to take necessary action
+		 * and to dump relevant info
+		 */
+
+		if (notify.error == CRM_KMD_ERR_FATAL) {
+			req_msg.session_hdl = ctx_isp->base->session_hdl;
+			req_msg.u.err_msg.device_hdl = ctx_isp->base->dev_hdl;
+
+			if (error_type == CAM_ISP_HW_ERROR_CSID_FATAL)
+				req_msg.u.err_msg.error_type =
+					CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY;
+			else
+				req_msg.u.err_msg.error_type =
+					CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+
+			req_msg.u.err_msg.link_hdl = ctx_isp->base->link_hdl;
+			req_msg.u.err_msg.request_id = error_request_id;
+			req_msg.u.err_msg.resource_size = 0x0;
+
+			if (cam_req_mgr_notify_message(&req_msg,
+					V4L_EVENT_CAM_REQ_MGR_ERROR,
+					V4L_EVENT_CAM_REQ_MGR_EVENT))
+				CAM_ERR(CAM_ISP,
+					"Error in notifying the error time for req id:%lld ctx %u",
+						ctx_isp->last_applied_req_id,
+						ctx->ctx_id);
+		}
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_HW_ERROR;
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"Can not notify ERRROR to CRM for ctx %u",
+			ctx->ctx_id);
+		rc = -EFAULT;
+	}
+
+	CAM_DBG(CAM_ISP, "Exit");
+
+exit:
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_sof_in_sof_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	struct cam_ctx_request *req;
+	struct cam_context *ctx = ctx_isp->base;
+	struct cam_req_mgr_trigger_notify  notify;
+	uint64_t  request_id  = 0;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id++;
+	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
+	ctx_isp->boot_timestamp = sof_event_data->boot_time;
+
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val);
+
+	if (!(list_empty(&ctx->wait_req_list)))
+		goto end;
+
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger &&
+		ctx_isp->active_req_cnt <= 2) {
+		if (ctx_isp->subscribe_event & CAM_TRIGGER_POINT_SOF) {
+			notify.link_hdl = ctx->link_hdl;
+			notify.dev_hdl = ctx->dev_hdl;
+			notify.frame_id = ctx_isp->frame_id;
+			notify.trigger = CAM_TRIGGER_POINT_SOF;
+			notify.req_id = ctx_isp->req_info.last_bufdone_req_id;
+			notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+			notify.trigger_id = ctx_isp->trigger_id;
+
+			ctx->ctx_crm_intf->notify_trigger(&notify);
+			CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
+				ctx_isp->frame_id);
+		}
+
+		list_for_each_entry(req, &ctx->active_req_list, list) {
+			if (req->request_id > ctx_isp->reported_req_id) {
+				request_id = req->request_id;
+				ctx_isp->reported_req_id = request_id;
+				break;
+			}
+		}
+
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_SOF, request_id);
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Can not notify SOF to CRM");
+		rc = -EFAULT;
+	}
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_buf_done(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_hw_done_event_data *done =
+		(struct cam_isp_hw_done_event_data *) evt_data;
+	struct cam_context *ctx = ctx_isp->base;
+	int prev_active_req_cnt = 0;
+	int curr_req_id = 0;
+	struct cam_ctx_request  *req;
+
+	prev_active_req_cnt = ctx_isp->active_req_cnt;
+	req = list_first_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+	if (req)
+		curr_req_id = req->request_id;
+
+	rc = __cam_isp_ctx_handle_buf_done_in_activated_state(ctx_isp, done, 0);
+
+	if (prev_active_req_cnt == ctx_isp->active_req_cnt + 1) {
+		if (list_empty(&ctx->wait_req_list) &&
+			list_empty(&ctx->active_req_list)) {
+			CAM_DBG(CAM_ISP, "No request, move to SOF");
+			ctx_isp->substate_activated =
+				CAM_ISP_CTX_ACTIVATED_SOF;
+			if (ctx_isp->reported_req_id < curr_req_id) {
+				ctx_isp->reported_req_id = curr_req_id;
+				__cam_isp_ctx_send_sof_timestamp(ctx_isp,
+					curr_req_id,
+					CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_buf_done_in_epoch(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+
+	rc =  __cam_isp_ctx_fs2_buf_done(ctx_isp, evt_data);
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_buf_done_in_applied(
+	struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+
+	rc =  __cam_isp_ctx_fs2_buf_done(ctx_isp, evt_data);
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_reg_upd_in_sof(struct cam_isp_context *ctx_isp,
+	void *evt_data)
+{
+	int rc = 0;
+	struct cam_ctx_request *req = NULL;
+	struct cam_isp_ctx_req *req_isp;
+	struct cam_context *ctx = ctx_isp->base;
+
+	if (ctx->state != CAM_CTX_ACTIVATED && ctx_isp->frame_id > 1) {
+		CAM_DBG(CAM_ISP, "invalid RUP");
+		goto end;
+	}
+
+	/*
+	 * This is for the first update. The initial setting will
+	 * cause the reg_upd in the first frame.
+	 */
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		if (req_isp->num_fence_map_out == req_isp->num_acked)
+			list_add_tail(&req->list, &ctx->free_req_list);
+		else
+			CAM_ERR(CAM_ISP,
+				"receive rup in unexpected state");
+	}
+	if (req != NULL) {
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE,
+			req->request_id);
+	}
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_fs2_reg_upd_in_applied_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_ctx_request  *req = NULL;
+	struct cam_context      *ctx = ctx_isp->base;
+	struct cam_isp_ctx_req  *req_isp;
+	struct cam_req_mgr_trigger_notify  notify;
+	uint64_t  request_id  = 0;
+
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request");
+		goto end;
+	}
+	req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+	list_del_init(&req->list);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	if (req_isp->num_fence_map_out != 0) {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		CAM_DBG(CAM_REQ, "move request %lld to active list(cnt = %d)",
+			 req->request_id, ctx_isp->active_req_cnt);
+	} else {
+		/* no io config, so the request is completed. */
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	/*
+	 * This function only called directly from applied and bubble applied
+	 * state so change substate here.
+	 */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
+	if (req_isp->num_fence_map_out != 1)
+		goto end;
+
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger &&
+		ctx_isp->active_req_cnt <= 2) {
+		list_for_each_entry(req, &ctx->active_req_list, list) {
+			if (req->request_id > ctx_isp->reported_req_id) {
+				request_id = req->request_id;
+				ctx_isp->reported_req_id = request_id;
+				break;
+			}
+		}
+
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+		if (ctx_isp->subscribe_event & CAM_TRIGGER_POINT_SOF) {
+			notify.link_hdl = ctx->link_hdl;
+			notify.dev_hdl = ctx->dev_hdl;
+			notify.frame_id = ctx_isp->frame_id;
+			notify.trigger = CAM_TRIGGER_POINT_SOF;
+			notify.req_id = ctx_isp->req_info.last_bufdone_req_id;
+			notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+			notify.trigger_id = ctx_isp->trigger_id;
+
+			ctx->ctx_crm_intf->notify_trigger(&notify);
+			CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
+				ctx_isp->frame_id);
+		}
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Can not notify SOF to CRM");
+		rc = -EFAULT;
+	}
+
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+end:
+	if (req != NULL && !rc) {
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE,
+			req->request_id);
+	}
+	return rc;
+}
+
+static struct cam_isp_ctx_irq_ops
+	cam_isp_ctx_activated_state_machine_irq[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_sof,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			NULL,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_applied_state,
+			__cam_isp_ctx_epoch_in_applied,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_applied,
+		},
+	},
+	/* EPOCH */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_epoch,
+			__cam_isp_ctx_reg_upd_in_epoch_bubble_state,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_epoch,
+		},
+	},
+	/* BUBBLE */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_epoch_bubble_state,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_bubble,
+		},
+	},
+	/* Bubble Applied */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_applied_state,
+			__cam_isp_ctx_epoch_in_bubble_applied,
+			NULL,
+			__cam_isp_ctx_buf_done_in_bubble_applied,
+		},
+	},
+	/* HW ERROR */
+	{
+		.irq_ops = {
+			NULL,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_hw_error,
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* HALT */
+	{
+	},
+};
+
+static struct cam_isp_ctx_irq_ops
+	cam_isp_ctx_fs2_state_machine_irq[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_fs2_sof_in_sof_state,
+			__cam_isp_ctx_fs2_reg_upd_in_sof,
+			__cam_isp_ctx_fs2_sof_in_sof_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			NULL,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_fs2_reg_upd_in_applied_state,
+			__cam_isp_ctx_epoch_in_applied,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_fs2_buf_done_in_applied,
+		},
+	},
+	/* EPOCH */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_epoch,
+			__cam_isp_ctx_reg_upd_in_epoch_bubble_state,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_fs2_buf_done_in_epoch,
+		},
+	},
+	/* BUBBLE */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_epoch_bubble_state,
+			__cam_isp_ctx_notify_sof_in_activated_state,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_bubble,
+		},
+	},
+	/* Bubble Applied */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_applied_state,
+			__cam_isp_ctx_epoch_in_bubble_applied,
+			NULL,
+			__cam_isp_ctx_buf_done_in_bubble_applied,
+		},
+	},
+	/* HW ERROR */
+	{
+		.irq_ops = {
+			NULL,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_hw_error,
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* HALT */
+	{
+	},
+};
+
+static struct cam_isp_ctx_irq_ops
+	cam_isp_ctx_offline_state_machine_irq[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_applied_state,
+			NULL,
+			NULL,
+			__cam_isp_ctx_buf_done_in_applied,
+		},
+	},
+	/* EPOCH */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			NULL,
+			NULL,
+			__cam_isp_ctx_offline_epoch_in_activated_state,
+			NULL,
+			__cam_isp_ctx_buf_done_in_epoch,
+		},
+	},
+	/* BUBBLE */
+	{
+	},
+	/* Bubble Applied */
+	{
+	},
+	/* HW ERROR */
+	{
+		.irq_ops = {
+			NULL,
+			__cam_isp_ctx_sof_in_activated_state,
+			__cam_isp_ctx_reg_upd_in_hw_error,
+			NULL,
+			NULL,
+			NULL,
+		},
+	},
+	/* HALT */
+	{
+	},
+};
+
+static int __cam_isp_ctx_apply_req_in_activated_state(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply,
+	enum cam_isp_ctx_activated_substate next_state)
+{
+	int rc = 0, i;
+	struct cam_ctx_request          *req;
+	struct cam_ctx_request          *active_req = NULL;
+	struct cam_isp_ctx_req          *req_isp;
+	struct cam_isp_ctx_req          *active_req_isp;
+	struct cam_isp_context          *ctx_isp = NULL;
+	struct cam_hw_config_args        cfg = {0};
+
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+
+	if (apply->re_apply)
+		if (apply->request_id <= ctx_isp->last_applied_req_id) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"ctx_id:%d Trying to reapply the same request %llu again",
+				ctx->ctx_id,
+				apply->request_id);
+			return 0;
+		}
+
+	if (list_empty(&ctx->pending_req_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%d No available request for Apply id %lld",
+			ctx->ctx_id,
+			apply->request_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	/*
+	 * When the pipeline has issue, the requests can be queued up in the
+	 * pipeline. In this case, we should reject the additional request.
+	 * The maximum number of request allowed to be outstanding is 2.
+	 *
+	 */
+	if (atomic_read(&ctx_isp->process_bubble)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%d Processing bubble cannot apply Request Id %llu",
+			ctx->ctx_id,
+			apply->request_id);
+		rc = -EAGAIN;
+		goto end;
+	}
+
+	spin_lock_bh(&ctx->lock);
+	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+		list);
+	spin_unlock_bh(&ctx->lock);
+
+	/*
+	 * Check whether the request id is matching the tip, if not, this means
+	 * we are in the middle of the error handling. Need to reject this apply
+	 */
+	if (req->request_id != apply->request_id) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%d Invalid Request Id asking %llu existing %llu",
+			ctx->ctx_id,
+			apply->request_id, req->request_id);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_REQ, "Apply request %lld in Substate[%s] ctx %u",
+		req->request_id,
+		__cam_isp_ctx_substate_val_to_type(ctx_isp->substate_activated),
+		ctx->ctx_id);
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	if (ctx_isp->active_req_cnt >=  2) {
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Reject apply request (id %lld) due to congestion(cnt = %d) ctx %u",
+			req->request_id,
+			ctx_isp->active_req_cnt,
+			ctx->ctx_id);
+
+		spin_lock_bh(&ctx->lock);
+		if (!list_empty(&ctx->active_req_list))
+			active_req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		else
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"WARNING: should not happen (cnt = %d) but active_list empty",
+				ctx_isp->active_req_cnt);
+		spin_unlock_bh(&ctx->lock);
+
+		if (active_req) {
+			active_req_isp =
+				(struct cam_isp_ctx_req *) active_req->req_priv;
+			__cam_isp_ctx_handle_buf_done_fail_log(
+				active_req->request_id, active_req_isp,
+				ctx_isp->isp_device_type);
+		}
+
+		rc = -EFAULT;
+		goto end;
+	}
+	req_isp->bubble_report = apply->report_if_bubble;
+
+	/* reset early_fence_map_index */
+	for (i = 0; i <  req_isp->num_fence_map_out; i++)
+		req_isp->early_fence_map_index[i] = 0;
+
+	req_isp->flag_sync_set = false;
+
+	cfg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	cfg.request_id = req->request_id;
+	cfg.hw_update_entries = req_isp->cfg;
+	cfg.num_hw_update_entries = req_isp->num_cfg;
+	cfg.priv  = &req_isp->hw_update_data;
+	cfg.init_packet = 0;
+	cfg.reapply = req_isp->reapply;
+	cfg.cdm_reset_before_apply = req_isp->cdm_reset_before_apply;
+
+	atomic_set(&ctx_isp->apply_in_progress, 1);
+
+	rc = ctx->hw_mgr_intf->hw_config(ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (!rc) {
+		spin_lock_bh(&ctx->lock);
+		ctx_isp->substate_activated = next_state;
+		ctx_isp->last_applied_req_id = apply->request_id;
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->wait_req_list);
+		CAM_DBG(CAM_ISP, "new substate Substate[%s], applied req %lld",
+			__cam_isp_ctx_substate_val_to_type(next_state),
+			ctx_isp->last_applied_req_id);
+		spin_unlock_bh(&ctx->lock);
+
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_APPLIED,
+			req->request_id);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_APPLY, req);
+	} else if (rc == -EALREADY) {
+		spin_lock_bh(&ctx->lock);
+		req_isp->bubble_detected = true;
+		req_isp->cdm_reset_before_apply = false;
+		atomic_set(&ctx_isp->process_bubble, 1);
+		list_del_init(&req->list);
+		list_add(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		spin_unlock_bh(&ctx->lock);
+		CAM_DBG(CAM_REQ,
+			"move request %lld to active list(cnt = %d), ctx %u",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%d ,Can not apply (req %lld) the configuration, rc %d",
+			ctx->ctx_id, apply->request_id, rc);
+	}
+	atomic_set(&ctx_isp->apply_in_progress, 0);
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_req_in_sof(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "current Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+	rc = __cam_isp_ctx_apply_req_in_activated_state(ctx, apply,
+		CAM_ISP_CTX_ACTIVATED_APPLIED);
+	CAM_DBG(CAM_ISP, "new Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	if (rc)
+		CAM_DBG(CAM_ISP, "Apply failed in Substate[%s], rc %d",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_req_in_epoch(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "current Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+	rc = __cam_isp_ctx_apply_req_in_activated_state(ctx, apply,
+		CAM_ISP_CTX_ACTIVATED_APPLIED);
+	CAM_DBG(CAM_ISP, "new Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	if (rc)
+		CAM_DBG(CAM_ISP, "Apply failed in Substate[%s], rc %d",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_req_in_bubble(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "current Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+	rc = __cam_isp_ctx_apply_req_in_activated_state(ctx, apply,
+		CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED);
+	CAM_DBG(CAM_ISP, "new Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	if (rc)
+		CAM_DBG(CAM_ISP, "Apply failed in Substate[%s], rc %d",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_dump_req_info(
+	struct cam_context     *ctx,
+	struct cam_ctx_request *req,
+	uintptr_t               cpu_addr,
+	size_t                  buf_len,
+	size_t                 *offset)
+{
+	int                                 i, rc;
+	uint8_t                            *dst;
+	int32_t                            *addr, *start;
+	uint32_t                            min_len;
+	size_t                              remain_len;
+	struct cam_isp_ctx_req             *req_isp;
+	struct cam_isp_context             *ctx_isp;
+	struct cam_isp_context_dump_header *hdr;
+
+	if (!req || !ctx || !offset || !cpu_addr || !buf_len) {
+		CAM_ERR(CAM_ISP, "Invalid parameters %pK %pK %pK %zu",
+			req, ctx, offset, buf_len);
+		return -EINVAL;
+	}
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	ctx_isp = (struct cam_isp_context *)ctx->ctx_priv;
+
+	if (buf_len <= *offset) {
+		CAM_WARN(CAM_ISP, "Dump buffer overshoot len %zu offset %zu",
+			buf_len, *offset);
+		return -ENOSPC;
+	}
+
+	remain_len = buf_len - *offset;
+	min_len = sizeof(struct cam_isp_context_dump_header) +
+		(CAM_ISP_CTX_DUMP_REQUEST_NUM_WORDS *
+		 req_isp->num_fence_map_out *
+		sizeof(int32_t));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)cpu_addr + *offset;
+	hdr = (struct cam_isp_context_dump_header *)dst;
+	hdr->word_size = sizeof(int32_t);
+	scnprintf(hdr->tag, CAM_ISP_CONTEXT_DUMP_TAG_MAX_LEN,
+		"ISP_OUT_FENCE:");
+	addr = (int32_t *)(dst + sizeof(struct cam_isp_context_dump_header));
+	start = addr;
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		*addr++ = req_isp->fence_map_out[i].resource_handle;
+		*addr++ = req_isp->fence_map_out[i].sync_id;
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	*offset += hdr->size + sizeof(struct cam_isp_context_dump_header);
+	rc = cam_isp_ctx_dump_req(req_isp, cpu_addr, buf_len,
+		offset, true);
+	return rc;
+}
+
+static int __cam_isp_ctx_dump_in_top_state(
+	struct cam_context           *ctx,
+	struct cam_req_mgr_dump_info *dump_info)
+{
+	int                                 rc = 0;
+	bool                                dump_only_event_record = false;
+	size_t                              buf_len;
+	size_t                              remain_len;
+	uint8_t                            *dst;
+	ktime_t                             cur_time;
+	uint32_t                            min_len;
+	uint64_t                            diff;
+	uint64_t                           *addr, *start;
+	uintptr_t                           cpu_addr;
+	struct timespec64                   ts;
+	struct cam_isp_context             *ctx_isp;
+	struct cam_ctx_request             *req = NULL;
+	struct cam_isp_ctx_req             *req_isp;
+	struct cam_ctx_request             *req_temp;
+	struct cam_hw_dump_args             dump_args;
+	struct cam_isp_context_dump_header *hdr;
+
+	rc  = cam_mem_get_cpu_buf(dump_info->buf_handle,
+		&cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Invalid handle %u rc %d",
+			dump_info->buf_handle, rc);
+		return rc;
+	}
+
+	spin_lock_bh(&ctx->lock);
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->active_req_list, list) {
+		if (req->request_id == dump_info->req_id) {
+			CAM_INFO(CAM_ISP, "isp dump active list req: %lld",
+			    dump_info->req_id);
+			goto hw_dump;
+		}
+	}
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->wait_req_list, list) {
+		if (req->request_id == dump_info->req_id) {
+			CAM_INFO(CAM_ISP, "isp dump wait list req: %lld",
+			    dump_info->req_id);
+			goto hw_dump;
+		}
+	}
+	spin_unlock_bh(&ctx->lock);
+	cam_mem_put_cpu_buf(dump_info->buf_handle);
+	return rc;
+
+hw_dump:
+	if (buf_len <= dump_info->offset) {
+		spin_unlock_bh(&ctx->lock);
+		CAM_WARN(CAM_ISP, "Dump buffer overshoot len %zu offset %zu",
+			buf_len, dump_info->offset);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return -ENOSPC;
+	}
+
+	remain_len = buf_len - dump_info->offset;
+	min_len = sizeof(struct cam_isp_context_dump_header) +
+		(CAM_ISP_CTX_DUMP_NUM_WORDS * sizeof(uint64_t));
+
+	if (remain_len < min_len) {
+		spin_unlock_bh(&ctx->lock);
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		cam_mem_put_cpu_buf(dump_info->buf_handle);
+		return -ENOSPC;
+	}
+
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+	cur_time = ktime_get();
+	diff = ktime_us_delta(
+		req_isp->event_timestamp[CAM_ISP_CTX_EVENT_APPLY],
+		cur_time);
+	if (diff < CAM_ISP_CTX_RESPONSE_TIME_THRESHOLD) {
+		CAM_INFO(CAM_ISP, "req %lld found no error",
+			req->request_id);
+		dump_only_event_record = true;
+	}
+	dst = (uint8_t *)cpu_addr + dump_info->offset;
+	hdr = (struct cam_isp_context_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_CONTEXT_DUMP_TAG_MAX_LEN,
+		"ISP_CTX_DUMP:");
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst +
+		sizeof(struct cam_isp_context_dump_header));
+	start = addr;
+	*addr++ = req->request_id;
+	ts      = ktime_to_timespec64(
+		req_isp->event_timestamp[CAM_ISP_CTX_EVENT_APPLY]);
+	*addr++ = ts.tv_sec;
+	*addr++ = ts.tv_nsec/NSEC_PER_USEC;
+	ts      = ktime_to_timespec64(cur_time);
+	*addr++ = ts.tv_sec;
+	*addr++ = ts.tv_nsec/NSEC_PER_USEC;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_info->offset += hdr->size +
+		sizeof(struct cam_isp_context_dump_header);
+
+	rc = __cam_isp_ctx_dump_event_record(ctx_isp, cpu_addr,
+		buf_len, &dump_info->offset);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Dump event fail %lld",
+			req->request_id);
+		goto end;
+	}
+	if (dump_only_event_record)
+		goto end;
+
+	rc = __cam_isp_ctx_dump_req_info(ctx, req, cpu_addr,
+		buf_len, &dump_info->offset);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Dump Req info fail %lld",
+			req->request_id);
+		goto end;
+	}
+	spin_unlock_bh(&ctx->lock);
+
+	if (ctx->hw_mgr_intf->hw_dump) {
+		dump_args.offset = dump_info->offset;
+		dump_args.request_id = dump_info->req_id;
+		dump_args.buf_handle = dump_info->buf_handle;
+		dump_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		rc = ctx->hw_mgr_intf->hw_dump(
+			ctx->hw_mgr_intf->hw_mgr_priv,
+			&dump_args);
+		dump_info->offset = dump_args.offset;
+	}
+	cam_mem_put_cpu_buf(dump_info->buf_handle);
+	return rc;
+
+end:
+	spin_unlock_bh(&ctx->lock);
+	cam_mem_put_cpu_buf(dump_info->buf_handle);
+	return rc;
+}
+
+static int __cam_isp_ctx_flush_req_in_flushed_state(
+	struct cam_context               *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		CAM_INFO(CAM_ISP, "Flush in flushed state req id %lld ctx_id:%d",
+			flush_req->req_id, ctx->ctx_id);
+		ctx->last_flush_req = flush_req->req_id;
+	}
+
+	return 0;
+}
+
+static int __cam_isp_ctx_flush_req(struct cam_context *ctx,
+	struct list_head *req_list, struct cam_req_mgr_flush_request *flush_req)
+{
+	int i, rc, tmp = 0;
+	uint32_t cancel_req_id_found = 0;
+	struct cam_ctx_request           *req;
+	struct cam_ctx_request           *req_temp;
+	struct cam_isp_ctx_req           *req_isp;
+	struct list_head                  flush_list;
+	struct cam_isp_context           *ctx_isp = NULL;
+
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+
+	INIT_LIST_HEAD(&flush_list);
+	if (list_empty(req_list)) {
+		CAM_DBG(CAM_ISP, "request list is empty");
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			CAM_ERR(CAM_ISP, "no request to cancel");
+			return -EINVAL;
+		} else
+			return 0;
+	}
+
+	CAM_DBG(CAM_REQ, "Flush [%u] in progress for req_id %llu",
+		flush_req->type, flush_req->req_id);
+	list_for_each_entry_safe(req, req_temp, req_list, list) {
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			if (req->request_id != flush_req->req_id) {
+				continue;
+			} else {
+				list_del_init(&req->list);
+				list_add_tail(&req->list, &flush_list);
+				cancel_req_id_found = 1;
+				__cam_isp_ctx_update_state_monitor_array(
+					ctx_isp,
+					CAM_ISP_STATE_CHANGE_TRIGGER_FLUSH,
+					req->request_id);
+				break;
+			}
+		}
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &flush_list);
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_FLUSH, req->request_id);
+	}
+
+	if (list_empty(&flush_list)) {
+		/*
+		 * Maybe the req isn't sent to KMD since UMD already skip
+		 * req in CSL layer.
+		 */
+		CAM_INFO(CAM_ISP,
+			"flush list is empty, flush type %d for req %llu",
+			flush_req->type, flush_req->req_id);
+		return 0;
+	}
+
+	list_for_each_entry_safe(req, req_temp, &flush_list, list) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		for (i = 0; i < req_isp->num_fence_map_out; i++) {
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				CAM_DBG(CAM_ISP, "Flush req 0x%llx, fence %d",
+					req->request_id,
+					req_isp->fence_map_out[i].sync_id);
+				rc = cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_ISP_EVENT_FLUSH);
+				if (rc) {
+					tmp = req_isp->fence_map_out[i].sync_id;
+					CAM_ERR_RATE_LIMIT(CAM_ISP,
+						"signal fence %d failed", tmp);
+				}
+				req_isp->fence_map_out[i].sync_id = -1;
+			}
+		}
+		req_isp->reapply = false;
+		req_isp->cdm_reset_before_apply = false;
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	return 0;
+}
+
+static int __cam_isp_ctx_flush_req_in_top_state(
+	struct cam_context               *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	int                               rc = 0;
+	struct cam_isp_context           *ctx_isp;
+	struct cam_isp_stop_args          stop_isp;
+	struct cam_hw_stop_args           stop_args;
+	struct cam_hw_reset_args          reset_args;
+	struct cam_hw_cmd_args            hw_cmd_args;
+	struct cam_req_mgr_timer_notify    timer;
+
+	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "Flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
+	spin_unlock_bh(&ctx->lock);
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		if (ctx->state <= CAM_CTX_READY) {
+			ctx->state = CAM_CTX_ACQUIRED;
+			goto end;
+		}
+
+		spin_lock_bh(&ctx->lock);
+		ctx->state = CAM_CTX_FLUSHED;
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_HALT;
+		spin_unlock_bh(&ctx->lock);
+
+		CAM_INFO(CAM_ISP, "Last request id to flush is %lld, ctx_id:%d",
+			flush_req->req_id, ctx->ctx_id);
+		ctx->last_flush_req = flush_req->req_id;
+
+		memset(&hw_cmd_args, 0, sizeof(hw_cmd_args));
+		hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+		hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_REG_DUMP_ON_FLUSH;
+		rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&hw_cmd_args);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Reg dump on flush failed rc: %d", rc);
+			rc = 0;
+		}
+
+		stop_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		stop_isp.hw_stop_cmd = CAM_ISP_HW_STOP_IMMEDIATELY;
+		stop_isp.stop_only = true;
+		stop_args.args = (void *)&stop_isp;
+		rc = ctx->hw_mgr_intf->hw_stop(ctx->hw_mgr_intf->hw_mgr_priv,
+			&stop_args);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to stop HW in Flush rc: %d",
+				rc);
+
+		CAM_INFO(CAM_ISP, "Stop HW complete. Reset HW next.");
+		CAM_DBG(CAM_ISP, "Flush wait and active lists");
+
+		if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_timer) {
+			timer.link_hdl = ctx->link_hdl;
+			timer.dev_hdl = ctx->dev_hdl;
+			timer.state = false;
+			ctx->ctx_crm_intf->notify_timer(&timer);
+		}
+
+		spin_lock_bh(&ctx->lock);
+		if (!list_empty(&ctx->wait_req_list))
+			rc = __cam_isp_ctx_flush_req(ctx, &ctx->wait_req_list,
+				flush_req);
+
+		if (!list_empty(&ctx->active_req_list))
+			rc = __cam_isp_ctx_flush_req(ctx, &ctx->active_req_list,
+				flush_req);
+
+		ctx_isp->active_req_cnt = 0;
+		spin_unlock_bh(&ctx->lock);
+
+		reset_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		rc = ctx->hw_mgr_intf->hw_reset(ctx->hw_mgr_intf->hw_mgr_priv,
+			&reset_args);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to reset HW rc: %d", rc);
+
+		ctx_isp->init_received = false;
+	}
+
+end:
+	ctx_isp->bubble_frame_cnt = 0;
+	atomic_set(&ctx_isp->process_bubble, 0);
+	atomic_set(&ctx_isp->rxd_epoch, 0);
+	return rc;
+}
+
+static int __cam_isp_ctx_flush_req_in_ready(
+	struct cam_context *ctx,
+	struct cam_req_mgr_flush_request *flush_req)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "try to flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
+
+	/* if nothing is in pending req list, change state to acquire */
+	if (list_empty(&ctx->pending_req_list))
+		ctx->state = CAM_CTX_ACQUIRED;
+	spin_unlock_bh(&ctx->lock);
+
+	trace_cam_context_state("ISP", ctx);
+
+	CAM_DBG(CAM_ISP, "Flush request in ready state. next state %d",
+		 ctx->state);
+	return rc;
+}
+
+static struct cam_ctx_ops
+	cam_isp_ctx_activated_state_machine[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_sof,
+		},
+		.irq_ops = NULL,
+	},
+	/* APPLIED */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* EPOCH */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_epoch,
+		},
+		.irq_ops = NULL,
+	},
+	/* BUBBLE */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_bubble,
+		},
+		.irq_ops = NULL,
+	},
+	/* Bubble Applied */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HW ERROR */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HALT */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+};
+
+static struct cam_ctx_ops
+	cam_isp_ctx_fs2_state_machine[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_sof,
+		},
+		.irq_ops = NULL,
+	},
+	/* APPLIED */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* EPOCH */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_epoch,
+		},
+		.irq_ops = NULL,
+	},
+	/* BUBBLE */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_apply_req_in_bubble,
+		},
+		.irq_ops = NULL,
+	},
+	/* Bubble Applied */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HW ERROR */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HALT */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+};
+
+static int __cam_isp_ctx_rdi_only_sof_in_top_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_context                    *ctx = ctx_isp->base;
+	struct cam_req_mgr_trigger_notify      notify;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	uint64_t                               request_id  = 0;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id++;
+	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
+	ctx_isp->boot_timestamp = sof_event_data->boot_time;
+
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val);
+
+	/*
+	 * notify reqmgr with sof signal. Note, due to scheduling delay
+	 * we can run into situation that two active requests has already
+	 * be in the active queue while we try to do the notification.
+	 * In this case, we need to skip the current notification. This
+	 * helps the state machine to catch up the delay.
+	 */
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger &&
+		ctx_isp->active_req_cnt <= 2) {
+		notify.link_hdl = ctx->link_hdl;
+		notify.dev_hdl = ctx->dev_hdl;
+		notify.frame_id = ctx_isp->frame_id;
+		notify.trigger = CAM_TRIGGER_POINT_SOF;
+		notify.req_id = ctx_isp->req_info.last_bufdone_req_id;
+		notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+		notify.trigger_id = ctx_isp->trigger_id;
+
+		ctx->ctx_crm_intf->notify_trigger(&notify);
+		CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
+			ctx_isp->frame_id);
+
+		/*
+		 * It is idle frame with out any applied request id, send
+		 * request id as zero
+		 */
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Can not notify SOF to CRM");
+	}
+
+	if (list_empty(&ctx->active_req_list))
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+	else
+		CAM_DBG(CAM_ISP, "Still need to wait for the buf done");
+
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+	return rc;
+}
+
+static int __cam_isp_ctx_rdi_only_sof_in_applied_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id++;
+	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
+	ctx_isp->boot_timestamp = sof_event_data->boot_time;
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val);
+
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED;
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	return 0;
+}
+
+static int __cam_isp_ctx_rdi_only_sof_in_bubble_applied(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_ctx_request    *req;
+	struct cam_isp_ctx_req    *req_isp;
+	struct cam_context        *ctx = ctx_isp->base;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	uint64_t  request_id = 0;
+
+	/*
+	 * Sof in bubble applied state means, reg update not received.
+	 * before increment frame id and override time stamp value, send
+	 * the previous sof time stamp that got captured in the
+	 * sof in applied state.
+	 */
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val);
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+	ctx_isp->frame_id++;
+	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
+	ctx_isp->boot_timestamp = sof_event_data->boot_time;
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val);
+
+	if (list_empty(&ctx->wait_req_list)) {
+		/*
+		 * If no pending req in epoch, this is an error case.
+		 * The recovery is to go back to sof state
+		 */
+		CAM_ERR(CAM_ISP, "No wait request");
+		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+
+		/* Send SOF event as empty frame*/
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+		goto end;
+	}
+
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
+		list);
+	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	req_isp->bubble_detected = true;
+	CAM_INFO_RATE_LIMIT(CAM_ISP, "Ctx:%d Report Bubble flag %d req id:%lld",
+		ctx->ctx_id, req_isp->bubble_report, req->request_id);
+	req_isp->reapply = true;
+	req_isp->cdm_reset_before_apply = false;
+
+	if (req_isp->bubble_report && ctx->ctx_crm_intf &&
+		ctx->ctx_crm_intf->notify_err) {
+		struct cam_req_mgr_error_notify notify;
+
+		notify.link_hdl = ctx->link_hdl;
+		notify.dev_hdl = ctx->dev_hdl;
+		notify.req_id = req->request_id;
+		notify.error = CRM_KMD_ERR_BUBBLE;
+		notify.trigger = 0;
+		if (ctx_isp->subscribe_event & CAM_TRIGGER_POINT_SOF)
+			notify.trigger = CAM_TRIGGER_POINT_SOF;
+		notify.frame_id = ctx_isp->frame_id;
+		notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Notify CRM about Bubble req %lld frame %lld ctx %u",
+			req->request_id,
+			ctx_isp->frame_id,
+			ctx->ctx_id);
+		ctx->ctx_crm_intf->notify_err(&notify);
+		atomic_set(&ctx_isp->process_bubble, 1);
+	} else {
+		req_isp->bubble_report = 0;
+	}
+
+	/*
+	 * Always move the request to active list. Let buf done
+	 * function handles the rest.
+	 */
+	list_del_init(&req->list);
+	list_add_tail(&req->list, &ctx->active_req_list);
+	ctx_isp->active_req_cnt++;
+	CAM_DBG(CAM_ISP, "move request %lld to active list(cnt = %d)",
+			req->request_id, ctx_isp->active_req_cnt);
+
+	if (!req_isp->bubble_report) {
+		if (req->request_id > ctx_isp->reported_req_id) {
+			request_id = req->request_id;
+			ctx_isp->reported_req_id = request_id;
+			__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_ERROR);
+		} else
+			__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+				CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	} else
+		__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+	/* change the state to bubble, as reg update has not come */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_BUBBLE;
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+end:
+	return 0;
+}
+
+static int __cam_isp_ctx_rdi_only_sof_in_bubble_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	uint32_t i;
+	struct cam_ctx_request                *req;
+	struct cam_context                    *ctx = ctx_isp->base;
+	struct cam_req_mgr_trigger_notify      notify;
+	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
+	struct cam_isp_ctx_req                *req_isp;
+	struct cam_hw_cmd_args                 hw_cmd_args;
+	struct cam_isp_hw_cmd_args             isp_hw_cmd_args;
+	uint64_t                               request_id  = 0;
+	uint64_t                               last_cdm_done_req = 0;
+	int                                    rc = 0;
+
+	if (!evt_data) {
+		CAM_ERR(CAM_ISP, "in valid sof event data");
+		return -EINVAL;
+	}
+
+	ctx_isp->frame_id++;
+	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
+	ctx_isp->boot_timestamp = sof_event_data->boot_time;
+	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx",
+		ctx_isp->frame_id, ctx_isp->sof_timestamp_val);
+
+
+	if (atomic_read(&ctx_isp->process_bubble)) {
+		if (list_empty(&ctx->active_req_list)) {
+			CAM_ERR(CAM_ISP, "No available active req in bubble");
+			atomic_set(&ctx_isp->process_bubble, 0);
+			return -EINVAL;
+		}
+
+		if (ctx_isp->last_sof_timestamp ==
+			ctx_isp->sof_timestamp_val) {
+			CAM_DBG(CAM_ISP,
+				"Tasklet delay detected! Bubble frame: %lld check skipped, sof_timestamp: %lld, ctx_id: %d",
+				ctx_isp->frame_id,
+				ctx_isp->sof_timestamp_val,
+				ctx->ctx_id);
+			goto end;
+		}
+
+		req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+		if (req_isp->bubble_detected) {
+			hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+			hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+			isp_hw_cmd_args.cmd_type =
+				CAM_ISP_HW_MGR_GET_LAST_CDM_DONE;
+			hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+			rc = ctx->hw_mgr_intf->hw_cmd(
+				ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "HW command failed");
+				return rc;
+			}
+
+			last_cdm_done_req = isp_hw_cmd_args.u.last_cdm_done;
+			CAM_DBG(CAM_ISP, "last_cdm_done req: %d ctx_id: %d",
+				last_cdm_done_req, ctx->ctx_id);
+
+			if (last_cdm_done_req >= req->request_id) {
+				CAM_DBG(CAM_ISP,
+					"CDM callback detected for req: %lld, possible buf_done delay, waiting for buf_done",
+					req->request_id);
+				if (req_isp->num_fence_map_out ==
+					req_isp->num_deferred_acks) {
+					__cam_isp_handle_deferred_buf_done(ctx_isp, req,
+						true,
+						CAM_SYNC_STATE_SIGNALED_ERROR,
+						CAM_SYNC_ISP_EVENT_BUBBLE);
+
+					__cam_isp_ctx_handle_buf_done_for_req_list(
+						ctx_isp, req);
+				}
+				goto end;
+			} else {
+				CAM_WARN(CAM_ISP,
+					"CDM callback not happened for req: %lld, possible CDM stuck or workqueue delay",
+					req->request_id);
+				req_isp->num_acked = 0;
+				req_isp->num_deferred_acks = 0;
+				req_isp->bubble_detected = false;
+				req_isp->cdm_reset_before_apply = true;
+				list_del_init(&req->list);
+				list_add(&req->list, &ctx->pending_req_list);
+				atomic_set(&ctx_isp->process_bubble, 0);
+				ctx_isp->active_req_cnt--;
+				CAM_DBG(CAM_REQ,
+					"Move active req: %lld to pending list(cnt = %d) [bubble re-apply],ctx %u",
+					req->request_id,
+					ctx_isp->active_req_cnt, ctx->ctx_id);
+			}
+			goto end;
+		}
+	}
+
+	/*
+	 * Signal all active requests with error and move the  all the active
+	 * requests to free list
+	 */
+	while (!list_empty(&ctx->active_req_list)) {
+		req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_ISP, "signal fence in active list. fence num %d",
+			req_isp->num_fence_map_out);
+		for (i = 0; i < req_isp->num_fence_map_out; i++)
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_ISP_EVENT_BUBBLE);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+		ctx_isp->active_req_cnt--;
+	}
+
+end:
+	/* notify reqmgr with sof signal */
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger) {
+		notify.link_hdl = ctx->link_hdl;
+		notify.dev_hdl = ctx->dev_hdl;
+		notify.frame_id = ctx_isp->frame_id;
+		notify.trigger = CAM_TRIGGER_POINT_SOF;
+		notify.req_id = ctx_isp->req_info.last_bufdone_req_id;
+		notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+		notify.trigger_id = ctx_isp->trigger_id;
+
+		ctx->ctx_crm_intf->notify_trigger(&notify);
+		CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
+			ctx_isp->frame_id);
+
+	} else {
+		CAM_ERR(CAM_ISP, "Can not notify SOF to CRM");
+	}
+
+	/*
+	 * It is idle frame with out any applied request id, send
+	 * request id as zero
+	 */
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	ctx_isp->last_sof_timestamp = ctx_isp->sof_timestamp_val;
+	return 0;
+}
+
+
+static int __cam_isp_ctx_rdi_only_reg_upd_in_bubble_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_ctx_request  *req = NULL;
+	struct cam_context      *ctx = ctx_isp->base;
+
+	req = list_first_entry(&ctx->active_req_list,
+		struct cam_ctx_request, list);
+
+	CAM_INFO(CAM_ISP, "Received RUP for Bubble Request=%lld, ctx %u link: 0x%x",
+		req->request_id, ctx->ctx_id, ctx->link_hdl);
+
+	return 0;
+}
+
+static int __cam_isp_ctx_rdi_only_reg_upd_in_bubble_applied_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_ctx_request  *req = NULL;
+	struct cam_context      *ctx = ctx_isp->base;
+	struct cam_isp_ctx_req  *req_isp;
+	struct cam_req_mgr_trigger_notify  notify;
+	uint64_t  request_id  = 0;
+
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
+	/* notify reqmgr with sof signal*/
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger) {
+		if (list_empty(&ctx->wait_req_list)) {
+			CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request");
+			goto error;
+		}
+		req = list_first_entry(&ctx->wait_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		request_id =
+			(req_isp->hw_update_data.packet_opcode_type ==
+				CAM_ISP_PACKET_INIT_DEV) ?
+			0 : req->request_id;
+
+		if (req_isp->num_fence_map_out != 0) {
+			list_add_tail(&req->list, &ctx->active_req_list);
+			ctx_isp->active_req_cnt++;
+			CAM_DBG(CAM_ISP,
+				"move request %lld to active list(cnt = %d)",
+				req->request_id, ctx_isp->active_req_cnt);
+			/* if packet has buffers, set correct request id */
+			request_id = req->request_id;
+		} else {
+			/* no io config, so the request is completed. */
+			list_add_tail(&req->list, &ctx->free_req_list);
+			CAM_DBG(CAM_ISP,
+				"move active req %lld to free list(cnt=%d)",
+				req->request_id, ctx_isp->active_req_cnt);
+		}
+
+		notify.link_hdl = ctx->link_hdl;
+		notify.dev_hdl = ctx->dev_hdl;
+		notify.frame_id = ctx_isp->frame_id;
+		notify.trigger = CAM_TRIGGER_POINT_SOF;
+		notify.req_id = ctx_isp->req_info.last_bufdone_req_id;
+		notify.sof_timestamp_val = ctx_isp->sof_timestamp_val;
+		notify.trigger_id = ctx_isp->trigger_id;
+
+		ctx->ctx_crm_intf->notify_trigger(&notify);
+		CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
+			ctx_isp->frame_id);
+	} else {
+		CAM_ERR(CAM_ISP, "Can not notify SOF to CRM");
+	}
+	if (request_id)
+		ctx_isp->reported_req_id = request_id;
+
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_RUP, req);
+	return 0;
+error:
+	/* Send SOF event as idle frame*/
+	__cam_isp_ctx_send_sof_timestamp(ctx_isp, request_id,
+		CAM_REQ_MGR_SOF_EVENT_SUCCESS);
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_RUP, NULL);
+
+	/*
+	 * There is no request in the pending list, move the sub state machine
+	 * to SOF sub state
+	 */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+
+	return 0;
+}
+
+static int __cam_isp_ctx_rdi_only_reg_upd_in_applied_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	struct cam_ctx_request  *req = NULL;
+	struct cam_context      *ctx = ctx_isp->base;
+	struct cam_isp_ctx_req  *req_isp;
+	uint64_t  request_id  = 0;
+
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request");
+		goto end;
+	}
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
+
+	req = list_first_entry(&ctx->wait_req_list,
+			struct cam_ctx_request, list);
+	list_del_init(&req->list);
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	request_id = (req_isp->hw_update_data.packet_opcode_type ==
+			CAM_ISP_PACKET_INIT_DEV) ? 0 : req->request_id;
+
+	if (req_isp->num_fence_map_out != 0) {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		request_id = req->request_id;
+		CAM_DBG(CAM_REQ,
+			"move request %lld to active list(cnt = %d), ctx %u",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
+		__cam_isp_ctx_update_event_record(ctx_isp,
+			CAM_ISP_CTX_EVENT_RUP, req);
+	} else {
+		/* no io config, so the request is completed. */
+		list_add_tail(&req->list, &ctx->free_req_list);
+		CAM_DBG(CAM_ISP,
+			"move active request %lld to free list(cnt = %d), ctx %u",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
+	}
+
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_RUP, req);
+
+	return 0;
+end:
+	__cam_isp_ctx_update_event_record(ctx_isp,
+		CAM_ISP_CTX_EVENT_RUP, NULL);
+	/*
+	 * There is no request in the pending list, move the sub state machine
+	 * to SOF sub state
+	 */
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+	return 0;
+}
+
+static struct cam_isp_ctx_irq_ops
+	cam_isp_ctx_rdi_only_activated_state_machine_irq
+			[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.irq_ops = {
+			NULL,
+			__cam_isp_ctx_rdi_only_sof_in_top_state,
+			__cam_isp_ctx_reg_upd_in_sof,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			NULL,
+		},
+	},
+	/* APPLIED */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_rdi_only_sof_in_applied_state,
+			__cam_isp_ctx_rdi_only_reg_upd_in_applied_state,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_applied,
+		},
+	},
+	/* EPOCH */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_rdi_only_sof_in_top_state,
+			NULL,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_epoch,
+		},
+	},
+	/* BUBBLE*/
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_rdi_only_sof_in_bubble_state,
+			__cam_isp_ctx_rdi_only_reg_upd_in_bubble_state,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_bubble,
+		},
+	},
+	/* BUBBLE APPLIED ie PRE_BUBBLE */
+	{
+		.irq_ops = {
+			__cam_isp_ctx_handle_error,
+			__cam_isp_ctx_rdi_only_sof_in_bubble_applied,
+			__cam_isp_ctx_rdi_only_reg_upd_in_bubble_applied_state,
+			NULL,
+			__cam_isp_ctx_notify_eof_in_activated_state,
+			__cam_isp_ctx_buf_done_in_bubble_applied,
+		},
+	},
+	/* HW ERROR */
+	{
+	},
+	/* HALT */
+	{
+	},
+};
+
+static int __cam_isp_ctx_rdi_only_apply_req_top_state(
+	struct cam_context *ctx, struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "current Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+	rc = __cam_isp_ctx_apply_req_in_activated_state(ctx, apply,
+		CAM_ISP_CTX_ACTIVATED_APPLIED);
+	CAM_DBG(CAM_ISP, "new Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"ctx_id:%d Apply failed in Substate[%s], rc %d",
+			ctx->ctx_id,
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc);
+
+	return rc;
+}
+
+static struct cam_ctx_ops
+	cam_isp_ctx_rdi_only_activated_state_machine
+		[CAM_ISP_CTX_ACTIVATED_MAX] = {
+	/* SOF */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_rdi_only_apply_req_top_state,
+		},
+		.irq_ops = NULL,
+	},
+	/* APPLIED */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* EPOCH */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {
+			.apply_req = __cam_isp_ctx_rdi_only_apply_req_top_state,
+		},
+		.irq_ops = NULL,
+	},
+	/* PRE BUBBLE */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* BUBBLE */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HW ERROR */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* HALT */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+};
+
+static int __cam_isp_ctx_release_hw_in_top_state(struct cam_context *ctx,
+	void *cmd)
+{
+	int rc = 0;
+	struct cam_hw_release_args       rel_arg;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_req_mgr_flush_request flush_req;
+	int i;
+
+	if (ctx_isp->hw_ctx) {
+		rel_arg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv,
+			&rel_arg);
+		ctx_isp->hw_ctx = NULL;
+	} else {
+		CAM_ERR(CAM_ISP, "No hw resources acquired for ctx[%u]", ctx->ctx_id);
+	}
+
+	ctx->last_flush_req = 0;
+	ctx_isp->custom_enabled = false;
+	ctx_isp->use_frame_header_ts = false;
+	ctx_isp->frame_id = 0;
+	ctx_isp->active_req_cnt = 0;
+	ctx_isp->reported_req_id = 0;
+	ctx_isp->hw_acquired = false;
+	ctx_isp->init_received = false;
+	ctx_isp->support_consumed_addr = false;
+	ctx_isp->req_info.last_bufdone_req_id = 0;
+
+	atomic64_set(&ctx_isp->state_monitor_head, -1);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->event_record_head[i], -1);
+	/*
+	 * Ideally, we should never have any active request here.
+	 * But we still add some sanity check code here to help the debug
+	 */
+	if (!list_empty(&ctx->active_req_list))
+		CAM_WARN(CAM_ISP, "Active list is not empty");
+
+	/* Flush all the pending request list  */
+	flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_ALL;
+	flush_req.link_hdl = ctx->link_hdl;
+	flush_req.dev_hdl = ctx->dev_hdl;
+	flush_req.req_id = 0;
+
+	CAM_DBG(CAM_ISP, "try to flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, &flush_req);
+	spin_unlock_bh(&ctx->lock);
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_DBG(CAM_ISP, "Release device success[%u] next state %d",
+		ctx->ctx_id, ctx->state);
+	return rc;
+}
+
+/* top level state machine */
+static int __cam_isp_ctx_release_dev_in_top_state(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_release_args       rel_arg;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_req_mgr_flush_request flush_req;
+
+	if (cmd && ctx_isp->hw_ctx) {
+		CAM_ERR(CAM_ISP, "releasing hw");
+		__cam_isp_ctx_release_hw_in_top_state(ctx, NULL);
+	}
+
+	if (ctx_isp->hw_ctx) {
+		rel_arg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+		ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv,
+			&rel_arg);
+		ctx_isp->hw_ctx = NULL;
+	}
+
+	ctx->session_hdl = -1;
+	ctx->dev_hdl = -1;
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+	ctx->last_flush_req = 0;
+	ctx_isp->frame_id = 0;
+	ctx_isp->active_req_cnt = 0;
+	ctx_isp->reported_req_id = 0;
+	ctx_isp->hw_acquired = false;
+	ctx_isp->init_received = false;
+	ctx_isp->offline_context = false;
+	ctx_isp->rdi_only_context = false;
+	ctx_isp->req_info.last_bufdone_req_id = 0;
+
+	atomic64_set(&ctx_isp->state_monitor_head, -1);
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->event_record_head[i], -1);
+	/*
+	 * Ideally, we should never have any active request here.
+	 * But we still add some sanity check code here to help the debug
+	 */
+	if (!list_empty(&ctx->active_req_list))
+		CAM_ERR(CAM_ISP, "Active list is not empty");
+
+	/* Flush all the pending request list  */
+	flush_req.type = CAM_REQ_MGR_FLUSH_TYPE_ALL;
+	flush_req.link_hdl = ctx->link_hdl;
+	flush_req.dev_hdl = ctx->dev_hdl;
+	flush_req.req_id = 0;
+
+	CAM_DBG(CAM_ISP, "try to flush pending list");
+	spin_lock_bh(&ctx->lock);
+	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, &flush_req);
+	spin_unlock_bh(&ctx->lock);
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_DBG(CAM_ISP, "Release device success[%u] next state %d",
+		ctx->ctx_id, ctx->state);
+	return rc;
+}
+
+static int __cam_isp_ctx_config_dev_in_top_state(
+	struct cam_context *ctx, struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0, i;
+	struct cam_ctx_request           *req = NULL;
+	struct cam_isp_ctx_req           *req_isp;
+	uintptr_t                         packet_addr;
+	struct cam_packet                *packet;
+	size_t                            len = 0;
+	size_t                            remain_len = 0;
+	struct cam_hw_prepare_update_args cfg = {0};
+	struct cam_req_mgr_add_request    add_req;
+	struct cam_isp_context           *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args           hw_cmd_args;
+	struct cam_isp_hw_cmd_args       isp_hw_cmd_args;
+	uint32_t                         packet_opcode = 0;
+
+	CAM_DBG(CAM_ISP, "get free request object......");
+
+	/* get free request */
+	spin_lock_bh(&ctx->lock);
+	if (!list_empty(&ctx->free_req_list)) {
+		req = list_first_entry(&ctx->free_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+	}
+	spin_unlock_bh(&ctx->lock);
+
+	if (!req) {
+		CAM_ERR(CAM_ISP, "No more request obj free");
+		return -ENOMEM;
+	}
+
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	/* for config dev, only memory handle is supported */
+	/* map packet from the memhandle */
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Can not get packet address");
+		rc = -EINVAL;
+		goto free_req;
+	}
+
+	remain_len = len;
+	if ((len < sizeof(struct cam_packet)) ||
+		((size_t)cmd->offset >= len - sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_ISP, "invalid buff length: %zu or offset", len);
+		rc = -EINVAL;
+		goto free_req;
+	}
+
+	remain_len -= (size_t)cmd->offset;
+	packet = (struct cam_packet *)(packet_addr + (uint32_t)cmd->offset);
+	CAM_DBG(CAM_ISP, "pack_handle %llx", cmd->packet_handle);
+	CAM_DBG(CAM_ISP, "packet address is 0x%zx", packet_addr);
+	CAM_DBG(CAM_ISP, "packet with length %zu, offset 0x%llx",
+		len, cmd->offset);
+	CAM_DBG(CAM_ISP, "Packet request id %lld",
+		packet->header.request_id);
+	CAM_DBG(CAM_ISP, "Packet size 0x%x", packet->header.size);
+	CAM_DBG(CAM_ISP, "packet op %d", packet->header.op_code);
+
+	/* Query the packet opcode */
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_GET_PACKET_OPCODE;
+	isp_hw_cmd_args.cmd_data = (void *)packet;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed");
+		goto free_req;
+	}
+
+	packet_opcode = isp_hw_cmd_args.u.packet_op_code;
+	CAM_DBG(CAM_ISP, "packet op %d", packet_opcode);
+
+	if ((packet_opcode == CAM_ISP_PACKET_UPDATE_DEV)
+		&& (packet->header.request_id <= ctx->last_flush_req)) {
+		CAM_INFO(CAM_ISP,
+			"request %lld has been flushed, reject packet",
+			packet->header.request_id);
+		rc = -EBADR;
+		goto free_req;
+	} else if ((packet_opcode == CAM_ISP_PACKET_INIT_DEV)
+		&& (packet->header.request_id <= ctx->last_flush_req)
+		&& ctx->last_flush_req && packet->header.request_id) {
+		CAM_WARN(CAM_ISP,
+			"last flushed req is %lld, config dev(init) for req %lld",
+			ctx->last_flush_req, packet->header.request_id);
+		rc = -EBADR;
+		goto free_req;
+	}
+
+	cfg.packet = packet;
+	cfg.remain_len = remain_len;
+	cfg.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	cfg.max_hw_update_entries = CAM_ISP_CTX_CFG_MAX;
+	cfg.hw_update_entries = req_isp->cfg;
+	cfg.max_out_map_entries = CAM_ISP_CTX_RES_MAX;
+	cfg.max_in_map_entries = CAM_ISP_CTX_RES_MAX;
+	cfg.out_map_entries = req_isp->fence_map_out;
+	cfg.in_map_entries = req_isp->fence_map_in;
+	cfg.priv  = &req_isp->hw_update_data;
+	cfg.pf_data = &(req->pf_data);
+
+	CAM_DBG(CAM_ISP, "try to prepare config packet......");
+
+	rc = ctx->hw_mgr_intf->hw_prepare_update(
+		ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Prepare config packet failed in HW layer");
+		rc = -EFAULT;
+		goto free_req;
+	}
+
+	req_isp->num_cfg = cfg.num_hw_update_entries;
+	req_isp->num_fence_map_out = cfg.num_out_map_entries;
+	req_isp->num_fence_map_in = cfg.num_in_map_entries;
+	req_isp->num_acked = 0;
+	req_isp->num_deferred_acks = 0;
+	req_isp->bubble_detected = false;
+	req_isp->cdm_reset_before_apply = false;
+	req_isp->hw_update_data.packet = packet;
+
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		rc = cam_sync_get_obj_ref(req_isp->fence_map_out[i].sync_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can't get ref for fence %d",
+				req_isp->fence_map_out[i].sync_id);
+			goto put_ref;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "num_entry: %d, num fence out: %d, num fence in: %d",
+		req_isp->num_cfg, req_isp->num_fence_map_out,
+		req_isp->num_fence_map_in);
+
+	req->request_id = packet->header.request_id;
+	req->status = 1;
+
+	CAM_DBG(CAM_ISP, "Packet request id %lld packet opcode:%d",
+		packet->header.request_id,
+		req_isp->hw_update_data.packet_opcode_type);
+
+	if (req_isp->hw_update_data.packet_opcode_type ==
+		CAM_ISP_PACKET_INIT_DEV) {
+		if (ctx->state < CAM_CTX_ACTIVATED) {
+			rc = __cam_isp_ctx_enqueue_init_request(ctx, req);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Enqueue INIT pkt failed");
+			ctx_isp->init_received = true;
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_ISP, "Recevied INIT pkt in wrong state:%d",
+				ctx->state);
+		}
+	} else {
+		if (ctx_isp->offline_context) {
+			__cam_isp_ctx_enqueue_request_in_order(ctx, req);
+		} else if ((ctx->state != CAM_CTX_FLUSHED) &&
+			(ctx->state >= CAM_CTX_READY) &&
+			ctx->ctx_crm_intf->add_req) {
+			memset(&add_req, 0, sizeof(add_req));
+			add_req.link_hdl = ctx->link_hdl;
+			add_req.dev_hdl  = ctx->dev_hdl;
+			add_req.req_id   = req->request_id;
+			rc = ctx->ctx_crm_intf->add_req(&add_req);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Add req failed: req id=%llu",
+					req->request_id);
+			} else {
+				__cam_isp_ctx_enqueue_request_in_order(
+					ctx, req);
+			}
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_ISP,
+				"Recevied update req %lld in wrong state:%d",
+				req->request_id, ctx->state);
+		}
+	}
+	if (rc)
+		goto put_ref;
+
+	CAM_DBG(CAM_REQ,
+		"Preprocessing Config req_id %lld successful on ctx %u",
+		req->request_id, ctx->ctx_id);
+
+	if (ctx_isp->offline_context && atomic_read(&ctx_isp->rxd_epoch)) {
+		__cam_isp_ctx_schedule_apply_req_offline(ctx_isp);
+	}
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+
+put_ref:
+	for (--i; i >= 0; i--) {
+		if (cam_sync_put_obj_ref(req_isp->fence_map_out[i].sync_id))
+			CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d",
+				req_isp->fence_map_out[i].sync_id);
+	}
+free_req:
+	spin_lock_bh(&ctx->lock);
+	list_add_tail(&req->list, &ctx->free_req_list);
+	spin_unlock_bh(&ctx->lock);
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+}
+
+static int __cam_isp_ctx_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_acquire_args       param;
+	struct cam_isp_resource         *isp_res = NULL;
+	struct cam_create_dev_hdl        req_hdl_param;
+	struct cam_hw_release_args       release;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args           hw_cmd_args;
+	struct cam_isp_hw_cmd_args       isp_hw_cmd_args;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_ISP, "HW interface is not ready");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"session_hdl 0x%x, num_resources %d, hdl type %d, res %lld",
+		cmd->session_handle, cmd->num_resources,
+		cmd->handle_type, cmd->resource_hdl);
+
+	if (cmd->num_resources == CAM_API_COMPAT_CONSTANT) {
+		ctx_isp->split_acquire = true;
+		CAM_DBG(CAM_ISP, "Acquire dev handle");
+		goto get_dev_handle;
+	}
+
+	if (cmd->num_resources > CAM_ISP_CTX_RES_MAX) {
+		CAM_ERR(CAM_ISP, "Too much resources in the acquire");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	/* for now we only support user pointer */
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_ISP, "Only user pointer is supported");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	isp_res = kzalloc(
+		sizeof(*isp_res)*cmd->num_resources, GFP_KERNEL);
+	if (!isp_res) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "start copy %d resources from user",
+		 cmd->num_resources);
+
+	if (copy_from_user(isp_res, u64_to_user_ptr(cmd->resource_hdl),
+		sizeof(*isp_res)*cmd->num_resources)) {
+		rc = -EFAULT;
+		goto free_res;
+	}
+
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.num_acq = cmd->num_resources;
+	param.acquire_info = (uintptr_t) isp_res;
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Acquire device failed");
+		goto free_res;
+	}
+
+	/* Query the context has rdi only resource */
+	hw_cmd_args.ctxt_to_hw_map = param.ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_CTX_TYPE;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed");
+		goto free_hw;
+	}
+
+	if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_RDI) {
+		/*
+		 * this context has rdi only resource assign rdi only
+		 * state machine
+		 */
+		CAM_DBG(CAM_ISP, "RDI only session Context");
+
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_rdi_only_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_rdi_only_activated_state_machine;
+		ctx_isp->rdi_only_context = true;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_FS2) {
+		CAM_DBG(CAM_ISP, "FS2 Session has PIX, RD and RDI");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_fs2_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_fs2_state_machine;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_OFFLINE) {
+		CAM_DBG(CAM_ISP, "offline Session has PIX and RD resources");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_offline_state_machine_irq;
+	} else {
+		CAM_DBG(CAM_ISP, "Session has PIX or PIX and RDI resources");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_activated_state_machine;
+	}
+
+	ctx_isp->hw_ctx = param.ctxt_to_hw_map;
+	ctx_isp->hw_acquired = true;
+	ctx_isp->split_acquire = false;
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+
+	atomic64_set(&ctx_isp->state_monitor_head, -1);
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->event_record_head[i], -1);
+
+	kfree(isp_res);
+	isp_res = NULL;
+
+get_dev_handle:
+
+	req_hdl_param.session_hdl = cmd->session_handle;
+	/* bridge is not ready for these flags. so false for now */
+	req_hdl_param.v4l2_sub_dev_flag = 0;
+	req_hdl_param.media_entity_flag = 0;
+	req_hdl_param.ops = ctx->crm_ctx_intf;
+	req_hdl_param.priv = ctx;
+	req_hdl_param.dev_id = CAM_ISP;
+	CAM_DBG(CAM_ISP, "get device handle form bridge");
+	ctx->dev_hdl = cam_create_device_hdl(&req_hdl_param);
+	if (ctx->dev_hdl <= 0) {
+		rc = -EFAULT;
+		CAM_ERR(CAM_ISP, "Can not create device handle");
+		goto free_hw;
+	}
+	cmd->dev_handle = ctx->dev_hdl;
+
+	/* store session information */
+	ctx->session_hdl = cmd->session_handle;
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_DBG(CAM_ISP,
+		"Acquire success on session_hdl 0x%x num_rsrces %d ctx %u",
+		cmd->session_handle, cmd->num_resources, ctx->ctx_id);
+
+	return rc;
+
+free_hw:
+	release.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	if (ctx_isp->hw_acquired)
+		ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv,
+			&release);
+	ctx_isp->hw_ctx = NULL;
+	ctx_isp->hw_acquired = false;
+free_res:
+	kfree(isp_res);
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_acquire_hw_v1(struct cam_context *ctx,
+	void *args)
+{
+	int rc = 0;
+	int i;
+	struct cam_acquire_hw_cmd_v1 *cmd =
+		(struct cam_acquire_hw_cmd_v1 *)args;
+	struct cam_hw_acquire_args       param;
+	struct cam_hw_release_args       release;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args           hw_cmd_args;
+	struct cam_isp_hw_cmd_args       isp_hw_cmd_args;
+	struct cam_isp_acquire_hw_info  *acquire_hw_info = NULL;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_ISP, "HW interface is not ready");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"session_hdl 0x%x, hdl type %d, res %lld",
+		cmd->session_handle, cmd->handle_type, cmd->resource_hdl);
+
+	/* for now we only support user pointer */
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_ISP, "Only user pointer is supported");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cmd->data_size < sizeof(*acquire_hw_info)) {
+		CAM_ERR(CAM_ISP, "data_size is not a valid value");
+		goto end;
+	}
+
+	acquire_hw_info = kzalloc(cmd->data_size, GFP_KERNEL);
+	if (!acquire_hw_info) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "start copy resources from user");
+
+	if (copy_from_user(acquire_hw_info, (void __user *)cmd->resource_hdl,
+		cmd->data_size)) {
+		rc = -EFAULT;
+		goto free_res;
+	}
+
+	memset(&param, 0, sizeof(param));
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.num_acq = CAM_API_COMPAT_CONSTANT;
+	param.acquire_info_size = cmd->data_size;
+	param.acquire_info = (uint64_t) acquire_hw_info;
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Acquire device failed");
+		goto free_res;
+	}
+
+	ctx_isp->support_consumed_addr =
+		param.support_consumed_addr;
+
+	/* Query the context has rdi only resource */
+	hw_cmd_args.ctxt_to_hw_map = param.ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_CTX_TYPE;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed");
+		goto free_hw;
+	}
+
+	if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_RDI) {
+		/*
+		 * this context has rdi only resource assign rdi only
+		 * state machine
+		 */
+		CAM_DBG(CAM_ISP, "RDI only session Context");
+
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_rdi_only_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_rdi_only_activated_state_machine;
+		ctx_isp->rdi_only_context = true;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_FS2) {
+		CAM_DBG(CAM_ISP, "FS2 Session has PIX, RD and RDI");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_fs2_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_fs2_state_machine;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_OFFLINE) {
+		CAM_DBG(CAM_ISP, "Offline session has PIX and RD resources");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_offline_state_machine_irq;
+		ctx_isp->substate_machine = NULL;
+	} else {
+		CAM_DBG(CAM_ISP, "Session has PIX or PIX and RDI resources");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_activated_state_machine;
+	}
+
+	ctx_isp->hw_ctx = param.ctxt_to_hw_map;
+	ctx_isp->hw_acquired = true;
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+
+	atomic64_set(&ctx_isp->state_monitor_head, -1);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->event_record_head[i], -1);
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_DBG(CAM_ISP,
+		"Acquire success on session_hdl 0x%xs ctx_type %d ctx_id %u",
+		ctx->session_hdl, isp_hw_cmd_args.u.ctx_type, ctx->ctx_id);
+	kfree(acquire_hw_info);
+	return rc;
+
+free_hw:
+	release.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv, &release);
+	ctx_isp->hw_ctx = NULL;
+	ctx_isp->hw_acquired = false;
+free_res:
+	kfree(acquire_hw_info);
+end:
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_offline_ife_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int __cam_isp_ctx_acquire_hw_v2(struct cam_context *ctx,
+	void *args)
+{
+	int rc = 0, i, j;
+	struct cam_acquire_hw_cmd_v2 *cmd =
+		(struct cam_acquire_hw_cmd_v2 *)args;
+	struct cam_hw_acquire_args       param;
+	struct cam_hw_release_args       release;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args           hw_cmd_args;
+	struct cam_isp_hw_cmd_args       isp_hw_cmd_args;
+	struct cam_isp_acquire_hw_info  *acquire_hw_info = NULL;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_ISP, "HW interface is not ready");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"session_hdl 0x%x, hdl type %d, res %lld",
+		cmd->session_handle, cmd->handle_type, cmd->resource_hdl);
+
+	/* for now we only support user pointer */
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_ISP, "Only user pointer is supported");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cmd->data_size < sizeof(*acquire_hw_info)) {
+		CAM_ERR(CAM_ISP, "data_size is not a valid value");
+		goto end;
+	}
+
+	acquire_hw_info = kzalloc(cmd->data_size, GFP_KERNEL);
+	if (!acquire_hw_info) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "start copy resources from user");
+
+	if (copy_from_user(acquire_hw_info, (void __user *)cmd->resource_hdl,
+		cmd->data_size)) {
+		rc = -EFAULT;
+		goto free_res;
+	}
+
+	memset(&param, 0, sizeof(param));
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.num_acq = CAM_API_COMPAT_CONSTANT;
+	param.acquire_info_size = cmd->data_size;
+	param.acquire_info = (uint64_t) acquire_hw_info;
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Acquire device failed");
+		goto free_res;
+	}
+
+	/* Set custom flag if applicable
+	 * custom hw is supported only on v2
+	 */
+	ctx_isp->custom_enabled = param.custom_enabled;
+	ctx_isp->use_frame_header_ts = param.use_frame_header_ts;
+	ctx_isp->support_consumed_addr =
+		param.support_consumed_addr;
+
+	/* Query the context has rdi only resource */
+	hw_cmd_args.ctxt_to_hw_map = param.ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_CTX_TYPE;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed");
+		goto free_hw;
+	}
+
+	if (param.valid_acquired_hw) {
+		for (i = 0; i < CAM_MAX_ACQ_RES; i++)
+			cmd->hw_info.acquired_hw_id[i] =
+				param.acquired_hw_id[i];
+
+		for (i = 0; i < CAM_MAX_ACQ_RES; i++)
+			for (j = 0; j < CAM_MAX_HW_SPLIT; j++)
+				cmd->hw_info.acquired_hw_path[i][j] =
+					param.acquired_hw_path[i][j];
+	}
+	cmd->hw_info.valid_acquired_hw =
+		param.valid_acquired_hw;
+
+	cmd->hw_info.valid_acquired_hw = param.valid_acquired_hw;
+
+	if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_RDI) {
+		/*
+		 * this context has rdi only resource assign rdi only
+		 * state machine
+		 */
+		CAM_DBG(CAM_ISP, "RDI only session Context");
+
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_rdi_only_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_rdi_only_activated_state_machine;
+		ctx_isp->rdi_only_context = true;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_FS2) {
+		CAM_DBG(CAM_ISP, "FS2 Session has PIX, RD and RDI");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_fs2_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_fs2_state_machine;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_OFFLINE) {
+		CAM_DBG(CAM_ISP, "Offline Session has PIX and RD resources");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_offline_state_machine_irq;
+		ctx_isp->substate_machine = NULL;
+		ctx_isp->offline_context = true;
+
+		rc = cam_req_mgr_workq_create("offline_ife", 20,
+			&ctx_isp->workq, CRM_WORKQ_USAGE_IRQ, 0,
+			cam_req_mgr_process_workq_offline_ife_worker);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Failed to create workq for offline IFE rc:%d",
+				rc);
+	} else {
+		CAM_DBG(CAM_ISP, "Session has PIX or PIX and RDI resources");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_activated_state_machine;
+	}
+
+	ctx_isp->hw_ctx = param.ctxt_to_hw_map;
+	ctx_isp->hw_acquired = true;
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+
+	if (copy_to_user((void __user *)cmd->resource_hdl, acquire_hw_info,
+		cmd->data_size)) {
+		rc = -EFAULT;
+		goto free_hw;
+	}
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_DBG(CAM_ISP,
+		"Acquire success on session_hdl 0x%xs ctx_type %d ctx_id %u",
+		ctx->session_hdl, isp_hw_cmd_args.u.ctx_type, ctx->ctx_id);
+	kfree(acquire_hw_info);
+	return rc;
+
+free_hw:
+	release.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv, &release);
+	ctx_isp->hw_ctx = NULL;
+	ctx_isp->hw_acquired = false;
+free_res:
+	kfree(acquire_hw_info);
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_acquire_hw_in_acquired(struct cam_context *ctx,
+	void *args)
+{
+	int rc = -EINVAL;
+	uint32_t api_version;
+
+	if (!ctx || !args) {
+		CAM_ERR(CAM_ISP, "Invalid input pointer");
+		return rc;
+	}
+
+	api_version = *((uint32_t *)args);
+	if (api_version == 1)
+		rc = __cam_isp_ctx_acquire_hw_v1(ctx, args);
+	else if (api_version == 2)
+		rc = __cam_isp_ctx_acquire_hw_v2(ctx, args);
+	else
+		CAM_ERR(CAM_ISP, "Unsupported api version %d", api_version);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_config_dev_in_acquired(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	if (!ctx_isp->hw_acquired) {
+		CAM_ERR(CAM_ISP, "HW is not acquired, reject packet");
+		return -EINVAL;
+	}
+
+	rc = __cam_isp_ctx_config_dev_in_top_state(ctx, cmd);
+
+	if (!rc && ((ctx->link_hdl >= 0) || ctx_isp->offline_context)) {
+		ctx->state = CAM_CTX_READY;
+		trace_cam_context_state("ISP", ctx);
+	}
+
+	CAM_DBG(CAM_ISP, "next state %d", ctx->state);
+	return rc;
+}
+
+static int __cam_isp_ctx_config_dev_in_flushed(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_start_stop_dev_cmd start_cmd;
+	struct cam_hw_cmd_args hw_cmd_args;
+	struct cam_isp_hw_cmd_args isp_hw_cmd_args;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	if (!ctx_isp->hw_acquired) {
+		CAM_ERR(CAM_ISP, "HW is not acquired, reject packet");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = __cam_isp_ctx_config_dev_in_top_state(ctx, cmd);
+	if (rc)
+		goto end;
+
+	if (!ctx_isp->init_received) {
+		CAM_WARN(CAM_ISP,
+			"Received update packet in flushed state, skip start");
+		goto end;
+	}
+
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_RESUME_HW;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to resume HW rc: %d", rc);
+		goto end;
+	}
+
+	start_cmd.dev_handle = cmd->dev_handle;
+	start_cmd.session_handle = cmd->session_handle;
+	rc = __cam_isp_ctx_start_dev_in_ready(ctx, &start_cmd);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Failed to re-start HW after flush rc: %d", rc);
+	else
+		CAM_INFO(CAM_ISP,
+			"Received init after flush. Re-start HW complete in ctx:%d",
+			ctx->ctx_id);
+
+end:
+	CAM_DBG(CAM_ISP, "next state %d sub_state:%d", ctx->state,
+		ctx_isp->substate_activated);
+	return rc;
+}
+
+static int __cam_isp_ctx_link_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *link)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	CAM_DBG(CAM_ISP, "Enter.........");
+
+	ctx->link_hdl = link->link_hdl;
+	ctx->ctx_crm_intf = link->crm_cb;
+	ctx_isp->subscribe_event =
+		CAM_TRIGGER_POINT_SOF | CAM_TRIGGER_POINT_EOF;
+	ctx_isp->trigger_id = link->trigger_id;
+
+	/* change state only if we had the init config */
+	if (ctx_isp->init_received) {
+		ctx->state = CAM_CTX_READY;
+		trace_cam_context_state("ISP", ctx);
+	}
+
+	CAM_DBG(CAM_ISP, "next state %d", ctx->state);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_unlink_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+	ctx_isp->trigger_id = -1;
+
+	return rc;
+}
+
+static int __cam_isp_ctx_get_dev_info_in_acquired(struct cam_context *ctx,
+	struct cam_req_mgr_device_info *dev_info)
+{
+	int rc = 0;
+
+	dev_info->dev_hdl = ctx->dev_hdl;
+	strscpy(dev_info->name, CAM_ISP_DEV_NAME, sizeof(dev_info->name));
+	dev_info->dev_id = CAM_REQ_MGR_DEVICE_IFE;
+	dev_info->p_delay = 1;
+	dev_info->trigger = CAM_TRIGGER_POINT_SOF;
+	dev_info->trigger_on = true;
+
+	return rc;
+}
+
+static int __cam_isp_ctx_start_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+	int i;
+	struct cam_isp_start_args        start_isp;
+	struct cam_ctx_request          *req;
+	struct cam_isp_ctx_req          *req_isp;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	if (cmd->session_handle != ctx->session_hdl ||
+		cmd->dev_handle != ctx->dev_hdl) {
+		rc = -EPERM;
+		goto end;
+	}
+
+	if (list_empty(&ctx->pending_req_list)) {
+		/* should never happen */
+		CAM_ERR(CAM_ISP, "Start device with empty configuration");
+		rc = -EFAULT;
+		goto end;
+	} else {
+		req = list_first_entry(&ctx->pending_req_list,
+			struct cam_ctx_request, list);
+	}
+	req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+
+	if (!ctx_isp->hw_ctx) {
+		CAM_ERR(CAM_ISP, "Wrong hw context pointer.");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	start_isp.hw_config.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	start_isp.hw_config.request_id = req->request_id;
+	start_isp.hw_config.hw_update_entries = req_isp->cfg;
+	start_isp.hw_config.num_hw_update_entries = req_isp->num_cfg;
+	start_isp.hw_config.priv  = &req_isp->hw_update_data;
+	start_isp.hw_config.init_packet = 1;
+	start_isp.hw_config.reapply = 0;
+	start_isp.hw_config.cdm_reset_before_apply = false;
+
+	ctx_isp->last_applied_req_id = req->request_id;
+
+	if (ctx->state == CAM_CTX_FLUSHED)
+		start_isp.start_only = true;
+	else
+		start_isp.start_only = false;
+
+	atomic_set(&ctx_isp->process_bubble, 0);
+	atomic_set(&ctx_isp->rxd_epoch, 0);
+	ctx_isp->frame_id = 0;
+	ctx_isp->active_req_cnt = 0;
+	ctx_isp->reported_req_id = 0;
+	ctx_isp->bubble_frame_cnt = 0;
+	ctx_isp->substate_activated = ctx_isp->rdi_only_context ?
+		CAM_ISP_CTX_ACTIVATED_APPLIED :
+		(req_isp->num_fence_map_out) ? CAM_ISP_CTX_ACTIVATED_EPOCH :
+		CAM_ISP_CTX_ACTIVATED_SOF;
+
+	atomic64_set(&ctx_isp->state_monitor_head, -1);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->event_record_head[i], -1);
+
+	/*
+	 * In case of CSID TPG we might receive SOF and RUP IRQs
+	 * before hw_mgr_intf->hw_start has returned. So move
+	 * req out of pending list before hw_start and add it
+	 * back to pending list if hw_start fails.
+	 */
+	list_del_init(&req->list);
+
+	if (ctx_isp->offline_context && !req_isp->num_fence_map_out) {
+		list_add_tail(&req->list, &ctx->free_req_list);
+		atomic_set(&ctx_isp->rxd_epoch, 1);
+		CAM_DBG(CAM_REQ,
+			"Move pending req: %lld to free list(cnt: %d) offline ctx %u",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
+	} else if (ctx_isp->rdi_only_context || !req_isp->num_fence_map_out) {
+		list_add_tail(&req->list, &ctx->wait_req_list);
+		CAM_DBG(CAM_REQ,
+			"Move pending req: %lld to wait list(cnt: %d) ctx %u",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id);
+	} else {
+		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+		CAM_DBG(CAM_REQ,
+			"Move pending req: %lld to active list(cnt: %d) ctx %u offline %d",
+			req->request_id, ctx_isp->active_req_cnt, ctx->ctx_id,
+			ctx_isp->offline_context);
+	}
+
+	/*
+	 * Only place to change state before calling the hw due to
+	 * hardware tasklet has higher priority that can cause the
+	 * irq handling comes early
+	 */
+	ctx->state = CAM_CTX_ACTIVATED;
+	trace_cam_context_state("ISP", ctx);
+	rc = ctx->hw_mgr_intf->hw_start(ctx->hw_mgr_intf->hw_mgr_priv,
+		&start_isp);
+	if (rc) {
+		/* HW failure. user need to clean up the resource */
+		CAM_ERR(CAM_ISP, "Start HW failed");
+		ctx->state = CAM_CTX_READY;
+		if ((rc == -ETIMEDOUT) &&
+			(isp_ctx_debug.enable_cdm_cmd_buff_dump))
+			rc = cam_isp_ctx_dump_req(req_isp, 0, 0, NULL, false);
+
+		trace_cam_context_state("ISP", ctx);
+		list_del_init(&req->list);
+		list_add(&req->list, &ctx->pending_req_list);
+		goto end;
+	}
+	CAM_DBG(CAM_ISP, "start device success ctx %u", ctx->ctx_id);
+
+end:
+	return rc;
+}
+
+static int __cam_isp_ctx_unlink_in_ready(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc = 0;
+
+	ctx->link_hdl = -1;
+	ctx->ctx_crm_intf = NULL;
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("ISP", ctx);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_stop_dev_in_activated_unlock(
+	struct cam_context *ctx, struct cam_start_stop_dev_cmd *stop_cmd)
+{
+	int rc = 0;
+	uint32_t i;
+	struct cam_hw_stop_args          stop;
+	struct cam_ctx_request          *req;
+	struct cam_isp_ctx_req          *req_isp;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_isp_stop_args         stop_isp;
+
+	/* Mask off all the incoming hardware events */
+	spin_lock_bh(&ctx->lock);
+	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_HALT;
+	spin_unlock_bh(&ctx->lock);
+
+	/* stop hw first */
+	if (ctx_isp->hw_ctx) {
+		stop.ctxt_to_hw_map = ctx_isp->hw_ctx;
+
+		stop_isp.hw_stop_cmd = CAM_ISP_HW_STOP_IMMEDIATELY;
+		stop_isp.stop_only = false;
+
+		stop.args = (void *) &stop_isp;
+		ctx->hw_mgr_intf->hw_stop(ctx->hw_mgr_intf->hw_mgr_priv,
+			&stop);
+	}
+
+	CAM_DBG(CAM_ISP, "next Substate[%s]",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+
+	if (ctx->ctx_crm_intf &&
+		ctx->ctx_crm_intf->notify_stop) {
+		struct cam_req_mgr_notify_stop notify;
+
+		notify.link_hdl = ctx->link_hdl;
+		CAM_DBG(CAM_ISP,
+			"Notify CRM about device stop ctx %u link 0x%x",
+			ctx->ctx_id, ctx->link_hdl);
+		ctx->ctx_crm_intf->notify_stop(&notify);
+	} else
+		CAM_ERR(CAM_ISP, "cb not present");
+
+	while (!list_empty(&ctx->pending_req_list)) {
+		req = list_first_entry(&ctx->pending_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_ISP, "signal fence in pending list. fence num %d",
+			 req_isp->num_fence_map_out);
+		for (i = 0; i < req_isp->num_fence_map_out; i++)
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_ISP_EVENT_HW_STOP);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	while (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_ISP, "signal fence in wait list. fence num %d",
+			 req_isp->num_fence_map_out);
+		for (i = 0; i < req_isp->num_fence_map_out; i++)
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_ISP_EVENT_HW_STOP);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	while (!list_empty(&ctx->active_req_list)) {
+		req = list_first_entry(&ctx->active_req_list,
+				struct cam_ctx_request, list);
+		list_del_init(&req->list);
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		CAM_DBG(CAM_ISP, "signal fence in active list. fence num %d",
+			 req_isp->num_fence_map_out);
+		for (i = 0; i < req_isp->num_fence_map_out; i++)
+			if (req_isp->fence_map_out[i].sync_id != -1) {
+				cam_sync_signal(
+					req_isp->fence_map_out[i].sync_id,
+					CAM_SYNC_STATE_SIGNALED_CANCEL,
+					CAM_SYNC_ISP_EVENT_HW_STOP);
+			}
+		list_add_tail(&req->list, &ctx->free_req_list);
+	}
+
+	ctx_isp->frame_id = 0;
+	ctx_isp->active_req_cnt = 0;
+	ctx_isp->reported_req_id = 0;
+	ctx_isp->last_applied_req_id = 0;
+	ctx_isp->req_info.last_bufdone_req_id = 0;
+	ctx_isp->bubble_frame_cnt = 0;
+	atomic_set(&ctx_isp->process_bubble, 0);
+	atomic_set(&ctx_isp->rxd_epoch, 0);
+	atomic64_set(&ctx_isp->state_monitor_head, -1);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx_isp->event_record_head[i], -1);
+
+	CAM_DBG(CAM_ISP, "Stop device success next state %d on ctx %u",
+		ctx->state, ctx->ctx_id);
+
+	if (!stop_cmd) {
+		rc = __cam_isp_ctx_unlink_in_ready(ctx, NULL);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Unlink failed rc=%d", rc);
+	}
+	return rc;
+}
+
+static int __cam_isp_ctx_stop_dev_in_activated(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *)ctx->ctx_priv;
+
+	__cam_isp_ctx_stop_dev_in_activated_unlock(ctx, cmd);
+	ctx_isp->init_received = false;
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("ISP", ctx);
+	return rc;
+}
+
+static int __cam_isp_ctx_release_dev_in_activated(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	rc = __cam_isp_ctx_stop_dev_in_activated_unlock(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Stop device failed rc=%d", rc);
+
+	rc = __cam_isp_ctx_release_dev_in_top_state(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Release device failed rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_release_hw_in_activated(struct cam_context *ctx,
+	void *cmd)
+{
+	int rc = 0;
+
+	rc = __cam_isp_ctx_stop_dev_in_activated_unlock(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Stop device failed rc=%d", rc);
+
+	rc = __cam_isp_ctx_release_hw_in_top_state(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Release hw failed rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_link_pause(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args       hw_cmd_args;
+	struct cam_isp_hw_cmd_args   isp_hw_cmd_args;
+	struct cam_isp_context      *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_PAUSE_HW;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_link_resume(struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args       hw_cmd_args;
+	struct cam_isp_hw_cmd_args   isp_hw_cmd_args;
+	struct cam_isp_context      *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_RESUME_HW;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_handle_sof_freeze_evt(
+	struct cam_context *ctx)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args       hw_cmd_args;
+	struct cam_isp_hw_cmd_args   isp_hw_cmd_args;
+	struct cam_isp_context      *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	hw_cmd_args.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_SOF_DEBUG;
+	isp_hw_cmd_args.u.sof_irq_enable = 1;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+		&hw_cmd_args);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_process_evt(struct cam_context *ctx,
+	struct cam_req_mgr_link_evt_data *link_evt_data)
+{
+	int rc = 0;
+
+	switch (link_evt_data->evt_type) {
+	case CAM_REQ_MGR_LINK_EVT_ERR:
+		/* No need to handle this message now */
+		break;
+	case CAM_REQ_MGR_LINK_EVT_PAUSE:
+		__cam_isp_ctx_link_pause(ctx);
+		break;
+	case CAM_REQ_MGR_LINK_EVT_RESUME:
+		__cam_isp_ctx_link_resume(ctx);
+		break;
+	case CAM_REQ_MGR_LINK_EVT_SOF_FREEZE:
+		__cam_isp_ctx_handle_sof_freeze_evt(ctx);
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "Unknown event from CRM");
+		break;
+	}
+	return rc;
+}
+
+static int __cam_isp_ctx_unlink_in_activated(struct cam_context *ctx,
+	struct cam_req_mgr_core_dev_link_setup *unlink)
+{
+	int rc = 0;
+
+	CAM_WARN(CAM_ISP,
+		"Received unlink in activated state. It's unexpected");
+
+	rc = __cam_isp_ctx_stop_dev_in_activated_unlock(ctx, NULL);
+	if (rc)
+		CAM_WARN(CAM_ISP, "Stop device failed rc=%d", rc);
+
+	rc = __cam_isp_ctx_unlink_in_ready(ctx, unlink);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Unlink failed rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_isp_ctx_apply_req(struct cam_context *ctx,
+	struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_ctx_ops *ctx_ops = NULL;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+
+	trace_cam_apply_req("ISP", apply->request_id);
+	CAM_DBG(CAM_ISP, "Enter: apply req in Substate[%s] request_id:%lld",
+		__cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), apply->request_id);
+	ctx_ops = &ctx_isp->substate_machine[ctx_isp->substate_activated];
+	if (ctx_ops->crm_ops.apply_req) {
+		rc = ctx_ops->crm_ops.apply_req(ctx, apply);
+	} else {
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"No handle function in activated Substate[%s]",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated));
+		rc = -EFAULT;
+	}
+
+	if (rc)
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Apply failed in active Substate[%s] rc %d",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated), rc);
+	return rc;
+}
+
+
+
+static int __cam_isp_ctx_handle_irq_in_activated(void *context,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc = 0;
+	struct cam_isp_ctx_irq_ops *irq_ops = NULL;
+	struct cam_context *ctx = (struct cam_context *)context;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *)ctx->ctx_priv;
+
+	spin_lock(&ctx->lock);
+
+	trace_cam_isp_activated_irq(ctx, ctx_isp->substate_activated, evt_id,
+		__cam_isp_ctx_get_event_ts(evt_id, evt_data));
+
+	CAM_DBG(CAM_ISP, "Enter: State %d, Substate[%s], evt id %d",
+		ctx->state, __cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated), evt_id);
+	irq_ops = &ctx_isp->substate_machine_irq[ctx_isp->substate_activated];
+	if (irq_ops->irq_ops[evt_id]) {
+		rc = irq_ops->irq_ops[evt_id](ctx_isp, evt_data);
+	} else {
+		CAM_DBG(CAM_ISP, "No handle function for Substate[%s]",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx_isp->substate_activated));
+		if (isp_ctx_debug.enable_state_monitor_dump)
+			__cam_isp_ctx_dump_state_monitor_array(ctx_isp);
+	}
+
+	CAM_DBG(CAM_ISP, "Exit: State %d Substate[%s]",
+		ctx->state, __cam_isp_ctx_substate_val_to_type(
+		ctx_isp->substate_activated));
+	spin_unlock(&ctx->lock);
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_isp_ctx_top_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_isp_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.acquire_hw = __cam_isp_ctx_acquire_hw_in_acquired,
+			.release_dev = __cam_isp_ctx_release_dev_in_top_state,
+			.config_dev = __cam_isp_ctx_config_dev_in_acquired,
+			.release_hw = __cam_isp_ctx_release_hw_in_top_state,
+		},
+		.crm_ops = {
+			.link = __cam_isp_ctx_link_in_acquired,
+			.unlink = __cam_isp_ctx_unlink_in_acquired,
+			.get_dev_info = __cam_isp_ctx_get_dev_info_in_acquired,
+			.flush_req = __cam_isp_ctx_flush_req_in_top_state,
+			.dump_req = __cam_isp_ctx_dump_in_top_state,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_isp_context_dump_requests,
+		.dumpinfo_ops = cam_isp_context_info_dump,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {
+			.start_dev = __cam_isp_ctx_start_dev_in_ready,
+			.release_dev = __cam_isp_ctx_release_dev_in_top_state,
+			.config_dev = __cam_isp_ctx_config_dev_in_top_state,
+			.release_hw = __cam_isp_ctx_release_hw_in_top_state,
+		},
+		.crm_ops = {
+			.unlink = __cam_isp_ctx_unlink_in_ready,
+			.flush_req = __cam_isp_ctx_flush_req_in_ready,
+			.dump_req = __cam_isp_ctx_dump_in_top_state,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_isp_context_dump_requests,
+		.dumpinfo_ops = cam_isp_context_info_dump,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_isp_ctx_stop_dev_in_activated,
+			.release_dev = __cam_isp_ctx_release_dev_in_activated,
+			.config_dev = __cam_isp_ctx_config_dev_in_flushed,
+			.release_hw = __cam_isp_ctx_release_hw_in_activated,
+		},
+		.crm_ops = {
+			.unlink = __cam_isp_ctx_unlink_in_ready,
+			.process_evt = __cam_isp_ctx_process_evt,
+			.flush_req = __cam_isp_ctx_flush_req_in_flushed_state,
+		},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_isp_context_dump_requests,
+		.dumpinfo_ops = cam_isp_context_info_dump,
+		.msg_cb_ops = cam_isp_context_handle_message,
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_isp_ctx_stop_dev_in_activated,
+			.release_dev = __cam_isp_ctx_release_dev_in_activated,
+			.config_dev = __cam_isp_ctx_config_dev_in_top_state,
+			.release_hw = __cam_isp_ctx_release_hw_in_activated,
+		},
+		.crm_ops = {
+			.unlink = __cam_isp_ctx_unlink_in_activated,
+			.apply_req = __cam_isp_ctx_apply_req,
+			.flush_req = __cam_isp_ctx_flush_req_in_top_state,
+			.process_evt = __cam_isp_ctx_process_evt,
+			.dump_req = __cam_isp_ctx_dump_in_top_state,
+		},
+		.irq_ops = __cam_isp_ctx_handle_irq_in_activated,
+		.pagefault_ops = cam_isp_context_dump_requests,
+		.dumpinfo_ops = cam_isp_context_info_dump,
+		.msg_cb_ops = cam_isp_context_handle_message,
+	},
+};
+
+static int cam_isp_context_dump_requests(void *data,
+	struct cam_smmu_pf_info *pf_info)
+{
+
+	struct cam_context *ctx = (struct cam_context *)data;
+	struct cam_ctx_request *req = NULL;
+	struct cam_ctx_request *req_temp = NULL;
+	struct cam_isp_ctx_req *req_isp  = NULL;
+	struct cam_isp_prepare_hw_update_data *hw_update_data = NULL;
+	struct cam_hw_mgr_dump_pf_data *pf_dbg_entry = NULL;
+	struct cam_req_mgr_message       req_msg;
+	struct cam_isp_context          *ctx_isp;
+	uint32_t  resource_type = 0;
+	bool mem_found = false, ctx_found = false, send_error = false;
+	int rc = 0;
+
+	struct cam_isp_context *isp_ctx =
+		(struct cam_isp_context *)ctx->ctx_priv;
+
+	if (!isp_ctx) {
+		CAM_ERR(CAM_ISP, "Invalid isp ctx");
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_ISP, "iommu fault handler for isp ctx %d state %d",
+		ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->active_req_list, list) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		hw_update_data = &req_isp->hw_update_data;
+		pf_dbg_entry = &(req->pf_data);
+		CAM_INFO(CAM_ISP, "Active List: req_id : %lld ",
+			req->request_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_dbg_entry,
+			&mem_found, &ctx_found, &resource_type, pf_info);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to dump pf info");
+
+		if (ctx_found)
+			send_error = true;
+	}
+
+	CAM_INFO(CAM_ISP, "Iterating over wait_list of isp ctx %d state %d",
+			ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->wait_req_list, list) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		hw_update_data = &req_isp->hw_update_data;
+		pf_dbg_entry = &(req->pf_data);
+		CAM_INFO(CAM_ISP, "Wait List: req_id : %lld ", req->request_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_dbg_entry,
+			&mem_found, &ctx_found, &resource_type, pf_info);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to dump pf info");
+
+		if (ctx_found)
+			send_error = true;
+	}
+
+	/*
+	 * In certain scenarios we observe both overflow and SMMU pagefault
+	 * for a particular request. If overflow is handled before page fault
+	 * we need to traverse through pending request list because if
+	 * bubble recovery is enabled on any request we move that request
+	 * and all the subsequent requests to the pending list while handling
+	 * overflow error.
+	 */
+
+	CAM_INFO(CAM_ISP,
+		"Iterating over pending req list of isp ctx %d state %d",
+		ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+		&ctx->pending_req_list, list) {
+		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
+		hw_update_data = &req_isp->hw_update_data;
+		pf_dbg_entry = &(req->pf_data);
+		CAM_INFO(CAM_ISP, "Pending List: req_id : %lld ",
+			req->request_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_dbg_entry,
+			&mem_found, &ctx_found, &resource_type, pf_info);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to dump pf info");
+
+		if (ctx_found)
+			send_error = true;
+	}
+
+	if (resource_type) {
+		ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+		if (ctx_isp->isp_device_type == CAM_IFE_DEVICE_TYPE)
+			CAM_ERR(CAM_ISP,
+				"Page fault on resource id:%s (0x%x) ctx id:%d frame id:%d reported id:%lld applied id:%lld",
+				__cam_isp_resource_handle_id_to_type(
+				resource_type),
+				resource_type, ctx->ctx_id, ctx_isp->frame_id,
+				ctx_isp->reported_req_id,
+				ctx_isp->last_applied_req_id);
+		else
+			CAM_ERR(CAM_ISP,
+				"Page fault on resource id:%s (0x%x) ctx id:%d frame id:%d reported id:%lld applied id:%lld",
+				__cam_isp_tfe_resource_handle_id_to_type(
+				resource_type),
+				resource_type, ctx->ctx_id, ctx_isp->frame_id,
+				ctx_isp->reported_req_id,
+				ctx_isp->last_applied_req_id);
+
+	}
+
+	if (send_error) {
+		CAM_INFO(CAM_ISP,
+			"page fault notifying to umd ctx %u session_hdl:%d device_hdl:%d link_hdl:%d",
+			ctx->ctx_id, ctx->session_hdl,
+			ctx->dev_hdl, ctx->link_hdl);
+
+		req_msg.session_hdl = ctx->session_hdl;
+		req_msg.u.err_msg.device_hdl = ctx->dev_hdl;
+		req_msg.u.err_msg.error_type =
+			CAM_REQ_MGR_ERROR_TYPE_PAGE_FAULT;
+		req_msg.u.err_msg.link_hdl = ctx->link_hdl;
+		req_msg.u.err_msg.request_id = 0;
+		req_msg.u.err_msg.resource_size = 0x0;
+
+		if (cam_req_mgr_notify_message(&req_msg,
+				V4L_EVENT_CAM_REQ_MGR_ERROR,
+				V4L_EVENT_CAM_REQ_MGR_EVENT))
+			CAM_ERR(CAM_ISP,
+				"could not send page fault notification ctx %u session_hdl:%d device_hdl:%d link_hdl:%d",
+				ctx->ctx_id, ctx->session_hdl,
+				ctx->dev_hdl, ctx->link_hdl);
+	}
+	return rc;
+}
+
+static int cam_isp_context_handle_message(void *context,
+	uint32_t msg_type, uint32_t *data)
+{
+	int                            rc = -EINVAL;
+	struct cam_hw_cmd_args         hw_cmd_args;
+	struct cam_isp_hw_cmd_args     isp_hw_cmd_args;
+	struct cam_context            *ctx = (struct cam_context *)context;
+
+	memset(&hw_cmd_args, 0, sizeof(hw_cmd_args));
+	hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
+
+	switch (msg_type) {
+	case CAM_SUBDEV_MESSAGE_CLOCK_UPDATE:
+		hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+		isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_UPDATE_CLOCK;
+		isp_hw_cmd_args.cmd_data = (void *)data;
+		hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+		rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+			&hw_cmd_args);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Update clock rate failed rc: %d", rc);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid message type %d", msg_type);
+	}
+	return rc;
+}
+
+static int cam_isp_context_debug_register(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_isp_ctx", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_ISP, "DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	isp_ctx_debug.dentry = dbgfileptr;
+
+	debugfs_create_u32("enable_state_monitor_dump", 0644,
+		isp_ctx_debug.dentry, &isp_ctx_debug.enable_state_monitor_dump);
+	debugfs_create_u8("enable_cdm_cmd_buffer_dump", 0644,
+		isp_ctx_debug.dentry, &isp_ctx_debug.enable_cdm_cmd_buff_dump);
+
+end:
+	return rc;
+}
+
+int cam_isp_context_init(struct cam_isp_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_req_mgr_kmd_ops *crm_node_intf,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id,
+	uint32_t isp_device_type)
+
+{
+	int rc = -1;
+	int i;
+
+	if (!ctx || !ctx_base) {
+		CAM_ERR(CAM_ISP, "Invalid Context");
+		goto err;
+	}
+
+	/* ISP context setup */
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->base = ctx_base;
+	ctx->frame_id = 0;
+	ctx->custom_enabled = false;
+	ctx->use_frame_header_ts = false;
+	ctx->active_req_cnt = 0;
+	ctx->reported_req_id = 0;
+	ctx->bubble_frame_cnt = 0;
+	ctx->req_info.last_bufdone_req_id = 0;
+
+	ctx->hw_ctx = NULL;
+	ctx->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
+	ctx->substate_machine = cam_isp_ctx_activated_state_machine;
+	ctx->substate_machine_irq = cam_isp_ctx_activated_state_machine_irq;
+	ctx->init_timestamp = jiffies_to_msecs(jiffies);
+	ctx->isp_device_type = isp_device_type;
+
+	for (i = 0; i < CAM_ISP_CTX_REQ_MAX; i++) {
+		ctx->req_base[i].req_priv = &ctx->req_isp[i];
+		ctx->req_isp[i].base = &ctx->req_base[i];
+	}
+
+	/* camera context setup */
+	rc = cam_context_init(ctx_base, isp_dev_name, CAM_ISP, ctx_id,
+		crm_node_intf, hw_intf, ctx->req_base, CAM_ISP_CTX_REQ_MAX);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Camera Context Base init failed");
+		goto err;
+	}
+
+	/* link camera context with isp context */
+	ctx_base->state_machine = cam_isp_ctx_top_state_machine;
+	ctx_base->ctx_priv = ctx;
+
+	/* initializing current state for error logging */
+	for (i = 0; i < CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES; i++) {
+		ctx->cam_isp_ctx_state_monitor[i].curr_state =
+		CAM_ISP_CTX_ACTIVATED_MAX;
+	}
+	atomic64_set(&ctx->state_monitor_head, -1);
+
+	for (i = 0; i < CAM_ISP_CTX_EVENT_MAX; i++)
+		atomic64_set(&ctx->event_record_head[i], -1);
+
+	if (!isp_ctx_debug.dentry)
+		cam_isp_context_debug_register();
+
+err:
+	return rc;
+}
+
+int cam_isp_context_deinit(struct cam_isp_context *ctx)
+{
+	if (ctx->base)
+		cam_context_deinit(ctx->base);
+
+	if (ctx->substate_activated != CAM_ISP_CTX_ACTIVATED_SOF)
+		CAM_ERR(CAM_ISP, "ISP context Substate[%s] is invalid",
+			__cam_isp_ctx_substate_val_to_type(
+			ctx->substate_activated));
+
+	debugfs_remove_recursive(isp_ctx_debug.dentry);
+	isp_ctx_debug.dentry = NULL;
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/cam_isp_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/cam_isp_context.h
@@ -0,0 +1,372 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_CONTEXT_H_
+#define _CAM_ISP_CONTEXT_H_
+
+
+#include <linux/spinlock.h>
+#include <media/cam_isp.h>
+#include <media/cam_defs.h>
+#include <media/cam_tfe.h>
+
+#include "cam_context.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_req_mgr_workq.h"
+
+#define CAM_IFE_QTIMER_MUL_FACTOR        10000
+#define CAM_IFE_QTIMER_DIV_FACTOR        192
+
+/*
+ * Maximum hw resource - This number is based on the maximum
+ * output port resource. The current maximum resource number
+ * is 24.
+ */
+#define CAM_ISP_CTX_RES_MAX                     24
+
+/* max requests per ctx for isp */
+#define CAM_ISP_CTX_REQ_MAX                     8
+
+/*
+ * Maximum entries in state monitoring array for error logging
+ */
+#define CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES   40
+
+/*
+ * Threshold response time in us beyond which a request is not expected
+ * to be with IFE hw
+ */
+#define CAM_ISP_CTX_RESPONSE_TIME_THRESHOLD   100000
+
+/* Number of words for dumping isp context */
+#define CAM_ISP_CTX_DUMP_NUM_WORDS  5
+
+/* Number of words for dumping isp context events*/
+#define CAM_ISP_CTX_DUMP_EVENT_NUM_WORDS  3
+
+/* Number of words for dumping request info*/
+#define CAM_ISP_CTX_DUMP_REQUEST_NUM_WORDS  2
+
+/* Maximum entries in event record */
+#define CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES   20
+
+/* Maximum length of tag while dumping */
+#define CAM_ISP_CONTEXT_DUMP_TAG_MAX_LEN 32
+
+/* forward declaration */
+struct cam_isp_context;
+
+/* cam isp context irq handling function type */
+typedef int (*cam_isp_hw_event_cb_func)(struct cam_isp_context *ctx_isp,
+	void *evt_data);
+
+/**
+ * enum cam_isp_ctx_activated_substate - sub states for activated
+ *
+ */
+enum cam_isp_ctx_activated_substate {
+	CAM_ISP_CTX_ACTIVATED_SOF,
+	CAM_ISP_CTX_ACTIVATED_APPLIED,
+	CAM_ISP_CTX_ACTIVATED_EPOCH,
+	CAM_ISP_CTX_ACTIVATED_BUBBLE,
+	CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED,
+	CAM_ISP_CTX_ACTIVATED_HW_ERROR,
+	CAM_ISP_CTX_ACTIVATED_HALT,
+	CAM_ISP_CTX_ACTIVATED_MAX,
+};
+
+/**
+ * enum cam_isp_ctx_event_type - events for a request
+ *
+ */
+enum cam_isp_ctx_event {
+	CAM_ISP_CTX_EVENT_SUBMIT,
+	CAM_ISP_CTX_EVENT_APPLY,
+	CAM_ISP_CTX_EVENT_EPOCH,
+	CAM_ISP_CTX_EVENT_RUP,
+	CAM_ISP_CTX_EVENT_BUFDONE,
+	CAM_ISP_CTX_EVENT_MAX
+};
+
+/**
+ * enum cam_isp_state_change_trigger - Different types of ISP events
+ *
+ */
+enum cam_isp_state_change_trigger {
+	CAM_ISP_STATE_CHANGE_TRIGGER_ERROR,
+	CAM_ISP_STATE_CHANGE_TRIGGER_APPLIED,
+	CAM_ISP_STATE_CHANGE_TRIGGER_REG_UPDATE,
+	CAM_ISP_STATE_CHANGE_TRIGGER_SOF,
+	CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH,
+	CAM_ISP_STATE_CHANGE_TRIGGER_DONE,
+	CAM_ISP_STATE_CHANGE_TRIGGER_EOF,
+	CAM_ISP_STATE_CHANGE_TRIGGER_FLUSH,
+	CAM_ISP_STATE_CHANGE_TRIGGER_MAX
+};
+
+/**
+ * struct cam_isp_ctx_debug -  Contains debug parameters
+ *
+ * @dentry:                     Debugfs entry
+ * @enable_state_monitor_dump:  Enable isp state monitor dump
+ * @enable_cdm_cmd_buff_dump: Enable CDM Command buffer dump
+ *
+ */
+struct cam_isp_ctx_debug {
+	struct dentry  *dentry;
+	uint32_t        enable_state_monitor_dump;
+	uint8_t         enable_cdm_cmd_buff_dump;
+};
+
+/**
+ * struct cam_isp_ctx_irq_ops - Function table for handling IRQ callbacks
+ *
+ * @irq_ops:               Array of handle function pointers.
+ *
+ */
+struct cam_isp_ctx_irq_ops {
+	cam_isp_hw_event_cb_func         irq_ops[CAM_ISP_HW_EVENT_MAX];
+};
+
+/**
+ * struct cam_isp_ctx_req - ISP context request object
+ *
+ * @base:                      Common request object ponter
+ * @cfg:                       ISP hardware configuration array
+ * @num_cfg:                   Number of ISP hardware configuration entries
+ * @fence_map_out:             Output fence mapping array
+ * @num_fence_map_out:         Number of the output fence map
+ * @fence_map_in:              Input fence mapping array
+ * @num_fence_map_in:          Number of input fence map
+ * @num_acked:                 Count to track acked entried for output.
+ *                             If count equals the number of fence out, it means
+ *                             the request has been completed.
+ * @early_fence_map_index      Array which stores fence map out index for resource
+ *                             which early buf done is received.
+ * @flag_sync_set              Flags to track if early bufdone fence are signalled
+ *                             or not
+ * @num_deferred_acks:         Number of buf_dones/acks that are deferred to
+ *                             handle or signalled in special scenarios.
+ *                             Increment this count instead of num_acked and
+ *                             handle the events later where eventually
+ *                             increment num_acked.
+ * @deferred_fence_map_index   Saves the indices of fence_map_out for which
+ *                             handling of buf_done is deferred.
+ * @bubble_report:             Flag to track if bubble report is active on
+ *                             current request
+ * @hw_update_data:            HW update data for this request
+ * @event_timestamp:           Timestamp for different stage of request
+ * @reapply:                   True if reapplying after bubble
+ * @cdm_reset_before_apply:    For bubble re-apply when buf done not coming set
+ *                             to True
+ *
+ */
+struct cam_isp_ctx_req {
+	struct cam_ctx_request               *base;
+	struct cam_hw_update_entry            cfg[CAM_ISP_CTX_CFG_MAX];
+	uint32_t                              num_cfg;
+	struct cam_hw_fence_map_entry         fence_map_out[CAM_ISP_CTX_RES_MAX];
+	uint32_t                              num_fence_map_out;
+	struct cam_hw_fence_map_entry         fence_map_in[CAM_ISP_CTX_RES_MAX];
+	uint32_t                              num_fence_map_in;
+	uint32_t                              num_acked;
+	uint32_t                     early_fence_map_index[CAM_ISP_CTX_RES_MAX];
+	bool                                  flag_sync_set;
+	uint32_t                              num_deferred_acks;
+	uint32_t                  deferred_fence_map_index[CAM_ISP_CTX_RES_MAX];
+	int32_t                               bubble_report;
+	struct cam_isp_prepare_hw_update_data hw_update_data;
+	ktime_t                               event_timestamp
+		[CAM_ISP_CTX_EVENT_MAX];
+	bool                                  bubble_detected;
+	bool                                  reapply;
+	bool                                  cdm_reset_before_apply;
+};
+
+/**
+ * struct cam_isp_context_state_monitor - ISP context state
+ *                                        monitoring for
+ *                                        debug purposes
+ *
+ * @curr_state:          Current sub state that received req
+ * @trigger:             Event type of incoming req
+ * @req_id:              Request id
+ * @frame_id:            Frame id based on SOFs
+ * @evt_time_stamp       Current time stamp
+ *
+ */
+struct cam_isp_context_state_monitor {
+	enum cam_isp_ctx_activated_substate  curr_state;
+	enum cam_isp_state_change_trigger    trigger;
+	uint64_t                             req_id;
+	int64_t                              frame_id;
+	unsigned int                         evt_time_stamp;
+};
+
+/**
+ * struct cam_isp_context_req_id_info - ISP context request id
+ *                     information for bufdone.
+ *
+ *@last_bufdone_req_id:   Last bufdone request id
+ *
+ */
+
+struct cam_isp_context_req_id_info {
+	int64_t                          last_bufdone_req_id;
+};
+
+/**
+ *
+ *
+ * struct cam_isp_context_event_record - Information for last 20 Events
+ *  for a request; Submit, Apply, EPOCH, RUP, Buf done.
+ *
+ * @req_id:    Last applied request id
+ * @timestamp: Timestamp for the event
+ *
+ */
+struct cam_isp_context_event_record {
+	uint64_t                         req_id;
+	ktime_t                          timestamp;
+};
+
+/**
+ * struct cam_isp_context   -  ISP context object
+ *
+ * @base:                      Common context object pointer
+ * @frame_id:                  Frame id tracking for the isp context
+ * @frame_id_meta:             Frame id read every epoch for the ctx
+ *                             meta from the sensor
+ * @substate_actiavted:        Current substate for the activated state.
+ * @process_bubble:            Atomic variable to check if ctx is still
+ *                             processing bubble.
+ * @substate_machine:          ISP substate machine for external interface
+ * @substate_machine_irq:      ISP substate machine for irq handling
+ * @req_base:                  Common request object storage
+ * @req_isp:                   ISP private request object storage
+ * @hw_ctx:                    HW object returned by the acquire device command
+ * @sof_timestamp_val:         Captured time stamp value at sof hw event
+ * @boot_timestamp:            Boot time stamp for a given req_id
+ * @active_req_cnt:            Counter for the active request
+ * @reported_req_id:           Last reported request id
+ * @subscribe_event:           The irq event mask that CRM subscribes to, IFE
+ *                             will invoke CRM cb at those event.
+ * @last_applied_req_id:       Last applied request id
+ * @last_sof_timestamp:        SOF timestamp of the last frame
+ * @bubble_frame_cnt:          Count of the frame after bubble
+ * @state_monitor_head:        Write index to the state monitoring array
+ * @req_info                   Request id information about last buf done
+ * @cam_isp_ctx_state_monitor: State monitoring array
+ * @event_record_head:         Write index to the state monitoring array
+ * @event_record:              Event record array
+ * @rdi_only_context:          Get context type information.
+ *                             true, if context is rdi only context
+ * @offline_context:           Indicate whether context is for offline IFE
+ * @hw_acquired:               Indicate whether HW resources are acquired
+ * @init_received:             Indicate whether init config packet is received
+ * @split_acquire:             Indicate whether a separate acquire is expected
+ * @custom_enabled:            Custom HW enabled for this ctx
+ * @use_frame_header_ts:       Use frame header for qtimer ts
+ * @support_consumed_addr:     Indicate whether HW has last consumed addr reg
+ * @apply_in_progress          Whether request apply is in progress
+ * @init_timestamp:            Timestamp at which this context is initialized
+ * @isp_device_type:           ISP device type
+ * @rxd_epoch:                 Indicate whether epoch has been received. Used to
+ *                             decide whether to apply request in offline ctx
+ * @workq:                     Worker thread for offline ife
+ * @trigger_id:                ID provided by CRM for each ctx on the link
+ * @last_bufdone_err_apply_req_id:  last bufdone error apply request id
+ *
+ */
+struct cam_isp_context {
+	struct cam_context              *base;
+
+	int64_t                          frame_id;
+	uint32_t                         frame_id_meta;
+	uint32_t                         substate_activated;
+	atomic_t                         process_bubble;
+	struct cam_ctx_ops              *substate_machine;
+	struct cam_isp_ctx_irq_ops      *substate_machine_irq;
+
+	struct cam_ctx_request           req_base[CAM_ISP_CTX_REQ_MAX];
+	struct cam_isp_ctx_req           req_isp[CAM_ISP_CTX_REQ_MAX];
+
+	void                            *hw_ctx;
+	uint64_t                         sof_timestamp_val;
+	uint64_t                         boot_timestamp;
+	int32_t                          active_req_cnt;
+	int64_t                          reported_req_id;
+	uint32_t                         subscribe_event;
+	int64_t                          last_applied_req_id;
+	uint64_t                         last_sof_timestamp;
+	uint32_t                         bubble_frame_cnt;
+	atomic64_t                       state_monitor_head;
+	struct cam_isp_context_state_monitor cam_isp_ctx_state_monitor[
+		CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES];
+	struct cam_isp_context_req_id_info    req_info;
+	atomic64_t                            event_record_head[
+		CAM_ISP_CTX_EVENT_MAX];
+	struct cam_isp_context_event_record   event_record[
+		CAM_ISP_CTX_EVENT_MAX][CAM_ISP_CTX_EVENT_RECORD_MAX_ENTRIES];
+	bool                                  rdi_only_context;
+	bool                                  offline_context;
+	bool                                  hw_acquired;
+	bool                                  init_received;
+	bool                                  split_acquire;
+	bool                                  custom_enabled;
+	bool                                  use_frame_header_ts;
+	bool                                  support_consumed_addr;
+	atomic_t                              apply_in_progress;
+	unsigned int                          init_timestamp;
+	uint32_t                              isp_device_type;
+	atomic_t                              rxd_epoch;
+	struct cam_req_mgr_core_workq        *workq;
+	int32_t                               trigger_id;
+	int64_t                               last_bufdone_err_apply_req_id;
+};
+
+/**
+ * struct cam_isp_context_dump_header - ISP context dump header
+ * @tag:       Tag name for the header
+ * @word_size: Size of word
+ * @size:      Size of data
+ *
+ */
+struct cam_isp_context_dump_header {
+	uint8_t   tag[CAM_ISP_CONTEXT_DUMP_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * cam_isp_context_init()
+ *
+ * @brief:              Initialization function for the ISP context
+ *
+ * @ctx:                ISP context obj to be initialized
+ * @bridge_ops:         Bridge call back funciton
+ * @hw_intf:            ISP hw manager interface
+ * @ctx_id:             ID for this context
+ * @isp_device_type     Isp device type
+ *
+ */
+int cam_isp_context_init(struct cam_isp_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_req_mgr_kmd_ops *bridge_ops,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id,
+	uint32_t isp_device_type);
+
+/**
+ * cam_isp_context_deinit()
+ *
+ * @brief:               Deinitialize function for the ISP context
+ *
+ * @ctx:                 ISP context obj to be deinitialized
+ *
+ */
+int cam_isp_context_deinit(struct cam_isp_context *ctx);
+
+#endif  /* __CAM_ISP_CONTEXT_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/cam_isp_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/cam_isp_dev.c
@@ -0,0 +1,322 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+
+#include <media/cam_req_mgr.h>
+#include "cam_isp_dev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_node.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+
+static struct cam_isp_dev g_isp_dev;
+
+static void cam_isp_dev_iommu_fault_handler(struct cam_smmu_pf_info *pf_info)
+{
+	int i = 0;
+	struct cam_node *node = NULL;
+
+	if (!pf_info || !pf_info->token) {
+		CAM_ERR(CAM_ISP, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_info->token;
+
+	for (i = 0; i < node->ctx_size; i++)
+		cam_context_dump_pf_info(&(node->ctx_list[i]), pf_info);
+}
+
+static void cam_isp_subdev_handle_message(
+		struct v4l2_subdev *sd,
+		enum cam_subdev_message_type_t message_type,
+		uint32_t data)
+{
+	int i, rc = 0;
+	struct cam_node  *node = v4l2_get_subdevdata(sd);
+
+	CAM_DBG(CAM_ISP, "node name %s", node->name, data);
+	for (i = 0; i < node->ctx_size; i++) {
+		rc = cam_context_handle_message(&(node->ctx_list[i]), message_type, &data);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to handle message for %s", node->name);
+	}
+}
+
+static const struct of_device_id cam_isp_dt_match[] = {
+	{
+		.compatible = "qcom,cam-isp"
+	},
+	{}
+};
+
+static int cam_isp_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+	mutex_lock(&g_isp_dev.isp_mutex);
+	if (g_isp_dev.open_cnt >= 1) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "ISP subdev is already opened");
+		rc = -EALREADY;
+		goto end;
+	}
+	g_isp_dev.open_cnt++;
+end:
+	mutex_unlock(&g_isp_dev.isp_mutex);
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
+	return rc;
+}
+
+static int cam_isp_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&g_isp_dev.isp_mutex);
+	if (g_isp_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_ISP, "ISP subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	g_isp_dev.open_cnt--;
+	if (!node) {
+		CAM_ERR(CAM_ISP, "Node ptr is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (g_isp_dev.open_cnt == 0)
+		cam_node_shutdown(node);
+
+end:
+	mutex_unlock(&g_isp_dev.isp_mutex);
+	return rc;
+}
+
+static int cam_isp_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_WARN(CAM_ISP, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+	return cam_isp_subdev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_isp_subdev_internal_ops = {
+	.close = cam_isp_subdev_close,
+	.open = cam_isp_subdev_open,
+};
+
+static int cam_isp_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = -1;
+	int i;
+	struct cam_hw_mgr_intf         hw_mgr_intf;
+	struct cam_node               *node;
+	const char                    *compat_str = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	int iommu_hdl = -1;
+
+	rc = of_property_read_string_index(pdev->dev.of_node, "arch-compat", 0,
+		(const char **)&compat_str);
+
+	g_isp_dev.sd.internal_ops = &cam_isp_subdev_internal_ops;
+	g_isp_dev.sd.close_seq_prior = CAM_SD_CLOSE_HIGH_PRIORITY;
+	/* Initialize the v4l2 subdevice first. (create cam_node) */
+	if (strnstr(compat_str, "ife", strlen(compat_str))) {
+		rc = cam_subdev_probe(&g_isp_dev.sd, pdev, CAM_ISP_DEV_NAME,
+		CAM_IFE_DEVICE_TYPE);
+		g_isp_dev.isp_device_type = CAM_IFE_DEVICE_TYPE;
+		g_isp_dev.max_context = CAM_IFE_CTX_MAX;
+	} else if (strnstr(compat_str, "tfe", strlen(compat_str))) {
+		rc = cam_subdev_probe(&g_isp_dev.sd, pdev, CAM_ISP_DEV_NAME,
+		CAM_TFE_DEVICE_TYPE);
+		g_isp_dev.sd.msg_cb = cam_isp_subdev_handle_message;
+		g_isp_dev.isp_device_type = CAM_TFE_DEVICE_TYPE;
+		g_isp_dev.max_context = CAM_TFE_CTX_MAX;
+	} else  {
+		CAM_ERR(CAM_ISP, "Invalid ISP hw type %s", compat_str);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "ISP cam_subdev_probe failed!");
+		goto err;
+	}
+	node = (struct cam_node *) g_isp_dev.sd.token;
+
+	memset(&hw_mgr_intf, 0, sizeof(hw_mgr_intf));
+	g_isp_dev.ctx = kcalloc(g_isp_dev.max_context,
+		sizeof(struct cam_context),
+		GFP_KERNEL);
+	if (!g_isp_dev.ctx) {
+		CAM_ERR(CAM_ISP,
+			"Mem Allocation failed for ISP base context");
+		goto unregister;
+	}
+
+	g_isp_dev.ctx_isp = kcalloc(g_isp_dev.max_context,
+		sizeof(struct cam_isp_context),
+		GFP_KERNEL);
+	if (!g_isp_dev.ctx_isp) {
+		CAM_ERR(CAM_ISP,
+			"Mem Allocation failed for Isp private context");
+		kfree(g_isp_dev.ctx);
+		g_isp_dev.ctx = NULL;
+		goto unregister;
+	}
+
+	rc = cam_isp_hw_mgr_init(compat_str, &hw_mgr_intf, &iommu_hdl);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Can not initialized ISP HW manager!");
+		goto kfree;
+	}
+
+	for (i = 0; i < g_isp_dev.max_context; i++) {
+		rc = cam_isp_context_init(&g_isp_dev.ctx_isp[i],
+			&g_isp_dev.ctx[i],
+			&node->crm_node_intf,
+			&node->hw_mgr_intf,
+			i,
+			g_isp_dev.isp_device_type);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "ISP context init failed!");
+			goto kfree;
+		}
+	}
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_isp_dev.ctx,
+			g_isp_dev.max_context, CAM_ISP_DEV_NAME);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "ISP node init failed!");
+		goto kfree;
+	}
+
+	node->sd_handler = cam_isp_subdev_close_internal;
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_isp_dev_iommu_fault_handler, node);
+
+	mutex_init(&g_isp_dev.isp_mutex);
+	rc = cam_subdev_register(&g_isp_dev.sd, pdev);
+
+	CAM_DBG(CAM_ISP, "Component bound successfully");
+
+	return rc;
+
+kfree:
+	kfree(g_isp_dev.ctx);
+	g_isp_dev.ctx = NULL;
+	kfree(g_isp_dev.ctx_isp);
+	g_isp_dev.ctx_isp = NULL;
+
+unregister:
+	rc = cam_subdev_remove(&g_isp_dev.sd);
+err:
+	return rc;
+}
+
+static void cam_isp_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	int i;
+	const char *compat_str = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	rc = of_property_read_string_index(pdev->dev.of_node, "arch-compat", 0,
+		(const char **)&compat_str);
+
+	cam_isp_hw_mgr_deinit(compat_str);
+	/* clean up resources */
+	for (i = 0; i < g_isp_dev.max_context; i++) {
+		rc = cam_isp_context_deinit(&g_isp_dev.ctx_isp[i]);
+		if (rc)
+			CAM_ERR(CAM_ISP, "ISP context %d deinit failed",
+				 i);
+	}
+
+	kfree(g_isp_dev.ctx);
+	g_isp_dev.ctx = NULL;
+	kfree(g_isp_dev.ctx_isp);
+	g_isp_dev.ctx_isp = NULL;
+
+	rc = cam_unregister_subdev(&g_isp_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Unregister failed rc: %d", rc);
+
+	rc = cam_subdev_remove(&g_isp_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Subdev remove failed rc: %d", rc);
+
+	memset(&g_isp_dev, 0, sizeof(g_isp_dev));
+}
+
+const static struct component_ops cam_isp_dev_component_ops = {
+	.bind = cam_isp_dev_component_bind,
+	.unbind = cam_isp_dev_component_unbind,
+};
+
+static int cam_isp_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_isp_dev_component_ops);
+	return 0;
+}
+
+static int cam_isp_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Adding ISP dev component");
+	rc = component_add(&pdev->dev, &cam_isp_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+struct platform_driver isp_driver = {
+	.probe = cam_isp_dev_probe,
+	.remove = cam_isp_dev_remove,
+	.driver = {
+		.name = "cam_isp",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_isp_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_isp_dev_init_module(void)
+{
+	return platform_driver_register(&isp_driver);
+}
+
+void cam_isp_dev_exit_module(void)
+{
+	platform_driver_unregister(&isp_driver);
+}
+
+MODULE_DESCRIPTION("MSM ISP driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/cam_isp_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/cam_isp_dev.h
@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_DEV_H_
+#define _CAM_ISP_DEV_H_
+
+#include "cam_subdev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_context.h"
+#include "cam_isp_context.h"
+
+/**
+ * struct cam_isp_dev - Camera ISP V4l2 device node
+ *
+ * @sd:                    Commone camera subdevice node
+ * @ctx:                   Isp base context storage
+ * @ctx_isp:               Isp private context storage
+ * @isp_mutex:             ISP dev mutex
+ * @open_cnt:              Open device count
+ * @isp_device_type        ISP device type
+ * @max_context            maximum contexts for TFE is 4 and for IFE is 8
+ */
+struct cam_isp_dev {
+	struct cam_subdev          sd;
+	struct cam_context         *ctx;
+	struct cam_isp_context     *ctx_isp;
+	struct mutex               isp_mutex;
+	int32_t                    open_cnt;
+	uint32_t                   isp_device_type;
+	int32_t                    max_context;
+};
+
+/**
+ * @brief : API to register ISP Dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_isp_dev_init_module(void);
+
+/**
+ * @brief : API to remove ISP Dev from platform framework.
+ */
+void cam_isp_dev_exit_module(void);
+#endif /* __CAM_ISP_DEV_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
@@ -0,0 +1,8714 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_compat.h"
+#include "cam_smmu_api.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_isp_packet_parser.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_packet_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_common_util.h"
+
+#define CAM_IFE_SAFE_DISABLE 0
+#define CAM_IFE_SAFE_ENABLE 1
+#define SMMU_SE_IFE 0
+
+#define CAM_ISP_PACKET_META_MAX                     \
+	(CAM_ISP_PACKET_META_GENERIC_BLOB_COMMON + 1)
+
+#define CAM_ISP_GENERIC_BLOB_TYPE_MAX               \
+	(CAM_ISP_GENERIC_BLOB_TYPE_CSID_QCFA_CONFIG + 1)
+
+#define ACQUIRED_HW_PATH_SIZE       16
+#define BITS_PER_RDI_CHANNEL        2
+#define ACQUIRED_IFE_RES_SHIFT(path) (ACQUIRED_HW_PATH_SIZE + (path) * BITS_PER_RDI_CHANNEL)
+
+static uint32_t blob_type_hw_cmd_map[CAM_ISP_GENERIC_BLOB_TYPE_MAX] = {
+	CAM_ISP_HW_CMD_GET_HFR_UPDATE,
+	CAM_ISP_HW_CMD_CLOCK_UPDATE,
+	CAM_ISP_HW_CMD_BW_UPDATE,
+	CAM_ISP_HW_CMD_UBWC_UPDATE,
+	CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE,
+	CAM_ISP_GENERIC_BLOB_TYPE_FE_CONFIG,
+	CAM_ISP_HW_CMD_UBWC_UPDATE_V2,
+	CAM_ISP_HW_CMD_CORE_CONFIG,
+	CAM_ISP_HW_CMD_WM_CONFIG_UPDATE,
+	CAM_ISP_HW_CMD_BW_UPDATE_V2,
+	CAM_ISP_HW_CMD_BLANKING_UPDATE,
+};
+
+static struct cam_ife_hw_mgr g_ife_hw_mgr;
+
+static uint32_t max_ife_out_res;
+
+static int cam_ife_hw_mgr_event_handler(
+	void                                *priv,
+	uint32_t                             evt_id,
+	void                                *evt_info);
+
+static int cam_ife_mgr_regspace_data_cb(uint32_t reg_base_type,
+	void *hw_mgr_ctx, struct cam_hw_soc_info **soc_info_ptr,
+	uint32_t *reg_base_idx)
+{
+	int rc = 0;
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	struct cam_isp_hw_mgr_res *hw_mgr_res_temp;
+	struct cam_hw_soc_info    *soc_info = NULL;
+	struct cam_ife_hw_mgr_ctx *ctx =
+		(struct cam_ife_hw_mgr_ctx *) hw_mgr_ctx;
+
+	*soc_info_ptr = NULL;
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&ctx->res_list_ife_src, list) {
+		if (hw_mgr_res->res_id != CAM_ISP_HW_VFE_IN_CAMIF)
+			continue;
+
+		switch (reg_base_type) {
+		case CAM_REG_DUMP_BASE_TYPE_CAMNOC:
+		case CAM_REG_DUMP_BASE_TYPE_ISP_LEFT:
+			if (!hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT])
+				continue;
+
+			rc = hw_mgr_res->hw_res[
+				CAM_ISP_HW_SPLIT_LEFT]->process_cmd(
+				hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT],
+				CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA, &soc_info,
+				sizeof(void *));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in regspace data query split idx: %d rc : %d",
+					CAM_ISP_HW_SPLIT_LEFT, rc);
+				return rc;
+			}
+
+			if (reg_base_type == CAM_REG_DUMP_BASE_TYPE_ISP_LEFT)
+				*reg_base_idx = 0;
+			else
+				*reg_base_idx = 1;
+
+			*soc_info_ptr = soc_info;
+			break;
+		case CAM_REG_DUMP_BASE_TYPE_ISP_RIGHT:
+			if (!hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT])
+				continue;
+
+			rc = hw_mgr_res->hw_res[
+				CAM_ISP_HW_SPLIT_RIGHT]->process_cmd(
+				hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT],
+				CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA, &soc_info,
+				sizeof(void *));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in regspace data query split idx: %d rc : %d",
+					CAM_ISP_HW_SPLIT_RIGHT, rc);
+				return rc;
+			}
+
+			*reg_base_idx = 0;
+			*soc_info_ptr = soc_info;
+			break;
+		default:
+			CAM_ERR(CAM_ISP,
+				"Unrecognized reg base type: %u",
+				reg_base_type);
+			return -EINVAL;
+		}
+
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_handle_reg_dump(struct cam_ife_hw_mgr_ctx *ctx,
+	struct cam_cmd_buf_desc *reg_dump_buf_desc, uint32_t num_reg_dump_buf,
+	uint32_t meta_type,
+	void *soc_dump_args,
+	bool user_triggered_dump)
+{
+	int rc = 0, i;
+
+	if (!num_reg_dump_buf || !reg_dump_buf_desc) {
+		CAM_DBG(CAM_ISP,
+			"Invalid args for reg dump req_id: [%llu] ctx idx: [%u] meta_type: [%u] num_reg_dump_buf: [%u] reg_dump_buf_desc: [%pK]",
+			ctx->applied_req_id, ctx->ctx_index, meta_type,
+			num_reg_dump_buf, reg_dump_buf_desc);
+		return rc;
+	}
+
+	if (!atomic_read(&ctx->cdm_done))
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Reg dump values might be from more than one request");
+
+	for (i = 0; i < num_reg_dump_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&reg_dump_buf_desc[i]);
+		if (rc)
+			return rc;
+
+		CAM_DBG(CAM_ISP, "Reg dump cmd meta data: %u req_type: %u",
+			reg_dump_buf_desc[i].meta_data, meta_type);
+		if (reg_dump_buf_desc[i].meta_data == meta_type) {
+			rc = cam_soc_util_reg_dump_to_cmd_buf(ctx,
+				&reg_dump_buf_desc[i],
+				ctx->applied_req_id,
+				cam_ife_mgr_regspace_data_cb,
+				soc_dump_args,
+				user_triggered_dump);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Reg dump failed at idx: %d, rc: %d req_id: %llu meta type: %u",
+					i, rc, ctx->applied_req_id, meta_type);
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_get_hw_caps(void *hw_mgr_priv,
+	void *hw_caps_args)
+{
+	int rc = 0;
+	int i;
+	struct cam_ife_hw_mgr             *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd          *query = hw_caps_args;
+	struct cam_isp_query_cap_cmd       query_isp;
+	struct cam_isp_dev_cap_info       *ife_full_hw_info = NULL;
+	struct cam_isp_dev_cap_info       *ife_lite_hw_info = NULL;
+	struct cam_isp_dev_cap_info       *csid_full_hw_info = NULL;
+	struct cam_isp_dev_cap_info       *csid_lite_hw_info = NULL;
+	struct cam_ife_csid_hw_caps       *ife_csid_caps = {0};
+
+	CAM_DBG(CAM_ISP, "enter");
+
+	if (copy_from_user(&query_isp,
+		u64_to_user_ptr(query->caps_handle),
+		sizeof(struct cam_isp_query_cap_cmd))) {
+		rc = -EFAULT;
+		return rc;
+	}
+
+	query_isp.device_iommu.non_secure = hw_mgr->mgr_common.img_iommu_hdl;
+	query_isp.device_iommu.secure = hw_mgr->mgr_common.img_iommu_hdl_secure;
+	query_isp.cdm_iommu.non_secure = hw_mgr->mgr_common.cmd_iommu_hdl;
+	query_isp.cdm_iommu.secure = hw_mgr->mgr_common.cmd_iommu_hdl_secure;
+	query_isp.num_dev = 0;
+
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (!hw_mgr->ife_devices[i])
+			continue;
+
+		if (hw_mgr->ife_dev_caps[i].is_lite) {
+			if (ife_lite_hw_info == NULL) {
+				ife_lite_hw_info =
+					&query_isp.dev_caps[query_isp.num_dev];
+				query_isp.num_dev++;
+
+				ife_lite_hw_info->hw_type = CAM_ISP_HW_IFE_LITE;
+				ife_lite_hw_info->hw_version.major =
+					hw_mgr->ife_dev_caps[i].major;
+				ife_lite_hw_info->hw_version.minor =
+					hw_mgr->ife_dev_caps[i].minor;
+				ife_lite_hw_info->hw_version.incr =
+					hw_mgr->ife_dev_caps[i].incr;
+				ife_lite_hw_info->hw_version.reserved = 0;
+				ife_lite_hw_info->num_hw = 0;
+			}
+
+			ife_lite_hw_info->num_hw++;
+
+		} else {
+			if (ife_full_hw_info == NULL) {
+				ife_full_hw_info =
+					&query_isp.dev_caps[query_isp.num_dev];
+				query_isp.num_dev++;
+
+				ife_full_hw_info->hw_type = CAM_ISP_HW_IFE;
+				ife_full_hw_info->hw_version.major =
+					hw_mgr->ife_dev_caps[i].major;
+				ife_full_hw_info->hw_version.minor =
+					hw_mgr->ife_dev_caps[i].minor;
+				ife_full_hw_info->hw_version.incr =
+					hw_mgr->ife_dev_caps[i].incr;
+				ife_full_hw_info->hw_version.reserved = 0;
+				ife_full_hw_info->num_hw = 0;
+			}
+
+			ife_full_hw_info->num_hw++;
+		}
+	}
+
+	for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		if (!hw_mgr->csid_devices[i])
+			continue;
+
+		ife_csid_caps = (struct cam_ife_csid_hw_caps *)
+			&hw_mgr->ife_csid_dev_caps[i];
+
+		if (ife_csid_caps->is_lite) {
+			if (csid_lite_hw_info == NULL) {
+				csid_lite_hw_info =
+					&query_isp.dev_caps[query_isp.num_dev];
+				query_isp.num_dev++;
+
+				csid_lite_hw_info->hw_type =
+					CAM_ISP_HW_CSID_LITE;
+				csid_lite_hw_info->hw_version.major =
+					ife_csid_caps->major_version;
+				csid_lite_hw_info->hw_version.minor =
+					ife_csid_caps->minor_version;
+				csid_lite_hw_info->hw_version.incr =
+					ife_csid_caps->version_incr;
+				csid_lite_hw_info->hw_version.reserved = 0;
+				csid_lite_hw_info->num_hw = 0;
+			}
+
+			csid_lite_hw_info->num_hw++;
+
+		} else {
+			if (csid_full_hw_info == NULL) {
+				csid_full_hw_info =
+					&query_isp.dev_caps[query_isp.num_dev];
+				query_isp.num_dev++;
+
+				csid_full_hw_info->hw_type = CAM_ISP_HW_CSID;
+				csid_full_hw_info->hw_version.major =
+					ife_csid_caps->major_version;
+				csid_full_hw_info->hw_version.minor =
+					ife_csid_caps->minor_version;
+				csid_full_hw_info->hw_version.incr =
+					ife_csid_caps->version_incr;
+				csid_full_hw_info->hw_version.reserved = 0;
+				csid_full_hw_info->num_hw = 0;
+			}
+
+			csid_full_hw_info->num_hw++;
+		}
+	}
+
+	if (copy_to_user(u64_to_user_ptr(query->caps_handle),
+		&query_isp, sizeof(struct cam_isp_query_cap_cmd)))
+		rc = -EFAULT;
+
+	CAM_DBG(CAM_ISP, "exit rc :%d", rc);
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_is_rdi_res(uint32_t res_id)
+{
+	int rc = 0;
+
+	switch (res_id) {
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+		rc = 1;
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_dump_hw_src_clock(uint8_t hw_idx,
+	enum cam_isp_hw_type hw_type)
+{
+
+	struct cam_isp_hw_intf_data               *hw_intf_data = NULL;
+	struct cam_hw_intf                        *hw_intf = NULL;
+	uint8_t                                    dummy_args;
+
+	switch (hw_type) {
+	case CAM_ISP_HW_TYPE_VFE:
+		if (!g_ife_hw_mgr.ife_devices[hw_idx]) {
+			CAM_ERR(CAM_ISP, "No vfe device added yet");
+			return -ENODEV;
+		}
+
+		hw_intf_data = g_ife_hw_mgr.ife_devices[hw_idx];
+		if (!hw_intf_data->hw_intf) {
+			CAM_ERR(CAM_ISP, "hw_intf is null");
+			return -EINVAL;
+		}
+
+		hw_intf = hw_intf_data->hw_intf;
+		if (hw_intf->hw_ops.process_cmd) {
+			hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_DUMP_HW_SRC_CLK_RATE,
+				(void *)&dummy_args, sizeof(uint8_t));
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported HW Type: %u", hw_type);
+	}
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_reset_csid_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	int rc = 0;
+	struct cam_hw_intf      *hw_intf;
+	struct cam_csid_reset_cfg_args  csid_reset_args;
+
+	csid_reset_args.reset_type = CAM_IFE_CSID_RESET_PATH;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		csid_reset_args.node_res = isp_hw_res->hw_res[i];
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		CAM_DBG(CAM_ISP, "Resetting csid hardware %d",
+			hw_intf->hw_idx);
+		if (hw_intf->hw_ops.reset) {
+			rc = hw_intf->hw_ops.reset(hw_intf->hw_priv,
+				&csid_reset_args,
+				sizeof(struct cam_csid_reset_cfg_args));
+			if (rc)
+				goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "RESET HW res failed: (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_init_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	int rc = -1;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		CAM_DBG(CAM_ISP, "enabled vfe hardware %d",
+			hw_intf->hw_idx);
+		if (hw_intf->hw_ops.init) {
+			rc = hw_intf->hw_ops.init(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc)
+				goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "INIT HW res failed: (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_start_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res,
+	struct cam_ife_hw_mgr_ctx   *ctx)
+{
+	int i;
+	int rc = -1;
+	struct cam_hw_intf      *hw_intf;
+
+	/* Start slave (which is right split) first */
+	for (i = CAM_ISP_HW_SPLIT_MAX - 1; i >= 0; i--) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.start) {
+			rc = hw_intf->hw_ops.start(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not start HW:%d resources",
+					hw_intf->hw_idx);
+				goto err;
+			}
+		} else {
+			CAM_ERR(CAM_ISP, "function null");
+			goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "Start hw res failed (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static void cam_ife_hw_mgr_stop_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	struct cam_hw_intf      *hw_intf;
+	uint32_t dummy_args;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+
+		if (isp_hw_res->hw_res[i]->res_state !=
+			CAM_ISP_RESOURCE_STATE_STREAMING)
+			continue;
+
+		if (hw_intf->hw_ops.stop) {
+			hw_intf->hw_ops.stop(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+		}
+		else
+			CAM_ERR(CAM_ISP, "stop null");
+		if (hw_intf->hw_ops.process_cmd &&
+			isp_hw_res->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+			hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ,
+				&dummy_args, sizeof(dummy_args));
+		}
+	}
+}
+
+static void cam_ife_hw_mgr_deinit_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.deinit)
+			hw_intf->hw_ops.deinit(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+	}
+}
+
+static void cam_ife_hw_mgr_deinit_hw(
+	struct cam_ife_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	int i = 0;
+
+	if (!ctx->init_done) {
+		CAM_WARN(CAM_ISP, "ctx is not in init state");
+		return;
+	}
+
+	if (ctx->is_tpg)
+		cam_ife_hw_mgr_deinit_hw_res(&ctx->res_list_tpg);
+
+	/* Deinit IFE CID */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_cid, list) {
+		CAM_DBG(CAM_ISP, "%s: Going to DeInit IFE CID\n", __func__);
+		cam_ife_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	/* Deinit IFE CSID */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		CAM_DBG(CAM_ISP, "%s: Going to DeInit IFE CSID\n", __func__);
+		cam_ife_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	/* Deint IFE MUX(SRC) */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		cam_ife_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	/* Deint IFE RD */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_in_rd, list) {
+		cam_ife_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	/* Deinit IFE OUT */
+	for (i = 0; i < max_ife_out_res; i++)
+		cam_ife_hw_mgr_deinit_hw_res(&ctx->res_list_ife_out[i]);
+
+	ctx->init_done = false;
+}
+
+static int cam_ife_hw_mgr_init_hw(
+	struct cam_ife_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	int rc = 0, i;
+
+	if (ctx->is_tpg) {
+		CAM_DBG(CAM_ISP, "INIT TPG ... in ctx id:%d",
+			ctx->ctx_index);
+		rc = cam_ife_hw_mgr_init_hw_res(&ctx->res_list_tpg);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT TFE TPG(id :%d)",
+				ctx->res_list_tpg.hw_res[0]->hw_intf->hw_idx);
+			goto deinit;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "INIT IFE CID ... in ctx id:%d",
+		ctx->ctx_index);
+	/* INIT IFE CID */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_cid, list) {
+		rc = cam_ife_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT IFE CID(id :%d)",
+				 hw_mgr_res->res_id);
+			goto deinit;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "INIT IFE csid ... in ctx id:%d",
+		ctx->ctx_index);
+
+	/* INIT IFE csid */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		rc = cam_ife_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT IFE CSID(id :%d)",
+				 hw_mgr_res->res_id);
+			goto deinit;
+		}
+	}
+
+	/* INIT IFE SRC */
+	CAM_DBG(CAM_ISP, "INIT IFE SRC in ctx id:%d",
+		ctx->ctx_index);
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		rc = cam_ife_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT IFE SRC (%d)",
+				 hw_mgr_res->res_id);
+			goto deinit;
+		}
+	}
+
+	/* INIT IFE BUS RD */
+	CAM_DBG(CAM_ISP, "INIT IFE BUS RD in ctx id:%d",
+		ctx->ctx_index);
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_in_rd, list) {
+		rc = cam_ife_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not IFE BUS RD (%d)",
+				 hw_mgr_res->res_id);
+			return rc;
+		}
+	}
+
+	/* INIT IFE OUT */
+	CAM_DBG(CAM_ISP, "INIT IFE OUT RESOURCES in ctx id:%d",
+		ctx->ctx_index);
+
+	for (i = 0; i < max_ife_out_res; i++) {
+		rc = cam_ife_hw_mgr_init_hw_res(&ctx->res_list_ife_out[i]);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT IFE OUT (%d)",
+				 ctx->res_list_ife_out[i].res_id);
+			goto deinit;
+		}
+	}
+
+	return rc;
+deinit:
+	ctx->init_done = true;
+	cam_ife_hw_mgr_deinit_hw(ctx);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_put_res(
+	struct list_head                *src_list,
+	struct cam_isp_hw_mgr_res      **res)
+{
+	int rc                              = 0;
+	struct cam_isp_hw_mgr_res *res_ptr  = NULL;
+
+	res_ptr = *res;
+	if (res_ptr)
+		list_add_tail(&res_ptr->list, src_list);
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_get_res(
+	struct list_head                *src_list,
+	struct cam_isp_hw_mgr_res      **res)
+{
+	int rc = 0;
+	struct cam_isp_hw_mgr_res *res_ptr  = NULL;
+
+	if (!list_empty(src_list)) {
+		res_ptr = list_first_entry(src_list,
+			struct cam_isp_hw_mgr_res, list);
+		list_del_init(&res_ptr->list);
+	} else {
+		CAM_ERR(CAM_ISP, "No more free ife hw mgr ctx");
+		rc = -1;
+	}
+	*res = res_ptr;
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_free_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.release) {
+			rc = hw_intf->hw_ops.release(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Release HW:%d resource id %d failed",
+					hw_intf->hw_idx, isp_hw_res->res_id);
+			isp_hw_res->hw_res[i] = NULL;
+		} else
+			CAM_ERR(CAM_ISP, "Release null");
+	}
+	/* caller should make sure the resource is in a list */
+	list_del_init(&isp_hw_res->list);
+	memset(isp_hw_res, 0, sizeof(*isp_hw_res));
+	INIT_LIST_HEAD(&isp_hw_res->list);
+
+	return 0;
+}
+
+static const char *cam_ife_hw_mgr_get_res_state(
+	uint32_t res_state)
+{
+	switch (res_state) {
+	case CAM_ISP_RESOURCE_STATE_UNAVAILABLE:
+		return "UNAVAILABLE";
+	case CAM_ISP_RESOURCE_STATE_AVAILABLE:
+		return "AVAILABLE";
+	case CAM_ISP_RESOURCE_STATE_RESERVED:
+		return "RESERVED";
+	case CAM_ISP_RESOURCE_STATE_INIT_HW:
+		return "HW INIT DONE";
+	case CAM_ISP_RESOURCE_STATE_STREAMING:
+		return "STREAMING";
+	default:
+		return "INVALID STATE";
+	}
+}
+
+static const char *cam_ife_hw_mgr_get_csid_res_id(
+	uint32_t res_id)
+{
+	switch (res_id) {
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+		return "RDI_0";
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+		return "RDI_1";
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+		return "RDI_2";
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+		return "RDI_3";
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		return "IPP";
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		return "PPP";
+	default:
+		return "INVALID";
+	}
+}
+
+static const char *cam_ife_hw_mgr_get_src_res_id(
+	uint32_t res_id)
+{
+	switch (res_id) {
+	case CAM_ISP_HW_VFE_IN_CAMIF:
+		return "CAMIF";
+	case CAM_ISP_HW_VFE_IN_TESTGEN:
+		return "TESTGEN";
+	case CAM_ISP_HW_VFE_IN_RD:
+		return "BUS_RD";
+	case CAM_ISP_HW_VFE_IN_RDI0:
+		return "RDI_0";
+	case CAM_ISP_HW_VFE_IN_RDI1:
+		return "RDI_1";
+	case CAM_ISP_HW_VFE_IN_RDI2:
+		return "RDI_2";
+	case CAM_ISP_HW_VFE_IN_RDI3:
+		return "RDI_3";
+	case CAM_ISP_HW_VFE_IN_PDLIB:
+		return "PDLIB";
+	case CAM_ISP_HW_VFE_IN_LCR:
+		return "LCR";
+	default:
+		return "INVALID";
+	}
+}
+
+static void cam_ife_hw_mgr_dump_all_ctx(void)
+{
+	uint32_t i;
+	struct cam_ife_hw_mgr_ctx       *ctx;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res_temp;
+	struct cam_ife_hw_mgr_ctx       *ctx_temp;
+
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	if (list_empty(&g_ife_hw_mgr.used_ctx_list)) {
+		CAM_INFO(CAM_ISP, "Currently no ctx in use");
+		mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+		return;
+	}
+
+	list_for_each_entry_safe(ctx, ctx_temp,
+		&g_ife_hw_mgr.used_ctx_list, list) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"ctx id:%d is_dual:%d is_tpg:%d num_base:%d rdi only:%d",
+			ctx->ctx_index, ctx->is_dual, ctx->is_tpg,
+			ctx->num_base, ctx->is_rdi_only_context);
+
+		if (ctx->res_list_tpg.res_type == CAM_ISP_RESOURCE_TPG) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"Acquired TPG HW:%d",
+				ctx->res_list_tpg.hw_res[0]->hw_intf->hw_idx);
+		}
+
+		list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+			&ctx->res_list_ife_csid, list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"csid:%d res_type:%d res_id:%d res_state:%d",
+					hw_mgr_res->hw_res[i]->hw_intf->hw_idx,
+					hw_mgr_res->hw_res[i]->res_type,
+					hw_mgr_res->hw_res[i]->res_id,
+					hw_mgr_res->hw_res[i]->res_state);
+			}
+		}
+
+		list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+			&ctx->res_list_ife_src, list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"ife IN:%d res_type:%d res_id:%d res_state:%d",
+					hw_mgr_res->hw_res[i]->hw_intf->hw_idx,
+					hw_mgr_res->hw_res[i]->res_type,
+					hw_mgr_res->hw_res[i]->res_id,
+					hw_mgr_res->hw_res[i]->res_state);
+			}
+		}
+	}
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+
+}
+
+static void cam_ife_hw_mgr_print_acquire_info(
+	struct cam_ife_hw_mgr_ctx *hw_mgr_ctx, uint32_t num_pix_port,
+	uint32_t num_pd_port, uint32_t num_rdi_port, int acquire_failed)
+{
+	struct cam_isp_hw_mgr_res    *hw_mgr_res = NULL;
+	struct cam_isp_hw_mgr_res    *hw_mgr_res_temp = NULL;
+	struct cam_isp_resource_node *hw_res = NULL;
+	int hw_idx[CAM_ISP_HW_SPLIT_MAX] = {-1, -1};
+	int i = 0;
+
+	if (!list_empty(&hw_mgr_ctx->res_list_ife_src)) {
+		hw_mgr_res = list_first_entry(&hw_mgr_ctx->res_list_ife_src,
+			struct cam_isp_hw_mgr_res, list);
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				hw_idx[i] = hw_res->hw_intf->hw_idx;
+		}
+	}
+
+	if (acquire_failed)
+		goto fail;
+
+	CAM_INFO(CAM_ISP,
+		"Acquired %s IFE[%d %d] with [%u pix] [%u pd] [%u rdi] ports for ctx:%u",
+		(hw_mgr_ctx->is_dual) ? "dual" : "single",
+		hw_idx[CAM_ISP_HW_SPLIT_LEFT], hw_idx[CAM_ISP_HW_SPLIT_RIGHT],
+		num_pix_port, num_pd_port, num_rdi_port, hw_mgr_ctx->ctx_index);
+
+	return;
+
+fail:
+	CAM_ERR(CAM_ISP,
+		"Failed to acquire %s-IFE with [%u pix] [%u pd] [%u rdi] ports for ctx:%u",
+		(hw_mgr_ctx->is_dual) ? "dual" : "single",
+		num_pix_port, num_pd_port, num_rdi_port, hw_mgr_ctx->ctx_index);
+	CAM_INFO(CAM_ISP, "Previously acquired IFEs[%d %d]",
+		hw_idx[CAM_ISP_HW_SPLIT_LEFT], hw_idx[CAM_ISP_HW_SPLIT_RIGHT]);
+
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&hw_mgr_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"IFE src split_id:%d res_id:%s hw_idx:%u state:%s",
+					i,
+					cam_ife_hw_mgr_get_src_res_id(
+					hw_res->res_id),
+					hw_res->hw_intf->hw_idx,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+	cam_ife_hw_mgr_dump_all_ctx();
+}
+
+static void cam_ife_hw_mgr_dump_acq_data(
+	struct cam_ife_hw_mgr_ctx    *hwr_mgr_ctx)
+{
+	struct cam_isp_hw_mgr_res    *hw_mgr_res = NULL;
+	struct cam_isp_hw_mgr_res    *hw_mgr_res_temp = NULL;
+	struct cam_isp_resource_node *hw_res = NULL;
+	struct timespec64            *ts = NULL;
+	uint64_t ms, tmp, hrs, min, sec;
+	int i = 0, j = 0;
+
+	ts = &hwr_mgr_ctx->ts;
+	tmp = ts->tv_sec;
+	ms = (ts->tv_nsec) / 1000000;
+	sec = do_div(tmp, 60);
+	min = do_div(tmp, 60);
+	hrs = do_div(tmp, 24);
+
+	CAM_INFO(CAM_ISP,
+		"**** %llu:%llu:%llu.%llu ctx_idx: %u rdi_only: %s is_dual: %s acquired ****",
+		hrs, min, sec, ms,
+		hwr_mgr_ctx->ctx_index,
+		(hwr_mgr_ctx->is_rdi_only_context ? "true" : "false"),
+		(hwr_mgr_ctx->is_dual ? "true" : "false"));
+
+	/* Iterate over CID resources */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&hwr_mgr_ctx->res_list_ife_cid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf) {
+				CAM_INFO(CAM_ISP,
+					"CID split_id: %d res_id: %u hw_idx: %u state: %s",
+					i, hw_res->res_id,
+					hw_res->hw_intf->hw_idx,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+			}
+		}
+	}
+
+	/* Iterate over CSID resources */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&hwr_mgr_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"CSID split_id: %d res_id: %s hw_idx: %u state: %s",
+					i,
+					cam_ife_hw_mgr_get_csid_res_id(
+					hw_res->res_id),
+					hw_res->hw_intf->hw_idx,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+
+	/* Iterate over IFE IN resources */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&hwr_mgr_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"IFE src split_id: %d res_id: %s hw_idx: %u state: %s",
+					i,
+					cam_ife_hw_mgr_get_src_res_id(
+					hw_res->res_id),
+					hw_res->hw_intf->hw_idx,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+
+	/* Iterate over IFE RD resources */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&hwr_mgr_ctx->res_list_ife_in_rd, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			hw_res = hw_mgr_res->hw_res[i];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"IFE src_rd split_id: %d res_id: %s hw_idx: %u state: %s",
+					i,
+					cam_ife_hw_mgr_get_src_res_id(
+					hw_res->res_id),
+					hw_res->hw_intf->hw_idx,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+
+	/* Iterate over IFE OUT resources */
+	for (i = 0; i < max_ife_out_res; i++) {
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			hw_mgr_res = &hwr_mgr_ctx->res_list_ife_out[i];
+			hw_res = hw_mgr_res->hw_res[j];
+			if (hw_res && hw_res->hw_intf)
+				CAM_INFO(CAM_ISP,
+					"IFE out split_id: %d res_id: 0x%x hw_idx: %u state: %s",
+					j, hw_res->res_id,
+					hw_res->hw_intf->hw_idx,
+					cam_ife_hw_mgr_get_res_state
+					(hw_res->res_state));
+		}
+	}
+}
+
+static int cam_ife_mgr_csid_change_halt_mode(struct cam_ife_hw_mgr_ctx *ctx,
+	enum cam_ife_csid_halt_mode halt_mode)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_resource_node     *isp_res;
+	struct cam_ife_csid_hw_halt_args halt;
+	struct cam_hw_intf               *hw_intf;
+	uint32_t i;
+	int rc = 0;
+
+	if (!ctx->is_dual)
+		return 0;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (i == CAM_ISP_HW_SPLIT_LEFT)
+				continue;
+
+			if (!hw_mgr_res->hw_res[i] ||
+				(hw_mgr_res->hw_res[i]->res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING))
+				continue;
+
+			isp_res = hw_mgr_res->hw_res[i];
+
+			if ((isp_res->res_type == CAM_ISP_RESOURCE_PIX_PATH) &&
+				(isp_res->res_id == CAM_IFE_PIX_PATH_RES_IPP)) {
+				hw_intf         = isp_res->hw_intf;
+				halt.node_res   = isp_res;
+				halt.halt_mode  = halt_mode;
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE,
+					&halt,
+					sizeof(
+					struct cam_ife_csid_hw_halt_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Halt update failed");
+				break;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_csid_stop_hw(
+	struct cam_ife_hw_mgr_ctx *ctx, struct list_head  *stop_list,
+		uint32_t  base_idx, uint32_t stop_cmd)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_isp_resource_node   *isp_res;
+	struct cam_isp_resource_node   *stop_res[CAM_IFE_PIX_PATH_RES_MAX - 1];
+	struct cam_csid_hw_stop_args    stop;
+	struct cam_hw_intf             *hw_intf;
+	uint32_t i, cnt;
+
+	cnt = 0;
+	list_for_each_entry(hw_mgr_res, stop_list, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i] ||
+				(hw_mgr_res->hw_res[i]->res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING))
+				continue;
+
+			isp_res = hw_mgr_res->hw_res[i];
+			if (isp_res->hw_intf->hw_idx != base_idx)
+				continue;
+			CAM_DBG(CAM_ISP, "base_idx %d res_id %d cnt %u",
+				base_idx, isp_res->res_id, cnt);
+			stop_res[cnt] = isp_res;
+			cnt++;
+		}
+	}
+
+	if (cnt) {
+		hw_intf =  stop_res[0]->hw_intf;
+		stop.num_res = cnt;
+		stop.node_res = stop_res;
+		stop.stop_cmd = stop_cmd;
+		hw_intf->hw_ops.stop(hw_intf->hw_priv, &stop, sizeof(stop));
+	}
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_release_hw_for_ctx(
+	struct cam_ife_hw_mgr_ctx  *ife_ctx)
+{
+	uint32_t                          i;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res_temp;
+
+	/* ife leaf resource */
+	for (i = 0; i < max_ife_out_res; i++)
+		cam_ife_hw_mgr_free_hw_res(&ife_ctx->res_list_ife_out[i]);
+
+	/* ife bus rd resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&ife_ctx->res_list_ife_in_rd, list) {
+		cam_ife_hw_mgr_free_hw_res(hw_mgr_res);
+		cam_ife_hw_mgr_put_res(&ife_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* ife source resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&ife_ctx->res_list_ife_src, list) {
+		cam_ife_hw_mgr_free_hw_res(hw_mgr_res);
+		cam_ife_hw_mgr_put_res(&ife_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* ife csid resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&ife_ctx->res_list_ife_csid, list) {
+		cam_ife_hw_mgr_free_hw_res(hw_mgr_res);
+		cam_ife_hw_mgr_put_res(&ife_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* ife cid resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&ife_ctx->res_list_ife_cid, list) {
+		cam_ife_hw_mgr_free_hw_res(hw_mgr_res);
+		cam_ife_hw_mgr_put_res(&ife_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* ife phy tpg resource */
+	if (ife_ctx->is_tpg)
+		cam_ife_hw_mgr_free_hw_res(&ife_ctx->res_list_tpg);
+
+	/* ife root node */
+	if (ife_ctx->res_list_ife_in.res_type != CAM_ISP_RESOURCE_UNINT)
+		cam_ife_hw_mgr_free_hw_res(&ife_ctx->res_list_ife_in);
+
+	/* clean up the callback function */
+	ife_ctx->common.cb_priv = NULL;
+	ife_ctx->common.event_cb = NULL;
+
+	CAM_DBG(CAM_ISP, "release context completed ctx id:%d",
+		ife_ctx->ctx_index);
+
+	return 0;
+}
+
+
+static int cam_ife_hw_mgr_put_ctx(
+	struct list_head                 *src_list,
+	struct cam_ife_hw_mgr_ctx       **ife_ctx)
+{
+	int rc                              = 0;
+	struct cam_ife_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	ctx_ptr = *ife_ctx;
+	if (ctx_ptr)
+		list_add_tail(&ctx_ptr->list, src_list);
+	*ife_ctx = NULL;
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_get_ctx(
+	struct list_head                *src_list,
+	struct cam_ife_hw_mgr_ctx       **ife_ctx)
+{
+	int rc                              = 0;
+	struct cam_ife_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	if (!list_empty(src_list)) {
+		ctx_ptr = list_first_entry(src_list,
+			struct cam_ife_hw_mgr_ctx, list);
+		list_del_init(&ctx_ptr->list);
+	} else {
+		CAM_ERR(CAM_ISP, "No more free ife hw mgr ctx");
+		rc = -1;
+	}
+	*ife_ctx = ctx_ptr;
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+
+	return rc;
+}
+
+static void cam_ife_mgr_add_base_info(
+	struct cam_ife_hw_mgr_ctx       *ctx,
+	enum cam_isp_hw_split_id         split_id,
+	uint32_t                         base_idx)
+{
+	uint32_t    i;
+
+	if (!ctx->num_base) {
+		ctx->base[0].split_id = split_id;
+		ctx->base[0].idx      = base_idx;
+		ctx->num_base++;
+		CAM_DBG(CAM_ISP,
+			"Add split id = %d for base idx = %d num_base=%d",
+			split_id, base_idx, ctx->num_base);
+	} else {
+		/*Check if base index already exists in the list */
+		for (i = 0; i < ctx->num_base; i++) {
+			if (ctx->base[i].idx == base_idx) {
+				if (split_id != CAM_ISP_HW_SPLIT_MAX &&
+					ctx->base[i].split_id ==
+						CAM_ISP_HW_SPLIT_MAX)
+					ctx->base[i].split_id = split_id;
+
+				break;
+			}
+		}
+
+		if (i == ctx->num_base) {
+			ctx->base[ctx->num_base].split_id = split_id;
+			ctx->base[ctx->num_base].idx      = base_idx;
+			ctx->num_base++;
+			CAM_DBG(CAM_ISP,
+				"Add split_id=%d for base idx=%d num_base=%d",
+				 split_id, base_idx, ctx->num_base);
+		}
+	}
+}
+
+static int cam_ife_mgr_process_base_info(
+	struct cam_ife_hw_mgr_ctx        *ctx)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_resource_node     *res = NULL;
+	uint32_t i;
+
+	if (list_empty(&ctx->res_list_ife_src)) {
+		CAM_ERR(CAM_ISP, "Mux List empty");
+		return -ENODEV;
+	}
+
+	/* IFE mux in resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			cam_ife_mgr_add_base_info(ctx, i,
+					res->hw_intf->hw_idx);
+			CAM_DBG(CAM_ISP, "add base info for hw %d",
+				res->hw_intf->hw_idx);
+		}
+	}
+	CAM_DBG(CAM_ISP, "ctx base num = %d", ctx->num_base);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_acquire_res_ife_out_rdi(
+	struct cam_ife_hw_mgr_ctx       *ife_ctx,
+	struct cam_isp_hw_mgr_res       *ife_src_res,
+	struct cam_isp_in_port_generic_info     *in_port)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_acquire_args               vfe_acquire;
+	struct cam_isp_out_port_generic_info     *out_port = NULL;
+	struct cam_isp_hw_mgr_res                *ife_out_res;
+	struct cam_hw_intf                       *hw_intf;
+	uint32_t  i, vfe_out_res_id, vfe_in_res_id;
+
+	/* take left resource */
+	vfe_in_res_id = ife_src_res->hw_res[0]->res_id;
+
+	switch (vfe_in_res_id) {
+	case CAM_ISP_HW_VFE_IN_RDI0:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_0;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI1:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_1;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI2:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_2;
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI3:
+		vfe_out_res_id = CAM_ISP_IFE_OUT_RES_RDI_3;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "invalid resource type");
+		goto err;
+	}
+	CAM_DBG(CAM_ISP, "vfe_in_res_id = %d, vfe_out_red_id = %d",
+		vfe_in_res_id, vfe_out_res_id);
+
+	vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_OUT;
+	vfe_acquire.tasklet = ife_ctx->common.tasklet_info;
+
+	ife_out_res = &ife_ctx->res_list_ife_out[vfe_out_res_id & 0xFF];
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+
+		CAM_DBG(CAM_ISP, "i = %d, vfe_out_res_id = %d, out_port: %d",
+			i, vfe_out_res_id, out_port->res_type);
+
+		if (out_port->reserved)
+			continue;
+		if ((vfe_out_res_id != out_port->res_type) &&
+		    (out_port->res_type < CAM_ISP_IFE_OUT_RES_RDI_0 ||
+		     out_port->res_type > CAM_ISP_IFE_OUT_RES_RDI_3))
+			continue;
+
+		out_port->res_type = vfe_out_res_id;
+
+		vfe_acquire.vfe_out.cdm_ops = ife_ctx->cdm_ops;
+		vfe_acquire.priv = ife_ctx;
+		vfe_acquire.vfe_out.out_port_info = out_port;
+		vfe_acquire.vfe_out.split_id = CAM_ISP_HW_SPLIT_LEFT;
+		vfe_acquire.vfe_out.unique_id = ife_ctx->ctx_index;
+		vfe_acquire.vfe_out.is_dual = 0;
+		vfe_acquire.vfe_out.disable_ubwc_comp =
+			g_ife_hw_mgr.debug_cfg.disable_ubwc_comp;
+		vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		hw_intf = ife_src_res->hw_res[0]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&vfe_acquire,
+			sizeof(struct cam_vfe_acquire_args));
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not acquire out resource 0x%x",
+				 out_port->res_type);
+			goto err;
+		}
+
+		out_port->reserved = 1;
+		break;
+	}
+
+	if (i == in_port->num_out_res) {
+		CAM_ERR(CAM_ISP,
+			"Cannot acquire out resource, i=%d, num_out_res=%d",
+			i, in_port->num_out_res);
+		goto err;
+	}
+
+	ife_out_res->hw_res[0] = vfe_acquire.vfe_out.rsrc_node;
+	ife_out_res->is_dual_isp = 0;
+	ife_out_res->res_id = vfe_out_res_id;
+	ife_out_res->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	ife_src_res->num_children++;
+
+	return 0;
+err:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_ife_out_pixel(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_hw_mgr_res           *ife_src_res,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool                                 acquire_lcr)
+{
+	int rc = -1;
+	uint32_t  i, j, k;
+	struct cam_vfe_acquire_args               vfe_acquire;
+	struct cam_isp_out_port_generic_info     *out_port;
+	struct cam_isp_hw_mgr_res                *ife_out_res;
+	struct cam_hw_intf                       *hw_intf;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		k = out_port->res_type & 0xFF;
+		if (k >= max_ife_out_res) {
+			CAM_ERR(CAM_ISP, "invalid output resource type 0x%x",
+				 out_port->res_type);
+			continue;
+		}
+
+		if (cam_ife_hw_mgr_is_rdi_res(out_port->res_type))
+			continue;
+
+		if ((acquire_lcr &&
+			out_port->res_type != CAM_ISP_IFE_OUT_RES_LCR) ||
+			(!acquire_lcr &&
+			out_port->res_type == CAM_ISP_IFE_OUT_RES_LCR))
+			continue;
+
+		if ((out_port->res_type == CAM_ISP_IFE_OUT_RES_2PD &&
+			ife_src_res->res_id != CAM_ISP_HW_VFE_IN_PDLIB) ||
+			(ife_src_res->res_id == CAM_ISP_HW_VFE_IN_PDLIB &&
+			out_port->res_type != CAM_ISP_IFE_OUT_RES_2PD))
+			continue;
+
+		CAM_DBG(CAM_ISP, "res_type 0x%x", out_port->res_type);
+
+		ife_out_res = &ife_ctx->res_list_ife_out[k];
+		ife_out_res->is_dual_isp = in_port->usage_type;
+
+		vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_OUT;
+		vfe_acquire.tasklet = ife_ctx->common.tasklet_info;
+		vfe_acquire.vfe_out.cdm_ops = ife_ctx->cdm_ops;
+		vfe_acquire.priv = ife_ctx;
+		vfe_acquire.vfe_out.out_port_info =  out_port;
+		vfe_acquire.vfe_out.is_dual       = ife_src_res->is_dual_isp;
+		vfe_acquire.vfe_out.unique_id     = ife_ctx->ctx_index;
+		vfe_acquire.vfe_out.disable_ubwc_comp =
+			g_ife_hw_mgr.debug_cfg.disable_ubwc_comp;
+		vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!ife_src_res->hw_res[j])
+				continue;
+
+			hw_intf = ife_src_res->hw_res[j]->hw_intf;
+
+			if (j == CAM_ISP_HW_SPLIT_LEFT) {
+				vfe_acquire.vfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_LEFT;
+				if (ife_src_res->is_dual_isp) {
+					/*TBD */
+					vfe_acquire.vfe_out.is_master     = 1;
+					vfe_acquire.vfe_out.dual_slave_core =
+						ife_ctx->slave_hw_idx;
+				} else {
+					vfe_acquire.vfe_out.is_master   = 0;
+					vfe_acquire.vfe_out.dual_slave_core =
+						0;
+				}
+			} else {
+				vfe_acquire.vfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_RIGHT;
+				vfe_acquire.vfe_out.is_master       = 0;
+				vfe_acquire.vfe_out.dual_slave_core =
+					ife_ctx->master_hw_idx;
+			}
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&vfe_acquire,
+				sizeof(struct cam_vfe_acquire_args));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire out resource 0x%x",
+					out_port->res_type);
+				goto err;
+			}
+
+			ife_out_res->hw_res[j] =
+				vfe_acquire.vfe_out.rsrc_node;
+			CAM_DBG(CAM_ISP, "resource type :0x%x res id:0x%x",
+				ife_out_res->hw_res[j]->res_type,
+				ife_out_res->hw_res[j]->res_id);
+
+		}
+		ife_out_res->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+		ife_out_res->res_id = out_port->res_type;
+		ife_src_res->num_children++;
+	}
+
+	return 0;
+err:
+	/* release resource at the entry function */
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_ife_out(
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res       *ife_src_res;
+
+	list_for_each_entry(ife_src_res, &ife_ctx->res_list_ife_src, list) {
+		if (ife_src_res->num_children)
+			continue;
+
+		switch (ife_src_res->res_id) {
+		case CAM_ISP_HW_VFE_IN_CAMIF:
+		case CAM_ISP_HW_VFE_IN_PDLIB:
+		case CAM_ISP_HW_VFE_IN_RD:
+			rc = cam_ife_hw_mgr_acquire_res_ife_out_pixel(ife_ctx,
+				ife_src_res, in_port, false);
+			break;
+		case CAM_ISP_HW_VFE_IN_LCR:
+			rc = cam_ife_hw_mgr_acquire_res_ife_out_pixel(ife_ctx,
+				ife_src_res, in_port, true);
+			break;
+		case CAM_ISP_HW_VFE_IN_RDI0:
+		case CAM_ISP_HW_VFE_IN_RDI1:
+		case CAM_ISP_HW_VFE_IN_RDI2:
+		case CAM_ISP_HW_VFE_IN_RDI3:
+			rc = cam_ife_hw_mgr_acquire_res_ife_out_rdi(ife_ctx,
+				ife_src_res, in_port);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unknown IFE SRC resource: %d",
+				ife_src_res->res_id);
+			break;
+		}
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+err:
+	/* release resource on entry function */
+	return rc;
+}
+
+static int cam_convert_hw_idx_to_ife_hw_num(int hw_idx)
+{
+	uint32_t hw_version, rc = 0;
+
+	rc = cam_cpas_get_cpas_hw_version(&hw_version);
+	if (!rc) {
+		switch (hw_version) {
+		case CAM_CPAS_TITAN_170_V100:
+		case CAM_CPAS_TITAN_170_V110:
+		case CAM_CPAS_TITAN_170_V120:
+		case CAM_CPAS_TITAN_175_V100:
+		case CAM_CPAS_TITAN_175_V101:
+		case CAM_CPAS_TITAN_175_V120:
+		case CAM_CPAS_TITAN_175_V130:
+		case CAM_CPAS_TITAN_480_V100:
+			if (hw_idx == 0)
+				return CAM_ISP_IFE0_HW;
+			else if (hw_idx == 1)
+				return CAM_ISP_IFE1_HW;
+			else if (hw_idx == 2)
+				return CAM_ISP_IFE0_LITE_HW;
+			else if (hw_idx == 3)
+				return CAM_ISP_IFE1_LITE_HW;
+			else if (hw_idx == 4)
+				return CAM_ISP_IFE2_LITE_HW;
+			else if (hw_idx == 5)
+				return CAM_ISP_IFE3_LITE_HW;
+			else if (hw_idx == 6)
+				return CAM_ISP_IFE4_LITE_HW;
+			break;
+		case CAM_CPAS_TITAN_580_V100:
+		case CAM_CPAS_TITAN_570_V200:
+		case CAM_CPAS_TITAN_165_V100:
+			if (hw_idx == 0)
+				return CAM_ISP_IFE0_HW;
+			else if (hw_idx == 1)
+				return CAM_ISP_IFE1_HW;
+			else if (hw_idx == 2)
+				return CAM_ISP_IFE2_HW;
+			else if (hw_idx == 3)
+				return CAM_ISP_IFE0_LITE_HW;
+			else if (hw_idx == 4)
+				return CAM_ISP_IFE1_LITE_HW;
+			break;
+		case CAM_CPAS_TITAN_170_V200:
+			if (hw_idx == 0)
+				return CAM_ISP_IFE0_HW;
+			else if (hw_idx == 1)
+				return CAM_ISP_IFE1_HW;
+			else if (hw_idx == 2)
+				return CAM_ISP_IFE2_HW;
+			else if (hw_idx == 3)
+				return CAM_ISP_IFE0_LITE_HW;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid hw_version: 0x%X",
+				hw_version);
+			rc = -EINVAL;
+			break;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_convert_rdi_out_res_id_to_src(int res_id)
+{
+	if (res_id == CAM_ISP_IFE_OUT_RES_RDI_0)
+		return CAM_ISP_HW_VFE_IN_RDI0;
+	else if (res_id == CAM_ISP_IFE_OUT_RES_RDI_1)
+		return CAM_ISP_HW_VFE_IN_RDI1;
+	else if (res_id == CAM_ISP_IFE_OUT_RES_RDI_2)
+		return CAM_ISP_HW_VFE_IN_RDI2;
+	else if (res_id == CAM_ISP_IFE_OUT_RES_RDI_3)
+		return CAM_ISP_HW_VFE_IN_RDI3;
+	return CAM_ISP_HW_VFE_IN_MAX;
+}
+
+static int cam_convert_res_id_to_hw_path(int res_id)
+{
+	if (res_id == CAM_ISP_HW_VFE_IN_LCR)
+		return CAM_ISP_LCR_PATH;
+	else if (res_id == CAM_ISP_HW_VFE_IN_PDLIB)
+		return CAM_ISP_PPP_PATH;
+	else if (res_id == CAM_ISP_HW_VFE_IN_CAMIF)
+		return CAM_ISP_PXL_PATH;
+	else if (res_id == CAM_ISP_HW_VFE_IN_RDI0)
+		return CAM_ISP_RDI0_PATH;
+	else if (res_id == CAM_ISP_HW_VFE_IN_RDI1)
+		return CAM_ISP_RDI1_PATH;
+	else if (res_id == CAM_ISP_HW_VFE_IN_RDI2)
+		return CAM_ISP_RDI2_PATH;
+	else if (res_id == CAM_ISP_HW_VFE_IN_RDI3)
+		return CAM_ISP_RDI3_PATH;
+	return 0;
+}
+
+static int cam_ife_hw_mgr_acquire_res_ife_src(
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool acquire_lcr, uint32_t *acquired_hw_id,
+	uint32_t *acquired_hw_path)
+{
+	int rc                = -1;
+	int i;
+	struct cam_isp_hw_mgr_res                  *csid_res;
+	struct cam_isp_hw_mgr_res                  *ife_src_res;
+	struct cam_vfe_acquire_args                 vfe_acquire;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_ife_hw_mgr                      *ife_hw_mgr;
+
+	ife_hw_mgr = ife_ctx->hw_mgr;
+
+	list_for_each_entry(csid_res, &ife_ctx->res_list_ife_csid, list) {
+		if (csid_res->num_children && !acquire_lcr)
+			continue;
+
+		if (acquire_lcr && csid_res->res_id != CAM_IFE_PIX_PATH_RES_IPP)
+			continue;
+
+		rc = cam_ife_hw_mgr_get_res(&ife_ctx->free_res_list,
+			&ife_src_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+			goto err;
+		}
+		cam_ife_hw_mgr_put_res(&ife_ctx->res_list_ife_src,
+			&ife_src_res);
+
+		vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_IN;
+		vfe_acquire.tasklet = ife_ctx->common.tasklet_info;
+		vfe_acquire.vfe_in.cdm_ops = ife_ctx->cdm_ops;
+		vfe_acquire.vfe_in.in_port = in_port;
+		vfe_acquire.vfe_in.is_fe_enabled = ife_ctx->is_fe_enabled;
+		vfe_acquire.vfe_in.is_offline = ife_ctx->is_offline;
+		vfe_acquire.priv = ife_ctx;
+		vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+
+		switch (csid_res->res_id) {
+		case CAM_IFE_PIX_PATH_RES_IPP:
+			if (!acquire_lcr)
+				vfe_acquire.vfe_in.res_id =
+					CAM_ISP_HW_VFE_IN_CAMIF;
+			else
+				vfe_acquire.vfe_in.res_id =
+					CAM_ISP_HW_VFE_IN_LCR;
+			if (csid_res->is_dual_isp)
+				vfe_acquire.vfe_in.sync_mode =
+				CAM_ISP_HW_SYNC_MASTER;
+			else
+				vfe_acquire.vfe_in.sync_mode =
+				CAM_ISP_HW_SYNC_NONE;
+			vfe_acquire.vfe_in.is_dual = csid_res->is_dual_isp;
+
+			break;
+		case CAM_IFE_PIX_PATH_RES_PPP:
+			vfe_acquire.vfe_in.res_id =
+				CAM_ISP_HW_VFE_IN_PDLIB;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_0:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI0;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_1:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI1;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_2:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI2;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_IFE_PIX_PATH_RES_RDI_3:
+			vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_RDI3;
+			vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Wrong IFE CSID Path Resource ID : %d",
+				csid_res->res_id);
+			goto err;
+		}
+		ife_src_res->res_type = vfe_acquire.rsrc_type;
+		ife_src_res->res_id = vfe_acquire.vfe_in.res_id;
+		ife_src_res->is_dual_isp = csid_res->is_dual_isp;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!csid_res->hw_res[i])
+				continue;
+
+			hw_intf = ife_hw_mgr->ife_devices[
+				csid_res->hw_res[i]->hw_intf->hw_idx]->hw_intf;
+
+			if (i == CAM_ISP_HW_SPLIT_LEFT &&
+				ife_src_res->is_dual_isp) {
+				vfe_acquire.vfe_in.dual_hw_idx =
+					ife_ctx->slave_hw_idx;
+			}
+
+			/* fill in more acquire information as needed */
+			/* slave Camif resource, */
+			if (i == CAM_ISP_HW_SPLIT_RIGHT &&
+				ife_src_res->is_dual_isp) {
+				vfe_acquire.vfe_in.sync_mode =
+				CAM_ISP_HW_SYNC_SLAVE;
+				vfe_acquire.vfe_in.dual_hw_idx =
+					ife_ctx->master_hw_idx;
+			}
+
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&vfe_acquire,
+					sizeof(struct cam_vfe_acquire_args));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire IFE HW res %d",
+					csid_res->res_id);
+				goto err;
+			}
+			ife_src_res->hw_res[i] = vfe_acquire.vfe_in.rsrc_node;
+
+			*acquired_hw_id |=
+				cam_convert_hw_idx_to_ife_hw_num(
+				hw_intf->hw_idx);
+
+			if (i >= CAM_MAX_HW_SPLIT) {
+				CAM_ERR(CAM_ISP, "HW split is invalid: %d", i);
+				return -EINVAL;
+			}
+
+			acquired_hw_path[i] |= cam_convert_res_id_to_hw_path(
+				ife_src_res->hw_res[i]->res_id);
+
+			CAM_DBG(CAM_ISP,
+				"acquire success IFE:%d res type :0x%x res id:0x%x",
+				hw_intf->hw_idx,
+				ife_src_res->hw_res[i]->res_type,
+				ife_src_res->hw_res[i]->res_id);
+
+		}
+		csid_res->num_children++;
+	}
+
+	return 0;
+err:
+	/* release resource at the entry function */
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_csid_hw(
+	struct cam_ife_hw_mgr *ife_hw_mgr,
+	struct cam_csid_hw_reserve_resource_args  *csid_acquire,
+	bool is_start_lower_idx,
+	bool dynamic_rdi_alloc)
+{
+	int i;
+	int rc = -EINVAL;
+	struct cam_hw_intf  *hw_intf;
+	bool   try_again;
+	bool   is_rdi = false;
+	int    tries;
+	enum cam_ife_pix_path_res_id rdis[CAM_IFE_CSID_RDI_MAX];
+
+
+	if (!ife_hw_mgr || !csid_acquire) {
+		CAM_ERR(CAM_ISP,
+			"Invalid args ife hw mgr %pK csid_acquire %pK",
+			ife_hw_mgr, csid_acquire);
+		return -EINVAL;
+	}
+
+	tries = 0;
+	if (csid_acquire->res_id >= CAM_IFE_PIX_PATH_RES_RDI_0 &&
+		csid_acquire->res_id <= CAM_IFE_PIX_PATH_RES_RDI_3) {
+		rdis[tries++] = csid_acquire->res_id;
+		is_rdi = true;
+		for (i = CAM_IFE_PIX_PATH_RES_RDI_0;
+			i <= CAM_IFE_PIX_PATH_RES_RDI_3;
+			i++) {
+			if (i != csid_acquire->res_id)
+				rdis[tries++] = i;
+		}
+	}
+	tries = 0;
+
+	CAM_DBG(CAM_ISP, "Acquire CSID HW lower_idx: %d", is_start_lower_idx);
+	if (is_start_lower_idx) {
+		for (i =  0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+			if (!ife_hw_mgr->csid_devices[i])
+				continue;
+
+			hw_intf = ife_hw_mgr->csid_devices[i];
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				csid_acquire,
+				sizeof(struct
+					cam_csid_hw_reserve_resource_args));
+			if (!rc)
+				return rc;
+		}
+		return rc;
+	}
+
+	for (i = CAM_IFE_CSID_HW_NUM_MAX - 1; i >= 0; i--) {
+		if (!ife_hw_mgr->csid_devices[i])
+			continue;
+
+		try_again = true;
+		while (try_again) {
+			try_again = false;
+			if (is_rdi)
+				csid_acquire->res_id =  rdis[tries];
+			hw_intf = ife_hw_mgr->csid_devices[i];
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				csid_acquire,
+				sizeof(struct
+					cam_csid_hw_reserve_resource_args));
+				if (rc == -EAGAIN && is_rdi && dynamic_rdi_alloc &&
+				(tries < CAM_IFE_CSID_RDI_MAX-1)) {
+					try_again = true;
+					tries++;
+			} else if (!rc)
+				return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_attempt_reuse_cid_res(
+	struct cam_ife_hw_mgr_ctx          *ife_ctx,
+	struct cam_isp_hw_mgr_res          *cid_res_temp,
+	struct cam_csid_hw_reserve_resource_args  *csid_acquire,
+	uint32_t *acquired_cnt,
+	bool dynamic_rdi_alloc)
+{
+	struct cam_isp_hw_mgr_res            *cid_res_iterator;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_isp_in_port_generic_info  *in_port;
+	struct cam_isp_out_port_generic_info *out_port = NULL;
+	int rc = -1;
+	int i;
+	int try_again = true;
+	bool is_rdi = false;
+	int tries;
+	enum cam_ife_pix_path_res_id rdis[CAM_IFE_CSID_RDI_MAX];
+
+	in_port = csid_acquire->in_port;
+
+	if (in_port->num_out_res)
+		out_port = &(in_port->data[0]);
+
+	tries = 0;
+	if (csid_acquire->res_id >= CAM_IFE_PIX_PATH_RES_RDI_0 &&
+		csid_acquire->res_id <= CAM_IFE_PIX_PATH_RES_RDI_3) {
+		rdis[tries++] = csid_acquire->res_id;
+		is_rdi = true;
+		for (i = CAM_IFE_PIX_PATH_RES_RDI_0;
+			i <= CAM_IFE_PIX_PATH_RES_RDI_3;
+			i++) {
+			if (i != csid_acquire->res_id)
+				rdis[tries++] = i;
+		}
+	}
+
+	list_for_each_entry(cid_res_iterator, &ife_ctx->res_list_ife_cid,
+		list) {
+
+		tries = 0;
+		try_again = true;
+
+		while (try_again) {
+			try_again = false;
+
+			if (is_rdi)
+				csid_acquire->res_id = rdis[tries];
+
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!cid_res_iterator->hw_res[i])
+					continue;
+
+				if (in_port->num_out_res &&
+					((cid_res_iterator->is_secure == 1 &&
+					out_port->secure_mode == 0) ||
+					(cid_res_iterator->is_secure == 0 &&
+					out_port->secure_mode == 1)))
+					continue;
+
+				if (!in_port->num_out_res &&
+					cid_res_iterator->is_secure == 1)
+					continue;
+
+				hw_intf = cid_res_iterator->hw_res[i]->hw_intf;
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					csid_acquire, sizeof(*csid_acquire));
+
+				if (rc == -EAGAIN && is_rdi &&
+					dynamic_rdi_alloc &&
+					(tries < CAM_IFE_CSID_RDI_MAX-1)) {
+					try_again = true;
+					tries++;
+					break;
+				} else if (rc) {
+					CAM_DBG(CAM_ISP,
+						"No ife cid resource from hw %d",
+						hw_intf->hw_idx);
+					continue;
+				}
+
+				cid_res_temp->hw_res[(*acquired_cnt)++] =
+					csid_acquire->node_res;
+				CAM_DBG(CAM_ISP,
+					"acquired csid(%s)=%d CID rsrc successfully",
+					(i == 0) ? "left" : "right",
+					hw_intf->hw_idx);
+
+				if (csid_acquire->in_port->usage_type &&
+					*acquired_cnt == 1 &&
+					csid_acquire->res_id ==
+						CAM_IFE_PIX_PATH_RES_IPP)
+					/* Continue to acquire Right */
+					continue;
+
+				if (*acquired_cnt)
+					/*
+					 * If successfully acquired CID from
+					 * previously acquired HW, skip the next
+					 * part
+					 */
+					return 0;
+			}
+		}
+	}
+	return -EBUSY;
+}
+
+static int cam_ife_mgr_acquire_cid_res(
+	struct cam_ife_hw_mgr_ctx          *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	struct cam_isp_hw_mgr_res         **cid_res,
+	enum cam_ife_pix_path_res_id        *path_res_id)
+{
+	int rc = -1;
+	int j;
+	struct cam_ife_hw_mgr               *ife_hw_mgr;
+	struct cam_hw_intf                  *hw_intf;
+	struct cam_isp_hw_mgr_res           *cid_res_temp;
+	struct cam_csid_hw_reserve_resource_args  csid_acquire = {0};
+	uint32_t acquired_cnt = 0;
+	struct cam_isp_out_port_generic_info *out_port = NULL;
+	struct cam_ife_hw_mgr_ctx *ife_ctx_iterator;
+
+	ife_hw_mgr = ife_ctx->hw_mgr;
+	*cid_res = NULL;
+
+	rc = cam_ife_hw_mgr_get_res(&ife_ctx->free_res_list, cid_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+		goto end;
+	}
+
+	cid_res_temp = *cid_res;
+
+	csid_acquire.res_type = CAM_ISP_RESOURCE_CID;
+	csid_acquire.in_port = in_port;
+	csid_acquire.node_res = NULL;
+
+	if (ife_ctx->is_rdi_only_context)
+		csid_acquire.can_use_lite = true;
+
+	CAM_DBG(CAM_ISP, "path_res_id %d", path_res_id);
+
+	csid_acquire.res_id =  *path_res_id;
+
+	if (in_port->num_out_res)
+		out_port = &(in_port->data[0]);
+
+	if (ife_ctx->is_tpg) {
+		if (ife_ctx->res_list_tpg.hw_res[0]->hw_intf->hw_idx == 0)
+			csid_acquire.phy_sel = CAM_ISP_IFE_IN_RES_PHY_0;
+		else
+			csid_acquire.phy_sel = CAM_ISP_IFE_IN_RES_PHY_1;
+	}
+
+
+	/* Try acquiring CID resource from previously acquired HW in
+	   same context */
+	if (0 == cam_ife_mgr_attempt_reuse_cid_res(
+			ife_ctx, cid_res_temp, &csid_acquire,
+			&acquired_cnt, ife_ctx->dynamic_rdi_alloc))
+		goto acquire_successful;
+
+	/* Try acquiring CID resource from previously acquired HW from other
+	   used contexts */
+	if (ife_ctx->dynamic_rdi_alloc) {
+		list_for_each_entry(ife_ctx_iterator, &ife_hw_mgr->used_ctx_list,
+			list) {
+			if (0 == cam_ife_mgr_attempt_reuse_cid_res(
+					ife_ctx_iterator, cid_res_temp, &csid_acquire,
+					&acquired_cnt, ife_ctx->dynamic_rdi_alloc))
+					goto acquire_successful;
+		}
+	}
+
+	/* Acquire Left if not already acquired */
+	/* For dual IFE cases, start acquiring the lower idx first */
+	CAM_DBG(CAM_ISP, "acquire new rsrc fe: %d usage_type %d dsp %d rsrc %p",
+		ife_ctx->is_fe_enabled, in_port->usage_type,
+		ife_ctx->dsp_enabled, csid_acquire.node_res);
+
+	if (ife_ctx->is_fe_enabled ||
+		ife_ctx->dsp_enabled)
+		rc = cam_ife_hw_mgr_acquire_csid_hw(ife_hw_mgr,
+			&csid_acquire, true, ife_ctx->dynamic_rdi_alloc);
+	else
+		rc = cam_ife_hw_mgr_acquire_csid_hw(ife_hw_mgr,
+			&csid_acquire, false, ife_ctx->dynamic_rdi_alloc);
+
+	if (rc || !csid_acquire.node_res) {
+		CAM_ERR(CAM_ISP, "No %d paths available rc %d rsrc %p",
+			*path_res_id, rc, csid_acquire.node_res);
+		goto put_res;
+	}
+
+	if (in_port->usage_type)
+		cid_res_temp->hw_res[++acquired_cnt] = csid_acquire.node_res;
+	else
+		cid_res_temp->hw_res[acquired_cnt++] = csid_acquire.node_res;
+
+acquire_successful:
+	CAM_DBG(CAM_ISP, "CID %s acquired success is_dual %d",
+		(in_port->usage_type ? "Right" : " Left"),
+		in_port->usage_type);
+
+	*path_res_id = csid_acquire.res_id;
+	cid_res_temp->res_type = CAM_ISP_RESOURCE_CID;
+	/* CID(DT_ID) value of acquire device, require for path */
+	cid_res_temp->res_id = csid_acquire.node_res->res_id;
+	cid_res_temp->is_dual_isp = in_port->usage_type;
+	ife_ctx->is_dual = (bool)in_port->usage_type;
+	if (in_port->num_out_res)
+		cid_res_temp->is_secure = out_port->secure_mode;
+
+	cam_ife_hw_mgr_put_res(&ife_ctx->res_list_ife_cid, cid_res);
+
+	/*
+	 * Acquire left if not already acquired.
+	 * Dual IFE for RDI and PPP is not currently supported.
+	 */
+	if (cid_res_temp->is_dual_isp && *path_res_id
+		== CAM_IFE_PIX_PATH_RES_IPP && acquired_cnt == 1) {
+		csid_acquire.node_res = NULL;
+		csid_acquire.res_type = CAM_ISP_RESOURCE_CID;
+		csid_acquire.in_port = in_port;
+
+		if (ife_ctx->is_tpg) {
+			if (ife_ctx->res_list_tpg.hw_res[0]->hw_intf->hw_idx
+				== 0)
+				csid_acquire.phy_sel = CAM_ISP_IFE_IN_RES_PHY_0;
+			else
+				csid_acquire.phy_sel = CAM_ISP_IFE_IN_RES_PHY_1;
+		}
+
+		for (j = CAM_IFE_CSID_HW_NUM_MAX - 1; j >= 0; j--) {
+			if (!ife_hw_mgr->csid_devices[j])
+				continue;
+
+			if (j == cid_res_temp->hw_res[1]->hw_intf->hw_idx)
+				continue;
+
+			hw_intf = ife_hw_mgr->csid_devices[j];
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+			if (rc)
+				continue;
+			else
+				break;
+		}
+
+		if (j == -1 || !csid_acquire.node_res) {
+			CAM_ERR(CAM_ISP,
+				"Can not acquire ife csid dual resource");
+			goto end;
+		}
+		cid_res_temp->hw_res[0] = csid_acquire.node_res;
+		ife_ctx->slave_hw_idx =
+			cid_res_temp->hw_res[1]->hw_intf->hw_idx;
+		ife_ctx->master_hw_idx =
+			cid_res_temp->hw_res[0]->hw_intf->hw_idx;
+		CAM_DBG(CAM_ISP, "CID left acquired success is_dual %d [master %u: slave %u]",
+			in_port->usage_type,
+			ife_ctx->master_hw_idx,
+			ife_ctx->slave_hw_idx);
+	}
+
+	return 0;
+put_res:
+	cam_ife_hw_mgr_put_res(&ife_ctx->free_res_list, cid_res);
+end:
+	return rc;
+
+}
+
+static int cam_ife_hw_mgr_acquire_tpg(
+	struct cam_ife_hw_mgr_ctx               *ife_ctx,
+	struct cam_isp_in_port_generic_info     *in_port,
+	uint32_t                                 num_inport)
+{
+	int rc = -EINVAL;
+	uint32_t i;
+	struct cam_ife_hw_mgr *ife_hw_mgr;
+	struct cam_hw_intf *hw_intf;
+	struct cam_top_tpg_ver2_reserve_args tpg_reserve;
+
+	ife_hw_mgr = ife_ctx->hw_mgr;
+
+	for (i = 0; i < CAM_TOP_TPG_HW_NUM_MAX; i++) {
+		if (!ife_hw_mgr->tpg_devices[i])
+			continue;
+
+		hw_intf = ife_hw_mgr->tpg_devices[i];
+		tpg_reserve.num_inport = num_inport;
+		tpg_reserve.node_res = NULL;
+		tpg_reserve.in_port = in_port;
+
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&tpg_reserve, sizeof(tpg_reserve));
+		if (!rc)
+			break;
+	}
+
+	if (i == CAM_TOP_TPG_HW_NUM_MAX || !tpg_reserve.node_res) {
+		CAM_ERR(CAM_ISP, "Can not acquire IFE TPG");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ife_ctx->res_list_tpg.res_type = in_port->res_type;
+	ife_ctx->res_list_tpg.hw_res[0] = tpg_reserve.node_res;
+	ife_ctx->is_tpg = true;
+
+end:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_ife_csid_pxl(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool                                 is_ipp,
+	bool                                 crop_enable)
+{
+	int rc = -1;
+	int i;
+	int master_idx = -1;
+
+	struct cam_ife_hw_mgr                    *ife_hw_mgr;
+	struct cam_isp_hw_mgr_res                *csid_res;
+	struct cam_isp_hw_mgr_res                *cid_res;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_csid_hw_reserve_resource_args  csid_acquire;
+	enum cam_ife_pix_path_res_id              path_res_id;
+
+	ife_hw_mgr = ife_ctx->hw_mgr;
+	/* get cid resource */
+	if (is_ipp)
+		path_res_id = CAM_IFE_PIX_PATH_RES_IPP;
+	else
+		path_res_id = CAM_IFE_PIX_PATH_RES_PPP;
+
+	rc = cam_ife_mgr_acquire_cid_res(ife_ctx, in_port, &cid_res,
+		&path_res_id);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE CID resource Failed");
+		goto end;
+	}
+
+	rc = cam_ife_hw_mgr_get_res(&ife_ctx->free_res_list, &csid_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+		goto end;
+	}
+
+	csid_res->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+
+	csid_res->res_id = path_res_id;
+
+	if (in_port->usage_type && is_ipp)
+		csid_res->is_dual_isp = 1;
+	else {
+		csid_res->is_dual_isp = 0;
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID Acq: E");
+	/* IPP resource needs to be from same HW as CID resource */
+	for (i = 0; i <= csid_res->is_dual_isp; i++) {
+		CAM_DBG(CAM_ISP, "i %d is_dual %d", i, csid_res->is_dual_isp);
+
+		csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_acquire.res_id = path_res_id;
+		csid_acquire.cid = cid_res->hw_res[i]->res_id;
+		csid_acquire.in_port = in_port;
+		csid_acquire.out_port = in_port->data;
+		csid_acquire.node_res = NULL;
+		csid_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		csid_acquire.priv = ife_ctx;
+		csid_acquire.crop_enable = crop_enable;
+		csid_acquire.drop_enable = false;
+
+		hw_intf = cid_res->hw_res[i]->hw_intf;
+
+		if (csid_res->is_dual_isp) {
+			if (i == CAM_ISP_HW_SPLIT_LEFT) {
+				master_idx = hw_intf->hw_idx;
+				csid_acquire.sync_mode =
+					CAM_ISP_HW_SYNC_MASTER;
+			} else {
+				if (master_idx == -1) {
+					CAM_ERR(CAM_ISP,
+						"No Master found");
+					goto put_res;
+				}
+				csid_acquire.sync_mode =
+					CAM_ISP_HW_SYNC_SLAVE;
+				csid_acquire.master_idx = master_idx;
+			}
+		}
+
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&csid_acquire, sizeof(csid_acquire));
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Cannot acquire ife csid pxl path rsrc %s",
+				(is_ipp) ? "IPP" : "PPP");
+			goto put_res;
+		}
+
+		csid_res->hw_res[i] = csid_acquire.node_res;
+		CAM_DBG(CAM_ISP,
+			"acquired csid(%s)=%d pxl path rsrc %s successfully",
+			(i == 0) ? "left" : "right", hw_intf->hw_idx,
+			(is_ipp) ? "IPP" : "PPP");
+	}
+	cam_ife_hw_mgr_put_res(&ife_ctx->res_list_ife_csid, &csid_res);
+	cid_res->num_children++;
+
+	CAM_DBG(CAM_ISP, "acquire res %d CID children = %d",
+		csid_acquire.res_id, cid_res->num_children);
+
+	return 0;
+put_res:
+	cam_ife_hw_mgr_put_res(&ife_ctx->free_res_list, &csid_res);
+end:
+	return rc;
+}
+
+static enum cam_ife_pix_path_res_id
+	cam_ife_hw_mgr_get_ife_csid_rdi_res_type(
+	uint32_t                 out_port_type)
+{
+	enum cam_ife_pix_path_res_id path_id;
+	CAM_DBG(CAM_ISP, "out_port_type %x", out_port_type);
+
+	switch (out_port_type) {
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_0;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_1;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_2;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+		path_id = CAM_IFE_PIX_PATH_RES_RDI_3;
+		break;
+	default:
+		path_id = CAM_IFE_PIX_PATH_RES_MAX;
+		CAM_DBG(CAM_ISP, "maximum rdi output type exceeded");
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "out_port %x path_id %d", out_port_type, path_id);
+
+	return path_id;
+}
+
+static int cam_ife_hw_mgr_acquire_res_ife_csid_rdi(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t                            *acq_res_id)
+{
+	int rc = -EINVAL;
+	int i;
+
+	struct cam_ife_hw_mgr                 *ife_hw_mgr;
+	struct cam_isp_hw_mgr_res             *csid_res;
+	struct cam_isp_hw_mgr_res             *cid_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_isp_out_port_generic_info  *out_port;
+	struct cam_csid_hw_reserve_resource_args  csid_acquire;
+	enum cam_ife_pix_path_res_id         path_res_id;
+	enum cam_ife_pix_path_res_id         org_path_res_id;
+
+	ife_hw_mgr = ife_ctx->hw_mgr;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		path_res_id = cam_ife_hw_mgr_get_ife_csid_rdi_res_type(
+			out_port->res_type);
+		if (path_res_id == CAM_IFE_PIX_PATH_RES_MAX)
+			continue;
+
+		org_path_res_id = path_res_id;
+
+		/* get cid resource */
+		rc = cam_ife_mgr_acquire_cid_res(ife_ctx, in_port, &cid_res,
+			&path_res_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire IFE CID resource Failed");
+			goto end;
+		}
+
+		/* For each RDI we need CID + PATH resource */
+		rc = cam_ife_hw_mgr_get_res(&ife_ctx->free_res_list,
+			&csid_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+			goto end;
+		}
+
+		memset(&csid_acquire, 0, sizeof(csid_acquire));
+		csid_acquire.res_id = path_res_id;
+		csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_acquire.cid = cid_res->hw_res[0]->res_id;
+		csid_acquire.in_port = in_port;
+		csid_acquire.out_port = out_port;
+		csid_acquire.node_res = NULL;
+		csid_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+		csid_acquire.priv = ife_ctx;
+
+		/*
+		 * Enable RDI pixel drop by default. CSID will enable only for
+		 * ver 480 HW to allow userspace to control pixel drop pattern.
+		 */
+		csid_acquire.drop_enable = true;
+		csid_acquire.crop_enable = true;
+
+		if (in_port->usage_type)
+			csid_acquire.sync_mode = CAM_ISP_HW_SYNC_MASTER;
+		else
+			csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+		hw_intf = cid_res->hw_res[0]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&csid_acquire, sizeof(csid_acquire));
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"CSID Path reserve failed hw=%d rc=%d cid=%d",
+				hw_intf->hw_idx, rc,
+				cid_res->hw_res[0]->res_id);
+
+			goto put_res;
+		}
+
+		if (csid_acquire.node_res == NULL) {
+			CAM_ERR(CAM_ISP, "Acquire CSID RDI rsrc failed");
+
+			goto put_res;
+		}
+
+		csid_res->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_res->res_id = csid_acquire.res_id;
+		*acq_res_id |= ((uint32_t)csid_acquire.res_id) << ACQUIRED_IFE_RES_SHIFT(org_path_res_id);
+		csid_res->is_dual_isp = 0;
+		csid_res->hw_res[0] = csid_acquire.node_res;
+		csid_res->hw_res[1] = NULL;
+		cam_ife_hw_mgr_put_res(&ife_ctx->res_list_ife_csid, &csid_res);
+		cid_res->num_children++;
+	}
+
+	return 0;
+put_res:
+	cam_ife_hw_mgr_put_res(&ife_ctx->free_res_list, &csid_res);
+end:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_res_root(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	int rc = -1;
+
+	if (ife_ctx->res_list_ife_in.res_type == CAM_ISP_RESOURCE_UNINT) {
+		/* first acquire */
+		ife_ctx->res_list_ife_in.res_type = CAM_ISP_RESOURCE_SRC;
+		ife_ctx->res_list_ife_in.res_id = in_port->res_type;
+		ife_ctx->res_list_ife_in.is_dual_isp = in_port->usage_type;
+	} else if ((ife_ctx->res_list_ife_in.res_id !=
+		in_port->res_type) && (!ife_ctx->is_fe_enabled))  {
+		CAM_ERR(CAM_ISP, "No Free resource for this context");
+		goto err;
+	} else {
+		/* else do nothing */
+	}
+	return 0;
+err:
+	/* release resource in entry function */
+	return rc;
+}
+
+static int cam_ife_mgr_check_and_update_fe_v0(
+	struct cam_ife_hw_mgr_ctx         *ife_ctx,
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size)
+{
+	int i;
+	struct cam_isp_in_port_info       *in_port = NULL;
+	uint32_t                           in_port_length = 0;
+	uint32_t                           total_in_port_length = 0;
+
+	if (acquire_hw_info->input_info_offset >=
+		acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP,
+			"Invalid size offset 0x%x is greater then size 0x%x",
+			acquire_hw_info->input_info_offset,
+			acquire_hw_info->input_info_size);
+		return -EINVAL;
+	}
+
+	in_port = (struct cam_isp_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+
+		if (((uint8_t *)in_port +
+			sizeof(struct cam_isp_in_port_info)) >
+			((uint8_t *)acquire_hw_info +
+			acquire_info_size)) {
+			CAM_ERR(CAM_ISP, "Invalid size");
+			return -EINVAL;
+		}
+
+		if ((in_port->num_out_res > max_ife_out_res) ||
+			(in_port->num_out_res <= 0)) {
+			CAM_ERR(CAM_ISP, "Invalid num output res %u",
+				in_port->num_out_res);
+			return -EINVAL;
+		}
+
+		in_port_length = sizeof(struct cam_isp_in_port_info) +
+			(in_port->num_out_res - 1) *
+			sizeof(struct cam_isp_out_port_info);
+		total_in_port_length += in_port_length;
+
+		if (total_in_port_length > acquire_hw_info->input_info_size) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough");
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ISP, "in_port%d res_type %d", i,
+			in_port->res_type);
+		if (in_port->res_type == CAM_ISP_IFE_IN_RES_RD) {
+			ife_ctx->is_fe_enabled = true;
+			break;
+		}
+
+		in_port = (struct cam_isp_in_port_info *)((uint8_t *)in_port +
+			in_port_length);
+	}
+	CAM_DBG(CAM_ISP, "is_fe_enabled %d", ife_ctx->is_fe_enabled);
+
+	return 0;
+}
+
+static int cam_ife_mgr_check_and_update_fe_v2(
+	struct cam_ife_hw_mgr_ctx         *ife_ctx,
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size)
+{
+	int i;
+	struct cam_isp_in_port_info_v2    *in_port = NULL;
+	uint32_t                           in_port_length = 0;
+	uint32_t                           total_in_port_length = 0;
+
+	if (acquire_hw_info->input_info_offset >=
+		acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP,
+			"Invalid size offset 0x%x is greater then size 0x%x",
+			acquire_hw_info->input_info_offset,
+			acquire_hw_info->input_info_size);
+		return -EINVAL;
+	}
+
+	in_port = (struct cam_isp_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+
+		if (((uint8_t *)in_port +
+			sizeof(struct cam_isp_in_port_info)) >
+			((uint8_t *)acquire_hw_info +
+			acquire_info_size)) {
+			CAM_ERR(CAM_ISP, "Invalid size");
+			return -EINVAL;
+		}
+
+		if ((in_port->num_out_res > max_ife_out_res) ||
+			(in_port->num_out_res <= 0)) {
+			CAM_ERR(CAM_ISP, "Invalid num output res %u",
+				in_port->num_out_res);
+			return -EINVAL;
+		}
+
+		in_port_length = sizeof(struct cam_isp_in_port_info_v2) +
+			(in_port->num_out_res - 1) *
+			sizeof(struct cam_isp_out_port_info_v2);
+		total_in_port_length += in_port_length;
+
+		if (total_in_port_length > acquire_hw_info->input_info_size) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough");
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ISP, "in_port%d res_type %d", i,
+			in_port->res_type);
+		if (in_port->res_type == CAM_ISP_IFE_IN_RES_RD) {
+			ife_ctx->is_fe_enabled = true;
+			if (in_port->offline_mode)
+				ife_ctx->is_offline = true;
+			break;
+		}
+
+		in_port = (struct cam_isp_in_port_info_v2 *)
+			((uint8_t *)in_port + in_port_length);
+	}
+	CAM_DBG(CAM_ISP, "is_fe_enabled %d is_offline %d",
+		ife_ctx->is_fe_enabled, ife_ctx->is_offline);
+
+	return 0;
+}
+
+static int cam_ife_mgr_check_and_update_fe(
+	struct cam_ife_hw_mgr_ctx         *ife_ctx,
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size)
+{
+	uint32_t major_ver = 0, minor_ver = 0;
+
+	if (acquire_hw_info == NULL || ife_ctx == NULL)
+		return -EINVAL;
+
+	major_ver = (acquire_hw_info->common_info_version >> 12) & 0xF;
+	minor_ver = (acquire_hw_info->common_info_version) & 0xFFF;
+
+	switch (major_ver) {
+	case 1:
+		return cam_ife_mgr_check_and_update_fe_v0(
+			ife_ctx, acquire_hw_info, acquire_info_size);
+	case 2:
+		return cam_ife_mgr_check_and_update_fe_v2(
+			ife_ctx, acquire_hw_info, acquire_info_size);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid ver of common info from user");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_ife_mgr_get_dynamic_rdi_alloc(
+	struct cam_ife_hw_mgr_ctx      *ife_ctx,
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t acquire_info_size)
+{
+	struct cam_isp_in_port_info_v2 *in_port = NULL;
+
+	if (acquire_hw_info->input_info_offset >=
+		acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP,
+			"Invalid size offset 0x%x is greater than size 0x%x",
+			acquire_hw_info->input_info_offset,
+			acquire_hw_info->input_info_size);
+		return -EINVAL;
+	}
+
+	in_port = (struct cam_isp_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+
+	if (!ife_ctx->is_offline &&
+	    in_port->feature_flag & CAM_ISP_PARAM_DYNAMIC_RDI_EN)
+		ife_ctx->dynamic_rdi_alloc = true;
+
+	return 0;
+}
+
+static int cam_ife_mgr_set_dynamic_rdi_mask(
+	struct cam_ife_hw_mgr_ctx      *ife_ctx,
+	struct cam_isp_acquire_hw_info *acquire_hw_info)
+{
+	struct cam_isp_in_port_info_v2 *in_port = NULL;
+
+	if (acquire_hw_info->input_info_offset >=
+		acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP,
+			"Invalid size offset 0x%x is greater than size 0x%x",
+			acquire_hw_info->input_info_offset,
+			acquire_hw_info->input_info_size);
+		return -EINVAL;
+	}
+
+	in_port = (struct cam_isp_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+
+	in_port->dynamic_rdi_rsrc_mask = ife_ctx->dynamic_rdi_mask;
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_preprocess_port(
+	struct cam_ife_hw_mgr_ctx   *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	uint32_t i;
+	struct cam_isp_out_port_generic_info *out_port;
+	struct cam_ife_hw_mgr *ife_hw_mgr;
+
+	ife_hw_mgr = ife_ctx->hw_mgr;
+
+	if (in_port->res_type == CAM_ISP_IFE_IN_RES_RD)
+		in_port->ife_rd_count++;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		if (cam_ife_hw_mgr_is_rdi_res(out_port->res_type))
+			in_port->rdi_count++;
+		else if (out_port->res_type == CAM_ISP_IFE_OUT_RES_2PD)
+			in_port->ppp_count++;
+		else if (out_port->res_type == CAM_ISP_IFE_OUT_RES_LCR)
+			in_port->lcr_count++;
+		else {
+			CAM_DBG(CAM_ISP, "out_res_type %d",
+			out_port->res_type);
+			in_port->ipp_count++;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "rdi: %d ipp: %d ppp: %d ife_rd: %d lcr: %d",
+		in_port->rdi_count, in_port->ipp_count,
+		in_port->ppp_count, in_port->ife_rd_count,
+		in_port->lcr_count);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_acquire_res_ife_bus_rd(
+	struct cam_ife_hw_mgr_ctx                  *ife_ctx,
+	struct cam_isp_in_port_generic_info        *in_port)
+{
+	int                                         rc = -EINVAL, j;
+	int                                         i = CAM_ISP_HW_SPLIT_LEFT;
+	struct cam_vfe_acquire_args                 vfe_acquire;
+	struct cam_isp_hw_mgr_res                  *ife_bus_rd_res;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_ife_hw_mgr                      *ife_hw_mgr;
+
+	ife_hw_mgr = ife_ctx->hw_mgr;
+
+	rc = cam_ife_hw_mgr_get_res(&ife_ctx->free_res_list, &ife_bus_rd_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+		goto end;
+	}
+
+	vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_BUS_RD;
+	vfe_acquire.tasklet = ife_ctx->common.tasklet_info;
+	vfe_acquire.priv = ife_ctx;
+	vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+
+	vfe_acquire.vfe_bus_rd.cdm_ops = ife_ctx->cdm_ops;
+	vfe_acquire.vfe_bus_rd.is_dual = (uint32_t)ife_ctx->is_dual;
+	vfe_acquire.vfe_bus_rd.is_offline = ife_ctx->is_offline;
+	vfe_acquire.vfe_bus_rd.res_id = CAM_ISP_HW_VFE_IN_RD;
+	vfe_acquire.vfe_bus_rd.unpacker_fmt = in_port->fe_unpacker_fmt;
+
+	for (j = 0; j < CAM_IFE_HW_NUM_MAX; j++) {
+		if (!ife_hw_mgr->ife_devices[j])
+			continue;
+
+		hw_intf = ife_hw_mgr->ife_devices[j]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&vfe_acquire, sizeof(struct cam_vfe_acquire_args));
+
+		if (!rc) {
+			ife_bus_rd_res->hw_res[i] =
+				vfe_acquire.vfe_bus_rd.rsrc_node;
+
+			CAM_DBG(CAM_ISP, "Acquired VFE:%d BUS RD for LEFT", j);
+			break;
+		}
+	}
+
+	if (j == CAM_IFE_HW_NUM_MAX || !vfe_acquire.vfe_bus_rd.rsrc_node) {
+		CAM_ERR(CAM_ISP, "Failed to acquire VFE:%d BUS RD for LEFT, ctx_idx: %u",
+			j, ife_ctx->ctx_index);
+		goto put_res;
+	}
+
+	ife_bus_rd_res->res_type = vfe_acquire.rsrc_type;
+	ife_bus_rd_res->res_id = vfe_acquire.vfe_in.res_id;
+	ife_bus_rd_res->is_dual_isp = (uint32_t)ife_ctx->is_dual;
+	cam_ife_hw_mgr_put_res(&ife_ctx->res_list_ife_in_rd, &ife_bus_rd_res);
+
+	if (ife_ctx->is_dual) {
+		for (j = 0; j < CAM_IFE_HW_NUM_MAX; j++) {
+			if (!ife_hw_mgr->ife_devices[j])
+				continue;
+
+			if (j == ife_bus_rd_res->hw_res[i]->hw_intf->hw_idx)
+				continue;
+
+			hw_intf = ife_hw_mgr->ife_devices[j]->hw_intf;
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&vfe_acquire,
+				sizeof(struct cam_vfe_acquire_args));
+
+			if (!rc) {
+				ife_bus_rd_res->hw_res[++i] =
+					vfe_acquire.vfe_bus_rd.rsrc_node;
+
+				CAM_DBG(CAM_ISP,
+					"Acquired VFE:%d BUS RD for RIGHT", j);
+				break;
+			}
+		}
+
+		if (j == CAM_IFE_HW_NUM_MAX ||
+			!vfe_acquire.vfe_bus_rd.rsrc_node) {
+			CAM_ERR(CAM_ISP, "Failed to acquire BUS RD for RIGHT");
+			goto end;
+		}
+	}
+
+	return 0;
+
+put_res:
+	cam_ife_hw_mgr_put_res(&ife_ctx->free_res_list, &ife_bus_rd_res);
+
+end:
+	return rc;
+}
+
+static int cam_ife_hw_mgr_acquire_offline_res_ife_camif(
+	struct cam_ife_hw_mgr_ctx                  *ife_ctx,
+	struct cam_isp_in_port_generic_info        *in_port,
+	bool                                        acquire_lcr,
+	uint32_t                                   *acquired_hw_id,
+	uint32_t                                   *acquired_hw_path)
+{
+	int                                         rc = -1;
+	int                                         i = CAM_ISP_HW_SPLIT_LEFT;
+	struct cam_isp_hw_mgr_res                  *ife_src_res;
+	struct cam_isp_hw_mgr_res                  *ife_bus_rd_res;
+	struct cam_vfe_acquire_args                 vfe_acquire;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_ife_hw_mgr                      *ife_hw_mgr;
+
+	ife_hw_mgr = ife_ctx->hw_mgr;
+
+	ife_bus_rd_res = list_first_entry(&ife_ctx->res_list_ife_in_rd,
+		struct cam_isp_hw_mgr_res, list);
+
+	if (!ife_bus_rd_res) {
+		CAM_ERR(CAM_ISP, "BUS RD resource has not been acquired");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_ife_hw_mgr_get_res(&ife_ctx->free_res_list, &ife_src_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No free resource");
+		goto end;
+	}
+
+	vfe_acquire.rsrc_type = CAM_ISP_RESOURCE_VFE_IN;
+	vfe_acquire.tasklet = ife_ctx->common.tasklet_info;
+	vfe_acquire.priv = ife_ctx;
+	vfe_acquire.event_cb = cam_ife_hw_mgr_event_handler;
+
+	vfe_acquire.vfe_in.cdm_ops = ife_ctx->cdm_ops;
+	vfe_acquire.vfe_in.in_port = in_port;
+	vfe_acquire.vfe_in.is_fe_enabled = ife_ctx->is_fe_enabled;
+	vfe_acquire.vfe_in.is_offline = ife_ctx->is_offline;
+
+	if (!acquire_lcr)
+		vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_CAMIF;
+	else
+		vfe_acquire.vfe_in.res_id = CAM_ISP_HW_VFE_IN_LCR;
+
+	if (ife_ctx->is_dual)
+		vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_MASTER;
+	else
+		vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+	hw_intf = ife_hw_mgr->ife_devices[
+		ife_bus_rd_res->hw_res[i]->hw_intf->hw_idx]->hw_intf;
+
+	rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv, &vfe_acquire,
+		sizeof(struct cam_vfe_acquire_args));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to acquire CAMIF for LEFT");
+		goto put_res;
+	}
+
+	ife_src_res->hw_res[i] = vfe_acquire.vfe_in.rsrc_node;
+
+	*acquired_hw_id |= cam_convert_hw_idx_to_ife_hw_num(
+		hw_intf->hw_idx);
+
+	acquired_hw_path[i] |= cam_convert_res_id_to_hw_path(
+		ife_src_res->hw_res[i]->res_id);
+
+	CAM_DBG(CAM_ISP, "Acquired VFE:%d CAMIF for LEFT",
+		ife_src_res->hw_res[i]->hw_intf->hw_idx);
+
+	ife_src_res->res_type = vfe_acquire.rsrc_type;
+	ife_src_res->res_id = vfe_acquire.vfe_in.res_id;
+	ife_src_res->is_dual_isp = (uint32_t)ife_ctx->is_dual;
+	cam_ife_hw_mgr_put_res(&ife_ctx->res_list_ife_src, &ife_src_res);
+
+	if (ife_ctx->is_dual) {
+		vfe_acquire.vfe_in.sync_mode = CAM_ISP_HW_SYNC_SLAVE;
+
+		hw_intf = ife_hw_mgr->ife_devices[
+			ife_bus_rd_res->hw_res[++i]->hw_intf->hw_idx]->hw_intf;
+
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv, &vfe_acquire,
+			sizeof(struct cam_vfe_acquire_args));
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to acquire CAMIF for RIGHT");
+			goto end;
+		}
+
+		ife_src_res->hw_res[i] = vfe_acquire.vfe_in.rsrc_node;
+
+		*acquired_hw_id |= cam_convert_hw_idx_to_ife_hw_num(
+			hw_intf->hw_idx);
+
+		acquired_hw_path[i] |= cam_convert_res_id_to_hw_path(
+			ife_src_res->hw_res[i]->res_id);
+
+		CAM_DBG(CAM_ISP, "Acquired VFE:%d CAMIF for RIGHT",
+			ife_src_res->hw_res[i]->hw_intf->hw_idx);
+	}
+
+	ife_bus_rd_res->num_children++;
+
+	return rc;
+
+put_res:
+	cam_ife_hw_mgr_put_res(&ife_ctx->free_res_list, &ife_src_res);
+
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_acquire_hw_for_offline_ctx(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t                            *acquired_hw_id,
+	uint32_t                            *acquired_hw_path)
+{
+	int                                  rc = -1;
+
+	ife_ctx->is_dual = (bool)in_port->usage_type;
+
+	if ((!in_port->ipp_count && !in_port->lcr_count) ||
+		!in_port->ife_rd_count) {
+		CAM_ERR(CAM_ISP,
+			"Invalid %d BUS RD %d PIX %d LCR ports for FE ctx: %u",
+			in_port->ife_rd_count, in_port->ipp_count, in_port->lcr_count,
+			ife_ctx->ctx_index);
+		return -EINVAL;
+	}
+
+	if (in_port->rdi_count || in_port->ppp_count) {
+		CAM_ERR(CAM_ISP,
+			"%d RDI %d PPP ports invalid for FE ctx",
+			in_port->rdi_count, in_port->ppp_count);
+		return -EINVAL;
+	}
+
+	rc = cam_ife_hw_mgr_acquire_res_ife_bus_rd(ife_ctx, in_port);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE BUS RD resource Failed");
+		goto err;
+	}
+
+	if (in_port->ipp_count)
+		rc = cam_ife_hw_mgr_acquire_offline_res_ife_camif(ife_ctx,
+			in_port, false, acquired_hw_id, acquired_hw_path);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE IPP SRC resource Failed");
+		goto err;
+	}
+
+	if (in_port->lcr_count)
+		rc = cam_ife_hw_mgr_acquire_offline_res_ife_camif(ife_ctx,
+			in_port, true, acquired_hw_id, acquired_hw_path);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE LCR SRC resource Failed");
+		goto err;
+	}
+
+	rc = cam_ife_hw_mgr_acquire_res_ife_out(ife_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE OUT resource Failed");
+		goto err;
+	}
+
+	return 0;
+
+err:
+	return rc;
+}
+
+
+static int cam_ife_mgr_acquire_hw_for_ctx(
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t *acquired_hw_id,
+	uint32_t *acquired_hw_path)
+{
+	int rc                                    = -1;
+	int is_dual_isp                           = 0;
+	bool crop_enable                          = true;
+	uint32_t acq_res_id                       = 0;
+
+	ife_ctx->dynamic_rdi_mask = 0;
+	is_dual_isp = in_port->usage_type;
+	ife_ctx->dsp_enabled = (bool)in_port->dsp_mode;
+	ife_ctx->is_dual = (bool)in_port->usage_type;
+
+	/* get root node resource */
+	rc = cam_ife_hw_mgr_acquire_res_root(ife_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Can not acquire root resource");
+		goto err;
+	}
+
+	if (!in_port->ipp_count && !in_port->rdi_count &&
+		!in_port->ppp_count && !in_port->lcr_count) {
+		CAM_ERR(CAM_ISP,
+			"No PIX or RDI or PPP or LCR resource");
+		return -EINVAL;
+	}
+
+	if (in_port->ife_rd_count) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_bus_rd(ife_ctx, in_port);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire IFE BUS RD resource Failed");
+			goto err;
+		}
+	}
+
+	if (in_port->ipp_count || in_port->lcr_count) {
+		/* get ife csid IPP resource */
+		rc = cam_ife_hw_mgr_acquire_res_ife_csid_pxl(ife_ctx,
+			in_port, true, crop_enable);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE CSID IPP/LCR resource Failed");
+			goto err;
+		}
+	}
+
+	if (in_port->rdi_count) {
+		/* get ife csid RDI resource */
+		rc = cam_ife_hw_mgr_acquire_res_ife_csid_rdi(ife_ctx, in_port, &acq_res_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE CSID RDI resource Failed");
+			goto err;
+		}
+	}
+
+	if (in_port->ppp_count) {
+		/* get ife csid PPP resource */
+
+		/* If both IPP and PPP paths are requested with the same vc dt
+		 * it is implied that the sensor is a type 3 PD sensor. Crop
+		 * must be enabled for this sensor on PPP path as well.
+		 */
+		if (!in_port->ipp_count)
+			crop_enable = false;
+
+		rc = cam_ife_hw_mgr_acquire_res_ife_csid_pxl(ife_ctx,
+			in_port, false, crop_enable);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE CSID PPP resource Failed");
+			goto err;
+		}
+	}
+
+	/* get ife src resource */
+	if (in_port->ipp_count || in_port->ppp_count || in_port->rdi_count) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx,
+			in_port, false,
+			acquired_hw_id, acquired_hw_path);
+
+		ife_ctx->dynamic_rdi_mask |= (acquired_hw_path[0] | acq_res_id);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire IFE IPP/PPP SRC resource Failed");
+			goto err;
+		}
+	}
+
+	if (in_port->lcr_count) {
+		rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx, in_port, true,
+		acquired_hw_id, acquired_hw_path);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Acquire IFE LCR SRC resource Failed");
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Acquiring IFE OUT resource...");
+	rc = cam_ife_hw_mgr_acquire_res_ife_out(ife_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire IFE OUT resource Failed");
+		goto err;
+	}
+
+	return 0;
+err:
+	/* release resource at the acquire entry funciton */
+	return rc;
+}
+
+static void cam_ife_cam_cdm_callback(uint32_t handle, void *userdata,
+	enum cam_cdm_cb_status status, uint64_t cookie)
+{
+	struct cam_isp_prepare_hw_update_data   *hw_update_data = NULL;
+	struct cam_ife_hw_mgr_ctx               *ctx = NULL;
+	int                                      reg_dump_done;
+
+	if (!userdata) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return;
+	}
+
+	hw_update_data = (struct cam_isp_prepare_hw_update_data *)userdata;
+	ctx = (struct cam_ife_hw_mgr_ctx *)hw_update_data->isp_mgr_ctx;
+
+	if (status == CAM_CDM_CB_STATUS_BL_SUCCESS) {
+		complete_all(&ctx->config_done_complete);
+		reg_dump_done = atomic_read(&ctx->cdm_done);
+		atomic_set(&ctx->cdm_done, 1);
+		ctx->last_cdm_done_req = cookie;
+		if ((g_ife_hw_mgr.debug_cfg.per_req_reg_dump) &&
+			(!reg_dump_done))
+			cam_ife_mgr_handle_reg_dump(ctx,
+				hw_update_data->reg_dump_buf_desc,
+				hw_update_data->num_reg_dump_buf,
+				CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST,
+				NULL, false);
+
+		CAM_DBG(CAM_ISP,
+			"Called by CDM hdl=0x%x, udata=%pK, status=%d, cookie=%llu ctx_index=%d",
+			 handle, userdata, status, cookie, ctx->ctx_index);
+	} else {
+		CAM_WARN(CAM_ISP,
+			"Called by CDM hdl=0x%x, udata=%pK, status=%d, cookie=%llu",
+			 handle, userdata, status, cookie);
+	}
+}
+
+static int cam_ife_mgr_acquire_get_unified_structure_v0(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	struct cam_isp_in_port_info *in = NULL;
+	uint32_t in_port_length = 0;
+	int32_t rc = 0, i;
+
+	in = (struct cam_isp_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset + *input_size);
+
+	in_port_length = sizeof(struct cam_isp_in_port_info) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_isp_out_port_info);
+
+	*input_size += in_port_length;
+
+	if (!in_port || ((*input_size) > acquire_hw_info->input_info_size)) {
+		CAM_ERR(CAM_ISP, "Input is not proper");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	in_port->major_ver       =
+		(acquire_hw_info->input_info_version >> 16) & 0xFFFF;
+	in_port->minor_ver       =
+		acquire_hw_info->input_info_version & 0xFFFF;
+	in_port->res_type        =  in->res_type;
+	in_port->lane_type       =  in->lane_type;
+	in_port->lane_num        =  in->lane_num;
+	in_port->lane_cfg        =  in->lane_cfg;
+	in_port->vc[0]           =  in->vc;
+	in_port->dt[0]           =  in->dt;
+	in_port->num_valid_vc_dt = 1;
+	in_port->format          =  in->format;
+	in_port->test_pattern    =  in->test_pattern;
+	in_port->usage_type      =  in->usage_type;
+	in_port->left_start      =  in->left_start;
+	in_port->left_stop       =  in->left_stop;
+	in_port->left_width      =  in->left_width;
+	in_port->right_start     =  in->right_start;
+	in_port->right_stop      =  in->right_stop;
+	in_port->right_width     =  in->right_width;
+	in_port->line_start      =  in->line_start;
+	in_port->line_stop       =  in->line_stop;
+	in_port->height          =  in->height;
+	in_port->pixel_clk       =  in->pixel_clk;
+	in_port->batch_size      =  in->batch_size;
+	in_port->dsp_mode        =  in->dsp_mode;
+	in_port->hbi_cnt         =  in->hbi_cnt;
+	in_port->cust_node       =  0;
+	in_port->horizontal_bin  =  0;
+	in_port->qcfa_bin        =  0;
+	in_port->num_out_res     =  in->num_out_res;
+
+	in_port->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_out_port_generic_info),
+		GFP_KERNEL);
+	if (in_port->data == NULL) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < in->num_out_res; i++) {
+		in_port->data[i].res_type     = in->data_flex[i].res_type;
+		in_port->data[i].format       = in->data_flex[i].format;
+		in_port->data[i].width        = in->data_flex[i].width;
+		in_port->data[i].height       = in->data_flex[i].height;
+		in_port->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		in_port->data[i].split_point  = in->data_flex[i].split_point;
+		in_port->data[i].secure_mode  = in->data_flex[i].secure_mode;
+		in_port->data[i].reserved     = in->data_flex[i].reserved;
+	}
+
+	return 0;
+err:
+	return rc;
+}
+
+static int cam_ife_mgr_acquire_get_unified_structure_v2(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	struct cam_isp_in_port_info_v2 *in = NULL;
+	uint32_t in_port_length = 0;
+	int32_t rc = 0, i;
+
+	in = (struct cam_isp_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset + *input_size);
+
+	in_port_length = sizeof(struct cam_isp_in_port_info_v2) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_isp_out_port_info_v2);
+
+	*input_size += in_port_length;
+
+	if (!in_port || ((*input_size) > acquire_hw_info->input_info_size)) {
+		CAM_ERR(CAM_ISP, "Input is not proper");
+		rc = -EINVAL;
+		goto err;
+	}
+
+	in_port->major_ver       =
+		(acquire_hw_info->input_info_version >> 16) & 0xFFFF;
+	in_port->minor_ver       =
+		acquire_hw_info->input_info_version & 0xFFFF;
+	in_port->res_type        =  in->res_type;
+	in_port->lane_type       =  in->lane_type;
+	in_port->lane_num        =  in->lane_num;
+	in_port->lane_cfg        =  in->lane_cfg;
+	in_port->num_valid_vc_dt =  in->num_valid_vc_dt;
+
+	if (in_port->num_valid_vc_dt == 0 ||
+		in_port->num_valid_vc_dt >= CAM_ISP_VC_DT_CFG) {
+		if (in->res_type != CAM_ISP_IFE_IN_RES_RD) {
+			CAM_ERR(CAM_ISP, "Invalid i/p arg invalid vc-dt: %d",
+				in->num_valid_vc_dt);
+			rc = -EINVAL;
+			goto err;
+		}
+	}
+
+	for (i = 0; i < in_port->num_valid_vc_dt; i++) {
+		in_port->vc[i]      =  in->vc[i];
+		in_port->dt[i]      =  in->dt[i];
+	}
+
+	in_port->format          =  in->format;
+	in_port->test_pattern    =  in->test_pattern;
+	in_port->usage_type      =  in->usage_type;
+	in_port->left_start      =  in->left_start;
+	in_port->left_stop       =  in->left_stop;
+	in_port->left_width      =  in->left_width;
+	in_port->right_start     =  in->right_start;
+	in_port->right_stop      =  in->right_stop;
+	in_port->right_width     =  in->right_width;
+	in_port->line_start      =  in->line_start;
+	in_port->line_stop       =  in->line_stop;
+	in_port->height          =  in->height;
+	in_port->pixel_clk       =  in->pixel_clk;
+	in_port->batch_size      =  in->batch_size;
+	in_port->dsp_mode        =  in->dsp_mode;
+	in_port->fe_unpacker_fmt =  in->format;
+	in_port->hbi_cnt         =  in->hbi_cnt;
+	in_port->cust_node       =  in->cust_node;
+	in_port->horizontal_bin  =  in->horizontal_bin;
+	in_port->qcfa_bin        =  in->qcfa_bin;
+	in_port->num_out_res     =  in->num_out_res;
+
+	in_port->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_out_port_generic_info),
+		GFP_KERNEL);
+	if (in_port->data == NULL) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		in_port->data[i].res_type     = in->data_flex[i].res_type;
+		in_port->data[i].format       = in->data_flex[i].format;
+		in_port->data[i].width        = in->data_flex[i].width;
+		in_port->data[i].height       = in->data_flex[i].height;
+		in_port->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		in_port->data[i].split_point  = in->data_flex[i].split_point;
+		in_port->data[i].secure_mode  = in->data_flex[i].secure_mode;
+	}
+
+	return 0;
+
+err:
+	return rc;
+}
+
+static int cam_ife_mgr_acquire_get_unified_structure(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info *in_port)
+{
+	uint32_t major_ver = 0, minor_ver = 0;
+
+	if (acquire_hw_info == NULL || input_size == NULL)
+		return -EINVAL;
+
+	major_ver = (acquire_hw_info->common_info_version >> 12) & 0xF;
+	minor_ver = (acquire_hw_info->common_info_version) & 0xFFF;
+
+	switch (major_ver) {
+	case 1:
+		return cam_ife_mgr_acquire_get_unified_structure_v0(
+			acquire_hw_info, offset, input_size, in_port);
+	case 2:
+		return cam_ife_mgr_acquire_get_unified_structure_v2(
+			acquire_hw_info, offset, input_size, in_port);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid ver of i/p port info from user");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/* entry function: acquire_hw */
+static int cam_ife_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	struct cam_ife_hw_mgr *ife_hw_mgr            = hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -1;
+	int i, j;
+	struct cam_ife_hw_mgr_ctx         *ife_ctx;
+	struct cam_isp_in_port_generic_info   *in_port = NULL;
+	struct cam_cdm_acquire_data        cdm_acquire;
+	uint32_t                           total_pix_port = 0;
+	uint32_t                           total_rdi_port = 0;
+	uint32_t                           total_pd_port = 0;
+	struct cam_isp_acquire_hw_info    *acquire_hw_info = NULL;
+	uint32_t                           input_size = 0;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	/* get the ife ctx */
+	rc = cam_ife_hw_mgr_get_ctx(&ife_hw_mgr->free_ctx_list, &ife_ctx);
+	if (rc || !ife_ctx) {
+		CAM_ERR(CAM_ISP, "Get ife hw context failed");
+		goto err;
+	}
+
+	ife_ctx->custom_enabled = false;
+	ife_ctx->custom_config = 0;
+	ife_ctx->cdm_handle = 0;
+	ife_ctx->common.cb_priv = acquire_args->context_data;
+	ife_ctx->internal_cdm = false;
+	ife_ctx->common.event_cb = acquire_args->event_cb;
+
+	ife_ctx->hw_mgr = ife_hw_mgr;
+	ife_ctx->cdm_ops =  cam_cdm_publish_ops();
+
+	acquire_hw_info =
+		(struct cam_isp_acquire_hw_info *)acquire_args->acquire_info;
+
+	rc = cam_ife_mgr_check_and_update_fe(ife_ctx, acquire_hw_info,
+		acquire_args->acquire_info_size);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "buffer size is not enough");
+		goto free_ctx;
+	}
+
+	cam_ife_mgr_get_dynamic_rdi_alloc(ife_ctx, acquire_hw_info,
+			acquire_args->acquire_info_size);
+
+	in_port = kcalloc(acquire_hw_info->num_inputs,
+			sizeof(struct cam_isp_in_port_generic_info),
+			GFP_KERNEL);
+
+	if (!in_port) {
+		CAM_ERR(CAM_ISP, "No memory available");
+		rc = -ENOMEM;
+		goto free_ctx;
+	}
+
+	/* Update in_port structure */
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		rc = cam_ife_mgr_acquire_get_unified_structure(acquire_hw_info,
+			i, &input_size, &in_port[i]);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Failed in parsing: %d", rc);
+			goto free_mem;
+		}
+		CAM_DBG(CAM_ISP, "in_res_type %x", in_port->res_type);
+
+		cam_ife_hw_mgr_preprocess_port(ife_ctx, &in_port[i]);
+		total_pix_port += in_port[i].ipp_count +
+					in_port[i].ife_rd_count +
+					in_port[i].lcr_count;
+		total_rdi_port += in_port[i].rdi_count;
+		total_pd_port += in_port[i].ppp_count;
+	}
+
+	/* Check whether context has only RDI resource */
+	if (!total_pix_port && !total_pd_port) {
+		ife_ctx->is_rdi_only_context = 1;
+		CAM_DBG(CAM_ISP, "RDI only context");
+	}
+
+	/* acquire HW resources */
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		CAM_DBG(CAM_ISP, "in_res_type %x", in_port[i].res_type);
+
+		if ((in_port[i].cust_node) && (!ife_ctx->custom_enabled)) {
+			ife_ctx->custom_enabled = true;
+			/* These can be obtained from uapi */
+			ife_ctx->custom_config |=
+				CAM_IFE_CUSTOM_CFG_FRAME_HEADER_TS;
+			ife_ctx->custom_config |=
+				CAM_IFE_CUSTOM_CFG_SW_SYNC_ON;
+		}
+
+		if ((in_port[i].res_type == CAM_ISP_IFE_IN_RES_CPHY_TPG_0) ||
+			(in_port[i].res_type == CAM_ISP_IFE_IN_RES_CPHY_TPG_1) ||
+			(in_port[i].res_type == CAM_ISP_IFE_IN_RES_CPHY_TPG_2))
+			rc  = cam_ife_hw_mgr_acquire_tpg(ife_ctx, &in_port[i],
+				acquire_hw_info->num_inputs);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "can not acquire TPG resource");
+			goto free_res;
+		}
+
+		if (ife_ctx->is_offline)
+			rc = cam_ife_mgr_acquire_hw_for_offline_ctx(
+				ife_ctx, &in_port[i],
+				&acquire_args->acquired_hw_id[i],
+				acquire_args->acquired_hw_path[i]);
+		else {
+			rc = cam_ife_mgr_acquire_hw_for_ctx(ife_ctx,
+				&in_port[i],
+				&acquire_args->acquired_hw_id[i],
+				acquire_args->acquired_hw_path[i]);
+
+			if (ife_ctx->dynamic_rdi_alloc)
+				cam_ife_mgr_set_dynamic_rdi_mask(ife_ctx,
+						acquire_hw_info);
+		}
+
+		if (rc) {
+			cam_ife_hw_mgr_print_acquire_info(ife_ctx,
+				(in_port[i].ipp_count +
+				in_port[i].ife_rd_count +
+				in_port[i].lcr_count),
+				in_port[i].ppp_count,
+				in_port[i].rdi_count, rc);
+			goto free_res;
+		}
+
+		kfree(in_port[i].data);
+		in_port[i].data = NULL;
+	}
+
+	kfree(in_port);
+	in_port = NULL;
+
+	/* Process base info */
+	rc = cam_ife_mgr_process_base_info(ife_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Process base info failed");
+		goto free_res;
+	}
+
+	cam_cpas_get_cpas_hw_version(&ife_ctx->hw_version);
+	if (ife_ctx->is_dual)
+		memcpy(cdm_acquire.identifier, "dualife", sizeof("dualife"));
+	else
+		memcpy(cdm_acquire.identifier, "ife", sizeof("ife"));
+
+	if (ife_ctx->is_dual)
+		cdm_acquire.cell_index = ife_ctx->master_hw_idx;
+	else
+		cdm_acquire.cell_index = ife_ctx->base[0].idx;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = ife_ctx;
+	cdm_acquire.base_array_cnt = CAM_IFE_HW_NUM_MAX;
+	for (i = 0, j = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (ife_hw_mgr->cdm_reg_map[i])
+			cdm_acquire.base_array[j++] =
+				ife_hw_mgr->cdm_reg_map[i];
+	}
+	cdm_acquire.base_array_cnt = j;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.cam_cdm_callback = cam_ife_cam_cdm_callback;
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to acquire the CDM HW");
+		goto free_res;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Successfully acquired CDM Id: %d, CDM HW hdl=%x, is_dual=%d",
+		cdm_acquire.id, cdm_acquire.handle, ife_ctx->is_dual);
+	ife_ctx->cdm_handle = cdm_acquire.handle;
+	ife_ctx->cdm_id = cdm_acquire.id;
+	if (cdm_acquire.id == CAM_CDM_IFE)
+		ife_ctx->internal_cdm = true;
+	atomic_set(&ife_ctx->cdm_done, 1);
+	ife_ctx->last_cdm_done_req = 0;
+
+	acquire_args->support_consumed_addr =
+		g_ife_hw_mgr.support_consumed_addr;
+
+	acquire_args->ctxt_to_hw_map = ife_ctx;
+	acquire_args->custom_enabled = ife_ctx->custom_enabled;
+	acquire_args->use_frame_header_ts =
+		(ife_ctx->custom_config & CAM_IFE_CUSTOM_CFG_FRAME_HEADER_TS);
+	ife_ctx->ctx_in_use = 1;
+	ife_ctx->num_reg_dump_buf = 0;
+
+	acquire_args->valid_acquired_hw =
+		acquire_hw_info->num_inputs;
+
+	ktime_get_real_ts64(&ife_ctx->ts);
+
+	cam_ife_hw_mgr_print_acquire_info(ife_ctx, total_pix_port,
+		total_pd_port, total_rdi_port, rc);
+
+	cam_ife_hw_mgr_put_ctx(&ife_hw_mgr->used_ctx_list, &ife_ctx);
+
+	return 0;
+
+free_res:
+	cam_ife_hw_mgr_release_hw_for_ctx(ife_ctx);
+free_mem:
+	if (in_port) {
+		for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+			kfree(in_port[i].data);
+			in_port[i].data = NULL;
+		}
+
+		kfree(in_port);
+		in_port = NULL;
+	}
+free_ctx:
+	cam_ife_hw_mgr_put_ctx(&ife_hw_mgr->free_ctx_list, &ife_ctx);
+err:
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static void cam_ife_mgr_acquire_get_unified_dev_str(struct cam_isp_in_port_info *in,
+	struct cam_isp_in_port_generic_info *gen_port_info)
+{
+	int i;
+
+	gen_port_info->res_type        =  in->res_type;
+	gen_port_info->lane_type       =  in->lane_type;
+	gen_port_info->lane_num        =  in->lane_num;
+	gen_port_info->lane_cfg        =  in->lane_cfg;
+	gen_port_info->vc[0]           =  in->vc;
+	gen_port_info->dt[0]           =  in->dt;
+	gen_port_info->num_valid_vc_dt = 1;
+	gen_port_info->format          =  in->format;
+	gen_port_info->test_pattern    =  in->test_pattern;
+	gen_port_info->usage_type      =  in->usage_type;
+	gen_port_info->left_start      =  in->left_start;
+	gen_port_info->left_stop       =  in->left_stop;
+	gen_port_info->left_width      =  in->left_width;
+	gen_port_info->right_start     =  in->right_start;
+	gen_port_info->right_stop      =  in->right_stop;
+	gen_port_info->right_width     =  in->right_width;
+	gen_port_info->line_start      =  in->line_start;
+	gen_port_info->line_stop       =  in->line_stop;
+	gen_port_info->height          =  in->height;
+	gen_port_info->pixel_clk       =  in->pixel_clk;
+	gen_port_info->batch_size      =  in->batch_size;
+	gen_port_info->dsp_mode        =  in->dsp_mode;
+	gen_port_info->hbi_cnt         =  in->hbi_cnt;
+	gen_port_info->fe_unpacker_fmt =  in->format;
+	gen_port_info->cust_node       =  0;
+	gen_port_info->num_out_res     =  in->num_out_res;
+
+	for (i = 0; i < in->num_out_res; i++) {
+		gen_port_info->data[i].res_type     = in->data_flex[i].res_type;
+		gen_port_info->data[i].format       = in->data_flex[i].format;
+		gen_port_info->data[i].width        = in->data_flex[i].width;
+		gen_port_info->data[i].height       = in->data_flex[i].height;
+		gen_port_info->data[i].comp_grp_id  = in->data_flex[i].comp_grp_id;
+		gen_port_info->data[i].split_point  = in->data_flex[i].split_point;
+		gen_port_info->data[i].secure_mode  = in->data_flex[i].secure_mode;
+	}
+}
+
+/* entry function: acquire_hw */
+static int cam_ife_mgr_acquire_dev(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	struct cam_ife_hw_mgr *ife_hw_mgr            = hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -1;
+	int i, j;
+	struct cam_ife_hw_mgr_ctx             *ife_ctx;
+	struct cam_isp_in_port_info           *in_port = NULL;
+	struct cam_isp_resource               *isp_resource = NULL;
+	struct cam_cdm_acquire_data            cdm_acquire;
+	struct cam_isp_in_port_generic_info   *gen_port_info = NULL;
+	uint32_t                               total_pd_port = 0;
+	uint32_t                               total_pix_port = 0;
+	uint32_t                               total_rdi_port = 0;
+	uint32_t                               in_port_length = 0;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	/* get the ife ctx */
+	rc = cam_ife_hw_mgr_get_ctx(&ife_hw_mgr->free_ctx_list, &ife_ctx);
+	if (rc || !ife_ctx) {
+		CAM_ERR(CAM_ISP, "Get ife hw context failed");
+		goto err;
+	}
+
+	ife_ctx->cdm_handle = 0;
+	ife_ctx->common.cb_priv = acquire_args->context_data;
+	ife_ctx->common.event_cb = acquire_args->event_cb;
+
+	ife_ctx->hw_mgr = ife_hw_mgr;
+	ife_ctx->cdm_ops = cam_cdm_publish_ops();
+
+	isp_resource = (struct cam_isp_resource *)acquire_args->acquire_info;
+
+	gen_port_info = kcalloc(acquire_args->num_acq,
+			    sizeof(struct cam_isp_in_port_generic_info),
+			    GFP_KERNEL);
+
+	if (!gen_port_info) {
+		CAM_ERR(CAM_ISP, "No memory available");
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < acquire_args->num_acq; i++) {
+		if (isp_resource[i].resource_id != CAM_ISP_RES_ID_PORT)
+			continue;
+
+		CAM_DBG(CAM_ISP, "acquire no = %d total = %d", i,
+			acquire_args->num_acq);
+		CAM_DBG(CAM_ISP,
+			"start copy from user handle %lld with len = %d",
+			isp_resource[i].res_hdl,
+			isp_resource[i].length);
+
+		in_port_length = sizeof(struct cam_isp_in_port_info);
+
+		if (in_port_length > isp_resource[i].length) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough");
+			rc = -EINVAL;
+			goto free_res;
+		}
+
+		in_port = memdup_user(
+			u64_to_user_ptr(isp_resource[i].res_hdl),
+			isp_resource[i].length);
+		if (!IS_ERR(in_port)) {
+			if (in_port->num_out_res > max_ife_out_res) {
+				CAM_ERR(CAM_ISP, "too many output res %d",
+					in_port->num_out_res);
+				rc = -EINVAL;
+				kfree(in_port);
+				goto free_res;
+			}
+
+			in_port_length = sizeof(struct cam_isp_in_port_info) +
+				(in_port->num_out_res - 1) *
+				sizeof(struct cam_isp_out_port_info);
+			if (in_port_length > isp_resource[i].length) {
+				CAM_ERR(CAM_ISP, "buffer size is not enough");
+				rc = -EINVAL;
+				kfree(in_port);
+				goto free_res;
+			}
+
+			gen_port_info[i].data = kcalloc(
+				in_port->num_out_res,
+				sizeof(struct cam_isp_out_port_generic_info),
+				GFP_KERNEL);
+			if (gen_port_info[i].data == NULL) {
+				rc = -ENOMEM;
+				goto free_res;
+			}
+
+			cam_ife_mgr_acquire_get_unified_dev_str(in_port,
+				&gen_port_info[i]);
+			cam_ife_hw_mgr_preprocess_port(ife_ctx,
+				&gen_port_info[i]);
+
+			total_pix_port += gen_port_info[i].ipp_count +
+						gen_port_info[i].ife_rd_count +
+						gen_port_info[i].lcr_count;
+			total_rdi_port += gen_port_info[i].rdi_count;
+			total_pd_port += gen_port_info[i].ppp_count;
+
+			kfree(in_port);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"Copy from user failed with in_port = %pK",
+				in_port);
+			rc = -EFAULT;
+			goto free_mem;
+		}
+	}
+
+	/* Check whether context has only RDI resource */
+	if (!total_pix_port || !total_pd_port) {
+		ife_ctx->is_rdi_only_context = 1;
+		CAM_DBG(CAM_ISP, "RDI only context");
+	}
+
+	/* acquire HW resources */
+	for (i = 0; i < acquire_args->num_acq; i++) {
+		if (isp_resource[i].resource_id != CAM_ISP_RES_ID_PORT)
+			continue;
+
+		rc = cam_ife_mgr_acquire_hw_for_ctx(ife_ctx,
+			&gen_port_info[i],
+			&acquire_args->acquired_hw_id[i],
+			acquire_args->acquired_hw_path[i]);
+
+		if (rc) {
+			cam_ife_hw_mgr_print_acquire_info(ife_ctx,
+				total_pix_port, total_pd_port,
+				total_rdi_port, rc);
+			goto free_res;
+		}
+
+		kfree(gen_port_info[i].data);
+		gen_port_info[i].data = NULL;
+	}
+
+	kfree(gen_port_info);
+	gen_port_info = NULL;
+
+	/* Process base info */
+	rc = cam_ife_mgr_process_base_info(ife_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Process base info failed");
+		goto free_res;
+	}
+
+	cam_cpas_get_cpas_hw_version(&ife_ctx->hw_version);
+	ife_ctx->internal_cdm = false;
+
+	if (ife_ctx->is_dual)
+		memcpy(cdm_acquire.identifier, "dualife", sizeof("dualife"));
+	else
+		memcpy(cdm_acquire.identifier, "ife", sizeof("ife"));
+	cdm_acquire.cell_index = ife_ctx->base[0].idx;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = ife_ctx;
+	cdm_acquire.base_array_cnt = CAM_IFE_HW_NUM_MAX;
+	for (i = 0, j = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (ife_hw_mgr->cdm_reg_map[i])
+			cdm_acquire.base_array[j++] =
+				ife_hw_mgr->cdm_reg_map[i];
+	}
+	cdm_acquire.base_array_cnt = j;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.cam_cdm_callback = cam_ife_cam_cdm_callback;
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to acquire the CDM HW");
+		goto free_res;
+	}
+
+	CAM_DBG(CAM_ISP, "Successfully acquired CDM ID:%d, CDM HW hdl=%x",
+		cdm_acquire.id, cdm_acquire.handle);
+
+	if (cdm_acquire.id == CAM_CDM_IFE)
+		ife_ctx->internal_cdm = true;
+	ife_ctx->cdm_handle = cdm_acquire.handle;
+	ife_ctx->cdm_id = cdm_acquire.id;
+	atomic_set(&ife_ctx->cdm_done, 1);
+	ife_ctx->last_cdm_done_req = 0;
+
+	acquire_args->ctxt_to_hw_map = ife_ctx;
+	ife_ctx->ctx_in_use = 1;
+	ife_ctx->num_reg_dump_buf = 0;
+
+	cam_ife_hw_mgr_print_acquire_info(ife_ctx, total_pix_port,
+		total_pd_port, total_rdi_port, rc);
+
+	cam_ife_hw_mgr_put_ctx(&ife_hw_mgr->used_ctx_list, &ife_ctx);
+
+	return 0;
+free_res:
+	cam_ife_hw_mgr_release_hw_for_ctx(ife_ctx);
+	cam_cdm_release(ife_ctx->cdm_handle);
+	cam_ife_hw_mgr_put_ctx(&ife_hw_mgr->free_ctx_list, &ife_ctx);
+free_mem:
+	if (gen_port_info) {
+		for (i = 0; i < acquire_args->num_acq; i++) {
+			kfree(gen_port_info[i].data);
+			gen_port_info[i].data = NULL;
+		}
+		kfree(gen_port_info);
+		gen_port_info = NULL;
+	}
+err:
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+/* entry function: acquire_hw */
+static int cam_ife_mgr_acquire(void *hw_mgr_priv,
+					void *acquire_hw_args)
+{
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -1;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	if (acquire_args->num_acq == CAM_API_COMPAT_CONSTANT)
+		rc = cam_ife_mgr_acquire_hw(hw_mgr_priv, acquire_hw_args);
+	else
+		rc = cam_ife_mgr_acquire_dev(hw_mgr_priv, acquire_hw_args);
+
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static const char *cam_isp_util_usage_data_to_string(
+	uint32_t usage_data)
+{
+	switch (usage_data) {
+	case CAM_ISP_USAGE_LEFT_PX:
+		return "LEFT_PX";
+	case CAM_ISP_USAGE_RIGHT_PX:
+		return "RIGHT_PX";
+	case CAM_ISP_USAGE_RDI:
+		return "RDI";
+	default:
+		return "USAGE_INVALID";
+	}
+}
+
+static int cam_isp_classify_vote_info(
+	struct cam_isp_hw_mgr_res            *hw_mgr_res,
+	struct cam_isp_bw_config_v2          *bw_config,
+	struct cam_axi_vote                  *isp_vote,
+	uint32_t                              split_idx,
+	bool                                 *nrdi_l_bw_updated,
+	bool                                 *nrdi_r_bw_updated)
+{
+	int                                   rc = 0, i, j = 0;
+
+	if ((hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF)
+		|| (hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_RD) ||
+		(hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_PDLIB) ||
+		(hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_LCR)) {
+		if (split_idx == CAM_ISP_HW_SPLIT_LEFT) {
+			if (*nrdi_l_bw_updated)
+				return rc;
+
+			for (i = 0; i < bw_config->num_paths; i++) {
+				if (bw_config->axi_path_flex[i].usage_data ==
+					CAM_ISP_USAGE_LEFT_PX) {
+					memcpy(&isp_vote->axi_path[j],
+						&bw_config->axi_path_flex[i],
+						sizeof(struct
+						cam_axi_per_path_bw_vote));
+					j++;
+				}
+			}
+			isp_vote->num_paths = j;
+
+			*nrdi_l_bw_updated = true;
+		} else {
+			if (*nrdi_r_bw_updated)
+				return rc;
+
+			for (i = 0; i < bw_config->num_paths; i++) {
+				if (bw_config->axi_path_flex[i].usage_data ==
+					CAM_ISP_USAGE_RIGHT_PX) {
+					memcpy(&isp_vote->axi_path[j],
+						&bw_config->axi_path_flex[i],
+						sizeof(struct
+						cam_axi_per_path_bw_vote));
+					j++;
+				}
+			}
+			isp_vote->num_paths = j;
+
+			*nrdi_r_bw_updated = true;
+		}
+	} else if ((hw_mgr_res->res_id >= CAM_ISP_HW_VFE_IN_RDI0)
+		&& (hw_mgr_res->res_id <=
+		CAM_ISP_HW_VFE_IN_RDI3)) {
+		for (i = 0; i < bw_config->num_paths; i++) {
+			if ((bw_config->axi_path_flex[i].usage_data ==
+				CAM_ISP_USAGE_RDI) &&
+				((bw_config->axi_path_flex[i].path_data_type -
+				CAM_AXI_PATH_DATA_IFE_RDI0) ==
+				(hw_mgr_res->res_id -
+				CAM_ISP_HW_VFE_IN_RDI0))) {
+				memcpy(&isp_vote->axi_path[j],
+					&bw_config->axi_path_flex[i],
+					sizeof(struct
+					cam_axi_per_path_bw_vote));
+				j++;
+			}
+		}
+		isp_vote->num_paths = j;
+
+	} else {
+		if (hw_mgr_res->hw_res[split_idx]) {
+			CAM_ERR(CAM_ISP, "Invalid res_id %u, split_idx: %u",
+				hw_mgr_res->res_id, split_idx);
+			rc = -EINVAL;
+			return rc;
+		}
+	}
+
+	for (i = 0; i < isp_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"CLASSIFY_VOTE [%s] [%s] [%s] [%llu] [%llu] [%llu]",
+			cam_isp_util_usage_data_to_string(
+			isp_vote->axi_path[i].usage_data),
+			cam_cpas_axi_util_path_type_to_string(
+			isp_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			isp_vote->axi_path[i].transac_type),
+			isp_vote->axi_path[i].camnoc_bw,
+			isp_vote->axi_path[i].mnoc_ab_bw,
+			isp_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_bw_update_v2(
+	struct cam_isp_bw_config_v2           *bw_config,
+	struct cam_ife_hw_mgr_ctx             *ctx)
+{
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_vfe_bw_update_args_v2       bw_upd_args;
+	int                                    rc = -EINVAL;
+	uint32_t                               i, split_idx;
+	bool                                   nrdi_l_bw_updated = false;
+	bool                                   nrdi_r_bw_updated = false;
+
+	for (i = 0; i < bw_config->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"ISP_BLOB usage_type=%u [%s] [%s] [%s] [%llu] [%llu] [%llu]",
+			bw_config->usage_type,
+			cam_isp_util_usage_data_to_string(
+			bw_config->axi_path[i].usage_data),
+			cam_cpas_axi_util_path_type_to_string(
+			bw_config->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			bw_config->axi_path[i].transac_type),
+			bw_config->axi_path[i].camnoc_bw,
+			bw_config->axi_path[i].mnoc_ab_bw,
+			bw_config->axi_path[i].mnoc_ib_bw);
+	}
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		for (split_idx = 0; split_idx < CAM_ISP_HW_SPLIT_MAX;
+			split_idx++) {
+			if (!hw_mgr_res->hw_res[split_idx])
+				continue;
+
+			memset(&bw_upd_args.isp_vote, 0,
+				sizeof(struct cam_axi_vote));
+			rc = cam_isp_classify_vote_info(hw_mgr_res, bw_config,
+				&bw_upd_args.isp_vote, split_idx,
+				&nrdi_l_bw_updated, &nrdi_r_bw_updated);
+			if (rc)
+				return rc;
+
+			if (!bw_upd_args.isp_vote.num_paths)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[split_idx]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_upd_args.node_res =
+					hw_mgr_res->hw_res[split_idx];
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_UPDATE_V2,
+					&bw_upd_args,
+					sizeof(
+					struct cam_vfe_bw_update_args_v2));
+				if (rc)
+					CAM_ERR(CAM_PERF,
+						"BW Update failed rc: %d", rc);
+			} else {
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_bw_update(
+	struct cam_isp_bw_config              *bw_config,
+	struct cam_ife_hw_mgr_ctx             *ctx)
+{
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_vfe_bw_update_args          bw_upd_args;
+	uint64_t                               cam_bw_bps = 0;
+	uint64_t                               ext_bw_bps = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+	bool                                   camif_l_bw_updated = false;
+	bool                                   camif_r_bw_updated = false;
+
+	CAM_DBG(CAM_PERF,
+		"ISP_BLOB usage=%u left cam_bw_bps=%llu ext_bw_bps=%llu, right cam_bw_bps=%llu ext_bw_bps=%llu",
+		bw_config->usage_type,
+		bw_config->left_pix_vote.cam_bw_bps,
+		bw_config->left_pix_vote.ext_bw_bps,
+		bw_config->right_pix_vote.cam_bw_bps,
+		bw_config->right_pix_vote.ext_bw_bps);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if ((hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF) ||
+				(hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_RD) ||
+				(hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_PDLIB)
+				|| (hw_mgr_res->res_id ==
+				CAM_ISP_HW_VFE_IN_LCR))
+				if (i == CAM_ISP_HW_SPLIT_LEFT) {
+					if (camif_l_bw_updated)
+						continue;
+
+					cam_bw_bps =
+					bw_config->left_pix_vote.cam_bw_bps;
+					ext_bw_bps =
+					bw_config->left_pix_vote.ext_bw_bps;
+
+					camif_l_bw_updated = true;
+				} else {
+					if (camif_r_bw_updated)
+						continue;
+
+					cam_bw_bps =
+					bw_config->right_pix_vote.cam_bw_bps;
+					ext_bw_bps =
+					bw_config->right_pix_vote.ext_bw_bps;
+
+					camif_r_bw_updated = true;
+				}
+			else if ((hw_mgr_res->res_id >= CAM_ISP_HW_VFE_IN_RDI0)
+					&& (hw_mgr_res->res_id <=
+					CAM_ISP_HW_VFE_IN_RDI3)) {
+				uint32_t idx = hw_mgr_res->res_id -
+						CAM_ISP_HW_VFE_IN_RDI0;
+				if (idx >= bw_config->num_rdi)
+					continue;
+
+				cam_bw_bps =
+					bw_config->rdi_vote_flex[idx].cam_bw_bps;
+				ext_bw_bps =
+					bw_config->rdi_vote_flex[idx].ext_bw_bps;
+			} else {
+				if (hw_mgr_res->hw_res[i]) {
+					CAM_ERR(CAM_ISP, "Invalid res_id %u",
+						hw_mgr_res->res_id);
+					rc = -EINVAL;
+					return rc;
+				}
+			}
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+
+				bw_upd_args.camnoc_bw_bytes = cam_bw_bps;
+				bw_upd_args.external_bw_bytes = ext_bw_bps;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_UPDATE,
+					&bw_upd_args,
+					sizeof(struct cam_vfe_bw_update_args));
+				if (rc)
+					CAM_ERR(CAM_PERF, "BW Update failed");
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+/* entry function: config_hw */
+static int cam_ife_mgr_config_hw(void *hw_mgr_priv,
+					void *config_hw_args)
+{
+	int rc = -1, i, skip = 0;
+	struct cam_hw_config_args *cfg;
+	struct cam_hw_update_entry *cmd;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_ife_hw_mgr_ctx *ctx;
+	struct cam_isp_prepare_hw_update_data *hw_update_data;
+	unsigned long rem_jiffies = 0;
+	bool cdm_hang_detect = false;
+
+	if (!hw_mgr_priv || !config_hw_args) {
+		CAM_ERR(CAM_ISP,
+			"Invalid arguments, hw_mgr_priv=%pK, config_hw_args=%pK",
+			hw_mgr_priv, config_hw_args);
+		return -EINVAL;
+	}
+
+	cfg = config_hw_args;
+	ctx = (struct cam_ife_hw_mgr_ctx *)cfg->ctxt_to_hw_map;
+	if (!ctx) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EINVAL;
+	}
+
+	if (!ctx->ctx_in_use || !ctx->cdm_cmd) {
+		CAM_ERR(CAM_ISP,
+			"Invalid context parameters : ctx_in_use=%d, cdm_cmd=%pK",
+			ctx->ctx_in_use, ctx->cdm_cmd);
+		return -EPERM;
+	}
+
+	if (atomic_read(&ctx->overflow_pending)) {
+		CAM_DBG(CAM_ISP,
+			"Ctx[%pK][%d] Overflow pending, cannot apply req %llu",
+			ctx, ctx->ctx_index, cfg->request_id);
+		return -EPERM;
+	}
+
+	hw_update_data = (struct cam_isp_prepare_hw_update_data  *) cfg->priv;
+	hw_update_data->isp_mgr_ctx = ctx;
+
+	CAM_DBG(CAM_ISP, "Ctx[%pK][%d] : Applying Req %lld, init_packet=%d",
+		ctx, ctx->ctx_index, cfg->request_id, cfg->init_packet);
+
+	if (cfg->reapply && cfg->cdm_reset_before_apply) {
+		if (ctx->last_cdm_done_req < cfg->request_id) {
+			cdm_hang_detect =
+				cam_cdm_detect_hang_error(ctx->cdm_handle);
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CDM callback not received for req: %lld, last_cdm_done_req: %lld, cdm_hang_detect: %d",
+				cfg->request_id, ctx->last_cdm_done_req,
+				cdm_hang_detect);
+			rc = cam_cdm_reset_hw(ctx->cdm_handle);
+			if (rc) {
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"CDM reset unsuccessful for req: %lld. ctx: %d, rc: %d",
+					cfg->request_id, ctx->ctx_index, rc);
+				ctx->last_cdm_done_req = 0;
+				return rc;
+			}
+		} else {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CDM callback received, should wait for buf done for req: %lld",
+				cfg->request_id);
+			return -EALREADY;
+		}
+		ctx->last_cdm_done_req = 0;
+	}
+
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (hw_update_data->bw_config_valid[i] == true) {
+
+			CAM_DBG(CAM_PERF, "idx=%d, bw_config_version=%d",
+				ctx, ctx->ctx_index, i,
+				hw_update_data->bw_config_version);
+
+			if (hw_update_data->bw_config_version ==
+				CAM_ISP_BW_CONFIG_V1) {
+				rc = cam_isp_blob_bw_update(
+					(struct cam_isp_bw_config *)
+					&hw_update_data->bw_config[i], ctx);
+				if (rc)
+					CAM_ERR(CAM_PERF,
+					"Bandwidth Update Failed rc: %d", rc);
+			} else if (hw_update_data->bw_config_version ==
+				CAM_ISP_BW_CONFIG_V2) {
+				rc = cam_isp_blob_bw_update_v2(
+					(struct cam_isp_bw_config_v2 *)
+					&hw_update_data->bw_config_v2[i], ctx);
+				if (rc)
+					CAM_ERR(CAM_PERF,
+					"Bandwidth Update Failed rc: %d", rc);
+
+			} else {
+				CAM_ERR(CAM_PERF,
+					"Invalid bw config version: %d",
+					hw_update_data->bw_config_version);
+			}
+		}
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Enter ctx id:%d num_hw_upd_entries %d request id: %llu",
+		ctx->ctx_index, cfg->num_hw_update_entries, cfg->request_id);
+
+	if (cfg->num_hw_update_entries > 0) {
+		cdm_cmd = ctx->cdm_cmd;
+		cdm_cmd->type = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+		cdm_cmd->flag = true;
+		cdm_cmd->userdata = hw_update_data;
+		cdm_cmd->cookie = cfg->request_id;
+		cdm_cmd->gen_irq_arb = false;
+
+		for (i = 0 ; i < cfg->num_hw_update_entries; i++) {
+			cmd = (cfg->hw_update_entries + i);
+
+			if (cfg->reapply &&
+				cmd->flags == CAM_ISP_IQ_BL) {
+				skip++;
+				continue;
+			}
+
+			if (cmd->flags == CAM_ISP_UNUSED_BL ||
+				cmd->flags >= CAM_ISP_BL_MAX)
+				CAM_ERR(CAM_ISP, "Unexpected BL type %d",
+					cmd->flags);
+
+			cdm_cmd->cmd_flex[i - skip].bl_addr.mem_handle = cmd->handle;
+			cdm_cmd->cmd_flex[i - skip].offset = cmd->offset;
+			cdm_cmd->cmd_flex[i - skip].len = cmd->len;
+			cdm_cmd->cmd_flex[i - skip].arbitrate = false;
+		}
+		cdm_cmd->cmd_arrary_count = cfg->num_hw_update_entries - skip;
+
+		reinit_completion(&ctx->config_done_complete);
+		ctx->applied_req_id = cfg->request_id;
+
+		CAM_DBG(CAM_ISP, "Submit to CDM");
+		atomic_set(&ctx->cdm_done, 0);
+		rc = cam_cdm_submit_bls(ctx->cdm_handle, cdm_cmd);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed to apply the configs for req %llu, rc %d",
+				cfg->request_id, rc);
+			return rc;
+		}
+
+		if (cfg->init_packet ||
+			(ctx->custom_config & CAM_IFE_CUSTOM_CFG_SW_SYNC_ON)) {
+			rem_jiffies = wait_for_completion_timeout(
+				&ctx->config_done_complete,
+				msecs_to_jiffies(60));
+			if (rem_jiffies == 0) {
+				CAM_ERR(CAM_ISP,
+					"config done completion timeout for req_id=%llu ctx_index %d",
+					cfg->request_id, ctx->ctx_index);
+				if (cam_cdm_detect_hang_error(ctx->cdm_handle))
+					cam_cdm_dump_debug_registers(
+						ctx->cdm_handle);
+				rc = -ETIMEDOUT;
+			} else
+				CAM_DBG(CAM_ISP,
+					"config done Success for req_id=%llu ctx_index %d",
+					cfg->request_id, ctx->ctx_index);
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "No commands to config");
+	}
+	CAM_DBG(CAM_ISP, "Exit: Config Done: %llu",  cfg->request_id);
+
+	return rc;
+}
+
+static int cam_ife_mgr_stop_hw_in_overflow(void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_ife_hw_mgr_ctx        *ctx;
+	uint32_t                          i, master_base_idx = 0;
+
+	if (!stop_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+	ctx = (struct cam_ife_hw_mgr_ctx *)stop_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d",
+		ctx->ctx_index);
+
+	if (!ctx->num_base) {
+		CAM_ERR(CAM_ISP, "Number of bases are zero");
+		return -EINVAL;
+	}
+
+	/* get master base index first */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
+			master_base_idx = ctx->base[i].idx;
+			break;
+		}
+	}
+
+	if (i == ctx->num_base)
+		master_base_idx = ctx->base[0].idx;
+
+
+	/* stop the master CIDs first */
+	cam_ife_mgr_csid_stop_hw(ctx, &ctx->res_list_ife_cid,
+		master_base_idx, CAM_CSID_HALT_IMMEDIATELY);
+
+	/* stop rest of the CIDs  */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (i == master_base_idx)
+			continue;
+		cam_ife_mgr_csid_stop_hw(ctx, &ctx->res_list_ife_cid,
+			ctx->base[i].idx, CAM_CSID_HALT_IMMEDIATELY);
+	}
+
+	/* stop the master CSID path first */
+	cam_ife_mgr_csid_stop_hw(ctx, &ctx->res_list_ife_csid,
+		master_base_idx, CAM_CSID_HALT_IMMEDIATELY);
+
+	/* Stop rest of the CSID paths  */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (i == master_base_idx)
+			continue;
+
+		cam_ife_mgr_csid_stop_hw(ctx, &ctx->res_list_ife_csid,
+			ctx->base[i].idx, CAM_CSID_HALT_IMMEDIATELY);
+	}
+
+	/* IFE mux in resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	/* IFE bus rd resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_in_rd, list) {
+		cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	/* IFE out resources */
+	for (i = 0; i < max_ife_out_res; i++)
+		cam_ife_hw_mgr_stop_hw_res(&ctx->res_list_ife_out[i]);
+
+
+	/* Stop tasklet for context */
+	cam_tasklet_stop(ctx->common.tasklet_info);
+	CAM_DBG(CAM_ISP, "Exit...ctx id:%d rc :%d",
+		ctx->ctx_index, rc);
+
+	return rc;
+}
+
+static int cam_ife_mgr_bw_control(struct cam_ife_hw_mgr_ctx *ctx,
+	enum cam_vfe_bw_control_action action)
+{
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_vfe_bw_control_args         bw_ctrl_args;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d", ctx->ctx_index);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_ctrl_args.node_res =
+					hw_mgr_res->hw_res[i];
+				bw_ctrl_args.action = action;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_CONTROL,
+					&bw_ctrl_args,
+					sizeof(struct cam_vfe_bw_control_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "BW Update failed");
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_pause_hw(struct cam_ife_hw_mgr_ctx *ctx)
+{
+	return cam_ife_mgr_bw_control(ctx, CAM_VFE_BW_CONTROL_EXCLUDE);
+}
+
+/* entry function: stop_hw */
+static int cam_ife_mgr_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_isp_stop_args         *stop_isp;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_ife_hw_mgr_ctx        *ctx;
+	enum cam_ife_csid_halt_cmd        csid_halt_type;
+	uint32_t                          i, master_base_idx = 0;
+	unsigned long                     rem_jiffies = 0;
+
+	if (!hw_mgr_priv || !stop_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_ife_hw_mgr_ctx *)stop_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, " Enter...ctx id:%d", ctx->ctx_index);
+	stop_isp = (struct cam_isp_stop_args    *)stop_args->args;
+
+	/* Set the csid halt command */
+	if ((stop_isp->hw_stop_cmd == CAM_ISP_HW_STOP_AT_FRAME_BOUNDARY) ||
+		ctx->dsp_enabled)
+		csid_halt_type = CAM_CSID_HALT_AT_FRAME_BOUNDARY;
+	else
+		csid_halt_type = CAM_CSID_HALT_IMMEDIATELY;
+
+	/* Note:stop resource will remove the irq mask from the hardware */
+
+	if (!ctx->num_base) {
+		CAM_ERR(CAM_ISP, "number of bases are zero");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Halting CSIDs");
+
+	/* get master base index first */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
+			master_base_idx = ctx->base[i].idx;
+			break;
+		}
+	}
+
+	/*
+	 * If Context does not have PIX resources and has only RDI resource
+	 * then take the first base index.
+	 */
+	if (i == ctx->num_base)
+		master_base_idx = ctx->base[0].idx;
+
+	/*Change slave mode*/
+	if (csid_halt_type == CAM_CSID_HALT_IMMEDIATELY)
+		cam_ife_mgr_csid_change_halt_mode(ctx,
+			CAM_CSID_HALT_MODE_INTERNAL);
+
+
+	CAM_DBG(CAM_ISP, "Stopping master CSID idx %d", master_base_idx);
+
+	/* Stop the master CSID path first */
+	cam_ife_mgr_csid_stop_hw(ctx, &ctx->res_list_ife_csid,
+		master_base_idx, csid_halt_type);
+
+	/* stop rest of the CSID paths  */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].idx == master_base_idx)
+			continue;
+		CAM_DBG(CAM_ISP, "Stopping CSID idx %d i %d master %d",
+			ctx->base[i].idx, i, master_base_idx);
+
+		cam_ife_mgr_csid_stop_hw(ctx, &ctx->res_list_ife_csid,
+			ctx->base[i].idx, csid_halt_type);
+	}
+
+	CAM_DBG(CAM_ISP, "Stopping master CID idx %d", master_base_idx);
+
+	/* Stop the master CIDs first */
+	cam_ife_mgr_csid_stop_hw(ctx, &ctx->res_list_ife_cid,
+			master_base_idx, csid_halt_type);
+
+	/* stop rest of the CIDs */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].idx == master_base_idx)
+			continue;
+		CAM_DBG(CAM_ISP, "Stopping CID idx %d i %d master %d",
+			ctx->base[i].idx, i, master_base_idx);
+		cam_ife_mgr_csid_stop_hw(ctx, &ctx->res_list_ife_cid,
+			ctx->base[i].idx, csid_halt_type);
+	}
+
+	CAM_DBG(CAM_ISP, "Going to stop IFE Out");
+
+	/* IFE out resources */
+	for (i = 0; i < max_ife_out_res; i++)
+		cam_ife_hw_mgr_stop_hw_res(&ctx->res_list_ife_out[i]);
+
+	CAM_DBG(CAM_ISP, "Going to stop IFE Mux");
+
+	/* IFE mux in resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	/* IFE bus rd resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_in_rd, list) {
+		cam_ife_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	cam_tasklet_stop(ctx->common.tasklet_info);
+
+	cam_ife_mgr_pause_hw(ctx);
+
+	rem_jiffies = wait_for_completion_timeout(
+		&ctx->config_done_complete,
+		msecs_to_jiffies(10));
+	if (rem_jiffies == 0)
+		CAM_WARN(CAM_ISP,
+			"config done completion timeout for last applied req_id=%llu ctx_index %u",
+			ctx->applied_req_id, ctx->ctx_index);
+
+	if (stop_isp->stop_only)
+		goto end;
+
+	if (cam_cdm_stream_off(ctx->cdm_handle))
+		CAM_ERR(CAM_ISP, "CDM stream off failed %d", ctx->cdm_handle);
+
+	if (ctx->is_tpg)
+		cam_ife_hw_mgr_stop_hw_res(&ctx->res_list_tpg);
+
+	cam_ife_hw_mgr_deinit_hw(ctx);
+	CAM_DBG(CAM_ISP,
+		"Stop success for ctx id:%d rc :%d", ctx->ctx_index, rc);
+
+#ifdef CONFIG_SPECTRA_SECURE
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	if (!atomic_dec_return(&g_ife_hw_mgr.active_ctx_cnt)) {
+		rc = cam_ife_notify_safe_lut_scm(CAM_IFE_SAFE_DISABLE);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"SAFE SCM call failed:Check TZ/HYP dependency");
+			rc = 0;
+		}
+	}
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+#endif /* CONFIG_SPECTRA_SECURE */
+
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_reset_vfe_hw(struct cam_ife_hw_mgr *hw_mgr,
+	uint32_t hw_idx)
+{
+	uint32_t i = 0;
+	struct cam_hw_intf             *vfe_hw_intf;
+	uint32_t vfe_reset_type;
+
+	if (!hw_mgr) {
+		CAM_DBG(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+	/* Reset VFE HW*/
+	vfe_reset_type = CAM_VFE_HW_RESET_HW;
+
+	for (i = 0; i < CAM_VFE_HW_NUM_MAX; i++) {
+		if (!hw_mgr->ife_devices[i])
+			continue;
+
+		if (hw_idx != hw_mgr->ife_devices[i]->hw_intf->hw_idx)
+			continue;
+		CAM_DBG(CAM_ISP, "VFE (id = %d) reset", hw_idx);
+		vfe_hw_intf = hw_mgr->ife_devices[i]->hw_intf;
+		vfe_hw_intf->hw_ops.reset(vfe_hw_intf->hw_priv,
+			&vfe_reset_type, sizeof(vfe_reset_type));
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "Exit Successfully");
+	return 0;
+}
+
+static int cam_ife_mgr_unmask_bus_wr_irq(struct cam_ife_hw_mgr *hw_mgr,
+	uint32_t hw_idx)
+{
+	uint32_t i = 0, dummy_args = 0;
+	struct cam_hw_intf *vfe_hw_intf;
+
+	if (!hw_mgr) {
+		CAM_DBG(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_VFE_HW_NUM_MAX; i++) {
+		if (!hw_mgr->ife_devices[i])
+			continue;
+
+		if (hw_idx != hw_mgr->ife_devices[i]->hw_intf->hw_idx)
+			continue;
+
+		CAM_DBG(CAM_ISP, "Unmask VFE:%d BUS_WR IRQ", hw_idx);
+
+		vfe_hw_intf = hw_mgr->ife_devices[i]->hw_intf;
+
+		vfe_hw_intf->hw_ops.process_cmd(vfe_hw_intf->hw_priv,
+			CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ,
+			&dummy_args,
+			sizeof(dummy_args));
+
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_ife_mgr_restart_hw(void *start_hw_args)
+{
+	int                               rc = -1;
+	struct cam_hw_start_args         *start_args = start_hw_args;
+	struct cam_ife_hw_mgr_ctx        *ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	uint32_t                          i;
+
+	if (!start_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_ife_hw_mgr_ctx *)start_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "START IFE OUT ... in ctx id:%d", ctx->ctx_index);
+
+	cam_tasklet_start(ctx->common.tasklet_info);
+
+	/* start the IFE out devices */
+	for (i = 0; i < max_ife_out_res; i++) {
+		rc = cam_ife_hw_mgr_start_hw_res(
+			&ctx->res_list_ife_out[i], ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE OUT (%d)", i);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START IFE SRC ... in ctx id:%d", ctx->ctx_index);
+
+	/* Start IFE BUS RD device */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_in_rd, list) {
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE BUS RD (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	/* Start the IFE mux in devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE MUX (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START CSID HW ... in ctx id:%d", ctx->ctx_index);
+	/* Start the IFE CSID HW devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE CSID (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START CID SRC ... in ctx id:%d", ctx->ctx_index);
+	/* Start IFE root node: do nothing */
+	CAM_DBG(CAM_ISP, "Exit...(success)");
+	return 0;
+
+err:
+	cam_ife_mgr_stop_hw_in_overflow(start_hw_args);
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static int cam_ife_mgr_start_hw(void *hw_mgr_priv, void *start_hw_args)
+{
+	int                               rc = -1;
+	struct cam_isp_start_args        *start_isp = start_hw_args;
+	struct cam_hw_stop_args           stop_args;
+	struct cam_isp_stop_args          stop_isp;
+	struct cam_ife_hw_mgr_ctx        *ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_resource_node     *rsrc_node = NULL;
+	uint32_t                          i, camif_debug;
+	bool                              res_rdi_context_set = false;
+	uint32_t                          primary_rdi_src_res;
+	uint32_t                          primary_rdi_out_res;
+
+	primary_rdi_src_res = CAM_ISP_HW_VFE_IN_MAX;
+	primary_rdi_out_res = g_ife_hw_mgr.max_vfe_out_res_type;
+
+	if (!hw_mgr_priv || !start_isp) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_ife_hw_mgr_ctx *)
+		start_isp->hw_config.ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	if ((!ctx->init_done) && start_isp->start_only) {
+		CAM_ERR(CAM_ISP, "Invalid args init_done %d start_only %d",
+			ctx->init_done, start_isp->start_only);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter... ctx id:%d",
+		ctx->ctx_index);
+
+	/* update Bandwidth should be done at the hw layer */
+
+	cam_tasklet_start(ctx->common.tasklet_info);
+
+	if (ctx->init_done && start_isp->start_only) {
+		/* Unmask BUS_WR bit in VFE top */
+		for (i = 0; i < ctx->num_base; i++) {
+			rc = cam_ife_mgr_unmask_bus_wr_irq(hw_mgr_priv,
+				ctx->base[i].idx);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Failed to unmask VFE:%d BUS_WR IRQ rc:%d",
+					ctx->base[i].idx, rc);
+		}
+		goto start_only;
+	}
+
+	/* set current csid debug information to CSID HW */
+	for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		if (g_ife_hw_mgr.csid_devices[i])
+			rc = g_ife_hw_mgr.csid_devices[i]->hw_ops.process_cmd(
+				g_ife_hw_mgr.csid_devices[i]->hw_priv,
+				CAM_IFE_CSID_SET_CSID_DEBUG,
+				&g_ife_hw_mgr.debug_cfg.csid_debug,
+				sizeof(g_ife_hw_mgr.debug_cfg.csid_debug));
+	}
+
+	camif_debug = g_ife_hw_mgr.debug_cfg.camif_debug;
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rsrc_node = hw_mgr_res->hw_res[i];
+			if (rsrc_node->process_cmd && (rsrc_node->res_id ==
+				CAM_ISP_HW_VFE_IN_CAMIF)) {
+				rc = hw_mgr_res->hw_res[i]->process_cmd(
+					hw_mgr_res->hw_res[i],
+					CAM_ISP_HW_CMD_SET_CAMIF_DEBUG,
+					&camif_debug,
+					sizeof(camif_debug));
+			}
+		}
+	}
+
+	rc = cam_ife_hw_mgr_init_hw(ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Init failed");
+		goto tasklet_stop;
+	}
+
+	ctx->init_done = true;
+
+#ifdef CONFIG_SPECTRA_SECURE
+	mutex_lock(&g_ife_hw_mgr.ctx_mutex);
+	if (!atomic_fetch_inc(&g_ife_hw_mgr.active_ctx_cnt)) {
+		rc = cam_ife_notify_safe_lut_scm(CAM_IFE_SAFE_ENABLE);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"SAFE SCM call failed:Check TZ/HYP dependency");
+			rc = -EFAULT;
+			goto deinit_hw;
+		}
+	}
+	mutex_unlock(&g_ife_hw_mgr.ctx_mutex);
+#endif /* CONFIG_SPECTRA_SECURE */
+
+	rc = cam_cdm_stream_on(ctx->cdm_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Can not start cdm (%d)", ctx->cdm_handle);
+		goto safe_disable;
+	}
+
+start_only:
+
+	atomic_set(&ctx->overflow_pending, 0);
+
+	/* Apply initial configuration */
+	CAM_DBG(CAM_ISP, "Config HW");
+	rc = cam_ife_mgr_config_hw(hw_mgr_priv, &start_isp->hw_config);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Config HW failed, start_only=%d, rc=%d",
+			start_isp->start_only, rc);
+		goto cdm_streamoff;
+	}
+
+	CAM_DBG(CAM_ISP, "START IFE OUT ... in ctx id:%d",
+		ctx->ctx_index);
+	/* start the IFE out devices */
+	for (i = 0; i < max_ife_out_res; i++) {
+		hw_mgr_res = &ctx->res_list_ife_out[i];
+		switch (hw_mgr_res->res_id) {
+		case CAM_ISP_IFE_OUT_RES_RDI_0:
+		case CAM_ISP_IFE_OUT_RES_RDI_1:
+		case CAM_ISP_IFE_OUT_RES_RDI_2:
+		case CAM_ISP_IFE_OUT_RES_RDI_3:
+			if (!res_rdi_context_set && ctx->is_rdi_only_context) {
+				hw_mgr_res->hw_res[0]->rdi_only_ctx =
+					ctx->is_rdi_only_context;
+				res_rdi_context_set = true;
+				primary_rdi_out_res = hw_mgr_res->res_id;
+			}
+			break;
+		default:
+			break;
+		}
+		rc = cam_ife_hw_mgr_start_hw_res(
+			&ctx->res_list_ife_out[i], ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE OUT (%d)",
+				 i);
+			goto err;
+		}
+	}
+
+	if (primary_rdi_out_res < g_ife_hw_mgr.max_vfe_out_res_type)
+		primary_rdi_src_res =
+			cam_convert_rdi_out_res_id_to_src(primary_rdi_out_res);
+
+	CAM_DBG(CAM_ISP, "START IFE SRC ... in ctx id:%d",
+		ctx->ctx_index);
+	/* Start the IFE mux in devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		if (primary_rdi_src_res == hw_mgr_res->res_id) {
+			hw_mgr_res->hw_res[0]->rdi_only_ctx =
+				ctx->is_rdi_only_context;
+		}
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE Mux (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START IFE BUS RD ... in ctx id:%d", ctx->ctx_index);
+	/* Start IFE Bus RD devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_in_rd, list) {
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE BUS RD (%d)",
+				hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START CSID HW ... in ctx id:%d",
+		ctx->ctx_index);
+	/* Start the IFE CSID HW devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE CSID (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START CID SRC ... in ctx id:%d",
+		ctx->ctx_index);
+	/* Start the IFE CID HW devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_cid, list) {
+		rc = cam_ife_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE CSID (%d)",
+				hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	if (ctx->is_tpg) {
+		CAM_DBG(CAM_ISP, "START TPG HW ... in ctx id:%d",
+			ctx->ctx_index);
+		rc = cam_ife_hw_mgr_start_hw_res(&ctx->res_list_tpg, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start IFE TPG (%d)",
+				ctx->res_list_tpg.res_id);
+			goto err;
+		}
+	}
+
+	/* Start IFE root node: do nothing */
+	CAM_DBG(CAM_ISP, "Start success for ctx id:%d", ctx->ctx_index);
+
+	return 0;
+
+err:
+	stop_isp.stop_only = false;
+	stop_isp.hw_stop_cmd = CAM_ISP_HW_STOP_IMMEDIATELY;
+	stop_args.ctxt_to_hw_map = start_isp->hw_config.ctxt_to_hw_map;
+	stop_args.args = (void *)(&stop_isp);
+
+	cam_ife_mgr_stop_hw(hw_mgr_priv, &stop_args);
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+
+cdm_streamoff:
+	cam_cdm_stream_off(ctx->cdm_handle);
+safe_disable:
+#ifdef CONFIG_SPECTRA_SECURE
+	cam_ife_notify_safe_lut_scm(CAM_IFE_SAFE_DISABLE);
+
+deinit_hw:
+#endif /* CONFIG_SPECTRA_SECURE */
+
+	cam_ife_hw_mgr_deinit_hw(ctx);
+
+tasklet_stop:
+	cam_tasklet_stop(ctx->common.tasklet_info);
+
+	return rc;
+}
+
+static int cam_ife_mgr_read(void *hw_mgr_priv, void *read_args)
+{
+	return -EPERM;
+}
+
+static int cam_ife_mgr_write(void *hw_mgr_priv, void *write_args)
+{
+	return -EPERM;
+}
+
+static int cam_ife_mgr_reset(void *hw_mgr_priv, void *hw_reset_args)
+{
+	struct cam_ife_hw_mgr            *hw_mgr = hw_mgr_priv;
+	struct cam_hw_reset_args         *reset_args = hw_reset_args;
+	struct cam_ife_hw_mgr_ctx        *ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	int                               rc = 0, i = 0;
+
+	if (!hw_mgr_priv || !hw_reset_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_ife_hw_mgr_ctx *)reset_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Reset CSID and VFE");
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		rc = cam_ife_hw_mgr_reset_csid_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to reset CSID:%d rc: %d",
+				hw_mgr_res->res_id, rc);
+			goto end;
+		}
+	}
+
+	for (i = 0; i < ctx->num_base; i++) {
+		rc = cam_ife_mgr_reset_vfe_hw(hw_mgr, ctx->base[i].idx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to reset VFE:%d rc: %d",
+				ctx->base[i].idx, rc);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_release_hw(void *hw_mgr_priv,
+					void *release_hw_args)
+{
+	int                               rc           = 0;
+	struct cam_hw_release_args       *release_args = release_hw_args;
+	struct cam_ife_hw_mgr            *hw_mgr       = hw_mgr_priv;
+	struct cam_ife_hw_mgr_ctx        *ctx;
+	uint32_t                          i;
+
+	if (!hw_mgr_priv || !release_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_ife_hw_mgr_ctx *)release_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d",
+		ctx->ctx_index);
+
+	if (ctx->init_done)
+		cam_ife_hw_mgr_deinit_hw(ctx);
+
+	/* we should called the stop hw before this already */
+	cam_ife_hw_mgr_release_hw_for_ctx(ctx);
+
+	/* reset base info */
+	ctx->num_base = 0;
+	memset(ctx->base, 0, sizeof(ctx->base));
+
+	/* release cdm handle */
+	cam_cdm_release(ctx->cdm_handle);
+
+	/* clean context */
+	list_del_init(&ctx->list);
+	ctx->ctx_in_use = 0;
+	ctx->is_rdi_only_context = 0;
+	ctx->cdm_handle = 0;
+	ctx->cdm_ops = NULL;
+	ctx->num_reg_dump_buf = 0;
+	ctx->custom_enabled = false;
+	ctx->custom_config = 0;
+	ctx->num_reg_dump_buf = 0;
+	ctx->is_dual = false;
+	ctx->dsp_enabled = false;
+	ctx->is_fe_enabled = false;
+	ctx->is_offline = false;
+	ctx->pf_mid_found = false;
+	ctx->last_cdm_done_req = 0;
+	atomic_set(&ctx->overflow_pending, 0);
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		ctx->sof_cnt[i] = 0;
+		ctx->eof_cnt[i] = 0;
+		ctx->epoch_cnt[i] = 0;
+	}
+
+	CAM_INFO(CAM_ISP, "Release HW success ctx id: %u",
+		ctx->ctx_index);
+
+	memset(&ctx->ts, 0, sizeof(struct timespec64));
+	cam_ife_hw_mgr_put_ctx(&hw_mgr->free_ctx_list, &ctx);
+	return rc;
+}
+
+static int cam_isp_blob_fe_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_fe_config                  *fe_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+	struct cam_vfe_fe_update_args          fe_upd_args;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_in_rd, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				fe_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+
+			memcpy(&fe_upd_args.fe_config, fe_config,
+				sizeof(struct cam_fe_config));
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD,
+					&fe_upd_args,
+					sizeof(
+					struct cam_fe_config));
+				if (rc)
+					CAM_ERR(CAM_ISP, "fs Update failed");
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if (hw_mgr_res->res_id != CAM_ISP_HW_VFE_IN_RD)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				fe_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+
+				memcpy(&fe_upd_args.fe_config, fe_config,
+					sizeof(struct cam_fe_config));
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_FE_UPDATE_IN_RD,
+					&fe_upd_args,
+					sizeof(
+					struct cam_vfe_fe_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "fe Update failed");
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+	return rc;
+}
+
+static int cam_isp_blob_ubwc_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_ubwc_config                *ubwc_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ubwc_plane_cfg_v1          *ubwc_plane_cfg;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    num_ent, rc = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+	if (!ctx) {
+		CAM_ERR(CAM_ISP, "Invalid ctx");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((prepare->num_hw_update_entries + 1) >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries :%d max:%d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	switch (ubwc_config->api_version) {
+	case CAM_UBWC_CFG_VERSION_1:
+		CAM_DBG(CAM_ISP, "num_ports= %d", ubwc_config->num_ports);
+
+		kmd_buf_info = blob_info->kmd_buf_info;
+		for (i = 0; i < ubwc_config->num_ports; i++) {
+			ubwc_plane_cfg = &ubwc_config->ubwc_plane_cfg_array_flex[i][0];
+			res_id_out = ubwc_plane_cfg->port_type & 0xFF;
+
+			CAM_DBG(CAM_ISP, "UBWC config idx %d, port_type=%d", i,
+				ubwc_plane_cfg->port_type);
+
+			if (res_id_out >= max_ife_out_res) {
+				CAM_ERR(CAM_ISP, "Invalid port type:%x",
+					ubwc_plane_cfg->port_type);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			if ((kmd_buf_info->used_bytes
+				+ total_used_bytes) < kmd_buf_info->size) {
+				kmd_buf_remain_size = kmd_buf_info->size -
+					(kmd_buf_info->used_bytes
+					+ total_used_bytes);
+			} else {
+				CAM_ERR(CAM_ISP,
+				"no free kmd memory for base=%d bytes_used=%u buf_size=%u",
+					blob_info->base_info->idx, bytes_used,
+					kmd_buf_info->size);
+				rc = -ENOMEM;
+				goto end;
+			}
+
+			cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4 +
+				total_used_bytes/4;
+			hw_mgr_res = &ctx->res_list_ife_out[res_id_out];
+
+			if (!hw_mgr_res) {
+				CAM_ERR(CAM_ISP, "Invalid hw_mgr_res");
+				rc = -EINVAL;
+				goto end;
+			}
+
+			rc = cam_isp_add_cmd_buf_update(
+				hw_mgr_res, blob_type,
+				blob_type_hw_cmd_map[blob_type],
+				blob_info->base_info->idx,
+				(void *)cmd_buf_addr,
+				kmd_buf_remain_size,
+				(void *)ubwc_plane_cfg,
+				&bytes_used);
+			if (rc < 0) {
+				CAM_ERR(CAM_ISP,
+					"Failed cmd_update, base_idx=%d, bytes_used=%u, res_id_out=0x%X",
+					blob_info->base_info->idx,
+					bytes_used,
+					ubwc_plane_cfg->port_type);
+				goto end;
+			}
+
+			total_used_bytes += bytes_used;
+		}
+
+		if (total_used_bytes) {
+			/* Update the HW entries */
+			num_ent = prepare->num_hw_update_entries;
+			prepare->hw_update_entries[num_ent].handle =
+				kmd_buf_info->handle;
+			prepare->hw_update_entries[num_ent].len =
+				total_used_bytes;
+			prepare->hw_update_entries[num_ent].offset =
+				kmd_buf_info->offset;
+			num_ent++;
+
+			kmd_buf_info->used_bytes += total_used_bytes;
+			kmd_buf_info->offset     += total_used_bytes;
+			prepare->num_hw_update_entries = num_ent;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid UBWC API Version %d",
+			ubwc_config->api_version);
+		rc = -EINVAL;
+		break;
+	}
+end:
+	return rc;
+}
+
+static int cam_isp_get_generic_ubwc_data_v2(
+	struct cam_ubwc_plane_cfg_v2       *ubwc_cfg,
+	uint32_t                            version,
+	struct cam_vfe_generic_ubwc_config *generic_ubwc_cfg)
+{
+	int i = 0;
+
+	generic_ubwc_cfg->api_version = version;
+	for (i = 0; i < CAM_PACKET_MAX_PLANES - 1; i++) {
+		generic_ubwc_cfg->ubwc_plane_cfg[i].port_type             =
+			ubwc_cfg[i].port_type;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].meta_stride           =
+			ubwc_cfg[i].meta_stride;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].meta_size             =
+			ubwc_cfg[i].meta_size;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].meta_offset           =
+			ubwc_cfg[i].meta_offset;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].packer_config         =
+			ubwc_cfg[i].packer_config;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].mode_config_0         =
+			ubwc_cfg[i].mode_config_0;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].mode_config_1         =
+			ubwc_cfg[i].mode_config_1;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].tile_config           =
+			ubwc_cfg[i].tile_config;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].h_init                =
+			ubwc_cfg[i].h_init;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].v_init                =
+			ubwc_cfg[i].v_init;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].static_ctrl           =
+			ubwc_cfg[i].static_ctrl;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].ctrl_2                =
+			ubwc_cfg[i].ctrl_2;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].stats_ctrl_2          =
+			ubwc_cfg[i].stats_ctrl_2;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].lossy_threshold_0     =
+			ubwc_cfg[i].lossy_threshold_0;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].lossy_threshold_1     =
+			ubwc_cfg[i].lossy_threshold_1;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].lossy_var_offset =
+			ubwc_cfg[i].lossy_var_offset;
+		generic_ubwc_cfg->ubwc_plane_cfg[i].bandwidth_limit       =
+			ubwc_cfg[i].bandwidth_limit;
+	}
+
+	return 0;
+}
+
+static int cam_isp_blob_ubwc_update_v2(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_ubwc_config_v2             *ubwc_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ubwc_plane_cfg_v2          *ubwc_plane_cfg;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    num_ent, rc = 0;
+	struct cam_vfe_generic_ubwc_config     generic_ubwc_cfg;
+
+	ctx = prepare->ctxt_to_hw_map;
+	if (!ctx) {
+		CAM_ERR(CAM_ISP, "Invalid ctx");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries :%d max:%d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "num_ports= %d", ubwc_config->num_ports);
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < ubwc_config->num_ports; i++) {
+		ubwc_plane_cfg = &ubwc_config->ubwc_plane_cfg_array_flex[i][0];
+		res_id_out = ubwc_plane_cfg->port_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "UBWC config idx %d, port_type=%d", i,
+			ubwc_plane_cfg->port_type);
+
+		if (res_id_out >= max_ife_out_res) {
+			CAM_ERR(CAM_ISP, "Invalid port type:%x",
+				ubwc_plane_cfg->port_type);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+				(kmd_buf_info->used_bytes
+				+ total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"no free kmd memory for base=%d bytes_used=%u buf_size=%u",
+				blob_info->base_info->idx, bytes_used,
+				kmd_buf_info->size);
+			rc = -ENOMEM;
+			goto end;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			kmd_buf_info->used_bytes/4 +
+			total_used_bytes/4;
+		hw_mgr_res = &ctx->res_list_ife_out[res_id_out];
+
+		if (!hw_mgr_res) {
+			CAM_ERR(CAM_ISP, "Invalid hw_mgr_res");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		rc = cam_isp_get_generic_ubwc_data_v2(ubwc_plane_cfg,
+			ubwc_config->api_version, &generic_ubwc_cfg);
+
+		rc = cam_isp_add_cmd_buf_update(
+			hw_mgr_res, blob_type,
+			blob_type_hw_cmd_map[blob_type],
+			blob_info->base_info->idx,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)&generic_ubwc_cfg,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed cmd_update, base_idx=%d, bytes_used=%u, res_id_out=0x%X",
+				blob_info->base_info->idx,
+				bytes_used,
+				ubwc_plane_cfg->port_type);
+			goto end;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = total_used_bytes;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		num_ent++;
+
+		kmd_buf_info->used_bytes += total_used_bytes;
+		kmd_buf_info->offset     += total_used_bytes;
+		prepare->num_hw_update_entries = num_ent;
+	}
+end:
+	return rc;
+}
+
+static int cam_isp_blob_hfr_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_resource_hfr_config    *hfr_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_isp_port_hfr_config        *port_hfr_config;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    num_ent, rc = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+	CAM_DBG(CAM_ISP, "num_ports= %d",
+		hfr_config->num_ports);
+
+	/* Max one hw entries required for hfr config update */
+	if (prepare->num_hw_update_entries + 1 >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < hfr_config->num_ports; i++) {
+		port_hfr_config = &hfr_config->port_hfr_config_flex[i];
+		res_id_out = port_hfr_config->resource_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "hfr config idx %d, type=%d", i,
+			res_id_out);
+
+		if (res_id_out >= max_ife_out_res) {
+			CAM_ERR(CAM_ISP, "invalid out restype:%x",
+				port_hfr_config->resource_type);
+			return -EINVAL;
+		}
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+			"no free kmd memory for base %d",
+			blob_info->base_info->idx);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			kmd_buf_info->used_bytes/4 +
+			total_used_bytes/4;
+		hw_mgr_res = &ctx->res_list_ife_out[res_id_out];
+
+		rc = cam_isp_add_cmd_buf_update(
+			hw_mgr_res, blob_type,
+			blob_type_hw_cmd_map[blob_type],
+			blob_info->base_info->idx,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)port_hfr_config,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed cmd_update, base_idx=%d, rc=%d, res_id_out:0x%X",
+				blob_info->base_info->idx, bytes_used,
+				port_hfr_config->resource_type);
+			return rc;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = total_used_bytes;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		num_ent++;
+		kmd_buf_info->used_bytes += total_used_bytes;
+		kmd_buf_info->offset     += total_used_bytes;
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_csid_clock_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_csid_clock_config      *clock_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_ife_csid_clock_update_args  csid_clock_upd_args;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	CAM_DBG(CAM_ISP,
+		"csid clk=%llu", clock_config->csid_clock);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			clk_rate = 0;
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			clk_rate = clock_config->csid_clock;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				csid_clock_upd_args.clk_rate = clk_rate;
+				CAM_DBG(CAM_ISP, "i= %d clk=%llu\n",
+				i, csid_clock_upd_args.clk_rate);
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					blob_type_hw_cmd_map[blob_type],
+					&csid_clock_upd_args,
+					sizeof(
+					struct cam_ife_csid_clock_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Clock Update failed");
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_csid_qcfa_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_csid_qcfa_config       *qcfa_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_ife_csid_qcfa_update_args   csid_qcfa_upd_args;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	CAM_DBG(CAM_ISP,
+		"csid binning=%d", qcfa_config->csid_binning);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+
+			if (!hw_mgr_res->hw_res[i] ||
+				hw_mgr_res->res_id != CAM_IFE_PIX_PATH_RES_IPP)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				csid_qcfa_upd_args.qcfa_binning =
+						qcfa_config->csid_binning;
+				CAM_DBG(CAM_ISP, "i= %d QCFA binning=%d\n",
+				i, csid_qcfa_upd_args.qcfa_binning);
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_QCFA_SUPPORTED,
+					&csid_qcfa_upd_args,
+					sizeof(
+					struct cam_ife_csid_qcfa_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "QCFA Update failed");
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_core_cfg_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_core_config            *core_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = 0, i;
+	struct cam_vfe_core_config_args        vfe_core_config;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			clk_rate = 0;
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if ((hw_mgr_res->res_id ==
+				CAM_ISP_HW_VFE_IN_CAMIF) ||
+				(hw_mgr_res->res_id ==
+				CAM_ISP_HW_VFE_IN_PDLIB)) {
+				hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+				if (hw_intf && hw_intf->hw_ops.process_cmd) {
+					vfe_core_config.node_res =
+						hw_mgr_res->hw_res[i];
+
+					memcpy(&vfe_core_config.core_config,
+						core_config,
+						sizeof(
+						struct cam_isp_core_config));
+
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_CORE_CONFIG,
+						&vfe_core_config,
+						sizeof(
+						struct cam_vfe_core_config_args)
+						);
+					if (rc)
+						CAM_ERR(CAM_ISP,
+						"Core cfg parse fail");
+				} else {
+					CAM_WARN(CAM_ISP, "NULL hw_intf!");
+				}
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_clock_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_clock_config           *clock_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_vfe_clock_update_args       clock_upd_args;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+	uint32_t                               j;
+	bool                                   camif_l_clk_updated = false;
+	bool                                   camif_r_clk_updated = false;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	CAM_DBG(CAM_PERF,
+		"usage=%u left_clk= %lu right_clk=%lu",
+		clock_config->usage_type,
+		clock_config->left_pix_hz,
+		clock_config->right_pix_hz);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			clk_rate = 0;
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if (hw_mgr_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF) {
+				if (i == CAM_ISP_HW_SPLIT_LEFT) {
+					if (camif_l_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->left_pix_hz;
+
+					camif_l_clk_updated = true;
+				} else {
+					if (camif_r_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->right_pix_hz;
+
+					camif_r_clk_updated = true;
+				}
+			} else if (hw_mgr_res->res_id ==
+				CAM_ISP_HW_VFE_IN_PDLIB) {
+				if (i == CAM_ISP_HW_SPLIT_LEFT) {
+					if (camif_l_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->left_pix_hz;
+
+					camif_l_clk_updated = true;
+				} else {
+					if (camif_r_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->right_pix_hz;
+
+					camif_r_clk_updated = true;
+				}
+			} else if ((hw_mgr_res->res_id >=
+				CAM_ISP_HW_VFE_IN_RD) && (hw_mgr_res->res_id
+				<= CAM_ISP_HW_VFE_IN_RDI3))
+				for (j = 0; j < clock_config->num_rdi; j++)
+					clk_rate = max(clock_config->rdi_hz_flex[j],
+						clk_rate);
+			else
+				if (hw_mgr_res->res_id != CAM_ISP_HW_VFE_IN_LCR
+					&& hw_mgr_res->hw_res[i]) {
+					CAM_ERR(CAM_ISP, "Invalid res_id %u",
+						hw_mgr_res->res_id);
+					rc = -EINVAL;
+					return rc;
+				}
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				clock_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+				CAM_DBG(CAM_PERF,
+				"res_id=%u i= %d clk=%llu\n",
+				hw_mgr_res->res_id, i, clk_rate);
+
+				clock_upd_args.clk_rate = clk_rate;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CLOCK_UPDATE,
+					&clock_upd_args,
+					sizeof(
+					struct cam_vfe_clock_update_args));
+				if (rc)
+					CAM_ERR(CAM_PERF,
+						"Clock Update failed");
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_tpg_config(
+	struct cam_isp_tpg_core_config        *tpg_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	int                                 i, rc = -EINVAL;
+	struct cam_ife_hw_mgr_ctx          *ctx = NULL;
+	struct cam_isp_hw_mgr_res          *hw_mgr_res;
+	struct cam_hw_intf                 *hw_intf;
+
+	ctx = prepare->ctxt_to_hw_map;
+	hw_mgr_res = &ctx->res_list_tpg;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+		hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+		CAM_DBG(CAM_ISP, "TPG ctrl config for hw %u",
+			hw_intf->hw_idx);
+		if (hw_intf->hw_ops.process_cmd) {
+			rc = hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_TPG_CORE_CFG_CMD, tpg_config,
+				sizeof(struct cam_isp_tpg_core_config));
+			if (rc)
+				goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_isp_blob_sensor_config(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_sensor_config          *dim_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_mgr_ctx                   *ctx = NULL;
+	struct cam_isp_hw_mgr_res                   *hw_mgr_res;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_ife_sensor_dimension_update_args  update_args;
+	int                                          rc = -EINVAL, found = 0;
+	uint32_t                                     i, j;
+	struct cam_isp_sensor_dimension             *path_config;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			found = 1;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				path_config = &(dim_config->ipp_path);
+				update_args.ipp_path.width =
+					path_config->width;
+				update_args.ipp_path.height =
+					path_config->height;
+				update_args.ipp_path.measure_enabled =
+					path_config->measure_enabled;
+				path_config = &(dim_config->ppp_path);
+				update_args.ppp_path.width =
+					path_config->width;
+				update_args.ppp_path.height =
+					path_config->height;
+				update_args.ppp_path.measure_enabled =
+					path_config->measure_enabled;
+				for (j = 0; j < CAM_IFE_RDI_NUM_MAX; j++) {
+					path_config =
+						&(dim_config->rdi_path[j]);
+					update_args.rdi_path[j].width =
+						path_config->width;
+					update_args.rdi_path[j].height =
+						path_config->height;
+				update_args.rdi_path[j].measure_enabled =
+						path_config->measure_enabled;
+				}
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_IFE_CSID_SET_SENSOR_DIMENSION_CFG,
+					&update_args,
+					sizeof(
+					struct
+					cam_ife_sensor_dimension_update_args)
+					);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Dimension Update failed");
+					break;
+				}
+			} else
+				CAM_ERR(CAM_ISP, "hw_intf is NULL");
+		}
+		if (found)
+			break;
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_vfe_out_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_vfe_out_config         *vfe_out_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_isp_vfe_wm_config          *wm_config;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_ife_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *ife_out_res;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    num_ent, rc = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	if (prepare->num_hw_update_entries + 1 >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient HW entries :%d",
+			prepare->num_hw_update_entries);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < vfe_out_config->num_ports; i++) {
+		wm_config = &vfe_out_config->wm_config_flex[i];
+		res_id_out = wm_config->port_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "VFE out config idx: %d port: 0x%x",
+			i, wm_config->port_type);
+
+		if (res_id_out >= max_ife_out_res) {
+			CAM_ERR(CAM_ISP, "Invalid out port:0x%x",
+				wm_config->port_type);
+			return -EINVAL;
+		}
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+			"No free kmd memory for base idx: %d",
+			blob_info->base_info->idx);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			(kmd_buf_info->used_bytes / 4) +
+			(total_used_bytes / 4);
+		ife_out_res = &ctx->res_list_ife_out[res_id_out];
+
+		rc = cam_isp_add_cmd_buf_update(
+			ife_out_res, blob_type,
+			blob_type_hw_cmd_map[blob_type],
+			blob_info->base_info->idx,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)wm_config,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed to update VFE Out out_type:0x%X base_idx:%d bytes_used:%u rc:%d",
+				wm_config->port_type, blob_info->base_info->idx,
+				bytes_used, rc);
+			return rc;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = total_used_bytes;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		num_ent++;
+		kmd_buf_info->used_bytes += total_used_bytes;
+		kmd_buf_info->offset     += total_used_bytes;
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_csid_config_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_csid_epd_config        *epd_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_ife_hw_mgr_ctx                   *ctx = NULL;
+	struct cam_isp_hw_mgr_res                   *hw_mgr_res;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_ife_csid_epd_update_args         epd_update_args;
+	int                                         rc = -EINVAL;
+	uint32_t                                    i = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				epd_update_args.epd_supported =
+					epd_config->is_epd_supported;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_IFE_CSID_SET_CONFIG,
+					&epd_update_args,
+					sizeof(
+					struct cam_ife_csid_epd_update_args)
+					);
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"Failed to epd config:%d",
+						epd_config->is_epd_supported);
+			} else {
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+			}
+
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_blob_sensor_blanking_config(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_sensor_blanking_config *sensor_blanking_config,
+	struct cam_hw_prepare_update_args     *prepare)
+
+{
+	struct cam_ife_hw_mgr_ctx       *ctx = NULL;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+	struct cam_hw_intf              *hw_intf;
+	struct cam_isp_blanking_config  blanking_config;
+	int                             rc = 0, i;
+
+	ctx = prepare->ctxt_to_hw_map;
+	if (list_empty(&ctx->res_list_ife_src)) {
+		CAM_ERR(CAM_ISP, "Mux List empty");
+		return -ENODEV;
+	}
+
+	list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			blanking_config.node_res = hw_mgr_res->hw_res[i];
+			blanking_config.vbi = sensor_blanking_config->vbi;
+			blanking_config.hbi = sensor_blanking_config->hbi;
+
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BLANKING_UPDATE,
+					&blanking_config,
+					sizeof(
+					struct cam_isp_blanking_config));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"blanking update failed");
+			}
+		}
+	}
+	return rc;
+}
+
+static int cam_isp_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	int rc = 0;
+	struct cam_isp_generic_blob_info *blob_info = user_data;
+	struct cam_ife_hw_mgr_ctx *ife_mgr_ctx = NULL;
+	struct cam_hw_prepare_update_args *prepare = NULL;
+
+	if (!blob_data || (blob_size == 0) || !blob_info) {
+		CAM_ERR(CAM_ISP, "Invalid args data %pK size %d info %pK",
+			blob_data, blob_size, blob_info);
+		return -EINVAL;
+	}
+
+	prepare = blob_info->prepare;
+	if (!prepare || !prepare->ctxt_to_hw_map) {
+		CAM_ERR(CAM_ISP, "Failed. prepare is NULL, blob_type %d",
+			blob_type);
+		return -EINVAL;
+	}
+
+	ife_mgr_ctx = prepare->ctxt_to_hw_map;
+	CAM_DBG(CAM_ISP, "Context[%pK][%d] blob_type=%d, blob_size=%d",
+		ife_mgr_ctx, ife_mgr_ctx->ctx_index, blob_type, blob_size);
+
+	switch (blob_type) {
+	case CAM_ISP_GENERIC_BLOB_TYPE_HFR_CONFIG: {
+		struct cam_isp_resource_hfr_config    *hfr_config;
+
+		if (blob_size < sizeof(struct cam_isp_resource_hfr_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		hfr_config = (struct cam_isp_resource_hfr_config *)blob_data;
+
+		if (hfr_config->num_ports > g_ife_hw_mgr.max_vfe_out_res_type ||
+			hfr_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in HFR config",
+				hfr_config->num_ports);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (hfr_config->num_ports != 1) {
+			if (sizeof(struct cam_isp_port_hfr_config) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_resource_hfr_config)) /
+				(hfr_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in hfr config num_ports:%u size per port:%lu",
+					hfr_config->num_ports,
+					sizeof(struct cam_isp_port_hfr_config));
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_isp_resource_hfr_config) +
+			(hfr_config->num_ports - 1) *
+			sizeof(struct cam_isp_port_hfr_config))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_isp_resource_hfr_config) +
+				(hfr_config->num_ports - 1) *
+				sizeof(struct cam_isp_port_hfr_config));
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_hfr_update(blob_type, blob_info,
+			hfr_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "HFR Update Failed");
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_CLOCK_CONFIG: {
+		struct cam_isp_clock_config    *clock_config;
+
+		if (blob_size < sizeof(struct cam_isp_clock_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		clock_config = (struct cam_isp_clock_config *)blob_data;
+
+		if (clock_config->num_rdi > CAM_IFE_RDI_NUM_MAX) {
+			CAM_ERR(CAM_ISP, "Invalid num_rdi %u in clock config",
+				clock_config->num_rdi);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (clock_config->num_rdi > 1) {
+			if (sizeof(uint64_t) > ((UINT_MAX -
+				sizeof(struct cam_isp_clock_config)) /
+				(clock_config->num_rdi - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in clock config num_rdi:%u size per port:%lu",
+					clock_config->num_rdi,
+					sizeof(uint64_t));
+				return -EINVAL;
+			}
+		}
+
+		if ((clock_config->num_rdi != 0) && (blob_size <
+			(sizeof(struct cam_isp_clock_config) +
+			sizeof(uint64_t) * (clock_config->num_rdi - 1)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(uint32_t) * 2 + sizeof(uint64_t) *
+				(clock_config->num_rdi + 2));
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_clock_update(blob_type, blob_info,
+			clock_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_PERF, "Clock Update Failed, rc=%d", rc);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG: {
+		struct cam_isp_bw_config    *bw_config;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+		struct cam_isp_bw_config    *bw_config_u;
+		size_t bw_config_size;
+
+		CAM_WARN_RATE_LIMIT_CUSTOM(CAM_PERF, 300, 1,
+			"Deprecated Blob TYPE_BW_CONFIG");
+		if (blob_size < sizeof(struct cam_isp_bw_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		bw_config_u = (struct cam_isp_bw_config *)blob_data;
+
+		if (bw_config_u->num_rdi > CAM_IFE_RDI_NUM_MAX || !bw_config_u->num_rdi) {
+			CAM_ERR(CAM_ISP, "Invalid num_rdi %u in bw config",
+				bw_config_u->num_rdi);
+			return -EINVAL;
+		}
+
+		bw_config_size = sizeof(struct cam_isp_bw_config) + ((bw_config_u->num_rdi-1)*
+					sizeof(struct cam_isp_bw_vote));
+
+		rc = cam_common_mem_kdup((void **)&bw_config, bw_config_u, bw_config_size);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Alloc and copy request bw_config failed");
+			return rc;
+		}
+		if (bw_config_u->num_rdi != bw_config->num_rdi) {
+				CAM_ERR(CAM_ISP, "num_rdi changed,userspace:%d, kernel:%d",
+						bw_config_u->num_rdi, bw_config->num_rdi);
+				cam_common_mem_free(bw_config);
+				return -EINVAL;
+		}
+		/* Check for integer overflow */
+		if (bw_config->num_rdi > 1) {
+			if (sizeof(struct cam_isp_bw_vote) > ((UINT_MAX -
+				sizeof(struct cam_isp_bw_config)) /
+				(bw_config->num_rdi - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in bw config num_rdi:%u size per port:%lu",
+					bw_config->num_rdi,
+					sizeof(struct cam_isp_bw_vote));
+				cam_common_mem_free(bw_config);
+				return -EINVAL;
+			}
+		}
+
+		if ((bw_config->num_rdi != 0) && (blob_size <
+			(sizeof(struct cam_isp_bw_config) +
+			(bw_config->num_rdi - 1) *
+			sizeof(struct cam_isp_bw_vote)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size, sizeof(struct cam_isp_bw_config) +
+				(bw_config->num_rdi - 1) *
+				sizeof(struct cam_isp_bw_vote));
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		if (!prepare || !prepare->priv ||
+			(bw_config->usage_type >= CAM_IFE_HW_NUM_MAX)) {
+			CAM_ERR(CAM_ISP, "Invalid inputs usage type %d",
+				bw_config->usage_type);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+
+		memcpy(&prepare_hw_data->bw_config[bw_config->usage_type],
+			bw_config, sizeof(prepare_hw_data->bw_config[0]));
+		prepare_hw_data->bw_config_version = CAM_ISP_BW_CONFIG_V1;
+		prepare_hw_data->bw_config_valid[bw_config->usage_type] = true;
+		cam_common_mem_free(bw_config);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V2: {
+		size_t bw_config_size = 0;
+		struct cam_isp_bw_config_v2    *bw_config;
+		struct cam_isp_bw_config_v2    *bw_config_u;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+
+		if (blob_size < sizeof(struct cam_isp_bw_config_v2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		bw_config_u = (struct cam_isp_bw_config_v2 *)blob_data;
+
+		if (bw_config_u->num_paths > CAM_ISP_MAX_PER_PATH_VOTES ||
+			!bw_config_u->num_paths) {
+			CAM_ERR(CAM_ISP, "Invalid num paths %d",
+				bw_config_u->num_paths);
+			return -EINVAL;
+		}
+
+		bw_config_size = sizeof(struct cam_isp_bw_config_v2) + ((bw_config_u->num_paths-1)*
+					sizeof(struct cam_axi_per_path_bw_vote));
+
+		rc = cam_common_mem_kdup((void **)&bw_config, bw_config_u, bw_config_size);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Alloc and copy request bw_config failed");
+			return rc;
+		}
+
+		if (bw_config_u->num_paths != bw_config->num_paths) {
+			CAM_ERR(CAM_ISP, "num_paths changed,userspace:%d, kernel:%d", bw_config_u->num_paths,
+					bw_config->num_paths);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+		/* Check for integer overflow */
+		if (bw_config->num_paths > 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_bw_config_v2)) /
+				(bw_config->num_paths - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Size exceeds limit paths:%u size per path:%lu",
+					bw_config->num_paths - 1,
+					sizeof(
+					struct cam_axi_per_path_bw_vote));
+				cam_common_mem_free(bw_config);
+				return -EINVAL;
+			}
+		}
+
+		if ((bw_config->num_paths != 0) && (blob_size <
+			(sizeof(struct cam_isp_bw_config_v2) +
+			(bw_config->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote)))) {
+			CAM_ERR(CAM_ISP,
+				"Invalid blob size: %u, num_paths: %u, bw_config size: %lu, per_path_vote size: %lu",
+				blob_size, bw_config->num_paths,
+				sizeof(struct cam_isp_bw_config_v2),
+				sizeof(struct cam_axi_per_path_bw_vote));
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		if (!prepare || !prepare->priv ||
+			(bw_config->usage_type >= CAM_IFE_HW_NUM_MAX)) {
+			CAM_ERR(CAM_ISP, "Invalid inputs usage type %d",
+				bw_config->usage_type);
+			cam_common_mem_free(bw_config);
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+
+		memset(&prepare_hw_data->bw_config_v2[bw_config->usage_type],
+			0, sizeof(
+			prepare_hw_data->bw_config_v2[bw_config->usage_type]));
+		bw_config_size = sizeof(struct cam_isp_bw_config_v2) +
+			((bw_config->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote));
+		memcpy(&prepare_hw_data->bw_config_v2[bw_config->usage_type],
+			bw_config, bw_config_size);
+
+		prepare_hw_data->bw_config_version = CAM_ISP_BW_CONFIG_V2;
+		prepare_hw_data->bw_config_valid[bw_config->usage_type] = true;
+		cam_common_mem_free(bw_config);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG: {
+		struct cam_ubwc_config *ubwc_config;
+
+		if (blob_size < sizeof(struct cam_ubwc_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob_size %u", blob_size);
+			return -EINVAL;
+		}
+
+		ubwc_config = (struct cam_ubwc_config *)blob_data;
+
+		if (ubwc_config->num_ports > CAM_VFE_MAX_UBWC_PORTS ||
+			ubwc_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in ubwc config",
+				ubwc_config->num_ports);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (ubwc_config->num_ports != 1) {
+			if (sizeof(struct cam_ubwc_plane_cfg_v1) >
+				((UINT_MAX - sizeof(struct cam_ubwc_config)) /
+				((ubwc_config->num_ports - 1) * 2))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in ubwc config num_ports:%u size per port:%lu",
+					ubwc_config->num_ports,
+					sizeof(struct cam_ubwc_plane_cfg_v1) *
+					2);
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_ubwc_config) +
+			(ubwc_config->num_ports - 1) *
+			sizeof(struct cam_ubwc_plane_cfg_v1) * 2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob_size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_ubwc_config) +
+				(ubwc_config->num_ports - 1) *
+				sizeof(struct cam_ubwc_plane_cfg_v1) * 2);
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_ubwc_update(blob_type, blob_info,
+			ubwc_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "UBWC Update Failed rc: %d", rc);
+	}
+		break;
+
+	case CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG_V2: {
+		struct cam_ubwc_config_v2 *ubwc_config;
+
+		if (blob_size < sizeof(struct cam_ubwc_config_v2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob_size %u", blob_size);
+			return -EINVAL;
+		}
+
+		ubwc_config = (struct cam_ubwc_config_v2 *)blob_data;
+
+		if (ubwc_config->num_ports > CAM_VFE_MAX_UBWC_PORTS ||
+			ubwc_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in ubwc config",
+				ubwc_config->num_ports);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (ubwc_config->num_ports != 1) {
+			if (sizeof(struct cam_ubwc_plane_cfg_v2) >
+				((UINT_MAX - sizeof(struct cam_ubwc_config_v2))
+				/ ((ubwc_config->num_ports - 1) * 2))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in ubwc config num_ports:%u size per port:%lu",
+					ubwc_config->num_ports,
+					sizeof(struct cam_ubwc_plane_cfg_v2) *
+					2);
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_ubwc_config_v2) +
+			(ubwc_config->num_ports - 1) *
+			sizeof(struct cam_ubwc_plane_cfg_v2) * 2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob_size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_ubwc_config_v2) +
+				(ubwc_config->num_ports - 1) *
+				sizeof(struct cam_ubwc_plane_cfg_v2) * 2);
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_ubwc_update_v2(blob_type, blob_info,
+			ubwc_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "UBWC Update Failed rc: %d", rc);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG: {
+		struct cam_isp_csid_clock_config    *clock_config;
+
+		if (blob_size < sizeof(struct cam_isp_csid_clock_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_isp_csid_clock_config));
+			return -EINVAL;
+		}
+
+		clock_config = (struct cam_isp_csid_clock_config *)blob_data;
+
+		rc = cam_isp_blob_csid_clock_update(blob_type, blob_info,
+			clock_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Clock Update Failed");
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_CSID_QCFA_CONFIG: {
+		struct cam_isp_csid_qcfa_config *qcfa_config;
+
+		if (blob_size < sizeof(struct cam_isp_csid_qcfa_config)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid qcfa blob size %u expected %u",
+				blob_size,
+				sizeof(struct cam_isp_csid_qcfa_config));
+			return -EINVAL;
+		}
+
+		qcfa_config = (struct cam_isp_csid_qcfa_config *)blob_data;
+
+		rc = cam_isp_blob_csid_qcfa_update(blob_type, blob_info,
+				qcfa_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "QCFA Update Failed rc: %d", rc);
+
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_FE_CONFIG: {
+		struct cam_fe_config *fe_config;
+
+		if (blob_size < sizeof(struct cam_fe_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size, sizeof(struct cam_fe_config));
+			return -EINVAL;
+		}
+
+		fe_config = (struct cam_fe_config *)blob_data;
+
+		rc = cam_isp_blob_fe_update(blob_type, blob_info,
+			fe_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "FS Update Failed rc: %d", rc);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_IFE_CORE_CONFIG: {
+		struct cam_isp_core_config *core_config;
+
+		if (blob_size < sizeof(struct cam_isp_core_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size, sizeof(struct cam_isp_core_config));
+			return -EINVAL;
+		}
+
+		core_config = (struct cam_isp_core_config *)blob_data;
+
+		rc = cam_isp_blob_core_cfg_update(blob_type, blob_info,
+			core_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Core cfg update fail: %d", rc);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_VFE_OUT_CONFIG: {
+		struct cam_isp_vfe_out_config *vfe_out_config;
+
+		if (blob_size < sizeof(struct cam_isp_vfe_out_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u, ctx_idx: %u",
+				blob_size, ife_mgr_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		vfe_out_config = (struct cam_isp_vfe_out_config *)blob_data;
+
+		if (vfe_out_config->num_ports > max_ife_out_res ||
+			vfe_out_config->num_ports == 0) {
+			CAM_ERR(CAM_ISP,
+				"Invalid num_ports:%u in vfe out config, ctx_idx: %u",
+				vfe_out_config->num_ports, ife_mgr_ctx->ctx_index);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (vfe_out_config->num_ports != 1) {
+			if (sizeof(struct cam_isp_vfe_wm_config) > ((UINT_MAX -
+				sizeof(struct cam_isp_vfe_out_config)) /
+				(vfe_out_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in vfe out config num_ports:%u size per port:%lu",
+					vfe_out_config->num_ports,
+					sizeof(struct cam_isp_vfe_wm_config));
+				return -EINVAL;
+			}
+		}
+
+		if (blob_size < (sizeof(struct cam_isp_vfe_out_config) +
+			(vfe_out_config->num_ports - 1) *
+			sizeof(struct cam_isp_vfe_wm_config))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size, sizeof(struct cam_isp_vfe_out_config)
+				+ (vfe_out_config->num_ports - 1) *
+				sizeof(struct cam_isp_vfe_wm_config));
+			return -EINVAL;
+		}
+
+		rc = cam_isp_blob_vfe_out_update(blob_type, blob_info,
+			vfe_out_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "VFE out update failed rc: %d", rc);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_CSID_CONFIG: {
+		struct cam_isp_csid_epd_config *epd_config;
+
+		if (blob_size < sizeof(struct cam_isp_csid_epd_config)) {
+			CAM_ERR(CAM_ISP,
+				"Invalid epd config blob size %u expected %u",
+				blob_size,
+				sizeof(struct cam_isp_csid_epd_config));
+			return -EINVAL;
+		}
+		epd_config = (struct cam_isp_csid_epd_config *)blob_data;
+		rc = cam_isp_blob_csid_config_update(blob_type, blob_info,
+			epd_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "CSID Config failed rc: %d", rc);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SENSOR_BLANKING_CONFIG: {
+		struct cam_isp_sensor_blanking_config  *sensor_blanking_config;
+
+		if (blob_size < sizeof(struct cam_isp_sensor_blanking_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %zu expected %zu",
+				blob_size,
+				sizeof(struct cam_isp_sensor_blanking_config));
+			return -EINVAL;
+		}
+		sensor_blanking_config =
+			(struct cam_isp_sensor_blanking_config *)blob_data;
+
+		rc = cam_isp_blob_sensor_blanking_config(blob_type, blob_info,
+			sensor_blanking_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Epoch Configuration Update Failed rc:%d", rc);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_SENSOR_DIMENSION_CONFIG: {
+		struct cam_isp_sensor_config *csid_dim_config;
+
+		if (blob_size < sizeof(struct cam_isp_sensor_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %zu expected %zu",
+				blob_size,
+				sizeof(struct cam_isp_sensor_config));
+			return -EINVAL;
+		}
+
+		csid_dim_config =
+			(struct cam_isp_sensor_config *)blob_data;
+
+		rc = cam_isp_blob_sensor_config(blob_type, blob_info,
+			csid_dim_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Sensor Dimension Update Failed rc: %d", rc);
+	}
+		break;
+	case CAM_ISP_GENERIC_BLOB_TYPE_TPG_CORE_CONFIG: {
+		struct cam_isp_tpg_core_config *tpg_config;
+
+		if (blob_size < sizeof(struct cam_isp_tpg_core_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %zu expected %zu",
+				blob_size,
+				sizeof(struct cam_isp_tpg_core_config));
+			return -EINVAL;
+		}
+
+		tpg_config =
+			(struct cam_isp_tpg_core_config *)blob_data;
+
+		rc = cam_isp_blob_tpg_config(tpg_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"TPG config failed rc: %d", rc);
+	}
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "Invalid blob type %d", blob_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_util_insert_frame_header(
+	struct cam_kmd_buf_info *kmd_buf,
+	struct cam_isp_prepare_hw_update_data *prepare_hw_data)
+{
+	int mmu_hdl = -1, rc = 0;
+	dma_addr_t iova_addr;
+	uint32_t frame_header_iova, padded_bytes = 0;
+	size_t len;
+	struct cam_ife_hw_mgr *hw_mgr = &g_ife_hw_mgr;
+
+	mmu_hdl = cam_mem_is_secure_buf(
+			kmd_buf->handle) ?
+			hw_mgr->mgr_common.img_iommu_hdl_secure :
+			hw_mgr->mgr_common.img_iommu_hdl;
+
+	rc = cam_mem_get_io_buf(kmd_buf->handle, mmu_hdl,
+		&iova_addr, &len);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Failed to get io addr for handle = %d for mmu_hdl = %u",
+			kmd_buf->handle, mmu_hdl);
+		return rc;
+	}
+
+	frame_header_iova = (uint32_t)iova_addr;
+	frame_header_iova += kmd_buf->offset;
+
+	/* frame header address needs to be 16 byte aligned */
+	if (frame_header_iova % 16) {
+		padded_bytes = (uint32_t)(16 - (frame_header_iova % 16));
+		frame_header_iova += padded_bytes;
+	}
+
+	prepare_hw_data->frame_header_iova = frame_header_iova;
+
+	/* update the padding if any for the cpu addr as well */
+	prepare_hw_data->frame_header_cpu_addr = kmd_buf->cpu_addr +
+			(padded_bytes / 4);
+
+	CAM_DBG(CAM_ISP,
+		"Frame Header iova_addr: %pK cpu_addr: %pK padded_bytes: %llu",
+		prepare_hw_data->frame_header_iova,
+		prepare_hw_data->frame_header_cpu_addr,
+		padded_bytes);
+
+	/* Reserve memory for frame header */
+	kmd_buf->used_bytes += 128;
+	kmd_buf->offset += kmd_buf->used_bytes;
+
+	return rc;
+}
+
+static int cam_ife_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int rc = 0;
+	struct cam_hw_prepare_update_args *prepare =
+		(struct cam_hw_prepare_update_args *) prepare_hw_update_args;
+
+	struct cam_ife_hw_mgr_ctx               *ctx;
+	struct cam_ife_hw_mgr                   *hw_mgr;
+	struct cam_kmd_buf_info                  kmd_buf;
+	uint32_t                                 i;
+	bool                                     fill_fence = true;
+	bool                                     frame_header_enable = false;
+	struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+	struct cam_isp_frame_header_info         frame_header_info;
+	struct cam_isp_change_base_args          change_base_info = {0};
+
+	if (!hw_mgr_priv || !prepare_hw_update_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+		prepare->priv;
+
+	ctx = (struct cam_ife_hw_mgr_ctx *) prepare->ctxt_to_hw_map;
+	hw_mgr = (struct cam_ife_hw_mgr *)hw_mgr_priv;
+
+
+	CAM_DBG(CAM_REQ, "ctx[%pK][%d] Enter for req_id %lld",
+		ctx, ctx->ctx_index, prepare->packet->header.request_id);
+
+	rc = cam_packet_util_validate_packet(prepare->packet,
+		prepare->remain_len);
+	if (rc)
+		return rc;
+
+	/* Pre parse the packet*/
+	rc = cam_packet_util_get_kmd_buffer(prepare->packet, &kmd_buf);
+	if (rc)
+		return rc;
+
+	if (ctx->custom_config & CAM_IFE_CUSTOM_CFG_FRAME_HEADER_TS) {
+		rc = cam_ife_mgr_util_insert_frame_header(&kmd_buf,
+			prepare_hw_data);
+		if (rc)
+			return rc;
+
+		frame_header_enable = true;
+		prepare_hw_data->frame_header_res_id = 0x0;
+	}
+
+	if (ctx->internal_cdm)
+		rc = cam_packet_util_process_patches(prepare->packet,
+			hw_mgr->mgr_common.img_iommu_hdl,
+			hw_mgr->mgr_common.img_iommu_hdl_secure);
+	else
+		rc = cam_packet_util_process_patches(prepare->packet,
+			hw_mgr->mgr_common.cmd_iommu_hdl,
+			hw_mgr->mgr_common.cmd_iommu_hdl_secure);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Patch ISP packet failed.");
+		return rc;
+	}
+
+	prepare->num_hw_update_entries = 0;
+	prepare->num_in_map_entries = 0;
+	prepare->num_out_map_entries = 0;
+	prepare->num_reg_dump_buf = 0;
+
+	memset(&prepare_hw_data->bw_config[0], 0x0,
+		sizeof(prepare_hw_data->bw_config[0]) *
+		CAM_IFE_HW_NUM_MAX);
+	memset(&prepare_hw_data->bw_config_valid[0], 0x0,
+		sizeof(prepare_hw_data->bw_config_valid[0]) *
+		CAM_IFE_HW_NUM_MAX);
+
+	for (i = 0; i < ctx->num_base; i++) {
+		CAM_DBG(CAM_ISP, "process cmd buffer for device %d", i);
+
+		CAM_DBG(CAM_ISP,
+			"change base i=%d, idx=%d, ctx->internal_cdm = %d",
+			i, ctx->base[i].idx, ctx->internal_cdm);
+
+		/* Add change base */
+		if (!ctx->internal_cdm) {
+			change_base_info.base_idx = ctx->base[i].idx;
+			change_base_info.cdm_id = ctx->cdm_id;
+			rc = cam_isp_add_change_base(prepare,
+				&ctx->res_list_ife_src,
+				&change_base_info, &kmd_buf);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+				"Failed in change base i=%d, idx=%d, rc=%d",
+				i, ctx->base[i].idx, rc);
+				goto end;
+			}
+		}
+		/* get command buffers */
+		if (ctx->base[i].split_id != CAM_ISP_HW_SPLIT_MAX) {
+			rc = cam_isp_add_command_buffers(prepare, &kmd_buf,
+				&ctx->base[i],
+				cam_isp_packet_generic_blob_handler,
+				ctx->res_list_ife_out, max_ife_out_res);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in add cmdbuf, i=%d, split_id=%d, rc=%d",
+					i, ctx->base[i].split_id, rc);
+				goto end;
+			}
+		}
+
+		memset(&frame_header_info, 0,
+			sizeof(struct cam_isp_frame_header_info));
+		if (frame_header_enable) {
+			frame_header_info.frame_header_enable = true;
+			frame_header_info.frame_header_iova_addr =
+				prepare_hw_data->frame_header_iova;
+		}
+
+		/* get IO buffers */
+		mutex_lock(&g_ife_hw_mgr.wm_cfg_mutex[ctx->base[i].idx]);
+		rc = cam_isp_add_io_buffers(
+			hw_mgr->mgr_common.img_iommu_hdl,
+			hw_mgr->mgr_common.img_iommu_hdl_secure,
+			prepare, ctx->base[i].idx,
+			&kmd_buf, ctx->res_list_ife_out,
+			&ctx->res_list_ife_in_rd,
+			max_ife_out_res, fill_fence,
+			&frame_header_info);
+		mutex_unlock(&g_ife_hw_mgr.wm_cfg_mutex[ctx->base[i].idx]);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in io buffers, i=%d, rc=%d",
+				i, rc);
+			goto end;
+		}
+
+		/* fence map table entries need to fill only once in the loop */
+		if (fill_fence)
+			fill_fence = false;
+
+		if (frame_header_info.frame_header_res_id &&
+			frame_header_enable) {
+			frame_header_enable = false;
+			prepare_hw_data->frame_header_res_id =
+				frame_header_info.frame_header_res_id;
+
+			CAM_DBG(CAM_ISP,
+				"Frame header enabled for res_id 0x%x cpu_addr %pK",
+				prepare_hw_data->frame_header_res_id,
+				prepare_hw_data->frame_header_cpu_addr);
+		}
+	}
+
+	/* Check if frame header was enabled for any WM */
+	if ((ctx->custom_config & CAM_IFE_CUSTOM_CFG_FRAME_HEADER_TS) &&
+		(prepare->num_out_map_entries) &&
+		(!prepare_hw_data->frame_header_res_id)) {
+		CAM_ERR(CAM_ISP, "Failed to configure frame header");
+		goto end;
+	}
+
+	/*
+	 * reg update will be done later for the initial configure.
+	 * need to plus one to the op_code and only take the lower
+	 * bits to get the type of operation since UMD definition
+	 * of op_code has some difference from KMD.
+	 */
+	if (((prepare->packet->header.op_code + 1) & 0xF) ==
+		CAM_ISP_PACKET_INIT_DEV) {
+		prepare_hw_data->packet_opcode_type = CAM_ISP_PACKET_INIT_DEV;
+
+		if ((!prepare->num_reg_dump_buf) || (prepare->num_reg_dump_buf >
+			CAM_REG_DUMP_MAX_BUF_ENTRIES))
+			goto end;
+
+		if (!ctx->num_reg_dump_buf) {
+			ctx->num_reg_dump_buf = prepare->num_reg_dump_buf;
+
+			memcpy(ctx->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare->num_reg_dump_buf);
+		} else {
+			prepare_hw_data->num_reg_dump_buf =
+				prepare->num_reg_dump_buf;
+			memcpy(prepare_hw_data->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare_hw_data->num_reg_dump_buf);
+		}
+
+		goto end;
+	} else {
+		prepare_hw_data->packet_opcode_type = CAM_ISP_PACKET_UPDATE_DEV;
+		prepare_hw_data->num_reg_dump_buf = prepare->num_reg_dump_buf;
+		if ((prepare_hw_data->num_reg_dump_buf) &&
+			(prepare_hw_data->num_reg_dump_buf <
+			CAM_REG_DUMP_MAX_BUF_ENTRIES)) {
+			memcpy(prepare_hw_data->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare_hw_data->num_reg_dump_buf);
+		}
+	}
+
+	/* add reg update commands */
+	for (i = 0; i < ctx->num_base; i++) {
+		change_base_info.base_idx = ctx->base[i].idx;
+		change_base_info.cdm_id = ctx->cdm_id;
+		/* Add change base */
+		if (!ctx->internal_cdm) {
+			rc = cam_isp_add_change_base(prepare,
+				&ctx->res_list_ife_src,
+				&change_base_info, &kmd_buf);
+
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in change base adding reg_update cmd i=%d, idx=%d, rc=%d",
+					i, ctx->base[i].idx, rc);
+				goto end;
+			}
+		}
+		/*Add reg update */
+		rc = cam_isp_add_reg_update(prepare, &ctx->res_list_ife_src,
+			ctx->base[i].idx, &kmd_buf);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Add Reg_update cmd Failed i=%d, idx=%d, rc=%d",
+				i, ctx->base[i].idx, rc);
+			goto end;
+		}
+	}
+
+	/* add go_cmd for offline context */
+	if (prepare->num_out_map_entries && prepare->num_in_map_entries &&
+		ctx->is_offline) {
+		rc = cam_isp_add_go_cmd(prepare, &ctx->res_list_ife_in_rd,
+			ctx->base[i].idx, &kmd_buf);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"Add GO_CMD faled i: %d, idx: %d, rc: %d",
+				i, ctx->base[i].idx, rc);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_resume_hw(struct cam_ife_hw_mgr_ctx *ctx)
+{
+	return cam_ife_mgr_bw_control(ctx, CAM_VFE_BW_CONTROL_INCLUDE);
+}
+
+static int cam_ife_mgr_sof_irq_debug(
+	struct cam_ife_hw_mgr_ctx *ctx,
+	uint32_t sof_irq_enable)
+{
+	int rc = 0;
+	uint32_t i = 0;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res = NULL;
+	struct cam_hw_intf            *hw_intf = NULL;
+	struct cam_isp_resource_node  *rsrc_node = NULL;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc |= hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_IFE_CSID_SOF_IRQ_DEBUG,
+					&sof_irq_enable,
+					sizeof(sof_irq_enable));
+			}
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rsrc_node = hw_mgr_res->hw_res[i];
+			if (rsrc_node->process_cmd && (rsrc_node->res_id ==
+				CAM_ISP_HW_VFE_IN_CAMIF)) {
+				rc |= hw_mgr_res->hw_res[i]->process_cmd(
+					hw_mgr_res->hw_res[i],
+					CAM_ISP_HW_CMD_SOF_IRQ_DEBUG,
+					&sof_irq_enable,
+					sizeof(sof_irq_enable));
+			}
+		}
+	}
+
+	return rc;
+}
+
+static void cam_ife_mgr_print_io_bufs(struct cam_ife_hw_mgr  *hw_mgr,
+		uint32_t res_id, struct cam_packet *packet,
+		bool    *ctx_found, struct cam_ife_hw_mgr_ctx *ctx)
+{
+
+	struct cam_buf_io_cfg  *io_cfg = NULL;
+	int32_t      mmu_hdl, iommu_hdl, sec_mmu_hdl;
+	dma_addr_t   iova_addr;
+	size_t        src_buf_size;
+	int  i, j, rc = 0;
+
+	iommu_hdl = hw_mgr->mgr_common.img_iommu_hdl;
+	sec_mmu_hdl = hw_mgr->mgr_common.img_iommu_hdl_secure;
+
+	io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload +
+		packet->io_configs_offset / 4);
+
+	for (i = 0; i < packet->num_io_configs; i++) {
+		if (io_cfg[i].resource_type != res_id)
+			continue;
+		else
+			break;
+		}
+
+		if (i == packet->num_io_configs) {
+			*ctx_found = false;
+			CAM_ERR(CAM_ISP,
+				"getting io port for mid resource id failed ctx id:%d req id:%lld res id:0x%x",
+				ctx->ctx_index, packet->header.request_id,
+				res_id);
+			return;
+		}
+
+		for (j = 0; j < CAM_PACKET_MAX_PLANES; j++) {
+			if (!io_cfg[i].mem_handle[j])
+				break;
+
+			CAM_INFO(CAM_ISP, "port: 0x%x f: %u format: %d dir %d",
+				io_cfg[i].resource_type,
+				io_cfg[i].fence,
+				io_cfg[i].format,
+				io_cfg[i].direction);
+
+			mmu_hdl = cam_mem_is_secure_buf(
+				io_cfg[i].mem_handle[j]) ? sec_mmu_hdl :
+				iommu_hdl;
+			rc = cam_mem_get_io_buf(io_cfg[i].mem_handle[j],
+				mmu_hdl, &iova_addr, &src_buf_size);
+			if (rc < 0) {
+				CAM_ERR(CAM_ISP,
+					"get src buf address fail mem_handle 0x%x",
+					io_cfg[i].mem_handle[j]);
+				continue;
+			}
+			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {
+				CAM_ERR(CAM_ISP, "Invalid mapped address");
+				continue;
+			}
+
+			CAM_INFO(CAM_ISP,
+				"pln %d w %d h %d s %u size 0x%x addr 0x%x end_addr 0x%x offset %x memh %x",
+				j, io_cfg[i].planes[j].width,
+				io_cfg[i].planes[j].height,
+				io_cfg[i].planes[j].plane_stride,
+				(unsigned int)src_buf_size,
+				(unsigned int)iova_addr,
+				(unsigned int)iova_addr +
+				(unsigned int)src_buf_size,
+				io_cfg[i].offsets[j],
+				io_cfg[i].mem_handle[j]);
+		}
+}
+
+static void cam_ife_mgr_pf_dump(uint32_t res_id,
+	struct cam_ife_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_hw_intf             *hw_intf;
+	struct cam_isp_hw_event_info    event_info;
+	uint32_t                        res_id_out;
+	int  i, rc = 0;
+
+	/* dump the registers  */
+	rc = cam_ife_mgr_handle_reg_dump(ctx, ctx->reg_dump_buf_desc,
+		ctx->num_reg_dump_buf,
+		CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR, NULL, false);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Reg dump on pf failed req id: %llu rc: %d",
+			ctx->applied_req_id, rc);
+
+
+	/* dump the acquire data */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_IFE_CSID_LOG_ACQUIRE_DATA,
+					hw_mgr_res->hw_res[i],
+					sizeof(void *));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"csid acquire data dump failed");
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	event_info.res_id = res_id;
+	res_id_out = res_id & 0xFF;
+
+	if (res_id_out >= max_ife_out_res) {
+		CAM_ERR(CAM_ISP, "Invalid out resource id :%x",
+			res_id);
+		return;
+	}
+
+	hw_mgr_res = &ctx->res_list_ife_out[res_id_out];
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+		hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.process_cmd) {
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+				(void *)&event_info,
+				sizeof(struct cam_isp_hw_event_info));
+		}
+	}
+}
+
+static void cam_ife_mgr_dump_pf_data(
+	struct cam_ife_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args *hw_cmd_args)
+{
+	struct cam_ife_hw_mgr_ctx *ctx;
+	struct cam_isp_hw_mgr_res          *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update    cmd_update;
+	struct cam_isp_hw_get_res_for_mid   get_res;
+	struct cam_packet                  *packet;
+	uint32_t    hw_id;
+	uint32_t    *resource_type;
+	bool         *ctx_found, hw_id_found = false;
+	int        i, j, rc = 0;
+
+	ctx = (struct cam_ife_hw_mgr_ctx *)hw_cmd_args->ctxt_to_hw_map;
+
+	packet  = hw_cmd_args->u.pf_args.pf_data.packet;
+	ctx_found = hw_cmd_args->u.pf_args.ctx_found;
+	resource_type = hw_cmd_args->u.pf_args.resource_type;
+
+	if ((*ctx_found) && (*resource_type))
+		goto outportlog;
+
+	if (ctx->pf_mid_found)
+		goto outportlog;
+
+	if (!g_ife_hw_mgr.hw_pid_support)
+		goto mid_check;
+
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (!hw_mgr->ife_devices[i])
+			continue;
+
+		for (j = 0; j < g_ife_hw_mgr.ife_devices[i]->num_hw_pid; j++) {
+			if (g_ife_hw_mgr.ife_devices[i]->hw_pid[j] ==
+				hw_cmd_args->u.pf_args.pid) {
+				hw_id_found = true;
+				hw_id = i;
+				break;
+			}
+		}
+		if (hw_id_found)
+			break;
+	}
+
+	if (i == CAM_IFE_HW_NUM_MAX) {
+		CAM_INFO(CAM_ISP,
+			"PID:%d is not matching with any IFE HW PIDs ctx id:%d",
+			hw_cmd_args->u.pf_args.pid,  ctx->ctx_index);
+		goto outportlog;
+	}
+
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].idx == hw_id) {
+			*ctx_found = true;
+			break;
+		}
+	}
+
+	if (!(*ctx_found)) {
+		CAM_INFO(CAM_ISP,
+			"This context does not cause pf:pid:%d hw id:%d ctx_id:%d",
+			hw_cmd_args->u.pf_args.pid, hw_id, ctx->ctx_index);
+		return;
+	}
+
+mid_check:
+	for (i = 0; i < max_ife_out_res; i++) {
+		hw_mgr_res = &ctx->res_list_ife_out[i];
+		if (!hw_mgr_res->hw_res[0])
+			continue;
+
+		break;
+	}
+
+	if (i >= max_ife_out_res) {
+		CAM_ERR(CAM_ISP,
+			"NO valid outport resources ctx id:%d req id:%lld",
+			ctx->ctx_index, packet->header.request_id);
+		return;
+	}
+
+	get_res.mid = hw_cmd_args->u.pf_args.mid;
+	cmd_update.res = hw_mgr_res->hw_res[0];
+	cmd_update.cmd_type = CAM_ISP_HW_CMD_GET_RES_FOR_MID;
+	cmd_update.data = (void *) &get_res;
+
+	/* get resource id for given mid */
+	rc = hw_mgr_res->hw_res[0]->hw_intf->hw_ops.process_cmd(
+		hw_mgr_res->hw_res[0]->hw_intf->hw_priv,
+		cmd_update.cmd_type, &cmd_update,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"getting mid port resource id failed ctx id:%d req id:%lld",
+			ctx->ctx_index, packet->header.request_id);
+		return;
+	}
+
+	CAM_ERR(CAM_ISP,
+		"Page fault on resource id:(0x%x) ctx id:%d req id:%lld",
+		get_res.out_res_id, ctx->ctx_index, packet->header.request_id);
+	*resource_type = get_res.out_res_id;
+	ctx->pf_mid_found = true;
+
+	cam_ife_mgr_pf_dump(get_res.out_res_id, ctx);
+
+outportlog:
+	cam_ife_mgr_print_io_bufs(hw_mgr, *resource_type, packet,
+		ctx_found, ctx);
+
+}
+
+static int cam_ife_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_ife_hw_mgr  *hw_mgr = hw_mgr_priv;
+	struct cam_ife_hw_mgr_ctx *ctx = (struct cam_ife_hw_mgr_ctx *)
+		hw_cmd_args->ctxt_to_hw_map;
+	struct cam_isp_hw_cmd_args *isp_hw_cmd_args = NULL;
+	struct cam_packet          *packet;
+	unsigned long rem_jiffies = 0;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Fatal: Invalid context is used");
+		return -EPERM;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_INTERNAL:
+		if (!hw_cmd_args->u.internal_args) {
+			CAM_ERR(CAM_ISP, "Invalid cmd arguments");
+			return -EINVAL;
+		}
+
+		isp_hw_cmd_args = (struct cam_isp_hw_cmd_args *)
+			hw_cmd_args->u.internal_args;
+
+		switch (isp_hw_cmd_args->cmd_type) {
+		case CAM_ISP_HW_MGR_CMD_PAUSE_HW:
+			cam_ife_mgr_pause_hw(ctx);
+			break;
+		case CAM_ISP_HW_MGR_CMD_RESUME_HW:
+			cam_ife_mgr_resume_hw(ctx);
+			break;
+		case CAM_ISP_HW_MGR_CMD_SOF_DEBUG:
+			cam_ife_mgr_sof_irq_debug(ctx,
+				isp_hw_cmd_args->u.sof_irq_enable);
+			break;
+		case CAM_ISP_HW_MGR_CMD_CTX_TYPE:
+			if (ctx->is_fe_enabled && ctx->is_offline)
+				isp_hw_cmd_args->u.ctx_type =
+					CAM_ISP_CTX_OFFLINE;
+			else if (ctx->is_fe_enabled && !ctx->is_offline)
+				isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_FS2;
+			else if (ctx->is_rdi_only_context)
+				isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_RDI;
+			else
+				isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_PIX;
+			break;
+		case CAM_ISP_HW_MGR_GET_PACKET_OPCODE:
+			packet = (struct cam_packet *)
+				isp_hw_cmd_args->cmd_data;
+			if (((packet->header.op_code + 1) & 0xF) ==
+				CAM_ISP_PACKET_INIT_DEV)
+				isp_hw_cmd_args->u.packet_op_code =
+				CAM_ISP_PACKET_INIT_DEV;
+			else
+				isp_hw_cmd_args->u.packet_op_code =
+				CAM_ISP_PACKET_UPDATE_DEV;
+			break;
+		case CAM_ISP_HW_MGR_GET_LAST_CDM_DONE:
+			isp_hw_cmd_args->u.last_cdm_done =
+				ctx->last_cdm_done_req;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid HW mgr command:0x%x",
+				hw_cmd_args->cmd_type);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_ife_mgr_dump_pf_data(hw_mgr, hw_cmd_args);
+
+		break;
+	case CAM_HW_MGR_CMD_REG_DUMP_ON_FLUSH:
+		if (ctx->last_dump_flush_req_id == ctx->applied_req_id)
+			return 0;
+
+		rem_jiffies = wait_for_completion_timeout(
+			&ctx->config_done_complete, msecs_to_jiffies(30));
+		if (rem_jiffies == 0)
+			CAM_ERR(CAM_ISP,
+				"config done completion timeout, Reg dump will be unreliable rc=%d ctx_index %d",
+				rc, ctx->ctx_index);
+
+		ctx->last_dump_flush_req_id = ctx->applied_req_id;
+		rc = cam_ife_mgr_handle_reg_dump(ctx, ctx->reg_dump_buf_desc,
+			ctx->num_reg_dump_buf,
+			CAM_ISP_PACKET_META_REG_DUMP_ON_FLUSH, NULL, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Reg dump on flush failed req id: %llu rc: %d",
+				ctx->applied_req_id, rc);
+			return rc;
+		}
+
+		break;
+	case CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR:
+		if (ctx->last_dump_err_req_id == ctx->applied_req_id)
+			return 0;
+
+		ctx->last_dump_err_req_id = ctx->applied_req_id;
+		rc = cam_ife_mgr_handle_reg_dump(ctx, ctx->reg_dump_buf_desc,
+			ctx->num_reg_dump_buf,
+			CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR, NULL, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Reg dump on error failed req id: %llu rc: %d",
+				ctx->applied_req_id, rc);
+			return rc;
+		}
+
+		break;
+	case CAM_HW_MGR_CMD_DUMP_ACQ_INFO:
+		cam_ife_hw_mgr_dump_acq_data(ctx);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid cmd");
+	}
+
+	return rc;
+}
+
+static int cam_ife_mgr_user_dump_hw(
+		struct cam_ife_hw_mgr_ctx *ife_ctx,
+		struct cam_hw_dump_args *dump_args)
+{
+	int rc = 0;
+	struct cam_hw_soc_dump_args soc_dump_args;
+
+	if (!ife_ctx || !dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid parameters %pK %pK",
+			ife_ctx, dump_args);
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_dump_args.buf_handle = dump_args->buf_handle;
+	soc_dump_args.request_id = dump_args->request_id;
+	soc_dump_args.offset = dump_args->offset;
+
+	rc = cam_ife_mgr_handle_reg_dump(ife_ctx,
+		ife_ctx->reg_dump_buf_desc,
+		ife_ctx->num_reg_dump_buf,
+		CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR,
+		&soc_dump_args,
+		true);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Dump failed req: %lld handle %u offset %u",
+			dump_args->request_id,
+			dump_args->buf_handle,
+			dump_args->offset);
+		goto end;
+	}
+	dump_args->offset = soc_dump_args.offset;
+end:
+	return rc;
+}
+
+static int cam_ife_mgr_dump(void *hw_mgr_priv, void *args)
+{
+	struct cam_isp_hw_dump_args isp_hw_dump_args;
+	struct cam_hw_dump_args *dump_args = (struct cam_hw_dump_args *)args;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_ife_hw_mgr_ctx *ife_ctx = (struct cam_ife_hw_mgr_ctx *)
+						dump_args->ctxt_to_hw_map;
+	int i;
+	int rc = 0;
+
+	/* for some targets, information about the IFE registers to be dumped
+	 * is already submitted with the hw manager. In this case, we
+	 * can dump just the related registers and skip going to core files.
+	 */
+	if (ife_ctx->num_reg_dump_buf) {
+		cam_ife_mgr_user_dump_hw(ife_ctx, dump_args);
+		goto end;
+	}
+
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&isp_hw_dump_args.cpu_addr,
+		&isp_hw_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+
+	isp_hw_dump_args.offset = dump_args->offset;
+	isp_hw_dump_args.req_id = dump_args->request_id;
+
+	list_for_each_entry(hw_mgr_res, &ife_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			switch (hw_mgr_res->hw_res[i]->res_id) {
+			case CAM_IFE_PIX_PATH_RES_RDI_0:
+			case CAM_IFE_PIX_PATH_RES_RDI_1:
+			case CAM_IFE_PIX_PATH_RES_RDI_2:
+			case CAM_IFE_PIX_PATH_RES_RDI_3:
+				if (ife_ctx->is_rdi_only_context &&
+					hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+			case CAM_IFE_PIX_PATH_RES_IPP:
+				if (hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+			default:
+				CAM_DBG(CAM_ISP, "not a valid res %d",
+				hw_mgr_res->res_id);
+				break;
+			}
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &ife_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			switch (hw_mgr_res->res_id) {
+			case CAM_ISP_HW_VFE_IN_RDI0:
+			case CAM_ISP_HW_VFE_IN_RDI1:
+			case CAM_ISP_HW_VFE_IN_RDI2:
+			case CAM_ISP_HW_VFE_IN_RDI3:
+				if (ife_ctx->is_rdi_only_context &&
+					hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+			case CAM_ISP_HW_VFE_IN_CAMIF:
+				if (hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+			default:
+				CAM_DBG(CAM_ISP, "not a valid res %d",
+					hw_mgr_res->res_id);
+				break;
+			}
+		}
+	}
+	dump_args->offset = isp_hw_dump_args.offset;
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+end:
+	CAM_DBG(CAM_ISP, "offset %u", dump_args->offset);
+	return rc;
+}
+
+static inline void cam_ife_hw_mgr_get_offline_sof_timestamp(
+	uint64_t                             *timestamp,
+	uint64_t                             *boot_time)
+{
+	struct timespec64                     ts;
+
+	ktime_get_boottime_ts64(&ts);
+	*timestamp = (uint64_t)((ts.tv_sec * 1000000000) + ts.tv_nsec);
+	*boot_time = *timestamp;
+}
+
+static int cam_ife_mgr_cmd_get_sof_timestamp(
+	struct cam_ife_hw_mgr_ctx            *ife_ctx,
+	uint64_t                             *time_stamp,
+	uint64_t                             *boot_time_stamp)
+{
+	int                                   rc = -EINVAL;
+	uint32_t                              i;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_csid_get_time_stamp_args   csid_get_time;
+
+	hw_mgr_res = list_first_entry(&ife_ctx->res_list_ife_csid,
+		struct cam_isp_hw_mgr_res, list);
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+
+		/*
+		 * Get the SOF time stamp from left resource only.
+		 * Left resource is master for dual vfe case and
+		 * Rdi only context case left resource only hold
+		 * the RDI resource
+		 */
+
+		hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.process_cmd) {
+			/*
+			 * Single VFE case, Get the time stamp from
+			 * available one csid hw in the context
+			 * Dual VFE case, get the time stamp from
+			 * master(left) would be sufficient
+			 */
+
+			csid_get_time.node_res =
+				hw_mgr_res->hw_res[i];
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_IFE_CSID_CMD_GET_TIME_STAMP,
+				&csid_get_time,
+				sizeof(
+				struct cam_csid_get_time_stamp_args));
+			if (!rc && (i == CAM_ISP_HW_SPLIT_LEFT)) {
+				*time_stamp =
+					csid_get_time.time_stamp_val;
+				*boot_time_stamp =
+					csid_get_time.boot_timestamp;
+			}
+		}
+	}
+
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Getting sof time stamp failed");
+
+	return rc;
+}
+
+static int cam_ife_mgr_process_recovery_cb(void *priv, void *data)
+{
+	int32_t rc = 0;
+	struct cam_ife_hw_event_recovery_data   *recovery_data = data;
+	struct cam_hw_start_args                 start_args;
+	struct cam_hw_stop_args                  stop_args;
+	struct cam_ife_hw_mgr                   *ife_hw_mgr = priv;
+	struct cam_isp_hw_mgr_res               *hw_mgr_res;
+	uint32_t                                 i = 0;
+
+	uint32_t error_type = recovery_data->error_type;
+	struct cam_ife_hw_mgr_ctx        *ctx = NULL;
+
+	/* Here recovery is performed */
+	CAM_DBG(CAM_ISP, "ErrorType = %d", error_type);
+
+	switch (error_type) {
+	case CAM_ISP_HW_ERROR_OVERFLOW:
+	case CAM_ISP_HW_ERROR_BUSIF_OVERFLOW:
+		if (!recovery_data->affected_ctx[0]) {
+			CAM_ERR(CAM_ISP,
+				"No context is affected but recovery called");
+			kfree(recovery_data);
+			return 0;
+		}
+		/* stop resources here */
+		CAM_DBG(CAM_ISP, "STOP: Number of affected context: %d",
+			recovery_data->no_of_context);
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			stop_args.ctxt_to_hw_map =
+				recovery_data->affected_ctx[i];
+			rc = cam_ife_mgr_stop_hw_in_overflow(&stop_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "CTX stop failed(%d)", rc);
+				return rc;
+			}
+		}
+
+		if (!g_ife_hw_mgr.debug_cfg.enable_recovery)
+			break;
+
+		CAM_DBG(CAM_ISP, "RESET: CSID PATH");
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			ctx = recovery_data->affected_ctx[i];
+			list_for_each_entry(hw_mgr_res, &ctx->res_list_ife_csid,
+				list) {
+				rc = cam_ife_hw_mgr_reset_csid_res(hw_mgr_res);
+				if (rc) {
+					CAM_ERR(CAM_ISP, "Failed RESET (%d)",
+						hw_mgr_res->res_id);
+					return rc;
+				}
+			}
+		}
+
+		CAM_DBG(CAM_ISP, "RESET: Calling VFE reset");
+
+		for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+			if (recovery_data->affected_core[i])
+				cam_ife_mgr_reset_vfe_hw(ife_hw_mgr, i);
+		}
+
+		CAM_DBG(CAM_ISP, "START: Number of affected context: %d",
+			recovery_data->no_of_context);
+
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			ctx =  recovery_data->affected_ctx[i];
+			start_args.ctxt_to_hw_map = ctx;
+
+			atomic_set(&ctx->overflow_pending, 0);
+
+			rc = cam_ife_mgr_restart_hw(&start_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "CTX start failed(%d)", rc);
+				return rc;
+			}
+			CAM_DBG(CAM_ISP, "Started resources rc (%d)", rc);
+		}
+		CAM_DBG(CAM_ISP, "Recovery Done rc (%d)", rc);
+
+		break;
+
+	case CAM_ISP_HW_ERROR_P2I_ERROR:
+		break;
+
+	case CAM_ISP_HW_ERROR_VIOLATION:
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Invalid Error");
+	}
+	CAM_DBG(CAM_ISP, "Exit: ErrorType = %d", error_type);
+
+	kfree(recovery_data);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_do_error_recovery(
+	struct cam_ife_hw_event_recovery_data  *ife_mgr_recovery_data)
+{
+	int32_t                                 rc = 0;
+	struct crm_workq_task                  *task = NULL;
+	struct cam_ife_hw_event_recovery_data  *recovery_data = NULL;
+
+	recovery_data = kmemdup(ife_mgr_recovery_data,
+		sizeof(struct cam_ife_hw_event_recovery_data), GFP_ATOMIC);
+	if (!recovery_data)
+		return -ENOMEM;
+
+	CAM_DBG(CAM_ISP, "Enter: error_type (%d)", recovery_data->error_type);
+
+	task = cam_req_mgr_workq_get_task(g_ife_hw_mgr.workq);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No empty task frame");
+		kfree(recovery_data);
+		return -ENOMEM;
+	}
+
+	task->process_cb = &cam_ife_mgr_process_recovery_cb;
+	task->payload = recovery_data;
+	rc = cam_req_mgr_workq_enqueue_task(task,
+		recovery_data->affected_ctx[0]->hw_mgr,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+/*
+ * This function checks if any of the valid entry in affected_core[]
+ * is associated with this context. if YES
+ *  a. It fills the other cores associated with this context.in
+ *      affected_core[]
+ *  b. Return true
+ */
+static bool cam_ife_hw_mgr_is_ctx_affected(
+	struct cam_ife_hw_mgr_ctx   *ife_hwr_mgr_ctx,
+	uint32_t                    *affected_core,
+	uint32_t                     size)
+{
+
+	bool                  rc = false;
+	uint32_t              i = 0, j = 0;
+	uint32_t              max_idx =  ife_hwr_mgr_ctx->num_base;
+	uint32_t              ctx_affected_core_idx[CAM_IFE_HW_NUM_MAX] = {0};
+
+	CAM_DBG(CAM_ISP, "Enter:max_idx = %d", max_idx);
+
+	if ((max_idx >= CAM_IFE_HW_NUM_MAX) || (size > CAM_IFE_HW_NUM_MAX)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "invalid parameter = %d", max_idx);
+		return rc;
+	}
+
+	for (i = 0; i < max_idx; i++) {
+		if (affected_core[ife_hwr_mgr_ctx->base[i].idx])
+			rc = true;
+		else {
+			ctx_affected_core_idx[j] = ife_hwr_mgr_ctx->base[i].idx;
+			j = j + 1;
+		}
+	}
+
+	if (rc) {
+		while (j) {
+			if (affected_core[ctx_affected_core_idx[j-1]] != 1)
+				affected_core[ctx_affected_core_idx[j-1]] = 1;
+			j = j - 1;
+		}
+	}
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+/*
+ * For any dual VFE context, if non-affected VFE is also serving
+ * another context, then that context should also be notified with fatal error
+ * So Loop through each context and -
+ *   a. match core_idx
+ *   b. Notify CTX with fatal error
+ */
+static int  cam_ife_hw_mgr_find_affected_ctx(
+	struct cam_isp_hw_error_event_data        *error_event_data,
+	uint32_t                                   curr_core_idx,
+	struct cam_ife_hw_event_recovery_data     *recovery_data)
+{
+	uint32_t affected_core[CAM_IFE_HW_NUM_MAX] = {0};
+	struct cam_ife_hw_mgr_ctx   *ife_hwr_mgr_ctx = NULL;
+	cam_hw_event_cb_func         notify_err_cb;
+	struct cam_ife_hw_mgr       *ife_hwr_mgr = NULL;
+	uint32_t i = 0;
+
+	if (!recovery_data) {
+		CAM_ERR(CAM_ISP, "recovery_data parameter is NULL");
+		return -EINVAL;
+	}
+
+	recovery_data->no_of_context = 0;
+	affected_core[curr_core_idx] = 1;
+	ife_hwr_mgr = &g_ife_hw_mgr;
+
+	list_for_each_entry(ife_hwr_mgr_ctx,
+		&ife_hwr_mgr->used_ctx_list, list) {
+		/*
+		 * Check if current core_idx matches the HW associated
+		 * with this context
+		 */
+		if (!cam_ife_hw_mgr_is_ctx_affected(ife_hwr_mgr_ctx,
+			affected_core, CAM_IFE_HW_NUM_MAX))
+			continue;
+
+		if (atomic_read(&ife_hwr_mgr_ctx->overflow_pending)) {
+			CAM_INFO(CAM_ISP, "CTX:%d already error reported",
+				ife_hwr_mgr_ctx->ctx_index);
+			continue;
+		}
+
+		atomic_set(&ife_hwr_mgr_ctx->overflow_pending, 1);
+		notify_err_cb = ife_hwr_mgr_ctx->common.event_cb;
+
+		/* Add affected_context in list of recovery data */
+		CAM_DBG(CAM_ISP, "Add affected ctx %d to list",
+			ife_hwr_mgr_ctx->ctx_index);
+		if (recovery_data->no_of_context < CAM_IFE_CTX_MAX)
+			recovery_data->affected_ctx[
+				recovery_data->no_of_context++] =
+				ife_hwr_mgr_ctx;
+
+		/*
+		 * In the call back function corresponding ISP context
+		 * will update CRM about fatal Error
+		 */
+		if (notify_err_cb)
+			notify_err_cb(ife_hwr_mgr_ctx->common.cb_priv,
+				CAM_ISP_HW_EVENT_ERROR,
+				(void *)error_event_data);
+		else {
+			CAM_WARN(CAM_ISP, "Error call back is not set");
+			goto end;
+		}
+	}
+
+	/* fill the affected_core in recovery data */
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		recovery_data->affected_core[i] = affected_core[i];
+		CAM_DBG(CAM_ISP, "Vfe core %d is affected (%d)",
+			 i, recovery_data->affected_core[i]);
+	}
+end:
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_dump_info(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_ife_hw_mgr_ctx     *ife_hw_mgr_ctx =
+		(struct cam_ife_hw_mgr_ctx *)ctx;
+	struct cam_isp_hw_event_info  *event_info =
+		(struct cam_isp_hw_event_info *)evt_info;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res = NULL;
+	struct cam_isp_resource_node  *rsrc_node = NULL;
+	struct cam_hw_intf            *hw_intf;
+	uint32_t i, out_port_id;
+	uint64_t dummy_args;
+	int rc = 0;
+
+	list_for_each_entry(hw_mgr_res,
+		&ife_hw_mgr_ctx->res_list_ife_src, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rsrc_node = hw_mgr_res->hw_res[i];
+			if (rsrc_node->res_id ==
+				CAM_ISP_HW_VFE_IN_CAMIF) {
+				hw_intf = rsrc_node->hw_intf;
+				if (hw_intf &&
+					hw_intf->hw_ops.process_cmd)
+					rc =
+					hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CAMIF_DATA,
+					rsrc_node,
+					sizeof(
+					struct
+					cam_isp_resource_node));
+			}
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res,
+		&ife_hw_mgr_ctx->res_list_ife_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_CLOCK_DUMP,
+					&dummy_args,
+					sizeof(uint64_t));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"CSID Clock Dump failed");
+			}
+		}
+	}
+
+	if (event_info->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		out_port_id = event_info->res_id & 0xFF;
+		hw_mgr_res =
+			&ife_hw_mgr_ctx->res_list_ife_out[out_port_id];
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+					(void *)event_info,
+					sizeof(struct cam_isp_hw_event_info));
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_csid_event(
+	struct cam_isp_hw_event_info *event_info)
+{
+	struct cam_isp_hw_error_event_data    error_event_data = {0};
+	struct cam_ife_hw_event_recovery_data recovery_data = {0};
+
+	/* this can be extended based on the types of error
+	 * received from CSID
+	 */
+	switch (event_info->err_type) {
+	case CAM_ISP_HW_ERROR_CSID_FATAL:
+		if (!g_ife_hw_mgr.debug_cfg.enable_csid_recovery)
+			break;
+
+		error_event_data.error_type = event_info->err_type;
+		cam_ife_hw_mgr_find_affected_ctx(&error_event_data,
+			event_info->hw_idx,
+			&recovery_data);
+		break;
+	case CAM_ISP_HW_ERROR_CSID_OVERFLOW:
+		if (cam_ife_hw_mgr_dump_hw_src_clock(event_info->hw_idx,
+			CAM_ISP_HW_TYPE_VFE))
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"VFE%d src_clk_rate dump failed", event_info->hw_idx);
+		break;
+	default:
+		break;
+	}
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_err(
+	void                                *ctx,
+	void                                *evt_info)
+{
+	struct cam_ife_hw_mgr_ctx               *ife_hw_mgr_ctx;
+	struct cam_isp_hw_event_info            *event_info = evt_info;
+	uint32_t                                 core_idx;
+	struct cam_isp_hw_error_event_data       error_event_data = {0};
+	struct cam_ife_hw_event_recovery_data    recovery_data = {0};
+	int                                      rc = -EINVAL;
+
+	if (event_info->err_type == CAM_VFE_IRQ_STATUS_VIOLATION)
+		error_event_data.error_type = CAM_ISP_HW_ERROR_VIOLATION;
+	else if (event_info->res_type == CAM_ISP_RESOURCE_VFE_IN)
+		error_event_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+	else if (event_info->res_type == CAM_ISP_RESOURCE_VFE_OUT)
+		error_event_data.error_type = CAM_ISP_HW_ERROR_BUSIF_OVERFLOW;
+
+	spin_lock(&g_ife_hw_mgr.ctx_lock);
+	if ((event_info->err_type == CAM_ISP_HW_ERROR_CSID_FATAL) ||
+		(event_info->err_type == CAM_ISP_HW_ERROR_CSID_OVERFLOW)) {
+		rc = cam_ife_hw_mgr_handle_csid_event(event_info);
+		spin_unlock(&g_ife_hw_mgr.ctx_lock);
+		return rc;
+	}
+
+	if (ctx) {
+		ife_hw_mgr_ctx =
+			(struct cam_ife_hw_mgr_ctx *)ctx;
+		if (event_info->res_type ==
+			CAM_ISP_RESOURCE_VFE_IN &&
+			!ife_hw_mgr_ctx->is_rdi_only_context &&
+			event_info->res_id !=
+			CAM_ISP_HW_VFE_IN_CAMIF)
+			cam_ife_hw_mgr_handle_hw_dump_info(
+			ife_hw_mgr_ctx, event_info);
+	}
+
+	core_idx = event_info->hw_idx;
+
+	if (g_ife_hw_mgr.debug_cfg.enable_recovery)
+		error_event_data.recovery_enabled = true;
+
+	if (g_ife_hw_mgr.debug_cfg.enable_req_dump)
+		error_event_data.enable_req_dump = true;
+
+	rc = cam_ife_hw_mgr_find_affected_ctx(&error_event_data,
+		core_idx, &recovery_data);
+	if ((rc != 0) || !(recovery_data.no_of_context))
+		goto end;
+
+	if (event_info->err_type == CAM_VFE_IRQ_STATUS_VIOLATION)
+		recovery_data.error_type = CAM_ISP_HW_ERROR_VIOLATION;
+	else
+		recovery_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+
+	cam_ife_hw_mgr_do_error_recovery(&recovery_data);
+end:
+	spin_unlock(&g_ife_hw_mgr.ctx_lock);
+	return rc;
+}
+
+static int cam_ife_hw_mgr_handle_hw_rup(
+	void                                    *ctx,
+	void                                    *evt_info)
+{
+	struct cam_isp_hw_event_info            *event_info = evt_info;
+	struct cam_ife_hw_mgr_ctx               *ife_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                     ife_hwr_irq_rup_cb;
+	struct cam_isp_hw_reg_update_event_data  rup_event_data;
+
+	ife_hwr_irq_rup_cb = ife_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_VFE_IN_CAMIF:
+		if ((ife_hw_mgr_ctx->is_dual) &&
+			(event_info->hw_idx !=
+			ife_hw_mgr_ctx->master_hw_idx))
+			break;
+
+		if (atomic_read(&ife_hw_mgr_ctx->overflow_pending))
+			break;
+		ife_hwr_irq_rup_cb(ife_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&rup_event_data);
+		break;
+
+	case CAM_ISP_HW_VFE_IN_RDI0:
+	case CAM_ISP_HW_VFE_IN_RDI1:
+	case CAM_ISP_HW_VFE_IN_RDI2:
+	case CAM_ISP_HW_VFE_IN_RDI3:
+		if (!ife_hw_mgr_ctx->is_rdi_only_context)
+			break;
+		if (atomic_read(&ife_hw_mgr_ctx->overflow_pending))
+			break;
+		ife_hwr_irq_rup_cb(ife_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&rup_event_data);
+		break;
+
+	case CAM_ISP_HW_VFE_IN_PDLIB:
+	case CAM_ISP_HW_VFE_IN_LCR:
+	case CAM_ISP_HW_VFE_IN_RD:
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "RUP done for VFE:%d source %d", event_info->hw_idx,
+		event_info->res_id);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_epoch(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_ife_hw_mgr_ctx            *ife_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                  ife_hw_irq_epoch_cb;
+	struct cam_isp_hw_epoch_event_data    epoch_done_event_data;
+
+	ife_hw_irq_epoch_cb = ife_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_VFE_IN_CAMIF:
+		if (atomic_read(&ife_hw_mgr_ctx->overflow_pending))
+			break;
+
+		epoch_done_event_data.frame_id_meta = event_info->reg_val;
+		ife_hw_irq_epoch_cb(ife_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_EPOCH, (void *)&epoch_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_VFE_IN_RDI0:
+	case CAM_ISP_HW_VFE_IN_RDI1:
+	case CAM_ISP_HW_VFE_IN_RDI2:
+	case CAM_ISP_HW_VFE_IN_RDI3:
+	case CAM_ISP_HW_VFE_IN_PDLIB:
+	case CAM_ISP_HW_VFE_IN_LCR:
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "Epoch for VFE:%d source %d", event_info->hw_idx,
+		event_info->res_id);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_sof(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_ife_hw_mgr_ctx            *ife_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                  ife_hw_irq_sof_cb;
+	struct cam_isp_hw_sof_event_data      sof_done_event_data;
+	struct timespec64 ts;
+
+	memset(&sof_done_event_data, 0, sizeof(sof_done_event_data));
+
+	ife_hw_irq_sof_cb = ife_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_VFE_IN_CAMIF:
+	case CAM_ISP_HW_VFE_IN_RD:
+		/* if frame header is enabled reset qtimer ts */
+		if (ife_hw_mgr_ctx->custom_config &
+			CAM_IFE_CUSTOM_CFG_FRAME_HEADER_TS) {
+			sof_done_event_data.timestamp = 0x0;
+			ktime_get_boottime_ts64(&ts);
+			sof_done_event_data.boot_time =
+			(uint64_t)((ts.tv_sec * 1000000000) +
+			ts.tv_nsec);
+			CAM_DBG(CAM_ISP, "boot_time 0x%llx",
+				sof_done_event_data.boot_time);
+		} else {
+			if (ife_hw_mgr_ctx->is_offline)
+				cam_ife_hw_mgr_get_offline_sof_timestamp(
+				&sof_done_event_data.timestamp,
+				&sof_done_event_data.boot_time);
+			else
+				cam_ife_mgr_cmd_get_sof_timestamp(
+				ife_hw_mgr_ctx,
+				&sof_done_event_data.timestamp,
+				&sof_done_event_data.boot_time);
+		}
+
+		if (atomic_read(&ife_hw_mgr_ctx->overflow_pending))
+			break;
+
+		ife_hw_irq_sof_cb(ife_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_SOF, (void *)&sof_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_VFE_IN_RDI0:
+	case CAM_ISP_HW_VFE_IN_RDI1:
+	case CAM_ISP_HW_VFE_IN_RDI2:
+	case CAM_ISP_HW_VFE_IN_RDI3:
+		if (!ife_hw_mgr_ctx->is_rdi_only_context)
+			break;
+		cam_ife_mgr_cmd_get_sof_timestamp(ife_hw_mgr_ctx,
+			&sof_done_event_data.timestamp,
+			&sof_done_event_data.boot_time);
+		if (atomic_read(&ife_hw_mgr_ctx->overflow_pending))
+			break;
+		ife_hw_irq_sof_cb(ife_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_SOF, (void *)&sof_done_event_data);
+		break;
+
+	case CAM_ISP_HW_VFE_IN_PDLIB:
+	case CAM_ISP_HW_VFE_IN_LCR:
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "SOF for VFE:%d source %d", event_info->hw_idx,
+		event_info->res_id);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_eof(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_ife_hw_mgr_ctx            *ife_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                  ife_hw_irq_eof_cb;
+	struct cam_isp_hw_eof_event_data      eof_done_event_data;
+
+	ife_hw_irq_eof_cb = ife_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_VFE_IN_CAMIF:
+		if (atomic_read(&ife_hw_mgr_ctx->overflow_pending))
+			break;
+
+		ife_hw_irq_eof_cb(ife_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_EOF, (void *)&eof_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_VFE_IN_RDI0:
+	case CAM_ISP_HW_VFE_IN_RDI1:
+	case CAM_ISP_HW_VFE_IN_RDI2:
+	case CAM_ISP_HW_VFE_IN_RDI3:
+		if (!ife_hw_mgr_ctx->is_rdi_only_context)
+			break;
+		if (atomic_read(&ife_hw_mgr_ctx->overflow_pending))
+			break;
+		ife_hw_irq_eof_cb(ife_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_EOF, (void *)&eof_done_event_data);
+		break;
+
+	case CAM_ISP_HW_VFE_IN_PDLIB:
+	case CAM_ISP_HW_VFE_IN_LCR:
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "EOF for VFE:%d source %d", event_info->hw_idx,
+		event_info->res_id);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_handle_hw_buf_done(
+	void                                *ctx,
+	void                                *evt_info)
+{
+	cam_hw_event_cb_func                 ife_hwr_irq_wm_done_cb;
+	struct cam_ife_hw_mgr_ctx           *ife_hw_mgr_ctx = ctx;
+	struct cam_isp_hw_done_event_data    buf_done_event_data = {0};
+	struct cam_isp_hw_event_info        *event_info = evt_info;
+
+	ife_hwr_irq_wm_done_cb = ife_hw_mgr_ctx->common.event_cb;
+
+	buf_done_event_data.num_handles = 1;
+	buf_done_event_data.resource_handle[0] = event_info->res_id;
+	buf_done_event_data.last_consumed_addr[0] =
+		event_info->reg_val;
+	buf_done_event_data.evt_param = event_info->evt_param;
+
+	if (atomic_read(&ife_hw_mgr_ctx->overflow_pending))
+		return 0;
+
+	if (buf_done_event_data.num_handles > 0 && ife_hwr_irq_wm_done_cb) {
+		CAM_DBG(CAM_ISP, "Notify ISP context");
+		ife_hwr_irq_wm_done_cb(ife_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_DONE, (void *)&buf_done_event_data);
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Buf done for VFE:%d res_id: 0x%x last consumed addr: 0x%x",
+		event_info->hw_idx, event_info->res_id, event_info->reg_val);
+
+	return 0;
+}
+
+static int cam_ife_hw_mgr_event_handler(
+	void                                *priv,
+	uint32_t                             evt_id,
+	void                                *evt_info)
+{
+	int                                  rc = 0;
+
+	if (!evt_info)
+		return -EINVAL;
+
+	if (!priv)
+		if (evt_id != CAM_ISP_HW_EVENT_ERROR)
+			return -EINVAL;
+
+	CAM_DBG(CAM_ISP, "Event ID 0x%x", evt_id);
+
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_SOF:
+		rc = cam_ife_hw_mgr_handle_hw_sof(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		rc = cam_ife_hw_mgr_handle_hw_rup(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_EPOCH:
+		rc = cam_ife_hw_mgr_handle_hw_epoch(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_EOF:
+		rc = cam_ife_hw_mgr_handle_hw_eof(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_DONE:
+		rc = cam_ife_hw_mgr_handle_hw_buf_done(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_ERROR:
+		rc = cam_ife_hw_mgr_handle_hw_err(priv, evt_info);
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Invalid event ID %d", evt_id);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_ife_hw_mgr_sort_dev_with_caps(
+	struct cam_ife_hw_mgr *ife_hw_mgr)
+{
+	int i;
+
+	/* get caps for csid devices */
+	for (i = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		if (!ife_hw_mgr->csid_devices[i])
+			continue;
+		if (ife_hw_mgr->csid_devices[i]->hw_ops.get_hw_caps) {
+			ife_hw_mgr->csid_devices[i]->hw_ops.get_hw_caps(
+				ife_hw_mgr->csid_devices[i]->hw_priv,
+				&ife_hw_mgr->ife_csid_dev_caps[i],
+				sizeof(ife_hw_mgr->ife_csid_dev_caps[i]));
+		}
+	}
+
+	/* get caps for ife devices */
+	for (i = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		if (!ife_hw_mgr->ife_devices[i])
+			continue;
+		if (ife_hw_mgr->ife_devices[i]->hw_intf->hw_ops.get_hw_caps) {
+			ife_hw_mgr->ife_devices[i]->hw_intf->hw_ops.get_hw_caps(
+				ife_hw_mgr->ife_devices[i]->hw_intf->hw_priv,
+				&ife_hw_mgr->ife_dev_caps[i],
+				sizeof(ife_hw_mgr->ife_dev_caps[i]));
+		}
+	}
+
+	return 0;
+}
+
+static int cam_ife_set_csid_debug(void *data, u64 val)
+{
+	g_ife_hw_mgr.debug_cfg.csid_debug = val;
+	CAM_DBG(CAM_ISP, "Set CSID Debug value :%lld", val);
+	return 0;
+}
+
+static int cam_ife_get_csid_debug(void *data, u64 *val)
+{
+	*val = g_ife_hw_mgr.debug_cfg.csid_debug;
+	CAM_DBG(CAM_ISP, "Get CSID Debug value :%lld",
+		g_ife_hw_mgr.debug_cfg.csid_debug);
+
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_ife_csid_debug,
+	cam_ife_get_csid_debug,
+	cam_ife_set_csid_debug, "%16llu");
+
+static int cam_ife_set_camif_debug(void *data, u64 val)
+{
+	g_ife_hw_mgr.debug_cfg.camif_debug = val;
+	CAM_DBG(CAM_ISP,
+		"Set camif enable_diag_sensor_status value :%lld", val);
+	return 0;
+}
+
+static int cam_ife_get_camif_debug(void *data, u64 *val)
+{
+	*val = g_ife_hw_mgr.debug_cfg.camif_debug;
+	CAM_DBG(CAM_ISP,
+		"Set camif enable_diag_sensor_status value :%lld",
+		g_ife_hw_mgr.debug_cfg.csid_debug);
+
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_ife_camif_debug,
+	cam_ife_get_camif_debug,
+	cam_ife_set_camif_debug, "%16llu");
+
+static int cam_ife_hw_mgr_debug_register(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_ife", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_ISP,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	g_ife_hw_mgr.debug_cfg.dentry = dbgfileptr;
+
+	debugfs_create_file("ife_csid_debug", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_csid_debug);
+	debugfs_create_u32("enable_recovery", 0644, g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.enable_recovery);
+	debugfs_create_bool("enable_req_dump", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.enable_req_dump);
+	debugfs_create_u32("enable_csid_recovery", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.enable_csid_recovery);
+	debugfs_create_file("ife_camif_debug", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry, NULL, &cam_ife_camif_debug);
+	debugfs_create_bool("per_req_reg_dump", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.per_req_reg_dump);
+	debugfs_create_bool("disable_ubwc_comp", 0644,
+		g_ife_hw_mgr.debug_cfg.dentry,
+		&g_ife_hw_mgr.debug_cfg.disable_ubwc_comp);
+
+end:
+	g_ife_hw_mgr.debug_cfg.enable_recovery = 0;
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_cam_ife_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+int cam_ife_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl)
+{
+	int rc = -EFAULT;
+	int i, j;
+	struct cam_iommu_handle cdm_handles;
+	struct cam_ife_hw_mgr_ctx *ctx_pool;
+	struct cam_isp_hw_mgr_res *res_list_ife_out;
+	struct cam_isp_hw_bus_cap isp_bus_cap = {0};
+
+	memset(&g_ife_hw_mgr, 0, sizeof(g_ife_hw_mgr));
+
+	mutex_init(&g_ife_hw_mgr.ctx_mutex);
+	for (i = 0, j = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		mutex_init(&g_ife_hw_mgr.wm_cfg_mutex[i]);
+	}
+	spin_lock_init(&g_ife_hw_mgr.ctx_lock);
+
+	if (CAM_IFE_HW_NUM_MAX != CAM_IFE_CSID_HW_NUM_MAX) {
+		CAM_ERR(CAM_ISP, "CSID num is different then IFE num");
+		return -EINVAL;
+	}
+
+	/* fill ife hw intf information */
+	for (i = 0, j = 0; i < CAM_IFE_HW_NUM_MAX; i++) {
+		rc = cam_vfe_hw_init(&g_ife_hw_mgr.ife_devices[i], i);
+		if (!rc) {
+			struct cam_hw_intf *ife_device =
+				g_ife_hw_mgr.ife_devices[i]->hw_intf;
+			struct cam_hw_info *vfe_hw =
+				(struct cam_hw_info *)
+				ife_device->hw_priv;
+			struct cam_hw_soc_info *soc_info = &vfe_hw->soc_info;
+
+			if (j == 0) {
+				ife_device->hw_ops.process_cmd(
+					vfe_hw,
+					CAM_ISP_HW_CMD_QUERY_BUS_CAP,
+					&isp_bus_cap,
+					sizeof(struct cam_isp_hw_bus_cap));
+				CAM_DBG(CAM_ISP, "max VFE out resources: 0x%x",
+					isp_bus_cap.max_vfe_out_res_type);
+			}
+
+			j++;
+			g_ife_hw_mgr.cdm_reg_map[i] = &soc_info->reg_map[0];
+			CAM_DBG(CAM_ISP,
+				"reg_map: mem base = %pK cam_base = 0x%llx",
+				(void __iomem *)soc_info->reg_map[0].mem_base,
+				(uint64_t) soc_info->reg_map[0].mem_cam_base);
+
+			if (g_ife_hw_mgr.ife_devices[i]->num_hw_pid)
+				g_ife_hw_mgr.hw_pid_support = true;
+
+		} else {
+			g_ife_hw_mgr.cdm_reg_map[i] = NULL;
+		}
+	}
+	if (j == 0) {
+		CAM_ERR(CAM_ISP, "no valid IFE HW");
+		return -EINVAL;
+	}
+
+	g_ife_hw_mgr.support_consumed_addr = isp_bus_cap.support_consumed_addr;
+	g_ife_hw_mgr.max_vfe_out_res_type = isp_bus_cap.max_vfe_out_res_type;
+	max_ife_out_res = g_ife_hw_mgr.max_vfe_out_res_type & 0xFF;
+
+	/* fill csid hw intf information */
+	for (i = 0, j = 0; i < CAM_IFE_CSID_HW_NUM_MAX; i++) {
+		rc = cam_ife_csid_hw_init(&g_ife_hw_mgr.csid_devices[i], i);
+		if (!rc)
+			j++;
+	}
+	if (!j) {
+		CAM_ERR(CAM_ISP, "no valid IFE CSID HW");
+		return -EINVAL;
+	}
+
+	/* fill tpg hw intf information */
+	for (i = 0, j = 0; i < CAM_TOP_TPG_HW_NUM_MAX; i++) {
+		rc = cam_top_tpg_hw_init(&g_ife_hw_mgr.tpg_devices[i], i);
+		if (!rc)
+			j++;
+	}
+	if (!j)
+		CAM_ERR(CAM_ISP, "no valid IFE TPG HW");
+
+
+	cam_ife_hw_mgr_sort_dev_with_caps(&g_ife_hw_mgr);
+
+	/* setup ife context list */
+	INIT_LIST_HEAD(&g_ife_hw_mgr.free_ctx_list);
+	INIT_LIST_HEAD(&g_ife_hw_mgr.used_ctx_list);
+
+	/*
+	 *  for now, we only support one iommu handle. later
+	 *  we will need to setup more iommu handle for other
+	 *  use cases.
+	 *  Also, we have to release them once we have the
+	 *  deinit support
+	 */
+	rc = cam_smmu_get_handle("ife",
+		&g_ife_hw_mgr.mgr_common.img_iommu_hdl);
+
+	if (rc && rc != -EALREADY) {
+		CAM_ERR(CAM_ISP, "Can not get iommu handle");
+		return -EINVAL;
+	}
+
+	if (cam_smmu_get_handle("cam-secure",
+		&g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure)) {
+		CAM_ERR(CAM_ISP, "Failed to get secure iommu handle");
+		goto secure_fail;
+	}
+
+	CAM_DBG(CAM_ISP, "iommu_handles: non-secure[0x%x], secure[0x%x]",
+		g_ife_hw_mgr.mgr_common.img_iommu_hdl,
+		g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure);
+
+	if (!cam_cdm_get_iommu_handle("ife3", &cdm_handles)) {
+		CAM_DBG(CAM_ISP,
+			"Successfully acquired CDM iommu handles 0x%x, 0x%x",
+			cdm_handles.non_secure, cdm_handles.secure);
+		g_ife_hw_mgr.mgr_common.cmd_iommu_hdl = cdm_handles.non_secure;
+		g_ife_hw_mgr.mgr_common.cmd_iommu_hdl_secure =
+			cdm_handles.secure;
+	} else {
+		CAM_ERR(CAM_ISP, "Failed to acquire CDM iommu handle");
+		g_ife_hw_mgr.mgr_common.cmd_iommu_hdl = -1;
+		g_ife_hw_mgr.mgr_common.cmd_iommu_hdl_secure = -1;
+	}
+
+	atomic_set(&g_ife_hw_mgr.active_ctx_cnt, 0);
+	for (i = 0; i < CAM_IFE_CTX_MAX; i++) {
+		memset(&g_ife_hw_mgr.ctx_pool[i], 0,
+			sizeof(g_ife_hw_mgr.ctx_pool[i]));
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].list);
+
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_tpg.list);
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_ife_in.list);
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_ife_cid);
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_ife_csid);
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_ife_src);
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].res_list_ife_in_rd);
+		ctx_pool = &g_ife_hw_mgr.ctx_pool[i];
+		ctx_pool->res_list_ife_out = kzalloc((max_ife_out_res *
+			sizeof(struct cam_isp_hw_mgr_res)), GFP_KERNEL);
+		if (!ctx_pool->res_list_ife_out) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_ISP, "Alloc failed for ife out res list");
+			goto end;
+		}
+
+		for (j = 0; j < max_ife_out_res; j++) {
+			res_list_ife_out = &ctx_pool->res_list_ife_out[j];
+			INIT_LIST_HEAD(&res_list_ife_out->list);
+		}
+
+		/* init context pool */
+		INIT_LIST_HEAD(&g_ife_hw_mgr.ctx_pool[i].free_res_list);
+		for (j = 0; j < CAM_IFE_HW_RES_POOL_MAX; j++) {
+			INIT_LIST_HEAD(
+				&g_ife_hw_mgr.ctx_pool[i].res_pool[j].list);
+			list_add_tail(
+				&g_ife_hw_mgr.ctx_pool[i].res_pool[j].list,
+				&g_ife_hw_mgr.ctx_pool[i].free_res_list);
+		}
+
+		g_ife_hw_mgr.ctx_pool[i].cdm_cmd =
+			kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+				((CAM_ISP_CTX_CFG_MAX - 1) *
+				 sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+		if (!g_ife_hw_mgr.ctx_pool[i].cdm_cmd) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_ISP, "Allocation Failed for cdm command");
+			goto end;
+		}
+
+		g_ife_hw_mgr.ctx_pool[i].ctx_index = i;
+		g_ife_hw_mgr.ctx_pool[i].hw_mgr = &g_ife_hw_mgr;
+
+		cam_tasklet_init(&g_ife_hw_mgr.mgr_common.tasklet_pool[i],
+			&g_ife_hw_mgr.ctx_pool[i], i);
+		g_ife_hw_mgr.ctx_pool[i].common.tasklet_info =
+			g_ife_hw_mgr.mgr_common.tasklet_pool[i];
+
+		init_completion(&g_ife_hw_mgr.ctx_pool[i].config_done_complete);
+		list_add_tail(&g_ife_hw_mgr.ctx_pool[i].list,
+			&g_ife_hw_mgr.free_ctx_list);
+	}
+
+	/* Create Worker for ife_hw_mgr with 10 tasks */
+	rc = cam_req_mgr_workq_create("cam_ife_worker", 10,
+			&g_ife_hw_mgr.workq, CRM_WORKQ_USAGE_NON_IRQ, 0,
+			cam_req_mgr_process_workq_cam_ife_worker);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Unable to create worker");
+		goto end;
+	}
+
+	/* fill return structure */
+	hw_mgr_intf->hw_mgr_priv = &g_ife_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_ife_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire = cam_ife_mgr_acquire;
+	hw_mgr_intf->hw_start = cam_ife_mgr_start_hw;
+	hw_mgr_intf->hw_stop = cam_ife_mgr_stop_hw;
+	hw_mgr_intf->hw_read = cam_ife_mgr_read;
+	hw_mgr_intf->hw_write = cam_ife_mgr_write;
+	hw_mgr_intf->hw_release = cam_ife_mgr_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_ife_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config = cam_ife_mgr_config_hw;
+	hw_mgr_intf->hw_cmd = cam_ife_mgr_cmd;
+	hw_mgr_intf->hw_reset = cam_ife_mgr_reset;
+	hw_mgr_intf->hw_dump = cam_ife_mgr_dump;
+
+	if (iommu_hdl)
+		*iommu_hdl = g_ife_hw_mgr.mgr_common.img_iommu_hdl;
+
+	cam_ife_hw_mgr_debug_register();
+	CAM_DBG(CAM_ISP, "Exit");
+
+	return 0;
+end:
+	if (rc) {
+		for (i = 0; i < CAM_IFE_CTX_MAX; i++) {
+			cam_tasklet_deinit(
+				&g_ife_hw_mgr.mgr_common.tasklet_pool[i]);
+			kfree(g_ife_hw_mgr.ctx_pool[i].cdm_cmd);
+			g_ife_hw_mgr.ctx_pool[i].cdm_cmd = NULL;
+			kfree(g_ife_hw_mgr.ctx_pool[i].res_list_ife_out);
+			g_ife_hw_mgr.ctx_pool[i].res_list_ife_out = NULL;
+			g_ife_hw_mgr.ctx_pool[i].common.tasklet_info = NULL;
+		}
+	}
+	cam_smmu_destroy_handle(
+		g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure);
+	g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure = -1;
+secure_fail:
+	cam_smmu_destroy_handle(g_ife_hw_mgr.mgr_common.img_iommu_hdl);
+	g_ife_hw_mgr.mgr_common.img_iommu_hdl = -1;
+	return rc;
+}
+
+void cam_ife_hw_mgr_deinit(void)
+{
+	int i = 0;
+
+	cam_req_mgr_workq_destroy(&g_ife_hw_mgr.workq);
+	debugfs_remove_recursive(g_ife_hw_mgr.debug_cfg.dentry);
+	g_ife_hw_mgr.debug_cfg.dentry = NULL;
+
+	for (i = 0; i < CAM_IFE_CTX_MAX; i++) {
+		cam_tasklet_deinit(
+			&g_ife_hw_mgr.mgr_common.tasklet_pool[i]);
+		kfree(g_ife_hw_mgr.ctx_pool[i].cdm_cmd);
+		g_ife_hw_mgr.ctx_pool[i].cdm_cmd = NULL;
+		kfree(g_ife_hw_mgr.ctx_pool[i].res_list_ife_out);
+		g_ife_hw_mgr.ctx_pool[i].res_list_ife_out = NULL;
+		g_ife_hw_mgr.ctx_pool[i].common.tasklet_info = NULL;
+	}
+
+	cam_smmu_destroy_handle(
+		g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure);
+	g_ife_hw_mgr.mgr_common.img_iommu_hdl_secure = -1;
+
+	cam_smmu_destroy_handle(g_ife_hw_mgr.mgr_common.img_iommu_hdl);
+	g_ife_hw_mgr.mgr_common.img_iommu_hdl = -1;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.h
@@ -0,0 +1,244 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_HW_MGR_H_
+#define _CAM_IFE_HW_MGR_H_
+
+#include <linux/completion.h>
+#include <linux/time.h>
+#include "cam_isp_hw_mgr.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_top_tpg_hw_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_cdm_intf_api.h"
+
+/* IFE resource constants */
+#define CAM_IFE_HW_IN_RES_MAX            (CAM_ISP_IFE_IN_RES_MAX & 0xFF)
+#define CAM_IFE_HW_RES_POOL_MAX          64
+
+/* IFE_HW_MGR custom config */
+#define CAM_IFE_CUSTOM_CFG_FRAME_HEADER_TS   BIT(0)
+#define CAM_IFE_CUSTOM_CFG_SW_SYNC_ON        BIT(1)
+
+/**
+ * struct cam_ife_hw_mgr_debug - contain the debug information
+ *
+ * @dentry:                    Debugfs entry
+ * @csid_debug:                csid debug information
+ * @enable_recovery:           enable recovery
+ * @enable_csid_recovery:      enable csid recovery
+ * @enable_diag_sensor_status: enable sensor diagnosis status
+ * @enable_req_dump:           Enable request dump on HW errors
+ * @per_req_reg_dump:          Enable per request reg dump
+ * @disable_ubwc_comp:         Disable UBWC compression
+ *
+ */
+struct cam_ife_hw_mgr_debug {
+	struct dentry  *dentry;
+	uint64_t       csid_debug;
+	uint32_t       enable_recovery;
+	uint32_t       enable_csid_recovery;
+	uint32_t       camif_debug;
+	bool           enable_req_dump;
+	bool           per_req_reg_dump;
+	bool           disable_ubwc_comp;
+};
+
+/**
+ * struct cam_vfe_hw_mgr_ctx - IFE HW manager Context object
+ *
+ * @list:                   used by the ctx list.
+ * @common:                 common acquired context data
+ * @ctx_index:              acquired context id.
+ * @master_hw_idx:          hw index for master core
+ * @slave_hw_idx:           hw index for slave core
+ * @hw_mgr:                 IFE hw mgr which owns this context
+ * @ctx_in_use:             flag to tell whether context is active
+ * @res_list_tpg:           TPG resource list
+ * @res_list_ife_in:        Starting resource(TPG,PHY0, PHY1...) Can only be
+ *                          one.
+ * @res_list_csid:          CSID resource list
+ * @res_list_ife_src:       IFE input resource list
+ * @res_list_ife_in_rd      IFE input resource list for read path
+ * @res_list_ife_out:       IFE output resoruces array
+ * @free_res_list:          Free resources list for the branch node
+ * @res_pool:               memory storage for the free resource list
+ * @irq_status0_mask:       irq_status0_mask for the context
+ * @irq_status1_mask:       irq_status1_mask for the context
+ * @base                    device base index array contain the all IFE HW
+ *                          instance associated with this context.
+ * @num_base                number of valid base data in the base array
+ * @cdm_handle              cdm hw acquire handle
+ * @cdm_ops                 cdm util operation pointer for building
+ *                          cdm commands
+ * @cdm_cmd                 cdm base and length request pointer
+ * @cdm_id                  cdm id of the acquired cdm
+ * @sof_cnt                 sof count value per core, used for dual VFE
+ * @epoch_cnt               epoch count value per core, used for dual VFE
+ * @eof_cnt                 eof count value per core, used for dual VFE
+ * @overflow_pending        flat to specify the overflow is pending for the
+ *                          context
+ * @cdm_done                flag to indicate cdm has finished writing shadow
+ *                          registers
+ * @last_cdm_done_req:      Last cdm done request
+ * @is_rdi_only_context     flag to specify the context has only rdi resource
+ * @config_done_complete    indicator for configuration complete
+ * @reg_dump_buf_desc:      cmd buffer descriptors for reg dump
+ * @num_reg_dump_buf:       Count of descriptors in reg_dump_buf_desc
+ * @applied_req_id:         Last request id to be applied
+ * @last_dump_flush_req_id  Last req id for which reg dump on flush was called
+ * @last_dump_err_req_id    Last req id for which reg dump on error was called
+ * @init_done               indicate whether init hw is done
+ * @is_fe_enabled           Indicate whether fetch engine\read path is enabled
+ * @is_dual                 indicate whether context is in dual VFE mode
+ * @custom_enabled          update the flag if context is connected to custom HW
+ * @custom_config           ife ctx config if custom is enabled [bit field]
+ * @ts                      captured timestamp when the ctx is acquired
+ * @is_tpg                  indicate whether context is using PHY TPG
+ * @is_offline              Indicate whether context is for offline IFE
+ * @dsp_enabled             Indicate whether dsp is enabled in this context
+ * @hw_enabled              Array to indicate active HW
+ * @internal_cdm            Indicate whether context uses internal CDM
+ * @pf_mid_found            in page fault, mid found for this ctx.
+ * dynamic_rdi_alloc:       is dynamic rdi allocation enabled
+ * dynamic_rdi_mask:        dynamic allocated resources mask*
+ */
+struct cam_ife_hw_mgr_ctx {
+	struct list_head                list;
+	struct cam_isp_hw_mgr_ctx       common;
+
+	uint32_t                        ctx_index;
+	uint32_t                        master_hw_idx;
+	uint32_t                        slave_hw_idx;
+	struct cam_ife_hw_mgr          *hw_mgr;
+	uint32_t                        ctx_in_use;
+
+	struct cam_isp_hw_mgr_res       res_list_ife_in;
+	struct cam_isp_hw_mgr_res       res_list_tpg;
+	struct list_head                res_list_ife_cid;
+	struct list_head                res_list_ife_csid;
+	struct list_head                res_list_ife_src;
+	struct list_head                res_list_ife_in_rd;
+	struct cam_isp_hw_mgr_res      *res_list_ife_out;
+	struct list_head                free_res_list;
+	struct cam_isp_hw_mgr_res       res_pool[CAM_IFE_HW_RES_POOL_MAX];
+
+	uint32_t                        irq_status0_mask[CAM_IFE_HW_NUM_MAX];
+	uint32_t                        irq_status1_mask[CAM_IFE_HW_NUM_MAX];
+	struct cam_isp_ctx_base_info    base[CAM_IFE_HW_NUM_MAX];
+	uint32_t                        num_base;
+	uint32_t                        cdm_handle;
+	struct cam_cdm_utils_ops       *cdm_ops;
+	struct cam_cdm_bl_request      *cdm_cmd;
+	enum cam_cdm_id                 cdm_id;
+	uint32_t                        sof_cnt[CAM_IFE_HW_NUM_MAX];
+	uint32_t                        epoch_cnt[CAM_IFE_HW_NUM_MAX];
+	uint32_t                        eof_cnt[CAM_IFE_HW_NUM_MAX];
+	atomic_t                        overflow_pending;
+	atomic_t                        cdm_done;
+	uint64_t                        last_cdm_done_req;
+	uint32_t                        is_rdi_only_context;
+	struct completion               config_done_complete;
+	uint32_t                        hw_version;
+	struct cam_cmd_buf_desc         reg_dump_buf_desc[
+						CAM_REG_DUMP_MAX_BUF_ENTRIES];
+	uint32_t                        num_reg_dump_buf;
+	uint64_t                        applied_req_id;
+	uint64_t                        last_dump_flush_req_id;
+	uint64_t                        last_dump_err_req_id;
+	bool                            init_done;
+	bool                            is_fe_enabled;
+	bool                            is_dual;
+	bool                            custom_enabled;
+	uint32_t                        custom_config;
+	struct timespec64               ts;
+	bool                            is_tpg;
+	bool                            is_offline;
+	bool                            dsp_enabled;
+	bool                            internal_cdm;
+	bool                            pf_mid_found;
+	bool                            dynamic_rdi_alloc;
+	uint32_t                        dynamic_rdi_mask;
+};
+
+/**
+ * struct cam_ife_hw_mgr - IFE HW Manager
+ *
+ * @mgr_common:            common data for all HW managers
+ * @csid_devices;          csid device instances array. This will be filled by
+ *                         HW manager during the initialization.
+ * @ife_devices:           IFE device instances array. This will be filled by
+ *                         HW layer during initialization
+ * @wm_cfg_mutex:          mutex for updating the wm configuration in CDM
+ * @ctx_mutex:             mutex for the hw context pool
+ * @free_ctx_list:         free hw context list
+ * @used_ctx_list:         used hw context list
+ * @ctx_pool:              context storage
+ * @ife_csid_dev_caps      csid device capability stored per core
+ * @ife_dev_caps           ife device capability per core
+ * @work q                 work queue for IFE hw manager
+ * @debug_cfg              debug configuration
+ * @ctx_lock               context lock
+ * @support_consumed_addr  indicate whether hw supports last consumed address
+ * @hw_pid_support         hw pid support for this target
+ * @max_vfe_out_res_type   max ife out res type value from hw
+ */
+struct cam_ife_hw_mgr {
+	struct cam_isp_hw_mgr          mgr_common;
+	struct cam_hw_intf            *tpg_devices[CAM_TOP_TPG_HW_NUM_MAX];
+	struct cam_hw_intf            *csid_devices[CAM_IFE_CSID_HW_NUM_MAX];
+	struct cam_isp_hw_intf_data   *ife_devices[CAM_IFE_HW_NUM_MAX];
+	struct cam_soc_reg_map        *cdm_reg_map[CAM_IFE_HW_NUM_MAX];
+	struct mutex                   wm_cfg_mutex[CAM_IFE_HW_NUM_MAX];
+
+	struct mutex                   ctx_mutex;
+	atomic_t                       active_ctx_cnt;
+	struct list_head               free_ctx_list;
+	struct list_head               used_ctx_list;
+	struct cam_ife_hw_mgr_ctx      ctx_pool[CAM_IFE_CTX_MAX];
+
+	struct cam_ife_csid_hw_caps    ife_csid_dev_caps[
+						CAM_IFE_CSID_HW_NUM_MAX];
+	struct cam_vfe_hw_get_hw_cap   ife_dev_caps[CAM_IFE_HW_NUM_MAX];
+	struct cam_req_mgr_core_workq *workq;
+	struct cam_ife_hw_mgr_debug    debug_cfg;
+	spinlock_t                     ctx_lock;
+	bool                           support_consumed_addr;
+	bool                           hw_pid_support;
+	uint32_t                       max_vfe_out_res_type;
+};
+
+/**
+ * struct cam_ife_hw_event_recovery_data - Payload for the recovery procedure
+ *
+ * @error_type:               Error type that causes the recovery
+ * @affected_core:            Array of the hardware cores that are affected
+ * @affected_ctx:             Array of the hardware contexts that are affected
+ * @no_of_context:            Actual number of the affected context
+ *
+ */
+struct cam_ife_hw_event_recovery_data {
+	uint32_t                   error_type;
+	uint32_t                   affected_core[CAM_ISP_HW_NUM_MAX];
+	struct cam_ife_hw_mgr_ctx *affected_ctx[CAM_IFE_CTX_MAX];
+	uint32_t                   no_of_context;
+};
+
+/**
+ * cam_ife_hw_mgr_init()
+ *
+ * @brief:              Initialize the IFE hardware manger. This is the
+ *                      etnry functinon for the IFE HW manager.
+ *
+ * @hw_mgr_intf:        IFE hardware manager object returned
+ * @iommu_hdl:          Iommu handle to be returned
+ *
+ */
+int cam_ife_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl);
+void cam_ife_hw_mgr_deinit(void);
+
+#endif /* _CAM_IFE_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.c
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_debug_util.h"
+#include "cam_tfe_hw_mgr.h"
+
+
+int cam_isp_hw_mgr_init(const char   *device_name_str,
+	struct cam_hw_mgr_intf *hw_mgr, int *iommu_hdl)
+{
+	int rc = 0;
+
+	if (strnstr(device_name_str, "ife", strlen(device_name_str)))
+		rc = cam_ife_hw_mgr_init(hw_mgr, iommu_hdl);
+	else if (strnstr(device_name_str, "tfe", strlen(device_name_str)))
+		rc = cam_tfe_hw_mgr_init(hw_mgr, iommu_hdl);
+	else {
+		CAM_ERR(CAM_ISP, "Invalid ISP hw type :%s", device_name_str);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+void cam_isp_hw_mgr_deinit(const char *device_name_str)
+{
+	if (strnstr(device_name_str, "ife", strlen(device_name_str)))
+		cam_ife_hw_mgr_deinit();
+	else if (strnstr(device_name_str, "tfe", strlen(device_name_str)))
+		cam_tfe_hw_mgr_deinit();
+	else
+		CAM_ERR(CAM_ISP, "Invalid ISP hw type :%s", device_name_str);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_isp_hw_mgr.h
@@ -0,0 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_HW_MGR_H_
+#define _CAM_ISP_HW_MGR_H_
+
+#include <media/cam_defs.h>
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_isp_hw.h"
+
+#define CAM_ISP_HW_NUM_MAX                       7
+
+/**
+ * struct cam_isp_hw_mgr_ctx - common acquired context for managers
+ *
+ * @takslet_info:          assciated tasklet
+ * @event_cb:              call back interface to ISP context. Set during
+ *                         acquire device
+ * @cb_priv:               first argument for the call back function
+ *                         set during acquire device
+ *
+ */
+struct cam_isp_hw_mgr_ctx {
+	void                           *tasklet_info;
+	cam_hw_event_cb_func            event_cb;
+	void                           *cb_priv;
+};
+
+/**
+ * struct cam_isp_hw_mgr - ISP HW Manager common object
+ *
+ * @tasklet_pool:             Tasklet pool
+ * @img_iommu_hdl:            iommu memory handle for regular image buffer
+ * @img_iommu_hdl_secure:     iommu memory handle for secure image buffer
+ * @cmd_iommu_hdl:            iommu memory handle for regular command buffer
+ * @cmd_iommu_hdl:            iommu memory handle for secure command buffer
+ * @scratch_buf_range:        scratch buffer range (not for IFE)
+ * @scratch_buf_addr:         scratch buffer address (not for IFE)
+ *
+ */
+struct cam_isp_hw_mgr {
+	void                           *tasklet_pool[CAM_CTX_MAX];
+	int                             img_iommu_hdl;
+	int                             img_iommu_hdl_secure;
+	int                             cmd_iommu_hdl;
+	int                             cmd_iommu_hdl_secure;
+	uint32_t                        scratch_buf_range;
+	dma_addr_t                      scratch_buf_addr;
+};
+
+/**
+ * struct cam_isp_hw_mgr_res- HW resources for the ISP hw manager
+ *
+ * @list:                used by the resource list
+ * @res_type:            ISP manager resource type
+ * @res_id:              resource id based on the resource type for root or
+ *                       leaf resource, it matches the KMD interface port id.
+ *                       For branch resource, it is defined by the ISP HW
+ *                       layer
+ * @is_dual_isp          is dual isp hw resource
+ * @hw_res:              hw layer resource array. For single ISP, only one ISP
+ *                       hw resource will be acquired. For dual ISP, two hw
+ *                       resources from different ISP HW device will be
+ *                       acquired
+ * @is_secure            informs whether the resource is in secure mode or not
+ * @num_children:        number of the child resource node.
+ *
+ */
+struct cam_isp_hw_mgr_res {
+	struct list_head                 list;
+	enum cam_isp_resource_type       res_type;
+	uint32_t                         res_id;
+	uint32_t                         is_dual_isp;
+	struct cam_isp_resource_node    *hw_res[CAM_ISP_HW_SPLIT_MAX];
+	uint32_t                         is_secure;
+	uint32_t                         num_children;
+};
+
+
+/**
+ * struct cam_isp_ctx_base_info - Base hardware information for the context
+ *
+ * @idx:                 Base resource index
+ * @split_id:            Split info for the base resource
+ *
+ */
+struct cam_isp_ctx_base_info {
+	uint32_t                       idx;
+	enum cam_isp_hw_split_id       split_id;
+};
+#endif /* _CAM_ISP_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c
@@ -0,0 +1,6187 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+#include <media/cam_tfe.h>
+
+#include "cam_smmu_api.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_tfe_csid_hw_intf.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_isp_packet_parser.h"
+#include "cam_tfe_hw_mgr.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_packet_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+#include "cam_req_mgr_debug.h"
+#include "cam_trace.h"
+#include "cam_compat.h"
+
+#define CAM_TFE_HW_CONFIG_TIMEOUT 60
+#define CAM_TFE_HW_CONFIG_WAIT_MAX_TRY  3
+
+#define TZ_SVC_SMMU_PROGRAM 0x15
+#define TZ_SAFE_SYSCALL_ID  0x3
+#define CAM_TFE_SAFE_DISABLE 0
+#define CAM_TFE_SAFE_ENABLE 1
+#define SMMU_SE_TFE 0
+
+
+static struct cam_tfe_hw_mgr g_tfe_hw_mgr;
+
+static int cam_tfe_hw_mgr_event_handler(
+	void                                *priv,
+	uint32_t                             evt_id,
+	void                                *evt_info);
+
+static int cam_tfe_mgr_regspace_data_cb(uint32_t reg_base_type,
+	void *hw_mgr_ctx, struct cam_hw_soc_info **soc_info_ptr,
+	uint32_t *reg_base_idx)
+{
+	int rc = 0;
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	struct cam_hw_soc_info    *soc_info = NULL;
+	struct cam_isp_resource_node       *res;
+	struct cam_tfe_hw_mgr_ctx *ctx =
+		(struct cam_tfe_hw_mgr_ctx *) hw_mgr_ctx;
+
+	*soc_info_ptr = NULL;
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		if ((hw_mgr_res->res_id != CAM_ISP_HW_TFE_IN_CAMIF) &&
+			!ctx->is_rdi_only_context)
+			continue;
+
+		switch (reg_base_type) {
+		case CAM_REG_DUMP_BASE_TYPE_CAMNOC:
+		case CAM_REG_DUMP_BASE_TYPE_ISP_LEFT:
+			if (!hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT])
+				continue;
+
+			res = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT];
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA,
+				&soc_info, sizeof(void *));
+
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in regspace data query split idx: %d rc : %d",
+					CAM_ISP_HW_SPLIT_LEFT, rc);
+				return rc;
+			}
+
+			if (reg_base_type == CAM_REG_DUMP_BASE_TYPE_ISP_LEFT)
+				*reg_base_idx = 0;
+			else
+				*reg_base_idx = 1;
+
+			*soc_info_ptr = soc_info;
+			break;
+		case CAM_REG_DUMP_BASE_TYPE_ISP_RIGHT:
+			if (!hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT])
+				continue;
+
+
+			res = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT];
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA,
+				&soc_info, sizeof(void *));
+
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in regspace data query split idx: %d rc : %d",
+					CAM_ISP_HW_SPLIT_RIGHT, rc);
+				return rc;
+			}
+
+			*reg_base_idx = 0;
+			*soc_info_ptr = soc_info;
+			break;
+		default:
+			CAM_ERR(CAM_ISP,
+				"Unrecognized reg base type: %d",
+				reg_base_type);
+			return -EINVAL;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_handle_reg_dump(struct cam_tfe_hw_mgr_ctx *ctx,
+	struct cam_cmd_buf_desc *reg_dump_buf_desc, uint32_t num_reg_dump_buf,
+	uint32_t meta_type,
+	void *soc_dump_args,
+	bool user_triggered_dump)
+{
+	int rc = -EINVAL, i;
+
+	if (!num_reg_dump_buf || !reg_dump_buf_desc) {
+		CAM_DBG(CAM_ISP,
+			"Invalid args for reg dump req_id: [%llu] ctx idx: [%u] meta_type: [%u] num_reg_dump_buf: [%u] reg_dump_buf_desc: [%pK]",
+			ctx->applied_req_id, ctx->ctx_index, meta_type,
+			num_reg_dump_buf, reg_dump_buf_desc);
+		return rc;
+	}
+
+	if (!atomic_read(&ctx->cdm_done))
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"Reg dump values might be from more than one request");
+
+	for (i = 0; i < num_reg_dump_buf; i++) {
+		CAM_DBG(CAM_ISP, "Reg dump cmd meta data: %u req_type: %u",
+			reg_dump_buf_desc[i].meta_data, meta_type);
+		if (reg_dump_buf_desc[i].meta_data == meta_type) {
+			rc = cam_soc_util_reg_dump_to_cmd_buf(ctx,
+				&reg_dump_buf_desc[i],
+				ctx->applied_req_id,
+				cam_tfe_mgr_regspace_data_cb,
+				soc_dump_args,
+				user_triggered_dump);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Reg dump failed at idx: %d, rc: %d req_id: %llu meta type: %u",
+					i, rc, ctx->applied_req_id, meta_type);
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_get_hw_caps(void *hw_mgr_priv,
+	void *hw_caps_args)
+{
+	int rc = 0;
+	int i;
+	uint32_t num_dev = 0;
+	struct cam_tfe_hw_mgr                  *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd               *query = hw_caps_args;
+	struct cam_isp_tfe_query_cap_cmd        query_isp;
+
+	CAM_DBG(CAM_ISP, "enter");
+
+	if (copy_from_user(&query_isp,
+		u64_to_user_ptr(query->caps_handle),
+		sizeof(struct cam_isp_tfe_query_cap_cmd))) {
+		rc = -EFAULT;
+		return rc;
+	}
+
+	query_isp.device_iommu.non_secure = hw_mgr->mgr_common.img_iommu_hdl;
+	query_isp.device_iommu.secure = hw_mgr->mgr_common.img_iommu_hdl_secure;
+	query_isp.cdm_iommu.non_secure = hw_mgr->mgr_common.cmd_iommu_hdl;
+	query_isp.cdm_iommu.secure = hw_mgr->mgr_common.cmd_iommu_hdl_secure;
+
+	for (i = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+		if (!hw_mgr->csid_devices[i])
+			continue;
+
+		query_isp.dev_caps[i].hw_type = CAM_ISP_TFE_HW_TFE;
+		query_isp.dev_caps[i].hw_version.major = 5;
+		query_isp.dev_caps[i].hw_version.minor = 3;
+		query_isp.dev_caps[i].hw_version.incr = 0;
+
+		/*
+		 * device number is based on number of full tfe
+		 * if pix is not supported, set reserve to 1
+		 */
+		if (hw_mgr->tfe_csid_dev_caps[i].num_pix) {
+			query_isp.dev_caps[i].hw_version.reserved = 0;
+			num_dev++;
+		} else
+			query_isp.dev_caps[i].hw_version.reserved = 1;
+	}
+
+	query_isp.num_dev = num_dev;
+
+	if (copy_to_user(u64_to_user_ptr(query->caps_handle),
+		&query_isp, sizeof(struct cam_isp_tfe_query_cap_cmd)))
+		rc = -EFAULT;
+
+	CAM_DBG(CAM_ISP, "exit rc :%d", rc);
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_is_rdi_res(uint32_t res_id)
+{
+	int rc = 0;
+
+	switch (res_id) {
+	case CAM_ISP_TFE_OUT_RES_RDI_0:
+	case CAM_ISP_TFE_OUT_RES_RDI_1:
+	case CAM_ISP_TFE_OUT_RES_RDI_2:
+		rc = 1;
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_convert_rdi_out_res_id_to_in_res(int res_id)
+{
+	if (res_id == CAM_ISP_TFE_OUT_RES_RDI_0)
+		return CAM_ISP_HW_TFE_IN_RDI0;
+	else if (res_id == CAM_ISP_TFE_OUT_RES_RDI_1)
+		return CAM_ISP_HW_TFE_IN_RDI1;
+	else if (res_id == CAM_ISP_TFE_OUT_RES_RDI_2)
+		return CAM_ISP_HW_TFE_IN_RDI1;
+
+	return CAM_ISP_HW_TFE_IN_MAX;
+}
+
+static int cam_tfe_hw_mgr_reset_csid_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	int rc = 0;
+	struct cam_hw_intf      *hw_intf;
+	struct cam_tfe_csid_reset_cfg_args  csid_reset_args;
+
+	csid_reset_args.reset_type = CAM_TFE_CSID_RESET_PATH;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		csid_reset_args.node_res = isp_hw_res->hw_res[i];
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		CAM_DBG(CAM_ISP, "Resetting csid hardware %d",
+			hw_intf->hw_idx);
+		if (hw_intf->hw_ops.reset) {
+			rc = hw_intf->hw_ops.reset(hw_intf->hw_priv,
+				&csid_reset_args,
+				sizeof(struct cam_tfe_csid_reset_cfg_args));
+			if (rc <= 0)
+				goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "RESET HW res failed: (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_init_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	int rc = -EINVAL;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		CAM_DBG(CAM_ISP, "hw type %d hw index:%d",
+			hw_intf->hw_type, hw_intf->hw_idx);
+		if (hw_intf->hw_ops.init) {
+			rc = hw_intf->hw_ops.init(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc)
+				goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "INIT HW res failed: (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_get_clock_rate(
+	struct cam_isp_hw_mgr_res   *isp_hw_res,
+	uint32_t                    *get_clock_rate)
+{
+	int i;
+	int rc = -EINVAL;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			CAM_DBG(CAM_ISP, "hw type %d hw index:%d",
+				hw_intf->hw_type, hw_intf->hw_idx);
+
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_CLOCK_RATE,
+				get_clock_rate,
+				sizeof(uint32_t));
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Failed to get Clock rate");
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_update_clock_rate(
+	struct cam_isp_hw_mgr_res   *isp_hw_res,
+	uint32_t                    *set_clock_rate,
+	uint32_t                    *updated_clock_rate)
+{
+	int i;
+	int rc = -EINVAL;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			CAM_DBG(CAM_ISP, "hw type %d hw index:%d",
+				hw_intf->hw_type, hw_intf->hw_idx);
+
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_DYNAMIC_CLOCK_UPDATE,
+				set_clock_rate,
+				sizeof(uint32_t));
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Failed to set Clock rate");
+				return rc;
+			}
+		}
+
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			CAM_DBG(CAM_ISP, "hw type %d hw index:%d",
+				hw_intf->hw_type, hw_intf->hw_idx);
+
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_CLOCK_RATE,
+				updated_clock_rate,
+				sizeof(uint32_t));
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Failed to get updated clock rate");
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_start_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res,
+	struct cam_tfe_hw_mgr_ctx   *ctx)
+{
+	int i;
+	int rc = -EINVAL;
+	struct cam_hw_intf      *hw_intf;
+
+	/* Start slave (which is right split) first */
+	for (i = CAM_ISP_HW_SPLIT_MAX - 1; i >= 0; i--) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.start) {
+			rc = hw_intf->hw_ops.start(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc) {
+				CAM_ERR(CAM_ISP, "Can not start HW resources");
+				goto err;
+			}
+			CAM_DBG(CAM_ISP, "Start hw type:%d HW idx %d Res %d",
+				hw_intf->hw_type,
+				hw_intf->hw_idx,
+				isp_hw_res->hw_res[i]->res_id);
+		} else {
+			CAM_ERR(CAM_ISP, "function null");
+			goto err;
+		}
+	}
+
+	return 0;
+err:
+	CAM_ERR(CAM_ISP, "Start hw res failed (type:%d, id:%d)",
+		isp_hw_res->res_type, isp_hw_res->res_id);
+	return rc;
+}
+
+static void cam_tfe_hw_mgr_stop_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	struct cam_hw_intf      *hw_intf;
+	uint32_t dummy_args;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+
+		if (isp_hw_res->hw_res[i]->res_state !=
+			CAM_ISP_RESOURCE_STATE_STREAMING)
+			continue;
+
+		if (hw_intf->hw_ops.stop)
+			hw_intf->hw_ops.stop(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+		else
+			CAM_ERR(CAM_ISP, "stop null");
+		if (hw_intf->hw_ops.process_cmd &&
+			isp_hw_res->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+			hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ,
+				&dummy_args, sizeof(dummy_args));
+		}
+	}
+}
+
+static void cam_tfe_hw_mgr_deinit_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int i;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.deinit)
+			hw_intf->hw_ops.deinit(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+	}
+}
+
+static void cam_tfe_hw_mgr_deinit_hw(
+	struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+
+	if (!ctx->init_done) {
+		CAM_WARN(CAM_ISP, "ctx is not in init state");
+		return;
+	}
+
+	/* Deinit TFE CSID hw */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		CAM_DBG(CAM_ISP, "Going to DeInit TFE CSID");
+		cam_tfe_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	/* Deint TFE HW */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		cam_tfe_hw_mgr_deinit_hw_res(hw_mgr_res);
+	}
+
+	if (ctx->is_tpg)
+		cam_tfe_hw_mgr_deinit_hw_res(&ctx->res_list_tpg);
+
+	ctx->init_done = false;
+}
+
+static int cam_tfe_hw_mgr_init_hw(
+	struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res *hw_mgr_res;
+	int rc = 0;
+
+	if (ctx->is_tpg) {
+		CAM_DBG(CAM_ISP, "INIT TPG ... in ctx id:%d",
+			ctx->ctx_index);
+		rc = cam_tfe_hw_mgr_init_hw_res(&ctx->res_list_tpg);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT TFE TPG(id :%d)",
+				ctx->res_list_tpg.hw_res[0]->hw_intf->hw_idx);
+			goto deinit;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "INIT TFE csid ... in ctx id:%d",
+		ctx->ctx_index);
+	/* INIT TFE csid */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		rc = cam_tfe_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT TFE CSID(id :%d)",
+				 hw_mgr_res->res_id);
+			goto deinit;
+		}
+	}
+
+	/* INIT TFE IN */
+	CAM_DBG(CAM_ISP, "INIT TFE in resource ctx id:%d",
+		ctx->ctx_index);
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		rc = cam_tfe_hw_mgr_init_hw_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not INIT TFE SRC (%d)",
+				 hw_mgr_res->res_id);
+			goto deinit;
+		}
+	}
+
+	return rc;
+deinit:
+	ctx->init_done = true;
+	cam_tfe_hw_mgr_deinit_hw(ctx);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_put_res(
+	struct list_head                *src_list,
+	struct cam_isp_hw_mgr_res      **res)
+{
+	struct cam_isp_hw_mgr_res *res_ptr  = NULL;
+
+	res_ptr = *res;
+	if (res_ptr)
+		list_add_tail(&res_ptr->list, src_list);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_get_res(
+	struct list_head                *src_list,
+	struct cam_isp_hw_mgr_res      **res)
+{
+	int rc = 0;
+	struct cam_isp_hw_mgr_res *res_ptr  = NULL;
+
+	if (!list_empty(src_list)) {
+		res_ptr = list_first_entry(src_list,
+			struct cam_isp_hw_mgr_res, list);
+		list_del_init(&res_ptr->list);
+	} else {
+		CAM_ERR(CAM_ISP, "No more free tfe hw mgr ctx");
+		rc = -EINVAL;
+	}
+	*res = res_ptr;
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_free_hw_res(
+	struct cam_isp_hw_mgr_res   *isp_hw_res)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_intf      *hw_intf;
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!isp_hw_res->hw_res[i])
+			continue;
+		hw_intf = isp_hw_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.release) {
+			rc = hw_intf->hw_ops.release(hw_intf->hw_priv,
+				isp_hw_res->hw_res[i],
+				sizeof(struct cam_isp_resource_node));
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Release hw resource id %d failed",
+					isp_hw_res->res_id);
+			isp_hw_res->hw_res[i] = NULL;
+		} else
+			CAM_ERR(CAM_ISP, "Release null");
+	}
+	/* caller should make sure the resource is in a list */
+	list_del_init(&isp_hw_res->list);
+	memset(isp_hw_res, 0, sizeof(*isp_hw_res));
+	INIT_LIST_HEAD(&isp_hw_res->list);
+
+	return 0;
+}
+
+static int cam_tfe_mgr_csid_change_halt_mode(struct cam_tfe_hw_mgr_ctx *ctx,
+	enum cam_tfe_csid_halt_mode halt_mode)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_resource_node     *isp_res;
+	struct cam_tfe_csid_hw_halt_args halt;
+	struct cam_hw_intf               *hw_intf;
+	uint32_t i;
+	int rc = 0;
+
+	if (!ctx->is_dual)
+		return 0;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (i == CAM_ISP_HW_SPLIT_LEFT)
+				continue;
+
+			if (!hw_mgr_res->hw_res[i] ||
+				(hw_mgr_res->hw_res[i]->res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING))
+				continue;
+
+			isp_res = hw_mgr_res->hw_res[i];
+
+			if ((isp_res->res_type == CAM_ISP_RESOURCE_PIX_PATH) &&
+				(isp_res->res_id ==
+					CAM_TFE_CSID_PATH_RES_IPP)) {
+				hw_intf         = isp_res->hw_intf;
+				halt.node_res   = isp_res;
+				halt.halt_mode  = halt_mode;
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE,
+					&halt,
+					sizeof(
+					struct cam_tfe_csid_hw_halt_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Halt update failed");
+				break;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_csid_stop_hw(
+	struct cam_tfe_hw_mgr_ctx *ctx, struct list_head  *stop_list,
+		uint32_t  base_idx, uint32_t stop_cmd)
+{
+	struct cam_isp_hw_mgr_res      *hw_mgr_res;
+	struct cam_isp_resource_node   *isp_res;
+	struct cam_isp_resource_node   *stop_res[CAM_TFE_CSID_PATH_RES_MAX];
+	struct cam_tfe_csid_hw_stop_args    stop;
+	struct cam_hw_intf             *hw_intf;
+	uint32_t i, cnt;
+
+	cnt = 0;
+	list_for_each_entry(hw_mgr_res, stop_list, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i] ||
+				(hw_mgr_res->hw_res[i]->res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING))
+				continue;
+
+			isp_res = hw_mgr_res->hw_res[i];
+			if (isp_res->hw_intf->hw_idx != base_idx)
+				continue;
+			CAM_DBG(CAM_ISP, "base_idx %d res_id %d cnt %u",
+				base_idx, isp_res->res_id, cnt);
+			stop_res[cnt] = isp_res;
+			cnt++;
+		}
+	}
+
+	if (cnt) {
+		hw_intf =  stop_res[0]->hw_intf;
+		stop.num_res = cnt;
+		stop.node_res = stop_res;
+		stop.stop_cmd = stop_cmd;
+		hw_intf->hw_ops.stop(hw_intf->hw_priv, &stop, sizeof(stop));
+	}
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_release_hw_for_ctx(
+	struct cam_tfe_hw_mgr_ctx  *tfe_ctx)
+{
+	uint32_t                          i;
+	int rc = 0;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res_temp;
+	struct cam_hw_intf               *hw_intf;
+
+	/* tfe out resource */
+	for (i = 0; i < CAM_TFE_HW_OUT_RES_MAX; i++)
+		cam_tfe_hw_mgr_free_hw_res(&tfe_ctx->res_list_tfe_out[i]);
+
+	/* tfe in resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&tfe_ctx->res_list_tfe_in, list) {
+		cam_tfe_hw_mgr_free_hw_res(hw_mgr_res);
+		cam_tfe_hw_mgr_put_res(&tfe_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* tfe csid resource */
+	list_for_each_entry_safe(hw_mgr_res, hw_mgr_res_temp,
+		&tfe_ctx->res_list_tfe_csid, list) {
+		cam_tfe_hw_mgr_free_hw_res(hw_mgr_res);
+		cam_tfe_hw_mgr_put_res(&tfe_ctx->free_res_list, &hw_mgr_res);
+	}
+
+	/* release tpg resource */
+	if (tfe_ctx->is_tpg) {
+		hw_intf = tfe_ctx->res_list_tpg.hw_res[0]->hw_intf;
+		if (hw_intf->hw_ops.release) {
+			rc = hw_intf->hw_ops.release(hw_intf->hw_priv,
+				tfe_ctx->res_list_tpg.hw_res[0],
+				sizeof(struct cam_isp_resource_node));
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"TPG Release hw failed");
+			tfe_ctx->res_list_tpg.hw_res[0] = NULL;
+		} else
+			CAM_ERR(CAM_ISP, "TPG resource Release null");
+	}
+
+	/* clean up the callback function */
+	tfe_ctx->common.cb_priv = NULL;
+	tfe_ctx->common.event_cb = NULL;
+
+	CAM_DBG(CAM_ISP, "release context completed ctx id:%d",
+		tfe_ctx->ctx_index);
+
+	return 0;
+}
+
+
+static int cam_tfe_hw_mgr_put_ctx(
+	struct list_head                 *src_list,
+	struct cam_tfe_hw_mgr_ctx       **tfe_ctx)
+{
+	struct cam_tfe_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	ctx_ptr = *tfe_ctx;
+	if (ctx_ptr)
+		list_add_tail(&ctx_ptr->list, src_list);
+	*tfe_ctx = NULL;
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_get_ctx(
+	struct list_head                *src_list,
+	struct cam_tfe_hw_mgr_ctx       **tfe_ctx)
+{
+	int rc                              = 0;
+	struct cam_tfe_hw_mgr_ctx *ctx_ptr  = NULL;
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	if (!list_empty(src_list)) {
+		ctx_ptr = list_first_entry(src_list,
+			struct cam_tfe_hw_mgr_ctx, list);
+		list_del_init(&ctx_ptr->list);
+	} else {
+		CAM_ERR(CAM_ISP, "No more free tfe hw mgr ctx");
+		rc = -EINVAL;
+	}
+	*tfe_ctx = ctx_ptr;
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+
+	return rc;
+}
+
+static void cam_tfe_hw_mgr_dump_all_ctx(void)
+{
+	uint32_t i;
+	struct cam_tfe_hw_mgr_ctx       *ctx;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	list_for_each_entry(ctx, &g_tfe_hw_mgr.used_ctx_list, list) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"ctx id:%d is_dual:%d is_tpg:%d num_base:%d rdi only:%d",
+			ctx->ctx_index, ctx->is_dual, ctx->is_tpg,
+			ctx->num_base, ctx->is_rdi_only_context);
+
+		if (ctx->res_list_tpg.res_type == CAM_ISP_RESOURCE_TPG) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"Acquired TPG HW:%d",
+				ctx->res_list_tpg.hw_res[0]->hw_intf->hw_idx);
+		}
+
+		list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid,
+			list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"csid:%d res_type:%d res_id:%d res_state:%d",
+					hw_mgr_res->hw_res[i]->hw_intf->hw_idx,
+					hw_mgr_res->hw_res[i]->res_type,
+					hw_mgr_res->hw_res[i]->res_id,
+					hw_mgr_res->hw_res[i]->res_state);
+			}
+		}
+
+		list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in,
+			list) {
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!hw_mgr_res->hw_res[i])
+					continue;
+
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"TFE IN:%d res_type:%d res_id:%d res_state:%d",
+					hw_mgr_res->hw_res[i]->hw_intf->hw_idx,
+					hw_mgr_res->hw_res[i]->res_type,
+					hw_mgr_res->hw_res[i]->res_id,
+					hw_mgr_res->hw_res[i]->res_state);
+			}
+		}
+	}
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+
+}
+
+static void cam_tfe_mgr_add_base_info(
+	struct cam_tfe_hw_mgr_ctx       *ctx,
+	enum cam_isp_hw_split_id         split_id,
+	uint32_t                         base_idx)
+{
+	uint32_t    i;
+
+	if (!ctx->num_base) {
+		ctx->base[0].split_id = split_id;
+		ctx->base[0].idx      = base_idx;
+		ctx->num_base++;
+		CAM_DBG(CAM_ISP,
+			"Add split id = %d for base idx = %d num_base=%d",
+			split_id, base_idx, ctx->num_base);
+	} else {
+		/*Check if base index already exists in the list */
+		for (i = 0; i < ctx->num_base; i++) {
+			if (ctx->base[i].idx == base_idx) {
+				if (split_id != CAM_ISP_HW_SPLIT_MAX &&
+					ctx->base[i].split_id ==
+						CAM_ISP_HW_SPLIT_MAX)
+					ctx->base[i].split_id = split_id;
+
+				break;
+			}
+		}
+
+		if (i == ctx->num_base) {
+			ctx->base[ctx->num_base].split_id = split_id;
+			ctx->base[ctx->num_base].idx      = base_idx;
+			ctx->num_base++;
+			CAM_DBG(CAM_ISP,
+				"Add split_id=%d for base idx=%d num_base=%d",
+				 split_id, base_idx, ctx->num_base);
+		}
+	}
+}
+
+static int cam_tfe_mgr_process_base_info(
+	struct cam_tfe_hw_mgr_ctx        *ctx)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_isp_resource_node     *res = NULL;
+	uint32_t i;
+
+	if (list_empty(&ctx->res_list_tfe_in)) {
+		CAM_ERR(CAM_ISP, "tfe in list empty");
+		return -ENODEV;
+	}
+
+	/* TFE in resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			cam_tfe_mgr_add_base_info(ctx, i,
+					res->hw_intf->hw_idx);
+			CAM_DBG(CAM_ISP, "add base info for hw %d",
+				res->hw_intf->hw_idx);
+		}
+	}
+	CAM_DBG(CAM_ISP, "ctx base num = %d", ctx->num_base);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_out_rdi(
+	struct cam_tfe_hw_mgr_ctx         *tfe_ctx,
+	struct cam_isp_hw_mgr_res         *tfe_in_res,
+	struct cam_isp_tfe_in_port_info   *in_port)
+{
+	int rc = -EINVAL;
+	struct cam_tfe_acquire_args              tfe_acquire;
+	struct cam_isp_tfe_out_port_info         *out_port = NULL;
+	struct cam_isp_hw_mgr_res                *tfe_out_res;
+	struct cam_hw_intf                       *hw_intf;
+	uint32_t  i, tfe_out_res_id, tfe_in_res_id;
+
+	/* take left resource */
+	tfe_in_res_id = tfe_in_res->hw_res[0]->res_id;
+
+	switch (tfe_in_res_id) {
+	case CAM_ISP_HW_TFE_IN_RDI0:
+		tfe_out_res_id = CAM_ISP_TFE_OUT_RES_RDI_0;
+		break;
+	case CAM_ISP_HW_TFE_IN_RDI1:
+		tfe_out_res_id = CAM_ISP_TFE_OUT_RES_RDI_1;
+		break;
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		tfe_out_res_id = CAM_ISP_TFE_OUT_RES_RDI_2;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "invalid resource type");
+		goto err;
+	}
+	CAM_DBG(CAM_ISP, "tfe_in_res_id = %d, tfe_out_red_id = %d",
+		tfe_in_res_id, tfe_out_res_id);
+
+	tfe_acquire.rsrc_type = CAM_ISP_RESOURCE_TFE_OUT;
+	tfe_acquire.tasklet = tfe_ctx->common.tasklet_info;
+
+	tfe_out_res = &tfe_ctx->res_list_tfe_out[tfe_out_res_id & 0xFF];
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+
+		CAM_DBG(CAM_ISP, "i = %d, tfe_out_res_id = %d, out_port: %d",
+			i, tfe_out_res_id, out_port->res_id);
+
+		if (tfe_out_res_id != out_port->res_id)
+			continue;
+
+		tfe_acquire.tfe_out.cdm_ops = tfe_ctx->cdm_ops;
+		tfe_acquire.priv = tfe_ctx;
+		tfe_acquire.tfe_out.out_port_info = out_port;
+		tfe_acquire.tfe_out.split_id = CAM_ISP_HW_SPLIT_LEFT;
+		tfe_acquire.tfe_out.unique_id = tfe_ctx->ctx_index;
+		tfe_acquire.tfe_out.is_dual = 0;
+		tfe_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+		hw_intf = tfe_in_res->hw_res[0]->hw_intf;
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&tfe_acquire,
+			sizeof(struct cam_tfe_acquire_args));
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not acquire out resource 0x%x",
+				 out_port->res_id);
+			goto err;
+		}
+		break;
+	}
+
+	if (i == in_port->num_out_res) {
+		CAM_ERR(CAM_ISP,
+			"Cannot acquire out resource, i=%d, num_out_res=%d",
+			i, in_port->num_out_res);
+		goto err;
+	}
+
+	tfe_out_res->hw_res[0] = tfe_acquire.tfe_out.rsrc_node;
+	tfe_out_res->is_dual_isp = 0;
+	tfe_out_res->res_id = tfe_out_res_id;
+	tfe_out_res->res_type = CAM_ISP_RESOURCE_TFE_OUT;
+	tfe_in_res->num_children++;
+
+	return 0;
+err:
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_out_pixel(
+	struct cam_tfe_hw_mgr_ctx           *tfe_ctx,
+	struct cam_isp_hw_mgr_res           *tfe_in_res,
+	struct cam_isp_tfe_in_port_info     *in_port)
+{
+	int rc = -EINVAL;
+	uint32_t  i, j, k;
+	struct cam_tfe_acquire_args               tfe_acquire;
+	struct cam_isp_tfe_out_port_info          *out_port;
+	struct cam_isp_hw_mgr_res                *tfe_out_res;
+	struct cam_hw_intf                       *hw_intf;
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		k = out_port->res_id & 0xFF;
+		if (k >= CAM_TFE_HW_OUT_RES_MAX) {
+			CAM_ERR(CAM_ISP, "invalid output resource type 0x%x",
+				 out_port->res_id);
+			continue;
+		}
+
+		if (cam_tfe_hw_mgr_is_rdi_res(out_port->res_id))
+			continue;
+
+		CAM_DBG(CAM_ISP, "res_type 0x%x", out_port->res_id);
+
+		tfe_out_res = &tfe_ctx->res_list_tfe_out[k];
+		tfe_out_res->is_dual_isp = in_port->usage_type;
+
+		tfe_acquire.rsrc_type = CAM_ISP_RESOURCE_TFE_OUT;
+		tfe_acquire.tasklet = tfe_ctx->common.tasklet_info;
+		tfe_acquire.tfe_out.cdm_ops = tfe_ctx->cdm_ops;
+		tfe_acquire.priv = tfe_ctx;
+		tfe_acquire.tfe_out.out_port_info =  out_port;
+		tfe_acquire.tfe_out.is_dual       = tfe_in_res->is_dual_isp;
+		tfe_acquire.tfe_out.unique_id     = tfe_ctx->ctx_index;
+		tfe_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!tfe_in_res->hw_res[j])
+				continue;
+
+			hw_intf = tfe_in_res->hw_res[j]->hw_intf;
+
+			if (j == CAM_ISP_HW_SPLIT_LEFT) {
+				tfe_acquire.tfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_LEFT;
+				if (tfe_in_res->is_dual_isp)
+					tfe_acquire.tfe_out.is_master   = 1;
+				else
+					tfe_acquire.tfe_out.is_master   = 0;
+			} else {
+				tfe_acquire.tfe_out.split_id  =
+					CAM_ISP_HW_SPLIT_RIGHT;
+				tfe_acquire.tfe_out.is_master       = 0;
+			}
+
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&tfe_acquire,
+				sizeof(struct cam_tfe_acquire_args));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire out resource 0x%x",
+					out_port->res_id);
+				goto err;
+			}
+
+			tfe_out_res->hw_res[j] =
+				tfe_acquire.tfe_out.rsrc_node;
+			CAM_DBG(CAM_ISP, "resource type :0x%x res id:0x%x",
+				tfe_out_res->hw_res[j]->res_type,
+				tfe_out_res->hw_res[j]->res_id);
+
+		}
+		tfe_out_res->res_type = CAM_ISP_RESOURCE_TFE_OUT;
+		tfe_out_res->res_id = out_port->res_id;
+		tfe_in_res->num_children++;
+	}
+
+	return 0;
+err:
+	/* release resource at the entry function */
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_out(
+	struct cam_tfe_hw_mgr_ctx         *tfe_ctx,
+	struct cam_isp_tfe_in_port_info   *in_port)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res       *tfe_in_res;
+
+	list_for_each_entry(tfe_in_res, &tfe_ctx->res_list_tfe_in, list) {
+		if (tfe_in_res->num_children)
+			continue;
+
+		switch (tfe_in_res->res_id) {
+		case CAM_ISP_HW_TFE_IN_CAMIF:
+			rc = cam_tfe_hw_mgr_acquire_res_tfe_out_pixel(tfe_ctx,
+				tfe_in_res, in_port);
+			break;
+		case CAM_ISP_HW_TFE_IN_RDI0:
+		case CAM_ISP_HW_TFE_IN_RDI1:
+		case CAM_ISP_HW_TFE_IN_RDI2:
+			rc = cam_tfe_hw_mgr_acquire_res_tfe_out_rdi(tfe_ctx,
+				tfe_in_res, in_port);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unknown TFE SRC resource: %d",
+				tfe_in_res->res_id);
+			break;
+		}
+		if (rc)
+			goto err;
+	}
+
+	return 0;
+err:
+	/* release resource on entry function */
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_in(
+	struct cam_tfe_hw_mgr_ctx         *tfe_ctx,
+	struct cam_isp_tfe_in_port_info   *in_port,
+	uint32_t                          *pdaf_enable)
+{
+	int rc                = -EINVAL;
+	int i;
+	struct cam_isp_hw_mgr_res                  *csid_res;
+	struct cam_isp_hw_mgr_res                  *tfe_src_res;
+	struct cam_tfe_acquire_args                 tfe_acquire;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_tfe_hw_mgr                      *tfe_hw_mgr;
+
+	tfe_hw_mgr = tfe_ctx->hw_mgr;
+
+	list_for_each_entry(csid_res, &tfe_ctx->res_list_tfe_csid, list) {
+		if (csid_res->num_children)
+			continue;
+
+		rc = cam_tfe_hw_mgr_get_res(&tfe_ctx->free_res_list,
+			&tfe_src_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+			goto err;
+		}
+		cam_tfe_hw_mgr_put_res(&tfe_ctx->res_list_tfe_in,
+			&tfe_src_res);
+		tfe_src_res->hw_res[0] = NULL;
+		tfe_src_res->hw_res[1] = NULL;
+
+		tfe_acquire.rsrc_type = CAM_ISP_RESOURCE_TFE_IN;
+		tfe_acquire.tasklet = tfe_ctx->common.tasklet_info;
+		tfe_acquire.tfe_in.cdm_ops = tfe_ctx->cdm_ops;
+		tfe_acquire.tfe_in.in_port = in_port;
+		tfe_acquire.tfe_in.camif_pd_enable = *pdaf_enable;
+		tfe_acquire.priv = tfe_ctx;
+		tfe_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+
+		switch (csid_res->res_id) {
+		case CAM_TFE_CSID_PATH_RES_IPP:
+			tfe_acquire.tfe_in.res_id =
+				CAM_ISP_HW_TFE_IN_CAMIF;
+
+			if (csid_res->is_dual_isp)
+				tfe_acquire.tfe_in.sync_mode =
+				CAM_ISP_HW_SYNC_MASTER;
+			else
+				tfe_acquire.tfe_in.sync_mode =
+				CAM_ISP_HW_SYNC_NONE;
+
+			break;
+		case CAM_TFE_CSID_PATH_RES_RDI_0:
+			tfe_acquire.tfe_in.res_id = CAM_ISP_HW_TFE_IN_RDI0;
+			tfe_acquire.tfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_TFE_CSID_PATH_RES_RDI_1:
+			tfe_acquire.tfe_in.res_id = CAM_ISP_HW_TFE_IN_RDI1;
+			tfe_acquire.tfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		case CAM_TFE_CSID_PATH_RES_RDI_2:
+			tfe_acquire.tfe_in.res_id = CAM_ISP_HW_TFE_IN_RDI2;
+			tfe_acquire.tfe_in.sync_mode = CAM_ISP_HW_SYNC_NONE;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Wrong TFE CSID Resource Node");
+			goto err;
+		}
+		tfe_src_res->res_type = tfe_acquire.rsrc_type;
+		tfe_src_res->res_id = tfe_acquire.tfe_in.res_id;
+		tfe_src_res->is_dual_isp = csid_res->is_dual_isp;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!csid_res->hw_res[i])
+				continue;
+
+			hw_intf = tfe_hw_mgr->tfe_devices[
+				csid_res->hw_res[i]->hw_intf->hw_idx]->hw_intf;
+
+			/* fill in more acquire information as needed */
+			/* slave Camif resource, */
+			if (i == CAM_ISP_HW_SPLIT_RIGHT &&
+				tfe_src_res->is_dual_isp) {
+				tfe_acquire.tfe_in.sync_mode =
+				CAM_ISP_HW_SYNC_SLAVE;
+				tfe_acquire.tfe_in.dual_tfe_sync_sel_idx =
+					csid_res->hw_res[0]->hw_intf->hw_idx;
+			} else if (i == CAM_ISP_HW_SPLIT_LEFT &&
+				tfe_src_res->is_dual_isp)
+				tfe_acquire.tfe_in.dual_tfe_sync_sel_idx =
+					csid_res->hw_res[1]->hw_intf->hw_idx;
+
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&tfe_acquire,
+					sizeof(struct cam_tfe_acquire_args));
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire TFE HW res %d",
+					csid_res->res_id);
+				goto err;
+			}
+			tfe_src_res->hw_res[i] = tfe_acquire.tfe_in.rsrc_node;
+			CAM_DBG(CAM_ISP,
+				"acquire success TFE:%d  res type :0x%x res id:0x%x",
+				hw_intf->hw_idx,
+				tfe_src_res->hw_res[i]->res_type,
+				tfe_src_res->hw_res[i]->res_id);
+
+		}
+		csid_res->num_children++;
+	}
+
+	return 0;
+err:
+	/* release resource at the entry function */
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_csid_pxl(
+	struct cam_tfe_hw_mgr_ctx              *tfe_ctx,
+	struct cam_isp_tfe_in_port_info        *in_port)
+{
+	int rc = -EINVAL;
+	int i, j;
+	uint32_t acquired_cnt = 0;
+	struct cam_tfe_hw_mgr                        *tfe_hw_mgr;
+	struct cam_isp_hw_mgr_res                    *csid_res;
+	struct cam_hw_intf                           *hw_intf;
+	struct cam_tfe_csid_hw_reserve_resource_args  csid_acquire;
+	enum cam_tfe_csid_path_res_id                 path_res_id;
+	struct cam_isp_hw_mgr_res        *csid_res_temp, *csid_res_iterator;
+	struct cam_isp_tfe_out_port_info        *out_port = NULL;
+
+	tfe_hw_mgr = tfe_ctx->hw_mgr;
+	/* get csid resource */
+	path_res_id = CAM_TFE_CSID_PATH_RES_IPP;
+
+	rc = cam_tfe_hw_mgr_get_res(&tfe_ctx->free_res_list, &csid_res);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+		goto end;
+	}
+
+	csid_res_temp = csid_res;
+
+	csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	csid_acquire.res_id = path_res_id;
+	csid_acquire.in_port = in_port;
+	csid_acquire.out_port = in_port->data;
+	csid_acquire.node_res = NULL;
+	csid_acquire.event_cb_prv = tfe_ctx;
+	csid_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+	if (in_port->num_out_res)
+		out_port = &(in_port->data[0]);
+
+	if (tfe_ctx->is_tpg) {
+		if (tfe_ctx->res_list_tpg.hw_res[0]->hw_intf->hw_idx == 0)
+			csid_acquire.phy_sel = CAM_ISP_TFE_IN_RES_PHY_0;
+		else
+			csid_acquire.phy_sel = CAM_ISP_TFE_IN_RES_PHY_1;
+	}
+
+	if (in_port->usage_type)
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_MASTER;
+	else
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+
+	/* Try acquiring CSID resource from previously acquired HW */
+	list_for_each_entry(csid_res_iterator, &tfe_ctx->res_list_tfe_csid,
+		list) {
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!csid_res_iterator->hw_res[i])
+				continue;
+
+			if (csid_res_iterator->is_secure == 1 ||
+				(csid_res_iterator->is_secure == 0 &&
+				in_port->num_out_res &&
+				out_port->secure_mode == 1))
+				continue;
+
+			hw_intf = csid_res_iterator->hw_res[i]->hw_intf;
+			csid_acquire.master_idx = hw_intf->hw_idx;
+
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+			if (rc) {
+				CAM_DBG(CAM_ISP,
+					"No tfe csid resource from hw %d",
+					hw_intf->hw_idx);
+				continue;
+			}
+
+			csid_res_temp->hw_res[acquired_cnt++] =
+				csid_acquire.node_res;
+
+			CAM_DBG(CAM_ISP,
+				"acquired from old csid(%s)=%d CSID rsrc successfully",
+				(i == 0) ? "left" : "right",
+				hw_intf->hw_idx);
+
+			if (in_port->usage_type && acquired_cnt == 1 &&
+				path_res_id == CAM_TFE_CSID_PATH_RES_IPP)
+				/*
+				 * Continue to acquire Right for IPP.
+				 * Dual TFE for RDI is not currently
+				 * supported.
+				 */
+				continue;
+
+			if (acquired_cnt)
+				/*
+				 * If successfully acquired CSID from
+				 * previously acquired HW, skip the next
+				 * part
+				 */
+				goto acquire_successful;
+		}
+	}
+
+	/*
+	 * If successfully acquired CSID from
+	 * previously acquired HW, skip the next
+	 * part
+	 */
+	if (acquired_cnt)
+		goto acquire_successful;
+
+	/* Acquire Left if not already acquired */
+	if (in_port->usage_type) {
+		for (i = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+			if (!tfe_hw_mgr->csid_devices[i])
+				continue;
+
+			hw_intf = tfe_hw_mgr->csid_devices[i];
+			csid_acquire.master_idx = hw_intf->hw_idx;
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+			if (rc)
+				continue;
+			else {
+				csid_res_temp->hw_res[acquired_cnt++] =
+					csid_acquire.node_res;
+				break;
+			}
+		}
+
+		if (i == CAM_TFE_CSID_HW_NUM_MAX || !csid_acquire.node_res) {
+			CAM_ERR(CAM_ISP,
+				"Can not acquire left tfe csid path resource %d",
+				path_res_id);
+			goto put_res;
+		}
+	} else {
+		for (i = (CAM_TFE_CSID_HW_NUM_MAX - 1); i >= 0; i--) {
+			if (!tfe_hw_mgr->csid_devices[i])
+				continue;
+
+			hw_intf = tfe_hw_mgr->csid_devices[i];
+			csid_acquire.master_idx = hw_intf->hw_idx;
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+			if (rc)
+				continue;
+			else {
+				csid_res_temp->hw_res[acquired_cnt++] =
+					csid_acquire.node_res;
+				break;
+			}
+		}
+
+		if (i == -1 || !csid_acquire.node_res) {
+			CAM_ERR(CAM_ISP,
+				"Can not acquire tfe csid path resource %d",
+				path_res_id);
+			goto put_res;
+		}
+	}
+acquire_successful:
+	CAM_DBG(CAM_ISP, "CSID path left acquired success. is_dual %d",
+		in_port->usage_type);
+
+	csid_res_temp->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+	csid_res_temp->res_id = path_res_id;
+
+	if (in_port->usage_type) {
+		csid_res_temp->is_dual_isp = 1;
+		tfe_ctx->is_dual = true;
+		tfe_ctx->master_hw_idx =
+			csid_res_temp->hw_res[0]->hw_intf->hw_idx;
+	} else
+		csid_res_temp->is_dual_isp = 0;
+
+	if (in_port->num_out_res)
+		csid_res_temp->is_secure = out_port->secure_mode;
+
+	cam_tfe_hw_mgr_put_res(&tfe_ctx->res_list_tfe_csid, &csid_res);
+
+	/*
+	 * Acquire Right if not already acquired.
+	 * Dual TFE for RDI is not currently supported.
+	 */
+	if (in_port->usage_type && (path_res_id == CAM_TFE_CSID_PATH_RES_IPP)
+		&& (acquired_cnt == 1)) {
+		memset(&csid_acquire, 0, sizeof(csid_acquire));
+		csid_acquire.node_res = NULL;
+		csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_acquire.res_id = path_res_id;
+		csid_acquire.in_port = in_port;
+		csid_acquire.master_idx =
+			csid_res_temp->hw_res[0]->hw_intf->hw_idx;
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_SLAVE;
+		csid_acquire.node_res = NULL;
+		csid_acquire.out_port = in_port->data;
+		csid_acquire.event_cb_prv = tfe_ctx;
+		csid_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+
+		if (tfe_ctx->is_tpg) {
+			if (tfe_ctx->res_list_tpg.hw_res[0]->hw_intf->hw_idx
+				== 0)
+				csid_acquire.phy_sel = CAM_ISP_TFE_IN_RES_PHY_0;
+			else
+				csid_acquire.phy_sel = CAM_ISP_TFE_IN_RES_PHY_1;
+		}
+
+		for (j = 0; j < CAM_TFE_CSID_HW_NUM_MAX; j++) {
+			if (!tfe_hw_mgr->csid_devices[j])
+				continue;
+
+			if (j == csid_res_temp->hw_res[0]->hw_intf->hw_idx)
+				continue;
+
+			hw_intf = tfe_hw_mgr->csid_devices[j];
+			rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+				&csid_acquire, sizeof(csid_acquire));
+			if (rc)
+				continue;
+			else
+				break;
+		}
+
+		if (j == CAM_TFE_CSID_HW_NUM_MAX) {
+			CAM_ERR(CAM_ISP,
+				"Can not acquire tfe csid pixel resource");
+			goto end;
+		}
+		csid_res_temp->hw_res[1] = csid_acquire.node_res;
+		tfe_ctx->slave_hw_idx =
+			csid_res_temp->hw_res[1]->hw_intf->hw_idx;
+		CAM_DBG(CAM_ISP, "CSID right acquired success is_dual %d",
+			in_port->usage_type);
+	}
+
+	return 0;
+put_res:
+	cam_tfe_hw_mgr_put_res(&tfe_ctx->free_res_list, &csid_res);
+end:
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_acquire_tpg(
+	struct cam_tfe_hw_mgr_ctx               *tfe_ctx,
+	struct cam_isp_tfe_in_port_info        **in_port,
+	uint32_t                                 num_inport)
+{
+	int rc = -EINVAL;
+	uint32_t i, j = 0;
+	struct cam_tfe_hw_mgr                        *tfe_hw_mgr;
+	struct cam_hw_intf                           *hw_intf;
+	struct cam_top_tpg_ver1_reserve_args          tpg_reserve;
+
+	tfe_hw_mgr = tfe_ctx->hw_mgr;
+
+	for (i = 0; i < CAM_TOP_TPG_HW_NUM_MAX; i++) {
+		if (!tfe_hw_mgr->tpg_devices[i])
+			continue;
+
+		hw_intf = tfe_hw_mgr->tpg_devices[i];
+		tpg_reserve.num_inport = num_inport;
+		tpg_reserve.node_res = NULL;
+		for (j = 0; j < num_inport; j++)
+			tpg_reserve.in_port[j] = in_port[j];
+
+		rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+			&tpg_reserve, sizeof(tpg_reserve));
+		if (!rc)
+			break;
+	}
+
+	if (i == CAM_TOP_TPG_HW_NUM_MAX || !tpg_reserve.node_res) {
+		CAM_ERR(CAM_ISP, "Can not acquire tfe TPG");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	tfe_ctx->res_list_tpg.res_type = CAM_ISP_RESOURCE_TPG;
+	tfe_ctx->res_list_tpg.hw_res[0] = tpg_reserve.node_res;
+
+end:
+	return rc;
+}
+
+static enum cam_tfe_csid_path_res_id
+	cam_tfe_hw_mgr_get_tfe_csid_rdi_res_type(
+	uint32_t                 out_port_type)
+{
+	enum cam_tfe_csid_path_res_id path_id;
+
+	CAM_DBG(CAM_ISP, "out_port_type %x", out_port_type);
+	switch (out_port_type) {
+	case CAM_ISP_TFE_OUT_RES_RDI_0:
+		path_id = CAM_TFE_CSID_PATH_RES_RDI_0;
+		break;
+	case CAM_ISP_TFE_OUT_RES_RDI_1:
+		path_id = CAM_TFE_CSID_PATH_RES_RDI_1;
+		break;
+	case CAM_ISP_TFE_OUT_RES_RDI_2:
+		path_id = CAM_TFE_CSID_PATH_RES_RDI_2;
+		break;
+	default:
+		path_id = CAM_TFE_CSID_PATH_RES_MAX;
+		CAM_DBG(CAM_ISP, "maximum rdi type exceeded out_port_type:%d ",
+			out_port_type);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "out_port %x path_id %d", out_port_type, path_id);
+
+	return path_id;
+}
+
+static int cam_tfe_hw_mgr_acquire_res_tfe_csid_rdi(
+	struct cam_tfe_hw_mgr_ctx         *tfe_ctx,
+	struct cam_isp_tfe_in_port_info   *in_port)
+{
+	int rc = -EINVAL;
+	int i, j;
+
+	struct cam_tfe_hw_mgr               *tfe_hw_mgr;
+	struct cam_isp_hw_mgr_res           *csid_res;
+	struct cam_hw_intf                  *hw_intf;
+	struct cam_isp_tfe_out_port_info    *out_port;
+	struct cam_tfe_csid_hw_reserve_resource_args  csid_acquire;
+	struct cam_isp_hw_mgr_res             *csid_res_iterator;
+	enum cam_tfe_csid_path_res_id        path_res_id;
+
+	tfe_hw_mgr = tfe_ctx->hw_mgr;
+
+	for (j = 0; j < in_port->num_out_res; j++) {
+		out_port = &in_port->data[j];
+		path_res_id = cam_tfe_hw_mgr_get_tfe_csid_rdi_res_type(
+			out_port->res_id);
+
+		if (path_res_id == CAM_TFE_CSID_PATH_RES_MAX)
+			continue;
+
+		rc = cam_tfe_hw_mgr_get_res(&tfe_ctx->free_res_list, &csid_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "No more free hw mgr resource");
+			goto end;
+		}
+
+		memset(&csid_acquire, 0, sizeof(csid_acquire));
+		csid_acquire.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_acquire.res_id = path_res_id;
+		csid_acquire.in_port = in_port;
+		csid_acquire.out_port = out_port;
+		csid_acquire.sync_mode = CAM_ISP_HW_SYNC_NONE;
+		csid_acquire.node_res = NULL;
+		csid_acquire.event_cb = cam_tfe_hw_mgr_event_handler;
+		csid_acquire.event_cb_prv = tfe_ctx;
+
+		if (tfe_ctx->is_tpg) {
+			if (tfe_ctx->res_list_tpg.hw_res[0]->hw_intf->hw_idx ==
+				0)
+				csid_acquire.phy_sel = CAM_ISP_TFE_IN_RES_PHY_0;
+			else
+				csid_acquire.phy_sel = CAM_ISP_TFE_IN_RES_PHY_1;
+		}
+
+		/* Try acquiring CSID resource from previously acquired HW */
+		list_for_each_entry(csid_res_iterator,
+			&tfe_ctx->res_list_tfe_csid, list) {
+
+			for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+				if (!csid_res_iterator->hw_res[i])
+					continue;
+
+				if (csid_res_iterator->is_secure == 1 ||
+					(csid_res_iterator->is_secure == 0 &&
+					in_port->num_out_res &&
+					out_port->secure_mode == 1))
+					continue;
+
+				hw_intf = csid_res_iterator->hw_res[i]->hw_intf;
+
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&csid_acquire, sizeof(csid_acquire));
+				if (rc) {
+					CAM_DBG(CAM_ISP,
+						"No tfe csid resource from hw %d",
+						hw_intf->hw_idx);
+					continue;
+				}
+
+				if (csid_acquire.node_res == NULL) {
+					CAM_ERR(CAM_ISP,
+						"Acquire RDI:%d rsrc failed",
+						path_res_id);
+					goto put_res;
+				}
+
+				csid_res->hw_res[0] = csid_acquire.node_res;
+
+				CAM_DBG(CAM_ISP,
+					"acquired from old csid(%s)=%d CSID rsrc successfully",
+					(i == 0) ? "left" : "right",
+					hw_intf->hw_idx);
+				/*
+				 * If successfully acquired CSID from
+				 * previously acquired HW, skip the next
+				 * part
+				 */
+				goto acquire_successful;
+			}
+		}
+
+		/* Acquire if not already acquired */
+		if (tfe_ctx->is_dual) {
+			for (i = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+				if (!tfe_hw_mgr->csid_devices[i])
+					continue;
+
+				hw_intf = tfe_hw_mgr->csid_devices[i];
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&csid_acquire, sizeof(csid_acquire));
+				if (rc)
+					continue;
+				else {
+					csid_res->hw_res[0] =
+						csid_acquire.node_res;
+					break;
+				}
+			}
+
+			if (i == CAM_TFE_CSID_HW_NUM_MAX ||
+				!csid_acquire.node_res) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire tfe csid rdi path%d",
+					path_res_id);
+
+				rc = -EINVAL;
+				goto put_res;
+			}
+		} else {
+			for (i = CAM_TFE_CSID_HW_NUM_MAX - 1; i >= 0; i--) {
+				if (!tfe_hw_mgr->csid_devices[i])
+					continue;
+
+				hw_intf = tfe_hw_mgr->csid_devices[i];
+				rc = hw_intf->hw_ops.reserve(hw_intf->hw_priv,
+					&csid_acquire, sizeof(csid_acquire));
+				if (rc)
+					continue;
+				else {
+					csid_res->hw_res[0] =
+						csid_acquire.node_res;
+					break;
+				}
+			}
+
+			if (i == -1 || !csid_acquire.node_res) {
+				CAM_ERR(CAM_ISP,
+					"Can not acquire tfe csid rdi path %d",
+					path_res_id);
+
+				rc = -EINVAL;
+				goto put_res;
+			}
+		}
+
+acquire_successful:
+		CAM_DBG(CAM_ISP, "CSID path :%d acquired success", path_res_id);
+		csid_res->res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		csid_res->res_id = path_res_id;
+		csid_res->hw_res[1] = NULL;
+		csid_res->is_dual_isp = 0;
+
+		if (in_port->num_out_res)
+			csid_res->is_secure = out_port->secure_mode;
+
+		cam_tfe_hw_mgr_put_res(&tfe_ctx->res_list_tfe_csid, &csid_res);
+	}
+
+	return 0;
+put_res:
+	cam_tfe_hw_mgr_put_res(&tfe_ctx->free_res_list, &csid_res);
+end:
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_preprocess_port(
+	struct cam_tfe_hw_mgr_ctx       *tfe_ctx,
+	struct cam_isp_tfe_in_port_info *in_port,
+	int                             *ipp_count,
+	int                             *rdi_count,
+	int                             *pdaf_enable)
+{
+	int ipp_num        = 0;
+	int rdi_num        = 0;
+	bool rdi2_enable   = false;
+	uint32_t i;
+	struct cam_isp_tfe_out_port_info      *out_port;
+	struct cam_tfe_hw_mgr                 *tfe_hw_mgr;
+
+	tfe_hw_mgr = tfe_ctx->hw_mgr;
+
+
+	for (i = 0; i < in_port->num_out_res; i++) {
+		out_port = &in_port->data[i];
+		CAM_DBG(CAM_ISP, "out_res id %d", out_port->res_id);
+
+		if (cam_tfe_hw_mgr_is_rdi_res(out_port->res_id)) {
+			rdi_num++;
+			if (out_port->res_id == CAM_ISP_TFE_OUT_RES_RDI_2)
+				rdi2_enable = true;
+		} else {
+			ipp_num++;
+			if (out_port->res_id == CAM_ISP_TFE_OUT_RES_PDAF)
+				*pdaf_enable = 1;
+		}
+	}
+
+	if (*pdaf_enable && rdi2_enable) {
+		CAM_ERR(CAM_ISP, "invalid outports both RDI2 and PDAF enabled");
+		return -EINVAL;
+	}
+
+	*ipp_count = ipp_num;
+	*rdi_count = rdi_num;
+
+	CAM_DBG(CAM_ISP, "rdi: %d ipp: %d pdaf:%d", rdi_num, ipp_num,
+		*pdaf_enable);
+
+	return 0;
+}
+
+static int cam_tfe_mgr_acquire_hw_for_ctx(
+	struct cam_tfe_hw_mgr_ctx              *tfe_ctx,
+	struct cam_isp_tfe_in_port_info        *in_port,
+	uint32_t *num_pix_port, uint32_t  *num_rdi_port,
+	uint32_t *pdaf_enable)
+{
+	int rc                                    = -EINVAL;
+	int is_dual_isp                           = 0;
+	int ipp_count                             = 0;
+	int rdi_count                             = 0;
+
+	is_dual_isp = in_port->usage_type;
+
+	cam_tfe_hw_mgr_preprocess_port(tfe_ctx, in_port, &ipp_count,
+		&rdi_count, pdaf_enable);
+
+	if (!ipp_count && !rdi_count) {
+		CAM_ERR(CAM_ISP,
+			"No PIX or RDI");
+		return -EINVAL;
+	}
+
+	if (ipp_count) {
+		/* get tfe csid IPP resource */
+		rc = cam_tfe_hw_mgr_acquire_res_tfe_csid_pxl(tfe_ctx,
+			in_port);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire TFE CSID IPP resource Failed dual:%d",
+				in_port->usage_type);
+			goto err;
+		}
+	}
+
+	if (rdi_count) {
+		/* get tfe csid rdi resource */
+		rc = cam_tfe_hw_mgr_acquire_res_tfe_csid_rdi(tfe_ctx, in_port);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Acquire TFE CSID RDI resource Failed dual:%d",
+				in_port->usage_type);
+			goto err;
+		}
+	}
+
+	rc = cam_tfe_hw_mgr_acquire_res_tfe_in(tfe_ctx, in_port, pdaf_enable);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+		"Acquire TFE IN resource Failed dual:%d", in_port->usage_type);
+		goto err;
+	}
+
+	CAM_DBG(CAM_ISP, "Acquiring TFE OUT resource...");
+	rc = cam_tfe_hw_mgr_acquire_res_tfe_out(tfe_ctx, in_port);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Acquire TFE OUT resource Failed dual:%d",
+			in_port->usage_type);
+		goto err;
+	}
+
+	*num_pix_port += ipp_count;
+	*num_rdi_port += rdi_count;
+
+	return 0;
+err:
+	/* release resource at the acquire entry funciton */
+	return rc;
+}
+
+void cam_tfe_cam_cdm_callback(uint32_t handle, void *userdata,
+	enum cam_cdm_cb_status status, uint64_t cookie)
+{
+	struct cam_isp_prepare_hw_update_data *hw_update_data = NULL;
+	struct cam_tfe_hw_mgr_ctx *ctx = NULL;
+	uint32_t *buf_start, *buf_end;
+	int i, rc = 0;
+	size_t len = 0;
+	uint32_t *buf_addr;
+
+	if (!userdata) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return;
+	}
+
+	if (status == CAM_CDM_CB_STATUS_BL_SUCCESS) {
+		hw_update_data =
+			(struct cam_isp_prepare_hw_update_data *)userdata;
+		ctx =
+		(struct cam_tfe_hw_mgr_ctx *)hw_update_data->isp_mgr_ctx;
+		complete_all(&ctx->config_done_complete);
+		atomic_set(&ctx->cdm_done, 1);
+		ctx->last_cdm_done_req = cookie;
+		if (g_tfe_hw_mgr.debug_cfg.per_req_reg_dump)
+			cam_tfe_mgr_handle_reg_dump(ctx,
+				hw_update_data->reg_dump_buf_desc,
+				hw_update_data->num_reg_dump_buf,
+				CAM_ISP_TFE_PACKET_META_REG_DUMP_PER_REQUEST,
+				NULL, false);
+		CAM_DBG(CAM_ISP,
+			"Called by CDM hdl=%x, udata=%pK, status=%d, cookie=%llu ctx_index=%d",
+			 handle, userdata, status, cookie, ctx->ctx_index);
+	} else if (status == CAM_CDM_CB_STATUS_PAGEFAULT ||
+		status == CAM_CDM_CB_STATUS_INVALID_BL_CMD ||
+		status == CAM_CDM_CB_STATUS_HW_ERROR) {
+		ctx = userdata;
+		CAM_INFO(CAM_ISP,
+			"req_id =%d ctx_id =%d Bl_cmd_count =%d status=%d",
+			ctx->applied_req_id, ctx->ctx_index,
+			ctx->last_submit_bl_cmd.bl_count, status);
+
+		for (i = 0; i < ctx->last_submit_bl_cmd.bl_count; i++) {
+			CAM_INFO(CAM_ISP,
+				"BL(%d) hdl=0x%x addr=0x%x len=%d input_len =%d offset=0x%x type=%d",
+				i, ctx->last_submit_bl_cmd.cmd[i].mem_handle,
+				ctx->last_submit_bl_cmd.cmd[i].hw_addr,
+				ctx->last_submit_bl_cmd.cmd[i].len,
+				ctx->last_submit_bl_cmd.cmd[i].input_len,
+				ctx->last_submit_bl_cmd.cmd[i].offset,
+				ctx->last_submit_bl_cmd.cmd[i].type);
+
+			rc = cam_packet_util_get_cmd_mem_addr(
+				ctx->last_submit_bl_cmd.cmd[i].mem_handle,
+				&buf_addr, &len);
+
+			buf_start = (uint32_t *)((uint8_t *) buf_addr +
+				ctx->last_submit_bl_cmd.cmd[i].offset);
+			buf_end = (uint32_t *)((uint8_t *) buf_start +
+				ctx->last_submit_bl_cmd.cmd[i].input_len - 1);
+
+			cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
+			cam_mem_put_cpu_buf(ctx->last_submit_bl_cmd.cmd[i].mem_handle);
+		}
+		if (ctx->packet != NULL)
+			cam_packet_dump_patch_info(ctx->packet,
+				g_tfe_hw_mgr.mgr_common.img_iommu_hdl,
+				g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure);
+	} else {
+		CAM_WARN(CAM_ISP,
+			"Called by CDM hdl=%x, udata=%pK, status=%d, cookie=%llu",
+			 handle, userdata, status, cookie);
+	}
+}
+
+int cam_tfe_cshiphy_callback(
+	struct cam_tfe_hw_mgr_ctx *ctx, void *cmd_args)
+{
+	int                          rc = -EINVAL;
+	struct cam_isp_hw_mgr_res    *hw_mgr_res;
+	uint32_t                     *phy_clock_rate;
+	uint32_t                     clock_rate = 0;
+	uint32_t                     csid_clock_rate = 0, tfe_clock_rate = 0;
+	uint32_t                     updated_tfe_clk = 0, updated_csid_clk = 0;
+
+	if (!ctx || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	phy_clock_rate = (uint32_t *)cmd_args;
+	CAM_DBG(CAM_ISP, "clk rate csid ... in ctx id:%d",
+		ctx->ctx_index);
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		rc = cam_tfe_hw_mgr_get_clock_rate(hw_mgr_res,
+			&clock_rate);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Can not get CSID clock rate(id :%d)",
+				hw_mgr_res->res_id);
+			return rc;
+		}
+
+		if (!csid_clock_rate)
+			csid_clock_rate = clock_rate;
+
+		if (clock_rate < csid_clock_rate)
+			csid_clock_rate = clock_rate;
+
+		CAM_DBG(CAM_ISP, "clk rate csid: %lld %lld",
+			clock_rate, csid_clock_rate);
+	}
+
+	CAM_DBG(CAM_ISP, "clk rate TFE in resource ctx id:%d",
+		ctx->ctx_index);
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		rc = cam_tfe_hw_mgr_get_clock_rate(hw_mgr_res,
+			&clock_rate);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Can not get TFE clock rate (%d)",
+				hw_mgr_res->res_id);
+			return rc;
+		}
+
+		if (!tfe_clock_rate)
+			tfe_clock_rate = clock_rate;
+
+		if (clock_rate < tfe_clock_rate)
+			tfe_clock_rate = clock_rate;
+
+		CAM_DBG(CAM_ISP, "clk rate tfe: %lld %lld",
+			clock_rate, tfe_clock_rate);
+	}
+
+	if (*phy_clock_rate > csid_clock_rate) {
+		list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_tfe_csid, list) {
+			rc = cam_tfe_hw_mgr_update_clock_rate(hw_mgr_res,
+				phy_clock_rate, &updated_csid_clk);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"csid clock update failed: %d, csid:%lld tfe:%lld",
+					rc, csid_clock_rate, tfe_clock_rate);
+				goto end;
+			}
+		}
+
+		if (updated_csid_clk > tfe_clock_rate) {
+			list_for_each_entry(hw_mgr_res,
+			&ctx->res_list_tfe_in, list) {
+				rc = cam_tfe_hw_mgr_update_clock_rate(hw_mgr_res,
+					&updated_csid_clk, &updated_tfe_clk);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"tfe clock update failed: %d, csid:%lld tfe:%lld",
+						rc, updated_csid_clk, tfe_clock_rate);
+					goto end;
+				}
+			}
+		}
+		goto skip_tfe_update;
+	}
+
+	if (csid_clock_rate > tfe_clock_rate) {
+		list_for_each_entry(hw_mgr_res,
+		&ctx->res_list_tfe_in, list) {
+			rc = cam_tfe_hw_mgr_update_clock_rate(hw_mgr_res,
+				&csid_clock_rate, &updated_tfe_clk);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"tfe clock update failed: %d, csid:%lld tfe:%lld",
+					rc, csid_clock_rate, tfe_clock_rate);
+				goto end;
+			}
+		}
+	}
+
+skip_tfe_update:
+	if (!updated_csid_clk)
+		updated_csid_clk = csid_clock_rate;
+
+	if (!updated_tfe_clk)
+		updated_tfe_clk = tfe_clock_rate;
+end:
+	/* final check */
+	if ((*phy_clock_rate > updated_csid_clk) ||
+		(updated_csid_clk > updated_tfe_clk) ||
+		(*phy_clock_rate > updated_tfe_clk)) {
+		CAM_ERR(CAM_ISP,
+			"improper clock rates, phy:%lld csid:%lld tfe:%lld",
+			*phy_clock_rate, updated_csid_clk, updated_tfe_clk);
+
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/* entry function: acquire_hw */
+static int cam_tfe_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	struct cam_tfe_hw_mgr *tfe_hw_mgr            = hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -EINVAL;
+	int i, j;
+	struct cam_tfe_hw_mgr_ctx          *tfe_ctx;
+	struct cam_isp_tfe_in_port_info    *in_port = NULL;
+	struct cam_cdm_acquire_data         cdm_acquire;
+	uint32_t                            num_pix_port_per_in = 0;
+	uint32_t                            num_rdi_port_per_in = 0;
+	uint32_t                            pdaf_enable = 0;
+	uint32_t                            total_pix_port = 0;
+	uint32_t                            total_rdi_port = 0;
+	uint32_t                            in_port_length = 0;
+	uint32_t                            total_in_port_length = 0;
+	struct cam_isp_tfe_acquire_hw_info *acquire_hw_info = NULL;
+	struct cam_isp_tfe_in_port_info
+		*tpg_inport[CAM_TOP_TPG_MAX_SUPPORTED_DT] = {0, 0, 0, 0};
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	/* get the tfe ctx */
+	rc = cam_tfe_hw_mgr_get_ctx(&tfe_hw_mgr->free_ctx_list, &tfe_ctx);
+	if (rc || !tfe_ctx) {
+		CAM_ERR(CAM_ISP, "Get tfe hw context failed");
+		goto err;
+	}
+
+	tfe_ctx->common.cb_priv = acquire_args->context_data;
+	tfe_ctx->common.event_cb = acquire_args->event_cb;
+
+	tfe_ctx->hw_mgr = tfe_hw_mgr;
+
+	memcpy(cdm_acquire.identifier, "tfe", sizeof("tfe"));
+	cdm_acquire.cell_index = 0;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = tfe_ctx;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	cdm_acquire.base_array_cnt = CAM_TFE_HW_NUM_MAX;
+	for (i = 0, j = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (tfe_hw_mgr->cdm_reg_map[i])
+			cdm_acquire.base_array[j++] =
+				tfe_hw_mgr->cdm_reg_map[i];
+	}
+	cdm_acquire.base_array_cnt = j;
+
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.cam_cdm_callback = cam_tfe_cam_cdm_callback;
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to acquire the CDM HW");
+		goto free_ctx;
+	}
+
+	CAM_DBG(CAM_ISP, "Successfully acquired the CDM HW hdl=%x",
+		cdm_acquire.handle);
+	tfe_ctx->cdm_handle = cdm_acquire.handle;
+	tfe_ctx->cdm_ops = cdm_acquire.ops;
+	atomic_set(&tfe_ctx->cdm_done, 1);
+	tfe_ctx->last_cdm_done_req = 0;
+
+	acquire_hw_info = (struct cam_isp_tfe_acquire_hw_info *)
+		acquire_args->acquire_info;
+	in_port = (struct cam_isp_tfe_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+
+	/* Check any inport has dual tfe usage  */
+	tfe_ctx->is_dual = false;
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+		if (in_port->usage_type)
+			tfe_ctx->is_dual = true;
+
+		in_port_length =
+			sizeof(struct cam_isp_tfe_in_port_info) +
+			(in_port->num_out_res - 1) *
+			sizeof(struct cam_isp_tfe_out_port_info);
+		total_in_port_length += in_port_length;
+		if (total_in_port_length >
+			acquire_hw_info->input_info_size) {
+			CAM_ERR(CAM_ISP,
+				"buffer size is not enough %d %d",
+				total_in_port_length,
+				acquire_hw_info->input_info_size);
+			rc = -EINVAL;
+			goto free_cdm;
+		}
+
+		in_port = (struct cam_isp_tfe_in_port_info *)
+			((uint8_t *)in_port + in_port_length);
+	}
+
+	in_port_length = 0;
+	total_in_port_length = 0;
+	in_port = (struct cam_isp_tfe_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+
+	if (in_port->res_id == CAM_ISP_TFE_IN_RES_TPG) {
+		if (acquire_hw_info->num_inputs >
+			CAM_TOP_TPG_MAX_SUPPORTED_DT) {
+			CAM_ERR(CAM_ISP, "too many number inport:%d for TPG ",
+				acquire_hw_info->num_inputs);
+			rc = -EINVAL;
+			goto free_cdm;
+		}
+
+		for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+			if (in_port->res_id != CAM_ISP_TFE_IN_RES_TPG) {
+				CAM_ERR(CAM_ISP, "Inval :%d inport res id:0x%x",
+					i, in_port->res_id);
+				rc = -EINVAL;
+				goto free_cdm;
+			}
+
+			tpg_inport[i] = in_port;
+			in_port_length =
+				sizeof(struct cam_isp_tfe_in_port_info) +
+				(in_port->num_out_res - 1) *
+				sizeof(struct cam_isp_tfe_out_port_info);
+			total_in_port_length += in_port_length;
+			if (total_in_port_length >
+				acquire_hw_info->input_info_size) {
+				CAM_ERR(CAM_ISP,
+					"buffer size is not enough %d %d",
+					total_in_port_length,
+					acquire_hw_info->input_info_size);
+				rc = -EINVAL;
+				goto free_cdm;
+			}
+
+			in_port = (struct cam_isp_tfe_in_port_info *)
+				((uint8_t *)in_port + in_port_length);
+		}
+
+		rc = cam_tfe_hw_mgr_acquire_tpg(tfe_ctx, tpg_inport,
+			acquire_hw_info->num_inputs);
+		if (rc)
+			goto free_cdm;
+
+		tfe_ctx->is_tpg = true;
+	}
+
+	in_port = (struct cam_isp_tfe_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+	in_port_length = 0;
+	total_in_port_length = 0;
+
+	/* acquire HW resources */
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+
+		if (in_port->num_out_res > CAM_TFE_HW_OUT_RES_MAX) {
+			CAM_ERR(CAM_ISP, "too many output res %d",
+				in_port->num_out_res);
+			rc = -EINVAL;
+			goto free_res;
+		}
+
+		in_port_length = sizeof(struct cam_isp_tfe_in_port_info) +
+			(in_port->num_out_res - 1) *
+			sizeof(struct cam_isp_tfe_out_port_info);
+		total_in_port_length += in_port_length;
+
+		if (total_in_port_length > acquire_hw_info->input_info_size) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough");
+			rc = -EINVAL;
+			goto free_res;
+		}
+		CAM_DBG(CAM_ISP, "in_res_id %x", in_port->res_id);
+		rc = cam_tfe_mgr_acquire_hw_for_ctx(tfe_ctx, in_port,
+			&num_pix_port_per_in, &num_rdi_port_per_in,
+			&pdaf_enable);
+		total_pix_port += num_pix_port_per_in;
+		total_rdi_port += num_rdi_port_per_in;
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "can not acquire resource");
+			goto free_res;
+		}
+		in_port = (struct cam_isp_tfe_in_port_info *)
+			((uint8_t *)in_port + in_port_length);
+	}
+
+	/* Check whether context has only RDI resource */
+	if (!total_pix_port) {
+		tfe_ctx->is_rdi_only_context = 1;
+		CAM_DBG(CAM_ISP, "RDI only context");
+	} else
+		tfe_ctx->is_rdi_only_context = 0;
+
+	/* Process base info */
+	rc = cam_tfe_mgr_process_base_info(tfe_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Process base info failed");
+		goto free_res;
+	}
+
+	acquire_args->ctxt_to_hw_map = tfe_ctx;
+	tfe_ctx->ctx_in_use = 1;
+	tfe_ctx->num_reg_dump_buf = 0;
+
+	acquire_args->support_consumed_addr =
+		g_tfe_hw_mgr.support_consumed_addr;
+
+	cam_tfe_hw_mgr_put_ctx(&tfe_hw_mgr->used_ctx_list, &tfe_ctx);
+
+	CAM_DBG(CAM_ISP, "Exit...(success)");
+
+	return 0;
+free_res:
+	cam_tfe_hw_mgr_release_hw_for_ctx(tfe_ctx);
+	tfe_ctx->ctx_in_use = 0;
+	tfe_ctx->is_rdi_only_context = 0;
+	tfe_ctx->cdm_handle = 0;
+	tfe_ctx->cdm_ops = NULL;
+	tfe_ctx->init_done = false;
+	tfe_ctx->is_dual = false;
+	tfe_ctx->is_tpg  = false;
+	tfe_ctx->res_list_tpg.res_type = CAM_ISP_RESOURCE_MAX;
+free_cdm:
+	cam_cdm_release(tfe_ctx->cdm_handle);
+free_ctx:
+	cam_tfe_hw_mgr_put_ctx(&tfe_hw_mgr->free_ctx_list, &tfe_ctx);
+err:
+	/* Dump all the current acquired HW */
+	cam_tfe_hw_mgr_dump_all_ctx();
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+/* entry function: acquire_hw */
+static int cam_tfe_mgr_acquire_dev(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	struct cam_tfe_hw_mgr *tfe_hw_mgr            = hw_mgr_priv;
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -EINVAL;
+	int i, j;
+	struct cam_tfe_hw_mgr_ctx         *tfe_ctx;
+	struct cam_isp_tfe_in_port_info   *in_port = NULL;
+	struct cam_isp_resource           *isp_resource = NULL;
+	struct cam_cdm_acquire_data        cdm_acquire;
+	uint32_t                           num_pix_port_per_in = 0;
+	uint32_t                           num_rdi_port_per_in = 0;
+	uint32_t                           pdad_enable         = 0;
+	uint32_t                           total_pix_port = 0;
+	uint32_t                           total_rdi_port = 0;
+	uint32_t                           in_port_length = 0;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	/* get the tfe ctx */
+	rc = cam_tfe_hw_mgr_get_ctx(&tfe_hw_mgr->free_ctx_list, &tfe_ctx);
+	if (rc || !tfe_ctx) {
+		CAM_ERR(CAM_ISP, "Get tfe hw context failed");
+		goto err;
+	}
+
+	tfe_ctx->common.cb_priv = acquire_args->context_data;
+	tfe_ctx->common.event_cb = acquire_args->event_cb;
+
+	tfe_ctx->hw_mgr = tfe_hw_mgr;
+
+	memcpy(cdm_acquire.identifier, "tfe", sizeof("tfe"));
+	cdm_acquire.cell_index = 0;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = tfe_ctx;
+	cdm_acquire.base_array_cnt = CAM_TFE_HW_NUM_MAX;
+	for (i = 0, j = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (tfe_hw_mgr->cdm_reg_map[i])
+			cdm_acquire.base_array[j++] =
+				tfe_hw_mgr->cdm_reg_map[i];
+	}
+	cdm_acquire.base_array_cnt = j;
+
+
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.cam_cdm_callback = cam_tfe_cam_cdm_callback;
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to acquire the CDM HW");
+		goto free_ctx;
+	}
+
+	CAM_DBG(CAM_ISP, "Successfully acquired the CDM HW hdl=%x",
+		cdm_acquire.handle);
+	tfe_ctx->cdm_handle = cdm_acquire.handle;
+	tfe_ctx->cdm_ops = cdm_acquire.ops;
+	atomic_set(&tfe_ctx->cdm_done, 1);
+	tfe_ctx->last_cdm_done_req = 0;
+
+	isp_resource = (struct cam_isp_resource *)acquire_args->acquire_info;
+
+	/* acquire HW resources */
+	for (i = 0; i < acquire_args->num_acq; i++) {
+		if (isp_resource[i].resource_id != CAM_ISP_RES_ID_PORT)
+			continue;
+
+		CAM_DBG(CAM_ISP, "acquire no = %d total = %d", i,
+			acquire_args->num_acq);
+		CAM_DBG(CAM_ISP,
+			"start copy from user handle %lld with len = %d",
+			isp_resource[i].res_hdl,
+			isp_resource[i].length);
+
+		in_port_length = sizeof(struct cam_isp_tfe_in_port_info);
+
+		if (in_port_length > isp_resource[i].length) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough");
+			rc = -EINVAL;
+			goto free_res;
+		}
+
+		in_port = memdup_user(
+			u64_to_user_ptr(isp_resource[i].res_hdl),
+			isp_resource[i].length);
+		if (!IS_ERR(in_port)) {
+			if (in_port->num_out_res > CAM_TFE_HW_OUT_RES_MAX) {
+				CAM_ERR(CAM_ISP, "too many output res %d",
+					in_port->num_out_res);
+				rc = -EINVAL;
+				kfree(in_port);
+				goto free_res;
+			}
+
+			in_port_length =
+				sizeof(struct cam_isp_tfe_in_port_info) +
+				(in_port->num_out_res - 1) *
+				sizeof(struct cam_isp_tfe_out_port_info);
+			if (in_port_length > isp_resource[i].length) {
+				CAM_ERR(CAM_ISP, "buffer size is not enough");
+				rc = -EINVAL;
+				kfree(in_port);
+				goto free_res;
+			}
+
+			rc = cam_tfe_mgr_acquire_hw_for_ctx(tfe_ctx, in_port,
+				&num_pix_port_per_in, &num_rdi_port_per_in,
+				&pdad_enable);
+			total_pix_port += num_pix_port_per_in;
+			total_rdi_port += num_rdi_port_per_in;
+
+			kfree(in_port);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "can not acquire resource");
+				goto free_res;
+			}
+		} else {
+			CAM_ERR(CAM_ISP,
+				"Copy from user failed with in_port = %pK",
+				in_port);
+			rc = -EFAULT;
+			goto free_res;
+		}
+	}
+
+	/* Check whether context has only RDI resource */
+	if (!total_pix_port) {
+		tfe_ctx->is_rdi_only_context = 1;
+		CAM_DBG(CAM_ISP, "RDI only context");
+	} else
+		tfe_ctx->is_rdi_only_context = 0;
+
+	/* Process base info */
+	rc = cam_tfe_mgr_process_base_info(tfe_ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Process base info failed");
+		goto free_res;
+	}
+
+	acquire_args->ctxt_to_hw_map = tfe_ctx;
+	tfe_ctx->ctx_in_use = 1;
+
+	cam_tfe_hw_mgr_put_ctx(&tfe_hw_mgr->used_ctx_list, &tfe_ctx);
+
+	CAM_DBG(CAM_ISP, "Exit...(success)");
+
+	return 0;
+free_res:
+	cam_tfe_hw_mgr_release_hw_for_ctx(tfe_ctx);
+	cam_cdm_release(tfe_ctx->cdm_handle);
+free_ctx:
+	cam_tfe_hw_mgr_put_ctx(&tfe_hw_mgr->free_ctx_list, &tfe_ctx);
+err:
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+/* entry function: acquire_hw */
+static int cam_tfe_mgr_acquire(void *hw_mgr_priv,
+	void *acquire_hw_args)
+{
+	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
+	int rc                                       = -EINVAL;
+
+	CAM_DBG(CAM_ISP, "Enter...");
+
+	if (!acquire_args || acquire_args->num_acq <= 0) {
+		CAM_ERR(CAM_ISP, "Nothing to acquire. Seems like error");
+		return -EINVAL;
+	}
+
+	if (acquire_args->num_acq == CAM_API_COMPAT_CONSTANT)
+		rc = cam_tfe_mgr_acquire_hw(hw_mgr_priv, acquire_hw_args);
+	else
+		rc = cam_tfe_mgr_acquire_dev(hw_mgr_priv, acquire_hw_args);
+
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static const char *cam_tfe_util_usage_data_to_string(
+	uint32_t usage_data)
+{
+	switch (usage_data) {
+	case CAM_ISP_TFE_USAGE_LEFT_PX:
+		return "LEFT_PX";
+	case CAM_ISP_TFE_USAGE_RIGHT_PX:
+		return "RIGHT_PX";
+	case CAM_ISP_TFE_USAGE_RDI:
+		return "RDI";
+	default:
+		return "USAGE_INVALID";
+	}
+}
+
+static int cam_tfe_classify_vote_info(
+	struct cam_isp_hw_mgr_res            *hw_mgr_res,
+	struct cam_isp_bw_config_internal_v2 *bw_config,
+	struct cam_axi_vote                  *isp_vote,
+	uint32_t                              split_idx,
+	bool                                 *camif_l_bw_updated,
+	bool                                 *camif_r_bw_updated)
+{
+	int                                   rc = 0, i, j = 0;
+
+	if (hw_mgr_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+		if (split_idx == CAM_ISP_HW_SPLIT_LEFT) {
+			if (*camif_l_bw_updated)
+				return rc;
+
+			for (i = 0; i < bw_config->num_paths; i++) {
+				if (bw_config->axi_path[i].usage_data ==
+					CAM_ISP_TFE_USAGE_LEFT_PX) {
+					memcpy(&isp_vote->axi_path[j],
+						&bw_config->axi_path[i],
+						sizeof(struct
+						cam_axi_per_path_bw_vote));
+					j++;
+				}
+			}
+			isp_vote->num_paths = j;
+
+			*camif_l_bw_updated = true;
+		} else {
+			if (*camif_r_bw_updated)
+				return rc;
+
+			for (i = 0; i < bw_config->num_paths; i++) {
+				if (bw_config->axi_path[i].usage_data ==
+					CAM_ISP_TFE_USAGE_RIGHT_PX) {
+					memcpy(&isp_vote->axi_path[j],
+						&bw_config->axi_path[i],
+						sizeof(struct
+						cam_axi_per_path_bw_vote));
+					j++;
+				}
+			}
+			isp_vote->num_paths = j;
+
+			*camif_r_bw_updated = true;
+		}
+	} else if ((hw_mgr_res->res_id >= CAM_ISP_HW_TFE_IN_RDI0)
+		&& (hw_mgr_res->res_id <=
+		CAM_ISP_HW_TFE_IN_RDI2)) {
+		for (i = 0; i < bw_config->num_paths; i++) {
+			if ((bw_config->axi_path[i].usage_data ==
+				CAM_ISP_TFE_USAGE_RDI) &&
+				((bw_config->axi_path[i].path_data_type -
+				CAM_AXI_PATH_DATA_IFE_RDI0) ==
+				(hw_mgr_res->res_id -
+				CAM_ISP_HW_TFE_IN_RDI0))) {
+				memcpy(&isp_vote->axi_path[j],
+					&bw_config->axi_path[i],
+					sizeof(struct
+					cam_axi_per_path_bw_vote));
+				j++;
+			}
+		}
+		isp_vote->num_paths = j;
+
+	} else {
+		if (hw_mgr_res->hw_res[split_idx]) {
+			CAM_ERR(CAM_ISP, "Invalid res_id %u, split_idx: %u",
+				hw_mgr_res->res_id, split_idx);
+			rc = -EINVAL;
+			return rc;
+		}
+	}
+
+	for (i = 0; i < isp_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"CLASSIFY_VOTE [%s] [%s] [%s] [%llu] [%llu] [%llu]",
+			cam_tfe_util_usage_data_to_string(
+			isp_vote->axi_path[i].usage_data),
+			cam_cpas_axi_util_path_type_to_string(
+			isp_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			isp_vote->axi_path[i].transac_type),
+			isp_vote->axi_path[i].camnoc_bw,
+			isp_vote->axi_path[i].mnoc_ab_bw,
+			isp_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_blob_bw_update(
+	struct cam_isp_bw_config_internal_v2  *bw_config,
+	struct cam_tfe_hw_mgr_ctx             *ctx)
+{
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_tfe_bw_update_args          *bw_upd_args = NULL;
+	int                                    rc = -EINVAL;
+	uint32_t                               i, split_idx;
+	bool                                   camif_l_bw_updated = false;
+	bool                                   camif_r_bw_updated = false;
+
+	for (i = 0; i < bw_config->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"ISP_BLOB usage_type=%u [%s] [%s] [%s] [%llu] [%llu] [%llu]",
+			bw_config->usage_type,
+			cam_tfe_util_usage_data_to_string(
+			bw_config->axi_path[i].usage_data),
+			cam_cpas_axi_util_path_type_to_string(
+			bw_config->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			bw_config->axi_path[i].transac_type),
+			bw_config->axi_path[i].camnoc_bw,
+			bw_config->axi_path[i].mnoc_ab_bw,
+			bw_config->axi_path[i].mnoc_ib_bw);
+	}
+
+	bw_upd_args = kzalloc(sizeof(struct cam_tfe_bw_update_args),
+		GFP_KERNEL);
+	if (!bw_upd_args) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		return -ENOMEM;
+	}
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (split_idx = 0; split_idx < CAM_ISP_HW_SPLIT_MAX;
+			split_idx++) {
+			if (!hw_mgr_res->hw_res[split_idx])
+				continue;
+
+			memset(&bw_upd_args->isp_vote, 0,
+				sizeof(struct cam_axi_vote));
+			rc = cam_tfe_classify_vote_info(hw_mgr_res, bw_config,
+				&bw_upd_args->isp_vote, split_idx,
+				&camif_l_bw_updated, &camif_r_bw_updated);
+			if (rc)
+				goto end;
+
+			if (!bw_upd_args->isp_vote.num_paths)
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[split_idx]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_upd_args->node_res =
+					hw_mgr_res->hw_res[split_idx];
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_UPDATE_V2,
+					bw_upd_args,
+					sizeof(
+					struct cam_tfe_bw_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"BW Update failed rc: %d", rc);
+			} else {
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+			}
+		}
+	}
+
+end:
+	cam_free_clear((void *)bw_upd_args);
+	bw_upd_args = NULL;
+	return rc;
+}
+
+/* entry function: config_hw */
+static int cam_tfe_mgr_config_hw(void *hw_mgr_priv,
+	void *config_hw_args)
+{
+	int rc = -EINVAL, i, skip = 0;
+	struct cam_hw_config_args *cfg;
+	struct cam_hw_update_entry *cmd;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_tfe_hw_mgr_ctx *ctx;
+	struct cam_isp_prepare_hw_update_data *hw_update_data;
+	bool cdm_hang_detect = false;
+	unsigned long rem_jiffies = 0;
+
+	if (!hw_mgr_priv || !config_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	cfg = config_hw_args;
+	ctx = (struct cam_tfe_hw_mgr_ctx *)cfg->ctxt_to_hw_map;
+	if (!ctx) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	if (!ctx->ctx_in_use || !ctx->cdm_cmd) {
+		CAM_ERR(CAM_ISP, "Invalid context parameters");
+		return -EPERM;
+	}
+	if (atomic_read(&ctx->overflow_pending))
+		return -EINVAL;
+
+	hw_update_data = (struct cam_isp_prepare_hw_update_data  *) cfg->priv;
+	hw_update_data->isp_mgr_ctx = ctx;
+
+	if (cfg->reapply && cfg->cdm_reset_before_apply) {
+		if (ctx->last_cdm_done_req < cfg->request_id) {
+			cdm_hang_detect =
+				cam_cdm_detect_hang_error(ctx->cdm_handle);
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CDM callback not received for req: %lld, last_cdm_done_req: %lld, cdm_hang_detect: %d",
+				cfg->request_id, ctx->last_cdm_done_req,
+				cdm_hang_detect);
+			rc = cam_cdm_reset_hw(ctx->cdm_handle);
+			if (rc) {
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"CDM reset unsuccessful for req: %lld, ctx: %d, rc: %d",
+					cfg->request_id, ctx->ctx_index, rc);
+				ctx->last_cdm_done_req = 0;
+				return rc;
+			}
+		} else {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CDM callback received, should wait for buf done for req: %lld",
+				cfg->request_id);
+			return -EALREADY;
+		}
+		ctx->last_cdm_done_req = 0;
+	}
+
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (hw_update_data->bw_config_valid[i] == true) {
+
+			CAM_DBG(CAM_ISP, "idx=%d, bw_config_version=%d",
+				ctx->ctx_index, i,
+				hw_update_data->bw_config_version);
+			if (hw_update_data->bw_config_version ==
+				CAM_ISP_BW_CONFIG_V2) {
+				rc = cam_isp_tfe_blob_bw_update(
+					&hw_update_data->bw_config_v2[i], ctx);
+				if (rc)
+					CAM_ERR(CAM_ISP,
+					"Bandwidth Update Failed rc: %d", rc);
+			} else {
+				CAM_ERR(CAM_ISP,
+					"Invalid bw config version: %d",
+					hw_update_data->bw_config_version);
+			}
+		}
+	}
+
+	CAM_DBG(CAM_ISP,
+		"Enter ctx id:%d num_hw_upd_entries %d request id: %llu",
+		ctx->ctx_index, cfg->num_hw_update_entries, cfg->request_id);
+
+	if (cfg->num_hw_update_entries <= 0) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"Enter ctx id:%d no valid hw entries:%d request id: %llu",
+			ctx->ctx_index, cfg->num_hw_update_entries,
+			cfg->request_id);
+		goto end;
+	}
+
+	cdm_cmd                       = ctx->cdm_cmd;
+	cdm_cmd->cmd_arrary_count     = cfg->num_hw_update_entries;
+	cdm_cmd->type                 = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+	cdm_cmd->flag                 = true;
+	cdm_cmd->userdata             = hw_update_data;
+	cdm_cmd->cookie               = cfg->request_id;
+	cdm_cmd->gen_irq_arb          = false;
+
+	for (i = 0; i < cfg->num_hw_update_entries; i++) {
+		cmd = (cfg->hw_update_entries + i);
+		if (cfg->reapply && cmd->flags == CAM_ISP_IQ_BL) {
+			skip++;
+			continue;
+		}
+
+			if (cmd->flags == CAM_ISP_UNUSED_BL ||
+				cmd->flags >= CAM_ISP_BL_MAX)
+				CAM_ERR(CAM_ISP, "Unexpected BL type %d",
+					cmd->flags);
+
+			cdm_cmd->cmd_flex[i - skip].bl_addr.mem_handle = cmd->handle;
+			cdm_cmd->cmd_flex[i - skip].offset = cmd->offset;
+			cdm_cmd->cmd_flex[i - skip].len = cmd->len;
+			cdm_cmd->cmd_flex[i - skip].arbitrate = false;
+		}
+		cdm_cmd->cmd_arrary_count = cfg->num_hw_update_entries - skip;
+		reinit_completion(&ctx->config_done_complete);
+		ctx->applied_req_id = cfg->request_id;
+		CAM_DBG(CAM_ISP, "Submit to CDM");
+
+		atomic_set(&ctx->cdm_done, 0);
+
+		rc = cam_cdm_submit_bls(ctx->cdm_handle, cdm_cmd);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed to apply the configs for req %llu, rc %d",
+				cfg->request_id, rc);
+			return rc;
+		}
+
+	ctx->packet = (struct cam_packet *)hw_update_data->packet;
+	ctx->last_submit_bl_cmd.bl_count = cdm_cmd->cmd_arrary_count;
+
+	for (i = 0; i < cdm_cmd->cmd_arrary_count; i++) {
+		if (cdm_cmd->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE) {
+			ctx->last_submit_bl_cmd.cmd[i].mem_handle =
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle;
+
+			rc = cam_mem_get_io_buf(
+			cdm_cmd->cmd_flex[i].bl_addr.mem_handle,
+			g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl,
+			&ctx->last_submit_bl_cmd.cmd[i].hw_addr,
+			&ctx->last_submit_bl_cmd.cmd[i].len);
+		} else if (cdm_cmd->type ==
+			CAM_CDM_BL_CMD_TYPE_HW_IOVA) {
+			if (!cdm_cmd->cmd_flex[i].bl_addr.hw_iova) {
+				CAM_ERR(CAM_CDM,
+					"Submitted Hw bl hw_iova is invalid %d:%d",
+					i, cdm_cmd->cmd_arrary_count);
+				rc = -EINVAL;
+				break;
+			}
+			rc = 0;
+			ctx->last_submit_bl_cmd.cmd[i].hw_addr =
+			(uint64_t)cdm_cmd->cmd_flex[i].bl_addr.hw_iova;
+			ctx->last_submit_bl_cmd.cmd[i].len =
+			cdm_cmd->cmd_flex[i].len + cdm_cmd->cmd_flex[i].offset;
+			ctx->last_submit_bl_cmd.cmd[i].mem_handle = 0;
+		} else
+			CAM_INFO(CAM_ISP,
+				"submitted invalid bl cmd addr type :%d for Bl(%d)",
+				cdm_cmd->type, i);
+
+		ctx->last_submit_bl_cmd.cmd[i].offset =
+			cdm_cmd->cmd_flex[i].offset;
+		ctx->last_submit_bl_cmd.cmd[i].type =
+			cdm_cmd->type;
+		ctx->last_submit_bl_cmd.cmd[i].input_len =
+		 cdm_cmd->cmd_flex[i].len;
+	}
+
+	if (!cfg->init_packet)
+		goto end;
+
+	for (i = 0; i < CAM_TFE_HW_CONFIG_WAIT_MAX_TRY; i++) {
+		rem_jiffies = wait_for_completion_timeout(
+			&ctx->config_done_complete,
+			msecs_to_jiffies(
+			CAM_TFE_HW_CONFIG_TIMEOUT));
+		if (rem_jiffies <= 0) {
+			rc = cam_cdm_detect_hang_error(ctx->cdm_handle);
+			if (rc == 0) {
+				CAM_ERR(CAM_ISP,
+					"CDM workqueue delay detected, wait for some more time req_id=%llu rc=%d ctx_index %d",
+					cfg->request_id, rc,
+					ctx->ctx_index);
+				cam_req_mgr_debug_delay_detect();
+				trace_cam_delay_detect("CDM",
+					"CDM workqueue delay detected",
+					cfg->request_id, ctx->ctx_index,
+					CAM_DEFAULT_VALUE,
+					CAM_DEFAULT_VALUE, rc);
+				continue;
+			} else {
+				CAM_ERR(CAM_ISP,
+					"config done completion timeout, cdm_hang=%d on req_id=%llu ctx_index %d",
+					true, cfg->request_id, ctx->ctx_index);
+				cam_req_mgr_debug_delay_detect();
+				trace_cam_delay_detect("ISP",
+					"config done completion timeout",
+					cfg->request_id, ctx->ctx_index,
+					CAM_DEFAULT_VALUE, CAM_DEFAULT_VALUE,
+					rc);
+				rc = -ETIMEDOUT;
+				break;
+			}
+		} else {
+			rc = 0;
+			CAM_DBG(CAM_ISP,
+				"config done Success for req_id=%llu ctx_index %d",
+				cfg->request_id, ctx->ctx_index);
+			break;
+		}
+	}
+
+	if ((i == CAM_TFE_HW_CONFIG_WAIT_MAX_TRY) && (rc == 0))
+		CAM_DBG(CAM_ISP,
+			"Wq delayed but IRQ CDM done");
+
+end:
+	CAM_DBG(CAM_ISP, "Exit: Config Done: %llu",  cfg->request_id);
+
+	return rc;
+}
+
+static int cam_tfe_mgr_stop_hw_in_overflow(void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	uint32_t                          i, master_base_idx = 0;
+
+	if (!stop_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+	ctx = (struct cam_tfe_hw_mgr_ctx *)stop_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d",
+		ctx->ctx_index);
+
+	if (!ctx->num_base) {
+		CAM_ERR(CAM_ISP, "Number of bases are zero");
+		return -EINVAL;
+	}
+
+	/* get master base index first */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
+			master_base_idx = ctx->base[i].idx;
+			break;
+		}
+	}
+
+	if (i == ctx->num_base)
+		master_base_idx = ctx->base[0].idx;
+
+
+	/* stop the master CSID path first */
+	cam_tfe_mgr_csid_stop_hw(ctx, &ctx->res_list_tfe_csid,
+		master_base_idx, CAM_TFE_CSID_HALT_IMMEDIATELY);
+
+	/* Stop rest of the CSID paths  */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (i == master_base_idx)
+			continue;
+
+		cam_tfe_mgr_csid_stop_hw(ctx, &ctx->res_list_tfe_csid,
+			ctx->base[i].idx, CAM_TFE_CSID_HALT_IMMEDIATELY);
+	}
+
+	/* TFE in resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		cam_tfe_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	/* TFE out resources */
+	for (i = 0; i < CAM_TFE_HW_OUT_RES_MAX; i++)
+		cam_tfe_hw_mgr_stop_hw_res(&ctx->res_list_tfe_out[i]);
+
+	if (ctx->is_tpg)
+		cam_tfe_hw_mgr_stop_hw_res(&ctx->res_list_tpg);
+
+	/* Stop tasklet for context */
+	cam_tasklet_stop(ctx->common.tasklet_info);
+	CAM_DBG(CAM_ISP, "Exit...ctx id:%d rc :%d",
+		ctx->ctx_index, rc);
+
+	return rc;
+}
+
+static int cam_tfe_mgr_bw_control(struct cam_tfe_hw_mgr_ctx *ctx,
+	enum cam_tfe_bw_control_action action)
+{
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_tfe_bw_control_args         bw_ctrl_args;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d", ctx->ctx_index);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				bw_ctrl_args.node_res =
+					hw_mgr_res->hw_res[i];
+				bw_ctrl_args.action = action;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_BW_CONTROL,
+					&bw_ctrl_args,
+					sizeof(struct cam_tfe_bw_control_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "BW Update failed");
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_pause_hw(struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	return cam_tfe_mgr_bw_control(ctx, CAM_TFE_BW_CONTROL_EXCLUDE);
+}
+
+/* entry function: stop_hw */
+static int cam_tfe_mgr_stop_hw(void *hw_mgr_priv, void *stop_hw_args)
+{
+	int                               rc        = 0;
+	struct cam_hw_stop_args          *stop_args = stop_hw_args;
+	struct cam_isp_stop_args         *stop_isp;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	enum cam_tfe_csid_halt_cmd        csid_halt_type;
+	uint32_t                          i, master_base_idx = 0;
+
+	if (!hw_mgr_priv || !stop_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)stop_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, " Enter...ctx id:%d", ctx->ctx_index);
+	stop_isp = (struct cam_isp_stop_args    *)stop_args->args;
+
+	/* Set the csid halt command */
+	if (stop_isp->hw_stop_cmd == CAM_ISP_HW_STOP_AT_FRAME_BOUNDARY)
+		csid_halt_type = CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY;
+	else
+		csid_halt_type = CAM_TFE_CSID_HALT_IMMEDIATELY;
+
+	/* Note:stop resource will remove the irq mask from the hardware */
+
+	if (!ctx->num_base) {
+		CAM_ERR(CAM_ISP, "number of bases are zero");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Halting CSIDs");
+
+	/* get master base index first */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].split_id == CAM_ISP_HW_SPLIT_LEFT) {
+			master_base_idx = ctx->base[i].idx;
+			break;
+		}
+	}
+
+	/*
+	 * If Context does not have PIX resources and has only RDI resource
+	 * then take the first base index.
+	 */
+	if (i == ctx->num_base)
+		master_base_idx = ctx->base[0].idx;
+
+	/*Change slave mode*/
+	if (csid_halt_type == CAM_CSID_HALT_IMMEDIATELY)
+		cam_tfe_mgr_csid_change_halt_mode(ctx,
+			CAM_TFE_CSID_HALT_MODE_INTERNAL);
+
+	CAM_DBG(CAM_ISP, "Stopping master CSID idx %d", master_base_idx);
+
+	/* Stop the master CSID path first */
+	cam_tfe_mgr_csid_stop_hw(ctx, &ctx->res_list_tfe_csid,
+		master_base_idx, csid_halt_type);
+
+	/* stop rest of the CSID paths  */
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].idx == master_base_idx)
+			continue;
+		CAM_DBG(CAM_ISP, "Stopping CSID idx %d i %d master %d",
+			ctx->base[i].idx, i, master_base_idx);
+
+		cam_tfe_mgr_csid_stop_hw(ctx, &ctx->res_list_tfe_csid,
+			ctx->base[i].idx, csid_halt_type);
+	}
+
+	CAM_DBG(CAM_ISP, "Going to stop TFE Out");
+
+	/* TFE out resources */
+	for (i = 0; i < CAM_TFE_HW_OUT_RES_MAX; i++)
+		cam_tfe_hw_mgr_stop_hw_res(&ctx->res_list_tfe_out[i]);
+
+	CAM_DBG(CAM_ISP, "Going to stop TFE IN");
+
+	/* TFE in resources */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		cam_tfe_hw_mgr_stop_hw_res(hw_mgr_res);
+	}
+
+	cam_tasklet_stop(ctx->common.tasklet_info);
+
+	cam_tfe_mgr_pause_hw(ctx);
+
+	wait_for_completion_timeout(&ctx->config_done_complete,
+		msecs_to_jiffies(5));
+
+	if (ctx->is_tpg)
+		cam_tfe_hw_mgr_stop_hw_res(&ctx->res_list_tpg);
+
+	if (stop_isp->stop_only)
+		goto end;
+
+	if (cam_cdm_stream_off(ctx->cdm_handle))
+		CAM_ERR(CAM_ISP, "CDM stream off failed %d", ctx->cdm_handle);
+
+	cam_tfe_hw_mgr_deinit_hw(ctx);
+
+	CAM_DBG(CAM_ISP,
+		"Stop success for ctx id:%d rc :%d", ctx->ctx_index, rc);
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	atomic_dec_return(&g_tfe_hw_mgr.active_ctx_cnt);
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+
+	for (i = 0; i < ctx->last_submit_bl_cmd.bl_count; i++) {
+		ctx->last_submit_bl_cmd.cmd[i].mem_handle = 0;
+		ctx->last_submit_bl_cmd.cmd[i].hw_addr = 0;
+		ctx->last_submit_bl_cmd.cmd[i].len = 0;
+		ctx->last_submit_bl_cmd.cmd[i].offset = 0;
+		ctx->last_submit_bl_cmd.cmd[i].type = 0;
+		ctx->last_submit_bl_cmd.cmd[i].input_len = 0;
+	}
+	ctx->last_submit_bl_cmd.bl_count = 0;
+	ctx->packet = NULL;
+
+end:
+	return rc;
+}
+
+static int cam_tfe_mgr_reset_tfe_hw(struct cam_tfe_hw_mgr *hw_mgr,
+	uint32_t hw_idx)
+{
+	uint32_t i = 0;
+	struct cam_hw_intf             *tfe_hw_intf;
+	uint32_t tfe_reset_type;
+
+	if (!hw_mgr) {
+		CAM_DBG(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+	/* Reset TFE HW*/
+	tfe_reset_type = CAM_TFE_HW_RESET_HW;
+
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (!hw_mgr->tfe_devices[i])
+			continue;
+
+		if (hw_idx != hw_mgr->tfe_devices[i]->hw_intf->hw_idx)
+			continue;
+		CAM_DBG(CAM_ISP, "TFE (id = %d) reset", hw_idx);
+		tfe_hw_intf = hw_mgr->tfe_devices[i]->hw_intf;
+		tfe_hw_intf->hw_ops.reset(tfe_hw_intf->hw_priv,
+			&tfe_reset_type, sizeof(tfe_reset_type));
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "Exit Successfully");
+	return 0;
+}
+
+static int cam_tfe_mgr_restart_hw(void *start_hw_args)
+{
+	int                               rc = -EINVAL;
+	struct cam_hw_start_args         *start_args = start_hw_args;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	uint32_t                          i;
+
+	if (!start_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)start_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "START TFE OUT ... in ctx id:%d", ctx->ctx_index);
+
+	cam_tasklet_start(ctx->common.tasklet_info);
+
+	/* start the TFE out devices */
+	for (i = 0; i < CAM_TFE_HW_OUT_RES_MAX; i++) {
+		rc = cam_tfe_hw_mgr_start_hw_res(
+			&ctx->res_list_tfe_out[i], ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE OUT (%d)", i);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START TFE SRC ... in ctx id:%d", ctx->ctx_index);
+
+	/* Start the TFE in devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		rc = cam_tfe_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE IN (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START CSID HW ... in ctx id:%d", ctx->ctx_index);
+	/* Start the TFE CSID HW devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		rc = cam_tfe_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE CSID (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Exit...(success)");
+	return 0;
+
+err:
+	cam_tfe_mgr_stop_hw_in_overflow(start_hw_args);
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+}
+
+static int cam_tfe_mgr_start_hw(void *hw_mgr_priv, void *start_hw_args)
+{
+	int                               rc = -EINVAL;
+	struct cam_isp_start_args        *start_isp = start_hw_args;
+	struct cam_hw_stop_args           stop_args;
+	struct cam_isp_stop_args          stop_isp;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_hw_intf               *hw_intf;
+	uint32_t                          i;
+	bool                              res_rdi_context_set = false;
+	uint32_t                          primary_rdi_in_res;
+	uint32_t                          primary_rdi_out_res;
+	bool                              hw_id[CAM_TFE_HW_NUM_MAX] = {0};
+
+	primary_rdi_in_res = CAM_ISP_HW_TFE_IN_MAX;
+	primary_rdi_out_res = CAM_ISP_TFE_OUT_RES_MAX;
+
+	if (!hw_mgr_priv || !start_isp) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)
+		start_isp->hw_config.ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	if ((!ctx->init_done) && start_isp->start_only) {
+		CAM_ERR(CAM_ISP, "Invalid args init_done %d start_only %d",
+			ctx->init_done, start_isp->start_only);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter... ctx id:%d",
+		ctx->ctx_index);
+
+	/* update Bandwidth should be done at the hw layer */
+
+	cam_tasklet_start(ctx->common.tasklet_info);
+
+	if (ctx->init_done && start_isp->start_only)
+		goto start_only;
+
+	/* set tpg debug information for top tpg */
+	for (i = 0; i < CAM_TOP_TPG_HW_NUM_MAX; i++) {
+		if (g_tfe_hw_mgr.tpg_devices[i]) {
+			rc = g_tfe_hw_mgr.tpg_devices[i]->hw_ops.process_cmd(
+				g_tfe_hw_mgr.tpg_devices[i]->hw_priv,
+				CAM_ISP_HW_CMD_TPG_SET_PATTERN,
+				&g_tfe_hw_mgr.debug_cfg.set_tpg_pattern,
+				sizeof(g_tfe_hw_mgr.debug_cfg.set_tpg_pattern));
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_id[hw_intf->hw_idx])
+				continue;
+
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_TFE_CSID_SET_CSID_DEBUG,
+				&g_tfe_hw_mgr.debug_cfg.csid_debug,
+				sizeof(g_tfe_hw_mgr.debug_cfg.csid_debug));
+			hw_id[hw_intf->hw_idx] = true;
+		}
+	}
+
+	memset(&hw_id[0], 0, sizeof(hw_id));
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_id[hw_intf->hw_idx])
+				continue;
+
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_SET_CAMIF_DEBUG,
+				&g_tfe_hw_mgr.debug_cfg.camif_debug,
+				sizeof(g_tfe_hw_mgr.debug_cfg.camif_debug));
+			hw_id[hw_intf->hw_idx] = true;
+		}
+	}
+
+	rc = cam_tfe_hw_mgr_init_hw(ctx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Init failed");
+		goto tasklet_stop;
+	}
+
+	ctx->init_done = true;
+
+	mutex_lock(&g_tfe_hw_mgr.ctx_mutex);
+	atomic_fetch_inc(&g_tfe_hw_mgr.active_ctx_cnt);
+	mutex_unlock(&g_tfe_hw_mgr.ctx_mutex);
+
+	CAM_DBG(CAM_ISP, "start cdm interface");
+	rc = cam_cdm_stream_on(ctx->cdm_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Can not start cdm (%d)",
+			 ctx->cdm_handle);
+		goto deinit_hw;
+	}
+
+start_only:
+	/* Apply initial configuration */
+	CAM_DBG(CAM_ISP, "Config HW");
+	rc = cam_tfe_mgr_config_hw(hw_mgr_priv, &start_isp->hw_config);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Config HW failed");
+		goto cdm_streamoff;
+	}
+
+	CAM_DBG(CAM_ISP, "START TFE OUT ... in ctx id:%d",
+		ctx->ctx_index);
+	/* start the TFE out devices */
+	for (i = 0; i < CAM_TFE_HW_OUT_RES_MAX; i++) {
+		hw_mgr_res = &ctx->res_list_tfe_out[i];
+		switch (hw_mgr_res->res_id) {
+		case CAM_ISP_TFE_OUT_RES_RDI_0:
+		case CAM_ISP_TFE_OUT_RES_RDI_1:
+		case CAM_ISP_TFE_OUT_RES_RDI_2:
+			if (!res_rdi_context_set && ctx->is_rdi_only_context) {
+				hw_mgr_res->hw_res[0]->rdi_only_ctx =
+					ctx->is_rdi_only_context;
+				res_rdi_context_set = true;
+				primary_rdi_out_res = hw_mgr_res->res_id;
+			}
+		}
+
+		rc = cam_tfe_hw_mgr_start_hw_res(
+			&ctx->res_list_tfe_out[i], ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE OUT (%d)",
+				 i);
+			goto err;
+		}
+	}
+
+	if (primary_rdi_out_res < CAM_ISP_TFE_OUT_RES_MAX)
+		primary_rdi_in_res =
+			cam_tfe_hw_mgr_convert_rdi_out_res_id_to_in_res(
+			primary_rdi_out_res);
+
+	CAM_DBG(CAM_ISP, "START TFE IN ... in ctx id:%d",
+		ctx->ctx_index);
+	/* Start the TFE in resources devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		/*
+		 * if rdi only context has two rdi resources then only one irq
+		 * subscription should be sufficient
+		 */
+		if (primary_rdi_in_res == hw_mgr_res->res_id)
+			hw_mgr_res->hw_res[0]->rdi_only_ctx =
+				ctx->is_rdi_only_context;
+
+		rc = cam_tfe_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE in resource (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "START CSID HW ... in ctx id:%d",
+		ctx->ctx_index);
+	/* Start the TFE CSID HW devices */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		rc = cam_tfe_hw_mgr_start_hw_res(hw_mgr_res, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE CSID (%d)",
+				 hw_mgr_res->res_id);
+			goto err;
+		}
+	}
+
+	if (ctx->is_tpg) {
+		CAM_DBG(CAM_ISP, "START TPG HW ... in ctx id:%d",
+			ctx->ctx_index);
+		rc = cam_tfe_hw_mgr_start_hw_res(&ctx->res_list_tpg, ctx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can not start TFE TPG (%d)",
+				ctx->res_list_tpg.res_id);
+			goto err;
+		}
+	}
+
+	return 0;
+
+err:
+	stop_isp.stop_only = false;
+	stop_isp.hw_stop_cmd = CAM_ISP_HW_STOP_IMMEDIATELY;
+	stop_args.ctxt_to_hw_map = start_isp->hw_config.ctxt_to_hw_map;
+	stop_args.args = (void *)(&stop_isp);
+
+	cam_tfe_mgr_stop_hw(hw_mgr_priv, &stop_args);
+	CAM_DBG(CAM_ISP, "Exit...(rc=%d)", rc);
+	return rc;
+
+cdm_streamoff:
+	cam_cdm_stream_off(ctx->cdm_handle);
+
+deinit_hw:
+	cam_tfe_hw_mgr_deinit_hw(ctx);
+
+tasklet_stop:
+	cam_tasklet_stop(ctx->common.tasklet_info);
+
+	return rc;
+}
+
+static int cam_tfe_mgr_read(void *hw_mgr_priv, void *read_args)
+{
+	return -EPERM;
+}
+
+static int cam_tfe_mgr_write(void *hw_mgr_priv, void *write_args)
+{
+	return -EPERM;
+}
+
+static int cam_tfe_mgr_user_dump_hw(
+		struct cam_tfe_hw_mgr_ctx *tfe_ctx,
+		struct cam_hw_dump_args *dump_args)
+{
+	int rc = 0;
+	struct cam_hw_soc_dump_args soc_dump_args;
+
+	if (!tfe_ctx || !dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid parameters %pK %pK",
+			tfe_ctx, dump_args);
+		return -EINVAL;
+	}
+	soc_dump_args.buf_handle = dump_args->buf_handle;
+	soc_dump_args.request_id = dump_args->request_id;
+	soc_dump_args.offset = dump_args->offset;
+
+	rc = cam_tfe_mgr_handle_reg_dump(tfe_ctx,
+		tfe_ctx->reg_dump_buf_desc,
+		tfe_ctx->num_reg_dump_buf,
+		CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR,
+		&soc_dump_args,
+		true);
+	if (rc) {
+		CAM_DBG(CAM_ISP,
+			"Dump failed req: %lld handle %u offset %u rc %d",
+			dump_args->request_id,
+			dump_args->buf_handle,
+			dump_args->offset,
+			rc);
+		return rc;
+	}
+	dump_args->offset = soc_dump_args.offset;
+	return rc;
+}
+
+static int cam_tfe_mgr_dump(void *hw_mgr_priv, void *args)
+{
+
+	struct cam_isp_hw_dump_args isp_hw_dump_args;
+	struct cam_hw_dump_args *dump_args = (struct cam_hw_dump_args *)args;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_tfe_hw_mgr_ctx *tfe_ctx = (struct cam_tfe_hw_mgr_ctx *)
+						dump_args->ctxt_to_hw_map;
+	int i;
+	int rc = 0;
+
+	/* for some targets, information about the TFE registers to be dumped
+	 * is already submitted with the hw manager. In this case, we
+	 * can dump just the related registers and skip going to core files.
+	 * If dump to this buffer falis due to any reason, fallback to dump
+	 * to the LDAR buffer
+	 */
+	isp_hw_dump_args.is_dump_all = true;
+	if (tfe_ctx->num_reg_dump_buf) {
+		rc = cam_tfe_mgr_user_dump_hw(tfe_ctx, dump_args);
+		if (!rc)
+			isp_hw_dump_args.is_dump_all = false;
+	}
+
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&isp_hw_dump_args.cpu_addr,
+		&isp_hw_dump_args.buf_len);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+
+	isp_hw_dump_args.offset = dump_args->offset;
+	isp_hw_dump_args.req_id = dump_args->request_id;
+
+	list_for_each_entry(hw_mgr_res, &tfe_ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			switch (hw_mgr_res->hw_res[i]->res_id) {
+			case CAM_TFE_CSID_PATH_RES_RDI_0:
+			case CAM_TFE_CSID_PATH_RES_RDI_1:
+			case CAM_TFE_CSID_PATH_RES_RDI_2:
+				if (tfe_ctx->is_rdi_only_context &&
+					hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+
+			case CAM_TFE_CSID_PATH_RES_IPP:
+				if (hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+			default:
+				CAM_DBG(CAM_ISP, "not a valid res %d",
+				hw_mgr_res->res_id);
+				break;
+			}
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &tfe_ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			switch (hw_mgr_res->hw_res[i]->res_id) {
+			case CAM_ISP_HW_TFE_IN_RDI0:
+			case CAM_ISP_HW_TFE_IN_RDI1:
+			case CAM_ISP_HW_TFE_IN_RDI2:
+				if (tfe_ctx->is_rdi_only_context &&
+					hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+
+			case CAM_ISP_HW_TFE_IN_CAMIF:
+				if (hw_intf->hw_ops.process_cmd) {
+					rc = hw_intf->hw_ops.process_cmd(
+						hw_intf->hw_priv,
+						CAM_ISP_HW_CMD_DUMP_HW,
+						&isp_hw_dump_args,
+						sizeof(struct
+						    cam_isp_hw_dump_args));
+				}
+				break;
+			default:
+				CAM_DBG(CAM_ISP, "not a valid res %d",
+				hw_mgr_res->res_id);
+				break;
+			}
+		}
+	}
+	dump_args->offset = isp_hw_dump_args.offset;
+	CAM_DBG(CAM_ISP, "offset %u", dump_args->offset);
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_tfe_mgr_reset(void *hw_mgr_priv, void *hw_reset_args)
+{
+	struct cam_tfe_hw_mgr            *hw_mgr = hw_mgr_priv;
+	struct cam_hw_reset_args         *reset_args = hw_reset_args;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	int                               rc = 0, i = 0;
+
+	if (!hw_mgr_priv || !hw_reset_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)reset_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Reset CSID and TFE");
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		rc = cam_tfe_hw_mgr_reset_csid_res(hw_mgr_res);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to reset CSID:%d rc: %d",
+				hw_mgr_res->res_id, rc);
+			goto end;
+		}
+	}
+
+	for (i = 0; i < ctx->num_base; i++) {
+		rc = cam_tfe_mgr_reset_tfe_hw(hw_mgr, ctx->base[i].idx);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Failed to reset TFE:%d rc: %d",
+				ctx->base[i].idx, rc);
+			goto end;
+		}
+	}
+
+	atomic_set(&ctx->overflow_pending, 0);
+end:
+	return rc;
+}
+
+static int cam_tfe_mgr_release_hw(void *hw_mgr_priv,
+					void *release_hw_args)
+{
+	int                               rc           = 0;
+	struct cam_hw_release_args       *release_args = release_hw_args;
+	struct cam_tfe_hw_mgr            *hw_mgr       = hw_mgr_priv;
+	struct cam_tfe_hw_mgr_ctx        *ctx;
+	uint32_t                          i;
+
+	if (!hw_mgr_priv || !release_hw_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)release_args->ctxt_to_hw_map;
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Invalid context is used");
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter...ctx id:%d",
+		ctx->ctx_index);
+
+	if (ctx->init_done)
+		cam_tfe_hw_mgr_deinit_hw(ctx);
+
+	/* we should called the stop hw before this already */
+	cam_tfe_hw_mgr_release_hw_for_ctx(ctx);
+
+	/* reset base info */
+	ctx->num_base = 0;
+	memset(ctx->base, 0, sizeof(ctx->base));
+
+	/* release cdm handle */
+	cam_cdm_release(ctx->cdm_handle);
+
+	/* clean context */
+	list_del_init(&ctx->list);
+	ctx->ctx_in_use = 0;
+	ctx->is_rdi_only_context = 0;
+	ctx->cdm_handle = 0;
+	ctx->cdm_ops = NULL;
+	ctx->init_done = false;
+	ctx->is_dual = false;
+	ctx->is_tpg  = false;
+	ctx->num_reg_dump_buf = 0;
+	ctx->res_list_tpg.res_type = CAM_ISP_RESOURCE_MAX;
+	ctx->last_cdm_done_req = 0;
+	atomic_set(&ctx->overflow_pending, 0);
+
+	for (i = 0; i < ctx->last_submit_bl_cmd.bl_count; i++) {
+		ctx->last_submit_bl_cmd.cmd[i].mem_handle = 0;
+		ctx->last_submit_bl_cmd.cmd[i].hw_addr = 0;
+		ctx->last_submit_bl_cmd.cmd[i].len = 0;
+		ctx->last_submit_bl_cmd.cmd[i].offset = 0;
+		ctx->last_submit_bl_cmd.cmd[i].type = 0;
+		ctx->last_submit_bl_cmd.cmd[i].input_len = 0;
+	}
+	ctx->last_submit_bl_cmd.bl_count = 0;
+	ctx->packet = NULL;
+
+	CAM_DBG(CAM_ISP, "Exit...ctx id:%d",
+		ctx->ctx_index);
+	cam_tfe_hw_mgr_put_ctx(&hw_mgr->free_ctx_list, &ctx);
+	return rc;
+}
+
+static int cam_isp_tfe_blob_hfr_update(
+	uint32_t                                  blob_type,
+	struct cam_isp_generic_blob_info         *blob_info,
+	struct cam_isp_tfe_resource_hfr_config   *hfr_config,
+	struct cam_hw_prepare_update_args        *prepare)
+{
+	struct cam_isp_tfe_port_hfr_config    *port_hfr_config;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+	struct cam_tfe_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	uint32_t                               res_id_out, i;
+	uint32_t                               total_used_bytes = 0;
+	uint32_t                               kmd_buf_remain_size;
+	uint32_t                              *cmd_buf_addr;
+	uint32_t                               bytes_used = 0;
+	int                                    num_ent, rc = 0;
+
+	ctx = prepare->ctxt_to_hw_map;
+	CAM_DBG(CAM_ISP, "num_ports= %d", hfr_config->num_ports);
+
+	/* Max one hw entries required for hfr config update */
+	if (prepare->num_hw_update_entries + 1 >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	kmd_buf_info = blob_info->kmd_buf_info;
+	for (i = 0; i < hfr_config->num_ports; i++) {
+		port_hfr_config = &hfr_config->port_hfr_config_flex[i];
+		res_id_out = port_hfr_config->resource_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "hfr config idx %d, type=%d", i,
+			res_id_out);
+
+		if (res_id_out >= CAM_TFE_HW_OUT_RES_MAX) {
+			CAM_ERR(CAM_ISP, "invalid out restype:%x",
+				port_hfr_config->resource_type);
+			return -EINVAL;
+		}
+
+		if ((kmd_buf_info->used_bytes
+			+ total_used_bytes) < kmd_buf_info->size) {
+			kmd_buf_remain_size = kmd_buf_info->size -
+			(kmd_buf_info->used_bytes +
+			total_used_bytes);
+		} else {
+			CAM_ERR(CAM_ISP,
+			"no free kmd memory for base %d",
+			blob_info->base_info->idx);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		cmd_buf_addr = kmd_buf_info->cpu_addr +
+			kmd_buf_info->used_bytes/4 +
+			total_used_bytes/4;
+		hw_mgr_res = &ctx->res_list_tfe_out[res_id_out];
+
+		rc = cam_isp_add_cmd_buf_update(
+			hw_mgr_res, blob_type, CAM_ISP_HW_CMD_GET_HFR_UPDATE,
+			blob_info->base_info->idx,
+			(void *)cmd_buf_addr,
+			kmd_buf_remain_size,
+			(void *)port_hfr_config,
+			&bytes_used);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"Failed cmd_update, base_idx=%d, rc=%d",
+				blob_info->base_info->idx, bytes_used);
+			return rc;
+		}
+
+		total_used_bytes += bytes_used;
+	}
+
+	if (total_used_bytes) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = total_used_bytes;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		num_ent++;
+		kmd_buf_info->used_bytes += total_used_bytes;
+		kmd_buf_info->offset     += total_used_bytes;
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_blob_csid_clock_update(
+	uint32_t                                   blob_type,
+	struct cam_isp_generic_blob_info          *blob_info,
+	struct cam_isp_tfe_csid_clock_config      *clock_config,
+	struct cam_hw_prepare_update_args         *prepare)
+{
+	struct cam_tfe_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_tfe_csid_clock_update_args  csid_clock_upd_args;
+	struct cam_top_tpg_clock_update_args   tpg_clock_upd_args;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	CAM_DBG(CAM_ISP, "csid clk=%llu", clock_config->csid_clock);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			clk_rate = 0;
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			clk_rate = clock_config->csid_clock;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				csid_clock_upd_args.clk_rate = clk_rate;
+				CAM_DBG(CAM_ISP, "i= %d csid clk=%llu",
+				i, csid_clock_upd_args.clk_rate);
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE,
+					&csid_clock_upd_args,
+					sizeof(
+					struct cam_tfe_csid_clock_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Clock Update failed");
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	if (ctx->res_list_tpg.res_type == CAM_ISP_RESOURCE_TPG) {
+		tpg_clock_upd_args.clk_rate = clock_config->phy_clock;
+		hw_intf = ctx->res_list_tpg.hw_res[0]->hw_intf;
+		if (hw_intf && hw_intf->hw_ops.process_cmd) {
+			CAM_DBG(CAM_ISP, "i= %d phy clk=%llu",
+				tpg_clock_upd_args.clk_rate);
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_TPG_PHY_CLOCK_UPDATE,
+				&tpg_clock_upd_args,
+				sizeof(struct cam_top_tpg_clock_update_args));
+			if (rc)
+				CAM_ERR(CAM_ISP, "Clock Update failed");
+		} else
+			CAM_ERR(CAM_ISP, "NULL hw_intf!");
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_blob_clock_update(
+	uint32_t                               blob_type,
+	struct cam_isp_generic_blob_info      *blob_info,
+	struct cam_isp_tfe_clock_config       *clock_config,
+	struct cam_hw_prepare_update_args     *prepare)
+{
+	struct cam_tfe_hw_mgr_ctx             *ctx = NULL;
+	struct cam_isp_hw_mgr_res             *hw_mgr_res;
+	struct cam_hw_intf                    *hw_intf;
+	struct cam_tfe_clock_update_args       clock_upd_args;
+	uint64_t                               clk_rate = 0;
+	int                                    rc = -EINVAL;
+	uint32_t                               i;
+	uint32_t                               j;
+	bool                                   camif_l_clk_updated = false;
+	bool                                   camif_r_clk_updated = false;
+
+	ctx = prepare->ctxt_to_hw_map;
+
+	CAM_DBG(CAM_PERF,
+		"usage=%u left_clk= %lu right_clk=%lu",
+		clock_config->usage_type,
+		clock_config->left_pix_hz,
+		clock_config->right_pix_hz);
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			clk_rate = 0;
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			if (hw_mgr_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+				if (i == CAM_ISP_HW_SPLIT_LEFT) {
+					if (camif_l_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->left_pix_hz;
+
+					camif_l_clk_updated = true;
+				} else {
+					if (camif_r_clk_updated)
+						continue;
+
+					clk_rate =
+						clock_config->right_pix_hz;
+
+					camif_r_clk_updated = true;
+				}
+			} else if ((hw_mgr_res->res_id >=
+				CAM_ISP_HW_TFE_IN_RDI0) && (hw_mgr_res->res_id
+				<= CAM_ISP_HW_TFE_IN_RDI2)) {
+				for (j = 0; j < clock_config->num_rdi; j++)
+					clk_rate = max(clock_config->rdi_hz_flex[j],
+						clk_rate);
+			} else {
+				CAM_ERR(CAM_ISP, "Invalid res_id %u",
+					hw_mgr_res->res_id);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				clock_upd_args.node_res =
+					hw_mgr_res->hw_res[i];
+				CAM_DBG(CAM_ISP,
+				"res_id=%u i= %d clk=%llu",
+				hw_mgr_res->res_id, i, clk_rate);
+
+				clock_upd_args.clk_rate = clk_rate;
+
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CLOCK_UPDATE,
+					&clock_upd_args,
+					sizeof(
+					struct cam_tfe_clock_update_args));
+				if (rc)
+					CAM_ERR(CAM_ISP, "Clock Update failed");
+			} else
+				CAM_WARN(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_tfe_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	int rc = 0;
+	struct cam_isp_generic_blob_info  *blob_info = user_data;
+	struct cam_hw_prepare_update_args *prepare = NULL;
+
+	if (!blob_data || (blob_size == 0) || !blob_info) {
+		CAM_ERR(CAM_ISP, "Invalid args data %pK size %d info %pK",
+			blob_data, blob_size, blob_info);
+		return -EINVAL;
+	}
+
+	prepare = blob_info->prepare;
+	if (!prepare) {
+		CAM_ERR(CAM_ISP, "Failed. prepare is NULL, blob_type %d",
+			blob_type);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "BLOB Type: %d", blob_type);
+	switch (blob_type) {
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_HFR_CONFIG: {
+		struct cam_isp_tfe_resource_hfr_config    *hfr_config =
+			(struct cam_isp_tfe_resource_hfr_config *)blob_data;
+
+		if (blob_size <
+			sizeof(struct cam_isp_tfe_resource_hfr_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		if (hfr_config->num_ports > CAM_ISP_TFE_OUT_RES_MAX) {
+			CAM_ERR(CAM_ISP, "Invalid num_ports %u in hfr config",
+				hfr_config->num_ports);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (hfr_config->num_ports > 1) {
+			if (sizeof(struct cam_isp_tfe_resource_hfr_config) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_tfe_resource_hfr_config))
+				/ (hfr_config->num_ports - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in hfr config num_ports:%u size per port:%lu",
+					hfr_config->num_ports,
+					sizeof(struct
+					cam_isp_tfe_resource_hfr_config));
+				return -EINVAL;
+			}
+		}
+
+		if ((hfr_config->num_ports != 0) && (blob_size <
+			(sizeof(struct cam_isp_tfe_resource_hfr_config) +
+			(hfr_config->num_ports - 1) *
+			sizeof(struct cam_isp_tfe_port_hfr_config)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(struct cam_isp_tfe_resource_hfr_config) +
+				(hfr_config->num_ports - 1) *
+				sizeof(struct cam_isp_tfe_resource_hfr_config));
+			return -EINVAL;
+		}
+
+		rc = cam_isp_tfe_blob_hfr_update(blob_type, blob_info,
+			hfr_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "HFR Update Failed");
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_CLOCK_CONFIG: {
+		struct cam_isp_tfe_clock_config    *clock_config =
+			(struct cam_isp_tfe_clock_config *)blob_data;
+
+		if (blob_size < sizeof(struct cam_isp_tfe_clock_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		if (clock_config->num_rdi > CAM_TFE_RDI_NUM_MAX) {
+			CAM_ERR(CAM_ISP, "Invalid num_rdi %u in clock config",
+				clock_config->num_rdi);
+			return -EINVAL;
+		}
+		/* Check integer overflow */
+		if (clock_config->num_rdi > 1) {
+			if (sizeof(uint64_t) > ((UINT_MAX-
+				sizeof(struct cam_isp_tfe_clock_config))/
+				(clock_config->num_rdi - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Max size exceeded in clock config num_rdi:%u size per port:%lu",
+					clock_config->num_rdi,
+					sizeof(uint64_t));
+				return -EINVAL;
+			}
+		}
+
+		if ((clock_config->num_rdi != 0) && (blob_size <
+			(sizeof(struct cam_isp_tfe_clock_config) +
+			sizeof(uint64_t) * (clock_config->num_rdi - 1)))) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %lu",
+				blob_size,
+				sizeof(uint32_t) * 2 + sizeof(uint64_t) *
+				(clock_config->num_rdi + 2));
+			return -EINVAL;
+		}
+
+		rc = cam_isp_tfe_blob_clock_update(blob_type, blob_info,
+			clock_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Clock Update Failed");
+	}
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_BW_CONFIG_V2: {
+		size_t bw_config_size = 0;
+		struct cam_isp_tfe_bw_config_v2    *bw_config =
+			(struct cam_isp_tfe_bw_config_v2 *)blob_data;
+		struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+
+		if (blob_size < sizeof(struct cam_isp_tfe_bw_config_v2)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u", blob_size);
+			return -EINVAL;
+		}
+
+		if ((bw_config->num_paths > CAM_ISP_MAX_PER_PATH_VOTES) ||
+			!bw_config->num_paths) {
+			CAM_ERR(CAM_ISP, "Invalid num paths %d",
+				bw_config->num_paths);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (bw_config->num_paths > 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote) >
+				((UINT_MAX -
+				sizeof(struct cam_isp_tfe_bw_config_v2)) /
+				(bw_config->num_paths - 1))) {
+				CAM_ERR(CAM_ISP,
+					"Size exceeds limit paths:%u size per path:%lu",
+					bw_config->num_paths - 1,
+					sizeof(
+					struct cam_axi_per_path_bw_vote));
+				return -EINVAL;
+			}
+		}
+
+		if ((bw_config->num_paths != 0) && (blob_size <
+			(sizeof(struct cam_isp_tfe_bw_config_v2) +
+			((bw_config->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote))))) {
+			CAM_ERR(CAM_ISP,
+				"Invalid blob size: %u, num_paths: %u, bw_config size: %lu, per_path_vote size: %lu",
+				blob_size, bw_config->num_paths,
+				sizeof(struct cam_isp_tfe_bw_config_v2),
+				sizeof(struct cam_axi_per_path_bw_vote));
+			return -EINVAL;
+		}
+
+		if (!prepare || !prepare->priv ||
+			(bw_config->usage_type >= CAM_TFE_HW_NUM_MAX)) {
+			CAM_ERR(CAM_ISP, "Invalid inputs");
+			return -EINVAL;
+		}
+
+		prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+			prepare->priv;
+
+		memset(&prepare_hw_data->bw_config_v2[bw_config->usage_type],
+			0, sizeof(
+			prepare_hw_data->bw_config_v2[bw_config->usage_type]));
+		bw_config_size = sizeof(struct cam_isp_tfe_bw_config_v2) +
+			((bw_config->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote));
+		memcpy(&prepare_hw_data->bw_config_v2[bw_config->usage_type],
+			bw_config, bw_config_size);
+
+		prepare_hw_data->bw_config_version = CAM_ISP_BW_CONFIG_V2;
+		prepare_hw_data->bw_config_valid[bw_config->usage_type] = true;
+	}
+
+		break;
+	case CAM_ISP_TFE_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG: {
+		struct cam_isp_tfe_csid_clock_config    *clock_config =
+			(struct cam_isp_tfe_csid_clock_config *)blob_data;
+
+		if (blob_size < sizeof(struct cam_isp_tfe_csid_clock_config)) {
+			CAM_ERR(CAM_ISP, "Invalid blob size %u expected %u",
+				blob_size,
+				sizeof(struct cam_isp_tfe_csid_clock_config));
+			return -EINVAL;
+		}
+		rc = cam_isp_tfe_blob_csid_clock_update(blob_type, blob_info,
+			clock_config, prepare);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Clock Update Failed");
+	}
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "Invalid blob type %d", blob_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_update_dual_config(
+	struct cam_cmd_buf_desc            *cmd_desc,
+	uint32_t                            split_id,
+	uint32_t                            base_idx,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint32_t                            size_isp_out)
+{
+	int rc = -EINVAL;
+	struct cam_isp_tfe_dual_config             *dual_config;
+	struct cam_isp_hw_mgr_res                  *hw_mgr_res;
+	struct cam_isp_resource_node               *res;
+	struct cam_tfe_dual_update_args             dual_isp_update_args;
+	uint32_t                                    outport_id;
+	size_t                                      len = 0, remain_len = 0;
+	uint32_t                                   *cpu_addr;
+	uint32_t                                    i, j, stp_index;
+
+	CAM_DBG(CAM_ISP, "cmd des size %d, length: %d",
+		cmd_desc->size, cmd_desc->length);
+
+	rc = cam_packet_util_get_cmd_mem_addr(
+		cmd_desc->mem_handle, &cpu_addr, &len);
+	if (rc) {
+		CAM_DBG(CAM_ISP, "unable to get cmd mem addr handle:0x%x",
+			cmd_desc->mem_handle);
+		return rc;
+	}
+
+	if ((len < sizeof(struct cam_isp_tfe_dual_config)) ||
+		(cmd_desc->offset >=
+			(len - sizeof(struct cam_isp_tfe_dual_config)))) {
+		CAM_ERR(CAM_ISP, "not enough buffer provided");
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+
+	remain_len = len - cmd_desc->offset;
+	cpu_addr += (cmd_desc->offset / 4);
+	dual_config = (struct cam_isp_tfe_dual_config *)cpu_addr;
+
+	if ((dual_config->num_ports *
+		sizeof(struct cam_isp_tfe_dual_stripe_config)) >
+		(remain_len -
+			offsetof(struct cam_isp_tfe_dual_config, stripes))) {
+		CAM_ERR(CAM_ISP, "not enough buffer for all the dual configs");
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "num_ports:%d", dual_config->num_ports);
+	if (dual_config->num_ports >= size_isp_out) {
+		CAM_ERR(CAM_UTIL,
+			"inval num ports %d max num tfe ports:%d",
+			dual_config->num_ports, size_isp_out);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	for (i = 0; i < dual_config->num_ports; i++) {
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			stp_index = (i * CAM_PACKET_MAX_PLANES) +
+				(j * (CAM_PACKET_MAX_PLANES *
+				dual_config->num_ports));
+
+			if (!dual_config->stripes_flex[stp_index].port_id)
+				continue;
+
+			outport_id = dual_config->stripes_flex[stp_index].port_id;
+			if (outport_id >= size_isp_out) {
+				CAM_ERR(CAM_UTIL,
+					"inval outport id:%d i:%d j:%d num ports:%d ",
+					outport_id, i, j,
+					dual_config->num_ports);
+					rc = -EINVAL;
+					goto end;
+			}
+
+			hw_mgr_res = &res_list_isp_out[outport_id];
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			res = hw_mgr_res->hw_res[j];
+
+			if (res->res_id < CAM_ISP_TFE_OUT_RES_BASE ||
+				res->res_id >= CAM_ISP_TFE_OUT_RES_MAX) {
+				CAM_DBG(CAM_ISP, "res id :%d", res->res_id);
+				continue;
+			}
+
+			dual_isp_update_args.split_id = j;
+			dual_isp_update_args.res      = res;
+			dual_isp_update_args.stripe_config =
+				&dual_config->stripes_flex[stp_index];
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_STRIPE_UPDATE,
+				&dual_isp_update_args,
+				sizeof(struct cam_tfe_dual_update_args));
+			if (rc)
+				goto end;
+		}
+	}
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+int cam_tfe_add_command_buffers(
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	struct cam_isp_ctx_base_info       *base_info,
+	cam_packet_generic_blob_handler     blob_handler_cb,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint32_t                            size_isp_out)
+{
+	int rc = 0;
+	uint32_t                           cmd_meta_data, num_ent, i;
+	uint32_t                           base_idx;
+	enum cam_isp_hw_split_id           split_id;
+	struct cam_cmd_buf_desc           *cmd_desc = NULL;
+	struct cam_hw_update_entry        *hw_entry = NULL;
+
+	split_id = base_info->split_id;
+	base_idx = base_info->idx;
+	hw_entry = prepare->hw_update_entries;
+	/*
+	 * set the cmd_desc to point the first command descriptor in the
+	 * packet
+	 */
+	cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint8_t *)&prepare->packet->payload_flex +
+			prepare->packet->cmd_buf_offset);
+
+	CAM_DBG(CAM_ISP, "split id = %d, number of command buffers:%d",
+		split_id, prepare->packet->num_cmd_buf);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		num_ent = prepare->num_hw_update_entries;
+		if (!cmd_desc[i].length)
+			continue;
+
+		/* One hw entry space required for left or right or common */
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		cmd_meta_data = cmd_desc[i].meta_data;
+
+		CAM_DBG(CAM_ISP, "meta type: %d, split_id: %d",
+			cmd_meta_data, split_id);
+
+		switch (cmd_meta_data) {
+		case CAM_ISP_TFE_PACKET_META_BASE:
+		case CAM_ISP_TFE_PACKET_META_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle =
+					cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				CAM_DBG(CAM_ISP,
+					"Meta_Left num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_TFE_PACKET_META_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle =
+					cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				CAM_DBG(CAM_ISP,
+					"Meta_Right num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_TFE_PACKET_META_COMMON:
+			hw_entry[num_ent].len = cmd_desc[i].length;
+			hw_entry[num_ent].handle =
+				cmd_desc[i].mem_handle;
+			hw_entry[num_ent].offset = cmd_desc[i].offset;
+			hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+			CAM_DBG(CAM_ISP,
+				"Meta_Common num_ent=%d handle=0x%x, len=%u, offset=%u",
+				num_ent,
+				hw_entry[num_ent].handle,
+				hw_entry[num_ent].len,
+				hw_entry[num_ent].offset);
+			if (cmd_meta_data == CAM_ISP_PACKET_META_DMI_COMMON)
+				hw_entry[num_ent].flags = 0x1;
+
+			num_ent++;
+			break;
+		case CAM_ISP_TFE_PACKET_META_DUAL_CONFIG:
+
+			rc = cam_tfe_update_dual_config(&cmd_desc[i], split_id,
+				base_idx, res_list_isp_out, size_isp_out);
+
+			if (rc)
+				return rc;
+			break;
+		case CAM_ISP_TFE_PACKET_META_GENERIC_BLOB_COMMON: {
+			struct cam_isp_generic_blob_info   blob_info;
+
+			prepare->num_hw_update_entries = num_ent;
+			blob_info.prepare = prepare;
+			blob_info.base_info = base_info;
+			blob_info.kmd_buf_info = kmd_buf_info;
+
+			rc = cam_packet_util_process_generic_cmd_buffer(
+				&cmd_desc[i],
+				blob_handler_cb,
+				&blob_info);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in processing blobs %d", rc);
+				return rc;
+			}
+			hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+			num_ent = prepare->num_hw_update_entries;
+		}
+			break;
+		case CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_FLUSH:
+		case CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR:
+		case CAM_ISP_TFE_PACKET_META_REG_DUMP_PER_REQUEST:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				if (prepare->num_reg_dump_buf >=
+					CAM_REG_DUMP_MAX_BUF_ENTRIES) {
+					CAM_ERR(CAM_ISP,
+					"Descriptor count out of bounds: %d",
+					prepare->num_reg_dump_buf);
+					return -EINVAL;
+				}
+				prepare->reg_dump_buf_desc[
+					prepare->num_reg_dump_buf] =
+					cmd_desc[i];
+				prepare->num_reg_dump_buf++;
+				CAM_DBG(CAM_ISP,
+					"Added command buffer: %d desc_count: %d",
+					cmd_desc[i].meta_data,
+					prepare->num_reg_dump_buf);
+			}
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "invalid cdm command meta data %d",
+				cmd_meta_data);
+			return -EINVAL;
+		}
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int rc = 0;
+	struct cam_hw_prepare_update_args       *prepare =
+		(struct cam_hw_prepare_update_args *) prepare_hw_update_args;
+	struct cam_tfe_hw_mgr_ctx               *ctx;
+	struct cam_tfe_hw_mgr                   *hw_mgr;
+	struct cam_kmd_buf_info                  kmd_buf;
+	uint32_t                                 i;
+	bool                                     fill_fence = true;
+	struct cam_isp_prepare_hw_update_data   *prepare_hw_data;
+	struct cam_isp_frame_header_info         frame_header_info;
+	struct cam_isp_change_base_args          change_base_info = {0};
+
+	if (!hw_mgr_priv || !prepare_hw_update_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_REQ, "Enter for req_id %lld",
+		prepare->packet->header.request_id);
+
+	prepare_hw_data = (struct cam_isp_prepare_hw_update_data  *)
+		prepare->priv;
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *) prepare->ctxt_to_hw_map;
+	hw_mgr = (struct cam_tfe_hw_mgr *)hw_mgr_priv;
+
+	rc = cam_packet_util_validate_packet(prepare->packet,
+		prepare->remain_len);
+	if (rc)
+		return rc;
+
+	/* Pre parse the packet*/
+	rc = cam_packet_util_get_kmd_buffer(prepare->packet, &kmd_buf);
+	if (rc)
+		return rc;
+
+	rc = cam_packet_util_process_patches(prepare->packet,
+		hw_mgr->mgr_common.cmd_iommu_hdl,
+		hw_mgr->mgr_common.cmd_iommu_hdl_secure);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Patch ISP packet failed.");
+		return rc;
+	}
+
+	prepare->num_hw_update_entries = 0;
+	prepare->num_in_map_entries = 0;
+	prepare->num_out_map_entries = 0;
+	prepare->num_reg_dump_buf = 0;
+
+	memset(&prepare_hw_data->bw_config[0], 0x0,
+		sizeof(prepare_hw_data->bw_config[0]) *
+		CAM_TFE_HW_NUM_MAX);
+	memset(&prepare_hw_data->bw_config_valid[0], 0x0,
+		sizeof(prepare_hw_data->bw_config_valid[0]) *
+		CAM_TFE_HW_NUM_MAX);
+
+	for (i = 0; i < ctx->num_base; i++) {
+		CAM_DBG(CAM_ISP, "process cmd buffer for device %d", i);
+
+		CAM_DBG(CAM_ISP,
+			"change base i=%d, idx=%d",
+			i, ctx->base[i].idx);
+
+		change_base_info.base_idx = ctx->base[i].idx;
+		change_base_info.cdm_id = CAM_CDM_MAX;
+
+		/* Add change base */
+		rc = cam_isp_add_change_base(prepare, &ctx->res_list_tfe_in,
+			&change_base_info, &kmd_buf);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in change base i=%d, idx=%d, rc=%d",
+				i, ctx->base[i].idx, rc);
+			goto end;
+		}
+
+
+		/* get command buffers */
+		if (ctx->base[i].split_id != CAM_ISP_HW_SPLIT_MAX) {
+			rc = cam_tfe_add_command_buffers(prepare, &kmd_buf,
+				&ctx->base[i],
+				cam_isp_tfe_packet_generic_blob_handler,
+				ctx->res_list_tfe_out, CAM_TFE_HW_OUT_RES_MAX);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in add cmdbuf, i=%d, split_id=%d, rc=%d",
+					i, ctx->base[i].split_id, rc);
+				goto end;
+			}
+		}
+
+		memset(&frame_header_info, 0,
+			sizeof(struct cam_isp_frame_header_info));
+		frame_header_info.frame_header_enable = false;
+
+		/* get IO buffers */
+		rc = cam_isp_add_io_buffers(hw_mgr->mgr_common.img_iommu_hdl,
+			hw_mgr->mgr_common.img_iommu_hdl_secure,
+			prepare, ctx->base[i].idx,
+			&kmd_buf, ctx->res_list_tfe_out,
+			NULL,
+			CAM_TFE_HW_OUT_RES_MAX, fill_fence,
+			&frame_header_info);
+
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in io buffers, i=%d, rc=%d",
+				i, rc);
+			goto end;
+		}
+
+		/* fence map table entries need to fill only once in the loop */
+		if (fill_fence)
+			fill_fence = false;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"num_reg_dump_buf=%d ope code:%d",
+		prepare->num_reg_dump_buf, prepare->packet->header.op_code);
+
+	/* reg update will be done later for the initial configure */
+	if (((prepare->packet->header.op_code) & 0xF) ==
+		CAM_ISP_PACKET_INIT_DEV) {
+		prepare_hw_data->packet_opcode_type =
+			CAM_ISP_TFE_PACKET_INIT_DEV;
+
+		if ((!prepare->num_reg_dump_buf) || (prepare->num_reg_dump_buf >
+			CAM_REG_DUMP_MAX_BUF_ENTRIES))
+			goto end;
+
+		if (!ctx->num_reg_dump_buf) {
+			ctx->num_reg_dump_buf =
+				prepare->num_reg_dump_buf;
+			memcpy(ctx->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare->num_reg_dump_buf);
+		} else {
+			prepare_hw_data->num_reg_dump_buf =
+				prepare->num_reg_dump_buf;
+			memcpy(prepare_hw_data->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare_hw_data->num_reg_dump_buf);
+		}
+
+		goto end;
+	} else  {
+		prepare_hw_data->packet_opcode_type =
+		CAM_ISP_TFE_PACKET_CONFIG_DEV;
+		prepare_hw_data->num_reg_dump_buf = prepare->num_reg_dump_buf;
+		if ((prepare_hw_data->num_reg_dump_buf) &&
+			(prepare_hw_data->num_reg_dump_buf <
+			CAM_REG_DUMP_MAX_BUF_ENTRIES)) {
+			memcpy(prepare_hw_data->reg_dump_buf_desc,
+				prepare->reg_dump_buf_desc,
+				sizeof(struct cam_cmd_buf_desc) *
+				prepare_hw_data->num_reg_dump_buf);
+		}
+	}
+
+	/* add reg update commands */
+	for (i = 0; i < ctx->num_base; i++) {
+		change_base_info.base_idx = ctx->base[i].idx;
+		change_base_info.cdm_id = CAM_CDM_MAX;
+		/* Add change base */
+		rc = cam_isp_add_change_base(prepare, &ctx->res_list_tfe_in,
+			&change_base_info, &kmd_buf);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in change base adding reg_update cmd i=%d, idx=%d, rc=%d",
+				i, ctx->base[i].idx, rc);
+			goto end;
+		}
+
+		/*Add reg update */
+		rc = cam_isp_add_reg_update(prepare, &ctx->res_list_tfe_in,
+			ctx->base[i].idx, &kmd_buf);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Add Reg_update cmd Failed i=%d, idx=%d, rc=%d",
+				i, ctx->base[i].idx, rc);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_tfe_mgr_resume_hw(struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	return cam_tfe_mgr_bw_control(ctx, CAM_TFE_BW_CONTROL_INCLUDE);
+}
+
+static int cam_tfe_mgr_sof_irq_debug(
+	struct cam_tfe_hw_mgr_ctx *ctx,
+	uint32_t sof_irq_enable)
+{
+	int rc = 0;
+	uint32_t i = 0;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res = NULL;
+	struct cam_hw_intf            *hw_intf = NULL;
+	struct cam_isp_resource_node  *rsrc_node = NULL;
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc |= hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_TFE_CSID_SOF_IRQ_DEBUG,
+					&sof_irq_enable,
+					sizeof(sof_irq_enable));
+			}
+		}
+	}
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			rsrc_node = hw_mgr_res->hw_res[i];
+			if (rsrc_node->process_cmd && (rsrc_node->res_id ==
+				CAM_ISP_HW_TFE_IN_CAMIF)) {
+				rc |= hw_mgr_res->hw_res[i]->process_cmd(
+					hw_mgr_res->hw_res[i],
+					CAM_ISP_HW_CMD_SOF_IRQ_DEBUG,
+					&sof_irq_enable,
+					sizeof(sof_irq_enable));
+			}
+		}
+	}
+
+	return rc;
+}
+
+static void cam_tfe_mgr_print_io_bufs(struct cam_tfe_hw_mgr  *hw_mgr,
+		uint32_t res_id, struct cam_packet *packet,
+		bool    *ctx_found, struct cam_tfe_hw_mgr_ctx *ctx)
+{
+
+	struct cam_buf_io_cfg  *io_cfg = NULL;
+	int32_t      mmu_hdl, iommu_hdl, sec_mmu_hdl;
+	dma_addr_t   iova_addr;
+	size_t        src_buf_size;
+	int  i, j, rc = 0;
+
+	iommu_hdl = hw_mgr->mgr_common.img_iommu_hdl;
+	sec_mmu_hdl = hw_mgr->mgr_common.img_iommu_hdl_secure;
+
+	io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload +
+		packet->io_configs_offset / 4);
+
+	for (i = 0; i < packet->num_io_configs; i++) {
+		if (io_cfg[i].resource_type != res_id)
+			continue;
+		else
+			break;
+	}
+
+	if (i == packet->num_io_configs) {
+		CAM_ERR(CAM_ISP,
+			"getting io port for mid resource id failed ctx id:%d req id:%lld res id:0x%x",
+			ctx->ctx_index, packet->header.request_id,
+			res_id);
+		return;
+	}
+
+	for (j = 0; j < CAM_PACKET_MAX_PLANES; j++) {
+		if (!io_cfg[i].mem_handle[j])
+			break;
+
+		CAM_INFO(CAM_ISP, "port: 0x%x f: %u format: %d dir %d",
+			io_cfg[i].resource_type,
+			io_cfg[i].fence,
+			io_cfg[i].format,
+			io_cfg[i].direction);
+
+		mmu_hdl = cam_mem_is_secure_buf(
+			io_cfg[i].mem_handle[j]) ? sec_mmu_hdl :
+			iommu_hdl;
+		rc = cam_mem_get_io_buf(io_cfg[i].mem_handle[j],
+			mmu_hdl, &iova_addr, &src_buf_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"get src buf address fail mem_handle 0x%x",
+				io_cfg[i].mem_handle[j]);
+			continue;
+		}
+		if ((iova_addr & 0xFFFFFFFF) != iova_addr) {
+			CAM_ERR(CAM_ISP, "Invalid mapped address");
+			rc = -EINVAL;
+			continue;
+		}
+
+		CAM_INFO(CAM_ISP,
+			"pln %d w %d h %d s %u size 0x%x addr 0x%x end_addr 0x%x offset %x memh %x",
+			j, io_cfg[i].planes[j].width,
+			io_cfg[i].planes[j].height,
+			io_cfg[i].planes[j].plane_stride,
+			(unsigned int)src_buf_size,
+			(unsigned int)iova_addr,
+			(unsigned int)iova_addr +
+			(unsigned int)src_buf_size,
+			io_cfg[i].offsets[j],
+			io_cfg[i].mem_handle[j]);
+	}
+}
+
+static void cam_tfe_mgr_pf_dump(uint32_t res_id,
+	struct cam_tfe_hw_mgr_ctx *ctx)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_hw_intf               *hw_intf;
+	struct cam_isp_hw_get_cmd_update  cmd_update;
+	uint32_t                          res_id_out;
+	int  i, rc = 0;
+
+	/* dump the registers  */
+	rc = cam_tfe_mgr_handle_reg_dump(ctx, ctx->reg_dump_buf_desc,
+		ctx->num_reg_dump_buf,
+		CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR, NULL, false);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Reg dump on pf failed req id: %llu rc: %d",
+			ctx->applied_req_id, rc);
+	}
+
+	/* dump the acquire data */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf && hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_TFE_CSID_LOG_ACQUIRE_DATA,
+					hw_mgr_res->hw_res[i],
+					sizeof(void *));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"acquire dump data failed");
+			} else
+				CAM_ERR(CAM_ISP, "NULL hw_intf!");
+		}
+	}
+
+	res_id_out = res_id & 0xFF;
+
+	if (res_id_out >= CAM_TFE_HW_OUT_RES_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid out resource id :%x",
+			res_id);
+		return;
+	}
+
+	hw_mgr_res =
+		&ctx->res_list_tfe_out[res_id_out];
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+
+		cmd_update.cmd_type = CAM_ISP_HW_CMD_DUMP_BUS_INFO;
+		cmd_update.res = hw_mgr_res->hw_res[i];
+		hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.process_cmd) {
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+				(void *)&cmd_update,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+		}
+	}
+}
+
+static void cam_tfe_mgr_dump_pf_data(
+	struct cam_tfe_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args *hw_cmd_args)
+{
+	struct cam_tfe_hw_mgr_ctx           *ctx;
+	struct cam_isp_hw_mgr_res           *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update     cmd_update;
+	struct cam_isp_hw_get_res_for_mid    get_res;
+	struct cam_packet                   *packet;
+	uint32_t  *resource_type;
+	uint32_t   hw_id;
+	bool      *ctx_found, hw_id_found = false;
+	int        i, j, rc = 0;
+
+	ctx = (struct cam_tfe_hw_mgr_ctx *)hw_cmd_args->ctxt_to_hw_map;
+
+	packet  = hw_cmd_args->u.pf_args.pf_data.packet;
+	ctx_found = hw_cmd_args->u.pf_args.ctx_found;
+	resource_type = hw_cmd_args->u.pf_args.resource_type;
+
+	if ((*ctx_found) && (*resource_type))
+		goto outportlog;
+
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (!g_tfe_hw_mgr.tfe_devices[i])
+			continue;
+
+		for (j = 0; j < g_tfe_hw_mgr.tfe_devices[i]->num_hw_pid; j++) {
+			if (g_tfe_hw_mgr.tfe_devices[i]->hw_pid[j] ==
+				hw_cmd_args->u.pf_args.pid) {
+				hw_id_found = true;
+				hw_id = i;
+				break;
+			}
+		}
+		if (hw_id_found)
+			break;
+	}
+
+	if (i == CAM_TFE_HW_NUM_MAX) {
+		CAM_INFO(CAM_ISP,
+			"PID:%d  is not matching with any TFE HW PIDs ctx id:%d",
+			hw_cmd_args->u.pf_args.pid,  ctx->ctx_index);
+		return;
+	}
+
+	for (i = 0; i < ctx->num_base; i++) {
+		if (ctx->base[i].idx == hw_id) {
+			*ctx_found = true;
+			break;
+		}
+	}
+
+	if (!(*ctx_found)) {
+		CAM_INFO(CAM_ISP,
+			"This context does not cause pf:pid:%d hw id:%d ctx_id:%d",
+			hw_cmd_args->u.pf_args.pid, hw_id, ctx->ctx_index);
+		return;
+	}
+
+	for (i = 0; i < CAM_TFE_HW_OUT_RES_MAX; i++) {
+		hw_mgr_res = &ctx->res_list_tfe_out[i];
+		if (!hw_mgr_res->hw_res[0])
+			continue;
+
+		break;
+	}
+
+	if (i >= CAM_TFE_HW_OUT_RES_MAX) {
+		CAM_ERR(CAM_ISP,
+			"NO valid outport resources ctx id:%d req id:%lld",
+			ctx->ctx_index, packet->header.request_id);
+		return;
+	}
+
+	get_res.mid = hw_cmd_args->u.pf_args.mid;
+	cmd_update.res = hw_mgr_res->hw_res[0];
+	cmd_update.cmd_type = CAM_ISP_HW_CMD_GET_RES_FOR_MID;
+	cmd_update.data = (void *) &get_res;
+
+	/* get resource id for given mid */
+	rc = hw_mgr_res->hw_res[0]->hw_intf->hw_ops.process_cmd(
+		hw_mgr_res->hw_res[0]->hw_intf->hw_priv,
+		cmd_update.cmd_type, &cmd_update,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"getting mid port resource id failed ctx id:%d req id:%lld",
+			ctx->ctx_index, packet->header.request_id);
+		return;
+	}
+	CAM_ERR(CAM_ISP,
+		"Page fault on resource id:0x%x ctx id:%d req id:%lld",
+		get_res.out_res_id, ctx->ctx_index, packet->header.request_id);
+	*resource_type = get_res.out_res_id;
+
+	cam_tfe_mgr_pf_dump(get_res.out_res_id, ctx);
+
+outportlog:
+	cam_tfe_mgr_print_io_bufs(hw_mgr, *resource_type, packet,
+		ctx_found, ctx);
+
+}
+
+static int cam_tfe_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_tfe_hw_mgr  *hw_mgr = hw_mgr_priv;
+	struct cam_tfe_hw_mgr_ctx *ctx = (struct cam_tfe_hw_mgr_ctx *)
+		hw_cmd_args->ctxt_to_hw_map;
+	struct cam_isp_hw_cmd_args *isp_hw_cmd_args = NULL;
+	struct cam_packet          *packet;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (!ctx || !ctx->ctx_in_use) {
+		CAM_ERR(CAM_ISP, "Fatal: Invalid context is used");
+		return -EPERM;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_INTERNAL:
+		if (!hw_cmd_args->u.internal_args) {
+			CAM_ERR(CAM_ISP, "Invalid cmd arguments");
+			return -EINVAL;
+		}
+
+		isp_hw_cmd_args = (struct cam_isp_hw_cmd_args *)
+			hw_cmd_args->u.internal_args;
+
+		switch (isp_hw_cmd_args->cmd_type) {
+		case CAM_ISP_HW_MGR_CMD_PAUSE_HW:
+			cam_tfe_mgr_pause_hw(ctx);
+			break;
+		case CAM_ISP_HW_MGR_CMD_RESUME_HW:
+			cam_tfe_mgr_resume_hw(ctx);
+			break;
+		case CAM_ISP_HW_MGR_CMD_SOF_DEBUG:
+			cam_tfe_mgr_sof_irq_debug(ctx,
+				isp_hw_cmd_args->u.sof_irq_enable);
+			break;
+		case CAM_ISP_HW_MGR_CMD_CTX_TYPE:
+			if (ctx->is_rdi_only_context)
+				isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_RDI;
+			else
+				isp_hw_cmd_args->u.ctx_type = CAM_ISP_CTX_PIX;
+			break;
+		case CAM_ISP_HW_MGR_GET_PACKET_OPCODE:
+			packet = (struct cam_packet *)
+				isp_hw_cmd_args->cmd_data;
+			if ((packet->header.op_code & 0xF) ==
+				CAM_ISP_TFE_PACKET_INIT_DEV)
+				isp_hw_cmd_args->u.packet_op_code =
+				CAM_ISP_TFE_PACKET_INIT_DEV;
+			else
+				isp_hw_cmd_args->u.packet_op_code =
+				CAM_ISP_TFE_PACKET_CONFIG_DEV;
+			break;
+		case CAM_ISP_HW_MGR_GET_LAST_CDM_DONE:
+			isp_hw_cmd_args->u.last_cdm_done =
+				ctx->last_cdm_done_req;
+			break;
+		case CAM_ISP_HW_MGR_CMD_UPDATE_CLOCK:
+			rc = cam_tfe_cshiphy_callback(ctx, isp_hw_cmd_args->cmd_data);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid HW mgr command:0x%x",
+				hw_cmd_args->cmd_type);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_tfe_mgr_dump_pf_data(hw_mgr, hw_cmd_args);
+		break;
+	case CAM_HW_MGR_CMD_REG_DUMP_ON_FLUSH:
+		if (ctx->last_dump_flush_req_id == ctx->applied_req_id)
+			return 0;
+
+		ctx->last_dump_flush_req_id = ctx->applied_req_id;
+
+		rc = cam_tfe_mgr_handle_reg_dump(ctx, ctx->reg_dump_buf_desc,
+			ctx->num_reg_dump_buf,
+			CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_FLUSH,
+			NULL, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Reg dump on flush failed req id: %llu num_reg_dump:0x%x rc: %d",
+				ctx->applied_req_id, ctx->num_reg_dump_buf, rc);
+			return rc;
+		}
+
+		break;
+	case CAM_HW_MGR_CMD_REG_DUMP_ON_ERROR:
+		if (ctx->last_dump_err_req_id == ctx->applied_req_id)
+			return 0;
+
+		ctx->last_dump_err_req_id = ctx->applied_req_id;
+		rc = cam_tfe_mgr_handle_reg_dump(ctx, ctx->reg_dump_buf_desc,
+			ctx->num_reg_dump_buf,
+			CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR,
+			NULL, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Reg dump on error failed req id:%llu num_reg_dump:0x%x rc: %d",
+				ctx->applied_req_id, ctx->num_reg_dump_buf, rc);
+			return rc;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid cmd");
+	}
+
+	return rc;
+}
+
+static int cam_tfe_mgr_cmd_get_sof_timestamp(
+	struct cam_tfe_hw_mgr_ctx            *tfe_ctx,
+	uint64_t                             *time_stamp,
+	uint64_t                             *boot_time_stamp)
+{
+	int                                        rc = -EINVAL;
+	uint32_t                                   i;
+	struct cam_isp_hw_mgr_res                 *hw_mgr_res;
+	struct cam_hw_intf                        *hw_intf;
+	struct cam_tfe_csid_get_time_stamp_args    csid_get_time;
+
+	hw_mgr_res = list_first_entry(&tfe_ctx->res_list_tfe_csid,
+		struct cam_isp_hw_mgr_res, list);
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+
+		/*
+		 * Get the SOF time stamp from left resource only.
+		 * Left resource is master for dual tfe case and
+		 * Rdi only context case left resource only hold
+		 * the RDI resource
+		 */
+
+		hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+		if (hw_intf->hw_ops.process_cmd) {
+			/*
+			 * Single TFE case, Get the time stamp from
+			 * available one csid hw in the context
+			 * Dual TFE case, get the time stamp from
+			 * master(left) would be sufficient
+			 */
+
+			csid_get_time.node_res =
+				hw_mgr_res->hw_res[i];
+			rc = hw_intf->hw_ops.process_cmd(
+				hw_intf->hw_priv,
+				CAM_TFE_CSID_CMD_GET_TIME_STAMP,
+				&csid_get_time,
+				sizeof(struct
+				cam_tfe_csid_get_time_stamp_args));
+			if (!rc && (i == CAM_ISP_HW_SPLIT_LEFT)) {
+				*time_stamp =
+					csid_get_time.time_stamp_val;
+				*boot_time_stamp =
+					csid_get_time.boot_timestamp;
+				break;
+			}
+		}
+	}
+
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Getting sof time stamp failed");
+
+	return rc;
+}
+
+static void cam_tfe_mgr_ctx_reg_dump(struct cam_tfe_hw_mgr_ctx  *ctx)
+{
+	struct cam_isp_hw_mgr_res        *hw_mgr_res;
+	struct cam_hw_intf               *hw_intf;
+	struct cam_isp_hw_get_cmd_update  cmd_update;
+	int i = 0;
+
+
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_in,
+		list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			switch (hw_mgr_res->hw_res[i]->res_id) {
+			case CAM_ISP_HW_TFE_IN_CAMIF:
+				hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+				cmd_update.res = hw_mgr_res->hw_res[i];
+				cmd_update.cmd_type =
+					CAM_ISP_HW_CMD_GET_REG_DUMP;
+				hw_intf->hw_ops.process_cmd(hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_GET_REG_DUMP,
+					&cmd_update, sizeof(cmd_update));
+				break;
+			default:
+				break;
+			}
+		}
+	}
+
+	/* Dump the TFE CSID registers */
+	list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid,
+		list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_TFE_CSID_CMD_GET_REG_DUMP,
+					hw_mgr_res->hw_res[i],
+					sizeof(struct cam_isp_resource_node));
+			}
+		}
+	}
+}
+
+static int cam_tfe_mgr_process_recovery_cb(void *priv, void *data)
+{
+	int32_t rc = 0;
+	struct cam_tfe_hw_event_recovery_data   *recovery_data = data;
+	struct cam_hw_start_args             start_args;
+	struct cam_hw_stop_args              stop_args;
+	struct cam_tfe_hw_mgr               *tfe_hw_mgr = priv;
+	struct cam_isp_hw_mgr_res           *hw_mgr_res;
+	struct cam_tfe_hw_mgr_ctx           *tfe_hw_mgr_ctx;
+	uint32_t                             i = 0;
+
+	uint32_t error_type = recovery_data->error_type;
+	struct cam_tfe_hw_mgr_ctx        *ctx = NULL;
+
+	/* Here recovery is performed */
+	CAM_DBG(CAM_ISP, "ErrorType = %d", error_type);
+
+	switch (error_type) {
+	case CAM_ISP_HW_ERROR_OVERFLOW:
+	case CAM_ISP_HW_ERROR_BUSIF_OVERFLOW:
+		if (!recovery_data->affected_ctx[0]) {
+			CAM_ERR(CAM_ISP,
+				"No context is affected but recovery called");
+			kfree(recovery_data);
+			return 0;
+		}
+
+		/* stop resources here */
+		CAM_DBG(CAM_ISP, "STOP: Number of affected context: %d",
+			recovery_data->no_of_context);
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			stop_args.ctxt_to_hw_map =
+				recovery_data->affected_ctx[i];
+			tfe_hw_mgr_ctx = recovery_data->affected_ctx[i];
+
+			if (g_tfe_hw_mgr.debug_cfg.enable_reg_dump)
+				cam_tfe_mgr_ctx_reg_dump(tfe_hw_mgr_ctx);
+
+			if (g_tfe_hw_mgr.debug_cfg.enable_recovery) {
+				rc = cam_tfe_mgr_stop_hw_in_overflow(
+					&stop_args);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"CTX stop failed(%d)", rc);
+					return rc;
+				}
+			}
+		}
+
+		if (!g_tfe_hw_mgr.debug_cfg.enable_recovery) {
+			CAM_INFO(CAM_ISP, "reg dumping is done ");
+			return 0;
+		}
+
+		CAM_DBG(CAM_ISP, "RESET: CSID PATH");
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			ctx = recovery_data->affected_ctx[i];
+			list_for_each_entry(hw_mgr_res, &ctx->res_list_tfe_csid,
+				list) {
+				rc = cam_tfe_hw_mgr_reset_csid_res(hw_mgr_res);
+				if (rc) {
+					CAM_ERR(CAM_ISP, "Failed RESET (%d)",
+						hw_mgr_res->res_id);
+					return rc;
+				}
+			}
+		}
+
+		CAM_DBG(CAM_ISP, "RESET: Calling TFE reset");
+
+		for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+			if (recovery_data->affected_core[i])
+				cam_tfe_mgr_reset_tfe_hw(tfe_hw_mgr, i);
+		}
+
+		CAM_DBG(CAM_ISP, "START: Number of affected context: %d",
+			recovery_data->no_of_context);
+
+		for (i = 0; i < recovery_data->no_of_context; i++) {
+			ctx =  recovery_data->affected_ctx[i];
+			start_args.ctxt_to_hw_map = ctx;
+
+			atomic_set(&ctx->overflow_pending, 0);
+
+			rc = cam_tfe_mgr_restart_hw(&start_args);
+			if (rc) {
+				CAM_ERR(CAM_ISP, "CTX start failed(%d)", rc);
+				return rc;
+			}
+			CAM_DBG(CAM_ISP, "Started resources rc (%d)", rc);
+		}
+		CAM_DBG(CAM_ISP, "Recovery Done rc (%d)", rc);
+
+		break;
+
+	case CAM_ISP_HW_ERROR_P2I_ERROR:
+		break;
+
+	case CAM_ISP_HW_ERROR_VIOLATION:
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Invalid Error");
+	}
+	CAM_DBG(CAM_ISP, "Exit: ErrorType = %d", error_type);
+
+	kfree(recovery_data);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_do_error_recovery(
+	struct cam_tfe_hw_event_recovery_data  *tfe_mgr_recovery_data)
+{
+	int32_t                             rc = 0;
+	struct crm_workq_task              *task = NULL;
+	struct cam_tfe_hw_event_recovery_data  *recovery_data = NULL;
+
+	recovery_data = kmemdup(tfe_mgr_recovery_data,
+		sizeof(struct cam_tfe_hw_event_recovery_data), GFP_ATOMIC);
+
+	if (!recovery_data)
+		return -ENOMEM;
+
+	CAM_DBG(CAM_ISP, "Enter: error_type (%d)", recovery_data->error_type);
+
+	task = cam_req_mgr_workq_get_task(g_tfe_hw_mgr.workq);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No empty task frame");
+		kfree(recovery_data);
+		return -ENOMEM;
+	}
+
+	task->process_cb = &cam_tfe_mgr_process_recovery_cb;
+	task->payload = recovery_data;
+	rc = cam_req_mgr_workq_enqueue_task(task,
+		recovery_data->affected_ctx[0]->hw_mgr,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+/*
+ * This function checks if any of the valid entry in affected_core[]
+ * is associated with this context. if YES
+ *  a. It fills the other cores associated with this context.in
+ *      affected_core[]
+ *  b. Return true
+ */
+static bool cam_tfe_hw_mgr_is_ctx_affected(
+	struct cam_tfe_hw_mgr_ctx   *tfe_hwr_mgr_ctx,
+	uint32_t                    *affected_core,
+	uint32_t                     size)
+{
+
+	bool                  rc = false;
+	uint32_t              i = 0, j = 0;
+	uint32_t              max_idx =  tfe_hwr_mgr_ctx->num_base;
+	uint32_t              ctx_affected_core_idx[CAM_TFE_HW_NUM_MAX] = {0};
+
+	CAM_DBG(CAM_ISP, "Enter:max_idx = %d", max_idx);
+
+	if ((max_idx >= CAM_TFE_HW_NUM_MAX) || (size > CAM_TFE_HW_NUM_MAX)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "invalid parameter = %d", max_idx);
+		return rc;
+	}
+
+	for (i = 0; i < max_idx; i++) {
+		if (affected_core[tfe_hwr_mgr_ctx->base[i].idx])
+			rc = true;
+		else {
+			ctx_affected_core_idx[j] = tfe_hwr_mgr_ctx->base[i].idx;
+			j = j + 1;
+		}
+	}
+
+	if (rc) {
+		while (j) {
+			if (affected_core[ctx_affected_core_idx[j-1]] != 1)
+				affected_core[ctx_affected_core_idx[j-1]] = 1;
+			j = j - 1;
+		}
+	}
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+/*
+ * For any dual TFE context, if non-affected TFE is also serving
+ * another context, then that context should also be notified with fatal error
+ * So Loop through each context and -
+ *   a. match core_idx
+ *   b. Notify CTX with fatal error
+ */
+static int  cam_tfe_hw_mgr_find_affected_ctx(
+	struct cam_isp_hw_error_event_data    *error_event_data,
+	uint32_t                               curr_core_idx,
+	struct cam_tfe_hw_event_recovery_data     *recovery_data)
+{
+	uint32_t affected_core[CAM_TFE_HW_NUM_MAX] = {0};
+	struct cam_tfe_hw_mgr_ctx   *tfe_hwr_mgr_ctx = NULL;
+	cam_hw_event_cb_func         notify_err_cb;
+	struct cam_tfe_hw_mgr       *tfe_hwr_mgr = NULL;
+	uint32_t i = 0;
+
+	if (!recovery_data) {
+		CAM_ERR(CAM_ISP, "recovery_data parameter is NULL");
+		return -EINVAL;
+	}
+
+	recovery_data->no_of_context = 0;
+	affected_core[curr_core_idx] = 1;
+	tfe_hwr_mgr = &g_tfe_hw_mgr;
+
+	list_for_each_entry(tfe_hwr_mgr_ctx,
+		&tfe_hwr_mgr->used_ctx_list, list) {
+		/*
+		 * Check if current core_idx matches the HW associated
+		 * with this context
+		 */
+		if (!cam_tfe_hw_mgr_is_ctx_affected(tfe_hwr_mgr_ctx,
+			affected_core, CAM_TFE_HW_NUM_MAX))
+			continue;
+
+		if (atomic_read(&tfe_hwr_mgr_ctx->overflow_pending)) {
+			CAM_INFO(CAM_ISP, "CTX:%d already error reported",
+				tfe_hwr_mgr_ctx->ctx_index);
+			continue;
+		}
+
+		atomic_set(&tfe_hwr_mgr_ctx->overflow_pending, 1);
+		notify_err_cb = tfe_hwr_mgr_ctx->common.event_cb;
+
+		/* Add affected_context in list of recovery data */
+		CAM_DBG(CAM_ISP, "Add affected ctx %d to list",
+			tfe_hwr_mgr_ctx->ctx_index);
+		if (recovery_data->no_of_context < CAM_TFE_CTX_MAX)
+			recovery_data->affected_ctx[
+				recovery_data->no_of_context++] =
+				tfe_hwr_mgr_ctx;
+
+		/*
+		 * In the call back function corresponding ISP context
+		 * will update CRM about fatal Error
+		 */
+		if (notify_err_cb) {
+			notify_err_cb(tfe_hwr_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_ERROR, (void *)error_event_data);
+		} else {
+			CAM_WARN(CAM_ISP, "Error call back is not set");
+			goto end;
+		}
+	}
+
+	/* fill the affected_core in recovery data */
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		recovery_data->affected_core[i] = affected_core[i];
+		CAM_DBG(CAM_ISP, "tfe core %d is affected (%d)",
+			 i, recovery_data->affected_core[i]);
+	}
+end:
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_dump_info(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_tfe_hw_mgr_ctx     *tfe_hw_mgr_ctx =
+		(struct cam_tfe_hw_mgr_ctx *)ctx;
+	struct cam_isp_hw_event_info  *event_info =
+		(struct cam_isp_hw_event_info *)evt_info;
+	struct cam_isp_hw_mgr_res     *hw_mgr_res = NULL;
+	struct cam_hw_intf            *hw_intf;
+	uint32_t i, out_port_id;
+	uint64_t dummy_args;
+	int rc = 0;
+
+	list_for_each_entry(hw_mgr_res,
+		&tfe_hw_mgr_ctx->res_list_tfe_csid, list) {
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_CSID_CLOCK_DUMP,
+					&dummy_args,
+					sizeof(uint64_t));
+				if (rc)
+					CAM_ERR(CAM_ISP,
+						"CSID Clock Dump failed");
+			}
+		}
+	}
+
+	if (event_info->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		out_port_id = event_info->res_id & 0xFF;
+		if (out_port_id >= CAM_TFE_HW_OUT_RES_MAX) {
+			CAM_ERR(CAM_ISP,
+				"Resource out of range");
+			goto end;
+		}
+		hw_mgr_res =
+			&tfe_hw_mgr_ctx->res_list_tfe_out[out_port_id];
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+			hw_intf = hw_mgr_res->hw_res[i]->hw_intf;
+			if (hw_intf->hw_ops.process_cmd) {
+				rc = hw_intf->hw_ops.process_cmd(
+					hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+					(void *)event_info,
+					sizeof(struct cam_isp_hw_event_info));
+			}
+		}
+	}
+end:
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_handle_csid_event(
+	struct cam_isp_hw_event_info *event_info)
+{
+	struct cam_isp_hw_error_event_data  error_event_data = {0};
+	struct cam_tfe_hw_event_recovery_data     recovery_data = {0};
+
+	/* this can be extended based on the types of error
+	 * received from CSID
+	 */
+	switch (event_info->err_type) {
+	case CAM_ISP_HW_ERROR_CSID_FATAL: {
+
+		if (!g_tfe_hw_mgr.debug_cfg.enable_csid_recovery)
+			break;
+
+		error_event_data.error_type = event_info->err_type;
+		cam_tfe_hw_mgr_find_affected_ctx(&error_event_data,
+			event_info->hw_idx,
+			&recovery_data);
+		break;
+	}
+	default:
+		break;
+	}
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_err(
+	void                                *ctx,
+	void                                *evt_info)
+{
+	struct cam_tfe_hw_mgr_ctx               *tfe_hw_mgr_ctx;
+	struct cam_isp_hw_event_info            *event_info = evt_info;
+	struct cam_isp_hw_error_event_data       error_event_data = {0};
+	struct cam_tfe_hw_event_recovery_data    recovery_data = {0};
+	int    rc = -EINVAL;
+	uint32_t core_idx;
+
+	if (event_info->err_type == CAM_TFE_IRQ_STATUS_VIOLATION)
+		error_event_data.error_type = CAM_ISP_HW_ERROR_VIOLATION;
+	else if (event_info->res_type == CAM_ISP_RESOURCE_TFE_IN ||
+		event_info->res_type == CAM_ISP_RESOURCE_PIX_PATH)
+		error_event_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+	else if (event_info->res_type == CAM_ISP_RESOURCE_TFE_OUT)
+		error_event_data.error_type = CAM_ISP_HW_ERROR_BUSIF_OVERFLOW;
+
+	spin_lock(&g_tfe_hw_mgr.ctx_lock);
+	if (event_info->err_type == CAM_ISP_HW_ERROR_CSID_FATAL) {
+		rc = cam_tfe_hw_mgr_handle_csid_event(event_info);
+		spin_unlock(&g_tfe_hw_mgr.ctx_lock);
+		return rc;
+	}
+
+	if (ctx) {
+		tfe_hw_mgr_ctx =
+			(struct cam_tfe_hw_mgr_ctx *)ctx;
+		if (event_info->res_type ==
+			CAM_ISP_RESOURCE_TFE_IN &&
+			!tfe_hw_mgr_ctx->is_rdi_only_context &&
+			event_info->res_id !=
+			CAM_ISP_HW_TFE_IN_CAMIF)
+			cam_tfe_hw_mgr_handle_hw_dump_info(
+				tfe_hw_mgr_ctx, event_info);
+	}
+
+	core_idx = event_info->hw_idx;
+
+	if (g_tfe_hw_mgr.debug_cfg.enable_recovery)
+		error_event_data.recovery_enabled = true;
+	else
+		error_event_data.recovery_enabled = false;
+
+	rc = cam_tfe_hw_mgr_find_affected_ctx(&error_event_data,
+		core_idx, &recovery_data);
+	if (rc || !(recovery_data.no_of_context))
+		goto end;
+
+	if (event_info->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		spin_unlock(&g_tfe_hw_mgr.ctx_lock);
+		return rc;
+	}
+
+	if (g_tfe_hw_mgr.debug_cfg.enable_recovery) {
+		/* Trigger for recovery */
+		if (event_info->err_type == CAM_TFE_IRQ_STATUS_VIOLATION)
+			recovery_data.error_type = CAM_ISP_HW_ERROR_VIOLATION;
+		else
+			recovery_data.error_type = CAM_ISP_HW_ERROR_OVERFLOW;
+		cam_tfe_hw_mgr_do_error_recovery(&recovery_data);
+	} else {
+		CAM_DBG(CAM_ISP, "recovery is not enabled");
+		rc = 0;
+	}
+end:
+	spin_unlock(&g_tfe_hw_mgr.ctx_lock);
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_rup(
+	void                                    *ctx,
+	void                                    *evt_info)
+{
+	struct cam_isp_hw_event_info            *event_info = evt_info;
+	struct cam_tfe_hw_mgr_ctx               *tfe_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                     tfe_hwr_irq_rup_cb;
+	struct cam_isp_hw_reg_update_event_data  rup_event_data;
+
+	tfe_hwr_irq_rup_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		if (tfe_hw_mgr_ctx->is_dual)
+			if (event_info->hw_idx != tfe_hw_mgr_ctx->master_hw_idx)
+				break;
+
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+
+		tfe_hwr_irq_rup_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_REG_UPDATE, &rup_event_data);
+		break;
+
+	case CAM_ISP_HW_TFE_IN_RDI0:
+	case CAM_ISP_HW_TFE_IN_RDI1:
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		if (!tfe_hw_mgr_ctx->is_rdi_only_context)
+			break;
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hwr_irq_rup_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&rup_event_data);
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "RUP done for TFE source %d",
+		event_info->res_id);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_epoch(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_tfe_hw_mgr_ctx            *tfe_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                  tfe_hw_irq_epoch_cb;
+	struct cam_isp_hw_epoch_event_data    epoch_done_event_data;
+
+	tfe_hw_irq_epoch_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hw_irq_epoch_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_EPOCH,
+			(void *)&epoch_done_event_data);
+		break;
+
+	case CAM_ISP_HW_TFE_IN_RDI0:
+	case CAM_ISP_HW_TFE_IN_RDI1:
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "Epoch for TFE source %d", event_info->res_id);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_sof(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_tfe_hw_mgr_ctx            *tfe_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                  tfe_hw_irq_sof_cb;
+	struct cam_isp_hw_sof_event_data      sof_done_event_data;
+
+	tfe_hw_irq_sof_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		cam_tfe_mgr_cmd_get_sof_timestamp(tfe_hw_mgr_ctx,
+			&sof_done_event_data.timestamp,
+			&sof_done_event_data.boot_time);
+
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+
+		tfe_hw_irq_sof_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_SOF, (void *)&sof_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_TFE_IN_RDI0:
+	case CAM_ISP_HW_TFE_IN_RDI1:
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		if (!tfe_hw_mgr_ctx->is_rdi_only_context)
+			break;
+		cam_tfe_mgr_cmd_get_sof_timestamp(tfe_hw_mgr_ctx,
+			&sof_done_event_data.timestamp,
+			&sof_done_event_data.boot_time);
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hw_irq_sof_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_SOF, (void *)&sof_done_event_data);
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "SOF for TFE source %d", event_info->res_id);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_eof(
+	void                                 *ctx,
+	void                                 *evt_info)
+{
+	struct cam_isp_hw_event_info         *event_info = evt_info;
+	struct cam_tfe_hw_mgr_ctx            *tfe_hw_mgr_ctx = ctx;
+	cam_hw_event_cb_func                  tfe_hw_irq_eof_cb;
+	struct cam_isp_hw_eof_event_data      eof_done_event_data;
+
+	tfe_hw_irq_eof_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	switch (event_info->res_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hw_irq_eof_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_EOF, (void *)&eof_done_event_data);
+
+		break;
+
+	case CAM_ISP_HW_TFE_IN_RDI0:
+	case CAM_ISP_HW_TFE_IN_RDI1:
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		if (!tfe_hw_mgr_ctx->is_rdi_only_context)
+			break;
+		if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+			break;
+		tfe_hw_irq_eof_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_EOF, (void *)&eof_done_event_data);
+		break;
+
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid res_id: %d",
+			event_info->res_id);
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "EOF for out_res->res_id: 0x%x",
+		event_info->res_id);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_handle_hw_buf_done(
+	void                                *ctx,
+	void                                *evt_info)
+{
+	cam_hw_event_cb_func                 tfe_hwr_irq_wm_done_cb;
+	struct cam_tfe_hw_mgr_ctx           *tfe_hw_mgr_ctx = ctx;
+	struct cam_isp_hw_done_event_data    buf_done_event_data = {0};
+	struct cam_isp_hw_event_info        *event_info = evt_info;
+
+	tfe_hwr_irq_wm_done_cb = tfe_hw_mgr_ctx->common.event_cb;
+
+	buf_done_event_data.num_handles = 1;
+	buf_done_event_data.resource_handle[0] = event_info->res_id;
+	buf_done_event_data.last_consumed_addr[0] = event_info->reg_val;
+
+	if (atomic_read(&tfe_hw_mgr_ctx->overflow_pending))
+		return 0;
+
+	if (buf_done_event_data.num_handles > 0 && tfe_hwr_irq_wm_done_cb) {
+		CAM_DBG(CAM_ISP, "Notify ISP context");
+		tfe_hwr_irq_wm_done_cb(tfe_hw_mgr_ctx->common.cb_priv,
+			CAM_ISP_HW_EVENT_DONE, (void *)&buf_done_event_data);
+	}
+
+	CAM_DBG(CAM_ISP, "Buf done for out_res->res_id: 0x%x",
+		event_info->res_id);
+
+	return 0;
+}
+
+static int cam_tfe_hw_mgr_event_handler(
+	void                                *priv,
+	uint32_t                             evt_id,
+	void                                *evt_info)
+{
+	int                                  rc = 0;
+
+	if (!evt_info)
+		return -EINVAL;
+
+	if (!priv)
+		if (evt_id != CAM_ISP_HW_EVENT_ERROR)
+			return -EINVAL;
+
+	CAM_DBG(CAM_ISP, "Event ID 0x%x", evt_id);
+
+	switch (evt_id) {
+	case CAM_ISP_HW_EVENT_SOF:
+		rc = cam_tfe_hw_mgr_handle_hw_sof(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		rc = cam_tfe_hw_mgr_handle_hw_rup(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_EPOCH:
+		rc = cam_tfe_hw_mgr_handle_hw_epoch(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_EOF:
+		rc = cam_tfe_hw_mgr_handle_hw_eof(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_DONE:
+		rc = cam_tfe_hw_mgr_handle_hw_buf_done(priv, evt_info);
+		break;
+
+	case CAM_ISP_HW_EVENT_ERROR:
+		rc = cam_tfe_hw_mgr_handle_hw_err(priv, evt_info);
+		break;
+
+	default:
+		CAM_ERR(CAM_ISP, "Invalid event ID %d", evt_id);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_hw_mgr_sort_dev_with_caps(
+	struct cam_tfe_hw_mgr *tfe_hw_mgr)
+{
+	int i;
+
+	/* get caps for csid devices */
+	for (i = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+		if (!tfe_hw_mgr->csid_devices[i])
+			continue;
+		if (tfe_hw_mgr->csid_devices[i]->hw_ops.get_hw_caps) {
+			tfe_hw_mgr->csid_devices[i]->hw_ops.get_hw_caps(
+				tfe_hw_mgr->csid_devices[i]->hw_priv,
+				&tfe_hw_mgr->tfe_csid_dev_caps[i],
+				sizeof(tfe_hw_mgr->tfe_csid_dev_caps[i]));
+		}
+	}
+
+	/* get caps for tfe devices */
+	for (i = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		if (!tfe_hw_mgr->tfe_devices[i])
+			continue;
+
+		if (tfe_hw_mgr->tfe_devices[i]->hw_intf->hw_ops.get_hw_caps) {
+			tfe_hw_mgr->tfe_devices[i]->hw_intf->hw_ops.get_hw_caps(
+				tfe_hw_mgr->tfe_devices[i]->hw_intf->hw_priv,
+				&tfe_hw_mgr->tfe_dev_caps[i],
+				sizeof(tfe_hw_mgr->tfe_dev_caps[i]));
+		}
+	}
+
+	return 0;
+}
+
+static int cam_tfe_set_csid_debug(void *data, u64 val)
+{
+	g_tfe_hw_mgr.debug_cfg.csid_debug = val;
+	CAM_DBG(CAM_ISP, "Set CSID Debug value :%lld", val);
+	return 0;
+}
+
+static int cam_tfe_get_csid_debug(void *data, u64 *val)
+{
+	*val = g_tfe_hw_mgr.debug_cfg.csid_debug;
+	CAM_DBG(CAM_ISP, "Get CSID Debug value :%lld",
+		g_tfe_hw_mgr.debug_cfg.csid_debug);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_tfe_csid_debug,
+	cam_tfe_get_csid_debug,
+	cam_tfe_set_csid_debug, "%16llu");
+
+static int cam_tfe_set_camif_debug(void *data, u64 val)
+{
+	g_tfe_hw_mgr.debug_cfg.camif_debug = val;
+	CAM_DBG(CAM_ISP,
+		"Set camif enable_diag_sensor_status value :%lld", val);
+	return 0;
+}
+
+static int cam_tfe_get_camif_debug(void *data, u64 *val)
+{
+	*val = g_tfe_hw_mgr.debug_cfg.camif_debug;
+	CAM_DBG(CAM_ISP,
+		"Set camif enable_diag_sensor_status value :%lld",
+		g_tfe_hw_mgr.debug_cfg.csid_debug);
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_tfe_camif_debug,
+	cam_tfe_get_camif_debug,
+	cam_tfe_set_camif_debug, "%16llu");
+
+#if IS_ENABLED(CONFIG_DEBUG_FS)
+static int cam_tfe_hw_mgr_debug_register(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	g_tfe_hw_mgr.debug_cfg.set_tpg_pattern = CAM_TOP_TPG_DEFAULT_PATTERN;
+	dbgfileptr = debugfs_create_dir("camera_tfe", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_ISP, "DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	g_tfe_hw_mgr.debug_cfg.dentry = dbgfileptr;
+
+	debugfs_create_file("tfe_csid_debug", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry, NULL, &cam_tfe_csid_debug);
+	debugfs_create_u32("enable_recovery", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.enable_recovery);
+	debugfs_create_u32("enable_reg_dump", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.enable_reg_dump);
+	debugfs_create_u32("enable_csid_recovery", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.enable_csid_recovery);
+	debugfs_create_u32("set_tpg_pattern", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.set_tpg_pattern);
+	debugfs_create_file("tfe_camif_debug", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry, NULL, &cam_tfe_camif_debug);
+	debugfs_create_u32("per_req_reg_dump", 0644,
+		g_tfe_hw_mgr.debug_cfg.dentry,
+		&g_tfe_hw_mgr.debug_cfg.per_req_reg_dump);
+
+end:
+	g_tfe_hw_mgr.debug_cfg.enable_recovery = 0;
+	return rc;
+}
+#else
+static inline int cam_tfe_hw_mgr_debug_register(void)
+{
+	g_tfe_hw_mgr.debug_cfg.enable_recovery = 0;
+	CAM_WARN(CAM_ISP, "DebugFS not enabled in kernel");
+	return 0;
+}
+#endif
+
+static void cam_req_mgr_process_tfe_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+int cam_tfe_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl)
+{
+	int rc = -EFAULT;
+	int i, j;
+	struct cam_iommu_handle cdm_handles;
+	struct cam_tfe_hw_mgr_ctx *ctx_pool;
+	struct cam_isp_hw_mgr_res *res_list_tfe_out;
+	bool support_consumed_addr = false;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	memset(&g_tfe_hw_mgr, 0, sizeof(g_tfe_hw_mgr));
+
+	mutex_init(&g_tfe_hw_mgr.ctx_mutex);
+	spin_lock_init(&g_tfe_hw_mgr.ctx_lock);
+
+	if (CAM_TFE_HW_NUM_MAX != CAM_TFE_CSID_HW_NUM_MAX) {
+		CAM_ERR(CAM_ISP, "CSID num is different then TFE num");
+		return -EINVAL;
+	}
+
+	/* fill tfe hw intf information */
+	for (i = 0, j = 0; i < CAM_TFE_HW_NUM_MAX; i++) {
+		rc = cam_tfe_hw_init(&g_tfe_hw_mgr.tfe_devices[i], i);
+		if (!rc) {
+			struct cam_hw_intf *tfe_device =
+				g_tfe_hw_mgr.tfe_devices[i]->hw_intf;
+			struct cam_hw_info *tfe_hw = (struct cam_hw_info *)
+				g_tfe_hw_mgr.tfe_devices[i]->hw_intf->hw_priv;
+			struct cam_hw_soc_info *soc_info = &tfe_hw->soc_info;
+
+			if (j == 0)
+				tfe_device->hw_ops.process_cmd(
+					tfe_hw,
+					CAM_ISP_HW_CMD_IS_CONSUMED_ADDR_SUPPORT,
+					&support_consumed_addr,
+					sizeof(support_consumed_addr));
+
+			j++;
+
+			g_tfe_hw_mgr.cdm_reg_map[i] = &soc_info->reg_map[0];
+			CAM_DBG(CAM_ISP,
+				"reg_map: mem base = %pK cam_base = 0x%llx",
+				(void __iomem *)soc_info->reg_map[0].mem_base,
+				(uint64_t) soc_info->reg_map[0].mem_cam_base);
+		} else {
+			g_tfe_hw_mgr.cdm_reg_map[i] = NULL;
+		}
+	}
+	if (j == 0) {
+		CAM_ERR(CAM_ISP, "no valid TFE HW");
+		return -EINVAL;
+	}
+
+	g_tfe_hw_mgr.support_consumed_addr = support_consumed_addr;
+	/* fill csid hw intf information */
+	for (i = 0, j = 0; i < CAM_TFE_CSID_HW_NUM_MAX; i++) {
+		rc = cam_tfe_csid_hw_init(&g_tfe_hw_mgr.csid_devices[i], i);
+		if (!rc)
+			j++;
+	}
+	if (!j) {
+		CAM_ERR(CAM_ISP, "no valid TFE CSID HW");
+		return -EINVAL;
+	}
+
+	/* fill tpg hw intf information */
+	for (i = 0, j = 0; i < CAM_TOP_TPG_HW_NUM_MAX; i++) {
+		rc = cam_top_tpg_hw_init(&g_tfe_hw_mgr.tpg_devices[i], i);
+		if (!rc)
+			j++;
+	}
+	if (!j) {
+		CAM_ERR(CAM_ISP, "no valid TFE TPG HW");
+		return -EINVAL;
+	}
+
+	cam_tfe_hw_mgr_sort_dev_with_caps(&g_tfe_hw_mgr);
+
+	/* setup tfe context list */
+	INIT_LIST_HEAD(&g_tfe_hw_mgr.free_ctx_list);
+	INIT_LIST_HEAD(&g_tfe_hw_mgr.used_ctx_list);
+
+	/*
+	 *  for now, we only support one iommu handle. later
+	 *  we will need to setup more iommu handle for other
+	 *  use cases.
+	 *  Also, we have to release them once we have the
+	 *  deinit support
+	 */
+	if (cam_smmu_get_handle("tfe",
+		&g_tfe_hw_mgr.mgr_common.img_iommu_hdl)) {
+		CAM_ERR(CAM_ISP, "Can not get iommu handle");
+		return -EINVAL;
+	}
+
+	if (cam_smmu_get_handle("cam-secure",
+		&g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure)) {
+		CAM_ERR(CAM_ISP, "Failed to get secure iommu handle");
+		goto secure_fail;
+	}
+
+	CAM_DBG(CAM_ISP, "iommu_handles: non-secure[0x%x], secure[0x%x]",
+		g_tfe_hw_mgr.mgr_common.img_iommu_hdl,
+		g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure);
+
+	if (!cam_cdm_get_iommu_handle("tfe0", &cdm_handles)) {
+		CAM_DBG(CAM_ISP, "Successfully acquired the CDM iommu handles");
+		g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl = cdm_handles.non_secure;
+		g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl_secure =
+			cdm_handles.secure;
+	} else {
+		CAM_DBG(CAM_ISP, "Failed to acquire the CDM iommu handles");
+		g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl = -1;
+		g_tfe_hw_mgr.mgr_common.cmd_iommu_hdl_secure = -1;
+	}
+
+	atomic_set(&g_tfe_hw_mgr.active_ctx_cnt, 0);
+	for (i = 0; i < CAM_TFE_CTX_MAX; i++) {
+		memset(&g_tfe_hw_mgr.ctx_pool[i], 0,
+			sizeof(g_tfe_hw_mgr.ctx_pool[i]));
+		INIT_LIST_HEAD(&g_tfe_hw_mgr.ctx_pool[i].list);
+		INIT_LIST_HEAD(&g_tfe_hw_mgr.ctx_pool[i].res_list_tfe_csid);
+		INIT_LIST_HEAD(&g_tfe_hw_mgr.ctx_pool[i].res_list_tfe_in);
+		ctx_pool = &g_tfe_hw_mgr.ctx_pool[i];
+		for (j = 0; j < CAM_TFE_HW_OUT_RES_MAX; j++) {
+			res_list_tfe_out = &ctx_pool->res_list_tfe_out[j];
+			INIT_LIST_HEAD(&res_list_tfe_out->list);
+		}
+
+		/* init context pool */
+		INIT_LIST_HEAD(&g_tfe_hw_mgr.ctx_pool[i].free_res_list);
+		for (j = 0; j < CAM_TFE_HW_RES_POOL_MAX; j++) {
+			INIT_LIST_HEAD(
+				&g_tfe_hw_mgr.ctx_pool[i].res_pool[j].list);
+			list_add_tail(
+				&g_tfe_hw_mgr.ctx_pool[i].res_pool[j].list,
+				&g_tfe_hw_mgr.ctx_pool[i].free_res_list);
+		}
+
+		g_tfe_hw_mgr.ctx_pool[i].cdm_cmd =
+			kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+				((CAM_ISP_CTX_CFG_MAX - 1) *
+				 sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+		if (!g_tfe_hw_mgr.ctx_pool[i].cdm_cmd) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_ISP, "Allocation Failed for cdm command");
+			goto end;
+		}
+
+		g_tfe_hw_mgr.ctx_pool[i].ctx_index = i;
+		g_tfe_hw_mgr.ctx_pool[i].hw_mgr = &g_tfe_hw_mgr;
+
+		cam_tasklet_init(&g_tfe_hw_mgr.mgr_common.tasklet_pool[i],
+			&g_tfe_hw_mgr.ctx_pool[i], i);
+		g_tfe_hw_mgr.ctx_pool[i].common.tasklet_info =
+			g_tfe_hw_mgr.mgr_common.tasklet_pool[i];
+
+
+		init_completion(&g_tfe_hw_mgr.ctx_pool[i].config_done_complete);
+		list_add_tail(&g_tfe_hw_mgr.ctx_pool[i].list,
+			&g_tfe_hw_mgr.free_ctx_list);
+	}
+
+	/* Create Worker for tfe_hw_mgr with 10 tasks */
+	rc = cam_req_mgr_workq_create("cam_tfe_worker", 10,
+		&g_tfe_hw_mgr.workq, CRM_WORKQ_USAGE_NON_IRQ, 0,
+		cam_req_mgr_process_tfe_worker);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Unable to create worker");
+		goto end;
+	}
+
+	/* fill return structure */
+	hw_mgr_intf->hw_mgr_priv = &g_tfe_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_tfe_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire = cam_tfe_mgr_acquire;
+	hw_mgr_intf->hw_start = cam_tfe_mgr_start_hw;
+	hw_mgr_intf->hw_stop = cam_tfe_mgr_stop_hw;
+	hw_mgr_intf->hw_read = cam_tfe_mgr_read;
+	hw_mgr_intf->hw_write = cam_tfe_mgr_write;
+	hw_mgr_intf->hw_release = cam_tfe_mgr_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_tfe_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config = cam_tfe_mgr_config_hw;
+	hw_mgr_intf->hw_cmd = cam_tfe_mgr_cmd;
+	hw_mgr_intf->hw_reset = cam_tfe_mgr_reset;
+	hw_mgr_intf->hw_dump = cam_tfe_mgr_dump;
+
+	if (iommu_hdl)
+		*iommu_hdl = g_tfe_hw_mgr.mgr_common.img_iommu_hdl;
+
+	cam_tfe_hw_mgr_debug_register();
+	CAM_DBG(CAM_ISP, "Exit");
+
+	return 0;
+end:
+	if (rc) {
+		for (i = 0; i < CAM_TFE_CTX_MAX; i++) {
+			cam_tasklet_deinit(
+				&g_tfe_hw_mgr.mgr_common.tasklet_pool[i]);
+			kfree(g_tfe_hw_mgr.ctx_pool[i].cdm_cmd);
+			g_tfe_hw_mgr.ctx_pool[i].cdm_cmd = NULL;
+			g_tfe_hw_mgr.ctx_pool[i].common.tasklet_info = NULL;
+		}
+	}
+	cam_smmu_destroy_handle(
+		g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure);
+	g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure = -1;
+secure_fail:
+	cam_smmu_destroy_handle(g_tfe_hw_mgr.mgr_common.img_iommu_hdl);
+	g_tfe_hw_mgr.mgr_common.img_iommu_hdl = -1;
+	return rc;
+}
+
+void cam_tfe_hw_mgr_deinit(void)
+{
+	int i = 0;
+
+	cam_req_mgr_workq_destroy(&g_tfe_hw_mgr.workq);
+	debugfs_remove_recursive(g_tfe_hw_mgr.debug_cfg.dentry);
+	g_tfe_hw_mgr.debug_cfg.dentry = NULL;
+
+	for (i = 0; i < CAM_TFE_CTX_MAX; i++) {
+		cam_tasklet_deinit(
+			&g_tfe_hw_mgr.mgr_common.tasklet_pool[i]);
+		kfree(g_tfe_hw_mgr.ctx_pool[i].cdm_cmd);
+		g_tfe_hw_mgr.ctx_pool[i].cdm_cmd = NULL;
+		g_tfe_hw_mgr.ctx_pool[i].common.tasklet_info = NULL;
+	}
+
+	cam_smmu_destroy_handle(
+		g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure);
+	g_tfe_hw_mgr.mgr_common.img_iommu_hdl_secure = -1;
+
+	cam_smmu_destroy_handle(g_tfe_hw_mgr.mgr_common.img_iommu_hdl);
+	g_tfe_hw_mgr.mgr_common.img_iommu_hdl = -1;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.h
@@ -0,0 +1,220 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_HW_MGR_H_
+#define _CAM_TFE_HW_MGR_H_
+
+#include <linux/completion.h>
+#include <media/cam_isp_tfe.h>
+#include "cam_isp_hw_mgr.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_tfe_csid_hw_intf.h"
+#include "cam_top_tpg_hw_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_cdm_intf_api.h"
+
+
+
+/* TFE resource constants */
+#define CAM_TFE_HW_IN_RES_MAX            (CAM_ISP_TFE_IN_RES_MAX & 0xFF)
+#define CAM_TFE_HW_OUT_RES_MAX           (CAM_ISP_TFE_OUT_RES_MAX & 0xFF)
+#define CAM_TFE_HW_RES_POOL_MAX          64
+
+/**
+ * struct cam_tfe_hw_mgr_debug - contain the debug information
+ *
+ * @dentry:                    Debugfs entry
+ * @csid_debug:                csid debug information
+ * @enable_recovery:           enable recovery
+ * @enable_csid_recovery:      enable csid recovery
+ * @camif_debug:               enable sensor diagnosis status
+ * @set_tpg_pattern:           tpg pattern information
+ * @enable_reg_dump:           enable reg dump on error;
+ * @per_req_reg_dump:          Enable per request reg dump
+ *
+ */
+struct cam_tfe_hw_mgr_debug {
+	struct dentry  *dentry;
+	uint64_t       csid_debug;
+	uint32_t       enable_recovery;
+	uint32_t       enable_csid_recovery;
+	uint32_t       camif_debug;
+	uint32_t       set_tpg_pattern;
+	uint32_t       enable_reg_dump;
+	uint32_t       per_req_reg_dump;
+};
+
+/**
+ * struct cam_tfe_hw_mgr_ctx - TFE HW manager Context object
+ *
+ * @list:                     used by the ctx list.
+ * @common:                   common acquired context data
+ * @ctx_index:                acquired context id.
+ * @hw_mgr:                   tfe hw mgr which owns this context
+ * @ctx_in_use:               flag to tell whether context is active
+ * @res_list_csid:            csid resource list
+ * @res_list_tfe_in:          tfe input resource list
+ * @res_list_tfe_out:         tfe output resoruces array
+ * @free_res_list:            free resources list for the branch node
+ * @res_pool:                 memory storage for the free resource list
+ * @base                      device base index array contain the all TFE HW
+ *                            instance associated with this context.
+ * @num_base                  number of valid base data in the base array
+ * @cdm_handle                cdm hw acquire handle
+ * @cdm_ops                   cdm util operation pointer for building
+ *                            cdm commands
+ * @cdm_cmd                   cdm base and length request pointer
+ * @last_submit_bl_cmd        last submiited CDM BL command data
+ * @config_done_complete      indicator for configuration complete
+ * @overflow_pending          flat to specify the overflow is pending for the
+ *                            context
+ * @cdm_done                  flag to indicate cdm has finished writing shadow
+ *                            registers
+ * @last_cdm_done_req:        Last CDM done request
+ * @is_rdi_only_context       flag to specify the context has only rdi resource
+ * @reg_dump_buf_desc:        cmd buffer descriptors for reg dump
+ * @num_reg_dump_buf:         count of descriptors in reg_dump_buf_desc
+ * @applied_req_id:           last request id to be applied
+ * @last_dump_flush_req_id    last req id for which reg dump on flush was called
+ * @last_dump_err_req_id      last req id for which reg dump on error was called
+ * @init_done                 indicate whether init hw is done
+ * @is_dual                   indicate whether context is in dual TFE mode
+ * @is_tpg                    indicate whether context use tpg
+ * @master_hw_idx             master hardware index in dual tfe case
+ * @slave_hw_idx              slave hardware index in dual tfe case
+ * @dual_tfe_irq_mismatch_cnt irq mismatch count value per core, used for
+ *                              dual TFE
+ * packet                     CSL packet from user mode driver
+ */
+struct cam_tfe_hw_mgr_ctx {
+	struct list_head                list;
+	struct cam_isp_hw_mgr_ctx       common;
+
+	uint32_t                        ctx_index;
+	struct cam_tfe_hw_mgr          *hw_mgr;
+	uint32_t                        ctx_in_use;
+
+	struct cam_isp_hw_mgr_res       res_list_tpg;
+	struct list_head                res_list_tfe_csid;
+	struct list_head                res_list_tfe_in;
+	struct cam_isp_hw_mgr_res
+			res_list_tfe_out[CAM_TFE_HW_OUT_RES_MAX];
+
+	struct list_head                free_res_list;
+	struct cam_isp_hw_mgr_res       res_pool[CAM_TFE_HW_RES_POOL_MAX];
+
+	struct cam_isp_ctx_base_info    base[CAM_TFE_HW_NUM_MAX];
+	uint32_t                        num_base;
+	uint32_t                        cdm_handle;
+	struct cam_cdm_utils_ops       *cdm_ops;
+	struct cam_cdm_bl_request      *cdm_cmd;
+	struct cam_cdm_bl_info          last_submit_bl_cmd;
+	struct completion               config_done_complete;
+
+	atomic_t                        overflow_pending;
+	atomic_t                        cdm_done;
+	uint64_t                        last_cdm_done_req;
+	uint32_t                        is_rdi_only_context;
+	struct cam_cmd_buf_desc         reg_dump_buf_desc[
+						CAM_REG_DUMP_MAX_BUF_ENTRIES];
+	uint32_t                        num_reg_dump_buf;
+	uint64_t                        applied_req_id;
+	uint64_t                        last_dump_flush_req_id;
+	uint64_t                        last_dump_err_req_id;
+	bool                            init_done;
+	bool                            is_dual;
+	bool                            is_tpg;
+	uint32_t                        master_hw_idx;
+	uint32_t                        slave_hw_idx;
+	uint32_t                        dual_tfe_irq_mismatch_cnt;
+	struct cam_packet              *packet;
+};
+
+/**
+ * struct cam_tfe_hw_mgr - TFE HW Manager
+ *
+ * @mgr_common:            common data for all HW managers
+ * @tpg_devices:           tpg devices instacnce array. This will be filled by
+ *                         HW manager during the initialization.
+ * @csid_devices:          csid device instances array. This will be filled by
+ *                         HW manager during the initialization.
+ * @tfe_devices:           TFE device instances array. This will be filled by
+ *                         HW layer during initialization
+ * @cdm_reg_map            commands for register dump
+ * @ctx_mutex:             mutex for the hw context pool
+ * @active_ctx_cnt         active context count number
+ * @free_ctx_list:         free hw context list
+ * @used_ctx_list:         used hw context list
+ * @ctx_pool:              context storage
+ * @tfe_csid_dev_caps      csid device capability stored per core
+ * @tfe_dev_caps           tfe device capability per core
+ * @work q                 work queue for TFE hw manager
+ * @debug_cfg              debug configuration
+ * @support_consumed_addr  indicate whether hw supports last consumed address
+ * @ctx_lock               Spinlock for HW manager
+ */
+struct cam_tfe_hw_mgr {
+	struct cam_isp_hw_mgr          mgr_common;
+	struct cam_hw_intf            *tpg_devices[CAM_TOP_TPG_HW_NUM_MAX];
+	struct cam_hw_intf            *csid_devices[CAM_TFE_CSID_HW_NUM_MAX];
+	struct cam_isp_hw_intf_data   *tfe_devices[CAM_TFE_HW_NUM_MAX];
+	struct cam_soc_reg_map        *cdm_reg_map[CAM_TFE_HW_NUM_MAX];
+	struct mutex                   ctx_mutex;
+	atomic_t                       active_ctx_cnt;
+	struct list_head               free_ctx_list;
+	struct list_head               used_ctx_list;
+	struct cam_tfe_hw_mgr_ctx      ctx_pool[CAM_TFE_CTX_MAX];
+
+	struct cam_tfe_csid_hw_caps    tfe_csid_dev_caps[
+						CAM_TFE_CSID_HW_NUM_MAX];
+	struct cam_tfe_hw_get_hw_cap   tfe_dev_caps[CAM_TFE_HW_NUM_MAX];
+	struct cam_req_mgr_core_workq *workq;
+	struct cam_tfe_hw_mgr_debug    debug_cfg;
+	bool                           support_consumed_addr;
+	spinlock_t                     ctx_lock;
+};
+
+/**
+ * struct cam_tfe_hw_event_recovery_data - Payload for the recovery procedure
+ *
+ * @error_type:               Error type that causes the recovery
+ * @affected_core:            Array of the hardware cores that are affected
+ * @affected_ctx:             Array of the hardware contexts that are affected
+ * @no_of_context:            Actual number of the affected context
+ *
+ */
+struct cam_tfe_hw_event_recovery_data {
+	uint32_t                   error_type;
+	uint32_t                   affected_core[CAM_TFE_HW_NUM_MAX];
+	struct cam_tfe_hw_mgr_ctx *affected_ctx[CAM_TFE_CTX_MAX];
+	uint32_t                   no_of_context;
+};
+
+/**
+ * cam_tfe_hw_mgr_init()
+ *
+ * @brief:              Initialize the TFE hardware manger. This is the
+ *                      etnry functinon for the TFE HW manager.
+ *
+ * @hw_mgr_intf:        TFE hardware manager object returned
+ * @iommu_hdl:          Iommu handle to be returned
+ *
+ */
+#ifdef CONFIG_SPECTRA_TFE
+int cam_tfe_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf, int *iommu_hdl);
+void cam_tfe_hw_mgr_deinit(void);
+#else
+static inline int cam_tfe_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf,
+	int *iommu_hdl)
+{
+	return -EINVAL;
+}
+
+static inline void cam_tfe_hw_mgr_deinit(void)
+{
+}
+#endif
+
+#endif /* _CAM_TFE_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
@@ -0,0 +1,1321 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <media/cam_defs.h>
+#include <media/cam_isp.h>
+#include "cam_mem_mgr.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_isp_packet_parser.h"
+#include "cam_debug_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+
+int cam_isp_add_change_base(
+	struct cam_hw_prepare_update_args      *prepare,
+	struct list_head                       *res_list_isp_src,
+	struct cam_isp_change_base_args        *change_base_args,
+	struct cam_kmd_buf_info                *kmd_buf_info)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res       *hw_mgr_res;
+	struct cam_isp_resource_node    *res;
+	struct cam_isp_hw_get_cmd_update get_base;
+	struct cam_hw_update_entry      *hw_entry;
+	uint32_t                         num_ent, i;
+
+	hw_entry = prepare->hw_update_entries;
+	num_ent = prepare->num_hw_update_entries;
+
+	/* Max one hw entries required for each base */
+	if (num_ent + 1 >= prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			num_ent, prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			if (res->hw_intf->hw_idx != change_base_args->base_idx)
+				continue;
+
+			get_base.res  = res;
+			get_base.cdm_id = change_base_args->cdm_id;
+			get_base.cmd_type = CAM_ISP_HW_CMD_GET_CHANGE_BASE;
+			get_base.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4;
+			get_base.cmd.size  = kmd_buf_info->size -
+					kmd_buf_info->used_bytes;
+
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_CHANGE_BASE, &get_base,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+			if (rc)
+				return rc;
+
+			hw_entry[num_ent].handle = kmd_buf_info->handle;
+			hw_entry[num_ent].len    = get_base.cmd.used_bytes;
+			hw_entry[num_ent].offset = kmd_buf_info->offset;
+
+			/* Marking change base as IOCFG to reapply on bubble */
+			hw_entry[num_ent].flags  = CAM_ISP_IOCFG_BL;
+			CAM_DBG(CAM_ISP,
+				"num_ent=%d handle=0x%x, len=%u, offset=%u",
+				num_ent,
+				hw_entry[num_ent].handle,
+				hw_entry[num_ent].len,
+				hw_entry[num_ent].offset);
+
+			kmd_buf_info->used_bytes += get_base.cmd.used_bytes;
+			kmd_buf_info->offset     += get_base.cmd.used_bytes;
+			num_ent++;
+			prepare->num_hw_update_entries = num_ent;
+
+			/* return success */
+			return 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_isp_update_dual_config(
+	struct cam_cmd_buf_desc            *cmd_desc,
+	uint32_t                            split_id,
+	uint32_t                            base_idx,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint32_t                            size_isp_out)
+{
+	int rc = -EINVAL;
+	struct cam_isp_dual_config                 *dual_config;
+	struct cam_isp_hw_mgr_res                  *hw_mgr_res;
+	struct cam_isp_resource_node               *res;
+	struct cam_isp_hw_dual_isp_update_args      dual_isp_update_args;
+	uint32_t                                    outport_id;
+	uint32_t                                    ports_plane_idx;
+	size_t                                      len = 0, remain_len = 0;
+	uint32_t                                   *cpu_addr;
+	uint32_t                                    i, j;
+
+	CAM_DBG(CAM_ISP, "cmd des size %d, length: %d",
+		cmd_desc->size, cmd_desc->length);
+
+	rc = cam_packet_util_get_cmd_mem_addr(
+		cmd_desc->mem_handle, &cpu_addr, &len);
+	if (rc)
+		return rc;
+
+	if ((len < sizeof(struct cam_isp_dual_config)) ||
+		(cmd_desc->offset >=
+		(len - sizeof(struct cam_isp_dual_config)))) {
+		CAM_ERR(CAM_ISP, "not enough buffer provided");
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+	remain_len = len - cmd_desc->offset;
+	cpu_addr += (cmd_desc->offset / 4);
+	dual_config = (struct cam_isp_dual_config *)cpu_addr;
+
+	if (dual_config->num_ports > size_isp_out) {
+		CAM_ERR(CAM_ISP, "num_ports %d more than max_vfe_out_res %d",
+			dual_config->num_ports, size_isp_out);
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+
+	if ((dual_config->num_ports *
+		sizeof(struct cam_isp_dual_stripe_config)) >
+		(remain_len - offsetof(struct cam_isp_dual_config, stripes))) {
+		CAM_ERR(CAM_ISP, "not enough buffer for all the dual configs");
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		return -EINVAL;
+	}
+	for (i = 0; i < dual_config->num_ports; i++) {
+
+		hw_mgr_res = &res_list_isp_out[i];
+		if (!hw_mgr_res) {
+			CAM_ERR(CAM_ISP,
+				"Invalid isp out resource i %d num_out_res %d",
+				i, dual_config->num_ports);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			res = hw_mgr_res->hw_res[j];
+
+			if (res->res_id < CAM_ISP_IFE_OUT_RES_BASE ||
+				res->res_id >= (CAM_ISP_IFE_OUT_RES_BASE +
+				size_isp_out))
+				continue;
+
+			outport_id = res->res_id & 0xFF;
+
+			ports_plane_idx = (j * (dual_config->num_ports *
+				CAM_PACKET_MAX_PLANES)) +
+				(outport_id * CAM_PACKET_MAX_PLANES);
+
+			if (dual_config->stripes_flex[ports_plane_idx].port_id == 0)
+				continue;
+
+			dual_isp_update_args.split_id = j;
+			dual_isp_update_args.res      = res;
+			dual_isp_update_args.dual_cfg = dual_config;
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_STRIPE_UPDATE,
+				&dual_isp_update_args,
+				sizeof(struct cam_isp_hw_dual_isp_update_args));
+			if (rc)
+				goto end;
+		}
+	}
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+int cam_isp_add_cmd_buf_update(
+	struct cam_isp_hw_mgr_res            *hw_mgr_res,
+	uint32_t                              cmd_type,
+	uint32_t                              hw_cmd_type,
+	uint32_t                              base_idx,
+	uint32_t                             *cmd_buf_addr,
+	uint32_t                              kmd_buf_remain_size,
+	void                                 *cmd_update_data,
+	uint32_t                             *bytes_used)
+{
+	int rc = 0;
+	struct cam_isp_resource_node       *res;
+	struct cam_isp_hw_get_cmd_update    cmd_update;
+	uint32_t                            i;
+	uint32_t                            total_used_bytes = 0;
+
+	if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT) {
+		CAM_ERR(CAM_ISP, "VFE out resource:0x%X type:%d not valid",
+			hw_mgr_res->res_id, hw_mgr_res->res_type);
+		return -EINVAL;
+	}
+
+	cmd_update.cmd_type = hw_cmd_type;
+	cmd_update.cmd.cmd_buf_addr = cmd_buf_addr;
+	cmd_update.cmd.size = kmd_buf_remain_size;
+	cmd_update.cmd.used_bytes = 0;
+	cmd_update.data = cmd_update_data;
+	CAM_DBG(CAM_ISP, "cmd_type %u cmd buffer 0x%pK, size %d",
+		cmd_update.cmd_type,
+		cmd_update.cmd.cmd_buf_addr,
+		cmd_update.cmd.size);
+
+	for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+		if (!hw_mgr_res->hw_res[i])
+			continue;
+
+		if (hw_mgr_res->hw_res[i]->hw_intf->hw_idx != base_idx)
+			continue;
+
+		res = hw_mgr_res->hw_res[i];
+		cmd_update.res = res;
+
+		rc = res->hw_intf->hw_ops.process_cmd(
+			res->hw_intf->hw_priv,
+			cmd_update.cmd_type, &cmd_update,
+			sizeof(struct cam_isp_hw_get_cmd_update));
+
+		if (rc) {
+			CAM_ERR(CAM_ISP, "get buf cmd error:%d",
+				res->res_id);
+			rc = -ENOMEM;
+			return rc;
+		}
+
+		total_used_bytes += cmd_update.cmd.used_bytes;
+	}
+	*bytes_used = total_used_bytes;
+	CAM_DBG(CAM_ISP, "total_used_bytes %u", total_used_bytes);
+	return rc;
+}
+
+int cam_isp_add_command_buffers(
+	struct cam_hw_prepare_update_args      *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	struct cam_isp_ctx_base_info       *base_info,
+	cam_packet_generic_blob_handler     blob_handler_cb,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint32_t                            size_isp_out)
+{
+	int rc = 0;
+	uint32_t                           cmd_meta_data, num_ent, i;
+	uint32_t                           base_idx;
+	enum cam_isp_hw_split_id           split_id;
+	struct cam_cmd_buf_desc           *cmd_desc = NULL;
+	struct cam_hw_update_entry        *hw_entry = NULL;
+
+	split_id = base_info->split_id;
+	base_idx = base_info->idx;
+	hw_entry = prepare->hw_update_entries;
+
+	/*
+	 * set the cmd_desc to point the first command descriptor in the
+	 * packet
+	 */
+	cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint8_t *)&prepare->packet->payload_flex +
+			prepare->packet->cmd_buf_offset);
+
+	CAM_DBG(CAM_ISP, "split id = %d, number of command buffers:%d",
+		split_id, prepare->packet->num_cmd_buf);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		num_ent = prepare->num_hw_update_entries;
+		if (!cmd_desc[i].length)
+			continue;
+
+		/* One hw entry space required for left or right or common */
+		if (num_ent + 1 >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+				num_ent, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		cmd_meta_data = cmd_desc[i].meta_data;
+
+		CAM_DBG(CAM_ISP, "meta type: %d, split_id: %d",
+			cmd_meta_data, split_id);
+
+		switch (cmd_meta_data) {
+		case CAM_ISP_PACKET_META_BASE:
+		case CAM_ISP_PACKET_META_LEFT:
+		case CAM_ISP_PACKET_META_DMI_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle =
+					cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				CAM_DBG(CAM_ISP,
+					"Meta_Left num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+					hw_entry[num_ent].flags =
+						CAM_ISP_IQ_BL;
+
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_PACKET_META_RIGHT:
+		case CAM_ISP_PACKET_META_DMI_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				hw_entry[num_ent].len = cmd_desc[i].length;
+				hw_entry[num_ent].handle =
+					cmd_desc[i].mem_handle;
+				hw_entry[num_ent].offset = cmd_desc[i].offset;
+				CAM_DBG(CAM_ISP,
+					"Meta_Right num_ent=%d handle=0x%x, len=%u, offset=%u",
+					num_ent,
+					hw_entry[num_ent].handle,
+					hw_entry[num_ent].len,
+					hw_entry[num_ent].offset);
+					hw_entry[num_ent].flags =
+						CAM_ISP_IQ_BL;
+				num_ent++;
+			}
+			break;
+		case CAM_ISP_PACKET_META_COMMON:
+		case CAM_ISP_PACKET_META_DMI_COMMON:
+			hw_entry[num_ent].len = cmd_desc[i].length;
+			hw_entry[num_ent].handle =
+				cmd_desc[i].mem_handle;
+			hw_entry[num_ent].offset = cmd_desc[i].offset;
+			CAM_DBG(CAM_ISP,
+				"Meta_Common num_ent=%d handle=0x%x, len=%u, offset=%u",
+				num_ent,
+				hw_entry[num_ent].handle,
+				hw_entry[num_ent].len,
+				hw_entry[num_ent].offset);
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+
+			num_ent++;
+			break;
+		case CAM_ISP_PACKET_META_DUAL_CONFIG:
+			rc = cam_isp_update_dual_config(&cmd_desc[i],
+				split_id, base_idx,
+				res_list_isp_out, size_isp_out);
+
+			if (rc)
+				return rc;
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_LEFT:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				struct cam_isp_generic_blob_info   blob_info;
+
+				prepare->num_hw_update_entries = num_ent;
+				blob_info.prepare = prepare;
+				blob_info.base_info = base_info;
+				blob_info.kmd_buf_info = kmd_buf_info;
+
+				rc = cam_packet_util_process_generic_cmd_buffer(
+					&cmd_desc[i],
+					blob_handler_cb,
+					&blob_info);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed in processing blobs %d",
+						rc);
+					return rc;
+				}
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent = prepare->num_hw_update_entries;
+			}
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_RIGHT:
+			if (split_id == CAM_ISP_HW_SPLIT_RIGHT) {
+				struct cam_isp_generic_blob_info   blob_info;
+
+				prepare->num_hw_update_entries = num_ent;
+				blob_info.prepare = prepare;
+				blob_info.base_info = base_info;
+				blob_info.kmd_buf_info = kmd_buf_info;
+
+				rc = cam_packet_util_process_generic_cmd_buffer(
+					&cmd_desc[i],
+					blob_handler_cb,
+					&blob_info);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"Failed in processing blobs %d",
+						rc);
+					return rc;
+				}
+				hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+				num_ent = prepare->num_hw_update_entries;
+			}
+			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB_COMMON: {
+			struct cam_isp_generic_blob_info   blob_info;
+
+			prepare->num_hw_update_entries = num_ent;
+			blob_info.prepare = prepare;
+			blob_info.base_info = base_info;
+			blob_info.kmd_buf_info = kmd_buf_info;
+
+			rc = cam_packet_util_process_generic_cmd_buffer(
+				&cmd_desc[i],
+				blob_handler_cb,
+				&blob_info);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in processing blobs %d", rc);
+				return rc;
+			}
+			hw_entry[num_ent].flags = CAM_ISP_IQ_BL;
+			num_ent = prepare->num_hw_update_entries;
+		}
+			break;
+		case CAM_ISP_PACKET_META_REG_DUMP_ON_FLUSH:
+		case CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR:
+		case CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST:
+			if (split_id == CAM_ISP_HW_SPLIT_LEFT) {
+				if (prepare->num_reg_dump_buf >=
+					CAM_REG_DUMP_MAX_BUF_ENTRIES) {
+					CAM_ERR(CAM_ISP,
+					"Descriptor count out of bounds: %d",
+					prepare->num_reg_dump_buf);
+					return -EINVAL;
+				}
+
+				prepare->reg_dump_buf_desc[
+					prepare->num_reg_dump_buf] =
+					cmd_desc[i];
+				prepare->num_reg_dump_buf++;
+				CAM_DBG(CAM_ISP,
+					"Added command buffer: %d desc_count: %d",
+					cmd_desc[i].meta_data,
+					prepare->num_reg_dump_buf);
+			}
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "invalid cdm command meta data %d",
+				cmd_meta_data);
+			return -EINVAL;
+		}
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_io_buffers(
+	int                                   iommu_hdl,
+	int                                   sec_iommu_hdl,
+	struct cam_hw_prepare_update_args    *prepare,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	struct cam_isp_hw_mgr_res            *res_list_isp_out,
+	struct list_head                     *res_list_ife_in_rd,
+	uint32_t                              size_isp_out,
+	bool                                  fill_fence,
+	struct cam_isp_frame_header_info     *frame_header_info)
+{
+	int                                 rc = 0;
+	dma_addr_t                          io_addr[CAM_PACKET_MAX_PLANES];
+	struct cam_buf_io_cfg              *io_cfg;
+	struct cam_isp_resource_node       *res;
+	struct cam_isp_hw_mgr_res          *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update    update_buf;
+	struct cam_isp_hw_get_wm_update     wm_update;
+	struct cam_isp_hw_get_wm_update     bus_rd_update;
+	struct cam_hw_fence_map_entry      *out_map_entries = NULL;
+	struct cam_hw_fence_map_entry      *in_map_entries;
+	struct cam_isp_hw_get_cmd_update    secure_mode;
+	uint32_t                            kmd_buf_remain_size;
+	uint32_t                            i, j, num_out_buf, num_in_buf;
+	uint32_t                            res_id_out, res_id_in, plane_id;
+	uint32_t                            io_cfg_used_bytes, num_ent;
+	uint32_t                           *image_buf_addr;
+	uint32_t                           *image_buf_offset;
+	uint64_t                            iova_addr;
+	size_t                              size;
+	int32_t                             hdl;
+	int                                 mmu_hdl;
+	bool                                is_buf_secure;
+	uint32_t                            mode;
+
+	io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+			&prepare->packet->payload_flex +
+			prepare->packet->io_configs_offset);
+	num_out_buf = 0;
+	num_in_buf  = 0;
+	io_cfg_used_bytes = 0;
+	prepare->pf_data->packet = prepare->packet;
+
+	/* Max one hw entries required for each base */
+	if (prepare->num_hw_update_entries + 1 >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		CAM_DBG(CAM_ISP, "======= io config idx %d ============", i);
+		CAM_DBG(CAM_REQ,
+			"i %d req_id %llu resource_type:%d fence:%d direction %d",
+			i, prepare->packet->header.request_id,
+			io_cfg[i].resource_type, io_cfg[i].fence,
+			io_cfg[i].direction);
+		CAM_DBG(CAM_ISP, "format: %d", io_cfg[i].format);
+
+		if (io_cfg[i].direction == CAM_BUF_OUTPUT) {
+			res_id_out = io_cfg[i].resource_type & 0xFF;
+			if (res_id_out >= size_isp_out) {
+				CAM_ERR(CAM_ISP, "invalid out restype:%x",
+					io_cfg[i].resource_type);
+				return -EINVAL;
+			}
+
+			CAM_DBG(CAM_ISP,
+				"configure output io with fill fence %d",
+				fill_fence);
+			out_map_entries =
+				&prepare->out_map_entries[num_out_buf];
+			if (fill_fence) {
+				if (num_out_buf <
+					prepare->max_out_map_entries) {
+					out_map_entries->resource_handle =
+						io_cfg[i].resource_type;
+					out_map_entries->sync_id =
+						io_cfg[i].fence;
+					num_out_buf++;
+				} else {
+					CAM_ERR(CAM_ISP, "ln_out:%d max_ln:%d",
+						num_out_buf,
+						prepare->max_out_map_entries);
+					return -EINVAL;
+				}
+			}
+
+			hw_mgr_res = &res_list_isp_out[res_id_out];
+			if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT) {
+				CAM_ERR(CAM_ISP, "io res id:%d not valid",
+					io_cfg[i].resource_type);
+				return -EINVAL;
+			}
+		} else if (io_cfg[i].direction == CAM_BUF_INPUT) {
+			res_id_in = io_cfg[i].resource_type & 0xFF;
+			CAM_DBG(CAM_ISP,
+				"configure input io with fill fence %d",
+				fill_fence);
+			if (!res_list_ife_in_rd) {
+				CAM_ERR(CAM_ISP,
+					"No ISP in Read supported");
+				return -EINVAL;
+			}
+			if (!list_empty(res_list_ife_in_rd)) {
+				hw_mgr_res =
+					list_first_entry(res_list_ife_in_rd,
+					struct cam_isp_hw_mgr_res, list);
+			} else {
+				CAM_ERR(CAM_ISP,
+					"No IFE in Read resource");
+				return -EINVAL;
+			}
+			in_map_entries =
+				&prepare->in_map_entries[num_in_buf];
+			if (fill_fence) {
+				if (num_in_buf < prepare->max_in_map_entries) {
+					in_map_entries->resource_handle =
+						io_cfg[i].resource_type;
+					in_map_entries->sync_id =
+						io_cfg[i].fence;
+					num_in_buf++;
+				} else {
+					CAM_ERR(CAM_ISP, "ln_in:%d imax_ln:%d",
+						num_in_buf,
+						prepare->max_in_map_entries);
+					return -EINVAL;
+				}
+			}
+		} else {
+			CAM_ERR(CAM_ISP, "Invalid io config direction :%d",
+				io_cfg[i].direction);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_ISP, "setup mem io");
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX &&
+			io_cfg[i].direction == CAM_BUF_OUTPUT; j++) {
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			res = hw_mgr_res->hw_res[j];
+			if (res->res_id != io_cfg[i].resource_type) {
+				CAM_ERR(CAM_ISP,
+					"wm err res id:%d io res id:%d",
+					res->res_id, io_cfg[i].resource_type);
+				return -EINVAL;
+			}
+
+			memset(io_addr, 0, sizeof(io_addr));
+
+			for (plane_id = 0; plane_id < CAM_PACKET_MAX_PLANES;
+						plane_id++) {
+				if (!io_cfg[i].mem_handle[plane_id])
+					break;
+
+				hdl = io_cfg[i].mem_handle[plane_id];
+				secure_mode.cmd_type =
+					CAM_ISP_HW_CMD_GET_SECURE_MODE;
+				secure_mode.res = res;
+				secure_mode.data = (void *)&mode;
+				rc = res->hw_intf->hw_ops.process_cmd(
+					res->hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_GET_SECURE_MODE,
+					&secure_mode,
+					sizeof(
+					struct cam_isp_hw_get_cmd_update));
+				if (rc)
+					return -EINVAL;
+
+				is_buf_secure = cam_mem_is_secure_buf(hdl);
+				if ((mode == CAM_SECURE_MODE_SECURE) &&
+					is_buf_secure) {
+					mmu_hdl = sec_iommu_hdl;
+				} else if (
+					(mode == CAM_SECURE_MODE_NON_SECURE) &&
+					(!is_buf_secure)) {
+					mmu_hdl = iommu_hdl;
+				} else {
+					CAM_ERR_RATE_LIMIT(CAM_ISP,
+						"Invalid hdl: port mode[%u], buf mode[%u]",
+						mode, is_buf_secure);
+					return -EINVAL;
+				}
+
+				rc = cam_mem_get_io_buf(
+					io_cfg[i].mem_handle[plane_id],
+					mmu_hdl, &io_addr[plane_id], &size);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"no io addr for plane%d",
+						plane_id);
+					rc = -ENOMEM;
+					return rc;
+				}
+
+				/* need to update with offset */
+				io_addr[plane_id] +=
+						io_cfg[i].offsets[plane_id];
+				CAM_DBG(CAM_ISP,
+					"get io_addr for plane %d: 0x%llx, mem_hdl=0x%x",
+					plane_id, io_addr[plane_id],
+					io_cfg[i].mem_handle[plane_id]);
+
+				CAM_DBG(CAM_ISP,
+					"mmu_hdl=0x%x, size=%d, end=0x%x",
+					mmu_hdl, (int)size,
+					io_addr[plane_id]+size);
+
+			}
+			if (!plane_id) {
+				CAM_ERR(CAM_ISP, "No valid planes for res%d",
+					res->res_id);
+				rc = -ENOMEM;
+				return rc;
+			}
+
+			if ((kmd_buf_info->used_bytes + io_cfg_used_bytes) <
+				kmd_buf_info->size) {
+				kmd_buf_remain_size = kmd_buf_info->size -
+					(kmd_buf_info->used_bytes +
+					io_cfg_used_bytes);
+			} else {
+				CAM_ERR(CAM_ISP,
+					"no free kmd memory for base %d",
+					base_idx);
+				rc = -ENOMEM;
+				return rc;
+			}
+			update_buf.res = res;
+			update_buf.cmd_type = CAM_ISP_HW_CMD_GET_BUF_UPDATE;
+			update_buf.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4 +
+					io_cfg_used_bytes/4;
+			wm_update.image_buf = io_addr;
+			wm_update.num_buf   = plane_id;
+			wm_update.io_cfg    = &io_cfg[i];
+			wm_update.frame_header = 0;
+			wm_update.fh_enabled = false;
+
+			for (plane_id = 0; plane_id < CAM_PACKET_MAX_PLANES;
+				plane_id++)
+				wm_update.image_buf_offset[plane_id] = 0;
+
+			iova_addr = frame_header_info->frame_header_iova_addr;
+			if ((frame_header_info->frame_header_enable) &&
+				!(frame_header_info->frame_header_res_id)) {
+				wm_update.frame_header = iova_addr;
+				wm_update.local_id =
+					prepare->packet->header.request_id;
+			}
+
+			update_buf.cmd.size = kmd_buf_remain_size;
+			update_buf.wm_update = &wm_update;
+
+			CAM_DBG(CAM_ISP, "cmd buffer 0x%pK, size %d",
+				update_buf.cmd.cmd_buf_addr,
+				update_buf.cmd.size);
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_BUF_UPDATE, &update_buf,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "get buf cmd error:%d",
+					res->res_id);
+				rc = -ENOMEM;
+				return rc;
+			}
+
+			if (wm_update.fh_enabled) {
+				frame_header_info->frame_header_res_id =
+					res->res_id;
+				CAM_DBG(CAM_ISP,
+					"Frame header enabled for res: 0x%x iova: %pK",
+					frame_header_info->frame_header_res_id,
+					wm_update.frame_header);
+			}
+
+			io_cfg_used_bytes += update_buf.cmd.used_bytes;
+
+			if (!out_map_entries) {
+				CAM_ERR(CAM_ISP, "out_map_entries is NULL");
+				rc = -EINVAL;
+				return rc;
+			}
+
+			image_buf_addr =
+				out_map_entries->image_buf_addr;
+			image_buf_offset =
+				wm_update.image_buf_offset;
+			if (j == CAM_ISP_HW_SPLIT_LEFT) {
+				for (plane_id = 0;
+					plane_id < CAM_PACKET_MAX_PLANES;
+					plane_id++)
+					image_buf_addr[plane_id] =
+						io_addr[plane_id] +
+						image_buf_offset[plane_id];
+			}
+		}
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX &&
+			io_cfg[i].direction == CAM_BUF_INPUT; j++) {
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			res = hw_mgr_res->hw_res[j];
+
+			memset(io_addr, 0, sizeof(io_addr));
+
+			for (plane_id = 0; plane_id < CAM_PACKET_MAX_PLANES;
+						plane_id++) {
+				if (!io_cfg[i].mem_handle[plane_id])
+					break;
+
+				hdl = io_cfg[i].mem_handle[plane_id];
+				secure_mode.cmd_type =
+					CAM_ISP_HW_CMD_GET_SECURE_MODE;
+				secure_mode.res = res;
+				secure_mode.data = (void *)&mode;
+				rc = res->hw_intf->hw_ops.process_cmd(
+					res->hw_intf->hw_priv,
+					CAM_ISP_HW_CMD_GET_SECURE_MODE,
+					&secure_mode,
+					sizeof(
+					struct cam_isp_hw_get_cmd_update));
+				if (rc)
+					return -EINVAL;
+
+				is_buf_secure = cam_mem_is_secure_buf(hdl);
+				if ((mode == CAM_SECURE_MODE_SECURE) &&
+					is_buf_secure) {
+					mmu_hdl = sec_iommu_hdl;
+				} else if (
+					(mode == CAM_SECURE_MODE_NON_SECURE) &&
+					(!is_buf_secure)) {
+					mmu_hdl = iommu_hdl;
+				} else {
+					CAM_ERR_RATE_LIMIT(CAM_ISP,
+						"Invalid hdl: port mode[%u], buf mode[%u]",
+						mode, is_buf_secure);
+					return -EINVAL;
+				}
+
+				rc = cam_mem_get_io_buf(
+					io_cfg[i].mem_handle[plane_id],
+					mmu_hdl, &io_addr[plane_id], &size);
+				if (rc) {
+					CAM_ERR(CAM_ISP,
+						"no io addr for plane%d",
+						plane_id);
+					rc = -ENOMEM;
+					return rc;
+				}
+
+				/* need to update with offset */
+				io_addr[plane_id] +=
+						io_cfg[i].offsets[plane_id];
+				CAM_DBG(CAM_ISP,
+					"get io_addr for plane %d: 0x%llx, mem_hdl=0x%x",
+					plane_id, io_addr[plane_id],
+					io_cfg[i].mem_handle[plane_id]);
+
+				CAM_DBG(CAM_ISP,
+					"mmu_hdl=0x%x, size=%d, end=0x%x",
+					mmu_hdl, (int)size,
+					io_addr[plane_id]+size);
+
+			}
+			if (!plane_id) {
+				CAM_ERR(CAM_ISP, "No valid planes for res%d",
+					res->res_id);
+				rc = -ENOMEM;
+				return rc;
+			}
+
+			if ((kmd_buf_info->used_bytes + io_cfg_used_bytes) <
+				kmd_buf_info->size) {
+				kmd_buf_remain_size = kmd_buf_info->size -
+					(kmd_buf_info->used_bytes +
+					io_cfg_used_bytes);
+			} else {
+				CAM_ERR(CAM_ISP,
+					"no free kmd memory for base %d",
+					base_idx);
+				rc = -ENOMEM;
+				return rc;
+			}
+			update_buf.res = res;
+			update_buf.cmd_type = CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM;
+			update_buf.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4 +
+					io_cfg_used_bytes/4;
+			bus_rd_update.image_buf = io_addr;
+			bus_rd_update.num_buf   = plane_id;
+			bus_rd_update.io_cfg    = &io_cfg[i];
+			update_buf.cmd.size = kmd_buf_remain_size;
+			update_buf.rm_update = &bus_rd_update;
+
+			CAM_DBG(CAM_ISP, "cmd buffer 0x%pK, size %d",
+				update_buf.cmd.cmd_buf_addr,
+				update_buf.cmd.size);
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM, &update_buf,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "get buf cmd error:%d",
+					res->res_id);
+				rc = -ENOMEM;
+				return rc;
+			}
+			io_cfg_used_bytes += update_buf.cmd.used_bytes;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "io_cfg_used_bytes %d, fill_fence %d",
+		io_cfg_used_bytes, fill_fence);
+	if (io_cfg_used_bytes) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len =
+			io_cfg_used_bytes;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IOCFG_BL;
+		CAM_DBG(CAM_ISP,
+			"num_ent=%d handle=0x%x, len=%u, offset=%u",
+			num_ent,
+			prepare->hw_update_entries[num_ent].handle,
+			prepare->hw_update_entries[num_ent].len,
+			prepare->hw_update_entries[num_ent].offset);
+		num_ent++;
+
+		kmd_buf_info->used_bytes += io_cfg_used_bytes;
+		kmd_buf_info->offset     += io_cfg_used_bytes;
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	if (fill_fence) {
+		prepare->num_out_map_entries = num_out_buf;
+		prepare->num_in_map_entries  = num_in_buf;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_reg_update(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info)
+{
+	int rc = -EINVAL;
+	struct cam_isp_resource_node         *res;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update      get_regup;
+	uint32_t kmd_buf_remain_size, num_ent, i, reg_update_size;
+
+	/* Max one hw entries required for each base */
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	reg_update_size = 0;
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			if (res->hw_intf->hw_idx != base_idx)
+				continue;
+
+			if (kmd_buf_info->size > (kmd_buf_info->used_bytes +
+				reg_update_size)) {
+				kmd_buf_remain_size =  kmd_buf_info->size -
+					(kmd_buf_info->used_bytes +
+					reg_update_size);
+			} else {
+				CAM_ERR(CAM_ISP, "no free mem %d %d %d",
+					base_idx, kmd_buf_info->size,
+					kmd_buf_info->used_bytes +
+					reg_update_size);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			get_regup.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4 +
+				reg_update_size/4;
+			get_regup.cmd.size = kmd_buf_remain_size;
+			get_regup.cmd_type = CAM_ISP_HW_CMD_GET_REG_UPDATE;
+			get_regup.res = res;
+
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_ISP_HW_CMD_GET_REG_UPDATE, &get_regup,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+			if (rc)
+				return rc;
+
+			CAM_DBG(CAM_ISP,
+				"Reg update added for res %d hw_id %d cdm_idx %d",
+				res->res_id, res->hw_intf->hw_idx, base_idx);
+			reg_update_size += get_regup.cmd.used_bytes;
+		}
+	}
+
+	if (reg_update_size) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = reg_update_size;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+
+		/* Marking reg update as IOCFG to reapply on bubble */
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IOCFG_BL;
+		CAM_DBG(CAM_ISP,
+			"num_ent=%d handle=0x%x, len=%u, offset=%u",
+			num_ent,
+			prepare->hw_update_entries[num_ent].handle,
+			prepare->hw_update_entries[num_ent].len,
+			prepare->hw_update_entries[num_ent].offset);
+		num_ent++;
+
+		kmd_buf_info->used_bytes += reg_update_size;
+		kmd_buf_info->offset     += reg_update_size;
+		prepare->num_hw_update_entries = num_ent;
+		/* reg update is success return status 0 */
+		rc = 0;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_go_cmd(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_rd,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info)
+{
+	int rc = -EINVAL;
+	struct cam_isp_resource_node         *res;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update      get_regup;
+	uint32_t kmd_buf_remain_size, num_ent, i, reg_update_size;
+
+	/* Max one hw entries required for each base */
+	if (prepare->num_hw_update_entries + 1 >=
+		prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	reg_update_size = 0;
+	list_for_each_entry(hw_mgr_res, res_list_isp_rd, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+
+		for (i = 0; i < CAM_ISP_HW_SPLIT_MAX; i++) {
+			if (!hw_mgr_res->hw_res[i])
+				continue;
+
+			res = hw_mgr_res->hw_res[i];
+			if (res->hw_intf->hw_idx != base_idx)
+				continue;
+
+			if (kmd_buf_info->size > (kmd_buf_info->used_bytes +
+				reg_update_size)) {
+				kmd_buf_remain_size =  kmd_buf_info->size -
+					(kmd_buf_info->used_bytes +
+					reg_update_size);
+			} else {
+				CAM_ERR(CAM_ISP, "no free mem %d %d %d",
+					base_idx, kmd_buf_info->size,
+					kmd_buf_info->used_bytes +
+					reg_update_size);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			get_regup.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4 +
+				reg_update_size/4;
+			get_regup.cmd.size = kmd_buf_remain_size;
+			get_regup.cmd_type = CAM_ISP_HW_CMD_FE_TRIGGER_CMD;
+			get_regup.res = res;
+
+			rc = res->process_cmd(res->res_priv,
+				CAM_ISP_HW_CMD_FE_TRIGGER_CMD, &get_regup,
+				sizeof(struct cam_isp_hw_get_cmd_update));
+			if (rc)
+				return rc;
+
+			CAM_DBG(CAM_ISP, "GO_CMD added for RD res %d hw_id %d",
+				res->res_type, res->hw_intf->hw_idx);
+			reg_update_size += get_regup.cmd.used_bytes;
+		}
+	}
+
+	if (reg_update_size) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = reg_update_size;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IOCFG_BL;
+		CAM_DBG(CAM_ISP,
+			"num_ent=%d handle=0x%x, len=%u, offset=%u",
+			num_ent,
+			prepare->hw_update_entries[num_ent].handle,
+			prepare->hw_update_entries[num_ent].len,
+			prepare->hw_update_entries[num_ent].offset);
+		num_ent++;
+
+		kmd_buf_info->used_bytes += reg_update_size;
+		kmd_buf_info->offset     += reg_update_size;
+		prepare->num_hw_update_entries = num_ent;
+
+		rc = 0;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_comp_wait(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update      add_wait;
+	struct cam_hw_intf                   *hw_intf;
+	bool                                  hw_res_valid = false;
+	uint32_t kmd_buf_remain_size, num_ent, add_wait_size;
+
+	/* Max one hw entries required for each base */
+	if (prepare->num_hw_update_entries >= prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries");
+		return -EINVAL;
+	}
+
+	add_wait_size = 0;
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+		if (hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT] &&
+			hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT]) {
+			hw_res_valid = true;
+			break;
+		}
+	}
+
+	if (!hw_mgr_res || !hw_res_valid) {
+		CAM_ERR(CAM_ISP, "No src with multi_vfe config");
+		return -EINVAL;
+	}
+
+	hw_intf = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT]->hw_intf;
+
+	if (kmd_buf_info->size > (kmd_buf_info->used_bytes +
+			add_wait_size)) {
+		kmd_buf_remain_size =  kmd_buf_info->size -
+			(kmd_buf_info->used_bytes + add_wait_size);
+	} else {
+		CAM_ERR(CAM_ISP, "no free mem %d %d %d",
+			base_idx, kmd_buf_info->size,
+			kmd_buf_info->used_bytes +
+			add_wait_size);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	add_wait.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes/4 +
+		add_wait_size/4;
+	add_wait.cmd.size = kmd_buf_remain_size;
+	add_wait.cmd_type = CAM_ISP_HW_CMD_ADD_WAIT;
+	add_wait.res = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT];
+
+	rc = hw_intf->hw_ops.process_cmd(
+		hw_intf->hw_priv,
+		CAM_ISP_HW_CMD_ADD_WAIT,
+		&add_wait,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"wait_comp_event addition failed for dual vfe");
+		return rc;
+	}
+
+	add_wait_size += add_wait.cmd.used_bytes;
+	if (add_wait_size) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = add_wait_size;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IOCFG_BL;
+		CAM_DBG(CAM_ISP,
+			"num_ent=%d handle=0x%x, len=%u, offset=%u",
+			num_ent,
+			prepare->hw_update_entries[num_ent].handle,
+			prepare->hw_update_entries[num_ent].len,
+			prepare->hw_update_entries[num_ent].offset);
+		num_ent++;
+
+		kmd_buf_info->used_bytes += add_wait_size;
+		kmd_buf_info->offset     += add_wait_size;
+		prepare->num_hw_update_entries = num_ent;
+		/* add wait_comp_event is success return status 0 */
+		rc = 0;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_wait_trigger(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  trigger_cdm_en)
+{
+	int rc = -EINVAL;
+	struct cam_isp_hw_mgr_res            *hw_mgr_res;
+	struct cam_isp_hw_get_cmd_update      add_trigger;
+	struct cam_hw_intf                   *hw_intf;
+	bool                                  hw_res_valid = false;
+	uint32_t kmd_buf_remain_size, num_ent, add_trigger_size;
+
+	/* Max one hw entries required for each base */
+	if (prepare->num_hw_update_entries + 1 >=
+				prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries");
+		return -EINVAL;
+	}
+
+	add_trigger_size = 0;
+
+	list_for_each_entry(hw_mgr_res, res_list_isp_src, list) {
+		if (hw_mgr_res->res_type == CAM_ISP_RESOURCE_UNINT)
+			continue;
+		if (hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_LEFT] &&
+			hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT]) {
+			hw_res_valid = true;
+			break;
+		}
+	}
+
+	if (!hw_mgr_res || !hw_res_valid) {
+		CAM_ERR(CAM_ISP, "No src with multi_vfe config");
+		return -EINVAL;
+	}
+
+	hw_intf = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT]->hw_intf;
+
+	if (kmd_buf_info->size > (kmd_buf_info->used_bytes +
+			add_trigger_size)) {
+		kmd_buf_remain_size =  kmd_buf_info->size -
+			(kmd_buf_info->used_bytes + add_trigger_size);
+	} else {
+		CAM_ERR(CAM_ISP, "no free mem %d %d %d",
+			base_idx, kmd_buf_info->size,
+			kmd_buf_info->used_bytes +
+			add_trigger_size);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	add_trigger.cmd.cmd_buf_addr = kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes/4 +
+		add_trigger_size/4;
+	add_trigger.cmd.size = kmd_buf_remain_size;
+	add_trigger.cmd_type = CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER;
+	add_trigger.res = hw_mgr_res->hw_res[CAM_ISP_HW_SPLIT_RIGHT];
+
+	rc = hw_intf->hw_ops.process_cmd(
+		hw_intf->hw_priv,
+		CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER,
+		&add_trigger,
+		sizeof(struct cam_isp_hw_get_cmd_update));
+
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"wait_trigger_event addition failed for dual vfe");
+		return rc;
+	}
+
+	add_trigger_size += add_trigger.cmd.used_bytes;
+
+	if (add_trigger_size) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+			kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = add_trigger_size;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		prepare->hw_update_entries[num_ent].flags = CAM_ISP_IOCFG_BL;
+		CAM_DBG(CAM_ISP,
+			"num_ent=%d handle=0x%x, len=%u, offset=%u",
+			num_ent,
+			prepare->hw_update_entries[num_ent].handle,
+			prepare->hw_update_entries[num_ent].len,
+			prepare->hw_update_entries[num_ent].offset);
+		num_ent++;
+
+		kmd_buf_info->used_bytes += add_trigger_size;
+		kmd_buf_info->offset     += add_trigger_size;
+		prepare->num_hw_update_entries = num_ent;
+		/* add wait trigger is success return status 0 */
+		rc = 0;
+	}
+
+	return rc;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_tasklet_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_tasklet_util.c
@@ -0,0 +1,356 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, 2021 The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/list.h>
+#include <linux/ratelimit.h>
+#include "cam_tasklet_util.h"
+#include "cam_irq_controller.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+
+
+/* Threshold for scheduling delay in ms */
+#define CAM_TASKLET_SCHED_TIME_THRESHOLD        5
+
+/* Threshold for execution delay in ms */
+#define CAM_TASKLET_EXE_TIME_THRESHOLD          10
+
+#define CAM_TASKLETQ_SIZE                          256
+
+static void cam_tasklet_action(unsigned long data);
+
+/**
+ * struct cam_tasklet_queue_cmd:
+ * @Brief:                  Structure associated with each slot in the
+ *                          tasklet queue
+ *
+ * @list:                   list_head member for each entry in queue
+ * @payload:                Payload structure for the event. This will be
+ *                          passed to the handler function
+ * @handler_priv:           Private data passed at event subscribe
+ * @bottom_half_handler:    Function pointer for event handler in bottom
+ *                          half context
+ * @tasklet_enqueue_ts:     enqueue time of tasklet
+ *
+ */
+struct cam_tasklet_queue_cmd {
+	struct list_head                   list;
+	void                              *payload;
+	void                              *handler_priv;
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler;
+	ktime_t                            tasklet_enqueue_ts;
+};
+
+/**
+ * struct cam_tasklet_info:
+ * @Brief:                  Tasklet private structure
+ *
+ * @list:                   list_head member for each tasklet
+ * @index:                  Instance id for the tasklet
+ * @tasklet_lock:           Spin lock
+ * @tasklet_active:         Atomic variable to control tasklet state
+ * @tasklet:                Tasklet structure used to schedule bottom half
+ * @free_cmd_list:          List of free tasklet queue cmd for use
+ * @used_cmd_list:          List of used tasklet queue cmd
+ * @cmd_queue:              Array of tasklet cmd for storage
+ * @ctx_priv:               Private data passed to the handling function
+ *
+ */
+struct cam_tasklet_info {
+	struct list_head                   list;
+	uint32_t                           index;
+	spinlock_t                         tasklet_lock;
+	atomic_t                           tasklet_active;
+	struct tasklet_struct              tasklet;
+
+	struct list_head                   free_cmd_list;
+	struct list_head                   used_cmd_list;
+	struct cam_tasklet_queue_cmd       cmd_queue[CAM_TASKLETQ_SIZE];
+
+	void                              *ctx_priv;
+};
+
+struct cam_irq_bh_api tasklet_bh_api = {
+	.bottom_half_enqueue_func = cam_tasklet_enqueue_cmd,
+	.get_bh_payload_func = cam_tasklet_get_cmd,
+	.put_bh_payload_func = cam_tasklet_put_cmd,
+};
+
+int cam_tasklet_get_cmd(
+	void                         *bottom_half,
+	void                        **bh_cmd)
+{
+	int           rc = 0;
+	unsigned long flags;
+	struct cam_tasklet_info        *tasklet = bottom_half;
+	struct cam_tasklet_queue_cmd   *tasklet_cmd = NULL;
+
+	*bh_cmd = NULL;
+
+	if (tasklet == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "tasklet is NULL");
+		return -EINVAL;
+	}
+
+	if (!atomic_read(&tasklet->tasklet_active)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Tasklet idx:%d is not active",
+			tasklet->index);
+		rc = -EPIPE;
+		return rc;
+	}
+
+	spin_lock_irqsave(&tasklet->tasklet_lock, flags);
+	if (list_empty(&tasklet->free_cmd_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No more free tasklet cmd idx:%d",
+			tasklet->index);
+		rc = -ENODEV;
+		goto spin_unlock;
+	} else {
+		tasklet_cmd = list_first_entry(&tasklet->free_cmd_list,
+			struct cam_tasklet_queue_cmd, list);
+		list_del_init(&(tasklet_cmd)->list);
+		*bh_cmd = tasklet_cmd;
+	}
+
+spin_unlock:
+	spin_unlock_irqrestore(&tasklet->tasklet_lock, flags);
+	return rc;
+}
+
+void cam_tasklet_put_cmd(
+	void                         *bottom_half,
+	void                        **bh_cmd)
+{
+	unsigned long flags;
+	struct cam_tasklet_info        *tasklet = bottom_half;
+	struct cam_tasklet_queue_cmd   *tasklet_cmd = *bh_cmd;
+
+	if (tasklet == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "tasklet is NULL");
+		return;
+	}
+
+	if (tasklet_cmd == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid tasklet_cmd");
+		return;
+	}
+
+	spin_lock_irqsave(&tasklet->tasklet_lock, flags);
+	list_del_init(&tasklet_cmd->list);
+	list_add_tail(&tasklet_cmd->list, &tasklet->free_cmd_list);
+	*bh_cmd = NULL;
+	spin_unlock_irqrestore(&tasklet->tasklet_lock, flags);
+}
+
+/**
+ * cam_tasklet_dequeue_cmd()
+ *
+ * @brief:              Initialize the tasklet info structure
+ *
+ * @hw_mgr_ctx:         Private Ctx data that will be passed to the handler
+ *                      function
+ * @idx:                Index of tasklet used as identity
+ * @tasklet_action:     Tasklet callback function that will be called
+ *                      when tasklet runs on CPU
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+static int cam_tasklet_dequeue_cmd(
+	struct cam_tasklet_info        *tasklet,
+	struct cam_tasklet_queue_cmd  **tasklet_cmd)
+{
+	int rc = 0;
+	unsigned long flags;
+
+	*tasklet_cmd = NULL;
+
+	CAM_DBG(CAM_ISP, "Dequeue before lock tasklet idx:%d", tasklet->index);
+	spin_lock_irqsave(&tasklet->tasklet_lock, flags);
+	if (list_empty(&tasklet->used_cmd_list)) {
+		CAM_DBG(CAM_ISP, "End of list reached. Exit");
+		rc = -ENODEV;
+		goto spin_unlock;
+	} else {
+		*tasklet_cmd = list_first_entry(&tasklet->used_cmd_list,
+			struct cam_tasklet_queue_cmd, list);
+		list_del_init(&(*tasklet_cmd)->list);
+		CAM_DBG(CAM_ISP, "Dequeue Successful");
+	}
+
+spin_unlock:
+	spin_unlock_irqrestore(&tasklet->tasklet_lock, flags);
+	return rc;
+}
+
+void cam_tasklet_enqueue_cmd(
+	void                              *bottom_half,
+	void                              *bh_cmd,
+	void                              *handler_priv,
+	void                              *evt_payload_priv,
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler)
+{
+	unsigned long                  flags;
+	struct cam_tasklet_queue_cmd  *tasklet_cmd = bh_cmd;
+	struct cam_tasklet_info       *tasklet = bottom_half;
+
+	if (!bottom_half) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "NULL bottom half");
+		return;
+	}
+
+	if (!bh_cmd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "NULL bh cmd");
+		return;
+	}
+
+	if (!atomic_read(&tasklet->tasklet_active)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Tasklet is not active idx:%d",
+			tasklet->index);
+		return;
+	}
+
+	CAM_DBG(CAM_ISP, "Enqueue tasklet cmd idx:%d", tasklet->index);
+	tasklet_cmd->bottom_half_handler = bottom_half_handler;
+	tasklet_cmd->payload = evt_payload_priv;
+	tasklet_cmd->handler_priv = handler_priv;
+	tasklet_cmd->tasklet_enqueue_ts = ktime_get();
+	spin_lock_irqsave(&tasklet->tasklet_lock, flags);
+	list_add_tail(&tasklet_cmd->list,
+		&tasklet->used_cmd_list);
+	spin_unlock_irqrestore(&tasklet->tasklet_lock, flags);
+	tasklet_hi_schedule(&tasklet->tasklet);
+}
+
+int cam_tasklet_init(
+	void                    **tasklet_info,
+	void                     *hw_mgr_ctx,
+	uint32_t                  idx)
+{
+	int i;
+	struct cam_tasklet_info  *tasklet = NULL;
+
+	tasklet = kzalloc(sizeof(struct cam_tasklet_info), GFP_KERNEL);
+	if (!tasklet) {
+		CAM_DBG(CAM_ISP,
+			"Error! Unable to allocate memory for tasklet");
+		*tasklet_info = NULL;
+		return -ENOMEM;
+	}
+
+	tasklet->ctx_priv = hw_mgr_ctx;
+	tasklet->index = idx;
+	spin_lock_init(&tasklet->tasklet_lock);
+	memset(tasklet->cmd_queue, 0, sizeof(tasklet->cmd_queue));
+	INIT_LIST_HEAD(&tasklet->free_cmd_list);
+	INIT_LIST_HEAD(&tasklet->used_cmd_list);
+	for (i = 0; i < CAM_TASKLETQ_SIZE; i++) {
+		INIT_LIST_HEAD(&tasklet->cmd_queue[i].list);
+		list_add_tail(&tasklet->cmd_queue[i].list,
+			&tasklet->free_cmd_list);
+	}
+	tasklet_init(&tasklet->tasklet, cam_tasklet_action,
+		(unsigned long)tasklet);
+	tasklet_disable(&tasklet->tasklet);
+
+	*tasklet_info = tasklet;
+
+	return 0;
+}
+
+void cam_tasklet_deinit(void    **tasklet_info)
+{
+	struct cam_tasklet_info *tasklet = *tasklet_info;
+
+	if (atomic_read(&tasklet->tasklet_active)) {
+		atomic_set(&tasklet->tasklet_active, 0);
+		tasklet_kill(&tasklet->tasklet);
+		tasklet_disable(&tasklet->tasklet);
+	}
+	kfree(tasklet);
+	*tasklet_info = NULL;
+}
+
+static inline void cam_tasklet_flush(struct cam_tasklet_info *tasklet_info)
+{
+	cam_tasklet_action((unsigned long) tasklet_info);
+}
+
+int cam_tasklet_start(void  *tasklet_info)
+{
+	struct cam_tasklet_info       *tasklet = tasklet_info;
+	int i = 0;
+
+	if (atomic_read(&tasklet->tasklet_active)) {
+		CAM_ERR(CAM_ISP, "Tasklet already active idx:%d",
+			tasklet->index);
+		return -EBUSY;
+	}
+
+	/* clean up the command queue first */
+	for (i = 0; i < CAM_TASKLETQ_SIZE; i++) {
+		list_del_init(&tasklet->cmd_queue[i].list);
+		list_add_tail(&tasklet->cmd_queue[i].list,
+			&tasklet->free_cmd_list);
+	}
+
+	atomic_set(&tasklet->tasklet_active, 1);
+
+	tasklet_enable(&tasklet->tasklet);
+
+	return 0;
+}
+
+void cam_tasklet_stop(void  *tasklet_info)
+{
+	struct cam_tasklet_info  *tasklet = tasklet_info;
+
+	if (!atomic_read(&tasklet->tasklet_active))
+		return;
+
+	atomic_set(&tasklet->tasklet_active, 0);
+	tasklet_kill(&tasklet->tasklet);
+	tasklet_disable(&tasklet->tasklet);
+	cam_tasklet_flush(tasklet);
+}
+
+/*
+ * cam_tasklet_action()
+ *
+ * @brief:              Process function that will be called  when tasklet runs
+ *                      on CPU
+ *
+ * @data:               Tasklet Info structure that is passed in tasklet_init
+ *
+ * @return:             Void
+ */
+static void cam_tasklet_action(unsigned long data)
+{
+	struct cam_tasklet_info          *tasklet_info = NULL;
+	struct cam_tasklet_queue_cmd     *tasklet_cmd = NULL;
+	ktime_t                           curr_time;
+
+	tasklet_info = (struct cam_tasklet_info *)data;
+
+	while (!cam_tasklet_dequeue_cmd(tasklet_info, &tasklet_cmd)) {
+		cam_common_util_thread_switch_delay_detect(
+			"Tasklet schedule",
+			tasklet_cmd->tasklet_enqueue_ts,
+			CAM_TASKLET_SCHED_TIME_THRESHOLD);
+		curr_time = ktime_get();
+
+		tasklet_cmd->bottom_half_handler(tasklet_cmd->handler_priv,
+			tasklet_cmd->payload);
+
+		cam_common_util_thread_switch_delay_detect(
+			"Tasklet execution",
+			curr_time,
+			CAM_TASKLET_EXE_TIME_THRESHOLD);
+		cam_tasklet_put_cmd(tasklet_info, (void **)(&tasklet_cmd));
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/include/cam_isp_packet_parser.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/include/cam_isp_packet_parser.h
@@ -0,0 +1,252 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_HW_PARSER_H_
+#define _CAM_ISP_HW_PARSER_H_
+
+#include <linux/types.h>
+#include <media/cam_isp.h>
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw_mgr.h"
+#include "cam_hw_intf.h"
+#include "cam_packet_util.h"
+#include "cam_cdm_intf_api.h"
+
+/* enum cam_isp_cdm_bl_type - isp cdm packet type*/
+enum cam_isp_cdm_bl_type {
+	CAM_ISP_UNUSED_BL,
+	CAM_ISP_IQ_BL,
+	CAM_ISP_IOCFG_BL,
+	CAM_ISP_BL_MAX,
+};
+
+/*
+ * struct cam_isp_generic_blob_info
+ *
+ * @prepare:            Payload for prepare command
+ * @base_info:          Base hardware information for the context
+ * @kmd_buf_info:       Kmd buffer to store the custom cmd data
+ */
+struct cam_isp_generic_blob_info {
+	struct cam_hw_prepare_update_args     *prepare;
+	struct cam_isp_ctx_base_info          *base_info;
+	struct cam_kmd_buf_info               *kmd_buf_info;
+};
+
+/*
+ * struct cam_isp_frame_header_info
+ *
+ * @frame_header_enable:    Enable frame header
+ * @frame_header_iova_addr: frame header iova
+ * @frame_header_res_id:    res id for which frame header is enabled
+ */
+struct cam_isp_frame_header_info {
+	bool                     frame_header_enable;
+	uint64_t                 frame_header_iova_addr;
+	uint32_t                 frame_header_res_id;
+};
+
+/*
+ * struct cam_isp_change_base_args
+ *
+ * @cdm_id:       CDM id
+ * @base_idx:     Base index
+ */
+struct cam_isp_change_base_args {
+	enum cam_cdm_id  cdm_id;
+	uint32_t         base_idx;
+};
+
+/*
+ * cam_isp_add_change_base()
+ *
+ * @brief                  Add change base in the hw entries list
+ *                         processe the isp source list get the change base from
+ *                         ISP HW instance
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @res_list_isp_src:      Resource list for IFE/VFE source
+ * @change_base_args:      Arguments for Change base function
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_change_base(
+	struct cam_hw_prepare_update_args     *prepare,
+	struct list_head                      *res_list_isp_src,
+	struct cam_isp_change_base_args       *change_base_args,
+	struct cam_kmd_buf_info               *kmd_buf_info);
+
+/*
+ * cam_isp_add_cmd_buf_update()
+ *
+ * @brief                  Add command buffer in the HW entries list for given
+ *                         Blob Data.
+ *
+ * @hw_mgr_res:            HW resource to get the update from
+ * @cmd_type:              Cmd type to get update for
+ * @hw_cmd_type:           HW Cmd type corresponding to cmd_type
+ * @base_idx:              Base hardware index
+ * @cmd_buf_addr:          Cpu buf addr of kmd scratch buffer
+ * @kmd_buf_remain_size:   Remaining size left for cmd buffer update
+ * @cmd_update_data:       Data needed by HW to process the cmd and provide
+ *                         cmd buffer
+ * @bytes_used:            Address of the field to be populated with
+ *                         total bytes used as output to caller
+ *
+ * @return:                Negative for Failure
+ *                         otherwise returns bytes used
+ */
+int cam_isp_add_cmd_buf_update(
+	struct cam_isp_hw_mgr_res            *hw_mgr_res,
+	uint32_t                              cmd_type,
+	uint32_t                              hw_cmd_type,
+	uint32_t                              base_idx,
+	uint32_t                             *cmd_buf_addr,
+	uint32_t                              kmd_buf_remain_size,
+	void                                 *cmd_update_data,
+	uint32_t                             *bytes_used);
+
+/*
+ * cam_isp_add_command_buffers()
+ *
+ * @brief                  Add command buffer in the HW entries list for given
+ *                         left or right VFE/IFE instance.
+ *
+ * @prepare:               Contain the packet and HW update variables
+ * @kmd_buf_info:          KMD buffer to store the custom cmd data
+ * @base_info:             base hardware information
+ * @blob_handler_cb:       Call_back_function for Meta handling
+ * @res_list_isp_out:      IFE /VFE out resource list
+ * @size_isp_out:          Size of the res_list_isp_out array
+ *
+ * @return:                0 for success
+ *                         Negative for Failure
+ */
+int cam_isp_add_command_buffers(
+	struct cam_hw_prepare_update_args  *prepare,
+	struct cam_kmd_buf_info            *kmd_buf_info,
+	struct cam_isp_ctx_base_info       *base_info,
+	cam_packet_generic_blob_handler     blob_handler_cb,
+	struct cam_isp_hw_mgr_res          *res_list_isp_out,
+	uint32_t                            size_isp_out);
+
+/*
+ * cam_isp_add_io_buffers()
+ *
+ * @brief                  Add io buffer configurations in the HW entries list
+ *                         processe the io configurations based on the base
+ *                         index and update the HW entries list
+ *
+ * @iommu_hdl:             Iommu handle to get the IO buf from memory manager
+ * @sec_iommu_hdl:         Secure iommu handle to get the IO buf from
+ *                         memory manager
+ * @prepare:               Contain the  packet and HW update variables
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @res_list_isp_out:      IFE /VFE out resource list
+ * @res_list_ife_in_rd:    IFE /VFE in rd resource list
+ * @size_isp_out:          Size of the res_list_isp_out array
+ * @fill_fence:            If true, Fence map table will be filled
+ * @frame_header_info:     Frame header related params
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_io_buffers(
+	int                                   iommu_hdl,
+	int                                   sec_iommu_hdl,
+	struct cam_hw_prepare_update_args    *prepare,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	struct cam_isp_hw_mgr_res            *res_list_isp_out,
+	struct list_head                     *res_list_ife_in_rd,
+	uint32_t                              size_isp_out,
+	bool                                  fill_fence,
+	struct cam_isp_frame_header_info     *frame_header_info);
+
+/*
+ * cam_isp_add_reg_update()
+ *
+ * @brief                  Add reg update in the hw entries list
+ *                         processe the isp source list get the reg update from
+ *                         ISP HW instance
+ *
+ * @prepare:               Contain the  packet and HW update variables
+ * @res_list_isp_src:      Resource list for IFE/VFE source
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_reg_update(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info);
+
+/*
+ * cam_isp_add_comp_wait()
+ *
+ * @brief                  Add reg update in the hw entries list
+ *                         processe the isp source list get the reg update from
+ *                         ISP HW instance
+ *
+ * @prepare:               Contain the  packet and HW update variables
+ * @res_list_isp_src:      Resource list for IFE/VFE source
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_comp_wait(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info);
+
+/*
+ * cam_isp_add_wait_trigger()
+ *
+ * @brief                  Add reg update in the hw entries list
+ *                         processe the isp source list get the reg update from
+ *                         ISP HW instance
+ *
+ * @prepare:               Contain the  packet and HW update variables
+ * @res_list_isp_src:      Resource list for IFE/VFE source
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @trigger_cdm_en         Used to reset and set trigger_cdm_events register
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_wait_trigger(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_src,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	bool                                  trigger_cdm_en);
+
+
+/*
+ * cam_isp_add_go_cmd()
+ *
+ * @brief                  Add go_cmd in the hw entries list for each rd source
+ *
+ * @prepare:               Contain the  packet and HW update variables
+ * @res_list_isp_rd:       Resource list for BUS RD ports
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_go_cmd(
+	struct cam_hw_prepare_update_args    *prepare,
+	struct list_head                     *res_list_isp_rd,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info);
+
+#endif /*_CAM_ISP_HW_PARSER_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/include/cam_tasklet_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/include/cam_tasklet_util.h
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TASKLET_UTIL_H_
+#define _CAM_TASKLET_UTIL_H_
+
+#include "cam_irq_controller.h"
+
+/*
+ * cam_tasklet_init()
+ *
+ * @brief:              Initialize the tasklet info structure
+ *
+ * @tasklet:            Tasklet to initialize
+ * @hw_mgr_ctx:         Private Ctx data that will be passed to the handler
+ *                      function
+ * @idx:                Index of tasklet used as identity
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_tasklet_init(
+	void                   **tasklet,
+	void                    *hw_mgr_ctx,
+	uint32_t                 idx);
+
+/*
+ * cam_tasklet_deinit()
+ *
+ * @brief:              Deinitialize the tasklet info structure
+ *
+ * @tasklet:            Tasklet to deinitialize
+ *
+ * @return:             Void
+ */
+void cam_tasklet_deinit(void   **tasklet);
+
+/*
+ * cam_tasklet_start()
+ *
+ * @brief:              Enable the tasklet to be scheduled and run.
+ *                      Caller should make sure this function is called
+ *                      before trying to enqueue.
+ *
+ * @tasklet:            Tasklet to start
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_tasklet_start(void    *tasklet);
+
+/*
+ * cam_tasklet_stop()
+ *
+ * @brief:              Disable the tasklet so it can no longer be scheduled.
+ *                      Need to enable again to run.
+ *
+ * @tasklet:            Tasklet to stop
+ *
+ * @return:             Void
+ */
+void cam_tasklet_stop(void    *tasklet);
+
+/*
+ * cam_tasklet_enqueue_cmd()
+ *
+ * @brief:               Enqueue the tasklet_cmd to used list
+ *
+ * @bottom_half:         Tasklet info to enqueue onto
+ * @bh_cmd:              Tasklet cmd used to enqueue task
+ * @handler_priv:        Private Handler data that will be passed to the
+ *                       handler function
+ * @evt_payload_priv:    Event payload that will be passed to the handler
+ *                       function
+ * @bottom_half_handler: Callback function that will be called by tasklet
+ *                       for handling event
+ *
+ * @return:              Void
+ */
+void cam_tasklet_enqueue_cmd(
+	void                              *bottom_half,
+	void                              *bh_cmd,
+	void                              *handler_priv,
+	void                              *evt_payload_priv,
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler);
+
+/**
+ * cam_tasklet_get_cmd()
+ *
+ * @brief:              Get free cmd from tasklet
+ *
+ * @bottom_half:        Tasklet Info structure to get cmd from
+ * @bh_cmd:             Return tasklet_cmd pointer if successful
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_tasklet_get_cmd(void *bottom_half, void **bh_cmd);
+
+/**
+ * cam_tasklet_put_cmd()
+ *
+ * @brief:              Put back cmd to free list
+ *
+ * @bottom_half:        Tasklet Info structure to put cmd into
+ * @bh_cmd:             tasklet_cmd pointer that needs to be put back
+ *
+ * @return:             Void
+ */
+void cam_tasklet_put_cmd(void *bottom_half, void **bh_cmd);
+
+extern struct cam_irq_bh_api tasklet_bh_api;
+
+#endif /* _CAM_TASKLET_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.c
@@ -0,0 +1,761 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/list.h>
+#include <linux/ratelimit.h>
+
+#include "cam_io_util.h"
+#include "cam_irq_controller.h"
+#include "cam_debug_util.h"
+
+/**
+ * struct cam_irq_evt_handler:
+ * @Brief:                  Event handler information
+ *
+ * @priority:               Priority level of this event
+ * @evt_bit_mask_arr:       evt_bit_mask that has the bits set for IRQs to
+ *                          subscribe for
+ * @handler_priv:           Private data that will be passed to the Top/Bottom
+ *                          Half handler function
+ * @top_half_handler:       Top half Handler callback function
+ * @bottom_half_handler:    Bottom half Handler callback function
+ * @bottom_half:            Pointer to bottom_half implementation on which to
+ *                          enqueue the event for further handling
+ * @bottom_half_enqueue_func:
+ *                          Function used to enqueue the bottom_half event
+ * @list_node:              list_head struct used for overall handler List
+ * @th_list_node:           list_head struct used for top half handler List
+ */
+struct cam_irq_evt_handler {
+	enum cam_irq_priority_level        priority;
+	uint32_t                          *evt_bit_mask_arr;
+	void                              *handler_priv;
+	CAM_IRQ_HANDLER_TOP_HALF           top_half_handler;
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler;
+	void                              *bottom_half;
+	struct cam_irq_bh_api              irq_bh_api;
+	struct list_head                   list_node;
+	struct list_head                   th_list_node;
+	int                                index;
+};
+
+/**
+ * struct cam_irq_register_obj:
+ * @Brief:                  Structure containing information related to
+ *                          a particular register Set
+ *
+ * @index:                  Index of set in Array
+ * @mask_reg_offset:        Offset of IRQ MASK register
+ * @clear_reg_offset:       Offset of IRQ CLEAR register
+ * @status_reg_offset:      Offset of IRQ STATUS register
+ * @top_half_enable_mask:   Array of enabled bit_mask sorted by priority
+ * @pclear_mask:            Partial mask to be cleared in case entire status
+ *                          register is not to be cleared
+ */
+struct cam_irq_register_obj {
+	uint32_t                     index;
+	uint32_t                     mask_reg_offset;
+	uint32_t                     clear_reg_offset;
+	uint32_t                     status_reg_offset;
+	uint32_t                     top_half_enable_mask[CAM_IRQ_PRIORITY_MAX];
+	uint32_t                     pclear_mask;
+};
+
+/**
+ * struct cam_irq_controller:
+ *
+ * @brief:                  IRQ Controller structure.
+ *
+ * @name:                   Name of IRQ Controller block
+ * @mem_base:               Mapped base address of register space to which
+ *                          register offsets are added to access registers
+ * @num_registers:          Number of sets(mask/clear/status) of IRQ registers
+ * @irq_register_arr:       Array of Register object associated with this
+ *                          Controller
+ * @irq_status_arr:         Array of IRQ Status values
+ * @global_clear_offset:    Offset of Global IRQ Clear register. This register
+ *                          contains the BIT that needs to be set for the CLEAR
+ *                          to take effect
+ * @global_clear_bitmask:   Bitmask needed to be used in Global Clear register
+ *                          for Clear IRQ cmd to take effect
+ * @evt_handler_list_head:  List of all event handlers
+ * @th_list_head:           List of handlers sorted by priority
+ * @hdl_idx:                Unique identity of handler assigned on Subscribe.
+ *                          Used to Unsubscribe.
+ * @lock:                   Lock for use by controller
+ * @clear_all:              Flag to indicate whether to clear entire status
+ *                          register
+ */
+struct cam_irq_controller {
+	const char                     *name;
+	void __iomem                   *mem_base;
+	uint32_t                        num_registers;
+	struct cam_irq_register_obj    *irq_register_arr;
+	uint32_t                       *irq_status_arr;
+	uint32_t                        global_clear_offset;
+	uint32_t                        global_clear_bitmask;
+	struct list_head                evt_handler_list_head;
+	struct list_head                th_list_head[CAM_IRQ_PRIORITY_MAX];
+	uint32_t                        hdl_idx;
+	spinlock_t                      lock;
+	struct cam_irq_th_payload       th_payload;
+	bool                            clear_all;
+};
+
+int cam_irq_controller_deinit(void **irq_controller)
+{
+	struct cam_irq_controller *controller = *irq_controller;
+	struct cam_irq_evt_handler *evt_handler = NULL;
+
+	while (!list_empty(&controller->evt_handler_list_head)) {
+		evt_handler = list_first_entry(
+			&controller->evt_handler_list_head,
+			struct cam_irq_evt_handler, list_node);
+		list_del_init(&evt_handler->list_node);
+		kfree(evt_handler->evt_bit_mask_arr);
+		kfree(evt_handler);
+	}
+
+	kfree(controller->th_payload.evt_status_arr);
+	kfree(controller->irq_status_arr);
+	kfree(controller->irq_register_arr);
+	kfree(controller);
+	*irq_controller = NULL;
+	return 0;
+}
+
+int cam_irq_controller_init(const char       *name,
+	void __iomem                         *mem_base,
+	struct cam_irq_controller_reg_info   *register_info,
+	void                                **irq_controller,
+	bool                                  clear_all)
+{
+	struct cam_irq_controller *controller = NULL;
+	int i, rc = 0;
+
+	*irq_controller = NULL;
+
+	if (!register_info->num_registers || !register_info->irq_reg_set ||
+		!name || !mem_base) {
+		CAM_ERR(CAM_IRQ_CTRL, "Invalid parameters");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	controller = kzalloc(sizeof(struct cam_irq_controller), GFP_KERNEL);
+	if (!controller) {
+		CAM_DBG(CAM_IRQ_CTRL, "Failed to allocate IRQ Controller");
+		return -ENOMEM;
+	}
+
+	controller->irq_register_arr = kzalloc(register_info->num_registers *
+		sizeof(struct cam_irq_register_obj), GFP_KERNEL);
+	if (!controller->irq_register_arr) {
+		CAM_DBG(CAM_IRQ_CTRL, "Failed to allocate IRQ register Arr");
+		rc = -ENOMEM;
+		goto reg_alloc_error;
+	}
+
+	controller->irq_status_arr = kzalloc(register_info->num_registers *
+		sizeof(uint32_t), GFP_KERNEL);
+	if (!controller->irq_status_arr) {
+		CAM_DBG(CAM_IRQ_CTRL, "Failed to allocate IRQ status Arr");
+		rc = -ENOMEM;
+		goto status_alloc_error;
+	}
+
+	controller->th_payload.evt_status_arr =
+		kzalloc(register_info->num_registers * sizeof(uint32_t),
+		GFP_KERNEL);
+	if (!controller->th_payload.evt_status_arr) {
+		CAM_DBG(CAM_IRQ_CTRL,
+			"Failed to allocate BH payload bit mask Arr");
+		rc = -ENOMEM;
+		goto evt_mask_alloc_error;
+	}
+
+	controller->name = name;
+
+	CAM_DBG(CAM_IRQ_CTRL, "num_registers: %d",
+		register_info->num_registers);
+	for (i = 0; i < register_info->num_registers; i++) {
+		controller->irq_register_arr[i].index = i;
+		controller->irq_register_arr[i].mask_reg_offset =
+			register_info->irq_reg_set[i].mask_reg_offset;
+		controller->irq_register_arr[i].clear_reg_offset =
+			register_info->irq_reg_set[i].clear_reg_offset;
+		controller->irq_register_arr[i].status_reg_offset =
+			register_info->irq_reg_set[i].status_reg_offset;
+		CAM_DBG(CAM_IRQ_CTRL, "i %d mask_reg_offset: 0x%x", i,
+			controller->irq_register_arr[i].mask_reg_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "i %d clear_reg_offset: 0x%x", i,
+			controller->irq_register_arr[i].clear_reg_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "i %d status_reg_offset: 0x%x", i,
+			controller->irq_register_arr[i].status_reg_offset);
+	}
+	controller->num_registers        = register_info->num_registers;
+	controller->global_clear_bitmask = register_info->global_clear_bitmask;
+	controller->global_clear_offset  = register_info->global_clear_offset;
+	controller->mem_base             = mem_base;
+	controller->clear_all            = clear_all;
+
+	CAM_DBG(CAM_IRQ_CTRL, "global_clear_bitmask: 0x%x",
+		controller->global_clear_bitmask);
+	CAM_DBG(CAM_IRQ_CTRL, "global_clear_offset: 0x%x",
+		controller->global_clear_offset);
+	CAM_DBG(CAM_IRQ_CTRL, "mem_base: %pK",
+		(void __iomem *)controller->mem_base);
+
+	INIT_LIST_HEAD(&controller->evt_handler_list_head);
+	for (i = 0; i < CAM_IRQ_PRIORITY_MAX; i++)
+		INIT_LIST_HEAD(&controller->th_list_head[i]);
+
+	spin_lock_init(&controller->lock);
+
+	controller->hdl_idx = 1;
+	*irq_controller = controller;
+
+	return rc;
+
+evt_mask_alloc_error:
+	kfree(controller->irq_status_arr);
+status_alloc_error:
+	kfree(controller->irq_register_arr);
+reg_alloc_error:
+	kfree(controller);
+
+	return rc;
+}
+
+int cam_irq_controller_subscribe_irq(void *irq_controller,
+	enum cam_irq_priority_level        priority,
+	uint32_t                          *evt_bit_mask_arr,
+	void                              *handler_priv,
+	CAM_IRQ_HANDLER_TOP_HALF           top_half_handler,
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler,
+	void                              *bottom_half,
+	struct cam_irq_bh_api             *irq_bh_api)
+{
+	struct cam_irq_controller  *controller  = irq_controller;
+	struct cam_irq_evt_handler *evt_handler = NULL;
+	int                         i;
+	int                         rc = 0;
+	uint32_t                    irq_mask;
+	unsigned long               flags = 0;
+	bool                        need_lock;
+
+	if (!controller || !handler_priv || !evt_bit_mask_arr) {
+		CAM_ERR(CAM_IRQ_CTRL,
+			"Inval params: ctlr=%pK hdl_priv=%pK bit_mask_arr=%pK",
+			controller, handler_priv, evt_bit_mask_arr);
+		return -EINVAL;
+	}
+
+	if (!top_half_handler) {
+		CAM_ERR(CAM_IRQ_CTRL, "Missing top half handler");
+		return -EINVAL;
+	}
+
+	if (bottom_half_handler &&
+		(!bottom_half || !irq_bh_api)) {
+		CAM_ERR(CAM_IRQ_CTRL,
+			"Invalid params: bh_handler=%pK bh=%pK bh_enq_f=%pK",
+			bottom_half_handler,
+			bottom_half,
+			irq_bh_api);
+		return -EINVAL;
+	}
+
+	if (irq_bh_api &&
+		(!irq_bh_api->bottom_half_enqueue_func ||
+		!irq_bh_api->get_bh_payload_func ||
+		!irq_bh_api->put_bh_payload_func)) {
+		CAM_ERR(CAM_IRQ_CTRL,
+			"Invalid: enqueue_func=%pK get_bh=%pK put_bh=%pK",
+			irq_bh_api->bottom_half_enqueue_func,
+			irq_bh_api->get_bh_payload_func,
+			irq_bh_api->put_bh_payload_func);
+		return -EINVAL;
+	}
+
+	if (priority >= CAM_IRQ_PRIORITY_MAX) {
+		CAM_ERR(CAM_IRQ_CTRL, "Invalid priority=%u, max=%u", priority,
+			CAM_IRQ_PRIORITY_MAX);
+		return -EINVAL;
+	}
+
+	evt_handler = kzalloc(sizeof(struct cam_irq_evt_handler), GFP_KERNEL);
+	if (!evt_handler) {
+		CAM_DBG(CAM_IRQ_CTRL, "Error allocating hlist_node");
+		return -ENOMEM;
+	}
+
+	evt_handler->evt_bit_mask_arr = kzalloc(sizeof(uint32_t) *
+		controller->num_registers, GFP_KERNEL);
+	if (!evt_handler->evt_bit_mask_arr) {
+		CAM_DBG(CAM_IRQ_CTRL, "Error allocating hlist_node");
+		rc = -ENOMEM;
+		goto free_evt_handler;
+	}
+
+	INIT_LIST_HEAD(&evt_handler->list_node);
+	INIT_LIST_HEAD(&evt_handler->th_list_node);
+
+	for (i = 0; i < controller->num_registers; i++)
+		evt_handler->evt_bit_mask_arr[i] = evt_bit_mask_arr[i];
+
+	evt_handler->priority                 = priority;
+	evt_handler->handler_priv             = handler_priv;
+	evt_handler->top_half_handler         = top_half_handler;
+	evt_handler->bottom_half_handler      = bottom_half_handler;
+	evt_handler->bottom_half              = bottom_half;
+	evt_handler->index                    = controller->hdl_idx++;
+
+	if (irq_bh_api)
+		evt_handler->irq_bh_api       = *irq_bh_api;
+
+	/* Avoid rollover to negative values */
+	if (controller->hdl_idx > 0x3FFFFFFF)
+		controller->hdl_idx = 1;
+
+	need_lock = !in_irq();
+	if (need_lock)
+		spin_lock_irqsave(&controller->lock, flags);
+	for (i = 0; i < controller->num_registers; i++) {
+		controller->irq_register_arr[i].top_half_enable_mask[priority]
+			|= evt_bit_mask_arr[i];
+
+		controller->irq_register_arr[i].pclear_mask
+			|= evt_bit_mask_arr[i];
+
+		irq_mask = cam_io_r_mb(controller->mem_base +
+			controller->irq_register_arr[i].mask_reg_offset);
+		irq_mask |= evt_bit_mask_arr[i];
+
+		cam_io_w_mb(irq_mask, controller->mem_base +
+			controller->irq_register_arr[i].mask_reg_offset);
+	}
+
+	list_add_tail(&evt_handler->list_node,
+		&controller->evt_handler_list_head);
+	list_add_tail(&evt_handler->th_list_node,
+		&controller->th_list_head[priority]);
+
+	if (need_lock)
+		spin_unlock_irqrestore(&controller->lock, flags);
+
+	return evt_handler->index;
+
+free_evt_handler:
+	kfree(evt_handler);
+	evt_handler = NULL;
+
+	return rc;
+}
+
+int cam_irq_controller_enable_irq(void *irq_controller, uint32_t handle)
+{
+	struct cam_irq_controller   *controller  = irq_controller;
+	struct cam_irq_evt_handler  *evt_handler = NULL;
+	struct cam_irq_evt_handler  *evt_handler_temp;
+	struct cam_irq_register_obj *irq_register = NULL;
+	enum cam_irq_priority_level priority;
+	unsigned long               flags = 0;
+	unsigned int                i;
+	uint32_t                    irq_mask;
+	uint32_t                    found = 0;
+	int                         rc = -EINVAL;
+	bool                        need_lock;
+
+	if (!controller)
+		return rc;
+
+	need_lock = !in_irq();
+	if (need_lock)
+		spin_lock_irqsave(&controller->lock, flags);
+
+	list_for_each_entry_safe(evt_handler, evt_handler_temp,
+		&controller->evt_handler_list_head, list_node) {
+		if (evt_handler->index == handle) {
+			CAM_DBG(CAM_IRQ_CTRL, "enable item %d", handle);
+			found = 1;
+			rc = 0;
+			break;
+		}
+	}
+
+	if (!found) {
+		if (need_lock)
+			spin_unlock_irqrestore(&controller->lock, flags);
+		return rc;
+	}
+
+	priority = evt_handler->priority;
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		irq_register->top_half_enable_mask[priority] |=
+			evt_handler->evt_bit_mask_arr[i];
+
+		irq_mask = cam_io_r_mb(controller->mem_base +
+			irq_register->mask_reg_offset);
+		irq_mask |= evt_handler->evt_bit_mask_arr[i];
+
+		cam_io_w_mb(irq_mask, controller->mem_base +
+		controller->irq_register_arr[i].mask_reg_offset);
+	}
+	if (need_lock)
+		spin_unlock_irqrestore(&controller->lock, flags);
+
+	return rc;
+}
+
+int cam_irq_controller_disable_irq(void *irq_controller, uint32_t handle)
+{
+	struct cam_irq_controller   *controller  = irq_controller;
+	struct cam_irq_evt_handler  *evt_handler = NULL;
+	struct cam_irq_evt_handler  *evt_handler_temp;
+	struct cam_irq_register_obj *irq_register;
+	enum cam_irq_priority_level priority;
+	unsigned long               flags = 0;
+	unsigned int                i;
+	uint32_t                    irq_mask;
+	uint32_t                    found = 0;
+	int                         rc = -EINVAL;
+	bool                        need_lock;
+
+	if (!controller)
+		return rc;
+
+	need_lock = !in_irq();
+	if (need_lock)
+		spin_lock_irqsave(&controller->lock, flags);
+
+	list_for_each_entry_safe(evt_handler, evt_handler_temp,
+		&controller->evt_handler_list_head, list_node) {
+		if (evt_handler->index == handle) {
+			CAM_DBG(CAM_IRQ_CTRL, "disable item %d", handle);
+			found = 1;
+			rc = 0;
+			break;
+		}
+	}
+
+	if (!found) {
+		if (need_lock)
+			spin_unlock_irqrestore(&controller->lock, flags);
+		return rc;
+	}
+
+	priority = evt_handler->priority;
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		irq_register->top_half_enable_mask[priority] &=
+			~(evt_handler->evt_bit_mask_arr[i]);
+
+		irq_mask = cam_io_r_mb(controller->mem_base +
+			irq_register->mask_reg_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "irq_mask 0x%x before disable 0x%x",
+			irq_register->mask_reg_offset, irq_mask);
+		irq_mask &= ~(evt_handler->evt_bit_mask_arr[i]);
+
+		cam_io_w_mb(irq_mask, controller->mem_base +
+			irq_register->mask_reg_offset);
+		CAM_DBG(CAM_IRQ_CTRL, "irq_mask 0x%x after disable 0x%x",
+			irq_register->mask_reg_offset, irq_mask);
+
+		/* Clear the IRQ bits of this handler */
+		cam_io_w_mb(evt_handler->evt_bit_mask_arr[i],
+			controller->mem_base +
+			irq_register->clear_reg_offset);
+
+		if (controller->global_clear_offset)
+			cam_io_w_mb(
+				controller->global_clear_bitmask,
+				controller->mem_base +
+				controller->global_clear_offset);
+	}
+	if (need_lock)
+		spin_unlock_irqrestore(&controller->lock, flags);
+
+	return rc;
+}
+
+int cam_irq_controller_unsubscribe_irq(void *irq_controller,
+	uint32_t handle)
+{
+	struct cam_irq_controller   *controller  = irq_controller;
+	struct cam_irq_evt_handler  *evt_handler = NULL;
+	struct cam_irq_evt_handler  *evt_handler_temp;
+	struct cam_irq_register_obj *irq_register;
+	enum cam_irq_priority_level priority;
+	uint32_t                    i;
+	uint32_t                    found = 0;
+	uint32_t                    irq_mask;
+	unsigned long               flags = 0;
+	int                         rc = -EINVAL;
+	bool                        need_lock;
+
+	need_lock = !in_irq();
+	if (need_lock)
+		spin_lock_irqsave(&controller->lock, flags);
+
+	list_for_each_entry_safe(evt_handler, evt_handler_temp,
+		&controller->evt_handler_list_head, list_node) {
+		if (evt_handler->index == handle) {
+			CAM_DBG(CAM_IRQ_CTRL, "unsubscribe item %d", handle);
+			list_del_init(&evt_handler->list_node);
+			list_del_init(&evt_handler->th_list_node);
+			found = 1;
+			rc = 0;
+			break;
+		}
+	}
+
+	if (found) {
+		priority = evt_handler->priority;
+		for (i = 0; i < controller->num_registers; i++) {
+			irq_register = &controller->irq_register_arr[i];
+			irq_register->top_half_enable_mask[priority] &=
+				~(evt_handler->evt_bit_mask_arr[i]);
+
+			irq_mask = cam_io_r_mb(controller->mem_base +
+				irq_register->mask_reg_offset);
+			irq_mask &= ~(evt_handler->evt_bit_mask_arr[i]);
+
+			cam_io_w_mb(irq_mask, controller->mem_base +
+				irq_register->mask_reg_offset);
+
+			/* Clear the IRQ bits of this handler */
+			cam_io_w_mb(evt_handler->evt_bit_mask_arr[i],
+				controller->mem_base +
+				irq_register->clear_reg_offset);
+			if (controller->global_clear_offset)
+				cam_io_w_mb(
+					controller->global_clear_bitmask,
+					controller->mem_base +
+					controller->global_clear_offset);
+		}
+
+		kfree(evt_handler->evt_bit_mask_arr);
+		kfree(evt_handler);
+	}
+
+	if (need_lock)
+		spin_unlock_irqrestore(&controller->lock, flags);
+
+	return rc;
+}
+
+/**
+ * cam_irq_controller_match_bit_mask()
+ *
+ * @Brief:                This function checks if any of the enabled IRQ bits
+ *                        for a certain handler is Set in the Status values
+ *                        of the controller.
+ *
+ * @controller:           IRQ Controller structure
+ * @evt_handler:          Event handler structure
+ *
+ * @Return:               True: If any interested IRQ Bit is Set
+ *                        False: Otherwise
+ */
+static bool cam_irq_controller_match_bit_mask(
+	struct cam_irq_controller   *controller,
+	struct cam_irq_evt_handler  *evt_handler)
+{
+	int i;
+
+	for (i = 0; i < controller->num_registers; i++) {
+		if (evt_handler->evt_bit_mask_arr[i] &
+			controller->irq_status_arr[i])
+			return true;
+	}
+
+	return false;
+}
+
+static void cam_irq_controller_th_processing(
+	struct cam_irq_controller      *controller,
+	struct list_head               *th_list_head)
+{
+	struct cam_irq_evt_handler     *evt_handler = NULL;
+	struct cam_irq_th_payload      *th_payload = &controller->th_payload;
+	bool                            is_irq_match;
+	int                             rc = -EINVAL;
+	int                             i;
+	void                           *bh_cmd = NULL;
+	struct cam_irq_bh_api          *irq_bh_api = NULL;
+
+	CAM_DBG(CAM_IRQ_CTRL, "Enter");
+
+	if (list_empty(th_list_head))
+		return;
+
+	list_for_each_entry(evt_handler, th_list_head, th_list_node) {
+		is_irq_match = cam_irq_controller_match_bit_mask(controller,
+			evt_handler);
+
+		if (!is_irq_match)
+			continue;
+
+		CAM_DBG(CAM_IRQ_CTRL, "match found");
+
+		cam_irq_th_payload_init(th_payload);
+		th_payload->handler_priv  = evt_handler->handler_priv;
+		th_payload->num_registers = controller->num_registers;
+		for (i = 0; i < controller->num_registers; i++) {
+			th_payload->evt_status_arr[i] =
+				controller->irq_status_arr[i] &
+				evt_handler->evt_bit_mask_arr[i];
+		}
+
+		irq_bh_api = &evt_handler->irq_bh_api;
+		bh_cmd = NULL;
+
+		if (evt_handler->bottom_half_handler) {
+			rc = irq_bh_api->get_bh_payload_func(
+				evt_handler->bottom_half, &bh_cmd);
+			if (rc || !bh_cmd) {
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"No payload, IRQ handling frozen for %s",
+					controller->name);
+				continue;
+			}
+		}
+
+		/*
+		 * irq_status_arr[0] is dummy argument passed. the entire
+		 * status array is passed in th_payload.
+		 */
+		if (evt_handler->top_half_handler)
+			rc = evt_handler->top_half_handler(
+				controller->irq_status_arr[0],
+				(void *)th_payload);
+
+		if (rc && bh_cmd) {
+			irq_bh_api->put_bh_payload_func(
+				evt_handler->bottom_half, &bh_cmd);
+			continue;
+		}
+
+		if (evt_handler->bottom_half_handler) {
+			CAM_DBG(CAM_IRQ_CTRL, "Enqueuing bottom half for %s",
+				controller->name);
+			irq_bh_api->bottom_half_enqueue_func(
+				evt_handler->bottom_half,
+				bh_cmd,
+				evt_handler->handler_priv,
+				th_payload->evt_payload_priv,
+				evt_handler->bottom_half_handler);
+		}
+	}
+
+	CAM_DBG(CAM_IRQ_CTRL, "Exit");
+}
+
+irqreturn_t cam_irq_controller_clear_and_mask(int irq_num, void *priv)
+{
+	struct cam_irq_controller  *controller  = priv;
+	uint32_t i = 0;
+
+	if (!controller)
+		return IRQ_NONE;
+
+	for (i = 0; i < controller->num_registers; i++) {
+
+		cam_io_w_mb(0x0, controller->mem_base +
+			controller->irq_register_arr[i].clear_reg_offset);
+	}
+
+	if (controller->global_clear_offset)
+		cam_io_w_mb(controller->global_clear_bitmask,
+			controller->mem_base +
+			controller->global_clear_offset);
+
+	for (i = 0; i < controller->num_registers; i++) {
+		cam_io_w_mb(0x0, controller->mem_base +
+		controller->irq_register_arr[i].mask_reg_offset);
+	}
+
+	return IRQ_HANDLED;
+}
+
+irqreturn_t cam_irq_controller_handle_irq(int irq_num, void *priv)
+{
+	struct cam_irq_controller   *controller  = priv;
+	struct cam_irq_register_obj *irq_register;
+	bool         need_th_processing[CAM_IRQ_PRIORITY_MAX] = {false};
+	int          i;
+	int          j;
+
+	if (!controller)
+		return IRQ_NONE;
+
+	CAM_DBG(CAM_IRQ_CTRL,
+		"Locking: %s IRQ Controller: [%pK], lock handle: %pK",
+		controller->name, controller, &controller->lock);
+	spin_lock(&controller->lock);
+	for (i = 0; i < controller->num_registers; i++) {
+		irq_register = &controller->irq_register_arr[i];
+		controller->irq_status_arr[i] = cam_io_r_mb(
+			controller->mem_base + irq_register->status_reg_offset);
+
+		if (controller->clear_all)
+			cam_io_w_mb(controller->irq_status_arr[i],
+				controller->mem_base +
+				irq_register->clear_reg_offset);
+		else
+			cam_io_w_mb(
+				controller->irq_register_arr[i].pclear_mask &
+				controller->irq_status_arr[i],
+				controller->mem_base +
+				irq_register->clear_reg_offset);
+
+		CAM_DBG(CAM_IRQ_CTRL, "Read irq status%d (0x%x) = 0x%x", i,
+			controller->irq_register_arr[i].status_reg_offset,
+			controller->irq_status_arr[i]);
+		for (j = 0; j < CAM_IRQ_PRIORITY_MAX; j++) {
+			if (irq_register->top_half_enable_mask[j] &
+				controller->irq_status_arr[i])
+				need_th_processing[j] = true;
+
+			CAM_DBG(CAM_IRQ_CTRL,
+				"i %d j %d need_th_processing = %d",
+				i, j, need_th_processing[j]);
+		}
+	}
+
+	CAM_DBG(CAM_IRQ_CTRL, "Status Registers read Successful");
+
+	if (controller->global_clear_offset) {
+		cam_io_w_mb(controller->global_clear_bitmask,
+			controller->mem_base + controller->global_clear_offset);
+		for (i = 0; i < controller->num_registers; i++) {
+			irq_register = &controller->irq_register_arr[i];
+			if (controller->irq_status_arr[i])
+				cam_io_w_mb(0x0, controller->mem_base +
+					irq_register->clear_reg_offset);
+		}
+
+		CAM_DBG(CAM_IRQ_CTRL, "Global Clear done from %s",
+			controller->name);
+	}
+
+	for (i = 0; i < CAM_IRQ_PRIORITY_MAX; i++) {
+		if (need_th_processing[i]) {
+			CAM_DBG(CAM_IRQ_CTRL, "Invoke TH processing");
+			cam_irq_controller_th_processing(controller,
+				&controller->th_list_head[i]);
+		}
+	}
+	spin_unlock(&controller->lock);
+	CAM_DBG(CAM_IRQ_CTRL,
+		"Unlocked: %s IRQ Controller: %pK, lock handle: %pK",
+		controller->name, controller, &controller->lock);
+
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/hw_utils/irq_controller/cam_irq_controller.h
@@ -0,0 +1,274 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IRQ_CONTROLLER_H_
+#define _CAM_IRQ_CONTROLLER_H_
+
+#include <linux/interrupt.h>
+
+#define CAM_IRQ_BITS_PER_REGISTER      32
+
+/*
+ * enum cam_irq_priority_level:
+ * @Brief:                  Priority levels for IRQ events.
+ *                          Priority_0 events will be serviced before
+ *                          Priority_1 if they these bits are set in the same
+ *                          Status Read. And so on upto Priority_4.
+ *
+ *                          Default Priority is Priority_4.
+ */
+enum cam_irq_priority_level {
+	CAM_IRQ_PRIORITY_0,
+	CAM_IRQ_PRIORITY_1,
+	CAM_IRQ_PRIORITY_2,
+	CAM_IRQ_PRIORITY_3,
+	CAM_IRQ_PRIORITY_4,
+	CAM_IRQ_PRIORITY_MAX,
+};
+
+/*
+ * struct cam_irq_register_set:
+ * @Brief:                  Structure containing offsets of IRQ related
+ *                          registers belonging to a Set
+ *
+ * @mask_reg_offset:        Offset of IRQ MASK register
+ * @clear_reg_offset:       Offset of IRQ CLEAR register
+ * @status_reg_offset:      Offset of IRQ STATUS register
+ */
+struct cam_irq_register_set {
+	uint32_t                       mask_reg_offset;
+	uint32_t                       clear_reg_offset;
+	uint32_t                       status_reg_offset;
+};
+
+/*
+ * struct cam_irq_controller_reg_info:
+ * @Brief:                  Structure describing the IRQ registers
+ *
+ * @num_registers:          Number of sets(mask/clear/status) of IRQ registers
+ * @irq_reg_set:            Array of Register Set Offsets.
+ *                          Length of array = num_registers
+ * @global_clear_offset:    Offset of Global IRQ Clear register. This register
+ *                          contains the BIT that needs to be set for the CLEAR
+ *                          to take effect
+ * @global_clear_bitmask:   Bitmask needed to be used in Global Clear register
+ *                          for Clear IRQ cmd to take effect
+ */
+struct cam_irq_controller_reg_info {
+	uint32_t                      num_registers;
+	struct cam_irq_register_set  *irq_reg_set;
+	uint32_t                      global_clear_offset;
+	uint32_t                      global_clear_bitmask;
+};
+
+/*
+ * struct cam_irq_th_payload:
+ * @Brief:                  Event payload structure. This structure will be
+ *                          passed to the Top Half handler functions.
+ *
+ * @handler_priv:           Private Data of handling object set when
+ *                          subscribing to IRQ event.
+ * @num_registers:          Length of evt_bit_mask Array below
+ * @evt_status_arr:         Array of Status bitmask read from registers.
+ *                          Length of array = num_registers
+ * @evt_payload_priv:       Private payload pointer which can be set by Top
+ *                          Half handler for use in Bottom Half.
+ */
+struct cam_irq_th_payload {
+	void       *handler_priv;
+	uint32_t    num_registers;
+	uint32_t   *evt_status_arr;
+	void       *evt_payload_priv;
+};
+
+/*
+ * cam_irq_th_payload_init()
+ *
+ * @brief:              Initialize the top half payload structure
+ *
+ * @th_payload:         Top Half payload structure to Initialize
+ *
+ * @return:             Void
+ */
+static inline void cam_irq_th_payload_init(
+	struct cam_irq_th_payload *th_payload) {
+	th_payload->handler_priv = NULL;
+	th_payload->evt_payload_priv = NULL;
+}
+
+typedef int (*CAM_IRQ_HANDLER_TOP_HALF)(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload);
+
+typedef int (*CAM_IRQ_HANDLER_BOTTOM_HALF)(void *handler_priv,
+	void *evt_payload_priv);
+
+typedef void (*CAM_IRQ_BOTTOM_HALF_ENQUEUE_FUNC)(void *bottom_half,
+	void *bh_cmd, void *handler_priv, void *evt_payload_priv,
+	CAM_IRQ_HANDLER_BOTTOM_HALF);
+
+typedef int (*CAM_IRQ_GET_TASKLET_PAYLOAD_FUNC)(void *bottom_half,
+	void **bh_cmd);
+
+typedef void (*CAM_IRQ_PUT_TASKLET_PAYLOAD_FUNC)(void *bottom_half,
+	void **bh_cmd);
+
+struct cam_irq_bh_api {
+	CAM_IRQ_BOTTOM_HALF_ENQUEUE_FUNC bottom_half_enqueue_func;
+	CAM_IRQ_GET_TASKLET_PAYLOAD_FUNC get_bh_payload_func;
+	CAM_IRQ_PUT_TASKLET_PAYLOAD_FUNC put_bh_payload_func;
+};
+
+/*
+ * cam_irq_controller_init()
+ *
+ * @brief:              Create and Initialize IRQ Controller.
+ *
+ * @name:               Name of IRQ Controller block
+ * @mem_base:           Mapped base address of register space to which
+ *                      register offsets are added to access registers
+ * @register_info:      Register Info structure associated with this Controller
+ * @irq_controller:     Pointer to IRQ Controller that will be filled if
+ *                      initialization is successful
+ * @clear_all:          Flag to indicate whether to clear entire status register
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_irq_controller_init(const char       *name,
+	void __iomem                         *mem_base,
+	struct cam_irq_controller_reg_info   *register_info,
+	void                                **irq_controller,
+	bool                                  clear_all);
+
+/*
+ * cam_irq_controller_subscribe_irq()
+ *
+ * @brief:               Subscribe to certain IRQ events.
+ *
+ * @irq_controller:      Pointer to IRQ Controller that controls this event IRQ
+ * @priority:            Priority level of these events used if multiple events
+ *                       are SET in the Status Register
+ * @evt_bit_mask_arr:    evt_bit_mask that has the bits set for IRQs to
+ *                       subscribe for
+ * @handler_priv:        Private data that will be passed to the Top/Bottom Half
+ *                       handler function
+ * @top_half_handler:    Top half Handler callback function
+ * @bottom_half_handler: Bottom half Handler callback function
+ * @bottom_half:         Pointer to bottom_half implementation on which to
+ *                       enqueue the event for further handling
+ * @bottom_half_enqueue_func:
+ *                       Function used to enqueue the bottom_half event
+ *
+ * @return:              Positive: Success. Value represents handle which is
+ *                                 to be used to unsubscribe
+ *                       Negative: Failure
+ */
+int cam_irq_controller_subscribe_irq(void *irq_controller,
+	enum cam_irq_priority_level        priority,
+	uint32_t                          *evt_bit_mask_arr,
+	void                              *handler_priv,
+	CAM_IRQ_HANDLER_TOP_HALF           top_half_handler,
+	CAM_IRQ_HANDLER_BOTTOM_HALF        bottom_half_handler,
+	void                              *bottom_half,
+	struct cam_irq_bh_api             *irq_bh_api);
+
+/*
+ * cam_irq_controller_unsubscribe_irq()
+ *
+ * @brief:               Unsubscribe to IRQ events previously subscribed to.
+ *
+ * @irq_controller:      Pointer to IRQ Controller that controls this event IRQ
+ * @handle:              Handle returned on successful subscribe used to
+ *                       identify the handler object
+ *
+ * @return:              0: Success
+ *                       Negative: Failure
+ */
+int cam_irq_controller_unsubscribe_irq(void *irq_controller,
+	uint32_t handle);
+
+/*
+ * cam_irq_controller_deinit()
+ *
+ * @brief:              Deinitialize IRQ Controller.
+ *
+ * @irq_controller:     Pointer to IRQ Controller that needs to be
+ *                      deinitialized
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_irq_controller_deinit(void **irq_controller);
+
+/*
+ * cam_irq_controller_handle_irq()
+ *
+ * @brief:              Function that should be registered with the IRQ line.
+ *                      This is the first function to be called when the IRQ
+ *                      is fired. It will read the Status register and Clear
+ *                      the IRQ bits. It will then call the top_half handlers
+ *                      and enqueue the result to bottom_half.
+ *
+ * @irq_num:            Number of IRQ line that was set that lead to this
+ *                      function being called
+ * @priv:               Private data registered with request_irq is passed back
+ *                      here. This private data should be the irq_controller
+ *                      structure.
+ *
+ * @return:             IRQ_HANDLED/IRQ_NONE
+ */
+irqreturn_t cam_irq_controller_handle_irq(int irq_num, void *priv);
+
+/*
+ * cam_irq_controller_disable_irq()
+ *
+ * @brief:              Disable the interrupts on given controller.
+ *                      Unsubscribe will disable the IRQ by default, so this is
+ *                      only needed if between subscribe/unsubscribe there is
+ *                      need to disable IRQ again
+ *
+ * @irq_controller:     Pointer to IRQ Controller that controls the registered
+ *                      events to it.
+ * @handle:             Handle returned on successful subscribe, used to
+ *                      identify the handler object
+ *
+ * @return:             0: events found and disabled
+ *                      Negative: events not registered on this controller
+ */
+int cam_irq_controller_disable_irq(void *irq_controller, uint32_t handle);
+
+/*
+ * cam_irq_controller_enable_irq()
+ *
+ * @brief:              Enable the interrupts on given controller.
+ *                      Subscribe will enable the IRQ by default, so this is
+ *                      only needed if between subscribe/unsubscribe there is
+ *                      need to enable IRQ again
+ *
+ * @irq_controller:     Pointer to IRQ Controller that controls the registered
+ *                      events to it.
+ * @handle:             Handle returned on successful subscribe, used to
+ *                      identify the handler object
+ *
+ * @return:             0: events found and enabled
+ *                      Negative: events not registered on this controller
+ */
+int cam_irq_controller_enable_irq(void *irq_controller, uint32_t handle);
+
+/*
+ * cam_irq_controller_clear_and_mask()
+ *
+ * @brief:              This function clears and masks all the irq bits
+ *
+ * @irq_num:            Number of IRQ line that was set that lead to this
+ *                      function being called
+ * @priv:               Private data registered with request_irq is passed back
+ *                      here. This private data should be the irq_controller
+ *                      structure.
+ *
+ * @return:             IRQ_HANDLED/IRQ_NONE
+ */
+irqreturn_t cam_irq_controller_clear_and_mask(int irq_num, void *priv);
+#endif /* _CAM_IRQ_CONTROLLER_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/include/cam_isp_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/include/cam_isp_hw_mgr_intf.h
@@ -0,0 +1,304 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_HW_MGR_INTF_H_
+#define _CAM_ISP_HW_MGR_INTF_H_
+
+#include <linux/of.h>
+#include <linux/time.h>
+#include <linux/list.h>
+#include <media/cam_isp.h>
+#include "cam_hw_mgr_intf.h"
+
+/* MAX IFE instance */
+#define CAM_IFE_HW_NUM_MAX   7
+#define CAM_IFE_RDI_NUM_MAX  4
+#define CAM_ISP_BW_CONFIG_V1 1
+#define CAM_ISP_BW_CONFIG_V2 2
+#define CAM_TFE_HW_NUM_MAX   3
+#define CAM_TFE_RDI_NUM_MAX  3
+
+/* maximum context numbers for TFE */
+#define CAM_TFE_CTX_MAX      4
+
+/* maximum context numbers for IFE */
+#define CAM_IFE_CTX_MAX      8
+
+/* Appliacble vote paths for dual ife, based on no. of UAPI definitions */
+#define CAM_ISP_MAX_PER_PATH_VOTES 40
+
+/*
+ * Maximum configuration entry size  - This is based on the
+ * worst case DUAL IFE use case plus some margin.
+ */
+#define CAM_ISP_CTX_CFG_MAX                     25
+
+/**
+ *  enum cam_isp_hw_event_type - Collection of the ISP hardware events
+ */
+enum cam_isp_hw_event_type {
+	CAM_ISP_HW_EVENT_ERROR,
+	CAM_ISP_HW_EVENT_SOF,
+	CAM_ISP_HW_EVENT_REG_UPDATE,
+	CAM_ISP_HW_EVENT_EPOCH,
+	CAM_ISP_HW_EVENT_EOF,
+	CAM_ISP_HW_EVENT_DONE,
+	CAM_ISP_HW_EVENT_MAX
+};
+
+/**
+ * enum cam_isp_hw_err_type - Collection of the ISP error types for
+ *                         ISP hardware event CAM_ISP_HW_EVENT_ERROR
+ */
+enum cam_isp_hw_err_type {
+	CAM_ISP_HW_ERROR_NONE = 0x0001,
+	CAM_ISP_HW_ERROR_OVERFLOW = 0x0002,
+	CAM_ISP_HW_ERROR_P2I_ERROR = 0x0004,
+	CAM_ISP_HW_ERROR_VIOLATION = 0x0008,
+	CAM_ISP_HW_ERROR_BUSIF_OVERFLOW = 0x0010,
+	CAM_ISP_HW_ERROR_CSID_FATAL = 0x0020,
+	CAM_ISP_HW_ERROR_CSID_OVERFLOW = 0x0040,
+};
+
+/**
+ *  enum cam_isp_hw_stop_cmd - Specify the stop command type
+ */
+enum cam_isp_hw_stop_cmd {
+	CAM_ISP_HW_STOP_AT_FRAME_BOUNDARY,
+	CAM_ISP_HW_STOP_IMMEDIATELY,
+	CAM_ISP_HW_STOP_MAX,
+};
+
+/**
+ * struct cam_isp_stop_args - hardware stop arguments
+ *
+ * @hw_stop_cmd:               Hardware stop command type information
+ * @stop_only                  Send stop only to hw drivers. No Deinit to be
+ *                             done.
+ *
+ */
+struct cam_isp_stop_args {
+	enum cam_isp_hw_stop_cmd      hw_stop_cmd;
+	bool                          stop_only;
+};
+
+
+
+/**
+ * struct cam_isp_bw_config_internal_v2 - Bandwidth configuration
+ *
+ * @usage_type:                 ife hw index
+ * @num_paths:                  Number of data paths
+ * @axi_path                    per path vote info
+ */
+struct cam_isp_bw_config_internal_v2 {
+	uint32_t                          usage_type;
+	uint32_t                          num_paths;
+	struct cam_axi_per_path_bw_vote   axi_path[CAM_ISP_MAX_PER_PATH_VOTES];
+};
+
+/**
+ * struct cam_isp_bw_config_internal - Internal Bandwidth configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_rdi:                    Number of RDI votes
+ * @left_pix_vote:              Bandwidth vote for left ISP
+ * @right_pix_vote:             Bandwidth vote for right ISP
+ * @rdi_vote:                   RDI bandwidth requirements
+ */
+struct cam_isp_bw_config_internal {
+	uint32_t                       usage_type;
+	uint32_t                       num_rdi;
+	struct cam_isp_bw_vote         left_pix_vote;
+	struct cam_isp_bw_vote         right_pix_vote;
+	struct cam_isp_bw_vote         rdi_vote[CAM_IFE_RDI_NUM_MAX];
+};
+
+/**
+ * struct cam_isp_prepare_hw_update_data - hw prepare data
+ *
+ * @isp_mgr_ctx:            ISP HW manager Context for current request
+ * @packet_opcode_type:     Packet header opcode in the packet header
+ *                          this opcode defines, packet is init packet or
+ *                          update packet
+ * @frame_header_cpu_addr:  Frame header cpu addr
+ * @frame_header_iova:      Frame header iova
+ * @frame_header_res_id:    Out port res_id corresponding to frame header
+ * @bw_config_version:      BW config version indicator
+ * @bw_config:              BW config information
+ * @bw_config_v2:           BW config info for AXI bw voting v2
+ * @bw_config_valid:        Flag indicating whether the bw_config at the index
+ *                          is valid or not
+ * @reg_dump_buf_desc:     cmd buffer descriptors for reg dump
+ * @num_reg_dump_buf:      Count of descriptors in reg_dump_buf_desc
+ * @packet                 CSL packet from user mode driver
+ *
+ */
+struct cam_isp_prepare_hw_update_data {
+	void                                 *isp_mgr_ctx;
+	uint32_t                              packet_opcode_type;
+	uint32_t                             *frame_header_cpu_addr;
+	uint64_t                              frame_header_iova;
+	uint32_t                              frame_header_res_id;
+	uint32_t                              bw_config_version;
+	struct cam_isp_bw_config_internal     bw_config[CAM_IFE_HW_NUM_MAX];
+	struct cam_isp_bw_config_internal_v2  bw_config_v2[CAM_IFE_HW_NUM_MAX];
+	bool                               bw_config_valid[CAM_IFE_HW_NUM_MAX];
+	struct cam_cmd_buf_desc               reg_dump_buf_desc[
+						CAM_REG_DUMP_MAX_BUF_ENTRIES];
+	uint32_t                              num_reg_dump_buf;
+	struct cam_packet                     *packet;
+};
+
+
+/**
+ * struct cam_isp_hw_sof_event_data - Event payload for CAM_HW_EVENT_SOF
+ *
+ * @timestamp:   Time stamp for the sof event
+ * @boot_time:   Boot time stamp for the sof event
+ *
+ */
+struct cam_isp_hw_sof_event_data {
+	uint64_t       timestamp;
+	uint64_t       boot_time;
+};
+
+/**
+ * struct cam_isp_hw_reg_update_event_data - Event payload for
+ *                         CAM_HW_EVENT_REG_UPDATE
+ *
+ * @timestamp:     Time stamp for the reg update event
+ *
+ */
+struct cam_isp_hw_reg_update_event_data {
+	uint64_t       timestamp;
+};
+
+/**
+ * struct cam_isp_hw_epoch_event_data - Event payload for CAM_HW_EVENT_EPOCH
+ *
+ * @timestamp:     Time stamp for the epoch event
+ * @frame_id_meta: Frame id value corresponding to this frame
+ */
+struct cam_isp_hw_epoch_event_data {
+	uint64_t       timestamp;
+	uint32_t       frame_id_meta;
+};
+
+/**
+ * struct cam_isp_hw_done_event_data - Event payload for CAM_HW_EVENT_DONE
+ *
+ * @num_handles:           Number of resource handeles
+ * @resource_handle:       Resource handle array
+ * @last_consumed_addr:    Last consumed addr
+ * @timestamp:             Timestamp for the buf done event
+ * @evt_param:             Specific info about the frame
+ */
+struct cam_isp_hw_done_event_data {
+	uint32_t             num_handles;
+	uint32_t             resource_handle[
+				CAM_NUM_OUT_PER_COMP_IRQ_MAX];
+	uint32_t             last_consumed_addr[
+				CAM_NUM_OUT_PER_COMP_IRQ_MAX];
+	uint64_t             timestamp;
+	uint32_t             evt_param;
+};
+
+/**
+ * struct cam_isp_hw_eof_event_data - Event payload for CAM_HW_EVENT_EOF
+ *
+ * @timestamp:             Timestamp for the eof event
+ *
+ */
+struct cam_isp_hw_eof_event_data {
+	uint64_t       timestamp;
+};
+
+/**
+ * struct cam_isp_hw_error_event_data - Event payload for CAM_HW_EVENT_ERROR
+ *
+ * @error_type:            Error type for the error event
+ * @timestamp:             Timestamp for the error event
+ * @recovery_enabled:      Identifies if the context needs to recover & reapply
+ *                         this request
+ * @enable_req_dump:       Enable request dump on HW errors
+ */
+struct cam_isp_hw_error_event_data {
+	uint32_t             error_type;
+	uint64_t             timestamp;
+	bool                 recovery_enabled;
+	bool                 enable_req_dump;
+};
+
+/* enum cam_isp_hw_mgr_command - Hardware manager command type */
+enum cam_isp_hw_mgr_command {
+	CAM_ISP_HW_MGR_CMD_IS_RDI_ONLY_CONTEXT,
+	CAM_ISP_HW_MGR_CMD_PAUSE_HW,
+	CAM_ISP_HW_MGR_CMD_RESUME_HW,
+	CAM_ISP_HW_MGR_CMD_SOF_DEBUG,
+	CAM_ISP_HW_MGR_CMD_CTX_TYPE,
+	CAM_ISP_HW_MGR_GET_PACKET_OPCODE,
+	CAM_ISP_HW_MGR_GET_LAST_CDM_DONE,
+	CAM_ISP_HW_MGR_CMD_UPDATE_CLOCK,
+	CAM_ISP_HW_MGR_CMD_MAX,
+};
+
+enum cam_isp_ctx_type {
+	CAM_ISP_CTX_FS2 = 1,
+	CAM_ISP_CTX_RDI,
+	CAM_ISP_CTX_PIX,
+	CAM_ISP_CTX_OFFLINE,
+	CAM_ISP_CTX_MAX,
+};
+/**
+ * struct cam_isp_hw_cmd_args - Payload for hw manager command
+ *
+ * @cmd_type:              HW command type
+ * @cmd_data:              Command data
+ * @sof_irq_enable:        To debug if SOF irq is enabled
+ * @ctx_type:              RDI_ONLY, PIX and RDI, or FS2
+ * @packet_op_code:        Packet opcode
+ * @last_cdm_done:         Last cdm done request
+ */
+struct cam_isp_hw_cmd_args {
+	uint32_t                          cmd_type;
+	void                             *cmd_data;
+	union {
+		uint32_t                      sof_irq_enable;
+		uint32_t                      ctx_type;
+		uint32_t                      packet_op_code;
+		uint64_t                      last_cdm_done;
+	} u;
+};
+
+/**
+ * struct cam_isp_start_args - isp hardware start arguments
+ *
+ * @config_args:               Hardware configuration commands.
+ * @start_only                 Send start only to hw drivers. No init to
+ *                             be done.
+ *
+ */
+struct cam_isp_start_args {
+	struct cam_hw_config_args hw_config;
+	bool                      start_only;
+};
+
+/**
+ * cam_isp_hw_mgr_init()
+ *
+ * @brief:              Initialization function for the ISP hardware manager
+ *
+ * @device_name_str:    Device name string
+ * @hw_mgr:             Input/output structure for the ISP hardware manager
+ *                          initialization
+ * @iommu_hdl:          Iommu handle to be returned
+ */
+int cam_isp_hw_mgr_init(const char    *device_name_str,
+	struct cam_hw_mgr_intf *hw_mgr, int *iommu_hdl);
+
+void cam_isp_hw_mgr_deinit(const char *device_name_str);
+
+#endif /* __CAM_ISP_HW_MGR_INTF_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid170.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid170.h
@@ -0,0 +1,309 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_170_H_
+#define _CAM_IFE_CSID_170_H_
+
+#include "cam_ife_csid_core.h"
+
+static struct cam_ife_csid_pxl_reg_offset  cam_ife_csid_170_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_frm_drop_pattern_addr      = 0x20c,
+	.csid_pxl_frm_drop_period_addr       = 0x210,
+	.csid_pxl_irq_subsample_pattern_addr = 0x214,
+	.csid_pxl_irq_subsample_period_addr  = 0x218,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_pix_drop_pattern_addr      = 0x224,
+	.csid_pxl_pix_drop_period_addr       = 0x228,
+	.csid_pxl_line_drop_pattern_addr     = 0x22c,
+	.csid_pxl_line_drop_period_addr      = 0x230,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_format_measure_cfg0_addr   = 0x270,
+	.csid_pxl_format_measure_cfg1_addr   = 0x274,
+	.csid_pxl_format_measure0_addr       = 0x278,
+	.csid_pxl_format_measure1_addr       = 0x27c,
+	.csid_pxl_format_measure2_addr       = 0x280,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+};
+
+static struct cam_ife_csid_rdi_reg_offset cam_ife_csid_170_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_frm_drop_pattern_addr           = 0x30c,
+	.csid_rdi_frm_drop_period_addr            = 0x310,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x314,
+	.csid_rdi_irq_subsample_period_addr       = 0x318,
+	.csid_rdi_rpp_hcrop_addr                  = 0x31c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x320,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x324,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x328,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x32c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x330,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_misr_val2_addr                  = 0x35c,
+	.csid_rdi_misr_val3_addr                  = 0x360,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+};
+
+static struct cam_ife_csid_rdi_reg_offset cam_ife_csid_170_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_frm_drop_pattern_addr           = 0x40c,
+	.csid_rdi_frm_drop_period_addr            = 0x410,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x414,
+	.csid_rdi_irq_subsample_period_addr       = 0x418,
+	.csid_rdi_rpp_hcrop_addr                  = 0x41c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x420,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x424,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x428,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x42c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x430,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_misr_val2_addr                  = 0x45c,
+	.csid_rdi_misr_val3_addr                  = 0x460,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+};
+
+static struct cam_ife_csid_rdi_reg_offset cam_ife_csid_170_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_frm_drop_pattern_addr           = 0x50c,
+	.csid_rdi_frm_drop_period_addr            = 0x510,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x514,
+	.csid_rdi_irq_subsample_period_addr       = 0x518,
+	.csid_rdi_rpp_hcrop_addr                  = 0x51c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x520,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x524,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x528,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x52c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x530,
+	.csid_rdi_yuv_chroma_conversion_addr      = 0x534,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_misr_val2_addr                  = 0x55c,
+	.csid_rdi_misr_val3_addr                  = 0x560,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_offset
+			cam_ife_csid_170_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_de_scramble_cfg0_addr           = 0x114,
+	.csid_csi2_rx_de_scramble_cfg1_addr           = 0x118,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_lane0_misr_addr                 = 0x150,
+	.csid_csi2_rx_lane1_misr_addr                 = 0x154,
+	.csid_csi2_rx_lane2_misr_addr                 = 0x158,
+	.csid_csi2_rx_lane3_misr_addr                 = 0x15c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 15,
+	.csi2_capture_cphy_pkt_dt_shift               = 20,
+	.csi2_capture_cphy_pkt_vc_shift               = 26,
+	.csi2_rx_phy_num_mask                         = 0x3,
+};
+
+static struct cam_ife_csid_csi2_tpg_reg_offset
+			cam_ife_csid_170_tpg_reg_offset = {
+	/*CSID TPG control */
+	.csid_tpg_ctrl_addr                           = 0x600,
+	.csid_tpg_vc_cfg0_addr                        = 0x604,
+	.csid_tpg_vc_cfg1_addr                        = 0x608,
+	.csid_tpg_lfsr_seed_addr                      = 0x60c,
+	.csid_tpg_dt_n_cfg_0_addr                     = 0x610,
+	.csid_tpg_dt_n_cfg_1_addr                     = 0x614,
+	.csid_tpg_dt_n_cfg_2_addr                     = 0x618,
+	.csid_tpg_color_bars_cfg_addr                 = 0x640,
+	.csid_tpg_color_box_cfg_addr                  = 0x644,
+	.csid_tpg_common_gen_cfg_addr                 = 0x648,
+	.csid_tpg_cgen_n_cfg_addr                     = 0x650,
+	.csid_tpg_cgen_n_x0_addr                      = 0x654,
+	.csid_tpg_cgen_n_x1_addr                      = 0x658,
+	.csid_tpg_cgen_n_x2_addr                      = 0x65c,
+	.csid_tpg_cgen_n_xy_addr                      = 0x660,
+	.csid_tpg_cgen_n_y1_addr                      = 0x664,
+	.csid_tpg_cgen_n_y2_addr                      = 0x668,
+
+	/* configurations */
+	.tpg_dtn_cfg_offset                           = 0xc,
+	.tpg_cgen_cfg_offset                          = 0x20,
+	.tpg_cpas_ife_reg_offset                      = 0x28,
+};
+
+static struct cam_ife_csid_common_reg_offset
+			cam_ife_csid_170_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_reset_addr                              = 0xc,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 1,
+	.minor_version                                = 7,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 0,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.path_rst_stb_all                             = 0x7f,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x7FFF,
+	.rdi_irq_mask_all                             = 0x7FFF,
+	.ppp_irq_mask_all                             = 0x0,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xC,
+	.format_measure_en_val                        = 1,
+	.format_measure_height_mask_val               = 0xFFFF,
+	.format_measure_height_shift_val              = 0x10,
+	.format_measure_width_mask_val                = 0xFFFF,
+	.format_measure_width_shift_val               = 0x0,
+};
+
+static struct cam_ife_csid_reg_offset cam_ife_csid_170_reg_offset = {
+	.cmn_reg          = &cam_ife_csid_170_cmn_reg_offset,
+	.csi2_reg         = &cam_ife_csid_170_csi2_reg_offset,
+	.ipp_reg          = &cam_ife_csid_170_ipp_reg_offset,
+	.ppp_reg          = NULL,
+	.rdi_reg = {
+		&cam_ife_csid_170_rdi_0_reg_offset,
+		&cam_ife_csid_170_rdi_1_reg_offset,
+		&cam_ife_csid_170_rdi_2_reg_offset,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_170_tpg_reg_offset,
+};
+
+#endif /*_CAM_IFE_CSID_170_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid170_200.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid170_200.h
@@ -0,0 +1,372 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_170_200_H_
+#define _CAM_IFE_CSID_170_200_H_
+
+#include "cam_ife_csid_core.h"
+
+static struct cam_ife_csid_pxl_reg_offset
+	cam_ife_csid_170_200_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_frm_drop_pattern_addr      = 0x20c,
+	.csid_pxl_frm_drop_period_addr       = 0x210,
+	.csid_pxl_irq_subsample_pattern_addr = 0x214,
+	.csid_pxl_irq_subsample_period_addr  = 0x218,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_pix_drop_pattern_addr      = 0x224,
+	.csid_pxl_pix_drop_period_addr       = 0x228,
+	.csid_pxl_line_drop_pattern_addr     = 0x22c,
+	.csid_pxl_line_drop_period_addr      = 0x230,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_format_measure_cfg0_addr   = 0x270,
+	.csid_pxl_format_measure_cfg1_addr   = 0x274,
+	.csid_pxl_format_measure0_addr       = 0x278,
+	.csid_pxl_format_measure1_addr       = 0x27c,
+	.csid_pxl_format_measure2_addr       = 0x280,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.quad_cfa_bin_en_shift_val           = 30,
+	.ccif_violation_en                   = 1,
+	.halt_master_sel_en                  = 1,
+	.halt_sel_internal_master_val        = 3,
+};
+
+static struct cam_ife_csid_pxl_reg_offset
+	cam_ife_csid_170_200_ppp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0xa0,
+	.csid_pxl_irq_mask_addr              = 0xa4,
+	.csid_pxl_irq_clear_addr             = 0xa8,
+	.csid_pxl_irq_set_addr               = 0xac,
+
+	.csid_pxl_cfg0_addr                  = 0x700,
+	.csid_pxl_cfg1_addr                  = 0x704,
+	.csid_pxl_ctrl_addr                  = 0x708,
+	.csid_pxl_frm_drop_pattern_addr      = 0x70c,
+	.csid_pxl_frm_drop_period_addr       = 0x710,
+	.csid_pxl_irq_subsample_pattern_addr = 0x714,
+	.csid_pxl_irq_subsample_period_addr  = 0x718,
+	.csid_pxl_hcrop_addr                 = 0x71c,
+	.csid_pxl_vcrop_addr                 = 0x720,
+	.csid_pxl_pix_drop_pattern_addr      = 0x724,
+	.csid_pxl_pix_drop_period_addr       = 0x728,
+	.csid_pxl_line_drop_pattern_addr     = 0x72c,
+	.csid_pxl_line_drop_period_addr      = 0x730,
+	.csid_pxl_rst_strobes_addr           = 0x740,
+	.csid_pxl_status_addr                = 0x754,
+	.csid_pxl_misr_val_addr              = 0x758,
+	.csid_pxl_format_measure_cfg0_addr   = 0x770,
+	.csid_pxl_format_measure_cfg1_addr   = 0x774,
+	.csid_pxl_format_measure0_addr       = 0x778,
+	.csid_pxl_format_measure1_addr       = 0x77c,
+	.csid_pxl_format_measure2_addr       = 0x780,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x790,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x794,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x798,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x79c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x7a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x7a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x7a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x7ac,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.ccif_violation_en                   = 1,
+	.halt_master_sel_en                  = 1,
+	.halt_sel_internal_master_val        = 3,
+};
+
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_170_200_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_frm_drop_pattern_addr           = 0x30c,
+	.csid_rdi_frm_drop_period_addr            = 0x310,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x314,
+	.csid_rdi_irq_subsample_period_addr       = 0x318,
+	.csid_rdi_rpp_hcrop_addr                  = 0x31c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x320,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x324,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x328,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x32c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x330,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_misr_val2_addr                  = 0x35c,
+	.csid_rdi_misr_val3_addr                  = 0x360,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+	.ccif_violation_en                        = 1,
+};
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_170_200_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_frm_drop_pattern_addr           = 0x40c,
+	.csid_rdi_frm_drop_period_addr            = 0x410,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x414,
+	.csid_rdi_irq_subsample_period_addr       = 0x418,
+	.csid_rdi_rpp_hcrop_addr                  = 0x41c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x420,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x424,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x428,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x42c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x430,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_misr_val2_addr                  = 0x45c,
+	.csid_rdi_misr_val3_addr                  = 0x460,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+	.ccif_violation_en                        = 1,
+};
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_170_200_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_frm_drop_pattern_addr           = 0x50c,
+	.csid_rdi_frm_drop_period_addr            = 0x510,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x514,
+	.csid_rdi_irq_subsample_period_addr       = 0x518,
+	.csid_rdi_rpp_hcrop_addr                  = 0x51c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x520,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x524,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x528,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x52c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x530,
+	.csid_rdi_yuv_chroma_conversion_addr      = 0x534,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_misr_val2_addr                  = 0x55c,
+	.csid_rdi_misr_val3_addr                  = 0x560,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+	.ccif_violation_en                        = 1,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_offset
+			cam_ife_csid_170_200_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_lane0_misr_addr                 = 0x150,
+	.csid_csi2_rx_lane1_misr_addr                 = 0x154,
+	.csid_csi2_rx_lane2_misr_addr                 = 0x158,
+	.csid_csi2_rx_lane3_misr_addr                 = 0x15c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+	.csid_csi2_rx_de_scramble_type3_cfg0_addr     = 0x170,
+	.csid_csi2_rx_de_scramble_type3_cfg1_addr     = 0x174,
+	.csid_csi2_rx_de_scramble_type2_cfg0_addr     = 0x178,
+	.csid_csi2_rx_de_scramble_type2_cfg1_addr     = 0x17c,
+	.csid_csi2_rx_de_scramble_type1_cfg0_addr     = 0x180,
+	.csid_csi2_rx_de_scramble_type1_cfg1_addr     = 0x184,
+	.csid_csi2_rx_de_scramble_type0_cfg0_addr     = 0x188,
+	.csid_csi2_rx_de_scramble_type0_cfg1_addr     = 0x18c,
+
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 15,
+	.csi2_capture_cphy_pkt_dt_shift               = 20,
+	.csi2_capture_cphy_pkt_vc_shift               = 26,
+	.csi2_rx_phy_num_mask                         = 0x7,
+};
+
+static struct cam_ife_csid_csi2_tpg_reg_offset
+			cam_ife_csid_170_200_tpg_reg_offset = {
+	/*CSID TPG control */
+	.csid_tpg_ctrl_addr                           = 0x600,
+	.csid_tpg_vc_cfg0_addr                        = 0x604,
+	.csid_tpg_vc_cfg1_addr                        = 0x608,
+	.csid_tpg_lfsr_seed_addr                      = 0x60c,
+	.csid_tpg_dt_n_cfg_0_addr                     = 0x610,
+	.csid_tpg_dt_n_cfg_1_addr                     = 0x614,
+	.csid_tpg_dt_n_cfg_2_addr                     = 0x618,
+	.csid_tpg_color_bars_cfg_addr                 = 0x640,
+	.csid_tpg_color_box_cfg_addr                  = 0x644,
+	.csid_tpg_common_gen_cfg_addr                 = 0x648,
+	.csid_tpg_cgen_n_cfg_addr                     = 0x650,
+	.csid_tpg_cgen_n_x0_addr                      = 0x654,
+	.csid_tpg_cgen_n_x1_addr                      = 0x658,
+	.csid_tpg_cgen_n_x2_addr                      = 0x65c,
+	.csid_tpg_cgen_n_xy_addr                      = 0x660,
+	.csid_tpg_cgen_n_y1_addr                      = 0x664,
+	.csid_tpg_cgen_n_y2_addr                      = 0x668,
+
+	/* configurations */
+	.tpg_dtn_cfg_offset                           = 0xc,
+	.tpg_cgen_cfg_offset                          = 0x20,
+	.tpg_cpas_ife_reg_offset                      = 0x28,
+};
+
+static struct cam_ife_csid_common_reg_offset
+			cam_ife_csid_170_200_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_reset_addr                              = 0xc,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 1,
+	.minor_version                                = 7,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 1,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.path_rst_stb_all                             = 0x7f,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.packing_fmt_shift_val                        = 30,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0xFFFF,
+	.rdi_irq_mask_all                             = 0xFFFF,
+	.ppp_irq_mask_all                             = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xC,
+	.format_measure_en_val                        = 1,
+	.format_measure_height_mask_val               = 0xFFFF,
+	.format_measure_height_shift_val              = 0x10,
+	.format_measure_width_mask_val                = 0xFFFF,
+	.format_measure_width_shift_val               = 0x0,
+};
+
+static struct cam_ife_csid_reg_offset cam_ife_csid_170_200_reg_offset = {
+	.cmn_reg          = &cam_ife_csid_170_200_cmn_reg_offset,
+	.csi2_reg         = &cam_ife_csid_170_200_csi2_reg_offset,
+	.ipp_reg          = &cam_ife_csid_170_200_ipp_reg_offset,
+	.ppp_reg          = &cam_ife_csid_170_200_ppp_reg_offset,
+	.rdi_reg = {
+		&cam_ife_csid_170_200_rdi_0_reg_offset,
+		&cam_ife_csid_170_200_rdi_1_reg_offset,
+		&cam_ife_csid_170_200_rdi_2_reg_offset,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_170_200_tpg_reg_offset,
+};
+
+#endif /*_CAM_IFE_CSID_170_200_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid175.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid175.h
@@ -0,0 +1,350 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_175_H_
+#define _CAM_IFE_CSID_175_H_
+
+#include "cam_ife_csid_core.h"
+
+static struct cam_ife_csid_pxl_reg_offset  cam_ife_csid_175_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_frm_drop_pattern_addr      = 0x20c,
+	.csid_pxl_frm_drop_period_addr       = 0x210,
+	.csid_pxl_irq_subsample_pattern_addr = 0x214,
+	.csid_pxl_irq_subsample_period_addr  = 0x218,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_pix_drop_pattern_addr      = 0x224,
+	.csid_pxl_pix_drop_period_addr       = 0x228,
+	.csid_pxl_line_drop_pattern_addr     = 0x22c,
+	.csid_pxl_line_drop_period_addr      = 0x230,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_format_measure_cfg0_addr   = 0x270,
+	.csid_pxl_format_measure_cfg1_addr   = 0x274,
+	.csid_pxl_format_measure0_addr       = 0x278,
+	.csid_pxl_format_measure1_addr       = 0x27c,
+	.csid_pxl_format_measure2_addr       = 0x280,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+};
+
+static struct cam_ife_csid_pxl_reg_offset  cam_ife_csid_175_ppp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0xa0,
+	.csid_pxl_irq_mask_addr              = 0xa4,
+	.csid_pxl_irq_clear_addr             = 0xa8,
+	.csid_pxl_irq_set_addr               = 0xac,
+
+	.csid_pxl_cfg0_addr                  = 0x700,
+	.csid_pxl_cfg1_addr                  = 0x704,
+	.csid_pxl_ctrl_addr                  = 0x708,
+	.csid_pxl_frm_drop_pattern_addr      = 0x70c,
+	.csid_pxl_frm_drop_period_addr       = 0x710,
+	.csid_pxl_irq_subsample_pattern_addr = 0x714,
+	.csid_pxl_irq_subsample_period_addr  = 0x718,
+	.csid_pxl_hcrop_addr                 = 0x71c,
+	.csid_pxl_vcrop_addr                 = 0x720,
+	.csid_pxl_pix_drop_pattern_addr      = 0x724,
+	.csid_pxl_pix_drop_period_addr       = 0x728,
+	.csid_pxl_line_drop_pattern_addr     = 0x72c,
+	.csid_pxl_line_drop_period_addr      = 0x730,
+	.csid_pxl_rst_strobes_addr           = 0x740,
+	.csid_pxl_status_addr                = 0x754,
+	.csid_pxl_misr_val_addr              = 0x758,
+	.csid_pxl_format_measure_cfg0_addr   = 0x770,
+	.csid_pxl_format_measure_cfg1_addr   = 0x774,
+	.csid_pxl_format_measure0_addr       = 0x778,
+	.csid_pxl_format_measure1_addr       = 0x77c,
+	.csid_pxl_format_measure2_addr       = 0x780,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x790,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x794,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x798,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x79c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x7a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x7a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x7a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x7ac,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+};
+
+
+static struct cam_ife_csid_rdi_reg_offset cam_ife_csid_175_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_frm_drop_pattern_addr           = 0x30c,
+	.csid_rdi_frm_drop_period_addr            = 0x310,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x314,
+	.csid_rdi_irq_subsample_period_addr       = 0x318,
+	.csid_rdi_rpp_hcrop_addr                  = 0x31c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x320,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x324,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x328,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x32c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x330,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_misr_val2_addr                  = 0x35c,
+	.csid_rdi_misr_val3_addr                  = 0x360,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+};
+
+static struct cam_ife_csid_rdi_reg_offset cam_ife_csid_175_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_frm_drop_pattern_addr           = 0x40c,
+	.csid_rdi_frm_drop_period_addr            = 0x410,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x414,
+	.csid_rdi_irq_subsample_period_addr       = 0x418,
+	.csid_rdi_rpp_hcrop_addr                  = 0x41c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x420,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x424,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x428,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x42c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x430,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_misr_val2_addr                  = 0x45c,
+	.csid_rdi_misr_val3_addr                  = 0x460,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+};
+
+static struct cam_ife_csid_rdi_reg_offset cam_ife_csid_175_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_frm_drop_pattern_addr           = 0x50c,
+	.csid_rdi_frm_drop_period_addr            = 0x510,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x514,
+	.csid_rdi_irq_subsample_period_addr       = 0x518,
+	.csid_rdi_rpp_hcrop_addr                  = 0x51c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x520,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x524,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x528,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x52c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x530,
+	.csid_rdi_yuv_chroma_conversion_addr      = 0x534,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_misr_val2_addr                  = 0x55c,
+	.csid_rdi_misr_val3_addr                  = 0x560,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_offset
+			cam_ife_csid_175_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_de_scramble_cfg0_addr           = 0x114,
+	.csid_csi2_rx_de_scramble_cfg1_addr           = 0x118,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_lane0_misr_addr                 = 0x150,
+	.csid_csi2_rx_lane1_misr_addr                 = 0x154,
+	.csid_csi2_rx_lane2_misr_addr                 = 0x158,
+	.csid_csi2_rx_lane3_misr_addr                 = 0x15c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 15,
+	.csi2_capture_cphy_pkt_dt_shift               = 20,
+	.csi2_capture_cphy_pkt_vc_shift               = 26,
+	.csi2_rx_phy_num_mask                         = 0x3,
+};
+
+static struct cam_ife_csid_csi2_tpg_reg_offset
+			cam_ife_csid_175_tpg_reg_offset = {
+	/*CSID TPG control */
+	.csid_tpg_ctrl_addr                           = 0x600,
+	.csid_tpg_vc_cfg0_addr                        = 0x604,
+	.csid_tpg_vc_cfg1_addr                        = 0x608,
+	.csid_tpg_lfsr_seed_addr                      = 0x60c,
+	.csid_tpg_dt_n_cfg_0_addr                     = 0x610,
+	.csid_tpg_dt_n_cfg_1_addr                     = 0x614,
+	.csid_tpg_dt_n_cfg_2_addr                     = 0x618,
+	.csid_tpg_color_bars_cfg_addr                 = 0x640,
+	.csid_tpg_color_box_cfg_addr                  = 0x644,
+	.csid_tpg_common_gen_cfg_addr                 = 0x648,
+	.csid_tpg_cgen_n_cfg_addr                     = 0x650,
+	.csid_tpg_cgen_n_x0_addr                      = 0x654,
+	.csid_tpg_cgen_n_x1_addr                      = 0x658,
+	.csid_tpg_cgen_n_x2_addr                      = 0x65c,
+	.csid_tpg_cgen_n_xy_addr                      = 0x660,
+	.csid_tpg_cgen_n_y1_addr                      = 0x664,
+	.csid_tpg_cgen_n_y2_addr                      = 0x668,
+
+	/* configurations */
+	.tpg_dtn_cfg_offset                           = 0xc,
+	.tpg_cgen_cfg_offset                          = 0x20,
+	.tpg_cpas_ife_reg_offset                      = 0x28,
+};
+
+static struct cam_ife_csid_common_reg_offset
+			cam_ife_csid_175_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_reset_addr                              = 0xc,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 1,
+	.minor_version                                = 7,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 1,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.path_rst_stb_all                             = 0x7f,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x7FFF,
+	.rdi_irq_mask_all                             = 0x7FFF,
+	.ppp_irq_mask_all                             = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xC,
+	.format_measure_en_val                        = 1,
+	.format_measure_height_mask_val               = 0xFFFF,
+	.format_measure_height_shift_val              = 0x10,
+	.format_measure_width_mask_val                = 0xFFFF,
+	.format_measure_width_shift_val               = 0x0,
+};
+
+static struct cam_ife_csid_reg_offset cam_ife_csid_175_reg_offset = {
+	.cmn_reg          = &cam_ife_csid_175_cmn_reg_offset,
+	.csi2_reg         = &cam_ife_csid_175_csi2_reg_offset,
+	.ipp_reg          = &cam_ife_csid_175_ipp_reg_offset,
+	.ppp_reg          = &cam_ife_csid_175_ppp_reg_offset,
+	.rdi_reg = {
+		&cam_ife_csid_175_rdi_0_reg_offset,
+		&cam_ife_csid_175_rdi_1_reg_offset,
+		&cam_ife_csid_175_rdi_2_reg_offset,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_175_tpg_reg_offset,
+};
+
+#endif /*_CAM_IFE_CSID_175_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid175_200.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid175_200.h
@@ -0,0 +1,369 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_175_200_H_
+#define _CAM_IFE_CSID_175_200_H_
+
+#include "cam_ife_csid_core.h"
+
+static struct cam_ife_csid_pxl_reg_offset
+	cam_ife_csid_175_200_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_frm_drop_pattern_addr      = 0x20c,
+	.csid_pxl_frm_drop_period_addr       = 0x210,
+	.csid_pxl_irq_subsample_pattern_addr = 0x214,
+	.csid_pxl_irq_subsample_period_addr  = 0x218,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_pix_drop_pattern_addr      = 0x224,
+	.csid_pxl_pix_drop_period_addr       = 0x228,
+	.csid_pxl_line_drop_pattern_addr     = 0x22c,
+	.csid_pxl_line_drop_period_addr      = 0x230,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_format_measure_cfg0_addr   = 0x270,
+	.csid_pxl_format_measure_cfg1_addr   = 0x274,
+	.csid_pxl_format_measure0_addr       = 0x278,
+	.csid_pxl_format_measure1_addr       = 0x27c,
+	.csid_pxl_format_measure2_addr       = 0x280,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.horizontal_bin_en_shift_val         = 2,
+	.quad_cfa_bin_en_shift_val           = 30,
+	.ccif_violation_en                   = 1,
+};
+
+static struct cam_ife_csid_pxl_reg_offset
+	cam_ife_csid_175_200_ppp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0xa0,
+	.csid_pxl_irq_mask_addr              = 0xa4,
+	.csid_pxl_irq_clear_addr             = 0xa8,
+	.csid_pxl_irq_set_addr               = 0xac,
+
+	.csid_pxl_cfg0_addr                  = 0x700,
+	.csid_pxl_cfg1_addr                  = 0x704,
+	.csid_pxl_ctrl_addr                  = 0x708,
+	.csid_pxl_frm_drop_pattern_addr      = 0x70c,
+	.csid_pxl_frm_drop_period_addr       = 0x710,
+	.csid_pxl_irq_subsample_pattern_addr = 0x714,
+	.csid_pxl_irq_subsample_period_addr  = 0x718,
+	.csid_pxl_hcrop_addr                 = 0x71c,
+	.csid_pxl_vcrop_addr                 = 0x720,
+	.csid_pxl_pix_drop_pattern_addr      = 0x724,
+	.csid_pxl_pix_drop_period_addr       = 0x728,
+	.csid_pxl_line_drop_pattern_addr     = 0x72c,
+	.csid_pxl_line_drop_period_addr      = 0x730,
+	.csid_pxl_rst_strobes_addr           = 0x740,
+	.csid_pxl_status_addr                = 0x754,
+	.csid_pxl_misr_val_addr              = 0x758,
+	.csid_pxl_format_measure_cfg0_addr   = 0x770,
+	.csid_pxl_format_measure_cfg1_addr   = 0x774,
+	.csid_pxl_format_measure0_addr       = 0x778,
+	.csid_pxl_format_measure1_addr       = 0x77c,
+	.csid_pxl_format_measure2_addr       = 0x780,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x790,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x794,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x798,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x79c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x7a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x7a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x7a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x7ac,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.ccif_violation_en                   = 1,
+};
+
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_175_200_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_frm_drop_pattern_addr           = 0x30c,
+	.csid_rdi_frm_drop_period_addr            = 0x310,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x314,
+	.csid_rdi_irq_subsample_period_addr       = 0x318,
+	.csid_rdi_rpp_hcrop_addr                  = 0x31c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x320,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x324,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x328,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x32c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x330,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_misr_val2_addr                  = 0x35c,
+	.csid_rdi_misr_val3_addr                  = 0x360,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+	.ccif_violation_en                        = 1,
+};
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_175_200_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_frm_drop_pattern_addr           = 0x40c,
+	.csid_rdi_frm_drop_period_addr            = 0x410,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x414,
+	.csid_rdi_irq_subsample_period_addr       = 0x418,
+	.csid_rdi_rpp_hcrop_addr                  = 0x41c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x420,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x424,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x428,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x42c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x430,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_misr_val2_addr                  = 0x45c,
+	.csid_rdi_misr_val3_addr                  = 0x460,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+	.ccif_violation_en                        = 1,
+};
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_175_200_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_frm_drop_pattern_addr           = 0x50c,
+	.csid_rdi_frm_drop_period_addr            = 0x510,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x514,
+	.csid_rdi_irq_subsample_period_addr       = 0x518,
+	.csid_rdi_rpp_hcrop_addr                  = 0x51c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x520,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x524,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x528,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x52c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x530,
+	.csid_rdi_yuv_chroma_conversion_addr      = 0x534,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_misr_val2_addr                  = 0x55c,
+	.csid_rdi_misr_val3_addr                  = 0x560,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+	.ccif_violation_en                        = 1,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_offset
+			cam_ife_csid_175_200_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_lane0_misr_addr                 = 0x150,
+	.csid_csi2_rx_lane1_misr_addr                 = 0x154,
+	.csid_csi2_rx_lane2_misr_addr                 = 0x158,
+	.csid_csi2_rx_lane3_misr_addr                 = 0x15c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+	.csid_csi2_rx_de_scramble_type3_cfg0_addr     = 0x170,
+	.csid_csi2_rx_de_scramble_type3_cfg1_addr     = 0x174,
+	.csid_csi2_rx_de_scramble_type2_cfg0_addr     = 0x178,
+	.csid_csi2_rx_de_scramble_type2_cfg1_addr     = 0x17c,
+	.csid_csi2_rx_de_scramble_type1_cfg0_addr     = 0x180,
+	.csid_csi2_rx_de_scramble_type1_cfg1_addr     = 0x184,
+	.csid_csi2_rx_de_scramble_type0_cfg0_addr     = 0x188,
+	.csid_csi2_rx_de_scramble_type0_cfg1_addr     = 0x18c,
+
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 15,
+	.csi2_capture_cphy_pkt_dt_shift               = 20,
+	.csi2_capture_cphy_pkt_vc_shift               = 26,
+	.csi2_rx_phy_num_mask                         = 0x7,
+};
+
+static struct cam_ife_csid_csi2_tpg_reg_offset
+			cam_ife_csid_175_200_tpg_reg_offset = {
+	/*CSID TPG control */
+	.csid_tpg_ctrl_addr                           = 0x600,
+	.csid_tpg_vc_cfg0_addr                        = 0x604,
+	.csid_tpg_vc_cfg1_addr                        = 0x608,
+	.csid_tpg_lfsr_seed_addr                      = 0x60c,
+	.csid_tpg_dt_n_cfg_0_addr                     = 0x610,
+	.csid_tpg_dt_n_cfg_1_addr                     = 0x614,
+	.csid_tpg_dt_n_cfg_2_addr                     = 0x618,
+	.csid_tpg_color_bars_cfg_addr                 = 0x640,
+	.csid_tpg_color_box_cfg_addr                  = 0x644,
+	.csid_tpg_common_gen_cfg_addr                 = 0x648,
+	.csid_tpg_cgen_n_cfg_addr                     = 0x650,
+	.csid_tpg_cgen_n_x0_addr                      = 0x654,
+	.csid_tpg_cgen_n_x1_addr                      = 0x658,
+	.csid_tpg_cgen_n_x2_addr                      = 0x65c,
+	.csid_tpg_cgen_n_xy_addr                      = 0x660,
+	.csid_tpg_cgen_n_y1_addr                      = 0x664,
+	.csid_tpg_cgen_n_y2_addr                      = 0x668,
+
+	/* configurations */
+	.tpg_dtn_cfg_offset                           = 0xc,
+	.tpg_cgen_cfg_offset                          = 0x20,
+	.tpg_cpas_ife_reg_offset                      = 0x28,
+};
+
+static struct cam_ife_csid_common_reg_offset
+			cam_ife_csid_175_200_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_reset_addr                              = 0xc,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 1,
+	.minor_version                                = 7,
+	.version_incr                                 = 5,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 1,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.path_rst_stb_all                             = 0x7f,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.packing_fmt_shift_val                        = 30,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0xFFFF,
+	.rdi_irq_mask_all                             = 0xFFFF,
+	.ppp_irq_mask_all                             = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xC,
+	.format_measure_en_val                        = 1,
+	.format_measure_height_mask_val               = 0xFFFF,
+	.format_measure_height_shift_val              = 0x10,
+	.format_measure_width_mask_val                = 0xFFFF,
+	.format_measure_width_shift_val               = 0x0,
+};
+
+static struct cam_ife_csid_reg_offset cam_ife_csid_175_200_reg_offset = {
+	.cmn_reg          = &cam_ife_csid_175_200_cmn_reg_offset,
+	.csi2_reg         = &cam_ife_csid_175_200_csi2_reg_offset,
+	.ipp_reg          = &cam_ife_csid_175_200_ipp_reg_offset,
+	.ppp_reg          = &cam_ife_csid_175_200_ppp_reg_offset,
+	.rdi_reg = {
+		&cam_ife_csid_175_200_rdi_0_reg_offset,
+		&cam_ife_csid_175_200_rdi_1_reg_offset,
+		&cam_ife_csid_175_200_rdi_2_reg_offset,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_175_200_tpg_reg_offset,
+};
+
+#endif /*_CAM_IFE_CSID_175_200_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid17x.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid17x.c
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#include <linux/module.h>
+#include "cam_ife_csid_core.h"
+#include "cam_ife_csid170.h"
+#include "cam_ife_csid170_200.h"
+#include "cam_ife_csid175.h"
+#include "cam_ife_csid175_200.h"
+#include "cam_ife_csid480.h"
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+
+#define CAM_CSID_DRV_NAME                    "csid_17x"
+#define CAM_CSID_VERSION_V170                 0x10070000
+#define CAM_CSID_VERSION_V175                 0x10070050
+#define CAM_CSID_VERSION_V480                 0x40080000
+#define CAM_CSID_VERSION_V165                 0x10060050
+
+static struct cam_ife_csid_hw_info cam_ife_csid170_hw_info = {
+	.csid_reg = &cam_ife_csid_170_reg_offset,
+	.hw_dts_version = CAM_CSID_VERSION_V170,
+};
+
+static struct cam_ife_csid_hw_info cam_ife_csid170_200_hw_info = {
+	.csid_reg = &cam_ife_csid_170_200_reg_offset,
+	.hw_dts_version = CAM_CSID_VERSION_V170,
+};
+
+static struct cam_ife_csid_hw_info cam_ife_csid175_hw_info = {
+	.csid_reg = &cam_ife_csid_175_reg_offset,
+	.hw_dts_version = CAM_CSID_VERSION_V175,
+};
+
+static struct cam_ife_csid_hw_info cam_ife_csid175_200_hw_info = {
+	.csid_reg = &cam_ife_csid_175_200_reg_offset,
+	.hw_dts_version = CAM_CSID_VERSION_V175,
+};
+
+static struct cam_ife_csid_hw_info cam_ife_csid480_hw_info = {
+	.csid_reg = &cam_ife_csid_480_reg_offset,
+	.hw_dts_version = CAM_CSID_VERSION_V480,
+};
+
+static struct cam_ife_csid_hw_info cam_ife_csid165_204_hw_info = {
+	.csid_reg = &cam_ife_csid_175_200_reg_offset,
+	.hw_dts_version = CAM_CSID_VERSION_V165,
+};
+
+static const struct of_device_id cam_ife_csid17x_dt_match[] = {
+	{
+		.compatible = "qcom,csid170",
+		.data = &cam_ife_csid170_hw_info,
+	},
+	{
+		.compatible = "qcom,csid170_200",
+		.data = &cam_ife_csid170_200_hw_info,
+	},
+	{
+		.compatible = "qcom,csid175",
+		.data = &cam_ife_csid175_hw_info,
+	},
+	{
+		.compatible = "qcom,csid175_200",
+		.data = &cam_ife_csid175_200_hw_info,
+	},
+	{
+		.compatible = "qcom,csid480",
+		.data = &cam_ife_csid480_hw_info,
+	},
+	{
+		.compatible = "qcom,csid580",
+		.data = &cam_ife_csid480_hw_info,
+	},
+	{
+		.compatible = "qcom,csid165_204",
+		.data = &cam_ife_csid165_204_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_ife_csid17x_dt_match);
+
+struct platform_driver cam_ife_csid17x_driver = {
+	.probe = cam_ife_csid_probe,
+	.remove = cam_ife_csid_remove,
+	.driver = {
+		.name = CAM_CSID_DRV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ife_csid17x_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ife_csid17x_init_module(void)
+{
+	return platform_driver_register(&cam_ife_csid17x_driver);
+}
+
+void cam_ife_csid17x_exit_module(void)
+{
+	platform_driver_unregister(&cam_ife_csid17x_driver);
+}
+
+MODULE_DESCRIPTION("CAM IFE_CSID17X driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid480.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid480.h
@@ -0,0 +1,389 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_480_H_
+#define _CAM_IFE_CSID_480_H_
+
+#include "cam_ife_csid_core.h"
+
+static struct cam_ife_csid_pxl_reg_offset  cam_ife_csid_480_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_frm_drop_pattern_addr      = 0x20c,
+	.csid_pxl_frm_drop_period_addr       = 0x210,
+	.csid_pxl_irq_subsample_pattern_addr = 0x214,
+	.csid_pxl_irq_subsample_period_addr  = 0x218,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_pix_drop_pattern_addr      = 0x224,
+	.csid_pxl_pix_drop_period_addr       = 0x228,
+	.csid_pxl_line_drop_pattern_addr     = 0x22c,
+	.csid_pxl_line_drop_period_addr      = 0x230,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_format_measure_cfg0_addr   = 0x270,
+	.csid_pxl_format_measure_cfg1_addr   = 0x274,
+	.csid_pxl_format_measure0_addr       = 0x278,
+	.csid_pxl_format_measure1_addr       = 0x27c,
+	.csid_pxl_format_measure2_addr       = 0x280,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	.csid_pxl_err_recovery_cfg0_addr     = 0x2d0,
+	.csid_pxl_err_recovery_cfg1_addr     = 0x2d4,
+	.csid_pxl_err_recovery_cfg2_addr     = 0x2d8,
+	.csid_pxl_multi_vcdt_cfg0_addr       = 0x2dc,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.horizontal_bin_en_shift_val         = 2,
+	.quad_cfa_bin_en_shift_val           = 30,
+	.ccif_violation_en                   = 1,
+	.overflow_ctrl_en                    = 1,
+	.hblank_cfg_shift_val                = 4,
+};
+
+static struct cam_ife_csid_pxl_reg_offset  cam_ife_csid_480_ppp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0xa0,
+	.csid_pxl_irq_mask_addr              = 0xa4,
+	.csid_pxl_irq_clear_addr             = 0xa8,
+	.csid_pxl_irq_set_addr               = 0xac,
+
+	.csid_pxl_cfg0_addr                  = 0x700,
+	.csid_pxl_cfg1_addr                  = 0x704,
+	.csid_pxl_ctrl_addr                  = 0x708,
+	.csid_pxl_frm_drop_pattern_addr      = 0x70c,
+	.csid_pxl_frm_drop_period_addr       = 0x710,
+	.csid_pxl_irq_subsample_pattern_addr = 0x714,
+	.csid_pxl_irq_subsample_period_addr  = 0x718,
+	.csid_pxl_hcrop_addr                 = 0x71c,
+	.csid_pxl_vcrop_addr                 = 0x720,
+	.csid_pxl_pix_drop_pattern_addr      = 0x724,
+	.csid_pxl_pix_drop_period_addr       = 0x728,
+	.csid_pxl_line_drop_pattern_addr     = 0x72c,
+	.csid_pxl_line_drop_period_addr      = 0x730,
+	.csid_pxl_rst_strobes_addr           = 0x740,
+	.csid_pxl_status_addr                = 0x754,
+	.csid_pxl_misr_val_addr              = 0x758,
+	.csid_pxl_format_measure_cfg0_addr   = 0x770,
+	.csid_pxl_format_measure_cfg1_addr   = 0x774,
+	.csid_pxl_format_measure0_addr       = 0x778,
+	.csid_pxl_format_measure1_addr       = 0x77c,
+	.csid_pxl_format_measure2_addr       = 0x780,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x790,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x794,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x798,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x79c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x7a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x7a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x7a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x7ac,
+	.csid_pxl_err_recovery_cfg0_addr     = 0x7d0,
+	.csid_pxl_err_recovery_cfg1_addr     = 0x7d4,
+	.csid_pxl_err_recovery_cfg2_addr     = 0x7d8,
+	.csid_pxl_multi_vcdt_cfg0_addr       = 0x7dc,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.ccif_violation_en                   = 1,
+	.overflow_ctrl_en                    = 1,
+};
+
+
+static struct cam_ife_csid_rdi_reg_offset cam_ife_csid_480_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_frm_drop_pattern_addr           = 0x30c,
+	.csid_rdi_frm_drop_period_addr            = 0x310,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x314,
+	.csid_rdi_irq_subsample_period_addr       = 0x318,
+	.csid_rdi_rpp_hcrop_addr                  = 0x31c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x320,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x324,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x328,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x32c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x330,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_misr_val2_addr                  = 0x35c,
+	.csid_rdi_misr_val3_addr                  = 0x360,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x3b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x3b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x3b8,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x3bc,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 1,
+};
+
+static struct cam_ife_csid_rdi_reg_offset cam_ife_csid_480_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_frm_drop_pattern_addr           = 0x40c,
+	.csid_rdi_frm_drop_period_addr            = 0x410,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x414,
+	.csid_rdi_irq_subsample_period_addr       = 0x418,
+	.csid_rdi_rpp_hcrop_addr                  = 0x41c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x420,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x424,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x428,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x42c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x430,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_misr_val2_addr                  = 0x45c,
+	.csid_rdi_misr_val3_addr                  = 0x460,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x4b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x4b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x4b8,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x4bc,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 1,
+};
+
+static struct cam_ife_csid_rdi_reg_offset cam_ife_csid_480_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_frm_drop_pattern_addr           = 0x50c,
+	.csid_rdi_frm_drop_period_addr            = 0x510,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x514,
+	.csid_rdi_irq_subsample_period_addr       = 0x518,
+	.csid_rdi_rpp_hcrop_addr                  = 0x51c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x520,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x524,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x528,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x52c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x530,
+	.csid_rdi_yuv_chroma_conversion_addr      = 0x534,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_misr_val2_addr                  = 0x55c,
+	.csid_rdi_misr_val3_addr                  = 0x560,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x5b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x5b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x5b8,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x5bc,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 1,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_offset
+			cam_ife_csid_480_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_de_scramble_cfg0_addr           = 0x114,
+	.csid_csi2_rx_de_scramble_cfg1_addr           = 0x118,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_lane0_misr_addr                 = 0x150,
+	.csid_csi2_rx_lane1_misr_addr                 = 0x154,
+	.csid_csi2_rx_lane2_misr_addr                 = 0x158,
+	.csid_csi2_rx_lane3_misr_addr                 = 0x15c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 15,
+	.csi2_capture_cphy_pkt_dt_shift               = 20,
+	.csi2_capture_cphy_pkt_vc_shift               = 26,
+	.csi2_rx_phy_num_mask                         = 0x7,
+};
+
+static struct cam_ife_csid_csi2_tpg_reg_offset
+			cam_ife_csid_480_tpg_reg_offset = {
+	/*CSID TPG control */
+	.csid_tpg_ctrl_addr                           = 0x600,
+	.csid_tpg_vc_cfg0_addr                        = 0x604,
+	.csid_tpg_vc_cfg1_addr                        = 0x608,
+	.csid_tpg_lfsr_seed_addr                      = 0x60c,
+	.csid_tpg_dt_n_cfg_0_addr                     = 0x610,
+	.csid_tpg_dt_n_cfg_1_addr                     = 0x614,
+	.csid_tpg_dt_n_cfg_2_addr                     = 0x618,
+	.csid_tpg_color_bars_cfg_addr                 = 0x640,
+	.csid_tpg_color_box_cfg_addr                  = 0x644,
+	.csid_tpg_common_gen_cfg_addr                 = 0x648,
+	.csid_tpg_cgen_n_cfg_addr                     = 0x650,
+	.csid_tpg_cgen_n_x0_addr                      = 0x654,
+	.csid_tpg_cgen_n_x1_addr                      = 0x658,
+	.csid_tpg_cgen_n_x2_addr                      = 0x65c,
+	.csid_tpg_cgen_n_xy_addr                      = 0x660,
+	.csid_tpg_cgen_n_y1_addr                      = 0x664,
+	.csid_tpg_cgen_n_y2_addr                      = 0x668,
+
+	/* configurations */
+	.tpg_dtn_cfg_offset                           = 0xc,
+	.tpg_cgen_cfg_offset                          = 0x20,
+	.tpg_cpas_ife_reg_offset                      = 0x28,
+};
+
+static struct cam_ife_csid_common_reg_offset
+			cam_ife_csid_480_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_reset_addr                              = 0xc,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 1,
+	.minor_version                                = 7,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.num_ppp                                      = 1,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.path_rst_stb_all                             = 0x7f,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.packing_fmt_shift_val                        = 30,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.drop_v_en_shift_val                          = 4,
+	.drop_h_en_shift_val                          = 3,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x7FFF,
+	.rdi_irq_mask_all                             = 0x7FFF,
+	.ppp_irq_mask_all                             = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xC,
+	.format_measure_en_val                        = 1,
+	.format_measure_height_mask_val               = 0xFFFF,
+	.format_measure_height_shift_val              = 0x10,
+	.format_measure_width_mask_val                = 0xFFFF,
+	.format_measure_width_shift_val               = 0x0,
+};
+
+static struct cam_ife_csid_reg_offset cam_ife_csid_480_reg_offset = {
+	.cmn_reg          = &cam_ife_csid_480_cmn_reg_offset,
+	.csi2_reg         = &cam_ife_csid_480_csi2_reg_offset,
+	.ipp_reg          = &cam_ife_csid_480_ipp_reg_offset,
+	.ppp_reg          = &cam_ife_csid_480_ppp_reg_offset,
+	.rdi_reg = {
+		&cam_ife_csid_480_rdi_0_reg_offset,
+		&cam_ife_csid_480_rdi_1_reg_offset,
+		&cam_ife_csid_480_rdi_2_reg_offset,
+		NULL,
+		},
+	.tpg_reg = &cam_ife_csid_480_tpg_reg_offset,
+};
+
+#endif /*_CAM_IFE_CSID_480_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
@@ -0,0 +1,5845 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+#include <media/cam_defs.h>
+
+#include <media/cam_req_mgr.h>
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_ife_csid_core.h"
+#include "cam_isp_hw.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_subdev.h"
+#include "cam_tasklet_util.h"
+
+/* Timeout value in msec */
+#define IFE_CSID_TIMEOUT                               1000
+
+/* TPG VC/DT values */
+#define CAM_IFE_CSID_TPG_VC_VAL                        0xA
+#define CAM_IFE_CSID_TPG_YUV_DT_VAL                    0x1e
+#define CAM_IFE_CSID_TPG_RGB_DT_VAL                    0x2B
+
+/* CSIPHY TPG VC/DT values */
+#define CAM_IFE_CPHY_TPG_VC_VAL                         0x0
+
+/* Timeout values in usec */
+#define CAM_IFE_CSID_TIMEOUT_SLEEP_US                  1000
+#define CAM_IFE_CSID_TIMEOUT_ALL_US                    100000
+
+#define CAM_IFE_CSID_RESET_TIMEOUT_MS                  100
+
+/*
+ * Constant Factors needed to change QTimer ticks to nanoseconds
+ * QTimer Freq = 19.2 MHz
+ * Time(us) = ticks/19.2
+ * Time(ns) = ticks/19.2 * 1000
+ */
+#define CAM_IFE_CSID_QTIMER_MUL_FACTOR                 10000
+#define CAM_IFE_CSID_QTIMER_DIV_FACTOR                 192
+
+/* Max number of sof irq's triggered in case of SOF freeze */
+#define CAM_CSID_IRQ_SOF_DEBUG_CNT_MAX 12
+
+/* Max CSI Rx irq error count threshold value */
+#define CAM_IFE_CSID_MAX_IRQ_ERROR_COUNT               100
+
+static int cam_ife_csid_reset_regs(
+	struct cam_ife_csid_hw *csid_hw, bool reset_hw);
+static int cam_ife_csid_is_ipp_ppp_format_supported(
+	uint32_t in_format)
+{
+	int rc = -EINVAL;
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_MIPI_RAW_20:
+	case CAM_FORMAT_DPCM_10_6_10:
+	case CAM_FORMAT_DPCM_10_8_10:
+	case CAM_FORMAT_DPCM_12_6_12:
+	case CAM_FORMAT_DPCM_12_8_12:
+	case CAM_FORMAT_DPCM_14_8_14:
+	case CAM_FORMAT_DPCM_14_10_14:
+	case CAM_FORMAT_DPCM_12_10_12:
+	case CAM_FORMAT_YUV422:
+	case CAM_FORMAT_YUV422_10:
+		rc = 0;
+		break;
+	default:
+		break;
+	}
+	return rc;
+}
+
+static int cam_ife_csid_get_format_rdi(
+	uint32_t in_format, uint32_t out_format, uint32_t *decode_fmt,
+	uint32_t *plain_fmt, uint32_t *packing_fmt, bool rpp, uint32_t *in_bpp)
+{
+	int rc = 0;
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_6:
+			*decode_fmt = 0xf;
+			if (rpp) {
+				*decode_fmt = 0x0;
+				*packing_fmt = 0x1;
+			}
+			break;
+		case CAM_FORMAT_PLAIN8:
+			*decode_fmt = 0x0;
+			*plain_fmt = 0x0;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		*in_bpp = 6;
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_PLAIN128:
+			*decode_fmt = 0xf;
+			if (rpp) {
+				*decode_fmt = 0x1;
+				*packing_fmt = 0x1;
+			}
+			break;
+		case CAM_FORMAT_PLAIN8:
+			*decode_fmt = 0x1;
+			*plain_fmt = 0x0;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		*in_bpp = 8;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_PLAIN128:
+			*decode_fmt = 0xf;
+			if (rpp) {
+				*decode_fmt = 0x2;
+				*packing_fmt = 0x1;
+			}
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+			*decode_fmt = 0x2;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		*in_bpp = 10;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_12:
+			*decode_fmt = 0xf;
+			if (rpp) {
+				*decode_fmt = 0x3;
+				*packing_fmt = 0x1;
+			}
+			break;
+		case CAM_FORMAT_PLAIN16_12:
+			*decode_fmt = 0x3;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		*in_bpp = 12;
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_14:
+			*decode_fmt = 0xf;
+			if (rpp) {
+				*decode_fmt = 0x4;
+				*packing_fmt = 0x1;
+			}
+			break;
+		case CAM_FORMAT_PLAIN16_14:
+			*decode_fmt = 0x4;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		*in_bpp = 14;
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_16:
+			*decode_fmt = 0xf;
+			if (rpp) {
+				*decode_fmt = 0x5;
+				*packing_fmt = 0x1;
+			}
+			break;
+		case CAM_FORMAT_PLAIN16_16:
+			*decode_fmt = 0x5;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		*in_bpp = 16;
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_20:
+			*decode_fmt = 0xf;
+			if (rpp) {
+				*decode_fmt = 0x6;
+				*packing_fmt = 0x1;
+			}
+			break;
+		case CAM_FORMAT_PLAIN32_20:
+			*decode_fmt = 0x6;
+			*plain_fmt = 0x2;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		*in_bpp = 20;
+		break;
+	case CAM_FORMAT_DPCM_10_6_10:
+		*decode_fmt  = 0x7;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_10_8_10:
+		*decode_fmt  = 0x8;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_12_6_12:
+		*decode_fmt  = 0x9;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_12_8_12:
+		*decode_fmt  = 0xA;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_14_8_14:
+		*decode_fmt  = 0xB;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_14_10_14:
+		*decode_fmt  = 0xC;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_12_10_12:
+		*decode_fmt  = 0xD;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_YUV422:
+		*decode_fmt  = 0x1;
+		*plain_fmt = 0x0;
+		break;
+	case CAM_FORMAT_YUV422_10:
+		*decode_fmt  = 0x2;
+		*plain_fmt = 0x1;
+		break;
+	default:
+		rc = -EINVAL;
+		break;
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Unsupported format pair in %d out %d",
+			in_format, out_format);
+
+	return rc;
+}
+
+static int cam_ife_csid_get_format_ipp_ppp(
+	uint32_t in_format,
+	uint32_t *decode_fmt, uint32_t *plain_fmt)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "input format:%d",
+		 in_format);
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		*decode_fmt  = 0;
+		*plain_fmt = 0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		*decode_fmt  = 0x1;
+		*plain_fmt = 0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		*decode_fmt  = 0x2;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		*decode_fmt  = 0x3;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		*decode_fmt  = 0x4;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		*decode_fmt  = 0x5;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_20:
+		*decode_fmt  = 0x6;
+		*plain_fmt = 0x2;
+		break;
+	case CAM_FORMAT_DPCM_10_6_10:
+		*decode_fmt  = 0x7;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_10_8_10:
+		*decode_fmt  = 0x8;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_12_6_12:
+		*decode_fmt  = 0x9;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_12_8_12:
+		*decode_fmt  = 0xA;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_14_8_14:
+		*decode_fmt  = 0xB;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_14_10_14:
+		*decode_fmt  = 0xC;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_DPCM_12_10_12:
+		*decode_fmt  = 0xD;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_YUV422:
+		*decode_fmt  = 0x1;
+		*plain_fmt = 0;
+		break;
+	case CAM_FORMAT_YUV422_10:
+		*decode_fmt  = 0x2;
+		*plain_fmt = 0x1;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported format %d",
+			in_format);
+		rc = -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "decode_fmt:%d plain_fmt:%d",
+		 *decode_fmt, *plain_fmt);
+
+	return rc;
+}
+
+static int cam_ife_match_vc_dt_pair(int32_t *vc, uint32_t *dt,
+	uint32_t num_valid_vc_dt, struct cam_ife_csid_cid_data *cid_data)
+{
+	uint32_t camera_hw_version;
+	int rc = 0;
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc:%d", rc);
+		return -EINVAL;
+	}
+
+	if ((camera_hw_version != CAM_CPAS_TITAN_480_V100) &&
+		(camera_hw_version != CAM_CPAS_TITAN_580_V100) &&
+		(camera_hw_version != CAM_CPAS_TITAN_570_V200))
+		num_valid_vc_dt = 1;
+
+	switch (num_valid_vc_dt) {
+	case 2:
+		if (vc[1] != cid_data->vc1 ||
+			dt[1] != cid_data->dt1)
+			return -EINVAL;
+		fallthrough;
+	case 1:
+		if (vc[0] != cid_data->vc ||
+			dt[0] != cid_data->dt)
+			return -EINVAL;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_cid_get(struct cam_ife_csid_hw *csid_hw,
+	struct cam_isp_resource_node **res, int32_t *vc, uint32_t *dt,
+	uint32_t num_valid_vc_dt)
+{
+	struct cam_ife_csid_cid_data    *cid_data;
+	uint32_t  i = 0;
+
+	*res = NULL;
+
+	/* Return already reserved CID if the VC/DT matches */
+	for (i = 0; i < CAM_IFE_CSID_CID_MAX; i++) {
+		if (csid_hw->cid_res[i].res_state >=
+			CAM_ISP_RESOURCE_STATE_RESERVED) {
+			cid_data = (struct cam_ife_csid_cid_data *)
+				csid_hw->cid_res[i].res_priv;
+			if (!cam_ife_match_vc_dt_pair(vc, dt,
+				num_valid_vc_dt, cid_data)) {
+				cid_data->cnt++;
+				*res = &csid_hw->cid_res[i];
+				CAM_DBG(CAM_ISP, "CSID:%d CID %d",
+					csid_hw->hw_intf->hw_idx,
+					csid_hw->cid_res[i].res_id);
+				return 0;
+			}
+		}
+	}
+
+	for (i = 0; i < CAM_IFE_CSID_CID_MAX; i++) {
+		if (csid_hw->cid_res[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			cid_data = (struct cam_ife_csid_cid_data *)
+				csid_hw->cid_res[i].res_priv;
+			cid_data->vc  = vc[0];
+			cid_data->dt  = dt[0];
+			if (num_valid_vc_dt > 1) {
+				cid_data->vc1  = vc[1];
+				cid_data->dt1  = dt[1];
+				cid_data->is_valid_vc1_dt1 = 1;
+			}
+			cid_data->cnt = 1;
+			csid_hw->cid_res[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			*res = &csid_hw->cid_res[i];
+			CAM_DBG(CAM_ISP, "CSID:%d CID %d allocated",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->cid_res[i].res_id);
+			return 0;
+		}
+	}
+
+	CAM_ERR(CAM_ISP, "CSID:%d Free cid is not available",
+		 csid_hw->hw_intf->hw_idx);
+
+	return -EINVAL;
+}
+
+
+static int cam_ife_csid_global_reset(struct cam_ife_csid_hw *csid_hw)
+{
+	struct cam_hw_soc_info                *soc_info;
+	const struct cam_ife_csid_reg_offset  *csid_reg;
+	int rc = 0;
+	uint32_t val = 0, i;
+	unsigned long flags;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid HW State:%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d Csid reset",
+		csid_hw->hw_intf->hw_idx);
+
+	spin_lock_irqsave(&csid_hw->hw_info->hw_lock, flags);
+
+	/* Mask all interrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_mask_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_mask_addr);
+
+	/* clear all interrupts */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+
+	cam_io_w_mb(csid_reg->csi2_reg->csi2_irq_mask_all,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(csid_reg->cmn_reg->ppp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_clear_addr);
+
+	for (i = 0 ; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->rdi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_clear_addr);
+
+	for (i = 0 ; i < csid_reg->cmn_reg->num_udis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->udi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[i]->csid_udi_irq_clear_addr);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	spin_unlock_irqrestore(&csid_hw->hw_info->hw_lock, flags);
+
+	cam_io_w_mb(0x80, soc_info->reg_map[0].mem_base +
+		csid_hw->csid_info->csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+
+	/* enable the IPP and RDI format measure */
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_cfg0_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_cfg0_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(0x2, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_cfg0_addr);
+
+	/* reset SW regs first, then HW */
+	rc = cam_ife_csid_reset_regs(csid_hw, false);
+	if (rc < 0)
+		goto end;
+	rc = cam_ife_csid_reset_regs(csid_hw, true);
+	if (rc < 0)
+		goto end;
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+	if (val != 0)
+		CAM_ERR(CAM_ISP, "CSID:%d IRQ value after reset rc = %d",
+			csid_hw->hw_intf->hw_idx, val);
+	csid_hw->error_irq_count = 0;
+	csid_hw->prev_boot_timestamp = 0;
+
+end:
+	return rc;
+}
+
+static int cam_ife_csid_path_reset(struct cam_ife_csid_hw *csid_hw,
+	struct cam_csid_reset_cfg_args  *reset)
+{
+	int rc = 0;
+	unsigned long rem_jiffies;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_isp_resource_node              *res;
+	const struct cam_ife_csid_reg_offset      *csid_reg;
+	uint32_t  reset_strb_addr, reset_strb_val, val, id;
+	struct completion  *complete;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	res      = reset->node_res;
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid hw state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d resource:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+		if (!csid_reg->ipp_reg) {
+			CAM_ERR(CAM_ISP, "CSID:%d IPP not supported :%d",
+				 csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			return -EINVAL;
+		}
+
+		reset_strb_addr = csid_reg->ipp_reg->csid_pxl_rst_strobes_addr;
+		complete = &csid_hw->csid_ipp_complete;
+
+		/* Enable path reset done interrupt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+		val |= CSID_PATH_INFO_RST_DONE;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			 csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+		if (!csid_reg->ppp_reg) {
+			CAM_ERR(CAM_ISP, "CSID:%d PPP not supported :%d",
+				csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			return -EINVAL;
+		}
+
+		reset_strb_addr = csid_reg->ppp_reg->csid_pxl_rst_strobes_addr;
+		complete = &csid_hw->csid_ppp_complete;
+
+		/* Enable path reset done interrupt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_mask_addr);
+		val |= CSID_PATH_INFO_RST_DONE;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			 csid_reg->ppp_reg->csid_pxl_irq_mask_addr);
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_RDI_1 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_RDI_2 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_RDI_3) {
+		id = res->res_id;
+		if (!csid_reg->rdi_reg[id]) {
+			CAM_ERR(CAM_ISP, "CSID:%d RDI res not supported :%d",
+				 csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			return -EINVAL;
+		}
+
+		reset_strb_addr =
+			csid_reg->rdi_reg[id]->csid_rdi_rst_strobes_addr;
+		complete =
+			&csid_hw->csid_rdin_complete[id];
+
+		/* Enable path reset done interrupt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+		val |= CSID_PATH_INFO_RST_DONE;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_UDI_0 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_UDI_1 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_UDI_2) {
+		id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+		if (!csid_reg->udi_reg[id]) {
+			CAM_ERR(CAM_ISP, "CSID:%d UDI res not supported :%d",
+				csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			return -EINVAL;
+		}
+
+		reset_strb_addr =
+			csid_reg->udi_reg[id]->csid_udi_rst_strobes_addr;
+		complete =
+			&csid_hw->csid_udin_complete[id];
+
+		/* Enable path reset done interrupt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[id]->csid_udi_irq_mask_addr);
+		val |= CSID_PATH_INFO_RST_DONE;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[id]->csid_udi_irq_mask_addr);
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res_id %u", res->res_id);
+		return -EINVAL;
+	}
+
+	reinit_completion(complete);
+	reset_strb_val = csid_reg->cmn_reg->path_rst_stb_all;
+
+	/* Reset the corresponding ife csid path */
+	cam_io_w_mb(reset_strb_val, soc_info->reg_map[0].mem_base +
+				reset_strb_addr);
+
+	rem_jiffies = wait_for_completion_timeout(complete,
+		msecs_to_jiffies(CAM_IFE_CSID_RESET_TIMEOUT_MS));
+	if (!rem_jiffies) {
+		rc = -ETIMEDOUT;
+		CAM_ERR(CAM_ISP, "CSID:%d Res id %d fail rc = %d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_id,  rc);
+	}
+
+end:
+	return rc;
+
+}
+
+int cam_ife_csid_cid_reserve(struct cam_ife_csid_hw *csid_hw,
+	struct cam_csid_hw_reserve_resource_args  *cid_reserv)
+{
+	int rc = 0, i, id;
+	struct cam_ife_csid_cid_data       *cid_data;
+	uint32_t camera_hw_version;
+	uint32_t valid_vc_dt;
+	uint32_t res_type;
+	struct cam_csid_soc_private *soc_priv;
+
+	if (!csid_hw || !csid_hw->csid_info) {
+		CAM_ERR(CAM_ISP, "Data is NULL");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"CSID:%d res_sel:0x%x Lane type:%d lane_num:%d dt:%d vc:%d cust_node:%u",
+		csid_hw->hw_intf->hw_idx,
+		cid_reserv->in_port->res_type,
+		cid_reserv->in_port->lane_type,
+		cid_reserv->in_port->lane_num,
+		cid_reserv->in_port->dt[0],
+		cid_reserv->in_port->vc[0],
+		cid_reserv->in_port->cust_node);
+
+	soc_priv = (struct cam_csid_soc_private *)
+		(csid_hw->hw_info->soc_info.soc_private);
+
+	if (soc_priv->is_ife_csid_lite && !cid_reserv->can_use_lite) {
+		CAM_DBG(CAM_ISP, "CSID[%u] not lite context",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	if (cid_reserv->in_port->res_type >= CAM_ISP_IFE_IN_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d  Invalid phy sel %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->res_type);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cid_reserv->in_port->lane_type >= CAM_ISP_LANE_TYPE_MAX &&
+		cid_reserv->in_port->res_type != CAM_ISP_IFE_IN_RES_TPG) {
+		CAM_ERR(CAM_ISP, "CSID:%d  Invalid lane type %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->lane_type);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((cid_reserv->in_port->lane_type ==  CAM_ISP_LANE_TYPE_DPHY &&
+		cid_reserv->in_port->lane_num > 4) &&
+		cid_reserv->in_port->res_type != CAM_ISP_IFE_IN_RES_TPG) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid lane num %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->lane_num);
+		rc = -EINVAL;
+		goto end;
+	}
+	if ((cid_reserv->in_port->lane_type == CAM_ISP_LANE_TYPE_CPHY &&
+		cid_reserv->in_port->lane_num > 3) &&
+		cid_reserv->in_port->res_type != CAM_ISP_IFE_IN_RES_TPG) {
+		CAM_ERR(CAM_ISP, " CSID:%d Invalid lane type %d & num %d",
+			 csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->lane_type,
+			cid_reserv->in_port->lane_num);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	valid_vc_dt = cid_reserv->in_port->num_valid_vc_dt;
+
+	/* CSID  CSI2 v2.0 supports 31 vc  */
+	for (i = 0; i < valid_vc_dt; i++) {
+		if (cid_reserv->in_port->vc[i] > 0x1f ||
+			cid_reserv->in_port->dt[i] > 0x3f) {
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d or dt: %d",
+				csid_hw->hw_intf->hw_idx,
+				cid_reserv->in_port->vc[i],
+				cid_reserv->in_port->dt[i]);
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	if (cid_reserv->in_port->res_type == CAM_ISP_IFE_IN_RES_TPG && (
+		(cid_reserv->in_port->format < CAM_FORMAT_MIPI_RAW_8 &&
+		cid_reserv->in_port->format > CAM_FORMAT_MIPI_RAW_16))) {
+		CAM_ERR(CAM_ISP, " CSID:%d Invalid tpg decode fmt %d",
+			 csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->format);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (csid_hw->csi2_reserve_cnt == UINT_MAX) {
+		CAM_ERR(CAM_ISP,
+			"CSID%d reserve cnt reached max",
+			csid_hw->hw_intf->hw_idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc:%d", rc);
+		goto end;
+	}
+	CAM_DBG(CAM_ISP, "HW version: %x", camera_hw_version);
+
+	switch (camera_hw_version) {
+	case CAM_CPAS_TITAN_NONE:
+	case CAM_CPAS_TITAN_MAX:
+		CAM_ERR(CAM_ISP, "Invalid HW version: %x", camera_hw_version);
+		break;
+	case CAM_CPAS_TITAN_170_V100:
+	case CAM_CPAS_TITAN_170_V110:
+	case CAM_CPAS_TITAN_170_V120:
+	case CAM_CPAS_TITAN_170_V200:
+		if (cid_reserv->in_port->res_type == CAM_ISP_IFE_IN_RES_PHY_3 &&
+			csid_hw->hw_intf->hw_idx != 2) {
+			rc = -EINVAL;
+			goto end;
+		}
+		csid_hw->csid_info->phy_num_mask =
+			csid_hw->csid_info->csid_reg->csi2_reg->csi2_rx_phy_num_mask;
+		break;
+	case CAM_CPAS_TITAN_480_V100:
+	case CAM_CPAS_TITAN_580_V100:
+		/*
+		 * Assigning existing two IFEs for custom in KONA,
+		 * this needs to be addressed accordingly for
+		 * upcoming targets
+		 */
+		if (cid_reserv->in_port->cust_node) {
+			if (cid_reserv->in_port->usage_type ==
+				CAM_ISP_RES_USAGE_DUAL) {
+				CAM_ERR(CAM_ISP,
+					"Dual IFE is not supported for cust_node %u",
+					cid_reserv->in_port->cust_node);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			if (cid_reserv->in_port->cust_node ==
+				CAM_ISP_ACQ_CUSTOM_PRIMARY) {
+				if (csid_hw->hw_intf->hw_idx != 0) {
+					CAM_ERR(CAM_ISP,
+						"CSID%d not eligible for cust_node: %u",
+						csid_hw->hw_intf->hw_idx,
+						cid_reserv->in_port->cust_node);
+					rc = -EINVAL;
+					goto end;
+				}
+			}
+
+			if (cid_reserv->in_port->cust_node ==
+				CAM_ISP_ACQ_CUSTOM_SECONDARY) {
+				if (csid_hw->hw_intf->hw_idx != 1) {
+					CAM_ERR(CAM_ISP,
+						"CSID%d not eligible for cust_node: %u",
+						csid_hw->hw_intf->hw_idx,
+						cid_reserv->in_port->cust_node);
+					rc = -EINVAL;
+					goto end;
+				}
+			}
+		}
+		csid_hw->csid_info->phy_num_mask =
+			csid_hw->csid_info->csid_reg->csi2_reg->csi2_rx_phy_num_mask;
+		break;
+		case CAM_CPAS_TITAN_165_V100:
+			CAM_INFO(CAM_ISP, "Hw version is 165_100");
+			/* For Unification between Full IFE and IFE Lite for
+			 * Titan 165 updating correct phy mask to support 5
+			 * CSIPHY hardware.
+			 */
+
+			csid_hw->csid_info->phy_num_mask = 0x7;
+		break;
+	default:
+		break;
+	}
+	CAM_DBG(CAM_ISP, "Reserve_cnt %u", csid_hw->csi2_reserve_cnt);
+
+	if (csid_hw->csi2_reserve_cnt) {
+		/* current configure res type should match requested res type */
+		if (csid_hw->res_type != cid_reserv->in_port->res_type) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if ((cid_reserv->in_port->res_type !=
+			CAM_ISP_IFE_IN_RES_TPG) &&
+			(csid_hw->csi2_rx_cfg.lane_cfg !=
+			cid_reserv->in_port->lane_cfg  ||
+			csid_hw->csi2_rx_cfg.lane_type !=
+			cid_reserv->in_port->lane_type ||
+			csid_hw->csi2_rx_cfg.lane_num !=
+			cid_reserv->in_port->lane_num)) {
+			rc = -EINVAL;
+			goto end;
+		}
+		if ((cid_reserv->in_port->res_type ==
+			CAM_ISP_IFE_IN_RES_TPG) &&
+			(csid_hw->tpg_cfg.in_format !=
+			cid_reserv->in_port->format     ||
+			csid_hw->tpg_cfg.width !=
+			cid_reserv->in_port->left_width ||
+			csid_hw->tpg_cfg.height !=
+			cid_reserv->in_port->height     ||
+			csid_hw->tpg_cfg.test_pattern !=
+			cid_reserv->in_port->test_pattern)) {
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	switch (cid_reserv->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		if (csid_hw->ipp_res.res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d IPP resource not available state %d",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->ipp_res.res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+		break;
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		if (csid_hw->ppp_res.res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d PPP resource not available state %d",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->ppp_res.res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+		if (csid_hw->rdi_res[cid_reserv->res_id].res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d RDI:%d resource not available state:%d",
+				csid_hw->hw_intf->hw_idx,
+				cid_reserv->res_id,
+				csid_hw->rdi_res[cid_reserv->res_id].res_state);
+			rc = -EAGAIN;
+			goto end;
+		}
+		break;
+	case CAM_IFE_PIX_PATH_RES_UDI_0:
+	case CAM_IFE_PIX_PATH_RES_UDI_1:
+	case CAM_IFE_PIX_PATH_RES_UDI_2:
+		id = cid_reserv->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+		if (csid_hw->udi_res[id].res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d UDI:%d resource not available state:%d",
+				csid_hw->hw_intf->hw_idx,
+				cid_reserv->res_id,
+				csid_hw->udi_res[id].res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID%d: Invalid csid path",
+			csid_hw->hw_intf->hw_idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_ife_csid_cid_get(csid_hw,
+		&cid_reserv->node_res,
+		cid_reserv->in_port->vc,
+		cid_reserv->in_port->dt,
+		cid_reserv->in_port->num_valid_vc_dt);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d CID Reserve failed res_type %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->res_type);
+		goto end;
+	}
+	cid_data = (struct cam_ife_csid_cid_data *)
+		cid_reserv->node_res->res_priv;
+
+	CAM_DBG(CAM_ISP, "Obtained cid:%d", cid_reserv->node_res->res_id);
+	if (!csid_hw->csi2_reserve_cnt) {
+		csid_hw->res_type = cid_reserv->in_port->res_type;
+
+		csid_hw->csi2_rx_cfg.lane_cfg =
+			cid_reserv->in_port->lane_cfg;
+		csid_hw->csi2_rx_cfg.lane_type =
+			cid_reserv->in_port->lane_type;
+		csid_hw->csi2_rx_cfg.lane_num =
+			cid_reserv->in_port->lane_num;
+
+		res_type = cid_reserv->in_port->res_type;
+		if ((res_type == CAM_ISP_IFE_IN_RES_CPHY_TPG_0) ||
+			(res_type == CAM_ISP_IFE_IN_RES_CPHY_TPG_1) ||
+			(res_type == CAM_ISP_IFE_IN_RES_CPHY_TPG_2)) {
+			csid_hw->csi2_rx_cfg.phy_sel =
+				(cid_reserv->phy_sel & 0xFF) - 1;
+			csid_hw->csi2_reserve_cnt++;
+			CAM_DBG(CAM_ISP, "CSID:%d CID:%d acquired",
+				csid_hw->hw_intf->hw_idx,
+				cid_reserv->node_res->res_id);
+			goto end;
+		}
+
+		if (cid_reserv->in_port->res_type != CAM_ISP_IFE_IN_RES_TPG) {
+			csid_hw->csi2_rx_cfg.phy_sel =
+				(cid_reserv->in_port->res_type & 0xFF) - 1;
+			csid_hw->csi2_reserve_cnt++;
+			CAM_DBG(CAM_ISP, "CSID:%d CID:%d acquired",
+				csid_hw->hw_intf->hw_idx,
+				cid_reserv->node_res->res_id);
+			goto end;
+		}
+
+		/* Below code is executed only for TPG in_res type */
+		csid_hw->csi2_rx_cfg.phy_sel = 0;
+		if ((cid_reserv->in_port->format != CAM_FORMAT_YUV422) &&
+			(cid_reserv->in_port->format >
+			    CAM_FORMAT_MIPI_RAW_16)) {
+			CAM_ERR(CAM_ISP, " Wrong TPG format %d",
+				cid_reserv->in_port->format);
+			rc = -EINVAL;
+			goto end;
+		}
+		csid_hw->tpg_cfg.in_format =
+			cid_reserv->in_port->format;
+		csid_hw->tpg_cfg.usage_type =
+			cid_reserv->in_port->usage_type;
+		if (cid_reserv->in_port->usage_type)
+			csid_hw->tpg_cfg.width =
+				(cid_reserv->in_port->right_stop + 1);
+		else
+			csid_hw->tpg_cfg.width =
+				cid_reserv->in_port->left_width;
+
+		csid_hw->tpg_cfg.height = cid_reserv->in_port->height;
+		csid_hw->tpg_cfg.test_pattern =
+			cid_reserv->in_port->test_pattern;
+
+		CAM_DBG(CAM_ISP, "CSID:%d TPG width:%d height:%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->tpg_cfg.width,
+			csid_hw->tpg_cfg.height);
+
+		cid_data->tpg_set = 1;
+	}
+
+	csid_hw->csi2_reserve_cnt++;
+	CAM_DBG(CAM_ISP, "CSID:%d CID:%d acquired phy_sel %u",
+		csid_hw->hw_intf->hw_idx,
+		cid_reserv->node_res->res_id,
+		csid_hw->csi2_rx_cfg.phy_sel);
+
+end:
+	return rc;
+}
+
+static bool cam_ife_csid_is_resolution_supported_by_fuse(uint32_t width)
+{
+	bool supported = true;
+	uint32_t hw_version, fuse_val = UINT_MAX;
+	int rc = 0;
+
+	rc = cam_cpas_get_cpas_hw_version(&hw_version);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Could not get CPAS version");
+		return supported;
+	}
+
+	switch (hw_version) {
+	case CAM_CPAS_TITAN_570_V200:
+		cam_cpas_is_feature_supported(CAM_CPAS_MP_LIMIT_FUSE,
+			CAM_CPAS_HW_IDX_ANY, &fuse_val);
+		switch (fuse_val) {
+		case 0x0:
+			if (width > CAM_CSID_RESOLUTION_22MP_WIDTH) {
+				CAM_ERR(CAM_ISP,
+					"Resolution not supported required_width: %d max_supported_width: %d",
+					width, CAM_CSID_RESOLUTION_22MP_WIDTH);
+				supported = false;
+			}
+			break;
+		case  0x1:
+			if (width > CAM_CSID_RESOLUTION_25MP_WIDTH) {
+				CAM_ERR(CAM_ISP,
+					"Resolution not supported required_width: %d max_supported_width: %d",
+					width, CAM_CSID_RESOLUTION_25MP_WIDTH);
+				supported  = false;
+			}
+			break;
+		case 0x2:
+			if (width > CAM_CSID_RESOLUTION_28MP_WIDTH) {
+				CAM_ERR(CAM_ISP,
+					"Resolution not supported required_width: %d max_supported_width: %d",
+					width, CAM_CSID_RESOLUTION_28MP_WIDTH);
+				supported = false;
+			}
+			break;
+		case UINT_MAX:
+			CAM_WARN(CAM_ISP, "Fuse value not updated");
+			break;
+		default:
+			CAM_ERR(CAM_ISP,
+				"Fuse value not defined, fuse_val: 0x%x",
+				fuse_val);
+			supported = false;
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+	return supported;
+}
+
+static bool cam_ife_csid_is_resolution_supported_by_dt(struct cam_ife_csid_hw *csid_hw,
+	uint32_t width)
+{
+	bool supported = true;
+	struct cam_hw_soc_info soc_info;
+	struct cam_csid_soc_private *soc_private = NULL;
+
+	if (!csid_hw || !csid_hw->hw_info) {
+		CAM_ERR(CAM_ISP, "Argument parsing error!");
+		supported = false;
+		goto end;
+	}
+
+	soc_info = csid_hw->hw_info->soc_info;
+
+	soc_private = (struct cam_csid_soc_private *)soc_info.soc_private;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "soc_private not found");
+		supported = false;
+		goto end;
+	}
+
+	if (soc_private->max_width_enabled) {
+		if (width > soc_private->max_width) {
+			CAM_ERR(CAM_ISP,
+				"Resolution not supported required_width: %d max_supported_width: %d",
+				width, soc_private->max_width);
+			supported = false;
+		}
+	}
+end:
+	return supported;
+}
+
+static bool cam_ife_csid_is_resolution_supported(struct cam_ife_csid_hw *csid_hw,
+	uint32_t width)
+{
+	bool supported = false;
+
+	if (!csid_hw) {
+		CAM_ERR(CAM_ISP, "csid_hw is NULL");
+		return supported;
+	}
+
+	if (cam_ife_csid_is_resolution_supported_by_fuse(width) &&
+		cam_ife_csid_is_resolution_supported_by_dt(csid_hw, width))
+		supported = true;
+	return supported;
+}
+
+int cam_ife_csid_path_reserve(struct cam_ife_csid_hw *csid_hw,
+	struct cam_csid_hw_reserve_resource_args  *reserve)
+{
+	int rc = 0, i, id;
+	struct cam_ife_csid_path_cfg    *path_data;
+	struct cam_isp_resource_node    *res;
+	bool                             is_rdi = false;
+	uint32_t                         width = 0;
+
+	/* CSID  CSI2 v2.0 supports 31 vc */
+	if (reserve->sync_mode >= CAM_ISP_HW_SYNC_MAX) {
+		CAM_ERR(CAM_ISP, "CSID: %d Sync Mode: %d",
+			csid_hw->hw_intf->hw_idx, reserve->sync_mode);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < reserve->in_port->num_valid_vc_dt; i++) {
+		if (reserve->in_port->dt[i] > 0x3f ||
+			reserve->in_port->vc[i] > 0x1f) {
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d dt %d",
+				csid_hw->hw_intf->hw_idx,
+				reserve->in_port->vc[i], reserve->in_port->dt[i]);
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	switch (reserve->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		if (csid_hw->ipp_res.res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d IPP resource not available %d",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->ipp_res.res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (cam_ife_csid_is_ipp_ppp_format_supported(
+				reserve->in_port->format)) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%d res id:%d un support format %d",
+				csid_hw->hw_intf->hw_idx, reserve->res_id,
+				reserve->in_port->format);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* assign the IPP resource */
+		res = &csid_hw->ipp_res;
+		CAM_DBG(CAM_ISP,
+			"CSID:%d IPP resource:%d acquired successfully",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+
+		break;
+	case CAM_IFE_PIX_PATH_RES_PPP:
+		if (csid_hw->ppp_res.res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d PPP resource not available %d",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->ppp_res.res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (cam_ife_csid_is_ipp_ppp_format_supported(
+				reserve->in_port->format)) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%d res id:%d unsupported format %d",
+				csid_hw->hw_intf->hw_idx, reserve->res_id,
+				reserve->in_port->format);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* assign the PPP resource */
+		res = &csid_hw->ppp_res;
+		CAM_DBG(CAM_ISP,
+			"CSID:%d PPP resource:%d acquired successfully",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+
+		break;
+	case CAM_IFE_PIX_PATH_RES_RDI_0:
+	case CAM_IFE_PIX_PATH_RES_RDI_1:
+	case CAM_IFE_PIX_PATH_RES_RDI_2:
+	case CAM_IFE_PIX_PATH_RES_RDI_3:
+		if (csid_hw->rdi_res[reserve->res_id].res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d RDI:%d resource not available %d",
+				csid_hw->hw_intf->hw_idx,
+				reserve->res_id,
+				csid_hw->rdi_res[reserve->res_id].res_state);
+			rc = -EINVAL;
+			goto end;
+		} else {
+			res = &csid_hw->rdi_res[reserve->res_id];
+			CAM_DBG(CAM_ISP,
+				"CSID:%d RDI resource:%d acquire success",
+				csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			is_rdi = true;
+		}
+
+		break;
+	case CAM_IFE_PIX_PATH_RES_UDI_0:
+	case CAM_IFE_PIX_PATH_RES_UDI_1:
+	case CAM_IFE_PIX_PATH_RES_UDI_2:
+		id = reserve->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+		if (csid_hw->udi_res[id].res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d UDI:%d resource not available %d",
+				csid_hw->hw_intf->hw_idx,
+				reserve->res_id,
+				csid_hw->udi_res[id].res_state);
+			rc = -EINVAL;
+			goto end;
+		} else {
+			res = &csid_hw->udi_res[id];
+			CAM_DBG(CAM_ISP,
+				"CSID:%d UDI resource:%d acquire success",
+				csid_hw->hw_intf->hw_idx,
+				res->res_id);
+		}
+
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id:%d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	path_data = (struct cam_ife_csid_path_cfg   *)res->res_priv;
+
+	path_data->cid = reserve->cid;
+	path_data->in_format = reserve->in_port->format;
+	path_data->out_format = reserve->out_port->format;
+	path_data->sync_mode = reserve->sync_mode;
+	path_data->height  = reserve->in_port->height;
+	path_data->start_line = reserve->in_port->line_start;
+	path_data->end_line = reserve->in_port->line_stop;
+	path_data->crop_enable = reserve->crop_enable;
+	path_data->drop_enable = reserve->drop_enable;
+	path_data->horizontal_bin = reserve->in_port->horizontal_bin;
+	path_data->qcfa_bin = reserve->in_port->qcfa_bin;
+	path_data->num_bytes_out = reserve->in_port->num_bytes_out;
+	path_data->hblank_cnt = reserve->in_port->hbi_cnt;
+
+	CAM_DBG(CAM_ISP,
+		"Res id: %d height:%d line_start %d line_stop %d crop_en %d hblank %u",
+		reserve->res_id, reserve->in_port->height,
+		reserve->in_port->line_start, reserve->in_port->line_stop,
+		path_data->crop_enable, path_data->hblank_cnt);
+
+
+	switch (reserve->in_port->res_type) {
+
+	case CAM_ISP_IFE_IN_RES_CPHY_TPG_0:
+	case CAM_ISP_IFE_IN_RES_CPHY_TPG_1:
+	case CAM_ISP_IFE_IN_RES_CPHY_TPG_2:
+		path_data->vc = CAM_IFE_CPHY_TPG_VC_VAL;
+
+		if (path_data->in_format == CAM_FORMAT_YUV422)
+			path_data->dt = CAM_IFE_CSID_TPG_YUV_DT_VAL;
+		else
+			path_data->dt = CAM_IFE_CSID_TPG_RGB_DT_VAL;
+		break;
+
+	case CAM_ISP_IFE_IN_RES_TPG:
+		path_data->vc = CAM_IFE_CSID_TPG_VC_VAL;
+
+		if (path_data->in_format == CAM_FORMAT_YUV422)
+			path_data->dt = CAM_IFE_CSID_TPG_YUV_DT_VAL;
+		else
+			path_data->dt = CAM_IFE_CSID_TPG_RGB_DT_VAL;
+		break;
+
+	default:
+		path_data->dt = reserve->in_port->dt[0];
+		path_data->vc = reserve->in_port->vc[0];
+		if (reserve->in_port->num_valid_vc_dt) {
+			path_data->dt1 = reserve->in_port->dt[1];
+			path_data->vc1 = reserve->in_port->vc[1];
+			path_data->is_valid_vc1_dt1 = 1;
+		}
+		break;
+	}
+
+	if (reserve->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+		width = reserve->in_port->left_stop -
+			reserve->in_port->left_start + 1;
+		if (path_data->horizontal_bin || path_data->qcfa_bin)
+			width /= 2;
+		if ((reserve->res_id == CAM_IFE_PIX_PATH_RES_IPP) &&
+			!(cam_ife_csid_is_resolution_supported(csid_hw,
+			width))) {
+			rc = -EINVAL;
+			goto end;
+		}
+		path_data->start_pixel = reserve->in_port->left_start;
+		path_data->end_pixel = reserve->in_port->left_stop;
+		path_data->width  = reserve->in_port->left_width;
+
+		if (is_rdi) {
+			path_data->end_pixel = reserve->in_port->right_stop;
+			path_data->width = path_data->end_pixel -
+				path_data->start_pixel + 1;
+		}
+
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d master:startpixel 0x%x endpixel:0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_data->start_pixel, path_data->end_pixel);
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d master:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_data->start_line, path_data->end_line);
+	} else if (reserve->sync_mode == CAM_ISP_HW_SYNC_SLAVE) {
+		width = reserve->in_port->right_stop -
+			reserve->in_port->right_start + 1;
+		if (path_data->horizontal_bin || path_data->qcfa_bin)
+			width /= 2;
+		if ((reserve->res_id == CAM_IFE_PIX_PATH_RES_IPP) &&
+			!(cam_ife_csid_is_resolution_supported(csid_hw,
+			width))) {
+			rc = -EINVAL;
+			goto end;
+		}
+		path_data->master_idx = reserve->master_idx;
+		CAM_DBG(CAM_ISP, "CSID:%d master_idx=%d",
+			csid_hw->hw_intf->hw_idx, path_data->master_idx);
+		path_data->start_pixel = reserve->in_port->right_start;
+		path_data->end_pixel = reserve->in_port->right_stop;
+		path_data->width  = reserve->in_port->right_width;
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d slave:start:0x%x end:0x%x width 0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_data->start_pixel, path_data->end_pixel,
+			path_data->width);
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d slave:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			path_data->start_line, path_data->end_line);
+	} else {
+		width = reserve->in_port->left_stop -
+			reserve->in_port->left_start + 1;
+		if (path_data->horizontal_bin || path_data->qcfa_bin)
+			width /= 2;
+		if ((reserve->res_id == CAM_IFE_PIX_PATH_RES_IPP) &&
+			!(cam_ife_csid_is_resolution_supported(csid_hw,
+			width))) {
+			rc = -EINVAL;
+			goto end;
+		}
+		path_data->width  = reserve->in_port->left_width;
+		path_data->start_pixel = reserve->in_port->left_start;
+		path_data->end_pixel = reserve->in_port->left_stop;
+		CAM_DBG(CAM_ISP,
+			"CSID:%d res:%d left width %d start: %d stop:%d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id,
+			reserve->in_port->left_width,
+			reserve->in_port->left_start,
+			reserve->in_port->left_stop);
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res:%d width %d height %d",
+		csid_hw->hw_intf->hw_idx, reserve->res_id,
+		path_data->width, path_data->height);
+	reserve->node_res = res;
+	csid_hw->event_cb = reserve->event_cb;
+	csid_hw->priv = reserve->priv;
+
+end:
+	return rc;
+}
+
+static int cam_ife_csid_enable_hw(struct cam_ife_csid_hw  *csid_hw)
+{
+	int rc = 0;
+	const struct cam_ife_csid_reg_offset   *csid_reg;
+	struct cam_hw_soc_info                 *soc_info;
+	uint32_t                               i;
+	int                                    clk_lvl;
+	unsigned long                          flags;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	/* overflow check before increment */
+	if (csid_hw->hw_info->open_count == UINT_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Open count reached max",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	/* Increment ref Count */
+	csid_hw->hw_info->open_count++;
+	if (csid_hw->hw_info->open_count > 1) {
+		CAM_DBG(CAM_ISP, "CSID hw has already been enabled");
+		return rc;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d init CSID HW",
+		csid_hw->hw_intf->hw_idx);
+
+	rc = cam_soc_util_get_clk_level(soc_info, csid_hw->clk_rate,
+		soc_info->src_clk_idx, &clk_lvl);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get clk level for rate %lld",
+			csid_hw->clk_rate);
+		goto err;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID clock lvl %d", clk_lvl);
+
+	rc = cam_ife_csid_enable_soc_resources(soc_info, clk_lvl);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d Enable SOC failed",
+			csid_hw->hw_intf->hw_idx);
+		goto err;
+	}
+
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_UP;
+	/* Reset CSID top */
+	rc = cam_ife_csid_global_reset(csid_hw);
+	if (rc)
+		goto disable_soc;
+
+	spin_lock_irqsave(&csid_hw->hw_info->hw_lock, flags);
+
+	/* clear all interrupts */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+
+	cam_io_w_mb(csid_reg->csi2_reg->csi2_irq_mask_all,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(csid_reg->cmn_reg->ppp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_clear_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->rdi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_clear_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_udis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->udi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[i]->csid_udi_irq_clear_addr);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	spin_unlock_irqrestore(&csid_hw->hw_info->hw_lock, flags);
+
+	csid_hw->csid_info->hw_reg_version =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_hw_version_addr);
+	CAM_DBG(CAM_ISP, "CSID:%d CSID HW version: 0x%x",
+		csid_hw->hw_intf->hw_idx,
+		csid_hw->csid_info->hw_reg_version);
+
+	spin_lock_irqsave(&csid_hw->lock_state, flags);
+	csid_hw->fatal_err_detected = false;
+	csid_hw->device_enabled = 1;
+	spin_unlock_irqrestore(&csid_hw->lock_state, flags);
+	cam_tasklet_start(csid_hw->tasklet);
+
+	return 0;
+
+disable_soc:
+	cam_ife_csid_disable_soc_resources(soc_info);
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+err:
+	csid_hw->hw_info->open_count--;
+	return rc;
+}
+
+static int cam_ife_csid_disable_hw(struct cam_ife_csid_hw *csid_hw)
+{
+	int rc = -EINVAL;
+	uint32_t i;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_reg_offset     *csid_reg;
+	unsigned long                             flags;
+
+	/* Check for refcount */
+	if (!csid_hw->hw_info->open_count) {
+		CAM_WARN(CAM_ISP, "Unbalanced disable_hw");
+		return rc;
+	}
+
+	/*  Decrement ref Count */
+	csid_hw->hw_info->open_count--;
+
+	if (csid_hw->hw_info->open_count) {
+		rc = 0;
+		return rc;
+	}
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	CAM_DBG(CAM_ISP, "%s:Calling Global Reset\n", __func__);
+	cam_ife_csid_global_reset(csid_hw);
+	CAM_DBG(CAM_ISP, "%s:Global Reset Done\n", __func__);
+
+	CAM_DBG(CAM_ISP, "CSID:%d De-init CSID HW",
+		csid_hw->hw_intf->hw_idx);
+
+	/*disable the top IRQ interrupt */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_mask_addr);
+
+	cam_tasklet_stop(csid_hw->tasklet);
+
+	rc = cam_ife_csid_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CSID:%d Disable CSID SOC failed",
+			csid_hw->hw_intf->hw_idx);
+
+	spin_lock_irqsave(&csid_hw->lock_state, flags);
+	csid_hw->device_enabled = 0;
+	spin_unlock_irqrestore(&csid_hw->lock_state, flags);
+
+	csid_hw->ipp_path_config.measure_enabled = 0;
+	csid_hw->ppp_path_config.measure_enabled = 0;
+	for (i = 0; i <= CAM_IFE_PIX_PATH_RES_RDI_3; i++)
+		csid_hw->rdi_path_config[i].measure_enabled = 0;
+
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	csid_hw->error_irq_count = 0;
+	csid_hw->prev_boot_timestamp = 0;
+	csid_hw->epd_supported = 0;
+
+	return rc;
+}
+
+
+static int cam_ife_csid_tpg_start(struct cam_ife_csid_hw   *csid_hw,
+	struct cam_isp_resource_node       *res)
+{
+	int rc = 0;
+	uint32_t  val = 0;
+	struct cam_hw_soc_info    *soc_info;
+	const struct cam_ife_csid_reg_offset *csid_reg = NULL;
+
+	csid_hw->tpg_start_cnt++;
+	if (csid_hw->tpg_start_cnt == 1) {
+		/*Enable the TPG */
+		CAM_DBG(CAM_ISP, "CSID:%d start CSID TPG",
+			csid_hw->hw_intf->hw_idx);
+
+		soc_info = &csid_hw->hw_info->soc_info;
+		{
+			uint32_t val;
+			uint32_t i;
+			uint32_t base = 0x600;
+
+			CAM_DBG(CAM_ISP, "================ TPG ============");
+			for (i = 0; i < 16; i++) {
+				val = cam_io_r_mb(
+					soc_info->reg_map[0].mem_base +
+					base + i * 4);
+				CAM_DBG(CAM_ISP, "reg 0x%x = 0x%x",
+					(base + i*4), val);
+			}
+
+			CAM_DBG(CAM_ISP, "================ IPP =============");
+			base = 0x200;
+			for (i = 0; i < 10; i++) {
+				val = cam_io_r_mb(
+					soc_info->reg_map[0].mem_base +
+					base + i * 4);
+				CAM_DBG(CAM_ISP, "reg 0x%x = 0x%x",
+					(base + i*4), val);
+			}
+
+			CAM_DBG(CAM_ISP, "================ RX =============");
+			base = 0x100;
+			for (i = 0; i < 5; i++) {
+				val = cam_io_r_mb(
+					soc_info->reg_map[0].mem_base +
+					base + i * 4);
+				CAM_DBG(CAM_ISP, "reg 0x%x = 0x%x",
+					(base + i*4), val);
+			}
+		}
+
+		/* Enable the IFE force clock on for dual isp case */
+		csid_reg = csid_hw->csid_info->csid_reg;
+		if (csid_hw->tpg_cfg.usage_type) {
+			rc = cam_ife_csid_enable_ife_force_clock_on(soc_info,
+				csid_reg->tpg_reg->tpg_cpas_ife_reg_offset);
+			if (rc)
+				return rc;
+		}
+
+		CAM_DBG(CAM_ISP, "============ TPG control ============");
+		val = (4 << 20);
+		val |= (0x80 << 8);
+		val |= (((csid_hw->csi2_rx_cfg.lane_num - 1) & 0x3) << 4);
+		val |= 7;
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->tpg_reg->csid_tpg_ctrl_addr);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base + 0x600);
+		CAM_DBG(CAM_ISP, "reg 0x%x = 0x%x", 0x600, val);
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_ife_csid_tpg_stop(struct cam_ife_csid_hw   *csid_hw,
+	struct cam_isp_resource_node       *res)
+{
+	int rc = 0;
+	struct cam_hw_soc_info                 *soc_info;
+	const struct cam_ife_csid_reg_offset   *csid_reg = NULL;
+
+	if (csid_hw->tpg_start_cnt)
+		csid_hw->tpg_start_cnt--;
+
+	if (csid_hw->tpg_start_cnt)
+		return 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	/* disable the TPG */
+	if (!csid_hw->tpg_start_cnt) {
+		CAM_DBG(CAM_ISP, "CSID:%d stop CSID TPG",
+			csid_hw->hw_intf->hw_idx);
+
+		/* Disable the IFE force clock on for dual isp case */
+		if (csid_hw->tpg_cfg.usage_type)
+			rc = cam_ife_csid_disable_ife_force_clock_on(soc_info,
+				csid_reg->tpg_reg->tpg_cpas_ife_reg_offset);
+
+		/*stop the TPG */
+		cam_io_w_mb(0,  soc_info->reg_map[0].mem_base +
+		csid_hw->csid_info->csid_reg->tpg_reg->csid_tpg_ctrl_addr);
+	}
+
+	return 0;
+}
+
+
+static int cam_ife_csid_config_tpg(struct cam_ife_csid_hw   *csid_hw,
+	struct cam_isp_resource_node       *res)
+{
+	const struct cam_ife_csid_reg_offset *csid_reg;
+	struct cam_hw_soc_info               *soc_info;
+	uint32_t val = 0;
+	uint32_t dt, in_format, test_pattern;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	CAM_DBG(CAM_ISP, "CSID:%d TPG config",
+		csid_hw->hw_intf->hw_idx);
+
+	/* configure one DT, infinite frames */
+	val = (0 << 16) | (1 << 10) | CAM_IFE_CSID_TPG_VC_VAL;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->tpg_reg->csid_tpg_vc_cfg0_addr);
+
+	/* vertical blanking count = 0x3FF, horzontal blanking count = 0x740*/
+	val = (0x3FF << 12) | 0x740;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->tpg_reg->csid_tpg_vc_cfg1_addr);
+
+	cam_io_w_mb(0x12345678, soc_info->reg_map[0].mem_base +
+		csid_hw->csid_info->csid_reg->tpg_reg->csid_tpg_lfsr_seed_addr);
+
+	val = csid_hw->tpg_cfg.width << 16 |
+		csid_hw->tpg_cfg.height;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->tpg_reg->csid_tpg_dt_n_cfg_0_addr);
+
+	if (csid_hw->tpg_cfg.in_format == CAM_FORMAT_YUV422) {
+		in_format = 0x2;
+		dt = CAM_IFE_CSID_TPG_YUV_DT_VAL;
+		test_pattern = 0x4;
+	} else {
+		in_format = csid_hw->tpg_cfg.in_format;
+		dt = CAM_IFE_CSID_TPG_RGB_DT_VAL;
+		test_pattern = csid_hw->tpg_cfg.test_pattern;
+	}
+
+	cam_io_w_mb(dt, soc_info->reg_map[0].mem_base +
+		csid_reg->tpg_reg->csid_tpg_dt_n_cfg_1_addr);
+
+	/*
+	 * in_format is the same as the input resource format.
+	 * it is one larger than the register spec format.
+	 */
+	val = ((in_format - 1) << 16) | 0x8;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->tpg_reg->csid_tpg_dt_n_cfg_2_addr);
+
+	/* static frame with split color bar */
+	val =  1 << 5;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->tpg_reg->csid_tpg_color_bars_cfg_addr);
+	/* config pix pattern */
+	cam_io_w_mb(test_pattern,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->tpg_reg->csid_tpg_common_gen_cfg_addr);
+
+	return 0;
+}
+
+static int cam_ife_csid_csi2_irq_ctrl(
+	struct cam_ife_csid_hw *csid_hw,
+	bool irq_enable)
+{
+	uint32_t val = 0;
+	struct cam_hw_soc_info                     *soc_info;
+	const struct cam_ife_csid_reg_offset       *csid_reg;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (irq_enable) {
+		/*Enable the CSI2 rx interrupts */
+		val = CSID_CSI2_RX_INFO_RST_DONE |
+			CSID_CSI2_RX_ERROR_TG_FIFO_OVERFLOW |
+			CSID_CSI2_RX_ERROR_LANE0_FIFO_OVERFLOW |
+			CSID_CSI2_RX_ERROR_LANE1_FIFO_OVERFLOW |
+			CSID_CSI2_RX_ERROR_LANE2_FIFO_OVERFLOW |
+			CSID_CSI2_RX_ERROR_LANE3_FIFO_OVERFLOW |
+			CSID_CSI2_RX_ERROR_CPHY_SOT_RECEPTION |
+			CSID_CSI2_RX_ERROR_CRC |
+			CSID_CSI2_RX_ERROR_ECC |
+			CSID_CSI2_RX_ERROR_MMAPPED_VC_DT |
+			CSID_CSI2_RX_ERROR_STREAM_UNDERFLOW |
+			CSID_CSI2_RX_ERROR_UNBOUNDED_FRAME |
+			CSID_CSI2_RX_ERROR_CPHY_PH_CRC;
+
+		if (csid_hw->epd_supported == 1)
+			CAM_INFO(CAM_ISP,
+				"Disable CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION for EPD");
+		else
+			val = val | CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION;
+
+		/* Enable the interrupt based on csid debug info set */
+		if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOT_IRQ)
+			val |= CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED |
+				CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED |
+				CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED |
+				CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED;
+
+		if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOT_IRQ)
+			val |= CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED |
+				CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED |
+				CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED |
+				CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED;
+
+		if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+			val |= CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED;
+
+		if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+			val |= CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED;
+		if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+			val |= CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED;
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+	} else {
+		/* Disable the CSI2 rx inerrupts */
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_enable_csi2(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	const struct cam_ife_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_ife_csid_cid_data               *cid_data;
+	uint32_t val = 0;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	CAM_DBG(CAM_ISP, "CSID:%d count:%d config csi2 rx res_id: %d",
+		csid_hw->hw_intf->hw_idx, csid_hw->csi2_cfg_cnt,
+		res->res_id);
+
+	/* overflow check before increment */
+	if (csid_hw->csi2_cfg_cnt == UINT_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Open count reached max",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	cid_data = (struct cam_ife_csid_cid_data *)res->res_priv;
+	cid_data->init_cnt++;
+	res->res_state  = CAM_ISP_RESOURCE_STATE_STREAMING;
+	csid_hw->csi2_cfg_cnt++;
+	if (csid_hw->csi2_cfg_cnt > 1)
+		return rc;
+
+	/* rx cfg0 */
+	val = 0;
+	val = (csid_hw->csi2_rx_cfg.lane_num - 1)  |
+		(csid_hw->csi2_rx_cfg.lane_cfg << 4) |
+		(csid_hw->csi2_rx_cfg.lane_type << 24);
+	val |= (csid_hw->csi2_rx_cfg.phy_sel &
+		csid_hw->csid_info->phy_num_mask) << 20;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg0_addr);
+
+	/* rx cfg1*/
+	val = (1 << csid_reg->csi2_reg->csi2_misr_enable_shift_val);
+	/* if VC value is more than 3 than set full width of VC */
+	if (cid_data->vc > 3 || (cid_data->is_valid_vc1_dt1 &&
+		cid_data->vc1 > 3))
+		val |= (1 << csid_reg->csi2_reg->csi2_vc_mode_shift_val);
+
+	/* enable packet ecc correction */
+	val |= 1;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+
+	if (csid_hw->res_type == CAM_ISP_IFE_IN_RES_TPG) {
+		/* Config the TPG */
+		rc = cam_ife_csid_config_tpg(csid_hw, res);
+		if (rc) {
+			res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+			return rc;
+		}
+	}
+
+	cam_ife_csid_csi2_irq_ctrl(csid_hw, true);
+	return 0;
+}
+
+static int cam_ife_csid_disable_csi2(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_ife_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_ife_csid_cid_data              *cid_data;
+
+	if (res->res_id >= CAM_IFE_CSID_CID_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id :%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	cid_data = (struct cam_ife_csid_cid_data *)res->res_priv;
+	CAM_DBG(CAM_ISP, "CSID:%d cnt : %d Disable csi2 rx res->res_id: %d",
+		csid_hw->hw_intf->hw_idx, csid_hw->csi2_cfg_cnt,
+		res->res_id);
+
+	if (cid_data->init_cnt)
+		cid_data->init_cnt--;
+	if (!cid_data->init_cnt)
+		res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	if (csid_hw->csi2_cfg_cnt)
+		csid_hw->csi2_cfg_cnt--;
+
+	CAM_DBG(CAM_ISP, "res_id %d res_state=%d",
+		res->res_id, res->res_state);
+
+	if (csid_hw->csi2_cfg_cnt)
+		return 0;
+
+	cam_ife_csid_csi2_irq_ctrl(csid_hw, false);
+
+	/* Reset the Rx CFG registers */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg0_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return 0;
+}
+
+static void cam_ife_csid_halt_csi2(
+	struct cam_ife_csid_hw          *csid_hw)
+{
+	const struct cam_ife_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	CAM_INFO(CAM_ISP, "CSID: %d cnt: %d Halt csi2 rx",
+		csid_hw->hw_intf->hw_idx, csid_hw->csi2_cfg_cnt);
+
+	/* Disable the CSI2 rx inerrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+	/* Reset the Rx CFG registers */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg0_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+}
+
+static int cam_ife_csid_init_config_pxl_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	struct cam_ife_csid_path_cfg             *path_data;
+	const struct cam_ife_csid_reg_offset     *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_ife_csid_pxl_reg_offset *pxl_reg = NULL;
+	bool                                      is_ipp;
+	uint32_t decode_format = 0, plain_format = 0, val = 0;
+	uint32_t camera_hw_version;
+	struct cam_isp_sensor_dimension  *path_config;
+
+	path_data = (struct cam_ife_csid_path_cfg  *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+		is_ipp = true;
+		pxl_reg = csid_reg->ipp_reg;
+		path_config = &(csid_hw->ipp_path_config);
+	} else {
+		is_ipp = false;
+		pxl_reg = csid_reg->ppp_reg;
+		path_config = &(csid_hw->ppp_path_config);
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d %s:%d is not supported on HW",
+			csid_hw->hw_intf->hw_idx,
+			(is_ipp) ? "IPP" : "PPP", res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Config %s Path", (is_ipp) ? "IPP" : "PPP");
+	rc = cam_ife_csid_get_format_ipp_ppp(path_data->in_format,
+		&decode_format, &plain_format);
+	if (rc)
+		return rc;
+
+	/*
+	 * configure Pxl path and enable the time stamp capture.
+	 * enable the HW measrurement blocks
+	 */
+	val = (path_data->vc << csid_reg->cmn_reg->vc_shift_val) |
+		(path_data->dt << csid_reg->cmn_reg->dt_shift_val) |
+		(path_data->cid << csid_reg->cmn_reg->dt_id_shift_val) |
+		(decode_format << csid_reg->cmn_reg->fmt_shift_val) |
+		(path_data->crop_enable <<
+		csid_reg->cmn_reg->crop_h_en_shift_val) |
+		(path_data->crop_enable <<
+		csid_reg->cmn_reg->crop_v_en_shift_val) |
+		(1 << 1) | 1;
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc:%d", rc);
+		camera_hw_version = 0;
+	}
+	CAM_DBG(CAM_ISP, "HW version: %x", camera_hw_version);
+
+	if ((camera_hw_version == CAM_CPAS_TITAN_480_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_580_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_570_V200))
+		val |= (path_data->drop_enable <<
+			csid_reg->cmn_reg->drop_h_en_shift_val) |
+			(path_data->drop_enable <<
+			csid_reg->cmn_reg->drop_v_en_shift_val);
+
+	if (path_data->horizontal_bin || path_data->qcfa_bin) {
+		val |= (1 << pxl_reg->horizontal_bin_en_shift_val);
+		if (path_data->qcfa_bin)
+			val |= (1 << pxl_reg->quad_cfa_bin_en_shift_val);
+	}
+
+	if (is_ipp && csid_hw->binning_supported &&
+		csid_hw->binning_enable) {
+		val |= (1 << pxl_reg->quad_cfa_bin_en_shift_val);
+		val |= (1 << pxl_reg->horizontal_bin_en_shift_val);
+	}
+
+	val |= (1 << pxl_reg->pix_store_en_shift_val);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg0_addr);
+
+	if (path_data->is_valid_vc1_dt1 &&
+		((camera_hw_version == CAM_CPAS_TITAN_480_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_580_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_570_V200))) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_multi_vcdt_cfg0_addr);
+		val |= ((path_data->vc1 << 2) |
+			(path_data->dt1 << 7) | 1);
+	}
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg1_addr);
+
+	/* Program min hbi between lines */
+	if ((path_data->hblank_cnt) && (path_data->hblank_cnt <=
+		(CAM_CSID_MIN_HBI_CFG_MAX_VAL * 16))) {
+		if ((path_data->hblank_cnt % 16) == 0)
+			val |= ((path_data->hblank_cnt / 16) <<
+				pxl_reg->hblank_cfg_shift_val);
+		else
+			val |=  (((path_data->hblank_cnt / 16) + 1) <<
+				pxl_reg->hblank_cfg_shift_val);
+	}
+
+	/* select the post irq sub sample strobe for time stamp capture */
+	val |= CSID_TIMESTAMP_STB_POST_IRQ;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg1_addr);
+
+	if (path_data->crop_enable) {
+		val = (((path_data->end_pixel & 0xFFFF) <<
+			csid_reg->cmn_reg->crop_shift) |
+			(path_data->start_pixel & 0xFFFF));
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_hcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Horizontal crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		val = (((path_data->end_line & 0xFFFF) <<
+			csid_reg->cmn_reg->crop_shift) |
+			(path_data->start_line & 0xFFFF));
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_vcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Vertical Crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		/* Enable generating early eof strobe based on crop config.
+		 * Skip for version 480 HW due to HW limitation.
+		 */
+		if (!(csid_hw->csid_debug & CSID_DEBUG_DISABLE_EARLY_EOF) &&
+			(camera_hw_version != CAM_CPAS_TITAN_480_V100) &&
+			(camera_hw_version != CAM_CPAS_TITAN_580_V100) &&
+			(camera_hw_version != CAM_CPAS_TITAN_570_V200)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_cfg0_addr);
+			val |= (1 << pxl_reg->early_eof_en_shift_val);
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_cfg0_addr);
+		}
+	}
+
+	/* set frame drop pattern to 0 and period to 1 */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_frm_drop_period_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_frm_drop_pattern_addr);
+	/* set irq sub sample pattern to 0 and period to 1 */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_subsample_period_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_subsample_pattern_addr);
+
+	/* configure pixel format measure */
+	if (path_config->measure_enabled) {
+		val = (((path_config->height  &
+			csid_reg->cmn_reg->format_measure_height_mask_val) <<
+			csid_reg->cmn_reg->format_measure_height_shift_val) |
+			(path_config->width &
+			csid_reg->cmn_reg->format_measure_width_mask_val));
+		CAM_DBG(CAM_ISP, "CSID:%d format measure cfg1 value : 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_format_measure_cfg1_addr);
+
+		/* enable pixel and line counter */
+		cam_io_w_mb(3, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_format_measure_cfg0_addr);
+	}
+
+	/* set pxl drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_pix_drop_pattern_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_pix_drop_period_addr);
+	/* set line drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_line_drop_pattern_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_line_drop_period_addr);
+
+
+	/* Enable the Pxl path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg0_addr);
+	val |= (1 << csid_reg->cmn_reg->path_en_shift_val);
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_HBI_VBI_INFO)
+		val |= csid_reg->cmn_reg->format_measure_en_val;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg0_addr);
+
+	/* Enable Error Detection */
+	if (pxl_reg->overflow_ctrl_en) {
+		val = pxl_reg->overflow_ctrl_en;
+		/* Overflow ctrl mode: 2 -> Detect overflow */
+		val |= 0x8;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_err_recovery_cfg0_addr);
+	}
+
+	/* Enable the HBI/VBI counter */
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_format_measure_cfg0_addr);
+		val |= csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val,
+			soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_format_measure_cfg0_addr);
+	}
+
+	/* configure the rx packet capture based on csid debug set */
+	val = 0;
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val = ((1 <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_en_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_vc_shift));
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_capture_ctrl_addr);
+	CAM_DBG(CAM_ISP, "rx capture control value 0x%x", val);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	return rc;
+}
+
+static int cam_ife_csid_deinit_pxl_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	uint32_t val;
+	const struct cam_ife_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	const struct cam_ife_csid_pxl_reg_offset  *pxl_reg = NULL;
+	bool                                       is_ipp;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+		is_ipp = true;
+		pxl_reg = csid_reg->ipp_reg;
+	} else {
+		is_ipp = false;
+		pxl_reg = csid_reg->ppp_reg;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s Res type %d res_id:%d in wrong state %d",
+			csid_hw->hw_intf->hw_idx,
+			(is_ipp) ? "IPP" : "PPP",
+			res->res_type, res->res_id, res->res_state);
+		rc = -EINVAL;
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d %s %d is not supported on HW",
+			csid_hw->hw_intf->hw_idx, (is_ipp) ? "IPP" : "PPP",
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Disable Error Recovery */
+	if (pxl_reg->overflow_ctrl_en)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_err_recovery_cfg0_addr);
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_cfg0_addr);
+	if (val & csid_reg->cmn_reg->format_measure_en_val) {
+		val &= ~csid_reg->cmn_reg->format_measure_en_val;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_cfg0_addr);
+
+		/* Disable the HBI/VBI counter */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_format_measure_cfg0_addr);
+		val &= ~csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_format_measure_cfg0_addr);
+	}
+
+end:
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_ife_csid_enable_pxl_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_ife_csid_reg_offset     *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	struct cam_ife_csid_path_cfg             *path_data;
+	const struct cam_ife_csid_pxl_reg_offset *pxl_reg = NULL;
+	bool                                      is_ipp;
+	uint32_t                                  val = 0;
+	struct cam_isp_sensor_dimension          *path_config;
+	unsigned int                              irq_mask_val = 0;
+	uint32_t                                  camera_hw_version;
+
+	path_data = (struct cam_ife_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+		is_ipp = true;
+		pxl_reg = csid_reg->ipp_reg;
+		path_config = &(csid_hw->ipp_path_config);
+	} else {
+		is_ipp = false;
+		pxl_reg = csid_reg->ppp_reg;
+		path_config = &(csid_hw->ppp_path_config);
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d %s path res type:%d res_id:%d Invalid state%d",
+			csid_hw->hw_intf->hw_idx,
+			(is_ipp) ? "IPP" : "PPP",
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d %s %d not supported on HW",
+			csid_hw->hw_intf->hw_idx, (is_ipp) ? "IPP" : "PPP",
+			res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enable %s path", (is_ipp) ? "IPP" : "PPP");
+
+	if ((csid_hw->csid_debug & CSID_DEBUG_ENABLE_UNMAPPED_VC_DT_IRQ) &&
+		(path_data->sync_mode != CAM_ISP_HW_SYNC_SLAVE)) {
+		irq_mask_val =
+			cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+		if (!(irq_mask_val &
+			CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT)) {
+			CAM_DBG(CAM_ISP,
+				"Subscribing to UNMAPPED_VC_DT event for sync_mode: %d",
+				path_data->sync_mode);
+			irq_mask_val |=
+				CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT;
+			cam_io_w_mb(irq_mask_val,
+			soc_info->reg_map[0].mem_base +
+				csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+		}
+	}
+
+	cam_cpas_get_cpas_hw_version(&camera_hw_version);
+
+	/* Set master or slave path */
+	if (path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+		/*Set halt mode as master */
+		if (pxl_reg->halt_master_sel_en)
+			val = pxl_reg->halt_sel_internal_master_val << 4 |
+				CSID_HALT_MODE_MASTER << 2;
+		else
+			val = CSID_HALT_MODE_MASTER << 2;
+	} else if (path_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) {
+		/*Set halt mode as slave and set master idx */
+		if (pxl_reg->halt_master_sel_en ||
+			camera_hw_version == CAM_CPAS_TITAN_165_V100)
+			val = CSID_HALT_MODE_SLAVE << 2;
+		else
+			val = path_data->master_idx  << 4 |
+				CSID_HALT_MODE_SLAVE << 2;
+	} else {
+		/* Default is internal halt mode */
+		val = 0;
+	}
+
+	/*
+	 * Resume at frame boundary if Master or No Sync.
+	 * Slave will get resume command from Master.
+	 */
+	if (path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		path_data->sync_mode == CAM_ISP_HW_SYNC_NONE)
+		val |= CAM_CSID_RESUME_AT_FRAME_BOUNDARY;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d %s Ctrl val: 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			(is_ipp) ? "IPP" : "PPP", val);
+
+	/* Enable the required pxl path interrupts */
+	val = CSID_PATH_INFO_RST_DONE | CSID_PATH_ERROR_FIFO_OVERFLOW;
+
+	if (pxl_reg->ccif_violation_en)
+		val |= CSID_PATH_ERROR_CCIF_VIOLATION;
+
+	if (pxl_reg->overflow_ctrl_en)
+		val |= CSID_PATH_OVERFLOW_RECOVERY;
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ)
+		val |= CSID_PATH_INFO_INPUT_SOF;
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOF_IRQ)
+		val |= CSID_PATH_INFO_INPUT_EOF;
+
+	val |= (CSID_PATH_ERROR_PIX_COUNT |
+		CSID_PATH_ERROR_LINE_COUNT);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_mask_addr);
+
+	CAM_DBG(CAM_ISP, "Enable %s IRQ mask 0x%x",
+		(is_ipp) ? "IPP" : "PPP", val);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+
+static int cam_ife_csid_change_pxl_halt_mode(
+	struct cam_ife_csid_hw            *csid_hw,
+	struct cam_ife_csid_hw_halt_args  *csid_halt)
+{
+	uint32_t val = 0;
+	const struct cam_ife_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	const struct cam_ife_csid_pxl_reg_offset   *pxl_reg;
+	struct cam_isp_resource_node               *res;
+
+	res = csid_halt->node_res;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id != CAM_IFE_PIX_PATH_RES_IPP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "CSID:%d Res:%d in invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	pxl_reg = csid_reg->ipp_reg;
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_mask_addr);
+
+	/* configure Halt for slave */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+	val &= ~0xC;
+	val |= (csid_halt->halt_mode << 2);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+	CAM_DBG(CAM_ISP, "CSID:%d IPP path Res halt mode:%d configured:%x",
+		csid_hw->hw_intf->hw_idx, csid_halt->halt_mode, val);
+
+	return 0;
+}
+
+static int cam_ife_csid_disable_pxl_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_ife_csid_halt_cmd       stop_cmd)
+{
+	int rc = 0;
+	uint32_t val = 0;
+	const struct cam_ife_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_ife_csid_path_cfg               *path_data;
+	const struct cam_ife_csid_pxl_reg_offset   *pxl_reg;
+	bool                                        is_ipp;
+
+	path_data = (struct cam_ife_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "CSID:%d Res:%d already in stopped state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return rc;
+	}
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+		is_ipp = true;
+		pxl_reg = csid_reg->ipp_reg;
+	} else {
+		is_ipp = false;
+		pxl_reg = csid_reg->ppp_reg;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_DBG(CAM_ISP, "CSID:%d %s path Res:%d Invalid state%d",
+			csid_hw->hw_intf->hw_idx, (is_ipp) ? "IPP" : "PPP",
+			res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d %s %d is not supported on HW",
+			csid_hw->hw_intf->hw_idx, (is_ipp) ? "IPP" : "PPP",
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (stop_cmd != CAM_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP, "CSID:%d %s path un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, (is_ipp) ? "IPP" : "PPP",
+			stop_cmd);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id:%d %s path",
+		csid_hw->hw_intf->hw_idx, res->res_id,
+		(is_ipp) ? "IPP" : "PPP");
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_mask_addr);
+
+	if (path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		path_data->sync_mode == CAM_ISP_HW_SYNC_NONE) {
+		/* configure Halt for master */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+		val &= ~0x3;
+		val |= stop_cmd;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_ctrl_addr);
+	}
+
+	if (path_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE &&
+		stop_cmd == CAM_CSID_HALT_IMMEDIATELY) {
+		/* configure Halt for slave */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_ctrl_addr);
+		val &= ~0xF;
+		val |= stop_cmd;
+		val |= (CSID_HALT_MODE_MASTER << 2);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_ctrl_addr);
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_init_config_rdi_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	struct cam_ife_csid_path_cfg           *path_data;
+	const struct cam_ife_csid_reg_offset   *csid_reg;
+	struct cam_hw_soc_info                 *soc_info;
+	uint32_t path_format = 0, plain_fmt = 0, val = 0, id;
+	uint32_t format_measure_addr, camera_hw_version;
+	uint32_t packing_fmt = 0, in_bpp = 0;
+
+	path_data = (struct cam_ife_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	id = res->res_id;
+	if (!csid_reg->rdi_reg[id]) {
+		CAM_ERR(CAM_ISP, "CSID:%d RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, id);
+		return -EINVAL;
+	}
+
+	rc = cam_ife_csid_get_format_rdi(path_data->in_format,
+		path_data->out_format, &path_format, &plain_fmt, &packing_fmt,
+		path_data->crop_enable || path_data->drop_enable, &in_bpp);
+	if (rc)
+		return rc;
+
+	/*
+	 * RDI path config and enable the time stamp capture
+	 * Enable the measurement blocks
+	 */
+	val = (path_data->vc << csid_reg->cmn_reg->vc_shift_val) |
+		(path_data->dt << csid_reg->cmn_reg->dt_shift_val) |
+		(path_data->cid << csid_reg->cmn_reg->dt_id_shift_val) |
+		(path_format << csid_reg->cmn_reg->fmt_shift_val) |
+		(plain_fmt << csid_reg->cmn_reg->plain_fmt_shit_val) |
+		(path_data->crop_enable  <<
+			csid_reg->cmn_reg->crop_h_en_shift_val) |
+		(path_data->crop_enable  <<
+		csid_reg->cmn_reg->crop_v_en_shift_val) |
+		(1 << 2) | 3;
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc:%d", rc);
+		camera_hw_version = 0;
+	}
+	CAM_DBG(CAM_ISP, "HW version: %x", camera_hw_version);
+
+	if (camera_hw_version == CAM_CPAS_TITAN_480_V100 ||
+		camera_hw_version == CAM_CPAS_TITAN_175_V130 ||
+		camera_hw_version == CAM_CPAS_TITAN_580_V100 ||
+		camera_hw_version == CAM_CPAS_TITAN_570_V200 ||
+		camera_hw_version == CAM_CPAS_TITAN_165_V100) {
+		val |= (path_data->drop_enable <<
+			csid_reg->cmn_reg->drop_h_en_shift_val) |
+			(path_data->drop_enable <<
+			csid_reg->cmn_reg->drop_v_en_shift_val) |
+			(packing_fmt <<
+			csid_reg->cmn_reg->packing_fmt_shift_val);
+	}
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+
+	if (path_data->is_valid_vc1_dt1 &&
+		((camera_hw_version == CAM_CPAS_TITAN_480_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_580_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_570_V200))) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_multi_vcdt_cfg0_addr);
+		val |= ((path_data->vc1 << 2) |
+			(path_data->dt1 << 7) | 1);
+	}
+
+	/* select the post irq sub sample strobe for time stamp capture */
+	cam_io_w_mb(CSID_TIMESTAMP_STB_POST_IRQ, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg1_addr);
+
+	if (path_data->crop_enable) {
+		val = (((path_data->end_pixel & 0xFFFF) <<
+			csid_reg->cmn_reg->crop_shift) |
+			(path_data->start_pixel & 0xFFFF));
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_rpp_hcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Horizontal crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		val = (((path_data->end_line & 0xFFFF) <<
+			csid_reg->cmn_reg->crop_shift) |
+			(path_data->start_line & 0xFFFF));
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_rpp_vcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Vertical Crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+	}
+
+	/* Enable Error Detection */
+	if (csid_reg->rdi_reg[id]->overflow_ctrl_en) {
+		val = csid_reg->rdi_reg[id]->overflow_ctrl_en;
+		/* Overflow ctrl mode: 2 -> Detect overflow */
+		val |= 0x8;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_err_recovery_cfg0_addr);
+	}
+
+	/* configure pixel format measure */
+	if (csid_hw->rdi_path_config[id].measure_enabled) {
+		val = ((csid_hw->rdi_path_config[id].height &
+		csid_reg->cmn_reg->format_measure_height_mask_val) <<
+		csid_reg->cmn_reg->format_measure_height_shift_val);
+
+		if (path_format == 0xF)
+			val |= (__KERNEL_DIV_ROUND_UP(
+				(csid_hw->rdi_path_config[id].width *
+				in_bpp), 8) &
+			csid_reg->cmn_reg->format_measure_width_mask_val);
+		else
+			val |= (csid_hw->rdi_path_config[id].width &
+			csid_reg->cmn_reg->format_measure_width_mask_val);
+
+		CAM_DBG(CAM_ISP, "CSID:%d format measure cfg1 value : 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+		CAM_DBG(CAM_ISP, "format measure width : 0x%x height : 0x%x",
+			csid_hw->rdi_path_config[id].width,
+			csid_hw->rdi_path_config[id].height);
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_format_measure_cfg1_addr);
+
+		/* enable pixel and line counter */
+		cam_io_w_mb(3, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_format_measure_cfg0_addr);
+	}
+
+	/* set frame drop pattern to 0 and period to 1 */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_frm_drop_period_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_frm_drop_pattern_addr);
+	/* set IRQ sum sabmple */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_irq_subsample_period_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_irq_subsample_pattern_addr);
+
+	/* set pixel drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_rpp_pix_drop_pattern_addr);
+
+	/* Write max value to pixel drop period due to a bug in ver 480 HW */
+	if (((camera_hw_version == CAM_CPAS_TITAN_480_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_580_V100) ||
+		(camera_hw_version == CAM_CPAS_TITAN_570_V200)) &&
+		path_data->drop_enable)
+		cam_io_w_mb(0x1F, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_rpp_pix_drop_period_addr);
+	else
+		cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_rpp_pix_drop_period_addr);
+
+	/* set line drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_rpp_line_drop_pattern_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_rpp_line_drop_period_addr);
+
+	/* Configure the halt mode */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+	/* Enable the RPP path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+	val |= (1 << csid_reg->cmn_reg->path_en_shift_val);
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_HBI_VBI_INFO)
+		val |= csid_reg->cmn_reg->format_measure_en_val;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+
+	format_measure_addr =
+		csid_reg->rdi_reg[id]->csid_rdi_format_measure_cfg0_addr;
+
+	/* Enable the HBI/VBI counter */
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			format_measure_addr);
+		val |= csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val,
+			soc_info->reg_map[0].mem_base + format_measure_addr);
+	}
+
+	/* configure the rx packet capture based on csid debug set */
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val = ((1 <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_en_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_vc_shift));
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_capture_ctrl_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	return rc;
+}
+
+static int cam_ife_csid_init_config_udi_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	struct cam_ife_csid_path_cfg           *path_data;
+	const struct cam_ife_csid_reg_offset   *csid_reg;
+	struct cam_hw_soc_info                 *soc_info;
+	uint32_t path_format = 0, plain_fmt = 0, val = 0, val1, id;
+	uint32_t format_measure_addr, packing_fmt = 0, in_bpp = 0;
+
+	path_data = (struct cam_ife_csid_path_cfg *)res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+	if ((id >= CAM_IFE_CSID_UDI_MAX) || (!csid_reg->udi_reg[id])) {
+		CAM_ERR(CAM_ISP, "CSID:%d UDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, id);
+		return -EINVAL;
+	}
+
+	rc = cam_ife_csid_get_format_rdi(path_data->in_format,
+		path_data->out_format, &path_format, &plain_fmt, &packing_fmt,
+		path_data->crop_enable || path_data->drop_enable, &in_bpp);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Failed to get format in_format: %u out_format: %u rc: %d",
+			path_data->in_format, path_data->out_format, rc);
+		return rc;
+	}
+
+	/*
+	 * UDI path config and enable the time stamp capture
+	 * Enable the measurement blocks
+	 */
+	val = (path_data->vc << csid_reg->cmn_reg->vc_shift_val) |
+		(path_data->dt << csid_reg->cmn_reg->dt_shift_val) |
+		(path_data->cid << csid_reg->cmn_reg->dt_id_shift_val) |
+		(path_format << csid_reg->cmn_reg->fmt_shift_val) |
+		(plain_fmt << csid_reg->cmn_reg->plain_fmt_shit_val) |
+		(path_data->crop_enable  <<
+			csid_reg->cmn_reg->crop_h_en_shift_val) |
+		(path_data->crop_enable  <<
+		csid_reg->cmn_reg->crop_v_en_shift_val) |
+		(1 << 2) | 3;
+
+	val |= (packing_fmt << csid_reg->cmn_reg->packing_fmt_shift_val);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[id]->csid_udi_cfg0_addr);
+
+	/* select the post irq sub sample strobe for time stamp capture */
+	val1 = CSID_TIMESTAMP_STB_POST_IRQ;
+
+	/* select the num bytes out per cycle */
+	val1 |= (path_data->num_bytes_out <<
+		csid_reg->cmn_reg->num_bytes_out_shift_val);
+
+	cam_io_w_mb(val1, soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[id]->csid_udi_cfg1_addr);
+
+	/* Enable Error Detection */
+	if (csid_reg->udi_reg[id]->overflow_ctrl_en) {
+		val = csid_reg->udi_reg[id]->overflow_ctrl_en;
+		/* Overflow ctrl mode: 2 -> Detect overflow */
+		val |= 0x8;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[id]->csid_udi_err_recovery_cfg0_addr);
+	}
+
+	/* set frame drop pattern to 0 and period to 1 */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_frm_drop_period_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_frm_drop_pattern_addr);
+	/* set IRQ sum sabmple */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_irq_subsample_period_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_irq_subsample_pattern_addr);
+
+	/* set pixel drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_rpp_pix_drop_pattern_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_rpp_pix_drop_period_addr);
+	/* set line drop pattern to 0 and period to 1 */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_rpp_line_drop_pattern_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_rpp_line_drop_period_addr);
+
+	/* Configure the halt mode */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[id]->csid_udi_ctrl_addr);
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_cfg0_addr);
+	val |= (1 << csid_reg->cmn_reg->path_en_shift_val);
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_HBI_VBI_INFO)
+		val |= csid_reg->cmn_reg->format_measure_en_val;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_cfg0_addr);
+
+	format_measure_addr =
+		csid_reg->udi_reg[id]->csid_udi_format_measure_cfg0_addr;
+
+	/* Enable the HBI/VBI counter */
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			format_measure_addr);
+		val |= csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val,
+			soc_info->reg_map[0].mem_base + format_measure_addr);
+	}
+
+	/* configure the rx packet capture based on csid debug set */
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val = ((1 <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_en_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_vc_shift));
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_capture_ctrl_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	return rc;
+}
+
+static int cam_ife_csid_deinit_udi_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	uint32_t id, val, format_measure_addr;
+	const struct cam_ife_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+
+	if ((res->res_id < CAM_IFE_PIX_PATH_RES_UDI_0) ||
+		(res->res_id > CAM_IFE_PIX_PATH_RES_UDI_2) ||
+		(res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) ||
+		(!csid_reg->udi_reg[id])) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id%d state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	/* Disable Error Recovery */
+	if (csid_reg->udi_reg[id]->overflow_ctrl_en) {
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[id]->csid_udi_err_recovery_cfg0_addr);
+	}
+
+	format_measure_addr =
+		csid_reg->udi_reg[id]->csid_udi_format_measure_cfg0_addr;
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[id]->csid_udi_cfg0_addr);
+		val &= ~csid_reg->cmn_reg->format_measure_en_val;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[id]->csid_udi_cfg0_addr);
+
+		/* Disable the HBI/VBI counter */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			format_measure_addr);
+		val &= ~csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			format_measure_addr);
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_ife_csid_deinit_rdi_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	uint32_t id, val, format_measure_addr;
+	const struct cam_ife_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id;
+
+	if (res->res_id > CAM_IFE_PIX_PATH_RES_RDI_3 ||
+		res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		!csid_reg->rdi_reg[id]) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id%d state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	/* Disable Error Recovery */
+	if (csid_reg->rdi_reg[id]->overflow_ctrl_en) {
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_err_recovery_cfg0_addr);
+	}
+
+	format_measure_addr =
+		csid_reg->rdi_reg[id]->csid_rdi_format_measure_cfg0_addr;
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+		val &= ~csid_reg->cmn_reg->format_measure_en_val;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+
+		/* Disable the HBI/VBI counter */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			format_measure_addr);
+		val &= ~csid_reg->cmn_reg->measure_en_hbi_vbi_cnt_mask;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			format_measure_addr);
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_ife_csid_enable_rdi_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_ife_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	unsigned int                               irq_mask_val = 0;
+	uint32_t id, val;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_id > CAM_IFE_PIX_PATH_RES_RDI_3 ||
+		!csid_reg->rdi_reg[id]) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d invalid res type:%d res_id:%d state%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_UNMAPPED_VC_DT_IRQ) {
+		irq_mask_val =
+			cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+		if (!(irq_mask_val &
+			CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT)) {
+			CAM_DBG(CAM_ISP, "Subscribing to UNMAPPED_VC_DT event");
+			irq_mask_val |=
+				CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT;
+			cam_io_w_mb(irq_mask_val,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+		}
+	}
+
+	/*resume at frame boundary */
+	cam_io_w_mb(CAM_CSID_RESUME_AT_FRAME_BOUNDARY,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+	/* Enable the required RDI interrupts */
+	val = CSID_PATH_INFO_RST_DONE | CSID_PATH_ERROR_FIFO_OVERFLOW;
+
+	if (csid_reg->rdi_reg[id]->ccif_violation_en)
+		val |= CSID_PATH_ERROR_CCIF_VIOLATION;
+
+	if (csid_reg->rdi_reg[id]->overflow_ctrl_en)
+		val |= CSID_PATH_OVERFLOW_RECOVERY;
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ)
+		val |= CSID_PATH_INFO_INPUT_SOF;
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOF_IRQ)
+		val |= CSID_PATH_INFO_INPUT_EOF;
+
+	val |= (CSID_PATH_ERROR_PIX_COUNT |
+		CSID_PATH_ERROR_LINE_COUNT);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_ife_csid_enable_udi_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_ife_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	unsigned int                               irq_mask_val = 0;
+	uint32_t id, val;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+
+	if ((res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) ||
+		(res->res_id > CAM_IFE_PIX_PATH_RES_UDI_2) ||
+		(res->res_id < CAM_IFE_PIX_PATH_RES_UDI_0) ||
+		(!csid_reg->udi_reg[id])) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d invalid res type:%d res_id:%d state%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_UNMAPPED_VC_DT_IRQ) {
+		irq_mask_val =
+			cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+		if (!(irq_mask_val &
+			CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT)) {
+			CAM_DBG(CAM_ISP,
+				"Subscribing to UNMAPPED_VC_DT event");
+			irq_mask_val |=
+				CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT;
+			cam_io_w_mb(irq_mask_val,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+		}
+	}
+
+	/*resume at frame boundary */
+	cam_io_w_mb(CAM_CSID_RESUME_AT_FRAME_BOUNDARY,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_ctrl_addr);
+
+	/* Enable the required UDI interrupts */
+	val = CSID_PATH_INFO_RST_DONE | CSID_PATH_ERROR_FIFO_OVERFLOW;
+
+	if (csid_reg->udi_reg[id]->ccif_violation_en)
+		val |= CSID_PATH_ERROR_CCIF_VIOLATION;
+
+	if (csid_reg->udi_reg[id]->overflow_ctrl_en)
+		val |= CSID_PATH_OVERFLOW_RECOVERY;
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ)
+		val |= CSID_PATH_INFO_INPUT_SOF;
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOF_IRQ)
+		val |= CSID_PATH_INFO_INPUT_EOF;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_irq_mask_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_ife_csid_disable_rdi_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_ife_csid_halt_cmd                stop_cmd)
+{
+	int rc = 0;
+	uint32_t id, val = 0;
+	const struct cam_ife_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id;
+
+	if ((res->res_id > CAM_IFE_PIX_PATH_RES_RDI_3) ||
+		(!csid_reg->rdi_reg[res->res_id])) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID:%d Res:%d already in stopped state:%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id, res->res_state);
+		return rc;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID:%d Res:%d Invalid res_state%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	if (stop_cmd != CAM_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP, "CSID:%d un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+
+	/* Halt the RDI path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+	val &= ~0x3;
+	val |= stop_cmd;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+	return rc;
+}
+
+static int cam_ife_csid_disable_udi_path(
+	struct cam_ife_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_ife_csid_halt_cmd                stop_cmd)
+{
+	int rc = 0;
+	uint32_t id, val = 0;
+	const struct cam_ife_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+
+	if ((res->res_id > CAM_IFE_PIX_PATH_RES_UDI_2) ||
+		(res->res_id < CAM_IFE_PIX_PATH_RES_UDI_0) ||
+		(!csid_reg->udi_reg[id])) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID:%d Res:%d already in stopped state:%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id, res->res_state);
+		return rc;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID:%d Res:%d Invalid res_state%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	if (stop_cmd != CAM_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP, "CSID:%d un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_irq_mask_addr);
+
+	/* Halt the UDI path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_ctrl_addr);
+	val &= ~0x3;
+	val |= stop_cmd;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->udi_reg[id]->csid_udi_ctrl_addr);
+
+	return rc;
+}
+
+static int cam_ife_csid_poll_stop_status(
+	struct cam_ife_csid_hw          *csid_hw,
+	uint32_t                         res_mask)
+{
+	int rc = 0, id;
+	uint32_t csid_status_addr = 0, val = 0, res_id = 0;
+	const struct cam_ife_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	for (; res_id < CAM_IFE_PIX_PATH_RES_MAX; res_id++, res_mask >>= 1) {
+		if ((res_mask & 0x1) == 0)
+			continue;
+		val = 0;
+
+		if (res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+			csid_status_addr =
+			csid_reg->ipp_reg->csid_pxl_status_addr;
+		} else if (res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+			csid_status_addr =
+				csid_reg->ppp_reg->csid_pxl_status_addr;
+		} else if (res_id == CAM_IFE_PIX_PATH_RES_RDI_0 ||
+			res_id == CAM_IFE_PIX_PATH_RES_RDI_1 ||
+			res_id == CAM_IFE_PIX_PATH_RES_RDI_2 ||
+			res_id == CAM_IFE_PIX_PATH_RES_RDI_3) {
+			csid_status_addr =
+				csid_reg->rdi_reg[res_id]->csid_rdi_status_addr;
+		} else if (res_id == CAM_IFE_PIX_PATH_RES_UDI_0 ||
+			res_id == CAM_IFE_PIX_PATH_RES_UDI_1 ||
+			res_id == CAM_IFE_PIX_PATH_RES_UDI_2) {
+			id = res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+			csid_status_addr =
+				csid_reg->udi_reg[id]->csid_udi_status_addr;
+		} else {
+			CAM_ERR(CAM_ISP, "Invalid res_id: %u", res_id);
+			rc = -EINVAL;
+			break;
+		}
+
+		CAM_DBG(CAM_ISP, "start polling CSID:%d res_id:%d",
+			csid_hw->hw_intf->hw_idx, res_id);
+
+		rc = readl_poll_timeout(soc_info->reg_map[0].mem_base +
+			csid_status_addr, val, (val & 0x1) == 0x1,
+				CAM_IFE_CSID_TIMEOUT_SLEEP_US,
+				CAM_IFE_CSID_TIMEOUT_ALL_US);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "CSID:%d res:%d halt failed rc %d",
+				csid_hw->hw_intf->hw_idx, res_id, rc);
+			rc = -ETIMEDOUT;
+			break;
+		}
+		CAM_DBG(CAM_ISP, "End polling CSID:%d res_id:%d",
+			csid_hw->hw_intf->hw_idx, res_id);
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_get_hbi_vbi(
+	struct cam_ife_csid_hw   *csid_hw,
+	struct cam_isp_resource_node *res)
+{
+	uint32_t  hbi, vbi;
+	int32_t id;
+	const struct cam_ife_csid_reg_offset     *csid_reg;
+	const struct cam_ife_csid_rdi_reg_offset *rdi_reg;
+	const struct cam_ife_csid_udi_reg_offset *udi_reg;
+	struct cam_hw_soc_info                   *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+		hbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_format_measure1_addr);
+		vbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_format_measure2_addr);
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+		hbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_format_measure1_addr);
+		vbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_format_measure2_addr);
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_RDI_1 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_RDI_2 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_RDI_3) {
+		rdi_reg = csid_reg->rdi_reg[res->res_id];
+		hbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_format_measure1_addr);
+		vbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_format_measure2_addr);
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_UDI_0 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_UDI_1 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_UDI_2) {
+		id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+		udi_reg = csid_reg->udi_reg[id];
+		hbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			udi_reg->csid_udi_format_measure1_addr);
+		vbi = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			udi_reg->csid_udi_format_measure2_addr);
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res_id: %u", res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_INFO_RATE_LIMIT(CAM_ISP,
+		"Device %s index %u Resource %u HBI: 0x%x VBI: 0x%x",
+		soc_info->dev_name, soc_info->index,
+		res->res_id, hbi, vbi);
+
+	return 0;
+}
+
+static int cam_ife_csid_get_time_stamp(
+		struct cam_ife_csid_hw   *csid_hw, void *cmd_args)
+{
+	struct cam_csid_get_time_stamp_args        *time_stamp;
+	struct cam_isp_resource_node               *res;
+	const struct cam_ife_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	const struct cam_ife_csid_rdi_reg_offset   *rdi_reg;
+	const struct cam_ife_csid_udi_reg_offset   *udi_reg;
+	struct timespec64 ts;
+	uint32_t  time_32, id;
+	uint64_t  time_delta = 0;
+
+	time_stamp = (struct cam_csid_get_time_stamp_args  *)cmd_args;
+	res = time_stamp->node_res;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP) {
+		time_32 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_timestamp_curr1_sof_addr);
+		time_stamp->time_stamp_val = (uint64_t) time_32;
+		time_stamp->time_stamp_val = time_stamp->time_stamp_val << 32;
+		time_32 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_timestamp_curr0_sof_addr);
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+		time_32 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_timestamp_curr1_sof_addr);
+		time_stamp->time_stamp_val = (uint64_t) time_32;
+		time_stamp->time_stamp_val = time_stamp->time_stamp_val << 32;
+		time_32 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_timestamp_curr0_sof_addr);
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_RDI_1 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_RDI_2 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_RDI_3) {
+		id = res->res_id;
+		rdi_reg = csid_reg->rdi_reg[id];
+		time_32 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_timestamp_curr1_sof_addr);
+		time_stamp->time_stamp_val = (uint64_t) time_32;
+		time_stamp->time_stamp_val = time_stamp->time_stamp_val << 32;
+
+		time_32 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_timestamp_curr0_sof_addr);
+	} else if (res->res_id == CAM_IFE_PIX_PATH_RES_UDI_0 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_UDI_1 ||
+		res->res_id == CAM_IFE_PIX_PATH_RES_UDI_2) {
+		id = res->res_id - CAM_IFE_PIX_PATH_RES_UDI_0;
+		udi_reg = csid_reg->udi_reg[id];
+		time_32 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			udi_reg->csid_udi_timestamp_curr1_sof_addr);
+		time_stamp->time_stamp_val = (uint64_t) time_32;
+		time_stamp->time_stamp_val = time_stamp->time_stamp_val << 32;
+
+		time_32 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			udi_reg->csid_udi_timestamp_curr0_sof_addr);
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res_id: %u", res->res_id);
+		return -EINVAL;
+	}
+
+	time_stamp->time_stamp_val |= (uint64_t) time_32;
+	time_stamp->time_stamp_val = mul_u64_u32_div(
+		time_stamp->time_stamp_val,
+		CAM_IFE_CSID_QTIMER_MUL_FACTOR,
+		CAM_IFE_CSID_QTIMER_DIV_FACTOR);
+
+	if (!csid_hw->prev_boot_timestamp) {
+		ktime_get_boottime_ts64(&ts);
+		time_stamp->boot_timestamp =
+			(uint64_t)((ts.tv_sec * 1000000000) +
+			ts.tv_nsec);
+		csid_hw->prev_qtimer_ts = 0;
+		CAM_DBG(CAM_ISP, "timestamp:%lld",
+			time_stamp->boot_timestamp);
+	} else {
+		time_delta = time_stamp->time_stamp_val -
+			csid_hw->prev_qtimer_ts;
+		time_stamp->boot_timestamp =
+			csid_hw->prev_boot_timestamp + time_delta;
+		if (time_delta == 0)
+			CAM_WARN_RATE_LIMIT(CAM_ISP,
+				"CSID:%d No qtimer update ts: %lld prev ts:%lld",
+				csid_hw->hw_intf->hw_idx,
+				time_stamp->time_stamp_val,
+				csid_hw->prev_qtimer_ts);
+	}
+	csid_hw->prev_qtimer_ts = time_stamp->time_stamp_val;
+	csid_hw->prev_boot_timestamp = time_stamp->boot_timestamp;
+
+	return 0;
+}
+
+static int cam_ife_csid_set_csid_debug(struct cam_ife_csid_hw   *csid_hw,
+	void *cmd_args)
+{
+	uint32_t  *csid_debug;
+
+	csid_debug = (uint32_t  *) cmd_args;
+	csid_hw->csid_debug = *csid_debug;
+	CAM_DBG(CAM_ISP, "CSID:%d set csid debug value:%d",
+		csid_hw->hw_intf->hw_idx, csid_hw->csid_debug);
+
+	return 0;
+}
+
+static int cam_ife_csid_get_hw_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw_caps           *hw_caps;
+	struct cam_ife_csid_hw                *csid_hw;
+	struct cam_hw_info                    *csid_hw_info;
+	const struct cam_ife_csid_reg_offset  *csid_reg;
+	struct cam_csid_soc_private           *soc_priv = NULL;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_hw   *)csid_hw_info->core_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	hw_caps = (struct cam_ife_csid_hw_caps *) get_hw_cap_args;
+
+	hw_caps->num_rdis = csid_reg->cmn_reg->num_rdis;
+	hw_caps->num_pix = csid_reg->cmn_reg->num_pix;
+	hw_caps->num_ppp = csid_reg->cmn_reg->num_ppp;
+
+	/* NOTE: HW version is not correct since we dont enable
+	 * the soc resources in the probe for CSID, instead we
+	 * when the camera actually runs
+	 */
+	hw_caps->version_incr =
+		csid_hw->csid_info->hw_reg_version & 0x00ffff;
+	hw_caps->minor_version =
+		(csid_hw->csid_info->hw_reg_version >> 16) & 0x0fff;
+	hw_caps->major_version =
+		(csid_hw->csid_info->hw_reg_version >> 28) & 0x000f;
+
+	soc_priv = (struct cam_csid_soc_private *)
+		(csid_hw_info->soc_info.soc_private);
+
+	hw_caps->is_lite = soc_priv->is_ife_csid_lite;
+
+	CAM_DBG(CAM_ISP,
+		"CSID:%d No rdis:%d, no pix:%d, major:%d minor:%d ver :%d",
+		csid_hw->hw_intf->hw_idx, hw_caps->num_rdis,
+		hw_caps->num_pix, hw_caps->major_version,
+		hw_caps->minor_version, hw_caps->version_incr);
+
+	return rc;
+}
+
+static int cam_ife_csid_reset(void *hw_priv,
+	void *reset_args, uint32_t arg_size)
+{
+	struct cam_ife_csid_hw          *csid_hw;
+	struct cam_hw_info              *csid_hw_info;
+	struct cam_csid_reset_cfg_args  *reset;
+	int rc = 0;
+
+	if (!hw_priv || !reset_args || (arg_size !=
+		sizeof(struct cam_csid_reset_cfg_args))) {
+		CAM_ERR(CAM_ISP, "CSID:Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_hw   *)csid_hw_info->core_info;
+	reset   = (struct cam_csid_reset_cfg_args  *)reset_args;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	switch (reset->reset_type) {
+	case CAM_IFE_CSID_RESET_GLOBAL:
+		rc = cam_ife_csid_global_reset(csid_hw);
+		break;
+	case CAM_IFE_CSID_RESET_PATH:
+		rc = cam_ife_csid_path_reset(csid_hw, reset);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:Invalid reset type :%d",
+			reset->reset_type);
+		rc = -EINVAL;
+		break;
+	}
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+
+	return rc;
+}
+
+static int cam_ife_csid_reserve(void *hw_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw                    *csid_hw;
+	struct cam_hw_info                        *csid_hw_info;
+	struct cam_csid_hw_reserve_resource_args  *reserv;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_csid_hw_reserve_resource_args))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_hw   *)csid_hw_info->core_info;
+	reserv = (struct cam_csid_hw_reserve_resource_args  *)reserve_args;
+
+	CAM_DBG(CAM_ISP, "res_type %d, CSID: %u",
+		reserv->res_type, csid_hw->hw_intf->hw_idx);
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	switch (reserv->res_type) {
+	case CAM_ISP_RESOURCE_CID:
+		rc = cam_ife_csid_cid_reserve(csid_hw, reserv);
+		break;
+	case CAM_ISP_RESOURCE_PIX_PATH:
+		rc = cam_ife_csid_path_reserve(csid_hw, reserv);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type :%d",
+			csid_hw->hw_intf->hw_idx, reserv->res_type);
+		rc = -EINVAL;
+		break;
+	}
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_release(void *hw_priv,
+	void *release_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw          *csid_hw;
+	struct cam_hw_info              *csid_hw_info;
+	struct cam_isp_resource_node    *res;
+	struct cam_ife_csid_cid_data    *cid_data;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_hw   *)csid_hw_info->core_info;
+	res = (struct cam_isp_resource_node *)release_args;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	csid_hw->event_cb = NULL;
+	csid_hw->priv = NULL;
+	if ((res->res_type == CAM_ISP_RESOURCE_CID &&
+		res->res_id >= CAM_IFE_CSID_CID_MAX) ||
+		(res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE) ||
+		(res->res_state >= CAM_ISP_RESOURCE_STATE_STREAMING)) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%d res type:%d Res %d in state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id,
+			res->res_state);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res type :%d Resource id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	switch (res->res_type) {
+	case CAM_ISP_RESOURCE_CID:
+		cid_data = (struct cam_ife_csid_cid_data    *) res->res_priv;
+		if (cid_data->cnt)
+			cid_data->cnt--;
+
+		if (!cid_data->cnt)
+			res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+		if (csid_hw->csi2_reserve_cnt)
+			csid_hw->csi2_reserve_cnt--;
+
+		if (!csid_hw->csi2_reserve_cnt)
+			memset(&csid_hw->csi2_rx_cfg, 0,
+				sizeof(struct cam_ife_csid_csi2_rx_cfg));
+
+		CAM_DBG(CAM_ISP, "CSID:%d res id :%d cnt:%d reserv cnt:%d res_state:%d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_id, cid_data->cnt, csid_hw->csi2_reserve_cnt,
+			res->res_state);
+
+		break;
+	case CAM_ISP_RESOURCE_PIX_PATH:
+		res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP)
+			csid_hw->ipp_path_config.measure_enabled = 0;
+		else if (res->res_id == CAM_IFE_PIX_PATH_RES_PPP)
+			csid_hw->ppp_path_config.measure_enabled = 0;
+		else if (res->res_id >= CAM_IFE_PIX_PATH_RES_RDI_0 &&
+			res->res_id <= CAM_IFE_PIX_PATH_RES_RDI_3)
+			csid_hw->rdi_path_config[res->res_id].measure_enabled
+				= 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		break;
+	}
+
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_reset_regs(
+	struct cam_ife_csid_hw *csid_hw, bool reset_hw)
+{
+	int rc = 0;
+	const struct cam_ife_csid_reg_offset *csid_reg =
+		csid_hw->csid_info->csid_reg;
+	struct cam_hw_soc_info          *soc_info;
+	uint32_t val = 0;
+	unsigned long flags, rem_jiffies = 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	reinit_completion(&csid_hw->csid_top_complete);
+
+	spin_lock_irqsave(&csid_hw->hw_info->hw_lock, flags);
+
+	csid_hw->is_resetting = true;
+
+	/* clear the top interrupt first */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	if (reset_hw) {
+		/* enable top reset complete IRQ */
+		cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_top_irq_mask_addr);
+		cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_irq_cmd_addr);
+	}
+
+	/* perform the top CSID registers reset */
+	val = reset_hw ? csid_reg->cmn_reg->csid_rst_stb :
+		csid_reg->cmn_reg->csid_reg_rst_stb;
+	cam_io_w_mb(val,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_rst_strobes_addr);
+
+	/*
+	 * for SW reset, we enable the IRQ after since the mask
+	 * register has been reset
+	 */
+	if (!reset_hw) {
+		/* enable top reset complete IRQ */
+		cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_top_irq_mask_addr);
+		cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_irq_cmd_addr);
+	}
+
+	spin_unlock_irqrestore(&csid_hw->hw_info->hw_lock, flags);
+	CAM_DBG(CAM_ISP, "CSID reset start");
+
+	rem_jiffies = wait_for_completion_timeout(&csid_hw->csid_top_complete,
+		msecs_to_jiffies(CAM_IFE_CSID_RESET_TIMEOUT_MS));
+	if (rem_jiffies == 0) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_top_irq_status_addr);
+		if (val & 0x1) {
+			/* clear top reset IRQ */
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->cmn_reg->csid_top_irq_clear_addr);
+			cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+				csid_reg->cmn_reg->csid_irq_cmd_addr);
+			CAM_DBG(CAM_ISP, "CSID:%d %s reset completed %d",
+				csid_hw->hw_intf->hw_idx,
+				reset_hw ? "hw" : "sw",
+				rem_jiffies);
+			goto end;
+		}
+		CAM_ERR(CAM_ISP, "CSID:%d csid_reset %s fail rc = %ld",
+			csid_hw->hw_intf->hw_idx, reset_hw ? "hw" : "sw",
+			rem_jiffies);
+		rc = -ETIMEDOUT;
+		goto end;
+	} else
+		CAM_DBG(CAM_ISP, "CSID:%d %s reset completed %d",
+			csid_hw->hw_intf->hw_idx, reset_hw ? "hw" : "sw",
+			rem_jiffies);
+
+end:
+	csid_hw->is_resetting = false;
+	return rc;
+}
+
+static int cam_ife_csid_init_hw(void *hw_priv,
+	void *init_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw                 *csid_hw;
+	struct cam_hw_info                     *csid_hw_info;
+	struct cam_isp_resource_node           *res;
+	const struct cam_ife_csid_reg_offset   *csid_reg;
+
+	if (!hw_priv || !init_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_hw   *)csid_hw_info->core_info;
+	res      = (struct cam_isp_resource_node *)init_args;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if ((res->res_type == CAM_ISP_RESOURCE_CID &&
+		res->res_id >= CAM_IFE_CSID_CID_MAX) ||
+		(res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res tpe:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((res->res_type == CAM_ISP_RESOURCE_PIX_PATH) &&
+		(res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED)) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d res type:%d res_id:%dInvalid state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res type :%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	/* Initialize the csid hardware */
+	rc = cam_ife_csid_enable_hw(csid_hw);
+	if (rc)
+		goto end;
+
+	switch (res->res_type) {
+	case CAM_ISP_RESOURCE_CID:
+		rc = cam_ife_csid_enable_csi2(csid_hw, res);
+		break;
+	case CAM_ISP_RESOURCE_PIX_PATH:
+		if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+			rc = cam_ife_csid_init_config_pxl_path(csid_hw, res);
+		} else if (res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_RDI_1 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_RDI_2 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_RDI_3) {
+			rc = cam_ife_csid_init_config_rdi_path(csid_hw, res);
+		} else if (res->res_id == CAM_IFE_PIX_PATH_RES_UDI_0 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_UDI_1 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_UDI_2) {
+			rc = cam_ife_csid_init_config_udi_path(csid_hw, res);
+		} else {
+			CAM_ERR(CAM_ISP, "Invalid res_id: %u", res->res_id);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		break;
+	}
+
+	rc = cam_ife_csid_reset_regs(csid_hw, true);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "CSID: Failed in HW reset");
+
+	if (rc)
+		cam_ife_csid_disable_hw(csid_hw);
+
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_deinit_hw(void *hw_priv,
+	void *deinit_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw                 *csid_hw;
+	struct cam_hw_info                     *csid_hw_info;
+	struct cam_isp_resource_node           *res;
+
+	if (!hw_priv || !deinit_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID:Invalid arguments");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter");
+	res = (struct cam_isp_resource_node *)deinit_args;
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_hw   *)csid_hw_info->core_info;
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "CSID:%d Res:%d already in De-init state",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_id);
+		goto end;
+	}
+
+	switch (res->res_type) {
+	case CAM_ISP_RESOURCE_CID:
+		CAM_DBG(CAM_ISP, "De-Init ife_csid");
+		rc = cam_ife_csid_disable_csi2(csid_hw, res);
+		break;
+	case CAM_ISP_RESOURCE_PIX_PATH:
+		CAM_DBG(CAM_ISP, "De-Init Pix Path: %d\n", res->res_id);
+		if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+			rc = cam_ife_csid_deinit_pxl_path(csid_hw, res);
+		} else if (res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_RDI_1 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_RDI_2 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_RDI_3) {
+			rc = cam_ife_csid_deinit_rdi_path(csid_hw, res);
+		} else if (res->res_id == CAM_IFE_PIX_PATH_RES_UDI_0 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_UDI_1 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_UDI_2) {
+			rc = cam_ife_csid_deinit_udi_path(csid_hw, res);
+		} else {
+			CAM_ERR(CAM_ISP, "Invalid res_id: %u", res->res_id);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid Res type %d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		goto end;
+	}
+
+	/* Disable CSID HW */
+	CAM_DBG(CAM_ISP, "Disabling CSID Hw\n");
+	cam_ife_csid_disable_hw(csid_hw);
+	CAM_DBG(CAM_ISP, "%s: Exit\n", __func__);
+
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_ife_csid_start(void *hw_priv, void *start_args,
+			uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw                 *csid_hw;
+	struct cam_hw_info                     *csid_hw_info;
+	struct cam_isp_resource_node           *res;
+	const struct cam_ife_csid_reg_offset   *csid_reg;
+	unsigned long                           flags;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_hw   *)csid_hw_info->core_info;
+	res = (struct cam_isp_resource_node *)start_args;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if ((res->res_type == CAM_ISP_RESOURCE_CID &&
+		res->res_id >= CAM_IFE_CSID_CID_MAX) ||
+		(res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_IFE_PIX_PATH_RES_MAX)) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res tpe:%d res id:%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Reset sof irq debug fields */
+	csid_hw->sof_irq_triggered = false;
+	csid_hw->irq_debug_cnt = 0;
+
+	spin_lock_irqsave(&csid_hw->lock_state, flags);
+	if (!csid_hw->device_enabled)
+		cam_ife_csid_csi2_irq_ctrl(csid_hw, true);
+	csid_hw->device_enabled = 1;
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_type :%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	switch (res->res_type) {
+	case CAM_ISP_RESOURCE_CID:
+		if (csid_hw->res_type ==  CAM_ISP_IFE_IN_RES_TPG)
+			rc = cam_ife_csid_tpg_start(csid_hw, res);
+		break;
+	case CAM_ISP_RESOURCE_PIX_PATH:
+		if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+			rc = cam_ife_csid_enable_pxl_path(csid_hw, res);
+		} else if (res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_RDI_1 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_RDI_2 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_RDI_3) {
+			rc = cam_ife_csid_enable_rdi_path(csid_hw, res);
+		} else if (res->res_id == CAM_IFE_PIX_PATH_RES_UDI_0 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_UDI_1 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_UDI_2) {
+			rc = cam_ife_csid_enable_udi_path(csid_hw, res);
+		} else {
+			CAM_ERR(CAM_ISP, "Invalid res_id: %u", res->res_id);
+			rc = -EINVAL;
+			goto irq_restore;
+		}
+
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type%d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		break;
+	}
+irq_restore:
+	spin_unlock_irqrestore(&csid_hw->lock_state, flags);
+end:
+	return rc;
+}
+
+static int cam_ife_csid_halt(struct cam_ife_csid_hw *csid_hw,
+		void *halt_args)
+{
+	struct cam_isp_resource_node         *res;
+	struct cam_ife_csid_hw_halt_args     *csid_halt;
+	int rc = 0;
+
+	if (!csid_hw || !halt_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_halt = (struct cam_ife_csid_hw_halt_args *)halt_args;
+
+	/* Change the halt mode */
+	res = csid_halt->node_res;
+	CAM_DBG(CAM_ISP, "CSID:%d res_type %d res_id %d",
+		csid_hw->hw_intf->hw_idx,
+		res->res_type, res->res_id);
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	switch (res->res_id) {
+	case CAM_IFE_PIX_PATH_RES_IPP:
+		rc = cam_ife_csid_change_pxl_halt_mode(csid_hw, csid_halt);
+		break;
+	default:
+		CAM_DBG(CAM_ISP, "CSID:%d res_id %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_stop(void *hw_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw               *csid_hw;
+	struct cam_hw_info                   *csid_hw_info;
+	struct cam_isp_resource_node         *res;
+	struct cam_csid_hw_stop_args         *csid_stop;
+	uint32_t  i;
+	uint32_t res_mask = 0;
+	unsigned long flags;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_csid_hw_stop_args))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+	csid_stop = (struct cam_csid_hw_stop_args  *) stop_args;
+
+	if (!csid_stop->num_res) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_hw   *)csid_hw_info->core_info;
+	CAM_DBG(CAM_ISP, "CSID:%d num_res %d",
+		csid_hw->hw_intf->hw_idx,
+		csid_stop->num_res);
+
+	spin_lock_irqsave(&csid_hw->lock_state, flags);
+	csid_hw->device_enabled = 0;
+	cam_ife_csid_csi2_irq_ctrl(csid_hw, false);
+	spin_unlock_irqrestore(&csid_hw->lock_state, flags);
+
+	/* Stop the resource first */
+	for (i = 0; i < csid_stop->num_res; i++) {
+		res = csid_stop->node_res[i];
+		CAM_DBG(CAM_ISP, "CSID:%d res_type %d res_id %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id);
+		switch (res->res_type) {
+		case CAM_ISP_RESOURCE_CID:
+			if (csid_hw->res_type == CAM_ISP_IFE_IN_RES_TPG)
+				rc = cam_ife_csid_tpg_stop(csid_hw, res);
+			break;
+		case CAM_ISP_RESOURCE_PIX_PATH:
+			res_mask |= (1 << res->res_id);
+			if (res->res_id == CAM_IFE_PIX_PATH_RES_IPP ||
+				res->res_id == CAM_IFE_PIX_PATH_RES_PPP) {
+				rc = cam_ife_csid_disable_pxl_path(csid_hw,
+					res, csid_stop->stop_cmd);
+			} else if (res->res_id == CAM_IFE_PIX_PATH_RES_RDI_0 ||
+				res->res_id == CAM_IFE_PIX_PATH_RES_RDI_1 ||
+				res->res_id == CAM_IFE_PIX_PATH_RES_RDI_2 ||
+				res->res_id == CAM_IFE_PIX_PATH_RES_RDI_3) {
+				rc = cam_ife_csid_disable_rdi_path(csid_hw,
+					res, csid_stop->stop_cmd);
+			} else if (res->res_id == CAM_IFE_PIX_PATH_RES_UDI_0 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_UDI_1 ||
+			res->res_id == CAM_IFE_PIX_PATH_RES_UDI_2) {
+				rc = cam_ife_csid_disable_udi_path(csid_hw,
+					res, csid_stop->stop_cmd);
+			} else {
+				CAM_ERR(CAM_ISP, "Invalid res_id: %u",
+					res->res_id);
+				return -EINVAL;
+			}
+
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid res type%d",
+				csid_hw->hw_intf->hw_idx,
+				res->res_type);
+			break;
+		}
+	}
+
+	if (res_mask)
+		rc = cam_ife_csid_poll_stop_status(csid_hw, res_mask);
+
+	for (i = 0; i < csid_stop->num_res; i++) {
+		res = csid_stop->node_res[i];
+		res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+	}
+
+	csid_hw->error_irq_count = 0;
+
+	CAM_DBG(CAM_ISP,  "%s: Exit\n", __func__);
+
+	return rc;
+
+}
+
+static int cam_ife_csid_read(void *hw_priv,
+	void *read_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+
+	return -EINVAL;
+}
+
+static int cam_ife_csid_write(void *hw_priv,
+	void *write_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+	return -EINVAL;
+}
+
+static int cam_ife_csid_sof_irq_debug(
+	struct cam_ife_csid_hw *csid_hw, void *cmd_args)
+{
+	int i = 0;
+	uint32_t val = 0;
+	bool sof_irq_enable = false;
+	const struct cam_ife_csid_reg_offset    *csid_reg;
+	struct cam_hw_soc_info                  *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (*((uint32_t *)cmd_args) == 1)
+		sof_irq_enable = true;
+
+	if (csid_hw->hw_info->hw_state ==
+		CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%d powered down unable to %s sof irq",
+			 csid_hw->hw_intf->hw_idx,
+			(sof_irq_enable == true) ? "enable" : "disable");
+		return 0;
+	}
+
+	if (csid_reg->ipp_reg) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+
+		if (val) {
+			if (sof_irq_enable)
+				val |= CSID_PATH_INFO_INPUT_SOF;
+			else
+				val &= ~CSID_PATH_INFO_INPUT_SOF;
+
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+			val = 0;
+		}
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_mask_addr);
+		if (val) {
+			if (sof_irq_enable)
+				val |= CSID_PATH_INFO_INPUT_SOF;
+			else
+				val &= ~CSID_PATH_INFO_INPUT_SOF;
+
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_irq_mask_addr);
+			val = 0;
+		}
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_udis; i++) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->udi_reg[i]->csid_udi_irq_mask_addr);
+		if (val) {
+			if (sof_irq_enable)
+				val |= CSID_PATH_INFO_INPUT_SOF;
+			else
+				val &= ~CSID_PATH_INFO_INPUT_SOF;
+
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->udi_reg[i]->csid_udi_irq_mask_addr);
+			val = 0;
+		}
+	}
+
+	if (sof_irq_enable) {
+		csid_hw->csid_debug |= CSID_DEBUG_ENABLE_SOF_IRQ;
+		csid_hw->sof_irq_triggered = true;
+	} else {
+		csid_hw->csid_debug &= ~CSID_DEBUG_ENABLE_SOF_IRQ;
+		csid_hw->sof_irq_triggered = false;
+	}
+
+	if (!in_irq())
+		CAM_INFO(CAM_ISP, "SOF freeze: CSID SOF irq %s, CSID HW:%d",
+			(sof_irq_enable) ? "enabled" : "disabled",
+			csid_hw->hw_intf->hw_idx);
+
+	CAM_INFO(CAM_ISP, "Notify CSIPHY: %d",
+		csid_hw->csi2_rx_cfg.phy_sel);
+
+	cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+		CAM_SUBDEV_MESSAGE_IRQ_ERR,
+		csid_hw->csi2_rx_cfg.phy_sel);
+
+	return 0;
+}
+
+static int cam_ife_csid_set_csid_clock(
+	struct cam_ife_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_ife_csid_clock_update_args *clk_update = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	clk_update =
+		(struct cam_ife_csid_clock_update_args *)cmd_args;
+
+	csid_hw->clk_rate = clk_update->clk_rate;
+	CAM_INFO(CAM_ISP, "CSID clock rate %llu", csid_hw->clk_rate);
+
+	return 0;
+}
+
+static int cam_ife_csid_dump_csid_clock(
+	struct cam_ife_csid_hw *csid_hw, void *cmd_args)
+{
+	if (!csid_hw)
+		return -EINVAL;
+
+	CAM_INFO(CAM_ISP, "CSID:%d clock rate %llu",
+		csid_hw->hw_intf->hw_idx,
+		csid_hw->clk_rate);
+
+	return 0;
+}
+
+static int cam_ife_csid_set_sensor_dimension(
+	struct cam_ife_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_ife_sensor_dimension_update_args *dimension_update = NULL;
+	uint32_t i;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	dimension_update =
+		(struct cam_ife_sensor_dimension_update_args *)cmd_args;
+	csid_hw->ipp_path_config.measure_enabled =
+		dimension_update->ipp_path.measure_enabled;
+	if (dimension_update->ipp_path.measure_enabled) {
+		csid_hw->ipp_path_config.width  =
+			dimension_update->ipp_path.width;
+		csid_hw->ipp_path_config.height =
+			dimension_update->ipp_path.height;
+		CAM_DBG(CAM_ISP, "CSID ipp path width %d height %d",
+			csid_hw->ipp_path_config.width,
+			csid_hw->ipp_path_config.height);
+	}
+	csid_hw->ppp_path_config.measure_enabled =
+		dimension_update->ppp_path.measure_enabled;
+	if (dimension_update->ppp_path.measure_enabled) {
+		csid_hw->ppp_path_config.width  =
+			dimension_update->ppp_path.width;
+		csid_hw->ppp_path_config.height =
+			dimension_update->ppp_path.height;
+		CAM_DBG(CAM_ISP, "CSID ppp path width %d height %d",
+			csid_hw->ppp_path_config.width,
+			csid_hw->ppp_path_config.height);
+	}
+	for (i = 0; i <= CAM_IFE_PIX_PATH_RES_RDI_3; i++) {
+		csid_hw->rdi_path_config[i].measure_enabled
+			= dimension_update->rdi_path[i].measure_enabled;
+		if (csid_hw->rdi_path_config[i].measure_enabled) {
+			csid_hw->rdi_path_config[i].width =
+				dimension_update->rdi_path[i].width;
+			csid_hw->rdi_path_config[i].height =
+				dimension_update->rdi_path[i].height;
+			if (csid_hw->rdi_path_config[i].height == 1)
+				csid_hw->rdi_path_config[i].measure_enabled = 0;
+			CAM_DBG(CAM_ISP,
+				"CSID rdi path[%d] width %d height %d",
+				i, csid_hw->rdi_path_config[i].width,
+				csid_hw->rdi_path_config[i].height);
+		}
+	}
+	return 0;
+}
+
+static int cam_ife_csid_set_csid_qcfa(
+	struct cam_ife_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_ife_csid_qcfa_update_args *qcfa_update = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	qcfa_update =
+		(struct cam_ife_csid_qcfa_update_args *)cmd_args;
+
+	csid_hw->binning_supported = qcfa_update->qcfa_binning;
+	CAM_DBG(CAM_ISP, "CSID QCFA binning %d", csid_hw->binning_supported);
+
+	return 0;
+}
+
+static int cam_ife_csid_set_epd_config(
+	struct cam_ife_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_ife_csid_epd_update_args *epd_update = NULL;
+
+	if ((!csid_hw) || (!cmd_args))
+		return -EINVAL;
+
+	epd_update =
+		(struct cam_ife_csid_epd_update_args *)cmd_args;
+
+	csid_hw->epd_supported = epd_update->epd_supported;
+	CAM_DBG(CAM_ISP, "CSID EPD supported %d", csid_hw->epd_supported);
+	return 0;
+}
+
+static int cam_ife_csid_dump_hw(
+	struct cam_ife_csid_hw *csid_hw, void *cmd_args)
+{
+	int                             i;
+	uint8_t                        *dst;
+	uint32_t                       *addr, *start;
+	uint32_t                        min_len;
+	uint32_t                        num_reg;
+	size_t                          remain_len;
+	struct cam_isp_hw_dump_header  *hdr;
+	struct cam_isp_hw_dump_args    *dump_args =
+		(struct cam_isp_hw_dump_args *)cmd_args;
+	struct cam_hw_soc_info         *soc_info;
+
+	if (!dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+	if (!dump_args->cpu_addr || !dump_args->buf_len) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params %pK %zu",
+			(void *)dump_args->cpu_addr,
+			dump_args->buf_len);
+		return -EINVAL;
+	}
+	soc_info = &csid_hw->hw_info->soc_info;
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ISP,
+			"Dump offset overshoot offset %zu buf_len %zu",
+			dump_args->offset, dump_args->buf_len);
+		return -ENOSPC;
+	}
+	min_len = soc_info->reg_map[0].size +
+		sizeof(struct cam_isp_hw_dump_header) +
+		sizeof(uint32_t);
+	remain_len = dump_args->buf_len - dump_args->offset;
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu, min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "CSID_REG:");
+	addr = (uint32_t *)(dst + sizeof(struct cam_isp_hw_dump_header));
+
+	start = addr;
+	num_reg = soc_info->reg_map[0].size/4;
+	hdr->word_size = sizeof(uint32_t);
+	*addr = soc_info->index;
+	addr++;
+	for (i = 0; i < num_reg; i++) {
+		addr[0] = soc_info->mem_block[0]->start + (i*4);
+		addr[1] = cam_io_r(soc_info->reg_map[0].mem_base
+			+ (i*4));
+		addr += 2;
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+	CAM_DBG(CAM_ISP, "offset %zu", dump_args->offset);
+	return 0;
+}
+
+static int cam_ife_csid_log_acquire_data(
+	struct cam_ife_csid_hw   *csid_hw,  void *cmd_args)
+{
+	struct cam_isp_resource_node  *res =
+		(struct cam_isp_resource_node *)cmd_args;
+	struct cam_ife_csid_path_cfg       *path_data;
+	struct cam_hw_soc_info                         *soc_info;
+	const struct cam_ife_csid_reg_offset           *csid_reg;
+	const struct cam_ife_csid_rdi_reg_offset       *rdi_reg;
+	uint32_t byte_cnt_ping, byte_cnt_pong;
+
+	path_data = (struct cam_ife_csid_path_cfg *)res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d invalid res id:%d res type: %d state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_type,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	/* Dump all the acquire data for this hardware */
+	CAM_INFO(CAM_ISP,
+		"CSID:%d res id:%d type:%d state:%d in f:%d out f:%d st pix:%d end pix:%d st line:%d end line:%d h bin:%d qcfa bin:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_type,
+		res->res_type, path_data->in_format, path_data->out_format,
+		path_data->start_pixel, path_data->end_pixel,
+		path_data->start_line, path_data->end_line,
+		path_data->horizontal_bin, path_data->qcfa_bin);
+
+	if (res->res_id >= CAM_IFE_PIX_PATH_RES_RDI_0  &&
+		res->res_id <= CAM_IFE_PIX_PATH_RES_RDI_3) {
+		rdi_reg = csid_reg->rdi_reg[res->res_id];
+		/* read total number of bytes transmitted through RDI */
+		byte_cnt_ping = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_byte_cntr_ping_addr);
+		byte_cnt_pong = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_byte_cntr_pong_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID:%d res id:%d byte cnt val ping:%d pong:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			byte_cnt_ping, byte_cnt_pong);
+	}
+
+	return 0;
+}
+
+static int cam_ife_csid_process_cmd(void *hw_priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_ife_csid_hw               *csid_hw;
+	struct cam_hw_info                   *csid_hw_info;
+	struct cam_isp_resource_node         *res = NULL;
+
+	if (!hw_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid arguments");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_ife_csid_hw   *)csid_hw_info->core_info;
+
+	switch (cmd_type) {
+	case CAM_IFE_CSID_CMD_GET_TIME_STAMP:
+		rc = cam_ife_csid_get_time_stamp(csid_hw, cmd_args);
+		if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_HBI_VBI_INFO) {
+			res = ((struct cam_csid_get_time_stamp_args *)
+				cmd_args)->node_res;
+			cam_ife_csid_get_hbi_vbi(csid_hw, res);
+		}
+		break;
+	case CAM_IFE_CSID_SET_CSID_DEBUG:
+		rc = cam_ife_csid_set_csid_debug(csid_hw, cmd_args);
+		break;
+	case CAM_IFE_CSID_SOF_IRQ_DEBUG:
+		rc = cam_ife_csid_sof_irq_debug(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE:
+		rc = cam_ife_csid_set_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CLOCK_DUMP:
+		rc = cam_ife_csid_dump_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_QCFA_SUPPORTED:
+		rc = cam_ife_csid_set_csid_qcfa(csid_hw, cmd_args);
+		break;
+	case CAM_IFE_CSID_SET_CONFIG:
+		rc = cam_ife_csid_set_epd_config(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_HW:
+		rc = cam_ife_csid_dump_hw(csid_hw, cmd_args);
+		break;
+	case CAM_IFE_CSID_SET_SENSOR_DIMENSION_CFG:
+		rc = cam_ife_csid_set_sensor_dimension(csid_hw, cmd_args);
+		break;
+	case CAM_IFE_CSID_LOG_ACQUIRE_DATA:
+		rc = cam_ife_csid_log_acquire_data(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE:
+		rc = cam_ife_csid_halt(csid_hw, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d unsupported cmd:%d",
+			csid_hw->hw_intf->hw_idx, cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+
+}
+
+static int cam_csid_get_evt_payload(
+	struct cam_ife_csid_hw *csid_hw,
+	struct cam_csid_evt_payload **evt_payload)
+{
+
+	spin_lock(&csid_hw->lock_state);
+
+	if (list_empty(&csid_hw->free_payload_list)) {
+		*evt_payload = NULL;
+		spin_unlock(&csid_hw->lock_state);
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -ENOMEM;
+	}
+
+	*evt_payload = list_first_entry(&csid_hw->free_payload_list,
+			struct cam_csid_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	spin_unlock(&csid_hw->lock_state);
+
+	return 0;
+}
+
+static int cam_csid_put_evt_payload(
+	struct cam_ife_csid_hw *csid_hw,
+	struct cam_csid_evt_payload **evt_payload)
+{
+	unsigned long flags;
+
+	if (*evt_payload == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+	spin_lock_irqsave(&csid_hw->lock_state, flags);
+	list_add_tail(&(*evt_payload)->list,
+		&csid_hw->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&csid_hw->lock_state, flags);
+
+	return 0;
+}
+
+static int cam_csid_evt_bottom_half_handler(
+	void *handler_priv,
+	void *evt_payload_priv)
+{
+	struct cam_ife_csid_hw *csid_hw;
+	struct cam_csid_evt_payload *evt_payload;
+	int i;
+	struct cam_isp_hw_event_info event_info;
+	const struct cam_ife_csid_reg_offset    *csid_reg;
+	int udi_start_idx = CAM_IFE_CSID_IRQ_REG_UDI_0;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid Param handler_priv %pK evt_payload_priv %pK",
+			handler_priv, evt_payload_priv);
+		return 0;
+	}
+
+	csid_hw = (struct cam_ife_csid_hw *)handler_priv;
+	evt_payload = (struct cam_csid_evt_payload *)evt_payload_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if (!csid_hw->event_cb || !csid_hw->priv) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"hw_idx %d Invalid args %pK %pK",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->event_cb,
+			csid_hw->priv);
+		goto end;
+	}
+
+	if (csid_hw->priv != evt_payload->priv) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"hw_idx %d priv mismatch %pK, %pK",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->priv,
+			evt_payload->priv);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID[%d] error type 0x%x", csid_hw->hw_intf->hw_idx,
+		evt_payload->evt_type);
+
+	if (csid_hw->sof_irq_triggered && (evt_payload->evt_type &
+		CAM_ISP_HW_ERROR_NONE)) {
+		if (evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_IPP] &
+			CSID_PATH_INFO_INPUT_SOF) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP SOF received",
+				csid_hw->hw_intf->hw_idx);
+		}
+
+		if (evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_PPP] &
+			CSID_PATH_INFO_INPUT_SOF) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PPP SOF received",
+				csid_hw->hw_intf->hw_idx);
+		}
+
+		for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+			if (evt_payload->irq_status[i] &
+				CSID_PATH_INFO_INPUT_SOF)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"CSID:%d RDI:%d SOF received",
+					csid_hw->hw_intf->hw_idx, i);
+		}
+
+		for (i = 0; i < csid_reg->cmn_reg->num_udis; i++) {
+			if (evt_payload->irq_status[udi_start_idx + i] &
+				CSID_PATH_INFO_INPUT_SOF)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"CSID:%d UDI:%d SOF received",
+					csid_hw->hw_intf->hw_idx, i);
+		}
+	}
+
+	if ((evt_payload->evt_type & CAM_ISP_HW_ERROR_CSID_FATAL) ||
+		(evt_payload->evt_type & CAM_ISP_HW_ERROR_CSID_OVERFLOW)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID %d err 0x%x phy %d irq status TOP: 0x%x RX: 0x%x IPP: 0x%x PPP: 0x%x RDI0: 0x%x RDI1: 0x%x RDI2: 0x%x RDI3: 0x%x UDI0:  0x%x  UDI1:  0x%x  UDI2:  0x%x",
+			csid_hw->hw_intf->hw_idx,
+			evt_payload->evt_type,
+			csid_hw->csi2_rx_cfg.phy_sel,
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_TOP],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RX],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_IPP],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_PPP],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RDI_0],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RDI_1],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RDI_2],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_RDI_3],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_UDI_1],
+			evt_payload->irq_status[CAM_IFE_CSID_IRQ_REG_UDI_2]);
+	}
+
+	/* this hunk can be extended to handle more cases
+	 * which we want to offload to bottom half from
+	 * irq handlers
+	 */
+	event_info.hw_idx = evt_payload->hw_idx;
+
+	if (evt_payload->evt_type & CAM_ISP_HW_ERROR_CSID_FATAL) {
+		cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+				CAM_SUBDEV_MESSAGE_IRQ_ERR,
+				csid_hw->csi2_rx_cfg.phy_sel);
+		if (csid_hw->fatal_err_detected)
+			goto end;
+		csid_hw->fatal_err_detected = true;
+		event_info.err_type = CAM_ISP_HW_ERROR_CSID_FATAL;
+		csid_hw->event_cb(NULL,
+			CAM_ISP_HW_EVENT_ERROR, (void *)&event_info);
+	}
+
+	if (evt_payload->evt_type & CAM_ISP_HW_ERROR_CSID_OVERFLOW) {
+		event_info.err_type = CAM_ISP_HW_ERROR_CSID_OVERFLOW;
+		csid_hw->event_cb(NULL,
+			CAM_ISP_HW_EVENT_ERROR, (void *)&event_info);
+	}
+end:
+	cam_csid_put_evt_payload(csid_hw, &evt_payload);
+	return 0;
+}
+
+static int cam_csid_handle_hw_err_irq(
+	struct cam_ife_csid_hw *csid_hw,
+	uint32_t                evt_type,
+	uint32_t               *irq_status)
+{
+	int      rc = 0;
+	int      i;
+	void    *bh_cmd = NULL;
+	struct cam_csid_evt_payload *evt_payload;
+
+	CAM_DBG(CAM_ISP, "CSID[%d] error 0x%x",
+		csid_hw->hw_intf->hw_idx, evt_type);
+
+	rc = cam_csid_get_evt_payload(csid_hw, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No free payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return rc;
+	}
+
+	rc = tasklet_bh_api.get_bh_payload_func(csid_hw->tasklet, &bh_cmd);
+	if (rc || !bh_cmd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID[%d] Can not get cmd for tasklet, evt_type 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			evt_type);
+		cam_csid_put_evt_payload(csid_hw, &evt_payload);
+		return rc;
+	}
+
+	evt_payload->evt_type = evt_type;
+	evt_payload->priv = csid_hw->priv;
+	evt_payload->hw_idx = csid_hw->hw_intf->hw_idx;
+
+	for (i = 0; i < CAM_IFE_CSID_IRQ_REG_MAX; i++)
+		evt_payload->irq_status[i] = irq_status[i];
+
+	tasklet_bh_api.bottom_half_enqueue_func(csid_hw->tasklet,
+		bh_cmd,
+		csid_hw,
+		evt_payload,
+		cam_csid_evt_bottom_half_handler);
+
+	return rc;
+}
+
+static irqreturn_t cam_ife_csid_irq(int irq_num, void *data)
+{
+	struct cam_ife_csid_hw                         *csid_hw;
+	struct cam_hw_soc_info                         *soc_info;
+	const struct cam_ife_csid_reg_offset           *csid_reg;
+	const struct cam_ife_csid_csi2_rx_reg_offset   *csi2_reg;
+	uint32_t                                        irq_status[CAM_IFE_CSID_IRQ_REG_MAX] = {0};
+	uint32_t                                        i, val, val2;
+	bool                                            fatal_err_detected = false;
+	bool                                            non_fatal_detected = false;
+	uint32_t                                        sof_irq_debug_en = 0;
+	uint32_t                                        event_type = 0;
+	unsigned long                                   flags;
+
+	csid_hw = (struct cam_ife_csid_hw *)data;
+
+	CAM_DBG(CAM_ISP, "CSID %d IRQ Handling", csid_hw->hw_intf->hw_idx);
+
+	if (!data) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid arguments");
+		return IRQ_HANDLED;
+	}
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csi2_reg = csid_reg->csi2_reg;
+
+	/* read */
+	irq_status[CAM_IFE_CSID_IRQ_REG_TOP] =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_status_addr);
+
+	irq_status[CAM_IFE_CSID_IRQ_REG_RX] =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_status_addr);
+
+	if (csid_reg->cmn_reg->num_pix)
+		irq_status[CAM_IFE_CSID_IRQ_REG_IPP] =
+			cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_status_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		irq_status[CAM_IFE_CSID_IRQ_REG_PPP] =
+			cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_status_addr);
+
+	if (csid_reg->cmn_reg->num_rdis <= CAM_IFE_CSID_RDI_MAX) {
+		for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+			irq_status[i] =
+				cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_irq_status_addr);
+		}
+	}
+
+	if (csid_reg->cmn_reg->num_udis <= CAM_IFE_CSID_UDI_MAX) {
+		for (i = 0; i < csid_reg->cmn_reg->num_udis; i++) {
+			irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0 + i] =
+				cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csid_reg->udi_reg[i]->csid_udi_irq_status_addr);
+		}
+	}
+
+	spin_lock_irqsave(&csid_hw->hw_info->hw_lock, flags);
+	/* clear */
+	cam_io_w_mb(irq_status[CAM_IFE_CSID_IRQ_REG_TOP],
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+
+	cam_io_w_mb(irq_status[CAM_IFE_CSID_IRQ_REG_RX],
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_clear_addr);
+	if (csid_reg->cmn_reg->num_pix)
+		cam_io_w_mb(irq_status[CAM_IFE_CSID_IRQ_REG_IPP],
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_ppp)
+		cam_io_w_mb(irq_status[CAM_IFE_CSID_IRQ_REG_PPP],
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_irq_clear_addr);
+
+	if (csid_reg->cmn_reg->num_rdis <= CAM_IFE_CSID_RDI_MAX) {
+		for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+			cam_io_w_mb(irq_status[i],
+				soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_irq_clear_addr);
+		}
+	}
+
+	if (csid_reg->cmn_reg->num_udis <= CAM_IFE_CSID_UDI_MAX) {
+		for (i = 0; i < csid_reg->cmn_reg->num_udis; i++) {
+			cam_io_w_mb(irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0 + i],
+				soc_info->reg_map[0].mem_base +
+				csid_reg->udi_reg[i]->csid_udi_irq_clear_addr);
+		}
+	}
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	spin_unlock_irqrestore(&csid_hw->hw_info->hw_lock, flags);
+
+	CAM_DBG(CAM_ISP, "irq_status_top = 0x%x",
+		irq_status[CAM_IFE_CSID_IRQ_REG_TOP]);
+	CAM_DBG(CAM_ISP, "irq_status_rx = 0x%x",
+		irq_status[CAM_IFE_CSID_IRQ_REG_RX]);
+	CAM_DBG(CAM_ISP, "irq_status_ipp = 0x%x",
+		irq_status[CAM_IFE_CSID_IRQ_REG_IPP]);
+	CAM_DBG(CAM_ISP, "irq_status_ppp = 0x%x",
+		irq_status[CAM_IFE_CSID_IRQ_REG_PPP]);
+	CAM_DBG(CAM_ISP,
+		"irq_status_rdi0= 0x%x irq_status_rdi1= 0x%x irq_status_rdi2= 0x%x",
+		irq_status[0], irq_status[1], irq_status[2]);
+	CAM_DBG(CAM_ISP,
+		"irq_status_udi0= 0x%x irq_status_udi1= 0x%x irq_status_udi2= 0x%x",
+		irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0],
+		irq_status[CAM_IFE_CSID_IRQ_REG_UDI_1],
+		irq_status[CAM_IFE_CSID_IRQ_REG_UDI_2]);
+
+	if (irq_status[CAM_IFE_CSID_IRQ_REG_TOP] & CSID_TOP_IRQ_DONE) {
+		CAM_DBG(CAM_ISP, "csid top reset complete");
+		complete(&csid_hw->csid_top_complete);
+		csid_hw->is_resetting = false;
+		return IRQ_HANDLED;
+	}
+
+	if (csid_hw->is_resetting) {
+		CAM_DBG(CAM_ISP, "CSID:%d is resetting, IRQ Handling exit",
+			csid_hw->hw_intf->hw_idx);
+		return IRQ_HANDLED;
+	}
+
+	if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+		BIT(csid_reg->csi2_reg->csi2_rst_done_shift_val)) {
+		CAM_DBG(CAM_ISP, "csi rx reset complete");
+		complete(&csid_hw->csid_csi2_complete);
+	}
+
+	spin_lock_irqsave(&csid_hw->lock_state, flags);
+	if (csid_hw->device_enabled == 1) {
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_LANE0_FIFO_OVERFLOW) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RX_ERROR_LANE0_FIFO_OVERFLOW: Skew/Less Data on lanes/ Slow csid clock:%luHz",
+				csid_hw->hw_intf->hw_idx,
+				soc_info->applied_src_clk_rate);
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_LANE1_FIFO_OVERFLOW) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RX_ERROR_LANE1_FIFO_OVERFLOW: Skew/Less Data on lanes/ Slow csid clock:%luHz",
+				csid_hw->hw_intf->hw_idx,
+				soc_info->applied_src_clk_rate);
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_LANE2_FIFO_OVERFLOW) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RX_ERROR_LANE2_FIFO_OVERFLOW: Skew/Less Data on lanes/ Slow csid clock:%luHz",
+				csid_hw->hw_intf->hw_idx,
+				soc_info->applied_src_clk_rate);
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_LANE3_FIFO_OVERFLOW) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RX_ERROR_LANE3_FIFO_OVERFLOW: Skew/Less Data on lanes/ Slow csid clock:%luHz",
+				csid_hw->hw_intf->hw_idx,
+				soc_info->applied_src_clk_rate);
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_TG_FIFO_OVERFLOW) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RX_ERROR_TPG_FIFO_OVERFLOW: Backpressure from IFE",
+				csid_hw->hw_intf->hw_idx);
+			fatal_err_detected = true;
+			event_type |= CAM_ISP_HW_ERROR_CSID_OVERFLOW;
+			goto handle_fatal_error;
+		}
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION) &&
+			(!csid_hw->epd_supported)) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d CPHY_EOT_RECEPTION: No EOT on lane/s",
+				csid_hw->hw_intf->hw_idx);
+			csid_hw->error_irq_count++;
+			non_fatal_detected = true;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_CPHY_SOT_RECEPTION) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d CPHY_SOT_RECEPTION: Less SOTs on lane/s",
+				csid_hw->hw_intf->hw_idx);
+			csid_hw->error_irq_count++;
+			non_fatal_detected = true;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_CPHY_PH_CRC) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d CPHY_PH_CRC CPHY: Pkt Hdr CRC mismatch",
+				csid_hw->hw_intf->hw_idx);
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_CRC) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d ERROR_CRC CPHY: Long pkt payload CRC mismatch",
+				csid_hw->hw_intf->hw_idx);
+			csid_hw->error_irq_count++;
+			non_fatal_detected = true;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_ECC) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d ERROR_ECC: Dphy pkt hdr errors unrecoverable",
+				csid_hw->hw_intf->hw_idx);
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_MMAPPED_VC_DT) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_0_addr);
+
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d MMAPPED_VC_DT: VC:%d DT:%d WC:%d mapped to more than 1 csid paths",
+				csid_hw->hw_intf->hw_idx, (val >> 22),
+				((val >> 16) & 0x3F), (val & 0xFFFF));
+		}
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT) &&
+			(csid_hw->csid_debug &
+				CSID_DEBUG_ENABLE_UNMAPPED_VC_DT_IRQ)) {
+
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr);
+
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d UNMAPPED_VC_DT: VC:%d DT:%d WC:%d not mapped to any csid paths",
+				csid_hw->hw_intf->hw_idx, (val >> 22),
+				((val >> 16) & 0x3F), (val & 0xFFFF));
+			csid_hw->error_irq_count++;
+			non_fatal_detected = true;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_STREAM_UNDERFLOW) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_0_addr);
+
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d ERROR_STREAM_UNDERFLOW: Fewer bytes rcvd than WC:%d in pkt hdr",
+				csid_hw->hw_intf->hw_idx, (val & 0xFFFF));
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_ERROR_UNBOUNDED_FRAME) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d UNBOUNDED_FRAME: Frame started with EOF or No EOF",
+				csid_hw->hw_intf->hw_idx);
+			csid_hw->error_irq_count++;
+			non_fatal_detected = true;
+		}
+
+		if (non_fatal_detected)
+			CAM_INFO(CAM_ISP, "CSID: %u Error IRQ Count:%u",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->error_irq_count++);
+	}
+
+handle_fatal_error:
+	spin_unlock_irqrestore(&csid_hw->lock_state, flags);
+
+	if (csid_hw->error_irq_count >
+		CAM_IFE_CSID_MAX_IRQ_ERROR_COUNT) {
+		fatal_err_detected = true;
+		csid_hw->error_irq_count = 0;
+	}
+
+	if (fatal_err_detected) {
+		cam_ife_csid_halt_csi2(csid_hw);
+		cam_csid_handle_hw_err_irq(csid_hw,
+			(event_type | CAM_ISP_HW_ERROR_CSID_FATAL), irq_status);
+		event_type = 0;
+	}
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOT_IRQ) {
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL0_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL1_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL2_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL3_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+	}
+
+	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOT_IRQ) {
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL0_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL1_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL2_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL3_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+	}
+
+	if ((csid_hw->csid_debug & CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE) &&
+		(irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED)) {
+
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d LONG_PKT_CAPTURED",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_0_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d long packet VC :%d DT:%d WC:%d",
+			csid_hw->hw_intf->hw_idx,
+			(val >> 22), ((val >> 16) & 0x3F), (val & 0xFFFF));
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_1_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d long packet ECC :%d",
+			csid_hw->hw_intf->hw_idx, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_ftr_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d long pkt cal CRC:%d expected CRC:%d",
+			csid_hw->hw_intf->hw_idx, (val >> 16), (val & 0xFFFF));
+	}
+	if ((csid_hw->csid_debug & CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE) &&
+		(irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED)) {
+
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d SHORT_PKT_CAPTURED",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_short_pkt_0_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d short pkt VC :%d DT:%d LC:%d",
+			csid_hw->hw_intf->hw_idx,
+			(val >> 22), ((val >> 16) & 0x3F), (val & 0xFFFF));
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_short_pkt_1_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d short packet ECC :%d",
+			csid_hw->hw_intf->hw_idx, val);
+	}
+
+	if ((csid_hw->csid_debug & CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE) &&
+		(irq_status[CAM_IFE_CSID_IRQ_REG_RX] &
+			CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d CPHY_PKT_HDR_CAPTURED",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_cphy_pkt_hdr_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d cphy packet VC :%d DT:%d WC:%d",
+			csid_hw->hw_intf->hw_idx,
+			(val >> 22), ((val >> 16) & 0x3F), (val & 0xFFFF));
+	}
+
+	/*read the IPP errors */
+	if (csid_reg->cmn_reg->num_pix) {
+		/* IPP reset done bit */
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_IPP] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) {
+			CAM_DBG(CAM_ISP, "CSID:%d IPP reset complete",
+				csid_hw->hw_intf->hw_idx);
+			complete(&csid_hw->csid_ipp_complete);
+		}
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_IPP] &
+			CSID_PATH_INFO_INPUT_SOF) &&
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			if (!csid_hw->sof_irq_triggered)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP SOF received",
+					csid_hw->hw_intf->hw_idx);
+			else
+				event_type |= CAM_ISP_HW_ERROR_NONE;
+
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_IPP] &
+			CSID_PATH_INFO_INPUT_EOF) &&
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOF_IRQ))
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d IPP EOF received",
+				csid_hw->hw_intf->hw_idx);
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_IPP] &
+			CSID_PATH_ERROR_CCIF_VIOLATION))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP_PATH_ERROR_CCIF_VIOLATION: Bad frame timings",
+				csid_hw->hw_intf->hw_idx);
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_IPP] &
+			CSID_PATH_OVERFLOW_RECOVERY))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP_PATH_OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+				csid_hw->hw_intf->hw_idx);
+
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_IPP] &
+			CSID_PATH_ERROR_FIFO_OVERFLOW) {
+			/* Stop IPP path immediately */
+			cam_io_w_mb(CAM_CSID_HALT_IMMEDIATELY,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_ctrl_addr);
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP_PATH_ERROR_O/P_FIFO_OVERFLOW: Slow IFE read",
+				csid_hw->hw_intf->hw_idx);
+			event_type |= CAM_ISP_HW_ERROR_CSID_OVERFLOW;
+		}
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_IPP] &
+			CSID_PATH_ERROR_PIX_COUNT) ||
+			(irq_status[CAM_IFE_CSID_IRQ_REG_IPP] &
+			CSID_PATH_ERROR_LINE_COUNT)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_format_measure0_addr);
+			val2 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_format_measure_cfg1_addr
+			);
+
+			CAM_ERR(CAM_ISP,
+				"CSID:%d irq_status_ipp:0x%x",
+				csid_hw->hw_intf->hw_idx,
+				irq_status[CAM_IFE_CSID_IRQ_REG_IPP]);
+			CAM_ERR(CAM_ISP,
+			"Expected:: h: 0x%x w: 0x%x actual:: h: 0x%x w: 0x%x [format_measure0: 0x%x]",
+			((val2 >>
+			csid_reg->cmn_reg->format_measure_height_shift_val) &
+			csid_reg->cmn_reg->format_measure_height_mask_val),
+			val2 &
+			csid_reg->cmn_reg->format_measure_width_mask_val,
+			((val >>
+			csid_reg->cmn_reg->format_measure_height_shift_val) &
+			csid_reg->cmn_reg->format_measure_height_mask_val),
+			val &
+			csid_reg->cmn_reg->format_measure_width_mask_val,
+			val);
+		}
+	}
+
+	/*read PPP errors */
+	if (csid_reg->cmn_reg->num_ppp) {
+		/* PPP reset done bit */
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_PPP] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) {
+			CAM_DBG(CAM_ISP, "CSID:%d PPP reset complete",
+				csid_hw->hw_intf->hw_idx);
+			complete(&csid_hw->csid_ppp_complete);
+		}
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_PPP] &
+			CSID_PATH_INFO_INPUT_SOF) &&
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			if (!csid_hw->sof_irq_triggered)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP SOF received",
+					csid_hw->hw_intf->hw_idx);
+			else
+				event_type |= CAM_ISP_HW_ERROR_NONE;
+
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_PPP] &
+			CSID_PATH_INFO_INPUT_EOF) &&
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOF_IRQ))
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d PPP EOF received",
+				csid_hw->hw_intf->hw_idx);
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_PPP] &
+			CSID_PATH_ERROR_CCIF_VIOLATION))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PPP_PATH_ERROR_CCIF_VIOLATION: Bad frame timings",
+				csid_hw->hw_intf->hw_idx);
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_PPP] &
+			CSID_PATH_OVERFLOW_RECOVERY))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PPP_PATH_OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+				csid_hw->hw_intf->hw_idx);
+
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_PPP] &
+			CSID_PATH_ERROR_FIFO_OVERFLOW) {
+			/* Stop PPP path immediately */
+			cam_io_w_mb(CAM_CSID_HALT_IMMEDIATELY,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->ppp_reg->csid_pxl_ctrl_addr);
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PPP_PATH_ERROR_O/P_FIFO_OVERFLOW: Slow IFE read",
+				csid_hw->hw_intf->hw_idx);
+			event_type |= CAM_ISP_HW_ERROR_CSID_OVERFLOW;
+		}
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_PPP] &
+			CSID_PATH_ERROR_PIX_COUNT) ||
+			(irq_status[CAM_IFE_CSID_IRQ_REG_PPP] &
+			CSID_PATH_ERROR_LINE_COUNT)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_format_measure0_addr);
+			val2 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ppp_reg->csid_pxl_format_measure_cfg1_addr
+			);
+
+			CAM_ERR(CAM_ISP,
+				"CSID:%d irq_status_ppp:0x%x",
+				csid_hw->hw_intf->hw_idx,
+				irq_status[CAM_IFE_CSID_IRQ_REG_PPP]);
+			CAM_ERR(CAM_ISP,
+			"Expected:: h:  0x%x w: 0x%x actual:: h: 0x%x w: 0x%x [format_measure0: 0x%x]",
+			((val2 >>
+			csid_reg->cmn_reg->format_measure_height_shift_val) &
+			csid_reg->cmn_reg->format_measure_height_mask_val),
+			val2 &
+			csid_reg->cmn_reg->format_measure_width_mask_val,
+			((val >>
+			csid_reg->cmn_reg->format_measure_height_shift_val) &
+			csid_reg->cmn_reg->format_measure_height_mask_val),
+			val &
+			csid_reg->cmn_reg->format_measure_width_mask_val,
+			val);
+		}
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		if (irq_status[i] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) {
+			CAM_DBG(CAM_ISP, "CSID:%d RDI%d reset complete",
+				csid_hw->hw_intf->hw_idx, i);
+			complete(&csid_hw->csid_rdin_complete[i]);
+		}
+
+		if ((irq_status[i] & CSID_PATH_INFO_INPUT_SOF) &&
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			if (!csid_hw->sof_irq_triggered)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RDI:%d SOF received",
+					csid_hw->hw_intf->hw_idx, i);
+			else
+				event_type |= CAM_ISP_HW_ERROR_NONE;
+
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
+
+		if ((irq_status[i]  & CSID_PATH_INFO_INPUT_EOF) &&
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOF_IRQ))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RDI:%d EOF received",
+				csid_hw->hw_intf->hw_idx, i);
+
+		if ((irq_status[i] & CSID_PATH_ERROR_CCIF_VIOLATION))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RDI :%d PATH_ERROR_CCIF_VIOLATION: Bad frame timings",
+				csid_hw->hw_intf->hw_idx, i);
+
+		if ((irq_status[i] & CSID_PATH_OVERFLOW_RECOVERY))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RDI :%d PATH_OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+				csid_hw->hw_intf->hw_idx, i);
+
+		if (irq_status[i] & CSID_PATH_ERROR_FIFO_OVERFLOW) {
+			/* Stop RDI path immediately */
+			cam_io_w_mb(CAM_CSID_HALT_IMMEDIATELY,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_ctrl_addr);
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RDI_PATH_ERROR_O/P_FIFO_OVERFLOW: Slow IFE read",
+				csid_hw->hw_intf->hw_idx);
+
+			event_type |= CAM_ISP_HW_ERROR_CSID_OVERFLOW;
+		}
+
+		if ((irq_status[i] & CSID_PATH_ERROR_PIX_COUNT) ||
+			(irq_status[i] & CSID_PATH_ERROR_LINE_COUNT)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_format_measure0_addr);
+			val2 = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_format_measure_cfg1_addr
+			);
+			CAM_ERR(CAM_ISP,
+				"CSID:%d irq_status_rdi[%d]:0x%x",
+				csid_hw->hw_intf->hw_idx, i, irq_status[i]);
+			CAM_ERR(CAM_ISP,
+			"Expected:: h: 0x%x w: 0x%x actual:: h: 0x%x w: 0x%x [format_measure0: 0x%x]",
+			((val2 >>
+			csid_reg->cmn_reg->format_measure_height_shift_val) &
+			csid_reg->cmn_reg->format_measure_height_mask_val),
+			val2 &
+			csid_reg->cmn_reg->format_measure_width_mask_val,
+			((val >>
+			csid_reg->cmn_reg->format_measure_height_shift_val) &
+			csid_reg->cmn_reg->format_measure_height_mask_val),
+			val &
+			csid_reg->cmn_reg->format_measure_width_mask_val,
+			val);
+		}
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_udis; i++) {
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0 + i] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) {
+			CAM_DBG(CAM_ISP, "CSID:%d UDI%d reset complete",
+				csid_hw->hw_intf->hw_idx, i);
+			complete(&csid_hw->csid_udin_complete[i]);
+		}
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0 + i] &
+			CSID_PATH_INFO_INPUT_SOF) &&
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			if (!csid_hw->sof_irq_triggered)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d UDI:%d SOF received",
+					csid_hw->hw_intf->hw_idx, i);
+			else
+				event_type |= CAM_ISP_HW_ERROR_NONE;
+
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0 + i]  &
+			CSID_PATH_INFO_INPUT_EOF) &&
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOF_IRQ))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d UDI:%d EOF received",
+				csid_hw->hw_intf->hw_idx, i);
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0 + i] &
+			CSID_PATH_ERROR_CCIF_VIOLATION))
+			CAM_WARN_RATE_LIMIT(CAM_ISP,
+				"CSID:%d UDI :%d PATH_ERROR_CCIF_VIOLATION: Bad frame timings",
+				csid_hw->hw_intf->hw_idx, i);
+
+		if ((irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0 + i] &
+			CSID_PATH_OVERFLOW_RECOVERY))
+			CAM_WARN_RATE_LIMIT(CAM_ISP,
+				"CSID:%d UDI :%d PATH_OVERFLOW_RECOVERY: Back pressure/output fifo ovrfl",
+				csid_hw->hw_intf->hw_idx, i);
+
+		if (irq_status[CAM_IFE_CSID_IRQ_REG_UDI_0 + i] &
+			CSID_PATH_ERROR_FIFO_OVERFLOW) {
+			/* Stop UDI path immediately */
+			cam_io_w_mb(CAM_CSID_HALT_IMMEDIATELY,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->udi_reg[i]->csid_udi_ctrl_addr);
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"CSID:%d UDI_PATH_ERROR_O/P_FIFO_OVERFLOW: Slow ife read",
+				csid_hw->hw_intf->hw_idx);
+			event_type |= CAM_ISP_HW_ERROR_CSID_OVERFLOW;
+		}
+	}
+
+	if (event_type)
+		cam_csid_handle_hw_err_irq(csid_hw, event_type, irq_status);
+
+	if (csid_hw->irq_debug_cnt >= CAM_CSID_IRQ_SOF_DEBUG_CNT_MAX) {
+		cam_ife_csid_sof_irq_debug(csid_hw, &sof_irq_debug_en);
+		csid_hw->irq_debug_cnt = 0;
+	}
+
+	CAM_DBG(CAM_ISP, "IRQ Handling exit");
+	return IRQ_HANDLED;
+}
+
+int cam_ife_csid_hw_probe_init(struct cam_hw_intf  *csid_hw_intf,
+	uint32_t csid_idx, bool is_custom)
+{
+	int rc = -EINVAL;
+	uint32_t i;
+	uint32_t num_paths;
+	struct cam_ife_csid_path_cfg         *path_data;
+	struct cam_ife_csid_cid_data         *cid_data;
+	struct cam_hw_info                   *csid_hw_info;
+	struct cam_ife_csid_hw               *ife_csid_hw = NULL;
+
+	if (csid_idx >= CAM_IFE_CSID_HW_NUM_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid csid index:%d", csid_idx);
+		return rc;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *) csid_hw_intf->hw_priv;
+	ife_csid_hw  = (struct cam_ife_csid_hw  *) csid_hw_info->core_info;
+
+	ife_csid_hw->hw_intf = csid_hw_intf;
+	ife_csid_hw->hw_info = csid_hw_info;
+
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		ife_csid_hw->hw_intf->hw_type, csid_idx);
+
+
+	ife_csid_hw->device_enabled = 0;
+	ife_csid_hw->is_resetting = false;
+	ife_csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	if (!cam_cpas_is_feature_supported(CAM_CPAS_ISP_FUSE,
+		(1 << ife_csid_hw->hw_intf->hw_idx), 0) ||
+		!cam_cpas_is_feature_supported(CAM_CPAS_ISP_LITE_FUSE,
+		(1 << ife_csid_hw->hw_intf->hw_idx), 0)) {
+		CAM_DBG(CAM_ISP, "IFE:%d is not supported",
+			ife_csid_hw->hw_intf->hw_idx);
+		return -ENODEV;
+	}
+
+	mutex_init(&ife_csid_hw->hw_info->hw_mutex);
+	spin_lock_init(&ife_csid_hw->hw_info->hw_lock);
+	spin_lock_init(&ife_csid_hw->lock_state);
+	init_completion(&ife_csid_hw->hw_info->hw_complete);
+
+	init_completion(&ife_csid_hw->csid_top_complete);
+	init_completion(&ife_csid_hw->csid_csi2_complete);
+	init_completion(&ife_csid_hw->csid_ipp_complete);
+	init_completion(&ife_csid_hw->csid_ppp_complete);
+	for (i = 0; i < CAM_IFE_CSID_RDI_MAX; i++)
+		init_completion(&ife_csid_hw->csid_rdin_complete[i]);
+
+	for (i = 0; i < CAM_IFE_CSID_UDI_MAX; i++)
+		init_completion(&ife_csid_hw->csid_udin_complete[i]);
+
+	rc = cam_ife_csid_init_soc_resources(&ife_csid_hw->hw_info->soc_info,
+			cam_ife_csid_irq, ife_csid_hw, is_custom);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d Failed to init_soc", csid_idx);
+		goto err;
+	}
+
+	if (cam_cpas_is_feature_supported(CAM_CPAS_QCFA_BINNING_ENABLE,
+		CAM_CPAS_HW_IDX_ANY, NULL))
+		ife_csid_hw->binning_enable = 1;
+
+	ife_csid_hw->hw_intf->hw_ops.get_hw_caps = cam_ife_csid_get_hw_caps;
+	ife_csid_hw->hw_intf->hw_ops.init        = cam_ife_csid_init_hw;
+	ife_csid_hw->hw_intf->hw_ops.deinit      = cam_ife_csid_deinit_hw;
+	ife_csid_hw->hw_intf->hw_ops.reset       = cam_ife_csid_reset;
+	ife_csid_hw->hw_intf->hw_ops.reserve     = cam_ife_csid_reserve;
+	ife_csid_hw->hw_intf->hw_ops.release     = cam_ife_csid_release;
+	ife_csid_hw->hw_intf->hw_ops.start       = cam_ife_csid_start;
+	ife_csid_hw->hw_intf->hw_ops.stop        = cam_ife_csid_stop;
+	ife_csid_hw->hw_intf->hw_ops.read        = cam_ife_csid_read;
+	ife_csid_hw->hw_intf->hw_ops.write       = cam_ife_csid_write;
+	ife_csid_hw->hw_intf->hw_ops.process_cmd = cam_ife_csid_process_cmd;
+
+	num_paths = ife_csid_hw->csid_info->csid_reg->cmn_reg->num_pix +
+		ife_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis +
+		ife_csid_hw->csid_info->csid_reg->cmn_reg->num_udis;
+
+	/* Initialize the CID resource */
+	for (i = 0; i < num_paths; i++) {
+		ife_csid_hw->cid_res[i].res_type = CAM_ISP_RESOURCE_CID;
+		ife_csid_hw->cid_res[i].res_id = i;
+		ife_csid_hw->cid_res[i].res_state  =
+					CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		ife_csid_hw->cid_res[i].hw_intf = ife_csid_hw->hw_intf;
+
+		cid_data = kzalloc(sizeof(struct cam_ife_csid_cid_data),
+					GFP_KERNEL);
+		if (!cid_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		ife_csid_hw->cid_res[i].res_priv = cid_data;
+	}
+
+	/* Initialize the IPP resources */
+	if (ife_csid_hw->csid_info->csid_reg->cmn_reg->num_pix) {
+		ife_csid_hw->ipp_res.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		ife_csid_hw->ipp_res.res_id = CAM_IFE_PIX_PATH_RES_IPP;
+		ife_csid_hw->ipp_res.res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		ife_csid_hw->ipp_res.hw_intf = ife_csid_hw->hw_intf;
+		path_data = kzalloc(sizeof(*path_data),
+					GFP_KERNEL);
+		if (!path_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		ife_csid_hw->ipp_res.res_priv = path_data;
+	}
+
+	/* Initialize PPP resource */
+	if (ife_csid_hw->csid_info->csid_reg->cmn_reg->num_ppp) {
+		ife_csid_hw->ppp_res.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		ife_csid_hw->ppp_res.res_id = CAM_IFE_PIX_PATH_RES_PPP;
+		ife_csid_hw->ppp_res.res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		ife_csid_hw->ppp_res.hw_intf = ife_csid_hw->hw_intf;
+		path_data = kzalloc(sizeof(*path_data),
+					GFP_KERNEL);
+		if (!path_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		ife_csid_hw->ppp_res.res_priv = path_data;
+	}
+
+	/* Initialize the RDI resource */
+	for (i = 0; i < ife_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis;
+				i++) {
+		/* res type is from RDI 0 to RDI3 */
+		ife_csid_hw->rdi_res[i].res_type =
+			CAM_ISP_RESOURCE_PIX_PATH;
+		ife_csid_hw->rdi_res[i].res_id = i;
+		ife_csid_hw->rdi_res[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		ife_csid_hw->rdi_res[i].hw_intf = ife_csid_hw->hw_intf;
+
+		path_data = kzalloc(sizeof(*path_data),
+			GFP_KERNEL);
+		if (!path_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		ife_csid_hw->rdi_res[i].res_priv = path_data;
+	}
+
+	/* Initialize the UDI resource */
+	for (i = 0; i < ife_csid_hw->csid_info->csid_reg->cmn_reg->num_udis;
+				i++) {
+		/* res type is from UDI0 to UDI3 */
+		ife_csid_hw->udi_res[i].res_type =
+			CAM_ISP_RESOURCE_PIX_PATH;
+		ife_csid_hw->udi_res[i].res_id = i +
+			CAM_IFE_PIX_PATH_RES_UDI_0;
+		ife_csid_hw->udi_res[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		ife_csid_hw->udi_res[i].hw_intf = ife_csid_hw->hw_intf;
+
+		path_data = kzalloc(sizeof(*path_data),
+			GFP_KERNEL);
+		if (!path_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		ife_csid_hw->udi_res[i].res_priv = path_data;
+	}
+
+	rc = cam_tasklet_init(&ife_csid_hw->tasklet, ife_csid_hw, csid_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Unable to create CSID tasklet rc %d", rc);
+		goto err;
+	}
+
+	INIT_LIST_HEAD(&ife_csid_hw->free_payload_list);
+	for (i = 0; i < CAM_CSID_EVT_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&ife_csid_hw->evt_payload[i].list);
+		list_add_tail(&ife_csid_hw->evt_payload[i].list,
+			&ife_csid_hw->free_payload_list);
+	}
+
+	ife_csid_hw->csid_debug = 0;
+	ife_csid_hw->error_irq_count = 0;
+	ife_csid_hw->ipp_path_config.measure_enabled = 0;
+	ife_csid_hw->ppp_path_config.measure_enabled = 0;
+	ife_csid_hw->epd_supported = 0;
+	for (i = 0; i <= CAM_IFE_PIX_PATH_RES_RDI_3; i++)
+		ife_csid_hw->rdi_path_config[i].measure_enabled = 0;
+
+	return 0;
+err:
+	if (rc) {
+		kfree(ife_csid_hw->ipp_res.res_priv);
+		kfree(ife_csid_hw->ppp_res.res_priv);
+		for (i = 0; i <
+			ife_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis;
+			i++)
+			kfree(ife_csid_hw->rdi_res[i].res_priv);
+
+		for (i = 0; i <
+			ife_csid_hw->csid_info->csid_reg->cmn_reg->num_udis;
+			i++)
+			kfree(ife_csid_hw->udi_res[i].res_priv);
+
+		for (i = 0; i < CAM_IFE_CSID_CID_MAX; i++)
+			kfree(ife_csid_hw->cid_res[i].res_priv);
+
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_ife_csid_hw_probe_init);
+
+int cam_ife_csid_hw_deinit(struct cam_ife_csid_hw *ife_csid_hw)
+{
+	int rc = -EINVAL;
+	uint32_t i;
+
+	if (!ife_csid_hw) {
+		CAM_ERR(CAM_ISP, "Invalid param");
+		return rc;
+	}
+
+	/* release the privdate data memory from resources */
+	kfree(ife_csid_hw->ipp_res.res_priv);
+	kfree(ife_csid_hw->ppp_res.res_priv);
+	for (i = 0; i <
+		ife_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis;
+		i++) {
+		kfree(ife_csid_hw->rdi_res[i].res_priv);
+	}
+	for (i = 0; i <
+		ife_csid_hw->csid_info->csid_reg->cmn_reg->num_udis;
+		i++) {
+		kfree(ife_csid_hw->udi_res[i].res_priv);
+	}
+	for (i = 0; i < CAM_IFE_CSID_CID_MAX; i++)
+		kfree(ife_csid_hw->cid_res[i].res_priv);
+
+	cam_ife_csid_deinit_soc_resources(&ife_csid_hw->hw_info->soc_info);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_ife_csid_hw_deinit);
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h
@@ -0,0 +1,678 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_HW_H_
+#define _CAM_IFE_CSID_HW_H_
+
+#include "cam_hw.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_ife_csid_soc.h"
+
+#define CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED    BIT(0)
+#define CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED    BIT(1)
+#define CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED    BIT(2)
+#define CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED    BIT(3)
+#define CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED    BIT(4)
+#define CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED    BIT(5)
+#define CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED    BIT(6)
+#define CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED    BIT(7)
+#define CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED       BIT(8)
+#define CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED      BIT(9)
+#define CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED   BIT(10)
+#define CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION     BIT(11)
+#define CSID_CSI2_RX_ERROR_CPHY_SOT_RECEPTION     BIT(12)
+#define CSID_CSI2_RX_ERROR_CPHY_PH_CRC            BIT(13)
+#define CSID_CSI2_RX_WARNING_ECC                  BIT(14)
+#define CSID_CSI2_RX_ERROR_LANE0_FIFO_OVERFLOW    BIT(15)
+#define CSID_CSI2_RX_ERROR_LANE1_FIFO_OVERFLOW    BIT(16)
+#define CSID_CSI2_RX_ERROR_LANE2_FIFO_OVERFLOW    BIT(17)
+#define CSID_CSI2_RX_ERROR_LANE3_FIFO_OVERFLOW    BIT(18)
+#define CSID_CSI2_RX_ERROR_CRC                    BIT(19)
+#define CSID_CSI2_RX_ERROR_ECC                    BIT(20)
+#define CSID_CSI2_RX_ERROR_MMAPPED_VC_DT          BIT(21)
+#define CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT         BIT(22)
+#define CSID_CSI2_RX_ERROR_STREAM_UNDERFLOW       BIT(23)
+#define CSID_CSI2_RX_ERROR_UNBOUNDED_FRAME        BIT(24)
+#define CSID_CSI2_RX_INFO_TG_DONE                 BIT(25)
+#define CSID_CSI2_RX_ERROR_TG_FIFO_OVERFLOW       BIT(26)
+#define CSID_CSI2_RX_INFO_RST_DONE                BIT(27)
+
+#define CSID_TOP_IRQ_DONE                         BIT(0)
+#define CSID_PATH_INFO_RST_DONE                   BIT(1)
+#define CSID_PATH_ERROR_FIFO_OVERFLOW             BIT(2)
+#define CSID_PATH_INFO_SUBSAMPLED_EOF             BIT(3)
+#define CSID_PATH_INFO_SUBSAMPLED_SOF             BIT(4)
+#define CSID_PATH_INFO_FRAME_DROP_EOF             BIT(5)
+#define CSID_PATH_INFO_FRAME_DROP_EOL             BIT(6)
+#define CSID_PATH_INFO_FRAME_DROP_SOL             BIT(7)
+#define CSID_PATH_INFO_FRAME_DROP_SOF             BIT(8)
+#define CSID_PATH_INFO_INPUT_EOF                  BIT(9)
+#define CSID_PATH_INFO_INPUT_EOL                  BIT(10)
+#define CSID_PATH_INFO_INPUT_SOL                  BIT(11)
+#define CSID_PATH_INFO_INPUT_SOF                  BIT(12)
+#define CSID_PATH_ERROR_PIX_COUNT                 BIT(13)
+#define CSID_PATH_ERROR_LINE_COUNT                BIT(14)
+#define CSID_PATH_ERROR_CCIF_VIOLATION            BIT(15)
+#define CSID_PATH_OVERFLOW_RECOVERY               BIT(17)
+
+/*
+ * Debug values enable the corresponding interrupts and debug logs provide
+ * necessary information
+ */
+#define CSID_DEBUG_ENABLE_SOF_IRQ                 BIT(0)
+#define CSID_DEBUG_ENABLE_EOF_IRQ                 BIT(1)
+#define CSID_DEBUG_ENABLE_SOT_IRQ                 BIT(2)
+#define CSID_DEBUG_ENABLE_EOT_IRQ                 BIT(3)
+#define CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE       BIT(4)
+#define CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE        BIT(5)
+#define CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE        BIT(6)
+#define CSID_DEBUG_ENABLE_HBI_VBI_INFO            BIT(7)
+#define CSID_DEBUG_DISABLE_EARLY_EOF              BIT(8)
+#define CSID_DEBUG_ENABLE_UNMAPPED_VC_DT_IRQ      BIT(9)
+
+#define CAM_CSID_EVT_PAYLOAD_MAX                  10
+#define CAM_CSID_MIN_HBI_CFG_MAX_VAL              0xF
+
+#define CAM_CSID_RESOLUTION_22MP_WIDTH            5612
+#define CAM_CSID_RESOLUTION_25MP_WIDTH            6048
+#define CAM_CSID_RESOLUTION_28MP_WIDTH            7308
+
+/* enum cam_csid_path_halt_mode select the path halt mode control */
+enum cam_csid_path_halt_mode {
+	CSID_HALT_MODE_INTERNAL,
+	CSID_HALT_MODE_GLOBAL,
+	CSID_HALT_MODE_MASTER,
+	CSID_HALT_MODE_SLAVE,
+};
+
+/**
+ *enum cam_csid_path_timestamp_stb_sel - select the sof/eof strobes used to
+ *        capture the timestamp
+ */
+enum cam_csid_path_timestamp_stb_sel {
+	CSID_TIMESTAMP_STB_PRE_HALT,
+	CSID_TIMESTAMP_STB_POST_HALT,
+	CSID_TIMESTAMP_STB_POST_IRQ,
+	CSID_TIMESTAMP_STB_MAX,
+};
+
+/**
+ * enum cam_ife_pix_path_res_id - Specify the csid patch
+ */
+enum cam_ife_csid_irq_reg {
+	CAM_IFE_CSID_IRQ_REG_RDI_0,
+	CAM_IFE_CSID_IRQ_REG_RDI_1,
+	CAM_IFE_CSID_IRQ_REG_RDI_2,
+	CAM_IFE_CSID_IRQ_REG_RDI_3,
+	CAM_IFE_CSID_IRQ_REG_TOP,
+	CAM_IFE_CSID_IRQ_REG_RX,
+	CAM_IFE_CSID_IRQ_REG_IPP,
+	CAM_IFE_CSID_IRQ_REG_PPP,
+	CAM_IFE_CSID_IRQ_REG_UDI_0,
+	CAM_IFE_CSID_IRQ_REG_UDI_1,
+	CAM_IFE_CSID_IRQ_REG_UDI_2,
+	CAM_IFE_CSID_IRQ_REG_MAX,
+};
+
+struct cam_ife_csid_pxl_reg_offset {
+	/* Pxl path register offsets*/
+	uint32_t csid_pxl_irq_status_addr;
+	uint32_t csid_pxl_irq_mask_addr;
+	uint32_t csid_pxl_irq_clear_addr;
+	uint32_t csid_pxl_irq_set_addr;
+
+	uint32_t csid_pxl_cfg0_addr;
+	uint32_t csid_pxl_cfg1_addr;
+	uint32_t csid_pxl_ctrl_addr;
+	uint32_t csid_pxl_frm_drop_pattern_addr;
+	uint32_t csid_pxl_frm_drop_period_addr;
+	uint32_t csid_pxl_irq_subsample_pattern_addr;
+	uint32_t csid_pxl_irq_subsample_period_addr;
+	uint32_t csid_pxl_hcrop_addr;
+	uint32_t csid_pxl_vcrop_addr;
+	uint32_t csid_pxl_pix_drop_pattern_addr;
+	uint32_t csid_pxl_pix_drop_period_addr;
+	uint32_t csid_pxl_line_drop_pattern_addr;
+	uint32_t csid_pxl_line_drop_period_addr;
+	uint32_t csid_pxl_rst_strobes_addr;
+	uint32_t csid_pxl_status_addr;
+	uint32_t csid_pxl_misr_val_addr;
+	uint32_t csid_pxl_format_measure_cfg0_addr;
+	uint32_t csid_pxl_format_measure_cfg1_addr;
+	uint32_t csid_pxl_format_measure0_addr;
+	uint32_t csid_pxl_format_measure1_addr;
+	uint32_t csid_pxl_format_measure2_addr;
+	uint32_t csid_pxl_timestamp_curr0_sof_addr;
+	uint32_t csid_pxl_timestamp_curr1_sof_addr;
+	uint32_t csid_pxl_timestamp_perv0_sof_addr;
+	uint32_t csid_pxl_timestamp_perv1_sof_addr;
+	uint32_t csid_pxl_timestamp_curr0_eof_addr;
+	uint32_t csid_pxl_timestamp_curr1_eof_addr;
+	uint32_t csid_pxl_timestamp_perv0_eof_addr;
+	uint32_t csid_pxl_timestamp_perv1_eof_addr;
+	uint32_t csid_pxl_err_recovery_cfg0_addr;
+	uint32_t csid_pxl_err_recovery_cfg1_addr;
+	uint32_t csid_pxl_err_recovery_cfg2_addr;
+	uint32_t csid_pxl_multi_vcdt_cfg0_addr;
+
+	/* configuration */
+	uint32_t pix_store_en_shift_val;
+	uint32_t early_eof_en_shift_val;
+	uint32_t horizontal_bin_en_shift_val;
+	uint32_t quad_cfa_bin_en_shift_val;
+	uint32_t ccif_violation_en;
+	uint32_t overflow_ctrl_en;
+	uint32_t hblank_cfg_shift_val;
+	uint32_t halt_master_sel_en;
+	uint32_t halt_sel_internal_master_val;
+};
+
+struct cam_ife_csid_rdi_reg_offset {
+	uint32_t csid_rdi_irq_status_addr;
+	uint32_t csid_rdi_irq_mask_addr;
+	uint32_t csid_rdi_irq_clear_addr;
+	uint32_t csid_rdi_irq_set_addr;
+
+	/*RDI N register address */
+	uint32_t csid_rdi_cfg0_addr;
+	uint32_t csid_rdi_cfg1_addr;
+	uint32_t csid_rdi_ctrl_addr;
+	uint32_t csid_rdi_frm_drop_pattern_addr;
+	uint32_t csid_rdi_frm_drop_period_addr;
+	uint32_t csid_rdi_irq_subsample_pattern_addr;
+	uint32_t csid_rdi_irq_subsample_period_addr;
+	uint32_t csid_rdi_rpp_hcrop_addr;
+	uint32_t csid_rdi_rpp_vcrop_addr;
+	uint32_t csid_rdi_rpp_pix_drop_pattern_addr;
+	uint32_t csid_rdi_rpp_pix_drop_period_addr;
+	uint32_t csid_rdi_rpp_line_drop_pattern_addr;
+	uint32_t csid_rdi_rpp_line_drop_period_addr;
+	uint32_t csid_rdi_yuv_chroma_conversion_addr;
+	uint32_t csid_rdi_rst_strobes_addr;
+	uint32_t csid_rdi_status_addr;
+	uint32_t csid_rdi_misr_val0_addr;
+	uint32_t csid_rdi_misr_val1_addr;
+	uint32_t csid_rdi_misr_val2_addr;
+	uint32_t csid_rdi_misr_val3_addr;
+	uint32_t csid_rdi_format_measure_cfg0_addr;
+	uint32_t csid_rdi_format_measure_cfg1_addr;
+	uint32_t csid_rdi_format_measure0_addr;
+	uint32_t csid_rdi_format_measure1_addr;
+	uint32_t csid_rdi_format_measure2_addr;
+	uint32_t csid_rdi_timestamp_curr0_sof_addr;
+	uint32_t csid_rdi_timestamp_curr1_sof_addr;
+	uint32_t csid_rdi_timestamp_prev0_sof_addr;
+	uint32_t csid_rdi_timestamp_prev1_sof_addr;
+	uint32_t csid_rdi_timestamp_curr0_eof_addr;
+	uint32_t csid_rdi_timestamp_curr1_eof_addr;
+	uint32_t csid_rdi_timestamp_prev0_eof_addr;
+	uint32_t csid_rdi_timestamp_prev1_eof_addr;
+	uint32_t csid_rdi_err_recovery_cfg0_addr;
+	uint32_t csid_rdi_err_recovery_cfg1_addr;
+	uint32_t csid_rdi_err_recovery_cfg2_addr;
+	uint32_t csid_rdi_multi_vcdt_cfg0_addr;
+	uint32_t csid_rdi_byte_cntr_ping_addr;
+	uint32_t csid_rdi_byte_cntr_pong_addr;
+
+	/* configuration */
+	uint32_t packing_format;
+	uint32_t ccif_violation_en;
+	uint32_t overflow_ctrl_en;
+};
+
+struct cam_ife_csid_udi_reg_offset {
+	uint32_t csid_udi_irq_status_addr;
+	uint32_t csid_udi_irq_mask_addr;
+	uint32_t csid_udi_irq_clear_addr;
+	uint32_t csid_udi_irq_set_addr;
+
+	/* UDI N register address */
+	uint32_t csid_udi_cfg0_addr;
+	uint32_t csid_udi_cfg1_addr;
+	uint32_t csid_udi_ctrl_addr;
+	uint32_t csid_udi_frm_drop_pattern_addr;
+	uint32_t csid_udi_frm_drop_period_addr;
+	uint32_t csid_udi_irq_subsample_pattern_addr;
+	uint32_t csid_udi_irq_subsample_period_addr;
+	uint32_t csid_udi_rpp_hcrop_addr;
+	uint32_t csid_udi_rpp_vcrop_addr;
+	uint32_t csid_udi_rpp_pix_drop_pattern_addr;
+	uint32_t csid_udi_rpp_pix_drop_period_addr;
+	uint32_t csid_udi_rpp_line_drop_pattern_addr;
+	uint32_t csid_udi_rpp_line_drop_period_addr;
+	uint32_t csid_udi_yuv_chroma_conversion_addr;
+	uint32_t csid_udi_rst_strobes_addr;
+	uint32_t csid_udi_status_addr;
+	uint32_t csid_udi_misr_val0_addr;
+	uint32_t csid_udi_misr_val1_addr;
+	uint32_t csid_udi_misr_val2_addr;
+	uint32_t csid_udi_misr_val3_addr;
+	uint32_t csid_udi_format_measure_cfg0_addr;
+	uint32_t csid_udi_format_measure_cfg1_addr;
+	uint32_t csid_udi_format_measure0_addr;
+	uint32_t csid_udi_format_measure1_addr;
+	uint32_t csid_udi_format_measure2_addr;
+	uint32_t csid_udi_timestamp_curr0_sof_addr;
+	uint32_t csid_udi_timestamp_curr1_sof_addr;
+	uint32_t csid_udi_timestamp_prev0_sof_addr;
+	uint32_t csid_udi_timestamp_prev1_sof_addr;
+	uint32_t csid_udi_timestamp_curr0_eof_addr;
+	uint32_t csid_udi_timestamp_curr1_eof_addr;
+	uint32_t csid_udi_timestamp_prev0_eof_addr;
+	uint32_t csid_udi_timestamp_prev1_eof_addr;
+	uint32_t csid_udi_err_recovery_cfg0_addr;
+	uint32_t csid_udi_err_recovery_cfg1_addr;
+	uint32_t csid_udi_err_recovery_cfg2_addr;
+	uint32_t csid_udi_multi_vcdt_cfg0_addr;
+	uint32_t csid_udi_byte_cntr_ping_addr;
+	uint32_t csid_udi_byte_cntr_pong_addr;
+
+	/* configuration */
+	uint32_t packing_format;
+	uint32_t ccif_violation_en;
+	uint32_t overflow_ctrl_en;
+};
+
+struct cam_ife_csid_csi2_rx_reg_offset {
+	uint32_t csid_csi2_rx_irq_status_addr;
+	uint32_t csid_csi2_rx_irq_mask_addr;
+	uint32_t csid_csi2_rx_irq_clear_addr;
+	uint32_t csid_csi2_rx_irq_set_addr;
+	uint32_t csid_csi2_rx_cfg0_addr;
+	uint32_t csid_csi2_rx_cfg1_addr;
+	uint32_t csid_csi2_rx_capture_ctrl_addr;
+	uint32_t csid_csi2_rx_rst_strobes_addr;
+	uint32_t csid_csi2_rx_de_scramble_cfg0_addr;
+	uint32_t csid_csi2_rx_de_scramble_cfg1_addr;
+	uint32_t csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr;
+	uint32_t csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr;
+	uint32_t csid_csi2_rx_captured_short_pkt_0_addr;
+	uint32_t csid_csi2_rx_captured_short_pkt_1_addr;
+	uint32_t csid_csi2_rx_captured_long_pkt_0_addr;
+	uint32_t csid_csi2_rx_captured_long_pkt_1_addr;
+	uint32_t csid_csi2_rx_captured_long_pkt_ftr_addr;
+	uint32_t csid_csi2_rx_captured_cphy_pkt_hdr_addr;
+	uint32_t csid_csi2_rx_lane0_misr_addr;
+	uint32_t csid_csi2_rx_lane1_misr_addr;
+	uint32_t csid_csi2_rx_lane2_misr_addr;
+	uint32_t csid_csi2_rx_lane3_misr_addr;
+	uint32_t csid_csi2_rx_total_pkts_rcvd_addr;
+	uint32_t csid_csi2_rx_stats_ecc_addr;
+	uint32_t csid_csi2_rx_total_crc_err_addr;
+	uint32_t csid_csi2_rx_de_scramble_type3_cfg0_addr;
+	uint32_t csid_csi2_rx_de_scramble_type3_cfg1_addr;
+	uint32_t csid_csi2_rx_de_scramble_type2_cfg0_addr;
+	uint32_t csid_csi2_rx_de_scramble_type2_cfg1_addr;
+	uint32_t csid_csi2_rx_de_scramble_type1_cfg0_addr;
+	uint32_t csid_csi2_rx_de_scramble_type1_cfg1_addr;
+	uint32_t csid_csi2_rx_de_scramble_type0_cfg0_addr;
+	uint32_t csid_csi2_rx_de_scramble_type0_cfg1_addr;
+
+	/*configurations */
+	uint32_t csi2_rst_srb_all;
+	uint32_t csi2_rst_done_shift_val;
+	uint32_t csi2_irq_mask_all;
+	uint32_t csi2_misr_enable_shift_val;
+	uint32_t csi2_vc_mode_shift_val;
+	uint32_t csi2_capture_long_pkt_en_shift;
+	uint32_t csi2_capture_short_pkt_en_shift;
+	uint32_t csi2_capture_cphy_pkt_en_shift;
+	uint32_t csi2_capture_long_pkt_dt_shift;
+	uint32_t csi2_capture_long_pkt_vc_shift;
+	uint32_t csi2_capture_short_pkt_vc_shift;
+	uint32_t csi2_capture_cphy_pkt_dt_shift;
+	uint32_t csi2_capture_cphy_pkt_vc_shift;
+	uint32_t csi2_rx_phy_num_mask;
+};
+
+struct cam_ife_csid_csi2_tpg_reg_offset {
+	uint32_t csid_tpg_ctrl_addr;
+	uint32_t csid_tpg_vc_cfg0_addr;
+	uint32_t csid_tpg_vc_cfg1_addr;
+	uint32_t csid_tpg_lfsr_seed_addr;
+	uint32_t csid_tpg_dt_n_cfg_0_addr;
+	uint32_t csid_tpg_dt_n_cfg_1_addr;
+	uint32_t csid_tpg_dt_n_cfg_2_addr;
+	uint32_t csid_tpg_color_bars_cfg_addr;
+	uint32_t csid_tpg_color_box_cfg_addr;
+	uint32_t csid_tpg_common_gen_cfg_addr;
+	uint32_t csid_tpg_cgen_n_cfg_addr;
+	uint32_t csid_tpg_cgen_n_x0_addr;
+	uint32_t csid_tpg_cgen_n_x1_addr;
+	uint32_t csid_tpg_cgen_n_x2_addr;
+	uint32_t csid_tpg_cgen_n_xy_addr;
+	uint32_t csid_tpg_cgen_n_y1_addr;
+	uint32_t csid_tpg_cgen_n_y2_addr;
+
+	/*configurations */
+	uint32_t tpg_dtn_cfg_offset;
+	uint32_t tpg_cgen_cfg_offset;
+	uint32_t tpg_cpas_ife_reg_offset;
+
+};
+struct cam_ife_csid_common_reg_offset {
+	/* MIPI CSID registers */
+	uint32_t csid_hw_version_addr;
+	uint32_t csid_cfg0_addr;
+	uint32_t csid_ctrl_addr;
+	uint32_t csid_reset_addr;
+	uint32_t csid_rst_strobes_addr;
+
+	uint32_t csid_test_bus_ctrl_addr;
+	uint32_t csid_top_irq_status_addr;
+	uint32_t csid_top_irq_mask_addr;
+	uint32_t csid_top_irq_clear_addr;
+	uint32_t csid_top_irq_set_addr;
+	uint32_t csid_irq_cmd_addr;
+
+	/*configurations */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t num_udis;
+	uint32_t num_rdis;
+	uint32_t num_pix;
+	uint32_t num_ppp;
+	uint32_t csid_reg_rst_stb;
+	uint32_t csid_rst_stb;
+	uint32_t csid_rst_stb_sw_all;
+	uint32_t path_rst_stb_all;
+	uint32_t path_rst_done_shift_val;
+	uint32_t path_en_shift_val;
+	uint32_t packing_fmt_shift_val;
+	uint32_t dt_id_shift_val;
+	uint32_t vc_shift_val;
+	uint32_t dt_shift_val;
+	uint32_t fmt_shift_val;
+	uint32_t plain_fmt_shit_val;
+	uint32_t crop_v_en_shift_val;
+	uint32_t crop_h_en_shift_val;
+	uint32_t drop_v_en_shift_val;
+	uint32_t drop_h_en_shift_val;
+	uint32_t crop_shift;
+	uint32_t ipp_irq_mask_all;
+	uint32_t rdi_irq_mask_all;
+	uint32_t ppp_irq_mask_all;
+	uint32_t udi_irq_mask_all;
+	uint32_t measure_en_hbi_vbi_cnt_mask;
+	uint32_t format_measure_en_val;
+	uint32_t num_bytes_out_shift_val;
+	uint32_t format_measure_width_shift_val;
+	uint32_t format_measure_width_mask_val;
+	uint32_t format_measure_height_shift_val;
+	uint32_t format_measure_height_mask_val;
+};
+
+/**
+ * struct cam_ife_csid_reg_offset- CSID instance register info
+ *
+ * @cmn_reg:  csid common registers info
+ * @ipp_reg:  ipp register offset information
+ * @ppp_reg:  ppp register offset information
+ * @rdi_reg:  rdi register offset information
+ * @udi_reg:  udi register offset information
+ * @tpg_reg:  tpg register offset information
+ *
+ */
+struct cam_ife_csid_reg_offset {
+	const struct cam_ife_csid_common_reg_offset   *cmn_reg;
+	const struct cam_ife_csid_csi2_rx_reg_offset  *csi2_reg;
+	const struct cam_ife_csid_pxl_reg_offset      *ipp_reg;
+	const struct cam_ife_csid_pxl_reg_offset      *ppp_reg;
+	const struct cam_ife_csid_rdi_reg_offset *rdi_reg[CAM_IFE_CSID_RDI_MAX];
+	const struct cam_ife_csid_udi_reg_offset *udi_reg[CAM_IFE_CSID_UDI_MAX];
+	const struct cam_ife_csid_csi2_tpg_reg_offset *tpg_reg;
+};
+
+
+/**
+ * struct cam_ife_csid_hw_info- CSID HW info
+ *
+ * @csid_reg:        csid register offsets
+ * @hw_dts_version:  HW DTS version
+ * @hw_reg_version:  HW Version read from register
+ * @csid_max_clk:    maximim csid clock
+ * @phy_num_mask:    number of csiphy hw availibility
+ *
+ */
+struct cam_ife_csid_hw_info {
+	const struct cam_ife_csid_reg_offset   *csid_reg;
+	uint32_t                                hw_dts_version;
+	uint32_t                                hw_reg_version;
+	uint32_t                                csid_max_clk;
+	uint32_t                                phy_num_mask;
+};
+
+
+
+/**
+ * struct cam_ife_csid_csi2_rx_cfg- csid csi2 rx configuration data
+ * @phy_sel:     input resource type for sensor only
+ * @lane_type:   lane type: c-phy or d-phy
+ * @lane_num :   active lane number
+ * @lane_cfg:    lane configurations: 4 bits per lane
+ *
+ */
+struct cam_ife_csid_csi2_rx_cfg  {
+	uint32_t                        phy_sel;
+	uint32_t                        lane_type;
+	uint32_t                        lane_num;
+	uint32_t                        lane_cfg;
+};
+
+/**
+ * struct             cam_ife_csid_tpg_cfg- csid tpg configuration data
+ * @width:            width
+ * @height:           height
+ * @test_pattern :    pattern
+ * @in_format:        decode format
+ * @usage_type:       whether dual isp is required
+ *
+ */
+struct cam_ife_csid_tpg_cfg  {
+	uint32_t                        width;
+	uint32_t                        height;
+	uint32_t                        test_pattern;
+	uint32_t                        in_format;
+	uint32_t                        usage_type;
+};
+
+/**
+ * struct cam_ife_csid_cid_data- cid configuration private data
+ *
+ * @vc:               Virtual channel
+ * @dt:               Data type
+ * @cnt:              Cid resource reference count.
+ * @tpg_set:          Tpg used for this cid resource
+ * @is_valid_vc1_dt1: Valid vc1 and dt1
+ * @init_cnt          cid resource init count
+ *
+ */
+struct cam_ife_csid_cid_data {
+	uint32_t                     vc;
+	uint32_t                     dt;
+	uint32_t                     vc1;
+	uint32_t                     dt1;
+	uint32_t                     cnt;
+	uint32_t                     tpg_set;
+	uint32_t                     is_valid_vc1_dt1;
+	uint32_t                     init_cnt;
+};
+
+
+/**
+ * struct cam_ife_csid_path_cfg- csid path configuration details. It is stored
+ *                          as private data for IPP/ RDI paths
+ * @vc :            Virtual channel number
+ * @dt :            Data type number
+ * @cid             cid number, it is same as DT_ID number in HW
+ * @in_format:      input decode format
+ * @out_format:     output format
+ * @crop_enable:    crop is enable or disabled, if enabled
+ *                  then remaining parameters are valid.
+ * @drop_enable:    flag to indicate pixel drop enable or disable
+ * @start_pixel:    start pixel
+ * @end_pixel:      end_pixel
+ * @width:          width
+ * @start_line:     start line
+ * @end_line:       end_line
+ * @height:         heigth
+ * @sync_mode:       Applicable for IPP/RDI path reservation
+ *                  Reserving the path for master IPP or slave IPP
+ *                  master (set value 1), Slave ( set value 2)
+ *                  for RDI, set  mode to none
+ * @master_idx:     For Slave reservation, Give master IFE instance Index.
+ *                  Slave will synchronize with master Start and stop operations
+ * @clk_rate        Clock rate
+ * @num_bytes_out:  Number of output bytes per cycle
+ * @hblank_cnt:     HBI count
+ *
+ */
+struct cam_ife_csid_path_cfg {
+	uint32_t                        vc;
+	uint32_t                        dt;
+	uint32_t                        vc1;
+	uint32_t                        dt1;
+	uint32_t                        is_valid_vc1_dt1;
+	uint32_t                        cid;
+	uint32_t                        in_format;
+	uint32_t                        out_format;
+	bool                            crop_enable;
+	bool                            drop_enable;
+	uint32_t                        start_pixel;
+	uint32_t                        end_pixel;
+	uint32_t                        width;
+	uint32_t                        start_line;
+	uint32_t                        end_line;
+	uint32_t                        height;
+	enum cam_isp_hw_sync_mode       sync_mode;
+	uint32_t                        master_idx;
+	uint64_t                        clk_rate;
+	uint32_t                        horizontal_bin;
+	uint32_t                        qcfa_bin;
+	uint32_t                        num_bytes_out;
+	uint32_t                        hblank_cnt;
+};
+
+/**
+ * struct cam_csid_evt_payload- payload for csid hw event
+ * @list       : list head
+ * @evt_type   : Event type from CSID
+ * @irq_status : IRQ Status register
+ * @hw_idx     : Hw index
+ * @priv       : Private data of payload
+ */
+struct cam_csid_evt_payload {
+	struct list_head   list;
+	uint32_t           evt_type;
+	uint32_t           irq_status[CAM_IFE_CSID_IRQ_REG_MAX];
+	uint32_t           hw_idx;
+	void              *priv;
+};
+
+/**
+ * struct cam_ife_csid_hw- csid hw device resources data
+ *
+ * @hw_intf:                  contain the csid hw interface information
+ * @hw_info:                  csid hw device information
+ * @csid_info:                csid hw specific information
+ * @tasklet:                  tasklet to handle csid errors
+ * @priv:                     private data to be sent with callback
+ * @free_payload_list:        list head for payload
+ * @evt_payload:              Event payload to be passed to tasklet
+ * @res_type:                 CSID in resource type
+ * @csi2_rx_cfg:              Csi2 rx decoder configuration for csid
+ * @tpg_cfg:                  TPG configuration
+ * @csi2_rx_reserve_cnt:      CSI2 reservations count value
+ * @csi2_cfg_cnt:             csi2 configuration count
+ * @tpg_start_cnt:            tpg start count
+ * @ipp_res:                  image pixel path resource
+ * @ppp_res:                  phase pxl path resource
+ * @rdi_res:                  raw dump image path resources
+ * @udi_res:                  udi path resources
+ * @cid_res:                  cid resources state
+ * @csid_top_reset_complete:  csid top reset completion
+ * @csid_csi2_reset_complete: csi2 reset completion
+ * @csid_ipp_reset_complete:  ipp reset completion
+ * @csid_ppp_complete:        ppp reset completion
+ * @csid_rdin_reset_complete: rdi n completion
+ * @csid_udin_reset_complete: udi n completion
+ * @csid_debug:               csid debug information to enable the SOT, EOT,
+ *                            SOF, EOF, measure etc in the csid hw
+ * @clk_rate                  Current clock rate
+ * @sof_irq_triggered:        Flag is set on receiving event to enable sof irq
+ *                            incase of SOF freeze.
+ * @is_resetting:             informs whether reset is started or not.
+ * @irq_debug_cnt:            Counter to track sof irq's when above flag is set.
+ * @error_irq_count           Error IRQ count, if continuous error irq comes
+ *                            need to stop the CSID and mask interrupts.
+ * @binning_enable            Flag is set if hardware supports QCFA binning
+ * @binning_supported         Flag is set if sensor supports QCFA binning
+ * @first_sof_ts              first bootime stamp at the start
+ * @prev_qtimer_ts            stores csid timestamp
+ * @epd_supported             Flag is set if sensor supports EPD
+ * @fatal_err_detected        flag to indicate fatal errror is reported
+ * @event_cb                  Callback to hw manager if CSID event reported
+ */
+struct cam_ife_csid_hw {
+	struct cam_hw_intf              *hw_intf;
+	struct cam_hw_info              *hw_info;
+	struct cam_ife_csid_hw_info     *csid_info;
+	void                            *tasklet;
+	void                            *priv;
+	struct list_head                 free_payload_list;
+	struct cam_csid_evt_payload      evt_payload[CAM_CSID_EVT_PAYLOAD_MAX];
+	uint32_t                         res_type;
+	struct cam_ife_csid_csi2_rx_cfg  csi2_rx_cfg;
+	struct cam_ife_csid_tpg_cfg      tpg_cfg;
+	uint32_t                         csi2_reserve_cnt;
+	uint32_t                         csi2_cfg_cnt;
+	uint32_t                         tpg_start_cnt;
+	struct cam_isp_resource_node     ipp_res;
+	struct cam_isp_resource_node     ppp_res;
+	struct cam_isp_resource_node     rdi_res[CAM_IFE_CSID_RDI_MAX];
+	struct cam_isp_resource_node     udi_res[CAM_IFE_CSID_UDI_MAX];
+	struct cam_isp_resource_node     cid_res[CAM_IFE_CSID_CID_MAX];
+	struct completion                csid_top_complete;
+	struct completion                csid_csi2_complete;
+	struct completion                csid_ipp_complete;
+	struct completion                csid_ppp_complete;
+	struct completion    csid_rdin_complete[CAM_IFE_CSID_RDI_MAX];
+	struct completion    csid_udin_complete[CAM_IFE_CSID_UDI_MAX];
+	uint64_t                         csid_debug;
+	uint64_t                         clk_rate;
+	struct cam_isp_sensor_dimension  ipp_path_config;
+	struct cam_isp_sensor_dimension  ppp_path_config;
+	struct cam_isp_sensor_dimension  rdi_path_config[CAM_IFE_CSID_RDI_MAX];
+	uint32_t                         hbi;
+	uint32_t                         vbi;
+	bool                             sof_irq_triggered;
+	bool                             is_resetting;
+	uint32_t                         irq_debug_cnt;
+	uint32_t                         error_irq_count;
+	uint32_t                         device_enabled;
+	spinlock_t                       lock_state;
+	uint32_t                         binning_enable;
+	uint32_t                         binning_supported;
+	uint64_t                         prev_boot_timestamp;
+	uint64_t                         prev_qtimer_ts;
+	uint32_t                         epd_supported;
+	bool                             fatal_err_detected;
+	cam_hw_mgr_event_cb_func         event_cb;
+};
+
+int cam_ife_csid_hw_probe_init(struct cam_hw_intf  *csid_hw_intf,
+	uint32_t csid_idx, bool is_custom);
+
+int cam_ife_csid_hw_deinit(struct cam_ife_csid_hw *ife_csid_hw);
+
+int cam_ife_csid_cid_reserve(struct cam_ife_csid_hw *csid_hw,
+	struct cam_csid_hw_reserve_resource_args  *cid_reserv);
+
+int cam_ife_csid_path_reserve(struct cam_ife_csid_hw *csid_hw,
+	struct cam_csid_hw_reserve_resource_args  *reserve);
+
+#endif /* _CAM_IFE_CSID_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.c
@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include "cam_ife_csid_core.h"
+#include "cam_ife_csid_dev.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_hw_intf *cam_ife_csid_hw_list[CAM_IFE_CSID_HW_NUM_MAX] = {
+	0, 0, 0, 0};
+
+static char csid_dev_name[8];
+
+static int cam_ife_csid_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf             *csid_hw_intf;
+	struct cam_hw_info             *csid_hw_info;
+	struct cam_ife_csid_hw         *csid_dev = NULL;
+	const struct of_device_id      *match_dev = NULL;
+	struct cam_ife_csid_hw_info    *csid_hw_data = NULL;
+	uint32_t                        csid_dev_idx;
+	int                             rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ISP, "Binding IFE CSID component");
+
+	csid_hw_intf = kzalloc(sizeof(*csid_hw_intf), GFP_KERNEL);
+	if (!csid_hw_intf) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	csid_hw_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!csid_hw_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	csid_dev = kzalloc(sizeof(struct cam_ife_csid_hw), GFP_KERNEL);
+	if (!csid_dev) {
+		rc = -ENOMEM;
+		goto free_hw_info;
+	}
+
+	/* get ife csid hw index */
+	of_property_read_u32(pdev->dev.of_node, "cell-index", &csid_dev_idx);
+	/* get ife csid hw information */
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "No matching table for the IFE CSID HW!");
+		rc = -EINVAL;
+		goto free_dev;
+	}
+
+	memset(csid_dev_name, 0, sizeof(csid_dev_name));
+	snprintf(csid_dev_name, sizeof(csid_dev_name),
+		"csid%1u", csid_dev_idx);
+
+	csid_hw_intf->hw_idx = csid_dev_idx;
+	csid_hw_intf->hw_type = CAM_ISP_HW_TYPE_IFE_CSID;
+	csid_hw_intf->hw_priv = csid_hw_info;
+
+	csid_hw_info->core_info = csid_dev;
+	csid_hw_info->soc_info.pdev = pdev;
+	csid_hw_info->soc_info.dev = &pdev->dev;
+	csid_hw_info->soc_info.dev_name = csid_dev_name;
+	csid_hw_info->soc_info.index = csid_dev_idx;
+
+	csid_hw_data = (struct cam_ife_csid_hw_info  *)match_dev->data;
+	/* need to setup the pdev before call the ife hw probe init */
+	csid_dev->csid_info = csid_hw_data;
+
+	rc = cam_ife_csid_hw_probe_init(csid_hw_intf, csid_dev_idx, false);
+	if (rc) {
+		if (rc == -ENODEV)
+			rc = 0;
+		goto free_dev;
+	}
+
+	platform_set_drvdata(pdev, csid_dev);
+	CAM_DBG(CAM_ISP, "CSID:%d component bound successfully",
+		csid_hw_intf->hw_idx);
+
+
+	if (csid_hw_intf->hw_idx < CAM_IFE_CSID_HW_NUM_MAX)
+		cam_ife_csid_hw_list[csid_hw_intf->hw_idx] = csid_hw_intf;
+	else
+		goto free_dev;
+
+	return 0;
+
+free_dev:
+	kfree(csid_dev);
+free_hw_info:
+	kfree(csid_hw_info);
+free_hw_intf:
+	kfree(csid_hw_intf);
+err:
+	return rc;
+}
+
+static void cam_ife_csid_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_ife_csid_hw         *csid_dev = NULL;
+	struct cam_hw_intf             *csid_hw_intf;
+	struct cam_hw_info             *csid_hw_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	csid_dev = (struct cam_ife_csid_hw *)platform_get_drvdata(pdev);
+	csid_hw_intf = csid_dev->hw_intf;
+	csid_hw_info = csid_dev->hw_info;
+
+	CAM_DBG(CAM_ISP, "CSID:%d component unbind",
+		csid_dev->hw_intf->hw_idx);
+
+	cam_ife_csid_hw_deinit(csid_dev);
+
+	/*release the csid device memory */
+	kfree(csid_dev);
+	kfree(csid_hw_info);
+	kfree(csid_hw_intf);
+}
+
+const static struct component_ops cam_ife_csid_component_ops = {
+	.bind = cam_ife_csid_component_bind,
+	.unbind = cam_ife_csid_component_unbind,
+};
+
+int cam_ife_csid_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Adding IFE CSID component");
+	rc = component_add(&pdev->dev, &cam_ife_csid_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_ife_csid_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ife_csid_component_ops);
+	return 0;
+}
+
+int cam_ife_csid_hw_init(struct cam_hw_intf **ife_csid_hw,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_ife_csid_hw_list[hw_idx]) {
+		*ife_csid_hw = cam_ife_csid_hw_list[hw_idx];
+	} else {
+		*ife_csid_hw = NULL;
+		rc = -1;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_DEV_H_
+#define _CAM_IFE_CSID_DEV_H_
+
+#include "cam_isp_hw.h"
+
+int cam_ife_csid_probe(struct platform_device *pdev);
+int cam_ife_csid_remove(struct platform_device *pdev);
+
+/**
+ * @brief : API to register CSID hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_ife_csid17x_init_module(void);
+
+/**
+ * @brief : API to register CSID Lite hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_ife_csid_lite_init_module(void);
+
+/**
+ * @brief : API to remove CSID Hw from platform framework.
+ */
+void cam_ife_csid17x_exit_module(void);
+
+/**
+ * @brief : API to remove CSID Lite Hw from platform framework.
+ */
+void cam_ife_csid_lite_exit_module(void);
+
+#endif /*_CAM_IFE_CSID_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite17x.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite17x.c
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_ife_csid_lite17x.h"
+#include "cam_ife_csid_lite480.h"
+#include "cam_ife_csid_core.h"
+#include "cam_ife_csid_dev.h"
+#include "camera_main.h"
+
+#define CAM_CSID_LITE_DRV_NAME                    "csid_lite"
+
+static struct cam_ife_csid_hw_info cam_ife_csid_lite_17x_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_17x_reg_offset,
+};
+
+static struct cam_ife_csid_hw_info cam_ife_csid_lite_480_hw_info = {
+	.csid_reg = &cam_ife_csid_lite_480_reg_offset,
+};
+
+static const struct of_device_id cam_ife_csid_lite_dt_match[] = {
+	{
+		.compatible = "qcom,csid-lite170",
+		.data = &cam_ife_csid_lite_17x_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite175",
+		.data = &cam_ife_csid_lite_17x_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite480",
+		.data = &cam_ife_csid_lite_480_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite580",
+		.data = &cam_ife_csid_lite_480_hw_info,
+	},
+	{
+		.compatible = "qcom,csid-lite165",
+		.data = &cam_ife_csid_lite_17x_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_ife_csid_lite_dt_match);
+
+struct platform_driver cam_ife_csid_lite_driver = {
+	.probe = cam_ife_csid_probe,
+	.remove = cam_ife_csid_remove,
+	.driver = {
+		.name = CAM_CSID_LITE_DRV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ife_csid_lite_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ife_csid_lite_init_module(void)
+{
+	return platform_driver_register(&cam_ife_csid_lite_driver);
+}
+
+void cam_ife_csid_lite_exit_module(void)
+{
+	platform_driver_unregister(&cam_ife_csid_lite_driver);
+}
+
+MODULE_DESCRIPTION("CAM IFE_CSID_LITE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite17x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite17x.h
@@ -0,0 +1,316 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE17X_H_
+#define _CAM_IFE_CSID_LITE17X_H_
+#include "cam_ife_csid_core.h"
+
+static const struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_lite_17x_rdi_0_reg_offset = {
+
+	.csid_rdi_irq_status_addr                 = 0x30,
+	.csid_rdi_irq_mask_addr                   = 0x34,
+	.csid_rdi_irq_clear_addr                  = 0x38,
+	.csid_rdi_irq_set_addr                    = 0x3c,
+	.csid_rdi_cfg0_addr                       = 0x200,
+	.csid_rdi_cfg1_addr                       = 0x204,
+	.csid_rdi_ctrl_addr                       = 0x208,
+	.csid_rdi_frm_drop_pattern_addr           = 0x20c,
+	.csid_rdi_frm_drop_period_addr            = 0x210,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x214,
+	.csid_rdi_irq_subsample_period_addr       = 0x218,
+	.csid_rdi_rpp_hcrop_addr                  = 0x21c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x220,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x224,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x228,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x22c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x230,
+	.csid_rdi_rst_strobes_addr                = 0x240,
+	.csid_rdi_status_addr                     = 0x250,
+	.csid_rdi_misr_val0_addr                  = 0x254,
+	.csid_rdi_misr_val1_addr                  = 0x258,
+	.csid_rdi_misr_val2_addr                  = 0x25c,
+	.csid_rdi_misr_val3_addr                  = 0x260,
+	.csid_rdi_format_measure_cfg0_addr        = 0x270,
+	.csid_rdi_format_measure_cfg1_addr        = 0x274,
+	.csid_rdi_format_measure0_addr            = 0x278,
+	.csid_rdi_format_measure1_addr            = 0x27c,
+	.csid_rdi_format_measure2_addr            = 0x280,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x290,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x294,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x298,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x29c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x2a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x2a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x2a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x2ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x2e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x2e4,
+};
+
+static const struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_lite_17x_rdi_1_reg_offset = {
+
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_frm_drop_pattern_addr           = 0x30c,
+	.csid_rdi_frm_drop_period_addr            = 0x310,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x314,
+	.csid_rdi_irq_subsample_period_addr       = 0x318,
+	.csid_rdi_rpp_hcrop_addr                  = 0x31c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x320,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x324,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x328,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x32c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x330,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_misr_val2_addr                  = 0x35c,
+	.csid_rdi_misr_val3_addr                  = 0x360,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+};
+
+static const struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_lite_17x_rdi_2_reg_offset = {
+
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_frm_drop_pattern_addr           = 0x40c,
+	.csid_rdi_frm_drop_period_addr            = 0x410,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x414,
+	.csid_rdi_irq_subsample_period_addr       = 0x418,
+	.csid_rdi_rpp_hcrop_addr                  = 0x41c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x420,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x424,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x428,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x42c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x430,
+	.csid_rdi_yuv_chroma_conversion_addr      = 0x434,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_misr_val2_addr                  = 0x45c,
+	.csid_rdi_misr_val3_addr                  = 0x460,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+};
+
+static const struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_lite_17x_rdi_3_reg_offset = {
+
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_frm_drop_pattern_addr           = 0x50c,
+	.csid_rdi_frm_drop_period_addr            = 0x510,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x514,
+	.csid_rdi_irq_subsample_period_addr       = 0x518,
+	.csid_rdi_rpp_hcrop_addr                  = 0x51c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x520,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x524,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x528,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x52c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x530,
+	.csid_rdi_yuv_chroma_conversion_addr      = 0x534,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_misr_val2_addr                  = 0x55c,
+	.csid_rdi_misr_val3_addr                  = 0x560,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+};
+
+static const struct cam_ife_csid_csi2_rx_reg_offset
+	cam_ife_csid_lite_17x_csi2_reg_offset = {
+
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_de_scramble_cfg0_addr           = 0x114,
+	.csid_csi2_rx_de_scramble_cfg1_addr           = 0x118,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_lane0_misr_addr                 = 0x150,
+	.csid_csi2_rx_lane1_misr_addr                 = 0x154,
+	.csid_csi2_rx_lane2_misr_addr                 = 0x158,
+	.csid_csi2_rx_lane3_misr_addr                 = 0x15c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 15,
+	.csi2_capture_cphy_pkt_dt_shift               = 20,
+	.csi2_capture_cphy_pkt_vc_shift               = 26,
+	.csi2_rx_phy_num_mask                         = 0x3,
+};
+
+
+static const struct cam_ife_csid_csi2_tpg_reg_offset
+	cam_ife_csid_lite_17x_tpg_reg_offset = {
+
+	/*CSID TPG control */
+	.csid_tpg_ctrl_addr                           = 0x600,
+	.csid_tpg_vc_cfg0_addr                        = 0x604,
+	.csid_tpg_vc_cfg1_addr                        = 0x608,
+	.csid_tpg_lfsr_seed_addr                      = 0x60c,
+	.csid_tpg_dt_n_cfg_0_addr                     = 0x610,
+	.csid_tpg_dt_n_cfg_1_addr                     = 0x614,
+	.csid_tpg_dt_n_cfg_2_addr                     = 0x618,
+	.csid_tpg_color_bars_cfg_addr                 = 0x640,
+	.csid_tpg_color_box_cfg_addr                  = 0x644,
+	.csid_tpg_common_gen_cfg_addr                 = 0x648,
+	.csid_tpg_cgen_n_cfg_addr                     = 0x650,
+	.csid_tpg_cgen_n_x0_addr                      = 0x654,
+	.csid_tpg_cgen_n_x1_addr                      = 0x658,
+	.csid_tpg_cgen_n_x2_addr                      = 0x65c,
+	.csid_tpg_cgen_n_xy_addr                      = 0x660,
+	.csid_tpg_cgen_n_y1_addr                      = 0x664,
+	.csid_tpg_cgen_n_y2_addr                      = 0x668,
+
+	/*configurations */
+	.tpg_dtn_cfg_offset                           = 0xc,
+	.tpg_cgen_cfg_offset                          = 0x20,
+	.tpg_cpas_ife_reg_offset                      = 0x28,
+};
+
+
+static const struct cam_ife_csid_common_reg_offset
+	cam_csid_lite_17x_cmn_reg_offset = {
+
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_reset_addr                              = 0xc,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 1,
+	.minor_version                                = 7,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 4,
+	.num_pix                                      = 0,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.path_rst_stb_all                             = 0x7f,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.packing_fmt_shift_val                        = 30,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x7FFF,
+	.rdi_irq_mask_all                             = 0x7FFF,
+	.ppp_irq_mask_all                             = 0xFFFF,
+};
+
+static const struct cam_ife_csid_reg_offset cam_ife_csid_lite_17x_reg_offset = {
+	.cmn_reg          = &cam_csid_lite_17x_cmn_reg_offset,
+	.csi2_reg         = &cam_ife_csid_lite_17x_csi2_reg_offset,
+	.ipp_reg          = NULL,
+	.rdi_reg = {
+		&cam_ife_csid_lite_17x_rdi_0_reg_offset,
+		&cam_ife_csid_lite_17x_rdi_1_reg_offset,
+		&cam_ife_csid_lite_17x_rdi_2_reg_offset,
+		&cam_ife_csid_lite_17x_rdi_3_reg_offset,
+		},
+	.tpg_reg = &cam_ife_csid_lite_17x_tpg_reg_offset,
+};
+
+#endif /*_CAM_IFE_CSID_LITE17X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite480.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_lite480.h
@@ -0,0 +1,340 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_LITE_480_H_
+#define _CAM_IFE_CSID_LITE_480_H_
+
+#include "cam_ife_csid_core.h"
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_lite_480_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x30,
+	.csid_rdi_irq_mask_addr                   = 0x34,
+	.csid_rdi_irq_clear_addr                  = 0x38,
+	.csid_rdi_irq_set_addr                    = 0x3c,
+	.csid_rdi_cfg0_addr                       = 0x200,
+	.csid_rdi_cfg1_addr                       = 0x204,
+	.csid_rdi_ctrl_addr                       = 0x208,
+	.csid_rdi_frm_drop_pattern_addr           = 0x20c,
+	.csid_rdi_frm_drop_period_addr            = 0x210,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x214,
+	.csid_rdi_irq_subsample_period_addr       = 0x218,
+	.csid_rdi_rpp_hcrop_addr                  = 0x21c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x220,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x224,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x228,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x22c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x230,
+	.csid_rdi_rst_strobes_addr                = 0x240,
+	.csid_rdi_status_addr                     = 0x250,
+	.csid_rdi_misr_val0_addr                  = 0x254,
+	.csid_rdi_misr_val1_addr                  = 0x258,
+	.csid_rdi_misr_val2_addr                  = 0x25c,
+	.csid_rdi_misr_val3_addr                  = 0x260,
+	.csid_rdi_format_measure_cfg0_addr        = 0x270,
+	.csid_rdi_format_measure_cfg1_addr        = 0x274,
+	.csid_rdi_format_measure0_addr            = 0x278,
+	.csid_rdi_format_measure1_addr            = 0x27c,
+	.csid_rdi_format_measure2_addr            = 0x280,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x290,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x294,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x298,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x29c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x2a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x2a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x2a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x2ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x2b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x2b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x2b8,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x2bc,
+	.csid_rdi_byte_cntr_ping_addr             = 0x2e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x2e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 1,
+};
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_lite_480_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_frm_drop_pattern_addr           = 0x30c,
+	.csid_rdi_frm_drop_period_addr            = 0x310,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x314,
+	.csid_rdi_irq_subsample_period_addr       = 0x318,
+	.csid_rdi_rpp_hcrop_addr                  = 0x31c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x320,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x324,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x328,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x32c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x330,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_misr_val2_addr                  = 0x35c,
+	.csid_rdi_misr_val3_addr                  = 0x360,
+	.csid_rdi_format_measure_cfg0_addr        = 0x370,
+	.csid_rdi_format_measure_cfg1_addr        = 0x374,
+	.csid_rdi_format_measure0_addr            = 0x378,
+	.csid_rdi_format_measure1_addr            = 0x37c,
+	.csid_rdi_format_measure2_addr            = 0x380,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x3b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x3b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x3b8,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x3bc,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 1,
+};
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_lite_480_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_frm_drop_pattern_addr           = 0x40c,
+	.csid_rdi_frm_drop_period_addr            = 0x410,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x414,
+	.csid_rdi_irq_subsample_period_addr       = 0x418,
+	.csid_rdi_rpp_hcrop_addr                  = 0x41c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x420,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x424,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x428,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x42c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x430,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_misr_val2_addr                  = 0x45c,
+	.csid_rdi_misr_val3_addr                  = 0x460,
+	.csid_rdi_format_measure_cfg0_addr        = 0x470,
+	.csid_rdi_format_measure_cfg1_addr        = 0x474,
+	.csid_rdi_format_measure0_addr            = 0x478,
+	.csid_rdi_format_measure1_addr            = 0x47c,
+	.csid_rdi_format_measure2_addr            = 0x480,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x4b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x4b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x4b8,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x4bc,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 1,
+};
+
+static struct cam_ife_csid_rdi_reg_offset
+	cam_ife_csid_lite_480_rdi_3_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_frm_drop_pattern_addr           = 0x50c,
+	.csid_rdi_frm_drop_period_addr            = 0x510,
+	.csid_rdi_irq_subsample_pattern_addr      = 0x514,
+	.csid_rdi_irq_subsample_period_addr       = 0x518,
+	.csid_rdi_rpp_hcrop_addr                  = 0x51c,
+	.csid_rdi_rpp_vcrop_addr                  = 0x520,
+	.csid_rdi_rpp_pix_drop_pattern_addr       = 0x524,
+	.csid_rdi_rpp_pix_drop_period_addr        = 0x528,
+	.csid_rdi_rpp_line_drop_pattern_addr      = 0x52c,
+	.csid_rdi_rpp_line_drop_period_addr       = 0x530,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_misr_val2_addr                  = 0x55c,
+	.csid_rdi_misr_val3_addr                  = 0x560,
+	.csid_rdi_format_measure_cfg0_addr        = 0x570,
+	.csid_rdi_format_measure_cfg1_addr        = 0x574,
+	.csid_rdi_format_measure0_addr            = 0x578,
+	.csid_rdi_format_measure1_addr            = 0x57c,
+	.csid_rdi_format_measure2_addr            = 0x580,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x5b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x5b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x5b8,
+	.csid_rdi_multi_vcdt_cfg0_addr            = 0x5bc,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+	/* configurations */
+	.ccif_violation_en                        = 1,
+	.overflow_ctrl_en                         = 1,
+};
+
+static struct cam_ife_csid_csi2_rx_reg_offset
+	cam_ife_csid_lite_480_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_de_scramble_cfg0_addr           = 0x114,
+	.csid_csi2_rx_de_scramble_cfg1_addr           = 0x118,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_lane0_misr_addr                 = 0x150,
+	.csid_csi2_rx_lane1_misr_addr                 = 0x154,
+	.csid_csi2_rx_lane2_misr_addr                 = 0x158,
+	.csid_csi2_rx_lane3_misr_addr                 = 0x15c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_vc_mode_shift_val                       = 2,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 15,
+	.csi2_capture_cphy_pkt_dt_shift               = 20,
+	.csi2_capture_cphy_pkt_vc_shift               = 26,
+	.csi2_rx_phy_num_mask                         = 0x7,
+};
+
+static struct cam_ife_csid_csi2_tpg_reg_offset
+	cam_ife_csid_lite_480_tpg_reg_offset = {
+	/*CSID TPG control */
+	.csid_tpg_ctrl_addr                           = 0x600,
+	.csid_tpg_vc_cfg0_addr                        = 0x604,
+	.csid_tpg_vc_cfg1_addr                        = 0x608,
+	.csid_tpg_lfsr_seed_addr                      = 0x60c,
+	.csid_tpg_dt_n_cfg_0_addr                     = 0x610,
+	.csid_tpg_dt_n_cfg_1_addr                     = 0x614,
+	.csid_tpg_dt_n_cfg_2_addr                     = 0x618,
+	.csid_tpg_color_bars_cfg_addr                 = 0x640,
+	.csid_tpg_color_box_cfg_addr                  = 0x644,
+	.csid_tpg_common_gen_cfg_addr                 = 0x648,
+	.csid_tpg_cgen_n_cfg_addr                     = 0x650,
+	.csid_tpg_cgen_n_x0_addr                      = 0x654,
+	.csid_tpg_cgen_n_x1_addr                      = 0x658,
+	.csid_tpg_cgen_n_x2_addr                      = 0x65c,
+	.csid_tpg_cgen_n_xy_addr                      = 0x660,
+	.csid_tpg_cgen_n_y1_addr                      = 0x664,
+	.csid_tpg_cgen_n_y2_addr                      = 0x668,
+
+	/* configurations */
+	.tpg_dtn_cfg_offset                           = 0xc,
+	.tpg_cgen_cfg_offset                          = 0x20,
+	.tpg_cpas_ife_reg_offset                      = 0x28,
+};
+
+static struct cam_ife_csid_common_reg_offset
+	cam_ife_csid_lite_480_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_reset_addr                              = 0xc,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 4,
+	.minor_version                                = 8,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 4,
+	.num_pix                                      = 0,
+	.num_ppp                                      = 0,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.path_rst_stb_all                             = 0x7f,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.packing_fmt_shift_val                        = 30,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.drop_v_en_shift_val                          = 4,
+	.drop_h_en_shift_val                          = 3,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x7FFF,
+	.rdi_irq_mask_all                             = 0x7FFF,
+	.ppp_irq_mask_all                             = 0xFFFF,
+	.measure_en_hbi_vbi_cnt_mask                  = 0xC,
+	.format_measure_en_val                        = 1,
+};
+
+static struct cam_ife_csid_reg_offset cam_ife_csid_lite_480_reg_offset = {
+	.cmn_reg          = &cam_ife_csid_lite_480_cmn_reg_offset,
+	.csi2_reg         = &cam_ife_csid_lite_480_csi2_reg_offset,
+	.ipp_reg          = NULL,
+	.ppp_reg          = NULL,
+	.rdi_reg = {
+		&cam_ife_csid_lite_480_rdi_0_reg_offset,
+		&cam_ife_csid_lite_480_rdi_1_reg_offset,
+		&cam_ife_csid_lite_480_rdi_2_reg_offset,
+		&cam_ife_csid_lite_480_rdi_3_reg_offset,
+		},
+	.tpg_reg = &cam_ife_csid_lite_480_tpg_reg_offset,
+};
+
+#endif /*_CAM_IFE_CSID_LITE480_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.c
@@ -0,0 +1,262 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+#include <linux/slab.h>
+#include "cam_ife_csid_soc.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+
+static int cam_ife_csid_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	struct device_node *of_node = NULL;
+	struct cam_csid_soc_private *soc_private = NULL;
+	int rc = 0;
+
+	of_node = soc_info->pdev->dev.of_node;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc)
+		return rc;
+
+	soc_private = (struct cam_csid_soc_private *)soc_info->soc_private;
+
+	rc = of_property_read_u32(of_node, "max-width",
+		&soc_private->max_width);
+	if (rc) {
+		CAM_DBG(CAM_ISP, "No max-width declared");
+		soc_private->max_width_enabled = false;
+		rc = 0;
+	} else {
+		soc_private->max_width_enabled = true;
+	}
+
+	soc_private->is_ife_csid_lite = false;
+	if (strnstr(soc_info->compatible, "lite",
+		strlen(soc_info->compatible)) != NULL) {
+		soc_private->is_ife_csid_lite = true;
+	}
+
+	return rc;
+}
+
+static int cam_ife_csid_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler,
+	void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, csid_irq_handler,
+		irq_data);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int cam_ife_csid_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler, void *irq_data, bool is_custom)
+{
+	int rc = 0;
+	struct cam_cpas_register_params   cpas_register_param;
+	struct cam_csid_soc_private      *soc_private;
+
+	soc_private = kzalloc(sizeof(struct cam_csid_soc_private), GFP_KERNEL);
+	if (!soc_private)
+		return -ENOMEM;
+
+	soc_info->soc_private = soc_private;
+
+	rc = cam_ife_csid_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	/* Need to see if we want post process the clock list */
+
+	rc = cam_ife_csid_request_platform_resource(soc_info, csid_irq_handler,
+		irq_data);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Error Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	if (is_custom)
+		strscpy(cpas_register_param.identifier, "csid-custom",
+			CAM_HW_IDENTIFIER_LENGTH);
+	else
+		strscpy(cpas_register_param.identifier, "csid",
+			CAM_HW_IDENTIFIER_LENGTH);
+
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	} else {
+		soc_private->cpas_handle = cpas_register_param.client_handle;
+	}
+
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_ife_csid_deinit_soc_resources(
+	struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPAS unregistration failed rc=%d", rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_WARN(CAM_ISP,
+			"soc release platform resource fail rc: %d", rc);
+
+	return rc;
+}
+
+int cam_ife_csid_enable_soc_resources(
+	struct cam_hw_soc_info *soc_info, enum cam_vote_level clk_level)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	CAM_DBG(CAM_ISP, "csid camnoc_bw:%lld mnoc_ab_bw:%lld mnoc_ib_bw:%lld ",
+		axi_vote.axi_path[0].camnoc_bw,
+		axi_vote.axi_path[0].mnoc_ab_bw,
+		axi_vote.axi_path[0].mnoc_ib_bw);
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS start failed");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "enable platform failed");
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_ife_csid_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Disable platform failed");
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_ife_csid_enable_ife_force_clock_on(struct cam_hw_soc_info  *soc_info,
+	uint32_t cpas_ife_base_offset)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+	uint32_t                           cpass_ife_force_clk_offset;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+
+	soc_private = soc_info->soc_private;
+	cpass_ife_force_clk_offset =
+		cpas_ife_base_offset + (0x4 * soc_info->index);
+	rc = cam_cpas_reg_write(soc_private->cpas_handle, CAM_CPAS_REG_CPASTOP,
+		cpass_ife_force_clk_offset, 1, 1);
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPASS set IFE:%d Force clock On failed",
+			soc_info->index);
+	else
+		CAM_DBG(CAM_ISP, "CPASS set IFE:%d Force clock On",
+		soc_info->index);
+
+	return rc;
+}
+
+int cam_ife_csid_disable_ife_force_clock_on(struct cam_hw_soc_info *soc_info,
+	uint32_t cpas_ife_base_offset)
+{
+	int rc = 0;
+	struct cam_csid_soc_private       *soc_private;
+	uint32_t                           cpass_ife_force_clk_offset;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+
+	soc_private = soc_info->soc_private;
+	cpass_ife_force_clk_offset =
+		cpas_ife_base_offset + (0x4 * soc_info->index);
+	rc = cam_cpas_reg_write(soc_private->cpas_handle, CAM_CPAS_REG_CPASTOP,
+		cpass_ife_force_clk_offset,  1, 0);
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPASS set IFE:%d Force clock Off failed",
+			soc_info->index);
+	else
+		CAM_DBG(CAM_ISP, "CPASS set IFE:%d Force clock off",
+		soc_info->index);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.h
@@ -0,0 +1,126 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IFE_CSID_SOC_H_
+#define _CAM_IFE_CSID_SOC_H_
+
+#include "cam_isp_hw.h"
+
+/*
+ * struct cam_csid_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to CSID HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ * @is_ife_csid_lite:        Flag to indicate Whether a full csid or a Lite csid
+ * @max_width_enabled:       Flag to enable max width restriction
+ * @max_width:               Maxinum allowed width
+ */
+struct cam_csid_soc_private {
+	uint32_t cpas_handle;
+	bool     is_ife_csid_lite;
+	bool     max_width_enabled;
+	uint32_t max_width;
+};
+
+/**
+ * struct csid_device_soc_info - CSID SOC info object
+ *
+ * @csi_vdd_voltage:       csi vdd voltage value
+ *
+ */
+struct csid_device_soc_info {
+	int                             csi_vdd_voltage;
+};
+
+/**
+ * cam_ife_csid_init_soc_resources()
+ *
+ * @brief:                 csid initialization function for the soc info
+ *
+ * @soc_info:              soc info structure pointer
+ * @csid_irq_handler:      irq handler function to be registered
+ * @irq_data:              irq data for the callback function
+ * @is_custom:             for custom csid hw
+ *
+ */
+int cam_ife_csid_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler, void *irq_data, bool is_custom);
+
+
+/**
+ * cam_ife_csid_deinit_soc_resources()
+ *
+ * @brief:                 csid de initialization function for the soc info
+ *
+ * @soc_info:              soc info structure pointer
+ *
+ */
+int cam_ife_csid_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_ife_csid_enable_soc_resources()
+ *
+ * @brief:                 csid soc resource enable function
+ *
+ * @soc_info:              soc info structure pointer
+ * @clk_lvl:               vote level to start with
+ *
+ */
+int cam_ife_csid_enable_soc_resources(struct cam_hw_soc_info  *soc_info,
+	enum cam_vote_level clk_lvl);
+
+/**
+ * cam_ife_csid_disable_soc_resources()
+ *
+ * @brief:                 csid soc resource disable function
+ *
+ * @soc_info:              soc info structure pointer
+ *
+ */
+int cam_ife_csid_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_ife_csid_enable_ife_force_clock()
+ *
+ * @brief:                 if csid testgen used for dual isp case, before
+ *                         starting csid test gen, enable ife force clock on
+ *                         through cpas
+ *
+ * @soc_info:              soc info structure pointer
+ * @cpas_ife_base_offset:  cpas ife force clock base reg offset value
+ *
+ */
+int cam_ife_csid_enable_ife_force_clock_on(struct cam_hw_soc_info  *soc_info,
+	uint32_t cpas_ife_base_offset);
+
+/**
+ * cam_ife_csid_disable_ife_force_clock_on()
+ *
+ * @brief:                 disable the IFE force clock on after dual ISP
+ *                         CSID test gen stop
+ *
+ * @soc_info:              soc info structure pointer
+ * @cpas_ife_base_offset:  cpas ife force clock base reg offset value
+ *
+ */
+int cam_ife_csid_disable_ife_force_clock_on(struct cam_hw_soc_info *soc_info,
+	uint32_t cpas_ife_base_offset);
+
+/**
+ * cam_ife_csid_get_vote_level()
+ *
+ * @brief:                 get the vote level from clock rate
+ *
+ * @soc_info:              soc info structure pointer
+ * @clock_rate             clock rate
+ *
+ */
+uint32_t cam_ife_csid_get_vote_level(struct cam_hw_soc_info *soc_info,
+	uint64_t clock_rate);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_ife_csid_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_ife_csid_hw_intf.h
@@ -0,0 +1,307 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSID_HW_INTF_H_
+#define _CAM_CSID_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_hw_intf.h"
+
+/* MAX IFE CSID instance */
+#define CAM_IFE_CSID_HW_NUM_MAX                        7
+#define CAM_IFE_CSID_RDI_MAX                           4
+#define CAM_IFE_CSID_UDI_MAX                           3
+
+/**
+ * enum cam_ife_pix_path_res_id - Specify the csid patch
+ */
+enum cam_ife_pix_path_res_id {
+	CAM_IFE_PIX_PATH_RES_RDI_0,
+	CAM_IFE_PIX_PATH_RES_RDI_1,
+	CAM_IFE_PIX_PATH_RES_RDI_2,
+	CAM_IFE_PIX_PATH_RES_RDI_3,
+	CAM_IFE_PIX_PATH_RES_IPP,
+	CAM_IFE_PIX_PATH_RES_PPP,
+	CAM_IFE_PIX_PATH_RES_UDI_0,
+	CAM_IFE_PIX_PATH_RES_UDI_1,
+	CAM_IFE_PIX_PATH_RES_UDI_2,
+	CAM_IFE_PIX_PATH_RES_MAX,
+};
+
+/**
+ * enum cam_ife_cid_res_id - Specify the csid cid
+ */
+enum cam_ife_cid_res_id {
+	CAM_IFE_CSID_CID_0,
+	CAM_IFE_CSID_CID_1,
+	CAM_IFE_CSID_CID_2,
+	CAM_IFE_CSID_CID_3,
+	CAM_IFE_CSID_CID_MAX,
+};
+
+/**
+ * struct cam_ife_csid_hw_caps- get the CSID hw capability
+ * @num_rdis:       number of rdis supported by CSID HW device
+ * @num_pix:        number of pxl paths supported by CSID HW device
+ * @num_ppp:        number of ppp paths supported by CSID HW device
+ * @major_version : major version
+ * @minor_version:  minor version
+ * @version_incr:   version increment
+ * @is_lite:        is the ife_csid lite
+ */
+struct cam_ife_csid_hw_caps {
+	uint32_t      num_rdis;
+	uint32_t      num_pix;
+	uint32_t      num_ppp;
+	uint32_t      major_version;
+	uint32_t      minor_version;
+	uint32_t      version_incr;
+	bool          is_lite;
+};
+
+struct cam_isp_out_port_generic_info {
+	uint32_t                res_type;
+	uint32_t                format;
+	uint32_t                width;
+	uint32_t                height;
+	uint32_t                comp_grp_id;
+	uint32_t                split_point;
+	uint32_t                secure_mode;
+	uint32_t                reserved;
+};
+
+struct cam_isp_in_port_generic_info {
+	uint32_t                        major_ver;
+	uint32_t                        minor_ver;
+	uint32_t                        res_type;
+	uint32_t                        lane_type;
+	uint32_t                        lane_num;
+	uint32_t                        lane_cfg;
+	uint32_t                        vc[CAM_ISP_VC_DT_CFG];
+	uint32_t                        dt[CAM_ISP_VC_DT_CFG];
+	uint32_t                        num_valid_vc_dt;
+	uint32_t                        format;
+	uint32_t                        test_pattern;
+	uint32_t                        usage_type;
+	uint32_t                        left_start;
+	uint32_t                        left_stop;
+	uint32_t                        left_width;
+	uint32_t                        right_start;
+	uint32_t                        right_stop;
+	uint32_t                        right_width;
+	uint32_t                        line_start;
+	uint32_t                        line_stop;
+	uint32_t                        height;
+	uint32_t                        pixel_clk;
+	uint32_t                        batch_size;
+	uint32_t                        dsp_mode;
+	uint32_t                        hbi_cnt;
+	uint32_t                        fe_unpacker_fmt;
+	uint32_t                        cust_node;
+	uint32_t                        num_out_res;
+	uint32_t                        horizontal_bin;
+	uint32_t                        qcfa_bin;
+	uint32_t                        num_bytes_out;
+	uint32_t                        ipp_count;
+	uint32_t                        ppp_count;
+	uint32_t                        rdi_count;
+	uint32_t                        udi_count;
+	uint32_t                        lcr_count;
+	uint32_t                        ife_rd_count;
+	struct cam_isp_out_port_generic_info    *data;
+};
+
+/**
+ * struct cam_csid_hw_reserve_resource- hw reserve
+ * @res_type :    Reource type CID or PATH
+ *                if type is CID, then res_id is not required,
+ *                if type is path then res id need to be filled
+ * @res_id  :     Resource id to be reserved
+ * @in_port :     Input port resource info
+ * @out_port:     Output port resource info, used for RDI path only
+ * @sync_mode:    Sync mode
+ *                Sync mode could be master, slave or none
+ * @master_idx:   Master device index to be configured in the slave path
+ *                for master path, this value is not required.
+ *                only slave need to configure the master index value
+ * @cid:          cid (DT_ID) value for path, this is applicable for CSID path
+ *                reserve
+ * @node_res :    Reserved resource structure pointer
+ * @crop_enable : Flag to indicate CSID crop enable
+ * @drop_enable : Flag to indicate CSID drop enable
+ * @priv:         private data to be sent in callback
+ * @event_cb:     CSID event callback to hw manager
+ * @phy_sel:      Phy selection number if tpg is enabled from userspace
+ * @can_use_lite: Flag to indicate if current call qualifies for acquire lite
+ *
+ */
+struct cam_csid_hw_reserve_resource_args {
+	enum cam_isp_resource_type                res_type;
+	uint32_t                                  res_id;
+	struct cam_isp_in_port_generic_info      *in_port;
+	struct cam_isp_out_port_generic_info     *out_port;
+	enum cam_isp_hw_sync_mode                 sync_mode;
+	uint32_t                                  master_idx;
+	uint32_t                                  cid;
+	struct cam_isp_resource_node             *node_res;
+	bool                                      crop_enable;
+	bool                                      drop_enable;
+	void                                     *priv;
+	cam_hw_mgr_event_cb_func                  event_cb;
+	uint32_t                                  phy_sel;
+	bool                                      can_use_lite;
+};
+
+/**
+ *  enum cam_ife_csid_halt_cmd - Specify the halt command type
+ */
+enum cam_ife_csid_halt_cmd {
+	CAM_CSID_HALT_AT_FRAME_BOUNDARY,
+	CAM_CSID_RESUME_AT_FRAME_BOUNDARY,
+	CAM_CSID_HALT_IMMEDIATELY,
+	CAM_CSID_HALT_MAX,
+};
+
+/**
+ *  enum cam_ife_csid_halt_mode - Specify the halt command type
+ */
+enum cam_ife_csid_halt_mode {
+	CAM_CSID_HALT_MODE_INTERNAL,
+	CAM_CSID_HALT_MODE_GLOBAL,
+	CAM_CSID_HALT_MODE_MASTER,
+	CAM_CSID_HALT_MODE_SLAVE,
+	CAM_CSID_HALT_MODE_MAX,
+};
+
+/**
+ * struct cam_ife_csid_hw_halt_args
+ * @halt_mode : Applicable only for PATH resources
+ *              0 Internal : The CSID responds to the HALT_CMD
+ *              1 Global   : The CSID responds to the GLOBAL_HALT_CMD
+ *              2 Master   : The CSID responds to the HALT_CMD
+ *              3 Slave    : The CSID responds to the external halt command
+ *                           and not the HALT_CMD register
+ * @node_res : reource pointer array( ie cid or CSID)
+ *
+ */
+struct cam_ife_csid_hw_halt_args {
+	enum cam_ife_csid_halt_mode     halt_mode;
+	struct cam_isp_resource_node   *node_res;
+};
+
+/**
+ * struct cam_csid_hw_stop- stop all resources
+ * @stop_cmd : Applicable only for PATH resources
+ *             if stop command set to Halt immediately,driver will stop
+ *             path immediately, manager need to reset the path after HI
+ *             if stop command set to halt at frame boundary, driver will set
+ *             halt at frame boundary and wait for frame boundary
+ * @node_res :  reource pointer array( ie cid or CSID)
+ * @num_res :   number of resources to be stopped
+ *
+ */
+struct cam_csid_hw_stop_args {
+	enum cam_ife_csid_halt_cmd                stop_cmd;
+	struct cam_isp_resource_node            **node_res;
+	uint32_t                                  num_res;
+};
+
+/**
+ * enum cam_ife_csid_reset_type - Specify the reset type
+ */
+enum cam_ife_csid_reset_type {
+	CAM_IFE_CSID_RESET_GLOBAL,
+	CAM_IFE_CSID_RESET_PATH,
+	CAM_IFE_CSID_RESET_MAX,
+};
+
+/**
+ * struct cam_ife_csid_reset_cfg-  csid reset configuration
+ * @ reset_type : Global reset or path reset
+ * @res_node :   resource need to be reset
+ *
+ */
+struct cam_csid_reset_cfg_args {
+	enum cam_ife_csid_reset_type   reset_type;
+	struct cam_isp_resource_node  *node_res;
+};
+
+/**
+ * struct cam_csid_get_time_stamp_args-  time stamp capture arguments
+ * @node_res         : resource to get the time stamp
+ * @time_stamp_val   : captured time stamp
+ * @boot_timestamp   : boot time stamp
+ */
+struct cam_csid_get_time_stamp_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           time_stamp_val;
+	uint64_t                           boot_timestamp;
+};
+
+/**
+ * enum cam_ife_csid_cmd_type - Specify the csid command
+ */
+enum cam_ife_csid_cmd_type {
+	CAM_IFE_CSID_CMD_GET_TIME_STAMP,
+	CAM_IFE_CSID_SET_CSID_DEBUG,
+	CAM_IFE_CSID_SOF_IRQ_DEBUG,
+	CAM_IFE_CSID_SET_CONFIG,
+	CAM_IFE_CSID_SET_SENSOR_DIMENSION_CFG,
+	CAM_IFE_CSID_LOG_ACQUIRE_DATA,
+	CAM_IFE_CSID_CMD_MAX,
+};
+
+/**
+ * cam_ife_csid_hw_init()
+ *
+ * @brief:               Initialize function for the CSID hardware
+ *
+ * @ife_csid_hw:         CSID hardware instance returned
+ * @hw_idex:             CSID hardware instance id
+ */
+int cam_ife_csid_hw_init(struct cam_hw_intf **ife_csid_hw,
+	uint32_t hw_idx);
+
+/*
+ * struct cam_ife_csid_clock_update_args:
+ *
+ * @clk_rate:                Clock rate requested
+ */
+struct cam_ife_csid_clock_update_args {
+	uint64_t                           clk_rate;
+};
+
+/*
+ * struct cam_ife_csid_qcfa_update_args:
+ *
+ * @qcfa_binning:                QCFA binning supported
+ */
+struct cam_ife_csid_qcfa_update_args {
+	uint32_t                           qcfa_binning;
+};
+
+/*
+ * struct cam_ife_csid_epd_update_args:
+ *
+ * @epd_supported:                flag to check epd supported or not
+ */
+struct cam_ife_csid_epd_update_args {
+	uint32_t                           epd_supported;
+};
+
+/*
+ * struct cam_ife_sensor_dim_update_args:
+ *
+ * @ppp_path:             expected ppp path configuration
+ * @ipp_path:             expected ipp path configuration
+ * @rdi_path:             expected rdi path configuration
+ */
+struct cam_ife_sensor_dimension_update_args {
+	struct cam_isp_sensor_dimension  ppp_path;
+	struct cam_isp_sensor_dimension  ipp_path;
+	struct cam_isp_sensor_dimension  rdi_path[CAM_IFE_CSID_RDI_MAX];
+};
+
+#endif /* _CAM_CSID_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
@@ -0,0 +1,402 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_ISP_HW_H_
+#define _CAM_ISP_HW_H_
+
+#include <linux/completion.h>
+#include <media/cam_isp.h>
+#include "cam_hw.h"
+#include "cam_soc_util.h"
+#include "cam_irq_controller.h"
+#include "cam_hw_intf.h"
+#include "cam_cdm_intf_api.h"
+
+/* Maximum length of tag while dumping */
+#define CAM_ISP_HW_DUMP_TAG_MAX_LEN 32
+/* Max isp hw pid values number */
+#define CAM_ISP_HW_MAX_PID_VAL      4
+/*
+ * struct cam_isp_timestamp:
+ *
+ * @mono_time:          Monotonic boot time
+ * @vt_time:            AV Timer time
+ * @ticks:              Qtimer ticks
+ */
+struct cam_isp_timestamp {
+	struct timespec64       mono_time;
+	struct timespec64       vt_time;
+	uint64_t                ticks;
+};
+
+/*
+ * cam_isp_hw_get_timestamp()
+ *
+ * @Brief:              Get timestamp values
+ *
+ * @time_stamp:         Structure that holds different time values
+ *
+ * @Return:             Void
+ */
+void cam_isp_hw_get_timestamp(struct cam_isp_timestamp *time_stamp);
+
+enum cam_isp_hw_type {
+	CAM_ISP_HW_TYPE_CSID,
+	CAM_ISP_HW_TYPE_ISPIF,
+	CAM_ISP_HW_TYPE_VFE,
+	CAM_ISP_HW_TYPE_IFE_CSID,
+	CAM_ISP_HW_TYPE_TFE,
+	CAM_ISP_HW_TYPE_TFE_CSID,
+	CAM_ISP_HW_TYPE_TPG,
+	CAM_ISP_HW_TYPE_SFE,
+	CAM_ISP_HW_TYPE_MAX,
+};
+
+enum cam_isp_hw_split_id {
+	CAM_ISP_HW_SPLIT_LEFT       = 0,
+	CAM_ISP_HW_SPLIT_RIGHT,
+	CAM_ISP_HW_SPLIT_MAX,
+};
+
+enum cam_isp_hw_sync_mode {
+	CAM_ISP_HW_SYNC_NONE,
+	CAM_ISP_HW_SYNC_MASTER,
+	CAM_ISP_HW_SYNC_SLAVE,
+	CAM_ISP_HW_SYNC_MAX,
+};
+
+enum cam_isp_resource_state {
+	CAM_ISP_RESOURCE_STATE_UNAVAILABLE   = 0,
+	CAM_ISP_RESOURCE_STATE_AVAILABLE     = 1,
+	CAM_ISP_RESOURCE_STATE_RESERVED      = 2,
+	CAM_ISP_RESOURCE_STATE_INIT_HW       = 3,
+	CAM_ISP_RESOURCE_STATE_STREAMING     = 4,
+};
+
+enum cam_isp_resource_type {
+	CAM_ISP_RESOURCE_UNINT,
+	CAM_ISP_RESOURCE_SRC,
+	CAM_ISP_RESOURCE_CID,
+	CAM_ISP_RESOURCE_PIX_PATH,
+	CAM_ISP_RESOURCE_VFE_IN,
+	CAM_ISP_RESOURCE_VFE_BUS_RD,
+	CAM_ISP_RESOURCE_VFE_OUT,
+	CAM_ISP_RESOURCE_TPG,
+	CAM_ISP_RESOURCE_TFE_IN,
+	CAM_ISP_RESOURCE_TFE_OUT,
+	CAM_ISP_RESOURCE_SFE_IN,
+	CAM_ISP_RESOURCE_SFE_RD,
+	CAM_ISP_RESOURCE_SFE_OUT,
+	CAM_ISP_RESOURCE_MAX,
+};
+
+enum cam_isp_hw_cmd_type {
+	CAM_ISP_HW_CMD_GET_CHANGE_BASE,
+	CAM_ISP_HW_CMD_GET_BUF_UPDATE,
+	CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM,
+	CAM_ISP_HW_CMD_GET_REG_UPDATE,
+	CAM_ISP_HW_CMD_GET_HFR_UPDATE,
+	CAM_ISP_HW_CMD_GET_HFR_UPDATE_RM,
+	CAM_ISP_HW_CMD_GET_SECURE_MODE,
+	CAM_ISP_HW_CMD_STRIPE_UPDATE,
+	CAM_ISP_HW_CMD_CLOCK_UPDATE,
+	CAM_ISP_HW_CMD_BW_UPDATE,
+	CAM_ISP_HW_CMD_BW_UPDATE_V2,
+	CAM_ISP_HW_CMD_BW_CONTROL,
+	CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ,
+	CAM_ISP_HW_CMD_GET_REG_DUMP,
+	CAM_ISP_HW_CMD_UBWC_UPDATE,
+	CAM_ISP_HW_CMD_DUMP_BUS_INFO,
+	CAM_ISP_HW_CMD_SOF_IRQ_DEBUG,
+	CAM_ISP_HW_CMD_SET_CAMIF_DEBUG,
+	CAM_ISP_HW_CMD_CAMIF_DATA,
+	CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE,
+	CAM_ISP_HW_CMD_FE_UPDATE_IN_RD,
+	CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD,
+	CAM_ISP_HW_CMD_UBWC_UPDATE_V2,
+	CAM_ISP_HW_CMD_CORE_CONFIG,
+	CAM_ISP_HW_CMD_WM_CONFIG_UPDATE,
+	CAM_ISP_HW_CMD_CSID_QCFA_SUPPORTED,
+	CAM_ISP_HW_CMD_ADD_WAIT,
+	CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER,
+	CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA,
+	CAM_ISP_HW_CMD_TPG_PHY_CLOCK_UPDATE,
+	CAM_ISP_HW_CMD_GET_IRQ_REGISTER_DUMP,
+	CAM_ISP_HW_CMD_DUMP_HW,
+	CAM_ISP_HW_CMD_FE_TRIGGER_CMD,
+	CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ,
+	CAM_ISP_HW_CMD_IS_CONSUMED_ADDR_SUPPORT,
+	CAM_ISP_HW_CMD_GET_RES_FOR_MID,
+	CAM_ISP_HW_CMD_BLANKING_UPDATE,
+	CAM_ISP_HW_CMD_CSID_CLOCK_DUMP,
+	CAM_ISP_HW_CMD_TPG_CORE_CFG_CMD,
+	CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE,
+	CAM_ISP_HW_CMD_SET_SFE_DEBUG_CFG,
+	CAM_ISP_HW_CMD_QUERY_BUS_CAP,
+	CAM_ISP_HW_CMD_GET_CLOCK_RATE,
+	CAM_ISP_HW_CMD_DYNAMIC_CLOCK_UPDATE,
+	CAM_ISP_HW_DUMP_HW_SRC_CLK_RATE,
+	CAM_ISP_HW_CMD_TPG_SET_PATTERN,
+	CAM_ISP_HW_CMD_MAX,
+};
+
+/*
+ * struct cam_isp_resource_node:
+ *
+ * @Brief:                        Structure representing HW resource object
+ *
+ * @res_type:                     Resource Type
+ * @res_id:                       Unique resource ID within res_type objects
+ *                                for a particular HW
+ * @res_state:                    State of the resource
+ * @hw_intf:                      HW Interface of HW to which this resource
+ *                                belongs
+ * @res_priv:                     Private data of the resource
+ * @list:                         list_head node for this resource
+ * @cdm_ops:                      CDM operation functions
+ * @tasklet_info:                 Tasklet structure that will be used to
+ *                                schedule IRQ events related to this resource
+ * @irq_handle:                   handle returned on subscribing for IRQ event
+ * @rdi_only_ctx:                 resource belong to rdi only context or not
+ * @init:                         function pointer to init the HW resource
+ * @deinit:                       function pointer to deinit the HW resource
+ * @start:                        function pointer to start the HW resource
+ * @stop:                         function pointer to stop the HW resource
+ * @process_cmd:                  function pointer for processing commands
+ *                                specific to the resource
+ * @top_half_handler:             Top Half handler function
+ * @bottom_half_handler:          Bottom Half handler function
+ */
+struct cam_isp_resource_node {
+	enum cam_isp_resource_type     res_type;
+	uint32_t                       res_id;
+	enum cam_isp_resource_state    res_state;
+	struct cam_hw_intf            *hw_intf;
+	void                          *res_priv;
+	struct list_head               list;
+	void                          *cdm_ops;
+	void                          *tasklet_info;
+	int                            irq_handle;
+	int                            rdi_only_ctx;
+
+	int (*init)(struct cam_isp_resource_node *rsrc_node,
+		void *init_args, uint32_t arg_size);
+	int (*deinit)(struct cam_isp_resource_node *rsrc_node,
+		void *deinit_args, uint32_t arg_size);
+	int (*start)(struct cam_isp_resource_node *rsrc_node);
+	int (*stop)(struct cam_isp_resource_node *rsrc_node);
+	int (*process_cmd)(struct cam_isp_resource_node *rsrc_node,
+		uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+	CAM_IRQ_HANDLER_TOP_HALF       top_half_handler;
+	CAM_IRQ_HANDLER_BOTTOM_HALF    bottom_half_handler;
+};
+
+/*
+ * struct cam_isp_blanking_config:
+ *
+ * @Brief:          Structure to pass blanking details
+ * @hbi:            HBI Value
+ * @vbi:            VBI Value
+ * node_res:        Pointer to Resource Node object
+ */
+struct cam_isp_blanking_config {
+	uint32_t                           hbi;
+	uint32_t                           vbi;
+	struct cam_isp_resource_node       *node_res;
+};
+
+/*
+ * struct cam_isp_hw_event_info:
+ *
+ * @Brief:          Structure to pass event details to hw mgr
+ *
+ * @res_type:       Type of IFE resource
+ * @res_id:         Unique resource ID
+ * @hw_idx:         IFE hw index
+ * @err_type:       Error type if any
+ * @reg_val:        Any critical register value captured during irq handling
+ * @evt_param       Specific info about frame
+ */
+struct cam_isp_hw_event_info {
+	enum cam_isp_resource_type     res_type;
+	uint32_t                       res_id;
+	uint32_t                       hw_idx;
+	uint32_t                       err_type;
+	uint32_t                       reg_val;
+	uint32_t                       evt_param;
+};
+
+/*
+ * struct cam_isp_hw_cmd_buf_update:
+ *
+ * @Brief:           Contain the new created command buffer information
+ *
+ * @cmd_buf_addr:    Command buffer to store the change base command
+ * @size:            Size of the buffer in bytes
+ * @used_bytes:      Consumed bytes in the command buffer
+ *
+ */
+struct cam_isp_hw_cmd_buf_update {
+	uint32_t                       *cmd_buf_addr;
+	uint32_t                        size;
+	uint32_t                        used_bytes;
+};
+
+/*
+ * struct cam_isp_hw_get_wm_update:
+ *
+ * @Brief:             Get cmd buffer for WM updates.
+ *
+ * @ image_buf:        image buffer address array
+ * @ image_buf_offset: image buffer address offset array
+ * @ num_buf:          Number of buffers in the image_buf array
+ * @ frame_header:     frame header iova
+ * @ fh_enabled:       flag to indicate if this WM enables frame header
+ * @ local_id:         local id for the wm
+ * @ width:            width of scratch buffer
+ * @ height:           height of scratch buffer
+ * @ stride:           stride of scratch buffer
+ * @ slice_height:     slice height of scratch buffer
+ * @ io_cfg:           IO buffer config information sent from UMD
+ *
+ */
+struct cam_isp_hw_get_wm_update {
+	dma_addr_t                     *image_buf;
+	uint32_t                        image_buf_offset[CAM_PACKET_MAX_PLANES];
+	uint32_t                        num_buf;
+	uint64_t                        frame_header;
+	bool                            fh_enabled;
+	uint32_t                        local_id;
+	uint32_t                        width;
+	uint32_t                        height;
+	uint32_t                        stride;
+	uint32_t                        slice_height;
+	struct cam_buf_io_cfg          *io_cfg;
+};
+
+/*
+ * struct cam_isp_hw_get_res_for_mid:
+ *
+ * @Brief:           Get the out resource id for given mid
+ *
+ * @mid:             Mid number of hw outport numb
+ * @out_res_id:      Out resource id
+ *
+ */
+struct cam_isp_hw_get_res_for_mid {
+	uint32_t                       mid;
+	uint32_t                       out_res_id;
+};
+
+/*
+ * struct cam_isp_hw_get_cmd_update:
+ *
+ * @Brief:         Get cmd buffer update for different CMD types
+ *
+ * @res:             Resource node
+ * @cmd_type:        Command type for which to get update
+ * @cdm_id:          CDM id
+ * @cmd:             Command buffer information
+ * @use_scratch_cfg: To indicate if it's scratch buffer config
+ *
+ */
+struct cam_isp_hw_get_cmd_update {
+	struct cam_isp_resource_node     *res;
+	enum cam_isp_hw_cmd_type          cmd_type;
+	enum cam_cdm_id                   cdm_id;
+	struct cam_isp_hw_cmd_buf_update  cmd;
+	bool                              use_scratch_cfg;
+	union {
+		void                                 *data;
+		struct cam_isp_hw_get_wm_update      *wm_update;
+		struct cam_isp_hw_get_wm_update      *rm_update;
+	};
+	bool trigger_cdm_en;
+};
+
+/*
+ * struct cam_isp_hw_dual_isp_update_args:
+ *
+ * @Brief:        update the dual isp striping configuration.
+ *
+ * @ split_id:    spilt id to inform left or rifht
+ * @ res:         resource node
+ * @ dual_cfg:    dual isp configuration
+ *
+ */
+struct cam_isp_hw_dual_isp_update_args {
+	enum cam_isp_hw_split_id         split_id;
+	struct cam_isp_resource_node    *res;
+	struct cam_isp_dual_config      *dual_cfg;
+};
+
+/*
+ * struct cam_isp_hw_dump_args:
+ *
+ * @Brief:        isp hw dump args
+ *
+ * @ req_id:         request id
+ * @ cpu_addr:       cpu address
+ * @ buf_len:        buf len
+ * @ offset:         offset of buffer
+ * @ ctxt_to_hw_map: ctx to hw map
+ * @ is_dump_all:    flag to indicate if all information or just bw/clk rate
+ */
+struct cam_isp_hw_dump_args {
+	uint64_t                req_id;
+	uintptr_t               cpu_addr;
+	size_t                  buf_len;
+	size_t                  offset;
+	void                   *ctxt_to_hw_map;
+	bool                    is_dump_all;
+};
+
+/**
+ * struct cam_isp_hw_dump_header - ISP context dump header
+ *
+ * @Brief:        isp hw dump header
+ *
+ * @tag:       Tag name for the header
+ * @word_size: Size of word
+ * @size:      Size of data
+ *
+ */
+struct cam_isp_hw_dump_header {
+	uint8_t   tag[CAM_ISP_HW_DUMP_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * struct cam_isp_hw_intf_data - ISP hw intf data
+ *
+ * @Brief:        isp hw intf pointer and pid list data
+ *
+ * @isp_hw_intf:      Isp hw intf pointer
+ * @num_hw_pid:       Number of pids for this hw
+ * @isp_hw_pid:       Isp hw pid values
+ *
+ */
+struct cam_isp_hw_intf_data {
+	struct cam_hw_intf     *hw_intf;
+	uint32_t                num_hw_pid;
+	uint32_t                hw_pid[CAM_ISP_HW_MAX_PID_VAL];
+};
+/**
+ * struct cam_isp_hw_bus_cap:
+ *
+ * @Brief:         ISP hw bus capabilities
+ *
+ * @support_consumed_addr:   Indicate whether HW has last consumed addr reg
+ * @max_vfe_out_res_type:    Maximum value of out resource type supported by hw
+ *
+ */
+struct cam_isp_hw_bus_cap {
+	bool                    support_consumed_addr;
+	uint32_t                max_vfe_out_res_type;
+};
+
+#endif /* _CAM_ISP_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_sfe_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_sfe_hw_intf.h
@@ -0,0 +1,310 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_HW_INTF_H_
+#define _CAM_SFE_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+
+#define SFE_CORE_BASE_IDX           0
+#define SFE_RT_CDM_BASE_IDX         1
+#define CAM_SFE_HW_NUM_MAX          2
+
+enum cam_isp_hw_sfe_in {
+	CAM_ISP_HW_SFE_IN_PIX,
+	CAM_ISP_HW_SFE_IN_RD0,
+	CAM_ISP_HW_SFE_IN_RD1,
+	CAM_ISP_HW_SFE_IN_RD2,
+	CAM_ISP_HW_SFE_IN_RDI0,
+	CAM_ISP_HW_SFE_IN_RDI1,
+	CAM_ISP_HW_SFE_IN_RDI2,
+	CAM_ISP_HW_SFE_IN_RDI3,
+	CAM_ISP_HW_SFE_IN_RDI4,
+	CAM_ISP_HW_SFE_IN_MAX,
+};
+
+enum cam_sfe_hw_irq_status {
+	CAM_SFE_IRQ_STATUS_SUCCESS,
+	CAM_SFE_IRQ_STATUS_ERR,
+	CAM_SFE_IRQ_STATUS_OVERFLOW,
+	CAM_SFE_IRQ_STATUS_VIOLATION,
+	CAM_SFE_IRQ_STATUS_MAX,
+};
+
+enum cam_sfe_bw_control_action {
+	CAM_SFE_BW_CONTROL_EXCLUDE,
+	CAM_SFE_BW_CONTROL_INCLUDE,
+};
+
+enum cam_sfe_hw_irq_regs {
+	CAM_SFE_IRQ_TOP_REG_STATUS0,
+	CAM_SFE_IRQ_REGISTERS_MAX,
+};
+
+enum cam_sfe_bus_irq_regs {
+	CAM_SFE_IRQ_BUS_REG_STATUS0,
+	CAM_SFE_BUS_IRQ_REGISTERS_MAX,
+};
+
+enum cam_sfe_bus_rd_irq_regs {
+	CAM_SFE_IRQ_BUS_RD_REG_STATUS0,
+	CAM_SFE_BUS_RD_IRQ_REGISTERS_MAX,
+};
+
+/*
+ * struct cam_sfe_bw_control_args:
+ *
+ * @node_res:             Resource node info
+ * @action:               Bandwidth control action
+ */
+struct cam_sfe_bw_control_args {
+	struct cam_isp_resource_node      *node_res;
+	enum cam_sfe_bw_control_action     action;
+};
+
+/*
+ * struct cam_sfe_bw_update_args:
+ *
+ * @node_res:             Resource to get the BW
+ * @sfe_vote:             Vote info according to usage data (left/right/rdi)
+ */
+struct cam_sfe_bw_update_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_axi_vote                sfe_vote;
+};
+
+/*
+ * struct cam_sfe_fe_update_args:
+ *
+ * @node_res:             Resource to get fetch configuration
+ * @fe_config:            fetch engine configuration
+ *
+ */
+struct cam_sfe_fe_update_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_fe_config               fe_config;
+};
+
+/*
+ * struct cam_sfe_clock_update_args:
+ *
+ * @node_res:                ISP Resource
+ * @clk_rate:                Clock rate requested
+ */
+struct cam_sfe_clock_update_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           clk_rate;
+};
+
+/*
+ * struct cam_sfe_core_config_args:
+ *
+ * @node_res:                ISP Resource
+ * @core_config:             Core config for SFE
+ */
+struct cam_sfe_core_config_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_isp_sfe_core_config     core_config;
+};
+
+/*
+ * struct cam_sfe_top_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           related to SFE top resource
+ *
+ * @list:                    list_head node for the payload
+ * @core_index:              Index of SFE HW that generated this IRQ event
+ * @evt_id:                  IRQ event
+ * @irq_reg_val:             IRQ and Error register values, read when IRQ was
+ *                           handled
+ * @violation_status         ccif violation status
+ * @error_type:              Identify different errors
+ * @ts:                      Timestamp
+ */
+struct cam_sfe_top_irq_evt_payload {
+	struct list_head           list;
+	uint32_t                   core_index;
+	uint32_t                   evt_id;
+	uint32_t                   irq_reg_val[CAM_SFE_IRQ_REGISTERS_MAX];
+	uint32_t                   violation_status;
+	uint32_t                   error_type;
+	struct cam_isp_timestamp   ts;
+};
+
+/*
+ * struct cam_sfe_bus_wr_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           BUS related to SFE resources
+ *
+ * @list:                    list_head node for the payload
+ * @core_index:              Index of SFE HW that generated this IRQ event
+ * @irq_reg_val              Bus irq register status
+ * @ccif_violation_status    ccif violation status
+ * @overflow_status          bus overflow status
+ * @image_size_vio_sts       image size violations status
+ * @error_type:              Identify different errors
+ * @evt_id:                  IRQ event
+ * @ts:                      Timestamp
+ */
+struct cam_sfe_bus_wr_irq_evt_payload {
+	struct list_head           list;
+	uint32_t                   core_index;
+	uint32_t                   irq_reg_val[CAM_SFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t                   ccif_violation_status;
+	uint32_t                   overflow_status;
+	uint32_t                   image_size_violation_status;
+	uint32_t                   error_type;
+	uint32_t                   evt_id;
+	struct cam_isp_timestamp   ts;
+};
+
+/*
+ * struct cam_sfe_bus_rd_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           BUS related to SFE resources
+ *
+ * @list:                    list_head node for the payload
+ * @irq_reg_val              Bus irq register status
+ * @constraint_violation     constraint violation
+ * @error_type:              Identify different errors
+ * @evt_id:                  IRQ event
+ * @ts:                      Timestamp
+ */
+struct cam_sfe_bus_rd_irq_evt_payload {
+	struct list_head           list;
+	uint32_t                   irq_reg_val[
+		CAM_SFE_BUS_RD_IRQ_REGISTERS_MAX];
+	uint32_t                   constraint_violation;
+	uint32_t                   error_type;
+	uint32_t                   evt_id;
+	struct cam_isp_timestamp   ts;
+};
+
+/*
+ * struct cam_sfe_hw_get_hw_cap:
+ *
+ * @reserved_1: reserved
+ * @reserved_2: reserved
+ * @reserved_3: reserved
+ * @reserved_4: reserved
+ */
+struct cam_sfe_hw_get_hw_cap {
+	uint32_t reserved_1;
+	uint32_t reserved_2;
+	uint32_t reserved_3;
+	uint32_t reserved_4;
+};
+
+/*
+ * struct cam_sfe_hw_vfe_bus_rd_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Unique Identity of port to associate with this
+ *                           resource.
+ * @cdm_ops:                 CDM operations
+ * @unpacket_fmt:            Unpacker format for read engine
+ * @is_offline:              Flag to indicate offline usecase
+ * @secure_mode:             If fetch is from secure/non-secure buffer
+ */
+struct cam_sfe_hw_sfe_bus_rd_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	uint32_t                              res_id;
+	struct cam_cdm_utils_ops             *cdm_ops;
+	uint32_t                              unpacker_fmt;
+	bool                                  is_offline;
+	bool                                  secure_mode;
+};
+
+/*
+ * struct cam_sfe_hw_sfe_bus_in_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Unique Identity of port to associate with this
+ *                           resource.
+ * @cdm_ops:                 CDM operations
+ * @is_dual:                 Dual mode usecase
+ * @in_port:                 in port info
+ * @is_offline:              Flag to indicate Offline IFE
+ */
+struct cam_sfe_hw_sfe_in_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	uint32_t                              res_id;
+	struct cam_cdm_utils_ops             *cdm_ops;
+	uint32_t                              is_dual;
+	struct cam_isp_in_port_generic_info  *in_port;
+	bool                                  is_offline;
+};
+
+/*
+ * struct cam_sfe_hw_sfe_out_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @out_port_info:           Output Port details to acquire
+ * @unique_id:               Unique Identity of Context to associate with this
+ *                           resource. Used for composite grouping of multiple
+ *                           resources in the same context
+ * @is_dual:                 Dual SFE or not
+ * @split_id:                In case of Dual SFE, this is Left or Right.
+ * @is_master:               In case of Dual SFE, this is Master or Slave.
+ * @cdm_ops:                 CDM operations
+ */
+struct cam_sfe_hw_sfe_out_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	struct cam_isp_out_port_generic_info *out_port_info;
+	uint32_t                              unique_id;
+	uint32_t                              is_dual;
+	enum cam_isp_hw_split_id              split_id;
+	uint32_t                              is_master;
+	struct cam_cdm_utils_ops             *cdm_ops;
+};
+
+/*
+ * struct cam_sfe_acquire_args:
+ *
+ * @rsrc_type:               Type of Resource (OUT/IN) to acquire
+ * @tasklet:                 Tasklet to associate with this resource. This is
+ *                           used to schedule bottom of IRQ events associated
+ *                           with this resource.
+ * @priv:                    Context data
+ * @event_cb:                Callback function to hw mgr in case of hw events
+ * @buf_done_controller:     Buf done controller
+ * @sfe_out:                 Acquire args for SFE_OUT
+ * @sfe_bus_rd               Acquire args for SFE_BUS_READ
+ * @sfe_in:                  Acquire args for SFE_IN
+ */
+struct cam_sfe_acquire_args {
+	enum cam_isp_resource_type           rsrc_type;
+	void                                *tasklet;
+	void                                *priv;
+	cam_hw_mgr_event_cb_func             event_cb;
+	void                                *buf_done_controller;
+	union {
+		struct cam_sfe_hw_sfe_out_acquire_args     sfe_out;
+		struct cam_sfe_hw_sfe_in_acquire_args      sfe_in;
+		struct cam_sfe_hw_sfe_bus_rd_acquire_args  sfe_rd;
+	};
+};
+
+/*
+ * cam_sfe_hw_init()
+ *
+ * @Brief:                  Initialize SFE HW device
+ *
+ * @sfe_hw:                 sfe_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of SFE HW
+ */
+int cam_sfe_hw_init(struct cam_hw_intf **sfe_hw, uint32_t hw_idx);
+
+#endif /* _CAM_SFE_HW_INTF_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_tfe_csid_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_tfe_csid_hw_intf.h
@@ -0,0 +1,207 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_HW_INTF_H_
+#define _CAM_TFE_CSID_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_hw_intf.h"
+
+/* MAX TFE CSID instance */
+#define CAM_TFE_CSID_HW_NUM_MAX                        3
+#define CAM_TFE_CSID_RDI_MAX                           3
+
+/**
+ * enum cam_tfe_pix_path_res_id - Specify the csid patch
+ */
+enum cam_tfe_csid_path_res_id {
+	CAM_TFE_CSID_PATH_RES_RDI_0,
+	CAM_TFE_CSID_PATH_RES_RDI_1,
+	CAM_TFE_CSID_PATH_RES_RDI_2,
+	CAM_TFE_CSID_PATH_RES_IPP,
+	CAM_TFE_CSID_PATH_RES_MAX,
+};
+
+/**
+ * enum cam_tfe_csid_irq_reg
+ */
+enum cam_tfe_csid_irq_reg {
+	TFE_CSID_IRQ_REG_RDI0,
+	TFE_CSID_IRQ_REG_RDI1,
+	TFE_CSID_IRQ_REG_RDI2,
+	TFE_CSID_IRQ_REG_TOP,
+	TFE_CSID_IRQ_REG_RX,
+	TFE_CSID_IRQ_REG_IPP,
+	TFE_CSID_IRQ_REG_MAX,
+};
+
+
+/**
+ * struct cam_tfe_csid_hw_caps- get the CSID hw capability
+ * @num_rdis:       number of rdis supported by CSID HW device
+ * @num_pix:        number of pxl paths supported by CSID HW device
+ * @major_version : major version
+ * @minor_version:  minor version
+ * @version_incr:   version increment
+ *
+ */
+struct cam_tfe_csid_hw_caps {
+	uint32_t      num_rdis;
+	uint32_t      num_pix;
+	uint32_t      major_version;
+	uint32_t      minor_version;
+	uint32_t      version_incr;
+};
+
+/**
+ * struct cam_tfe_csid_hw_reserve_resource_args- hw reserve
+ * @res_type :    Reource type ie PATH
+ * @res_id  :     Resource id to be reserved
+ * @in_port :     Input port resource info
+ * @out_port:     Output port resource info, used for RDI path only
+ * @sync_mode:    Sync mode
+ *                Sync mode could be master, slave or none
+ * @master_idx:   Master device index to be configured in the slave path
+ *                for master path, this value is not required.
+ *                only slave need to configure the master index value
+ * @phy_sel:      Phy selection number if tpg is enabled from userspace
+ * @event_cb_prv: Context data
+ * @event_cb:     Callback function to hw mgr in case of hw events
+ * @node_res :    Reserved resource structure pointer
+ *
+ */
+struct cam_tfe_csid_hw_reserve_resource_args {
+	enum cam_isp_resource_type                res_type;
+	uint32_t                                  res_id;
+	struct cam_isp_tfe_in_port_info          *in_port;
+	struct cam_isp_tfe_out_port_info         *out_port;
+	enum cam_isp_hw_sync_mode                 sync_mode;
+	uint32_t                                  master_idx;
+	uint32_t                                  phy_sel;
+	void                                     *event_cb_prv;
+	cam_hw_mgr_event_cb_func                  event_cb;
+	struct cam_isp_resource_node             *node_res;
+};
+
+/**
+ *  enum cam_tfe_csid_halt_cmd - Specify the halt command type
+ */
+enum cam_tfe_csid_halt_cmd {
+	CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY,
+	CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY,
+	CAM_TFE_CSID_HALT_IMMEDIATELY,
+	CAM_TFE_CSID_HALT_MAX,
+};
+
+/**
+ * enum cam_tfe_csid_halt_mode - Specify the halt command type
+ */
+enum cam_tfe_csid_halt_mode {
+	CAM_TFE_CSID_HALT_MODE_INTERNAL,
+	CAM_TFE_CSID_HALT_MODE_GLOBAL,
+	CAM_TFE_CSID_HALT_MODE_MASTER,
+	CAM_TFE_CSID_HALT_MODE_SLAVE,
+	CAM_TFE_CSID_HALT_MODE_MAX,
+};
+
+/**
+ * struct cam_tfe_csid_hw_halt_args
+ * @halt_mode : Applicable only for PATH resources
+ *              0 Internal : The CSID responds to the HALT_CMD
+ *              1 Global   : The CSID responds to the GLOBAL_HALT_CMD
+ *              2 Master   : The CSID responds to the HALT_CMD
+ *              3 Slave    : The CSID responds to the external halt command
+ *                           and not the HALT_CMD register
+ * @node_res : reource pointer array( ie cid or CSID)
+ *
+ */
+struct cam_tfe_csid_hw_halt_args {
+	enum cam_tfe_csid_halt_mode     halt_mode;
+	struct cam_isp_resource_node   *node_res;
+};
+
+/**
+ * struct cam_csid_hw_stop- stop all resources
+ * @stop_cmd : Applicable only for PATH resources
+ *             if stop command set to Halt immediately,driver will stop
+ *             path immediately, manager need to reset the path after HI
+ *             if stop command set to halt at frame boundary, driver will set
+ *             halt at frame boundary and wait for frame boundary
+ * @num_res :  Number of resources to be stopped
+ * @node_res : Reource pointer array( ie cid or CSID)
+ *
+ */
+struct cam_tfe_csid_hw_stop_args {
+	enum cam_tfe_csid_halt_cmd                stop_cmd;
+	uint32_t                                  num_res;
+	struct cam_isp_resource_node            **node_res;
+};
+
+/**
+ * enum cam_tfe_csid_reset_type - Specify the reset type
+ */
+enum cam_tfe_csid_reset_type {
+	CAM_TFE_CSID_RESET_GLOBAL,
+	CAM_TFE_CSID_RESET_PATH,
+	CAM_TFE_CSID_RESET_MAX,
+};
+
+/**
+ * struct cam_tfe_csid_reset_cfg-  Csid reset configuration
+ * @ reset_type :                  Global reset or path reset
+ * @res_node :                     Resource need to be reset
+ *
+ */
+struct cam_tfe_csid_reset_cfg_args {
+	enum cam_tfe_csid_reset_type   reset_type;
+	struct cam_isp_resource_node  *node_res;
+};
+
+/**
+ * struct cam_csid_get_time_stamp_args-  time stamp capture arguments
+ * @res_node :       Resource to get the time stamp
+ * @time_stamp_val : Captured time stamp
+ * @boot_timestamp : Boot time stamp
+ */
+struct cam_tfe_csid_get_time_stamp_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           time_stamp_val;
+	uint64_t                           boot_timestamp;
+};
+
+/**
+ * enum cam_tfe_csid_cmd_type - Specify the csid command
+ */
+enum cam_tfe_csid_cmd_type {
+	CAM_TFE_CSID_CMD_GET_TIME_STAMP,
+	CAM_TFE_CSID_SET_CSID_DEBUG,
+	CAM_TFE_CSID_SOF_IRQ_DEBUG,
+	CAM_TFE_CSID_CMD_GET_REG_DUMP,
+	CAM_TFE_CSID_LOG_ACQUIRE_DATA,
+	CAM_TFE_CSID_CMD_MAX,
+};
+
+/**
+ * cam_tfe_csid_hw_init()
+ *
+ * @brief:               Initialize function for the CSID hardware
+ *
+ * @tfe_csid_hw:         CSID hardware instance returned
+ * @hw_idex:             CSID hardware instance id
+ */
+int cam_tfe_csid_hw_init(struct cam_hw_intf **tfe_csid_hw,
+	uint32_t hw_idx);
+
+/*
+ * struct cam_tfe_csid_clock_update_args:
+ *
+ * @clk_rate:                Clock rate requested
+ */
+struct cam_tfe_csid_clock_update_args {
+	uint64_t                           clk_rate;
+};
+
+
+#endif /* _CAM_TFE_CSID_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_tfe_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_tfe_hw_intf.h
@@ -0,0 +1,253 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_HW_INTF_H_
+#define _CAM_TFE_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_cpas_api.h"
+
+#define CAM_TFE_HW_NUM_MAX            3
+#define TFE_CORE_BASE_IDX             0
+
+
+enum cam_isp_hw_tfe_in {
+	CAM_ISP_HW_TFE_IN_CAMIF       = 0,
+	CAM_ISP_HW_TFE_IN_RDI0        = 1,
+	CAM_ISP_HW_TFE_IN_RDI1        = 2,
+	CAM_ISP_HW_TFE_IN_RDI2        = 3,
+	CAM_ISP_HW_TFE_IN_MAX,
+};
+
+enum cam_isp_hw_tfe_core {
+	CAM_ISP_HW_TFE_CORE_0,
+	CAM_ISP_HW_TFE_CORE_1,
+	CAM_ISP_HW_TFE_CORE_2,
+	CAM_ISP_HW_TFE_CORE_MAX,
+};
+
+enum cam_tfe_hw_irq_status {
+	CAM_TFE_IRQ_STATUS_SUCCESS,
+	CAM_TFE_IRQ_STATUS_ERR,
+	CAM_TFE_IRQ_STATUS_OVERFLOW,
+	CAM_TFE_IRQ_STATUS_P2I_ERROR,
+	CAM_TFE_IRQ_STATUS_VIOLATION,
+	CAM_TFE_IRQ_STATUS_MAX,
+};
+
+enum cam_tfe_hw_irq_regs {
+	CAM_TFE_IRQ_CAMIF_REG_STATUS0           = 0,
+	CAM_TFE_IRQ_CAMIF_REG_STATUS1           = 1,
+	CAM_TFE_IRQ_CAMIF_REG_STATUS2           = 2,
+	CAM_TFE_IRQ_REGISTERS_MAX,
+};
+
+enum cam_tfe_bus_irq_regs {
+	CAM_TFE_IRQ_BUS_REG_STATUS0             = 0,
+	CAM_TFE_IRQ_BUS_REG_STATUS1             = 1,
+	CAM_TFE_BUS_IRQ_REGISTERS_MAX,
+};
+
+enum cam_tfe_reset_type {
+	CAM_TFE_HW_RESET_HW_AND_REG,
+	CAM_TFE_HW_RESET_HW,
+	CAM_TFE_HW_RESET_MAX,
+};
+
+enum cam_tfe_bw_control_action {
+	CAM_TFE_BW_CONTROL_EXCLUDE       = 0,
+	CAM_TFE_BW_CONTROL_INCLUDE       = 1
+};
+
+/*
+ * struct cam_tfe_hw_get_hw_cap:
+ *
+ * @max_width:               Max width supported by HW
+ * @max_height:              Max height supported by HW
+ * @max_pixel_num:           Max Pixel channels available
+ * @max_rdi_num:             Max Raw channels available
+ */
+struct cam_tfe_hw_get_hw_cap {
+	uint32_t                max_width;
+	uint32_t                max_height;
+	uint32_t                max_pixel_num;
+	uint32_t                max_rdi_num;
+};
+
+/*
+ * struct cam_tfe_hw_tfe_out_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @out_port_info:           Output Port details to acquire
+ * @unique_id:               Unique Identity of Context to associate with this
+ *                           resource. Used for composite grouping of multiple
+ *                           resources in the same context
+ * @is_dual:                 Dual TFE or not
+ * @split_id:                In case of Dual TFE, this is Left or Right.
+ *                           (Default is Left if Single TFE)
+ * @is_master:               In case of Dual TFE, this is Master or Slave.
+ *                           (Default is Master in case of Single TFE)
+ * @cdm_ops:                 CDM operations
+ * @ctx:                     Context data
+ */
+struct cam_tfe_hw_tfe_out_acquire_args {
+	struct cam_isp_resource_node      *rsrc_node;
+	struct cam_isp_tfe_out_port_info  *out_port_info;
+	uint32_t                           unique_id;
+	uint32_t                           is_dual;
+	enum cam_isp_hw_split_id           split_id;
+	uint32_t                           is_master;
+	struct cam_cdm_utils_ops          *cdm_ops;
+	void                              *ctx;
+};
+
+/*
+ * struct cam_tfe_hw_tfe_in_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Resource ID of resource to acquire if specific,
+ *                           else CAM_ISP_HW_TFE_IN_MAX
+ * @cdm_ops:                 CDM operations
+ * @sync_mode:               In case of Dual TFE, this is Master or Slave.
+ *                           (Default is Master in case of Single TFE)
+ * @in_port:                 Input port details to acquire
+ * @camif_pd_enable          Camif pd enable or disable
+ * @dual_tfe_sync_sel_idx    Dual tfe master hardware index
+ */
+struct cam_tfe_hw_tfe_in_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	struct cam_isp_tfe_in_port_info      *in_port;
+	uint32_t                              res_id;
+	void                                 *cdm_ops;
+	enum cam_isp_hw_sync_mode             sync_mode;
+	bool                                  camif_pd_enable;
+	uint32_t                              dual_tfe_sync_sel_idx;
+};
+
+/*
+ * struct cam_tfe_acquire_args:
+ *
+ * @rsrc_type:               Type of Resource (OUT/IN) to acquire
+ * @tasklet:                 Tasklet to associate with this resource. This is
+ *                           used to schedule bottom of IRQ events associated
+ *                           with this resource.
+ * @priv:                    Context data
+ * @event_cb:                Callback function to hw mgr in case of hw events
+ * @tfe_out:                 Acquire args for TFE_OUT
+ * @tfe_in:                  Acquire args for TFE_IN
+ */
+struct cam_tfe_acquire_args {
+	enum cam_isp_resource_type           rsrc_type;
+	void                                *tasklet;
+	void                                *priv;
+	cam_hw_mgr_event_cb_func             event_cb;
+	union {
+		struct cam_tfe_hw_tfe_out_acquire_args  tfe_out;
+		struct cam_tfe_hw_tfe_in_acquire_args   tfe_in;
+	};
+};
+
+/*
+ * struct cam_tfe_clock_update_args:
+ *
+ * @node_res:                Resource to get the time stamp
+ * @clk_rate:                Clock rate requested
+ */
+struct cam_tfe_clock_update_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           clk_rate;
+};
+
+/*
+ * struct cam_tfe_bw_update_args:
+ *
+ * @node_res:             Resource to get the BW
+ * @isp_vote:             Vote info according to usage data (left/right/rdi)
+ */
+struct cam_tfe_bw_update_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_axi_vote                isp_vote;
+};
+
+/*
+ * struct cam_tfe_dual_update_args:
+ *
+ * @Brief:        update the dual isp striping configuration.
+ *
+ * @ split_id:        spilt id to inform left or rifht
+ * @ res:             resource node
+ * @ stripe_config:   stripe configuration for port
+ *
+ */
+struct cam_tfe_dual_update_args {
+	enum cam_isp_hw_split_id                  split_id;
+	struct cam_isp_resource_node             *res;
+	struct cam_isp_tfe_dual_stripe_config    *stripe_config;
+};
+
+/*
+ * struct cam_tfe_bw_control_args:
+ *
+ * @node_res:             Resource to get the time stamp
+ * @action:               Bandwidth control action
+ */
+struct cam_tfe_bw_control_args {
+	struct cam_isp_resource_node      *node_res;
+	enum cam_tfe_bw_control_action     action;
+};
+
+/*
+ * struct cam_tfe_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           related to TFE_TOP resources
+ *
+ * @list:                    list_head node for the payload
+ * @core_index:              Index of TFE HW that generated this IRQ event
+ * @core_info:               Private data of handler in bottom half context
+ * @evt_id:                  IRQ event
+ * @irq_reg_val:             IRQ and Error register values, read when IRQ was
+ *                           handled
+ * @bus_irq_val              Bus irq register status
+ * @debug_status_0:          Value of debug status_0 register at time of IRQ
+ * @ccif_violation_status    ccif violation status
+ * @overflow_status          bus overflow status
+ * @image_size_violation_status  image size violations status
+
+ * @error_type:              Identify different errors
+ * @enable_reg_dump:         enable register dump on error
+ * @ts:                      Timestamp
+ */
+struct cam_tfe_irq_evt_payload {
+	struct list_head           list;
+	uint32_t                   core_index;
+	void                      *core_info;
+	uint32_t                   evt_id;
+	uint32_t                   irq_reg_val[CAM_TFE_IRQ_REGISTERS_MAX];
+	uint32_t                   bus_irq_val[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t                   ccif_violation_status;
+	uint32_t                   overflow_status;
+	uint32_t                   image_size_violation_status;
+	uint32_t                   debug_status_0;
+
+	uint32_t                   error_type;
+	bool                       enable_reg_dump;
+	struct cam_isp_timestamp   ts;
+};
+
+/*
+ * cam_tfe_hw_init()
+ *
+ * @Brief:                  Initialize TFE HW device
+ *
+ * @tfe_hw:                 tfe_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of TFE HW
+ */
+int cam_tfe_hw_init(struct cam_isp_hw_intf_data **tfe_hw, uint32_t hw_idx);
+
+#endif /* _CAM_TFE_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_top_tpg_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_top_tpg_hw_intf.h
@@ -0,0 +1,105 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG_HW_INTF_H_
+#define _CAM_TOP_TPG_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_csid_hw_intf.h"
+
+/* Max top tpg instance */
+#define CAM_TOP_TPG_HW_NUM_MAX                        3
+/* Max supported number of DT for TPG */
+#define CAM_TOP_TPG_MAX_SUPPORTED_DT                  4
+/* TPG default pattern should be color bar */
+#define CAM_TOP_TPG_DEFAULT_PATTERN                   0x8
+/**
+ * enum cam_top_tpg_id - top tpg hw instance id
+ */
+enum cam_top_tpg_id {
+	CAM_TOP_TPG_ID_0,
+	CAM_TOP_TPG_ID_1,
+	CAM_TOP_TPG_ID_2,
+	CAM_TFE_TPG_ID_MAX,
+};
+
+/**
+ * struct cam_top_tpg_hw_caps- Get the top tpg hw capability
+ * @major_version : Major version
+ * @minor_version:  Minor version
+ * @version_incr:   Version increment
+ *
+ */
+struct cam_top_tpg_hw_caps {
+	uint32_t      major_version;
+	uint32_t      minor_version;
+	uint32_t      version_incr;
+};
+
+/**
+ * struct cam_top_tpg_ver1_reserve_args- hw reserve
+ * @num_inport:   number of inport
+ *                TPG support 4 dt types, each different dt comes in different
+ *                in port.
+ * @in_port :     Input port resource info structure pointer
+ * @node_res :    Reserved resource structure pointer
+ *
+ */
+struct cam_top_tpg_ver1_reserve_args {
+	uint32_t                          num_inport;
+	struct cam_isp_tfe_in_port_info  *in_port[CAM_TOP_TPG_MAX_SUPPORTED_DT];
+	struct cam_isp_resource_node     *node_res;
+};
+
+/**
+ * struct cam_top_tpg_ver2_reserve_args
+ * @num_inport:   number of inport
+ *                TPG supports 1 VC/DT combo
+ * @in_port :     Input port resource info structure pointer
+ * @node_res :    Reserved resource structure pointer
+ *
+ */
+struct cam_top_tpg_ver2_reserve_args {
+	uint32_t                                  num_inport;
+	struct cam_isp_in_port_generic_info      *in_port;
+	struct cam_isp_resource_node             *node_res;
+};
+
+/**
+ * struct cam_top_tpg_ver2_reserve_args
+ * @num_inport:   number of inport
+ *                TPG supports 4 VC's and 4 DT's per VC
+ * @in_port :     Input port resource info structure pointer
+ * @node_res :    Reserved resource structure pointer
+ *
+ */
+struct cam_top_tpg_ver3_reserve_args {
+	uint32_t                                  num_inport;
+	struct cam_isp_in_port_generic_info      *in_port;
+	struct cam_isp_resource_node             *node_res;
+};
+
+/**
+ * cam_top_tpg_hw_init()
+ *
+ * @brief:               Initialize function for the tpg hardware
+ *
+ * @top_tpg_hw:          TPG hardware instance returned
+ * @hw_idex:             TPG hardware instance id
+ */
+int cam_top_tpg_hw_init(struct cam_hw_intf **top_tpg_hw,
+	uint32_t hw_idx);
+
+/*
+ * struct cam_top_tpg_clock_update_args:
+ *
+ * @clk_rate:                phy rate requested
+ */
+struct cam_top_tpg_clock_update_args {
+	uint64_t                           clk_rate;
+};
+
+#endif /* _CAM_TOP_TPG_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
@@ -0,0 +1,414 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_HW_INTF_H_
+#define _CAM_VFE_HW_INTF_H_
+
+#include "cam_isp_hw.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_ife_csid_hw_intf.h"
+#include "cam_cpas_api.h"
+
+#define CAM_VFE_HW_NUM_MAX            7
+
+#define VFE_CORE_BASE_IDX             0
+#define CAMNOC_CORE_BASE_IDX          1
+#define RT_BASE_IDX                   2
+/*
+ * VBIF and BUS do not exist on same HW.
+ * Hence both can be 1 below.
+ */
+#define VFE_VBIF_BASE_IDX             1
+#define VFE_BUS_BASE_IDX              1
+
+#define CAM_VFE_MAX_UBWC_PORTS        4
+
+enum cam_isp_hw_vfe_in_mux {
+	CAM_ISP_HW_VFE_IN_CAMIF       = 0,
+	CAM_ISP_HW_VFE_IN_TESTGEN     = 1,
+	CAM_ISP_HW_VFE_IN_RD          = 2,
+	CAM_ISP_HW_VFE_IN_RDI0        = 3,
+	CAM_ISP_HW_VFE_IN_RDI1        = 4,
+	CAM_ISP_HW_VFE_IN_RDI2        = 5,
+	CAM_ISP_HW_VFE_IN_RDI3        = 6,
+	CAM_ISP_HW_VFE_IN_PDLIB       = 7,
+	CAM_ISP_HW_VFE_IN_LCR         = 8,
+	CAM_ISP_HW_VFE_IN_MAX,
+};
+
+enum cam_isp_hw_vfe_core {
+	CAM_ISP_HW_VFE_CORE_0,
+	CAM_ISP_HW_VFE_CORE_1,
+	CAM_ISP_HW_VFE_CORE_2,
+	CAM_ISP_HW_VFE_CORE_3,
+	CAM_ISP_HW_VFE_CORE_MAX,
+};
+
+enum cam_vfe_hw_irq_status {
+	CAM_VFE_IRQ_STATUS_ERR_COMP             = -3,
+	CAM_VFE_IRQ_STATUS_COMP_OWRT            = -2,
+	CAM_VFE_IRQ_STATUS_ERR                  = -1,
+	CAM_VFE_IRQ_STATUS_SUCCESS              = 0,
+	CAM_VFE_IRQ_STATUS_OVERFLOW             = 1,
+	CAM_VFE_IRQ_STATUS_P2I_ERROR            = 2,
+	CAM_VFE_IRQ_STATUS_VIOLATION            = 3,
+	CAM_VFE_IRQ_STATUS_MAX,
+};
+
+enum cam_vfe_hw_irq_regs {
+	CAM_IFE_IRQ_CAMIF_REG_STATUS0           = 0,
+	CAM_IFE_IRQ_CAMIF_REG_STATUS1           = 1,
+	CAM_IFE_IRQ_CAMIF_REG_STATUS2           = 2,
+	CAM_IFE_IRQ_VIOLATION_STATUS            = 3,
+	CAM_IFE_IRQ_BUS_OVERFLOW_STATUS         = 4,
+	CAM_IFE_IRQ_REGISTERS_MAX,
+};
+
+enum cam_vfe_bus_irq_regs {
+	CAM_IFE_IRQ_BUS_REG_STATUS0             = 0,
+	CAM_IFE_IRQ_BUS_REG_STATUS1             = 1,
+	CAM_IFE_IRQ_BUS_REG_STATUS2             = 2,
+	CAM_IFE_IRQ_BUS_REG_COMP_ERR            = 3,
+	CAM_IFE_IRQ_BUS_REG_COMP_OWRT           = 4,
+	CAM_IFE_IRQ_BUS_DUAL_COMP_ERR           = 5,
+	CAM_IFE_IRQ_BUS_DUAL_COMP_OWRT          = 6,
+	CAM_IFE_BUS_IRQ_REGISTERS_MAX,
+};
+
+enum cam_vfe_bus_ver3_irq_regs {
+	CAM_IFE_IRQ_BUS_VER3_REG_STATUS0             = 0,
+	CAM_IFE_IRQ_BUS_VER3_REG_STATUS1             = 1,
+	CAM_IFE_IRQ_BUS_VER3_REG_MAX,
+};
+
+enum cam_vfe_reset_type {
+	CAM_VFE_HW_RESET_HW_AND_REG,
+	CAM_VFE_HW_RESET_HW,
+	CAM_VFE_HW_RESET_MAX,
+};
+
+/*
+ * struct cam_vfe_hw_get_hw_cap:
+ *
+ * @Brief:     Argument type for fetching the hw information for Query caps
+ * @major:     Major revision number
+ * @minor:     Minor revision number
+ * @incr:      Increment revision number
+ * @is_lite:   Flag to indicate Whether a full vfe or a Lite vfe
+ */
+struct cam_vfe_hw_get_hw_cap {
+	uint32_t major;
+	uint32_t minor;
+	uint32_t incr;
+	bool     is_lite;
+};
+
+/*
+ * struct cam_vfe_hw_vfe_bus_rd_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Unique Identity of port to associate with this
+ *                           resource.
+ * @is_dual:                 Flag to indicate dual VFE usecase
+ * @cdm_ops:                 CDM operations
+ * @unpacket_fmt:            Unpacker format for read engine
+ * @is_offline:              Flag to indicate offline usecase
+ */
+struct cam_vfe_hw_vfe_bus_rd_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	uint32_t                              res_id;
+	uint32_t                              is_dual;
+	struct cam_cdm_utils_ops             *cdm_ops;
+	uint32_t                              unpacker_fmt;
+	bool                                  is_offline;
+};
+
+/*
+ * struct cam_vfe_hw_vfe_out_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @out_port_info:           Output Port details to acquire
+ * @unique_id:               Unique Identity of Context to associate with this
+ *                           resource. Used for composite grouping of multiple
+ *                           resources in the same context
+ * @is_dual:                 Dual VFE or not
+ * @split_id:                In case of Dual VFE, this is Left or Right.
+ *                           (Default is Left if Single VFE)
+ * @is_master:               In case of Dual VFE, this is Master or Slave.
+ *                           (Default is Master in case of Single VFE)
+ * @dual_slave_core:         If Master and Slave exists, HW Index of Slave
+ * @cdm_ops:                 CDM operations
+ * @disable_ubwc_comp:       Disable UBWC compression
+ */
+struct cam_vfe_hw_vfe_out_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	struct cam_isp_out_port_generic_info *out_port_info;
+	uint32_t                              unique_id;
+	uint32_t                              is_dual;
+	enum cam_isp_hw_split_id              split_id;
+	uint32_t                              is_master;
+	uint32_t                              dual_slave_core;
+	struct cam_cdm_utils_ops             *cdm_ops;
+	bool                                  disable_ubwc_comp;
+};
+
+/*
+ * struct cam_vfe_hw_vfe_in_acquire_args:
+ *
+ * @rsrc_node:               Pointer to Resource Node object, filled if acquire
+ *                           is successful
+ * @res_id:                  Resource ID of resource to acquire if specific,
+ *                           else CAM_ISP_HW_VFE_IN_MAX
+ * @dual_hw_idx:             Slave core for this master core if dual vfe case
+ * @is_dual:                 flag to indicate if dual vfe case
+ * @cdm_ops:                 CDM operations
+ * @sync_mode:               In case of Dual VFE, this is Master or Slave.
+ *                           (Default is Master in case of Single VFE)
+ * @in_port:                 Input port details to acquire
+ * @is_fe_enabled:           Flag to indicate if FE is enabled
+ * @is_offline:              Flag to indicate Offline IFE
+ */
+struct cam_vfe_hw_vfe_in_acquire_args {
+	struct cam_isp_resource_node         *rsrc_node;
+	uint32_t                              res_id;
+	uint32_t                              dual_hw_idx;
+	uint32_t                              is_dual;
+	void                                 *cdm_ops;
+	enum cam_isp_hw_sync_mode             sync_mode;
+	struct cam_isp_in_port_generic_info  *in_port;
+	bool                                  is_fe_enabled;
+	bool                                  is_offline;
+};
+
+/*
+ * struct cam_vfe_acquire_args:
+ *
+ * @rsrc_type:               Type of Resource (OUT/IN) to acquire
+ * @tasklet:                 Tasklet to associate with this resource. This is
+ *                           used to schedule bottom of IRQ events associated
+ *                           with this resource.
+ * @priv:                    Context data
+ * @event_cb:                Callback function to hw mgr in case of hw events
+ * @buf_done_controller:     Buf done controller for isp
+ * @vfe_out:                 Acquire args for VFE_OUT
+ * @vfe_bus_rd               Acquire args for VFE_BUS_READ
+ * @vfe_in:                  Acquire args for VFE_IN
+ */
+struct cam_vfe_acquire_args {
+	enum cam_isp_resource_type           rsrc_type;
+	void                                *tasklet;
+	void                                *priv;
+	cam_hw_mgr_event_cb_func             event_cb;
+	void                                *buf_done_controller;
+	union {
+		struct cam_vfe_hw_vfe_out_acquire_args     vfe_out;
+		struct cam_vfe_hw_vfe_bus_rd_acquire_args  vfe_bus_rd;
+		struct cam_vfe_hw_vfe_in_acquire_args      vfe_in;
+	};
+};
+
+/*
+ * struct cam_vfe_clock_update_args:
+ *
+ * @node_res:                Resource to get the time stamp
+ * @clk_rate:                Clock rate requested
+ */
+struct cam_vfe_clock_update_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           clk_rate;
+};
+
+/*
+ * struct cam_vfe_core_config_args:
+ *
+ * @node_res:                Resource to get the time stamp
+ * @core_config:             Core config for IFE
+ */
+struct cam_vfe_core_config_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_isp_core_config         core_config;
+};
+
+/*
+ * struct cam_vfe_bw_update_args_v2:
+ *
+ * @node_res:             Resource to get the BW
+ * @isp_vote:             Vote info according to usage data (left/right/rdi)
+ */
+struct cam_vfe_bw_update_args_v2 {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_axi_vote                isp_vote;
+};
+
+/*
+ * struct cam_vfe_bw_update_args:
+ *
+ * @node_res:             Resource to get the BW
+ * @camnoc_bw_bytes:      Bandwidth vote request for CAMNOC
+ * @external_bw_bytes:    Bandwidth vote request from CAMNOC
+ *                        out to the rest of the path-to-DDR
+ */
+struct cam_vfe_bw_update_args {
+	struct cam_isp_resource_node      *node_res;
+	uint64_t                           camnoc_bw_bytes;
+	uint64_t                           external_bw_bytes;
+};
+
+/*
+ * struct cam_vfe_fe_update_args:
+ *
+ * @node_res:             Resource to get fetch configuration
+ * @fe_config:            fetch engine configuration
+ *
+ */
+struct cam_vfe_fe_update_args {
+	struct cam_isp_resource_node      *node_res;
+	struct cam_fe_config               fe_config;
+};
+
+enum cam_vfe_bw_control_action {
+	CAM_VFE_BW_CONTROL_EXCLUDE       = 0,
+	CAM_VFE_BW_CONTROL_INCLUDE       = 1
+};
+
+/*
+ * struct cam_vfe_bw_control_args:
+ *
+ * @node_res:             Resource to get the time stamp
+ * @action:               Bandwidth control action
+ */
+struct cam_vfe_bw_control_args {
+	struct cam_isp_resource_node      *node_res;
+	enum cam_vfe_bw_control_action     action;
+};
+
+/*
+ * struct cam_vfe_top_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           related to VFE_TOP resources
+ *
+ * @list:                    list_head node for the payload
+ * @irq_reg_val:             IRQ and Error register values, read when IRQ was
+ *                           handled
+ * @reg_val:                 Value of any critical register that needs to be
+ *                           read at during irq handling
+ *
+ * @ts:                      Timestamp
+ */
+struct cam_vfe_top_irq_evt_payload {
+	struct list_head            list;
+	uint32_t                    irq_reg_val[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                    reg_val;
+	struct cam_isp_timestamp    ts;
+};
+
+/*
+ * struct cam_vfe_bus_irq_evt_payload:
+ *
+ * @Brief:                   This structure is used to save payload for IRQ
+ *                           related to VFE_BUS resources
+ *
+ * @list:                    list_head node for the payload
+ * @core_index:              Index of VFE HW that generated this IRQ event
+ * @debug_status_0:          Value of debug status_0 register at time of IRQ
+ * @evt_id:                  IRQ event
+ * @irq_reg_val:             IRQ and Error register values, read when IRQ was
+ *                           handled
+ * @error_type:              Identify different errors
+ * @ts:                      Timestamp
+ * @evt_param                Specific info about frame
+ */
+struct cam_vfe_bus_irq_evt_payload {
+	struct list_head            list;
+	uint32_t                    core_index;
+	uint32_t                    debug_status_0;
+	uint32_t                    ccif_violation_status;
+	uint32_t                    overflow_status;
+	uint32_t                    image_size_violation_status;
+	uint32_t                    evt_id;
+	uint32_t                    irq_reg_val[CAM_IFE_BUS_IRQ_REGISTERS_MAX];
+	struct cam_isp_timestamp    ts;
+	uint32_t                    evt_param;
+};
+
+/**
+ * struct cam_ubwc_generic_plane_config - UBWC Plane configuration info
+ *
+ * @port_type:                  Port Type
+ * @meta_stride:                UBWC metadata stride
+ * @meta_size:                  UBWC metadata plane size
+ * @meta_offset:                UBWC metadata offset
+ * @packer_config:              UBWC packer config
+ * @mode_config:                UBWC mode config
+ * @static ctrl:                UBWC static ctrl
+ * @ctrl_2:                     UBWC ctrl 2
+ * @tile_config:                UBWC tile config
+ * @h_init:                     UBWC horizontal initial coordinate in pixels
+ * @v_init:                     UBWC vertical initial coordinate in lines
+ * @stats_ctrl_2:               UBWC stats control
+ * @lossy_threshold0            UBWC lossy threshold 0
+ * @lossy_threshold1            UBWC lossy threshold 1
+ * @lossy_var_offset            UBWC offset variance threshold
+ * @bandwidth limit             UBWC bandwidth limit
+ */
+struct cam_vfe_generic_ubwc_plane_config {
+	uint32_t                port_type;
+	uint32_t                meta_stride;
+	uint32_t                meta_size;
+	uint32_t                meta_offset;
+	uint32_t                packer_config;
+	uint32_t                mode_config_0;
+	uint32_t                mode_config_1;
+	uint32_t                tile_config;
+	uint32_t                h_init;
+	uint32_t                v_init;
+	uint32_t                static_ctrl;
+	uint32_t                ctrl_2;
+	uint32_t                stats_ctrl_2;
+	uint32_t                lossy_threshold_0;
+	uint32_t                lossy_threshold_1;
+	uint32_t                lossy_var_offset;
+	uint32_t                bandwidth_limit;
+};
+
+/**
+ * struct cam_ubwc_generic_config - UBWC Configuration Payload
+ *
+ * @api_version:         UBWC config api version
+ * @ubwc_plane_config:   Array of UBWC configurations per plane
+ */
+struct cam_vfe_generic_ubwc_config {
+	uint32_t   api_version;
+	struct cam_vfe_generic_ubwc_plane_config
+		ubwc_plane_cfg[CAM_PACKET_MAX_PLANES - 1];
+};
+
+/*
+ * cam_vfe_hw_init()
+ *
+ * @Brief:                  Initialize VFE HW device
+ *
+ * @vfe_hw:                 vfe_hw interface to fill in and return on
+ *                          successful initialization
+ * @hw_idx:                 Index of VFE HW
+ */
+int cam_vfe_hw_init(struct cam_isp_hw_intf_data **vfe_hw,
+	uint32_t hw_idx);
+
+/*
+ * cam_vfe_put_evt_payload()
+ *
+ * @Brief:                  Put the evt payload back to free list
+ *
+ * @core_info:              VFE HW core_info
+ * @evt_payload:            Event payload data
+ */
+int cam_vfe_put_evt_payload(void             *core_info,
+	struct cam_vfe_top_irq_evt_payload  **evt_payload);
+
+#endif /* _CAM_VFE_HW_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.c
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_csid_ppi_core.h"
+#include "cam_csid_ppi100.h"
+#include "cam_csid_ppi_dev.h"
+
+#define CAM_PPI_DRV_NAME                    "ppi_100"
+#define CAM_PPI_VERSION_V100                 0x10000000
+
+static struct cam_csid_ppi_hw_info cam_csid_ppi100_hw_info = {
+	.ppi_reg = &cam_csid_ppi_100_reg_offset,
+};
+
+static const struct of_device_id cam_csid_ppi100_dt_match[] = {
+	{
+		.compatible = "qcom,ppi100",
+		.data = &cam_csid_ppi100_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_csid_ppi100_dt_match);
+
+struct platform_driver cam_csid_ppi100_driver = {
+	.probe  = cam_csid_ppi_probe,
+	.remove = cam_csid_ppi_remove,
+	.driver = {
+		.name = CAM_PPI_DRV_NAME,
+		.of_match_table = cam_csid_ppi100_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_csid_ppi100_init_module(void)
+{
+	return platform_driver_register(&cam_csid_ppi100_driver);
+}
+
+void cam_csid_ppi100_exit_module(void)
+{
+	platform_driver_unregister(&cam_csid_ppi100_driver);
+}
+
+MODULE_DESCRIPTION("CAM CSID_PPI100 driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi100.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSID_PPI_100_H_
+#define _CAM_CSID_PPI_100_H_
+
+#include "cam_csid_ppi_core.h"
+
+static struct cam_csid_ppi_reg_offset cam_csid_ppi_100_reg_offset = {
+	.ppi_hw_version_addr    = 0,
+	.ppi_module_cfg_addr    = 0x60,
+	.ppi_irq_status_addr    = 0x68,
+	.ppi_irq_mask_addr      = 0x6c,
+	.ppi_irq_set_addr       = 0x70,
+	.ppi_irq_clear_addr     = 0x74,
+	.ppi_irq_cmd_addr       = 0x78,
+	.ppi_rst_cmd_addr       = 0x7c,
+	.ppi_test_bus_ctrl_addr = 0x1f4,
+	.ppi_debug_addr         = 0x1f8,
+	.ppi_spare_addr         = 0x1fc,
+};
+
+/**
+ * @brief : API to register PPI Dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_csid_ppi100_init_module(void);
+
+/**
+ * @brief : API to remove PPI Dev from platform framework.
+ */
+void cam_csid_ppi100_exit_module(void);
+#endif /*_CAM_CSID_PPI_100_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.c
@@ -0,0 +1,373 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+#include <media/cam_defs.h>
+
+#include "cam_csid_ppi_core.h"
+#include "cam_csid_ppi_dev.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_io_util.h"
+
+static int cam_csid_ppi_reset(struct cam_csid_ppi_hw *ppi_hw)
+{
+	struct cam_hw_soc_info                *soc_info;
+	const struct cam_csid_ppi_reg_offset  *ppi_reg;
+	int rc = 0;
+	uint32_t status;
+
+	soc_info = &ppi_hw->hw_info->soc_info;
+	ppi_reg  = ppi_hw->ppi_info->ppi_reg;
+
+	CAM_DBG(CAM_ISP, "PPI:%d reset", ppi_hw->hw_intf->hw_idx);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_mask_addr);
+	cam_io_w_mb(PPI_RST_CONTROL, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_set_addr);
+	cam_io_w_mb(PPI_RST_CONTROL, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_rst_cmd_addr);
+	cam_io_w_mb(PPI_IRQ_CMD_SET, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_cmd_addr);
+
+	rc = readl_poll_timeout(soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_status_addr, status,
+		(status & 0x1) == 0x1, 1000, 500000);
+	CAM_DBG(CAM_ISP, "PPI:%d reset status %d", ppi_hw->hw_intf->hw_idx,
+		status);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "PPI:%d ppi_reset fail rc = %d status = %d",
+			ppi_hw->hw_intf->hw_idx, rc, status);
+		return rc;
+	}
+	cam_io_w_mb(PPI_RST_CONTROL, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_clear_addr);
+	cam_io_w_mb(PPI_IRQ_CMD_CLEAR, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_cmd_addr);
+
+	return 0;
+}
+
+static int cam_csid_ppi_enable_hw(struct cam_csid_ppi_hw  *ppi_hw)
+{
+	int rc = 0;
+	int32_t i;
+	uint64_t val;
+	const struct cam_csid_ppi_reg_offset *ppi_reg;
+	struct cam_hw_soc_info               *soc_info;
+	uint32_t err_irq_mask;
+
+	ppi_reg  = ppi_hw->ppi_info->ppi_reg;
+	soc_info = &ppi_hw->hw_info->soc_info;
+
+	CAM_DBG(CAM_ISP, "PPI:%d init PPI HW", ppi_hw->hw_intf->hw_idx);
+
+	ppi_hw->hw_info->open_count++;
+	if (ppi_hw->hw_info->open_count > 1) {
+		CAM_DBG(CAM_ISP, "PPI:%d dual vfe already enabled",
+			ppi_hw->hw_intf->hw_idx);
+		return 0;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		rc = cam_soc_util_clk_enable(soc_info->clk[i],
+			soc_info->clk_name[i], 0, NULL);
+		if (rc)
+			goto clk_disable;
+	}
+
+	rc = cam_csid_ppi_reset(ppi_hw);
+	if (rc)
+		goto clk_disable;
+
+	err_irq_mask = PPI_IRQ_FIFO0_OVERFLOW | PPI_IRQ_FIFO1_OVERFLOW |
+		PPI_IRQ_FIFO2_OVERFLOW;
+	cam_io_w_mb(err_irq_mask, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_mask_addr);
+	rc  = cam_soc_util_irq_enable(soc_info);
+	if (rc)
+		goto clk_disable;
+
+	cam_io_w_mb(PPI_RST_CONTROL, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_clear_addr);
+	cam_io_w_mb(PPI_IRQ_CMD_CLEAR, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_cmd_addr);
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_hw_version_addr);
+	CAM_DBG(CAM_ISP, "PPI:%d PPI HW version: 0x%x",
+		ppi_hw->hw_intf->hw_idx, val);
+	ppi_hw->device_enabled = 1;
+
+	return 0;
+clk_disable:
+	for (--i; i >= 0; i--)
+		cam_soc_util_clk_disable(soc_info->clk[i],
+			soc_info->clk_name[i]);
+	ppi_hw->hw_info->open_count--;
+	return rc;
+}
+
+static int cam_csid_ppi_disable_hw(struct cam_csid_ppi_hw *ppi_hw)
+{
+	int rc = 0;
+	int i;
+	struct cam_hw_soc_info               *soc_info;
+	const struct cam_csid_ppi_reg_offset *ppi_reg;
+	uint64_t ppi_cfg_val = 0;
+
+	CAM_DBG(CAM_ISP, "PPI:%d De-init PPI HW",
+		ppi_hw->hw_intf->hw_idx);
+
+	if (!ppi_hw->hw_info->open_count) {
+		CAM_WARN(CAM_ISP, "ppi[%d] unbalanced disable hw",
+			ppi_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+	ppi_hw->hw_info->open_count--;
+
+	if (ppi_hw->hw_info->open_count)
+		return rc;
+
+	soc_info = &ppi_hw->hw_info->soc_info;
+	ppi_reg = ppi_hw->ppi_info->ppi_reg;
+
+	CAM_DBG(CAM_ISP, "Calling PPI Reset");
+	cam_csid_ppi_reset(ppi_hw);
+	CAM_DBG(CAM_ISP, "PPI Reset Done");
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_mask_addr);
+	cam_soc_util_irq_disable(soc_info);
+
+	for (i = 0; i < CAM_CSID_PPI_LANES_MAX; i++)
+		ppi_cfg_val &= ~PPI_CFG_CPHY_DLX_EN(i);
+
+	cam_io_w_mb(ppi_cfg_val, soc_info->reg_map[0].mem_base +
+			ppi_reg->ppi_module_cfg_addr);
+
+	ppi_hw->device_enabled = 0;
+
+	for (i = 0; i < soc_info->num_clk; i++)
+		cam_soc_util_clk_disable(soc_info->clk[i],
+			soc_info->clk_name[i]);
+
+	return rc;
+}
+
+static int cam_csid_ppi_init_hw(void *hw_priv, void *init_args,
+		uint32_t arg_size)
+{
+	int i, rc = 0;
+	uint32_t num_lanes;
+	uint32_t cphy;
+	uint32_t ppi_cfg_val = 0;
+	struct cam_csid_ppi_hw                *ppi_hw;
+	struct cam_hw_info                    *ppi_hw_info;
+	const struct cam_csid_ppi_reg_offset  *ppi_reg;
+	struct cam_hw_soc_info                *soc_info;
+	struct cam_csid_ppi_cfg                ppi_cfg;
+
+	if (!hw_priv || !init_args ||
+		(arg_size != sizeof(struct cam_csid_ppi_cfg))) {
+		CAM_ERR(CAM_ISP, "PPI: Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ppi_hw_info = (struct cam_hw_info *)hw_priv;
+	ppi_hw      = (struct cam_csid_ppi_hw *)ppi_hw_info->core_info;
+	ppi_reg     = ppi_hw->ppi_info->ppi_reg;
+	ppi_cfg     = *((struct cam_csid_ppi_cfg *)init_args);
+
+	rc = cam_csid_ppi_enable_hw(ppi_hw);
+	if (rc)
+		goto end;
+
+	num_lanes = ppi_cfg.lane_num;
+	cphy = ppi_cfg.lane_type;
+	CAM_DBG(CAM_ISP, "lane_cfg  0x%x | num_lanes  0x%x | lane_type 0x%x",
+		ppi_cfg.lane_cfg, num_lanes, cphy);
+
+	if (cphy) {
+		ppi_cfg_val |= PPI_CFG_CPHY_DLX_SEL(0);
+		ppi_cfg_val |= PPI_CFG_CPHY_DLX_SEL(1);
+	} else {
+		ppi_cfg_val = 0;
+	}
+
+	for (i = 0; i < CAM_CSID_PPI_LANES_MAX; i++)
+		ppi_cfg_val |= PPI_CFG_CPHY_DLX_EN(i);
+
+	CAM_DBG(CAM_ISP, "ppi_cfg_val 0x%x", ppi_cfg_val);
+	soc_info = &ppi_hw->hw_info->soc_info;
+	cam_io_w_mb(ppi_cfg_val, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_module_cfg_addr);
+
+	CAM_DBG(CAM_ISP, "ppi cfg 0x%x",
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_module_cfg_addr));
+end:
+	return rc;
+}
+
+static int cam_csid_ppi_deinit_hw(void *hw_priv, void *deinit_args,
+		uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_csid_ppi_hw  *ppi_hw;
+	struct cam_hw_info      *ppi_hw_info;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "PPI:Invalid arguments");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ppi_hw_info = (struct cam_hw_info  *)hw_priv;
+	ppi_hw      = (struct cam_csid_ppi_hw *)ppi_hw_info->core_info;
+
+	CAM_DBG(CAM_ISP, "Disabling PPI Hw");
+	rc = cam_csid_ppi_disable_hw(ppi_hw);
+	if (rc < 0)
+		CAM_DBG(CAM_ISP, "Exit with %d", rc);
+end:
+	return rc;
+}
+
+int cam_csid_ppi_hw_probe_init(struct cam_hw_intf  *ppi_hw_intf,
+	uint32_t ppi_idx)
+{
+	int rc = -EINVAL;
+	struct cam_hw_info        *ppi_hw_info;
+	struct cam_csid_ppi_hw    *csid_ppi_hw = NULL;
+
+	if (ppi_idx >= CAM_CSID_PPI_HW_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid ppi index:%d", ppi_idx);
+		goto err;
+	}
+
+	ppi_hw_info = (struct cam_hw_info  *) ppi_hw_intf->hw_priv;
+	csid_ppi_hw  = (struct cam_csid_ppi_hw  *) ppi_hw_info->core_info;
+
+	csid_ppi_hw->hw_intf = ppi_hw_intf;
+	csid_ppi_hw->hw_info = ppi_hw_info;
+
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		csid_ppi_hw->hw_intf->hw_type, ppi_idx);
+
+	rc = cam_csid_ppi_init_soc_resources(&csid_ppi_hw->hw_info->soc_info,
+		cam_csid_ppi_irq, csid_ppi_hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "PPI:%d Failed to init_soc", ppi_idx);
+		goto err;
+	}
+
+	csid_ppi_hw->hw_intf->hw_ops.init   = cam_csid_ppi_init_hw;
+	csid_ppi_hw->hw_intf->hw_ops.deinit = cam_csid_ppi_deinit_hw;
+	return 0;
+err:
+	return rc;
+}
+
+int cam_csid_ppi_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ppi_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "PPI: Failed to get dt properties");
+		goto end;
+	}
+
+	rc = cam_soc_util_request_platform_resource(soc_info, ppi_irq_handler,
+		irq_data);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"PPI: Error Request platform resources failed rc=%d",
+			rc);
+		goto err;
+	}
+end:
+	return rc;
+err:
+	cam_soc_util_release_platform_resource(soc_info);
+	return rc;
+}
+
+irqreturn_t cam_csid_ppi_irq(int irq_num, void *data)
+{
+	uint32_t      irq_status = 0;
+	uint32_t      i, ppi_cfg_val = 0;
+	bool          fatal_err_detected = false;
+
+	struct cam_csid_ppi_hw                *ppi_hw;
+	struct cam_hw_soc_info                *soc_info;
+	const struct cam_csid_ppi_reg_offset  *ppi_reg;
+
+	if (!data) {
+		CAM_ERR(CAM_ISP, "PPI: Invalid arguments");
+		return IRQ_HANDLED;
+	}
+
+	ppi_hw = (struct cam_csid_ppi_hw *)data;
+	ppi_reg = ppi_hw->ppi_info->ppi_reg;
+	soc_info = &ppi_hw->hw_info->soc_info;
+
+	if (ppi_hw->device_enabled != 1)
+		goto ret;
+
+	irq_status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_status_addr);
+
+	cam_io_w_mb(irq_status, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_clear_addr);
+
+	cam_io_w_mb(PPI_IRQ_CMD_CLEAR, soc_info->reg_map[0].mem_base +
+		ppi_reg->ppi_irq_cmd_addr);
+
+	CAM_DBG(CAM_ISP, "PPI %d irq status 0x%x", ppi_hw->hw_intf->hw_idx,
+			irq_status);
+
+	if (irq_status & PPI_IRQ_RST_DONE) {
+		CAM_DBG(CAM_ISP, "PPI Reset Done");
+		goto ret;
+	}
+	if ((irq_status & PPI_IRQ_FIFO0_OVERFLOW) ||
+		(irq_status & PPI_IRQ_FIFO1_OVERFLOW) ||
+		(irq_status & PPI_IRQ_FIFO2_OVERFLOW)) {
+		fatal_err_detected = true;
+		goto handle_fatal_error;
+	}
+
+handle_fatal_error:
+	if (fatal_err_detected) {
+		CAM_ERR(CAM_ISP, "PPI: %d irq_status:0x%x",
+			ppi_hw->hw_intf->hw_idx, irq_status);
+		for (i = 0; i < CAM_CSID_PPI_LANES_MAX; i++)
+			ppi_cfg_val &= ~PPI_CFG_CPHY_DLX_EN(i);
+
+		cam_io_w_mb(ppi_cfg_val, soc_info->reg_map[0].mem_base +
+			ppi_reg->ppi_module_cfg_addr);
+	}
+ret:
+	CAM_DBG(CAM_ISP, "IRQ Handling exit");
+	return IRQ_HANDLED;
+}
+
+int cam_csid_ppi_hw_deinit(struct cam_csid_ppi_hw *csid_ppi_hw)
+{
+	if (!csid_ppi_hw) {
+		CAM_ERR(CAM_ISP, "Invalid param");
+		return -EINVAL;
+	}
+	return cam_soc_util_release_platform_resource(
+		&csid_ppi_hw->hw_info->soc_info);
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_core.h
@@ -0,0 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSID_PPI_HW_H_
+#define _CAM_CSID_PPI_HW_H_
+
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+
+#define CAM_CSID_PPI_HW_MAX      6
+#define CAM_CSID_PPI_LANES_MAX   3
+
+#define PPI_IRQ_RST_DONE                   BIT(0)
+#define PPI_IRQ_FIFO0_OVERFLOW             BIT(1)
+#define PPI_IRQ_FIFO1_OVERFLOW             BIT(2)
+#define PPI_IRQ_FIFO2_OVERFLOW             BIT(3)
+
+#define PPI_IRQ_CMD_SET                    BIT(1)
+
+#define PPI_IRQ_CMD_CLEAR                  BIT(0)
+
+#define PPI_RST_CONTROL                    BIT(0)
+/*
+ * Select the PHY (CPHY set '1' or DPHY set '0')
+ */
+#define PPI_CFG_CPHY_DLX_SEL(X)            BIT(X)
+
+#define PPI_CFG_CPHY_DLX_EN(X)             BIT(4+X)
+
+struct cam_csid_ppi_reg_offset {
+	uint32_t ppi_hw_version_addr;
+	uint32_t ppi_module_cfg_addr;
+
+	uint32_t ppi_irq_status_addr;
+	uint32_t ppi_irq_mask_addr;
+	uint32_t ppi_irq_set_addr;
+	uint32_t ppi_irq_clear_addr;
+	uint32_t ppi_irq_cmd_addr;
+	uint32_t ppi_rst_cmd_addr;
+	uint32_t ppi_test_bus_ctrl_addr;
+	uint32_t ppi_debug_addr;
+	uint32_t ppi_spare_addr;
+};
+
+/**
+ * struct cam_csid_ppi_hw_info- ppi HW info
+ *
+ * @ppi_reg:         ppi register offsets
+ *
+ */
+struct cam_csid_ppi_hw_info {
+	const struct cam_csid_ppi_reg_offset *ppi_reg;
+};
+
+/**
+ * struct cam_csid_ppi_hw- ppi hw device resources data
+ *
+ * @hw_intf:                  contain the ppi hw interface information
+ * @hw_info:                  ppi hw device information
+ * @ppi_info:                 ppi hw specific information
+ * @device_enabled            Device enabled will set once ppi powered on and
+ *                            initial configuration are done.
+ *
+ */
+struct cam_csid_ppi_hw {
+	struct cam_hw_intf              *hw_intf;
+	struct cam_hw_info              *hw_info;
+	struct cam_csid_ppi_hw_info     *ppi_info;
+	uint32_t                         device_enabled;
+};
+
+/**
+ * struct cam_csid_ppi_cfg - ppi lane configuration data
+ * @lane_type:   lane type: c-phy or d-phy
+ * @lane_num :   active lane number
+ * @lane_cfg:    lane configurations: 4 bits per lane
+ *
+ */
+struct cam_csid_ppi_cfg {
+	uint32_t lane_type;
+	uint32_t lane_num;
+	uint32_t lane_cfg;
+};
+
+int cam_csid_ppi_hw_probe_init(struct cam_hw_intf  *ppi_hw_intf,
+	uint32_t ppi_idx);
+int cam_csid_ppi_hw_deinit(struct cam_csid_ppi_hw *csid_ppi_hw);
+int cam_csid_ppi_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ppi_irq_handler, void *irq_data);
+int cam_csid_ppi_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+int cam_csid_ppi_hw_init(struct cam_hw_intf **csid_ppi_hw,
+	uint32_t hw_idx);
+#endif /* _CAM_CSID_PPI_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.c
@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/component.h>
+
+#include "cam_isp_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_csid_ppi_core.h"
+#include "cam_csid_ppi_dev.h"
+#include "cam_debug_util.h"
+
+static struct cam_hw_intf *cam_csid_ppi_hw_list[CAM_CSID_PPI_HW_MAX] = {
+	NULL, NULL, NULL, NULL};
+static char ppi_dev_name[8];
+
+static int cam_ppi_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf            *ppi_hw_intf;
+	struct cam_hw_info            *ppi_hw_info;
+	struct cam_csid_ppi_hw        *ppi_dev = NULL;
+	const struct of_device_id     *match_dev = NULL;
+	struct cam_csid_ppi_hw_info   *ppi_hw_data = NULL;
+	uint32_t                       ppi_dev_idx;
+	int                            rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ISP, "PPI probe called");
+
+	ppi_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!ppi_hw_intf) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	ppi_hw_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!ppi_hw_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	ppi_dev = kzalloc(sizeof(struct cam_csid_ppi_hw), GFP_KERNEL);
+	if (!ppi_dev) {
+		rc = -ENOMEM;
+		goto free_hw_info;
+	}
+
+	of_property_read_u32(pdev->dev.of_node, "cell-index", &ppi_dev_idx);
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "No matching table for the CSID PPI HW!");
+		rc = -EINVAL;
+		goto free_dev;
+	}
+
+	memset(ppi_dev_name, 0, sizeof(ppi_dev_name));
+	snprintf(ppi_dev_name, sizeof(ppi_dev_name), "ppi%1u", ppi_dev_idx);
+
+	ppi_hw_intf->hw_idx  = ppi_dev_idx;
+	ppi_hw_intf->hw_priv = ppi_hw_info;
+
+	if (ppi_hw_intf->hw_idx < CAM_CSID_PPI_HW_MAX)
+		cam_csid_ppi_hw_list[ppi_hw_intf->hw_idx] = ppi_hw_intf;
+	else {
+		rc = -EINVAL;
+		goto free_dev;
+	}
+
+	ppi_hw_info->core_info         = ppi_dev;
+	ppi_hw_info->soc_info.pdev     = pdev;
+	ppi_hw_info->soc_info.dev      = &pdev->dev;
+	ppi_hw_info->soc_info.dev_name = ppi_dev_name;
+	ppi_hw_info->soc_info.index    = ppi_dev_idx;
+
+	ppi_hw_data = (struct cam_csid_ppi_hw_info  *)match_dev->data;
+	ppi_dev->ppi_info = ppi_hw_data;
+
+	rc = cam_csid_ppi_hw_probe_init(ppi_hw_intf, ppi_dev_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "PPI: Probe init failed!");
+		goto free_dev;
+	}
+
+	platform_set_drvdata(pdev, ppi_dev);
+	CAM_DBG(CAM_ISP, "PPI:%d probe successful",
+		ppi_hw_intf->hw_idx);
+
+	return 0;
+free_dev:
+	kfree(ppi_dev);
+free_hw_info:
+	kfree(ppi_hw_info);
+free_hw_intf:
+	kfree(ppi_hw_intf);
+err:
+	return rc;
+}
+
+static void cam_ppi_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_csid_ppi_hw         *ppi_dev = NULL;
+	struct cam_hw_intf             *ppi_hw_intf;
+	struct cam_hw_info             *ppi_hw_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	ppi_dev = (struct cam_csid_ppi_hw *)platform_get_drvdata(pdev);
+	ppi_hw_intf = ppi_dev->hw_intf;
+	ppi_hw_info = ppi_dev->hw_info;
+
+	CAM_DBG(CAM_ISP, "PPI:%d remove", ppi_dev->hw_intf->hw_idx);
+
+	cam_csid_ppi_hw_deinit(ppi_dev);
+
+	kfree(ppi_dev);
+	kfree(ppi_hw_info);
+	kfree(ppi_hw_intf);
+}
+
+int cam_csid_ppi_hw_init(struct cam_hw_intf **csid_ppi_hw,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_csid_ppi_hw_list[hw_idx]) {
+		*csid_ppi_hw = cam_csid_ppi_hw_list[hw_idx];
+	} else {
+		*csid_ppi_hw = NULL;
+		rc = -1;
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_csid_ppi_hw_init);
+
+const static struct component_ops cam_ppi_component_ops = {
+	.bind = cam_ppi_component_bind,
+	.unbind = cam_ppi_component_unbind,
+};
+
+int cam_csid_ppi_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Adding PPI component");
+	rc = component_add(&pdev->dev, &cam_ppi_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_csid_ppi_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ppi_component_ops);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/ppi_hw/cam_csid_ppi_dev.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSID_PPI_DEV_H_
+#define _CAM_CSID_PPI_DEV_H_
+
+#include "cam_isp_hw.h"
+
+irqreturn_t cam_csid_ppi_irq(int irq_num, void *data);
+int cam_csid_ppi_probe(struct platform_device *pdev);
+int cam_csid_ppi_remove(struct platform_device *pdev);
+
+#endif /*_CAM_CSID_PPI_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe680.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe680.h
@@ -0,0 +1,739 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE680_H_
+#define _CAM_SFE680_H_
+#include "cam_sfe_core.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+#include "cam_sfe_bus_wr.h"
+
+static struct cam_sfe_top_common_reg_offset  sfe680_top_commong_reg  = {
+	.hw_version                    = 0x00000000,
+	.hw_capability                 = 0x00000004,
+	.stats_feature                 = 0x00000008,
+	.core_cgc_ctrl                 = 0x00000010,
+	.ahb_clk_ovd                   = 0x00000014,
+	.core_cfg                      = 0x00000018,
+	.violation_status              = 0x00000030,
+	.diag_config                   = 0x00000034,
+	.diag_sensor_status_0          = 0x00000038,
+	.diag_sensor_status_1          = 0x0000003C,
+	.diag_sensor_frame_cnt_status0 = 0x00000040,
+	.diag_sensor_frame_cnt_status1 = 0x00000044,
+	.top_debug_0                   = 0x0000004C,
+	.top_debug_1                   = 0x00000050,
+	.top_debug_2                   = 0x00000054,
+	.top_debug_3                   = 0x00000058,
+	.top_debug_4                   = 0x0000005C,
+	.top_debug_5                   = 0x00000060,
+	.top_debug_6                   = 0x00000064,
+	.top_debug_7                   = 0x00000068,
+	.top_debug_8                   = 0x0000006C,
+	.top_debug_9                   = 0x00000070,
+	.top_debug_10                  = 0x00000074,
+	.top_debug_11                  = 0x00000078,
+	.top_debug_cfg                 = 0x0000007C,
+	.stats_ch2_throttle_cfg        = 0x000000B0,
+	.stats_ch1_throttle_cfg        = 0x000000B4,
+	.stats_ch0_throttle_cfg        = 0x000000B8,
+	.lcr_throttle_cfg              = 0x000000BC,
+	.hdr_throttle_cfg              = 0x000000C0,
+	.sfe_op_throttle_cfg           = 0x000000C4,
+};
+
+static struct cam_sfe_modules_common_reg_offset sfe680_modules_common_reg = {
+	.demux_module_cfg              = 0x00003060,
+	.demux_qcfa_cfg                = 0x00003064,
+	.demux_hdr_cfg                 = 0x00003074,
+	.demux_lcr_sel                 = 0x00003078,
+	.hdrc_remo_mod_cfg             = 0x00005860,
+	.hdrc_remo_qcfa_bin_cfg        = 0x00005A78,
+	.qcfa_hdrc_remo_out_mux_cfg    = 0x00005A74,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_pix_reg_data = {
+	.sof_irq_mask                  = 0x4,
+	.eof_irq_mask                  = 0x8,
+	.error_irq_mask                = 0x1C000,
+	.subscribe_irq_mask            = 0xC,
+	.enable_diagnostic_hw          = 0x1,
+	.top_debug_cfg_en              = 0x3,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi0_reg_data = {
+	.sof_irq_mask                  = 0x10,
+	.eof_irq_mask                  = 0x20,
+	.error_irq_mask                = 0x1C000,
+	.subscribe_irq_mask            = 0x30,
+	.enable_diagnostic_hw          = 0x1,
+	.top_debug_cfg_en              = 0x3,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi1_reg_data = {
+	.sof_irq_mask                  = 0x40,
+	.eof_irq_mask                  = 0x80,
+	.error_irq_mask                = 0x1C000,
+	.subscribe_irq_mask            = 0xC0,
+	.enable_diagnostic_hw          = 0x1,
+	.top_debug_cfg_en              = 0x3,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi2_reg_data = {
+	.sof_irq_mask                  = 0x100,
+	.eof_irq_mask                  = 0x200,
+	.error_irq_mask                = 0x1C000,
+	.subscribe_irq_mask            = 0x300,
+	.enable_diagnostic_hw          = 0x1,
+	.top_debug_cfg_en              = 0x3,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi3_reg_data = {
+	.sof_irq_mask                  = 0x400,
+	.eof_irq_mask                  = 0x800,
+	.error_irq_mask                = 0x1C000,
+	.subscribe_irq_mask            = 0xC00,
+	.enable_diagnostic_hw          = 0x1,
+	.top_debug_cfg_en              = 0x3,
+};
+
+static struct cam_sfe_path_common_reg_data sfe_680_rdi4_reg_data = {
+	.sof_irq_mask                  = 0x1000,
+	.eof_irq_mask                  = 0x2000,
+	.error_irq_mask                = 0x1C000,
+	.subscribe_irq_mask            = 0x3000,
+	.enable_diagnostic_hw          = 0x1,
+	.top_debug_cfg_en              = 0x3,
+};
+
+static struct cam_sfe_top_hw_info sfe680_top_hw_info = {
+	.common_reg = &sfe680_top_commong_reg,
+	.modules_hw_info = &sfe680_modules_common_reg,
+	.pix_reg_data = &sfe_680_pix_reg_data,
+	.rdi_reg_data[0] = &sfe_680_rdi0_reg_data,
+	.rdi_reg_data[1] = &sfe_680_rdi1_reg_data,
+	.rdi_reg_data[2] = &sfe_680_rdi2_reg_data,
+	.rdi_reg_data[3] = &sfe_680_rdi3_reg_data,
+	.rdi_reg_data[4] = &sfe_680_rdi4_reg_data,
+	.num_inputs = 6,
+	.input_type = {
+		CAM_SFE_PIX_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+		CAM_SFE_RDI_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set sfe680_bus_rd_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00000404,
+		.clear_reg_offset  = 0x00000408,
+		.status_reg_offset = 0x00000410,
+	},
+};
+
+static struct cam_sfe_bus_rd_hw_info sfe680_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00000400,
+		.misr_reset                   = 0x0000041C,
+		.pwr_iso_cfg                  = 0x00000424,
+		.input_if_cmd                 = 0x00000414,
+		.test_bus_ctrl                = 0x0000042C,
+		.security_cfg                 = 0x00000420,
+		.cons_violation_status        = 0x00000434,
+		.irq_reg_info = {
+			.num_registers     = 1,
+			.irq_reg_set          = sfe680_bus_rd_irq_reg,
+			.global_clear_offset  = 0x0000040C,
+			.global_clear_bitmask = 0x00000001,
+		},
+	},
+	.num_client = 3,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x00000450,
+			.image_addr               = 0x00000458,
+			.buf_width                = 0x0000045C,
+			.buf_height               = 0x00000460,
+			.stride                   = 0x00000464,
+			.unpacker_cfg             = 0x00000468,
+			.latency_buf_allocation   = 0x0000047C,
+		},
+		/* BUS Client 1 */
+		{
+			.cfg                      = 0x000004F0,
+			.image_addr               = 0x000004F8,
+			.buf_width                = 0x000004FC,
+			.buf_height               = 0x00000500,
+			.stride                   = 0x00000504,
+			.unpacker_cfg             = 0x00000508,
+			.latency_buf_allocation   = 0x0000051C,
+		},
+		/* BUS Client 2 */
+		{
+			.cfg                      = 0x00000590,
+			.image_addr               = 0x00000598,
+			.buf_width                = 0x0000059C,
+			.buf_height               = 0x000005A0,
+			.stride                   = 0x000005A4,
+			.unpacker_cfg             = 0x000005A8,
+			.latency_buf_allocation   = 0x000005BC,
+		},
+	},
+	.num_bus_rd_resc = 3,
+	.sfe_bus_rd_info = {
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.sfe_bus_rd_type = CAM_SFE_BUS_RD_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 0x1,
+};
+
+static struct cam_irq_register_set sfe680_bus_wr_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x00000818,
+		.clear_reg_offset  = 0x00000820,
+		.status_reg_offset = 0x00000828,
+	},
+};
+
+static struct cam_sfe_bus_wr_hw_info sfe680_bus_wr_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000800,
+		.cgc_ovd                          = 0x00000808,
+		.if_frameheader_cfg               = {
+			0x00000834,
+			0x00000838,
+			0x0000083C,
+			0x00000840,
+			0x00000844,
+			0x00000848,
+		},
+		.pwr_iso_cfg                      = 0x0000085C,
+		.overflow_status_clear            = 0x00000860,
+		.ccif_violation_status            = 0x00000864,
+		.overflow_status                  = 0x00000868,
+		.image_size_violation_status      = 0x00000870,
+		.debug_status_top_cfg             = 0x000008D4,
+		.debug_status_top                 = 0x000008D8,
+		.test_bus_ctrl                    = 0x000008DC,
+		.top_irq_mask_0                   = 0x00000020,
+		.irq_reg_info = {
+			.num_registers     = 1,
+			.irq_reg_set          = sfe680_bus_wr_irq_reg,
+			.global_clear_offset  = 0x00000830,
+			.global_clear_bitmask = 0x00000001,
+		},
+	},
+	.num_client = 13,
+	.bus_client_reg = {
+		/* BUS Client 0 REMOSAIC */
+		{
+			.cfg                      = 0x00000A00,
+			.image_addr               = 0x00000A04,
+			.frame_incr               = 0x00000A08,
+			.image_cfg_0              = 0x00000A0C,
+			.image_cfg_1              = 0x00000A10,
+			.image_cfg_2              = 0x00000A14,
+			.packer_cfg               = 0x00000A18,
+			.frame_header_addr        = 0x00000A20,
+			.frame_header_incr        = 0x00000A24,
+			.frame_header_cfg         = 0x00000A28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000A30,
+			.irq_subsample_pattern    = 0x00000A34,
+			.framedrop_period         = 0x00000A38,
+			.framedrop_pattern        = 0x00000A3C,
+			.system_cache_cfg         = 0x00000A68,
+			.addr_status_0            = 0x00000A70,
+			.addr_status_1            = 0x00000A74,
+			.addr_status_2            = 0x00000A78,
+			.addr_status_3            = 0x00000A7C,
+			.debug_status_cfg         = 0x00000A80,
+			.debug_status_0           = 0x00000A84,
+			.debug_status_1           = 0x00000A88,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_0,
+		},
+		/* BUS Client 1 LCR */
+		{
+			.cfg                      = 0x00000B00,
+			.image_addr               = 0x00000B04,
+			.frame_incr               = 0x00000B08,
+			.image_cfg_0              = 0x00000B0C,
+			.image_cfg_1              = 0x00000B10,
+			.image_cfg_2              = 0x00000B14,
+			.packer_cfg               = 0x00000B18,
+			.frame_header_addr        = 0x00000B20,
+			.frame_header_incr        = 0x00000B24,
+			.frame_header_cfg         = 0x00000B28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000B30,
+			.irq_subsample_pattern    = 0x00000B34,
+			.framedrop_period         = 0x00000B38,
+			.framedrop_pattern        = 0x00000B3C,
+			.system_cache_cfg         = 0x00000B68,
+			.addr_status_0            = 0x00000B70,
+			.addr_status_1            = 0x00000B74,
+			.addr_status_2            = 0x00000B78,
+			.addr_status_3            = 0x00000B7C,
+			.debug_status_cfg         = 0x00000B80,
+			.debug_status_0           = 0x00000B84,
+			.debug_status_1           = 0x00000B88,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_1,
+		},
+		/* BUS Client 2 STATS_BE_0 */
+		{
+			.cfg                      = 0x00000C00,
+			.image_addr               = 0x00000C04,
+			.frame_incr               = 0x00000C08,
+			.image_cfg_0              = 0x00000C0C,
+			.image_cfg_1              = 0x00000C10,
+			.image_cfg_2              = 0x00000C14,
+			.packer_cfg               = 0x00000C18,
+			.frame_header_addr        = 0x00000C20,
+			.frame_header_incr        = 0x00000C24,
+			.frame_header_cfg         = 0x00000C28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000C30,
+			.irq_subsample_pattern    = 0x00000C34,
+			.framedrop_period         = 0x00000C38,
+			.framedrop_pattern        = 0x00000C3C,
+			.system_cache_cfg         = 0x00000C68,
+			.addr_status_0            = 0x00000C70,
+			.addr_status_1            = 0x00000C74,
+			.addr_status_2            = 0x00000C78,
+			.addr_status_3            = 0x00000C7C,
+			.debug_status_cfg         = 0x00000C80,
+			.debug_status_0           = 0x00000C84,
+			.debug_status_1           = 0x00000C88,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 3 STATS_BHIST_0 */
+		{
+			.cfg                      = 0x00000D00,
+			.image_addr               = 0x00000D04,
+			.frame_incr               = 0x00000D08,
+			.image_cfg_0              = 0x00000D0C,
+			.image_cfg_1              = 0x00000D10,
+			.image_cfg_2              = 0x00000D14,
+			.packer_cfg               = 0x00000D18,
+			.frame_header_addr        = 0x00000D20,
+			.frame_header_incr        = 0x00000D24,
+			.frame_header_cfg         = 0x00000D28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000D30,
+			.irq_subsample_pattern    = 0x00000D34,
+			.framedrop_period         = 0x00000D38,
+			.framedrop_pattern        = 0x00000D3C,
+			.system_cache_cfg         = 0x00000D68,
+			.addr_status_0            = 0x00000D70,
+			.addr_status_1            = 0x00000D74,
+			.addr_status_2            = 0x00000D78,
+			.addr_status_3            = 0x00000D7C,
+			.debug_status_cfg         = 0x00000D80,
+			.debug_status_0           = 0x00000D84,
+			.debug_status_1           = 0x00000D88,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_2,
+		},
+		/* BUS Client 4 STATS_BE_1 */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.frame_header_addr        = 0x00000E20,
+			.frame_header_incr        = 0x00000E24,
+			.frame_header_cfg         = 0x00000E28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_status_0            = 0x00000E70,
+			.addr_status_1            = 0x00000E74,
+			.addr_status_2            = 0x00000E78,
+			.addr_status_3            = 0x00000E7C,
+			.debug_status_cfg         = 0x00000E80,
+			.debug_status_0           = 0x00000E84,
+			.debug_status_1           = 0x00000E88,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 5 STATS_BHIST_1 */
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_status_0            = 0x00000F70,
+			.addr_status_1            = 0x00000F74,
+			.addr_status_2            = 0x00000F78,
+			.addr_status_3            = 0x00000F7C,
+			.debug_status_cfg         = 0x00000F80,
+			.debug_status_0           = 0x00000F84,
+			.debug_status_1           = 0x00000F88,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_3,
+		},
+		/* BUS Client 6 STATS_BE_2 */
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.frame_header_addr        = 0x00001020,
+			.frame_header_incr        = 0x00001024,
+			.frame_header_cfg         = 0x00001028,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.system_cache_cfg         = 0x00001068,
+			.addr_status_0            = 0x00001070,
+			.addr_status_1            = 0x00001074,
+			.addr_status_2            = 0x00001078,
+			.addr_status_3            = 0x0000107C,
+			.debug_status_cfg         = 0x00001080,
+			.debug_status_0           = 0x00001084,
+			.debug_status_1           = 0x00001088,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 7 STATS_BHIST_2 */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.frame_header_addr        = 0x00001120,
+			.frame_header_incr        = 0x00001124,
+			.frame_header_cfg         = 0x00001128,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.system_cache_cfg         = 0x00001168,
+			.addr_status_0            = 0x00001170,
+			.addr_status_1            = 0x00001174,
+			.addr_status_2            = 0x00001178,
+			.addr_status_3            = 0x0000117C,
+			.debug_status_cfg         = 0x00001180,
+			.debug_status_0           = 0x00001184,
+			.debug_status_1           = 0x00001188,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_4,
+		},
+		/* BUS Client 8 RDI0 */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.line_done_cfg            = 0x0000122C,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.system_cache_cfg         = 0x00001268,
+			.addr_status_0            = 0x00001270,
+			.addr_status_1            = 0x00001274,
+			.addr_status_2            = 0x00001278,
+			.addr_status_3            = 0x0000127C,
+			.debug_status_cfg         = 0x00001280,
+			.debug_status_0           = 0x00001284,
+			.debug_status_1           = 0x00001288,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_5,
+		},
+		/* BUS Client 9 RDI1 */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.line_done_cfg            = 0x0000132C,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.system_cache_cfg         = 0x00001368,
+			.addr_status_0            = 0x00001370,
+			.addr_status_1            = 0x00001374,
+			.addr_status_2            = 0x00001378,
+			.addr_status_3            = 0x0000137C,
+			.debug_status_cfg         = 0x00001380,
+			.debug_status_0           = 0x00001384,
+			.debug_status_1           = 0x00001388,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_6,
+		},
+		/* BUS Client 10 RDI2 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.frame_header_addr        = 0x00001420,
+			.frame_header_incr        = 0x00001424,
+			.frame_header_cfg         = 0x00001428,
+			.line_done_cfg            = 0x0000142C,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.system_cache_cfg         = 0x00001468,
+			.addr_status_0            = 0x00001470,
+			.addr_status_1            = 0x00001474,
+			.addr_status_2            = 0x00001478,
+			.addr_status_3            = 0x0000147C,
+			.debug_status_cfg         = 0x00001480,
+			.debug_status_0           = 0x00001484,
+			.debug_status_1           = 0x00001488,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_7,
+		},
+		/* BUS Client 11 RDI3 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.frame_header_addr        = 0x00001520,
+			.frame_header_incr        = 0x00001524,
+			.frame_header_cfg         = 0x00001528,
+			.line_done_cfg            = 0x0000152C,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.system_cache_cfg         = 0x00001568,
+			.addr_status_0            = 0x00001570,
+			.addr_status_1            = 0x00001574,
+			.addr_status_2            = 0x00001578,
+			.addr_status_3            = 0x0000157C,
+			.debug_status_cfg         = 0x00001580,
+			.debug_status_0           = 0x00001584,
+			.debug_status_1           = 0x00001588,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_8,
+		},
+		/* BUS Client 12 RDI4 */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.line_done_cfg            = 0x0000162C,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.system_cache_cfg         = 0x00001668,
+			.addr_status_0            = 0x00001670,
+			.addr_status_1            = 0x00001674,
+			.addr_status_2            = 0x00001678,
+			.addr_status_3            = 0x0000167C,
+			.debug_status_cfg         = 0x00001680,
+			.debug_status_0           = 0x00001684,
+			.debug_status_1           = 0x00001688,
+			.comp_group               = CAM_SFE_BUS_WR_COMP_GRP_9,
+		},
+	},
+	.num_out = 13,
+	.sfe_out_hw_info = {
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_1,
+			.num_wm        = 1,
+			.wm_idx        = 8,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_2,
+			.num_wm        = 1,
+			.wm_idx        = 9,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_3,
+			.num_wm        = 1,
+			.wm_idx        = 10,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_4,
+			.num_wm        = 1,
+			.wm_idx        = 11,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RDI4,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_4,
+			.num_wm        = 1,
+			.wm_idx        = 12,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_RAW_DUMP,
+			.max_width     = 9312,
+			.max_height    = 6992,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = 0,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_LCR,
+			.max_width     = 9312,
+			.max_height    = 2048,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = 1,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = 2,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_0,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = 3,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = 4,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_1,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = 5,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BE_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = 6,
+		},
+		{
+			.sfe_out_type  = CAM_SFE_BUS_SFE_OUT_BHIST_2,
+			.max_width     = 7296,
+			.max_height    = 5472,
+			.source_group  = CAM_SFE_BUS_WR_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = 7,
+		},
+	},
+	.num_comp_grp    = 10,
+	.comp_done_shift = 17,
+	.top_irq_shift   = 0x0,
+};
+
+static struct cam_irq_register_set sfe680_top_irq_reg_set[1] = {
+{
+	.mask_reg_offset   = 0x00000020,
+	.clear_reg_offset  = 0x00000024,
+	.status_reg_offset = 0x00000028,
+	},
+};
+
+static struct cam_irq_controller_reg_info sfe680_top_irq_reg_info = {
+	.num_registers = 1,
+	.irq_reg_set = sfe680_top_irq_reg_set,
+	.global_clear_offset  = 0x0000001C,
+	.global_clear_bitmask = 0x00000001,
+};
+
+struct cam_sfe_hw_info cam_sfe680_hw_info = {
+	.irq_reg_info                  = &sfe680_top_irq_reg_info,
+
+	.bus_wr_version                = CAM_SFE_BUS_WR_VER_1_0,
+	.bus_wr_hw_info                = &sfe680_bus_wr_hw_info,
+
+	.bus_rd_version                = CAM_SFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &sfe680_bus_rd_hw_info,
+
+	.top_version                   = CAM_SFE_TOP_VER_1_0,
+	.top_hw_info                   = &sfe680_top_hw_info,
+};
+
+#endif /* _CAM_SFE680_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.c
@@ -0,0 +1,503 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/list.h>
+#include "cam_tasklet_util.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_sfe_soc.h"
+#include "cam_sfe_core.h"
+#include "cam_debug_util.h"
+
+static const char drv_name[] = "sfe";
+
+int cam_sfe_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_sfe_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_sfe_read(void *device_priv,
+	void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_sfe_write(void *device_priv,
+	void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_sfe_init_hw(void *hw_priv, void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *sfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	sfe_hw->open_count++;
+	if (sfe_hw->open_count > 1) {
+		mutex_unlock(&sfe_hw->hw_mutex);
+		CAM_DBG(CAM_SFE, "SFE has already been initialized cnt: %d",
+			sfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&sfe_hw->hw_mutex);
+
+	soc_info = &sfe_hw->soc_info;
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+
+	/* Turn ON Regulators, Clocks and other SOC resources */
+	rc = cam_sfe_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Enable SOC failed");
+		rc = -EFAULT;
+		goto decrement_open_cnt;
+	}
+
+	CAM_DBG(CAM_SFE, "SFE SOC resource enabled");
+
+	/* Async Reset as part of power ON */
+	/* Sync Reset in CSID */
+
+	/* INIT SFE BUS WR */
+	rc = core_info->sfe_bus_wr->hw_ops.init(
+		core_info->sfe_bus_wr->bus_priv, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_SFE,
+			"SFE bus wr init failed rc: %d", rc);
+		goto disable_soc;
+	}
+
+	/* INIT SFE BUS RD */
+	rc = core_info->sfe_bus_rd->hw_ops.init(
+		core_info->sfe_bus_rd->bus_priv, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE bus rd init failed rc: %d", rc);
+		goto deinit_bus_wr;
+	}
+
+	sfe_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	return rc;
+
+deinit_bus_wr:
+	core_info->sfe_bus_wr->hw_ops.deinit(
+		core_info->sfe_bus_wr->bus_priv, NULL, 0);
+disable_soc:
+	cam_sfe_disable_soc_resources(soc_info);
+decrement_open_cnt:
+	mutex_lock(&sfe_hw->hw_mutex);
+	sfe_hw->open_count--;
+	mutex_unlock(&sfe_hw->hw_mutex);
+	return rc;
+}
+
+int cam_sfe_deinit_hw(void *hw_priv, void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *sfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	if (!sfe_hw->open_count) {
+		mutex_unlock(&sfe_hw->hw_mutex);
+		CAM_ERR(CAM_SFE, "Unbalanced deinit");
+		return -EFAULT;
+	}
+
+	sfe_hw->open_count--;
+	if (sfe_hw->open_count) {
+		mutex_unlock(&sfe_hw->hw_mutex);
+		CAM_DBG(CAM_SFE, "open_cnt non-zero: %d",
+			sfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&sfe_hw->hw_mutex);
+
+	soc_info = &sfe_hw->soc_info;
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+
+	rc = core_info->sfe_bus_wr->hw_ops.deinit(
+		core_info->sfe_bus_wr->bus_priv, NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_SFE, "SFE bus wr deinit failed rc: %d",
+			rc);
+
+	rc = core_info->sfe_bus_rd->hw_ops.deinit(
+		core_info->sfe_bus_rd->bus_priv, NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_SFE, "SFE bus rd deinit failed rc: %d",
+			rc);
+
+	/* Turn OFF Regulators, Clocks and other SOC resources */
+	CAM_DBG(CAM_SFE, "Disable SFE SOC resource");
+	rc = cam_sfe_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_SFE, "Disable SOC failed");
+
+	sfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	CAM_DBG(CAM_SFE, "SFE deinit done rc: %d", rc);
+	return rc;
+}
+
+int cam_sfe_reserve(void *hw_priv, void *reserve_args, uint32_t arg_size)
+{
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *sfe_hw  = hw_priv;
+	struct cam_sfe_acquire_args       *acquire;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_sfe_acquire_args))) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+	acquire = (struct cam_sfe_acquire_args   *)reserve_args;
+
+	CAM_DBG(CAM_SFE, "SFE acquire for res type: %d",
+		acquire->rsrc_type);
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	if (acquire->rsrc_type == CAM_ISP_RESOURCE_SFE_IN)
+		rc = core_info->sfe_top->hw_ops.reserve(
+			core_info->sfe_top->top_priv,
+			reserve_args, arg_size);
+	else if (acquire->rsrc_type == CAM_ISP_RESOURCE_SFE_OUT)
+		rc = core_info->sfe_bus_wr->hw_ops.reserve(
+			core_info->sfe_bus_wr->bus_priv, acquire,
+			sizeof(*acquire));
+	else if (acquire->rsrc_type == CAM_ISP_RESOURCE_SFE_RD)
+		rc = core_info->sfe_bus_rd->hw_ops.reserve(
+			core_info->sfe_bus_rd->bus_priv, acquire,
+			sizeof(*acquire));
+	else
+		CAM_ERR(CAM_SFE, "Invalid SFE res_type: %d",
+			acquire->rsrc_type);
+	mutex_unlock(&sfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_sfe_release(void *hw_priv, void *release_args, uint32_t arg_size)
+{
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *sfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *sfe_res;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_sfe_hw_core_info *) sfe_hw->core_info;
+	sfe_res = (struct cam_isp_resource_node  *) release_args;
+
+	CAM_DBG(CAM_SFE, "SFE release for res type: %d",
+		sfe_res->res_type);
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_IN)
+		rc = core_info->sfe_top->hw_ops.release(
+			core_info->sfe_top->top_priv, sfe_res,
+			sizeof(struct cam_isp_resource_node));
+	else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_OUT)
+		rc = core_info->sfe_bus_wr->hw_ops.release(
+			core_info->sfe_bus_wr->bus_priv, sfe_res,
+			sizeof(*sfe_res));
+	else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_RD)
+		rc = core_info->sfe_bus_rd->hw_ops.release(
+			core_info->sfe_bus_rd->bus_priv, sfe_res,
+			sizeof(*sfe_res));
+	else
+		CAM_ERR(CAM_SFE, "Invalid SFE res type: %d",
+			sfe_res->res_type);
+	mutex_unlock(&sfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_sfe_start(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *sfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *sfe_res;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	int                                rc;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &sfe_hw->soc_info;
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+	sfe_res = (struct cam_isp_resource_node  *)start_args;
+	core_info->tasklet_info = sfe_res->tasklet_info;
+
+	mutex_lock(&sfe_hw->hw_mutex);
+	if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_IN) {
+		rc = core_info->sfe_top->hw_ops.start(
+			core_info->sfe_top->top_priv, sfe_res,
+			sizeof(struct cam_isp_resource_node));
+		if (rc)
+			CAM_ERR(CAM_SFE, "Failed to start SFE IN rc: %d", rc);
+	} else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_OUT) {
+		rc = core_info->sfe_bus_wr->hw_ops.start(sfe_res, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Failed to start SFE BUS WR rc: %d",
+				rc);
+	} else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_RD) {
+		rc = core_info->sfe_bus_rd->hw_ops.start(sfe_res,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Failed to start SFE BUS RD rc: %d",
+				rc);
+	} else {
+		CAM_ERR(CAM_SFE, "Invalid SFE res type:%d",
+			sfe_res->res_type);
+		rc = -EINVAL;
+	}
+
+	mutex_unlock(&sfe_hw->hw_mutex);
+	CAM_DBG(CAM_SFE,
+		"Start for SFE res type: %u res id: %u res_state: %d rc: %d",
+		sfe_res->res_type, sfe_res->res_id,
+		sfe_res->res_state, rc);
+	return rc;
+}
+
+int cam_sfe_stop(void *hw_priv, void *stop_args, uint32_t arg_size)
+{
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *sfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *sfe_res;
+	int rc = -EINVAL;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+	sfe_res = (struct cam_isp_resource_node  *)stop_args;
+	mutex_lock(&sfe_hw->hw_mutex);
+
+	if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_IN)
+		rc = core_info->sfe_top->hw_ops.stop(
+			core_info->sfe_top->top_priv, sfe_res,
+			sizeof(struct cam_isp_resource_node));
+	else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_OUT)
+		rc = core_info->sfe_bus_wr->hw_ops.stop(sfe_res, NULL, 0);
+	else if (sfe_res->res_type == CAM_ISP_RESOURCE_SFE_RD)
+		rc = core_info->sfe_bus_rd->hw_ops.stop(sfe_res, NULL, 0);
+	else
+		CAM_ERR(CAM_SFE, "Invalid SFE res type: %d", sfe_res->res_type);
+
+	mutex_unlock(&sfe_hw->hw_mutex);
+	CAM_DBG(CAM_SFE,
+			"Stop for SFE res type: %u res id: %u res_state: %d rc: %d",
+			sfe_res->res_type, sfe_res->res_id,
+			sfe_res->res_state, rc);
+
+	return rc;
+}
+
+int cam_sfe_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *sfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_sfe_hw_info            *hw_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &sfe_hw->soc_info;
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+	hw_info = core_info->sfe_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = core_info->sfe_top->hw_ops.process_cmd(
+			core_info->sfe_top->top_priv, cmd_type,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+	case CAM_ISP_HW_CMD_GET_SECURE_MODE:
+		rc = core_info->sfe_bus_wr->hw_ops.process_cmd(
+			core_info->sfe_bus_wr->bus_priv, cmd_type,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE_RM:
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM:
+	case CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD:
+		rc = core_info->sfe_bus_rd->hw_ops.process_cmd(
+			core_info->sfe_bus_rd->bus_priv, cmd_type,
+			cmd_args, arg_size);
+		break;
+	case  CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ:
+		/* Needs to be handled based on hw_mgr change */
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Invalid cmd type: %d", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+irqreturn_t cam_sfe_irq(int irq_num, void *data)
+{
+	struct cam_hw_info            *sfe_hw;
+	struct cam_sfe_hw_core_info   *core_info;
+
+	if (!data)
+		return IRQ_NONE;
+
+	sfe_hw = (struct cam_hw_info *)data;
+	core_info = (struct cam_sfe_hw_core_info *)sfe_hw->core_info;
+
+	return cam_irq_controller_handle_irq(irq_num,
+		core_info->sfe_irq_controller);
+}
+
+int cam_sfe_core_init(
+	struct cam_sfe_hw_core_info  *core_info,
+	struct cam_hw_soc_info       *soc_info,
+	struct cam_hw_intf           *hw_intf,
+	struct cam_sfe_hw_info       *sfe_hw_info)
+{
+	int rc = -EINVAL;
+
+	rc = cam_irq_controller_init(drv_name,
+		CAM_SOC_GET_REG_MAP_START(soc_info, SFE_CORE_BASE_IDX),
+		sfe_hw_info->irq_reg_info, &core_info->sfe_irq_controller,
+		true);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE irq controller init failed");
+		return rc;
+	}
+
+	rc = cam_sfe_top_init(sfe_hw_info->top_version, soc_info, hw_intf,
+		sfe_hw_info->top_hw_info, core_info->sfe_irq_controller,
+		&core_info->sfe_top);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE top init failed rc: %d", rc);
+		goto deinit_controller;
+	}
+
+	rc = cam_sfe_bus_init(sfe_hw_info->bus_wr_version, BUS_TYPE_SFE_WR,
+		soc_info, hw_intf, sfe_hw_info->bus_wr_hw_info,
+		core_info->sfe_irq_controller,
+		&core_info->sfe_bus_wr);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE bus wr init failed rc: %d", rc);
+		goto deinit_top;
+	}
+
+	rc = cam_sfe_bus_init(sfe_hw_info->bus_rd_version, BUS_TYPE_SFE_RD,
+		soc_info, hw_intf, sfe_hw_info->bus_rd_hw_info,
+		core_info->sfe_irq_controller,
+		&core_info->sfe_bus_rd);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "SFE bus rd init failed rc: %d", rc);
+		goto deinit_bus_wr;
+	}
+
+	spin_lock_init(&core_info->spin_lock);
+	CAM_DBG(CAM_SFE, "SFE device [%u] INIT success",
+		hw_intf->hw_idx);
+	return rc;
+
+deinit_bus_wr:
+	cam_sfe_bus_deinit(BUS_TYPE_SFE_WR,
+		sfe_hw_info->bus_wr_version,
+		&core_info->sfe_bus_wr);
+deinit_top:
+	cam_sfe_top_deinit(sfe_hw_info->top_version,
+		&core_info->sfe_top);
+deinit_controller:
+	if (cam_irq_controller_deinit(&core_info->sfe_irq_controller))
+		CAM_ERR(CAM_SFE,
+			"Error cam_irq_controller_deinit failed rc=%d", rc);
+
+	return rc;
+}
+
+int cam_sfe_core_deinit(
+	struct cam_sfe_hw_core_info  *core_info,
+	struct cam_sfe_hw_info       *sfe_hw_info)
+{
+	int                rc = -EINVAL;
+	unsigned long      flags;
+
+	spin_lock_irqsave(&core_info->spin_lock, flags);
+
+	rc = cam_sfe_bus_deinit(BUS_TYPE_SFE_RD,
+		sfe_hw_info->bus_rd_version,
+		&core_info->sfe_bus_rd);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"SFE bus rd deinit failed rc: %d", rc);
+
+	rc = cam_sfe_bus_deinit(BUS_TYPE_SFE_WR,
+			sfe_hw_info->bus_wr_version,
+			&core_info->sfe_bus_wr);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"SFE bus wr deinit failed rc: %d", rc);
+
+	rc = cam_sfe_top_deinit(sfe_hw_info->top_version,
+		&core_info->sfe_top);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"SFE top deinit failed rc: %d", rc);
+
+	rc = cam_irq_controller_deinit(&core_info->sfe_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"Error cam_irq_controller_deinit failed rc=%d", rc);
+
+	spin_unlock_irqrestore(&core_info->spin_lock, flags);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_core.h
@@ -0,0 +1,73 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_CORE_H_
+#define _CAM_SFE_CORE_H_
+
+#include <linux/spinlock.h>
+#include "cam_hw_intf.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_top.h"
+
+#define CAM_SFE_EVT_MAX                        256
+
+struct cam_sfe_hw_info {
+	struct cam_irq_controller_reg_info *irq_reg_info;
+
+	uint32_t                            bus_wr_version;
+	void                               *bus_wr_hw_info;
+
+	uint32_t                            bus_rd_version;
+	void                               *bus_rd_hw_info;
+
+	uint32_t                            top_version;
+	void                               *top_hw_info;
+};
+
+struct cam_sfe_hw_core_info {
+	struct cam_sfe_hw_info             *sfe_hw_info;
+	struct cam_sfe_top                 *sfe_top;
+	struct cam_sfe_bus                 *sfe_bus_wr;
+	struct cam_sfe_bus                 *sfe_bus_rd;
+	void                               *sfe_irq_controller;
+	void                               *tasklet_info;
+	spinlock_t                          spin_lock;
+};
+
+int cam_sfe_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_sfe_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size);
+int cam_sfe_read(void *device_priv,
+	void *read_args, uint32_t arg_size);
+int cam_sfe_write(void *device_priv,
+	void *write_args, uint32_t arg_size);
+int cam_sfe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_sfe_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_sfe_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_sfe_release(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_sfe_start(void *device_priv,
+	void *start_args, uint32_t arg_size);
+int cam_sfe_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_sfe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+irqreturn_t cam_sfe_irq(int irq_num, void *data);
+
+int cam_sfe_core_init(struct cam_sfe_hw_core_info *core_info,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	struct cam_sfe_hw_info             *sfe_hw_info);
+
+int cam_sfe_core_deinit(struct cam_sfe_hw_core_info *core_info,
+	struct cam_sfe_hw_info             *sfe_hw_info);
+
+#endif /* _CAM_SFE_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.c
@@ -0,0 +1,262 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/module.h>
+#include "cam_sfe_dev.h"
+#include "cam_sfe_core.h"
+#include "cam_sfe_soc.h"
+#include "cam_sfe680.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_hw_intf *cam_sfe_hw_list[CAM_SFE_HW_NUM_MAX];
+
+static char sfe_dev_name[8];
+
+static int cam_sfe_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+
+	struct cam_hw_info                *sfe_info = NULL;
+	struct cam_hw_intf                *sfe_hw_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct cam_sfe_hw_info            *hw_info = NULL;
+	struct platform_device            *pdev = NULL;
+	int                                rc = 0;
+
+	pdev = to_platform_device(dev);
+	sfe_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!sfe_hw_intf) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &sfe_hw_intf->hw_idx);
+
+	sfe_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!sfe_info) {
+		rc = -ENOMEM;
+		goto free_sfe_hw_intf;
+	}
+
+	memset(sfe_dev_name, 0, sizeof(sfe_dev_name));
+	snprintf(sfe_dev_name, sizeof(sfe_dev_name),
+		"sfe%1u", sfe_hw_intf->hw_idx);
+
+	sfe_info->soc_info.pdev = pdev;
+	sfe_info->soc_info.dev = &pdev->dev;
+	sfe_info->soc_info.dev_name = sfe_dev_name;
+	sfe_hw_intf->hw_priv = sfe_info;
+	sfe_hw_intf->hw_ops.get_hw_caps = cam_sfe_get_hw_caps;
+	sfe_hw_intf->hw_ops.init = cam_sfe_init_hw;
+	sfe_hw_intf->hw_ops.deinit = cam_sfe_deinit_hw;
+	sfe_hw_intf->hw_ops.reset = cam_sfe_reset;
+	sfe_hw_intf->hw_ops.reserve = cam_sfe_reserve;
+	sfe_hw_intf->hw_ops.release = cam_sfe_release;
+	sfe_hw_intf->hw_ops.start = cam_sfe_start;
+	sfe_hw_intf->hw_ops.stop = cam_sfe_stop;
+	sfe_hw_intf->hw_ops.read = cam_sfe_read;
+	sfe_hw_intf->hw_ops.write = cam_sfe_write;
+	sfe_hw_intf->hw_ops.process_cmd = cam_sfe_process_cmd;
+	sfe_hw_intf->hw_type = CAM_ISP_HW_TYPE_SFE;
+
+	CAM_DBG(CAM_SFE, "SFE component bind type %d index %d",
+		sfe_hw_intf->hw_type, sfe_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, sfe_hw_intf);
+
+	sfe_info->core_info = kzalloc(sizeof(struct cam_sfe_hw_core_info),
+		GFP_KERNEL);
+	if (!sfe_info->core_info) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for core");
+		rc = -ENOMEM;
+		goto free_sfe_hw;
+	}
+	core_info = (struct cam_sfe_hw_core_info *)sfe_info->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_SFE, "Of_match Failed");
+		rc = -EINVAL;
+		goto free_core_info;
+	}
+	hw_info = (struct cam_sfe_hw_info *)match_dev->data;
+	core_info->sfe_hw_info = hw_info;
+
+	rc = cam_sfe_init_soc_resources(&sfe_info->soc_info, cam_sfe_irq,
+		sfe_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE, "Failed to init soc rc=%d", rc);
+		goto free_core_info;
+	}
+
+	rc = cam_sfe_core_init(core_info, &sfe_info->soc_info,
+		sfe_hw_intf, hw_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE, "Failed to init core rc=%d", rc);
+		goto deinit_soc;
+	}
+
+	sfe_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&sfe_info->hw_mutex);
+	spin_lock_init(&sfe_info->hw_lock);
+	init_completion(&sfe_info->hw_complete);
+
+	if (sfe_hw_intf->hw_idx < CAM_SFE_HW_NUM_MAX)
+		cam_sfe_hw_list[sfe_hw_intf->hw_idx] = sfe_hw_intf;
+
+	CAM_DBG(CAM_SFE, "SFE%d bound successfully",
+		sfe_hw_intf->hw_idx);
+
+	return rc;
+
+deinit_soc:
+	if (cam_sfe_deinit_soc_resources(&sfe_info->soc_info))
+		CAM_ERR(CAM_SFE, "Failed to deinit soc");
+free_core_info:
+	kfree(sfe_info->core_info);
+free_sfe_hw:
+	kfree(sfe_info);
+free_sfe_hw_intf:
+	kfree(sfe_hw_intf);
+end:
+	return rc;
+}
+
+static void cam_sfe_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+
+	struct cam_hw_info                *sfe_info = NULL;
+	struct cam_hw_intf                *sfe_hw_intf = NULL;
+	struct cam_sfe_hw_core_info       *core_info = NULL;
+	struct platform_device            *pdev = NULL;
+	int                                rc = 0;
+
+	pdev = to_platform_device(dev);
+	sfe_hw_intf = platform_get_drvdata(pdev);
+	if (!sfe_hw_intf) {
+		CAM_ERR(CAM_SFE, "Error! No data in pdev");
+		return;
+	}
+
+	CAM_DBG(CAM_SFE, "SFE component unbound type %d index %d",
+		sfe_hw_intf->hw_type, sfe_hw_intf->hw_idx);
+
+	if (sfe_hw_intf->hw_idx < CAM_SFE_HW_NUM_MAX)
+		cam_sfe_hw_list[sfe_hw_intf->hw_idx] = NULL;
+
+	sfe_info = sfe_hw_intf->hw_priv;
+	if (!sfe_info) {
+		CAM_ERR(CAM_SFE, "HW data is NULL");
+		rc = -ENODEV;
+		goto free_sfe_hw_intf;
+	}
+
+	core_info = (struct cam_sfe_hw_core_info *)sfe_info->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_SFE, "core data NULL");
+		rc = -EINVAL;
+		goto deinit_soc;
+	}
+
+	rc = cam_sfe_core_deinit(core_info, core_info->sfe_hw_info);
+	if (rc < 0)
+		CAM_ERR(CAM_SFE, "Failed to deinit core rc=%d", rc);
+
+	kfree(sfe_info->core_info);
+
+deinit_soc:
+	rc = cam_sfe_deinit_soc_resources(&sfe_info->soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_SFE, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&sfe_info->hw_mutex);
+	kfree(sfe_info);
+
+	CAM_DBG(CAM_SFE, "SFE%d remove successful", sfe_hw_intf->hw_idx);
+
+free_sfe_hw_intf:
+	kfree(sfe_hw_intf);
+}
+
+const static struct component_ops cam_sfe_component_ops = {
+	.bind = cam_sfe_component_bind,
+	.unbind = cam_sfe_component_unbind,
+};
+
+static int cam_sfe_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_SFE, "Adding SFE component");
+	rc = component_add(&pdev->dev, &cam_sfe_component_ops);
+	if (rc)
+		CAM_ERR(CAM_SFE, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_sfe_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_sfe_component_ops);
+	return 0;
+}
+
+int cam_sfe_hw_init(struct cam_hw_intf **sfe_hw, uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_sfe_hw_list[hw_idx]) {
+		*sfe_hw = cam_sfe_hw_list[hw_idx];
+		rc = 0;
+	} else {
+		*sfe_hw = NULL;
+		rc = -ENODEV;
+	}
+
+	return rc;
+}
+
+static const struct of_device_id cam_sfe_dt_match[] = {
+	{
+		.compatible = "",
+		.data = &cam_sfe680_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_sfe_dt_match);
+
+struct platform_driver cam_sfe_driver = {
+	.probe = cam_sfe_probe,
+	.remove = cam_sfe_remove,
+	.driver = {
+		.name = "cam_sfe",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_sfe_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_sfe_init_module(void)
+{
+	return platform_driver_register(&cam_sfe_driver);
+}
+
+
+void cam_sfe_exit_module(void)
+{
+	platform_driver_unregister(&cam_sfe_driver);
+}
+
+MODULE_DESCRIPTION("CAM SFE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_DEV_H_
+#define _CAM_SFE_DEV_H_
+
+/**
+ * @brief : API to register SFE hw to platform framework.
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_init_module(void);
+
+/**
+ * @brief : API to remove SFE  Hw from platform framework.
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+void cam_sfe_exit_module(void);
+
+#endif /* _CAM_SFE_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.c
@@ -0,0 +1,216 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_cpas_api.h"
+#include "cam_sfe_soc.h"
+#include "cam_debug_util.h"
+
+static int cam_sfe_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc)
+		CAM_ERR(CAM_SFE, "Error get DT properties failed rc=%d", rc);
+
+	return rc;
+}
+
+static int cam_sfe_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler_func, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler_func,
+		irq_data);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"Error Request platform resource failed rc=%d", rc);
+
+	return rc;
+}
+
+static int cam_sfe_release_platform_resource(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"Error Release platform resource failed rc=%d", rc);
+
+	return rc;
+}
+
+int cam_sfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler_func, void *irq_data)
+{
+	int rc = 0;
+	struct cam_sfe_soc_private       *soc_private;
+	struct cam_cpas_register_params   cpas_register_param;
+
+	soc_private = kzalloc(sizeof(struct cam_sfe_soc_private),
+		GFP_KERNEL);
+	if (!soc_private)
+		return -ENOMEM;
+
+	soc_info->soc_private = soc_private;
+	rc = cam_cpas_get_cpas_hw_version(&soc_private->cpas_version);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Error! Invalid cpas version rc=%d", rc);
+		goto free_soc_private;
+	}
+	soc_info->hw_version = soc_private->cpas_version;
+
+	rc = cam_sfe_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE, "Error Get DT properties failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	rc = cam_sfe_request_platform_resource(soc_info,
+		irq_handler_func, irq_data);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE,
+			"Error Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "sfe",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	cpas_register_param.cam_cpas_client_cb = NULL;
+	cpas_register_param.userdata = soc_info;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	} else {
+		soc_private->cpas_handle = cpas_register_param.client_handle;
+	}
+
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+	return rc;
+}
+
+int cam_sfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_sfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_SFE, "Error soc_info NULL");
+		return -ENODEV;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_SFE, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_SFE, "CPAS unregistration failed rc=%d", rc);
+
+	rc = cam_sfe_release_platform_resource(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_SFE,
+			"Error Release platform resources failed rc=%d", rc);
+
+	kfree(soc_private);
+	return rc;
+}
+
+int cam_sfe_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_sfe_soc_private       *soc_private;
+	struct cam_ahb_vote               ahb_vote;
+	struct cam_axi_vote               axi_vote = {0};
+
+	if (!soc_info) {
+		CAM_ERR(CAM_SFE, "Error! Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type       = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_SFE_NRDI;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[0].camnoc_bw = 10640000000L;
+	axi_vote.axi_path[0].mnoc_ab_bw = 10640000000L;
+	axi_vote.axi_path[0].mnoc_ib_bw = 10640000000L;
+
+	rc = cam_cpas_start(soc_private->cpas_handle,
+			&ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "CPAS start failed rc=%d", rc);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_LOWSVS_VOTE, true);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Enable platform failed rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_sfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	return -EPERM;
+}
+
+int cam_sfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	return -EPERM;
+}
+
+int cam_sfe_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_sfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_SFE, "Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc)
+		CAM_ERR(CAM_SFE, "Disable platform failed rc=%d", rc);
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_SFE, "CPAS stop failed rc=%d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_soc.h
@@ -0,0 +1,106 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_SOC_H_
+#define _CAM_SFE_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_isp_hw.h"
+
+/*
+ * struct cam_sfe_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to SFE HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ * @cpas_version:            CPAS version
+ */
+struct cam_sfe_soc_private {
+	uint32_t    cpas_handle;
+	uint32_t    cpas_version;
+};
+
+/*
+ * cam_sfe_init_soc_resources()
+ *
+ * @Brief:                   Initialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ * @handler:                 Irq handler function pointer
+ * @irq_data:                Irq handler function Callback data
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t sfe_irq_handler, void *irq_data);
+
+/*
+ * cam_sfe_deinit_soc_resources()
+ *
+ * @Brief:                   Deinitialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_sfe_enable_soc_resources()
+ *
+ * @brief:                   Enable regulator, irq resources, Clocks
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_sfe_disable_soc_resources()
+ *
+ * @brief:                   Disable regulator, irq resources, Clocks
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_sfe_soc_enable_clk()
+ *
+ * @brief:                   Enable clock wsfe given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+extern int cam_sfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+/*
+ * cam_sfe_soc_disable_clk()
+ *
+ * @brief:                   Disable clock wsfe given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+#endif /* _CAM_SFE_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus.c
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+#include "cam_sfe_bus_wr.h"
+#include "cam_debug_util.h"
+
+int cam_sfe_bus_init(
+	uint32_t                       bus_version,
+	int                            bus_type,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *bus_hw_info,
+	void                          *sfe_irq_controller,
+	struct cam_sfe_bus           **sfe_bus)
+{
+	int rc = -ENODEV;
+
+	switch (bus_type) {
+	case BUS_TYPE_SFE_WR:
+		switch (bus_version) {
+		case CAM_SFE_BUS_WR_VER_1_0:
+			rc = cam_sfe_bus_wr_init(soc_info, hw_intf,
+				bus_hw_info, sfe_irq_controller, sfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Unsupported Bus WR Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	case BUS_TYPE_SFE_RD:
+		switch (bus_version) {
+		case CAM_SFE_BUS_RD_VER_1_0:
+			rc = cam_sfe_bus_rd_init(soc_info, hw_intf,
+				bus_hw_info, sfe_irq_controller, sfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Unsupported Bus RD Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Unsupported Bus type %d", bus_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_sfe_bus_deinit(
+	uint32_t              bus_version,
+	int                   bus_type,
+	struct cam_sfe_bus  **sfe_bus)
+{
+	int rc = -ENODEV;
+
+	switch (bus_type) {
+	case BUS_TYPE_SFE_WR:
+		switch (bus_version) {
+		case CAM_SFE_BUS_WR_VER_1_0:
+			rc = cam_sfe_bus_wr_deinit(sfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Unsupported Bus WR Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	case BUS_TYPE_SFE_RD:
+		switch (bus_version) {
+		case CAM_SFE_BUS_RD_VER_1_0:
+			rc = cam_sfe_bus_rd_deinit(sfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Unsupported Bus RD Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Unsupported Bus type %d", bus_type);
+		break;
+	}
+
+	return rc;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.c
@@ -0,0 +1,1396 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_rd.h"
+#include "cam_sfe_core.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+
+static const char drv_name[] = "sfe_bus_rd";
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	(sizeof(struct cam_sfe_bus_rd_reg_offset_bus_client)/4)
+
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+#define BUS_RD_DEFAULT_LATENCY_BUF_ALLOC   512
+#define CAM_SFE_BUS_RD_PAYLOAD_MAX         16
+
+static uint32_t bus_rd_error_irq_mask[1] = {
+	0x00000001,
+};
+
+enum cam_sfe_bus_rd_unpacker_format {
+	BUS_RD_UNPACKER_FMT_PLAIN_128             = 0x0,
+	BUS_RD_UNPACKER_FMT_PLAIN_8               = 0x1,
+	BUS_RD_UNPACKER_FMT_PLAIN_16_10BPP        = 0x2,
+	BUS_RD_UNPACKER_FMT_PLAIN_16_12BPP        = 0x3,
+	BUS_RD_UNPACKER_FMT_PLAIN_16_14BPP        = 0x4,
+	BUS_RD_UNPACKER_FMT_PLAIN_32_20BPP        = 0x5,
+	BUS_RD_UNPACKER_FMT_ARGB_10               = 0x6,
+	BUS_RD_UNPACKER_FMT_ARGB_12               = 0x7,
+	BUS_RD_UNPACKER_FMT_ARGB_14               = 0x8,
+	BUS_RD_UNPACKER_FMT_PLAIN_32              = 0x9,
+	BUS_RD_UNPACKER_FMT_PLAIN_64              = 0xA,
+	BUS_RD_UNPACKER_FMT_TP_10                 = 0xB,
+	BUS_RD_UNPACKER_FMT_MIPI8                 = 0xC,
+	BUS_RD_UNPACKER_FMT_MIPI10                = 0xD,
+	BUS_RD_UNPACKER_FMT_MIPI12                = 0xE,
+	BUS_RD_UNPACKER_FMT_MIPI14                = 0xF,
+	BUS_RD_UNPACKER_FMT_PLAIN_16_16BPP        = 0x10,
+	BUS_RD_UNPACKER_FMT_PLAIN_128_ODD_EVEN    = 0x11,
+	BUS_RD_UNPACKER_FMT_PLAIN_8_ODD_EVEN      = 0x12,
+	BUS_RD_UNPACKER_FMT_MAX                   = 0x13,
+};
+
+struct cam_sfe_bus_rd_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_sfe_bus_rd_reg_offset_common    *common_reg;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+	void                                       *bus_irq_controller;
+	void                                       *sfe_irq_controller;
+	spinlock_t                                  spin_lock;
+	struct list_head                            free_payload_list;
+	struct cam_sfe_bus_rd_irq_evt_payload       evt_payload[
+		CAM_SFE_BUS_RD_PAYLOAD_MAX];
+	cam_hw_mgr_event_cb_func                    event_cb;
+};
+
+struct cam_sfe_bus_rd_rm_resource_data {
+	uint32_t             index;
+	struct cam_sfe_bus_rd_common_data            *common_data;
+	struct cam_sfe_bus_rd_reg_offset_bus_client  *hw_regs;
+	void                *ctx;
+	uint32_t             min_vbi;
+	uint32_t             fs_mode;
+	uint32_t             hbi_count;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	uint32_t             latency_buf_allocation;
+	uint32_t             unpacker_cfg;
+	uint32_t             burst_len;
+	uint32_t             en_cfg;
+	uint32_t             img_addr;
+	uint32_t             input_if_cmd;
+};
+
+struct cam_sfe_bus_rd_data {
+	uint32_t                           bus_rd_type;
+	struct cam_sfe_bus_rd_common_data *common_data;
+
+	uint32_t                           num_rm;
+	struct cam_isp_resource_node      *rm_res[PLANE_MAX];
+	uint32_t                           format;
+	uint32_t                           max_width;
+	uint32_t                           max_height;
+	struct cam_cdm_utils_ops          *cdm_util_ops;
+	void                              *priv;
+	uint32_t                           secure_mode;
+	uint32_t                           fs_sync_enable;
+	uint32_t                           fs_line_sync_en;
+	bool                               is_offline;
+};
+
+struct cam_sfe_bus_rd_priv {
+	struct cam_sfe_bus_rd_common_data   common_data;
+	uint32_t                            num_client;
+	uint32_t                            num_bus_rd_resc;
+
+	struct cam_isp_resource_node  bus_client[
+		CAM_SFE_BUS_RD_MAX_CLIENTS];
+	struct cam_isp_resource_node  sfe_bus_rd[
+		CAM_SFE_BUS_RD_MAX];
+
+	int                                 irq_handle;
+	int                                 error_irq_handle;
+	void                               *tasklet_info;
+	uint32_t                            top_irq_shift;
+};
+
+static void cam_sfe_bus_rd_pxls_to_bytes(uint32_t pxls, uint32_t fmt,
+	uint32_t *bytes)
+{
+	switch (fmt) {
+	case BUS_RD_UNPACKER_FMT_PLAIN_128:
+		*bytes = pxls * 16;
+		break;
+	case BUS_RD_UNPACKER_FMT_PLAIN_8:
+	case BUS_RD_UNPACKER_FMT_PLAIN_8_ODD_EVEN:
+	case BUS_RD_UNPACKER_FMT_PLAIN_16_10BPP:
+	case BUS_RD_UNPACKER_FMT_PLAIN_16_12BPP:
+	case BUS_RD_UNPACKER_FMT_PLAIN_16_14BPP:
+	case BUS_RD_UNPACKER_FMT_PLAIN_16_16BPP:
+	case BUS_RD_UNPACKER_FMT_ARGB_10:
+	case BUS_RD_UNPACKER_FMT_ARGB_12:
+	case BUS_RD_UNPACKER_FMT_ARGB_14:
+		*bytes = pxls * 2;
+		break;
+	case BUS_RD_UNPACKER_FMT_PLAIN_32_20BPP:
+	case BUS_RD_UNPACKER_FMT_PLAIN_32:
+		*bytes = pxls * 4;
+		break;
+	case BUS_RD_UNPACKER_FMT_PLAIN_64:
+		*bytes = pxls * 8;
+		break;
+	case BUS_RD_UNPACKER_FMT_TP_10:
+		*bytes = ALIGNUP(pxls, 3) * 4 / 3;
+		break;
+	case BUS_RD_UNPACKER_FMT_MIPI8:
+		*bytes = pxls;
+		break;
+	case BUS_RD_UNPACKER_FMT_MIPI10:
+		*bytes = ALIGNUP(pxls * 5, 4) / 4;
+		break;
+	case BUS_RD_UNPACKER_FMT_MIPI12:
+		*bytes = ALIGNUP(pxls * 3, 2) / 2;
+		break;
+	case BUS_RD_UNPACKER_FMT_MIPI14:
+		*bytes = ALIGNUP(pxls * 7, 4) / 4;
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Invalid unpacker_fmt:%d", fmt);
+		break;
+	}
+}
+
+static enum cam_sfe_bus_rd_unpacker_format
+	cam_sfe_bus_get_unpacker_fmt(uint32_t unpack_fmt)
+{
+	switch (unpack_fmt) {
+	case CAM_FORMAT_PLAIN128:
+		return BUS_RD_UNPACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_PLAIN8:
+		return BUS_RD_UNPACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_PLAIN16_10:
+		return BUS_RD_UNPACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return BUS_RD_UNPACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return BUS_RD_UNPACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN32_20:
+		return BUS_RD_UNPACKER_FMT_PLAIN_32_20BPP;
+	case CAM_FORMAT_ARGB_10:
+		return BUS_RD_UNPACKER_FMT_ARGB_10;
+	case CAM_FORMAT_ARGB_12:
+		return BUS_RD_UNPACKER_FMT_ARGB_12;
+	case CAM_FORMAT_ARGB_14:
+		return BUS_RD_UNPACKER_FMT_ARGB_14;
+	case CAM_FORMAT_PLAIN32:
+	case CAM_FORMAT_ARGB:
+		return BUS_RD_UNPACKER_FMT_PLAIN_32;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_ARGB_16:
+	case CAM_FORMAT_PD10:
+		return BUS_RD_UNPACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_TP10:
+		return BUS_RD_UNPACKER_FMT_TP_10;
+	case CAM_FORMAT_MIPI_RAW_8:
+		return BUS_RD_UNPACKER_FMT_MIPI8;
+	case CAM_FORMAT_MIPI_RAW_10:
+		return BUS_RD_UNPACKER_FMT_MIPI10;
+	case CAM_FORMAT_MIPI_RAW_12:
+		return BUS_RD_UNPACKER_FMT_MIPI12;
+	case CAM_FORMAT_MIPI_RAW_14:
+		return BUS_RD_UNPACKER_FMT_MIPI14;
+	case CAM_FORMAT_PLAIN16_16:
+		return BUS_RD_UNPACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN8_SWAP:
+		return BUS_RD_UNPACKER_FMT_PLAIN_8_ODD_EVEN;
+	default:
+		return BUS_RD_UNPACKER_FMT_MAX;
+	}
+}
+
+static enum cam_sfe_bus_rd_type
+	cam_sfe_bus_get_bus_rd_res_id(uint32_t res_type)
+{
+	switch (res_type) {
+	case CAM_ISP_HW_SFE_IN_RD0:
+		return CAM_SFE_BUS_RD_RDI0;
+	case CAM_ISP_HW_SFE_IN_RD1:
+		return CAM_SFE_BUS_RD_RDI1;
+	case CAM_ISP_HW_SFE_IN_RD2:
+		return CAM_SFE_BUS_RD_RDI2;
+	default:
+		return CAM_SFE_BUS_RD_MAX;
+	}
+}
+
+static int cam_sfe_bus_get_num_rm(
+	enum cam_sfe_bus_rd_type res_type)
+{
+	switch (res_type) {
+	case CAM_SFE_BUS_RD_RDI0:
+	case CAM_SFE_BUS_RD_RDI1:
+	case CAM_SFE_BUS_RD_RDI2:
+		return 1;
+	default:
+		CAM_ERR(CAM_SFE, "Unsupported resource_type %u", res_type);
+		return -EINVAL;
+	}
+}
+
+static int cam_sfe_bus_get_rm_idx(
+	enum cam_sfe_bus_rd_type    sfe_bus_rd_res_id,
+	enum cam_sfe_bus_plane_type plane)
+{
+	int rm_idx = -1;
+
+	switch (sfe_bus_rd_res_id) {
+	case CAM_SFE_BUS_RD_RDI0:
+		switch (plane) {
+		case PLANE_Y:
+			rm_idx = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_SFE_BUS_RD_RDI1:
+		switch (plane) {
+		case PLANE_Y:
+			rm_idx = 1;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_SFE_BUS_RD_RDI2:
+		switch (plane) {
+		case PLANE_Y:
+			rm_idx = 2;
+			break;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	return rm_idx;
+}
+
+static int cam_sfe_bus_rd_get_evt_payload(
+	struct cam_sfe_bus_rd_common_data      *common_data,
+	struct cam_sfe_bus_rd_irq_evt_payload **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&common_data->spin_lock);
+
+	if (list_empty(&common_data->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE,
+			"No free BUS RD event payload");
+		*evt_payload = NULL;
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&common_data->free_payload_list,
+		struct cam_sfe_bus_rd_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+
+done:
+	spin_unlock(&common_data->spin_lock);
+	return rc;
+}
+
+static int cam_sfe_bus_rd_put_evt_payload(
+	struct cam_sfe_bus_rd_common_data       *common_data,
+	struct cam_sfe_bus_rd_irq_evt_payload  **evt_payload)
+{
+	unsigned long flags;
+
+	if (!common_data) {
+		CAM_ERR(CAM_SFE, "Invalid param common_data NULL");
+		return -EINVAL;
+	}
+
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_SFE, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&common_data->spin_lock, flags);
+		list_add_tail(&(*evt_payload)->list,
+			&common_data->free_payload_list);
+	spin_unlock_irqrestore(&common_data->spin_lock, flags);
+
+	*evt_payload = NULL;
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_handle_irq(
+	uint32_t    evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	struct cam_sfe_bus_rd_priv *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	CAM_DBG(CAM_SFE, "Top Bus RD IRQ Received");
+
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller);
+
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_sfe_bus_acquire_rm(
+	struct cam_sfe_bus_rd_priv             *bus_rd_priv,
+	void                                   *tasklet,
+	void                                   *ctx,
+	enum cam_sfe_bus_rd_type                sfe_bus_rd_res_id,
+	enum cam_sfe_bus_plane_type             plane,
+	struct cam_isp_resource_node          **rm_res,
+	uint32_t                                unpacker_fmt)
+{
+	uint32_t                                rm_idx = 0;
+	struct cam_isp_resource_node           *rm_res_local = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data = NULL;
+
+	*rm_res = NULL;
+
+	rm_idx = cam_sfe_bus_get_rm_idx(sfe_bus_rd_res_id, plane);
+	if (rm_idx < 0 || rm_idx >= bus_rd_priv->num_client) {
+		CAM_ERR(CAM_SFE, "Unsupported SFE RM:%d plane:%d",
+			sfe_bus_rd_res_id, plane);
+		return -EINVAL;
+	}
+
+	rm_res_local = &bus_rd_priv->bus_client[rm_idx];
+	if (rm_res_local->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_SFE, "SFE:%d RM:%d res not available state:%d",
+			bus_rd_priv->common_data.core_index, rm_idx,
+			rm_res_local->res_state);
+		return -EALREADY;
+	}
+	rm_res_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rm_res_local->tasklet_info = tasklet;
+
+	rsrc_data = rm_res_local->res_priv;
+	rsrc_data->ctx = ctx;
+	rsrc_data->unpacker_cfg =
+		cam_sfe_bus_get_unpacker_fmt(unpacker_fmt);
+	rsrc_data->latency_buf_allocation =
+		BUS_RD_DEFAULT_LATENCY_BUF_ALLOC;
+
+	*rm_res = rm_res_local;
+
+	CAM_DBG(CAM_SFE, "SFE:%d RM:%d Acquired",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+	return 0;
+}
+
+static int cam_sfe_bus_release_rm(void          *bus_priv,
+	struct cam_isp_resource_node                *rm_res)
+{
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data =
+		rm_res->res_priv;
+
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->unpacker_cfg = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->en_cfg = 0;
+
+	rm_res->tasklet_info = NULL;
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_SFE, "SFE:%d RM:%d released",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+	return 0;
+}
+
+static int cam_sfe_bus_start_rm(struct cam_isp_resource_node *rm_res)
+{
+	struct cam_sfe_bus_rd_rm_resource_data  *rm_data;
+	struct cam_sfe_bus_rd_common_data       *common_data;
+
+	rm_data = rm_res->res_priv;
+	common_data = rm_data->common_data;
+
+	cam_io_w_mb(rm_data->width, common_data->mem_base +
+		rm_data->hw_regs->buf_width);
+	cam_io_w_mb(rm_data->height, common_data->mem_base +
+		rm_data->hw_regs->buf_height);
+	cam_io_w_mb(rm_data->width, common_data->mem_base +
+		rm_data->hw_regs->stride);
+	cam_io_w_mb(rm_data->unpacker_cfg, common_data->mem_base +
+		rm_data->hw_regs->unpacker_cfg);
+	cam_io_w_mb(rm_data->latency_buf_allocation, common_data->mem_base +
+		rm_data->hw_regs->latency_buf_allocation);
+	cam_io_w_mb(0x1, common_data->mem_base + rm_data->hw_regs->cfg);
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	CAM_DBG(CAM_SFE,
+		"Start SFE:%d RM:%d offset:0x%X en_cfg:0x%X width:%d height:%d",
+		rm_data->common_data->core_index, rm_data->index,
+		(uint32_t) rm_data->hw_regs->cfg, rm_data->en_cfg,
+		rm_data->width, rm_data->height);
+	CAM_DBG(CAM_SFE, "RM:%d pk_fmt:%d stride:%d", rm_data->index,
+		rm_data->unpacker_cfg, rm_data->stride);
+
+	return 0;
+}
+
+static int cam_sfe_bus_stop_rm(struct cam_isp_resource_node *rm_res)
+{
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data =
+		rm_res->res_priv;
+	struct cam_sfe_bus_rd_common_data      *common_data =
+		rsrc_data->common_data;
+
+	/* Disable RM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	CAM_DBG(CAM_SFE, "SFE:%d RM:%d stopped",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	return 0;
+}
+
+static int cam_sfe_bus_init_rm_resource(uint32_t index,
+	struct cam_sfe_bus_rd_priv     *bus_rd_priv,
+	struct cam_sfe_bus_rd_hw_info  *bus_rd_hw_info,
+	struct cam_isp_resource_node   *rm_res)
+{
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_rd_rm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_SFE, "Failed to alloc SFE:%d RM res priv",
+			bus_rd_priv->common_data.core_index);
+		return -ENOMEM;
+	}
+	rm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &bus_rd_hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &bus_rd_priv->common_data;
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&rm_res->list);
+
+	rm_res->start = cam_sfe_bus_start_rm;
+	rm_res->stop = cam_sfe_bus_stop_rm;
+	rm_res->hw_intf = bus_rd_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_rm_resource(
+	struct cam_isp_resource_node    *rm_res)
+{
+	struct cam_sfe_bus_rd_rm_resource_data *rsrc_data;
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&rm_res->list);
+
+	rm_res->start = NULL;
+	rm_res->stop = NULL;
+	rm_res->top_half_handler = NULL;
+	rm_res->bottom_half_handler = NULL;
+	rm_res->hw_intf = NULL;
+
+	rsrc_data = rm_res->res_priv;
+	rm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int i, rc = 0;
+	struct cam_sfe_bus_rd_priv *bus_priv;
+	struct cam_sfe_bus_rd_irq_evt_payload *evt_payload = NULL;
+
+	bus_priv = th_payload->handler_priv;
+	rc  = cam_sfe_bus_rd_get_evt_payload(
+		&bus_priv->common_data, &evt_payload);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < th_payload->num_registers; i++) {
+		evt_payload->irq_reg_val[i] =
+			th_payload->evt_status_arr[i];
+		CAM_DBG(CAM_SFE, "SFE:%d Bus RD IRQ status_%d: 0x%x",
+			bus_priv->common_data.core_index, i,
+			th_payload->evt_status_arr[i]);
+	}
+
+	evt_payload->constraint_violation = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->cons_violation_status);
+	if (evt_payload->constraint_violation) {
+		CAM_ERR(CAM_SFE, "SFE:%d constraint violation:0x%x",
+			bus_priv->common_data.core_index,
+			evt_payload->constraint_violation);
+		cam_irq_controller_disable_irq(
+			bus_priv->common_data.bus_irq_controller,
+			 bus_priv->error_irq_handle);
+		cam_irq_controller_clear_and_mask(evt_id,
+			bus_priv->common_data.bus_irq_controller);
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	th_payload->evt_payload_priv = evt_payload;
+	return 0;
+}
+
+static int cam_sfe_bus_rd_handle_irq_bottom_half(
+	void  *handler_priv, void *evt_payload_priv)
+{
+	struct cam_sfe_bus_rd_irq_evt_payload *evt_payload;
+	struct cam_sfe_bus_rd_priv            *bus_priv;
+	struct cam_sfe_bus_rd_common_data     *common_data = NULL;
+	struct cam_isp_hw_event_info           evt_info;
+	uint32_t status = 0, constraint_violation = 0;
+
+	if (!handler_priv || !evt_payload_priv)
+		return -EINVAL;
+
+	bus_priv = (struct cam_sfe_bus_rd_priv *)handler_priv;
+	evt_payload = (struct cam_sfe_bus_rd_irq_evt_payload *)evt_payload_priv;
+	common_data = &bus_priv->common_data;
+	status = evt_payload->irq_reg_val[CAM_SFE_IRQ_BUS_RD_REG_STATUS0];
+	constraint_violation = evt_payload->constraint_violation;
+	cam_sfe_bus_rd_put_evt_payload(common_data, &evt_payload);
+
+	if (status & 0x2)
+		CAM_DBG(CAM_SFE, "Received SFE:%d BUS RD RUP",
+			bus_priv->common_data.core_index);
+
+	if (status & 0x4)
+		CAM_DBG(CAM_SFE, "Received SFE:%d BUS RD0 BUF DONE",
+			bus_priv->common_data.core_index);
+
+	if (status & 0x8)
+		CAM_DBG(CAM_SFE, "Received SFE:%d BUS RD1 BUF DONE",
+			bus_priv->common_data.core_index);
+
+	if (status & 0x10)
+		CAM_DBG(CAM_SFE, "Received SFE:%d BUS RD2 BUF DONE",
+			bus_priv->common_data.core_index);
+
+	if (status & 0x1) {
+		CAM_ERR(CAM_SFE, "SFE:%d Constraint violation status:0x%x",
+			bus_priv->common_data.core_index,
+			constraint_violation);
+
+		evt_info.hw_idx = bus_priv->common_data.core_index;
+		evt_info.res_type = CAM_ISP_RESOURCE_SFE_RD;
+		evt_info.res_id = CAM_SFE_BUS_RD_MAX;
+		evt_info.err_type = CAM_SFE_IRQ_STATUS_VIOLATION;
+
+		if (common_data->event_cb)
+			common_data->event_cb(NULL,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update      *secure_mode = cmd_args;
+	struct cam_sfe_bus_rd_data            *rsrc_data = NULL;
+	uint32_t                              *mode;
+
+	rsrc_data = (struct cam_sfe_bus_rd_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode = (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_sfe_bus_acquire_bus_rd(void *bus_priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                           rc = -ENODEV;
+	int                                           i;
+	enum cam_sfe_bus_rd_type                      bus_rd_res_id;
+	int                                           num_rm;
+	struct cam_sfe_bus_rd_priv                   *bus_rd_priv =
+		bus_priv;
+	struct cam_sfe_acquire_args                  *acq_args = acquire_args;
+	struct cam_sfe_hw_sfe_bus_rd_acquire_args    *bus_rd_acquire_args;
+	struct cam_isp_resource_node                 *rsrc_node = NULL;
+	struct cam_sfe_bus_rd_data                   *rsrc_data = NULL;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_SFE, "Invalid Param");
+		return -EINVAL;
+	}
+
+	bus_rd_acquire_args = &acq_args->sfe_rd;
+
+	bus_rd_res_id = cam_sfe_bus_get_bus_rd_res_id(
+		bus_rd_acquire_args->res_id);
+	if (bus_rd_res_id == CAM_SFE_BUS_RD_MAX)
+		return -ENODEV;
+
+	num_rm = cam_sfe_bus_get_num_rm(bus_rd_res_id);
+	if (num_rm < 1)
+		return -EINVAL;
+
+	rsrc_node = &bus_rd_priv->sfe_bus_rd[bus_rd_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_SFE, "SFE:%d RM:0x%x not available state:%d",
+			bus_rd_priv->common_data.core_index,
+			acq_args->rsrc_type, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	rsrc_node->res_id = bus_rd_acquire_args->res_id;
+	rsrc_data = rsrc_node->res_priv;
+
+	CAM_DBG(CAM_SFE, "SFE:%d acquire RD type:0x%x",
+		rsrc_data->common_data->core_index, acq_args->rsrc_type);
+
+	rsrc_data->num_rm = num_rm;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	bus_rd_priv->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = bus_rd_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = bus_rd_acquire_args->cdm_ops;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->is_offline = bus_rd_acquire_args->is_offline;
+	if (!rsrc_data->secure_mode) {
+		rsrc_data->secure_mode =
+			bus_rd_acquire_args->secure_mode;
+	} else if (rsrc_data->secure_mode !=
+		bus_rd_acquire_args->secure_mode) {
+		CAM_ERR(CAM_SFE,
+			"Current Mode %u Requesting Mode %u",
+			rsrc_data->secure_mode,
+			bus_rd_acquire_args->secure_mode);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_rm; i++) {
+		rc = cam_sfe_bus_acquire_rm(bus_rd_priv,
+			acq_args->tasklet,
+			acq_args->priv,
+			bus_rd_res_id,
+			i,
+			&rsrc_data->rm_res[i],
+			bus_rd_acquire_args->unpacker_fmt);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d RM:%d acquire failed rc:%d",
+				rsrc_data->common_data->core_index,
+				bus_rd_res_id, rc);
+			goto release_rm;
+		}
+	}
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	bus_rd_acquire_args->rsrc_node = rsrc_node;
+
+	CAM_DBG(CAM_SFE, "SFE:%d acquire RD 0x%x successful",
+		rsrc_data->common_data->core_index, acq_args->rsrc_type);
+	return rc;
+
+release_rm:
+	for (i--; i >= 0; i--)
+		cam_sfe_bus_release_rm(bus_rd_priv, rsrc_data->rm_res[i]);
+	return rc;
+}
+
+static int cam_sfe_bus_release_bus_rd(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node   *sfe_bus_rd = NULL;
+	struct cam_sfe_bus_rd_data     *rsrc_data = NULL;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_SFE, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	sfe_bus_rd = release_args;
+	rsrc_data = sfe_bus_rd->res_priv;
+
+	if (sfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE,
+			"SFE:%d RD type:0x%x invalid resource state:%d",
+			rsrc_data->common_data->core_index,
+			sfe_bus_rd->res_id, sfe_bus_rd->res_state);
+	}
+
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		cam_sfe_bus_release_rm(bus_priv, rsrc_data->rm_res[i]);
+	rsrc_data->num_rm = 0;
+
+	sfe_bus_rd->tasklet_info = NULL;
+	sfe_bus_rd->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+	rsrc_data->secure_mode = 0;
+
+	if (sfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		sfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_sfe_bus_start_bus_rd(
+	void *hw_priv, void *stop_hw_args, uint32_t arg_size)
+{
+	int rc = -ENODEV, i;
+	struct cam_isp_resource_node *sfe_bus_rd = NULL;
+	struct cam_sfe_bus_rd_data *rsrc_data = NULL;
+	struct cam_sfe_bus_rd_common_data *common_data = NULL;
+	uint32_t val = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+
+	sfe_bus_rd = (struct cam_isp_resource_node *)hw_priv;
+	rsrc_data = sfe_bus_rd->res_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_SFE, "SFE:%d start RD type:0x%x", sfe_bus_rd->res_id);
+
+	if (sfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE, "Invalid resource state:%d",
+			sfe_bus_rd->res_state);
+		return -EACCES;
+	}
+
+	if (!rsrc_data->is_offline) {
+		val = (rsrc_data->fs_sync_enable << 5);
+		cam_io_w_mb(val, common_data->mem_base +
+			common_data->common_reg->input_if_cmd);
+	}
+
+	if (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE)
+		cam_io_w_mb(1, common_data->mem_base +
+			common_data->common_reg->security_cfg);
+
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		rc = cam_sfe_bus_start_rm(rsrc_data->rm_res[i]);
+
+	/* TO DO Subscribe mask for buf_done */
+	if (!rc)
+		sfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_sfe_bus_stop_bus_rd(
+	void *hw_priv, void *stop_hw_args, uint32_t arg_size)
+{
+	int rc = 0, i;
+	struct cam_isp_resource_node *sfe_bus_rd = NULL;
+	struct cam_sfe_bus_rd_data   *rsrc_data = NULL;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+
+	sfe_bus_rd = (struct cam_isp_resource_node *)hw_priv;
+	rsrc_data = sfe_bus_rd->res_priv;
+
+	if (sfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		sfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_SFE, "SFE: %d res_id: 0x%x state: %d",
+			rsrc_data->common_data->core_index, sfe_bus_rd->res_id,
+			sfe_bus_rd->res_state);
+		return rc;
+	}
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		rc = cam_sfe_bus_stop_rm(rsrc_data->rm_res[i]);
+
+	sfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	/* Unsubscribe mask for this wm IRQ controller */
+	CAM_DBG(CAM_SFE, "SFE:%d stopped Bus RD:0x%x",
+		rsrc_data->common_data->core_index,
+		sfe_bus_rd->res_id);
+	return rc;
+}
+
+static int cam_sfe_bus_init_sfe_bus_read_resource(
+	uint32_t                           index,
+	struct cam_sfe_bus_rd_priv        *bus_rd_priv,
+	struct cam_sfe_bus_rd_hw_info     *bus_rd_hw_info)
+{
+	struct cam_isp_resource_node         *sfe_bus_rd = NULL;
+	struct cam_sfe_bus_rd_data           *rsrc_data = NULL;
+	int rc = 0;
+	int32_t sfe_bus_rd_resc_type =
+		bus_rd_hw_info->sfe_bus_rd_info[index].sfe_bus_rd_type;
+
+	if (sfe_bus_rd_resc_type < 0 ||
+		sfe_bus_rd_resc_type >= CAM_SFE_BUS_RD_MAX) {
+		CAM_ERR(CAM_SFE, "Init SFE RD failed, Invalid type=%d",
+			sfe_bus_rd_resc_type);
+		return -EINVAL;
+	}
+
+	sfe_bus_rd = &bus_rd_priv->sfe_bus_rd[sfe_bus_rd_resc_type];
+	if (sfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		sfe_bus_rd->res_priv) {
+		CAM_ERR(CAM_SFE,
+			"Error. Looks like same resource is init again");
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_rd_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	sfe_bus_rd->res_priv = rsrc_data;
+
+	sfe_bus_rd->res_type = CAM_ISP_RESOURCE_SFE_RD;
+	sfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&sfe_bus_rd->list);
+
+	rsrc_data->bus_rd_type    =
+		bus_rd_hw_info->sfe_bus_rd_info[index].sfe_bus_rd_type;
+	rsrc_data->common_data = &bus_rd_priv->common_data;
+	rsrc_data->max_width   =
+		bus_rd_hw_info->sfe_bus_rd_info[index].max_width;
+	rsrc_data->max_height  =
+		bus_rd_hw_info->sfe_bus_rd_info[index].max_height;
+	rsrc_data->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+	sfe_bus_rd->hw_intf = bus_rd_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_sfe_bus_rd_resource(
+	struct cam_isp_resource_node    *sfe_bus_rd_res)
+{
+	struct cam_sfe_bus_rd_data *rsrc_data =
+		sfe_bus_rd_res->res_priv;
+
+	if (sfe_bus_rd_res->res_state ==
+		CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		CAM_DBG(CAM_SFE, "HW%d Res %d already deinitialized");
+		return 0;
+	}
+
+	sfe_bus_rd_res->start = NULL;
+	sfe_bus_rd_res->stop = NULL;
+	sfe_bus_rd_res->top_half_handler = NULL;
+	sfe_bus_rd_res->bottom_half_handler = NULL;
+	sfe_bus_rd_res->hw_intf = NULL;
+
+	sfe_bus_rd_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&sfe_bus_rd_res->list);
+	sfe_bus_rd_res->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_update_rm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update       *update_buf;
+	struct cam_buf_io_cfg                  *io_cfg = NULL;
+	struct cam_sfe_bus_rd_data             *sfe_bus_rd_data = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data *rm_data = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t width = 0, height = 0, stride = 0;
+	uint32_t  i, j, size = 0;
+
+	bus_priv = (struct cam_sfe_bus_rd_priv  *) priv;
+	update_buf =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *)
+		update_buf->res->res_priv;
+
+	if (!sfe_bus_rd_data || !sfe_bus_rd_data->cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SFE, "#of RM: %d scratch_buf_cfg: %s",
+		sfe_bus_rd_data->num_rm,
+		update_buf->use_scratch_cfg ? "true" : "false");
+	if (update_buf->rm_update->num_buf != sfe_bus_rd_data->num_rm) {
+		CAM_ERR(CAM_SFE,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->rm_update->num_buf,
+			sfe_bus_rd_data->num_rm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &sfe_bus_rd_data->common_data->io_buf_update[0];
+	if (!update_buf->use_scratch_cfg)
+		io_cfg = update_buf->rm_update->io_cfg;
+
+	for (i = 0, j = 0; i < sfe_bus_rd_data->num_rm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_SFE,
+				"reg_val_pair %d exceeds the array limit %lu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		rm_data = sfe_bus_rd_data->rm_res[i]->res_priv;
+		if (update_buf->use_scratch_cfg) {
+			stride = update_buf->rm_update->stride;
+			width = update_buf->rm_update->width;
+			height = update_buf->rm_update->height;
+		} else {
+			stride = io_cfg->planes[i].plane_stride;
+			width = io_cfg->planes[i].width;
+			height = io_cfg->planes[i].height;
+		}
+
+		/* update size register */
+		cam_sfe_bus_rd_pxls_to_bytes(width,
+			rm_data->unpacker_cfg, &rm_data->width);
+		rm_data->height = height;
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->buf_width, rm_data->width);
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->buf_height, rm_data->height);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d width:0x%X height:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, rm_data->width,
+			rm_data->height);
+
+		rm_data->stride = stride;
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->stride, rm_data->stride);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d image_stride:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->image_addr,
+			update_buf->rm_update->image_buf[i]);
+		CAM_DBG(CAM_SFE, "SFE:%d RM:%d image_address:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+		rm_data->img_addr = reg_val_pair[j-1];
+	}
+
+	size = sfe_bus_rd_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_buf->cmd.size) {
+		CAM_ERR(CAM_SFE,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_buf->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	sfe_bus_rd_data->cdm_util_ops->cdm_write_regrandom(
+		update_buf->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_buf->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_sfe_bus_rd_update_fs_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_priv              *bus_priv;
+	struct cam_sfe_bus_rd_data              *sfe_bus_rd_data = NULL;
+	struct cam_sfe_bus_rd_rm_resource_data  *rm_data = NULL;
+	struct cam_sfe_fe_update_args           *fe_upd_args;
+	struct cam_fe_config                    *fe_cfg;
+	struct cam_sfe_bus_rd_common_data       *common_data;
+	int i = 0;
+
+	bus_priv = (struct cam_sfe_bus_rd_priv  *) priv;
+	fe_upd_args = (struct cam_sfe_fe_update_args *)cmd_args;
+
+	sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *)
+		fe_upd_args->node_res->res_priv;
+
+	if (!sfe_bus_rd_data || !sfe_bus_rd_data->cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	fe_cfg = &fe_upd_args->fe_config;
+
+	for (i = 0; i < sfe_bus_rd_data->num_rm; i++) {
+
+		rm_data = sfe_bus_rd_data->rm_res[i]->res_priv;
+		common_data = rm_data->common_data;
+
+		rm_data->format = fe_cfg->format;
+		rm_data->unpacker_cfg = fe_cfg->unpacker_cfg;
+		rm_data->latency_buf_allocation = fe_cfg->latency_buf_size;
+		rm_data->stride = fe_cfg->stride;
+		rm_data->hbi_count = fe_cfg->hbi_count;
+		rm_data->fs_mode = fe_cfg->fs_mode;
+		rm_data->min_vbi = fe_cfg->min_vbi;
+		sfe_bus_rd_data->fs_sync_enable =
+			fe_cfg->fs_sync_enable;
+		sfe_bus_rd_data->fs_line_sync_en =
+			fe_cfg->fs_line_sync_en;
+
+		CAM_DBG(CAM_SFE,
+			"SFE:%d RM:%d format:0x%x unpacker_cfg:0x%x",
+			rm_data->format, rm_data->unpacker_cfg);
+		CAM_DBG(CAM_SFE,
+			"latency_buf_alloc:0x%x stride:0x%x",
+			rm_data->latency_buf_allocation, rm_data->stride);
+		CAM_DBG(CAM_SFE,
+			"fs_sync_en:%d hbi_cnt:0x%x fs_mode:0x%x min_vbi:0x%x",
+			sfe_bus_rd_data->fs_sync_enable,
+			rm_data->hbi_count, rm_data->fs_mode,
+			rm_data->min_vbi);
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_priv    *bus_priv = hw_priv;
+	uint32_t                       offset = 0;
+	struct cam_sfe_bus_rd_reg_offset_common  *common_reg;
+	uint32_t sfe_top_irq_mask[CAM_SFE_IRQ_REGISTERS_MAX] = {0};
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+	common_reg = bus_priv->common_data.common_reg;
+	sfe_top_irq_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	/* Subscribe for top IRQ */
+	bus_priv->irq_handle = cam_irq_controller_subscribe_irq(
+		bus_priv->common_data.sfe_irq_controller,
+		CAM_IRQ_PRIORITY_2,
+		sfe_top_irq_mask,
+		bus_priv,
+		cam_sfe_bus_rd_handle_irq,
+		NULL,
+		NULL,
+		NULL);
+
+	if (bus_priv->irq_handle < 1) {
+		CAM_ERR(CAM_SFE,
+			"Failed to subscribe TOP IRQ for BUS RD");
+		bus_priv->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	if (bus_priv->tasklet_info != NULL) {
+		bus_priv->error_irq_handle = cam_irq_controller_subscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			bus_rd_error_irq_mask,
+			bus_priv,
+			cam_sfe_bus_rd_handle_irq_top_half,
+			cam_sfe_bus_rd_handle_irq_bottom_half,
+			bus_priv->tasklet_info,
+			&tasklet_bh_api);
+
+		if (bus_priv->error_irq_handle < 1) {
+			CAM_ERR(CAM_SFE, "Failed to subscribe error IRQ");
+			bus_priv->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+	/* BUS_RD_TEST_BUS_CTRL disabling test bus */
+	offset = common_reg->test_bus_ctrl;
+	cam_io_w_mb(0x0, bus_priv->common_data.mem_base + offset);
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_sfe_bus_rd_priv    *bus_priv = hw_priv;
+	int                            rc = 0;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_SFE, "Error: Invalid args");
+		return -EINVAL;
+	}
+
+	/* Unsubscribe irqs */
+	if (bus_priv->irq_handle) {
+		rc =   cam_irq_controller_unsubscribe_irq(
+				bus_priv->common_data.sfe_irq_controller,
+				bus_priv->irq_handle);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Failed to unsubscribe top irq");
+		bus_priv->irq_handle = 0;
+	}
+
+	if (bus_priv->error_irq_handle) {
+		rc =   cam_irq_controller_unsubscribe_irq(
+				bus_priv->common_data.bus_irq_controller,
+				bus_priv->error_irq_handle);
+		if (rc)
+			CAM_ERR(CAM_SFE, "Failed to unsubscribe error irq");
+		bus_priv->error_irq_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_sfe_bus_rd_process_cmd(
+	void *priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE,
+			"Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM:
+		rc = cam_sfe_bus_rd_update_rm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_SECURE_MODE:
+		rc = cam_sfe_bus_rd_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD:
+		rc = cam_sfe_bus_rd_update_fs_cfg(priv, cmd_args, arg_size);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_SFE,
+			"Invalid SFE BUS RD command type: %d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_sfe_bus_rd_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *sfe_irq_controller,
+	struct cam_sfe_bus                  **sfe_bus)
+{
+	int i, rc = 0;
+	struct cam_sfe_bus_rd_priv    *bus_priv = NULL;
+	struct cam_sfe_bus            *sfe_bus_local;
+	struct cam_sfe_bus_rd_hw_info *bus_rd_hw_info = bus_hw_info;
+
+	if (!soc_info || !hw_intf || !bus_hw_info) {
+		CAM_ERR(CAM_SFE,
+			"Invalid_params soc_info:%pK hw_intf:%pK hw_info:%pK",
+			soc_info, hw_intf, bus_rd_hw_info);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	sfe_bus_local = kzalloc(sizeof(struct cam_sfe_bus), GFP_KERNEL);
+	if (!sfe_bus_local) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for sfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_sfe_bus_rd_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for sfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+
+	sfe_bus_local->bus_priv = bus_priv;
+	bus_priv->num_client                    = bus_rd_hw_info->num_client;
+	bus_priv->num_bus_rd_resc               =
+		bus_rd_hw_info->num_bus_rd_resc;
+	bus_priv->common_data.core_index        = soc_info->index;
+	bus_priv->common_data.mem_base          =
+		CAM_SOC_GET_REG_MAP_START(soc_info, SFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf           = hw_intf;
+	bus_priv->common_data.sfe_irq_controller = sfe_irq_controller;
+	bus_priv->common_data.common_reg        = &bus_rd_hw_info->common_reg;
+	bus_priv->top_irq_shift                 = bus_rd_hw_info->top_irq_shift;
+
+	rc = cam_irq_controller_init(drv_name,
+		bus_priv->common_data.mem_base,
+		&bus_rd_hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller, true);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "IRQ controller init failed");
+		goto free_bus_priv;
+	}
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_sfe_bus_init_rm_resource(i, bus_priv, bus_hw_info,
+			&bus_priv->bus_client[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_SFE, "Init RM failed rc=%d", rc);
+			goto deinit_rm;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_bus_rd_resc; i++) {
+		rc = cam_sfe_bus_init_sfe_bus_read_resource(i, bus_priv,
+			bus_rd_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_SFE, "Init SFE RD failed rc=%d", rc);
+			goto deinit_sfe_bus_rd;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_SFE_BUS_RD_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+
+	sfe_bus_local->hw_ops.reserve      = cam_sfe_bus_acquire_bus_rd;
+	sfe_bus_local->hw_ops.release      = cam_sfe_bus_release_bus_rd;
+	sfe_bus_local->hw_ops.start        = cam_sfe_bus_start_bus_rd;
+	sfe_bus_local->hw_ops.stop         = cam_sfe_bus_stop_bus_rd;
+	sfe_bus_local->hw_ops.init         = cam_sfe_bus_init_hw;
+	sfe_bus_local->hw_ops.deinit       = cam_sfe_bus_deinit_hw;
+	sfe_bus_local->top_half_handler    = cam_sfe_bus_rd_handle_irq;
+	sfe_bus_local->bottom_half_handler = NULL;
+	sfe_bus_local->hw_ops.process_cmd  = cam_sfe_bus_rd_process_cmd;
+
+	*sfe_bus = sfe_bus_local;
+
+	return rc;
+
+deinit_sfe_bus_rd:
+	if (i < 0)
+		i = CAM_SFE_BUS_RD_MAX;
+	for (--i; i >= 0; i--)
+		cam_sfe_bus_deinit_sfe_bus_rd_resource(
+			&bus_priv->sfe_bus_rd[i]);
+deinit_rm:
+	if (i < 0)
+		i = bus_priv->num_client;
+	for (--i; i >= 0; i--)
+		cam_sfe_bus_deinit_rm_resource(&bus_priv->bus_client[i]);
+
+free_bus_priv:
+	kfree(sfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(sfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_sfe_bus_rd_deinit(
+	struct cam_sfe_bus                  **sfe_bus)
+{
+	int i, rc = 0;
+	unsigned long flags;
+	struct cam_sfe_bus_rd_priv    *bus_priv = NULL;
+	struct cam_sfe_bus            *sfe_bus_local;
+
+	if (!sfe_bus || !*sfe_bus) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+	sfe_bus_local = *sfe_bus;
+
+	bus_priv = sfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_SFE, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_SFE_BUS_RD_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_sfe_bus_deinit_rm_resource(&bus_priv->bus_client[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"Deinit RM failed rc=%d", rc);
+	}
+	for (i = 0; i < CAM_SFE_BUS_RD_MAX; i++) {
+		rc = cam_sfe_bus_deinit_sfe_bus_rd_resource(
+			&bus_priv->sfe_bus_rd[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"Deinit SFE RD failed rc=%d", rc);
+	}
+
+	rc = cam_irq_controller_deinit(
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_SFE,
+			"Deinit IRQ Controller failed rc=%d", rc);
+
+	kfree(sfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(sfe_bus_local);
+	*sfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.h
@@ -0,0 +1,118 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_BUS_RD_H_
+#define _CAM_SFE_BUS_RD_H_
+
+#include "cam_sfe_bus.h"
+
+#define CAM_SFE_BUS_RD_MAX_CLIENTS 3
+
+enum cam_sfe_bus_rd_type {
+	CAM_SFE_BUS_RD_RDI0,
+	CAM_SFE_BUS_RD_RDI1,
+	CAM_SFE_BUS_RD_RDI2,
+	CAM_SFE_BUS_RD_MAX,
+};
+
+/*
+ * struct cam_sfe_bus_rd_reg_offset_common:
+ *
+ * @Brief:        Common registers across BUS RD Clients
+ */
+struct cam_sfe_bus_rd_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t misr_reset;
+	uint32_t pwr_iso_cfg;
+	uint32_t input_if_cmd;
+	uint32_t test_bus_ctrl;
+	uint32_t security_cfg;
+	uint32_t cons_violation_status;
+	struct cam_irq_controller_reg_info irq_reg_info;
+};
+
+/*
+ * struct cam_sfe_bus_rd_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS RD Clients
+ */
+struct cam_sfe_bus_rd_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t buf_width;
+	uint32_t buf_height;
+	uint32_t stride;
+	uint32_t unpacker_cfg;
+	uint32_t latency_buf_allocation;
+};
+
+/*
+ * struct cam_sfe_bus_rd_hw_info:
+ *
+ * @Brief:        HW capability of SFE Bus RD Client
+ */
+struct cam_sfe_bus_rd_info {
+	enum cam_sfe_bus_rd_type  sfe_bus_rd_type;
+	uint32_t                  max_width;
+	uint32_t                  max_height;
+};
+
+/*
+ * struct cam_sfe_bus_rd_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:       Common register details
+ * @num_client:       Number of bus rd clients
+ * @bus_client_reg:   Bus client register info
+ * @num_bus_rd_resc:  Number of SFE BUS RD masters
+ * @sfe_bus_rd_info:  SFE bus rd client info
+ * @top_irq_shift:    Top irq shift val
+ */
+struct cam_sfe_bus_rd_hw_info {
+	struct cam_sfe_bus_rd_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_sfe_bus_rd_reg_offset_bus_client
+		bus_client_reg[CAM_SFE_BUS_RD_MAX_CLIENTS];
+	uint32_t num_bus_rd_resc;
+	struct cam_sfe_bus_rd_info
+		sfe_bus_rd_info[CAM_SFE_BUS_RD_MAX];
+	uint32_t top_irq_shift;
+};
+
+/*
+ * cam_sfe_bus_rd_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @sfe_bus:                 Pointer to sfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_rd_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *sfe_irq_controller,
+	struct cam_sfe_bus                  **sfe_bus);
+
+/*
+ * cam_sfe_bus_rd_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @sfe_bus:                 Pointer to sfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_rd_deinit(struct cam_sfe_bus       **sfe_bus);
+
+#endif /* _CAM_SFE_BUS_RD_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.c
@@ -0,0 +1,2414 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_sfe_bus.h"
+#include "cam_sfe_bus_wr.h"
+#include "cam_sfe_core.h"
+#include "cam_sfe_soc.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_trace.h"
+
+static const char drv_name[] = "sfe_bus_wr";
+
+#define CAM_SFE_BUS_WR_PAYLOAD_MAX             256
+
+#define CAM_SFE_RDI_BUS_DEFAULT_WIDTH          0xFFFF
+#define CAM_SFE_RDI_BUS_DEFAULT_STRIDE         0xFFFF
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	(sizeof(struct cam_sfe_bus_reg_offset_bus_client) / 4)
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+static uint32_t bus_wr_error_irq_mask[1] = {
+	0xD0000000,
+};
+
+enum cam_sfe_bus_wr_packer_format {
+	PACKER_FMT_PLAIN_128,
+	PACKER_FMT_PLAIN_8,
+	PACKER_FMT_PLAIN_8_ODD_EVEN,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN,
+	PACKER_FMT_PLAIN_16_10BPP,
+	PACKER_FMT_PLAIN_16_12BPP,
+	PACKER_FMT_PLAIN_16_14BPP,
+	PACKER_FMT_PLAIN_16_16BPP,
+	PACKER_FMT_PLAIN_32,
+	PACKER_FMT_PLAIN_64,
+	PACKER_FMT_TP_10,
+	PACKER_FMT_MIPI10,
+	PACKER_FMT_MIPI12,
+	PACKER_FMT_MIPI14,
+	PACKER_FMT_MIPI20,
+	PACKER_FMT_PLAIN_32_20BPP,
+	PACKER_FMT_MAX,
+};
+
+struct cam_sfe_bus_wr_common_data {
+	uint32_t                                    core_index;
+	uint32_t                                    hw_version;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *sfe_irq_controller;
+	void                                       *buf_done_controller;
+	void                                       *bus_irq_controller;
+	struct cam_sfe_bus_reg_offset_common       *common_reg;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+	struct list_head                            free_payload_list;
+	spinlock_t                                  spin_lock;
+	struct cam_sfe_bus_wr_irq_evt_payload       evt_payload[
+		CAM_SFE_BUS_WR_PAYLOAD_MAX];
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    addr_no_sync;
+	uint32_t                                    comp_done_shift;
+	bool                                        hw_init;
+	cam_hw_mgr_event_cb_func                    event_cb;
+};
+
+struct cam_sfe_wr_scratch_buf_info {
+	uint32_t     width;
+	uint32_t     height;
+	uint32_t     stride;
+	uint32_t     slice_height;
+	dma_addr_t   io_addr;
+};
+
+struct cam_sfe_bus_wr_wm_resource_data {
+	uint32_t             index;
+	struct cam_sfe_bus_wr_common_data         *common_data;
+	struct cam_sfe_bus_reg_offset_bus_client  *hw_regs;
+	struct cam_sfe_wr_scratch_buf_info scratch_buf_info;
+
+	bool                 init_cfg_done;
+	bool                 hfr_cfg_done;
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	enum cam_sfe_bus_wr_packer_format pack_fmt;
+
+	uint32_t             packer_cfg;
+	uint32_t             h_init;
+
+	uint32_t             irq_subsample_period;
+	uint32_t             irq_subsample_pattern;
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             en_cfg;
+	uint32_t             is_dual;
+
+	uint32_t             acquired_width;
+	uint32_t             acquired_height;
+};
+
+struct cam_sfe_bus_wr_comp_grp_data {
+	enum cam_sfe_bus_wr_comp_grp_type          comp_grp_type;
+	struct cam_sfe_bus_wr_common_data         *common_data;
+
+	uint32_t                                   is_master;
+	uint32_t                                   is_dual;
+	uint32_t                                   dual_slave_core;
+	uint32_t                                   intra_client_mask;
+	uint32_t                                   addr_sync_mode;
+	uint32_t                                   composite_mask;
+
+	uint32_t                                   acquire_dev_cnt;
+	uint32_t                                   irq_trigger_cnt;
+};
+
+struct cam_sfe_bus_wr_out_data {
+	uint32_t                              out_type;
+	uint32_t                              source_group;
+	struct cam_sfe_bus_wr_common_data    *common_data;
+
+	uint32_t                           num_wm;
+	struct cam_isp_resource_node      *wm_res;
+
+	struct cam_isp_resource_node      *comp_grp;
+	struct list_head                   sfe_out_list;
+
+	uint32_t                           is_master;
+	uint32_t                           is_dual;
+
+	uint32_t                           format;
+	uint32_t                           max_width;
+	uint32_t                           max_height;
+	struct cam_cdm_utils_ops          *cdm_util_ops;
+	uint32_t                           secure_mode;
+	void                              *priv;
+};
+
+struct cam_sfe_bus_wr_priv {
+	struct cam_sfe_bus_wr_common_data   common_data;
+	uint32_t                            num_client;
+	uint32_t                            num_out;
+	uint32_t                            num_comp_grp;
+	uint32_t                            top_irq_shift;
+
+	struct cam_isp_resource_node       *comp_grp;
+	struct cam_isp_resource_node       *sfe_out;
+
+	struct list_head                    free_comp_grp;
+	struct list_head                    used_comp_grp;
+
+	int                                 bus_irq_handle;
+	int                                 error_irq_handle;
+	void                               *tasklet_info;
+};
+
+static int cam_sfe_bus_wr_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args,
+	uint32_t arg_size);
+
+static bool cam_sfe_bus_can_be_secure(uint32_t out_type)
+{
+	switch (out_type) {
+	case CAM_SFE_BUS_SFE_OUT_RAW_DUMP:
+	case CAM_SFE_BUS_SFE_OUT_RDI0:
+	case CAM_SFE_BUS_SFE_OUT_RDI1:
+	case CAM_SFE_BUS_SFE_OUT_RDI2:
+	case CAM_SFE_BUS_SFE_OUT_RDI3:
+	case CAM_SFE_BUS_SFE_OUT_RDI4:
+		return true;
+	case CAM_SFE_BUS_SFE_OUT_LCR:
+	case CAM_SFE_BUS_SFE_OUT_BE_0:
+	case CAM_SFE_BUS_SFE_OUT_BHIST_0:
+	case CAM_SFE_BUS_SFE_OUT_BE_1:
+	case CAM_SFE_BUS_SFE_OUT_BHIST_1:
+	case CAM_SFE_BUS_SFE_OUT_BE_2:
+	case CAM_SFE_BUS_SFE_OUT_BHIST_2:
+	default:
+		return false;
+	}
+}
+
+static enum cam_sfe_bus_sfe_out_type
+	cam_sfe_bus_wr_get_out_res_id(uint32_t res_type)
+{
+	switch (res_type) {
+	case CAM_ISP_SFE_OUT_RES_RAW_DUMP:
+		return CAM_SFE_BUS_SFE_OUT_RAW_DUMP;
+	case CAM_ISP_SFE_OUT_RES_RDI_0:
+		return CAM_SFE_BUS_SFE_OUT_RDI0;
+	case CAM_ISP_SFE_OUT_RES_RDI_1:
+		return CAM_SFE_BUS_SFE_OUT_RDI1;
+	case CAM_ISP_SFE_OUT_RES_RDI_2:
+		return CAM_SFE_BUS_SFE_OUT_RDI2;
+	case CAM_ISP_SFE_OUT_RES_RDI_3:
+		return CAM_SFE_BUS_SFE_OUT_RDI3;
+	case CAM_ISP_SFE_OUT_RES_RDI_4:
+		return CAM_SFE_BUS_SFE_OUT_RDI4;
+	case CAM_ISP_SFE_OUT_BE_STATS_0:
+		return CAM_SFE_BUS_SFE_OUT_BE_0;
+	case CAM_ISP_SFE_OUT_BHIST_STATS_0:
+		return CAM_SFE_BUS_SFE_OUT_BHIST_0;
+	case CAM_ISP_SFE_OUT_BE_STATS_1:
+		return CAM_SFE_BUS_SFE_OUT_BE_1;
+	case CAM_ISP_SFE_OUT_BHIST_STATS_1:
+		return CAM_SFE_BUS_SFE_OUT_BHIST_1;
+	case CAM_ISP_SFE_OUT_BE_STATS_2:
+		return CAM_SFE_BUS_SFE_OUT_BE_2;
+	case CAM_ISP_SFE_OUT_BHIST_STATS_2:
+		return CAM_SFE_BUS_SFE_OUT_BHIST_2;
+	case CAM_ISP_SFE_OUT_RES_LCR:
+		return CAM_SFE_BUS_SFE_OUT_LCR;
+	default:
+		return CAM_SFE_BUS_SFE_OUT_MAX;
+	}
+}
+
+static int cam_sfe_bus_get_comp_sfe_out_res_id_list(
+	uint32_t comp_mask, uint32_t *out_list, int *num_out)
+{
+	int count = 0;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_RDI0))
+		out_list[count++] = CAM_ISP_SFE_OUT_RES_RDI_0;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_RDI1))
+		out_list[count++] = CAM_ISP_SFE_OUT_RES_RDI_1;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_RDI2))
+		out_list[count++] = CAM_ISP_SFE_OUT_RES_RDI_2;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_RDI3))
+		out_list[count++] = CAM_ISP_SFE_OUT_RES_RDI_3;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_RDI4))
+		out_list[count++] = CAM_ISP_SFE_OUT_RES_RDI_4;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_RAW_DUMP))
+		out_list[count++] = CAM_ISP_SFE_OUT_RES_RAW_DUMP;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_BE_0))
+		out_list[count++] = CAM_ISP_SFE_OUT_BE_STATS_0;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_BHIST_0))
+		out_list[count++] = CAM_ISP_SFE_OUT_BHIST_STATS_0;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_BE_1))
+		out_list[count++] = CAM_ISP_SFE_OUT_BE_STATS_1;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_BHIST_1))
+		out_list[count++] = CAM_ISP_SFE_OUT_BHIST_STATS_1;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_BE_2))
+		out_list[count++] = CAM_ISP_SFE_OUT_BE_STATS_2;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_BHIST_2))
+		out_list[count++] = CAM_ISP_SFE_OUT_BHIST_STATS_2;
+
+	if (comp_mask & (1 << CAM_SFE_BUS_SFE_OUT_LCR))
+		out_list[count++] = CAM_ISP_SFE_OUT_RES_LCR;
+
+	*num_out = count;
+	return 0;
+}
+
+static enum cam_sfe_bus_wr_packer_format
+	cam_sfe_bus_get_packer_fmt(uint32_t out_fmt, int wm_index)
+{
+	switch (out_fmt) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PD8:
+		return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_MIPI_RAW_10:
+		if (wm_index == 0)
+			return PACKER_FMT_MIPI10;
+		else
+			return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_MIPI_RAW_12:
+		if (wm_index == 0)
+			return PACKER_FMT_MIPI12;
+		else
+			return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_MIPI_RAW_14:
+		if (wm_index == 0)
+			return PACKER_FMT_MIPI14;
+		else
+			return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_MIPI_RAW_20:
+		if (wm_index == 0)
+			return PACKER_FMT_MIPI20;
+		else
+			return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_PLAIN8:
+		return PACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_NV12:
+	case CAM_FORMAT_UBWC_NV12:
+	case CAM_FORMAT_UBWC_NV12_4R:
+	case CAM_FORMAT_Y_ONLY:
+		return PACKER_FMT_PLAIN_8_LSB_MSB_10;
+	case CAM_FORMAT_PLAIN16_10:
+		return PACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return PACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return PACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN16_16:
+		return PACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN32:
+	case CAM_FORMAT_ARGB:
+		return PACKER_FMT_PLAIN_32;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_ARGB_16:
+	case CAM_FORMAT_PD10:
+		return PACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_UBWC_TP10:
+	case CAM_FORMAT_TP10:
+		return PACKER_FMT_TP_10;
+	default:
+		return PACKER_FMT_MAX;
+	}
+}
+
+static int cam_sfe_bus_acquire_wm(
+	struct cam_sfe_bus_wr_priv            *bus_priv,
+	struct cam_isp_out_port_generic_info  *out_port_info,
+	void                                  *tasklet,
+	enum cam_sfe_bus_sfe_out_type          sfe_out_res_id,
+	enum cam_sfe_bus_plane_type            plane,
+	struct cam_isp_resource_node          *wm_res,
+	uint32_t                              *comp_done_mask,
+	uint32_t                               is_dual,
+	enum cam_sfe_bus_wr_comp_grp_type     *comp_grp_id)
+{
+	int32_t wm_idx = 0;
+	struct cam_sfe_bus_wr_wm_resource_data  *rsrc_data = NULL;
+	char wm_mode[50] = {0};
+
+	if (wm_res->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_SFE, "WM:%d not available state:%d",
+			wm_idx, wm_res->res_state);
+		return -EALREADY;
+	}
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	wm_res->tasklet_info = tasklet;
+
+	rsrc_data = wm_res->res_priv;
+	wm_idx = rsrc_data->index;
+	rsrc_data->format = out_port_info->format;
+	rsrc_data->pack_fmt = cam_sfe_bus_get_packer_fmt(rsrc_data->format,
+		wm_idx);
+
+	rsrc_data->width = out_port_info->width;
+	rsrc_data->height = out_port_info->height;
+	rsrc_data->is_dual = is_dual;
+	/* Set WM offset value to default */
+	rsrc_data->offset  = 0;
+	CAM_DBG(CAM_SFE, "WM:%d width %d height %d", rsrc_data->index,
+		rsrc_data->width, rsrc_data->height);
+
+	if ((sfe_out_res_id >= CAM_SFE_BUS_SFE_OUT_RDI0) &&
+		(sfe_out_res_id <= CAM_SFE_BUS_SFE_OUT_RDI4)) {
+
+		rsrc_data->pack_fmt = 0x0;
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_MIPI_RAW_6:
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_MIPI_RAW_14:
+		case CAM_FORMAT_MIPI_RAW_16:
+		case CAM_FORMAT_MIPI_RAW_20:
+		case CAM_FORMAT_PLAIN128:
+		case CAM_FORMAT_PLAIN32_20:
+			rsrc_data->width = CAM_SFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride = CAM_SFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->stride = rsrc_data->width * 2;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 2, 16) / 16;
+			rsrc_data->en_cfg = 0x1;
+			break;
+		case CAM_FORMAT_PLAIN64:
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 8, 16) / 16;
+			rsrc_data->en_cfg = 0x1;
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Unsupported RDI format %d",
+				rsrc_data->format);
+			return -EINVAL;
+		}
+
+	} else if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_RAW_DUMP) {
+		rsrc_data->stride = rsrc_data->width;
+		rsrc_data->en_cfg = 0x1;
+	} else if ((sfe_out_res_id >= CAM_SFE_BUS_SFE_OUT_BE_0) &&
+		(sfe_out_res_id <= CAM_SFE_BUS_SFE_OUT_BHIST_2)) {
+
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+
+	} else if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_LCR) {
+
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			/* LSB aligned */
+			rsrc_data->pack_fmt |= 0x20;
+			break;
+		default:
+			CAM_ERR(CAM_SFE, "Invalid format %d out_type:%d",
+				rsrc_data->format, sfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else {
+		CAM_ERR(CAM_SFE, "Invalid out_type:%d requested",
+			sfe_out_res_id);
+		return -EINVAL;
+	}
+
+	*comp_grp_id = rsrc_data->hw_regs->comp_group;
+	*comp_done_mask |= (1 << sfe_out_res_id);
+
+	switch (rsrc_data->en_cfg) {
+	case 0x1:
+		strscpy(wm_mode, "line-based", sizeof(wm_mode));
+		break;
+	case ((0x1 << 16) | 0x1):
+		strscpy(wm_mode, "frame-based", sizeof(wm_mode));
+		break;
+	case ((0x2 << 16) | 0x1):
+		strscpy(wm_mode, "index-based", sizeof(wm_mode));
+		break;
+	}
+
+	CAM_DBG(CAM_SFE,
+		"SFE:%d WM:%d processed width:%d height:%d format:0x%X pack_fmt 0x%x %s",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		rsrc_data->width, rsrc_data->height, rsrc_data->format,
+		rsrc_data->pack_fmt, wm_mode);
+	return 0;
+}
+
+static int cam_sfe_bus_release_wm(void   *bus_priv,
+	struct cam_isp_resource_node     *wm_res)
+{
+	struct cam_sfe_bus_wr_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->pack_fmt = 0;
+	rsrc_data->irq_subsample_period = 0;
+	rsrc_data->irq_subsample_pattern = 0;
+	rsrc_data->framedrop_period = 0;
+	rsrc_data->framedrop_pattern = 0;
+	rsrc_data->packer_cfg = 0;
+	rsrc_data->h_init = 0;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+
+	wm_res->tasklet_info = NULL;
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_SFE, "SFE:%d Release WM:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	return 0;
+}
+
+static int cam_sfe_bus_start_wm(struct cam_isp_resource_node *wm_res)
+{
+	const uint32_t image_cfg_height_shift_val = 16;
+	struct cam_sfe_bus_wr_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_sfe_bus_wr_common_data        *common_data =
+		rsrc_data->common_data;
+
+	cam_io_w((rsrc_data->height << image_cfg_height_shift_val)
+		| rsrc_data->width, common_data->mem_base +
+		rsrc_data->hw_regs->image_cfg_0);
+	cam_io_w(rsrc_data->pack_fmt,
+		common_data->mem_base + rsrc_data->hw_regs->packer_cfg);
+
+	/* Enable WM */
+	cam_io_w_mb(rsrc_data->en_cfg, common_data->mem_base +
+		rsrc_data->hw_regs->cfg);
+
+	CAM_DBG(CAM_SFE,
+		"Start SFE:%d WM:%d offset:0x%X en_cfg:0x%X width:%d height:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		(uint32_t) rsrc_data->hw_regs->cfg, rsrc_data->en_cfg,
+		rsrc_data->width, rsrc_data->height);
+	CAM_DBG(CAM_SFE, "WM:%d pk_fmt:%d stride:%d",
+		rsrc_data->index, rsrc_data->pack_fmt & PACKER_FMT_MAX,
+		rsrc_data->stride);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_sfe_bus_stop_wm(struct cam_isp_resource_node *wm_res)
+{
+	struct cam_sfe_bus_wr_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_sfe_bus_wr_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable WM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+	CAM_DBG(CAM_SFE, "Stop SFE:%d WM:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+
+	return 0;
+}
+
+static int cam_sfe_bus_handle_wm_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_sfe_bus_handle_wm_done_bottom_half(void *wm_node,
+	void *evt_payload_priv)
+{
+	return -EPERM;
+}
+
+static int cam_sfe_bus_init_wm_resource(uint32_t index,
+	struct cam_sfe_bus_wr_priv      *bus_priv,
+	struct cam_sfe_bus_wr_hw_info   *hw_info,
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_sfe_bus_wr_wm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_wr_wm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for WM res priv");
+		return -ENOMEM;
+	}
+	wm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &bus_priv->common_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = cam_sfe_bus_start_wm;
+	wm_res->stop = cam_sfe_bus_stop_wm;
+	wm_res->top_half_handler = cam_sfe_bus_handle_wm_done_top_half;
+	wm_res->bottom_half_handler =
+		cam_sfe_bus_handle_wm_done_bottom_half;
+	wm_res->hw_intf = bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_wm_resource(
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_sfe_bus_wr_wm_resource_data *rsrc_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = NULL;
+	wm_res->bottom_half_handler = NULL;
+	wm_res->hw_intf = NULL;
+
+	rsrc_data = wm_res->res_priv;
+	wm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static void cam_sfe_bus_add_wm_to_comp_grp(
+	struct cam_isp_resource_node    *comp_grp,
+	uint32_t                         composite_mask)
+{
+	struct cam_sfe_bus_wr_comp_grp_data  *rsrc_data = comp_grp->res_priv;
+
+	rsrc_data->composite_mask |= composite_mask;
+}
+
+static bool cam_sfe_bus_match_comp_grp(
+	struct cam_sfe_bus_wr_priv           *bus_priv,
+	struct cam_isp_resource_node        **comp_grp,
+	uint32_t                              comp_grp_id)
+{
+	struct cam_sfe_bus_wr_comp_grp_data  *rsrc_data = NULL;
+	struct cam_isp_resource_node         *comp_grp_local = NULL;
+
+	list_for_each_entry(comp_grp_local,
+		&bus_priv->used_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_type == comp_grp_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			return true;
+		}
+	}
+
+	list_for_each_entry(comp_grp_local,
+		&bus_priv->free_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_type == comp_grp_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			list_del(&comp_grp_local->list);
+			list_add_tail(&comp_grp_local->list,
+			&bus_priv->used_comp_grp);
+			return false;
+		}
+	}
+
+	*comp_grp = NULL;
+	return false;
+}
+
+static int cam_sfe_bus_acquire_comp_grp(
+	struct cam_sfe_bus_wr_priv           *bus_priv,
+	struct cam_isp_out_port_generic_info *out_port_info,
+	void                                 *tasklet,
+	uint32_t                              is_dual,
+	uint32_t                              is_master,
+	struct cam_isp_resource_node        **comp_grp,
+	enum cam_sfe_bus_wr_comp_grp_type     comp_grp_id)
+{
+	int rc = 0;
+	struct cam_isp_resource_node         *comp_grp_local = NULL;
+	struct cam_sfe_bus_wr_comp_grp_data  *rsrc_data = NULL;
+	bool previously_acquired = false;
+
+	/* Check if matching comp_grp has already been acquired */
+	previously_acquired = cam_sfe_bus_match_comp_grp(
+		bus_priv, &comp_grp_local, comp_grp_id);
+
+	if (!comp_grp_local) {
+		CAM_ERR(CAM_SFE, "Invalid comp_grp:%d", comp_grp_id);
+		return -ENODEV;
+	}
+
+	rsrc_data = comp_grp_local->res_priv;
+
+	if (!previously_acquired) {
+		rsrc_data->intra_client_mask = 0x1;
+		comp_grp_local->tasklet_info = tasklet;
+		comp_grp_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		rsrc_data->is_master = is_master;
+		rsrc_data->is_dual = is_dual;
+
+		if (is_master)
+			rsrc_data->addr_sync_mode = 0;
+		else
+			rsrc_data->addr_sync_mode = 1;
+
+	} else {
+		rsrc_data = comp_grp_local->res_priv;
+		/* Do not support runtime change in composite mask */
+		if (comp_grp_local->res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) {
+			CAM_ERR(CAM_SFE, "Invalid State %d comp_grp:%u",
+				comp_grp_local->res_state,
+				rsrc_data->comp_grp_type);
+			return -EBUSY;
+		}
+	}
+
+	CAM_DBG(CAM_SFE, "Acquire SFE:%d comp_grp:%u",
+		rsrc_data->common_data->core_index, rsrc_data->comp_grp_type);
+
+	rsrc_data->acquire_dev_cnt++;
+	*comp_grp = comp_grp_local;
+
+	return rc;
+}
+
+static int cam_sfe_bus_release_comp_grp(
+	struct cam_sfe_bus_wr_priv         *bus_priv,
+	struct cam_isp_resource_node       *in_comp_grp)
+{
+	struct cam_isp_resource_node         *comp_grp = NULL;
+	struct cam_sfe_bus_wr_comp_grp_data  *in_rsrc_data = NULL;
+	int match_found = 0;
+
+	if (!in_comp_grp) {
+		CAM_ERR(CAM_SFE, "Invalid Params comp_grp %pK", in_comp_grp);
+		return -EINVAL;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_SFE, "Already released comp_grp");
+		return 0;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_SFE, "Invalid State %d",
+			in_comp_grp->res_state);
+		return -EBUSY;
+	}
+
+	in_rsrc_data = in_comp_grp->res_priv;
+	CAM_DBG(CAM_SFE, "Release SFE:%d comp_grp:%u",
+		bus_priv->common_data.core_index,
+		in_rsrc_data->comp_grp_type);
+
+	list_for_each_entry(comp_grp, &bus_priv->used_comp_grp, list) {
+		if (comp_grp == in_comp_grp) {
+			match_found = 1;
+			break;
+		}
+	}
+
+	if (!match_found) {
+		CAM_ERR(CAM_SFE, "Could not find comp_grp:%u",
+			in_rsrc_data->comp_grp_type);
+		return -ENODEV;
+	}
+
+	in_rsrc_data->acquire_dev_cnt--;
+	if (in_rsrc_data->acquire_dev_cnt == 0) {
+		list_del(&comp_grp->list);
+
+		in_rsrc_data->dual_slave_core = CAM_SFE_BUS_SFE_CORE_MAX;
+		in_rsrc_data->addr_sync_mode = 0;
+		in_rsrc_data->composite_mask = 0;
+
+		comp_grp->tasklet_info = NULL;
+		comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+		list_add_tail(&comp_grp->list, &bus_priv->free_comp_grp);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_start_comp_grp(
+	struct cam_isp_resource_node *comp_grp,
+	uint32_t *bus_irq_reg_mask)
+{
+	int rc = 0;
+	struct cam_sfe_bus_wr_comp_grp_data *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_common_data   *common_data = NULL;
+
+	rsrc_data = comp_grp->res_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_SFE,
+		"Start SFE:%d comp_grp:%d streaming state:%d comp_mask:0x%X",
+		rsrc_data->common_data->core_index,
+		rsrc_data->comp_grp_type, comp_grp->res_state,
+		rsrc_data->composite_mask);
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		return 0;
+
+	bus_irq_reg_mask[CAM_SFE_IRQ_BUS_REG_STATUS0] =
+		(0x1 << (rsrc_data->comp_grp_type +
+		rsrc_data->common_data->comp_done_shift));
+
+	CAM_DBG(CAM_SFE, "Start Done SFE:%d comp_grp:%d",
+		rsrc_data->common_data->core_index,
+		rsrc_data->comp_grp_type,
+		bus_irq_reg_mask[0]);
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static inline int cam_sfe_bus_stop_comp_grp(
+	struct cam_isp_resource_node          *comp_grp)
+{
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_init_comp_grp(uint32_t index,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_sfe_bus_wr_priv    *bus_priv,
+	struct cam_sfe_bus_wr_hw_info *hw_info,
+	struct cam_isp_resource_node  *comp_grp)
+{
+	struct cam_sfe_bus_wr_comp_grp_data *rsrc_data = NULL;
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_wr_comp_grp_data),
+		GFP_KERNEL);
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	comp_grp->res_priv = rsrc_data;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&comp_grp->list);
+
+	rsrc_data->comp_grp_type   = index;
+	rsrc_data->common_data     = &bus_priv->common_data;
+	rsrc_data->dual_slave_core = CAM_SFE_BUS_SFE_CORE_MAX;
+
+	list_add_tail(&comp_grp->list, &bus_priv->free_comp_grp);
+
+	/* TO DO set top half */
+	comp_grp->top_half_handler = NULL;
+	comp_grp->hw_intf = bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_comp_grp(
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_sfe_bus_wr_comp_grp_data *rsrc_data =
+		comp_grp->res_priv;
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = NULL;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = NULL;
+
+	list_del_init(&comp_grp->list);
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+	comp_grp->res_priv = NULL;
+
+	if (!rsrc_data) {
+		CAM_ERR(CAM_SFE, "comp_grp_priv is NULL");
+		return -ENODEV;
+	}
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update  *secure_mode = cmd_args;
+	struct cam_sfe_bus_wr_out_data    *rsrc_data;
+	uint32_t                          *mode;
+
+	rsrc_data = (struct cam_sfe_bus_wr_out_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode = (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_sfe_bus_acquire_sfe_out(void *priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                     rc = -ENODEV;
+	int                                     i;
+	enum cam_sfe_bus_sfe_out_type           sfe_out_res_id;
+	uint32_t                                format;
+	struct cam_sfe_bus_wr_priv             *bus_priv = priv;
+	struct cam_sfe_acquire_args            *acq_args = acquire_args;
+	struct cam_sfe_hw_sfe_out_acquire_args *out_acquire_args;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_sfe_bus_wr_out_data         *rsrc_data = NULL;
+	uint32_t                                secure_caps = 0, mode;
+	enum cam_sfe_bus_wr_comp_grp_type       comp_grp_id;
+	uint32_t                                client_done_mask = 0;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_SFE, "Invalid Param");
+		return -EINVAL;
+	}
+
+	comp_grp_id = CAM_SFE_BUS_WR_COMP_GRP_MAX;
+	out_acquire_args = &acq_args->sfe_out;
+	format = out_acquire_args->out_port_info->format;
+
+	CAM_DBG(CAM_SFE, "SFE:%d Acquire out_type:0x%X",
+		bus_priv->common_data.core_index,
+		out_acquire_args->out_port_info->res_type);
+
+	sfe_out_res_id = cam_sfe_bus_wr_get_out_res_id(
+		out_acquire_args->out_port_info->res_type);
+	if (sfe_out_res_id == CAM_SFE_BUS_SFE_OUT_MAX)
+		return -ENODEV;
+
+	rsrc_node = &bus_priv->sfe_out[sfe_out_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_SFE,
+			"SFE:%d out_type:0x%X resource not available state:%d",
+			bus_priv->common_data.core_index,
+			sfe_out_res_id, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	if (!acq_args->buf_done_controller) {
+		CAM_ERR(CAM_SFE, "Invalid buf done controller");
+		return -EINVAL;
+	}
+
+	rsrc_data = rsrc_node->res_priv;
+	rsrc_data->common_data->buf_done_controller =
+		acq_args->buf_done_controller;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->priv = acq_args->priv;
+	secure_caps = cam_sfe_bus_can_be_secure(
+		rsrc_data->out_type);
+	mode = out_acquire_args->out_port_info->secure_mode;
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (!rsrc_data->common_data->num_sec_out) {
+			rsrc_data->secure_mode = mode;
+			rsrc_data->common_data->secure_mode = mode;
+		} else {
+			if (mode == rsrc_data->common_data->secure_mode) {
+				rsrc_data->secure_mode =
+					rsrc_data->common_data->secure_mode;
+			} else {
+				rc = -EINVAL;
+				CAM_ERR_RATE_LIMIT(CAM_SFE,
+					"Mismatch: Acquire mode[%d], drvr mode[%d]",
+					rsrc_data->common_data->secure_mode,
+					mode);
+				mutex_unlock(
+					&rsrc_data->common_data->bus_mutex);
+				return rc;
+			}
+		}
+		rsrc_data->common_data->num_sec_out++;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	//bus_priv->tasklet_info = acq_args->tasklet;
+	rsrc_node->rdi_only_ctx = 0;
+	rsrc_node->res_id = out_acquire_args->out_port_info->res_type;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = out_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = out_acquire_args->cdm_ops;
+	rsrc_data->format = out_acquire_args->out_port_info->format;
+
+	/* Acquire WM and retrieve COMP GRP ID */
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_sfe_bus_acquire_wm(bus_priv,
+			out_acquire_args->out_port_info,
+			acq_args->tasklet,
+			sfe_out_res_id,
+			i,
+			&rsrc_data->wm_res[i],
+			&client_done_mask,
+			out_acquire_args->is_dual,
+			&comp_grp_id);
+		if (rc) {
+			CAM_ERR(CAM_SFE,
+				"Failed to acquire WM SFE:%d out_type:%d rc:%d",
+				rsrc_data->common_data->core_index,
+				sfe_out_res_id, rc);
+			goto release_wm;
+		}
+	}
+
+	/* Acquire composite group using COMP GRP ID */
+	rc = cam_sfe_bus_acquire_comp_grp(bus_priv,
+		out_acquire_args->out_port_info,
+		acq_args->tasklet,
+		out_acquire_args->is_dual,
+		out_acquire_args->is_master,
+		&rsrc_data->comp_grp,
+		comp_grp_id);
+	if (rc) {
+		CAM_ERR(CAM_SFE,
+			"Failed to acquire comp_grp SFE:%d out_type:%d rc:%d",
+			rsrc_data->common_data->core_index,
+			sfe_out_res_id, rc);
+		return rc;
+	}
+
+	rsrc_data->is_dual = out_acquire_args->is_dual;
+	rsrc_data->is_master = out_acquire_args->is_master;
+
+	cam_sfe_bus_add_wm_to_comp_grp(rsrc_data->comp_grp,
+		client_done_mask);
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	out_acquire_args->rsrc_node = rsrc_node;
+
+	CAM_DBG(CAM_SFE, "Acquire successful");
+	return rc;
+
+release_wm:
+	for (i--; i >= 0; i--)
+		cam_sfe_bus_release_wm(bus_priv,
+			&rsrc_data->wm_res[i]);
+
+	cam_sfe_bus_release_comp_grp(bus_priv, rsrc_data->comp_grp);
+
+	return rc;
+}
+
+static int cam_sfe_bus_release_sfe_out(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node         *sfe_out = NULL;
+	struct cam_sfe_bus_wr_out_data       *rsrc_data = NULL;
+	uint32_t                              secure_caps = 0;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_SFE, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	sfe_out = release_args;
+	rsrc_data = sfe_out->res_priv;
+
+	if (sfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE,
+			"Invalid resource state:%d SFE:%d out_type:0x%X",
+			sfe_out->res_state, rsrc_data->common_data->core_index,
+			sfe_out->res_id);
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		cam_sfe_bus_release_wm(bus_priv, &rsrc_data->wm_res[i]);
+	rsrc_data->num_wm = 0;
+
+	if (rsrc_data->comp_grp)
+		cam_sfe_bus_release_comp_grp(bus_priv,
+			rsrc_data->comp_grp);
+	rsrc_data->comp_grp = NULL;
+
+	sfe_out->tasklet_info = NULL;
+	sfe_out->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+
+	secure_caps = cam_sfe_bus_can_be_secure(rsrc_data->out_type);
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (rsrc_data->secure_mode ==
+			rsrc_data->common_data->secure_mode) {
+			rsrc_data->common_data->num_sec_out--;
+			rsrc_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+		} else {
+			/*
+			 * The validity of the mode is properly
+			 * checked while acquiring the output port.
+			 * not expected to reach here, unless there is
+			 * some corruption.
+			 */
+			CAM_ERR(CAM_SFE, "driver[%d],resource[%d] mismatch",
+				rsrc_data->common_data->secure_mode,
+				rsrc_data->secure_mode);
+		}
+
+		if (!rsrc_data->common_data->num_sec_out)
+			rsrc_data->common_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	if (sfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		sfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_get_evt_payload(
+	struct cam_sfe_bus_wr_common_data       *common_data,
+	struct cam_sfe_bus_wr_irq_evt_payload  **evt_payload)
+{
+	int rc;
+
+	spin_lock(&common_data->spin_lock);
+
+	if (!common_data->hw_init) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "SFE:%d Bus uninitialized",
+			common_data->core_index);
+		*evt_payload = NULL;
+		rc = -EPERM;
+		goto done;
+	}
+
+	if (list_empty(&common_data->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "No free BUS event payload");
+		*evt_payload = NULL;
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&common_data->free_payload_list,
+		struct cam_sfe_bus_wr_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&common_data->spin_lock);
+	return rc;
+}
+
+static int cam_sfe_bus_wr_put_evt_payload(
+	struct cam_sfe_bus_wr_common_data      *common_data,
+	struct cam_sfe_bus_wr_irq_evt_payload **evt_payload)
+{
+	unsigned long flags;
+
+	if (!common_data) {
+		CAM_ERR(CAM_SFE, "Invalid param common_data NULL");
+		return -EINVAL;
+	}
+
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_SFE, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&common_data->spin_lock, flags);
+	if (common_data->hw_init)
+		list_add_tail(&(*evt_payload)->list,
+			&common_data->free_payload_list);
+	spin_unlock_irqrestore(&common_data->spin_lock, flags);
+
+	*evt_payload = NULL;
+
+	CAM_DBG(CAM_SFE, "Done");
+	return 0;
+}
+
+static int cam_sfe_bus_start_sfe_out(
+	struct cam_isp_resource_node          *sfe_out)
+{
+	int rc = 0, i;
+	struct cam_sfe_bus_wr_out_data      *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_common_data   *common_data = NULL;
+	uint32_t bus_irq_reg_mask[CAM_SFE_IRQ_REGISTERS_MAX];
+	uint32_t source_group = 0;
+
+	if (!sfe_out) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = sfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+	source_group = rsrc_data->source_group;
+
+	if (sfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE,
+			"Invalid resource state:%d SFE:%d out_type:0x%X",
+			sfe_out->res_state, rsrc_data->common_data->core_index,
+			rsrc_data->out_type);
+		return -EACCES;
+	}
+
+	CAM_DBG(CAM_SFE, "Start SFE:%d out_type:0x%X",
+		rsrc_data->common_data->core_index, rsrc_data->out_type);
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_sfe_bus_start_wm(&rsrc_data->wm_res[i]);
+
+	memset(bus_irq_reg_mask, 0, sizeof(bus_irq_reg_mask));
+	rc = cam_sfe_bus_start_comp_grp(rsrc_data->comp_grp,
+		bus_irq_reg_mask);
+
+	if (rsrc_data->is_dual && !rsrc_data->is_master)
+		goto end;
+
+	sfe_out->irq_handle =  cam_irq_controller_subscribe_irq(
+		common_data->buf_done_controller,
+		CAM_IRQ_PRIORITY_1,
+		bus_irq_reg_mask,
+		sfe_out,
+		sfe_out->top_half_handler,
+		sfe_out->bottom_half_handler,
+		sfe_out->tasklet_info,
+		&tasklet_bh_api);
+	if (sfe_out->irq_handle < 1) {
+		CAM_ERR(CAM_SFE, "Subscribe IRQ failed for sfe out_res: %d",
+			sfe_out->res_id);
+		sfe_out->irq_handle = 0;
+		return -EFAULT;
+	}
+end:
+	sfe_out->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_sfe_bus_stop_sfe_out(
+	struct cam_isp_resource_node          *sfe_out)
+{
+	int rc = 0, i;
+	struct cam_sfe_bus_wr_out_data      *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_common_data   *common_data = NULL;
+
+	if (!sfe_out) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = sfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+
+	if (sfe_out->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		sfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_SFE, "Stop SFE:%d out_type:0x%X state:%d",
+			rsrc_data->common_data->core_index, rsrc_data->out_type,
+			sfe_out->res_state);
+		return rc;
+	}
+
+	rc = cam_sfe_bus_stop_comp_grp(rsrc_data->comp_grp);
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_sfe_bus_stop_wm(&rsrc_data->wm_res[i]);
+
+	/* TO DO any IRQ handling */
+	if (sfe_out->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			common_data->buf_done_controller,
+			sfe_out->irq_handle);
+		sfe_out->irq_handle = 0;
+	}
+
+	sfe_out->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_sfe_bus_handle_sfe_out_done_top_half(
+	uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                     rc;
+	int                                         i;
+	struct cam_isp_resource_node               *sfe_out = NULL;
+	struct cam_sfe_bus_wr_out_data             *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_irq_evt_payload      *evt_payload;
+	struct cam_sfe_bus_wr_comp_grp_data        *resource_data;
+	uint32_t                                    status_0;
+
+	sfe_out = th_payload->handler_priv;
+	if (!sfe_out) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "No resource");
+		return -ENODEV;
+	}
+
+	rsrc_data = sfe_out->res_priv;
+	resource_data = rsrc_data->comp_grp->res_priv;
+
+	CAM_DBG(CAM_SFE, "SFE:%d Bus IRQ status_0: 0x%X status_1: 0x%X",
+		rsrc_data->common_data->core_index,
+		th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1]);
+
+	rc  = cam_sfe_bus_wr_get_evt_payload(rsrc_data->common_data,
+			&evt_payload);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_SFE,
+			"SFE:%d Bus IRQ status_0: 0x%X status_1: 0x%X",
+			rsrc_data->common_data->core_index,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	evt_payload->core_index = rsrc_data->common_data->core_index;
+	evt_payload->evt_id = evt_id;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	status_0 = th_payload->evt_status_arr[CAM_SFE_IRQ_BUS_REG_STATUS0];
+
+	if (status_0 & BIT(resource_data->comp_grp_type +
+		rsrc_data->common_data->comp_done_shift)) {
+		trace_cam_log_event("bufdone", "bufdone_IRQ",
+			status_0, resource_data->comp_grp_type);
+	}
+
+	return rc;
+}
+
+static int cam_sfe_bus_handle_comp_done_bottom_half(
+	void                *handler_priv,
+	void                *evt_payload_priv,
+	uint32_t            *comp_mask)
+{
+	int rc = CAM_SFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node          *comp_grp = handler_priv;
+	struct cam_sfe_bus_wr_irq_evt_payload *evt_payload = evt_payload_priv;
+	struct cam_sfe_bus_wr_comp_grp_data   *rsrc_data = comp_grp->res_priv;
+	uint32_t                              *cam_ife_irq_regs;
+	uint32_t                               status_0;
+
+	if (!evt_payload)
+		return rc;
+
+	if (rsrc_data->is_dual && (!rsrc_data->is_master)) {
+		CAM_ERR(CAM_SFE, "Invalid comp_grp:%u is_master:%u",
+			rsrc_data->comp_grp_type, rsrc_data->is_master);
+		return rc;
+	}
+
+	cam_ife_irq_regs = evt_payload->irq_reg_val;
+	status_0 = cam_ife_irq_regs[CAM_SFE_IRQ_BUS_REG_STATUS0];
+
+	if (status_0 & BIT(rsrc_data->comp_grp_type +
+		rsrc_data->common_data->comp_done_shift)) {
+		evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+		rc = CAM_SFE_IRQ_STATUS_SUCCESS;
+	}
+
+	CAM_DBG(CAM_SFE, "SFE:%d comp_grp:%d Bus IRQ status_0: 0x%X rc:%d",
+		rsrc_data->common_data->core_index, rsrc_data->comp_grp_type,
+		status_0, rc);
+
+	*comp_mask = rsrc_data->composite_mask;
+
+	return rc;
+}
+
+static int cam_sfe_bus_handle_sfe_out_done_bottom_half(
+	void                *handler_priv,
+	void                *evt_payload_priv)
+{
+	int                                    rc = -EINVAL, num_out = 0, i = 0;
+	struct cam_isp_resource_node          *sfe_out = handler_priv;
+	struct cam_sfe_bus_wr_out_data        *rsrc_data = sfe_out->res_priv;
+	struct cam_sfe_bus_wr_irq_evt_payload *evt_payload = evt_payload_priv;
+	struct cam_isp_hw_event_info           evt_info;
+	void                                  *ctx = NULL;
+	uint32_t                               evt_id = 0, comp_mask = 0;
+	uint32_t                       out_list[CAM_SFE_BUS_SFE_OUT_MAX];
+
+	rc = cam_sfe_bus_handle_comp_done_bottom_half(
+		rsrc_data->comp_grp, evt_payload_priv, &comp_mask);
+	CAM_DBG(CAM_SFE, "SFE:%d out_type:0x%X rc:%d",
+		rsrc_data->common_data->core_index, rsrc_data->out_type,
+		rsrc_data->out_type, rc);
+
+	ctx = rsrc_data->priv;
+	memset(out_list, 0, sizeof(out_list));
+
+	switch (rc) {
+	case CAM_SFE_IRQ_STATUS_SUCCESS:
+		evt_id = evt_payload->evt_id;
+
+		evt_info.res_type = sfe_out->res_type;
+		evt_info.hw_idx   = sfe_out->hw_intf->hw_idx;
+
+		rc = cam_sfe_bus_get_comp_sfe_out_res_id_list(
+			comp_mask, out_list, &num_out);
+		for (i = 0; i < num_out; i++) {
+			evt_info.res_id = out_list[i];
+			if (rsrc_data->common_data->event_cb)
+				rsrc_data->common_data->event_cb(ctx, evt_id,
+					(void *)&evt_info);
+		}
+		break;
+	default:
+		break;
+	}
+
+	cam_sfe_bus_wr_put_evt_payload(rsrc_data->common_data, &evt_payload);
+
+	return rc;
+}
+
+static int cam_sfe_bus_init_sfe_out_resource(
+	uint32_t                              index,
+	struct cam_sfe_bus_wr_priv           *bus_priv,
+	struct cam_sfe_bus_wr_hw_info        *hw_info)
+{
+	struct cam_isp_resource_node         *sfe_out = NULL;
+	struct cam_sfe_bus_wr_out_data       *rsrc_data = NULL;
+	int rc = 0, i = 0;
+	int32_t sfe_out_type =
+		hw_info->sfe_out_hw_info[index].sfe_out_type;
+
+	if (sfe_out_type < 0 ||
+		sfe_out_type >= CAM_SFE_BUS_SFE_OUT_MAX) {
+		CAM_ERR(CAM_SFE, "Init SFE Out failed, Invalid type=%d",
+			sfe_out_type);
+		return -EINVAL;
+	}
+
+	sfe_out = &bus_priv->sfe_out[sfe_out_type];
+	if (sfe_out->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		sfe_out->res_priv) {
+		CAM_ERR(CAM_SFE, "sfe_out_type %d has already been initialized",
+			sfe_out_type);
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_sfe_bus_wr_out_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	sfe_out->res_priv = rsrc_data;
+
+	sfe_out->res_type = CAM_ISP_RESOURCE_SFE_OUT;
+	sfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&sfe_out->list);
+
+	rsrc_data->source_group =
+		hw_info->sfe_out_hw_info[index].source_group;
+	rsrc_data->out_type     =
+		hw_info->sfe_out_hw_info[index].sfe_out_type;
+	rsrc_data->common_data  = &bus_priv->common_data;
+	rsrc_data->max_width    =
+		hw_info->sfe_out_hw_info[index].max_width;
+	rsrc_data->max_height   =
+		hw_info->sfe_out_hw_info[index].max_height;
+	rsrc_data->secure_mode  = CAM_SECURE_MODE_NON_SECURE;
+	rsrc_data->num_wm       = hw_info->sfe_out_hw_info[index].num_wm;
+
+	rsrc_data->wm_res = kzalloc((sizeof(struct cam_isp_resource_node) *
+		rsrc_data->num_wm), GFP_KERNEL);
+	if (!rsrc_data->wm_res) {
+		CAM_ERR(CAM_SFE, "Failed to alloc for wm_res");
+		return -ENOMEM;
+	}
+
+	rc = cam_sfe_bus_init_wm_resource(
+			hw_info->sfe_out_hw_info[index].wm_idx,
+			bus_priv, hw_info,
+			&rsrc_data->wm_res[i]);
+	if (rc < 0) {
+		CAM_ERR(CAM_SFE, "SFE:%d init WM:%d failed rc:%d",
+			bus_priv->common_data.core_index, i, rc);
+		return rc;
+	}
+
+	sfe_out->start = cam_sfe_bus_start_sfe_out;
+	sfe_out->stop = cam_sfe_bus_stop_sfe_out;
+	sfe_out->top_half_handler =
+		cam_sfe_bus_handle_sfe_out_done_top_half;
+	sfe_out->bottom_half_handler =
+		cam_sfe_bus_handle_sfe_out_done_bottom_half;
+	sfe_out->process_cmd = cam_sfe_bus_wr_process_cmd;
+	sfe_out->hw_intf = bus_priv->common_data.hw_intf;
+	sfe_out->irq_handle = 0;
+
+	return 0;
+}
+
+static int cam_sfe_bus_deinit_sfe_out_resource(
+	struct cam_isp_resource_node    *sfe_out)
+{
+	struct cam_sfe_bus_wr_out_data *rsrc_data = sfe_out->res_priv;
+	int rc = 0, i = 0;
+
+	if (sfe_out->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		return 0;
+	}
+
+	sfe_out->start = NULL;
+	sfe_out->stop = NULL;
+	sfe_out->top_half_handler = NULL;
+	sfe_out->bottom_half_handler = NULL;
+	sfe_out->hw_intf = NULL;
+	sfe_out->irq_handle = 0;
+
+	sfe_out->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&sfe_out->list);
+	sfe_out->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_sfe_bus_deinit_wm_resource(&rsrc_data->wm_res[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"SFE:%d deinit WM:%d failed rc:%d",
+				rsrc_data->common_data->core_index, i, rc);
+	}
+
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_print_dimensions(
+	enum cam_sfe_bus_sfe_out_type        sfe_out_res_id,
+	struct cam_sfe_bus_wr_priv          *bus_priv)
+{
+	struct cam_isp_resource_node            *rsrc_node = NULL;
+	struct cam_sfe_bus_wr_out_data          *rsrc_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data  *wm_data   = NULL;
+	int                                      i, wm_idx;
+
+	rsrc_node = &bus_priv->sfe_out[sfe_out_res_id];
+	rsrc_data = rsrc_node->res_priv;
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		wm_data = (struct cam_sfe_bus_wr_wm_resource_data  *)
+			&rsrc_data->wm_res[i].res_priv;
+		wm_idx = wm_data->index;
+		if (wm_idx < 0 || wm_idx >= bus_priv->num_client) {
+			CAM_ERR(CAM_SFE, "Unsupported SFE out %d",
+				sfe_out_res_id);
+			return -EINVAL;
+		}
+
+		CAM_INFO(CAM_SFE,
+			"SFE:%d WM:%d width:%u height:%u stride:%u x_init:%u en_cfg:%u acquired width:%u height:%u",
+			wm_data->common_data->core_index, wm_idx,
+			wm_data->width,
+			wm_data->height,
+			wm_data->stride, wm_data->h_init,
+			wm_data->en_cfg,
+			wm_data->acquired_width,
+			wm_data->acquired_height);
+	}
+	return 0;
+}
+
+static int cam_sfe_bus_wr_handle_bus_irq(uint32_t    evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_sfe_bus_wr_priv          *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller);
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_sfe_bus_wr_err_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+
+	int i = 0, rc = 0;
+	struct cam_sfe_bus_wr_priv *bus_priv =
+		th_payload->handler_priv;
+	struct cam_sfe_bus_wr_irq_evt_payload *evt_payload;
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "SFE:%d BUS Err IRQ",
+		bus_priv->common_data.core_index);
+
+	for (i = 0; i < th_payload->num_registers; i++) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "SFE:%d BUS IRQ status_%d: 0x%X",
+		bus_priv->common_data.core_index, i,
+			th_payload->evt_status_arr[i]);
+	}
+	cam_irq_controller_disable_irq(
+		bus_priv->common_data.bus_irq_controller,
+		bus_priv->error_irq_handle);
+
+	rc  = cam_sfe_bus_wr_get_evt_payload(&bus_priv->common_data,
+		&evt_payload);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->core_index = bus_priv->common_data.core_index;
+
+	evt_payload->ccif_violation_status = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->ccif_violation_status);
+
+	evt_payload->image_size_violation_status = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->image_size_violation_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_sfe_bus_wr_irq_bottom_half(
+	void *handler_priv, void *evt_payload_priv)
+{
+	uint32_t status = 0;
+	struct cam_sfe_bus_wr_priv            *bus_priv = handler_priv;
+	struct cam_sfe_bus_wr_common_data     *common_data;
+	struct cam_isp_hw_event_info           evt_info;
+	struct cam_sfe_bus_wr_irq_evt_payload *evt_payload = evt_payload_priv;
+
+	if (!handler_priv || !evt_payload_priv)
+		return -EINVAL;
+
+	common_data = &bus_priv->common_data;
+
+	status = evt_payload->irq_reg_val[CAM_SFE_IRQ_BUS_REG_STATUS0];
+
+	CAM_ERR(CAM_SFE,
+		"SFE:%d status 0x%x Image Size violation status 0x%x CCIF violation status 0x%x",
+		bus_priv->common_data.core_index, status,
+		evt_payload->image_size_violation_status,
+		evt_payload->ccif_violation_status);
+
+	cam_sfe_bus_wr_put_evt_payload(common_data, &evt_payload);
+
+	evt_info.hw_idx = common_data->core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_SFE_OUT;
+	evt_info.res_id = CAM_SFE_BUS_SFE_OUT_MAX;
+	evt_info.err_type = CAM_SFE_IRQ_STATUS_VIOLATION;
+
+	if (common_data->event_cb)
+		common_data->event_cb(NULL, CAM_ISP_HW_EVENT_ERROR,
+			(void *)&evt_info);
+	return 0;
+}
+
+static int cam_sfe_bus_wr_update_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update       *update_buf;
+	struct cam_buf_io_cfg                  *io_cfg = NULL;
+	struct cam_sfe_bus_wr_out_data         *sfe_out_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data *wm_data = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t  i, j, k, size = 0;
+	uint32_t  frame_inc = 0, val;
+	uint32_t loop_size = 0, stride = 0, slice_h = 0;
+
+	bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+	update_buf =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
+		update_buf->res->res_priv;
+
+	if (!sfe_out_data || !sfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	if (update_buf->wm_update->num_buf != sfe_out_data->num_wm) {
+		CAM_ERR(CAM_SFE,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->wm_update->num_buf, sfe_out_data->num_wm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &sfe_out_data->common_data->io_buf_update[0];
+	if (update_buf->use_scratch_cfg)
+		CAM_DBG(CAM_SFE, "Using scratch buf config");
+	else
+		io_cfg = update_buf->wm_update->io_cfg;
+
+	for (i = 0, j = 0; i < sfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_SFE,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = (struct cam_sfe_bus_wr_wm_resource_data *)
+			sfe_out_data->wm_res[i].res_priv;
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg, wm_data->en_cfg);
+		CAM_DBG(CAM_SFE, "WM:%d en_cfg 0x%X",
+			wm_data->index, reg_val_pair[j-1]);
+
+		val = (wm_data->height << 16) | wm_data->width;
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_cfg_0, val);
+		CAM_DBG(CAM_SFE, "WM:%d image height and width 0x%X",
+			wm_data->index, reg_val_pair[j-1]);
+
+		/* For initial configuration program all bus registers */
+		if (update_buf->use_scratch_cfg) {
+			stride = update_buf->wm_update->stride;
+			slice_h = update_buf->wm_update->slice_height;
+		} else {
+			stride = io_cfg->planes[i].plane_stride;
+			slice_h = io_cfg->planes[i].slice_height;
+		}
+
+		val = stride;
+		CAM_DBG(CAM_SFE, "before stride %d", val);
+		val = ALIGNUP(val, 16);
+		if (val != stride &&
+			val != wm_data->stride)
+			CAM_WARN(CAM_SFE, "Warning stride %u expected %u",
+				stride, val);
+
+		if (wm_data->stride != val || !wm_data->init_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_2,
+				stride);
+			wm_data->stride = val;
+			CAM_DBG(CAM_SFE, "WM:%d image stride 0x%X",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		frame_inc = stride * slice_h;
+
+		if (!(wm_data->en_cfg & (0x3 << 16))) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_1, wm_data->h_init);
+			CAM_DBG(CAM_SFE, "WM:%d h_init 0x%X",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		if (wm_data->index > 7)
+			loop_size = wm_data->irq_subsample_period + 1;
+		else
+			loop_size = 1;
+
+		/* WM Image address */
+		for (k = 0; k < loop_size; k++) {
+			if (wm_data->en_cfg & (0x3 << 16))
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					wm_data->hw_regs->image_addr,
+					(update_buf->wm_update->image_buf[i] +
+					wm_data->offset + k * frame_inc));
+			else
+				CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					wm_data->hw_regs->image_addr,
+					(update_buf->wm_update->image_buf[i] +
+					k * frame_inc));
+
+			CAM_DBG(CAM_SFE, "WM:%d image address 0x%X",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->frame_incr, frame_inc);
+		CAM_DBG(CAM_SFE, "WM:%d frame_inc %d",
+			wm_data->index, reg_val_pair[j-1]);
+
+		/* enable the WM */
+		CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg,
+			wm_data->en_cfg);
+
+		/* set initial configuration done */
+		if (!wm_data->init_cfg_done)
+			wm_data->init_cfg_done = true;
+	}
+
+	size = sfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_buf->cmd.size) {
+		CAM_ERR(CAM_SFE,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_buf->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	sfe_out_data->cdm_util_ops->cdm_write_regrandom(
+		update_buf->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_buf->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update       *update_hfr;
+	struct cam_sfe_bus_wr_out_data         *sfe_out_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data *wm_data = NULL;
+	struct cam_isp_port_hfr_config         *hfr_cfg = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t  i, j, size = 0;
+
+	bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+	update_hfr =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
+		update_hfr->res->res_priv;
+
+	if (!sfe_out_data || !sfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	reg_val_pair = &sfe_out_data->common_data->io_buf_update[0];
+	hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data;
+
+	for (i = 0, j = 0; i < sfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_SFE,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = sfe_out_data->wm_res[i].res_priv;
+		if ((wm_data->framedrop_pattern !=
+			hfr_cfg->framedrop_pattern) ||
+			!wm_data->hfr_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_pattern,
+				hfr_cfg->framedrop_pattern);
+			wm_data->framedrop_pattern = hfr_cfg->framedrop_pattern;
+			CAM_DBG(CAM_SFE, "WM:%d framedrop pattern 0x%X",
+				wm_data->index, wm_data->framedrop_pattern);
+		}
+
+		if (wm_data->framedrop_period != hfr_cfg->framedrop_period ||
+			!wm_data->hfr_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_period,
+				hfr_cfg->framedrop_period);
+			wm_data->framedrop_period = hfr_cfg->framedrop_period;
+			CAM_DBG(CAM_SFE, "WM:%d framedrop period 0x%X",
+				wm_data->index, wm_data->framedrop_period);
+		}
+
+		if (wm_data->irq_subsample_period != hfr_cfg->subsample_period
+			|| !wm_data->hfr_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_period,
+				hfr_cfg->subsample_period);
+			wm_data->irq_subsample_period =
+				hfr_cfg->subsample_period;
+			CAM_DBG(CAM_SFE, "WM:%d irq subsample period 0x%X",
+				wm_data->index, wm_data->irq_subsample_period);
+		}
+
+		if (wm_data->irq_subsample_pattern != hfr_cfg->subsample_pattern
+			|| !wm_data->hfr_cfg_done) {
+			CAM_SFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_pattern,
+				hfr_cfg->subsample_pattern);
+			wm_data->irq_subsample_pattern =
+				hfr_cfg->subsample_pattern;
+			CAM_DBG(CAM_SFE, "WM:%d irq subsample pattern 0x%X",
+				wm_data->index, wm_data->irq_subsample_pattern);
+		}
+
+		/* set initial configuration done */
+		if (!wm_data->hfr_cfg_done)
+			wm_data->hfr_cfg_done = true;
+	}
+
+	size = sfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_hfr->cmd.size) {
+		CAM_ERR(CAM_SFE,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_hfr->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	sfe_out_data->cdm_util_ops->cdm_write_regrandom(
+		update_hfr->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_hfr->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_update_stripe_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv                *bus_priv;
+	struct cam_isp_hw_dual_isp_update_args    *stripe_args;
+	struct cam_sfe_bus_wr_out_data            *sfe_out_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data    *wm_data = NULL;
+	struct cam_isp_dual_stripe_config         *stripe_config;
+	uint32_t outport_id, ports_plane_idx, i;
+
+	bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+	stripe_args = (struct cam_isp_hw_dual_isp_update_args *)cmd_args;
+
+	sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
+		stripe_args->res->res_priv;
+
+	if (!sfe_out_data) {
+		CAM_ERR(CAM_SFE, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	outport_id = stripe_args->res->res_id & 0xFF;
+	if (stripe_args->res->res_id < CAM_ISP_SFE_OUT_RES_BASE ||
+		stripe_args->res->res_id >= CAM_ISP_SFE_OUT_RES_MAX)
+		return 0;
+
+	ports_plane_idx = (stripe_args->split_id *
+	(stripe_args->dual_cfg->num_ports * CAM_PACKET_MAX_PLANES)) +
+	(outport_id * CAM_PACKET_MAX_PLANES);
+	for (i = 0; i < sfe_out_data->num_wm; i++) {
+		wm_data = sfe_out_data->wm_res[i].res_priv;
+		stripe_config = (struct cam_isp_dual_stripe_config  *)
+			&stripe_args->dual_cfg->stripes_flex[ports_plane_idx + i];
+		wm_data->width = stripe_config->width;
+
+		/*
+		 * UMD sends buffer offset address as offset for clients
+		 * programmed to operate in frame/index based mode and h_init
+		 * value as offset for clients programmed to operate in line
+		 * based mode.
+		 */
+
+		if (wm_data->en_cfg & (0x3 << 16))
+			wm_data->offset = stripe_config->offset;
+		else
+			wm_data->h_init = stripe_config->offset;
+
+		CAM_DBG(CAM_SFE,
+			"out_type:0x%X WM:%d width:%d offset:0x%X h_init:%d",
+			stripe_args->res->res_id, wm_data->index,
+			wm_data->width, wm_data->offset, wm_data->h_init);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_update_wm_config(
+	void                                        *cmd_args)
+{
+	int                                          i;
+	struct cam_isp_hw_get_cmd_update            *wm_config_update;
+	struct cam_sfe_bus_wr_out_data              *sfe_out_data = NULL;
+	struct cam_sfe_bus_wr_wm_resource_data      *wm_data = NULL;
+	struct cam_isp_vfe_wm_config                *wm_config = NULL;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	wm_config_update = cmd_args;
+	sfe_out_data = wm_config_update->res->res_priv;
+	wm_config = (struct cam_isp_vfe_wm_config  *)
+		wm_config_update->data;
+
+	if (!sfe_out_data || !sfe_out_data->cdm_util_ops || !wm_config) {
+		CAM_ERR(CAM_SFE, "Invalid data");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < sfe_out_data->num_wm; i++) {
+		wm_data = sfe_out_data->wm_res[i].res_priv;
+
+		if (wm_config->wm_mode > 0x2) {
+			CAM_ERR(CAM_SFE, "Invalid wm_mode: 0x%X WM:%d",
+				wm_config->wm_mode, wm_data->index);
+			return -EINVAL;
+		}
+
+		wm_data->en_cfg = (wm_config->wm_mode << 16) | 0x1;
+		wm_data->width  = wm_config->width;
+
+		if (i == PLANE_C)
+			wm_data->height = wm_config->height / 2;
+		else
+			wm_data->height = wm_config->height;
+
+		CAM_DBG(CAM_SFE,
+			"WM:%d en_cfg:0x%X height:%d width:%d",
+			wm_data->index, wm_data->en_cfg, wm_data->height,
+			wm_data->width);
+	}
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_start_hw(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	return cam_sfe_bus_start_sfe_out(hw_priv);
+}
+
+static int cam_sfe_bus_wr_stop_hw(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	return cam_sfe_bus_stop_sfe_out(hw_priv);
+}
+
+static int cam_sfe_bus_wr_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv    *bus_priv = hw_priv;
+	uint32_t top_irq_reg_mask[CAM_SFE_IRQ_REGISTERS_MAX] = {0};
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (bus_priv->common_data.hw_init)
+		return 0;
+
+	/* Subscribe top IRQ */
+	top_irq_reg_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	bus_priv->bus_irq_handle = cam_irq_controller_subscribe_irq(
+		bus_priv->common_data.sfe_irq_controller,
+		CAM_IRQ_PRIORITY_4,
+		top_irq_reg_mask,
+		bus_priv,
+		cam_sfe_bus_wr_handle_bus_irq,
+		NULL,
+		NULL,
+		NULL);
+
+	if (bus_priv->bus_irq_handle < 1) {
+		CAM_ERR(CAM_SFE, "Failed to subscribe BUS (buf_done) IRQ");
+		bus_priv->bus_irq_handle = 0;
+		return -EFAULT;
+	}
+
+	if (bus_priv->tasklet_info != NULL) {
+		bus_priv->error_irq_handle = cam_irq_controller_subscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			bus_wr_error_irq_mask,
+			bus_priv,
+			cam_sfe_bus_wr_err_irq_top_half,
+			cam_sfe_bus_wr_irq_bottom_half,
+			bus_priv->tasklet_info,
+			&tasklet_bh_api);
+
+		if (bus_priv->error_irq_handle < 1) {
+			CAM_ERR(CAM_SFE, "Failed to subscribe BUS Error IRQ");
+			bus_priv->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	/* BUS_WR_TEST_BUS_CTRL */
+	cam_io_w_mb(0x0, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->test_bus_ctrl);
+
+	bus_priv->common_data.hw_init = true;
+
+	return 0;
+}
+
+static int cam_sfe_bus_wr_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_sfe_bus_wr_priv    *bus_priv = hw_priv;
+	int                            rc = 0;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_SFE, "Error: Invalid args");
+		return -EINVAL;
+	}
+
+	if (!bus_priv->common_data.hw_init)
+		return 0;
+
+	/* To Do Unsubscribe IRQs */
+
+	return rc;
+}
+
+static int __cam_sfe_bus_wr_process_cmd(
+	void *priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	return cam_sfe_bus_wr_process_cmd(priv, cmd_type,
+		cmd_args, arg_size);
+}
+
+static int cam_sfe_bus_wr_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args,
+	uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_sfe_bus_wr_priv *bus_priv;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+		rc = cam_sfe_bus_wr_update_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+		rc = cam_sfe_bus_wr_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_SECURE_MODE:
+		rc = cam_sfe_bus_wr_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+		rc = cam_sfe_bus_wr_update_stripe_cfg(priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+		bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+		/* Handle bus err IRQ */
+		break;
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO: {
+		struct cam_isp_hw_event_info  *event_info;
+		enum cam_sfe_bus_sfe_out_type  sfe_out_res_id;
+
+		event_info =
+			(struct cam_isp_hw_event_info *)cmd_args;
+		bus_priv = (struct cam_sfe_bus_wr_priv  *) priv;
+		sfe_out_res_id =
+			cam_sfe_bus_wr_get_out_res_id(event_info->res_id);
+		rc = cam_sfe_bus_wr_print_dimensions(
+			sfe_out_res_id, bus_priv);
+		break;
+		}
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+		rc = cam_sfe_bus_wr_update_wm_config(cmd_args);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_SFE, "Invalid HW command type:%d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_sfe_bus_wr_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *sfe_irq_controller,
+	struct cam_sfe_bus                  **sfe_bus)
+{
+	int i, rc = 0;
+	struct cam_sfe_bus_wr_priv    *bus_priv = NULL;
+	struct cam_sfe_bus            *sfe_bus_local;
+	struct cam_sfe_bus_wr_hw_info *hw_info = bus_hw_info;
+
+	CAM_DBG(CAM_SFE, "Enter");
+
+	if (!soc_info || !hw_intf || !bus_hw_info) {
+		CAM_ERR(CAM_SFE,
+			"Inval_prms soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_hw_info);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	sfe_bus_local = kzalloc(sizeof(struct cam_sfe_bus), GFP_KERNEL);
+	if (!sfe_bus_local) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for sfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_sfe_bus_wr_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_SFE, "Failed to alloc for sfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+	sfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                     = hw_info->num_client;
+	bus_priv->num_out                        = hw_info->num_out;
+	bus_priv->num_comp_grp                   = hw_info->num_comp_grp;
+	bus_priv->top_irq_shift                  = hw_info->top_irq_shift;
+	bus_priv->common_data.num_sec_out        = 0;
+	bus_priv->common_data.secure_mode        = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index         = soc_info->index;
+	bus_priv->common_data.mem_base           =
+		CAM_SOC_GET_REG_MAP_START(soc_info, SFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf            = hw_intf;
+	bus_priv->common_data.common_reg         = &hw_info->common_reg;
+	bus_priv->common_data.comp_done_shift    = hw_info->comp_done_shift;
+	bus_priv->common_data.hw_init            = false;
+	bus_priv->common_data.sfe_irq_controller = sfe_irq_controller;
+	rc = cam_cpas_get_cpas_hw_version(&bus_priv->common_data.hw_version);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Failed to get hw_version rc:%d", rc);
+		goto free_bus_priv;
+	}
+
+	bus_priv->comp_grp = kzalloc((sizeof(struct cam_isp_resource_node) *
+		bus_priv->num_comp_grp), GFP_KERNEL);
+	if (!bus_priv->comp_grp) {
+		CAM_ERR(CAM_SFE, "Failed to alloc for bus comp groups");
+		rc = -ENOMEM;
+		goto free_bus_priv;
+	}
+
+	bus_priv->sfe_out = kzalloc((sizeof(struct cam_isp_resource_node) *
+		CAM_SFE_BUS_SFE_OUT_MAX), GFP_KERNEL);
+	if (!bus_priv->sfe_out) {
+		CAM_ERR(CAM_SFE, "Failed to alloc for bus out res");
+		rc = -ENOMEM;
+		goto free_comp_grp;
+	}
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+	rc = cam_irq_controller_init(drv_name,
+		bus_priv->common_data.mem_base,
+		&hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller,
+		false);
+	if (rc) {
+		CAM_ERR(CAM_SFE, "Init bus_irq_controller failed");
+		goto free_bus_priv;
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	for (i = 0; i < bus_priv->num_comp_grp; i++) {
+		rc = cam_sfe_bus_wr_init_comp_grp(i, soc_info,
+			bus_priv, bus_hw_info,
+			&bus_priv->comp_grp[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_SFE, "SFE:%d init comp_grp:%d failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+			goto deinit_comp_grp;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_sfe_bus_init_sfe_out_resource(i, bus_priv,
+			bus_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_SFE,
+				"SFE:%d init out_type:0x%X failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+			goto deinit_sfe_out;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+
+	for (i = 0; i < CAM_SFE_BUS_WR_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+
+	sfe_bus_local->hw_ops.reserve      = cam_sfe_bus_acquire_sfe_out;
+	sfe_bus_local->hw_ops.release      = cam_sfe_bus_release_sfe_out;
+	sfe_bus_local->hw_ops.start        = cam_sfe_bus_wr_start_hw;
+	sfe_bus_local->hw_ops.stop         = cam_sfe_bus_wr_stop_hw;
+	sfe_bus_local->hw_ops.init         = cam_sfe_bus_wr_init_hw;
+	sfe_bus_local->hw_ops.deinit       = cam_sfe_bus_wr_deinit_hw;
+	sfe_bus_local->top_half_handler    = NULL;
+	sfe_bus_local->bottom_half_handler = NULL;
+	sfe_bus_local->hw_ops.process_cmd  = __cam_sfe_bus_wr_process_cmd;
+
+	*sfe_bus = sfe_bus_local;
+
+	CAM_DBG(CAM_SFE, "Exit");
+	return rc;
+
+deinit_sfe_out:
+	if (i < 0)
+		i = CAM_SFE_BUS_SFE_OUT_MAX;
+	for (--i; i >= 0; i--)
+		cam_sfe_bus_deinit_sfe_out_resource(&bus_priv->sfe_out[i]);
+
+deinit_comp_grp:
+	if (i < 0)
+		i = bus_priv->num_comp_grp;
+	for (--i; i >= 0; i--)
+		cam_sfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+	kfree(bus_priv->sfe_out);
+
+free_comp_grp:
+	kfree(bus_priv->comp_grp);
+
+free_bus_priv:
+	kfree(sfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(sfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_sfe_bus_wr_deinit(
+	struct cam_sfe_bus                  **sfe_bus)
+{
+	int i, rc = 0;
+	struct cam_sfe_bus_wr_priv    *bus_priv = NULL;
+	struct cam_sfe_bus            *sfe_bus_local;
+	unsigned long                  flags;
+
+	if (!sfe_bus || !*sfe_bus) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return -EINVAL;
+	}
+	sfe_bus_local = *sfe_bus;
+
+	bus_priv = sfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_SFE, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_SFE_BUS_WR_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+	bus_priv->common_data.hw_init = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	for (i = 0; i < CAM_SFE_BUS_WR_COMP_GRP_MAX; i++) {
+		rc = cam_sfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"SFE:%d deinit comp_grp:%d failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+	}
+
+	for (i = 0; i < CAM_SFE_BUS_SFE_OUT_MAX; i++) {
+		rc = cam_sfe_bus_deinit_sfe_out_resource(
+			&bus_priv->sfe_out[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_SFE,
+				"SFE:%d deinit out_type:0x%X failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+	kfree(sfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(sfe_bus_local);
+
+	*sfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.h
@@ -0,0 +1,183 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_SFE_BUS_WR_H_
+#define _CAM_SFE_BUS_WR_H_
+
+#include "cam_sfe_bus.h"
+
+#define CAM_SFE_BUS_WR_MAX_CLIENTS     13
+#define CAM_SFE_BUS_WR_MAX_SUB_GRPS    6
+
+enum cam_sfe_bus_wr_src_grp {
+	CAM_SFE_BUS_WR_SRC_GRP_0,
+	CAM_SFE_BUS_WR_SRC_GRP_1,
+	CAM_SFE_BUS_WR_SRC_GRP_2,
+	CAM_SFE_BUS_WR_SRC_GRP_3,
+	CAM_SFE_BUS_WR_SRC_GRP_4,
+	CAM_SFE_BUS_WR_SRC_GRP_5,
+	CAM_SFE_BUS_WR_SRC_GRP_MAX,
+};
+
+enum cam_sfe_bus_wr_comp_grp_type {
+	CAM_SFE_BUS_WR_COMP_GRP_0,
+	CAM_SFE_BUS_WR_COMP_GRP_1,
+	CAM_SFE_BUS_WR_COMP_GRP_2,
+	CAM_SFE_BUS_WR_COMP_GRP_3,
+	CAM_SFE_BUS_WR_COMP_GRP_4,
+	CAM_SFE_BUS_WR_COMP_GRP_5,
+	CAM_SFE_BUS_WR_COMP_GRP_6,
+	CAM_SFE_BUS_WR_COMP_GRP_7,
+	CAM_SFE_BUS_WR_COMP_GRP_8,
+	CAM_SFE_BUS_WR_COMP_GRP_9,
+	CAM_SFE_BUS_WR_COMP_GRP_MAX,
+};
+
+enum cam_sfe_bus_sfe_out_type {
+	CAM_SFE_BUS_SFE_OUT_RDI0,
+	CAM_SFE_BUS_SFE_OUT_RDI1,
+	CAM_SFE_BUS_SFE_OUT_RDI2,
+	CAM_SFE_BUS_SFE_OUT_RDI3,
+	CAM_SFE_BUS_SFE_OUT_RDI4,
+	CAM_SFE_BUS_SFE_OUT_RAW_DUMP,
+	CAM_SFE_BUS_SFE_OUT_LCR,
+	CAM_SFE_BUS_SFE_OUT_BE_0,
+	CAM_SFE_BUS_SFE_OUT_BHIST_0,
+	CAM_SFE_BUS_SFE_OUT_BE_1,
+	CAM_SFE_BUS_SFE_OUT_BHIST_1,
+	CAM_SFE_BUS_SFE_OUT_BE_2,
+	CAM_SFE_BUS_SFE_OUT_BHIST_2,
+	CAM_SFE_BUS_SFE_OUT_MAX,
+};
+
+/*
+ * struct cam_sfe_bus_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_sfe_bus_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t cgc_ovd;
+	uint32_t if_frameheader_cfg[CAM_SFE_BUS_WR_MAX_SUB_GRPS];
+	uint32_t pwr_iso_cfg;
+	uint32_t overflow_status_clear;
+	uint32_t ccif_violation_status;
+	uint32_t overflow_status;
+	uint32_t image_size_violation_status;
+	uint32_t debug_status_top_cfg;
+	uint32_t debug_status_top;
+	uint32_t test_bus_ctrl;
+	uint32_t top_irq_mask_0;
+	struct cam_irq_controller_reg_info irq_reg_info;
+};
+
+/*
+ * struct cam_sfe_bus_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_sfe_bus_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t frame_incr;
+	uint32_t image_cfg_0;
+	uint32_t image_cfg_1;
+	uint32_t image_cfg_2;
+	uint32_t packer_cfg;
+	uint32_t frame_header_addr;
+	uint32_t frame_header_incr;
+	uint32_t frame_header_cfg;
+	uint32_t line_done_cfg;
+	uint32_t irq_subsample_period;
+	uint32_t irq_subsample_pattern;
+	uint32_t framedrop_period;
+	uint32_t framedrop_pattern;
+	uint32_t system_cache_cfg;
+	uint32_t addr_status_0;
+	uint32_t addr_status_1;
+	uint32_t addr_status_2;
+	uint32_t addr_status_3;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	uint32_t comp_group;
+};
+
+/*
+ * struct cam_sfe_bus_sfe_out_hw_info:
+ *
+ * @Brief:        HW capability of SFE Bus Client
+ */
+struct cam_sfe_bus_sfe_out_hw_info {
+	enum cam_sfe_bus_sfe_out_type       sfe_out_type;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+	uint32_t                            source_group;
+	uint32_t                            num_wm;
+	uint32_t                            wm_idx;
+};
+
+/*
+ * struct cam_sfe_bus_wr_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:       Common register details
+ * @num_client:       Total number of write clients
+ * @bus_client_reg:   Bus client register info
+ * @sfe_out_hw_info:  SFE output capability
+ * @num_comp_grp:     Number of composite groups
+ * @comp_done_shift:  Mask shift for comp done mask
+ * @top_irq_shift:    Mask shift for top level BUS WR irq
+ */
+struct cam_sfe_bus_wr_hw_info {
+	struct cam_sfe_bus_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_sfe_bus_reg_offset_bus_client
+		bus_client_reg[CAM_SFE_BUS_WR_MAX_CLIENTS];
+	uint32_t num_out;
+	struct cam_sfe_bus_sfe_out_hw_info
+		sfe_out_hw_info[CAM_SFE_BUS_SFE_OUT_MAX];
+	uint32_t num_comp_grp;
+	uint32_t comp_done_shift;
+	uint32_t top_irq_shift;
+};
+
+/*
+ * cam_sfe_bus_wr_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @sfe_irq_controller:      SFE irq controller
+ * @sfe_bus:                 Pointer to sfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_wr_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *sfe_irq_controller,
+	struct cam_sfe_bus                  **sfe_bus);
+
+/*
+ * cam_sfe_bus_wr_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @sfe_bus:                 Pointer to sfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_wr_deinit(struct cam_sfe_bus     **sfe_bus);
+
+#endif /* _CAM_SFE_BUS_WR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/include/cam_sfe_bus.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/include/cam_sfe_bus.h
@@ -0,0 +1,100 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_BUS_H_
+#define _CAM_SFE_BUS_H_
+
+#include "cam_sfe_hw_intf.h"
+
+#define CAM_SFE_BUS_WR_VER_1_0          0x1000
+#define CAM_SFE_BUS_RD_VER_1_0          0x1000
+
+#define CAM_SFE_ADD_REG_VAL_PAIR(buf_array, index, offset, val)    \
+	do {                                               \
+		buf_array[(index)++] = offset;             \
+		buf_array[(index)++] = val;                \
+	} while (0)
+
+#define ALIGNUP(value, alignment) \
+	((value + alignment - 1) / alignment * alignment)
+
+enum cam_sfe_bus_sfe_core_id {
+	CAM_SFE_BUS_SFE_CORE_0,
+	CAM_SFE_BUS_SFE_CORE_1,
+	CAM_SFE_BUS_SFE_CORE_MAX,
+};
+
+enum cam_sfe_bus_plane_type {
+	PLANE_Y,
+	PLANE_C,
+	PLANE_MAX,
+};
+
+enum cam_sfe_bus_type {
+	BUS_TYPE_SFE_WR,
+	BUS_TYPE_SFE_RD,
+	BUS_TYPE_SFE_MAX,
+};
+
+/*
+ * struct cam_sfe_bus:
+ *
+ * @Brief:                   Bus interface structure
+ *
+ * @bus_priv:                Private data of BUS
+ * @hw_ops:                  Hardware interface functions
+ * @top_half_handler:        Top Half handler function
+ * @bottom_half_handler:     Bottom Half handler function
+ */
+struct cam_sfe_bus {
+	void                          *bus_priv;
+	struct cam_hw_ops              hw_ops;
+	CAM_IRQ_HANDLER_TOP_HALF       top_half_handler;
+	CAM_IRQ_HANDLER_BOTTOM_HALF    bottom_half_handler;
+};
+
+/*
+ * cam_sfe_bus_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @bus_version:             Version of BUS to initialize
+ * @bus_type:                Bus Type RD/WR
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @sfe_irq_controller:      SFE irq controller
+ * @sfe_bus:                 Pointer to sfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_init(
+	uint32_t      bus_version,
+	int                            bus_type,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *bus_hw_info,
+	void                          *sfe_irq_controller,
+	struct cam_sfe_bus           **sfe_bus);
+
+/*
+ * cam_sfe_bus_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @bus_version:             Version of BUS to deinitialize
+ * @sfe_bus:                 Pointer to sfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_sfe_bus_deinit(
+	uint32_t                   bus_version,
+	int                        bus_type,
+	struct cam_sfe_bus       **sfe_bus);
+
+#endif /* _CAM_SFE_BUS_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.c
@@ -0,0 +1,1315 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_io_util.h"
+#include "cam_cdm_util.h"
+#include "cam_sfe_hw_intf.h"
+#include "cam_tasklet_util.h"
+#include "cam_sfe_top.h"
+#include "cam_debug_util.h"
+#include "cam_sfe_soc.h"
+#include "cam_sfe_core.h"
+
+#define CAM_SFE_DELAY_BW_REDUCTION_NUM_FRAMES 18
+
+struct cam_sfe_core_cfg {
+	uint32_t   mode_sel;
+	uint32_t   ops_mode_cfg;
+	uint32_t   fs_mode_cfg;
+};
+
+struct cam_sfe_top_common_data {
+	struct cam_hw_soc_info                  *soc_info;
+	struct cam_hw_intf                      *hw_intf;
+	struct cam_sfe_top_common_reg_offset    *common_reg;
+	struct cam_irq_controller               *sfe_irq_controller;
+	struct cam_sfe_top_irq_evt_payload       evt_payload[CAM_SFE_EVT_MAX];
+	struct list_head                         free_payload_list;
+};
+
+struct cam_sfe_top_priv {
+	struct cam_sfe_top_common_data  common_data;
+	struct cam_isp_resource_node    in_rsrc[CAM_SFE_TOP_IN_PORT_MAX];
+	uint32_t                        num_in_ports;
+	unsigned long                   hw_clk_rate;
+	unsigned long                   req_clk_rate[CAM_SFE_TOP_IN_PORT_MAX];
+	uint32_t                        last_counter;
+	uint64_t                        total_bw_applied;
+	struct cam_axi_vote             req_axi_vote[CAM_SFE_TOP_IN_PORT_MAX];
+	struct cam_axi_vote             last_vote[
+			CAM_SFE_DELAY_BW_REDUCTION_NUM_FRAMES];
+	enum cam_sfe_bw_control_action  axi_vote_control[
+		CAM_SFE_TOP_IN_PORT_MAX];
+	struct cam_axi_vote             applied_axi_vote;
+	struct cam_sfe_core_cfg         core_cfg;
+	uint32_t                        sfe_debug_cfg;
+	spinlock_t                      spin_lock;
+};
+
+struct cam_sfe_path_data {
+	void __iomem                             *mem_base;
+	void                                     *priv;
+	struct cam_hw_intf                       *hw_intf;
+	struct cam_sfe_top_priv                  *top_priv;
+	struct cam_sfe_top_common_reg_offset     *common_reg;
+	struct cam_sfe_modules_common_reg_offset *modules_reg;
+	struct cam_sfe_path_common_reg_data      *path_reg_data;
+	struct cam_hw_soc_info                   *soc_info;
+	uint32_t                                  min_hblank_cnt;
+	int                                       error_irq_handle;
+	int                                       sof_eof_handle;
+	cam_hw_mgr_event_cb_func                  event_cb;
+};
+
+static const char *cam_sfe_top_res_id_to_string(
+	uint32_t res_id)
+{
+	switch (res_id) {
+	case CAM_ISP_HW_SFE_IN_PIX:
+		return "PP";
+	case CAM_ISP_HW_SFE_IN_RDI0:
+		return "RDI0";
+	case CAM_ISP_HW_SFE_IN_RDI1:
+		return "RDI1";
+	case CAM_ISP_HW_SFE_IN_RDI2:
+		return "RDI2";
+	case CAM_ISP_HW_SFE_IN_RDI3:
+		return "RDI3";
+	case CAM_ISP_HW_SFE_IN_RDI4:
+		return "RDI4";
+	default:
+		return "";
+	}
+}
+
+static struct cam_axi_vote *cam_sfe_top_delay_bw_reduction(
+	struct cam_sfe_top_priv *top_priv,
+	uint64_t *to_be_applied_bw)
+{
+	uint32_t i, j;
+	int vote_idx = -1;
+	uint64_t max_bw = 0;
+	uint64_t total_bw;
+	struct cam_axi_vote *curr_l_vote;
+
+	for (i = 0; i < CAM_SFE_DELAY_BW_REDUCTION_NUM_FRAMES; i++) {
+		total_bw = 0;
+		curr_l_vote = &top_priv->last_vote[i];
+		for (j = 0; j < curr_l_vote->num_paths; j++) {
+			if (total_bw >
+				(U64_MAX -
+				curr_l_vote->axi_path[j].camnoc_bw)) {
+				CAM_ERR(CAM_PERF,
+					"sfe[%d] : Integer overflow at hist idx: %d, path: %d, total_bw = %llu, camnoc_bw = %llu",
+					top_priv->common_data.hw_intf->hw_idx,
+					i, j, total_bw,
+					curr_l_vote->axi_path[j].camnoc_bw);
+				return NULL;
+			}
+
+			total_bw += curr_l_vote->axi_path[j].camnoc_bw;
+		}
+
+		if (total_bw > max_bw) {
+			vote_idx = i;
+			max_bw = total_bw;
+		}
+	}
+
+	if (vote_idx < 0)
+		return NULL;
+
+	*to_be_applied_bw = max_bw;
+
+	return &top_priv->last_vote[vote_idx];
+}
+
+static int cam_sfe_top_set_axi_bw_vote(struct cam_sfe_soc_private *soc_private,
+	struct cam_sfe_top_priv *top_priv, bool start_stop)
+{
+	struct cam_axi_vote agg_vote = {0};
+	struct cam_axi_vote *to_be_applied_axi_vote = NULL;
+	int rc = 0;
+	uint32_t i;
+	uint32_t num_paths = 0;
+	uint64_t total_bw_new_vote = 0;
+	bool bw_unchanged = true;
+	bool apply_bw_update = false;
+
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->axi_vote_control[i] ==
+			CAM_SFE_BW_CONTROL_INCLUDE) {
+			if (num_paths +
+				top_priv->req_axi_vote[i].num_paths >
+				CAM_CPAS_MAX_PATHS_PER_CLIENT) {
+				CAM_ERR(CAM_PERF,
+					"Required paths(%d) more than max(%d)",
+					num_paths +
+					top_priv->req_axi_vote[i].num_paths,
+					CAM_CPAS_MAX_PATHS_PER_CLIENT);
+				return -EINVAL;
+			}
+
+			memcpy(&agg_vote.axi_path[num_paths],
+				&top_priv->req_axi_vote[i].axi_path[0],
+				top_priv->req_axi_vote[i].num_paths *
+				sizeof(
+				struct cam_axi_per_path_bw_vote));
+			num_paths += top_priv->req_axi_vote[i].num_paths;
+		}
+	}
+
+	agg_vote.num_paths = num_paths;
+
+	for (i = 0; i < agg_vote.num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"sfe[%d] : New BW Vote : counter[%d] [%s][%s] [%llu %llu %llu]",
+			top_priv->common_data.hw_intf->hw_idx,
+			top_priv->last_counter,
+			cam_cpas_axi_util_path_type_to_string(
+			agg_vote.axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			agg_vote.axi_path[i].transac_type),
+			agg_vote.axi_path[i].camnoc_bw,
+			agg_vote.axi_path[i].mnoc_ab_bw,
+			agg_vote.axi_path[i].mnoc_ib_bw);
+
+		total_bw_new_vote += agg_vote.axi_path[i].camnoc_bw;
+	}
+
+	memcpy(&top_priv->last_vote[top_priv->last_counter], &agg_vote,
+		sizeof(struct cam_axi_vote));
+	top_priv->last_counter = (top_priv->last_counter + 1) %
+		CAM_SFE_DELAY_BW_REDUCTION_NUM_FRAMES;
+
+	if ((agg_vote.num_paths != top_priv->applied_axi_vote.num_paths) ||
+		(total_bw_new_vote != top_priv->total_bw_applied))
+		bw_unchanged = false;
+
+	CAM_DBG(CAM_PERF,
+		"applied_total=%lld, new_total=%lld unchanged=%d, start_stop=%d",
+		top_priv->total_bw_applied,
+		total_bw_new_vote, bw_unchanged, start_stop);
+
+	if (bw_unchanged) {
+		CAM_DBG(CAM_PERF, "BW config unchanged");
+		return 0;
+	}
+
+	if (start_stop) {
+		/* need to vote current request immediately */
+		to_be_applied_axi_vote = &agg_vote;
+		/* Reset everything, we can start afresh */
+		memset(top_priv->last_vote, 0x0, sizeof(struct cam_axi_vote) *
+			CAM_SFE_DELAY_BW_REDUCTION_NUM_FRAMES);
+		top_priv->last_counter = 0;
+		top_priv->last_vote[top_priv->last_counter] = agg_vote;
+		top_priv->last_counter = (top_priv->last_counter + 1) %
+			CAM_SFE_DELAY_BW_REDUCTION_NUM_FRAMES;
+	} else {
+		/*
+		 * Find max bw request in last few frames. This will the bw
+		 * that we want to vote to CPAS now.
+		 */
+		to_be_applied_axi_vote =
+			cam_sfe_top_delay_bw_reduction(top_priv,
+			&total_bw_new_vote);
+		if (!to_be_applied_axi_vote) {
+			CAM_ERR(CAM_PERF, "to_be_applied_axi_vote is NULL");
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < to_be_applied_axi_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"sfe[%d] : Apply BW Vote : [%s][%s] [%llu %llu %llu]",
+			top_priv->common_data.hw_intf->hw_idx,
+			cam_cpas_axi_util_path_type_to_string(
+			to_be_applied_axi_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			to_be_applied_axi_vote->axi_path[i].transac_type),
+			to_be_applied_axi_vote->axi_path[i].camnoc_bw,
+			to_be_applied_axi_vote->axi_path[i].mnoc_ab_bw,
+			to_be_applied_axi_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	if ((to_be_applied_axi_vote->num_paths !=
+		top_priv->applied_axi_vote.num_paths) ||
+		(total_bw_new_vote != top_priv->total_bw_applied))
+		apply_bw_update = true;
+
+	CAM_DBG(CAM_PERF,
+		"sfe[%d] : Delayed update: applied_total=%lld, new_total=%lld apply_bw_update=%d, start_stop=%d",
+		top_priv->common_data.hw_intf->hw_idx,
+		top_priv->total_bw_applied, total_bw_new_vote, apply_bw_update,
+		start_stop);
+
+	if (apply_bw_update) {
+		rc = cam_cpas_update_axi_vote(soc_private->cpas_handle,
+			to_be_applied_axi_vote);
+		if (!rc) {
+			memcpy(&top_priv->applied_axi_vote,
+				to_be_applied_axi_vote,
+				sizeof(struct cam_axi_vote));
+			top_priv->total_bw_applied = total_bw_new_vote;
+		} else {
+			CAM_ERR(CAM_PERF, "BW request failed, rc=%d", rc);
+		}
+	}
+
+	return rc;
+}
+
+static int cam_sfe_top_bw_update(struct cam_sfe_soc_private *soc_private,
+	struct cam_sfe_top_priv *top_priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bw_update_args        *bw_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_update = (struct cam_sfe_bw_update_args *)cmd_args;
+	res = bw_update->node_res;
+
+	if (!res || !res->hw_intf || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_SFE_IN ||
+		res->res_id >= CAM_ISP_HW_SFE_IN_MAX) {
+		CAM_ERR(CAM_SFE, "SFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			memcpy(&top_priv->req_axi_vote[i],
+				&bw_update->sfe_vote,
+				sizeof(struct cam_axi_vote));
+			top_priv->axi_vote_control[i] =
+				CAM_SFE_BW_CONTROL_INCLUDE;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE,
+			"SFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_sfe_top_set_axi_bw_vote(soc_private, top_priv,
+			false);
+	}
+
+	return rc;
+}
+
+static int cam_sfe_top_bw_control(struct cam_sfe_soc_private *soc_private,
+	struct cam_sfe_top_priv *top_priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_sfe_bw_control_args       *bw_ctrl = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_ctrl = (struct cam_sfe_bw_control_args *)cmd_args;
+	res = bw_ctrl->node_res;
+
+	if (!res || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_SFE_IN ||
+		res->res_id >= CAM_ISP_HW_SFE_IN_MAX) {
+		CAM_ERR(CAM_SFE, "SFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			top_priv->axi_vote_control[i] = bw_ctrl->action;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_SFE,
+			"SFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_sfe_top_set_axi_bw_vote(soc_private, top_priv, true);
+	}
+
+	return rc;
+}
+
+static int cam_sfe_top_core_cfg(
+	struct cam_sfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_sfe_core_config_args *sfe_core_cfg = NULL;
+
+	if ((!cmd_args) ||
+		(arg_size != sizeof(struct cam_sfe_core_config_args))) {
+		CAM_ERR(CAM_SFE, "Invalid inputs");
+		return -EINVAL;
+	}
+
+	sfe_core_cfg = (struct cam_sfe_core_config_args *)cmd_args;
+	top_priv->core_cfg.mode_sel =
+		sfe_core_cfg->core_config.mode_sel;
+	top_priv->core_cfg.fs_mode_cfg =
+		sfe_core_cfg->core_config.fs_mode_cfg;
+	top_priv->core_cfg.ops_mode_cfg =
+		sfe_core_cfg->core_config.ops_mode_cfg;
+
+	return 0;
+}
+
+static int cam_sfe_top_set_hw_clk_rate(
+	struct cam_sfe_top_priv *top_priv)
+{
+	struct cam_hw_soc_info        *soc_info = NULL;
+	struct cam_sfe_soc_private    *soc_private = NULL;
+	struct cam_ahb_vote            ahb_vote;
+	int                            rc, clk_lvl = -1, i;
+	unsigned long                  max_clk_rate = 0;
+
+	soc_info = top_priv->common_data.soc_info;
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->req_clk_rate[i] > max_clk_rate)
+			max_clk_rate = top_priv->req_clk_rate[i];
+	}
+
+	if (max_clk_rate == top_priv->hw_clk_rate)
+		return 0;
+
+	soc_private = (struct cam_sfe_soc_private *)
+		soc_info->soc_private;
+	CAM_DBG(CAM_PERF, "SFE [%u]: clk: %s idx: %d rate: %llu",
+		soc_info->index,
+		soc_info->clk_name[soc_info->src_clk_idx],
+		soc_info->src_clk_idx, top_priv->req_clk_rate);
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info,
+		max_clk_rate);
+
+	if (!rc) {
+		top_priv->hw_clk_rate = max_clk_rate;
+		rc = cam_soc_util_get_clk_level(soc_info,
+			max_clk_rate,
+			soc_info->src_clk_idx, &clk_lvl);
+		if (rc) {
+			CAM_WARN(CAM_SFE,
+				"Failed to get clk level for %s with clk_rate %llu src_idx %d rc: %d",
+				soc_info->dev_name, max_clk_rate,
+				soc_info->src_clk_idx, rc);
+			rc = 0;
+			goto end;
+		}
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = clk_lvl;
+		cam_cpas_update_ahb_vote(soc_private->cpas_handle, &ahb_vote);
+	} else {
+		CAM_ERR(CAM_PERF,
+			"Set clk rate failed for SFE [%u] clk: %s rate: %llu rc: %d",
+			soc_info->index,
+			soc_info->clk_name[soc_info->src_clk_idx],
+			max_clk_rate, rc);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_sfe_top_get_base(
+	struct cam_sfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_SFE, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_SFE, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_SFE, "buf size: %d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(
+		top_priv->common_data.soc_info,
+		SFE_CORE_BASE_IDX);
+
+	if (cdm_args->cdm_id == CAM_CDM_RT)
+		mem_base -= CAM_SOC_GET_REG_MAP_CAM_BASE(
+			top_priv->common_data.soc_info,
+			SFE_RT_CDM_BASE_IDX);
+
+	CAM_DBG(CAM_SFE, "core %d mem_base 0x%x, CDM Id: %d",
+		top_priv->common_data.soc_info->index, mem_base,
+		cdm_args->cdm_id);
+
+	cdm_util_ops->cdm_write_changebase(
+	cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_sfe_top_clock_update(
+	struct cam_sfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_sfe_clock_update_args     *clk_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0, i;
+
+	if (arg_size != sizeof(struct cam_sfe_clock_update_args)) {
+		CAM_ERR(CAM_SFE, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	clk_update =
+		(struct cam_sfe_clock_update_args *)cmd_args;
+	if (!clk_update || !clk_update->node_res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	res = clk_update->node_res;
+
+	if (!res || !res->hw_intf->hw_priv) {
+		CAM_ERR(CAM_PERF, "Invalid inputs");
+		return -EINVAL;
+	}
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_SFE_IN ||
+		res->res_id >= CAM_ISP_HW_SFE_IN_MAX) {
+		CAM_ERR(CAM_PERF,
+			"SFE: %d Invalid res_type: %d res_id: %d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_priv->num_in_ports; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			top_priv->req_clk_rate[i] = clk_update->clk_rate;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_DBG(CAM_PERF,
+			"SFE: %d not ready to set clocks yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+		rc = -EAGAIN;
+	} else
+		rc = cam_sfe_top_set_hw_clk_rate(top_priv);
+
+	return rc;
+}
+
+static int cam_sfe_set_top_debug(
+	struct cam_sfe_top_priv *top_priv,
+	void *cmd_args)
+{
+	uint32_t *sfe_debug;
+
+	sfe_debug = (uint32_t *)cmd_args;
+	top_priv->sfe_debug_cfg = *sfe_debug;
+
+	return 0;
+}
+
+static int cam_sfe_top_process_cmd(void *priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_sfe_top_priv           *top_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_sfe_soc_private        *soc_private = NULL;
+
+	if (!priv) {
+		CAM_ERR(CAM_SFE, "Invalid top_priv");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_sfe_top_priv *) priv;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = soc_info->soc_private;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_SFE, "soc private is NULL");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_sfe_top_get_base(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+		rc = cam_sfe_top_clock_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+		rc = cam_sfe_top_bw_update(soc_private, top_priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+		break;
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = cam_sfe_top_core_cfg(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SET_SFE_DEBUG_CFG:
+		rc = cam_sfe_set_top_debug(top_priv, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_SFE, "Invalid cmd type: %d", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_sfe_top_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_sfe_top_priv                 *top_priv;
+	struct cam_sfe_acquire_args             *args;
+	struct cam_sfe_hw_sfe_in_acquire_args   *acquire_args;
+	struct cam_sfe_path_data                *path_data;
+	int rc = -EINVAL, i;
+
+	if (!device_priv || !reserve_args) {
+		CAM_ERR(CAM_SFE,
+			"Error invalid input arguments");
+		return rc;
+	}
+
+	top_priv = (struct cam_sfe_top_priv *)device_priv;
+	args = (struct cam_sfe_acquire_args *)reserve_args;
+	acquire_args = &args->sfe_in;
+
+	for (i = 0; i < CAM_SFE_TOP_IN_PORT_MAX; i++) {
+		CAM_DBG(CAM_SFE, "i: %d res_id: %d state: %d", i,
+			acquire_args->res_id, top_priv->in_rsrc[i].res_state);
+
+		if ((top_priv->in_rsrc[i].res_id == acquire_args->res_id) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_AVAILABLE)) {
+			path_data = (struct cam_sfe_path_data *)
+				top_priv->in_rsrc[i].res_priv;
+			path_data->event_cb = args->event_cb;
+			path_data->priv = args->priv;
+			path_data->top_priv = top_priv;
+			CAM_DBG(CAM_SFE,
+				"SFE [%u] for rsrc: %u acquired",
+				top_priv->in_rsrc[i].hw_intf->hw_idx,
+				acquire_args->res_id);
+
+			top_priv->in_rsrc[i].cdm_ops = acquire_args->cdm_ops;
+			top_priv->in_rsrc[i].tasklet_info = args->tasklet;
+			top_priv->in_rsrc[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			acquire_args->rsrc_node =
+				&top_priv->in_rsrc[i];
+			rc = 0;
+			break;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_sfe_top_release(void *device_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_sfe_top_priv            *top_priv;
+	struct cam_isp_resource_node       *in_res;
+
+	if (!device_priv || !release_args) {
+		CAM_ERR(CAM_SFE, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_sfe_top_priv   *)device_priv;
+	in_res = (struct cam_isp_resource_node *)release_args;
+
+	CAM_DBG(CAM_SFE,
+		"Release for SFE [%u] resource id: %u in state: %d",
+		in_res->hw_intf->hw_idx, in_res->res_id,
+		in_res->res_state);
+	if (in_res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_SFE, "SFE [%u] invalid res_state: %d",
+			in_res->hw_intf->hw_idx, in_res->res_state);
+		return -EINVAL;
+	}
+
+	in_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	in_res->cdm_ops = NULL;
+	in_res->tasklet_info = NULL;
+
+	return 0;
+}
+
+static int cam_sfe_top_get_evt_payload(
+	struct cam_sfe_top_priv            *top_priv,
+	struct cam_sfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&top_priv->spin_lock);
+	if (list_empty(&top_priv->common_data.free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free CAMIF LITE event payload");
+		*evt_payload = NULL;
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(
+		&top_priv->common_data.free_payload_list,
+		struct cam_sfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+
+done:
+	spin_unlock(&top_priv->spin_lock);
+	return rc;
+}
+
+static int cam_sfe_top_put_evt_payload(
+	struct cam_sfe_top_priv                *top_priv,
+	struct cam_sfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!top_priv) {
+		CAM_ERR(CAM_SFE, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_SFE, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&top_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list,
+		&top_priv->common_data.free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&top_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_SFE, "Done");
+	return 0;
+}
+
+static void cam_sfe_top_print_debug_reg_info(
+	struct cam_sfe_path_data           *path_data)
+{
+	CAM_INFO(CAM_SFE,
+		"Debug0: 0x%x Debug1: 0x%x Debug2: 0x%x Debug3: 0x%x",
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_0),
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_1),
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_2),
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_3));
+	CAM_INFO(CAM_SFE,
+		"Debug4: 0x%x Debug5: 0x%x Debug6: 0x%x Debug7: 0x%x",
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_4),
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_5),
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_6),
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_7));
+	CAM_INFO(CAM_SFE,
+		"Debug8: 0x%x Debug9: 0x%x Debug10: 0x%x Debug11: 0x%x",
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_8),
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_9),
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_10),
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->top_debug_11));
+}
+
+static int cam_sfe_top_handle_err_irq_top_half(
+	uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int rc = 0, i;
+	uint32_t irq_status = 0;
+	void __iomem *base = NULL;
+	struct cam_sfe_top_priv            *top_priv;
+	struct cam_isp_resource_node       *res;
+	struct cam_sfe_path_data           *path_data;
+	struct cam_sfe_top_irq_evt_payload *evt_payload;
+
+	res = th_payload->handler_priv;
+	path_data = res->res_priv;
+	top_priv = path_data->priv;
+
+	CAM_DBG(CAM_SFE, "Top error IRQ Received");
+
+	irq_status = th_payload->evt_status_arr[0];
+
+	base = path_data->mem_base;
+	if (irq_status & path_data->path_reg_data->error_irq_mask) {
+		CAM_ERR(CAM_SFE,
+			"SFE Violation Detected irq_status: 0x%x",
+			irq_status);
+		cam_irq_controller_disable_irq(
+			top_priv->common_data.sfe_irq_controller,
+			path_data->error_irq_handle);
+		cam_irq_controller_clear_and_mask(evt_id,
+			top_priv->common_data.sfe_irq_controller);
+	}
+
+	rc  = cam_sfe_top_get_evt_payload(top_priv, &evt_payload);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] =
+			th_payload->evt_status_arr[i];
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	evt_payload->violation_status =
+	cam_io_r(base +
+		top_priv->common_data.common_reg->violation_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_sfe_top_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int rc = 0, i;
+	uint32_t irq_status = 0;
+	struct cam_sfe_top_priv             *top_priv;
+	struct cam_isp_resource_node        *res;
+	struct cam_sfe_path_data            *path_data;
+	struct cam_sfe_top_irq_evt_payload  *evt_payload;
+
+	res = th_payload->handler_priv;
+	path_data = res->res_priv;
+	top_priv = path_data->top_priv;
+
+	rc  = cam_sfe_top_get_evt_payload(top_priv, &evt_payload);
+	if (rc)
+		return rc;
+
+	irq_status = th_payload->evt_status_arr[0];
+	CAM_DBG(CAM_SFE, "SFE top irq status: 0x%x",
+			irq_status);
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] =
+			th_payload->evt_status_arr[i];
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	th_payload->evt_payload_priv = evt_payload;
+	return rc;
+}
+
+static int cam_sfe_top_handle_irq_bottom_half(
+	void *handler_priv, void *evt_payload_priv)
+{
+	int i;
+	uint32_t irq_status[CAM_SFE_IRQ_REGISTERS_MAX] = {0};
+	enum cam_sfe_hw_irq_status          ret = CAM_SFE_IRQ_STATUS_MAX;
+	struct cam_isp_hw_event_info        evt_info;
+	struct cam_isp_resource_node       *res = handler_priv;
+	struct cam_sfe_path_data           *path_data = res->res_priv;
+	struct cam_sfe_top_priv            *top_priv = path_data->top_priv;
+	struct cam_sfe_top_irq_evt_payload *payload = evt_payload_priv;
+
+	for (i = 0; i < CAM_SFE_IRQ_REGISTERS_MAX; i++)
+		irq_status[i] = payload->irq_reg_val[i];
+
+	evt_info.hw_idx = res->hw_intf->hw_idx;
+	evt_info.res_id = res->res_id;
+	evt_info.res_type = res->res_type;
+	evt_info.reg_val = 0;
+
+	if (irq_status[0] &
+		path_data->path_reg_data->error_irq_mask) {
+		if (irq_status[0] & 0x4000)
+			CAM_ERR(CAM_SFE, "PP VIOLATION");
+
+		if (irq_status[0] & 0x8000)
+			CAM_ERR(CAM_SFE, "DIAG VIOLATION");
+
+		if (irq_status[0] & 0x10000)
+			CAM_ERR(CAM_SFE, "LINE SMOOTH VIOLATION");
+
+		CAM_INFO(CAM_SFE, "Violation status 0x%x",
+			payload->violation_status);
+
+		evt_info.err_type = CAM_SFE_IRQ_STATUS_VIOLATION;
+		cam_sfe_top_print_debug_reg_info(path_data);
+		if (path_data->event_cb)
+			path_data->event_cb(NULL,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		ret = CAM_SFE_IRQ_STATUS_VIOLATION;
+	}
+
+	/* To Do Debugfs entry to control the enablement */
+	if (irq_status[0] & path_data->path_reg_data->subscribe_irq_mask) {
+		if (irq_status[0] & path_data->path_reg_data->sof_irq_mask) {
+			CAM_INFO_RATE_LIMIT(CAM_SFE, "SFE:%d Received %s SOF",
+				evt_info.hw_idx,
+				cam_sfe_top_res_id_to_string(res->res_id));
+		}
+
+		if (irq_status[0] &
+			path_data->path_reg_data->eof_irq_mask) {
+			CAM_INFO_RATE_LIMIT(CAM_SFE, "SFE:%d Received %s EOF",
+				evt_info.hw_idx,
+				cam_sfe_top_res_id_to_string(res->res_id));
+		}
+		ret = CAM_SFE_IRQ_STATUS_SUCCESS;
+	}
+
+	/* To DO frame counter under debugfs */
+	CAM_DBG(CAM_SFE,
+		"SFE:%d SFE_DIAG_SENSOR_STATUS0: 0x%x SFE_DIAG_SENSOR_STATUS1: 0x%x",
+		evt_info.hw_idx,
+		cam_io_r(path_data->mem_base +
+			path_data->common_reg->diag_sensor_status_0),
+		cam_io_r(path_data->mem_base +
+			path_data->common_reg->diag_sensor_status_1));
+
+	cam_sfe_top_put_evt_payload(top_priv, &payload);
+
+	return ret;
+}
+
+static int cam_sfe_top_start(
+	void *priv, void *start_args, uint32_t arg_size)
+{
+	int                                   rc = -EINVAL;
+	struct cam_sfe_top_priv              *top_priv;
+	struct cam_isp_resource_node         *sfe_res;
+	struct cam_hw_info                   *hw_info = NULL;
+	struct cam_sfe_path_data             *path_data;
+	uint32_t   error_mask[CAM_SFE_IRQ_REGISTERS_MAX];
+	uint32_t   sof_eof_mask[CAM_SFE_IRQ_REGISTERS_MAX];
+
+	if (!priv || !start_args) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_sfe_top_priv *)priv;
+	sfe_res = (struct cam_isp_resource_node *) start_args;
+
+	hw_info = (struct cam_hw_info  *)sfe_res->hw_intf->hw_priv;
+	if (!hw_info) {
+		CAM_ERR(CAM_SFE, "Invalid input");
+		return rc;
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_SFE, "SFE HW [%u] not powered up",
+			hw_info->soc_info.index);
+		rc = -EPERM;
+		return rc;
+	}
+
+	path_data = (struct cam_sfe_path_data *)sfe_res->res_priv;
+	rc = cam_sfe_top_set_hw_clk_rate(top_priv);
+	if (rc)
+		return rc;
+
+	/* core cfg updated via CDM */
+	CAM_DBG(CAM_SFE, "SFE HW [%u] core_cfg: 0x%x",
+		hw_info->soc_info.index,
+		cam_io_r_mb(path_data->mem_base +
+			path_data->common_reg->core_cfg));
+
+	/* Enable debug cfg registers */
+	cam_io_w(path_data->path_reg_data->top_debug_cfg_en,
+		path_data->mem_base +
+		path_data->common_reg->top_debug_cfg);
+
+	/* Enable sensor diag info */
+	/* TO DO - debug fs to enable*/
+	cam_io_w(path_data->path_reg_data->enable_diagnostic_hw,
+		path_data->mem_base + path_data->common_reg->diag_config);
+
+	error_mask[0] = path_data->path_reg_data->error_irq_mask;
+	/* Enable error IRQ by default */
+	if (!path_data->error_irq_handle) {
+		path_data->error_irq_handle = cam_irq_controller_subscribe_irq(
+			top_priv->common_data.sfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			error_mask,
+			sfe_res,
+			cam_sfe_top_handle_err_irq_top_half,
+			cam_sfe_top_handle_irq_bottom_half,
+			sfe_res->tasklet_info,
+			&tasklet_bh_api);
+
+		if (path_data->error_irq_handle < 1) {
+			CAM_ERR(CAM_SFE, "Failed to subscribe Top IRQ");
+			path_data->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	/* TO DO define the debugfs to enable/disable sof/eof irq */
+	if (!path_data->sof_eof_handle) {
+		sof_eof_mask[0] = path_data->path_reg_data->subscribe_irq_mask;
+		path_data->sof_eof_handle = cam_irq_controller_subscribe_irq(
+			top_priv->common_data.sfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			sof_eof_mask,
+			sfe_res,
+			cam_sfe_top_handle_irq_top_half,
+			cam_sfe_top_handle_irq_bottom_half,
+			sfe_res->tasklet_info,
+			&tasklet_bh_api);
+
+		if (path_data->sof_eof_handle < 1) {
+			CAM_ERR(CAM_SFE, "Failed to subscribe SOF/EOF IRQ");
+			path_data->sof_eof_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	sfe_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return 0;
+}
+
+static int cam_sfe_top_stop(
+	void *priv, void *stop_args, uint32_t arg_size)
+{
+	int i;
+	struct cam_sfe_top_priv       *top_priv;
+	struct cam_isp_resource_node  *sfe_res;
+	struct cam_sfe_path_data      *path_data;
+
+	if (!priv || !stop_args) {
+		CAM_ERR(CAM_SFE, "Invalid args");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_sfe_top_priv *)priv;
+	sfe_res = (struct cam_isp_resource_node *) stop_args;
+	path_data = sfe_res->res_priv;
+
+	if (sfe_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		sfe_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	/* Unsubscribe for IRQs */
+	sfe_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	for (i = 0; i < CAM_SFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->in_rsrc[i].res_id == sfe_res->res_id) {
+			top_priv->req_clk_rate[i] = 0;
+			memset(&top_priv->req_axi_vote[i], 0,
+				sizeof(struct cam_axi_vote));
+			top_priv->axi_vote_control[i] =
+				CAM_SFE_BW_CONTROL_EXCLUDE;
+			break;
+		}
+	}
+
+	if (path_data->error_irq_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			top_priv->common_data.sfe_irq_controller,
+			path_data->error_irq_handle);
+	}
+
+	if (path_data->sof_eof_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			top_priv->common_data.sfe_irq_controller,
+			path_data->sof_eof_handle);
+	}
+
+	return 0;
+}
+
+int cam_sfe_top_init(
+	uint32_t                            hw_version,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	void                               *top_hw_info,
+	void                               *sfe_irq_controller,
+	struct cam_sfe_top                **sfe_top_ptr)
+{
+	int i, j, rc = 0;
+	struct cam_sfe_top_priv           *top_priv = NULL;
+	struct cam_sfe_path_data          *path_data = NULL;
+	struct cam_sfe_top                *sfe_top;
+	struct cam_sfe_top_hw_info        *sfe_top_hw_info =
+		(struct cam_sfe_top_hw_info *)top_hw_info;
+
+	sfe_top = kzalloc(sizeof(struct cam_sfe_top), GFP_KERNEL);
+	if (!sfe_top) {
+		CAM_DBG(CAM_SFE, "Error, Failed to alloc for sfe_top");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	top_priv = kzalloc(sizeof(struct cam_sfe_top_priv),
+		GFP_KERNEL);
+	if (!top_priv) {
+		rc = -ENOMEM;
+		goto free_sfe_top;
+	}
+
+	sfe_top->top_priv = top_priv;
+	top_priv->common_data.sfe_irq_controller = sfe_irq_controller;
+	if (sfe_top_hw_info->num_inputs > CAM_SFE_TOP_IN_PORT_MAX) {
+		CAM_ERR(CAM_SFE,
+			"Invalid number of input resources: %d max: %d",
+			sfe_top_hw_info->num_inputs,
+			CAM_SFE_TOP_IN_PORT_MAX);
+		rc = -EINVAL;
+		goto free_top_priv;
+	}
+
+	top_priv->hw_clk_rate = 0;
+	top_priv->num_in_ports = sfe_top_hw_info->num_inputs;
+	memset(top_priv->last_vote, 0x0, sizeof(struct cam_axi_vote) *
+		CAM_SFE_DELAY_BW_REDUCTION_NUM_FRAMES);
+	memset(&top_priv->core_cfg, 0x0,
+		sizeof(struct cam_sfe_core_cfg));
+
+	CAM_DBG(CAM_SFE,
+		"Initializing SFE [%u] top with hw_version: 0x%x",
+		hw_intf->hw_idx, hw_version);
+	for (i = 0, j = 0; i < top_priv->num_in_ports &&
+		j < CAM_SFE_RDI_MAX; i++) {
+		top_priv->in_rsrc[i].res_type =
+			CAM_ISP_RESOURCE_SFE_IN;
+		top_priv->in_rsrc[i].hw_intf = hw_intf;
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		top_priv->req_clk_rate[i] = 0;
+
+		if (sfe_top_hw_info->input_type[i] ==
+			CAM_SFE_PIX_VER_1_0) {
+			top_priv->in_rsrc[i].res_id =
+				CAM_ISP_HW_SFE_IN_PIX;
+
+			path_data = kzalloc(sizeof(struct cam_sfe_path_data),
+				GFP_KERNEL);
+			if (!path_data) {
+				CAM_DBG(CAM_SFE,
+					"Failed to alloc SFE [%u] pix data",
+					hw_intf->hw_idx);
+				goto deinit_resources;
+			}
+			top_priv->in_rsrc[i].res_priv = path_data;
+			path_data->mem_base =
+				soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base;
+			path_data->path_reg_data =
+				sfe_top_hw_info->pix_reg_data;
+			path_data->common_reg = sfe_top_hw_info->common_reg;
+			path_data->modules_reg =
+				sfe_top_hw_info->modules_hw_info;
+			path_data->hw_intf = hw_intf;
+			path_data->soc_info = soc_info;
+		} else if (sfe_top_hw_info->input_type[i] ==
+			CAM_SFE_RDI_VER_1_0) {
+			top_priv->in_rsrc[i].res_id =
+				CAM_ISP_HW_SFE_IN_RDI0 + j;
+
+			path_data = kzalloc(sizeof(struct cam_sfe_path_data),
+					GFP_KERNEL);
+			if (!path_data) {
+				CAM_DBG(CAM_SFE,
+					"Failed to alloc SFE [%u] rdi data res_id: %u",
+					hw_intf->hw_idx,
+					(CAM_ISP_HW_SFE_IN_RDI0 + j));
+				goto deinit_resources;
+			}
+
+			top_priv->in_rsrc[i].res_priv = path_data;
+
+			path_data->mem_base =
+				soc_info->reg_map[SFE_CORE_BASE_IDX].mem_base;
+			path_data->hw_intf = hw_intf;
+			path_data->common_reg = sfe_top_hw_info->common_reg;
+			path_data->modules_reg =
+				sfe_top_hw_info->modules_hw_info;
+			path_data->soc_info = soc_info;
+			path_data->path_reg_data =
+				sfe_top_hw_info->rdi_reg_data[j++];
+		} else {
+			CAM_WARN(CAM_SFE, "Invalid SFE input type: %u",
+				sfe_top_hw_info->input_type[i]);
+		}
+	}
+
+	top_priv->common_data.soc_info = soc_info;
+	top_priv->common_data.hw_intf = hw_intf;
+	top_priv->common_data.common_reg =
+		sfe_top_hw_info->common_reg;
+
+	sfe_top->hw_ops.process_cmd = cam_sfe_top_process_cmd;
+	sfe_top->hw_ops.start = cam_sfe_top_start;
+	sfe_top->hw_ops.stop = cam_sfe_top_stop;
+	sfe_top->hw_ops.reserve = cam_sfe_top_reserve;
+	sfe_top->hw_ops.release = cam_sfe_top_release;
+
+	spin_lock_init(&top_priv->spin_lock);
+	INIT_LIST_HEAD(&top_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_SFE_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&top_priv->common_data.evt_payload[i].list);
+		list_add_tail(&top_priv->common_data.evt_payload[i].list,
+			&top_priv->common_data.free_payload_list);
+	}
+
+	*sfe_top_ptr = sfe_top;
+
+	return rc;
+
+deinit_resources:
+	for (--i; i >= 0; i--) {
+		top_priv->in_rsrc[i].start = NULL;
+		top_priv->in_rsrc[i].stop  = NULL;
+		top_priv->in_rsrc[i].process_cmd = NULL;
+		top_priv->in_rsrc[i].top_half_handler = NULL;
+		top_priv->in_rsrc[i].bottom_half_handler = NULL;
+
+		if (!top_priv->in_rsrc[i].res_priv)
+			continue;
+
+		kfree(top_priv->in_rsrc[i].res_priv);
+		top_priv->in_rsrc[i].res_priv = NULL;
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	}
+free_top_priv:
+	kfree(sfe_top->top_priv);
+	sfe_top->top_priv = NULL;
+free_sfe_top:
+	kfree(sfe_top);
+end:
+	*sfe_top_ptr = NULL;
+	return rc;
+}
+
+int cam_sfe_top_deinit(
+	uint32_t             hw_version,
+	struct cam_sfe_top **sfe_top_ptr)
+{
+	int i, rc = 0;
+	unsigned long flags;
+	struct cam_sfe_top      *sfe_top;
+	struct cam_sfe_top_priv *top_priv;
+
+	if (!sfe_top_ptr) {
+		CAM_ERR(CAM_SFE, "Error Invalid input");
+		return -ENODEV;
+	}
+
+	sfe_top = *sfe_top_ptr;
+	if (!sfe_top) {
+		CAM_ERR(CAM_SFE, "Error sfe top NULL");
+		return -ENODEV;
+	}
+
+	top_priv = sfe_top->top_priv;
+	if (!top_priv) {
+		CAM_ERR(CAM_SFE, "Error sfe top priv NULL");
+		rc = -ENODEV;
+		goto free_sfe_top;
+	}
+
+	CAM_DBG(CAM_SFE,
+		"Deinit SFE [%u] top with hw_version 0x%x",
+		top_priv->common_data.hw_intf->hw_idx,
+		hw_version);
+
+	spin_lock_irqsave(&top_priv->spin_lock, flags);
+	INIT_LIST_HEAD(&top_priv->common_data.free_payload_list);
+		for (i = 0; i < CAM_SFE_EVT_MAX; i++)
+			INIT_LIST_HEAD(
+				&top_priv->common_data.evt_payload[i].list);
+	spin_unlock_irqrestore(&top_priv->spin_lock, flags);
+
+	for (i = 0; i < CAM_SFE_TOP_IN_PORT_MAX; i++) {
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+		top_priv->in_rsrc[i].start = NULL;
+		top_priv->in_rsrc[i].stop  = NULL;
+		top_priv->in_rsrc[i].process_cmd = NULL;
+		top_priv->in_rsrc[i].top_half_handler = NULL;
+		top_priv->in_rsrc[i].bottom_half_handler = NULL;
+
+		if (!top_priv->in_rsrc[i].res_priv) {
+			CAM_ERR(CAM_SFE, "Error res_priv is NULL");
+			continue;
+		}
+
+		kfree(top_priv->in_rsrc[i].res_priv);
+		top_priv->in_rsrc[i].res_priv = NULL;
+	}
+
+	kfree(sfe_top->top_priv);
+
+free_sfe_top:
+	kfree(sfe_top);
+	*sfe_top_ptr = NULL;
+
+	return rc;
+}
+
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_top/cam_sfe_top.h
@@ -0,0 +1,103 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SFE_TOP_H_
+#define _CAM_SFE_TOP_H_
+
+#include "cam_cpas_api.h"
+
+#define CAM_SFE_PIX_VER_1_0    0x10
+#define CAM_SFE_RDI_VER_1_0    0x1000
+#define CAM_SFE_TOP_VER_1_0    0x10000
+
+#define CAM_SFE_DELAY_BW_REDUCTION_NUM_FRAMES  18
+#define CAM_SFE_TOP_IN_PORT_MAX                6
+#define CAM_SFE_RDI_MAX                        5
+
+#define CAM_SHIFT_TOP_CORE_CFG_MODE_SEL        2
+#define CAM_SHIFT_TOP_CORE_CFG_OPS_MODE_CFG    1
+#define CAM_SHIFT_TOP_CORE_CFG_FS_MODE_CFG     0
+
+struct cam_sfe_top {
+	void                   *top_priv;
+	struct cam_hw_ops       hw_ops;
+};
+
+struct cam_sfe_top_common_reg_offset {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t stats_feature;
+	uint32_t core_cgc_ctrl;
+	uint32_t ahb_clk_ovd;
+	uint32_t core_cfg;
+	uint32_t violation_status;
+	uint32_t diag_config;
+	uint32_t diag_sensor_status_0;
+	uint32_t diag_sensor_status_1;
+	uint32_t diag_sensor_frame_cnt_status0;
+	uint32_t diag_sensor_frame_cnt_status1;
+	uint32_t top_debug_0;
+	uint32_t top_debug_1;
+	uint32_t top_debug_2;
+	uint32_t top_debug_3;
+	uint32_t top_debug_4;
+	uint32_t top_debug_5;
+	uint32_t top_debug_6;
+	uint32_t top_debug_7;
+	uint32_t top_debug_8;
+	uint32_t top_debug_9;
+	uint32_t top_debug_10;
+	uint32_t top_debug_11;
+	uint32_t top_debug_cfg;
+	uint32_t stats_ch2_throttle_cfg;
+	uint32_t stats_ch1_throttle_cfg;
+	uint32_t stats_ch0_throttle_cfg;
+	uint32_t lcr_throttle_cfg;
+	uint32_t hdr_throttle_cfg;
+	uint32_t sfe_op_throttle_cfg;
+};
+
+struct cam_sfe_modules_common_reg_offset {
+	uint32_t demux_module_cfg;
+	uint32_t demux_qcfa_cfg;
+	uint32_t demux_hdr_cfg;
+	uint32_t demux_lcr_sel;
+	uint32_t hdrc_remo_mod_cfg;
+	uint32_t hdrc_remo_qcfa_bin_cfg;
+	uint32_t qcfa_hdrc_remo_out_mux_cfg;
+};
+
+struct cam_sfe_path_common_reg_data {
+	uint32_t sof_irq_mask;
+	uint32_t eof_irq_mask;
+	uint32_t error_irq_mask;
+	uint32_t subscribe_irq_mask;
+	uint32_t enable_diagnostic_hw;
+	uint32_t top_debug_cfg_en;
+};
+
+struct cam_sfe_top_hw_info {
+	struct cam_sfe_top_common_reg_offset     *common_reg;
+	struct cam_sfe_modules_common_reg_offset *modules_hw_info;
+	struct cam_sfe_path_common_reg_data      *pix_reg_data;
+	struct cam_sfe_path_common_reg_data      *rdi_reg_data[CAM_SFE_RDI_MAX];
+	uint32_t                                  num_inputs;
+	uint32_t                                  input_type[
+		CAM_SFE_TOP_IN_PORT_MAX];
+};
+
+int cam_sfe_top_init(
+	uint32_t                            hw_version,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	void                               *top_hw_info,
+	void                               *sfe_irq_controller,
+	struct cam_sfe_top                **sfe_top);
+
+int cam_sfe_top_deinit(
+	uint32_t                       hw_version,
+	struct cam_sfe_top           **sfe_top);
+
+#endif /* _CAM_SFE_TOP_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid530.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid530.c
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#include <linux/module.h>
+#include "cam_tfe_csid_core.h"
+#include "cam_tfe_csid530.h"
+#include "cam_tfe_csid_dev.h"
+#include "camera_main.h"
+
+#define CAM_TFE_CSID_DRV_NAME                    "csid_530"
+#define CAM_TFE_CSID_VERSION_V530                 0x50030000
+
+static struct cam_tfe_csid_hw_info cam_tfe_csid530_hw_info = {
+	.csid_reg = &cam_tfe_csid_530_reg_offset,
+	.hw_dts_version = CAM_TFE_CSID_VERSION_V530,
+};
+
+static const struct of_device_id cam_tfe_csid530_dt_match[] = {
+	{
+		.compatible = "qcom,csid530",
+		.data = &cam_tfe_csid530_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_tfe_csid530_dt_match);
+
+struct platform_driver cam_tfe_csid530_driver = {
+	.probe = cam_tfe_csid_probe,
+	.remove = cam_tfe_csid_remove,
+	.driver = {
+		.name = CAM_TFE_CSID_DRV_NAME,
+		.of_match_table = cam_tfe_csid530_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_tfe_csid530_init_module(void)
+{
+	return platform_driver_register(&cam_tfe_csid530_driver);
+}
+
+void cam_tfe_csid530_exit_module(void)
+{
+	platform_driver_unregister(&cam_tfe_csid530_driver);
+}
+
+MODULE_DESCRIPTION("CAM TFE_CSID530 driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid530.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid530.h
@@ -0,0 +1,227 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_530_H_
+#define _CAM_TFE_CSID_530_H_
+
+#include "cam_tfe_csid_core.h"
+
+static struct cam_tfe_csid_pxl_reg_offset  cam_tfe_csid_530_ipp_reg_offset = {
+	.csid_pxl_irq_status_addr            = 0x30,
+	.csid_pxl_irq_mask_addr              = 0x34,
+	.csid_pxl_irq_clear_addr             = 0x38,
+	.csid_pxl_irq_set_addr               = 0x3c,
+
+	.csid_pxl_cfg0_addr                  = 0x200,
+	.csid_pxl_cfg1_addr                  = 0x204,
+	.csid_pxl_ctrl_addr                  = 0x208,
+	.csid_pxl_hcrop_addr                 = 0x21c,
+	.csid_pxl_vcrop_addr                 = 0x220,
+	.csid_pxl_rst_strobes_addr           = 0x240,
+	.csid_pxl_status_addr                = 0x254,
+	.csid_pxl_misr_val_addr              = 0x258,
+	.csid_pxl_timestamp_curr0_sof_addr   = 0x290,
+	.csid_pxl_timestamp_curr1_sof_addr   = 0x294,
+	.csid_pxl_timestamp_perv0_sof_addr   = 0x298,
+	.csid_pxl_timestamp_perv1_sof_addr   = 0x29c,
+	.csid_pxl_timestamp_curr0_eof_addr   = 0x2a0,
+	.csid_pxl_timestamp_curr1_eof_addr   = 0x2a4,
+	.csid_pxl_timestamp_perv0_eof_addr   = 0x2a8,
+	.csid_pxl_timestamp_perv1_eof_addr   = 0x2ac,
+	.csid_pxl_err_recovery_cfg0_addr     = 0x2d0,
+	.csid_pxl_err_recovery_cfg1_addr     = 0x2d4,
+	.csid_pxl_err_recovery_cfg2_addr     = 0x2d8,
+	/* configurations */
+	.pix_store_en_shift_val              = 7,
+	.early_eof_en_shift_val              = 29,
+	.halt_master_sel_shift               = 4,
+	.halt_mode_shift                     = 2,
+	.halt_master_sel_master_val          = 3,
+	.halt_master_sel_slave_val           = 0,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_530_rdi_0_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x40,
+	.csid_rdi_irq_mask_addr                   = 0x44,
+	.csid_rdi_irq_clear_addr                  = 0x48,
+	.csid_rdi_irq_set_addr                    = 0x4c,
+
+	.csid_rdi_cfg0_addr                       = 0x300,
+	.csid_rdi_cfg1_addr                       = 0x304,
+	.csid_rdi_ctrl_addr                       = 0x308,
+	.csid_rdi_rst_strobes_addr                = 0x340,
+	.csid_rdi_status_addr                     = 0x350,
+	.csid_rdi_misr_val0_addr                  = 0x354,
+	.csid_rdi_misr_val1_addr                  = 0x358,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x390,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x394,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x398,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x39c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x3a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x3a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x3a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x3ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x3b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x3b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x3b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x3e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x3e4,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_530_rdi_1_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x50,
+	.csid_rdi_irq_mask_addr                   = 0x54,
+	.csid_rdi_irq_clear_addr                  = 0x58,
+	.csid_rdi_irq_set_addr                    = 0x5c,
+
+	.csid_rdi_cfg0_addr                       = 0x400,
+	.csid_rdi_cfg1_addr                       = 0x404,
+	.csid_rdi_ctrl_addr                       = 0x408,
+	.csid_rdi_rst_strobes_addr                = 0x440,
+	.csid_rdi_status_addr                     = 0x450,
+	.csid_rdi_misr_val0_addr                  = 0x454,
+	.csid_rdi_misr_val1_addr                  = 0x458,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x490,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x494,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x498,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x49c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x4a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x4a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x4a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x4ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x4b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x4b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x4b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x4e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x4e4,
+};
+
+static struct cam_tfe_csid_rdi_reg_offset cam_tfe_csid_530_rdi_2_reg_offset = {
+	.csid_rdi_irq_status_addr                 = 0x60,
+	.csid_rdi_irq_mask_addr                   = 0x64,
+	.csid_rdi_irq_clear_addr                  = 0x68,
+	.csid_rdi_irq_set_addr                    = 0x6c,
+
+	.csid_rdi_cfg0_addr                       = 0x500,
+	.csid_rdi_cfg1_addr                       = 0x504,
+	.csid_rdi_ctrl_addr                       = 0x508,
+	.csid_rdi_rst_strobes_addr                = 0x540,
+	.csid_rdi_status_addr                     = 0x550,
+	.csid_rdi_misr_val0_addr                  = 0x554,
+	.csid_rdi_misr_val1_addr                  = 0x558,
+	.csid_rdi_timestamp_curr0_sof_addr        = 0x590,
+	.csid_rdi_timestamp_curr1_sof_addr        = 0x594,
+	.csid_rdi_timestamp_prev0_sof_addr        = 0x598,
+	.csid_rdi_timestamp_prev1_sof_addr        = 0x59c,
+	.csid_rdi_timestamp_curr0_eof_addr        = 0x5a0,
+	.csid_rdi_timestamp_curr1_eof_addr        = 0x5a4,
+	.csid_rdi_timestamp_prev0_eof_addr        = 0x5a8,
+	.csid_rdi_timestamp_prev1_eof_addr        = 0x5ac,
+	.csid_rdi_err_recovery_cfg0_addr          = 0x5b0,
+	.csid_rdi_err_recovery_cfg1_addr          = 0x5b4,
+	.csid_rdi_err_recovery_cfg2_addr          = 0x5b8,
+	.csid_rdi_byte_cntr_ping_addr             = 0x5e0,
+	.csid_rdi_byte_cntr_pong_addr             = 0x5e4,
+};
+
+static struct cam_tfe_csid_csi2_rx_reg_offset
+	cam_tfe_csid_530_csi2_reg_offset = {
+	.csid_csi2_rx_irq_status_addr                 = 0x20,
+	.csid_csi2_rx_irq_mask_addr                   = 0x24,
+	.csid_csi2_rx_irq_clear_addr                  = 0x28,
+	.csid_csi2_rx_irq_set_addr                    = 0x2c,
+
+	/*CSI2 rx control */
+	.phy_sel_base                                 = 1,
+	.csid_csi2_rx_cfg0_addr                       = 0x100,
+	.csid_csi2_rx_cfg1_addr                       = 0x104,
+	.csid_csi2_rx_capture_ctrl_addr               = 0x108,
+	.csid_csi2_rx_rst_strobes_addr                = 0x110,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr   = 0x120,
+	.csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr   = 0x124,
+	.csid_csi2_rx_captured_short_pkt_0_addr       = 0x128,
+	.csid_csi2_rx_captured_short_pkt_1_addr       = 0x12c,
+	.csid_csi2_rx_captured_long_pkt_0_addr        = 0x130,
+	.csid_csi2_rx_captured_long_pkt_1_addr        = 0x134,
+	.csid_csi2_rx_captured_long_pkt_ftr_addr      = 0x138,
+	.csid_csi2_rx_captured_cphy_pkt_hdr_addr      = 0x13c,
+	.csid_csi2_rx_total_pkts_rcvd_addr            = 0x160,
+	.csid_csi2_rx_stats_ecc_addr                  = 0x164,
+	.csid_csi2_rx_total_crc_err_addr              = 0x168,
+
+	.csi2_rst_srb_all                             = 0x3FFF,
+	.csi2_rst_done_shift_val                      = 27,
+	.csi2_irq_mask_all                            = 0xFFFFFFF,
+	.csi2_misr_enable_shift_val                   = 6,
+	.csi2_capture_long_pkt_en_shift               = 0,
+	.csi2_capture_short_pkt_en_shift              = 1,
+	.csi2_capture_cphy_pkt_en_shift               = 2,
+	.csi2_capture_long_pkt_dt_shift               = 4,
+	.csi2_capture_long_pkt_vc_shift               = 10,
+	.csi2_capture_short_pkt_vc_shift              = 12,
+	.csi2_capture_cphy_pkt_dt_shift               = 14,
+	.csi2_capture_cphy_pkt_vc_shift               = 20,
+	.csi2_rx_phy_num_mask                         = 0x7,
+	.csi2_rx_long_pkt_hdr_rst_stb_shift           = 0x1,
+	.csi2_rx_short_pkt_hdr_rst_stb_shift          = 0x2,
+	.csi2_rx_cphy_pkt_hdr_rst_stb_shift           = 0x3,
+};
+
+static struct cam_tfe_csid_common_reg_offset
+	cam_tfe_csid_530_cmn_reg_offset = {
+	.csid_hw_version_addr                         = 0x0,
+	.csid_cfg0_addr                               = 0x4,
+	.csid_ctrl_addr                               = 0x8,
+	.csid_rst_strobes_addr                        = 0x10,
+
+	.csid_test_bus_ctrl_addr                      = 0x14,
+	.csid_top_irq_status_addr                     = 0x70,
+	.csid_top_irq_mask_addr                       = 0x74,
+	.csid_top_irq_clear_addr                      = 0x78,
+	.csid_top_irq_set_addr                        = 0x7c,
+	.csid_irq_cmd_addr                            = 0x80,
+
+	/*configurations */
+	.major_version                                = 5,
+	.minor_version                                = 3,
+	.version_incr                                 = 0,
+	.num_rdis                                     = 3,
+	.num_pix                                      = 1,
+	.csid_reg_rst_stb                             = 1,
+	.csid_rst_stb                                 = 0x1e,
+	.csid_rst_stb_sw_all                          = 0x1f,
+	.ipp_path_rst_stb_all                         = 0x17,
+	.rdi_path_rst_stb_all                         = 0x97,
+	.path_rst_done_shift_val                      = 1,
+	.path_en_shift_val                            = 31,
+	.dt_id_shift_val                              = 27,
+	.vc_shift_val                                 = 22,
+	.dt_shift_val                                 = 16,
+	.fmt_shift_val                                = 12,
+	.plain_fmt_shit_val                           = 10,
+	.crop_v_en_shift_val                          = 6,
+	.crop_h_en_shift_val                          = 5,
+	.crop_shift                                   = 16,
+	.ipp_irq_mask_all                             = 0x3FFFF,
+	.rdi_irq_mask_all                             = 0x3FFFF,
+	.top_tfe2_pix_pipe_fuse_reg                   = 0xFE4,
+	.top_tfe2_fuse_reg                            = 0xFE8,
+};
+
+static struct cam_tfe_csid_reg_offset cam_tfe_csid_530_reg_offset = {
+	.cmn_reg          = &cam_tfe_csid_530_cmn_reg_offset,
+	.csi2_reg         = &cam_tfe_csid_530_csi2_reg_offset,
+	.ipp_reg          = &cam_tfe_csid_530_ipp_reg_offset,
+	.rdi_reg = {
+		&cam_tfe_csid_530_rdi_0_reg_offset,
+		&cam_tfe_csid_530_rdi_1_reg_offset,
+		&cam_tfe_csid_530_rdi_2_reg_offset,
+		},
+};
+
+int cam_tfe_csid530_init_module(void);
+void cam_tfe_csid530_exit_module(void);
+
+#endif /*_CAM_TFE_CSID_530_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.c
@@ -0,0 +1,3782 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+#include <media/cam_tfe.h>
+#include <media/cam_defs.h>
+#include <media/cam_req_mgr.h>
+
+#include "cam_tfe_csid_core.h"
+#include "cam_csid_ppi_core.h"
+#include "cam_isp_hw.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_subdev.h"
+#include "cam_tasklet_util.h"
+
+/* Timeout value in msec */
+#define TFE_CSID_TIMEOUT                               1000
+
+/* Timeout values in usec */
+#define CAM_TFE_CSID_TIMEOUT_SLEEP_US                  1000
+#define CAM_TFE_CSID_TIMEOUT_ALL_US                    100000
+
+/*
+ * Constant Factors needed to change QTimer ticks to nanoseconds
+ * QTimer Freq = 19.2 MHz
+ * Time(us) = ticks/19.2
+ * Time(ns) = ticks/19.2 * 1000
+ */
+#define CAM_TFE_CSID_QTIMER_MUL_FACTOR                 10000
+#define CAM_TFE_CSID_QTIMER_DIV_FACTOR                 192
+
+/* Max number of sof irq's triggered in case of SOF freeze */
+#define CAM_TFE_CSID_IRQ_SOF_DEBUG_CNT_MAX 12
+
+/* Max CSI Rx irq error count threshold value */
+#define CAM_TFE_CSID_MAX_IRQ_ERROR_COUNT               5
+
+static int cam_tfe_csid_is_ipp_format_supported(
+	uint32_t in_format)
+{
+	int rc = -EINVAL;
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+		rc = 0;
+		break;
+	default:
+		break;
+	}
+	return rc;
+}
+
+static int cam_tfe_csid_get_format_rdi(
+	uint32_t in_format, uint32_t out_format,
+	uint32_t *decode_fmt, uint32_t *plain_fmt)
+{
+	int rc = 0;
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_6:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			*decode_fmt = 0x0;
+			*plain_fmt = 0x0;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_PLAIN128:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			*decode_fmt = 0x1;
+			*plain_fmt = 0x0;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_PLAIN128:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+			*decode_fmt = 0x2;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_12:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN16_12:
+			*decode_fmt = 0x3;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_14:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN16_14:
+			*decode_fmt = 0x4;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		switch (out_format) {
+		case CAM_FORMAT_MIPI_RAW_16:
+			*decode_fmt = 0xf;
+			break;
+		case CAM_FORMAT_PLAIN16_16:
+			*decode_fmt = 0x5;
+			*plain_fmt = 0x1;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	default:
+		rc = -EINVAL;
+		break;
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Unsupported format pair in %d out %d",
+			in_format, out_format);
+
+	return rc;
+}
+
+static int cam_tfe_csid_get_format_ipp(
+	uint32_t in_format,
+	uint32_t *decode_fmt, uint32_t *plain_fmt)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "input format:%d",
+		 in_format);
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		*decode_fmt  = 0;
+		*plain_fmt = 0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		*decode_fmt  = 0x1;
+		*plain_fmt = 0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		*decode_fmt  = 0x2;
+		*plain_fmt = 0x1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		*decode_fmt  = 0x3;
+		*plain_fmt = 0x1;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported format %d",
+			in_format);
+		rc = -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "decode_fmt:%d plain_fmt:%d",
+		 *decode_fmt, *plain_fmt);
+
+	return rc;
+}
+
+static void cam_tfe_csid_enable_path_for_init_frame_drop(
+	struct cam_tfe_csid_hw *csid_hw,
+	int res_id)
+{
+	struct cam_tfe_csid_path_cfg             *path_data;
+	const struct cam_tfe_csid_pxl_reg_offset *pxl_reg = NULL;
+	const struct cam_tfe_csid_rdi_reg_offset *rdi_reg = NULL;
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	struct cam_isp_resource_node             *res;
+	uint32_t val;
+
+	if (!csid_hw) {
+		CAM_WARN(CAM_ISP, "csid_hw cannot be NULL");
+		return;
+	}
+
+	csid_reg  = csid_hw->csid_info->csid_reg;
+	soc_info  = &csid_hw->hw_info->soc_info;
+
+	if (res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+		res = &csid_hw->ipp_res;
+		pxl_reg = csid_reg->ipp_reg;
+	} else if (res_id >= CAM_TFE_CSID_PATH_RES_RDI_0 &&
+			res_id <= CAM_TFE_CSID_PATH_RES_RDI_2) {
+		res = &csid_hw->rdi_res[res_id];
+		rdi_reg = csid_reg->rdi_reg[res_id];
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res_id");
+		return;
+	}
+
+	path_data = (struct cam_tfe_csid_path_cfg *)res->res_priv;
+
+	if (!path_data || !path_data->init_frame_drop)
+		return;
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING)
+		return;
+
+	path_data->res_sof_cnt++;
+	if ((path_data->res_sof_cnt + 1) <
+			path_data->res_sof_cnt) {
+		CAM_WARN(CAM_ISP, "Res %d sof count overflow %d",
+			res_id, path_data->res_sof_cnt);
+		return;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id %d SOF cnt:%d init_frame_drop:%d",
+		csid_hw->hw_intf->hw_idx, res_id, path_data->res_sof_cnt,
+		path_data->init_frame_drop);
+
+	if ((path_data->res_sof_cnt ==
+		path_data->init_frame_drop) &&
+		pxl_reg) {
+		CAM_DBG(CAM_ISP, "Enabling pixel IPP Path");
+		if (path_data->sync_mode !=
+			CAM_ISP_HW_SYNC_SLAVE) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_ctrl_addr);
+			val |= CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY;
+			cam_io_w_mb(val,
+				soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_ctrl_addr);
+		}
+
+		if (!(csid_hw->csid_debug &
+				TFE_CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_irq_mask_addr);
+			val &= ~(TFE_CSID_PATH_INFO_INPUT_SOF);
+			cam_io_w_mb(val,
+				soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_irq_mask_addr);
+		}
+	} else if ((path_data->res_sof_cnt ==
+		path_data->init_frame_drop) && rdi_reg) {
+		CAM_DBG(CAM_ISP, "Enabling RDI %d Path", res_id);
+		cam_io_w_mb(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY,
+			soc_info->reg_map[0].mem_base +
+			rdi_reg->csid_rdi_ctrl_addr);
+		if (!(csid_hw->csid_debug &
+				TFE_CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				rdi_reg->csid_rdi_irq_mask_addr);
+			val &= ~(TFE_CSID_PATH_INFO_INPUT_SOF);
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				rdi_reg->csid_rdi_irq_mask_addr);
+		}
+	}
+}
+
+static bool cam_tfe_csid_check_path_active(struct cam_tfe_csid_hw   *csid_hw)
+{
+	const struct cam_tfe_csid_reg_offset  *csid_reg;
+	struct cam_hw_soc_info                *soc_info;
+	uint32_t i;
+	uint32_t path_status = 1;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	/* check the IPP path status */
+	if (csid_reg->cmn_reg->num_pix) {
+		path_status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_status_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d IPP path status:%d",
+			csid_hw->hw_intf->hw_idx, path_status);
+		/* if status is 0 then it is active */
+		if (!path_status)
+			goto end;
+	}
+
+	/* Check the RDI path status */
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		path_status = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_status_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d RDI:%d path status:%d",
+			csid_hw->hw_intf->hw_idx, i,  path_status);
+		/* if status is 0 then it is active */
+		if (!path_status)
+			goto end;
+	}
+
+end:
+	/* if status is 0 then path is active */
+	return path_status ? false : true;
+}
+
+static void cam_tfe_csid_reset_path_data(
+	struct cam_tfe_csid_hw       *csid_hw,
+	struct cam_isp_resource_node *res)
+{
+	struct cam_tfe_csid_path_cfg *path_data = NULL;
+
+	if (!csid_hw || !res) {
+		CAM_WARN(CAM_ISP, "csid_hw or res cannot be NULL");
+		return;
+	}
+	path_data = res->res_priv;
+
+	if (path_data) {
+		path_data->init_frame_drop = 0;
+		path_data->res_sof_cnt     = 0;
+	}
+}
+
+static int cam_tfe_csid_cid_get(struct cam_tfe_csid_hw *csid_hw,
+	int32_t vc, uint32_t dt, uint32_t *cid)
+{
+	uint32_t  i = 0;
+
+	/* Return already reserved CID if the VC/DT matches */
+	for (i = 0; i < CAM_TFE_CSID_CID_MAX; i++) {
+		if (csid_hw->cid_res[i].cnt >= 1) {
+			if (csid_hw->cid_res[i].vc == vc &&
+				csid_hw->cid_res[i].dt == dt) {
+				csid_hw->cid_res[i].cnt++;
+				*cid = i;
+				CAM_DBG(CAM_ISP, "CSID:%d CID %d allocated",
+					csid_hw->hw_intf->hw_idx, i);
+				return 0;
+			}
+		}
+	}
+
+	for (i = 0; i < CAM_TFE_CSID_CID_MAX; i++) {
+		if (!csid_hw->cid_res[i].cnt) {
+			csid_hw->cid_res[i].vc  = vc;
+			csid_hw->cid_res[i].dt  = dt;
+			csid_hw->cid_res[i].cnt = 1;
+			*cid = i;
+			CAM_DBG(CAM_ISP, "CSID:%d CID %d allocated",
+				csid_hw->hw_intf->hw_idx, i);
+			return 0;
+		}
+	}
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d Free cid is not available",
+		 csid_hw->hw_intf->hw_idx);
+	/* Dump CID values */
+	for (i = 0; i < CAM_TFE_CSID_CID_MAX; i++) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d CID:%d vc:%d dt:%d cnt:%d",
+			csid_hw->hw_intf->hw_idx, i, csid_hw->cid_res[i].vc,
+			csid_hw->cid_res[i].dt, csid_hw->cid_res[i].cnt);
+	}
+	return -EINVAL;
+}
+
+static int cam_tfe_csid_global_reset(struct cam_tfe_csid_hw *csid_hw)
+{
+	struct cam_hw_soc_info                *soc_info;
+	const struct cam_tfe_csid_reg_offset  *csid_reg;
+	struct cam_tfe_csid_path_cfg          *path_data = NULL;
+	int rc = 0;
+	uint32_t val = 0, i;
+	uint32_t status;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid HW State:%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d Csid reset", csid_hw->hw_intf->hw_idx);
+
+	/* Mask all interrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_mask_addr);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_mask_addr);
+
+	/* clear all interrupts */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+
+	cam_io_w_mb(csid_reg->csi2_reg->csi2_irq_mask_all,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_clear_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_clear_addr);
+
+	for (i = 0 ; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->rdi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_clear_addr);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	cam_io_w_mb(0x80, soc_info->reg_map[0].mem_base +
+		csid_hw->csid_info->csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+
+	/* perform the top CSID HW registers reset */
+	cam_io_w_mb(csid_reg->cmn_reg->csid_rst_stb,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_rst_strobes_addr);
+
+	rc = readl_poll_timeout(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_status_addr,
+			status, (status & 0x1) == 0x1,
+		CAM_TFE_CSID_TIMEOUT_SLEEP_US, CAM_TFE_CSID_TIMEOUT_ALL_US);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d csid_reset fail rc = %d",
+			  csid_hw->hw_intf->hw_idx, rc);
+		rc = -ETIMEDOUT;
+	}
+
+	status = cam_io_r(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_status_addr);
+	CAM_DBG(CAM_ISP, "Status reg %d", status);
+
+	/* perform the SW registers reset */
+	reinit_completion(&csid_hw->csid_top_complete);
+	cam_io_w_mb(csid_reg->cmn_reg->csid_reg_rst_stb,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_rst_strobes_addr);
+
+	rc = wait_for_completion_timeout(&csid_hw->csid_top_complete,
+		msecs_to_jiffies(TFE_CSID_TIMEOUT));
+	if (rc <= 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d soft reg reset fail rc = %d",
+			 csid_hw->hw_intf->hw_idx, rc);
+		if (rc == 0)
+			rc = -ETIMEDOUT;
+	} else
+		rc = 0;
+
+	usleep_range(3000, 3010);
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+	if (val != 0)
+		CAM_ERR(CAM_ISP, "CSID:%d IRQ value after reset rc = %d",
+			csid_hw->hw_intf->hw_idx, val);
+	csid_hw->error_irq_count = 0;
+	csid_hw->prev_boot_timestamp = 0;
+
+	path_data = (struct cam_tfe_csid_path_cfg *)csid_hw->ipp_res.res_priv;
+	path_data->res_sof_cnt = 0;
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		path_data = (struct cam_tfe_csid_path_cfg  *)
+			csid_hw->rdi_res[i].res_priv;
+		path_data->res_sof_cnt = 0;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_path_reset(struct cam_tfe_csid_hw *csid_hw,
+	struct cam_tfe_csid_reset_cfg_args  *reset)
+{
+	int rc = 0;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_isp_resource_node              *res;
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	uint32_t  reset_strb_addr, reset_strb_val, val, id;
+	struct completion  *complete;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	res      = reset->node_res;
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid hw state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d resource:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+		if (!csid_reg->ipp_reg) {
+			CAM_ERR(CAM_ISP, "CSID:%d IPP not supported :%d",
+				 csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			return -EINVAL;
+		}
+
+		reset_strb_addr = csid_reg->ipp_reg->csid_pxl_rst_strobes_addr;
+		complete = &csid_hw->csid_ipp_complete;
+		reset_strb_val = csid_reg->cmn_reg->ipp_path_rst_stb_all;
+
+		/* Enable path reset done interrupt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+		val |= TFE_CSID_PATH_INFO_RST_DONE;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			 csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+	} else {
+		id = res->res_id;
+		if (!csid_reg->rdi_reg[id]) {
+			CAM_ERR(CAM_ISP, "CSID:%d RDI res not supported :%d",
+				 csid_hw->hw_intf->hw_idx,
+				res->res_id);
+			return -EINVAL;
+		}
+
+		reset_strb_addr =
+			csid_reg->rdi_reg[id]->csid_rdi_rst_strobes_addr;
+		complete =
+			&csid_hw->csid_rdin_complete[id];
+		reset_strb_val = csid_reg->cmn_reg->rdi_path_rst_stb_all;
+
+		/* Enable path reset done interrupt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+		val |= TFE_CSID_PATH_INFO_RST_DONE;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+	}
+
+	reinit_completion(complete);
+
+	/* Reset the corresponding tfe csid path */
+	cam_io_w_mb(reset_strb_val, soc_info->reg_map[0].mem_base +
+				reset_strb_addr);
+
+	rc = wait_for_completion_timeout(complete,
+		msecs_to_jiffies(TFE_CSID_TIMEOUT));
+	if (rc <= 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d Res id %d fail rc = %d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_id,  rc);
+		if (rc == 0)
+			rc = -ETIMEDOUT;
+	}
+
+end:
+	return rc;
+}
+
+static int cam_tfe_csid_cid_reserve(struct cam_tfe_csid_hw *csid_hw,
+	struct cam_tfe_csid_hw_reserve_resource_args  *cid_reserv,
+	uint32_t  *cid_value)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP,
+		"CSID:%d res_id:0x%x Lane type:%d lane_num:%d dt:%d vc:%d",
+		csid_hw->hw_intf->hw_idx,
+		cid_reserv->in_port->res_id,
+		cid_reserv->in_port->lane_type,
+		cid_reserv->in_port->lane_num,
+		cid_reserv->in_port->dt,
+		cid_reserv->in_port->vc);
+
+	if (cid_reserv->in_port->res_id >= CAM_ISP_TFE_IN_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d  Invalid phy sel %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cid_reserv->in_port->lane_type >= CAM_ISP_LANE_TYPE_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d  Invalid lane type %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->lane_type);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((cid_reserv->in_port->lane_type ==  CAM_ISP_LANE_TYPE_DPHY &&
+		cid_reserv->in_port->lane_num > 4)) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid lane num %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->lane_num);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cid_reserv->in_port->lane_type == CAM_ISP_LANE_TYPE_CPHY &&
+		cid_reserv->in_port->lane_num > 3) {
+		CAM_ERR(CAM_ISP, " CSID:%d Invalid lane type %d & num %d",
+			 csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->lane_type,
+			cid_reserv->in_port->lane_num);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* CSID  CSI2 v1.1 supports 4 vc  */
+	if (cid_reserv->in_port->dt > 0x3f ||
+		cid_reserv->in_port->vc > 0x3) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d dt %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->vc, cid_reserv->in_port->dt);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (csid_hw->csi2_reserve_cnt == UINT_MAX) {
+		CAM_ERR(CAM_ISP,
+			"CSID%d reserve cnt reached max",
+			csid_hw->hw_intf->hw_idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "Reserve_cnt %u", csid_hw->csi2_reserve_cnt);
+
+	if (csid_hw->csi2_reserve_cnt) {
+		/* current configure res type should match requested res type */
+		if (csid_hw->in_res_id != cid_reserv->in_port->res_id) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (csid_hw->csi2_rx_cfg.lane_cfg !=
+			cid_reserv->in_port->lane_cfg  ||
+			csid_hw->csi2_rx_cfg.lane_type !=
+			cid_reserv->in_port->lane_type ||
+			csid_hw->csi2_rx_cfg.lane_num !=
+			cid_reserv->in_port->lane_num) {
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	rc = cam_tfe_csid_cid_get(csid_hw,
+		cid_reserv->in_port->vc,
+		cid_reserv->in_port->dt,
+		cid_value);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d CID Reserve failed res_id %d",
+			csid_hw->hw_intf->hw_idx,
+			cid_reserv->in_port->res_id);
+		goto end;
+	}
+
+	if (!csid_hw->csi2_reserve_cnt) {
+		csid_hw->in_res_id = cid_reserv->in_port->res_id;
+
+		csid_hw->csi2_rx_cfg.lane_cfg =
+			cid_reserv->in_port->lane_cfg;
+		csid_hw->csi2_rx_cfg.lane_type =
+			cid_reserv->in_port->lane_type;
+		csid_hw->csi2_rx_cfg.lane_num =
+			cid_reserv->in_port->lane_num;
+
+		if (cid_reserv->in_port->res_id != CAM_ISP_TFE_IN_RES_TPG)
+			csid_hw->csi2_rx_cfg.phy_sel =
+				(cid_reserv->in_port->res_id & 0xFF) - 1;
+		else
+			csid_hw->csi2_rx_cfg.phy_sel =
+				(cid_reserv->phy_sel & 0xFF) - 1;
+	}
+
+	csid_hw->csi2_reserve_cnt++;
+	CAM_DBG(CAM_ISP, "CSID:%d CID:%d acquired reserv cnt:%d",
+		csid_hw->hw_intf->hw_idx, *cid_value,
+		csid_hw->csi2_reserve_cnt);
+
+end:
+	return rc;
+}
+
+static int cam_tfe_csid_path_reserve(struct cam_tfe_csid_hw *csid_hw,
+	struct cam_tfe_csid_hw_reserve_resource_args  *reserve)
+{
+	int rc = 0;
+	struct cam_tfe_csid_path_cfg    *path_data;
+	struct cam_isp_resource_node    *res;
+	uint32_t          cid_value;
+
+	/* CSID  CSI2 v2.0 supports 4 vc */
+	if (reserve->in_port->dt > 0x3f || reserve->in_port->vc > 0x3 ||
+		(reserve->sync_mode >= CAM_ISP_HW_SYNC_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d dt %d mode:%d",
+			 csid_hw->hw_intf->hw_idx,
+			reserve->in_port->vc, reserve->in_port->dt,
+			reserve->sync_mode);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	switch (reserve->res_id) {
+	case CAM_TFE_CSID_PATH_RES_IPP:
+		if (csid_hw->ipp_res.res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_DBG(CAM_ISP,
+				"CSID:%d IPP resource not available %d",
+				csid_hw->hw_intf->hw_idx,
+				csid_hw->ipp_res.res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (cam_tfe_csid_is_ipp_format_supported(
+				reserve->in_port->format)) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%d res id:%d un support format %d",
+				csid_hw->hw_intf->hw_idx, reserve->res_id,
+				reserve->in_port->format);
+			rc = -EINVAL;
+			goto end;
+		}
+		rc = cam_tfe_csid_cid_reserve(csid_hw, reserve, &cid_value);
+		if (rc)
+			goto end;
+
+		/* assign the IPP resource */
+		res = &csid_hw->ipp_res;
+		CAM_DBG(CAM_ISP,
+			"CSID:%d IPP resource:%d acquired successfully",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+
+		break;
+
+	case CAM_TFE_CSID_PATH_RES_RDI_0:
+	case CAM_TFE_CSID_PATH_RES_RDI_1:
+	case CAM_TFE_CSID_PATH_RES_RDI_2:
+		if (csid_hw->rdi_res[reserve->res_id].res_state !=
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+			CAM_ERR(CAM_ISP,
+				"CSID:%d RDI:%d resource not available %d",
+				csid_hw->hw_intf->hw_idx,
+				reserve->res_id,
+				csid_hw->rdi_res[reserve->res_id].res_state);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		rc = cam_tfe_csid_cid_reserve(csid_hw, reserve, &cid_value);
+		if (rc)
+			goto end;
+
+		res = &csid_hw->rdi_res[reserve->res_id];
+		CAM_DBG(CAM_ISP,
+			"CSID:%d RDI resource:%d acquire success",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id);
+
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id:%d",
+			csid_hw->hw_intf->hw_idx, reserve->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	path_data = (struct cam_tfe_csid_path_cfg   *)res->res_priv;
+
+	CAM_DBG(CAM_ISP, "sensor width:%d height:%d fps:%d vbi:%d hbi:%d",
+		reserve->in_port->sensor_width,
+		reserve->in_port->sensor_height,
+		reserve->in_port->sensor_fps,
+		reserve->in_port->sensor_vbi,
+		reserve->in_port->sensor_hbi);
+	path_data->sensor_width = reserve->in_port->sensor_width;
+	path_data->sensor_height = reserve->in_port->sensor_height;
+	path_data->sensor_fps  = reserve->in_port->sensor_fps;
+	path_data->sensor_hbi = reserve->in_port->sensor_vbi;
+	path_data->sensor_vbi = reserve->in_port->sensor_hbi;
+
+	path_data->cid = cid_value;
+	path_data->in_format = reserve->in_port->format;
+	path_data->out_format = reserve->out_port->format;
+	path_data->sync_mode = reserve->sync_mode;
+	path_data->height  = reserve->in_port->height;
+	path_data->start_line = reserve->in_port->line_start;
+	path_data->end_line = reserve->in_port->line_end;
+	path_data->usage_type = reserve->in_port->usage_type;
+
+	csid_hw->event_cb = reserve->event_cb;
+	csid_hw->event_cb_priv = reserve->event_cb_prv;
+
+	/* Enable crop only for ipp */
+	if (reserve->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+		path_data->crop_enable = true;
+
+	CAM_DBG(CAM_ISP,
+		"Res id: %d height:%d line_start %d line_end %d crop_en %d",
+		reserve->res_id, reserve->in_port->height,
+		reserve->in_port->line_start, reserve->in_port->line_end,
+		path_data->crop_enable);
+
+	path_data->dt = reserve->in_port->dt;
+	path_data->vc = reserve->in_port->vc;
+
+	if (reserve->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
+		path_data->start_pixel = reserve->in_port->left_start;
+		path_data->end_pixel = reserve->in_port->left_end;
+		path_data->width  = reserve->in_port->left_width;
+		CAM_DBG(CAM_ISP, "CSID:%d master:startpixel 0x%x endpixel:0x%x",
+			csid_hw->hw_intf->hw_idx, path_data->start_pixel,
+			path_data->end_pixel);
+		CAM_DBG(CAM_ISP, "CSID:%d master:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, path_data->start_line,
+			path_data->end_line);
+	} else if (reserve->sync_mode == CAM_ISP_HW_SYNC_SLAVE) {
+		path_data->master_idx = reserve->master_idx;
+		CAM_DBG(CAM_ISP, "CSID:%d master_idx=%d",
+			csid_hw->hw_intf->hw_idx, path_data->master_idx);
+		path_data->start_pixel = reserve->in_port->right_start;
+		path_data->end_pixel = reserve->in_port->right_end;
+		path_data->width  = reserve->in_port->right_width;
+		CAM_DBG(CAM_ISP, "CSID:%d slave:start:0x%x end:0x%x width 0x%x",
+			csid_hw->hw_intf->hw_idx, path_data->start_pixel,
+			path_data->end_pixel, path_data->width);
+		CAM_DBG(CAM_ISP, "CSID:%d slave:line start:0x%x line end:0x%x",
+			csid_hw->hw_intf->hw_idx, path_data->start_line,
+			path_data->end_line);
+	} else {
+		path_data->width  = reserve->in_port->left_width;
+		path_data->start_pixel = reserve->in_port->left_start;
+		path_data->end_pixel = reserve->in_port->left_end;
+		CAM_DBG(CAM_ISP, "Res id: %d left width %d start: %d stop:%d",
+			reserve->res_id, reserve->in_port->left_width,
+			reserve->in_port->left_start,
+			reserve->in_port->left_end);
+	}
+
+	CAM_DBG(CAM_ISP, "Res %d width %d height %d", reserve->res_id,
+		path_data->width, path_data->height);
+	reserve->node_res = res;
+
+end:
+	return rc;
+}
+
+static int cam_tfe_csid_enable_csi2(
+	struct cam_tfe_csid_hw          *csid_hw)
+{
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_csid_ppi_cfg                     ppi_lane_cfg;
+	uint32_t val = 0;
+	uint32_t ppi_index = 0, rc;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	CAM_DBG(CAM_ISP, "CSID:%d config csi2 rx",
+		csid_hw->hw_intf->hw_idx);
+
+	/* rx cfg0 */
+	val = 0;
+	val = (csid_hw->csi2_rx_cfg.lane_num - 1)  |
+		(csid_hw->csi2_rx_cfg.lane_cfg << 4) |
+		(csid_hw->csi2_rx_cfg.lane_type << 24);
+	val |= (csid_hw->csi2_rx_cfg.phy_sel &
+		csid_reg->csi2_reg->csi2_rx_phy_num_mask) << 20;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg0_addr);
+
+	/* rx cfg1 */
+	val = (1 << csid_reg->csi2_reg->csi2_misr_enable_shift_val);
+
+	/* enable packet ecc correction */
+	val |= 1;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+
+	/* Enable the CSI2 rx inerrupts */
+	val = TFE_CSID_CSI2_RX_INFO_RST_DONE |
+		TFE_CSID_CSI2_RX_ERROR_LANE0_FIFO_OVERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_LANE1_FIFO_OVERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_LANE2_FIFO_OVERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_LANE3_FIFO_OVERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION |
+		TFE_CSID_CSI2_RX_ERROR_CPHY_SOT_RECEPTION |
+		TFE_CSID_CSI2_RX_ERROR_CRC |
+		TFE_CSID_CSI2_RX_ERROR_ECC |
+		TFE_CSID_CSI2_RX_ERROR_MMAPPED_VC_DT |
+		TFE_CSID_CSI2_RX_ERROR_STREAM_UNDERFLOW |
+		TFE_CSID_CSI2_RX_ERROR_UNBOUNDED_FRAME |
+		TFE_CSID_CSI2_RX_ERROR_CPHY_PH_CRC;
+
+	/* Enable the interrupt based on csid debug info set */
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOT_IRQ)
+		val |= TFE_CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED;
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOT_IRQ)
+		val |= TFE_CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED |
+			TFE_CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED;
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val |= TFE_CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED;
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+		val |= TFE_CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED;
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+		val |= TFE_CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+	/*
+	 * There is one to one mapping for ppi index with phy index
+	 * we do not always update phy sel equal to phy number,for some
+	 * targets "phy_sel = phy_num + 1", and for some targets it is
+	 * "phy_sel = phy_num", ppi_index should be updated accordingly
+	 */
+	ppi_index = csid_hw->csi2_rx_cfg.phy_sel - csid_reg->csi2_reg->phy_sel_base;
+
+	if (csid_hw->ppi_hw_intf[ppi_index] && csid_hw->ppi_enable) {
+		ppi_lane_cfg.lane_type = csid_hw->csi2_rx_cfg.lane_type;
+		ppi_lane_cfg.lane_num  = csid_hw->csi2_rx_cfg.lane_num;
+		ppi_lane_cfg.lane_cfg  = csid_hw->csi2_rx_cfg.lane_cfg;
+
+		CAM_DBG(CAM_ISP, "ppi_index to init %d", ppi_index);
+		rc = csid_hw->ppi_hw_intf[ppi_index]->hw_ops.init(
+				csid_hw->ppi_hw_intf[ppi_index]->hw_priv,
+				&ppi_lane_cfg,
+				sizeof(struct cam_csid_ppi_cfg));
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "PPI:%d Init Failed",
+					ppi_index);
+			return rc;
+		}
+	}
+
+
+	return 0;
+}
+
+static int cam_tfe_csid_disable_csi2(
+	struct cam_tfe_csid_hw          *csid_hw)
+{
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	uint32_t ppi_index = 0, rc;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	CAM_DBG(CAM_ISP, "CSID:%d Disable csi2 rx",
+		csid_hw->hw_intf->hw_idx);
+
+	/* Disable the CSI2 rx inerrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+
+	/* Reset the Rx CFG registers */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg0_addr);
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+
+	ppi_index = csid_hw->csi2_rx_cfg.phy_sel - csid_reg->csi2_reg->phy_sel_base;
+	if (csid_hw->ppi_hw_intf[ppi_index] && csid_hw->ppi_enable) {
+		/* De-Initialize the PPI bridge */
+		CAM_DBG(CAM_ISP, "ppi_index to de-init %d\n", ppi_index);
+		rc = csid_hw->ppi_hw_intf[ppi_index]->hw_ops.deinit(
+				csid_hw->ppi_hw_intf[ppi_index]->hw_priv,
+				NULL, 0);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "PPI:%d De-Init Failed", ppi_index);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_tfe_csid_enable_hw(struct cam_tfe_csid_hw  *csid_hw)
+{
+	int rc = 0;
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_tfe_csid_path_cfg              *path_data = NULL;
+	uint32_t i, val, clk_lvl;
+	unsigned long flags;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	/* overflow check before increment */
+	if (csid_hw->hw_info->open_count == UINT_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Open count reached max",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+
+	/* Increment ref Count */
+	csid_hw->hw_info->open_count++;
+	if (csid_hw->hw_info->open_count > 1) {
+		CAM_DBG(CAM_ISP, "CSID hw has already been enabled");
+		return rc;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d init CSID HW",
+		csid_hw->hw_intf->hw_idx);
+
+	rc = cam_soc_util_get_clk_level(soc_info, csid_hw->clk_rate,
+		soc_info->src_clk_idx, &clk_lvl);
+	CAM_DBG(CAM_ISP, "CSID clock lvl %u", clk_lvl);
+
+	rc = cam_tfe_csid_enable_soc_resources(soc_info, clk_lvl);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d Enable SOC failed",
+			csid_hw->hw_intf->hw_idx);
+		goto err;
+	}
+
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_UP;
+	/* Disable the top IRQ interrupt */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_mask_addr);
+	/* Reset CSID top */
+	rc = cam_tfe_csid_global_reset(csid_hw);
+	if (rc)
+		goto disable_soc;
+
+	/* clear all interrupts */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+
+	cam_io_w_mb(csid_reg->csi2_reg->csi2_irq_mask_all,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_clear_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		cam_io_w_mb(csid_reg->cmn_reg->ipp_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_clear_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		cam_io_w_mb(csid_reg->cmn_reg->rdi_irq_mask_all,
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_clear_addr);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_hw_version_addr);
+	CAM_DBG(CAM_ISP, "CSID:%d CSID HW version: 0x%x",
+		csid_hw->hw_intf->hw_idx, val);
+
+	/* enable the csi2 rx */
+	rc = cam_tfe_csid_enable_csi2(csid_hw);
+	if (rc)
+		goto disable_soc;
+
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	csid_hw->fatal_err_detected = false;
+	csid_hw->device_enabled = 1;
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+	cam_tasklet_start(csid_hw->tasklet);
+
+	path_data = (struct cam_tfe_csid_path_cfg  *)csid_hw->ipp_res.res_priv;
+	path_data->res_sof_cnt = 0;
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		path_data = (struct cam_tfe_csid_path_cfg *)
+						csid_hw->rdi_res[i].res_priv;
+		path_data->res_sof_cnt = 0;
+	}
+
+
+	return rc;
+
+disable_soc:
+	cam_tfe_csid_disable_soc_resources(soc_info);
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+err:
+	csid_hw->hw_info->open_count--;
+	return rc;
+}
+
+static int cam_tfe_csid_disable_hw(struct cam_tfe_csid_hw *csid_hw)
+{
+	int rc = -EINVAL;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	unsigned long                             flags;
+
+	/* Check for refcount */
+	if (!csid_hw->hw_info->open_count) {
+		CAM_WARN(CAM_ISP, "Unbalanced disable_hw");
+		return rc;
+	}
+
+	/* Decrement ref Count */
+	csid_hw->hw_info->open_count--;
+
+	if (csid_hw->hw_info->open_count) {
+		rc = 0;
+		return rc;
+	}
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	/* Disable the csi2 */
+	cam_tfe_csid_disable_csi2(csid_hw);
+
+	CAM_DBG(CAM_ISP, "%s:Calling Global Reset", __func__);
+	cam_tfe_csid_global_reset(csid_hw);
+	CAM_DBG(CAM_ISP, "%s:Global Reset Done", __func__);
+
+	CAM_DBG(CAM_ISP, "CSID:%d De-init CSID HW",
+		csid_hw->hw_intf->hw_idx);
+
+	/* Disable the top IRQ interrupt */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_mask_addr);
+
+	cam_tasklet_stop(csid_hw->tasklet);
+
+	rc = cam_tfe_csid_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CSID:%d Disable CSID SOC failed",
+			csid_hw->hw_intf->hw_idx);
+
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	csid_hw->device_enabled = 0;
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+	csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	csid_hw->error_irq_count = 0;
+	csid_hw->prev_boot_timestamp = 0;
+
+	return rc;
+}
+
+static int cam_tfe_csid_init_config_pxl_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	struct cam_tfe_csid_path_cfg             *path_data;
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	const struct cam_tfe_csid_pxl_reg_offset *pxl_reg = NULL;
+	uint32_t decode_format = 0, plain_format = 0, val = 0;
+
+	path_data = (struct cam_tfe_csid_path_cfg  *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	pxl_reg = csid_reg->ipp_reg;
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d IPP :%d is not supported on HW",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Config IPP Path");
+	rc = cam_tfe_csid_get_format_ipp(path_data->in_format,
+		&decode_format, &plain_format);
+	if (rc)
+		return rc;
+
+	/*
+	 * configure Pxl path and enable the time stamp capture.
+	 * enable the HW measrurement blocks
+	 */
+	val = (path_data->vc << csid_reg->cmn_reg->vc_shift_val) |
+		(path_data->dt << csid_reg->cmn_reg->dt_shift_val) |
+		(path_data->cid << csid_reg->cmn_reg->dt_id_shift_val) |
+		(decode_format << csid_reg->cmn_reg->fmt_shift_val) |
+		(path_data->crop_enable <<
+		csid_reg->cmn_reg->crop_h_en_shift_val) |
+		(path_data->crop_enable <<
+		csid_reg->cmn_reg->crop_v_en_shift_val) |
+		(1 << 1);
+
+	val |= (1 << pxl_reg->pix_store_en_shift_val);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg0_addr);
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg1_addr);
+
+	/* select the post irq sub sample strobe for time stamp capture */
+	val |= TFE_CSID_TIMESTAMP_STB_POST_IRQ;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg1_addr);
+
+	if (path_data->crop_enable) {
+		val = (((path_data->end_pixel & 0xFFFF) <<
+			csid_reg->cmn_reg->crop_shift) |
+			(path_data->start_pixel & 0xFFFF));
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_hcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Horizontal crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		val = (((path_data->end_line & 0xFFFF) <<
+			csid_reg->cmn_reg->crop_shift) |
+			(path_data->start_line & 0xFFFF));
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_vcrop_addr);
+		CAM_DBG(CAM_ISP, "CSID:%d Vertical Crop config val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+		/* Enable generating early eof strobe based on crop config */
+		if (!(csid_hw->csid_debug & TFE_CSID_DEBUG_DISABLE_EARLY_EOF)) {
+			val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_cfg0_addr);
+			val |= (1 << pxl_reg->early_eof_en_shift_val);
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				pxl_reg->csid_pxl_cfg0_addr);
+		}
+	}
+
+	/* Enable the Pxl path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg0_addr);
+	val |= (1 << csid_reg->cmn_reg->path_en_shift_val);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_cfg0_addr);
+
+	/* Enable Error Detection Overflow ctrl mode: 2 -> Detect overflow */
+	val = 0x9;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_err_recovery_cfg0_addr);
+
+	/* configure the rx packet capture based on csid debug set */
+	val = 0;
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val = ((1 <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_en_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_vc_shift));
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_capture_ctrl_addr);
+	CAM_DBG(CAM_ISP, "rx capture control value 0x%x", val);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	return rc;
+}
+
+static int cam_tfe_csid_deinit_pxl_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	const struct cam_tfe_csid_pxl_reg_offset  *pxl_reg = NULL;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	pxl_reg = csid_reg->ipp_reg;
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d IPP Res type %d res_id:%d in wrong state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		rc = -EINVAL;
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d IPP %d is not supported on HW",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Disable Error Recovery */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_err_recovery_cfg0_addr);
+
+end:
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_tfe_csid_enable_pxl_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_tfe_csid_reg_offset     *csid_reg;
+	struct cam_hw_soc_info                   *soc_info;
+	struct cam_tfe_csid_path_cfg             *path_data;
+	const struct cam_tfe_csid_pxl_reg_offset *pxl_reg = NULL;
+	uint32_t                                  val = 0;
+
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	pxl_reg = csid_reg->ipp_reg;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d IPP path res type:%d res_id:%d Invalid state%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d IPP resid: %d not supported on HW",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enable IPP path");
+
+	/* Set master or slave path */
+	if (path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER)
+		/* Set halt mode as master */
+		val = (TFE_CSID_HALT_MODE_MASTER  <<
+			pxl_reg->halt_mode_shift) |
+			(pxl_reg->halt_master_sel_master_val <<
+			pxl_reg->halt_master_sel_shift);
+	else if (path_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		/* Set halt mode as slave and set master idx */
+		val = (TFE_CSID_HALT_MODE_SLAVE << pxl_reg->halt_mode_shift);
+	else
+		/* Default is internal halt mode */
+		val = 0;
+
+	/*
+	 * Resume at frame boundary if Master or No Sync.
+	 * Slave will get resume command from Master.
+	 */
+	if (path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		path_data->sync_mode == CAM_ISP_HW_SYNC_NONE)
+		val |= CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+
+	CAM_DBG(CAM_ISP, "CSID:%d IPP Ctrl val: 0x%x",
+			csid_hw->hw_intf->hw_idx, val);
+
+	/* Enable the required pxl path interrupts */
+	val = TFE_CSID_PATH_INFO_RST_DONE |
+		TFE_CSID_PATH_ERROR_FIFO_OVERFLOW |
+		TFE_CSID_PATH_IPP_ERROR_CCIF_VIOLATION |
+		TFE_CSID_PATH_IPP_OVERFLOW_IRQ;
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ)
+		val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)
+		val |= TFE_CSID_PATH_INFO_INPUT_EOF;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_mask_addr);
+
+	CAM_DBG(CAM_ISP, "Enable IPP IRQ mask 0x%x", val);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_tfe_csid_change_pxl_halt_mode(
+	struct cam_tfe_csid_hw            *csid_hw,
+	struct cam_tfe_csid_hw_halt_args  *csid_halt)
+{
+	uint32_t val = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	const struct cam_tfe_csid_pxl_reg_offset   *pxl_reg;
+	struct cam_isp_resource_node               *res;
+
+	res = csid_halt->node_res;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id != CAM_TFE_CSID_PATH_RES_IPP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id %d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "CSID:%d Res:%d in invalid state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	pxl_reg = csid_reg->ipp_reg;
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_mask_addr);
+
+	/* configure Halt for slave */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+	val &= ~0xC;
+	val |= (csid_halt->halt_mode << 2);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+	CAM_DBG(CAM_ISP, "CSID:%d IPP path Res halt mode:%d configured:%x",
+		csid_hw->hw_intf->hw_idx, csid_halt->halt_mode, val);
+
+	return 0;
+}
+
+static int cam_tfe_csid_disable_pxl_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_tfe_csid_halt_cmd       stop_cmd)
+{
+	int rc = 0;
+	uint32_t val = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_tfe_csid_path_cfg               *path_data;
+	const struct cam_tfe_csid_pxl_reg_offset   *pxl_reg;
+
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "CSID:%d Res:%d already in stopped state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return rc;
+	}
+
+	pxl_reg = csid_reg->ipp_reg;
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_DBG(CAM_ISP, "CSID:%d IPP path Res:%d Invalid state%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	if (!pxl_reg) {
+		CAM_ERR(CAM_ISP, "CSID:%d IPP %d is not supported on HW",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (stop_cmd != CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_TFE_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d IPP path un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id:%d IPP path",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_irq_mask_addr);
+
+	if (path_data->sync_mode == CAM_ISP_HW_SYNC_MASTER ||
+		path_data->sync_mode == CAM_ISP_HW_SYNC_NONE) {
+		/* configure Halt */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		pxl_reg->csid_pxl_ctrl_addr);
+		val &= ~0x3;
+		val |= stop_cmd;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_ctrl_addr);
+	}
+
+	if (path_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE &&
+		stop_cmd == CAM_TFE_CSID_HALT_IMMEDIATELY) {
+		/* configure Halt for slave */
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_ctrl_addr);
+		val &= ~0xF;
+		val |= stop_cmd;
+		val |= (TFE_CSID_HALT_MODE_MASTER << 2);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_ctrl_addr);
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_init_config_rdi_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	struct cam_tfe_csid_path_cfg           *path_data;
+	const struct cam_tfe_csid_reg_offset   *csid_reg;
+	struct cam_hw_soc_info                 *soc_info;
+	uint32_t path_format = 0, plain_fmt = 0, val = 0, id;
+
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	id = res->res_id;
+	if (!csid_reg->rdi_reg[id]) {
+		CAM_ERR(CAM_ISP, "CSID:%d RDI:%d is not supported on HW",
+			 csid_hw->hw_intf->hw_idx, id);
+		return -EINVAL;
+	}
+
+	rc = cam_tfe_csid_get_format_rdi(path_data->in_format,
+		path_data->out_format, &path_format, &plain_fmt);
+	if (rc)
+		return rc;
+
+	/*
+	 * RDI path config and enable the time stamp capture
+	 * Enable the measurement blocks
+	 */
+	val = (path_data->vc << csid_reg->cmn_reg->vc_shift_val) |
+		(path_data->dt << csid_reg->cmn_reg->dt_shift_val) |
+		(path_data->cid << csid_reg->cmn_reg->dt_id_shift_val) |
+		(path_format << csid_reg->cmn_reg->fmt_shift_val) |
+		(plain_fmt << csid_reg->cmn_reg->plain_fmt_shit_val) |
+		(1 << 2) | 1;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+
+	/* select the post irq sub sample strobe for time stamp capture */
+	cam_io_w_mb(TFE_CSID_TIMESTAMP_STB_POST_IRQ,
+		soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg1_addr);
+
+	/* Enable Error Detection, Overflow ctrl mode: 2 -> Detect overflow */
+	val = 0x9;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_err_recovery_cfg0_addr);
+
+	/* Configure the halt mode */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+	/* Enable the RPP path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+	val |= (1 << csid_reg->cmn_reg->path_en_shift_val);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+
+	/* configure the rx packet capture based on csid debug set */
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE)
+		val = ((1 <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_en_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_short_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_long_pkt_vc_shift));
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE)
+		val |= ((1 <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_en_shift) |
+			(path_data->dt <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_dt_shift) |
+			(path_data->vc <<
+			csid_reg->csi2_reg->csi2_capture_cphy_pkt_vc_shift));
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_capture_ctrl_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+
+	return rc;
+}
+
+static int cam_tfe_csid_deinit_rdi_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	int rc = 0;
+	uint32_t id;
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id;
+
+	if (res->res_id > CAM_TFE_CSID_PATH_RES_RDI_2 ||
+		res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		!csid_reg->rdi_reg[id]) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res id%d state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	/* Disable Error Recovery */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_err_recovery_cfg0_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_tfe_csid_enable_rdi_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res)
+{
+	const struct cam_tfe_csid_reg_offset      *csid_reg;
+	struct cam_hw_soc_info                    *soc_info;
+	struct cam_tfe_csid_path_cfg              *path_data;
+	uint32_t id, val;
+	bool path_active = false;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id;
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_id > CAM_TFE_CSID_PATH_RES_RDI_2 ||
+		!csid_reg->rdi_reg[id]) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d invalid res type:%d res_id:%d state%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		return -EINVAL;
+	}
+
+	/*Drop one frame extra on RDI for dual TFE use case */
+	if (path_data->usage_type == CAM_ISP_TFE_IN_RES_USAGE_DUAL)
+		path_data->init_frame_drop = 1;
+
+	/*resume at frame boundary */
+	if (!path_data->init_frame_drop) {
+		CAM_DBG(CAM_ISP, "Start RDI:%d path", id);
+		/* resume at frame boundary */
+		cam_io_w_mb(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY,
+				  soc_info->reg_map[0].mem_base +
+				  csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+	} else {
+		path_active = cam_tfe_csid_check_path_active(csid_hw);
+		if (path_active)
+			cam_io_w_mb(CAM_TFE_CSID_RESUME_AT_FRAME_BOUNDARY,
+					  soc_info->reg_map[0].mem_base +
+					  csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+			CAM_DBG(CAM_ISP,
+				"CSID:%d  %s RDI:%d path frame drop %d",
+				csid_hw->hw_intf->hw_idx,
+				path_active ? "Starting" : "Not Starting", id,
+				path_data->init_frame_drop);
+	}
+
+	/* Enable the required RDI interrupts */
+	val = TFE_CSID_PATH_INFO_RST_DONE | TFE_CSID_PATH_ERROR_FIFO_OVERFLOW |
+		TFE_CSID_PATH_RDI_ERROR_CCIF_VIOLATION |
+		TFE_CSID_PATH_RDI_OVERFLOW_IRQ;
+
+	if ((csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ) ||
+		(path_data->init_frame_drop && !path_active))
+		val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)
+		val |= TFE_CSID_PATH_INFO_INPUT_EOF;
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_tfe_csid_disable_rdi_path(
+	struct cam_tfe_csid_hw          *csid_hw,
+	struct cam_isp_resource_node    *res,
+	enum cam_tfe_csid_halt_cmd                stop_cmd)
+{
+	int rc = 0;
+	uint32_t id, val = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_tfe_csid_path_cfg               *path_data;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	id = res->res_id;
+	path_data = (struct cam_tfe_csid_path_cfg   *) res->res_priv;
+
+	if ((res->res_id > CAM_TFE_CSID_PATH_RES_RDI_2) ||
+		(!csid_reg->rdi_reg[res->res_id])) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d Invalid res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_id);
+		return -EINVAL;
+	}
+
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_INIT_HW ||
+		res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID:%d Res:%d already in stopped state:%d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id, res->res_state);
+		return rc;
+	}
+
+	if (res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID:%d Res:%d Invalid res_state%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	if (stop_cmd != CAM_TFE_CSID_HALT_AT_FRAME_BOUNDARY &&
+		stop_cmd != CAM_TFE_CSID_HALT_IMMEDIATELY) {
+		CAM_ERR(CAM_ISP, "CSID:%d un supported stop command:%d",
+			csid_hw->hw_intf->hw_idx, stop_cmd);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id);
+
+	path_data->init_frame_drop = 0;
+	path_data->res_sof_cnt     = 0;
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_irq_mask_addr);
+
+	/* Halt the RDI path */
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+	val &= ~0x3;
+	val |= stop_cmd;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+
+	return rc;
+}
+
+static int cam_tfe_csid_poll_stop_status(
+	struct cam_tfe_csid_hw          *csid_hw,
+	uint32_t                         res_mask)
+{
+	int rc = 0;
+	uint32_t csid_status_addr = 0, val = 0, res_id = 0;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	for (; res_id < CAM_TFE_CSID_PATH_RES_MAX; res_id++, res_mask >>= 1) {
+		if ((res_mask & 0x1) == 0)
+			continue;
+		val = 0;
+
+		if (res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+			csid_status_addr =
+			csid_reg->ipp_reg->csid_pxl_status_addr;
+
+			if (csid_hw->ipp_res.res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING)
+				continue;
+
+		} else {
+			csid_status_addr =
+				csid_reg->rdi_reg[res_id]->csid_rdi_status_addr;
+
+			if (csid_hw->rdi_res[res_id].res_state !=
+				CAM_ISP_RESOURCE_STATE_STREAMING)
+				continue;
+
+		}
+
+		CAM_DBG(CAM_ISP, "start polling CSID:%d res_id:%d",
+			csid_hw->hw_intf->hw_idx, res_id);
+
+		rc = readl_poll_timeout(soc_info->reg_map[0].mem_base +
+			csid_status_addr, val, (val & 0x1) == 0x1,
+				CAM_TFE_CSID_TIMEOUT_SLEEP_US,
+				CAM_TFE_CSID_TIMEOUT_ALL_US);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "CSID:%d res:%d halt failed rc %d",
+				csid_hw->hw_intf->hw_idx, res_id, rc);
+			rc = -ETIMEDOUT;
+			break;
+		}
+		CAM_DBG(CAM_ISP, "End polling CSID:%d res_id:%d",
+			csid_hw->hw_intf->hw_idx, res_id);
+	}
+
+	return rc;
+}
+
+static int __cam_tfe_csid_read_timestamp(void __iomem *base,
+	uint32_t msb_offset, uint32_t lsb_offset, uint64_t *timestamp)
+{
+	uint32_t lsb, msb, tmp, torn = 0;
+
+	msb = cam_io_r_mb(base + msb_offset);
+	do {
+		tmp = msb;
+		torn++;
+		lsb = cam_io_r_mb(base + lsb_offset);
+		msb = cam_io_r_mb(base + msb_offset);
+	} while (tmp != msb);
+
+	*timestamp = msb;
+	*timestamp = (*timestamp << 32) | lsb;
+
+	return (torn > 1);
+}
+
+static int cam_tfe_csid_get_time_stamp(
+		struct cam_tfe_csid_hw   *csid_hw, void *cmd_args)
+{
+	struct cam_tfe_csid_get_time_stamp_args    *time_stamp;
+	struct cam_isp_resource_node               *res;
+	const struct cam_tfe_csid_reg_offset       *csid_reg;
+	struct cam_hw_soc_info                     *soc_info;
+	const struct cam_tfe_csid_rdi_reg_offset   *rdi_reg;
+	struct timespec64 ts;
+	uint32_t  id, torn;
+	uint64_t  time_delta;
+
+	time_stamp = (struct cam_tfe_csid_get_time_stamp_args  *)cmd_args;
+	res = time_stamp->node_res;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+		torn = __cam_tfe_csid_read_timestamp(
+			soc_info->reg_map[0].mem_base,
+			csid_reg->ipp_reg->csid_pxl_timestamp_curr1_sof_addr,
+			csid_reg->ipp_reg->csid_pxl_timestamp_curr0_sof_addr,
+			&time_stamp->time_stamp_val);
+	} else {
+		id = res->res_id;
+		rdi_reg = csid_reg->rdi_reg[id];
+		torn = __cam_tfe_csid_read_timestamp(
+			soc_info->reg_map[0].mem_base,
+			rdi_reg->csid_rdi_timestamp_curr1_sof_addr,
+			rdi_reg->csid_rdi_timestamp_curr0_sof_addr,
+			&time_stamp->time_stamp_val);
+	}
+
+	time_stamp->time_stamp_val = mul_u64_u32_div(
+		time_stamp->time_stamp_val,
+		CAM_TFE_CSID_QTIMER_MUL_FACTOR,
+		CAM_TFE_CSID_QTIMER_DIV_FACTOR);
+
+	if (!csid_hw->prev_boot_timestamp) {
+		ktime_get_boottime_ts64(&ts);
+		time_stamp->boot_timestamp =
+			(uint64_t)((ts.tv_sec * 1000000000) +
+			ts.tv_nsec);
+		csid_hw->prev_qtimer_ts = 0;
+		CAM_DBG(CAM_ISP, "timestamp:%lld",
+			time_stamp->boot_timestamp);
+	} else {
+		time_delta = time_stamp->time_stamp_val -
+			csid_hw->prev_qtimer_ts;
+
+		if (csid_hw->prev_boot_timestamp >
+			U64_MAX - time_delta) {
+			CAM_WARN(CAM_ISP, "boottimestamp overflowed");
+			CAM_INFO(CAM_ISP,
+			"currQTimer %lx prevQTimer %lx prevBootTimer %lx torn %d",
+				time_stamp->time_stamp_val,
+				csid_hw->prev_qtimer_ts,
+				csid_hw->prev_boot_timestamp, torn);
+			return -EINVAL;
+		}
+
+		time_stamp->boot_timestamp =
+			csid_hw->prev_boot_timestamp + time_delta;
+	}
+
+	CAM_DBG(CAM_ISP,
+	"currQTimer %lx prevQTimer %lx currBootTimer %lx prevBootTimer %lx torn %d",
+		time_stamp->time_stamp_val,
+		csid_hw->prev_qtimer_ts, time_stamp->boot_timestamp,
+		csid_hw->prev_boot_timestamp, torn);
+
+	csid_hw->prev_qtimer_ts = time_stamp->time_stamp_val;
+	csid_hw->prev_boot_timestamp = time_stamp->boot_timestamp;
+
+	return 0;
+}
+
+static int cam_tfe_csid_set_csid_debug(struct cam_tfe_csid_hw   *csid_hw,
+	void *cmd_args)
+{
+	uint32_t  *csid_debug;
+
+	csid_debug = (uint32_t  *) cmd_args;
+	csid_hw->csid_debug = *csid_debug;
+	CAM_DBG(CAM_ISP, "CSID:%d set csid debug value:%d",
+		csid_hw->hw_intf->hw_idx, csid_hw->csid_debug);
+
+	return 0;
+}
+
+static int cam_tfe_csid_get_hw_caps(void *hw_priv,
+	void *get_hw_cap_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw_caps           *hw_caps;
+	struct cam_tfe_csid_hw                *csid_hw;
+	struct cam_hw_info                    *csid_hw_info;
+	const struct cam_tfe_csid_reg_offset  *csid_reg;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	hw_caps = (struct cam_tfe_csid_hw_caps *) get_hw_cap_args;
+
+	hw_caps->num_rdis = csid_reg->cmn_reg->num_rdis;
+	hw_caps->num_pix = csid_hw->pxl_pipe_enable;
+	hw_caps->major_version = csid_reg->cmn_reg->major_version;
+	hw_caps->minor_version = csid_reg->cmn_reg->minor_version;
+	hw_caps->version_incr = csid_reg->cmn_reg->version_incr;
+
+	CAM_DBG(CAM_ISP,
+		"CSID:%d No rdis:%d, no pix:%d, major:%d minor:%d ver :%d",
+		csid_hw->hw_intf->hw_idx, hw_caps->num_rdis,
+		hw_caps->num_pix, hw_caps->major_version,
+		hw_caps->minor_version, hw_caps->version_incr);
+
+	return rc;
+}
+
+static int cam_tfe_csid_reset(void *hw_priv,
+	void *reset_args, uint32_t arg_size)
+{
+	struct cam_tfe_csid_hw          *csid_hw;
+	struct cam_hw_info              *csid_hw_info;
+	struct cam_tfe_csid_reset_cfg_args  *reset;
+	int rc = 0;
+
+	if (!hw_priv || !reset_args || (arg_size !=
+		sizeof(struct cam_tfe_csid_reset_cfg_args))) {
+		CAM_ERR(CAM_ISP, "CSID:Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	reset   = (struct cam_tfe_csid_reset_cfg_args  *)reset_args;
+
+	switch (reset->reset_type) {
+	case CAM_TFE_CSID_RESET_GLOBAL:
+		rc = cam_tfe_csid_global_reset(csid_hw);
+		break;
+	case CAM_TFE_CSID_RESET_PATH:
+		rc = cam_tfe_csid_path_reset(csid_hw, reset);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:Invalid reset type :%d",
+			reset->reset_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_reserve(void *hw_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw                    *csid_hw;
+	struct cam_hw_info                        *csid_hw_info;
+	struct cam_tfe_csid_hw_reserve_resource_args  *reserv;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_tfe_csid_hw_reserve_resource_args))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	reserv = (struct cam_tfe_csid_hw_reserve_resource_args  *)reserve_args;
+
+	if (reserv->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type :%d",
+			csid_hw->hw_intf->hw_idx, reserv->res_type);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "res_type %d, CSID: %u",
+		reserv->res_type, csid_hw->hw_intf->hw_idx);
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	rc = cam_tfe_csid_path_reserve(csid_hw, reserv);
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_tfe_csid_release(void *hw_priv,
+	void *release_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw          *csid_hw;
+	struct cam_hw_info              *csid_hw_info;
+	struct cam_isp_resource_node    *res;
+	struct cam_tfe_csid_path_cfg    *path_data;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	res = (struct cam_isp_resource_node *)release_args;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if ((res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX)) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	csid_hw->event_cb = NULL;
+	csid_hw->event_cb_priv = NULL;
+
+	if ((res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE) ||
+		(res->res_state >= CAM_ISP_RESOURCE_STATE_STREAMING)) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%d res type:%d Res %d in state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id,
+			res->res_state);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res type :%d Resource id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	path_data = (struct cam_tfe_csid_path_cfg *)res->res_priv;
+	if (csid_hw->cid_res[path_data->cid].cnt)
+		csid_hw->cid_res[path_data->cid].cnt--;
+
+	if (csid_hw->csi2_reserve_cnt)
+		csid_hw->csi2_reserve_cnt--;
+
+	if (!csid_hw->csi2_reserve_cnt)
+		memset(&csid_hw->csi2_rx_cfg, 0,
+			sizeof(struct cam_tfe_csid_csi2_rx_cfg));
+
+	CAM_DBG(CAM_ISP, "CSID:%d res id :%d cnt:%d reserv cnt:%d",
+		csid_hw->hw_intf->hw_idx,
+		res->res_id, csid_hw->cid_res[path_data->cid].cnt,
+		csid_hw->csi2_reserve_cnt);
+
+	res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	cam_tfe_csid_reset_path_data(csid_hw, res);
+
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_tfe_csid_reset_retain_sw_reg(
+	struct cam_tfe_csid_hw *csid_hw)
+{
+	int rc = 0;
+	uint32_t status;
+	const struct cam_tfe_csid_reg_offset *csid_reg =
+		csid_hw->csid_info->csid_reg;
+	struct cam_hw_soc_info          *soc_info;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	/* Mask top interrupts */
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_mask_addr);
+	/* clear the top interrupt first */
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	cam_io_w_mb(csid_reg->cmn_reg->csid_rst_stb,
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_rst_strobes_addr);
+	rc = readl_poll_timeout(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_status_addr,
+			status, (status & 0x1) == 0x1,
+		CAM_TFE_CSID_TIMEOUT_SLEEP_US, CAM_TFE_CSID_TIMEOUT_ALL_US);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d csid_reset fail rc = %d",
+			  csid_hw->hw_intf->hw_idx, rc);
+		status = cam_io_r(soc_info->reg_map[0].mem_base +
+			csid_reg->cmn_reg->csid_top_irq_status_addr);
+		CAM_DBG(CAM_ISP, "Status reg %d", status);
+	} else {
+		CAM_DBG(CAM_ISP, "CSID:%d hw reset completed %d",
+			csid_hw->hw_intf->hw_idx, rc);
+		rc = 0;
+	}
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+	return rc;
+}
+
+static int cam_tfe_csid_init_hw(void *hw_priv,
+	void *init_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw                 *csid_hw;
+	struct cam_hw_info                     *csid_hw_info;
+	struct cam_isp_resource_node           *res;
+	const struct cam_tfe_csid_reg_offset   *csid_reg;
+	unsigned long                           flags;
+
+	if (!hw_priv || !init_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	res      = (struct cam_isp_resource_node *)init_args;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if (res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res tpe:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((res->res_type == CAM_ISP_RESOURCE_PIX_PATH) &&
+		(res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED)) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d res type:%d res_id:%dInvalid state %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id, res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "CSID:%d res type :%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	/* Initialize the csid hardware */
+	rc = cam_tfe_csid_enable_hw(csid_hw);
+	if (rc)
+		goto end;
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+		rc = cam_tfe_csid_init_config_pxl_path(csid_hw, res);
+	else
+		rc = cam_tfe_csid_init_config_rdi_path(csid_hw, res);
+
+	rc = cam_tfe_csid_reset_retain_sw_reg(csid_hw);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "CSID: Failed in SW reset");
+
+	if (rc)
+		cam_tfe_csid_disable_hw(csid_hw);
+
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	csid_hw->device_enabled = 1;
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_tfe_csid_deinit_hw(void *hw_priv,
+	void *deinit_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw                 *csid_hw;
+	struct cam_hw_info                     *csid_hw_info;
+	struct cam_isp_resource_node           *res;
+
+	if (!hw_priv || !deinit_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID:Invalid arguments");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter");
+	res = (struct cam_isp_resource_node *)deinit_args;
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid Res type %d",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if (res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "CSID:%d Res:%d already in De-init state",
+			 csid_hw->hw_intf->hw_idx,
+			res->res_id);
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "De-Init IPP Path: %d", res->res_id);
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+		rc = cam_tfe_csid_deinit_pxl_path(csid_hw, res);
+	else
+		rc = cam_tfe_csid_deinit_rdi_path(csid_hw, res);
+
+	/* Disable CSID HW */
+	CAM_DBG(CAM_ISP, "Disabling CSID Hw");
+	cam_tfe_csid_disable_hw(csid_hw);
+	CAM_DBG(CAM_ISP, "%s: Exit", __func__);
+
+end:
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_tfe_csid_start(void *hw_priv, void *start_args,
+			uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw                 *csid_hw;
+	struct cam_hw_info                     *csid_hw_info;
+	struct cam_isp_resource_node           *res;
+	const struct cam_tfe_csid_reg_offset   *csid_reg;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	res = (struct cam_isp_resource_node *)start_args;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if (res->res_type == CAM_ISP_RESOURCE_PIX_PATH &&
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res tpe:%d res id:%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Reset sof irq debug fields */
+	csid_hw->sof_irq_triggered = false;
+	csid_hw->irq_debug_cnt = 0;
+
+	CAM_DBG(CAM_ISP, "CSID:%d res_type :%d res_id:%d",
+		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
+
+	switch (res->res_type) {
+	case CAM_ISP_RESOURCE_PIX_PATH:
+		if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+			rc = cam_tfe_csid_enable_pxl_path(csid_hw, res);
+		else
+			rc = cam_tfe_csid_enable_rdi_path(csid_hw, res);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type%d",
+			csid_hw->hw_intf->hw_idx, res->res_type);
+		break;
+	}
+end:
+	return rc;
+}
+
+int cam_tfe_csid_halt(struct cam_tfe_csid_hw *csid_hw,
+	void *halt_args)
+{
+	struct cam_isp_resource_node         *res;
+	struct cam_tfe_csid_hw_halt_args     *csid_halt;
+	int rc = 0;
+
+	if (!csid_hw || !halt_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_halt = (struct cam_tfe_csid_hw_halt_args *)halt_args;
+
+	/* Change the halt mode */
+	res = csid_halt->node_res;
+	CAM_DBG(CAM_ISP, "CSID:%d res_type %d res_id %d",
+		csid_hw->hw_intf->hw_idx,
+		res->res_type, res->res_id);
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid res type %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type);
+		return -EINVAL;
+	}
+
+	switch (res->res_id) {
+	case CAM_TFE_CSID_PATH_RES_IPP:
+		rc = cam_tfe_csid_change_pxl_halt_mode(csid_hw, csid_halt);
+		break;
+	default:
+		CAM_DBG(CAM_ISP, "CSID:%d res_id %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_id);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_stop(void *hw_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw               *csid_hw;
+	struct cam_hw_info                   *csid_hw_info;
+	struct cam_isp_resource_node         *res;
+	struct cam_tfe_csid_hw_stop_args     *csid_stop;
+	uint32_t  i;
+	uint32_t res_mask = 0;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_tfe_csid_hw_stop_args))) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+	csid_stop = (struct cam_tfe_csid_hw_stop_args  *) stop_args;
+
+	if (!csid_stop->num_res) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid args");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+	CAM_DBG(CAM_ISP, "CSID:%d num_res %d",
+		csid_hw->hw_intf->hw_idx,
+		csid_stop->num_res);
+
+	/* Stop the resource first */
+	for (i = 0; i < csid_stop->num_res; i++) {
+		res = csid_stop->node_res[i];
+		CAM_DBG(CAM_ISP, "CSID:%d res_type %d res_id %d",
+			csid_hw->hw_intf->hw_idx,
+			res->res_type, res->res_id);
+		switch (res->res_type) {
+		case CAM_ISP_RESOURCE_PIX_PATH:
+			res_mask |= (1 << res->res_id);
+			if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP)
+				rc = cam_tfe_csid_disable_pxl_path(csid_hw,
+					res, csid_stop->stop_cmd);
+			else
+				rc = cam_tfe_csid_disable_rdi_path(csid_hw,
+					res, csid_stop->stop_cmd);
+
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid res type%d",
+				csid_hw->hw_intf->hw_idx,
+				res->res_type);
+			break;
+		}
+	}
+
+	if (res_mask)
+		rc = cam_tfe_csid_poll_stop_status(csid_hw, res_mask);
+
+	for (i = 0; i < csid_stop->num_res; i++) {
+		res = csid_stop->node_res[i];
+		res->res_state = CAM_ISP_RESOURCE_STATE_INIT_HW;
+	}
+
+	CAM_DBG(CAM_ISP,  "%s: Exit", __func__);
+	return rc;
+}
+
+static int cam_tfe_csid_read(void *hw_priv,
+	void *read_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+	return -EINVAL;
+}
+
+static int cam_tfe_csid_write(void *hw_priv,
+	void *write_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "CSID: un supported");
+	return -EINVAL;
+}
+
+static int cam_tfe_csid_sof_irq_debug(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	int i = 0;
+	uint32_t val = 0;
+	bool sof_irq_enable = false;
+	const struct cam_tfe_csid_reg_offset    *csid_reg;
+	struct cam_hw_soc_info                  *soc_info;
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (*((uint32_t *)cmd_args) == 1)
+		sof_irq_enable = true;
+
+	if (csid_hw->hw_info->hw_state ==
+		CAM_HW_STATE_POWER_DOWN) {
+		CAM_WARN(CAM_ISP,
+			"CSID:%d powered down unable to %s sof irq",
+			csid_hw->hw_intf->hw_idx,
+			sof_irq_enable ? "enable" : "disable");
+		return 0;
+	}
+
+	if (csid_reg->ipp_reg) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+
+		if (val) {
+			if (sof_irq_enable)
+				val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+			else
+				val &= ~TFE_CSID_PATH_INFO_INPUT_SOF;
+
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_irq_mask_addr);
+			val = 0;
+		}
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_mask_addr);
+		if (val) {
+			if (sof_irq_enable)
+				val |= TFE_CSID_PATH_INFO_INPUT_SOF;
+			else
+				val &= ~TFE_CSID_PATH_INFO_INPUT_SOF;
+
+			cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_irq_mask_addr);
+			val = 0;
+		}
+	}
+
+	if (sof_irq_enable) {
+		csid_hw->csid_debug |= TFE_CSID_DEBUG_ENABLE_SOF_IRQ;
+		csid_hw->sof_irq_triggered = true;
+	} else {
+		csid_hw->csid_debug &= ~TFE_CSID_DEBUG_ENABLE_SOF_IRQ;
+		csid_hw->sof_irq_triggered = false;
+	}
+
+	if (!in_irq())
+		CAM_INFO(CAM_ISP, "SOF freeze: CSID:%d SOF irq %s",
+			csid_hw->hw_intf->hw_idx,
+			sof_irq_enable ? "enabled" : "disabled");
+
+	return 0;
+}
+
+static int cam_tfe_csid_set_csid_clock(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_tfe_csid_clock_update_args *clk_update = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	clk_update =
+		(struct cam_tfe_csid_clock_update_args *)cmd_args;
+
+	csid_hw->clk_rate = clk_update->clk_rate;
+	CAM_DBG(CAM_ISP, "CSID clock rate %llu", csid_hw->clk_rate);
+
+	return 0;
+}
+
+static int cam_tfe_csid_dump_csid_clock(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	if (!csid_hw)
+		return -EINVAL;
+
+	CAM_INFO(CAM_ISP, "CSID:%d clock rate %llu",
+		csid_hw->hw_intf->hw_idx,
+		csid_hw->clk_rate);
+
+	return 0;
+}
+
+static int cam_tfe_csid_get_csid_clock(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_hw_soc_info   *soc_info;
+	uint32_t                 *curr_clk_rate;
+	int                       src_clk_idx;
+	int rc = 0;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	src_clk_idx = soc_info->src_clk_idx;
+
+	curr_clk_rate = (uint32_t *)cmd_args;
+
+	rc = cam_soc_util_get_clk_rate(soc_info->clk[src_clk_idx],
+			soc_info->clk_name[src_clk_idx], curr_clk_rate);
+
+	CAM_DBG(CAM_ISP, "CSID clock rate %llu", *curr_clk_rate);
+
+	return rc;
+}
+
+static int cam_tfe_csid_set_csid_clock_dynamically(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	struct cam_hw_soc_info   *soc_info;
+	uint32_t                 *clk_rate;
+	int rc = 0;
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	clk_rate = (uint32_t *)cmd_args;
+
+	CAM_DBG(CAM_ISP, "CSID clock rate %lld", *clk_rate);
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, *clk_rate);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"unable to set clock dynamically rate:%lld", *clk_rate);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_get_regdump(struct cam_tfe_csid_hw *csid_hw,
+	void *cmd_args)
+{
+	struct cam_tfe_csid_reg_offset    *csid_reg;
+	struct cam_hw_soc_info            *soc_info;
+	struct cam_isp_resource_node      *res;
+	struct cam_tfe_csid_path_cfg      *path_data;
+	uint32_t id;
+	int val;
+
+	csid_reg = (struct cam_tfe_csid_reg_offset   *)
+			csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	res = (struct cam_isp_resource_node  *)cmd_args;
+	path_data = (struct cam_tfe_csid_path_cfg   *)res->res_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_PIX_PATH ||
+		res->res_id >= CAM_TFE_CSID_PATH_RES_MAX) {
+		CAM_DBG(CAM_ISP, "CSID:%d Invalid res_type:%d res id%d",
+			csid_hw->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid dev state :%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		return -EINVAL;
+	}
+
+	if (res->res_id == CAM_TFE_CSID_PATH_RES_IPP) {
+		CAM_INFO(CAM_ISP, "Dumping CSID:%d IPP registers ",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_cfg0_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_cfg0_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_cfg1_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_cfg1_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_ctrl_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_ctrl_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_hcrop_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_hcrop_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_vcrop_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->ipp_reg->csid_pxl_vcrop_addr, val);
+	} else {
+		id = res->res_id;
+		CAM_INFO(CAM_ISP, "Dumping CSID:%d RDI:%d registers ",
+			csid_hw->hw_intf->hw_idx, id);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_cfg1_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->rdi_reg[id]->csid_rdi_cfg1_addr, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr);
+		CAM_INFO(CAM_ISP, "offset 0x%x=0x08%x",
+			csid_reg->rdi_reg[id]->csid_rdi_ctrl_addr, val);
+	}
+	CAM_INFO(CAM_ISP,
+		"start pix:%d end pix:%d start line:%d end line:%d w:%d h:%d",
+		path_data->start_pixel, path_data->end_pixel,
+		path_data->start_line, path_data->end_line,
+		path_data->width, path_data->height);
+	CAM_INFO(CAM_ISP,
+		"clock:%d crop_enable:%d vc:%d dt:%d informat:%d outformat:%d",
+		path_data->clk_rate, path_data->crop_enable,
+		path_data->vc, path_data->dt,
+		path_data->in_format, path_data->out_format);
+
+	return 0;
+}
+
+static int cam_tfe_csid_dump_hw(
+	struct cam_tfe_csid_hw *csid_hw, void *cmd_args)
+{
+	int                             i;
+	uint8_t                        *dst;
+	uint32_t                       *addr, *start;
+	uint64_t                       *clk_addr, *clk_start;
+	uint32_t                        min_len;
+	uint32_t                        num_reg;
+	uint32_t                        reg_size = 0;
+	size_t                          remain_len;
+	struct cam_isp_hw_dump_header  *hdr;
+	struct cam_isp_hw_dump_args    *dump_args =
+		(struct cam_isp_hw_dump_args *)cmd_args;
+	struct cam_hw_soc_info         *soc_info;
+
+	if (!dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (!dump_args->cpu_addr || !dump_args->buf_len) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params %pK %zu",
+			(void *)dump_args->cpu_addr,
+			dump_args->buf_len);
+		return -EINVAL;
+	}
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ISP,
+			"Dump offset overshoot offset %zu buf_len %zu",
+			dump_args->offset, dump_args->buf_len);
+		return -ENOSPC;
+	}
+
+	soc_info = &csid_hw->hw_info->soc_info;
+	if (dump_args->is_dump_all)
+		reg_size = soc_info->reg_map[0].size;
+
+	min_len = reg_size +
+		sizeof(struct cam_isp_hw_dump_header) +
+		(sizeof(uint32_t) * CAM_TFE_CSID_DUMP_MISC_NUM_WORDS);
+	remain_len = dump_args->buf_len - dump_args->offset;
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu, min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+
+	mutex_lock(&csid_hw->hw_info->hw_mutex);
+	if (csid_hw->hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "CSID:%d Invalid HW State:%d",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->hw_info->hw_state);
+		mutex_unlock(&csid_hw->hw_info->hw_mutex);
+		return -EINVAL;
+	}
+
+	if (!dump_args->is_dump_all)
+		goto dump_bw;
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "CSID_REG:");
+	addr = (uint32_t *)(dst + sizeof(struct cam_isp_hw_dump_header));
+	start = addr;
+	num_reg = soc_info->reg_map[0].size/4;
+	hdr->word_size = sizeof(uint32_t);
+	*addr = soc_info->index;
+	addr++;
+
+	for (i = 0; i < num_reg; i++) {
+		addr[0] = soc_info->mem_block[0]->start + (i*4);
+		addr[1] = cam_io_r(soc_info->reg_map[0].mem_base
+			+ (i*4));
+		addr += 2;
+	}
+
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+dump_bw:
+	dst = (char *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "CSID_CLK_RATE:");
+	clk_addr = (uint64_t *)(dst +
+		sizeof(struct cam_isp_hw_dump_header));
+	clk_start = clk_addr;
+	hdr->word_size = sizeof(uint64_t);
+	*clk_addr++ = csid_hw->clk_rate;
+	hdr->size = hdr->word_size * (clk_addr - clk_start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+	CAM_DBG(CAM_ISP, "offset %zu", dump_args->offset);
+	mutex_unlock(&csid_hw->hw_info->hw_mutex);
+	return 0;
+}
+
+static int cam_tfe_csid_log_acquire_data(
+	struct cam_tfe_csid_hw   *csid_hw,  void *cmd_args)
+{
+	struct cam_isp_resource_node  *res =
+		(struct cam_isp_resource_node *)cmd_args;
+	struct cam_tfe_csid_path_cfg       *path_data;
+	struct cam_hw_soc_info                         *soc_info;
+	const struct cam_tfe_csid_reg_offset           *csid_reg;
+	uint32_t byte_cnt_ping, byte_cnt_pong;
+
+	path_data = (struct cam_tfe_csid_path_cfg *)res->res_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+
+	if (res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP,
+			"CSID:%d invalid res id:%d res type: %d state:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id, res->res_type,
+			res->res_state);
+		return -EINVAL;
+	}
+
+	/* Dump all the acquire data for this  */
+	CAM_INFO(CAM_ISP,
+		"CSID:%d res id:%d type:%d state:%d in f:%d out f:%d st pix:%d end pix:%d st line:%d end line:%d",
+		csid_hw->hw_intf->hw_idx, res->res_id, res->res_type,
+		res->res_type, path_data->in_format, path_data->out_format,
+		path_data->start_pixel, path_data->end_pixel,
+		path_data->start_line, path_data->end_line);
+
+	if (res->res_id >= CAM_TFE_CSID_PATH_RES_RDI_0  &&
+		res->res_id <= CAM_TFE_CSID_PATH_RES_RDI_2) {
+		/* read total number of bytes transmitted through RDI */
+		byte_cnt_ping = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[res->res_id]->csid_rdi_byte_cntr_ping_addr);
+		byte_cnt_pong = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[res->res_id]->csid_rdi_byte_cntr_pong_addr);
+		CAM_INFO(CAM_ISP,
+			"CSID:%d res id:%d byte cnt val ping:%d pong:%d",
+			csid_hw->hw_intf->hw_idx, res->res_id,
+			byte_cnt_ping, byte_cnt_pong);
+	}
+
+	return 0;
+
+}
+
+static int cam_tfe_csid_process_cmd(void *hw_priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_tfe_csid_hw               *csid_hw;
+	struct cam_hw_info                   *csid_hw_info;
+
+	if (!hw_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid arguments");
+		return -EINVAL;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *)hw_priv;
+	csid_hw = (struct cam_tfe_csid_hw   *)csid_hw_info->core_info;
+
+	switch (cmd_type) {
+	case CAM_TFE_CSID_CMD_GET_TIME_STAMP:
+		rc = cam_tfe_csid_get_time_stamp(csid_hw, cmd_args);
+		break;
+	case CAM_TFE_CSID_SET_CSID_DEBUG:
+		rc = cam_tfe_csid_set_csid_debug(csid_hw, cmd_args);
+		break;
+	case CAM_TFE_CSID_SOF_IRQ_DEBUG:
+		rc = cam_tfe_csid_sof_irq_debug(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CLOCK_UPDATE:
+		rc = cam_tfe_csid_set_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CLOCK_DUMP:
+		rc = cam_tfe_csid_dump_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_TFE_CSID_CMD_GET_REG_DUMP:
+		rc = cam_tfe_csid_get_regdump(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_HW:
+		rc = cam_tfe_csid_dump_hw(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CSID_CHANGE_HALT_MODE:
+		rc = cam_tfe_csid_halt(csid_hw, cmd_args);
+		break;
+	case CAM_TFE_CSID_LOG_ACQUIRE_DATA:
+		rc = cam_tfe_csid_log_acquire_data(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_GET_CLOCK_RATE:
+		rc = cam_tfe_csid_get_csid_clock(csid_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DYNAMIC_CLOCK_UPDATE:
+		rc = cam_tfe_csid_set_csid_clock_dynamically(csid_hw, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "CSID:%d unsupported cmd:%d",
+			csid_hw->hw_intf->hw_idx, cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_tfe_csid_get_evt_payload(
+	struct cam_tfe_csid_hw *csid_hw,
+	struct cam_csid_evt_payload **evt_payload)
+{
+
+	spin_lock(&csid_hw->spin_lock);
+
+	if (list_empty(&csid_hw->free_payload_list)) {
+		*evt_payload = NULL;
+		spin_unlock(&csid_hw->spin_lock);
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -ENOMEM;
+	}
+
+	*evt_payload = list_first_entry(&csid_hw->free_payload_list,
+			struct cam_csid_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	spin_unlock(&csid_hw->spin_lock);
+
+	return 0;
+}
+
+static int cam_tfe_csid_put_evt_payload(
+	struct cam_tfe_csid_hw *csid_hw,
+	struct cam_csid_evt_payload **evt_payload)
+{
+	unsigned long flags;
+
+	if (*evt_payload == NULL) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return -EINVAL;
+	}
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list,
+		&csid_hw->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+
+	return 0;
+}
+
+static int cam_tfe_csid_evt_bottom_half_handler(
+	void *handler_priv,
+	void *evt_payload_priv)
+{
+	struct cam_tfe_csid_hw *csid_hw;
+	struct cam_csid_evt_payload *evt_payload;
+	const struct cam_tfe_csid_reg_offset    *csid_reg;
+	struct cam_isp_hw_event_info event_info;
+	int i;
+	int rc = 0;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid Param handler_priv %pK evt_payload_priv %pK",
+			handler_priv, evt_payload_priv);
+		return 0;
+	}
+
+	csid_hw = (struct cam_tfe_csid_hw *)handler_priv;
+	evt_payload = (struct cam_csid_evt_payload *)evt_payload_priv;
+	csid_reg = csid_hw->csid_info->csid_reg;
+
+	if (!csid_hw->event_cb || !csid_hw->event_cb_priv) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"hw_idx %d Invalid args %pK %pK",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->event_cb,
+			csid_hw->event_cb_priv);
+		goto end;
+	}
+
+	if (csid_hw->event_cb_priv != evt_payload->priv) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"hw_idx %d priv mismatch %pK, %pK",
+			csid_hw->hw_intf->hw_idx,
+			csid_hw->event_cb_priv,
+			evt_payload->priv);
+		goto end;
+	}
+
+	if (csid_hw->sof_irq_triggered && (evt_payload->evt_type ==
+		CAM_ISP_HW_ERROR_NONE)) {
+		if (evt_payload->irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_INFO_INPUT_SOF) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP SOF received",
+				csid_hw->hw_intf->hw_idx);
+		}
+
+		for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+			if (evt_payload->irq_status[i] &
+				TFE_CSID_PATH_INFO_INPUT_SOF)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"CSID:%d RDI:%d SOF received",
+					csid_hw->hw_intf->hw_idx, i);
+		}
+	} else {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID %d err %d phy %d irq status TOP: 0x%x RX: 0x%x IPP: 0x%x RDI0: 0x%x RDI1: 0x%x RDI2: 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			evt_payload->evt_type,
+			csid_hw->csi2_rx_cfg.phy_sel,
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_TOP],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_RX],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_IPP],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_RDI0],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_RDI1],
+			evt_payload->irq_status[TFE_CSID_IRQ_REG_RDI2]);
+	}
+	/* this hunk can be extended to handle more cases
+	 * which we want to offload to bottom half from
+	 * irq handlers
+	 */
+	event_info.err_type = evt_payload->evt_type;
+	event_info.hw_idx = evt_payload->hw_idx;
+
+	switch (evt_payload->evt_type) {
+	case CAM_ISP_HW_ERROR_CSID_FATAL:
+		if (csid_hw->fatal_err_detected)
+			break;
+		csid_hw->fatal_err_detected = true;
+		rc = csid_hw->event_cb(NULL,
+			CAM_ISP_HW_EVENT_ERROR, (void *)&event_info);
+		break;
+
+	default:
+		CAM_DBG(CAM_ISP, "CSID[%d] error type %d",
+			csid_hw->hw_intf->hw_idx,
+			evt_payload->evt_type);
+		break;
+	}
+end:
+	cam_tfe_csid_put_evt_payload(csid_hw, &evt_payload);
+	return 0;
+}
+
+static int cam_tfe_csid_handle_hw_err_irq(
+	struct cam_tfe_csid_hw *csid_hw,
+	int                     evt_type,
+	uint32_t               *irq_status)
+{
+	int      rc = 0;
+	int      i;
+	void    *bh_cmd = NULL;
+	struct cam_csid_evt_payload *evt_payload;
+
+	CAM_DBG(CAM_ISP, "CSID[%d] error %d",
+		csid_hw->hw_intf->hw_idx, evt_type);
+
+	rc = cam_tfe_csid_get_evt_payload(csid_hw, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No free payload core %d",
+			csid_hw->hw_intf->hw_idx);
+		return rc;
+	}
+
+	rc = tasklet_bh_api.get_bh_payload_func(csid_hw->tasklet, &bh_cmd);
+	if (rc || !bh_cmd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"CSID[%d] Can not get cmd for tasklet, evt_type %d",
+			csid_hw->hw_intf->hw_idx,
+			evt_type);
+		return rc;
+	}
+
+	evt_payload->evt_type = evt_type;
+	evt_payload->priv = csid_hw->event_cb_priv;
+	evt_payload->hw_idx = csid_hw->hw_intf->hw_idx;
+
+	for (i = 0; i < TFE_CSID_IRQ_REG_MAX; i++)
+		evt_payload->irq_status[i] = irq_status[i];
+
+	tasklet_bh_api.bottom_half_enqueue_func(csid_hw->tasklet,
+		bh_cmd,
+		csid_hw,
+		evt_payload,
+		cam_tfe_csid_evt_bottom_half_handler);
+
+	return rc;
+}
+
+irqreturn_t cam_tfe_csid_irq(int irq_num, void *data)
+{
+	struct cam_tfe_csid_hw                         *csid_hw;
+	struct cam_hw_soc_info                         *soc_info;
+	const struct cam_tfe_csid_reg_offset           *csid_reg;
+	const struct cam_tfe_csid_csi2_rx_reg_offset   *csi2_reg;
+	uint32_t                   irq_status[TFE_CSID_IRQ_REG_MAX];
+	bool fatal_err_detected = false, is_error_irq = false;
+	uint32_t sof_irq_debug_en = 0, log_en = 0;
+	unsigned long flags;
+	uint32_t i, val;
+
+	if (!data) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid arguments");
+		return IRQ_HANDLED;
+	}
+
+	csid_hw = (struct cam_tfe_csid_hw *)data;
+	CAM_DBG(CAM_ISP, "CSID %d IRQ Handling", csid_hw->hw_intf->hw_idx);
+
+	csid_reg = csid_hw->csid_info->csid_reg;
+	soc_info = &csid_hw->hw_info->soc_info;
+	csi2_reg = csid_reg->csi2_reg;
+
+	/* read */
+	irq_status[TFE_CSID_IRQ_REG_TOP] =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_status_addr);
+
+	irq_status[TFE_CSID_IRQ_REG_RX] =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_status_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		irq_status[TFE_CSID_IRQ_REG_IPP] =
+			cam_io_r_mb(soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_irq_status_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++)
+		irq_status[i] =
+		cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		csid_reg->rdi_reg[i]->csid_rdi_irq_status_addr);
+
+	/* clear */
+	cam_io_w_mb(irq_status[TFE_CSID_IRQ_REG_TOP],
+		soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_top_irq_clear_addr);
+
+	cam_io_w_mb(irq_status[TFE_CSID_IRQ_REG_RX],
+		soc_info->reg_map[0].mem_base +
+		csid_reg->csi2_reg->csid_csi2_rx_irq_clear_addr);
+
+	if (csid_hw->pxl_pipe_enable)
+		cam_io_w_mb(irq_status[TFE_CSID_IRQ_REG_IPP],
+			soc_info->reg_map[0].mem_base +
+			csid_reg->ipp_reg->csid_pxl_irq_clear_addr);
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+		cam_io_w_mb(irq_status[i],
+			soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[i]->csid_rdi_irq_clear_addr);
+	}
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		csid_reg->cmn_reg->csid_irq_cmd_addr);
+
+
+	/* Software register reset complete*/
+	if (irq_status[TFE_CSID_IRQ_REG_TOP])
+		complete(&csid_hw->csid_top_complete);
+
+	if (irq_status[TFE_CSID_IRQ_REG_RX] &
+		BIT(csid_reg->csi2_reg->csi2_rst_done_shift_val))
+		complete(&csid_hw->csid_csi2_complete);
+
+	spin_lock_irqsave(&csid_hw->spin_lock, flags);
+	if (csid_hw->device_enabled == 1) {
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_LANE0_FIFO_OVERFLOW) {
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_LANE1_FIFO_OVERFLOW) {
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_LANE2_FIFO_OVERFLOW) {
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_LANE3_FIFO_OVERFLOW) {
+			fatal_err_detected = true;
+			goto handle_fatal_error;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION)
+			csid_hw->error_irq_count++;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_CPHY_SOT_RECEPTION)
+			csid_hw->error_irq_count++;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_STREAM_UNDERFLOW)
+			csid_hw->error_irq_count++;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_UNBOUNDED_FRAME)
+			csid_hw->error_irq_count++;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_CRC)
+			is_error_irq = true;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_ECC)
+			is_error_irq = true;
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_ERROR_MMAPPED_VC_DT)
+			is_error_irq = true;
+	}
+handle_fatal_error:
+	spin_unlock_irqrestore(&csid_hw->spin_lock, flags);
+
+	if (csid_hw->error_irq_count || fatal_err_detected)
+		is_error_irq = true;
+
+	if (csid_hw->error_irq_count >
+		CAM_TFE_CSID_MAX_IRQ_ERROR_COUNT) {
+		fatal_err_detected = true;
+		csid_hw->error_irq_count = 0;
+	}
+
+	if (fatal_err_detected) {
+		/* Reset the Rx CFG registers */
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_cfg0_addr);
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_cfg1_addr);
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			csid_reg->csi2_reg->csid_csi2_rx_irq_mask_addr);
+		/* phy_sel starts from 1 and should never be zero*/
+		if (csid_hw->csi2_rx_cfg.phy_sel > 0) {
+			cam_subdev_notify_message(CAM_CSIPHY_DEVICE_TYPE,
+				CAM_SUBDEV_MESSAGE_IRQ_ERR,
+				(csid_hw->csi2_rx_cfg.phy_sel - 1));
+		}
+		cam_tfe_csid_handle_hw_err_irq(csid_hw,
+			CAM_ISP_HW_ERROR_CSID_FATAL, irq_status);
+	}
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOT_IRQ) {
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL0_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL1_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL2_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL3_EOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+	}
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOT_IRQ) {
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL0_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL1_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL2_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d PHY_DL3_SOT_CAPTURED",
+				csid_hw->hw_intf->hw_idx);
+		}
+	}
+
+	if ((csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE) &&
+		(irq_status[TFE_CSID_IRQ_REG_RX] &
+		TFE_CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d LONG_PKT_CAPTURED",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_0_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d long packet VC :%d DT:%d WC:%d",
+			csid_hw->hw_intf->hw_idx,
+			(val >> 22), ((val >> 16) & 0x3F), (val & 0xFFFF));
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_1_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d long packet ECC :%d",
+			csid_hw->hw_intf->hw_idx, val);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_long_pkt_ftr_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d long pkt cal CRC:%d expected CRC:%d",
+			csid_hw->hw_intf->hw_idx, (val >> 16), (val & 0xFFFF));
+		/* reset long pkt strobe to capture next long packet */
+		val = (1 << csi2_reg->csi2_rx_long_pkt_hdr_rst_stb_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_rst_strobes_addr);
+	}
+	if ((csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE) &&
+		(irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d SHORT_PKT_CAPTURED",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_short_pkt_0_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d short pkt VC :%d DT:%d LC:%d",
+			csid_hw->hw_intf->hw_idx,
+			(val >> 22), ((val >> 16) & 0x1F), (val & 0xFFFF));
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_short_pkt_1_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d short packet ECC :%d",
+			csid_hw->hw_intf->hw_idx, val);
+		/* reset short pkt strobe to capture next short packet */
+		val = (1 << csi2_reg->csi2_rx_short_pkt_hdr_rst_stb_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_rst_strobes_addr);
+	}
+
+	if ((csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE) &&
+		(irq_status[TFE_CSID_IRQ_REG_RX] &
+			TFE_CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED)) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d CPHY_PKT_HDR_CAPTURED",
+			csid_hw->hw_intf->hw_idx);
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_captured_cphy_pkt_hdr_addr);
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d cphy packet VC :%d DT:%d WC:%d",
+			csid_hw->hw_intf->hw_idx,
+			(val >> 22), ((val >> 16) & 0x1F), (val & 0xFFFF));
+		/* reset cphy pkt strobe to capture next short packet */
+		val = (1 << csi2_reg->csi2_rx_cphy_pkt_hdr_rst_stb_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			csi2_reg->csid_csi2_rx_rst_strobes_addr);
+	}
+
+	if (csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_RST_IRQ_LOG) {
+
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID IPP reset complete");
+
+		if (irq_status[TFE_CSID_IRQ_REG_TOP])
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID TOP reset complete");
+
+		if (irq_status[TFE_CSID_IRQ_REG_RX] &
+			BIT(csid_reg->csi2_reg->csi2_rst_done_shift_val))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID RX reset complete");
+	}
+
+	/* read the IPP errors */
+	if (csid_hw->pxl_pipe_enable) {
+		/* IPP reset done bit */
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) {
+			CAM_DBG(CAM_ISP, "CSID IPP reset complete");
+			complete(&csid_hw->csid_ipp_complete);
+		}
+
+		if ((irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_INFO_INPUT_SOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			if (!csid_hw->sof_irq_triggered)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d IPP SOF received",
+					csid_hw->hw_intf->hw_idx);
+			else
+				log_en = 1;
+
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
+
+		if ((irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_INFO_INPUT_EOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d IPP EOF received",
+				csid_hw->hw_intf->hw_idx);
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_ERROR_FIFO_OVERFLOW) {
+			/* Stop IPP path immediately */
+			cam_io_w_mb(CAM_TFE_CSID_HALT_IMMEDIATELY,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->ipp_reg->csid_pxl_ctrl_addr);
+			is_error_irq = true;
+		}
+
+		if (irq_status[TFE_CSID_IRQ_REG_IPP] &
+			TFE_CSID_PATH_IPP_ERROR_CCIF_VIOLATION)
+			is_error_irq = true;
+
+	}
+
+	for (i = 0; i < csid_reg->cmn_reg->num_rdis; i++) {
+
+		if ((irq_status[i] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) &&
+			(csid_hw->csid_debug &
+			TFE_CSID_DEBUG_ENABLE_RST_IRQ_LOG))
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RDI%d reset complete",
+				csid_hw->hw_intf->hw_idx, i);
+
+		if (irq_status[i] &
+			BIT(csid_reg->cmn_reg->path_rst_done_shift_val)) {
+			CAM_DBG(CAM_ISP, "CSID:%d RDI%d reset complete",
+				csid_hw->hw_intf->hw_idx, i);
+			complete(&csid_hw->csid_rdin_complete[i]);
+		}
+
+		if (irq_status[i] & TFE_CSID_PATH_INFO_INPUT_SOF)
+			cam_tfe_csid_enable_path_for_init_frame_drop(csid_hw, i);
+
+		if ((irq_status[i] & TFE_CSID_PATH_INFO_INPUT_SOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			if (!csid_hw->sof_irq_triggered)
+				CAM_INFO_RATE_LIMIT(CAM_ISP,
+					"CSID:%d RDI:%d SOF received",
+					csid_hw->hw_intf->hw_idx, i);
+			else
+				log_en = 1;
+
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
+
+		if ((irq_status[i] & TFE_CSID_PATH_INFO_INPUT_EOF) &&
+			(csid_hw->csid_debug & TFE_CSID_DEBUG_ENABLE_EOF_IRQ)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
+				"CSID:%d RDI:%d EOF received",
+				csid_hw->hw_intf->hw_idx, i);
+		}
+
+		if (irq_status[i] & TFE_CSID_PATH_ERROR_FIFO_OVERFLOW) {
+			/* Stop RDI path immediately */
+			is_error_irq = true;
+			cam_io_w_mb(CAM_TFE_CSID_HALT_IMMEDIATELY,
+				soc_info->reg_map[0].mem_base +
+				csid_reg->rdi_reg[i]->csid_rdi_ctrl_addr);
+		}
+
+		if ((irq_status[i] & TFE_CSID_PATH_RDI_OVERFLOW_IRQ) ||
+			(irq_status[i] &
+				 TFE_CSID_PATH_RDI_ERROR_CCIF_VIOLATION))
+			is_error_irq = true;
+	}
+
+	if (is_error_irq || log_en) {
+		CAM_ERR(CAM_ISP,
+			"CSID %d irq status TOP: 0x%x RX: 0x%x IPP: 0x%x",
+			csid_hw->hw_intf->hw_idx,
+			irq_status[TFE_CSID_IRQ_REG_TOP],
+			irq_status[TFE_CSID_IRQ_REG_RX],
+			irq_status[TFE_CSID_IRQ_REG_IPP]);
+		CAM_ERR(CAM_ISP,
+			"RDI0: 0x%x RDI1: 0x%x RDI2: 0x%x CSID clk:%d",
+			irq_status[TFE_CSID_IRQ_REG_RDI0],
+			irq_status[TFE_CSID_IRQ_REG_RDI1],
+			irq_status[TFE_CSID_IRQ_REG_RDI2],
+			csid_hw->clk_rate);
+
+		cam_tfe_csid_handle_hw_err_irq(csid_hw,
+			CAM_ISP_HW_ERROR_NONE, irq_status);
+	}
+
+	if (csid_hw->irq_debug_cnt >= CAM_TFE_CSID_IRQ_SOF_DEBUG_CNT_MAX) {
+		cam_tfe_csid_sof_irq_debug(csid_hw, &sof_irq_debug_en);
+		csid_hw->irq_debug_cnt = 0;
+	}
+
+	CAM_DBG(CAM_ISP, "IRQ Handling exit");
+	return IRQ_HANDLED;
+}
+
+int cam_tfe_csid_hw_probe_init(struct cam_hw_intf  *csid_hw_intf,
+	uint32_t csid_idx)
+{
+	int rc = -EINVAL;
+	uint32_t i, val, clk_lvl;
+	struct cam_tfe_csid_path_cfg         *path_data;
+	struct cam_hw_info                   *csid_hw_info;
+	struct cam_tfe_csid_hw               *tfe_csid_hw = NULL;
+	const struct cam_tfe_csid_reg_offset *csid_reg;
+
+	if (csid_idx >= CAM_TFE_CSID_HW_NUM_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid csid index:%d", csid_idx);
+		return rc;
+	}
+
+	csid_hw_info = (struct cam_hw_info  *) csid_hw_intf->hw_priv;
+	tfe_csid_hw  = (struct cam_tfe_csid_hw  *) csid_hw_info->core_info;
+
+	tfe_csid_hw->hw_intf = csid_hw_intf;
+	tfe_csid_hw->hw_info = csid_hw_info;
+	csid_reg = tfe_csid_hw->csid_info->csid_reg;
+
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		tfe_csid_hw->hw_intf->hw_type, csid_idx);
+
+	tfe_csid_hw->device_enabled = 0;
+	tfe_csid_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&tfe_csid_hw->hw_info->hw_mutex);
+	spin_lock_init(&tfe_csid_hw->hw_info->hw_lock);
+	spin_lock_init(&tfe_csid_hw->spin_lock);
+	init_completion(&tfe_csid_hw->hw_info->hw_complete);
+
+	init_completion(&tfe_csid_hw->csid_top_complete);
+	init_completion(&tfe_csid_hw->csid_csi2_complete);
+	init_completion(&tfe_csid_hw->csid_ipp_complete);
+	for (i = 0; i < CAM_TFE_CSID_RDI_MAX; i++)
+		init_completion(&tfe_csid_hw->csid_rdin_complete[i]);
+
+	rc = cam_tfe_csid_init_soc_resources(&tfe_csid_hw->hw_info->soc_info,
+			cam_tfe_csid_irq, tfe_csid_hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d Failed to init_soc", csid_idx);
+		goto err;
+	}
+	rc = cam_soc_util_get_clk_level(&tfe_csid_hw->hw_info->soc_info,
+		tfe_csid_hw->clk_rate,
+		tfe_csid_hw->hw_info->soc_info.src_clk_idx, &clk_lvl);
+	CAM_DBG(CAM_ISP, "CSID clock lvl %u", clk_lvl);
+
+	rc = cam_tfe_csid_enable_soc_resources(&tfe_csid_hw->hw_info->soc_info,
+		clk_lvl);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d Enable SOC failed",
+			tfe_csid_hw->hw_intf->hw_idx);
+		goto err;
+	}
+
+	tfe_csid_hw->hw_intf->hw_ops.get_hw_caps = cam_tfe_csid_get_hw_caps;
+	tfe_csid_hw->hw_intf->hw_ops.init        = cam_tfe_csid_init_hw;
+	tfe_csid_hw->hw_intf->hw_ops.deinit      = cam_tfe_csid_deinit_hw;
+	tfe_csid_hw->hw_intf->hw_ops.reset       = cam_tfe_csid_reset;
+	tfe_csid_hw->hw_intf->hw_ops.reserve     = cam_tfe_csid_reserve;
+	tfe_csid_hw->hw_intf->hw_ops.release     = cam_tfe_csid_release;
+	tfe_csid_hw->hw_intf->hw_ops.start       = cam_tfe_csid_start;
+	tfe_csid_hw->hw_intf->hw_ops.stop        = cam_tfe_csid_stop;
+	tfe_csid_hw->hw_intf->hw_ops.read        = cam_tfe_csid_read;
+	tfe_csid_hw->hw_intf->hw_ops.write       = cam_tfe_csid_write;
+	tfe_csid_hw->hw_intf->hw_ops.process_cmd = cam_tfe_csid_process_cmd;
+
+	/* reset the cid values */
+	for (i = 0; i < CAM_TFE_CSID_CID_MAX; i++) {
+		tfe_csid_hw->cid_res[i].vc  = 0;
+		tfe_csid_hw->cid_res[i].dt  = 0;
+		tfe_csid_hw->cid_res[i].cnt = 0;
+	}
+
+	if (tfe_csid_hw->hw_intf->hw_idx == 2) {
+		val = cam_io_r_mb(
+			tfe_csid_hw->hw_info->soc_info.reg_map[1].mem_base +
+			csid_reg->cmn_reg->top_tfe2_fuse_reg);
+		if (val) {
+			CAM_INFO(CAM_ISP, "TFE 2 is not supported by hardware");
+
+			rc = cam_tfe_csid_disable_soc_resources(
+				&tfe_csid_hw->hw_info->soc_info);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"CSID:%d Disable CSID SOC failed",
+					tfe_csid_hw->hw_intf->hw_idx);
+			else
+				rc = -EINVAL;
+			goto err;
+		}
+	}
+
+	val = cam_io_r_mb(
+		tfe_csid_hw->hw_info->soc_info.reg_map[1].mem_base +
+		csid_reg->cmn_reg->top_tfe2_pix_pipe_fuse_reg);
+
+	/* Initialize the IPP resources */
+	if (!(val && (tfe_csid_hw->hw_intf->hw_idx == 2))) {
+		CAM_DBG(CAM_ISP, "initializing the pix path");
+
+		tfe_csid_hw->ipp_res.res_type = CAM_ISP_RESOURCE_PIX_PATH;
+		tfe_csid_hw->ipp_res.res_id = CAM_TFE_CSID_PATH_RES_IPP;
+		tfe_csid_hw->ipp_res.res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		tfe_csid_hw->ipp_res.hw_intf = tfe_csid_hw->hw_intf;
+		path_data = kzalloc(sizeof(*path_data),
+					GFP_KERNEL);
+		if (!path_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		tfe_csid_hw->ipp_res.res_priv = path_data;
+		tfe_csid_hw->pxl_pipe_enable = 1;
+	}
+
+	/* Initialize the RDI resource */
+	for (i = 0; i < tfe_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis;
+			i++) {
+		/* res type is from RDI 0 to RDI2 */
+		tfe_csid_hw->rdi_res[i].res_type =
+			CAM_ISP_RESOURCE_PIX_PATH;
+		tfe_csid_hw->rdi_res[i].res_id = i;
+		tfe_csid_hw->rdi_res[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		tfe_csid_hw->rdi_res[i].hw_intf = tfe_csid_hw->hw_intf;
+
+		path_data = kzalloc(sizeof(*path_data),
+			GFP_KERNEL);
+		if (!path_data) {
+			rc = -ENOMEM;
+			goto err;
+		}
+		tfe_csid_hw->rdi_res[i].res_priv = path_data;
+	}
+
+	rc = cam_tasklet_init(&tfe_csid_hw->tasklet, tfe_csid_hw, csid_idx);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Unable to create CSID tasklet rc %d", rc);
+		goto err;
+	}
+
+	INIT_LIST_HEAD(&tfe_csid_hw->free_payload_list);
+	for (i = 0; i < CAM_CSID_EVT_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&tfe_csid_hw->evt_payload[i].list);
+		list_add_tail(&tfe_csid_hw->evt_payload[i].list,
+			&tfe_csid_hw->free_payload_list);
+	}
+
+	tfe_csid_hw->csid_debug = 0;
+	tfe_csid_hw->error_irq_count = 0;
+	tfe_csid_hw->prev_boot_timestamp = 0;
+
+	rc = cam_tfe_csid_disable_soc_resources(
+		&tfe_csid_hw->hw_info->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CSID:%d Disable CSID SOC failed",
+			tfe_csid_hw->hw_intf->hw_idx);
+		goto err;
+	}
+
+	/* Check if ppi bridge is present or not? */
+	tfe_csid_hw->ppi_enable = of_property_read_bool(
+		csid_hw_info->soc_info.pdev->dev.of_node,
+		"ppi-enable");
+
+	if (!tfe_csid_hw->ppi_enable)
+		return 0;
+
+	/* Initialize the PPI bridge */
+	for (i = 0; i < CAM_CSID_PPI_HW_MAX; i++) {
+		rc = cam_csid_ppi_hw_init(&tfe_csid_hw->ppi_hw_intf[i], i);
+		if (rc < 0) {
+			CAM_INFO(CAM_ISP, "PPI init failed for PPI %d", i);
+			rc = 0;
+			break;
+		}
+	}
+
+	return 0;
+err:
+	if (rc) {
+		kfree(tfe_csid_hw->ipp_res.res_priv);
+		for (i = 0; i <
+			tfe_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis;
+			i++)
+			kfree(tfe_csid_hw->rdi_res[i].res_priv);
+	}
+
+	return rc;
+}
+
+
+int cam_tfe_csid_hw_deinit(struct cam_tfe_csid_hw *tfe_csid_hw)
+{
+	int rc = -EINVAL;
+	uint32_t i;
+
+	if (!tfe_csid_hw) {
+		CAM_ERR(CAM_ISP, "Invalid param");
+		return rc;
+	}
+
+	/* release the privdate data memory from resources */
+	kfree(tfe_csid_hw->ipp_res.res_priv);
+
+	for (i = 0; i <
+		tfe_csid_hw->csid_info->csid_reg->cmn_reg->num_rdis;
+		i++) {
+		kfree(tfe_csid_hw->rdi_res[i].res_priv);
+	}
+
+	cam_tfe_csid_deinit_soc_resources(&tfe_csid_hw->hw_info->soc_info);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_core.h
@@ -0,0 +1,465 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_HW_H_
+#define _CAM_TFE_CSID_HW_H_
+
+#include "cam_hw.h"
+#include "cam_tfe_csid_hw_intf.h"
+#include "cam_tfe_csid_soc.h"
+#include "cam_csid_ppi_core.h"
+
+#define CAM_TFE_CSID_CID_MAX                          4
+
+/* Each word is taken as uint32_t, for dumping uint64_t count as 2 words
+ * 1. soc_index
+ * 2. clk_rate --> uint64_t -> 2 words
+ */
+#define CAM_TFE_CSID_DUMP_MISC_NUM_WORDS              3
+
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED    BIT(0)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED    BIT(1)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED    BIT(2)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED    BIT(3)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED    BIT(4)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED    BIT(5)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED    BIT(6)
+#define TFE_CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED    BIT(7)
+#define TFE_CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED       BIT(8)
+#define TFE_CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED      BIT(9)
+#define TFE_CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED   BIT(10)
+#define TFE_CSID_CSI2_RX_ERROR_CPHY_EOT_RECEPTION     BIT(11)
+#define TFE_CSID_CSI2_RX_ERROR_CPHY_SOT_RECEPTION     BIT(12)
+#define TFE_CSID_CSI2_RX_ERROR_CPHY_PH_CRC            BIT(13)
+#define TFE_CSID_CSI2_RX_WARNING_ECC                  BIT(14)
+#define TFE_CSID_CSI2_RX_ERROR_LANE0_FIFO_OVERFLOW    BIT(15)
+#define TFE_CSID_CSI2_RX_ERROR_LANE1_FIFO_OVERFLOW    BIT(16)
+#define TFE_CSID_CSI2_RX_ERROR_LANE2_FIFO_OVERFLOW    BIT(17)
+#define TFE_CSID_CSI2_RX_ERROR_LANE3_FIFO_OVERFLOW    BIT(18)
+#define TFE_CSID_CSI2_RX_ERROR_CRC                    BIT(19)
+#define TFE_CSID_CSI2_RX_ERROR_ECC                    BIT(20)
+#define TFE_CSID_CSI2_RX_ERROR_MMAPPED_VC_DT          BIT(21)
+#define TFE_CSID_CSI2_RX_ERROR_UNMAPPED_VC_DT         BIT(22)
+#define TFE_CSID_CSI2_RX_ERROR_STREAM_UNDERFLOW       BIT(23)
+#define TFE_CSID_CSI2_RX_ERROR_UNBOUNDED_FRAME        BIT(24)
+#define TFE_CSID_CSI2_RX_INFO_RST_DONE                BIT(27)
+
+#define TFE_CSID_PATH_INFO_RST_DONE                   BIT(1)
+#define TFE_CSID_PATH_ERROR_FIFO_OVERFLOW             BIT(2)
+#define TFE_CSID_PATH_INFO_INPUT_EOF                  BIT(9)
+#define TFE_CSID_PATH_INFO_INPUT_EOL                  BIT(10)
+#define TFE_CSID_PATH_INFO_INPUT_SOL                  BIT(11)
+#define TFE_CSID_PATH_INFO_INPUT_SOF                  BIT(12)
+#define TFE_CSID_PATH_IPP_ERROR_CCIF_VIOLATION        BIT(15)
+#define TFE_CSID_PATH_IPP_OVERFLOW_IRQ                BIT(16)
+#define TFE_CSID_PATH_IPP_FRAME_DROP                  BIT(17)
+#define TFE_CSID_PATH_RDI_FRAME_DROP                  BIT(16)
+#define TFE_CSID_PATH_RDI_OVERFLOW_IRQ                BIT(17)
+#define TFE_CSID_PATH_RDI_ERROR_CCIF_VIOLATION        BIT(18)
+
+/*
+ * Debug values enable the corresponding interrupts and debug logs provide
+ * necessary information
+ */
+#define TFE_CSID_DEBUG_ENABLE_SOF_IRQ                 BIT(0)
+#define TFE_CSID_DEBUG_ENABLE_EOF_IRQ                 BIT(1)
+#define TFE_CSID_DEBUG_ENABLE_SOT_IRQ                 BIT(2)
+#define TFE_CSID_DEBUG_ENABLE_EOT_IRQ                 BIT(3)
+#define TFE_CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE       BIT(4)
+#define TFE_CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE        BIT(5)
+#define TFE_CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE        BIT(6)
+#define TFE_CSID_DEBUG_ENABLE_HBI_VBI_INFO            BIT(7)
+#define TFE_CSID_DEBUG_DISABLE_EARLY_EOF              BIT(8)
+#define TFE_CSID_DEBUG_ENABLE_RST_IRQ_LOG             BIT(9)
+
+#define CAM_CSID_EVT_PAYLOAD_MAX                  10
+
+/* enum cam_csid_path_halt_mode select the path halt mode control */
+enum cam_tfe_csid_path_halt_mode {
+	TFE_CSID_HALT_MODE_INTERNAL,
+	TFE_CSID_HALT_MODE_GLOBAL,
+	TFE_CSID_HALT_MODE_MASTER,
+	TFE_CSID_HALT_MODE_SLAVE,
+};
+
+/**
+ *enum cam_csid_path_timestamp_stb_sel - select the sof/eof strobes used to
+ *        capture the timestamp
+ */
+enum cam_tfe_csid_path_timestamp_stb_sel {
+	TFE_CSID_TIMESTAMP_STB_PRE_HALT,
+	TFE_CSID_TIMESTAMP_STB_POST_HALT,
+	TFE_CSID_TIMESTAMP_STB_POST_IRQ,
+	TFE_CSID_TIMESTAMP_STB_MAX,
+};
+
+struct cam_tfe_csid_pxl_reg_offset {
+	/* Pxl path register offsets*/
+	uint32_t csid_pxl_irq_status_addr;
+	uint32_t csid_pxl_irq_mask_addr;
+	uint32_t csid_pxl_irq_clear_addr;
+	uint32_t csid_pxl_irq_set_addr;
+
+	uint32_t csid_pxl_cfg0_addr;
+	uint32_t csid_pxl_cfg1_addr;
+	uint32_t csid_pxl_ctrl_addr;
+	uint32_t csid_pxl_hcrop_addr;
+	uint32_t csid_pxl_vcrop_addr;
+	uint32_t csid_pxl_rst_strobes_addr;
+	uint32_t csid_pxl_status_addr;
+	uint32_t csid_pxl_misr_val_addr;
+	uint32_t csid_pxl_timestamp_curr0_sof_addr;
+	uint32_t csid_pxl_timestamp_curr1_sof_addr;
+	uint32_t csid_pxl_timestamp_perv0_sof_addr;
+	uint32_t csid_pxl_timestamp_perv1_sof_addr;
+	uint32_t csid_pxl_timestamp_curr0_eof_addr;
+	uint32_t csid_pxl_timestamp_curr1_eof_addr;
+	uint32_t csid_pxl_timestamp_perv0_eof_addr;
+	uint32_t csid_pxl_timestamp_perv1_eof_addr;
+	uint32_t csid_pxl_err_recovery_cfg0_addr;
+	uint32_t csid_pxl_err_recovery_cfg1_addr;
+	uint32_t csid_pxl_err_recovery_cfg2_addr;
+
+	/* configuration */
+	uint32_t pix_store_en_shift_val;
+	uint32_t early_eof_en_shift_val;
+	uint32_t halt_master_sel_shift;
+	uint32_t halt_mode_shift;
+	uint32_t halt_master_sel_master_val;
+	uint32_t halt_master_sel_slave_val;
+};
+
+struct cam_tfe_csid_rdi_reg_offset {
+	uint32_t csid_rdi_irq_status_addr;
+	uint32_t csid_rdi_irq_mask_addr;
+	uint32_t csid_rdi_irq_clear_addr;
+	uint32_t csid_rdi_irq_set_addr;
+
+	/*RDI N register address */
+	uint32_t csid_rdi_cfg0_addr;
+	uint32_t csid_rdi_cfg1_addr;
+	uint32_t csid_rdi_ctrl_addr;
+	uint32_t csid_rdi_rst_strobes_addr;
+	uint32_t csid_rdi_status_addr;
+	uint32_t csid_rdi_misr_val0_addr;
+	uint32_t csid_rdi_misr_val1_addr;
+	uint32_t csid_rdi_timestamp_curr0_sof_addr;
+	uint32_t csid_rdi_timestamp_curr1_sof_addr;
+	uint32_t csid_rdi_timestamp_prev0_sof_addr;
+	uint32_t csid_rdi_timestamp_prev1_sof_addr;
+	uint32_t csid_rdi_timestamp_curr0_eof_addr;
+	uint32_t csid_rdi_timestamp_curr1_eof_addr;
+	uint32_t csid_rdi_timestamp_prev0_eof_addr;
+	uint32_t csid_rdi_timestamp_prev1_eof_addr;
+	uint32_t csid_rdi_err_recovery_cfg0_addr;
+	uint32_t csid_rdi_err_recovery_cfg1_addr;
+	uint32_t csid_rdi_err_recovery_cfg2_addr;
+	uint32_t csid_rdi_byte_cntr_ping_addr;
+	uint32_t csid_rdi_byte_cntr_pong_addr;
+
+	/* configuration */
+	uint32_t packing_format;
+};
+
+struct cam_tfe_csid_csi2_rx_reg_offset {
+	uint32_t csid_csi2_rx_irq_status_addr;
+	uint32_t csid_csi2_rx_irq_mask_addr;
+	uint32_t csid_csi2_rx_irq_clear_addr;
+	uint32_t csid_csi2_rx_irq_set_addr;
+	uint32_t csid_csi2_rx_cfg0_addr;
+	uint32_t csid_csi2_rx_cfg1_addr;
+	uint32_t csid_csi2_rx_capture_ctrl_addr;
+	uint32_t csid_csi2_rx_rst_strobes_addr;
+	uint32_t csid_csi2_rx_cap_unmap_long_pkt_hdr_0_addr;
+	uint32_t csid_csi2_rx_cap_unmap_long_pkt_hdr_1_addr;
+	uint32_t csid_csi2_rx_captured_short_pkt_0_addr;
+	uint32_t csid_csi2_rx_captured_short_pkt_1_addr;
+	uint32_t csid_csi2_rx_captured_long_pkt_0_addr;
+	uint32_t csid_csi2_rx_captured_long_pkt_1_addr;
+	uint32_t csid_csi2_rx_captured_long_pkt_ftr_addr;
+	uint32_t csid_csi2_rx_captured_cphy_pkt_hdr_addr;
+	uint32_t csid_csi2_rx_total_pkts_rcvd_addr;
+	uint32_t csid_csi2_rx_stats_ecc_addr; //no
+	uint32_t csid_csi2_rx_total_crc_err_addr;
+
+	/*configurations */
+	uint32_t phy_sel_base;
+	uint32_t csi2_rst_srb_all;
+	uint32_t csi2_rst_done_shift_val;
+	uint32_t csi2_irq_mask_all;
+	uint32_t csi2_misr_enable_shift_val;
+	uint32_t csi2_vc_mode_shift_val;
+	uint32_t csi2_capture_long_pkt_en_shift;
+	uint32_t csi2_capture_short_pkt_en_shift;
+	uint32_t csi2_capture_cphy_pkt_en_shift;
+	uint32_t csi2_capture_long_pkt_dt_shift;
+	uint32_t csi2_capture_long_pkt_vc_shift;
+	uint32_t csi2_capture_short_pkt_vc_shift;
+	uint32_t csi2_capture_cphy_pkt_dt_shift;
+	uint32_t csi2_capture_cphy_pkt_vc_shift;
+	uint32_t csi2_rx_phy_num_mask;
+	uint32_t csi2_rx_long_pkt_hdr_rst_stb_shift;
+	uint32_t csi2_rx_short_pkt_hdr_rst_stb_shift;
+	uint32_t csi2_rx_cphy_pkt_hdr_rst_stb_shift;
+};
+
+struct cam_tfe_csid_common_reg_offset {
+	/* MIPI CSID registers */
+	uint32_t csid_hw_version_addr;
+	uint32_t csid_cfg0_addr;
+	uint32_t csid_ctrl_addr;
+	uint32_t csid_rst_strobes_addr;
+
+	uint32_t csid_test_bus_ctrl_addr;
+	uint32_t csid_top_irq_status_addr;
+	uint32_t csid_top_irq_mask_addr;
+	uint32_t csid_top_irq_clear_addr;
+	uint32_t csid_top_irq_set_addr;
+	uint32_t csid_irq_cmd_addr;
+
+	/*configurations */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t num_rdis;
+	uint32_t num_pix;
+	uint32_t csid_reg_rst_stb;
+	uint32_t csid_rst_stb;
+	uint32_t csid_rst_stb_sw_all;
+	uint32_t ipp_path_rst_stb_all;
+	uint32_t rdi_path_rst_stb_all;
+	uint32_t path_rst_done_shift_val;
+	uint32_t path_en_shift_val;
+	uint32_t dt_id_shift_val;
+	uint32_t vc_shift_val;
+	uint32_t dt_shift_val;
+	uint32_t fmt_shift_val;
+	uint32_t plain_fmt_shit_val;
+	uint32_t crop_v_en_shift_val;
+	uint32_t crop_h_en_shift_val;
+	uint32_t crop_shift;
+	uint32_t ipp_irq_mask_all;
+	uint32_t rdi_irq_mask_all;
+	uint32_t top_tfe2_pix_pipe_fuse_reg;
+	uint32_t top_tfe2_fuse_reg;
+};
+
+/**
+ * struct cam_tfe_csid_reg_offset- CSID instance register info
+ *
+ * @cmn_reg:  csid common registers info
+ * @ipp_reg:  ipp register offset information
+ * @ppp_reg:  ppp register offset information
+ * @rdi_reg:  rdi register offset information
+ *
+ */
+struct cam_tfe_csid_reg_offset {
+	const struct cam_tfe_csid_common_reg_offset   *cmn_reg;
+	const struct cam_tfe_csid_csi2_rx_reg_offset  *csi2_reg;
+	const struct cam_tfe_csid_pxl_reg_offset      *ipp_reg;
+	const struct cam_tfe_csid_rdi_reg_offset *rdi_reg[CAM_TFE_CSID_RDI_MAX];
+};
+
+/**
+ * struct cam_tfe_csid_hw_info- CSID HW info
+ *
+ * @csid_reg:        csid register offsets
+ * @hw_dts_version:  HW DTS version
+ * @csid_max_clk:    maximim csid clock
+ *
+ */
+struct cam_tfe_csid_hw_info {
+	const struct cam_tfe_csid_reg_offset   *csid_reg;
+	uint32_t                                hw_dts_version;
+	uint32_t                                csid_max_clk;
+};
+
+/**
+ * struct cam_tfe_csid_csi2_rx_cfg- csid csi2 rx configuration data
+ * @phy_sel:     input resource type for sensor only
+ * @lane_type:   lane type: c-phy or d-phy
+ * @lane_num :   active lane number
+ * @lane_cfg:    lane configurations: 4 bits per lane
+ *
+ */
+struct cam_tfe_csid_csi2_rx_cfg  {
+	uint32_t                        phy_sel;
+	uint32_t                        lane_type;
+	uint32_t                        lane_num;
+	uint32_t                        lane_cfg;
+};
+
+/**
+ * struct cam_tfe_csid_cid_data- cid configuration private data
+ *
+ * @vc:          Virtual channel
+ * @dt:          Data type
+ * @cnt:         Cid resource reference count.
+ *
+ */
+struct cam_tfe_csid_cid_data {
+	uint32_t                     vc;
+	uint32_t                     dt;
+	uint32_t                     cnt;
+};
+
+/**
+ * struct cam_tfe_csid_path_cfg- csid path configuration details. It is stored
+ *                          as private data for IPP/ RDI paths
+ * @vc :            Virtual channel number
+ * @dt :            Data type number
+ * @cid             cid number, it is same as DT_ID number in HW
+ * @in_format:      input decode format
+ * @out_format:     output format
+ * @crop_enable:    crop is enable or disabled, if enabled
+ *                  then remaining parameters are valid.
+ * @start_pixel:    start pixel
+ * @end_pixel:      end_pixel
+ * @width:          width
+ * @start_line:     start line
+ * @end_line:       end_line
+ * @height:         heigth
+ * @sync_mode:      Applicable for IPP/RDI path reservation
+ *                  Reserving the path for master IPP or slave IPP
+ *                  master (set value 1), Slave ( set value 2)
+ *                  for RDI, set  mode to none
+ * @master_idx:     For Slave reservation, Give master TFE instance Index.
+ *                  Slave will synchronize with master Start and stop operations
+ * @clk_rate        Clock rate
+ * @sensor_width    Sensor width in pixel
+ * @sensor_height   Sensor height in pixel
+ * @sensor_fps      Sensor fps
+ * @sensor_hbi      Sensor horizontal blanking interval
+ * @sensor_vbi      Sensor vertical blanking interval
+ * @usage_type:     dual or single tfe information
+ * @init_frame_drop init frame drop value. In dual ife case rdi need to drop one
+ *                  more frame than pix.
+ * @res_sof_cnt     path resource sof count value. it used for initial
+ *                  frame drop
+
+ */
+struct cam_tfe_csid_path_cfg {
+	uint32_t                        vc;
+	uint32_t                        dt;
+	uint32_t                        cid;
+	uint32_t                        in_format;
+	uint32_t                        out_format;
+	bool                            crop_enable;
+	uint32_t                        start_pixel;
+	uint32_t                        end_pixel;
+	uint32_t                        width;
+	uint32_t                        start_line;
+	uint32_t                        end_line;
+	uint32_t                        height;
+	enum cam_isp_hw_sync_mode       sync_mode;
+	uint32_t                        master_idx;
+	uint64_t                        clk_rate;
+	uint32_t                        sensor_width;
+	uint32_t                        sensor_height;
+	uint32_t                        sensor_fps;
+	uint32_t                        sensor_hbi;
+	uint32_t                        sensor_vbi;
+	uint32_t                        usage_type;
+	uint32_t                        init_frame_drop;
+	uint32_t                        res_sof_cnt;
+};
+
+/**
+ * struct cam_csid_evt_payload- payload for csid hw event
+ * @list       : list head
+ * @evt_type   : Event type from CSID
+ * @irq_status : IRQ Status register
+ * @hw_idx     : Hw index
+ * @priv       : Private data of payload
+ */
+struct cam_csid_evt_payload {
+	struct list_head   list;
+	uint32_t           evt_type;
+	uint32_t           irq_status[TFE_CSID_IRQ_REG_MAX];
+	uint32_t           hw_idx;
+	void              *priv;
+};
+
+/**
+ * struct cam_tfe_csid_hw- csid hw device resources data
+ *
+ * @hw_intf:                  contain the csid hw interface information
+ * @hw_info:                  csid hw device information
+ * @csid_info:                csid hw specific information
+ * @tasklet:                  tasklet to handle csid errors
+ * @free_payload_list:        list head for payload
+ * @evt_payload:              Event payload to be passed to tasklet
+ * @in_res_id:                csid in resource type
+ * @csi2_rx_cfg:              csi2 rx decoder configuration for csid
+ * @csi2_rx_reserve_cnt:      csi2 reservations count value
+ * @ipp_res:                  image pixel path resource
+ * @rdi_res:                  raw dump image path resources
+ * @cid_res:                  cid resources values
+ * @csid_top_reset_complete:  csid top reset completion
+ * @csid_csi2_reset_complete: csi2 reset completion
+ * @csid_ipp_reset_complete:  ipp reset completion
+ * @csid_ppp_complete:        ppp reset completion
+ * @csid_rdin_reset_complete: rdi n completion
+ * @csid_debug:               csid debug information to enable the SOT, EOT,
+ *                            SOF, EOF, measure etc in the csid hw
+ * @clk_rate                  Clock rate
+ * @sof_irq_triggered:        Flag is set on receiving event to enable sof irq
+ *                            incase of SOF freeze.
+ * @irq_debug_cnt:            Counter to track sof irq's when above flag is set.
+ * @error_irq_count           Error IRQ count, if continuous error irq comes
+ *                            need to stop the CSID and mask interrupts.
+ * @device_enabled            Device enabled will set once CSID powered on and
+ *                            initial configuration are done.
+ * @lock_state                csid spin lock
+ * @fatal_err_detected        flag to indicate fatal errror is reported
+ * @event_cb:                 Callback function to hw mgr in case of hw events
+ * @event_cb_priv:            Context data
+ * @ppi_hw_intf               interface to ppi hardware
+ * @ppi_enabled               flag to specify if the hardware has ppi bridge
+ *                            or not
+ * @prev_boot_timestamp       previous frame bootime stamp
+ * @prev_qtimer_ts            previous frame qtimer csid timestamp
+ *
+ */
+struct cam_tfe_csid_hw {
+	struct cam_hw_intf                 *hw_intf;
+	struct cam_hw_info                 *hw_info;
+	struct cam_tfe_csid_hw_info        *csid_info;
+	void                               *tasklet;
+	struct list_head                    free_payload_list;
+	struct cam_csid_evt_payload   evt_payload[CAM_CSID_EVT_PAYLOAD_MAX];
+	uint32_t                            in_res_id;
+	struct cam_tfe_csid_csi2_rx_cfg     csi2_rx_cfg;
+	uint32_t                            csi2_reserve_cnt;
+	uint32_t                            pxl_pipe_enable;
+	struct cam_isp_resource_node        ipp_res;
+	struct cam_isp_resource_node        rdi_res[CAM_TFE_CSID_RDI_MAX];
+	struct cam_tfe_csid_cid_data        cid_res[CAM_TFE_CSID_CID_MAX];
+	struct completion                   csid_top_complete;
+	struct completion                   csid_csi2_complete;
+	struct completion                   csid_ipp_complete;
+	struct completion     csid_rdin_complete[CAM_TFE_CSID_RDI_MAX];
+	uint64_t                            csid_debug;
+	uint64_t                            clk_rate;
+	bool                                sof_irq_triggered;
+	uint32_t                            irq_debug_cnt;
+	uint32_t                            error_irq_count;
+	uint32_t                            device_enabled;
+	spinlock_t                          spin_lock;
+	bool                                fatal_err_detected;
+	cam_hw_mgr_event_cb_func            event_cb;
+	void                               *event_cb_priv;
+	struct cam_hw_intf                 *ppi_hw_intf[CAM_CSID_PPI_HW_MAX];
+	bool                                ppi_enable;
+	uint64_t                            prev_boot_timestamp;
+	uint64_t                            prev_qtimer_ts;
+};
+
+int cam_tfe_csid_hw_probe_init(struct cam_hw_intf  *csid_hw_intf,
+	uint32_t csid_idx);
+
+int cam_tfe_csid_hw_deinit(struct cam_tfe_csid_hw *tfe_csid_hw);
+
+#endif /* _CAM_TFE_CSID_HW_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.c
@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include "cam_tfe_csid_core.h"
+#include "cam_tfe_csid_dev.h"
+#include "cam_tfe_csid_hw_intf.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_hw_intf *cam_tfe_csid_hw_list[CAM_TFE_CSID_HW_NUM_MAX] = {
+	0, 0, 0};
+
+static char csid_dev_name[8];
+
+static int cam_tfe_csid_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+
+	struct cam_hw_intf             *csid_hw_intf;
+	struct cam_hw_info             *csid_hw_info;
+	struct cam_tfe_csid_hw         *csid_dev = NULL;
+	const struct of_device_id      *match_dev = NULL;
+	struct cam_tfe_csid_hw_info    *csid_hw_data = NULL;
+	uint32_t                        csid_dev_idx;
+	int                             rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ISP, "probe called");
+
+	csid_hw_intf = kzalloc(sizeof(*csid_hw_intf), GFP_KERNEL);
+	if (!csid_hw_intf) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	csid_hw_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!csid_hw_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	csid_dev = kzalloc(sizeof(struct cam_tfe_csid_hw), GFP_KERNEL);
+	if (!csid_dev) {
+		rc = -ENOMEM;
+		goto free_hw_info;
+	}
+
+	/* get tfe csid hw index */
+	of_property_read_u32(pdev->dev.of_node, "cell-index", &csid_dev_idx);
+	/* get tfe csid hw information */
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "No matching table for the tfe csid hw");
+		rc = -EINVAL;
+		goto free_dev;
+	}
+
+	memset(csid_dev_name, 0, sizeof(csid_dev_name));
+	snprintf(csid_dev_name, sizeof(csid_dev_name),
+		"csid%1u", csid_dev_idx);
+
+	csid_hw_intf->hw_idx = csid_dev_idx;
+	csid_hw_intf->hw_type = CAM_ISP_HW_TYPE_TFE_CSID;
+	csid_hw_intf->hw_priv = csid_hw_info;
+
+	csid_hw_info->core_info = csid_dev;
+	csid_hw_info->soc_info.pdev = pdev;
+	csid_hw_info->soc_info.dev = &pdev->dev;
+	csid_hw_info->soc_info.dev_name = csid_dev_name;
+	csid_hw_info->soc_info.index = csid_dev_idx;
+
+	csid_hw_data = (struct cam_tfe_csid_hw_info  *)match_dev->data;
+	/* need to setup the pdev before call the tfe hw probe init */
+	csid_dev->csid_info = csid_hw_data;
+
+	rc = cam_tfe_csid_hw_probe_init(csid_hw_intf, csid_dev_idx);
+	if (rc)
+		goto free_dev;
+
+	platform_set_drvdata(pdev, csid_dev);
+	CAM_DBG(CAM_ISP, "CSID:%d probe successful",
+		csid_hw_intf->hw_idx);
+
+	if (csid_hw_intf->hw_idx < CAM_TFE_CSID_HW_NUM_MAX)
+		cam_tfe_csid_hw_list[csid_hw_intf->hw_idx] = csid_hw_intf;
+	else
+		goto free_dev;
+
+	return 0;
+
+free_dev:
+	kfree(csid_dev);
+free_hw_info:
+	kfree(csid_hw_info);
+free_hw_intf:
+	kfree(csid_hw_intf);
+err:
+	return rc;
+}
+
+void cam_tfe_csid_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_tfe_csid_hw         *csid_dev = NULL;
+	struct cam_hw_intf             *csid_hw_intf;
+	struct cam_hw_info             *csid_hw_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	csid_dev = (struct cam_tfe_csid_hw *)platform_get_drvdata(pdev);
+	csid_hw_intf = csid_dev->hw_intf;
+	csid_hw_info = csid_dev->hw_info;
+
+	CAM_DBG(CAM_ISP, "CSID:%d remove",
+		csid_dev->hw_intf->hw_idx);
+
+	cam_tfe_csid_hw_deinit(csid_dev);
+
+	/*release the csid device memory */
+	kfree(csid_dev);
+	kfree(csid_hw_info);
+	kfree(csid_hw_intf);
+}
+
+const static struct component_ops cam_tfe_csid_component_ops = {
+	.bind = cam_tfe_csid_component_bind,
+	.unbind = cam_tfe_csid_component_unbind,
+};
+
+int cam_tfe_csid_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	rc = component_add(&pdev->dev, &cam_tfe_csid_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_tfe_csid_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_tfe_csid_component_ops);
+	return 0;
+}
+
+int cam_tfe_csid_hw_init(struct cam_hw_intf **tfe_csid_hw,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_tfe_csid_hw_list[hw_idx]) {
+		*tfe_csid_hw = cam_tfe_csid_hw_list[hw_idx];
+	} else {
+		*tfe_csid_hw = NULL;
+		rc = -1;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_dev.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_DEV_H_
+#define _CAM_TFE_CSID_DEV_H_
+
+#include "cam_isp_hw.h"
+
+irqreturn_t cam_tfe_csid_irq(int irq_num, void *data);
+
+int cam_tfe_csid_probe(struct platform_device *pdev);
+int cam_tfe_csid_remove(struct platform_device *pdev);
+
+#endif /*_CAM_TFE_CSID_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.c
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+#include <linux/slab.h>
+#include "cam_tfe_csid_soc.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+
+
+int cam_tfe_csid_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler, void *irq_data)
+{
+	int rc = 0;
+	struct cam_cpas_register_params   cpas_register_param;
+	struct cam_tfe_csid_soc_private      *soc_private;
+
+	soc_private = kzalloc(sizeof(struct cam_tfe_csid_soc_private),
+		GFP_KERNEL);
+	if (!soc_private)
+		return -ENOMEM;
+
+	soc_info->soc_private = soc_private;
+
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	/* Need to see if we want post process the clock list */
+	rc = cam_soc_util_request_platform_resource(soc_info, csid_irq_handler,
+		irq_data);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Error Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "csid",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	} else {
+		soc_private->cpas_handle = cpas_register_param.client_handle;
+	}
+
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_tfe_csid_deinit_soc_resources(
+	struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPAS unregistration failed rc=%d", rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+
+	return rc;
+}
+
+int cam_tfe_csid_enable_soc_resources(
+	struct cam_hw_soc_info *soc_info, enum cam_vote_level clk_level)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_SVS_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	CAM_DBG(CAM_ISP, "csid camnoc_bw:%lld mnoc_ab_bw:%lld mnoc_ib_bw:%lld ",
+		axi_vote.axi_path[0].camnoc_bw,
+		axi_vote.axi_path[0].mnoc_ab_bw,
+		axi_vote.axi_path[0].mnoc_ib_bw);
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS start failed");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		clk_level, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "enable platform failed");
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_tfe_csid_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Disable platform failed");
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_tfe_csid_enable_tfe_force_clock_on(struct cam_hw_soc_info  *soc_info,
+	uint32_t cpas_tfe_base_offset)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+	uint32_t                           cpass_tfe_force_clk_offset;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+
+	soc_private = soc_info->soc_private;
+	cpass_tfe_force_clk_offset =
+		cpas_tfe_base_offset + (0x4 * soc_info->index);
+	rc = cam_cpas_reg_write(soc_private->cpas_handle, CAM_CPAS_REG_CPASTOP,
+		cpass_tfe_force_clk_offset, 1, 1);
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPASS set TFE:%d Force clock On failed",
+			soc_info->index);
+	else
+		CAM_DBG(CAM_ISP, "CPASS set TFE:%d Force clock On",
+		soc_info->index);
+
+	return rc;
+}
+
+int cam_tfe_csid_disable_tfe_force_clock_on(struct cam_hw_soc_info *soc_info,
+	uint32_t cpas_tfe_base_offset)
+{
+	int rc = 0;
+	struct cam_tfe_csid_soc_private       *soc_private;
+	uint32_t                           cpass_tfe_force_clk_offset;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+
+	soc_private = soc_info->soc_private;
+	cpass_tfe_force_clk_offset =
+		cpas_tfe_base_offset + (0x4 * soc_info->index);
+	rc = cam_cpas_reg_write(soc_private->cpas_handle, CAM_CPAS_REG_CPASTOP,
+		cpass_tfe_force_clk_offset,  1, 0);
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPASS set TFE:%d Force clock Off failed",
+			soc_info->index);
+	else
+		CAM_DBG(CAM_ISP, "CPASS set TFE:%d Force clock off",
+		soc_info->index);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_csid_hw/cam_tfe_csid_soc.h
@@ -0,0 +1,119 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_CSID_SOC_H_
+#define _CAM_TFE_CSID_SOC_H_
+
+#include "cam_isp_hw.h"
+
+/*
+ * struct cam_csid_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to CSID HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ */
+struct cam_tfe_csid_soc_private {
+	uint32_t cpas_handle;
+};
+
+/**
+ * struct csid_device_soc_info - CSID SOC info object
+ *
+ * @csi_vdd_voltage:       Csi vdd voltage value
+ *
+ */
+struct cam_tfe_csid_device_soc_info {
+	int                             csi_vdd_voltage;
+};
+
+/**
+ * cam_tfe_csid_init_soc_resources()
+ *
+ * @brief:                 Csid initialization function for the soc info
+ *
+ * @soc_info:              Soc info structure pointer
+ * @csid_irq_handler:      Irq handler function to be registered
+ * @irq_data:              Irq data for the callback function
+ *
+ */
+int cam_tfe_csid_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t csid_irq_handler, void *irq_data);
+
+
+/**
+ * cam_tfe_csid_deinit_soc_resources()
+ *
+ * @brief:                 Csid de initialization function for the soc info
+ *
+ * @soc_info:              Soc info structure pointer
+ *
+ */
+int cam_tfe_csid_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_tfe_csid_enable_soc_resources()
+ *
+ * @brief:                 Csid soc resource enable function
+ *
+ * @soc_info:              Soc info structure pointer
+ * @clk_lvl:               Vote level to start with
+ *
+ */
+int cam_tfe_csid_enable_soc_resources(struct cam_hw_soc_info  *soc_info,
+	uint32_t clk_lvl);
+
+/**
+ * cam_tfe_csid_disable_soc_resources()
+ *
+ * @brief:                 Csid soc resource disable function
+ *
+ * @soc_info:              Soc info structure pointer
+ *
+ */
+int cam_tfe_csid_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_tfe_csid_enable_tfe_force_clock()
+ *
+ * @brief:                 If csid testgen used for dual isp case, before
+ *                         starting csid test gen, enable tfe force clock on
+ *                         through cpas
+ *
+ * @soc_info:              Soc info structure pointer
+ * @cpas_tfe_base_offset:  Cpas tfe force clock base reg offset value
+ *
+ */
+int cam_tfe_csid_enable_tfe_force_clock_on(struct cam_hw_soc_info  *soc_info,
+	uint32_t cpas_tfe_base_offset);
+
+/**
+ * cam_tfe_csid_disable_tfe_force_clock_on()
+ *
+ * @brief:                 Disable the TFE force clock on after dual ISP
+ *                         CSID test gen stop
+ *
+ * @soc_info:              Soc info structure pointer
+ * @cpas_tfe_base_offset:  Cpas tfe force clock base reg offset value
+ *
+ */
+int cam_tfe_csid_disable_tfe_force_clock_on(struct cam_hw_soc_info *soc_info,
+	uint32_t cpas_tfe_base_offset);
+
+/**
+ * cam_tfe_csid_get_vote_level()
+ *
+ * @brief:                 Get the vote level from clock rate
+ *
+ * @soc_info:              Soc info structure pointer
+ * @clock_rate             Clock rate
+ *
+ */
+uint32_t cam_tfe_csid_get_vote_level(struct cam_hw_soc_info *soc_info,
+	uint64_t clock_rate);
+
+#endif /* _CAM_TFE_CSID_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe.c
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_tfe530.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_tfe_core.h"
+#include "cam_tfe_dev.h"
+#include "camera_main.h"
+
+static const struct of_device_id cam_tfe_dt_match[] = {
+	{
+		.compatible = "qcom,tfe530",
+		.data = &cam_tfe530,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_tfe_dt_match);
+
+struct platform_driver cam_tfe_driver = {
+	.probe = cam_tfe_probe,
+	.remove = cam_tfe_remove,
+	.driver = {
+		.name = "cam_tfe",
+		.of_match_table = cam_tfe_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_tfe_init_module(void)
+{
+	return platform_driver_register(&cam_tfe_driver);
+}
+
+void cam_tfe_exit_module(void)
+{
+	platform_driver_unregister(&cam_tfe_driver);
+}
+
+MODULE_DESCRIPTION("CAM TFE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe530.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe530.h
@@ -0,0 +1,913 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE530_H_
+#define _CAM_TFE530_H_
+#include "cam_tfe_core.h"
+#include "cam_tfe_bus.h"
+
+
+static struct cam_tfe_top_reg_offset_common  tfe530_top_commong_reg  = {
+	.hw_version                   = 0x00001000,
+	.hw_capability                = 0x00001004,
+	.lens_feature                 = 0x00001008,
+	.stats_feature                = 0x0000100C,
+	.zoom_feature                 = 0x00001010,
+	.global_reset_cmd             = 0x00001014,
+	.core_cgc_ctrl                = 0x00001018,
+	.ahb_cgc_ctrl                 = 0x0000101C,
+	.core_cfg_0                   = 0x00001024,
+	.core_cfg_1                   = 0x00001028,
+	.reg_update_cmd               = 0x0000102C,
+	.diag_config                  = 0x00001060,
+	.diag_sensor_status_0         = 0x00001064,
+	.diag_sensor_status_1         = 0x00001068,
+	.diag_sensor_frame_cnt_status = 0x0000106C,
+	.violation_status             = 0x00001070,
+	.stats_throttle_cnt_cfg_0     = 0x00001074,
+	.stats_throttle_cnt_cfg_1     = 0x00001078,
+	.debug_0                      = 0x000010A0,
+	.debug_1                      = 0x000010A4,
+	.debug_2                      = 0x000010A8,
+	.debug_3                      = 0x000010AC,
+	.debug_cfg                    = 0x000010DC,
+	.perf_cnt_cfg                 = 0x000010E0,
+	.perf_pixel_count             = 0x000010E4,
+	.perf_line_count              = 0x000010E8,
+	.perf_stall_count             = 0x000010EC,
+	.perf_always_count            = 0x000010F0,
+	.perf_count_status            = 0x000010F4,
+	.diag_min_hbi_error_shift     = 15,
+	.diag_neq_hbi_shift           = 14,
+	.diag_sensor_hbi_mask         = 0x3FFF,
+};
+
+static struct cam_tfe_camif_reg  tfe530_camif_reg = {
+	.hw_version                   = 0x00001200,
+	.hw_status                    = 0x00001204,
+	.module_cfg                   = 0x00001260,
+	.pdaf_raw_crop_width_cfg      = 0x00001268,
+	.pdaf_raw_crop_height_cfg     = 0x0000126C,
+	.line_skip_pattern            = 0x00001270,
+	.pixel_skip_pattern           = 0x00001274,
+	.period_cfg                   = 0x00001278,
+	.irq_subsample_pattern        = 0x0000127C,
+	.epoch_irq_cfg                = 0x00001280,
+	.debug_1                      = 0x000013F0,
+	.debug_0                      = 0x000013F4,
+	.test_bus_ctrl                = 0x000013F8,
+	.spare                        = 0x000013F8,
+	.reg_update_cmd               = 0x0000102C,
+};
+
+static struct cam_tfe_camif_reg_data tfe530_camif_reg_data = {
+	.extern_reg_update_mask       = 0x00000001,
+	.dual_tfe_pix_en_shift        = 0x00000001,
+	.extern_reg_update_shift      = 0x0,
+	.camif_pd_rdi2_src_sel_shift  = 0x2,
+	.dual_tfe_sync_sel_shift      = 18,
+	.delay_line_en_shift          = 8,
+	.pixel_pattern_shift          = 24,
+	.pixel_pattern_mask           = 0x7000000,
+	.module_enable_shift          = 0,
+	.pix_out_enable_shift         = 8,
+	.pdaf_output_enable_shift     = 9,
+	.dsp_mode_shift               = 0,
+	.dsp_mode_mask                = 0,
+	.dsp_en_shift                 = 0,
+	.dsp_en_mask                  = 0,
+	.reg_update_cmd_data          = 0x1,
+	.epoch_line_cfg               = 0x00140014,
+	.sof_irq_mask                 = 0x00000001,
+	.epoch0_irq_mask              = 0x00000004,
+	.epoch1_irq_mask              = 0x00000008,
+	.eof_irq_mask                 = 0x00000002,
+	.reg_update_irq_mask          = 0x00000001,
+	.error_irq_mask0              = 0x00010100,
+	.error_irq_mask2              = 0x00000023,
+	.subscribe_irq_mask           = {
+		0x00000000,
+		0x00000007,
+		0x00000000,
+	},
+	.enable_diagnostic_hw         = 0x1,
+	.perf_cnt_start_cmd_shift     = 0,
+	.perf_cnt_continuous_shift    = 2,
+	.perf_client_sel_shift        = 8,
+	.perf_window_start_shift      = 16,
+	.perf_window_end_shift        = 20,
+};
+
+static struct cam_tfe_rdi_reg  tfe530_rdi0_reg = {
+	.rdi_hw_version              = 0x00001400,
+	.rdi_hw_status               = 0x00001404,
+	.rdi_module_config           = 0x00001460,
+	.rdi_skip_period             = 0x00001468,
+	.rdi_irq_subsample_pattern   = 0x0000146C,
+	.rdi_epoch_irq               = 0x00001470,
+	.rdi_debug_1                 = 0x000015F0,
+	.rdi_debug_0                 = 0x000015F4,
+	.rdi_test_bus_ctrl           = 0x000015F8,
+	.rdi_spare                   = 0x000015FC,
+	.reg_update_cmd              = 0x0000102C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe530_rdi0_reg_data = {
+	.reg_update_cmd_data         = 0x2,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000010,
+	.epoch0_irq_mask             = 0x00000040,
+	.epoch1_irq_mask             = 0x00000080,
+	.eof_irq_mask                = 0x00000020,
+	.error_irq_mask0             = 0x00020200,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000030,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x1,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe530_rdi1_reg = {
+	.rdi_hw_version              = 0x00001600,
+	.rdi_hw_status               = 0x00001604,
+	.rdi_module_config           = 0x00001660,
+	.rdi_skip_period             = 0x00001668,
+	.rdi_irq_subsample_pattern   = 0x0000166C,
+	.rdi_epoch_irq               = 0x00001670,
+	.rdi_debug_1                 = 0x000017F0,
+	.rdi_debug_0                 = 0x000017F4,
+	.rdi_test_bus_ctrl           = 0x000017F8,
+	.rdi_spare                   = 0x000017FC,
+	.reg_update_cmd              = 0x0000102C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe530_rdi1_reg_data = {
+	.reg_update_cmd_data         = 0x4,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00000100,
+	.epoch0_irq_mask             = 0x00000400,
+	.epoch1_irq_mask             = 0x00000800,
+	.eof_irq_mask                = 0x00000200,
+	.error_irq_mask0             = 0x00040400,
+	.error_irq_mask2             = 0x00000008,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00000300,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x2,
+	.diag_sensor_shift           = 0x1,
+};
+
+static struct cam_tfe_rdi_reg  tfe530_rdi2_reg = {
+	.rdi_hw_version              = 0x00001800,
+	.rdi_hw_status               = 0x00001804,
+	.rdi_module_config           = 0x00001860,
+	.rdi_skip_period             = 0x00001868,
+	.rdi_irq_subsample_pattern   = 0x0000186C,
+	.rdi_epoch_irq               = 0x00001870,
+	.rdi_debug_1                 = 0x000019F0,
+	.rdi_debug_0                 = 0x000019F4,
+	.rdi_test_bus_ctrl           = 0x000019F8,
+	.rdi_spare                   = 0x000019FC,
+	.reg_update_cmd              = 0x0000102C,
+};
+
+static struct cam_tfe_rdi_reg_data tfe530_rdi2_reg_data = {
+	.reg_update_cmd_data         = 0x8,
+	.epoch_line_cfg              = 0x00140014,
+	.pixel_pattern_shift         = 24,
+	.pixel_pattern_mask          = 0x07000000,
+	.rdi_out_enable_shift        = 0,
+
+	.sof_irq_mask                = 0x00001000,
+	.epoch0_irq_mask             = 0x00004000,
+	.epoch1_irq_mask             = 0x00008000,
+	.eof_irq_mask                = 0x00002000,
+	.error_irq_mask0             = 0x00080800,
+	.error_irq_mask2             = 0x00000004,
+	.subscribe_irq_mask          = {
+		0x00000000,
+		0x00003000,
+		0x00000000,
+	},
+	.enable_diagnostic_hw        = 0x1,
+	.diag_sensor_sel             = 0x3,
+	.diag_sensor_shift           = 0x1,
+
+};
+
+static struct cam_tfe_clc_hw_status  tfe530_clc_hw_info[CAM_TFE_MAX_CLC] = {
+	{
+		.name = "CLC_CAMIF",
+		.hw_status_reg = 0x1204,
+	},
+	{
+		.name = "CLC_RDI0_CAMIF",
+		.hw_status_reg = 0x1404,
+	},
+	{
+		.name = "CLC_RDI1_CAMIF",
+		.hw_status_reg = 0x1604,
+	},
+	{
+		.name = "CLC_RDI2_CAMIF",
+		.hw_status_reg = 0x1804,
+	},
+	{
+		.name = "CLC_CHANNEL_GAIN",
+		.hw_status_reg = 0x2604,
+	},
+	{
+		.name = "CLC_LENS_ROLL_OFF",
+		.hw_status_reg = 0x2804,
+	},
+	{
+		.name = "CLC_WB_BDS",
+		.hw_status_reg = 0x2A04,
+	},
+	{
+		.name = "CLC_STATS_BHIST",
+		.hw_status_reg = 0x2C04,
+	},
+	{
+		.name = "CLC_STATS_TINTLESS_BG",
+		.hw_status_reg = 0x2E04,
+	},
+	{
+		.name = "CLC_STATS_BAF",
+		.hw_status_reg = 0x3004,
+	},
+	{
+		.name = "CLC_STATS_AWB_BG",
+		.hw_status_reg = 0x3204,
+	},
+	{
+		.name = "CLC_STATS_AEC_BG",
+		.hw_status_reg = 0x3404,
+	},
+	{
+		.name = "CLC_STATS_RAW_OUT",
+		.hw_status_reg = 0x3604,
+	},
+	{
+		.name = "CLC_STATS_CROP_POST_BDS",
+		.hw_status_reg = 0x3804,
+	},
+};
+
+static struct  cam_tfe_top_hw_info tfe530_top_hw_info = {
+	.common_reg = &tfe530_top_commong_reg,
+	.camif_hw_info = {
+		.camif_reg = &tfe530_camif_reg,
+		.reg_data  = &tfe530_camif_reg_data,
+	},
+	.rdi_hw_info  = {
+		{
+			.rdi_reg  = &tfe530_rdi0_reg,
+			.reg_data = &tfe530_rdi0_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe530_rdi1_reg,
+			.reg_data = &tfe530_rdi1_reg_data,
+		},
+		{
+			.rdi_reg  = &tfe530_rdi2_reg,
+			.reg_data = &tfe530_rdi2_reg_data,
+		},
+	},
+	.in_port = {
+		CAM_TFE_CAMIF_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0,
+		CAM_TFE_RDI_VER_1_0
+	},
+	.reg_dump_data  = {
+		.num_reg_dump_entries    = 19,
+		.num_lut_dump_entries    = 0,
+		.bus_start_addr          = 0x2000,
+		.bus_write_top_end_addr  = 0x2120,
+		.bus_client_start_addr   = 0x2200,
+		.bus_client_offset       = 0x100,
+		.num_bus_clients         = 10,
+		.reg_entry = {
+			{
+				.start_offset = 0x1000,
+				.end_offset   = 0x10F4,
+			},
+			{
+				.start_offset = 0x1260,
+				.end_offset   = 0x1280,
+			},
+			{
+				.start_offset = 0x13F0,
+				.end_offset   = 0x13FC,
+			},
+			{
+				.start_offset = 0x1460,
+				.end_offset   = 0x1470,
+			},
+			{
+				.start_offset = 0x15F0,
+				.end_offset   = 0x15FC,
+			},
+			{
+				.start_offset = 0x1660,
+				.end_offset   = 0x1670,
+			},
+			{
+				.start_offset = 0x17F0,
+				.end_offset   = 0x17FC,
+			},
+			{
+				.start_offset = 0x1860,
+				.end_offset   = 0x1870,
+			},
+			{
+				.start_offset = 0x19F0,
+				.end_offset   = 0x19FC,
+			},
+			{
+				.start_offset = 0x2660,
+				.end_offset   = 0x2694,
+			},
+			{
+				.start_offset = 0x2860,
+				.end_offset   = 0x2884,
+			},
+			{
+				.start_offset = 0x2A60,
+				.end_offset   = 0X2B34,
+			},
+			{
+				.start_offset = 0x2C60,
+				.end_offset   = 0X2C80,
+			},
+			{
+				.start_offset = 0x2E60,
+				.end_offset   = 0X2E7C,
+			},
+			{
+				.start_offset = 0x3060,
+				.end_offset   = 0X3110,
+			},
+			{
+				.start_offset = 0x3260,
+				.end_offset   = 0X3278,
+			},
+			{
+				.start_offset = 0x3460,
+				.end_offset   = 0X3478,
+			},
+			{
+				.start_offset = 0x3660,
+				.end_offset   = 0X3684,
+			},
+			{
+				.start_offset = 0x3860,
+				.end_offset   = 0X3884,
+			},
+		},
+		.lut_entry = {
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x40,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x2800,
+			},
+			{
+				.lut_word_size = 1,
+				.lut_bank_sel  = 0x41,
+				.lut_addr_size = 180,
+				.dmi_reg_offset = 0x3000,
+			},
+		},
+	},
+};
+
+static struct cam_tfe_bus_hw_info  tfe530_bus_hw_info = {
+	.common_reg = {
+		.hw_version  = 0x00001A00,
+		.cgc_ovd     = 0x00001A08,
+		.comp_cfg_0  = 0x00001A0C,
+		.comp_cfg_1  = 0x00001A10,
+		.frameheader_cfg  = {
+			0x00001A34,
+			0x00001A38,
+			0x00001A3C,
+			0x00001A40,
+		},
+		.pwr_iso_cfg = 0x00001A5C,
+		.overflow_status_clear = 0x00001A60,
+		.ccif_violation_status = 0x00001A64,
+		.overflow_status       = 0x00001A68,
+		.image_size_violation_status = 0x00001A70,
+		.perf_count_cfg = {
+			0x00001A74,
+			0x00001A78,
+			0x00001A7C,
+			0x00001A80,
+			0x00001A84,
+			0x00001A88,
+			0x00001A8C,
+			0x00001A90,
+		},
+		.perf_count_val = {
+			0x00001A94,
+			0x00001A98,
+			0x00001A9C,
+			0x00001AA0,
+			0x00001AA4,
+			0x00001AA8,
+			0x00001AAC,
+			0x00001AB0,
+		},
+		.perf_count_status = 0x00001AB4,
+		.debug_status_top_cfg = 0x00001AD4,
+		.debug_status_top = 0x00001AD8,
+		.test_bus_ctrl = 0x00001ADC,
+		.irq_mask = {
+			0x00001A18,
+			0x00001A1C,
+		},
+		.irq_clear = {
+			0x00001A20,
+			0x00001A24,
+		},
+		.irq_status = {
+			0x00001A28,
+			0x00001A2C,
+		},
+		.irq_cmd = 0x00001A30,
+		.cons_violation_shift = 28,
+		.violation_shift  = 30,
+		.image_size_violation = 31,
+	},
+	.num_client = CAM_TFE_BUS_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 BAYER */
+		{
+			.cfg                   = 0x00001C00,
+			.image_addr            = 0x00001C04,
+			.frame_incr            = 0x00001C08,
+			.image_cfg_0           = 0x00001C0C,
+			.image_cfg_1           = 0x00001C10,
+			.image_cfg_2           = 0x00001C14,
+			.packer_cfg            = 0x00001C18,
+			.bw_limit              = 0x00001C1C,
+			.frame_header_addr     = 0x00001C20,
+			.frame_header_incr     = 0x00001C24,
+			.frame_header_cfg      = 0x00001C28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00001C30,
+			.irq_subsample_pattern = 0x00001C34,
+			.framedrop_period      = 0x00001C38,
+			.framedrop_pattern     = 0x00001C3C,
+			.addr_status_0         = 0x00001C68,
+			.addr_status_1         = 0x00001C6C,
+			.addr_status_2         = 0x00001C70,
+			.addr_status_3         = 0x00001C74,
+			.debug_status_cfg      = 0x00001C78,
+			.debug_status_0        = 0x00001C7C,
+			.debug_status_1        = 0x00001C80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_0,
+			.client_name           = "BAYER",
+		},
+		/* BUS Client 1 IDEAL RAW*/
+		{
+			.cfg                   = 0x00001D00,
+			.image_addr            = 0x00001D04,
+			.frame_incr            = 0x00001D08,
+			.image_cfg_0           = 0x00001D0C,
+			.image_cfg_1           = 0x00001D10,
+			.image_cfg_2           = 0x00001D14,
+			.packer_cfg            = 0x00001D18,
+			.bw_limit              = 0x00001D1C,
+			.frame_header_addr     = 0x00001D20,
+			.frame_header_incr     = 0x00001D24,
+			.frame_header_cfg      = 0x00001D28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00001D30,
+			.irq_subsample_pattern = 0x00001D34,
+			.framedrop_period      = 0x00001D38,
+			.framedrop_pattern     = 0x00001D3C,
+			.addr_status_0         = 0x00001D68,
+			.addr_status_1         = 0x00001D6C,
+			.addr_status_2         = 0x00001D70,
+			.addr_status_3         = 0x00001D74,
+			.debug_status_cfg      = 0x00001D78,
+			.debug_status_0        = 0x00001D7C,
+			.debug_status_1        = 0x00001D80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_1,
+			.client_name           = "IDEAL_RAW",
+		},
+		/* BUS Client 2 Stats BE Tintless */
+		{
+			.cfg                   = 0x00001E00,
+			.image_addr            = 0x00001E04,
+			.frame_incr            = 0x00001E08,
+			.image_cfg_0           = 0x00001E0C,
+			.image_cfg_1           = 0x00001E10,
+			.image_cfg_2           = 0x00001E14,
+			.packer_cfg            = 0x00001E18,
+			.bw_limit              = 0x00001E1C,
+			.frame_header_addr     = 0x00001E20,
+			.frame_header_incr     = 0x00001E24,
+			.frame_header_cfg      = 0x00001E28,
+			.line_done_cfg         = 0x00001E00,
+			.irq_subsample_period  = 0x00001E30,
+			.irq_subsample_pattern = 0x00000E34,
+			.framedrop_period      = 0x00001E38,
+			.framedrop_pattern     = 0x00001E3C,
+			.addr_status_0         = 0x00001E68,
+			.addr_status_1         = 0x00001E6C,
+			.addr_status_2         = 0x00001E70,
+			.addr_status_3         = 0x00001E74,
+			.debug_status_cfg      = 0x00001E78,
+			.debug_status_0        = 0x00001E7C,
+			.debug_status_1        = 0x00001E80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BE TINTLESS",
+		},
+		/* BUS Client 3 Stats Bhist */
+		{
+			.cfg                   = 0x00001F00,
+			.image_addr            = 0x00001F04,
+			.frame_incr            = 0x00001F08,
+			.image_cfg_0           = 0x00001F0C,
+			.image_cfg_1           = 0x00001F10,
+			.image_cfg_2           = 0x00001F14,
+			.packer_cfg            = 0x00001F18,
+			.bw_limit              = 0x00001F1C,
+			.frame_header_addr     = 0x00001F20,
+			.frame_header_incr     = 0x00001F24,
+			.frame_header_cfg      = 0x00001F28,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00001F30,
+			.irq_subsample_pattern = 0x00001F34,
+			.framedrop_period      = 0x00001F38,
+			.framedrop_pattern     = 0x00001F3C,
+			.addr_status_0         = 0x00001F68,
+			.addr_status_1         = 0x00001F6C,
+			.addr_status_2         = 0x00001F70,
+			.addr_status_3         = 0x00001F74,
+			.debug_status_cfg      = 0x00001F78,
+			.debug_status_0        = 0x00001F7C,
+			.debug_status_1        = 0x00001F80,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_2,
+			.client_name           = "STATS BHIST",
+		},
+		/* BUS Client 4 Stats AWB BG */
+		{
+			.cfg                   = 0x00002000,
+			.image_addr            = 0x00002004,
+			.frame_incr            = 0x00002008,
+			.image_cfg_0           = 0x0000200C,
+			.image_cfg_1           = 0x00002010,
+			.image_cfg_2           = 0x00002014,
+			.packer_cfg            = 0x00002018,
+			.bw_limit              = 0x0000201C,
+			.frame_header_addr     = 0x00002020,
+			.frame_header_incr     = 0x00002024,
+			.frame_header_cfg      = 0x00002028,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002030,
+			.irq_subsample_pattern = 0x00002034,
+			.framedrop_period      = 0x00002038,
+			.framedrop_pattern     = 0x0000203C,
+			.addr_status_0         = 0x00002068,
+			.addr_status_1         = 0x0000206C,
+			.addr_status_2         = 0x00002070,
+			.addr_status_3         = 0x00002074,
+			.debug_status_cfg      = 0x00002078,
+			.debug_status_0        = 0x0000207C,
+			.debug_status_1        = 0x00002080,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AWB BG",
+		},
+		/* BUS Client 5 Stats AEC BG */
+		{
+			.cfg                   = 0x00002100,
+			.image_addr            = 0x00002104,
+			.frame_incr            = 0x00002108,
+			.image_cfg_0           = 0x0000210C,
+			.image_cfg_1           = 0x00002110,
+			.image_cfg_2           = 0x00002114,
+			.packer_cfg            = 0x00002118,
+			.bw_limit              = 0x0000211C,
+			.frame_header_addr     = 0x00002120,
+			.frame_header_incr     = 0x00002124,
+			.frame_header_cfg      = 0x00002128,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002130,
+			.irq_subsample_pattern = 0x00002134,
+			.framedrop_period      = 0x00002138,
+			.framedrop_pattern     = 0x0000213C,
+			.addr_status_0         = 0x00002168,
+			.addr_status_1         = 0x0000216C,
+			.addr_status_2         = 0x00002170,
+			.addr_status_3         = 0x00002174,
+			.debug_status_cfg      = 0x00002178,
+			.debug_status_0        = 0x0000217C,
+			.debug_status_1        = 0x00002180,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_3,
+			.client_name           = "STATS AEC BG",
+		},
+		/* BUS Client 6 Stats BAF */
+		{
+			.cfg                   = 0x00002200,
+			.image_addr            = 0x00002204,
+			.frame_incr            = 0x00002208,
+			.image_cfg_0           = 0x0000220C,
+			.image_cfg_1           = 0x00002210,
+			.image_cfg_2           = 0x00002214,
+			.packer_cfg            = 0x00002218,
+			.bw_limit              = 0x0000221C,
+			.frame_header_addr     = 0x00002220,
+			.frame_header_incr     = 0x00002224,
+			.frame_header_cfg      = 0x00002228,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002230,
+			.irq_subsample_pattern = 0x00002234,
+			.framedrop_period      = 0x00002238,
+			.framedrop_pattern     = 0x0000223C,
+			.addr_status_0         = 0x00002268,
+			.addr_status_1         = 0x0000226C,
+			.addr_status_2         = 0x00002270,
+			.addr_status_3         = 0x00002274,
+			.debug_status_cfg      = 0x00002278,
+			.debug_status_0        = 0x0000227C,
+			.debug_status_1        = 0x00002280,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_4,
+			.client_name           = "STATS BAF",
+		},
+		/* BUS Client 7 RDI0 */
+		{
+			.cfg                   = 0x00002300,
+			.image_addr            = 0x00002304,
+			.frame_incr            = 0x00002308,
+			.image_cfg_0           = 0x0000230C,
+			.image_cfg_1           = 0x00002310,
+			.image_cfg_2           = 0x00002314,
+			.packer_cfg            = 0x00002318,
+			.bw_limit              = 0x0000231C,
+			.frame_header_addr     = 0x00002320,
+			.frame_header_incr     = 0x00002324,
+			.frame_header_cfg      = 0x00002328,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002330,
+			.irq_subsample_pattern = 0x00002334,
+			.framedrop_period      = 0x00002338,
+			.framedrop_pattern     = 0x0000233C,
+			.addr_status_0         = 0x00002368,
+			.addr_status_1         = 0x0000236C,
+			.addr_status_2         = 0x00002370,
+			.addr_status_3         = 0x00002374,
+			.debug_status_cfg      = 0x00002378,
+			.debug_status_0        = 0x0000237C,
+			.debug_status_1        = 0x00002380,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_5,
+			.client_name           = "RDI0",
+		},
+		/* BUS Client 8 RDI1 */
+		{
+			.cfg                   = 0x00002400,
+			.image_addr            = 0x00002404,
+			.frame_incr            = 0x00002408,
+			.image_cfg_0           = 0x0000240C,
+			.image_cfg_1           = 0x00002410,
+			.image_cfg_2           = 0x00002414,
+			.packer_cfg            = 0x00002418,
+			.bw_limit              = 0x0000241C,
+			.frame_header_addr     = 0x00002420,
+			.frame_header_incr     = 0x00002424,
+			.frame_header_cfg      = 0x00002428,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002430,
+			.irq_subsample_pattern = 0x00002434,
+			.framedrop_period      = 0x00002438,
+			.framedrop_pattern     = 0x0000243C,
+			.addr_status_0         = 0x00002468,
+			.addr_status_1         = 0x0000246C,
+			.addr_status_2         = 0x00002470,
+			.addr_status_3         = 0x00002474,
+			.debug_status_cfg      = 0x00002478,
+			.debug_status_0        = 0x0000247C,
+			.debug_status_1        = 0x00002480,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_6,
+			.client_name           = "RDI1",
+		},
+		/* BUS Client 9 PDAF/RDI2*/
+		{
+			.cfg                   = 0x00002500,
+			.image_addr            = 0x00002504,
+			.frame_incr            = 0x00002508,
+			.image_cfg_0           = 0x0000250C,
+			.image_cfg_1           = 0x00002510,
+			.image_cfg_2           = 0x00002514,
+			.packer_cfg            = 0x00002518,
+			.bw_limit              = 0x0000251C,
+			.frame_header_addr     = 0x00002520,
+			.frame_header_incr     = 0x00002524,
+			.frame_header_cfg      = 0x00002528,
+			.line_done_cfg         = 0x00000000,
+			.irq_subsample_period  = 0x00002530,
+			.irq_subsample_pattern = 0x00002534,
+			.framedrop_period      = 0x00002538,
+			.framedrop_pattern     = 0x0000253C,
+			.addr_status_0         = 0x00002568,
+			.addr_status_1         = 0x0000256C,
+			.addr_status_2         = 0x00002570,
+			.addr_status_3         = 0x00002574,
+			.debug_status_cfg      = 0x00002578,
+			.debug_status_0        = 0x0000257C,
+			.debug_status_1        = 0x00002580,
+			.comp_group            = CAM_TFE_BUS_COMP_GRP_7,
+			.client_name           = "RDI2/PADF",
+		},
+	},
+	.num_out  = CAM_TFE_BUS_TFE_OUT_MAX,
+	.tfe_out_hw_info = {
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI0,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_5,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_1,
+			.mid              = 23,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI1,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_6,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_2,
+			.mid              = 24,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RDI2,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_7,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_3,
+			.mid              = 25,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_FULL,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_0,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid              = 16,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_RAW_DUMP,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_1,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid              = 17,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_PDAF,
+			.max_width        = 4096,
+			.max_height       = 4096,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_7,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_3,
+			.mid              = 25,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid              = 21,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid              = 19,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_TL_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_2,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid              = 18,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_3,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid              = 20,
+		},
+		{
+			.tfe_out_id       = CAM_TFE_BUS_TFE_OUT_STATS_BF,
+			.max_width        = -1,
+			.max_height       = -1,
+			.composite_group  = CAM_TFE_BUS_COMP_GRP_4,
+			.rup_group_id     = CAM_TFE_BUS_RUP_GRP_0,
+			.mid              = 22,
+		},
+	},
+	.comp_done_shift          = 8,
+	.top_bus_wr_irq_shift     = 1,
+	.comp_buf_done_mask = 0xFF00,
+	.comp_rup_done_mask = 0xF,
+	.bus_irq_error_mask = {
+		0xD0000000,
+		0x00000000,
+	},
+	.support_consumed_addr = true,
+};
+
+struct cam_tfe_hw_info cam_tfe530 = {
+	.top_irq_mask = {
+		0x00001034,
+		0x00001038,
+		0x0000103C,
+	},
+	.top_irq_clear = {
+		0x00001040,
+		0x00001044,
+		0x00001048,
+	},
+	.top_irq_status = {
+		0x0000104C,
+		0x00001050,
+		0x00001054,
+	},
+	.top_irq_cmd                       = 0x00001030,
+	.global_clear_bitmask              = 0x00000001,
+
+	.bus_irq_mask = {
+		0x00001A18,
+		0x00001A1C,
+	},
+	.bus_irq_clear = {
+		0x00001A20,
+		0x00001A24,
+	},
+	.bus_irq_status = {
+		0x00001A28,
+		0x00001A2C,
+	},
+	.bus_irq_cmd = 0x00001A30,
+	.bus_violation_reg = 0x00001A64,
+	.bus_overflow_reg = 0x00001A68,
+	.bus_image_size_vilation_reg = 0x1A70,
+	.bus_overflow_clear_cmd = 0x1A60,
+	.debug_status_top = 0x1AD8,
+
+	.reset_irq_mask = {
+		0x00000001,
+		0x00000000,
+		0x00000000,
+	},
+	.error_irq_mask = {
+		0x000F0F00,
+		0x00000000,
+		0x0000003F,
+	},
+	.bus_reg_irq_mask = {
+		0x00000002,
+		0x00000000,
+	},
+	.bus_error_irq_mask = {
+		0xC0000000,
+		0x00000000,
+	},
+
+	.num_clc = 14,
+	.clc_hw_status_info            = tfe530_clc_hw_info,
+	.bus_version                   = CAM_TFE_BUS_1_0,
+	.bus_hw_info                   = &tfe530_bus_hw_info,
+
+	.top_version                   = CAM_TFE_TOP_1_0,
+	.top_hw_info                   = &tfe530_top_hw_info,
+};
+
+#endif /* _CAM_TFE530_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.c
@@ -0,0 +1,2523 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+#include <media/cam_tfe.h>
+#include <media/cam_isp_tfe.h>
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_tfe_bus.h"
+#include "cam_tfe_irq.h"
+#include "cam_tfe_soc.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+
+
+static const char drv_name[] = "tfe_bus";
+
+#define CAM_TFE_BUS_IRQ_REG0                0
+#define CAM_TFE_BUS_IRQ_REG1                1
+
+#define CAM_TFE_BUS_PAYLOAD_MAX             256
+
+#define CAM_TFE_RDI_BUS_DEFAULT_WIDTH               0xFFFF
+#define CAM_TFE_RDI_BUS_DEFAULT_STRIDE              0xFFFF
+
+#define CAM_TFE_MAX_OUT_RES_PER_COMP_GRP    2
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	(sizeof(struct cam_tfe_bus_reg_offset_bus_client) / 4)
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+enum cam_tfe_bus_packer_format {
+	PACKER_FMT_PLAIN_128,
+	PACKER_FMT_PLAIN_8,
+	PACKER_FMT_PLAIN_8_ODD_EVEN,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN,
+	PACKER_FMT_PLAIN_16_10BPP,
+	PACKER_FMT_PLAIN_16_12BPP,
+	PACKER_FMT_PLAIN_16_14BPP,
+	PACKER_FMT_PLAIN_16_16BPP,
+	PACKER_FMT_PLAIN_32,
+	PACKER_FMT_PLAIN_64,
+	PACKER_FMT_TP_10,
+	PACKET_FMT_MIPI10,
+	PACKET_FMT_MIPI12,
+	PACKER_FMT_MAX,
+};
+
+struct cam_tfe_bus_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *tfe_core_data;
+	struct cam_tfe_bus_reg_offset_common       *common_reg;
+	uint32_t       io_buf_update[MAX_REG_VAL_PAIR_SIZE];
+
+	spinlock_t                                  spin_lock;
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    comp_done_shift;
+	bool                                        is_lite;
+	bool                                        support_consumed_addr;
+	cam_hw_mgr_event_cb_func                    event_cb;
+	bool                        rup_irq_enable[CAM_TFE_BUS_RUP_GRP_MAX];
+};
+
+struct cam_tfe_bus_wm_resource_data {
+	uint32_t             index;
+	uint32_t             out_id;
+	struct cam_tfe_bus_common_data            *common_data;
+	struct cam_tfe_bus_reg_offset_bus_client  *hw_regs;
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	uint32_t             pack_fmt;
+	uint32_t             burst_len;
+	uint32_t             mode;
+
+	uint32_t             irq_subsample_period;
+	uint32_t             irq_subsample_pattern;
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             en_cfg;
+	uint32_t             image_addr_offset;
+	uint32_t             is_dual;
+
+	uint32_t             acquired_width;
+	uint32_t             acquired_height;
+	uint32_t             acquired_stride;
+};
+
+struct cam_tfe_bus_comp_grp_data {
+	enum cam_tfe_bus_comp_grp_id            comp_grp_id;
+	struct cam_tfe_bus_common_data         *common_data;
+
+	uint32_t                                is_master;
+	uint32_t                                is_dual;
+	uint32_t                                addr_sync_mode;
+	uint32_t                                composite_mask;
+
+	uint32_t                                acquire_dev_cnt;
+	uint32_t                                source_grp;
+
+	struct cam_isp_resource_node
+		*out_rsrc[CAM_TFE_MAX_OUT_RES_PER_COMP_GRP];
+};
+
+struct cam_tfe_bus_tfe_out_data {
+	uint32_t                         out_id;
+	uint32_t                         composite_group;
+	uint32_t                         rup_group_id;
+	uint32_t                         source_group;
+	struct cam_tfe_bus_common_data  *common_data;
+	struct cam_tfe_bus_priv         *bus_priv;
+
+	uint32_t                         num_wm;
+	struct cam_isp_resource_node    *wm_res[PLANE_MAX];
+
+	struct cam_isp_resource_node    *comp_grp;
+	struct list_head                 tfe_out_list;
+
+	uint32_t                         is_master;
+	uint32_t                         is_dual;
+
+	uint32_t                         format;
+	uint32_t                         max_width;
+	uint32_t                         max_height;
+	struct cam_cdm_utils_ops        *cdm_util_ops;
+	uint32_t                         secure_mode;
+	void                            *priv;
+	cam_hw_mgr_event_cb_func         event_cb;
+	uint32_t                         mid;
+};
+
+struct cam_tfe_bus_priv {
+	struct cam_tfe_bus_common_data      common_data;
+	uint32_t                            num_client;
+	uint32_t                            num_out;
+	uint32_t                            top_bus_wr_irq_shift;
+
+	struct cam_isp_resource_node  bus_client[CAM_TFE_BUS_MAX_CLIENTS];
+	struct cam_isp_resource_node  comp_grp[CAM_TFE_BUS_COMP_GRP_MAX];
+	struct cam_isp_resource_node  tfe_out[CAM_TFE_BUS_TFE_OUT_MAX];
+
+	struct list_head                    free_comp_grp;
+	struct list_head                    used_comp_grp;
+
+	void                               *tasklet_info;
+	uint32_t                            comp_buf_done_mask;
+	uint32_t                            comp_rup_done_mask;
+	uint32_t           bus_irq_error_mask[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+};
+
+static bool cam_tfe_bus_can_be_secure(uint32_t out_id)
+{
+	switch (out_id) {
+	case CAM_TFE_BUS_TFE_OUT_FULL:
+	case CAM_TFE_BUS_TFE_OUT_RAW_DUMP:
+	case CAM_TFE_BUS_TFE_OUT_RDI0:
+	case CAM_TFE_BUS_TFE_OUT_RDI1:
+	case CAM_TFE_BUS_TFE_OUT_RDI2:
+		return true;
+
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE:
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST:
+	case CAM_TFE_BUS_TFE_OUT_STATS_TL_BG:
+	case CAM_TFE_BUS_TFE_OUT_STATS_BF:
+	case CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG:
+	default:
+		return false;
+	}
+}
+
+static enum cam_tfe_bus_tfe_out_id
+	cam_tfe_bus_get_out_res_id(uint32_t out_res_id)
+{
+	switch (out_res_id) {
+	case CAM_ISP_TFE_OUT_RES_FULL:
+		return CAM_TFE_BUS_TFE_OUT_FULL;
+	case CAM_ISP_TFE_OUT_RES_RAW_DUMP:
+		return CAM_TFE_BUS_TFE_OUT_RAW_DUMP;
+	case CAM_ISP_TFE_OUT_RES_PDAF:
+		return CAM_TFE_BUS_TFE_OUT_PDAF;
+	case CAM_ISP_TFE_OUT_RES_RDI_0:
+		return CAM_TFE_BUS_TFE_OUT_RDI0;
+	case CAM_ISP_TFE_OUT_RES_RDI_1:
+		return CAM_TFE_BUS_TFE_OUT_RDI1;
+	case CAM_ISP_TFE_OUT_RES_RDI_2:
+		return CAM_TFE_BUS_TFE_OUT_RDI2;
+	case CAM_ISP_TFE_OUT_RES_STATS_HDR_BE:
+		return CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE;
+	case CAM_ISP_TFE_OUT_RES_STATS_HDR_BHIST:
+		return CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST;
+	case CAM_ISP_TFE_OUT_RES_STATS_TL_BG:
+		return CAM_TFE_BUS_TFE_OUT_STATS_TL_BG;
+	case CAM_ISP_TFE_OUT_RES_STATS_BF:
+		return CAM_TFE_BUS_TFE_OUT_STATS_BF;
+	case CAM_ISP_TFE_OUT_RES_STATS_AWB_BG:
+		return CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG;
+	default:
+		return CAM_TFE_BUS_TFE_OUT_MAX;
+	}
+}
+
+static int cam_tfe_bus_get_num_wm(
+	enum cam_tfe_bus_tfe_out_id           out_res_id,
+	uint32_t                              format)
+{
+	switch (out_res_id) {
+	case CAM_TFE_BUS_TFE_OUT_RDI0:
+	case CAM_TFE_BUS_TFE_OUT_RDI1:
+	case CAM_TFE_BUS_TFE_OUT_RDI2:
+		switch (format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_MIPI_RAW_14:
+		case CAM_FORMAT_MIPI_RAW_16:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+		case CAM_FORMAT_PLAIN128:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_PDAF:
+		switch (format) {
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+			return 1;
+		default:
+			break;
+		}
+		break;
+
+	case CAM_TFE_BUS_TFE_OUT_FULL:
+		switch (format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RAW_DUMP:
+		switch (format) {
+		case CAM_FORMAT_ARGB_14:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE:
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST:
+	case CAM_TFE_BUS_TFE_OUT_STATS_TL_BG:
+	case CAM_TFE_BUS_TFE_OUT_STATS_BF:
+	case CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG:
+		switch (format) {
+		case CAM_FORMAT_PLAIN64:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	CAM_ERR(CAM_ISP, "Unsupported format %u for resource id %u",
+		format, out_res_id);
+
+	return -EINVAL;
+}
+
+static int cam_tfe_bus_get_wm_idx(
+	enum cam_tfe_bus_tfe_out_id tfe_out_res_id,
+	enum cam_tfe_bus_plane_type plane)
+{
+	int wm_idx = -1;
+
+	switch (tfe_out_res_id) {
+	case CAM_TFE_BUS_TFE_OUT_RDI0:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 7;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RDI1:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 8;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RDI2:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 9;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_PDAF:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 9;
+			break;
+		default:
+			break;
+		}
+		break;
+
+	case CAM_TFE_BUS_TFE_OUT_FULL:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_RAW_DUMP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 1;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 5;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 3;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 4;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_TL_BG:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 2;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_TFE_BUS_TFE_OUT_STATS_BF:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 6;
+			break;
+		default:
+			break;
+		}
+		break;
+
+	default:
+		break;
+	}
+
+	return wm_idx;
+}
+
+static enum cam_tfe_bus_packer_format
+	cam_tfe_bus_get_packer_fmt(uint32_t out_fmt, int wm_index)
+{
+	switch (out_fmt) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_MIPI_RAW_20:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PD8:
+		return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_PLAIN8:
+		return PACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_Y_ONLY:
+		return PACKER_FMT_PLAIN_8_LSB_MSB_10;
+	case CAM_FORMAT_PLAIN16_10:
+		return PACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return PACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return PACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN16_16:
+		return PACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_ARGB:
+		return PACKER_FMT_PLAIN_32;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_PD10:
+		return PACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_TP10:
+		return PACKER_FMT_TP_10;
+	default:
+		return PACKER_FMT_MAX;
+	}
+}
+
+static int cam_tfe_bus_acquire_rdi_wm(
+	struct cam_tfe_bus_wm_resource_data  *rsrc_data)
+{
+	switch (rsrc_data->format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		rsrc_data->pack_fmt = 0xA;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 6, 64) / 64;
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_PLAIN8:
+		rsrc_data->pack_fmt = 0xA;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 8, 64) / 64;
+
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		rsrc_data->pack_fmt = 0xA;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 10, 64) / 64;
+
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		rsrc_data->pack_fmt = 0xA;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 12, 64) / 64;
+
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		rsrc_data->pack_fmt = 0xA;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 14, 64) / 64;
+
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+		}
+		break;
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_12:
+	case CAM_FORMAT_PLAIN16_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_PLAIN16_16:
+		rsrc_data->pack_fmt = 0xA;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 16, 64) / 64;
+
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+		}
+		break;
+
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PLAIN64:
+		rsrc_data->pack_fmt = 0xA;
+		if (rsrc_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE) {
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 64, 64) / 64;
+
+			rsrc_data->en_cfg = 0x1;
+		} else {
+			rsrc_data->width =
+				CAM_TFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride =
+				CAM_TFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported RDI:%d format %d",
+			rsrc_data->index, rsrc_data->format);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_acquire_wm(
+	struct cam_tfe_bus_priv               *bus_priv,
+	struct cam_isp_tfe_out_port_info      *out_port_info,
+	struct cam_isp_resource_node         **wm_res,
+	void                                  *tasklet,
+	enum cam_tfe_bus_tfe_out_id            tfe_out_res_id,
+	enum cam_tfe_bus_plane_type            plane,
+	uint32_t                              *client_done_mask,
+	uint32_t                               is_dual,
+	enum cam_tfe_bus_comp_grp_id          *comp_grp_id)
+{
+	struct cam_isp_resource_node         *wm_res_local = NULL;
+	struct cam_tfe_bus_wm_resource_data  *rsrc_data = NULL;
+	uint32_t wm_idx = 0;
+	int rc = 0;
+
+	*wm_res = NULL;
+	/* No need to allocate for BUS TFE OUT to WM is fixed. */
+	wm_idx = cam_tfe_bus_get_wm_idx(tfe_out_res_id, plane);
+	if (wm_idx < 0 || wm_idx >= bus_priv->num_client) {
+		CAM_ERR(CAM_ISP, "Unsupported TFE out %d plane %d",
+			tfe_out_res_id, plane);
+		return -EINVAL;
+	}
+
+	wm_res_local = &bus_priv->bus_client[wm_idx];
+	if (wm_res_local->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "WM:%d not available state:%d",
+			wm_idx, wm_res_local->res_state);
+		return -EALREADY;
+	}
+	wm_res_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	wm_res_local->tasklet_info = tasklet;
+
+	rsrc_data = wm_res_local->res_priv;
+	rsrc_data->format = out_port_info->format;
+	rsrc_data->pack_fmt = cam_tfe_bus_get_packer_fmt(rsrc_data->format,
+		wm_idx);
+
+	rsrc_data->width = out_port_info->width;
+	rsrc_data->height = out_port_info->height;
+	rsrc_data->stride = out_port_info->stride;
+	rsrc_data->mode = out_port_info->wm_mode;
+	rsrc_data->out_id = tfe_out_res_id;
+
+	/*
+	 * Store the acquire width, height separately. For frame based ports
+	 * width and height modified again
+	 */
+	rsrc_data->acquired_width = out_port_info->width;
+	rsrc_data->acquired_height = out_port_info->height;
+	rsrc_data->acquired_stride = out_port_info->stride;
+
+	rsrc_data->is_dual = is_dual;
+	/* Set WM offset value to default */
+	rsrc_data->offset  = 0;
+
+	if ((rsrc_data->index > 6) &&
+		(tfe_out_res_id != CAM_TFE_BUS_TFE_OUT_PDAF)) {
+		/* WM 7-9 refers to RDI 0/ RDI 1/RDI 2 */
+		rc = cam_tfe_bus_acquire_rdi_wm(rsrc_data);
+		if (rc)
+			return rc;
+
+	} else if (rsrc_data->index == 0 || rsrc_data->index == 1 ||
+		(tfe_out_res_id == CAM_TFE_BUS_TFE_OUT_PDAF)) {
+	/*  WM 0 FULL_OUT WM 1 IDEAL RAW WM9 for pdaf */
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+			rsrc_data->pack_fmt = 0x1;
+			break;
+		case CAM_FORMAT_MIPI_RAW_10:
+			rsrc_data->pack_fmt = 0xc;
+			break;
+		case CAM_FORMAT_MIPI_RAW_12:
+			rsrc_data->pack_fmt = 0xd;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			rsrc_data->pack_fmt = 0x1;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+			rsrc_data->pack_fmt = 0x5;
+			rsrc_data->pack_fmt |= 0x10;
+			break;
+		case CAM_FORMAT_PLAIN16_12:
+			rsrc_data->pack_fmt = 0x6;
+			rsrc_data->pack_fmt |= 0x10;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d",
+				rsrc_data->format);
+			return -EINVAL;
+		}
+
+		rsrc_data->en_cfg = 0x1;
+	} else if (rsrc_data->index  >= 2 && rsrc_data->index <= 6) {
+		/* WM 2-6 stats */
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid WM:%d requested", rsrc_data->index);
+		return -EINVAL;
+	}
+
+	*wm_res = wm_res_local;
+	*comp_grp_id = rsrc_data->hw_regs->comp_group;
+	*client_done_mask |= (1 << wm_idx);
+
+	CAM_DBG(CAM_ISP,
+		"WM:%d processed width:%d height:%d format:0x%x comp_group:%d packt format:0x%x wm mode:%d",
+		rsrc_data->index, rsrc_data->width, rsrc_data->height,
+		rsrc_data->format, *comp_grp_id, rsrc_data->pack_fmt,
+		rsrc_data->mode);
+	return 0;
+}
+
+static int cam_tfe_bus_release_wm(void   *bus_priv,
+	struct cam_isp_resource_node     *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data   *rsrc_data = wm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->pack_fmt = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->irq_subsample_period = 0;
+	rsrc_data->irq_subsample_pattern = 0;
+	rsrc_data->framedrop_period = 0;
+	rsrc_data->framedrop_pattern = 0;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+
+	wm_res->tasklet_info = NULL;
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_ISP, "TFE:%dRelease WM:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	return 0;
+}
+
+static int cam_tfe_bus_start_wm(struct cam_isp_resource_node *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_tfe_bus_common_data        *common_data =
+		rsrc_data->common_data;
+
+	cam_io_w(0xf, common_data->mem_base + rsrc_data->hw_regs->bw_limit);
+
+	cam_io_w((rsrc_data->height << 16) | rsrc_data->width,
+		common_data->mem_base + rsrc_data->hw_regs->image_cfg_0);
+	cam_io_w(rsrc_data->pack_fmt,
+		common_data->mem_base + rsrc_data->hw_regs->packer_cfg);
+
+	/* Configure stride for RDIs on full TFE and TFE lite  */
+	if ((rsrc_data->index > 6) &&
+		((rsrc_data->mode != CAM_ISP_TFE_WM_LINE_BASED_MODE) &&
+		(rsrc_data->out_id != CAM_TFE_BUS_TFE_OUT_PDAF))) {
+		cam_io_w_mb(rsrc_data->stride, (common_data->mem_base +
+			rsrc_data->hw_regs->image_cfg_2));
+		CAM_DBG(CAM_ISP, "WM:%d configure stride reg :0x%x",
+			rsrc_data->index,
+			rsrc_data->stride);
+	}
+
+	/* Enable WM */
+	cam_io_w_mb(rsrc_data->en_cfg, common_data->mem_base +
+		rsrc_data->hw_regs->cfg);
+
+	CAM_DBG(CAM_ISP, "TFE:%d WM:%d width = %d, height = %d",
+		common_data->core_index, rsrc_data->index,
+		rsrc_data->width, rsrc_data->height);
+	CAM_DBG(CAM_ISP, "WM:%d pk_fmt = %d", rsrc_data->index,
+		rsrc_data->pack_fmt);
+	CAM_DBG(CAM_ISP, "WM:%d stride = %d, burst len = %d",
+		rsrc_data->index, rsrc_data->stride, 0xf);
+	CAM_DBG(CAM_ISP, "TFE:%d Start WM:%d offset 0x%x val 0x%x",
+		common_data->core_index, rsrc_data->index,
+		(uint32_t) rsrc_data->hw_regs->cfg, rsrc_data->en_cfg);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_tfe_bus_stop_wm(struct cam_isp_resource_node *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_tfe_bus_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable WM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+	CAM_DBG(CAM_ISP, "TFE:%d Stop WM:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return 0;
+}
+
+static int cam_tfe_bus_init_wm_resource(uint32_t index,
+	struct cam_tfe_bus_priv    *bus_priv,
+	struct cam_tfe_bus_hw_info *hw_info,
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_tfe_bus_wm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for WM res priv");
+		return -ENOMEM;
+	}
+	wm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &bus_priv->common_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = cam_tfe_bus_start_wm;
+	wm_res->stop = cam_tfe_bus_stop_wm;
+	wm_res->hw_intf = bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_tfe_bus_deinit_wm_resource(
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_tfe_bus_wm_resource_data *rsrc_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = NULL;
+	wm_res->bottom_half_handler = NULL;
+	wm_res->hw_intf = NULL;
+
+	rsrc_data = wm_res->res_priv;
+	wm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static void cam_tfe_bus_add_wm_to_comp_grp(
+	struct cam_isp_resource_node    *comp_grp,
+	uint32_t                         composite_mask)
+{
+	struct cam_tfe_bus_comp_grp_data  *rsrc_data = comp_grp->res_priv;
+
+	rsrc_data->composite_mask |= composite_mask;
+}
+
+static bool cam_tfe_bus_match_comp_grp(
+	struct cam_tfe_bus_priv                *bus_priv,
+	struct cam_isp_resource_node          **comp_grp,
+	uint32_t                                comp_grp_id)
+{
+	struct cam_tfe_bus_comp_grp_data       *rsrc_data = NULL;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+
+	list_for_each_entry(comp_grp_local,
+		&bus_priv->used_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_id == comp_grp_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			return true;
+		}
+	}
+
+	list_for_each_entry(comp_grp_local,
+		&bus_priv->free_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_id == comp_grp_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			list_del(&comp_grp_local->list);
+			list_add_tail(&comp_grp_local->list,
+			&bus_priv->used_comp_grp);
+			return false;
+		}
+	}
+
+	*comp_grp = NULL;
+	return false;
+}
+
+static int cam_tfe_bus_acquire_comp_grp(
+	struct cam_tfe_bus_priv             *bus_priv,
+	struct cam_isp_tfe_out_port_info    *out_port_info,
+	void                                *tasklet,
+	uint32_t                             is_dual,
+	uint32_t                             is_master,
+	struct cam_isp_resource_node       **comp_grp,
+	enum cam_tfe_bus_comp_grp_id         comp_grp_id,
+	struct cam_isp_resource_node        *out_rsrc,
+	uint32_t                             source_group)
+{
+	int rc = 0;
+	struct cam_isp_resource_node      *comp_grp_local = NULL;
+	struct cam_tfe_bus_comp_grp_data  *rsrc_data = NULL;
+	bool previously_acquired  = false;
+
+	if (comp_grp_id >= CAM_TFE_BUS_COMP_GRP_0 &&
+		comp_grp_id <= CAM_TFE_BUS_COMP_GRP_7) {
+		/* Check if matching comp_grp has already been acquired */
+		previously_acquired = cam_tfe_bus_match_comp_grp(
+			bus_priv, &comp_grp_local, comp_grp_id);
+	}
+
+	if (!comp_grp_local) {
+		CAM_ERR(CAM_ISP, "Invalid comp_grp_id:%d", comp_grp_id);
+		return -ENODEV;
+	}
+
+	rsrc_data = comp_grp_local->res_priv;
+	if (rsrc_data->acquire_dev_cnt > CAM_TFE_MAX_OUT_RES_PER_COMP_GRP) {
+		CAM_ERR(CAM_ISP, "Many acquires comp_grp_id:%d", comp_grp_id);
+		return -ENODEV;
+	}
+
+	if (!previously_acquired) {
+		comp_grp_local->tasklet_info = tasklet;
+		comp_grp_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		rsrc_data->is_master = is_master;
+		rsrc_data->is_dual = is_dual;
+
+		if (is_master)
+			rsrc_data->addr_sync_mode = 0;
+		else
+			rsrc_data->addr_sync_mode = 1;
+	} else {
+		rsrc_data = comp_grp_local->res_priv;
+		/* Do not support runtime change in composite mask */
+		if (comp_grp_local->res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) {
+			CAM_ERR(CAM_ISP, "Invalid State %d Comp Grp %u",
+				comp_grp_local->res_state,
+				rsrc_data->comp_grp_id);
+			return -EBUSY;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Acquire comp_grp id:%u", rsrc_data->comp_grp_id);
+	rsrc_data->source_grp = source_group;
+	rsrc_data->out_rsrc[rsrc_data->acquire_dev_cnt] = out_rsrc;
+	rsrc_data->acquire_dev_cnt++;
+	*comp_grp = comp_grp_local;
+
+	return rc;
+}
+
+static int cam_tfe_bus_release_comp_grp(
+	struct cam_tfe_bus_priv              *bus_priv,
+	struct cam_isp_resource_node         *comp_grp)
+{
+	struct cam_isp_resource_node      *comp_grp_local = NULL;
+	struct cam_tfe_bus_comp_grp_data  *comp_rsrc_data = NULL;
+	int match_found = 0;
+
+	if (!comp_grp) {
+		CAM_ERR(CAM_ISP, "Invalid Params Comp Grp %pK", comp_grp);
+		return -EINVAL;
+	}
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "Already released Comp Grp");
+		return 0;
+	}
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "Invalid State %d",
+			comp_grp->res_state);
+		return -EBUSY;
+	}
+
+	comp_rsrc_data = comp_grp->res_priv;
+	CAM_DBG(CAM_ISP, "Comp Grp id %u", comp_rsrc_data->comp_grp_id);
+
+	list_for_each_entry(comp_grp_local, &bus_priv->used_comp_grp, list) {
+		if (comp_grp_local == comp_grp) {
+			match_found = 1;
+			break;
+		}
+	}
+
+	if (!match_found) {
+		CAM_ERR(CAM_ISP, "Could not find comp_grp_id:%u",
+			comp_rsrc_data->comp_grp_id);
+		return -ENODEV;
+	}
+
+	comp_rsrc_data->acquire_dev_cnt--;
+	if (comp_rsrc_data->acquire_dev_cnt == 0) {
+		list_del(&comp_grp_local->list);
+
+		comp_rsrc_data->addr_sync_mode = 0;
+		comp_rsrc_data->composite_mask = 0;
+
+		comp_grp_local->tasklet_info = NULL;
+		comp_grp_local->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+		list_add_tail(&comp_grp_local->list, &bus_priv->free_comp_grp);
+		CAM_DBG(CAM_ISP, "Comp Grp id %u released",
+			comp_rsrc_data->comp_grp_id);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_start_comp_grp(
+	struct cam_isp_resource_node *comp_grp)
+{
+	int rc = 0;
+	uint32_t val;
+	struct cam_tfe_bus_comp_grp_data *rsrc_data = NULL;
+	struct cam_tfe_bus_common_data   *common_data = NULL;
+	uint32_t     bus_irq_reg_mask_0  = 0;
+
+	rsrc_data = comp_grp->res_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP, "TFE:%d comp_grp_id:%d streaming state:%d mask:0x%x",
+		common_data->core_index, rsrc_data->comp_grp_id,
+		comp_grp->res_state, rsrc_data->composite_mask);
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		return 0;
+
+	if (rsrc_data->is_dual) {
+		if (rsrc_data->is_master) {
+			val = cam_io_r(common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+			val |= (0x1 << (rsrc_data->comp_grp_id + 16));
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val = cam_io_r(common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+			val |= (0x1 << rsrc_data->comp_grp_id);
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+		} else {
+			val = cam_io_r(common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+			val |= (0x1 << rsrc_data->comp_grp_id);
+			val |= (0x1 << (rsrc_data->comp_grp_id + 16));
+			cam_io_w(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val = cam_io_r(common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+			val |= (0x1 << rsrc_data->comp_grp_id);
+			cam_io_w(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+		}
+	}
+
+	if (rsrc_data->is_dual && !rsrc_data->is_master)
+		goto end;
+
+	/* Update the composite done mask in bus irq mask*/
+	bus_irq_reg_mask_0 = cam_io_r(common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	bus_irq_reg_mask_0 |= (0x1 << (rsrc_data->comp_grp_id +
+		rsrc_data->common_data->comp_done_shift));
+	cam_io_w_mb(bus_irq_reg_mask_0, common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+
+	CAM_DBG(CAM_ISP, "TFE:%d start COMP_GRP:%d bus_irq_mask_0 0x%x",
+		common_data->core_index, rsrc_data->comp_grp_id,
+		bus_irq_reg_mask_0);
+
+end:
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_tfe_bus_stop_comp_grp(
+	struct cam_isp_resource_node          *comp_grp)
+{
+	struct cam_tfe_bus_comp_grp_data *rsrc_data = NULL;
+	struct cam_tfe_bus_common_data *common_data = NULL;
+	uint32_t      bus_irq_reg_mask_0 = 0;
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		return 0;
+
+	rsrc_data = (struct cam_tfe_bus_comp_grp_data *)comp_grp->res_priv;
+	common_data = rsrc_data->common_data;
+
+	/* Update the composite done mask in bus irq mask*/
+	bus_irq_reg_mask_0  = cam_io_r(common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	bus_irq_reg_mask_0 &= ~(0x1 << (rsrc_data->comp_grp_id +
+		rsrc_data->common_data->comp_done_shift));
+	cam_io_w_mb(bus_irq_reg_mask_0, common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return 0;
+}
+
+static int cam_tfe_bus_init_comp_grp(uint32_t index,
+	struct cam_hw_soc_info          *soc_info,
+	struct cam_tfe_bus_priv         *bus_priv,
+	struct cam_tfe_bus_hw_info      *hw_info,
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_tfe_bus_comp_grp_data *rsrc_data = NULL;
+
+	rsrc_data = kzalloc(sizeof(struct cam_tfe_bus_comp_grp_data),
+		GFP_KERNEL);
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	comp_grp->res_priv = rsrc_data;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&comp_grp->list);
+
+	comp_grp->res_id = index;
+	rsrc_data->comp_grp_id   = index;
+	rsrc_data->common_data     = &bus_priv->common_data;
+
+	list_add_tail(&comp_grp->list, &bus_priv->free_comp_grp);
+
+	comp_grp->hw_intf = bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_tfe_bus_deinit_comp_grp(
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_tfe_bus_comp_grp_data *rsrc_data =
+		comp_grp->res_priv;
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = NULL;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = NULL;
+
+	list_del_init(&comp_grp->list);
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+	comp_grp->res_priv = NULL;
+
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "comp_grp_priv is NULL");
+		return -ENODEV;
+	}
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_tfe_bus_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update    *secure_mode = cmd_args;
+	struct cam_tfe_bus_tfe_out_data     *rsrc_data;
+	uint32_t                            *mode;
+
+	rsrc_data = (struct cam_tfe_bus_tfe_out_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode = (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_tfe_bus_acquire_tfe_out(void *priv, void *acquire_args,
+	uint32_t args_size)
+{
+	struct cam_tfe_bus_priv                *bus_priv = priv;
+	struct cam_tfe_acquire_args            *acq_args = acquire_args;
+	struct cam_tfe_hw_tfe_out_acquire_args *out_acquire_args;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_tfe_bus_tfe_out_data        *rsrc_data = NULL;
+	enum cam_tfe_bus_tfe_out_id             tfe_out_res_id;
+	enum cam_tfe_bus_comp_grp_id            comp_grp_id;
+	int                                     i, rc = -ENODEV;
+	uint32_t                                secure_caps = 0, mode;
+	uint32_t  format, num_wm, client_done_mask = 0;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_ISP, "Invalid Param");
+		return -EINVAL;
+	}
+
+	out_acquire_args = &acq_args->tfe_out;
+	format = out_acquire_args->out_port_info->format;
+
+	CAM_DBG(CAM_ISP, "resid 0x%x fmt:%d, sec mode:%d wm mode:%d",
+		out_acquire_args->out_port_info->res_id, format,
+		out_acquire_args->out_port_info->secure_mode,
+		out_acquire_args->out_port_info->wm_mode);
+	CAM_DBG(CAM_ISP, "width:%d, height:%d stride:%d",
+		out_acquire_args->out_port_info->width,
+		out_acquire_args->out_port_info->height,
+		out_acquire_args->out_port_info->stride);
+
+	tfe_out_res_id = cam_tfe_bus_get_out_res_id(
+		out_acquire_args->out_port_info->res_id);
+	if (tfe_out_res_id == CAM_TFE_BUS_TFE_OUT_MAX)
+		return -ENODEV;
+
+	num_wm = cam_tfe_bus_get_num_wm(tfe_out_res_id, format);
+	if (num_wm < 1)
+		return -EINVAL;
+
+	rsrc_node = &bus_priv->tfe_out[tfe_out_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "Resource not available: Res_id %d state:%d",
+			tfe_out_res_id, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	rsrc_data = rsrc_node->res_priv;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->event_cb = acq_args->event_cb;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->bus_priv = bus_priv;
+
+	secure_caps = cam_tfe_bus_can_be_secure(rsrc_data->out_id);
+	mode = out_acquire_args->out_port_info->secure_mode;
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (!rsrc_data->common_data->num_sec_out) {
+			rsrc_data->secure_mode = mode;
+			rsrc_data->common_data->secure_mode = mode;
+		} else {
+			if (mode == rsrc_data->common_data->secure_mode) {
+				rsrc_data->secure_mode =
+					rsrc_data->common_data->secure_mode;
+			} else {
+				rc = -EINVAL;
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"Mismatch: Acquire mode[%d], drvr mode[%d]",
+					rsrc_data->common_data->secure_mode,
+					mode);
+				mutex_unlock(
+					&rsrc_data->common_data->bus_mutex);
+				return -EINVAL;
+			}
+		}
+		rsrc_data->common_data->num_sec_out++;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	bus_priv->tasklet_info = acq_args->tasklet;
+	rsrc_data->num_wm = num_wm;
+	rsrc_node->rdi_only_ctx = 0;
+	rsrc_node->res_id = out_acquire_args->out_port_info->res_id;
+	rsrc_node->cdm_ops = out_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = out_acquire_args->cdm_ops;
+
+	/* Acquire WM and retrieve COMP GRP ID */
+	for (i = 0; i < num_wm; i++) {
+		rc = cam_tfe_bus_acquire_wm(bus_priv,
+			out_acquire_args->out_port_info,
+			&rsrc_data->wm_res[i],
+			acq_args->tasklet,
+			tfe_out_res_id,
+			i,
+			&client_done_mask,
+			out_acquire_args->is_dual,
+			&comp_grp_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"TFE:%d WM acquire failed for Out %d rc=%d",
+				rsrc_data->common_data->core_index,
+				tfe_out_res_id, rc);
+			goto release_wm;
+		}
+	}
+
+	/* Acquire composite group using COMP GRP ID */
+	rc = cam_tfe_bus_acquire_comp_grp(bus_priv,
+		out_acquire_args->out_port_info,
+		acq_args->tasklet,
+		out_acquire_args->is_dual,
+		out_acquire_args->is_master,
+		&rsrc_data->comp_grp,
+		comp_grp_id,
+		rsrc_node,
+		rsrc_data->source_group);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"TFE%d Comp_Grp acquire fail for Out %d rc=%d",
+			rsrc_data->common_data->core_index,
+			tfe_out_res_id, rc);
+		return rc;
+	}
+
+	rsrc_data->is_dual = out_acquire_args->is_dual;
+	rsrc_data->is_master = out_acquire_args->is_master;
+
+	cam_tfe_bus_add_wm_to_comp_grp(rsrc_data->comp_grp,
+		client_done_mask);
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	out_acquire_args->rsrc_node = rsrc_node;
+
+	return rc;
+
+release_wm:
+	for (i--; i >= 0; i--)
+		cam_tfe_bus_release_wm(bus_priv, rsrc_data->wm_res[i]);
+
+	if (rsrc_data->comp_grp)
+		cam_tfe_bus_release_comp_grp(bus_priv, rsrc_data->comp_grp);
+
+	return rc;
+}
+
+static int cam_tfe_bus_release_tfe_out(void *priv, void *release_args,
+	uint32_t args_size)
+{
+	struct cam_tfe_bus_priv               *bus_priv = priv;
+	struct cam_isp_resource_node          *tfe_out = NULL;
+	struct cam_tfe_bus_tfe_out_data       *rsrc_data = NULL;
+	uint32_t                               secure_caps = 0;
+	uint32_t i;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	tfe_out = (struct cam_isp_resource_node *)release_args;
+	rsrc_data = (struct cam_tfe_bus_tfe_out_data *)tfe_out->res_priv;
+
+	if (tfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid resource state:%d res id:%d",
+			tfe_out->res_state, tfe_out->res_id);
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		cam_tfe_bus_release_wm(bus_priv, rsrc_data->wm_res[i]);
+
+	rsrc_data->num_wm = 0;
+
+	if (rsrc_data->comp_grp)
+		cam_tfe_bus_release_comp_grp(bus_priv, rsrc_data->comp_grp);
+
+	rsrc_data->comp_grp = NULL;
+
+	tfe_out->tasklet_info = NULL;
+	tfe_out->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+
+	secure_caps = cam_tfe_bus_can_be_secure(rsrc_data->out_id);
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (rsrc_data->secure_mode ==
+			rsrc_data->common_data->secure_mode) {
+			rsrc_data->common_data->num_sec_out--;
+			rsrc_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+		} else {
+			/*
+			 * The validity of the mode is properly
+			 * checked while acquiring the output port.
+			 * not expected to reach here, unless there is
+			 * some corruption.
+			 */
+			CAM_ERR(CAM_ISP, "driver[%d],resource[%d] mismatch",
+				rsrc_data->common_data->secure_mode,
+				rsrc_data->secure_mode);
+		}
+
+		if (!rsrc_data->common_data->num_sec_out)
+			rsrc_data->common_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	if (tfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		tfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_tfe_bus_start_tfe_out(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node     *tfe_out = hw_priv;
+	struct cam_tfe_bus_tfe_out_data  *rsrc_data = NULL;
+	struct cam_tfe_bus_common_data   *common_data = NULL;
+	uint32_t bus_irq_reg_mask_0 = 0;
+	uint32_t rup_group_id = 0;
+	int rc = 0, i;
+
+	if (!tfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = tfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+	rup_group_id = rsrc_data->rup_group_id;
+
+	CAM_DBG(CAM_ISP, "TFE:%d Start resource index %d",
+		common_data->core_index, rsrc_data->out_id);
+
+	if (tfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid resource state:%d",
+			common_data->core_index, tfe_out->res_state);
+		return -EACCES;
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_tfe_bus_start_wm(rsrc_data->wm_res[i]);
+
+	rc = cam_tfe_bus_start_comp_grp(rsrc_data->comp_grp);
+
+	if (rsrc_data->is_dual && !rsrc_data->is_master &&
+		!tfe_out->rdi_only_ctx)
+		goto end;
+
+	if (common_data->rup_irq_enable[rup_group_id])
+		goto end;
+
+	/* Update the composite regupdate mask in bus irq mask*/
+	bus_irq_reg_mask_0 = cam_io_r(common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	bus_irq_reg_mask_0 |= (0x1 << rup_group_id);
+	cam_io_w_mb(bus_irq_reg_mask_0, common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	common_data->rup_irq_enable[rup_group_id] = true;
+
+end:
+	tfe_out->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_tfe_bus_stop_tfe_out(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node      *tfe_out = hw_priv;
+	struct cam_tfe_bus_tfe_out_data   *rsrc_data = NULL;
+	struct cam_tfe_bus_common_data    *common_data = NULL;
+	uint32_t bus_irq_reg_mask_0 = 0,  rup_group = 0;
+	int rc = 0, i;
+
+	if (!tfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = tfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+	rup_group = rsrc_data->rup_group_id;
+
+	if (tfe_out->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		tfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "tfe_out res_state is %d", tfe_out->res_state);
+		return rc;
+	}
+
+	rc = cam_tfe_bus_stop_comp_grp(rsrc_data->comp_grp);
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_tfe_bus_stop_wm(rsrc_data->wm_res[i]);
+
+
+	if (!common_data->rup_irq_enable[rup_group])
+		goto end;
+
+	/* disable composite regupdate mask in bus irq mask register*/
+	bus_irq_reg_mask_0 = cam_io_r(common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	bus_irq_reg_mask_0 &= ~(0x1 << rup_group);
+	cam_io_w_mb(bus_irq_reg_mask_0, common_data->mem_base +
+		common_data->common_reg->irq_mask[CAM_TFE_BUS_IRQ_REG0]);
+	common_data->rup_irq_enable[rup_group] = false;
+
+end:
+	tfe_out->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_tfe_bus_init_tfe_out_resource(uint32_t  index,
+	struct cam_tfe_bus_priv                  *bus_priv,
+	struct cam_tfe_bus_hw_info               *hw_info)
+{
+	struct cam_isp_resource_node         *tfe_out = NULL;
+	struct cam_tfe_bus_tfe_out_data *rsrc_data = NULL;
+	int rc = 0;
+	int32_t tfe_out_id = hw_info->tfe_out_hw_info[index].tfe_out_id;
+
+	if (tfe_out_id < 0 ||
+		tfe_out_id >= CAM_TFE_BUS_TFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "Init TFE Out failed, Invalid type=%d",
+			tfe_out_id);
+		return -EINVAL;
+	}
+
+	tfe_out = &bus_priv->tfe_out[tfe_out_id];
+	if (tfe_out->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		tfe_out->res_priv) {
+		CAM_ERR(CAM_ISP, "tfe_out_id %d has already been initialized",
+			tfe_out_id);
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_tfe_bus_tfe_out_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	tfe_out->res_priv = rsrc_data;
+
+	tfe_out->res_type = CAM_ISP_RESOURCE_TFE_OUT;
+	tfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&tfe_out->list);
+
+	rsrc_data->composite_group =
+		hw_info->tfe_out_hw_info[index].composite_group;
+	rsrc_data->rup_group_id    =
+		hw_info->tfe_out_hw_info[index].rup_group_id;
+	rsrc_data->out_id          =
+		hw_info->tfe_out_hw_info[index].tfe_out_id;
+	rsrc_data->common_data     = &bus_priv->common_data;
+	rsrc_data->max_width       =
+		hw_info->tfe_out_hw_info[index].max_width;
+	rsrc_data->max_height      =
+		hw_info->tfe_out_hw_info[index].max_height;
+	rsrc_data->secure_mode  = CAM_SECURE_MODE_NON_SECURE;
+	rsrc_data->mid = hw_info->tfe_out_hw_info[index].mid;
+
+	tfe_out->hw_intf = bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_tfe_bus_deinit_tfe_out_resource(
+	struct cam_isp_resource_node    *tfe_out)
+{
+	struct cam_tfe_bus_tfe_out_data *rsrc_data = tfe_out->res_priv;
+
+	if (tfe_out->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		CAM_DBG(CAM_ISP, "HW%d Res %d already deinitialized");
+		return 0;
+	}
+
+	tfe_out->start = NULL;
+	tfe_out->stop = NULL;
+	tfe_out->top_half_handler = NULL;
+	tfe_out->bottom_half_handler = NULL;
+	tfe_out->hw_intf = NULL;
+
+	tfe_out->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&tfe_out->list);
+	tfe_out->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static const char *cam_tfe_bus_rup_type(
+	uint32_t group_id)
+{
+	switch (group_id) {
+	case CAM_ISP_HW_TFE_IN_CAMIF:
+		return "CAMIF RUP";
+	case CAM_ISP_HW_TFE_IN_RDI0:
+		return "RDI0 RUP";
+	case CAM_ISP_HW_TFE_IN_RDI1:
+		return "RDI1 RUP";
+	case CAM_ISP_HW_TFE_IN_RDI2:
+		return "RDI2 RUP";
+	default:
+		return "invalid rup group";
+	}
+}
+static int cam_tfe_bus_rup_bottom_half(
+	struct cam_tfe_bus_priv            *bus_priv,
+	struct cam_tfe_irq_evt_payload *evt_payload)
+{
+	struct cam_tfe_bus_common_data     *common_data;
+	struct cam_tfe_bus_tfe_out_data    *out_rsrc_data;
+	struct cam_isp_hw_event_info        evt_info;
+	uint32_t i, j;
+
+	common_data = &bus_priv->common_data;
+	evt_info.hw_idx = bus_priv->common_data.core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_TFE_OUT;
+
+	for (i = 0; i < CAM_TFE_BUS_RUP_GRP_MAX; i++) {
+		if (!(evt_payload->bus_irq_val[0] &
+			bus_priv->comp_rup_done_mask))
+			break;
+
+		if (evt_payload->bus_irq_val[0] & BIT(i)) {
+			for (j = 0; j < CAM_TFE_BUS_TFE_OUT_MAX; j++) {
+				out_rsrc_data =
+					(struct cam_tfe_bus_tfe_out_data *)
+					bus_priv->tfe_out[j].res_priv;
+				if ((out_rsrc_data->rup_group_id == i) &&
+					(bus_priv->tfe_out[j].res_state ==
+					CAM_ISP_RESOURCE_STATE_STREAMING))
+					break;
+			}
+
+			if (j == CAM_TFE_BUS_TFE_OUT_MAX) {
+				CAM_ERR(CAM_ISP,
+					"TFE:%d out rsc active status[0]:0x%x",
+					bus_priv->common_data.core_index,
+					evt_payload->bus_irq_val[0]);
+				continue;
+			}
+
+			CAM_DBG(CAM_ISP, "TFE:%d Received %s",
+				bus_priv->common_data.core_index,
+				cam_tfe_bus_rup_type(i));
+			evt_info.res_id = i;
+			if (out_rsrc_data->event_cb) {
+				out_rsrc_data->event_cb(
+					out_rsrc_data->priv,
+					CAM_ISP_HW_EVENT_REG_UPDATE,
+					(void *)&evt_info);
+				/* reset the rup bit */
+				evt_payload->bus_irq_val[0] &= ~BIT(i);
+			} else
+				CAM_ERR(CAM_ISP,
+					"TFE:%d No event cb id:%lld evt id:%d",
+					bus_priv->common_data.core_index,
+					out_rsrc_data->out_id, evt_info.res_id);
+		}
+	}
+
+	return 0;
+}
+
+static uint32_t cam_tfe_bus_get_last_consumed_addr(
+	struct cam_tfe_bus_priv *bus_priv,
+	uint32_t out_id)
+{
+	uint32_t                             val = 0;
+	struct cam_isp_resource_node        *rsrc_node = NULL;
+	struct cam_tfe_bus_tfe_out_data     *rsrc_data = NULL;
+	struct cam_tfe_bus_wm_resource_data *wm_rsrc_data = NULL;
+
+	if (out_id >= CAM_TFE_BUS_TFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "invalid out_id:%u", out_id);
+		return 0;
+	}
+
+	rsrc_node = &bus_priv->tfe_out[out_id];
+	rsrc_data = rsrc_node->res_priv;
+	wm_rsrc_data = rsrc_data->wm_res[PLANE_Y]->res_priv;
+
+	val = cam_io_r_mb(
+		wm_rsrc_data->common_data->mem_base +
+		wm_rsrc_data->hw_regs->addr_status_0);
+
+	return val;
+}
+
+static int cam_tfe_bus_bufdone_bottom_half(
+	struct cam_tfe_bus_priv            *bus_priv,
+	struct cam_tfe_irq_evt_payload *evt_payload)
+{
+	struct cam_tfe_bus_common_data     *common_data;
+	struct cam_tfe_bus_tfe_out_data    *out_rsrc_data;
+	struct cam_isp_hw_event_info        evt_info;
+	struct cam_isp_resource_node       *out_rsrc = NULL;
+	struct cam_tfe_bus_comp_grp_data   *comp_rsrc_data;
+	uint32_t i, j;
+
+	common_data = &bus_priv->common_data;
+
+	for (i = 0; i < CAM_TFE_BUS_COMP_GRP_MAX; i++) {
+		if (!(evt_payload->bus_irq_val[0] &
+			bus_priv->comp_buf_done_mask))
+			break;
+
+		comp_rsrc_data = (struct cam_tfe_bus_comp_grp_data  *)
+			bus_priv->comp_grp[i].res_priv;
+
+		if (evt_payload->bus_irq_val[0] &
+			BIT(comp_rsrc_data->comp_grp_id +
+			bus_priv->common_data.comp_done_shift)) {
+			for (j = 0; j < comp_rsrc_data->acquire_dev_cnt; j++) {
+				out_rsrc = comp_rsrc_data->out_rsrc[j];
+				out_rsrc_data = out_rsrc->res_priv;
+				evt_info.res_type = out_rsrc->res_type;
+				evt_info.hw_idx = out_rsrc->hw_intf->hw_idx;
+				evt_info.res_id = out_rsrc->res_id;
+				evt_info.reg_val =
+					cam_tfe_bus_get_last_consumed_addr(
+						out_rsrc_data->bus_priv,
+						out_rsrc_data->out_id);
+				out_rsrc_data->event_cb(out_rsrc_data->priv,
+					CAM_ISP_HW_EVENT_DONE,
+					(void *)&evt_info);
+			}
+
+			evt_payload->bus_irq_val[0] &=
+				~BIT(comp_rsrc_data->comp_grp_id +
+				bus_priv->common_data.comp_done_shift);
+		}
+	}
+
+	return 0;
+}
+
+static void cam_tfe_bus_error_bottom_half(
+	struct cam_tfe_bus_priv            *bus_priv,
+	struct cam_tfe_irq_evt_payload     *evt_payload)
+{
+	struct cam_tfe_bus_wm_resource_data   *rsrc_data;
+	struct cam_tfe_bus_reg_offset_common  *common_reg;
+	uint32_t i, overflow_status, image_size_violation_status;
+	uint32_t ccif_violation_status;
+
+	common_reg = bus_priv->common_data.common_reg;
+
+	CAM_INFO(CAM_ISP, "BUS IRQ[0]:0x%x BUS IRQ[1]:0x%x",
+		evt_payload->bus_irq_val[0], evt_payload->bus_irq_val[1]);
+
+	overflow_status = cam_io_r_mb(bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->overflow_status);
+
+	image_size_violation_status  = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->image_size_violation_status);
+
+	ccif_violation_status = cam_io_r_mb(bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->ccif_violation_status);
+
+	CAM_INFO(CAM_ISP,
+		"ccif violation status:0x%x image size violation:0x%x overflow status:0x%x",
+		ccif_violation_status,
+		image_size_violation_status,
+		overflow_status);
+
+	/* Check the bus errors */
+	if (evt_payload->bus_irq_val[0] & BIT(common_reg->cons_violation_shift))
+		CAM_INFO(CAM_ISP, "CONS_VIOLATION");
+
+	if (evt_payload->bus_irq_val[0] & BIT(common_reg->violation_shift))
+		CAM_INFO(CAM_ISP, "VIOLATION");
+
+	if (evt_payload->bus_irq_val[0] &
+		BIT(common_reg->image_size_violation)) {
+		CAM_INFO(CAM_ISP, "IMAGE_SIZE_VIOLATION val :0x%x",
+			evt_payload->image_size_violation_status);
+
+		for (i = 0; i < CAM_TFE_BUS_MAX_CLIENTS; i++) {
+			if (!(evt_payload->image_size_violation_status >> i))
+				break;
+
+			if (evt_payload->image_size_violation_status & BIT(i)) {
+				rsrc_data = bus_priv->bus_client[i].res_priv;
+				CAM_INFO(CAM_ISP,
+					"WM:%d width 0x%x height:0x%x format:%d stride:0x%x offset:0x%x encfg:0x%x",
+					i,
+					rsrc_data->acquired_width,
+					rsrc_data->acquired_height,
+					rsrc_data->format,
+					rsrc_data->acquired_stride,
+					rsrc_data->offset,
+					rsrc_data->en_cfg);
+
+			CAM_INFO(CAM_ISP,
+				"WM:%d current width 0x%x height:0x%x stride:0x%x",
+				i,
+				rsrc_data->width,
+				rsrc_data->height,
+				rsrc_data->stride);
+
+			}
+		}
+	}
+
+	if (overflow_status) {
+		for (i = 0; i < CAM_TFE_BUS_MAX_CLIENTS; i++) {
+
+			if (!(evt_payload->overflow_status >> i))
+				break;
+
+			if (evt_payload->overflow_status & BIT(i)) {
+				rsrc_data = bus_priv->bus_client[i].res_priv;
+				CAM_INFO(CAM_ISP,
+					"WM:%d %s BUS OVERFLOW width0x%x height:0x%x format:%d stride:0x%x offset:0x%x encfg:%x",
+					i,
+					rsrc_data->hw_regs->client_name,
+					rsrc_data->acquired_width,
+					rsrc_data->acquired_height,
+					rsrc_data->format,
+					rsrc_data->acquired_stride,
+					rsrc_data->offset,
+					rsrc_data->en_cfg);
+
+				CAM_INFO(CAM_ISP,
+					"WM:%d current width:0x%x height:0x%x stride:0x%x",
+					i,
+					rsrc_data->width,
+					rsrc_data->height,
+					rsrc_data->stride);
+			}
+		}
+	}
+}
+
+static int cam_tfe_bus_bottom_half(void   *priv,
+	bool rup_process, struct cam_tfe_irq_evt_payload   *evt_payload,
+	bool error_process)
+{
+	struct cam_tfe_bus_priv          *bus_priv;
+	uint32_t val;
+
+	if (!priv || !evt_payload) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid priv param");
+		return -EINVAL;
+	}
+	bus_priv = (struct cam_tfe_bus_priv   *) priv;
+
+	if (error_process) {
+		cam_tfe_bus_error_bottom_half(bus_priv, evt_payload);
+		goto end;
+	}
+
+	/* if bus errors are there, mask all bus errors */
+	if (evt_payload->bus_irq_val[0] & bus_priv->bus_irq_error_mask[0]) {
+		val = cam_io_r(bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->irq_mask[0]);
+		val &= ~bus_priv->bus_irq_error_mask[0];
+		cam_io_w(val, bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->irq_mask[0]);
+
+	}
+
+	if (rup_process) {
+		if (evt_payload->bus_irq_val[0] &
+			bus_priv->comp_rup_done_mask)
+			cam_tfe_bus_rup_bottom_half(bus_priv, evt_payload);
+	} else {
+		if (evt_payload->bus_irq_val[0] &
+			bus_priv->comp_buf_done_mask)
+			cam_tfe_bus_bufdone_bottom_half(bus_priv, evt_payload);
+	}
+
+end:
+	return 0;
+
+}
+
+static int cam_tfe_bus_update_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv              *bus_priv;
+	struct cam_isp_hw_get_cmd_update     *update_buf;
+	struct cam_buf_io_cfg                *io_cfg;
+	struct cam_tfe_bus_tfe_out_data      *tfe_out_data = NULL;
+	struct cam_tfe_bus_wm_resource_data  *wm_data = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t i, j, size = 0;
+	uint32_t frame_inc = 0, val;
+
+	bus_priv = (struct cam_tfe_bus_priv  *) priv;
+	update_buf = (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *)
+		update_buf->res->res_priv;
+
+	if (!tfe_out_data || !tfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	if (update_buf->wm_update->num_buf != tfe_out_data->num_wm) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->wm_update->num_buf, tfe_out_data->num_wm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &tfe_out_data->common_data->io_buf_update[0];
+	io_cfg = update_buf->wm_update->io_cfg;
+
+	for (i = 0, j = 0; i < tfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		/* update width register */
+		val = ((wm_data->height << 16) | (wm_data->width & 0xFFFF));
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_cfg_0, val);
+		CAM_DBG(CAM_ISP, "WM:%d image height and width 0x%x",
+			wm_data->index, reg_val_pair[j-1]);
+
+		val = wm_data->offset;
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_cfg_1, val);
+		CAM_DBG(CAM_ISP, "WM:%d xinit 0x%x",
+			wm_data->index, reg_val_pair[j-1]);
+
+		if ((wm_data->index < 7) || ((wm_data->index >= 7) &&
+			(wm_data->mode == CAM_ISP_TFE_WM_LINE_BASED_MODE)) ||
+			(wm_data->out_id == CAM_TFE_BUS_TFE_OUT_PDAF)) {
+			CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_2,
+				io_cfg->planes[i].plane_stride);
+			wm_data->stride = io_cfg->planes[i].plane_stride;
+			CAM_DBG(CAM_ISP, "WM %d image stride 0x%x",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		frame_inc = io_cfg->planes[i].plane_stride *
+			io_cfg->planes[i].slice_height;
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_addr,
+			update_buf->wm_update->image_buf[i]);
+		CAM_DBG(CAM_ISP, "WM %d image address 0x%x",
+			wm_data->index, reg_val_pair[j-1]);
+		update_buf->wm_update->image_buf_offset[i] = 0;
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->frame_incr, frame_inc);
+		CAM_DBG(CAM_ISP, "WM %d frame_inc %d",
+			wm_data->index, reg_val_pair[j-1]);
+
+		/* enable the WM */
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg,
+			wm_data->en_cfg);
+	}
+
+	size = tfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_buf->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_buf->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	tfe_out_data->cdm_util_ops->cdm_write_regrandom(
+		update_buf->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_buf->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_tfe_bus_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv                  *bus_priv;
+	struct cam_isp_hw_get_cmd_update         *update_hfr;
+	struct cam_tfe_bus_tfe_out_data          *tfe_out_data = NULL;
+	struct cam_tfe_bus_wm_resource_data      *wm_data = NULL;
+	struct cam_isp_tfe_port_hfr_config       *hfr_cfg = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t  i, j, size = 0;
+
+	bus_priv = (struct cam_tfe_bus_priv  *) priv;
+	update_hfr =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *)
+		update_hfr->res->res_priv;
+
+	if (!tfe_out_data || !tfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	reg_val_pair = &tfe_out_data->common_data->io_buf_update[0];
+	hfr_cfg = (struct cam_isp_tfe_port_hfr_config *)update_hfr->data;
+
+	for (i = 0, j = 0; i < tfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->framedrop_pattern,
+			hfr_cfg->framedrop_pattern);
+		wm_data->framedrop_pattern = hfr_cfg->framedrop_pattern;
+		CAM_DBG(CAM_ISP, "WM:%d framedrop pattern 0x%x",
+			wm_data->index, wm_data->framedrop_pattern);
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->framedrop_period,
+			hfr_cfg->framedrop_period);
+		wm_data->framedrop_period = hfr_cfg->framedrop_period;
+		CAM_DBG(CAM_ISP, "WM:%d framedrop period 0x%x",
+			wm_data->index, wm_data->framedrop_period);
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->irq_subsample_period,
+			hfr_cfg->subsample_period);
+		wm_data->irq_subsample_period = hfr_cfg->subsample_period;
+		CAM_DBG(CAM_ISP, "WM:%d irq subsample period 0x%x",
+			wm_data->index, wm_data->irq_subsample_period);
+
+		CAM_TFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->irq_subsample_pattern,
+			hfr_cfg->subsample_pattern);
+		wm_data->irq_subsample_pattern = hfr_cfg->subsample_pattern;
+		CAM_DBG(CAM_ISP, "WM:%d irq subsample pattern 0x%x",
+			wm_data->index, wm_data->irq_subsample_pattern);
+	}
+
+	size = tfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_hfr->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_hfr->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	tfe_out_data->cdm_util_ops->cdm_write_regrandom(
+		update_hfr->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_hfr->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_tfe_bus_update_stripe_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv                     *bus_priv;
+	struct cam_tfe_dual_update_args             *stripe_args;
+	struct cam_tfe_bus_tfe_out_data             *tfe_out_data = NULL;
+	struct cam_tfe_bus_wm_resource_data         *wm_data = NULL;
+	struct cam_isp_tfe_dual_stripe_config       *stripe_config;
+	uint32_t i;
+
+	bus_priv = (struct cam_tfe_bus_priv  *) priv;
+	stripe_args = (struct cam_tfe_dual_update_args *)cmd_args;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data *)
+		stripe_args->res->res_priv;
+
+	if (!tfe_out_data) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	if (stripe_args->res->res_id < CAM_ISP_TFE_OUT_RES_BASE ||
+		stripe_args->res->res_id >= CAM_ISP_TFE_OUT_RES_MAX)
+		return 0;
+
+	stripe_config = (struct cam_isp_tfe_dual_stripe_config *)
+		stripe_args->stripe_config;
+
+	for (i = 0; i < tfe_out_data->num_wm; i++) {
+		stripe_config = &stripe_args->stripe_config[i];
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		wm_data->width = stripe_config->width;
+		wm_data->offset = stripe_config->offset;
+		CAM_DBG(CAM_ISP, "id:%x WM:%d width:0x%x offset:0x%x",
+			stripe_args->res->res_id, wm_data->index,
+			wm_data->width, wm_data->offset);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_bus_get_res_id_for_mid(
+	struct cam_tfe_bus_priv    *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_tfe_out_data     *tfe_out_data = NULL;
+	struct cam_isp_hw_get_cmd_update   *cmd_update =
+		(struct cam_isp_hw_get_cmd_update   *)cmd_args;
+	struct cam_isp_hw_get_res_for_mid       *get_res = NULL;
+	int i;
+
+	get_res = (struct cam_isp_hw_get_res_for_mid *)cmd_update->data;
+	if (!get_res) {
+		CAM_ERR(CAM_ISP,
+			"invalid get resource for mid paramas");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		tfe_out_data = (struct cam_tfe_bus_tfe_out_data  *)
+			bus_priv->tfe_out[i].res_priv;
+
+		if (!tfe_out_data)
+			continue;
+
+		if (tfe_out_data->mid == get_res->mid)
+			goto end;
+	}
+
+	if (i == bus_priv->num_out) {
+		CAM_ERR(CAM_ISP,
+			"mid:%d does not match with any out resource",
+			get_res->mid);
+		get_res->out_res_id = 0;
+		return -EINVAL;
+	}
+
+end:
+	CAM_INFO(CAM_ISP, "match mid :%d  out resource:%d found",
+		get_res->mid, bus_priv->tfe_out[i].res_id);
+	get_res->out_res_id = bus_priv->tfe_out[i].res_id;
+	return 0;
+}
+
+static int cam_tfe_bus_dump_bus_info(
+	struct cam_tfe_bus_priv    *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_tfe_out_data     *tfe_out_data = NULL;
+	struct cam_isp_hw_get_cmd_update   *cmd_update =
+		(struct cam_isp_hw_get_cmd_update   *)cmd_args;
+	struct cam_tfe_bus_wm_resource_data   *wm_data;
+	struct cam_tfe_bus_common_data        *common_data;
+	uint32_t i, addr_status0, addr_status1, addr_status2, addr_status3;
+
+	tfe_out_data = (struct cam_tfe_bus_tfe_out_data  *)
+		cmd_update->res->res_priv;
+	common_data = tfe_out_data->common_data;
+
+	for (i = 0; i < tfe_out_data->num_wm; i++) {
+		wm_data = tfe_out_data->wm_res[i]->res_priv;
+		addr_status0 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_0);
+		addr_status1 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_1);
+		addr_status2 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_2);
+		addr_status3 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_3);
+		CAM_INFO(CAM_ISP,
+			"TFE:%d WM:%d %s last consumed addr:0x%x last frame addr:0x%x fifo cnt:0x%x cur clt addr:0x%x",
+			common_data->hw_intf->hw_idx,
+			wm_data->index,
+			wm_data->hw_regs->client_name,
+			addr_status0,
+			addr_status1,
+			addr_status2,
+			addr_status3);
+
+		CAM_INFO(CAM_ISP,
+			"WM:%d %s width0x%x height:0x%x format:%d stride:0x%x offset:0x%x encfg:%x",
+			wm_data->index,
+			wm_data->hw_regs->client_name,
+			wm_data->acquired_width,
+			wm_data->acquired_height,
+			wm_data->format,
+			wm_data->acquired_stride,
+			wm_data->offset,
+			wm_data->en_cfg);
+
+		CAM_INFO(CAM_ISP,
+			"WM:%d current width:0x%x height:0x%x stride:0x%x",
+			wm_data->index,
+			wm_data->width,
+			wm_data->height,
+			wm_data->stride);
+	}
+
+	for (i = 0; i < CAM_TFE_BUS_MAX_CLIENTS; i++) {
+		wm_data = bus_priv->bus_client[i].res_priv;
+		/* disable WM */
+			cam_io_w_mb(0, common_data->mem_base +
+				wm_data->hw_regs->cfg);
+
+	}
+	return 0;
+}
+
+static int cam_tfe_bus_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv    *bus_priv = hw_priv;
+	uint32_t                   i, top_irq_reg_mask[3] = {0};
+	int rc = -EINVAL;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	top_irq_reg_mask[0] = (1 << bus_priv->top_bus_wr_irq_shift);
+
+	rc  = cam_tfe_irq_config(bus_priv->common_data.tfe_core_data,
+		top_irq_reg_mask, CAM_TFE_TOP_IRQ_REG_NUM, true);
+	if (rc)
+		return rc;
+
+	/* configure the error irq */
+	for (i = 0; i < CAM_TFE_BUS_IRQ_REGISTERS_MAX; i++)
+		cam_io_w(bus_priv->bus_irq_error_mask[i],
+			bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->irq_mask[i]);
+
+	return 0;
+}
+
+static int cam_tfe_bus_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv    *bus_priv = hw_priv;
+	uint32_t                    top_irq_reg_mask[3] = {0};
+	int                              rc = 0;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Error: Invalid args");
+		return -EINVAL;
+	}
+	top_irq_reg_mask[0] = (1 << bus_priv->top_bus_wr_irq_shift);
+	rc  = cam_tfe_irq_config(bus_priv->common_data.tfe_core_data,
+		top_irq_reg_mask, CAM_TFE_TOP_IRQ_REG_NUM, false);
+	if (rc)
+		return rc;
+
+	/* configure the error irq */
+	cam_io_w(0, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->irq_mask[0]);
+
+	cam_io_w_mb(0, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->irq_mask[1]);
+
+	return rc;
+}
+
+static int cam_tfe_bus_process_cmd(void *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bus_priv      *bus_priv;
+	int rc = -EINVAL;
+	uint32_t i, val;
+	bool *support_consumed_addr;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+		rc = cam_tfe_bus_update_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+		rc = cam_tfe_bus_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_SECURE_MODE:
+		rc = cam_tfe_bus_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+		rc = cam_tfe_bus_update_stripe_cfg(priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+		bus_priv = (struct cam_tfe_bus_priv  *) priv;
+		/* disable the bus error interrupts */
+		for (i = 0; i < CAM_TFE_BUS_IRQ_REGISTERS_MAX; i++) {
+			val = cam_io_r(bus_priv->common_data.mem_base +
+				bus_priv->common_data.common_reg->irq_mask[i]);
+			val &= ~bus_priv->bus_irq_error_mask[i];
+			cam_io_w(val, bus_priv->common_data.mem_base +
+				bus_priv->common_data.common_reg->irq_mask[i]);
+		}
+		break;
+	case CAM_ISP_HW_CMD_IS_CONSUMED_ADDR_SUPPORT:
+		bus_priv = (struct cam_tfe_bus_priv  *) priv;
+		support_consumed_addr = (bool *)cmd_args;
+		*support_consumed_addr =
+			bus_priv->common_data.support_consumed_addr;
+		break;
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+		rc = cam_tfe_bus_get_res_id_for_mid(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO:
+		rc = cam_tfe_bus_dump_bus_info(priv, cmd_args, arg_size);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid camif process command:%d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_tfe_bus_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *core_data,
+	struct cam_tfe_bus                  **tfe_bus)
+{
+	int i, rc = 0;
+	struct cam_tfe_bus_priv    *bus_priv = NULL;
+	struct cam_tfe_bus         *tfe_bus_local;
+	struct cam_tfe_bus_hw_info *hw_info = bus_hw_info;
+
+	if (!soc_info || !hw_intf || !bus_hw_info) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_hw_info);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	tfe_bus_local = kzalloc(sizeof(struct cam_tfe_bus), GFP_KERNEL);
+	if (!tfe_bus_local) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for tfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_tfe_bus_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for tfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+	tfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                   = hw_info->num_client;
+	bus_priv->num_out                      = hw_info->num_out;
+	bus_priv->top_bus_wr_irq_shift         = hw_info->top_bus_wr_irq_shift;
+	bus_priv->common_data.comp_done_shift  = hw_info->comp_done_shift;
+
+	bus_priv->common_data.num_sec_out      = 0;
+	bus_priv->common_data.secure_mode      = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index       = soc_info->index;
+	bus_priv->common_data.mem_base         =
+		CAM_SOC_GET_REG_MAP_START(soc_info, TFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf          = hw_intf;
+	bus_priv->common_data.tfe_core_data    = core_data;
+	bus_priv->common_data.common_reg       = &hw_info->common_reg;
+	bus_priv->comp_buf_done_mask      = hw_info->comp_buf_done_mask;
+	bus_priv->comp_rup_done_mask      = hw_info->comp_rup_done_mask;
+	bus_priv->common_data.support_consumed_addr =
+		hw_info->support_consumed_addr;
+
+	for (i = 0; i < CAM_TFE_BUS_IRQ_REGISTERS_MAX; i++)
+		bus_priv->bus_irq_error_mask[i] =
+			hw_info->bus_irq_error_mask[i];
+
+	if (strnstr(soc_info->compatible, "lite",
+		strlen(soc_info->compatible)) != NULL)
+		bus_priv->common_data.is_lite = true;
+	else
+		bus_priv->common_data.is_lite = false;
+
+	for (i = 0; i < CAM_TFE_BUS_RUP_GRP_MAX; i++)
+		bus_priv->common_data.rup_irq_enable[i] = false;
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_tfe_bus_init_wm_resource(i, bus_priv, bus_hw_info,
+			&bus_priv->bus_client[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init WM failed rc=%d", rc);
+			goto deinit_wm;
+		}
+	}
+
+	for (i = 0; i < CAM_TFE_BUS_COMP_GRP_MAX; i++) {
+		rc = cam_tfe_bus_init_comp_grp(i, soc_info,
+			bus_priv, bus_hw_info,
+			&bus_priv->comp_grp[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init Comp Grp failed rc=%d", rc);
+			goto deinit_comp_grp;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_tfe_bus_init_tfe_out_resource(i, bus_priv,
+			bus_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init TFE Out failed rc=%d", rc);
+			goto deinit_tfe_out;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+
+	tfe_bus_local->hw_ops.reserve      = cam_tfe_bus_acquire_tfe_out;
+	tfe_bus_local->hw_ops.release      = cam_tfe_bus_release_tfe_out;
+	tfe_bus_local->hw_ops.start        = cam_tfe_bus_start_tfe_out;
+	tfe_bus_local->hw_ops.stop         = cam_tfe_bus_stop_tfe_out;
+	tfe_bus_local->hw_ops.init         = cam_tfe_bus_init_hw;
+	tfe_bus_local->hw_ops.deinit       = cam_tfe_bus_deinit_hw;
+	tfe_bus_local->bottom_half_handler = cam_tfe_bus_bottom_half;
+	tfe_bus_local->hw_ops.process_cmd  = cam_tfe_bus_process_cmd;
+
+	*tfe_bus = tfe_bus_local;
+
+	return rc;
+
+deinit_tfe_out:
+	if (i < 0)
+		i = CAM_TFE_BUS_TFE_OUT_MAX;
+	for (--i; i >= 0; i--)
+		cam_tfe_bus_deinit_tfe_out_resource(&bus_priv->tfe_out[i]);
+
+deinit_comp_grp:
+	if (i < 0)
+		i = CAM_TFE_BUS_COMP_GRP_MAX;
+	for (--i; i >= 0; i--)
+		cam_tfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+
+deinit_wm:
+	if (i < 0)
+		i = bus_priv->num_client;
+	for (--i; i >= 0; i--)
+		cam_tfe_bus_deinit_wm_resource(&bus_priv->bus_client[i]);
+
+	kfree(tfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(tfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_tfe_bus_deinit(
+	struct cam_tfe_bus                  **tfe_bus)
+{
+	int i, rc = 0;
+	struct cam_tfe_bus_priv         *bus_priv = NULL;
+	struct cam_tfe_bus              *tfe_bus_local;
+
+	if (!tfe_bus || !*tfe_bus) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+	tfe_bus_local = *tfe_bus;
+	bus_priv = tfe_bus_local->bus_priv;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_tfe_bus_deinit_wm_resource(
+			&bus_priv->bus_client[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit WM failed rc=%d", rc);
+	}
+
+	for (i = 0; i < CAM_TFE_BUS_COMP_GRP_MAX; i++) {
+		rc = cam_tfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit Comp Grp failed rc=%d", rc);
+	}
+
+	for (i = 0; i < CAM_TFE_BUS_TFE_OUT_MAX; i++) {
+		rc = cam_tfe_bus_deinit_tfe_out_resource(
+			&bus_priv->tfe_out[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit TFE Out failed rc=%d", rc);
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+	kfree(tfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(tfe_bus_local);
+
+	*tfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.h
@@ -0,0 +1,253 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE_BUS_H_
+#define _CAM_TFE_BUS_H_
+
+#include "cam_soc_util.h"
+#include "cam_isp_hw.h"
+#include "cam_tfe_hw_intf.h"
+
+#define CAM_TFE_BUS_MAX_CLIENTS            10
+#define CAM_TFE_BUS_MAX_SUB_GRPS            4
+#define CAM_TFE_BUS_MAX_PERF_CNT_REG        8
+#define CAM_TFE_BUS_MAX_IRQ_REGISTERS       2
+#define CAM_TFE_BUS_CLIENT_NAME_MAX_LENGTH 32
+
+#define CAM_TFE_BUS_1_0             0x1000
+#define CAM_TFE_BUS_MAX_MID_PER_PORT        1
+
+
+#define CAM_TFE_ADD_REG_VAL_PAIR(buf_array, index, offset, val)    \
+	do {                                               \
+		buf_array[(index)++] = offset;             \
+		buf_array[(index)++] = val;                \
+	} while (0)
+
+#define ALIGNUP(value, alignment) \
+	((value + alignment - 1) / alignment * alignment)
+
+typedef int (*CAM_BUS_HANDLER_BOTTOM_HALF)(void      *bus_priv,
+	bool rup_process, struct cam_tfe_irq_evt_payload   *evt_payload,
+	bool error_process);
+
+enum cam_tfe_bus_plane_type {
+	PLANE_Y,
+	PLANE_C,
+	PLANE_MAX,
+};
+
+
+enum cam_tfe_bus_tfe_core_id {
+	CAM_TFE_BUS_TFE_CORE_0,
+	CAM_TFE_BUS_TFE_CORE_1,
+	CAM_TFE_BUS_TFE_CORE_2,
+	CAM_TFE_BUS_TFE_CORE_MAX,
+};
+
+enum cam_tfe_bus_comp_grp_id {
+	CAM_TFE_BUS_COMP_GRP_0,
+	CAM_TFE_BUS_COMP_GRP_1,
+	CAM_TFE_BUS_COMP_GRP_2,
+	CAM_TFE_BUS_COMP_GRP_3,
+	CAM_TFE_BUS_COMP_GRP_4,
+	CAM_TFE_BUS_COMP_GRP_5,
+	CAM_TFE_BUS_COMP_GRP_6,
+	CAM_TFE_BUS_COMP_GRP_7,
+	CAM_TFE_BUS_COMP_GRP_MAX,
+};
+
+enum cam_tfe_bus_rup_grp_id {
+	CAM_TFE_BUS_RUP_GRP_0,
+	CAM_TFE_BUS_RUP_GRP_1,
+	CAM_TFE_BUS_RUP_GRP_2,
+	CAM_TFE_BUS_RUP_GRP_3,
+	CAM_TFE_BUS_RUP_GRP_MAX,
+};
+
+enum cam_tfe_bus_tfe_out_id {
+	CAM_TFE_BUS_TFE_OUT_RDI0,
+	CAM_TFE_BUS_TFE_OUT_RDI1,
+	CAM_TFE_BUS_TFE_OUT_RDI2,
+	CAM_TFE_BUS_TFE_OUT_FULL,
+	CAM_TFE_BUS_TFE_OUT_RAW_DUMP,
+	CAM_TFE_BUS_TFE_OUT_PDAF,
+	CAM_TFE_BUS_TFE_OUT_STATS_HDR_BE,
+	CAM_TFE_BUS_TFE_OUT_STATS_HDR_BHIST,
+	CAM_TFE_BUS_TFE_OUT_STATS_TL_BG,
+	CAM_TFE_BUS_TFE_OUT_STATS_AWB_BG,
+	CAM_TFE_BUS_TFE_OUT_STATS_BF,
+	CAM_TFE_BUS_TFE_OUT_MAX,
+};
+
+/*
+ * struct cam_tfe_bus_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_tfe_bus_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t cgc_ovd;
+	uint32_t comp_cfg_0;
+	uint32_t comp_cfg_1;
+	uint32_t frameheader_cfg[4];
+	uint32_t pwr_iso_cfg;
+	uint32_t overflow_status_clear;
+	uint32_t ccif_violation_status;
+	uint32_t overflow_status;
+	uint32_t image_size_violation_status;
+	uint32_t perf_count_cfg[CAM_TFE_BUS_MAX_PERF_CNT_REG];
+	uint32_t perf_count_val[CAM_TFE_BUS_MAX_PERF_CNT_REG];
+	uint32_t perf_count_status;
+	uint32_t debug_status_top_cfg;
+	uint32_t debug_status_top;
+	uint32_t test_bus_ctrl;
+	uint32_t irq_mask[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t irq_clear[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t irq_status[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	uint32_t irq_cmd;
+	/* common register data */
+	uint32_t cons_violation_shift;
+	uint32_t violation_shift;
+	uint32_t image_size_violation;
+};
+
+/*
+ * struct cam_tfe_bus_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_tfe_bus_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t frame_incr;
+	uint32_t image_cfg_0;
+	uint32_t image_cfg_1;
+	uint32_t image_cfg_2;
+	uint32_t packer_cfg;
+	uint32_t bw_limit;
+	uint32_t frame_header_addr;
+	uint32_t frame_header_incr;
+	uint32_t frame_header_cfg;
+	uint32_t line_done_cfg;
+	uint32_t irq_subsample_period;
+	uint32_t irq_subsample_pattern;
+	uint32_t framedrop_period;
+	uint32_t framedrop_pattern;
+	uint32_t addr_status_0;
+	uint32_t addr_status_1;
+	uint32_t addr_status_2;
+	uint32_t addr_status_3;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	uint32_t comp_group;
+	/*bus data */
+	uint8_t  client_name[CAM_TFE_BUS_CLIENT_NAME_MAX_LENGTH];
+};
+
+/*
+ * struct cam_tfe_bus_tfe_out_hw_info:
+ *
+ * @Brief:           HW capability of TFE Bus Client
+ * tfe_out_id        Tfe out port id
+ * max_width         Max width supported by the outport
+ * max_height        Max height supported by outport
+ * composite_group   Out port composite group id
+ * rup_group_id      Reg update group of outport id
+ * mid:              ouport mid value
+ */
+struct cam_tfe_bus_tfe_out_hw_info {
+	enum cam_tfe_bus_tfe_out_id         tfe_out_id;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+	uint32_t                            composite_group;
+	uint32_t                            rup_group_id;
+	uint32_t                            mid;
+};
+
+/*
+ * struct cam_tfe_bus_hw_info:
+ *
+ * @Brief:                 HW register info for entire Bus
+ *
+ * @common_reg:            Common register details
+ * @num_client:            Total number of write clients
+ * @bus_client_reg:        Bus client register info
+ * @tfe_out_hw_info:       TFE output capability
+ * @comp_done_shift:       Mask shift for comp done mask
+ * @top_bus_wr_irq_shift:  Mask shift for top level BUS WR irq
+ * @comp_buf_done_mask:    Composite buf done bits mask
+ * @comp_rup_done_mask:    Reg update done mask
+ * @bus_irq_error_mask:    Bus irq error mask bits
+ * @support_consumed_addr: Indicate if bus support consumed address
+ */
+struct cam_tfe_bus_hw_info {
+	struct cam_tfe_bus_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_tfe_bus_reg_offset_bus_client
+		bus_client_reg[CAM_TFE_BUS_MAX_CLIENTS];
+	uint32_t num_out;
+	struct cam_tfe_bus_tfe_out_hw_info
+		tfe_out_hw_info[CAM_TFE_BUS_TFE_OUT_MAX];
+	uint32_t comp_done_shift;
+	uint32_t top_bus_wr_irq_shift;
+	uint32_t comp_buf_done_mask;
+	uint32_t comp_rup_done_mask;
+	uint32_t bus_irq_error_mask[CAM_TFE_BUS_IRQ_REGISTERS_MAX];
+	bool support_consumed_addr;
+};
+
+/*
+ * struct cam_tfe_bus:
+ *
+ * @Brief:                   Bus interface structure
+ *
+ * @bus_priv:                Private data of bus
+ * @hw_ops:                  Hardware interface functions
+ * @bottom_half_handler:     Bottom Half handler function
+ */
+struct cam_tfe_bus {
+	void                          *bus_priv;
+	struct cam_hw_ops              hw_ops;
+	CAM_BUS_HANDLER_BOTTOM_HALF    bottom_half_handler;
+};
+
+/*
+ * cam_tfe_bus_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @core_data:               Core data pointer used for top irq config
+ * @tfe_bus:                 Pointer to tfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_bus_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *core_data,
+	struct cam_tfe_bus                  **tfe_bus);
+
+/*
+ * cam_tfe_bus_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @tfe_bus:                 Pointer to tfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_bus_deinit(struct cam_tfe_bus     **tfe_bus);
+
+#endif /* _CAM_TFE_BUS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.c
@@ -0,0 +1,3046 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/timer.h>
+#include <linux/ratelimit.h>
+#include <media/cam_tfe.h>
+
+#include "cam_cdm_util.h"
+#include "cam_tasklet_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_tfe_soc.h"
+#include "cam_tfe_core.h"
+#include "cam_tfe_bus.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_compat.h"
+
+static const char drv_name[] = "tfe";
+
+#define CAM_TFE_HW_RESET_HW_AND_REG_VAL       0x1
+#define CAM_TFE_HW_RESET_HW_VAL               0x10000
+#define CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES 3
+#define CAM_TFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX  2
+#define CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES 3
+
+struct cam_tfe_top_common_data {
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_tfe_top_reg_offset_common       *common_reg;
+	struct cam_tfe_reg_dump_data               *reg_dump_data;
+};
+
+struct cam_tfe_top_priv {
+	struct cam_tfe_top_common_data      common_data;
+	struct cam_isp_resource_node        in_rsrc[CAM_TFE_TOP_IN_PORT_MAX];
+	unsigned long                       hw_clk_rate;
+	struct cam_axi_vote                 applied_axi_vote;
+	struct cam_axi_vote             req_axi_vote[CAM_TFE_TOP_IN_PORT_MAX];
+	unsigned long                   req_clk_rate[CAM_TFE_TOP_IN_PORT_MAX];
+	struct cam_axi_vote             last_vote[CAM_TFE_TOP_IN_PORT_MAX *
+					CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES];
+	uint32_t                        last_counter;
+	uint64_t                        total_bw_applied;
+	enum cam_tfe_bw_control_action
+		axi_vote_control[CAM_TFE_TOP_IN_PORT_MAX];
+	uint32_t                          irq_prepared_mask[3];
+	void                            *tasklet_info;
+	struct timespec64                sof_ts;
+	struct timespec64                epoch_ts;
+	struct timespec64                eof_ts;
+	struct timespec64                error_ts;
+	uint32_t                         top_debug;
+};
+
+struct cam_tfe_camif_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_tfe_top_reg_offset_common        *common_reg;
+	struct cam_tfe_camif_reg                    *camif_reg;
+	struct cam_tfe_camif_reg_data               *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+
+
+	cam_hw_mgr_event_cb_func           event_cb;
+	void                              *priv;
+	enum cam_isp_hw_sync_mode          sync_mode;
+	uint32_t                           dsp_mode;
+	uint32_t                           pix_pattern;
+	uint32_t                           left_first_pixel;
+	uint32_t                           left_last_pixel;
+	uint32_t                           right_first_pixel;
+	uint32_t                           right_last_pixel;
+	uint32_t                           first_line;
+	uint32_t                           last_line;
+	bool                               enable_sof_irq_debug;
+	uint32_t                           irq_debug_cnt;
+	uint32_t                           camif_debug;
+	uint32_t                           camif_pd_enable;
+	uint32_t                           dual_tfe_sync_sel;
+	uint32_t                           hbi_value;
+	uint32_t                           vbi_value;
+};
+
+struct cam_tfe_rdi_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_tfe_top_reg_offset_common        *common_reg;
+	struct cam_tfe_rdi_reg                      *rdi_reg;
+	struct cam_tfe_rdi_reg_data                 *reg_data;
+	cam_hw_mgr_event_cb_func                     event_cb;
+	void                                        *priv;
+	enum cam_isp_hw_sync_mode                    sync_mode;
+	uint32_t                                     pix_pattern;
+	uint32_t                                     left_first_pixel;
+	uint32_t                                     left_last_pixel;
+	uint32_t                                     first_line;
+	uint32_t                                     last_line;
+};
+
+static int cam_tfe_validate_pix_pattern(uint32_t pattern)
+{
+	int rc;
+
+	switch (pattern) {
+	case CAM_ISP_TFE_PATTERN_BAYER_RGRGRG:
+	case CAM_ISP_TFE_PATTERN_BAYER_GRGRGR:
+	case CAM_ISP_TFE_PATTERN_BAYER_BGBGBG:
+	case CAM_ISP_TFE_PATTERN_BAYER_GBGBGB:
+	case CAM_ISP_TFE_PATTERN_YUV_YCBYCR:
+	case CAM_ISP_TFE_PATTERN_YUV_YCRYCB:
+	case CAM_ISP_TFE_PATTERN_YUV_CBYCRY:
+	case CAM_ISP_TFE_PATTERN_YUV_CRYCBY:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error Invalid pix pattern:%d", pattern);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int cam_tfe_get_evt_payload(struct cam_tfe_hw_core_info *core_info,
+	struct cam_tfe_irq_evt_payload    **evt_payload)
+{
+	spin_lock(&core_info->spin_lock);
+	if (list_empty(&core_info->free_payload_list)) {
+		*evt_payload = NULL;
+		spin_unlock(&core_info->spin_lock);
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload, core id 0x%x",
+			core_info->core_index);
+		return -ENODEV;
+	}
+
+	*evt_payload = list_first_entry(&core_info->free_payload_list,
+		struct cam_tfe_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	spin_unlock(&core_info->spin_lock);
+
+	return 0;
+}
+
+int cam_tfe_put_evt_payload(void             *core_info,
+	struct cam_tfe_irq_evt_payload  **evt_payload)
+{
+	struct cam_tfe_hw_core_info        *tfe_core_info = core_info;
+	unsigned long                       flags;
+
+	if (!core_info) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&tfe_core_info->spin_lock, flags);
+	(*evt_payload)->error_type = 0;
+	list_add_tail(&(*evt_payload)->list, &tfe_core_info->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&tfe_core_info->spin_lock, flags);
+
+	return 0;
+}
+
+int cam_tfe_get_hw_caps(void *hw_priv, void *get_hw_cap_args,
+		uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+void cam_tfe_get_timestamp(struct cam_isp_timestamp *time_stamp)
+{
+	struct timespec64 ts;
+
+	ktime_get_boottime_ts64(&ts);
+	time_stamp->mono_time.tv_sec    = ts.tv_sec;
+	time_stamp->mono_time.tv_nsec   = ts.tv_nsec;
+}
+
+int cam_tfe_irq_config(void     *tfe_core_data,
+	uint32_t  *irq_mask, uint32_t num_reg, bool enable)
+{
+	struct cam_tfe_hw_core_info    *core_info;
+	struct cam_tfe_top_priv        *top_priv;
+	struct cam_hw_soc_info         *soc_info;
+	void __iomem                   *mem_base;
+	bool                            need_lock;
+	unsigned long                   flags = 0;
+	uint32_t i, val;
+
+	if (!tfe_core_data) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"Invalid core data");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info    *)tfe_core_data;
+	top_priv = (struct cam_tfe_top_priv        *)core_info->top_priv;
+	soc_info = (struct cam_hw_soc_info  *)top_priv->common_data.soc_info;
+	mem_base = soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+
+	need_lock = !in_irq();
+	if (need_lock)
+		spin_lock_irqsave(&core_info->spin_lock, flags);
+
+	for (i = 0; i < num_reg; i++) {
+		val = cam_io_r_mb(mem_base  +
+			core_info->tfe_hw_info->top_irq_mask[i]);
+		if (enable)
+			val |= irq_mask[i];
+		else
+			val &= ~irq_mask[i];
+		cam_io_w_mb(val, mem_base +
+			core_info->tfe_hw_info->top_irq_mask[i]);
+	}
+	if (need_lock)
+		spin_unlock_irqrestore(&core_info->spin_lock, flags);
+
+	return 0;
+}
+
+static void cam_tfe_log_tfe_in_debug_status(
+	struct cam_tfe_top_priv              *top_priv)
+{
+	void __iomem                         *mem_base;
+	struct cam_tfe_camif_data            *camif_data;
+	struct cam_tfe_rdi_data              *rdi_data;
+	uint32_t  i, val_0, val_1;
+
+	mem_base = top_priv->common_data.soc_info->reg_map[0].mem_base;
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if ((top_priv->in_rsrc[i].res_state !=
+			CAM_ISP_RESOURCE_STATE_STREAMING))
+			continue;
+
+		if (top_priv->in_rsrc[i].res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+			camif_data = (struct cam_tfe_camif_data  *)
+				top_priv->in_rsrc[i].res_priv;
+			val_0 = cam_io_r(mem_base  +
+				camif_data->camif_reg->debug_0);
+			val_1 = cam_io_r(mem_base  +
+				camif_data->camif_reg->debug_1);
+			CAM_INFO(CAM_ISP,
+				"camif debug1:0x%x Height:0x%x, width:0x%x",
+				val_1,
+				((val_0 >> 16) & 0x1FFF),
+				(val_0 & 0x1FFF));
+			CAM_INFO(CAM_ISP,
+				"Acquired sync mode:%d left start pxl:0x%x end_pixel:0x%x",
+				camif_data->sync_mode,
+				camif_data->left_first_pixel,
+				camif_data->left_last_pixel);
+
+			if (camif_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+				CAM_INFO(CAM_ISP,
+					"sync mode:%d right start pxl:0x%x end_pixel:0x%x",
+					camif_data->sync_mode,
+					camif_data->right_first_pixel,
+					camif_data->right_last_pixel);
+
+			CAM_INFO(CAM_ISP,
+				"Acquired line start:0x%x line end:0x%x",
+				camif_data->first_line,
+				camif_data->last_line);
+			CAM_INFO(CAM_ISP, "vbi_value:0x%x hbi_value:0x%x",
+				camif_data->vbi_value,
+				camif_data->hbi_value);
+
+		} else if ((top_priv->in_rsrc[i].res_id >=
+			CAM_ISP_HW_TFE_IN_RDI0) ||
+			(top_priv->in_rsrc[i].res_id <=
+			CAM_ISP_HW_TFE_IN_RDI2)) {
+			rdi_data = (struct cam_tfe_rdi_data  *)
+				top_priv->in_rsrc[i].res_priv;
+			val_0 = cam_io_r(mem_base  +
+				rdi_data->rdi_reg->rdi_debug_0);
+			val_1 = cam_io_r(mem_base  +
+				rdi_data->rdi_reg->rdi_debug_1);
+			CAM_INFO(CAM_ISP,
+				"RDI res id:%d debug1:0x%x Height:0x%x, width:0x%x",
+				top_priv->in_rsrc[i].res_id,
+				val_1, ((val_0 >> 16) & 0x1FFF),
+				(val_0 & 0x1FFF));
+			CAM_INFO(CAM_ISP,
+				"sync mode:%d left start pxl:0x%x end_pixel:0x%x",
+				rdi_data->sync_mode,
+				rdi_data->left_first_pixel,
+				rdi_data->left_last_pixel);
+			CAM_INFO(CAM_ISP,
+				"sync mode:%d line start:0x%x line end:0x%x",
+				rdi_data->sync_mode,
+				rdi_data->first_line,
+				rdi_data->last_line);
+		}
+	}
+}
+static void cam_tfe_log_error_irq_status(
+	struct cam_tfe_hw_core_info          *core_info,
+	struct cam_tfe_top_priv              *top_priv,
+	struct cam_tfe_irq_evt_payload       *evt_payload)
+{
+	struct cam_tfe_hw_info               *hw_info;
+	void __iomem                         *mem_base;
+	struct cam_hw_soc_info               *soc_info;
+	struct cam_tfe_soc_private           *soc_private;
+
+	struct cam_tfe_clc_hw_status         *clc_hw_status;
+	struct timespec64 ts;
+	uint32_t  i, val_0, val_1, val_2, val_3;
+
+
+	ktime_get_boottime_ts64(&ts);
+	hw_info = core_info->tfe_hw_info;
+	mem_base = top_priv->common_data.soc_info->reg_map[0].mem_base;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = top_priv->common_data.soc_info->soc_private;
+
+	CAM_INFO(CAM_ISP, "current monotonic time stamp seconds %lld:%lld",
+		ts.tv_sec, ts.tv_nsec/1000);
+	CAM_INFO(CAM_ISP,
+		"ERROR time %lld:%lld SOF %lld:%lld EPOCH %lld:%lld EOF %lld:%lld",
+		top_priv->error_ts.tv_sec,
+		top_priv->error_ts.tv_nsec/NSEC_PER_USEC,
+		top_priv->sof_ts.tv_sec,
+		top_priv->sof_ts.tv_nsec/NSEC_PER_USEC,
+		top_priv->epoch_ts.tv_sec,
+		top_priv->epoch_ts.tv_nsec/NSEC_PER_USEC,
+		top_priv->eof_ts.tv_sec,
+		top_priv->eof_ts.tv_nsec/NSEC_PER_USEC);
+
+	val_0 = cam_io_r(mem_base  +
+		top_priv->common_data.common_reg->debug_0);
+	val_1 = cam_io_r(mem_base  +
+		top_priv->common_data.common_reg->debug_1);
+	val_2 = cam_io_r(mem_base  +
+		top_priv->common_data.common_reg->debug_2);
+	val_3 = cam_io_r(mem_base  +
+		top_priv->common_data.common_reg->debug_3);
+
+	CAM_INFO(CAM_ISP, "TOP IRQ[0]:0x%x IRQ[1]:0x%x IRQ[2]:0x%x",
+		evt_payload->irq_reg_val[0], evt_payload->irq_reg_val[1],
+		evt_payload->irq_reg_val[2]);
+
+	CAM_INFO(CAM_ISP, "Top debug [0]:0x%x [1]:0x%x [2]:0x%x [3]:0x%x",
+		val_0, val_1, val_2, val_3);
+
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0x20, true, &val_0);
+	CAM_INFO(CAM_ISP, "tfe_niu_MaxWr_Low offset 0x20 val 0x%x",
+		val_0);
+
+	val_0 = cam_io_r(mem_base  +
+		top_priv->common_data.common_reg->perf_pixel_count);
+
+	val_1 = cam_io_r(mem_base  +
+		top_priv->common_data.common_reg->perf_line_count);
+
+	val_2 = cam_io_r(mem_base  +
+		top_priv->common_data.common_reg->perf_stall_count);
+
+	val_3 = cam_io_r(mem_base  +
+		top_priv->common_data.common_reg->perf_always_count);
+
+	CAM_INFO(CAM_ISP,
+		"Top perf cnt pix:0x%x line:0x%x stall:0x%x always:0x%x",
+		val_0, val_1, val_2, val_3);
+
+	clc_hw_status = hw_info->clc_hw_status_info;
+	for (i = 0; i < hw_info->num_clc; i++) {
+		val_0 = cam_io_r(mem_base  +
+			clc_hw_status[i].hw_status_reg);
+		if (val_0)
+			CAM_INFO(CAM_ISP,
+				"CLC HW status :name:%s offset:0x%x value:0x%x",
+				clc_hw_status[i].name,
+				clc_hw_status[i].hw_status_reg,
+				val_0);
+	}
+
+	cam_tfe_log_tfe_in_debug_status(top_priv);
+
+	/* Check the overflow errors */
+	if (evt_payload->irq_reg_val[0] & hw_info->error_irq_mask[0]) {
+		if (evt_payload->irq_reg_val[0] & BIT(8))
+			CAM_INFO(CAM_ISP, "PP_FRAME_DROP");
+
+		if (evt_payload->irq_reg_val[0] & BIT(9))
+			CAM_INFO(CAM_ISP, "RDI0_FRAME_DROP");
+
+		if (evt_payload->irq_reg_val[0] & BIT(10))
+			CAM_INFO(CAM_ISP, "RDI1_FRAME_DROP");
+
+		if (evt_payload->irq_reg_val[0] & BIT(11))
+			CAM_INFO(CAM_ISP, "RDI2_FRAME_DROP");
+
+		if (evt_payload->irq_reg_val[0] & BIT(16))
+			CAM_INFO(CAM_ISP, "PP_OVERFLOW");
+
+		if (evt_payload->irq_reg_val[0] & BIT(17))
+			CAM_INFO(CAM_ISP, "RDI0_OVERFLOW");
+
+		if (evt_payload->irq_reg_val[0] & BIT(18))
+			CAM_INFO(CAM_ISP, "RDI1_OVERFLOW");
+
+		if (evt_payload->irq_reg_val[0] & BIT(19))
+			CAM_INFO(CAM_ISP, "RDI2_OVERFLOW");
+	}
+
+	/* Check the violation errors */
+	if (evt_payload->irq_reg_val[2] & hw_info->error_irq_mask[2]) {
+		if (evt_payload->irq_reg_val[2] & BIT(0))
+			CAM_INFO(CAM_ISP, "PP_CAMIF_VIOLATION");
+
+		if (evt_payload->irq_reg_val[2] & BIT(1))
+			CAM_INFO(CAM_ISP, "PP_VIOLATION");
+
+		if (evt_payload->irq_reg_val[2] & BIT(2))
+			CAM_INFO(CAM_ISP, "RDI0_CAMIF_VIOLATION");
+
+		if (evt_payload->irq_reg_val[2] & BIT(3))
+			CAM_INFO(CAM_ISP, "RDI1_CAMIF_VIOLATION");
+
+		if (evt_payload->irq_reg_val[2] & BIT(4))
+			CAM_INFO(CAM_ISP, "RDI2_CAMIF_VIOLATION");
+
+		if (evt_payload->irq_reg_val[2] & BIT(5))
+			CAM_INFO(CAM_ISP, "DIAG_VIOLATION");
+
+		val_0 = cam_io_r(mem_base  +
+		top_priv->common_data.common_reg->violation_status);
+		CAM_INFO(CAM_ISP, "TOP Violation status:0x%x", val_0);
+	}
+
+	core_info->tfe_bus->bottom_half_handler(
+		core_info->tfe_bus->bus_priv, false, evt_payload, true);
+
+	CAM_INFO(CAM_ISP,
+		"TFE clock rate:%d TFE total bw applied:%lld",
+		top_priv->hw_clk_rate,
+		top_priv->total_bw_applied);
+	cam_cpas_log_votes();
+}
+
+static int cam_tfe_error_irq_bottom_half(
+	struct cam_tfe_hw_core_info          *core_info,
+	struct cam_tfe_top_priv              *top_priv,
+	struct cam_tfe_irq_evt_payload       *evt_payload,
+	cam_hw_mgr_event_cb_func              event_cb,
+	void                                 *event_cb_priv)
+{
+	struct cam_isp_hw_event_info         evt_info;
+	struct cam_tfe_hw_info              *hw_info;
+	uint32_t   error_detected = 0;
+
+	hw_info = core_info->tfe_hw_info;
+	evt_info.hw_idx = core_info->core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_TFE_IN;
+
+	if (evt_payload->irq_reg_val[0] & hw_info->error_irq_mask[0]) {
+		evt_info.err_type = CAM_TFE_IRQ_STATUS_OVERFLOW;
+		error_detected = 1;
+	}
+
+	if ((evt_payload->bus_irq_val[0] & hw_info->bus_error_irq_mask[0]) ||
+		(evt_payload->irq_reg_val[2] & hw_info->error_irq_mask[2])) {
+		evt_info.err_type = CAM_TFE_IRQ_STATUS_VIOLATION;
+		error_detected = 1;
+	}
+
+	if (error_detected) {
+		evt_info.err_type = CAM_TFE_IRQ_STATUS_OVERFLOW;
+		top_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		cam_tfe_log_error_irq_status(core_info, top_priv, evt_payload);
+		if (event_cb)
+			event_cb(event_cb_priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+		else
+			CAM_ERR(CAM_ISP, "TFE:%d invalid eventcb:",
+				core_info->core_index);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_rdi_irq_bottom_half(
+	struct cam_tfe_top_priv              *top_priv,
+	struct cam_isp_resource_node         *rdi_node,
+	bool                                  epoch_process,
+	struct cam_tfe_irq_evt_payload       *evt_payload)
+{
+	struct cam_tfe_rdi_data               *rdi_priv;
+	struct cam_isp_hw_event_info           evt_info;
+	struct cam_hw_info                    *hw_info;
+	struct cam_tfe_top_reg_offset_common  *common_reg;
+	uint32_t                               val, val2;
+
+	rdi_priv = (struct cam_tfe_rdi_data    *)rdi_node->res_priv;
+	hw_info = rdi_node->hw_intf->hw_priv;
+
+	evt_info.hw_idx   = rdi_node->hw_intf->hw_idx;
+	evt_info.res_id   = rdi_node->res_id;
+	evt_info.res_type = rdi_node->res_type;
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		rdi_priv->reg_data->eof_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EOF");
+		top_priv->eof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->eof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+	}
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		rdi_priv->reg_data->sof_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received SOF");
+		top_priv->sof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->sof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		if (top_priv->top_debug &
+			CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+			common_reg  = rdi_priv->common_reg;
+			val = cam_io_r(rdi_priv->mem_base +
+				common_reg->diag_sensor_status_0);
+			val2 =  cam_io_r(rdi_priv->mem_base +
+				common_reg->diag_sensor_status_1);
+			CAM_INFO(CAM_ISP,
+				"TFE:%d diag sensor hbi min error:%d neq hbi:%d HBI:%d VBI:%d",
+				rdi_node->hw_intf->hw_idx,
+				((val >> common_reg->diag_min_hbi_error_shift)
+					& 0x1),
+				((val >> common_reg->diag_neq_hbi_shift) & 0x1),
+				(val & common_reg->diag_sensor_hbi_mask),
+				val2);
+		}
+	}
+
+	if (epoch_process && (evt_payload->irq_reg_val[1] &
+		rdi_priv->reg_data->epoch0_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EPOCH0");
+		top_priv->epoch_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->epoch_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_camif_irq_bottom_half(
+	struct cam_tfe_top_priv              *top_priv,
+	struct cam_isp_resource_node         *camif_node,
+	bool                                  epoch_process,
+	struct cam_tfe_irq_evt_payload       *evt_payload)
+{
+	struct cam_tfe_camif_data             *camif_priv;
+	struct cam_isp_hw_event_info           evt_info;
+	struct cam_hw_info                    *hw_info;
+	struct cam_tfe_top_reg_offset_common  *common_reg;
+	uint32_t                              val, val2;
+
+	camif_priv = camif_node->res_priv;
+	hw_info = camif_node->hw_intf->hw_priv;
+	evt_info.hw_idx   = camif_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_node->res_id;
+	evt_info.res_type = camif_node->res_type;
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		camif_priv->reg_data->eof_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EOF");
+
+		top_priv->eof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->eof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+	}
+
+	if ((!epoch_process) && (evt_payload->irq_reg_val[1] &
+		camif_priv->reg_data->sof_irq_mask)) {
+		if ((camif_priv->enable_sof_irq_debug) &&
+			(camif_priv->irq_debug_cnt <=
+			CAM_TFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "Received SOF");
+
+			camif_priv->irq_debug_cnt++;
+			if (camif_priv->irq_debug_cnt ==
+				CAM_TFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+				camif_priv->enable_sof_irq_debug =
+					false;
+				camif_priv->irq_debug_cnt = 0;
+			}
+		} else
+			CAM_DBG(CAM_ISP, "Received SOF");
+
+		top_priv->sof_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->sof_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		if (top_priv->top_debug &
+			CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+			common_reg  = camif_priv->common_reg;
+			val = cam_io_r(camif_priv->mem_base +
+				common_reg->diag_sensor_status_0);
+			val2 =  cam_io_r(camif_priv->mem_base +
+				common_reg->diag_sensor_status_1);
+			CAM_INFO(CAM_ISP,
+				"TFE:%d diag sensor hbi min error:%d neq hbi:%d HBI:%d VBI:%d",
+				camif_node->hw_intf->hw_idx,
+				((val >> common_reg->diag_min_hbi_error_shift)
+					& 0x1),
+				((val >> common_reg->diag_neq_hbi_shift) & 0x1),
+				(val & common_reg->diag_sensor_hbi_mask),
+				val2);
+		}
+	}
+
+	if (epoch_process  && (evt_payload->irq_reg_val[1] &
+		camif_priv->reg_data->epoch0_irq_mask)) {
+		CAM_DBG(CAM_ISP, "Received EPOCH");
+
+		top_priv->epoch_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		top_priv->epoch_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+	}
+
+	return 0;
+}
+
+static int cam_tfe_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	struct cam_tfe_hw_core_info         *core_info;
+	struct cam_tfe_top_priv             *top_priv;
+	struct cam_tfe_irq_evt_payload      *evt_payload;
+	struct cam_tfe_camif_data           *camif_priv;
+	struct cam_tfe_rdi_data             *rdi_priv;
+	cam_hw_mgr_event_cb_func             event_cb = NULL;
+	void                                *event_cb_priv = NULL;
+	uint32_t i;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params handle_priv:%pK, evt_payload_priv:%pK",
+			handler_priv, evt_payload_priv);
+		return 0;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)handler_priv;
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	evt_payload = evt_payload_priv;
+
+	/* process sof and eof */
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if ((top_priv->in_rsrc[i].res_id ==
+			CAM_ISP_HW_TFE_IN_CAMIF) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING)) {
+			camif_priv = (struct cam_tfe_camif_data  *)
+				top_priv->in_rsrc[i].res_priv;
+			event_cb = camif_priv->event_cb;
+			event_cb_priv = camif_priv->priv;
+
+			if (camif_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_camif_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], false,
+					evt_payload);
+
+		} else if ((top_priv->in_rsrc[i].res_id >=
+			CAM_ISP_HW_TFE_IN_RDI0) &&
+			(top_priv->in_rsrc[i].res_id <=
+			CAM_ISP_HW_TFE_IN_RDI2) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) &&
+			top_priv->in_rsrc[i].rdi_only_ctx) {
+			rdi_priv = (struct cam_tfe_rdi_data *)
+				top_priv->in_rsrc[i].res_priv;
+			event_cb = rdi_priv->event_cb;
+			event_cb_priv = rdi_priv->priv;
+
+			if (rdi_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_rdi_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], false,
+					evt_payload);
+		}
+	}
+
+	/* process the irq errors */
+	cam_tfe_error_irq_bottom_half(core_info, top_priv, evt_payload,
+		event_cb, event_cb_priv);
+
+	/* process the reg update in the bus */
+	if (evt_payload->irq_reg_val[0] &
+		core_info->tfe_hw_info->bus_reg_irq_mask[0]) {
+		core_info->tfe_bus->bottom_half_handler(
+			core_info->tfe_bus->bus_priv, true, evt_payload, false);
+	}
+
+	/* process the epoch */
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if ((top_priv->in_rsrc[i].res_id ==
+			CAM_ISP_HW_TFE_IN_CAMIF) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING)) {
+			camif_priv = (struct cam_tfe_camif_data  *)
+				top_priv->in_rsrc[i].res_priv;
+			if (camif_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_camif_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], true,
+					evt_payload);
+		} else if ((top_priv->in_rsrc[i].res_id >=
+			CAM_ISP_HW_TFE_IN_RDI0) &&
+			(top_priv->in_rsrc[i].res_id <=
+			CAM_ISP_HW_TFE_IN_RDI2) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING)) {
+			rdi_priv = (struct cam_tfe_rdi_data *)
+				top_priv->in_rsrc[i].res_priv;
+			if (rdi_priv->reg_data->subscribe_irq_mask[1] &
+				evt_payload->irq_reg_val[1])
+				cam_tfe_rdi_irq_bottom_half(top_priv,
+					&top_priv->in_rsrc[i], true,
+					evt_payload);
+		}
+	}
+
+	/* process the bufone */
+	if (evt_payload->irq_reg_val[0] &
+		core_info->tfe_hw_info->bus_reg_irq_mask[0]) {
+		core_info->tfe_bus->bottom_half_handler(
+			core_info->tfe_bus->bus_priv, false, evt_payload,
+			false);
+	}
+
+	cam_tfe_put_evt_payload(core_info, &evt_payload);
+
+	return 0;
+}
+
+static int cam_tfe_irq_err_top_half(
+	struct cam_tfe_hw_core_info       *core_info,
+	void __iomem                      *mem_base,
+	uint32_t                          *top_irq_status,
+	uint32_t                          *bus_irq_status)
+{
+	uint32_t i;
+
+	if ((top_irq_status[0] &  core_info->tfe_hw_info->error_irq_mask[0]) ||
+		(top_irq_status[2] &
+		core_info->tfe_hw_info->error_irq_mask[2]) ||
+		(bus_irq_status[0] &
+		core_info->tfe_hw_info->bus_error_irq_mask[0])) {
+		CAM_ERR(CAM_ISP,
+			"Encountered Error: tfe:%d: Irq_status0=0x%x status2=0x%x",
+			core_info->core_index, top_irq_status[0],
+			top_irq_status[2]);
+		CAM_ERR(CAM_ISP,
+			"Encountered Error: tfe:%d:BUS Irq_status0=0x%x",
+			core_info->core_index, bus_irq_status[0]);
+
+		for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+			cam_io_w(0, mem_base +
+				core_info->tfe_hw_info->top_irq_mask[i]);
+
+		cam_io_w_mb(core_info->tfe_hw_info->global_clear_bitmask,
+			mem_base + core_info->tfe_hw_info->top_irq_cmd);
+	}
+
+	return 0;
+}
+
+irqreturn_t cam_tfe_irq(int irq_num, void *data)
+{
+	struct cam_hw_info             *tfe_hw;
+	struct cam_tfe_hw_core_info    *core_info;
+	struct cam_tfe_top_priv        *top_priv;
+	void __iomem                   *mem_base;
+	struct cam_tfe_irq_evt_payload  *evt_payload;
+	uint32_t  top_irq_status[CAM_TFE_TOP_IRQ_REG_NUM] = {0};
+	uint32_t   bus_irq_status[CAM_TFE_BUS_MAX_IRQ_REGISTERS] = {0};
+	uint32_t  i,  ccif_violation = 0, overflow_status = 0;
+	uint32_t    image_sz_violation = 0;
+	void        *bh_cmd = NULL;
+	int rc = -EINVAL;
+
+	if (!data)
+		return IRQ_NONE;
+
+	tfe_hw = (struct cam_hw_info *)data;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	mem_base = top_priv->common_data.soc_info->reg_map[0].mem_base;
+
+	if (tfe_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_ISP, "TFE:%d hw is not powered up",
+			core_info->core_index);
+		return IRQ_HANDLED;
+	}
+
+	spin_lock(&core_info->spin_lock);
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		top_irq_status[i] = cam_io_r(mem_base  +
+		core_info->tfe_hw_info->top_irq_status[i]);
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		cam_io_w(top_irq_status[i], mem_base +
+			core_info->tfe_hw_info->top_irq_clear[i]);
+
+	cam_io_w_mb(core_info->tfe_hw_info->global_clear_bitmask,
+		mem_base + core_info->tfe_hw_info->top_irq_cmd);
+
+	CAM_DBG(CAM_ISP, "TFE:%d IRQ status_0:0x%x status_1:0x%x status_2:0x%x",
+		core_info->core_index, top_irq_status[0],
+		top_irq_status[1], top_irq_status[2]);
+
+	if (top_irq_status[0] & core_info->tfe_hw_info->bus_reg_irq_mask[0]) {
+		for (i = 0; i < CAM_TFE_BUS_MAX_IRQ_REGISTERS; i++)
+			bus_irq_status[i] = cam_io_r(mem_base  +
+				core_info->tfe_hw_info->bus_irq_status[i]);
+
+		for (i = 0; i < CAM_TFE_BUS_MAX_IRQ_REGISTERS; i++)
+			cam_io_w(bus_irq_status[i], mem_base +
+				core_info->tfe_hw_info->bus_irq_clear[i]);
+
+		ccif_violation =  cam_io_r(mem_base  +
+			core_info->tfe_hw_info->bus_violation_reg);
+		overflow_status = cam_io_r(mem_base  +
+			core_info->tfe_hw_info->bus_overflow_reg);
+		image_sz_violation = cam_io_r(mem_base  +
+			core_info->tfe_hw_info->bus_image_size_vilation_reg);
+
+		cam_io_w(core_info->tfe_hw_info->global_clear_bitmask,
+			mem_base + core_info->tfe_hw_info->bus_irq_cmd);
+
+		CAM_DBG(CAM_ISP, "TFE:%d BUS IRQ status_0:0x%x status_1:0x%x",
+			core_info->core_index, bus_irq_status[0],
+			bus_irq_status[1]);
+	}
+	spin_unlock(&core_info->spin_lock);
+
+	/* check reset */
+	if ((top_irq_status[0] & core_info->tfe_hw_info->reset_irq_mask[0]) ||
+		(top_irq_status[1] &
+			core_info->tfe_hw_info->reset_irq_mask[1]) ||
+		(top_irq_status[2] &
+			core_info->tfe_hw_info->reset_irq_mask[2])) {
+		/* Reset ack */
+		complete(&core_info->reset_complete);
+		return IRQ_HANDLED;
+	}
+
+	/* Check the irq errors  */
+	cam_tfe_irq_err_top_half(core_info, mem_base, top_irq_status,
+		bus_irq_status);
+
+	rc  = cam_tfe_get_evt_payload(core_info, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ status0=0x%x status2=0x%x",
+			top_irq_status[0], top_irq_status[1]);
+		goto end;
+	}
+
+	cam_tfe_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		evt_payload->irq_reg_val[i] = top_irq_status[i];
+
+	for (i = 0; i < CAM_TFE_BUS_MAX_IRQ_REGISTERS; i++)
+		evt_payload->bus_irq_val[i] = bus_irq_status[i];
+
+	evt_payload->ccif_violation_status = ccif_violation;
+	evt_payload->overflow_status = overflow_status;
+	evt_payload->image_size_violation_status = image_sz_violation;
+
+	evt_payload->core_index = core_info->core_index;
+	evt_payload->core_info  = core_info;
+
+	rc = tasklet_bh_api.get_bh_payload_func(
+		top_priv->tasklet_info, &bh_cmd);
+	if (rc || !bh_cmd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No payload, IRQ handling frozen");
+		cam_tfe_put_evt_payload(core_info, &evt_payload);
+		goto end;
+	}
+
+	tasklet_bh_api.bottom_half_enqueue_func(
+		top_priv->tasklet_info,
+		bh_cmd,
+		core_info,
+		evt_payload,
+		cam_tfe_irq_bottom_half);
+
+end:
+	return IRQ_HANDLED;
+
+}
+
+static int cam_tfe_top_set_hw_clk_rate(
+	struct cam_tfe_top_priv *top_priv)
+{
+	struct cam_hw_soc_info        *soc_info = NULL;
+	int                            i, rc = 0;
+	unsigned long                  max_clk_rate = 0;
+
+	soc_info = top_priv->common_data.soc_info;
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->req_clk_rate[i] > max_clk_rate)
+			max_clk_rate = top_priv->req_clk_rate[i];
+	}
+	if (max_clk_rate == top_priv->hw_clk_rate)
+		return 0;
+
+	CAM_DBG(CAM_ISP, "TFE:%d Clock name=%s idx=%d clk=%llu",
+		top_priv->common_data.soc_info->index,
+		soc_info->clk_name[soc_info->src_clk_idx],
+		soc_info->src_clk_idx, max_clk_rate);
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, max_clk_rate);
+
+	if (!rc)
+		top_priv->hw_clk_rate = max_clk_rate;
+	else
+		CAM_ERR(CAM_ISP, "TFE:%d set src clock rate:%lld failed, rc=%d",
+		top_priv->common_data.soc_info->index, max_clk_rate,  rc);
+
+	return rc;
+}
+
+static int cam_tfe_top_get_hw_clk_rate(
+	struct cam_tfe_top_priv  *top_priv,
+	void                     *cmd_args,
+	uint32_t                  arg_size)
+{
+	struct cam_hw_soc_info   *soc_info;
+	uint32_t                 *curr_clk_rate;
+	int                      src_clk_idx;
+	int rc = 0;
+
+	if (!top_priv) {
+		CAM_ERR(CAM_ISP, "Error top_private NULL");
+		return -EINVAL;
+	}
+
+	soc_info = top_priv->common_data.soc_info;
+	src_clk_idx = soc_info->src_clk_idx;
+
+	curr_clk_rate = (uint32_t *)cmd_args;
+
+	rc = cam_soc_util_get_clk_rate(soc_info->clk[src_clk_idx],
+		soc_info->clk_name[src_clk_idx], curr_clk_rate);
+
+	CAM_DBG(CAM_ISP, "TFE clock rate %llu", *curr_clk_rate);
+
+	return rc;
+}
+
+static int cam_tfe_top_dynamic_clock_update(
+	struct cam_tfe_top_priv  *top_priv,
+	void                     *cmd_args,
+	uint32_t                 arg_size)
+{
+	struct cam_hw_soc_info   *soc_info;
+	int                      src_clk_idx;
+	uint32_t                 *clk_rate;
+	int rc = 0;
+
+	soc_info = top_priv->common_data.soc_info;
+	src_clk_idx = soc_info->src_clk_idx;
+
+	clk_rate = (uint32_t *)cmd_args;
+
+	CAM_DBG(CAM_ISP, "TFE clock rate %lld", *clk_rate);
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, *clk_rate);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"unable to set clock dynamically rate:%lld",
+			*clk_rate);
+		return rc;
+	}
+
+	return rc;
+}
+
+static struct cam_axi_vote *cam_tfe_top_delay_bw_reduction(
+	struct cam_tfe_top_priv *top_priv,
+	uint64_t *to_be_applied_bw)
+{
+	uint32_t i, j;
+	int vote_idx = -1;
+	uint64_t max_bw = 0;
+	uint64_t total_bw;
+	struct cam_axi_vote *curr_l_vote;
+
+	for (i = 0; i < (CAM_TFE_TOP_IN_PORT_MAX *
+		CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES); i++) {
+		total_bw = 0;
+		curr_l_vote = &top_priv->last_vote[i];
+		for (j = 0; j < curr_l_vote->num_paths; j++) {
+			if (total_bw >
+				(U64_MAX -
+				curr_l_vote->axi_path[j].camnoc_bw)) {
+				CAM_ERR(CAM_ISP, "Overflow at idx: %d", j);
+				return NULL;
+			}
+
+			total_bw += curr_l_vote->axi_path[j].camnoc_bw;
+		}
+
+		if (total_bw > max_bw) {
+			vote_idx = i;
+			max_bw = total_bw;
+		}
+	}
+
+	if (vote_idx < 0)
+		return NULL;
+
+	*to_be_applied_bw = max_bw;
+
+	return &top_priv->last_vote[vote_idx];
+}
+
+static int cam_tfe_top_set_axi_bw_vote(
+	struct cam_tfe_top_priv *top_priv,
+	bool start_stop)
+{
+	struct cam_axi_vote *agg_vote = NULL;
+	struct cam_axi_vote *to_be_applied_axi_vote = NULL;
+	struct cam_hw_soc_info   *soc_info = top_priv->common_data.soc_info;
+	struct cam_tfe_soc_private *soc_private = soc_info->soc_private;
+	int rc = 0;
+	uint32_t i;
+	uint32_t num_paths = 0;
+	uint64_t total_bw_new_vote = 0;
+	bool bw_unchanged = true;
+	bool apply_bw_update = false;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	agg_vote = kzalloc(sizeof(struct cam_axi_vote), GFP_KERNEL);
+	if (!agg_vote) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->axi_vote_control[i] ==
+			CAM_TFE_BW_CONTROL_INCLUDE) {
+			if (num_paths +
+				top_priv->req_axi_vote[i].num_paths >
+				CAM_CPAS_MAX_PATHS_PER_CLIENT) {
+				CAM_ERR(CAM_ISP,
+					"Required paths(%d) more than max(%d)",
+					num_paths +
+					top_priv->req_axi_vote[i].num_paths,
+					CAM_CPAS_MAX_PATHS_PER_CLIENT);
+				rc = -EINVAL;
+				goto free_mem;
+			}
+
+			memcpy(&agg_vote->axi_path[num_paths],
+				&top_priv->req_axi_vote[i].axi_path[0],
+				top_priv->req_axi_vote[i].num_paths *
+				sizeof(
+				struct cam_axi_per_path_bw_vote));
+			num_paths += top_priv->req_axi_vote[i].num_paths;
+		}
+	}
+
+	agg_vote->num_paths = num_paths;
+
+	for (i = 0; i < agg_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"tfe[%d] : New BW Vote : counter[%d] [%s][%s] [%llu %llu %llu]",
+			top_priv->common_data.hw_intf->hw_idx,
+			top_priv->last_counter,
+			cam_cpas_axi_util_path_type_to_string(
+			agg_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			agg_vote->axi_path[i].transac_type),
+			agg_vote->axi_path[i].camnoc_bw,
+			agg_vote->axi_path[i].mnoc_ab_bw,
+			agg_vote->axi_path[i].mnoc_ib_bw);
+
+		total_bw_new_vote += agg_vote->axi_path[i].camnoc_bw;
+	}
+
+	memcpy(&top_priv->last_vote[top_priv->last_counter], agg_vote,
+		sizeof(struct cam_axi_vote));
+	top_priv->last_counter = (top_priv->last_counter + 1) %
+		(CAM_TFE_TOP_IN_PORT_MAX *
+		CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES);
+
+	if ((agg_vote->num_paths != top_priv->applied_axi_vote.num_paths) ||
+		(total_bw_new_vote != top_priv->total_bw_applied))
+		bw_unchanged = false;
+
+	CAM_DBG(CAM_PERF,
+		"tfe[%d] : applied_total=%lld, new_total=%lld unchanged=%d, start_stop=%d",
+		top_priv->common_data.hw_intf->hw_idx,
+		top_priv->total_bw_applied, total_bw_new_vote,
+		bw_unchanged, start_stop);
+
+	if (bw_unchanged) {
+		CAM_DBG(CAM_ISP, "BW config unchanged");
+		rc = 0;
+		goto free_mem;
+	}
+
+	if (start_stop) {
+		/* need to vote current request immediately */
+		to_be_applied_axi_vote = agg_vote;
+		/* Reset everything, we can start afresh */
+		memset(top_priv->last_vote, 0x0, sizeof(struct cam_axi_vote) *
+			(CAM_TFE_TOP_IN_PORT_MAX *
+			CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES));
+		top_priv->last_counter = 0;
+		top_priv->last_vote[top_priv->last_counter] = *agg_vote;
+		top_priv->last_counter = (top_priv->last_counter + 1) %
+			(CAM_TFE_TOP_IN_PORT_MAX *
+			CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES);
+	} else {
+		/*
+		 * Find max bw request in last few frames. This will the bw
+		 * that we want to vote to CPAS now.
+		 */
+		to_be_applied_axi_vote =
+			cam_tfe_top_delay_bw_reduction(top_priv,
+			&total_bw_new_vote);
+		if (!to_be_applied_axi_vote) {
+			CAM_ERR(CAM_ISP, "to_be_applied_axi_vote is NULL");
+			rc = -EINVAL;
+			goto free_mem;
+		}
+	}
+
+	for (i = 0; i < to_be_applied_axi_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"tfe[%d] : Apply BW Vote : [%s][%s] [%llu %llu %llu]",
+			top_priv->common_data.hw_intf->hw_idx,
+			cam_cpas_axi_util_path_type_to_string(
+			to_be_applied_axi_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			to_be_applied_axi_vote->axi_path[i].transac_type),
+			to_be_applied_axi_vote->axi_path[i].camnoc_bw,
+			to_be_applied_axi_vote->axi_path[i].mnoc_ab_bw,
+			to_be_applied_axi_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	if ((to_be_applied_axi_vote->num_paths !=
+		top_priv->applied_axi_vote.num_paths) ||
+		(total_bw_new_vote != top_priv->total_bw_applied))
+		apply_bw_update = true;
+
+	CAM_DBG(CAM_PERF,
+		"tfe[%d] : Delayed update: applied_total=%lld, new_total=%lld apply_bw_update=%d, start_stop=%d",
+		top_priv->common_data.hw_intf->hw_idx,
+		top_priv->total_bw_applied, total_bw_new_vote,
+		apply_bw_update, start_stop);
+
+	if (apply_bw_update) {
+		rc = cam_cpas_update_axi_vote(soc_private->cpas_handle,
+			to_be_applied_axi_vote);
+		if (!rc) {
+			memcpy(&top_priv->applied_axi_vote,
+				to_be_applied_axi_vote,
+				sizeof(struct cam_axi_vote));
+			top_priv->total_bw_applied = total_bw_new_vote;
+		} else {
+			CAM_ERR(CAM_ISP, "BW request failed, rc=%d", rc);
+		}
+	}
+
+free_mem:
+	cam_free_clear((void *)agg_vote);
+	agg_vote = NULL;
+	return rc;
+}
+
+static int cam_tfe_top_get_base(struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(
+		top_priv->common_data.soc_info, TFE_CORE_BASE_IDX);
+
+	cdm_util_ops->cdm_write_changebase(
+	cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_tfe_top_get_reg_update(
+	struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_tfe_camif_data        *camif_rsrc_data = NULL;
+	struct cam_tfe_rdi_data          *rdi_rsrc_data = NULL;
+	struct cam_isp_resource_node     *in_res;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	in_res = cdm_args->res;
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	if (in_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+		camif_rsrc_data =  in_res->res_priv;
+		reg_val_pair[0] = camif_rsrc_data->camif_reg->reg_update_cmd;
+		reg_val_pair[1] =
+			camif_rsrc_data->reg_data->reg_update_cmd_data;
+	} else if ((in_res->res_id >= CAM_ISP_HW_TFE_IN_RDI0) &&
+		(in_res->res_id <= CAM_ISP_HW_TFE_IN_RDI2)) {
+		rdi_rsrc_data =  in_res->res_priv;
+		reg_val_pair[0] = rdi_rsrc_data->rdi_reg->reg_update_cmd;
+		reg_val_pair[1] = rdi_rsrc_data->reg_data->reg_update_cmd_data;
+	}
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_tfe_top_clock_update(
+	struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_clock_update_args     *clk_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   i, rc = 0;
+
+	clk_update =
+		(struct cam_tfe_clock_update_args *)cmd_args;
+	res = clk_update->node_res;
+
+	if (!res || !res->hw_intf->hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid input res %pK", res);
+		return -EINVAL;
+	}
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_TFE_IN ||
+		res->res_id >= CAM_ISP_HW_TFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			top_priv->req_clk_rate[i] = clk_update->clk_rate;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_DBG(CAM_ISP,
+			"TFE:%d Not ready to set clocks yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else
+		rc = cam_tfe_top_set_hw_clk_rate(top_priv);
+
+	return rc;
+}
+
+static int cam_tfe_top_bw_update(
+	struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bw_update_args        *bw_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_update = (struct cam_tfe_bw_update_args *)cmd_args;
+	res = bw_update->node_res;
+
+	if (!res || !res->hw_intf || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_TFE_IN ||
+		res->res_id >= CAM_ISP_HW_TFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_ISP_HW_TFE_IN_MAX; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			memcpy(&top_priv->req_axi_vote[i], &bw_update->isp_vote,
+				sizeof(struct cam_axi_vote));
+			top_priv->axi_vote_control[i] =
+				CAM_TFE_BW_CONTROL_INCLUDE;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"TFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_tfe_top_set_axi_bw_vote(top_priv, false);
+	}
+
+	return rc;
+}
+
+static int cam_tfe_top_bw_control(
+	struct cam_tfe_top_priv *top_priv,
+	 void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_bw_control_args       *bw_ctrl = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_ctrl = (struct cam_tfe_bw_control_args *)cmd_args;
+	res = bw_ctrl->node_res;
+
+	if (!res || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_TFE_IN ||
+		res->res_id >= CAM_ISP_HW_TFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		if (top_priv->in_rsrc[i].res_id == res->res_id) {
+			top_priv->axi_vote_control[i] = bw_ctrl->action;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"TFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_tfe_top_set_axi_bw_vote(top_priv, true);
+	}
+
+	return rc;
+}
+
+static int cam_tfe_top_get_reg_dump(
+	struct cam_tfe_top_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update  *reg_dump_cmd = cmd_args;
+	struct cam_tfe_soc_private        *soc_private;
+	struct cam_tfe_reg_dump_data      *reg_dump_data;
+	struct cam_hw_soc_info            *soc_info;
+	void __iomem                      *mem_base;
+	int i, j, num_reg_dump_entries;
+	uint32_t val_0, val_1, val_2, val_3, wm_offset, start_offset;
+	uint32_t end_offset, lut_word_size, lut_size, lut_bank_sel, lut_dmi_reg;
+
+	if (!reg_dump_cmd) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((reg_dump_cmd->res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(reg_dump_cmd->res->res_state ==
+		CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = top_priv->common_data.soc_info->soc_private;
+	mem_base = soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+	CAM_INFO(CAM_ISP, "dump tfe:%d registers",
+		top_priv->common_data.hw_intf->hw_idx);
+
+	reg_dump_data = top_priv->common_data.reg_dump_data;
+	num_reg_dump_entries = reg_dump_data->num_reg_dump_entries;
+	for (i = 0; i < num_reg_dump_entries; i++) {
+		start_offset = reg_dump_data->reg_entry[i].start_offset;
+		end_offset = reg_dump_data->reg_entry[i].end_offset;
+
+		for (j = start_offset; (j + 0xc) <= end_offset; j += 0x10) {
+			val_0 = cam_io_r_mb(mem_base + j);
+			val_1 = cam_io_r_mb(mem_base + j + 4);
+			val_2 = cam_io_r_mb(mem_base + j + 0x8);
+			val_3 = cam_io_r_mb(mem_base + j + 0xc);
+			CAM_INFO(CAM_ISP, "0x%04x=0x%08x 0x%08x 0x%08x 0x%08x",
+				j, val_0, val_1, val_2, val_3);
+		}
+	}
+
+	num_reg_dump_entries = reg_dump_data->num_lut_dump_entries;
+	for (i = 0; i < num_reg_dump_entries; i++) {
+		lut_bank_sel = reg_dump_data->lut_entry[i].lut_bank_sel;
+		lut_size = reg_dump_data->lut_entry[i].lut_addr_size;
+		lut_word_size = reg_dump_data->lut_entry[i].lut_word_size;
+		lut_dmi_reg = reg_dump_data->lut_entry[i].dmi_reg_offset;
+
+		cam_io_w_mb(lut_bank_sel, mem_base + lut_dmi_reg + 4);
+		cam_io_w_mb(0, mem_base + 0xC28);
+
+		for (j = 0; j < lut_size; j++) {
+			val_0 = cam_io_r_mb(mem_base + 0xC30);
+			CAM_INFO(CAM_ISP, "Bank%d:0x%x LO: 0x%x",
+				lut_bank_sel, j, val_0);
+		}
+	}
+	/* No mem selected */
+	cam_io_w_mb(0, mem_base + 0xC24);
+	cam_io_w_mb(0, mem_base + 0xC28);
+
+	start_offset = reg_dump_data->bus_start_addr;
+	end_offset = reg_dump_data->bus_write_top_end_addr;
+
+	CAM_INFO(CAM_ISP, "bus start addr:0x%x end_offset:0x%x",
+		start_offset, end_offset);
+
+	for (i = start_offset; (i + 0xc) <= end_offset; i += 0x10) {
+		val_0 = cam_io_r_mb(mem_base + i);
+		val_1 = cam_io_r_mb(mem_base + i + 4);
+		val_2 = cam_io_r_mb(mem_base + i + 0x8);
+		val_3 = cam_io_r_mb(mem_base + i + 0xc);
+		CAM_INFO(CAM_ISP, "0x%04x=0x%08x 0x%08x 0x%08x 0x%08x",
+			i, val_0, val_1, val_2, val_3);
+	}
+
+	wm_offset = reg_dump_data->bus_client_start_addr;
+
+	CAM_INFO(CAM_ISP, "bus wm offset:0x%x",
+		wm_offset);
+
+	for (j = 0; j < reg_dump_data->num_bus_clients; j++) {
+		for (i = 0x0; (i + 0xc) <= 0x3C; i += 0x10) {
+			val_0 = cam_io_r_mb(mem_base + wm_offset + i);
+			val_1 = cam_io_r_mb(mem_base + wm_offset + i + 4);
+			val_2 = cam_io_r_mb(mem_base + wm_offset + i + 0x8);
+			val_3 = cam_io_r_mb(mem_base + wm_offset + i + 0xc);
+			CAM_INFO(CAM_ISP, "0x%04x=0x%08x 0x%08x 0x%08x 0x%08x",
+				(wm_offset + i), val_0, val_1, val_2, val_3);
+		}
+		for (i = 0x60; (i + 0xc) <= 0x80; i += 0x10) {
+			val_0 = cam_io_r_mb(mem_base + wm_offset + i);
+			val_1 = cam_io_r_mb(mem_base + wm_offset + i + 4);
+			val_2 = cam_io_r_mb(mem_base + wm_offset + i + 0x8);
+			val_3 = cam_io_r_mb(mem_base + wm_offset + i + 0xc);
+			CAM_INFO(CAM_ISP, "0x%04x=0x%08x 0x%08x 0x%08x 0x%08x",
+				(wm_offset + i), val_0, val_1, val_2, val_3);
+		}
+		wm_offset += reg_dump_data->bus_client_offset;
+	}
+
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0x20, true, &val_0);
+	CAM_INFO(CAM_ISP, "tfe_niu_MaxWr_Low offset 0x20 val 0x%x",
+		val_0);
+
+	/* dump the clock votings */
+	CAM_INFO(CAM_ISP, "TFE:%d clk=%ld",
+		top_priv->common_data.hw_intf->hw_idx,
+		top_priv->hw_clk_rate);
+
+	return 0;
+}
+
+static int cam_tfe_hw_dump(
+	struct cam_tfe_hw_core_info *core_info,
+	void                        *cmd_args,
+	uint32_t                     arg_size)
+{
+	int                                i, j;
+	uint8_t                           *dst;
+	uint32_t                           reg_start_offset;
+	uint32_t                           reg_dump_size = 0;
+	uint32_t                           lut_dump_size = 0;
+	uint32_t                           num_lut_dump_entries = 0;
+	uint32_t                           num_reg;
+	uint32_t                           lut_word_size, lut_size;
+	uint32_t                           lut_bank_sel, lut_dmi_reg;
+	uint32_t                           val;
+	void __iomem                      *reg_base;
+	void __iomem                      *mem_base;
+	uint32_t                          *addr, *start;
+	uint64_t                          *clk_waddr, *clk_wstart;
+	size_t                             remain_len;
+	uint32_t                           min_len;
+	struct cam_hw_info                *tfe_hw_info;
+	struct cam_hw_soc_info            *soc_info;
+	struct cam_tfe_top_priv           *top_priv;
+	struct cam_tfe_soc_private        *soc_private;
+	struct cam_tfe_reg_dump_data      *reg_dump_data;
+	struct cam_isp_hw_dump_header     *hdr;
+	struct cam_isp_hw_dump_args       *dump_args =
+		(struct cam_isp_hw_dump_args *)cmd_args;
+
+	if (!dump_args || !core_info) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (!dump_args->cpu_addr || !dump_args->buf_len) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params %pK %zu",
+			(void *)dump_args->cpu_addr,
+			dump_args->buf_len);
+		return -EINVAL;
+	}
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ISP,
+			"Dump offset overshoot offset %zu buf_len %zu",
+			dump_args->offset, dump_args->buf_len);
+		return -ENOSPC;
+	}
+
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	tfe_hw_info =
+		(struct cam_hw_info *)(top_priv->common_data.hw_intf->hw_priv);
+	reg_dump_data = top_priv->common_data.reg_dump_data;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = top_priv->common_data.soc_info->soc_private;
+	mem_base = soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+
+	if (dump_args->is_dump_all) {
+
+		/*Dump registers size*/
+		for (i = 0; i < reg_dump_data->num_reg_dump_entries; i++)
+			reg_dump_size +=
+				(reg_dump_data->reg_entry[i].end_offset -
+				reg_dump_data->reg_entry[i].start_offset);
+
+		/*
+		 * We dump the offset as well, so the total size dumped becomes
+		 * multiplied by 2
+		 */
+		reg_dump_size *= 2;
+
+		/* LUT dump size */
+		for (i = 0; i < reg_dump_data->num_lut_dump_entries; i++)
+			lut_dump_size +=
+				((reg_dump_data->lut_entry[i].lut_addr_size) *
+				(reg_dump_data->lut_entry[i].lut_word_size/8));
+
+		num_lut_dump_entries = reg_dump_data->num_lut_dump_entries;
+	}
+
+	/*Minimum len comprises of:
+	 * lut_dump_size + reg_dump_size + sizeof dump_header +
+	 * (num_lut_dump_entries--> represents number of banks) +
+	 *  (misc number of words) * sizeof(uint32_t)
+	 */
+	min_len = lut_dump_size + reg_dump_size +
+		sizeof(struct cam_isp_hw_dump_header) +
+		(num_lut_dump_entries * sizeof(uint32_t)) +
+		(sizeof(uint32_t) * CAM_TFE_CORE_DUMP_MISC_NUM_WORDS);
+
+	remain_len = dump_args->buf_len - dump_args->offset;
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu, min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+
+	mutex_lock(&tfe_hw_info->hw_mutex);
+	if (tfe_hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "TFE:%d HW not powered up",
+			core_info->core_index);
+		mutex_unlock(&tfe_hw_info->hw_mutex);
+		return -EPERM;
+	}
+
+	if (!dump_args->is_dump_all)
+		goto dump_bw;
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	hdr->word_size = sizeof(uint32_t);
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "TFE_REG:");
+	addr = (uint32_t *)(dst + sizeof(struct cam_isp_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+	for (i = 0; i < reg_dump_data->num_reg_dump_entries; i++) {
+		num_reg  = (reg_dump_data->reg_entry[i].end_offset -
+			reg_dump_data->reg_entry[i].start_offset)/4;
+		reg_start_offset = reg_dump_data->reg_entry[i].start_offset;
+		reg_base = mem_base + reg_start_offset;
+		for (j = 0; j < num_reg; j++) {
+			addr[0] =
+				soc_info->mem_block[TFE_CORE_BASE_IDX]->start +
+				reg_start_offset + (j*4);
+			addr[1] = cam_io_r(reg_base + (j*4));
+			addr += 2;
+		}
+	}
+
+	/*Dump bus top registers*/
+	num_reg  = (reg_dump_data->bus_write_top_end_addr -
+			reg_dump_data->bus_start_addr)/4;
+	reg_base = mem_base + reg_dump_data->bus_start_addr;
+	reg_start_offset = soc_info->mem_block[TFE_CORE_BASE_IDX]->start +
+		reg_dump_data->bus_start_addr;
+	for (i = 0; i < num_reg; i++) {
+		addr[0] = reg_start_offset + (i*4);
+		addr[1] = cam_io_r(reg_base + (i*4));
+		addr += 2;
+	}
+
+	/* Dump bus clients */
+	reg_base = mem_base + reg_dump_data->bus_client_start_addr;
+	reg_start_offset = soc_info->mem_block[TFE_CORE_BASE_IDX]->start +
+		reg_dump_data->bus_client_start_addr;
+	for (j = 0; j < reg_dump_data->num_bus_clients; j++) {
+
+		for (i = 0; i <= 0x3c; i += 4) {
+			addr[0] = reg_start_offset + i;
+			addr[1] = cam_io_r(reg_base + i);
+			addr += 2;
+		}
+		for (i = 0x60; i <= 0x80; i += 4) {
+			addr[0] = reg_start_offset + (i*4);
+			addr[1] = cam_io_r(reg_base + (i*4));
+			addr += 2;
+		}
+		reg_base += reg_dump_data->bus_client_offset;
+		reg_start_offset += reg_dump_data->bus_client_offset;
+	}
+
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+
+	/* Dump LUT entries */
+	for (i = 0; i < reg_dump_data->num_lut_dump_entries; i++) {
+
+		lut_bank_sel = reg_dump_data->lut_entry[i].lut_bank_sel;
+		lut_size = reg_dump_data->lut_entry[i].lut_addr_size;
+		lut_word_size = reg_dump_data->lut_entry[i].lut_word_size;
+		lut_dmi_reg = reg_dump_data->lut_entry[i].dmi_reg_offset;
+		dst = (char *)dump_args->cpu_addr + dump_args->offset;
+		hdr = (struct cam_isp_hw_dump_header *)dst;
+		scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "LUT_REG:");
+		hdr->word_size = lut_word_size/8;
+		addr = (uint32_t *)(dst +
+			sizeof(struct cam_isp_hw_dump_header));
+		start = addr;
+		*addr++ = lut_bank_sel;
+		cam_io_w_mb(lut_bank_sel, mem_base + lut_dmi_reg + 4);
+		cam_io_w_mb(0, mem_base + 0xC28);
+		for (j = 0; j < lut_size; j++) {
+			*addr = cam_io_r_mb(mem_base + 0xc30);
+			addr++;
+		}
+		hdr->size = hdr->word_size * (addr - start);
+		dump_args->offset +=  hdr->size +
+			sizeof(struct cam_isp_hw_dump_header);
+	}
+	cam_io_w_mb(0, mem_base + 0xC24);
+	cam_io_w_mb(0, mem_base + 0xC28);
+
+dump_bw:
+	dst = (char *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "TFE_CLK_RATE_BW:");
+	clk_waddr = (uint64_t *)(dst +
+		sizeof(struct cam_isp_hw_dump_header));
+	clk_wstart = clk_waddr;
+	hdr->word_size = sizeof(uint64_t);
+	*clk_waddr++ = top_priv->hw_clk_rate;
+	*clk_waddr++ = top_priv->total_bw_applied;
+
+	hdr->size = hdr->word_size * (clk_waddr - clk_wstart);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+
+	dst = (char *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "TFE_NIU_MAXWR:");
+	addr = (uint32_t *)(dst +
+		sizeof(struct cam_isp_hw_dump_header));
+	start = addr;
+	hdr->word_size = sizeof(uint32_t);
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0x20, true, &val);
+	*addr++ = val;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+	mutex_unlock(&tfe_hw_info->hw_mutex);
+
+	CAM_DBG(CAM_ISP, "offset %zu", dump_args->offset);
+	return 0;
+}
+
+static int cam_tfe_camif_irq_reg_dump(
+	struct cam_tfe_hw_core_info    *core_info,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv            *top_priv;
+	struct cam_isp_hw_get_cmd_update   *cmd_update;
+	struct cam_isp_resource_node       *camif_res = NULL;
+	void __iomem                       *mem_base;
+	uint32_t i;
+
+	int rc = 0;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments\n");
+		return -EINVAL;
+	}
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	cmd_update = (struct cam_isp_hw_get_cmd_update  *)cmd_args;
+	camif_res = cmd_update->res;
+	mem_base = top_priv->common_data.soc_info->reg_map[0].mem_base;
+	if ((camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)) {
+		CAM_ERR(CAM_ISP, "Error! Invalid state\n");
+		return 0;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++) {
+		CAM_INFO(CAM_ISP,
+			"Core Id =%d TOP IRQ status[%d ] val 0x%x",
+			core_info->core_index, i,
+			cam_io_r_mb(mem_base +
+			core_info->tfe_hw_info->top_irq_status[i]));
+	}
+
+	for (i = 0; i < CAM_TFE_BUS_MAX_IRQ_REGISTERS; i++) {
+		CAM_INFO(CAM_ISP,
+			"Core Id =%d BUS IRQ status[%d ] val:0x%x",
+			core_info->core_index, i,
+			cam_io_r_mb(mem_base +
+			core_info->tfe_hw_info->bus_irq_status[i]));
+	}
+
+	return rc;
+}
+
+int cam_tfe_set_top_debug(struct cam_tfe_hw_core_info    *core_info,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv              *top_priv;
+	uint32_t                             *debug_val;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+	debug_val = (uint32_t  *)cmd_args;
+	top_priv->top_debug =  *debug_val;
+
+	CAM_DBG(CAM_ISP, "TFE:%d top debug set:%d",
+		core_info->core_index,
+		top_priv->top_debug);
+
+	return 0;
+}
+
+
+int cam_tfe_top_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv                 *top_priv;
+	struct cam_tfe_acquire_args             *args;
+	struct cam_tfe_hw_tfe_in_acquire_args   *acquire_args;
+	struct cam_tfe_camif_data               *camif_data;
+	struct cam_tfe_rdi_data                 *rdi_data;
+	uint32_t i;
+	int rc = -EINVAL;
+
+	if (!device_priv || !reserve_args) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv   *)device_priv;
+	args = (struct cam_tfe_acquire_args *)reserve_args;
+	acquire_args = &args->tfe_in;
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		CAM_DBG(CAM_ISP, "i :%d res_id:%d state:%d", i,
+			acquire_args->res_id, top_priv->in_rsrc[i].res_state);
+
+		if ((top_priv->in_rsrc[i].res_id == acquire_args->res_id) &&
+			(top_priv->in_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_AVAILABLE)) {
+			rc = cam_tfe_validate_pix_pattern(
+				acquire_args->in_port->pix_pattern);
+			if (rc)
+				return rc;
+
+			if (acquire_args->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+				camif_data = (struct cam_tfe_camif_data    *)
+					top_priv->in_rsrc[i].res_priv;
+				camif_data->pix_pattern =
+					acquire_args->in_port->pix_pattern;
+				camif_data->dsp_mode =
+					acquire_args->in_port->dsp_mode;
+				camif_data->left_first_pixel =
+					acquire_args->in_port->left_start;
+				camif_data->left_last_pixel =
+					acquire_args->in_port->left_end;
+				camif_data->right_first_pixel =
+					acquire_args->in_port->right_start;
+				camif_data->right_last_pixel =
+					acquire_args->in_port->right_end;
+				camif_data->first_line =
+					acquire_args->in_port->line_start;
+				camif_data->last_line =
+					acquire_args->in_port->line_end;
+				if (acquire_args->in_port->res_id == CAM_ISP_TFE_IN_RES_TPG)
+					camif_data->vbi_value = 0;
+				else
+					camif_data->vbi_value =
+						acquire_args->in_port->sensor_vbi;
+				camif_data->hbi_value =
+					acquire_args->in_port->sensor_hbi;
+				camif_data->camif_pd_enable =
+					acquire_args->camif_pd_enable;
+				camif_data->dual_tfe_sync_sel =
+					acquire_args->dual_tfe_sync_sel_idx;
+				camif_data->sync_mode = acquire_args->sync_mode;
+				camif_data->event_cb = args->event_cb;
+				camif_data->priv = args->priv;
+
+				CAM_DBG(CAM_ISP,
+					"TFE:%d pix_pattern:%d dsp_mode=%d",
+					top_priv->in_rsrc[i].hw_intf->hw_idx,
+					camif_data->pix_pattern,
+					camif_data->dsp_mode);
+			} else {
+				rdi_data = (struct cam_tfe_rdi_data      *)
+					top_priv->in_rsrc[i].res_priv;
+				rdi_data->pix_pattern =
+					acquire_args->in_port->pix_pattern;
+				rdi_data->sync_mode = acquire_args->sync_mode;
+				rdi_data->event_cb = args->event_cb;
+				rdi_data->priv = args->priv;
+				rdi_data->left_first_pixel =
+					acquire_args->in_port->left_start;
+				rdi_data->left_last_pixel =
+					acquire_args->in_port->left_end;
+				rdi_data->first_line =
+					acquire_args->in_port->line_start;
+				rdi_data->last_line =
+					acquire_args->in_port->line_end;
+			}
+
+			top_priv->in_rsrc[i].cdm_ops = acquire_args->cdm_ops;
+			top_priv->in_rsrc[i].tasklet_info = args->tasklet;
+			top_priv->in_rsrc[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			top_priv->tasklet_info = args->tasklet;
+			acquire_args->rsrc_node =
+				&top_priv->in_rsrc[i];
+			rc = 0;
+			break;
+		}
+	}
+
+	return rc;
+}
+
+int cam_tfe_top_release(void *device_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv            *top_priv;
+	struct cam_isp_resource_node       *in_res;
+
+	if (!device_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv   *)device_priv;
+	in_res = (struct cam_isp_resource_node *)release_args;
+
+	CAM_DBG(CAM_ISP, "TFE:%d resource id:%d in state %d",
+		in_res->hw_intf->hw_idx, in_res->res_id,
+		in_res->res_state);
+	if (in_res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Resource Invalid res_state :%d",
+			in_res->hw_intf->hw_idx, in_res->res_state);
+		return -EINVAL;
+	}
+	in_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	in_res->cdm_ops = NULL;
+	in_res->tasklet_info = NULL;
+	in_res->rdi_only_ctx = 0;
+
+	return 0;
+}
+
+static int cam_tfe_camif_resource_start(
+	struct cam_tfe_hw_core_info         *core_info,
+	struct cam_isp_resource_node        *camif_res)
+{
+	struct cam_tfe_camif_data           *rsrc_data;
+	struct cam_tfe_soc_private          *soc_private;
+	struct cam_tfe_top_priv             *top_priv;
+	uint32_t                             val = 0;
+	uint32_t                             epoch0_irq_mask;
+	uint32_t                             epoch1_irq_mask;
+	uint32_t                             computed_epoch_line_cfg;
+	uint32_t                             camera_hw_version = 0;
+
+	if (!camif_res || !core_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Invalid camif res res_state:%d",
+			core_info->core_index, camif_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_tfe_camif_data  *)camif_res->res_priv;
+	soc_private = rsrc_data->soc_info->soc_private;
+	top_priv = (struct cam_tfe_top_priv  *)core_info->top_priv;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error soc_private NULL",
+			core_info->core_index);
+		return -ENODEV;
+	}
+
+	/* Config tfe core*/
+	val = 0;
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val = (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	if ((rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) ||
+		(rsrc_data->sync_mode == CAM_ISP_HW_SYNC_MASTER)) {
+		val |= (1 << rsrc_data->reg_data->dual_tfe_pix_en_shift);
+		val |= ((rsrc_data->dual_tfe_sync_sel + 1) <<
+			rsrc_data->reg_data->dual_tfe_sync_sel_shift);
+	}
+
+	if (!rsrc_data->camif_pd_enable)
+		val |= (1 << rsrc_data->reg_data->camif_pd_rdi2_src_sel_shift);
+
+	/* enables the Delay Line CLC in the pixel pipeline */
+	val |= BIT(rsrc_data->reg_data->delay_line_en_shift);
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	CAM_DBG(CAM_ISP, "TFE:%d core_cfg 0 val:0x%x", core_info->core_index,
+		val);
+
+	if (cam_cpas_get_cpas_hw_version(&camera_hw_version))
+		CAM_ERR(CAM_ISP, "Failed to get HW version");
+
+	if (camera_hw_version == CAM_CPAS_TITAN_540_V100) {
+		val = cam_io_r(rsrc_data->mem_base +
+			rsrc_data->common_reg->core_cfg_1);
+		val &= ~BIT(0);
+		cam_io_w_mb(val, rsrc_data->mem_base +
+			rsrc_data->common_reg->core_cfg_1);
+		CAM_DBG(CAM_ISP, "TFE:%d core_cfg 1 val:0x%x",
+			core_info->core_index, val);
+	}
+
+	/* Epoch config */
+	epoch0_irq_mask = (((rsrc_data->last_line + rsrc_data->vbi_value) -
+			rsrc_data->first_line) / 2);
+	if (epoch0_irq_mask > (rsrc_data->last_line - rsrc_data->first_line))
+		epoch0_irq_mask = (rsrc_data->last_line -
+					rsrc_data->first_line);
+
+	epoch1_irq_mask = rsrc_data->reg_data->epoch_line_cfg &
+			0xFFFF;
+	computed_epoch_line_cfg = (epoch0_irq_mask << 16) |
+			epoch1_irq_mask;
+	cam_io_w_mb(computed_epoch_line_cfg,
+			rsrc_data->mem_base +
+			rsrc_data->camif_reg->epoch_irq_cfg);
+	CAM_DBG(CAM_ISP, "TFE:%d first_line: %u\n"
+			"last_line: %u\n"
+			"epoch_line_cfg: 0x%x",
+			core_info->core_index,
+			rsrc_data->first_line,
+			rsrc_data->last_line,
+			computed_epoch_line_cfg);
+
+	camif_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base + rsrc_data->camif_reg->reg_update_cmd);
+	CAM_DBG(CAM_ISP, "hw id:%d RUP val:%d", camif_res->hw_intf->hw_idx,
+		rsrc_data->reg_data->reg_update_cmd_data);
+
+	/* Disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
+	if (top_priv->top_debug & CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		val = cam_io_r_mb(rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+		val |= rsrc_data->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+	}
+
+	/* Enable the irq only for master or single tfe usecase */
+	if (rsrc_data->sync_mode != CAM_ISP_HW_SYNC_SLAVE)
+		cam_tfe_irq_config(core_info, rsrc_data->reg_data->subscribe_irq_mask,
+			CAM_TFE_TOP_IRQ_REG_NUM, true);
+
+	/* Program perf counters */
+	val = (1 << rsrc_data->reg_data->perf_cnt_start_cmd_shift) |
+		(1 << rsrc_data->reg_data->perf_cnt_continuous_shift) |
+		(1 << rsrc_data->reg_data->perf_client_sel_shift) |
+		(1 << rsrc_data->reg_data->perf_window_start_shift) |
+		(2 << rsrc_data->reg_data->perf_window_end_shift);
+	cam_io_w_mb(val,
+		rsrc_data->mem_base + rsrc_data->common_reg->perf_cnt_cfg);
+	CAM_DBG(CAM_ISP, "TFE:%d perf_cfg val:%d", core_info->core_index,
+		val);
+
+	/* Enable the top debug registers */
+	cam_io_w_mb(0x1,
+		rsrc_data->mem_base + rsrc_data->common_reg->debug_cfg);
+
+	CAM_DBG(CAM_ISP, "Start Camif TFE %d Done", core_info->core_index);
+	return 0;
+}
+
+int cam_tfe_top_start(struct cam_tfe_hw_core_info *core_info,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv                 *top_priv;
+	struct cam_isp_resource_node            *in_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_tfe_rdi_data                 *rsrc_rdi_data;
+	uint32_t val;
+	int rc = 0;
+
+	if (!start_args) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Invalid input arguments",
+			core_info->core_index);
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv *)core_info->top_priv;
+	in_res = (struct cam_isp_resource_node *)start_args;
+	hw_info = (struct cam_hw_info  *)in_res->hw_intf->hw_priv;
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR(CAM_ISP, "TFE:%d HW not powered up",
+			core_info->core_index);
+		rc = -EPERM;
+		goto end;
+	}
+
+	rc = cam_tfe_top_set_hw_clk_rate(top_priv);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d set_hw_clk_rate failed, rc=%d",
+			hw_info->soc_info.index, rc);
+		return rc;
+	}
+
+	rc = cam_tfe_top_set_axi_bw_vote(top_priv, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d set_axi_bw_vote failed, rc=%d",
+			core_info->core_index, rc);
+		return rc;
+	}
+
+	if (in_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+		cam_tfe_camif_resource_start(core_info, in_res);
+	} else if (in_res->res_id >= CAM_ISP_HW_TFE_IN_RDI0 &&
+		in_res->res_id <= CAM_ISP_HW_TFE_IN_RDI2) {
+		rsrc_rdi_data = (struct cam_tfe_rdi_data *) in_res->res_priv;
+		val = (rsrc_rdi_data->pix_pattern <<
+			rsrc_rdi_data->reg_data->pixel_pattern_shift);
+
+		val |= (1 << rsrc_rdi_data->reg_data->rdi_out_enable_shift);
+		cam_io_w_mb(val, rsrc_rdi_data->mem_base +
+			rsrc_rdi_data->rdi_reg->rdi_module_config);
+
+		/* Epoch config */
+		cam_io_w_mb(rsrc_rdi_data->reg_data->epoch_line_cfg,
+			rsrc_rdi_data->mem_base +
+			rsrc_rdi_data->rdi_reg->rdi_epoch_irq);
+
+		/* Reg Update */
+		cam_io_w_mb(rsrc_rdi_data->reg_data->reg_update_cmd_data,
+			rsrc_rdi_data->mem_base +
+			rsrc_rdi_data->rdi_reg->reg_update_cmd);
+		in_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+		/* Enable the irq */
+		if (in_res->rdi_only_ctx)
+			cam_tfe_irq_config(core_info,
+				rsrc_rdi_data->reg_data->subscribe_irq_mask,
+				CAM_TFE_TOP_IRQ_REG_NUM, true);
+
+		if (top_priv->top_debug &
+			CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+			val = cam_io_r_mb(rsrc_rdi_data->mem_base +
+				rsrc_rdi_data->common_reg->diag_config);
+			val |= ((rsrc_rdi_data->reg_data->enable_diagnostic_hw)|
+				(rsrc_rdi_data->reg_data->diag_sensor_sel <<
+				rsrc_rdi_data->reg_data->diag_sensor_shift));
+			cam_io_w_mb(val, rsrc_rdi_data->mem_base +
+				rsrc_rdi_data->common_reg->diag_config);
+		}
+
+		CAM_DBG(CAM_ISP, "TFE:%d Start RDI %d", core_info->core_index,
+			in_res->res_id - CAM_ISP_HW_TFE_IN_RDI0);
+	}
+
+	core_info->irq_err_config_cnt++;
+	if (core_info->irq_err_config_cnt == 1)  {
+		cam_tfe_irq_config(core_info,
+			core_info->tfe_hw_info->error_irq_mask,
+			CAM_TFE_TOP_IRQ_REG_NUM, true);
+		top_priv->error_ts.tv_sec = 0;
+		top_priv->error_ts.tv_nsec = 0;
+		top_priv->sof_ts.tv_sec = 0;
+		top_priv->sof_ts.tv_nsec = 0;
+		top_priv->epoch_ts.tv_sec = 0;
+		top_priv->epoch_ts.tv_nsec = 0;
+		top_priv->eof_ts.tv_sec = 0;
+		top_priv->eof_ts.tv_nsec = 0;
+	}
+
+end:
+	return rc;
+}
+
+int cam_tfe_top_stop(struct cam_tfe_hw_core_info *core_info,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_tfe_top_priv                 *top_priv;
+	struct cam_isp_resource_node            *in_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_tfe_camif_data               *camif_data;
+	struct cam_tfe_rdi_data                 *rsrc_rdi_data;
+	uint32_t val = 0;
+	int i, rc = 0;
+
+	if (!stop_args) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Invalid input arguments",
+			core_info->core_index);
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_tfe_top_priv   *)core_info->top_priv;
+	in_res = (struct cam_isp_resource_node *)stop_args;
+	hw_info = (struct cam_hw_info  *)in_res->hw_intf->hw_priv;
+
+	if (in_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		in_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	if (in_res->res_id == CAM_ISP_HW_TFE_IN_CAMIF) {
+		camif_data = (struct cam_tfe_camif_data *)in_res->res_priv;
+
+		cam_io_w_mb(0, camif_data->mem_base +
+			camif_data->camif_reg->module_cfg);
+
+		cam_tfe_irq_config(core_info,
+			camif_data->reg_data->subscribe_irq_mask,
+			CAM_TFE_TOP_IRQ_REG_NUM, false);
+
+		if (in_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+			in_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		val = cam_io_r_mb(camif_data->mem_base +
+				camif_data->common_reg->diag_config);
+		if (val & camif_data->reg_data->enable_diagnostic_hw) {
+			val &= ~camif_data->reg_data->enable_diagnostic_hw;
+			cam_io_w_mb(val, camif_data->mem_base +
+				camif_data->common_reg->diag_config);
+		}
+	}  else if ((in_res->res_id >= CAM_ISP_HW_TFE_IN_RDI0) &&
+		(in_res->res_id <= CAM_ISP_HW_TFE_IN_RDI2)) {
+		rsrc_rdi_data = (struct cam_tfe_rdi_data *) in_res->res_priv;
+		cam_io_w_mb(0x0, rsrc_rdi_data->mem_base +
+			rsrc_rdi_data->rdi_reg->rdi_module_config);
+
+		if (in_res->rdi_only_ctx)
+			cam_tfe_irq_config(core_info,
+				rsrc_rdi_data->reg_data->subscribe_irq_mask,
+				CAM_TFE_TOP_IRQ_REG_NUM, false);
+
+		if (in_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+			in_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res id:%d",
+			core_info->core_index, in_res->res_id);
+		return -EINVAL;
+	}
+
+	if (!rc) {
+		for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+			if (top_priv->in_rsrc[i].res_id == in_res->res_id) {
+				top_priv->req_clk_rate[i] = 0;
+				memset(&top_priv->req_axi_vote[i], 0,
+					sizeof(struct cam_axi_vote));
+				top_priv->axi_vote_control[i] =
+					CAM_TFE_BW_CONTROL_EXCLUDE;
+				break;
+			}
+		}
+	}
+
+	core_info->irq_err_config_cnt--;
+	if (!core_info->irq_err_config_cnt)
+		cam_tfe_irq_config(core_info,
+			core_info->tfe_hw_info->error_irq_mask,
+			CAM_TFE_TOP_IRQ_REG_NUM, false);
+
+	return rc;
+}
+
+int cam_tfe_top_init(
+	struct cam_hw_soc_info                 *soc_info,
+	struct cam_hw_intf                     *hw_intf,
+	void                                   *top_hw_info,
+	struct cam_tfe_hw_core_info            *core_info)
+{
+	struct cam_tfe_top_priv           *top_priv = NULL;
+	struct cam_tfe_top_hw_info        *hw_info = top_hw_info;
+	struct cam_tfe_soc_private        *soc_private = NULL;
+	struct cam_tfe_camif_data         *camif_priv = NULL;
+	struct cam_tfe_rdi_data           *rdi_priv = NULL;
+	int i, j, rc = 0;
+
+	top_priv = kzalloc(sizeof(struct cam_tfe_top_priv),
+		GFP_KERNEL);
+	if (!top_priv) {
+		CAM_DBG(CAM_ISP, "TFE:%DError Failed to alloc for tfe_top_priv",
+			core_info->core_index);
+		rc = -ENOMEM;
+		goto end;
+	}
+	core_info->top_priv = top_priv;
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error soc_private NULL",
+			core_info->core_index);
+		rc = -ENODEV;
+		goto free_tfe_top_priv;
+	}
+
+	top_priv->hw_clk_rate = 0;
+	memset(top_priv->last_vote, 0x0, sizeof(struct cam_axi_vote) *
+		(CAM_TFE_TOP_IN_PORT_MAX *
+		CAM_TFE_DELAY_BW_REDUCTION_NUM_FRAMES));
+	top_priv->last_counter = 0;
+
+	for (i = 0, j = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		top_priv->in_rsrc[i].res_type = CAM_ISP_RESOURCE_TFE_IN;
+		top_priv->in_rsrc[i].hw_intf = hw_intf;
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		top_priv->req_clk_rate[i] = 0;
+		memset(&top_priv->req_axi_vote[i], 0,
+			sizeof(struct cam_axi_vote));
+		top_priv->axi_vote_control[i] =
+			CAM_TFE_BW_CONTROL_EXCLUDE;
+
+		if (hw_info->in_port[i] == CAM_TFE_CAMIF_VER_1_0) {
+			top_priv->in_rsrc[i].res_id =
+				CAM_ISP_HW_TFE_IN_CAMIF;
+
+			camif_priv = kzalloc(sizeof(struct cam_tfe_camif_data),
+				GFP_KERNEL);
+			if (!camif_priv) {
+				CAM_DBG(CAM_ISP,
+					"TFE:%dError Failed to alloc for camif_priv",
+					core_info->core_index);
+				goto free_tfe_top_priv;
+			}
+
+			top_priv->in_rsrc[i].res_priv = camif_priv;
+
+			camif_priv->mem_base    =
+				soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+			camif_priv->camif_reg   =
+				hw_info->camif_hw_info.camif_reg;
+			camif_priv->common_reg  = hw_info->common_reg;
+			camif_priv->reg_data    =
+				hw_info->camif_hw_info.reg_data;
+			camif_priv->hw_intf     = hw_intf;
+			camif_priv->soc_info    = soc_info;
+
+		} else if (hw_info->in_port[i] ==
+			CAM_TFE_RDI_VER_1_0) {
+			top_priv->in_rsrc[i].res_id =
+				CAM_ISP_HW_TFE_IN_RDI0 + j;
+
+			rdi_priv = kzalloc(sizeof(struct cam_tfe_rdi_data),
+					GFP_KERNEL);
+			if (!rdi_priv) {
+				CAM_DBG(CAM_ISP,
+					"TFE:%d Error Failed to alloc for rdi_priv",
+					core_info->core_index);
+				goto deinit_resources;
+			}
+
+			top_priv->in_rsrc[i].res_priv = rdi_priv;
+
+			rdi_priv->mem_base   =
+				soc_info->reg_map[TFE_CORE_BASE_IDX].mem_base;
+			rdi_priv->hw_intf    = hw_intf;
+			rdi_priv->common_reg = hw_info->common_reg;
+			rdi_priv->rdi_reg    =
+				hw_info->rdi_hw_info[j].rdi_reg;
+			rdi_priv->reg_data =
+				hw_info->rdi_hw_info[j++].reg_data;
+		}  else {
+			CAM_WARN(CAM_ISP, "TFE:%d Invalid inport type: %u",
+				core_info->core_index, hw_info->in_port[i]);
+		}
+	}
+
+	top_priv->common_data.soc_info     = soc_info;
+	top_priv->common_data.hw_intf      = hw_intf;
+	top_priv->common_data.common_reg   = hw_info->common_reg;
+	top_priv->common_data.reg_dump_data = &hw_info->reg_dump_data;
+
+	return rc;
+
+deinit_resources:
+	for (--i; i >= 0; i--) {
+
+		top_priv->in_rsrc[i].start = NULL;
+		top_priv->in_rsrc[i].stop  = NULL;
+		top_priv->in_rsrc[i].process_cmd = NULL;
+		top_priv->in_rsrc[i].top_half_handler = NULL;
+		top_priv->in_rsrc[i].bottom_half_handler = NULL;
+
+		if (!top_priv->in_rsrc[i].res_priv)
+			continue;
+
+		kfree(top_priv->in_rsrc[i].res_priv);
+		top_priv->in_rsrc[i].res_priv = NULL;
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	}
+free_tfe_top_priv:
+	kfree(core_info->top_priv);
+	core_info->top_priv = NULL;
+end:
+	return rc;
+}
+
+
+int cam_tfe_top_deinit(struct cam_tfe_top_priv  *top_priv)
+{
+	int i, rc = 0;
+
+	if (!top_priv) {
+		CAM_ERR(CAM_ISP, "Error Invalid input");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_TFE_TOP_IN_PORT_MAX; i++) {
+		top_priv->in_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+		top_priv->in_rsrc[i].start = NULL;
+		top_priv->in_rsrc[i].stop  = NULL;
+		top_priv->in_rsrc[i].process_cmd = NULL;
+		top_priv->in_rsrc[i].top_half_handler = NULL;
+		top_priv->in_rsrc[i].bottom_half_handler = NULL;
+
+		if (!top_priv->in_rsrc[i].res_priv) {
+			CAM_ERR(CAM_ISP, "Error res_priv is NULL");
+			return -ENODEV;
+		}
+
+		kfree(top_priv->in_rsrc[i].res_priv);
+		top_priv->in_rsrc[i].res_priv = NULL;
+	}
+
+	return rc;
+}
+
+int cam_tfe_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_tfe_top_priv           *top_priv  = NULL;
+	struct cam_tfe_hw_info            *hw_info = NULL;
+	void __iomem                      *mem_base;
+	uint32_t *reset_reg_args = reset_core_args;
+	uint32_t i, reset_reg_val, irq_status[3];
+	int rc;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &tfe_hw->soc_info;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	top_priv = core_info->top_priv;
+	hw_info = core_info->tfe_hw_info;
+	mem_base = tfe_hw->soc_info.reg_map[TFE_CORE_BASE_IDX].mem_base;
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		irq_status[i] = cam_io_r(mem_base +
+			core_info->tfe_hw_info->top_irq_status[i]);
+
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		cam_io_w(irq_status[i], mem_base +
+			core_info->tfe_hw_info->top_irq_clear[i]);
+
+	cam_io_w_mb(core_info->tfe_hw_info->global_clear_bitmask,
+		mem_base + core_info->tfe_hw_info->top_irq_cmd);
+
+	/* Mask all irq registers */
+	for (i = 0; i < CAM_TFE_TOP_IRQ_REG_NUM; i++)
+		cam_io_w(0, mem_base +
+			core_info->tfe_hw_info->top_irq_mask[i]);
+
+	cam_tfe_irq_config(core_info, hw_info->reset_irq_mask,
+		CAM_TFE_TOP_IRQ_REG_NUM, true);
+
+	reinit_completion(&core_info->reset_complete);
+
+	CAM_DBG(CAM_ISP, "calling RESET on tfe %d", soc_info->index);
+
+	switch (*reset_reg_args) {
+	case CAM_TFE_HW_RESET_HW_AND_REG:
+		reset_reg_val = CAM_TFE_HW_RESET_HW_AND_REG_VAL;
+		break;
+	default:
+		reset_reg_val = CAM_TFE_HW_RESET_HW_VAL;
+		break;
+	}
+
+	cam_io_w_mb(reset_reg_val, mem_base +
+		top_priv->common_data.common_reg->global_reset_cmd);
+
+	CAM_DBG(CAM_ISP, "TFE:%d waiting for tfe reset complete",
+		core_info->core_index);
+	/* Wait for Completion or Timeout of 100ms */
+	rc = wait_for_completion_timeout(&core_info->reset_complete,
+		msecs_to_jiffies(100));
+	if (rc <= 0) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error Reset Timeout",
+			core_info->core_index);
+		rc = -ETIMEDOUT;
+	} else {
+		rc = 0;
+		CAM_DBG(CAM_ISP, "TFE:%d reset complete done (%d)",
+			core_info->core_index, rc);
+	}
+
+	CAM_DBG(CAM_ISP, "TFE:%d reset complete done (%d)",
+		core_info->core_index, rc);
+
+	cam_tfe_irq_config(core_info, hw_info->reset_irq_mask,
+		CAM_TFE_TOP_IRQ_REG_NUM, false);
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+int cam_tfe_init_hw(void *hw_priv, void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *tfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_tfe_top_priv           *top_priv;
+	void __iomem                      *mem_base;
+	int rc = 0;
+	uint32_t                           reset_core_args =
+					CAM_TFE_HW_RESET_HW_AND_REG;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &tfe_hw->soc_info;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	top_priv = (struct cam_tfe_top_priv *)core_info->top_priv;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	tfe_hw->open_count++;
+	if (tfe_hw->open_count > 1) {
+		mutex_unlock(&tfe_hw->hw_mutex);
+		CAM_DBG(CAM_ISP, "TFE:%d has already been initialized cnt %d",
+			core_info->core_index, tfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	/* Turn ON Regulators, Clocks and other SOC resources */
+	rc = cam_tfe_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Enable SOC failed");
+		rc = -EFAULT;
+		goto decrement_open_cnt;
+	}
+	tfe_hw->hw_state = CAM_HW_STATE_POWER_UP;
+
+	mem_base = tfe_hw->soc_info.reg_map[TFE_CORE_BASE_IDX].mem_base;
+	CAM_DBG(CAM_ISP, "TFE:%d Enable soc done", core_info->core_index);
+
+	/* Do HW Reset */
+	rc = cam_tfe_reset(hw_priv, &reset_core_args, sizeof(uint32_t));
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d Reset Failed rc=%d",
+			core_info->core_index, rc);
+		goto disable_soc;
+	}
+
+	top_priv->hw_clk_rate = 0;
+	core_info->irq_err_config_cnt = 0;
+	core_info->irq_err_config = false;
+	rc = core_info->tfe_bus->hw_ops.init(core_info->tfe_bus->bus_priv,
+		NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d Top HW init Failed rc=%d",
+			core_info->core_index, rc);
+		goto disable_soc;
+	}
+
+	return rc;
+
+disable_soc:
+	cam_tfe_disable_soc_resources(soc_info);
+	tfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+decrement_open_cnt:
+	mutex_lock(&tfe_hw->hw_mutex);
+	tfe_hw->open_count--;
+	mutex_unlock(&tfe_hw->hw_mutex);
+	return rc;
+}
+
+int cam_tfe_deinit_hw(void *hw_priv, void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *tfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+	uint32_t                           reset_core_args =
+					CAM_TFE_HW_RESET_HW_AND_REG;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &tfe_hw->soc_info;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (!tfe_hw->open_count) {
+		mutex_unlock(&tfe_hw->hw_mutex);
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "TFE:%d Error Unbalanced deinit",
+			core_info->core_index);
+		return -EFAULT;
+	}
+	tfe_hw->open_count--;
+	if (tfe_hw->open_count) {
+		mutex_unlock(&tfe_hw->hw_mutex);
+		CAM_DBG(CAM_ISP, "TFE:%d open_cnt non-zero =%d",
+			core_info->core_index, tfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	rc = core_info->tfe_bus->hw_ops.deinit(core_info->tfe_bus->bus_priv,
+		NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_ISP, "TFE:%d Bus HW deinit Failed rc=%d",
+			core_info->core_index, rc);
+
+	rc = cam_tfe_reset(hw_priv, &reset_core_args, sizeof(uint32_t));
+
+	/* Turn OFF Regulators, Clocks and other SOC resources */
+	CAM_DBG(CAM_ISP, "TFE:%d Disable SOC resource", core_info->core_index);
+	rc = cam_tfe_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, " TFE:%d Disable SOC failed",
+			core_info->core_index);
+
+	tfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+int cam_tfe_reserve(void *hw_priv, void *reserve_args, uint32_t arg_size)
+{
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_tfe_acquire_args       *acquire;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_tfe_acquire_args))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	acquire = (struct cam_tfe_acquire_args   *)reserve_args;
+
+	CAM_DBG(CAM_ISP, "TFE:%d acquire res type: %d",
+		core_info->core_index, acquire->rsrc_type);
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (acquire->rsrc_type == CAM_ISP_RESOURCE_TFE_IN) {
+		rc = cam_tfe_top_reserve(core_info->top_priv,
+		reserve_args, arg_size);
+	} else if (acquire->rsrc_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		rc = core_info->tfe_bus->hw_ops.reserve(
+			core_info->tfe_bus->bus_priv, acquire,
+			sizeof(*acquire));
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res type:%d",
+			core_info->core_index, acquire->rsrc_type);
+	}
+
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	return rc;
+}
+
+
+int cam_tfe_release(void *hw_priv, void *release_args, uint32_t arg_size)
+{
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node      *) release_args;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_TFE_IN)
+		rc = cam_tfe_top_release(core_info->top_priv, isp_res,
+			sizeof(*isp_res));
+	else if (isp_res->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		rc = core_info->tfe_bus->hw_ops.release(
+			core_info->tfe_bus->bus_priv, isp_res,
+			sizeof(*isp_res));
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res type:%d",
+			core_info->core_index, isp_res->res_type);
+	}
+
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_tfe_start(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *start_res;
+
+	int rc = 0;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	start_res = (struct cam_isp_resource_node  *)start_args;
+	core_info->tasklet_info = start_res->tasklet_info;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (start_res->res_type == CAM_ISP_RESOURCE_TFE_IN) {
+		rc = cam_tfe_top_start(core_info, start_args,
+			arg_size);
+		if (rc)
+			CAM_ERR(CAM_ISP, "TFE:%d Start failed. type:%d",
+				core_info->core_index, start_res->res_type);
+
+	} else if (start_res->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		rc = core_info->tfe_bus->hw_ops.start(start_res, NULL, 0);
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res type:%d",
+			core_info->core_index, start_res->res_type);
+		rc = -EFAULT;
+	}
+
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_tfe_stop(void *hw_priv, void *stop_args, uint32_t arg_size)
+{
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *tfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	int rc = -EINVAL;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node  *)stop_args;
+
+	mutex_lock(&tfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_TFE_IN) {
+		rc = cam_tfe_top_stop(core_info, isp_res,
+			sizeof(struct cam_isp_resource_node));
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_TFE_OUT) {
+		rc = core_info->tfe_bus->hw_ops.stop(isp_res, NULL, 0);
+	} else {
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid res type:%d",
+			core_info->core_index, isp_res->res_type);
+	}
+
+	CAM_DBG(CAM_ISP, "TFE:%d stopped res type:%d res id:%d res_state:%d ",
+		core_info->core_index, isp_res->res_type,
+		isp_res->res_id, isp_res->res_state);
+
+	mutex_unlock(&tfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_tfe_read(void *hw_priv, void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_tfe_write(void *hw_priv, void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_tfe_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *tfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_tfe_hw_info            *hw_info = NULL;
+
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &tfe_hw->soc_info;
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	hw_info = core_info->tfe_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_tfe_top_get_base(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_tfe_top_get_reg_update(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+		rc = cam_tfe_top_clock_update(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+		rc = cam_tfe_top_bw_update(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+		rc = cam_tfe_top_bw_control(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_DUMP:
+		rc = cam_tfe_top_get_reg_dump(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_IRQ_REGISTER_DUMP:
+		rc = cam_tfe_camif_irq_reg_dump(core_info, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA:
+		*((struct cam_hw_soc_info **)cmd_args) = soc_info;
+		break;
+	case CAM_ISP_HW_CMD_DUMP_HW:
+		rc = cam_tfe_hw_dump(core_info,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		rc = cam_tfe_set_top_debug(core_info, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_CLOCK_RATE:
+		rc = cam_tfe_top_get_hw_clk_rate(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DYNAMIC_CLOCK_UPDATE:
+		rc = cam_tfe_top_dynamic_clock_update(core_info->top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+	case CAM_ISP_HW_CMD_GET_SECURE_MODE:
+	case CAM_ISP_HW_CMD_IS_CONSUMED_ADDR_SUPPORT:
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO:
+		rc = core_info->tfe_bus->hw_ops.process_cmd(
+			core_info->tfe_bus->bus_priv, cmd_type, cmd_args,
+			arg_size);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "TFE:%d Invalid cmd type:%d",
+			core_info->core_index, cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+int cam_tfe_core_init(struct cam_tfe_hw_core_info  *core_info,
+	struct cam_hw_soc_info                     *soc_info,
+	struct cam_hw_intf                         *hw_intf,
+	struct cam_tfe_hw_info                     *tfe_hw_info)
+{
+	int rc = -EINVAL;
+	int i;
+
+	rc = cam_tfe_top_init(soc_info, hw_intf, tfe_hw_info->top_hw_info,
+		core_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error cam_tfe_top_init failed",
+			core_info->core_index);
+		goto end;
+	}
+
+	rc = cam_tfe_bus_init(soc_info, hw_intf,
+		tfe_hw_info->bus_hw_info, core_info,
+		&core_info->tfe_bus);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TFE:%d Error cam_tfe_bus_init failed",
+			core_info->core_index);
+		goto deinit_top;
+	}
+
+	INIT_LIST_HEAD(&core_info->free_payload_list);
+	for (i = 0; i < CAM_TFE_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&core_info->evt_payload[i].list);
+		list_add_tail(&core_info->evt_payload[i].list,
+			&core_info->free_payload_list);
+	}
+
+	core_info->irq_err_config = false;
+	core_info->irq_err_config_cnt = 0;
+	spin_lock_init(&core_info->spin_lock);
+	init_completion(&core_info->reset_complete);
+
+	return rc;
+
+deinit_top:
+	cam_tfe_top_deinit(core_info->top_priv);
+
+end:
+	return rc;
+}
+
+int cam_tfe_core_deinit(struct cam_tfe_hw_core_info  *core_info,
+	struct cam_tfe_hw_info                       *tfe_hw_info)
+{
+	int                rc = -EINVAL;
+	int                i;
+	unsigned long      flags;
+
+	spin_lock_irqsave(&core_info->spin_lock, flags);
+
+	INIT_LIST_HEAD(&core_info->free_payload_list);
+	for (i = 0; i < CAM_TFE_EVT_MAX; i++)
+		INIT_LIST_HEAD(&core_info->evt_payload[i].list);
+
+	rc = cam_tfe_bus_deinit(&core_info->tfe_bus);
+	if (rc)
+		CAM_ERR(CAM_ISP, "TFE:%d Error cam_tfe_bus_deinit failed rc=%d",
+			core_info->core_index, rc);
+
+	rc = cam_tfe_top_deinit(core_info->top_priv);
+	kfree(core_info->top_priv);
+	core_info->top_priv = NULL;
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Error cam_tfe_top_deinit failed rc=%d", rc);
+
+	spin_unlock_irqrestore(&core_info->spin_lock, flags);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_core.h
@@ -0,0 +1,300 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_TFE_CORE_H_
+#define _CAM_TFE_CORE_H_
+
+#include <linux/spinlock.h>
+#include "cam_hw_intf.h"
+#include "cam_tfe_bus.h"
+#include "cam_tfe_hw_intf.h"
+#include "cam_tfe_irq.h"
+
+#define CAM_TFE_CAMIF_VER_1_0        0x10
+#define CAM_TFE_RDI_VER_1_0          0x1000
+#define CAM_TFE_TOP_1_0              0x1000
+#define CAM_TFE_TOP_IN_PORT_MAX      4
+#define CAM_TFE_RDI_MAX              4
+
+#define CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS      BIT(0)
+#define CAM_TFE_EVT_MAX                            256
+
+#define CAM_TFE_MAX_REG_DUMP_ENTRIES  20
+#define CAM_TFE_MAX_LUT_DUMP_ENTRIES  10
+
+#define CAM_TFE_MAX_CLC               30
+#define CAM_TFE_CLC_NAME_LENGTH_MAX   32
+
+/*we take each word as uint32_t, for dumping uint64_t count as 2 words
+ * soc index
+ * clk_rate--> uint64_t--> count as 2 words
+ * BW--> uint64_t --> count as 2 words
+ * MAX_NIU
+ */
+#define CAM_TFE_CORE_DUMP_MISC_NUM_WORDS 4
+
+enum cam_tfe_lut_word_size {
+	CAM_TFE_LUT_WORD_SIZE_32,
+	CAM_TFE_LUT_WORD_SIZE_64,
+	CAM_TFE_LUT_WORD_SIZE_MAX,
+};
+
+struct cam_tfe_reg_dump_entry {
+	uint32_t     start_offset;
+	uint32_t     end_offset;
+};
+
+struct cam_tfe_lut_dump_entry {
+	enum cam_tfe_lut_word_size  lut_word_size;
+	uint32_t                    lut_bank_sel;
+	uint32_t                    lut_addr_size;
+	uint32_t                    dmi_reg_offset;
+};
+struct cam_tfe_reg_dump_data {
+	uint32_t     num_reg_dump_entries;
+	uint32_t     num_lut_dump_entries;
+	uint32_t     bus_start_addr;
+	uint32_t     bus_write_top_end_addr;
+	uint32_t     bus_client_start_addr;
+	uint32_t     bus_client_offset;
+	uint32_t     num_bus_clients;
+	struct cam_tfe_reg_dump_entry
+		reg_entry[CAM_TFE_MAX_REG_DUMP_ENTRIES];
+	struct cam_tfe_lut_dump_entry
+		lut_entry[CAM_TFE_MAX_LUT_DUMP_ENTRIES];
+};
+
+struct cam_tfe_top_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t lens_feature;
+	uint32_t stats_feature;
+	uint32_t zoom_feature;
+	uint32_t global_reset_cmd;
+	uint32_t core_cgc_ctrl;
+	uint32_t ahb_cgc_ctrl;
+	uint32_t core_cfg_0;
+	uint32_t core_cfg_1;
+	uint32_t reg_update_cmd;
+	uint32_t diag_config;
+	uint32_t diag_sensor_status_0;
+	uint32_t diag_sensor_status_1;
+	uint32_t diag_sensor_frame_cnt_status;
+	uint32_t violation_status;
+	uint32_t stats_throttle_cnt_cfg_0;
+	uint32_t stats_throttle_cnt_cfg_1;
+	uint32_t debug_0;
+	uint32_t debug_1;
+	uint32_t debug_2;
+	uint32_t debug_3;
+	uint32_t debug_cfg;
+	uint32_t perf_cnt_cfg;
+	uint32_t perf_pixel_count;
+	uint32_t perf_line_count;
+	uint32_t perf_stall_count;
+	uint32_t perf_always_count;
+	uint32_t perf_count_status;
+
+	/*reg data */
+	uint32_t diag_min_hbi_error_shift;
+	uint32_t diag_neq_hbi_shift;
+	uint32_t diag_sensor_hbi_mask;
+};
+
+struct cam_tfe_camif_reg {
+	uint32_t     hw_version;
+	uint32_t     hw_status;
+	uint32_t     module_cfg;
+	uint32_t     pdaf_raw_crop_width_cfg;
+	uint32_t     pdaf_raw_crop_height_cfg;
+	uint32_t     line_skip_pattern;
+	uint32_t     pixel_skip_pattern;
+	uint32_t     period_cfg;
+	uint32_t     irq_subsample_pattern;
+	uint32_t     epoch_irq_cfg;
+	uint32_t     debug_1;
+	uint32_t     debug_0;
+	uint32_t     test_bus_ctrl;
+	uint32_t     spare;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_tfe_camif_reg_data {
+	uint32_t     extern_reg_update_mask;
+	uint32_t     dual_tfe_pix_en_shift;
+	uint32_t     extern_reg_update_shift;
+	uint32_t     camif_pd_rdi2_src_sel_shift;
+	uint32_t     dual_tfe_sync_sel_shift;
+	uint32_t     delay_line_en_shift;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+	uint32_t     module_enable_shift;
+	uint32_t     pix_out_enable_shift;
+	uint32_t     pdaf_output_enable_shift;
+
+	uint32_t     dsp_mode_shift;
+	uint32_t     dsp_mode_mask;
+	uint32_t     dsp_en_shift;
+	uint32_t     dsp_en_mask;
+
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     epoch1_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     reg_update_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask2;
+	uint32_t     subscribe_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     perf_cnt_start_cmd_shift;
+	uint32_t     perf_cnt_continuous_shift;
+	uint32_t     perf_client_sel_shift;
+	uint32_t     perf_window_start_shift;
+	uint32_t     perf_window_end_shift;
+};
+
+struct cam_tfe_camif_hw_info {
+	struct cam_tfe_camif_reg      *camif_reg;
+	struct cam_tfe_camif_reg_data *reg_data;
+};
+
+struct cam_tfe_rdi_reg {
+	uint32_t     rdi_hw_version;
+	uint32_t     rdi_hw_status;
+	uint32_t     rdi_module_config;
+	uint32_t     rdi_skip_period;
+	uint32_t     rdi_irq_subsample_pattern;
+	uint32_t     rdi_epoch_irq;
+	uint32_t     rdi_debug_1;
+	uint32_t     rdi_debug_0;
+	uint32_t     rdi_test_bus_ctrl;
+	uint32_t     rdi_spare;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_tfe_rdi_reg_data {
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+	uint32_t     rdi_out_enable_shift;
+
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     epoch1_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask2;
+	uint32_t     subscribe_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     diag_sensor_sel;
+	uint32_t     diag_sensor_shift;
+};
+
+struct cam_tfe_clc_hw_status {
+	uint8_t     name[CAM_TFE_CLC_NAME_LENGTH_MAX];
+	uint32_t    hw_status_reg;
+};
+
+struct cam_tfe_rdi_hw_info {
+	struct cam_tfe_rdi_reg              *rdi_reg;
+	struct cam_tfe_rdi_reg_data         *reg_data;
+};
+
+struct cam_tfe_top_hw_info {
+	struct cam_tfe_top_reg_offset_common  *common_reg;
+	struct cam_tfe_camif_hw_info           camif_hw_info;
+	struct cam_tfe_rdi_hw_info             rdi_hw_info[CAM_TFE_RDI_MAX];
+	uint32_t in_port[CAM_TFE_TOP_IN_PORT_MAX];
+	struct cam_tfe_reg_dump_data           reg_dump_data;
+};
+
+struct cam_tfe_hw_info {
+	uint32_t    top_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    top_irq_clear[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    top_irq_status[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    top_irq_cmd;
+	uint32_t    global_clear_bitmask;
+
+	uint32_t    bus_irq_mask[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+	uint32_t    bus_irq_clear[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+	uint32_t    bus_irq_status[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+	uint32_t    bus_irq_cmd;
+
+	uint32_t    bus_violation_reg;
+	uint32_t    bus_overflow_reg;
+	uint32_t    bus_image_size_vilation_reg;
+	uint32_t    bus_overflow_clear_cmd;
+	uint32_t    debug_status_top;
+
+	uint32_t    reset_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    error_irq_mask[CAM_TFE_TOP_IRQ_REG_NUM];
+	uint32_t    bus_reg_irq_mask[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+	uint32_t    bus_error_irq_mask[CAM_TFE_BUS_MAX_IRQ_REGISTERS];
+
+	uint32_t    num_clc;
+	struct cam_tfe_clc_hw_status  *clc_hw_status_info;
+
+	uint32_t    top_version;
+	void       *top_hw_info;
+
+	uint32_t    bus_version;
+	void       *bus_hw_info;
+};
+
+struct cam_tfe_hw_core_info {
+	uint32_t                            core_index;
+	struct cam_tfe_hw_info             *tfe_hw_info;
+	void                               *top_priv;
+	struct cam_tfe_bus                 *tfe_bus;
+	void                               *tasklet_info;
+	struct cam_tfe_irq_evt_payload  evt_payload[CAM_TFE_EVT_MAX];
+	struct list_head                    free_payload_list;
+	bool                                irq_err_config;
+	uint32_t                            irq_err_config_cnt;
+	spinlock_t                          spin_lock;
+	struct completion                   reset_complete;
+};
+
+int cam_tfe_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_tfe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_tfe_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_tfe_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size);
+int cam_tfe_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_tfe_release(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_tfe_start(void *device_priv,
+	void *start_args, uint32_t arg_size);
+int cam_tfe_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_tfe_read(void *device_priv,
+	void *read_args, uint32_t arg_size);
+int cam_tfe_write(void *device_priv,
+	void *write_args, uint32_t arg_size);
+int cam_tfe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+irqreturn_t cam_tfe_irq(int irq_num, void *data);
+
+int cam_tfe_core_init(struct cam_tfe_hw_core_info *core_info,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	struct cam_tfe_hw_info             *tfe_hw_info);
+
+int cam_tfe_core_deinit(struct cam_tfe_hw_core_info *core_info,
+	struct cam_tfe_hw_info             *tfe_hw_info);
+
+#endif /* _CAM_TFE_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.c
@@ -0,0 +1,235 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include "cam_tfe_dev.h"
+#include "cam_tfe_core.h"
+#include "cam_tfe_soc.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_isp_hw_intf_data  cam_tfe_hw_list[CAM_TFE_HW_NUM_MAX];
+
+static char tfe_dev_name[8];
+
+static int cam_tfe_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info                *tfe_hw = NULL;
+	struct cam_hw_intf                *tfe_hw_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_tfe_hw_core_info       *core_info = NULL;
+	struct cam_tfe_hw_info            *hw_info = NULL;
+	struct cam_tfe_soc_private        *tfe_soc_priv;
+	int                                rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+	uint32_t  i;
+
+	tfe_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!tfe_hw_intf) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &tfe_hw_intf->hw_idx);
+
+	tfe_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!tfe_hw) {
+		rc = -ENOMEM;
+		goto free_tfe_hw_intf;
+	}
+
+	memset(tfe_dev_name, 0, sizeof(tfe_dev_name));
+	snprintf(tfe_dev_name, sizeof(tfe_dev_name),
+		"tfe%1u", tfe_hw_intf->hw_idx);
+
+	tfe_hw->soc_info.pdev = pdev;
+	tfe_hw->soc_info.dev = &pdev->dev;
+	tfe_hw->soc_info.dev_name = tfe_dev_name;
+	tfe_hw_intf->hw_priv = tfe_hw;
+	tfe_hw_intf->hw_ops.get_hw_caps = cam_tfe_get_hw_caps;
+	tfe_hw_intf->hw_ops.init = cam_tfe_init_hw;
+	tfe_hw_intf->hw_ops.deinit = cam_tfe_deinit_hw;
+	tfe_hw_intf->hw_ops.reset = cam_tfe_reset;
+	tfe_hw_intf->hw_ops.reserve = cam_tfe_reserve;
+	tfe_hw_intf->hw_ops.release = cam_tfe_release;
+	tfe_hw_intf->hw_ops.start = cam_tfe_start;
+	tfe_hw_intf->hw_ops.stop = cam_tfe_stop;
+	tfe_hw_intf->hw_ops.read = cam_tfe_read;
+	tfe_hw_intf->hw_ops.write = cam_tfe_write;
+	tfe_hw_intf->hw_ops.process_cmd = cam_tfe_process_cmd;
+	tfe_hw_intf->hw_type = CAM_ISP_HW_TYPE_TFE;
+
+	CAM_DBG(CAM_ISP, "TFE component bind,type %d index %d",
+		tfe_hw_intf->hw_type, tfe_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, tfe_hw_intf);
+
+	tfe_hw->core_info = kzalloc(sizeof(struct cam_tfe_hw_core_info),
+		GFP_KERNEL);
+	if (!tfe_hw->core_info) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for core");
+		rc = -ENOMEM;
+		goto free_tfe_hw;
+	}
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "Of_match Failed");
+		rc = -EINVAL;
+		goto free_core_info;
+	}
+	hw_info = (struct cam_tfe_hw_info *)match_dev->data;
+	core_info->tfe_hw_info = hw_info;
+	core_info->core_index = tfe_hw_intf->hw_idx;
+
+	rc = cam_tfe_init_soc_resources(&tfe_hw->soc_info, cam_tfe_irq,
+		tfe_hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Failed to init soc rc=%d", rc);
+		goto free_core_info;
+	}
+
+	rc = cam_tfe_core_init(core_info, &tfe_hw->soc_info,
+		tfe_hw_intf, hw_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Failed to init core rc=%d", rc);
+		goto deinit_soc;
+	}
+
+	tfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&tfe_hw->hw_mutex);
+	spin_lock_init(&tfe_hw->hw_lock);
+	init_completion(&tfe_hw->hw_complete);
+
+	if (tfe_hw_intf->hw_idx < CAM_TFE_HW_NUM_MAX)
+		cam_tfe_hw_list[tfe_hw_intf->hw_idx].hw_intf = tfe_hw_intf;
+	else {
+		CAM_ERR(CAM_ISP, "HW index:%d is wrong max HW idx:%d",
+			tfe_hw_intf->hw_idx, CAM_TFE_HW_NUM_MAX);
+		goto deinit_soc;
+	}
+
+	tfe_soc_priv = tfe_hw->soc_info.soc_private;
+	cam_tfe_hw_list[tfe_hw_intf->hw_idx].num_hw_pid = tfe_soc_priv->num_pid;
+	for (i = 0; i < tfe_soc_priv->num_pid; i++)
+		cam_tfe_hw_list[tfe_hw_intf->hw_idx].hw_pid[i] =
+			tfe_soc_priv->pid[i];
+
+	cam_tfe_init_hw(tfe_hw, NULL, 0);
+	cam_tfe_deinit_hw(tfe_hw, NULL, 0);
+
+	CAM_DBG(CAM_ISP, "TFE:%d component bound successfully",
+		tfe_hw_intf->hw_idx);
+	return rc;
+
+deinit_soc:
+	if (cam_tfe_deinit_soc_resources(&tfe_hw->soc_info))
+		CAM_ERR(CAM_ISP, "Failed to deinit soc");
+free_core_info:
+	kfree(tfe_hw->core_info);
+free_tfe_hw:
+	kfree(tfe_hw);
+free_tfe_hw_intf:
+	kfree(tfe_hw_intf);
+end:
+	return rc;
+}
+
+static void cam_tfe_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info		  *tfe_hw = NULL;
+	struct cam_hw_intf		  *tfe_hw_intf = NULL;
+	struct cam_tfe_hw_core_info	  *core_info = NULL;
+	int				   rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	tfe_hw_intf = platform_get_drvdata(pdev);
+	if (!tfe_hw_intf) {
+		CAM_ERR(CAM_ISP, "Error! No data in pdev");
+		return;
+	}
+
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		tfe_hw_intf->hw_type, tfe_hw_intf->hw_idx);
+
+	if (tfe_hw_intf->hw_idx < CAM_TFE_HW_NUM_MAX)
+		cam_tfe_hw_list[tfe_hw_intf->hw_idx].hw_intf = NULL;
+
+	tfe_hw = tfe_hw_intf->hw_priv;
+	if (!tfe_hw) {
+		CAM_ERR(CAM_ISP, "Error! HW data is NULL");
+		goto free_tfe_hw_intf;
+	}
+
+	core_info = (struct cam_tfe_hw_core_info *)tfe_hw->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_ISP, "Error! core data NULL");
+		goto deinit_soc;
+	}
+
+	rc = cam_tfe_core_deinit(core_info, core_info->tfe_hw_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "Failed to deinit core rc=%d", rc);
+
+	kfree(tfe_hw->core_info);
+
+deinit_soc:
+	rc = cam_tfe_deinit_soc_resources(&tfe_hw->soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&tfe_hw->hw_mutex);
+	kfree(tfe_hw);
+
+	CAM_DBG(CAM_ISP, "TFE%d component unbound", tfe_hw_intf->hw_idx);
+
+free_tfe_hw_intf:
+	kfree(tfe_hw_intf);
+}
+
+const static struct component_ops cam_tfe_component_ops = {
+	.bind = cam_tfe_component_bind,
+	.unbind = cam_tfe_component_unbind,
+};
+
+int cam_tfe_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Adding TFE component");
+	rc = component_add(&pdev->dev, &cam_tfe_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_tfe_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_tfe_component_ops);
+	return 0;
+}
+
+int cam_tfe_hw_init(struct cam_isp_hw_intf_data **tfe_hw_intf,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_tfe_hw_list[hw_idx].hw_intf) {
+		*tfe_hw_intf = &cam_tfe_hw_list[hw_idx];
+		rc = 0;
+	} else {
+		*tfe_hw_intf = NULL;
+		rc = -ENODEV;
+	}
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_dev.h
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_DEV_H_
+#define _CAM_TFE_DEV_H_
+
+#include <linux/platform_device.h>
+
+/*
+ * cam_tfe_probe()
+ *
+ * @brief:                   Driver probe function called on Boot
+ *
+ * @pdev:                    Platform Device pointer
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_probe(struct platform_device *pdev);
+
+/*
+ * cam_tfe_remove()
+ *
+ * @brief:                   Driver remove function
+ *
+ * @pdev:                    Platform Device pointer
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_remove(struct platform_device *pdev);
+
+int cam_tfe_init_module(void);
+void cam_tfe_exit_module(void);
+
+#endif /* _CAM_TFE_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_irq.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_irq.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_IRQ_H_
+#define _CAM_TFE_IRQ_H_
+
+#include <linux/platform_device.h>
+
+#define CAM_TFE_TOP_IRQ_REG_NUM 3
+
+/*
+ * cam_tfe_irq_config()
+ *
+ * @brief:                   Tfe hw irq configuration
+ *
+ * @tfe_core_data:           tfe core pointer
+ * @irq_mask:                Irq mask for enable interrupts or disable
+ * @num_reg:                 Number irq mask registers
+ * @enable:                  enable = 1, enable the given irq mask interrupts
+ *                           enable = 0 disable the given irq mask interrupts
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_irq_config(void     *tfe_core_data,
+	uint32_t  *irq_mask, uint32_t num_reg, bool enable);
+
+
+#endif /* _CAM_TFE_IRQ_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.c
@@ -0,0 +1,261 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_cpas_api.h"
+#include "cam_tfe_soc.h"
+#include "cam_debug_util.h"
+
+static bool cam_tfe_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool error_handled = false;
+
+	if (!irq_data)
+		return error_handled;
+
+	CAM_DBG(CAM_ISP, "CPSS error type=%d ",
+		irq_data->irq_type);
+
+	return error_handled;
+}
+
+int cam_tfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t tfe_irq_handler, void *irq_data)
+{
+	struct cam_tfe_soc_private       *soc_private;
+	struct cam_cpas_register_params   cpas_register_param;
+	int    rc = 0,  i = 0, num_pid = 0;
+
+	soc_private = kzalloc(sizeof(struct cam_tfe_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_ISP, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! get DT properties failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	/* set some default values */
+	soc_private->num_pid = 0;
+
+	num_pid = of_property_count_u32_elems(soc_info->pdev->dev.of_node,
+		"cam_hw_pid");
+	CAM_DBG(CAM_CPAS, "tfe:%d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_ISP_HW_MAX_PID_VAL)
+		goto clk_option;
+
+	for (i = 0; i < num_pid; i++) {
+		of_property_read_u32_index(soc_info->pdev->dev.of_node,
+		"cam_hw_pid", i, &soc_private->pid[i]);
+		CAM_INFO(CAM_CPAS, "tfe:%d I:%d pid %d", soc_info->index,
+			i, soc_private->pid[i]);
+	}
+
+	soc_private->num_pid = num_pid;
+
+clk_option:
+
+	rc = cam_soc_util_get_option_clk_by_name(soc_info,
+		CAM_TFE_DSP_CLK_NAME, &soc_private->dsp_clk,
+		&soc_private->dsp_clk_index, &soc_private->dsp_clk_rate);
+	if (rc)
+		CAM_WARN(CAM_ISP, "Option clk get failed with rc %d", rc);
+
+	rc = cam_soc_util_request_platform_resource(soc_info, tfe_irq_handler,
+		irq_data);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Error! Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "tfe",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	cpas_register_param.cam_cpas_client_cb = cam_tfe_cpas_cb;
+	cpas_register_param.userdata = soc_info;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	}
+
+	soc_private->cpas_handle = cpas_register_param.client_handle;
+
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_tfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! soc_info NULL");
+		return -ENODEV;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPAS0 unregistration failed rc=%d", rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Error! Release platform resource failed rc=%d", rc);
+
+
+	rc = cam_soc_util_clk_put(&soc_private->dsp_clk);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP,
+			"Error Put dsp clk failed rc=%d", rc);
+
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_tfe_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+	struct cam_ahb_vote               ahb_vote;
+	struct cam_axi_vote               axi_vote = {0};
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type       = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_SVS_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_IFE_VID;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[0].camnoc_bw = 10640000000L;
+	axi_vote.axi_path[0].mnoc_ab_bw = 10640000000L;
+	axi_vote.axi_path[0].mnoc_ib_bw = 10640000000L;
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! CPAS0 start failed rc=%d", rc);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_TURBO_VOTE, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! enable platform failed rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_tfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	int  rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+	soc_private = soc_info->soc_private;
+
+	if (strcmp(clk_name, CAM_TFE_DSP_CLK_NAME) == 0) {
+		rc = cam_soc_util_clk_enable(soc_private->dsp_clk,
+			CAM_TFE_DSP_CLK_NAME, soc_private->dsp_clk_rate, NULL);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+			"Error enable dsp clk failed rc=%d", rc);
+	}
+
+	return rc;
+}
+
+int cam_tfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	int  rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+	soc_private = soc_info->soc_private;
+
+	if (strcmp(clk_name, CAM_TFE_DSP_CLK_NAME) == 0) {
+		rc = cam_soc_util_clk_disable(soc_private->dsp_clk,
+			CAM_TFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+			"Error enable dsp clk failed rc=%d", rc);
+	}
+
+	return rc;
+}
+
+
+int cam_tfe_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_tfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Disable platform failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_soc.h
@@ -0,0 +1,121 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TFE_SOC_H_
+#define _CAM_TFE_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_isp_hw.h"
+
+#define CAM_TFE_DSP_CLK_NAME "tfe_dsp_clk"
+
+enum cam_cpas_handle_id {
+	CAM_CPAS_HANDLE_CAMIF,
+	CAM_CPAS_HANDLE_RAW,
+	CAM_CPAS_HANDLE_MAX,
+};
+
+/*
+ * struct cam_tfe_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to TFE HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ * @cpas_version:            Has cpas version read from Hardware
+ * @num_pid:                 number of pids of tfe
+ * @pid:                     TFE pid value list
+ */
+struct cam_tfe_soc_private {
+	uint32_t    cpas_handle;
+	uint32_t    cpas_version;
+	struct clk *dsp_clk;
+	int32_t     dsp_clk_index;
+	int32_t     dsp_clk_rate;
+	uint32_t    num_pid;
+	uint32_t    pid[CAM_ISP_HW_MAX_PID_VAL];
+};
+
+/*
+ * cam_tfe_init_soc_resources()
+ *
+ * @Brief:                   Initialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ * @handler:                 Irq handler function pointer
+ * @irq_data:                Irq handler function Callback data
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t tfe_irq_handler, void *irq_data);
+
+/*
+ * cam_tfe_deinit_soc_resources()
+ *
+ * @Brief:                   Deinitialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_tfe_enable_soc_resources()
+ *
+ * @brief:                   Enable regulator, irq resources, start CPAS
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_tfe_disable_soc_resources()
+ *
+ * @brief:                   Disable regulator, irq resources, stop CPAS
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_tfe_soc_enable_clk()
+ *
+ * @brief:                   Enable clock with given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+/*
+ * cam_tfe_soc_disable_dsp_clk()
+ *
+ * @brief:                   Disable clock with given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_tfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+#endif /* _CAM_TFE_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg.c
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+
+#include "cam_top_tpg.h"
+#include "cam_top_tpg101.h"
+#include "cam_top_tpg102.h"
+#include "cam_top_tpg103.h"
+#include "cam_top_tpg_core.h"
+#include "cam_top_tpg_dev.h"
+
+static const struct of_device_id cam_top_tpg_dt_match[] = {
+	{
+		.compatible = "qcom,tpg101",
+		.data = &cam_top_tpg101_hw_info,
+	},
+	{
+		.compatible = "qcom,tpg102",
+		.data = &cam_top_tpg102_hw_info,
+	},
+	{
+		.compatible = "qcom,tpg103",
+		.data = &cam_top_tpg103_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_top_tpg_dt_match);
+
+struct platform_driver cam_top_tpg_driver = {
+	.probe = cam_top_tpg_probe,
+	.remove = cam_top_tpg_remove,
+	.driver = {
+		.name = "cam_top_tpg",
+		.of_match_table = cam_top_tpg_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_top_tpg_init_module(void)
+{
+	return platform_driver_register(&cam_top_tpg_driver);
+}
+
+void cam_top_tpg_exit_module(void)
+{
+	platform_driver_unregister(&cam_top_tpg_driver);
+}
+
+MODULE_DESCRIPTION("CAM TOP TPG driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG_H_
+#define _CAM_TOP_TPG_H_
+
+int cam_top_tpg_init_module(void);
+void cam_top_tpg_exit_module(void);
+
+#endif /*_CAM_TOP_TPG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg101.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg101.h
@@ -0,0 +1,62 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG101_H_
+#define _CAM_TOP_TPG101_H_
+
+#include "cam_top_tpg_ver1.h"
+#include "cam_top_tpg_core.h"
+
+static struct cam_top_tpg_ver1_reg_offset cam_top_tpg101_reg = {
+	.tpg_hw_version = 0x0,
+	.tpg_hw_status = 0x4,
+	.tpg_ctrl = 0x60,
+	.tpg_vc_cfg0 = 0x64,
+	.tpg_vc_cfg1 = 0x68,
+	.tpg_lfsr_seed = 0x6c,
+	.tpg_dt_0_cfg_0 = 0x70,
+	.tpg_dt_1_cfg_0 = 0x74,
+	.tpg_dt_2_cfg_0 = 0x78,
+	.tpg_dt_3_cfg_0 = 0x7C,
+	.tpg_dt_0_cfg_1 = 0x80,
+	.tpg_dt_1_cfg_1 = 0x84,
+	.tpg_dt_2_cfg_1 = 0x88,
+	.tpg_dt_3_cfg_1 = 0x8C,
+	.tpg_dt_0_cfg_2 = 0x90,
+	.tpg_dt_1_cfg_2 = 0x94,
+	.tpg_dt_2_cfg_2 = 0x98,
+	.tpg_dt_3_cfg_2 = 0x9C,
+	.tpg_color_bar_cfg = 0xA0,
+	.tpg_common_gen_cfg = 0xA4,
+	.tpg_vbi_cfg = 0xA8,
+	.tpg_test_bus_crtl = 0xF8,
+	.tpg_spare = 0xFC,
+	/* configurations */
+	.major_version = 1,
+	.minor_version = 0,
+	.version_incr = 0,
+	.tpg_en_shift_val = 0,
+	.tpg_phy_sel_shift_val = 3,
+	.tpg_num_active_lines_shift = 4,
+	.tpg_fe_pkt_en_shift = 2,
+	.tpg_fs_pkt_en_shift = 1,
+	.tpg_line_interleaving_mode_shift = 10,
+	.tpg_num_dts_shift_val = 8,
+	.tpg_v_blank_cnt_shift = 12,
+	.tpg_dt_encode_format_shift = 16,
+	.tpg_payload_mode_color = 0x8,
+	.tpg_split_en_shift = 5,
+	.top_mux_reg_offset = 0x1C,
+	.top_unicolor_bar_shift = 2,
+};
+
+struct cam_top_tpg_hw_info cam_top_tpg101_hw_info = {
+	.tpg_reg = &cam_top_tpg101_reg,
+	.hw_dts_version = CAM_TOP_TPG_VERSION_1,
+	.csid_max_clk = 426400000,
+	.phy_max_clk = 384000000,
+};
+
+#endif /* _CAM_TOP_TPG101_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg102.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg102.h
@@ -0,0 +1,50 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG102_H_
+#define _CAM_TOP_TPG102_H_
+
+#include "cam_top_tpg_ver2.h"
+#include "cam_top_tpg_core.h"
+
+static struct cam_top_tpg_ver2_reg_offset cam_top_tpg102_reg = {
+	.tpg_hw_version = 0x0,
+	.tpg_hw_status = 0x4,
+	.tpg_module_cfg = 0x60,
+	.tpg_cfg_0 = 0x68,
+	.tpg_cfg_1 = 0x6C,
+	.tpg_cfg_2 = 0x70,
+	.tpg_cfg_3 = 0x74,
+	.tpg_spare = 0xFC,
+	.top_mux_sel = 0x90,
+	/* configurations */
+	.major_version = 1,
+	.minor_version = 0,
+	.version_incr = 0,
+	.tpg_module_en = 1,
+	.tpg_mux_sel_en = 1,
+	.tpg_mux_sel_tpg_0_shift = 0,
+	.tpg_mux_sel_tpg_1_shift = 8,
+	.tpg_en_shift_val = 0,
+	.tpg_phy_sel_shift_val = 3,
+	.tpg_num_active_lines_shift = 4,
+	.tpg_fe_pkt_en_shift = 2,
+	.tpg_fs_pkt_en_shift = 1,
+	.tpg_line_interleaving_mode_shift = 10,
+	.tpg_num_dts_shift_val = 8,
+	.tpg_v_blank_cnt_shift = 12,
+	.tpg_dt_encode_format_shift = 16,
+	.tpg_payload_mode_color = 0x8,
+	.tpg_split_en_shift = 5,
+};
+
+struct cam_top_tpg_hw_info cam_top_tpg102_hw_info = {
+	.tpg_reg = &cam_top_tpg102_reg,
+	.hw_dts_version = CAM_TOP_TPG_VERSION_2,
+	.csid_max_clk = 400000000,
+	.phy_max_clk = 400000000,
+};
+
+#endif /* _CAM_TOP_TPG102_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg103.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg103.h
@@ -0,0 +1,125 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG103_H_
+#define _CAM_TOP_TPG103_H_
+
+#include "cam_top_tpg_ver3.h"
+#include "cam_top_tpg_core.h"
+
+static struct cam_top_tpg_ver3_reg_offset cam_top_tpg103_reg = {
+	.tpg_hw_version        = 0x0,
+	.tpg_hw_status         = 0x4,
+	.tpg_ctrl              = 0x64,
+	.tpg_vc0_cfg0          = 0x68,
+	.tpg_vc0_lfsr_seed     = 0x6C,
+	.tpg_vc0_hbi_cfg       = 0x70,
+	.tpg_vc0_vbi_cfg       = 0x74,
+	.tpg_vc0_color_bar_cfg = 0x78,
+	.tpg_vc0_dt_0_cfg_0   = 0x7C,
+	.tpg_vc0_dt_0_cfg_1   = 0x80,
+	.tpg_vc0_dt_0_cfg_2   = 0x84,
+	.tpg_vc0_dt_1_cfg_0   = 0x88,
+	.tpg_vc0_dt_1_cfg_1   = 0x8C,
+	.tpg_vc0_dt_1_cfg_2   = 0x90,
+	.tpg_vc0_dt_2_cfg_0   = 0x94,
+	.tpg_vc0_dt_2_cfg_1   = 0x98,
+	.tpg_vc0_dt_2_cfg_2   = 0x9C,
+	.tpg_vc0_dt_3_cfg_0   = 0xA0,
+	.tpg_vc0_dt_3_cfg_1   = 0xA4,
+	.tpg_vc0_dt_3_cfg_2   = 0xA8,
+
+	.tpg_vc1_cfg0          = 0xC8,
+	.tpg_vc1_lfsr_seed     = 0xCC,
+	.tpg_vc1_hbi_cfg       = 0xD0,
+	.tpg_vc1_vbi_cfg       = 0xD4,
+	.tpg_vc1_color_bar_cfg = 0xD8,
+	.tpg_vc1_dt_0_cfg_0   = 0xDC,
+	.tpg_vc1_dt_0_cfg_1   = 0xE0,
+	.tpg_vc1_dt_0_cfg_2   = 0xE4,
+	.tpg_vc1_dt_1_cfg_0   = 0xE8,
+	.tpg_vc1_dt_1_cfg_1   = 0xEC,
+	.tpg_vc1_dt_1_cfg_2   = 0xF0,
+	.tpg_vc1_dt_2_cfg_0   = 0xF4,
+	.tpg_vc1_dt_2_cfg_1   = 0xF8,
+	.tpg_vc1_dt_2_cfg_2   = 0xFC,
+	.tpg_vc1_dt_3_cfg_0   = 0x100,
+	.tpg_vc1_dt_3_cfg_1   = 0x104,
+	.tpg_vc1_dt_3_cfg_2   = 0x108,
+
+	.tpg_vc2_cfg0          = 0x128,
+	.tpg_vc2_lfsr_seed     = 0x12C,
+	.tpg_vc2_hbi_cfg       = 0x130,
+	.tpg_vc2_vbi_cfg       = 0x134,
+	.tpg_vc2_color_bar_cfg = 0x138,
+	.tpg_vc2_dt_0_cfg_0   = 0x13C,
+	.tpg_vc2_dt_0_cfg_1   = 0x140,
+	.tpg_vc2_dt_0_cfg_2   = 0x144,
+	.tpg_vc2_dt_1_cfg_0   = 0x148,
+	.tpg_vc2_dt_1_cfg_1   = 0x14C,
+	.tpg_vc2_dt_1_cfg_2   = 0x150,
+	.tpg_vc2_dt_2_cfg_0   = 0x154,
+	.tpg_vc2_dt_2_cfg_1   = 0x158,
+	.tpg_vc2_dt_2_cfg_2   = 0x15C,
+	.tpg_vc2_dt_3_cfg_0   = 0x160,
+	.tpg_vc2_dt_3_cfg_1   = 0x164,
+	.tpg_vc2_dt_3_cfg_2   = 0x168,
+
+	.tpg_vc3_cfg0          = 0x188,
+	.tpg_vc3_lfsr_seed     = 0x18C,
+	.tpg_vc3_hbi_cfg       = 0x190,
+	.tpg_vc3_vbi_cfg       = 0x194,
+	.tpg_vc3_color_bar_cfg = 0x198,
+	.tpg_vc3_dt_0_cfg_0   = 0x19C,
+	.tpg_vc3_dt_0_cfg_1   = 0x1A0,
+	.tpg_vc3_dt_0_cfg_2   = 0x1A4,
+	.tpg_vc3_dt_1_cfg_0   = 0x1A8,
+	.tpg_vc3_dt_1_cfg_1   = 0x1AC,
+	.tpg_vc3_dt_1_cfg_2   = 0x1B0,
+	.tpg_vc3_dt_2_cfg_0   = 0x1B4,
+	.tpg_vc3_dt_2_cfg_1   = 0x1B8,
+	.tpg_vc3_dt_2_cfg_2   = 0x1BC,
+	.tpg_vc3_dt_3_cfg_0   = 0x1C0,
+	.tpg_vc3_dt_3_cfg_1   = 0x1C4,
+	.tpg_vc3_dt_3_cfg_2   = 0x1C8,
+	.tpg_throttle          = 0x1CC,
+	.tpg_top_irq_status    = 0x1E0,
+	.tpg_top_irq_mask      = 0x1E4,
+	.tpg_top_irq_clear     = 0x1E8,
+	.tpg_top_irq_set       = 0x1EC,
+	.tpg_top_irq_cmd       = 0x1F0,
+	.tpg_top_clear         = 0x1F4,
+	.tpg_test_bus_crtl     = 0x1F8,
+	.tpg_spare             = 0x1FC,
+
+	/* configurations */
+	.major_version = 2,
+	.minor_version = 0,
+	.version_incr = 0,
+	.tpg_en_shift_val = 0,
+	.tpg_cphy_dphy_sel_shift_val = 3,
+	.tpg_num_active_lanes_shift = 4,
+	.tpg_fe_pkt_en_shift = 2,
+	.tpg_fs_pkt_en_shift = 1,
+	.tpg_line_interleaving_mode_shift = 10,
+	.tpg_num_dts_shift_val = 8,
+	.tpg_v_blank_cnt_shift = 12,
+	.tpg_dt_encode_format_shift = 20,
+	.tpg_payload_mode_color = 0x8,
+	.tpg_split_en_shift = 4,
+	.top_mux_reg_offset = 0x1C,
+	.tpg_vc_dt_pattern_id_shift = 6,
+	.tpg_num_active_vcs_shift = 30,
+	.tpg_color_bar_qcfa_en_shift = 3,
+};
+
+struct cam_top_tpg_hw_info cam_top_tpg103_hw_info = {
+	.tpg_reg = &cam_top_tpg103_reg,
+	.hw_dts_version = CAM_TOP_TPG_VERSION_3,
+	.csid_max_clk = 480000000,
+	.phy_max_clk = 480000000,
+};
+
+#endif /* _CAM_TOP_TPG103_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_core.c
@@ -0,0 +1,417 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+#include <media/cam_tfe.h>
+#include <media/cam_defs.h>
+
+#include "cam_top_tpg_core.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_top_tpg_ver1.h"
+#include "cam_top_tpg_ver2.h"
+#include "cam_top_tpg_ver3.h"
+
+int cam_top_tpg_get_format(
+	uint32_t                                     in_format,
+	uint32_t                                    *tpg_encode_format)
+{
+	int                                          rc = 0;
+
+	switch (in_format) {
+	case CAM_FORMAT_MIPI_RAW_6:
+		*tpg_encode_format = 0;
+		break;
+	case CAM_FORMAT_MIPI_RAW_8:
+		*tpg_encode_format = 1;
+		break;
+	case CAM_FORMAT_MIPI_RAW_10:
+		*tpg_encode_format = 2;
+		break;
+	case CAM_FORMAT_MIPI_RAW_12:
+		*tpg_encode_format = 3;
+		break;
+	case CAM_FORMAT_MIPI_RAW_14:
+		*tpg_encode_format = 4;
+		break;
+	case CAM_FORMAT_MIPI_RAW_16:
+		*tpg_encode_format = 5;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported input encode format %d",
+			in_format);
+		rc = -EINVAL;
+	}
+	return rc;
+}
+
+static int cam_top_tpg_release(void *hw_priv,
+	void *release_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_top_tpg_hw           *tpg_hw;
+	struct cam_hw_info              *tpg_hw_info;
+	struct cam_top_tpg_cfg          *tpg_data;
+	struct cam_isp_resource_node    *tpg_res;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	tpg_res = (struct cam_isp_resource_node *)release_args;
+
+	mutex_lock(&tpg_hw->hw_info->hw_mutex);
+	if ((tpg_res->res_type != CAM_ISP_RESOURCE_TPG) ||
+		(tpg_res->res_state <= CAM_ISP_RESOURCE_STATE_AVAILABLE)) {
+		CAM_ERR(CAM_ISP, "TPG:%d Invalid res type:%d res_state:%d",
+			tpg_hw->hw_intf->hw_idx, tpg_res->res_type,
+			tpg_res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "TPG:%d res type :%d",
+		tpg_hw->hw_intf->hw_idx, tpg_res->res_type);
+
+	tpg_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	tpg_data = (struct cam_top_tpg_cfg *)tpg_res->res_priv;
+	memset(tpg_data, 0, sizeof(struct cam_top_tpg_cfg));
+
+end:
+	mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_top_tpg_init_hw(void *hw_priv,
+	void *init_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_top_tpg_hw                  *tpg_hw;
+	struct cam_hw_info                     *tpg_hw_info;
+	struct cam_isp_resource_node           *tpg_res;
+	struct cam_hw_soc_info                 *soc_info;
+	uint32_t clk_lvl;
+
+	if (!hw_priv || !init_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	tpg_res = (struct cam_isp_resource_node *)init_args;
+	soc_info = &tpg_hw->hw_info->soc_info;
+
+	if (tpg_res->res_type != CAM_ISP_RESOURCE_TPG) {
+		CAM_ERR(CAM_ISP, "TPG:%d Invalid res type state %d",
+			tpg_hw->hw_intf->hw_idx,
+			tpg_res->res_type);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "TPG:%d init HW res type :%d",
+		tpg_hw->hw_intf->hw_idx, tpg_res->res_type);
+	mutex_lock(&tpg_hw->hw_info->hw_mutex);
+	/* overflow check before increment */
+	if (tpg_hw->hw_info->open_count == UINT_MAX) {
+		CAM_ERR(CAM_ISP, "TPG:%d Open count reached max",
+			tpg_hw->hw_intf->hw_idx);
+		mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+		return -EINVAL;
+	}
+
+	/* Increment ref Count */
+	tpg_hw->hw_info->open_count++;
+	if (tpg_hw->hw_info->open_count > 1) {
+		CAM_DBG(CAM_ISP, "TPG hw has already been enabled");
+		mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+		return rc;
+	}
+
+	rc = cam_soc_util_get_clk_level(soc_info, tpg_hw->clk_rate,
+		soc_info->src_clk_idx, &clk_lvl);
+	CAM_DBG(CAM_ISP, "TPG phy clock level %u", clk_lvl);
+
+	rc = cam_top_tpg_enable_soc_resources(soc_info, clk_lvl);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "TPG:%d Enable SOC failed",
+			tpg_hw->hw_intf->hw_idx);
+		goto err;
+	}
+
+	tpg_hw->hw_info->hw_state = CAM_HW_STATE_POWER_UP;
+
+	mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+	return rc;
+
+err:
+	tpg_hw->hw_info->open_count--;
+	mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_top_tpg_deinit_hw(void *hw_priv,
+	void *deinit_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_top_tpg_hw                 *tpg_hw;
+	struct cam_hw_info                    *tpg_hw_info;
+	struct cam_isp_resource_node          *tpg_res;
+	struct cam_hw_soc_info                *soc_info;
+
+	if (!hw_priv || !deinit_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "TPG:Invalid arguments");
+		return -EINVAL;
+	}
+
+	tpg_res = (struct cam_isp_resource_node *)deinit_args;
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+
+	if (tpg_res->res_type != CAM_ISP_RESOURCE_TPG) {
+		CAM_ERR(CAM_ISP, "TPG:%d Invalid Res type %d",
+			tpg_hw->hw_intf->hw_idx,
+			tpg_res->res_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&tpg_hw->hw_info->hw_mutex);
+	/* Check for refcount */
+	if (!tpg_hw->hw_info->open_count) {
+		CAM_WARN(CAM_ISP, "Unbalanced disable_hw");
+		goto end;
+	}
+
+	/* Decrement ref Count */
+	tpg_hw->hw_info->open_count--;
+	if (tpg_hw->hw_info->open_count) {
+		rc = 0;
+		goto end;
+	}
+
+	soc_info = &tpg_hw->hw_info->soc_info;
+	rc = cam_top_tpg_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, "TPG:%d Disable SOC failed",
+			tpg_hw->hw_intf->hw_idx);
+
+	tpg_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	CAM_DBG(CAM_ISP, "TPG:%d deint completed", tpg_hw->hw_intf->hw_idx);
+
+end:
+	mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+	return rc;
+}
+
+static int cam_top_tpg_read(void *hw_priv,
+	void *read_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "TPG: un supported");
+
+	return -EINVAL;
+}
+
+static int cam_top_tpg_write(void *hw_priv,
+	void *write_args, uint32_t arg_size)
+{
+	CAM_ERR(CAM_ISP, "TPG: un supported");
+	return -EINVAL;
+}
+
+static int cam_top_tpg_set_phy_clock(
+	struct cam_top_tpg_hw *csid_hw, void *cmd_args)
+{
+	struct cam_top_tpg_clock_update_args *clk_update = NULL;
+
+	if (!csid_hw)
+		return -EINVAL;
+
+	clk_update =
+		(struct cam_top_tpg_clock_update_args *)cmd_args;
+
+	csid_hw->clk_rate = clk_update->clk_rate;
+	CAM_DBG(CAM_ISP, "CSI PHY clock rate %llu", csid_hw->clk_rate);
+
+	return 0;
+}
+
+static irqreturn_t cam_top_tpg_irq(int irq_num, void *data)
+{
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_soc_info                       *soc_info;
+	struct cam_top_tpg_ver3_reg_offset           *tpg_reg;
+	uint32_t                                      irq_status_top;
+	unsigned long                                 flags;
+
+	if (!data) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid arguments");
+		return IRQ_HANDLED;
+	}
+
+
+	tpg_hw = (struct cam_top_tpg_hw *) data;
+	CAM_DBG(CAM_ISP, "CPHY TPG %d IRQ Handling", tpg_hw->hw_intf->hw_idx);
+
+	soc_info = &tpg_hw->hw_info->soc_info;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+
+	irq_status_top = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_top_irq_status);
+
+	spin_lock_irqsave(&tpg_hw->hw_info->hw_lock, flags);
+	/* clear */
+	cam_io_w_mb(irq_status_top, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_top_irq_clear);
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_top_irq_cmd);
+
+	spin_unlock_irqrestore(&tpg_hw->hw_info->hw_lock, flags);
+
+	CAM_DBG(CAM_ISP, "TPG: irq_status_top = 0x%x", irq_status_top);
+	return IRQ_HANDLED;
+}
+
+static int cam_top_tpg_set_top_tpg_pattern(struct cam_top_tpg_hw *tpg_hw,
+	void *cmd_args)
+{
+	uint32_t *top_tpg_pattern;
+
+	top_tpg_pattern = (uint32_t  *) cmd_args;
+	tpg_hw->tpg_pattern = *top_tpg_pattern;
+	CAM_DBG(CAM_ISP, "TPG:%d set tpg debug value:%d",
+		tpg_hw->hw_intf->hw_idx, tpg_hw->tpg_pattern);
+
+	return 0;
+}
+
+static int cam_top_tpg_process_cmd(void *hw_priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_top_tpg_hw               *tpg_hw;
+	struct cam_hw_info                  *tpg_hw_info;
+
+	if (!hw_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "CSID: Invalid arguments");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_TPG_PHY_CLOCK_UPDATE:
+		rc = cam_top_tpg_set_phy_clock(tpg_hw, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_TPG_SET_PATTERN:
+		rc = cam_top_tpg_set_top_tpg_pattern(tpg_hw, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "TPG:%d unsupported cmd:%d",
+			tpg_hw->hw_intf->hw_idx, cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return 0;
+}
+
+int cam_top_tpg_probe_init(struct cam_hw_intf  *tpg_hw_intf,
+	uint32_t tpg_idx)
+{
+	int rc = -EINVAL;
+	struct cam_top_tpg_cfg             *tpg_data;
+	struct cam_hw_info                 *tpg_hw_info;
+	struct cam_top_tpg_hw              *tpg_hw = NULL;
+	uint32_t hw_version = 0;
+
+	if (tpg_idx >= CAM_TOP_TPG_HW_NUM_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid tpg index:%d", tpg_idx);
+		return rc;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)tpg_hw_intf->hw_priv;
+	tpg_hw      = (struct cam_top_tpg_hw  *)tpg_hw_info->core_info;
+
+	tpg_hw->hw_intf = tpg_hw_intf;
+	tpg_hw->hw_info = tpg_hw_info;
+
+	CAM_DBG(CAM_ISP, "type %d index %d",
+		tpg_hw->hw_intf->hw_type, tpg_idx);
+
+	tpg_hw->hw_info->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&tpg_hw->hw_info->hw_mutex);
+	spin_lock_init(&tpg_hw->hw_info->hw_lock);
+	spin_lock_init(&tpg_hw->lock_state);
+	init_completion(&tpg_hw->hw_info->hw_complete);
+	init_completion(&tpg_hw->tpg_complete);
+
+	rc = cam_top_tpg_init_soc_resources(&tpg_hw->hw_info->soc_info,
+		cam_top_tpg_irq, tpg_hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "TPG:%d Failed to init_soc", tpg_idx);
+		goto err;
+	}
+
+	tpg_hw->hw_intf->hw_ops.init        = cam_top_tpg_init_hw;
+	tpg_hw->hw_intf->hw_ops.deinit      = cam_top_tpg_deinit_hw;
+	tpg_hw->hw_intf->hw_ops.reset       = NULL;
+	tpg_hw->hw_intf->hw_ops.release     = cam_top_tpg_release;
+	tpg_hw->hw_intf->hw_ops.read        = cam_top_tpg_read;
+	tpg_hw->hw_intf->hw_ops.write       = cam_top_tpg_write;
+	tpg_hw->hw_intf->hw_ops.process_cmd = cam_top_tpg_process_cmd;
+
+	hw_version = tpg_hw->tpg_info->hw_dts_version;
+	if (hw_version == CAM_TOP_TPG_VERSION_1)
+		cam_top_tpg_ver1_init(tpg_hw);
+	else if (hw_version == CAM_TOP_TPG_VERSION_2)
+		cam_top_tpg_ver2_init(tpg_hw);
+	else if (hw_version == CAM_TOP_TPG_VERSION_3)
+		cam_top_tpg_ver3_init(tpg_hw);
+
+	tpg_hw->tpg_res.res_type = CAM_ISP_RESOURCE_TPG;
+	tpg_hw->tpg_res.res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	tpg_hw->tpg_res.hw_intf = tpg_hw->hw_intf;
+	tpg_data = kzalloc(sizeof(*tpg_data), GFP_KERNEL);
+	if (!tpg_data) {
+		rc = -ENOMEM;
+		goto err;
+	}
+	tpg_hw->tpg_res.res_priv = tpg_data;
+
+	cam_top_tpg_enable_soc_resources(&tpg_hw->hw_info->soc_info,
+		CAM_SVS_VOTE);
+
+	cam_top_tpg_disable_soc_resources(&tpg_hw->hw_info->soc_info);
+
+err:
+	return rc;
+}
+
+int cam_top_tpg_deinit(struct cam_top_tpg_hw *top_tpg_hw)
+{
+	int rc = -EINVAL;
+
+	if (!top_tpg_hw) {
+		CAM_ERR(CAM_ISP, "Invalid param");
+		return rc;
+	}
+
+	/* release the privdate data memory from resources */
+	kfree(top_tpg_hw->tpg_res.res_priv);
+	cam_top_tpg_deinit_soc_resources(&top_tpg_hw->hw_info->soc_info);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_core.h
@@ -0,0 +1,133 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG_CORE_H_
+#define _CAM_TOP_TPG_CORE_H_
+
+#include "cam_hw.h"
+#include "cam_top_tpg_hw_intf.h"
+#include "cam_top_tpg_soc.h"
+
+#define CAM_TOP_TPG_VERSION_1             0x10000001
+#define CAM_TOP_TPG_VERSION_2             0x10000002
+#define CAM_TOP_TPG_VERSION_3             0x20000000
+
+
+enum cam_top_tpg_encode_format {
+	CAM_TOP_TPG_ENCODE_FORMAT_RAW6,
+	CAM_TOP_TPG_ENCODE_FORMAT_RAW8,
+	CAM_TOP_TPG_ENCODE_FORMAT_RAW10,
+	CAM_TOP_TPG_ENCODE_FORMAT_RAW12,
+	CAM_TOP_TPG_ENCODE_FORMAT_RAW14,
+	CAM_TOP_TPG_ENCODE_FORMAT_RAW16,
+	CAM_TOP_TPG_ENCODE_FORMAT_MAX,
+};
+
+/**
+ * struct cam_top_tpg_hw_info- tpg hardware info
+ *
+ * @tpg_reg:         tpg register offsets
+ * @hw_dts_version:  HW DTS version
+ * @csid_max_clk:    maximum csid clock
+ * @phy_max_clk      maximum phy clock
+ *
+ */
+struct cam_top_tpg_hw_info {
+	void                                   *tpg_reg;
+	uint32_t                                hw_dts_version;
+	uint32_t                                csid_max_clk;
+	uint32_t                                phy_max_clk;
+};
+
+/**
+ * struct cam_top_tpg_dt_cfg- tpg data type(dt) configuration
+ *
+ * @frame_width:     frame width in pixel
+ * @frame_height:    frame height in pixel
+ * @data_type:       data type(dt) value
+ * @encode_format:   encode format for this data type
+ * @payload_mode     payload data, such color bar, color box etc
+ * @bayer_pattern:   Bayer patter information
+ * @rotate_period:   period value for repeating color, 0 for no rotate
+ * @split_en:        enables split mode
+ * @unicolor_en:     enables unicolor value
+ * @unicolor_sel:    select color used in unicolor mode
+ *
+ */
+struct cam_top_tpg_dt_cfg {
+	uint32_t                               frame_width;
+	uint32_t                               frame_height;
+	uint32_t                               data_type;
+	uint32_t                               encode_format;
+	uint32_t                               payload_mode;
+	uint32_t                               bayer_pattern;
+	uint32_t                               rotate_period;
+	uint32_t                               split_en;
+	uint32_t                               unicolor_en;
+	uint32_t                               unicolor_sel;
+};
+
+/**
+ * struct cam_top_tpg_cfg- tpg congiguration
+ * @pix_pattern :    pixel pattern output of the tpg
+ * @phy_sel :        phy selection 0:dphy or 1:cphy
+ * @num_active_lanes Number of active lines
+ * @vc_num:          Virtual channel number
+ * @h_blank_count:   horizontal blanking count value
+ * @h_blank_count:   vertical blanking count value
+ * @vbi_cnt:         vbi count
+ * @num_active_dts:  number of active dts need to configure
+ * @num_frames:      number of output frames
+ * @qcfa_en:         enable qcfa in color bar cfg
+ * @dt_cfg:          dt configuration values
+ *
+ */
+struct cam_top_tpg_cfg {
+	uint32_t                        pix_pattern;
+	uint32_t                        phy_sel;
+	uint32_t                        num_active_lanes;
+	uint32_t                        vc_num[4];
+	uint32_t                        v_blank_count;
+	uint32_t                        h_blank_count;
+	uint32_t                        vbi_cnt;
+	uint32_t                        num_active_dts;
+	uint32_t                        num_frames;
+	uint32_t                        vc_dt_pattern_id;
+	uint32_t                        qcfa_en;
+	struct cam_top_tpg_dt_cfg       dt_cfg[4];
+};
+
+/**
+ * struct cam_top_tpg_hw- tpg hw device resources data
+ *
+ * @hw_intf:                  contain the tpg hw interface information
+ * @hw_info:                  tpg hw device information
+ * @tpg_info:                 tpg hw specific information
+ * @tpg_res:                  tpg resource
+ * @tpg_pattern:              tpg pattern configuration
+ * @clk_rate                  clock rate
+ * @lock_state                lock state
+ * @tpg_complete              tpg completion
+ *
+ */
+struct cam_top_tpg_hw {
+	struct cam_hw_intf              *hw_intf;
+	struct cam_hw_info              *hw_info;
+	struct cam_top_tpg_hw_info      *tpg_info;
+	struct cam_isp_resource_node     tpg_res;
+	uint32_t                         tpg_pattern;
+	uint64_t                         clk_rate;
+	spinlock_t                       lock_state;
+	struct completion                tpg_complete;
+};
+
+int cam_top_tpg_get_format(uint32_t    in_format, uint32_t *tpg_encode_format);
+
+int cam_top_tpg_probe_init(struct cam_hw_intf *tpg_hw_intf,
+	uint32_t tpg_idx);
+
+int cam_top_tpg_deinit(struct cam_top_tpg_hw *top_tpg_hw);
+
+#endif /* _CAM_TOP_TPG_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_dev.c
@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include "cam_top_tpg_core.h"
+#include "cam_top_tpg_dev.h"
+#include "cam_top_tpg_hw_intf.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+
+static struct cam_hw_intf *cam_top_tpg_hw_list[CAM_TOP_TPG_HW_NUM_MAX] = {
+	0, 0};
+
+static char tpg_dev_name[8];
+
+static int cam_top_tpg_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf             *tpg_hw_intf;
+	struct cam_hw_info             *hw_info;
+	struct cam_top_tpg_hw          *tpg_hw = NULL;
+	const struct of_device_id      *match_dev = NULL;
+	struct cam_top_tpg_hw_info     *tpg_hw_info = NULL;
+	uint32_t                        tpg_dev_idx;
+	int                             rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_ISP, "Binding TPG component");
+
+	tpg_hw_intf = kzalloc(sizeof(*tpg_hw_intf), GFP_KERNEL);
+	if (!tpg_hw_intf) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	hw_info = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!hw_info) {
+		rc = -ENOMEM;
+		goto free_hw_intf;
+	}
+
+	tpg_hw = kzalloc(sizeof(struct cam_top_tpg_hw), GFP_KERNEL);
+	if (!tpg_hw) {
+		rc = -ENOMEM;
+		goto free_hw_info;
+	}
+
+	/* get top tpg hw index */
+	of_property_read_u32(pdev->dev.of_node, "cell-index", &tpg_dev_idx);
+	/* get top tpg hw information */
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "No matching table for the top tpg hw");
+		rc = -EINVAL;
+		goto free_dev;
+	}
+
+	memset(tpg_dev_name, 0, sizeof(tpg_dev_name));
+	snprintf(tpg_dev_name, sizeof(tpg_dev_name),
+		"tpg%1u", tpg_dev_idx);
+
+	tpg_hw_intf->hw_idx = tpg_dev_idx;
+	tpg_hw_intf->hw_type = CAM_ISP_HW_TYPE_TPG;
+	tpg_hw_intf->hw_priv = hw_info;
+
+	hw_info->core_info = tpg_hw;
+	hw_info->soc_info.pdev = pdev;
+	hw_info->soc_info.dev = &pdev->dev;
+	hw_info->soc_info.dev_name = tpg_dev_name;
+	hw_info->soc_info.index = tpg_dev_idx;
+
+	tpg_hw_info = (struct cam_top_tpg_hw_info  *)match_dev->data;
+	/* need to setup the pdev before call the tfe hw probe init */
+	tpg_hw->tpg_info = tpg_hw_info;
+
+	rc = cam_top_tpg_probe_init(tpg_hw_intf, tpg_dev_idx);
+	if (rc)
+		goto free_dev;
+
+	platform_set_drvdata(pdev, tpg_hw);
+	CAM_DBG(CAM_ISP, "TPG: %d component binded successfully",
+		tpg_hw_intf->hw_idx);
+
+	if (tpg_hw_intf->hw_idx < CAM_TOP_TPG_HW_NUM_MAX)
+		cam_top_tpg_hw_list[tpg_hw_intf->hw_idx] = tpg_hw_intf;
+	else
+		goto free_dev;
+
+	return 0;
+
+free_dev:
+	kfree(tpg_hw);
+free_hw_info:
+	kfree(hw_info);
+free_hw_intf:
+	kfree(tpg_hw_intf);
+err:
+	return rc;
+}
+
+static void cam_top_tpg_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_top_tpg_hw          *tpg_dev = NULL;
+	struct cam_hw_intf             *tpg_hw_intf;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct cam_hw_info             *hw_info;
+
+	tpg_dev = (struct cam_top_tpg_hw *)platform_get_drvdata(pdev);
+	tpg_hw_intf = tpg_dev->hw_intf;
+	hw_info = tpg_dev->hw_info;
+
+	CAM_DBG(CAM_ISP, "TPG:%d component unbound", tpg_dev->hw_intf->hw_idx);
+	cam_top_tpg_deinit(tpg_dev);
+
+	/*release the tpg device memory */
+	kfree(tpg_dev);
+	kfree(hw_info);
+	kfree(tpg_hw_intf);
+}
+
+const static struct component_ops cam_top_tpg_component_ops = {
+	.bind = cam_top_tpg_component_bind,
+	.unbind = cam_top_tpg_component_unbind,
+};
+
+int cam_top_tpg_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Adding TPG component");
+	rc = component_add(&pdev->dev, &cam_top_tpg_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_top_tpg_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_top_tpg_component_ops);
+	return 0;
+}
+
+int cam_top_tpg_hw_init(struct cam_hw_intf **top_tpg_hw,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_top_tpg_hw_list[hw_idx]) {
+		*top_tpg_hw = cam_top_tpg_hw_list[hw_idx];
+	} else {
+		*top_tpg_hw = NULL;
+		rc = -1;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_dev.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG_DEV_H_
+#define _CAM_TOP_TPG_DEV_H_
+
+int cam_top_tpg_probe(struct platform_device *pdev);
+int cam_top_tpg_remove(struct platform_device *pdev);
+
+#endif /*_CAM_TOP_TPG_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_soc.c
@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+#include <linux/slab.h>
+#include "cam_top_tpg_soc.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+
+int cam_top_tpg_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t tpg_irq_handler, void *irq_data)
+{
+	int rc = 0;
+	struct cam_cpas_register_params   cpas_register_param;
+	struct cam_top_tpg_soc_private    *soc_private;
+
+	soc_private = kzalloc(sizeof(struct cam_top_tpg_soc_private),
+		GFP_KERNEL);
+	if (!soc_private)
+		return -ENOMEM;
+
+	soc_info->soc_private = soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	/* Need to see if we want post process the clock list */
+	rc = cam_soc_util_request_platform_resource(soc_info, tpg_irq_handler,
+		irq_data);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Error Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "tpg",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	} else {
+		soc_private->cpas_handle = cpas_register_param.client_handle;
+	}
+
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_top_tpg_deinit_soc_resources(
+	struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_top_tpg_soc_private       *soc_private;
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPAS unregistration failed rc=%d", rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+
+	return rc;
+}
+
+int cam_top_tpg_enable_soc_resources(
+	struct cam_hw_soc_info *soc_info, enum cam_vote_level clk_level)
+{
+	int rc = 0;
+	struct cam_top_tpg_soc_private       *soc_private;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_SVS_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	CAM_DBG(CAM_ISP, "csid camnoc_bw:%lld mnoc_ab_bw:%lld mnoc_ib_bw:%lld ",
+		axi_vote.axi_path[0].camnoc_bw,
+		axi_vote.axi_path[0].mnoc_ab_bw,
+		axi_vote.axi_path[0].mnoc_ib_bw);
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS start failed");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		clk_level, false);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "enable platform failed");
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_top_tpg_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_top_tpg_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		return -EINVAL;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, false);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Disable platform failed");
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_soc.h
@@ -0,0 +1,79 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG_SOC_H_
+#define _CAM_TOP_TPG_SOC_H_
+
+#include "cam_isp_hw.h"
+
+/*
+ * struct cam_top_tpg_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to TPG HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ */
+struct cam_top_tpg_soc_private {
+	uint32_t cpas_handle;
+};
+
+/**
+ * struct cam_top_tpg_device_soc_info - tpg soc SOC info object
+ *
+ * @csi_vdd_voltage:       csi vdd voltage value
+ *
+ */
+struct cam_top_tpg_device_soc_info {
+	int                             csi_vdd_voltage;
+};
+
+/**
+ * cam_top_tpg_init_soc_resources()
+ *
+ * @brief:                 csid initialization function for the soc info
+ *
+ * @soc_info:              soc info structure pointer
+ * @tpg_irq_handler:       irq handler function to be registered
+ * @irq_data:              irq data for the callback function
+ *
+ */
+int cam_top_tpg_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t tpg_irq_handler, void *irq_data);
+
+/**
+ * cam_top_tpg_deinit_soc_resources()
+ *
+ * @brief:                 tpg de initialization function for the soc info
+ *
+ * @soc_info:              soc info structure pointer
+ *
+ */
+int cam_top_tpg_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_top_tpg_enable_soc_resources()
+ *
+ * @brief:                 tpg soc resource enable function
+ *
+ * @soc_info:              soc info structure pointer
+ * @clk_lvl:               vote level to start with
+ *
+ */
+int cam_top_tpg_enable_soc_resources(struct cam_hw_soc_info  *soc_info,
+	enum cam_vote_level clk_lvl);
+
+/**
+ * cam_top_tpg_disable_soc_resources()
+ *
+ * @brief:                 csid soc resource disable function
+ *
+ * @soc_info:              soc info structure pointer
+ *
+ */
+int cam_top_tpg_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_TOP_TPG_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver1.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver1.c
@@ -0,0 +1,422 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+#include <media/cam_tfe.h>
+#include <media/cam_defs.h>
+
+#include "cam_top_tpg_core.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_top_tpg_ver1.h"
+
+static uint32_t tpg_num_dt_map[CAM_TOP_TPG_MAX_SUPPORTED_DT] = {
+	0,
+	3,
+	1,
+	2
+};
+
+static int cam_top_tpg_ver1_get_hw_caps(
+	void                                         *hw_priv,
+	void                                         *get_hw_cap_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw_caps                   *hw_caps;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	const struct cam_top_tpg_ver1_reg_offset     *tpg_reg;
+	struct cam_hw_info                           *tpg_hw_info;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	hw_caps = (struct cam_top_tpg_hw_caps *) get_hw_cap_args;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+
+	hw_caps->major_version = tpg_reg->major_version;
+	hw_caps->minor_version = tpg_reg->minor_version;
+	hw_caps->version_incr = tpg_reg->version_incr;
+
+	CAM_DBG(CAM_ISP,
+		"TPG:%d major:%d minor:%d ver :%d",
+		tpg_hw->hw_intf->hw_idx, hw_caps->major_version,
+		hw_caps->minor_version, hw_caps->version_incr);
+
+	return rc;
+}
+
+static int cam_top_tpg_ver1_reserve(
+	void                                         *hw_priv,
+	void                                         *reserve_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_info                           *tpg_hw_info;
+	struct cam_top_tpg_ver1_reserve_args         *reserv;
+	struct cam_top_tpg_cfg                       *tpg_data;
+	uint32_t                                      encode_format = 0;
+	uint32_t                                      i;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_top_tpg_ver1_reserve_args))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw *)tpg_hw_info->core_info;
+	reserv = (struct cam_top_tpg_ver1_reserve_args  *)reserve_args;
+
+	if (reserv->num_inport <= 0 ||
+		reserv->num_inport > CAM_TOP_TPG_MAX_SUPPORTED_DT) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "TPG: %u invalid input num port:%d",
+			tpg_hw->hw_intf->hw_idx, reserv->num_inport);
+		return -EINVAL;
+	}
+
+	mutex_lock(&tpg_hw->hw_info->hw_mutex);
+	if (tpg_hw->tpg_res.res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+		return -EINVAL;
+	}
+
+	if ((reserv->in_port[0]->vc > 0xF) ||
+		(reserv->in_port[0]->lane_num <= 0 ||
+		reserv->in_port[0]->lane_num > 4) ||
+		(reserv->in_port[0]->pix_pattern > 4) ||
+		(reserv->in_port[0]->lane_type >= 2)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "TPG:%u invalid input %d %d %d %d",
+			tpg_hw->hw_intf->hw_idx, reserv->in_port[0]->vc,
+			reserv->in_port[0]->lane_num,
+			reserv->in_port[0]->pix_pattern,
+			reserv->in_port[0]->lane_type);
+		mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+		return -EINVAL;
+	}
+	rc = cam_top_tpg_get_format(reserv->in_port[0]->format,
+		&encode_format);
+	if (rc)
+		goto error;
+
+	CAM_DBG(CAM_ISP, "TPG: %u enter", tpg_hw->hw_intf->hw_idx);
+
+	tpg_data = (struct cam_top_tpg_cfg *)tpg_hw->tpg_res.res_priv;
+	tpg_data->vc_num[0] = reserv->in_port[0]->vc;
+	tpg_data->phy_sel = reserv->in_port[0]->lane_type;
+	tpg_data->num_active_lanes = reserv->in_port[0]->lane_num;
+	tpg_data->h_blank_count = reserv->in_port[0]->sensor_hbi;
+	tpg_data->v_blank_count = reserv->in_port[0]->sensor_vbi;
+	tpg_data->pix_pattern = reserv->in_port[0]->pix_pattern;
+	tpg_data->dt_cfg[0].data_type = reserv->in_port[0]->dt;
+	tpg_data->dt_cfg[0].frame_height = reserv->in_port[0]->height;
+	if (reserv->in_port[0]->usage_type)
+		tpg_data->dt_cfg[0].frame_width =
+			((reserv->in_port[0]->right_end -
+				reserv->in_port[0]->left_start) + 1);
+	else
+		tpg_data->dt_cfg[0].frame_width =
+			reserv->in_port[0]->left_width;
+	tpg_data->dt_cfg[0].encode_format = encode_format;
+	tpg_data->num_active_dts = 1;
+
+	CAM_DBG(CAM_ISP,
+		"TPG:%u vc_num:%d dt:%d phy:%d lines:%d pattern:%d format:%d",
+		tpg_hw->hw_intf->hw_idx,
+		tpg_data->vc_num[0], tpg_data->dt_cfg[0].data_type,
+		tpg_data->phy_sel, tpg_data->num_active_lanes,
+		tpg_data->pix_pattern,
+		tpg_data->dt_cfg[0].encode_format);
+
+	CAM_DBG(CAM_ISP, "TPG:%u height:%d width:%d h blank:%d v blank:%d",
+		tpg_hw->hw_intf->hw_idx,
+		tpg_data->dt_cfg[0].frame_height,
+		tpg_data->dt_cfg[0].frame_width,
+		tpg_data->h_blank_count,
+		tpg_data->v_blank_count);
+
+	if (reserv->num_inport == 1)
+		goto end;
+
+	for (i = 1; i < reserv->num_inport; i++) {
+		if ((tpg_data->vc_num[0] != reserv->in_port[i]->vc) ||
+			(tpg_data->phy_sel != reserv->in_port[i]->lane_type) ||
+			(tpg_data->num_active_lanes !=
+				reserv->in_port[i]->lane_num) ||
+			(tpg_data->pix_pattern !=
+			reserv->in_port[i]->pix_pattern)) {
+			CAM_ERR_RATE_LIMIT(CAM_ISP,
+				"TPG: %u invalid DT config for tpg",
+				tpg_hw->hw_intf->hw_idx);
+			rc = -EINVAL;
+			goto error;
+		}
+		rc = cam_top_tpg_get_format(reserv->in_port[0]->format,
+			&encode_format);
+		if (rc)
+			return rc;
+
+		tpg_data->dt_cfg[i].data_type = reserv->in_port[i]->dt;
+		tpg_data->dt_cfg[i].frame_height =
+			reserv->in_port[i]->height;
+		tpg_data->dt_cfg[i].frame_width =
+			reserv->in_port[i]->left_width;
+		tpg_data->dt_cfg[i].encode_format = encode_format;
+		tpg_data->num_active_dts++;
+
+		CAM_DBG(CAM_ISP, "TPG:%u height:%d width:%d dt:%d format:%d",
+			tpg_hw->hw_intf->hw_idx,
+			tpg_data->dt_cfg[i].frame_height,
+			tpg_data->dt_cfg[i].frame_width,
+			tpg_data->dt_cfg[i].data_type,
+			tpg_data->dt_cfg[i].encode_format);
+
+	}
+end:
+	reserv->node_res = &tpg_hw->tpg_res;
+	tpg_hw->tpg_res.res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+error:
+	mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+	CAM_DBG(CAM_ISP, "exit rc %u", rc);
+
+	return rc;
+}
+
+static int cam_top_tpg_ver1_start(
+	void                                         *hw_priv,
+	void                                         *start_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_info                           *tpg_hw_info;
+	struct cam_hw_soc_info                       *soc_info;
+	struct cam_isp_resource_node                 *tpg_res;
+	struct cam_top_tpg_ver1_reg_offset           *tpg_reg;
+	struct cam_top_tpg_cfg                       *tpg_data;
+	uint32_t                                      i, val;
+	uint32_t in_format = 0;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+	tpg_res = (struct cam_isp_resource_node *)start_args;
+	tpg_data = (struct cam_top_tpg_cfg  *)tpg_res->res_priv;
+	soc_info = &tpg_hw->hw_info->soc_info;
+
+	if ((tpg_res->res_type != CAM_ISP_RESOURCE_TPG) ||
+		(tpg_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED)) {
+		CAM_ERR(CAM_ISP, "TPG:%d Invalid Res type:%d res_state:%d",
+			tpg_hw->hw_intf->hw_idx,
+			tpg_res->res_type, tpg_res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+	cam_io_w_mb(0x12345678, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_lfsr_seed);
+
+	for (i = 0; i < tpg_data->num_active_dts; i++) {
+		val = (((tpg_data->dt_cfg[i].frame_width & 0xFFFF) << 16) |
+			(tpg_data->dt_cfg[i].frame_height & 0x3FFF));
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_dt_0_cfg_0 + 0x10 * i);
+		cam_io_w_mb(tpg_data->dt_cfg[i].data_type,
+			soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_dt_0_cfg_1 + 0x10 * i);
+		val = ((tpg_data->dt_cfg[i].encode_format & 0xF) <<
+			tpg_reg->tpg_dt_encode_format_shift) |
+			tpg_reg->tpg_payload_mode_color;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_dt_0_cfg_2 + 0x10 * i);
+	}
+
+	/* configure one DT, infinite frames */
+	val = (tpg_num_dt_map[tpg_data->num_active_dts-1] <<
+		 tpg_reg->tpg_num_dts_shift_val) | tpg_data->vc_num[0];
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc_cfg0);
+
+	/*
+	 * if hblank is notset configureHBlank count 500 and
+	 * V blank count is 600
+	 */
+
+	if (tpg_data->h_blank_count)
+		cam_io_w_mb(tpg_data->h_blank_count,
+			soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc_cfg1);
+	else
+		cam_io_w_mb(0x2581F4,
+		soc_info->reg_map[0].mem_base + tpg_reg->tpg_vc_cfg1);
+
+	/* configure tpg pattern */
+	in_format = tpg_data->dt_cfg[0].encode_format & 0xF;
+	val = in_format << tpg_reg->tpg_dt_encode_format_shift;
+
+	switch (tpg_hw->tpg_pattern) {
+	case 0x0:
+		val = val | tpg_hw->tpg_pattern;
+		break;
+	case 0x1:
+		val = val | tpg_hw->tpg_pattern;
+		break;
+	case 0x2:
+		val = val | tpg_hw->tpg_pattern;
+		break;
+	case 0x3:
+		val = val | tpg_hw->tpg_pattern;
+		break;
+	case 0x4:
+		val = val | tpg_hw->tpg_pattern;
+		break;
+	case 0x5:
+		val = val | tpg_hw->tpg_pattern;
+		break;
+	case 0x6:
+		val = val | tpg_hw->tpg_pattern;
+		break;
+	case 0x7:
+		val = val | tpg_hw->tpg_pattern;
+		break;
+	case 0x8:
+		/* unicolor bar selection */
+		val = 0x1 | (1 << tpg_reg->top_unicolor_bar_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_color_bar_cfg);
+		val = (in_format << tpg_reg->tpg_dt_encode_format_shift) |
+			tpg_hw->tpg_pattern;
+		break;
+	default:
+		/* frame with split color bar */
+		val =  1 << tpg_reg->tpg_split_en_shift;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_color_bar_cfg);
+		val = (in_format << tpg_reg->tpg_dt_encode_format_shift) |
+			CAM_TOP_TPG_DEFAULT_PATTERN;
+		break;
+	}
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_dt_0_cfg_2);
+
+	/* config pix pattern */
+	val = (1 << tpg_reg->tpg_split_en_shift);
+	cam_io_w_mb(tpg_data->pix_pattern, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_common_gen_cfg);
+
+	/* if VBI is notset configureVBI to 0xAFF */
+	if (tpg_data->v_blank_count)
+		cam_io_w_mb(tpg_data->v_blank_count,
+			soc_info->reg_map[0].mem_base + tpg_reg->tpg_vbi_cfg);
+	else
+		cam_io_w_mb(0xAFFF,
+			soc_info->reg_map[0].mem_base + tpg_reg->tpg_vbi_cfg);
+
+	/* Set the TOP tpg mux sel*/
+	val = cam_io_r_mb(soc_info->reg_map[1].mem_base +
+			tpg_reg->top_mux_reg_offset);
+	val |= (1 << tpg_hw->hw_intf->hw_idx);
+
+	cam_io_w_mb(val,
+		soc_info->reg_map[1].mem_base + tpg_reg->top_mux_reg_offset);
+	CAM_DBG(CAM_ISP, "TPG:%d Set top Mux: 0x%x",
+		tpg_hw->hw_intf->hw_idx, val);
+
+	val = ((tpg_data->num_active_lanes - 1) <<
+		tpg_reg->tpg_num_active_lines_shift) |
+		(1 << tpg_reg->tpg_fe_pkt_en_shift) |
+		(1 << tpg_reg->tpg_fs_pkt_en_shift) |
+		(tpg_data->phy_sel << tpg_reg->tpg_phy_sel_shift_val) |
+		(1 << tpg_reg->tpg_en_shift_val);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+
+	tpg_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_hw_version);
+	CAM_DBG(CAM_ISP, "TPG:%d TPG HW version: 0x%x started",
+		tpg_hw->hw_intf->hw_idx, val);
+
+end:
+	return rc;
+}
+
+static int cam_top_tpg_ver1_stop(
+	void                                         *hw_priv,
+	void                                         *stop_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_info                           *tpg_hw_info;
+	struct cam_hw_soc_info                       *soc_info;
+	struct cam_isp_resource_node                 *tpg_res;
+	const struct cam_top_tpg_ver1_reg_offset     *tpg_reg;
+	struct cam_top_tpg_cfg                       *tpg_data;
+	uint32_t                                      val;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+	tpg_res = (struct cam_isp_resource_node  *) stop_args;
+	tpg_data = (struct cam_top_tpg_cfg  *)tpg_res->res_state;
+	soc_info = &tpg_hw->hw_info->soc_info;
+
+	if ((tpg_res->res_type != CAM_ISP_RESOURCE_TPG) ||
+		(tpg_res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING)) {
+		CAM_DBG(CAM_ISP, "TPG:%d Invalid Res type:%d res_state:%d",
+			tpg_hw->hw_intf->hw_idx,
+			tpg_res->res_type, tpg_res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_ctrl);
+
+	/* Reset the TOP tpg mux sel*/
+	val = cam_io_r_mb(soc_info->reg_map[1].mem_base +
+			tpg_reg->top_mux_reg_offset);
+	val &= ~(1 << tpg_hw->hw_intf->hw_idx);
+
+	cam_io_w_mb(val,
+		soc_info->reg_map[1].mem_base + tpg_reg->top_mux_reg_offset);
+	CAM_DBG(CAM_ISP, "TPG:%d Reset Top Mux: 0x%x",
+		tpg_hw->hw_intf->hw_idx, val);
+
+	tpg_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	CAM_DBG(CAM_ISP, "TPG:%d stopped", tpg_hw->hw_intf->hw_idx);
+end:
+	return rc;
+}
+
+int cam_top_tpg_ver1_init(
+	struct cam_top_tpg_hw                        *tpg_hw)
+{
+	tpg_hw->hw_intf->hw_ops.get_hw_caps = cam_top_tpg_ver1_get_hw_caps;
+	tpg_hw->hw_intf->hw_ops.reserve     = cam_top_tpg_ver1_reserve;
+	tpg_hw->hw_intf->hw_ops.start       = cam_top_tpg_ver1_start;
+	tpg_hw->hw_intf->hw_ops.stop        = cam_top_tpg_ver1_stop;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver1.h
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG_VER1_H_
+#define _CAM_TOP_TPG_VER1_H_
+
+#include "cam_top_tpg_core.h"
+
+struct cam_top_tpg_ver1_reg_offset {
+	uint32_t tpg_hw_version;
+	uint32_t tpg_hw_status;
+	uint32_t tpg_ctrl;
+	uint32_t tpg_vc_cfg0;
+	uint32_t tpg_vc_cfg1;
+	uint32_t tpg_lfsr_seed;
+	uint32_t tpg_dt_0_cfg_0;
+	uint32_t tpg_dt_1_cfg_0;
+	uint32_t tpg_dt_2_cfg_0;
+	uint32_t tpg_dt_3_cfg_0;
+	uint32_t tpg_dt_0_cfg_1;
+	uint32_t tpg_dt_1_cfg_1;
+	uint32_t tpg_dt_2_cfg_1;
+	uint32_t tpg_dt_3_cfg_1;
+	uint32_t tpg_dt_0_cfg_2;
+	uint32_t tpg_dt_1_cfg_2;
+	uint32_t tpg_dt_2_cfg_2;
+	uint32_t tpg_dt_3_cfg_2;
+	uint32_t tpg_color_bar_cfg;
+	uint32_t tpg_common_gen_cfg;
+	uint32_t tpg_vbi_cfg;
+	uint32_t tpg_test_bus_crtl;
+	uint32_t tpg_spare;
+	/* configurations */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t tpg_en_shift_val;
+	uint32_t tpg_phy_sel_shift_val;
+	uint32_t tpg_num_active_lines_shift;
+	uint32_t tpg_fe_pkt_en_shift;
+	uint32_t tpg_fs_pkt_en_shift;
+	uint32_t tpg_line_interleaving_mode_shift;
+	uint32_t tpg_num_dts_shift_val;
+	uint32_t tpg_v_blank_cnt_shift;
+	uint32_t tpg_dt_encode_format_shift;
+	uint32_t tpg_payload_mode_color;
+	uint32_t tpg_split_en_shift;
+	uint32_t top_mux_reg_offset;
+	uint32_t top_unicolor_bar_shift;
+};
+
+int cam_top_tpg_ver1_init(struct cam_top_tpg_hw *tpg_hw);
+
+#endif /* _CAM_TOP_TPG_VER1_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver2.c
@@ -0,0 +1,242 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+#include <media/cam_defs.h>
+
+#include "cam_top_tpg_core.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_top_tpg_ver2.h"
+
+#define CAM_TOP_TPG_VER2_MAX_SUPPORTED_DT 1
+
+static int cam_top_tpg_ver2_get_hw_caps(
+	void                                         *hw_priv,
+	void                                         *get_hw_cap_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw_caps                   *hw_caps;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	const struct cam_top_tpg_ver2_reg_offset     *tpg_reg;
+	struct cam_hw_info                           *tpg_hw_info;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	hw_caps = (struct cam_top_tpg_hw_caps *) get_hw_cap_args;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+
+	hw_caps->major_version = tpg_reg->major_version;
+	hw_caps->minor_version = tpg_reg->minor_version;
+	hw_caps->version_incr = tpg_reg->version_incr;
+
+	CAM_DBG(CAM_ISP,
+		"TPG:%d major:%d minor:%d ver :%d",
+		tpg_hw->hw_intf->hw_idx, hw_caps->major_version,
+		hw_caps->minor_version, hw_caps->version_incr);
+
+	return rc;
+}
+
+static int cam_top_tpg_ver2_reserve(
+	void                                         *hw_priv,
+	void                                         *reserve_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_info                           *tpg_hw_info;
+	struct cam_top_tpg_ver2_reserve_args         *reserv;
+	struct cam_top_tpg_cfg                       *tpg_data;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_top_tpg_ver2_reserve_args))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw *)tpg_hw_info->core_info;
+	reserv = (struct cam_top_tpg_ver2_reserve_args  *)reserve_args;
+
+	if (reserv->num_inport <= 0 ||
+		reserv->num_inport > CAM_TOP_TPG_VER2_MAX_SUPPORTED_DT) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "TPG: %u invalid input num port:%d",
+			tpg_hw->hw_intf->hw_idx, reserv->num_inport);
+		return -EINVAL;
+	}
+
+	mutex_lock(&tpg_hw->hw_info->hw_mutex);
+	if (tpg_hw->tpg_res.res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "TPG:%d resource not available state:%d",
+			tpg_hw->hw_intf->hw_idx, tpg_hw->tpg_res.res_state);
+		mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+		return -EINVAL;
+	}
+
+	tpg_data = (struct cam_top_tpg_cfg *)tpg_hw->tpg_res.res_priv;
+	tpg_data->h_blank_count = reserv->in_port->hbi_cnt;
+	tpg_data->v_blank_count = 600;
+	tpg_data->dt_cfg[0].data_type = reserv->in_port->dt[0];
+	tpg_data->dt_cfg[0].frame_height = reserv->in_port->height;
+	if (reserv->in_port->usage_type)
+		tpg_data->dt_cfg[0].frame_width =
+			((reserv->in_port->right_stop -
+				reserv->in_port->left_start) + 1);
+	else
+		tpg_data->dt_cfg[0].frame_width =
+			reserv->in_port->left_width;
+	tpg_data->num_active_dts = 1;
+
+	CAM_DBG(CAM_ISP, "TPG:%u dt:0x%x h:%d w:%d hbi:%d vbi:%d reserved",
+		tpg_hw->hw_intf->hw_idx,
+		tpg_data->dt_cfg[0].data_type,
+		tpg_data->dt_cfg[0].frame_height,
+		tpg_data->dt_cfg[0].frame_width,
+		tpg_data->h_blank_count,
+		tpg_data->v_blank_count);
+
+	reserv->node_res = &tpg_hw->tpg_res;
+	tpg_hw->tpg_res.res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+
+	return rc;
+}
+
+static int cam_top_tpg_ver2_start(
+	void                                         *hw_priv,
+	void                                         *start_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_info                           *tpg_hw_info;
+	struct cam_hw_soc_info                       *soc_info;
+	struct cam_isp_resource_node                 *tpg_res;
+	struct cam_top_tpg_ver2_reg_offset           *tpg_reg;
+	struct cam_top_tpg_cfg                       *tpg_data;
+	uint32_t                                      val;
+	uint32_t                                      mux_sel_shift = 0;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+	tpg_res = (struct cam_isp_resource_node *)start_args;
+	tpg_data = (struct cam_top_tpg_cfg  *)tpg_res->res_priv;
+	soc_info = &tpg_hw->hw_info->soc_info;
+
+	if ((tpg_res->res_type != CAM_ISP_RESOURCE_TPG) ||
+		(tpg_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED)) {
+		CAM_ERR(CAM_ISP, "TPG:%d Invalid Res type:%d res_state:%d",
+			tpg_hw->hw_intf->hw_idx,
+			tpg_res->res_type, tpg_res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tpg_hw->hw_intf->hw_idx == CAM_TOP_TPG_ID_0)
+		mux_sel_shift = tpg_reg->tpg_mux_sel_tpg_0_shift;
+	else if (tpg_hw->hw_intf->hw_idx == CAM_TOP_TPG_ID_1)
+		mux_sel_shift = tpg_reg->tpg_mux_sel_tpg_1_shift;
+
+	cam_io_w_mb((tpg_reg->tpg_mux_sel_en << mux_sel_shift),
+		soc_info->reg_map[1].mem_base + tpg_reg->top_mux_sel);
+
+	val = (((tpg_data->dt_cfg[0].frame_width & 0x3FFF) << 16) |
+		(tpg_data->dt_cfg[0].frame_height & 0x3FFF));
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_cfg_0);
+
+	val = (tpg_data->h_blank_count & 0x7FF) << 20;
+	val |= (tpg_data->v_blank_count & 0x3FFFF);
+
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_cfg_1);
+
+	val = tpg_data->dt_cfg[0].data_type << 11;
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_cfg_2);
+
+	/* program number of frames */
+	cam_io_w_mb(0xFFFFF, soc_info->reg_map[0].mem_base + tpg_reg->tpg_cfg_3);
+
+	cam_io_w_mb(tpg_reg->tpg_module_en, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_module_cfg);
+
+	tpg_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	CAM_DBG(CAM_ISP, "TPG:%d started", tpg_hw->hw_intf->hw_idx);
+
+end:
+	return rc;
+}
+
+static int cam_top_tpg_ver2_stop(
+	void                                         *hw_priv,
+	void                                         *stop_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_info                           *tpg_hw_info;
+	struct cam_hw_soc_info                       *soc_info;
+	struct cam_isp_resource_node                 *tpg_res;
+	const struct cam_top_tpg_ver2_reg_offset     *tpg_reg;
+	struct cam_top_tpg_cfg                       *tpg_data;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+	tpg_res = (struct cam_isp_resource_node  *) stop_args;
+	tpg_data = (struct cam_top_tpg_cfg  *)tpg_res->res_state;
+	soc_info = &tpg_hw->hw_info->soc_info;
+
+	if ((tpg_res->res_type != CAM_ISP_RESOURCE_TPG) ||
+		(tpg_res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING)) {
+		CAM_DBG(CAM_ISP, "TPG:%d Invalid Res type:%d res_state:%d",
+			tpg_hw->hw_intf->hw_idx,
+			tpg_res->res_type, tpg_res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_module_cfg);
+
+	tpg_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	CAM_DBG(CAM_ISP, "TPG:%d stopped", tpg_hw->hw_intf->hw_idx);
+end:
+	return rc;
+}
+
+int cam_top_tpg_ver2_init(
+	struct cam_top_tpg_hw                        *tpg_hw)
+{
+	tpg_hw->hw_intf->hw_ops.get_hw_caps = cam_top_tpg_ver2_get_hw_caps;
+	tpg_hw->hw_intf->hw_ops.reserve     = cam_top_tpg_ver2_reserve;
+	tpg_hw->hw_intf->hw_ops.start       = cam_top_tpg_ver2_start;
+	tpg_hw->hw_intf->hw_ops.stop        = cam_top_tpg_ver2_stop;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver2.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG_VER2_H_
+#define _CAM_TOP_TPG_VER2_H_
+
+#include "cam_top_tpg_core.h"
+
+struct cam_top_tpg_ver2_reg_offset {
+	uint32_t tpg_hw_version;
+	uint32_t tpg_hw_status;
+	uint32_t tpg_module_cfg;
+	uint32_t tpg_cfg_0;
+	uint32_t tpg_cfg_1;
+	uint32_t tpg_cfg_2;
+	uint32_t tpg_cfg_3;
+	uint32_t tpg_spare;
+	uint32_t top_mux_sel;
+	/* configurations */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t tpg_module_en;
+	uint32_t tpg_mux_sel_en;
+	uint32_t tpg_mux_sel_tpg_0_shift;
+	uint32_t tpg_mux_sel_tpg_1_shift;
+	uint32_t tpg_en_shift_val;
+	uint32_t tpg_phy_sel_shift_val;
+	uint32_t tpg_num_active_lines_shift;
+	uint32_t tpg_fe_pkt_en_shift;
+	uint32_t tpg_fs_pkt_en_shift;
+	uint32_t tpg_line_interleaving_mode_shift;
+	uint32_t tpg_num_dts_shift_val;
+	uint32_t tpg_v_blank_cnt_shift;
+	uint32_t tpg_dt_encode_format_shift;
+	uint32_t tpg_payload_mode_color;
+	uint32_t tpg_split_en_shift;
+};
+
+int cam_top_tpg_ver2_init(struct cam_top_tpg_hw *tpg_hw);
+
+#endif /* _CAM_TOP_TPG_VER2_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver3.c
@@ -0,0 +1,393 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/slab.h>
+#include <media/cam_tfe.h>
+#include <media/cam_defs.h>
+
+#include "cam_top_tpg_core.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_top_tpg_ver3.h"
+
+static int cam_top_tpg_ver3_get_hw_caps(
+	void                                         *hw_priv,
+	void                                         *get_hw_cap_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw_caps                   *hw_caps;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	const struct cam_top_tpg_ver3_reg_offset     *tpg_reg;
+	struct cam_hw_info                           *tpg_hw_info;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	hw_caps = (struct cam_top_tpg_hw_caps *) get_hw_cap_args;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+
+	hw_caps->major_version = tpg_reg->major_version;
+	hw_caps->minor_version = tpg_reg->minor_version;
+	hw_caps->version_incr = tpg_reg->version_incr;
+
+	CAM_DBG(CAM_ISP,
+		"TPG:%d major:%d minor:%d ver :%d",
+		tpg_hw->hw_intf->hw_idx, hw_caps->major_version,
+		hw_caps->minor_version, hw_caps->version_incr);
+
+	return rc;
+}
+
+static int cam_top_tpg_ver3_process_cmd(void *hw_priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int                                     rc = 0;
+	struct cam_top_tpg_hw                  *tpg_hw;
+	struct cam_hw_info                     *tpg_hw_info;
+	struct cam_isp_tpg_core_config         *core_cfg;
+	struct cam_top_tpg_cfg                 *tpg_data;
+
+	if (!hw_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw *)tpg_hw_info->core_info;
+	tpg_data = (struct cam_top_tpg_cfg *)tpg_hw->tpg_res.res_priv;
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_TPG_CORE_CFG_CMD:
+		if (arg_size != sizeof(struct cam_isp_tpg_core_config)) {
+			CAM_ERR(CAM_ISP, "Invalid size %u expected %u",
+				arg_size,
+				sizeof(struct cam_isp_tpg_core_config));
+			rc = -EINVAL;
+			break;
+		}
+
+		core_cfg = (struct cam_isp_tpg_core_config *)cmd_args;
+		tpg_data->pix_pattern = core_cfg->pix_pattern;
+		tpg_data->vc_dt_pattern_id = core_cfg->vc_dt_pattern_id;
+		tpg_data->qcfa_en = core_cfg->qcfa_en;
+		CAM_DBG(CAM_ISP,
+			"pattern_id: 0x%x pix_pattern: 0x%x qcfa_en: 0x%x",
+			tpg_data->vc_dt_pattern_id, tpg_data->pix_pattern,
+			tpg_data->qcfa_en);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid TPG cmd type %u", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_top_tpg_ver3_reserve(
+	void                                         *hw_priv,
+	void                                         *reserve_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_info                           *tpg_hw_info;
+	struct cam_top_tpg_ver3_reserve_args         *reserv;
+	struct cam_top_tpg_cfg                       *tpg_data;
+	uint32_t                                      encode_format = 0;
+	uint32_t                                      i;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_top_tpg_ver3_reserve_args))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw *)tpg_hw_info->core_info;
+	reserv = (struct cam_top_tpg_ver3_reserve_args  *)reserve_args;
+
+	if (reserv->num_inport <= 0 ||
+		reserv->num_inport > CAM_TOP_TPG_MAX_SUPPORTED_DT) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "TPG: %u invalid input num port:%d",
+			tpg_hw->hw_intf->hw_idx, reserv->num_inport);
+		return -EINVAL;
+	}
+
+	mutex_lock(&tpg_hw->hw_info->hw_mutex);
+	if (tpg_hw->tpg_res.res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		rc = -EINVAL;
+		goto error;
+	}
+
+	if ((reserv->in_port->lane_num <= 0 ||
+		reserv->in_port->lane_num > 4) ||
+		(reserv->in_port->lane_type >= 2)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "TPG:%u invalid input %d %d",
+			tpg_hw->hw_intf->hw_idx,
+			reserv->in_port->lane_num,
+			reserv->in_port->lane_type);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	tpg_data = (struct cam_top_tpg_cfg *)tpg_hw->tpg_res.res_priv;
+	memset(tpg_data, 0, sizeof(*tpg_data));
+	for (i = 0; i < reserv->in_port->num_valid_vc_dt; i++) {
+		if (reserv->in_port->dt[i] > 0x3f ||
+			reserv->in_port->vc[i] > 0x1f) {
+			CAM_ERR(CAM_ISP, "TPG:%u Invalid vc:%d dt %d",
+				tpg_hw->hw_intf->hw_idx,
+				reserv->in_port->vc[i],
+				reserv->in_port->dt[i]);
+			rc = -EINVAL;
+			goto error;
+		}
+		tpg_data->vc_num[i] = reserv->in_port->vc[i];
+		tpg_data->dt_cfg[i].data_type = reserv->in_port->dt[i];
+	}
+
+	rc = cam_top_tpg_get_format(reserv->in_port->format,
+		&encode_format);
+	if (rc)
+		goto error;
+
+
+	CAM_DBG(CAM_ISP, "TPG: %u enter", tpg_hw->hw_intf->hw_idx);
+
+	tpg_data = (struct cam_top_tpg_cfg *)tpg_hw->tpg_res.res_priv;
+	tpg_data->phy_sel = reserv->in_port->lane_type;
+	tpg_data->num_active_lanes = reserv->in_port->lane_num;
+	tpg_data->h_blank_count = reserv->in_port->hbi_cnt;
+	tpg_data->v_blank_count = 600;
+	tpg_data->num_active_dts = reserv->in_port->num_valid_vc_dt;
+
+	for (i = 0; i < reserv->in_port->num_valid_vc_dt; i++) {
+		tpg_data->dt_cfg[i].encode_format = encode_format;
+		tpg_data->dt_cfg[i].frame_height = reserv->in_port->height;
+
+		if (reserv->in_port->usage_type)
+			tpg_data->dt_cfg[i].frame_width =
+				((reserv->in_port->right_stop -
+					reserv->in_port->left_start) + 1);
+		else
+			tpg_data->dt_cfg[i].frame_width =
+				reserv->in_port->left_width;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"TPG:%u vc_num:%d dt:%d phy:%d lines:%d pattern:%d format:%d",
+		tpg_hw->hw_intf->hw_idx,
+		tpg_data->vc_num, tpg_data->dt_cfg[0].data_type,
+		tpg_data->phy_sel, tpg_data->num_active_lanes,
+		tpg_data->pix_pattern,
+		tpg_data->dt_cfg[0].encode_format);
+
+	CAM_DBG(CAM_ISP, "TPG:%u height:%d width:%d h blank:%d v blank:%d",
+		tpg_hw->hw_intf->hw_idx,
+		tpg_data->dt_cfg[0].frame_height,
+		tpg_data->dt_cfg[0].frame_width,
+		tpg_data->h_blank_count,
+		tpg_data->v_blank_count);
+
+	reserv->node_res = &tpg_hw->tpg_res;
+	tpg_hw->tpg_res.res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+error:
+	mutex_unlock(&tpg_hw->hw_info->hw_mutex);
+	CAM_DBG(CAM_ISP, "exit rc %u", rc);
+
+	return rc;
+}
+
+static int cam_top_tpg_ver3_start(
+	void                                         *hw_priv,
+	void                                         *start_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_info                           *tpg_hw_info;
+	struct cam_hw_soc_info                       *soc_info;
+	struct cam_isp_resource_node                 *tpg_res;
+	struct cam_top_tpg_ver3_reg_offset           *tpg_reg;
+	struct cam_top_tpg_cfg                       *tpg_data;
+	uint32_t                                      i, val;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+	tpg_res = (struct cam_isp_resource_node *)start_args;
+	tpg_data = (struct cam_top_tpg_cfg  *)tpg_res->res_priv;
+	soc_info = &tpg_hw->hw_info->soc_info;
+
+	if ((tpg_res->res_type != CAM_ISP_RESOURCE_TPG) ||
+		(tpg_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED)) {
+		CAM_ERR(CAM_ISP, "TPG:%d Invalid Res type:%d res_state:%d",
+			tpg_hw->hw_intf->hw_idx,
+			tpg_res->res_type, tpg_res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base + tpg_reg->tpg_top_clear);
+
+	for (i = 0; i < tpg_data->num_active_dts; i++) {
+		val = (((tpg_data->dt_cfg[i].frame_width & 0xFFFF) << 16) |
+			(tpg_data->dt_cfg[i].frame_height & 0xFFFF));
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_0 + 0x60 * i);
+
+		cam_io_w_mb(tpg_data->dt_cfg[i].data_type,
+			soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_1 + 0x60 * i);
+		val = ((tpg_data->dt_cfg[i].encode_format & 0xF) <<
+			tpg_reg->tpg_dt_encode_format_shift) |
+			tpg_reg->tpg_payload_mode_color;
+
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_dt_0_cfg_2 + 0x60 * i);
+
+		val = (1 << tpg_reg->tpg_split_en_shift);
+		val |= tpg_data->pix_pattern;
+		if (tpg_data->qcfa_en)
+			val |= (1 << tpg_reg->tpg_color_bar_qcfa_en_shift);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_color_bar_cfg + 0x60 * i);
+
+		/*
+		 * if hblank is notset configureHBlank count 500 and
+		 * V blank count is 600
+		 */
+
+		if (tpg_data->h_blank_count)
+			cam_io_w_mb(tpg_data->h_blank_count,
+				soc_info->reg_map[0].mem_base +
+				tpg_reg->tpg_vc0_hbi_cfg + 0x60 * i);
+		else
+			cam_io_w_mb(0x1F4,
+				soc_info->reg_map[0].mem_base +
+				tpg_reg->tpg_vc0_hbi_cfg + 0x60 * i);
+
+		if (tpg_data->v_blank_count)
+			cam_io_w_mb(tpg_data->v_blank_count,
+				soc_info->reg_map[0].mem_base +
+				tpg_reg->tpg_vc0_vbi_cfg + 0x60 * i);
+		else
+			cam_io_w_mb(0x258,
+				soc_info->reg_map[0].mem_base +
+				tpg_reg->tpg_vc0_vbi_cfg + 0x60 * i);
+
+		cam_io_w_mb(0x12345678, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_lfsr_seed + 0x60 * i);
+
+		val = (((tpg_data->num_active_dts-1) <<
+			 tpg_reg->tpg_num_dts_shift_val) | tpg_data->vc_num[i]);
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			tpg_reg->tpg_vc0_cfg0 + 0x60 * i);
+	}
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_top_irq_mask);
+
+	val = ((tpg_data->num_active_dts - 1) <<
+		(tpg_reg->tpg_num_active_vcs_shift) |
+		(tpg_data->num_active_lanes - 1) <<
+		tpg_reg->tpg_num_active_lanes_shift) |
+		(tpg_data->vc_dt_pattern_id) <<
+		(tpg_reg->tpg_vc_dt_pattern_id_shift) |
+		(tpg_data->phy_sel << tpg_reg->tpg_cphy_dphy_sel_shift_val) |
+		(1 << tpg_reg->tpg_en_shift_val);
+	cam_io_w_mb(val, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+
+
+	tpg_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_hw_version);
+	CAM_DBG(CAM_ISP, "TPG:%d TPG HW version: 0x%x started",
+		tpg_hw->hw_intf->hw_idx, val);
+
+end:
+	return rc;
+}
+
+static int cam_top_tpg_ver3_stop(
+	void                                         *hw_priv,
+	void                                         *stop_args,
+	uint32_t                                      arg_size)
+{
+	int                                           rc = 0;
+	struct cam_top_tpg_hw                        *tpg_hw;
+	struct cam_hw_info                           *tpg_hw_info;
+	struct cam_hw_soc_info                       *soc_info;
+	struct cam_isp_resource_node                 *tpg_res;
+	const struct cam_top_tpg_ver3_reg_offset     *tpg_reg;
+	struct cam_top_tpg_cfg                       *tpg_data;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "TPG: Invalid args");
+		return -EINVAL;
+	}
+
+	tpg_hw_info = (struct cam_hw_info  *)hw_priv;
+	tpg_hw = (struct cam_top_tpg_hw   *)tpg_hw_info->core_info;
+	tpg_reg = tpg_hw->tpg_info->tpg_reg;
+	tpg_res = (struct cam_isp_resource_node  *) stop_args;
+	tpg_data = (struct cam_top_tpg_cfg  *)tpg_res->res_state;
+	soc_info = &tpg_hw->hw_info->soc_info;
+
+	if ((tpg_res->res_type != CAM_ISP_RESOURCE_TPG) ||
+		(tpg_res->res_state != CAM_ISP_RESOURCE_STATE_STREAMING)) {
+		CAM_DBG(CAM_ISP, "TPG:%d Invalid Res type:%d res_state:%d",
+			tpg_hw->hw_intf->hw_idx,
+			tpg_res->res_type, tpg_res->res_state);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base + tpg_reg->tpg_ctrl);
+
+	cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_top_irq_mask);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_top_irq_clear);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base +
+		tpg_reg->tpg_top_irq_cmd);
+
+	cam_io_w_mb(1, soc_info->reg_map[0].mem_base + tpg_reg->tpg_top_clear);
+
+	tpg_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	CAM_DBG(CAM_ISP, "TPG:%d stopped", tpg_hw->hw_intf->hw_idx);
+end:
+	return rc;
+}
+
+int cam_top_tpg_ver3_init(
+	struct cam_top_tpg_hw                        *tpg_hw)
+{
+	tpg_hw->hw_intf->hw_ops.get_hw_caps = cam_top_tpg_ver3_get_hw_caps;
+	tpg_hw->hw_intf->hw_ops.reserve     = cam_top_tpg_ver3_reserve;
+	tpg_hw->hw_intf->hw_ops.start       = cam_top_tpg_ver3_start;
+	tpg_hw->hw_intf->hw_ops.stop        = cam_top_tpg_ver3_stop;
+	tpg_hw->hw_intf->hw_ops.process_cmd = cam_top_tpg_ver3_process_cmd;
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/top_tpg/cam_top_tpg_ver3.h
@@ -0,0 +1,119 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_TOP_TPG_VER3_H_
+#define _CAM_TOP_TPG_VER3_H_
+
+#include "cam_top_tpg_core.h"
+
+struct cam_top_tpg_ver3_reg_offset {
+	uint32_t tpg_hw_version;
+	uint32_t tpg_hw_status;
+	uint32_t tpg_ctrl;
+	uint32_t tpg_vc0_cfg0;
+	uint32_t tpg_vc0_lfsr_seed;
+	uint32_t tpg_vc0_hbi_cfg;
+	uint32_t tpg_vc0_vbi_cfg;
+	uint32_t tpg_vc0_color_bar_cfg;
+	uint32_t tpg_vc0_dt_0_cfg_0;
+	uint32_t tpg_vc0_dt_0_cfg_1;
+	uint32_t tpg_vc0_dt_0_cfg_2;
+	uint32_t tpg_vc0_dt_1_cfg_0;
+	uint32_t tpg_vc0_dt_1_cfg_1;
+	uint32_t tpg_vc0_dt_1_cfg_2;
+	uint32_t tpg_vc0_dt_2_cfg_0;
+	uint32_t tpg_vc0_dt_2_cfg_1;
+	uint32_t tpg_vc0_dt_2_cfg_2;
+	uint32_t tpg_vc0_dt_3_cfg_0;
+	uint32_t tpg_vc0_dt_3_cfg_1;
+	uint32_t tpg_vc0_dt_3_cfg_2;
+
+	uint32_t tpg_vc1_cfg0;
+	uint32_t tpg_vc1_lfsr_seed;
+	uint32_t tpg_vc1_hbi_cfg;
+	uint32_t tpg_vc1_vbi_cfg;
+	uint32_t tpg_vc1_color_bar_cfg;
+	uint32_t tpg_vc1_dt_0_cfg_0;
+	uint32_t tpg_vc1_dt_0_cfg_1;
+	uint32_t tpg_vc1_dt_0_cfg_2;
+	uint32_t tpg_vc1_dt_1_cfg_0;
+	uint32_t tpg_vc1_dt_1_cfg_1;
+	uint32_t tpg_vc1_dt_1_cfg_2;
+	uint32_t tpg_vc1_dt_2_cfg_0;
+	uint32_t tpg_vc1_dt_2_cfg_1;
+	uint32_t tpg_vc1_dt_2_cfg_2;
+	uint32_t tpg_vc1_dt_3_cfg_0;
+	uint32_t tpg_vc1_dt_3_cfg_1;
+	uint32_t tpg_vc1_dt_3_cfg_2;
+
+	uint32_t tpg_vc2_cfg0;
+	uint32_t tpg_vc2_lfsr_seed;
+	uint32_t tpg_vc2_hbi_cfg;
+	uint32_t tpg_vc2_vbi_cfg;
+	uint32_t tpg_vc2_color_bar_cfg;
+	uint32_t tpg_vc2_dt_0_cfg_0;
+	uint32_t tpg_vc2_dt_0_cfg_1;
+	uint32_t tpg_vc2_dt_0_cfg_2;
+	uint32_t tpg_vc2_dt_1_cfg_0;
+	uint32_t tpg_vc2_dt_1_cfg_1;
+	uint32_t tpg_vc2_dt_1_cfg_2;
+	uint32_t tpg_vc2_dt_2_cfg_0;
+	uint32_t tpg_vc2_dt_2_cfg_1;
+	uint32_t tpg_vc2_dt_2_cfg_2;
+	uint32_t tpg_vc2_dt_3_cfg_0;
+	uint32_t tpg_vc2_dt_3_cfg_1;
+	uint32_t tpg_vc2_dt_3_cfg_2;
+
+	uint32_t tpg_vc3_cfg0;
+	uint32_t tpg_vc3_lfsr_seed;
+	uint32_t tpg_vc3_hbi_cfg;
+	uint32_t tpg_vc3_vbi_cfg;
+	uint32_t tpg_vc3_color_bar_cfg;
+	uint32_t tpg_vc3_dt_0_cfg_0;
+	uint32_t tpg_vc3_dt_0_cfg_1;
+	uint32_t tpg_vc3_dt_0_cfg_2;
+	uint32_t tpg_vc3_dt_1_cfg_0;
+	uint32_t tpg_vc3_dt_1_cfg_1;
+	uint32_t tpg_vc3_dt_1_cfg_2;
+	uint32_t tpg_vc3_dt_2_cfg_0;
+	uint32_t tpg_vc3_dt_2_cfg_1;
+	uint32_t tpg_vc3_dt_2_cfg_2;
+	uint32_t tpg_vc3_dt_3_cfg_0;
+	uint32_t tpg_vc3_dt_3_cfg_1;
+	uint32_t tpg_vc3_dt_3_cfg_2;
+	uint32_t tpg_throttle;
+	uint32_t tpg_top_irq_status;
+	uint32_t tpg_top_irq_mask;
+	uint32_t tpg_top_irq_clear;
+	uint32_t tpg_top_irq_set;
+	uint32_t tpg_top_irq_cmd;
+	uint32_t tpg_top_clear;
+	uint32_t tpg_test_bus_crtl;
+	uint32_t tpg_spare;
+
+	/* configurations */
+	uint32_t major_version;
+	uint32_t minor_version;
+	uint32_t version_incr;
+	uint32_t tpg_en_shift_val;
+	uint32_t tpg_cphy_dphy_sel_shift_val;
+	uint32_t tpg_num_active_lanes_shift;
+	uint32_t tpg_fe_pkt_en_shift;
+	uint32_t tpg_fs_pkt_en_shift;
+	uint32_t tpg_line_interleaving_mode_shift;
+	uint32_t tpg_num_dts_shift_val;
+	uint32_t tpg_v_blank_cnt_shift;
+	uint32_t tpg_dt_encode_format_shift;
+	uint32_t tpg_payload_mode_color;
+	uint32_t tpg_split_en_shift;
+	uint32_t top_mux_reg_offset;
+	uint32_t tpg_vc_dt_pattern_id_shift;
+	uint32_t tpg_num_active_vcs_shift;
+	uint32_t tpg_color_bar_qcfa_en_shift;
+};
+
+int cam_top_tpg_ver3_init(struct cam_top_tpg_hw *tpg_hw);
+
+#endif /* _CAM_TOP_TPG_VER3_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.c
@@ -0,0 +1,776 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/timer.h>
+#include <linux/ratelimit.h>
+#include "cam_tasklet_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_top.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include <dt-bindings/msm-camera.h>
+
+
+static const char drv_name[] = "vfe";
+
+#define CAM_VFE_17X_CLEAR_0_REG_OFFSET              0x00000064
+#define CAM_VFE_17X_CLEAR_1_REG_OFFSET              0x00000068
+#define CAM_VFE_17X_IRQ_CMD_REG_OFFSET              0x00000058
+#define CAM_VFE_17X_TOP_RESET_MASK                  0x80000000
+
+#define CAM_VFE_48X_CLEAR_0_REG_OFFSET              0x00000048
+#define CAM_VFE_48X_CLEAR_1_REG_OFFSET              0x0000004C
+#define CAM_VFE_48X_CLEAR_2_REG_OFFSET              0x00000050
+#define CAM_VFE_48X_IRQ_CMD_REG_OFFSET              0x00000038
+#define CAM_VFE_48X_TOP_RESET_MASK                  0x00000001
+
+#define CAM_VFE_LITE_48X_CLEAR_0_REG_OFFSET         0x00000034
+#define CAM_VFE_LITE_48X_CLEAR_1_REG_OFFSET         0x00000038
+#define CAM_VFE_LITE_48X_CLEAR_2_REG_OFFSET         0x0000003C
+#define CAM_VFE_LITE_48X_IRQ_CMD_REG_OFFSET         0x00000024
+#define CAM_VFE_LITE_48X_TOP_RESET_MASK             0x00020000
+
+int cam_vfe_get_hw_caps(void *hw_priv, void *get_hw_cap_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *vfe_dev = hw_priv;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_dev->core_info;
+
+	if (core_info->vfe_top->hw_ops.get_hw_caps)
+		core_info->vfe_top->hw_ops.get_hw_caps(
+			core_info->vfe_top->top_priv,
+			get_hw_cap_args, arg_size);
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_reset_irq_top_half(uint32_t    evt_id,
+	struct cam_irq_th_payload         *th_payload)
+{
+	int32_t                            rc = -EINVAL;
+	struct cam_hw_info                *vfe_hw;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_vfe_soc_private        *soc_private = NULL;
+	void __iomem                      *mem_base;
+
+	vfe_hw = th_payload->handler_priv;
+	soc_info = &vfe_hw->soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	/*
+	 * Clear All IRQs to avoid spurious IRQs immediately
+	 * after Reset Done.
+	 */
+	CAM_DBG(CAM_ISP, "TOP_IRQ_STATUS_0 = 0x%x",
+		th_payload->evt_status_arr[0]);
+
+	mem_base = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+
+	switch (soc_info->hw_version) {
+	case CAM_CPAS_TITAN_480_V100:
+	case CAM_CPAS_TITAN_580_V100:
+	case CAM_CPAS_TITAN_570_V200:
+		if (!soc_private->is_ife_lite) {
+			if (th_payload->evt_status_arr[0] & 0x1) {
+				cam_io_w(0xFFFFFFFF, mem_base +
+					CAM_VFE_48X_CLEAR_0_REG_OFFSET);
+				cam_io_w(0xFFFFFFFF, mem_base +
+					CAM_VFE_48X_CLEAR_1_REG_OFFSET);
+				cam_io_w(0xFFFFFFFF, mem_base +
+					CAM_VFE_48X_CLEAR_2_REG_OFFSET);
+				cam_io_w(0x00000001, mem_base +
+					CAM_VFE_48X_IRQ_CMD_REG_OFFSET);
+				CAM_DBG(CAM_ISP,
+					"Calling Complete for RESET CMD");
+				complete(&vfe_hw->hw_complete);
+				rc = 0;
+			}
+		} else {
+			if (th_payload->evt_status_arr[0] & (1<<17)) {
+				cam_io_w(0xFFFFFFFF, mem_base +
+					CAM_VFE_LITE_48X_CLEAR_0_REG_OFFSET);
+				cam_io_w(0xFFFFFFFF, mem_base +
+					CAM_VFE_LITE_48X_CLEAR_1_REG_OFFSET);
+				cam_io_w(0xFFFFFFFF, mem_base +
+					CAM_VFE_LITE_48X_CLEAR_2_REG_OFFSET);
+				cam_io_w(0x00000001, mem_base +
+					CAM_VFE_LITE_48X_IRQ_CMD_REG_OFFSET);
+				CAM_DBG(CAM_ISP,
+					"Calling Complete for RESET CMD");
+				complete(&vfe_hw->hw_complete);
+				rc = 0;
+			}
+		}
+		break;
+	default:
+		if (th_payload->evt_status_arr[0] & (1<<31)) {
+			cam_io_w(0xFFFFFFFF, mem_base +
+				CAM_VFE_17X_CLEAR_0_REG_OFFSET);
+			cam_io_w(0xFFFFFFFF, mem_base +
+				CAM_VFE_17X_CLEAR_1_REG_OFFSET);
+			cam_io_w(0x00000001, mem_base +
+				CAM_VFE_17X_IRQ_CMD_REG_OFFSET);
+			CAM_DBG(CAM_ISP, "Calling Complete for RESET CMD");
+			complete(&vfe_hw->hw_complete);
+			rc = 0;
+		}
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+int cam_vfe_init_hw(void *hw_priv, void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *vfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_isp_resource_node      *isp_res = NULL;
+	int rc = 0;
+	uint32_t                           reset_core_args =
+					CAM_VFE_HW_RESET_HW_AND_REG;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	vfe_hw->open_count++;
+	if (vfe_hw->open_count > 1) {
+		mutex_unlock(&vfe_hw->hw_mutex);
+		CAM_DBG(CAM_ISP, "VFE has already been initialized cnt %d",
+			vfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	soc_info = &vfe_hw->soc_info;
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	/* Turn ON Regulators, Clocks and other SOC resources */
+	rc = cam_vfe_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Enable SOC failed");
+		rc = -EFAULT;
+		goto decrement_open_cnt;
+	}
+
+	isp_res   = (struct cam_isp_resource_node *)init_hw_args;
+	if (isp_res && isp_res->init) {
+		rc = isp_res->init(isp_res, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "init Failed rc=%d", rc);
+			goto disable_soc;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Enable soc done");
+
+	/* Do HW Reset */
+	rc = cam_vfe_reset(hw_priv, &reset_core_args, sizeof(uint32_t));
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Reset Failed rc=%d", rc);
+		goto deinint_vfe_res;
+	}
+
+	rc = core_info->vfe_bus->hw_ops.init(core_info->vfe_bus->bus_priv,
+		NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Bus HW init Failed rc=%d", rc);
+		goto deinint_vfe_res;
+	}
+
+	rc = core_info->vfe_top->hw_ops.init(core_info->vfe_top->top_priv,
+		NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Top HW init Failed rc=%d", rc);
+		goto deinint_vfe_res;
+	}
+
+	if (core_info->vfe_rd_bus) {
+		rc = core_info->vfe_rd_bus->hw_ops.init(
+			core_info->vfe_rd_bus->bus_priv,
+			NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Bus RD HW init Failed rc=%d", rc);
+			goto deinint_vfe_res;
+		}
+	}
+
+	vfe_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	return rc;
+
+deinint_vfe_res:
+	if (isp_res && isp_res->deinit)
+		isp_res->deinit(isp_res, NULL, 0);
+disable_soc:
+	cam_vfe_disable_soc_resources(soc_info);
+decrement_open_cnt:
+	mutex_lock(&vfe_hw->hw_mutex);
+	vfe_hw->open_count--;
+	mutex_unlock(&vfe_hw->hw_mutex);
+	return rc;
+}
+
+int cam_vfe_deinit_hw(void *hw_priv, void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *vfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_isp_resource_node      *isp_res = NULL;
+	int rc = 0;
+	uint32_t                           reset_core_args =
+					CAM_VFE_HW_RESET_HW_AND_REG;
+
+	CAM_DBG(CAM_ISP, "Enter");
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	isp_res = (struct cam_isp_resource_node *)deinit_hw_args;
+	if (isp_res && isp_res->deinit) {
+		rc = isp_res->deinit(isp_res, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_ISP, "deinit failed");
+	}
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (!vfe_hw->open_count) {
+		mutex_unlock(&vfe_hw->hw_mutex);
+		CAM_ERR(CAM_ISP, "Error. Unbalanced deinit");
+		return -EFAULT;
+	}
+	vfe_hw->open_count--;
+	if (vfe_hw->open_count) {
+		mutex_unlock(&vfe_hw->hw_mutex);
+		CAM_DBG(CAM_ISP, "open_cnt non-zero =%d", vfe_hw->open_count);
+		return 0;
+	}
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	soc_info = &vfe_hw->soc_info;
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	rc = core_info->vfe_bus->hw_ops.deinit(core_info->vfe_bus->bus_priv,
+		NULL, 0);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Bus HW deinit Failed rc=%d", rc);
+
+	if (core_info->vfe_rd_bus) {
+		rc = core_info->vfe_rd_bus->hw_ops.deinit(
+			core_info->vfe_rd_bus->bus_priv,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Bus HW deinit Failed rc=%d", rc);
+	}
+
+	rc = cam_vfe_reset(hw_priv, &reset_core_args, sizeof(uint32_t));
+
+	/* Turn OFF Regulators, Clocks and other SOC resources */
+	CAM_DBG(CAM_ISP, "Disable SOC resource");
+	rc = cam_vfe_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Disable SOC failed");
+
+	vfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+int cam_vfe_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_hw_info *vfe_hw  = hw_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_vfe_soc_private *soc_private = NULL;
+	struct cam_vfe_hw_core_info *core_info = NULL;
+	uint32_t top_reset_irq_reg_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	int rc;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &vfe_hw->soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	memset(top_reset_irq_reg_mask, 0, sizeof(top_reset_irq_reg_mask));
+
+	switch (soc_info->hw_version) {
+	case CAM_CPAS_TITAN_480_V100:
+	case CAM_CPAS_TITAN_580_V100:
+	case CAM_CPAS_TITAN_570_V200:
+		if (!soc_private->is_ife_lite)
+			top_reset_irq_reg_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+				= CAM_VFE_48X_TOP_RESET_MASK;
+		else
+			top_reset_irq_reg_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+				= CAM_VFE_LITE_48X_TOP_RESET_MASK;
+		break;
+	default:
+		top_reset_irq_reg_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+			= CAM_VFE_17X_TOP_RESET_MASK;
+		break;
+	}
+
+	core_info->reset_irq_handle = cam_irq_controller_subscribe_irq(
+		core_info->vfe_irq_controller, CAM_IRQ_PRIORITY_0,
+		top_reset_irq_reg_mask, vfe_hw,
+		cam_vfe_reset_irq_top_half, NULL, NULL, NULL);
+	if (core_info->reset_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "subscribe irq controller failed");
+		core_info->reset_irq_handle = 0;
+		return -EFAULT;
+	}
+
+	reinit_completion(&vfe_hw->hw_complete);
+
+	CAM_DBG(CAM_ISP, "calling RESET on VFE:%d", soc_info->index);
+
+	core_info->vfe_top->hw_ops.reset(core_info->vfe_top->top_priv,
+		reset_core_args, arg_size);
+
+	/* Wait for Completion or Timeout of 500ms */
+	rc = wait_for_completion_timeout(&vfe_hw->hw_complete, 500);
+
+	if (!rc)
+		CAM_ERR(CAM_ISP, "Reset Timeout");
+	else
+		CAM_DBG(CAM_ISP, "reset complete done (%d)", rc);
+
+	rc = cam_irq_controller_unsubscribe_irq(
+		core_info->vfe_irq_controller, core_info->reset_irq_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Error. Unsubscribe failed");
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+void cam_isp_hw_get_timestamp(struct cam_isp_timestamp *time_stamp)
+{
+	struct timespec64 ts;
+
+	ktime_get_boottime_ts64(&ts);
+	time_stamp->mono_time.tv_sec    = ts.tv_sec;
+	time_stamp->mono_time.tv_nsec   = ts.tv_nsec;
+}
+
+int cam_vfe_reserve(void *hw_priv, void *reserve_args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *vfe_hw  = hw_priv;
+	struct cam_vfe_acquire_args       *acquire;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !reserve_args || (arg_size !=
+		sizeof(struct cam_vfe_acquire_args))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	acquire = (struct cam_vfe_acquire_args   *)reserve_args;
+
+	CAM_DBG(CAM_ISP, "acq res type: %d", acquire->rsrc_type);
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (acquire->rsrc_type == CAM_ISP_RESOURCE_VFE_IN) {
+		rc = core_info->vfe_top->hw_ops.reserve(
+			core_info->vfe_top->top_priv,
+			acquire, sizeof(*acquire));
+	} else if (acquire->rsrc_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		rc = core_info->vfe_bus->hw_ops.reserve(
+			core_info->vfe_bus->bus_priv, acquire,
+			sizeof(*acquire));
+	} else if (acquire->rsrc_type == CAM_ISP_RESOURCE_VFE_BUS_RD) {
+		if (core_info->vfe_rd_bus)
+			rc = core_info->vfe_rd_bus->hw_ops.reserve(
+				core_info->vfe_rd_bus->bus_priv, acquire,
+				sizeof(*acquire));
+	} else
+		CAM_ERR(CAM_ISP, "Invalid res type:%d", acquire->rsrc_type);
+
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_vfe_release(void *hw_priv, void *release_args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *vfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	int rc = -ENODEV;
+
+	if (!hw_priv || !release_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node      *) release_args;
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_IN)
+		rc = core_info->vfe_top->hw_ops.release(
+			core_info->vfe_top->top_priv, isp_res,
+			sizeof(*isp_res));
+	else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_OUT)
+		rc = core_info->vfe_bus->hw_ops.release(
+			core_info->vfe_bus->bus_priv, isp_res,
+			sizeof(*isp_res));
+	else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_BUS_RD) {
+		if (core_info->vfe_rd_bus)
+			rc = core_info->vfe_rd_bus->hw_ops.release(
+				core_info->vfe_rd_bus->bus_priv, isp_res,
+				sizeof(*isp_res));
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res type:%d", isp_res->res_type);
+	}
+
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	return rc;
+}
+
+
+int cam_vfe_start(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *vfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	int                                rc = 0;
+
+	if (!hw_priv || !start_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &vfe_hw->soc_info;
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node  *)start_args;
+	core_info->tasklet_info = isp_res->tasklet_info;
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_IN) {
+		rc = core_info->vfe_top->hw_ops.start(
+			core_info->vfe_top->top_priv, isp_res,
+			sizeof(struct cam_isp_resource_node));
+
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to start VFE IN");
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		rc = core_info->vfe_bus->hw_ops.start(isp_res, NULL, 0);
+
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed to start VFE OUT");
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_BUS_RD) {
+		if (core_info->vfe_rd_bus) {
+			rc = core_info->vfe_rd_bus->hw_ops.start(isp_res,
+				NULL, 0);
+
+			if (rc)
+				CAM_ERR(CAM_ISP, "Failed to start BUS RD");
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res type:%d", isp_res->res_type);
+		rc = -EFAULT;
+	}
+
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_vfe_stop(void *hw_priv, void *stop_args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_hw_info                *vfe_hw  = hw_priv;
+	struct cam_isp_resource_node      *isp_res;
+	int rc = -EINVAL;
+
+	if (!hw_priv || !stop_args ||
+		(arg_size != sizeof(struct cam_isp_resource_node))) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	isp_res = (struct cam_isp_resource_node  *)stop_args;
+
+	mutex_lock(&vfe_hw->hw_mutex);
+	if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_IN) {
+		rc = core_info->vfe_top->hw_ops.stop(
+			core_info->vfe_top->top_priv, isp_res,
+			sizeof(struct cam_isp_resource_node));
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_OUT) {
+		rc = core_info->vfe_bus->hw_ops.stop(isp_res, NULL, 0);
+	} else if (isp_res->res_type == CAM_ISP_RESOURCE_VFE_BUS_RD) {
+		if (core_info->vfe_rd_bus)
+			rc = core_info->vfe_rd_bus->hw_ops.stop(isp_res,
+				NULL, 0);
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res type:%d", isp_res->res_type);
+	}
+
+	if (core_info->reset_irq_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			core_info->vfe_irq_controller,
+			core_info->reset_irq_handle);
+		core_info->reset_irq_handle = 0;
+	}
+
+	mutex_unlock(&vfe_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_vfe_read(void *hw_priv, void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_vfe_write(void *hw_priv, void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+int cam_vfe_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info                *vfe_hw = hw_priv;
+	struct cam_hw_soc_info            *soc_info = NULL;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_vfe_hw_info            *hw_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = &vfe_hw->soc_info;
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	hw_info = core_info->vfe_hw_info;
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+	case CAM_ISP_HW_CMD_BW_UPDATE:
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+	case CAM_ISP_HW_CMD_DUMP_HW:
+	case CAM_ISP_HW_CMD_ADD_WAIT:
+	case CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER:
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+	case CAM_ISP_HW_DUMP_HW_SRC_CLK_RATE:
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = core_info->vfe_top->hw_ops.process_cmd(
+			core_info->vfe_top->top_priv, cmd_type, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+	case CAM_ISP_HW_CMD_UBWC_UPDATE:
+	case CAM_ISP_HW_CMD_UBWC_UPDATE_V2:
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+	case CAM_ISP_HW_CMD_GET_SECURE_MODE:
+	case CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ:
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO:
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+	case CAM_ISP_HW_CMD_QUERY_BUS_CAP:
+		rc = core_info->vfe_bus->hw_ops.process_cmd(
+			core_info->vfe_bus->bus_priv, cmd_type, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE_RM:
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM:
+		if (core_info->vfe_rd_bus)
+			rc = core_info->vfe_rd_bus->hw_ops.process_cmd(
+				core_info->vfe_rd_bus->bus_priv, cmd_type,
+				cmd_args, arg_size);
+		break;
+
+	case CAM_ISP_HW_CMD_FE_UPDATE_IN_RD:
+		rc = core_info->vfe_top->hw_ops.process_cmd(
+			core_info->vfe_top->top_priv, cmd_type, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD:
+		if (core_info->vfe_rd_bus) {
+			rc = core_info->vfe_rd_bus->hw_ops.process_cmd(
+				core_info->vfe_rd_bus->bus_priv, cmd_type,
+				cmd_args, arg_size);
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid cmd type:%d", cmd_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+irqreturn_t cam_vfe_irq(int irq_num, void *data)
+{
+	struct cam_hw_info            *vfe_hw;
+	struct cam_vfe_hw_core_info   *core_info;
+
+	if (!data)
+		return IRQ_NONE;
+
+	vfe_hw = (struct cam_hw_info *)data;
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	return cam_irq_controller_handle_irq(irq_num,
+		core_info->vfe_irq_controller);
+}
+
+int cam_vfe_core_init(struct cam_vfe_hw_core_info  *core_info,
+	struct cam_hw_soc_info                     *soc_info,
+	struct cam_hw_intf                         *hw_intf,
+	struct cam_vfe_hw_info                     *vfe_hw_info)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_soc_private *soc_private = NULL;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	if (!cam_cpas_is_feature_supported(CAM_CPAS_ISP_FUSE,
+		(1 << hw_intf->hw_idx), 0) ||
+		!cam_cpas_is_feature_supported(CAM_CPAS_ISP_LITE_FUSE,
+		(1 << hw_intf->hw_idx), 0)) {
+		CAM_DBG(CAM_ISP, "IFE:%d is not supported",
+			hw_intf->hw_idx);
+		return -ENXIO;
+	}
+
+	rc = cam_irq_controller_init(drv_name,
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX),
+		vfe_hw_info->irq_reg_info, &core_info->vfe_irq_controller,
+		true);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Error, cam_irq_controller_init failed rc = %d", rc);
+		return rc;
+	}
+
+	rc = cam_vfe_top_init(vfe_hw_info->top_version, soc_info, hw_intf,
+		vfe_hw_info->top_hw_info, core_info->vfe_irq_controller,
+		&core_info->vfe_top);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error, cam_vfe_top_init failed rc = %d", rc);
+		goto deinit_controller;
+	}
+
+	rc = cam_vfe_bus_init(vfe_hw_info->bus_version, BUS_TYPE_WR,
+		soc_info, hw_intf, vfe_hw_info->bus_hw_info,
+		core_info->vfe_irq_controller, &core_info->vfe_bus);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error, cam_vfe_bus_init failed rc = %d", rc);
+		goto deinit_top;
+	}
+
+	/* Read Bus is not valid for vfe-lite */
+	if (!soc_private->is_ife_lite) {
+		rc = cam_vfe_bus_init(vfe_hw_info->bus_rd_version, BUS_TYPE_RD,
+			soc_info, hw_intf, vfe_hw_info->bus_rd_hw_info,
+			core_info->vfe_irq_controller, &core_info->vfe_rd_bus);
+		if (rc) {
+			CAM_WARN(CAM_ISP, "Error, RD cam_vfe_bus_init failed");
+			rc = 0;
+		}
+		CAM_DBG(CAM_ISP, "vfe_bus_rd %pK hw_idx %d",
+			core_info->vfe_rd_bus, hw_intf->hw_idx);
+	}
+
+	spin_lock_init(&core_info->spin_lock);
+
+	return rc;
+
+deinit_top:
+	cam_vfe_top_deinit(vfe_hw_info->top_version,
+		&core_info->vfe_top);
+
+deinit_controller:
+	cam_irq_controller_deinit(&core_info->vfe_irq_controller);
+
+	return rc;
+}
+
+int cam_vfe_core_deinit(struct cam_vfe_hw_core_info  *core_info,
+	struct cam_vfe_hw_info                       *vfe_hw_info)
+{
+	int                rc = -EINVAL;
+	unsigned long      flags;
+
+	spin_lock_irqsave(&core_info->spin_lock, flags);
+
+	rc = cam_vfe_bus_deinit(vfe_hw_info->bus_version,
+		&core_info->vfe_bus);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Error cam_vfe_bus_deinit failed rc=%d", rc);
+
+	rc = cam_vfe_top_deinit(vfe_hw_info->top_version,
+		&core_info->vfe_top);
+	if (rc)
+		CAM_ERR(CAM_ISP, "Error cam_vfe_top_deinit failed rc=%d", rc);
+
+	rc = cam_irq_controller_deinit(&core_info->vfe_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Error cam_irq_controller_deinit failed rc=%d", rc);
+
+	spin_unlock_irqrestore(&core_info->spin_lock, flags);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.h
@@ -0,0 +1,98 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CORE_H_
+#define _CAM_VFE_CORE_H_
+
+#include <linux/spinlock.h>
+#include "cam_hw_intf.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_hw_intf.h"
+
+#define CAM_VFE_HW_IRQ_CAP_SOF             0x1
+#define CAM_VFE_HW_IRQ_CAP_EPOCH_0         0x2
+#define CAM_VFE_HW_IRQ_CAP_EPOCH_1         0x4
+#define CAM_VFE_HW_IRQ_CAP_RUP             0x8
+#define CAM_VFE_HW_IRQ_CAP_BUF_DONE        0x10
+#define CAM_VFE_HW_IRQ_CAP_EOF             0x20
+
+struct cam_vfe_hw_info {
+	struct cam_irq_controller_reg_info *irq_reg_info;
+
+	uint32_t                          bus_version;
+	void                             *bus_hw_info;
+
+	uint32_t                          bus_rd_version;
+	void                             *bus_rd_hw_info;
+
+	uint32_t                          top_version;
+	void                             *top_hw_info;
+	uint32_t                          camif_version;
+	void                             *camif_reg;
+
+	uint32_t                          camif_lite_version;
+	void                             *camif_lite_reg;
+
+	uint32_t                          testgen_version;
+	void                             *testgen_reg;
+
+	uint32_t                          num_qos_settings;
+	struct cam_isp_reg_val_pair      *qos_settings;
+
+	uint32_t                          num_ds_settings;
+	struct cam_isp_reg_val_pair      *ds_settings;
+
+	uint32_t                          num_vbif_settings;
+	struct cam_isp_reg_val_pair      *vbif_settings;
+};
+
+#define CAM_VFE_EVT_MAX                    256
+
+struct cam_vfe_hw_core_info {
+	struct cam_vfe_hw_info             *vfe_hw_info;
+	void                               *vfe_irq_controller;
+	struct cam_vfe_top                 *vfe_top;
+	struct cam_vfe_bus                 *vfe_bus;
+	struct cam_vfe_bus                 *vfe_rd_bus;
+	void                               *tasklet_info;
+	spinlock_t                          spin_lock;
+	int                                 reset_irq_handle;
+};
+
+int cam_vfe_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_vfe_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_vfe_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size);
+int cam_vfe_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size);
+int cam_vfe_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_vfe_release(void *device_priv,
+	void *reserve_args, uint32_t arg_size);
+int cam_vfe_start(void *device_priv,
+	void *start_args, uint32_t arg_size);
+int cam_vfe_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_vfe_read(void *device_priv,
+	void *read_args, uint32_t arg_size);
+int cam_vfe_write(void *device_priv,
+	void *write_args, uint32_t arg_size);
+int cam_vfe_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+
+irqreturn_t cam_vfe_irq(int irq_num, void *data);
+
+int cam_vfe_core_init(struct cam_vfe_hw_core_info *core_info,
+	struct cam_hw_soc_info             *soc_info,
+	struct cam_hw_intf                 *hw_intf,
+	struct cam_vfe_hw_info             *vfe_hw_info);
+
+int cam_vfe_core_deinit(struct cam_vfe_hw_core_info *core_info,
+	struct cam_vfe_hw_info             *vfe_hw_info);
+
+#endif /* _CAM_VFE_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.c
@@ -0,0 +1,233 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/component.h>
+
+#include "cam_vfe_dev.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_soc.h"
+#include "cam_debug_util.h"
+
+static  struct cam_isp_hw_intf_data cam_vfe_hw_list[CAM_VFE_HW_NUM_MAX];
+static char vfe_dev_name[8];
+
+static int cam_vfe_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info                *vfe_hw = NULL;
+	struct cam_hw_intf                *vfe_hw_intf = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_vfe_hw_core_info       *core_info = NULL;
+	struct cam_vfe_hw_info            *hw_info = NULL;
+	int                                rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct cam_vfe_soc_private   *vfe_soc_priv;
+	uint32_t  i;
+
+	vfe_hw_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!vfe_hw_intf) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &vfe_hw_intf->hw_idx);
+
+	vfe_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!vfe_hw) {
+		rc = -ENOMEM;
+		goto free_vfe_hw_intf;
+	}
+
+	memset(vfe_dev_name, 0, sizeof(vfe_dev_name));
+	snprintf(vfe_dev_name, sizeof(vfe_dev_name),
+		"vfe%1u", vfe_hw_intf->hw_idx);
+
+	vfe_hw->soc_info.pdev = pdev;
+	vfe_hw->soc_info.dev = &pdev->dev;
+	vfe_hw->soc_info.dev_name = vfe_dev_name;
+	vfe_hw_intf->hw_priv = vfe_hw;
+	vfe_hw_intf->hw_ops.get_hw_caps = cam_vfe_get_hw_caps;
+	vfe_hw_intf->hw_ops.init = cam_vfe_init_hw;
+	vfe_hw_intf->hw_ops.deinit = cam_vfe_deinit_hw;
+	vfe_hw_intf->hw_ops.reset = cam_vfe_reset;
+	vfe_hw_intf->hw_ops.reserve = cam_vfe_reserve;
+	vfe_hw_intf->hw_ops.release = cam_vfe_release;
+	vfe_hw_intf->hw_ops.start = cam_vfe_start;
+	vfe_hw_intf->hw_ops.stop = cam_vfe_stop;
+	vfe_hw_intf->hw_ops.read = cam_vfe_read;
+	vfe_hw_intf->hw_ops.write = cam_vfe_write;
+	vfe_hw_intf->hw_ops.process_cmd = cam_vfe_process_cmd;
+	vfe_hw_intf->hw_type = CAM_ISP_HW_TYPE_VFE;
+
+	CAM_DBG(CAM_ISP, "VFE component bind, type %d index %d",
+		vfe_hw_intf->hw_type, vfe_hw_intf->hw_idx);
+
+	platform_set_drvdata(pdev, vfe_hw_intf);
+
+	vfe_hw->core_info = kzalloc(sizeof(struct cam_vfe_hw_core_info),
+		GFP_KERNEL);
+	if (!vfe_hw->core_info) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for core");
+		rc = -ENOMEM;
+		goto free_vfe_hw;
+	}
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_ISP, "Of_match Failed");
+		rc = -EINVAL;
+		goto free_core_info;
+	}
+	hw_info = (struct cam_vfe_hw_info *)match_dev->data;
+	core_info->vfe_hw_info = hw_info;
+
+	rc = cam_vfe_init_soc_resources(&vfe_hw->soc_info, cam_vfe_irq,
+		vfe_hw);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Failed to init soc rc=%d", rc);
+		goto free_core_info;
+	}
+
+	rc = cam_vfe_core_init(core_info, &vfe_hw->soc_info,
+		vfe_hw_intf, hw_info);
+	if (rc < 0) {
+		if (rc == -ENXIO)
+			rc = 0;
+		CAM_ERR(CAM_ISP, "Failed to init core rc=%d", rc);
+		goto deinit_soc;
+	}
+
+	vfe_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&vfe_hw->hw_mutex);
+	spin_lock_init(&vfe_hw->hw_lock);
+	init_completion(&vfe_hw->hw_complete);
+
+	if (vfe_hw_intf->hw_idx < CAM_VFE_HW_NUM_MAX)
+		cam_vfe_hw_list[vfe_hw_intf->hw_idx].hw_intf = vfe_hw_intf;
+
+	vfe_soc_priv = vfe_hw->soc_info.soc_private;
+	cam_vfe_hw_list[vfe_hw_intf->hw_idx].num_hw_pid = vfe_soc_priv->num_pid;
+	for (i = 0; i < vfe_soc_priv->num_pid; i++)
+		cam_vfe_hw_list[vfe_hw_intf->hw_idx].hw_pid[i] =
+			vfe_soc_priv->pid[i];
+
+	cam_vfe_init_hw(vfe_hw, NULL, 0);
+	cam_vfe_deinit_hw(vfe_hw, NULL, 0);
+
+	CAM_DBG(CAM_ISP, "VFE:%d component bound successfully",
+		vfe_hw_intf->hw_idx);
+	return rc;
+
+deinit_soc:
+	if (cam_vfe_deinit_soc_resources(&vfe_hw->soc_info))
+		CAM_ERR(CAM_ISP, "Failed to deinit soc");
+free_core_info:
+	kfree(vfe_hw->core_info);
+free_vfe_hw:
+	kfree(vfe_hw);
+free_vfe_hw_intf:
+	kfree(vfe_hw_intf);
+end:
+	return rc;
+}
+
+static void cam_vfe_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info		  *vfe_hw = NULL;
+	struct cam_hw_intf		  *vfe_hw_intf = NULL;
+	struct cam_vfe_hw_core_info	  *core_info = NULL;
+	int				   rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	vfe_hw_intf = platform_get_drvdata(pdev);
+	if (!vfe_hw_intf) {
+		CAM_ERR(CAM_ISP, "Error! No data in pdev");
+		return;
+	}
+
+	CAM_DBG(CAM_ISP, "VFE component unbind, type %d index %d",
+		vfe_hw_intf->hw_type, vfe_hw_intf->hw_idx);
+
+	if (vfe_hw_intf->hw_idx < CAM_VFE_HW_NUM_MAX)
+		cam_vfe_hw_list[vfe_hw_intf->hw_idx].hw_intf = NULL;
+
+	vfe_hw = vfe_hw_intf->hw_priv;
+	if (!vfe_hw) {
+		CAM_ERR(CAM_ISP, "Error! HW data is NULL");
+		goto free_vfe_hw_intf;
+	}
+
+	core_info = (struct cam_vfe_hw_core_info *)vfe_hw->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_ISP, "Error! core data NULL");
+		goto deinit_soc;
+	}
+
+	rc = cam_vfe_core_deinit(core_info, core_info->vfe_hw_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "Failed to deinit core rc=%d", rc);
+
+	kfree(vfe_hw->core_info);
+
+deinit_soc:
+	rc = cam_vfe_deinit_soc_resources(&vfe_hw->soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&vfe_hw->hw_mutex);
+	kfree(vfe_hw);
+
+	CAM_DBG(CAM_ISP, "VFE%d component unbound", vfe_hw_intf->hw_idx);
+
+free_vfe_hw_intf:
+	kfree(vfe_hw_intf);
+}
+
+const static struct component_ops cam_vfe_component_ops = {
+	.bind = cam_vfe_component_bind,
+	.unbind = cam_vfe_component_unbind,
+};
+
+int cam_vfe_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ISP, "Adding VFE component");
+	rc = component_add(&pdev->dev, &cam_vfe_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ISP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+int cam_vfe_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_vfe_component_ops);
+	return 0;
+}
+
+int cam_vfe_hw_init(struct cam_isp_hw_intf_data **vfe_hw_intf,
+	uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_vfe_hw_list[hw_idx].hw_intf) {
+		*vfe_hw_intf = &cam_vfe_hw_list[hw_idx];
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_ISP, "inval param");
+		*vfe_hw_intf = NULL;
+		rc = -ENODEV;
+	}
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_DEV_H_
+#define _CAM_VFE_DEV_H_
+
+#include <linux/platform_device.h>
+
+/*
+ * cam_vfe_probe()
+ *
+ * @brief:                   Driver probe function called on Boot
+ *
+ * @pdev:                    Platform Device pointer
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_probe(struct platform_device *pdev);
+
+/*
+ * cam_vfe_remove()
+ *
+ * @brief:                   Driver remove function
+ *
+ * @pdev:                    Platform Device pointer
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_remove(struct platform_device *pdev);
+
+#endif /* _CAM_VFE_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.c
@@ -0,0 +1,378 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_cpas_api.h"
+#include "cam_vfe_soc.h"
+#include "cam_debug_util.h"
+
+static bool cam_vfe_cpas_cb(uint32_t client_handle, void *userdata,
+	struct cam_cpas_irq_data *irq_data)
+{
+	bool error_handled = false;
+
+	if (!irq_data)
+		return error_handled;
+
+	switch (irq_data->irq_type) {
+	case CAM_CAMNOC_IRQ_IFE02_UBWC_ENCODE_ERROR:
+	case CAM_CAMNOC_IRQ_IFE13_UBWC_ENCODE_ERROR:
+	case CAM_CAMNOC_IRQ_IFE0_UBWC_ENCODE_ERROR:
+	case CAM_CAMNOC_IRQ_IFE1_WRITE_UBWC_ENCODE_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"IFE UBWC Encode error type=%d status=%x",
+			irq_data->irq_type,
+			irq_data->u.enc_err.encerr_status.value);
+		error_handled = true;
+		break;
+	default:
+		break;
+	}
+
+	return error_handled;
+}
+
+static int cam_vfe_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0, num_ubwc_cfg = 0, i = 0, num_pid = 0;
+	struct device_node *of_node = NULL;
+	struct platform_device *pdev = NULL;
+	struct cam_vfe_soc_private *vfe_soc_private;
+
+	pdev = soc_info->pdev;
+	of_node = pdev->dev.of_node;
+	vfe_soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! get DT properties failed rc=%d", rc);
+		return rc;
+	}
+
+	vfe_soc_private->is_ife_lite = false;
+	if (strnstr(soc_info->compatible, "lite",
+		strlen(soc_info->compatible)) != NULL) {
+		vfe_soc_private->is_ife_lite = true;
+		goto pid;
+	}
+
+	if (!of_property_read_bool(of_node, "ubwc-static-cfg")) {
+		CAM_DBG(CAM_ISP, "ubwc-static-cfg not supported");
+		goto pid;
+	}
+
+	num_ubwc_cfg = of_property_count_u32_elems(of_node,
+		"ubwc-static-cfg");
+
+	if (num_ubwc_cfg < 0 || num_ubwc_cfg > UBWC_STATIC_CONFIG_MAX) {
+		CAM_ERR(CAM_ISP, "wrong num_ubwc_cfg: %d",
+			num_ubwc_cfg);
+		rc = num_ubwc_cfg;
+		goto pid;
+	}
+
+	for (i = 0; i < num_ubwc_cfg; i++) {
+		rc = of_property_read_u32_index(of_node,
+			"ubwc-static-cfg", i,
+			&vfe_soc_private->ubwc_static_ctrl[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"unable to read ubwc static config");
+		}
+	}
+pid:
+	/* set some default values */
+	vfe_soc_private->num_pid = 0;
+
+	num_pid = of_property_count_u32_elems(pdev->dev.of_node, "cam_hw_pid");
+	CAM_DBG(CAM_CPAS, "vfe:%d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_ISP_HW_MAX_PID_VAL)
+		goto end;
+
+	for (i = 0; i < num_pid; i++)
+		of_property_read_u32_index(pdev->dev.of_node, "cam_hw_pid", i,
+		&vfe_soc_private->pid[i]);
+
+	vfe_soc_private->num_pid = num_pid;
+
+end:
+
+	return rc;
+}
+
+static int cam_vfe_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t vfe_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, vfe_irq_handler,
+		irq_data);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Error! Request platform resource failed rc=%d", rc);
+
+	return rc;
+}
+
+static int cam_vfe_release_platform_resource(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Error! Release platform resource failed rc=%d", rc);
+
+	return rc;
+}
+
+int cam_vfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t vfe_irq_handler, void *irq_data)
+{
+	int                               rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+	struct cam_cpas_register_params   cpas_register_param;
+
+	soc_private = kzalloc(sizeof(struct cam_vfe_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_ISP, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_cpas_get_cpas_hw_version(&soc_private->cpas_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! Invalid cpas version rc=%d", rc);
+		goto free_soc_private;
+	}
+	soc_info->hw_version = soc_private->cpas_version;
+
+	rc = cam_vfe_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "Error! Get DT properties failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	rc = cam_soc_util_get_option_clk_by_name(soc_info,
+		CAM_VFE_DSP_CLK_NAME, &soc_private->dsp_clk,
+		&soc_private->dsp_clk_index, &soc_private->dsp_clk_rate);
+	if (rc)
+		CAM_DBG(CAM_ISP, "Option clk get failed with rc %d", rc);
+
+	rc = cam_vfe_request_platform_resource(soc_info, vfe_irq_handler,
+		irq_data);
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP,
+			"Error! Request platform resources failed rc=%d", rc);
+		goto free_soc_private;
+	}
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "ife",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = soc_info->dev;
+	cpas_register_param.cam_cpas_client_cb = cam_vfe_cpas_cb;
+	cpas_register_param.userdata = soc_info;
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
+		goto release_soc;
+	} else {
+		soc_private->cpas_handle = cpas_register_param.client_handle;
+	}
+	return rc;
+
+release_soc:
+	cam_soc_util_release_platform_resource(soc_info);
+free_soc_private:
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_vfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! soc_info NULL");
+		return -ENODEV;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_ISP, "CPAS unregistration failed rc=%d", rc);
+
+	rc = cam_vfe_release_platform_resource(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_ISP,
+			"Error! Release platform resources failed rc=%d", rc);
+
+	if (soc_private->dsp_clk_index != -1) {
+		rc = cam_soc_util_clk_put(&soc_private->dsp_clk);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Error Put dsp clk failed rc=%d", rc);
+	}
+	kfree(soc_private);
+
+	return rc;
+}
+
+int cam_vfe_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int                               rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+	struct cam_ahb_vote               ahb_vote;
+	struct cam_axi_vote               axi_vote = {0};
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_private = soc_info->soc_private;
+
+	ahb_vote.type       = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 1;
+	if (strnstr(soc_info->compatible, "lite",
+		strlen(soc_info->compatible))) {
+		axi_vote.axi_path[0].path_data_type =
+			CAM_AXI_PATH_DATA_IFE_RDI1;
+	} else {
+		axi_vote.axi_path[0].path_data_type =
+			CAM_AXI_PATH_DATA_IFE_VID;
+	}
+
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[0].camnoc_bw = 10640000000L;
+	axi_vote.axi_path[0].mnoc_ab_bw = 10640000000L;
+	axi_vote.axi_path[0].mnoc_ib_bw = 10640000000L;
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! CPAS start failed rc=%d", rc);
+		rc = -EFAULT;
+		goto end;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_TURBO_VOTE, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! enable platform failed rc=%d", rc);
+		goto stop_cpas;
+	}
+
+	return rc;
+
+stop_cpas:
+	cam_cpas_stop(soc_private->cpas_handle);
+end:
+	return rc;
+}
+
+int cam_vfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	int  rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_private = soc_info->soc_private;
+
+	if (!strcmp(clk_name, CAM_VFE_DSP_CLK_NAME)) {
+		if (soc_private->dsp_clk_index == -1) {
+			CAM_ERR(CAM_ISP,
+			"DSP clock not supported for vfe: %d", soc_info->index);
+			rc = -EPERM;
+			goto end;
+		}
+
+		rc = cam_soc_util_clk_enable(soc_private->dsp_clk,
+			CAM_VFE_DSP_CLK_NAME, soc_private->dsp_clk_rate, NULL);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+			"Error enable dsp clk failed rc=%d", rc);
+	}
+
+end:
+	return rc;
+}
+
+int cam_vfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name)
+{
+	int  rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error Invalid params");
+		rc = -EINVAL;
+		goto end;
+	}
+	soc_private = soc_info->soc_private;
+
+	if (!strcmp(clk_name, CAM_VFE_DSP_CLK_NAME)) {
+		if (soc_private->dsp_clk_index == -1) {
+			CAM_ERR(CAM_ISP,
+			"DSP clock not supported for vfe: %d", soc_info->index);
+			rc = -EPERM;
+			goto end;
+		}
+
+		rc = cam_soc_util_clk_disable(soc_private->dsp_clk,
+			CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+			"Error disable dsp clk failed rc=%d", rc);
+	}
+
+end:
+	return rc;
+}
+
+
+int cam_vfe_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct cam_vfe_soc_private       *soc_private;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid params");
+		rc = -EINVAL;
+		return rc;
+	}
+	soc_private = soc_info->soc_private;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Disable platform failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Error! CPAS stop failed rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.h
@@ -0,0 +1,123 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_SOC_H_
+#define _CAM_VFE_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_isp_hw.h"
+
+#define CAM_VFE_DSP_CLK_NAME "ife_dsp_clk"
+
+#define UBWC_STATIC_CONFIG_MAX 2
+
+/*
+ * struct cam_vfe_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to VFE HW Driver
+ *
+ * @cpas_handle:             Handle returned on registering with CPAS driver.
+ *                           This handle is used for all further interface
+ *                           with CPAS.
+ * @cpas_version:            Has cpas version read from Hardware
+ * @ubwc_static_ctrl:        UBWC static control configuration
+ * @is_ife_lite:             Flag to indicate full vs lite IFE
+ * @ife_clk_src:             IFE source clock
+ * @num_pid:                 Number of pids of ife
+ * @pid:                     IFE pid values list
+ */
+struct cam_vfe_soc_private {
+	uint32_t    cpas_handle;
+	uint32_t    cpas_version;
+	struct clk *dsp_clk;
+	int32_t     dsp_clk_index;
+	int32_t     dsp_clk_rate;
+	uint32_t    ubwc_static_ctrl[UBWC_STATIC_CONFIG_MAX];
+	bool        is_ife_lite;
+	uint64_t    ife_clk_src;
+	uint32_t    num_pid;
+	uint32_t    pid[CAM_ISP_HW_MAX_PID_VAL];
+};
+
+/*
+ * cam_vfe_init_soc_resources()
+ *
+ * @Brief:                   Initialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ * @handler:                 Irq handler function pointer
+ * @irq_data:                Irq handler function Callback data
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t vfe_irq_handler, void *irq_data);
+
+/*
+ * cam_vfe_deinit_soc_resources()
+ *
+ * @Brief:                   Deinitialize SOC resources including private data
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_deinit_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_vfe_enable_soc_resources()
+ *
+ * @brief:                   Enable regulator, irq resources, start CPAS
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_vfe_disable_soc_resources()
+ *
+ * @brief:                   Disable regulator, irq resources, stop CPAS
+ *
+ * @soc_info:                Device soc information
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+/*
+ * cam_vfe_soc_enable_clk()
+ *
+ * @brief:                   Enable clock with given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_soc_enable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+/*
+ * cam_vfe_soc_disable_dsp_clk()
+ *
+ * @brief:                   Disable clock with given name
+ *
+ * @soc_info:                Device soc information
+ * @clk_name:                Name of clock to enable
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_soc_disable_clk(struct cam_hw_soc_info *soc_info,
+	const char *clk_name);
+
+#endif /* _CAM_VFE_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.c
@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+
+#include "cam_vfe.h"
+#include "cam_vfe170.h"
+#include "cam_vfe170_150.h"
+#include "cam_vfe175.h"
+#include "cam_vfe175_130.h"
+#include "cam_vfe480.h"
+#include "cam_vfe580.h"
+#include "cam_vfe165_160.h"
+#include "cam_vfe_lite17x.h"
+#include "cam_vfe_lite48x.h"
+#include "cam_vfe_lite16x.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_dev.h"
+
+static const struct of_device_id cam_vfe_dt_match[] = {
+	{
+		.compatible = "qcom,vfe170",
+		.data = &cam_vfe170_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe170_150",
+		.data = &cam_vfe170_150_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe175",
+		.data = &cam_vfe175_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe175_130",
+		.data = &cam_vfe175_130_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe480",
+		.data = &cam_vfe480_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe580",
+		.data = &cam_vfe580_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe165_160",
+		.data = &cam_vfe165_160_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite170",
+		.data = &cam_vfe_lite17x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite175",
+		.data = &cam_vfe_lite17x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite480",
+		.data = &cam_vfe_lite48x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite580",
+		.data = &cam_vfe_lite48x_hw_info,
+	},
+	{
+		.compatible = "qcom,vfe-lite165",
+		.data = &cam_vfe_lite16x_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_vfe_dt_match);
+
+struct platform_driver cam_vfe_driver = {
+	.probe = cam_vfe_probe,
+	.remove = cam_vfe_remove,
+	.driver = {
+		.name = "cam_vfe",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_vfe_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_vfe_init_module(void)
+{
+	return platform_driver_register(&cam_vfe_driver);
+}
+
+
+void cam_vfe_exit_module(void)
+{
+	platform_driver_unregister(&cam_vfe_driver);
+}
+
+MODULE_DESCRIPTION("CAM VFE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_H_
+#define _CAM_VFE_H_
+
+/**
+ * @brief : API to register VFE hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_vfe_init_module(void);
+
+/**
+ * @brief : API to remove VFE  Hw from platform framework.
+ */
+void cam_vfe_exit_module(void);
+
+#endif /* _CAM_VFE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe165_160.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe165_160.h
@@ -0,0 +1,1197 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE165_160_H_
+#define _CAM_VFE165_160_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_camif_lite_ver2.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_vfe_bus_rd_ver1.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe165_160_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_vfe_rdi_overflow_status vfe165_160_rdi_irq_status = {
+	.rdi0_overflow_mask = 0x8,
+	.rdi1_overflow_mask = 0x10,
+	.rdi2_overflow_mask = 0x18,
+	.rdi3_overflow_mask = 0x20,
+	.rdi_overflow_mask  = 0x3c,
+};
+
+static struct cam_irq_controller_reg_info vfe165_160_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe165_160_top_irq_reg_set,
+	.global_clear_offset  = 0x00000058,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_camif_ver2_reg vfe165_160_camif_reg = {
+	.dual_vfe_sync            = 0x00000080,
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+};
+
+static struct cam_vfe_camif_reg_data vfe_165_160_camif_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0xEFFF7E80,
+	.subscribe_irq_mask0             = 0x00000017,
+	.subscribe_irq_mask1             = 0x00000000,
+	.enable_diagnostic_hw            = 0x1,
+	.dual_vfe_sync_mask              = 0x3,
+};
+
+static struct cam_vfe_fe_ver1_reg vfe165_160_fe_reg = {
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+	.fe_cfg                   = 0x00000084,
+};
+
+static struct cam_vfe_fe_reg_data vfe_165_160_fe_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0xEFFF7E80,
+	.enable_diagnostic_hw            = 0x1,
+	.fe_mux_data                     = 0x2,
+	.hbi_cnt_shift                   = 0x8,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg vfe165_160_camif_lite_reg = {
+	.camif_lite_cmd                = 0x00000FC0,
+	.camif_lite_config             = 0x00000FC4,
+	.lite_skip_period              = 0x00000FC8,
+	.lite_irq_subsample_pattern    = 0x00000FCC,
+	.lite_epoch_irq                = 0x00000FD0,
+	.reg_update_cmd                = 0x000004AC,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg_data
+	vfe165_160_camif_lite_reg_data = {
+	.dual_pd_reg_update_cmd_data     = 0x20,
+	.lite_epoch_line_cfg             = 0x00140014,
+	.lite_sof_irq_mask               = 0x00040000,
+	.lite_epoch0_irq_mask            = 0x00100000,
+	.dual_pd_reg_upd_irq_mask        = 0x04000000,
+	.lite_eof_irq_mask               = 0x00080000,
+	.lite_err_irq_mask0              = 0x00400000,
+	.lite_err_irq_mask1              = 0x00004100,
+	.extern_reg_update_shift         = 4,
+	.dual_pd_path_sel_shift          = 24,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_165_160_reg = {
+	.reset    = 0x0000001C,
+	.cgc_ovd  = 0x0000002C,
+	.enable   = 0x00000040,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl stats_165_160_reg = {
+	.reset    = 0x00000020,
+	.cgc_ovd  = 0x00000030,
+	.enable   = 0x00000044,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl color_165_160_reg = {
+	.reset    = 0x00000024,
+	.cgc_ovd  = 0x00000034,
+	.enable   = 0x00000048,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl zoom_165_160_reg = {
+	.reset    = 0x00000028,
+	.cgc_ovd  = 0x00000038,
+	.enable   = 0x0000004C,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe165_160_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		&lens_165_160_reg,
+		&stats_165_160_reg,
+		&color_165_160_reg,
+		&zoom_165_160_reg,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000050,
+	.three_D_cfg              = 0x00000054,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe165_160_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_common_reg_data vfe165_160_rdi_reg_data = {
+	.subscribe_irq_mask0      = 0x780001E0,
+	.subscribe_irq_mask1      = 0x0,
+	.error_irq_mask0          = 0x0,
+	.error_irq_mask1          = 0x3C,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_165_160_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_165_160_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_165_160_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+struct cam_vfe_top_dump_data vfe165_160_dump_data = {
+	.num_reg_dump_entries  =  2,
+	.num_lut_dump_entries  =  1,
+	.dmi_cfg               =  0xc24,
+	.dmi_addr              =  0xc28,
+	.dmi_data_path_hi      =  0xc2C,
+	.dmi_data_path_lo      =  0xc30,
+	.reg_entry = {
+		{
+			.reg_dump_start = 0x0,
+			.reg_dump_end   = 0x1164,
+		},
+		{
+			.reg_dump_start = 0x2000,
+			.reg_dump_end   = 0x397C,
+		},
+	},
+	.lut_entry = {
+		{
+			.lut_word_size = 64,
+			.lut_bank_sel  = 0x40,
+			.lut_addr_size = 180,
+		},
+	},
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe165_160_top_hw_info = {
+	.common_reg = &vfe165_160_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe165_160_top_common_reg,
+		.camif_reg      = &vfe165_160_camif_reg,
+		.reg_data       = &vfe_165_160_camif_reg_data,
+		},
+	.camif_lite_hw_info = {
+		.common_reg     = &vfe165_160_top_common_reg,
+		.camif_lite_reg = &vfe165_160_camif_lite_reg,
+		.reg_data       = &vfe165_160_camif_lite_reg_data,
+		},
+	.rdi_hw_info = {
+		.common_reg      = &vfe165_160_top_common_reg,
+		.rdi_reg         = &vfe165_160_rdi_reg,
+		.common_reg_data = &vfe165_160_rdi_reg_data,
+		.rdi_irq_status  = &vfe165_160_rdi_irq_status,
+		.reg_data = {
+			&vfe_165_160_rdi_0_data,
+			&vfe_165_160_rdi_1_data,
+			&vfe_165_160_rdi_2_data,
+			NULL,
+			},
+		},
+	.fe_hw_info = {
+		.common_reg     = &vfe165_160_top_common_reg,
+		.fe_reg     = &vfe165_160_fe_reg,
+		.reg_data       = &vfe_165_160_fe_reg_data,
+		},
+	.num_mux = 6,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_2_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_CAMIF_LITE_VER_2_0,
+		CAM_VFE_IN_RD_VER_1_0,
+	},
+	.dump_data = &vfe165_160_dump_data,
+};
+
+static struct cam_irq_register_set vfe165_160_bus_rd_irq_reg[1] = {
+		{
+			.mask_reg_offset   = 0x00005010,
+			.clear_reg_offset  = 0x00005014,
+			.status_reg_offset = 0x0000501C,
+		},
+};
+
+static struct cam_irq_register_set vfe165_160_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe165_160_ubwc_regs_client_3 = {
+	.tile_cfg         = 0x0000252C,
+	.h_init           = 0x00002530,
+	.v_init           = 0x00002534,
+	.meta_addr        = 0x00002538,
+	.meta_offset      = 0x0000253C,
+	.meta_stride      = 0x00002540,
+	.mode_cfg_0       = 0x00002544,
+	.mode_cfg_1       = 0x000025A4,
+	.bw_limit         = 0x000025A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe165_160_ubwc_regs_client_4 = {
+	.tile_cfg         = 0x0000262C,
+	.h_init           = 0x00002630,
+	.v_init           = 0x00002634,
+	.meta_addr        = 0x00002638,
+	.meta_offset      = 0x0000263C,
+	.meta_stride      = 0x00002640,
+	.mode_cfg_0       = 0x00002644,
+	.mode_cfg_1       = 0x000026A4,
+	.bw_limit         = 0x000026A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe165_160_ubwc_regs_client_20 = {
+	.tile_cfg         = 0x0000362C,
+	.h_init           = 0x00003630,
+	.v_init           = 0x00003634,
+	.meta_addr        = 0x00003638,
+	.meta_offset      = 0x0000363C,
+	.meta_stride      = 0x00003640,
+	.mode_cfg_0       = 0x00003644,
+	.mode_cfg_1       = 0x000036A4,
+	.bw_limit         = 0x000036A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe165_160_ubwc_regs_client_21 = {
+	.tile_cfg         = 0x0000372C,
+	.h_init           = 0x00003730,
+	.v_init           = 0x00003734,
+	.meta_addr        = 0x00003738,
+	.meta_offset      = 0x0000373C,
+	.meta_stride      = 0x00003740,
+	.mode_cfg_0       = 0x00003744,
+	.mode_cfg_1       = 0x000037A4,
+	.bw_limit         = 0x000037A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_rd_ver1_hw_info vfe165_160_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00005000,
+		.hw_capability                = 0x00005004,
+		.sw_reset                     = 0x00005008,
+		.cgc_ovd                      = 0x0000500C,
+		.pwr_iso_cfg                  = 0x000050CC,
+		.input_if_cmd                 = 0x00005020,
+		.test_bus_ctrl                = 0x00005048,
+		.irq_reg_info = {
+			.num_registers        = 1,
+			.irq_reg_set          = vfe165_160_bus_rd_irq_reg,
+			.global_clear_offset  = 0x00005018,
+			.global_clear_bitmask = 0x00000001,
+		},
+	},
+	.num_client = 1,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x00005050,
+			.image_addr               = 0x00005058,
+			.buf_size                 = 0x0000505C,
+			.stride                   = 0x00005060,
+			.unpacker_cfg             = 0x00005064,
+			.latency_buf_allocation   = 0x00005078,
+			.burst_limit              = 0x00005080,
+		},
+	},
+	.num_bus_rd_resc = 1,
+	.vfe_bus_rd_hw_info = {
+		{
+			.vfe_bus_rd_type = CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 23,
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe165_160_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers        = 3,
+			.irq_reg_set          = vfe165_160_bus_irq_reg,
+			.global_clear_offset  = 0x00002068,
+			.global_clear_bitmask = 0x00000001,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 24,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                =
+				&vfe165_160_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 */
+		{
+			.status0                  = 0x00002600,
+			.status1                  = 0x00002604,
+			.cfg                      = 0x00002608,
+			.header_addr              = 0x0000260C,
+			.header_cfg               = 0x00002610,
+			.image_addr               = 0x00002614,
+			.image_addr_offset        = 0x00002618,
+			.buffer_width_cfg         = 0x0000261C,
+			.buffer_height_cfg        = 0x00002620,
+			.packer_cfg               = 0x00002624,
+			.stride                   = 0x00002628,
+			.irq_subsample_period     = 0x00002648,
+			.irq_subsample_pattern    = 0x0000264C,
+			.framedrop_period         = 0x00002650,
+			.framedrop_pattern        = 0x00002654,
+			.frame_inc                = 0x00002658,
+			.burst_limit              = 0x0000265C,
+			.ubwc_regs                =
+				&vfe165_160_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 */
+		{
+			.status0                  = 0x00002700,
+			.status1                  = 0x00002704,
+			.cfg                      = 0x00002708,
+			.header_addr              = 0x0000270C,
+			.header_cfg               = 0x00002710,
+			.image_addr               = 0x00002714,
+			.image_addr_offset        = 0x00002718,
+			.buffer_width_cfg         = 0x0000271C,
+			.buffer_height_cfg        = 0x00002720,
+			.packer_cfg               = 0x00002724,
+			.stride                   = 0x00002728,
+			.irq_subsample_period     = 0x00002748,
+			.irq_subsample_pattern    = 0x0000274C,
+			.framedrop_period         = 0x00002750,
+			.framedrop_pattern        = 0x00002754,
+			.frame_inc                = 0x00002758,
+			.burst_limit              = 0x0000275C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 */
+		{
+			.status0                  = 0x00002800,
+			.status1                  = 0x00002804,
+			.cfg                      = 0x00002808,
+			.header_addr              = 0x0000280C,
+			.header_cfg               = 0x00002810,
+			.image_addr               = 0x00002814,
+			.image_addr_offset        = 0x00002818,
+			.buffer_width_cfg         = 0x0000281C,
+			.buffer_height_cfg        = 0x00002820,
+			.packer_cfg               = 0x00002824,
+			.stride                   = 0x00002828,
+			.irq_subsample_period     = 0x00002848,
+			.irq_subsample_pattern    = 0x0000284C,
+			.framedrop_period         = 0x00002850,
+			.framedrop_pattern        = 0x00002854,
+			.frame_inc                = 0x00002858,
+			.burst_limit              = 0x0000285C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 */
+		{
+			.status0                  = 0x00002900,
+			.status1                  = 0x00002904,
+			.cfg                      = 0x00002908,
+			.header_addr              = 0x0000290C,
+			.header_cfg               = 0x00002910,
+			.image_addr               = 0x00002914,
+			.image_addr_offset        = 0x00002918,
+			.buffer_width_cfg         = 0x0000291C,
+			.buffer_height_cfg        = 0x00002920,
+			.packer_cfg               = 0x00002924,
+			.stride                   = 0x00002928,
+			.irq_subsample_period     = 0x00002948,
+			.irq_subsample_pattern    = 0x0000294C,
+			.framedrop_period         = 0x00002950,
+			.framedrop_pattern        = 0x00002954,
+			.frame_inc                = 0x00002958,
+			.burst_limit              = 0x0000295C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 */
+		{
+			.status0                  = 0x00002A00,
+			.status1                  = 0x00002A04,
+			.cfg                      = 0x00002A08,
+			.header_addr              = 0x00002A0C,
+			.header_cfg               = 0x00002A10,
+			.image_addr               = 0x00002A14,
+			.image_addr_offset        = 0x00002A18,
+			.buffer_width_cfg         = 0x00002A1C,
+			.buffer_height_cfg        = 0x00002A20,
+			.packer_cfg               = 0x00002A24,
+			.stride                   = 0x00002A28,
+			.irq_subsample_period     = 0x00002A48,
+			.irq_subsample_pattern    = 0x00002A4C,
+			.framedrop_period         = 0x00002A50,
+			.framedrop_pattern        = 0x00002A54,
+			.frame_inc                = 0x00002A58,
+			.burst_limit              = 0x00002A5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 */
+		{
+			.status0                  = 0x00002B00,
+			.status1                  = 0x00002B04,
+			.cfg                      = 0x00002B08,
+			.header_addr              = 0x00002B0C,
+			.header_cfg               = 0x00002B10,
+			.image_addr               = 0x00002B14,
+			.image_addr_offset        = 0x00002B18,
+			.buffer_width_cfg         = 0x00002B1C,
+			.buffer_height_cfg        = 0x00002B20,
+			.packer_cfg               = 0x00002B24,
+			.stride                   = 0x00002B28,
+			.irq_subsample_period     = 0x00002B48,
+			.irq_subsample_pattern    = 0x00002B4C,
+			.framedrop_period         = 0x00002B50,
+			.framedrop_pattern        = 0x00002B54,
+			.frame_inc                = 0x00002B58,
+			.burst_limit              = 0x00002B5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 */
+		{
+			.status0                  = 0x00002C00,
+			.status1                  = 0x00002C04,
+			.cfg                      = 0x00002C08,
+			.header_addr              = 0x00002C0C,
+			.header_cfg               = 0x00002C10,
+			.image_addr               = 0x00002C14,
+			.image_addr_offset        = 0x00002C18,
+			.buffer_width_cfg         = 0x00002C1C,
+			.buffer_height_cfg        = 0x00002C20,
+			.packer_cfg               = 0x00002C24,
+			.stride                   = 0x00002C28,
+			.irq_subsample_period     = 0x00002C48,
+			.irq_subsample_pattern    = 0x00002C4C,
+			.framedrop_period         = 0x00002C50,
+			.framedrop_pattern        = 0x00002C54,
+			.frame_inc                = 0x00002C58,
+			.burst_limit              = 0x00002C5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 */
+		{
+			.status0                  = 0x00002D00,
+			.status1                  = 0x00002D04,
+			.cfg                      = 0x00002D08,
+			.header_addr              = 0x00002D0C,
+			.header_cfg               = 0x00002D10,
+			.image_addr               = 0x00002D14,
+			.image_addr_offset        = 0x00002D18,
+			.buffer_width_cfg         = 0x00002D1C,
+			.buffer_height_cfg        = 0x00002D20,
+			.packer_cfg               = 0x00002D24,
+			.stride                   = 0x00002D28,
+			.irq_subsample_period     = 0x00002D48,
+			.irq_subsample_pattern    = 0x00002D4C,
+			.framedrop_period         = 0x00002D50,
+			.framedrop_pattern        = 0x00002D54,
+			.frame_inc                = 0x00002D58,
+			.burst_limit              = 0x00002D5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 */
+		{
+			.status0                  = 0x00002E00,
+			.status1                  = 0x00002E04,
+			.cfg                      = 0x00002E08,
+			.header_addr              = 0x00002E0C,
+			.header_cfg               = 0x00002E10,
+			.image_addr               = 0x00002E14,
+			.image_addr_offset        = 0x00002E18,
+			.buffer_width_cfg         = 0x00002E1C,
+			.buffer_height_cfg        = 0x00002E20,
+			.packer_cfg               = 0x00002E24,
+			.stride                   = 0x00002E28,
+			.irq_subsample_period     = 0x00002E48,
+			.irq_subsample_pattern    = 0x00002E4C,
+			.framedrop_period         = 0x00002E50,
+			.framedrop_pattern        = 0x00002E54,
+			.frame_inc                = 0x00002E58,
+			.burst_limit              = 0x00002E5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 */
+		{
+			.status0                  = 0x00002F00,
+			.status1                  = 0x00002F04,
+			.cfg                      = 0x00002F08,
+			.header_addr              = 0x00002F0C,
+			.header_cfg               = 0x00002F10,
+			.image_addr               = 0x00002F14,
+			.image_addr_offset        = 0x00002F18,
+			.buffer_width_cfg         = 0x00002F1C,
+			.buffer_height_cfg        = 0x00002F20,
+			.packer_cfg               = 0x00002F24,
+			.stride                   = 0x00002F28,
+			.irq_subsample_period     = 0x00002F48,
+			.irq_subsample_pattern    = 0x00002F4C,
+			.framedrop_period         = 0x00002F50,
+			.framedrop_pattern        = 0x00002F54,
+			.frame_inc                = 0x00002F58,
+			.burst_limit              = 0x00002F5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 */
+		{
+			.status0                  = 0x00003000,
+			.status1                  = 0x00003004,
+			.cfg                      = 0x00003008,
+			.header_addr              = 0x0000300C,
+			.header_cfg               = 0x00003010,
+			.image_addr               = 0x00003014,
+			.image_addr_offset        = 0x00003018,
+			.buffer_width_cfg         = 0x0000301C,
+			.buffer_height_cfg        = 0x00003020,
+			.packer_cfg               = 0x00003024,
+			.stride                   = 0x00003028,
+			.irq_subsample_period     = 0x00003048,
+			.irq_subsample_pattern    = 0x0000304C,
+			.framedrop_period         = 0x00003050,
+			.framedrop_pattern        = 0x00003054,
+			.frame_inc                = 0x00003058,
+			.burst_limit              = 0x0000305C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 */
+		{
+			.status0                  = 0x00003100,
+			.status1                  = 0x00003104,
+			.cfg                      = 0x00003108,
+			.header_addr              = 0x0000310C,
+			.header_cfg               = 0x00003110,
+			.image_addr               = 0x00003114,
+			.image_addr_offset        = 0x00003118,
+			.buffer_width_cfg         = 0x0000311C,
+			.buffer_height_cfg        = 0x00003120,
+			.packer_cfg               = 0x00003124,
+			.stride                   = 0x00003128,
+			.irq_subsample_period     = 0x00003148,
+			.irq_subsample_pattern    = 0x0000314C,
+			.framedrop_period         = 0x00003150,
+			.framedrop_pattern        = 0x00003154,
+			.frame_inc                = 0x00003158,
+			.burst_limit              = 0x0000315C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 */
+		{
+			.status0                  = 0x00003200,
+			.status1                  = 0x00003204,
+			.cfg                      = 0x00003208,
+			.header_addr              = 0x0000320C,
+			.header_cfg               = 0x00003210,
+			.image_addr               = 0x00003214,
+			.image_addr_offset        = 0x00003218,
+			.buffer_width_cfg         = 0x0000321C,
+			.buffer_height_cfg        = 0x00003220,
+			.packer_cfg               = 0x00003224,
+			.stride                   = 0x00003228,
+			.irq_subsample_period     = 0x00003248,
+			.irq_subsample_pattern    = 0x0000324C,
+			.framedrop_period         = 0x00003250,
+			.framedrop_pattern        = 0x00003254,
+			.frame_inc                = 0x00003258,
+			.burst_limit              = 0x0000325C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 */
+		{
+			.status0                  = 0x00003300,
+			.status1                  = 0x00003304,
+			.cfg                      = 0x00003308,
+			.header_addr              = 0x0000330C,
+			.header_cfg               = 0x00003310,
+			.image_addr               = 0x00003314,
+			.image_addr_offset        = 0x00003318,
+			.buffer_width_cfg         = 0x0000331C,
+			.buffer_height_cfg        = 0x00003320,
+			.packer_cfg               = 0x00003324,
+			.stride                   = 0x00003328,
+			.irq_subsample_period     = 0x00003348,
+			.irq_subsample_pattern    = 0x0000334C,
+			.framedrop_period         = 0x00003350,
+			.framedrop_pattern        = 0x00003354,
+			.frame_inc                = 0x00003358,
+			.burst_limit              = 0x0000335C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 */
+		{
+			.status0                  = 0x00003400,
+			.status1                  = 0x00003404,
+			.cfg                      = 0x00003408,
+			.header_addr              = 0x0000340C,
+			.header_cfg               = 0x00003410,
+			.image_addr               = 0x00003414,
+			.image_addr_offset        = 0x00003418,
+			.buffer_width_cfg         = 0x0000341C,
+			.buffer_height_cfg        = 0x00003420,
+			.packer_cfg               = 0x00003424,
+			.stride                   = 0x00003428,
+			.irq_subsample_period     = 0x00003448,
+			.irq_subsample_pattern    = 0x0000344C,
+			.framedrop_period         = 0x00003450,
+			.framedrop_pattern        = 0x00003454,
+			.frame_inc                = 0x00003458,
+			.burst_limit              = 0x0000345C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 */
+		{
+			.status0                  = 0x00003500,
+			.status1                  = 0x00003504,
+			.cfg                      = 0x00003508,
+			.header_addr              = 0x0000350C,
+			.header_cfg               = 0x00003510,
+			.image_addr               = 0x00003514,
+			.image_addr_offset        = 0x00003518,
+			.buffer_width_cfg         = 0x0000351C,
+			.buffer_height_cfg        = 0x00003520,
+			.packer_cfg               = 0x00003524,
+			.stride                   = 0x00003528,
+			.irq_subsample_period     = 0x00003548,
+			.irq_subsample_pattern    = 0x0000354C,
+			.framedrop_period         = 0x00003550,
+			.framedrop_pattern        = 0x00003554,
+			.frame_inc                = 0x00003558,
+			.burst_limit              = 0x0000355C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 */
+		{
+			.status0                  = 0x00003600,
+			.status1                  = 0x00003604,
+			.cfg                      = 0x00003608,
+			.header_addr              = 0x0000360C,
+			.header_cfg               = 0x00003610,
+			.image_addr               = 0x00003614,
+			.image_addr_offset        = 0x00003618,
+			.buffer_width_cfg         = 0x0000361C,
+			.buffer_height_cfg        = 0x00003620,
+			.packer_cfg               = 0x00003624,
+			.stride                   = 0x00003628,
+			.irq_subsample_period     = 0x00003648,
+			.irq_subsample_pattern    = 0x0000364C,
+			.framedrop_period         = 0x00003650,
+			.framedrop_pattern        = 0x00003654,
+			.frame_inc                = 0x00003658,
+			.burst_limit              = 0x0000365C,
+			.ubwc_regs                =
+				&vfe165_160_ubwc_regs_client_20,
+		},
+		/* BUS Client 21 */
+		{
+			.status0                  = 0x00003700,
+			.status1                  = 0x00003704,
+			.cfg                      = 0x00003708,
+			.header_addr              = 0x0000370C,
+			.header_cfg               = 0x00003710,
+			.image_addr               = 0x00003714,
+			.image_addr_offset        = 0x00003718,
+			.buffer_width_cfg         = 0x0000371C,
+			.buffer_height_cfg        = 0x00003720,
+			.packer_cfg               = 0x00003724,
+			.stride                   = 0x00003728,
+			.irq_subsample_period     = 0x00003748,
+			.irq_subsample_pattern    = 0x0000374C,
+			.framedrop_period         = 0x00003750,
+			.framedrop_pattern        = 0x00003754,
+			.frame_inc                = 0x00003758,
+			.burst_limit              = 0x0000375C,
+			.ubwc_regs                =
+				&vfe165_160_ubwc_regs_client_21,
+		},
+		/* BUS Client 22 */
+		{
+			.status0                  = 0x00003800,
+			.status1                  = 0x00003804,
+			.cfg                      = 0x00003808,
+			.header_addr              = 0x0000380C,
+			.header_cfg               = 0x00003810,
+			.image_addr               = 0x00003814,
+			.image_addr_offset        = 0x00003818,
+			.buffer_width_cfg         = 0x0000381C,
+			.buffer_height_cfg        = 0x00003820,
+			.packer_cfg               = 0x00003824,
+			.stride                   = 0x00003828,
+			.irq_subsample_period     = 0x00003848,
+			.irq_subsample_pattern    = 0x0000384C,
+			.framedrop_period         = 0x00003850,
+			.framedrop_pattern        = 0x00003854,
+			.frame_inc                = 0x00003858,
+			.burst_limit              = 0x0000385C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 */
+		{
+			.status0                  = 0x00003900,
+			.status1                  = 0x00003904,
+			.cfg                      = 0x00003908,
+			.header_addr              = 0x0000390C,
+			.header_cfg               = 0x00003910,
+			.image_addr               = 0x00003914,
+			.image_addr_offset        = 0x00003918,
+			.buffer_width_cfg         = 0x0000391C,
+			.buffer_height_cfg        = 0x00003920,
+			.packer_cfg               = 0x00003924,
+			.stride                   = 0x00003928,
+			.irq_subsample_period     = 0x00003948,
+			.irq_subsample_pattern    = 0x0000394C,
+			.framedrop_period         = 0x00003950,
+			.framedrop_pattern        = 0x00003954,
+			.frame_inc                = 0x00003958,
+			.burst_limit              = 0x0000395C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 22,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 4,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 5,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 6,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.mid[0]        = 32,
+			.mid[1]        = 33,
+			.mid[2]        = 34,
+			.mid[3]        = 35,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.mid[0]        = 36,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.mid[0]        = 37,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 40,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.mid[0]        = 38,
+			.mid[1]        = 39,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 41,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 42,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.mid[0]        = 43,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 44,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 45,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 46,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 47,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 48,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 49,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 50,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.mid[0]        = 51,
+			.mid[1]        = 52,
+			.mid[2]        = 53,
+			.mid[3]        = 54,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.mid[0]        = 55,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.mid[0]        = 56,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 23,
+};
+
+static struct cam_vfe_hw_info cam_vfe165_160_hw_info = {
+	.irq_reg_info                  = &vfe165_160_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe165_160_bus_hw_info,
+
+	.bus_rd_version                = CAM_VFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &vfe165_160_bus_rd_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe165_160_top_hw_info,
+
+	.camif_version                 = CAM_VFE_CAMIF_VER_2_0,
+	.camif_reg                     = &vfe165_160_camif_reg,
+
+	.camif_lite_version            = CAM_VFE_CAMIF_LITE_VER_2_0,
+	.camif_lite_reg                = &vfe165_160_camif_lite_reg,
+
+};
+
+#endif /* _CAM_VFE165_160_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe170.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe170.h
@@ -0,0 +1,886 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE170_H_
+#define _CAM_VFE170_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe170_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe170_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe170_top_irq_reg_set,
+	.global_clear_offset  = 0x00000058,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_camif_ver2_reg vfe170_camif_reg = {
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+};
+
+static struct cam_vfe_camif_reg_data vfe_170_camif_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0x0FFF7E80,
+	.enable_diagnostic_hw            = 0x1,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_170_reg = {
+	.reset    = 0x0000001C,
+	.cgc_ovd  = 0x0000002C,
+	.enable   = 0x00000040,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl stats_170_reg = {
+	.reset    = 0x00000020,
+	.cgc_ovd  = 0x00000030,
+	.enable   = 0x00000044,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl color_170_reg = {
+	.reset    = 0x00000024,
+	.cgc_ovd  = 0x00000034,
+	.enable   = 0x00000048,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl zoom_170_reg = {
+	.reset    = 0x00000028,
+	.cgc_ovd  = 0x00000038,
+	.enable   = 0x0000004C,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe170_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		&lens_170_reg,
+		&stats_170_reg,
+		&color_170_reg,
+		&zoom_170_reg,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000050,
+	.three_D_cfg              = 0x00000054,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe170_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+struct cam_vfe_top_dump_data vfe170_dump_data = {
+	.num_reg_dump_entries  =  2,
+	.num_lut_dump_entries  =  1,
+	.dmi_cfg               =  0xc24,
+	.dmi_addr              =  0xc28,
+	.dmi_data_path_hi      =  0xc2C,
+	.dmi_data_path_lo      =  0xc30,
+	.reg_entry = {
+		{
+			.reg_dump_start = 0x0,
+			.reg_dump_end   = 0x1164,
+		},
+		{
+			.reg_dump_start = 0x2000,
+			.reg_dump_end   = 0x397C,
+		},
+	},
+	.lut_entry = {
+		{
+			.lut_word_size = 64,
+			.lut_bank_sel  = 0x40,
+			.lut_addr_size = 180,
+		},
+	},
+};
+
+static struct cam_vfe_rdi_overflow_status vfe170_rdi_irq_status = {
+	.rdi0_overflow_mask = 0x8,
+	.rdi1_overflow_mask = 0x10,
+	.rdi2_overflow_mask = 0x18,
+	.rdi3_overflow_mask = 0x20,
+	.rdi_overflow_mask  = 0x3c,
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe170_top_hw_info = {
+	.common_reg = &vfe170_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe170_top_common_reg,
+		.camif_reg      = &vfe170_camif_reg,
+		.reg_data       = &vfe_170_camif_reg_data,
+		},
+	.camif_lite_hw_info = {
+		.common_reg     = NULL,
+		.camif_lite_reg = NULL,
+		.reg_data       = NULL,
+		},
+	.rdi_hw_info = {
+		.common_reg      = &vfe170_top_common_reg,
+		.rdi_reg         = &vfe170_rdi_reg,
+		.rdi_irq_status  = &vfe170_rdi_irq_status,
+		.reg_data = {
+			&vfe_170_rdi_0_data,
+			&vfe_170_rdi_1_data,
+			&vfe_170_rdi_2_data,
+			NULL,
+			},
+		},
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_2_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+	.dump_data = &vfe170_dump_data,
+};
+
+static struct cam_irq_register_set vfe170_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_client ubwc_regs_client_3 = {
+	.tile_cfg         = 0x0000252C,
+	.h_init           = 0x00002530,
+	.v_init           = 0x00002534,
+	.meta_addr        = 0x00002538,
+	.meta_offset      = 0x0000253C,
+	.meta_stride      = 0x00002540,
+	.mode_cfg_0       = 0x00002544,
+	.bw_limit         = 0x000025A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_client ubwc_regs_client_4 = {
+	.tile_cfg         = 0x0000262C,
+	.h_init           = 0x00002630,
+	.v_init           = 0x00002634,
+	.meta_addr        = 0x00002638,
+	.meta_offset      = 0x0000263C,
+	.meta_stride      = 0x00002640,
+	.mode_cfg_0       = 0x00002644,
+	.bw_limit         = 0x000026A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe170_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers        = 3,
+			.irq_reg_set          = vfe170_bus_irq_reg,
+			.global_clear_offset  = 0x00002068,
+			.global_clear_bitmask = 0x00000001,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 20,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                = &ubwc_regs_client_3,
+		},
+		/* BUS Client 4 */
+		{
+			.status0                  = 0x00002600,
+			.status1                  = 0x00002604,
+			.cfg                      = 0x00002608,
+			.header_addr              = 0x0000260C,
+			.header_cfg               = 0x00002610,
+			.image_addr               = 0x00002614,
+			.image_addr_offset        = 0x00002618,
+			.buffer_width_cfg         = 0x0000261C,
+			.buffer_height_cfg        = 0x00002620,
+			.packer_cfg               = 0x00002624,
+			.stride                   = 0x00002628,
+			.irq_subsample_period     = 0x00002648,
+			.irq_subsample_pattern    = 0x0000264C,
+			.framedrop_period         = 0x00002650,
+			.framedrop_pattern        = 0x00002654,
+			.frame_inc                = 0x00002658,
+			.burst_limit              = 0x0000265C,
+			.ubwc_regs                = &ubwc_regs_client_4,
+		},
+		/* BUS Client 5 */
+		{
+			.status0                  = 0x00002700,
+			.status1                  = 0x00002704,
+			.cfg                      = 0x00002708,
+			.header_addr              = 0x0000270C,
+			.header_cfg               = 0x00002710,
+			.image_addr               = 0x00002714,
+			.image_addr_offset        = 0x00002718,
+			.buffer_width_cfg         = 0x0000271C,
+			.buffer_height_cfg        = 0x00002720,
+			.packer_cfg               = 0x00002724,
+			.stride                   = 0x00002728,
+			.irq_subsample_period     = 0x00002748,
+			.irq_subsample_pattern    = 0x0000274C,
+			.framedrop_period         = 0x00002750,
+			.framedrop_pattern        = 0x00002754,
+			.frame_inc                = 0x00002758,
+			.burst_limit              = 0x0000275C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 */
+		{
+			.status0                  = 0x00002800,
+			.status1                  = 0x00002804,
+			.cfg                      = 0x00002808,
+			.header_addr              = 0x0000280C,
+			.header_cfg               = 0x00002810,
+			.image_addr               = 0x00002814,
+			.image_addr_offset        = 0x00002818,
+			.buffer_width_cfg         = 0x0000281C,
+			.buffer_height_cfg        = 0x00002820,
+			.packer_cfg               = 0x00002824,
+			.stride                   = 0x00002828,
+			.irq_subsample_period     = 0x00002848,
+			.irq_subsample_pattern    = 0x0000284C,
+			.framedrop_period         = 0x00002850,
+			.framedrop_pattern        = 0x00002854,
+			.frame_inc                = 0x00002858,
+			.burst_limit              = 0x0000285C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 */
+		{
+			.status0                  = 0x00002900,
+			.status1                  = 0x00002904,
+			.cfg                      = 0x00002908,
+			.header_addr              = 0x0000290C,
+			.header_cfg               = 0x00002910,
+			.image_addr               = 0x00002914,
+			.image_addr_offset        = 0x00002918,
+			.buffer_width_cfg         = 0x0000291C,
+			.buffer_height_cfg        = 0x00002920,
+			.packer_cfg               = 0x00002924,
+			.stride                   = 0x00002928,
+			.irq_subsample_period     = 0x00002948,
+			.irq_subsample_pattern    = 0x0000294C,
+			.framedrop_period         = 0x00002950,
+			.framedrop_pattern        = 0x00002954,
+			.frame_inc                = 0x00002958,
+			.burst_limit              = 0x0000295C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 */
+		{
+			.status0                  = 0x00002A00,
+			.status1                  = 0x00002A04,
+			.cfg                      = 0x00002A08,
+			.header_addr              = 0x00002A0C,
+			.header_cfg               = 0x00002A10,
+			.image_addr               = 0x00002A14,
+			.image_addr_offset        = 0x00002A18,
+			.buffer_width_cfg         = 0x00002A1C,
+			.buffer_height_cfg        = 0x00002A20,
+			.packer_cfg               = 0x00002A24,
+			.stride                   = 0x00002A28,
+			.irq_subsample_period     = 0x00002A48,
+			.irq_subsample_pattern    = 0x00002A4C,
+			.framedrop_period         = 0x00002A50,
+			.framedrop_pattern        = 0x00002A54,
+			.frame_inc                = 0x00002A58,
+			.burst_limit              = 0x00002A5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 */
+		{
+			.status0                  = 0x00002B00,
+			.status1                  = 0x00002B04,
+			.cfg                      = 0x00002B08,
+			.header_addr              = 0x00002B0C,
+			.header_cfg               = 0x00002B10,
+			.image_addr               = 0x00002B14,
+			.image_addr_offset        = 0x00002B18,
+			.buffer_width_cfg         = 0x00002B1C,
+			.buffer_height_cfg        = 0x00002B20,
+			.packer_cfg               = 0x00002B24,
+			.stride                   = 0x00002B28,
+			.irq_subsample_period     = 0x00002B48,
+			.irq_subsample_pattern    = 0x00002B4C,
+			.framedrop_period         = 0x00002B50,
+			.framedrop_pattern        = 0x00002B54,
+			.frame_inc                = 0x00002B58,
+			.burst_limit              = 0x00002B5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 */
+		{
+			.status0                  = 0x00002C00,
+			.status1                  = 0x00002C04,
+			.cfg                      = 0x00002C08,
+			.header_addr              = 0x00002C0C,
+			.header_cfg               = 0x00002C10,
+			.image_addr               = 0x00002C14,
+			.image_addr_offset        = 0x00002C18,
+			.buffer_width_cfg         = 0x00002C1C,
+			.buffer_height_cfg        = 0x00002C20,
+			.packer_cfg               = 0x00002C24,
+			.stride                   = 0x00002C28,
+			.irq_subsample_period     = 0x00002C48,
+			.irq_subsample_pattern    = 0x00002C4C,
+			.framedrop_period         = 0x00002C50,
+			.framedrop_pattern        = 0x00002C54,
+			.frame_inc                = 0x00002C58,
+			.burst_limit              = 0x00002C5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 */
+		{
+			.status0                  = 0x00002D00,
+			.status1                  = 0x00002D04,
+			.cfg                      = 0x00002D08,
+			.header_addr              = 0x00002D0C,
+			.header_cfg               = 0x00002D10,
+			.image_addr               = 0x00002D14,
+			.image_addr_offset        = 0x00002D18,
+			.buffer_width_cfg         = 0x00002D1C,
+			.buffer_height_cfg        = 0x00002D20,
+			.packer_cfg               = 0x00002D24,
+			.stride                   = 0x00002D28,
+			.irq_subsample_period     = 0x00002D48,
+			.irq_subsample_pattern    = 0x00002D4C,
+			.framedrop_period         = 0x00002D50,
+			.framedrop_pattern        = 0x00002D54,
+			.frame_inc                = 0x00002D58,
+			.burst_limit              = 0x00002D5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 */
+		{
+			.status0                  = 0x00002E00,
+			.status1                  = 0x00002E04,
+			.cfg                      = 0x00002E08,
+			.header_addr              = 0x00002E0C,
+			.header_cfg               = 0x00002E10,
+			.image_addr               = 0x00002E14,
+			.image_addr_offset        = 0x00002E18,
+			.buffer_width_cfg         = 0x00002E1C,
+			.buffer_height_cfg        = 0x00002E20,
+			.packer_cfg               = 0x00002E24,
+			.stride                   = 0x00002E28,
+			.irq_subsample_period     = 0x00002E48,
+			.irq_subsample_pattern    = 0x00002E4C,
+			.framedrop_period         = 0x00002E50,
+			.framedrop_pattern        = 0x00002E54,
+			.frame_inc                = 0x00002E58,
+			.burst_limit              = 0x00002E5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 */
+		{
+			.status0                  = 0x00002F00,
+			.status1                  = 0x00002F04,
+			.cfg                      = 0x00002F08,
+			.header_addr              = 0x00002F0C,
+			.header_cfg               = 0x00002F10,
+			.image_addr               = 0x00002F14,
+			.image_addr_offset        = 0x00002F18,
+			.buffer_width_cfg         = 0x00002F1C,
+			.buffer_height_cfg        = 0x00002F20,
+			.packer_cfg               = 0x00002F24,
+			.stride                   = 0x00002F28,
+			.irq_subsample_period     = 0x00002F48,
+			.irq_subsample_pattern    = 0x00002F4C,
+			.framedrop_period         = 0x00002F50,
+			.framedrop_pattern        = 0x00002F54,
+			.frame_inc                = 0x00002F58,
+			.burst_limit              = 0x00002F5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 */
+		{
+			.status0                  = 0x00003000,
+			.status1                  = 0x00003004,
+			.cfg                      = 0x00003008,
+			.header_addr              = 0x0000300C,
+			.header_cfg               = 0x00003010,
+			.image_addr               = 0x00003014,
+			.image_addr_offset        = 0x00003018,
+			.buffer_width_cfg         = 0x0000301C,
+			.buffer_height_cfg        = 0x00003020,
+			.packer_cfg               = 0x00003024,
+			.stride                   = 0x00003028,
+			.irq_subsample_period     = 0x00003048,
+			.irq_subsample_pattern    = 0x0000304C,
+			.framedrop_period         = 0x00003050,
+			.framedrop_pattern        = 0x00003054,
+			.frame_inc                = 0x00003058,
+			.burst_limit              = 0x0000305C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 */
+		{
+			.status0                  = 0x00003100,
+			.status1                  = 0x00003104,
+			.cfg                      = 0x00003108,
+			.header_addr              = 0x0000310C,
+			.header_cfg               = 0x00003110,
+			.image_addr               = 0x00003114,
+			.image_addr_offset        = 0x00003118,
+			.buffer_width_cfg         = 0x0000311C,
+			.buffer_height_cfg        = 0x00003120,
+			.packer_cfg               = 0x00003124,
+			.stride                   = 0x00003128,
+			.irq_subsample_period     = 0x00003148,
+			.irq_subsample_pattern    = 0x0000314C,
+			.framedrop_period         = 0x00003150,
+			.framedrop_pattern        = 0x00003154,
+			.frame_inc                = 0x00003158,
+			.burst_limit              = 0x0000315C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 */
+		{
+			.status0                  = 0x00003200,
+			.status1                  = 0x00003204,
+			.cfg                      = 0x00003208,
+			.header_addr              = 0x0000320C,
+			.header_cfg               = 0x00003210,
+			.image_addr               = 0x00003214,
+			.image_addr_offset        = 0x00003218,
+			.buffer_width_cfg         = 0x0000321C,
+			.buffer_height_cfg        = 0x00003220,
+			.packer_cfg               = 0x00003224,
+			.stride                   = 0x00003228,
+			.irq_subsample_period     = 0x00003248,
+			.irq_subsample_pattern    = 0x0000324C,
+			.framedrop_period         = 0x00003250,
+			.framedrop_pattern        = 0x00003254,
+			.frame_inc                = 0x00003258,
+			.burst_limit              = 0x0000325C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 */
+		{
+			.status0                  = 0x00003300,
+			.status1                  = 0x00003304,
+			.cfg                      = 0x00003308,
+			.header_addr              = 0x0000330C,
+			.header_cfg               = 0x00003310,
+			.image_addr               = 0x00003314,
+			.image_addr_offset        = 0x00003318,
+			.buffer_width_cfg         = 0x0000331C,
+			.buffer_height_cfg        = 0x00003320,
+			.packer_cfg               = 0x00003324,
+			.stride                   = 0x00003328,
+			.irq_subsample_period     = 0x00003348,
+			.irq_subsample_pattern    = 0x0000334C,
+			.framedrop_period         = 0x00003350,
+			.framedrop_pattern        = 0x00003354,
+			.frame_inc                = 0x00003358,
+			.burst_limit              = 0x0000335C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 */
+		{
+			.status0                  = 0x00003400,
+			.status1                  = 0x00003404,
+			.cfg                      = 0x00003408,
+			.header_addr              = 0x0000340C,
+			.header_cfg               = 0x00003410,
+			.image_addr               = 0x00003414,
+			.image_addr_offset        = 0x00003418,
+			.buffer_width_cfg         = 0x0000341C,
+			.buffer_height_cfg        = 0x00003420,
+			.packer_cfg               = 0x00003424,
+			.stride                   = 0x00003428,
+			.irq_subsample_period     = 0x00003448,
+			.irq_subsample_pattern    = 0x0000344C,
+			.framedrop_period         = 0x00003450,
+			.framedrop_pattern        = 0x00003454,
+			.frame_inc                = 0x00003458,
+			.burst_limit              = 0x0000345C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 */
+		{
+			.status0                  = 0x00003500,
+			.status1                  = 0x00003504,
+			.cfg                      = 0x00003508,
+			.header_addr              = 0x0000350C,
+			.header_cfg               = 0x00003510,
+			.image_addr               = 0x00003514,
+			.image_addr_offset        = 0x00003518,
+			.buffer_width_cfg         = 0x0000351C,
+			.buffer_height_cfg        = 0x00003520,
+			.packer_cfg               = 0x00003524,
+			.stride                   = 0x00003528,
+			.irq_subsample_period     = 0x00003548,
+			.irq_subsample_pattern    = 0x0000354C,
+			.framedrop_period         = 0x00003550,
+			.framedrop_pattern        = 0x00003554,
+			.frame_inc                = 0x00003558,
+			.burst_limit              = 0x0000355C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 18,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 19,
+};
+
+static struct cam_vfe_hw_info cam_vfe170_hw_info = {
+	.irq_reg_info                  = &vfe170_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe170_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe170_top_hw_info,
+
+	.camif_version                 = CAM_VFE_CAMIF_VER_2_0,
+	.camif_reg                     = &vfe170_camif_reg,
+
+	.camif_lite_version            = 0,
+	.camif_lite_reg                = NULL,
+
+};
+
+#endif /* _CAM_VFE170_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe170_150.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe170_150.h
@@ -0,0 +1,854 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE170_150_H_
+#define _CAM_VFE170_150_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe170_150_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe170_150_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe170_150_top_irq_reg_set,
+	.global_clear_offset  = 0x00000058,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_camif_ver2_reg vfe170_150_camif_reg = {
+	.dual_vfe_sync            = 0x00000100,
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+};
+
+static struct cam_vfe_camif_reg_data vfe_170_150_camif_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0x0FFF7E80,
+	.enable_diagnostic_hw            = 0x1,
+	.dual_vfe_sync_mask              = 0x3,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_170_150_reg = {
+	.reset    = 0x0000001C,
+	.cgc_ovd  = 0x0000002C,
+	.enable   = 0x00000040,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl stats_170_150_reg = {
+	.reset    = 0x00000020,
+	.cgc_ovd  = 0x00000030,
+	.enable   = 0x00000044,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl color_170_150_reg = {
+	.reset    = 0x00000024,
+	.cgc_ovd  = 0x00000034,
+	.enable   = 0x00000048,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl zoom_170_150_reg = {
+	.reset    = 0x00000028,
+	.cgc_ovd  = 0x00000038,
+	.enable   = 0x0000004C,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe170_150_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		&lens_170_150_reg,
+		&stats_170_150_reg,
+		&color_170_150_reg,
+		&zoom_170_150_reg,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000050,
+	.three_D_cfg              = 0x00000054,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe170_150_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_150_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_150_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_170_150_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe170_150_top_hw_info = {
+	.common_reg = &vfe170_150_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe170_150_top_common_reg,
+		.camif_reg      = &vfe170_150_camif_reg,
+		.reg_data       = &vfe_170_150_camif_reg_data,
+		},
+	.camif_lite_hw_info = {
+		.common_reg     = NULL,
+		.camif_lite_reg = NULL,
+		.reg_data       = NULL,
+		},
+	.rdi_hw_info = {
+		.common_reg = &vfe170_150_top_common_reg,
+		.rdi_reg    = &vfe170_150_rdi_reg,
+		.reg_data = {
+			&vfe_170_150_rdi_0_data,
+			&vfe_170_150_rdi_1_data,
+			&vfe_170_150_rdi_2_data,
+			NULL,
+			},
+		},
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_2_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set vfe170_150_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_client
+	vfe_170_150_ubwc_regs_client_3 = {
+		.tile_cfg         = 0x0000252C,
+		.h_init           = 0x00002530,
+		.v_init           = 0x00002534,
+		.meta_addr        = 0x00002538,
+		.meta_offset      = 0x0000253C,
+		.meta_stride      = 0x00002540,
+		.mode_cfg_0       = 0x00002544,
+		.bw_limit         = 0x000025A0,
+		.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_client
+	vfe_170_150_ubwc_regs_client_4 = {
+		.tile_cfg         = 0x0000262C,
+		.h_init           = 0x00002630,
+		.v_init           = 0x00002634,
+		.meta_addr        = 0x00002638,
+		.meta_offset      = 0x0000263C,
+		.meta_stride      = 0x00002640,
+		.mode_cfg_0       = 0x00002644,
+		.bw_limit         = 0x000026A0,
+		.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe170_150_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers        = 3,
+			.irq_reg_set          = vfe170_150_bus_irq_reg,
+			.global_clear_offset  = 0x00002068,
+			.global_clear_bitmask = 0x00000001,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
+	},
+	.num_client = 20,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                =
+				&vfe_170_150_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 */
+		{
+			.status0                  = 0x00002600,
+			.status1                  = 0x00002604,
+			.cfg                      = 0x00002608,
+			.header_addr              = 0x0000260C,
+			.header_cfg               = 0x00002610,
+			.image_addr               = 0x00002614,
+			.image_addr_offset        = 0x00002618,
+			.buffer_width_cfg         = 0x0000261C,
+			.buffer_height_cfg        = 0x00002620,
+			.packer_cfg               = 0x00002624,
+			.stride                   = 0x00002628,
+			.irq_subsample_period     = 0x00002648,
+			.irq_subsample_pattern    = 0x0000264C,
+			.framedrop_period         = 0x00002650,
+			.framedrop_pattern        = 0x00002654,
+			.frame_inc                = 0x00002658,
+			.burst_limit              = 0x0000265C,
+			.ubwc_regs                =
+				&vfe_170_150_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 */
+		{
+			.status0                  = 0x00002700,
+			.status1                  = 0x00002704,
+			.cfg                      = 0x00002708,
+			.header_addr              = 0x0000270C,
+			.header_cfg               = 0x00002710,
+			.image_addr               = 0x00002714,
+			.image_addr_offset        = 0x00002718,
+			.buffer_width_cfg         = 0x0000271C,
+			.buffer_height_cfg        = 0x00002720,
+			.packer_cfg               = 0x00002724,
+			.stride                   = 0x00002728,
+			.irq_subsample_period     = 0x00002748,
+			.irq_subsample_pattern    = 0x0000274C,
+			.framedrop_period         = 0x00002750,
+			.framedrop_pattern        = 0x00002754,
+			.frame_inc                = 0x00002758,
+			.burst_limit              = 0x0000275C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 */
+		{
+			.status0                  = 0x00002800,
+			.status1                  = 0x00002804,
+			.cfg                      = 0x00002808,
+			.header_addr              = 0x0000280C,
+			.header_cfg               = 0x00002810,
+			.image_addr               = 0x00002814,
+			.image_addr_offset        = 0x00002818,
+			.buffer_width_cfg         = 0x0000281C,
+			.buffer_height_cfg        = 0x00002820,
+			.packer_cfg               = 0x00002824,
+			.stride                   = 0x00002828,
+			.irq_subsample_period     = 0x00002848,
+			.irq_subsample_pattern    = 0x0000284C,
+			.framedrop_period         = 0x00002850,
+			.framedrop_pattern        = 0x00002854,
+			.frame_inc                = 0x00002858,
+			.burst_limit              = 0x0000285C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 */
+		{
+			.status0                  = 0x00002900,
+			.status1                  = 0x00002904,
+			.cfg                      = 0x00002908,
+			.header_addr              = 0x0000290C,
+			.header_cfg               = 0x00002910,
+			.image_addr               = 0x00002914,
+			.image_addr_offset        = 0x00002918,
+			.buffer_width_cfg         = 0x0000291C,
+			.buffer_height_cfg        = 0x00002920,
+			.packer_cfg               = 0x00002924,
+			.stride                   = 0x00002928,
+			.irq_subsample_period     = 0x00002948,
+			.irq_subsample_pattern    = 0x0000294C,
+			.framedrop_period         = 0x00002950,
+			.framedrop_pattern        = 0x00002954,
+			.frame_inc                = 0x00002958,
+			.burst_limit              = 0x0000295C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 */
+		{
+			.status0                  = 0x00002A00,
+			.status1                  = 0x00002A04,
+			.cfg                      = 0x00002A08,
+			.header_addr              = 0x00002A0C,
+			.header_cfg               = 0x00002A10,
+			.image_addr               = 0x00002A14,
+			.image_addr_offset        = 0x00002A18,
+			.buffer_width_cfg         = 0x00002A1C,
+			.buffer_height_cfg        = 0x00002A20,
+			.packer_cfg               = 0x00002A24,
+			.stride                   = 0x00002A28,
+			.irq_subsample_period     = 0x00002A48,
+			.irq_subsample_pattern    = 0x00002A4C,
+			.framedrop_period         = 0x00002A50,
+			.framedrop_pattern        = 0x00002A54,
+			.frame_inc                = 0x00002A58,
+			.burst_limit              = 0x00002A5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 */
+		{
+			.status0                  = 0x00002B00,
+			.status1                  = 0x00002B04,
+			.cfg                      = 0x00002B08,
+			.header_addr              = 0x00002B0C,
+			.header_cfg               = 0x00002B10,
+			.image_addr               = 0x00002B14,
+			.image_addr_offset        = 0x00002B18,
+			.buffer_width_cfg         = 0x00002B1C,
+			.buffer_height_cfg        = 0x00002B20,
+			.packer_cfg               = 0x00002B24,
+			.stride                   = 0x00002B28,
+			.irq_subsample_period     = 0x00002B48,
+			.irq_subsample_pattern    = 0x00002B4C,
+			.framedrop_period         = 0x00002B50,
+			.framedrop_pattern        = 0x00002B54,
+			.frame_inc                = 0x00002B58,
+			.burst_limit              = 0x00002B5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 */
+		{
+			.status0                  = 0x00002C00,
+			.status1                  = 0x00002C04,
+			.cfg                      = 0x00002C08,
+			.header_addr              = 0x00002C0C,
+			.header_cfg               = 0x00002C10,
+			.image_addr               = 0x00002C14,
+			.image_addr_offset        = 0x00002C18,
+			.buffer_width_cfg         = 0x00002C1C,
+			.buffer_height_cfg        = 0x00002C20,
+			.packer_cfg               = 0x00002C24,
+			.stride                   = 0x00002C28,
+			.irq_subsample_period     = 0x00002C48,
+			.irq_subsample_pattern    = 0x00002C4C,
+			.framedrop_period         = 0x00002C50,
+			.framedrop_pattern        = 0x00002C54,
+			.frame_inc                = 0x00002C58,
+			.burst_limit              = 0x00002C5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 */
+		{
+			.status0                  = 0x00002D00,
+			.status1                  = 0x00002D04,
+			.cfg                      = 0x00002D08,
+			.header_addr              = 0x00002D0C,
+			.header_cfg               = 0x00002D10,
+			.image_addr               = 0x00002D14,
+			.image_addr_offset        = 0x00002D18,
+			.buffer_width_cfg         = 0x00002D1C,
+			.buffer_height_cfg        = 0x00002D20,
+			.packer_cfg               = 0x00002D24,
+			.stride                   = 0x00002D28,
+			.irq_subsample_period     = 0x00002D48,
+			.irq_subsample_pattern    = 0x00002D4C,
+			.framedrop_period         = 0x00002D50,
+			.framedrop_pattern        = 0x00002D54,
+			.frame_inc                = 0x00002D58,
+			.burst_limit              = 0x00002D5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 */
+		{
+			.status0                  = 0x00002E00,
+			.status1                  = 0x00002E04,
+			.cfg                      = 0x00002E08,
+			.header_addr              = 0x00002E0C,
+			.header_cfg               = 0x00002E10,
+			.image_addr               = 0x00002E14,
+			.image_addr_offset        = 0x00002E18,
+			.buffer_width_cfg         = 0x00002E1C,
+			.buffer_height_cfg        = 0x00002E20,
+			.packer_cfg               = 0x00002E24,
+			.stride                   = 0x00002E28,
+			.irq_subsample_period     = 0x00002E48,
+			.irq_subsample_pattern    = 0x00002E4C,
+			.framedrop_period         = 0x00002E50,
+			.framedrop_pattern        = 0x00002E54,
+			.frame_inc                = 0x00002E58,
+			.burst_limit              = 0x00002E5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 */
+		{
+			.status0                  = 0x00002F00,
+			.status1                  = 0x00002F04,
+			.cfg                      = 0x00002F08,
+			.header_addr              = 0x00002F0C,
+			.header_cfg               = 0x00002F10,
+			.image_addr               = 0x00002F14,
+			.image_addr_offset        = 0x00002F18,
+			.buffer_width_cfg         = 0x00002F1C,
+			.buffer_height_cfg        = 0x00002F20,
+			.packer_cfg               = 0x00002F24,
+			.stride                   = 0x00002F28,
+			.irq_subsample_period     = 0x00002F48,
+			.irq_subsample_pattern    = 0x00002F4C,
+			.framedrop_period         = 0x00002F50,
+			.framedrop_pattern        = 0x00002F54,
+			.frame_inc                = 0x00002F58,
+			.burst_limit              = 0x00002F5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 */
+		{
+			.status0                  = 0x00003000,
+			.status1                  = 0x00003004,
+			.cfg                      = 0x00003008,
+			.header_addr              = 0x0000300C,
+			.header_cfg               = 0x00003010,
+			.image_addr               = 0x00003014,
+			.image_addr_offset        = 0x00003018,
+			.buffer_width_cfg         = 0x0000301C,
+			.buffer_height_cfg        = 0x00003020,
+			.packer_cfg               = 0x00003024,
+			.stride                   = 0x00003028,
+			.irq_subsample_period     = 0x00003048,
+			.irq_subsample_pattern    = 0x0000304C,
+			.framedrop_period         = 0x00003050,
+			.framedrop_pattern        = 0x00003054,
+			.frame_inc                = 0x00003058,
+			.burst_limit              = 0x0000305C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 */
+		{
+			.status0                  = 0x00003100,
+			.status1                  = 0x00003104,
+			.cfg                      = 0x00003108,
+			.header_addr              = 0x0000310C,
+			.header_cfg               = 0x00003110,
+			.image_addr               = 0x00003114,
+			.image_addr_offset        = 0x00003118,
+			.buffer_width_cfg         = 0x0000311C,
+			.buffer_height_cfg        = 0x00003120,
+			.packer_cfg               = 0x00003124,
+			.stride                   = 0x00003128,
+			.irq_subsample_period     = 0x00003148,
+			.irq_subsample_pattern    = 0x0000314C,
+			.framedrop_period         = 0x00003150,
+			.framedrop_pattern        = 0x00003154,
+			.frame_inc                = 0x00003158,
+			.burst_limit              = 0x0000315C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 */
+		{
+			.status0                  = 0x00003200,
+			.status1                  = 0x00003204,
+			.cfg                      = 0x00003208,
+			.header_addr              = 0x0000320C,
+			.header_cfg               = 0x00003210,
+			.image_addr               = 0x00003214,
+			.image_addr_offset        = 0x00003218,
+			.buffer_width_cfg         = 0x0000321C,
+			.buffer_height_cfg        = 0x00003220,
+			.packer_cfg               = 0x00003224,
+			.stride                   = 0x00003228,
+			.irq_subsample_period     = 0x00003248,
+			.irq_subsample_pattern    = 0x0000324C,
+			.framedrop_period         = 0x00003250,
+			.framedrop_pattern        = 0x00003254,
+			.frame_inc                = 0x00003258,
+			.burst_limit              = 0x0000325C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 */
+		{
+			.status0                  = 0x00003300,
+			.status1                  = 0x00003304,
+			.cfg                      = 0x00003308,
+			.header_addr              = 0x0000330C,
+			.header_cfg               = 0x00003310,
+			.image_addr               = 0x00003314,
+			.image_addr_offset        = 0x00003318,
+			.buffer_width_cfg         = 0x0000331C,
+			.buffer_height_cfg        = 0x00003320,
+			.packer_cfg               = 0x00003324,
+			.stride                   = 0x00003328,
+			.irq_subsample_period     = 0x00003348,
+			.irq_subsample_pattern    = 0x0000334C,
+			.framedrop_period         = 0x00003350,
+			.framedrop_pattern        = 0x00003354,
+			.frame_inc                = 0x00003358,
+			.burst_limit              = 0x0000335C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 */
+		{
+			.status0                  = 0x00003400,
+			.status1                  = 0x00003404,
+			.cfg                      = 0x00003408,
+			.header_addr              = 0x0000340C,
+			.header_cfg               = 0x00003410,
+			.image_addr               = 0x00003414,
+			.image_addr_offset        = 0x00003418,
+			.buffer_width_cfg         = 0x0000341C,
+			.buffer_height_cfg        = 0x00003420,
+			.packer_cfg               = 0x00003424,
+			.stride                   = 0x00003428,
+			.irq_subsample_period     = 0x00003448,
+			.irq_subsample_pattern    = 0x0000344C,
+			.framedrop_period         = 0x00003450,
+			.framedrop_pattern        = 0x00003454,
+			.frame_inc                = 0x00003458,
+			.burst_limit              = 0x0000345C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 */
+		{
+			.status0                  = 0x00003500,
+			.status1                  = 0x00003504,
+			.cfg                      = 0x00003508,
+			.header_addr              = 0x0000350C,
+			.header_cfg               = 0x00003510,
+			.image_addr               = 0x00003514,
+			.image_addr_offset        = 0x00003518,
+			.buffer_width_cfg         = 0x0000351C,
+			.buffer_height_cfg        = 0x00003520,
+			.packer_cfg               = 0x00003524,
+			.stride                   = 0x00003528,
+			.irq_subsample_period     = 0x00003548,
+			.irq_subsample_pattern    = 0x0000354C,
+			.framedrop_period         = 0x00003550,
+			.framedrop_pattern        = 0x00003554,
+			.frame_inc                = 0x00003558,
+			.burst_limit              = 0x0000355C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 18,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 19,
+};
+
+static struct cam_vfe_hw_info cam_vfe170_150_hw_info = {
+	.irq_reg_info                  = &vfe170_150_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe170_150_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe170_150_top_hw_info,
+
+	.camif_version                 = CAM_VFE_CAMIF_VER_2_0,
+	.camif_reg                     = &vfe170_150_camif_reg,
+
+	.camif_lite_version            = 0,
+	.camif_lite_reg                = NULL,
+
+};
+
+#endif /* _CAM_vfe170_150_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175.h
@@ -0,0 +1,1049 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE175_H_
+#define _CAM_VFE175_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_camif_lite_ver2.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe175_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe175_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe175_top_irq_reg_set,
+	.global_clear_offset  = 0x00000058,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_camif_ver2_reg vfe175_camif_reg = {
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+};
+
+static struct cam_vfe_camif_reg_data vfe_175_camif_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0xEFFF7E80,
+	.subscribe_irq_mask0             = 0x00000017,
+	.subscribe_irq_mask1             = 0x00000000,
+	.enable_diagnostic_hw            = 0x1,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg vfe175_camif_lite_reg = {
+	.camif_lite_cmd                = 0x00000FC0,
+	.camif_lite_config             = 0x00000FC4,
+	.lite_skip_period              = 0x00000FC8,
+	.lite_irq_subsample_pattern    = 0x00000FCC,
+	.lite_epoch_irq                = 0x00000FD0,
+	.reg_update_cmd                = 0x000004AC,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg_data vfe175_camif_lite_reg_data = {
+	.dual_pd_reg_update_cmd_data     = 0x20,
+	.lite_epoch_line_cfg             = 0x00140014,
+	.lite_sof_irq_mask               = 0x00040000,
+	.lite_epoch0_irq_mask            = 0x00100000,
+	.dual_pd_reg_upd_irq_mask        = 0x04000000,
+	.lite_eof_irq_mask               = 0x00080000,
+	.lite_err_irq_mask0              = 0x00400000,
+	.lite_err_irq_mask1              = 0x00004100,
+	.lite_subscribe_irq_mask0        = 0x001C0000,
+	.lite_subscribe_irq_mask1        = 0x0,
+	.extern_reg_update_shift         = 4,
+	.dual_pd_path_sel_shift          = 24,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_175_reg = {
+	.reset    = 0x0000001C,
+	.cgc_ovd  = 0x0000002C,
+	.enable   = 0x00000040,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl stats_175_reg = {
+	.reset    = 0x00000020,
+	.cgc_ovd  = 0x00000030,
+	.enable   = 0x00000044,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl color_175_reg = {
+	.reset    = 0x00000024,
+	.cgc_ovd  = 0x00000034,
+	.enable   = 0x00000048,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl zoom_175_reg = {
+	.reset    = 0x00000028,
+	.cgc_ovd  = 0x00000038,
+	.enable   = 0x0000004C,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe175_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		&lens_175_reg,
+		&stats_175_reg,
+		&color_175_reg,
+		&zoom_175_reg,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000050,
+	.three_D_cfg              = 0x00000054,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe175_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_common_reg_data vfe175_rdi_reg_data = {
+	.subscribe_irq_mask0      = 0x780001E0,
+	.subscribe_irq_mask1      = 0x0,
+	.error_irq_mask0          = 0x0,
+	.error_irq_mask1          = 0x3C,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+struct cam_vfe_top_dump_data vfe175_dump_data = {
+	.num_reg_dump_entries  =  2,
+	.num_lut_dump_entries  =  1,
+	.dmi_cfg               =  0xc24,
+	.dmi_addr              =  0xc28,
+	.dmi_data_path_hi      =  0xc2C,
+	.dmi_data_path_lo      =  0xc30,
+	.reg_entry = {
+		{
+			.reg_dump_start = 0x0,
+			.reg_dump_end   = 0x1164,
+		},
+		{
+			.reg_dump_start = 0x2000,
+			.reg_dump_end   = 0x397C,
+		},
+	},
+	.lut_entry = {
+		{
+			.lut_word_size = 64,
+			.lut_bank_sel  = 0x40,
+			.lut_addr_size = 180,
+		},
+	},
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe175_top_hw_info = {
+	.common_reg = &vfe175_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe175_top_common_reg,
+		.camif_reg      = &vfe175_camif_reg,
+		.reg_data       = &vfe_175_camif_reg_data,
+		},
+	.camif_lite_hw_info = {
+		.common_reg     = &vfe175_top_common_reg,
+		.camif_lite_reg = &vfe175_camif_lite_reg,
+		.reg_data       = &vfe175_camif_lite_reg_data,
+		},
+	.rdi_hw_info = {
+		.common_reg      = &vfe175_top_common_reg,
+		.rdi_reg         = &vfe175_rdi_reg,
+		.common_reg_data = &vfe175_rdi_reg_data,
+		.reg_data = {
+			&vfe_175_rdi_0_data,
+			&vfe_175_rdi_1_data,
+			&vfe_175_rdi_2_data,
+			NULL,
+			},
+		},
+	.num_mux = 5,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_2_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_CAMIF_LITE_VER_2_0,
+	},
+	.dump_data = &vfe175_dump_data,
+};
+
+static struct cam_irq_register_set vfe175_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_ubwc_regs_client_3 = {
+	.tile_cfg         = 0x0000252C,
+	.h_init           = 0x00002530,
+	.v_init           = 0x00002534,
+	.meta_addr        = 0x00002538,
+	.meta_offset      = 0x0000253C,
+	.meta_stride      = 0x00002540,
+	.mode_cfg_0       = 0x00002544,
+	.mode_cfg_1       = 0x000025A4,
+	.bw_limit         = 0x000025A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_ubwc_regs_client_4 = {
+	.tile_cfg         = 0x0000262C,
+	.h_init           = 0x00002630,
+	.v_init           = 0x00002634,
+	.meta_addr        = 0x00002638,
+	.meta_offset      = 0x0000263C,
+	.meta_stride      = 0x00002640,
+	.mode_cfg_0       = 0x00002644,
+	.mode_cfg_1       = 0x000026A4,
+	.bw_limit         = 0x000026A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_ubwc_regs_client_20 = {
+	.tile_cfg         = 0x0000362C,
+	.h_init           = 0x00003630,
+	.v_init           = 0x00003634,
+	.meta_addr        = 0x00003638,
+	.meta_offset      = 0x0000363C,
+	.meta_stride      = 0x00003640,
+	.mode_cfg_0       = 0x00003644,
+	.mode_cfg_1       = 0x000036A4,
+	.bw_limit         = 0x000036A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_ubwc_regs_client_21 = {
+	.tile_cfg         = 0x0000372C,
+	.h_init           = 0x00003730,
+	.v_init           = 0x00003734,
+	.meta_addr        = 0x00003738,
+	.meta_offset      = 0x0000373C,
+	.meta_stride      = 0x00003740,
+	.mode_cfg_0       = 0x00003744,
+	.mode_cfg_1       = 0x000037A4,
+	.bw_limit         = 0x000037A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe175_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers        = 3,
+			.irq_reg_set          = vfe175_bus_irq_reg,
+			.global_clear_offset  = 0x00002068,
+			.global_clear_bitmask = 0x00000001,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 24,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                = &vfe175_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 */
+		{
+			.status0                  = 0x00002600,
+			.status1                  = 0x00002604,
+			.cfg                      = 0x00002608,
+			.header_addr              = 0x0000260C,
+			.header_cfg               = 0x00002610,
+			.image_addr               = 0x00002614,
+			.image_addr_offset        = 0x00002618,
+			.buffer_width_cfg         = 0x0000261C,
+			.buffer_height_cfg        = 0x00002620,
+			.packer_cfg               = 0x00002624,
+			.stride                   = 0x00002628,
+			.irq_subsample_period     = 0x00002648,
+			.irq_subsample_pattern    = 0x0000264C,
+			.framedrop_period         = 0x00002650,
+			.framedrop_pattern        = 0x00002654,
+			.frame_inc                = 0x00002658,
+			.burst_limit              = 0x0000265C,
+			.ubwc_regs                = &vfe175_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 */
+		{
+			.status0                  = 0x00002700,
+			.status1                  = 0x00002704,
+			.cfg                      = 0x00002708,
+			.header_addr              = 0x0000270C,
+			.header_cfg               = 0x00002710,
+			.image_addr               = 0x00002714,
+			.image_addr_offset        = 0x00002718,
+			.buffer_width_cfg         = 0x0000271C,
+			.buffer_height_cfg        = 0x00002720,
+			.packer_cfg               = 0x00002724,
+			.stride                   = 0x00002728,
+			.irq_subsample_period     = 0x00002748,
+			.irq_subsample_pattern    = 0x0000274C,
+			.framedrop_period         = 0x00002750,
+			.framedrop_pattern        = 0x00002754,
+			.frame_inc                = 0x00002758,
+			.burst_limit              = 0x0000275C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 */
+		{
+			.status0                  = 0x00002800,
+			.status1                  = 0x00002804,
+			.cfg                      = 0x00002808,
+			.header_addr              = 0x0000280C,
+			.header_cfg               = 0x00002810,
+			.image_addr               = 0x00002814,
+			.image_addr_offset        = 0x00002818,
+			.buffer_width_cfg         = 0x0000281C,
+			.buffer_height_cfg        = 0x00002820,
+			.packer_cfg               = 0x00002824,
+			.stride                   = 0x00002828,
+			.irq_subsample_period     = 0x00002848,
+			.irq_subsample_pattern    = 0x0000284C,
+			.framedrop_period         = 0x00002850,
+			.framedrop_pattern        = 0x00002854,
+			.frame_inc                = 0x00002858,
+			.burst_limit              = 0x0000285C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 */
+		{
+			.status0                  = 0x00002900,
+			.status1                  = 0x00002904,
+			.cfg                      = 0x00002908,
+			.header_addr              = 0x0000290C,
+			.header_cfg               = 0x00002910,
+			.image_addr               = 0x00002914,
+			.image_addr_offset        = 0x00002918,
+			.buffer_width_cfg         = 0x0000291C,
+			.buffer_height_cfg        = 0x00002920,
+			.packer_cfg               = 0x00002924,
+			.stride                   = 0x00002928,
+			.irq_subsample_period     = 0x00002948,
+			.irq_subsample_pattern    = 0x0000294C,
+			.framedrop_period         = 0x00002950,
+			.framedrop_pattern        = 0x00002954,
+			.frame_inc                = 0x00002958,
+			.burst_limit              = 0x0000295C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 */
+		{
+			.status0                  = 0x00002A00,
+			.status1                  = 0x00002A04,
+			.cfg                      = 0x00002A08,
+			.header_addr              = 0x00002A0C,
+			.header_cfg               = 0x00002A10,
+			.image_addr               = 0x00002A14,
+			.image_addr_offset        = 0x00002A18,
+			.buffer_width_cfg         = 0x00002A1C,
+			.buffer_height_cfg        = 0x00002A20,
+			.packer_cfg               = 0x00002A24,
+			.stride                   = 0x00002A28,
+			.irq_subsample_period     = 0x00002A48,
+			.irq_subsample_pattern    = 0x00002A4C,
+			.framedrop_period         = 0x00002A50,
+			.framedrop_pattern        = 0x00002A54,
+			.frame_inc                = 0x00002A58,
+			.burst_limit              = 0x00002A5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 */
+		{
+			.status0                  = 0x00002B00,
+			.status1                  = 0x00002B04,
+			.cfg                      = 0x00002B08,
+			.header_addr              = 0x00002B0C,
+			.header_cfg               = 0x00002B10,
+			.image_addr               = 0x00002B14,
+			.image_addr_offset        = 0x00002B18,
+			.buffer_width_cfg         = 0x00002B1C,
+			.buffer_height_cfg        = 0x00002B20,
+			.packer_cfg               = 0x00002B24,
+			.stride                   = 0x00002B28,
+			.irq_subsample_period     = 0x00002B48,
+			.irq_subsample_pattern    = 0x00002B4C,
+			.framedrop_period         = 0x00002B50,
+			.framedrop_pattern        = 0x00002B54,
+			.frame_inc                = 0x00002B58,
+			.burst_limit              = 0x00002B5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 */
+		{
+			.status0                  = 0x00002C00,
+			.status1                  = 0x00002C04,
+			.cfg                      = 0x00002C08,
+			.header_addr              = 0x00002C0C,
+			.header_cfg               = 0x00002C10,
+			.image_addr               = 0x00002C14,
+			.image_addr_offset        = 0x00002C18,
+			.buffer_width_cfg         = 0x00002C1C,
+			.buffer_height_cfg        = 0x00002C20,
+			.packer_cfg               = 0x00002C24,
+			.stride                   = 0x00002C28,
+			.irq_subsample_period     = 0x00002C48,
+			.irq_subsample_pattern    = 0x00002C4C,
+			.framedrop_period         = 0x00002C50,
+			.framedrop_pattern        = 0x00002C54,
+			.frame_inc                = 0x00002C58,
+			.burst_limit              = 0x00002C5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 */
+		{
+			.status0                  = 0x00002D00,
+			.status1                  = 0x00002D04,
+			.cfg                      = 0x00002D08,
+			.header_addr              = 0x00002D0C,
+			.header_cfg               = 0x00002D10,
+			.image_addr               = 0x00002D14,
+			.image_addr_offset        = 0x00002D18,
+			.buffer_width_cfg         = 0x00002D1C,
+			.buffer_height_cfg        = 0x00002D20,
+			.packer_cfg               = 0x00002D24,
+			.stride                   = 0x00002D28,
+			.irq_subsample_period     = 0x00002D48,
+			.irq_subsample_pattern    = 0x00002D4C,
+			.framedrop_period         = 0x00002D50,
+			.framedrop_pattern        = 0x00002D54,
+			.frame_inc                = 0x00002D58,
+			.burst_limit              = 0x00002D5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 */
+		{
+			.status0                  = 0x00002E00,
+			.status1                  = 0x00002E04,
+			.cfg                      = 0x00002E08,
+			.header_addr              = 0x00002E0C,
+			.header_cfg               = 0x00002E10,
+			.image_addr               = 0x00002E14,
+			.image_addr_offset        = 0x00002E18,
+			.buffer_width_cfg         = 0x00002E1C,
+			.buffer_height_cfg        = 0x00002E20,
+			.packer_cfg               = 0x00002E24,
+			.stride                   = 0x00002E28,
+			.irq_subsample_period     = 0x00002E48,
+			.irq_subsample_pattern    = 0x00002E4C,
+			.framedrop_period         = 0x00002E50,
+			.framedrop_pattern        = 0x00002E54,
+			.frame_inc                = 0x00002E58,
+			.burst_limit              = 0x00002E5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 */
+		{
+			.status0                  = 0x00002F00,
+			.status1                  = 0x00002F04,
+			.cfg                      = 0x00002F08,
+			.header_addr              = 0x00002F0C,
+			.header_cfg               = 0x00002F10,
+			.image_addr               = 0x00002F14,
+			.image_addr_offset        = 0x00002F18,
+			.buffer_width_cfg         = 0x00002F1C,
+			.buffer_height_cfg        = 0x00002F20,
+			.packer_cfg               = 0x00002F24,
+			.stride                   = 0x00002F28,
+			.irq_subsample_period     = 0x00002F48,
+			.irq_subsample_pattern    = 0x00002F4C,
+			.framedrop_period         = 0x00002F50,
+			.framedrop_pattern        = 0x00002F54,
+			.frame_inc                = 0x00002F58,
+			.burst_limit              = 0x00002F5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 */
+		{
+			.status0                  = 0x00003000,
+			.status1                  = 0x00003004,
+			.cfg                      = 0x00003008,
+			.header_addr              = 0x0000300C,
+			.header_cfg               = 0x00003010,
+			.image_addr               = 0x00003014,
+			.image_addr_offset        = 0x00003018,
+			.buffer_width_cfg         = 0x0000301C,
+			.buffer_height_cfg        = 0x00003020,
+			.packer_cfg               = 0x00003024,
+			.stride                   = 0x00003028,
+			.irq_subsample_period     = 0x00003048,
+			.irq_subsample_pattern    = 0x0000304C,
+			.framedrop_period         = 0x00003050,
+			.framedrop_pattern        = 0x00003054,
+			.frame_inc                = 0x00003058,
+			.burst_limit              = 0x0000305C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 */
+		{
+			.status0                  = 0x00003100,
+			.status1                  = 0x00003104,
+			.cfg                      = 0x00003108,
+			.header_addr              = 0x0000310C,
+			.header_cfg               = 0x00003110,
+			.image_addr               = 0x00003114,
+			.image_addr_offset        = 0x00003118,
+			.buffer_width_cfg         = 0x0000311C,
+			.buffer_height_cfg        = 0x00003120,
+			.packer_cfg               = 0x00003124,
+			.stride                   = 0x00003128,
+			.irq_subsample_period     = 0x00003148,
+			.irq_subsample_pattern    = 0x0000314C,
+			.framedrop_period         = 0x00003150,
+			.framedrop_pattern        = 0x00003154,
+			.frame_inc                = 0x00003158,
+			.burst_limit              = 0x0000315C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 */
+		{
+			.status0                  = 0x00003200,
+			.status1                  = 0x00003204,
+			.cfg                      = 0x00003208,
+			.header_addr              = 0x0000320C,
+			.header_cfg               = 0x00003210,
+			.image_addr               = 0x00003214,
+			.image_addr_offset        = 0x00003218,
+			.buffer_width_cfg         = 0x0000321C,
+			.buffer_height_cfg        = 0x00003220,
+			.packer_cfg               = 0x00003224,
+			.stride                   = 0x00003228,
+			.irq_subsample_period     = 0x00003248,
+			.irq_subsample_pattern    = 0x0000324C,
+			.framedrop_period         = 0x00003250,
+			.framedrop_pattern        = 0x00003254,
+			.frame_inc                = 0x00003258,
+			.burst_limit              = 0x0000325C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 */
+		{
+			.status0                  = 0x00003300,
+			.status1                  = 0x00003304,
+			.cfg                      = 0x00003308,
+			.header_addr              = 0x0000330C,
+			.header_cfg               = 0x00003310,
+			.image_addr               = 0x00003314,
+			.image_addr_offset        = 0x00003318,
+			.buffer_width_cfg         = 0x0000331C,
+			.buffer_height_cfg        = 0x00003320,
+			.packer_cfg               = 0x00003324,
+			.stride                   = 0x00003328,
+			.irq_subsample_period     = 0x00003348,
+			.irq_subsample_pattern    = 0x0000334C,
+			.framedrop_period         = 0x00003350,
+			.framedrop_pattern        = 0x00003354,
+			.frame_inc                = 0x00003358,
+			.burst_limit              = 0x0000335C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 */
+		{
+			.status0                  = 0x00003400,
+			.status1                  = 0x00003404,
+			.cfg                      = 0x00003408,
+			.header_addr              = 0x0000340C,
+			.header_cfg               = 0x00003410,
+			.image_addr               = 0x00003414,
+			.image_addr_offset        = 0x00003418,
+			.buffer_width_cfg         = 0x0000341C,
+			.buffer_height_cfg        = 0x00003420,
+			.packer_cfg               = 0x00003424,
+			.stride                   = 0x00003428,
+			.irq_subsample_period     = 0x00003448,
+			.irq_subsample_pattern    = 0x0000344C,
+			.framedrop_period         = 0x00003450,
+			.framedrop_pattern        = 0x00003454,
+			.frame_inc                = 0x00003458,
+			.burst_limit              = 0x0000345C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 */
+		{
+			.status0                  = 0x00003500,
+			.status1                  = 0x00003504,
+			.cfg                      = 0x00003508,
+			.header_addr              = 0x0000350C,
+			.header_cfg               = 0x00003510,
+			.image_addr               = 0x00003514,
+			.image_addr_offset        = 0x00003518,
+			.buffer_width_cfg         = 0x0000351C,
+			.buffer_height_cfg        = 0x00003520,
+			.packer_cfg               = 0x00003524,
+			.stride                   = 0x00003528,
+			.irq_subsample_period     = 0x00003548,
+			.irq_subsample_pattern    = 0x0000354C,
+			.framedrop_period         = 0x00003550,
+			.framedrop_pattern        = 0x00003554,
+			.frame_inc                = 0x00003558,
+			.burst_limit              = 0x0000355C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 */
+		{
+			.status0                  = 0x00003600,
+			.status1                  = 0x00003604,
+			.cfg                      = 0x00003608,
+			.header_addr              = 0x0000360C,
+			.header_cfg               = 0x00003610,
+			.image_addr               = 0x00003614,
+			.image_addr_offset        = 0x00003618,
+			.buffer_width_cfg         = 0x0000361C,
+			.buffer_height_cfg        = 0x00003620,
+			.packer_cfg               = 0x00003624,
+			.stride                   = 0x00003628,
+			.irq_subsample_period     = 0x00003648,
+			.irq_subsample_pattern    = 0x0000364C,
+			.framedrop_period         = 0x00003650,
+			.framedrop_pattern        = 0x00003654,
+			.frame_inc                = 0x00003658,
+			.burst_limit              = 0x0000365C,
+			.ubwc_regs                = &vfe175_ubwc_regs_client_20,
+		},
+		/* BUS Client 21 */
+		{
+			.status0                  = 0x00003700,
+			.status1                  = 0x00003704,
+			.cfg                      = 0x00003708,
+			.header_addr              = 0x0000370C,
+			.header_cfg               = 0x00003710,
+			.image_addr               = 0x00003714,
+			.image_addr_offset        = 0x00003718,
+			.buffer_width_cfg         = 0x0000371C,
+			.buffer_height_cfg        = 0x00003720,
+			.packer_cfg               = 0x00003724,
+			.stride                   = 0x00003728,
+			.irq_subsample_period     = 0x00003748,
+			.irq_subsample_pattern    = 0x0000374C,
+			.framedrop_period         = 0x00003750,
+			.framedrop_pattern        = 0x00003754,
+			.frame_inc                = 0x00003758,
+			.burst_limit              = 0x0000375C,
+			.ubwc_regs                = &vfe175_ubwc_regs_client_21,
+		},
+		/* BUS Client 22 */
+		{
+			.status0                  = 0x00003800,
+			.status1                  = 0x00003804,
+			.cfg                      = 0x00003808,
+			.header_addr              = 0x0000380C,
+			.header_cfg               = 0x00003810,
+			.image_addr               = 0x00003814,
+			.image_addr_offset        = 0x00003818,
+			.buffer_width_cfg         = 0x0000381C,
+			.buffer_height_cfg        = 0x00003820,
+			.packer_cfg               = 0x00003824,
+			.stride                   = 0x00003828,
+			.irq_subsample_period     = 0x00003848,
+			.irq_subsample_pattern    = 0x0000384C,
+			.framedrop_period         = 0x00003850,
+			.framedrop_pattern        = 0x00003854,
+			.frame_inc                = 0x00003858,
+			.burst_limit              = 0x0000385C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 */
+		{
+			.status0                  = 0x00003900,
+			.status1                  = 0x00003904,
+			.cfg                      = 0x00003908,
+			.header_addr              = 0x0000390C,
+			.header_cfg               = 0x00003910,
+			.image_addr               = 0x00003914,
+			.image_addr_offset        = 0x00003918,
+			.buffer_width_cfg         = 0x0000391C,
+			.buffer_height_cfg        = 0x00003920,
+			.packer_cfg               = 0x00003924,
+			.stride                   = 0x00003928,
+			.irq_subsample_period     = 0x00003948,
+			.irq_subsample_pattern    = 0x0000394C,
+			.framedrop_period         = 0x00003950,
+			.framedrop_pattern        = 0x00003954,
+			.frame_inc                = 0x00003958,
+			.burst_limit              = 0x0000395C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 22,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 23,
+};
+
+static struct cam_vfe_hw_info cam_vfe175_hw_info = {
+	.irq_reg_info                  = &vfe175_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe175_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe175_top_hw_info,
+
+	.camif_version                 = CAM_VFE_CAMIF_VER_2_0,
+	.camif_reg                     = &vfe175_camif_reg,
+
+	.camif_lite_version            = CAM_VFE_CAMIF_LITE_VER_2_0,
+	.camif_lite_reg                = &vfe175_camif_lite_reg,
+
+};
+
+#endif /* _CAM_VFE175_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175_130.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe175_130.h
@@ -0,0 +1,1167 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE175_130_H_
+#define _CAM_VFE175_130_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_camif_lite_ver2.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_vfe_bus_rd_ver1.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe175_130_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_vfe_rdi_overflow_status vfe175_130_rdi_irq_status = {
+	.rdi0_overflow_mask = 0x8,
+	.rdi1_overflow_mask = 0x10,
+	.rdi2_overflow_mask = 0x18,
+	.rdi3_overflow_mask = 0x20,
+	.rdi_overflow_mask  = 0x3c,
+};
+
+static struct cam_irq_controller_reg_info vfe175_130_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe175_130_top_irq_reg_set,
+	.global_clear_offset  = 0x00000058,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_camif_ver2_reg vfe175_130_camif_reg = {
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+};
+
+static struct cam_vfe_camif_reg_data vfe_175_130_camif_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0xEFFF7E80,
+	.subscribe_irq_mask0             = 0x00000017,
+	.subscribe_irq_mask1             = 0x00000000,
+	.enable_diagnostic_hw            = 0x1,
+};
+
+static struct cam_vfe_fe_ver1_reg vfe175_130_fe_reg = {
+	.camif_cmd                = 0x00000478,
+	.camif_config             = 0x0000047C,
+	.line_skip_pattern        = 0x00000488,
+	.pixel_skip_pattern       = 0x0000048C,
+	.skip_period              = 0x00000490,
+	.irq_subsample_pattern    = 0x0000049C,
+	.epoch_irq                = 0x000004A0,
+	.raw_crop_width_cfg       = 0x00000CE4,
+	.raw_crop_height_cfg      = 0x00000CE8,
+	.reg_update_cmd           = 0x000004AC,
+	.vfe_diag_config          = 0x00000C48,
+	.vfe_diag_sensor_status   = 0x00000C4C,
+	.fe_cfg                   = 0x00000084,
+};
+
+static struct cam_vfe_fe_reg_data vfe_175_130_fe_reg_data = {
+	.raw_crop_first_pixel_shift      = 16,
+	.raw_crop_first_pixel_mask       = 0xFFFF,
+	.raw_crop_last_pixel_shift       = 0x0,
+	.raw_crop_last_pixel_mask        = 0x3FFF,
+	.raw_crop_first_line_shift       = 16,
+	.raw_crop_first_line_mask        = 0xFFFF,
+	.raw_crop_last_line_shift        = 0,
+	.raw_crop_last_line_mask         = 0x3FFF,
+	.input_mux_sel_shift             = 5,
+	.input_mux_sel_mask              = 0x3,
+	.extern_reg_update_shift         = 4,
+	.extern_reg_update_mask          = 1,
+	.pixel_pattern_shift             = 0,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 23,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 3,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x1,
+	.epoch_line_cfg                  = 0x00140014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x0003FC00,
+	.error_irq_mask1                 = 0xEFFF7E80,
+	.enable_diagnostic_hw            = 0x1,
+	.fe_mux_data                     = 0x2,
+	.hbi_cnt_shift                   = 0x8,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg vfe175_130_camif_lite_reg = {
+	.camif_lite_cmd                = 0x00000FC0,
+	.camif_lite_config             = 0x00000FC4,
+	.lite_skip_period              = 0x00000FC8,
+	.lite_irq_subsample_pattern    = 0x00000FCC,
+	.lite_epoch_irq                = 0x00000FD0,
+	.reg_update_cmd                = 0x000004AC,
+};
+
+static struct cam_vfe_camif_lite_ver2_reg_data
+	vfe175_130_camif_lite_reg_data = {
+	.dual_pd_reg_update_cmd_data     = 0x20,
+	.lite_epoch_line_cfg             = 0x00140014,
+	.lite_sof_irq_mask               = 0x00040000,
+	.lite_epoch0_irq_mask            = 0x00100000,
+	.dual_pd_reg_upd_irq_mask        = 0x04000000,
+	.lite_eof_irq_mask               = 0x00080000,
+	.lite_err_irq_mask0              = 0x00400000,
+	.lite_err_irq_mask1              = 0x00004100,
+	.extern_reg_update_shift         = 4,
+	.dual_pd_path_sel_shift          = 24,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_175_130_reg = {
+	.reset    = 0x0000001C,
+	.cgc_ovd  = 0x0000002C,
+	.enable   = 0x00000040,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl stats_175_130_reg = {
+	.reset    = 0x00000020,
+	.cgc_ovd  = 0x00000030,
+	.enable   = 0x00000044,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl color_175_130_reg = {
+	.reset    = 0x00000024,
+	.cgc_ovd  = 0x00000034,
+	.enable   = 0x00000048,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_module_ctrl zoom_175_130_reg = {
+	.reset    = 0x00000028,
+	.cgc_ovd  = 0x00000038,
+	.enable   = 0x0000004C,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe175_130_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		&lens_175_130_reg,
+		&stats_175_130_reg,
+		&color_175_130_reg,
+		&zoom_175_130_reg,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000050,
+	.three_D_cfg              = 0x00000054,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe175_130_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_common_reg_data vfe175_130_rdi_reg_data = {
+	.subscribe_irq_mask0      = 0x780001E0,
+	.subscribe_irq_mask1      = 0x0,
+	.error_irq_mask0          = 0x0,
+	.error_irq_mask1          = 0x3C,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_130_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_130_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe_175_130_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+struct cam_vfe_top_dump_data vfe175_130_dump_data = {
+	.num_reg_dump_entries  =  2,
+	.num_lut_dump_entries  =  1,
+	.dmi_cfg               =  0xc24,
+	.dmi_addr              =  0xc28,
+	.dmi_data_path_hi      =  0xc2C,
+	.dmi_data_path_lo      =  0xc30,
+	.reg_entry = {
+		{
+			.reg_dump_start = 0x0,
+			.reg_dump_end   = 0x1164,
+		},
+		{
+			.reg_dump_start = 0x2000,
+			.reg_dump_end   = 0x397C,
+		},
+	},
+	.lut_entry = {
+		{
+			.lut_word_size = 64,
+			.lut_bank_sel  = 0x40,
+			.lut_addr_size = 180,
+		},
+	},
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe175_130_top_hw_info = {
+	.common_reg = &vfe175_130_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe175_130_top_common_reg,
+		.camif_reg      = &vfe175_130_camif_reg,
+		.reg_data       = &vfe_175_130_camif_reg_data,
+		},
+	.camif_lite_hw_info = {
+		.common_reg     = &vfe175_130_top_common_reg,
+		.camif_lite_reg = &vfe175_130_camif_lite_reg,
+		.reg_data       = &vfe175_130_camif_lite_reg_data,
+		},
+	.rdi_hw_info = {
+		.common_reg      = &vfe175_130_top_common_reg,
+		.rdi_reg         = &vfe175_130_rdi_reg,
+		.common_reg_data = &vfe175_130_rdi_reg_data,
+		.rdi_irq_status  = &vfe175_130_rdi_irq_status,
+		.reg_data = {
+			&vfe_175_130_rdi_0_data,
+			&vfe_175_130_rdi_1_data,
+			&vfe_175_130_rdi_2_data,
+			NULL,
+			},
+		},
+	.fe_hw_info = {
+		.common_reg     = &vfe175_130_top_common_reg,
+		.fe_reg     = &vfe175_130_fe_reg,
+		.reg_data       = &vfe_175_130_fe_reg_data,
+		},
+	.num_mux = 6,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_2_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_CAMIF_LITE_VER_2_0,
+		CAM_VFE_IN_RD_VER_1_0,
+	},
+	.dump_data = &vfe175_130_dump_data,
+};
+
+static struct cam_irq_register_set vfe175_130_bus_rd_irq_reg[1] = {
+		{
+			.mask_reg_offset   = 0x00005010,
+			.clear_reg_offset  = 0x00005014,
+			.status_reg_offset = 0x0000501C,
+		},
+};
+
+static struct cam_irq_register_set vfe175_130_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_130_ubwc_regs_client_3 = {
+	.tile_cfg         = 0x0000252C,
+	.h_init           = 0x00002530,
+	.v_init           = 0x00002534,
+	.meta_addr        = 0x00002538,
+	.meta_offset      = 0x0000253C,
+	.meta_stride      = 0x00002540,
+	.mode_cfg_0       = 0x00002544,
+	.mode_cfg_1       = 0x000025A4,
+	.bw_limit         = 0x000025A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_130_ubwc_regs_client_4 = {
+	.tile_cfg         = 0x0000262C,
+	.h_init           = 0x00002630,
+	.v_init           = 0x00002634,
+	.meta_addr        = 0x00002638,
+	.meta_offset      = 0x0000263C,
+	.meta_stride      = 0x00002640,
+	.mode_cfg_0       = 0x00002644,
+	.mode_cfg_1       = 0x000026A4,
+	.bw_limit         = 0x000026A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_130_ubwc_regs_client_20 = {
+	.tile_cfg         = 0x0000362C,
+	.h_init           = 0x00003630,
+	.v_init           = 0x00003634,
+	.meta_addr        = 0x00003638,
+	.meta_offset      = 0x0000363C,
+	.meta_stride      = 0x00003640,
+	.mode_cfg_0       = 0x00003644,
+	.mode_cfg_1       = 0x000036A4,
+	.bw_limit         = 0x000036A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+	vfe175_130_ubwc_regs_client_21 = {
+	.tile_cfg         = 0x0000372C,
+	.h_init           = 0x00003730,
+	.v_init           = 0x00003734,
+	.meta_addr        = 0x00003738,
+	.meta_offset      = 0x0000373C,
+	.meta_stride      = 0x00003740,
+	.mode_cfg_0       = 0x00003744,
+	.mode_cfg_1       = 0x000037A4,
+	.bw_limit         = 0x000037A0,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_rd_ver1_hw_info vfe175_130_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00005000,
+		.hw_capability                = 0x00005004,
+		.sw_reset                     = 0x00005008,
+		.cgc_ovd                      = 0x0000500C,
+		.pwr_iso_cfg                  = 0x000050CC,
+		.input_if_cmd                 = 0x00005020,
+		.test_bus_ctrl                = 0x00005048,
+		.irq_reg_info = {
+			.num_registers        = 1,
+			.irq_reg_set          = vfe175_130_bus_rd_irq_reg,
+			.global_clear_offset  = 0x00005018,
+			.global_clear_bitmask = 0x00000001,
+		},
+	},
+	.num_client = 1,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x00005050,
+			.image_addr               = 0x00005058,
+			.buf_size                 = 0x0000505C,
+			.stride                   = 0x00005060,
+			.unpacker_cfg             = 0x00005064,
+			.latency_buf_allocation   = 0x00005078,
+			.burst_limit              = 0x00005080,
+		},
+	},
+	.num_bus_rd_resc = 1,
+	.vfe_bus_rd_hw_info = {
+		{
+			.vfe_bus_rd_type = CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 23,
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe175_130_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers        = 3,
+			.irq_reg_set          = vfe175_130_bus_irq_reg,
+			.global_clear_offset  = 0x00002068,
+			.global_clear_bitmask = 0x00000001,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 24,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                =
+				&vfe175_130_ubwc_regs_client_3,
+		},
+		/* BUS Client 4 */
+		{
+			.status0                  = 0x00002600,
+			.status1                  = 0x00002604,
+			.cfg                      = 0x00002608,
+			.header_addr              = 0x0000260C,
+			.header_cfg               = 0x00002610,
+			.image_addr               = 0x00002614,
+			.image_addr_offset        = 0x00002618,
+			.buffer_width_cfg         = 0x0000261C,
+			.buffer_height_cfg        = 0x00002620,
+			.packer_cfg               = 0x00002624,
+			.stride                   = 0x00002628,
+			.irq_subsample_period     = 0x00002648,
+			.irq_subsample_pattern    = 0x0000264C,
+			.framedrop_period         = 0x00002650,
+			.framedrop_pattern        = 0x00002654,
+			.frame_inc                = 0x00002658,
+			.burst_limit              = 0x0000265C,
+			.ubwc_regs                =
+				&vfe175_130_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 */
+		{
+			.status0                  = 0x00002700,
+			.status1                  = 0x00002704,
+			.cfg                      = 0x00002708,
+			.header_addr              = 0x0000270C,
+			.header_cfg               = 0x00002710,
+			.image_addr               = 0x00002714,
+			.image_addr_offset        = 0x00002718,
+			.buffer_width_cfg         = 0x0000271C,
+			.buffer_height_cfg        = 0x00002720,
+			.packer_cfg               = 0x00002724,
+			.stride                   = 0x00002728,
+			.irq_subsample_period     = 0x00002748,
+			.irq_subsample_pattern    = 0x0000274C,
+			.framedrop_period         = 0x00002750,
+			.framedrop_pattern        = 0x00002754,
+			.frame_inc                = 0x00002758,
+			.burst_limit              = 0x0000275C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 6 */
+		{
+			.status0                  = 0x00002800,
+			.status1                  = 0x00002804,
+			.cfg                      = 0x00002808,
+			.header_addr              = 0x0000280C,
+			.header_cfg               = 0x00002810,
+			.image_addr               = 0x00002814,
+			.image_addr_offset        = 0x00002818,
+			.buffer_width_cfg         = 0x0000281C,
+			.buffer_height_cfg        = 0x00002820,
+			.packer_cfg               = 0x00002824,
+			.stride                   = 0x00002828,
+			.irq_subsample_period     = 0x00002848,
+			.irq_subsample_pattern    = 0x0000284C,
+			.framedrop_period         = 0x00002850,
+			.framedrop_pattern        = 0x00002854,
+			.frame_inc                = 0x00002858,
+			.burst_limit              = 0x0000285C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 */
+		{
+			.status0                  = 0x00002900,
+			.status1                  = 0x00002904,
+			.cfg                      = 0x00002908,
+			.header_addr              = 0x0000290C,
+			.header_cfg               = 0x00002910,
+			.image_addr               = 0x00002914,
+			.image_addr_offset        = 0x00002918,
+			.buffer_width_cfg         = 0x0000291C,
+			.buffer_height_cfg        = 0x00002920,
+			.packer_cfg               = 0x00002924,
+			.stride                   = 0x00002928,
+			.irq_subsample_period     = 0x00002948,
+			.irq_subsample_pattern    = 0x0000294C,
+			.framedrop_period         = 0x00002950,
+			.framedrop_pattern        = 0x00002954,
+			.frame_inc                = 0x00002958,
+			.burst_limit              = 0x0000295C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 */
+		{
+			.status0                  = 0x00002A00,
+			.status1                  = 0x00002A04,
+			.cfg                      = 0x00002A08,
+			.header_addr              = 0x00002A0C,
+			.header_cfg               = 0x00002A10,
+			.image_addr               = 0x00002A14,
+			.image_addr_offset        = 0x00002A18,
+			.buffer_width_cfg         = 0x00002A1C,
+			.buffer_height_cfg        = 0x00002A20,
+			.packer_cfg               = 0x00002A24,
+			.stride                   = 0x00002A28,
+			.irq_subsample_period     = 0x00002A48,
+			.irq_subsample_pattern    = 0x00002A4C,
+			.framedrop_period         = 0x00002A50,
+			.framedrop_pattern        = 0x00002A54,
+			.frame_inc                = 0x00002A58,
+			.burst_limit              = 0x00002A5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 */
+		{
+			.status0                  = 0x00002B00,
+			.status1                  = 0x00002B04,
+			.cfg                      = 0x00002B08,
+			.header_addr              = 0x00002B0C,
+			.header_cfg               = 0x00002B10,
+			.image_addr               = 0x00002B14,
+			.image_addr_offset        = 0x00002B18,
+			.buffer_width_cfg         = 0x00002B1C,
+			.buffer_height_cfg        = 0x00002B20,
+			.packer_cfg               = 0x00002B24,
+			.stride                   = 0x00002B28,
+			.irq_subsample_period     = 0x00002B48,
+			.irq_subsample_pattern    = 0x00002B4C,
+			.framedrop_period         = 0x00002B50,
+			.framedrop_pattern        = 0x00002B54,
+			.frame_inc                = 0x00002B58,
+			.burst_limit              = 0x00002B5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 */
+		{
+			.status0                  = 0x00002C00,
+			.status1                  = 0x00002C04,
+			.cfg                      = 0x00002C08,
+			.header_addr              = 0x00002C0C,
+			.header_cfg               = 0x00002C10,
+			.image_addr               = 0x00002C14,
+			.image_addr_offset        = 0x00002C18,
+			.buffer_width_cfg         = 0x00002C1C,
+			.buffer_height_cfg        = 0x00002C20,
+			.packer_cfg               = 0x00002C24,
+			.stride                   = 0x00002C28,
+			.irq_subsample_period     = 0x00002C48,
+			.irq_subsample_pattern    = 0x00002C4C,
+			.framedrop_period         = 0x00002C50,
+			.framedrop_pattern        = 0x00002C54,
+			.frame_inc                = 0x00002C58,
+			.burst_limit              = 0x00002C5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 */
+		{
+			.status0                  = 0x00002D00,
+			.status1                  = 0x00002D04,
+			.cfg                      = 0x00002D08,
+			.header_addr              = 0x00002D0C,
+			.header_cfg               = 0x00002D10,
+			.image_addr               = 0x00002D14,
+			.image_addr_offset        = 0x00002D18,
+			.buffer_width_cfg         = 0x00002D1C,
+			.buffer_height_cfg        = 0x00002D20,
+			.packer_cfg               = 0x00002D24,
+			.stride                   = 0x00002D28,
+			.irq_subsample_period     = 0x00002D48,
+			.irq_subsample_pattern    = 0x00002D4C,
+			.framedrop_period         = 0x00002D50,
+			.framedrop_pattern        = 0x00002D54,
+			.frame_inc                = 0x00002D58,
+			.burst_limit              = 0x00002D5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 */
+		{
+			.status0                  = 0x00002E00,
+			.status1                  = 0x00002E04,
+			.cfg                      = 0x00002E08,
+			.header_addr              = 0x00002E0C,
+			.header_cfg               = 0x00002E10,
+			.image_addr               = 0x00002E14,
+			.image_addr_offset        = 0x00002E18,
+			.buffer_width_cfg         = 0x00002E1C,
+			.buffer_height_cfg        = 0x00002E20,
+			.packer_cfg               = 0x00002E24,
+			.stride                   = 0x00002E28,
+			.irq_subsample_period     = 0x00002E48,
+			.irq_subsample_pattern    = 0x00002E4C,
+			.framedrop_period         = 0x00002E50,
+			.framedrop_pattern        = 0x00002E54,
+			.frame_inc                = 0x00002E58,
+			.burst_limit              = 0x00002E5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 */
+		{
+			.status0                  = 0x00002F00,
+			.status1                  = 0x00002F04,
+			.cfg                      = 0x00002F08,
+			.header_addr              = 0x00002F0C,
+			.header_cfg               = 0x00002F10,
+			.image_addr               = 0x00002F14,
+			.image_addr_offset        = 0x00002F18,
+			.buffer_width_cfg         = 0x00002F1C,
+			.buffer_height_cfg        = 0x00002F20,
+			.packer_cfg               = 0x00002F24,
+			.stride                   = 0x00002F28,
+			.irq_subsample_period     = 0x00002F48,
+			.irq_subsample_pattern    = 0x00002F4C,
+			.framedrop_period         = 0x00002F50,
+			.framedrop_pattern        = 0x00002F54,
+			.frame_inc                = 0x00002F58,
+			.burst_limit              = 0x00002F5C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 */
+		{
+			.status0                  = 0x00003000,
+			.status1                  = 0x00003004,
+			.cfg                      = 0x00003008,
+			.header_addr              = 0x0000300C,
+			.header_cfg               = 0x00003010,
+			.image_addr               = 0x00003014,
+			.image_addr_offset        = 0x00003018,
+			.buffer_width_cfg         = 0x0000301C,
+			.buffer_height_cfg        = 0x00003020,
+			.packer_cfg               = 0x00003024,
+			.stride                   = 0x00003028,
+			.irq_subsample_period     = 0x00003048,
+			.irq_subsample_pattern    = 0x0000304C,
+			.framedrop_period         = 0x00003050,
+			.framedrop_pattern        = 0x00003054,
+			.frame_inc                = 0x00003058,
+			.burst_limit              = 0x0000305C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 */
+		{
+			.status0                  = 0x00003100,
+			.status1                  = 0x00003104,
+			.cfg                      = 0x00003108,
+			.header_addr              = 0x0000310C,
+			.header_cfg               = 0x00003110,
+			.image_addr               = 0x00003114,
+			.image_addr_offset        = 0x00003118,
+			.buffer_width_cfg         = 0x0000311C,
+			.buffer_height_cfg        = 0x00003120,
+			.packer_cfg               = 0x00003124,
+			.stride                   = 0x00003128,
+			.irq_subsample_period     = 0x00003148,
+			.irq_subsample_pattern    = 0x0000314C,
+			.framedrop_period         = 0x00003150,
+			.framedrop_pattern        = 0x00003154,
+			.frame_inc                = 0x00003158,
+			.burst_limit              = 0x0000315C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 */
+		{
+			.status0                  = 0x00003200,
+			.status1                  = 0x00003204,
+			.cfg                      = 0x00003208,
+			.header_addr              = 0x0000320C,
+			.header_cfg               = 0x00003210,
+			.image_addr               = 0x00003214,
+			.image_addr_offset        = 0x00003218,
+			.buffer_width_cfg         = 0x0000321C,
+			.buffer_height_cfg        = 0x00003220,
+			.packer_cfg               = 0x00003224,
+			.stride                   = 0x00003228,
+			.irq_subsample_period     = 0x00003248,
+			.irq_subsample_pattern    = 0x0000324C,
+			.framedrop_period         = 0x00003250,
+			.framedrop_pattern        = 0x00003254,
+			.frame_inc                = 0x00003258,
+			.burst_limit              = 0x0000325C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 */
+		{
+			.status0                  = 0x00003300,
+			.status1                  = 0x00003304,
+			.cfg                      = 0x00003308,
+			.header_addr              = 0x0000330C,
+			.header_cfg               = 0x00003310,
+			.image_addr               = 0x00003314,
+			.image_addr_offset        = 0x00003318,
+			.buffer_width_cfg         = 0x0000331C,
+			.buffer_height_cfg        = 0x00003320,
+			.packer_cfg               = 0x00003324,
+			.stride                   = 0x00003328,
+			.irq_subsample_period     = 0x00003348,
+			.irq_subsample_pattern    = 0x0000334C,
+			.framedrop_period         = 0x00003350,
+			.framedrop_pattern        = 0x00003354,
+			.frame_inc                = 0x00003358,
+			.burst_limit              = 0x0000335C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 */
+		{
+			.status0                  = 0x00003400,
+			.status1                  = 0x00003404,
+			.cfg                      = 0x00003408,
+			.header_addr              = 0x0000340C,
+			.header_cfg               = 0x00003410,
+			.image_addr               = 0x00003414,
+			.image_addr_offset        = 0x00003418,
+			.buffer_width_cfg         = 0x0000341C,
+			.buffer_height_cfg        = 0x00003420,
+			.packer_cfg               = 0x00003424,
+			.stride                   = 0x00003428,
+			.irq_subsample_period     = 0x00003448,
+			.irq_subsample_pattern    = 0x0000344C,
+			.framedrop_period         = 0x00003450,
+			.framedrop_pattern        = 0x00003454,
+			.frame_inc                = 0x00003458,
+			.burst_limit              = 0x0000345C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 */
+		{
+			.status0                  = 0x00003500,
+			.status1                  = 0x00003504,
+			.cfg                      = 0x00003508,
+			.header_addr              = 0x0000350C,
+			.header_cfg               = 0x00003510,
+			.image_addr               = 0x00003514,
+			.image_addr_offset        = 0x00003518,
+			.buffer_width_cfg         = 0x0000351C,
+			.buffer_height_cfg        = 0x00003520,
+			.packer_cfg               = 0x00003524,
+			.stride                   = 0x00003528,
+			.irq_subsample_period     = 0x00003548,
+			.irq_subsample_pattern    = 0x0000354C,
+			.framedrop_period         = 0x00003550,
+			.framedrop_pattern        = 0x00003554,
+			.frame_inc                = 0x00003558,
+			.burst_limit              = 0x0000355C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 */
+		{
+			.status0                  = 0x00003600,
+			.status1                  = 0x00003604,
+			.cfg                      = 0x00003608,
+			.header_addr              = 0x0000360C,
+			.header_cfg               = 0x00003610,
+			.image_addr               = 0x00003614,
+			.image_addr_offset        = 0x00003618,
+			.buffer_width_cfg         = 0x0000361C,
+			.buffer_height_cfg        = 0x00003620,
+			.packer_cfg               = 0x00003624,
+			.stride                   = 0x00003628,
+			.irq_subsample_period     = 0x00003648,
+			.irq_subsample_pattern    = 0x0000364C,
+			.framedrop_period         = 0x00003650,
+			.framedrop_pattern        = 0x00003654,
+			.frame_inc                = 0x00003658,
+			.burst_limit              = 0x0000365C,
+			.ubwc_regs                =
+				&vfe175_130_ubwc_regs_client_20,
+		},
+		/* BUS Client 21 */
+		{
+			.status0                  = 0x00003700,
+			.status1                  = 0x00003704,
+			.cfg                      = 0x00003708,
+			.header_addr              = 0x0000370C,
+			.header_cfg               = 0x00003710,
+			.image_addr               = 0x00003714,
+			.image_addr_offset        = 0x00003718,
+			.buffer_width_cfg         = 0x0000371C,
+			.buffer_height_cfg        = 0x00003720,
+			.packer_cfg               = 0x00003724,
+			.stride                   = 0x00003728,
+			.irq_subsample_period     = 0x00003748,
+			.irq_subsample_pattern    = 0x0000374C,
+			.framedrop_period         = 0x00003750,
+			.framedrop_pattern        = 0x00003754,
+			.frame_inc                = 0x00003758,
+			.burst_limit              = 0x0000375C,
+			.ubwc_regs                =
+				&vfe175_130_ubwc_regs_client_21,
+		},
+		/* BUS Client 22 */
+		{
+			.status0                  = 0x00003800,
+			.status1                  = 0x00003804,
+			.cfg                      = 0x00003808,
+			.header_addr              = 0x0000380C,
+			.header_cfg               = 0x00003810,
+			.image_addr               = 0x00003814,
+			.image_addr_offset        = 0x00003818,
+			.buffer_width_cfg         = 0x0000381C,
+			.buffer_height_cfg        = 0x00003820,
+			.packer_cfg               = 0x00003824,
+			.stride                   = 0x00003828,
+			.irq_subsample_period     = 0x00003848,
+			.irq_subsample_pattern    = 0x0000384C,
+			.framedrop_period         = 0x00003850,
+			.framedrop_pattern        = 0x00003854,
+			.frame_inc                = 0x00003858,
+			.burst_limit              = 0x0000385C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 */
+		{
+			.status0                  = 0x00003900,
+			.status1                  = 0x00003904,
+			.cfg                      = 0x00003908,
+			.header_addr              = 0x0000390C,
+			.header_cfg               = 0x00003910,
+			.image_addr               = 0x00003914,
+			.image_addr_offset        = 0x00003918,
+			.buffer_width_cfg         = 0x0000391C,
+			.buffer_height_cfg        = 0x00003920,
+			.packer_cfg               = 0x00003924,
+			.stride                   = 0x00003928,
+			.irq_subsample_period     = 0x00003948,
+			.irq_subsample_pattern    = 0x0000394C,
+			.framedrop_period         = 0x00003950,
+			.framedrop_pattern        = 0x00003954,
+			.frame_inc                = 0x00003958,
+			.burst_limit              = 0x0000395C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 22,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 23,
+};
+
+static struct cam_vfe_hw_info cam_vfe175_130_hw_info = {
+	.irq_reg_info                  = &vfe175_130_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe175_130_bus_hw_info,
+
+	.bus_rd_version                = CAM_VFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &vfe175_130_bus_rd_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe175_130_top_hw_info,
+
+	.camif_version                 = CAM_VFE_CAMIF_VER_2_0,
+	.camif_reg                     = &vfe175_130_camif_reg,
+
+	.camif_lite_version            = CAM_VFE_CAMIF_LITE_VER_2_0,
+	.camif_lite_reg                = &vfe175_130_camif_lite_reg,
+
+};
+
+#endif /* _CAM_VFE175_130_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe480.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe480.h
@@ -0,0 +1,1503 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE480_H_
+#define _CAM_VFE480_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+static struct cam_irq_register_set vfe480_top_irq_reg_set[3] = {
+	{
+		.mask_reg_offset   = 0x0000003C,
+		.clear_reg_offset  = 0x00000048,
+		.status_reg_offset = 0x00000054,
+	},
+	{
+		.mask_reg_offset   = 0x00000040,
+		.clear_reg_offset  = 0x0000004C,
+		.status_reg_offset = 0x00000058,
+	},
+		{
+		.mask_reg_offset   = 0x00000044,
+		.clear_reg_offset  = 0x00000050,
+		.status_reg_offset = 0x0000005C,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe480_top_irq_reg_info = {
+	.num_registers = 3,
+	.irq_reg_set = vfe480_top_irq_reg_set,
+	.global_clear_offset  = 0x00000038,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_camif_ver3_pp_clc_reg vfe480_camif_reg = {
+	.hw_version                  = 0x00002600,
+	.hw_status                   = 0x00002604,
+	.module_cfg                  = 0x00002660,
+	.pdaf_raw_crop_width_cfg     = 0x00002668,
+	.pdaf_raw_crop_height_cfg    = 0x0000266C,
+	.line_skip_pattern           = 0x00002670,
+	.pixel_skip_pattern          = 0x00002674,
+	.period_cfg                  = 0x00002678,
+	.irq_subsample_pattern       = 0x0000267C,
+	.epoch_irq_cfg               = 0x00002680,
+	.debug_1                     = 0x000027F0,
+	.debug_0                     = 0x000027F4,
+	.test_bus_ctrl               = 0x000027F8,
+	.spare                       = 0x000027FC,
+	.reg_update_cmd              = 0x00000034,
+};
+
+static struct cam_vfe_camif_ver3_reg_data vfe_480_camif_reg_data = {
+	.pp_extern_reg_update_shift      = 4,
+	.dual_pd_extern_reg_update_shift = 17,
+	.extern_reg_update_mask          = 1,
+	.dual_ife_pix_en_shift           = 3,
+	.operating_mode_shift            = 11,
+	.input_mux_sel_shift             = 5,
+	.pixel_pattern_shift             = 24,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 24,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 23,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x41,
+	.epoch_line_cfg                  = 0x00000014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.epoch1_irq_mask                 = 0x00000008,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x82000200,
+	.error_irq_mask2                 = 0x30301F80,
+	.subscribe_irq_mask1             = 0x00000007,
+	.frame_id_irq_mask               = 0x400,
+	.enable_diagnostic_hw            = 0x1,
+	.pp_camif_cfg_en_shift           = 0,
+	.pp_camif_cfg_ife_out_en_shift   = 8,
+	.top_debug_cfg_en                = 1,
+};
+
+static struct cam_vfe_top_ver3_reg_offset_common vfe480_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.titan_version            = 0x00000004,
+	.hw_capability            = 0x00000008,
+	.lens_feature             = 0x0000000C,
+	.stats_feature            = 0x00000010,
+	.color_feature            = 0x00000014,
+	.zoom_feature             = 0x00000018,
+	.global_reset_cmd         = 0x0000001C,
+	.core_cfg_0               = 0x0000002C,
+	.core_cfg_1               = 0x00000030,
+	.reg_update_cmd           = 0x00000034,
+	.violation_status         = 0x00000074,
+	.core_cgc_ovd_0           = 0x00000020,
+	.core_cgc_ovd_1           = 0x00000094,
+	.ahb_cgc_ovd              = 0x00000024,
+	.noc_cgc_ovd              = 0x00000028,
+	.trigger_cdm_events       = 0x00000090,
+	.custom_frame_idx         = 0x00000110,
+	.dsp_status               = 0x0000007C,
+	.diag_config              = 0x00000064,
+	.diag_sensor_status_0     = 0x00000068,
+	.diag_sensor_status_1     = 0x00000098,
+	.bus_overflow_status      = 0x0000AA68,
+	.top_debug_cfg            = 0x000000DC,
+	.top_debug_0              = 0x00000080,
+	.top_debug_1              = 0x00000084,
+	.top_debug_2              = 0x00000088,
+	.top_debug_3              = 0x0000008C,
+	.top_debug_4              = 0x0000009C,
+	.top_debug_5              = 0x000000A0,
+	.top_debug_6              = 0x000000A4,
+	.top_debug_7              = 0x000000A8,
+	.top_debug_8              = 0x000000AC,
+	.top_debug_9              = 0x000000B0,
+	.top_debug_10             = 0x000000B4,
+	.top_debug_11             = 0x000000B8,
+	.top_debug_12             = 0x000000BC,
+	.top_debug_13             = 0x000000C0,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg vfe480_camif_rdi[3] = {
+	{
+		.lite_hw_version            = 0x9A00,
+		.lite_hw_status             = 0x9A04,
+		.lite_module_config         = 0x9A60,
+		.lite_skip_period           = 0x9A68,
+		.lite_irq_subsample_pattern = 0x9A6C,
+		.lite_epoch_irq             = 0x9A70,
+		.lite_debug_1               = 0x9BF0,
+		.lite_debug_0               = 0x9BF4,
+		.lite_test_bus_ctrl         = 0x9BF8,
+		.camif_lite_spare           = 0x9BFC,
+		.reg_update_cmd             = 0x34,
+	},
+	{
+		.lite_hw_version            = 0x9C00,
+		.lite_hw_status             = 0x9C04,
+		.lite_module_config         = 0x9C60,
+		.lite_skip_period           = 0x9C68,
+		.lite_irq_subsample_pattern = 0x9C6C,
+		.lite_epoch_irq             = 0x9C70,
+		.lite_debug_1               = 0x9DF0,
+		.lite_debug_0               = 0x9DF4,
+		.lite_test_bus_ctrl         = 0x9DF8,
+		.camif_lite_spare           = 0x9DFC,
+		.reg_update_cmd             = 0x34,
+	},
+	{
+		.lite_hw_version            = 0x9E00,
+		.lite_hw_status             = 0x9E04,
+		.lite_module_config         = 0x9E60,
+		.lite_skip_period           = 0x9E68,
+		.lite_irq_subsample_pattern = 0x9E6C,
+		.lite_epoch_irq             = 0x9E70,
+		.lite_debug_1               = 0x9FF0,
+		.lite_debug_0               = 0x9FF4,
+		.lite_test_bus_ctrl         = 0x9FF8,
+		.camif_lite_spare           = 0x9FFC,
+		.reg_update_cmd             = 0x34,
+	},
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe480_camif_rdi_reg_data[3] = {
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x2,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x10,
+		.epoch0_irq_mask                 = 0x40,
+		.epoch1_irq_mask                 = 0x80,
+		.eof_irq_mask                    = 0x20,
+		.error_irq_mask0                 = 0x20000000,
+		.error_irq_mask2                 = 0x20000,
+		.subscribe_irq_mask1             = 0x30,
+		.enable_diagnostic_hw            = 0x1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x4,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x100,
+		.epoch0_irq_mask                 = 0x400,
+		.epoch1_irq_mask                 = 0x800,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask0                 = 0x10000000,
+		.error_irq_mask2                 = 0x40000,
+		.subscribe_irq_mask1             = 0x300,
+		.enable_diagnostic_hw            = 0x1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x8,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x1000,
+		.epoch0_irq_mask                 = 0x4000,
+		.epoch1_irq_mask                 = 0x8000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask0                 = 0x8000000,
+		.error_irq_mask2                 = 0x80000,
+		.subscribe_irq_mask1             = 0x3000,
+		.enable_diagnostic_hw            = 0x1,
+	},
+};
+
+static struct cam_vfe_camif_lite_ver3_reg vfe480_camif_lcr = {
+	.lite_hw_version            = 0xA000,
+	.lite_hw_status             = 0xA004,
+	.lite_module_config         = 0xA060,
+	.lite_skip_period           = 0xA068,
+	.lite_irq_subsample_pattern = 0xA06C,
+	.lite_epoch_irq             = 0xA070,
+	.lite_debug_1               = 0xA1F0,
+	.lite_debug_0               = 0xA1F4,
+	.lite_test_bus_ctrl         = 0xA1F8,
+	.camif_lite_spare           = 0xA1FC,
+	.reg_update_cmd             = 0x0034,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe480_camif_lcr_reg_data = {
+	.extern_reg_update_shift    = 16,
+	.reg_update_cmd_data        = 0x40,
+	.epoch_line_cfg             = 0x00140014,
+	.sof_irq_mask               = 0x100000,
+	.epoch0_irq_mask            = 0x400000,
+	.epoch1_irq_mask            = 0x800000,
+	.eof_irq_mask               = 0x200000,
+	.error_irq_mask0            = 0x0,
+	.error_irq_mask2            = 0x18000,
+	.subscribe_irq_mask1        = 0x300000,
+	.enable_diagnostic_hw       = 0x1,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg vfe480_camif_pd = {
+	.lite_hw_version            = 0xA400,
+	.lite_hw_status             = 0xA404,
+	.lite_module_config         = 0xA460,
+	.lite_skip_period           = 0xA468,
+	.lite_irq_subsample_pattern = 0xA46C,
+	.lite_epoch_irq             = 0xA470,
+	.lite_debug_1               = 0xA5F0,
+	.lite_debug_0               = 0xA5F4,
+	.lite_test_bus_ctrl         = 0xA5F8,
+	.camif_lite_spare           = 0xA5FC,
+	.reg_update_cmd             = 0x0034,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe480_camif_pd_reg_data = {
+	.extern_reg_update_shift    = 17,
+	.operating_mode_shift       = 13,
+	.input_mux_sel_shift        = 31,
+	.reg_update_cmd_data        = 0x20,
+	.epoch_line_cfg             = 0x00140014,
+	.sof_irq_mask               = 0x10000,
+	.epoch0_irq_mask            = 0x40000,
+	.epoch1_irq_mask            = 0x80000,
+	.eof_irq_mask               = 0x20000,
+	.error_irq_mask0            = 0x40000000,
+	.error_irq_mask2            = 0x6000,
+	.subscribe_irq_mask1        = 0x30000,
+	.enable_diagnostic_hw       = 0x1,
+};
+
+struct cam_vfe_camif_lite_ver3_hw_info rdi_hw_info_arr[CAM_VFE_RDI_VER2_MAX] = {
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[0],
+		.reg_data       = &vfe480_camif_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[1],
+		.reg_data       = &vfe480_camif_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[2],
+		.reg_data       = &vfe480_camif_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver3_hw_info vfe480_top_hw_info = {
+	.common_reg = &vfe480_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_reg      = &vfe480_camif_reg,
+		.reg_data       = &vfe_480_camif_reg_data,
+		},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_pd,
+		.reg_data       = &vfe480_camif_pd_reg_data,
+		},
+	.rdi_hw_info[0] = &rdi_hw_info_arr[0],
+	.rdi_hw_info[1] = &rdi_hw_info_arr[1],
+	.rdi_hw_info[2] = &rdi_hw_info_arr[2],
+	.lcr_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_lcr,
+		.reg_data       = &vfe480_camif_lcr_reg_data,
+		},
+	.num_mux = 6,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_3_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_LCR_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set vfe480_bus_irq_reg[2] = {
+		{
+			.mask_reg_offset   = 0x0000AA18,
+			.clear_reg_offset  = 0x0000AA20,
+			.status_reg_offset = 0x0000AA28,
+		},
+		{
+			.mask_reg_offset   = 0x0000AA1C,
+			.clear_reg_offset  = 0x0000AA24,
+			.status_reg_offset = 0x0000AA2C,
+		},
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe480_ubwc_regs_client_0 = {
+	.meta_addr        = 0x0000AC40,
+	.meta_cfg         = 0x0000AC44,
+	.mode_cfg         = 0x0000AC48,
+	.stats_ctrl       = 0x0000AC4C,
+	.ctrl_2           = 0x0000AC50,
+	.lossy_thresh0    = 0x0000AC54,
+	.lossy_thresh1    = 0x0000AC58,
+	.off_lossy_var    = 0x0000AC5C,
+	.bw_limit         = 0x0000AC1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe480_ubwc_regs_client_1 = {
+	.meta_addr        = 0x0000AD40,
+	.meta_cfg         = 0x0000AD44,
+	.mode_cfg         = 0x0000AD48,
+	.stats_ctrl       = 0x0000AD4C,
+	.ctrl_2           = 0x0000AD50,
+	.lossy_thresh0    = 0x0000AD54,
+	.lossy_thresh1    = 0x0000AD58,
+	.off_lossy_var    = 0x0000AD5C,
+	.bw_limit         = 0x0000AD1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe480_ubwc_regs_client_4 = {
+	.meta_addr        = 0x0000B040,
+	.meta_cfg         = 0x0000B044,
+	.mode_cfg         = 0x0000B048,
+	.stats_ctrl       = 0x0000B04C,
+	.ctrl_2           = 0x0000B050,
+	.lossy_thresh0    = 0x0000B054,
+	.lossy_thresh1    = 0x0000B058,
+	.off_lossy_var    = 0x0000B05C,
+	.bw_limit         = 0x0000B01C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe480_ubwc_regs_client_5 = {
+	.meta_addr        = 0x0000B140,
+	.meta_cfg         = 0x0000B144,
+	.mode_cfg         = 0x0000B148,
+	.stats_ctrl       = 0x0000B14C,
+	.ctrl_2           = 0x0000B150,
+	.lossy_thresh0    = 0x0000B154,
+	.lossy_thresh1    = 0x0000B158,
+	.off_lossy_var    = 0x0000B15C,
+	.bw_limit         = 0x0000B11C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe480_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x0000AA00,
+		.cgc_ovd                          = 0x0000AA08,
+		.comp_cfg_0                       = 0x0000AA0C,
+		.comp_cfg_1                       = 0x0000AA10,
+		.if_frameheader_cfg               = {
+			0x0000AA34,
+			0x0000AA38,
+			0x0000AA3C,
+			0x0000AA40,
+			0x0000AA44,
+			0x0000AA48,
+		},
+		.ubwc_static_ctrl                 = 0x0000AA58,
+		.pwr_iso_cfg                      = 0x0000AA5C,
+		.overflow_status_clear            = 0x0000AA60,
+		.ccif_violation_status            = 0x0000AA64,
+		.overflow_status                  = 0x0000AA68,
+		.image_size_violation_status      = 0x0000AA70,
+		.debug_status_top_cfg             = 0x0000AAD4,
+		.debug_status_top                 = 0x0000AAD8,
+		.test_bus_ctrl                    = 0x0000AADC,
+		.top_irq_mask_0                   = 0x0000003C,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe480_bus_irq_reg,
+			.global_clear_offset      = 0x0000AA30,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = CAM_VFE_BUS_VER3_480_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 FULL Y */
+		{
+			.cfg                      = 0x0000AC00,
+			.image_addr               = 0x0000AC04,
+			.frame_incr               = 0x0000AC08,
+			.image_cfg_0              = 0x0000AC0C,
+			.image_cfg_1              = 0x0000AC10,
+			.image_cfg_2              = 0x0000AC14,
+			.packer_cfg               = 0x0000AC18,
+			.frame_header_addr        = 0x0000AC20,
+			.frame_header_incr        = 0x0000AC24,
+			.frame_header_cfg         = 0x0000AC28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000AC30,
+			.irq_subsample_pattern    = 0x0000AC34,
+			.framedrop_period         = 0x0000AC38,
+			.framedrop_pattern        = 0x0000AC3C,
+			.system_cache_cfg         = 0x0000AC60,
+			.burst_limit              = 0x0000AC64,
+			.addr_status_0            = 0x0000AC68,
+			.addr_status_1            = 0x0000AC6C,
+			.addr_status_2            = 0x0000AC70,
+			.addr_status_3            = 0x0000AC74,
+			.debug_status_cfg         = 0x0000AC78,
+			.debug_status_0           = 0x0000AC7C,
+			.debug_status_1           = 0x0000AC80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe480_ubwc_regs_client_0,
+		},
+		/* BUS Client 1 FULL C */
+		{
+			.cfg                      = 0x0000AD00,
+			.image_addr               = 0x0000AD04,
+			.frame_incr               = 0x0000AD08,
+			.image_cfg_0              = 0x0000AD0C,
+			.image_cfg_1              = 0x0000AD10,
+			.image_cfg_2              = 0x0000AD14,
+			.packer_cfg               = 0x0000AD18,
+			.frame_header_addr        = 0x0000AD20,
+			.frame_header_incr        = 0x0000AD24,
+			.frame_header_cfg         = 0x0000AD28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000AD30,
+			.irq_subsample_pattern    = 0x0000AD34,
+			.framedrop_period         = 0x0000AD38,
+			.framedrop_pattern        = 0x0000AD3C,
+			.system_cache_cfg         = 0x0000AD60,
+			.burst_limit              = 0x0000AD64,
+			.addr_status_0            = 0x0000AD68,
+			.addr_status_1            = 0x0000AD6C,
+			.addr_status_2            = 0x0000AD70,
+			.addr_status_3            = 0x0000AD74,
+			.debug_status_cfg         = 0x0000AD78,
+			.debug_status_0           = 0x0000AD7C,
+			.debug_status_1           = 0x0000AD80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe480_ubwc_regs_client_1,
+		},
+		/* BUS Client 2 DS4 */
+		{
+			.cfg                      = 0x0000AE00,
+			.image_addr               = 0x0000AE04,
+			.frame_incr               = 0x0000AE08,
+			.image_cfg_0              = 0x0000AE0C,
+			.image_cfg_1              = 0x0000AE10,
+			.image_cfg_2              = 0x0000AE14,
+			.packer_cfg               = 0x0000AE18,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000AE30,
+			.irq_subsample_pattern    = 0x0000AE34,
+			.framedrop_period         = 0x0000AE38,
+			.framedrop_pattern        = 0x0000AE3C,
+			.system_cache_cfg         = 0x0000AE60,
+			.burst_limit              = 0x0000AE64,
+			.addr_status_0            = 0x0000AE68,
+			.addr_status_1            = 0x0000AE6C,
+			.addr_status_2            = 0x0000AE70,
+			.addr_status_3            = 0x0000AE74,
+			.debug_status_cfg         = 0x0000AE78,
+			.debug_status_0           = 0x0000AE7C,
+			.debug_status_1           = 0x0000AE80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 DS16 */
+		{
+			.cfg                      = 0x0000AF00,
+			.image_addr               = 0x0000AF04,
+			.frame_incr               = 0x0000AF08,
+			.image_cfg_0              = 0x0000AF0C,
+			.image_cfg_1              = 0x0000AF10,
+			.image_cfg_2              = 0x0000AF14,
+			.packer_cfg               = 0x0000AF18,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000AF30,
+			.irq_subsample_pattern    = 0x0000AF34,
+			.framedrop_period         = 0x0000AF38,
+			.framedrop_pattern        = 0x0000AF3C,
+			.system_cache_cfg         = 0x0000AF60,
+			.burst_limit              = 0x0000AF64,
+			.addr_status_0            = 0x0000AF68,
+			.addr_status_1            = 0x0000AF6C,
+			.addr_status_2            = 0x0000AF70,
+			.addr_status_3            = 0x0000AF74,
+			.debug_status_cfg         = 0x0000AF78,
+			.debug_status_0           = 0x0000AF7C,
+			.debug_status_1           = 0x0000AF80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 DISP Y */
+		{
+			.cfg                      = 0x0000B000,
+			.image_addr               = 0x0000B004,
+			.frame_incr               = 0x0000B008,
+			.image_cfg_0              = 0x0000B00C,
+			.image_cfg_1              = 0x0000B010,
+			.image_cfg_2              = 0x0000B014,
+			.packer_cfg               = 0x0000B018,
+			.frame_header_addr        = 0x0000B020,
+			.frame_header_incr        = 0x0000B024,
+			.frame_header_cfg         = 0x0000B028,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B030,
+			.irq_subsample_pattern    = 0x0000B034,
+			.framedrop_period         = 0x0000B038,
+			.framedrop_pattern        = 0x0000B03C,
+			.system_cache_cfg         = 0x0000B060,
+			.burst_limit              = 0x0000B064,
+			.addr_status_0            = 0x0000B068,
+			.addr_status_1            = 0x0000B06C,
+			.addr_status_2            = 0x0000B070,
+			.addr_status_3            = 0x0000B074,
+			.debug_status_cfg         = 0x0000B078,
+			.debug_status_0           = 0x0000B07C,
+			.debug_status_1           = 0x0000B080,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe480_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 DISP C */
+		{
+			.cfg                      = 0x0000B100,
+			.image_addr               = 0x0000B104,
+			.frame_incr               = 0x0000B108,
+			.image_cfg_0              = 0x0000B10C,
+			.image_cfg_1              = 0x0000B110,
+			.image_cfg_2              = 0x0000B114,
+			.packer_cfg               = 0x0000B118,
+			.frame_header_addr        = 0x0000B120,
+			.frame_header_incr        = 0x0000B124,
+			.frame_header_cfg         = 0x0000B128,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B130,
+			.irq_subsample_pattern    = 0x0000B134,
+			.framedrop_period         = 0x0000B138,
+			.framedrop_pattern        = 0x0000B13C,
+			.system_cache_cfg         = 0x0000B160,
+			.burst_limit              = 0x0000B164,
+			.addr_status_0            = 0x0000B168,
+			.addr_status_1            = 0x0000B16C,
+			.addr_status_2            = 0x0000B170,
+			.addr_status_3            = 0x0000B174,
+			.debug_status_cfg         = 0x0000B178,
+			.debug_status_0           = 0x0000B17C,
+			.debug_status_1           = 0x0000B180,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe480_ubwc_regs_client_5,
+		},
+		/* BUS Client 6 DISP DS4 */
+		{
+			.cfg                      = 0x0000B200,
+			.image_addr               = 0x0000B204,
+			.frame_incr               = 0x0000B208,
+			.image_cfg_0              = 0x0000B20C,
+			.image_cfg_1              = 0x0000B210,
+			.image_cfg_2              = 0x0000B214,
+			.packer_cfg               = 0x0000B218,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B230,
+			.irq_subsample_pattern    = 0x0000B234,
+			.framedrop_period         = 0x0000B238,
+			.framedrop_pattern        = 0x0000B23C,
+			.system_cache_cfg         = 0x0000B260,
+			.burst_limit              = 0x0000B264,
+			.addr_status_0            = 0x0000B268,
+			.addr_status_1            = 0x0000B26C,
+			.addr_status_2            = 0x0000B270,
+			.addr_status_3            = 0x0000B274,
+			.debug_status_cfg         = 0x0000B278,
+			.debug_status_0           = 0x0000B27C,
+			.debug_status_1           = 0x0000B280,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 DISP DS16 */
+		{
+			.cfg                      = 0x0000B300,
+			.image_addr               = 0x0000B304,
+			.frame_incr               = 0x0000B308,
+			.image_cfg_0              = 0x0000B30C,
+			.image_cfg_1              = 0x0000B310,
+			.image_cfg_2              = 0x0000B314,
+			.packer_cfg               = 0x0000B318,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B330,
+			.irq_subsample_pattern    = 0x0000B334,
+			.framedrop_period         = 0x0000B338,
+			.framedrop_pattern        = 0x0000B33C,
+			.system_cache_cfg         = 0x0000B360,
+			.burst_limit              = 0x0000B364,
+			.addr_status_0            = 0x0000B368,
+			.addr_status_1            = 0x0000B36C,
+			.addr_status_2            = 0x0000B370,
+			.addr_status_3            = 0x0000B374,
+			.debug_status_cfg         = 0x0000B378,
+			.debug_status_0           = 0x0000B37C,
+			.debug_status_1           = 0x0000B380,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 FD Y */
+		{
+			.cfg                      = 0x0000B400,
+			.image_addr               = 0x0000B404,
+			.frame_incr               = 0x0000B408,
+			.image_cfg_0              = 0x0000B40C,
+			.image_cfg_1              = 0x0000B410,
+			.image_cfg_2              = 0x0000B414,
+			.packer_cfg               = 0x0000B418,
+			.frame_header_addr        = 0x0000B420,
+			.frame_header_incr        = 0x0000B424,
+			.frame_header_cfg         = 0x0000B428,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B430,
+			.irq_subsample_pattern    = 0x0000B434,
+			.framedrop_period         = 0x0000B438,
+			.framedrop_pattern        = 0x0000B43C,
+			.system_cache_cfg         = 0x0000B460,
+			.burst_limit              = 0x0000B464,
+			.addr_status_0            = 0x0000B468,
+			.addr_status_1            = 0x0000B46C,
+			.addr_status_2            = 0x0000B470,
+			.addr_status_3            = 0x0000B474,
+			.debug_status_cfg         = 0x0000B478,
+			.debug_status_0           = 0x0000B47C,
+			.debug_status_1           = 0x0000B480,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 FD C */
+		{
+			.cfg                      = 0x0000B500,
+			.image_addr               = 0x0000B504,
+			.frame_incr               = 0x0000B508,
+			.image_cfg_0              = 0x0000B50C,
+			.image_cfg_1              = 0x0000B510,
+			.image_cfg_2              = 0x0000B514,
+			.packer_cfg               = 0x0000B518,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B530,
+			.irq_subsample_pattern    = 0x0000B534,
+			.framedrop_period         = 0x0000B538,
+			.framedrop_pattern        = 0x0000B53C,
+			.system_cache_cfg         = 0x0000B560,
+			.burst_limit              = 0x0000B564,
+			.addr_status_0            = 0x0000B568,
+			.addr_status_1            = 0x0000B56C,
+			.addr_status_2            = 0x0000B570,
+			.addr_status_3            = 0x0000B574,
+			.debug_status_cfg         = 0x0000B578,
+			.debug_status_0           = 0x0000B57C,
+			.debug_status_1           = 0x0000B580,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 PIXEL RAW */
+		{
+			.cfg                      = 0x0000B600,
+			.image_addr               = 0x0000B604,
+			.frame_incr               = 0x0000B608,
+			.image_cfg_0              = 0x0000B60C,
+			.image_cfg_1              = 0x0000B610,
+			.image_cfg_2              = 0x0000B614,
+			.packer_cfg               = 0x0000B618,
+			.frame_header_addr        = 0x0000B620,
+			.frame_header_incr        = 0x0000B624,
+			.frame_header_cfg         = 0x0000B628,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B630,
+			.irq_subsample_pattern    = 0x0000B634,
+			.framedrop_period         = 0x0000B638,
+			.framedrop_pattern        = 0x0000B63C,
+			.system_cache_cfg         = 0x0000B660,
+			.burst_limit              = 0x0000B664,
+			.addr_status_0            = 0x0000B668,
+			.addr_status_1            = 0x0000B66C,
+			.addr_status_2            = 0x0000B670,
+			.addr_status_3            = 0x0000B674,
+			.debug_status_cfg         = 0x0000B678,
+			.debug_status_0           = 0x0000B67C,
+			.debug_status_1           = 0x0000B680,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 CAMIF PD */
+		{
+			.cfg                      = 0x0000B700,
+			.image_addr               = 0x0000B704,
+			.frame_incr               = 0x0000B708,
+			.image_cfg_0              = 0x0000B70C,
+			.image_cfg_1              = 0x0000B710,
+			.image_cfg_2              = 0x0000B714,
+			.packer_cfg               = 0x0000B718,
+			.frame_header_addr        = 0x0000B720,
+			.frame_header_incr        = 0x0000B724,
+			.frame_header_cfg         = 0x0000B728,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B730,
+			.irq_subsample_pattern    = 0x0000B734,
+			.framedrop_period         = 0x0000B738,
+			.framedrop_pattern        = 0x0000B73C,
+			.system_cache_cfg         = 0x0000B760,
+			.burst_limit              = 0x0000B764,
+			.addr_status_0            = 0x0000B768,
+			.addr_status_1            = 0x0000B76C,
+			.addr_status_2            = 0x0000B770,
+			.addr_status_3            = 0x0000B774,
+			.debug_status_cfg         = 0x0000B778,
+			.debug_status_0           = 0x0000B77C,
+			.debug_status_1           = 0x0000B780,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 STATS HDR BE */
+		{
+			.cfg                      = 0x0000B800,
+			.image_addr               = 0x0000B804,
+			.frame_incr               = 0x0000B808,
+			.image_cfg_0              = 0x0000B80C,
+			.image_cfg_1              = 0x0000B810,
+			.image_cfg_2              = 0x0000B814,
+			.packer_cfg               = 0x0000B818,
+			.frame_header_addr        = 0x0000B820,
+			.frame_header_incr        = 0x0000B824,
+			.frame_header_cfg         = 0x0000B828,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B830,
+			.irq_subsample_pattern    = 0x0000B834,
+			.framedrop_period         = 0x0000B838,
+			.framedrop_pattern        = 0x0000B83C,
+			.system_cache_cfg         = 0x0000B860,
+			.burst_limit              = 0x0000B864,
+			.addr_status_0            = 0x0000B868,
+			.addr_status_1            = 0x0000B86C,
+			.addr_status_2            = 0x0000B870,
+			.addr_status_3            = 0x0000B874,
+			.debug_status_cfg         = 0x0000B878,
+			.debug_status_0           = 0x0000B87C,
+			.debug_status_1           = 0x0000B880,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 STATS HDR BHIST */
+		{
+			.cfg                      = 0x0000B900,
+			.image_addr               = 0x0000B904,
+			.frame_incr               = 0x0000B908,
+			.image_cfg_0              = 0x0000B90C,
+			.image_cfg_1              = 0x0000B910,
+			.image_cfg_2              = 0x0000B914,
+			.packer_cfg               = 0x0000B918,
+			.frame_header_addr        = 0x0000B920,
+			.frame_header_incr        = 0x0000B924,
+			.frame_header_cfg         = 0x0000B928,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000B930,
+			.irq_subsample_pattern    = 0x0000B934,
+			.framedrop_period         = 0x0000B938,
+			.framedrop_pattern        = 0x0000B93C,
+			.system_cache_cfg         = 0x0000B960,
+			.burst_limit              = 0x0000B964,
+			.addr_status_0            = 0x0000B968,
+			.addr_status_1            = 0x0000B96C,
+			.addr_status_2            = 0x0000B970,
+			.addr_status_3            = 0x0000B974,
+			.debug_status_cfg         = 0x0000B978,
+			.debug_status_0           = 0x0000B97C,
+			.debug_status_1           = 0x0000B980,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 STATS TINTLESS BG */
+		{
+			.cfg                      = 0x0000BA00,
+			.image_addr               = 0x0000BA04,
+			.frame_incr               = 0x0000BA08,
+			.image_cfg_0              = 0x0000BA0C,
+			.image_cfg_1              = 0x0000BA10,
+			.image_cfg_2              = 0x0000BA14,
+			.packer_cfg               = 0x0000BA18,
+			.frame_header_addr        = 0x0000BA20,
+			.frame_header_incr        = 0x0000BA24,
+			.frame_header_cfg         = 0x0000BA28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BA30,
+			.irq_subsample_pattern    = 0x0000BA34,
+			.framedrop_period         = 0x0000BA38,
+			.framedrop_pattern        = 0x0000BA3C,
+			.system_cache_cfg         = 0x0000BA60,
+			.burst_limit              = 0x0000BA64,
+			.addr_status_0            = 0x0000BA68,
+			.addr_status_1            = 0x0000BA6C,
+			.addr_status_2            = 0x0000BA70,
+			.addr_status_3            = 0x0000BA74,
+			.debug_status_cfg         = 0x0000BA78,
+			.debug_status_0           = 0x0000BA7C,
+			.debug_status_1           = 0x0000BA80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 STATS AWB BG */
+		{
+			.cfg                      = 0x0000BB00,
+			.image_addr               = 0x0000BB04,
+			.frame_incr               = 0x0000BB08,
+			.image_cfg_0              = 0x0000BB0C,
+			.image_cfg_1              = 0x0000BB10,
+			.image_cfg_2              = 0x0000BB14,
+			.packer_cfg               = 0x0000BB18,
+			.frame_header_addr        = 0x0000BB20,
+			.frame_header_incr        = 0x0000BB24,
+			.frame_header_cfg         = 0x0000BB28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BB30,
+			.irq_subsample_pattern    = 0x0000BB34,
+			.framedrop_period         = 0x0000BB38,
+			.framedrop_pattern        = 0x0000BB3C,
+			.system_cache_cfg         = 0x0000BB60,
+			.burst_limit              = 0x0000BB64,
+			.addr_status_0            = 0x0000BB68,
+			.addr_status_1            = 0x0000BB6C,
+			.addr_status_2            = 0x0000BB70,
+			.addr_status_3            = 0x0000BB74,
+			.debug_status_cfg         = 0x0000BB78,
+			.debug_status_0           = 0x0000BB7C,
+			.debug_status_1           = 0x0000BB80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 STATS BHIST */
+		{
+			.cfg                      = 0x0000BC00,
+			.image_addr               = 0x0000BC04,
+			.frame_incr               = 0x0000BC08,
+			.image_cfg_0              = 0x0000BC0C,
+			.image_cfg_1              = 0x0000BC10,
+			.image_cfg_2              = 0x0000BC14,
+			.packer_cfg               = 0x0000BC18,
+			.frame_header_addr        = 0x0000BC20,
+			.frame_header_incr        = 0x0000BC24,
+			.frame_header_cfg         = 0x0000BC28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BC30,
+			.irq_subsample_pattern    = 0x0000BC34,
+			.framedrop_period         = 0x0000BC38,
+			.framedrop_pattern        = 0x0000BC3C,
+			.system_cache_cfg         = 0x0000BC60,
+			.burst_limit              = 0x0000BC64,
+			.addr_status_0            = 0x0000BC68,
+			.addr_status_1            = 0x0000BC6C,
+			.addr_status_2            = 0x0000BC70,
+			.addr_status_3            = 0x0000BC74,
+			.debug_status_cfg         = 0x0000BC78,
+			.debug_status_0           = 0x0000BC7C,
+			.debug_status_1           = 0x0000BC80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 STATS RS */
+		{
+			.cfg                      = 0x0000BD00,
+			.image_addr               = 0x0000BD04,
+			.frame_incr               = 0x0000BD08,
+			.image_cfg_0              = 0x0000BD0C,
+			.image_cfg_1              = 0x0000BD10,
+			.image_cfg_2              = 0x0000BD14,
+			.packer_cfg               = 0x0000BD18,
+			.frame_header_addr        = 0x0000BD20,
+			.frame_header_incr        = 0x0000BD24,
+			.frame_header_cfg         = 0x0000BD28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BD30,
+			.irq_subsample_pattern    = 0x0000BD34,
+			.framedrop_period         = 0x0000BD38,
+			.framedrop_pattern        = 0x0000BD3C,
+			.system_cache_cfg         = 0x0000BD60,
+			.burst_limit              = 0x0000BD64,
+			.addr_status_0            = 0x0000BD68,
+			.addr_status_1            = 0x0000BD6C,
+			.addr_status_2            = 0x0000BD70,
+			.addr_status_3            = 0x0000BD74,
+			.debug_status_cfg         = 0x0000BD78,
+			.debug_status_0           = 0x0000BD7C,
+			.debug_status_1           = 0x0000BD80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 STATS CS */
+		{
+			.cfg                      = 0x0000BE00,
+			.image_addr               = 0x0000BE04,
+			.frame_incr               = 0x0000BE08,
+			.image_cfg_0              = 0x0000BE0C,
+			.image_cfg_1              = 0x0000BE10,
+			.image_cfg_2              = 0x0000BE14,
+			.packer_cfg               = 0x0000BE18,
+			.frame_header_addr        = 0x0000BE20,
+			.frame_header_incr        = 0x0000BE24,
+			.frame_header_cfg         = 0x0000BE28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BE30,
+			.irq_subsample_pattern    = 0x0000BE34,
+			.framedrop_period         = 0x0000BE38,
+			.framedrop_pattern        = 0x0000BE3C,
+			.system_cache_cfg         = 0x0000BE60,
+			.burst_limit              = 0x0000BE64,
+			.addr_status_0            = 0x0000BE68,
+			.addr_status_1            = 0x0000BE6C,
+			.addr_status_2            = 0x0000BE70,
+			.addr_status_3            = 0x0000BE74,
+			.debug_status_cfg         = 0x0000BE78,
+			.debug_status_0           = 0x0000BE7C,
+			.debug_status_1           = 0x0000BE80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 STATS IHIST */
+		{
+			.cfg                      = 0x0000BF00,
+			.image_addr               = 0x0000BF04,
+			.frame_incr               = 0x0000BF08,
+			.image_cfg_0              = 0x0000BF0C,
+			.image_cfg_1              = 0x0000BF10,
+			.image_cfg_2              = 0x0000BF14,
+			.packer_cfg               = 0x0000BF18,
+			.frame_header_addr        = 0x0000BF20,
+			.frame_header_incr        = 0x0000BF24,
+			.frame_header_cfg         = 0x0000BF28,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000BF30,
+			.irq_subsample_pattern    = 0x0000BF34,
+			.framedrop_period         = 0x0000BF38,
+			.framedrop_pattern        = 0x0000BF3C,
+			.system_cache_cfg         = 0x0000BF60,
+			.burst_limit              = 0x0000BF64,
+			.addr_status_0            = 0x0000BF68,
+			.addr_status_1            = 0x0000BF6C,
+			.addr_status_2            = 0x0000BF70,
+			.addr_status_3            = 0x0000BF74,
+			.debug_status_cfg         = 0x0000BF78,
+			.debug_status_0           = 0x0000BF7C,
+			.debug_status_1           = 0x0000BF80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 STATS BF */
+		{
+			.cfg                      = 0x0000C000,
+			.image_addr               = 0x0000C004,
+			.frame_incr               = 0x0000C008,
+			.image_cfg_0              = 0x0000C00C,
+			.image_cfg_1              = 0x0000C010,
+			.image_cfg_2              = 0x0000C014,
+			.packer_cfg               = 0x0000C018,
+			.frame_header_addr        = 0x0000C020,
+			.frame_header_incr        = 0x0000C024,
+			.frame_header_cfg         = 0x0000C028,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000C030,
+			.irq_subsample_pattern    = 0x0000C034,
+			.framedrop_period         = 0x0000C038,
+			.framedrop_pattern        = 0x0000C03C,
+			.system_cache_cfg         = 0x0000C060,
+			.burst_limit              = 0x0000C064,
+			.addr_status_0            = 0x0000C068,
+			.addr_status_1            = 0x0000C06C,
+			.addr_status_2            = 0x0000C070,
+			.addr_status_3            = 0x0000C074,
+			.debug_status_cfg         = 0x0000C078,
+			.debug_status_0           = 0x0000C07C,
+			.debug_status_1           = 0x0000C080,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_8,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 21 PDAF V2.0 */
+		{
+			.cfg                      = 0x0000C100,
+			.image_addr               = 0x0000C104,
+			.frame_incr               = 0x0000C108,
+			.image_cfg_0              = 0x0000C10C,
+			.image_cfg_1              = 0x0000C110,
+			.image_cfg_2              = 0x0000C114,
+			.packer_cfg               = 0x0000C118,
+			.frame_header_addr        = 0x0000C120,
+			.frame_header_incr        = 0x0000C124,
+			.frame_header_cfg         = 0x0000C128,
+			.line_done_cfg            = 0x0000C12C,
+			.irq_subsample_period     = 0x0000C130,
+			.irq_subsample_pattern    = 0x0000C134,
+			.framedrop_period         = 0x0000C138,
+			.framedrop_pattern        = 0x0000C13C,
+			.system_cache_cfg         = 0x0000C160,
+			.burst_limit              = 0x0000C164,
+			.addr_status_0            = 0x0000C168,
+			.addr_status_1            = 0x0000C16C,
+			.addr_status_2            = 0x0000C170,
+			.addr_status_3            = 0x0000C174,
+			.debug_status_cfg         = 0x0000C178,
+			.debug_status_0           = 0x0000C17C,
+			.debug_status_1           = 0x0000C180,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_9,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 22 LCR */
+		{
+			.cfg                      = 0x0000C200,
+			.image_addr               = 0x0000C204,
+			.frame_incr               = 0x0000C208,
+			.image_cfg_0              = 0x0000C20C,
+			.image_cfg_1              = 0x0000C210,
+			.image_cfg_2              = 0x0000C214,
+			.packer_cfg               = 0x0000C218,
+			.frame_header_addr        = 0x0000C220,
+			.frame_header_incr        = 0x0000C224,
+			.frame_header_cfg         = 0x0000C228,
+			.line_done_cfg            = 0,
+			.irq_subsample_period     = 0x0000C230,
+			.irq_subsample_pattern    = 0x0000C234,
+			.framedrop_period         = 0x0000C238,
+			.framedrop_pattern        = 0x0000C23C,
+			.system_cache_cfg         = 0x0000C260,
+			.burst_limit              = 0x0000C264,
+			.addr_status_0            = 0x0000C268,
+			.addr_status_1            = 0x0000C26C,
+			.addr_status_2            = 0x0000C270,
+			.addr_status_3            = 0x0000C274,
+			.debug_status_cfg         = 0x0000C278,
+			.debug_status_0           = 0x0000C27C,
+			.debug_status_1           = 0x0000C280,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_10,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 RDI0 */
+		{
+			.cfg                      = 0x0000C300,
+			.image_addr               = 0x0000C304,
+			.frame_incr               = 0x0000C308,
+			.image_cfg_0              = 0x0000C30C,
+			.image_cfg_1              = 0x0000C310,
+			.image_cfg_2              = 0x0000C314,
+			.packer_cfg               = 0x0000C318,
+			.frame_header_addr        = 0x0000C320,
+			.frame_header_incr        = 0x0000C324,
+			.frame_header_cfg         = 0x0000C328,
+			.line_done_cfg            = 0x0000C32C,
+			.irq_subsample_period     = 0x0000C330,
+			.irq_subsample_pattern    = 0x0000C334,
+			.framedrop_period         = 0x0000C338,
+			.framedrop_pattern        = 0x0000C33C,
+			.system_cache_cfg         = 0x0000C360,
+			.burst_limit              = 0x0000C364,
+			.addr_status_0            = 0x0000C368,
+			.addr_status_1            = 0x0000C36C,
+			.addr_status_2            = 0x0000C370,
+			.addr_status_3            = 0x0000C374,
+			.debug_status_cfg         = 0x0000C378,
+			.debug_status_0           = 0x0000C37C,
+			.debug_status_1           = 0x0000C380,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 24 RDI1 */
+		{
+			.cfg                      = 0x0000C400,
+			.image_addr               = 0x0000C404,
+			.frame_incr               = 0x0000C408,
+			.image_cfg_0              = 0x0000C40C,
+			.image_cfg_1              = 0x0000C410,
+			.image_cfg_2              = 0x0000C414,
+			.packer_cfg               = 0x0000C418,
+			.frame_header_addr        = 0x0000C420,
+			.frame_header_incr        = 0x0000C424,
+			.frame_header_cfg         = 0x0000C428,
+			.line_done_cfg            = 0x0000C42C,
+			.irq_subsample_period     = 0x0000C430,
+			.irq_subsample_pattern    = 0x0000C434,
+			.framedrop_period         = 0x0000C438,
+			.framedrop_pattern        = 0x0000C43C,
+			.system_cache_cfg         = 0x0000C460,
+			.burst_limit              = 0x0000C464,
+			.addr_status_0            = 0x0000C468,
+			.addr_status_1            = 0x0000C46C,
+			.addr_status_2            = 0x0000C470,
+			.addr_status_3            = 0x0000C474,
+			.debug_status_cfg         = 0x0000C478,
+			.debug_status_0           = 0x0000C47C,
+			.debug_status_1           = 0x0000C480,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_12,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 25 RDI2 */
+		{
+			.cfg                      = 0x0000C500,
+			.image_addr               = 0x0000C504,
+			.frame_incr               = 0x0000C508,
+			.image_cfg_0              = 0x0000C50C,
+			.image_cfg_1              = 0x0000C510,
+			.image_cfg_2              = 0x0000C514,
+			.packer_cfg               = 0x0000C518,
+			.frame_header_addr        = 0x0000C520,
+			.frame_header_incr        = 0x0000C524,
+			.frame_header_cfg         = 0x0000C528,
+			.line_done_cfg            = 0x0000C52C,
+			.irq_subsample_period     = 0x0000C530,
+			.irq_subsample_pattern    = 0x0000C534,
+			.framedrop_period         = 0x0000C538,
+			.framedrop_pattern        = 0x0000C53C,
+			.system_cache_cfg         = 0x0000C560,
+			.burst_limit              = 0x0000C564,
+			.addr_status_0            = 0x0000C568,
+			.addr_status_1            = 0x0000C56C,
+			.addr_status_2            = 0x0000C570,
+			.addr_status_3            = 0x0000C574,
+			.debug_status_cfg         = 0x0000C578,
+			.debug_status_0           = 0x0000C57C,
+			.debug_status_1           = 0x0000C580,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_13,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 23,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid[0]        = 8,
+			.num_wm        = 1,
+			.wm_idx        = {
+				23,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.mid[0]        = 9,
+			.num_wm        = 1,
+			.wm_idx        = {
+				24,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_5,
+			.mid[0]        = 10,
+			.num_wm        = 1,
+			.wm_idx        = {
+				25,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 32,
+			.mid[1]        = 33,
+			.mid[2]        = 34,
+			.mid[3]        = 35,
+			.num_wm        = 2,
+			.wm_idx        = {
+				0,
+				1,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 16,
+			.num_wm        = 1,
+			.wm_idx        = {
+				2,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 17,
+			.num_wm        = 1,
+			.wm_idx        = {
+				3,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 11,
+			.mid[1]        = 12,
+			.num_wm        = 1,
+			.wm_idx        = {
+				10,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 20,
+			.mid[1]        = 21,
+			.mid[2]        = 22,
+			.num_wm        = 2,
+			.wm_idx        = {
+				8,
+				9,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 25,
+			.mid[1]        = 26,
+			.num_wm        = 1,
+			.wm_idx        = {
+				11,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 40,
+			.num_wm        = 1,
+			.wm_idx        = {
+				12,
+			}
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 41,
+			.num_wm        = 1,
+			.wm_idx        = {
+				13,
+			}
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 42,
+			.num_wm        = 1,
+			.wm_idx        = {
+				14,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 43,
+			.num_wm        = 1,
+			.wm_idx        = {
+				20,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]         = 44,
+			.num_wm        = 1,
+			.wm_idx        = {
+				15,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 45,
+			.num_wm        = 1,
+			.wm_idx        = {
+				16,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 46,
+			.num_wm        = 1,
+			.wm_idx        = {
+				17,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 47,
+			.num_wm        = 1,
+			.wm_idx        = {
+				18,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 48,
+			.num_wm        = 1,
+			.wm_idx        = {
+				19,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 36,
+			.mid[1]        = 37,
+			.mid[2]        = 38,
+			.mid[3]        = 39,
+			.num_wm        = 2,
+			.wm_idx        = {
+				4,
+				5,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 18,
+			.num_wm        = 1,
+			.wm_idx        = {
+				6,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 19,
+			.num_wm        = 1,
+			.wm_idx        = {
+				7,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid[0]        = 23,
+			.mid[1]        = 24,
+			.num_wm        = 1,
+			.wm_idx        = {
+				21,
+			}
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LCR,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid[0]        = 27,
+			.num_wm        = 1,
+			.wm_idx        = {
+				22,
+			}
+		},
+	},
+	.num_comp_grp    = 14,
+	.comp_done_shift = 6,
+	.top_irq_shift   = 7,
+	.support_consumed_addr = true,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 25,
+	.supported_irq =  CAM_VFE_HW_IRQ_CAP_BUF_DONE | CAM_VFE_HW_IRQ_CAP_RUP,
+	.comp_cfg_needed = true,
+};
+
+static struct cam_irq_register_set vfe480_bus_rd_irq_reg[1] = {
+	{
+		.mask_reg_offset   = 0x0000A810,
+		.clear_reg_offset  = 0x0000A814,
+		.status_reg_offset = 0x0000A81C,
+	},
+};
+
+static struct cam_vfe_bus_rd_ver1_hw_info vfe480_bus_rd_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x0000A800,
+		.hw_capability                = 0x0000A804,
+		.sw_reset                     = 0x0000A808,
+		.cgc_ovd                      = 0x0000A80C,
+		.pwr_iso_cfg                  = 0x0000A834,
+		.input_if_cmd                 = 0x0000A820,
+		.test_bus_ctrl                = 0x0000A848,
+		.irq_reg_info = {
+			.num_registers        = 1,
+			.irq_reg_set          = vfe480_bus_rd_irq_reg,
+			.global_clear_offset  = 0x0000A818,
+			.global_clear_bitmask = 0x00000001,
+		},
+	},
+	.num_client = 1,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.cfg                      = 0x0000A850,
+			.image_addr               = 0x0000A858,
+			.buf_size                 = 0x0000A85C,
+			.stride                   = 0x0000A860,
+			.unpacker_cfg             = 0x0000A864,
+			.latency_buf_allocation   = 0x0000A878,
+			.burst_limit              = 0x0000A880,
+		},
+	},
+	.num_bus_rd_resc = 1,
+	.vfe_bus_rd_hw_info = {
+		{
+			.vfe_bus_rd_type = CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 8,
+};
+
+static struct cam_vfe_hw_info cam_vfe480_hw_info = {
+	.irq_reg_info                  = &vfe480_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe480_bus_hw_info,
+
+	.bus_rd_version                = CAM_VFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &vfe480_bus_rd_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_3_0,
+	.top_hw_info                   = &vfe480_top_hw_info,
+};
+
+#endif /* _CAM_VFE480_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe580.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe580.h
@@ -0,0 +1,121 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE580_H_
+#define _CAM_VFE580_H_
+#include "cam_vfe480.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_core.h"
+
+static struct cam_vfe_camif_ver3_reg_data vfe_580_camif_reg_data = {
+	.pp_extern_reg_update_shift      = 4,
+	.dual_pd_extern_reg_update_shift = 17,
+	.extern_reg_update_mask          = 1,
+	.dual_ife_pix_en_shift           = 3,
+	.dual_ife_sync_sel_shift         = 18,
+	.operating_mode_shift            = 11,
+	.input_mux_sel_shift             = 5,
+	.pixel_pattern_shift             = 24,
+	.pixel_pattern_mask              = 0x7,
+	.dsp_mode_shift                  = 24,
+	.dsp_mode_mask                   = 0x1,
+	.dsp_en_shift                    = 23,
+	.dsp_en_mask                     = 0x1,
+	.reg_update_cmd_data             = 0x41,
+	.epoch_line_cfg                  = 0x00000014,
+	.sof_irq_mask                    = 0x00000001,
+	.epoch0_irq_mask                 = 0x00000004,
+	.epoch1_irq_mask                 = 0x00000008,
+	.eof_irq_mask                    = 0x00000002,
+	.error_irq_mask0                 = 0x82000200,
+	.error_irq_mask2                 = 0x30301F80,
+	.subscribe_irq_mask1             = 0x00000007,
+	.enable_diagnostic_hw            = 0x1,
+	.pp_camif_cfg_en_shift           = 0,
+	.pp_camif_cfg_ife_out_en_shift   = 8,
+	.top_debug_cfg_en                = 1,
+	.dual_vfe_sync_mask              = 0x3,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe580_camif_rdi1_reg_data = {
+	.extern_reg_update_shift         = 0,
+	.input_mux_sel_shift             = 7,
+	.reg_update_cmd_data             = 0x4,
+	.epoch_line_cfg                  = 0x0,
+	.sof_irq_mask                    = 0x100,
+	.epoch0_irq_mask                 = 0x400,
+	.epoch1_irq_mask                 = 0x800,
+	.eof_irq_mask                    = 0x200,
+	.error_irq_mask0                 = 0x10000000,
+	.error_irq_mask2                 = 0x40000,
+	.subscribe_irq_mask1             = 0x300,
+	.enable_diagnostic_hw            = 0x1,
+};
+
+struct cam_vfe_camif_lite_ver3_hw_info
+	vfe580_rdi_hw_info_arr[CAM_VFE_RDI_VER2_MAX] = {
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[0],
+		.reg_data       = &vfe480_camif_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[1],
+		.reg_data       = &vfe580_camif_rdi1_reg_data,
+	},
+	{
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_rdi[2],
+		.reg_data       = &vfe480_camif_rdi_reg_data[2],
+	},
+};
+
+static struct cam_vfe_top_ver3_hw_info vfe580_top_hw_info = {
+	.common_reg = &vfe480_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_reg      = &vfe480_camif_reg,
+		.reg_data       = &vfe_580_camif_reg_data,
+		},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_pd,
+		.reg_data       = &vfe480_camif_pd_reg_data,
+		},
+	.rdi_hw_info[0] = &vfe580_rdi_hw_info_arr[0],
+	.rdi_hw_info[1] = &vfe580_rdi_hw_info_arr[1],
+	.rdi_hw_info[2] = &vfe580_rdi_hw_info_arr[2],
+	.lcr_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_lcr,
+		.reg_data       = &vfe480_camif_lcr_reg_data,
+		},
+	.num_mux = 6,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_3_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_LCR_VER_1_0,
+	},
+};
+
+static struct cam_vfe_hw_info cam_vfe580_hw_info = {
+	.irq_reg_info                  = &vfe480_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe480_bus_hw_info,
+
+	.bus_rd_version                = CAM_VFE_BUS_RD_VER_1_0,
+	.bus_rd_hw_info                = &vfe480_bus_rd_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_3_0,
+	.top_hw_info                   = &vfe580_top_hw_info,
+};
+
+#endif /* _CAM_VFE580_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe680.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe680.h
@@ -0,0 +1,1317 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE680_H_
+#define _CAM_VFE680_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+static struct cam_irq_register_set vfe680_top_irq_reg_set[3] = {
+	{
+		.mask_reg_offset   = 0x00000034,
+		.clear_reg_offset  = 0x0000003c,
+		.status_reg_offset = 0x00000044,
+	},
+	{
+		.mask_reg_offset   = 0x00000038,
+		.clear_reg_offset  = 0x00000040,
+		.status_reg_offset = 0x00000048,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe680_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe680_top_irq_reg_set,
+	.global_clear_offset  = 0x00000030,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_top_ver3_reg_offset_common vfe680_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.core_cfg_0               = 0x00000024,
+	.core_cfg_1               = 0x00000028,
+	.core_cfg_2               = 0x0000002C,
+	.global_reset_cmd         = 0x00000030,
+	.diag_config              = 0x00000050,
+	.diag_sensor_status_0     = 0x00000054,
+	.diag_sensor_status_1     = 0x00000058,
+	.diag_frm_cnt_status_0    = 0x0000005C,
+	.diag_frm_cnt_status_1    = 0x00000060,
+	.violation_status         = 0x00000064,
+	.core_cfg_3               = 0x00000068,
+	.core_cgc_ovd_0           = 0x00000018,
+	.core_cgc_ovd_1           = 0x0000001C,
+	.ahb_cgc_ovd              = 0x00000020,
+	.dsp_status               = 0x0000006C,
+	.stats_throttle_cfg_0     = 0x00000070,
+	.stats_throttle_cfg_1     = 0x00000074,
+	.stats_throttle_cfg_2     = 0x00000078,
+	.core_cfg_4               = 0x00000080,
+	.core_cfg_5               = 0x00000084,
+	.core_cfg_6               = 0x00000088,
+	.period_cfg               = 0x0000008C,
+	.irq_sub_pattern_cfg      = 0x00000090,
+	.epoch0_pattern_cfg       = 0x00000094,
+	.epoch1_pattern_cfg       = 0x00000098,
+	.epoch_height_cfg         = 0x0000009C,
+	.bus_overflow_status      = 0x0000AA68,
+	.top_debug_cfg            = 0x000000FC,
+	.top_debug_0              = 0x000000A0,
+	.top_debug_1              = 0x000000A4,
+	.top_debug_2              = 0x000000A8,
+	.top_debug_3              = 0x000000AC,
+	.top_debug_4              = 0x000000B0,
+	.top_debug_5              = 0x000000B4,
+	.top_debug_6              = 0x000000B8,
+	.top_debug_7              = 0x000000BC,
+	.top_debug_8              = 0x000000C0,
+	.top_debug_9              = 0x000000C4,
+	.top_debug_10             = 0x000000C8,
+	.top_debug_11             = 0x000000CC,
+	.top_debug_12             = 0x000000D0,
+	.top_debug_13             = 0x000000D4,
+	.top_debug_14             = 0x000000D8,
+	.top_debug_15             = 0x000000DC,
+	.top_debug_16             = 0x000000E0,
+};
+
+
+static struct cam_vfe_top_ver3_hw_info vfe680_top_hw_info = {
+	.common_reg = &vfe480_top_common_reg,
+	.camif_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_reg      = &vfe480_camif_reg,
+		.reg_data       = &vfe_480_camif_reg_data,
+		},
+	.pdlib_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_pd,
+		.reg_data       = &vfe480_camif_pd_reg_data,
+		},
+	.rdi_hw_info[0] = &rdi_hw_info_arr[0],
+	.rdi_hw_info[1] = &rdi_hw_info_arr[1],
+	.rdi_hw_info[2] = &rdi_hw_info_arr[2],
+	.lcr_hw_info = {
+		.common_reg     = &vfe480_top_common_reg,
+		.camif_lite_reg = &vfe480_camif_lcr,
+		.reg_data       = &vfe480_camif_lcr_reg_data,
+		},
+	.num_mux = 6,
+	.mux_type = {
+		CAM_VFE_CAMIF_VER_3_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_PDLIB_VER_1_0,
+		CAM_VFE_LCR_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set vfe680_bus_irq_reg[2] = {
+		{
+			.mask_reg_offset   = 0x00000C18,
+			.clear_reg_offset  = 0x00000C20,
+			.status_reg_offset = 0x00000C28,
+		},
+		{
+			.mask_reg_offset   = 0x00000C1C,
+			.clear_reg_offset  = 0x00000C24,
+			.status_reg_offset = 0x00000C2C,
+		},
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe680_ubwc_regs_client_0 = {
+	.meta_addr        = 0x00000E40,
+	.meta_cfg         = 0x00000E44,
+	.mode_cfg         = 0x00000E48,
+	.stats_ctrl       = 0x00000E4C,
+	.ctrl_2           = 0x00000E50,
+	.lossy_thresh0    = 0x00000E54,
+	.lossy_thresh1    = 0x00000E58,
+	.off_lossy_var    = 0x00000E5C,
+	.bw_limit         = 0x00000E1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe680_ubwc_regs_client_1 = {
+	.meta_addr        = 0x00000F40,
+	.meta_cfg         = 0x00000F44,
+	.mode_cfg         = 0x00000F48,
+	.stats_ctrl       = 0x00000F4C,
+	.ctrl_2           = 0x00000F50,
+	.lossy_thresh0    = 0x00000F54,
+	.lossy_thresh1    = 0x00000F58,
+	.off_lossy_var    = 0x00000F5C,
+	.bw_limit         = 0x00000F1C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe680_ubwc_regs_client_4 = {
+	.meta_addr        = 0x00001240,
+	.meta_cfg         = 0x00001244,
+	.mode_cfg         = 0x00001248,
+	.stats_ctrl       = 0x0000124C,
+	.ctrl_2           = 0x00001250,
+	.lossy_thresh0    = 0x00001254,
+	.lossy_thresh1    = 0x00001258,
+	.off_lossy_var    = 0x0000125C,
+	.bw_limit         = 0x0000121C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_reg_offset_ubwc_client
+	vfe680_ubwc_regs_client_5 = {
+	.meta_addr        = 0x00001340,
+	.meta_cfg         = 0x00001344,
+	.mode_cfg         = 0x00001348,
+	.stats_ctrl       = 0x0000134C,
+	.ctrl_2           = 0x00001350,
+	.lossy_thresh0    = 0x00001354,
+	.lossy_thresh1    = 0x00001358,
+	.off_lossy_var    = 0x0000135C,
+	.bw_limit         = 0x0000131C,
+	.ubwc_comp_en_bit = BIT(1),
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe680_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000C00,
+		.cgc_ovd                          = 0x00000C08,
+		.if_frameheader_cfg               = {
+			0x00000C34,
+			0x00000C38,
+			0x00000C3C,
+			0x00000C40,
+			0x00000C44,
+			0x00000C48,
+		},
+		.ubwc_static_ctrl                 = 0x00000C58,
+		.pwr_iso_cfg                      = 0x00000C5C,
+		.overflow_status_clear            = 0x00000C60,
+		.ccif_violation_status            = 0x00000C64,
+		.overflow_status                  = 0x00000C68,
+		.image_size_violation_status      = 0x00000C70,
+		.debug_status_top_cfg             = 0x00000CD4,
+		.debug_status_top                 = 0x00000CD8,
+		.test_bus_ctrl                    = 0x00000CDC,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe680_bus_irq_reg,
+			.global_clear_offset      = 0x00000C30,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = CAM_VFE_BUS_VER3_680_MAX_CLIENTS,
+	.bus_client_reg = {
+		/* BUS Client 0 FULL Y */
+		{
+			.cfg                      = 0x00000E00,
+			.image_addr               = 0x00000E04,
+			.frame_incr               = 0x00000E08,
+			.image_cfg_0              = 0x00000E0C,
+			.image_cfg_1              = 0x00000E10,
+			.image_cfg_2              = 0x00000E14,
+			.packer_cfg               = 0x00000E18,
+			.frame_header_addr        = 0x00000E20,
+			.frame_header_incr        = 0x00000E24,
+			.frame_header_cfg         = 0x00000E28,
+			.irq_subsample_period     = 0x00000E30,
+			.irq_subsample_pattern    = 0x00000E34,
+			.framedrop_period         = 0x00000E38,
+			.framedrop_pattern        = 0x00000E3C,
+			.mmu_prefetch_cfg         = 0x00000E60,
+			.mmu_prefetch_max_offset  = 0x00000E64,
+			.system_cache_cfg         = 0x00000E68,
+			.addr_status_0            = 0x00000E70,
+			.addr_status_1            = 0x00000E74,
+			.addr_status_2            = 0x00000E78,
+			.addr_status_3            = 0x00000E7C,
+			.debug_status_cfg         = 0x00000E80,
+			.debug_status_0           = 0x00000E84,
+			.debug_status_1           = 0x00000E88,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe680_ubwc_regs_client_0,
+		},
+		/* BUS Client 1 FULL C */
+		{
+			.cfg                      = 0x00000F00,
+			.image_addr               = 0x00000F04,
+			.frame_incr               = 0x00000F08,
+			.image_cfg_0              = 0x00000F0C,
+			.image_cfg_1              = 0x00000F10,
+			.image_cfg_2              = 0x00000F14,
+			.packer_cfg               = 0x00000F18,
+			.frame_header_addr        = 0x00000F20,
+			.frame_header_incr        = 0x00000F24,
+			.frame_header_cfg         = 0x00000F28,
+			.irq_subsample_period     = 0x00000F30,
+			.irq_subsample_pattern    = 0x00000F34,
+			.framedrop_period         = 0x00000F38,
+			.framedrop_pattern        = 0x00000F3C,
+			.mmu_prefetch_cfg         = 0x00000F60,
+			.mmu_prefetch_max_offset  = 0x00000F64,
+			.system_cache_cfg         = 0x00000F68,
+			.addr_status_0            = 0x00000F70,
+			.addr_status_1            = 0x00000F74,
+			.addr_status_2            = 0x00000F78,
+			.addr_status_3            = 0x00000F7C,
+			.debug_status_cfg         = 0x00000F80,
+			.debug_status_0           = 0x00000F84,
+			.debug_status_1           = 0x00000F88,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = &vfe680_ubwc_regs_client_1,
+		},
+		/* BUS Client 2 DS4 */
+		{
+			.cfg                      = 0x00001000,
+			.image_addr               = 0x00001004,
+			.frame_incr               = 0x00001008,
+			.image_cfg_0              = 0x0000100C,
+			.image_cfg_1              = 0x00001010,
+			.image_cfg_2              = 0x00001014,
+			.packer_cfg               = 0x00001018,
+			.irq_subsample_period     = 0x00001030,
+			.irq_subsample_pattern    = 0x00001034,
+			.framedrop_period         = 0x00001038,
+			.framedrop_pattern        = 0x0000103C,
+			.mmu_prefetch_cfg         = 0x00001060,
+			.mmu_prefetch_max_offset  = 0x00001064,
+			.system_cache_cfg         = 0x00001068,
+			.addr_status_0            = 0x00001070,
+			.addr_status_1            = 0x00001074,
+			.addr_status_2            = 0x00001078,
+			.addr_status_3            = 0x0000107C,
+			.debug_status_cfg         = 0x00001080,
+			.debug_status_0           = 0x00001084,
+			.debug_status_1           = 0x00001088,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 DS16 */
+		{
+			.cfg                      = 0x00001100,
+			.image_addr               = 0x00001104,
+			.frame_incr               = 0x00001108,
+			.image_cfg_0              = 0x0000110C,
+			.image_cfg_1              = 0x00001110,
+			.image_cfg_2              = 0x00001114,
+			.packer_cfg               = 0x00001118,
+			.irq_subsample_period     = 0x00001130,
+			.irq_subsample_pattern    = 0x00001134,
+			.framedrop_period         = 0x00001138,
+			.framedrop_pattern        = 0x0000113C,
+			.mmu_prefetch_cfg         = 0x00001160,
+			.mmu_prefetch_max_offset  = 0x00001164,
+			.system_cache_cfg         = 0x00001168,
+			.addr_status_0            = 0x00001170,
+			.addr_status_1            = 0x00001174,
+			.addr_status_2            = 0x00001178,
+			.addr_status_3            = 0x0000117C,
+			.debug_status_cfg         = 0x00001180,
+			.debug_status_0           = 0x00001184,
+			.debug_status_1           = 0x00001188,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 DISP Y */
+		{
+			.cfg                      = 0x00001200,
+			.image_addr               = 0x00001204,
+			.frame_incr               = 0x00001208,
+			.image_cfg_0              = 0x0000120C,
+			.image_cfg_1              = 0x00001210,
+			.image_cfg_2              = 0x00001214,
+			.packer_cfg               = 0x00001218,
+			.frame_header_addr        = 0x00001220,
+			.frame_header_incr        = 0x00001224,
+			.frame_header_cfg         = 0x00001228,
+			.irq_subsample_period     = 0x00001230,
+			.irq_subsample_pattern    = 0x00001234,
+			.framedrop_period         = 0x00001238,
+			.framedrop_pattern        = 0x0000123C,
+			.mmu_prefetch_cfg         = 0x00001260,
+			.mmu_prefetch_max_offset  = 0x00001264,
+			.system_cache_cfg         = 0x00001268,
+			.addr_status_0            = 0x00001270,
+			.addr_status_1            = 0x00001274,
+			.addr_status_2            = 0x00001278,
+			.addr_status_3            = 0x0000127C,
+			.debug_status_cfg         = 0x00001280,
+			.debug_status_0           = 0x00001284,
+			.debug_status_1           = 0x00001288,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe680_ubwc_regs_client_4,
+		},
+		/* BUS Client 5 DISP C */
+		{
+			.cfg                      = 0x00001300,
+			.image_addr               = 0x00001304,
+			.frame_incr               = 0x00001308,
+			.image_cfg_0              = 0x0000130C,
+			.image_cfg_1              = 0x00001310,
+			.image_cfg_2              = 0x00001314,
+			.packer_cfg               = 0x00001318,
+			.frame_header_addr        = 0x00001320,
+			.frame_header_incr        = 0x00001324,
+			.frame_header_cfg         = 0x00001328,
+			.irq_subsample_period     = 0x00001330,
+			.irq_subsample_pattern    = 0x00001334,
+			.framedrop_period         = 0x00001338,
+			.framedrop_pattern        = 0x0000133C,
+			.mmu_prefetch_cfg         = 0x00001360,
+			.mmu_prefetch_max_offset  = 0x00001364,
+			.system_cache_cfg         = 0x00001368,
+			.addr_status_0            = 0x00001370,
+			.addr_status_1            = 0x00001374,
+			.addr_status_2            = 0x00001378,
+			.addr_status_3            = 0x0000137C,
+			.debug_status_cfg         = 0x00001380,
+			.debug_status_0           = 0x00001384,
+			.debug_status_1           = 0x00001388,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = &vfe680_ubwc_regs_client_5,
+		},
+		/* BUS Client 6 DISP DS4 */
+		{
+			.cfg                      = 0x00001400,
+			.image_addr               = 0x00001404,
+			.frame_incr               = 0x00001408,
+			.image_cfg_0              = 0x0000140C,
+			.image_cfg_1              = 0x00001410,
+			.image_cfg_2              = 0x00001414,
+			.packer_cfg               = 0x00001418,
+			.irq_subsample_period     = 0x00001430,
+			.irq_subsample_pattern    = 0x00001434,
+			.framedrop_period         = 0x00001438,
+			.framedrop_pattern        = 0x0000143C,
+			.mmu_prefetch_cfg         = 0x00001460,
+			.mmu_prefetch_max_offset  = 0x00001464,
+			.system_cache_cfg         = 0x00001468,
+			.addr_status_0            = 0x00001470,
+			.addr_status_1            = 0x00001474,
+			.addr_status_2            = 0x00001478,
+			.addr_status_3            = 0x0000147C,
+			.debug_status_cfg         = 0x00001480,
+			.debug_status_0           = 0x00001484,
+			.debug_status_1           = 0x00001488,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 7 DISP DS16 */
+		{
+			.cfg                      = 0x00001500,
+			.image_addr               = 0x00001504,
+			.frame_incr               = 0x00001508,
+			.image_cfg_0              = 0x0000150C,
+			.image_cfg_1              = 0x00001510,
+			.image_cfg_2              = 0x00001514,
+			.packer_cfg               = 0x00001518,
+			.irq_subsample_period     = 0x00001530,
+			.irq_subsample_pattern    = 0x00001534,
+			.framedrop_period         = 0x00001538,
+			.framedrop_pattern        = 0x0000153C,
+			.mmu_prefetch_cfg         = 0x00001560,
+			.mmu_prefetch_max_offset  = 0x00001564,
+			.system_cache_cfg         = 0x00001568,
+			.addr_status_0            = 0x00001570,
+			.addr_status_1            = 0x00001574,
+			.addr_status_2            = 0x00001578,
+			.addr_status_3            = 0x0000157C,
+			.debug_status_cfg         = 0x00001580,
+			.debug_status_0           = 0x00001584,
+			.debug_status_1           = 0x00001588,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 8 FD Y */
+		{
+			.cfg                      = 0x00001600,
+			.image_addr               = 0x00001604,
+			.frame_incr               = 0x00001608,
+			.image_cfg_0              = 0x0000160C,
+			.image_cfg_1              = 0x00001610,
+			.image_cfg_2              = 0x00001614,
+			.packer_cfg               = 0x00001618,
+			.frame_header_addr        = 0x00001620,
+			.frame_header_incr        = 0x00001624,
+			.frame_header_cfg         = 0x00001628,
+			.irq_subsample_period     = 0x00001630,
+			.irq_subsample_pattern    = 0x00001634,
+			.framedrop_period         = 0x00001638,
+			.framedrop_pattern        = 0x0000163C,
+			.mmu_prefetch_cfg         = 0x00001660,
+			.mmu_prefetch_max_offset  = 0x00001664,
+			.system_cache_cfg         = 0x00001668,
+			.addr_status_0            = 0x00001670,
+			.addr_status_1            = 0x00001674,
+			.addr_status_2            = 0x00001678,
+			.addr_status_3            = 0x0000167C,
+			.debug_status_cfg         = 0x00001680,
+			.debug_status_0           = 0x00001684,
+			.debug_status_1           = 0x00001688,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 9 FD C */
+		{
+			.cfg                      = 0x00001700,
+			.image_addr               = 0x00001704,
+			.frame_incr               = 0x00001708,
+			.image_cfg_0              = 0x0000170C,
+			.image_cfg_1              = 0x00001710,
+			.image_cfg_2              = 0x00001714,
+			.packer_cfg               = 0x00001718,
+			.irq_subsample_period     = 0x00001730,
+			.irq_subsample_pattern    = 0x00001734,
+			.framedrop_period         = 0x00001738,
+			.framedrop_pattern        = 0x0000173C,
+			.mmu_prefetch_cfg         = 0x00001760,
+			.mmu_prefetch_max_offset  = 0x00001764,
+			.system_cache_cfg         = 0x00001768,
+			.addr_status_0            = 0x00001770,
+			.addr_status_1            = 0x00001774,
+			.addr_status_2            = 0x00001778,
+			.addr_status_3            = 0x0000177C,
+			.debug_status_cfg         = 0x00001780,
+			.debug_status_0           = 0x00001784,
+			.debug_status_1           = 0x00001788,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 10 PIXEL RAW */
+		{
+			.cfg                      = 0x00001800,
+			.image_addr               = 0x00001804,
+			.frame_incr               = 0x00001808,
+			.image_cfg_0              = 0x0000180C,
+			.image_cfg_1              = 0x00001810,
+			.image_cfg_2              = 0x00001814,
+			.packer_cfg               = 0x00001818,
+			.frame_header_addr        = 0x00001820,
+			.frame_header_incr        = 0x00001824,
+			.frame_header_cfg         = 0x00001828,
+			.irq_subsample_period     = 0x00001830,
+			.irq_subsample_pattern    = 0x00001834,
+			.framedrop_period         = 0x00001838,
+			.framedrop_pattern        = 0x0000183C,
+			.mmu_prefetch_cfg         = 0x00001860,
+			.mmu_prefetch_max_offset  = 0x00001864,
+			.system_cache_cfg         = 0x00001868,
+			.addr_status_0            = 0x00001870,
+			.addr_status_1            = 0x00001874,
+			.addr_status_2            = 0x00001878,
+			.addr_status_3            = 0x0000187C,
+			.debug_status_cfg         = 0x00001880,
+			.debug_status_0           = 0x00001884,
+			.debug_status_1           = 0x00001888,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 11 STATS BE 0 */
+		{
+			.cfg                      = 0x00001900,
+			.image_addr               = 0x00001904,
+			.frame_incr               = 0x00001908,
+			.image_cfg_0              = 0x0000190C,
+			.image_cfg_1              = 0x00001910,
+			.image_cfg_2              = 0x00001914,
+			.packer_cfg               = 0x00001918,
+			.frame_header_addr        = 0x00001920,
+			.frame_header_incr        = 0x00001924,
+			.frame_header_cfg         = 0x00001928,
+			.irq_subsample_period     = 0x00001930,
+			.irq_subsample_pattern    = 0x00001934,
+			.framedrop_period         = 0x00001938,
+			.framedrop_pattern        = 0x0000193C,
+			.mmu_prefetch_cfg         = 0x00001960,
+			.mmu_prefetch_max_offset  = 0x00001964,
+			.system_cache_cfg         = 0x00001968,
+			.addr_status_0            = 0x00001970,
+			.addr_status_1            = 0x00001974,
+			.addr_status_2            = 0x00001978,
+			.addr_status_3            = 0x0000197C,
+			.debug_status_cfg         = 0x00001980,
+			.debug_status_0           = 0x00001984,
+			.debug_status_1           = 0x00001988,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 12 STATS BHIST 0 */
+		{
+			.cfg                      = 0x00001A00,
+			.image_addr               = 0x00001A04,
+			.frame_incr               = 0x00001A08,
+			.image_cfg_0              = 0x00001A0C,
+			.image_cfg_1              = 0x00001A10,
+			.image_cfg_2              = 0x00001A14,
+			.packer_cfg               = 0x00001A18,
+			.frame_header_addr        = 0x00001A20,
+			.frame_header_incr        = 0x00001A24,
+			.frame_header_cfg         = 0x00001A28,
+			.irq_subsample_period     = 0x00001A30,
+			.irq_subsample_pattern    = 0x00001A34,
+			.framedrop_period         = 0x00001A38,
+			.framedrop_pattern        = 0x00001A3C,
+			.mmu_prefetch_cfg         = 0x00001A60,
+			.mmu_prefetch_max_offset  = 0x00001A64,
+			.system_cache_cfg         = 0x00001A68,
+			.addr_status_0            = 0x00001A70,
+			.addr_status_1            = 0x00001A74,
+			.addr_status_2            = 0x00001A78,
+			.addr_status_3            = 0x00001A7C,
+			.debug_status_cfg         = 0x00001A80,
+			.debug_status_0           = 0x00001A84,
+			.debug_status_1           = 0x00001A88,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 13 STATS TINTLESS BG */
+		{
+			.cfg                      = 0x00001B00,
+			.image_addr               = 0x00001B04,
+			.frame_incr               = 0x00001B08,
+			.image_cfg_0              = 0x00001B0C,
+			.image_cfg_1              = 0x00001B10,
+			.image_cfg_2              = 0x00001B14,
+			.packer_cfg               = 0x00001B18,
+			.frame_header_addr        = 0x00001B20,
+			.frame_header_incr        = 0x00001B24,
+			.frame_header_cfg         = 0x00001B28,
+			.irq_subsample_period     = 0x00001B30,
+			.irq_subsample_pattern    = 0x00001B34,
+			.framedrop_period         = 0x00001B38,
+			.framedrop_pattern        = 0x00001B3C,
+			.mmu_prefetch_cfg         = 0x00001B60,
+			.mmu_prefetch_max_offset  = 0x00001B64,
+			.system_cache_cfg         = 0x00001B68,
+			.addr_status_0            = 0x00001B70,
+			.addr_status_1            = 0x00001B74,
+			.addr_status_2            = 0x00001B78,
+			.addr_status_3            = 0x00001B7C,
+			.debug_status_cfg         = 0x00001B80,
+			.debug_status_0           = 0x00001B84,
+			.debug_status_1           = 0x00001B88,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_5,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 14 STATS AWB BG */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.framedrop_period         = 0x00001C38,
+			.framedrop_pattern        = 0x00001C3C,
+			.mmu_prefetch_cfg         = 0x00001C60,
+			.mmu_prefetch_max_offset  = 0x00001C64,
+			.system_cache_cfg         = 0x00001C68,
+			.addr_status_0            = 0x00001C70,
+			.addr_status_1            = 0x00001C74,
+			.addr_status_2            = 0x00001C78,
+			.addr_status_3            = 0x00001C7C,
+			.debug_status_cfg         = 0x00001C80,
+			.debug_status_0           = 0x00001C84,
+			.debug_status_1           = 0x00001C88,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 15 STATS AWB BFW */
+		{
+			.cfg                      = 0x00001D00,
+			.image_addr               = 0x00001D04,
+			.frame_incr               = 0x00001D08,
+			.image_cfg_0              = 0x00001D0C,
+			.image_cfg_1              = 0x00001D10,
+			.image_cfg_2              = 0x00001D14,
+			.packer_cfg               = 0x00001D18,
+			.frame_header_addr        = 0x00001D20,
+			.frame_header_incr        = 0x00001D24,
+			.frame_header_cfg         = 0x00001D28,
+			.irq_subsample_period     = 0x00001D30,
+			.irq_subsample_pattern    = 0x00001D34,
+			.framedrop_period         = 0x00001D38,
+			.framedrop_pattern        = 0x00001D3C,
+			.mmu_prefetch_cfg         = 0x00001D60,
+			.mmu_prefetch_max_offset  = 0x00001D64,
+			.system_cache_cfg         = 0x00001D68,
+			.addr_status_0            = 0x00001D70,
+			.addr_status_1            = 0x00001D74,
+			.addr_status_2            = 0x00001D78,
+			.addr_status_3            = 0x00001D7C,
+			.debug_status_cfg         = 0x00001D80,
+			.debug_status_0           = 0x00001D84,
+			.debug_status_1           = 0x00001D88,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_6,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 16 STATS BAF */
+		{
+			.cfg                      = 0x00001E00,
+			.image_addr               = 0x00001E04,
+			.frame_incr               = 0x00001E08,
+			.image_cfg_0              = 0x00001E0C,
+			.image_cfg_1              = 0x00001E10,
+			.image_cfg_2              = 0x00001E14,
+			.packer_cfg               = 0x00001E18,
+			.frame_header_addr        = 0x00001E20,
+			.frame_header_incr        = 0x00001E24,
+			.frame_header_cfg         = 0x00001E28,
+			.irq_subsample_period     = 0x00001E30,
+			.irq_subsample_pattern    = 0x00001E34,
+			.framedrop_period         = 0x00001E38,
+			.framedrop_pattern        = 0x00001E3C,
+			.mmu_prefetch_cfg         = 0x00001E60,
+			.mmu_prefetch_max_offset  = 0x00001E64,
+			.system_cache_cfg         = 0x00001E68,
+			.addr_status_0            = 0x00001E70,
+			.addr_status_1            = 0x00001E74,
+			.addr_status_2            = 0x00001E78,
+			.addr_status_3            = 0x00001E7C,
+			.debug_status_cfg         = 0x00001E80,
+			.debug_status_0           = 0x00001E84,
+			.debug_status_1           = 0x00001E88,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_7,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 17 STATS BHIST */
+		{
+			.cfg                      = 0x00001F00,
+			.image_addr               = 0x00001F04,
+			.frame_incr               = 0x00001F08,
+			.image_cfg_0              = 0x00001F0C,
+			.image_cfg_1              = 0x00001F10,
+			.image_cfg_2              = 0x00001F14,
+			.packer_cfg               = 0x00001F18,
+			.frame_header_addr        = 0x00001F20,
+			.frame_header_incr        = 0x00001F24,
+			.frame_header_cfg         = 0x00001F28,
+			.irq_subsample_period     = 0x00001F30,
+			.irq_subsample_pattern    = 0x00001F34,
+			.framedrop_period         = 0x00001F38,
+			.framedrop_pattern        = 0x00001F3C,
+			.mmu_prefetch_cfg         = 0x00001F60,
+			.mmu_prefetch_max_offset  = 0x00001F64,
+			.system_cache_cfg         = 0x00001F68,
+			.addr_status_0            = 0x00001F70,
+			.addr_status_1            = 0x00001F74,
+			.addr_status_2            = 0x00001F78,
+			.addr_status_3            = 0x00001F7C,
+			.debug_status_cfg         = 0x00001F80,
+			.debug_status_0           = 0x00001F84,
+			.debug_status_1           = 0x00001F88,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_8,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 18 STATS RS */
+		{
+			.cfg                      = 0x00002000,
+			.image_addr               = 0x00002004,
+			.frame_incr               = 0x00002008,
+			.image_cfg_0              = 0x0000200C,
+			.image_cfg_1              = 0x00002010,
+			.image_cfg_2              = 0x00002014,
+			.packer_cfg               = 0x00002018,
+			.frame_header_addr        = 0x00002020,
+			.frame_header_incr        = 0x00002024,
+			.frame_header_cfg         = 0x00002028,
+			.irq_subsample_period     = 0x00002030,
+			.irq_subsample_pattern    = 0x00002034,
+			.framedrop_period         = 0x00002038,
+			.framedrop_pattern        = 0x0000203C,
+			.mmu_prefetch_cfg         = 0x00002060,
+			.mmu_prefetch_max_offset  = 0x00002064,
+			.system_cache_cfg         = 0x00002068,
+			.addr_status_0            = 0x00002070,
+			.addr_status_1            = 0x00002074,
+			.addr_status_2            = 0x00002078,
+			.addr_status_3            = 0x0000207C,
+			.debug_status_cfg         = 0x00002080,
+			.debug_status_0           = 0x00002084,
+			.debug_status_1           = 0x00002088,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_9,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 19 STATS IHIST */
+		{
+			.cfg                      = 0x00002100,
+			.image_addr               = 0x00002104,
+			.frame_incr               = 0x00002108,
+			.image_cfg_0              = 0x0000210C,
+			.image_cfg_1              = 0x00002110,
+			.image_cfg_2              = 0x00002114,
+			.packer_cfg               = 0x00002118,
+			.frame_header_addr        = 0x00002120,
+			.frame_header_incr        = 0x00002124,
+			.frame_header_cfg         = 0x00002128,
+			.irq_subsample_period     = 0x00002130,
+			.irq_subsample_pattern    = 0x00002134,
+			.framedrop_period         = 0x00002138,
+			.framedrop_pattern        = 0x0000213C,
+			.mmu_prefetch_cfg         = 0x00002160,
+			.mmu_prefetch_max_offset  = 0x00002164,
+			.system_cache_cfg         = 0x00002168,
+			.addr_status_0            = 0x00002170,
+			.addr_status_1            = 0x00002174,
+			.addr_status_2            = 0x00002178,
+			.addr_status_3            = 0x0000217C,
+			.debug_status_cfg         = 0x00002180,
+			.debug_status_0           = 0x00002184,
+			.debug_status_1           = 0x00002188,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_10,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 20 CAMIF PD - PDAF */
+		{
+			.cfg                      = 0x00002200,
+			.image_addr               = 0x00002204,
+			.frame_incr               = 0x00002208,
+			.image_cfg_0              = 0x0000220C,
+			.image_cfg_1              = 0x00002210,
+			.image_cfg_2              = 0x00002214,
+			.packer_cfg               = 0x00002218,
+			.frame_header_addr        = 0x00002220,
+			.frame_header_incr        = 0x00002224,
+			.frame_header_cfg         = 0x00002228,
+			.irq_subsample_period     = 0x00002230,
+			.irq_subsample_pattern    = 0x00002234,
+			.framedrop_period         = 0x00002238,
+			.framedrop_pattern        = 0x0000223C,
+			.mmu_prefetch_cfg         = 0x00002260,
+			.mmu_prefetch_max_offset  = 0x00002264,
+			.system_cache_cfg         = 0x00002268,
+			.addr_status_0            = 0x00002270,
+			.addr_status_1            = 0x00002274,
+			.addr_status_2            = 0x00002278,
+			.addr_status_3            = 0x0000227C,
+			.debug_status_cfg         = 0x00002280,
+			.debug_status_0           = 0x00002284,
+			.debug_status_1           = 0x00002288,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_12,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 21 PDAF V2.0 PD DATA - 2PD */
+		{
+			.cfg                      = 0x00002300,
+			.image_addr               = 0x00002304,
+			.frame_incr               = 0x00002308,
+			.image_cfg_0              = 0x0000230C,
+			.image_cfg_1              = 0x00002310,
+			.image_cfg_2              = 0x00002314,
+			.packer_cfg               = 0x00002318,
+			.frame_header_addr        = 0x00002320,
+			.frame_header_incr        = 0x00002324,
+			.frame_header_cfg         = 0x00002328,
+			.irq_subsample_period     = 0x00002330,
+			.irq_subsample_pattern    = 0x00002334,
+			.framedrop_period         = 0x00002338,
+			.framedrop_pattern        = 0x0000233C,
+			.mmu_prefetch_cfg         = 0x00002360,
+			.mmu_prefetch_max_offset  = 0x00002364,
+			.system_cache_cfg         = 0x00002368,
+			.addr_status_0            = 0x00002370,
+			.addr_status_1            = 0x00002374,
+			.addr_status_2            = 0x00002378,
+			.addr_status_3            = 0x0000237C,
+			.debug_status_cfg         = 0x00002380,
+			.debug_status_0           = 0x00002384,
+			.debug_status_1           = 0x00002388,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_13,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 22 PDAF V2.0 SAD STATS */
+		{
+			.cfg                      = 0x00002400,
+			.image_addr               = 0x00002404,
+			.frame_incr               = 0x00002408,
+			.image_cfg_0              = 0x0000240C,
+			.image_cfg_1              = 0x00002410,
+			.image_cfg_2              = 0x00002414,
+			.packer_cfg               = 0x00002418,
+			.frame_header_addr        = 0x00002420,
+			.frame_header_incr        = 0x00002424,
+			.frame_header_cfg         = 0x00002428,
+			.irq_subsample_period     = 0x00002430,
+			.irq_subsample_pattern    = 0x00002434,
+			.framedrop_period         = 0x00002438,
+			.framedrop_pattern        = 0x0000243C,
+			.mmu_prefetch_cfg         = 0x00002460,
+			.mmu_prefetch_max_offset  = 0x00002464,
+			.system_cache_cfg         = 0x00002468,
+			.addr_status_0            = 0x00002470,
+			.addr_status_1            = 0x00002474,
+			.addr_status_2            = 0x00002478,
+			.addr_status_3            = 0x0000247C,
+			.debug_status_cfg         = 0x00002480,
+			.debug_status_0           = 0x00002484,
+			.debug_status_1           = 0x00002488,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_13,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 23 LCR */
+		{
+			.cfg                      = 0x00002500,
+			.image_addr               = 0x00002504,
+			.frame_incr               = 0x00002508,
+			.image_cfg_0              = 0x0000250C,
+			.image_cfg_1              = 0x00002510,
+			.image_cfg_2              = 0x00002514,
+			.packer_cfg               = 0x00002518,
+			.frame_header_addr        = 0x00002520,
+			.frame_header_incr        = 0x00002524,
+			.frame_header_cfg         = 0x00002528,
+			.irq_subsample_period     = 0x00002530,
+			.irq_subsample_pattern    = 0x00002534,
+			.framedrop_period         = 0x00002538,
+			.framedrop_pattern        = 0x0000253C,
+			.mmu_prefetch_cfg         = 0x00002560,
+			.mmu_prefetch_max_offset  = 0x00002564,
+			.system_cache_cfg         = 0x00002568,
+			.addr_status_0            = 0x00002570,
+			.addr_status_1            = 0x00002574,
+			.addr_status_2            = 0x00002578,
+			.addr_status_3            = 0x0000257C,
+			.debug_status_cfg         = 0x00002580,
+			.debug_status_0           = 0x00002584,
+			.debug_status_1           = 0x00002588,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_11,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 24 RDI0 */
+		{
+			.cfg                      = 0x00002600,
+			.image_addr               = 0x00002604,
+			.frame_incr               = 0x00002608,
+			.image_cfg_0              = 0x0000260C,
+			.image_cfg_1              = 0x00002610,
+			.image_cfg_2              = 0x00002614,
+			.packer_cfg               = 0x00002618,
+			.frame_header_addr        = 0x00002620,
+			.frame_header_incr        = 0x00002624,
+			.frame_header_cfg         = 0x00002628,
+			.irq_subsample_period     = 0x00002630,
+			.irq_subsample_pattern    = 0x00002634,
+			.framedrop_period         = 0x00002638,
+			.framedrop_pattern        = 0x0000263C,
+			.mmu_prefetch_cfg         = 0x00002660,
+			.mmu_prefetch_max_offset  = 0x00002664,
+			.system_cache_cfg         = 0x00002668,
+			.addr_status_0            = 0x00002670,
+			.addr_status_1            = 0x00002674,
+			.addr_status_2            = 0x00002678,
+			.addr_status_3            = 0x0000267C,
+			.debug_status_cfg         = 0x00002680,
+			.debug_status_0           = 0x00002684,
+			.debug_status_1           = 0x00002688,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_14,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 25 RDI1 */
+		{
+			.cfg                      = 0x00002700,
+			.image_addr               = 0x00002704,
+			.frame_incr               = 0x00002708,
+			.image_cfg_0              = 0x0000270C,
+			.image_cfg_1              = 0x00002710,
+			.image_cfg_2              = 0x00002714,
+			.packer_cfg               = 0x00002718,
+			.frame_header_addr        = 0x00002720,
+			.frame_header_incr        = 0x00002724,
+			.frame_header_cfg         = 0x00002728,
+			.irq_subsample_period     = 0x00002730,
+			.irq_subsample_pattern    = 0x00002734,
+			.framedrop_period         = 0x00002738,
+			.framedrop_pattern        = 0x0000273C,
+			.mmu_prefetch_cfg         = 0x00002760,
+			.mmu_prefetch_max_offset  = 0x00002764,
+			.system_cache_cfg         = 0x00002768,
+			.addr_status_0            = 0x00002770,
+			.addr_status_1            = 0x00002774,
+			.addr_status_2            = 0x00002778,
+			.addr_status_3            = 0x0000277C,
+			.debug_status_cfg         = 0x00002780,
+			.debug_status_0           = 0x00002784,
+			.debug_status_1           = 0x00002788,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_15,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 26 RDI2 */
+		{
+			.cfg                      = 0x00002800,
+			.image_addr               = 0x00002804,
+			.frame_incr               = 0x00002808,
+			.image_cfg_0              = 0x0000280C,
+			.image_cfg_1              = 0x00002810,
+			.image_cfg_2              = 0x00002814,
+			.packer_cfg               = 0x00002818,
+			.frame_header_addr        = 0x00002820,
+			.frame_header_incr        = 0x00002824,
+			.frame_header_cfg         = 0x00002828,
+			.irq_subsample_period     = 0x00002830,
+			.irq_subsample_pattern    = 0x00002834,
+			.framedrop_period         = 0x00002838,
+			.framedrop_pattern        = 0x0000283C,
+			.mmu_prefetch_cfg         = 0x00002860,
+			.mmu_prefetch_max_offset  = 0x00002864,
+			.system_cache_cfg         = 0x00002868,
+			.addr_status_0            = 0x00002870,
+			.addr_status_1            = 0x00002874,
+			.addr_status_2            = 0x00002878,
+			.addr_status_3            = 0x0000287C,
+			.debug_status_cfg         = 0x00002880,
+			.debug_status_0           = 0x00002884,
+			.debug_status_1           = 0x00002888,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_16,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 27 LTM STATS */
+		{
+			.cfg                      = 0x00002900,
+			.image_addr               = 0x00002904,
+			.frame_incr               = 0x00002908,
+			.image_cfg_0              = 0x0000290C,
+			.image_cfg_1              = 0x00002910,
+			.image_cfg_2              = 0x00002914,
+			.packer_cfg               = 0x00002918,
+			.frame_header_addr        = 0x00002920,
+			.frame_header_incr        = 0x00002924,
+			.frame_header_cfg         = 0x00002928,
+			.irq_subsample_period     = 0x00002930,
+			.irq_subsample_pattern    = 0x00002934,
+			.framedrop_period         = 0x00002938,
+			.framedrop_pattern        = 0x0000293C,
+			.mmu_prefetch_cfg         = 0x00002960,
+			.mmu_prefetch_max_offset  = 0x00002964,
+			.system_cache_cfg         = 0x00002968,
+			.addr_status_0            = 0x00002970,
+			.addr_status_1            = 0x00002974,
+			.addr_status_2            = 0x00002978,
+			.addr_status_3            = 0x0000297C,
+			.debug_status_cfg         = 0x00002980,
+			.debug_status_0           = 0x00002984,
+			.debug_status_1           = 0x00002988,
+			.comp_group              = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 27,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				24,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.num_wm        = 1,
+			.wm_idx        = {
+				25,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.num_wm        = 1,
+			.wm_idx        = {
+				26,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 2,
+			.wm_idx        = {
+				0,
+				1,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				2,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				3,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				10,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 2,
+			.wm_idx        = {
+				8,
+				9,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_PDAF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				20,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				11,
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				12,
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				13,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				16,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				14,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				12,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				18,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				19,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+			.max_width     = 4096,
+			.max_height    = 4096,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 2,
+			.wm_idx        = {
+				4,
+				5,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				6,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				7,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				21,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LCR,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				23,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				15,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_2PD_STATS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				22,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				11,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				27,
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				17,
+			},
+		},
+	},
+	.num_comp_grp    = 17,
+	.comp_done_shift = 0,
+	.top_irq_shift   = 1,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 33,
+};
+
+
+static struct cam_vfe_hw_info cam_vfe680_hw_info = {
+	.irq_reg_info                  = &vfe680_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe680_bus_hw_info,
+
+	.bus_rd_version                = NULL,
+	.bus_rd_hw_info                = NULL,
+
+	.top_version                   = CAM_VFE_TOP_VER_4_0,
+	.top_hw_info                   = &vfe680_top_hw_info,
+};
+
+#endif /* _CAM_VFE680_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite16x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite16x.h
@@ -0,0 +1,356 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_LITE16X_H_
+#define _CAM_VFE_LITE16X_H_
+
+#include "cam_vfe_bus_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe16x_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe16x_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe16x_top_irq_reg_set,
+	.global_clear_offset  = 0x00000058,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe16x_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		NULL,
+		NULL,
+		NULL,
+		NULL,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000000,
+	.three_D_cfg              = 0x00000000,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe16x_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_common_reg_data vfe16x_rdi_reg_data = {
+	.subscribe_irq_mask0      = 0x780001E0,
+	.subscribe_irq_mask1      = 0x0,
+	.error_irq_mask0          = 0x0,
+	.error_irq_mask1          = 0x3C,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe16x_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe16x_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe16x_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe16x_rdi_3_data = {
+	.reg_update_cmd_data      = 0x10,
+	.sof_irq_mask             = 0x40000000,
+	.reg_update_irq_mask      = 0x100,
+};
+
+static struct cam_vfe_rdi_overflow_status vfe16x_rdi_irq_status = {
+	.rdi0_overflow_mask = 0x8,
+	.rdi1_overflow_mask = 0x10,
+	.rdi2_overflow_mask = 0x18,
+	.rdi3_overflow_mask = 0x20,
+	.rdi_overflow_mask  = 0x3c,
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe16x_top_hw_info = {
+	.common_reg = &vfe16x_top_common_reg,
+	.camif_hw_info = {
+		.common_reg = NULL,
+		.camif_reg  = NULL,
+		.reg_data   = NULL,
+		},
+	.rdi_hw_info = {
+		.common_reg = &vfe16x_top_common_reg,
+		.rdi_reg    = &vfe16x_rdi_reg,
+		.common_reg_data = &vfe16x_rdi_reg_data,
+		.reg_data = {
+			&vfe16x_rdi_0_data,
+			&vfe16x_rdi_1_data,
+			&vfe16x_rdi_2_data,
+			&vfe16x_rdi_3_data,
+			},
+		.rdi_irq_status  = &vfe16x_rdi_irq_status,
+		},
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set vfe16x_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe16x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers        = 3,
+			.irq_reg_set          = vfe16x_bus_irq_reg,
+			.global_clear_offset  = 0x00002068,
+			.global_clear_bitmask = 0x00000001,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 4,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 4,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 4,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 5,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 6,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.mid[0]        = 7,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 23,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite16x_hw_info = {
+	.irq_reg_info                  = &vfe16x_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe16x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe16x_top_hw_info,
+
+};
+
+#endif /* _CAM_VFE_LITE16X_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite17x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite17x.h
@@ -0,0 +1,351 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_LITE17X_H_
+#define _CAM_VFE_LITE17X_H_
+
+#include "cam_vfe_bus_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe17x_top_irq_reg_set[2] = {
+	{
+		.mask_reg_offset   = 0x0000005C,
+		.clear_reg_offset  = 0x00000064,
+		.status_reg_offset = 0x0000006C,
+	},
+	{
+		.mask_reg_offset   = 0x00000060,
+		.clear_reg_offset  = 0x00000068,
+		.status_reg_offset = 0x00000070,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe17x_top_irq_reg_info = {
+	.num_registers = 2,
+	.irq_reg_set = vfe17x_top_irq_reg_set,
+	.global_clear_offset  = 0x00000058,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_top_ver2_reg_offset_common vfe17x_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.hw_capability            = 0x00000004,
+	.lens_feature             = 0x00000008,
+	.stats_feature            = 0x0000000C,
+	.color_feature            = 0x00000010,
+	.zoom_feature             = 0x00000014,
+	.global_reset_cmd         = 0x00000018,
+	.module_ctrl              = {
+		NULL,
+		NULL,
+		NULL,
+		NULL,
+	},
+	.bus_cgc_ovd              = 0x0000003C,
+	.core_cfg                 = 0x00000000,
+	.three_D_cfg              = 0x00000000,
+	.violation_status         = 0x0000007C,
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_ver2_reg vfe17x_rdi_reg = {
+	.reg_update_cmd           = 0x000004AC,
+};
+
+static struct cam_vfe_rdi_common_reg_data vfe17x_rdi_reg_data = {
+	.subscribe_irq_mask0      = 0x780001E0,
+	.subscribe_irq_mask1      = 0x0,
+	.error_irq_mask0          = 0x0,
+	.error_irq_mask1          = 0x3C,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe17x_rdi_0_data = {
+	.reg_update_cmd_data      = 0x2,
+	.sof_irq_mask             = 0x8000000,
+	.reg_update_irq_mask      = 0x20,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe17x_rdi_1_data = {
+	.reg_update_cmd_data      = 0x4,
+	.sof_irq_mask             = 0x10000000,
+	.reg_update_irq_mask      = 0x40,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe17x_rdi_2_data = {
+	.reg_update_cmd_data      = 0x8,
+	.sof_irq_mask             = 0x20000000,
+	.reg_update_irq_mask      = 0x80,
+};
+
+static struct cam_vfe_rdi_reg_data  vfe17x_rdi_3_data = {
+	.reg_update_cmd_data      = 0x10,
+	.sof_irq_mask             = 0x40000000,
+	.reg_update_irq_mask      = 0x100,
+};
+
+static struct cam_vfe_rdi_overflow_status vfe17x_rdi_irq_status = {
+	.rdi0_overflow_mask = 0x8,
+	.rdi1_overflow_mask = 0x10,
+	.rdi2_overflow_mask = 0x18,
+	.rdi3_overflow_mask = 0x20,
+	.rdi_overflow_mask  = 0x3c,
+};
+
+static struct cam_vfe_top_ver2_hw_info vfe17x_top_hw_info = {
+	.common_reg = &vfe17x_top_common_reg,
+	.camif_hw_info = {
+		.common_reg = NULL,
+		.camif_reg  = NULL,
+		.reg_data   = NULL,
+		},
+	.rdi_hw_info = {
+		.common_reg = &vfe17x_top_common_reg,
+		.rdi_reg    = &vfe17x_rdi_reg,
+		.common_reg_data = &vfe17x_rdi_reg_data,
+		.reg_data = {
+			&vfe17x_rdi_0_data,
+			&vfe17x_rdi_1_data,
+			&vfe17x_rdi_2_data,
+			&vfe17x_rdi_3_data,
+			},
+		.rdi_irq_status  = &vfe17x_rdi_irq_status,
+		},
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set vfe17x_bus_irq_reg[3] = {
+		{
+			.mask_reg_offset   = 0x00002044,
+			.clear_reg_offset  = 0x00002050,
+			.status_reg_offset = 0x0000205C,
+		},
+		{
+			.mask_reg_offset   = 0x00002048,
+			.clear_reg_offset  = 0x00002054,
+			.status_reg_offset = 0x00002060,
+		},
+		{
+			.mask_reg_offset   = 0x0000204C,
+			.clear_reg_offset  = 0x00002058,
+			.status_reg_offset = 0x00002064,
+		},
+};
+
+static struct cam_vfe_bus_ver2_hw_info vfe17x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                   = 0x00002000,
+		.hw_capability                = 0x00002004,
+		.sw_reset                     = 0x00002008,
+		.cgc_ovd                      = 0x0000200C,
+		.pwr_iso_cfg                  = 0x000020CC,
+		.dual_master_comp_cfg         = 0x00002028,
+		.irq_reg_info = {
+			.num_registers        = 3,
+			.irq_reg_set          = vfe17x_bus_irq_reg,
+			.global_clear_offset  = 0x00002068,
+			.global_clear_bitmask = 0x00000001,
+		},
+		.comp_error_status            = 0x0000206C,
+		.comp_ovrwr_status            = 0x00002070,
+		.dual_comp_error_status       = 0x00002074,
+		.dual_comp_ovrwr_status       = 0x00002078,
+		.addr_sync_cfg                = 0x0000207C,
+		.addr_sync_frame_hdr          = 0x00002080,
+		.addr_sync_no_sync            = 0x00002084,
+		.top_irq_mask_0               = 0x0000005C,
+	},
+	.num_client = 4,
+	.bus_client_reg = {
+		/* BUS Client 0 */
+		{
+			.status0                  = 0x00002200,
+			.status1                  = 0x00002204,
+			.cfg                      = 0x00002208,
+			.header_addr              = 0x0000220C,
+			.header_cfg               = 0x00002210,
+			.image_addr               = 0x00002214,
+			.image_addr_offset        = 0x00002218,
+			.buffer_width_cfg         = 0x0000221C,
+			.buffer_height_cfg        = 0x00002220,
+			.packer_cfg               = 0x00002224,
+			.stride                   = 0x00002228,
+			.irq_subsample_period     = 0x00002248,
+			.irq_subsample_pattern    = 0x0000224C,
+			.framedrop_period         = 0x00002250,
+			.framedrop_pattern        = 0x00002254,
+			.frame_inc                = 0x00002258,
+			.burst_limit              = 0x0000225C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 */
+		{
+			.status0                  = 0x00002300,
+			.status1                  = 0x00002304,
+			.cfg                      = 0x00002308,
+			.header_addr              = 0x0000230C,
+			.header_cfg               = 0x00002310,
+			.image_addr               = 0x00002314,
+			.image_addr_offset        = 0x00002318,
+			.buffer_width_cfg         = 0x0000231C,
+			.buffer_height_cfg        = 0x00002320,
+			.packer_cfg               = 0x00002324,
+			.stride                   = 0x00002328,
+			.irq_subsample_period     = 0x00002348,
+			.irq_subsample_pattern    = 0x0000234C,
+			.framedrop_period         = 0x00002350,
+			.framedrop_pattern        = 0x00002354,
+			.frame_inc                = 0x00002358,
+			.burst_limit              = 0x0000235C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 */
+		{
+			.status0                  = 0x00002400,
+			.status1                  = 0x00002404,
+			.cfg                      = 0x00002408,
+			.header_addr              = 0x0000240C,
+			.header_cfg               = 0x00002410,
+			.image_addr               = 0x00002414,
+			.image_addr_offset        = 0x00002418,
+			.buffer_width_cfg         = 0x0000241C,
+			.buffer_height_cfg        = 0x00002420,
+			.packer_cfg               = 0x00002424,
+			.stride                   = 0x00002428,
+			.irq_subsample_period     = 0x00002448,
+			.irq_subsample_pattern    = 0x0000244C,
+			.framedrop_period         = 0x00002450,
+			.framedrop_pattern        = 0x00002454,
+			.frame_inc                = 0x00002458,
+			.burst_limit              = 0x0000245C,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 */
+		{
+			.status0                  = 0x00002500,
+			.status1                  = 0x00002504,
+			.cfg                      = 0x00002508,
+			.header_addr              = 0x0000250C,
+			.header_cfg               = 0x00002510,
+			.image_addr               = 0x00002514,
+			.image_addr_offset        = 0x00002518,
+			.buffer_width_cfg         = 0x0000251C,
+			.buffer_height_cfg        = 0x00002520,
+			.packer_cfg               = 0x00002524,
+			.stride                   = 0x00002528,
+			.irq_subsample_period     = 0x00002548,
+			.irq_subsample_pattern    = 0x0000254C,
+			.framedrop_period         = 0x00002550,
+			.framedrop_pattern        = 0x00002554,
+			.frame_inc                = 0x00002558,
+			.burst_limit              = 0x0000255C,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.comp_grp_reg = {
+		/* CAM_VFE_BUS_VER2_COMP_GRP_0 */
+		{
+			.comp_mask                    = 0x00002010,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_1 */
+		{
+			.comp_mask                    = 0x00002014,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_2 */
+		{
+			.comp_mask                    = 0x00002018,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_3 */
+		{
+			.comp_mask                    = 0x0000201C,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_4 */
+		{
+			.comp_mask                    = 0x00002020,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_5 */
+		{
+			.comp_mask                    = 0x00002024,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 */
+		{
+			.comp_mask                    = 0x0000202C,
+			.addr_sync_mask               = 0x00002088,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1 */
+		{
+			.comp_mask                    = 0x00002030,
+			.addr_sync_mask               = 0x0000208C,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2 */
+		{
+			.comp_mask                    = 0x00002034,
+			.addr_sync_mask               = 0x00002090,
+
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3 */
+		{
+			.comp_mask                    = 0x00002038,
+			.addr_sync_mask               = 0x00002094,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4 */
+		{
+			.comp_mask                    = 0x0000203C,
+			.addr_sync_mask               = 0x00002098,
+		},
+		/* CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5 */
+		{
+			.comp_mask                    = 0x00002040,
+			.addr_sync_mask               = 0x0000209C,
+		},
+	},
+	.num_out = 4,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER2_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+		},
+	},
+	.top_irq_shift = 9,
+	.support_consumed_addr = false,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 23,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite17x_hw_info = {
+	.irq_reg_info                  = &vfe17x_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_2_0,
+	.bus_hw_info                   = &vfe17x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_2_0,
+	.top_hw_info                   = &vfe17x_top_hw_info,
+
+};
+
+#endif /* _CAM_VFE_LITE17X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite48x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite48x.h
@@ -0,0 +1,436 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_LITE48x_H_
+#define _CAM_VFE_LITE48x_H_
+
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_core.h"
+
+static struct cam_irq_register_set vfe48x_top_irq_reg_set[3] = {
+	{
+		.mask_reg_offset   = 0x00000028,
+		.clear_reg_offset  = 0x00000034,
+		.status_reg_offset = 0x00000040,
+	},
+	{
+		.mask_reg_offset   = 0x0000002C,
+		.clear_reg_offset  = 0x00000038,
+		.status_reg_offset = 0x00000044,
+	},
+	{
+		.mask_reg_offset   = 0x00000030,
+		.clear_reg_offset  = 0x0000003C,
+		.status_reg_offset = 0x00000048,
+	},
+};
+
+static struct cam_irq_controller_reg_info vfe48x_top_irq_reg_info = {
+	.num_registers = 3,
+	.irq_reg_set = vfe48x_top_irq_reg_set,
+	.global_clear_offset  = 0x00000024,
+	.global_clear_bitmask = 0x00000001,
+};
+
+static struct cam_vfe_top_ver3_reg_offset_common vfe48x_top_common_reg = {
+	.hw_version               = 0x00000000,
+	.titan_version            = 0x00000004,
+	.hw_capability            = 0x00000008,
+	.global_reset_cmd         = 0x0000000C,
+	.core_cgc_ovd_0           = 0x00000010,
+	.ahb_cgc_ovd              = 0x00000014,
+	.noc_cgc_ovd              = 0x00000018,
+	.reg_update_cmd           = 0x00000020,
+	.diag_config              = 0x00000050,
+	.diag_sensor_status_0     = 0x00000054,
+	.bus_overflow_status      = 0x00001A68,
+	.top_debug_cfg            = 0x00000074,
+	.top_debug_0              = 0x0000005C,
+	.top_debug_1              = 0x00000068,
+	.top_debug_2              = 0x0000006C,
+	.top_debug_3              = 0x00000070,
+};
+
+static struct cam_vfe_camif_lite_ver3_reg vfe48x_camif_rdi[4] = {
+	{
+		.lite_hw_version            = 0x1200,
+		.lite_hw_status             = 0x1204,
+		.lite_module_config         = 0x1260,
+		.lite_skip_period           = 0x1268,
+		.lite_irq_subsample_pattern = 0x126C,
+		.lite_epoch_irq             = 0x1270,
+		.lite_debug_1               = 0x13F0,
+		.lite_debug_0               = 0x13F4,
+		.lite_test_bus_ctrl         = 0x13F8,
+		.camif_lite_spare           = 0x13FC,
+		.reg_update_cmd             = 0x0020,
+	},
+	{
+		.lite_hw_version            = 0x1400,
+		.lite_hw_status             = 0x1404,
+		.lite_module_config         = 0x1460,
+		.lite_skip_period           = 0x1468,
+		.lite_irq_subsample_pattern = 0x146C,
+		.lite_epoch_irq             = 0x1470,
+		.lite_debug_1               = 0x15F0,
+		.lite_debug_0               = 0x15F4,
+		.lite_test_bus_ctrl         = 0x15F8,
+		.camif_lite_spare           = 0x15FC,
+		.reg_update_cmd             = 0x0020,
+	},
+	{
+		.lite_hw_version            = 0x1600,
+		.lite_hw_status             = 0x1604,
+		.lite_module_config         = 0x1660,
+		.lite_skip_period           = 0x1668,
+		.lite_irq_subsample_pattern = 0x166C,
+		.lite_epoch_irq             = 0x1670,
+		.lite_debug_1               = 0x17F0,
+		.lite_debug_0               = 0x17F4,
+		.lite_test_bus_ctrl         = 0x17F8,
+		.camif_lite_spare           = 0x17FC,
+		.reg_update_cmd             = 0x0020,
+	},
+	{
+		.lite_hw_version            = 0x1800,
+		.lite_hw_status             = 0x1804,
+		.lite_module_config         = 0x1860,
+		.lite_skip_period           = 0x1868,
+		.lite_irq_subsample_pattern = 0x186C,
+		.lite_epoch_irq             = 0x1870,
+		.lite_debug_1               = 0x19F0,
+		.lite_debug_0               = 0x19F4,
+		.lite_test_bus_ctrl         = 0x19F8,
+		.camif_lite_spare           = 0x19FC,
+		.reg_update_cmd             = 0x0020,
+	},
+};
+
+static struct cam_vfe_camif_lite_ver3_reg_data vfe48x_camif_rdi_reg_data[4] = {
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x1,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x1,
+		.epoch0_irq_mask                 = 0x4,
+		.epoch1_irq_mask                 = 0x8,
+		.eof_irq_mask                    = 0x02,
+		.error_irq_mask0                 = 0x1,
+		.error_irq_mask2                 = 0x100,
+		.subscribe_irq_mask1             = 0x3,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x2,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x10,
+		.epoch0_irq_mask                 = 0x40,
+		.epoch1_irq_mask                 = 0x80,
+		.eof_irq_mask                    = 0x20,
+		.error_irq_mask0                 = 0x2,
+		.error_irq_mask2                 = 0x200,
+		.subscribe_irq_mask1             = 0x30,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x4,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x100,
+		.epoch0_irq_mask                 = 0x400,
+		.epoch1_irq_mask                 = 0x800,
+		.eof_irq_mask                    = 0x200,
+		.error_irq_mask0                 = 0x4,
+		.error_irq_mask2                 = 0x400,
+		.subscribe_irq_mask1             = 0x300,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x1,
+	},
+	{
+		.extern_reg_update_shift         = 0,
+		.reg_update_cmd_data             = 0x8,
+		.epoch_line_cfg                  = 0x0,
+		.sof_irq_mask                    = 0x1000,
+		.epoch0_irq_mask                 = 0x4000,
+		.epoch1_irq_mask                 = 0x8000,
+		.eof_irq_mask                    = 0x2000,
+		.error_irq_mask0                 = 0x8,
+		.error_irq_mask2                 = 0x800,
+		.subscribe_irq_mask1             = 0x3000,
+		.enable_diagnostic_hw            = 0x1,
+		.top_debug_cfg_en                = 0x1,
+	},
+};
+
+static struct cam_vfe_camif_lite_ver3_hw_info
+	vfe48x_rdi_hw_info[CAM_VFE_RDI_VER2_MAX] = {
+	{
+		.common_reg     = &vfe48x_top_common_reg,
+		.camif_lite_reg = &vfe48x_camif_rdi[0],
+		.reg_data       = &vfe48x_camif_rdi_reg_data[0],
+	},
+	{
+		.common_reg     = &vfe48x_top_common_reg,
+		.camif_lite_reg = &vfe48x_camif_rdi[1],
+		.reg_data       = &vfe48x_camif_rdi_reg_data[1],
+	},
+	{
+		.common_reg     = &vfe48x_top_common_reg,
+		.camif_lite_reg = &vfe48x_camif_rdi[2],
+		.reg_data       = &vfe48x_camif_rdi_reg_data[2],
+	},
+	{
+		.common_reg     = &vfe48x_top_common_reg,
+		.camif_lite_reg = &vfe48x_camif_rdi[3],
+		.reg_data       = &vfe48x_camif_rdi_reg_data[3],
+	},
+};
+
+static struct cam_vfe_top_ver3_hw_info vfe48x_top_hw_info = {
+	.common_reg = &vfe48x_top_common_reg,
+	.rdi_hw_info[0] = &vfe48x_rdi_hw_info[0],
+	.rdi_hw_info[1] = &vfe48x_rdi_hw_info[1],
+	.rdi_hw_info[2] = &vfe48x_rdi_hw_info[2],
+	.rdi_hw_info[3] = &vfe48x_rdi_hw_info[3],
+	.num_mux = 4,
+	.mux_type = {
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+		CAM_VFE_RDI_VER_1_0,
+	},
+};
+
+static struct cam_irq_register_set vfe48x_bus_irq_reg[2] = {
+	{
+		.mask_reg_offset   = 0x00001A18,
+		.clear_reg_offset  = 0x00001A20,
+		.status_reg_offset = 0x00001A28,
+	},
+	{
+		.mask_reg_offset   = 0x00001A1C,
+		.clear_reg_offset  = 0x00001A24,
+		.status_reg_offset = 0x00001A2C,
+	},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe48x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00001A00,
+		.cgc_ovd                          = 0x00001A08,
+		.if_frameheader_cfg               = {
+			0x00001A34,
+			0x00001A38,
+			0x00001A3C,
+			0x00001A40,
+		},
+		.pwr_iso_cfg                      = 0x00001A5C,
+		.overflow_status_clear            = 0x00001A60,
+		.ccif_violation_status            = 0x00001A64,
+		.overflow_status                  = 0x00001A68,
+		.image_size_violation_status      = 0x00001A70,
+		.debug_status_top_cfg             = 0x00001AD4,
+		.debug_status_top                 = 0x00001AD8,
+		.test_bus_ctrl                    = 0x00001ADC,
+		.top_irq_mask_0                   = 0x00000028,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe48x_bus_irq_reg,
+			.global_clear_offset      = 0x00001A30,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = 4,
+	.bus_client_reg = {
+		/* RDI 0 */
+		{
+			.cfg                      = 0x00001C00,
+			.image_addr               = 0x00001C04,
+			.frame_incr               = 0x00001C08,
+			.image_cfg_0              = 0x00001C0C,
+			.image_cfg_1              = 0x00001C10,
+			.image_cfg_2              = 0x00001C14,
+			.packer_cfg               = 0x00001C18,
+			.frame_header_addr        = 0x00001C20,
+			.frame_header_incr        = 0x00001C24,
+			.frame_header_cfg         = 0x00001C28,
+			.line_done_cfg            = 0x00001C2C,
+			.irq_subsample_period     = 0x00001C30,
+			.irq_subsample_pattern    = 0x00001C34,
+			.framedrop_period         = 0x00001C38,
+			.framedrop_pattern        = 0x00001C3C,
+			.system_cache_cfg         = 0x00001C60,
+			.burst_limit              = 0x00001C64,
+			.addr_status_0            = 0x00001C68,
+			.addr_status_1            = 0x00001C6C,
+			.addr_status_2            = 0x00001C70,
+			.addr_status_3            = 0x00001C74,
+			.debug_status_cfg         = 0x00001C78,
+			.debug_status_0           = 0x00001C7C,
+			.debug_status_1           = 0x00001C80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs                = NULL,
+		},
+		/* RDI 1 */
+		{
+			.cfg                      = 0x00001D00,
+			.image_addr               = 0x00001D04,
+			.frame_incr               = 0x00001D08,
+			.image_cfg_0              = 0x00001D0C,
+			.image_cfg_1              = 0x00001D10,
+			.image_cfg_2              = 0x00001D14,
+			.packer_cfg               = 0x00001D18,
+			.frame_header_addr        = 0x00001D20,
+			.frame_header_incr        = 0x00001D24,
+			.frame_header_cfg         = 0x00001D28,
+			.line_done_cfg            = 0x00001D2C,
+			.irq_subsample_period     = 0x00001D30,
+			.irq_subsample_pattern    = 0x00001D34,
+			.framedrop_period         = 0x00001D38,
+			.framedrop_pattern        = 0x00001D3C,
+			.system_cache_cfg         = 0x00001D60,
+			.burst_limit              = 0x00001D64,
+			.addr_status_0            = 0x00001D68,
+			.addr_status_1            = 0x00001D6C,
+			.addr_status_2            = 0x00001D70,
+			.addr_status_3            = 0x00001D74,
+			.debug_status_cfg         = 0x00001D78,
+			.debug_status_0           = 0x00001D7C,
+			.debug_status_1           = 0x00001D80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* RDI 2 */
+		{
+			.cfg                      = 0x00001E00,
+			.image_addr               = 0x00001E04,
+			.frame_incr               = 0x00001E08,
+			.image_cfg_0              = 0x00001E0C,
+			.image_cfg_1              = 0x00001E10,
+			.image_cfg_2              = 0x00001E14,
+			.packer_cfg               = 0x00001E18,
+			.frame_header_addr        = 0x00001E20,
+			.frame_header_incr        = 0x00001E24,
+			.frame_header_cfg         = 0x00001E28,
+			.line_done_cfg            = 0x00001E2C,
+			.irq_subsample_period     = 0x00001E30,
+			.irq_subsample_pattern    = 0x00001E34,
+			.framedrop_period         = 0x00001E38,
+			.framedrop_pattern        = 0x00001E3C,
+			.system_cache_cfg         = 0x00001E60,
+			.burst_limit              = 0x00001E64,
+			.addr_status_0            = 0x00001E68,
+			.addr_status_1            = 0x00001E6C,
+			.addr_status_2            = 0x00001E70,
+			.addr_status_3            = 0x00001E74,
+			.debug_status_cfg         = 0x00001E78,
+			.debug_status_0           = 0x00001E7C,
+			.debug_status_1           = 0x00001E80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* RDI 3 */
+		{
+			.cfg                      = 0x00001F00,
+			.image_addr               = 0x00001F04,
+			.frame_incr               = 0x00001F08,
+			.image_cfg_0              = 0x00001F0C,
+			.image_cfg_1              = 0x00001F10,
+			.image_cfg_2              = 0x00001F14,
+			.packer_cfg               = 0x00001F18,
+			.frame_header_addr        = 0x00001F20,
+			.frame_header_incr        = 0x00001F24,
+			.frame_header_cfg         = 0x00001F28,
+			.line_done_cfg            = 0x00001F2C,
+			.irq_subsample_period     = 0x00001F30,
+			.irq_subsample_pattern    = 0x00001F34,
+			.framedrop_period         = 0x00001F38,
+			.framedrop_pattern        = 0x00001F3C,
+			.system_cache_cfg         = 0x00001F60,
+			.burst_limit              = 0x00001F64,
+			.addr_status_0            = 0x00001F68,
+			.addr_status_1            = 0x00001F6C,
+			.addr_status_2            = 0x00001F70,
+			.addr_status_3            = 0x00001F74,
+			.debug_status_cfg         = 0x00001F78,
+			.debug_status_0           = 0x00001F7C,
+			.debug_status_1           = 0x00001F80,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+	},
+	.num_out = 4,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.mid[0]        = 16,
+			.num_wm        = 1,
+			.wm_idx        = {
+				0,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.mid[0]        = 17,
+			.num_wm        = 1,
+			.wm_idx        = {
+				1,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.mid[0]        = 18,
+			.num_wm        = 1,
+			.wm_idx        = {
+				2,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.mid[0]        = 19,
+			.num_wm        = 1,
+			.wm_idx        = {
+				3,
+			},
+		},
+	},
+	.num_comp_grp    = 4,
+	.comp_done_shift = 4,
+	.top_irq_shift   = 4,
+	.support_consumed_addr = true,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 25,
+	.supported_irq =  CAM_VFE_HW_IRQ_CAP_BUF_DONE | CAM_VFE_HW_IRQ_CAP_RUP,
+	.comp_cfg_needed = true,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite48x_hw_info = {
+	.irq_reg_info                  = &vfe48x_top_irq_reg_info,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe48x_bus_hw_info,
+
+	.top_version                   = CAM_VFE_TOP_VER_3_0,
+	.top_hw_info                   = &vfe48x_top_hw_info,
+
+};
+
+#endif /* _CAM_VFE_LITE48x_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite68x.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe17x/cam_vfe_lite68x.h
@@ -0,0 +1,314 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE_LITE680X_H_
+#define _CAM_VFE_LITE680X_H_
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_irq_controller.h"
+
+static struct cam_irq_register_set vfe680x_bus_irq_reg[2] = {
+		{
+			.mask_reg_offset   = 0x00000218,
+			.clear_reg_offset  = 0x00000220,
+			.status_reg_offset = 0x00000228,
+		},
+		{
+			.mask_reg_offset   = 0x0000021C,
+			.clear_reg_offset  = 0x00000224,
+			.status_reg_offset = 0x0000022C,
+		},
+};
+
+static struct cam_vfe_bus_ver3_hw_info vfe680x_bus_hw_info = {
+	.common_reg = {
+		.hw_version                       = 0x00000200,
+		.cgc_ovd                          = 0x00000208,
+		.if_frameheader_cfg               = {
+			0x00000234,
+			0x00000238,
+			0x0000023C,
+			0x00000240,
+			0x00000244,
+		},
+		.pwr_iso_cfg                      = 0x0000025C,
+		.overflow_status_clear            = 0x00000260,
+		.ccif_violation_status            = 0x00000264,
+		.overflow_status                  = 0x00000268,
+		.image_size_violation_status      = 0x00000270,
+		.debug_status_top_cfg             = 0x000002D4,
+		.debug_status_top                 = 0x000002D8,
+		.test_bus_ctrl                    = 0x000002DC,
+		.irq_reg_info = {
+			.num_registers            = 2,
+			.irq_reg_set              = vfe680x_bus_irq_reg,
+			.global_clear_offset      = 0x00000230,
+			.global_clear_bitmask     = 0x00000001,
+		},
+	},
+	.num_client = 6,
+	.bus_client_reg = {
+		/* BUS Client 0 RDI0 */
+		{
+			.cfg                      = 0x00000400,
+			.image_addr               = 0x00000404,
+			.frame_incr               = 0x00000408,
+			.image_cfg_0              = 0x0000040C,
+			.image_cfg_1              = 0x00000410,
+			.image_cfg_2              = 0x00000414,
+			.packer_cfg               = 0x00000418,
+			.frame_header_addr        = 0x00000420,
+			.frame_header_incr        = 0x00000424,
+			.frame_header_cfg         = 0x00000428,
+			.irq_subsample_period     = 0x00000430,
+			.irq_subsample_pattern    = 0x00000434,
+			.framedrop_period         = 0x00000438,
+			.framedrop_pattern        = 0x0000043C,
+			.mmu_prefetch_cfg         = 0x00000460,
+			.mmu_prefetch_max_offset  = 0x00000464,
+			.system_cache_cfg         = 0x00000468,
+			.addr_status_0            = 0x00000470,
+			.addr_status_1            = 0x00000474,
+			.addr_status_2            = 0x00000478,
+			.addr_status_3            = 0x0000047C,
+			.debug_status_cfg         = 0x00000480,
+			.debug_status_0           = 0x00000484,
+			.debug_status_1           = 0x00000488,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_1,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 1 RDI1 */
+		{
+			.cfg                      = 0x00000500,
+			.image_addr               = 0x00000504,
+			.frame_incr               = 0x00000508,
+			.image_cfg_0              = 0x0000050C,
+			.image_cfg_1              = 0x00000510,
+			.image_cfg_2              = 0x00000514,
+			.packer_cfg               = 0x00000518,
+			.frame_header_addr        = 0x00000520,
+			.frame_header_incr        = 0x00000524,
+			.frame_header_cfg         = 0x00000528,
+			.irq_subsample_period     = 0x00000530,
+			.irq_subsample_pattern    = 0x00000534,
+			.framedrop_period         = 0x00000538,
+			.framedrop_pattern        = 0x0000053C,
+			.mmu_prefetch_cfg         = 0x00000560,
+			.mmu_prefetch_max_offset  = 0x00000564,
+			.system_cache_cfg         = 0x00000568,
+			.addr_status_0            = 0x00000570,
+			.addr_status_1            = 0x00000574,
+			.addr_status_2            = 0x00000578,
+			.addr_status_3            = 0x0000057C,
+			.debug_status_cfg         = 0x00000580,
+			.debug_status_0           = 0x00000584,
+			.debug_status_1           = 0x00000588,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_2,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 2 RDI2 */
+		{
+			.cfg                      = 0x00000600,
+			.image_addr               = 0x00000604,
+			.frame_incr               = 0x00000608,
+			.image_cfg_0              = 0x0000060C,
+			.image_cfg_1              = 0x00000610,
+			.image_cfg_2              = 0x00000614,
+			.packer_cfg               = 0x00000618,
+			.frame_header_addr        = 0x00000620,
+			.frame_header_incr        = 0x00000624,
+			.frame_header_cfg         = 0x00000628,
+			.irq_subsample_period     = 0x00000630,
+			.irq_subsample_pattern    = 0x00000634,
+			.framedrop_period         = 0x00000638,
+			.framedrop_pattern        = 0x0000063C,
+			.mmu_prefetch_cfg         = 0x00000660,
+			.mmu_prefetch_max_offset  = 0x00000664,
+			.system_cache_cfg         = 0x00000668,
+			.addr_status_0            = 0x00000670,
+			.addr_status_1            = 0x00000674,
+			.addr_status_2            = 0x00000678,
+			.addr_status_3            = 0x0000067C,
+			.debug_status_cfg         = 0x00000680,
+			.debug_status_0           = 0x00000684,
+			.debug_status_1           = 0x00000688,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_3,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 3 RDI3 */
+		{
+			.cfg                      = 0x00000700,
+			.image_addr               = 0x00000704,
+			.frame_incr               = 0x00000708,
+			.image_cfg_0              = 0x0000070C,
+			.image_cfg_1              = 0x00000710,
+			.image_cfg_2              = 0x00000714,
+			.packer_cfg               = 0x00000718,
+			.frame_header_addr        = 0x00000720,
+			.frame_header_incr        = 0x00000724,
+			.frame_header_cfg         = 0x00000728,
+			.irq_subsample_period     = 0x00000730,
+			.irq_subsample_pattern    = 0x00000734,
+			.framedrop_period         = 0x00000738,
+			.framedrop_pattern        = 0x0000073C,
+			.mmu_prefetch_cfg         = 0x00000760,
+			.mmu_prefetch_max_offset  = 0x00000764,
+			.system_cache_cfg         = 0x00000768,
+			.addr_status_0            = 0x00000770,
+			.addr_status_1            = 0x00000774,
+			.addr_status_2            = 0x00000778,
+			.addr_status_3            = 0x0000077C,
+			.debug_status_cfg         = 0x00000780,
+			.debug_status_0           = 0x00000784,
+			.debug_status_1           = 0x00000788,
+			.comp_group               = CAM_VFE_BUS_VER3_COMP_GRP_4,
+			.ubwc_regs                = NULL,
+		},
+		/* BUS Client 4 Gamma */
+		{
+			.cfg			  = 0x00000800,
+			.image_addr		  = 0x00000804,
+			.frame_incr		  = 0x00000808,
+			.image_cfg_0		  = 0x0000080C,
+			.image_cfg_1		  = 0x00000810,
+			.image_cfg_2		  = 0x00000814,
+			.packer_cfg		  = 0x00000818,
+			.frame_header_addr	  = 0x00000820,
+			.frame_header_incr	  = 0x00000824,
+			.frame_header_cfg	  = 0x00000828,
+			.irq_subsample_period	  = 0x00000830,
+			.irq_subsample_pattern	  = 0x00000834,
+			.framedrop_period	  = 0x00000838,
+			.framedrop_pattern	  = 0x0000083C,
+			.mmu_prefetch_cfg	  = 0x00000860,
+			.mmu_prefetch_max_offset  = 0x00000864,
+			.system_cache_cfg	  = 0x00000868,
+			.addr_status_0		  = 0x00000870,
+			.addr_status_1		  = 0x00000874,
+			.addr_status_2		  = 0x00000878,
+			.addr_status_3		  = 0x0000087C,
+			.debug_status_cfg	  = 0x00000880,
+			.debug_status_0		  = 0x00000884,
+			.debug_status_1		  = 0x00000888,
+			.comp_group		  = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs		  = NULL,
+		},
+		/* BUS Client 5 Stats BE */
+		{
+			.cfg			  = 0x00000900,
+			.image_addr		  = 0x00000904,
+			.frame_incr		  = 0x00000908,
+			.image_cfg_0		  = 0x0000090C,
+			.image_cfg_1		  = 0x00000910,
+			.image_cfg_2		  = 0x00000914,
+			.packer_cfg		  = 0x00000918,
+			.frame_header_addr	  = 0x00000920,
+			.frame_header_incr	  = 0x00000924,
+			.frame_header_cfg	  = 0x00000928,
+			.irq_subsample_period	  = 0x00000930,
+			.irq_subsample_pattern	  = 0x00000934,
+			.framedrop_period	  = 0x00000938,
+			.framedrop_pattern	  = 0x0000093C,
+			.mmu_prefetch_cfg	  = 0x00000960,
+			.mmu_prefetch_max_offset  = 0x00000964,
+			.system_cache_cfg	  = 0x00000968,
+			.addr_status_0		  = 0x00000970,
+			.addr_status_1		  = 0x00000974,
+			.addr_status_2		  = 0x00000978,
+			.addr_status_3		  = 0x0000097C,
+			.debug_status_cfg	  = 0x00000980,
+			.debug_status_0		  = 0x00000984,
+			.debug_status_1		  = 0x00000988,
+			.comp_group		  = CAM_VFE_BUS_VER3_COMP_GRP_0,
+			.ubwc_regs		  = NULL,
+		},
+	},
+	.num_out = 6,
+	.vfe_out_hw_info = {
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_1,
+			.num_wm        = 1,
+			.wm_idx        = {
+				0,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_2,
+			.num_wm        = 1,
+			.wm_idx        = {
+				1,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_3,
+			.num_wm        = 1,
+			.wm_idx        = {
+				2,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_4,
+			.num_wm        = 1,
+			.wm_idx        = {
+				3,
+			},
+		},
+		{
+			.vfe_out_type  =
+				CAM_VFE_BUS_VER3_VFE_OUT_GAMMA,
+			.max_width     = 1920,
+			.max_height    = 1080,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				4,
+			},
+		},
+		{
+			.vfe_out_type  = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BE,
+			.max_width     = -1,
+			.max_height    = -1,
+			.source_group  = CAM_VFE_BUS_VER3_SRC_GRP_0,
+			.num_wm        = 1,
+			.wm_idx        = {
+				5,
+			},
+		},
+	},
+	.num_comp_grp    = 4,
+	.comp_done_shift = 0,
+	.top_irq_shift   = 1,
+	.max_out_res = CAM_ISP_IFE_OUT_RES_BASE + 33,
+};
+
+static struct cam_vfe_hw_info cam_vfe_lite68x_hw_info = {
+	.irq_reg_info                  =,
+
+	.bus_version                   = CAM_VFE_BUS_VER_3_0,
+	.bus_hw_info                   = &vfe680x_bus_hw_info,
+
+	.bus_rd_version                = NULL,
+	.bus_rd_hw_info                = NULL,
+
+	.top_version                   =,
+	.top_hw_info                   =,
+};
+
+#endif /* _CAM_VFE_LITE680X_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus.c
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_vfe_bus.h"
+#include "cam_vfe_bus_ver1.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_vfe_bus_rd_ver1.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_debug_util.h"
+
+int cam_vfe_bus_init(uint32_t          bus_version,
+	int                            bus_type,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *bus_hw_info,
+	void                          *vfe_irq_controller,
+	struct cam_vfe_bus           **vfe_bus)
+{
+	int rc = -ENODEV;
+
+	switch (bus_type) {
+	case BUS_TYPE_WR:
+		switch (bus_version) {
+		case CAM_VFE_BUS_VER_2_0:
+			rc = cam_vfe_bus_ver2_init(soc_info, hw_intf,
+				bus_hw_info, vfe_irq_controller, vfe_bus);
+			break;
+		case CAM_VFE_BUS_VER_3_0:
+			rc = cam_vfe_bus_ver3_init(soc_info, hw_intf,
+				bus_hw_info, vfe_irq_controller, vfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unsupported Bus WR Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	case BUS_TYPE_RD:
+		switch (bus_version) {
+		case CAM_VFE_BUS_RD_VER_1_0:
+			/* Call vfe bus rd init function */
+			rc = cam_vfe_bus_rd_ver1_init(soc_info, hw_intf,
+				bus_hw_info, vfe_irq_controller, vfe_bus);
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unsupported Bus RD Version 0x%x",
+				bus_version);
+			break;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported Bus type %d", bus_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_bus_deinit(uint32_t        bus_version,
+	struct cam_vfe_bus           **vfe_bus)
+{
+	int rc = -ENODEV;
+
+	switch (bus_version) {
+	case CAM_VFE_BUS_VER_2_0:
+		rc = cam_vfe_bus_ver2_deinit(vfe_bus);
+		break;
+	case CAM_VFE_BUS_VER_3_0:
+		rc = cam_vfe_bus_ver3_deinit(vfe_bus);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported Bus Version %x", bus_version);
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.c
@@ -0,0 +1,1359 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_bus_rd_ver1.h"
+#include "cam_vfe_core.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+
+static const char drv_name[] = "vfe_bus_rd";
+
+#define ALIGNUP(value, alignment) \
+	((value + alignment - 1) / alignment * alignment)
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	(sizeof(struct cam_vfe_bus_rd_ver1_reg_offset_bus_client)/4)
+
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+#define CAM_VFE_ADD_REG_VAL_PAIR(buf_array, index, offset, val)    \
+	do {                                               \
+		buf_array[(index)++] = offset;             \
+		buf_array[(index)++] = val;                \
+	} while (0)
+
+#define BUS_RD_VER1_DEFAULT_LATENCY_BUF_ALLOC 512
+
+enum cam_vfe_bus_rd_ver1_unpacker_format {
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_128             = 0x0,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_8               = 0x1,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_10BPP        = 0x2,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_12BPP        = 0x3,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_14BPP        = 0x4,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_32_20BPP        = 0x5,
+	BUS_RD_VER1_UNPACKER_FMT_ARGB_10               = 0x6,
+	BUS_RD_VER1_UNPACKER_FMT_ARGB_12               = 0x7,
+	BUS_RD_VER1_UNPACKER_FMT_ARGB_14               = 0x8,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_32              = 0x9,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_64              = 0xA,
+	BUS_RD_VER1_UNPACKER_FMT_TP_10                 = 0xB,
+	BUS_RD_VER1_UNPACKER_FMT_MIPI8                 = 0xC,
+	BUS_RD_VER1_UNPACKER_FMT_MIPI10                = 0xD,
+	BUS_RD_VER1_UNPACKER_FMT_MIPI12                = 0xE,
+	BUS_RD_VER1_UNPACKER_FMT_MIPI14                = 0xF,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_16BPP        = 0x10,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_128_ODD_EVEN    = 0x11,
+	BUS_RD_VER1_UNPACKER_FMT_PLAIN_8_ODD_EVEN      = 0x12,
+	BUS_RD_VER1_UNPACKER_FMT_MAX                   = 0x13,
+};
+
+struct cam_vfe_bus_rd_ver1_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *bus_irq_controller;
+	void                                       *vfe_irq_controller;
+	struct cam_vfe_bus_rd_ver1_reg_offset_common  *common_reg;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+
+	struct list_head                            free_payload_list;
+	spinlock_t                                  spin_lock;
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    fs_sync_enable;
+	uint32_t                                    go_cmd_sel;
+	cam_hw_mgr_event_cb_func                    event_cb;
+};
+
+struct cam_vfe_bus_rd_ver1_rm_resource_data {
+	uint32_t             index;
+	struct cam_vfe_bus_rd_ver1_common_data            *common_data;
+	struct cam_vfe_bus_rd_ver1_reg_offset_bus_client  *hw_regs;
+	void                *ctx;
+
+	bool                 init_cfg_done;
+
+	uint32_t             offset;
+
+	uint32_t             min_vbi;
+	uint32_t             fs_mode;
+	uint32_t             hbi_count;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	uint32_t             latency_buf_allocation;
+	uint32_t             unpacker_cfg;
+	uint32_t             burst_len;
+
+	uint32_t             go_cmd_sel;
+	uint32_t             fs_sync_enable;
+	uint32_t             fs_line_sync_en;
+
+	uint32_t             en_cfg;
+	uint32_t             is_dual;
+	uint32_t             img_addr;
+	uint32_t             input_if_cmd;
+};
+
+struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data {
+	uint32_t                              bus_rd_type;
+	struct cam_vfe_bus_rd_ver1_common_data  *common_data;
+
+	uint32_t                         num_rm;
+	struct cam_isp_resource_node    *rm_res[PLANE_MAX];
+
+	struct cam_isp_resource_node    *comp_grp;
+	enum cam_isp_hw_sync_mode        dual_comp_sync_mode;
+	uint32_t                         dual_hw_alternate_vfe_id;
+	struct list_head                 vfe_bus_rd_list;
+
+	uint32_t                         format;
+	uint32_t                         max_width;
+	uint32_t                         max_height;
+	struct cam_cdm_utils_ops        *cdm_util_ops;
+	uint32_t                         secure_mode;
+	int                              irq_handle;
+	void                            *priv;
+	uint32_t                         status;
+	bool                             is_offline;
+};
+
+struct cam_vfe_bus_rd_ver1_priv {
+	struct cam_vfe_bus_rd_ver1_common_data common_data;
+	uint32_t                               num_client;
+	uint32_t                               num_bus_rd_resc;
+
+	struct cam_isp_resource_node  bus_client[
+		CAM_VFE_BUS_RD_VER1_MAX_CLIENTS];
+	struct cam_isp_resource_node  vfe_bus_rd[
+		CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX];
+
+	int                                 irq_handle;
+	void                               *tasklet_info;
+	uint32_t                            top_irq_shift;
+};
+
+static int cam_vfe_bus_rd_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+
+static void cam_vfe_bus_rd_pxls_to_bytes(uint32_t pxls, uint32_t fmt,
+	uint32_t *bytes)
+{
+	switch (fmt) {
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_128:
+		*bytes = pxls * 16;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_8:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_8_ODD_EVEN:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_10BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_12BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_14BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_16BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_ARGB_10:
+	case BUS_RD_VER1_UNPACKER_FMT_ARGB_12:
+	case BUS_RD_VER1_UNPACKER_FMT_ARGB_14:
+		*bytes = pxls * 2;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_32_20BPP:
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_32:
+		*bytes = pxls * 4;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_PLAIN_64:
+		*bytes = pxls * 8;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_TP_10:
+		*bytes = ALIGNUP(pxls, 3) * 4 / 3;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_MIPI8:
+		*bytes = pxls;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_MIPI10:
+		*bytes = ALIGNUP(pxls * 5, 4) / 4;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_MIPI12:
+		*bytes = ALIGNUP(pxls * 3, 2) / 2;
+		break;
+	case BUS_RD_VER1_UNPACKER_FMT_MIPI14:
+		*bytes = ALIGNUP(pxls * 7, 4) / 4;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid unpacker_fmt:%d", fmt);
+		break;
+	}
+}
+
+static enum cam_vfe_bus_rd_ver1_unpacker_format
+	cam_vfe_bus_get_unpacker_fmt(uint32_t unpack_fmt)
+{
+	switch (unpack_fmt) {
+	case CAM_FORMAT_PLAIN128:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_PLAIN8:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_PLAIN16_10:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN32_20:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_32_20BPP;
+	case CAM_FORMAT_ARGB_10:
+		return BUS_RD_VER1_UNPACKER_FMT_ARGB_10;
+	case CAM_FORMAT_ARGB_12:
+		return BUS_RD_VER1_UNPACKER_FMT_ARGB_12;
+	case CAM_FORMAT_ARGB_14:
+		return BUS_RD_VER1_UNPACKER_FMT_ARGB_14;
+	case CAM_FORMAT_PLAIN32:
+	case CAM_FORMAT_ARGB:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_32;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_ARGB_16:
+	case CAM_FORMAT_PD10:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_TP10:
+		return BUS_RD_VER1_UNPACKER_FMT_TP_10;
+	case CAM_FORMAT_MIPI_RAW_8:
+		return BUS_RD_VER1_UNPACKER_FMT_MIPI8;
+	case CAM_FORMAT_MIPI_RAW_10:
+		return BUS_RD_VER1_UNPACKER_FMT_MIPI10;
+	case CAM_FORMAT_MIPI_RAW_12:
+		return BUS_RD_VER1_UNPACKER_FMT_MIPI12;
+	case CAM_FORMAT_MIPI_RAW_14:
+		return BUS_RD_VER1_UNPACKER_FMT_MIPI14;
+	case CAM_FORMAT_PLAIN16_16:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN8_SWAP:
+		return BUS_RD_VER1_UNPACKER_FMT_PLAIN_8_ODD_EVEN;
+	default:
+		return BUS_RD_VER1_UNPACKER_FMT_MAX;
+	}
+}
+
+static enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type
+	cam_vfe_bus_get_bus_rd_res_id(uint32_t res_type)
+{
+	switch (res_type) {
+	case CAM_ISP_RESOURCE_VFE_BUS_RD:
+		return CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0;
+	default:
+		return CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX;
+	}
+}
+
+static int cam_vfe_bus_get_num_rm(
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type res_type)
+{
+	switch (res_type) {
+	case CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0:
+		return 1;
+	default:
+		CAM_ERR(CAM_ISP, "Unsupported resource_type %u", res_type);
+		return -EINVAL;
+	}
+}
+
+static int cam_vfe_bus_rd_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	struct cam_isp_resource_node                *bus_rd = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rsrc_data = NULL;
+
+	bus_rd = th_payload->handler_priv;
+	if (!bus_rd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+	rsrc_data = bus_rd->res_priv;
+	rsrc_data->status = th_payload->evt_status_arr[0];
+
+	CAM_DBG(CAM_ISP, "VFE:%d Bus RD IRQ status_0: 0x%X",
+		rsrc_data->common_data->core_index,
+		th_payload->evt_status_arr[0]);
+
+	return 0;
+}
+
+static int cam_vfe_bus_rd_handle_irq_bottom_half(
+	void  *handler_priv, void *evt_payload_priv)
+{
+	struct cam_isp_resource_node                *bus_rd = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rsrc_data = NULL;
+
+	bus_rd = (struct cam_isp_resource_node *)handler_priv;
+	if (!bus_rd) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+	rsrc_data = bus_rd->res_priv;
+
+	if (rsrc_data->status & 0x2)
+		CAM_DBG(CAM_ISP, "Received VFE:%d BUS RD RUP",
+			rsrc_data->common_data->core_index);
+	else if (rsrc_data->status & 0x4)
+		CAM_DBG(CAM_ISP, "Received VFE:%d BUS RD BUF DONE",
+			rsrc_data->common_data->core_index);
+	else if (rsrc_data->status & 0x10000) {
+		CAM_ERR(CAM_ISP, "Received VFE:%d BUS RD CCIF Violation",
+			rsrc_data->common_data->core_index);
+		return CAM_VFE_IRQ_STATUS_VIOLATION;
+	}
+
+	return CAM_VFE_IRQ_STATUS_SUCCESS;
+}
+
+static int cam_vfe_bus_get_rm_idx(
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type vfe_bus_rd_res_id,
+	enum cam_vfe_bus_plane_type plane)
+{
+	int rm_idx = -1;
+
+	switch (vfe_bus_rd_res_id) {
+	case CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0:
+		switch (plane) {
+		case PLANE_Y:
+			rm_idx = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	return rm_idx;
+}
+
+static int cam_vfe_bus_acquire_rm(
+	struct cam_vfe_bus_rd_ver1_priv             *ver1_bus_rd_priv,
+	void                                        *tasklet,
+	void                                        *ctx,
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type     vfe_bus_rd_res_id,
+	enum cam_vfe_bus_plane_type                  plane,
+	struct cam_isp_resource_node               **rm_res,
+	uint32_t                                    *client_done_mask,
+	uint32_t                                     is_dual,
+	uint32_t                                     unpacker_fmt)
+{
+	uint32_t                                     rm_idx = 0;
+	struct cam_isp_resource_node                *rm_res_local = NULL;
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data = NULL;
+
+	*rm_res = NULL;
+	*client_done_mask = 0;
+
+	/* No need to allocate for BUS VER2. VFE OUT to RM is fixed. */
+	rm_idx = cam_vfe_bus_get_rm_idx(vfe_bus_rd_res_id, plane);
+	if (rm_idx < 0 || rm_idx >= ver1_bus_rd_priv->num_client) {
+		CAM_ERR(CAM_ISP, "Unsupported VFE RM:%d plane:%d",
+			vfe_bus_rd_res_id, plane);
+		return -EINVAL;
+	}
+
+	rm_res_local = &ver1_bus_rd_priv->bus_client[rm_idx];
+	if (rm_res_local->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "VFE:%d RM:%d res not available state:%d",
+			ver1_bus_rd_priv->common_data.core_index, rm_idx,
+			rm_res_local->res_state);
+		return -EALREADY;
+	}
+	rm_res_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rm_res_local->tasklet_info = tasklet;
+
+	rsrc_data = rm_res_local->res_priv;
+	rsrc_data->ctx = ctx;
+	rsrc_data->is_dual = is_dual;
+	rsrc_data->unpacker_cfg = cam_vfe_bus_get_unpacker_fmt(unpacker_fmt);
+	rsrc_data->latency_buf_allocation =
+		BUS_RD_VER1_DEFAULT_LATENCY_BUF_ALLOC;
+	/* Set RM offset value to default */
+	rsrc_data->offset  = 0;
+
+	*client_done_mask = (1 << (rm_idx + 2));
+	*rm_res = rm_res_local;
+
+	CAM_DBG(CAM_ISP, "VFE:%d RM:%d Acquired",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+	return 0;
+}
+
+static int cam_vfe_bus_release_rm(void              *bus_priv,
+	struct cam_isp_resource_node                *rm_res)
+{
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data =
+		rm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->unpacker_cfg = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+
+	rm_res->tasklet_info = NULL;
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_ISP, "VFE:%d RM:%d released",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+	return 0;
+}
+
+static int cam_vfe_bus_start_rm(struct cam_isp_resource_node *rm_res)
+{
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rm_data;
+	struct cam_vfe_bus_rd_ver1_common_data      *common_data;
+	uint32_t                                     buf_size;
+
+	rm_data = rm_res->res_priv;
+	common_data = rm_data->common_data;
+
+	buf_size = ((rm_data->width)&(0x0000FFFF)) |
+		((rm_data->height<<16)&(0xFFFF0000));
+	cam_io_w_mb(buf_size, common_data->mem_base +
+		rm_data->hw_regs->buf_size);
+	cam_io_w_mb(rm_data->width, common_data->mem_base +
+		rm_data->hw_regs->stride);
+	cam_io_w_mb(rm_data->unpacker_cfg, common_data->mem_base +
+		rm_data->hw_regs->unpacker_cfg);
+	cam_io_w_mb(rm_data->latency_buf_allocation, common_data->mem_base +
+		rm_data->hw_regs->latency_buf_allocation);
+	cam_io_w_mb(0x1, common_data->mem_base + rm_data->hw_regs->cfg);
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	CAM_DBG(CAM_ISP,
+		"Start VFE:%d RM:%d offset:0x%X en_cfg:0x%X width:%d height:%d",
+		rm_data->common_data->core_index, rm_data->index,
+		(uint32_t) rm_data->hw_regs->cfg, rm_data->en_cfg,
+		rm_data->width, rm_data->height);
+	CAM_DBG(CAM_ISP, "RM:%d pk_fmt:%d stride:%d", rm_data->index,
+		rm_data->unpacker_cfg, rm_data->stride);
+
+	return 0;
+}
+
+static int cam_vfe_bus_stop_rm(struct cam_isp_resource_node *rm_res)
+{
+	int rc = 0;
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data =
+		rm_res->res_priv;
+	struct cam_vfe_bus_rd_ver1_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable RM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_data->init_cfg_done = false;
+
+	CAM_DBG(CAM_ISP, "VFE:%d RM:%d stopped",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	return rc;
+}
+
+static int cam_vfe_bus_init_rm_resource(uint32_t index,
+	struct cam_vfe_bus_rd_ver1_priv   *ver1_bus_rd_priv,
+	struct cam_vfe_bus_rd_ver1_hw_info *bus_rd_hw_info,
+	struct cam_isp_resource_node    *rm_res)
+{
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_rd_ver1_rm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_ISP, "Failed to alloc VFE:%d RM res priv",
+			ver1_bus_rd_priv->common_data.core_index);
+		return -ENOMEM;
+	}
+	rm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &bus_rd_hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &ver1_bus_rd_priv->common_data;
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&rm_res->list);
+
+	rm_res->start = cam_vfe_bus_start_rm;
+	rm_res->stop = cam_vfe_bus_stop_rm;
+	rm_res->hw_intf = ver1_bus_rd_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_rm_resource(
+	struct cam_isp_resource_node    *rm_res)
+{
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data;
+
+	rm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&rm_res->list);
+
+	rm_res->start = NULL;
+	rm_res->stop = NULL;
+	rm_res->top_half_handler = NULL;
+	rm_res->bottom_half_handler = NULL;
+	rm_res->hw_intf = NULL;
+
+	rsrc_data = rm_res->res_priv;
+	rm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_rd_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	return 0;
+}
+
+static int cam_vfe_bus_acquire_vfe_bus_rd(void *bus_priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                           rc = -ENODEV;
+	int                                           i;
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type      bus_rd_res_id;
+	int                                           num_rm;
+	uint32_t                                      client_done_mask;
+	struct cam_vfe_bus_rd_ver1_priv              *ver1_bus_rd_priv =
+		bus_priv;
+	struct cam_vfe_acquire_args                  *acq_args = acquire_args;
+	struct cam_vfe_hw_vfe_bus_rd_acquire_args    *bus_rd_acquire_args;
+	struct cam_isp_resource_node                 *rsrc_node = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data   *rsrc_data = NULL;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_ISP, "Invalid Param");
+		return -EINVAL;
+	}
+
+	bus_rd_acquire_args = &acq_args->vfe_bus_rd;
+
+	bus_rd_res_id = cam_vfe_bus_get_bus_rd_res_id(
+		acq_args->rsrc_type);
+	if (bus_rd_res_id == CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX)
+		return -ENODEV;
+
+	num_rm = cam_vfe_bus_get_num_rm(bus_rd_res_id);
+	if (num_rm < 1)
+		return -EINVAL;
+
+	rsrc_node = &ver1_bus_rd_priv->vfe_bus_rd[bus_rd_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "VFE:%d RM:0x%x not available state:%d",
+			ver1_bus_rd_priv->common_data.core_index,
+			acq_args->rsrc_type, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	rsrc_node->res_id = acq_args->rsrc_type;
+	rsrc_data = rsrc_node->res_priv;
+
+	CAM_DBG(CAM_ISP, "VFE:%d acquire RD type:0x%x",
+		rsrc_data->common_data->core_index, acq_args->rsrc_type);
+
+	rsrc_data->num_rm = num_rm;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	ver1_bus_rd_priv->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = bus_rd_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = bus_rd_acquire_args->cdm_ops;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->is_offline = bus_rd_acquire_args->is_offline;
+
+	for (i = 0; i < num_rm; i++) {
+		rc = cam_vfe_bus_acquire_rm(ver1_bus_rd_priv,
+			acq_args->tasklet,
+			acq_args->priv,
+			bus_rd_res_id,
+			i,
+			&rsrc_data->rm_res[i],
+			&client_done_mask,
+			bus_rd_acquire_args->is_dual,
+			bus_rd_acquire_args->unpacker_fmt);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d RM:%d acquire failed rc:%d",
+				rsrc_data->common_data->core_index,
+				bus_rd_res_id, rc);
+			goto release_rm;
+		}
+	}
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	bus_rd_acquire_args->rsrc_node = rsrc_node;
+
+	CAM_DBG(CAM_ISP, "VFE:%d acquire RD 0x%x successful",
+		rsrc_data->common_data->core_index, acq_args->rsrc_type);
+	return rc;
+
+release_rm:
+	for (i--; i >= 0; i--)
+		cam_vfe_bus_release_rm(ver1_bus_rd_priv, rsrc_data->rm_res[i]);
+	return rc;
+}
+
+static int cam_vfe_bus_release_vfe_bus_rd(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node          *vfe_bus_rd = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rsrc_data = NULL;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	vfe_bus_rd = release_args;
+	rsrc_data = vfe_bus_rd->res_priv;
+
+	if (vfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d RD type:0x%x invalid resource state:%d",
+			rsrc_data->common_data->core_index,
+			vfe_bus_rd->res_id, vfe_bus_rd->res_state);
+	}
+
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		cam_vfe_bus_release_rm(bus_priv, rsrc_data->rm_res[i]);
+	rsrc_data->num_rm = 0;
+
+	vfe_bus_rd->tasklet_info = NULL;
+	vfe_bus_rd->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+
+	if (vfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		vfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_vfe_bus_rd(
+	struct cam_isp_resource_node          *vfe_bus_rd)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data *rsrc_data = NULL;
+	struct cam_vfe_bus_rd_ver1_common_data *common_data = NULL;
+	uint32_t irq_reg_mask[1] = {0x6}, val = 0;
+
+	if (!vfe_bus_rd) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_bus_rd->res_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP, "VFE:%d start RD type:0x%x", vfe_bus_rd->res_id);
+
+	if (vfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid resource state:%d",
+			vfe_bus_rd->res_state);
+		return -EACCES;
+	}
+
+	if (!rsrc_data->is_offline) {
+		val = (common_data->fs_sync_enable << 5) |
+			(common_data->go_cmd_sel << 4);
+		cam_io_w_mb(val, common_data->mem_base +
+			common_data->common_reg->input_if_cmd);
+	}
+
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		rc = cam_vfe_bus_start_rm(rsrc_data->rm_res[i]);
+
+	rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+		common_data->bus_irq_controller,
+		CAM_IRQ_PRIORITY_1,
+		irq_reg_mask,
+		vfe_bus_rd,
+		cam_vfe_bus_rd_handle_irq_top_half,
+		cam_vfe_bus_rd_handle_irq_bottom_half,
+		vfe_bus_rd->tasklet_info,
+		&tasklet_bh_api);
+
+	if (rsrc_data->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Failed to subscribe BUS RD IRQ");
+		rsrc_data->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	vfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_vfe_bus_stop_vfe_bus_rd(
+	struct cam_isp_resource_node          *vfe_bus_rd)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rsrc_data = NULL;
+
+	if (!vfe_bus_rd) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_bus_rd->res_priv;
+
+	if (vfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		vfe_bus_rd->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "VFE:%d Bus RD 0x%x state: %d",
+			rsrc_data->common_data->core_index, vfe_bus_rd->res_id,
+			vfe_bus_rd->res_state);
+		return rc;
+	}
+	for (i = 0; i < rsrc_data->num_rm; i++)
+		rc = cam_vfe_bus_stop_rm(rsrc_data->rm_res[i]);
+
+	if (rsrc_data->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			rsrc_data->common_data->bus_irq_controller,
+			rsrc_data->irq_handle);
+		rsrc_data->irq_handle = 0;
+	}
+
+	vfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	CAM_DBG(CAM_ISP, "VFE:%d stopped Bus RD:0x%x",
+		rsrc_data->common_data->core_index,
+		vfe_bus_rd->res_id);
+	return rc;
+}
+
+static int cam_vfe_bus_init_vfe_bus_read_resource(uint32_t  index,
+	struct cam_vfe_bus_rd_ver1_priv                  *bus_rd_priv,
+	struct cam_vfe_bus_rd_ver1_hw_info               *bus_rd_hw_info)
+{
+	struct cam_isp_resource_node         *vfe_bus_rd = NULL;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data *rsrc_data = NULL;
+	int rc = 0;
+	int32_t vfe_bus_rd_resc_type =
+		bus_rd_hw_info->vfe_bus_rd_hw_info[index].vfe_bus_rd_type;
+
+	if (vfe_bus_rd_resc_type < 0 ||
+		vfe_bus_rd_resc_type >= CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX) {
+		CAM_ERR(CAM_ISP, "Init VFE Out failed, Invalid type=%d",
+			vfe_bus_rd_resc_type);
+		return -EINVAL;
+	}
+
+	vfe_bus_rd = &bus_rd_priv->vfe_bus_rd[vfe_bus_rd_resc_type];
+	if (vfe_bus_rd->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		vfe_bus_rd->res_priv) {
+		CAM_ERR(CAM_ISP,
+			"Error. Looks like same resource is init again");
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	vfe_bus_rd->res_priv = rsrc_data;
+
+	vfe_bus_rd->res_type = CAM_ISP_RESOURCE_VFE_BUS_RD;
+	vfe_bus_rd->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&vfe_bus_rd->list);
+
+	rsrc_data->bus_rd_type    =
+		bus_rd_hw_info->vfe_bus_rd_hw_info[index].vfe_bus_rd_type;
+	rsrc_data->common_data = &bus_rd_priv->common_data;
+	rsrc_data->max_width   =
+		bus_rd_hw_info->vfe_bus_rd_hw_info[index].max_width;
+	rsrc_data->max_height  =
+		bus_rd_hw_info->vfe_bus_rd_hw_info[index].max_height;
+	rsrc_data->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+
+	vfe_bus_rd->start = cam_vfe_bus_start_vfe_bus_rd;
+	vfe_bus_rd->stop = cam_vfe_bus_stop_vfe_bus_rd;
+	vfe_bus_rd->process_cmd = cam_vfe_bus_rd_process_cmd;
+	vfe_bus_rd->hw_intf = bus_rd_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_vfe_bus_rd_resource(
+	struct cam_isp_resource_node    *vfe_bus_rd_res)
+{
+	struct cam_vfe_bus_ver2_vfe_out_data *rsrc_data =
+		vfe_bus_rd_res->res_priv;
+
+	if (vfe_bus_rd_res->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		CAM_DBG(CAM_ISP, "HW%d Res %d already deinitialized");
+		return 0;
+	}
+
+	vfe_bus_rd_res->start = NULL;
+	vfe_bus_rd_res->stop = NULL;
+	vfe_bus_rd_res->top_half_handler = NULL;
+	vfe_bus_rd_res->bottom_half_handler = NULL;
+	vfe_bus_rd_res->hw_intf = NULL;
+
+	vfe_bus_rd_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&vfe_bus_rd_res->list);
+	vfe_bus_rd_res->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_rd_ver1_handle_irq(uint32_t    evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	struct cam_vfe_bus_rd_ver1_priv *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	CAM_DBG(CAM_ISP, "Top Bus RD IRQ Received");
+
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller);
+
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_vfe_bus_rd_update_rm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_rd_ver1_priv          *bus_priv;
+	struct cam_isp_hw_get_cmd_update         *update_buf;
+	struct cam_buf_io_cfg                    *io_cfg;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data     *vfe_bus_rd_data = NULL;
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rm_data = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t  i, j, size = 0;
+	uint32_t buf_size = 0;
+
+	bus_priv = (struct cam_vfe_bus_rd_ver1_priv  *) priv;
+	update_buf =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_bus_rd_data = (struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data *)
+		update_buf->res->res_priv;
+
+	if (!vfe_bus_rd_data || !vfe_bus_rd_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "#of RM: %d",  vfe_bus_rd_data->num_rm);
+	if (update_buf->rm_update->num_buf != vfe_bus_rd_data->num_rm) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->rm_update->num_buf,
+			vfe_bus_rd_data->num_rm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &vfe_bus_rd_data->common_data->io_buf_update[0];
+	io_cfg = update_buf->rm_update->io_cfg;
+
+	for (i = 0, j = 0; i < vfe_bus_rd_data->num_rm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %lu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		rm_data = vfe_bus_rd_data->rm_res[i]->res_priv;
+
+		/* update size register */
+		cam_vfe_bus_rd_pxls_to_bytes(io_cfg->planes[i].width,
+			rm_data->unpacker_cfg, &rm_data->width);
+		rm_data->height = io_cfg->planes[i].height;
+
+		buf_size = ((rm_data->width)&(0x0000FFFF)) |
+			((rm_data->height<<16)&(0xFFFF0000));
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->buf_size, buf_size);
+		CAM_DBG(CAM_ISP, "VFE:%d RM:%d image_size:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+
+		rm_data->stride = io_cfg->planes[i].plane_stride;
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->stride, rm_data->stride);
+		CAM_DBG(CAM_ISP, "VFE:%d RM:%d image_stride:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			rm_data->hw_regs->image_addr,
+			update_buf->rm_update->image_buf[i] +
+				rm_data->offset);
+		CAM_DBG(CAM_ISP, "VFE:%d RM:%d image_address:0x%X",
+			rm_data->common_data->core_index,
+			rm_data->index, reg_val_pair[j-1]);
+		rm_data->img_addr = reg_val_pair[j-1];
+
+	}
+
+	size = vfe_bus_rd_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_buf->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_buf->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	vfe_bus_rd_data->cdm_util_ops->cdm_write_regrandom(
+		update_buf->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_buf->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_vfe_bus_rd_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	return 0;
+}
+
+static int cam_vfe_bus_rd_update_fs_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_rd_ver1_priv              *bus_priv;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data   *vfe_bus_rd_data = NULL;
+	struct cam_vfe_bus_rd_ver1_rm_resource_data  *rm_data = NULL;
+	struct cam_vfe_fe_update_args                *fe_upd_args;
+	struct cam_fe_config                         *fe_cfg;
+	struct cam_vfe_bus_rd_ver1_common_data        *common_data;
+	int i = 0;
+
+	bus_priv = (struct cam_vfe_bus_rd_ver1_priv  *) priv;
+	fe_upd_args = (struct cam_vfe_fe_update_args *)cmd_args;
+
+	vfe_bus_rd_data = (struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data *)
+		fe_upd_args->node_res->res_priv;
+
+	if (!vfe_bus_rd_data || !vfe_bus_rd_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	fe_cfg = &fe_upd_args->fe_config;
+
+	for (i = 0; i < vfe_bus_rd_data->num_rm; i++) {
+
+		rm_data = vfe_bus_rd_data->rm_res[i]->res_priv;
+		common_data = rm_data->common_data;
+
+		rm_data->format = fe_cfg->format;
+		rm_data->unpacker_cfg = fe_cfg->unpacker_cfg;
+		rm_data->latency_buf_allocation = fe_cfg->latency_buf_size;
+		rm_data->stride = fe_cfg->stride;
+		rm_data->go_cmd_sel = fe_cfg->go_cmd_sel;
+		rm_data->fs_sync_enable = fe_cfg->fs_sync_enable;
+		rm_data->hbi_count = fe_cfg->hbi_count;
+		rm_data->fs_line_sync_en = fe_cfg->fs_line_sync_en;
+		rm_data->fs_mode = fe_cfg->fs_mode;
+		rm_data->min_vbi = fe_cfg->min_vbi;
+
+		CAM_DBG(CAM_ISP,
+			"VFE:%d RM:%d format:0x%x unpacker_cfg:0x%x",
+			rm_data->format, rm_data->unpacker_cfg);
+		CAM_DBG(CAM_ISP,
+			"latency_buf_alloc:0x%x stride:0x%x go_cmd_sel:0x%x",
+			rm_data->latency_buf_allocation, rm_data->stride,
+			rm_data->go_cmd_sel);
+		CAM_DBG(CAM_ISP,
+			"fs_sync_en:%d hbi_cnt:0x%x fs_mode:0x%x min_vbi:0x%x",
+			rm_data->fs_sync_enable, rm_data->hbi_count,
+			rm_data->fs_mode, rm_data->min_vbi);
+	}
+	bus_priv->common_data.fs_sync_enable = fe_cfg->fs_sync_enable;
+	bus_priv->common_data.go_cmd_sel = fe_cfg->go_cmd_sel;
+	return 0;
+}
+
+static int cam_vfe_bus_rd_add_go_cmd(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *rd_data;
+	struct cam_isp_hw_get_cmd_update            *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops                    *cdm_util_ops = NULL;
+	uint32_t reg_val_pair[2 * CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX];
+	struct cam_vfe_bus_rd_ver1_rm_resource_data *rsrc_data;
+	int i = 0;
+	uint32_t val = 0, size = 0, offset = 0;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "invalid ars size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	rd_data = (struct cam_vfe_bus_rd_ver1_vfe_bus_rd_data  *) priv;
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < rd_data->num_rm; i++) {
+		size = cdm_util_ops->cdm_required_size_reg_random(1);
+		/* since cdm returns dwords, we need to convert it into bytes */
+		if ((size * 4) > cdm_args->cmd.size) {
+			CAM_ERR(CAM_ISP,
+				"buf size:%d is not sufficient, expected: %d",
+				cdm_args->cmd.size, size);
+			return -EINVAL;
+		}
+
+		rsrc_data = rd_data->rm_res[i]->res_priv;
+		offset = rsrc_data->common_data->common_reg->input_if_cmd;
+		val = cam_io_r_mb(rsrc_data->common_data->mem_base + offset);
+		val |= 0x1;
+		reg_val_pair[i * 2] = offset;
+		reg_val_pair[i * 2 + 1] = val;
+		CAM_DBG(CAM_ISP, "VFE:%d Bus RD go_cmd: 0x%x offset 0x%x",
+			rd_data->common_data->core_index,
+			reg_val_pair[i * 2 + 1], reg_val_pair[i * 2]);
+	}
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+
+}
+
+static int cam_vfe_bus_start_hw(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_start_vfe_bus_rd(hw_priv);
+}
+
+static int cam_vfe_bus_stop_hw(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_stop_vfe_bus_rd(hw_priv);
+}
+
+static int cam_vfe_bus_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_rd_ver1_priv    *bus_priv = hw_priv;
+	uint32_t                            top_irq_reg_mask[3] = {0};
+	uint32_t                            offset = 0;
+	struct cam_vfe_bus_rd_ver1_reg_offset_common  *common_reg;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+	common_reg = bus_priv->common_data.common_reg;
+	top_irq_reg_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	bus_priv->irq_handle = cam_irq_controller_subscribe_irq(
+		bus_priv->common_data.vfe_irq_controller,
+		CAM_IRQ_PRIORITY_2,
+		top_irq_reg_mask,
+		bus_priv,
+		cam_vfe_bus_rd_ver1_handle_irq,
+		NULL,
+		NULL,
+		NULL);
+
+	if (bus_priv->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Failed to subscribe BUS IRQ");
+		bus_priv->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	/* no clock gating at bus input */
+	offset = common_reg->cgc_ovd;
+	cam_io_w_mb(0x1, bus_priv->common_data.mem_base + offset);
+
+	/* BUS_RD_TEST_BUS_CTRL */
+	offset = common_reg->test_bus_ctrl;
+	cam_io_w_mb(0x0, bus_priv->common_data.mem_base + offset);
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_rd_ver1_priv    *bus_priv = hw_priv;
+	int                              rc = 0;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Error: Invalid args");
+		return -EINVAL;
+	}
+
+	if (bus_priv->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			bus_priv->irq_handle);
+		bus_priv->irq_handle = 0;
+	}
+
+	return rc;
+}
+
+static int __cam_vfe_bus_rd_process_cmd(void *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_rd_process_cmd(priv, cmd_type, cmd_args, arg_size);
+}
+
+static int cam_vfe_bus_rd_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE_RM:
+		rc = cam_vfe_bus_rd_update_rm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE_RM:
+		rc = cam_vfe_bus_rd_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_SECURE_MODE:
+		rc = cam_vfe_bus_rd_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_BUS_RD:
+		rc = cam_vfe_bus_rd_update_fs_cfg(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_FE_TRIGGER_CMD:
+		rc = cam_vfe_bus_rd_add_go_cmd(priv, cmd_args, arg_size);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid camif process command:%d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_bus_rd_ver1_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_rd_ver1_priv    *bus_priv = NULL;
+	struct cam_vfe_bus                 *vfe_bus_local;
+	struct cam_vfe_bus_rd_ver1_hw_info *bus_rd_hw_info = bus_hw_info;
+
+	if (!soc_info || !hw_intf || !bus_hw_info || !vfe_irq_controller) {
+		CAM_ERR(CAM_ISP,
+			"Inval_prms soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_rd_hw_info);
+		CAM_ERR(CAM_ISP, "controller: %pK", vfe_irq_controller);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	vfe_bus_local = kzalloc(sizeof(struct cam_vfe_bus), GFP_KERNEL);
+	if (!vfe_bus_local) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_vfe_bus_rd_ver1_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+
+	vfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                     = bus_rd_hw_info->num_client;
+	bus_priv->num_bus_rd_resc                =
+		bus_rd_hw_info->num_bus_rd_resc;
+	bus_priv->common_data.num_sec_out        = 0;
+	bus_priv->common_data.secure_mode        = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index         = soc_info->index;
+	bus_priv->common_data.mem_base           =
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf            = hw_intf;
+	bus_priv->common_data.vfe_irq_controller = vfe_irq_controller;
+	bus_priv->common_data.common_reg         = &bus_rd_hw_info->common_reg;
+	bus_priv->top_irq_shift                 = bus_rd_hw_info->top_irq_shift;
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+
+	rc = cam_irq_controller_init(drv_name, bus_priv->common_data.mem_base,
+		&bus_rd_hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "cam_irq_controller_init failed");
+		goto free_bus_priv;
+	}
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_vfe_bus_init_rm_resource(i, bus_priv, bus_hw_info,
+			&bus_priv->bus_client[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init RM failed rc=%d", rc);
+			goto deinit_rm;
+		}
+	}
+
+	for (i = 0; i < bus_priv->num_bus_rd_resc; i++) {
+		rc = cam_vfe_bus_init_vfe_bus_read_resource(i, bus_priv,
+			bus_rd_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init VFE Out failed rc=%d", rc);
+			goto deinit_vfe_bus_rd;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+
+	vfe_bus_local->hw_ops.reserve      = cam_vfe_bus_acquire_vfe_bus_rd;
+	vfe_bus_local->hw_ops.release      = cam_vfe_bus_release_vfe_bus_rd;
+	vfe_bus_local->hw_ops.start        = cam_vfe_bus_start_hw;
+	vfe_bus_local->hw_ops.stop         = cam_vfe_bus_stop_hw;
+	vfe_bus_local->hw_ops.init         = cam_vfe_bus_init_hw;
+	vfe_bus_local->hw_ops.deinit       = cam_vfe_bus_deinit_hw;
+	vfe_bus_local->top_half_handler    = cam_vfe_bus_rd_ver1_handle_irq;
+	vfe_bus_local->bottom_half_handler = NULL;
+	vfe_bus_local->hw_ops.process_cmd  = __cam_vfe_bus_rd_process_cmd;
+
+	*vfe_bus = vfe_bus_local;
+
+	return rc;
+
+deinit_vfe_bus_rd:
+	if (i < 0)
+		i = CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_vfe_bus_rd_resource(
+			&bus_priv->vfe_bus_rd[i]);
+deinit_rm:
+	if (i < 0)
+		i = bus_priv->num_client;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_rm_resource(&bus_priv->bus_client[i]);
+
+free_bus_priv:
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_vfe_bus_rd_bus_ver1_deinit(
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_rd_ver1_priv    *bus_priv = NULL;
+	struct cam_vfe_bus                 *vfe_bus_local;
+
+	if (!vfe_bus || !*vfe_bus) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+	vfe_bus_local = *vfe_bus;
+
+	bus_priv = vfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_vfe_bus_deinit_rm_resource(&bus_priv->bus_client[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit RM failed rc=%d", rc);
+	}
+	for (i = 0; i < CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX; i++) {
+		rc = cam_vfe_bus_deinit_vfe_bus_rd_resource(
+			&bus_priv->vfe_bus_rd[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit VFE Out failed rc=%d", rc);
+	}
+
+	rc = cam_irq_controller_deinit(
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Deinit IRQ Controller failed rc=%d", rc);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+	*vfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.h
@@ -0,0 +1,129 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_BUS_R_VER1_H_
+#define _CAM_VFE_BUS_R_VER1_H_
+
+#include "cam_irq_controller.h"
+#include "cam_vfe_bus.h"
+
+#define CAM_VFE_BUS_RD_VER1_MAX_CLIENTS 1
+
+enum cam_vfe_bus_rd_ver1_vfe_core_id {
+	CAM_VFE_BUS_RD_VER1_VFE_CORE_0,
+	CAM_VFE_BUS_RD_VER1_VFE_CORE_1,
+	CAM_VFE_BUS_RD_VER1_VFE_CORE_MAX,
+};
+
+enum cam_vfe_bus_rd_ver1_comp_grp_type {
+	CAM_VFE_BUS_RD_VER1_COMP_GRP_0,
+	CAM_VFE_BUS_RD_VER1_COMP_GRP_MAX,
+};
+
+
+enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type {
+	CAM_VFE_BUS_RD_VER1_VFE_BUSRD_RDI0,
+	CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX,
+};
+
+/*
+ * struct cam_vfe_bus_rd_ver1_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_vfe_bus_rd_ver1_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t sw_reset;
+	uint32_t cgc_ovd;
+	uint32_t pwr_iso_cfg;
+	uint32_t input_if_cmd;
+	uint32_t test_bus_ctrl;
+	struct cam_irq_controller_reg_info irq_reg_info;
+};
+
+/*
+ * struct cam_vfe_bus_rd_ver1_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_vfe_bus_rd_ver1_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t buf_size;
+	uint32_t stride;
+	uint32_t unpacker_cfg;
+	uint32_t latency_buf_allocation;
+	uint32_t burst_limit;
+};
+
+/*
+ * struct cam_vfe_bus_rd_ver1_vfe_bus_hw_info:
+ *
+ * @Brief:        HW capability of VFE Bus Client
+ */
+struct cam_vfe_bus_rd_ver1_vfe_bus_hw_info {
+	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type  vfe_bus_rd_type;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+};
+
+/*
+ * struct cam_vfe_bus_rd_ver1_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:       Common register details
+ * @bus_client_reg:   Bus client register info
+ * @comp_reg_grp:     Composite group register info
+ * @vfe_out_hw_info:  VFE output capability
+ */
+struct cam_vfe_bus_rd_ver1_hw_info {
+	struct cam_vfe_bus_rd_ver1_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_vfe_bus_rd_ver1_reg_offset_bus_client
+		bus_client_reg[CAM_VFE_BUS_RD_VER1_MAX_CLIENTS];
+	uint32_t num_bus_rd_resc;
+	struct cam_vfe_bus_rd_ver1_vfe_bus_hw_info
+		vfe_bus_rd_hw_info[CAM_VFE_BUS_RD_VER1_VFE_BUSRD_MAX];
+	uint32_t top_irq_shift;
+};
+
+/*
+ * cam_vfe_bus_rd_ver1_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_rd_ver1_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus);
+
+/*
+ * cam_vfe_bus_rd_bus_ver1_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @vfe_bus:                 Pointer to vfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_rd_bus_ver1_deinit(struct cam_vfe_bus     **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_R_VER1_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver1.h
@@ -0,0 +1,113 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_BUS_VER1_H_
+#define _CAM_VFE_BUS_VER1_H_
+
+enum cam_vfe_bus_ver1_pingpong_id {
+	CAM_VFE_BUS_VER1_PING,
+	CAM_VFE_BUS_VER1_PONG,
+	CAM_VFE_BUS_VER1_PINGPONG_MAX,
+};
+
+enum cam_vfe_bus_ver1_wm_type {
+	CAM_VFE_BUS_WM_TYPE_IMAGE,
+	CAM_VFE_BUS_WM_TYPE_STATS,
+	CAM_VFE_BUS_WM_TYPE_MAX,
+};
+
+enum cam_vfe_bus_ver1_comp_grp_type {
+	CAM_VFE_BUS_VER1_COMP_GRP_IMG0,
+	CAM_VFE_BUS_VER1_COMP_GRP_IMG1,
+	CAM_VFE_BUS_VER1_COMP_GRP_IMG2,
+	CAM_VFE_BUS_VER1_COMP_GRP_IMG3,
+	CAM_VFE_BUS_VER1_COMP_GRP_STATS0,
+	CAM_VFE_BUS_VER1_COMP_GRP_STATS1,
+	CAM_VFE_BUS_VER1_COMP_GRP_MAX,
+};
+
+struct cam_vfe_bus_ver1_common_reg {
+	uint32_t cmd_offset;
+	uint32_t cfg_offset;
+	uint32_t io_fmt_offset;
+	uint32_t argb_cfg_offset;
+	uint32_t xbar_cfg0_offset;
+	uint32_t xbar_cfg1_offset;
+	uint32_t xbar_cfg2_offset;
+	uint32_t xbar_cfg3_offset;
+	uint32_t ping_pong_status_reg;
+};
+
+struct cam_vfe_bus_ver1_wm_reg {
+	uint32_t wm_cfg_offset;
+	uint32_t ping_addr_offset;
+	uint32_t ping_max_addr_offset;
+	uint32_t pong_addr_offset;
+	uint32_t pong_max_addr_offset;
+	uint32_t addr_cfg_offset;
+	uint32_t ub_cfg_offset;
+	uint32_t image_size_offset;
+	uint32_t buffer_cfg_offset;
+	uint32_t framedrop_pattern_offset;
+	uint32_t irq_subsample_pattern_offset;
+	uint32_t ping_pong_status_bit; /* 0 - 31 */
+	uint32_t composite_bit; /* 0 -31 */
+};
+
+struct cam_vfe_bus_ver1_wm_resource_data {
+	uint32_t             index;
+	uint32_t             wm_type;
+	uint32_t             res_type;
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             scanline;
+
+	uint32_t             burst_len;
+
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             buf_valid[CAM_VFE_BUS_VER1_PINGPONG_MAX];
+	uint32_t             ub_size;
+	uint32_t             ub_offset;
+
+	struct cam_vfe_bus_ver1_wm_reg  hw_regs;
+};
+
+struct cam_vfe_bus_ver1_comp_grp_reg {
+	enum cam_vfe_bus_ver1_comp_grp_type comp_grp_type;
+	uint32_t             comp_grp_offset;
+};
+
+struct cam_vfe_bus_ver1_comp_grp {
+	struct cam_vfe_bus_ver1_comp_grp_reg reg_info;
+	struct list_head     wm_list;
+	uint32_t             cur_bit_mask;
+};
+
+/*
+ * cam_vfe_bus_ver1_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @mem_base:                Mapped base address of register space
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ */
+int cam_vfe_bus_ver1_init(
+	void __iomem                         *mem_base,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_VER1_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
@@ -0,0 +1,4312 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_bus_ver2.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_core.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+
+static const char drv_name[] = "vfe_bus";
+
+#define CAM_VFE_BUS_IRQ_REG0                     0
+#define CAM_VFE_BUS_IRQ_REG1                     1
+#define CAM_VFE_BUS_IRQ_REG2                     2
+#define CAM_VFE_BUS_IRQ_MAX                      3
+
+#define CAM_VFE_BUS_VER2_PAYLOAD_MAX             256
+
+#define CAM_VFE_BUS_SET_DEBUG_REG                0x82
+
+#define CAM_VFE_RDI_BUS_DEFAULT_WIDTH               0xFF01
+#define CAM_VFE_RDI_BUS_DEFAULT_STRIDE              0xFF01
+#define CAM_VFE_BUS_INTRA_CLIENT_MASK               0x3
+#define CAM_VFE_BUS_ADDR_SYNC_INTRA_CLIENT_SHIFT    8
+#define CAM_VFE_BUS_ADDR_NO_SYNC_DEFAULT_VAL \
+	((1 << CAM_VFE_BUS_VER2_MAX_CLIENTS) - 1)
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	((sizeof(struct cam_vfe_bus_ver2_reg_offset_bus_client) +  \
+	sizeof(struct cam_vfe_bus_ver2_reg_offset_ubwc_client))/4)
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+static uint32_t bus_error_irq_mask[3] = {
+	0x7800,
+	0x0000,
+	0x0040,
+};
+
+enum cam_vfe_bus_packer_format {
+	PACKER_FMT_PLAIN_128                   = 0x0,
+	PACKER_FMT_PLAIN_8                     = 0x1,
+	PACKER_FMT_PLAIN_16_10BPP              = 0x2,
+	PACKER_FMT_PLAIN_16_12BPP              = 0x3,
+	PACKER_FMT_PLAIN_16_14BPP              = 0x4,
+	PACKER_FMT_PLAIN_16_16BPP              = 0x5,
+	PACKER_FMT_ARGB_10                     = 0x6,
+	PACKER_FMT_ARGB_12                     = 0x7,
+	PACKER_FMT_ARGB_14                     = 0x8,
+	PACKER_FMT_PLAIN_32_20BPP              = 0x9,
+	PACKER_FMT_PLAIN_64                    = 0xA,
+	PACKER_FMT_TP_10                       = 0xB,
+	PACKER_FMT_PLAIN_32_32BPP              = 0xC,
+	PACKER_FMT_PLAIN_8_ODD_EVEN            = 0xD,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10          = 0xE,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN = 0xF,
+	PACKER_FMT_MAX                         = 0xF,
+};
+
+enum cam_vfe_bus_comp_grp_id {
+	CAM_VFE_BUS_COMP_GROUP_NONE = -EINVAL,
+	CAM_VFE_BUS_COMP_GROUP_ID_0 = 0x0,
+	CAM_VFE_BUS_COMP_GROUP_ID_1 = 0x1,
+	CAM_VFE_BUS_COMP_GROUP_ID_2 = 0x2,
+	CAM_VFE_BUS_COMP_GROUP_ID_3 = 0x3,
+	CAM_VFE_BUS_COMP_GROUP_ID_4 = 0x4,
+	CAM_VFE_BUS_COMP_GROUP_ID_5 = 0x5,
+};
+
+struct cam_vfe_bus_error_info {
+	uint32_t  bitmask;
+	uint32_t  vfe_output;
+	char     *error_description;
+};
+
+struct cam_vfe_bus_ver2_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *bus_irq_controller;
+	void                                       *vfe_irq_controller;
+	struct cam_vfe_bus_ver2_reg_offset_common  *common_reg;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+
+	struct cam_vfe_bus_irq_evt_payload          evt_payload[
+		CAM_VFE_BUS_VER2_PAYLOAD_MAX];
+	struct list_head                            free_payload_list;
+	spinlock_t                                  spin_lock;
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    addr_no_sync;
+	cam_hw_mgr_event_cb_func                    event_cb;
+	bool                                        is_lite;
+	bool                                        hw_init;
+	bool                                        support_consumed_addr;
+	bool                                        disable_ubwc_comp;
+};
+
+struct cam_vfe_bus_ver2_wm_resource_data {
+	uint32_t             index;
+	struct cam_vfe_bus_ver2_common_data            *common_data;
+	struct cam_vfe_bus_ver2_reg_offset_bus_client  *hw_regs;
+
+	bool                 init_cfg_done;
+	bool                 hfr_cfg_done;
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	enum cam_vfe_bus_packer_format pack_fmt;
+
+	uint32_t             burst_len;
+
+	uint32_t             en_ubwc;
+	bool                 ubwc_updated;
+	uint32_t             packer_cfg;
+	uint32_t             tile_cfg;
+	uint32_t             h_init;
+	uint32_t             v_init;
+	uint32_t             ubwc_meta_stride;
+	uint32_t             ubwc_mode_cfg_0;
+	uint32_t             ubwc_mode_cfg_1;
+	uint32_t             ubwc_meta_offset;
+
+	uint32_t             irq_subsample_period;
+	uint32_t             irq_subsample_pattern;
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             en_cfg;
+	uint32_t             is_dual;
+	uint32_t             ubwc_lossy_threshold_0;
+	uint32_t             ubwc_lossy_threshold_1;
+	uint32_t             ubwc_bandwidth_limit;
+	uint32_t             acquired_width;
+	uint32_t             acquired_height;
+};
+
+struct cam_vfe_bus_ver2_comp_grp_data {
+	enum cam_vfe_bus_ver2_comp_grp_type          comp_grp_type;
+	struct cam_vfe_bus_ver2_common_data         *common_data;
+	struct cam_vfe_bus_ver2_reg_offset_comp_grp *hw_regs;
+
+	uint32_t                         comp_grp_local_idx;
+	uint32_t                         unique_id;
+
+	uint32_t                         is_master;
+	uint32_t                         dual_slave_core;
+	uint32_t                         intra_client_mask;
+	uint32_t                         composite_mask;
+	uint32_t                         addr_sync_mode;
+
+	uint32_t                         acquire_dev_cnt;
+};
+
+struct cam_vfe_bus_ver2_vfe_out_data {
+	uint32_t                              out_type;
+	struct cam_vfe_bus_ver2_common_data  *common_data;
+
+	uint32_t                         num_wm;
+	struct cam_isp_resource_node    *wm_res[PLANE_MAX];
+
+	struct cam_isp_resource_node    *comp_grp;
+	enum cam_isp_hw_sync_mode        dual_comp_sync_mode;
+	uint32_t                         dual_hw_alternate_vfe_id;
+	struct list_head                 vfe_out_list;
+
+	uint32_t                         format;
+	uint32_t                         max_width;
+	uint32_t                         max_height;
+	struct cam_cdm_utils_ops        *cdm_util_ops;
+	uint32_t                         secure_mode;
+	void                            *priv;
+	uint32_t                         mid[CAM_VFE_BUS_VER2_MAX_MID_PER_PORT];
+};
+
+struct cam_vfe_bus_ver2_priv {
+	struct cam_vfe_bus_ver2_common_data common_data;
+	uint32_t                            num_client;
+	uint32_t                            num_out;
+	uint32_t                            top_irq_shift;
+
+	struct cam_isp_resource_node  bus_client[CAM_VFE_BUS_VER2_MAX_CLIENTS];
+	struct cam_isp_resource_node  comp_grp[CAM_VFE_BUS_VER2_COMP_GRP_MAX];
+	struct cam_isp_resource_node  vfe_out[CAM_VFE_BUS_VER2_VFE_OUT_MAX];
+	uint32_t  vfe_out_map_outtype[CAM_VFE_BUS_VER2_VFE_OUT_MAX];
+
+	struct list_head                    free_comp_grp;
+	struct list_head                    free_dual_comp_grp;
+	struct list_head                    used_comp_grp;
+
+	int                                 irq_handle;
+	int                                 error_irq_handle;
+	void                               *tasklet_info;
+	uint32_t                            max_out_res;
+};
+
+static const struct cam_vfe_bus_error_info vfe_error_list[] = {
+	{
+		.bitmask = 0x80000000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP,
+		.error_description = "DISP C 1:1"
+	},
+	{
+		.bitmask = 0x40000000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP,
+		.error_description = "DISP Y 1:1"
+	},
+	{
+		.bitmask = 0x01000000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+		.error_description = "STATS TINTLESS BG"
+	},
+	{
+		.bitmask = 0x00800000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+		.error_description = "STATS BHIST"
+	},
+	{
+		.bitmask = 0x00400000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+		.error_description = "STATS IHIST"
+	},
+	{
+		.bitmask = 0x00200000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+		.error_description = "STATS CS"
+	},
+	{
+		.bitmask = 0x00100000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+		.error_description = "STATS RS"
+	},
+	{
+		.bitmask = 0x00080000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+		.error_description = "STATS HDR BHIST"
+	},
+	{
+		.bitmask = 0x00040000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+		.error_description = "STATS BAF"
+	},
+	{
+		.bitmask = 0x00020000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+		.error_description = "STATS AWB BG"
+	},
+	{
+		.bitmask = 0x00010000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+		.error_description = "STATS HDR BE"
+	},
+	{
+		.bitmask = 0x00004000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_2PD,
+		.error_description = "PD"
+	},
+	{
+		.bitmask = 0x00002000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+		.error_description = "PIXEL RAW DUMP"
+	},
+	{
+		.bitmask = 0x00001000,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+		.error_description = "VID C 1:1"
+	},
+	{
+		.bitmask = 0x00000800,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+		.error_description = "VID Y 1:1"
+	},
+	{
+		.bitmask = 0x00000400,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+		.error_description = "FD C"
+	},
+	{
+		.bitmask = 0x00000200,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_FD,
+		.error_description = "FD Y"
+	},
+	{
+		.bitmask = 0x00000020,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_RDI3,
+		.error_description = "Full RDI 3"
+	},
+	{
+		.bitmask = 0x00000010,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+		.error_description = "Full RDI 2"
+	},
+	{
+		.bitmask = 0x00000008,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+		.error_description = "Full RDI 1"
+	},
+	{
+		.bitmask = 0x00000004,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+		.error_description = "Full RDI 0"
+	},
+};
+
+static const struct cam_vfe_bus_error_info vfe_lite_error_list[] = {
+	{
+		.bitmask = 0x04,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+		.error_description = "Lite RDI 0"
+	},
+	{
+		.bitmask = 0x08,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+		.error_description = "Lite RDI 1"
+	},
+	{
+		.bitmask = 0x10,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+		.error_description = "Lite RDI 2"
+	},
+	{
+		.bitmask = 0x20,
+		.vfe_output = CAM_VFE_BUS_VER2_VFE_OUT_RDI3,
+		.error_description = "Lite RDI 3"
+	}
+};
+
+
+static int cam_vfe_bus_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+
+static int cam_vfe_bus_get_evt_payload(
+	struct cam_vfe_bus_ver2_common_data  *common_data,
+	struct cam_vfe_bus_irq_evt_payload  **evt_payload)
+{
+	int rc;
+
+	spin_lock(&common_data->spin_lock);
+
+	if (!common_data->hw_init) {
+		*evt_payload = NULL;
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE:%d Bus uninitialized",
+			common_data->core_index);
+		rc = -EPERM;
+		goto done;
+	}
+
+	if (list_empty(&common_data->free_payload_list)) {
+		*evt_payload = NULL;
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&common_data->free_payload_list,
+		struct cam_vfe_bus_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&common_data->spin_lock);
+	return rc;
+}
+
+static enum cam_vfe_bus_comp_grp_id
+	cam_vfe_bus_comp_grp_id_convert(uint32_t comp_grp)
+{
+	switch (comp_grp) {
+	case CAM_ISP_RES_COMP_GROUP_ID_0:
+		return CAM_VFE_BUS_COMP_GROUP_ID_0;
+	case CAM_ISP_RES_COMP_GROUP_ID_1:
+		return CAM_VFE_BUS_COMP_GROUP_ID_1;
+	case CAM_ISP_RES_COMP_GROUP_ID_2:
+		return CAM_VFE_BUS_COMP_GROUP_ID_2;
+	case CAM_ISP_RES_COMP_GROUP_ID_3:
+		return CAM_VFE_BUS_COMP_GROUP_ID_3;
+	case CAM_ISP_RES_COMP_GROUP_ID_4:
+		return CAM_VFE_BUS_COMP_GROUP_ID_4;
+	case CAM_ISP_RES_COMP_GROUP_ID_5:
+		return CAM_VFE_BUS_COMP_GROUP_ID_5;
+	case CAM_ISP_RES_COMP_GROUP_NONE:
+	default:
+		return CAM_VFE_BUS_COMP_GROUP_NONE;
+	}
+}
+
+static enum cam_vfe_bus_ver2_comp_grp_type
+	cam_vfe_bus_dual_comp_grp_id_convert(uint32_t comp_grp)
+{
+	switch (comp_grp) {
+	case CAM_VFE_BUS_COMP_GROUP_ID_0:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0;
+	case CAM_VFE_BUS_COMP_GROUP_ID_1:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1;
+	case CAM_VFE_BUS_COMP_GROUP_ID_2:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2;
+	case CAM_VFE_BUS_COMP_GROUP_ID_3:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3;
+	case CAM_VFE_BUS_COMP_GROUP_ID_4:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4;
+	case CAM_VFE_BUS_COMP_GROUP_ID_5:
+		return CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5;
+	case CAM_VFE_BUS_COMP_GROUP_NONE:
+	default:
+		return CAM_VFE_BUS_VER2_COMP_GRP_MAX;
+	}
+}
+
+static int cam_vfe_bus_put_evt_payload(
+	struct cam_vfe_bus_ver2_common_data     *common_data,
+	struct cam_vfe_bus_irq_evt_payload     **evt_payload)
+{
+	unsigned long flags;
+
+	if (!common_data) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&common_data->spin_lock, flags);
+	if (common_data->hw_init)
+		list_add_tail(&(*evt_payload)->list,
+			&common_data->free_payload_list);
+	spin_unlock_irqrestore(&common_data->spin_lock, flags);
+
+	*evt_payload = NULL;
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_bus_ver2_get_intra_client_mask(
+	enum cam_vfe_bus_ver2_vfe_core_id  dual_slave_core,
+	enum cam_vfe_bus_ver2_vfe_core_id  current_core,
+	uint32_t                          *intra_client_mask)
+{
+	int rc = 0;
+	uint32_t camera_hw_version = 0;
+	uint32_t version_based_intra_client_mask = 0x1;
+
+	*intra_client_mask = 0;
+
+
+	if (dual_slave_core == current_core) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params. Same core as Master and Slave");
+		return -EINVAL;
+	}
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+
+	CAM_DBG(CAM_ISP, "CPAS VERSION %d", camera_hw_version);
+
+	switch (camera_hw_version) {
+	case CAM_CPAS_TITAN_170_V100:
+		version_based_intra_client_mask = 0x3;
+		break;
+	default:
+		version_based_intra_client_mask = 0x1;
+		break;
+	}
+
+
+	switch (current_core) {
+	case CAM_VFE_BUS_VER2_VFE_CORE_0:
+		switch (dual_slave_core) {
+		case CAM_VFE_BUS_VER2_VFE_CORE_1:
+		case CAM_VFE_BUS_VER2_VFE_CORE_2:
+			*intra_client_mask = version_based_intra_client_mask;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid value for slave core %u",
+				dual_slave_core);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_CORE_1:
+		switch (dual_slave_core) {
+		case CAM_VFE_BUS_VER2_VFE_CORE_0:
+		case CAM_VFE_BUS_VER2_VFE_CORE_2:
+			*intra_client_mask = version_based_intra_client_mask;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid value for slave core %u",
+				dual_slave_core);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_CORE_2:
+		switch (dual_slave_core) {
+		case CAM_VFE_BUS_VER2_VFE_CORE_0:
+		case CAM_VFE_BUS_VER2_VFE_CORE_1:
+			*intra_client_mask = version_based_intra_client_mask;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid value for slave core %u",
+				dual_slave_core);
+			rc = -EINVAL;
+			break;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"Invalid value for master core %u", current_core);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static bool cam_vfe_bus_can_be_secure(uint32_t out_type)
+{
+	switch (out_type) {
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16:
+	case CAM_VFE_BUS_VER2_VFE_OUT_FD:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI0:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI1:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI2:
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP:
+		return true;
+
+	case CAM_VFE_BUS_VER2_VFE_OUT_PDAF:
+	case CAM_VFE_BUS_VER2_VFE_OUT_2PD:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST:
+	default:
+		return false;
+	}
+}
+
+static enum cam_vfe_bus_ver2_vfe_out_type
+	cam_vfe_bus_get_out_res_id(uint32_t res_type)
+{
+	switch (res_type) {
+	case CAM_ISP_IFE_OUT_RES_FULL:
+		return CAM_VFE_BUS_VER2_VFE_OUT_FULL;
+	case CAM_ISP_IFE_OUT_RES_DS4:
+		return CAM_VFE_BUS_VER2_VFE_OUT_DS4;
+	case CAM_ISP_IFE_OUT_RES_DS16:
+		return CAM_VFE_BUS_VER2_VFE_OUT_DS16;
+	case CAM_ISP_IFE_OUT_RES_FD:
+		return CAM_VFE_BUS_VER2_VFE_OUT_FD;
+	case CAM_ISP_IFE_OUT_RES_RAW_DUMP:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP;
+	case CAM_ISP_IFE_OUT_RES_PDAF:
+		return CAM_VFE_BUS_VER2_VFE_OUT_PDAF;
+	case CAM_ISP_IFE_OUT_RES_2PD:
+		return CAM_VFE_BUS_VER2_VFE_OUT_2PD;
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RDI0;
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RDI1;
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RDI2;
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+		return CAM_VFE_BUS_VER2_VFE_OUT_RDI3;
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BE:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE;
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST;
+	case CAM_ISP_IFE_OUT_RES_STATS_TL_BG:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG;
+	case CAM_ISP_IFE_OUT_RES_STATS_BF:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF;
+	case CAM_ISP_IFE_OUT_RES_STATS_AWB_BG:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG;
+	case CAM_ISP_IFE_OUT_RES_STATS_BHIST:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST;
+	case CAM_ISP_IFE_OUT_RES_STATS_RS:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS;
+	case CAM_ISP_IFE_OUT_RES_STATS_CS:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS;
+	case CAM_ISP_IFE_OUT_RES_STATS_IHIST:
+		return CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST;
+	case CAM_ISP_IFE_OUT_RES_FULL_DISP:
+		return CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP;
+	case CAM_ISP_IFE_OUT_RES_DS4_DISP:
+		return CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP;
+	case CAM_ISP_IFE_OUT_RES_DS16_DISP:
+		return CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP;
+	default:
+		return CAM_VFE_BUS_VER2_VFE_OUT_MAX;
+	}
+}
+
+static enum cam_vfe_bus_ver2_vfe_out_type
+	cam_vfe_bus_ver2_get_out_res_id_and_index(
+	struct cam_vfe_bus_ver2_priv  *bus_priv,
+	uint32_t res_type, uint32_t  *index)
+{
+	uint32_t vfe_out_type;
+
+	vfe_out_type = cam_vfe_bus_get_out_res_id(res_type);
+	if (vfe_out_type == CAM_VFE_BUS_VER2_VFE_OUT_MAX)
+		*index = CAM_VFE_BUS_VER2_VFE_OUT_MAX;
+	else
+		*index = bus_priv->vfe_out_map_outtype[vfe_out_type];
+
+	return vfe_out_type;
+}
+
+static int cam_vfe_bus_get_num_wm(
+	enum cam_vfe_bus_ver2_vfe_out_type    res_type,
+	uint32_t                              format)
+{
+	switch (res_type) {
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI0:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI1:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI2:
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI3:
+		switch (format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_MIPI_RAW_14:
+		case CAM_FORMAT_MIPI_RAW_16:
+		case CAM_FORMAT_MIPI_RAW_20:
+		case CAM_FORMAT_DPCM_10_6_10:
+		case CAM_FORMAT_DPCM_10_8_10:
+		case CAM_FORMAT_DPCM_12_6_12:
+		case CAM_FORMAT_DPCM_12_8_12:
+		case CAM_FORMAT_DPCM_14_8_14:
+		case CAM_FORMAT_DPCM_14_10_14:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+		case CAM_FORMAT_PLAIN32_20:
+		case CAM_FORMAT_PLAIN128:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL:
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP:
+		switch (format) {
+		case CAM_FORMAT_NV21:
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_TP10:
+		case CAM_FORMAT_UBWC_NV12:
+		case CAM_FORMAT_UBWC_NV12_4R:
+		case CAM_FORMAT_UBWC_TP10:
+		case CAM_FORMAT_UBWC_P010:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+			return 2;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FD:
+		switch (format) {
+		case CAM_FORMAT_NV21:
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_TP10:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+			return 2;
+		case CAM_FORMAT_Y_ONLY:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16:
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP:
+		switch (format) {
+		case CAM_FORMAT_PD8:
+		case CAM_FORMAT_PD10:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP:
+		switch (format) {
+		case CAM_FORMAT_ARGB_14:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_PDAF:
+		switch (format) {
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_2PD:
+		switch (format) {
+		case CAM_FORMAT_PLAIN16_8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+		case CAM_FORMAT_PLAIN64:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS:
+		switch (format) {
+		case CAM_FORMAT_PLAIN64:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS:
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST:
+		switch (format) {
+		case CAM_FORMAT_PLAIN16_16:
+			return 1;
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	CAM_ERR(CAM_ISP, "Unsupported format %u for resource_type %u",
+		format, res_type);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_bus_get_wm_idx(
+	enum cam_vfe_bus_ver2_vfe_out_type vfe_out_res_id,
+	enum cam_vfe_bus_plane_type plane)
+{
+	int wm_idx = -1;
+
+	switch (vfe_out_res_id) {
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI0:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI1:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 1;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI2:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 2;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RDI3:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 3;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 3;
+			break;
+		case PLANE_C:
+			wm_idx = 4;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 5;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 6;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FD:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 7;
+			break;
+		case PLANE_C:
+			wm_idx = 8;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 9;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_PDAF:
+	case CAM_VFE_BUS_VER2_VFE_OUT_2PD:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 10;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 11;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 12;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 13;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 14;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 15;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 16;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 17;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 18;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 19;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 20;
+			break;
+		case PLANE_C:
+			wm_idx = 21;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 22;
+			break;
+		default:
+			break;
+		}
+		break;
+	case CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP:
+		switch (plane) {
+		case PLANE_Y:
+			wm_idx = 23;
+			break;
+		default:
+			break;
+		}
+		break;
+
+	default:
+		break;
+	}
+
+	return wm_idx;
+}
+
+static void cam_vfe_bus_get_comp_vfe_out_res_id_list(
+	uint32_t comp_mask, uint32_t *out_list, int *num_out)
+{
+	int count = 0;
+
+	if (comp_mask & 0x1)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RDI_0;
+
+	if (comp_mask & 0x2)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RDI_1;
+
+	if (comp_mask & 0x4)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RDI_2;
+
+	if ((comp_mask & 0x8) && (((comp_mask >> 4) & 0x1) == 0))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RDI_3;
+
+	if (comp_mask & 0x18)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_FULL;
+
+	if (comp_mask & 0x20)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_DS4;
+
+	if (comp_mask & 0x40)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_DS16;
+
+	if (comp_mask & 0x180)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_FD;
+
+	if (comp_mask & 0x200)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RAW_DUMP;
+
+	if (comp_mask & 0x800)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_HDR_BE;
+
+	if (comp_mask & 0x1000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST;
+
+	if (comp_mask & 0x2000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_TL_BG;
+
+	if (comp_mask & 0x4000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_BF;
+
+	if (comp_mask & 0x8000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_AWB_BG;
+
+	if (comp_mask & 0x10000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_BHIST;
+
+	if (comp_mask & 0x20000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_RS;
+
+	if (comp_mask & 0x40000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_CS;
+
+	if (comp_mask & 0x80000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_IHIST;
+
+	if (comp_mask & 0x300000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_FULL_DISP;
+
+	if (comp_mask & 0x400000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_DS4_DISP;
+
+	if (comp_mask & 0x800000)
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_DS16_DISP;
+
+	*num_out = count;
+
+}
+
+static enum cam_vfe_bus_packer_format
+	cam_vfe_bus_get_packer_fmt(uint32_t out_fmt, int wm_index)
+{
+	switch (out_fmt) {
+	case CAM_FORMAT_NV21:
+		if ((wm_index == 4) || (wm_index == 6) || (wm_index == 21))
+			return PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN;
+		fallthrough;
+	case CAM_FORMAT_NV12:
+	case CAM_FORMAT_UBWC_NV12:
+	case CAM_FORMAT_UBWC_NV12_4R:
+	case CAM_FORMAT_Y_ONLY:
+		return PACKER_FMT_PLAIN_8_LSB_MSB_10;
+	case CAM_FORMAT_PLAIN16_16:
+		return PACKER_FMT_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN64:
+		return PACKER_FMT_PLAIN_64;
+	case CAM_FORMAT_PLAIN8:
+		return PACKER_FMT_PLAIN_8;
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_10_LSB:
+		return PACKER_FMT_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return PACKER_FMT_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return PACKER_FMT_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN32_20:
+		return PACKER_FMT_PLAIN_32_20BPP;
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_MIPI_RAW_20:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PD8:
+	case CAM_FORMAT_PD10:
+		return PACKER_FMT_PLAIN_128;
+	case CAM_FORMAT_UBWC_TP10:
+	case CAM_FORMAT_TP10:
+		return PACKER_FMT_TP_10;
+	case CAM_FORMAT_ARGB_14:
+		return PACKER_FMT_ARGB_14;
+	default:
+		return PACKER_FMT_MAX;
+	}
+	return PACKER_FMT_MAX;
+}
+
+static int cam_vfe_bus_acquire_wm(
+	struct cam_vfe_bus_ver2_priv          *ver2_bus_priv,
+	struct cam_isp_out_port_generic_info  *out_port_info,
+	void                                  *tasklet,
+	enum cam_vfe_bus_ver2_vfe_out_type     vfe_out_res_id,
+	enum cam_vfe_bus_plane_type            plane,
+	struct cam_isp_resource_node         **wm_res,
+	uint32_t                              *client_done_mask,
+	uint32_t                               is_dual)
+{
+	uint32_t wm_idx = 0;
+	struct cam_isp_resource_node              *wm_res_local = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data  *rsrc_data = NULL;
+
+	*wm_res = NULL;
+	*client_done_mask = 0;
+
+	/* No need to allocate for BUS VER2. VFE OUT to WM is fixed. */
+	wm_idx = cam_vfe_bus_get_wm_idx(vfe_out_res_id, plane);
+	if (wm_idx < 0 || wm_idx >= ver2_bus_priv->num_client) {
+		CAM_ERR(CAM_ISP, "Unsupported VFE out %d plane %d",
+			vfe_out_res_id, plane);
+		return -EINVAL;
+	}
+
+	wm_res_local = &ver2_bus_priv->bus_client[wm_idx];
+	if (wm_res_local->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "WM res not available state:%d",
+			wm_res_local->res_state);
+		return -EALREADY;
+	}
+	wm_res_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	wm_res_local->tasklet_info = tasklet;
+
+	rsrc_data = wm_res_local->res_priv;
+	rsrc_data->format = out_port_info->format;
+	rsrc_data->pack_fmt = cam_vfe_bus_get_packer_fmt(rsrc_data->format,
+		wm_idx);
+
+	rsrc_data->width = out_port_info->width;
+	rsrc_data->height = out_port_info->height;
+	rsrc_data->acquired_width = out_port_info->width;
+	rsrc_data->acquired_height = out_port_info->height;
+	rsrc_data->is_dual = is_dual;
+	/* Set WM offset value to default */
+	rsrc_data->offset  = 0;
+	CAM_DBG(CAM_ISP, "WM %d width %d height %d", rsrc_data->index,
+		rsrc_data->width, rsrc_data->height);
+
+	if (rsrc_data->index < 3) {
+		/* Write master 0-2 refers to RDI 0/ RDI 1/RDI 2 */
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_MIPI_RAW_6:
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_MIPI_RAW_14:
+		case CAM_FORMAT_MIPI_RAW_16:
+		case CAM_FORMAT_MIPI_RAW_20:
+		case CAM_FORMAT_PLAIN128:
+			rsrc_data->width = CAM_VFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride = CAM_VFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->pack_fmt = 0x0;
+			rsrc_data->en_cfg = 0x3;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->pack_fmt = 0x1;
+			rsrc_data->width = rsrc_data->width * 2;
+			rsrc_data->stride = rsrc_data->width;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_10_LSB:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+		case CAM_FORMAT_PLAIN32_20:
+			rsrc_data->width = CAM_VFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride = CAM_VFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->pack_fmt = 0x0;
+			rsrc_data->en_cfg = 0x3;
+			break;
+		case CAM_FORMAT_PLAIN64:
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->pack_fmt = 0xA;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unsupported RDI format %d",
+				rsrc_data->format);
+			return -EINVAL;
+		}
+	} else if ((rsrc_data->index < 5) ||
+		(rsrc_data->index == 7) || (rsrc_data->index == 8) ||
+		(rsrc_data->index == 20) || (rsrc_data->index == 21)) {
+		/*
+		 * Write master 3, 4 - for Full OUT , 7-8  FD OUT,
+		 * WM 20-21 = FULL_DISP
+		 */
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_UBWC_NV12_4R:
+			rsrc_data->en_ubwc = 1;
+			rsrc_data->width = ALIGNUP(rsrc_data->width, 64);
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_UBWC_NV12:
+			rsrc_data->en_ubwc = 1;
+			/* Fall through for NV12 */
+			fallthrough;
+		case CAM_FORMAT_NV21:
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_Y_ONLY:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_UBWC_TP10:
+			rsrc_data->en_ubwc = 1;
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width, 48) * 4 / 3;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_TP10:
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width, 3) * 4 / 3;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_PLAIN16_10_LSB:
+			rsrc_data->pack_fmt |= 0x10;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			rsrc_data->width *= 2;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			rsrc_data->width *= 2;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d",
+				rsrc_data->format);
+			return -EINVAL;
+		}
+		rsrc_data->en_cfg = 0x1;
+	} else if (rsrc_data->index >= 11 && rsrc_data->index < 20) {
+		/* Write master 11 - 19 stats */
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = 0x3;
+	} else if (rsrc_data->index == 10) {
+		/* Write master 10 - PDAF/2PD */
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = 0x3;
+		if (vfe_out_res_id == CAM_VFE_BUS_VER2_VFE_OUT_PDAF)
+			/* LSB aligned */
+			rsrc_data->pack_fmt |= 0x10;
+	}  else if (rsrc_data->index == 9) {
+		/* Write master 9 - Raw dump */
+		rsrc_data->width = rsrc_data->width * 2;
+		rsrc_data->stride = rsrc_data->width;
+		rsrc_data->en_cfg = 0x1;
+		/* LSB aligned */
+		rsrc_data->pack_fmt |= 0x10;
+	}  else {
+		/* Write master 5-6 DS ports */
+		uint32_t align_width;
+
+		rsrc_data->width = rsrc_data->width * 4;
+		rsrc_data->height = rsrc_data->height / 2;
+		rsrc_data->en_cfg = 0x1;
+		CAM_DBG(CAM_ISP, "before width %d", rsrc_data->width);
+		align_width = ALIGNUP(rsrc_data->width, 16);
+		if (align_width != rsrc_data->width) {
+			CAM_WARN(CAM_ISP,
+				"Override width %u with expected %u",
+				rsrc_data->width, align_width);
+			rsrc_data->width = align_width;
+		}
+	}
+
+	*client_done_mask = (1 << wm_idx);
+	*wm_res = wm_res_local;
+
+	CAM_DBG(CAM_ISP, "WM %d: processed width %d, processed  height %d",
+		rsrc_data->index, rsrc_data->width, rsrc_data->height);
+	return 0;
+}
+
+static int cam_vfe_bus_release_wm(void   *bus_priv,
+	struct cam_isp_resource_node     *wm_res)
+{
+	struct cam_vfe_bus_ver2_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->pack_fmt = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->irq_subsample_period = 0;
+	rsrc_data->irq_subsample_pattern = 0;
+	rsrc_data->framedrop_period = 0;
+	rsrc_data->framedrop_pattern = 0;
+	rsrc_data->packer_cfg = 0;
+	rsrc_data->en_ubwc = 0;
+	rsrc_data->tile_cfg = 0;
+	rsrc_data->h_init = 0;
+	rsrc_data->v_init = 0;
+	rsrc_data->ubwc_meta_stride = 0;
+	rsrc_data->ubwc_mode_cfg_0 = 0;
+	rsrc_data->ubwc_mode_cfg_1 = 0;
+	rsrc_data->ubwc_meta_offset = 0;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+
+	rsrc_data->ubwc_lossy_threshold_0 = 0;
+	rsrc_data->ubwc_lossy_threshold_1 = 0;
+	rsrc_data->ubwc_bandwidth_limit = 0;
+	wm_res->tasklet_info = NULL;
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_wm(
+	struct cam_isp_resource_node *wm_res,
+	uint32_t                     *bus_irq_reg_mask)
+{
+	int rc = 0, val = 0;
+	struct cam_vfe_bus_ver2_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_vfe_bus_ver2_common_data        *common_data =
+		rsrc_data->common_data;
+	uint32_t camera_hw_version;
+	uint32_t disable_ubwc_comp = rsrc_data->common_data->disable_ubwc_comp;
+
+	cam_io_w(0xf, common_data->mem_base + rsrc_data->hw_regs->burst_limit);
+
+	cam_io_w_mb(rsrc_data->width,
+		common_data->mem_base + rsrc_data->hw_regs->buffer_width_cfg);
+	cam_io_w(rsrc_data->height,
+		common_data->mem_base + rsrc_data->hw_regs->buffer_height_cfg);
+	cam_io_w(rsrc_data->pack_fmt,
+		common_data->mem_base + rsrc_data->hw_regs->packer_cfg);
+
+	/* Configure stride for RDIs */
+	if (rsrc_data->index < 3)
+		cam_io_w_mb(rsrc_data->stride, (common_data->mem_base +
+			rsrc_data->hw_regs->stride));
+
+	bus_irq_reg_mask[CAM_VFE_BUS_IRQ_REG1] = (1 << rsrc_data->index);
+
+	/* enable ubwc if needed*/
+	if (rsrc_data->en_ubwc) {
+		rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "failed to get HW version rc=%d", rc);
+			return rc;
+		}
+		if ((camera_hw_version > CAM_CPAS_TITAN_NONE) &&
+			(camera_hw_version < CAM_CPAS_TITAN_175_V100) &&
+			(camera_hw_version != CAM_CPAS_TITAN_165_V100)) {
+			struct cam_vfe_bus_ver2_reg_offset_ubwc_client
+				*ubwc_regs;
+
+			ubwc_regs =
+				(struct
+				cam_vfe_bus_ver2_reg_offset_ubwc_client *)
+				rsrc_data->hw_regs->ubwc_regs;
+			if (!ubwc_regs) {
+				CAM_ERR(CAM_ISP, "ubwc_regs is NULL");
+				return -EINVAL;
+			}
+			val = cam_io_r_mb(common_data->mem_base +
+				ubwc_regs->mode_cfg_0);
+			val |= 0x1;
+			if (disable_ubwc_comp) {
+				val &= ~ubwc_regs->ubwc_comp_en_bit;
+				CAM_DBG(CAM_ISP,
+					"Force disable UBWC compression, ubwc_mode_cfg: 0x%x",
+					val);
+			}
+			cam_io_w_mb(val, common_data->mem_base +
+				ubwc_regs->mode_cfg_0);
+		} else if ((camera_hw_version == CAM_CPAS_TITAN_175_V100) ||
+			(camera_hw_version == CAM_CPAS_TITAN_175_V101) ||
+			(camera_hw_version == CAM_CPAS_TITAN_175_V120) ||
+			(camera_hw_version == CAM_CPAS_TITAN_175_V130) ||
+			(camera_hw_version == CAM_CPAS_TITAN_165_V100)) {
+			struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client
+				*ubwc_regs;
+
+			ubwc_regs =
+				(struct
+				cam_vfe_bus_ver2_reg_offset_ubwc_3_client *)
+				rsrc_data->hw_regs->ubwc_regs;
+			if (!ubwc_regs) {
+				CAM_ERR(CAM_ISP, "ubwc_regs is NULL");
+				return -EINVAL;
+			}
+			val = cam_io_r_mb(common_data->mem_base +
+				ubwc_regs->mode_cfg_0);
+			val |= 0x1;
+			if (disable_ubwc_comp) {
+				val &= ~ubwc_regs->ubwc_comp_en_bit;
+				CAM_DBG(CAM_ISP,
+					"Force disable UBWC compression, ubwc_mode_cfg: 0x%x",
+					val);
+			}
+			cam_io_w_mb(val, common_data->mem_base +
+				ubwc_regs->mode_cfg_0);
+		} else {
+			CAM_ERR(CAM_ISP, "Invalid HW version: %d",
+				camera_hw_version);
+			return -EINVAL;
+		}
+	}
+	/* enabling Wm configuratons are taken care in update_wm().
+	 * i.e enable wm only if io buffers are allocated
+	 */
+
+	CAM_DBG(CAM_ISP, "WM res %d width = %d, height = %d", rsrc_data->index,
+		rsrc_data->width, rsrc_data->height);
+	CAM_DBG(CAM_ISP, "WM res %d pk_fmt = %d", rsrc_data->index,
+		rsrc_data->pack_fmt & PACKER_FMT_MAX);
+	CAM_DBG(CAM_ISP, "WM res %d stride = %d, burst len = %d",
+		rsrc_data->index, rsrc_data->stride, 0xf);
+	CAM_DBG(CAM_ISP, "enable WM res %d offset 0x%x val 0x%x",
+		rsrc_data->index, (uint32_t) rsrc_data->hw_regs->cfg,
+		rsrc_data->en_cfg);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_vfe_bus_stop_wm(struct cam_isp_resource_node *wm_res)
+{
+	int rc = 0;
+	struct cam_vfe_bus_ver2_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_vfe_bus_ver2_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable WM */
+	cam_io_w_mb(0x0,
+		common_data->mem_base + rsrc_data->hw_regs->cfg);
+
+	/* Disable all register access, reply on global reset */
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+
+	return rc;
+}
+
+static int cam_vfe_bus_handle_wm_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_handle_wm_done_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int rc = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node          *wm_res = handler_priv;
+	struct cam_vfe_bus_irq_evt_payload    *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver2_wm_resource_data *rsrc_data =
+		(wm_res == NULL) ? NULL : wm_res->res_priv;
+	uint32_t  *cam_ife_irq_regs;
+	uint32_t   status_reg;
+
+	if (!evt_payload || !wm_res || !rsrc_data)
+		return rc;
+
+	CAM_DBG(CAM_ISP, "addr of evt_payload = %llx core index:0x%x",
+		(uint64_t)evt_payload, evt_payload->core_index);
+	CAM_DBG(CAM_ISP, "bus_irq_status_0: = %x", evt_payload->irq_reg_val[0]);
+	CAM_DBG(CAM_ISP, "bus_irq_status_1: = %x", evt_payload->irq_reg_val[1]);
+	CAM_DBG(CAM_ISP, "bus_irq_status_2: = %x", evt_payload->irq_reg_val[2]);
+	CAM_DBG(CAM_ISP, "bus_irq_comp_err: = %x", evt_payload->irq_reg_val[3]);
+	CAM_DBG(CAM_ISP, "bus_irq_comp_owrt: = %x",
+		evt_payload->irq_reg_val[4]);
+	CAM_DBG(CAM_ISP, "bus_irq_dual_comp_err: = %x",
+		evt_payload->irq_reg_val[5]);
+	CAM_DBG(CAM_ISP, "bus_irq_dual_comp_owrt: = %x",
+		evt_payload->irq_reg_val[6]);
+
+	cam_ife_irq_regs = evt_payload->irq_reg_val;
+	status_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_STATUS1];
+
+	if (status_reg & BIT(rsrc_data->index)) {
+		cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_STATUS1] &=
+			~BIT(rsrc_data->index);
+		rc = CAM_VFE_IRQ_STATUS_SUCCESS;
+		evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+	}
+	CAM_DBG(CAM_ISP, "status_reg %x rc %d wm_idx %d",
+		status_reg, rc, rsrc_data->index);
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver2_print_dimensions(
+	uint32_t                                   res_id,
+	struct cam_vfe_bus_ver2_priv              *bus_priv)
+{
+	struct cam_isp_resource_node              *rsrc_node = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data      *rsrc_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data  *wm_data   = NULL;
+	struct cam_vfe_bus_ver2_common_data  *common_data = NULL;
+	int                                        i;
+	uint32_t addr_status0, addr_status1;
+	enum cam_vfe_bus_ver2_vfe_out_type  vfe_out_res_id =
+		CAM_VFE_BUS_VER2_VFE_OUT_MAX;
+	uint32_t  outmap_index = CAM_VFE_BUS_VER2_VFE_OUT_MAX;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid bus private data, res_id: %d",
+			res_id);
+		return -EINVAL;
+	}
+
+	vfe_out_res_id = cam_vfe_bus_ver2_get_out_res_id_and_index(bus_priv,
+		res_id, &outmap_index);
+
+	if ((vfe_out_res_id == CAM_VFE_BUS_VER2_VFE_OUT_MAX) ||
+		(outmap_index >= bus_priv->num_out)) {
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"target does not support req res id :0x%x outtype:%d index:%d",
+			res_id,
+			vfe_out_res_id, outmap_index);
+		return -EINVAL;
+	}
+
+	rsrc_node = &bus_priv->vfe_out[outmap_index];
+	rsrc_data = rsrc_node->res_priv;
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "VFE out data is null, res_id: %d",
+			vfe_out_res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		wm_data = rsrc_data->wm_res[i]->res_priv;
+		common_data = rsrc_data->common_data;
+		addr_status0 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->status0);
+		addr_status1 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->status1);
+
+		CAM_INFO(CAM_ISP,
+			"VFE:%d WM:%d width:%u height:%u stride:%u x_init:%u en_cfg:%u acquired width:%u height:%u",
+			wm_data->common_data->core_index, wm_data->index,
+			wm_data->width,
+			wm_data->height,
+			wm_data->stride, wm_data->h_init,
+			wm_data->en_cfg,
+			wm_data->acquired_width,
+			wm_data->acquired_height);
+		CAM_INFO(CAM_ISP,
+			"hw:%d WM:%d last consumed address:0x%x last frame addr:0x%x",
+			common_data->hw_intf->hw_idx,
+			wm_data->index,
+			addr_status0,
+			addr_status1);
+	}
+	return 0;
+}
+
+static void cam_vfe_print_violations(
+	char *error_type,
+	const struct cam_vfe_bus_error_info *error_list,
+	uint32_t num_errors,
+	uint32_t status,
+	struct cam_vfe_bus_ver2_priv *bus_priv)
+{
+	int i;
+
+	for (i = 0; i < num_errors; i++) {
+		if (status & error_list[i].bitmask) {
+			CAM_INFO(CAM_ISP, "%s: %s violation",
+				error_list[i].error_description,
+				error_type);
+			if (bus_priv != NULL)
+				cam_vfe_bus_ver2_print_dimensions(
+					error_list[i].vfe_output,
+					bus_priv);
+		}
+	}
+}
+
+static int cam_vfe_bus_err_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	struct cam_vfe_bus_irq_evt_payload *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver2_priv *bus_priv = handler_priv;
+	struct cam_vfe_bus_ver2_common_data *common_data;
+	struct cam_isp_hw_event_info evt_info;
+	const struct cam_vfe_bus_error_info *error_list = NULL;
+	uint32_t val = 0;
+	uint32_t error_list_size = 0;
+	uint32_t status = 0;
+
+	if (!handler_priv || !evt_payload_priv)
+		return -EINVAL;
+
+	evt_payload = evt_payload_priv;
+	common_data = &bus_priv->common_data;
+
+	val = evt_payload->debug_status_0;
+	CAM_ERR(CAM_ISP, "Bus Violation: debug_status_0 = 0x%x", val);
+
+	error_list = common_data->is_lite ?
+		vfe_lite_error_list : vfe_error_list;
+	error_list_size = common_data->is_lite ?
+		ARRAY_SIZE(vfe_lite_error_list) : ARRAY_SIZE(vfe_error_list);
+
+	if (val & 0x00000004)
+		CAM_INFO(CAM_ISP, "RDI 0 violation");
+
+	if (val & 0x00000008)
+		CAM_INFO(CAM_ISP, "RDI 1 violation");
+
+	if (val & 0x00000010)
+		CAM_INFO(CAM_ISP, "RDI 2 violation");
+
+	if (val & 0x00000020)
+		CAM_INFO(CAM_ISP, "RDI 3 violation");
+
+	if (val & 0x00000200)
+		CAM_INFO(CAM_ISP, "FD Y violation");
+
+	if (val & 0x00000400)
+		CAM_INFO(CAM_ISP, "FD C violation");
+
+	if (val & 0x00001000)
+		CAM_INFO(CAM_ISP, "VID C 1:1 UBWC violation");
+
+	if (val & 0x00000800)
+		CAM_INFO(CAM_ISP, "VID Y 1:1 UBWC violation");
+
+	if (val & 0x00002000)
+		CAM_INFO(CAM_ISP, "RAW DUMP violation");
+
+	if (val & 0x00004000)
+		CAM_INFO(CAM_ISP, "PDAF violation");
+
+	if (val & 0x00010000)
+		CAM_INFO(CAM_ISP, "STATs HDR BE violation");
+
+	if (val & 0x00020000)
+		CAM_INFO(CAM_ISP, "STATs AWB BG UBWC violation");
+
+	if (val & 0x00040000)
+		CAM_INFO(CAM_ISP, "STATs BF violation");
+
+	if (val & 0x00080000)
+		CAM_INFO(CAM_ISP, "STATs HDR BHIST violation");
+
+	if (val & 0x00100000)
+		CAM_INFO(CAM_ISP, "STATs RS violation");
+
+	if (val & 0x00200000)
+		CAM_INFO(CAM_ISP, "STATs CS violation");
+
+	if (val & 0x00400000)
+		CAM_INFO(CAM_ISP, "STATs IHIST violation");
+
+	if (val & 0x00800000)
+		CAM_INFO(CAM_ISP, "STATs BHIST violation");
+
+	if (val & 0x01000000)
+		CAM_INFO(CAM_ISP, "STATs TINTLESS BG violation");
+
+	if (val & 0x40000000)
+		CAM_INFO(CAM_ISP, "DISP Y 1:1 UBWC violation");
+
+	if (val & 0x80000000)
+		CAM_INFO(CAM_ISP, "DISP C 1:1 UBWC violation");
+
+	cam_vfe_print_violations("Error", error_list,
+		error_list_size, status, bus_priv);
+
+	cam_vfe_bus_put_evt_payload(common_data, &evt_payload);
+
+	evt_info.hw_idx = common_data->core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	evt_info.res_id = CAM_VFE_BUS_VER2_VFE_OUT_MAX;
+
+	if (common_data->event_cb)
+		common_data->event_cb(NULL, CAM_ISP_HW_EVENT_ERROR,
+			(void *)&evt_info);
+
+	return 0;
+}
+
+static int cam_vfe_bus_init_wm_resource(uint32_t index,
+	struct cam_vfe_bus_ver2_priv    *ver2_bus_priv,
+	struct cam_vfe_bus_ver2_hw_info *ver2_hw_info,
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_vfe_bus_ver2_wm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver2_wm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for WM res priv");
+		return -ENOMEM;
+	}
+	wm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &ver2_hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &ver2_bus_priv->common_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = cam_vfe_bus_handle_wm_done_top_half;
+	wm_res->bottom_half_handler = cam_vfe_bus_handle_wm_done_bottom_half;
+	wm_res->hw_intf = ver2_bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_wm_resource(
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_vfe_bus_ver2_wm_resource_data *rsrc_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = NULL;
+	wm_res->bottom_half_handler = NULL;
+	wm_res->hw_intf = NULL;
+
+	rsrc_data = wm_res->res_priv;
+	wm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static void cam_vfe_bus_add_wm_to_comp_grp(
+	struct cam_isp_resource_node    *comp_grp,
+	uint32_t                         composite_mask)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data  *rsrc_data = comp_grp->res_priv;
+
+	rsrc_data->composite_mask |= composite_mask;
+}
+
+static void cam_vfe_bus_match_comp_grp(
+	struct cam_vfe_bus_ver2_priv  *ver2_bus_priv,
+	struct cam_isp_resource_node **comp_grp,
+	uint32_t                       comp_grp_local_idx,
+	uint32_t                       unique_id)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data  *rsrc_data = NULL;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+
+	list_for_each_entry(comp_grp_local,
+		&ver2_bus_priv->used_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_local_idx == comp_grp_local_idx &&
+			rsrc_data->unique_id == unique_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			return;
+		}
+	}
+
+	*comp_grp = NULL;
+}
+
+static int cam_vfe_bus_get_free_dual_comp_grp(
+	struct cam_vfe_bus_ver2_priv  *ver2_bus_priv,
+	struct cam_isp_resource_node **comp_grp,
+	uint32_t                       comp_grp_local_idx)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data  *rsrc_data = NULL;
+	struct cam_isp_resource_node           *dual_comp_grp_local = NULL;
+	struct cam_isp_resource_node           *dual_comp_grp_local_temp = NULL;
+	int32_t  dual_comp_grp_idx = 0;
+	int rc = -EINVAL;
+
+	dual_comp_grp_idx = cam_vfe_bus_dual_comp_grp_id_convert(comp_grp_local_idx);
+
+	CAM_DBG(CAM_ISP, "dual_comp_grp_idx :%d", dual_comp_grp_idx);
+
+	list_for_each_entry_safe(dual_comp_grp_local, dual_comp_grp_local_temp,
+		&ver2_bus_priv->free_dual_comp_grp, list) {
+		rsrc_data = dual_comp_grp_local->res_priv;
+		CAM_DBG(CAM_ISP, "current grp type : %d expected :%d",
+			rsrc_data->comp_grp_type, dual_comp_grp_idx);
+		if (dual_comp_grp_idx != rsrc_data->comp_grp_type) {
+			continue;
+		} else {
+			list_del_init(&dual_comp_grp_local->list);
+			*comp_grp = dual_comp_grp_local;
+			return 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_vfe_bus_acquire_comp_grp(
+	struct cam_vfe_bus_ver2_priv        *ver2_bus_priv,
+	struct cam_isp_out_port_generic_info        *out_port_info,
+	void                                *tasklet,
+	uint32_t                             unique_id,
+	uint32_t                             is_dual,
+	uint32_t                             is_master,
+	enum cam_vfe_bus_ver2_vfe_core_id    dual_slave_core,
+	struct cam_isp_resource_node       **comp_grp)
+{
+	int rc = 0;
+	uint32_t bus_comp_grp_id;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+	struct cam_vfe_bus_ver2_comp_grp_data  *rsrc_data = NULL;
+
+	bus_comp_grp_id = cam_vfe_bus_comp_grp_id_convert(
+		out_port_info->comp_grp_id);
+	/* Perform match only if there is valid comp grp request */
+	if (out_port_info->comp_grp_id != CAM_ISP_RES_COMP_GROUP_NONE) {
+		/* Check if matching comp_grp already acquired */
+		cam_vfe_bus_match_comp_grp(ver2_bus_priv, &comp_grp_local,
+			bus_comp_grp_id, unique_id);
+	}
+
+	if (!comp_grp_local) {
+		/* First find a free group */
+		if (is_dual) {
+			CAM_DBG(CAM_ISP, "Acquire dual comp group");
+			if (list_empty(&ver2_bus_priv->free_dual_comp_grp)) {
+				CAM_ERR(CAM_ISP, "No Free Composite Group");
+				return -ENODEV;
+			}
+			rc = cam_vfe_bus_get_free_dual_comp_grp(
+				ver2_bus_priv, &comp_grp_local, bus_comp_grp_id);
+			if (rc || !comp_grp_local) {
+				CAM_ERR(CAM_ISP,
+					"failed to acquire dual comp grp for :%d rc :%d",
+					bus_comp_grp_id, rc);
+					return rc;
+			}
+			rsrc_data = comp_grp_local->res_priv;
+			rc = cam_vfe_bus_ver2_get_intra_client_mask(
+				dual_slave_core,
+				comp_grp_local->hw_intf->hw_idx,
+				&rsrc_data->intra_client_mask);
+			if (rc)
+				return rc;
+		} else {
+			CAM_DBG(CAM_ISP, "Acquire comp group");
+			if (list_empty(&ver2_bus_priv->free_comp_grp)) {
+				CAM_ERR(CAM_ISP, "No Free Composite Group");
+				return -ENODEV;
+			}
+			comp_grp_local = list_first_entry(
+				&ver2_bus_priv->free_comp_grp,
+				struct cam_isp_resource_node, list);
+			rsrc_data = comp_grp_local->res_priv;
+		}
+
+		list_del(&comp_grp_local->list);
+		comp_grp_local->tasklet_info = tasklet;
+		comp_grp_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		rsrc_data->is_master = is_master;
+		rsrc_data->composite_mask = 0;
+		rsrc_data->unique_id = unique_id;
+		rsrc_data->comp_grp_local_idx = bus_comp_grp_id;
+
+		if (is_master)
+			rsrc_data->addr_sync_mode = 0;
+		else
+			rsrc_data->addr_sync_mode = 1;
+
+		list_add_tail(&comp_grp_local->list,
+			&ver2_bus_priv->used_comp_grp);
+
+	} else {
+		rsrc_data = comp_grp_local->res_priv;
+		/* Do not support runtime change in composite mask */
+		if (comp_grp_local->res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) {
+			CAM_ERR(CAM_ISP, "Invalid State %d Comp Grp %u",
+				comp_grp_local->res_state,
+				rsrc_data->comp_grp_type);
+			return -EBUSY;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Comp Grp type %u", rsrc_data->comp_grp_type);
+
+	rsrc_data->acquire_dev_cnt++;
+	*comp_grp = comp_grp_local;
+
+	return rc;
+}
+
+static int cam_vfe_bus_release_comp_grp(
+	struct cam_vfe_bus_ver2_priv         *ver2_bus_priv,
+	struct cam_isp_resource_node         *in_comp_grp)
+{
+	struct cam_isp_resource_node           *comp_grp = NULL;
+	struct cam_vfe_bus_ver2_comp_grp_data  *in_rsrc_data = NULL;
+	int match_found = 0;
+
+	if (!in_comp_grp) {
+		CAM_ERR(CAM_ISP, "Invalid Params Comp Grp %pK", in_comp_grp);
+		return -EINVAL;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "Already released Comp Grp");
+		return 0;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "Invalid State %d",
+			in_comp_grp->res_state);
+		return -EBUSY;
+	}
+
+	in_rsrc_data = in_comp_grp->res_priv;
+	CAM_DBG(CAM_ISP, "Comp Grp type %u", in_rsrc_data->comp_grp_type);
+
+	list_for_each_entry(comp_grp, &ver2_bus_priv->used_comp_grp, list) {
+		if (comp_grp == in_comp_grp) {
+			match_found = 1;
+			break;
+		}
+	}
+
+	if (!match_found) {
+		CAM_ERR(CAM_ISP, "Could not find matching Comp Grp type %u",
+			in_rsrc_data->comp_grp_type);
+		return -ENODEV;
+	}
+
+	in_rsrc_data->acquire_dev_cnt--;
+	if (in_rsrc_data->acquire_dev_cnt == 0) {
+		list_del(&comp_grp->list);
+
+		in_rsrc_data->unique_id = 0;
+		in_rsrc_data->comp_grp_local_idx = CAM_VFE_BUS_COMP_GROUP_NONE;
+		in_rsrc_data->composite_mask = 0;
+		in_rsrc_data->dual_slave_core = CAM_VFE_BUS_VER2_VFE_CORE_MAX;
+		in_rsrc_data->addr_sync_mode = 0;
+
+		comp_grp->tasklet_info = NULL;
+		comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+		if (in_rsrc_data->comp_grp_type >=
+			CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 &&
+			in_rsrc_data->comp_grp_type <=
+			CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5)
+			list_add_tail(&comp_grp->list,
+				&ver2_bus_priv->free_dual_comp_grp);
+		else if (in_rsrc_data->comp_grp_type >=
+			CAM_VFE_BUS_VER2_COMP_GRP_0 &&
+			in_rsrc_data->comp_grp_type <=
+			CAM_VFE_BUS_VER2_COMP_GRP_5)
+			list_add_tail(&comp_grp->list,
+				&ver2_bus_priv->free_comp_grp);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_comp_grp(
+	struct cam_isp_resource_node *comp_grp,
+	uint32_t                     *bus_irq_reg_mask)
+{
+	int rc = 0;
+	uint32_t addr_sync_cfg;
+	struct cam_vfe_bus_ver2_comp_grp_data      *rsrc_data =
+		comp_grp->res_priv;
+	struct cam_vfe_bus_ver2_common_data        *common_data =
+		rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP, "comp group id:%d streaming state:%d",
+		rsrc_data->comp_grp_type, comp_grp->res_state);
+
+	cam_io_w_mb(rsrc_data->composite_mask, common_data->mem_base +
+		rsrc_data->hw_regs->comp_mask);
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		return 0;
+
+	CAM_DBG(CAM_ISP, "composite_mask is 0x%x", rsrc_data->composite_mask);
+	CAM_DBG(CAM_ISP, "composite_mask addr 0x%x",
+		rsrc_data->hw_regs->comp_mask);
+
+	if (rsrc_data->comp_grp_type >= CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 &&
+		rsrc_data->comp_grp_type <= CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5) {
+		int dual_comp_grp = (rsrc_data->comp_grp_type -
+			CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0);
+
+		if (rsrc_data->is_master) {
+			int intra_client_en = cam_io_r_mb(
+				common_data->mem_base +
+				common_data->common_reg->dual_master_comp_cfg);
+
+			/*
+			 * 2 Bits per comp_grp. Hence left shift by
+			 * comp_grp * 2
+			 */
+			intra_client_en |=
+				(rsrc_data->intra_client_mask <<
+					(dual_comp_grp * 2));
+
+			cam_io_w_mb(intra_client_en, common_data->mem_base +
+				common_data->common_reg->dual_master_comp_cfg);
+
+			bus_irq_reg_mask[CAM_VFE_BUS_IRQ_REG2] =
+				(1 << dual_comp_grp);
+		}
+
+		CAM_DBG(CAM_ISP, "addr_sync_mask addr 0x%x",
+			rsrc_data->hw_regs->addr_sync_mask);
+		cam_io_w_mb(rsrc_data->composite_mask, common_data->mem_base +
+			rsrc_data->hw_regs->addr_sync_mask);
+
+		addr_sync_cfg = cam_io_r_mb(common_data->mem_base +
+			common_data->common_reg->addr_sync_cfg);
+		addr_sync_cfg |= (rsrc_data->addr_sync_mode << dual_comp_grp);
+		/*
+		 * 2 Bits per dual_comp_grp. dual_comp_grp stats at bit number
+		 * 8. Hence left shift cdual_comp_grp dual comp_grp * 2 and
+		 * add 8
+		 */
+		addr_sync_cfg |=
+			(rsrc_data->intra_client_mask <<
+				((dual_comp_grp * 2) +
+				CAM_VFE_BUS_ADDR_SYNC_INTRA_CLIENT_SHIFT));
+		cam_io_w_mb(addr_sync_cfg, common_data->mem_base +
+			common_data->common_reg->addr_sync_cfg);
+
+		common_data->addr_no_sync &= ~(rsrc_data->composite_mask);
+		cam_io_w_mb(common_data->addr_no_sync, common_data->mem_base +
+			common_data->common_reg->addr_sync_no_sync);
+		CAM_DBG(CAM_ISP, "addr_sync_cfg: 0x%x addr_no_sync_cfg: 0x%x",
+			addr_sync_cfg, common_data->addr_no_sync);
+	} else {
+		/* IRQ bits for COMP GRP start at 5. So add 5 to the shift */
+		bus_irq_reg_mask[CAM_VFE_BUS_IRQ_REG0] =
+			(1 << (rsrc_data->comp_grp_type + 5));
+	}
+
+	CAM_DBG(CAM_ISP, "VFE start COMP_GRP%d", rsrc_data->comp_grp_type);
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_vfe_bus_stop_comp_grp(struct cam_isp_resource_node *comp_grp)
+{
+	int rc = 0;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return rc;
+}
+
+static int cam_vfe_bus_handle_comp_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_handle_comp_done_bottom_half(void *handler_priv,
+	void  *evt_payload_priv, uint32_t *comp_mask)
+{
+	int rc = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node          *comp_grp = handler_priv;
+	struct cam_vfe_bus_irq_evt_payload    *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver2_comp_grp_data *rsrc_data = comp_grp->res_priv;
+	uint32_t                              *cam_ife_irq_regs;
+	uint32_t                               status_reg;
+	uint32_t                               comp_err_reg;
+	uint32_t                               comp_grp_id;
+
+	CAM_DBG(CAM_ISP, "comp grp type %d", rsrc_data->comp_grp_type);
+
+	if (!evt_payload)
+		return rc;
+
+	cam_ife_irq_regs = evt_payload->irq_reg_val;
+
+	switch (rsrc_data->comp_grp_type) {
+	case CAM_VFE_BUS_VER2_COMP_GRP_0:
+	case CAM_VFE_BUS_VER2_COMP_GRP_1:
+	case CAM_VFE_BUS_VER2_COMP_GRP_2:
+	case CAM_VFE_BUS_VER2_COMP_GRP_3:
+	case CAM_VFE_BUS_VER2_COMP_GRP_4:
+	case CAM_VFE_BUS_VER2_COMP_GRP_5:
+		comp_grp_id = (rsrc_data->comp_grp_type -
+			CAM_VFE_BUS_VER2_COMP_GRP_0);
+
+		/* Check for Regular composite error */
+		status_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_STATUS0];
+
+		comp_err_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_COMP_ERR];
+		if ((status_reg & BIT(11)) &&
+			(comp_err_reg & rsrc_data->composite_mask)) {
+			/* Check for Regular composite error */
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_ERROR;
+			rc = CAM_VFE_IRQ_STATUS_ERR_COMP;
+			break;
+		}
+
+		comp_err_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_COMP_OWRT];
+		/* Check for Regular composite Overwrite */
+		if ((status_reg & BIT(12)) &&
+			(comp_err_reg & rsrc_data->composite_mask)) {
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_ERROR;
+			rc = CAM_VFE_IRQ_STATUS_COMP_OWRT;
+			break;
+		}
+
+		/* Regular Composite SUCCESS */
+		if (status_reg & BIT(comp_grp_id + 5)) {
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+			rc = CAM_VFE_IRQ_STATUS_SUCCESS;
+		}
+
+		CAM_DBG(CAM_ISP, "status reg = 0x%x, bit index = %d rc %d",
+			status_reg, (comp_grp_id + 5), rc);
+		break;
+
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4:
+	case CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5:
+		comp_grp_id = (rsrc_data->comp_grp_type -
+			CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0);
+
+		/* Check for DUAL composite error */
+		status_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_REG_STATUS2];
+
+		comp_err_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_DUAL_COMP_ERR];
+		if ((status_reg & BIT(6)) &&
+			(comp_err_reg & rsrc_data->composite_mask)) {
+			/* Check for DUAL composite error */
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_ERROR;
+			rc = CAM_VFE_IRQ_STATUS_ERR_COMP;
+			break;
+		}
+
+		/* Check for Dual composite Overwrite */
+		comp_err_reg = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_DUAL_COMP_OWRT];
+		if ((status_reg & BIT(7)) &&
+			(comp_err_reg & rsrc_data->composite_mask)) {
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_ERROR;
+			rc = CAM_VFE_IRQ_STATUS_COMP_OWRT;
+			break;
+		}
+
+		/* DUAL Composite SUCCESS */
+		if (status_reg & BIT(comp_grp_id)) {
+			evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+			rc = CAM_VFE_IRQ_STATUS_SUCCESS;
+		}
+
+		break;
+	default:
+		rc = CAM_VFE_IRQ_STATUS_ERR;
+		CAM_ERR(CAM_ISP, "Invalid comp_grp_type %u",
+			rsrc_data->comp_grp_type);
+		break;
+	}
+
+	*comp_mask = rsrc_data->composite_mask;
+
+	return rc;
+}
+
+static int cam_vfe_bus_init_comp_grp(uint32_t index,
+	struct cam_vfe_bus_ver2_priv    *ver2_bus_priv,
+	struct cam_vfe_bus_ver2_hw_info *ver2_hw_info,
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data *rsrc_data = NULL;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver2_comp_grp_data),
+		GFP_KERNEL);
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	comp_grp->res_priv = rsrc_data;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&comp_grp->list);
+
+	rsrc_data->comp_grp_type   = index;
+	rsrc_data->common_data     = &ver2_bus_priv->common_data;
+	rsrc_data->hw_regs         = &ver2_hw_info->comp_grp_reg[index];
+	rsrc_data->dual_slave_core = CAM_VFE_BUS_VER2_VFE_CORE_MAX;
+
+	if (rsrc_data->comp_grp_type >= CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0 &&
+		rsrc_data->comp_grp_type <= CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5)
+		list_add_tail(&comp_grp->list,
+			&ver2_bus_priv->free_dual_comp_grp);
+	else if (rsrc_data->comp_grp_type >= CAM_VFE_BUS_VER2_COMP_GRP_0
+		&& rsrc_data->comp_grp_type <= CAM_VFE_BUS_VER2_COMP_GRP_5)
+		list_add_tail(&comp_grp->list, &ver2_bus_priv->free_comp_grp);
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = cam_vfe_bus_handle_comp_done_top_half;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = ver2_bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_comp_grp(
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_vfe_bus_ver2_comp_grp_data *rsrc_data =
+		comp_grp->res_priv;
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = NULL;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = NULL;
+
+	list_del_init(&comp_grp->list);
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+	comp_grp->res_priv = NULL;
+
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "comp_grp_priv is NULL");
+		return -ENODEV;
+	}
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+
+	struct cam_isp_hw_get_cmd_update      *secure_mode = cmd_args;
+	struct cam_vfe_bus_ver2_vfe_out_data  *rsrc_data;
+	uint32_t                              *mode;
+
+	rsrc_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode =
+		(rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_vfe_bus_acquire_vfe_out(void *bus_priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                     rc = -ENODEV;
+	int                                     i;
+	enum cam_vfe_bus_ver2_vfe_out_type      vfe_out_res_id;
+	uint32_t                                format;
+	int                                     num_wm;
+	uint32_t                                client_done_mask;
+	struct cam_vfe_bus_ver2_priv           *ver2_bus_priv = bus_priv;
+	struct cam_vfe_acquire_args            *acq_args = acquire_args;
+	struct cam_vfe_hw_vfe_out_acquire_args *out_acquire_args;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data   *rsrc_data = NULL;
+	uint32_t                                secure_caps = 0, mode;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_ISP, "Invalid Param");
+		return -EINVAL;
+	}
+
+	out_acquire_args = &acq_args->vfe_out;
+	format = out_acquire_args->out_port_info->format;
+
+	CAM_DBG(CAM_ISP, "Acquiring resource type 0x%x",
+		out_acquire_args->out_port_info->res_type);
+
+	vfe_out_res_id = cam_vfe_bus_get_out_res_id(
+		out_acquire_args->out_port_info->res_type);
+	if (vfe_out_res_id == CAM_VFE_BUS_VER2_VFE_OUT_MAX)
+		return -ENODEV;
+
+	num_wm = cam_vfe_bus_get_num_wm(vfe_out_res_id, format);
+	if (num_wm < 1)
+		return -EINVAL;
+
+	rsrc_node = &ver2_bus_priv->vfe_out[vfe_out_res_id];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "Resource not available: Res_id %d state:%d",
+			vfe_out_res_id, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	rsrc_data = rsrc_node->res_priv;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->common_data->disable_ubwc_comp =
+		out_acquire_args->disable_ubwc_comp;
+	rsrc_data->priv = acq_args->priv;
+
+	secure_caps = cam_vfe_bus_can_be_secure(rsrc_data->out_type);
+	mode = out_acquire_args->out_port_info->secure_mode;
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (!rsrc_data->common_data->num_sec_out) {
+			rsrc_data->secure_mode = mode;
+			rsrc_data->common_data->secure_mode = mode;
+		} else {
+			if (mode == rsrc_data->common_data->secure_mode) {
+				rsrc_data->secure_mode =
+					rsrc_data->common_data->secure_mode;
+			} else {
+				rc = -EINVAL;
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"Mismatch: Acquire mode[%d], drvr mode[%d]",
+					rsrc_data->common_data->secure_mode,
+					mode);
+				mutex_unlock(
+					&rsrc_data->common_data->bus_mutex);
+				return -EINVAL;
+			}
+		}
+		rsrc_data->common_data->num_sec_out++;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	ver2_bus_priv->tasklet_info = acq_args->tasklet;
+	rsrc_data->num_wm = num_wm;
+	rsrc_node->res_id = out_acquire_args->out_port_info->res_type;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = out_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = out_acquire_args->cdm_ops;
+
+	if (out_acquire_args->out_port_info->comp_grp_id >
+		CAM_ISP_RES_COMP_GROUP_ID_MAX)
+		CAM_ERR(CAM_ISP, "VFE%d Invalid composite group id %d res_id %x",
+			rsrc_data->common_data->core_index,
+			out_acquire_args->out_port_info->comp_grp_id,
+			vfe_out_res_id);
+
+	/* Reserve Composite Group */
+	if ((num_wm > 1 || (out_acquire_args->is_dual)) &&
+		(out_acquire_args->out_port_info->comp_grp_id >
+		CAM_ISP_RES_COMP_GROUP_NONE &&
+		out_acquire_args->out_port_info->comp_grp_id <
+		CAM_ISP_RES_COMP_GROUP_ID_MAX)) {
+
+		rc = cam_vfe_bus_acquire_comp_grp(ver2_bus_priv,
+			out_acquire_args->out_port_info,
+			acq_args->tasklet,
+			out_acquire_args->unique_id,
+			out_acquire_args->is_dual,
+			out_acquire_args->is_master,
+			out_acquire_args->dual_slave_core,
+			&rsrc_data->comp_grp);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE%d Comp_Grp acquire fail for Out %d rc=%d",
+				rsrc_data->common_data->core_index,
+				vfe_out_res_id, rc);
+			return rc;
+		}
+	}
+
+	/* Reserve WM */
+	for (i = 0; i < num_wm; i++) {
+		rc = cam_vfe_bus_acquire_wm(ver2_bus_priv,
+			out_acquire_args->out_port_info,
+			acq_args->tasklet,
+			vfe_out_res_id,
+			i,
+			&rsrc_data->wm_res[i],
+			&client_done_mask,
+			out_acquire_args->is_dual);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"VFE%d WM acquire failed for Out %d rc=%d",
+				rsrc_data->common_data->core_index,
+				vfe_out_res_id, rc);
+			goto release_wm;
+		}
+
+		if (rsrc_data->comp_grp)
+			cam_vfe_bus_add_wm_to_comp_grp(rsrc_data->comp_grp,
+				client_done_mask);
+	}
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	out_acquire_args->rsrc_node = rsrc_node;
+
+	CAM_DBG(CAM_ISP, "Acquire successful");
+	return rc;
+
+release_wm:
+	for (i--; i >= 0; i--)
+		cam_vfe_bus_release_wm(ver2_bus_priv, rsrc_data->wm_res[i]);
+
+	cam_vfe_bus_release_comp_grp(ver2_bus_priv,
+		rsrc_data->comp_grp);
+
+	return rc;
+}
+
+static int cam_vfe_bus_release_vfe_out(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node          *vfe_out = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data  *rsrc_data = NULL;
+	uint32_t                               secure_caps = 0;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	vfe_out = release_args;
+	rsrc_data = vfe_out->res_priv;
+
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid resource state:%d",
+			vfe_out->res_state);
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		cam_vfe_bus_release_wm(bus_priv, rsrc_data->wm_res[i]);
+	rsrc_data->num_wm = 0;
+
+	if (rsrc_data->comp_grp)
+		cam_vfe_bus_release_comp_grp(bus_priv, rsrc_data->comp_grp);
+	rsrc_data->comp_grp = NULL;
+
+	vfe_out->tasklet_info = NULL;
+	vfe_out->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+
+	secure_caps = cam_vfe_bus_can_be_secure(rsrc_data->out_type);
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (rsrc_data->secure_mode ==
+			rsrc_data->common_data->secure_mode) {
+			rsrc_data->common_data->num_sec_out--;
+			rsrc_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+		} else {
+			/*
+			 * The validity of the mode is properly
+			 * checked while acquiring the output port.
+			 * not expected to reach here, unless there is
+			 * some corruption.
+			 */
+			CAM_ERR(CAM_ISP, "driver[%d],resource[%d] mismatch",
+				rsrc_data->common_data->secure_mode,
+				rsrc_data->secure_mode);
+		}
+
+		if (!rsrc_data->common_data->num_sec_out)
+			rsrc_data->common_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		vfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_vfe_out(
+	struct cam_isp_resource_node          *vfe_out)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_ver2_vfe_out_data  *rsrc_data = NULL;
+	struct cam_vfe_bus_ver2_common_data   *common_data = NULL;
+	uint32_t bus_irq_reg_mask[CAM_VFE_BUS_IRQ_MAX];
+
+	if (!vfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP, "Start resource index %d", rsrc_data->out_type);
+
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid resource state:%d",
+			vfe_out->res_state);
+		return -EACCES;
+	}
+
+	memset(bus_irq_reg_mask, 0, sizeof(bus_irq_reg_mask));
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_vfe_bus_start_wm(rsrc_data->wm_res[i],
+			bus_irq_reg_mask);
+
+	if (rsrc_data->comp_grp) {
+		memset(bus_irq_reg_mask, 0, sizeof(bus_irq_reg_mask));
+		rc = cam_vfe_bus_start_comp_grp(rsrc_data->comp_grp,
+			bus_irq_reg_mask);
+	}
+
+	vfe_out->irq_handle = cam_irq_controller_subscribe_irq(
+		common_data->bus_irq_controller, CAM_IRQ_PRIORITY_1,
+		bus_irq_reg_mask, vfe_out, vfe_out->top_half_handler,
+		vfe_out->bottom_half_handler, vfe_out->tasklet_info,
+		&tasklet_bh_api);
+
+	if (vfe_out->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Subscribe IRQ failed for res_id %d",
+			vfe_out->res_id);
+		vfe_out->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_vfe_bus_stop_vfe_out(
+	struct cam_isp_resource_node          *vfe_out)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_ver2_vfe_out_data  *rsrc_data = NULL;
+	struct cam_vfe_bus_ver2_common_data   *common_data = NULL;
+
+	if (!vfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		vfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "vfe_out res_state is %d", vfe_out->res_state);
+		return rc;
+	}
+
+	if (rsrc_data->comp_grp)
+		rc = cam_vfe_bus_stop_comp_grp(rsrc_data->comp_grp);
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_vfe_bus_stop_wm(rsrc_data->wm_res[i]);
+
+	if (vfe_out->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			common_data->bus_irq_controller,
+			vfe_out->irq_handle);
+		vfe_out->irq_handle = 0;
+	}
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_vfe_bus_handle_vfe_out_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                     rc;
+	int                                         i;
+	struct cam_isp_resource_node               *vfe_out = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data       *rsrc_data = NULL;
+	struct cam_vfe_bus_irq_evt_payload         *evt_payload;
+
+	vfe_out = th_payload->handler_priv;
+	if (!vfe_out) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = 0x%x", th_payload->evt_status_arr[0]);
+	CAM_DBG(CAM_ISP, "IRQ status_1 = 0x%x", th_payload->evt_status_arr[1]);
+	CAM_DBG(CAM_ISP, "IRQ status_2 = 0x%x", th_payload->evt_status_arr[2]);
+
+	rc  = cam_vfe_bus_get_evt_payload(rsrc_data->common_data, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"IRQ status_0 = 0x%x status_1 = 0x%x status_2 = 0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1],
+			th_payload->evt_status_arr[2]);
+
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	evt_payload->core_index = rsrc_data->common_data->core_index;
+	evt_payload->evt_id  = evt_id;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_bus_handle_vfe_out_done_bottom_half(
+	void                                     *handler_priv,
+	void                                     *evt_payload_priv)
+{
+	int rc = -EINVAL;
+	struct cam_isp_resource_node             *vfe_out = handler_priv;
+	struct cam_vfe_bus_ver2_vfe_out_data     *rsrc_data = vfe_out->res_priv;
+	struct cam_isp_hw_event_info              evt_info;
+	void                                     *ctx = NULL;
+	uint32_t                                  evt_id = 0;
+	uint32_t                                  comp_mask = 0;
+	int                                       num_out = 0, i = 0;
+	struct cam_vfe_bus_irq_evt_payload       *evt_payload =
+		evt_payload_priv;
+	uint32_t                   out_list[CAM_VFE_BUS_VER2_VFE_OUT_MAX] = {0};
+
+	/*
+	 * If this resource has Composite Group then we only handle
+	 * Composite done. We acquire Composite if number of WM > 1.
+	 * So Else case is only one individual buf_done = WM[0].
+	 */
+	if (rsrc_data->comp_grp) {
+		rc = cam_vfe_bus_handle_comp_done_bottom_half(
+			rsrc_data->comp_grp, evt_payload_priv, &comp_mask);
+	} else {
+		rc = rsrc_data->wm_res[0]->bottom_half_handler(
+			rsrc_data->wm_res[0], evt_payload_priv);
+	}
+
+	ctx = rsrc_data->priv;
+
+	switch (rc) {
+	case CAM_VFE_IRQ_STATUS_SUCCESS:
+		evt_id = evt_payload->evt_id;
+
+		evt_info.res_type = vfe_out->res_type;
+		evt_info.hw_idx   = vfe_out->hw_intf->hw_idx;
+		if (rsrc_data->comp_grp) {
+			cam_vfe_bus_get_comp_vfe_out_res_id_list(
+				comp_mask, out_list, &num_out);
+			for (i = 0; i < num_out; i++) {
+				evt_info.res_id = out_list[i];
+				if (rsrc_data->common_data->event_cb)
+					rsrc_data->common_data->event_cb(ctx,
+						evt_id, (void *)&evt_info);
+			}
+		} else {
+			evt_info.res_id = vfe_out->res_id;
+			if (rsrc_data->common_data->event_cb)
+				rsrc_data->common_data->event_cb(ctx, evt_id,
+					(void *)&evt_info);
+		}
+		break;
+	default:
+		break;
+	}
+
+	cam_vfe_bus_put_evt_payload(rsrc_data->common_data, &evt_payload);
+	CAM_DBG(CAM_ISP, "vfe_out %d rc %d", rsrc_data->out_type, rc);
+
+	return rc;
+}
+
+static int cam_vfe_bus_init_vfe_out_resource(uint32_t  index,
+	struct cam_vfe_bus_ver2_priv                  *ver2_bus_priv,
+	struct cam_vfe_bus_ver2_hw_info               *ver2_hw_info)
+{
+	struct cam_isp_resource_node         *vfe_out = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data *rsrc_data = NULL;
+	int rc = 0, i;
+	int32_t vfe_out_type =
+		ver2_hw_info->vfe_out_hw_info[index].vfe_out_type;
+
+	if (vfe_out_type < 0 ||
+		vfe_out_type >= CAM_VFE_BUS_VER2_VFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "Init VFE Out failed, Invalid type=%d",
+			vfe_out_type);
+		return -EINVAL;
+	}
+
+	ver2_bus_priv->vfe_out_map_outtype[vfe_out_type] = index;
+	vfe_out = &ver2_bus_priv->vfe_out[index];
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		vfe_out->res_priv) {
+		CAM_ERR(CAM_ISP,
+			"Error. Looks like same resource is init again");
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver2_vfe_out_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	vfe_out->res_priv = rsrc_data;
+
+	vfe_out->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&vfe_out->list);
+
+	rsrc_data->out_type    =
+		ver2_hw_info->vfe_out_hw_info[index].vfe_out_type;
+	rsrc_data->common_data = &ver2_bus_priv->common_data;
+	rsrc_data->max_width   =
+		ver2_hw_info->vfe_out_hw_info[index].max_width;
+	rsrc_data->max_height  =
+		ver2_hw_info->vfe_out_hw_info[index].max_height;
+	rsrc_data->secure_mode = CAM_SECURE_MODE_NON_SECURE;
+
+	vfe_out->start = cam_vfe_bus_start_vfe_out;
+	vfe_out->stop = cam_vfe_bus_stop_vfe_out;
+	vfe_out->top_half_handler = cam_vfe_bus_handle_vfe_out_done_top_half;
+	vfe_out->bottom_half_handler =
+		cam_vfe_bus_handle_vfe_out_done_bottom_half;
+	vfe_out->process_cmd = cam_vfe_bus_process_cmd;
+	vfe_out->hw_intf = ver2_bus_priv->common_data.hw_intf;
+	vfe_out->irq_handle = 0;
+
+	for (i = 0; i < CAM_VFE_BUS_VER2_MAX_MID_PER_PORT; i++)
+		rsrc_data->mid[i] = ver2_hw_info->vfe_out_hw_info[index].mid[i];
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_vfe_out_resource(
+	struct cam_isp_resource_node    *vfe_out)
+{
+	struct cam_vfe_bus_ver2_vfe_out_data *rsrc_data = vfe_out->res_priv;
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		CAM_DBG(CAM_ISP, "HW%d Res %d already deinitialized");
+		return 0;
+	}
+
+	vfe_out->start = NULL;
+	vfe_out->stop = NULL;
+	vfe_out->top_half_handler = NULL;
+	vfe_out->bottom_half_handler = NULL;
+	vfe_out->hw_intf = NULL;
+	vfe_out->irq_handle = 0;
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&vfe_out->list);
+	vfe_out->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver2_handle_irq(uint32_t    evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_vfe_bus_ver2_priv          *bus_priv;
+	int rc = 0;
+
+	bus_priv     = th_payload->handler_priv;
+	CAM_DBG(CAM_ISP, "Enter");
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller);
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_vfe_bus_error_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int i = 0, rc = 0;
+	struct cam_vfe_bus_ver2_priv *bus_priv =
+		th_payload->handler_priv;
+	struct cam_vfe_bus_irq_evt_payload *evt_payload;
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "Bus Err IRQ");
+	for (i = 0; i < th_payload->num_registers; i++) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "vfe:%d: IRQ_Status%d: 0x%x",
+		bus_priv->common_data.core_index, i,
+			th_payload->evt_status_arr[i]);
+	}
+	cam_irq_controller_disable_irq(bus_priv->common_data.bus_irq_controller,
+		bus_priv->error_irq_handle);
+
+	rc  = cam_vfe_bus_get_evt_payload(&bus_priv->common_data, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Cannot get payload");
+		return rc;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->core_index = bus_priv->common_data.core_index;
+	evt_payload->evt_id  = evt_id;
+	evt_payload->debug_status_0 = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->debug_status_0);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static void cam_vfe_bus_update_ubwc_meta_addr(
+	uint32_t *reg_val_pair,
+	uint32_t  *j,
+	void     *regs,
+	uint64_t  image_buf)
+{
+	uint32_t  camera_hw_version;
+	struct cam_vfe_bus_ver2_reg_offset_ubwc_client *ubwc_regs;
+	struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client *ubwc_3_regs;
+	int rc = 0;
+
+	if (!regs || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc: %d", rc);
+		goto end;
+	}
+
+	switch (camera_hw_version) {
+	case CAM_CPAS_TITAN_170_V100:
+	case CAM_CPAS_TITAN_170_V110:
+	case CAM_CPAS_TITAN_170_V120:
+	case CAM_CPAS_TITAN_170_V200:
+		ubwc_regs =
+			(struct cam_vfe_bus_ver2_reg_offset_ubwc_client *)regs;
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->meta_addr,
+			image_buf);
+		break;
+	case CAM_CPAS_TITAN_175_V100:
+	case CAM_CPAS_TITAN_175_V101:
+	case CAM_CPAS_TITAN_175_V120:
+	case CAM_CPAS_TITAN_175_V130:
+	case CAM_CPAS_TITAN_165_V100:
+		ubwc_3_regs =
+			(struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client *)
+			regs;
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_3_regs->meta_addr,
+			image_buf);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid HW version: %d",
+			camera_hw_version);
+		break;
+	}
+end:
+	return;
+}
+
+static int cam_vfe_bus_update_ubwc_3_regs(
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data,
+	uint32_t *reg_val_pair,	uint32_t i, uint32_t *j)
+{
+	struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client *ubwc_regs;
+	int rc = 0;
+
+	if (!wm_data || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_regs = (struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client *)
+		wm_data->hw_regs->ubwc_regs;
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		wm_data->hw_regs->packer_cfg, wm_data->packer_cfg);
+	CAM_DBG(CAM_ISP, "WM %d packer cfg 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->is_dual) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->tile_cfg, wm_data->tile_cfg);
+	} else {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->tile_cfg, wm_data->tile_cfg);
+		CAM_DBG(CAM_ISP, "WM %d tile cfg 0x%x",
+			wm_data->index, reg_val_pair[*j-1]);
+	}
+
+	if (wm_data->is_dual) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->h_init, wm_data->offset);
+	} else {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->h_init, wm_data->h_init);
+		CAM_DBG(CAM_ISP, "WM %d h_init 0x%x",
+			wm_data->index, reg_val_pair[*j-1]);
+	}
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->v_init, wm_data->v_init);
+	CAM_DBG(CAM_ISP, "WM %d v_init 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_stride, wm_data->ubwc_meta_stride);
+	CAM_DBG(CAM_ISP, "WM %d meta stride 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->common_data->disable_ubwc_comp) {
+		wm_data->ubwc_mode_cfg_0 &= ~ubwc_regs->ubwc_comp_en_bit;
+		CAM_DBG(CAM_ISP,
+			"Force disable UBWC compression on VFE:%d WM:%d",
+			wm_data->common_data->core_index, wm_data->index);
+	}
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->mode_cfg_0, wm_data->ubwc_mode_cfg_0);
+	CAM_DBG(CAM_ISP, "WM %d ubwc_mode_cfg_0 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->mode_cfg_1, wm_data->ubwc_mode_cfg_1);
+	CAM_DBG(CAM_ISP, "WM %d ubwc_mode_cfg_1 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_offset, wm_data->ubwc_meta_offset);
+	CAM_DBG(CAM_ISP, "WM %d ubwc meta offset 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->ubwc_bandwidth_limit) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->bw_limit, wm_data->ubwc_bandwidth_limit);
+		CAM_DBG(CAM_ISP, "WM %d ubwc bw limit 0x%x",
+			wm_data->index,   wm_data->ubwc_bandwidth_limit);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_update_ubwc_legacy_regs(
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data,
+	uint32_t camera_hw_version, uint32_t *reg_val_pair,
+	uint32_t i, uint32_t *j)
+{
+	struct cam_vfe_bus_ver2_reg_offset_ubwc_client *ubwc_regs;
+	uint32_t ubwc_bw_limit = 0;
+	int rc = 0;
+
+	if (!wm_data || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_regs = (struct cam_vfe_bus_ver2_reg_offset_ubwc_client *)
+		wm_data->hw_regs->ubwc_regs;
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		wm_data->hw_regs->packer_cfg, wm_data->packer_cfg);
+	CAM_DBG(CAM_ISP, "WM %d packer cfg 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->is_dual) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->tile_cfg, wm_data->tile_cfg);
+	} else {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->tile_cfg, wm_data->tile_cfg);
+		CAM_DBG(CAM_ISP, "WM %d tile cfg 0x%x",
+			wm_data->index, reg_val_pair[*j-1]);
+	}
+
+	if (wm_data->is_dual) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->h_init, wm_data->offset);
+	} else {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->h_init, wm_data->h_init);
+		CAM_DBG(CAM_ISP, "WM %d h_init 0x%x",
+			wm_data->index, reg_val_pair[*j-1]);
+	}
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->v_init, wm_data->v_init);
+	CAM_DBG(CAM_ISP, "WM %d v_init 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_stride, wm_data->ubwc_meta_stride);
+	CAM_DBG(CAM_ISP, "WM %d meta stride 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->common_data->disable_ubwc_comp) {
+		wm_data->ubwc_mode_cfg_0 &= ~ubwc_regs->ubwc_comp_en_bit;
+		CAM_DBG(CAM_ISP,
+			"Force disable UBWC compression on VFE:%d WM:%d",
+			wm_data->common_data->core_index, wm_data->index);
+	}
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->mode_cfg_0, wm_data->ubwc_mode_cfg_0);
+	CAM_DBG(CAM_ISP, "WM %d ubwc_mode_cfg_0 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_offset, wm_data->ubwc_meta_offset);
+	CAM_DBG(CAM_ISP, "WM %d ubwc meta offset 0x%x",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (camera_hw_version == CAM_CPAS_TITAN_170_V110) {
+		switch (wm_data->format) {
+		case CAM_FORMAT_UBWC_TP10:
+			ubwc_bw_limit = 0x8 | BIT(0);
+			break;
+		case CAM_FORMAT_UBWC_NV12_4R:
+			ubwc_bw_limit = 0xB | BIT(0);
+			break;
+		default:
+			ubwc_bw_limit = 0;
+			break;
+		}
+	}
+
+	if (ubwc_bw_limit) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->bw_limit, ubwc_bw_limit);
+		CAM_DBG(CAM_ISP, "WM %d ubwc bw limit 0x%x",
+			wm_data->index, ubwc_bw_limit);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_update_ubwc_regs(
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data,
+	uint32_t *reg_val_pair,	uint32_t i, uint32_t *j)
+{
+	uint32_t camera_hw_version;
+	int rc = 0;
+
+	if (!wm_data || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc =  cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc: %d", rc);
+		goto end;
+	} else if ((camera_hw_version <= CAM_CPAS_TITAN_NONE) ||
+		(camera_hw_version >= CAM_CPAS_TITAN_MAX)) {
+		CAM_ERR(CAM_ISP, "Invalid HW version: %d",
+			camera_hw_version);
+		rc = -EINVAL;
+		goto end;
+	}
+	switch (camera_hw_version) {
+	case CAM_CPAS_TITAN_170_V100:
+	case CAM_CPAS_TITAN_170_V110:
+	case CAM_CPAS_TITAN_170_V120:
+	case CAM_CPAS_TITAN_170_V200:
+		rc = cam_vfe_bus_update_ubwc_legacy_regs(
+			wm_data, camera_hw_version, reg_val_pair, i, j);
+		break;
+	case CAM_CPAS_TITAN_175_V100:
+	case CAM_CPAS_TITAN_175_V101:
+	case CAM_CPAS_TITAN_175_V120:
+	case CAM_CPAS_TITAN_175_V130:
+	case CAM_CPAS_TITAN_165_V100:
+		rc = cam_vfe_bus_update_ubwc_3_regs(
+			wm_data, reg_val_pair, i, j);
+		break;
+	default:
+		break;
+	}
+
+	if (rc)
+		CAM_ERR(CAM_ISP, "Failed to update ubwc regs rc:%d", rc);
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_update_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update         *update_buf;
+	struct cam_buf_io_cfg                    *io_cfg;
+	struct cam_vfe_bus_ver2_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data = NULL;
+	struct cam_vfe_bus_ver2_reg_offset_ubwc_client *ubwc_client = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t  i, j, k, size = 0;
+	uint32_t  frame_inc = 0, val;
+	uint32_t loop_size = 0;
+
+	bus_priv = (struct cam_vfe_bus_ver2_priv  *) priv;
+	update_buf =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		update_buf->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	if (update_buf->wm_update->num_buf != vfe_out_data->num_wm) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->wm_update->num_buf, vfe_out_data->num_wm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	io_cfg = update_buf->wm_update->io_cfg;
+
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+		ubwc_client = wm_data->hw_regs->ubwc_regs;
+		/* update width register */
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->buffer_width_cfg,
+			wm_data->width);
+		CAM_DBG(CAM_ISP, "WM %d image width 0x%x",
+			wm_data->index, reg_val_pair[j-1]);
+
+		/* For initial configuration program all bus registers */
+		val = io_cfg->planes[i].plane_stride;
+		CAM_DBG(CAM_ISP, "before stride %d", val);
+		val = ALIGNUP(val, 16);
+		if (val != io_cfg->planes[i].plane_stride &&
+			val != wm_data->stride)
+			CAM_WARN(CAM_ISP,
+				"Warning stride %u expected %u",
+				io_cfg->planes[i].plane_stride,
+				val);
+
+		if ((wm_data->stride != val ||
+			!wm_data->init_cfg_done) && (wm_data->index >= 3)) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->stride,
+				io_cfg->planes[i].plane_stride);
+			wm_data->stride = val;
+			CAM_DBG(CAM_ISP, "WM %d image stride 0x%x",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		if (wm_data->en_ubwc) {
+			if (!wm_data->hw_regs->ubwc_regs) {
+				CAM_ERR(CAM_ISP,
+					"No UBWC register to configure.");
+				return -EINVAL;
+			}
+			if (wm_data->ubwc_updated) {
+				wm_data->ubwc_updated = false;
+				cam_vfe_bus_update_ubwc_regs(
+					wm_data, reg_val_pair, i, &j);
+			}
+
+			/* UBWC meta address */
+			cam_vfe_bus_update_ubwc_meta_addr(
+				reg_val_pair, &j,
+				wm_data->hw_regs->ubwc_regs,
+				update_buf->wm_update->image_buf[i]);
+			CAM_DBG(CAM_ISP, "WM %d ubwc meta addr 0x%llx",
+				wm_data->index,
+				update_buf->wm_update->image_buf[i]);
+		}
+
+		if (wm_data->en_ubwc) {
+			frame_inc = ALIGNUP(io_cfg->planes[i].plane_stride *
+			    io_cfg->planes[i].slice_height, 4096);
+			frame_inc += io_cfg->planes[i].meta_size;
+			CAM_DBG(CAM_ISP,
+				"WM %d frm %d: ht: %d stride %d meta: %d",
+				wm_data->index, frame_inc,
+				io_cfg->planes[i].slice_height,
+				io_cfg->planes[i].plane_stride,
+				io_cfg->planes[i].meta_size);
+		} else {
+			frame_inc = io_cfg->planes[i].plane_stride *
+				io_cfg->planes[i].slice_height;
+		}
+
+		if (wm_data->index < 3)
+			loop_size = wm_data->irq_subsample_period + 1;
+		else
+			loop_size = 1;
+
+		/* WM Image address */
+		for (k = 0; k < loop_size; k++) {
+			if (wm_data->en_ubwc)
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					wm_data->hw_regs->image_addr,
+					update_buf->wm_update->image_buf[i] +
+					io_cfg->planes[i].meta_size +
+					k * frame_inc);
+			else
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+					wm_data->hw_regs->image_addr,
+					update_buf->wm_update->image_buf[i] +
+					wm_data->offset + k * frame_inc);
+			CAM_DBG(CAM_ISP, "WM %d image address 0x%x",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->frame_inc, frame_inc);
+		CAM_DBG(CAM_ISP, "WM %d frame_inc %d",
+			wm_data->index, reg_val_pair[j-1]);
+
+
+		/* enable the WM */
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg,
+			wm_data->en_cfg);
+
+		/* set initial configuration done */
+		if (!wm_data->init_cfg_done)
+			wm_data->init_cfg_done = true;
+	}
+
+	size = vfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_buf->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_buf->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	vfe_out_data->cdm_util_ops->cdm_write_regrandom(
+		update_buf->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_buf->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_vfe_bus_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update         *update_hfr;
+	struct cam_vfe_bus_ver2_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data = NULL;
+	struct cam_isp_port_hfr_config           *hfr_cfg = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t  i, j, size = 0;
+
+	bus_priv = (struct cam_vfe_bus_ver2_priv  *) priv;
+	update_hfr =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		update_hfr->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data;
+
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+
+		if (wm_data->index <= 2 && hfr_cfg->subsample_period > 3) {
+			CAM_ERR(CAM_ISP,
+				"RDI doesn't support irq subsample period %d",
+				hfr_cfg->subsample_period);
+			return -EINVAL;
+		}
+
+		if ((wm_data->framedrop_pattern !=
+			hfr_cfg->framedrop_pattern) ||
+			!wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_pattern,
+				hfr_cfg->framedrop_pattern);
+			wm_data->framedrop_pattern = hfr_cfg->framedrop_pattern;
+			CAM_DBG(CAM_ISP, "WM %d framedrop pattern 0x%x",
+				wm_data->index, wm_data->framedrop_pattern);
+		}
+
+		if (wm_data->framedrop_period != hfr_cfg->framedrop_period ||
+			!wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_period,
+				hfr_cfg->framedrop_period);
+			wm_data->framedrop_period = hfr_cfg->framedrop_period;
+			CAM_DBG(CAM_ISP, "WM %d framedrop period 0x%x",
+				wm_data->index, wm_data->framedrop_period);
+		}
+
+		if (wm_data->irq_subsample_period != hfr_cfg->subsample_period
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_period,
+				hfr_cfg->subsample_period);
+			wm_data->irq_subsample_period =
+				hfr_cfg->subsample_period;
+			CAM_DBG(CAM_ISP, "WM %d irq subsample period 0x%x",
+				wm_data->index, wm_data->irq_subsample_period);
+		}
+
+		if (wm_data->irq_subsample_pattern != hfr_cfg->subsample_pattern
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_pattern,
+				hfr_cfg->subsample_pattern);
+			wm_data->irq_subsample_pattern =
+				hfr_cfg->subsample_pattern;
+			CAM_DBG(CAM_ISP, "WM %d irq subsample pattern 0x%x",
+				wm_data->index, wm_data->irq_subsample_pattern);
+		}
+
+		/* set initial configuration done */
+		if (!wm_data->hfr_cfg_done)
+			wm_data->hfr_cfg_done = true;
+	}
+
+	size = vfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_hfr->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_hfr->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	vfe_out_data->cdm_util_ops->cdm_write_regrandom(
+		update_hfr->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_hfr->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_vfe_bus_update_ubwc_config(void *cmd_args)
+{
+	struct cam_isp_hw_get_cmd_update         *update_ubwc;
+	struct cam_vfe_bus_ver2_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data = NULL;
+	struct cam_ubwc_plane_cfg_v1             *ubwc_plane_cfg = NULL;
+	uint32_t                                  i;
+	int                                       rc = 0;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	update_ubwc =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		update_ubwc->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_plane_cfg = (struct cam_ubwc_plane_cfg_v1   *)update_ubwc->data;
+
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+		if (i > 0)
+			ubwc_plane_cfg++;
+
+		if (!wm_data->hw_regs->ubwc_regs) {
+			CAM_ERR(CAM_ISP,
+				"No UBWC register to configure.");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (!wm_data->en_ubwc) {
+			CAM_ERR(CAM_ISP, "UBWC Disabled");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (wm_data->packer_cfg !=
+			ubwc_plane_cfg->packer_config ||
+			!wm_data->init_cfg_done) {
+			wm_data->packer_cfg = ubwc_plane_cfg->packer_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->tile_cfg !=
+			ubwc_plane_cfg->tile_config)
+			|| !wm_data->init_cfg_done)) {
+			wm_data->tile_cfg = ubwc_plane_cfg->tile_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->h_init !=
+			ubwc_plane_cfg->h_init) ||
+			!wm_data->init_cfg_done)) {
+			wm_data->h_init = ubwc_plane_cfg->h_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->v_init != ubwc_plane_cfg->v_init ||
+			!wm_data->init_cfg_done) {
+			wm_data->v_init = ubwc_plane_cfg->v_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_stride !=
+			ubwc_plane_cfg->meta_stride ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_stride = ubwc_plane_cfg->meta_stride;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg_0 !=
+			ubwc_plane_cfg->mode_config_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg_0 =
+				ubwc_plane_cfg->mode_config_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg_1 !=
+			ubwc_plane_cfg->mode_config_1 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg_1 =
+				ubwc_plane_cfg->mode_config_1;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_offset !=
+			ubwc_plane_cfg->meta_offset ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_offset = ubwc_plane_cfg->meta_offset;
+			wm_data->ubwc_updated = true;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_update_ubwc_config_v2(void *cmd_args)
+{
+	struct cam_isp_hw_get_cmd_update         *update_ubwc;
+	struct cam_vfe_bus_ver2_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data = NULL;
+	struct cam_vfe_generic_ubwc_config       *ubwc_generic_cfg = NULL;
+	struct cam_vfe_generic_ubwc_plane_config *ubwc_generic_plane_cfg = NULL;
+	uint32_t                                  i;
+	int                                       rc = 0;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	update_ubwc =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		update_ubwc->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_generic_cfg = (struct cam_vfe_generic_ubwc_config *)
+		update_ubwc->data;
+
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+		ubwc_generic_plane_cfg = &ubwc_generic_cfg->ubwc_plane_cfg[i];
+
+		if (!wm_data->hw_regs->ubwc_regs) {
+			CAM_ERR(CAM_ISP,
+				"No UBWC register to configure.");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (!wm_data->en_ubwc) {
+			CAM_ERR(CAM_ISP, "UBWC Disabled");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (wm_data->packer_cfg !=
+			ubwc_generic_plane_cfg->packer_config ||
+			!wm_data->init_cfg_done) {
+			wm_data->packer_cfg =
+				ubwc_generic_plane_cfg->packer_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->tile_cfg !=
+			ubwc_generic_plane_cfg->tile_config)
+			|| !wm_data->init_cfg_done)) {
+			wm_data->tile_cfg = ubwc_generic_plane_cfg->tile_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->h_init !=
+			ubwc_generic_plane_cfg->h_init) ||
+			!wm_data->init_cfg_done)) {
+			wm_data->h_init = ubwc_generic_plane_cfg->h_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->v_init != ubwc_generic_plane_cfg->v_init ||
+			!wm_data->init_cfg_done) {
+			wm_data->v_init = ubwc_generic_plane_cfg->v_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_stride !=
+			ubwc_generic_plane_cfg->meta_stride ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_stride =
+				ubwc_generic_plane_cfg->meta_stride;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg_0 !=
+			ubwc_generic_plane_cfg->mode_config_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg_0 =
+				ubwc_generic_plane_cfg->mode_config_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg_1 !=
+			ubwc_generic_plane_cfg->mode_config_1 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg_1 =
+				ubwc_generic_plane_cfg->mode_config_1;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_offset !=
+			ubwc_generic_plane_cfg->meta_offset ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_offset =
+				ubwc_generic_plane_cfg->meta_offset;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_lossy_threshold_0 !=
+			ubwc_generic_plane_cfg->lossy_threshold_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_lossy_threshold_0 =
+				ubwc_generic_plane_cfg->lossy_threshold_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_lossy_threshold_1 !=
+			ubwc_generic_plane_cfg->lossy_threshold_1 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_lossy_threshold_1 =
+				ubwc_generic_plane_cfg->lossy_threshold_1;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_bandwidth_limit !=
+			ubwc_generic_plane_cfg->bandwidth_limit ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_bandwidth_limit =
+				ubwc_generic_plane_cfg->bandwidth_limit;
+			wm_data->ubwc_updated = true;
+		}
+	}
+
+end:
+	return rc;
+}
+
+
+static int cam_vfe_bus_update_stripe_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv                *bus_priv;
+	struct cam_isp_hw_dual_isp_update_args      *stripe_args;
+	struct cam_vfe_bus_ver2_vfe_out_data        *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data    *wm_data = NULL;
+	struct cam_isp_dual_stripe_config           *stripe_config;
+	uint32_t outport_id, ports_plane_idx, i;
+
+	bus_priv = (struct cam_vfe_bus_ver2_priv  *) priv;
+	stripe_args = (struct cam_isp_hw_dual_isp_update_args *)cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		stripe_args->res->res_priv;
+
+	if (!vfe_out_data) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	outport_id = stripe_args->res->res_id & 0xFF;
+	if (stripe_args->res->res_id < CAM_ISP_IFE_OUT_RES_BASE ||
+		stripe_args->res->res_id >= bus_priv->max_out_res)
+		return 0;
+
+	ports_plane_idx = (stripe_args->split_id *
+	(stripe_args->dual_cfg->num_ports * CAM_PACKET_MAX_PLANES)) +
+	(outport_id * CAM_PACKET_MAX_PLANES);
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+		stripe_config = (struct cam_isp_dual_stripe_config  *)
+			&stripe_args->dual_cfg->stripes_flex[ports_plane_idx + i];
+		wm_data->width = stripe_config->width;
+		wm_data->offset = stripe_config->offset;
+		wm_data->tile_cfg = stripe_config->tileconfig;
+		CAM_DBG(CAM_ISP, "id:%x wm:%d width:0x%x offset:%x tilecfg:%x",
+			stripe_args->res->res_id, i, wm_data->width,
+			wm_data->offset, wm_data->tile_cfg);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_start_hw(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_start_vfe_out(hw_priv);
+}
+
+static int cam_vfe_bus_stop_hw(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_stop_vfe_out(hw_priv);
+}
+
+static int cam_vfe_bus_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv    *bus_priv = hw_priv;
+	uint32_t                         top_irq_reg_mask[2] = {0};
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (bus_priv->common_data.hw_init)
+		return 0;
+
+	top_irq_reg_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	bus_priv->irq_handle = cam_irq_controller_subscribe_irq(
+		bus_priv->common_data.vfe_irq_controller,
+		CAM_IRQ_PRIORITY_2,
+		top_irq_reg_mask,
+		bus_priv,
+		cam_vfe_bus_ver2_handle_irq,
+		NULL,
+		NULL,
+		NULL);
+
+	if (bus_priv->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Failed to subscribe BUS IRQ");
+		bus_priv->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	if (bus_priv->tasklet_info != NULL) {
+		bus_priv->error_irq_handle = cam_irq_controller_subscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			bus_error_irq_mask,
+			bus_priv,
+			cam_vfe_bus_error_irq_top_half,
+			cam_vfe_bus_err_bottom_half,
+			bus_priv->tasklet_info,
+			&tasklet_bh_api);
+
+		if (bus_priv->error_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "Failed to subscribe BUS error IRQ %d",
+				bus_priv->error_irq_handle);
+			bus_priv->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	/*Set Debug Registers*/
+	cam_io_w_mb(CAM_VFE_BUS_SET_DEBUG_REG, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->debug_status_cfg);
+
+	/* BUS_WR_INPUT_IF_ADDR_SYNC_FRAME_HEADER */
+	cam_io_w_mb(0x0, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->addr_sync_frame_hdr);
+
+	/* no clock gating at bus input */
+	cam_io_w_mb(0xFFFFF, bus_priv->common_data.mem_base + 0x0000200C);
+
+	/* BUS_WR_TEST_BUS_CTRL */
+	cam_io_w_mb(0x0, bus_priv->common_data.mem_base + 0x0000211C);
+
+	/* if addr_no_sync has default value then config the addr no sync reg */
+	cam_io_w_mb(CAM_VFE_BUS_ADDR_NO_SYNC_DEFAULT_VAL,
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->addr_sync_no_sync);
+
+	bus_priv->common_data.hw_init = true;
+
+	return 0;
+}
+
+static int cam_vfe_bus_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv    *bus_priv = hw_priv;
+	int                              rc = 0, i;
+	unsigned long                    flags;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Error: Invalid args");
+		return -EINVAL;
+	}
+
+	if (!bus_priv->common_data.hw_init)
+		return 0;
+
+	if (bus_priv->error_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			bus_priv->error_irq_handle);
+		bus_priv->error_irq_handle = 0;
+	}
+
+	if (bus_priv->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			bus_priv->irq_handle);
+		bus_priv->irq_handle = 0;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER2_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+	bus_priv->common_data.hw_init = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	return rc;
+}
+
+static int __cam_vfe_bus_process_cmd(void *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_process_cmd(priv, cmd_type, cmd_args, arg_size);
+}
+
+static int cam_vfe_bus_dump_wm_data(void *priv, void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv  *bus_priv =
+		(struct cam_vfe_bus_ver2_priv  *) priv;
+	struct cam_isp_hw_event_info  *event_info =
+		(struct cam_isp_hw_event_info *)cmd_args;
+	struct cam_isp_resource_node              *rsrc_node = NULL;
+	struct cam_vfe_bus_ver2_vfe_out_data      *rsrc_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data  *wm_data   = NULL;
+	int                                        i, wm_idx;
+	enum cam_vfe_bus_ver2_vfe_out_type         vfe_out_res_id;
+
+	vfe_out_res_id = cam_vfe_bus_get_out_res_id(event_info->res_id);
+	rsrc_node = &bus_priv->vfe_out[vfe_out_res_id];
+	rsrc_data = rsrc_node->res_priv;
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		wm_idx = cam_vfe_bus_get_wm_idx(vfe_out_res_id, i);
+		if (wm_idx < 0 || wm_idx >= bus_priv->num_client) {
+			CAM_ERR(CAM_ISP, "Unsupported VFE out %d",
+				vfe_out_res_id);
+			return -EINVAL;
+		}
+		wm_data = bus_priv->bus_client[wm_idx].res_priv;
+		CAM_INFO(CAM_ISP,
+			"VFE:%d WM:%d width:%u height:%u stride:%u x_init:%u en_cfg:%u acquired width:%u height:%u",
+			wm_data->common_data->core_index, wm_idx,
+			wm_data->width,
+			wm_data->height,
+			wm_data->stride, wm_data->h_init,
+			wm_data->en_cfg,
+			wm_data->acquired_width,
+			wm_data->acquired_height);
+	}
+	return 0;
+}
+
+static int cam_vfe_bus_get_res_for_mid(
+	struct cam_vfe_bus_ver2_priv *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_vfe_out_data   *out_data = NULL;
+	struct cam_isp_hw_get_cmd_update       *cmd_update = cmd_args;
+	struct cam_isp_hw_get_res_for_mid      *get_res = NULL;
+	int i, j;
+
+	get_res = (struct cam_isp_hw_get_res_for_mid *)cmd_update->data;
+	if (!get_res) {
+		CAM_ERR(CAM_ISP,
+			"invalid get resource for mid paramas");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		out_data = (struct cam_vfe_bus_ver2_vfe_out_data   *)
+			bus_priv->vfe_out[i].res_priv;
+
+		if (!out_data)
+			continue;
+
+		for (j = 0; j < CAM_VFE_BUS_VER2_MAX_MID_PER_PORT; j++) {
+			if (out_data->mid[j] == get_res->mid)
+				goto end;
+		}
+	}
+
+	if (i == bus_priv->num_out) {
+		CAM_ERR(CAM_ISP,
+			"mid:%d does not match with any out resource",
+			get_res->mid);
+		get_res->out_res_id = 0;
+		return -EINVAL;
+	}
+
+end:
+	CAM_INFO(CAM_ISP, "match mid :%d  out resource:0x%x found",
+		get_res->mid, bus_priv->vfe_out[i].res_id);
+	get_res->out_res_id = bus_priv->vfe_out[i].res_id;
+	return 0;
+}
+
+static int cam_vfe_bus_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_bus_ver2_priv		 *bus_priv;
+	uint32_t top_mask_0 = 0;
+	struct cam_isp_hw_bus_cap *vfe_bus_cap;
+
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+		rc = cam_vfe_bus_update_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+		rc = cam_vfe_bus_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_SECURE_MODE:
+		rc = cam_vfe_bus_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+		rc = cam_vfe_bus_update_stripe_cfg(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+		bus_priv = (struct cam_vfe_bus_ver2_priv  *) priv;
+		if (bus_priv->error_irq_handle) {
+			CAM_DBG(CAM_ISP, "Mask off bus error irq handler");
+			rc = cam_irq_controller_unsubscribe_irq(
+				bus_priv->common_data.bus_irq_controller,
+				bus_priv->error_irq_handle);
+			bus_priv->error_irq_handle = 0;
+		}
+		break;
+	case CAM_ISP_HW_CMD_UBWC_UPDATE:
+		rc = cam_vfe_bus_update_ubwc_config(cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO:
+		rc = cam_vfe_bus_dump_wm_data(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_UBWC_UPDATE_V2:
+		rc = cam_vfe_bus_update_ubwc_config_v2(cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ:
+		bus_priv = (struct cam_vfe_bus_ver2_priv *) priv;
+		top_mask_0 = cam_io_r_mb(bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->top_irq_mask_0);
+		top_mask_0 |= (1 << bus_priv->top_irq_shift);
+		cam_io_w_mb(top_mask_0, bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->top_irq_mask_0);
+		break;
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+		bus_priv = (struct cam_vfe_bus_ver2_priv *) priv;
+		rc = cam_vfe_bus_get_res_for_mid(bus_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_BUS_CAP:
+		bus_priv = (struct cam_vfe_bus_ver2_priv  *) priv;
+		vfe_bus_cap = (struct cam_isp_hw_bus_cap *) cmd_args;
+		vfe_bus_cap->max_vfe_out_res_type = bus_priv->max_out_res;
+		vfe_bus_cap->support_consumed_addr =
+			bus_priv->common_data.support_consumed_addr;
+
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid camif process command:%d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_bus_ver2_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_ver2_priv    *bus_priv = NULL;
+	struct cam_vfe_bus              *vfe_bus_local;
+	struct cam_vfe_bus_ver2_hw_info *ver2_hw_info = bus_hw_info;
+	struct cam_vfe_soc_private      *soc_private = NULL;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	if (!soc_info || !hw_intf || !bus_hw_info || !vfe_irq_controller) {
+		CAM_ERR(CAM_ISP,
+			"Inval_prms soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_hw_info);
+		CAM_ERR(CAM_ISP, "controller: %pK", vfe_irq_controller);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	vfe_bus_local = kzalloc(sizeof(struct cam_vfe_bus), GFP_KERNEL);
+	if (!vfe_bus_local) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_vfe_bus_ver2_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+	vfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                     = ver2_hw_info->num_client;
+	bus_priv->num_out                        = ver2_hw_info->num_out;
+	bus_priv->top_irq_shift                  = ver2_hw_info->top_irq_shift;
+	bus_priv->max_out_res                    = ver2_hw_info->max_out_res;
+	bus_priv->common_data.num_sec_out        = 0;
+	bus_priv->common_data.secure_mode        = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index         = soc_info->index;
+	bus_priv->common_data.mem_base           =
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX);
+	bus_priv->common_data.hw_intf            = hw_intf;
+	bus_priv->common_data.vfe_irq_controller = vfe_irq_controller;
+	bus_priv->common_data.common_reg         = &ver2_hw_info->common_reg;
+	bus_priv->common_data.addr_no_sync       =
+		CAM_VFE_BUS_ADDR_NO_SYNC_DEFAULT_VAL;
+	bus_priv->common_data.hw_init            = false;
+	bus_priv->common_data.support_consumed_addr =
+		ver2_hw_info->support_consumed_addr;
+	bus_priv->common_data.disable_ubwc_comp  = false;
+	bus_priv->common_data.is_lite = soc_private->is_ife_lite;
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+
+	rc = cam_irq_controller_init(drv_name, bus_priv->common_data.mem_base,
+		&ver2_hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller, true);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "cam_irq_controller_init failed");
+		goto free_bus_priv;
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->free_dual_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_vfe_bus_init_wm_resource(i, bus_priv, bus_hw_info,
+			&bus_priv->bus_client[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init WM failed rc=%d", rc);
+			goto deinit_wm;
+		}
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER2_COMP_GRP_MAX; i++) {
+		rc = cam_vfe_bus_init_comp_grp(i, bus_priv, bus_hw_info,
+			&bus_priv->comp_grp[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init Comp Grp failed rc=%d", rc);
+			goto deinit_comp_grp;
+		}
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER2_VFE_OUT_MAX; i++)
+		bus_priv->vfe_out_map_outtype[i] =
+			CAM_VFE_BUS_VER2_VFE_OUT_MAX;
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_vfe_bus_init_vfe_out_resource(i, bus_priv,
+			bus_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Init VFE Out failed rc=%d", rc);
+			goto deinit_vfe_out;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER2_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+
+	vfe_bus_local->hw_ops.reserve      = cam_vfe_bus_acquire_vfe_out;
+	vfe_bus_local->hw_ops.release      = cam_vfe_bus_release_vfe_out;
+	vfe_bus_local->hw_ops.start        = cam_vfe_bus_start_hw;
+	vfe_bus_local->hw_ops.stop         = cam_vfe_bus_stop_hw;
+	vfe_bus_local->hw_ops.init         = cam_vfe_bus_init_hw;
+	vfe_bus_local->hw_ops.deinit       = cam_vfe_bus_deinit_hw;
+	vfe_bus_local->top_half_handler    = cam_vfe_bus_ver2_handle_irq;
+	vfe_bus_local->bottom_half_handler = NULL;
+	vfe_bus_local->hw_ops.process_cmd  = __cam_vfe_bus_process_cmd;
+
+	*vfe_bus = vfe_bus_local;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+
+deinit_vfe_out:
+	if (i < 0)
+		i = CAM_VFE_BUS_VER2_VFE_OUT_MAX;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_vfe_out_resource(&bus_priv->vfe_out[i]);
+
+deinit_comp_grp:
+	if (i < 0)
+		i = CAM_VFE_BUS_VER2_COMP_GRP_MAX;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+
+deinit_wm:
+	if (i < 0)
+		i = bus_priv->num_client;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_deinit_wm_resource(&bus_priv->bus_client[i]);
+
+free_bus_priv:
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_vfe_bus_ver2_deinit(
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_ver2_priv    *bus_priv = NULL;
+	struct cam_vfe_bus              *vfe_bus_local;
+	unsigned long                    flags;
+
+	if (!vfe_bus || !*vfe_bus) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+	vfe_bus_local = *vfe_bus;
+
+	bus_priv = vfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER2_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+	bus_priv->common_data.hw_init = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	for (i = 0; i < bus_priv->num_client; i++) {
+		rc = cam_vfe_bus_deinit_wm_resource(&bus_priv->bus_client[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit WM failed rc=%d", rc);
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER2_COMP_GRP_MAX; i++) {
+		rc = cam_vfe_bus_deinit_comp_grp(&bus_priv->comp_grp[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit Comp Grp failed rc=%d", rc);
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER2_VFE_OUT_MAX; i++) {
+		rc = cam_vfe_bus_deinit_vfe_out_resource(&bus_priv->vfe_out[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"Deinit VFE Out failed rc=%d", rc);
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->free_dual_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	rc = cam_irq_controller_deinit(
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Deinit IRQ Controller failed rc=%d", rc);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+	*vfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.h
@@ -0,0 +1,239 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_BUS_VER2_H_
+#define _CAM_VFE_BUS_VER2_H_
+
+#include "cam_irq_controller.h"
+#include "cam_vfe_bus.h"
+
+#define CAM_VFE_BUS_VER2_MAX_CLIENTS 24
+#define CAM_VFE_BUS_VER2_MAX_MID_PER_PORT 4
+
+enum cam_vfe_bus_ver2_vfe_core_id {
+	CAM_VFE_BUS_VER2_VFE_CORE_0,
+	CAM_VFE_BUS_VER2_VFE_CORE_1,
+	CAM_VFE_BUS_VER2_VFE_CORE_2,
+	CAM_VFE_BUS_VER2_VFE_CORE_MAX,
+};
+
+enum cam_vfe_bus_ver2_comp_grp_type {
+	CAM_VFE_BUS_VER2_COMP_GRP_0,
+	CAM_VFE_BUS_VER2_COMP_GRP_1,
+	CAM_VFE_BUS_VER2_COMP_GRP_2,
+	CAM_VFE_BUS_VER2_COMP_GRP_3,
+	CAM_VFE_BUS_VER2_COMP_GRP_4,
+	CAM_VFE_BUS_VER2_COMP_GRP_5,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_0,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_1,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_2,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_3,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_4,
+	CAM_VFE_BUS_VER2_COMP_GRP_DUAL_5,
+	CAM_VFE_BUS_VER2_COMP_GRP_MAX,
+};
+
+enum cam_vfe_bus_ver2_vfe_out_type {
+	CAM_VFE_BUS_VER2_VFE_OUT_RDI0,
+	CAM_VFE_BUS_VER2_VFE_OUT_RDI1,
+	CAM_VFE_BUS_VER2_VFE_OUT_RDI2,
+	CAM_VFE_BUS_VER2_VFE_OUT_RDI3,
+	CAM_VFE_BUS_VER2_VFE_OUT_FULL,
+	CAM_VFE_BUS_VER2_VFE_OUT_DS4,
+	CAM_VFE_BUS_VER2_VFE_OUT_DS16,
+	CAM_VFE_BUS_VER2_VFE_OUT_RAW_DUMP,
+	CAM_VFE_BUS_VER2_VFE_OUT_FD,
+	CAM_VFE_BUS_VER2_VFE_OUT_PDAF,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BE,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_HDR_BHIST,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_TL_BG,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_BF,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_AWB_BG,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_BHIST,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_RS,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_CS,
+	CAM_VFE_BUS_VER2_VFE_OUT_STATS_IHIST,
+	CAM_VFE_BUS_VER2_VFE_OUT_FULL_DISP,
+	CAM_VFE_BUS_VER2_VFE_OUT_DS4_DISP,
+	CAM_VFE_BUS_VER2_VFE_OUT_DS16_DISP,
+	CAM_VFE_BUS_VER2_VFE_OUT_2PD,
+	CAM_VFE_BUS_VER2_VFE_OUT_MAX,
+};
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_vfe_bus_ver2_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t sw_reset;
+	uint32_t cgc_ovd;
+	uint32_t pwr_iso_cfg;
+	uint32_t dual_master_comp_cfg;
+	struct cam_irq_controller_reg_info irq_reg_info;
+	uint32_t comp_error_status;
+	uint32_t comp_ovrwr_status;
+	uint32_t dual_comp_error_status;
+	uint32_t dual_comp_ovrwr_status;
+	uint32_t addr_sync_cfg;
+	uint32_t addr_sync_frame_hdr;
+	uint32_t addr_sync_no_sync;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t top_irq_mask_0;
+};
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_ubwc_client:
+ *
+ * @Brief:        UBWC register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver2_reg_offset_ubwc_client {
+	uint32_t tile_cfg;
+	uint32_t h_init;
+	uint32_t v_init;
+	uint32_t meta_addr;
+	uint32_t meta_offset;
+	uint32_t meta_stride;
+	uint32_t mode_cfg_0;
+	uint32_t bw_limit;
+	uint32_t ubwc_comp_en_bit;
+};
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_ubwc_client:
+ *
+ * @Brief:        UBWC register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver2_reg_offset_ubwc_3_client {
+	uint32_t tile_cfg;
+	uint32_t h_init;
+	uint32_t v_init;
+	uint32_t meta_addr;
+	uint32_t meta_offset;
+	uint32_t meta_stride;
+	uint32_t mode_cfg_0;
+	uint32_t mode_cfg_1;
+	uint32_t bw_limit;
+	uint32_t ubwc_comp_en_bit;
+};
+
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver2_reg_offset_bus_client {
+	uint32_t status0;
+	uint32_t status1;
+	uint32_t cfg;
+	uint32_t header_addr;
+	uint32_t header_cfg;
+	uint32_t image_addr;
+	uint32_t image_addr_offset;
+	uint32_t buffer_width_cfg;
+	uint32_t buffer_height_cfg;
+	uint32_t packer_cfg;
+	uint32_t stride;
+	uint32_t irq_subsample_period;
+	uint32_t irq_subsample_pattern;
+	uint32_t framedrop_period;
+	uint32_t framedrop_pattern;
+	uint32_t frame_inc;
+	uint32_t burst_limit;
+	void    *ubwc_regs;
+};
+
+/*
+ * struct cam_vfe_bus_ver2_reg_offset_comp_grp:
+ *
+ * @Brief:        Register offsets for Composite Group registers
+ * comp_mask:     Comp group register address
+ * addr_sync_mask:Address sync group register address
+ */
+struct cam_vfe_bus_ver2_reg_offset_comp_grp {
+	uint32_t                            comp_mask;
+	uint32_t                            addr_sync_mask;
+};
+
+/*
+ * struct cam_vfe_bus_ver2_vfe_out_hw_info:
+ *
+ * @Brief:        HW capability of VFE Bus Client
+ */
+struct cam_vfe_bus_ver2_vfe_out_hw_info {
+	enum cam_vfe_bus_ver2_vfe_out_type  vfe_out_type;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+	uint32_t                         mid[CAM_VFE_BUS_VER2_MAX_MID_PER_PORT];
+};
+
+/*
+ * struct cam_vfe_bus_ver2_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:            Common register details
+ * @bus_client_reg:        Bus client register info
+ * @comp_reg_grp:          Composite group register info
+ * @vfe_out_hw_info:       VFE output capability
+ * @top_irq_shift:         Mask shift for top level BUS WR irq
+ * @support_consumed_addr: Indicate if bus support consumed address
+ * @max_out_res:           Max vfe out resource value supported for hw
+ */
+struct cam_vfe_bus_ver2_hw_info {
+	struct cam_vfe_bus_ver2_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_vfe_bus_ver2_reg_offset_bus_client
+		bus_client_reg[CAM_VFE_BUS_VER2_MAX_CLIENTS];
+	struct cam_vfe_bus_ver2_reg_offset_comp_grp
+		comp_grp_reg[CAM_VFE_BUS_VER2_COMP_GRP_MAX];
+	uint32_t num_out;
+	struct cam_vfe_bus_ver2_vfe_out_hw_info
+		vfe_out_hw_info[CAM_VFE_BUS_VER2_VFE_OUT_MAX];
+	uint32_t top_irq_shift;
+	bool support_consumed_addr;
+	uint32_t max_out_res;
+};
+
+/*
+ * cam_vfe_bus_ver2_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_ver2_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus);
+
+/*
+ * cam_vfe_bus_ver2_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @vfe_bus:                 Pointer to vfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_ver2_deinit(struct cam_vfe_bus     **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_VER2_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.c
@@ -0,0 +1,4052 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_hw_intf.h"
+#include "cam_ife_hw_mgr.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_bus.h"
+#include "cam_vfe_bus_ver3.h"
+#include "cam_vfe_core.h"
+#include "cam_vfe_soc.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "cam_trace.h"
+#include "cam_compat.h"
+
+static const char drv_name[] = "vfe_bus";
+
+#define CAM_VFE_BUS_VER3_IRQ_REG0                0
+#define CAM_VFE_BUS_VER3_IRQ_REG1                1
+#define CAM_VFE_BUS_VER3_IRQ_MAX                 2
+
+#define CAM_VFE_BUS_VER3_PAYLOAD_MAX             256
+
+#define CAM_VFE_RDI_BUS_DEFAULT_WIDTH               0xFFFF
+#define CAM_VFE_RDI_BUS_DEFAULT_STRIDE              0xFFFF
+
+#define MAX_BUF_UPDATE_REG_NUM   \
+	((sizeof(struct cam_vfe_bus_ver3_reg_offset_bus_client) +  \
+	sizeof(struct cam_vfe_bus_ver3_reg_offset_ubwc_client))/4)
+#define MAX_REG_VAL_PAIR_SIZE    \
+	(MAX_BUF_UPDATE_REG_NUM * 2 * CAM_PACKET_MAX_PLANES)
+
+static uint32_t bus_error_irq_mask[2] = {
+	0xD0000000,
+	0x00000000,
+};
+
+enum cam_vfe_bus_ver3_packer_format {
+	PACKER_FMT_VER3_PLAIN_128,
+	PACKER_FMT_VER3_PLAIN_8,
+	PACKER_FMT_VER3_PLAIN_8_ODD_EVEN,
+	PACKER_FMT_VER3_PLAIN_8_LSB_MSB_10,
+	PACKER_FMT_VER3_PLAIN_8_LSB_MSB_10_ODD_EVEN,
+	PACKER_FMT_VER3_PLAIN_16_10BPP,
+	PACKER_FMT_VER3_PLAIN_16_12BPP,
+	PACKER_FMT_VER3_PLAIN_16_14BPP,
+	PACKER_FMT_VER3_PLAIN_16_16BPP,
+	PACKER_FMT_VER3_PLAIN_32,
+	PACKER_FMT_VER3_PLAIN_64,
+	PACKER_FMT_VER3_TP_10,
+	PACKER_FMT_VER3_MAX,
+};
+
+struct cam_vfe_bus_ver3_comp_grp_acquire_args {
+	enum cam_vfe_bus_ver3_comp_grp_type  comp_grp_id;
+	uint32_t                             composite_mask;
+};
+
+struct cam_vfe_bus_error_info {
+	uint32_t  bitmask;
+	uint32_t  vfe_output;
+	char     *error_description;
+};
+
+struct cam_vfe_bus_ver3_common_data {
+	uint32_t                                    core_index;
+	void __iomem                               *mem_base;
+	void __iomem                               *camnoc_mem_base;
+	uint32_t                                    cpas_version;
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_hw_intf                         *hw_intf;
+	void                                       *bus_irq_controller;
+	void                                       *rup_irq_controller;
+	void                                       *vfe_irq_controller;
+	void                                       *buf_done_controller;
+	struct cam_vfe_bus_ver3_reg_offset_common  *common_reg;
+	uint32_t                                    io_buf_update[
+		MAX_REG_VAL_PAIR_SIZE];
+
+	struct cam_vfe_bus_irq_evt_payload          evt_payload[
+		CAM_VFE_BUS_VER3_PAYLOAD_MAX];
+	struct list_head                            free_payload_list;
+	spinlock_t                                  spin_lock;
+	struct mutex                                bus_mutex;
+	uint32_t                                    secure_mode;
+	uint32_t                                    num_sec_out;
+	uint32_t                                    addr_no_sync;
+	uint32_t                                    comp_done_shift;
+	uint32_t                                    supported_irq;
+	bool                                        comp_config_needed;
+	bool                                        is_lite;
+	bool                                        hw_init;
+	bool                                        support_consumed_addr;
+	bool                                        disable_ubwc_comp;
+	cam_hw_mgr_event_cb_func                    event_cb;
+	int                        rup_irq_handle[CAM_VFE_BUS_VER3_SRC_GRP_MAX];
+};
+
+struct cam_vfe_bus_ver3_wm_resource_data {
+	uint32_t             index;
+	struct cam_vfe_bus_ver3_common_data            *common_data;
+	struct cam_vfe_bus_ver3_reg_offset_bus_client  *hw_regs;
+
+	bool                 init_cfg_done;
+	bool                 hfr_cfg_done;
+
+	uint32_t             offset;
+	uint32_t             width;
+	uint32_t             height;
+	uint32_t             stride;
+	uint32_t             format;
+	enum cam_vfe_bus_ver3_packer_format pack_fmt;
+
+	uint32_t             burst_len;
+
+	uint32_t             en_ubwc;
+	bool                 ubwc_updated;
+	uint32_t             packer_cfg;
+	uint32_t             h_init;
+	uint32_t             ubwc_meta_addr;
+	uint32_t             ubwc_meta_cfg;
+	uint32_t             ubwc_mode_cfg;
+	uint32_t             ubwc_stats_ctrl;
+	uint32_t             ubwc_ctrl_2;
+
+	uint32_t             irq_subsample_period;
+	uint32_t             irq_subsample_pattern;
+	uint32_t             framedrop_period;
+	uint32_t             framedrop_pattern;
+
+	uint32_t             en_cfg;
+	uint32_t             is_dual;
+
+	uint32_t             ubwc_lossy_threshold_0;
+	uint32_t             ubwc_lossy_threshold_1;
+	uint32_t             ubwc_offset_lossy_variance;
+	uint32_t             ubwc_bandwidth_limit;
+	uint32_t             acquired_width;
+	uint32_t             acquired_height;
+};
+
+struct cam_vfe_bus_ver3_comp_grp_data {
+	enum cam_vfe_bus_ver3_comp_grp_type          comp_grp_type;
+	struct cam_vfe_bus_ver3_common_data         *common_data;
+
+	uint32_t                                     is_master;
+	uint32_t                                     is_dual;
+	uint32_t                                     dual_slave_core;
+	uint32_t                                     intra_client_mask;
+	uint32_t                                     addr_sync_mode;
+	uint32_t                                     composite_mask;
+
+	uint32_t                                     acquire_dev_cnt;
+	uint32_t                                     irq_trigger_cnt;
+	uint32_t                                     ubwc_static_ctrl;
+};
+
+struct cam_vfe_bus_ver3_vfe_out_data {
+	uint32_t                              out_type;
+	uint32_t                              source_group;
+	struct cam_vfe_bus_ver3_common_data  *common_data;
+	struct cam_vfe_bus_ver3_priv         *bus_priv;
+
+	uint32_t                         num_wm;
+	struct cam_isp_resource_node    *wm_res;
+
+	struct cam_isp_resource_node    *comp_grp;
+	enum cam_isp_hw_sync_mode        dual_comp_sync_mode;
+	uint32_t                         dual_hw_alternate_vfe_id;
+	struct list_head                 vfe_out_list;
+
+	uint32_t                         is_master;
+	uint32_t                         is_dual;
+
+	uint32_t                         format;
+	uint32_t                         max_width;
+	uint32_t                         max_height;
+	struct cam_cdm_utils_ops        *cdm_util_ops;
+	uint32_t                         secure_mode;
+	void                            *priv;
+	uint32_t                         mid[CAM_VFE_BUS_VER3_MAX_MID_PER_PORT];
+};
+
+struct cam_vfe_bus_ver3_priv {
+	struct cam_vfe_bus_ver3_common_data common_data;
+	uint32_t                            num_client;
+	uint32_t                            num_out;
+	uint32_t                            num_comp_grp;
+	uint32_t                            top_irq_shift;
+
+	struct cam_isp_resource_node       *bus_client;
+	struct cam_isp_resource_node       *comp_grp;
+	struct cam_isp_resource_node       *vfe_out;
+	uint32_t  vfe_out_map_outtype[CAM_VFE_BUS_VER3_VFE_OUT_MAX];
+
+	struct list_head                    free_comp_grp;
+	struct list_head                    used_comp_grp;
+
+	int                                 bus_irq_handle;
+	int                                 rup_irq_handle;
+	int                                 error_irq_handle;
+	void                               *tasklet_info;
+	uint32_t                            max_out_res;
+};
+
+static const struct cam_vfe_bus_error_info vfe_error_list[] = {
+	{
+		.bitmask = 0x0000001,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+		.error_description = "VID Y 1:1"
+	},
+	{
+		.bitmask = 0x0000002,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+		.error_description = "VID C 1:1"
+	},
+	{
+		.bitmask = 0x0000004,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+		.error_description = "VID YC 4:1"
+	},
+	{
+		.bitmask = 0x0000008,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+		.error_description = "VID YC 16:1"
+	},
+	{
+		.bitmask = 0x0000010,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+		.error_description = "DISP Y 1:1"
+	},
+	{
+		.bitmask = 0x0000020,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+		.error_description = "DISP C 1:1"
+	},
+	{
+		.bitmask = 0x0000040,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+		.error_description = "DISP YC 4:1"
+	},
+	{
+		.bitmask = 0x0000080,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+		.error_description = "DISP YC 16:1"
+	},
+	{
+		.bitmask = 0x0000100,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_FD,
+		.error_description = "FD Y"
+	},
+	{
+		.bitmask = 0x0000200,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_FD,
+		.error_description = "FD C"
+	},
+	{
+		.bitmask = 0x0000400,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+		.error_description = "PIXEL RAW DUMP"
+	},
+	{
+		.bitmask = 0x0001000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE,
+		.error_description = "STATS HDR BE"
+	},
+	{
+		.bitmask = 0x0002000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST,
+		.error_description = "STATS HDR BHIST"
+	},
+	{
+		.bitmask = 0x0004000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+		.error_description = "STATS TINTLESS BG"
+	},
+	{
+		.bitmask = 0x0008000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+		.error_description = "STATS AWB BG"
+	},
+	{
+		.bitmask = 0x0010000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+		.error_description = "STATS BHIST"
+	},
+	{
+		.bitmask = 0x0020000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS,
+		.error_description = "STATS RS"
+	},
+	{
+		.bitmask = 0x0040000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS,
+		.error_description = "STATS CS"
+	},
+	{
+		.bitmask = 0x0080000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST,
+		.error_description = "STATS IHIST"
+	},
+	{
+		.bitmask = 0x0100000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF,
+		.error_description = "STATS BAF"
+	},
+	{
+		.bitmask = 0x0200000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+		.error_description = "PD"
+	},
+	{
+		.bitmask = 0x0400000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_LCR,
+		.error_description = "LCR"
+	},
+	{
+		.bitmask = 0x0800000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+		.error_description = "Full RDI 0"
+	},
+	{
+		.bitmask = 0x1000000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+		.error_description = "Full RDI 1"
+	},
+	{
+		.bitmask = 0x2000000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+		.error_description = "Full RDI 2"
+	},
+};
+
+static const struct cam_vfe_bus_error_info vfe_constraint_error_list[] = {
+	{
+		.bitmask = 0x000001,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "PPC 1x1 illegal"
+	},
+	{
+		.bitmask = 0x000002,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "PPC 1x2 illegal"
+	},
+	{
+		.bitmask = 0x000004,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "PPC 2x1 illegal"
+	},
+	{
+		.bitmask = 0x000008,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "PPC 2x2 illegal"
+	},
+	{
+		.bitmask = 0x000010,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Pack 8 BPP illegal"
+	},
+	{
+		.bitmask = 0x000020,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Pack 16 BPP illegal"
+	},
+	{
+		.bitmask = 0x000040,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Pack 32 BPP illegal"
+	},
+	{
+		.bitmask = 0x000080,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Pack 64 BPP illegal"
+	},
+	{
+		.bitmask = 0x000100,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Pack 128 BPP illegal"
+	},
+	{
+		.bitmask = 0x000200,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "UBWC NV12 illegal"
+	},
+	{
+		.bitmask = 0x000400,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "UBWC NV12 4R illegal"
+	},
+	{
+		.bitmask = 0x000800,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "UBWC TP10 illegal"
+	},
+	{
+		.bitmask = 0x001000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Frame based illegal"
+	},
+	{
+		.bitmask = 0x002000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Index based illegal"
+	},
+	{
+		.bitmask = 0x004000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Image address unalign"
+	},
+	{
+		.bitmask = 0x008000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "UBWC address unalign"
+	},
+	{
+		.bitmask = 0x010000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Frame Header address unalign"
+	},
+	{
+		.bitmask = 0x020000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "X Initialization unalign"
+	},
+	{
+		.bitmask = 0x040000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Image Width unalign"
+	},
+	{
+		.bitmask = 0x080000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Image Height unalign"
+	},
+	{
+		.bitmask = 0x100000,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+		.error_description = "Meta Stride unalign"
+	},
+};
+
+static const struct cam_vfe_bus_error_info vfe_lite_error_list[] = {
+	{
+		.bitmask = 0x01,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+		.error_description = "Lite RDI 0"
+	},
+	{
+		.bitmask = 0x02,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+		.error_description = "Lite RDI 1"
+	},
+	{
+		.bitmask = 0x04,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+		.error_description = "Lite RDI 2"
+	},
+	{
+		.bitmask = 0x08,
+		.vfe_output = CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+		.error_description = "Lite RDI 3"
+	}
+};
+
+static int cam_vfe_bus_ver3_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size);
+
+static int cam_vfe_bus_ver3_get_evt_payload(
+	struct cam_vfe_bus_ver3_common_data  *common_data,
+	struct cam_vfe_bus_irq_evt_payload  **evt_payload)
+{
+	int rc;
+
+	spin_lock(&common_data->spin_lock);
+
+	if (!common_data->hw_init) {
+		*evt_payload = NULL;
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE:%d Bus uninitialized",
+			common_data->core_index);
+		rc = -EPERM;
+		goto done;
+	}
+
+	if (list_empty(&common_data->free_payload_list)) {
+		*evt_payload = NULL;
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free BUS event payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&common_data->free_payload_list,
+		struct cam_vfe_bus_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&common_data->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_put_evt_payload(
+	struct cam_vfe_bus_ver3_common_data     *common_data,
+	struct cam_vfe_bus_irq_evt_payload     **evt_payload)
+{
+	unsigned long flags;
+
+	if (!common_data) {
+		CAM_ERR(CAM_ISP, "Invalid param common_data NULL");
+		return -EINVAL;
+	}
+
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&common_data->spin_lock, flags);
+	if (common_data->hw_init)
+		list_add_tail(&(*evt_payload)->list,
+			&common_data->free_payload_list);
+	spin_unlock_irqrestore(&common_data->spin_lock, flags);
+
+	*evt_payload = NULL;
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static bool cam_vfe_bus_ver3_can_be_secure(uint32_t out_type)
+{
+	switch (out_type) {
+	case CAM_VFE_BUS_VER3_VFE_OUT_FULL:
+	case CAM_VFE_BUS_VER3_VFE_OUT_DS4:
+	case CAM_VFE_BUS_VER3_VFE_OUT_DS16:
+	case CAM_VFE_BUS_VER3_VFE_OUT_FD:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RDI0:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RDI1:
+	case CAM_VFE_BUS_VER3_VFE_OUT_RDI2:
+	case CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP:
+	case CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP:
+	case CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP:
+		return true;
+
+	case CAM_VFE_BUS_VER3_VFE_OUT_2PD:
+	case CAM_VFE_BUS_VER3_VFE_OUT_LCR:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS:
+	case CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST:
+	default:
+		return false;
+	}
+}
+
+static enum cam_vfe_bus_ver3_vfe_out_type
+	cam_vfe_bus_ver3_get_out_res_id_and_index(
+	struct cam_vfe_bus_ver3_priv  *bus_priv,
+	uint32_t res_type, uint32_t  *index)
+{
+	uint32_t  vfe_out_type;
+
+	switch (res_type) {
+	case CAM_ISP_IFE_OUT_RES_FULL:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_FULL;
+		break;
+	case CAM_ISP_IFE_OUT_RES_DS4:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_DS4;
+		break;
+	case CAM_ISP_IFE_OUT_RES_DS16:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_DS16;
+		break;
+	case CAM_ISP_IFE_OUT_RES_FD:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_FD;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RAW_DUMP:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP;
+		break;
+	case CAM_ISP_IFE_OUT_RES_2PD:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_2PD;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_0:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI0;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_1:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI1;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_2:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI2;
+		break;
+	case CAM_ISP_IFE_OUT_RES_RDI_3:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_RDI3;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BE:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_TL_BG:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_BF:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_AWB_BG:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_BHIST:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_RS:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_CS:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_IHIST:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST;
+		break;
+	case CAM_ISP_IFE_OUT_RES_FULL_DISP:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP;
+		break;
+	case CAM_ISP_IFE_OUT_RES_DS4_DISP:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP;
+		break;
+	case CAM_ISP_IFE_OUT_RES_DS16_DISP:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP;
+		break;
+	case CAM_ISP_IFE_OUT_RES_LCR:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_LCR;
+		break;
+	case CAM_ISP_IFE_OUT_RES_AWB_BFW:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW;
+		break;
+	case CAM_ISP_IFE_OUT_RES_2PD_STATS:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_2PD_STATS;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_AEC_BE:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE;
+		break;
+
+	case CAM_ISP_IFE_OUT_RES_LTM_STATS:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS;
+		break;
+	case CAM_ISP_IFE_OUT_RES_STATS_GTM_BHIST:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST;
+		break;
+	case CAM_ISP_IFE_LITE_OUT_RES_STATS_BE:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_STATS_BE;
+		break;
+	case CAM_ISP_IFE_LITE_OUT_RES_GAMMA:
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_GAMMA;
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "Invalid isp res id: %d , assigning max",
+			res_type);
+		vfe_out_type = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+		*index = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+		return CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+	}
+	*index = bus_priv->vfe_out_map_outtype[vfe_out_type];
+
+	return vfe_out_type;
+}
+
+static int cam_vfe_bus_ver3_get_comp_vfe_out_res_id_list(
+	uint32_t comp_mask, uint32_t *out_list, int *num_out)
+{
+	int count = 0;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_RDI0))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RDI_0;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_RDI1))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RDI_1;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_RDI2))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RDI_2;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_RDI3))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RDI_3;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_FULL))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_FULL;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_DS4))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_DS4;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_DS16))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_DS16;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_RAW_DUMP;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_FD))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_FD;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_PDAF))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_PDAF;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_HDR_BE;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_TL_BG;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_BF;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_AWB_BG;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_BHIST;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_RS;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_CS;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_IHIST;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_FULL_DISP;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_DS4_DISP;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_DS16_DISP;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_2PD))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_2PD;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_LCR))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_LCR;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_AWB_BFW;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_2PD_STATS))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_2PD_STATS;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_AEC_BE;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_LTM_STATS;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST))
+		out_list[count++] = CAM_ISP_IFE_OUT_RES_STATS_GTM_BHIST;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_STATS_BE))
+		out_list[count++] = CAM_ISP_IFE_LITE_OUT_RES_STATS_BE;
+
+	if (comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_GAMMA))
+		out_list[count++] = CAM_ISP_IFE_LITE_OUT_RES_GAMMA;
+
+	*num_out = count;
+	return 0;
+}
+
+static enum cam_vfe_bus_ver3_packer_format
+	cam_vfe_bus_ver3_get_packer_fmt(uint32_t out_fmt, int wm_index)
+{
+	switch (out_fmt) {
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_MIPI_RAW_20:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN128:
+	case CAM_FORMAT_PD8:
+		return PACKER_FMT_VER3_PLAIN_128;
+	case CAM_FORMAT_PLAIN8:
+		return PACKER_FMT_VER3_PLAIN_8;
+	case CAM_FORMAT_NV21:
+		if ((wm_index == 1) || (wm_index == 3) || (wm_index == 5))
+			return PACKER_FMT_VER3_PLAIN_8_LSB_MSB_10_ODD_EVEN;
+		fallthrough;
+	case CAM_FORMAT_NV12:
+	case CAM_FORMAT_UBWC_NV12:
+	case CAM_FORMAT_UBWC_NV12_4R:
+	case CAM_FORMAT_Y_ONLY:
+		return PACKER_FMT_VER3_PLAIN_8_LSB_MSB_10;
+	case CAM_FORMAT_PLAIN16_10:
+		return PACKER_FMT_VER3_PLAIN_16_10BPP;
+	case CAM_FORMAT_PLAIN16_12:
+		return PACKER_FMT_VER3_PLAIN_16_12BPP;
+	case CAM_FORMAT_PLAIN16_14:
+		return PACKER_FMT_VER3_PLAIN_16_14BPP;
+	case CAM_FORMAT_PLAIN16_16:
+		return PACKER_FMT_VER3_PLAIN_16_16BPP;
+	case CAM_FORMAT_PLAIN32:
+	case CAM_FORMAT_ARGB:
+		return PACKER_FMT_VER3_PLAIN_32;
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_ARGB_16:
+	case CAM_FORMAT_PD10:
+		return PACKER_FMT_VER3_PLAIN_64;
+	case CAM_FORMAT_UBWC_TP10:
+	case CAM_FORMAT_TP10:
+		return PACKER_FMT_VER3_TP_10;
+	default:
+		return PACKER_FMT_VER3_MAX;
+	}
+	return PACKER_FMT_VER3_MAX;
+}
+
+static int cam_vfe_bus_ver3_handle_rup_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                     rc;
+	int                                         i;
+	struct cam_isp_resource_node               *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data       *rsrc_data = NULL;
+	struct cam_vfe_bus_irq_evt_payload         *evt_payload;
+	uint32_t irq_status;
+
+	vfe_out = th_payload->handler_priv;
+	if (!vfe_out) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+
+	CAM_DBG(CAM_ISP, "VFE:%d Bus IRQ status_0: 0x%X",
+		rsrc_data->common_data->core_index,
+		th_payload->evt_status_arr[0]);
+
+	rc  = cam_vfe_bus_ver3_get_evt_payload(rsrc_data->common_data,
+		&evt_payload);
+
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"VFE:%d Bus IRQ status_0: 0x%X",
+			rsrc_data->common_data->core_index,
+			th_payload->evt_status_arr[0]);
+		return rc;
+	}
+
+	evt_payload->core_index = rsrc_data->common_data->core_index;
+	evt_payload->evt_id  = evt_id;
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	irq_status =
+		th_payload->evt_status_arr[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+
+	trace_cam_log_event("RUP", "RUP_IRQ", irq_status, 0);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static void cam_vfe_bus_ver3_print_constraint_errors(
+	uint32_t wm_idx,
+	uint32_t constraint_errors)
+{
+	uint32_t i;
+
+	CAM_INFO(CAM_ISP, "Constraint violation bitflags: %u",
+		constraint_errors);
+
+	for (i = 0; i < ARRAY_SIZE(vfe_constraint_error_list); i++) {
+		if (vfe_constraint_error_list[i].bitmask & constraint_errors) {
+			CAM_INFO(CAM_ISP, "WM:%u %s programming",
+				wm_idx,
+				vfe_constraint_error_list[i].error_description);
+		}
+	}
+}
+
+static void cam_vfe_bus_ver3_get_constraint_errors(
+	struct cam_vfe_bus_ver3_priv *bus_priv)
+{
+	uint32_t i, j, constraint_errors;
+	struct cam_isp_resource_node              *out_rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data      *out_rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data  *wm_data   = NULL;
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		out_rsrc_node = &bus_priv->vfe_out[i];
+		if (!out_rsrc_node || !out_rsrc_node->res_priv) {
+			CAM_DBG(CAM_ISP,
+				"Vfe out:%d out rsrc node or data is NULL", i);
+			continue;
+		}
+		out_rsrc_data = out_rsrc_node->res_priv;
+		for (j = 0; j < out_rsrc_data->num_wm; j++) {
+			wm_data = out_rsrc_data->wm_res[j].res_priv;
+			if (wm_data) {
+				constraint_errors = cam_io_r_mb(
+					bus_priv->common_data.mem_base +
+					wm_data->hw_regs->debug_status_1);
+				cam_vfe_bus_ver3_print_constraint_errors(j,
+					constraint_errors);
+			}
+		}
+	}
+}
+
+static int cam_vfe_bus_ver3_handle_rup_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int                                   ret = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_vfe_bus_irq_evt_payload   *payload;
+	struct cam_isp_resource_node         *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data *rsrc_data = NULL;
+	struct cam_isp_hw_event_info          evt_info;
+	uint32_t                              irq_status;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	payload = evt_payload_priv;
+	vfe_out = handler_priv;
+	rsrc_data = vfe_out->res_priv;
+
+	if (!rsrc_data->common_data->event_cb) {
+		CAM_ERR(CAM_ISP, "Callback to HW MGR not found");
+		return ret;
+	}
+
+	irq_status = payload->irq_reg_val[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+
+	evt_info.hw_idx = rsrc_data->common_data->core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_VFE_IN;
+	evt_info.evt_param = payload->evt_param;
+
+	if (!rsrc_data->common_data->is_lite) {
+		if (irq_status & 0x1) {
+			CAM_DBG(CAM_ISP, "VFE:%d Received CAMIF RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_CAMIF;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x2) {
+			CAM_DBG(CAM_ISP, "VFE:%d Received PDLIB RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_PDLIB;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x4)
+			CAM_DBG(CAM_ISP, "VFE:%d Received LCR RUP",
+				evt_info.hw_idx);
+
+		if (irq_status & 0x8) {
+			CAM_DBG(CAM_ISP, "VFE:%d Received RDI0 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI0;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x10) {
+			CAM_DBG(CAM_ISP, "VFE:%d Received RDI1 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI1;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x20) {
+			CAM_DBG(CAM_ISP, "VFE:%d Received RDI2 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI2;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+	} else {
+		if (irq_status & 0x1) {
+			CAM_DBG(CAM_ISP, "VFE:%d Received RDI0 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI0;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x2) {
+			CAM_DBG(CAM_ISP, "VFE:%d Received RDI1 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI1;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x4) {
+			CAM_DBG(CAM_ISP, "VFE:%d Received RDI2 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI2;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+
+		if (irq_status & 0x8) {
+			CAM_DBG(CAM_ISP, "VFE:%d Received RDI3 RUP",
+				evt_info.hw_idx);
+			evt_info.res_id = CAM_ISP_HW_VFE_IN_RDI3;
+			rsrc_data->common_data->event_cb(
+				rsrc_data->priv, CAM_ISP_HW_EVENT_REG_UPDATE,
+				(void *)&evt_info);
+		}
+	}
+
+	ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d Bus RUP IRQ status_0:0x%X rc:%d",
+		evt_info.hw_idx, CAM_ISP_HW_EVENT_REG_UPDATE, irq_status, ret);
+
+	cam_vfe_bus_ver3_put_evt_payload(rsrc_data->common_data, &payload);
+
+	return ret;
+}
+
+static int cam_vfe_bus_ver3_acquire_wm(
+	struct cam_vfe_bus_ver3_priv          *ver3_bus_priv,
+	struct cam_isp_out_port_generic_info  *out_port_info,
+	void                                  *tasklet,
+	enum cam_vfe_bus_ver3_vfe_out_type     vfe_out_res_id,
+	enum cam_vfe_bus_plane_type            plane,
+	struct cam_isp_resource_node          *wm_res,
+	uint32_t                               is_dual,
+	enum cam_vfe_bus_ver3_comp_grp_type   *comp_grp_id)
+{
+	int32_t wm_idx = 0;
+	struct cam_vfe_bus_ver3_wm_resource_data  *rsrc_data = NULL;
+	char wm_mode[50];
+
+	memset(wm_mode, '\0', sizeof(wm_mode));
+
+	if (wm_res->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "WM:%d not available state:%d",
+			wm_idx, wm_res->res_state);
+		return -EALREADY;
+	}
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	wm_res->tasklet_info = tasklet;
+
+	rsrc_data = wm_res->res_priv;
+	wm_idx = rsrc_data->index;
+	rsrc_data->format = out_port_info->format;
+	rsrc_data->pack_fmt = cam_vfe_bus_ver3_get_packer_fmt(rsrc_data->format,
+		wm_idx);
+
+	rsrc_data->width = out_port_info->width;
+	rsrc_data->height = out_port_info->height;
+	rsrc_data->acquired_width = out_port_info->width;
+	rsrc_data->acquired_height = out_port_info->height;
+	rsrc_data->is_dual = is_dual;
+	/* Set WM offset value to default */
+	rsrc_data->offset  = 0;
+	CAM_DBG(CAM_ISP, "WM:%d width %d height %d", rsrc_data->index,
+		rsrc_data->width, rsrc_data->height);
+
+	if ((vfe_out_res_id >= CAM_VFE_BUS_VER3_VFE_OUT_RDI0) &&
+		(vfe_out_res_id <= CAM_VFE_BUS_VER3_VFE_OUT_RDI3)) {
+
+		rsrc_data->pack_fmt = 0x0;
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_MIPI_RAW_6:
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_MIPI_RAW_14:
+		case CAM_FORMAT_MIPI_RAW_16:
+		case CAM_FORMAT_MIPI_RAW_20:
+		case CAM_FORMAT_PLAIN128:
+		case CAM_FORMAT_PLAIN32_20:
+		case CAM_FORMAT_YUV422:
+		case CAM_FORMAT_YUV422_10:
+			rsrc_data->width = CAM_VFE_RDI_BUS_DEFAULT_WIDTH;
+			rsrc_data->height = 0;
+			rsrc_data->stride = CAM_VFE_RDI_BUS_DEFAULT_STRIDE;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+			break;
+		case CAM_FORMAT_PLAIN8:
+			rsrc_data->en_cfg = 0x1;
+			rsrc_data->stride = rsrc_data->width * 2;
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+		case CAM_FORMAT_PLAIN16_14:
+		case CAM_FORMAT_PLAIN16_16:
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 2, 16) / 16;
+			rsrc_data->en_cfg = 0x1;
+			break;
+		case CAM_FORMAT_PLAIN64:
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width * 8, 16) / 16;
+			rsrc_data->en_cfg = 0x1;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Unsupported RDI format %d",
+				rsrc_data->format);
+			return -EINVAL;
+		}
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP) {
+
+		rsrc_data->stride = rsrc_data->width;
+		rsrc_data->en_cfg = 0x1;
+		/* LSB aligned */
+		rsrc_data->pack_fmt |= 0x10;
+
+	} else if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_FULL) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_FD) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP)) {
+
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_UBWC_NV12_4R:
+			rsrc_data->en_ubwc = 1;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_UBWC_NV12:
+			rsrc_data->en_ubwc = 1;
+			/* Fall through for NV12 */
+			fallthrough;
+		case CAM_FORMAT_NV21:
+		case CAM_FORMAT_NV12:
+		case CAM_FORMAT_Y_ONLY:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_UBWC_TP10:
+			rsrc_data->en_ubwc = 1;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_TP10:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_PLAIN16_10:
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d", plane);
+				return -EINVAL;
+			}
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d out_type:%d",
+				rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+		rsrc_data->en_cfg = 0x1;
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF) {
+
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+
+	} else if ((vfe_out_res_id >= CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE) &&
+		(vfe_out_res_id <= CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST)) {
+
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_2PD) {
+
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_LCR) {
+
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN16_16:
+			rsrc_data->stride = ALIGNUP(rsrc_data->width * 2, 8);
+			rsrc_data->en_cfg = 0x1;
+			/* LSB aligned */
+			rsrc_data->pack_fmt |= 0x10;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d out_type:%d",
+				rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_DS4) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_DS16) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP)) {
+
+		rsrc_data->height = rsrc_data->height / 2;
+		rsrc_data->width  = rsrc_data->width / 2;
+		rsrc_data->en_cfg = 0x1;
+
+	} else if ((vfe_out_res_id >= CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW) &&
+		(vfe_out_res_id <= CAM_VFE_BUS_VER3_VFE_OUT_2PD_STATS)) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN64:
+			rsrc_data->width = 0;
+			rsrc_data->height = 0;
+			rsrc_data->stride = 1;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d out_type:%d",
+				rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN32:
+			rsrc_data->width = 0;
+			rsrc_data->height = 0;
+			rsrc_data->stride = 1;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d out_type:%d",
+				rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE) ||
+		(vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST)) {
+		rsrc_data->width = 0;
+		rsrc_data->height = 0;
+		rsrc_data->stride = 1;
+		rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_STATS_BE) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_MIPI_RAW_8:
+		case CAM_FORMAT_MIPI_RAW_10:
+		case CAM_FORMAT_MIPI_RAW_12:
+		case CAM_FORMAT_PLAIN8:
+		case CAM_FORMAT_PLAIN16_8:
+		case CAM_FORMAT_PLAIN16_10:
+		case CAM_FORMAT_PLAIN16_12:
+			rsrc_data->width = 0;
+			rsrc_data->height = 0;
+			rsrc_data->stride = 1;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d out_type:%d",
+				rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else if (vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_GAMMA) {
+		switch (rsrc_data->format) {
+		case CAM_FORMAT_PLAIN64:
+			rsrc_data->width = 0;
+			rsrc_data->height = 0;
+			rsrc_data->stride = 1;
+			rsrc_data->en_cfg = (0x1 << 16) | 0x1;
+			break;
+		default:
+			CAM_ERR(CAM_ISP, "Invalid format %d out_type:%d",
+				rsrc_data->format, vfe_out_res_id);
+			return -EINVAL;
+		}
+
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid out_type:%d requested",
+			vfe_out_res_id);
+		return -EINVAL;
+	}
+
+	*comp_grp_id = rsrc_data->hw_regs->comp_group;
+
+	switch (rsrc_data->en_cfg) {
+	case 0x1:
+		strscpy(wm_mode, "line-based", sizeof(wm_mode));
+		break;
+	case ((0x1 << 16) | 0x1):
+		strscpy(wm_mode, "frame-based", sizeof(wm_mode));
+		break;
+	case ((0x2 << 16) | 0x1):
+		strscpy(wm_mode, "index-based", sizeof(wm_mode));
+		break;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d WM:%d processed width:%d height:%d format:0x%X en_ubwc:%d %s",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		rsrc_data->width, rsrc_data->height, rsrc_data->format,
+		rsrc_data->en_ubwc, wm_mode);
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_release_wm(void   *bus_priv,
+	struct cam_isp_resource_node     *wm_res)
+{
+	struct cam_vfe_bus_ver3_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+
+	rsrc_data->offset = 0;
+	rsrc_data->width = 0;
+	rsrc_data->height = 0;
+	rsrc_data->stride = 0;
+	rsrc_data->format = 0;
+	rsrc_data->pack_fmt = 0;
+	rsrc_data->burst_len = 0;
+	rsrc_data->irq_subsample_period = 0;
+	rsrc_data->irq_subsample_pattern = 0;
+	rsrc_data->framedrop_period = 0;
+	rsrc_data->framedrop_pattern = 0;
+	rsrc_data->packer_cfg = 0;
+	rsrc_data->en_ubwc = 0;
+	rsrc_data->h_init = 0;
+	rsrc_data->ubwc_meta_addr = 0;
+	rsrc_data->ubwc_meta_cfg = 0;
+	rsrc_data->ubwc_mode_cfg = 0;
+	rsrc_data->ubwc_stats_ctrl = 0;
+	rsrc_data->ubwc_ctrl_2 = 0;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+	rsrc_data->ubwc_updated = false;
+	rsrc_data->en_cfg = 0;
+	rsrc_data->is_dual = 0;
+
+	rsrc_data->ubwc_lossy_threshold_0 = 0;
+	rsrc_data->ubwc_lossy_threshold_1 = 0;
+	rsrc_data->ubwc_offset_lossy_variance = 0;
+	rsrc_data->ubwc_bandwidth_limit = 0;
+	wm_res->tasklet_info = NULL;
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	CAM_DBG(CAM_ISP, "VFE:%d Release WM:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_start_wm(struct cam_isp_resource_node *wm_res)
+{
+	const uint32_t enable_debug_status_1 = 11 << 8;
+	int val = 0;
+	struct cam_vfe_bus_ver3_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_vfe_bus_ver3_common_data        *common_data =
+		rsrc_data->common_data;
+	struct cam_vfe_bus_ver3_reg_offset_ubwc_client *ubwc_regs;
+	bool disable_ubwc_comp = rsrc_data->common_data->disable_ubwc_comp;
+
+	ubwc_regs = (struct cam_vfe_bus_ver3_reg_offset_ubwc_client *)
+		rsrc_data->hw_regs->ubwc_regs;
+
+	cam_io_w(0xf, common_data->mem_base + rsrc_data->hw_regs->burst_limit);
+
+	cam_io_w((rsrc_data->height << 16) | rsrc_data->width,
+		common_data->mem_base + rsrc_data->hw_regs->image_cfg_0);
+	cam_io_w(rsrc_data->pack_fmt,
+		common_data->mem_base + rsrc_data->hw_regs->packer_cfg);
+
+	/* enable ubwc if needed*/
+	if (rsrc_data->en_ubwc) {
+		if (!ubwc_regs) {
+			CAM_ERR(CAM_ISP,
+				"ubwc_regs is NULL, VFE:%d WM:%d en_ubwc:%d",
+				rsrc_data->common_data->core_index,
+				rsrc_data->index, rsrc_data->en_ubwc);
+			return -EINVAL;
+		}
+		val = cam_io_r_mb(common_data->mem_base + ubwc_regs->mode_cfg);
+		val |= 0x1;
+		if (disable_ubwc_comp) {
+			val &= ~ubwc_regs->ubwc_comp_en_bit;
+			CAM_DBG(CAM_ISP,
+				"Force disable UBWC compression, VFE:%d WM:%d ubwc_mode_cfg: 0x%x",
+				rsrc_data->common_data->core_index,
+				rsrc_data->index, val);
+		}
+		cam_io_w_mb(val, common_data->mem_base + ubwc_regs->mode_cfg);
+	}
+
+	/* Enable WM */
+	cam_io_w_mb(rsrc_data->en_cfg, common_data->mem_base +
+		rsrc_data->hw_regs->cfg);
+
+	/* Enable constraint error detection */
+	cam_io_w_mb(enable_debug_status_1,
+		common_data->mem_base +
+		rsrc_data->hw_regs->debug_status_cfg);
+
+	CAM_DBG(CAM_ISP,
+		"Start VFE:%d WM:%d offset:0x%X en_cfg:0x%X width:%d height:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index,
+		(uint32_t) rsrc_data->hw_regs->cfg, rsrc_data->en_cfg,
+		rsrc_data->width, rsrc_data->height);
+	CAM_DBG(CAM_ISP, "WM:%d pk_fmt:%d stride:%d burst len:%d",
+		rsrc_data->index, rsrc_data->pack_fmt & PACKER_FMT_VER3_MAX,
+		rsrc_data->stride, 0xF);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_stop_wm(struct cam_isp_resource_node *wm_res)
+{
+	struct cam_vfe_bus_ver3_wm_resource_data   *rsrc_data =
+		wm_res->res_priv;
+	struct cam_vfe_bus_ver3_common_data        *common_data =
+		rsrc_data->common_data;
+
+	/* Disable WM */
+	cam_io_w_mb(0x0, common_data->mem_base + rsrc_data->hw_regs->cfg);
+	CAM_DBG(CAM_ISP, "Stop VFE:%d WM:%d",
+		rsrc_data->common_data->core_index, rsrc_data->index);
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
+	rsrc_data->ubwc_updated = false;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_handle_wm_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_ver3_handle_wm_done_bottom_half(void *wm_node,
+	void *evt_payload_priv)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_ver3_init_wm_resource(uint32_t index,
+	struct cam_vfe_bus_ver3_priv    *ver3_bus_priv,
+	struct cam_vfe_bus_ver3_hw_info *ver3_hw_info,
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_vfe_bus_ver3_wm_resource_data *rsrc_data;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver3_wm_resource_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for WM res priv");
+		return -ENOMEM;
+	}
+	wm_res->res_priv = rsrc_data;
+
+	rsrc_data->index = index;
+	rsrc_data->hw_regs = &ver3_hw_info->bus_client_reg[index];
+	rsrc_data->common_data = &ver3_bus_priv->common_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = cam_vfe_bus_ver3_start_wm;
+	wm_res->stop = cam_vfe_bus_ver3_stop_wm;
+	wm_res->top_half_handler = cam_vfe_bus_ver3_handle_wm_done_top_half;
+	wm_res->bottom_half_handler =
+		cam_vfe_bus_ver3_handle_wm_done_bottom_half;
+	wm_res->hw_intf = ver3_bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_deinit_wm_resource(
+	struct cam_isp_resource_node    *wm_res)
+{
+	struct cam_vfe_bus_ver3_wm_resource_data *rsrc_data;
+
+	wm_res->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&wm_res->list);
+
+	wm_res->start = NULL;
+	wm_res->stop = NULL;
+	wm_res->top_half_handler = NULL;
+	wm_res->bottom_half_handler = NULL;
+	wm_res->hw_intf = NULL;
+
+	rsrc_data = wm_res->res_priv;
+	wm_res->res_priv = NULL;
+	if (!rsrc_data)
+		return -ENOMEM;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static bool cam_vfe_bus_ver3_match_comp_grp(
+	struct cam_vfe_bus_ver3_priv           *ver3_bus_priv,
+	struct cam_isp_resource_node          **comp_grp,
+	uint32_t                                comp_grp_id)
+{
+	struct cam_vfe_bus_ver3_comp_grp_data  *rsrc_data = NULL;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+
+	list_for_each_entry(comp_grp_local,
+		&ver3_bus_priv->used_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_type == comp_grp_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			return true;
+		}
+	}
+
+	list_for_each_entry(comp_grp_local,
+		&ver3_bus_priv->free_comp_grp, list) {
+		rsrc_data = comp_grp_local->res_priv;
+		if (rsrc_data->comp_grp_type == comp_grp_id) {
+			/* Match found */
+			*comp_grp = comp_grp_local;
+			list_del(&comp_grp_local->list);
+			list_add_tail(&comp_grp_local->list,
+			&ver3_bus_priv->used_comp_grp);
+			return false;
+		}
+	}
+
+	*comp_grp = NULL;
+	return false;
+}
+
+static int cam_vfe_bus_ver3_acquire_comp_grp(
+	struct cam_vfe_bus_ver3_priv         *ver3_bus_priv,
+	void                                *tasklet,
+	uint32_t                             is_dual,
+	uint32_t                             is_master,
+	struct cam_isp_resource_node       **comp_grp,
+	struct cam_vfe_bus_ver3_comp_grp_acquire_args *comp_acq_args)
+{
+	int rc = 0;
+	struct cam_isp_resource_node           *comp_grp_local = NULL;
+	struct cam_vfe_bus_ver3_comp_grp_data  *rsrc_data = NULL;
+	bool previously_acquired = false;
+
+	/* Check if matching comp_grp has already been acquired */
+	previously_acquired = cam_vfe_bus_ver3_match_comp_grp(
+		ver3_bus_priv, &comp_grp_local, comp_acq_args->comp_grp_id);
+
+	if (!comp_grp_local) {
+		CAM_ERR(CAM_ISP, "Invalid comp_grp:%d",
+			comp_acq_args->comp_grp_id);
+		return -ENODEV;
+	}
+
+	rsrc_data = comp_grp_local->res_priv;
+
+	if (!previously_acquired) {
+		rsrc_data->intra_client_mask = 0x1;
+		comp_grp_local->tasklet_info = tasklet;
+		comp_grp_local->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+		rsrc_data->is_master = is_master;
+		rsrc_data->is_dual = is_dual;
+
+		if (is_master)
+			rsrc_data->addr_sync_mode = 0;
+		else
+			rsrc_data->addr_sync_mode = 1;
+
+	} else {
+		rsrc_data = comp_grp_local->res_priv;
+		/* Do not support runtime change in composite mask */
+		if (comp_grp_local->res_state ==
+			CAM_ISP_RESOURCE_STATE_STREAMING) {
+			CAM_ERR(CAM_ISP, "Invalid State %d comp_grp:%u",
+				comp_grp_local->res_state,
+				rsrc_data->comp_grp_type);
+			return -EBUSY;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Acquire VFE:%d comp_grp:%u",
+		rsrc_data->common_data->core_index, rsrc_data->comp_grp_type);
+
+	rsrc_data->acquire_dev_cnt++;
+	rsrc_data->composite_mask |= comp_acq_args->composite_mask;
+	*comp_grp = comp_grp_local;
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_release_comp_grp(
+	struct cam_vfe_bus_ver3_priv         *ver3_bus_priv,
+	struct cam_isp_resource_node         *in_comp_grp)
+{
+	struct cam_isp_resource_node           *comp_grp = NULL;
+	struct cam_vfe_bus_ver3_comp_grp_data  *in_rsrc_data = NULL;
+	int match_found = 0;
+
+	if (!in_comp_grp) {
+		CAM_ERR(CAM_ISP, "Invalid Params comp_grp %pK", in_comp_grp);
+		return -EINVAL;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP, "Already released comp_grp");
+		return 0;
+	}
+
+	if (in_comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING) {
+		CAM_ERR(CAM_ISP, "Invalid State %d",
+			in_comp_grp->res_state);
+		return -EBUSY;
+	}
+
+	in_rsrc_data = in_comp_grp->res_priv;
+	CAM_DBG(CAM_ISP, "Release VFE:%d comp_grp:%u",
+		ver3_bus_priv->common_data.core_index,
+		in_rsrc_data->comp_grp_type);
+
+	list_for_each_entry(comp_grp, &ver3_bus_priv->used_comp_grp, list) {
+		if (comp_grp == in_comp_grp) {
+			match_found = 1;
+			break;
+		}
+	}
+
+	if (!match_found) {
+		CAM_ERR(CAM_ISP, "Could not find comp_grp:%u",
+			in_rsrc_data->comp_grp_type);
+		return -ENODEV;
+	}
+
+	in_rsrc_data->acquire_dev_cnt--;
+	if (in_rsrc_data->acquire_dev_cnt == 0) {
+		list_del(&comp_grp->list);
+
+		in_rsrc_data->dual_slave_core = CAM_VFE_BUS_VER3_VFE_CORE_MAX;
+		in_rsrc_data->addr_sync_mode = 0;
+		in_rsrc_data->composite_mask = 0;
+
+		comp_grp->tasklet_info = NULL;
+		comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+		list_add_tail(&comp_grp->list, &ver3_bus_priv->free_comp_grp);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_start_comp_grp(
+	struct cam_isp_resource_node *comp_grp, uint32_t *bus_irq_reg_mask)
+{
+	int rc = 0;
+	uint32_t val;
+	struct cam_vfe_bus_ver3_comp_grp_data *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_common_data *common_data = NULL;
+
+	rsrc_data = comp_grp->res_priv;
+	common_data = rsrc_data->common_data;
+
+	CAM_DBG(CAM_ISP,
+		"Start VFE:%d comp_grp:%d streaming state:%d comp_mask:0x%X",
+		rsrc_data->common_data->core_index,
+		rsrc_data->comp_grp_type, comp_grp->res_state,
+		rsrc_data->composite_mask);
+
+	if (comp_grp->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		return 0;
+
+	if (!common_data->comp_config_needed)
+		goto skip_comp_cfg;
+
+	if (rsrc_data->is_dual) {
+		if (rsrc_data->is_master) {
+			val = cam_io_r_mb(common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val |= (0x1 << (rsrc_data->comp_grp_type + 14));
+
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val = cam_io_r_mb(common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+
+			val |= (0x1 << rsrc_data->comp_grp_type);
+
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+		} else {
+			val = cam_io_r_mb(common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val |= (0x1 << rsrc_data->comp_grp_type);
+			val |= (0x1 << (rsrc_data->comp_grp_type + 14));
+
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_0);
+
+			val = cam_io_r_mb(common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+
+			val |= (0x1 << rsrc_data->comp_grp_type);
+
+			cam_io_w_mb(val, common_data->mem_base +
+				common_data->common_reg->comp_cfg_1);
+		}
+	}
+
+skip_comp_cfg:
+
+	if (rsrc_data->ubwc_static_ctrl) {
+		val = cam_io_r_mb(common_data->mem_base +
+			common_data->common_reg->ubwc_static_ctrl);
+		val |= rsrc_data->ubwc_static_ctrl;
+		cam_io_w_mb(val, common_data->mem_base +
+			common_data->common_reg->ubwc_static_ctrl);
+	}
+
+	bus_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0] =
+		(0x1 << (rsrc_data->comp_grp_type +
+		rsrc_data->common_data->comp_done_shift));
+
+	CAM_DBG(CAM_ISP, "Start Done VFE:%d comp_grp:%d bus_irq_mask_0: 0x%X",
+		rsrc_data->common_data->core_index,
+		rsrc_data->comp_grp_type,
+		bus_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0]);
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_stop_comp_grp(
+	struct cam_isp_resource_node          *comp_grp)
+{
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_handle_comp_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_bus_ver3_handle_comp_done_bottom_half(
+	void                *handler_priv,
+	void                *evt_payload_priv,
+	uint32_t            *comp_mask)
+{
+	int rc = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node          *comp_grp = handler_priv;
+	struct cam_vfe_bus_irq_evt_payload    *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver3_comp_grp_data *rsrc_data = comp_grp->res_priv;
+	uint32_t                              *cam_ife_irq_regs;
+	uint32_t                               status_0;
+
+	if (!evt_payload)
+		return rc;
+
+	if (rsrc_data->is_dual && (!rsrc_data->is_master)) {
+		CAM_ERR(CAM_ISP, "Invalid comp_grp:%u is_master:%u",
+			rsrc_data->comp_grp_type, rsrc_data->is_master);
+		return rc;
+	}
+
+	cam_ife_irq_regs = evt_payload->irq_reg_val;
+	status_0 = cam_ife_irq_regs[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+
+	if (status_0 & BIT(rsrc_data->comp_grp_type +
+		rsrc_data->common_data->comp_done_shift)) {
+		evt_payload->evt_id = CAM_ISP_HW_EVENT_DONE;
+		rc = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d comp_grp:%d Bus IRQ status_0: 0x%X rc:%d",
+		rsrc_data->common_data->core_index, rsrc_data->comp_grp_type,
+		status_0, rc);
+
+	*comp_mask = rsrc_data->composite_mask;
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_init_comp_grp(uint32_t index,
+	struct cam_hw_soc_info          *soc_info,
+	struct cam_vfe_bus_ver3_priv    *ver3_bus_priv,
+	struct cam_vfe_bus_ver3_hw_info *ver3_hw_info,
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_vfe_bus_ver3_comp_grp_data *rsrc_data = NULL;
+	struct cam_vfe_soc_private *vfe_soc_private = soc_info->soc_private;
+	int ddr_type = 0;
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver3_comp_grp_data),
+		GFP_KERNEL);
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	comp_grp->res_priv = rsrc_data;
+
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&comp_grp->list);
+
+	rsrc_data->comp_grp_type   = index;
+	rsrc_data->common_data     = &ver3_bus_priv->common_data;
+	rsrc_data->dual_slave_core = CAM_VFE_BUS_VER3_VFE_CORE_MAX;
+
+	if (rsrc_data->comp_grp_type != CAM_VFE_BUS_VER3_COMP_GRP_0 &&
+		rsrc_data->comp_grp_type != CAM_VFE_BUS_VER3_COMP_GRP_1)
+		rsrc_data->ubwc_static_ctrl = 0;
+	else {
+		ddr_type = cam_get_ddr_type();
+		if ((ddr_type == DDR_TYPE_LPDDR5) ||
+			(ddr_type == DDR_TYPE_LPDDR5X))
+			rsrc_data->ubwc_static_ctrl =
+				vfe_soc_private->ubwc_static_ctrl[1];
+		else
+			rsrc_data->ubwc_static_ctrl =
+				vfe_soc_private->ubwc_static_ctrl[0];
+	}
+
+	list_add_tail(&comp_grp->list, &ver3_bus_priv->free_comp_grp);
+
+	comp_grp->top_half_handler = cam_vfe_bus_ver3_handle_comp_done_top_half;
+	comp_grp->hw_intf = ver3_bus_priv->common_data.hw_intf;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_deinit_comp_grp(
+	struct cam_isp_resource_node    *comp_grp)
+{
+	struct cam_vfe_bus_ver3_comp_grp_data *rsrc_data =
+		comp_grp->res_priv;
+
+	comp_grp->start = NULL;
+	comp_grp->stop = NULL;
+	comp_grp->top_half_handler = NULL;
+	comp_grp->bottom_half_handler = NULL;
+	comp_grp->hw_intf = NULL;
+
+	list_del_init(&comp_grp->list);
+	comp_grp->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+
+	comp_grp->res_priv = NULL;
+
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "comp_grp_priv is NULL");
+		return -ENODEV;
+	}
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_get_secure_mode(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update      *secure_mode = cmd_args;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data;
+	uint32_t                              *mode;
+
+	rsrc_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		secure_mode->res->res_priv;
+	mode = (uint32_t *)secure_mode->data;
+	*mode = (rsrc_data->secure_mode == CAM_SECURE_MODE_SECURE) ?
+		true : false;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_acquire_vfe_out(void *bus_priv, void *acquire_args,
+	uint32_t args_size)
+{
+	int                                     rc = -ENODEV;
+	int                                     i;
+	enum cam_vfe_bus_ver3_vfe_out_type      vfe_out_res_id;
+	uint32_t                                format;
+	struct cam_vfe_bus_ver3_priv           *ver3_bus_priv = bus_priv;
+	struct cam_vfe_acquire_args            *acq_args = acquire_args;
+	struct cam_vfe_hw_vfe_out_acquire_args *out_acquire_args;
+	struct cam_isp_resource_node           *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data   *rsrc_data = NULL;
+	uint32_t                                secure_caps = 0, mode;
+	struct cam_vfe_bus_ver3_comp_grp_acquire_args comp_acq_args = {0};
+	uint32_t       outmap_index = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+
+	if (!bus_priv || !acquire_args) {
+		CAM_ERR(CAM_ISP, "Invalid Param");
+		return -EINVAL;
+	}
+
+	out_acquire_args = &acq_args->vfe_out;
+	format = out_acquire_args->out_port_info->format;
+
+	CAM_DBG(CAM_ISP, "VFE:%d Acquire out_type:0x%X",
+		ver3_bus_priv->common_data.core_index,
+		out_acquire_args->out_port_info->res_type);
+
+	vfe_out_res_id = cam_vfe_bus_ver3_get_out_res_id_and_index(
+				ver3_bus_priv,
+				out_acquire_args->out_port_info->res_type,
+				&outmap_index);
+	if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_MAX) ||
+		(outmap_index >= ver3_bus_priv->num_out)) {
+		CAM_WARN(CAM_ISP,
+			"target does not support req res id :0x%x outtype:%d index:%d",
+			out_acquire_args->out_port_info->res_type,
+			vfe_out_res_id, outmap_index);
+		return -ENODEV;
+	}
+
+	rsrc_node = &ver3_bus_priv->vfe_out[outmap_index];
+	if (rsrc_node->res_state != CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d out_type:0x%X resource not available state:%d",
+			ver3_bus_priv->common_data.core_index,
+			vfe_out_res_id, rsrc_node->res_state);
+		return -EBUSY;
+	}
+
+	rsrc_data = rsrc_node->res_priv;
+	rsrc_data->common_data->event_cb = acq_args->event_cb;
+	rsrc_data->common_data->disable_ubwc_comp =
+		out_acquire_args->disable_ubwc_comp;
+	rsrc_data->priv = acq_args->priv;
+	rsrc_data->bus_priv = ver3_bus_priv;
+	comp_acq_args.composite_mask = (1 << vfe_out_res_id);
+
+	/* for some hw versions, buf done is not received from vfe but
+	 * from IP external to VFE. In such case, we get the controller
+	 * from hw manager and assign it here
+	 */
+	if (!(ver3_bus_priv->common_data.supported_irq &
+			CAM_VFE_HW_IRQ_CAP_BUF_DONE))
+		rsrc_data->common_data->buf_done_controller =
+			acq_args->buf_done_controller;
+
+	secure_caps = cam_vfe_bus_ver3_can_be_secure(
+		rsrc_data->out_type);
+	mode = out_acquire_args->out_port_info->secure_mode;
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (!rsrc_data->common_data->num_sec_out) {
+			rsrc_data->secure_mode = mode;
+			rsrc_data->common_data->secure_mode = mode;
+		} else {
+			if (mode == rsrc_data->common_data->secure_mode) {
+				rsrc_data->secure_mode =
+					rsrc_data->common_data->secure_mode;
+			} else {
+				rc = -EINVAL;
+				CAM_ERR_RATE_LIMIT(CAM_ISP,
+					"Mismatch: Acquire mode[%d], drvr mode[%d]",
+					rsrc_data->common_data->secure_mode,
+					mode);
+				mutex_unlock(
+					&rsrc_data->common_data->bus_mutex);
+				return -EINVAL;
+			}
+		}
+		rsrc_data->common_data->num_sec_out++;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	ver3_bus_priv->tasklet_info = acq_args->tasklet;
+	rsrc_node->rdi_only_ctx = 0;
+	rsrc_node->res_id = out_acquire_args->out_port_info->res_type;
+	rsrc_node->tasklet_info = acq_args->tasklet;
+	rsrc_node->cdm_ops = out_acquire_args->cdm_ops;
+	rsrc_data->cdm_util_ops = out_acquire_args->cdm_ops;
+	rsrc_data->format = out_acquire_args->out_port_info->format;
+
+	if ((rsrc_data->out_type == CAM_VFE_BUS_VER3_VFE_OUT_FD) &&
+		(rsrc_data->format == CAM_FORMAT_Y_ONLY))
+		rsrc_data->num_wm = 1;
+
+	/* Acquire WM and retrieve COMP GRP ID */
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_vfe_bus_ver3_acquire_wm(ver3_bus_priv,
+			out_acquire_args->out_port_info,
+			acq_args->tasklet,
+			vfe_out_res_id,
+			i,
+			&rsrc_data->wm_res[i],
+			out_acquire_args->is_dual,
+			&comp_acq_args.comp_grp_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed to acquire WM VFE:%d out_type:%d rc:%d",
+				rsrc_data->common_data->core_index,
+				vfe_out_res_id, rc);
+			goto release_wm;
+		}
+	}
+
+
+	/* Acquire composite group using COMP GRP ID */
+	rc = cam_vfe_bus_ver3_acquire_comp_grp(ver3_bus_priv,
+		acq_args->tasklet,
+		out_acquire_args->is_dual,
+		out_acquire_args->is_master,
+		&rsrc_data->comp_grp,
+		&comp_acq_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP,
+			"Failed to acquire comp_grp VFE:%d out_typp:%d rc:%d",
+			rsrc_data->common_data->core_index,
+			vfe_out_res_id, rc);
+		return rc;
+	}
+
+	rsrc_data->is_dual = out_acquire_args->is_dual;
+	rsrc_data->is_master = out_acquire_args->is_master;
+
+	rsrc_node->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	out_acquire_args->rsrc_node = rsrc_node;
+
+	CAM_DBG(CAM_ISP, "Acquire successful");
+	return rc;
+
+release_wm:
+	for (i--; i >= 0; i--)
+		cam_vfe_bus_ver3_release_wm(ver3_bus_priv,
+			&rsrc_data->wm_res[i]);
+
+	cam_vfe_bus_ver3_release_comp_grp(ver3_bus_priv, rsrc_data->comp_grp);
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_release_vfe_out(void *bus_priv, void *release_args,
+	uint32_t args_size)
+{
+	uint32_t i;
+	struct cam_isp_resource_node          *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data = NULL;
+	uint32_t                               secure_caps = 0;
+
+	if (!bus_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Invalid input bus_priv %pK release_args %pK",
+			bus_priv, release_args);
+		return -EINVAL;
+	}
+
+	vfe_out = release_args;
+	rsrc_data = vfe_out->res_priv;
+
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP,
+			"Invalid resource state:%d VFE:%d out_type:0x%X",
+			vfe_out->res_state, rsrc_data->common_data->core_index,
+			vfe_out->res_id);
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		cam_vfe_bus_ver3_release_wm(bus_priv, &rsrc_data->wm_res[i]);
+
+	if ((rsrc_data->out_type == CAM_VFE_BUS_VER3_VFE_OUT_FD) &&
+		(rsrc_data->format == CAM_FORMAT_Y_ONLY))
+		rsrc_data->num_wm = 2;
+
+	if (rsrc_data->comp_grp)
+		cam_vfe_bus_ver3_release_comp_grp(bus_priv,
+			rsrc_data->comp_grp);
+	rsrc_data->comp_grp = NULL;
+
+	vfe_out->tasklet_info = NULL;
+	vfe_out->cdm_ops = NULL;
+	rsrc_data->cdm_util_ops = NULL;
+
+	secure_caps = cam_vfe_bus_ver3_can_be_secure(rsrc_data->out_type);
+	mutex_lock(&rsrc_data->common_data->bus_mutex);
+	if (secure_caps) {
+		if (rsrc_data->secure_mode ==
+			rsrc_data->common_data->secure_mode) {
+			rsrc_data->common_data->num_sec_out--;
+			rsrc_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+		} else {
+			/*
+			 * The validity of the mode is properly
+			 * checked while acquiring the output port.
+			 * not expected to reach here, unless there is
+			 * some corruption.
+			 */
+			CAM_ERR(CAM_ISP, "driver[%d],resource[%d] mismatch",
+				rsrc_data->common_data->secure_mode,
+				rsrc_data->secure_mode);
+		}
+
+		if (!rsrc_data->common_data->num_sec_out)
+			rsrc_data->common_data->secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+	}
+	mutex_unlock(&rsrc_data->common_data->bus_mutex);
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED)
+		vfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_start_vfe_out(
+	struct cam_isp_resource_node          *vfe_out)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_common_data   *common_data = NULL;
+	uint32_t bus_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_MAX];
+	uint32_t rup_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_MAX];
+	uint32_t source_group = 0;
+
+	if (!vfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+	source_group = rsrc_data->source_group;
+
+	CAM_DBG(CAM_ISP, "Start VFE:%d out_type:0x%X",
+		rsrc_data->common_data->core_index, rsrc_data->out_type);
+
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP,
+			"Invalid resource state:%d VFE:%d out_type:0x%X",
+			vfe_out->res_state, rsrc_data->common_data->core_index,
+			rsrc_data->out_type);
+		return -EACCES;
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_vfe_bus_ver3_start_wm(&rsrc_data->wm_res[i]);
+
+	memset(bus_irq_reg_mask, 0, sizeof(bus_irq_reg_mask));
+	rc = cam_vfe_bus_ver3_start_comp_grp(rsrc_data->comp_grp,
+		bus_irq_reg_mask);
+
+	if (rsrc_data->is_dual && !rsrc_data->is_master)
+		goto end;
+
+	vfe_out->irq_handle = cam_irq_controller_subscribe_irq(
+		common_data->buf_done_controller,
+		CAM_IRQ_PRIORITY_1,
+		bus_irq_reg_mask,
+		vfe_out,
+		vfe_out->top_half_handler,
+		vfe_out->bottom_half_handler,
+		vfe_out->tasklet_info,
+		&tasklet_bh_api);
+
+	if (vfe_out->irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Subscribe IRQ failed for VFE out_res %d",
+			vfe_out->res_id);
+		vfe_out->irq_handle = 0;
+		return -EFAULT;
+	}
+
+	if ((common_data->is_lite || source_group > CAM_VFE_BUS_VER3_SRC_GRP_0)
+		&& !vfe_out->rdi_only_ctx)
+		goto end;
+
+	if ((common_data->supported_irq & CAM_VFE_HW_IRQ_CAP_RUP) &&
+		(!common_data->rup_irq_handle[source_group])) {
+		memset(rup_irq_reg_mask, 0, sizeof(rup_irq_reg_mask));
+		rup_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0] |=
+			0x1 << source_group;
+
+		CAM_DBG(CAM_ISP,
+			"VFE:%d out_type:0x%X bus_irq_mask_0:0x%X for RUP",
+			rsrc_data->common_data->core_index, rsrc_data->out_type,
+			rup_irq_reg_mask[CAM_VFE_BUS_VER3_IRQ_REG0]);
+
+		common_data->rup_irq_handle[source_group] =
+			cam_irq_controller_subscribe_irq(
+				common_data->rup_irq_controller,
+				CAM_IRQ_PRIORITY_0,
+				rup_irq_reg_mask,
+				vfe_out,
+				cam_vfe_bus_ver3_handle_rup_top_half,
+				cam_vfe_bus_ver3_handle_rup_bottom_half,
+				vfe_out->tasklet_info,
+				&tasklet_bh_api);
+
+		if (common_data->rup_irq_handle[source_group] < 1) {
+			CAM_ERR(CAM_ISP, "Failed to subscribe RUP IRQ");
+			common_data->rup_irq_handle[source_group] = 0;
+			return -EFAULT;
+		}
+	}
+
+end:
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_stop_vfe_out(
+	struct cam_isp_resource_node          *vfe_out)
+{
+	int rc = 0, i;
+	struct cam_vfe_bus_ver3_vfe_out_data  *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_common_data   *common_data = NULL;
+
+	if (!vfe_out) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	common_data = rsrc_data->common_data;
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE ||
+		vfe_out->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_DBG(CAM_ISP, "Stop VFE:%d out_type:0x%X state:%d",
+			rsrc_data->common_data->core_index, rsrc_data->out_type,
+			vfe_out->res_state);
+		return rc;
+	}
+
+	rc = cam_vfe_bus_ver3_stop_comp_grp(rsrc_data->comp_grp);
+
+	for (i = 0; i < rsrc_data->num_wm; i++)
+		rc = cam_vfe_bus_ver3_stop_wm(&rsrc_data->wm_res[i]);
+
+	if (common_data->rup_irq_handle[rsrc_data->source_group]) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			common_data->rup_irq_controller,
+			common_data->rup_irq_handle[rsrc_data->source_group]);
+		common_data->rup_irq_handle[rsrc_data->source_group] = 0;
+	}
+
+	if (vfe_out->irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			common_data->bus_irq_controller,
+			vfe_out->irq_handle);
+		vfe_out->irq_handle = 0;
+	}
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_handle_vfe_out_done_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                 rc;
+	int                                     i;
+	struct cam_isp_resource_node           *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data   *rsrc_data = NULL;
+	struct cam_vfe_bus_irq_evt_payload     *evt_payload;
+	struct cam_vfe_bus_ver3_comp_grp_data  *resource_data;
+	uint32_t                                status_0;
+	struct cam_vfe_bus_ver3_priv           *bus_priv;
+	void __iomem                           *camnoc_mem_base = NULL;
+	uint32_t                                val0 = 0, val1 = 0, val2 = 0;
+	uint32_t                                comp_mask = 0;
+
+	vfe_out = th_payload->handler_priv;
+	if (!vfe_out) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No resource");
+		return -ENODEV;
+	}
+
+	rsrc_data = vfe_out->res_priv;
+	resource_data = rsrc_data->comp_grp->res_priv;
+
+	bus_priv = rsrc_data->bus_priv;
+	camnoc_mem_base = bus_priv->common_data.camnoc_mem_base;
+
+	CAM_DBG(CAM_ISP, "VFE:%d Bus IRQ status_0: 0x%X status_1: 0x%X",
+		rsrc_data->common_data->core_index,
+		th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1]);
+	rc  = cam_vfe_bus_ver3_get_evt_payload(rsrc_data->common_data,
+		&evt_payload);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"VFE:%d Bus IRQ status_0: 0x%X status_1: 0x%X",
+			rsrc_data->common_data->core_index,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	evt_payload->core_index = rsrc_data->common_data->core_index;
+	evt_payload->evt_id = evt_id;
+	evt_payload->evt_param = 0;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	if (bus_priv->common_data.cpas_version == CAM_CPAS_TITAN_570_V200) {
+		rc = cam_vfe_bus_ver3_handle_comp_done_bottom_half(
+			rsrc_data->comp_grp, evt_payload, &comp_mask);
+
+		if ((comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_RDI0)) ||
+			(comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_RDI1)) ||
+			(comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_RDI2)) ||
+			(comp_mask & (1 << CAM_VFE_BUS_VER3_VFE_OUT_RDI3))) {
+
+			/* Read Fill Level */
+			val0 = cam_io_r_mb(camnoc_mem_base + 0xA20);
+			val1 = cam_io_r_mb(camnoc_mem_base + 0x1420);
+			val2 = cam_io_r_mb(camnoc_mem_base + 0x1A20);
+			CAM_DBG(CAM_ISP,
+				"comp_mask %d: CAMNOC REG[Queued Pending] ife_niu_1[%d %d] ife_niu_3[%d %d] ife_niu_0[%d %d]",
+				comp_mask,
+				(val0 & 0x7FF), (val0 & 0x7F0000) >> 16,
+				(val1 & 0x7FF), (val1 & 0x7F0000) >> 16,
+				(val2 & 0x7FF), (val2 & 0x7F0000) >> 16);
+
+			if ((val1 & 0x7FF) > 205) {
+				CAM_ERR(CAM_ISP, "VFE:%d, Potential Error!!!",
+					rsrc_data->common_data->core_index);
+				CAM_INFO(CAM_ISP,
+				"comp_mask %d: CAMNOC REG[Queued Pending] ife_niu_1[%d %d] ife_niu_3[%d %d] ife_niu_0[%d %d]",
+				comp_mask,
+				(val0 & 0x7FF), (val0 & 0x7F0000) >> 16,
+				(val1 & 0x7FF), (val1 & 0x7F0000) >> 16,
+				(val2 & 0x7FF), (val2 & 0x7F0000) >> 16);
+
+				evt_payload->evt_param = 1;
+			}
+
+		}
+	}
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	status_0 = th_payload->evt_status_arr[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+
+	if (status_0 & BIT(resource_data->comp_grp_type +
+		rsrc_data->common_data->comp_done_shift)) {
+		trace_cam_log_event("bufdone", "bufdone_IRQ",
+			status_0, resource_data->comp_grp_type);
+	}
+
+	if (status_0 & 0x1)
+		trace_cam_log_event("UnexpectedRUP", "RUP_IRQ", status_0, 40);
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static uint32_t cam_vfe_bus_ver3_get_last_consumed_addr(
+	struct cam_vfe_bus_ver3_priv *bus_priv,
+	uint32_t res_type)
+{
+	uint32_t                                  val = 0;
+	struct cam_isp_resource_node             *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data     *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_rsrc_data = NULL;
+	enum cam_vfe_bus_ver3_vfe_out_type        res_id;
+	uint32_t           outmap_index = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+
+	res_id = cam_vfe_bus_ver3_get_out_res_id_and_index(bus_priv,
+		res_type, &outmap_index);
+
+	if ((res_id >= CAM_VFE_BUS_VER3_VFE_OUT_MAX) ||
+		(outmap_index >= bus_priv->num_out)) {
+		CAM_WARN(CAM_ISP,
+			"target does not support req res id :0x%x outtype:%d index:%d",
+			res_type, res_id, outmap_index);
+		return 0;
+	}
+
+	rsrc_node = &bus_priv->vfe_out[outmap_index];
+	rsrc_data = rsrc_node->res_priv;
+	wm_rsrc_data = rsrc_data->wm_res[PLANE_Y].res_priv;
+
+	val = cam_io_r_mb(
+		wm_rsrc_data->common_data->mem_base +
+		wm_rsrc_data->hw_regs->addr_status_0);
+
+	return val;
+}
+
+static int cam_vfe_bus_ver3_handle_vfe_out_done_bottom_half(
+	void                *handler_priv,
+	void                *evt_payload_priv)
+{
+	int                                   rc = -EINVAL, num_out = 0, i = 0;
+	struct cam_isp_resource_node         *vfe_out = handler_priv;
+	struct cam_vfe_bus_ver3_vfe_out_data *rsrc_data = vfe_out->res_priv;
+	struct cam_vfe_bus_irq_evt_payload   *evt_payload = evt_payload_priv;
+	struct cam_isp_hw_event_info          evt_info;
+	void                                 *ctx = NULL;
+	uint32_t                              evt_id = 0, comp_mask = 0;
+	uint32_t                              out_list[CAM_VFE_BUS_VER3_VFE_OUT_MAX];
+
+	rc = cam_vfe_bus_ver3_handle_comp_done_bottom_half(
+		rsrc_data->comp_grp, evt_payload_priv, &comp_mask);
+	CAM_DBG(CAM_ISP, "VFE:%d out_type:0x%X rc:%d",
+		rsrc_data->common_data->core_index, rsrc_data->out_type,
+		rsrc_data->out_type, rc);
+
+	ctx = rsrc_data->priv;
+	memset(out_list, 0, sizeof(out_list));
+
+	switch (rc) {
+	case CAM_VFE_IRQ_STATUS_SUCCESS:
+		evt_id = evt_payload->evt_id;
+
+		evt_info.res_type = vfe_out->res_type;
+		evt_info.hw_idx   = vfe_out->hw_intf->hw_idx;
+		evt_info.evt_param = evt_payload->evt_param;
+
+		rc = cam_vfe_bus_ver3_get_comp_vfe_out_res_id_list(
+			comp_mask, out_list, &num_out);
+		for (i = 0; i < num_out; i++) {
+			evt_info.res_id = out_list[i];
+			evt_info.reg_val =
+				cam_vfe_bus_ver3_get_last_consumed_addr(
+				rsrc_data->bus_priv,
+				evt_info.res_id);
+			if (rsrc_data->common_data->event_cb)
+				rsrc_data->common_data->event_cb(ctx, evt_id,
+					(void *)&evt_info);
+		}
+		break;
+	default:
+		break;
+	}
+
+	cam_vfe_bus_ver3_put_evt_payload(rsrc_data->common_data, &evt_payload);
+
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_init_vfe_out_resource(uint32_t  index,
+	struct cam_vfe_bus_ver3_priv                  *ver3_bus_priv,
+	struct cam_vfe_bus_ver3_hw_info               *ver3_hw_info)
+{
+	struct cam_isp_resource_node         *vfe_out = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data *rsrc_data = NULL;
+	int rc = 0, i = 0;
+	int32_t vfe_out_type =
+		ver3_hw_info->vfe_out_hw_info[index].vfe_out_type;
+
+	if (vfe_out_type < 0 ||
+		vfe_out_type >= CAM_VFE_BUS_VER3_VFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "Init VFE Out failed, Invalid type=%d",
+			vfe_out_type);
+		return -EINVAL;
+	}
+
+	ver3_bus_priv->vfe_out_map_outtype[vfe_out_type] = index;
+	vfe_out = &ver3_bus_priv->vfe_out[index];
+	if (vfe_out->res_state != CAM_ISP_RESOURCE_STATE_UNAVAILABLE ||
+		vfe_out->res_priv) {
+		CAM_ERR(CAM_ISP, "vfe_out_type %d has already been initialized",
+			vfe_out_type);
+		return -EFAULT;
+	}
+
+	rsrc_data = kzalloc(sizeof(struct cam_vfe_bus_ver3_vfe_out_data),
+		GFP_KERNEL);
+	if (!rsrc_data) {
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	vfe_out->res_priv = rsrc_data;
+
+	vfe_out->res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+	INIT_LIST_HEAD(&vfe_out->list);
+
+	rsrc_data->source_group =
+		ver3_hw_info->vfe_out_hw_info[index].source_group;
+	rsrc_data->out_type     =
+		ver3_hw_info->vfe_out_hw_info[index].vfe_out_type;
+	rsrc_data->common_data  = &ver3_bus_priv->common_data;
+	rsrc_data->max_width    =
+		ver3_hw_info->vfe_out_hw_info[index].max_width;
+	rsrc_data->max_height   =
+		ver3_hw_info->vfe_out_hw_info[index].max_height;
+	rsrc_data->secure_mode  = CAM_SECURE_MODE_NON_SECURE;
+	rsrc_data->num_wm       = ver3_hw_info->vfe_out_hw_info[index].num_wm;
+
+	rsrc_data->wm_res = kzalloc((sizeof(struct cam_isp_resource_node) *
+		rsrc_data->num_wm), GFP_KERNEL);
+	if (!rsrc_data->wm_res) {
+		CAM_ERR(CAM_ISP, "Failed to alloc for wm_res");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_vfe_bus_ver3_init_wm_resource(
+			ver3_hw_info->vfe_out_hw_info[index].wm_idx[i],
+			ver3_bus_priv, ver3_hw_info,
+			&rsrc_data->wm_res[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "VFE:%d init WM:%d failed rc:%d",
+				ver3_bus_priv->common_data.core_index, i, rc);
+			return rc;
+		}
+	}
+
+	vfe_out->start = cam_vfe_bus_ver3_start_vfe_out;
+	vfe_out->stop = cam_vfe_bus_ver3_stop_vfe_out;
+	vfe_out->top_half_handler =
+		cam_vfe_bus_ver3_handle_vfe_out_done_top_half;
+	vfe_out->bottom_half_handler =
+		cam_vfe_bus_ver3_handle_vfe_out_done_bottom_half;
+	vfe_out->process_cmd = cam_vfe_bus_ver3_process_cmd;
+	vfe_out->hw_intf = ver3_bus_priv->common_data.hw_intf;
+	vfe_out->irq_handle = 0;
+
+	for (i = 0; i < CAM_VFE_BUS_VER3_MAX_MID_PER_PORT; i++)
+		rsrc_data->mid[i] = ver3_hw_info->vfe_out_hw_info[index].mid[i];
+
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_deinit_vfe_out_resource(
+	struct cam_isp_resource_node    *vfe_out)
+{
+	struct cam_vfe_bus_ver3_vfe_out_data *rsrc_data = vfe_out->res_priv;
+	int rc = 0, i = 0;
+
+	if (vfe_out->res_state == CAM_ISP_RESOURCE_STATE_UNAVAILABLE) {
+		/*
+		 * This is not error. It can happen if the resource is
+		 * never supported in the HW.
+		 */
+		return 0;
+	}
+
+	vfe_out->start = NULL;
+	vfe_out->stop = NULL;
+	vfe_out->top_half_handler = NULL;
+	vfe_out->bottom_half_handler = NULL;
+	vfe_out->hw_intf = NULL;
+	vfe_out->irq_handle = 0;
+
+	vfe_out->res_state = CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	INIT_LIST_HEAD(&vfe_out->list);
+	vfe_out->res_priv = NULL;
+
+	if (!rsrc_data)
+		return -ENOMEM;
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		rc = cam_vfe_bus_ver3_deinit_wm_resource(&rsrc_data->wm_res[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"VFE:%d deinit WM:%d failed rc:%d",
+				rsrc_data->common_data->core_index, i, rc);
+	}
+
+	rsrc_data->wm_res = NULL;
+	kfree(rsrc_data);
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_print_dimensions(
+	uint32_t                                   res_id,
+	struct cam_vfe_bus_ver3_priv              *bus_priv)
+{
+	struct cam_isp_resource_node              *rsrc_node = NULL;
+	struct cam_vfe_bus_ver3_vfe_out_data      *rsrc_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data  *wm_data   = NULL;
+	struct cam_vfe_bus_ver3_common_data  *common_data = NULL;
+	int                                        i;
+	uint32_t addr_status0, addr_status1, addr_status2, addr_status3;
+	enum cam_vfe_bus_ver3_vfe_out_type  vfe_out_res_id =
+		CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+	uint32_t  outmap_index = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid bus private data, res_id: %d",
+			res_id);
+		return -EINVAL;
+	}
+
+	vfe_out_res_id = cam_vfe_bus_ver3_get_out_res_id_and_index(bus_priv,
+				res_id, &outmap_index);
+
+	if ((vfe_out_res_id == CAM_VFE_BUS_VER3_VFE_OUT_MAX) ||
+		(outmap_index >= bus_priv->num_out)) {
+		CAM_WARN_RATE_LIMIT(CAM_ISP,
+			"target does not support req res id :0x%x outtype:%d index:%d",
+			res_id,
+			vfe_out_res_id, outmap_index);
+		return -EINVAL;
+	}
+
+	rsrc_node = &bus_priv->vfe_out[outmap_index];
+	rsrc_data = rsrc_node->res_priv;
+	if (!rsrc_data) {
+		CAM_ERR(CAM_ISP, "VFE out data is null, res_id: %d",
+			vfe_out_res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < rsrc_data->num_wm; i++) {
+		wm_data = rsrc_data->wm_res[i].res_priv;
+		common_data = rsrc_data->common_data;
+		addr_status0 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_0);
+		addr_status1 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_1);
+		addr_status2 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_2);
+		addr_status3 = cam_io_r_mb(common_data->mem_base +
+			wm_data->hw_regs->addr_status_3);
+
+		CAM_INFO(CAM_ISP,
+			"VFE:%d WM:%d width:%u height:%u stride:%u x_init:%u en_cfg:%u acquired width:%u height:%u",
+			wm_data->common_data->core_index, wm_data->index,
+			wm_data->width,
+			wm_data->height,
+			wm_data->stride, wm_data->h_init,
+			wm_data->en_cfg,
+			wm_data->acquired_width,
+			wm_data->acquired_height);
+		CAM_INFO(CAM_ISP,
+			"hw:%d WM:%d last consumed address:0x%x last frame addr:0x%x fifo cnt:0x%x current client address:0x%x",
+			common_data->hw_intf->hw_idx,
+			wm_data->index,
+			addr_status0,
+			addr_status1,
+			addr_status2,
+			addr_status3);
+	}
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_handle_bus_irq(uint32_t    evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_vfe_bus_ver3_priv          *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	CAM_DBG(CAM_ISP, "Enter");
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.bus_irq_controller);
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_vfe_bus_ver3_handle_rup_irq(uint32_t     evt_id,
+	struct cam_irq_th_payload                 *th_payload)
+{
+	struct cam_vfe_bus_ver3_priv          *bus_priv;
+	int rc = 0;
+
+	bus_priv = th_payload->handler_priv;
+	CAM_DBG(CAM_ISP, "Enter");
+	rc = cam_irq_controller_handle_irq(evt_id,
+		bus_priv->common_data.rup_irq_controller);
+	return (rc == IRQ_HANDLED) ? 0 : -EINVAL;
+}
+
+static int cam_vfe_bus_ver3_err_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int i = 0, rc = 0;
+	struct cam_vfe_bus_ver3_priv *bus_priv =
+		th_payload->handler_priv;
+	struct cam_vfe_bus_irq_evt_payload *evt_payload;
+
+	CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE:%d BUS Err IRQ",
+		bus_priv->common_data.core_index);
+	for (i = 0; i < th_payload->num_registers; i++) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "VFE:%d BUS IRQ status_%d: 0x%X",
+		bus_priv->common_data.core_index, i,
+			th_payload->evt_status_arr[i]);
+	}
+	cam_irq_controller_disable_irq(bus_priv->common_data.bus_irq_controller,
+		bus_priv->error_irq_handle);
+
+	rc  = cam_vfe_bus_ver3_get_evt_payload(&bus_priv->common_data,
+		&evt_payload);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->core_index = bus_priv->common_data.core_index;
+
+	evt_payload->ccif_violation_status = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->ccif_violation_status);
+
+	evt_payload->image_size_violation_status = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->image_size_violation_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static void cam_vfe_print_violations(
+	char *error_type,
+	const struct cam_vfe_bus_error_info *error_list,
+	uint32_t num_errors,
+	uint32_t status,
+	struct cam_vfe_bus_ver3_priv *bus_priv)
+{
+	int i;
+
+	for (i = 0; i < num_errors; i++) {
+		if (status & error_list[i].bitmask) {
+			CAM_INFO(CAM_ISP, "%s: %s violation",
+				error_list[i].error_description,
+				error_type);
+			if (bus_priv != NULL)
+				cam_vfe_bus_ver3_print_dimensions(
+					error_list[i].vfe_output,
+					bus_priv);
+		}
+	}
+}
+
+static int cam_vfe_bus_ver3_err_irq_bottom_half(
+	void *handler_priv, void *evt_payload_priv)
+{
+	struct cam_vfe_bus_irq_evt_payload *evt_payload = evt_payload_priv;
+	struct cam_vfe_bus_ver3_priv *bus_priv = handler_priv;
+	struct cam_vfe_bus_ver3_common_data *common_data;
+	struct cam_isp_hw_event_info evt_info;
+	const struct cam_vfe_bus_error_info *error_list = NULL;
+	uint32_t error_list_size = 0;
+	uint32_t status = 0, image_size_violation = 0, ccif_violation = 0;
+
+	if (!handler_priv || !evt_payload_priv)
+		return -EINVAL;
+
+	common_data = &bus_priv->common_data;
+
+	status = evt_payload->irq_reg_val[CAM_IFE_IRQ_BUS_VER3_REG_STATUS0];
+	image_size_violation = (status >> 31) & 0x1;
+	ccif_violation = (status >> 30) & 0x1;
+
+	CAM_ERR(CAM_ISP,
+		"VFE:%d BUS error image size violation %d CCIF violation %d",
+		bus_priv->common_data.core_index, image_size_violation,
+		ccif_violation);
+	CAM_INFO(CAM_ISP,
+		"Image Size violation status 0x%X CCIF violation status 0x%X",
+		evt_payload->image_size_violation_status,
+		evt_payload->ccif_violation_status);
+
+	error_list = common_data->is_lite ?
+		vfe_lite_error_list : vfe_error_list;
+	error_list_size = common_data->is_lite ?
+		ARRAY_SIZE(vfe_lite_error_list) : ARRAY_SIZE(vfe_error_list);
+
+	if (image_size_violation) {
+		status = evt_payload->image_size_violation_status;
+		if (!status)
+			cam_vfe_bus_ver3_get_constraint_errors(bus_priv);
+		else {
+			cam_vfe_print_violations("Image Size", error_list,
+				error_list_size, status, bus_priv);
+		}
+	}
+
+	if (ccif_violation) {
+		status = evt_payload->ccif_violation_status;
+		cam_vfe_print_violations("CCIF", error_list,
+			error_list_size, status, NULL);
+	}
+
+	cam_vfe_bus_ver3_put_evt_payload(common_data, &evt_payload);
+
+	evt_info.hw_idx = common_data->core_index;
+	evt_info.res_type = CAM_ISP_RESOURCE_VFE_OUT;
+	evt_info.res_id = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+	evt_info.err_type = CAM_VFE_IRQ_STATUS_VIOLATION;
+
+	if (common_data->event_cb)
+		common_data->event_cb(NULL, CAM_ISP_HW_EVENT_ERROR,
+			(void *)&evt_info);
+	return 0;
+}
+
+static void cam_vfe_bus_ver3_update_ubwc_meta_addr(
+	uint32_t *reg_val_pair,
+	uint32_t  *j,
+	void     *regs,
+	uint64_t  image_buf)
+{
+	struct cam_vfe_bus_ver3_reg_offset_ubwc_client *ubwc_regs;
+
+	if (!regs || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		goto end;
+	}
+
+	ubwc_regs = (struct cam_vfe_bus_ver3_reg_offset_ubwc_client *)regs;
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_addr, image_buf);
+
+end:
+	return;
+}
+
+static int cam_vfe_bus_ver3_update_ubwc_regs(
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data,
+	uint32_t *reg_val_pair,	uint32_t i, uint32_t *j)
+{
+	struct cam_vfe_bus_ver3_reg_offset_ubwc_client *ubwc_regs;
+	int rc = 0;
+
+	if (!wm_data || !reg_val_pair || !j) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_regs = (struct cam_vfe_bus_ver3_reg_offset_ubwc_client *)
+		wm_data->hw_regs->ubwc_regs;
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		wm_data->hw_regs->packer_cfg, wm_data->packer_cfg);
+	CAM_DBG(CAM_ISP, "WM:%d packer cfg 0x%X",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->meta_cfg, wm_data->ubwc_meta_cfg);
+	CAM_DBG(CAM_ISP, "WM:%d meta stride 0x%X",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->common_data->disable_ubwc_comp) {
+		wm_data->ubwc_mode_cfg &= ~ubwc_regs->ubwc_comp_en_bit;
+		CAM_DBG(CAM_ISP,
+			"Force disable UBWC compression on VFE:%d WM:%d",
+			wm_data->common_data->core_index, wm_data->index);
+	}
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->mode_cfg, wm_data->ubwc_mode_cfg);
+	CAM_DBG(CAM_ISP, "WM:%d ubwc_mode_cfg 0x%X",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->ctrl_2, wm_data->ubwc_ctrl_2);
+	CAM_DBG(CAM_ISP, "WM:%d ubwc_ctrl_2 0x%X",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->lossy_thresh0, wm_data->ubwc_lossy_threshold_0);
+	CAM_DBG(CAM_ISP, "WM:%d lossy_thresh0 0x%X",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->lossy_thresh1, wm_data->ubwc_lossy_threshold_1);
+	CAM_DBG(CAM_ISP, "WM:%d lossy_thresh1 0x%X",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+		ubwc_regs->off_lossy_var, wm_data->ubwc_offset_lossy_variance);
+	CAM_DBG(CAM_ISP, "WM:%d off_lossy_var 0x%X",
+		wm_data->index, reg_val_pair[*j-1]);
+
+	if (wm_data->ubwc_bandwidth_limit) {
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, *j,
+			ubwc_regs->bw_limit, wm_data->ubwc_bandwidth_limit);
+		CAM_DBG(CAM_ISP, "WM:%d ubwc bw limit 0x%X",
+			wm_data->index,   wm_data->ubwc_bandwidth_limit);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_update_wm(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update         *update_buf;
+	struct cam_buf_io_cfg                    *io_cfg;
+	struct cam_vfe_bus_ver3_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data = NULL;
+	struct cam_vfe_bus_ver3_reg_offset_ubwc_client *ubwc_client = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t  i, j, size = 0;
+	uint32_t  frame_inc = 0, val;
+
+	bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+	update_buf =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		update_buf->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	if (update_buf->wm_update->num_buf != vfe_out_data->num_wm) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Invalid number buffers:%d required:%d",
+			update_buf->wm_update->num_buf, vfe_out_data->num_wm);
+		return -EINVAL;
+	}
+
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	io_cfg = update_buf->wm_update->io_cfg;
+
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+		ubwc_client = wm_data->hw_regs->ubwc_regs;
+
+		/* Disable frame header in case it was previously enabled */
+		if ((wm_data->en_cfg) & (1 << 2))
+			wm_data->en_cfg &= ~(1 << 2);
+
+		if (update_buf->wm_update->frame_header &&
+			!update_buf->wm_update->fh_enabled) {
+			if (wm_data->hw_regs->frame_header_addr) {
+				wm_data->en_cfg |= 1 << 2;
+				update_buf->wm_update->fh_enabled = true;
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+						wm_data->hw_regs->frame_header_addr,
+						update_buf->wm_update->frame_header);
+				CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+						wm_data->hw_regs->frame_header_cfg,
+						update_buf->wm_update->local_id);
+				CAM_DBG(CAM_ISP,
+					"WM: %d en_cfg 0x%x frame_header %pK local_id %u",
+					wm_data->index, wm_data->en_cfg,
+					update_buf->wm_update->frame_header,
+					update_buf->wm_update->local_id);
+			}
+		}
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg, wm_data->en_cfg);
+		CAM_DBG(CAM_ISP, "WM:%d en_cfg 0x%X",
+			wm_data->index, reg_val_pair[j-1]);
+
+		val = (wm_data->height << 16) | wm_data->width;
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->image_cfg_0, val);
+		CAM_DBG(CAM_ISP, "WM:%d image height and width 0x%X",
+			wm_data->index, reg_val_pair[j-1]);
+
+		/* For initial configuration program all bus registers */
+		val = io_cfg->planes[i].plane_stride;
+		CAM_DBG(CAM_ISP, "before stride %d", val);
+		val = ALIGNUP(val, 16);
+		if (val != io_cfg->planes[i].plane_stride &&
+			val != wm_data->stride)
+			CAM_WARN(CAM_ISP, "Warning stride %u expected %u",
+				io_cfg->planes[i].plane_stride, val);
+
+		if (wm_data->stride != val || !wm_data->init_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_2,
+				io_cfg->planes[i].plane_stride);
+			wm_data->stride = val;
+			CAM_DBG(CAM_ISP, "WM:%d image stride 0x%X",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		if (wm_data->en_ubwc) {
+			if (!wm_data->hw_regs->ubwc_regs) {
+				CAM_ERR(CAM_ISP,
+					"No UBWC register to configure.");
+				return -EINVAL;
+			}
+			if (wm_data->ubwc_updated) {
+				wm_data->ubwc_updated = false;
+				cam_vfe_bus_ver3_update_ubwc_regs(
+					wm_data, reg_val_pair, i, &j);
+			}
+
+			/* UBWC meta address */
+			cam_vfe_bus_ver3_update_ubwc_meta_addr(
+				reg_val_pair, &j,
+				wm_data->hw_regs->ubwc_regs,
+				update_buf->wm_update->image_buf[i]);
+			CAM_DBG(CAM_ISP, "WM:%d ubwc meta addr 0x%llx",
+				wm_data->index,
+				update_buf->wm_update->image_buf[i]);
+		}
+
+		if (wm_data->en_ubwc) {
+			frame_inc = ALIGNUP(io_cfg->planes[i].plane_stride *
+			    io_cfg->planes[i].slice_height, 4096);
+			frame_inc += io_cfg->planes[i].meta_size;
+			CAM_DBG(CAM_ISP,
+				"WM:%d frm %d: ht: %d stride %d meta: %d",
+				wm_data->index, frame_inc,
+				io_cfg->planes[i].slice_height,
+				io_cfg->planes[i].plane_stride,
+				io_cfg->planes[i].meta_size);
+		} else {
+			frame_inc = io_cfg->planes[i].plane_stride *
+				io_cfg->planes[i].slice_height;
+		}
+
+		if (!(wm_data->en_cfg & (0x3 << 16))) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_cfg_1, wm_data->h_init);
+			CAM_DBG(CAM_ISP, "WM:%d h_init 0x%X",
+				wm_data->index, reg_val_pair[j-1]);
+		}
+
+		/* WM Image address */
+		if (wm_data->en_ubwc) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_addr,
+				update_buf->wm_update->image_buf[i] +
+				io_cfg->planes[i].meta_size);
+			update_buf->wm_update->image_buf_offset[i] =
+				io_cfg->planes[i].meta_size;
+		} else if (wm_data->en_cfg & (0x3 << 16)) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_addr,
+				(update_buf->wm_update->image_buf[i] +
+				wm_data->offset));
+			update_buf->wm_update->image_buf_offset[i] =
+				wm_data->offset;
+		} else {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->image_addr,
+				update_buf->wm_update->image_buf[i]);
+			update_buf->wm_update->image_buf_offset[i] = 0;
+		}
+
+		CAM_DBG(CAM_ISP, "WM:%d image address 0x%X",
+			wm_data->index, reg_val_pair[j-1]);
+
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->frame_incr, frame_inc);
+		CAM_DBG(CAM_ISP, "WM:%d frame_inc %d",
+			wm_data->index, reg_val_pair[j-1]);
+
+
+		/* enable the WM */
+		CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+			wm_data->hw_regs->cfg,
+			wm_data->en_cfg);
+
+		/* set initial configuration done */
+		if (!wm_data->init_cfg_done)
+			wm_data->init_cfg_done = true;
+	}
+
+	size = vfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_buf->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_buf->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	vfe_out_data->cdm_util_ops->cdm_write_regrandom(
+		update_buf->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_buf->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_priv             *bus_priv;
+	struct cam_isp_hw_get_cmd_update         *update_hfr;
+	struct cam_vfe_bus_ver3_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data = NULL;
+	struct cam_isp_port_hfr_config           *hfr_cfg = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t  i, j, size = 0;
+
+	bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+	update_hfr =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		update_hfr->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data;
+
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %zu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+
+		if (((!bus_priv->common_data.is_lite && wm_data->index > 22) ||
+			bus_priv->common_data.is_lite) &&
+			hfr_cfg->subsample_period > 3) {
+			CAM_ERR(CAM_ISP,
+				"RDI doesn't support irq subsample period %d",
+				hfr_cfg->subsample_period);
+			return -EINVAL;
+		}
+
+		if ((wm_data->framedrop_pattern !=
+			hfr_cfg->framedrop_pattern) ||
+			!wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_pattern,
+				hfr_cfg->framedrop_pattern);
+			wm_data->framedrop_pattern = hfr_cfg->framedrop_pattern;
+			CAM_DBG(CAM_ISP, "WM:%d framedrop pattern 0x%X",
+				wm_data->index, wm_data->framedrop_pattern);
+		}
+
+		if (wm_data->framedrop_period != hfr_cfg->framedrop_period ||
+			!wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_period,
+				hfr_cfg->framedrop_period);
+			wm_data->framedrop_period = hfr_cfg->framedrop_period;
+			CAM_DBG(CAM_ISP, "WM:%d framedrop period 0x%X",
+				wm_data->index, wm_data->framedrop_period);
+		}
+
+		if (wm_data->irq_subsample_period != hfr_cfg->subsample_period
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_period,
+				hfr_cfg->subsample_period);
+			wm_data->irq_subsample_period =
+				hfr_cfg->subsample_period;
+			CAM_DBG(CAM_ISP, "WM:%d irq subsample period 0x%X",
+				wm_data->index, wm_data->irq_subsample_period);
+		}
+
+		if (wm_data->irq_subsample_pattern != hfr_cfg->subsample_pattern
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_pattern,
+				hfr_cfg->subsample_pattern);
+			wm_data->irq_subsample_pattern =
+				hfr_cfg->subsample_pattern;
+			CAM_DBG(CAM_ISP, "WM:%d irq subsample pattern 0x%X",
+				wm_data->index, wm_data->irq_subsample_pattern);
+		}
+
+		/* set initial configuration done */
+		if (!wm_data->hfr_cfg_done)
+			wm_data->hfr_cfg_done = true;
+	}
+
+	size = vfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_hfr->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_hfr->cmd.size, size);
+		return -ENOMEM;
+	}
+
+	vfe_out_data->cdm_util_ops->cdm_write_regrandom(
+		update_hfr->cmd.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_hfr->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_ubwc_config_v2(void *cmd_args)
+{
+	struct cam_isp_hw_get_cmd_update         *update_ubwc;
+	struct cam_vfe_bus_ver3_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data *wm_data = NULL;
+	struct cam_vfe_generic_ubwc_config       *ubwc_generic_cfg = NULL;
+	struct cam_vfe_generic_ubwc_plane_config *ubwc_generic_plane_cfg = NULL;
+	uint32_t                                  i;
+	int                                       rc = 0;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	update_ubwc =  (struct cam_isp_hw_get_cmd_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		update_ubwc->res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ubwc_generic_cfg = (struct cam_vfe_generic_ubwc_config *)
+		update_ubwc->data;
+
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+		ubwc_generic_plane_cfg = &ubwc_generic_cfg->ubwc_plane_cfg[i];
+
+		if (!wm_data->hw_regs->ubwc_regs) {
+			CAM_ERR(CAM_ISP,
+				"No UBWC register to configure.");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (!wm_data->en_ubwc) {
+			CAM_ERR(CAM_ISP, "UBWC Disabled");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (wm_data->packer_cfg !=
+			ubwc_generic_plane_cfg->packer_config ||
+			!wm_data->init_cfg_done) {
+			wm_data->packer_cfg =
+				ubwc_generic_plane_cfg->packer_config;
+			wm_data->ubwc_updated = true;
+		}
+
+		if ((!wm_data->is_dual) && ((wm_data->h_init !=
+			ubwc_generic_plane_cfg->h_init) ||
+			!wm_data->init_cfg_done)) {
+			wm_data->h_init = ubwc_generic_plane_cfg->h_init;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_meta_cfg !=
+			ubwc_generic_plane_cfg->meta_stride ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_meta_cfg =
+				ubwc_generic_plane_cfg->meta_stride;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_mode_cfg !=
+			ubwc_generic_plane_cfg->mode_config_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_mode_cfg =
+				ubwc_generic_plane_cfg->mode_config_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_ctrl_2 !=
+			ubwc_generic_plane_cfg->ctrl_2 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_ctrl_2 =
+				ubwc_generic_plane_cfg->ctrl_2;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_lossy_threshold_0 !=
+			ubwc_generic_plane_cfg->lossy_threshold_0 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_lossy_threshold_0 =
+				ubwc_generic_plane_cfg->lossy_threshold_0;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_lossy_threshold_1 !=
+			ubwc_generic_plane_cfg->lossy_threshold_1 ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_lossy_threshold_1 =
+				ubwc_generic_plane_cfg->lossy_threshold_1;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_offset_lossy_variance !=
+			ubwc_generic_plane_cfg->lossy_var_offset ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_offset_lossy_variance =
+				ubwc_generic_plane_cfg->lossy_var_offset;
+			wm_data->ubwc_updated = true;
+		}
+
+		if (wm_data->ubwc_bandwidth_limit !=
+			ubwc_generic_plane_cfg->bandwidth_limit ||
+			!wm_data->init_cfg_done) {
+			wm_data->ubwc_bandwidth_limit =
+				ubwc_generic_plane_cfg->bandwidth_limit;
+			wm_data->ubwc_updated = true;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_bus_ver3_update_stripe_cfg(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_priv                *bus_priv;
+	struct cam_isp_hw_dual_isp_update_args      *stripe_args;
+	struct cam_vfe_bus_ver3_vfe_out_data        *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data    *wm_data = NULL;
+	struct cam_isp_dual_stripe_config           *stripe_config;
+	uint32_t outport_id, ports_plane_idx, i;
+
+	bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+	stripe_args = (struct cam_isp_hw_dual_isp_update_args *)cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
+		stripe_args->res->res_priv;
+
+	if (!vfe_out_data) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	outport_id = stripe_args->res->res_id & 0xFF;
+	if (stripe_args->res->res_id < CAM_ISP_IFE_OUT_RES_BASE ||
+		stripe_args->res->res_id >= bus_priv->max_out_res)
+		return 0;
+
+	ports_plane_idx = (stripe_args->split_id *
+	(stripe_args->dual_cfg->num_ports * CAM_PACKET_MAX_PLANES)) +
+	(outport_id * CAM_PACKET_MAX_PLANES);
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+		stripe_config = (struct cam_isp_dual_stripe_config  *)
+			&stripe_args->dual_cfg->stripes_flex[ports_plane_idx + i];
+		wm_data->width = stripe_config->width;
+
+		/*
+		 * UMD sends buffer offset address as offset for clients
+		 * programmed to operate in frame/index based mode and h_init
+		 * value as offset for clients programmed to operate in line
+		 * based mode.
+		 */
+
+		if (wm_data->en_cfg & (0x3 << 16))
+			wm_data->offset = stripe_config->offset;
+		else
+			wm_data->h_init = stripe_config->offset;
+
+		CAM_DBG(CAM_ISP,
+			"out_type:0x%X WM:%d width:%d offset:0x%X h_init:%d",
+			stripe_args->res->res_id, wm_data->index,
+			wm_data->width, wm_data->offset, wm_data->h_init);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_update_wm_config(
+	void                                        *cmd_args)
+{
+	int                                          i;
+	struct cam_isp_hw_get_cmd_update            *wm_config_update;
+	struct cam_vfe_bus_ver3_vfe_out_data        *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver3_wm_resource_data    *wm_data = NULL;
+	struct cam_isp_vfe_wm_config                *wm_config = NULL;
+
+	if (!cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	wm_config_update = cmd_args;
+	vfe_out_data = wm_config_update->res->res_priv;
+	wm_config = (struct cam_isp_vfe_wm_config  *)
+		wm_config_update->data;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops || !wm_config) {
+		CAM_ERR(CAM_ISP, "Invalid data");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < vfe_out_data->num_wm; i++) {
+		wm_data = vfe_out_data->wm_res[i].res_priv;
+
+		if (wm_config->wm_mode > 0x2) {
+			CAM_ERR(CAM_ISP, "Invalid wm_mode: 0x%X WM:%d",
+				wm_config->wm_mode, wm_data->index);
+			return -EINVAL;
+		}
+
+		wm_data->en_cfg = (wm_config->wm_mode << 16) | 0x1;
+		wm_data->width  = wm_config->width;
+
+		if (i == PLANE_C)
+			wm_data->height = wm_config->height / 2;
+		else
+			wm_data->height = wm_config->height;
+
+		CAM_DBG(CAM_ISP,
+			"WM:%d en_cfg:0x%X height:%d width:%d",
+			wm_data->index, wm_data->en_cfg, wm_data->height,
+			wm_data->width);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_start_hw(void *hw_priv,
+	void *start_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_ver3_start_vfe_out(hw_priv);
+}
+
+static int cam_vfe_bus_ver3_stop_hw(void *hw_priv,
+	void *stop_hw_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_ver3_stop_vfe_out(hw_priv);
+}
+
+static int cam_vfe_bus_ver3_init_hw(void *hw_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_priv    *bus_priv = hw_priv;
+	uint32_t                         top_irq_reg_mask[3] = {0};
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (bus_priv->common_data.hw_init)
+		return 0;
+
+	top_irq_reg_mask[0] = (1 << bus_priv->top_irq_shift);
+
+	bus_priv->bus_irq_handle = cam_irq_controller_subscribe_irq(
+		bus_priv->common_data.vfe_irq_controller,
+		CAM_IRQ_PRIORITY_4,
+		top_irq_reg_mask,
+		bus_priv,
+		cam_vfe_bus_ver3_handle_bus_irq,
+		NULL,
+		NULL,
+		NULL);
+
+	if (bus_priv->bus_irq_handle < 1) {
+		CAM_ERR(CAM_ISP, "Failed to subscribe BUS (buf_done) IRQ");
+		bus_priv->bus_irq_handle = 0;
+		return -EFAULT;
+	}
+
+	if (bus_priv->common_data.supported_irq & CAM_VFE_HW_IRQ_CAP_RUP) {
+		bus_priv->rup_irq_handle = cam_irq_controller_subscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			CAM_IRQ_PRIORITY_2,
+			top_irq_reg_mask,
+			bus_priv,
+			cam_vfe_bus_ver3_handle_rup_irq,
+			NULL,
+			NULL,
+			NULL);
+
+		if (bus_priv->rup_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "Failed to subscribe BUS (rup) IRQ");
+			bus_priv->rup_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	if (bus_priv->tasklet_info != NULL) {
+		bus_priv->error_irq_handle = cam_irq_controller_subscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			bus_error_irq_mask,
+			bus_priv,
+			cam_vfe_bus_ver3_err_irq_top_half,
+			cam_vfe_bus_ver3_err_irq_bottom_half,
+			bus_priv->tasklet_info,
+			&tasklet_bh_api);
+
+		if (bus_priv->error_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "Failed to subscribe BUS Error IRQ");
+			bus_priv->error_irq_handle = 0;
+			return -EFAULT;
+		}
+	}
+
+	/* We take the controller only if the buf done is supported on vfe side
+	 * for some hw, it is taken from IP extenal to VFE like CSID
+	 */
+	if ((bus_priv->common_data.supported_irq & CAM_VFE_HW_IRQ_CAP_BUF_DONE))
+		bus_priv->common_data.buf_done_controller =
+			bus_priv->common_data.bus_irq_controller;
+
+	/* no clock gating at bus input */
+	CAM_DBG(CAM_ISP, "Overriding clock gating at bus input");
+	cam_io_w_mb(0x3FFFFFF, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->cgc_ovd);
+
+	/* BUS_WR_TEST_BUS_CTRL */
+	cam_io_w_mb(0x0, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->test_bus_ctrl);
+
+	bus_priv->common_data.hw_init = true;
+
+	return 0;
+}
+
+static int cam_vfe_bus_ver3_deinit_hw(void *hw_priv,
+	void *deinit_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_priv    *bus_priv = hw_priv;
+	int                              rc = 0, i;
+	unsigned long                    flags;
+
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "Error: Invalid args");
+		return -EINVAL;
+	}
+
+	if (!bus_priv->common_data.hw_init)
+		return 0;
+
+	if (bus_priv->error_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.bus_irq_controller,
+			bus_priv->error_irq_handle);
+		bus_priv->error_irq_handle = 0;
+	}
+
+	if (bus_priv->bus_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			bus_priv->bus_irq_handle);
+		bus_priv->bus_irq_handle = 0;
+	}
+
+	if (bus_priv->rup_irq_handle) {
+		rc = cam_irq_controller_unsubscribe_irq(
+			bus_priv->common_data.vfe_irq_controller,
+			bus_priv->rup_irq_handle);
+		bus_priv->rup_irq_handle = 0;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER3_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+	bus_priv->common_data.hw_init = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	return rc;
+}
+
+static int cam_vfe_bus_get_res_for_mid(
+	struct cam_vfe_bus_ver3_priv *bus_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver3_vfe_out_data   *out_data = NULL;
+	struct cam_isp_hw_get_cmd_update       *cmd_update = cmd_args;
+	struct cam_isp_hw_get_res_for_mid       *get_res = NULL;
+	int i, j;
+
+	get_res = (struct cam_isp_hw_get_res_for_mid *)cmd_update->data;
+	if (!get_res) {
+		CAM_ERR(CAM_ISP,
+			"invalid get resource for mid paramas");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		out_data = (struct cam_vfe_bus_ver3_vfe_out_data   *)
+			bus_priv->vfe_out[i].res_priv;
+
+		if (!out_data)
+			continue;
+
+		for (j = 0; j < CAM_VFE_BUS_VER3_MAX_MID_PER_PORT; j++) {
+			if (out_data->mid[j] == get_res->mid)
+				goto end;
+		}
+	}
+
+	if (i == bus_priv->num_out) {
+		CAM_ERR(CAM_ISP,
+			"mid:%d does not match with any out resource",
+			get_res->mid);
+		get_res->out_res_id = 0;
+		return -EINVAL;
+	}
+
+end:
+	CAM_INFO(CAM_ISP, "match mid :%d  out resource:0x%x found",
+		get_res->mid, bus_priv->vfe_out[i].res_id);
+	get_res->out_res_id = bus_priv->vfe_out[i].res_id;
+	return 0;
+}
+
+static int __cam_vfe_bus_ver3_process_cmd(void *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	return cam_vfe_bus_ver3_process_cmd(priv, cmd_type, cmd_args, arg_size);
+}
+
+static int cam_vfe_bus_ver3_process_cmd(
+	struct cam_isp_resource_node *priv,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_bus_ver3_priv		 *bus_priv;
+	uint32_t top_mask_0 = 0;
+	struct cam_isp_hw_bus_cap *vfe_bus_cap;
+
+
+	if (!priv || !cmd_args) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_BUF_UPDATE:
+		rc = cam_vfe_bus_ver3_update_wm(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_HFR_UPDATE:
+		rc = cam_vfe_bus_ver3_update_hfr(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_SECURE_MODE:
+		rc = cam_vfe_bus_ver3_get_secure_mode(priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STRIPE_UPDATE:
+		rc = cam_vfe_bus_ver3_update_stripe_cfg(priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_STOP_BUS_ERR_IRQ:
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+		if (bus_priv->error_irq_handle) {
+			CAM_DBG(CAM_ISP, "Mask off bus error irq handler");
+			rc = cam_irq_controller_unsubscribe_irq(
+				bus_priv->common_data.bus_irq_controller,
+				bus_priv->error_irq_handle);
+			bus_priv->error_irq_handle = 0;
+		}
+		break;
+	case CAM_ISP_HW_CMD_DUMP_BUS_INFO: {
+		struct cam_isp_hw_event_info  *event_info;
+
+		event_info =
+			(struct cam_isp_hw_event_info *)cmd_args;
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+
+		rc = cam_vfe_bus_ver3_print_dimensions(
+			event_info->res_id, bus_priv);
+		break;
+		}
+	case CAM_ISP_HW_CMD_UBWC_UPDATE_V2:
+		rc = cam_vfe_bus_ver3_update_ubwc_config_v2(cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_WM_CONFIG_UPDATE:
+		rc = cam_vfe_bus_ver3_update_wm_config(cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_UNMASK_BUS_WR_IRQ:
+		bus_priv = (struct cam_vfe_bus_ver3_priv *) priv;
+		top_mask_0 = cam_io_r_mb(bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->top_irq_mask_0);
+		top_mask_0 |= (1 << bus_priv->top_irq_shift);
+		cam_io_w_mb(top_mask_0, bus_priv->common_data.mem_base +
+			bus_priv->common_data.common_reg->top_irq_mask_0);
+		break;
+	case CAM_ISP_HW_CMD_GET_RES_FOR_MID:
+		bus_priv = (struct cam_vfe_bus_ver3_priv *) priv;
+		rc = cam_vfe_bus_get_res_for_mid(bus_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_BUS_CAP:
+		bus_priv = (struct cam_vfe_bus_ver3_priv  *) priv;
+		vfe_bus_cap = (struct cam_isp_hw_bus_cap *) cmd_args;
+		vfe_bus_cap->max_vfe_out_res_type = bus_priv->max_out_res;
+		vfe_bus_cap->support_consumed_addr =
+			bus_priv->common_data.support_consumed_addr;
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Invalid camif process command:%d",
+			cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_bus_ver3_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_ver3_priv    *bus_priv = NULL;
+	struct cam_vfe_bus              *vfe_bus_local;
+	struct cam_vfe_bus_ver3_hw_info *ver3_hw_info = bus_hw_info;
+	struct cam_vfe_soc_private      *soc_private = NULL;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	if (!soc_info || !hw_intf || !bus_hw_info || !vfe_irq_controller) {
+		CAM_ERR(CAM_ISP,
+			"Inval_prms soc_info:%pK hw_intf:%pK hw_info%pK",
+			soc_info, hw_intf, bus_hw_info);
+		CAM_ERR(CAM_ISP, "controller: %pK", vfe_irq_controller);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	vfe_bus_local = kzalloc(sizeof(struct cam_vfe_bus), GFP_KERNEL);
+	if (!vfe_bus_local) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_priv = kzalloc(sizeof(struct cam_vfe_bus_ver3_priv),
+		GFP_KERNEL);
+	if (!bus_priv) {
+		CAM_DBG(CAM_ISP, "Failed to alloc for vfe_bus_priv");
+		rc = -ENOMEM;
+		goto free_bus_local;
+	}
+	vfe_bus_local->bus_priv = bus_priv;
+
+	bus_priv->num_client                     = ver3_hw_info->num_client;
+	bus_priv->num_out                        = ver3_hw_info->num_out;
+	bus_priv->num_comp_grp                   = ver3_hw_info->num_comp_grp;
+	bus_priv->top_irq_shift                  = ver3_hw_info->top_irq_shift;
+	bus_priv->max_out_res                    = ver3_hw_info->max_out_res;
+	bus_priv->common_data.num_sec_out        = 0;
+	bus_priv->common_data.secure_mode        = CAM_SECURE_MODE_NON_SECURE;
+	bus_priv->common_data.core_index         = soc_info->index;
+	bus_priv->common_data.mem_base           =
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX);
+	bus_priv->common_data.camnoc_mem_base           =
+		CAM_SOC_GET_REG_MAP_START(soc_info, CAMNOC_CORE_BASE_IDX);
+	bus_priv->common_data.cpas_version        = soc_private->cpas_version;
+	bus_priv->common_data.hw_intf            = hw_intf;
+	bus_priv->common_data.vfe_irq_controller = vfe_irq_controller;
+	bus_priv->common_data.common_reg         = &ver3_hw_info->common_reg;
+	bus_priv->common_data.comp_done_shift    =
+		ver3_hw_info->comp_done_shift;
+	bus_priv->common_data.hw_init            = false;
+
+	bus_priv->common_data.is_lite = soc_private->is_ife_lite;
+	bus_priv->common_data.support_consumed_addr =
+		ver3_hw_info->support_consumed_addr;
+	bus_priv->common_data.disable_ubwc_comp = false;
+	bus_priv->common_data.supported_irq      = ver3_hw_info->supported_irq;
+	bus_priv->common_data.comp_config_needed =
+		ver3_hw_info->comp_cfg_needed;
+
+	if (bus_priv->num_out >= CAM_VFE_BUS_VER3_VFE_OUT_MAX) {
+		CAM_ERR(CAM_ISP, "number of vfe out:%d more than max value:%d ",
+			bus_priv->num_out, CAM_VFE_BUS_VER3_VFE_OUT_MAX);
+		rc = -EINVAL;
+		goto free_bus_priv;
+	}
+
+	bus_priv->comp_grp = kzalloc((sizeof(struct cam_isp_resource_node) *
+		bus_priv->num_comp_grp), GFP_KERNEL);
+	if (!bus_priv->comp_grp) {
+		CAM_ERR(CAM_ISP, "Failed to alloc for bus comp groups");
+		rc = -ENOMEM;
+		goto free_bus_priv;
+	}
+
+	bus_priv->vfe_out = kzalloc((sizeof(struct cam_isp_resource_node) *
+		bus_priv->num_out), GFP_KERNEL);
+	if (!bus_priv->vfe_out) {
+		CAM_ERR(CAM_ISP, "Failed to alloc for bus out res");
+		rc = -ENOMEM;
+		goto free_comp_grp;
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER3_SRC_GRP_MAX; i++)
+		bus_priv->common_data.rup_irq_handle[i] = 0;
+
+	mutex_init(&bus_priv->common_data.bus_mutex);
+
+	rc = cam_irq_controller_init(drv_name, bus_priv->common_data.mem_base,
+		&ver3_hw_info->common_reg.irq_reg_info,
+		&bus_priv->common_data.bus_irq_controller, false);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Init bus_irq_controller failed");
+		goto free_vfe_out;
+	}
+
+	if (bus_priv->common_data.supported_irq & CAM_VFE_HW_IRQ_CAP_RUP) {
+		rc = cam_irq_controller_init("vfe_bus_rup",
+			bus_priv->common_data.mem_base,
+			&ver3_hw_info->common_reg.irq_reg_info,
+			&bus_priv->common_data.rup_irq_controller, false);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Init rup_irq_controller failed");
+			goto free_vfe_out;
+		}
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	for (i = 0; i < bus_priv->num_comp_grp; i++) {
+		rc = cam_vfe_bus_ver3_init_comp_grp(i, soc_info,
+			bus_priv, bus_hw_info,
+			&bus_priv->comp_grp[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "VFE:%d init comp_grp:%d failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+			goto deinit_comp_grp;
+		}
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER3_VFE_OUT_MAX; i++)
+		bus_priv->vfe_out_map_outtype[i] =
+			CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+
+	for (i = 0; i < bus_priv->num_out; i++) {
+		rc = cam_vfe_bus_ver3_init_vfe_out_resource(i, bus_priv,
+			bus_hw_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP,
+				"VFE:%d init out_type:0x%X failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+			goto deinit_vfe_out;
+		}
+	}
+
+	spin_lock_init(&bus_priv->common_data.spin_lock);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER3_PAYLOAD_MAX; i++) {
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+		list_add_tail(&bus_priv->common_data.evt_payload[i].list,
+			&bus_priv->common_data.free_payload_list);
+	}
+
+	vfe_bus_local->hw_ops.reserve      = cam_vfe_bus_ver3_acquire_vfe_out;
+	vfe_bus_local->hw_ops.release      = cam_vfe_bus_ver3_release_vfe_out;
+	vfe_bus_local->hw_ops.start        = cam_vfe_bus_ver3_start_hw;
+	vfe_bus_local->hw_ops.stop         = cam_vfe_bus_ver3_stop_hw;
+	vfe_bus_local->hw_ops.init         = cam_vfe_bus_ver3_init_hw;
+	vfe_bus_local->hw_ops.deinit       = cam_vfe_bus_ver3_deinit_hw;
+	vfe_bus_local->top_half_handler    = NULL;
+	vfe_bus_local->bottom_half_handler = NULL;
+	vfe_bus_local->hw_ops.process_cmd  = __cam_vfe_bus_ver3_process_cmd;
+
+	*vfe_bus = vfe_bus_local;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+
+deinit_vfe_out:
+	if (i < 0)
+		i = CAM_VFE_BUS_VER3_VFE_OUT_MAX;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_ver3_deinit_vfe_out_resource(&bus_priv->vfe_out[i]);
+
+deinit_comp_grp:
+	if (i < 0)
+		i = bus_priv->num_comp_grp;
+	for (--i; i >= 0; i--)
+		cam_vfe_bus_ver3_deinit_comp_grp(&bus_priv->comp_grp[i]);
+
+free_vfe_out:
+	kfree(bus_priv->vfe_out);
+
+free_comp_grp:
+	kfree(bus_priv->comp_grp);
+
+free_bus_priv:
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+end:
+	return rc;
+}
+
+int cam_vfe_bus_ver3_deinit(
+	struct cam_vfe_bus                  **vfe_bus)
+{
+	int i, rc = 0;
+	struct cam_vfe_bus_ver3_priv    *bus_priv = NULL;
+	struct cam_vfe_bus              *vfe_bus_local;
+	unsigned long                    flags;
+
+	if (!vfe_bus || !*vfe_bus) {
+		CAM_ERR(CAM_ISP, "Invalid input");
+		return -EINVAL;
+	}
+	vfe_bus_local = *vfe_bus;
+
+	bus_priv = vfe_bus_local->bus_priv;
+	if (!bus_priv) {
+		CAM_ERR(CAM_ISP, "bus_priv is NULL");
+		rc = -ENODEV;
+		goto free_bus_local;
+	}
+
+	spin_lock_irqsave(&bus_priv->common_data.spin_lock, flags);
+	INIT_LIST_HEAD(&bus_priv->common_data.free_payload_list);
+	for (i = 0; i < CAM_VFE_BUS_VER3_PAYLOAD_MAX; i++)
+		INIT_LIST_HEAD(&bus_priv->common_data.evt_payload[i].list);
+	bus_priv->common_data.hw_init = false;
+	spin_unlock_irqrestore(&bus_priv->common_data.spin_lock, flags);
+
+	for (i = 0; i < CAM_VFE_BUS_VER3_COMP_GRP_MAX; i++) {
+		rc = cam_vfe_bus_ver3_deinit_comp_grp(&bus_priv->comp_grp[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"VFE:%d deinit comp_grp:%d failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+	}
+
+	for (i = 0; i < CAM_VFE_BUS_VER3_VFE_OUT_MAX; i++) {
+		rc = cam_vfe_bus_ver3_deinit_vfe_out_resource(
+			&bus_priv->vfe_out[i]);
+		if (rc < 0)
+			CAM_ERR(CAM_ISP,
+				"VFE:%d deinit out_type:0x%X failed rc:%d",
+				bus_priv->common_data.core_index, i, rc);
+	}
+
+	INIT_LIST_HEAD(&bus_priv->free_comp_grp);
+	INIT_LIST_HEAD(&bus_priv->used_comp_grp);
+
+	rc = cam_irq_controller_deinit(
+		&bus_priv->common_data.bus_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Deinit BUS IRQ Controller failed rc=%d", rc);
+
+	rc = cam_irq_controller_deinit(
+		&bus_priv->common_data.rup_irq_controller);
+	if (rc)
+		CAM_ERR(CAM_ISP,
+			"Deinit RUP IRQ Controller failed rc=%d", rc);
+
+	kfree(bus_priv->comp_grp);
+	kfree(bus_priv->vfe_out);
+
+	mutex_destroy(&bus_priv->common_data.bus_mutex);
+	kfree(vfe_bus_local->bus_priv);
+
+free_bus_local:
+	kfree(vfe_bus_local);
+
+	*vfe_bus = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.h
@@ -0,0 +1,252 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_VFE_BUS_VER3_H_
+#define _CAM_VFE_BUS_VER3_H_
+
+#include "cam_irq_controller.h"
+#include "cam_vfe_bus.h"
+
+#define CAM_VFE_BUS_VER3_MAX_SUB_GRPS        6
+#define CAM_VFE_BUS_VER3_MAX_MID_PER_PORT 4
+#define CAM_VFE_BUS_VER3_480_MAX_CLIENTS     26
+#define CAM_VFE_BUS_VER3_680_MAX_CLIENTS     28
+
+enum cam_vfe_bus_ver3_vfe_core_id {
+	CAM_VFE_BUS_VER3_VFE_CORE_0,
+	CAM_VFE_BUS_VER3_VFE_CORE_1,
+	CAM_VFE_BUS_VER3_VFE_CORE_MAX,
+};
+
+enum cam_vfe_bus_ver3_src_grp {
+	CAM_VFE_BUS_VER3_SRC_GRP_0,
+	CAM_VFE_BUS_VER3_SRC_GRP_1,
+	CAM_VFE_BUS_VER3_SRC_GRP_2,
+	CAM_VFE_BUS_VER3_SRC_GRP_3,
+	CAM_VFE_BUS_VER3_SRC_GRP_4,
+	CAM_VFE_BUS_VER3_SRC_GRP_5,
+	CAM_VFE_BUS_VER3_SRC_GRP_MAX,
+};
+
+enum cam_vfe_bus_ver3_comp_grp_type {
+	CAM_VFE_BUS_VER3_COMP_GRP_0,
+	CAM_VFE_BUS_VER3_COMP_GRP_1,
+	CAM_VFE_BUS_VER3_COMP_GRP_2,
+	CAM_VFE_BUS_VER3_COMP_GRP_3,
+	CAM_VFE_BUS_VER3_COMP_GRP_4,
+	CAM_VFE_BUS_VER3_COMP_GRP_5,
+	CAM_VFE_BUS_VER3_COMP_GRP_6,
+	CAM_VFE_BUS_VER3_COMP_GRP_7,
+	CAM_VFE_BUS_VER3_COMP_GRP_8,
+	CAM_VFE_BUS_VER3_COMP_GRP_9,
+	CAM_VFE_BUS_VER3_COMP_GRP_10,
+	CAM_VFE_BUS_VER3_COMP_GRP_11,
+	CAM_VFE_BUS_VER3_COMP_GRP_12,
+	CAM_VFE_BUS_VER3_COMP_GRP_13,
+	CAM_VFE_BUS_VER3_COMP_GRP_14,
+	CAM_VFE_BUS_VER3_COMP_GRP_15,
+	CAM_VFE_BUS_VER3_COMP_GRP_16,
+	CAM_VFE_BUS_VER3_COMP_GRP_MAX,
+};
+
+enum cam_vfe_bus_ver3_vfe_out_type {
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI0,
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI1,
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI2,
+	CAM_VFE_BUS_VER3_VFE_OUT_RDI3,
+	CAM_VFE_BUS_VER3_VFE_OUT_FULL,
+	CAM_VFE_BUS_VER3_VFE_OUT_DS4,
+	CAM_VFE_BUS_VER3_VFE_OUT_DS16,
+	CAM_VFE_BUS_VER3_VFE_OUT_RAW_DUMP,
+	CAM_VFE_BUS_VER3_VFE_OUT_FD,
+	CAM_VFE_BUS_VER3_VFE_OUT_PDAF,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BE,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_HDR_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_TL_BG,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_BF,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_AWB_BG,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_RS,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_CS,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_IHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_FULL_DISP,
+	CAM_VFE_BUS_VER3_VFE_OUT_DS4_DISP,
+	CAM_VFE_BUS_VER3_VFE_OUT_DS16_DISP,
+	CAM_VFE_BUS_VER3_VFE_OUT_2PD,
+	CAM_VFE_BUS_VER3_VFE_OUT_LCR,
+	CAM_VFE_BUS_VER3_VFE_OUT_AWB_BFW,
+	CAM_VFE_BUS_VER3_VFE_OUT_2PD_STATS,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_AEC_BE,
+	CAM_VFE_BUS_VER3_VFE_OUT_LTM_STATS,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_GTM_BHIST,
+	CAM_VFE_BUS_VER3_VFE_OUT_STATS_BE,
+	CAM_VFE_BUS_VER3_VFE_OUT_GAMMA,
+	CAM_VFE_BUS_VER3_VFE_OUT_MAX,
+};
+
+/*
+ * struct cam_vfe_bus_ver3_reg_offset_common:
+ *
+ * @Brief:        Common registers across all BUS Clients
+ */
+struct cam_vfe_bus_ver3_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t cgc_ovd;
+	uint32_t comp_cfg_0;
+	uint32_t comp_cfg_1;
+	uint32_t if_frameheader_cfg[CAM_VFE_BUS_VER3_MAX_SUB_GRPS];
+	uint32_t ubwc_static_ctrl;
+	uint32_t pwr_iso_cfg;
+	uint32_t overflow_status_clear;
+	uint32_t ccif_violation_status;
+	uint32_t overflow_status;
+	uint32_t image_size_violation_status;
+	uint32_t debug_status_top_cfg;
+	uint32_t debug_status_top;
+	uint32_t test_bus_ctrl;
+	uint32_t top_irq_mask_0;
+	struct cam_irq_controller_reg_info irq_reg_info;
+};
+
+/*
+ * struct cam_vfe_bus_ver3_reg_offset_ubwc_client:
+ *
+ * @Brief:        UBWC register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver3_reg_offset_ubwc_client {
+	uint32_t meta_addr;
+	uint32_t meta_cfg;
+	uint32_t mode_cfg;
+	uint32_t stats_ctrl;
+	uint32_t ctrl_2;
+	uint32_t lossy_thresh0;
+	uint32_t lossy_thresh1;
+	uint32_t off_lossy_var;
+	uint32_t bw_limit;
+	uint32_t ubwc_comp_en_bit;
+};
+
+/*
+ * struct cam_vfe_bus_ver3_reg_offset_bus_client:
+ *
+ * @Brief:        Register offsets for BUS Clients
+ */
+struct cam_vfe_bus_ver3_reg_offset_bus_client {
+	uint32_t cfg;
+	uint32_t image_addr;
+	uint32_t frame_incr;
+	uint32_t image_cfg_0;
+	uint32_t image_cfg_1;
+	uint32_t image_cfg_2;
+	uint32_t packer_cfg;
+	uint32_t frame_header_addr;
+	uint32_t frame_header_incr;
+	uint32_t frame_header_cfg;
+	uint32_t line_done_cfg;
+	uint32_t irq_subsample_period;
+	uint32_t irq_subsample_pattern;
+	uint32_t framedrop_period;
+	uint32_t framedrop_pattern;
+	uint32_t mmu_prefetch_cfg;
+	uint32_t mmu_prefetch_max_offset;
+	uint32_t burst_limit;
+	uint32_t system_cache_cfg;
+	void    *ubwc_regs;
+	uint32_t addr_status_0;
+	uint32_t addr_status_1;
+	uint32_t addr_status_2;
+	uint32_t addr_status_3;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+	uint32_t comp_group;
+};
+
+/*
+ * struct cam_vfe_bus_ver3_vfe_out_hw_info:
+ *
+ * @Brief:        HW capability of VFE Bus Client
+ */
+struct cam_vfe_bus_ver3_vfe_out_hw_info {
+	enum cam_vfe_bus_ver3_vfe_out_type  vfe_out_type;
+	uint32_t                            max_width;
+	uint32_t                            max_height;
+	uint32_t                            source_group;
+	uint32_t                         mid[CAM_VFE_BUS_VER3_MAX_MID_PER_PORT];
+	uint32_t                            num_wm;
+	uint32_t                            wm_idx[PLANE_MAX];
+};
+
+/*
+ * struct cam_vfe_bus_ver3_hw_info:
+ *
+ * @Brief:            HW register info for entire Bus
+ *
+ * @common_reg:            Common register details
+ * @num_client:            Total number of write clients
+ * @bus_client_reg:        Bus client register info
+ * @vfe_out_hw_info:       VFE output capability
+ * @num_comp_grp:          Number of composite groups
+ * @comp_done_shift:       Mask shift for comp done mask
+ * @top_irq_shift:         Mask shift for top level BUS WR irq
+ * @support_consumed_addr: Indicate if bus support consumed address
+ * @max_out_res:           Max vfe out resource value supported for hw
+ * @supported_irq:         Mask to indicate the IRQ supported
+ * @comp_cfg_needed:       Composite group config is needed for hw
+ */
+struct cam_vfe_bus_ver3_hw_info {
+	struct cam_vfe_bus_ver3_reg_offset_common common_reg;
+	uint32_t num_client;
+	struct cam_vfe_bus_ver3_reg_offset_bus_client
+		bus_client_reg[CAM_VFE_BUS_VER3_680_MAX_CLIENTS];
+	uint32_t num_out;
+	struct cam_vfe_bus_ver3_vfe_out_hw_info
+		vfe_out_hw_info[CAM_VFE_BUS_VER3_VFE_OUT_MAX];
+	uint32_t num_comp_grp;
+	uint32_t comp_done_shift;
+	uint32_t top_irq_shift;
+	bool support_consumed_addr;
+	uint32_t max_out_res;
+	uint32_t supported_irq;
+	bool comp_cfg_needed;
+};
+
+/*
+ * cam_vfe_bus_ver3_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_ver3_init(
+	struct cam_hw_soc_info               *soc_info,
+	struct cam_hw_intf                   *hw_intf,
+	void                                 *bus_hw_info,
+	void                                 *vfe_irq_controller,
+	struct cam_vfe_bus                  **vfe_bus);
+
+/*
+ * cam_vfe_bus_ver3_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @vfe_bus:                 Pointer to vfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_ver3_deinit(struct cam_vfe_bus     **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_VER3_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/include/cam_vfe_bus.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/include/cam_vfe_bus.h
@@ -0,0 +1,99 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_BUS_H_
+#define _CAM_VFE_BUS_H_
+
+#include <media/cam_isp.h>
+
+#include "cam_hw_intf.h"
+#include "cam_isp_hw.h"
+
+#define CAM_VFE_BUS_VER_1_0             0x1000
+#define CAM_VFE_BUS_VER_2_0             0x2000
+#define CAM_VFE_BUS_VER_3_0             0x3000
+
+#define CAM_VFE_BUS_RD_VER_1_0          0x1000
+
+#define CAM_VFE_ADD_REG_VAL_PAIR(buf_array, index, offset, val)    \
+	do {                                               \
+		buf_array[(index)++] = offset;             \
+		buf_array[(index)++] = val;                \
+	} while (0)
+
+#define ALIGNUP(value, alignment) \
+	((value + alignment - 1) / alignment * alignment)
+
+enum cam_vfe_bus_plane_type {
+	PLANE_Y,
+	PLANE_C,
+	PLANE_MAX,
+};
+
+enum cam_vfe_bus_type {
+	BUS_TYPE_WR,
+	BUS_TYPE_RD,
+	BUS_TYPE_MAX,
+};
+
+/*
+ * struct cam_vfe_bus:
+ *
+ * @Brief:                   Bus interface structure
+ *
+ * @bus_priv:                Private data of BUS
+ * @hw_ops:                  Hardware interface functions
+ * @top_half_handler:        Top Half handler function
+ * @bottom_half_handler:     Bottom Half handler function
+ */
+struct cam_vfe_bus {
+	void               *bus_priv;
+
+	struct cam_hw_ops              hw_ops;
+	CAM_IRQ_HANDLER_TOP_HALF       top_half_handler;
+	CAM_IRQ_HANDLER_BOTTOM_HALF    bottom_half_handler;
+};
+
+/*
+ * cam_vfe_bus_init()
+ *
+ * @Brief:                   Initialize Bus layer
+ *
+ * @bus_version:             Version of BUS to initialize
+ * @bus_type:                Bus Type RD/WR
+ * @soc_info:                Soc Information for the associated HW
+ * @hw_intf:                 HW Interface of HW to which this resource belongs
+ * @bus_hw_info:             BUS HW info that contains details of BUS registers
+ * @vfe_irq_controller:      VFE IRQ Controller to use for subscribing to Top
+ *                           level IRQs
+ * @vfe_bus:                 Pointer to vfe_bus structure which will be filled
+ *                           and returned on successful initialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_init(uint32_t          bus_version,
+	int                            bus_type,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *bus_hw_info,
+	void                          *vfe_irq_controller,
+	struct cam_vfe_bus           **vfe_bus);
+
+/*
+ * cam_vfe_bus_deinit()
+ *
+ * @Brief:                   Deinitialize Bus layer
+ *
+ * @bus_version:             Version of BUS to deinitialize
+ * @vfe_bus:                 Pointer to vfe_bus structure to deinitialize
+ *
+ * @Return:                  0: Success
+ *                           Non-zero: Failure
+ */
+int cam_vfe_bus_deinit(uint32_t        bus_version,
+	struct cam_vfe_bus           **vfe_bus);
+
+#endif /* _CAM_VFE_BUS_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.c
@@ -0,0 +1,659 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_camif_lite_ver2.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+
+struct cam_vfe_mux_camif_lite_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_camif_lite_ver2_reg          *camif_lite_reg;
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_lite_ver2_reg_data     *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+	enum cam_isp_hw_sync_mode                    sync_mode;
+
+	cam_hw_mgr_event_cb_func              event_cb;
+	void                                 *priv;
+	int                                   irq_err_handle;
+	int                                   irq_handle;
+	void                                 *vfe_irq_controller;
+	struct cam_vfe_top_irq_evt_payload
+		evt_payload[CAM_VFE_CAMIF_LITE_EVT_MAX];
+	struct list_head                      free_payload_list;
+	spinlock_t                            spin_lock;
+	struct timespec64                     error_ts;
+};
+
+static int cam_vfe_camif_lite_get_evt_payload(
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&camif_lite_priv->spin_lock);
+	if (list_empty(&camif_lite_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&camif_lite_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&camif_lite_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_put_evt_payload(
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!camif_lite_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&camif_lite_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list,
+		&camif_lite_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&camif_lite_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_camif_lite_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	bool                                   error_flag = false;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x, IRQ status_1 = %x",
+		th_payload->evt_status_arr[0], th_payload->evt_status_arr[1]);
+
+	camif_lite_node = th_payload->handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[1] || (th_payload->evt_status_arr[0] &
+		camif_lite_priv->reg_data->lite_err_irq_mask0)) {
+		CAM_ERR(CAM_ISP,
+			"CAMIF LITE ERR VFE:%d IRQ STATUS_0=0x%x STATUS_1=0x%x",
+			camif_lite_node->hw_intf->hw_idx,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from VFE:%d",
+			camif_lite_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_irq(
+			camif_lite_priv->vfe_irq_controller,
+			camif_lite_priv->irq_err_handle);
+		cam_irq_controller_clear_and_mask(evt_id,
+			camif_lite_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_camif_lite_get_evt_payload(camif_lite_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ STATUS_0=0x%x STATUS_1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		camif_lite_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		camif_lite_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->violation_status);
+
+	if (error_flag)
+		CAM_INFO(CAM_ISP, "Violation status = 0x%x",
+			evt_payload->irq_reg_val[i]);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+
+static int cam_vfe_camif_lite_get_reg_update(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *cmd_args,
+	uint32_t                               arg_size)
+{
+	uint32_t                               size = 0;
+	uint32_t                               reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update      *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops              *cdm_util_ops = NULL;
+	struct cam_vfe_mux_camif_lite_data    *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	rsrc_data = camif_lite_res->res_priv;
+	reg_val_pair[0] = rsrc_data->camif_lite_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->dual_pd_reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "CAMIF Lite reg_update_cmd %x offset %x",
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_camif_lite_ver2_acquire_resource(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *acquire_param)
+{
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_data;
+	struct cam_vfe_acquire_args           *acquire_data;
+	int rc = 0;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_lite_data = (struct cam_vfe_mux_camif_lite_data *)
+		camif_lite_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	camif_lite_data->sync_mode   = acquire_data->vfe_in.sync_mode;
+	camif_lite_data->event_cb    = acquire_data->event_cb;
+	camif_lite_data->priv        = acquire_data->priv;
+
+	CAM_DBG(CAM_ISP, "hw id:%d sync_mode=%d",
+		camif_lite_res->hw_intf->hw_idx,
+		camif_lite_data->sync_mode);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_resource_start(
+	struct cam_isp_resource_node         *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data   *rsrc_data;
+	uint32_t                              val = 0;
+	int                                   rc = 0;
+	uint32_t err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_lite_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Invalid camif lite res res_state:%d",
+			camif_lite_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_vfe_mux_camif_lite_data *)
+		camif_lite_res->res_priv;
+
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->lite_err_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->lite_err_irq_mask1;
+
+	/* vfe core config */
+	val = cam_io_r_mb(rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg);
+
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	val |= (1 << rsrc_data->reg_data->dual_pd_path_sel_shift);
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg);
+
+	CAM_DBG(CAM_ISP, "hw id:%d core_cfg val:%d",
+		camif_lite_res->hw_intf->hw_idx, val);
+
+	/* epoch config with 20 line */
+	cam_io_w_mb(rsrc_data->reg_data->lite_epoch_line_cfg,
+		rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->lite_epoch_irq);
+
+	camif_lite_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->dual_pd_reg_update_cmd_data,
+		rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->reg_update_cmd);
+	CAM_DBG(CAM_ISP, "hw id:%d RUP val:%d",
+		camif_lite_res->hw_intf->hw_idx,
+		rsrc_data->reg_data->dual_pd_reg_update_cmd_data);
+
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			camif_lite_res,
+			cam_vfe_camif_lite_err_irq_top_half,
+			camif_lite_res->bottom_half_handler,
+			camif_lite_res->tasklet_info,
+			&tasklet_bh_api);
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	rsrc_data->error_ts.tv_sec = 0;
+	rsrc_data->error_ts.tv_nsec = 0;
+
+	CAM_DBG(CAM_ISP, "Start Camif Lite IFE %d Done",
+		camif_lite_res->hw_intf->hw_idx);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_resource_stop(
+	struct cam_isp_resource_node             *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv;
+	int                                       rc = 0;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_lite_priv = (struct cam_vfe_mux_camif_lite_data *)camif_lite_res;
+
+	if (camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		camif_lite_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	if (camif_lite_priv->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_lite_priv->vfe_irq_controller,
+			camif_lite_priv->irq_handle);
+		camif_lite_priv->irq_handle = 0;
+	}
+
+	if (camif_lite_priv->irq_err_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_lite_priv->vfe_irq_controller,
+			camif_lite_priv->irq_err_handle);
+		camif_lite_priv->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_lite_process_cmd(
+	struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_camif_lite_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_lite_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload  *evt_payload;
+
+	camif_lite_node = th_payload->handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x", th_payload->evt_status_arr[0]);
+	CAM_DBG(CAM_ISP, "IRQ status_1 = %x", th_payload->evt_status_arr[1]);
+
+	rc  = cam_vfe_camif_lite_get_evt_payload(camif_lite_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ status0=0x%x status1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_camif_lite_cpas_fifo_levels_reg_dump(
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv)
+{
+	int rc = 0;
+	struct cam_vfe_soc_private *soc_private =
+		camif_lite_priv->soc_info->soc_private;
+	uint32_t  val;
+
+	if (soc_private->cpas_version == CAM_CPAS_TITAN_175_V120 ||
+		soc_private->cpas_version == CAM_CPAS_TITAN_175_V130 ||
+		soc_private->cpas_version == CAM_CPAS_TITAN_165_V100) {
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x3A20, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"IFE0_nRDI_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP, "IFE0_nRDI_MAXWR_LOW offset 0x3A20 val 0x%x",
+			val);
+
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x5420, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"IFE1_nRDI_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP, "IFE1_nRDI_MAXWR_LOW offset 0x5420 val 0x%x",
+			val);
+
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x3620, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"IFE0123_RDI_WR_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP,
+			"IFE0123_RDI_WR_MAXWR_LOW offset 0x3620 val 0x%x", val);
+
+	} else if (soc_private->cpas_version < CAM_CPAS_TITAN_175_V120) {
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x420, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "IFE02_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP, "IFE02_MAXWR_LOW offset 0x420 val 0x%x", val);
+
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x820, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "IFE13_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP, "IFE13_MAXWR_LOW offset 0x820 val 0x%x", val);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_camif_lite_handle_irq_bottom_half(
+	void                                 *handler_priv,
+	void                                 *evt_payload_priv)
+{
+	int                                   ret = CAM_VFE_IRQ_STATUS_MAX;
+	struct cam_isp_resource_node         *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data   *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload   *payload;
+	struct cam_isp_hw_event_info          evt_info;
+	uint32_t                              irq_status0;
+	uint32_t                              irq_status1;
+	struct cam_hw_soc_info               *soc_info = NULL;
+	struct cam_vfe_soc_private           *soc_private = NULL;
+	struct timespec64                     ts;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	camif_lite_node = handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+	payload = evt_payload_priv;
+	irq_status0 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	irq_status1 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1];
+	soc_info = camif_lite_priv->soc_info;
+	soc_private =
+		(struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	evt_info.hw_idx   = camif_lite_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_lite_node->res_id;
+	evt_info.res_type = camif_lite_node->res_type;
+
+	CAM_DBG(CAM_ISP, "irq_status_0 = 0x%x irq_status_1 = 0x%x",
+		irq_status0, irq_status1);
+
+	if (irq_status0 & camif_lite_priv->reg_data->lite_sof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF Lite Received SOF",
+			evt_info.hw_idx);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_lite_priv->reg_data->lite_epoch0_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF Lite Received EPOCH",
+			evt_info.hw_idx);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_lite_priv->reg_data->dual_pd_reg_upd_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF Lite Received REG_UPDATE_ACK",
+			evt_info.hw_idx);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_lite_priv->reg_data->lite_eof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF Lite Received EOF",
+			evt_info.hw_idx);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if ((irq_status0 & camif_lite_priv->reg_data->lite_err_irq_mask0) ||
+		(irq_status1 & camif_lite_priv->reg_data->lite_err_irq_mask1)) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE Received ERROR",
+			evt_info.hw_idx);
+
+		cam_vfe_camif_lite_cpas_fifo_levels_reg_dump(camif_lite_priv);
+
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic time stamp seconds %lld:%lld",
+			ts.tv_sec, ts.tv_nsec/1000);
+		CAM_INFO(CAM_ISP,
+			"ERROR time %lld:%lld",
+			camif_lite_priv->error_ts.tv_sec,
+			camif_lite_priv->error_ts.tv_nsec/NSEC_PER_USEC);
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+
+		cam_cpas_log_votes();
+
+	}
+
+	cam_vfe_camif_lite_put_evt_payload(camif_lite_priv, &payload);
+
+	CAM_DBG(CAM_ISP, "returning status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_camif_lite_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_lite_hw_info,
+	struct cam_isp_resource_node  *camif_lite_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv = NULL;
+	struct cam_vfe_camif_lite_ver2_hw_info   *camif_lite_info =
+		camif_lite_hw_info;
+	int                                       i = 0;
+
+	camif_lite_priv = kzalloc(sizeof(*camif_lite_priv),
+		GFP_KERNEL);
+	if (!camif_lite_priv)
+		return -ENOMEM;
+
+	camif_lite_node->res_priv = camif_lite_priv;
+
+	camif_lite_priv->mem_base           =
+		soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	camif_lite_priv->camif_lite_reg     = camif_lite_info->camif_lite_reg;
+	camif_lite_priv->common_reg         = camif_lite_info->common_reg;
+	camif_lite_priv->reg_data           = camif_lite_info->reg_data;
+	camif_lite_priv->hw_intf            = hw_intf;
+	camif_lite_priv->soc_info           = soc_info;
+	camif_lite_priv->vfe_irq_controller = vfe_irq_controller;
+
+	camif_lite_node->init    = NULL;
+	camif_lite_node->deinit  = NULL;
+	camif_lite_node->start   = cam_vfe_camif_lite_resource_start;
+	camif_lite_node->stop    = cam_vfe_camif_lite_resource_stop;
+	camif_lite_node->process_cmd = cam_vfe_camif_lite_process_cmd;
+	camif_lite_node->top_half_handler =
+		cam_vfe_camif_lite_handle_irq_top_half;
+	camif_lite_node->bottom_half_handler =
+		cam_vfe_camif_lite_handle_irq_bottom_half;
+
+	spin_lock_init(&camif_lite_priv->spin_lock);
+	INIT_LIST_HEAD(&camif_lite_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_LITE_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&camif_lite_priv->evt_payload[i].list);
+		list_add_tail(&camif_lite_priv->evt_payload[i].list,
+			&camif_lite_priv->free_payload_list);
+	}
+
+	return 0;
+}
+
+int cam_vfe_camif_lite_ver2_deinit(
+	struct cam_isp_resource_node  *camif_lite_node)
+{
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv =
+		camif_lite_node->res_priv;
+	int                                 i = 0;
+
+	INIT_LIST_HEAD(&camif_lite_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_LITE_EVT_MAX; i++)
+		INIT_LIST_HEAD(&camif_lite_priv->evt_payload[i].list);
+
+	camif_lite_node->start = NULL;
+	camif_lite_node->stop  = NULL;
+	camif_lite_node->process_cmd = NULL;
+	camif_lite_node->top_half_handler = NULL;
+	camif_lite_node->bottom_half_handler = NULL;
+
+	camif_lite_node->res_priv = NULL;
+
+	if (!camif_lite_priv) {
+		CAM_ERR(CAM_ISP, "Error! camif_priv is NULL");
+		return -ENODEV;
+	}
+
+	kfree(camif_lite_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver2.h
@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CAMIF_LITE_VER2_H_
+#define _CAM_VFE_CAMIF_LITE_VER2_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+#define CAM_VFE_CAMIF_LITE_EVT_MAX     256
+
+struct cam_vfe_camif_lite_ver2_reg {
+	uint32_t     camif_lite_cmd;
+	uint32_t     camif_lite_config;
+	uint32_t     lite_skip_period;
+	uint32_t     lite_irq_subsample_pattern;
+	uint32_t     lite_epoch_irq;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_vfe_camif_lite_ver2_reg_data {
+	uint32_t     dual_pd_reg_update_cmd_data;
+	uint32_t     lite_epoch_line_cfg;
+	uint32_t     lite_sof_irq_mask;
+	uint32_t     lite_epoch0_irq_mask;
+	uint32_t     dual_pd_reg_upd_irq_mask;
+	uint32_t     lite_eof_irq_mask;
+	uint32_t     lite_err_irq_mask0;
+	uint32_t     lite_err_irq_mask1;
+	uint32_t     lite_subscribe_irq_mask0;
+	uint32_t     lite_subscribe_irq_mask1;
+	uint32_t     extern_reg_update_shift;
+	uint32_t     dual_pd_path_sel_shift;
+};
+
+struct cam_vfe_camif_lite_ver2_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_lite_ver2_reg          *camif_lite_reg;
+	struct cam_vfe_camif_lite_ver2_reg_data     *reg_data;
+};
+
+int cam_vfe_camif_lite_ver2_acquire_resource(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *acquire_param);
+
+int cam_vfe_camif_lite_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_lite_hw_info,
+	struct cam_isp_resource_node  *camif_lite_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_camif_lite_ver2_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_CAMIF_LITE_VER2_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.c
@@ -0,0 +1,1350 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_camif_lite_ver3.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_cpas_api.h"
+
+struct cam_vfe_mux_camif_lite_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_camif_lite_ver3_reg          *camif_lite_reg;
+	struct cam_vfe_top_ver3_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_lite_ver3_reg_data     *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+	enum cam_isp_hw_sync_mode                    sync_mode;
+	struct cam_vfe_camif_common_cfg              cam_common_cfg;
+
+	cam_hw_mgr_event_cb_func                     event_cb;
+	void                                        *priv;
+	int                                          irq_err_handle;
+	int                                          irq_handle;
+	int                                          sof_irq_handle;
+	void                                        *vfe_irq_controller;
+	struct list_head                             free_payload_list;
+	spinlock_t                                   spin_lock;
+	uint32_t                                     camif_debug;
+	struct cam_vfe_top_irq_evt_payload
+		evt_payload[CAM_VFE_CAMIF_LITE_EVT_MAX];
+	struct timespec64                            sof_ts;
+	struct timespec64                            epoch_ts;
+	struct timespec64                            eof_ts;
+	struct timespec64                            error_ts;
+};
+
+static int cam_vfe_camif_lite_get_evt_payload(
+	struct cam_vfe_mux_camif_lite_data     *camif_lite_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&camif_lite_priv->spin_lock);
+	if (list_empty(&camif_lite_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free CAMIF LITE event payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&camif_lite_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&camif_lite_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_put_evt_payload(
+	struct cam_vfe_mux_camif_lite_data     *camif_lite_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!camif_lite_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&camif_lite_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list,
+		&camif_lite_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&camif_lite_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_camif_lite_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	struct cam_vfe_soc_private            *soc_private = NULL;
+	bool                                   error_flag = false;
+
+	camif_lite_node = th_payload->handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+
+	soc_private = camif_lite_priv->soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[2] || (th_payload->evt_status_arr[0] &
+		camif_lite_priv->reg_data->error_irq_mask0)) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d CAMIF LITE:%d Err IRQ status_1: 0x%X status_2: 0x%X",
+			camif_lite_node->hw_intf->hw_idx,
+			camif_lite_node->res_id,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[2]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from VFE:%d",
+			camif_lite_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_irq(
+			camif_lite_priv->vfe_irq_controller,
+			camif_lite_priv->irq_err_handle);
+		cam_irq_controller_clear_and_mask(evt_id,
+			camif_lite_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_camif_lite_get_evt_payload(camif_lite_priv, &evt_payload);
+	if (rc)
+		return rc;
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		camif_lite_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		camif_lite_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->violation_status);
+
+	evt_payload->irq_reg_val[++i] = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->bus_overflow_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+
+static int cam_vfe_camif_lite_get_reg_update(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *cmd_args,
+	uint32_t                               arg_size)
+{
+	uint32_t                               size = 0;
+	uint32_t                               reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update      *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops              *cdm_util_ops = NULL;
+	struct cam_vfe_mux_camif_lite_data    *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP,
+			"Invalid args: cdm args %pK", cdm_args);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CAMIF LITE:%d get RUP", camif_lite_res->res_id);
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	rsrc_data = camif_lite_res->res_priv;
+	reg_val_pair[0] = rsrc_data->camif_lite_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "CAMIF LITE:%d reg_update_cmd 0x%X offset 0x%X",
+		camif_lite_res->res_id, reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_camif_lite_ver3_acquire_resource(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *acquire_param)
+{
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_data;
+	struct cam_vfe_acquire_args           *acquire_data;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_lite_data = (struct cam_vfe_mux_camif_lite_data *)
+		camif_lite_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	camif_lite_data->sync_mode   = acquire_data->vfe_in.sync_mode;
+	camif_lite_data->event_cb    = acquire_data->event_cb;
+	camif_lite_data->priv        = acquire_data->priv;
+	camif_lite_res->rdi_only_ctx = 0;
+	CAM_DBG(CAM_ISP, "Acquired VFE:%d CAMIF LITE:%d sync_mode=%d",
+		camif_lite_res->hw_intf->hw_idx,
+		camif_lite_res->res_id,
+		camif_lite_data->sync_mode);
+	return 0;
+}
+
+static int cam_vfe_camif_lite_resource_start(
+	struct cam_isp_resource_node         *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data   *rsrc_data;
+	struct cam_vfe_soc_private           *soc_private = NULL;
+	uint32_t                              val = 0;
+	int                                   rc = 0;
+	uint32_t err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_lite_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Invalid camif lite res res_state:%d",
+			camif_lite_res->res_state);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "CAMIF LITE:%d Start", camif_lite_res->res_id);
+
+	rsrc_data = (struct cam_vfe_mux_camif_lite_data *)
+		camif_lite_res->res_priv;
+
+	soc_private = rsrc_data->soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	if (soc_private->is_ife_lite)
+		goto skip_core_cfg;
+
+	/* vfe core config */
+	val = cam_io_r_mb(rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	if (camif_lite_res->res_id == CAM_ISP_HW_VFE_IN_LCR &&
+		rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	if (camif_lite_res->res_id == CAM_ISP_HW_VFE_IN_PDLIB) {
+		val |= (1 << rsrc_data->reg_data->operating_mode_shift);
+		val |= (rsrc_data->cam_common_cfg.input_mux_sel_pdaf & 0x1) <<
+			CAM_SHIFT_TOP_CORE_CFG_MUXSEL_PDAF;
+	}
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	CAM_DBG(CAM_ISP, "VFE:%d core_cfg val:%d",
+		camif_lite_res->hw_intf->hw_idx, val);
+
+	/* epoch config */
+	cam_io_w_mb(rsrc_data->reg_data->epoch_line_cfg,
+		rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->lite_epoch_irq);
+
+	rsrc_data->error_ts.tv_sec = 0;
+	rsrc_data->error_ts.tv_nsec = 0;
+	rsrc_data->sof_ts.tv_sec = 0;
+	rsrc_data->sof_ts.tv_nsec = 0;
+	rsrc_data->epoch_ts.tv_sec = 0;
+	rsrc_data->epoch_ts.tv_nsec = 0;
+	rsrc_data->eof_ts.tv_sec = 0;
+	rsrc_data->eof_ts.tv_nsec = 0;
+
+skip_core_cfg:
+
+	camif_lite_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->reg_update_cmd);
+
+	memset(err_irq_mask, 0, sizeof(err_irq_mask));
+	memset(irq_mask, 0, sizeof(irq_mask));
+
+	/* config debug status registers */
+	cam_io_w_mb(rsrc_data->reg_data->top_debug_cfg_en, rsrc_data->mem_base +
+		rsrc_data->common_reg->top_debug_cfg);
+
+	if (!camif_lite_res->rdi_only_ctx)
+		goto subscribe_err;
+
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->epoch0_irq_mask |
+		rsrc_data->reg_data->eof_irq_mask;
+
+	if (!rsrc_data->irq_handle) {
+		rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_3,
+			irq_mask,
+			camif_lite_res,
+			camif_lite_res->top_half_handler,
+			camif_lite_res->bottom_half_handler,
+			camif_lite_res->tasklet_info,
+			&tasklet_bh_api);
+		if (rsrc_data->irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_handle = 0;
+		}
+	}
+
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+			rsrc_data->reg_data->sof_irq_mask;
+
+	if (!rsrc_data->sof_irq_handle) {
+		rsrc_data->sof_irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			irq_mask,
+			camif_lite_res,
+			camif_lite_res->top_half_handler,
+			camif_lite_res->bottom_half_handler,
+			camif_lite_res->tasklet_info,
+			&tasklet_bh_api);
+		if (rsrc_data->sof_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->sof_irq_handle = 0;
+		}
+	}
+
+subscribe_err:
+
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->error_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS2] =
+		rsrc_data->reg_data->error_irq_mask2;
+
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			camif_lite_res,
+			cam_vfe_camif_lite_err_irq_top_half,
+			camif_lite_res->bottom_half_handler,
+			camif_lite_res->tasklet_info,
+			&tasklet_bh_api);
+
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d Start Done",
+		camif_lite_res->hw_intf->hw_idx,
+		camif_lite_res->res_id);
+	return rc;
+}
+
+static int cam_vfe_camif_lite_reg_dump(
+	struct cam_isp_resource_node *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv;
+	struct cam_vfe_soc_private         *soc_private = NULL;
+	uint32_t offset, val, wm_idx;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_lite_priv =
+		(struct cam_vfe_mux_camif_lite_data *)camif_lite_res->res_priv;
+
+	soc_private = camif_lite_priv->soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d TOP", camif_lite_priv->hw_intf->hw_idx);
+	if (!soc_private->is_ife_lite) {
+		for (offset = 0x0; offset <= 0x1FC; offset += 0x4) {
+			if (offset == 0x1C || offset == 0x34 ||
+				offset == 0x38 || offset == 0x90)
+				continue;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+		}
+	} else {
+		for (offset = 0x0; offset <= 0x74; offset += 0x4) {
+			if (offset == 0xC || offset == 0x20 || offset == 0x24)
+				continue;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+		}
+	}
+
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_RDI0)
+		goto dump_rdi_1;
+
+	CAM_INFO(CAM_ISP, "IFE:%d RDI0 CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	if (!soc_private->is_ife_lite) {
+		for (offset = 0x9A00; offset <= 0x9BFC; offset += 0x4) {
+			if (offset == 0x9A08)
+				offset = 0x9A60;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x9A60)
+				offset = 0x9A64;
+			else if (offset == 0x9A70)
+				offset = 0x9AEC;
+		}
+	} else {
+		for (offset = 0x1200; offset <= 0x13FC; offset += 0x4) {
+			if (offset == 0x1208)
+				offset = 0x1260;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x1260)
+				offset = 0x1264;
+			else if (offset == 0x1270)
+				offset = 0x12EC;
+		}
+	}
+
+	goto wr_dump;
+
+dump_rdi_1:
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_RDI1)
+		goto dump_rdi_2;
+
+	CAM_INFO(CAM_ISP, "IFE:%d RDI1 CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	if (!soc_private->is_ife_lite) {
+		for (offset = 0x9C00; offset <= 0x9DFC; offset += 0x4) {
+			if (offset == 0x9A08)
+				offset = 0x9A60;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x9A60)
+				offset = 0x9A64;
+			else if (offset == 0x9A70)
+				offset = 0x9BEC;
+		}
+	} else {
+		for (offset = 0x1400; offset <= 0x15FC; offset += 0x4) {
+			if (offset == 0x1408)
+				offset = 0x1460;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x1460)
+				offset = 0x1464;
+			else if (offset == 0x1470)
+				offset = 0x15EC;
+		}
+	}
+
+	goto wr_dump;
+
+dump_rdi_2:
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_RDI2)
+		goto dump_rdi_3;
+
+	CAM_INFO(CAM_ISP, "IFE:%d RDI2 CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	if (!soc_private->is_ife_lite) {
+		for (offset = 0x9E00; offset <= 0x9FFC; offset += 0x4) {
+			if (offset == 0x9E08)
+				offset = 0x9E60;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x9E60)
+				offset = 0x9E64;
+			else if (offset == 0x9E80)
+				offset = 0x9FEC;
+		}
+	} else {
+		for (offset = 0x1600; offset <= 0x17FC; offset += 0x4) {
+			if (offset == 0x1608)
+				offset = 0x1660;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x1660)
+				offset = 0x1664;
+			else if (offset == 0x1670)
+				offset = 0x17EC;
+		}
+	}
+
+	goto wr_dump;
+
+dump_rdi_3:
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_RDI3)
+		goto dump_pdlib;
+
+	CAM_INFO(CAM_ISP, "IFE:%d RDI3 CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	if (soc_private->is_ife_lite) {
+		for (offset = 0x1800; offset <= 0x19FC; offset += 0x4) {
+			if (offset == 0x1808)
+				offset = 0x1860;
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+			if (offset == 0x1860)
+				offset = 0x1864;
+			else if (offset == 0x1870)
+				offset = 0x19EC;
+		}
+	}
+
+	goto wr_dump;
+
+dump_pdlib:
+	if (camif_lite_res->res_id != CAM_ISP_HW_VFE_IN_PDLIB)
+		goto dump_lcr;
+
+	CAM_INFO(CAM_ISP, "IFE:%d PDLIB CAMIF",
+		camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0xA400; offset <= 0xA5FC; offset += 0x4) {
+		if (offset == 0xA408)
+			offset = 0xA460;
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+			offset, val);
+		if (offset == 0xA460)
+			offset = 0xA464;
+		else if (offset == 0xA470)
+			offset = 0xA5EC;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d CLC PDLIB",
+		camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0xA600; offset <= 0xA718; offset += 0x4) {
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	goto wr_dump;
+
+dump_lcr:
+	CAM_INFO(CAM_ISP, "IFE:%d LCR CAMIF", camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0xA000; offset <= 0xA1FC; offset += 0x4) {
+		if (offset == 0xA008)
+			offset = 0xA060;
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+			offset, val);
+		if (offset == 0xA060)
+			offset = 0xA064;
+		else if (offset == 0xA070)
+			offset = 0xA1EC;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d CLC LCR", camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0xA200; offset <= 0xA3FC; offset += 0x4) {
+		if (offset == 0xA208)
+			offset = 0xA260;
+		else if (offset == 0xA288)
+			offset = 0xA3F8;
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+			offset, val);
+		if (offset == 0xA260)
+			offset = 0xA264;
+		else if (offset == 0xA280)
+			offset = 0xA1EC;
+	}
+
+wr_dump:
+	if (!soc_private->is_ife_lite)
+		goto end_dump;
+
+	CAM_INFO(CAM_ISP, "IFE:%d LITE BUS WR",
+		camif_lite_priv->hw_intf->hw_idx);
+	for (offset = 0x1A00; offset <= 0x1AE0; offset += 0x4) {
+		val = cam_soc_util_r(camif_lite_priv->soc_info, 0, offset);
+		CAM_DBG(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	for (wm_idx = 0; wm_idx <= 3; wm_idx++) {
+		for (offset = 0x1C00 + 0x100 * wm_idx; offset < (0x1C00 +
+			0x100 * wm_idx + 0x84); offset += 0x4) {
+			val = cam_soc_util_r(camif_lite_priv->soc_info,
+				0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+		}
+	}
+
+end_dump:
+	return 0;
+}
+
+static int cam_vfe_camif_lite_resource_stop(
+	struct cam_isp_resource_node             *camif_lite_res)
+{
+	struct cam_vfe_mux_camif_lite_data       *rsrc_data;
+	int                                       rc = 0;
+
+	if (!camif_lite_res) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d Stop",
+		camif_lite_res->hw_intf->hw_idx,
+		camif_lite_res->res_id);
+
+	if ((camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	rsrc_data =
+		(struct cam_vfe_mux_camif_lite_data *)camif_lite_res->res_priv;
+
+	/* Disable Camif */
+	cam_io_w_mb(0x0, rsrc_data->mem_base +
+		rsrc_data->camif_lite_reg->lite_module_config);
+
+	if (camif_lite_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		camif_lite_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	if (rsrc_data->irq_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			rsrc_data->irq_handle);
+		rsrc_data->irq_handle = 0;
+	}
+
+	if (rsrc_data->sof_irq_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			rsrc_data->sof_irq_handle);
+		rsrc_data->sof_irq_handle = 0;
+	}
+
+	if (rsrc_data->irq_err_handle > 0) {
+		cam_irq_controller_unsubscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			rsrc_data->irq_err_handle);
+		rsrc_data->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_lite_ver3_core_config(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv;
+	struct cam_vfe_core_config_args *vfe_core_cfg =
+		(struct cam_vfe_core_config_args *)cmd_args;
+
+	camif_lite_priv =
+		(struct cam_vfe_mux_camif_lite_data *)rsrc_node->res_priv;
+	camif_lite_priv->cam_common_cfg.vid_ds16_r2pd =
+		vfe_core_cfg->core_config.vid_ds16_r2pd;
+	camif_lite_priv->cam_common_cfg.vid_ds4_r2pd =
+		vfe_core_cfg->core_config.vid_ds4_r2pd;
+	camif_lite_priv->cam_common_cfg.disp_ds16_r2pd =
+		vfe_core_cfg->core_config.disp_ds16_r2pd;
+	camif_lite_priv->cam_common_cfg.disp_ds4_r2pd =
+		vfe_core_cfg->core_config.disp_ds4_r2pd;
+	camif_lite_priv->cam_common_cfg.dsp_streaming_tap_point =
+		vfe_core_cfg->core_config.dsp_streaming_tap_point;
+	camif_lite_priv->cam_common_cfg.ihist_src_sel =
+		vfe_core_cfg->core_config.ihist_src_sel;
+	camif_lite_priv->cam_common_cfg.hdr_be_src_sel =
+		vfe_core_cfg->core_config.hdr_be_src_sel;
+	camif_lite_priv->cam_common_cfg.hdr_bhist_src_sel =
+		vfe_core_cfg->core_config.hdr_bhist_src_sel;
+	camif_lite_priv->cam_common_cfg.input_mux_sel_pdaf =
+		vfe_core_cfg->core_config.input_mux_sel_pdaf;
+	camif_lite_priv->cam_common_cfg.input_mux_sel_pp =
+		vfe_core_cfg->core_config.input_mux_sel_pp;
+
+	return 0;
+}
+
+static int cam_vfe_camif_lite_process_cmd(
+	struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv = NULL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_camif_lite_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = cam_vfe_camif_lite_ver3_core_config(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		camif_lite_priv = (struct cam_vfe_mux_camif_lite_data *)
+			rsrc_node->res_priv;
+		camif_lite_priv->camif_debug = *((uint32_t *)cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static void cam_vfe_camif_lite_overflow_debug_info(
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv)
+{
+	struct cam_vfe_soc_private *soc_private = NULL;
+	uint32_t val0, val1, val2, val3;
+
+	soc_private = camif_lite_priv->soc_info->soc_private;
+
+	val0 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_0);
+	val1 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_1);
+	val2 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_2);
+	val3 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_3);
+	CAM_INFO(CAM_ISP,
+		"status_0: 0x%X status_1: 0x%X status_2: 0x%X status_3: 0x%X",
+		val0, val1, val2, val3);
+
+	if (soc_private->is_ife_lite)
+		return;
+
+	val0 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_4);
+	val1 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_5);
+	val2 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_6);
+	val3 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_7);
+	CAM_INFO(CAM_ISP,
+		"status_4: 0x%X status_5: 0x%X status_6: 0x%X status_7: 0x%X",
+		val0, val1, val2, val3);
+	val0 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_8);
+	val1 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_9);
+	val2 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_10);
+	val3 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_11);
+	CAM_INFO(CAM_ISP,
+		"status_8: 0x%X status_9: 0x%X status_10: 0x%X status_11: 0x%X",
+		val0, val1, val2, val3);
+	val0 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_12);
+	val1 = cam_io_r(camif_lite_priv->mem_base +
+		camif_lite_priv->common_reg->top_debug_13);
+	CAM_INFO(CAM_ISP, "status_12: 0x%X status_13: 0x%X",
+		val0, val1);
+}
+
+static void cam_vfe_camif_lite_print_status(uint32_t *status,
+	int err_type, struct cam_vfe_mux_camif_lite_data *camif_lite_priv)
+{
+	uint32_t violation_mask = 0x3F00, violation_status = 0;
+	uint32_t bus_overflow_status = 0, status_0 = 0, status_2 = 0;
+	struct cam_vfe_soc_private *soc_private = NULL;
+	uint32_t val0, val1, val2, val3, val4;
+	uint32_t camera_hw_version;
+	int rc = 0;
+
+	val3 = val4 = 0;
+
+	if (!status) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return;
+	}
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc:%d", rc);
+		return;
+	}
+
+	bus_overflow_status = status[CAM_IFE_IRQ_BUS_OVERFLOW_STATUS];
+	violation_status = status[CAM_IFE_IRQ_VIOLATION_STATUS];
+	status_0 = status[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	status_2 = status[CAM_IFE_IRQ_CAMIF_REG_STATUS2];
+	soc_private = camif_lite_priv->soc_info->soc_private;
+
+	if (soc_private->is_ife_lite)
+		goto ife_lite;
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) {
+		if (status_0 & 0x200000)
+			CAM_INFO(CAM_ISP, "RDI2 FRAME DROP");
+
+		if (status_0 & 0x400000)
+			CAM_INFO(CAM_ISP, "RDI1 FRAME DROP");
+
+		if (status_0 & 0x800000)
+			CAM_INFO(CAM_ISP, "RDI0 FRAME DROP");
+
+		if (status_0 & 0x1000000)
+			CAM_INFO(CAM_ISP, "PD PIPE FRAME DROP");
+
+		if (status_0 & 0x8000000)
+			CAM_INFO(CAM_ISP, "RDI2 OVERFLOW");
+
+		if (status_0 & 0x10000000)
+			CAM_INFO(CAM_ISP, "RDI1 OVERFLOW");
+
+		if (status_0 & 0x20000000)
+			CAM_INFO(CAM_ISP, "RDI0 OVERFLOW");
+
+		if (status_0 & 0x40000000) {
+			CAM_INFO(CAM_ISP, "PD PIPE OVERFLOW");
+			cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x1010, true, &val3);
+			CAM_INFO(CAM_ISP, "ife_rdi_Rd: 0x%x", val3);
+			cam_cpas_log_votes();
+		}
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && bus_overflow_status) {
+		if (bus_overflow_status & 0x0800)
+			CAM_INFO(CAM_ISP, "CAMIF PD BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0400000)
+			CAM_INFO(CAM_ISP, "LCR BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0800000)
+			CAM_INFO(CAM_ISP, "RDI0 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x01000000)
+			CAM_INFO(CAM_ISP, "RDI1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x02000000)
+			CAM_INFO(CAM_ISP, "RDI2 BUS OVERFLOW");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && !bus_overflow_status) {
+		CAM_INFO(CAM_ISP, "PDLIB / LCR Module hang");
+		/* print debug registers */
+		cam_vfe_camif_lite_overflow_debug_info(camif_lite_priv);
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION) {
+		if (status_2 & 0x02000)
+			CAM_INFO(CAM_ISP, "PD CAMIF VIOLATION");
+
+		if (status_2 & 0x04000)
+			CAM_INFO(CAM_ISP, "PD VIOLATION");
+
+		if (status_2 & 0x08000)
+			CAM_INFO(CAM_ISP, "LCR CAMIF VIOLATION");
+
+		if (status_2 & 0x010000)
+			CAM_INFO(CAM_ISP, "LCR VIOLATION");
+
+		if (status_2 & 0x020000)
+			CAM_INFO(CAM_ISP, "RDI0 CAMIF VIOLATION");
+
+		if (status_2 & 0x040000)
+			CAM_INFO(CAM_ISP, "RDI1 CAMIF VIOLATION");
+
+		if (status_2 & 0x080000)
+			CAM_INFO(CAM_ISP, "RDI2 CAMIF VIOLATION");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION && violation_status) {
+		if (violation_mask & violation_status)
+			CAM_INFO(CAM_ISP, "LCR VIOLATION Module ID:%d",
+				violation_mask & violation_status);
+
+		violation_mask = 0x0F0000;
+		if (violation_mask & violation_status)
+			CAM_INFO(CAM_ISP, "PD VIOLATION Module ID:%d",
+				violation_mask & violation_status);
+
+	}
+
+	goto print_state;
+
+ife_lite:
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) {
+		if (status_0 & 0x100)
+			CAM_INFO(CAM_ISP, "RDI3 FRAME DROP");
+
+		if (status_0 & 0x80)
+			CAM_INFO(CAM_ISP, "RDI2 FRAME DROP");
+
+		if (status_0 & 0x40)
+			CAM_INFO(CAM_ISP, "RDI1 FRAME DROP");
+
+		if (status_0 & 0x20)
+			CAM_INFO(CAM_ISP, "RDI0 FRAME DROP");
+
+		if (status_0 & 0x8)
+			CAM_INFO(CAM_ISP, "RDI3 OVERFLOW");
+
+		if (status_0 & 0x4)
+			CAM_INFO(CAM_ISP, "RDI2 OVERFLOW");
+
+		if (status_0 & 0x2)
+			CAM_INFO(CAM_ISP, "RDI1 OVERFLOW");
+
+		if (status_0 & 0x1)
+			CAM_INFO(CAM_ISP, "RDI0 OVERFLOW");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && bus_overflow_status) {
+		if (bus_overflow_status & 0x01)
+			CAM_INFO(CAM_ISP, "RDI0 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x02)
+			CAM_INFO(CAM_ISP, "RDI1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x04)
+			CAM_INFO(CAM_ISP, "RDI2 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x08)
+			CAM_INFO(CAM_ISP, "RDI3 BUS OVERFLOW");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && !bus_overflow_status) {
+		CAM_INFO(CAM_ISP, "RDI hang");
+		/* print debug registers */
+		cam_vfe_camif_lite_overflow_debug_info(camif_lite_priv);
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION) {
+		if (status_2 & 0x100)
+			CAM_INFO(CAM_ISP, "RDI0 CAMIF VIOLATION");
+
+		if (status_2 & 0x200)
+			CAM_INFO(CAM_ISP, "RDI1 CAMIF VIOLATION");
+
+		if (status_2 & 0x400)
+			CAM_INFO(CAM_ISP, "RDI2 CAMIF VIOLATION");
+
+		if (status_2 & 0x800)
+			CAM_INFO(CAM_ISP, "RDI3 CAMIF VIOLATION");
+	}
+
+print_state:
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0xA20, true, &val0);
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0x1420, true, &val1);
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0x1A20, true, &val2);
+
+	if (camera_hw_version == CAM_CPAS_TITAN_580_V100) {
+		cam_cpas_reg_read(soc_private->cpas_handle,
+			CAM_CPAS_REG_CAMNOC, 0x7620, true, &val3);
+		cam_cpas_reg_read(soc_private->cpas_handle,
+			CAM_CPAS_REG_CAMNOC, 0x7420, true, &val4);
+	}
+
+	CAM_INFO(CAM_ISP,
+		"CAMNOC REG[Queued Pending] linear[%d %d] rdi0_wr[%d %d] ubwc_stats0[%d %d] ubwc_stats1[%d %d] rdi1_wr[%d %d]",
+		(val0 & 0x7FF), (val0 & 0x7F0000) >> 16,
+		(val1 & 0x7FF), (val1 & 0x7F0000) >> 16,
+		(val2 & 0x7FF), (val2 & 0x7F0000) >> 16,
+		(val3 & 0x7FF), (val3 & 0x7F0000) >> 16,
+		(val4 & 0x7FF), (val4 & 0x7F0000) >> 16);
+
+	CAM_INFO(CAM_ISP, "ife_clk_src:%lld", soc_private->ife_clk_src);
+
+	if ((err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) &&
+		bus_overflow_status)
+		cam_cpas_log_votes();
+
+}
+
+static int cam_vfe_camif_lite_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data    *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+
+	camif_lite_node = th_payload->handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d CAMIF LITE:%d IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+		camif_lite_node->hw_intf->hw_idx,
+		camif_lite_node->res_id,
+		th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1],
+		th_payload->evt_status_arr[2]);
+
+	rc  = cam_vfe_camif_lite_get_evt_payload(camif_lite_priv, &evt_payload);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"VFE:%d CAMIF LITE:%d IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+			camif_lite_node->hw_intf->hw_idx,
+			camif_lite_node->res_id,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1],
+			th_payload->evt_status_arr[2]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_camif_lite_handle_irq_bottom_half(
+	void                                    *handler_priv,
+	void                                    *evt_payload_priv)
+{
+	int ret = CAM_VFE_IRQ_STATUS_MAX;
+	struct cam_isp_resource_node *camif_lite_node;
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv;
+	struct cam_vfe_top_irq_evt_payload *payload;
+	struct cam_isp_hw_event_info evt_info;
+	struct cam_vfe_soc_private *soc_private = NULL;
+	uint32_t irq_status[CAM_IFE_IRQ_REGISTERS_MAX] = {0};
+	int i = 0;
+	uint32_t status_0 = 0;
+	struct timespec64 ts;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	camif_lite_node = handler_priv;
+	camif_lite_priv = camif_lite_node->res_priv;
+	payload         = evt_payload_priv;
+
+	soc_private = camif_lite_priv->soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	for (i = 0; i < CAM_IFE_IRQ_REGISTERS_MAX; i++)
+		irq_status[i] = payload->irq_reg_val[i];
+
+	evt_info.hw_idx   = camif_lite_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_lite_node->res_id;
+	evt_info.res_type = camif_lite_node->res_type;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d CAMIF LITE:%d IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+		evt_info.hw_idx, evt_info.res_id,
+		irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0],
+		irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1],
+		irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS2]);
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_lite_priv->reg_data->sof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d Received SOF",
+			evt_info.hw_idx, evt_info.res_id);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+		camif_lite_priv->sof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_lite_priv->sof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_lite_priv->reg_data->epoch0_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d Received EPOCH",
+			evt_info.hw_idx, evt_info.res_id);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+		camif_lite_priv->epoch_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_lite_priv->epoch_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_lite_priv->reg_data->eof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d Received EOF",
+			evt_info.hw_idx, evt_info.res_id);
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+		camif_lite_priv->eof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_lite_priv->eof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+	}
+
+	status_0 = irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+		& camif_lite_priv->reg_data->error_irq_mask0;
+	if (status_0) {
+		CAM_ERR(CAM_ISP, "VFE:%d Overflow",
+			camif_lite_node->hw_intf->hw_idx);
+
+		evt_info.err_type = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic time stamp seconds %lld:%lld",
+			ts.tv_sec, ts.tv_nsec/1000);
+		CAM_INFO(CAM_ISP,
+			"ERROR time %lld:%lld",
+			camif_lite_priv->error_ts.tv_sec,
+			camif_lite_priv->error_ts.tv_nsec);
+
+		if (camif_lite_node->rdi_only_ctx)
+			CAM_INFO(CAM_ISP,
+				"SOF %lld:%lld EPOCH %lld:%lld EOF %lld:%lld",
+				camif_lite_priv->sof_ts.tv_sec,
+				camif_lite_priv->sof_ts.tv_nsec,
+				camif_lite_priv->epoch_ts.tv_sec,
+				camif_lite_priv->epoch_ts.tv_nsec,
+				camif_lite_priv->eof_ts.tv_sec,
+				camif_lite_priv->eof_ts.tv_nsec);
+
+		if (status_0 & 0x8000000)
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_2;
+
+		if (status_0 & 0x10000000)
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_1;
+
+		if (status_0 & 0x20000000)
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_0;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_vfe_camif_lite_print_status(irq_status, ret,
+			camif_lite_priv);
+
+		if (camif_lite_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_lite_reg_dump(camif_lite_node);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS2]) {
+		CAM_ERR(CAM_ISP, "VFE:%d Violation",
+			camif_lite_node->hw_intf->hw_idx);
+
+		evt_info.err_type = CAM_VFE_IRQ_STATUS_VIOLATION;
+
+		if (camif_lite_priv->event_cb)
+			camif_lite_priv->event_cb(camif_lite_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_VIOLATION;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_vfe_camif_lite_print_status(irq_status, ret,
+			camif_lite_priv);
+
+		if (camif_lite_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_lite_reg_dump(camif_lite_node);
+	}
+
+	cam_vfe_camif_lite_put_evt_payload(camif_lite_priv, &payload);
+
+	CAM_DBG(CAM_ISP, "returning status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_camif_lite_ver3_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_lite_hw_info,
+	struct cam_isp_resource_node  *camif_lite_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_camif_lite_data       *camif_lite_priv = NULL;
+	struct cam_vfe_camif_lite_ver3_hw_info   *camif_lite_info =
+		camif_lite_hw_info;
+	int                                       i = 0;
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d Init",
+		camif_lite_node->res_id, camif_lite_node->res_id);
+
+	camif_lite_priv = kzalloc(sizeof(*camif_lite_priv),
+		GFP_KERNEL);
+	if (!camif_lite_priv)
+		return -ENOMEM;
+
+	camif_lite_node->res_priv = camif_lite_priv;
+
+	camif_lite_priv->mem_base         =
+		soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	camif_lite_priv->camif_lite_reg     = camif_lite_info->camif_lite_reg;
+	camif_lite_priv->common_reg         = camif_lite_info->common_reg;
+	camif_lite_priv->reg_data           = camif_lite_info->reg_data;
+	camif_lite_priv->hw_intf            = hw_intf;
+	camif_lite_priv->soc_info           = soc_info;
+	camif_lite_priv->vfe_irq_controller = vfe_irq_controller;
+
+	camif_lite_node->init    = NULL;
+	camif_lite_node->deinit  = NULL;
+	camif_lite_node->start   = cam_vfe_camif_lite_resource_start;
+	camif_lite_node->stop    = cam_vfe_camif_lite_resource_stop;
+	camif_lite_node->process_cmd = cam_vfe_camif_lite_process_cmd;
+	camif_lite_node->top_half_handler =
+		cam_vfe_camif_lite_handle_irq_top_half;
+	camif_lite_node->bottom_half_handler =
+		cam_vfe_camif_lite_handle_irq_bottom_half;
+
+	spin_lock_init(&camif_lite_priv->spin_lock);
+	INIT_LIST_HEAD(&camif_lite_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_LITE_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&camif_lite_priv->evt_payload[i].list);
+		list_add_tail(&camif_lite_priv->evt_payload[i].list,
+			&camif_lite_priv->free_payload_list);
+	}
+
+	return 0;
+}
+
+int cam_vfe_camif_lite_ver3_deinit(
+	struct cam_isp_resource_node  *camif_lite_node)
+{
+	struct cam_vfe_mux_camif_lite_data *camif_lite_priv =
+		camif_lite_node->res_priv;
+	int                                 i = 0;
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF LITE:%d Deinit",
+		camif_lite_node->hw_intf->hw_idx, camif_lite_node->res_id);
+
+	INIT_LIST_HEAD(&camif_lite_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_LITE_EVT_MAX; i++)
+		INIT_LIST_HEAD(&camif_lite_priv->evt_payload[i].list);
+
+	camif_lite_node->start = NULL;
+	camif_lite_node->stop  = NULL;
+	camif_lite_node->process_cmd = NULL;
+	camif_lite_node->top_half_handler = NULL;
+	camif_lite_node->bottom_half_handler = NULL;
+
+	camif_lite_node->res_priv = NULL;
+
+	if (!camif_lite_priv) {
+		CAM_ERR(CAM_ISP, "Error. camif_priv is NULL");
+		return -ENODEV;
+	}
+
+	kfree(camif_lite_priv);
+
+	return 0;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_lite_ver3.h
@@ -0,0 +1,67 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CAMIF_LITE_VER3_H_
+#define _CAM_VFE_CAMIF_LITE_VER3_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+#define CAM_VFE_RDI_VER2_MAX 4
+#define CAM_VFE_CAMIF_LITE_EVT_MAX 256
+
+struct cam_vfe_camif_lite_ver3_reg {
+	uint32_t     lite_hw_version;
+	uint32_t     lite_hw_status;
+	uint32_t     lite_module_config;
+	uint32_t     lite_skip_period;
+	uint32_t     lite_irq_subsample_pattern;
+	uint32_t     lite_epoch_irq;
+	uint32_t     lite_debug_1;
+	uint32_t     lite_debug_0;
+	uint32_t     lite_test_bus_ctrl;
+	uint32_t     camif_lite_spare;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_vfe_camif_lite_ver3_reg_data {
+	uint32_t     extern_reg_update_shift;
+	uint32_t     operating_mode_shift;
+	uint32_t     input_mux_sel_shift;
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     epoch1_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask2;
+	uint32_t     subscribe_irq_mask1;
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     top_debug_cfg_en;
+};
+
+struct cam_vfe_camif_lite_ver3_hw_info {
+	struct cam_vfe_top_ver3_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_lite_ver3_reg          *camif_lite_reg;
+	struct cam_vfe_camif_lite_ver3_reg_data     *reg_data;
+};
+
+int cam_vfe_camif_lite_ver3_acquire_resource(
+	struct cam_isp_resource_node          *camif_lite_res,
+	void                                  *acquire_param);
+
+int cam_vfe_camif_lite_ver3_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_lite_hw_info,
+	struct cam_isp_resource_node  *camif_lite_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_camif_lite_ver3_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_CAMIF_LITE_VER3_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
@@ -0,0 +1,1014 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_camif_ver2.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_cpas_api.h"
+
+#define CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX 2
+
+struct cam_vfe_mux_camif_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_camif_ver2_reg               *camif_reg;
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_reg_data               *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+
+	cam_hw_mgr_event_cb_func             event_cb;
+	void                                *priv;
+	int                                  irq_err_handle;
+	int                                  irq_handle;
+	void                                *vfe_irq_controller;
+	struct cam_vfe_top_irq_evt_payload evt_payload[CAM_VFE_CAMIF_EVT_MAX];
+	struct list_head                     free_payload_list;
+	spinlock_t                           spin_lock;
+
+	enum cam_isp_hw_sync_mode          sync_mode;
+	uint32_t                           dsp_mode;
+	uint32_t                           pix_pattern;
+	uint32_t                           first_pixel;
+	uint32_t                           first_line;
+	uint32_t                           last_pixel;
+	uint32_t                           last_line;
+	uint32_t                           hbi_value;
+	uint32_t                           vbi_value;
+	bool                               enable_sof_irq_debug;
+	uint32_t                           irq_debug_cnt;
+	uint32_t                           camif_debug;
+	uint32_t                           dual_hw_idx;
+	uint32_t                           is_dual;
+	struct timespec64                  sof_ts;
+	struct timespec64                  epoch_ts;
+	struct timespec64                  eof_ts;
+	struct timespec64                  error_ts;
+};
+
+static int cam_vfe_camif_get_evt_payload(
+	struct cam_vfe_mux_camif_data            *camif_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&camif_priv->spin_lock);
+	if (list_empty(&camif_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&camif_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+done:
+	spin_unlock(&camif_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_camif_put_evt_payload(
+	struct cam_vfe_mux_camif_data            *camif_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!camif_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&camif_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list, &camif_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&camif_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_camif_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_node;
+	struct cam_vfe_mux_camif_data         *camif_priv;
+	struct cam_vfe_top_irq_evt_payload  *evt_payload;
+	bool                                   error_flag = false;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x, IRQ status_1 = %x",
+		th_payload->evt_status_arr[0], th_payload->evt_status_arr[1]);
+
+	camif_node = th_payload->handler_priv;
+	camif_priv = camif_node->res_priv;
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[1] || (th_payload->evt_status_arr[0] &
+		camif_priv->reg_data->error_irq_mask0)) {
+		CAM_ERR(CAM_ISP,
+			"Camif Error: vfe:%d: IRQ STATUS_0=0x%x STATUS_1=0x%x",
+			camif_node->hw_intf->hw_idx,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from vfe=%d",
+			camif_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_irq(camif_priv->vfe_irq_controller,
+			camif_priv->irq_err_handle);
+		cam_irq_controller_clear_and_mask(evt_id,
+			camif_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_camif_get_evt_payload(camif_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ STATUS_0=0x%x STATUS_1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		camif_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		camif_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->violation_status);
+
+	if (error_flag)
+		CAM_INFO(CAM_ISP, "Violation status = 0x%x",
+			evt_payload->irq_reg_val[2]);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_vfe_camif_validate_pix_pattern(uint32_t pattern)
+{
+	int rc;
+
+	switch (pattern) {
+	case CAM_ISP_PATTERN_BAYER_RGRGRG:
+	case CAM_ISP_PATTERN_BAYER_GRGRGR:
+	case CAM_ISP_PATTERN_BAYER_BGBGBG:
+	case CAM_ISP_PATTERN_BAYER_GBGBGB:
+	case CAM_ISP_PATTERN_YUV_YCBYCR:
+	case CAM_ISP_PATTERN_YUV_YCRYCB:
+	case CAM_ISP_PATTERN_YUV_CBYCRY:
+	case CAM_ISP_PATTERN_YUV_CRYCBY:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error! Invalid pix pattern:%d", pattern);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int cam_vfe_camif_get_reg_update(
+	struct cam_isp_resource_node  *camif_res,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_vfe_mux_camif_data    *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	rsrc_data = camif_res->res_priv;
+	reg_val_pair[0] = rsrc_data->camif_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "CAMIF reg_update_cmd %x offset %x",
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_camif_ver2_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_camif_data    *camif_data;
+	struct cam_vfe_acquire_args      *acquire_data;
+
+	int rc = 0;
+
+	camif_data   = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args   *)acquire_param;
+
+	rc = cam_vfe_camif_validate_pix_pattern(
+			acquire_data->vfe_in.in_port->test_pattern);
+	if (rc)
+		return rc;
+
+	camif_data->sync_mode   = acquire_data->vfe_in.sync_mode;
+	camif_data->pix_pattern = acquire_data->vfe_in.in_port->test_pattern;
+	camif_data->dsp_mode    = acquire_data->vfe_in.in_port->dsp_mode;
+	camif_data->first_pixel = acquire_data->vfe_in.in_port->left_start;
+	camif_data->last_pixel  = acquire_data->vfe_in.in_port->left_stop;
+	camif_data->first_line  = acquire_data->vfe_in.in_port->line_start;
+	camif_data->last_line   = acquire_data->vfe_in.in_port->line_stop;
+	camif_data->event_cb    = acquire_data->event_cb;
+	camif_data->priv        = acquire_data->priv;
+	camif_data->is_dual     = acquire_data->vfe_in.is_dual;
+	camif_data->hbi_value   = 0;
+	camif_data->vbi_value   = 0;
+
+	if (acquire_data->vfe_in.is_dual)
+		camif_data->dual_hw_idx =
+			acquire_data->vfe_in.dual_hw_idx;
+
+	CAM_DBG(CAM_ISP, "hw id:%d pix_pattern:%d dsp_mode=%d",
+		camif_res->hw_intf->hw_idx,
+		camif_data->pix_pattern, camif_data->dsp_mode);
+	return rc;
+}
+
+static int cam_vfe_camif_resource_init(
+	struct cam_isp_resource_node        *camif_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_camif_data    *camif_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_data   = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+
+	soc_info = camif_data->soc_info;
+
+	if ((camif_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_enable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to enable dsp clk");
+	}
+	camif_data->sof_ts.tv_sec = 0;
+	camif_data->sof_ts.tv_nsec = 0;
+	camif_data->epoch_ts.tv_sec = 0;
+	camif_data->epoch_ts.tv_nsec = 0;
+	camif_data->eof_ts.tv_sec = 0;
+	camif_data->eof_ts.tv_nsec = 0;
+	camif_data->error_ts.tv_sec = 0;
+	camif_data->error_ts.tv_nsec = 0;
+
+	return rc;
+}
+
+static int cam_vfe_camif_resource_deinit(
+	struct cam_isp_resource_node        *camif_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_camif_data    *camif_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_data   = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+
+	soc_info = camif_data->soc_info;
+
+	if ((camif_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_disable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to disable dsp clk");
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_resource_start(
+	struct cam_isp_resource_node   *camif_res)
+{
+	struct cam_vfe_mux_camif_data  *rsrc_data;
+	uint32_t                        val = 0;
+	uint32_t                        epoch0_irq_mask;
+	uint32_t                        epoch1_irq_mask;
+	uint32_t                        computed_epoch_line_cfg;
+	int                             rc = 0;
+	uint32_t                        err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                        irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                        dual_vfe_sync_val;
+	struct cam_vfe_soc_private     *soc_private;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Invalid camif res res_state:%d",
+			camif_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_vfe_mux_camif_data  *)camif_res->res_priv;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->error_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->error_irq_mask1;
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->subscribe_irq_mask0;
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->subscribe_irq_mask1;
+
+	soc_private = rsrc_data->soc_info->soc_private;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error! soc_private NULL");
+		return -ENODEV;
+	}
+
+	/*config vfe core*/
+	val = (rsrc_data->pix_pattern <<
+			rsrc_data->reg_data->pixel_pattern_shift);
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	if ((rsrc_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(rsrc_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		/* DSP mode reg val is CAM_ISP_DSP_MODE - 1 */
+		val |= (((rsrc_data->dsp_mode - 1) &
+			rsrc_data->reg_data->dsp_mode_mask) <<
+			rsrc_data->reg_data->dsp_mode_shift);
+		val |= (0x1 << rsrc_data->reg_data->dsp_en_shift);
+	}
+
+	cam_io_w_mb(val, rsrc_data->mem_base + rsrc_data->common_reg->core_cfg);
+
+	CAM_DBG(CAM_ISP, "hw id:%d core_cfg val:%d", camif_res->hw_intf->hw_idx,
+		val);
+
+	/* disable the CGC for stats */
+	cam_io_w_mb(0xFFFFFFFF, rsrc_data->mem_base +
+		rsrc_data->common_reg->module_ctrl[
+		CAM_VFE_TOP_VER2_MODULE_STATS]->cgc_ovd);
+
+	/* epoch config */
+	switch (soc_private->cpas_version) {
+	case CAM_CPAS_TITAN_170_V100:
+	case CAM_CPAS_TITAN_170_V110:
+	case CAM_CPAS_TITAN_170_V120:
+	case CAM_CPAS_TITAN_170_V200:
+		cam_io_w_mb(rsrc_data->reg_data->epoch_line_cfg,
+				rsrc_data->mem_base +
+				rsrc_data->camif_reg->epoch_irq);
+		break;
+	default:
+		epoch0_irq_mask = (((rsrc_data->last_line +
+				rsrc_data->vbi_value) -
+				rsrc_data->first_line) / 2);
+		if ((epoch0_irq_mask) >
+			(rsrc_data->last_line - rsrc_data->first_line))
+			epoch0_irq_mask = rsrc_data->last_line -
+				rsrc_data->first_line;
+
+		epoch1_irq_mask = rsrc_data->reg_data->epoch_line_cfg &
+				0xFFFF;
+		computed_epoch_line_cfg = (epoch0_irq_mask << 16) |
+				epoch1_irq_mask;
+		cam_io_w_mb(computed_epoch_line_cfg,
+				rsrc_data->mem_base +
+				rsrc_data->camif_reg->epoch_irq);
+		CAM_DBG(CAM_ISP, "first_line: %u\n"
+				"last_line: %u vbi: %u\n"
+				"epoch_line_cfg: 0x%x",
+				rsrc_data->first_line,
+				rsrc_data->last_line,
+				rsrc_data->vbi_value,
+				computed_epoch_line_cfg);
+		break;
+	}
+
+	if (rsrc_data->is_dual && rsrc_data->reg_data->dual_vfe_sync_mask) {
+		dual_vfe_sync_val = (rsrc_data->dual_hw_idx &
+			rsrc_data->reg_data->dual_vfe_sync_mask) + 1;
+		cam_io_w_mb(dual_vfe_sync_val, rsrc_data->mem_base +
+			rsrc_data->camif_reg->dual_vfe_sync);
+	}
+	camif_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base + rsrc_data->camif_reg->reg_update_cmd);
+	CAM_DBG(CAM_ISP, "hw id:%d RUP val:%d", camif_res->hw_intf->hw_idx,
+		rsrc_data->reg_data->reg_update_cmd_data);
+
+	/* disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
+	if (rsrc_data->camif_debug &
+		CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		val = cam_io_r_mb(rsrc_data->mem_base +
+			rsrc_data->camif_reg->vfe_diag_config);
+		val |= rsrc_data->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, rsrc_data->mem_base +
+			rsrc_data->camif_reg->vfe_diag_config);
+	}
+
+	if ((rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) &&
+		rsrc_data->is_dual)
+		goto subscribe_err;
+
+	if (!rsrc_data->irq_handle) {
+		rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			irq_mask,
+			camif_res,
+			camif_res->top_half_handler,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api);
+		if (rsrc_data->irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_handle = 0;
+		}
+	}
+
+subscribe_err:
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			camif_res,
+			cam_vfe_camif_err_irq_top_half,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api);
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Start Camif IFE %d Done", camif_res->hw_intf->hw_idx);
+	return 0;
+}
+
+static int cam_vfe_camif_reg_dump(
+	struct cam_isp_resource_node *camif_res)
+{
+	struct cam_vfe_mux_camif_data *camif_priv;
+	uint32_t offset, val, wm_idx;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_priv = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+	for (offset = 0x0; offset < 0x1160; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%x value 0x%x", offset, val);
+	}
+
+	for (offset = 0x2000; offset <= 0x20B8; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%x value 0x%x", offset, val);
+	}
+
+	for (wm_idx = 0; wm_idx <= 23; wm_idx++) {
+		for (offset = 0x2200 + 0x100 * wm_idx;
+			offset < 0x2278 + 0x100 * wm_idx; offset += 0x4) {
+			val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+			CAM_INFO(CAM_ISP,
+				"offset 0x%x value 0x%x", offset, val);
+		}
+	}
+
+	return 0;
+}
+
+static int cam_vfe_camif_resource_stop(
+	struct cam_isp_resource_node        *camif_res)
+{
+	struct cam_vfe_mux_camif_data       *camif_priv;
+	struct cam_vfe_camif_ver2_reg       *camif_reg;
+	int rc = 0;
+	uint32_t val = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	camif_priv = (struct cam_vfe_mux_camif_data *)camif_res->res_priv;
+	camif_reg = camif_priv->camif_reg;
+
+	if ((camif_priv->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_priv->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		val = cam_io_r_mb(camif_priv->mem_base +
+				camif_priv->common_reg->core_cfg);
+		val &= (~(1 << camif_priv->reg_data->dsp_en_shift));
+		cam_io_w_mb(val, camif_priv->mem_base +
+			camif_priv->common_reg->core_cfg);
+	}
+
+	if (camif_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		camif_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	val = cam_io_r_mb(camif_priv->mem_base +
+			camif_priv->camif_reg->vfe_diag_config);
+	if (val & camif_priv->reg_data->enable_diagnostic_hw) {
+		val &= ~camif_priv->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, camif_priv->mem_base +
+			camif_priv->camif_reg->vfe_diag_config);
+	}
+
+	if (camif_priv->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller, camif_priv->irq_handle);
+		camif_priv->irq_handle = 0;
+	}
+
+	if (camif_priv->irq_err_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller,
+			camif_priv->irq_err_handle);
+		camif_priv->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_sof_irq_debug(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_data *camif_priv;
+	uint32_t *enable_sof_irq = (uint32_t *)cmd_args;
+
+	camif_priv =
+		(struct cam_vfe_mux_camif_data *)rsrc_node->res_priv;
+
+	if (*enable_sof_irq == 1)
+		camif_priv->enable_sof_irq_debug = true;
+	else
+		camif_priv->enable_sof_irq_debug = false;
+
+	return 0;
+}
+
+static int cam_vfe_camif_dump_timestamps(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_data *camif_priv =
+		(struct cam_vfe_mux_camif_data *)rsrc_node->res_priv;
+
+	CAM_INFO(CAM_ISP,
+		"CAMIF ERROR time %lld:%lld SOF %lld:%lld EPOCH %lld:%lld EOF %lld:%lld",
+		camif_priv->error_ts.tv_sec,
+		camif_priv->error_ts.tv_nsec,
+		camif_priv->sof_ts.tv_sec,
+		camif_priv->sof_ts.tv_nsec,
+		camif_priv->epoch_ts.tv_sec,
+		camif_priv->epoch_ts.tv_nsec,
+		camif_priv->eof_ts.tv_sec,
+		camif_priv->eof_ts.tv_nsec);
+
+	return 0;
+}
+
+static int cam_vfe_camif_blanking_update(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_data *camif_priv =
+		(struct cam_vfe_mux_camif_data *)rsrc_node->res_priv;
+
+	struct cam_isp_blanking_config  *blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+
+	camif_priv->hbi_value = blanking_config->hbi;
+	camif_priv->vbi_value = blanking_config->vbi;
+
+	CAM_DBG(CAM_ISP, "hbi:%d vbi:%d",
+		camif_priv->hbi_value, camif_priv->vbi_value);
+	return 0;
+}
+
+static int cam_vfe_camif_process_cmd(struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_mux_camif_data *camif_priv = NULL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_camif_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SOF_IRQ_DEBUG:
+		rc = cam_vfe_camif_sof_irq_debug(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		camif_priv =
+			(struct cam_vfe_mux_camif_data *)rsrc_node->res_priv;
+		camif_priv->camif_debug = *((uint32_t *)cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+		rc = cam_vfe_camif_dump_timestamps(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_camif_blanking_update(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA:
+		camif_priv = (struct cam_vfe_mux_camif_data *)
+			rsrc_node->res_priv;
+		*((struct cam_hw_soc_info **)cmd_args) = camif_priv->soc_info;
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_node;
+	struct cam_vfe_mux_camif_data         *camif_priv;
+	struct cam_vfe_top_irq_evt_payload  *evt_payload;
+
+	camif_node = th_payload->handler_priv;
+	camif_priv = camif_node->res_priv;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x", th_payload->evt_status_arr[0]);
+	CAM_DBG(CAM_ISP, "IRQ status_1 = %x", th_payload->evt_status_arr[1]);
+
+	rc  = cam_vfe_camif_get_evt_payload(camif_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ status0=0x%x status1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_camif_handle_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int                                   ret = CAM_VFE_IRQ_STATUS_MAX;
+	struct cam_isp_resource_node         *camif_node;
+	struct cam_vfe_mux_camif_data        *camif_priv;
+	struct cam_vfe_top_irq_evt_payload *payload;
+	struct cam_isp_hw_event_info          evt_info;
+	struct cam_hw_soc_info               *soc_info = NULL;
+	struct cam_vfe_soc_private           *soc_private = NULL;
+	uint32_t                              irq_status0;
+	uint32_t                              irq_status1;
+	uint32_t                              val;
+	struct timespec64                     ts;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	camif_node = handler_priv;
+	camif_priv = camif_node->res_priv;
+	payload = evt_payload_priv;
+	irq_status0 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	irq_status1 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1];
+
+	soc_info = camif_priv->soc_info;
+	soc_private = (struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	evt_info.hw_idx   = camif_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_node->res_id;
+	evt_info.res_type = camif_node->res_type;
+
+	CAM_DBG(CAM_ISP, "irq_status_0 = 0x%x irq_status_1 = 0x%x",
+		irq_status0, irq_status1);
+
+	if (irq_status0 & camif_priv->reg_data->eof_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received EOF");
+		camif_priv->eof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_priv->eof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_priv->reg_data->sof_irq_mask) {
+		if ((camif_priv->enable_sof_irq_debug) &&
+			(camif_priv->irq_debug_cnt <=
+			CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "Received SOF");
+
+			camif_priv->irq_debug_cnt++;
+			if (camif_priv->irq_debug_cnt ==
+				CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+				camif_priv->enable_sof_irq_debug =
+					false;
+				camif_priv->irq_debug_cnt = 0;
+			}
+		} else {
+			CAM_DBG(CAM_ISP, "Received SOF");
+			camif_priv->sof_ts.tv_sec =
+				payload->ts.mono_time.tv_sec;
+			camif_priv->sof_ts.tv_nsec =
+				payload->ts.mono_time.tv_nsec;
+		}
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_priv->reg_data->reg_update_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received REG_UPDATE_ACK");
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_priv->reg_data->epoch0_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received EPOCH");
+		camif_priv->epoch_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_priv->epoch_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & camif_priv->reg_data->error_irq_mask0) {
+		CAM_DBG(CAM_ISP, "Received ERROR");
+
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic time stamp seconds %lld:%lld",
+			ts.tv_sec, ts.tv_nsec/1000);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		CAM_INFO(CAM_ISP,
+			"SOF %lld:%lld EPOCH %lld:%lld EOF %lld:%lld",
+			camif_priv->sof_ts.tv_sec,
+			camif_priv->sof_ts.tv_nsec,
+			camif_priv->epoch_ts.tv_sec,
+			camif_priv->epoch_ts.tv_nsec,
+			camif_priv->eof_ts.tv_sec,
+			camif_priv->eof_ts.tv_nsec);
+
+		CAM_INFO(CAM_ISP, "Violation status = %x",
+			payload->irq_reg_val[2]);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_cpas_get_camnoc_fifo_fill_level_info(
+			soc_private->cpas_version,
+			soc_private->cpas_handle);
+		cam_cpas_log_votes();
+
+		if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_reg_dump(camif_node->res_priv);
+	}
+
+	if (irq_status1 & camif_priv->reg_data->error_irq_mask1) {
+		CAM_DBG(CAM_ISP, "Received ERROR");
+
+		CAM_INFO(CAM_ISP,
+			"SOF %lld:%lld EPOCH %lld:%lld EOF %lld:%lld",
+			camif_priv->sof_ts.tv_sec,
+			camif_priv->sof_ts.tv_nsec,
+			camif_priv->epoch_ts.tv_sec,
+			camif_priv->epoch_ts.tv_nsec,
+			camif_priv->eof_ts.tv_sec,
+			camif_priv->eof_ts.tv_nsec);
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic time stamp seconds %lld:%lld",
+			ts.tv_sec, ts.tv_nsec/1000);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+
+		CAM_INFO(CAM_ISP, "Violation status = %x",
+			payload->irq_reg_val[2]);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_cpas_get_camnoc_fifo_fill_level_info(
+			soc_private->cpas_version,
+			soc_private->cpas_handle);
+		cam_cpas_log_votes();
+
+		if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_reg_dump(camif_node->res_priv);
+	}
+
+	if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		val = cam_io_r(camif_priv->mem_base +
+			camif_priv->camif_reg->vfe_diag_sensor_status);
+		CAM_DBG(CAM_ISP, "VFE_DIAG_SENSOR_STATUS: 0x%x",
+			camif_priv->mem_base, val);
+	}
+
+	cam_vfe_camif_put_evt_payload(camif_priv, &payload);
+
+	CAM_DBG(CAM_ISP, "returning status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_camif_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_camif_data     *camif_priv = NULL;
+	struct cam_vfe_camif_ver2_hw_info *camif_info = camif_hw_info;
+	int                                i = 0;
+
+	camif_priv = kzalloc(sizeof(struct cam_vfe_mux_camif_data),
+		GFP_KERNEL);
+	if (!camif_priv) {
+		CAM_DBG(CAM_ISP, "Error! Failed to alloc for camif_priv");
+		return -ENOMEM;
+	}
+
+	camif_node->res_priv = camif_priv;
+
+	camif_priv->mem_base    = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	camif_priv->camif_reg   = camif_info->camif_reg;
+	camif_priv->common_reg  = camif_info->common_reg;
+	camif_priv->reg_data    = camif_info->reg_data;
+	camif_priv->hw_intf     = hw_intf;
+	camif_priv->soc_info    = soc_info;
+	camif_priv->vfe_irq_controller = vfe_irq_controller;
+
+	camif_node->init    = cam_vfe_camif_resource_init;
+	camif_node->deinit  = cam_vfe_camif_resource_deinit;
+	camif_node->start   = cam_vfe_camif_resource_start;
+	camif_node->stop    = cam_vfe_camif_resource_stop;
+	camif_node->process_cmd = cam_vfe_camif_process_cmd;
+	camif_node->top_half_handler = cam_vfe_camif_handle_irq_top_half;
+	camif_node->bottom_half_handler = cam_vfe_camif_handle_irq_bottom_half;
+
+	spin_lock_init(&camif_priv->spin_lock);
+	INIT_LIST_HEAD(&camif_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&camif_priv->evt_payload[i].list);
+		list_add_tail(&camif_priv->evt_payload[i].list,
+			&camif_priv->free_payload_list);
+	}
+
+	return 0;
+}
+
+int cam_vfe_camif_ver2_deinit(
+	struct cam_isp_resource_node  *camif_node)
+{
+	struct cam_vfe_mux_camif_data *camif_priv = camif_node->res_priv;
+	int                            i = 0;
+
+	INIT_LIST_HEAD(&camif_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++)
+		INIT_LIST_HEAD(&camif_priv->evt_payload[i].list);
+
+	camif_node->start = NULL;
+	camif_node->stop  = NULL;
+	camif_node->process_cmd = NULL;
+	camif_node->top_half_handler = NULL;
+	camif_node->bottom_half_handler = NULL;
+
+	camif_node->res_priv = NULL;
+
+	if (!camif_priv) {
+		CAM_ERR(CAM_ISP, "Error! camif_priv is NULL");
+		return -ENODEV;
+	}
+
+	kfree(camif_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.h
@@ -0,0 +1,89 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CAMIF_VER2_H_
+#define _CAM_VFE_CAMIF_VER2_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+struct cam_vfe_camif_ver2_reg {
+	uint32_t     camif_cmd;
+	uint32_t     camif_config;
+	uint32_t     line_skip_pattern;
+	uint32_t     pixel_skip_pattern;
+	uint32_t     skip_period;
+	uint32_t     irq_subsample_pattern;
+	uint32_t     epoch_irq;
+	uint32_t     raw_crop_width_cfg;
+	uint32_t     raw_crop_height_cfg;
+	uint32_t     reg_update_cmd;
+	uint32_t     vfe_diag_config;
+	uint32_t     vfe_diag_sensor_status;
+	uint32_t     dual_vfe_sync;
+};
+
+struct cam_vfe_camif_reg_data {
+	uint32_t     raw_crop_first_pixel_shift;
+	uint32_t     raw_crop_first_pixel_mask;
+
+	uint32_t     raw_crop_last_pixel_shift;
+	uint32_t     raw_crop_last_pixel_mask;
+
+	uint32_t     raw_crop_first_line_shift;
+	uint32_t     raw_crop_first_line_mask;
+
+	uint32_t     raw_crop_last_line_shift;
+	uint32_t     raw_crop_last_line_mask;
+
+	uint32_t     input_mux_sel_shift;
+	uint32_t     input_mux_sel_mask;
+	uint32_t     extern_reg_update_shift;
+	uint32_t     extern_reg_update_mask;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+
+	uint32_t     dsp_mode_shift;
+	uint32_t     dsp_mode_mask;
+	uint32_t     dsp_en_shift;
+	uint32_t     dsp_en_mask;
+
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     reg_update_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask1;
+	uint32_t     subscribe_irq_mask0;
+	uint32_t     subscribe_irq_mask1;
+
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     dual_vfe_sync_mask;
+};
+
+struct cam_vfe_camif_ver2_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_ver2_reg               *camif_reg;
+	struct cam_vfe_camif_reg_data               *reg_data;
+};
+
+int cam_vfe_camif_ver2_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param);
+
+int cam_vfe_camif_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_camif_ver2_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_CAMIF_VER2_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.c
@@ -0,0 +1,1683 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <media/cam_isp.h>
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_vfe_camif_ver3.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_cpas_api.h"
+#include "cam_trace.h"
+
+#define CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX 2
+
+struct cam_vfe_mux_camif_ver3_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_camif_ver3_pp_clc_reg        *camif_reg;
+	struct cam_vfe_top_ver3_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_ver3_reg_data          *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+	struct cam_vfe_camif_common_cfg             cam_common_cfg;
+
+	cam_hw_mgr_event_cb_func             event_cb;
+	void                                *priv;
+	int                                  irq_err_handle;
+	int                                  irq_handle;
+	int                                  sof_irq_handle;
+	void                                *vfe_irq_controller;
+	struct cam_vfe_top_irq_evt_payload   evt_payload[CAM_VFE_CAMIF_EVT_MAX];
+	struct list_head                     free_payload_list;
+	spinlock_t                           spin_lock;
+
+	enum cam_isp_hw_sync_mode          sync_mode;
+	uint32_t                           dsp_mode;
+	uint32_t                           pix_pattern;
+	uint32_t                           first_pixel;
+	uint32_t                           first_line;
+	uint32_t                           last_pixel;
+	uint32_t                           last_line;
+	uint32_t                           hbi_value;
+	uint32_t                           vbi_value;
+	bool                               enable_sof_irq_debug;
+	uint32_t                           irq_debug_cnt;
+	uint32_t                           camif_debug;
+	uint32_t                           horizontal_bin;
+	uint32_t                           qcfa_bin;
+	uint32_t                           dual_hw_idx;
+	uint32_t                           is_dual;
+	bool                               is_fe_enabled;
+	bool                               is_offline;
+	struct timespec64                  sof_ts;
+	struct timespec64                  epoch_ts;
+	struct timespec64                  eof_ts;
+	struct timespec64                  error_ts;
+};
+
+static int cam_vfe_camif_ver3_get_evt_payload(
+	struct cam_vfe_mux_camif_ver3_data     *camif_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&camif_priv->spin_lock);
+	if (list_empty(&camif_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free CAMIF event payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&camif_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+done:
+	spin_unlock(&camif_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_put_evt_payload(
+	struct cam_vfe_mux_camif_ver3_data     *camif_priv,
+	struct cam_vfe_top_irq_evt_payload    **evt_payload)
+{
+	unsigned long flags;
+
+	if (!camif_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&camif_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list, &camif_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&camif_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_node;
+	struct cam_vfe_mux_camif_ver3_data    *camif_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	bool                                   error_flag = false;
+
+	camif_node = th_payload->handler_priv;
+	camif_priv = camif_node->res_priv;
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[2] || (th_payload->evt_status_arr[0] &
+		camif_priv->reg_data->error_irq_mask0)) {
+		CAM_ERR(CAM_ISP,
+			"VFE:%d CAMIF Err IRQ status_0: 0x%X status_2: 0x%X",
+			camif_node->hw_intf->hw_idx,
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[2]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from VFE:%d",
+			camif_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_irq(camif_priv->vfe_irq_controller,
+			camif_priv->irq_err_handle);
+		cam_irq_controller_clear_and_mask(evt_id,
+			camif_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_camif_ver3_get_evt_payload(camif_priv, &evt_payload);
+	if (rc)
+		return rc;
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		camif_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		camif_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->violation_status);
+
+	evt_payload->irq_reg_val[++i] = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->bus_overflow_status);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_validate_pix_pattern(uint32_t pattern,
+	uint32_t *input_pp_fmt)
+{
+	int rc;
+
+	switch (pattern) {
+	case CAM_ISP_PATTERN_BAYER_RGRGRG:
+	case CAM_ISP_PATTERN_BAYER_GRGRGR:
+	case CAM_ISP_PATTERN_BAYER_BGBGBG:
+	case CAM_ISP_PATTERN_BAYER_GBGBGB:
+		rc = 0;
+		*input_pp_fmt = CAM_ISP_PP_INPUT_BAYER_FMT;
+		break;
+
+	case CAM_ISP_PATTERN_YUV_YCBYCR:
+	case CAM_ISP_PATTERN_YUV_YCRYCB:
+	case CAM_ISP_PATTERN_YUV_CBYCRY:
+	case CAM_ISP_PATTERN_YUV_CRYCBY:
+		rc = 0;
+		*input_pp_fmt = CAM_ISP_PP_INPUT_YUV_FMT;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error, Invalid pix pattern:%d", pattern);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_get_reg_update(
+	struct cam_isp_resource_node  *camif_res,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                           size = 0;
+	uint32_t                           reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update   *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops           *cdm_util_ops = NULL;
+	struct cam_vfe_mux_camif_ver3_data *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid arg size: %d expected:%ld",
+			arg_size, sizeof(struct cam_isp_hw_get_cmd_update));
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args: %pK", cdm_args);
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, (size*4));
+		return -EINVAL;
+	}
+
+	rsrc_data = camif_res->res_priv;
+	reg_val_pair[0] = rsrc_data->camif_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF reg_update_cmd 0x%X offset 0x%X",
+		camif_res->hw_intf->hw_idx,
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_camif_ver3_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_camif_ver3_data    *camif_data;
+	struct cam_vfe_acquire_args           *acquire_data;
+	int                                    rc = 0;
+
+	camif_data  = (struct cam_vfe_mux_camif_ver3_data *)
+		camif_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	rc = cam_vfe_camif_ver3_validate_pix_pattern(
+		acquire_data->vfe_in.in_port->test_pattern,
+		&camif_data->cam_common_cfg.input_pp_fmt);
+
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Validate pix pattern failed, rc = %d", rc);
+		return rc;
+	}
+
+	camif_data->sync_mode      = acquire_data->vfe_in.sync_mode;
+	camif_data->pix_pattern    = acquire_data->vfe_in.in_port->test_pattern;
+	camif_data->dsp_mode       = acquire_data->vfe_in.in_port->dsp_mode;
+	camif_data->first_pixel    = acquire_data->vfe_in.in_port->left_start;
+	camif_data->last_pixel     = acquire_data->vfe_in.in_port->left_stop;
+	camif_data->first_line     = acquire_data->vfe_in.in_port->line_start;
+	camif_data->last_line      = acquire_data->vfe_in.in_port->line_stop;
+	camif_data->is_fe_enabled  = acquire_data->vfe_in.is_fe_enabled;
+	camif_data->is_offline     = acquire_data->vfe_in.is_offline;
+	camif_data->is_dual        = acquire_data->vfe_in.is_dual;
+	camif_data->event_cb       = acquire_data->event_cb;
+	camif_data->priv           = acquire_data->priv;
+	camif_data->qcfa_bin       = acquire_data->vfe_in.in_port->qcfa_bin;
+	camif_data->horizontal_bin =
+		acquire_data->vfe_in.in_port->horizontal_bin;
+	camif_data->hbi_value      = 0;
+	camif_data->vbi_value      = 0;
+
+	if (camif_data->is_dual)
+		camif_data->dual_hw_idx = acquire_data->vfe_in.dual_hw_idx;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d CAMIF pix_pattern:%d dsp_mode=%d is_dual:%d dual_hw_idx:%d format = %d",
+		camif_res->hw_intf->hw_idx,
+		camif_data->pix_pattern, camif_data->dsp_mode,
+		camif_data->is_dual, camif_data->dual_hw_idx,
+		acquire_data->vfe_in.in_port->format);
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_resource_init(
+	struct cam_isp_resource_node *camif_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_camif_ver3_data    *camif_data;
+	struct cam_hw_soc_info                *soc_info;
+	int                                    rc = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_data = (struct cam_vfe_mux_camif_ver3_data *)
+		camif_res->res_priv;
+
+	soc_info = camif_data->soc_info;
+
+	if ((camif_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_enable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP,
+				"failed to enable dsp clk, rc = %d", rc);
+	}
+	camif_data->sof_ts.tv_sec = 0;
+	camif_data->sof_ts.tv_nsec = 0;
+	camif_data->epoch_ts.tv_sec = 0;
+	camif_data->epoch_ts.tv_nsec = 0;
+	camif_data->eof_ts.tv_sec = 0;
+	camif_data->eof_ts.tv_nsec = 0;
+	camif_data->error_ts.tv_sec = 0;
+	camif_data->error_ts.tv_nsec = 0;
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_resource_deinit(
+	struct cam_isp_resource_node        *camif_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_camif_ver3_data    *camif_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	camif_data   = (struct cam_vfe_mux_camif_ver3_data *)
+		camif_res->res_priv;
+
+	soc_info = camif_data->soc_info;
+
+	if ((camif_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_disable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to disable dsp clk");
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_resource_start(
+	struct cam_isp_resource_node *camif_res)
+{
+	struct cam_vfe_mux_camif_ver3_data  *rsrc_data;
+	uint32_t                             val = 0;
+	uint32_t                             epoch0_line_cfg;
+	uint32_t                             epoch1_line_cfg;
+	uint32_t                             computed_epoch_line_cfg;
+	int                                  rc = 0;
+	uint32_t                        err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                        irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	struct cam_vfe_soc_private          *soc_private;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (camif_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error, Invalid camif res res_state:%d",
+			camif_res->res_state);
+		return -EINVAL;
+	}
+
+	memset(err_irq_mask, 0, sizeof(err_irq_mask));
+	memset(irq_mask, 0, sizeof(irq_mask));
+
+	rsrc_data = (struct cam_vfe_mux_camif_ver3_data *)camif_res->res_priv;
+
+	soc_private = rsrc_data->soc_info->soc_private;
+
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error, soc_private NULL");
+		return -ENODEV;
+	}
+
+	/* config debug status registers */
+	cam_io_w_mb(rsrc_data->reg_data->top_debug_cfg_en, rsrc_data->mem_base +
+		rsrc_data->common_reg->top_debug_cfg);
+
+	val = cam_io_r_mb(rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	/* AF stitching by hw disabled by default
+	 * PP CAMIF currently operates only in offline mode
+	 */
+
+	if ((rsrc_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(rsrc_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		/* DSP mode reg val is CAM_ISP_DSP_MODE - 1 */
+		if (camif_res->hw_intf->hw_idx != CAM_ISP_HW_VFE_CORE_2) {
+			val |= (((rsrc_data->dsp_mode - 1) &
+				rsrc_data->reg_data->dsp_mode_mask) <<
+				rsrc_data->reg_data->dsp_mode_shift);
+			val |= (0x1 << rsrc_data->reg_data->dsp_en_shift);
+		} else {
+			CAM_ERR(CAM_ISP, "Error, HVX not available for IFE_%d",
+				camif_res->hw_intf->hw_idx);
+			return -EINVAL;
+		}
+	}
+
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->pp_extern_reg_update_shift);
+
+	if ((rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) ||
+		(rsrc_data->sync_mode == CAM_ISP_HW_SYNC_MASTER))
+		val |= (1 << rsrc_data->reg_data->dual_ife_pix_en_shift);
+
+	val |= (~rsrc_data->cam_common_cfg.vid_ds16_r2pd & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_VID_DS16_R2PD;
+	val |= (~rsrc_data->cam_common_cfg.vid_ds4_r2pd & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_VID_DS4_R2PD;
+	val |= (~rsrc_data->cam_common_cfg.disp_ds16_r2pd & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_DISP_DS16_R2PD;
+	val |= (~rsrc_data->cam_common_cfg.disp_ds4_r2pd & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_DISP_DS4_R2PD;
+	val |= (rsrc_data->cam_common_cfg.dsp_streaming_tap_point & 0x3) <<
+		CAM_SHIFT_TOP_CORE_CFG_DSP_STREAMING;
+	val |= (rsrc_data->cam_common_cfg.ihist_src_sel & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_STATS_IHIST;
+	val |= (rsrc_data->cam_common_cfg.hdr_be_src_sel & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_STATS_HDR_BE;
+	val |= (rsrc_data->cam_common_cfg.hdr_bhist_src_sel & 0x1) <<
+		CAM_SHIFT_TOP_CORE_CFG_STATS_HDR_BHIST;
+	val |= (rsrc_data->cam_common_cfg.input_mux_sel_pp & 0x3) <<
+		CAM_SHIFT_TOP_CORE_CFG_INPUTMUX_PP;
+	val |= (rsrc_data->cam_common_cfg.input_pp_fmt & 0x3) <<
+		CAM_SHIFT_TOP_CORE_CFG_INPUT_PP_FMT;
+
+
+	if (rsrc_data->is_fe_enabled && !rsrc_data->is_offline)
+		val |= 0x2 << rsrc_data->reg_data->operating_mode_shift;
+	else
+		val |= 0x1 << rsrc_data->reg_data->operating_mode_shift;
+
+	if (rsrc_data->is_dual && rsrc_data->reg_data->dual_vfe_sync_mask) {
+		val |= (((rsrc_data->dual_hw_idx &
+				rsrc_data->reg_data->dual_vfe_sync_mask) + 1) <<
+				rsrc_data->reg_data->dual_ife_sync_sel_shift);
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d TOP core_cfg: 0x%X",
+		camif_res->hw_intf->hw_idx, val);
+
+	cam_io_w_mb(val, rsrc_data->mem_base +
+		rsrc_data->common_reg->core_cfg_0);
+
+	/* epoch config */
+	switch (soc_private->cpas_version) {
+	case CAM_CPAS_TITAN_480_V100:
+	case CAM_CPAS_TITAN_580_V100:
+	case CAM_CPAS_TITAN_570_V200:
+		epoch0_line_cfg = ((rsrc_data->last_line +
+			rsrc_data->vbi_value) -
+			rsrc_data->first_line) / 4;
+		if ((epoch0_line_cfg * 2) >
+			(rsrc_data->last_line - rsrc_data->first_line))
+			epoch0_line_cfg = (rsrc_data->last_line -
+				rsrc_data->first_line)/2;
+	/* epoch line cfg will still be configured at midpoint of the
+	 * frame width. We use '/ 4' instead of '/ 2'
+	 * cause it is multipixel path
+	 */
+		if (rsrc_data->horizontal_bin || rsrc_data->qcfa_bin)
+			epoch0_line_cfg >>= 1;
+
+		epoch1_line_cfg = rsrc_data->reg_data->epoch_line_cfg &
+			0xFFFF;
+		computed_epoch_line_cfg = (epoch1_line_cfg << 16) |
+			epoch0_line_cfg;
+		cam_io_w_mb(computed_epoch_line_cfg,
+			rsrc_data->mem_base +
+			rsrc_data->camif_reg->epoch_irq_cfg);
+		CAM_DBG(CAM_ISP, "epoch_line_cfg: 0x%X",
+			computed_epoch_line_cfg);
+		break;
+	default:
+			CAM_ERR(CAM_ISP, "Hardware version not proper: 0x%X",
+				soc_private->cpas_version);
+			return -EINVAL;
+		break;
+	}
+
+	camif_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	if (!rsrc_data->is_offline) {
+		cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+			rsrc_data->mem_base +
+			rsrc_data->camif_reg->reg_update_cmd);
+		CAM_DBG(CAM_ISP, "VFE:%d CAMIF RUP val:0x%X",
+			camif_res->hw_intf->hw_idx,
+			rsrc_data->reg_data->reg_update_cmd_data);
+	}
+
+	/* disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
+	if (rsrc_data->camif_debug &
+		CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		val = cam_io_r_mb(rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+		val |= rsrc_data->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, rsrc_data->mem_base +
+			rsrc_data->common_reg->diag_config);
+	}
+
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->reg_data->error_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS2] =
+		rsrc_data->reg_data->error_irq_mask2;
+
+	if ((rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE) &&
+		rsrc_data->is_dual)
+		goto subscribe_err;
+
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->epoch0_irq_mask |
+		rsrc_data->reg_data->eof_irq_mask;
+
+	if (!rsrc_data->irq_handle) {
+		rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_3,
+			irq_mask,
+			camif_res,
+			camif_res->top_half_handler,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api);
+
+		if (rsrc_data->irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_handle = 0;
+		}
+	}
+
+	irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->reg_data->sof_irq_mask;
+	if (rsrc_data->cam_common_cfg.input_mux_sel_pp & 0x3)
+		irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+			rsrc_data->reg_data->frame_id_irq_mask;
+
+	if (!rsrc_data->sof_irq_handle) {
+		rsrc_data->sof_irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			irq_mask,
+			camif_res,
+			camif_res->top_half_handler,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api);
+
+		if (rsrc_data->sof_irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "SOF IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->sof_irq_handle = 0;
+		}
+	}
+
+subscribe_err:
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			camif_res,
+			cam_vfe_camif_ver3_err_irq_top_half,
+			camif_res->bottom_half_handler,
+			camif_res->tasklet_info,
+			&tasklet_bh_api);
+
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "VFE:%d CAMIF Start Done", camif_res->hw_intf->hw_idx);
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_reg_dump(
+	struct cam_isp_resource_node *camif_res)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	uint32_t offset, val, wm_idx;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_priv = (struct cam_vfe_mux_camif_ver3_data *)camif_res->res_priv;
+
+	CAM_INFO(CAM_ISP, "IFE:%d TOP", camif_res->hw_intf->hw_idx);
+	for (offset = 0x0; offset <= 0x1FC; offset += 0x4) {
+		if (offset == 0x1C || offset == 0x34 ||
+			offset == 0x38 || offset == 0x90)
+			continue;
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d PP CLC PREPROCESS",
+		camif_res->hw_intf->hw_idx);
+	for (offset = 0x2200; offset <= 0x23FC; offset += 0x4) {
+		if (offset == 0x2208)
+			offset = 0x2260;
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+		if (offset == 0x2260)
+			offset = 0x23F4;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d PP CLC CAMIF", camif_res->hw_intf->hw_idx);
+	for (offset = 0x2600; offset <= 0x27FC; offset += 0x4) {
+		if (offset == 0x2608)
+			offset = 0x2660;
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+		if (offset == 0x2660)
+			offset = 0x2664;
+		else if (offset == 0x2680)
+			offset = 0x27EC;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d PP CLC Modules", camif_res->hw_intf->hw_idx);
+	for (offset = 0x2800; offset <= 0x8FFC; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d BUS RD", camif_res->hw_intf->hw_idx);
+	for (offset = 0xA800; offset <= 0xA89C; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+		if (offset == 0xA838)
+			offset = 0xA844;
+		if (offset == 0xA864)
+			offset = 0xA874;
+		if (offset == 0xA878)
+			offset = 0xA87C;
+	}
+
+	CAM_INFO(CAM_ISP, "IFE:%d BUS WR", camif_res->hw_intf->hw_idx);
+	for (offset = 0xAA00; offset <= 0xAADC; offset += 0x4) {
+		val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+		CAM_DBG(CAM_ISP, "offset 0x%X value 0x%X", offset, val);
+	}
+
+	for (wm_idx = 0; wm_idx <= 25; wm_idx++) {
+		for (offset = 0xAC00 + 0x100 * wm_idx;
+			offset < 0xAC84 + 0x100 * wm_idx; offset += 0x4) {
+			val = cam_soc_util_r(camif_priv->soc_info, 0, offset);
+			CAM_INFO(CAM_ISP, "offset 0x%X value 0x%X",
+				offset, val);
+		}
+	}
+
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_resource_stop(
+	struct cam_isp_resource_node *camif_res)
+{
+	struct cam_vfe_mux_camif_ver3_data        *camif_priv;
+	struct cam_vfe_camif_ver3_pp_clc_reg      *camif_reg;
+	int                                        rc = 0;
+	uint32_t                                   val = 0;
+
+	if (!camif_res) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((camif_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(camif_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	camif_priv = (struct cam_vfe_mux_camif_ver3_data *)camif_res->res_priv;
+	camif_reg = camif_priv->camif_reg;
+
+	if ((camif_priv->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(camif_priv->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		val = cam_io_r_mb(camif_priv->mem_base +
+			camif_priv->common_reg->core_cfg_0);
+		val &= (~(1 << camif_priv->reg_data->dsp_en_shift));
+		cam_io_w_mb(val, camif_priv->mem_base +
+			camif_priv->common_reg->core_cfg_0);
+	}
+
+	if (camif_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		camif_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	val = cam_io_r_mb(camif_priv->mem_base +
+		camif_priv->common_reg->diag_config);
+	if (val & camif_priv->reg_data->enable_diagnostic_hw) {
+		val &= ~camif_priv->reg_data->enable_diagnostic_hw;
+		cam_io_w_mb(val, camif_priv->mem_base +
+			camif_priv->common_reg->diag_config);
+	}
+
+	if (camif_priv->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller, camif_priv->irq_handle);
+		camif_priv->irq_handle = 0;
+	}
+
+	if (camif_priv->sof_irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller,
+			camif_priv->sof_irq_handle);
+		camif_priv->sof_irq_handle = 0;
+	}
+
+	if (camif_priv->irq_err_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			camif_priv->vfe_irq_controller,
+			camif_priv->irq_err_handle);
+		camif_priv->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_core_config(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	struct cam_vfe_core_config_args *vfe_core_cfg =
+		(struct cam_vfe_core_config_args *)cmd_args;
+
+	camif_priv =
+		(struct cam_vfe_mux_camif_ver3_data *)rsrc_node->res_priv;
+	camif_priv->cam_common_cfg.vid_ds16_r2pd =
+		vfe_core_cfg->core_config.vid_ds16_r2pd;
+	camif_priv->cam_common_cfg.vid_ds4_r2pd =
+		vfe_core_cfg->core_config.vid_ds4_r2pd;
+	camif_priv->cam_common_cfg.disp_ds16_r2pd =
+		vfe_core_cfg->core_config.disp_ds16_r2pd;
+	camif_priv->cam_common_cfg.disp_ds4_r2pd =
+		vfe_core_cfg->core_config.disp_ds4_r2pd;
+	camif_priv->cam_common_cfg.dsp_streaming_tap_point =
+		vfe_core_cfg->core_config.dsp_streaming_tap_point;
+	camif_priv->cam_common_cfg.ihist_src_sel =
+		vfe_core_cfg->core_config.ihist_src_sel;
+	camif_priv->cam_common_cfg.hdr_be_src_sel =
+		vfe_core_cfg->core_config.hdr_be_src_sel;
+	camif_priv->cam_common_cfg.hdr_bhist_src_sel =
+		vfe_core_cfg->core_config.hdr_bhist_src_sel;
+	camif_priv->cam_common_cfg.input_mux_sel_pdaf =
+		vfe_core_cfg->core_config.input_mux_sel_pdaf;
+	camif_priv->cam_common_cfg.input_mux_sel_pp =
+		vfe_core_cfg->core_config.input_mux_sel_pp;
+
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_sof_irq_debug(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	uint32_t *enable_sof_irq = (uint32_t *)cmd_args;
+
+	camif_priv =
+		(struct cam_vfe_mux_camif_ver3_data *)rsrc_node->res_priv;
+
+	if (*enable_sof_irq == 1)
+		camif_priv->enable_sof_irq_debug = true;
+	else
+		camif_priv->enable_sof_irq_debug = false;
+
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_dump_timestamps(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv =
+		(struct cam_vfe_mux_camif_ver3_data *)rsrc_node->res_priv;
+
+	CAM_INFO(CAM_ISP,
+		"CAMIF ERROR time %lld:%lld SOF %lld:%lld EPOCH %lld:%lld EOF %lld:%lld",
+		camif_priv->error_ts.tv_sec,
+		camif_priv->error_ts.tv_nsec,
+		camif_priv->sof_ts.tv_sec,
+		camif_priv->sof_ts.tv_nsec,
+		camif_priv->epoch_ts.tv_sec,
+		camif_priv->epoch_ts.tv_nsec,
+		camif_priv->eof_ts.tv_sec,
+		camif_priv->eof_ts.tv_nsec);
+
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_blanking_update(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv =
+		(struct cam_vfe_mux_camif_ver3_data *)rsrc_node->res_priv;
+
+	struct cam_isp_blanking_config  *blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+
+	camif_priv->hbi_value = blanking_config->hbi;
+	camif_priv->vbi_value = blanking_config->vbi;
+
+	CAM_DBG(CAM_ISP, "hbi:%d vbi:%d",
+		camif_priv->hbi_value, camif_priv->vbi_value);
+	return 0;
+}
+
+static int cam_vfe_camif_ver3_process_cmd(
+	struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+	struct cam_vfe_mux_camif_ver3_data *camif_priv = NULL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP,
+			"Invalid input arguments rsesource node:%pK cmd_args:%pK",
+			rsrc_node, cmd_args);
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_camif_ver3_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SOF_IRQ_DEBUG:
+		rc = cam_vfe_camif_ver3_sof_irq_debug(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = cam_vfe_camif_ver3_core_config(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_SET_CAMIF_DEBUG:
+		camif_priv = (struct cam_vfe_mux_camif_ver3_data *)
+			rsrc_node->res_priv;
+		camif_priv->camif_debug = *((uint32_t *)cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_QUERY_REGSPACE_DATA:
+		camif_priv = (struct cam_vfe_mux_camif_ver3_data *)
+			rsrc_node->res_priv;
+		*((struct cam_hw_soc_info **)cmd_args) = camif_priv->soc_info;
+		rc = 0;
+		break;
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+		rc = cam_vfe_camif_ver3_dump_timestamps(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_camif_ver3_blanking_update(rsrc_node, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+
+static void cam_vfe_camif_ver3_overflow_debug_info(
+	struct cam_vfe_mux_camif_ver3_data *camif_priv)
+{
+	uint32_t val0, val1, val2, val3;
+
+	val0 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_0);
+	val1 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_1);
+	val2 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_2);
+	val3 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_3);
+	CAM_INFO(CAM_ISP,
+		"status_0: 0x%X status_1: 0x%X status_2: 0x%X status_3: 0x%X",
+		val0, val1, val2, val3);
+
+	val0 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_4);
+	val1 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_5);
+	val2 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_6);
+	val3 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_7);
+	CAM_INFO(CAM_ISP,
+		"status_4: 0x%X status_5: 0x%X status_6: 0x%X status_7: 0x%X",
+		val0, val1, val2, val3);
+
+	val0 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_8);
+	val1 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_9);
+	val2 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_10);
+	val3 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_11);
+	CAM_INFO(CAM_ISP,
+		"status_8: 0x%X status_9: 0x%X status_10: 0x%X status_11: 0x%X",
+		val0, val1, val2, val3);
+
+	val0 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_12);
+	val1 = cam_io_r(camif_priv->mem_base +
+		camif_priv->common_reg->top_debug_13);
+	CAM_INFO(CAM_ISP, "status_12: 0x%X status_13: 0x%X",
+		val0, val1);
+}
+
+static void cam_vfe_camif_ver3_print_status(uint32_t *status,
+	int err_type, struct cam_vfe_mux_camif_ver3_data *camif_priv)
+{
+	uint32_t violation_mask = 0x3F, module_id = 0;
+	uint32_t bus_overflow_status = 0, status_0 = 0, status_2 = 0;
+	struct cam_vfe_soc_private *soc_private;
+	uint32_t val0, val1, val2, val3, val4;
+	uint32_t camera_hw_version;
+	int rc = 0;
+
+	val3 = val4 = 0;
+
+	if (!status) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return;
+	}
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc:%d", rc);
+		return;
+	}
+
+	bus_overflow_status = status[CAM_IFE_IRQ_BUS_OVERFLOW_STATUS];
+	status_0 = status[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	status_2 = status[CAM_IFE_IRQ_CAMIF_REG_STATUS2];
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) {
+		if (status_0 & 0x0200)
+			CAM_INFO(CAM_ISP, "DSP OVERFLOW");
+
+		if (status_0 & 0x2000000)
+			CAM_INFO(CAM_ISP, "PIXEL PIPE FRAME DROP");
+
+		if (status_0 & 0x80000000)
+			CAM_INFO(CAM_ISP, "PIXEL PIPE OVERFLOW");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && bus_overflow_status) {
+		if (bus_overflow_status & 0x01)
+			CAM_INFO(CAM_ISP, "VID Y 1:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x02)
+			CAM_INFO(CAM_ISP, "VID C 1:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x04)
+			CAM_INFO(CAM_ISP, "VID YC 4:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x08)
+			CAM_INFO(CAM_ISP, "VID YC 16:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x010)
+			CAM_INFO(CAM_ISP, "DISP Y 1:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x020)
+			CAM_INFO(CAM_ISP, "DISP C 1:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x040)
+			CAM_INFO(CAM_ISP, "DISP YC 4:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x080)
+			CAM_INFO(CAM_ISP, "DISP YC 16:1 BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0100)
+			CAM_INFO(CAM_ISP, "FD Y BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0200)
+			CAM_INFO(CAM_ISP, "FD C BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0400)
+			CAM_INFO(CAM_ISP, "PIXEL RAW DUMP BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x01000)
+			CAM_INFO(CAM_ISP, "STATS HDR BE BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x02000)
+			CAM_INFO(CAM_ISP, "STATS HDR BHIST BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x04000)
+			CAM_INFO(CAM_ISP, "STATS TINTLESS BG BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x08000)
+			CAM_INFO(CAM_ISP, "STATS AWB BG BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x010000)
+			CAM_INFO(CAM_ISP, "STATS BHIST BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x020000)
+			CAM_INFO(CAM_ISP, "STATS RS BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x040000)
+			CAM_INFO(CAM_ISP, "STATS CS BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x080000)
+			CAM_INFO(CAM_ISP, "STATS IHIST BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0100000)
+			CAM_INFO(CAM_ISP, "STATS BAF BUS OVERFLOW");
+
+		if (bus_overflow_status & 0x0200000)
+			CAM_INFO(CAM_ISP, "PDAF BUS OVERFLOW");
+		goto print_state;
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_OVERFLOW && !bus_overflow_status) {
+		CAM_INFO(CAM_ISP, "PIXEL PIPE Module hang");
+		/* print debug registers */
+		cam_vfe_camif_ver3_overflow_debug_info(camif_priv);
+		goto print_state;
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION) {
+		if (status_2 & 0x080)
+			CAM_INFO(CAM_ISP, "DSP IFE PROTOCOL VIOLATION");
+
+		if (status_2 & 0x0100)
+			CAM_INFO(CAM_ISP, "IFE DSP TX PROTOCOL VIOLATION");
+
+		if (status_2 & 0x0200)
+			CAM_INFO(CAM_ISP, "DSP IFE RX PROTOCOL VIOLATION");
+
+		if (status_2 & 0x0400)
+			CAM_INFO(CAM_ISP, "PP PREPROCESS VIOLATION");
+
+		if (status_2 & 0x0800)
+			CAM_INFO(CAM_ISP, "PP CAMIF VIOLATION");
+
+		if (status_2 & 0x01000)
+			CAM_INFO(CAM_ISP, "PP VIOLATION");
+
+		if (status_2 & 0x0100000)
+			CAM_INFO(CAM_ISP,
+				"DSP_TX_VIOLATION:overflow on DSP interface TX path FIFO");
+
+		if (status_2 & 0x0200000)
+			CAM_INFO(CAM_ISP,
+			"DSP_RX_VIOLATION:overflow on DSP interface RX path FIFO");
+
+		if (status_2 & 0x10000000)
+			CAM_INFO(CAM_ISP, "DSP ERROR VIOLATION");
+
+		if (status_2 & 0x20000000)
+			CAM_INFO(CAM_ISP,
+				"DIAG VIOLATION: HBI is less than the minimum required HBI");
+	}
+
+	if (err_type == CAM_VFE_IRQ_STATUS_VIOLATION &&
+		status[CAM_IFE_IRQ_VIOLATION_STATUS]) {
+		module_id =
+			violation_mask & status[CAM_IFE_IRQ_VIOLATION_STATUS];
+		CAM_INFO(CAM_ISP, "PIXEL PIPE VIOLATION Module ID:%d",
+			module_id);
+
+		switch (module_id) {
+		case 0:
+			CAM_INFO(CAM_ISP, "DEMUX");
+			break;
+		case 1:
+			CAM_INFO(CAM_ISP, "CHROMA_UP");
+			break;
+		case 2:
+			CAM_INFO(CAM_ISP, "PEDESTAL");
+			break;
+		case 3:
+			CAM_INFO(CAM_ISP, "LINEARIZATION");
+			break;
+		case 4:
+			CAM_INFO(CAM_ISP, "BPC_PDPC");
+			break;
+		case 5:
+			CAM_INFO(CAM_ISP, "HDR_BINCORRECT");
+			break;
+		case 6:
+			CAM_INFO(CAM_ISP, "ABF");
+			break;
+		case 7:
+			CAM_INFO(CAM_ISP, "LSC");
+			break;
+		case 8:
+			CAM_INFO(CAM_ISP, "DEMOSAIC");
+			break;
+		case 9:
+			CAM_INFO(CAM_ISP, "COLOR_CORRECT");
+			break;
+		case 10:
+			CAM_INFO(CAM_ISP, "GTM");
+			break;
+		case 11:
+			CAM_INFO(CAM_ISP, "GLUT");
+			break;
+		case 12:
+			CAM_INFO(CAM_ISP, "COLOR_XFORM");
+			break;
+		case 13:
+			CAM_INFO(CAM_ISP, "CROP_RND_CLAMP_PIXEL_RAW_OUT");
+			break;
+		case 14:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_Y_FD_OUT");
+			break;
+		case 15:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_C_FD_OUT");
+			break;
+		case 16:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_FD_OUT");
+			break;
+		case 17:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_FD_OUT");
+			break;
+		case 18:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_Y_DISP_OUT");
+			break;
+		case 19:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_C_DISP_OUT");
+			break;
+		case 20:
+			CAM_INFO(CAM_ISP,
+				"module: CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_DISP_OUT");
+			break;
+		case 21:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_DISP_OUT");
+			break;
+		case 22:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_4TO1_Y_DISP_DS4_OUT");
+			break;
+		case 23:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_4TO1_C_DISP_DS4_OUT");
+			break;
+		case 24:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS4_OUT");
+			break;
+		case 25:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS4_OUT");
+			break;
+		case 26:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_4TO1_Y_DISP_DS16_OUT");
+			break;
+		case 27:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_4TO1_C_DISP_DS16_OUT");
+			break;
+		case 28:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_DISP_DS16_OUT");
+			break;
+		case 29:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_DISP_DS16_OUT");
+			break;
+		case 30:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_Y_VID_OUT");
+			break;
+		case 31:
+			CAM_INFO(CAM_ISP, "DOWNSCALE_MN_C_VID_OUT");
+			break;
+		case 32:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_Y_VID_OUT");
+			break;
+		case 33:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_MN_C_VID_OUT");
+			break;
+		case 34:
+			CAM_INFO(CAM_ISP, "DSX_Y_VID_OUT");
+			break;
+		case 35:
+			CAM_INFO(CAM_ISP, "DSX_C_VID_OUT");
+			break;
+		case 36:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DSX_Y_VID_OUT");
+			break;
+		case 37:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DSX_C_VID_OUT");
+			break;
+		case 38:
+			CAM_INFO(CAM_ISP,
+				"DOWNSCALE_4TO1_Y_VID_DS16_OUT");
+			break;
+		case 39:
+			CAM_INFO(CAM_ISP,
+				"DOWNSCALE_4TO1_C_VID_DS16_OUT");
+			break;
+		case 40:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_Y_VID_DS16_OUT");
+			break;
+		case 41:
+			CAM_INFO(CAM_ISP,
+				"CROP_RND_CLAMP_POST_DOWNSCALE_4TO1_C_VID_DS16_OUT");
+			break;
+		case 42:
+			CAM_INFO(CAM_ISP, "BLS");
+			break;
+		case 43:
+			CAM_INFO(CAM_ISP, "STATS_TINTLESS_BG");
+			break;
+		case 44:
+			CAM_INFO(CAM_ISP, "STATS_HDR_BHIST");
+			break;
+		case 45:
+			CAM_INFO(CAM_ISP, "STATS_HDR_BE");
+			break;
+		case 46:
+			CAM_INFO(CAM_ISP, "STATS_AWB_BG");
+			break;
+		case 47:
+			CAM_INFO(CAM_ISP, "STATS_BHIST");
+			break;
+		case 48:
+			CAM_INFO(CAM_ISP, "STATS_BAF");
+			break;
+		case 49:
+			CAM_INFO(CAM_ISP, "STATS_RS");
+			break;
+		case 50:
+			CAM_INFO(CAM_ISP, "STATS_CS");
+			break;
+		case 51:
+			CAM_INFO(CAM_ISP, "STATS_IHIST");
+			break;
+		default:
+			CAM_ERR(CAM_ISP,
+				"Invalid Module ID:%d", module_id);
+			break;
+		}
+	}
+
+print_state:
+	soc_private = camif_priv->soc_info->soc_private;
+
+	cam_cpas_get_camnoc_fifo_fill_level_info(
+		soc_private->cpas_version,
+		soc_private->cpas_handle);
+
+	cam_cpas_log_votes();
+
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0xA20, true, &val0);
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0x1420, true, &val1);
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0x1A20, true, &val2);
+
+	if (camera_hw_version == CAM_CPAS_TITAN_580_V100) {
+		cam_cpas_reg_read(soc_private->cpas_handle,
+			CAM_CPAS_REG_CAMNOC, 0x7620, true, &val3);
+		cam_cpas_reg_read(soc_private->cpas_handle,
+			CAM_CPAS_REG_CAMNOC, 0x7420, true, &val4);
+	}
+
+	CAM_INFO(CAM_ISP,
+		"CAMNOC REG[Queued Pending] linear[%d %d] rdi0_wr[%d %d] ubwc_stats0[%d %d] ubwc_stats1[%d %d] rdi1_wr[%d %d]",
+		(val0 & 0x7FF), (val0 & 0x7F0000) >> 16,
+		(val1 & 0x7FF), (val1 & 0x7F0000) >> 16,
+		(val2 & 0x7FF), (val2 & 0x7F0000) >> 16,
+		(val3 & 0x7FF), (val3 & 0x7F0000) >> 16,
+		(val4 & 0x7FF), (val4 & 0x7F0000) >> 16);
+
+	CAM_INFO(CAM_ISP, "ife_clk_src:%lld", soc_private->ife_clk_src);
+
+	if ((err_type == CAM_VFE_IRQ_STATUS_OVERFLOW) &&
+		((camif_priv->cam_common_cfg.input_mux_sel_pp & 0x3) ||
+		(bus_overflow_status)))
+		cam_cpas_log_votes();
+}
+
+static int cam_vfe_camif_ver3_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *camif_node;
+	struct cam_vfe_mux_camif_ver3_data    *camif_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	struct cam_hw_soc_info                *soc_info = NULL;
+	void __iomem                          *camnoc_mem_base = NULL;
+	struct cam_vfe_soc_private            *soc_private = NULL;
+
+	camif_node = th_payload->handler_priv;
+	camif_priv = camif_node->res_priv;
+
+	soc_info = camif_priv->soc_info;
+	camnoc_mem_base = CAM_SOC_GET_REG_MAP_START(soc_info, 1);
+	soc_private =
+		(struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	CAM_DBG(CAM_ISP,
+		"VFE:%d CAMIF IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+		camif_node->hw_intf->hw_idx, th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1], th_payload->evt_status_arr[2]);
+
+	rc  = cam_vfe_camif_ver3_get_evt_payload(camif_priv, &evt_payload);
+	if (rc) {
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+		"VFE:%d CAMIF IRQ status_0: 0x%X status_1: 0x%X status_2: 0x%X",
+		camif_node->hw_intf->hw_idx, th_payload->evt_status_arr[0],
+		th_payload->evt_status_arr[1], th_payload->evt_status_arr[2]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	evt_payload->reg_val = 0;
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	/* Read frame_id meta at every epoch if custom hw is enabled */
+	if (evt_payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_priv->reg_data->epoch0_irq_mask) {
+		if ((camif_priv->common_reg->custom_frame_idx) &&
+			(camif_priv->cam_common_cfg.input_mux_sel_pp & 0x3))
+			evt_payload->reg_val = cam_io_r_mb(
+			camif_priv->mem_base +
+			camif_priv->common_reg->custom_frame_idx);
+	}
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	if (th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+			& camif_priv->reg_data->sof_irq_mask) {
+		trace_cam_log_event("SOF", "TOP_HALF",
+		th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1],
+		camif_node->hw_intf->hw_idx);
+
+		switch (soc_private->cpas_version) {
+		case CAM_CPAS_TITAN_570_V200:
+			/* Reset Fill levels */
+			cam_io_w_mb(0x1, camnoc_mem_base + 0x1A28);
+			cam_io_w_mb(0x1, camnoc_mem_base + 0xA28);
+			cam_io_w_mb(0x1, camnoc_mem_base + 0x1428);
+			break;
+		default:
+			break;
+		}
+	}
+
+	if (th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+			& camif_priv->reg_data->epoch0_irq_mask) {
+		trace_cam_log_event("EPOCH0", "TOP_HALF",
+		th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1],
+		camif_node->hw_intf->hw_idx);
+	}
+
+	if (th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+			& camif_priv->reg_data->eof_irq_mask) {
+		trace_cam_log_event("EOF", "TOP_HALF",
+		th_payload->evt_status_arr[CAM_IFE_IRQ_CAMIF_REG_STATUS1],
+		camif_node->hw_intf->hw_idx);
+	}
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_camif_ver3_handle_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int ret = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node *camif_node;
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	struct cam_vfe_top_irq_evt_payload *payload;
+	struct cam_isp_hw_event_info evt_info;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_vfe_soc_private *soc_private = NULL;
+	uint32_t irq_status[CAM_IFE_IRQ_REGISTERS_MAX] = {0};
+	struct timespec64 ts;
+	uint32_t val = 0;
+	int i = 0;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params handle_priv:%pK, evt_payload_priv:%pK",
+			handler_priv, evt_payload_priv);
+		return ret;
+	}
+
+	camif_node = handler_priv;
+	camif_priv = camif_node->res_priv;
+	payload = evt_payload_priv;
+
+	soc_info = camif_priv->soc_info;
+	soc_private =
+		(struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	for (i = 0; i < CAM_IFE_IRQ_REGISTERS_MAX; i++)
+		irq_status[i] = payload->irq_reg_val[i];
+
+	evt_info.hw_idx   = camif_node->hw_intf->hw_idx;
+	evt_info.res_id   = camif_node->res_id;
+	evt_info.res_type = camif_node->res_type;
+	evt_info.reg_val = 0;
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_priv->reg_data->sof_irq_mask) {
+		if ((camif_priv->enable_sof_irq_debug) &&
+			(camif_priv->irq_debug_cnt <=
+			CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "VFE:%d Received SOF",
+				evt_info.hw_idx);
+
+			camif_priv->irq_debug_cnt++;
+			if (camif_priv->irq_debug_cnt ==
+				CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+				camif_priv->enable_sof_irq_debug =
+					false;
+				camif_priv->irq_debug_cnt = 0;
+			}
+		} else {
+			CAM_DBG(CAM_ISP, "VFE:%d Received SOF",
+				evt_info.hw_idx);
+			camif_priv->sof_ts.tv_sec =
+				payload->ts.mono_time.tv_sec;
+			camif_priv->sof_ts.tv_nsec =
+				payload->ts.mono_time.tv_nsec;
+		}
+
+		cam_cpas_notify_event("IFE SOF", evt_info.hw_idx);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_priv->reg_data->epoch0_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d Received EPOCH", evt_info.hw_idx);
+		evt_info.reg_val = payload->reg_val;
+		camif_priv->epoch_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_priv->epoch_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EPOCH, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS1]
+		& camif_priv->reg_data->eof_irq_mask) {
+		CAM_DBG(CAM_ISP, "VFE:%d Received EOF", evt_info.hw_idx);
+		camif_priv->eof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		camif_priv->eof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+
+		cam_cpas_notify_event("IFE EOF", evt_info.hw_idx);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_EOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+		& camif_priv->reg_data->error_irq_mask0) {
+		CAM_ERR(CAM_ISP, "VFE:%d Overflow", evt_info.hw_idx);
+
+		CAM_INFO(CAM_ISP,
+			"SOF %lld:%lld EPOCH %lld:%lld EOF %lld:%lld",
+			camif_priv->sof_ts.tv_sec,
+			camif_priv->sof_ts.tv_nsec,
+			camif_priv->epoch_ts.tv_sec,
+			camif_priv->epoch_ts.tv_nsec,
+			camif_priv->eof_ts.tv_sec,
+			camif_priv->eof_ts.tv_nsec);
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic time stamp seconds %lld:%lld",
+			ts.tv_sec, ts.tv_nsec/1000);
+
+		ret = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		evt_info.err_type = CAM_VFE_IRQ_STATUS_OVERFLOW;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_vfe_camif_ver3_print_status(irq_status, ret, camif_priv);
+
+		if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_ver3_reg_dump(camif_node);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS0]
+		& camif_priv->reg_data->frame_id_irq_mask) {
+		val = cam_io_r_mb(camif_priv->mem_base +
+			camif_priv->common_reg->custom_frame_idx);
+		CAM_DBG(CAM_ISP,
+			"VFE:%d Frame id change to: %u", evt_info.hw_idx,
+			val);
+	}
+
+	if (irq_status[CAM_IFE_IRQ_CAMIF_REG_STATUS2]) {
+		CAM_ERR(CAM_ISP, "VFE:%d Violation", evt_info.hw_idx);
+
+		CAM_INFO(CAM_ISP,
+			"SOF %lld:%lld EPOCH %lld:%lld EOF %lld:%lld",
+			camif_priv->sof_ts.tv_sec,
+			camif_priv->sof_ts.tv_nsec,
+			camif_priv->epoch_ts.tv_sec,
+			camif_priv->epoch_ts.tv_nsec,
+			camif_priv->eof_ts.tv_sec,
+			camif_priv->eof_ts.tv_nsec);
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic time stamp seconds %lld:%lld",
+			ts.tv_sec, ts.tv_nsec/1000);
+
+		ret = CAM_VFE_IRQ_STATUS_VIOLATION;
+		evt_info.err_type = CAM_VFE_IRQ_STATUS_VIOLATION;
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+
+		cam_vfe_camif_ver3_print_status(irq_status, ret, camif_priv);
+
+		if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_REG_DUMP)
+			cam_vfe_camif_ver3_reg_dump(camif_node);
+
+		if (camif_priv->event_cb)
+			camif_priv->event_cb(camif_priv->priv,
+				CAM_ISP_HW_EVENT_ERROR, (void *)&evt_info);
+	}
+
+	if (camif_priv->camif_debug & CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS) {
+		CAM_DBG(CAM_ISP, "VFE:%d VFE_DIAG_SENSOR_STATUS: 0x%X",
+			evt_info.hw_idx, camif_priv->mem_base,
+			cam_io_r(camif_priv->mem_base +
+			camif_priv->common_reg->diag_sensor_status_0));
+	}
+
+	cam_vfe_camif_ver3_put_evt_payload(camif_priv, &payload);
+
+	CAM_DBG(CAM_ISP, "returning status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_camif_ver3_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv = NULL;
+	struct cam_vfe_camif_ver3_hw_info *camif_info = camif_hw_info;
+	int i = 0;
+
+	camif_priv = kzalloc(sizeof(struct cam_vfe_mux_camif_ver3_data),
+		GFP_KERNEL);
+	if (!camif_priv)
+		return -ENOMEM;
+
+	camif_node->res_priv = camif_priv;
+
+	camif_priv->mem_base    = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	camif_priv->camif_reg   = camif_info->camif_reg;
+	camif_priv->common_reg  = camif_info->common_reg;
+	camif_priv->reg_data    = camif_info->reg_data;
+	camif_priv->hw_intf     = hw_intf;
+	camif_priv->soc_info    = soc_info;
+	camif_priv->vfe_irq_controller = vfe_irq_controller;
+
+	camif_node->init    = cam_vfe_camif_ver3_resource_init;
+	camif_node->deinit  = cam_vfe_camif_ver3_resource_deinit;
+	camif_node->start   = cam_vfe_camif_ver3_resource_start;
+	camif_node->stop    = cam_vfe_camif_ver3_resource_stop;
+	camif_node->process_cmd = cam_vfe_camif_ver3_process_cmd;
+	camif_node->top_half_handler = cam_vfe_camif_ver3_handle_irq_top_half;
+	camif_node->bottom_half_handler =
+		cam_vfe_camif_ver3_handle_irq_bottom_half;
+	spin_lock_init(&camif_priv->spin_lock);
+	INIT_LIST_HEAD(&camif_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&camif_priv->evt_payload[i].list);
+		list_add_tail(&camif_priv->evt_payload[i].list,
+			&camif_priv->free_payload_list);
+	}
+
+	return 0;
+}
+
+int cam_vfe_camif_ver3_deinit(
+	struct cam_isp_resource_node  *camif_node)
+{
+	struct cam_vfe_mux_camif_ver3_data *camif_priv;
+	int i = 0;
+
+	if (!camif_node) {
+		CAM_ERR(CAM_ISP, "Error, camif_node is NULL %pK", camif_node);
+		return -ENODEV;
+	}
+
+	camif_priv = camif_node->res_priv;
+
+	INIT_LIST_HEAD(&camif_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_CAMIF_EVT_MAX; i++)
+		INIT_LIST_HEAD(&camif_priv->evt_payload[i].list);
+
+	camif_priv = camif_node->res_priv;
+
+	camif_node->start = NULL;
+	camif_node->stop  = NULL;
+	camif_node->process_cmd = NULL;
+	camif_node->top_half_handler = NULL;
+	camif_node->bottom_half_handler = NULL;
+	camif_node->res_priv = NULL;
+
+	if (!camif_priv) {
+		CAM_ERR(CAM_ISP, "Error, camif_priv is NULL %pK", camif_priv);
+		return -ENODEV;
+	}
+
+	kfree(camif_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver3.h
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_CAMIF_VER3_H_
+#define _CAM_VFE_CAMIF_VER3_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+#define CAM_ISP_PP_INPUT_BAYER_FMT 0
+#define CAM_ISP_PP_INPUT_YUV_FMT 1
+
+struct cam_vfe_camif_ver3_pp_clc_reg {
+	uint32_t     hw_version;
+	uint32_t     hw_status;
+	uint32_t     module_cfg;
+	uint32_t     pdaf_raw_crop_width_cfg;
+	uint32_t     pdaf_raw_crop_height_cfg;
+	uint32_t     line_skip_pattern;
+	uint32_t     pixel_skip_pattern;
+	uint32_t     period_cfg;
+	uint32_t     irq_subsample_pattern;
+	uint32_t     epoch_irq_cfg;
+	uint32_t     debug_1;
+	uint32_t     debug_0;
+	uint32_t     test_bus_ctrl;
+	uint32_t     spare;
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_vfe_camif_ver3_reg_data {
+	uint32_t     pp_extern_reg_update_shift;
+	uint32_t     dual_pd_extern_reg_update_shift;
+	uint32_t     extern_reg_update_mask;
+	uint32_t     dual_ife_pix_en_shift;
+	uint32_t     dual_ife_sync_sel_shift;
+	uint32_t     operating_mode_shift;
+	uint32_t     input_mux_sel_shift;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+
+	uint32_t     dsp_mode_shift;
+	uint32_t     dsp_mode_mask;
+	uint32_t     dsp_en_shift;
+	uint32_t     dsp_en_mask;
+
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     epoch1_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask2;
+	uint32_t     subscribe_irq_mask1;
+	uint32_t     frame_id_irq_mask;
+
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     pp_camif_cfg_en_shift;
+	uint32_t     pp_camif_cfg_ife_out_en_shift;
+	uint32_t     top_debug_cfg_en;
+	uint32_t     dual_vfe_sync_mask;
+};
+
+struct cam_vfe_camif_ver3_hw_info {
+	struct cam_vfe_top_ver3_reg_offset_common   *common_reg;
+	struct cam_vfe_camif_ver3_pp_clc_reg        *camif_reg;
+	struct cam_vfe_camif_ver3_reg_data          *reg_data;
+};
+
+int cam_vfe_camif_ver3_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param);
+
+int cam_vfe_camif_ver3_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_camif_ver3_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_CAMIF_VER3_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.c
@@ -0,0 +1,644 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+
+#include <media/cam_isp.h>
+
+#include "cam_io_util.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_fe_ver1.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_cpas_api.h"
+
+#define CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX 2
+
+struct cam_vfe_mux_fe_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_fe_ver1_reg              *fe_reg;
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_fe_reg_data               *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+
+	enum cam_isp_hw_sync_mode          sync_mode;
+	uint32_t                           dsp_mode;
+	uint32_t                           pix_pattern;
+	uint32_t                           first_pixel;
+	uint32_t                           first_line;
+	uint32_t                           last_pixel;
+	uint32_t                           last_line;
+	uint32_t                           hbi_value;
+	uint32_t                           vbi_value;
+	bool                               enable_sof_irq_debug;
+	uint32_t                           irq_debug_cnt;
+	uint32_t                           fe_cfg_data;
+	uint32_t                           hbi_count;
+};
+
+static int cam_vfe_fe_validate_pix_pattern(uint32_t pattern)
+{
+	int rc;
+
+	switch (pattern) {
+	case CAM_ISP_PATTERN_BAYER_RGRGRG:
+	case CAM_ISP_PATTERN_BAYER_GRGRGR:
+	case CAM_ISP_PATTERN_BAYER_BGBGBG:
+	case CAM_ISP_PATTERN_BAYER_GBGBGB:
+	case CAM_ISP_PATTERN_YUV_YCBYCR:
+	case CAM_ISP_PATTERN_YUV_YCRYCB:
+	case CAM_ISP_PATTERN_YUV_CBYCRY:
+	case CAM_ISP_PATTERN_YUV_CRYCBY:
+		rc = 0;
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error! Invalid pix pattern:%d", pattern);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int cam_vfe_fe_update(
+	struct cam_isp_resource_node  *fe_res,
+	void *cmd_data, uint32_t arg_size)
+{
+	struct cam_vfe_mux_fe_data    *rsrc_data = NULL;
+	struct cam_vfe_fe_update_args    *args = cmd_data;
+	uint32_t                         fe_cfg_data;
+
+	if (arg_size != sizeof(struct cam_vfe_fe_update_args)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "fe_update->min_vbi = 0x%x", args->fe_config.min_vbi);
+	CAM_DBG(CAM_ISP, "fe_update->hbi_count = 0x%x",
+		args->fe_config.hbi_count);
+	CAM_DBG(CAM_ISP, "fe_update->fs_mode = 0x%x", args->fe_config.fs_mode);
+	CAM_DBG(CAM_ISP, "fe_update->fs_line_sync_en = 0x%x",
+		args->fe_config.fs_line_sync_en);
+
+	fe_cfg_data = args->fe_config.min_vbi |
+			args->fe_config.fs_mode << 8 |
+			args->fe_config.fs_line_sync_en;
+
+	rsrc_data = fe_res->res_priv;
+	rsrc_data->fe_cfg_data = fe_cfg_data;
+	rsrc_data->hbi_count = args->fe_config.hbi_count;
+
+	CAM_DBG(CAM_ISP, "fe_cfg_data = 0x%x", fe_cfg_data);
+	return 0;
+}
+
+static int cam_vfe_fe_get_reg_update(
+	struct cam_isp_resource_node  *fe_res,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_vfe_mux_fe_data    *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	rsrc_data = fe_res->res_priv;
+	reg_val_pair[0] = rsrc_data->fe_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "CAMIF reg_update_cmd 0x%x offset 0x%x",
+		reg_val_pair[1], reg_val_pair[0]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_fe_ver1_acquire_resource(
+	struct cam_isp_resource_node  *fe_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_fe_data    *fe_data;
+	struct cam_vfe_acquire_args      *acquire_data;
+
+	int rc = 0;
+
+	fe_data   = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args   *)acquire_param;
+
+	rc = cam_vfe_fe_validate_pix_pattern(
+			acquire_data->vfe_in.in_port->test_pattern);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "pix validation failed: id:%d pix_pattern %d",
+			fe_res->hw_intf->hw_idx,
+			acquire_data->vfe_in.in_port->test_pattern);
+		return rc;
+	}
+
+	fe_data->sync_mode   = acquire_data->vfe_in.sync_mode;
+	fe_data->pix_pattern = acquire_data->vfe_in.in_port->test_pattern;
+	fe_data->dsp_mode    = acquire_data->vfe_in.in_port->dsp_mode;
+	fe_data->first_pixel = acquire_data->vfe_in.in_port->left_start;
+	fe_data->last_pixel  = acquire_data->vfe_in.in_port->left_stop;
+	fe_data->first_line  = acquire_data->vfe_in.in_port->line_start;
+	fe_data->last_line   = acquire_data->vfe_in.in_port->line_stop;
+	fe_data->hbi_value   = 0;
+	fe_data->vbi_value   = 0;
+
+	CAM_DBG(CAM_ISP, "hw id:%d pix_pattern:%d dsp_mode=%d",
+		fe_res->hw_intf->hw_idx,
+		fe_data->pix_pattern, fe_data->dsp_mode);
+	return rc;
+}
+
+static int cam_vfe_fe_resource_init(
+	struct cam_isp_resource_node        *fe_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_fe_data    *fe_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	fe_data   = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+
+	soc_info = fe_data->soc_info;
+
+	if ((fe_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(fe_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_enable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to enable dsp clk");
+	}
+
+	return rc;
+}
+
+static int cam_vfe_fe_resource_deinit(
+	struct cam_isp_resource_node        *fe_res,
+	void *init_args, uint32_t arg_size)
+{
+	struct cam_vfe_mux_fe_data    *fe_data;
+	struct cam_hw_soc_info           *soc_info;
+	int rc = 0;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error Invalid input arguments");
+		return -EINVAL;
+	}
+
+	fe_data   = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+
+	soc_info = fe_data->soc_info;
+
+	if ((fe_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(fe_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		rc = cam_vfe_soc_disable_clk(soc_info, CAM_VFE_DSP_CLK_NAME);
+		if (rc)
+			CAM_ERR(CAM_ISP, "failed to disable dsp clk");
+	}
+
+	return rc;
+
+}
+
+static int cam_vfe_fe_resource_start(
+	struct cam_isp_resource_node        *fe_res)
+{
+	struct cam_vfe_mux_fe_data       *rsrc_data;
+	uint32_t                             val = 0;
+	uint32_t                             epoch0_irq_mask;
+	uint32_t                             epoch1_irq_mask;
+	uint32_t                             computed_epoch_line_cfg;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (fe_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Invalid fe res res_state:%d",
+			fe_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_vfe_mux_fe_data  *)fe_res->res_priv;
+
+	/* config vfe core */
+	val = (rsrc_data->pix_pattern <<
+			rsrc_data->reg_data->pixel_pattern_shift);
+	if (rsrc_data->sync_mode == CAM_ISP_HW_SYNC_SLAVE)
+		val |= (1 << rsrc_data->reg_data->extern_reg_update_shift);
+
+	if ((rsrc_data->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(rsrc_data->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		/* DSP mode reg val is CAM_ISP_DSP_MODE - 1 */
+		val |= (((rsrc_data->dsp_mode - 1) &
+			rsrc_data->reg_data->dsp_mode_mask) <<
+			rsrc_data->reg_data->dsp_mode_shift);
+		val |= (0x1 << rsrc_data->reg_data->dsp_en_shift);
+	}
+
+	if (rsrc_data->fe_cfg_data) {
+		/*set Mux mode value to EXT_RD_PATH */
+		val |= (rsrc_data->reg_data->fe_mux_data <<
+				rsrc_data->reg_data->input_mux_sel_shift);
+	}
+
+	if (rsrc_data->hbi_count) {
+		/*set hbi count*/
+		val |= (rsrc_data->hbi_count <<
+			rsrc_data->reg_data->hbi_cnt_shift);
+	}
+	cam_io_w_mb(val, rsrc_data->mem_base + rsrc_data->common_reg->core_cfg);
+
+	CAM_DBG(CAM_ISP, "hw id:%d core_cfg (off:0x%x, val:0x%x)",
+		fe_res->hw_intf->hw_idx,
+		rsrc_data->common_reg->core_cfg,
+		val);
+
+	/* disable the CGC for stats */
+	cam_io_w_mb(0xFFFFFFFF, rsrc_data->mem_base +
+		rsrc_data->common_reg->module_ctrl[
+		CAM_VFE_TOP_VER2_MODULE_STATS]->cgc_ovd);
+
+	/* epoch config */
+	epoch0_irq_mask = (((rsrc_data->last_line + rsrc_data->vbi_value) -
+		rsrc_data->first_line) / 2);
+	if (epoch0_irq_mask > (rsrc_data->last_line - rsrc_data->first_line))
+		epoch0_irq_mask = rsrc_data->last_line - rsrc_data->first_line;
+
+	epoch1_irq_mask = rsrc_data->reg_data->epoch_line_cfg & 0xFFFF;
+	computed_epoch_line_cfg = (epoch0_irq_mask << 16) | epoch1_irq_mask;
+	cam_io_w_mb(computed_epoch_line_cfg,
+		rsrc_data->mem_base + rsrc_data->fe_reg->epoch_irq);
+	CAM_DBG(CAM_ISP,
+		"first_line:0x%x last_line:0x%x vbi:0x%x epoch_line_cfg: 0x%x",
+		rsrc_data->first_line, rsrc_data->last_line,
+		rsrc_data->vbi_value, computed_epoch_line_cfg);
+
+	fe_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Read Back cfg */
+	cam_io_w_mb(rsrc_data->fe_cfg_data,
+		rsrc_data->mem_base + rsrc_data->fe_reg->fe_cfg);
+	CAM_DBG(CAM_ISP, "hw id:%d fe_cfg_data(off:0x%x val:0x%x)",
+		fe_res->hw_intf->hw_idx,
+		rsrc_data->fe_reg->fe_cfg,
+		rsrc_data->fe_cfg_data);
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base + rsrc_data->fe_reg->reg_update_cmd);
+	CAM_DBG(CAM_ISP, "hw id:%d RUP (off:0x%x, val:0x%x)",
+		fe_res->hw_intf->hw_idx,
+		rsrc_data->fe_reg->reg_update_cmd,
+		rsrc_data->reg_data->reg_update_cmd_data);
+
+	/* disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
+	CAM_DBG(CAM_ISP, "Start Camif IFE %d Done", fe_res->hw_intf->hw_idx);
+	return 0;
+}
+
+static int cam_vfe_fe_reg_dump(
+	struct cam_isp_resource_node *fe_res)
+{
+	struct cam_vfe_mux_fe_data *fe_priv;
+	struct cam_vfe_soc_private *soc_private;
+	int rc = 0, i;
+	uint32_t val = 0;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if ((fe_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED) ||
+		(fe_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE))
+		return 0;
+
+	fe_priv = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+	soc_private = fe_priv->soc_info->soc_private;
+	for (i = 0xA3C; i <= 0xA90; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	for (i = 0xE0C; i <= 0xE3C; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	for (i = 0x2000; i <= 0x20B8; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	for (i = 0x2500; i <= 0x255C; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	for (i = 0x2600; i <= 0x265C; i += 4) {
+		val = cam_io_r_mb(fe_priv->mem_base + i);
+		CAM_INFO(CAM_ISP, "offset 0x%x val 0x%x", i, val);
+	}
+
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0x420, true, &val);
+	CAM_INFO(CAM_ISP, "IFE02_MAXWR_LOW offset 0x420 val 0x%x", val);
+
+	cam_cpas_reg_read(soc_private->cpas_handle,
+		CAM_CPAS_REG_CAMNOC, 0x820, true, &val);
+	CAM_INFO(CAM_ISP, "IFE13_MAXWR_LOW offset 0x820 val 0x%x", val);
+
+	return rc;
+}
+
+static int cam_vfe_fe_resource_stop(
+	struct cam_isp_resource_node        *fe_res)
+{
+	struct cam_vfe_mux_fe_data       *fe_priv;
+	struct cam_vfe_fe_ver1_reg       *fe_reg;
+	int rc = 0;
+	uint32_t val = 0;
+
+	if (!fe_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (fe_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		fe_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	fe_priv = (struct cam_vfe_mux_fe_data *)fe_res->res_priv;
+	fe_reg = fe_priv->fe_reg;
+
+	if ((fe_priv->dsp_mode >= CAM_ISP_DSP_MODE_ONE_WAY) &&
+		(fe_priv->dsp_mode <= CAM_ISP_DSP_MODE_ROUND)) {
+		val = cam_io_r_mb(fe_priv->mem_base +
+				fe_priv->common_reg->core_cfg);
+		val &= (~(1 << fe_priv->reg_data->dsp_en_shift));
+		cam_io_w_mb(val, fe_priv->mem_base +
+			fe_priv->common_reg->core_cfg);
+	}
+
+	if (fe_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		fe_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	return rc;
+}
+
+static int cam_vfe_fe_sof_irq_debug(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_fe_data *fe_priv;
+	uint32_t *enable_sof_irq = (uint32_t *)cmd_args;
+
+	fe_priv =
+		(struct cam_vfe_mux_fe_data *)rsrc_node->res_priv;
+
+	if (*enable_sof_irq == 1)
+		fe_priv->enable_sof_irq_debug = true;
+	else
+		fe_priv->enable_sof_irq_debug = false;
+
+	return 0;
+}
+
+static int cam_vfe_fe_blanking_update(
+	struct cam_isp_resource_node *rsrc_node, void *cmd_args)
+{
+	struct cam_vfe_mux_fe_data *fe_priv =
+		(struct cam_vfe_mux_fe_data *)rsrc_node->res_priv;
+
+	struct cam_isp_blanking_config  *blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+
+	fe_priv->hbi_value = blanking_config->hbi;
+	fe_priv->vbi_value = blanking_config->vbi;
+	CAM_DBG(CAM_ISP, "hbi:%d vbi:%d",
+		fe_priv->hbi_value, fe_priv->vbi_value);
+
+	return 0;
+}
+
+static int cam_vfe_fe_process_cmd(struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_fe_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_SOF_IRQ_DEBUG:
+		rc = cam_vfe_fe_sof_irq_debug(rsrc_node, cmd_args);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_IN_RD:
+		rc = cam_vfe_fe_update(rsrc_node, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_fe_blanking_update(rsrc_node, cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_fe_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_fe_handle_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int                                   ret = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node         *fe_node;
+	struct cam_vfe_mux_fe_data           *fe_priv;
+	struct cam_vfe_top_irq_evt_payload   *payload;
+	struct cam_isp_hw_event_info          evt_info;
+	uint32_t                              irq_status0;
+	uint32_t                              irq_status1;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	fe_node = handler_priv;
+	fe_priv = fe_node->res_priv;
+	payload = evt_payload_priv;
+	irq_status0 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	irq_status1 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1];
+
+	evt_info.hw_idx = fe_node->hw_intf->hw_idx;
+	evt_info.res_id = fe_node->res_id;
+	evt_info.res_type = fe_node->res_type;
+
+	CAM_DBG(CAM_ISP, "event ID, irq_status_0 = 0x%x", irq_status0);
+
+	if (irq_status0 & fe_priv->reg_data->sof_irq_mask) {
+		if ((fe_priv->enable_sof_irq_debug) &&
+			(fe_priv->irq_debug_cnt <=
+			CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "Received SOF");
+
+			fe_priv->irq_debug_cnt++;
+			if (fe_priv->irq_debug_cnt ==
+				CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+				fe_priv->enable_sof_irq_debug =
+					false;
+				fe_priv->irq_debug_cnt = 0;
+			}
+		} else {
+			CAM_DBG(CAM_ISP, "Received SOF");
+		}
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & fe_priv->reg_data->epoch0_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received EPOCH");
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & fe_priv->reg_data->reg_update_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received REG_UPDATE_ACK");
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & fe_priv->reg_data->eof_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received EOF");
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status1 & fe_priv->reg_data->error_irq_mask1) {
+		CAM_DBG(CAM_ISP, "Received ERROR");
+		ret = CAM_ISP_HW_ERROR_OVERFLOW;
+		evt_info.err_type = CAM_VFE_IRQ_STATUS_OVERFLOW;
+		cam_vfe_fe_reg_dump(fe_node);
+	} else {
+		ret = CAM_ISP_HW_ERROR_NONE;
+	}
+
+	CAM_DBG(CAM_ISP, "returing status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_fe_ver1_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *fe_hw_info,
+	struct cam_isp_resource_node  *fe_node)
+{
+	struct cam_vfe_mux_fe_data     *fe_priv = NULL;
+	struct cam_vfe_fe_ver1_hw_info *fe_info = fe_hw_info;
+
+	fe_priv = kzalloc(sizeof(struct cam_vfe_mux_fe_data),
+		GFP_KERNEL);
+	if (!fe_priv) {
+		CAM_ERR(CAM_ISP, "Error! Failed to alloc for fe_priv");
+		return -ENOMEM;
+	}
+
+	fe_node->res_priv = fe_priv;
+
+	fe_priv->mem_base    = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	fe_priv->fe_reg  = fe_info->fe_reg;
+	fe_priv->common_reg  = fe_info->common_reg;
+	fe_priv->reg_data    = fe_info->reg_data;
+	fe_priv->hw_intf     = hw_intf;
+	fe_priv->soc_info    = soc_info;
+
+	fe_node->init    = cam_vfe_fe_resource_init;
+	fe_node->deinit  = cam_vfe_fe_resource_deinit;
+	fe_node->start   = cam_vfe_fe_resource_start;
+	fe_node->stop    = cam_vfe_fe_resource_stop;
+	fe_node->process_cmd = cam_vfe_fe_process_cmd;
+	fe_node->top_half_handler = cam_vfe_fe_handle_irq_top_half;
+	fe_node->bottom_half_handler = cam_vfe_fe_handle_irq_bottom_half;
+
+	return 0;
+}
+
+int cam_vfe_fe_ver1_deinit(
+	struct cam_isp_resource_node  *fe_node)
+{
+	struct cam_vfe_mux_fe_data *fe_priv = fe_node->res_priv;
+
+	fe_node->start = NULL;
+	fe_node->stop  = NULL;
+	fe_node->process_cmd = NULL;
+	fe_node->top_half_handler = NULL;
+	fe_node->bottom_half_handler = NULL;
+
+	fe_node->res_priv = NULL;
+
+	if (!fe_priv) {
+		CAM_ERR(CAM_ISP, "Error! fe_priv is NULL");
+		return -ENODEV;
+	}
+
+	kfree(fe_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_fe_ver1.h
@@ -0,0 +1,87 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_FE_VER1_H_
+#define _CAM_VFE_FE_VER1_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+struct cam_vfe_fe_ver1_reg {
+	uint32_t     camif_cmd;
+	uint32_t     camif_config;
+	uint32_t     line_skip_pattern;
+	uint32_t     pixel_skip_pattern;
+	uint32_t     skip_period;
+	uint32_t     irq_subsample_pattern;
+	uint32_t     epoch_irq;
+	uint32_t     raw_crop_width_cfg;
+	uint32_t     raw_crop_height_cfg;
+	uint32_t     reg_update_cmd;
+	uint32_t     vfe_diag_config;
+	uint32_t     vfe_diag_sensor_status;
+	uint32_t     fe_cfg;
+};
+
+struct cam_vfe_fe_reg_data {
+	uint32_t     raw_crop_first_pixel_shift;
+	uint32_t     raw_crop_first_pixel_mask;
+
+	uint32_t     raw_crop_last_pixel_shift;
+	uint32_t     raw_crop_last_pixel_mask;
+
+	uint32_t     raw_crop_first_line_shift;
+	uint32_t     raw_crop_first_line_mask;
+
+	uint32_t     raw_crop_last_line_shift;
+	uint32_t     raw_crop_last_line_mask;
+
+	uint32_t     input_mux_sel_shift;
+	uint32_t     input_mux_sel_mask;
+	uint32_t     extern_reg_update_shift;
+	uint32_t     extern_reg_update_mask;
+
+	uint32_t     pixel_pattern_shift;
+	uint32_t     pixel_pattern_mask;
+
+	uint32_t     dsp_mode_shift;
+	uint32_t     dsp_mode_mask;
+	uint32_t     dsp_en_shift;
+	uint32_t     dsp_en_mask;
+
+	uint32_t     reg_update_cmd_data;
+	uint32_t     epoch_line_cfg;
+	uint32_t     sof_irq_mask;
+	uint32_t     epoch0_irq_mask;
+	uint32_t     reg_update_irq_mask;
+	uint32_t     eof_irq_mask;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask1;
+
+	uint32_t     enable_diagnostic_hw;
+	uint32_t     fe_mux_data;
+	uint32_t     hbi_cnt_shift;
+};
+
+struct cam_vfe_fe_ver1_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_fe_ver1_reg              *fe_reg;
+	struct cam_vfe_fe_reg_data              *reg_data;
+};
+
+int cam_vfe_fe_ver1_acquire_resource(
+	struct cam_isp_resource_node  *camif_res,
+	void                          *acquire_param);
+
+int cam_vfe_fe_ver1_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *camif_hw_info,
+	struct cam_isp_resource_node  *camif_node);
+
+int cam_vfe_fe_ver1_deinit(
+	struct cam_isp_resource_node  *camif_node);
+
+#endif /* _CAM_VFE_FE_VER1_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.c
@@ -0,0 +1,682 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_vfe_rdi.h"
+#include "cam_isp_hw_mgr_intf.h"
+#include "cam_isp_hw.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "cam_irq_controller.h"
+#include "cam_tasklet_util.h"
+#include "cam_cpas_api.h"
+
+struct cam_vfe_mux_rdi_data {
+	void __iomem                                *mem_base;
+	struct cam_hw_intf                          *hw_intf;
+	struct cam_vfe_top_ver2_reg_offset_common   *common_reg;
+	struct cam_vfe_rdi_ver2_reg                 *rdi_reg;
+	struct cam_vfe_rdi_common_reg_data          *rdi_common_reg_data;
+	struct cam_vfe_rdi_overflow_status          *rdi_irq_status;
+	struct cam_vfe_rdi_reg_data                 *reg_data;
+	struct cam_hw_soc_info                      *soc_info;
+
+	cam_hw_mgr_event_cb_func              event_cb;
+	void                                 *priv;
+	int                                   irq_err_handle;
+	int                                   irq_handle;
+	void                                 *vfe_irq_controller;
+	struct cam_vfe_top_irq_evt_payload    evt_payload[CAM_VFE_RDI_EVT_MAX];
+	struct list_head                      free_payload_list;
+	spinlock_t                            spin_lock;
+
+	enum cam_isp_hw_sync_mode             sync_mode;
+	struct timespec64                     sof_ts;
+	struct timespec64                     error_ts;
+};
+
+static int cam_vfe_rdi_get_evt_payload(
+	struct cam_vfe_mux_rdi_data              *rdi_priv,
+	struct cam_vfe_top_irq_evt_payload     **evt_payload)
+{
+	int rc = 0;
+
+	spin_lock(&rdi_priv->spin_lock);
+	if (list_empty(&rdi_priv->free_payload_list)) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No free payload");
+		rc = -ENODEV;
+		goto done;
+	}
+
+	*evt_payload = list_first_entry(&rdi_priv->free_payload_list,
+		struct cam_vfe_top_irq_evt_payload, list);
+	list_del_init(&(*evt_payload)->list);
+	rc = 0;
+done:
+	spin_unlock(&rdi_priv->spin_lock);
+	return rc;
+}
+
+static int cam_vfe_rdi_put_evt_payload(
+	struct cam_vfe_mux_rdi_data              *rdi_priv,
+	struct cam_vfe_top_irq_evt_payload      **evt_payload)
+{
+	unsigned long flags;
+
+	if (!rdi_priv) {
+		CAM_ERR(CAM_ISP, "Invalid param core_info NULL");
+		return -EINVAL;
+	}
+	if (*evt_payload == NULL) {
+		CAM_ERR(CAM_ISP, "No payload to put");
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&rdi_priv->spin_lock, flags);
+	list_add_tail(&(*evt_payload)->list, &rdi_priv->free_payload_list);
+	*evt_payload = NULL;
+	spin_unlock_irqrestore(&rdi_priv->spin_lock, flags);
+
+	CAM_DBG(CAM_ISP, "Done");
+	return 0;
+}
+
+static int cam_vfe_rdi_cpas_reg_dump(
+struct cam_vfe_mux_rdi_data *rdi_priv)
+{
+	int rc = 0;
+	struct cam_vfe_soc_private *soc_private =
+		rdi_priv->soc_info->soc_private;
+	uint32_t  val;
+
+	if (soc_private->cpas_version == CAM_CPAS_TITAN_175_V120 ||
+		soc_private->cpas_version == CAM_CPAS_TITAN_175_V130 ||
+		soc_private->cpas_version == CAM_CPAS_TITAN_165_V100) {
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x3A20, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"IFE0_nRDI_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP, "IFE0_nRDI_MAXWR_LOW offset 0x3A20 val 0x%x",
+			val);
+
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x5420, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"IFE1_nRDI_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP, "IFE1_nRDI_MAXWR_LOW offset 0x5420 val 0x%x",
+			val);
+
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x3620, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"IFE0123_RDI_WR_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP,
+			"IFE0123_RDI_WR_MAXWR_LOW offset 0x3620 val 0x%x", val);
+
+	} else if (soc_private->cpas_version < CAM_CPAS_TITAN_175_V120) {
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x420, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "IFE02_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP, "IFE02_MAXWR_LOW offset 0x420 val 0x%x", val);
+
+		rc = cam_cpas_reg_read(soc_private->cpas_handle,
+				CAM_CPAS_REG_CAMNOC, 0x820, true, &val);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "IFE13_MAXWR_LOW read failed rc=%d",
+				rc);
+			return rc;
+		}
+		CAM_INFO(CAM_ISP, "IFE13_MAXWR_LOW offset 0x820 val 0x%x", val);
+	}
+
+	return 0;
+}
+
+static int cam_vfe_rdi_err_irq_top_half(
+	uint32_t                               evt_id,
+	struct cam_irq_th_payload             *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *rdi_node;
+	struct cam_vfe_mux_rdi_data           *rdi_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+	bool                                   error_flag = false;
+
+	CAM_DBG(CAM_ISP, "IRQ status_1 = %x", th_payload->evt_status_arr[1]);
+
+	rdi_node = th_payload->handler_priv;
+	rdi_priv = rdi_node->res_priv;
+	/*
+	 *  need to handle overflow condition here, otherwise irq storm
+	 *  will block everything
+	 */
+	if (th_payload->evt_status_arr[1]) {
+		CAM_ERR(CAM_ISP,
+			"RDI Error: vfe:%d: STATUS_1=0x%x",
+			rdi_node->hw_intf->hw_idx,
+			th_payload->evt_status_arr[1]);
+		CAM_ERR(CAM_ISP, "Stopping further IRQ processing from vfe=%d",
+			rdi_node->hw_intf->hw_idx);
+		cam_irq_controller_disable_irq(rdi_priv->vfe_irq_controller,
+			rdi_priv->irq_err_handle);
+		cam_irq_controller_clear_and_mask(evt_id,
+			rdi_priv->vfe_irq_controller);
+		error_flag = true;
+	}
+
+	rc  = cam_vfe_rdi_get_evt_payload(rdi_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP,
+			"No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "STATUS_1=0x%x",
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+	if (error_flag) {
+		rdi_priv->error_ts.tv_sec =
+			evt_payload->ts.mono_time.tv_sec;
+		rdi_priv->error_ts.tv_nsec =
+			evt_payload->ts.mono_time.tv_nsec;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->irq_reg_val[i] = cam_io_r(rdi_priv->mem_base +
+			rdi_priv->common_reg->violation_status);
+
+	if (error_flag)
+		CAM_INFO(CAM_ISP, "Violation status = 0x%x",
+			evt_payload->irq_reg_val[i]);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
+}
+
+static int cam_vfe_rdi_get_reg_update(
+	struct cam_isp_resource_node  *rdi_res,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_vfe_mux_rdi_data      *rsrc_data = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error - Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res) {
+		CAM_ERR(CAM_ISP, "Error - Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops = (struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Error - Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP,
+			"Error - buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size * 4);
+		return -EINVAL;
+	}
+
+	rsrc_data = rdi_res->res_priv;
+	reg_val_pair[0] = rsrc_data->rdi_reg->reg_update_cmd;
+	reg_val_pair[1] = rsrc_data->reg_data->reg_update_cmd_data;
+	CAM_DBG(CAM_ISP, "RDI%d reg_update_cmd %x",
+		rdi_res->res_id - CAM_ISP_HW_VFE_IN_RDI0, reg_val_pair[1]);
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+	cdm_args->cmd.used_bytes = size * 4;
+
+	return 0;
+}
+
+int cam_vfe_rdi_ver2_acquire_resource(
+	struct cam_isp_resource_node  *rdi_res,
+	void                          *acquire_param)
+{
+	struct cam_vfe_mux_rdi_data   *rdi_data;
+	struct cam_vfe_acquire_args   *acquire_data;
+
+	rdi_data     = (struct cam_vfe_mux_rdi_data *)rdi_res->res_priv;
+	acquire_data = (struct cam_vfe_acquire_args *)acquire_param;
+
+	rdi_data->event_cb    = acquire_data->event_cb;
+	rdi_data->priv        = acquire_data->priv;
+	rdi_data->sync_mode   = acquire_data->vfe_in.sync_mode;
+	rdi_res->rdi_only_ctx = 0;
+
+	return 0;
+}
+
+static int cam_vfe_rdi_resource_start(
+	struct cam_isp_resource_node  *rdi_res)
+{
+	struct cam_vfe_mux_rdi_data   *rsrc_data;
+	int                            rc = 0;
+	uint32_t                       err_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX];
+	uint32_t                 rdi_irq_mask[CAM_IFE_IRQ_REGISTERS_MAX] = {0};
+
+	if (!rdi_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (rdi_res->res_state != CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Invalid rdi res res_state:%d",
+			rdi_res->res_state);
+		return -EINVAL;
+	}
+
+	rsrc_data = (struct cam_vfe_mux_rdi_data  *)rdi_res->res_priv;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS0] =
+		rsrc_data->rdi_common_reg_data->error_irq_mask0;
+	err_irq_mask[CAM_IFE_IRQ_CAMIF_REG_STATUS1] =
+		rsrc_data->rdi_common_reg_data->error_irq_mask1;
+
+	rdi_res->res_state = CAM_ISP_RESOURCE_STATE_STREAMING;
+
+	/* Reg Update */
+	cam_io_w_mb(rsrc_data->reg_data->reg_update_cmd_data,
+		rsrc_data->mem_base + rsrc_data->rdi_reg->reg_update_cmd);
+
+	if (!rsrc_data->irq_err_handle) {
+		rsrc_data->irq_err_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_0,
+			err_irq_mask,
+			rdi_res,
+			cam_vfe_rdi_err_irq_top_half,
+			rdi_res->bottom_half_handler,
+			rdi_res->tasklet_info,
+			&tasklet_bh_api);
+		if (rsrc_data->irq_err_handle < 1) {
+			CAM_ERR(CAM_ISP, "Error IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_err_handle = 0;
+		}
+	}
+
+	if (!rdi_res->rdi_only_ctx)
+		goto end;
+
+	rdi_irq_mask[0] =
+		(rsrc_data->reg_data->reg_update_irq_mask |
+			rsrc_data->reg_data->sof_irq_mask);
+
+	CAM_DBG(CAM_ISP, "RDI%d irq_mask 0x%x",
+		rdi_res->res_id - CAM_ISP_HW_VFE_IN_RDI0,
+		rdi_irq_mask[0]);
+
+	if (!rsrc_data->irq_handle) {
+		rsrc_data->irq_handle = cam_irq_controller_subscribe_irq(
+			rsrc_data->vfe_irq_controller,
+			CAM_IRQ_PRIORITY_1,
+			rdi_irq_mask,
+			rdi_res,
+			rdi_res->top_half_handler,
+			rdi_res->bottom_half_handler,
+			rdi_res->tasklet_info,
+			&tasklet_bh_api);
+		if (rsrc_data->irq_handle < 1) {
+			CAM_ERR(CAM_ISP, "IRQ handle subscribe failure");
+			rc = -ENOMEM;
+			rsrc_data->irq_handle = 0;
+		}
+	}
+
+	rsrc_data->sof_ts.tv_sec = 0;
+	rsrc_data->sof_ts.tv_nsec = 0;
+	rsrc_data->error_ts.tv_sec = 0;
+	rsrc_data->error_ts.tv_nsec = 0;
+
+	CAM_DBG(CAM_ISP, "Start RDI %d",
+		rdi_res->res_id - CAM_ISP_HW_VFE_IN_RDI0);
+end:
+	return rc;
+}
+
+
+static int cam_vfe_rdi_resource_stop(
+	struct cam_isp_resource_node        *rdi_res)
+{
+	struct cam_vfe_mux_rdi_data         *rdi_priv;
+	int rc = 0;
+
+	if (!rdi_res) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	if (rdi_res->res_state == CAM_ISP_RESOURCE_STATE_RESERVED ||
+		rdi_res->res_state == CAM_ISP_RESOURCE_STATE_AVAILABLE)
+		return 0;
+
+	rdi_priv = (struct cam_vfe_mux_rdi_data *)rdi_res->res_priv;
+
+	if (rdi_res->res_state == CAM_ISP_RESOURCE_STATE_STREAMING)
+		rdi_res->res_state = CAM_ISP_RESOURCE_STATE_RESERVED;
+
+	if (rdi_priv->irq_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			rdi_priv->vfe_irq_controller, rdi_priv->irq_handle);
+		rdi_priv->irq_handle = 0;
+	}
+
+	if (rdi_priv->irq_err_handle) {
+		cam_irq_controller_unsubscribe_irq(
+			rdi_priv->vfe_irq_controller, rdi_priv->irq_err_handle);
+		rdi_priv->irq_err_handle = 0;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_rdi_process_cmd(struct cam_isp_resource_node *rsrc_node,
+	uint32_t cmd_type, void *cmd_args, uint32_t arg_size)
+{
+	int rc = -EINVAL;
+
+	if (!rsrc_node || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_rdi_get_reg_update(rsrc_node, cmd_args,
+			arg_size);
+		break;
+	default:
+		CAM_ERR(CAM_ISP,
+			"unsupported RDI process command:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_rdi_handle_irq_top_half(uint32_t evt_id,
+	struct cam_irq_th_payload *th_payload)
+{
+	int32_t                                rc;
+	int                                    i;
+	struct cam_isp_resource_node          *rdi_node;
+	struct cam_vfe_mux_rdi_data           *rdi_priv;
+	struct cam_vfe_top_irq_evt_payload    *evt_payload;
+
+	rdi_node = th_payload->handler_priv;
+	rdi_priv = rdi_node->res_priv;
+
+	CAM_DBG(CAM_ISP, "IRQ status_0 = %x", th_payload->evt_status_arr[0]);
+	CAM_DBG(CAM_ISP, "IRQ status_1 = %x", th_payload->evt_status_arr[1]);
+
+	rc  = cam_vfe_rdi_get_evt_payload(rdi_priv, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "No tasklet_cmd is free in queue");
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "IRQ status0=0x%x status1=0x%x",
+			th_payload->evt_status_arr[0],
+			th_payload->evt_status_arr[1]);
+		return rc;
+	}
+
+	cam_isp_hw_get_timestamp(&evt_payload->ts);
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	CAM_DBG(CAM_ISP, "Exit");
+	return rc;
+}
+
+static int cam_vfe_rdi_handle_irq_bottom_half(void *handler_priv,
+	void *evt_payload_priv)
+{
+	int                                  ret = CAM_VFE_IRQ_STATUS_ERR;
+	struct cam_isp_resource_node        *rdi_node;
+	struct cam_vfe_mux_rdi_data         *rdi_priv;
+	struct cam_vfe_top_irq_evt_payload  *payload;
+	struct cam_isp_hw_event_info         evt_info;
+	uint32_t                             irq_status0;
+	uint32_t                             irq_status1;
+	uint32_t                             irq_rdi_status;
+	struct cam_hw_soc_info              *soc_info = NULL;
+	struct cam_vfe_soc_private          *soc_private = NULL;
+	struct timespec64                    ts;
+
+	if (!handler_priv || !evt_payload_priv) {
+		CAM_ERR(CAM_ISP, "Invalid params");
+		return ret;
+	}
+
+	rdi_node = handler_priv;
+	rdi_priv = rdi_node->res_priv;
+	payload = evt_payload_priv;
+	soc_info = rdi_priv->soc_info;
+	soc_private =
+		(struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	irq_status0 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS0];
+	irq_status1 = payload->irq_reg_val[CAM_IFE_IRQ_CAMIF_REG_STATUS1];
+
+	evt_info.hw_idx   = rdi_node->hw_intf->hw_idx;
+	evt_info.res_id   = rdi_node->res_id;
+	evt_info.res_type = rdi_node->res_type;
+
+	CAM_DBG(CAM_ISP, "irq_status_0 = %x", irq_status0);
+
+	if (irq_status0 & rdi_priv->reg_data->sof_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received SOF");
+		rdi_priv->sof_ts.tv_sec =
+			payload->ts.mono_time.tv_sec;
+		rdi_priv->sof_ts.tv_nsec =
+			payload->ts.mono_time.tv_nsec;
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_SOF, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (irq_status0 & rdi_priv->reg_data->reg_update_irq_mask) {
+		CAM_DBG(CAM_ISP, "Received REG UPDATE");
+
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+				CAM_ISP_HW_EVENT_REG_UPDATE, (void *)&evt_info);
+
+		ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+	}
+
+	if (!rdi_priv->rdi_irq_status)
+		goto end;
+
+	irq_rdi_status =
+		(irq_status1 &
+		rdi_priv->rdi_irq_status->rdi_overflow_mask);
+	if (irq_rdi_status) {
+		ktime_get_boottime_ts64(&ts);
+		CAM_INFO(CAM_ISP,
+			"current monotonic time stamp seconds %lld:%lld",
+			ts.tv_sec, ts.tv_nsec/1000);
+
+		cam_vfe_rdi_cpas_reg_dump(rdi_priv);
+
+		CAM_INFO(CAM_ISP, "ife_clk_src:%lld",
+			soc_private->ife_clk_src);
+		CAM_INFO(CAM_ISP,
+			"ERROR time %lld:%lld SOF %lld:%lld",
+			rdi_priv->error_ts.tv_sec,
+			rdi_priv->error_ts.tv_nsec,
+			rdi_priv->sof_ts.tv_sec,
+			rdi_priv->sof_ts.tv_nsec);
+
+		if (irq_rdi_status &
+			rdi_priv->rdi_irq_status->rdi0_overflow_mask) {
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_0;
+			}
+		else if (irq_rdi_status &
+			rdi_priv->rdi_irq_status->rdi1_overflow_mask) {
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_1;
+			}
+		else if (irq_rdi_status &
+			rdi_priv->rdi_irq_status->rdi2_overflow_mask) {
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_2;
+			}
+		else if (irq_rdi_status &
+			rdi_priv->rdi_irq_status->rdi3_overflow_mask) {
+			evt_info.res_id = CAM_ISP_IFE_OUT_RES_RDI_3;
+			}
+
+		if (rdi_priv->event_cb)
+			rdi_priv->event_cb(rdi_priv->priv,
+			CAM_ISP_HW_EVENT_ERROR,
+			(void *)&evt_info);
+
+		cam_cpas_get_camnoc_fifo_fill_level_info(
+			soc_private->cpas_version,
+			soc_private->cpas_handle);
+		cam_cpas_log_votes();
+	}
+end:
+	cam_vfe_rdi_put_evt_payload(rdi_priv, &payload);
+	CAM_DBG(CAM_ISP, "returing status = %d", ret);
+	return ret;
+}
+
+int cam_vfe_rdi_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *rdi_hw_info,
+	struct cam_isp_resource_node  *rdi_node,
+	void                          *vfe_irq_controller)
+{
+	struct cam_vfe_mux_rdi_data     *rdi_priv = NULL;
+	struct cam_vfe_rdi_ver2_hw_info *rdi_info = rdi_hw_info;
+	int                              i = 0;
+
+	rdi_priv = kzalloc(sizeof(struct cam_vfe_mux_rdi_data),
+			GFP_KERNEL);
+	if (!rdi_priv) {
+		CAM_DBG(CAM_ISP, "Error! Failed to alloc for rdi_priv");
+		return -ENOMEM;
+	}
+
+	rdi_node->res_priv = rdi_priv;
+
+	rdi_priv->mem_base   = soc_info->reg_map[VFE_CORE_BASE_IDX].mem_base;
+	rdi_priv->hw_intf    = hw_intf;
+	rdi_priv->common_reg = rdi_info->common_reg;
+	rdi_priv->rdi_reg    = rdi_info->rdi_reg;
+	rdi_priv->vfe_irq_controller  = vfe_irq_controller;
+	rdi_priv->rdi_common_reg_data = rdi_info->common_reg_data;
+	rdi_priv->soc_info = soc_info;
+	rdi_priv->rdi_irq_status = rdi_info->rdi_irq_status;
+
+	switch (rdi_node->res_id) {
+	case CAM_ISP_HW_VFE_IN_RDI0:
+		rdi_priv->reg_data = rdi_info->reg_data[0];
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI1:
+		rdi_priv->reg_data = rdi_info->reg_data[1];
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI2:
+		rdi_priv->reg_data = rdi_info->reg_data[2];
+		break;
+	case CAM_ISP_HW_VFE_IN_RDI3:
+		if (rdi_info->reg_data[3]) {
+			rdi_priv->reg_data = rdi_info->reg_data[3];
+		} else {
+			CAM_ERR(CAM_ISP, "Error! RDI3 is not supported");
+			goto err_init;
+		}
+		break;
+	default:
+		CAM_DBG(CAM_ISP, "invalid Resource id:%d", rdi_node->res_id);
+		goto err_init;
+	}
+
+	rdi_node->start = cam_vfe_rdi_resource_start;
+	rdi_node->stop  = cam_vfe_rdi_resource_stop;
+	rdi_node->process_cmd = cam_vfe_rdi_process_cmd;
+	rdi_node->top_half_handler = cam_vfe_rdi_handle_irq_top_half;
+	rdi_node->bottom_half_handler = cam_vfe_rdi_handle_irq_bottom_half;
+
+	spin_lock_init(&rdi_priv->spin_lock);
+	INIT_LIST_HEAD(&rdi_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_RDI_EVT_MAX; i++) {
+		INIT_LIST_HEAD(&rdi_priv->evt_payload[i].list);
+		list_add_tail(&rdi_priv->evt_payload[i].list,
+			&rdi_priv->free_payload_list);
+	}
+
+	return 0;
+err_init:
+	kfree(rdi_priv);
+	return -EINVAL;
+}
+
+int cam_vfe_rdi_ver2_deinit(
+	struct cam_isp_resource_node  *rdi_node)
+{
+	struct cam_vfe_mux_rdi_data *rdi_priv = rdi_node->res_priv;
+	int                          i = 0;
+
+	INIT_LIST_HEAD(&rdi_priv->free_payload_list);
+	for (i = 0; i < CAM_VFE_RDI_EVT_MAX; i++)
+		INIT_LIST_HEAD(&rdi_priv->evt_payload[i].list);
+
+	rdi_node->start = NULL;
+	rdi_node->stop  = NULL;
+	rdi_node->process_cmd = NULL;
+	rdi_node->top_half_handler = NULL;
+	rdi_node->bottom_half_handler = NULL;
+
+	rdi_node->res_priv = NULL;
+
+	if (!rdi_priv) {
+		CAM_ERR(CAM_ISP, "Error! rdi_priv NULL");
+		return -ENODEV;
+	}
+	kfree(rdi_priv);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_rdi.h
@@ -0,0 +1,64 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_RDI_H_
+#define _CAM_VFE_RDI_H_
+
+#include "cam_isp_hw.h"
+#include "cam_vfe_top.h"
+
+#define CAM_VFE_RDI_VER2_MAX  4
+
+#define CAM_VFE_RDI_EVT_MAX   256
+
+struct cam_vfe_rdi_ver2_reg {
+	uint32_t     reg_update_cmd;
+};
+
+struct cam_vfe_rdi_overflow_status {
+	uint32_t    rdi0_overflow_mask;
+	uint32_t    rdi1_overflow_mask;
+	uint32_t    rdi2_overflow_mask;
+	uint32_t    rdi3_overflow_mask;
+	uint32_t    rdi_overflow_mask;
+};
+
+struct cam_vfe_rdi_common_reg_data {
+	uint32_t     subscribe_irq_mask0;
+	uint32_t     subscribe_irq_mask1;
+	uint32_t     error_irq_mask0;
+	uint32_t     error_irq_mask1;
+	uint32_t     error_irq_mask2;
+	uint32_t     rdi_frame_drop_mask;
+};
+
+struct cam_vfe_rdi_reg_data {
+	uint32_t     reg_update_cmd_data;
+	uint32_t     sof_irq_mask;
+	uint32_t     reg_update_irq_mask;
+};
+struct cam_vfe_rdi_ver2_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common  *common_reg;
+	struct cam_vfe_rdi_ver2_reg                *rdi_reg;
+	struct cam_vfe_rdi_common_reg_data         *common_reg_data;
+	struct cam_vfe_rdi_overflow_status         *rdi_irq_status;
+	struct cam_vfe_rdi_reg_data  *reg_data[CAM_VFE_RDI_VER2_MAX];
+};
+
+int cam_vfe_rdi_ver2_acquire_resource(
+	struct cam_isp_resource_node  *rdi_res,
+	void                          *acquire_param);
+
+int cam_vfe_rdi_ver2_init(
+	struct cam_hw_intf            *hw_intf,
+	struct cam_hw_soc_info        *soc_info,
+	void                          *rdi_hw_info,
+	struct cam_isp_resource_node  *rdi_node,
+	void                          *vfe_irq_controller);
+
+int cam_vfe_rdi_ver2_deinit(
+	struct cam_isp_resource_node  *rdi_node);
+
+#endif /* _CAM_VFE_RDI_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top.c
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_debug_util.h"
+
+int cam_vfe_top_init(uint32_t          top_version,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *top_hw_info,
+	void                          *vfe_irq_controller,
+	struct cam_vfe_top           **vfe_top)
+{
+	int rc = -EINVAL;
+
+	switch (top_version) {
+	case CAM_VFE_TOP_VER_2_0:
+		rc = cam_vfe_top_ver2_init(soc_info, hw_intf, top_hw_info,
+			vfe_irq_controller, vfe_top);
+		break;
+	case CAM_VFE_TOP_VER_3_0:
+		rc = cam_vfe_top_ver3_init(soc_info, hw_intf, top_hw_info,
+			vfe_irq_controller, vfe_top);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error! Unsupported Version %x", top_version);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_deinit(uint32_t        top_version,
+	struct cam_vfe_top           **vfe_top)
+{
+	int rc = -EINVAL;
+
+	switch (top_version) {
+	case CAM_VFE_TOP_VER_2_0:
+		rc = cam_vfe_top_ver2_deinit(vfe_top);
+		break;
+	case CAM_VFE_TOP_VER_3_0:
+		rc = cam_vfe_top_ver3_deinit(vfe_top);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Error! Unsupported Version %x", top_version);
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.c
@@ -0,0 +1,373 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_vfe_top_common.h"
+#include "cam_debug_util.h"
+
+static struct cam_axi_vote *cam_vfe_top_delay_bw_reduction(
+	struct cam_vfe_top_priv_common *top_common,
+	uint64_t *to_be_applied_bw)
+{
+	uint32_t i, j;
+	int vote_idx = -1;
+	uint64_t max_bw = 0;
+	uint64_t total_bw;
+	struct cam_axi_vote *curr_l_vote;
+
+	for (i = 0; i < CAM_VFE_DELAY_BW_REDUCTION_NUM_FRAMES; i++) {
+		total_bw = 0;
+		curr_l_vote = &top_common->last_vote[i];
+		for (j = 0; j < curr_l_vote->num_paths; j++) {
+			if (total_bw >
+				(U64_MAX -
+				curr_l_vote->axi_path[j].camnoc_bw)) {
+				CAM_ERR(CAM_PERF,
+					"ife[%d] : Integer overflow at hist idx: %d, path: %d, total_bw = %llu, camnoc_bw = %llu",
+					top_common->hw_idx, i, j, total_bw,
+					curr_l_vote->axi_path[j].camnoc_bw);
+				return NULL;
+			}
+
+			total_bw += curr_l_vote->axi_path[j].camnoc_bw;
+		}
+
+		if (total_bw > max_bw) {
+			vote_idx = i;
+			max_bw = total_bw;
+		}
+	}
+
+	if (vote_idx < 0)
+		return NULL;
+
+	*to_be_applied_bw = max_bw;
+
+	return &top_common->last_vote[vote_idx];
+}
+
+int cam_vfe_top_set_axi_bw_vote(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, bool start_stop)
+{
+	struct cam_axi_vote agg_vote = {0};
+	struct cam_axi_vote *to_be_applied_axi_vote = NULL;
+	int rc = 0;
+	uint32_t i;
+	uint32_t num_paths = 0;
+	uint64_t total_bw_new_vote = 0;
+	bool bw_unchanged = true;
+	bool apply_bw_update = false;
+
+	for (i = 0; i < top_common->num_mux; i++) {
+		if (top_common->axi_vote_control[i] ==
+			CAM_VFE_BW_CONTROL_INCLUDE) {
+			if (num_paths +
+				top_common->req_axi_vote[i].num_paths >
+				CAM_CPAS_MAX_PATHS_PER_CLIENT) {
+				CAM_ERR(CAM_PERF,
+					"Required paths(%d) more than max(%d)",
+					num_paths +
+					top_common->req_axi_vote[i].num_paths,
+					CAM_CPAS_MAX_PATHS_PER_CLIENT);
+				return -EINVAL;
+			}
+
+			memcpy(&agg_vote.axi_path[num_paths],
+				&top_common->req_axi_vote[i].axi_path[0],
+				top_common->req_axi_vote[i].num_paths *
+				sizeof(
+				struct cam_axi_per_path_bw_vote));
+			num_paths += top_common->req_axi_vote[i].num_paths;
+		}
+	}
+
+	agg_vote.num_paths = num_paths;
+
+	for (i = 0; i < agg_vote.num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"ife[%d] : New BW Vote : counter[%d] [%s][%s] [%llu %llu %llu]",
+			top_common->hw_idx,
+			top_common->last_counter,
+			cam_cpas_axi_util_path_type_to_string(
+			agg_vote.axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			agg_vote.axi_path[i].transac_type),
+			agg_vote.axi_path[i].camnoc_bw,
+			agg_vote.axi_path[i].mnoc_ab_bw,
+			agg_vote.axi_path[i].mnoc_ib_bw);
+
+		total_bw_new_vote += agg_vote.axi_path[i].camnoc_bw;
+	}
+
+	memcpy(&top_common->last_vote[top_common->last_counter], &agg_vote,
+		sizeof(struct cam_axi_vote));
+	top_common->last_counter = (top_common->last_counter + 1) %
+		CAM_VFE_DELAY_BW_REDUCTION_NUM_FRAMES;
+
+	if ((agg_vote.num_paths != top_common->applied_axi_vote.num_paths) ||
+		(total_bw_new_vote != top_common->total_bw_applied))
+		bw_unchanged = false;
+
+	CAM_DBG(CAM_PERF,
+		"ife[%d] : applied_total=%lld, new_total=%lld unchanged=%d, start_stop=%d",
+		top_common->hw_idx, top_common->total_bw_applied,
+		total_bw_new_vote, bw_unchanged, start_stop);
+
+	if (bw_unchanged) {
+		CAM_DBG(CAM_PERF, "BW config unchanged");
+		return 0;
+	}
+
+	if (start_stop) {
+		/* need to vote current request immediately */
+		to_be_applied_axi_vote = &agg_vote;
+		/* Reset everything, we can start afresh */
+		memset(top_common->last_vote, 0x0, sizeof(struct cam_axi_vote) *
+			CAM_VFE_DELAY_BW_REDUCTION_NUM_FRAMES);
+		top_common->last_counter = 0;
+		top_common->last_vote[top_common->last_counter] = agg_vote;
+		top_common->last_counter = (top_common->last_counter + 1) %
+			CAM_VFE_DELAY_BW_REDUCTION_NUM_FRAMES;
+	} else {
+		/*
+		 * Find max bw request in last few frames. This will the bw
+		 * that we want to vote to CPAS now.
+		 */
+		to_be_applied_axi_vote =
+			cam_vfe_top_delay_bw_reduction(top_common,
+			&total_bw_new_vote);
+		if (!to_be_applied_axi_vote) {
+			CAM_ERR(CAM_PERF, "to_be_applied_axi_vote is NULL");
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < to_be_applied_axi_vote->num_paths; i++) {
+		CAM_DBG(CAM_PERF,
+			"ife[%d] : Apply BW Vote : [%s][%s] [%llu %llu %llu]",
+			top_common->hw_idx,
+			cam_cpas_axi_util_path_type_to_string(
+			to_be_applied_axi_vote->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			to_be_applied_axi_vote->axi_path[i].transac_type),
+			to_be_applied_axi_vote->axi_path[i].camnoc_bw,
+			to_be_applied_axi_vote->axi_path[i].mnoc_ab_bw,
+			to_be_applied_axi_vote->axi_path[i].mnoc_ib_bw);
+	}
+
+	if ((to_be_applied_axi_vote->num_paths !=
+		top_common->applied_axi_vote.num_paths) ||
+		(total_bw_new_vote != top_common->total_bw_applied))
+		apply_bw_update = true;
+
+	CAM_DBG(CAM_PERF,
+		"ife[%d] : Delayed update: applied_total=%lld, new_total=%lld apply_bw_update=%d, start_stop=%d",
+		top_common->hw_idx, top_common->total_bw_applied,
+		total_bw_new_vote, apply_bw_update, start_stop);
+
+	if (apply_bw_update) {
+		rc = cam_cpas_update_axi_vote(soc_private->cpas_handle,
+			to_be_applied_axi_vote);
+		if (!rc) {
+			memcpy(&top_common->applied_axi_vote,
+				to_be_applied_axi_vote,
+				sizeof(struct cam_axi_vote));
+			top_common->total_bw_applied = total_bw_new_vote;
+		} else {
+			CAM_ERR(CAM_PERF, "BW request failed, rc=%d", rc);
+		}
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_bw_update_v2(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bw_update_args_v2        *bw_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_update = (struct cam_vfe_bw_update_args_v2 *)cmd_args;
+	res = bw_update->node_res;
+
+	if (!res || !res->hw_intf || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_VFE_IN ||
+		res->res_id >= CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "VFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_common->num_mux; i++) {
+		if (top_common->mux_rsrc[i].res_id == res->res_id) {
+			memcpy(&top_common->req_axi_vote[i],
+				&bw_update->isp_vote,
+				sizeof(struct cam_axi_vote));
+			top_common->axi_vote_control[i] =
+				CAM_VFE_BW_CONTROL_INCLUDE;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_PERF,
+			"VFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_vfe_top_set_axi_bw_vote(soc_private, top_common,
+			false);
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_bw_update(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bw_update_args        *bw_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+	struct cam_axi_vote                  *mux_axi_vote;
+	bool                                  vid_exists = false;
+	bool                                  rdi_exists = false;
+
+	bw_update = (struct cam_vfe_bw_update_args *)cmd_args;
+	res = bw_update->node_res;
+
+	if (!res || !res->hw_intf || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	CAM_DBG(CAM_PERF, "res_id=%d, BW=[%lld %lld]",
+		res->res_id, bw_update->camnoc_bw_bytes,
+		bw_update->external_bw_bytes);
+
+	if (res->res_type != CAM_ISP_RESOURCE_VFE_IN ||
+		res->res_id >= CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "VFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_common->num_mux; i++) {
+		mux_axi_vote = &top_common->req_axi_vote[i];
+		if (top_common->mux_rsrc[i].res_id == res->res_id) {
+			mux_axi_vote->num_paths = 1;
+			if ((res->res_id >= CAM_ISP_HW_VFE_IN_RDI0) &&
+				(res->res_id <= CAM_ISP_HW_VFE_IN_RDI3)) {
+				mux_axi_vote->axi_path[0].path_data_type =
+					CAM_AXI_PATH_DATA_IFE_RDI0 +
+					(res->res_id - CAM_ISP_HW_VFE_IN_RDI0);
+			} else {
+				/*
+				 * Vote all bw into VIDEO path as we cannot
+				 * differentiate to which path this has to go
+				 */
+				mux_axi_vote->axi_path[0].path_data_type =
+					CAM_AXI_PATH_DATA_IFE_VID;
+			}
+
+			mux_axi_vote->axi_path[0].transac_type =
+				CAM_AXI_TRANSACTION_WRITE;
+			mux_axi_vote->axi_path[0].camnoc_bw =
+				bw_update->camnoc_bw_bytes;
+			mux_axi_vote->axi_path[0].mnoc_ab_bw =
+				bw_update->external_bw_bytes;
+			mux_axi_vote->axi_path[0].mnoc_ib_bw =
+				bw_update->external_bw_bytes;
+			/* Make ddr bw same as mnoc bw */
+			mux_axi_vote->axi_path[0].ddr_ab_bw =
+				bw_update->external_bw_bytes;
+			mux_axi_vote->axi_path[0].ddr_ib_bw =
+				bw_update->external_bw_bytes;
+
+			top_common->axi_vote_control[i] =
+				CAM_VFE_BW_CONTROL_INCLUDE;
+			break;
+		}
+
+		if (mux_axi_vote->num_paths == 1) {
+			if (mux_axi_vote->axi_path[0].path_data_type ==
+				CAM_AXI_PATH_DATA_IFE_VID)
+				vid_exists = true;
+			else if ((mux_axi_vote->axi_path[0].path_data_type >=
+				CAM_AXI_PATH_DATA_IFE_RDI0) &&
+				(mux_axi_vote->axi_path[0].path_data_type <=
+				CAM_AXI_PATH_DATA_IFE_RDI3))
+				rdi_exists = true;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_PERF,
+			"VFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_vfe_top_set_axi_bw_vote(soc_private, top_common,
+			false);
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_bw_control(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bw_control_args       *bw_ctrl = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   rc = 0;
+	int                                   i;
+
+	bw_ctrl = (struct cam_vfe_bw_control_args *)cmd_args;
+	res = bw_ctrl->node_res;
+
+	if (!res || !res->hw_intf->hw_priv)
+		return -EINVAL;
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_VFE_IN ||
+		res->res_id >= CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_ISP, "VFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_common->num_mux; i++) {
+		if (top_common->mux_rsrc[i].res_id == res->res_id) {
+			top_common->axi_vote_control[i] = bw_ctrl->action;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_ERR_RATE_LIMIT(CAM_PERF,
+			"VFE:%d Not ready to set BW yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else {
+		rc = cam_vfe_top_set_axi_bw_vote(soc_private, top_common, true);
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_common.h
@@ -0,0 +1,73 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_TOP_COMMON_H_
+#define _CAM_VFE_TOP_COMMON_H_
+
+#define CAM_VFE_TOP_MUX_MAX 6
+#define CAM_VFE_DELAY_BW_REDUCTION_NUM_FRAMES 18
+
+#include "cam_cpas_api.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_soc.h"
+
+#define CAM_VFE_TOP_MAX_REG_DUMP_ENTRIES 70
+
+#define CAM_VFE_TOP_MAX_LUT_DUMP_ENTRIES 6
+
+struct cam_vfe_top_priv_common {
+	struct cam_isp_resource_node    mux_rsrc[CAM_VFE_TOP_MUX_MAX];
+	uint32_t                        num_mux;
+	uint32_t                        hw_idx;
+	struct cam_axi_vote             applied_axi_vote;
+	struct cam_axi_vote             req_axi_vote[CAM_VFE_TOP_MUX_MAX];
+	struct cam_axi_vote             last_vote[
+					CAM_VFE_DELAY_BW_REDUCTION_NUM_FRAMES];
+	uint32_t                        last_counter;
+	uint64_t                        total_bw_applied;
+	uint32_t                        hw_version;
+	enum cam_vfe_bw_control_action  axi_vote_control[CAM_VFE_TOP_MUX_MAX];
+};
+
+struct cam_vfe_top_reg_dump_entry {
+	uint32_t reg_dump_start;
+	uint32_t reg_dump_end;
+};
+
+struct cam_vfe_top_lut_dump_entry {
+	uint32_t lut_word_size;
+	uint32_t lut_bank_sel;
+	uint32_t lut_addr_size;
+};
+
+struct cam_vfe_top_dump_data {
+	uint32_t num_reg_dump_entries;
+	uint32_t num_lut_dump_entries;
+	uint32_t dmi_cfg;
+	uint32_t dmi_addr;
+	uint32_t dmi_data_path_hi;
+	uint32_t dmi_data_path_lo;
+	struct cam_vfe_top_reg_dump_entry
+		reg_entry[CAM_VFE_TOP_MAX_REG_DUMP_ENTRIES];
+	struct cam_vfe_top_lut_dump_entry
+		lut_entry[CAM_VFE_TOP_MAX_LUT_DUMP_ENTRIES];
+};
+
+int cam_vfe_top_set_axi_bw_vote(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, bool start_stop);
+
+int cam_vfe_top_bw_update_v2(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size);
+
+int cam_vfe_top_bw_update(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size);
+
+int cam_vfe_top_bw_control(struct cam_vfe_soc_private *soc_private,
+	struct cam_vfe_top_priv_common *top_common, void *cmd_args,
+	uint32_t arg_size);
+
+#endif /* _CAM_VFE_TOP_COMMON_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.c
@@ -0,0 +1,1082 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_io_util.h"
+#include "cam_cdm_util.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver2.h"
+#include "cam_debug_util.h"
+#include "cam_vfe_soc.h"
+
+#define CAM_VFE_HW_RESET_HW_AND_REG_VAL       0x00003F9F
+#define CAM_VFE_HW_RESET_HW_VAL               0x00003F87
+
+struct cam_vfe_top_ver2_common_data {
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_vfe_top_ver2_reg_offset_common  *common_reg;
+	struct cam_vfe_top_dump_data               *dump_data;
+};
+
+struct cam_vfe_top_ver2_priv {
+	struct cam_vfe_top_ver2_common_data common_data;
+	unsigned long                       hw_clk_rate;
+	unsigned long                       req_clk_rate[
+						CAM_VFE_TOP_MUX_MAX];
+	struct cam_vfe_top_priv_common      top_common;
+};
+
+static int cam_vfe_top_mux_get_base(struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error! Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(
+		top_priv->common_data.soc_info, VFE_CORE_BASE_IDX);
+	CAM_DBG(CAM_ISP, "core %d mem_base 0x%x",
+		top_priv->common_data.soc_info->index, mem_base);
+
+	cdm_util_ops->cdm_write_changebase(
+	cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_set_hw_clk_rate(
+	struct cam_vfe_top_ver2_priv *top_priv)
+{
+	struct cam_hw_soc_info        *soc_info = NULL;
+	int                            i, rc = 0;
+	unsigned long                  max_clk_rate = 0;
+	struct cam_vfe_soc_private    *soc_private = NULL;
+
+	soc_info = top_priv->common_data.soc_info;
+	soc_private =
+		(struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->req_clk_rate[i] > max_clk_rate)
+			max_clk_rate = top_priv->req_clk_rate[i];
+	}
+	if (max_clk_rate == top_priv->hw_clk_rate)
+		return 0;
+
+	CAM_DBG(CAM_PERF, "VFE: Clock name=%s idx=%d clk=%llu",
+		soc_info->clk_name[soc_info->src_clk_idx],
+		soc_info->src_clk_idx, max_clk_rate);
+	soc_private->ife_clk_src = max_clk_rate;
+	rc = cam_soc_util_set_src_clk_rate(soc_info, max_clk_rate);
+
+	if (!rc)
+		top_priv->hw_clk_rate = max_clk_rate;
+	else
+		CAM_ERR(CAM_PERF, "Set Clock rate failed, rc=%d", rc);
+
+	return rc;
+}
+
+static int cam_vfe_top_fs_update(
+	struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_fe_update_args *cmd_update = cmd_args;
+
+	if (cmd_update->node_res->process_cmd)
+		return cmd_update->node_res->process_cmd(cmd_update->node_res,
+			CAM_ISP_HW_CMD_FE_UPDATE_IN_RD, cmd_args, arg_size);
+
+	return 0;
+}
+
+static int cam_vfe_top_clock_update(
+	struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_clock_update_args     *clk_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   i, rc = 0;
+
+	clk_update =
+		(struct cam_vfe_clock_update_args *)cmd_args;
+	res = clk_update->node_res;
+
+	if (!res || !res->hw_intf->hw_priv) {
+		CAM_ERR(CAM_PERF, "Invalid input res %pK", res);
+		return -EINVAL;
+	}
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_VFE_IN ||
+		res->res_id >= CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_PERF, "VFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->top_common.mux_rsrc[i].res_id == res->res_id) {
+			top_priv->req_clk_rate[i] = clk_update->clk_rate;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_DBG(CAM_PERF,
+			"VFE:%d Not ready to set clocks yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else
+		rc = cam_vfe_top_set_hw_clk_rate(top_priv);
+
+	return rc;
+}
+
+static int cam_vfe_top_dump_info(
+	struct cam_vfe_top_ver2_priv *top_priv, uint32_t cmd_type)
+{
+	struct cam_hw_soc_info *soc_info = top_priv->common_data.soc_info;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Null soc_info");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_DUMP_HW_SRC_CLK_RATE:
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "VFE%d src_clk_rate:%luHz",
+			soc_info->index, soc_info->applied_src_clk_rate);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "cmd_type: %u not supported", cmd_type);
+		break;
+	}
+
+	return 0;
+}
+
+static int cam_vfe_top_blanking_update(uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_blanking_config       *blanking_config = NULL;
+	struct cam_isp_resource_node         *node_res = NULL;
+
+	blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+	node_res = blanking_config->node_res;
+
+	if (!node_res) {
+		CAM_ERR(CAM_PERF, "Invalid input res %pK", node_res);
+		return -EINVAL;
+	}
+
+	if (!node_res->process_cmd) {
+		CAM_ERR(CAM_PERF, "Invalid input res process_cmd %pK",
+			node_res->process_cmd);
+		return -EINVAL;
+	}
+
+	return node_res->process_cmd(node_res,
+		cmd_type, cmd_args, arg_size);
+}
+
+static int cam_vfe_top_mux_get_reg_update(
+	struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update  *cmd_update = cmd_args;
+
+	if (cmd_update->res->process_cmd)
+		return cmd_update->res->process_cmd(cmd_update->res,
+			CAM_ISP_HW_CMD_GET_REG_UPDATE, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_top_wait_comp_event(struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error! Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_comp_wait();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	cdm_util_ops->cdm_write_wait_comp_event(cdm_args->cmd.cmd_buf_addr,
+		0, 0x2);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_add_wait_trigger(struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error! Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "Error! Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	reg_val_pair[0] = 0x90;
+	reg_val_pair[1] = 0x1;
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_get_data(
+	struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node  *res = cmd_args;
+
+	if (res->process_cmd)
+		return res->process_cmd(res,
+			CAM_ISP_HW_CMD_CAMIF_DATA, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_top_get_hw_caps(void *device_priv,
+	void *args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_get_hw_cap *vfe_cap_info = NULL;
+	struct cam_vfe_top_ver2_priv *vfe_top_prv = NULL;
+	struct cam_vfe_soc_private *vfe_soc_private = NULL;
+
+	if (!device_priv || !args) {
+		CAM_ERR(CAM_ISP,
+			"Invalid arguments device_priv:%p, args:%p",
+			device_priv, args);
+		return -EINVAL;
+	}
+
+	vfe_cap_info = (struct cam_vfe_hw_get_hw_cap *)args;
+	vfe_top_prv = (struct cam_vfe_top_ver2_priv *)device_priv;
+
+	if (!vfe_top_prv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "soc_info is null");
+		return -EFAULT;
+	}
+
+	vfe_soc_private = (struct cam_vfe_soc_private *)
+		vfe_top_prv->common_data.soc_info->soc_private;
+
+	vfe_cap_info->is_lite = (vfe_soc_private->is_ife_lite) ? true : false;
+	vfe_cap_info->incr =
+		(vfe_top_prv->top_common.hw_version) & 0x00ffff;
+	vfe_cap_info->minor =
+		((vfe_top_prv->top_common.hw_version) >> 16) & 0x0fff;
+	vfe_cap_info->major =
+		((vfe_top_prv->top_common.hw_version) >> 28) & 0x000f;
+
+	return 0;
+}
+
+static int cam_vfe_hw_dump(
+	struct cam_vfe_top_ver2_priv *top_priv,
+	void *cmd_args,
+	uint32_t arg_size)
+{
+	int                                i, j;
+	uint8_t                           *dst;
+	uint32_t                           reg_start_offset;
+	uint32_t                           reg_dump_size = 0;
+	uint32_t                           lut_dump_size = 0;
+	uint32_t                           val;
+	uint32_t                           num_reg;
+	void __iomem                      *reg_base;
+	uint32_t                          *addr, *start;
+	size_t                             remain_len;
+	uint32_t                           min_len;
+	struct cam_hw_soc_info            *soc_info;
+	struct cam_vfe_top_dump_data      *dump_data;
+	struct cam_isp_hw_dump_header     *hdr;
+	struct cam_isp_hw_dump_args       *dump_args =
+		(struct cam_isp_hw_dump_args *)cmd_args;
+
+	if (!dump_args) {
+		CAM_ERR(CAM_ISP, "Invalid args");
+		return -EINVAL;
+	}
+	if (!dump_args->cpu_addr || !dump_args->buf_len) {
+		CAM_ERR(CAM_ISP,
+			"Invalid params %pK %zu",
+			(void *)dump_args->cpu_addr,
+			dump_args->buf_len);
+		return -EINVAL;
+	}
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_ISP,
+			"Dump offset overshoot offset %zu buf_len %zu",
+			dump_args->offset, dump_args->buf_len);
+		return -ENOSPC;
+	}
+	dump_data = top_priv->common_data.dump_data;
+
+	if (!dump_data) {
+		CAM_ERR(CAM_ISP, "Dump data not available");
+		return -EINVAL;
+	}
+
+	soc_info = top_priv->common_data.soc_info;
+
+	/*Dump registers */
+	for (i = 0; i < dump_data->num_reg_dump_entries; i++)
+		reg_dump_size += (dump_data->reg_entry[i].reg_dump_end -
+			dump_data->reg_entry[i].reg_dump_start);
+	/*
+	 * We dump the offset as well, so the total size dumped becomes
+	 * multiplied by 2
+	 */
+	reg_dump_size *= 2;
+	for (i = 0; i < dump_data->num_lut_dump_entries; i++)
+		lut_dump_size += ((dump_data->lut_entry[i].lut_addr_size) *
+			(dump_data->lut_entry[i].lut_word_size/8));
+
+	/*Minimum len comprises of:
+	 * soc_index
+	 * lut_dump_size + reg_dump_size + sizeof dump_header +
+	 * (num_lut_dump_entries--> represents number of banks)
+	 */
+	min_len = sizeof(uint32_t) + lut_dump_size + reg_dump_size +
+		sizeof(struct cam_isp_hw_dump_header) +
+		(dump_data->num_lut_dump_entries * sizeof(uint32_t));
+	remain_len = dump_args->buf_len - dump_args->offset;
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu, min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_isp_hw_dump_header *)dst;
+	hdr->word_size = sizeof(uint32_t);
+	scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "VFE_REG:");
+	addr = (uint32_t *)(dst + sizeof(struct cam_isp_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+	for (i = 0; i < dump_data->num_reg_dump_entries; i++) {
+		num_reg  = (dump_data->reg_entry[i].reg_dump_end -
+			dump_data->reg_entry[i].reg_dump_start)/4;
+		reg_start_offset = dump_data->reg_entry[i].reg_dump_start;
+		reg_base = soc_info->reg_map[0].mem_base + reg_start_offset;
+		for (j = 0; j < num_reg; j++) {
+			addr[0] = soc_info->mem_block[0]->start +
+				reg_start_offset + (j*4);
+			addr[1] = cam_io_r(reg_base + (j*4));
+			addr += 2;
+		}
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_isp_hw_dump_header);
+
+	/*dump LUT*/
+	for (i = 0; i < dump_data->num_lut_dump_entries; i++) {
+
+		dst = (char *)dump_args->cpu_addr + dump_args->offset;
+		hdr = (struct cam_isp_hw_dump_header *)dst;
+		scnprintf(hdr->tag, CAM_ISP_HW_DUMP_TAG_MAX_LEN, "LUT_REG:");
+		hdr->word_size = dump_data->lut_entry[i].lut_word_size/8;
+		addr = (uint32_t *)(dst +
+			sizeof(struct cam_isp_hw_dump_header));
+		start = addr;
+		*addr++ = dump_data->lut_entry[i].lut_bank_sel;
+		val = 0x100 |  dump_data->lut_entry[i].lut_bank_sel;
+		cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
+			dump_data->dmi_cfg);
+		cam_io_w_mb(0, soc_info->reg_map[0].mem_base +
+			dump_data->dmi_addr);
+		for (j = 0; j < dump_data->lut_entry[i].lut_addr_size;
+			j++) {
+			if (dump_data->lut_entry[i].lut_word_size == 64) {
+				addr[0] = cam_io_r(
+					soc_info->reg_map[0].mem_base +
+					dump_data->dmi_data_path_lo);
+				addr[1] = cam_io_r(
+					soc_info->reg_map[0].mem_base +
+					dump_data->dmi_data_path_hi);
+				addr += 2;
+			} else {
+				*addr = cam_io_r(
+					soc_info->reg_map[0].mem_base +
+					dump_data->dmi_data_path_lo);
+				addr++;
+			}
+		}
+		hdr->size = hdr->word_size * (addr - start);
+		dump_args->offset +=  hdr->size +
+			sizeof(struct cam_isp_hw_dump_header);
+	}
+	CAM_DBG(CAM_ISP, "offset %zu", dump_args->offset);
+	return 0;
+}
+
+static int cam_vfe_top_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv   *top_priv = device_priv;
+	struct cam_vfe_top_ver2_common_data common_data = top_priv->common_data;
+
+	top_priv->hw_clk_rate = 0;
+
+	top_priv->top_common.hw_version =
+		cam_io_r_mb(common_data.soc_info->reg_map[0].mem_base +
+		common_data.common_reg->hw_version);
+
+	return 0;
+}
+
+static int cam_vfe_top_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv   *top_priv = device_priv;
+	struct cam_hw_soc_info         *soc_info = NULL;
+	struct cam_vfe_top_ver2_reg_offset_common *reg_common = NULL;
+	uint32_t *reset_reg_args = reset_core_args;
+	uint32_t reset_reg_val;
+
+	if (!top_priv || !reset_reg_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	switch (*reset_reg_args) {
+	case CAM_VFE_HW_RESET_HW_AND_REG:
+		reset_reg_val = CAM_VFE_HW_RESET_HW_AND_REG_VAL;
+		break;
+	default:
+		reset_reg_val = CAM_VFE_HW_RESET_HW_VAL;
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "reset reg value: %x", reset_reg_val);
+	soc_info = top_priv->common_data.soc_info;
+	reg_common = top_priv->common_data.common_reg;
+
+	/* Mask All the IRQs except RESET */
+	cam_io_w_mb((1 << 31),
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX) + 0x5C);
+
+	/* Reset HW */
+	cam_io_w_mb(reset_reg_val,
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX) +
+		reg_common->global_reset_cmd);
+
+	CAM_DBG(CAM_ISP, "Reset HW exit");
+	return 0;
+}
+
+static int cam_vfe_top_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv            *top_priv;
+	struct cam_vfe_acquire_args             *args;
+	struct cam_vfe_hw_vfe_in_acquire_args   *acquire_args;
+	uint32_t i;
+	int rc = -EINVAL;
+
+	if (!device_priv || !reserve_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver2_priv   *)device_priv;
+	args = (struct cam_vfe_acquire_args *)reserve_args;
+	acquire_args = &args->vfe_in;
+
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->top_common.mux_rsrc[i].res_id ==
+			acquire_args->res_id &&
+			top_priv->top_common.mux_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+
+			if (acquire_args->res_id == CAM_ISP_HW_VFE_IN_CAMIF) {
+				rc = cam_vfe_camif_ver2_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if (acquire_args->res_id ==
+				CAM_ISP_HW_VFE_IN_PDLIB) {
+				rc = cam_vfe_camif_lite_ver2_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if ((acquire_args->res_id >=
+				CAM_ISP_HW_VFE_IN_RDI0) &&
+				(acquire_args->res_id <=
+				CAM_ISP_HW_VFE_IN_RDI3)) {
+				rc = cam_vfe_rdi_ver2_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if (acquire_args->res_id == CAM_ISP_HW_VFE_IN_RD) {
+				rc = cam_vfe_fe_ver1_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			top_priv->top_common.mux_rsrc[i].cdm_ops =
+				acquire_args->cdm_ops;
+			top_priv->top_common.mux_rsrc[i].tasklet_info =
+				args->tasklet;
+			top_priv->top_common.mux_rsrc[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			acquire_args->rsrc_node =
+				&top_priv->top_common.mux_rsrc[i];
+
+			rc = 0;
+			break;
+		}
+	}
+
+	return rc;
+
+}
+
+static int cam_vfe_top_release(void *device_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+
+	if (!device_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver2_priv   *)device_priv;
+	mux_res = (struct cam_isp_resource_node *)release_args;
+
+	CAM_DBG(CAM_ISP, "Resource in state %d", mux_res->res_state);
+	if (mux_res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error! Resource in Invalid res_state :%d",
+			mux_res->res_state);
+		return -EINVAL;
+	}
+	mux_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_top_start(void *device_priv,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+	int rc = 0;
+
+	if (!device_priv || !start_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver2_priv *)device_priv;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	mux_res = (struct cam_isp_resource_node *)start_args;
+	hw_info = (struct cam_hw_info  *)mux_res->hw_intf->hw_priv;
+
+	if (hw_info->hw_state == CAM_HW_STATE_POWER_UP) {
+		rc = cam_vfe_top_set_hw_clk_rate(top_priv);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"set_hw_clk_rate failed, rc=%d", rc);
+			return rc;
+		}
+
+		rc = cam_vfe_top_set_axi_bw_vote(soc_private,
+			&top_priv->top_common, true);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"set_axi_bw_vote failed, rc=%d", rc);
+			return rc;
+		}
+
+		if (mux_res->start) {
+			rc = mux_res->start(mux_res);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"Invalid res id:%d", mux_res->res_id);
+			rc = -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "VFE HW not powered up");
+		rc = -EPERM;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_top_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver2_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+	int i, rc = 0;
+
+	if (!device_priv || !stop_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver2_priv   *)device_priv;
+	mux_res = (struct cam_isp_resource_node *)stop_args;
+	hw_info = (struct cam_hw_info  *)mux_res->hw_intf->hw_priv;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = soc_info->soc_private;
+
+	if ((mux_res->res_id == CAM_ISP_HW_VFE_IN_CAMIF) ||
+		(mux_res->res_id == CAM_ISP_HW_VFE_IN_PDLIB) ||
+		(mux_res->res_id == CAM_ISP_HW_VFE_IN_RD) ||
+		((mux_res->res_id >= CAM_ISP_HW_VFE_IN_RDI0) &&
+		(mux_res->res_id <= CAM_ISP_HW_VFE_IN_RDI3))) {
+		rc = mux_res->stop(mux_res);
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res id:%d", mux_res->res_id);
+		return -EINVAL;
+	}
+
+	if (!rc) {
+		for (i = 0; i < top_priv->top_common.num_mux; i++) {
+			if (top_priv->top_common.mux_rsrc[i].res_id ==
+				mux_res->res_id) {
+				top_priv->req_clk_rate[i] = 0;
+				top_priv->req_clk_rate[i] = 0;
+				top_priv->top_common.req_axi_vote[i]
+					.axi_path[0].camnoc_bw = 0;
+				top_priv->top_common.req_axi_vote[i]
+					.axi_path[0].mnoc_ab_bw = 0;
+				top_priv->top_common.req_axi_vote[i]
+					.axi_path[0].mnoc_ib_bw = 0;
+				top_priv->top_common.axi_vote_control[i] =
+					CAM_VFE_BW_CONTROL_EXCLUDE;
+				break;
+			}
+		}
+	}
+	soc_private->ife_clk_src = 0;
+	return rc;
+}
+
+static int cam_vfe_top_read(void *device_priv,
+	void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_top_write(void *device_priv,
+	void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_top_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_vfe_top_ver2_priv            *top_priv;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+
+	if (!device_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Error! Invalid arguments");
+		return -EINVAL;
+	}
+	top_priv = (struct cam_vfe_top_ver2_priv *)device_priv;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_vfe_top_mux_get_base(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_top_mux_get_reg_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+		rc = cam_vfe_top_get_data(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+		rc = cam_vfe_top_clock_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_DUMP_HW_SRC_CLK_RATE:
+		rc = cam_vfe_top_dump_info(top_priv, cmd_type);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_IN_RD:
+		rc = cam_vfe_top_fs_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE:
+		rc = cam_vfe_top_bw_update(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+		rc = cam_vfe_top_bw_update_v2(soc_private,
+			&top_priv->top_common, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+		rc = cam_vfe_top_bw_control(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_DUMP_HW:
+		rc = cam_vfe_hw_dump(top_priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_ADD_WAIT:
+		rc = cam_vfe_top_wait_comp_event(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER:
+		rc = cam_vfe_top_add_wait_trigger(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_top_blanking_update(cmd_type, cmd_args, arg_size);
+		break;
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_ISP, "Error! Invalid cmd:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_ver2_init(
+	struct cam_hw_soc_info                 *soc_info,
+	struct cam_hw_intf                     *hw_intf,
+	void                                   *top_hw_info,
+	void                                   *vfe_irq_controller,
+	struct cam_vfe_top                    **vfe_top_ptr)
+{
+	int i, j, rc = 0;
+	struct cam_vfe_top_ver2_priv           *top_priv = NULL;
+	struct cam_vfe_top_ver2_hw_info        *ver2_hw_info = top_hw_info;
+	struct cam_vfe_top                     *vfe_top;
+
+	vfe_top = kzalloc(sizeof(struct cam_vfe_top), GFP_KERNEL);
+	if (!vfe_top) {
+		CAM_DBG(CAM_ISP, "Error! Failed to alloc for vfe_top");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	top_priv = kzalloc(sizeof(struct cam_vfe_top_ver2_priv),
+		GFP_KERNEL);
+	if (!top_priv) {
+		CAM_DBG(CAM_ISP, "Error! Failed to alloc for vfe_top_priv");
+		rc = -ENOMEM;
+		goto free_vfe_top;
+	}
+
+	vfe_top->top_priv = top_priv;
+	top_priv->hw_clk_rate = 0;
+	if (ver2_hw_info->num_mux > CAM_VFE_TOP_MUX_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid number of input rsrc: %d, max: %d",
+			ver2_hw_info->num_mux, CAM_VFE_TOP_MUX_MAX);
+		rc = -EINVAL;
+		goto free_top_priv;
+	}
+
+	top_priv->top_common.num_mux = ver2_hw_info->num_mux;
+
+	for (i = 0, j = 0; i < top_priv->top_common.num_mux; i++) {
+		top_priv->top_common.mux_rsrc[i].res_type =
+			CAM_ISP_RESOURCE_VFE_IN;
+		top_priv->top_common.mux_rsrc[i].hw_intf = hw_intf;
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		top_priv->req_clk_rate[i] = 0;
+
+		if (ver2_hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_2_0) {
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_CAMIF;
+
+			rc = cam_vfe_camif_ver2_init(hw_intf, soc_info,
+				&ver2_hw_info->camif_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			if (rc)
+				goto deinit_resources;
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_CAMIF_LITE_VER_2_0) {
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_PDLIB;
+
+			rc = cam_vfe_camif_lite_ver2_init(hw_intf, soc_info,
+				&ver2_hw_info->camif_lite_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+
+			if (rc)
+				goto deinit_resources;
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_RDI_VER_1_0) {
+			/* set the RDI resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_RDI0 + j++;
+
+			rc = cam_vfe_rdi_ver2_init(hw_intf, soc_info,
+				&ver2_hw_info->rdi_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			if (rc)
+				goto deinit_resources;
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			/* set the RD resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_RD;
+
+			rc = cam_vfe_fe_ver1_init(hw_intf, soc_info,
+				&ver2_hw_info->fe_hw_info,
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				goto deinit_resources;
+		} else {
+			CAM_WARN(CAM_ISP, "Invalid mux type: %u",
+				ver2_hw_info->mux_type[i]);
+		}
+	}
+
+	vfe_top->hw_ops.get_hw_caps = cam_vfe_top_get_hw_caps;
+	vfe_top->hw_ops.init        = cam_vfe_top_init_hw;
+	vfe_top->hw_ops.reset       = cam_vfe_top_reset;
+	vfe_top->hw_ops.reserve     = cam_vfe_top_reserve;
+	vfe_top->hw_ops.release     = cam_vfe_top_release;
+	vfe_top->hw_ops.start       = cam_vfe_top_start;
+	vfe_top->hw_ops.stop        = cam_vfe_top_stop;
+	vfe_top->hw_ops.read        = cam_vfe_top_read;
+	vfe_top->hw_ops.write       = cam_vfe_top_write;
+	vfe_top->hw_ops.process_cmd = cam_vfe_top_process_cmd;
+	*vfe_top_ptr = vfe_top;
+
+	top_priv->common_data.soc_info     = soc_info;
+	top_priv->common_data.hw_intf      = hw_intf;
+	top_priv->top_common.hw_idx        = hw_intf->hw_idx;
+	top_priv->common_data.common_reg   = ver2_hw_info->common_reg;
+	top_priv->common_data.dump_data    = ver2_hw_info->dump_data;
+
+	return rc;
+
+deinit_resources:
+	for (--i; i >= 0; i--) {
+		if (ver2_hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_2_0) {
+			if (cam_vfe_camif_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "Camif Deinit failed");
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_CAMIF_LITE_VER_2_0) {
+			if (cam_vfe_camif_lite_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "Camif lite deinit failed");
+		} else if (ver2_hw_info->mux_type[i] ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			if (cam_vfe_fe_ver1_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "VFE FE deinit failed");
+		} else {
+			if (cam_vfe_rdi_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "RDI Deinit failed");
+		}
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	}
+
+free_top_priv:
+	kfree(vfe_top->top_priv);
+free_vfe_top:
+	kfree(vfe_top);
+end:
+	return rc;
+}
+
+int cam_vfe_top_ver2_deinit(struct cam_vfe_top  **vfe_top_ptr)
+{
+	int i, rc = 0;
+	struct cam_vfe_top_ver2_priv           *top_priv = NULL;
+	struct cam_vfe_top                     *vfe_top;
+
+	if (!vfe_top_ptr) {
+		CAM_ERR(CAM_ISP, "Error! Invalid input");
+		return -EINVAL;
+	}
+
+	vfe_top = *vfe_top_ptr;
+	if (!vfe_top) {
+		CAM_ERR(CAM_ISP, "Error! vfe_top NULL");
+		return -ENODEV;
+	}
+
+	top_priv = vfe_top->top_priv;
+	if (!top_priv) {
+		CAM_ERR(CAM_ISP, "Error! vfe_top_priv NULL");
+		rc = -ENODEV;
+		goto free_vfe_top;
+	}
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+		if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_CAMIF_VER_2_0) {
+			rc = cam_vfe_camif_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Camif deinit failed rc=%d",
+					rc);
+		} else if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_CAMIF_LITE_VER_2_0) {
+			rc = cam_vfe_camif_lite_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Camif lite deinit failed rc=%d", rc);
+		} else if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_RDI_VER_1_0) {
+			rc = cam_vfe_rdi_ver2_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "RDI deinit failed rc=%d", rc);
+		} else if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			rc = cam_vfe_fe_ver1_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Camif deinit failed rc=%d",
+					rc);
+		}
+	}
+
+	kfree(vfe_top->top_priv);
+
+free_vfe_top:
+	kfree(vfe_top);
+	*vfe_top_ptr = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver2.h
@@ -0,0 +1,65 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_TOP_VER2_H_
+#define _CAM_VFE_TOP_VER2_H_
+
+#include "cam_vfe_camif_ver2.h"
+#include "cam_vfe_camif_lite_ver2.h"
+#include "cam_vfe_rdi.h"
+#include "cam_vfe_fe_ver1.h"
+#include "cam_vfe_top_common.h"
+
+enum cam_vfe_top_ver2_module_type {
+	CAM_VFE_TOP_VER2_MODULE_LENS,
+	CAM_VFE_TOP_VER2_MODULE_STATS,
+	CAM_VFE_TOP_VER2_MODULE_COLOR,
+	CAM_VFE_TOP_VER2_MODULE_ZOOM,
+	CAM_VFE_TOP_VER2_MODULE_MAX,
+};
+
+struct cam_vfe_top_ver2_reg_offset_module_ctrl {
+	uint32_t reset;
+	uint32_t cgc_ovd;
+	uint32_t enable;
+};
+
+struct cam_vfe_top_ver2_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t lens_feature;
+	uint32_t stats_feature;
+	uint32_t color_feature;
+	uint32_t zoom_feature;
+	uint32_t global_reset_cmd;
+	struct cam_vfe_top_ver2_reg_offset_module_ctrl
+		*module_ctrl[CAM_VFE_TOP_VER2_MODULE_MAX];
+	uint32_t bus_cgc_ovd;
+	uint32_t core_cfg;
+	uint32_t three_D_cfg;
+	uint32_t violation_status;
+	uint32_t reg_update_cmd;
+};
+
+struct cam_vfe_top_ver2_hw_info {
+	struct cam_vfe_top_ver2_reg_offset_common  *common_reg;
+	struct cam_vfe_camif_ver2_hw_info           camif_hw_info;
+	struct cam_vfe_camif_lite_ver2_hw_info      camif_lite_hw_info;
+	struct cam_vfe_rdi_ver2_hw_info             rdi_hw_info;
+	struct cam_vfe_fe_ver1_hw_info              fe_hw_info;
+	struct cam_vfe_top_dump_data               *dump_data;
+	uint32_t                                    num_mux;
+	uint32_t mux_type[CAM_VFE_TOP_MUX_MAX];
+};
+
+int cam_vfe_top_ver2_init(struct cam_hw_soc_info     *soc_info,
+	struct cam_hw_intf                           *hw_intf,
+	void                                         *top_hw_info,
+	void                                         *vfe_irq_controller,
+	struct cam_vfe_top                          **vfe_top_ptr);
+
+int cam_vfe_top_ver2_deinit(struct cam_vfe_top      **vfe_top);
+
+#endif /* _CAM_VFE_TOP_VER2_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.c
@@ -0,0 +1,1018 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include "cam_io_util.h"
+#include "cam_cdm_util.h"
+#include "cam_vfe_hw_intf.h"
+#include "cam_vfe_top.h"
+#include "cam_vfe_top_ver3.h"
+#include "cam_debug_util.h"
+#include "cam_vfe_soc.h"
+
+#define CAM_VFE_HW_RESET_HW_AND_REG_VAL       0x00000001
+#define CAM_VFE_HW_RESET_HW_VAL               0x00010000
+#define CAM_VFE_LITE_HW_RESET_AND_REG_VAL     0x00000002
+#define CAM_VFE_LITE_HW_RESET_HW_VAL          0x00000001
+#define CAM_CDM_WAIT_COMP_EVENT_BIT           0x2
+
+struct cam_vfe_top_ver3_common_data {
+	struct cam_hw_soc_info                     *soc_info;
+	struct cam_hw_intf                         *hw_intf;
+	struct cam_vfe_top_ver3_reg_offset_common  *common_reg;
+};
+
+struct cam_vfe_top_ver3_priv {
+	struct cam_vfe_top_ver3_common_data common_data;
+	unsigned long                       hw_clk_rate;
+	unsigned long                       req_clk_rate[
+						CAM_VFE_TOP_MUX_MAX];
+	struct cam_vfe_top_priv_common      top_common;
+};
+
+static int cam_vfe_top_ver3_mux_get_base(struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          mem_base = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error, Invalid cmd size");
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_changebase();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(
+		top_priv->common_data.soc_info, VFE_CORE_BASE_IDX);
+	CAM_DBG(CAM_ISP, "core %d mem_base 0x%x",
+		top_priv->common_data.soc_info->index, mem_base);
+
+	cdm_util_ops->cdm_write_changebase(
+	cdm_args->cmd.cmd_buf_addr, mem_base);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver3_set_hw_clk_rate(
+	struct cam_vfe_top_ver3_priv *top_priv)
+{
+	struct cam_hw_soc_info        *soc_info = NULL;
+	struct cam_vfe_soc_private    *soc_private = NULL;
+	struct cam_ahb_vote            ahb_vote;
+	int                            i, rc = 0, clk_lvl = -1;
+	unsigned long                  max_clk_rate = 0;
+
+	soc_info = top_priv->common_data.soc_info;
+	soc_private =
+		(struct cam_vfe_soc_private *)soc_info->soc_private;
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->req_clk_rate[i] > max_clk_rate)
+			max_clk_rate = top_priv->req_clk_rate[i];
+	}
+	if (max_clk_rate == top_priv->hw_clk_rate)
+		return 0;
+
+	CAM_DBG(CAM_PERF, "VFE: Clock name=%s idx=%d clk=%llu",
+		soc_info->clk_name[soc_info->src_clk_idx],
+		soc_info->src_clk_idx, max_clk_rate);
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info, max_clk_rate);
+
+	if (!rc) {
+		soc_private->ife_clk_src = max_clk_rate;
+
+		top_priv->hw_clk_rate = max_clk_rate;
+		rc = cam_soc_util_get_clk_level(soc_info, max_clk_rate,
+			soc_info->src_clk_idx, &clk_lvl);
+		if (rc) {
+			CAM_WARN(CAM_ISP,
+				"Failed to get clk level for %s with clk_rate %llu src_idx %d rc %d",
+				soc_info->dev_name, max_clk_rate,
+				soc_info->src_clk_idx, rc);
+			rc = 0;
+			goto end;
+		}
+
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = clk_lvl;
+		cam_cpas_update_ahb_vote(soc_private->cpas_handle, &ahb_vote);
+	} else {
+		CAM_ERR(CAM_PERF, "Set Clock rate failed, rc=%d", rc);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_vfe_top_fs_update(
+	struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_fe_update_args *cmd_update = cmd_args;
+
+	if (cmd_update->node_res->process_cmd)
+		return cmd_update->node_res->process_cmd(cmd_update->node_res,
+			CAM_ISP_HW_CMD_FE_UPDATE_IN_RD, cmd_args, arg_size);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver3_clock_update(
+	struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_clock_update_args     *clk_update = NULL;
+	struct cam_isp_resource_node         *res = NULL;
+	struct cam_hw_info                   *hw_info = NULL;
+	int                                   i, rc = 0;
+
+	clk_update =
+		(struct cam_vfe_clock_update_args *)cmd_args;
+	res = clk_update->node_res;
+
+	if (!res || !res->hw_intf->hw_priv) {
+		CAM_ERR(CAM_PERF, "Invalid input res %pK", res);
+		return -EINVAL;
+	}
+
+	hw_info = res->hw_intf->hw_priv;
+
+	if (res->res_type != CAM_ISP_RESOURCE_VFE_IN ||
+		res->res_id >= CAM_ISP_HW_VFE_IN_MAX) {
+		CAM_ERR(CAM_PERF, "VFE:%d Invalid res_type:%d res id%d",
+			res->hw_intf->hw_idx, res->res_type,
+			res->res_id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->top_common.mux_rsrc[i].res_id == res->res_id) {
+			top_priv->req_clk_rate[i] = clk_update->clk_rate;
+			break;
+		}
+	}
+
+	if (hw_info->hw_state != CAM_HW_STATE_POWER_UP) {
+		CAM_DBG(CAM_PERF,
+			"VFE:%d Not ready to set clocks yet :%d",
+			res->hw_intf->hw_idx,
+			hw_info->hw_state);
+	} else
+		rc = cam_vfe_top_ver3_set_hw_clk_rate(top_priv);
+
+	return rc;
+}
+
+static int cam_vfe_top_ver3_dump_info(
+	struct cam_vfe_top_ver3_priv *top_priv, uint32_t cmd_type)
+{
+	struct cam_hw_soc_info *soc_info = top_priv->common_data.soc_info;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_ISP, "Null soc_info");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_DUMP_HW_SRC_CLK_RATE:
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "VFE%d src_clk_rate:%luHz",
+			soc_info->index, soc_info->applied_src_clk_rate);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "cmd_type: %u not supported", cmd_type);
+		break;
+	}
+
+	return 0;
+}
+
+
+static int cam_vfe_top_ver3_blanking_update(uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_blanking_config       *blanking_config = NULL;
+	struct cam_isp_resource_node         *node_res = NULL;
+
+	blanking_config =
+		(struct cam_isp_blanking_config *)cmd_args;
+	node_res = blanking_config->node_res;
+
+	if (!node_res) {
+		CAM_ERR(CAM_PERF, "Invalid input res %pK", node_res);
+		return -EINVAL;
+	}
+
+	if (!node_res->process_cmd) {
+		CAM_ERR(CAM_PERF, "Invalid input res process_cmd %pK",
+			node_res->process_cmd);
+		return -EINVAL;
+	}
+
+	return node_res->process_cmd(node_res,
+		cmd_type, cmd_args, arg_size);
+}
+
+static int cam_vfe_core_config_control(
+	struct cam_vfe_top_ver3_priv *top_priv,
+	 void *cmd_args, uint32_t arg_size)
+{
+	struct cam_vfe_core_config_args  *core_config = cmd_args;
+
+	if (core_config->node_res->process_cmd)
+		return core_config->node_res->process_cmd(core_config->node_res,
+			CAM_ISP_HW_CMD_CORE_CONFIG, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_top_ver3_mux_get_reg_update(
+	struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_hw_get_cmd_update  *cmd_update = cmd_args;
+
+	if (cmd_update->res->process_cmd)
+		return cmd_update->res->process_cmd(cmd_update->res,
+			CAM_ISP_HW_CMD_GET_REG_UPDATE, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_top_wait_comp_event(struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error, Invalid arg size = %d expected = %d",
+			arg_size, sizeof(struct cam_isp_hw_get_cmd_update));
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_comp_wait();
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	cdm_util_ops->cdm_write_wait_comp_event(cdm_args->cmd.cmd_buf_addr,
+		0, CAM_CDM_WAIT_COMP_EVENT_BIT);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_add_wait_trigger(struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	uint32_t                          size = 0;
+	uint32_t                          reg_val_pair[2];
+	struct cam_isp_hw_get_cmd_update *cdm_args  = cmd_args;
+	struct cam_cdm_utils_ops         *cdm_util_ops = NULL;
+	struct cam_vfe_top_ver3_reg_offset_common *reg_common = NULL;
+	uint32_t set_cdm_trigger_event;
+
+	if (arg_size != sizeof(struct cam_isp_hw_get_cmd_update)) {
+		CAM_ERR(CAM_ISP, "Error, Invalid arg size = %d expected = %d",
+			arg_size, sizeof(struct cam_isp_hw_get_cmd_update));
+		return -EINVAL;
+	}
+
+	if (!cdm_args || !cdm_args->res || !top_priv ||
+		!top_priv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "Error, Invalid args");
+		return -EINVAL;
+	}
+
+	cdm_util_ops =
+		(struct cam_cdm_utils_ops *)cdm_args->res->cdm_ops;
+
+	if (!cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Invalid CDM ops");
+		return -EINVAL;
+	}
+
+	size = cdm_util_ops->cdm_required_size_reg_random(1);
+	/* since cdm returns dwords, we need to convert it into bytes */
+	if ((size * 4) > cdm_args->cmd.size) {
+		CAM_ERR(CAM_ISP, "buf size:%d is not sufficient, expected: %d",
+			cdm_args->cmd.size, size);
+		return -EINVAL;
+	}
+
+	if (cdm_args->trigger_cdm_en == true)
+		set_cdm_trigger_event = 1;
+	else
+		set_cdm_trigger_event = 0;
+
+	reg_common = top_priv->common_data.common_reg;
+	reg_val_pair[0] = reg_common->trigger_cdm_events;
+	reg_val_pair[1] = set_cdm_trigger_event;
+
+	cdm_util_ops->cdm_write_regrandom(cdm_args->cmd.cmd_buf_addr,
+		1, reg_val_pair);
+	cdm_args->cmd.used_bytes = (size * 4);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver3_get_data(
+	struct cam_vfe_top_ver3_priv *top_priv,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_isp_resource_node  *res = cmd_args;
+
+	if (res->process_cmd)
+		return res->process_cmd(res,
+			CAM_ISP_HW_CMD_CAMIF_DATA, cmd_args, arg_size);
+
+	return -EINVAL;
+}
+
+static int cam_vfe_top_ver3_get_hw_caps(void *device_priv,
+	void *args, uint32_t arg_size)
+{
+	struct cam_vfe_hw_get_hw_cap *vfe_cap_info = NULL;
+	struct cam_vfe_top_ver3_priv *vfe_top_prv = NULL;
+	struct cam_vfe_soc_private *vfe_soc_private = NULL;
+
+	if (!device_priv || !args) {
+		CAM_ERR(CAM_ISP,
+			"Invalid arguments device_priv:%p, args:%p",
+			device_priv, args);
+		return -EINVAL;
+	}
+
+	vfe_cap_info = (struct cam_vfe_hw_get_hw_cap *)args;
+	vfe_top_prv = (struct cam_vfe_top_ver3_priv *)device_priv;
+
+	if (!vfe_top_prv->common_data.soc_info) {
+		CAM_ERR(CAM_ISP, "soc_info is null");
+		return -EFAULT;
+	}
+
+	vfe_soc_private = (struct cam_vfe_soc_private *)
+		vfe_top_prv->common_data.soc_info->soc_private;
+
+	vfe_cap_info->is_lite = (vfe_soc_private->is_ife_lite) ? true : false;
+	vfe_cap_info->incr =
+		(vfe_top_prv->top_common.hw_version) & 0x00ffff;
+	vfe_cap_info->minor =
+		((vfe_top_prv->top_common.hw_version) >> 16) & 0x0fff;
+	vfe_cap_info->major =
+		((vfe_top_prv->top_common.hw_version) >> 28) & 0x000f;
+
+	return 0;
+}
+
+static int cam_vfe_top_ver3_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv   *top_priv = device_priv;
+	struct cam_vfe_top_ver3_common_data common_data = top_priv->common_data;
+
+	top_priv->hw_clk_rate = 0;
+
+	/**
+	 * Auto clock gating is enabled by default, but no harm
+	 * in setting the value we expect.
+	 */
+	CAM_DBG(CAM_ISP, "Enabling clock gating at IFE top");
+
+	cam_soc_util_w_mb(common_data.soc_info, VFE_CORE_BASE_IDX,
+		common_data.common_reg->core_cgc_ovd_0, 0x0);
+
+	cam_soc_util_w_mb(common_data.soc_info, VFE_CORE_BASE_IDX,
+		common_data.common_reg->core_cgc_ovd_1, 0x0);
+
+	cam_soc_util_w_mb(common_data.soc_info, VFE_CORE_BASE_IDX,
+		common_data.common_reg->ahb_cgc_ovd, 0x0);
+
+	cam_soc_util_w_mb(common_data.soc_info, VFE_CORE_BASE_IDX,
+		common_data.common_reg->noc_cgc_ovd, 0x0);
+
+	top_priv->top_common.hw_version =
+		cam_io_r_mb(common_data.soc_info->reg_map[0].mem_base +
+		common_data.common_reg->hw_version);
+
+	return 0;
+}
+
+static int cam_vfe_top_ver3_reset(void *device_priv,
+	void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv   *top_priv = device_priv;
+	struct cam_hw_soc_info         *soc_info = NULL;
+	struct cam_vfe_soc_private     *soc_private = NULL;
+	struct cam_vfe_top_ver3_reg_offset_common *reg_common = NULL;
+	uint32_t *reset_reg_args = reset_core_args;
+	uint32_t reset_reg_val;
+
+	if (!top_priv || !reset_reg_args) {
+		CAM_ERR(CAM_ISP, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	soc_info = top_priv->common_data.soc_info;
+	reg_common = top_priv->common_data.common_reg;
+
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Invalid soc_private");
+		return -ENODEV;
+	}
+
+	switch (*reset_reg_args) {
+	case CAM_VFE_HW_RESET_HW_AND_REG:
+		if (!soc_private->is_ife_lite)
+			reset_reg_val = CAM_VFE_HW_RESET_HW_AND_REG_VAL;
+		else
+			reset_reg_val = CAM_VFE_LITE_HW_RESET_AND_REG_VAL;
+		break;
+	default:
+		if (!soc_private->is_ife_lite)
+			reset_reg_val = CAM_VFE_HW_RESET_HW_VAL;
+		else
+			reset_reg_val = CAM_VFE_LITE_HW_RESET_HW_VAL;
+		break;
+	}
+
+	CAM_DBG(CAM_ISP, "reset reg value: 0x%x", reset_reg_val);
+
+	/* Mask All the IRQs except RESET */
+	if (!soc_private->is_ife_lite)
+		cam_io_w_mb(0x00000001,
+			CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX)
+			+ 0x3C);
+	else
+		cam_io_w_mb(0x00020000,
+			CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX)
+			+ 0x28);
+
+	/* Reset HW */
+	cam_io_w_mb(reset_reg_val,
+		CAM_SOC_GET_REG_MAP_START(soc_info, VFE_CORE_BASE_IDX) +
+		reg_common->global_reset_cmd);
+
+	CAM_DBG(CAM_ISP, "Reset HW exit");
+	return 0;
+}
+
+static int cam_vfe_top_ver3_reserve(void *device_priv,
+	void *reserve_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv            *top_priv;
+	struct cam_vfe_acquire_args             *args;
+	struct cam_vfe_hw_vfe_in_acquire_args   *acquire_args;
+	uint32_t i;
+	int rc = -EINVAL;
+
+	if (!device_priv || !reserve_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver3_priv   *)device_priv;
+	args = (struct cam_vfe_acquire_args *)reserve_args;
+	acquire_args = &args->vfe_in;
+
+	CAM_DBG(CAM_ISP, "res id %d", acquire_args->res_id);
+
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		if (top_priv->top_common.mux_rsrc[i].res_id ==
+			acquire_args->res_id &&
+			top_priv->top_common.mux_rsrc[i].res_state ==
+			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
+
+			if (acquire_args->res_id == CAM_ISP_HW_VFE_IN_CAMIF) {
+				rc = cam_vfe_camif_ver3_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if (acquire_args->res_id >= CAM_ISP_HW_VFE_IN_RDI0 &&
+				acquire_args->res_id < CAM_ISP_HW_VFE_IN_MAX) {
+				rc = cam_vfe_camif_lite_ver3_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			if (acquire_args->res_id == CAM_ISP_HW_VFE_IN_RD) {
+				rc = cam_vfe_fe_ver1_acquire_resource(
+					&top_priv->top_common.mux_rsrc[i],
+					args);
+				if (rc)
+					break;
+			}
+
+			top_priv->top_common.mux_rsrc[i].cdm_ops =
+				acquire_args->cdm_ops;
+			top_priv->top_common.mux_rsrc[i].tasklet_info =
+				args->tasklet;
+			top_priv->top_common.mux_rsrc[i].res_state =
+				CAM_ISP_RESOURCE_STATE_RESERVED;
+			acquire_args->rsrc_node =
+				&top_priv->top_common.mux_rsrc[i];
+
+			rc = 0;
+			break;
+		}
+	}
+
+	return rc;
+
+}
+
+static int cam_vfe_top_ver3_release(void *device_priv,
+	void *release_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+
+	if (!device_priv || !release_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver3_priv   *)device_priv;
+	mux_res = (struct cam_isp_resource_node *)release_args;
+
+	CAM_DBG(CAM_ISP, "Resource in state %d", mux_res->res_state);
+	if (mux_res->res_state < CAM_ISP_RESOURCE_STATE_RESERVED) {
+		CAM_ERR(CAM_ISP, "Error, Resource in Invalid res_state :%d",
+			mux_res->res_state);
+		return -EINVAL;
+	}
+	mux_res->res_state = CAM_ISP_RESOURCE_STATE_AVAILABLE;
+
+	return 0;
+}
+
+static int cam_vfe_top_ver3_start(void *device_priv,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+	int rc = 0;
+
+	if (!device_priv || !start_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver3_priv *)device_priv;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	mux_res = (struct cam_isp_resource_node *)start_args;
+	hw_info = (struct cam_hw_info  *)mux_res->hw_intf->hw_priv;
+
+	if (hw_info->hw_state == CAM_HW_STATE_POWER_UP) {
+		rc = cam_vfe_top_ver3_set_hw_clk_rate(top_priv);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"set_hw_clk_rate failed, rc=%d", rc);
+			return rc;
+		}
+
+		rc = cam_vfe_top_set_axi_bw_vote(soc_private,
+			&top_priv->top_common, true);
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"set_axi_bw_vote failed, rc=%d", rc);
+			return rc;
+		}
+
+		if (mux_res->start) {
+			rc = mux_res->start(mux_res);
+		} else {
+			CAM_ERR(CAM_ISP,
+				"Invalid res id:%d", mux_res->res_id);
+			rc = -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_ISP, "VFE HW not powered up");
+		rc = -EPERM;
+	}
+
+	return rc;
+}
+
+static int cam_vfe_top_ver3_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_vfe_top_ver3_priv            *top_priv;
+	struct cam_isp_resource_node            *mux_res;
+	struct cam_hw_info                      *hw_info = NULL;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+	int i, rc = 0;
+
+	if (!device_priv || !stop_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver3_priv   *)device_priv;
+	mux_res = (struct cam_isp_resource_node *)stop_args;
+	hw_info = (struct cam_hw_info  *)mux_res->hw_intf->hw_priv;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = soc_info->soc_private;
+
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = soc_info->soc_private;
+
+	if (mux_res->res_id < CAM_ISP_HW_VFE_IN_MAX) {
+		rc = mux_res->stop(mux_res);
+	} else {
+		CAM_ERR(CAM_ISP, "Invalid res id:%d", mux_res->res_id);
+		return -EINVAL;
+	}
+
+	if (!rc) {
+		for (i = 0; i < top_priv->top_common.num_mux; i++) {
+			if (top_priv->top_common.mux_rsrc[i].res_id ==
+				mux_res->res_id) {
+				top_priv->req_clk_rate[i] = 0;
+				memset(&top_priv->top_common.req_axi_vote[i],
+					0, sizeof(struct cam_axi_vote));
+				top_priv->top_common.axi_vote_control[i] =
+					CAM_VFE_BW_CONTROL_EXCLUDE;
+				break;
+			}
+		}
+	}
+
+	soc_private->ife_clk_src = 0;
+
+	return rc;
+}
+
+static int cam_vfe_top_ver3_read(void *device_priv,
+	void *read_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_top_ver3_write(void *device_priv,
+	void *write_args, uint32_t arg_size)
+{
+	return -EPERM;
+}
+
+static int cam_vfe_top_ver3_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct cam_vfe_top_ver3_priv            *top_priv;
+	struct cam_hw_soc_info                  *soc_info = NULL;
+	struct cam_vfe_soc_private              *soc_private = NULL;
+
+	if (!device_priv || !cmd_args) {
+		CAM_ERR(CAM_ISP, "Error, Invalid arguments");
+		return -EINVAL;
+	}
+
+	top_priv = (struct cam_vfe_top_ver3_priv *)device_priv;
+	soc_info = top_priv->common_data.soc_info;
+	soc_private = soc_info->soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_ISP, "Error soc_private NULL");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case CAM_ISP_HW_CMD_GET_CHANGE_BASE:
+		rc = cam_vfe_top_ver3_mux_get_base(top_priv,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_GET_REG_UPDATE:
+		rc = cam_vfe_top_ver3_mux_get_reg_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CAMIF_DATA:
+		rc = cam_vfe_top_ver3_get_data(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CLOCK_UPDATE:
+		rc = cam_vfe_top_ver3_clock_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_DUMP_HW_SRC_CLK_RATE:
+		rc = cam_vfe_top_ver3_dump_info(top_priv, cmd_type);
+		break;
+	case CAM_ISP_HW_CMD_FE_UPDATE_IN_RD:
+		rc = cam_vfe_top_fs_update(top_priv, cmd_args,
+			arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE:
+		rc = cam_vfe_top_bw_update(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_UPDATE_V2:
+		rc = cam_vfe_top_bw_update_v2(soc_private,
+			&top_priv->top_common, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BW_CONTROL:
+		rc = cam_vfe_top_bw_control(soc_private, &top_priv->top_common,
+			cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_CORE_CONFIG:
+		rc = cam_vfe_core_config_control(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_ADD_WAIT:
+		rc = cam_vfe_top_wait_comp_event(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_ADD_WAIT_TRIGGER:
+		rc = cam_vfe_top_add_wait_trigger(top_priv, cmd_args, arg_size);
+		break;
+	case CAM_ISP_HW_CMD_BLANKING_UPDATE:
+		rc = cam_vfe_top_ver3_blanking_update(cmd_type,
+			cmd_args, arg_size);
+		break;
+	default:
+		rc = -EINVAL;
+		CAM_ERR(CAM_ISP, "Error, Invalid cmd:%d", cmd_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_vfe_top_ver3_init(
+	struct cam_hw_soc_info                 *soc_info,
+	struct cam_hw_intf                     *hw_intf,
+	void                                   *top_hw_info,
+	void                                   *vfe_irq_controller,
+	struct cam_vfe_top                    **vfe_top_ptr)
+{
+	int i, j, rc = 0;
+	struct cam_vfe_top_ver3_priv           *top_priv = NULL;
+	struct cam_vfe_top_ver3_hw_info        *ver3_hw_info = top_hw_info;
+	struct cam_vfe_top                     *vfe_top;
+
+	vfe_top = kzalloc(sizeof(struct cam_vfe_top), GFP_KERNEL);
+	if (!vfe_top) {
+		CAM_DBG(CAM_ISP, "Error, Failed to alloc for vfe_top");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	top_priv = kzalloc(sizeof(struct cam_vfe_top_ver3_priv),
+		GFP_KERNEL);
+	if (!top_priv) {
+		CAM_DBG(CAM_ISP, "Error, Failed to alloc for vfe_top_priv");
+		rc = -ENOMEM;
+		goto free_vfe_top;
+	}
+
+	vfe_top->top_priv = top_priv;
+	top_priv->hw_clk_rate = 0;
+	if (ver3_hw_info->num_mux > CAM_VFE_TOP_MUX_MAX) {
+		CAM_ERR(CAM_ISP, "Invalid number of input rsrc: %d, max: %d",
+			ver3_hw_info->num_mux, CAM_VFE_TOP_MUX_MAX);
+		rc = -EINVAL;
+		goto free_top_priv;
+	}
+
+	top_priv->top_common.num_mux = ver3_hw_info->num_mux;
+
+	for (i = 0, j = 0; i < top_priv->top_common.num_mux &&
+		j < CAM_VFE_RDI_VER2_MAX; i++) {
+		top_priv->top_common.mux_rsrc[i].res_type =
+			CAM_ISP_RESOURCE_VFE_IN;
+		top_priv->top_common.mux_rsrc[i].hw_intf = hw_intf;
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_AVAILABLE;
+		top_priv->req_clk_rate[i] = 0;
+
+		if (ver3_hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_3_0) {
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_CAMIF;
+
+			rc = cam_vfe_camif_ver3_init(hw_intf, soc_info,
+				&ver3_hw_info->camif_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			if (rc)
+				goto deinit_resources;
+		} else if (ver3_hw_info->mux_type[i] ==
+			CAM_VFE_PDLIB_VER_1_0) {
+			/* set the PDLIB resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_PDLIB;
+
+			rc = cam_vfe_camif_lite_ver3_init(hw_intf, soc_info,
+				&ver3_hw_info->pdlib_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			if (rc)
+				goto deinit_resources;
+		} else if (ver3_hw_info->mux_type[i] ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			/* set the RD resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_RD;
+
+			rc = cam_vfe_fe_ver1_init(hw_intf, soc_info,
+				&ver3_hw_info->fe_hw_info,
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				goto deinit_resources;
+		} else if (ver3_hw_info->mux_type[i] ==
+			CAM_VFE_RDI_VER_1_0) {
+			/* set the RDI resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_RDI0 + j;
+
+			rc = cam_vfe_camif_lite_ver3_init(hw_intf, soc_info,
+				ver3_hw_info->rdi_hw_info[j++],
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			if (rc)
+				goto deinit_resources;
+		} else if (ver3_hw_info->mux_type[i] ==
+			CAM_VFE_LCR_VER_1_0) {
+			/* set the LCR resource id */
+			top_priv->top_common.mux_rsrc[i].res_id =
+				CAM_ISP_HW_VFE_IN_LCR;
+
+			rc = cam_vfe_camif_lite_ver3_init(hw_intf, soc_info,
+				&ver3_hw_info->lcr_hw_info,
+				&top_priv->top_common.mux_rsrc[i],
+				vfe_irq_controller);
+			if (rc)
+				goto deinit_resources;
+		} else {
+			CAM_WARN(CAM_ISP, "Invalid mux type: %u",
+				ver3_hw_info->mux_type[i]);
+		}
+	}
+
+	vfe_top->hw_ops.get_hw_caps = cam_vfe_top_ver3_get_hw_caps;
+	vfe_top->hw_ops.init        = cam_vfe_top_ver3_init_hw;
+	vfe_top->hw_ops.reset       = cam_vfe_top_ver3_reset;
+	vfe_top->hw_ops.reserve     = cam_vfe_top_ver3_reserve;
+	vfe_top->hw_ops.release     = cam_vfe_top_ver3_release;
+	vfe_top->hw_ops.start       = cam_vfe_top_ver3_start;
+	vfe_top->hw_ops.stop        = cam_vfe_top_ver3_stop;
+	vfe_top->hw_ops.read        = cam_vfe_top_ver3_read;
+	vfe_top->hw_ops.write       = cam_vfe_top_ver3_write;
+	vfe_top->hw_ops.process_cmd = cam_vfe_top_ver3_process_cmd;
+	*vfe_top_ptr = vfe_top;
+
+	top_priv->common_data.soc_info     = soc_info;
+	top_priv->common_data.hw_intf      = hw_intf;
+	top_priv->top_common.hw_idx        = hw_intf->hw_idx;
+	top_priv->common_data.common_reg   = ver3_hw_info->common_reg;
+
+	return rc;
+
+deinit_resources:
+	for (--i; i >= 0; i--) {
+		if (ver3_hw_info->mux_type[i] == CAM_VFE_CAMIF_VER_3_0) {
+			if (cam_vfe_camif_ver3_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "Camif Deinit failed");
+		} else if (ver3_hw_info->mux_type[i] == CAM_VFE_IN_RD_VER_1_0) {
+			if (cam_vfe_fe_ver1_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP, "Camif fe Deinit failed");
+		} else {
+			if (cam_vfe_camif_lite_ver3_deinit(
+				&top_priv->top_common.mux_rsrc[i]))
+				CAM_ERR(CAM_ISP,
+					"Camif lite res id %d Deinit failed",
+					top_priv->top_common.mux_rsrc[i]
+					.res_id);
+		}
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+	}
+
+free_top_priv:
+	kfree(vfe_top->top_priv);
+free_vfe_top:
+	kfree(vfe_top);
+end:
+	return rc;
+}
+
+int cam_vfe_top_ver3_deinit(struct cam_vfe_top  **vfe_top_ptr)
+{
+	int i, rc = 0;
+	struct cam_vfe_top_ver3_priv           *top_priv = NULL;
+	struct cam_vfe_top                     *vfe_top;
+
+	if (!vfe_top_ptr) {
+		CAM_ERR(CAM_ISP, "Error, Invalid input");
+		return -EINVAL;
+	}
+
+	vfe_top = *vfe_top_ptr;
+	if (!vfe_top) {
+		CAM_ERR(CAM_ISP, "Error, vfe_top NULL");
+		return -ENODEV;
+	}
+
+	top_priv = vfe_top->top_priv;
+	if (!top_priv) {
+		CAM_ERR(CAM_ISP, "Error, vfe_top_priv NULL");
+		rc = -ENODEV;
+		goto free_vfe_top;
+	}
+
+	for (i = 0; i < top_priv->top_common.num_mux; i++) {
+		top_priv->top_common.mux_rsrc[i].res_state =
+			CAM_ISP_RESOURCE_STATE_UNAVAILABLE;
+		if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_CAMIF_VER_3_0) {
+			rc = cam_vfe_camif_ver3_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Camif deinit failed rc=%d",
+					rc);
+		} else if (top_priv->top_common.mux_rsrc[i].res_type ==
+			CAM_VFE_IN_RD_VER_1_0) {
+			rc = cam_vfe_fe_ver1_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP, "Camif deinit failed rc=%d",
+					rc);
+		} else {
+			rc = cam_vfe_camif_lite_ver3_deinit(
+				&top_priv->top_common.mux_rsrc[i]);
+			if (rc)
+				CAM_ERR(CAM_ISP,
+					"Camif lite res id %d Deinit failed",
+					top_priv->top_common.mux_rsrc[i]
+					.res_id);
+		}
+	}
+
+	kfree(vfe_top->top_priv);
+
+free_vfe_top:
+	kfree(vfe_top);
+	*vfe_top_ptr = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_top_ver3.h
@@ -0,0 +1,102 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_TOP_VER3_H_
+#define _CAM_VFE_TOP_VER3_H_
+
+#include "cam_vfe_camif_ver3.h"
+#include "cam_vfe_camif_lite_ver3.h"
+#include "cam_vfe_fe_ver1.h"
+#include "cam_vfe_top_common.h"
+
+#define CAM_SHIFT_TOP_CORE_CFG_MUXSEL_PDAF       31
+#define CAM_SHIFT_TOP_CORE_CFG_VID_DS16_R2PD     30
+#define CAM_SHIFT_TOP_CORE_CFG_VID_DS4_R2PD      29
+#define CAM_SHIFT_TOP_CORE_CFG_DISP_DS16_R2PD    28
+#define CAM_SHIFT_TOP_CORE_CFG_DISP_DS4_R2PD     27
+#define CAM_SHIFT_TOP_CORE_CFG_DSP_STREAMING     25
+#define CAM_SHIFT_TOP_CORE_CFG_INPUT_PP_FMT      14
+#define CAM_SHIFT_TOP_CORE_CFG_STATS_IHIST       10
+#define CAM_SHIFT_TOP_CORE_CFG_STATS_HDR_BE       9
+#define CAM_SHIFT_TOP_CORE_CFG_STATS_HDR_BHIST    8
+#define CAM_SHIFT_TOP_CORE_CFG_INPUTMUX_PP        5
+
+struct cam_vfe_top_ver3_reg_offset_common {
+	uint32_t hw_version;
+	uint32_t titan_version;
+	uint32_t hw_capability;
+	uint32_t lens_feature;
+	uint32_t stats_feature;
+	uint32_t color_feature;
+	uint32_t zoom_feature;
+	uint32_t global_reset_cmd;
+	uint32_t core_cgc_ovd_0;
+	uint32_t core_cgc_ovd_1;
+	uint32_t ahb_cgc_ovd;
+	uint32_t noc_cgc_ovd;
+	uint32_t bus_cgc_ovd;
+	uint32_t core_cfg_0;
+	uint32_t core_cfg_1;
+	uint32_t reg_update_cmd;
+	uint32_t trigger_cdm_events;
+	uint32_t violation_status;
+	uint32_t custom_frame_idx;
+	uint32_t dsp_status;
+	uint32_t diag_config;
+	uint32_t diag_sensor_status_0;
+	uint32_t diag_sensor_status_1;
+	uint32_t bus_overflow_status;
+	uint32_t top_debug_cfg;
+	uint32_t top_debug_0;
+	uint32_t top_debug_1;
+	uint32_t top_debug_2;
+	uint32_t top_debug_3;
+	uint32_t top_debug_4;
+	uint32_t top_debug_5;
+	uint32_t top_debug_6;
+	uint32_t top_debug_7;
+	uint32_t top_debug_8;
+	uint32_t top_debug_9;
+	uint32_t top_debug_10;
+	uint32_t top_debug_11;
+	uint32_t top_debug_12;
+	uint32_t top_debug_13;
+};
+
+struct cam_vfe_camif_common_cfg {
+	uint32_t     vid_ds16_r2pd;
+	uint32_t     vid_ds4_r2pd;
+	uint32_t     disp_ds16_r2pd;
+	uint32_t     disp_ds4_r2pd;
+	uint32_t     dsp_streaming_tap_point;
+	uint32_t     ihist_src_sel;
+	uint32_t     hdr_be_src_sel;
+	uint32_t     hdr_bhist_src_sel;
+	uint32_t     input_mux_sel_pdaf;
+	uint32_t     input_mux_sel_pp;
+	uint32_t     input_pp_fmt;
+};
+
+struct cam_vfe_top_ver3_hw_info {
+	struct cam_vfe_top_ver3_reg_offset_common  *common_reg;
+	struct cam_vfe_camif_ver3_hw_info           camif_hw_info;
+	struct cam_vfe_camif_lite_ver3_hw_info      pdlib_hw_info;
+	struct cam_vfe_camif_lite_ver3_hw_info
+		*rdi_hw_info[CAM_VFE_RDI_VER2_MAX];
+	struct cam_vfe_camif_lite_ver3_hw_info      lcr_hw_info;
+	struct cam_vfe_fe_ver1_hw_info              fe_hw_info;
+	uint32_t                                    num_mux;
+	uint32_t mux_type[CAM_VFE_TOP_MUX_MAX];
+};
+
+int cam_vfe_top_ver3_init(struct cam_hw_soc_info     *soc_info,
+	struct cam_hw_intf                           *hw_intf,
+	void                                         *top_hw_info,
+	void                                         *vfe_irq_controller,
+	struct cam_vfe_top                          **vfe_top);
+
+int cam_vfe_top_ver3_deinit(struct cam_vfe_top      **vfe_top);
+
+#endif /* _CAM_VFE_TOP_VER3_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/include/cam_vfe_top.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/include/cam_vfe_top.h
@@ -0,0 +1,51 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_VFE_TOP_H_
+#define _CAM_VFE_TOP_H_
+
+#include "cam_hw_intf.h"
+#include "cam_isp_hw.h"
+
+#define CAM_VFE_TOP_VER_1_0 0x100000
+#define CAM_VFE_TOP_VER_2_0 0x200000
+#define CAM_VFE_TOP_VER_3_0 0x300000
+#define CAM_VFE_TOP_VER_4_0 0x400000
+
+#define CAM_VFE_CAMIF_VER_1_0 0x10
+#define CAM_VFE_CAMIF_VER_2_0 0x20
+#define CAM_VFE_CAMIF_VER_3_0 0x30
+
+#define CAM_VFE_CAMIF_LITE_VER_2_0 0x02
+
+#define CAM_VFE_RDI_VER_1_0    0x1000
+#define CAM_VFE_IN_RD_VER_1_0  0x2000
+
+#define CAM_VFE_LCR_VER_1_0 0x100
+#define CAM_VFE_PDLIB_VER_1_0 0x10000
+
+/*
+ * Debug values for camif module
+ */
+#define CAMIF_DEBUG_ENABLE_SENSOR_DIAG_STATUS      BIT(0)
+#define CAMIF_DEBUG_ENABLE_REG_DUMP                BIT(1)
+#define CAM_VFE_CAMIF_EVT_MAX                      256
+
+struct cam_vfe_top {
+	void                   *top_priv;
+	struct cam_hw_ops       hw_ops;
+};
+
+int cam_vfe_top_init(uint32_t          top_version,
+	struct cam_hw_soc_info        *soc_info,
+	struct cam_hw_intf            *hw_intf,
+	void                          *top_hw_info,
+	void                          *vfe_irq_controller,
+	struct cam_vfe_top           **vfe_top);
+
+int cam_vfe_top_deinit(uint32_t        top_version,
+	struct cam_vfe_top           **vfe_top);
+
+#endif /* _CAM_VFE_TOP_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/cam_jpeg_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/cam_jpeg_context.c
@@ -0,0 +1,229 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#include "cam_mem_mgr.h"
+#include "cam_jpeg_context.h"
+#include "cam_context_utils.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+
+static const char jpeg_dev_name[] = "cam-jpeg";
+
+static int cam_jpeg_context_dump_active_request(void *data,
+	struct cam_smmu_pf_info *pf_info)
+{
+
+	struct cam_context *ctx = (struct cam_context *)data;
+	struct cam_ctx_request          *req = NULL;
+	struct cam_ctx_request          *req_temp = NULL;
+	struct cam_hw_mgr_dump_pf_data  *pf_dbg_entry = NULL;
+	uint32_t  resource_type = 0;
+	int rc = 0;
+	int closest_port;
+	bool b_mem_found = false, b_ctx_found = false;
+
+
+	if (!ctx) {
+		CAM_ERR(CAM_JPEG, "Invalid ctx");
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_JPEG, "iommu fault for jpeg ctx %d state %d",
+		ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+			&ctx->active_req_list, list) {
+		pf_dbg_entry = &(req->pf_data);
+		closest_port = -1;
+		CAM_INFO(CAM_JPEG, "req_id : %lld ", req->request_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_dbg_entry,
+			&b_mem_found, &b_ctx_found, &resource_type, pf_info);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "Failed to dump pf info");
+
+		if (b_mem_found)
+			CAM_ERR(CAM_JPEG, "Found page fault in req %lld %d",
+				req->request_id, rc);
+	}
+	return rc;
+}
+
+static int __cam_jpeg_ctx_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Unable to Acquire device %d", rc);
+	else
+		ctx->state = CAM_CTX_ACQUIRED;
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Unable to release device %d", rc);
+
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_dump_dev_in_acquired(
+	struct cam_context      *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Failed to dump device, rc=%d", rc);
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_flush_dev_in_acquired(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_flush_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_ICP, "Failed to flush device");
+
+	return rc;
+}
+
+static int __cam_jpeg_ctx_config_dev_in_acquired(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	return cam_context_prepare_dev_to_hw(ctx, cmd);
+}
+
+static int __cam_jpeg_ctx_handle_buf_done_in_acquired(void *ctx,
+	uint32_t evt_id, void *done)
+{
+	return cam_context_buf_done_from_hw(ctx, done, evt_id);
+}
+
+static int __cam_jpeg_ctx_stop_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Failed in Stop dev, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_jpeg_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = { },
+		.crm_ops = { },
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_jpeg_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = { },
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.release_dev = __cam_jpeg_ctx_release_dev_in_acquired,
+			.config_dev = __cam_jpeg_ctx_config_dev_in_acquired,
+			.stop_dev = __cam_jpeg_ctx_stop_dev_in_acquired,
+			.flush_dev = __cam_jpeg_ctx_flush_dev_in_acquired,
+			.dump_dev = __cam_jpeg_ctx_dump_dev_in_acquired,
+		},
+		.crm_ops = { },
+		.irq_ops = __cam_jpeg_ctx_handle_buf_done_in_acquired,
+		.pagefault_ops = cam_jpeg_context_dump_active_request,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {},
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {},
+	},
+};
+
+int cam_jpeg_context_init(struct cam_jpeg_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id)
+{
+	int rc;
+	int i;
+
+	if (!ctx || !ctx_base) {
+		CAM_ERR(CAM_JPEG, "Invalid Context");
+		rc = -EFAULT;
+		goto err;
+	}
+
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->base = ctx_base;
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++)
+		ctx->req_base[i].req_priv = ctx;
+
+	rc = cam_context_init(ctx_base, jpeg_dev_name, CAM_JPEG, ctx_id,
+		NULL, hw_intf, ctx->req_base, CAM_CTX_REQ_MAX);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Camera Context Base init failed");
+		goto err;
+	}
+
+	ctx_base->state_machine = cam_jpeg_ctx_state_machine;
+	ctx_base->ctx_priv = ctx;
+
+err:
+	return rc;
+}
+
+int cam_jpeg_context_deinit(struct cam_jpeg_context *ctx)
+{
+	if (!ctx || !ctx->base) {
+		CAM_ERR(CAM_JPEG, "Invalid params: %pK", ctx);
+		return -EINVAL;
+	}
+
+	cam_context_deinit(ctx->base);
+
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/cam_jpeg_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/cam_jpeg_context.h
@@ -0,0 +1,67 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_JPEG_CONTEXT_H_
+#define _CAM_JPEG_CONTEXT_H_
+
+#include <media/cam_jpeg.h>
+
+#include "cam_context.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+
+#define CAM_JPEG_HW_EVENT_MAX 20
+
+/**
+ * struct cam_jpeg_context - Jpeg context
+ * @base: Base jpeg cam context object
+ * @req_base: Common request structure
+ */
+struct cam_jpeg_context {
+	struct cam_context *base;
+	struct cam_ctx_request req_base[CAM_CTX_REQ_MAX];
+};
+
+/* cam jpeg context irq handling function type */
+typedef int (*cam_jpeg_hw_event_cb_func)(
+	struct cam_jpeg_context *ctx_jpeg,
+	void *evt_data);
+
+/**
+ * struct cam_jpeg_ctx_irq_ops - Function table for handling IRQ callbacks
+ *
+ * @irq_ops: Array of handle function pointers.
+ *
+ */
+struct cam_jpeg_ctx_irq_ops {
+	cam_jpeg_hw_event_cb_func irq_ops[CAM_JPEG_HW_EVENT_MAX];
+};
+
+/**
+ * cam_jpeg_context_init()
+ *
+ * @brief: Initialization function for the JPEG context
+ *
+ * @ctx: JPEG context obj to be initialized
+ * @ctx_base: Context base from cam_context
+ * @hw_intf: JPEG hw manager interface
+ * @ctx_id: ID for this context
+ *
+ */
+int cam_jpeg_context_init(struct cam_jpeg_context *ctx,
+	struct cam_context *ctx_base,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t ctx_id);
+
+/**
+ * cam_jpeg_context_deinit()
+ *
+ * @brief: Deinitialize function for the JPEG context
+ *
+ * @ctx: JPEG context obj to be deinitialized
+ *
+ */
+int cam_jpeg_context_deinit(struct cam_jpeg_context *ctx);
+
+#endif  /* __CAM_JPEG_CONTEXT_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/cam_jpeg_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/cam_jpeg_dev.c
@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_node.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_jpeg_dev.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+
+#define CAM_JPEG_DEV_NAME "cam-jpeg"
+
+static struct cam_jpeg_dev g_jpeg_dev;
+
+static void cam_jpeg_dev_iommu_fault_handler(
+	struct cam_smmu_pf_info *pf_info)
+{
+	int i = 0;
+	struct cam_node *node = NULL;
+
+	if (!pf_info || !pf_info->token) {
+		CAM_ERR(CAM_ISP, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_info->token;
+
+	for (i = 0; i < node->ctx_size; i++)
+		cam_context_dump_pf_info(&(node->ctx_list[i]), pf_info);
+}
+
+static const struct of_device_id cam_jpeg_dt_match[] = {
+	{
+		.compatible = "qcom,cam-jpeg"
+	},
+	{ }
+};
+
+static int cam_jpeg_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
+	mutex_lock(&g_jpeg_dev.jpeg_mutex);
+	g_jpeg_dev.open_cnt++;
+	mutex_unlock(&g_jpeg_dev.jpeg_mutex);
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
+	return 0;
+}
+
+static int cam_jpeg_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&g_jpeg_dev.jpeg_mutex);
+	if (g_jpeg_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_JPEG, "JPEG subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	g_jpeg_dev.open_cnt--;
+
+	if (!node) {
+		CAM_ERR(CAM_JPEG, "Node ptr is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (g_jpeg_dev.open_cnt == 0)
+		cam_node_shutdown(node);
+
+end:
+	mutex_unlock(&g_jpeg_dev.jpeg_mutex);
+	return rc;
+}
+
+static int cam_jpeg_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_JPEG, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+	return cam_jpeg_subdev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_jpeg_subdev_internal_ops = {
+	.close = cam_jpeg_subdev_close,
+	.open = cam_jpeg_subdev_open,
+};
+
+static int cam_jpeg_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+	int i;
+	struct cam_hw_mgr_intf hw_mgr_intf;
+	struct cam_node *node;
+	int iommu_hdl = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	g_jpeg_dev.sd.internal_ops = &cam_jpeg_subdev_internal_ops;
+	g_jpeg_dev.sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+	rc = cam_subdev_probe(&g_jpeg_dev.sd, pdev, CAM_JPEG_DEV_NAME,
+		CAM_JPEG_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "JPEG cam_subdev_probe failed %d", rc);
+		goto err;
+	}
+	node = (struct cam_node *)g_jpeg_dev.sd.token;
+
+	rc = cam_jpeg_hw_mgr_init(pdev->dev.of_node,
+		(uint64_t *)&hw_mgr_intf, &iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Can not initialize JPEG HWmanager %d", rc);
+		goto unregister;
+	}
+
+	for (i = 0; i < CAM_JPEG_CTX_MAX; i++) {
+		rc = cam_jpeg_context_init(&g_jpeg_dev.ctx_jpeg[i],
+			&g_jpeg_dev.ctx[i],
+			&node->hw_mgr_intf,
+			i);
+		if (rc) {
+			CAM_ERR(CAM_JPEG, "JPEG context init failed %d %d",
+				i, rc);
+			goto ctx_init_fail;
+		}
+	}
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_jpeg_dev.ctx, CAM_JPEG_CTX_MAX,
+		CAM_JPEG_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "JPEG node init failed %d", rc);
+		goto ctx_init_fail;
+	}
+
+	node->sd_handler = cam_jpeg_subdev_close_internal;
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_jpeg_dev_iommu_fault_handler, node);
+
+	mutex_init(&g_jpeg_dev.jpeg_mutex);
+	rc = cam_subdev_register(&g_jpeg_dev.sd, pdev);
+
+	CAM_DBG(CAM_JPEG, "Component bound successfully");
+
+	return rc;
+
+ctx_init_fail:
+	for (--i; i >= 0; i--)
+		if (cam_jpeg_context_deinit(&g_jpeg_dev.ctx_jpeg[i]))
+			CAM_ERR(CAM_JPEG, "deinit fail %d %d", i, rc);
+unregister:
+	if (cam_subdev_remove(&g_jpeg_dev.sd))
+		CAM_ERR(CAM_JPEG, "remove fail %d", rc);
+err:
+	return rc;
+}
+
+static void cam_jpeg_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+	int i;
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_jpeg_context_deinit(&g_jpeg_dev.ctx_jpeg[i]);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "JPEG context %d deinit failed %d",
+				i, rc);
+	}
+
+	rc = cam_unregister_subdev(&g_jpeg_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Unregister failed %d", rc);
+
+	rc = cam_subdev_remove(&g_jpeg_dev.sd);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Subdev remove failed %d", rc);
+}
+
+const static struct component_ops cam_jpeg_dev_component_ops = {
+	.bind = cam_jpeg_dev_component_bind,
+	.unbind = cam_jpeg_dev_component_unbind,
+};
+
+static int cam_jpeg_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_jpeg_dev_component_ops);
+	return 0;
+}
+
+static int cam_jpeg_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_JPEG, "Adding JPEG component");
+	rc = component_add(&pdev->dev, &cam_jpeg_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to add component rc: %d", rc);
+
+	return rc;
+
+}
+
+struct platform_driver jpeg_driver = {
+	.probe = cam_jpeg_dev_probe,
+	.remove = cam_jpeg_dev_remove,
+	.driver = {
+		.name = "cam_jpeg",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_jpeg_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_jpeg_dev_init_module(void)
+{
+	return platform_driver_register(&jpeg_driver);
+}
+
+void cam_jpeg_dev_exit_module(void)
+{
+	platform_driver_unregister(&jpeg_driver);
+}
+
+MODULE_DESCRIPTION("MSM JPEG driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/cam_jpeg_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/cam_jpeg_dev.h
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_JPEG_DEV_H_
+#define _CAM_JPEG_DEV_H_
+
+#include "cam_subdev.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_context.h"
+#include "cam_jpeg_context.h"
+
+/**
+ * struct cam_jpeg_dev - Camera JPEG V4l2 device node
+ *
+ * @sd: Commone camera subdevice node
+ * @node: Pointer to jpeg subdevice
+ * @ctx: JPEG base context storage
+ * @ctx_jpeg: JPEG private context storage
+ * @jpeg_mutex: Jpeg dev mutex
+ * @open_cnt: Open device count
+ */
+struct cam_jpeg_dev {
+	struct cam_subdev sd;
+	struct cam_node *node;
+	struct cam_context ctx[CAM_JPEG_CTX_MAX];
+	struct cam_jpeg_context ctx_jpeg[CAM_JPEG_CTX_MAX];
+	struct mutex jpeg_mutex;
+	int32_t open_cnt;
+};
+
+/**
+ * @brief : API to register JPEG dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_jpeg_dev_init_module(void);
+
+/**
+ * @brief : API to remove JPEG dev from platform framework.
+ */
+void cam_jpeg_dev_exit_module(void);
+#endif /* __CAM_JPEG_DEV_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
@@ -0,0 +1,1995 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/uaccess.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
+#include <linux/timer.h>
+#include <linux/debugfs.h>
+#include <media/cam_defs.h>
+#include <media/cam_jpeg.h>
+#include <media/cam_sync.h>
+
+#include "cam_packet_util.h"
+#include "cam_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_jpeg_hw_mgr.h"
+#include "cam_smmu_api.h"
+#include "cam_mem_mgr.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+
+#define CAM_JPEG_HW_ENTRIES_MAX  20
+#define CAM_JPEG_CHBASE          0
+#define CAM_JPEG_CFG             1
+#define CAM_JPEG_PARAM           2
+
+static struct cam_jpeg_hw_mgr g_jpeg_hw_mgr;
+
+static int32_t cam_jpeg_hw_mgr_cb(uint32_t irq_status,
+	int32_t result_size, void *data);
+static int cam_jpeg_mgr_process_cmd(void *priv, void *data);
+static int cam_jpeg_insert_cdm_change_base(
+	struct cam_hw_config_args *config_args,
+	struct cam_jpeg_hw_ctx_data *ctx_data,
+	struct cam_jpeg_hw_mgr *hw_mgr);
+
+static int cam_jpeg_process_next_hw_update(void *priv, void *data,
+	struct cam_hw_done_event_data *buf_data)
+{
+	int rc;
+	int i = 0;
+	struct cam_jpeg_hw_mgr *hw_mgr = priv;
+	struct cam_hw_update_entry *cmd;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_hw_config_args *config_args = NULL;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	uint32_t dev_type;
+	struct cam_jpeg_hw_cfg_req *p_cfg_req = NULL;
+	uint32_t cdm_cfg_to_insert = 0;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_JPEG, "Invalid data");
+		return -EINVAL;
+	}
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)data;
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+	p_cfg_req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+	config_args = (struct cam_hw_config_args *)&p_cfg_req->hw_cfg_args;
+
+	if (!hw_mgr->devices[dev_type][0]->hw_ops.reset) {
+		CAM_ERR(CAM_JPEG, "op reset null ");
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_INVLD_CMD;
+		rc = -EFAULT;
+		goto end_error;
+	}
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.reset(
+		hw_mgr->devices[dev_type][0]->hw_priv,
+		NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "jpeg hw reset failed %d", rc);
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_HW_RESET_FAILED;
+		goto end_error;
+	}
+
+	cdm_cmd = ctx_data->cdm_cmd;
+	cdm_cmd->type = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+	cdm_cmd->flag = false;
+	cdm_cmd->userdata = NULL;
+	cdm_cmd->cookie = 0;
+	cdm_cmd->cmd_arrary_count = 0;
+
+	/* insert cdm chage base cmd */
+	rc = cam_jpeg_insert_cdm_change_base(config_args,
+		ctx_data, hw_mgr);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "insert change base failed %d", rc);
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_CDM_CHANGE_BASE_ERR;
+		goto end_error;
+	}
+
+	/* insert next cdm payload at index */
+	/* for enc or dma 1st pass at index 1 */
+	/* for dma 2nd pass at index 2, for 3rd at 4 */
+	if (p_cfg_req->num_hw_entry_processed == 0)
+		cdm_cfg_to_insert = CAM_JPEG_CFG;
+	else
+		cdm_cfg_to_insert = p_cfg_req->num_hw_entry_processed + 2;
+
+	CAM_DBG(CAM_JPEG, "processed %d total %d using cfg entry %d for %pK",
+		p_cfg_req->num_hw_entry_processed,
+		config_args->num_hw_update_entries,
+		cdm_cfg_to_insert,
+		p_cfg_req);
+
+	cmd = (config_args->hw_update_entries + cdm_cfg_to_insert);
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].bl_addr.mem_handle =
+		cmd->handle;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].offset =
+		cmd->offset;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].len =
+		cmd->len;
+	CAM_DBG(CAM_JPEG, "i %d entry h %d o %d l %d",
+		i, cmd->handle, cmd->offset, cmd->len);
+	cdm_cmd->cmd_arrary_count++;
+
+	rc = cam_cdm_submit_bls(
+		hw_mgr->cdm_info[dev_type][0].cdm_handle,
+		cdm_cmd);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Failed to apply the configs %d", rc);
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_CDM_CONFIG_ERR;
+		goto end_error;
+	}
+
+	if (!hw_mgr->devices[dev_type][0]->hw_ops.start) {
+		CAM_ERR(CAM_JPEG, "op start null ");
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_INVLD_CMD;
+		rc = -EINVAL;
+		goto end_error;
+	}
+
+	CAM_TRACE(CAM_JPEG, "Start JPEG ENC Req %llu", config_args->request_id);
+
+	if (g_jpeg_hw_mgr.camnoc_misr_test) {
+		/* configure jpeg hw and camnoc misr */
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			CAM_JPEG_CMD_CONFIG_HW_MISR,
+			&g_jpeg_hw_mgr.camnoc_misr_test,
+			sizeof(g_jpeg_hw_mgr.camnoc_misr_test));
+		if (rc) {
+			CAM_ERR(CAM_JPEG, "Failed to apply the configs %d", rc);
+			goto end_error;
+		}
+	}
+
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.start(
+		hw_mgr->devices[dev_type][0]->hw_priv, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Failed to apply the configs %d",
+			rc);
+		buf_data->evt_param = CAM_SYNC_JPEG_EVENT_START_HW_ERR;
+		goto end_error;
+	}
+
+	return 0;
+end_error:
+	return rc;
+}
+
+static int cam_jpeg_mgr_process_irq(void *priv, void *data)
+{
+	int rc = 0;
+	int mem_hdl = 0;
+	struct cam_jpeg_process_irq_work_data_t *task_data;
+	struct cam_jpeg_hw_mgr *hw_mgr;
+	int32_t i;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	struct cam_hw_done_event_data buf_data;
+	struct cam_jpeg_set_irq_cb irq_cb;
+	uintptr_t dev_type = 0;
+	uintptr_t kaddr;
+	uint32_t *cmd_buf_kaddr;
+	size_t cmd_buf_len;
+	struct cam_jpeg_config_inout_param_info *p_params;
+	struct cam_jpeg_hw_cfg_req *p_cfg_req = NULL;
+	struct crm_workq_task *task;
+	struct cam_jpeg_process_frame_work_data_t *wq_task_data;
+	struct cam_jpeg_misr_dump_args misr_args;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_JPEG, "Invalid data");
+		return -EINVAL;
+	}
+
+	task_data = data;
+	hw_mgr = &g_jpeg_hw_mgr;
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)task_data->data;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		return -EINVAL;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	mutex_lock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+
+	p_cfg_req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+
+	if (hw_mgr->device_in_use[dev_type][0] == false ||
+		p_cfg_req == NULL) {
+		CAM_ERR(CAM_JPEG, "irq for old request %d", rc);
+		mutex_unlock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	p_cfg_req->num_hw_entry_processed++;
+	CAM_DBG(CAM_JPEG, "hw entry processed %d Encoded size :%d",
+		p_cfg_req->num_hw_entry_processed, task_data->result_size);
+
+	if (g_jpeg_hw_mgr.camnoc_misr_test) {
+		misr_args.req_id = p_cfg_req->req_id;
+		misr_args.enable_bug = g_jpeg_hw_mgr.bug_on_misr;
+		CAM_DBG(CAM_JPEG, "req %lld bug is enabled for MISR :%d",
+			misr_args.req_id, misr_args.enable_bug);
+
+		/* dump jpeg hw and camnoc misr */
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			CAM_JPEG_CMD_DUMP_HW_MISR_VAL, &misr_args,
+			sizeof(struct cam_jpeg_misr_dump_args));
+	}
+
+	if ((task_data->result_size > 0) &&
+		(p_cfg_req->num_hw_entry_processed <
+			p_cfg_req->hw_cfg_args.num_hw_update_entries - 2)) {
+		/* start processing next entry before marking device free */
+		rc  = cam_jpeg_process_next_hw_update(priv, ctx_data,
+			&buf_data);
+		if (!rc) {
+			mutex_unlock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+			return 0;
+		}
+	}
+
+	irq_cb.jpeg_hw_mgr_cb = cam_jpeg_hw_mgr_cb;
+	irq_cb.data = NULL;
+	irq_cb.b_set_cb = false;
+	if (!hw_mgr->devices[dev_type][0]->hw_ops.process_cmd) {
+		CAM_ERR(CAM_JPEG, "process_cmd null ");
+		mutex_unlock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+		return -EINVAL;
+	}
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+		hw_mgr->devices[dev_type][0]->hw_priv,
+		CAM_JPEG_CMD_SET_IRQ_CB,
+		&irq_cb, sizeof(irq_cb));
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "CMD_SET_IRQ_CB failed %d", rc);
+		mutex_unlock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+		return rc;
+	}
+
+	if (hw_mgr->devices[dev_type][0]->hw_ops.deinit) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.deinit(
+			hw_mgr->devices[dev_type][0]->hw_priv, NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "Failed to Deinit %lu HW", dev_type);
+	}
+
+	hw_mgr->device_in_use[dev_type][0] = false;
+	hw_mgr->dev_hw_cfg_args[dev_type][0] = NULL;
+	mutex_unlock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+
+	task = cam_req_mgr_workq_get_task(
+		g_jpeg_hw_mgr.work_process_frame);
+	if (!task) {
+		CAM_ERR(CAM_JPEG, "no empty task");
+		return -EINVAL;
+	}
+
+	wq_task_data = (struct cam_jpeg_process_frame_work_data_t *)
+		task->payload;
+	if (!task_data) {
+		CAM_ERR(CAM_JPEG, "task_data is NULL");
+		return -EINVAL;
+	}
+	wq_task_data->data = (void *)dev_type;
+	wq_task_data->request_id = 0;
+	wq_task_data->type = CAM_JPEG_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_jpeg_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, &g_jpeg_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "could not enque task %d", rc);
+		return rc;
+	}
+
+	mem_hdl =
+		p_cfg_req->hw_cfg_args.hw_update_entries[CAM_JPEG_PARAM].handle;
+	rc = cam_mem_get_cpu_buf(mem_hdl, &kaddr, &cmd_buf_len);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "unable to get info for cmd buf: %x %d",
+			hw_mgr->iommu_hdl, rc);
+		return rc;
+	}
+
+	cmd_buf_kaddr = (uint32_t *)kaddr;
+
+	if ((p_cfg_req->hw_cfg_args.hw_update_entries[CAM_JPEG_PARAM].offset /
+			sizeof(uint32_t)) >= cmd_buf_len) {
+		CAM_ERR(CAM_JPEG, "Invalid offset: %u cmd buf len: %zu",
+			p_cfg_req->hw_cfg_args.hw_update_entries[
+			CAM_JPEG_PARAM].offset, cmd_buf_len);
+		cam_mem_put_cpu_buf(mem_hdl);
+		return -EINVAL;
+	}
+
+	cmd_buf_kaddr =
+		(cmd_buf_kaddr +
+		(p_cfg_req->hw_cfg_args.hw_update_entries[CAM_JPEG_PARAM].offset
+			/ sizeof(uint32_t)));
+
+	p_params = (struct cam_jpeg_config_inout_param_info *)cmd_buf_kaddr;
+
+	p_params->output_size = task_data->result_size;
+
+	buf_data.num_handles =
+		p_cfg_req->hw_cfg_args.num_out_map_entries;
+	for (i = 0; i < buf_data.num_handles; i++) {
+		buf_data.resource_handle[i] =
+		p_cfg_req->hw_cfg_args.out_map_entries[i].resource_handle;
+	}
+	buf_data.request_id =
+		PTR_TO_U64(p_cfg_req->hw_cfg_args.priv);
+	ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_CTX_EVT_ID_SUCCESS,
+		&buf_data);
+
+	mutex_lock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+	list_add_tail(&p_cfg_req->list, &hw_mgr->free_req_list);
+	mutex_unlock(&g_jpeg_hw_mgr.hw_mgr_mutex);
+	cam_mem_put_cpu_buf(mem_hdl);
+	return rc;
+}
+
+static int cam_jpeg_hw_mgr_cb(
+	uint32_t irq_status, int32_t result_size, void *data)
+{
+	int32_t rc;
+	unsigned long flags;
+	struct cam_jpeg_hw_mgr *hw_mgr = &g_jpeg_hw_mgr;
+	struct crm_workq_task *task;
+	struct cam_jpeg_process_irq_work_data_t *task_data;
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(
+		g_jpeg_hw_mgr.work_process_irq_cb);
+	if (!task) {
+		CAM_ERR(CAM_JPEG, "no empty task");
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+		return -ENOMEM;
+	}
+
+	task_data = (struct cam_jpeg_process_irq_work_data_t *)task->payload;
+	task_data->data = data;
+	task_data->irq_status = irq_status;
+	task_data->result_size = result_size;
+	task_data->type = CAM_JPEG_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_jpeg_mgr_process_irq;
+
+	rc = cam_req_mgr_workq_enqueue_task(task, &g_jpeg_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_get_free_ctx(struct cam_jpeg_hw_mgr *hw_mgr)
+{
+	int i = 0;
+	int num_ctx = CAM_JPEG_CTX_MAX;
+
+	for (i = 0; i < num_ctx; i++) {
+		mutex_lock(&hw_mgr->ctx_data[i].ctx_mutex);
+		if (hw_mgr->ctx_data[i].in_use == false) {
+			hw_mgr->ctx_data[i].in_use = true;
+			mutex_unlock(&hw_mgr->ctx_data[i].ctx_mutex);
+			break;
+		}
+		mutex_unlock(&hw_mgr->ctx_data[i].ctx_mutex);
+	}
+
+	return i;
+}
+
+
+static int cam_jpeg_mgr_release_ctx(
+	struct cam_jpeg_hw_mgr *hw_mgr, struct cam_jpeg_hw_ctx_data *ctx_data)
+{
+	if (!ctx_data) {
+		CAM_ERR(CAM_JPEG, "invalid ctx_data %pK", ctx_data);
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is already un-used: %pK", ctx_data);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return -EINVAL;
+	}
+
+	ctx_data->in_use = false;
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return 0;
+}
+
+static int cam_jpeg_insert_cdm_change_base(
+	struct cam_hw_config_args *config_args,
+	struct cam_jpeg_hw_ctx_data *ctx_data,
+	struct cam_jpeg_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	uint32_t dev_type;
+	struct cam_cdm_bl_request *cdm_cmd;
+	uint32_t size;
+	uint32_t mem_cam_base;
+	uintptr_t iova_addr;
+	uint32_t *ch_base_iova_addr;
+	size_t ch_base_len;
+
+	rc = cam_mem_get_cpu_buf(
+		config_args->hw_update_entries[CAM_JPEG_CHBASE].handle,
+		&iova_addr, &ch_base_len);
+	if (rc) {
+		CAM_ERR(CAM_JPEG,
+			"unable to get src buf info for cmd buf: %d", rc);
+		return rc;
+	}
+
+	if (config_args->hw_update_entries[CAM_JPEG_CHBASE].offset >=
+		ch_base_len) {
+		CAM_ERR(CAM_JPEG, "Not enough buf offset %d len %d",
+			config_args->hw_update_entries[CAM_JPEG_CHBASE].offset,
+			ch_base_len);
+		cam_mem_put_cpu_buf(
+			config_args->hw_update_entries[CAM_JPEG_CHBASE].handle);
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_JPEG, "iova %pK len %zu offset %d",
+		(void *)iova_addr, ch_base_len,
+		config_args->hw_update_entries[CAM_JPEG_CHBASE].offset);
+	ch_base_iova_addr = (uint32_t *)iova_addr;
+	ch_base_iova_addr = (ch_base_iova_addr +
+		(config_args->hw_update_entries[CAM_JPEG_CHBASE].offset /
+		sizeof(uint32_t)));
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+	mem_cam_base = hw_mgr->cdm_reg_map[dev_type][0]->mem_cam_base;
+	size =
+	hw_mgr->cdm_info[dev_type][0].cdm_ops->cdm_required_size_changebase();
+	hw_mgr->cdm_info[dev_type][0].cdm_ops->cdm_write_changebase(
+		ch_base_iova_addr, mem_cam_base);
+
+	cdm_cmd = ctx_data->cdm_cmd;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].bl_addr.mem_handle =
+		config_args->hw_update_entries[CAM_JPEG_CHBASE].handle;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].offset =
+		config_args->hw_update_entries[CAM_JPEG_CHBASE].offset;
+	cdm_cmd->cmd_flex[cdm_cmd->cmd_arrary_count].len = size * sizeof(uint32_t);
+	cdm_cmd->cmd_arrary_count++;
+	cdm_cmd->gen_irq_arb = false;
+
+	ch_base_iova_addr += size;
+	*ch_base_iova_addr = 0;
+	ch_base_iova_addr += size;
+	*ch_base_iova_addr = 0;
+
+	cam_mem_put_cpu_buf(
+		config_args->hw_update_entries[CAM_JPEG_CHBASE].handle);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_process_cmd(void *priv, void *data)
+{
+	int rc;
+	int i = 0;
+	struct cam_jpeg_hw_mgr *hw_mgr = priv;
+	struct cam_hw_config_args *config_args = NULL;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	uintptr_t request_id = 0;
+	struct cam_jpeg_process_frame_work_data_t *task_data =
+		(struct cam_jpeg_process_frame_work_data_t *)data;
+	uint32_t dev_type;
+	struct cam_jpeg_set_irq_cb irq_cb;
+	struct cam_jpeg_hw_cfg_req *p_cfg_req = NULL;
+	struct cam_hw_done_event_data buf_data;
+	struct cam_hw_config_args *hw_cfg_args = NULL;
+
+	if (!hw_mgr || !task_data) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments %pK %pK",
+			hw_mgr, task_data);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	if (list_empty(&hw_mgr->hw_config_req_list)) {
+		CAM_DBG(CAM_JPEG, "no available request");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	p_cfg_req = list_first_entry(&hw_mgr->hw_config_req_list,
+		struct cam_jpeg_hw_cfg_req, list);
+	if (!p_cfg_req) {
+		CAM_ERR(CAM_JPEG, "no request");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	if (false == hw_mgr->device_in_use[p_cfg_req->dev_type][0]) {
+		hw_mgr->device_in_use[p_cfg_req->dev_type][0] = true;
+		hw_mgr->dev_hw_cfg_args[p_cfg_req->dev_type][0] = p_cfg_req;
+		list_del_init(&p_cfg_req->list);
+	} else {
+		CAM_DBG(CAM_JPEG, "Not dequeing, just return");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	config_args = (struct cam_hw_config_args *)&p_cfg_req->hw_cfg_args;
+	request_id = task_data->request_id;
+	if (request_id != (uintptr_t)config_args->priv) {
+		CAM_DBG(CAM_JPEG, "not a recent req %zd %zd",
+			request_id, (uintptr_t)config_args->priv);
+	}
+
+	if (!config_args->num_hw_update_entries) {
+		CAM_ERR(CAM_JPEG, "No hw update enteries are available");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		rc = -EINVAL;
+		goto end_unusedev;
+	}
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)config_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		rc = -EINVAL;
+		goto end_unusedev;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	if (dev_type != p_cfg_req->dev_type)
+		CAM_WARN(CAM_JPEG, "dev types not same something wrong");
+
+	if (!hw_mgr->devices[dev_type][0]->hw_ops.init) {
+		CAM_ERR(CAM_JPEG, "hw op init null ");
+		rc = -EFAULT;
+		goto end;
+	}
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.init(
+		hw_mgr->devices[dev_type][0]->hw_priv,
+		ctx_data,
+		sizeof(ctx_data));
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Failed to Init %d HW", dev_type);
+		goto end;
+	}
+
+	irq_cb.jpeg_hw_mgr_cb = cam_jpeg_hw_mgr_cb;
+	irq_cb.data = (void *)ctx_data;
+	irq_cb.b_set_cb = true;
+	if (!hw_mgr->devices[dev_type][0]->hw_ops.process_cmd) {
+		CAM_ERR(CAM_JPEG, "op process_cmd null ");
+		buf_data.evt_param = CAM_SYNC_JPEG_EVENT_INVLD_CMD;
+		rc = -EFAULT;
+		goto end_callcb;
+	}
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+		hw_mgr->devices[dev_type][0]->hw_priv,
+		CAM_JPEG_CMD_SET_IRQ_CB,
+		&irq_cb, sizeof(irq_cb));
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "SET_IRQ_CB failed %d", rc);
+		buf_data.evt_param = CAM_SYNC_JPEG_EVENT_SET_IRQ_CB;
+		goto end_callcb;
+	}
+
+	/* insert one of the cdm payloads */
+	rc = cam_jpeg_process_next_hw_update(priv, ctx_data, &buf_data);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "next hw update failed %d", rc);
+		goto end_callcb;
+	}
+
+	p_cfg_req->submit_timestamp = ktime_get();
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+
+end_callcb:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	if (p_cfg_req) {
+		hw_cfg_args = &p_cfg_req->hw_cfg_args;
+		buf_data.num_handles =
+			hw_cfg_args->num_out_map_entries;
+		for (i = 0; i < buf_data.num_handles; i++) {
+			buf_data.resource_handle[i] =
+			hw_cfg_args->out_map_entries[i].resource_handle;
+		}
+		buf_data.request_id =
+			(uintptr_t)p_cfg_req->hw_cfg_args.priv;
+		ctx_data->ctxt_event_cb(ctx_data->context_priv,
+			CAM_CTX_EVT_ID_ERROR, &buf_data);
+	}
+end_unusedev:
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	hw_mgr->device_in_use[p_cfg_req->dev_type][0] = false;
+	hw_mgr->dev_hw_cfg_args[p_cfg_req->dev_type][0] = NULL;
+
+end:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_jpeg_mgr_config_hw(void *hw_mgr_priv, void *config_hw_args)
+{
+	int rc;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_config_args *config_args = config_hw_args;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	uintptr_t request_id = 0;
+	struct cam_hw_update_entry *hw_update_entries;
+	struct crm_workq_task *task;
+	struct cam_jpeg_process_frame_work_data_t *task_data;
+	struct cam_jpeg_hw_cfg_req *p_cfg_req = NULL;
+
+	if (!hw_mgr || !config_args) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments %pK %pK",
+			hw_mgr, config_args);
+		return -EINVAL;
+	}
+
+	if (!config_args->num_hw_update_entries) {
+		CAM_ERR(CAM_JPEG, "No hw update enteries are available");
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)config_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	if (list_empty(&hw_mgr->free_req_list)) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_JPEG, "list empty");
+		return -ENOMEM;
+	}
+
+	p_cfg_req = list_first_entry(&hw_mgr->free_req_list,
+		struct cam_jpeg_hw_cfg_req, list);
+	list_del_init(&p_cfg_req->list);
+
+	/* Update Currently Processing Config Request */
+	p_cfg_req->hw_cfg_args = *config_args;
+	p_cfg_req->dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	request_id = (uintptr_t)config_args->priv;
+	p_cfg_req->req_id = request_id;
+	p_cfg_req->num_hw_entry_processed = 0;
+	hw_update_entries = config_args->hw_update_entries;
+	CAM_DBG(CAM_JPEG, "ctx_data = %pK req_id = %lld %zd",
+		ctx_data, request_id, (uintptr_t)config_args->priv);
+	task = cam_req_mgr_workq_get_task(g_jpeg_hw_mgr.work_process_frame);
+	if (!task) {
+		CAM_ERR(CAM_JPEG, "no empty task");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		rc = -ENOMEM;
+		goto err_after_dq_free_list;
+	}
+
+
+	task_data = (struct cam_jpeg_process_frame_work_data_t *)
+		task->payload;
+	if (!task_data) {
+		CAM_ERR(CAM_JPEG, "task_data is NULL");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		rc = -EINVAL;
+		goto err_after_dq_free_list;
+	}
+	CAM_DBG(CAM_JPEG, "cfge %pK num %d",
+		p_cfg_req->hw_cfg_args.hw_update_entries,
+		p_cfg_req->hw_cfg_args.num_hw_update_entries);
+
+	list_add_tail(&p_cfg_req->list, &hw_mgr->hw_config_req_list);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	task_data->data = (void *)(uintptr_t)p_cfg_req->dev_type;
+	task_data->request_id = request_id;
+	task_data->type = CAM_JPEG_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_jpeg_mgr_process_cmd;
+
+	rc = cam_req_mgr_workq_enqueue_task(task, &g_jpeg_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "failed to enqueue task %d", rc);
+		goto err_after_get_task;
+	}
+
+	return rc;
+
+err_after_get_task:
+	list_del_init(&p_cfg_req->list);
+err_after_dq_free_list:
+	list_add_tail(&p_cfg_req->list, &hw_mgr->free_req_list);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv,
+	void *prepare_hw_update_args)
+{
+	int rc, i, j, k;
+	struct cam_hw_prepare_update_args *prepare_args =
+		prepare_hw_update_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	struct cam_packet *packet = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+	struct cam_kmd_buf_info kmd_buf;
+
+	if (!prepare_args || !hw_mgr) {
+		CAM_ERR(CAM_JPEG, "Invalid args %pK %pK",
+			prepare_args, hw_mgr);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)prepare_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	packet = prepare_args->packet;
+	if (!packet) {
+		CAM_ERR(CAM_JPEG, "received packet is NULL");
+		return -EINVAL;
+	}
+
+	if (((packet->header.op_code & 0xff) != CAM_JPEG_OPCODE_ENC_UPDATE) &&
+		((packet->header.op_code
+		& 0xff) != CAM_JPEG_OPCODE_DMA_UPDATE)) {
+		CAM_ERR(CAM_JPEG, "Invalid Opcode in pkt: %d",
+			packet->header.op_code & 0xff);
+		return -EINVAL;
+	}
+
+	rc = cam_packet_util_validate_packet(packet, prepare_args->remain_len);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "invalid packet %d", rc);
+		return rc;
+	}
+
+	if (!packet->num_cmd_buf ||
+		(packet->num_cmd_buf > 5) ||
+		!packet->num_patches || !packet->num_io_configs ||
+		(packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {
+		CAM_ERR(CAM_JPEG,
+			"wrong number of cmd/patch/io_configs info: %u %u %u",
+			packet->num_cmd_buf, packet->num_patches, packet->num_io_configs);
+		return -EINVAL;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *)&packet->payload +
+		(packet->cmd_buf_offset / 4));
+	CAM_DBG(CAM_JPEG, "packet = %pK cmd_desc = %pK size = %lu",
+		(void *)packet, (void *)cmd_desc,
+		sizeof(struct cam_cmd_buf_desc));
+
+	rc = cam_packet_util_process_patches(packet, hw_mgr->iommu_hdl, -1);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Patch processing failed %d", rc);
+		return rc;
+	}
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload_flex +
+		packet->io_configs_offset / 4);
+	CAM_DBG(CAM_JPEG, "packet = %pK io_cfg_ptr = %pK size = %lu",
+		(void *)packet, (void *)io_cfg_ptr,
+		sizeof(struct cam_buf_io_cfg));
+	prepare_args->pf_data->packet = packet;
+
+	prepare_args->num_out_map_entries = 0;
+
+	for (i = 0, j = 0, k = 0; i < packet->num_io_configs; i++) {
+		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) {
+			prepare_args->in_map_entries[j].resource_handle =
+				io_cfg_ptr[i].resource_type;
+			prepare_args->in_map_entries[j++].sync_id =
+				io_cfg_ptr[i].fence;
+			prepare_args->num_in_map_entries++;
+		} else {
+			prepare_args->in_map_entries[k].resource_handle =
+				io_cfg_ptr[i].resource_type;
+			prepare_args->out_map_entries[k++].sync_id =
+				io_cfg_ptr[i].fence;
+			prepare_args->num_out_map_entries++;
+		}
+		CAM_DBG(CAM_JPEG, "dir[%d]: %u, fence: %u",
+			i, io_cfg_ptr[i].direction, io_cfg_ptr[i].fence);
+	}
+
+	CAM_DBG(CAM_JPEG, "received num cmd buf %d", packet->num_cmd_buf);
+
+	j = prepare_args->num_hw_update_entries;
+	rc = cam_packet_util_get_kmd_buffer(packet, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "get kmd buf failed %d", rc);
+		return rc;
+	}
+	/* fill kmd buf info into 1st hw update entry */
+	prepare_args->hw_update_entries[j].len =
+		(uint32_t)kmd_buf.used_bytes;
+	prepare_args->hw_update_entries[j].handle =
+		(uint32_t)kmd_buf.handle;
+	prepare_args->hw_update_entries[j].offset =
+		(uint32_t)kmd_buf.offset;
+	j++;
+
+	for (i = 0; i < packet->num_cmd_buf;  i++, j++) {
+		prepare_args->hw_update_entries[j].len =
+			(uint32_t)cmd_desc[i].length;
+		prepare_args->hw_update_entries[j].handle =
+			(uint32_t)cmd_desc[i].mem_handle;
+		prepare_args->hw_update_entries[j].offset =
+			(uint32_t)cmd_desc[i].offset;
+	}
+	prepare_args->num_hw_update_entries = j;
+	prepare_args->priv = (void *)(uintptr_t)packet->header.request_id;
+
+	CAM_DBG(CAM_JPEG, "will wait on input sync sync_id %d",
+		prepare_args->in_map_entries[0].sync_id);
+
+	return rc;
+}
+
+static void cam_jpeg_mgr_stop_deinit_dev(struct cam_jpeg_hw_mgr *hw_mgr,
+	struct cam_jpeg_hw_cfg_req *p_cfg_req, uint32_t dev_type)
+{
+	int rc = 0;
+	struct cam_jpeg_set_irq_cb irq_cb;
+
+	/* stop reset Unregister CB and deinit */
+	irq_cb.jpeg_hw_mgr_cb = cam_jpeg_hw_mgr_cb;
+	irq_cb.data = NULL;
+	irq_cb.b_set_cb = false;
+	if (hw_mgr->devices[dev_type][0]->hw_ops.process_cmd) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			CAM_JPEG_CMD_SET_IRQ_CB,
+			&irq_cb, sizeof(irq_cb));
+		if (rc)
+			CAM_ERR(CAM_JPEG, "SET_IRQ_CB fail %d", rc);
+	} else {
+		CAM_ERR(CAM_JPEG, "process_cmd null %d", dev_type);
+	}
+
+	if (hw_mgr->devices[dev_type][0]->hw_ops.stop) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.stop(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "stop fail %d", rc);
+	} else {
+		CAM_ERR(CAM_JPEG, "op stop null %d", dev_type);
+	}
+
+	if (hw_mgr->devices[dev_type][0]->hw_ops.reset) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.reset(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "jpeg hw reset failed %d:%d",
+				dev_type, rc);
+	} else {
+		CAM_ERR(CAM_JPEG, "op hw reset null %d", dev_type);
+	}
+
+	if (hw_mgr->devices[dev_type][0]->hw_ops.deinit) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.deinit(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_JPEG, "Failed to Deinit %d HW %d",
+				dev_type, rc);
+	} else {
+		CAM_ERR(CAM_JPEG, "op deinit null %d", dev_type);
+	}
+
+	hw_mgr->device_in_use[dev_type][0] = false;
+	hw_mgr->dev_hw_cfg_args[dev_type][0] = NULL;
+}
+
+static int cam_jpeg_mgr_flush(void *hw_mgr_priv,
+	struct cam_jpeg_hw_ctx_data *ctx_data)
+{
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	uint32_t dev_type;
+	struct cam_jpeg_hw_cfg_req *p_cfg_req = NULL;
+	struct cam_jpeg_hw_cfg_req *cfg_req = NULL, *req_temp = NULL;
+
+	CAM_DBG(CAM_JPEG, "E: JPEG flush ctx");
+
+	if (!hw_mgr || !ctx_data) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	p_cfg_req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+	if (hw_mgr->device_in_use[dev_type][0] == true &&
+		p_cfg_req != NULL) {
+		if ((struct cam_jpeg_hw_ctx_data *)
+			p_cfg_req->hw_cfg_args.ctxt_to_hw_map == ctx_data) {
+			cam_jpeg_mgr_stop_deinit_dev(hw_mgr, p_cfg_req,
+				dev_type);
+			list_del_init(&p_cfg_req->list);
+			list_add_tail(&p_cfg_req->list,
+				&hw_mgr->free_req_list);
+		}
+	}
+
+	list_for_each_entry_safe(cfg_req, req_temp,
+		&hw_mgr->hw_config_req_list, list) {
+		if ((struct cam_jpeg_hw_ctx_data *)
+			cfg_req->hw_cfg_args.ctxt_to_hw_map != ctx_data)
+			continue;
+
+		list_del_init(&cfg_req->list);
+		list_add_tail(&cfg_req->list, &hw_mgr->free_req_list);
+	}
+
+	CAM_DBG(CAM_JPEG, "X: JPEG flush ctx");
+
+	return 0;
+}
+
+static int cam_jpeg_mgr_flush_req(void *hw_mgr_priv,
+	struct cam_jpeg_hw_ctx_data *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_cfg_req *cfg_req = NULL;
+	struct cam_jpeg_hw_cfg_req *req_temp = NULL;
+	long request_id = 0;
+	uint32_t dev_type;
+	struct cam_jpeg_hw_cfg_req *p_cfg_req = NULL;
+	bool b_req_found = false;
+
+	CAM_DBG(CAM_JPEG, "E: JPEG flush req");
+
+	if (!hw_mgr || !ctx_data || !flush_args) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	if (flush_args->num_req_pending)
+		return 0;
+
+	request_id = (uintptr_t)flush_args->flush_req_active[0];
+
+	if (!flush_args->num_req_active)
+		return 0;
+
+	if (request_id <= 0) {
+		CAM_ERR(CAM_JPEG, "Invalid red id %ld", request_id);
+		return -EINVAL;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	p_cfg_req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+	if (hw_mgr->device_in_use[dev_type][0] == true &&
+		p_cfg_req != NULL) {
+		if (((struct cam_jpeg_hw_ctx_data *)
+			p_cfg_req->hw_cfg_args.ctxt_to_hw_map == ctx_data) &&
+			(p_cfg_req->req_id == request_id)) {
+			cam_jpeg_mgr_stop_deinit_dev(hw_mgr, p_cfg_req,
+				dev_type);
+			list_del_init(&p_cfg_req->list);
+			list_add_tail(&p_cfg_req->list,
+				&hw_mgr->free_req_list);
+			b_req_found = true;
+		}
+	}
+
+	list_for_each_entry_safe(cfg_req, req_temp,
+		&hw_mgr->hw_config_req_list, list) {
+		if ((struct cam_jpeg_hw_ctx_data *)
+			cfg_req->hw_cfg_args.ctxt_to_hw_map != ctx_data)
+			continue;
+
+		if (cfg_req->req_id != request_id)
+			continue;
+
+		list_del_init(&cfg_req->list);
+		list_add_tail(&cfg_req->list, &hw_mgr->free_req_list);
+		b_req_found = true;
+		break;
+	}
+
+	if (!b_req_found) {
+		CAM_ERR(CAM_JPEG, "req not found %ld", request_id);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_JPEG, "X: JPEG flush req");
+	return 0;
+}
+
+static int cam_jpeg_mgr_hw_flush(void *hw_mgr_priv, void *flush_hw_args)
+{
+	int rc = 0;
+	struct cam_hw_flush_args *flush_args = flush_hw_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+
+	if (!hw_mgr || !flush_args || !flush_args->ctxt_to_hw_map) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)flush_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	if ((flush_args->flush_type >= CAM_FLUSH_TYPE_MAX) ||
+		(flush_args->flush_type < CAM_FLUSH_TYPE_REQ)) {
+		CAM_ERR(CAM_JPEG, "Invalid flush type: %d",
+			flush_args->flush_type);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_ALL:
+		rc = cam_jpeg_mgr_flush(hw_mgr_priv, ctx_data);
+		if ((rc))
+			CAM_ERR(CAM_JPEG, "Flush failed %d", rc);
+		break;
+	case CAM_FLUSH_TYPE_REQ:
+		rc = cam_jpeg_mgr_flush_req(hw_mgr_priv, ctx_data, flush_args);
+		break;
+	default:
+		CAM_ERR(CAM_JPEG, "Invalid flush type: %d",
+			flush_args->flush_type);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_hw_stop(void *hw_mgr_priv, void *stop_hw_args)
+{
+	int rc;
+	struct cam_hw_stop_args *stop_args =
+		(struct cam_hw_stop_args *)stop_hw_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+
+	if (!hw_mgr || !stop_args || !stop_args->ctxt_to_hw_map) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)stop_args->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	rc = cam_jpeg_mgr_flush(hw_mgr_priv, ctx_data);
+	if ((rc))
+		CAM_ERR(CAM_JPEG, "flush failed %d", rc);
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_release_hw(void *hw_mgr_priv, void *release_hw_args)
+{
+	int rc;
+	struct cam_hw_release_args *release_hw = release_hw_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	uint32_t dev_type;
+
+	if (!hw_mgr || !release_hw || !release_hw->ctxt_to_hw_map) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)release_hw->ctxt_to_hw_map;
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (hw_mgr->cdm_info[dev_type][0].ref_cnt == 0) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_JPEG, "Error Unbalanced deinit");
+		return -EFAULT;
+	}
+
+	hw_mgr->cdm_info[dev_type][0].ref_cnt--;
+	if (!(hw_mgr->cdm_info[dev_type][0].ref_cnt)) {
+		if (cam_cdm_stream_off(
+			hw_mgr->cdm_info[dev_type][0].cdm_handle)) {
+			CAM_ERR(CAM_JPEG, "CDM stream off failed %d",
+				hw_mgr->cdm_info[dev_type][0].cdm_handle);
+		}
+		/* release cdm handle */
+		cam_cdm_release(hw_mgr->cdm_info[dev_type][0].cdm_handle);
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	rc = cam_jpeg_mgr_release_ctx(hw_mgr, ctx_data);
+	if (rc) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_JPEG, "JPEG release ctx failed");
+		kfree(ctx_data->cdm_cmd);
+		ctx_data->cdm_cmd = NULL;
+
+		return -EINVAL;
+	}
+
+	kfree(ctx_data->cdm_cmd);
+	ctx_data->cdm_cmd = NULL;
+	CAM_DBG(CAM_JPEG, "handle %llu", ctx_data);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
+{
+	int rc = 0;
+	int32_t ctx_id = 0;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_jpeg_hw_ctx_data *ctx_data = NULL;
+	struct cam_hw_acquire_args *args = acquire_hw_args;
+	struct cam_jpeg_acquire_dev_info jpeg_dev_acquire_info;
+	struct cam_cdm_acquire_data cdm_acquire;
+	uint32_t dev_type;
+	uint32_t size = 0;
+
+	if ((!hw_mgr_priv) || (!acquire_hw_args)) {
+		CAM_ERR(CAM_JPEG, "Invalid params: %pK %pK", hw_mgr_priv,
+			acquire_hw_args);
+		return -EINVAL;
+	}
+
+	if (args->num_acq > 1) {
+		CAM_ERR(CAM_JPEG,
+			"number of resources are wrong: %u",
+			args->num_acq);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&jpeg_dev_acquire_info,
+			(void __user *)args->acquire_info,
+			sizeof(jpeg_dev_acquire_info))) {
+		CAM_ERR(CAM_JPEG, "copy failed");
+		return -EFAULT;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	ctx_id = cam_jpeg_mgr_get_free_ctx(hw_mgr);
+	if (ctx_id >= CAM_JPEG_CTX_MAX) {
+		CAM_ERR(CAM_JPEG, "No free ctx space in hw_mgr");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EFAULT;
+	}
+
+	ctx_data = &hw_mgr->ctx_data[ctx_id];
+
+	ctx_data->cdm_cmd =
+		kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+			((CAM_JPEG_HW_ENTRIES_MAX - 1) *
+			sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+	if (!ctx_data->cdm_cmd) {
+		rc = -ENOMEM;
+		goto jpeg_release_ctx;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	ctx_data->jpeg_dev_acquire_info = jpeg_dev_acquire_info;
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	if (ctx_data->jpeg_dev_acquire_info.dev_type >=
+		CAM_JPEG_RES_TYPE_MAX) {
+		rc = -EINVAL;
+		goto acq_cdm_hdl_failed;
+	}
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+	if (!hw_mgr->cdm_info[dev_type][0].ref_cnt) {
+
+		if (dev_type == CAM_JPEG_RES_TYPE_ENC) {
+			memcpy(cdm_acquire.identifier,
+				"jpegenc", sizeof("jpegenc"));
+		} else {
+			memcpy(cdm_acquire.identifier,
+				"jpegdma", sizeof("jpegdma"));
+		}
+		cdm_acquire.cell_index = 0;
+		cdm_acquire.handle = 0;
+		cdm_acquire.userdata = ctx_data;
+		if (hw_mgr->cdm_reg_map[dev_type][0]) {
+			cdm_acquire.base_array[0] =
+				hw_mgr->cdm_reg_map[dev_type][0];
+		}
+		cdm_acquire.base_array_cnt = 1;
+		cdm_acquire.id = CAM_CDM_VIRTUAL;
+		cdm_acquire.cam_cdm_callback = NULL;
+		cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+
+		rc = cam_cdm_acquire(&cdm_acquire);
+		if (rc) {
+			CAM_ERR(CAM_JPEG, "Failed to acquire the CDM HW %d",
+				rc);
+			rc = -EFAULT;
+			goto acq_cdm_hdl_failed;
+		}
+		hw_mgr->cdm_info[dev_type][0].cdm_handle = cdm_acquire.handle;
+		hw_mgr->cdm_info[dev_type][0].cdm_ops = cdm_acquire.ops;
+		hw_mgr->cdm_info[dev_type][0].ref_cnt++;
+	} else {
+		hw_mgr->cdm_info[dev_type][0].ref_cnt++;
+	}
+
+	size =
+	hw_mgr->cdm_info[dev_type][0].cdm_ops->cdm_required_size_changebase();
+
+	if (hw_mgr->cdm_info[dev_type][0].ref_cnt == 1)
+		if (cam_cdm_stream_on(
+			hw_mgr->cdm_info[dev_type][0].cdm_handle)) {
+			CAM_ERR(CAM_JPEG, "Can not start cdm (%d)!",
+				hw_mgr->cdm_info[dev_type][0].cdm_handle);
+			rc = -EFAULT;
+			goto start_cdm_hdl_failed;
+		}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	ctx_data->context_priv = args->context_data;
+
+	args->ctxt_to_hw_map = (void *)&(hw_mgr->ctx_data[ctx_id]);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	hw_mgr->ctx_data[ctx_id].ctxt_event_cb = args->event_cb;
+
+
+	if (copy_to_user((void __user *)args->acquire_info,
+		&jpeg_dev_acquire_info,
+		sizeof(jpeg_dev_acquire_info))) {
+		rc = -EFAULT;
+		goto copy_to_user_failed;
+	}
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_JPEG, "success ctx_data= %pK", ctx_data);
+
+	return rc;
+
+copy_to_user_failed:
+	if (hw_mgr->cdm_info[dev_type][0].ref_cnt == 1)
+		cam_cdm_stream_off(hw_mgr->cdm_info[dev_type][0].cdm_handle);
+start_cdm_hdl_failed:
+	if (hw_mgr->cdm_info[dev_type][0].ref_cnt == 1)
+		cam_cdm_release(hw_mgr->cdm_info[dev_type][0].cdm_handle);
+	hw_mgr->cdm_info[dev_type][0].ref_cnt--;
+acq_cdm_hdl_failed:
+	kfree(ctx_data->cdm_cmd);
+jpeg_release_ctx:
+	cam_jpeg_mgr_release_ctx(hw_mgr, ctx_data);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_get_hw_caps(void *hw_mgr_priv, void *hw_caps_args)
+{
+	int rc;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd *query_cap = hw_caps_args;
+
+	if (!hw_mgr_priv || !hw_caps_args) {
+		CAM_ERR(CAM_JPEG, "Invalid params: %pK %pK",
+			hw_mgr_priv, hw_caps_args);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	if (copy_to_user(u64_to_user_ptr(query_cap->caps_handle),
+		&g_jpeg_hw_mgr.jpeg_caps,
+		sizeof(struct cam_jpeg_query_cap_cmd))) {
+		CAM_ERR(CAM_JPEG, "copy_to_user failed");
+		rc = -EFAULT;
+		goto copy_error;
+	}
+	CAM_DBG(CAM_JPEG, "Success");
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return 0;
+
+copy_error:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_jpeg_command_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_workq_jpeg_message_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int cam_jpeg_setup_workqs(void)
+{
+	int rc, i;
+
+	rc = cam_req_mgr_workq_create(
+		"jpeg_command_queue",
+		CAM_JPEG_WORKQ_NUM_TASK,
+		&g_jpeg_hw_mgr.work_process_frame,
+		CRM_WORKQ_USAGE_NON_IRQ, 0,
+		cam_req_mgr_process_workq_jpeg_command_queue);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "unable to create a worker %d", rc);
+		goto work_process_frame_failed;
+	}
+
+	rc = cam_req_mgr_workq_create(
+		"jpeg_message_queue",
+		CAM_JPEG_WORKQ_NUM_TASK,
+		&g_jpeg_hw_mgr.work_process_irq_cb,
+		CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_jpeg_message_queue);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "unable to create a worker %d", rc);
+		goto work_process_irq_cb_failed;
+	}
+
+	g_jpeg_hw_mgr.process_frame_work_data =
+		kzalloc(sizeof(struct cam_jpeg_process_frame_work_data_t) *
+			CAM_JPEG_WORKQ_NUM_TASK, GFP_KERNEL);
+	if (!g_jpeg_hw_mgr.process_frame_work_data) {
+		rc = -ENOMEM;
+		goto work_process_frame_data_failed;
+	}
+
+	g_jpeg_hw_mgr.process_irq_cb_work_data =
+		kzalloc(sizeof(struct cam_jpeg_process_irq_work_data_t) *
+			CAM_JPEG_WORKQ_NUM_TASK, GFP_KERNEL);
+	if (!g_jpeg_hw_mgr.process_irq_cb_work_data) {
+		rc = -ENOMEM;
+		goto work_process_irq_cb_data_failed;
+	}
+
+	for (i = 0; i < CAM_JPEG_WORKQ_NUM_TASK; i++)
+		g_jpeg_hw_mgr.work_process_irq_cb->task.pool[i].payload =
+			&g_jpeg_hw_mgr.process_irq_cb_work_data[i];
+
+	for (i = 0; i < CAM_JPEG_WORKQ_NUM_TASK; i++)
+		g_jpeg_hw_mgr.work_process_frame->task.pool[i].payload =
+			&g_jpeg_hw_mgr.process_frame_work_data[i];
+
+	INIT_LIST_HEAD(&g_jpeg_hw_mgr.hw_config_req_list);
+	INIT_LIST_HEAD(&g_jpeg_hw_mgr.free_req_list);
+	for (i = 0; i < CAM_JPEG_HW_CFG_Q_MAX; i++) {
+		INIT_LIST_HEAD(&(g_jpeg_hw_mgr.req_list[i].list));
+		list_add_tail(&(g_jpeg_hw_mgr.req_list[i].list),
+			&(g_jpeg_hw_mgr.free_req_list));
+	}
+
+	return rc;
+
+work_process_irq_cb_data_failed:
+	kfree(g_jpeg_hw_mgr.process_frame_work_data);
+work_process_frame_data_failed:
+	cam_req_mgr_workq_destroy(&g_jpeg_hw_mgr.work_process_irq_cb);
+work_process_irq_cb_failed:
+	cam_req_mgr_workq_destroy(&g_jpeg_hw_mgr.work_process_frame);
+work_process_frame_failed:
+
+	return rc;
+}
+
+static int cam_jpeg_init_devices(struct device_node *of_node,
+	uint32_t *p_num_enc_dev,
+	uint32_t *p_num_dma_dev)
+{
+	int count, i, rc;
+	uint32_t num_dev;
+	uint32_t num_dma_dev;
+	const char *name = NULL;
+	struct device_node *child_node = NULL;
+	struct platform_device *child_pdev = NULL;
+	struct cam_hw_intf *child_dev_intf = NULL;
+	struct cam_hw_info *enc_hw = NULL;
+	struct cam_hw_info *dma_hw = NULL;
+	struct cam_hw_soc_info *enc_soc_info = NULL;
+	struct cam_hw_soc_info *dma_soc_info = NULL;
+
+	if (!p_num_enc_dev || !p_num_dma_dev) {
+		rc = -EINVAL;
+		goto num_dev_failed;
+	}
+	count = of_property_count_strings(of_node, "compat-hw-name");
+	if (!count) {
+		CAM_ERR(CAM_JPEG,
+			"no compat hw found in dev tree, count = %d",
+			count);
+		rc = -EINVAL;
+		goto num_dev_failed;
+	}
+
+	rc = of_property_read_u32(of_node, "num-jpeg-enc", &num_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "read num enc devices failed %d", rc);
+		goto num_enc_failed;
+	}
+	g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC] = kzalloc(
+		sizeof(struct cam_hw_intf *) * num_dev, GFP_KERNEL);
+	if (!g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC]) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_JPEG, "getting number of dma dev nodes failed");
+		goto num_enc_failed;
+	}
+
+	rc = of_property_read_u32(of_node, "num-jpeg-dma", &num_dma_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "get num dma dev nodes failed %d", rc);
+		goto num_dma_failed;
+	}
+
+	g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA] = kzalloc(
+		sizeof(struct cam_hw_intf *) * num_dma_dev, GFP_KERNEL);
+	if (!g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA]) {
+		rc = -ENOMEM;
+		goto num_dma_failed;
+	}
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node, "compat-hw-name",
+			i, &name);
+		if (rc) {
+			CAM_ERR(CAM_JPEG, "getting dev object name failed");
+			goto compat_hw_name_failed;
+		}
+
+		child_node = of_find_node_by_name(NULL, name);
+		if (!child_node) {
+			CAM_ERR(CAM_JPEG,
+				"error! Cannot find node in dtsi %s", name);
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+
+		child_pdev = of_find_device_by_node(child_node);
+		if (!child_pdev) {
+			CAM_ERR(CAM_JPEG, "failed to find device on bus %s",
+				child_node->name);
+			rc = -ENODEV;
+			of_node_put(child_node);
+			goto compat_hw_name_failed;
+		}
+
+		child_dev_intf = (struct cam_hw_intf *)platform_get_drvdata(
+			child_pdev);
+		if (!child_dev_intf) {
+			CAM_ERR(CAM_JPEG, "no child device");
+			of_node_put(child_node);
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+		CAM_DBG(CAM_JPEG, "child_intf %pK type %d id %d",
+			child_dev_intf,
+			child_dev_intf->hw_type,
+			child_dev_intf->hw_idx);
+
+		if ((child_dev_intf->hw_type == CAM_JPEG_DEV_ENC &&
+			child_dev_intf->hw_idx >= num_dev) ||
+			(child_dev_intf->hw_type == CAM_JPEG_DEV_DMA &&
+			child_dev_intf->hw_idx >= num_dma_dev)) {
+			CAM_ERR(CAM_JPEG, "index out of range");
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+		g_jpeg_hw_mgr.devices[child_dev_intf->hw_type]
+			[child_dev_intf->hw_idx] = child_dev_intf;
+
+		of_node_put(child_node);
+	}
+
+	enc_hw = (struct cam_hw_info *)
+		g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC][0]->hw_priv;
+	enc_soc_info = &enc_hw->soc_info;
+	g_jpeg_hw_mgr.cdm_reg_map[CAM_JPEG_DEV_ENC][0] =
+		&enc_soc_info->reg_map[0];
+	dma_hw = (struct cam_hw_info *)
+		g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA][0]->hw_priv;
+	dma_soc_info = &dma_hw->soc_info;
+	g_jpeg_hw_mgr.cdm_reg_map[CAM_JPEG_DEV_DMA][0] =
+		&dma_soc_info->reg_map[0];
+
+	rc = g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC][0]->hw_ops.process_cmd(
+		g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC][0]->hw_priv,
+		CAM_JPEG_CMD_GET_NUM_PID,
+		&g_jpeg_hw_mgr.num_pid[CAM_JPEG_DEV_ENC],
+		sizeof(uint32_t));
+
+	rc = g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA][0]->hw_ops.process_cmd(
+		g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA][0]->hw_priv,
+		CAM_JPEG_CMD_GET_NUM_PID,
+		&g_jpeg_hw_mgr.num_pid[CAM_JPEG_DEV_DMA],
+		sizeof(uint32_t));
+
+	*p_num_enc_dev = num_dev;
+	*p_num_dma_dev = num_dma_dev;
+
+	return rc;
+
+compat_hw_name_failed:
+	kfree(g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_DMA]);
+num_dma_failed:
+	kfree(g_jpeg_hw_mgr.devices[CAM_JPEG_DEV_ENC]);
+num_enc_failed:
+num_dev_failed:
+
+	return rc;
+}
+
+static int cam_jpeg_mgr_hw_dump(void *hw_mgr_priv, void *dump_hw_args)
+{
+	int                             rc;
+	uint8_t                        *dst;
+	ktime_t                         cur_time;
+	size_t                          remain_len;
+	uint32_t                        min_len;
+	uint32_t                        dev_type;
+	uint64_t                        diff;
+	uint64_t                       *addr, *start;
+	struct timespec64               cur_ts;
+	struct timespec64               req_ts;
+	struct cam_jpeg_hw_mgr         *hw_mgr;
+	struct cam_hw_dump_args        *dump_args;
+	struct cam_jpeg_hw_cfg_req     *p_cfg_req;
+	struct cam_jpeg_hw_ctx_data    *ctx_data;
+	struct cam_jpeg_hw_dump_args    jpeg_dump_args;
+	struct cam_jpeg_hw_dump_header *hdr;
+
+	if (!hw_mgr_priv || !dump_hw_args) {
+		CAM_ERR(CAM_JPEG, "Invalid args %pK %pK",
+			hw_mgr_priv, dump_hw_args);
+		return -EINVAL;
+	}
+
+	hw_mgr = hw_mgr_priv;
+	dump_args = (struct cam_hw_dump_args *)dump_hw_args;
+	ctx_data = (struct cam_jpeg_hw_ctx_data *)dump_args->ctxt_to_hw_map;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_JPEG, "Invalid context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	if (!ctx_data->in_use) {
+		CAM_ERR(CAM_JPEG, "ctx is not in use");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	if (true == hw_mgr->device_in_use[dev_type][0]) {
+		p_cfg_req = hw_mgr->dev_hw_cfg_args[dev_type][0];
+		if (p_cfg_req  && p_cfg_req->req_id ==
+			    (uintptr_t)dump_args->request_id)
+			goto hw_dump;
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return 0;
+
+hw_dump:
+	cur_time = ktime_get();
+	diff = ktime_us_delta(p_cfg_req->submit_timestamp, cur_time);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(p_cfg_req->submit_timestamp);
+
+	if (diff < CAM_JPEG_RESPONSE_TIME_THRESHOLD) {
+		CAM_INFO(CAM_JPEG,
+			"No error req %lld %ld:%06ld %ld:%06ld",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return 0;
+	}
+
+	CAM_INFO(CAM_JPEG,
+		"Error req %lld %ld:%06ld %ld:%06ld",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&jpeg_dump_args.cpu_addr, &jpeg_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -rc;
+	}
+
+	if (jpeg_dump_args.buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_JPEG, "dump offset overshoot len %zu offset %zu",
+			jpeg_dump_args.buf_len, dump_args->offset);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	remain_len = jpeg_dump_args.buf_len - dump_args->offset;
+	min_len = sizeof(struct cam_jpeg_hw_dump_header) +
+			(CAM_JPEG_HW_DUMP_NUM_WORDS * sizeof(uint64_t));
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_JPEG, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)jpeg_dump_args.cpu_addr + dump_args->offset;
+	hdr = (struct cam_jpeg_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_JPEG_HW_DUMP_TAG_MAX_LEN,
+		"JPEG_REQ:");
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_jpeg_hw_dump_header));
+	start = addr;
+	*addr++ = dump_args->request_id;
+	*addr++ = req_ts.tv_sec;
+	*addr++ = req_ts.tv_nsec/NSEC_PER_USEC;
+	*addr++ = cur_ts.tv_sec;
+	*addr++ = cur_ts.tv_nsec/NSEC_PER_USEC;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_jpeg_hw_dump_header);
+	jpeg_dump_args.request_id = dump_args->request_id;
+	jpeg_dump_args.offset = dump_args->offset;
+
+	if (hw_mgr->devices[dev_type][0]->hw_ops.process_cmd) {
+		rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+			hw_mgr->devices[dev_type][0]->hw_priv,
+			CAM_JPEG_CMD_HW_DUMP,
+			&jpeg_dump_args, sizeof(jpeg_dump_args));
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	CAM_DBG(CAM_JPEG, "Offset before %u after %u",
+		dump_args->offset, jpeg_dump_args.offset);
+	dump_args->offset = jpeg_dump_args.offset;
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static void cam_jpeg_mgr_dump_pf_data(
+	struct cam_jpeg_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args  *hw_cmd_args)
+{
+	struct cam_jpeg_hw_ctx_data    *ctx_data;
+	struct cam_packet              *packet;
+	struct cam_jpeg_match_pid_args  jpeg_pid_mid_args;
+	struct cam_buf_io_cfg          *io_cfg = NULL;
+	uint32_t                        dev_type;
+	dma_addr_t   iova_addr;
+	size_t       src_buf_size;
+	int          i, j;
+	int32_t    mmu_hdl;
+	bool      hw_pid_support = true;
+	int rc = 0;
+
+	ctx_data = (struct cam_jpeg_hw_ctx_data  *)hw_cmd_args->ctxt_to_hw_map;
+	packet  = hw_cmd_args->u.pf_args.pf_data.packet;
+
+	jpeg_pid_mid_args.fault_mid = hw_cmd_args->u.pf_args.mid;
+	jpeg_pid_mid_args.pid = hw_cmd_args->u.pf_args.pid;
+	dev_type = ctx_data->jpeg_dev_acquire_info.dev_type;
+
+	if (!hw_mgr->num_pid[dev_type]) {
+		hw_pid_support = false;
+		goto iodump;
+	}
+
+	rc = hw_mgr->devices[dev_type][0]->hw_ops.process_cmd(
+		hw_mgr->devices[dev_type][0]->hw_priv,
+		CAM_JPEG_CMD_MATCH_PID_MID,
+		&jpeg_pid_mid_args, sizeof(jpeg_pid_mid_args));
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "CAM_JPEG_CMD_MATCH_PID_MID failed %d", rc);
+		return;
+	}
+
+	if (!jpeg_pid_mid_args.pid_match_found) {
+		CAM_INFO(CAM_JPEG, "This context data is not matched with pf pid and mid");
+		return;
+	}
+
+iodump:
+	io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload +
+		packet->io_configs_offset / 4);
+
+	for (i = 0; i < packet->num_io_configs; i++) {
+		if (hw_pid_support) {
+			if (io_cfg[i].resource_type !=
+				jpeg_pid_mid_args.match_res)
+				continue;
+
+			if (i == packet->num_io_configs) {
+				CAM_ERR(CAM_JPEG,
+					"getting io port for mid resource id failed  req id:%lld res id:0x%x",
+					packet->header.request_id,
+					jpeg_pid_mid_args.match_res);
+				return;
+			}
+		}
+
+		for (j = 0; j < CAM_PACKET_MAX_PLANES; j++) {
+			if (!io_cfg[i].mem_handle[j])
+				break;
+
+			CAM_INFO(CAM_JPEG, "port: %d f: %u format: %d dir %d",
+				io_cfg[i].resource_type,
+				io_cfg[i].fence,
+				io_cfg[i].format,
+				io_cfg[i].direction);
+
+			mmu_hdl = cam_mem_is_secure_buf(
+				io_cfg[i].mem_handle[j]) ? hw_mgr->iommu_sec_hdl :
+				hw_mgr->iommu_hdl;
+			rc = cam_mem_get_io_buf(io_cfg[i].mem_handle[j],
+				mmu_hdl, &iova_addr, &src_buf_size);
+			if (rc < 0) {
+				CAM_ERR(CAM_UTIL, "get src buf address fail");
+				continue;
+			}
+			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {
+				CAM_ERR(CAM_JPEG, "Invalid mapped address");
+				rc = -EINVAL;
+				continue;
+			}
+
+			CAM_INFO(CAM_JPEG,
+				"pln %u w %u h %u stride %u slice %u size %d addr 0x%x offset 0x%x memh %x",
+				j, io_cfg[i].planes[j].width,
+				io_cfg[i].planes[j].height,
+				io_cfg[i].planes[j].plane_stride,
+				io_cfg[i].planes[j].slice_height,
+				(int32_t)src_buf_size,
+				(unsigned int)iova_addr,
+				io_cfg[i].offsets[j],
+				io_cfg[i].mem_handle[j]);
+		}
+
+		if (hw_pid_support)
+			return;
+	}
+}
+
+static int cam_jpeg_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_jpeg_hw_mgr *hw_mgr = hw_mgr_priv;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_jpeg_mgr_dump_pf_data(hw_mgr, hw_cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_JPEG, "Invalid cmd :%d",
+			hw_cmd_args->cmd_type);
+	}
+
+	return rc;
+}
+
+static int cam_jpeg_set_camnoc_misr_test(void *data, u64 val)
+{
+	g_jpeg_hw_mgr.camnoc_misr_test = val;
+	return 0;
+}
+
+static int cam_jpeg_get_camnoc_misr_test(void *data, u64 *val)
+{
+	*val = g_jpeg_hw_mgr.camnoc_misr_test;
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(camnoc_misr_test, cam_jpeg_get_camnoc_misr_test,
+	cam_jpeg_set_camnoc_misr_test, "%08llu");
+
+static int cam_jpeg_set_bug_on_misr(void *data, u64 val)
+{
+	g_jpeg_hw_mgr.bug_on_misr = val;
+	return 0;
+}
+
+static int cam_jpeg_get_bug_on_misr(void *data, u64 *val)
+{
+	*val = g_jpeg_hw_mgr.bug_on_misr;
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(bug_on_misr_mismatch, cam_jpeg_get_bug_on_misr,
+	cam_jpeg_set_bug_on_misr, "%08llu");
+
+static int cam_jpeg_mgr_create_debugfs_entry(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_jpeg", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_JPEG, "DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto err;
+	}
+	/* Store parent inode for cleanup in caller */
+	g_jpeg_hw_mgr.dentry = dbgfileptr;
+
+	debugfs_create_file("camnoc_misr_test", 0644,
+		g_jpeg_hw_mgr.dentry, NULL, &camnoc_misr_test);
+
+	debugfs_create_file("bug_on_misr_mismatch", 0644,
+		g_jpeg_hw_mgr.dentry, NULL, &bug_on_misr_mismatch);
+
+err:
+	return rc;
+}
+
+int cam_jpeg_hw_mgr_init(struct device_node *of_node, uint64_t *hw_mgr_hdl,
+	int *iommu_hdl)
+{
+	int i, rc;
+	uint32_t num_dev;
+	uint32_t num_dma_dev;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	struct cam_iommu_handle cdm_handles;
+
+	hw_mgr_intf = (struct cam_hw_mgr_intf *)hw_mgr_hdl;
+	if (!of_node || !hw_mgr_intf) {
+		CAM_ERR(CAM_JPEG, "Invalid args of_node %pK hw_mgr %pK",
+			of_node, hw_mgr_intf);
+		return -EINVAL;
+	}
+
+	memset(hw_mgr_hdl, 0x0, sizeof(struct cam_hw_mgr_intf));
+	hw_mgr_intf->hw_mgr_priv = &g_jpeg_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_jpeg_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire = cam_jpeg_mgr_acquire_hw;
+	hw_mgr_intf->hw_release = cam_jpeg_mgr_release_hw;
+	hw_mgr_intf->hw_prepare_update = cam_jpeg_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config = cam_jpeg_mgr_config_hw;
+	hw_mgr_intf->hw_flush = cam_jpeg_mgr_hw_flush;
+	hw_mgr_intf->hw_stop = cam_jpeg_mgr_hw_stop;
+	hw_mgr_intf->hw_cmd = cam_jpeg_mgr_cmd;
+	hw_mgr_intf->hw_dump = cam_jpeg_mgr_hw_dump;
+
+	mutex_init(&g_jpeg_hw_mgr.hw_mgr_mutex);
+	spin_lock_init(&g_jpeg_hw_mgr.hw_mgr_lock);
+
+	for (i = 0; i < CAM_JPEG_CTX_MAX; i++)
+		mutex_init(&g_jpeg_hw_mgr.ctx_data[i].ctx_mutex);
+
+	rc = cam_jpeg_init_devices(of_node, &num_dev, &num_dma_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "jpeg init devices %d", rc);
+		goto smmu_get_failed;
+	}
+
+	rc = cam_smmu_get_handle("jpeg", &g_jpeg_hw_mgr.iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "jpeg get iommu handle failed %d", rc);
+		goto smmu_get_failed;
+	}
+
+	CAM_DBG(CAM_JPEG, "mmu handle :%d", g_jpeg_hw_mgr.iommu_hdl);
+
+	rc = cam_cdm_get_iommu_handle("jpegenc", &cdm_handles);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "acquire cdm iommu handle Fail  %d", rc);
+		g_jpeg_hw_mgr.cdm_iommu_hdl = -1;
+		g_jpeg_hw_mgr.cdm_iommu_hdl_secure = -1;
+		goto cdm_iommu_failed;
+	}
+	g_jpeg_hw_mgr.cdm_iommu_hdl = cdm_handles.non_secure;
+	g_jpeg_hw_mgr.cdm_iommu_hdl_secure = cdm_handles.secure;
+
+	g_jpeg_hw_mgr.jpeg_caps.dev_iommu_handle.non_secure =
+		g_jpeg_hw_mgr.iommu_hdl;
+	g_jpeg_hw_mgr.jpeg_caps.dev_iommu_handle.secure =
+		g_jpeg_hw_mgr.iommu_sec_hdl;
+	g_jpeg_hw_mgr.jpeg_caps.cdm_iommu_handle.non_secure =
+		g_jpeg_hw_mgr.cdm_iommu_hdl;
+	g_jpeg_hw_mgr.jpeg_caps.cdm_iommu_handle.secure =
+		g_jpeg_hw_mgr.cdm_iommu_hdl_secure;
+	g_jpeg_hw_mgr.jpeg_caps.num_enc = num_dev;
+	g_jpeg_hw_mgr.jpeg_caps.num_dma = num_dma_dev;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_ENC].hw_ver.major = 4;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_ENC].hw_ver.minor = 2;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_ENC].hw_ver.incr  = 0;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_ENC].hw_ver.reserved = 0;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_DMA].hw_ver.major = 4;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_DMA].hw_ver.minor = 2;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_DMA].hw_ver.incr  = 0;
+	g_jpeg_hw_mgr.jpeg_caps.dev_ver[CAM_JPEG_DEV_DMA].hw_ver.reserved = 0;
+
+	rc = cam_jpeg_setup_workqs();
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "setup work qs failed  %d", rc);
+		goto cdm_iommu_failed;
+	}
+
+	if (iommu_hdl)
+		*iommu_hdl = g_jpeg_hw_mgr.iommu_hdl;
+
+	rc = cam_jpeg_mgr_create_debugfs_entry();
+	if (!rc)
+		return rc;
+
+cdm_iommu_failed:
+	cam_smmu_destroy_handle(g_jpeg_hw_mgr.iommu_hdl);
+	g_jpeg_hw_mgr.iommu_hdl = 0;
+smmu_get_failed:
+	mutex_destroy(&g_jpeg_hw_mgr.hw_mgr_mutex);
+	for (i = 0; i < CAM_JPEG_CTX_MAX; i++)
+		mutex_destroy(&g_jpeg_hw_mgr.ctx_data[i].ctx_mutex);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.h
@@ -0,0 +1,173 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_HW_MGR_H
+#define CAM_JPEG_HW_MGR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_jpeg.h>
+
+#include "cam_jpeg_hw_intf.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+
+#define CAM_JPEG_WORKQ_NUM_TASK      30
+#define CAM_JPEG_WORKQ_TASK_CMD_TYPE 1
+#define CAM_JPEG_WORKQ_TASK_MSG_TYPE 2
+#define CAM_JPEG_HW_CFG_Q_MAX        50
+
+/*
+ * Response time threshold in ms beyond which a request is not expected
+ * to be with JPEG hw
+ */
+#define CAM_JPEG_RESPONSE_TIME_THRESHOLD   100000
+
+/**
+ * struct cam_jpeg_process_frame_work_data_t
+ *
+ * @type: Task type
+ * @data: Pointer to command data
+ * @request_id: Request id
+ */
+struct cam_jpeg_process_frame_work_data_t {
+	uint32_t type;
+	void *data;
+	uintptr_t request_id;
+};
+
+/**
+ * struct cam_jpeg_process_irq_work_data_t
+ *
+ * @type: Task type
+ * @data: Pointer to message data
+ * @result_size: Result size of enc/dma
+ * @irq_status: IRQ status
+ */
+struct cam_jpeg_process_irq_work_data_t {
+	uint32_t type;
+	void *data;
+	int32_t result_size;
+	uint32_t irq_status;
+};
+
+/**
+ * struct cam_jpeg_hw_cdm_info_t
+ *
+ * @ref_cnt: Ref count of how many times device type is acquired
+ * @cdm_handle: Cdm handle
+ * @cdm_ops: Cdm ops struct
+ */
+struct cam_jpeg_hw_cdm_info_t {
+	int ref_cnt;
+	uint32_t cdm_handle;
+	struct cam_cdm_utils_ops *cdm_ops;
+};
+
+/**
+ * struct cam_jpeg_hw_cfg_req_t
+ *
+ * @list_head: List head
+ * @hw_cfg_args: Hw config args
+ * @dev_type: Dev type for cfg request
+ * @req_id: Request Id
+ * @submit_timestamp: Timestamp of submitting request
+ * @num_hw_entry_processed: Cdm payloads already processed
+ */
+struct cam_jpeg_hw_cfg_req {
+	struct list_head list;
+	struct cam_hw_config_args hw_cfg_args;
+	uint32_t dev_type;
+	uintptr_t req_id;
+	ktime_t    submit_timestamp;
+	uint32_t num_hw_entry_processed;
+};
+
+/**
+ * struct cam_jpeg_hw_ctx_data
+ *
+ * @context_priv: Context private data, cam_context from
+ *     acquire.
+ * @ctx_mutex: Mutex for context
+ * @jpeg_dev_acquire_info: Acquire device info
+ * @ctxt_event_cb: Context callback function
+ * @in_use: Flag for context usage
+ * @wait_complete: Completion info
+ * @cdm_cmd: Cdm cmd submitted for that context.
+ */
+struct cam_jpeg_hw_ctx_data {
+	void *context_priv;
+	struct mutex ctx_mutex;
+	struct cam_jpeg_acquire_dev_info jpeg_dev_acquire_info;
+	cam_hw_event_cb_func ctxt_event_cb;
+	bool in_use;
+	struct completion wait_complete;
+	struct cam_cdm_bl_request *cdm_cmd;
+};
+
+/**
+ * struct cam_jpeg_hw_mgr
+ * @hw_mgr_mutex: Mutex for JPEG hardware manager
+ * @hw_mgr_lock: Spinlock for JPEG hardware manager
+ * @ctx_data: Context data
+ * @jpeg_caps: JPEG capabilities
+ * @iommu_hdl: Non secure IOMMU handle
+ * @iommu_sec_hdl: Secure IOMMU handle
+ * @work_process_frame: Work queue for hw config requests
+ * @work_process_irq_cb: Work queue for processing IRQs.
+ * @process_frame_work_data: Work data pool for hw config
+ *     requests
+ * @process_irq_cb_work_data: Work data pool for irq requests
+ * @cdm_iommu_hdl: Iommu handle received from cdm
+ * @cdm_iommu_hdl_secure: Secure iommu handle received from cdm
+ * @dentry: Debugfs entry
+ * @camnoc_misr_test : debugfs entry to select camnoc_misr for read or write path
+ * @bug_on_misr : enable/disable bug on when misr mismatch is seen
+ * @devices: Core hw Devices of JPEG hardware manager
+ * @cdm_info: Cdm info for each core device.
+ * @cdm_reg_map: Regmap of each device for cdm.
+ * @device_in_use: Flag device being used for an active request
+ * @dev_hw_cfg_args: Current cfg request per core dev
+ * @hw_config_req_list: Pending hw update requests list
+ * @free_req_list: Free nodes for above list
+ * @req_list: Nodes of hw update list
+ * @num_pid: num of pids supported in the device
+ */
+struct cam_jpeg_hw_mgr {
+	struct mutex hw_mgr_mutex;
+	spinlock_t hw_mgr_lock;
+	struct cam_jpeg_hw_ctx_data ctx_data[CAM_JPEG_CTX_MAX];
+	struct cam_jpeg_query_cap_cmd jpeg_caps;
+	int32_t iommu_hdl;
+	int32_t iommu_sec_hdl;
+	struct cam_req_mgr_core_workq *work_process_frame;
+	struct cam_req_mgr_core_workq *work_process_irq_cb;
+	struct cam_jpeg_process_frame_work_data_t *process_frame_work_data;
+	struct cam_jpeg_process_irq_work_data_t *process_irq_cb_work_data;
+	int cdm_iommu_hdl;
+	int cdm_iommu_hdl_secure;
+	struct dentry *dentry;
+	u64 camnoc_misr_test;
+	u64 bug_on_misr;
+
+	struct cam_hw_intf **devices[CAM_JPEG_DEV_TYPE_MAX];
+	struct cam_jpeg_hw_cdm_info_t cdm_info[CAM_JPEG_DEV_TYPE_MAX]
+		[CAM_JPEG_NUM_DEV_PER_RES_MAX];
+	struct cam_soc_reg_map *cdm_reg_map[CAM_JPEG_DEV_TYPE_MAX]
+		[CAM_JPEG_NUM_DEV_PER_RES_MAX];
+	uint32_t device_in_use[CAM_JPEG_DEV_TYPE_MAX]
+		[CAM_JPEG_NUM_DEV_PER_RES_MAX];
+	struct cam_jpeg_hw_cfg_req *dev_hw_cfg_args[CAM_JPEG_DEV_TYPE_MAX]
+		[CAM_JPEG_NUM_DEV_PER_RES_MAX];
+
+	struct list_head hw_config_req_list;
+	struct list_head free_req_list;
+	struct cam_jpeg_hw_cfg_req req_list[CAM_JPEG_HW_CFG_Q_MAX];
+	uint32_t num_pid[CAM_JPEG_DEV_TYPE_MAX];
+};
+
+#endif /* CAM_JPEG_HW_MGR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/include/cam_jpeg_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/include/cam_jpeg_hw_intf.h
@@ -0,0 +1,82 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_HW_INTF_H
+#define CAM_JPEG_HW_INTF_H
+
+#include "cam_cpas_api.h"
+
+#define CAM_JPEG_DEV_PER_TYPE_MAX     1
+
+#define CAM_JPEG_CMD_BUF_MAX_SIZE     128
+#define CAM_JPEG_MSG_BUF_MAX_SIZE     CAM_JPEG_CMD_BUF_MAX_SIZE
+
+#define JPEG_VOTE                     640000000
+
+#define CAM_JPEG_HW_DUMP_TAG_MAX_LEN 32
+#define CAM_JPEG_HW_DUMP_NUM_WORDS   5
+#define CAM_JPEG_HW_MAX_NUM_PID      2
+#define CAM_JPEG_CAMNOC_MISR_VAL_ROW 2
+#define CAM_JPEG_CAMNOC_MISR_VAL_COL 4
+#define CAM_JPEG_ENC_MISR_VAL_NUM    3
+#define CAM_JPEG_MISR_ID_LOW_RD      1
+#define CAM_JPEG_MISR_ID_LOW_WR      2
+
+enum cam_jpeg_hw_type {
+	CAM_JPEG_DEV_ENC,
+	CAM_JPEG_DEV_DMA,
+};
+
+struct cam_jpeg_set_irq_cb {
+	int32_t (*jpeg_hw_mgr_cb)(uint32_t irq_status,
+		int32_t result_size, void *data);
+	void *data;
+	uint32_t b_set_cb;
+};
+
+struct cam_jpeg_hw_dump_args {
+	uint64_t  request_id;
+	uintptr_t cpu_addr;
+	size_t    offset;
+	size_t    buf_len;
+};
+
+struct cam_jpeg_hw_dump_header {
+	uint8_t     tag[CAM_JPEG_HW_DUMP_TAG_MAX_LEN];
+	uint64_t    size;
+	uint32_t    word_size;
+};
+
+struct cam_jpeg_match_pid_args {
+	uint32_t    pid;
+	uint32_t    fault_mid;
+	bool        pid_match_found;
+	uint32_t    match_res;
+};
+
+/**
+ * struct cam_jpeg_misr_dump_args
+ * @req_id: Request Id
+ * @enable_bug: This flag indicates whether BUG_ON(1) has to be called or not
+ * on MISR mismatch
+ */
+struct cam_jpeg_misr_dump_args {
+	uint32_t    req_id;
+	bool        enable_bug;
+};
+
+enum cam_jpeg_cmd_type {
+	CAM_JPEG_CMD_CDM_CFG,
+	CAM_JPEG_CMD_SET_IRQ_CB,
+	CAM_JPEG_CMD_HW_DUMP,
+	CAM_JPEG_CMD_GET_NUM_PID,
+	CAM_JPEG_CMD_MATCH_PID_MID,
+	CAM_JPEG_CMD_CONFIG_HW_MISR,
+	CAM_JPEG_CMD_DUMP_HW_MISR_VAL,
+	CAM_JPEG_CMD_MAX,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/include/cam_jpeg_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/include/cam_jpeg_hw_mgr_intf.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_HW_MGR_INTF_H
+#define CAM_JPEG_HW_MGR_INTF_H
+
+#include <linux/of.h>
+#include <media/cam_jpeg.h>
+#include <media/cam_defs.h>
+
+#define CAM_JPEG_CTX_MAX        16
+
+int cam_jpeg_hw_mgr_init(struct device_node *of_node,
+	uint64_t *hw_mgr_hdl, int *iommu_hdl);
+
+#endif /* CAM_JPEG_HW_MGR_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_165_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_165_hw_info_ver_4_2_0.h
@@ -0,0 +1,77 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_165_HW_INFO_VER_4_2_0_H
+#define CAM_JPEG_DMA_165_HW_INFO_VER_4_2_0_H
+
+#define CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE (1 << 0)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RD_BUF_DONE  (1 << 1)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_WR_BUF_DONE  (1 << 5)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT     (1 << 9)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE     (1 << 10)
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE
+#define CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE
+
+static struct cam_jpeg_dma_device_hw_info cam_jpeg_dma_165_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x14,
+		.int_status = 0x10,
+		.int_mask = 0x0C,
+		.hw_cmd = 0x1C,
+		.reset_cmd = 0x08,
+		.encode_size = 0x180,
+		.core_cfg = 0x18,
+		.misr_cfg0 = 0x160,
+		.misr_cfg1 = 0x164,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x32083,
+		.hw_cmd_stop = 0x00000004,
+		.misr_cfg0 = 0x506,
+	},
+	.int_status = {
+		.framedone = CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK,
+		.iserror = 0x0,
+		.stopdone = CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x4,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x5908,
+		.id_mask_low = 0x5920,
+		.id_value_low = 0x5918,
+		.misc_ctl = 0x5910,
+		.sigdata0 = 0x5950,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD00,
+		.id_value_low_wr = 0xD42,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.max_misr_wr = 4,
+	.camnoc_misr_sigdata = 4,
+	.master_we_sel = 2,
+	.misr_rd_word_sel = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_DMA_165_HW_INFO_VER_4_2_0_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_580_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_580_hw_info_ver_4_2_0.h
@@ -0,0 +1,77 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_580_HW_INFO_VER_4_2_0_H
+#define CAM_JPEG_DMA_580_HW_INFO_VER_4_2_0_H
+
+#define CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE (1 << 0)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RD_BUF_DONE  (1 << 1)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_WR_BUF_DONE  (1 << 5)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT     (1 << 9)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE     (1 << 10)
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE
+#define CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE
+
+static struct cam_jpeg_dma_device_hw_info cam_jpeg_dma_580_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x14,
+		.int_status = 0x10,
+		.int_mask = 0x0C,
+		.hw_cmd = 0x1C,
+		.reset_cmd = 0x08,
+		.encode_size = 0x180,
+		.core_cfg = 0x18,
+		.misr_cfg0 = 0x160,
+		.misr_cfg1 = 0x164,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x32083,
+		.hw_cmd_stop = 0x00000004,
+		.misr_cfg0 = 0x506,
+	},
+	.int_status = {
+		.framedone = CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK,
+		.iserror = 0x0,
+		.stopdone = CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x4,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x3608,
+		.id_mask_low = 0x3620,
+		.id_value_low = 0x3618,
+		.misc_ctl = 0x3610,
+		.sigdata0 = 0x3650,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD00,
+		.id_value_low_wr = 0xD42,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.max_misr_wr = 4,
+	.camnoc_misr_sigdata = 4,
+	.master_we_sel = 2,
+	.misr_rd_word_sel = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_DMA_580_HW_INFO_VER_4_2_0_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_hw_info_ver_4_2_0.h
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_HW_INFO_VER_4_2_0_H
+#define CAM_JPEG_DMA_HW_INFO_VER_4_2_0_H
+
+#define CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE (1 << 0)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RD_BUF_DONE  (1 << 1)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_WR_BUF_DONE  (1 << 5)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT     (1 << 9)
+#define CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE     (1 << 10)
+
+#define CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEGDMA_HW_IRQ_STATUS_SESSION_DONE
+#define CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEGDMA_HW_IRQ_STATUS_RST_DONE
+
+static struct cam_jpeg_dma_device_hw_info cam_jpeg_dma_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x14,
+		.int_status = 0x10,
+		.int_mask = 0x0C,
+		.hw_cmd = 0x1C,
+		.reset_cmd = 0x08,
+		.encode_size = 0x180,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x32083,
+		.hw_cmd_stop = 0x00000004,
+	},
+	.int_status = {
+		.framedone = CAM_JPEGDMA_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEGDMA_HW_MASK_COMP_RESET_ACK,
+		.iserror = 0x0,
+		.stopdone = CAM_JPEGDMA_HW_IRQ_STATUS_AXI_HALT,
+	},
+	.camnoc_misr_support = 0,
+};
+
+#endif /* CAM_JPEG_DMA_HW_INFO_VER_4_2_0_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.c
@@ -0,0 +1,713 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "jpeg_dma_core.h"
+#include "jpeg_dma_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_jpeg_hw_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+
+#define CAM_JPEG_HW_IRQ_IS_FRAME_DONE(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.framedone)
+#define CAM_JPEG_HW_IRQ_IS_RESET_ACK(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.resetdone)
+#define CAM_JPEG_HW_IRQ_IS_STOP_DONE(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.stopdone)
+
+#define CAM_JPEG_DMA_RESET_TIMEOUT msecs_to_jiffies(500)
+
+int cam_jpeg_dma_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	int rc;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+
+	if (!soc_info || !core_info) {
+		CAM_ERR(CAM_JPEG, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	mutex_lock(&core_info->core_mutex);
+	if (++core_info->ref_count > 1) {
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = JPEG_VOTE;
+	axi_vote.axi_path[0].mnoc_ab_bw = JPEG_VOTE;
+	axi_vote.axi_path[0].mnoc_ib_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].mnoc_ab_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].mnoc_ib_bw = JPEG_VOTE;
+
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "cpass start failed: %d", rc);
+		goto cpas_failed;
+	}
+
+	rc = cam_jpeg_dma_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "soc enable is failed %d", rc);
+		goto soc_failed;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+
+	return 0;
+
+soc_failed:
+	cam_cpas_stop(core_info->cpas_handle);
+cpas_failed:
+	--core_info->ref_count;
+	mutex_unlock(&core_info->core_mutex);
+
+	return rc;
+}
+
+int cam_jpeg_dma_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	int rc;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	if (!soc_info || !core_info) {
+		CAM_ERR(CAM_JPEG, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	mutex_lock(&core_info->core_mutex);
+	if (--core_info->ref_count > 0) {
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	if (core_info->ref_count < 0) {
+		CAM_ERR(CAM_JPEG, "ref cnt %d", core_info->ref_count);
+		core_info->ref_count = 0;
+		mutex_unlock(&core_info->core_mutex);
+		return -EFAULT;
+	}
+
+	rc = cam_jpeg_dma_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "soc disable failed %d", rc);
+
+	rc = cam_cpas_stop(core_info->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "cpas stop failed: %d", rc);
+
+	mutex_unlock(&core_info->core_mutex);
+
+	return 0;
+}
+
+irqreturn_t cam_jpeg_dma_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *jpeg_dma_dev = data;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	uint32_t irq_status = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return IRQ_HANDLED;
+	}
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	hw_info = core_info->jpeg_dma_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	irq_status = cam_io_r_mb(mem_base +
+		core_info->jpeg_dma_hw_info->reg_offset.int_status);
+	cam_io_w_mb(irq_status,
+		soc_info->reg_map[0].mem_base +
+		core_info->jpeg_dma_hw_info->reg_offset.int_clr);
+	CAM_DBG(CAM_JPEG, "irq_num %d  irq_status = %x , core_state %d",
+		irq_num, irq_status, core_info->core_state);
+	if (CAM_JPEG_HW_IRQ_IS_FRAME_DONE(irq_status, hw_info)) {
+		spin_lock(&jpeg_dma_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_DMA_CORE_READY) {
+			core_info->result_size = 1;
+			CAM_DBG(CAM_JPEG, "result_size %d",
+				core_info->result_size);
+			core_info->core_state =
+				CAM_JPEG_DMA_CORE_RESETTING_ON_DONE;
+			cam_io_w_mb(hw_info->reg_val.reset_cmd,
+				mem_base + hw_info->reg_offset.reset_cmd);
+		} else {
+			CAM_WARN(CAM_JPEG, "unexpected frame done ");
+			core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+		}
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+	}
+
+	if (CAM_JPEG_HW_IRQ_IS_RESET_ACK(irq_status, hw_info)) {
+		spin_lock(&jpeg_dma_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_DMA_CORE_RESETTING) {
+			core_info->core_state = CAM_JPEG_DMA_CORE_READY;
+			core_info->result_size = -1;
+			complete(&jpeg_dma_dev->hw_complete);
+		} else if (core_info->core_state ==
+			CAM_JPEG_DMA_CORE_RESETTING_ON_DONE) {
+			if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+				core_info->irq_cb.jpeg_hw_mgr_cb(irq_status,
+					core_info->result_size,
+					core_info->irq_cb.data);
+			} else {
+				CAM_WARN(CAM_JPEG, "unexpected frame done");
+			}
+			core_info->result_size = -1;
+			core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected reset irq");
+		}
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+	}
+	if (CAM_JPEG_HW_IRQ_IS_STOP_DONE(irq_status, hw_info)) {
+		spin_lock(&jpeg_dma_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_DMA_CORE_ABORTING) {
+			core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+			complete(&jpeg_dma_dev->hw_complete);
+			if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+				core_info->irq_cb.jpeg_hw_mgr_cb(irq_status,
+					-1,
+					core_info->irq_cb.data);
+			}
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected abort irq");
+		}
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+	}
+
+	return IRQ_HANDLED;
+}
+
+int cam_jpeg_dma_reset_hw(void *data,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = data;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long rem_jiffies;
+
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	/* maskdisable.clrirq.maskenable.resetcmd */
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	hw_info = core_info->jpeg_dma_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	mutex_lock(&core_info->core_mutex);
+	spin_lock(&jpeg_dma_dev->hw_lock);
+	if (core_info->core_state == CAM_JPEG_DMA_CORE_RESETTING) {
+		CAM_ERR(CAM_JPEG, "dma alrady resetting");
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	reinit_completion(&jpeg_dma_dev->hw_complete);
+
+	core_info->core_state = CAM_JPEG_DMA_CORE_RESETTING;
+	spin_unlock(&jpeg_dma_dev->hw_lock);
+
+	cam_io_w_mb(hw_info->reg_val.int_mask_disable_all,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.int_clr_clearall,
+		mem_base + hw_info->reg_offset.int_clr);
+	cam_io_w_mb(hw_info->reg_val.int_mask_enable_all,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.reset_cmd,
+		mem_base + hw_info->reg_offset.reset_cmd);
+
+	rem_jiffies = wait_for_completion_timeout(&jpeg_dma_dev->hw_complete,
+		CAM_JPEG_DMA_RESET_TIMEOUT);
+	if (!rem_jiffies) {
+		CAM_ERR(CAM_JPEG, "dma error Reset Timeout");
+		core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	return 0;
+}
+
+int cam_jpeg_dma_start_hw(void *data,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = data;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	hw_info = core_info->jpeg_dma_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	if (core_info->core_state != CAM_JPEG_DMA_CORE_READY) {
+		CAM_ERR(CAM_JPEG, "Error not ready");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_JPEG, "Starting DMA");
+	cam_io_w_mb(0x00000601,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.hw_cmd_start,
+		mem_base + hw_info->reg_offset.hw_cmd);
+
+	return 0;
+}
+
+int cam_jpeg_dma_stop_hw(void *data,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = data;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long rem_jiffies;
+
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	soc_info = &jpeg_dma_dev->soc_info;
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	hw_info = core_info->jpeg_dma_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	mutex_lock(&core_info->core_mutex);
+	spin_lock(&jpeg_dma_dev->hw_lock);
+	if (core_info->core_state == CAM_JPEG_DMA_CORE_ABORTING) {
+		CAM_ERR(CAM_JPEG, "alrady stopping");
+		spin_unlock(&jpeg_dma_dev->hw_lock);
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	reinit_completion(&jpeg_dma_dev->hw_complete);
+	core_info->core_state = CAM_JPEG_DMA_CORE_ABORTING;
+	spin_unlock(&jpeg_dma_dev->hw_lock);
+
+	cam_io_w_mb(hw_info->reg_val.hw_cmd_stop,
+		mem_base + hw_info->reg_offset.hw_cmd);
+
+	rem_jiffies = wait_for_completion_timeout(&jpeg_dma_dev->hw_complete,
+		CAM_JPEG_DMA_RESET_TIMEOUT);
+	if (!rem_jiffies) {
+		CAM_ERR(CAM_JPEG, "error Reset Timeout");
+		core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	return 0;
+}
+
+static int cam_jpeg_dma_dump_camnoc_misr_val(struct cam_jpeg_dma_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *dma_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	struct cam_jpeg_misr_dump_args       *pmisr_args;
+	int32_t camnoc_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{0}};
+	int i, rc = 0;
+	int32_t val;
+	uint32_t index = 0;
+	bool mismatch = false;
+
+	dma_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	pmisr_args = (struct cam_jpeg_misr_dump_args *)cmd_args;
+	if (!pmisr_args) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+	val = cam_io_r_mb(dma_mem_base + hw_info->reg_offset.core_cfg);
+	index = (val >> hw_info->int_status.scale_enable_shift) &
+		hw_info->int_status.scale_enable;
+	CAM_DBG(CAM_JPEG, "index %d", index);
+
+	for (i = 0; i < hw_info->camnoc_misr_sigdata; i++) {
+		camnoc_misr_val[index][i] = cam_io_r_mb(camnoc_mem_base +
+			hw_info->camnoc_misr_reg_offset.sigdata0 + (i * 8));
+		if (hw_info->prev_camnoc_misr_val[index][i] !=
+			camnoc_misr_val[index][i])
+			mismatch = true;
+	}
+	if (mismatch && (pmisr_args->req_id != 1)) {
+		CAM_ERR(CAM_JPEG,
+			"CAMNOC DMA_MISR MISMATCH [req:%d][i:%d][index:%d]\n"
+			"curr:0x%x %x %x %x prev:0x%x %x %x %x isbug:%d",
+			pmisr_args->req_id, i, index,
+			camnoc_misr_val[index][3], camnoc_misr_val[index][2],
+			camnoc_misr_val[index][1], camnoc_misr_val[index][0],
+			hw_info->prev_camnoc_misr_val[index][3],
+			hw_info->prev_camnoc_misr_val[index][2],
+			hw_info->prev_camnoc_misr_val[index][1],
+			hw_info->prev_camnoc_misr_val[index][0],
+			pmisr_args->enable_bug);
+		if (pmisr_args->enable_bug)
+			BUG_ON(1);
+	}
+	CAM_DBG(CAM_JPEG,
+		"CAMNOC DMA_MISR req:%d SigData:0x %x %x %x %x",
+		pmisr_args->req_id,
+		camnoc_misr_val[index][3], camnoc_misr_val[index][2],
+		camnoc_misr_val[index][1], camnoc_misr_val[index][0]);
+	mismatch = false;
+	for (i = 0; i < hw_info->camnoc_misr_sigdata; i++)
+		hw_info->prev_camnoc_misr_val[index][i] =
+			camnoc_misr_val[index][i];
+	/* stop misr : cam_noc_cam_noc_0_req_link_misrprb_MiscCtl_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.misc_ctl_stop,
+		camnoc_mem_base + hw_info->camnoc_misr_reg_offset.misc_ctl);
+
+	return rc;
+}
+
+static int cam_jpeg_dma_dump_hw_misr_val(struct cam_jpeg_dma_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *dma_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	struct cam_jpeg_misr_dump_args       *pmisr_args;
+	int32_t dma_wr_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{0}};
+	int32_t dma_rd_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{0}};
+	int offset, i, rc = 0;
+	int32_t val;
+	uint32_t index = 0;
+	bool mismatch = false;
+
+	dma_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	pmisr_args = (struct cam_jpeg_misr_dump_args *)cmd_args;
+	if (!pmisr_args) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+	val = cam_io_r_mb(dma_mem_base + hw_info->reg_offset.core_cfg);
+	index = (val >> hw_info->int_status.scale_enable_shift) &
+		hw_info->int_status.scale_enable;
+	CAM_DBG(CAM_JPEG, "index %d", index);
+
+	/* After the session is complete, read back the MISR values.
+	 * fetch engine MISR values
+	 */
+	offset = hw_info->reg_offset.misr_cfg1;
+	for (i = 0; i < hw_info->max_misr_rd; i++) {
+		val = i << hw_info->misr_rd_word_sel;
+		cam_io_w_mb(val, dma_mem_base + offset);
+		dma_rd_misr_val[index][i] = cam_io_r_mb(dma_mem_base +
+			offset + 0x4);
+		if (hw_info->prev_dma_rd_misr_val[index][i] != dma_rd_misr_val[index][i])
+			mismatch = true;
+	}
+	if (mismatch && (pmisr_args->req_id != 1)) {
+		CAM_ERR(CAM_JPEG,
+			"CAMNOC DMA_RD_MISR MISMATCH [req:%d][index:%d][i:%d]\n"
+			"curr:0x%x %x %x %x prev:0x%x %x %x %x isbug:%d",
+			pmisr_args->req_id, index, i,
+			dma_rd_misr_val[index][3], dma_rd_misr_val[index][2],
+			dma_rd_misr_val[index][1], dma_rd_misr_val[index][0],
+			hw_info->prev_dma_rd_misr_val[index][3],
+			hw_info->prev_dma_rd_misr_val[index][2],
+			hw_info->prev_dma_rd_misr_val[index][1],
+			hw_info->prev_dma_rd_misr_val[index][0],
+			pmisr_args->enable_bug);
+		if (pmisr_args->enable_bug)
+			BUG_ON(1);
+	}
+
+	CAM_DBG(CAM_JPEG,
+		"CORE JPEG DMA RD MISR: 0x%x %x %x %x",
+		dma_rd_misr_val[index][3], dma_rd_misr_val[index][2],
+		dma_rd_misr_val[index][1], dma_rd_misr_val[index][0]);
+
+	mismatch = false;
+	for (i = 0; i < hw_info->max_misr_rd; i++) {
+		hw_info->prev_dma_rd_misr_val[index][i] =
+			dma_rd_misr_val[index][i];
+	}
+
+	/* write engine MISR values */
+	for (i = 0; i < hw_info->max_misr_wr; i++) {
+		val = hw_info->master_we_sel | (i << hw_info->misr_rd_word_sel);
+		cam_io_w_mb(val, dma_mem_base + offset);
+		dma_wr_misr_val[index][i] = cam_io_r_mb(dma_mem_base +
+			offset + 0x4);
+		if (hw_info->prev_dma_wr_misr_val[index][i] !=
+			dma_wr_misr_val[index][i])
+			mismatch = true;
+	}
+	if (mismatch && (pmisr_args->req_id != 1)) {
+		CAM_ERR(CAM_JPEG,
+			"CAMNOC DMA_WR_MISR MISMATCH [req:%d][index:%d][i:%d]\n"
+			"curr:0x%x %x %x %x prev:0x%x %x %x %x isbug:%d",
+			pmisr_args->req_id, index, i,
+			dma_wr_misr_val[index][3], dma_wr_misr_val[index][2],
+			dma_wr_misr_val[index][1], dma_wr_misr_val[index][0],
+			hw_info->prev_dma_wr_misr_val[index][3],
+			hw_info->prev_dma_wr_misr_val[index][2],
+			hw_info->prev_dma_wr_misr_val[index][1],
+			hw_info->prev_dma_wr_misr_val[index][0],
+			pmisr_args->enable_bug);
+		if (pmisr_args->enable_bug)
+			BUG_ON(1);
+	}
+	CAM_DBG(CAM_JPEG,
+		"CORE JPEG DMA WR MISR: 0x%x %x %x %x",
+		dma_wr_misr_val[index][3], dma_wr_misr_val[index][2],
+		dma_wr_misr_val[index][1], dma_wr_misr_val[index][0]);
+
+	mismatch = false;
+	for (i = 0; i < hw_info->max_misr_wr; i++) {
+		hw_info->prev_dma_wr_misr_val[index][i] =
+			dma_wr_misr_val[index][i];
+	}
+
+	return rc;
+}
+
+static int cam_jpeg_dma_config_cmanoc_hw_misr(struct cam_jpeg_dma_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *dma_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	uint32_t                             *camnoc_misr_test = NULL;
+	int val = 0;
+
+	dma_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	if (!camnoc_mem_base) {
+		CAM_ERR(CAM_JPEG, "Invalid camnoc base address");
+		return -EINVAL;
+	}
+	camnoc_misr_test = (uint32_t *)cmd_args;
+	if (!camnoc_misr_test) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+	/* enable FE and WE with sample data mode */
+	cam_io_w_mb(hw_info->reg_val.misr_cfg0, dma_mem_base +
+		hw_info->reg_offset.misr_cfg0);
+
+	/* cam_noc_cam_noc_0_req_link_misrprb_MainCtl_Low
+	 * enable CRC generation on both RD, WR and transaction payload
+	 */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.main_ctl, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.main_ctl);
+	/* cam_noc_cam_noc_0_req_link_misrprb_IdMask_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.main_ctl, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.id_mask_low);
+	/* cam_noc_cam_noc_0_req_link_misrprb_IdValue_Low */
+	switch (*camnoc_misr_test) {
+	case CAM_JPEG_MISR_ID_LOW_RD:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_rd;
+		break;
+	case CAM_JPEG_MISR_ID_LOW_WR:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_wr;
+		break;
+	default:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_rd;
+		break;
+	}
+	cam_io_w_mb(val, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.id_value_low);
+	/* start/reset misr : cam_noc_cam_noc_0_req_link_misrprb_MiscCtl_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.misc_ctl_start,
+		camnoc_mem_base + hw_info->camnoc_misr_reg_offset.misc_ctl);
+	CAM_DBG(CAM_JPEG, "DMA CAMNOC and HW MISR configured");
+
+	return 0;
+}
+
+int cam_jpeg_dma_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_dma_dev = device_priv;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_jpeg_dma_device_hw_info   *hw_info = NULL;
+	struct cam_jpeg_match_pid_args       *match_pid_mid = NULL;
+	uint32_t                             *num_pid = NULL;
+	struct cam_hw_soc_info               *soc_info = NULL;
+	int i, rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_JPEG_CMD_MAX) {
+		CAM_ERR(CAM_JPEG, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+
+	hw_info = core_info->jpeg_dma_hw_info;
+	soc_info = &jpeg_dma_dev->soc_info;
+
+
+	switch (cmd_type) {
+	case CAM_JPEG_CMD_SET_IRQ_CB:
+	{
+		struct cam_jpeg_set_irq_cb *irq_cb = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+		if (irq_cb->b_set_cb) {
+			core_info->irq_cb.jpeg_hw_mgr_cb =
+				irq_cb->jpeg_hw_mgr_cb;
+			core_info->irq_cb.data = irq_cb->data;
+		} else {
+			core_info->irq_cb.jpeg_hw_mgr_cb = NULL;
+			core_info->irq_cb.data = NULL;
+		}
+		rc = 0;
+		break;
+	}
+	case CAM_JPEG_CMD_GET_NUM_PID:
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		num_pid = (uint32_t    *)cmd_args;
+		*num_pid = core_info->num_pid;
+
+		break;
+	case CAM_JPEG_CMD_MATCH_PID_MID:
+		match_pid_mid = (struct cam_jpeg_match_pid_args *)cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		for (i = 0; i < core_info->num_pid; i++) {
+			if (core_info->pid[i] == match_pid_mid->pid)
+				break;
+		}
+
+		if (i == core_info->num_pid)
+			match_pid_mid->pid_match_found = false;
+		else
+			match_pid_mid->pid_match_found = true;
+
+		if (match_pid_mid->pid_match_found) {
+			if (match_pid_mid->fault_mid == core_info->rd_mid) {
+				match_pid_mid->match_res =
+					CAM_JPEG_DMA_INPUT_IMAGE;
+			} else if (match_pid_mid->fault_mid ==
+				core_info->wr_mid) {
+				match_pid_mid->match_res =
+					CAM_JPEG_DMA_OUTPUT_IMAGE;
+			} else
+				match_pid_mid->pid_match_found = false;
+		}
+
+		break;
+	case CAM_JPEG_CMD_CONFIG_HW_MISR:
+	{
+		if (hw_info->camnoc_misr_support)
+			rc = cam_jpeg_dma_config_cmanoc_hw_misr(hw_info, soc_info, cmd_args);
+		else
+			CAM_DBG(CAM_JPEG, "camnoc misr is not supported");
+		break;
+	}
+	case CAM_JPEG_CMD_DUMP_HW_MISR_VAL:
+	{
+		if (hw_info->camnoc_misr_support) {
+			rc = cam_jpeg_dma_dump_hw_misr_val(hw_info, soc_info, cmd_args);
+			if (rc)
+				break;
+			rc = cam_jpeg_dma_dump_camnoc_misr_val(hw_info, soc_info, cmd_args);
+		} else {
+			CAM_DBG(CAM_JPEG, "camnoc misr is not supported");
+		}
+		break;
+	}
+	default:
+		rc = -EINVAL;
+		break;
+	}
+	if (rc)
+		CAM_ERR(CAM_JPEG, "error cmdtype %d rc = %d", cmd_type, rc);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_core.h
@@ -0,0 +1,135 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_DMA_CORE_H
+#define CAM_JPEG_DMA_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/dma-buf.h>
+
+#include "cam_jpeg_hw_intf.h"
+
+struct cam_jpeg_dma_reg_offsets {
+	uint32_t hw_version;
+	uint32_t int_status;
+	uint32_t int_clr;
+	uint32_t int_mask;
+	uint32_t hw_cmd;
+	uint32_t reset_cmd;
+	uint32_t encode_size;
+	uint32_t core_cfg;
+	uint32_t misr_cfg0;
+	uint32_t misr_cfg1;
+};
+
+struct cam_jpeg_dma_regval {
+	uint32_t int_clr_clearall;
+	uint32_t int_mask_disable_all;
+	uint32_t int_mask_enable_all;
+	uint32_t hw_cmd_start;
+	uint32_t reset_cmd;
+	uint32_t hw_cmd_stop;
+	uint32_t misr_cfg0;
+};
+
+struct cam_jpeg_dma_int_status {
+	uint32_t framedone;
+	uint32_t resetdone;
+	uint32_t iserror;
+	uint32_t stopdone;
+	uint32_t scale_enable;
+	uint32_t scale_enable_shift;
+};
+
+struct cam_jpeg_dma_camnoc_misr_reg_offset {
+	uint32_t main_ctl;
+	uint32_t id_mask_low;
+	uint32_t id_value_low;
+	uint32_t misc_ctl;
+	uint32_t sigdata0;
+};
+
+struct cam_jpeg_dma_camnoc_misr_reg_val {
+	uint32_t main_ctl;
+	uint32_t id_mask_low;
+	uint32_t id_value_low_rd;
+	uint32_t id_value_low_wr;
+	uint32_t misc_ctl_start;
+	uint32_t misc_ctl_stop;
+};
+
+struct cam_jpeg_dma_device_hw_info {
+	struct cam_jpeg_dma_reg_offsets reg_offset;
+	struct cam_jpeg_dma_regval reg_val;
+	struct cam_jpeg_dma_int_status int_status;
+	struct cam_jpeg_dma_camnoc_misr_reg_offset camnoc_misr_reg_offset;
+	struct cam_jpeg_dma_camnoc_misr_reg_val camnoc_misr_reg_val;
+	uint32_t max_misr;
+	uint32_t max_misr_rd;
+	uint32_t max_misr_wr;
+	uint32_t camnoc_misr_sigdata;
+	uint32_t master_we_sel;
+	uint32_t misr_rd_word_sel;
+	uint32_t camnoc_misr_support;
+	int32_t prev_dma_wr_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL];
+	int32_t prev_dma_rd_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL];
+	int32_t prev_camnoc_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL];
+};
+
+enum cam_jpeg_dma_core_state {
+	CAM_JPEG_DMA_CORE_NOT_READY,
+	CAM_JPEG_DMA_CORE_READY,
+	CAM_JPEG_DMA_CORE_RESETTING,
+	CAM_JPEG_DMA_CORE_ABORTING,
+	CAM_JPEG_DMA_CORE_RESETTING_ON_DONE,
+	CAM_JPEG_DMA_CORE_STATE_MAX,
+};
+
+struct cam_jpeg_dma_device_core_info {
+	enum cam_jpeg_dma_core_state core_state;
+	struct cam_jpeg_dma_device_hw_info *jpeg_dma_hw_info;
+	uint32_t cpas_handle;
+	struct cam_jpeg_set_irq_cb irq_cb;
+	int32_t ref_count;
+	struct mutex core_mutex;
+	int32_t result_size;
+	uint32_t num_pid;
+	uint32_t pid[CAM_JPEG_HW_MAX_NUM_PID];
+	uint32_t rd_mid;
+	uint32_t wr_mid;
+};
+
+int cam_jpeg_dma_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_start_hw(void *device_priv,
+	void *start_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_stop_hw(void *device_priv,
+	void *stop_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_reset_hw(void *device_priv,
+	void *reset_hw_args, uint32_t arg_size);
+int cam_jpeg_dma_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+irqreturn_t cam_jpeg_dma_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register JPEG DMA hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_jpeg_dma_init_module(void);
+
+/**
+ * @brief : API to remove JPEG DMA Hw from platform framework.
+ */
+void cam_jpeg_dma_exit_module(void);
+#endif /* CAM_JPEG_DMA_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.c
@@ -0,0 +1,277 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+
+#include "jpeg_dma_core.h"
+#include "jpeg_dma_soc.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_jpeg_hw_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_jpeg_dma_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_dma_165_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_dma_580_hw_info_ver_4_2_0.h"
+#include "camera_main.h"
+
+static int cam_jpeg_dma_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_jpeg_dma_device_core_info *core_info,
+	uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = soc_info->dev;
+	memcpy(cpas_register_params.identifier, "jpeg-dma",
+		sizeof("jpeg-dma"));
+	cpas_register_params.cam_cpas_client_cb = NULL;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "cpas_register failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_jpeg_dma_unregister_cpas(
+	struct cam_jpeg_dma_device_core_info *core_info)
+{
+	int rc;
+
+	rc = cam_cpas_unregister_client(core_info->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "cpas unregister failed: %d", rc);
+	core_info->cpas_handle = 0;
+
+	return rc;
+}
+
+static int cam_jpeg_dma_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *jpeg_dma_dev = NULL;
+	struct cam_hw_intf *jpeg_dma_dev_intf = NULL;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	struct cam_jpeg_dma_device_hw_info *hw_info = NULL;
+	struct cam_jpeg_dma_soc_private  *soc_private;
+	int i, rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	jpeg_dma_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!jpeg_dma_dev_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &jpeg_dma_dev_intf->hw_idx);
+
+	jpeg_dma_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!jpeg_dma_dev) {
+		rc = -ENOMEM;
+		goto error_alloc_dev;
+	}
+	jpeg_dma_dev->soc_info.pdev = pdev;
+	jpeg_dma_dev->soc_info.dev = &pdev->dev;
+	jpeg_dma_dev->soc_info.dev_name = pdev->name;
+	jpeg_dma_dev_intf->hw_priv = jpeg_dma_dev;
+	jpeg_dma_dev_intf->hw_ops.init = cam_jpeg_dma_init_hw;
+	jpeg_dma_dev_intf->hw_ops.deinit = cam_jpeg_dma_deinit_hw;
+	jpeg_dma_dev_intf->hw_ops.start = cam_jpeg_dma_start_hw;
+	jpeg_dma_dev_intf->hw_ops.stop = cam_jpeg_dma_stop_hw;
+	jpeg_dma_dev_intf->hw_ops.reset = cam_jpeg_dma_reset_hw;
+	jpeg_dma_dev_intf->hw_ops.process_cmd = cam_jpeg_dma_process_cmd;
+	jpeg_dma_dev_intf->hw_type = CAM_JPEG_DEV_DMA;
+
+	platform_set_drvdata(pdev, jpeg_dma_dev_intf);
+	jpeg_dma_dev->core_info =
+		kzalloc(sizeof(struct cam_jpeg_dma_device_core_info),
+			GFP_KERNEL);
+	if (!jpeg_dma_dev->core_info) {
+		rc = -ENOMEM;
+		goto error_alloc_core;
+	}
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_JPEG, " No jpeg_dma hardware info");
+		rc = -EINVAL;
+		goto error_match_dev;
+	}
+	hw_info = (struct cam_jpeg_dma_device_hw_info *)match_dev->data;
+	core_info->jpeg_dma_hw_info = hw_info;
+	core_info->core_state = CAM_JPEG_DMA_CORE_NOT_READY;
+	mutex_init(&core_info->core_mutex);
+
+	rc = cam_jpeg_dma_init_soc_resources(&jpeg_dma_dev->soc_info,
+		cam_jpeg_dma_irq,
+		jpeg_dma_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "failed to init_soc %d", rc);
+		goto error_init_soc;
+	}
+
+	rc = cam_jpeg_dma_register_cpas(&jpeg_dma_dev->soc_info,
+		core_info, jpeg_dma_dev_intf->hw_idx);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, " failed to reg cpas %d", rc);
+		goto error_reg_cpas;
+	}
+	jpeg_dma_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&jpeg_dma_dev->hw_mutex);
+	spin_lock_init(&jpeg_dma_dev->hw_lock);
+	init_completion(&jpeg_dma_dev->hw_complete);
+	CAM_DBG(CAM_JPEG, "JPEG-DMA component bound successfully");
+
+	soc_private = (struct cam_jpeg_dma_soc_private  *)
+		jpeg_dma_dev->soc_info.soc_private;
+
+	core_info->num_pid = soc_private->num_pid;
+	for (i = 0; i < soc_private->num_pid; i++)
+		core_info->pid[i] = soc_private->pid[i];
+
+	core_info->rd_mid = soc_private->rd_mid;
+	core_info->wr_mid = soc_private->wr_mid;
+
+	return rc;
+
+error_reg_cpas:
+	cam_soc_util_release_platform_resource(&jpeg_dma_dev->soc_info);
+error_init_soc:
+	mutex_destroy(&core_info->core_mutex);
+error_match_dev:
+	kfree(jpeg_dma_dev->core_info);
+error_alloc_core:
+	kfree(jpeg_dma_dev);
+error_alloc_dev:
+	kfree(jpeg_dma_dev_intf);
+
+	return rc;
+}
+
+static void cam_jpeg_dma_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *jpeg_dma_dev = NULL;
+	struct cam_hw_intf *jpeg_dma_dev_intf = NULL;
+	struct cam_jpeg_dma_device_core_info *core_info = NULL;
+	int rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	jpeg_dma_dev_intf = platform_get_drvdata(pdev);
+	if (!jpeg_dma_dev_intf) {
+		CAM_ERR(CAM_JPEG, "error No data in pdev");
+		return;
+	}
+
+	jpeg_dma_dev = jpeg_dma_dev_intf->hw_priv;
+	if (!jpeg_dma_dev) {
+		CAM_ERR(CAM_JPEG, "error HW data is NULL");
+		goto free_jpeg_hw_intf;
+	}
+
+	core_info = (struct cam_jpeg_dma_device_core_info *)
+		jpeg_dma_dev->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_JPEG, "error core data NULL");
+		goto deinit_soc;
+	}
+
+	rc = cam_jpeg_dma_unregister_cpas(core_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, " unreg failed to reg cpas %d", rc);
+
+	mutex_destroy(&core_info->core_mutex);
+	kfree(core_info);
+
+deinit_soc:
+	rc = cam_soc_util_release_platform_resource(&jpeg_dma_dev->soc_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&jpeg_dma_dev->hw_mutex);
+	kfree(jpeg_dma_dev);
+
+free_jpeg_hw_intf:
+	kfree(jpeg_dma_dev_intf);
+}
+
+const static struct component_ops cam_jpeg_dma_component_ops = {
+	.bind = cam_jpeg_dma_component_bind,
+	.unbind = cam_jpeg_dma_component_unbind,
+};
+
+static int cam_jpeg_dma_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_jpeg_dma_component_ops);
+	return 0;
+}
+
+static int cam_jpeg_dma_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_JPEG, "Adding JPEG dma component");
+	rc = component_add(&pdev->dev, &cam_jpeg_dma_component_ops);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static const struct of_device_id cam_jpeg_dma_dt_match[] = {
+	{
+		.compatible = "qcom,cam_jpeg_dma",
+		.data = &cam_jpeg_dma_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_dma_165",
+		.data = &cam_jpeg_dma_165_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_dma_580",
+		.data = &cam_jpeg_dma_580_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_jpeg_dma_dt_match);
+
+struct platform_driver cam_jpeg_dma_driver = {
+	.probe = cam_jpeg_dma_probe,
+	.remove = cam_jpeg_dma_remove,
+	.driver = {
+		.name = "cam-jpeg-dma",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_jpeg_dma_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_jpeg_dma_init_module(void)
+{
+	return platform_driver_register(&cam_jpeg_dma_driver);
+}
+
+void cam_jpeg_dma_exit_module(void)
+{
+	platform_driver_unregister(&cam_jpeg_dma_driver);
+}
+
+MODULE_DESCRIPTION("CAM JPEG_DMA driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.c
@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, 2021 The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_jpeg.h>
+
+#include "jpeg_dma_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+int cam_jpeg_dma_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t jpeg_dma_irq_handler, void *irq_data)
+{
+	struct cam_jpeg_dma_soc_private  *soc_private;
+	struct platform_device *pdev = NULL;
+	int num_pid = 0, i = 0;
+	int rc;
+
+	soc_private = kzalloc(sizeof(struct cam_jpeg_dma_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_JPEG, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+	pdev = soc_info->pdev;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc)
+		return rc;
+
+	rc = cam_soc_util_request_platform_resource(soc_info,
+		jpeg_dma_irq_handler,
+		irq_data);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "init soc failed %d", rc);
+
+	soc_private->num_pid = 0;
+	soc_private->rd_mid = UINT_MAX;
+	soc_private->wr_mid = UINT_MAX;
+
+	num_pid = of_property_count_u32_elems(pdev->dev.of_node, "cam_hw_pid");
+	CAM_DBG(CAM_JPEG, "jpeg:%d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_JPEG_HW_MAX_NUM_PID)
+		goto end;
+
+	soc_private->num_pid  = num_pid;
+	for (i = 0; i < num_pid; i++)
+		of_property_read_u32_index(pdev->dev.of_node, "cam_hw_pid", i,
+		&soc_private->pid[i]);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cam_hw_rd_mid", &soc_private->rd_mid);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cam_hw_wr_mid", &soc_private->wr_mid);
+
+end:
+	return rc;
+}
+
+int cam_jpeg_dma_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_SVS_VOTE, true);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "enable platform failed %d", rc);
+
+	return rc;
+}
+
+int cam_jpeg_dma_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "disable platform failed %d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_soc.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2021 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_JPEG_DMA_SOC_H_
+#define _CAM_JPEG_DMA_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_jpeg_hw_intf.h"
+
+/*
+ * struct cam_jpeg_dma_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to JPEG DMA Driver
+ *
+ * @num_pid                  JPEG number of pids
+ * @pid:                     JPEG DMA pid value list
+ * @rd_mid:                  JPEG DMA inport read mid value
+ * @wr_mid:                  JPEG DMA outport write mid value
+ */
+struct cam_jpeg_dma_soc_private {
+	uint32_t    num_pid;
+	uint32_t    pid[CAM_JPEG_HW_MAX_NUM_PID];
+	uint32_t    rd_mid;
+	uint32_t    wr_mid;
+};
+
+int cam_jpeg_dma_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t jpeg_dma_irq_handler, void *irq_data);
+
+int cam_jpeg_dma_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_jpeg_dma_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_JPEG_DMA_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_165_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_165_hw_info_ver_4_2_0.h
@@ -0,0 +1,104 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_165_HW_INFO_TITAN170_H
+#define CAM_JPEG_ENC_165_HW_INFO_TITAN170_H
+
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK 0x00000001
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_SHIFT 0x00000000
+
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK 0x10000000
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_SHIFT 0x0000000a
+
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK 0x8000000
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_SHIFT 0x0000001b
+
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_MASK 0x00000800
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_SHIFT 0x0000000b
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF      (0x1<<19)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR     (0x1<<20)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR   (0x1<<21)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF (0x1<<22)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW    (0x1<<23)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM       (0x1<<24)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ   (0x1<<25)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM       (0x1<<26)
+#define CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK        (0x1<<29)
+
+#define CAM_JPEG_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK
+#define CAM_JPEG_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK
+#define CAM_JPEG_HW_MASK_COMP_ERR \
+		(CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK)
+
+static struct cam_jpeg_enc_device_hw_info cam_jpeg_enc_165_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x1c,
+		.int_status = 0x20,
+		.int_mask = 0x18,
+		.hw_cmd = 0x10,
+		.reset_cmd = 0x8,
+		.encode_size = 0x180,
+		.core_cfg = 0xc,
+		.misr_cfg = 0x2B4,
+		.misr_rd0 = 0x2B8,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x200320D3,
+		.hw_cmd_stop = 0x00000002,
+		.misr_cfg = 0x7,
+	},
+	.int_status = {
+		.framedone = CAM_JPEG_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEG_HW_MASK_COMP_RESET_ACK,
+		.iserror = CAM_JPEG_HW_MASK_COMP_ERR,
+		.stopdone = CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x7,
+	},
+	.reg_dump = {
+		.start_offset = 0x0,
+		.end_offset = 0x33C,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x5908,
+		.id_mask_low = 0x5920,
+		.id_value_low = 0x5918,
+		.misc_ctl = 0x5910,
+		.sigdata0 = 0x5950,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD80,
+		.id_value_low_wr = 0xDC2,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.camnoc_misr_sigdata = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_ENC_165_HW_INFO_TITAN170_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_580_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_580_hw_info_ver_4_2_0.h
@@ -0,0 +1,104 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_580_HW_INFO_TITAN170_H
+#define CAM_JPEG_ENC_580_HW_INFO_TITAN170_H
+
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK 0x00000001
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_SHIFT 0x00000000
+
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK 0x10000000
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_SHIFT 0x0000000a
+
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK 0x8000000
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_SHIFT 0x0000001b
+
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_MASK 0x00000800
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_SHIFT 0x0000000b
+
+#define CAM_JPEG_HW_MASK_SCALE_ENABLE 0x1
+
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF      (0x1<<19)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR     (0x1<<20)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR   (0x1<<21)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF (0x1<<22)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW    (0x1<<23)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM       (0x1<<24)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ   (0x1<<25)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM       (0x1<<26)
+#define CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK        (0x1<<29)
+
+#define CAM_JPEG_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK
+#define CAM_JPEG_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK
+#define CAM_JPEG_HW_MASK_COMP_ERR \
+		(CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK)
+
+static struct cam_jpeg_enc_device_hw_info cam_jpeg_enc_580_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x1c,
+		.int_status = 0x20,
+		.int_mask = 0x18,
+		.hw_cmd = 0x10,
+		.reset_cmd = 0x8,
+		.encode_size = 0x180,
+		.core_cfg = 0xc,
+		.misr_cfg = 0x2B4,
+		.misr_rd0 = 0x2B8,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x200320D3,
+		.hw_cmd_stop = 0x00000002,
+		.misr_cfg = 0x7,
+	},
+	.int_status = {
+		.framedone = CAM_JPEG_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEG_HW_MASK_COMP_RESET_ACK,
+		.iserror = CAM_JPEG_HW_MASK_COMP_ERR,
+		.stopdone = CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK,
+		.scale_enable = CAM_JPEG_HW_MASK_SCALE_ENABLE,
+		.scale_enable_shift = 0x7,
+	},
+	.reg_dump = {
+		.start_offset = 0x0,
+		.end_offset = 0x33C,
+	},
+	.camnoc_misr_reg_offset = {
+		.main_ctl = 0x3608,
+		.id_mask_low = 0x3620,
+		.id_value_low = 0x3618,
+		.misc_ctl = 0x3610,
+		.sigdata0 = 0x3650,
+	},
+	.camnoc_misr_reg_val = {
+		.main_ctl = 0x7,
+		.id_mask_low = 0xFC0,
+		.id_value_low_rd = 0xD80,
+		.id_value_low_wr = 0xDC2,
+		.misc_ctl_start = 0x1,
+		.misc_ctl_stop = 0x2,
+	},
+	.max_misr = 3,
+	.max_misr_rd = 4,
+	.camnoc_misr_sigdata = 4,
+	.camnoc_misr_support = 1,
+};
+
+#endif /* CAM_JPEG_ENC_580_HW_INFO_TITAN170_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_hw_info_ver_4_2_0.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/cam_jpeg_enc_hw_info_ver_4_2_0.h
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_HW_INFO_TITAN170_H
+#define CAM_JPEG_ENC_HW_INFO_TITAN170_H
+
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK 0x00000001
+#define CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_SHIFT 0x00000000
+
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK 0x10000000
+#define CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_SHIFT 0x0000000a
+
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK 0x8000000
+#define CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_SHIFT 0x0000001b
+
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_MASK 0x00000800
+#define CAM_JPEG_HW_IRQ_STATUS_BUS_ERROR_SHIFT 0x0000000b
+
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF      (0x1<<19)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR     (0x1<<20)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR   (0x1<<21)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF (0x1<<22)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW    (0x1<<23)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM       (0x1<<24)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ   (0x1<<25)
+#define CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM       (0x1<<26)
+#define CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK        (0x1<<29)
+
+#define CAM_JPEG_HW_MASK_COMP_FRAMEDONE \
+		CAM_JPEG_HW_IRQ_STATUS_FRAMEDONE_MASK
+#define CAM_JPEG_HW_MASK_COMP_RESET_ACK \
+		CAM_JPEG_HW_IRQ_STATUS_RESET_ACK_MASK
+#define CAM_JPEG_HW_MASK_COMP_ERR \
+		(CAM_JPEG_HW_IRQ_STATUS_DCD_UNESCAPED_FF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_HUFFMAN_ERROR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_COEFFICIENT_ERR | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_BIT_STUFF | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_SCAN_UNDERFLOW | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_INVALID_RSM_SEQ | \
+		CAM_JPEG_HW_IRQ_STATUS_DCD_MISSING_RSM | \
+		CAM_JPEG_HW_IRQ_STATUS_VIOLATION_MASK)
+
+static struct cam_jpeg_enc_device_hw_info cam_jpeg_enc_hw_info = {
+	.reg_offset = {
+		.hw_version = 0x0,
+		.int_clr = 0x1c,
+		.int_status = 0x20,
+		.int_mask = 0x18,
+		.hw_cmd = 0x10,
+		.reset_cmd = 0x8,
+		.encode_size = 0x180,
+	},
+	.reg_val = {
+		.int_clr_clearall = 0xFFFFFFFF,
+		.int_mask_disable_all = 0x00000000,
+		.int_mask_enable_all = 0xFFFFFFFF,
+		.hw_cmd_start = 0x00000001,
+		.reset_cmd = 0x200320D3,
+		.hw_cmd_stop = 0x00000002,
+	},
+	.int_status = {
+		.framedone = CAM_JPEG_HW_MASK_COMP_FRAMEDONE,
+		.resetdone = CAM_JPEG_HW_MASK_COMP_RESET_ACK,
+		.iserror = CAM_JPEG_HW_MASK_COMP_ERR,
+		.stopdone = CAM_JPEG_HW_IRQ_STATUS_STOP_DONE_MASK,
+	},
+	.reg_dump = {
+		.start_offset = 0x0,
+		.end_offset = 0x33C,
+	},
+	.camnoc_misr_support = 0,
+};
+
+#endif /* CAM_JPEG_ENC_HW_INFO_TITAN170_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.c
@@ -0,0 +1,804 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "jpeg_enc_core.h"
+#include "jpeg_enc_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_jpeg_hw_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+
+#define CAM_JPEG_HW_IRQ_IS_FRAME_DONE(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.framedone)
+#define CAM_JPEG_HW_IRQ_IS_RESET_ACK(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.resetdone)
+#define CAM_JPEG_HW_IRQ_IS_ERR(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.iserror)
+#define CAM_JPEG_HW_IRQ_IS_STOP_DONE(jpeg_irq_status, hi) \
+	((jpeg_irq_status) & (hi)->int_status.stopdone)
+
+#define CAM_JPEG_ENC_RESET_TIMEOUT msecs_to_jiffies(500)
+
+int cam_jpeg_enc_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	unsigned long flags;
+	int rc;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+
+	if (!soc_info || !core_info) {
+		CAM_ERR(CAM_JPEG, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	mutex_lock(&core_info->core_mutex);
+	if (++core_info->ref_count > 1) {
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = JPEG_VOTE;
+	axi_vote.axi_path[0].mnoc_ab_bw = JPEG_VOTE;
+	axi_vote.axi_path[0].mnoc_ib_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].mnoc_ab_bw = JPEG_VOTE;
+	axi_vote.axi_path[1].mnoc_ib_bw = JPEG_VOTE;
+
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "cpass start failed: %d", rc);
+		goto cpas_failed;
+	}
+
+	rc = cam_jpeg_enc_enable_soc_resources(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "soc enable is failed %d", rc);
+		goto soc_failed;
+	}
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	jpeg_enc_dev->hw_state = CAM_HW_STATE_POWER_UP;
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+
+	mutex_unlock(&core_info->core_mutex);
+
+	return 0;
+
+soc_failed:
+	cam_cpas_stop(core_info->cpas_handle);
+cpas_failed:
+	--core_info->ref_count;
+	mutex_unlock(&core_info->core_mutex);
+
+	return rc;
+}
+
+int cam_jpeg_enc_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	unsigned long flags;
+	int rc;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	if (!soc_info || !core_info) {
+		CAM_ERR(CAM_JPEG, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	mutex_lock(&core_info->core_mutex);
+	if (--core_info->ref_count > 0) {
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	if (core_info->ref_count < 0) {
+		CAM_ERR(CAM_JPEG, "ref cnt %d", core_info->ref_count);
+		core_info->ref_count = 0;
+		mutex_unlock(&core_info->core_mutex);
+		return -EFAULT;
+	}
+
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	jpeg_enc_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+	rc = cam_jpeg_enc_disable_soc_resources(soc_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "soc disable failed %d", rc);
+
+	rc = cam_cpas_stop(core_info->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "cpas stop failed: %d", rc);
+
+	mutex_unlock(&core_info->core_mutex);
+
+	return 0;
+}
+
+irqreturn_t cam_jpeg_enc_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *jpeg_enc_dev = data;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	uint32_t irq_status = 0;
+	uint32_t encoded_size = 0;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return IRQ_HANDLED;
+	}
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	spin_lock(&jpeg_enc_dev->hw_lock);
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+		return IRQ_HANDLED;
+	}
+	irq_status = cam_io_r_mb(mem_base +
+		core_info->jpeg_enc_hw_info->reg_offset.int_status);
+
+	cam_io_w_mb(irq_status,
+		soc_info->reg_map[0].mem_base +
+		core_info->jpeg_enc_hw_info->reg_offset.int_clr);
+	spin_unlock(&jpeg_enc_dev->hw_lock);
+
+	CAM_DBG(CAM_JPEG, "irq_num %d  irq_status = %x , core_state %d",
+		irq_num, irq_status, core_info->core_state);
+
+	if (CAM_JPEG_HW_IRQ_IS_FRAME_DONE(irq_status, hw_info)) {
+		spin_lock(&jpeg_enc_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_ENC_CORE_READY) {
+			CAM_TRACE(CAM_JPEG, "FrameDone IRQ");
+			encoded_size = cam_io_r_mb(mem_base +
+			core_info->jpeg_enc_hw_info->reg_offset.encode_size);
+			if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+				core_info->irq_cb.jpeg_hw_mgr_cb(irq_status,
+					encoded_size,
+					core_info->irq_cb.data);
+			} else {
+				CAM_ERR(CAM_JPEG, "unexpected done, no cb");
+			}
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected done irq");
+		}
+		core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+	}
+	if (CAM_JPEG_HW_IRQ_IS_RESET_ACK(irq_status, hw_info)) {
+		spin_lock(&jpeg_enc_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_ENC_CORE_RESETTING) {
+			core_info->core_state = CAM_JPEG_ENC_CORE_READY;
+			complete(&jpeg_enc_dev->hw_complete);
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected reset irq");
+		}
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+	}
+	if (CAM_JPEG_HW_IRQ_IS_STOP_DONE(irq_status, hw_info)) {
+		spin_lock(&jpeg_enc_dev->hw_lock);
+		if (core_info->core_state == CAM_JPEG_ENC_CORE_ABORTING) {
+			core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+			complete(&jpeg_enc_dev->hw_complete);
+			if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+				core_info->irq_cb.jpeg_hw_mgr_cb(irq_status,
+					-1,
+					core_info->irq_cb.data);
+			}
+		} else {
+			CAM_ERR(CAM_JPEG, "unexpected abort irq");
+		}
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+	}
+	/* Unexpected/unintended HW interrupt */
+	if (CAM_JPEG_HW_IRQ_IS_ERR(irq_status, hw_info)) {
+		spin_lock(&jpeg_enc_dev->hw_lock);
+		core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+		CAM_ERR_RATE_LIMIT(CAM_JPEG,
+			"error irq_num %d  irq_status = %x , core_state %d",
+			irq_num, irq_status, core_info->core_state);
+
+		if (core_info->irq_cb.jpeg_hw_mgr_cb) {
+			core_info->irq_cb.jpeg_hw_mgr_cb(irq_status,
+				-1,
+				core_info->irq_cb.data);
+		}
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+	}
+
+	return IRQ_HANDLED;
+}
+
+int cam_jpeg_enc_reset_hw(void *data,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = data;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long rem_jiffies;
+	unsigned long flags;
+
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	/* maskdisable.clrirq.maskenable.resetcmd */
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	mutex_lock(&core_info->core_mutex);
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		mutex_unlock(&core_info->core_mutex);
+		return -EINVAL;
+	}
+	if (core_info->core_state == CAM_JPEG_ENC_CORE_RESETTING) {
+		CAM_ERR(CAM_JPEG, "alrady resetting");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	reinit_completion(&jpeg_enc_dev->hw_complete);
+	core_info->core_state = CAM_JPEG_ENC_CORE_RESETTING;
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+
+	cam_io_w_mb(hw_info->reg_val.int_mask_disable_all,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.int_clr_clearall,
+		mem_base + hw_info->reg_offset.int_clr);
+	cam_io_w_mb(hw_info->reg_val.int_mask_enable_all,
+		mem_base + hw_info->reg_offset.int_mask);
+	cam_io_w_mb(hw_info->reg_val.reset_cmd,
+		mem_base + hw_info->reg_offset.reset_cmd);
+
+	rem_jiffies = wait_for_completion_timeout(&jpeg_enc_dev->hw_complete,
+		CAM_JPEG_ENC_RESET_TIMEOUT);
+	if (!rem_jiffies) {
+		CAM_ERR(CAM_JPEG, "error Reset Timeout");
+		core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	return 0;
+}
+
+int cam_jpeg_enc_start_hw(void *data,
+	void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = data;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long flags;
+
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		return -EINVAL;
+	}
+	if (core_info->core_state != CAM_JPEG_ENC_CORE_READY) {
+		CAM_ERR(CAM_JPEG, "Error not ready: %d", core_info->core_state);
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		return -EINVAL;
+	}
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+
+	CAM_DBG(CAM_JPEG, "Starting JPEG ENC");
+	cam_io_w_mb(hw_info->reg_val.hw_cmd_start,
+		mem_base + hw_info->reg_offset.hw_cmd);
+
+	return 0;
+}
+
+int cam_jpeg_enc_stop_hw(void *data,
+	void *stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = data;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	void __iomem *mem_base;
+	unsigned long rem_jiffies;
+	unsigned long flags;
+
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "Invalid args");
+		return -EINVAL;
+	}
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mem_base = soc_info->reg_map[0].mem_base;
+
+	mutex_lock(&core_info->core_mutex);
+	spin_lock_irqsave(&jpeg_enc_dev->hw_lock, flags);
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		mutex_unlock(&core_info->core_mutex);
+		return -EINVAL;
+	}
+	if (core_info->core_state == CAM_JPEG_ENC_CORE_ABORTING) {
+		CAM_ERR(CAM_JPEG, "alrady stopping");
+		spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+		mutex_unlock(&core_info->core_mutex);
+		return 0;
+	}
+
+	reinit_completion(&jpeg_enc_dev->hw_complete);
+	core_info->core_state = CAM_JPEG_ENC_CORE_ABORTING;
+	spin_unlock_irqrestore(&jpeg_enc_dev->hw_lock, flags);
+
+	cam_io_w_mb(hw_info->reg_val.hw_cmd_stop,
+		mem_base + hw_info->reg_offset.hw_cmd);
+
+	rem_jiffies = wait_for_completion_timeout(&jpeg_enc_dev->hw_complete,
+		CAM_JPEG_ENC_RESET_TIMEOUT);
+	if (!rem_jiffies) {
+		CAM_ERR(CAM_JPEG, "error Reset Timeout");
+		core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	return 0;
+}
+
+static int cam_jpeg_enc_hw_dump(
+	struct cam_hw_info           *jpeg_enc_dev,
+	struct cam_jpeg_hw_dump_args *dump_args)
+{
+
+	int                                   i;
+	uint8_t                              *dst;
+	uint32_t                             *addr, *start;
+	uint32_t                              num_reg, min_len;
+	uint32_t                              reg_start_offset;
+	size_t                                remain_len;
+	struct cam_hw_soc_info               *soc_info;
+	struct cam_jpeg_hw_dump_header       *hdr;
+	struct cam_jpeg_enc_device_hw_info   *hw_info;
+	struct cam_jpeg_enc_device_core_info *core_info;
+
+	soc_info = &jpeg_enc_dev->soc_info;
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	hw_info = core_info->jpeg_enc_hw_info;
+	mutex_lock(&core_info->core_mutex);
+	spin_lock(&jpeg_enc_dev->hw_lock);
+
+	if (jpeg_enc_dev->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_ERR(CAM_JPEG, "JPEG HW is in off state");
+		spin_unlock(&jpeg_enc_dev->hw_lock);
+		mutex_unlock(&core_info->core_mutex);
+		return -EINVAL;
+	}
+
+	spin_unlock(&jpeg_enc_dev->hw_lock);
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_JPEG, "dump buffer overshoot %zu %zu",
+			dump_args->buf_len, dump_args->offset);
+		mutex_unlock(&core_info->core_mutex);
+		return -ENOSPC;
+	}
+
+	remain_len = dump_args->buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_jpeg_hw_dump_header) +
+		    soc_info->reg_map[0].size + sizeof(uint32_t);
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_JPEG, "dump buffer exhaust %zu %u",
+			remain_len, min_len);
+		mutex_unlock(&core_info->core_mutex);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_jpeg_hw_dump_header *)dst;
+	snprintf(hdr->tag, CAM_JPEG_HW_DUMP_TAG_MAX_LEN,
+		"JPEG_REG:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_jpeg_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+	num_reg = (hw_info->reg_dump.end_offset -
+		hw_info->reg_dump.start_offset)/4;
+	reg_start_offset = hw_info->reg_dump.start_offset;
+	for (i = 0; i < num_reg; i++) {
+		*addr++ = soc_info->mem_block[0]->start +
+			reg_start_offset + i*4;
+		*addr++ = cam_io_r(soc_info->reg_map[0].mem_base + (i*4));
+	}
+
+	mutex_unlock(&core_info->core_mutex);
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_jpeg_hw_dump_header);
+	CAM_DBG(CAM_JPEG, "offset %zu", dump_args->offset);
+
+	return 0;
+}
+
+static int cam_jpeg_enc_dump_camnoc_misr_val(struct cam_jpeg_enc_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *enc_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	struct cam_jpeg_misr_dump_args       *pmisr_args;
+	int32_t val;
+	uint32_t index = 0;
+	int i;
+	bool mismatch = false;
+	int32_t camnoc_misr_val[CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{0}};
+
+	enc_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	if (!camnoc_mem_base) {
+		CAM_ERR(CAM_JPEG, "Invalid camnoc base address");
+		return -EINVAL;
+	}
+	pmisr_args = (struct cam_jpeg_misr_dump_args *)cmd_args;
+	if (!pmisr_args) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+
+	val = cam_io_r_mb(enc_mem_base + hw_info->reg_offset.core_cfg);
+	index = (val >> hw_info->int_status.scale_enable_shift) &
+		hw_info->int_status.scale_enable;
+	CAM_DBG(CAM_JPEG, "index %d", index);
+
+	for (i = 0; i < hw_info->camnoc_misr_sigdata; i++) {
+		camnoc_misr_val[index][i] = cam_io_r_mb(camnoc_mem_base +
+			hw_info->camnoc_misr_reg_offset.sigdata0 + (i * 8));
+		if (hw_info->prev_camnoc_misr_val[index][i] != camnoc_misr_val[index][i])
+			mismatch = true;
+	}
+	if (mismatch && (pmisr_args->req_id != 1)) {
+		CAM_ERR(CAM_JPEG,
+			"CAMNOC ENC_MISR MISMATCH [req:%d][i:%d][index:%d]\n"
+			"curr SigData:0x%x %x %x %x prev SigData:0x%x %x %x %x isbug:%d",
+			pmisr_args->req_id, i, index,
+			camnoc_misr_val[index][3], camnoc_misr_val[index][2],
+			camnoc_misr_val[index][1], camnoc_misr_val[index][0],
+			hw_info->prev_camnoc_misr_val[index][3],
+			hw_info->prev_camnoc_misr_val[index][2],
+			hw_info->prev_camnoc_misr_val[index][1],
+			hw_info->prev_camnoc_misr_val[index][0], pmisr_args->enable_bug);
+		if (pmisr_args->enable_bug)
+			BUG_ON(1);
+	}
+	CAM_DBG(CAM_JPEG,
+		"CAMNOC ENC MISR req:%d SigData:0x%x %x %x %x",
+		pmisr_args->req_id,
+		camnoc_misr_val[index][3], camnoc_misr_val[index][2],
+		camnoc_misr_val[index][1], camnoc_misr_val[index][0]);
+	mismatch = false;
+	for (i = 0; i < hw_info->camnoc_misr_sigdata; i++)
+		hw_info->prev_camnoc_misr_val[index][i] = camnoc_misr_val[index][i];
+	/* stop misr : cam_noc_cam_noc_0_req_link_misrprb_MiscCtl_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.misc_ctl_stop,
+		camnoc_mem_base + hw_info->camnoc_misr_reg_offset.misc_ctl);
+	return 0;
+}
+
+static int cam_jpeg_enc_dump_hw_misr_val(struct cam_jpeg_enc_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *enc_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	struct cam_jpeg_misr_dump_args       *pmisr_args;
+	int32_t val;
+	uint32_t index = 0;
+	int offset, i, j;
+	bool mismatch = false;
+	int32_t enc_misr_val[CAM_JPEG_ENC_MISR_VAL_NUM][CAM_JPEG_CAMNOC_MISR_VAL_ROW][
+		CAM_JPEG_CAMNOC_MISR_VAL_COL] = {{{0}}};
+
+	enc_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	if (!camnoc_mem_base) {
+		CAM_ERR(CAM_JPEG, "Invalid camnoc base address");
+		return -EINVAL;
+	}
+	pmisr_args = (struct cam_jpeg_misr_dump_args *)cmd_args;
+	if (!pmisr_args) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+
+	val = cam_io_r_mb(enc_mem_base + hw_info->reg_offset.core_cfg);
+	index = (val >> hw_info->int_status.scale_enable_shift) &
+		hw_info->int_status.scale_enable;
+	CAM_DBG(CAM_JPEG, "index %d", index);
+
+	for (i = 0; i < hw_info->max_misr; i++) {
+		offset = hw_info->reg_offset.misr_rd0 + (i * 0x10);
+		for (j = 0; j < hw_info->max_misr_rd; j++) {
+			enc_misr_val[i][index][j] = cam_io_r_mb(enc_mem_base +
+				offset + (j * 4));
+			if (hw_info->prev_enc_misr_val[i][index][j] !=
+				enc_misr_val[i][index][j])
+				mismatch = true;
+		}
+		if (mismatch && (pmisr_args->req_id != 1)) {
+			CAM_ERR(CAM_JPEG,
+				"ENC_MISR RD MISMATCH [req:%d][i:%d][index:%d][j:%d]\n"
+				"curr:0x%x %x %x %x prev:0x%x %x %x %x isbug:%d",
+				pmisr_args->req_id, i, index, j, enc_misr_val[i][index][3],
+				enc_misr_val[i][index][2], enc_misr_val[i][index][1],
+				enc_misr_val[i][index][0], hw_info->prev_enc_misr_val[i][index][3],
+				hw_info->prev_enc_misr_val[i][index][2],
+				hw_info->prev_enc_misr_val[i][index][1],
+				hw_info->prev_enc_misr_val[i][index][0], pmisr_args->enable_bug);
+			if (pmisr_args->enable_bug)
+				BUG_ON(1);
+		}
+		CAM_DBG(CAM_JPEG, "ENC_MISR RD [req:%d][%d]: 0x%x %x %x %x",
+			pmisr_args->req_id, i,
+			enc_misr_val[i][index][3], enc_misr_val[i][index][2],
+			enc_misr_val[i][index][1], enc_misr_val[i][index][0]);
+		mismatch = false;
+
+		for (j = 0; j < hw_info->max_misr_rd; j++)
+			hw_info->prev_enc_misr_val[i][index][j] = enc_misr_val[i][index][j];
+	}
+
+	return 0;
+}
+
+static int cam_jpeg_enc_config_cmanoc_hw_misr(struct cam_jpeg_enc_device_hw_info *hw_info,
+	struct cam_hw_soc_info *soc_info, void *cmd_args)
+{
+	void __iomem                         *enc_mem_base = NULL;
+	void __iomem                         *camnoc_mem_base = NULL;
+	uint32_t                             *camnoc_misr_test = NULL;
+	int val = 0;
+
+	enc_mem_base = soc_info->reg_map[0].mem_base;
+	camnoc_mem_base = soc_info->reg_map[1].mem_base;
+	if (!camnoc_mem_base) {
+		CAM_ERR(CAM_JPEG, "Invalid camnoc base address");
+		return -EINVAL;
+	}
+	camnoc_misr_test = (uint32_t *)cmd_args;
+	if (!camnoc_misr_test) {
+		CAM_ERR(CAM_JPEG, "Invalid command argument");
+		return -EINVAL;
+	}
+
+	/* enable all MISRs */
+	cam_io_w_mb(hw_info->reg_val.misr_cfg, enc_mem_base +
+		hw_info->reg_offset.misr_cfg);
+
+	/* cam_noc_cam_noc_0_req_link_misrprb_MainCtl_Low
+	 * enable CRC generation on both RD, WR and transaction payload
+	 */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.main_ctl, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.main_ctl);
+
+	/* cam_noc_cam_noc_0_req_link_misrprb_IdMask_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.main_ctl, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.id_mask_low);
+
+	/* cam_noc_cam_noc_0_req_link_misrprb_IdValue_Low */
+	switch (*camnoc_misr_test) {
+	case CAM_JPEG_MISR_ID_LOW_RD:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_rd;
+		break;
+	case CAM_JPEG_MISR_ID_LOW_WR:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_wr;
+		break;
+	default:
+		val = hw_info->camnoc_misr_reg_val.id_value_low_rd;
+		break;
+	}
+	cam_io_w_mb(val, camnoc_mem_base +
+		hw_info->camnoc_misr_reg_offset.id_value_low);
+
+	/* start/reset misr : cam_noc_cam_noc_0_req_link_misrprb_MiscCtl_Low */
+	cam_io_w_mb(hw_info->camnoc_misr_reg_val.misc_ctl_start,
+		camnoc_mem_base + hw_info->camnoc_misr_reg_offset.misc_ctl);
+	CAM_DBG(CAM_JPEG, "ENC CAMNOC MISR configured");
+
+	return 0;
+}
+
+int cam_jpeg_enc_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *jpeg_enc_dev = device_priv;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_jpeg_enc_device_hw_info   *hw_info = NULL;
+	struct cam_jpeg_match_pid_args       *match_pid_mid = NULL;
+	uint32_t    *num_pid = NULL;
+	struct cam_hw_soc_info               *soc_info = NULL;
+	int i, rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_JPEG, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd_type >= CAM_JPEG_CMD_MAX) {
+		CAM_ERR(CAM_JPEG, "Invalid command : %x", cmd_type);
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+
+	hw_info = core_info->jpeg_enc_hw_info;
+	soc_info = &jpeg_enc_dev->soc_info;
+
+	switch (cmd_type) {
+	case CAM_JPEG_CMD_SET_IRQ_CB:
+	{
+		struct cam_jpeg_set_irq_cb *irq_cb = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+		if (irq_cb->b_set_cb) {
+			core_info->irq_cb.jpeg_hw_mgr_cb =
+				irq_cb->jpeg_hw_mgr_cb;
+			core_info->irq_cb.data = irq_cb->data;
+		} else {
+			core_info->irq_cb.jpeg_hw_mgr_cb = NULL;
+			core_info->irq_cb.data = NULL;
+		}
+		rc = 0;
+		break;
+	}
+	case CAM_JPEG_CMD_HW_DUMP:
+	{
+		rc = cam_jpeg_enc_hw_dump(jpeg_enc_dev,
+			cmd_args);
+		break;
+	}
+	case CAM_JPEG_CMD_GET_NUM_PID:
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		num_pid = (uint32_t    *)cmd_args;
+		*num_pid = core_info->num_pid;
+
+		break;
+	case CAM_JPEG_CMD_MATCH_PID_MID:
+		match_pid_mid = (struct cam_jpeg_match_pid_args *)cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_JPEG, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		for (i = 0 ; i < core_info->num_pid; i++) {
+			if (core_info->pid[i] == match_pid_mid->pid)
+				break;
+		}
+
+		if (i == core_info->num_pid)
+			match_pid_mid->pid_match_found = false;
+		else
+			match_pid_mid->pid_match_found = true;
+
+		if (match_pid_mid->pid_match_found) {
+			if (match_pid_mid->fault_mid == core_info->rd_mid) {
+				match_pid_mid->match_res =
+					CAM_JPEG_ENC_INPUT_IMAGE;
+			} else if (match_pid_mid->fault_mid ==
+				core_info->wr_mid) {
+				match_pid_mid->match_res =
+					CAM_JPEG_ENC_OUTPUT_IMAGE;
+			} else
+				match_pid_mid->pid_match_found = false;
+		}
+
+		break;
+	case CAM_JPEG_CMD_CONFIG_HW_MISR:
+	{
+		if (hw_info->camnoc_misr_support)
+			rc = cam_jpeg_enc_config_cmanoc_hw_misr(hw_info, soc_info, cmd_args);
+		else
+			CAM_DBG(CAM_JPEG, "camnoc misr is not supported");
+		break;
+	}
+	case CAM_JPEG_CMD_DUMP_HW_MISR_VAL:
+	{
+		if (hw_info->camnoc_misr_support) {
+			rc = cam_jpeg_enc_dump_hw_misr_val(hw_info, soc_info, cmd_args);
+			if (rc)
+				break;
+			rc = cam_jpeg_enc_dump_camnoc_misr_val(hw_info, soc_info, cmd_args);
+		} else {
+			CAM_DBG(CAM_JPEG, "camnoc misr is not supported");
+		}
+		break;
+	}
+	default:
+		rc = -EINVAL;
+		break;
+	}
+	if (rc)
+		CAM_ERR(CAM_JPEG, "error cmdtype %d rc = %d", cmd_type, rc);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_core.h
@@ -0,0 +1,133 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_JPEG_ENC_CORE_H
+#define CAM_JPEG_ENC_CORE_H
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include "cam_jpeg_hw_intf.h"
+
+struct cam_jpeg_enc_reg_offsets {
+	uint32_t hw_version;
+	uint32_t int_status;
+	uint32_t int_clr;
+	uint32_t int_mask;
+	uint32_t hw_cmd;
+	uint32_t reset_cmd;
+	uint32_t encode_size;
+	uint32_t core_cfg;
+	uint32_t misr_cfg;
+	uint32_t misr_rd0;
+};
+
+struct cam_jpeg_enc_regval {
+	uint32_t int_clr_clearall;
+	uint32_t int_mask_disable_all;
+	uint32_t int_mask_enable_all;
+	uint32_t hw_cmd_start;
+	uint32_t reset_cmd;
+	uint32_t hw_cmd_stop;
+	uint32_t misr_cfg;
+};
+
+struct cam_jpeg_enc_int_status {
+	uint32_t framedone;
+	uint32_t resetdone;
+	uint32_t iserror;
+	uint32_t stopdone;
+	uint32_t scale_enable;
+	uint32_t scale_enable_shift;
+};
+
+struct cam_jpeg_enc_reg_dump {
+	uint32_t start_offset;
+	uint32_t end_offset;
+};
+
+struct cam_jpeg_enc_camnoc_misr_reg_offset {
+	uint32_t main_ctl;
+	uint32_t id_mask_low;
+	uint32_t id_value_low;
+	uint32_t misc_ctl;
+	uint32_t sigdata0;
+};
+
+struct cam_jpeg_enc_camnoc_misr_reg_val {
+	uint32_t main_ctl;
+	uint32_t id_mask_low;
+	uint32_t id_value_low_rd;
+	uint32_t id_value_low_wr;
+	uint32_t misc_ctl_start;
+	uint32_t misc_ctl_stop;
+};
+
+struct cam_jpeg_enc_device_hw_info {
+	struct cam_jpeg_enc_reg_offsets reg_offset;
+	struct cam_jpeg_enc_regval reg_val;
+	struct cam_jpeg_enc_int_status int_status;
+	struct cam_jpeg_enc_reg_dump reg_dump;
+	struct cam_jpeg_enc_camnoc_misr_reg_offset camnoc_misr_reg_offset;
+	struct cam_jpeg_enc_camnoc_misr_reg_val camnoc_misr_reg_val;
+	uint32_t max_misr;
+	uint32_t max_misr_rd;
+	uint32_t camnoc_misr_sigdata;
+	uint32_t camnoc_misr_support;
+	int32_t prev_camnoc_misr_val[
+		CAM_JPEG_CAMNOC_MISR_VAL_ROW][CAM_JPEG_CAMNOC_MISR_VAL_COL];
+	int32_t prev_enc_misr_val[CAM_JPEG_ENC_MISR_VAL_NUM][
+		CAM_JPEG_CAMNOC_MISR_VAL_ROW][CAM_JPEG_CAMNOC_MISR_VAL_COL];
+};
+
+enum cam_jpeg_enc_core_state {
+	CAM_JPEG_ENC_CORE_NOT_READY,
+	CAM_JPEG_ENC_CORE_READY,
+	CAM_JPEG_ENC_CORE_RESETTING,
+	CAM_JPEG_ENC_CORE_ABORTING,
+	CAM_JPEG_ENC_CORE_STATE_MAX,
+};
+
+struct cam_jpeg_enc_device_core_info {
+	enum cam_jpeg_enc_core_state core_state;
+	struct cam_jpeg_enc_device_hw_info *jpeg_enc_hw_info;
+	uint32_t cpas_handle;
+	struct cam_jpeg_set_irq_cb irq_cb;
+	int32_t ref_count;
+	struct mutex core_mutex;
+	uint32_t num_pid;
+	uint32_t pid[CAM_JPEG_HW_MAX_NUM_PID];
+	uint32_t rd_mid;
+	uint32_t wr_mid;
+};
+
+int cam_jpeg_enc_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_start_hw(void *device_priv,
+	void *start_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_stop_hw(void *device_priv,
+	void *stop_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_reset_hw(void *device_priv,
+	void *reset_hw_args, uint32_t arg_size);
+int cam_jpeg_enc_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+irqreturn_t cam_jpeg_enc_irq(int irq_num, void *data);
+
+/**
+ * @brief : API to register JPEG ENC hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_jpeg_enc_init_module(void);
+
+/**
+ * @brief : API to remove JPEG ENC Hw from platform framework.
+ */
+void cam_jpeg_enc_exit_module(void);
+#endif /* CAM_JPEG_ENC_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.c
@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+
+#include "jpeg_enc_core.h"
+#include "jpeg_enc_soc.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_jpeg_hw_intf.h"
+#include "cam_jpeg_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_jpeg_enc_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_enc_165_hw_info_ver_4_2_0.h"
+#include "cam_jpeg_enc_580_hw_info_ver_4_2_0.h"
+#include "camera_main.h"
+
+static int cam_jpeg_enc_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_jpeg_enc_device_core_info *core_info,
+	uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = soc_info->dev;
+	memcpy(cpas_register_params.identifier, "jpeg-enc",
+		sizeof("jpeg-enc"));
+	cpas_register_params.cam_cpas_client_cb = NULL;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, "cpas_register failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_jpeg_enc_unregister_cpas(
+	struct cam_jpeg_enc_device_core_info *core_info)
+{
+	int rc;
+
+	rc = cam_cpas_unregister_client(core_info->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "cpas unregister failed: %d", rc);
+	core_info->cpas_handle = 0;
+
+	return rc;
+}
+
+static int cam_jpeg_enc_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *jpeg_enc_dev = NULL;
+	struct cam_hw_intf *jpeg_enc_dev_intf = NULL;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	struct cam_jpeg_enc_device_hw_info *hw_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct cam_jpeg_enc_soc_private  *soc_private;
+	int i;
+	int rc;
+
+	jpeg_enc_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!jpeg_enc_dev_intf)
+		return -ENOMEM;
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &jpeg_enc_dev_intf->hw_idx);
+
+	jpeg_enc_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!jpeg_enc_dev) {
+		rc = -ENOMEM;
+		goto error_alloc_dev;
+	}
+	jpeg_enc_dev->soc_info.pdev = pdev;
+	jpeg_enc_dev->soc_info.dev = &pdev->dev;
+	jpeg_enc_dev->soc_info.dev_name = pdev->name;
+	jpeg_enc_dev_intf->hw_priv = jpeg_enc_dev;
+	jpeg_enc_dev_intf->hw_ops.init = cam_jpeg_enc_init_hw;
+	jpeg_enc_dev_intf->hw_ops.deinit = cam_jpeg_enc_deinit_hw;
+	jpeg_enc_dev_intf->hw_ops.start = cam_jpeg_enc_start_hw;
+	jpeg_enc_dev_intf->hw_ops.stop = cam_jpeg_enc_stop_hw;
+	jpeg_enc_dev_intf->hw_ops.reset = cam_jpeg_enc_reset_hw;
+	jpeg_enc_dev_intf->hw_ops.process_cmd = cam_jpeg_enc_process_cmd;
+	jpeg_enc_dev_intf->hw_type = CAM_JPEG_DEV_ENC;
+
+	platform_set_drvdata(pdev, jpeg_enc_dev_intf);
+	jpeg_enc_dev->core_info =
+		kzalloc(sizeof(struct cam_jpeg_enc_device_core_info),
+			GFP_KERNEL);
+	if (!jpeg_enc_dev->core_info) {
+		rc = -ENOMEM;
+		goto error_alloc_core;
+	}
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		CAM_ERR(CAM_JPEG, " No jpeg_enc hardware info");
+		rc = -EINVAL;
+		goto error_match_dev;
+	}
+	hw_info = (struct cam_jpeg_enc_device_hw_info *)match_dev->data;
+	core_info->jpeg_enc_hw_info = hw_info;
+	core_info->core_state = CAM_JPEG_ENC_CORE_NOT_READY;
+	mutex_init(&core_info->core_mutex);
+
+	rc = cam_jpeg_enc_init_soc_resources(&jpeg_enc_dev->soc_info,
+		cam_jpeg_enc_irq,
+		jpeg_enc_dev);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, " failed to init_soc %d", rc);
+		goto error_init_soc;
+	}
+
+	rc = cam_jpeg_enc_register_cpas(&jpeg_enc_dev->soc_info,
+		core_info, jpeg_enc_dev_intf->hw_idx);
+	if (rc) {
+		CAM_ERR(CAM_JPEG, " failed to reg cpas %d", rc);
+		goto error_reg_cpas;
+	}
+	jpeg_enc_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+	mutex_init(&jpeg_enc_dev->hw_mutex);
+	spin_lock_init(&jpeg_enc_dev->hw_lock);
+	init_completion(&jpeg_enc_dev->hw_complete);
+	CAM_DBG(CAM_JPEG, "JPEG-Encoder component bound successfully");
+
+	soc_private = (struct cam_jpeg_enc_soc_private  *)
+		jpeg_enc_dev->soc_info.soc_private;
+
+	core_info->num_pid = soc_private->num_pid;
+	for (i = 0; i < soc_private->num_pid; i++)
+		core_info->pid[i] = soc_private->pid[i];
+
+	core_info->rd_mid = soc_private->rd_mid;
+	core_info->wr_mid = soc_private->wr_mid;
+
+	return rc;
+
+error_reg_cpas:
+	cam_soc_util_release_platform_resource(&jpeg_enc_dev->soc_info);
+error_init_soc:
+	mutex_destroy(&core_info->core_mutex);
+error_match_dev:
+	kfree(jpeg_enc_dev->core_info);
+error_alloc_core:
+	kfree(jpeg_enc_dev);
+error_alloc_dev:
+	kfree(jpeg_enc_dev_intf);
+
+	return rc;
+}
+
+static void cam_jpeg_enc_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *jpeg_enc_dev = NULL;
+	struct cam_hw_intf *jpeg_enc_dev_intf = NULL;
+	struct cam_jpeg_enc_device_core_info *core_info = NULL;
+	int rc;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	jpeg_enc_dev_intf = platform_get_drvdata(pdev);
+	if (!jpeg_enc_dev_intf) {
+		CAM_ERR(CAM_JPEG, "error No data in pdev");
+		return;
+	}
+
+	jpeg_enc_dev = jpeg_enc_dev_intf->hw_priv;
+	if (!jpeg_enc_dev) {
+		CAM_ERR(CAM_JPEG, "error HW data is NULL");
+		goto free_jpeg_hw_intf;
+	}
+
+	core_info = (struct cam_jpeg_enc_device_core_info *)
+		jpeg_enc_dev->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_JPEG, "error core data NULL");
+		goto deinit_soc;
+	}
+
+	rc = cam_jpeg_enc_unregister_cpas(core_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, " unreg failed to reg cpas %d", rc);
+
+	mutex_destroy(&core_info->core_mutex);
+	kfree(core_info);
+
+deinit_soc:
+	rc = cam_soc_util_release_platform_resource(&jpeg_enc_dev->soc_info);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "Failed to deinit soc rc=%d", rc);
+
+	mutex_destroy(&jpeg_enc_dev->hw_mutex);
+	kfree(jpeg_enc_dev);
+
+free_jpeg_hw_intf:
+	kfree(jpeg_enc_dev_intf);
+}
+
+const static struct component_ops cam_jpeg_enc_component_ops = {
+	.bind = cam_jpeg_enc_component_bind,
+	.unbind = cam_jpeg_enc_component_unbind,
+};
+
+static int cam_jpeg_enc_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_jpeg_enc_component_ops);
+	return 0;
+}
+
+static int cam_jpeg_enc_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_JPEG, "Adding JPEG component");
+	rc = component_add(&pdev->dev, &cam_jpeg_enc_component_ops);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static const struct of_device_id cam_jpeg_enc_dt_match[] = {
+	{
+		.compatible = "qcom,cam_jpeg_enc",
+		.data = &cam_jpeg_enc_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_enc_165",
+		.data = &cam_jpeg_enc_165_hw_info,
+	},
+	{
+		.compatible = "qcom,cam_jpeg_enc_580",
+		.data = &cam_jpeg_enc_580_hw_info,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_jpeg_enc_dt_match);
+
+struct platform_driver cam_jpeg_enc_driver = {
+	.probe = cam_jpeg_enc_probe,
+	.remove = cam_jpeg_enc_remove,
+	.driver = {
+		.name = "cam-jpeg-enc",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_jpeg_enc_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_jpeg_enc_init_module(void)
+{
+	return platform_driver_register(&cam_jpeg_enc_driver);
+}
+
+void cam_jpeg_enc_exit_module(void)
+{
+	platform_driver_unregister(&cam_jpeg_enc_driver);
+}
+
+MODULE_DESCRIPTION("CAM JPEG_ENC driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.c
@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, 2021 The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <media/cam_defs.h>
+#include <media/cam_jpeg.h>
+
+#include "jpeg_enc_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+int cam_jpeg_enc_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t jpeg_enc_irq_handler, void *irq_data)
+{
+	struct cam_jpeg_enc_soc_private  *soc_private;
+	struct platform_device *pdev = NULL;
+	int num_pid = 0, i = 0;
+	int rc;
+
+	soc_private = kzalloc(sizeof(struct cam_jpeg_enc_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_ISP, "Error! soc_private Alloc Failed");
+		return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc)
+		return rc;
+
+	rc = cam_soc_util_request_platform_resource(soc_info,
+		jpeg_enc_irq_handler,
+		irq_data);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "init soc failed %d", rc);
+
+	soc_private->num_pid = 0;
+	soc_private->rd_mid = UINT_MAX;
+	soc_private->wr_mid = UINT_MAX;
+
+	pdev = soc_info->pdev;
+	num_pid = of_property_count_u32_elems(pdev->dev.of_node, "cam_hw_pid");
+	CAM_DBG(CAM_JPEG, "jpeg enc:%d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_JPEG_HW_MAX_NUM_PID)
+		goto end;
+
+	soc_private->num_pid  = num_pid;
+	for (i = 0; i < num_pid; i++)
+		of_property_read_u32_index(pdev->dev.of_node, "cam_hw_pid", i,
+		&soc_private->pid[i]);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cam_hw_rd_mid", &soc_private->rd_mid);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cam_hw_wr_mid", &soc_private->wr_mid);
+end:
+	return rc;
+}
+
+int cam_jpeg_enc_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_SVS_VOTE, true);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "enable platform failed %d", rc);
+
+	return rc;
+}
+
+int cam_jpeg_enc_disable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc)
+		CAM_ERR(CAM_JPEG, "disable platform failed %d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_soc.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2021 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_JPEG_ENC_SOC_H_
+#define _CAM_JPEG_ENC_SOC_H_
+
+#include "cam_soc_util.h"
+#include "cam_jpeg_hw_intf.h"
+
+/*
+ * struct cam_jpeg_enc_soc_private:
+ *
+ * @Brief:                   Private SOC data specific to JPEG ENC Driver
+ *
+ * @num_pid                  JPEG number of pids
+ * @pid:                     JPEG enc pid value list
+ * @rd_mid:                  JPEG enc inport read mid value
+ * @wr_mid:                  JPEG enc outport write mid value
+ */
+struct cam_jpeg_enc_soc_private {
+	uint32_t    num_pid;
+	uint32_t    pid[CAM_JPEG_HW_MAX_NUM_PID];
+	uint32_t    rd_mid;
+	uint32_t    wr_mid;
+};
+
+int cam_jpeg_enc_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t jpeg_enc_irq_handler, void *irq_data);
+
+int cam_jpeg_enc_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_jpeg_enc_disable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_JPEG_ENC_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/cam_lrme_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/cam_lrme_context.c
@@ -0,0 +1,271 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_debug_util.h"
+#include "cam_lrme_context.h"
+
+static const char lrme_dev_name[] = "cam-lrme";
+
+static int __cam_lrme_ctx_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc = 0;
+	uintptr_t ctxt_to_hw_map = (uintptr_t)ctx->ctxt_to_hw_map;
+	struct cam_lrme_context *lrme_ctx = ctx->ctx_priv;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to acquire");
+		return rc;
+	}
+
+	ctxt_to_hw_map |= (lrme_ctx->index << CAM_LRME_CTX_INDEX_SHIFT);
+	ctx->ctxt_to_hw_map = (void *)ctxt_to_hw_map;
+
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to release");
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_start_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_start_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to start");
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACTIVATED;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_config_dev_in_activated(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to config");
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_dump_dev_in_activated(
+	struct cam_context      *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed to dump device");
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_flush_dev_in_activated(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_flush_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed to flush device");
+
+	return rc;
+}
+static int __cam_lrme_ctx_stop_dev_in_activated(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to stop dev");
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_ACQUIRED;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_release_dev_in_activated(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter ctx %d", ctx->ctx_id);
+
+	rc = __cam_lrme_ctx_stop_dev_in_activated(ctx, NULL);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to stop");
+		return rc;
+	}
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to release");
+		return rc;
+	}
+
+	ctx->state = CAM_CTX_AVAILABLE;
+
+	return rc;
+}
+
+static int __cam_lrme_ctx_handle_irq_in_activated(void *context,
+	uint32_t evt_id, void *evt_data)
+{
+	int rc;
+
+	CAM_DBG(CAM_LRME, "Enter");
+
+	rc = cam_context_buf_done_from_hw(context, evt_data, evt_id);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed in buf done, rc=%d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+/* top state machine */
+static struct cam_ctx_ops
+	cam_lrme_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_lrme_ctx_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.config_dev = __cam_lrme_ctx_config_dev_in_activated,
+			.release_dev = __cam_lrme_ctx_release_dev_in_acquired,
+			.start_dev = __cam_lrme_ctx_start_dev_in_acquired,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activate */
+	{
+		.ioctl_ops = {
+			.config_dev = __cam_lrme_ctx_config_dev_in_activated,
+			.release_dev = __cam_lrme_ctx_release_dev_in_activated,
+			.stop_dev = __cam_lrme_ctx_stop_dev_in_activated,
+			.flush_dev = __cam_lrme_ctx_flush_dev_in_activated,
+			.dump_dev = __cam_lrme_ctx_dump_dev_in_activated,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_lrme_ctx_handle_irq_in_activated,
+	},
+};
+
+int cam_lrme_context_init(struct cam_lrme_context *lrme_ctx,
+	struct cam_context *base_ctx,
+	struct cam_hw_mgr_intf *hw_intf,
+	uint32_t index)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter");
+
+	if (!base_ctx || !lrme_ctx) {
+		CAM_ERR(CAM_LRME, "Invalid input");
+		return -EINVAL;
+	}
+
+	memset(lrme_ctx, 0, sizeof(*lrme_ctx));
+
+	rc = cam_context_init(base_ctx, lrme_dev_name, CAM_LRME, index,
+		NULL, hw_intf, lrme_ctx->req_base, CAM_CTX_REQ_MAX);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to init context");
+		return rc;
+	}
+	lrme_ctx->base = base_ctx;
+	lrme_ctx->index = index;
+	base_ctx->ctx_priv = lrme_ctx;
+	base_ctx->state_machine = cam_lrme_ctx_state_machine;
+
+	return rc;
+}
+
+int cam_lrme_context_deinit(struct cam_lrme_context *lrme_ctx)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Enter");
+
+	if (!lrme_ctx) {
+		CAM_ERR(CAM_LRME, "No ctx to deinit");
+		return -EINVAL;
+	}
+
+	rc = cam_context_deinit(lrme_ctx->base);
+
+	memset(lrme_ctx, 0, sizeof(*lrme_ctx));
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/cam_lrme_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/cam_lrme_context.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_CONTEXT_H_
+#define _CAM_LRME_CONTEXT_H_
+
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_interface.h"
+
+#define CAM_LRME_CTX_INDEX_SHIFT 16
+
+/**
+ * struct cam_lrme_context
+ *
+ * @base      : Base context pointer for this LRME context
+ * @req_base  : List of base request for this LRME context
+ */
+struct cam_lrme_context {
+	struct cam_context         *base;
+	struct cam_ctx_request      req_base[CAM_CTX_REQ_MAX];
+	uint64_t index;
+};
+
+int cam_lrme_context_init(struct cam_lrme_context *lrme_ctx,
+	struct cam_context *base_ctx, struct cam_hw_mgr_intf *hw_intf,
+	uint32_t index);
+int cam_lrme_context_deinit(struct cam_lrme_context *lrme_ctx);
+
+#endif /* _CAM_LRME_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/cam_lrme_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/cam_lrme_dev.c
@@ -0,0 +1,284 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_lrme_dev.h"
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_lrme_context.h"
+#include "cam_lrme_hw_mgr.h"
+#include "cam_lrme_hw_mgr_intf.h"
+#include "camera_main.h"
+
+#define CAM_LRME_DEV_NAME "cam-lrme"
+
+/**
+ * struct cam_lrme_dev
+ *
+ * @sd       : Subdev information
+ * @ctx      : List of base contexts
+ * @lrme_ctx : List of LRME contexts
+ * @lock     : Mutex for LRME subdev
+ * @open_cnt : Open count of LRME subdev
+ */
+struct cam_lrme_dev {
+	struct cam_subdev        sd;
+	struct cam_context       ctx[CAM_CTX_MAX];
+	struct cam_lrme_context  lrme_ctx[CAM_CTX_MAX];
+	struct mutex             lock;
+	uint32_t                 open_cnt;
+};
+
+static struct cam_lrme_dev *g_lrme_dev;
+
+static int cam_lrme_dev_buf_done_cb(void *ctxt_to_hw_map, uint32_t evt_id,
+	void *evt_data)
+{
+	uint64_t index;
+	struct cam_context *ctx;
+	int rc;
+
+	index = CAM_LRME_DECODE_CTX_INDEX(ctxt_to_hw_map);
+	CAM_DBG(CAM_LRME, "ctx index %llu, evt_id %u\n", index, evt_id);
+	ctx = &g_lrme_dev->ctx[index];
+	rc = ctx->irq_cb_intf(ctx, evt_id, evt_data);
+	if (rc)
+		CAM_ERR(CAM_LRME, "irq callback failed");
+
+	return rc;
+}
+
+static int cam_lrme_dev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_lrme_dev *lrme_dev = g_lrme_dev;
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
+	if (!lrme_dev) {
+		CAM_ERR(CAM_LRME,
+			"LRME Dev not initialized, dev=%pK", lrme_dev);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+		return -ENODEV;
+	}
+
+	mutex_lock(&lrme_dev->lock);
+	lrme_dev->open_cnt++;
+	mutex_unlock(&lrme_dev->lock);
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
+	return 0;
+}
+
+static int cam_lrme_dev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_lrme_dev *lrme_dev = g_lrme_dev;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	if (!lrme_dev) {
+		CAM_ERR(CAM_LRME, "Invalid args");
+		return -ENODEV;
+	}
+
+	mutex_lock(&lrme_dev->lock);
+	if (lrme_dev->open_cnt <= 0) {
+		CAM_DBG(CAM_LRME, "LRME subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	lrme_dev->open_cnt--;
+	if (!node) {
+		CAM_ERR(CAM_LRME, "Node is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (lrme_dev->open_cnt == 0)
+		cam_node_shutdown(node);
+
+end:
+	mutex_unlock(&lrme_dev->lock);
+	return rc;
+}
+
+static int cam_lrme_dev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_LRME, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+	return cam_lrme_dev_close_internal(sd, fh);
+}
+
+static const struct v4l2_subdev_internal_ops cam_lrme_subdev_internal_ops = {
+	.open = cam_lrme_dev_open,
+	.close = cam_lrme_dev_close,
+};
+
+static int cam_lrme_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+	int i;
+	struct cam_hw_mgr_intf hw_mgr_intf;
+	struct cam_node *node;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	g_lrme_dev = kzalloc(sizeof(struct cam_lrme_dev), GFP_KERNEL);
+	if (!g_lrme_dev) {
+		CAM_ERR(CAM_LRME, "No memory");
+		return -ENOMEM;
+	}
+	g_lrme_dev->sd.internal_ops = &cam_lrme_subdev_internal_ops;
+	g_lrme_dev->sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	mutex_init(&g_lrme_dev->lock);
+
+	rc = cam_subdev_probe(&g_lrme_dev->sd, pdev, CAM_LRME_DEV_NAME,
+		CAM_LRME_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "LRME cam_subdev_probe failed");
+		goto free_mem;
+	}
+	node = (struct cam_node *)g_lrme_dev->sd.token;
+
+	rc = cam_lrme_hw_mgr_init(&hw_mgr_intf, cam_lrme_dev_buf_done_cb);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Can not initialized LRME HW manager");
+		goto unregister;
+	}
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_lrme_context_init(&g_lrme_dev->lrme_ctx[i],
+				&g_lrme_dev->ctx[i],
+				&node->hw_mgr_intf, i);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "LRME context init failed");
+			goto deinit_ctx;
+		}
+	}
+
+	rc = cam_node_init(node, &hw_mgr_intf, g_lrme_dev->ctx, CAM_CTX_MAX,
+		CAM_LRME_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "LRME node init failed");
+		goto deinit_ctx;
+	}
+
+	node->sd_handler = cam_lrme_dev_close_internal;
+	rc = cam_subdev_register(&g_lrme_dev->sd, pdev);
+	CAM_DBG(CAM_LRME, "Component bound successfully");
+
+	return rc;
+
+deinit_ctx:
+	for (--i; i >= 0; i--) {
+		if (cam_lrme_context_deinit(&g_lrme_dev->lrme_ctx[i]))
+			CAM_ERR(CAM_LRME, "LRME context %d deinit failed", i);
+	}
+unregister:
+	if (cam_subdev_remove(&g_lrme_dev->sd))
+		CAM_ERR(CAM_LRME, "Failed in subdev remove");
+free_mem:
+	kfree(g_lrme_dev);
+
+	return rc;
+}
+
+static void cam_lrme_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+	int rc = 0;
+
+	for (i = 0; i < CAM_CTX_MAX; i++) {
+		rc = cam_lrme_context_deinit(&g_lrme_dev->lrme_ctx[i]);
+		if (rc)
+			CAM_ERR(CAM_LRME, "LRME context %d deinit failed", i);
+	}
+
+	rc = cam_lrme_hw_mgr_deinit();
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed in hw mgr deinit, rc=%d", rc);
+
+	rc = cam_unregister_subdev(&g_lrme_dev->sd);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Unregister failed rc: %d", rc);
+
+	rc = cam_subdev_remove(&g_lrme_dev->sd);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Subdev remove failed rc: %d", rc);
+
+	mutex_destroy(&g_lrme_dev->lock);
+	kfree(g_lrme_dev);
+	g_lrme_dev = NULL;
+}
+
+const static struct component_ops cam_lrme_component_ops = {
+	.bind = cam_lrme_component_bind,
+	.unbind = cam_lrme_component_unbind,
+};
+
+static int cam_lrme_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Adding LRME component");
+	rc = component_add(&pdev->dev, &cam_lrme_component_ops);
+	if (rc)
+		CAM_ERR(CAM_LRME, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_lrme_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_lrme_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_lrme_dt_match[] = {
+	{
+		.compatible = "qcom,cam-lrme"
+	},
+	{}
+};
+
+struct platform_driver cam_lrme_driver = {
+	.probe = cam_lrme_dev_probe,
+	.remove = cam_lrme_dev_remove,
+	.driver = {
+		.name = "cam_lrme",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_lrme_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_lrme_dev_init_module(void)
+{
+	return platform_driver_register(&cam_lrme_driver);
+}
+
+void cam_lrme_dev_exit_module(void)
+{
+	platform_driver_unregister(&cam_lrme_driver);
+}
+
+MODULE_DESCRIPTION("MSM LRME driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/cam_lrme_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/cam_lrme_dev.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_DEV_H_
+#define _CAM_LRME_DEV_H_
+
+/**
+ * @brief : API to register LRME dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_lrme_dev_init_module(void);
+
+/**
+ * @brief : API to remove LRME dev from platform framework.
+ */
+void cam_lrme_dev_exit_module(void);
+
+#endif /* _CAM_LRME_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
@@ -0,0 +1,1237 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_sync.h>
+
+#include "cam_io_util.h"
+#include "cam_soc_util.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_smmu_api.h"
+#include "cam_packet_util.h"
+#include "cam_lrme_context.h"
+#include "cam_lrme_hw_intf.h"
+#include "cam_lrme_hw_core.h"
+#include "cam_lrme_hw_soc.h"
+#include "cam_lrme_hw_mgr_intf.h"
+#include "cam_lrme_hw_mgr.h"
+
+static struct cam_lrme_hw_mgr g_lrme_hw_mgr;
+
+static int cam_lrme_mgr_util_reserve_device(struct cam_lrme_hw_mgr *hw_mgr,
+	struct cam_lrme_acquire_args *lrme_acquire_args)
+{
+	int i, index = 0;
+	uint32_t min_ctx = UINT_MAX;
+	struct cam_lrme_device *hw_device = NULL;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (!hw_mgr->device_count) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_LRME, "No device is registered");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < hw_mgr->device_count && i < CAM_LRME_HW_MAX; i++) {
+		hw_device = &hw_mgr->hw_device[i];
+		if (!hw_device->num_context) {
+			index = i;
+			break;
+		}
+		if (hw_device->num_context < min_ctx) {
+			min_ctx = hw_device->num_context;
+			index = i;
+		}
+	}
+
+	hw_device = &hw_mgr->hw_device[index];
+	hw_device->num_context++;
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_LRME, "reserve device index %d", index);
+
+	return index;
+}
+
+static int cam_lrme_mgr_util_get_device(struct cam_lrme_hw_mgr *hw_mgr,
+	uint32_t device_index, struct cam_lrme_device **hw_device)
+{
+	if (!hw_mgr) {
+		CAM_ERR(CAM_LRME, "invalid params hw_mgr %pK", hw_mgr);
+		return -EINVAL;
+	}
+
+	if (device_index >= CAM_LRME_HW_MAX) {
+		CAM_ERR(CAM_LRME, "Wrong device index %d", device_index);
+		return -EINVAL;
+	}
+
+	*hw_device = &hw_mgr->hw_device[device_index];
+
+	return 0;
+}
+
+static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet,
+	size_t remain_len)
+{
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	int i, rc;
+
+	if (!packet) {
+		CAM_ERR(CAM_LRME, "Invalid args");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_LRME, "Packet request=%d, op_code=0x%x, size=%d, flags=%d",
+		packet->header.request_id, packet->header.op_code,
+		packet->header.size, packet->header.flags);
+	CAM_DBG(CAM_LRME,
+		"Packet cmdbuf(offset=%d, num=%d) io(offset=%d, num=%d)",
+		packet->cmd_buf_offset, packet->num_cmd_buf,
+		packet->io_configs_offset, packet->num_io_configs);
+	CAM_DBG(CAM_LRME,
+		"Packet Patch(offset=%d, num=%d) kmd(offset=%d, num=%d)",
+		packet->patch_offset, packet->num_patches,
+		packet->kmd_cmd_buf_offset, packet->kmd_cmd_buf_index);
+
+	if (cam_packet_util_validate_packet(packet, remain_len)) {
+		CAM_ERR(CAM_LRME, "invalid packet:%d %d %d %d %d",
+			packet->kmd_cmd_buf_index,
+			packet->num_cmd_buf, packet->cmd_buf_offset,
+			packet->io_configs_offset, packet->header.size);
+		return -EINVAL;
+	}
+
+	if (!packet->num_io_configs) {
+		CAM_ERR(CAM_LRME, "no io configs");
+		return -EINVAL;
+	}
+
+	if (!packet->num_cmd_buf) {
+		CAM_ERR(CAM_LRME, "no cmd bufs");
+		return -EINVAL;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *)((uint8_t *)&packet->payload_flex +
+		packet->cmd_buf_offset);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		CAM_DBG(CAM_LRME,
+			"CmdBuf[%d] hdl=%d, offset=%d, size=%d, len=%d, type=%d, meta_data=%d",
+			i,
+			cmd_desc[i].mem_handle, cmd_desc[i].offset,
+			cmd_desc[i].size, cmd_desc[i].length, cmd_desc[i].type,
+			cmd_desc[i].meta_data);
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Invalid cmd buffer %d", i);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_lrme_hw_io_buffer *input_buf,
+	struct cam_lrme_hw_io_buffer *output_buf, uint32_t io_buf_size)
+{
+	int rc = -EINVAL;
+	uint32_t num_in_buf, num_out_buf, i, j, plane;
+	struct cam_buf_io_cfg *io_cfg;
+	dma_addr_t io_addr[CAM_PACKET_MAX_PLANES];
+	size_t size;
+
+	num_in_buf = 0;
+	num_out_buf = 0;
+	io_cfg = (struct cam_buf_io_cfg *)((uint8_t *)
+		 &prepare->packet->payload_flex +
+		 prepare->packet->io_configs_offset);
+
+	for (i = 0; i < prepare->packet->num_io_configs; i++) {
+		CAM_DBG(CAM_LRME,
+			"IOConfig[%d] : handle[%d] Dir[%d] Res[%d] Fence[%d], Format[%d]",
+			i, io_cfg[i].mem_handle[0], io_cfg[i].direction,
+			io_cfg[i].resource_type,
+			io_cfg[i].fence, io_cfg[i].format);
+
+		memset(io_addr, 0, sizeof(io_addr));
+		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {
+			if (!io_cfg[i].mem_handle[plane])
+				break;
+
+			rc = cam_mem_get_io_buf(io_cfg[i].mem_handle[plane],
+				iommu_hdl, &io_addr[plane], &size);
+			if (rc) {
+				CAM_ERR(CAM_LRME, "Cannot get io buf for %d %d",
+					plane, rc);
+				return -ENOMEM;
+			}
+
+			if ((size_t)io_cfg[i].offsets[plane] >= size) {
+				CAM_ERR(CAM_LRME, "Invalid plane offset: %zu",
+					(size_t)io_cfg[i].offsets[plane]);
+				return -EINVAL;
+			}
+
+			io_addr[plane] += io_cfg[i].offsets[plane];
+
+			CAM_DBG(CAM_LRME, "IO Address[%d][%d] : %llu",
+				io_cfg[i].direction, plane, io_addr[plane]);
+		}
+
+		switch (io_cfg[i].direction) {
+		case CAM_BUF_INPUT: {
+			if (num_in_buf >= io_buf_size) {
+				CAM_ERR(CAM_LRME,
+					"Invalid number of buffers %d %d %d",
+					num_in_buf, num_out_buf, io_buf_size);
+				return -EINVAL;
+			}
+			prepare->in_map_entries[num_in_buf].resource_handle =
+				io_cfg[i].resource_type;
+			prepare->in_map_entries[num_in_buf].sync_id =
+				io_cfg[i].fence;
+
+			input_buf[num_in_buf].valid = true;
+			for (j = 0; j < plane; j++)
+				input_buf[num_in_buf].io_addr[j] = io_addr[j];
+			input_buf[num_in_buf].num_plane = plane;
+			input_buf[num_in_buf].io_cfg = &io_cfg[i];
+
+			num_in_buf++;
+			break;
+		}
+		case CAM_BUF_OUTPUT: {
+			if (num_out_buf >= io_buf_size) {
+				CAM_ERR(CAM_LRME,
+					"Invalid number of buffers %d %d %d",
+					num_in_buf, num_out_buf, io_buf_size);
+				return -EINVAL;
+			}
+			prepare->out_map_entries[num_out_buf].resource_handle =
+				io_cfg[i].resource_type;
+			prepare->out_map_entries[num_out_buf].sync_id =
+				io_cfg[i].fence;
+
+			output_buf[num_out_buf].valid = true;
+			for (j = 0; j < plane; j++)
+				output_buf[num_out_buf].io_addr[j] = io_addr[j];
+			output_buf[num_out_buf].num_plane = plane;
+			output_buf[num_out_buf].io_cfg = &io_cfg[i];
+
+			num_out_buf++;
+			break;
+		}
+		default:
+			CAM_ERR(CAM_LRME, "Unsupported io direction %d",
+				io_cfg[i].direction);
+			return -EINVAL;
+		}
+	}
+	prepare->num_in_map_entries = num_in_buf;
+	prepare->num_out_map_entries = num_out_buf;
+
+	return 0;
+}
+
+static int cam_lrme_mgr_util_prepare_hw_update_entries(
+	struct cam_lrme_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_lrme_hw_cmd_config_args *config_args,
+	struct cam_kmd_buf_info *kmd_buf_info)
+{
+	int i, rc = 0;
+	struct cam_lrme_device *hw_device = NULL;
+	uint32_t *kmd_buf_addr;
+	uint32_t num_entry;
+	uint32_t kmd_buf_max_size;
+	uint32_t kmd_buf_used_bytes = 0;
+	struct cam_hw_update_entry *hw_entry;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+
+	hw_device = config_args->hw_device;
+	if (!hw_device) {
+		CAM_ERR(CAM_LRME, "Invalid hw_device");
+		return -EINVAL;
+	}
+
+	kmd_buf_addr = (uint32_t *)((uint8_t *)kmd_buf_info->cpu_addr +
+		kmd_buf_info->used_bytes);
+	kmd_buf_max_size = kmd_buf_info->size - kmd_buf_info->used_bytes;
+
+	config_args->cmd_buf_addr = kmd_buf_addr;
+	config_args->size = kmd_buf_max_size;
+	config_args->config_buf_size = 0;
+
+	if (hw_device->hw_intf.hw_ops.process_cmd) {
+		rc = hw_device->hw_intf.hw_ops.process_cmd(
+			hw_device->hw_intf.hw_priv,
+			CAM_LRME_HW_CMD_PREPARE_HW_UPDATE,
+			config_args,
+			sizeof(struct cam_lrme_hw_cmd_config_args));
+		if (rc) {
+			CAM_ERR(CAM_LRME,
+				"Failed in CMD_PREPARE_HW_UPDATE %d", rc);
+			return rc;
+		}
+	} else {
+		CAM_ERR(CAM_LRME, "Can't find handle function");
+		return -EINVAL;
+	}
+
+	kmd_buf_used_bytes += config_args->config_buf_size;
+
+	if (!kmd_buf_used_bytes || (kmd_buf_used_bytes > kmd_buf_max_size)) {
+		CAM_ERR(CAM_LRME, "Invalid kmd used bytes %d (%d)",
+			kmd_buf_used_bytes, kmd_buf_max_size);
+		return -ENOMEM;
+	}
+
+	hw_entry = prepare->hw_update_entries;
+	num_entry = 0;
+
+	if (config_args->config_buf_size) {
+		if ((num_entry + 1) >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_LRME, "Insufficient  HW entries :%d %d",
+				num_entry, prepare->max_hw_update_entries);
+			return -EINVAL;
+		}
+
+		hw_entry[num_entry].handle = kmd_buf_info->handle;
+		hw_entry[num_entry].len = config_args->config_buf_size;
+		hw_entry[num_entry].offset = kmd_buf_info->offset;
+
+		kmd_buf_info->used_bytes += config_args->config_buf_size;
+		kmd_buf_info->offset += config_args->config_buf_size;
+		num_entry++;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *)((uint8_t *)
+		&prepare->packet->payload_flex + prepare->packet->cmd_buf_offset);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		if ((num_entry + 1) >= prepare->max_hw_update_entries) {
+			CAM_ERR(CAM_LRME, "Exceed max num of entry");
+			return -EINVAL;
+		}
+		hw_entry[num_entry].handle = cmd_desc[i].mem_handle;
+		hw_entry[num_entry].len = cmd_desc[i].length;
+		hw_entry[num_entry].offset = cmd_desc[i].offset;
+		num_entry++;
+	}
+	prepare->num_hw_update_entries = num_entry;
+
+	CAM_DBG(CAM_LRME, "FinalConfig : hw_entries=%d, Sync(in=%d, out=%d)",
+		prepare->num_hw_update_entries, prepare->num_in_map_entries,
+		prepare->num_out_map_entries);
+
+	return rc;
+}
+
+static void cam_lrme_mgr_util_put_frame_req(
+	struct list_head *src_list,
+	struct list_head *list,
+	spinlock_t *lock)
+{
+	spin_lock(lock);
+	list_add_tail(list, src_list);
+	spin_unlock(lock);
+}
+
+static int cam_lrme_mgr_util_get_frame_req(
+	struct list_head *src_list,
+	struct cam_lrme_frame_request **frame_req,
+	spinlock_t *lock)
+{
+	int rc = 0;
+	struct cam_lrme_frame_request *req_ptr = NULL;
+
+	spin_lock(lock);
+	if (!list_empty(src_list)) {
+		req_ptr = list_first_entry(src_list,
+			struct cam_lrme_frame_request, frame_list);
+		list_del_init(&req_ptr->frame_list);
+	} else {
+		rc = -ENOENT;
+	}
+	*frame_req = req_ptr;
+	spin_unlock(lock);
+
+	return rc;
+}
+
+
+static int cam_lrme_mgr_util_submit_req(void *priv, void *data)
+{
+	struct cam_lrme_device *hw_device;
+	struct cam_lrme_hw_mgr *hw_mgr;
+	struct cam_lrme_frame_request *frame_req = NULL;
+	struct cam_lrme_hw_submit_args submit_args;
+	struct cam_lrme_mgr_work_data *work_data;
+	int rc;
+	int req_prio = 0;
+
+	if (!priv) {
+		CAM_ERR(CAM_LRME, "worker doesn't have private data");
+		return -EINVAL;
+	}
+
+	hw_mgr = (struct cam_lrme_hw_mgr *)priv;
+	work_data = (struct cam_lrme_mgr_work_data *)data;
+	hw_device = work_data->hw_device;
+
+	rc = cam_lrme_mgr_util_get_frame_req(
+		&hw_device->frame_pending_list_high, &frame_req,
+		&hw_device->high_req_lock);
+
+	if (!frame_req) {
+		rc = cam_lrme_mgr_util_get_frame_req(
+			&hw_device->frame_pending_list_normal, &frame_req,
+			&hw_device->normal_req_lock);
+		if (frame_req)
+			req_prio = 1;
+	}
+
+	if (!frame_req) {
+		CAM_DBG(CAM_LRME, "No pending request");
+		return 0;
+	}
+
+	if (hw_device->hw_intf.hw_ops.process_cmd) {
+		submit_args.hw_update_entries = frame_req->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			frame_req->num_hw_update_entries;
+		submit_args.frame_req = frame_req;
+
+		rc = hw_device->hw_intf.hw_ops.process_cmd(
+			hw_device->hw_intf.hw_priv,
+			CAM_LRME_HW_CMD_SUBMIT,
+			&submit_args, sizeof(struct cam_lrme_hw_submit_args));
+
+		if (rc) {
+			if (rc == -EBUSY) {
+				CAM_DBG(CAM_LRME, "device busy");
+
+				req_prio == 0 ?
+					spin_lock(&hw_device->high_req_lock) :
+					spin_lock(&hw_device->normal_req_lock);
+				list_add(&frame_req->frame_list,
+					(req_prio == 0 ?
+					&hw_device->frame_pending_list_high :
+					&hw_device->frame_pending_list_normal));
+				req_prio == 0 ?
+					spin_unlock(&hw_device->high_req_lock) :
+					spin_unlock(
+						&hw_device->normal_req_lock);
+				rc = 0;
+			} else
+				CAM_ERR(CAM_LRME,
+					"submit request failed for frame req id: %llu rc %d",
+					frame_req->req_id, rc);
+		}
+	} else {
+		req_prio == 0 ? spin_lock(&hw_device->high_req_lock) :
+			spin_lock(&hw_device->normal_req_lock);
+		list_add(&frame_req->frame_list,
+			(req_prio == 0 ?
+			 &hw_device->frame_pending_list_high :
+			 &hw_device->frame_pending_list_normal));
+		req_prio == 0 ? spin_unlock(&hw_device->high_req_lock) :
+			spin_unlock(&hw_device->normal_req_lock);
+		rc = -EINVAL;
+	}
+
+	CAM_DBG(CAM_LRME, "End of submit, rc %d", rc);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_util_schedule_frame_req(
+	struct cam_lrme_hw_mgr *hw_mgr, struct cam_lrme_device *hw_device)
+{
+	int rc = 0;
+	struct crm_workq_task *task;
+	struct cam_lrme_mgr_work_data *work_data;
+
+	task = cam_req_mgr_workq_get_task(hw_device->work);
+	if (!task) {
+		CAM_ERR(CAM_LRME, "Can not get task for worker");
+		return -ENOMEM;
+	}
+
+	work_data = (struct cam_lrme_mgr_work_data *)task->payload;
+	work_data->hw_device = hw_device;
+
+	task->process_cb = cam_lrme_mgr_util_submit_req;
+	CAM_DBG(CAM_LRME, "enqueue submit task");
+	rc = cam_req_mgr_workq_enqueue_task(task, hw_mgr, CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_util_release(struct cam_lrme_hw_mgr *hw_mgr,
+	uint32_t device_index)
+{
+	int rc = 0;
+	struct cam_lrme_device *hw_device;
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in getting device %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	hw_device->num_context--;
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_cb(void *data,
+	struct cam_lrme_hw_cb_args *cb_args)
+{
+	struct cam_lrme_hw_mgr *hw_mgr = &g_lrme_hw_mgr;
+	int rc = 0;
+	uint32_t evt_id = CAM_CTX_EVT_ID_ERROR;
+	struct cam_lrme_frame_request *frame_req;
+	struct cam_lrme_device *hw_device;
+
+	if (!data || !cb_args) {
+		CAM_ERR(CAM_LRME, "Invalid input args");
+		return -EINVAL;
+	}
+
+	hw_device = (struct cam_lrme_device *)data;
+	frame_req = cb_args->frame_req;
+
+	if (cb_args->cb_type & CAM_LRME_CB_PUT_FRAME) {
+		memset(frame_req, 0x0, sizeof(*frame_req));
+		INIT_LIST_HEAD(&frame_req->frame_list);
+		cam_lrme_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+				&frame_req->frame_list,
+				&hw_mgr->free_req_lock);
+		cb_args->cb_type &= ~CAM_LRME_CB_PUT_FRAME;
+		frame_req = NULL;
+	}
+
+	if (cb_args->cb_type & CAM_LRME_CB_COMP_REG_UPDATE) {
+		cb_args->cb_type &= ~CAM_LRME_CB_COMP_REG_UPDATE;
+		CAM_DBG(CAM_LRME, "Reg update");
+	}
+
+	if (!frame_req)
+		return rc;
+
+	if (cb_args->cb_type & CAM_LRME_CB_BUF_DONE) {
+		cb_args->cb_type &= ~CAM_LRME_CB_BUF_DONE;
+		evt_id = CAM_CTX_EVT_ID_SUCCESS;
+	} else if (cb_args->cb_type & CAM_LRME_CB_ERROR) {
+		cb_args->cb_type &= ~CAM_LRME_CB_ERROR;
+		evt_id = CAM_CTX_EVT_ID_ERROR;
+	} else {
+		CAM_ERR(CAM_LRME, "Wrong cb type %d, req %lld",
+			cb_args->cb_type, frame_req->req_id);
+		return -EINVAL;
+	}
+
+	if (hw_mgr->event_cb) {
+		struct cam_hw_done_event_data buf_data;
+
+		buf_data.request_id = frame_req->req_id;
+		buf_data.evt_param = (cb_args->cb_type & CAM_LRME_CB_ERROR) ?
+			CAM_SYNC_LRME_EVENT_CB_ERROR :
+			CAM_SYNC_COMMON_EVENT_SUCCESS;
+		CAM_DBG(CAM_LRME, "frame req %llu, evt_id %d",
+			frame_req->req_id, evt_id);
+		rc = hw_mgr->event_cb(frame_req->ctxt_to_hw_map,
+			evt_id, &buf_data);
+	} else {
+		CAM_ERR(CAM_LRME, "No cb function");
+	}
+	memset(frame_req, 0x0, sizeof(*frame_req));
+	INIT_LIST_HEAD(&frame_req->frame_list);
+	cam_lrme_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+				&frame_req->frame_list,
+				&hw_mgr->free_req_lock);
+
+	rc = cam_lrme_mgr_util_schedule_frame_req(hw_mgr, hw_device);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_get_caps(void *hw_mgr_priv, void *hw_get_caps_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_query_cap_cmd *args = hw_get_caps_args;
+
+	if (sizeof(struct cam_lrme_query_cap_cmd) != args->size) {
+		CAM_ERR(CAM_LRME,
+			"sizeof(struct cam_query_cap_cmd) = %zu, args->size = %d",
+			sizeof(struct cam_query_cap_cmd), args->size);
+		return -EFAULT;
+	}
+
+	if (copy_to_user(u64_to_user_ptr(args->caps_handle),
+		&(hw_mgr->lrme_caps),
+		sizeof(struct cam_lrme_query_cap_cmd))) {
+		CAM_ERR(CAM_LRME, "copy to user failed");
+		return -EFAULT;
+	}
+
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_acquire(void *hw_mgr_priv, void *hw_acquire_args)
+{
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_acquire_args *args =
+		(struct cam_hw_acquire_args *)hw_acquire_args;
+	struct cam_lrme_acquire_args lrme_acquire_args;
+	uintptr_t device_index;
+
+	if (!hw_mgr_priv || !args) {
+		CAM_ERR(CAM_LRME,
+		"Invalid input params hw_mgr_priv %pK, acquire_args %pK",
+		hw_mgr_priv, args);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&lrme_acquire_args,
+		(void __user *)args->acquire_info,
+		sizeof(struct cam_lrme_acquire_args))) {
+		CAM_ERR(CAM_LRME, "Failed to copy acquire args from user");
+		return -EFAULT;
+	}
+
+	device_index = cam_lrme_mgr_util_reserve_device(hw_mgr,
+		&lrme_acquire_args);
+	CAM_DBG(CAM_LRME, "Get device id %llu", device_index);
+
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Get wrong device id %lu", device_index);
+		return -EINVAL;
+	}
+
+	/* device_index is the right 4 bit in ctxt_to_hw_map */
+	args->ctxt_to_hw_map = (void *)device_index;
+
+	return 0;
+}
+
+static int cam_lrme_mgr_hw_release(void *hw_mgr_priv, void *hw_release_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_release_args *args =
+		(struct cam_hw_release_args *)hw_release_args;
+	uint64_t device_index;
+
+	if (!hw_mgr_priv || !hw_release_args) {
+		CAM_ERR(CAM_LRME, "Invalid arguments %pK, %pK",
+			hw_mgr_priv, hw_release_args);
+		return -EINVAL;
+	}
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %llu", device_index);
+		return -EPERM;
+	}
+
+	rc = cam_lrme_mgr_util_release(hw_mgr, device_index);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed in release device, rc=%d", rc);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_dump(void *hw_mgr_priv, void *hw_dump_args)
+{
+	struct cam_hw_dump_args *dump_args = hw_dump_args;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_lrme_device *hw_device;
+	int rc = 0;
+	uint32_t device_index;
+	struct cam_lrme_hw_dump_args lrme_dump_args;
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(dump_args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_LRME, "Start device index %d", device_index);
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to get hw device");
+		return rc;
+	}
+	rc  = cam_mem_get_cpu_buf(dump_args->buf_handle,
+		&lrme_dump_args.cpu_addr,
+		&lrme_dump_args.buf_len);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+	lrme_dump_args.offset =  dump_args->offset;
+	lrme_dump_args.request_id = dump_args->request_id;
+
+	rc = hw_device->hw_intf.hw_ops.process_cmd(
+		hw_device->hw_intf.hw_priv,
+		CAM_LRME_HW_CMD_DUMP,
+		&lrme_dump_args,
+		sizeof(struct cam_lrme_hw_dump_args));
+	CAM_DBG(CAM_LRME, "Offset before %zu after %zu",
+		dump_args->offset, lrme_dump_args.offset);
+	dump_args->offset = lrme_dump_args.offset;
+	cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_flush(void *hw_mgr_priv, void *hw_flush_args)
+{	int rc = 0, i;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_flush_args *args;
+	struct cam_lrme_device *hw_device;
+	struct cam_lrme_frame_request *frame_req = NULL, *req_to_flush = NULL;
+	struct cam_lrme_frame_request *frame_req_temp = NULL;
+	struct cam_lrme_frame_request **req_list = NULL;
+	uint32_t device_index;
+	struct cam_lrme_hw_flush_args lrme_flush_args;
+	uint32_t priority;
+
+	if (!hw_mgr_priv || !hw_flush_args) {
+		CAM_ERR(CAM_LRME, "Invalid args %pK %pK",
+			hw_mgr_priv, hw_flush_args);
+		return -EINVAL;
+	}
+
+	args = (struct cam_hw_flush_args *)hw_flush_args;
+	device_index = ((uintptr_t)args->ctxt_to_hw_map & 0xF);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in getting device %d", rc);
+		goto end;
+	}
+
+	spin_lock(&hw_device->high_req_lock);
+	list_for_each_entry_safe(frame_req, frame_req_temp,
+		&hw_device->frame_pending_list_high, frame_list) {
+		list_del_init(&frame_req->frame_list);
+	}
+	spin_unlock(&hw_device->high_req_lock);
+
+	spin_lock(&hw_device->normal_req_lock);
+	list_for_each_entry_safe(frame_req, frame_req_temp,
+		&hw_device->frame_pending_list_normal, frame_list) {
+		list_del_init(&frame_req->frame_list);
+	}
+	spin_unlock(&hw_device->normal_req_lock);
+
+	req_list = (struct cam_lrme_frame_request **)args->flush_req_pending;
+	for (i = 0; i < args->num_req_pending; i++) {
+		frame_req = req_list[i];
+		memset(frame_req, 0x0, sizeof(*frame_req));
+		cam_lrme_mgr_util_put_frame_req(&hw_mgr->frame_free_list,
+			&frame_req->frame_list, &hw_mgr->free_req_lock);
+	}
+
+	req_list = (struct cam_lrme_frame_request **)args->flush_req_active;
+	for (i = 0; i < args->num_req_active; i++) {
+		frame_req = req_list[i];
+		priority = CAM_LRME_DECODE_PRIORITY(args->ctxt_to_hw_map);
+		spin_lock((priority == CAM_LRME_PRIORITY_HIGH) ?
+			&hw_device->high_req_lock :
+			&hw_device->normal_req_lock);
+		if (!list_empty(&frame_req->frame_list)) {
+			list_del_init(&frame_req->frame_list);
+			cam_lrme_mgr_util_put_frame_req(
+				&hw_mgr->frame_free_list,
+				&frame_req->frame_list,
+				&hw_mgr->free_req_lock);
+		} else
+			req_to_flush = frame_req;
+		spin_unlock((priority == CAM_LRME_PRIORITY_HIGH) ?
+			&hw_device->high_req_lock :
+			&hw_device->normal_req_lock);
+	}
+	if (!req_to_flush)
+		goto end;
+	if (hw_device->hw_intf.hw_ops.flush) {
+		lrme_flush_args.ctxt_to_hw_map = req_to_flush->ctxt_to_hw_map;
+		lrme_flush_args.flush_type = args->flush_type;
+		lrme_flush_args.req_to_flush = req_to_flush;
+		rc = hw_device->hw_intf.hw_ops.flush(hw_device->hw_intf.hw_priv,
+			&lrme_flush_args,
+			sizeof(lrme_flush_args));
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Failed in HW Stop %d", rc);
+			goto end;
+		}
+	} else {
+		CAM_ERR(CAM_LRME, "No stop ops");
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+
+static int cam_lrme_mgr_hw_start(void *hw_mgr_priv, void *hw_start_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_start_args *args =
+		(struct cam_hw_start_args *)hw_start_args;
+	struct cam_lrme_device *hw_device;
+	uint32_t device_index;
+
+	if (!hw_mgr || !args) {
+		CAM_ERR(CAM_LRME, "Invalid input params");
+		return -EINVAL;
+	}
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_LRME, "Start device index %d", device_index);
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to get hw device");
+		return rc;
+	}
+
+	if (hw_device->hw_intf.hw_ops.start) {
+		rc = hw_device->hw_intf.hw_ops.start(
+			hw_device->hw_intf.hw_priv, NULL, 0);
+	} else {
+		CAM_ERR(CAM_LRME, "Invalid start function");
+		return -EINVAL;
+	}
+
+	rc = hw_device->hw_intf.hw_ops.process_cmd(
+			hw_device->hw_intf.hw_priv,
+			CAM_LRME_HW_CMD_DUMP_REGISTER,
+			&g_lrme_hw_mgr.debugfs_entry.dump_register,
+			sizeof(bool));
+
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_stop(void *hw_mgr_priv, void *stop_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_stop_args *args =
+		(struct cam_hw_stop_args *)stop_args;
+	struct cam_lrme_device *hw_device;
+	uint32_t device_index;
+
+	if (!hw_mgr_priv || !stop_args) {
+		CAM_ERR(CAM_LRME, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	CAM_DBG(CAM_LRME, "Stop device index %d", device_index);
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to get hw device");
+		return rc;
+	}
+
+	if (hw_device->hw_intf.hw_ops.stop) {
+		rc = hw_device->hw_intf.hw_ops.stop(
+			hw_device->hw_intf.hw_priv, NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Failed in HW stop %d", rc);
+			goto end;
+		}
+	}
+
+end:
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_prepare_update(void *hw_mgr_priv,
+	void *hw_prepare_update_args)
+{
+	int rc = 0, i;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_prepare_update_args *args =
+		(struct cam_hw_prepare_update_args *)hw_prepare_update_args;
+	struct cam_lrme_device *hw_device;
+	struct cam_kmd_buf_info kmd_buf;
+	struct cam_lrme_hw_cmd_config_args config_args;
+	struct cam_lrme_frame_request *frame_req = NULL;
+	uint32_t device_index;
+
+	if (!hw_mgr_priv || !hw_prepare_update_args) {
+		CAM_ERR(CAM_LRME, "Invalid args %pK %pK",
+			hw_mgr_priv, hw_prepare_update_args);
+		return -EINVAL;
+	}
+
+	device_index = CAM_LRME_DECODE_DEVICE_INDEX(args->ctxt_to_hw_map);
+	if (device_index >= hw_mgr->device_count) {
+		CAM_ERR(CAM_LRME, "Invalid device index %d", device_index);
+		return -EPERM;
+	}
+
+	rc = cam_lrme_mgr_util_get_device(hw_mgr, device_index, &hw_device);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in getting device %d", rc);
+		goto error;
+	}
+
+	rc = cam_lrme_mgr_util_packet_validate(args->packet, args->remain_len);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in packet validation %d", rc);
+		goto error;
+	}
+
+	rc = cam_packet_util_get_kmd_buffer(args->packet, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in get kmd buf buffer %d", rc);
+		goto error;
+	}
+
+	CAM_DBG(CAM_LRME,
+		"KMD Buf : hdl=%d, cpu_addr=%pK, offset=%d, size=%d, used=%d",
+		kmd_buf.handle, kmd_buf.cpu_addr, kmd_buf.offset,
+		kmd_buf.size, kmd_buf.used_bytes);
+
+	rc = cam_packet_util_process_patches(args->packet,
+		hw_mgr->device_iommu.non_secure, hw_mgr->device_iommu.secure);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Patch packet failed, rc=%d", rc);
+		return rc;
+	}
+
+	memset(&config_args, 0, sizeof(config_args));
+	config_args.hw_device = hw_device;
+
+	rc = cam_lrme_mgr_util_prepare_io_buffer(
+		hw_mgr->device_iommu.non_secure, args,
+		config_args.input_buf, config_args.output_buf,
+		CAM_LRME_MAX_IO_BUFFER);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in prepare IO Buf %d", rc);
+		goto error;
+	}
+	/* Check port number */
+	if (args->num_in_map_entries == 0 || args->num_out_map_entries == 0) {
+		CAM_ERR(CAM_LRME, "Error in port number in %d, out %d",
+			args->num_in_map_entries, args->num_out_map_entries);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	rc = cam_lrme_mgr_util_prepare_hw_update_entries(hw_mgr, args,
+		&config_args, &kmd_buf);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Error in hw update entries %d", rc);
+		goto error;
+	}
+
+	rc = cam_lrme_mgr_util_get_frame_req(&hw_mgr->frame_free_list,
+		&frame_req, &hw_mgr->free_req_lock);
+	if (rc || !frame_req) {
+		CAM_ERR(CAM_LRME, "Can not get free frame request");
+		goto error;
+	}
+
+	frame_req->ctxt_to_hw_map = args->ctxt_to_hw_map;
+	frame_req->req_id = args->packet->header.request_id;
+	frame_req->hw_device = hw_device;
+	frame_req->num_hw_update_entries = args->num_hw_update_entries;
+	for (i = 0; i < args->num_hw_update_entries; i++)
+		frame_req->hw_update_entries[i] = args->hw_update_entries[i];
+
+	args->priv = frame_req;
+
+	CAM_DBG(CAM_LRME, "FramePrepare : Frame[%lld]", frame_req->req_id);
+
+	return 0;
+
+error:
+	return rc;
+}
+
+static int cam_lrme_mgr_hw_config(void *hw_mgr_priv,
+	void *hw_config_args)
+{
+	int rc = 0;
+	struct cam_lrme_hw_mgr *hw_mgr = hw_mgr_priv;
+	struct cam_hw_config_args *args =
+		(struct cam_hw_config_args *)hw_config_args;
+	struct cam_lrme_frame_request *frame_req;
+	struct cam_lrme_device *hw_device = NULL;
+	enum cam_lrme_hw_mgr_ctx_priority priority;
+
+	if (!hw_mgr_priv || !hw_config_args) {
+		CAM_ERR(CAM_LRME, "Invalid arguments, hw_mgr %pK, config %pK",
+			hw_mgr_priv, hw_config_args);
+		return -EINVAL;
+	}
+
+	if (!args->num_hw_update_entries) {
+		CAM_ERR(CAM_LRME, "No hw update entries");
+		return -EINVAL;
+	}
+
+	frame_req = (struct cam_lrme_frame_request *)args->priv;
+	if (!frame_req) {
+		CAM_ERR(CAM_LRME, "No frame request");
+		return -EINVAL;
+	}
+
+	hw_device = frame_req->hw_device;
+	if (!hw_device)
+		return -EINVAL;
+
+	priority = CAM_LRME_DECODE_PRIORITY(args->ctxt_to_hw_map);
+	if (priority == CAM_LRME_PRIORITY_HIGH) {
+		cam_lrme_mgr_util_put_frame_req(
+			&hw_device->frame_pending_list_high,
+			&frame_req->frame_list, &hw_device->high_req_lock);
+	} else {
+		cam_lrme_mgr_util_put_frame_req(
+			&hw_device->frame_pending_list_normal,
+			&frame_req->frame_list, &hw_device->normal_req_lock);
+	}
+
+	CAM_DBG(CAM_LRME, "schedule req %llu", frame_req->req_id);
+	rc = cam_lrme_mgr_util_schedule_frame_req(hw_mgr, hw_device);
+
+	return rc;
+}
+
+static int cam_lrme_mgr_create_debugfs_entry(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_lrme", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_ISP,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto err;
+	}
+	/* Store parent inode for cleanup in caller */
+	g_lrme_hw_mgr.debugfs_entry.dentry = dbgfileptr;
+
+	debugfs_create_bool("dump_register", 0644,
+		g_lrme_hw_mgr.debugfs_entry.dentry,
+		&g_lrme_hw_mgr.debugfs_entry.dump_register);
+
+err:
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_cam_lrme_device_submit_worker(
+	struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+int cam_lrme_mgr_register_device(
+	struct cam_hw_intf *lrme_hw_intf,
+	struct cam_iommu_handle *device_iommu,
+	struct cam_iommu_handle *cdm_iommu)
+{
+	struct cam_lrme_device *hw_device;
+	char buf[128];
+	int i, rc;
+
+	hw_device = &g_lrme_hw_mgr.hw_device[lrme_hw_intf->hw_idx];
+
+	g_lrme_hw_mgr.device_iommu = *device_iommu;
+	g_lrme_hw_mgr.cdm_iommu = *cdm_iommu;
+
+	memcpy(&hw_device->hw_intf, lrme_hw_intf, sizeof(struct cam_hw_intf));
+
+	spin_lock_init(&hw_device->high_req_lock);
+	spin_lock_init(&hw_device->normal_req_lock);
+	INIT_LIST_HEAD(&hw_device->frame_pending_list_high);
+	INIT_LIST_HEAD(&hw_device->frame_pending_list_normal);
+
+	rc = snprintf(buf, sizeof(buf), "cam_lrme_device_submit_worker%d",
+		lrme_hw_intf->hw_idx);
+	CAM_DBG(CAM_LRME, "Create submit workq for %s", buf);
+	rc = cam_req_mgr_workq_create(buf,
+		CAM_LRME_WORKQ_NUM_TASK,
+		&hw_device->work, CRM_WORKQ_USAGE_NON_IRQ, 0,
+		cam_req_mgr_process_workq_cam_lrme_device_submit_worker);
+	if (rc) {
+		CAM_ERR(CAM_LRME,
+			"Unable to create a worker, rc=%d", rc);
+		return rc;
+	}
+
+	for (i = 0; i < CAM_LRME_WORKQ_NUM_TASK; i++)
+		hw_device->work->task.pool[i].payload =
+			&hw_device->work_data[i];
+
+	if (hw_device->hw_intf.hw_ops.process_cmd) {
+		struct cam_lrme_hw_cmd_set_cb cb_args;
+
+		cb_args.cam_lrme_hw_mgr_cb = cam_lrme_mgr_cb;
+		cb_args.data = hw_device;
+
+		rc = hw_device->hw_intf.hw_ops.process_cmd(
+			hw_device->hw_intf.hw_priv,
+			CAM_LRME_HW_CMD_REGISTER_CB,
+			&cb_args, sizeof(cb_args));
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Register cb failed");
+			goto destroy_workqueue;
+		}
+		CAM_DBG(CAM_LRME, "cb registered");
+	}
+
+	if (hw_device->hw_intf.hw_ops.get_hw_caps) {
+		rc = hw_device->hw_intf.hw_ops.get_hw_caps(
+			hw_device->hw_intf.hw_priv, &hw_device->hw_caps,
+			sizeof(hw_device->hw_caps));
+		if (rc)
+			CAM_ERR(CAM_LRME, "Get caps failed");
+	} else {
+		CAM_ERR(CAM_LRME, "No get_hw_caps function");
+		goto destroy_workqueue;
+	}
+	g_lrme_hw_mgr.lrme_caps.dev_caps[lrme_hw_intf->hw_idx] =
+		hw_device->hw_caps;
+	g_lrme_hw_mgr.device_count++;
+	g_lrme_hw_mgr.lrme_caps.device_iommu = g_lrme_hw_mgr.device_iommu;
+	g_lrme_hw_mgr.lrme_caps.cdm_iommu = g_lrme_hw_mgr.cdm_iommu;
+	g_lrme_hw_mgr.lrme_caps.num_devices = g_lrme_hw_mgr.device_count;
+
+	hw_device->valid = true;
+
+	CAM_DBG(CAM_LRME, "device registration done");
+	return 0;
+
+destroy_workqueue:
+	cam_req_mgr_workq_destroy(&hw_device->work);
+
+	return rc;
+}
+
+int cam_lrme_mgr_deregister_device(int device_index)
+{
+	struct cam_lrme_device *hw_device;
+
+	hw_device = &g_lrme_hw_mgr.hw_device[device_index];
+	cam_req_mgr_workq_destroy(&hw_device->work);
+	memset(hw_device, 0x0, sizeof(struct cam_lrme_device));
+	g_lrme_hw_mgr.device_count--;
+
+	return 0;
+}
+
+int cam_lrme_hw_mgr_deinit(void)
+{
+	mutex_destroy(&g_lrme_hw_mgr.hw_mgr_mutex);
+	debugfs_remove_recursive(g_lrme_hw_mgr.debugfs_entry.dentry);
+	memset(&g_lrme_hw_mgr, 0x0, sizeof(g_lrme_hw_mgr));
+
+	return 0;
+}
+
+int cam_lrme_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf,
+	cam_hw_event_cb_func cam_lrme_dev_buf_done_cb)
+{
+	int i, rc = 0;
+	struct cam_lrme_frame_request *frame_req;
+
+	if (!hw_mgr_intf)
+		return -EINVAL;
+
+	CAM_DBG(CAM_LRME, "device count %d", g_lrme_hw_mgr.device_count);
+	if (g_lrme_hw_mgr.device_count > CAM_LRME_HW_MAX) {
+		CAM_ERR(CAM_LRME, "Invalid count of devices");
+		return -EINVAL;
+	}
+
+	memset(hw_mgr_intf, 0, sizeof(*hw_mgr_intf));
+
+	mutex_init(&g_lrme_hw_mgr.hw_mgr_mutex);
+	spin_lock_init(&g_lrme_hw_mgr.free_req_lock);
+	INIT_LIST_HEAD(&g_lrme_hw_mgr.frame_free_list);
+
+	/* Init hw mgr frame requests and add to free list */
+	for (i = 0; i < CAM_CTX_REQ_MAX * CAM_CTX_MAX; i++) {
+		frame_req = &g_lrme_hw_mgr.frame_req[i];
+
+		memset(frame_req, 0x0, sizeof(*frame_req));
+		INIT_LIST_HEAD(&frame_req->frame_list);
+
+		list_add_tail(&frame_req->frame_list,
+			&g_lrme_hw_mgr.frame_free_list);
+	}
+
+	hw_mgr_intf->hw_mgr_priv = &g_lrme_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_lrme_mgr_get_caps;
+	hw_mgr_intf->hw_acquire = cam_lrme_mgr_hw_acquire;
+	hw_mgr_intf->hw_release = cam_lrme_mgr_hw_release;
+	hw_mgr_intf->hw_start = cam_lrme_mgr_hw_start;
+	hw_mgr_intf->hw_stop = cam_lrme_mgr_hw_stop;
+	hw_mgr_intf->hw_prepare_update = cam_lrme_mgr_hw_prepare_update;
+	hw_mgr_intf->hw_config = cam_lrme_mgr_hw_config;
+	hw_mgr_intf->hw_read = NULL;
+	hw_mgr_intf->hw_write = NULL;
+	hw_mgr_intf->hw_close = NULL;
+	hw_mgr_intf->hw_flush = cam_lrme_mgr_hw_flush;
+
+	g_lrme_hw_mgr.event_cb = cam_lrme_dev_buf_done_cb;
+	hw_mgr_intf->hw_dump = cam_lrme_mgr_hw_dump;
+
+	cam_lrme_mgr_create_debugfs_entry();
+	CAM_DBG(CAM_LRME, "Hw mgr init done");
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.h
@@ -0,0 +1,126 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_MGR_H_
+#define _CAM_LRME_HW_MGR_H_
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include <media/cam_lrme.h>
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_lrme_hw_intf.h"
+#include "cam_context.h"
+
+#define CAM_LRME_HW_MAX 1
+#define CAM_LRME_WORKQ_NUM_TASK 10
+
+#define CAM_LRME_DECODE_DEVICE_INDEX(ctxt_to_hw_map) \
+	((uintptr_t)ctxt_to_hw_map & 0xF)
+
+#define CAM_LRME_DECODE_PRIORITY(ctxt_to_hw_map) \
+	(((uintptr_t)ctxt_to_hw_map & 0xF0) >> 4)
+
+#define CAM_LRME_DECODE_CTX_INDEX(ctxt_to_hw_map) \
+	((uint64_t)(uintptr_t)ctxt_to_hw_map >> CAM_LRME_CTX_INDEX_SHIFT)
+
+/**
+ * enum cam_lrme_hw_mgr_ctx_priority
+ *
+ * CAM_LRME_PRIORITY_HIGH   : High priority client
+ * CAM_LRME_PRIORITY_NORMAL : Normal priority client
+ */
+enum cam_lrme_hw_mgr_ctx_priority {
+	CAM_LRME_PRIORITY_HIGH,
+	CAM_LRME_PRIORITY_NORMAL,
+};
+
+/**
+ * struct cam_lrme_mgr_work_data : HW Mgr work data
+ *
+ * @hw_device                    : Pointer to the hw device
+ */
+struct cam_lrme_mgr_work_data {
+	struct cam_lrme_device *hw_device;
+};
+
+/**
+ * struct cam_lrme_debugfs_entry : debugfs entry struct
+ *
+ * @dentry                       : entry of debugfs
+ * @dump_register                : flag to dump registers
+ */
+struct cam_lrme_debugfs_entry {
+	struct dentry   *dentry;
+	bool             dump_register;
+};
+
+/**
+ * struct cam_lrme_device     : LRME HW device
+ *
+ * @hw_caps                   : HW device's capabilities
+ * @hw_intf                   : HW device's interface information
+ * @num_context               : Number of contexts using this device
+ * @valid                     : Whether this device is valid
+ * @work                      : HW device's work queue
+ * @work_data                 : HW device's work data
+ * @frame_pending_list_high   : High priority request queue
+ * @frame_pending_list_normal : Normal priority request queue
+ * @high_req_lock             : Spinlock of high priority queue
+ * @normal_req_lock           : Spinlock of normal priority queue
+ */
+struct cam_lrme_device {
+	struct cam_lrme_dev_cap        hw_caps;
+	struct cam_hw_intf             hw_intf;
+	uint32_t                       num_context;
+	bool                           valid;
+	struct cam_req_mgr_core_workq *work;
+	struct cam_lrme_mgr_work_data  work_data[CAM_LRME_WORKQ_NUM_TASK];
+	struct list_head               frame_pending_list_high;
+	struct list_head               frame_pending_list_normal;
+	spinlock_t                     high_req_lock;
+	spinlock_t                     normal_req_lock;
+};
+
+/**
+ * struct cam_lrme_hw_mgr : LRME HW manager
+ *
+ * @device_count    : Number of HW devices
+ * @frame_free_list : List of free frame request
+ * @hw_mgr_mutex    : Mutex to protect HW manager data
+ * @free_req_lock   :Spinlock to protect frame_free_list
+ * @hw_device       : List of HW devices
+ * @device_iommu    : Device iommu
+ * @cdm_iommu       : cdm iommu
+ * @frame_req       : List of frame request to use
+ * @lrme_caps       : LRME capabilities
+ * @event_cb        : IRQ callback function
+ * @debugfs_entry   : debugfs entry to set debug prop
+ */
+struct cam_lrme_hw_mgr {
+	uint32_t                      device_count;
+	struct list_head              frame_free_list;
+	struct mutex                  hw_mgr_mutex;
+	spinlock_t                    free_req_lock;
+	struct cam_lrme_device        hw_device[CAM_LRME_HW_MAX];
+	struct cam_iommu_handle       device_iommu;
+	struct cam_iommu_handle       cdm_iommu;
+	struct cam_lrme_frame_request frame_req[CAM_CTX_REQ_MAX * CAM_CTX_MAX];
+	struct cam_lrme_query_cap_cmd lrme_caps;
+	cam_hw_event_cb_func          event_cb;
+	struct cam_lrme_debugfs_entry debugfs_entry;
+};
+
+int cam_lrme_mgr_register_device(struct cam_hw_intf *lrme_hw_intf,
+	struct cam_iommu_handle *device_iommu,
+	struct cam_iommu_handle *cdm_iommu);
+int cam_lrme_mgr_deregister_device(int device_index);
+
+#endif /* _CAM_LRME_HW_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr_intf.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_MGR_INTF_H_
+#define _CAM_LRME_HW_MGR_INTF_H_
+
+#include <linux/of.h>
+
+#include "cam_debug_util.h"
+#include "cam_hw_mgr_intf.h"
+
+int cam_lrme_hw_mgr_init(struct cam_hw_mgr_intf *hw_mgr_intf,
+	cam_hw_event_cb_func cam_lrme_dev_buf_done_cb);
+int cam_lrme_hw_mgr_deinit(void);
+
+#endif /* _CAM_LRME_HW_MGR_INTF_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.c
@@ -0,0 +1,1439 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/timer.h>
+#include "cam_lrme_hw_core.h"
+#include "cam_lrme_hw_soc.h"
+#include "cam_smmu_api.h"
+
+static void cam_lrme_dump_registers(void __iomem *base)
+{
+	/* dump the clc registers */
+	cam_io_dump(base, 0x60, (0xc0 - 0x60) / 0x4);
+	/* dump the fe and we registers */
+	cam_io_dump(base, 0x200, (0x29c - 0x200) / 0x4);
+	cam_io_dump(base, 0x2f0, (0x330 - 0x2f0) / 0x4);
+	cam_io_dump(base, 0x500, (0x5b4 - 0x500) / 0x4);
+	cam_io_dump(base, 0x700, (0x778 - 0x700) / 0x4);
+	cam_io_dump(base, 0x800, (0x878 - 0x800) / 0x4);
+	/* dump lrme sw registers, interrupts */
+	cam_io_dump(base, 0x900, (0x928 - 0x900) / 0x4);
+}
+
+static int  cam_lrme_dump_regs_to_buf(
+	struct cam_lrme_frame_request *req,
+	struct cam_hw_info *lrme_hw,
+	struct cam_lrme_hw_dump_args *dump_args)
+{
+	int                             i;
+	uint8_t                        *dst;
+	uint32_t                       *addr, *start;
+	uint32_t                        num_reg, min_len;
+	size_t                          remain_len;
+	struct cam_hw_soc_info         *soc_info;
+	struct cam_lrme_hw_dump_header *hdr;
+
+	if (!lrme_hw || !req || !dump_args) {
+		CAM_ERR(CAM_LRME, "Invalid params %pK, %pK, %pK",
+			lrme_hw, req, dump_args);
+		return -EINVAL;
+	}
+	soc_info = &lrme_hw->soc_info;
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_LRME, "dump buffer overshoot len %zu offset %zu",
+			dump_args->buf_len, dump_args->offset);
+		return -ENOSPC;
+	}
+	remain_len = dump_args->buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_lrme_hw_dump_header) +
+		    soc_info->reg_map[0].size + sizeof(uint32_t);
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_LRME, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		return -ENOSPC;
+	}
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_lrme_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_LRME_HW_DUMP_TAG_MAX_LEN,
+		"LRME_REG:");
+	hdr->word_size = sizeof(uint32_t);
+	addr = (uint32_t *)(dst + sizeof(struct cam_lrme_hw_dump_header));
+	start = addr;
+	*addr++ = soc_info->index;
+	num_reg = soc_info->reg_map[0].size/4;
+	for (i = 0; i < num_reg; i++) {
+		*addr++ = soc_info->mem_block[0]->start + (i*4);
+		*addr++ = cam_io_r(soc_info->reg_map[0].mem_base + (i*4));
+	}
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_lrme_hw_dump_header);
+	CAM_DBG(CAM_LRME, "offset %zu", dump_args->offset);
+	return 0;
+}
+
+static int cam_lrme_hw_dump(
+	struct cam_hw_info           *lrme_hw,
+	struct cam_lrme_hw_dump_args *dump_args)
+{
+	uint8_t                        *dst;
+	ktime_t                         cur_time;
+	size_t                          remain_len;
+	uint32_t                        min_len;
+	uint64_t                        diff;
+	uint64_t                       *addr, *start;
+	struct timespec64               cur_ts;
+	struct timespec64               req_ts;
+	struct cam_lrme_core           *lrme_core;
+	struct cam_lrme_frame_request  *req = NULL;
+	struct cam_lrme_hw_dump_header *hdr;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+	if (lrme_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_DBG(CAM_LRME, "LRME HW is in off state");
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+
+	if (lrme_core->req_submit &&
+		lrme_core->req_submit->req_id == dump_args->request_id)
+		req = lrme_core->req_submit;
+	else if (lrme_core->req_proc &&
+		lrme_core->req_proc->req_id == dump_args->request_id)
+		req = lrme_core->req_proc;
+
+	if (!req) {
+		CAM_DBG(CAM_LRME, "LRME req %lld not with hw",
+			dump_args->request_id);
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	cur_time = ktime_get();
+	diff = ktime_us_delta(req->submit_timestamp, cur_time);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(req->submit_timestamp);
+
+	if (diff < CAM_LRME_RESPONSE_TIME_THRESHOLD) {
+		CAM_INFO(CAM_LRME, "No error req %lld %ld:%06ld %ld:%06ld",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	CAM_INFO(CAM_LRME, "Error req %lld %ld:%06ld %ld:%06ld",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_LRME, "dump buffer overshoot len %zu offset %zu",
+			dump_args->buf_len, dump_args->offset);
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	remain_len = dump_args->buf_len - dump_args->offset;
+	min_len =  sizeof(struct cam_lrme_hw_dump_header) +
+		    (CAM_LRME_HW_DUMP_NUM_WORDS * sizeof(uint64_t));
+
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_LRME, "dump buffer exhaust remain %zu min %u",
+			remain_len, min_len);
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return 0;
+	}
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_lrme_hw_dump_header *)dst;
+	scnprintf(hdr->tag, CAM_LRME_HW_DUMP_TAG_MAX_LEN,
+		"LRME_REQ:");
+	hdr->word_size = sizeof(uint64_t);
+	addr = (uint64_t *)(dst + sizeof(struct cam_lrme_hw_dump_header));
+	start = addr;
+	*addr++ = req->req_id;
+	*addr++ = req_ts.tv_sec;
+	*addr++ = req_ts.tv_nsec/NSEC_PER_USEC;
+	*addr++ = cur_ts.tv_sec;
+	*addr++ = cur_ts.tv_nsec/NSEC_PER_USEC;
+	hdr->size = hdr->word_size * (addr - start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_lrme_hw_dump_header);
+	cam_lrme_dump_regs_to_buf(req, lrme_hw, dump_args);
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return 0;
+}
+
+static void cam_lrme_cdm_write_reg_val_pair(uint32_t *buffer,
+	uint32_t *index, uint32_t reg_offset, uint32_t reg_value)
+{
+	buffer[(*index)++] = reg_offset;
+	buffer[(*index)++] = reg_value;
+}
+
+static void cam_lrme_hw_util_fill_fe_reg(struct cam_lrme_hw_io_buffer *io_buf,
+	uint32_t index, uint32_t *reg_val_pair, uint32_t *num_cmd,
+	struct cam_lrme_hw_info *hw_info)
+{
+	uint32_t reg_val;
+
+	/* 1. config buffer size */
+	if (io_buf->io_cfg->format == CAM_FORMAT_PLAIN16_10)
+		reg_val = io_buf->io_cfg->planes[0].width * 2;
+	else
+		reg_val = io_buf->io_cfg->planes[0].width;
+	reg_val |= (io_buf->io_cfg->planes[0].height << 16);
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_rd_reg.bus_client_reg[index].rd_buffer_size,
+		reg_val);
+
+	CAM_DBG(CAM_LRME,
+		"width %d", io_buf->io_cfg->planes[0].width);
+	CAM_DBG(CAM_LRME,
+		"height %d", io_buf->io_cfg->planes[0].height);
+
+	/* 2. config image address */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_rd_reg.bus_client_reg[index].addr_image,
+		io_buf->io_addr[0]);
+
+	CAM_DBG(CAM_LRME, "io addr %llu", io_buf->io_addr[0]);
+
+	/* 3. config stride */
+	reg_val = io_buf->io_cfg->planes[0].plane_stride;
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_rd_reg.bus_client_reg[index].rd_stride,
+		reg_val);
+
+	CAM_DBG(CAM_LRME, "plane_stride %d",
+		io_buf->io_cfg->planes[0].plane_stride);
+
+	/* 4. enable client */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_rd_reg.bus_client_reg[index].core_cfg, 0x1);
+
+	/* 5. unpack_cfg */
+	if (io_buf->io_cfg->format == CAM_FORMAT_PD10)
+		cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+			hw_info->bus_rd_reg.bus_client_reg[index].unpack_cfg_0,
+			0x0);
+	else if (io_buf->io_cfg->format == CAM_FORMAT_Y_ONLY ||
+			io_buf->io_cfg->format == CAM_FORMAT_PLAIN8 ||
+			io_buf->io_cfg->format == CAM_FORMAT_NV12 ||
+			io_buf->io_cfg->format == CAM_FORMAT_NV21)
+		cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+			hw_info->bus_rd_reg.bus_client_reg[index].unpack_cfg_0,
+			0x1);
+	else if (io_buf->io_cfg->format == CAM_FORMAT_PLAIN16_10)
+		cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+			hw_info->bus_rd_reg.bus_client_reg[index].unpack_cfg_0,
+			0x22);
+	else
+		CAM_ERR(CAM_LRME, "Unsupported format %d",
+			io_buf->io_cfg->format);
+}
+
+static void cam_lrme_hw_util_fill_we_reg(struct cam_lrme_hw_io_buffer *io_buf,
+	uint32_t index, uint32_t *reg_val_pair, uint32_t *num_cmd,
+	struct cam_lrme_hw_info *hw_info)
+{
+	/* config client mode */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].cfg,
+		0x1);
+
+	/* image address */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].addr_image,
+		io_buf->io_addr[0]);
+	CAM_DBG(CAM_LRME, "io addr %llu", io_buf->io_addr[0]);
+
+	/* buffer width and height */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].buffer_width_cfg,
+		io_buf->io_cfg->planes[0].width);
+	CAM_DBG(CAM_LRME, "width %d", io_buf->io_cfg->planes[0].width);
+
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].buffer_height_cfg,
+		io_buf->io_cfg->planes[0].height);
+	CAM_DBG(CAM_LRME, "height %d", io_buf->io_cfg->planes[0].height);
+
+	/* packer cfg */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].packer_cfg,
+		(index == 0) ? 0x1 : 0x5);
+
+	/* client stride */
+	cam_lrme_cdm_write_reg_val_pair(reg_val_pair, num_cmd,
+		hw_info->bus_wr_reg.bus_client_reg[index].wr_stride,
+		io_buf->io_cfg->planes[0].plane_stride);
+	CAM_DBG(CAM_LRME, "plane_stride %d",
+		io_buf->io_cfg->planes[0].plane_stride);
+}
+
+
+static int cam_lrme_hw_util_process_config_hw(struct cam_hw_info *lrme_hw,
+	struct cam_lrme_hw_cmd_config_args *config_args)
+{
+	int i;
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_cdm_info *hw_cdm_info;
+	uint32_t *cmd_buf_addr = config_args->cmd_buf_addr;
+	uint32_t reg_val_pair[CAM_LRME_MAX_REG_PAIR_NUM];
+	struct cam_lrme_hw_io_buffer *io_buf;
+	struct cam_lrme_hw_info *hw_info =
+		((struct cam_lrme_core *)lrme_hw->core_info)->hw_info;
+	uint32_t num_cmd = 0;
+	uint32_t size;
+	uint32_t mem_base, available_size = config_args->size;
+	uint32_t output_res_mask = 0, input_res_mask = 0;
+
+
+	if (!cmd_buf_addr) {
+		CAM_ERR(CAM_LRME, "Invalid input args");
+		return -EINVAL;
+	}
+
+	hw_cdm_info =
+		((struct cam_lrme_core *)lrme_hw->core_info)->hw_cdm_info;
+
+	for (i = 0; i < CAM_LRME_MAX_IO_BUFFER; i++) {
+		io_buf = &config_args->input_buf[i];
+
+		if (io_buf->valid == false)
+			break;
+
+		if (io_buf->io_cfg->direction != CAM_BUF_INPUT) {
+			CAM_ERR(CAM_LRME, "Incorrect direction %d %d",
+				io_buf->io_cfg->direction, CAM_BUF_INPUT);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_LRME,
+			"resource_type %d", io_buf->io_cfg->resource_type);
+
+		switch (io_buf->io_cfg->resource_type) {
+		case CAM_LRME_IO_TYPE_TAR:
+			cam_lrme_hw_util_fill_fe_reg(io_buf, 0, reg_val_pair,
+				&num_cmd, hw_info);
+
+			input_res_mask |= CAM_LRME_INPUT_PORT_TYPE_TAR;
+			break;
+		case CAM_LRME_IO_TYPE_REF:
+			cam_lrme_hw_util_fill_fe_reg(io_buf, 1, reg_val_pair,
+				&num_cmd, hw_info);
+
+			input_res_mask |= CAM_LRME_INPUT_PORT_TYPE_REF;
+			break;
+		default:
+			CAM_ERR(CAM_LRME, "wrong resource_type %d",
+				io_buf->io_cfg->resource_type);
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < CAM_LRME_BUS_RD_MAX_CLIENTS; i++)
+		if (!((input_res_mask >> i) & 0x1))
+			cam_lrme_cdm_write_reg_val_pair(reg_val_pair, &num_cmd,
+				hw_info->bus_rd_reg.bus_client_reg[i].core_cfg,
+				0x0);
+
+	for (i = 0; i < CAM_LRME_MAX_IO_BUFFER; i++) {
+		io_buf = &config_args->output_buf[i];
+
+		if (io_buf->valid == false)
+			break;
+
+		if (io_buf->io_cfg->direction != CAM_BUF_OUTPUT) {
+			CAM_ERR(CAM_LRME, "Incorrect direction %d %d",
+				io_buf->io_cfg->direction, CAM_BUF_INPUT);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_LRME, "resource_type %d",
+			io_buf->io_cfg->resource_type);
+		switch (io_buf->io_cfg->resource_type) {
+		case CAM_LRME_IO_TYPE_DS2:
+			cam_lrme_hw_util_fill_we_reg(io_buf, 0, reg_val_pair,
+				&num_cmd, hw_info);
+
+			output_res_mask |= CAM_LRME_OUTPUT_PORT_TYPE_DS2;
+			break;
+		case CAM_LRME_IO_TYPE_RES:
+			cam_lrme_hw_util_fill_we_reg(io_buf, 1, reg_val_pair,
+				&num_cmd, hw_info);
+
+			output_res_mask |= CAM_LRME_OUTPUT_PORT_TYPE_RES;
+			break;
+
+		default:
+			CAM_ERR(CAM_LRME, "wrong resource_type %d",
+				io_buf->io_cfg->resource_type);
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < CAM_LRME_BUS_RD_MAX_CLIENTS; i++)
+		if (!((output_res_mask >> i) & 0x1))
+			cam_lrme_cdm_write_reg_val_pair(reg_val_pair, &num_cmd,
+				hw_info->bus_wr_reg.bus_client_reg[i].cfg, 0x0);
+
+	if (output_res_mask) {
+		/* write composite mask */
+		cam_lrme_cdm_write_reg_val_pair(reg_val_pair, &num_cmd,
+			hw_info->bus_wr_reg.common_reg.composite_mask_0,
+			output_res_mask);
+	}
+
+	size = hw_cdm_info->cdm_ops->cdm_required_size_changebase();
+	if ((size * 4) > available_size) {
+		CAM_ERR(CAM_LRME, "buf size:%d is not sufficient, expected: %d",
+			available_size, size);
+		return -EINVAL;
+	}
+
+	mem_base = CAM_SOC_GET_REG_MAP_CAM_BASE(soc_info, CAM_LRME_BASE_IDX);
+
+	hw_cdm_info->cdm_ops->cdm_write_changebase(cmd_buf_addr, mem_base);
+	cmd_buf_addr += size;
+	available_size -= (size * 4);
+
+	size = hw_cdm_info->cdm_ops->cdm_required_size_reg_random(
+		num_cmd / 2);
+
+	if ((size * 4) > available_size) {
+		CAM_ERR(CAM_LRME, "buf size:%d is not sufficient, expected: %d",
+			available_size, size);
+		return -ENOMEM;
+	}
+
+	hw_cdm_info->cdm_ops->cdm_write_regrandom(cmd_buf_addr, num_cmd / 2,
+		reg_val_pair);
+	cmd_buf_addr += size;
+	available_size -= (size * 4);
+
+	config_args->config_buf_size =
+		config_args->size - available_size;
+
+	return 0;
+}
+
+static int cam_lrme_hw_util_submit_go(struct cam_hw_info *lrme_hw)
+{
+	struct cam_lrme_core *lrme_core;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_lrme_hw_info   *hw_info;
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	hw_info = lrme_core->hw_info;
+	soc_info = &lrme_hw->soc_info;
+
+	cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.cmd);
+
+	return 0;
+}
+
+static int cam_lrme_hw_util_reset(struct cam_hw_info *lrme_hw,
+	uint32_t reset_type)
+{
+	struct cam_lrme_core *lrme_core;
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_hw_info *hw_info;
+	long time_left;
+
+	lrme_core = lrme_hw->core_info;
+	hw_info = lrme_core->hw_info;
+
+	switch (reset_type) {
+	case CAM_LRME_HW_RESET_TYPE_HW_RESET:
+		reinit_completion(&lrme_core->reset_complete);
+		cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+			hw_info->titan_reg.top_rst_cmd);
+		time_left = wait_for_completion_timeout(
+			&lrme_core->reset_complete,
+			msecs_to_jiffies(CAM_LRME_HW_RESET_TIMEOUT));
+		if (time_left <= 0) {
+			CAM_ERR(CAM_LRME,
+				"HW reset wait failed time_left=%ld",
+				time_left);
+			return -ETIMEDOUT;
+		}
+		break;
+	case CAM_LRME_HW_RESET_TYPE_SW_RESET:
+		cam_io_w_mb(0x3, soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.sw_reset);
+		cam_io_w_mb(0x3, soc_info->reg_map[0].mem_base +
+			hw_info->bus_rd_reg.common_reg.sw_reset);
+		reinit_completion(&lrme_core->reset_complete);
+		cam_io_w_mb(0x2, soc_info->reg_map[0].mem_base +
+			hw_info->titan_reg.top_rst_cmd);
+		time_left = wait_for_completion_timeout(
+			&lrme_core->reset_complete,
+			msecs_to_jiffies(CAM_LRME_HW_RESET_TIMEOUT));
+		if (time_left <= 0) {
+			CAM_ERR(CAM_LRME,
+				"SW reset wait failed time_left=%ld",
+				time_left);
+			return -ETIMEDOUT;
+		}
+		break;
+	}
+
+	return 0;
+}
+
+int cam_lrme_hw_util_get_caps(struct cam_hw_info *lrme_hw,
+	struct cam_lrme_dev_cap *hw_caps)
+{
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_hw_info *hw_info =
+		((struct cam_lrme_core *)lrme_hw->core_info)->hw_info;
+	uint32_t reg_value;
+
+	if (!hw_info) {
+		CAM_ERR(CAM_LRME, "Invalid hw info data");
+		return -EINVAL;
+	}
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->clc_reg.clc_hw_version);
+	hw_caps->clc_hw_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->clc_hw_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->clc_hw_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.hw_version);
+	hw_caps->bus_rd_hw_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->bus_rd_hw_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->bus_rd_hw_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.hw_version);
+	hw_caps->bus_wr_hw_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->bus_wr_hw_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->bus_wr_hw_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_hw_version);
+	hw_caps->top_hw_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->top_hw_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->top_hw_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	reg_value = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_titan_version);
+	hw_caps->top_titan_version.gen =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xf0000000, 0x1C);
+	hw_caps->top_titan_version.rev =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xfff0000, 0x10);
+	hw_caps->top_titan_version.step =
+		CAM_BITS_MASK_SHIFT(reg_value, 0xffff, 0x0);
+
+	return 0;
+}
+
+static int cam_lrme_hw_util_submit_req(struct cam_lrme_core *lrme_core,
+	struct cam_lrme_frame_request *frame_req)
+{
+	struct cam_lrme_cdm_info *hw_cdm_info =
+		lrme_core->hw_cdm_info;
+	struct cam_cdm_bl_request *cdm_cmd = hw_cdm_info->cdm_cmd;
+	struct cam_hw_update_entry *cmd;
+	int i, rc = 0;
+
+	if (frame_req->num_hw_update_entries > 0) {
+		cdm_cmd->cmd_arrary_count = frame_req->num_hw_update_entries;
+		cdm_cmd->type = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+		cdm_cmd->flag = false;
+		cdm_cmd->userdata = NULL;
+		cdm_cmd->cookie = 0;
+		cdm_cmd->gen_irq_arb = false;
+
+		for (i = 0; i <= frame_req->num_hw_update_entries; i++) {
+			cmd = (frame_req->hw_update_entries + i);
+			cdm_cmd->cmd_flex[i].bl_addr.mem_handle = cmd->handle;
+			cdm_cmd->cmd_flex[i].offset = cmd->offset;
+			cdm_cmd->cmd_flex[i].len = cmd->len;
+			cdm_cmd->cmd_flex[i].arbitrate = false;
+		}
+
+		rc = cam_cdm_submit_bls(hw_cdm_info->cdm_handle, cdm_cmd);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Failed to submit cdm commands");
+			return -EINVAL;
+		}
+	} else {
+		CAM_ERR(CAM_LRME, "No hw update entry");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_lrme_hw_util_flush_ctx(struct cam_hw_info *lrme_hw,
+	void *ctxt_to_hw_map)
+{
+	int rc = -ENODEV;
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	struct cam_lrme_hw_cb_args cb_args;
+	struct cam_lrme_frame_request *req_proc, *req_submit;
+	struct cam_lrme_hw_submit_args submit_args;
+
+	rc = cam_lrme_hw_util_reset(lrme_hw, CAM_LRME_HW_RESET_TYPE_HW_RESET);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "reset failed");
+		return rc;
+	}
+
+	lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+	req_proc = lrme_core->req_proc;
+	req_submit = lrme_core->req_submit;
+	lrme_core->req_proc = NULL;
+	lrme_core->req_submit = NULL;
+
+	if (req_submit && req_submit->ctxt_to_hw_map == ctxt_to_hw_map) {
+		cb_args.cb_type = CAM_LRME_CB_PUT_FRAME;
+		cb_args.frame_req = req_submit;
+		if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb)
+			lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+				lrme_core->hw_mgr_cb.data, &cb_args);
+	} else if (req_submit) {
+		submit_args.frame_req = req_submit;
+		submit_args.hw_update_entries = req_submit->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			req_submit->num_hw_update_entries;
+		rc = cam_lrme_hw_util_submit_req(lrme_core, req_submit);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Submit failed");
+		lrme_core->req_submit = req_submit;
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+	}
+
+	if (req_proc && req_proc->ctxt_to_hw_map == ctxt_to_hw_map) {
+		cb_args.cb_type = CAM_LRME_CB_PUT_FRAME;
+		cb_args.frame_req = req_proc;
+		if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb)
+			lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+				lrme_core->hw_mgr_cb.data, &cb_args);
+	} else if (req_proc) {
+		submit_args.frame_req = req_proc;
+		submit_args.hw_update_entries = req_proc->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			req_proc->num_hw_update_entries;
+		rc = cam_lrme_hw_util_submit_req(lrme_core, req_proc);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Submit failed");
+		lrme_core->req_submit = req_proc;
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+	}
+
+	return rc;
+}
+
+static int cam_lrme_hw_util_flush_req(struct cam_hw_info *lrme_hw,
+	struct cam_lrme_frame_request *req_to_flush)
+{
+	int rc = -ENODEV;
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	struct cam_lrme_hw_cb_args cb_args;
+	struct cam_lrme_frame_request *req_proc, *req_submit;
+	struct cam_lrme_hw_submit_args submit_args;
+
+	rc = cam_lrme_hw_util_reset(lrme_hw, CAM_LRME_HW_RESET_TYPE_HW_RESET);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "reset failed");
+		return rc;
+	}
+
+	lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+	req_proc = lrme_core->req_proc;
+	req_submit = lrme_core->req_submit;
+	lrme_core->req_proc = NULL;
+	lrme_core->req_submit = NULL;
+
+	if (req_submit && req_submit == req_to_flush) {
+		cb_args.cb_type = CAM_LRME_CB_PUT_FRAME;
+		cb_args.frame_req = req_submit;
+		if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb)
+			lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+				lrme_core->hw_mgr_cb.data, &cb_args);
+	} else if (req_submit) {
+		submit_args.frame_req = req_submit;
+		submit_args.hw_update_entries = req_submit->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			req_submit->num_hw_update_entries;
+		rc = cam_lrme_hw_util_submit_req(lrme_core, req_submit);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Submit failed");
+		lrme_core->req_submit = req_submit;
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+	}
+
+	if (req_proc && req_proc == req_to_flush) {
+		cb_args.cb_type = CAM_LRME_CB_PUT_FRAME;
+		cb_args.frame_req = req_proc;
+		if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb)
+			lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+				lrme_core->hw_mgr_cb.data, &cb_args);
+	} else if (req_proc) {
+		submit_args.frame_req = req_proc;
+		submit_args.hw_update_entries = req_proc->hw_update_entries;
+		submit_args.num_hw_update_entries =
+			req_proc->num_hw_update_entries;
+		rc = cam_lrme_hw_util_submit_req(lrme_core, req_proc);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Submit failed");
+		lrme_core->req_submit = req_proc;
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+	}
+
+	return rc;
+}
+
+
+static int cam_lrme_hw_util_process_err(struct cam_hw_info *lrme_hw)
+{
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	struct cam_lrme_frame_request *req_proc, *req_submit;
+	struct cam_lrme_hw_cb_args cb_args;
+	int rc;
+
+	req_proc = lrme_core->req_proc;
+	req_submit = lrme_core->req_submit;
+	cb_args.cb_type = CAM_LRME_CB_ERROR;
+
+	if ((lrme_core->state != CAM_LRME_CORE_STATE_PROCESSING) &&
+		(lrme_core->state != CAM_LRME_CORE_STATE_REQ_PENDING) &&
+		(lrme_core->state != CAM_LRME_CORE_STATE_REQ_PROC_PEND)) {
+		CAM_ERR(CAM_LRME, "Get error irq in wrong state %d",
+			lrme_core->state);
+	}
+
+	cam_lrme_dump_registers(lrme_hw->soc_info.reg_map[0].mem_base);
+
+	CAM_ERR_RATE_LIMIT(CAM_LRME, "Start recovery");
+	lrme_core->state = CAM_LRME_CORE_STATE_RECOVERY;
+	rc = cam_lrme_hw_util_reset(lrme_hw, CAM_LRME_HW_RESET_TYPE_HW_RESET);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed to reset");
+
+	lrme_core->req_proc = NULL;
+	lrme_core->req_submit = NULL;
+	if (!rc)
+		lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+
+	cb_args.frame_req = req_proc;
+	lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(lrme_core->hw_mgr_cb.data,
+		&cb_args);
+
+	cb_args.frame_req = req_submit;
+	lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(lrme_core->hw_mgr_cb.data,
+		&cb_args);
+
+	return rc;
+}
+
+static int cam_lrme_hw_util_process_reg_update(
+	struct cam_hw_info *lrme_hw, struct cam_lrme_hw_cb_args *cb_args)
+{
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	int rc = 0;
+
+	cb_args->cb_type |= CAM_LRME_CB_COMP_REG_UPDATE;
+	if (lrme_core->state == CAM_LRME_CORE_STATE_REQ_PENDING) {
+		lrme_core->state = CAM_LRME_CORE_STATE_PROCESSING;
+	} else {
+		CAM_ERR(CAM_LRME, "Reg update in wrong state %d",
+			lrme_core->state);
+		rc = cam_lrme_hw_util_process_err(lrme_hw);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Failed to reset");
+		return -EINVAL;
+	}
+
+	lrme_core->req_proc = lrme_core->req_submit;
+	lrme_core->req_submit = NULL;
+
+	if (lrme_core->dump_flag)
+		cam_lrme_dump_registers(lrme_hw->soc_info.reg_map[0].mem_base);
+
+	return 0;
+}
+
+static int cam_lrme_hw_util_process_idle(
+	struct cam_hw_info *lrme_hw, struct cam_lrme_hw_cb_args *cb_args)
+{
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	int rc = 0;
+
+	cb_args->cb_type |= CAM_LRME_CB_BUF_DONE;
+	switch (lrme_core->state) {
+	case CAM_LRME_CORE_STATE_REQ_PROC_PEND:
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+		break;
+
+	case CAM_LRME_CORE_STATE_PROCESSING:
+		lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+		break;
+
+	default:
+		CAM_ERR(CAM_LRME, "Idle in wrong state %d",
+			lrme_core->state);
+		rc = cam_lrme_hw_util_process_err(lrme_hw);
+		return rc;
+	}
+	cb_args->frame_req = lrme_core->req_proc;
+	lrme_core->req_proc = NULL;
+
+	return 0;
+}
+
+void cam_lrme_set_irq(struct cam_hw_info *lrme_hw,
+	enum cam_lrme_irq_set set)
+{
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_core *lrme_core = lrme_hw->core_info;
+	struct cam_lrme_hw_info *hw_info = lrme_core->hw_info;
+
+	switch (set) {
+	case CAM_LRME_IRQ_ENABLE:
+		cam_io_w_mb(0xFFFF,
+			soc_info->reg_map[0].mem_base +
+			hw_info->titan_reg.top_irq_mask);
+		cam_io_w_mb(0xFFFFF,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.irq_mask_0);
+		cam_io_w_mb(0xFFFFF,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.irq_mask_1);
+		cam_io_w_mb(0xFFFFF,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_rd_reg.common_reg.irq_mask);
+		break;
+
+	case CAM_LRME_IRQ_DISABLE:
+		cam_io_w_mb(0x0,
+			soc_info->reg_map[0].mem_base +
+			hw_info->titan_reg.top_irq_mask);
+		cam_io_w_mb(0x0,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.irq_mask_0);
+		cam_io_w_mb(0x0,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_wr_reg.common_reg.irq_mask_1);
+		cam_io_w_mb(0x0,
+			soc_info->reg_map[0].mem_base +
+			hw_info->bus_rd_reg.common_reg.irq_mask);
+		break;
+	}
+}
+
+
+int cam_lrme_hw_process_irq(void *priv, void *data)
+{
+	struct cam_lrme_hw_work_data *work_data;
+	struct cam_hw_info *lrme_hw;
+	struct cam_lrme_core *lrme_core;
+	int rc = 0;
+	uint32_t top_irq_status, fe_irq_status;
+	uint32_t *we_irq_status;
+	struct cam_lrme_hw_cb_args cb_args;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_LRME, "Invalid data %pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	memset(&cb_args, 0, sizeof(struct cam_lrme_hw_cb_args));
+	lrme_hw = (struct cam_hw_info *)priv;
+	work_data = (struct cam_lrme_hw_work_data *)data;
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	top_irq_status = work_data->top_irq_status;
+	fe_irq_status = work_data->fe_irq_status;
+	we_irq_status = work_data->we_irq_status;
+
+	CAM_DBG(CAM_LRME,
+		"top status %x, fe status %x, we status0 %x, we status1 %x",
+		top_irq_status, fe_irq_status, we_irq_status[0],
+		we_irq_status[1]);
+	CAM_DBG(CAM_LRME, "Current state %d", lrme_core->state);
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		CAM_DBG(CAM_LRME, "LRME HW is in off state");
+		goto end;
+	}
+
+	if (top_irq_status & (1 << 3)) {
+		CAM_DBG(CAM_LRME, "Error");
+		rc = cam_lrme_hw_util_process_err(lrme_hw);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Process error failed");
+		goto end;
+	}
+
+	if (we_irq_status[0] & (1 << 1)) {
+		CAM_DBG(CAM_LRME, "reg update");
+		rc = cam_lrme_hw_util_process_reg_update(lrme_hw, &cb_args);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Process reg_update failed");
+			goto end;
+		}
+	}
+
+	if (top_irq_status & (1 << 4)) {
+		CAM_DBG(CAM_LRME, "IDLE");
+		if (!lrme_core->req_proc) {
+			CAM_DBG(CAM_LRME, "No frame request to process idle");
+			goto end;
+		}
+		rc = cam_lrme_hw_util_process_idle(lrme_hw, &cb_args);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Process idle failed");
+			goto end;
+		}
+	}
+
+	if (lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb) {
+		lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb(
+			lrme_core->hw_mgr_cb.data, &cb_args);
+	} else {
+		CAM_ERR(CAM_LRME, "No hw mgr cb");
+		rc = -EINVAL;
+	}
+
+end:
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return rc;
+}
+
+int cam_lrme_hw_start(void *hw_priv, void *hw_start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = (struct cam_hw_info *)hw_priv;
+	int rc = 0;
+	struct cam_lrme_core *lrme_core;
+
+	if (!lrme_hw) {
+		CAM_ERR(CAM_LRME,
+			"Invalid input params, lrme_hw %pK",
+			lrme_hw);
+		return -EINVAL;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_hw->open_count > 0) {
+		lrme_hw->open_count++;
+		CAM_DBG(CAM_LRME, "This device is activated before");
+		goto unlock;
+	}
+
+	rc = cam_lrme_soc_enable_resources(lrme_hw);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to enable soc resources");
+		goto unlock;
+	}
+
+	rc = cam_lrme_hw_util_reset(lrme_hw, CAM_LRME_HW_RESET_TYPE_HW_RESET);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to reset hw");
+		goto disable_soc;
+	}
+
+	if (lrme_core->hw_cdm_info) {
+		struct cam_lrme_cdm_info *hw_cdm_info =
+			lrme_core->hw_cdm_info;
+
+		rc = cam_cdm_stream_on(hw_cdm_info->cdm_handle);
+		if (rc) {
+			CAM_ERR(CAM_LRME, "Failed to stream on cdm");
+			goto disable_soc;
+		}
+	}
+
+	lrme_hw->hw_state = CAM_HW_STATE_POWER_UP;
+	lrme_hw->open_count++;
+	lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+
+	CAM_DBG(CAM_LRME, "open count %d", lrme_hw->open_count);
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return rc;
+
+disable_soc:
+	if (cam_lrme_soc_disable_resources(lrme_hw))
+		CAM_ERR(CAM_LRME, "Error in disable soc resources");
+unlock:
+	CAM_DBG(CAM_LRME, "open count %d", lrme_hw->open_count);
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return rc;
+}
+
+int cam_lrme_hw_stop(void *hw_priv, void *hw_stop_args, uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = (struct cam_hw_info *)hw_priv;
+	int rc = 0;
+	struct cam_lrme_core *lrme_core;
+
+	if (!lrme_hw) {
+		CAM_ERR(CAM_LRME, "Invalid argument");
+		return -EINVAL;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_hw->open_count == 0 ||
+		lrme_hw->hw_state == CAM_HW_STATE_POWER_DOWN) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_ERR(CAM_LRME, "Error Unbalanced stop");
+		return -EINVAL;
+	}
+	lrme_hw->open_count--;
+
+	CAM_DBG(CAM_LRME, "open count %d", lrme_hw->open_count);
+
+	if (lrme_hw->open_count)
+		goto unlock;
+
+	lrme_core->req_proc = NULL;
+	lrme_core->req_submit = NULL;
+
+	if (lrme_core->hw_cdm_info) {
+		struct cam_lrme_cdm_info *hw_cdm_info =
+			lrme_core->hw_cdm_info;
+
+		rc = cam_cdm_stream_off(hw_cdm_info->cdm_handle);
+		if (rc) {
+			CAM_ERR(CAM_LRME,
+				"Failed in CDM StreamOff, handle=0x%x, rc=%d",
+				hw_cdm_info->cdm_handle, rc);
+			goto unlock;
+		}
+	}
+
+	rc = cam_lrme_soc_disable_resources(lrme_hw);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed in Disable SOC, rc=%d", rc);
+
+	lrme_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	if (lrme_core->state == CAM_LRME_CORE_STATE_IDLE) {
+		lrme_core->state = CAM_LRME_CORE_STATE_INIT;
+	} else {
+		CAM_ERR(CAM_LRME, "HW in wrong state %d", lrme_core->state);
+		rc = -EINVAL;
+	}
+
+unlock:
+	mutex_unlock(&lrme_hw->hw_mutex);
+	return rc;
+}
+
+int cam_lrme_hw_submit_req(void *hw_priv, void *hw_submit_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = (struct cam_hw_info *)hw_priv;
+	struct cam_lrme_core *lrme_core;
+	struct cam_lrme_hw_submit_args *args =
+		(struct cam_lrme_hw_submit_args *)hw_submit_args;
+	int rc = 0;
+	struct cam_lrme_frame_request *frame_req;
+
+
+	if (!hw_priv || !hw_submit_args) {
+		CAM_ERR(CAM_LRME, "Invalid input");
+		return -EINVAL;
+	}
+
+	if (sizeof(struct cam_lrme_hw_submit_args) != arg_size) {
+		CAM_ERR(CAM_LRME,
+			"size of args %zu, arg_size %d",
+			sizeof(struct cam_lrme_hw_submit_args), arg_size);
+		return -EINVAL;
+	}
+
+	frame_req = args->frame_req;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_hw->open_count == 0) {
+		CAM_ERR(CAM_LRME, "HW is not open");
+		mutex_unlock(&lrme_hw->hw_mutex);
+		return -EINVAL;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	if (lrme_core->state != CAM_LRME_CORE_STATE_IDLE &&
+		lrme_core->state != CAM_LRME_CORE_STATE_PROCESSING) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_DBG(CAM_LRME, "device busy, can not submit, state %d",
+			lrme_core->state);
+		return -EBUSY;
+	}
+
+	if (lrme_core->req_submit != NULL) {
+		CAM_ERR(CAM_LRME, "req_submit is not NULL");
+		return -EBUSY;
+	}
+
+	rc = cam_lrme_hw_util_submit_req(lrme_core, frame_req);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Submit req failed");
+		goto error;
+	}
+
+	frame_req->submit_timestamp = ktime_get();
+
+	switch (lrme_core->state) {
+	case CAM_LRME_CORE_STATE_PROCESSING:
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PROC_PEND;
+		break;
+
+	case CAM_LRME_CORE_STATE_IDLE:
+		cam_lrme_hw_util_submit_go(lrme_hw);
+		lrme_core->state = CAM_LRME_CORE_STATE_REQ_PENDING;
+		break;
+
+	default:
+		CAM_ERR(CAM_LRME, "Wrong hw state");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	lrme_core->req_submit = frame_req;
+
+	mutex_unlock(&lrme_hw->hw_mutex);
+	CAM_DBG(CAM_LRME, "Release lock, submit done for req %llu",
+		frame_req->req_id);
+
+	return 0;
+
+error:
+	mutex_unlock(&lrme_hw->hw_mutex);
+
+	return rc;
+
+}
+
+int cam_lrme_hw_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = hw_priv;
+	struct cam_lrme_core *lrme_core;
+	struct cam_lrme_hw_reset_args *lrme_reset_args = reset_core_args;
+	int rc;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_LRME, "Invalid input args");
+		return -EINVAL;
+	}
+
+	if (!reset_core_args ||
+		sizeof(struct cam_lrme_hw_reset_args) != arg_size) {
+		CAM_ERR(CAM_LRME, "Invalid reset args");
+		return -EINVAL;
+	}
+
+	lrme_core = lrme_hw->core_info;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+	if (lrme_core->state == CAM_LRME_CORE_STATE_RECOVERY) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_ERR(CAM_LRME, "Reset not allowed in %d state",
+			lrme_core->state);
+		return -EINVAL;
+	}
+
+	lrme_core->state = CAM_LRME_CORE_STATE_RECOVERY;
+
+	rc = cam_lrme_hw_util_reset(lrme_hw, lrme_reset_args->reset_type);
+	if (rc) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_ERR(CAM_FD, "Failed to reset");
+		return rc;
+	}
+
+	lrme_core->state = CAM_LRME_CORE_STATE_IDLE;
+
+	mutex_unlock(&lrme_hw->hw_mutex);
+
+	return 0;
+}
+
+int cam_lrme_hw_flush(void *hw_priv, void *hw_flush_args, uint32_t arg_size)
+{
+	struct cam_lrme_core         *lrme_core = NULL;
+	struct cam_hw_info           *lrme_hw = hw_priv;
+	struct cam_lrme_hw_flush_args *flush_args =
+		(struct cam_lrme_hw_flush_args *)hw_flush_args;
+	int rc = -ENODEV;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_LRME, "Invalid arguments %pK", hw_priv);
+		return -EINVAL;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+
+	mutex_lock(&lrme_hw->hw_mutex);
+
+	if (lrme_core->state != CAM_LRME_CORE_STATE_PROCESSING &&
+		lrme_core->state != CAM_LRME_CORE_STATE_REQ_PENDING &&
+		lrme_core->state != CAM_LRME_CORE_STATE_REQ_PROC_PEND) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_DBG(CAM_LRME, "Flush is not needed in %d state",
+			lrme_core->state);
+		return 0;
+	}
+
+	if (!lrme_core->req_proc && !lrme_core->req_submit) {
+		mutex_unlock(&lrme_hw->hw_mutex);
+		CAM_DBG(CAM_LRME, "no req in device");
+		return 0;
+	}
+
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_ALL:
+		if ((!lrme_core->req_submit ||
+			lrme_core->req_submit->ctxt_to_hw_map !=
+			flush_args->ctxt_to_hw_map) &&
+			(!lrme_core->req_proc ||
+			lrme_core->req_proc->ctxt_to_hw_map !=
+			flush_args->ctxt_to_hw_map)) {
+			mutex_unlock(&lrme_hw->hw_mutex);
+			CAM_DBG(CAM_LRME, "hw running on different ctx");
+			return 0;
+		}
+		rc = cam_lrme_hw_util_flush_ctx(lrme_hw,
+			flush_args->ctxt_to_hw_map);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Flush all failed");
+		break;
+
+	case CAM_FLUSH_TYPE_REQ:
+		if ((!lrme_core->req_submit ||
+			lrme_core->req_submit != flush_args->req_to_flush) &&
+			(!lrme_core->req_proc ||
+			lrme_core->req_proc != flush_args->req_to_flush)) {
+			mutex_unlock(&lrme_hw->hw_mutex);
+			CAM_DBG(CAM_LRME, "hw running on different ctx");
+			return 0;
+		}
+		rc = cam_lrme_hw_util_flush_req(lrme_hw,
+			flush_args->req_to_flush);
+		if (rc)
+			CAM_ERR(CAM_LRME, "Flush req failed");
+		break;
+
+	default:
+		CAM_ERR(CAM_LRME, "Unsupported flush type");
+		break;
+	}
+
+	mutex_unlock(&lrme_hw->hw_mutex);
+
+	return rc;
+}
+
+int cam_lrme_hw_get_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw;
+	struct cam_lrme_core *lrme_core;
+	struct cam_lrme_dev_cap *lrme_hw_caps =
+		(struct cam_lrme_dev_cap *)get_hw_cap_args;
+
+	if (!hw_priv || !get_hw_cap_args) {
+		CAM_ERR(CAM_LRME, "Invalid input pointers %pK %pK",
+			hw_priv, get_hw_cap_args);
+		return -EINVAL;
+	}
+
+	lrme_hw = (struct cam_hw_info *)hw_priv;
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	*lrme_hw_caps = lrme_core->hw_caps;
+
+	return 0;
+}
+
+irqreturn_t cam_lrme_hw_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *lrme_hw;
+	struct cam_lrme_core *lrme_core;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_lrme_hw_info   *hw_info;
+	struct crm_workq_task *task;
+	struct cam_lrme_hw_work_data *work_data;
+	uint32_t top_irq_status, fe_irq_status, we_irq_status0, we_irq_status1;
+	int rc;
+
+	if (!data) {
+		CAM_ERR(CAM_LRME, "Invalid data in IRQ callback");
+		return IRQ_NONE;
+	}
+
+	lrme_hw = (struct cam_hw_info *)data;
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	soc_info = &lrme_hw->soc_info;
+	hw_info = lrme_core->hw_info;
+
+	top_irq_status = cam_io_r_mb(
+		soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_irq_status);
+	CAM_DBG(CAM_LRME, "top_irq_status %x", top_irq_status);
+	cam_io_w_mb(top_irq_status,
+		soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_irq_clear);
+	top_irq_status &= CAM_LRME_TOP_IRQ_MASK;
+
+	fe_irq_status = cam_io_r_mb(
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.irq_status);
+	CAM_DBG(CAM_LRME, "fe_irq_status %x", fe_irq_status);
+	cam_io_w_mb(fe_irq_status,
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.irq_clear);
+	fe_irq_status &= CAM_LRME_FE_IRQ_MASK;
+
+	we_irq_status0 = cam_io_r_mb(
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_status_0);
+	CAM_DBG(CAM_LRME, "we_irq_status[0] %x", we_irq_status0);
+	cam_io_w_mb(we_irq_status0,
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_clear_0);
+	we_irq_status0 &= CAM_LRME_WE_IRQ_MASK_0;
+
+	we_irq_status1 = cam_io_r_mb(
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_status_1);
+	CAM_DBG(CAM_LRME, "we_irq_status[1] %x", we_irq_status1);
+	cam_io_w_mb(we_irq_status1,
+		soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_clear_1);
+	we_irq_status1 &= CAM_LRME_WE_IRQ_MASK_1;
+
+	cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+		hw_info->titan_reg.top_irq_cmd);
+	cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+		hw_info->bus_wr_reg.common_reg.irq_cmd);
+	cam_io_w_mb(0x1, soc_info->reg_map[0].mem_base +
+		hw_info->bus_rd_reg.common_reg.irq_cmd);
+
+	if (top_irq_status & 0x1) {
+		complete(&lrme_core->reset_complete);
+		top_irq_status &= (~0x1);
+	}
+
+	if (top_irq_status || fe_irq_status ||
+		we_irq_status0 || we_irq_status1) {
+		task = cam_req_mgr_workq_get_task(lrme_core->work);
+		if (!task) {
+			CAM_ERR(CAM_LRME, "no empty task available");
+			return IRQ_NONE;
+		}
+		work_data = (struct cam_lrme_hw_work_data *)task->payload;
+		work_data->top_irq_status = top_irq_status;
+		work_data->fe_irq_status = fe_irq_status;
+		work_data->we_irq_status[0] = we_irq_status0;
+		work_data->we_irq_status[1] = we_irq_status1;
+		task->process_cb = cam_lrme_hw_process_irq;
+		rc = cam_req_mgr_workq_enqueue_task(task, data,
+			CRM_TASK_PRIORITY_0);
+		if (rc)
+			CAM_ERR(CAM_LRME,
+				"Failed in enqueue work task, rc=%d", rc);
+	}
+
+	return IRQ_HANDLED;
+}
+
+int cam_lrme_hw_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	struct cam_hw_info *lrme_hw = (struct cam_hw_info *)hw_priv;
+	int rc = 0;
+
+	switch (cmd_type) {
+	case CAM_LRME_HW_CMD_PREPARE_HW_UPDATE: {
+		struct cam_lrme_hw_cmd_config_args *config_args;
+
+		config_args = (struct cam_lrme_hw_cmd_config_args *)cmd_args;
+		rc = cam_lrme_hw_util_process_config_hw(lrme_hw, config_args);
+		break;
+	}
+
+	case CAM_LRME_HW_CMD_REGISTER_CB: {
+		struct cam_lrme_hw_cmd_set_cb *cb_args;
+		struct cam_lrme_device *hw_device;
+		struct cam_lrme_core *lrme_core =
+			(struct cam_lrme_core *)lrme_hw->core_info;
+		cb_args = (struct cam_lrme_hw_cmd_set_cb *)cmd_args;
+		lrme_core->hw_mgr_cb.cam_lrme_hw_mgr_cb =
+			cb_args->cam_lrme_hw_mgr_cb;
+		lrme_core->hw_mgr_cb.data = cb_args->data;
+		hw_device = cb_args->data;
+		rc = 0;
+		break;
+	}
+
+	case CAM_LRME_HW_CMD_SUBMIT: {
+		struct cam_lrme_hw_submit_args *submit_args;
+
+		submit_args = (struct cam_lrme_hw_submit_args *)cmd_args;
+		rc = cam_lrme_hw_submit_req(hw_priv,
+			submit_args, arg_size);
+		break;
+	}
+
+	case CAM_LRME_HW_CMD_DUMP_REGISTER: {
+		struct cam_lrme_core *lrme_core =
+			(struct cam_lrme_core *)lrme_hw->core_info;
+		lrme_core->dump_flag = *(bool *)cmd_args;
+		CAM_DBG(CAM_LRME, "dump_flag %d", lrme_core->dump_flag);
+		break;
+	}
+
+	case CAM_LRME_HW_CMD_DUMP: {
+		struct cam_lrme_hw_dump_args *dump_args =
+		   (struct cam_lrme_hw_dump_args *)cmd_args;
+		rc = cam_lrme_hw_dump(lrme_hw, dump_args);
+		break;
+		}
+	default:
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_core.h
@@ -0,0 +1,469 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_CORE_H_
+#define _CAM_LRME_HW_CORE_H_
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_defs.h>
+#include <media/cam_lrme.h>
+
+#include "cam_common_util.h"
+#include "cam_debug_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_lrme_hw_intf.h"
+#include "cam_lrme_hw_soc.h"
+#include "cam_req_mgr_workq.h"
+
+#define CAM_LRME_HW_RESET_TIMEOUT 3000
+
+#define CAM_LRME_BUS_RD_MAX_CLIENTS 2
+#define CAM_LRME_BUS_WR_MAX_CLIENTS 2
+
+#define CAM_LRME_HW_WORKQ_NUM_TASK 30
+
+#define CAM_LRME_TOP_IRQ_MASK          0x19
+#define CAM_LRME_WE_IRQ_MASK_0         0x2
+#define CAM_LRME_WE_IRQ_MASK_1         0x0
+#define CAM_LRME_FE_IRQ_MASK           0x0
+
+#define CAM_LRME_MAX_REG_PAIR_NUM 60
+
+#define CAM_LRME_RESPONSE_TIME_THRESHOLD 100000
+#define CAM_LRME_HW_DUMP_TAG_MAX_LEN     32
+#define CAM_LRME_HW_DUMP_NUM_WORDS       5
+
+/**
+ * enum cam_lrme_irq_set
+ *
+ * @CAM_LRME_IRQ_ENABLE  : Enable irqs
+ * @CAM_LRME_IRQ_DISABLE : Disable irqs
+ */
+enum cam_lrme_irq_set {
+	CAM_LRME_IRQ_ENABLE,
+	CAM_LRME_IRQ_DISABLE,
+};
+
+/**
+ * struct cam_lrme_cdm_info : information used to submit cdm command
+ *
+ * @cdm_handle      : CDM handle for this device
+ * @cdm_ops         : CDM ops
+ * @cdm_cmd         : CDM command pointer
+ */
+struct cam_lrme_cdm_info {
+	uint32_t                   cdm_handle;
+	struct cam_cdm_utils_ops  *cdm_ops;
+	struct cam_cdm_bl_request *cdm_cmd;
+};
+
+/**
+ * struct cam_lrme_hw_work_data : Work data for HW work queue
+ *
+ * @top_irq_status : Top registers irq status
+ * @fe_irq_status  : FE engine irq status
+ * @we_irq_status  : WE engine irq status
+ */
+struct cam_lrme_hw_work_data {
+	uint32_t                          top_irq_status;
+	uint32_t                          fe_irq_status;
+	uint32_t                          we_irq_status[2];
+};
+
+/**
+ *  enum cam_lrme_core_state : LRME core states
+ *
+ * @CAM_LRME_CORE_STATE_UNINIT        : LRME is in uninit state
+ * @CAM_LRME_CORE_STATE_INIT          : LRME is in init state after probe
+ * @ CAM_LRME_CORE_STATE_IDLE         : LRME is in idle state. Hardware is in
+ *                                      this state when no frame is processing
+ *                                      or waiting for this core.
+ * @CAM_LRME_CORE_STATE_REQ_PENDING   : LRME is in pending state. One frame is
+ *                                      waiting for processing
+ * @CAM_LRME_CORE_STATE_PROCESSING    : LRME is in processing state. HW manager
+ *                                      can submit one more frame to HW
+ * @CAM_LRME_CORE_STATE_REQ_PROC_PEND : Indicate two frames are inside HW.
+ * @CAM_LRME_CORE_STATE_RECOVERY      : Indicate core is in the process of reset
+ * @CAM_LRME_CORE_STATE_MAX           : upper limit of states
+ */
+enum cam_lrme_core_state {
+	CAM_LRME_CORE_STATE_UNINIT,
+	CAM_LRME_CORE_STATE_INIT,
+	CAM_LRME_CORE_STATE_IDLE,
+	CAM_LRME_CORE_STATE_REQ_PENDING,
+	CAM_LRME_CORE_STATE_PROCESSING,
+	CAM_LRME_CORE_STATE_REQ_PROC_PEND,
+	CAM_LRME_CORE_STATE_RECOVERY,
+	CAM_LRME_CORE_STATE_MAX,
+};
+
+/**
+ *  struct cam_lrme_core : LRME HW core information
+ *
+ * @hw_info        : Pointer to base HW information structure
+ * @device_iommu   : Device iommu handle
+ * @cdm_iommu      : CDM iommu handle
+ * @hw_caps        : Hardware capabilities
+ * @state          : Hardware state
+ * @reset_complete : Reset completion
+ * @work           : Hardware workqueue to handle irq events
+ * @work_data      : Work data used by hardware workqueue
+ * @hw_mgr_cb      : Hw manager callback
+ * @req_proc       : Pointer to the processing frame request
+ * @req_submit     : Pointer to the frame request waiting for processing
+ * @hw_cdm_info    : CDM information used by this device
+ * @hw_idx         : Hardware index
+ */
+struct cam_lrme_core {
+	struct cam_lrme_hw_info          *hw_info;
+	struct cam_iommu_handle           device_iommu;
+	struct cam_iommu_handle           cdm_iommu;
+	struct cam_lrme_dev_cap           hw_caps;
+	enum cam_lrme_core_state          state;
+	struct completion                 reset_complete;
+	struct cam_req_mgr_core_workq    *work;
+	struct cam_lrme_hw_work_data      work_data[CAM_LRME_HW_WORKQ_NUM_TASK];
+	struct cam_lrme_hw_cmd_set_cb     hw_mgr_cb;
+	struct cam_lrme_frame_request    *req_proc;
+	struct cam_lrme_frame_request    *req_submit;
+	struct cam_lrme_cdm_info         *hw_cdm_info;
+	uint32_t                          hw_idx;
+	bool                              dump_flag;
+};
+
+/**
+ * struct cam_lrme_bus_rd_reg_common : Offsets of FE common registers
+ *
+ * @hw_version    : Offset of hw_version register
+ * @hw_capability : Offset of hw_capability register
+ * @sw_reset      : Offset of sw_reset register
+ * @cgc_override  : Offset of cgc_override register
+ * @irq_mask      : Offset of irq_mask register
+ * @irq_clear     : Offset of irq_clear register
+ * @irq_cmd       : Offset of irq_cmd register
+ * @irq_status    : Offset of irq_status register
+ * @cmd           : Offset of cmd register
+ * @irq_set       : Offset of irq_set register
+ * @misr_reset    : Offset of misr_reset register
+ * @security_cfg  : Offset of security_cfg register
+ * @pwr_iso_cfg   : Offset of pwr_iso_cfg register
+ * @pwr_iso_seed  : Offset of pwr_iso_seed register
+ * @test_bus_ctrl : Offset of test_bus_ctrl register
+ * @spare         : Offset of spare register
+ */
+struct cam_lrme_bus_rd_reg_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t sw_reset;
+	uint32_t cgc_override;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_cmd;
+	uint32_t irq_status;
+	uint32_t cmd;
+	uint32_t irq_set;
+	uint32_t misr_reset;
+	uint32_t security_cfg;
+	uint32_t pwr_iso_cfg;
+	uint32_t pwr_iso_seed;
+	uint32_t test_bus_ctrl;
+	uint32_t spare;
+};
+
+/**
+ * struct cam_lrme_bus_wr_reg_common : Offset of WE common registers
+ * @hw_version        : Offset of hw_version register
+ * @hw_capability     : Offset of hw_capability register
+ * @sw_reset          : Offset of sw_reset register
+ * @cgc_override      : Offset of cgc_override register
+ * @misr_reset        : Offset of misr_reset register
+ * @pwr_iso_cfg       : Offset of pwr_iso_cfg register
+ * @test_bus_ctrl     : Offset of test_bus_ctrl register
+ * @composite_mask_0  : Offset of composite_mask_0 register
+ * @irq_mask_0        : Offset of irq_mask_0 register
+ * @irq_mask_1        : Offset of irq_mask_1 register
+ * @irq_clear_0       : Offset of irq_clear_0 register
+ * @irq_clear_1       : Offset of irq_clear_1 register
+ * @irq_status_0      : Offset of irq_status_0 register
+ * @irq_status_1      : Offset of irq_status_1 register
+ * @irq_cmd           : Offset of irq_cmd register
+ * @irq_set_0         : Offset of irq_set_0 register
+ * @irq_set_1         : Offset of irq_set_1 register
+ * @addr_fifo_status  : Offset of addr_fifo_status register
+ * @frame_header_cfg0 : Offset of frame_header_cfg0 register
+ * @frame_header_cfg1 : Offset of frame_header_cfg1 register
+ * @spare             : Offset of spare register
+ */
+struct cam_lrme_bus_wr_reg_common {
+	uint32_t hw_version;
+	uint32_t hw_capability;
+	uint32_t sw_reset;
+	uint32_t cgc_override;
+	uint32_t misr_reset;
+	uint32_t pwr_iso_cfg;
+	uint32_t test_bus_ctrl;
+	uint32_t composite_mask_0;
+	uint32_t irq_mask_0;
+	uint32_t irq_mask_1;
+	uint32_t irq_clear_0;
+	uint32_t irq_clear_1;
+	uint32_t irq_status_0;
+	uint32_t irq_status_1;
+	uint32_t irq_cmd;
+	uint32_t irq_set_0;
+	uint32_t irq_set_1;
+	uint32_t addr_fifo_status;
+	uint32_t frame_header_cfg0;
+	uint32_t frame_header_cfg1;
+	uint32_t spare;
+};
+
+/**
+ * struct cam_lrme_bus_rd_bus_client : Offset of FE registers
+ *
+ * @core_cfg                : Offset of core_cfg register
+ * @ccif_meta_data          : Offset of ccif_meta_data register
+ * @addr_image              : Offset of addr_image register
+ * @rd_buffer_size          : Offset of rd_buffer_size register
+ * @rd_stride               : Offset of rd_stride register
+ * @unpack_cfg_0            : Offset of unpack_cfg_0 register
+ * @latency_buff_allocation : Offset of latency_buff_allocation register
+ * @burst_limit_cfg         : Offset of burst_limit_cfg register
+ * @misr_cfg_0              : Offset of misr_cfg_0 register
+ * @misr_cfg_1              : Offset of misr_cfg_1 register
+ * @misr_rd_val             : Offset of misr_rd_val register
+ * @debug_status_cfg        : Offset of debug_status_cfg register
+ * @debug_status_0          : Offset of debug_status_0 register
+ * @debug_status_1          : Offset of debug_status_1 register
+ */
+struct cam_lrme_bus_rd_bus_client {
+	uint32_t core_cfg;
+	uint32_t ccif_meta_data;
+	uint32_t addr_image;
+	uint32_t rd_buffer_size;
+	uint32_t rd_stride;
+	uint32_t unpack_cfg_0;
+	uint32_t latency_buff_allocation;
+	uint32_t burst_limit_cfg;
+	uint32_t misr_cfg_0;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_val;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+};
+
+/**
+ * struct cam_lrme_bus_wr_bus_client : Offset of WE registers
+ *
+ * @status_0                  : Offset of status_0 register
+ * @status_1                  : Offset of status_1 register
+ * @cfg                       : Offset of cfg register
+ * @addr_frame_header         : Offset of addr_frame_header register
+ * @frame_header_cfg          : Offset of frame_header_cfg register
+ * @addr_image                : Offset of addr_image register
+ * @addr_image_offset         : Offset of addr_image_offset register
+ * @buffer_width_cfg          : Offset of buffer_width_cfg register
+ * @buffer_height_cfg         : Offset of buffer_height_cfg register
+ * @packer_cfg                : Offset of packer_cfg register
+ * @wr_stride                 : Offset of wr_stride register
+ * @irq_subsample_cfg_period  : Offset of irq_subsample_cfg_period register
+ * @irq_subsample_cfg_pattern : Offset of irq_subsample_cfg_pattern register
+ * @burst_limit_cfg           : Offset of burst_limit_cfg register
+ * @misr_cfg                  : Offset of misr_cfg register
+ * @misr_rd_word_sel          : Offset of misr_rd_word_sel register
+ * @misr_val                  : Offset of misr_val register
+ * @debug_status_cfg          : Offset of debug_status_cfg register
+ * @debug_status_0            : Offset of debug_status_0 register
+ * @debug_status_1            : Offset of debug_status_1 register
+ */
+struct cam_lrme_bus_wr_bus_client {
+	uint32_t status_0;
+	uint32_t status_1;
+	uint32_t cfg;
+	uint32_t addr_frame_header;
+	uint32_t frame_header_cfg;
+	uint32_t addr_image;
+	uint32_t addr_image_offset;
+	uint32_t buffer_width_cfg;
+	uint32_t buffer_height_cfg;
+	uint32_t packer_cfg;
+	uint32_t wr_stride;
+	uint32_t irq_subsample_cfg_period;
+	uint32_t irq_subsample_cfg_pattern;
+	uint32_t burst_limit_cfg;
+	uint32_t misr_cfg;
+	uint32_t misr_rd_word_sel;
+	uint32_t misr_val;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
+	uint32_t debug_status_1;
+};
+
+/**
+ * struct cam_lrme_bus_rd_hw_info : FE registers information
+ *
+ * @common_reg     : FE common register
+ * @bus_client_reg : List of FE bus registers information
+ */
+struct cam_lrme_bus_rd_hw_info {
+	struct cam_lrme_bus_rd_reg_common common_reg;
+	struct cam_lrme_bus_rd_bus_client
+		bus_client_reg[CAM_LRME_BUS_RD_MAX_CLIENTS];
+};
+
+/**
+ * struct cam_lrme_bus_wr_hw_info : WE engine registers information
+ *
+ * @common_reg     : WE common register
+ * @bus_client_reg : List of WE bus registers information
+ */
+struct cam_lrme_bus_wr_hw_info {
+	struct cam_lrme_bus_wr_reg_common common_reg;
+	struct cam_lrme_bus_wr_bus_client
+		bus_client_reg[CAM_LRME_BUS_WR_MAX_CLIENTS];
+};
+
+/**
+ * struct cam_lrme_clc_reg : Offset of clc registers
+ *
+ * @clc_hw_version                 : Offset of clc_hw_version register
+ * @clc_hw_status                  : Offset of clc_hw_status register
+ * @clc_hw_status_dbg              : Offset of clc_hw_status_dbg register
+ * @clc_module_cfg                 : Offset of clc_module_cfg register
+ * @clc_moduleformat               : Offset of clc_moduleformat register
+ * @clc_rangestep                  : Offset of clc_rangestep register
+ * @clc_offset                     : Offset of clc_offset register
+ * @clc_maxallowedsad              : Offset of clc_maxallowedsad register
+ * @clc_minallowedtarmad           : Offset of clc_minallowedtarmad register
+ * @clc_meaningfulsaddiff          : Offset of clc_meaningfulsaddiff register
+ * @clc_minsaddiffdenom            : Offset of clc_minsaddiffdenom register
+ * @clc_robustnessmeasuredistmap_0 : Offset of measuredistmap_0 register
+ * @clc_robustnessmeasuredistmap_1 : Offset of measuredistmap_1 register
+ * @clc_robustnessmeasuredistmap_2 : Offset of measuredistmap_2 register
+ * @clc_robustnessmeasuredistmap_3 : Offset of measuredistmap_3 register
+ * @clc_robustnessmeasuredistmap_4 : Offset of measuredistmap_4 register
+ * @clc_robustnessmeasuredistmap_5 : Offset of measuredistmap_5 register
+ * @clc_robustnessmeasuredistmap_6 : Offset of measuredistmap_6 register
+ * @clc_robustnessmeasuredistmap_7 : Offset of measuredistmap_7 register
+ * @clc_ds_crop_horizontal         : Offset of clc_ds_crop_horizontal register
+ * @clc_ds_crop_vertical           : Offset of clc_ds_crop_vertical register
+ * @clc_tar_pd_unpacker            : Offset of clc_tar_pd_unpacker register
+ * @clc_ref_pd_unpacker            : Offset of clc_ref_pd_unpacker register
+ * @clc_sw_override                : Offset of clc_sw_override register
+ * @clc_tar_height                 : Offset of clc_tar_height register
+ * @clc_test_bus_ctrl              : Offset of clc_test_bus_ctrl register
+ * @clc_spare                      : Offset of clc_spare register
+ */
+struct cam_lrme_clc_reg {
+	uint32_t clc_hw_version;
+	uint32_t clc_hw_status;
+	uint32_t clc_hw_status_dbg;
+	uint32_t clc_module_cfg;
+	uint32_t clc_moduleformat;
+	uint32_t clc_rangestep;
+	uint32_t clc_offset;
+	uint32_t clc_maxallowedsad;
+	uint32_t clc_minallowedtarmad;
+	uint32_t clc_meaningfulsaddiff;
+	uint32_t clc_minsaddiffdenom;
+	uint32_t clc_robustnessmeasuredistmap_0;
+	uint32_t clc_robustnessmeasuredistmap_1;
+	uint32_t clc_robustnessmeasuredistmap_2;
+	uint32_t clc_robustnessmeasuredistmap_3;
+	uint32_t clc_robustnessmeasuredistmap_4;
+	uint32_t clc_robustnessmeasuredistmap_5;
+	uint32_t clc_robustnessmeasuredistmap_6;
+	uint32_t clc_robustnessmeasuredistmap_7;
+	uint32_t clc_ds_crop_horizontal;
+	uint32_t clc_ds_crop_vertical;
+	uint32_t clc_tar_pd_unpacker;
+	uint32_t clc_ref_pd_unpacker;
+	uint32_t clc_sw_override;
+	uint32_t clc_tar_height;
+	uint32_t clc_ref_height;
+	uint32_t clc_test_bus_ctrl;
+	uint32_t clc_spare;
+};
+
+/**
+ * struct cam_lrme_titan_reg : Offset of LRME top registers
+ *
+ * @top_hw_version           : Offset of top_hw_version register
+ * @top_titan_version        : Offset of top_titan_version register
+ * @top_rst_cmd              : Offset of top_rst_cmd register
+ * @top_core_clk_cfg         : Offset of top_core_clk_cfg register
+ * @top_irq_status           : Offset of top_irq_status register
+ * @top_irq_mask             : Offset of top_irq_mask register
+ * @top_irq_clear            : Offset of top_irq_clear register
+ * @top_irq_set              : Offset of top_irq_set register
+ * @top_irq_cmd              : Offset of top_irq_cmd register
+ * @top_violation_status     : Offset of top_violation_status register
+ * @top_spare                : Offset of top_spare register
+ */
+struct cam_lrme_titan_reg {
+	uint32_t top_hw_version;
+	uint32_t top_titan_version;
+	uint32_t top_rst_cmd;
+	uint32_t top_core_clk_cfg;
+	uint32_t top_irq_status;
+	uint32_t top_irq_mask;
+	uint32_t top_irq_clear;
+	uint32_t top_irq_set;
+	uint32_t top_irq_cmd;
+	uint32_t top_violation_status;
+	uint32_t top_spare;
+};
+
+/**
+ * struct cam_lrme_hw_info : LRME registers information
+ *
+ * @clc_reg    : LRME CLC registers
+ * @bus_rd_reg : LRME FE registers
+ * @bus_wr_reg : LRME WE registers
+ * @titan_reg  : LRME top reisters
+ */
+struct cam_lrme_hw_info {
+	struct cam_lrme_clc_reg clc_reg;
+	struct cam_lrme_bus_rd_hw_info bus_rd_reg;
+	struct cam_lrme_bus_wr_hw_info bus_wr_reg;
+	struct cam_lrme_titan_reg titan_reg;
+};
+
+/**
+ * struct cam_lrme_hw_dump_header : LRME hw dump header
+ *
+ * @tag       : LRME hw dump header tag
+ * @size      : Size of data
+ * @word_size : size of each word
+ */
+
+struct cam_lrme_hw_dump_header {
+	uint8_t     tag[CAM_LRME_HW_DUMP_TAG_MAX_LEN];
+	uint64_t    size;
+	uint32_t    word_size;
+};
+
+int cam_lrme_hw_process_irq(void *priv, void *data);
+int cam_lrme_hw_submit_req(void *hw_priv, void *hw_submit_args,
+	uint32_t arg_size);
+int cam_lrme_hw_reset(void *hw_priv, void *reset_core_args, uint32_t arg_size);
+int cam_lrme_hw_stop(void *hw_priv, void *stop_args, uint32_t arg_size);
+int cam_lrme_hw_get_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size);
+irqreturn_t cam_lrme_hw_irq(int irq_num, void *data);
+int cam_lrme_hw_process_cmd(void *hw_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+int cam_lrme_hw_util_get_caps(struct cam_hw_info *lrme_hw,
+	struct cam_lrme_dev_cap *hw_caps);
+int cam_lrme_hw_start(void *hw_priv, void *hw_init_args, uint32_t arg_size);
+int cam_lrme_hw_flush(void *hw_priv, void *hw_flush_args, uint32_t arg_size);
+void cam_lrme_set_irq(struct cam_hw_info *lrme_hw, enum cam_lrme_irq_set set);
+
+#endif /* _CAM_LRME_HW_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_dev.c
@@ -0,0 +1,334 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_req_mgr.h>
+
+#include "cam_subdev.h"
+#include "cam_lrme_hw_intf.h"
+#include "cam_lrme_hw_core.h"
+#include "cam_lrme_hw_soc.h"
+#include "cam_lrme_hw_reg.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_lrme_hw_mgr.h"
+#include "cam_mem_mgr_api.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+
+static int cam_lrme_hw_dev_util_cdm_acquire(struct cam_lrme_core *lrme_core,
+	struct cam_hw_info *lrme_hw)
+{
+	int rc, i;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_cdm_acquire_data cdm_acquire;
+	struct cam_lrme_cdm_info *hw_cdm_info;
+
+	hw_cdm_info = kzalloc(sizeof(struct cam_lrme_cdm_info),
+		GFP_KERNEL);
+	if (!hw_cdm_info) {
+		CAM_ERR(CAM_LRME, "No memory for hw_cdm_info");
+		return -ENOMEM;
+	}
+
+	cdm_cmd = kzalloc((sizeof(struct cam_cdm_bl_request) +
+		((CAM_LRME_MAX_HW_ENTRIES - 1) *
+		sizeof(struct cam_cdm_bl_cmd))), GFP_KERNEL);
+	if (!cdm_cmd) {
+		CAM_ERR(CAM_LRME, "No memory for cdm_cmd");
+		kfree(hw_cdm_info);
+		return -ENOMEM;
+	}
+
+	memset(&cdm_acquire, 0, sizeof(cdm_acquire));
+	strscpy(cdm_acquire.identifier, "lrmecdm", sizeof("lrmecdm"));
+	cdm_acquire.cell_index = lrme_hw->soc_info.index;
+	cdm_acquire.handle = 0;
+	cdm_acquire.userdata = hw_cdm_info;
+	cdm_acquire.cam_cdm_callback = NULL;
+	cdm_acquire.id = CAM_CDM_VIRTUAL;
+	cdm_acquire.base_array_cnt = lrme_hw->soc_info.num_reg_map;
+	cdm_acquire.priority = CAM_CDM_BL_FIFO_0;
+	for (i = 0; i < lrme_hw->soc_info.num_reg_map; i++)
+		cdm_acquire.base_array[i] = &lrme_hw->soc_info.reg_map[i];
+
+	rc = cam_cdm_acquire(&cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Can't acquire cdm");
+		goto error;
+	}
+
+	hw_cdm_info->cdm_cmd = cdm_cmd;
+	hw_cdm_info->cdm_ops = cdm_acquire.ops;
+	hw_cdm_info->cdm_handle = cdm_acquire.handle;
+
+	lrme_core->hw_cdm_info = hw_cdm_info;
+	CAM_DBG(CAM_LRME, "cdm acquire done");
+
+	return 0;
+error:
+	kfree(cdm_cmd);
+	kfree(hw_cdm_info);
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_cam_lrme_hw_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int cam_lrme_hw_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_info *lrme_hw;
+	struct cam_hw_intf lrme_hw_intf;
+	struct cam_lrme_core *lrme_core;
+	const struct of_device_id *match_dev = NULL;
+	struct cam_lrme_hw_info *hw_info;
+	int rc, i;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	lrme_hw = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!lrme_hw) {
+		CAM_ERR(CAM_LRME, "No memory to create lrme_hw");
+		return -ENOMEM;
+	}
+
+	lrme_core = kzalloc(sizeof(struct cam_lrme_core), GFP_KERNEL);
+	if (!lrme_core) {
+		CAM_ERR(CAM_LRME, "No memory to create lrme_core");
+		kfree(lrme_hw);
+		return -ENOMEM;
+	}
+
+	lrme_hw->core_info = lrme_core;
+	lrme_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
+	lrme_hw->soc_info.pdev = pdev;
+	lrme_hw->soc_info.dev = &pdev->dev;
+	lrme_hw->soc_info.dev_name = pdev->name;
+	lrme_hw->open_count = 0;
+	lrme_core->state = CAM_LRME_CORE_STATE_INIT;
+
+	mutex_init(&lrme_hw->hw_mutex);
+	spin_lock_init(&lrme_hw->hw_lock);
+	init_completion(&lrme_hw->hw_complete);
+	init_completion(&lrme_core->reset_complete);
+
+	rc = cam_req_mgr_workq_create("cam_lrme_hw_worker",
+		CAM_LRME_HW_WORKQ_NUM_TASK,
+		&lrme_core->work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_workq_cam_lrme_hw_worker);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Unable to create a workq, rc=%d", rc);
+		goto free_memory;
+	}
+
+	for (i = 0; i < CAM_LRME_HW_WORKQ_NUM_TASK; i++)
+		lrme_core->work->task.pool[i].payload =
+			&lrme_core->work_data[i];
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev || !match_dev->data) {
+		CAM_ERR(CAM_LRME, "No Of_match data, %pK", match_dev);
+		rc = -EINVAL;
+		goto destroy_workqueue;
+	}
+	hw_info = (struct cam_lrme_hw_info *)match_dev->data;
+	lrme_core->hw_info = hw_info;
+
+	rc = cam_lrme_soc_init_resources(&lrme_hw->soc_info,
+		cam_lrme_hw_irq, lrme_hw);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to init soc, rc=%d", rc);
+		goto destroy_workqueue;
+	}
+
+	rc = cam_lrme_hw_dev_util_cdm_acquire(lrme_core, lrme_hw);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to acquire cdm");
+		goto deinit_platform_res;
+	}
+
+	rc = cam_smmu_get_handle("lrme", &lrme_core->device_iommu.non_secure);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Get iommu handle failed");
+		goto release_cdm;
+	}
+
+	rc = cam_lrme_hw_start(lrme_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to hw init, rc=%d", rc);
+		goto detach_smmu;
+	}
+
+	rc = cam_lrme_hw_util_get_caps(lrme_hw, &lrme_core->hw_caps);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to get hw caps, rc=%d", rc);
+		if (cam_lrme_hw_stop(lrme_hw, NULL, 0))
+			CAM_ERR(CAM_LRME, "Failed in hw deinit");
+		goto detach_smmu;
+	}
+
+	rc = cam_lrme_hw_stop(lrme_hw, NULL, 0);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to deinit hw, rc=%d", rc);
+		goto detach_smmu;
+	}
+
+	lrme_core->hw_idx = lrme_hw->soc_info.index;
+	lrme_hw_intf.hw_priv = lrme_hw;
+	lrme_hw_intf.hw_idx = lrme_hw->soc_info.index;
+	lrme_hw_intf.hw_ops.get_hw_caps = cam_lrme_hw_get_caps;
+	lrme_hw_intf.hw_ops.init = NULL;
+	lrme_hw_intf.hw_ops.deinit = NULL;
+	lrme_hw_intf.hw_ops.reset = cam_lrme_hw_reset;
+	lrme_hw_intf.hw_ops.reserve = NULL;
+	lrme_hw_intf.hw_ops.release = NULL;
+	lrme_hw_intf.hw_ops.start = cam_lrme_hw_start;
+	lrme_hw_intf.hw_ops.stop = cam_lrme_hw_stop;
+	lrme_hw_intf.hw_ops.read = NULL;
+	lrme_hw_intf.hw_ops.write = NULL;
+	lrme_hw_intf.hw_ops.process_cmd = cam_lrme_hw_process_cmd;
+	lrme_hw_intf.hw_ops.flush = cam_lrme_hw_flush;
+	lrme_hw_intf.hw_type = CAM_HW_LRME;
+
+	rc = cam_cdm_get_iommu_handle("lrmecdm", &lrme_core->cdm_iommu);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to acquire the CDM iommu handles");
+		goto detach_smmu;
+	}
+
+	rc = cam_lrme_mgr_register_device(&lrme_hw_intf,
+		&lrme_core->device_iommu,
+		&lrme_core->cdm_iommu);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to register device");
+		goto detach_smmu;
+	}
+
+	platform_set_drvdata(pdev, lrme_hw);
+	CAM_DBG(CAM_LRME, "HW:%d component bound successfully",
+		lrme_hw_intf.hw_idx);
+
+	return rc;
+
+detach_smmu:
+	cam_smmu_destroy_handle(lrme_core->device_iommu.non_secure);
+release_cdm:
+	cam_cdm_release(lrme_core->hw_cdm_info->cdm_handle);
+	kfree(lrme_core->hw_cdm_info->cdm_cmd);
+	kfree(lrme_core->hw_cdm_info);
+deinit_platform_res:
+	if (cam_lrme_soc_deinit_resources(&lrme_hw->soc_info))
+		CAM_ERR(CAM_LRME, "Failed in soc deinit");
+	mutex_destroy(&lrme_hw->hw_mutex);
+destroy_workqueue:
+	cam_req_mgr_workq_destroy(&lrme_core->work);
+free_memory:
+	mutex_destroy(&lrme_hw->hw_mutex);
+	kfree(lrme_hw);
+	kfree(lrme_core);
+
+	return rc;
+}
+
+static void cam_lrme_hw_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct cam_hw_info *lrme_hw;
+	struct cam_lrme_core *lrme_core;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	lrme_hw = platform_get_drvdata(pdev);
+	if (!lrme_hw) {
+		CAM_ERR(CAM_LRME, "Invalid lrme_hw from fd_hw_intf");
+		return;
+	}
+
+	lrme_core = (struct cam_lrme_core *)lrme_hw->core_info;
+	if (!lrme_core) {
+		CAM_ERR(CAM_LRME, "Invalid lrme_core from fd_hw");
+		goto deinit_platform_res;
+	}
+
+	cam_smmu_destroy_handle(lrme_core->device_iommu.non_secure);
+	cam_cdm_release(lrme_core->hw_cdm_info->cdm_handle);
+	cam_lrme_mgr_deregister_device(lrme_core->hw_idx);
+
+	kfree(lrme_core->hw_cdm_info->cdm_cmd);
+	kfree(lrme_core->hw_cdm_info);
+	kfree(lrme_core);
+
+deinit_platform_res:
+	rc = cam_lrme_soc_deinit_resources(&lrme_hw->soc_info);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Error in LRME soc deinit, rc=%d", rc);
+
+	mutex_destroy(&lrme_hw->hw_mutex);
+	kfree(lrme_hw);
+}
+
+const static struct component_ops cam_lrme_hw_dev_component_ops = {
+	.bind = cam_lrme_hw_dev_component_bind,
+	.unbind = cam_lrme_hw_dev_component_unbind,
+};
+
+static int cam_lrme_hw_dev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_LRME, "Adding LRME HW component");
+	rc = component_add(&pdev->dev, &cam_lrme_hw_dev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_LRME, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_lrme_hw_dev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_lrme_hw_dev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_lrme_hw_dt_match[] = {
+	{
+		.compatible = "qcom,lrme",
+		.data = &cam_lrme10_hw_info,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_lrme_hw_dt_match);
+
+struct platform_driver cam_lrme_hw_driver = {
+	.probe = cam_lrme_hw_dev_probe,
+	.remove = cam_lrme_hw_dev_remove,
+	.driver = {
+		.name = "cam_lrme_hw",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_lrme_hw_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_lrme_hw_init_module(void)
+{
+	return platform_driver_register(&cam_lrme_hw_driver);
+}
+
+void cam_lrme_hw_exit_module(void)
+{
+	platform_driver_unregister(&cam_lrme_hw_driver);
+}
+
+MODULE_DESCRIPTION("CAM LRME HW driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_intf.h
@@ -0,0 +1,226 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_INTF_H_
+#define _CAM_LRME_HW_INTF_H_
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/cam_cpas.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_lrme.h>
+
+#include "cam_io_util.h"
+#include "cam_soc_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_subdev.h"
+#include "cam_cpas_api.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+
+
+#define CAM_LRME_MAX_IO_BUFFER 2
+#define CAM_LRME_MAX_HW_ENTRIES 5
+
+#define CAM_LRME_BASE_IDX 0
+
+/**
+ *  enum cam_lrme_hw_type : Enum for LRME HW type
+ *
+ * @CAM_HW_LRME : LRME HW type
+ */
+enum cam_lrme_hw_type {
+	CAM_HW_LRME,
+};
+
+/**
+ * enum cam_lrme_cb_type : HW manager call back type
+ *
+ * @CAM_LRME_CB_BUF_DONE        : Indicate buf done has been generated
+ * @CAM_LRME_CB_COMP_REG_UPDATE : Indicate receiving WE comp reg update
+ * @CAM_LRME_CB_PUT_FRAME       : Request HW manager to put back the frame
+ * @CAM_LRME_CB_ERROR           : Indicate error irq has been generated
+ */
+enum cam_lrme_cb_type {
+	CAM_LRME_CB_BUF_DONE = 1,
+	CAM_LRME_CB_COMP_REG_UPDATE = 1 << 1,
+	CAM_LRME_CB_PUT_FRAME = 1 << 2,
+	CAM_LRME_CB_ERROR = 1 << 3,
+};
+
+/**
+ * enum cam_lrme_hw_cmd_type : HW CMD type
+ *
+ * @CAM_LRME_HW_CMD_prepare_hw_update : Prepare HW update
+ * @CAM_LRME_HW_CMD_REGISTER_CB       : register HW manager callback
+ * @CAM_LRME_HW_CMD_SUBMIT            : Submit frame to HW
+ * @CAM_LRME_HW_CMD_DUMP_REGISTER     : dump register values
+ * @CAM_LRME_HW_CMD_DUMP              : dump register values to buffer
+ */
+enum cam_lrme_hw_cmd_type {
+	CAM_LRME_HW_CMD_PREPARE_HW_UPDATE,
+	CAM_LRME_HW_CMD_REGISTER_CB,
+	CAM_LRME_HW_CMD_SUBMIT,
+	CAM_LRME_HW_CMD_DUMP_REGISTER,
+	CAM_LRME_HW_CMD_DUMP,
+};
+
+/**
+ * enum cam_lrme_hw_reset_type : Type of reset
+ *
+ * @CAM_LRME_HW_RESET_TYPE_HW_RESET : HW reset
+ * @CAM_LRME_HW_RESET_TYPE_SW_RESET : SW reset
+ */
+enum cam_lrme_hw_reset_type {
+	CAM_LRME_HW_RESET_TYPE_HW_RESET,
+	CAM_LRME_HW_RESET_TYPE_SW_RESET,
+};
+
+/**
+ *struct cam_lrme_frame_request : LRME frame request
+ *
+ * @frame_list            : List head
+ * @req_id                : Request ID
+ * @ctxt_to_hw_map        : Information about context id, priority and device id
+ * @hw_device             : Pointer to HW device
+ * @hw_update_entries     : List of hw_update_entries
+ * @num_hw_update_entries : number of hw_update_entries
+ * @submit_timestamp      : timestamp of submitting request with hw
+ */
+struct cam_lrme_frame_request {
+	struct list_head           frame_list;
+	uint64_t                   req_id;
+	void                      *ctxt_to_hw_map;
+	struct cam_lrme_device    *hw_device;
+	struct cam_hw_update_entry hw_update_entries[CAM_LRME_MAX_HW_ENTRIES];
+	uint32_t                   num_hw_update_entries;
+	ktime_t                    submit_timestamp;
+};
+
+/**
+ * struct cam_lrme_hw_io_buffer : IO buffer information
+ *
+ * @valid     : Indicate whether this IO config is valid
+ * @io_cfg    : Pointer to IO configuration
+ * @num_buf   : Number of buffers
+ * @num_plane : Number of planes
+ * @io_addr   : List of IO address
+ */
+struct cam_lrme_hw_io_buffer {
+	bool                   valid;
+	struct cam_buf_io_cfg *io_cfg;
+	uint32_t               num_buf;
+	uint32_t               num_plane;
+	uint64_t               io_addr[CAM_PACKET_MAX_PLANES];
+};
+
+/**
+ * struct cam_lrme_hw_cmd_config_args : Args for prepare HW update
+ *
+ * @hw_device       : Pointer to HW device
+ * @input_buf       : List of input buffers
+ * @output_buf      : List of output buffers
+ * @cmd_buf_addr    : Pointer to available KMD buffer
+ * @size            : Available KMD buffer size
+ * @config_buf_size : Size used to prepare update
+ */
+struct cam_lrme_hw_cmd_config_args {
+	struct cam_lrme_device *hw_device;
+	struct cam_lrme_hw_io_buffer input_buf[CAM_LRME_MAX_IO_BUFFER];
+	struct cam_lrme_hw_io_buffer output_buf[CAM_LRME_MAX_IO_BUFFER];
+	uint32_t *cmd_buf_addr;
+	uint32_t size;
+	uint32_t config_buf_size;
+};
+
+/**
+ * struct cam_lrme_hw_flush_args : Args for flush HW
+ *
+ * @ctxt_to_hw_map : Identity of context
+ * @req_to_flush   : Pointer to the frame need to flush in
+ *                   case of single frame flush
+ * @flush_type     : Flush type
+ */
+struct cam_lrme_hw_flush_args {
+	void                          *ctxt_to_hw_map;
+	struct cam_lrme_frame_request *req_to_flush;
+	uint32_t                       flush_type;
+};
+
+/**
+ * struct cam_lrme_hw_reset_args : Args for reset HW
+ *
+ * @reset_type : Enum cam_lrme_hw_reset_type
+ */
+struct cam_lrme_hw_reset_args {
+	uint32_t reset_type;
+};
+
+/**
+ * struct cam_lrme_hw_cb_args : HW manager callback args
+ *
+ * @cb_type   : Callback event type
+ * @frame_req : Pointer to the frame associated with the cb
+ */
+struct cam_lrme_hw_cb_args {
+	uint32_t                       cb_type;
+	struct cam_lrme_frame_request *frame_req;
+};
+
+/**
+ * struct cam_lrme_hw_cmd_set_cb : Args for set callback function
+ *
+ * @cam_lrme_hw_mgr_cb : Callback function pointer
+ * @data               : Data sent along with callback function
+ */
+struct cam_lrme_hw_cmd_set_cb {
+	int (*cam_lrme_hw_mgr_cb)(void *data,
+		struct cam_lrme_hw_cb_args *args);
+	void *data;
+};
+
+/**
+ * struct cam_lrme_hw_submit_args : Args for submit request
+ *
+ * @hw_update_entries     : List of hw update entries used to program registers
+ * @num_hw_update_entries : Number of hw update entries
+ * @frame_req             : Pointer to the frame request
+ */
+struct cam_lrme_hw_submit_args {
+	struct cam_hw_update_entry    *hw_update_entries;
+	uint32_t            num_hw_update_entries;
+	struct cam_lrme_frame_request *frame_req;
+};
+
+/**
+ * struct cam_lrme_hw_dump_args : Args for dump request
+ *
+ * @request_id   : Issue request id
+ * @cpu_addr     : start address of the target buffer
+ * @offset       : offset of the buffer
+ * @buf_len      : Length of target buffer
+ */
+struct cam_lrme_hw_dump_args {
+	uint64_t  request_id;
+	uintptr_t cpu_addr;
+	size_t    offset;
+	size_t    buf_len;
+};
+
+/**
+ * @brief : API to register LRME hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_lrme_hw_init_module(void);
+
+/**
+ * @brief : API to remove LRME Hw from platform framework.
+ */
+void cam_lrme_hw_exit_module(void);
+
+#endif /* _CAM_LRME_HW_INTF_H_ */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_reg.h
@@ -0,0 +1,186 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_REG_H_
+#define _CAM_LRME_HW_REG_H_
+
+#include "cam_lrme_hw_core.h"
+
+static struct cam_lrme_hw_info cam_lrme10_hw_info = {
+	.clc_reg = {
+		.clc_hw_version                 = 0x00000000,
+		.clc_hw_status                  = 0x00000004,
+		.clc_hw_status_dbg              = 0x00000008,
+		.clc_module_cfg                 = 0x00000060,
+		.clc_moduleformat               = 0x000000A8,
+		.clc_rangestep                  = 0x00000068,
+		.clc_offset                     = 0x0000006C,
+		.clc_maxallowedsad              = 0x00000070,
+		.clc_minallowedtarmad           = 0x00000074,
+		.clc_meaningfulsaddiff          = 0x00000078,
+		.clc_minsaddiffdenom            = 0x0000007C,
+		.clc_robustnessmeasuredistmap_0 = 0x00000080,
+		.clc_robustnessmeasuredistmap_1 = 0x00000084,
+		.clc_robustnessmeasuredistmap_2 = 0x00000088,
+		.clc_robustnessmeasuredistmap_3 = 0x0000008C,
+		.clc_robustnessmeasuredistmap_4 = 0x00000090,
+		.clc_robustnessmeasuredistmap_5 = 0x00000094,
+		.clc_robustnessmeasuredistmap_6 = 0x00000098,
+		.clc_robustnessmeasuredistmap_7 = 0x0000009C,
+		.clc_ds_crop_horizontal         = 0x000000A0,
+		.clc_ds_crop_vertical           = 0x000000A4,
+		.clc_tar_pd_unpacker            = 0x000000AC,
+		.clc_ref_pd_unpacker            = 0x000000B0,
+		.clc_sw_override                = 0x000000B4,
+		.clc_tar_height                 = 0x000000B8,
+		.clc_ref_height                 = 0x000000BC,
+		.clc_test_bus_ctrl              = 0x000001F8,
+		.clc_spare                      = 0x000001FC,
+	},
+	.bus_rd_reg = {
+		.common_reg = {
+			.hw_version     = 0x00000200,
+			.hw_capability  = 0x00000204,
+			.sw_reset       = 0x00000208,
+			.cgc_override   = 0x0000020C,
+			.irq_mask       = 0x00000210,
+			.irq_clear      = 0x00000214,
+			.irq_cmd        = 0x00000218,
+			.irq_status     = 0x0000021C,
+			.cmd            = 0x00000220,
+			.irq_set        = 0x00000224,
+			.misr_reset     = 0x0000022C,
+			.security_cfg   = 0x00000230,
+			.pwr_iso_cfg    = 0x00000234,
+			.pwr_iso_seed   = 0x00000238,
+			.test_bus_ctrl  = 0x00000248,
+			.spare          = 0x0000024C,
+		},
+		.bus_client_reg = {
+			/* bus client 0 */
+			{
+				.core_cfg                = 0x00000250,
+				.ccif_meta_data          = 0x00000254,
+				.addr_image              = 0x00000258,
+				.rd_buffer_size          = 0x0000025C,
+				.rd_stride               = 0x00000260,
+				.unpack_cfg_0            = 0x00000264,
+				.latency_buff_allocation = 0x00000278,
+				.burst_limit_cfg         = 0x00000280,
+				.misr_cfg_0              = 0x00000284,
+				.misr_cfg_1              = 0x00000288,
+				.misr_rd_val             = 0x0000028C,
+				.debug_status_cfg        = 0x00000290,
+				.debug_status_0          = 0x00000294,
+				.debug_status_1          = 0x00000298,
+			},
+			/* bus client 1 */
+			{
+				.core_cfg                = 0x000002F0,
+				.ccif_meta_data          = 0x000002F4,
+				.addr_image              = 0x000002F8,
+				.rd_buffer_size          = 0x000002FC,
+				.rd_stride               = 0x00000300,
+				.unpack_cfg_0            = 0x00000304,
+				.latency_buff_allocation = 0x00000318,
+				.burst_limit_cfg         = 0x00000320,
+				.misr_cfg_0              = 0x00000324,
+				.misr_cfg_1              = 0x00000328,
+				.misr_rd_val             = 0x0000032C,
+				.debug_status_cfg        = 0x00000330,
+				.debug_status_0          = 0x00000334,
+				.debug_status_1          = 0x00000338,
+			},
+		},
+	},
+	.bus_wr_reg = {
+		.common_reg = {
+			.hw_version        = 0x00000500,
+			.hw_capability     = 0x00000504,
+			.sw_reset          = 0x00000508,
+			.cgc_override      = 0x0000050C,
+			.misr_reset        = 0x000005C8,
+			.pwr_iso_cfg       = 0x000005CC,
+			.test_bus_ctrl     = 0x0000061C,
+			.composite_mask_0  = 0x00000510,
+			.irq_mask_0        = 0x00000544,
+			.irq_mask_1        = 0x00000548,
+			.irq_clear_0       = 0x00000550,
+			.irq_clear_1       = 0x00000554,
+			.irq_status_0      = 0x0000055C,
+			.irq_status_1      = 0x00000560,
+			.irq_cmd           = 0x00000568,
+			.irq_set_0         = 0x000005BC,
+			.irq_set_1         = 0x000005C0,
+			.addr_fifo_status  = 0x000005A8,
+			.frame_header_cfg0 = 0x000005AC,
+			.frame_header_cfg1 = 0x000005B0,
+			.spare             = 0x00000620,
+		},
+		.bus_client_reg = {
+			/* bus client 0 */
+			{
+				.status_0                  = 0x00000700,
+				.status_1                  = 0x00000704,
+				.cfg                       = 0x00000708,
+				.addr_frame_header         = 0x0000070C,
+				.frame_header_cfg          = 0x00000710,
+				.addr_image                = 0x00000714,
+				.addr_image_offset         = 0x00000718,
+				.buffer_width_cfg          = 0x0000071C,
+				.buffer_height_cfg         = 0x00000720,
+				.packer_cfg                = 0x00000724,
+				.wr_stride                 = 0x00000728,
+				.irq_subsample_cfg_period  = 0x00000748,
+				.irq_subsample_cfg_pattern = 0x0000074C,
+				.burst_limit_cfg           = 0x0000075C,
+				.misr_cfg                  = 0x00000760,
+				.misr_rd_word_sel          = 0x00000764,
+				.misr_val                  = 0x00000768,
+				.debug_status_cfg          = 0x0000076C,
+				.debug_status_0            = 0x00000770,
+				.debug_status_1            = 0x00000774,
+			},
+			/* bus client 1 */
+			{
+				.status_0                  = 0x00000800,
+				.status_1                  = 0x00000804,
+				.cfg                       = 0x00000808,
+				.addr_frame_header         = 0x0000080C,
+				.frame_header_cfg          = 0x00000810,
+				.addr_image                = 0x00000814,
+				.addr_image_offset         = 0x00000818,
+				.buffer_width_cfg          = 0x0000081C,
+				.buffer_height_cfg         = 0x00000820,
+				.packer_cfg                = 0x00000824,
+				.wr_stride                 = 0x00000828,
+				.irq_subsample_cfg_period  = 0x00000848,
+				.irq_subsample_cfg_pattern = 0x0000084C,
+				.burst_limit_cfg           = 0x0000085C,
+				.misr_cfg                  = 0x00000860,
+				.misr_rd_word_sel          = 0x00000864,
+				.misr_val                  = 0x00000868,
+				.debug_status_cfg          = 0x0000086C,
+				.debug_status_0            = 0x00000870,
+				.debug_status_1            = 0x00000874,
+			},
+		},
+	},
+	.titan_reg = {
+		.top_hw_version        = 0x00000900,
+		.top_titan_version     = 0x00000904,
+		.top_rst_cmd           = 0x00000908,
+		.top_core_clk_cfg      = 0x00000920,
+		.top_irq_status        = 0x0000090C,
+		.top_irq_mask          = 0x00000910,
+		.top_irq_clear         = 0x00000914,
+		.top_irq_set           = 0x00000918,
+		.top_irq_cmd           = 0x0000091C,
+		.top_violation_status  = 0x00000924,
+		.top_spare             = 0x000009FC,
+	},
+};
+
+#endif /* _CAM_LRME_HW_REG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.c
@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "cam_lrme_hw_core.h"
+#include "cam_lrme_hw_soc.h"
+
+
+int cam_lrme_soc_enable_resources(struct cam_hw_info *lrme_hw)
+{
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_soc_private *soc_private =
+		(struct cam_lrme_soc_private *)soc_info->soc_private;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	int rc = 0;
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 2;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_READ;
+	axi_vote.axi_path[0].camnoc_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[0].mnoc_ib_bw = 7200000;
+	axi_vote.axi_path[1].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[1].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[1].camnoc_bw = 7200000;
+	axi_vote.axi_path[1].mnoc_ab_bw = 7200000;
+	axi_vote.axi_path[1].mnoc_ib_bw = 7200000;
+
+	rc = cam_cpas_start(soc_private->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to start cpas, rc %d", rc);
+		return -EFAULT;
+	}
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true, CAM_SVS_VOTE,
+		true);
+	if (rc) {
+		CAM_ERR(CAM_LRME,
+			"Failed to enable platform resource, rc %d", rc);
+		goto stop_cpas;
+	}
+
+	cam_lrme_set_irq(lrme_hw, CAM_LRME_IRQ_ENABLE);
+
+	return rc;
+
+stop_cpas:
+	if (cam_cpas_stop(soc_private->cpas_handle))
+		CAM_ERR(CAM_LRME, "Failed to stop cpas");
+
+	return rc;
+}
+
+int cam_lrme_soc_disable_resources(struct cam_hw_info *lrme_hw)
+{
+	struct cam_hw_soc_info *soc_info = &lrme_hw->soc_info;
+	struct cam_lrme_soc_private *soc_private;
+	int rc = 0;
+
+	soc_private = soc_info->soc_private;
+
+	cam_lrme_set_irq(lrme_hw, CAM_LRME_IRQ_DISABLE);
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed to disable platform resource");
+		return rc;
+	}
+	rc = cam_cpas_stop(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Failed to stop cpas");
+
+	return rc;
+}
+
+int cam_lrme_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *private_data)
+{
+	struct cam_lrme_soc_private *soc_private;
+	struct cam_cpas_register_params cpas_register_param;
+	int rc;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed in get_dt_properties, rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_soc_util_request_platform_resource(soc_info, irq_handler,
+		private_data);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "Failed in request_platform_resource rc=%d",
+			rc);
+		return rc;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_lrme_soc_private), GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto release_res;
+	}
+	soc_info->soc_private = soc_private;
+
+	memset(&cpas_register_param, 0, sizeof(cpas_register_param));
+	strscpy(cpas_register_param.identifier, "lrmecpas",
+		CAM_HW_IDENTIFIER_LENGTH);
+	cpas_register_param.cell_index = soc_info->index;
+	cpas_register_param.dev = &soc_info->pdev->dev;
+	cpas_register_param.userdata = private_data;
+	cpas_register_param.cam_cpas_client_cb = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_param);
+	if (rc) {
+		CAM_ERR(CAM_LRME, "CPAS registration failed");
+		goto free_soc_private;
+	}
+	soc_private->cpas_handle = cpas_register_param.client_handle;
+	CAM_DBG(CAM_LRME, "CPAS handle=%d", soc_private->cpas_handle);
+
+	return rc;
+
+free_soc_private:
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+release_res:
+	cam_soc_util_release_platform_resource(soc_info);
+
+	return rc;
+}
+
+int cam_lrme_soc_deinit_resources(struct cam_hw_soc_info *soc_info)
+{
+	struct cam_lrme_soc_private *soc_private =
+		(struct cam_lrme_soc_private *)soc_info->soc_private;
+	int rc;
+
+	rc = cam_cpas_unregister_client(soc_private->cpas_handle);
+	if (rc)
+		CAM_ERR(CAM_LRME, "Unregister cpas failed, handle=%d, rc=%d",
+			soc_private->cpas_handle, rc);
+
+	rc = cam_soc_util_release_platform_resource(soc_info);
+	if (rc)
+		CAM_ERR(CAM_LRME, "release platform failed, rc=%d", rc);
+
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_lrme/lrme_hw_mgr/lrme_hw/cam_lrme_hw_soc.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_LRME_HW_SOC_H_
+#define _CAM_LRME_HW_SOC_H_
+
+#include "cam_soc_util.h"
+
+struct cam_lrme_soc_private {
+	uint32_t cpas_handle;
+};
+
+int cam_lrme_soc_enable_resources(struct cam_hw_info *lrme_hw);
+int cam_lrme_soc_disable_resources(struct cam_hw_info *lrme_hw);
+int cam_lrme_soc_init_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t irq_handler, void *private_data);
+int cam_lrme_soc_deinit_resources(struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_LRME_HW_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/cam_ope_context.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/cam_ope_context.c
@@ -0,0 +1,292 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <media/cam_sync.h>
+#include <media/cam_defs.h>
+#include <media/cam_ope.h>
+#include "cam_sync_api.h"
+#include "cam_node.h"
+#include "cam_context.h"
+#include "cam_context_utils.h"
+#include "cam_ope_context.h"
+#include "cam_req_mgr_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_packet_util.h"
+
+static const char ope_dev_name[] = "cam-ope";
+
+static int cam_ope_context_dump_active_request(void *data,
+	struct cam_smmu_pf_info *pf_info)
+{
+	struct cam_context *ctx = (struct cam_context *)data;
+	struct cam_ctx_request          *req = NULL;
+	struct cam_ctx_request          *req_temp = NULL;
+	struct cam_hw_mgr_dump_pf_data  *pf_dbg_entry = NULL;
+	uint32_t  resource_type = 0;
+	int rc = 0;
+	bool b_mem_found = false, b_ctx_found = false;
+
+	if (!ctx) {
+		CAM_ERR(CAM_OPE, "Invalid ctx");
+		return -EINVAL;
+	}
+
+	if (ctx->state < CAM_CTX_ACQUIRED || ctx->state > CAM_CTX_ACTIVATED) {
+		CAM_ERR(CAM_OPE, "Invalid state ope ctx %d state %d",
+			ctx->ctx_id, ctx->state);
+		goto end;
+	}
+
+	CAM_INFO(CAM_OPE, "iommu fault for ope ctx %d state %d",
+		ctx->ctx_id, ctx->state);
+
+	list_for_each_entry_safe(req, req_temp,
+			&ctx->active_req_list, list) {
+		pf_dbg_entry = &(req->pf_data);
+		CAM_INFO(CAM_OPE, "req_id : %lld", req->request_id);
+
+		rc = cam_context_dump_pf_info_to_hw(ctx, pf_dbg_entry,
+			&b_mem_found, &b_ctx_found, &resource_type, pf_info);
+		if (rc)
+			CAM_ERR(CAM_OPE, "Failed to dump pf info");
+
+		if (b_mem_found)
+			CAM_ERR(CAM_OPE, "Found page fault in req %lld %d",
+				req->request_id, rc);
+	}
+
+end:
+	return rc;
+}
+
+static int __cam_ope_acquire_dev_in_available(struct cam_context *ctx,
+	struct cam_acquire_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_acquire_dev_to_hw(ctx, cmd);
+	if (!rc) {
+		ctx->state = CAM_CTX_ACQUIRED;
+		trace_cam_context_state("OPE", ctx);
+	}
+
+	return rc;
+}
+
+static int __cam_ope_release_dev_in_acquired(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_release_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Unable to release device");
+
+	ctx->state = CAM_CTX_AVAILABLE;
+	trace_cam_context_state("OPE", ctx);
+	return rc;
+}
+
+static int __cam_ope_start_dev_in_acquired(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_start_dev_to_hw(ctx, cmd);
+	if (!rc) {
+		ctx->state = CAM_CTX_READY;
+		trace_cam_context_state("OPE", ctx);
+	}
+
+	return rc;
+}
+
+static int __cam_ope_flush_dev_in_ready(struct cam_context *ctx,
+	struct cam_flush_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_flush_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to flush device");
+
+	return rc;
+}
+
+static int __cam_ope_dump_dev_in_ready(struct cam_context *ctx,
+	struct cam_dump_req_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_dump_dev_to_hw(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to dump device");
+
+	return rc;
+}
+
+static int __cam_ope_config_dev_in_ready(struct cam_context *ctx,
+	struct cam_config_dev_cmd *cmd)
+{
+	int rc;
+	size_t len;
+	uintptr_t packet_addr;
+
+	rc = cam_mem_get_cpu_buf((int32_t) cmd->packet_handle,
+		&packet_addr, &len);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "[%s][%d] Can not get packet address",
+			ctx->dev_name, ctx->ctx_id);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	rc = cam_context_prepare_dev_to_hw(ctx, cmd);
+
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to prepare device");
+
+	cam_mem_put_cpu_buf((int32_t) cmd->packet_handle);
+	return rc;
+}
+
+static int __cam_ope_stop_dev_in_ready(struct cam_context *ctx,
+	struct cam_start_stop_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = cam_context_stop_dev_to_hw(ctx);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to stop device");
+
+	ctx->state = CAM_CTX_ACQUIRED;
+	trace_cam_context_state("OPE", ctx);
+	return rc;
+}
+
+static int __cam_ope_release_dev_in_ready(struct cam_context *ctx,
+	struct cam_release_dev_cmd *cmd)
+{
+	int rc;
+
+	rc = __cam_ope_stop_dev_in_ready(ctx, NULL);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to stop device");
+
+	rc = __cam_ope_release_dev_in_acquired(ctx, cmd);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to release device");
+
+	return rc;
+}
+
+static int __cam_ope_handle_buf_done_in_ready(void *ctx,
+	uint32_t evt_id, void *done)
+{
+	return cam_context_buf_done_from_hw(ctx, done, evt_id);
+}
+
+static struct cam_ctx_ops
+	cam_ope_ctx_state_machine[CAM_CTX_STATE_MAX] = {
+	/* Uninit */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Available */
+	{
+		.ioctl_ops = {
+			.acquire_dev = __cam_ope_acquire_dev_in_available,
+		},
+		.crm_ops = {},
+		.irq_ops = NULL,
+	},
+	/* Acquired */
+	{
+		.ioctl_ops = {
+			.release_dev = __cam_ope_release_dev_in_acquired,
+			.start_dev = __cam_ope_start_dev_in_acquired,
+			.config_dev = __cam_ope_config_dev_in_ready,
+			.flush_dev = __cam_ope_flush_dev_in_ready,
+			.dump_dev = __cam_ope_dump_dev_in_ready,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_ope_handle_buf_done_in_ready,
+		.pagefault_ops = cam_ope_context_dump_active_request,
+	},
+	/* Ready */
+	{
+		.ioctl_ops = {
+			.stop_dev = __cam_ope_stop_dev_in_ready,
+			.release_dev = __cam_ope_release_dev_in_ready,
+			.config_dev = __cam_ope_config_dev_in_ready,
+			.flush_dev = __cam_ope_flush_dev_in_ready,
+			.dump_dev = __cam_ope_dump_dev_in_ready,
+		},
+		.crm_ops = {},
+		.irq_ops = __cam_ope_handle_buf_done_in_ready,
+		.pagefault_ops = cam_ope_context_dump_active_request,
+	},
+	/* Flushed */
+	{
+		.ioctl_ops = {},
+	},
+	/* Activated */
+	{
+		.ioctl_ops = {},
+		.crm_ops = {},
+		.irq_ops = NULL,
+		.pagefault_ops = cam_ope_context_dump_active_request,
+	},
+};
+
+int cam_ope_context_init(struct cam_ope_context *ctx,
+	struct cam_hw_mgr_intf *hw_intf, uint32_t ctx_id)
+{
+	int rc;
+
+	if ((!ctx) || (!ctx->base) || (!hw_intf)) {
+		CAM_ERR(CAM_OPE, "Invalid params: %pK %pK", ctx, hw_intf);
+		rc = -EINVAL;
+		goto err;
+	}
+
+	rc = cam_context_init(ctx->base, ope_dev_name, CAM_OPE, ctx_id,
+		NULL, hw_intf, ctx->req_base, CAM_CTX_REQ_MAX);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "Camera Context Base init failed");
+		goto err;
+	}
+
+	ctx->base->state_machine = cam_ope_ctx_state_machine;
+	ctx->base->ctx_priv = ctx;
+	ctx->ctxt_to_hw_map = NULL;
+
+err:
+	return rc;
+}
+
+int cam_ope_context_deinit(struct cam_ope_context *ctx)
+{
+	if ((!ctx) || (!ctx->base)) {
+		CAM_ERR(CAM_OPE, "Invalid params: %pK", ctx);
+		return -EINVAL;
+	}
+
+	cam_context_deinit(ctx->base);
+	memset(ctx, 0, sizeof(*ctx));
+
+	return 0;
+}
+
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/cam_ope_context.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/cam_ope_context.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_OPE_CONTEXT_H_
+#define _CAM_OPE_CONTEXT_H_
+
+#include "cam_context.h"
+
+#define OPE_CTX_MAX 32
+
+/**
+ * struct cam_ope_context - ope context
+ * @base:           ope context object
+ * @state_machine:  state machine for OPE context
+ * @req_base:       common request structure
+ * @state:          ope context state
+ * @ctxt_to_hw_map: context to FW handle mapping
+ */
+struct cam_ope_context {
+	struct cam_context *base;
+	struct cam_ctx_ops *state_machine;
+	struct cam_ctx_request req_base[CAM_CTX_REQ_MAX];
+	uint32_t state;
+	void *ctxt_to_hw_map;
+};
+
+/**
+ * cam_ope_context_init() - OPE context init
+ * @ctx:     Pointer to context
+ * @hw_intf: Pointer to OPE hardware interface
+ * @ctx_id:  ID for this context
+ */
+int cam_ope_context_init(struct cam_ope_context *ctx,
+	struct cam_hw_mgr_intf *hw_intf, uint32_t ctx_id);
+
+/**
+ * cam_ope_context_deinit() - OPE context deinit
+ * @ctx: Pointer to context
+ */
+int cam_ope_context_deinit(struct cam_ope_context *ctx);
+
+#endif /* _CAM_OPE_CONTEXT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/cam_ope_subdev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/cam_ope_subdev.c
@@ -0,0 +1,323 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/platform_device.h>
+#include <linux/videodev2.h>
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_defs.h>
+#include <media/cam_ope.h>
+#include "cam_req_mgr_dev.h"
+#include "cam_subdev.h"
+#include "cam_node.h"
+#include "cam_context.h"
+#include "cam_ope_context.h"
+#include "cam_ope_hw_mgr_intf.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_debug_util.h"
+#include "cam_smmu_api.h"
+#include "camera_main.h"
+
+#define OPE_DEV_NAME        "cam-ope"
+
+struct cam_ope_subdev {
+	struct cam_subdev sd;
+	struct cam_node *node;
+	struct cam_context ctx[OPE_CTX_MAX];
+	struct cam_ope_context ctx_ope[OPE_CTX_MAX];
+	struct mutex ope_lock;
+	int32_t open_cnt;
+	int32_t reserved;
+};
+
+static struct cam_ope_subdev g_ope_dev;
+
+static void cam_ope_dev_iommu_fault_handler(
+	struct cam_smmu_pf_info *pf_info)
+{
+	int i = 0;
+	struct cam_node *node = NULL;
+
+	if (!pf_info || !pf_info->token) {
+		CAM_ERR(CAM_ISP, "invalid token in page handler cb");
+		return;
+	}
+
+	node = (struct cam_node *)pf_info->token;
+
+	for (i = 0; i < node->ctx_size; i++)
+		cam_context_dump_pf_info(&(node->ctx_list[i]), pf_info);
+}
+
+static int cam_ope_subdev_open(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_hw_mgr_intf *hw_mgr_intf = NULL;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+	int rc = 0;
+
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
+	mutex_lock(&g_ope_dev.ope_lock);
+	if (g_ope_dev.open_cnt >= 1) {
+		CAM_ERR(CAM_OPE, "OPE subdev is already opened");
+		rc = -EALREADY;
+		goto end;
+	}
+
+	if (!node) {
+		CAM_ERR(CAM_OPE, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	hw_mgr_intf = &node->hw_mgr_intf;
+	rc = hw_mgr_intf->hw_open(hw_mgr_intf->hw_mgr_priv, NULL);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "OPE HW open failed: %d", rc);
+		goto end;
+	}
+	g_ope_dev.open_cnt++;
+	CAM_DBG(CAM_OPE, "OPE HW open success: %d", rc);
+end:
+	mutex_unlock(&g_ope_dev.ope_lock);
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+	return rc;
+}
+
+static int cam_ope_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	int rc = 0;
+	struct cam_hw_mgr_intf *hw_mgr_intf = NULL;
+	struct cam_node *node = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&g_ope_dev.ope_lock);
+	if (g_ope_dev.open_cnt <= 0) {
+		CAM_DBG(CAM_OPE, "OPE subdev is already closed");
+		rc = -EINVAL;
+		goto end;
+	}
+	g_ope_dev.open_cnt--;
+	if (!node) {
+		CAM_ERR(CAM_OPE, "Invalid args");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	hw_mgr_intf = &node->hw_mgr_intf;
+	if (!hw_mgr_intf) {
+		CAM_ERR(CAM_OPE, "hw_mgr_intf is not initialized");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	rc = cam_node_shutdown(node);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "HW close failed");
+		goto end;
+	}
+	CAM_DBG(CAM_OPE, "OPE HW close success: %d", rc);
+
+end:
+	mutex_unlock(&g_ope_dev.ope_lock);
+	return rc;
+}
+
+static int cam_ope_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_OPE, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_ope_subdev_close_internal(sd, fh);
+}
+
+const struct v4l2_subdev_internal_ops cam_ope_subdev_internal_ops = {
+	.open = cam_ope_subdev_open,
+	.close = cam_ope_subdev_close,
+};
+
+static int cam_ope_subdev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0, i = 0;
+	struct cam_node *node;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	int iommu_hdl = -1;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_OPE, "Binding OPE subdev component");
+	if (!pdev) {
+		CAM_ERR(CAM_OPE, "pdev is NULL");
+		return -EINVAL;
+	}
+
+	g_ope_dev.sd.pdev = pdev;
+	g_ope_dev.sd.internal_ops = &cam_ope_subdev_internal_ops;
+	g_ope_dev.sd.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+	rc = cam_subdev_probe(&g_ope_dev.sd, pdev, OPE_DEV_NAME,
+		CAM_OPE_DEVICE_TYPE);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "OPE cam_subdev_probe failed:%d", rc);
+		return rc;
+	}
+
+	node = (struct cam_node *) g_ope_dev.sd.token;
+
+	hw_mgr_intf = kzalloc(sizeof(*hw_mgr_intf), GFP_KERNEL);
+	if (!hw_mgr_intf) {
+		rc = -EINVAL;
+		goto hw_alloc_fail;
+	}
+
+	rc = cam_ope_hw_mgr_init(pdev->dev.of_node, (uint64_t *)hw_mgr_intf,
+		&iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "OPE HW manager init failed: %d", rc);
+		goto hw_init_fail;
+	}
+
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		g_ope_dev.ctx_ope[i].base = &g_ope_dev.ctx[i];
+		rc = cam_ope_context_init(&g_ope_dev.ctx_ope[i],
+			hw_mgr_intf, i);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE context init failed");
+			goto ctx_fail;
+		}
+	}
+
+	rc = cam_node_init(node, hw_mgr_intf, g_ope_dev.ctx,
+		OPE_CTX_MAX, OPE_DEV_NAME);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "OPE node init failed");
+		goto ctx_fail;
+	}
+
+	cam_smmu_set_client_page_fault_handler(iommu_hdl,
+		cam_ope_dev_iommu_fault_handler, node);
+
+	g_ope_dev.open_cnt = 0;
+	mutex_init(&g_ope_dev.ope_lock);
+
+	node->sd_handler = cam_ope_subdev_close_internal;
+	rc = cam_subdev_register(&g_ope_dev.sd, pdev);
+	CAM_DBG(CAM_OPE, "Subdev component bound successfully");
+
+	return rc;
+
+ctx_fail:
+	for (--i; i >= 0; i--)
+		cam_ope_context_deinit(&g_ope_dev.ctx_ope[i]);
+hw_init_fail:
+	kfree(hw_mgr_intf);
+hw_alloc_fail:
+	cam_subdev_remove(&g_ope_dev.sd);
+	return rc;
+}
+
+static void cam_ope_subdev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+	struct v4l2_subdev *sd;
+	struct cam_subdev *subdev;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	if (!pdev) {
+		CAM_ERR(CAM_OPE, "pdev is NULL");
+		return;
+	}
+
+	sd = platform_get_drvdata(pdev);
+	if (!sd) {
+		CAM_ERR(CAM_OPE, "V4l2 subdev is NULL");
+		return;
+	}
+
+	subdev = v4l2_get_subdevdata(sd);
+	if (!subdev) {
+		CAM_ERR(CAM_OPE, "cam subdev is NULL");
+		return;
+	}
+
+	for (i = 0; i < OPE_CTX_MAX; i++)
+		cam_ope_context_deinit(&g_ope_dev.ctx_ope[i]);
+
+	cam_node_deinit(g_ope_dev.node);
+	cam_unregister_subdev(&g_ope_dev.sd);
+	cam_subdev_remove(&g_ope_dev.sd);
+	mutex_destroy(&g_ope_dev.ope_lock);
+}
+
+const static struct component_ops cam_ope_subdev_component_ops = {
+	.bind = cam_ope_subdev_component_bind,
+	.unbind = cam_ope_subdev_component_unbind,
+};
+
+static int cam_ope_subdev_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_OPE, "Adding OPE subdev component");
+	rc = component_add(&pdev->dev, &cam_ope_subdev_component_ops);
+	if (rc)
+		CAM_ERR(CAM_OPE, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_ope_subdev_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ope_subdev_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_ope_dt_match[] = {
+	{.compatible = "qcom,cam-ope"},
+	{}
+};
+
+
+struct platform_driver cam_ope_subdev_driver = {
+	.probe = cam_ope_subdev_probe,
+	.remove = cam_ope_subdev_remove,
+	.driver = {
+		.name = "cam_ope",
+		.of_match_table = cam_ope_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ope_subdev_init_module(void)
+{
+	return platform_driver_register(&cam_ope_subdev_driver);
+}
+
+void cam_ope_subdev_exit_module(void)
+{
+	platform_driver_unregister(&cam_ope_subdev_driver);
+}
+
+MODULE_DESCRIPTION("MSM OPE driver");
+MODULE_LICENSE("GPL v2");
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
@@ -0,0 +1,4309 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/uaccess.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/io.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+#include <linux/timer.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <linux/debugfs.h>
+#include <media/cam_defs.h>
+#include <media/cam_ope.h>
+#include <media/cam_cpas.h>
+#include <linux/math64.h>
+
+#include "cam_sync_api.h"
+#include "cam_packet_util.h"
+#include "cam_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_ope_hw_mgr_intf.h"
+#include "cam_ope_hw_mgr.h"
+#include "ope_hw.h"
+#include "cam_smmu_api.h"
+#include "cam_mem_mgr.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_debug_util.h"
+#include "cam_soc_util.h"
+#include "cam_trace.h"
+#include "cam_cpas_api.h"
+#include "cam_common_util.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cdm_util.h"
+#include "cam_cdm.h"
+#include "ope_dev_intf.h"
+#include "cam_compat.h"
+
+static struct cam_ope_hw_mgr *ope_hw_mgr;
+
+static int cam_ope_req_timer_reset(struct cam_ope_ctx *ctx_data);
+
+static void cam_ope_mgr_dump_pf_data(struct cam_ope_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args  *hw_cmd_args);
+
+static int cam_ope_mgr_get_rsc_idx(struct cam_ope_ctx *ctx_data,
+	struct ope_io_buf_info *in_io_buf)
+{
+	int k = 0;
+	int rsc_idx = -EINVAL;
+
+	if (in_io_buf->direction == CAM_BUF_INPUT) {
+		for (k = 0; k < OPE_IN_RES_MAX; k++) {
+			if (ctx_data->ope_acquire.in_res[k].res_id ==
+				in_io_buf->resource_type)
+				break;
+		}
+		if (k == OPE_IN_RES_MAX) {
+			CAM_ERR(CAM_OPE, "Invalid res_id %d",
+				in_io_buf->resource_type);
+			goto end;
+		}
+		rsc_idx = k;
+	} else if (in_io_buf->direction == CAM_BUF_OUTPUT) {
+		for (k = 0; k < OPE_OUT_RES_MAX; k++) {
+			if (ctx_data->ope_acquire.out_res[k].res_id ==
+				in_io_buf->resource_type)
+				break;
+		}
+		if (k == OPE_OUT_RES_MAX) {
+			CAM_ERR(CAM_OPE, "Invalid res_id %d",
+				in_io_buf->resource_type);
+			goto end;
+		}
+		rsc_idx = k;
+	}
+
+end:
+	return rsc_idx;
+}
+
+static bool cam_ope_is_pending_request(struct cam_ope_ctx *ctx_data)
+{
+	return !bitmap_empty(ctx_data->bitmap, CAM_CTX_REQ_MAX);
+}
+
+static int cam_ope_mgr_process_cmd(void *priv, void *data)
+{
+	int rc;
+	struct ope_cmd_work_data *task_data = NULL;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_OPE, "Invalid params%pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	ctx_data = priv;
+	task_data = (struct ope_cmd_work_data *)data;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	cdm_cmd = task_data->data;
+
+	if (!cdm_cmd) {
+		CAM_ERR(CAM_OPE, "Invalid params%pK", cdm_cmd);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	if (ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_OPE, "ctx id :%u is not in use",
+			ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	if (task_data->req_id <= ctx_data->last_flush_req) {
+		CAM_WARN(CAM_OPE,
+			"request %lld has been flushed, last flush req %lld, reject packet",
+			task_data->req_id, ctx_data->last_flush_req);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	if (!cam_ope_is_pending_request(ctx_data)) {
+		CAM_WARN(CAM_OPE, "no pending req, req %lld last flush %lld",
+			task_data->req_id, ctx_data->last_flush_req);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_OPE,
+		"cam_cdm_submit_bls: handle 0x%x, ctx_id %d req %d cookie %d",
+		ctx_data->ope_cdm.cdm_handle, ctx_data->ctx_id,
+		task_data->req_id, cdm_cmd->cookie);
+
+	if (task_data->req_id > ctx_data->last_flush_req)
+		ctx_data->last_flush_req = 0;
+
+	cam_ope_req_timer_reset(ctx_data);
+
+	rc = cam_cdm_submit_bls(ctx_data->ope_cdm.cdm_handle, cdm_cmd);
+
+	if (!rc)
+		ctx_data->req_cnt++;
+	else
+		CAM_ERR(CAM_OPE, "submit failed for %lld", cdm_cmd->cookie);
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+}
+
+static int cam_ope_mgr_reset_hw(void)
+{
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+	int i, rc = 0;
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RESET,
+			NULL, 0);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Reset failed: %d", rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static void cam_ope_free_io_config(struct cam_ope_request *req)
+{
+	int i, j;
+
+	for (i = 0; i < OPE_MAX_BATCH_SIZE; i++) {
+		for (j = 0; j < OPE_MAX_IO_BUFS; j++) {
+			if (req->io_buf[i][j]) {
+				cam_free_clear((void *)req->io_buf[i][j]);
+				req->io_buf[i][j] = NULL;
+			}
+		}
+	}
+}
+
+static void cam_ope_device_timer_stop(struct cam_ope_hw_mgr *hw_mgr)
+{
+	if (hw_mgr->clk_info.watch_dog) {
+		hw_mgr->clk_info.watch_dog_reset_counter = 0;
+		crm_timer_exit(&hw_mgr->clk_info.watch_dog);
+		hw_mgr->clk_info.watch_dog = NULL;
+	}
+}
+
+static void cam_ope_device_timer_reset(struct cam_ope_hw_mgr *hw_mgr)
+{
+
+	if (hw_mgr->clk_info.watch_dog) {
+		CAM_DBG(CAM_OPE, "reset timer");
+		crm_timer_reset(hw_mgr->clk_info.watch_dog);
+			hw_mgr->clk_info.watch_dog_reset_counter++;
+	}
+}
+
+static int cam_ope_req_timer_modify(struct cam_ope_ctx *ctx_data,
+	int32_t expires)
+{
+	if (ctx_data->req_watch_dog) {
+		CAM_DBG(CAM_OPE, "stop timer : ctx_id = %d", ctx_data->ctx_id);
+		crm_timer_modify(ctx_data->req_watch_dog, expires);
+	}
+	return 0;
+}
+
+static int cam_ope_req_timer_stop(struct cam_ope_ctx *ctx_data)
+{
+	if (ctx_data->req_watch_dog) {
+		CAM_DBG(CAM_OPE, "stop timer : ctx_id = %d", ctx_data->ctx_id);
+		ctx_data->req_watch_dog_reset_counter = 0;
+		crm_timer_exit(&ctx_data->req_watch_dog);
+		ctx_data->req_watch_dog = NULL;
+	}
+	return 0;
+}
+
+static int cam_ope_req_timer_reset(struct cam_ope_ctx *ctx_data)
+{
+	if (ctx_data && ctx_data->req_watch_dog) {
+		ctx_data->req_watch_dog_reset_counter++;
+		CAM_DBG(CAM_OPE, "reset timer : ctx_id = %d, counter=%d",
+			ctx_data->ctx_id,
+			ctx_data->req_watch_dog_reset_counter);
+		crm_timer_reset(ctx_data->req_watch_dog);
+	}
+
+	return 0;
+}
+
+
+static int cam_ope_mgr_reapply_config(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_request *ope_req)
+{
+	int rc = 0;
+	uint64_t request_id = 0;
+	struct crm_workq_task *task;
+	struct ope_cmd_work_data *task_data;
+
+	request_id = ope_req->request_id;
+	CAM_DBG(CAM_OPE, "reapply req_id = %lld", request_id);
+
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		return -ENOMEM;
+	}
+
+	task_data = (struct ope_cmd_work_data *)task->payload;
+	task_data->data = (void *)ope_req->cdm_cmd;
+	task_data->req_id = request_id;
+	task_data->type = OPE_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_ope_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, ctx_data,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_get_valid_ctx_id(void)
+{
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+	int i;
+
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		if (hw_mgr->ctx[i].ctx_state == OPE_CTX_STATE_ACQUIRED)
+			break;
+	}
+
+	if (i == OPE_CTX_MAX)
+		return -EINVAL;
+
+	return i;
+}
+
+static int32_t cam_ope_mgr_process_msg(void *priv, void *data)
+{
+	struct ope_msg_work_data *task_data;
+	struct cam_ope_hw_mgr *hw_mgr;
+	struct cam_ope_ctx *ctx;
+	uint32_t irq_status;
+	int32_t ctx_id;
+	int rc = 0, i;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_OPE, "Invalid data");
+		return -EINVAL;
+	}
+
+	task_data = data;
+	hw_mgr = priv;
+	irq_status = task_data->irq_status;
+	ctx_id = cam_get_valid_ctx_id();
+	if (ctx_id < 0) {
+		CAM_ERR(CAM_OPE, "No valid context to handle error");
+		return ctx_id;
+	}
+
+	ctx = &hw_mgr->ctx[ctx_id];
+
+	/* Indicate about this error to CDM and reset OPE*/
+	rc = cam_cdm_handle_error(ctx->ope_cdm.cdm_handle);
+
+	mutex_lock(&ctx->ctx_mutex);
+	if (ctx->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_OPE, "ctx id: %d not in right state: %d",
+			ctx_id, ctx->ctx_state);
+		mutex_unlock(&ctx->ctx_mutex);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RESET,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_OPE, "OPE Dev acquire failed: %d", rc);
+	}
+
+	mutex_unlock(&ctx->ctx_mutex);
+	return rc;
+}
+
+static int cam_ope_dump_hang_patches(struct cam_packet *packet,
+	struct cam_ope_hang_dump *dump)
+{
+	struct cam_patch_desc *patch_desc = NULL;
+	dma_addr_t iova_addr;
+	size_t     src_buf_size;
+	int        i, rc = 0;
+	int32_t iommu_hdl = ope_hw_mgr->iommu_hdl;
+
+	/* process patch descriptor */
+	patch_desc = (struct cam_patch_desc *)
+		((uint32_t *) &packet->payload_flex +
+		packet->patch_offset/4);
+
+	for (i = 0; i < packet->num_patches; i++) {
+		rc = cam_mem_get_io_buf(patch_desc[i].src_buf_hdl,
+			iommu_hdl, &iova_addr, &src_buf_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_UTIL,
+				"get src buf address failed for handle 0x%x",
+				patch_desc[i].src_buf_hdl);
+			return rc;
+		}
+		dump->entries[dump->num_bufs].memhdl =
+			patch_desc[i].src_buf_hdl;
+		dump->entries[dump->num_bufs].iova   = iova_addr;
+		dump->entries[dump->num_bufs].offset = patch_desc[i].src_offset;
+		dump->entries[dump->num_bufs].len    = 0;
+		dump->entries[dump->num_bufs].size   = src_buf_size;
+		dump->num_bufs++;
+	}
+	return rc;
+}
+
+static int cam_ope_dump_direct(struct ope_cmd_buf_info *cmd_buf_info,
+	struct cam_ope_hang_dump *dump)
+{
+	dma_addr_t iova_addr;
+	size_t size;
+	int rc = 0;
+
+	rc = cam_mem_get_io_buf(cmd_buf_info->mem_handle,
+		ope_hw_mgr->iommu_hdl, &iova_addr, &size);
+	if (rc < 0) {
+		CAM_ERR(CAM_UTIL, "get cmd buf addressfailed for handle 0x%x",
+			cmd_buf_info->mem_handle);
+		return rc;
+	}
+	dump->entries[dump->num_bufs].memhdl = cmd_buf_info->mem_handle;
+	dump->entries[dump->num_bufs].iova   = iova_addr;
+	dump->entries[dump->num_bufs].offset = cmd_buf_info->offset;
+	dump->entries[dump->num_bufs].len    = cmd_buf_info->length;
+	dump->entries[dump->num_bufs].size   = size;
+	dump->num_bufs++;
+	return 0;
+}
+
+static void cam_ope_dump_dmi(struct cam_ope_hang_dump *dump, uint32_t addr,
+	uint32_t length)
+{
+	int i;
+	uint32_t memhdl = 0, iova = 0, size;
+
+	for (i = 0; i < dump->num_bufs; i++) {
+		if (dump->entries[i].iova + dump->entries[i].offset == addr) {
+			if (dump->entries[i].len == length)
+				goto end;
+			else if (dump->entries[i].len == 0) {
+				dump->entries[i].len = length;
+				goto end;
+			} else {
+				iova = dump->entries[i].iova;
+				memhdl = dump->entries[i].memhdl;
+				size = dump->entries[i].size;
+			}
+		}
+	}
+	if (memhdl && iova) {
+		dump->entries[dump->num_bufs].memhdl = memhdl;
+		dump->entries[dump->num_bufs].iova = iova;
+		dump->entries[dump->num_bufs].offset = addr - iova;
+		dump->entries[dump->num_bufs].len = length;
+		dump->entries[dump->num_bufs].size = size;
+		dump->num_bufs++;
+	}
+end:
+	return;
+}
+
+static int cam_ope_mgr_put_cmd_buf(struct cam_packet *packet)
+{
+	int i = 0, rc = 0;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
+			cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
+			continue;
+
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+
+	return rc;
+}
+
+static int cam_ope_dump_indirect(struct ope_cmd_buf_info *cmd_buf_info,
+	struct cam_ope_hang_dump *dump)
+{
+	int rc = 0;
+	uintptr_t cpu_addr;
+	size_t buf_len;
+	uint32_t num_dmi;
+	struct cdm_dmi_cmd dmi_cmd;
+	uint32_t *print_ptr, print_idx;
+
+	rc = cam_mem_get_cpu_buf(cmd_buf_info->mem_handle,
+		&cpu_addr, &buf_len);
+	if (rc || !cpu_addr) {
+		CAM_ERR(CAM_OPE, "get cmd buf fail 0x%x",
+			cmd_buf_info->mem_handle);
+		return rc;
+	}
+	cpu_addr = cpu_addr + cmd_buf_info->offset;
+
+	num_dmi = cmd_buf_info->length /
+		sizeof(struct cdm_dmi_cmd);
+	print_ptr = (uint32_t *)cpu_addr;
+	for (print_idx = 0; print_idx < num_dmi; print_idx++) {
+		memcpy(&dmi_cmd, (const void *)print_ptr,
+			sizeof(struct cdm_dmi_cmd));
+		cam_ope_dump_dmi(dump, dmi_cmd.addr, dmi_cmd.length+1);
+			print_ptr += sizeof(struct cdm_dmi_cmd) /
+				sizeof(uint32_t);
+	}
+	cam_mem_put_cpu_buf((int32_t) cmd_buf_info->mem_handle);
+	return rc;
+}
+
+static int cam_ope_mgr_dump_cmd_buf(uintptr_t frame_process_addr,
+	struct cam_ope_hang_dump *dump)
+{
+	int rc = 0;
+	int i, j;
+	struct ope_frame_process *frame_process;
+	struct ope_cmd_buf_info *cmd_buf;
+
+	frame_process = (struct ope_frame_process *)frame_process_addr;
+	for (i = 0; i < frame_process->batch_size; i++) {
+		for (j = 0; j < frame_process->num_cmd_bufs[i]; j++) {
+			cmd_buf = &frame_process->cmd_buf[i][j];
+			if (cmd_buf->type == OPE_CMD_BUF_TYPE_DIRECT) {
+				if (cmd_buf->cmd_buf_usage == OPE_CMD_BUF_DEBUG)
+					continue;
+				cam_ope_dump_direct(cmd_buf, dump);
+			} else if (cmd_buf->type == OPE_CMD_BUF_TYPE_INDIRECT)
+				cam_ope_dump_indirect(cmd_buf, dump);
+		}
+	}
+	return rc;
+}
+
+static int cam_ope_mgr_dump_frame_set(uintptr_t frame_process_addr,
+	struct cam_ope_hang_dump *dump)
+{
+	int i, j, rc = 0;
+	dma_addr_t iova_addr;
+	size_t size;
+	struct ope_frame_process *frame_process;
+	struct ope_io_buf_info *io_buf;
+	struct cam_ope_buf_entry *buf_entry;
+	struct cam_ope_output_info *output_info;
+
+	frame_process = (struct ope_frame_process *)frame_process_addr;
+	for (j = 0; j < frame_process->batch_size; j++) {
+		for (i = 0; i < frame_process->frame_set[j].num_io_bufs; i++) {
+			io_buf = &frame_process->frame_set[j].io_buf[i];
+			rc = cam_mem_get_io_buf(io_buf->mem_handle[0],
+				ope_hw_mgr->iommu_hdl, &iova_addr, &size);
+			if (rc) {
+				CAM_ERR(CAM_OPE, "get io buf fail 0x%x",
+					io_buf->mem_handle[0]);
+				return rc;
+			}
+			buf_entry = &dump->entries[dump->num_bufs];
+			buf_entry->memhdl = io_buf->mem_handle[0];
+			buf_entry->iova = iova_addr;
+			buf_entry->offset = io_buf->plane_offset[0];
+			buf_entry->len = size - io_buf->plane_offset[0];
+			buf_entry->size = size;
+			dump->num_bufs++;
+			if (io_buf->direction == 2) {
+				output_info =
+					&dump->outputs[dump->num_outputs];
+				output_info->iova = iova_addr;
+				output_info->offset = io_buf->plane_offset[0];
+				output_info->len = size -
+					io_buf->plane_offset[0];
+				dump->num_outputs++;
+			}
+		}
+	}
+	return rc;
+}
+
+static int cam_ope_dump_frame_process(struct cam_packet *packet,
+	struct cam_ope_hang_dump *dump)
+{
+	int rc = 0;
+	int i;
+	size_t len;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	uintptr_t cpu_addr = 0;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
+			cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
+			continue;
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&cpu_addr, &len);
+		if (rc || !cpu_addr) {
+			CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+				cmd_desc[i].mem_handle);
+			return rc;
+		}
+		cpu_addr = cpu_addr + cmd_desc[i].offset;
+		break;
+	}
+
+	if (!cpu_addr) {
+		CAM_ERR(CAM_OPE, "invalid number of cmd buf");
+		return -EINVAL;
+	}
+
+	cam_ope_mgr_dump_cmd_buf(cpu_addr, dump);
+	cam_ope_mgr_dump_frame_set(cpu_addr, dump);
+	cam_ope_mgr_put_cmd_buf(packet);
+	return rc;
+}
+
+static int cam_ope_dump_bls(struct cam_ope_request *ope_req,
+	struct cam_ope_hang_dump *dump)
+{
+	struct cam_cdm_bl_request *cdm_cmd;
+	size_t size;
+	int i, rc;
+	dma_addr_t iova_addr;
+
+	cdm_cmd = ope_req->cdm_cmd;
+	for (i = 0; i < cdm_cmd->cmd_arrary_count; i++) {
+		rc = cam_mem_get_io_buf(cdm_cmd->cmd_flex[i].bl_addr.mem_handle,
+				ope_hw_mgr->iommu_hdl, &iova_addr, &size);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "get io buf fail 0x%x",
+				cdm_cmd->cmd_flex[i].bl_addr.mem_handle);
+			return rc;
+		}
+		dump->bl_entries[dump->num_bls].base =
+			(uint32_t)iova_addr + cdm_cmd->cmd_flex[i].offset;
+		dump->bl_entries[dump->num_bls].len = cdm_cmd->cmd_flex[i].len;
+		dump->bl_entries[dump->num_bls].arbitration =
+			cdm_cmd->cmd_flex[i].arbitrate;
+		dump->num_bls++;
+	}
+	return 0;
+}
+
+static void cam_ope_dump_req_data(struct cam_ope_request *ope_req)
+{
+	struct cam_ope_hang_dump *dump;
+	struct cam_packet *packet =
+		(struct cam_packet *)ope_req->hang_data.packet;
+
+	if (!ope_req->ope_debug_buf.cpu_addr ||
+		ope_req->ope_debug_buf.len < sizeof(struct cam_ope_hang_dump) ||
+		(ope_req->ope_debug_buf.offset + ope_req->ope_debug_buf.len)
+			> ope_req->ope_debug_buf.size) {
+		CAM_ERR(CAM_OPE, "Invalid debug buf, size %d %d len %d off %d",
+				sizeof(struct cam_ope_hang_dump),
+				ope_req->ope_debug_buf.size,
+				ope_req->ope_debug_buf.len,
+				ope_req->ope_debug_buf.offset);
+		return;
+	}
+
+	dump = (struct cam_ope_hang_dump *)ope_req->ope_debug_buf.cpu_addr;
+	memset(dump, 0, sizeof(struct cam_ope_hang_dump));
+	dump->num_bufs = 0;
+	cam_ope_dump_hang_patches(packet, dump);
+	cam_ope_dump_frame_process(packet, dump);
+	cam_ope_dump_bls(ope_req, dump);
+}
+
+static bool cam_ope_check_req_delay(struct cam_ope_ctx *ctx_data,
+	uint64_t req_time)
+{
+	struct timespec64 ts;
+	uint64_t ts_ns;
+
+	ktime_get_boottime_ts64(&ts);
+	ts_ns = (uint64_t)((ts.tv_sec * 1000000000) +
+		ts.tv_nsec);
+
+	if (ts_ns - req_time <
+		((ctx_data->req_timer_timeout -
+			div_u64(ctx_data->req_timer_timeout, 10)) * 1000000)) {
+		CAM_INFO(CAM_OPE, "ctx: %d, ts_ns : %llu",
+		ctx_data->ctx_id, ts_ns);
+		cam_ope_req_timer_reset(ctx_data);
+		return true;
+	}
+
+	return false;
+}
+
+static int32_t cam_ope_process_request_timer(void *priv, void *data)
+{
+	struct ope_clk_work_data *clk_data = (struct ope_clk_work_data *)data;
+	struct cam_ope_ctx *ctx_data = (struct cam_ope_ctx *)clk_data->data;
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+	uint32_t id;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_ope_clk_info *clk_info;
+	struct cam_ope_dev_bw_update clk_update;
+	int i = 0;
+	int device_share_ratio = 1;
+	int path_index;
+	struct crm_workq_task *task;
+	struct ope_msg_work_data *task_data;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "ctx_data is NULL, failed to update clk");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	if ((ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) ||
+		(ctx_data->req_watch_dog_reset_counter == 0)) {
+		CAM_DBG(CAM_OPE, "state %d counter = %d", ctx_data->ctx_state,
+			ctx_data->req_watch_dog_reset_counter);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return 0;
+	}
+
+	if (cam_ope_is_pending_request(ctx_data)) {
+
+		if (cam_ope_check_req_delay(ctx_data,
+			ctx_data->last_req_time)) {
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+
+		if (cam_ope_check_req_delay(ctx_data,
+			ope_hw_mgr->last_callback_time)) {
+			CAM_WARN(CAM_OPE,
+				"ope ctx: %d stuck due to other contexts",
+				ctx_data->ctx_id);
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+
+		if (!cam_cdm_detect_hang_error(ctx_data->ope_cdm.cdm_handle)) {
+			cam_ope_req_timer_reset(ctx_data);
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+
+		/* Try checking ctx struck again */
+		if (cam_ope_check_req_delay(ctx_data,
+			ope_hw_mgr->last_callback_time)) {
+			CAM_WARN(CAM_OPE,
+				"ope ctx: %d stuck due to other contexts",
+				ctx_data->ctx_id);
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+
+		CAM_ERR(CAM_OPE,
+			"pending req at HW, ctx %d lrt %llu lct %llu",
+			ctx_data->ctx_id, ctx_data->last_req_time,
+			ope_hw_mgr->last_callback_time);
+		hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				OPE_HW_DUMP_DEBUG,
+				NULL, 0);
+
+		task = cam_req_mgr_workq_get_task(ope_hw_mgr->msg_work);
+		if (!task) {
+			CAM_ERR(CAM_OPE, "no empty task");
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return 0;
+		}
+		task_data = (struct ope_msg_work_data *)task->payload;
+		task_data->data = hw_mgr;
+		task_data->irq_status = 1;
+		task_data->type = OPE_WORKQ_TASK_MSG_TYPE;
+		task->process_cb = cam_ope_mgr_process_msg;
+		cam_req_mgr_workq_enqueue_task(task, ope_hw_mgr,
+			CRM_TASK_PRIORITY_0);
+		cam_ope_req_timer_reset(ctx_data);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return 0;
+	}
+
+	cam_ope_req_timer_modify(ctx_data, ~0);
+	/* Remove context BW */
+	dev_intf = hw_mgr->ope_dev_intf[0];
+	if (!dev_intf) {
+		CAM_ERR(CAM_OPE, "OPE dev intf is NULL");
+		mutex_unlock(&ctx_data->ctx_mutex);
+		return -EINVAL;
+	}
+
+	clk_info = &hw_mgr->clk_info;
+	id = OPE_HW_BW_UPDATE;
+	device_share_ratio = hw_mgr->num_ope;
+
+	clk_update.ahb_vote.type = CAM_VOTE_DYNAMIC;
+	clk_update.ahb_vote.vote.freq = 0;
+	clk_update.ahb_vote_valid = false;
+
+	/*
+	 * Remove previous vote of this context from hw mgr first.
+	 * hw_mgr_clk_info has all valid paths, with each path in its
+	 * own index. BW that we wanted to vote now is after removing
+	 * current context's vote from hw mgr consolidated vote
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index = ctx_data->clk_info.axi_path[i]
+			.path_data_type -
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_WARN_RATE_LIMIT(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i]
+				.path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+				continue;
+		}
+
+		clk_info->axi_path[path_index].camnoc_bw -=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		clk_info->axi_path[path_index].mnoc_ab_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		clk_info->axi_path[path_index].mnoc_ib_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		clk_info->axi_path[path_index].ddr_ab_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+		clk_info->axi_path[path_index].ddr_ib_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+	}
+
+	memset(&ctx_data->clk_info.axi_path[0], 0,
+		CAM_OPE_MAX_PER_PATH_VOTES *
+		sizeof(struct cam_axi_per_path_bw_vote));
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+
+	clk_update.axi_vote.num_paths = clk_info->num_paths;
+	memcpy(&clk_update.axi_vote.axi_path[0],
+		&clk_info->axi_path[0],
+		clk_update.axi_vote.num_paths *
+		sizeof(struct cam_axi_per_path_bw_vote));
+
+	if (device_share_ratio > 1) {
+		for (i = 0; i < clk_update.axi_vote.num_paths; i++) {
+			do_div(
+			clk_update.axi_vote.axi_path[i].camnoc_bw,
+				device_share_ratio);
+			do_div(
+			clk_update.axi_vote.axi_path[i].mnoc_ab_bw,
+				device_share_ratio);
+			do_div(
+			clk_update.axi_vote.axi_path[i].mnoc_ib_bw,
+				device_share_ratio);
+			do_div(
+			clk_update.axi_vote.axi_path[i].ddr_ab_bw,
+				device_share_ratio);
+			do_div(
+			clk_update.axi_vote.axi_path[i].ddr_ib_bw,
+				device_share_ratio);
+		}
+	}
+
+	clk_update.axi_vote_valid = true;
+	dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, id,
+		&clk_update, sizeof(clk_update));
+
+	CAM_DBG(CAM_OPE, "X :ctx_id = %d curr_fc = %u bc = %u",
+		ctx_data->ctx_id, ctx_data->clk_info.curr_fc,
+		ctx_data->clk_info.base_clk);
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return 0;
+}
+
+static void cam_ope_req_timer_cb(struct timer_list *timer_data)
+{
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct ope_clk_work_data *task_data;
+	struct cam_req_mgr_timer *timer =
+	container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+
+	spin_lock_irqsave(&ope_hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->timer_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		spin_unlock_irqrestore(&ope_hw_mgr->hw_mgr_lock, flags);
+		return;
+	}
+
+	task_data = (struct ope_clk_work_data *)task->payload;
+	task_data->data = timer->parent;
+	task_data->type = OPE_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_ope_process_request_timer;
+	cam_req_mgr_workq_enqueue_task(task, ope_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&ope_hw_mgr->hw_mgr_lock, flags);
+}
+
+static int cam_ope_start_req_timer(struct cam_ope_ctx *ctx_data)
+{
+	int rc = 0;
+
+	rc = crm_timer_init(&ctx_data->req_watch_dog,
+		ctx_data->req_timer_timeout, ctx_data, &cam_ope_req_timer_cb);
+	if (rc)
+		CAM_ERR(CAM_OPE, "Failed to start timer");
+
+	ctx_data->req_watch_dog_reset_counter = 0;
+
+	return rc;
+}
+
+static int cam_ope_supported_clk_rates(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data)
+{
+	int i;
+	struct cam_hw_soc_info *soc_info;
+	struct cam_hw_intf *dev_intf = NULL;
+	struct cam_hw_info *dev = NULL;
+
+	dev_intf = hw_mgr->ope_dev_intf[0];
+	if (!dev_intf) {
+		CAM_ERR(CAM_OPE, "dev_intf is invalid");
+		return -EINVAL;
+	}
+
+	dev = (struct cam_hw_info *)dev_intf->hw_priv;
+	soc_info = &dev->soc_info;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++) {
+		ctx_data->clk_info.clk_rate[i] =
+			soc_info->clk_rate[i][soc_info->src_clk_idx];
+		CAM_DBG(CAM_OPE, "clk_info[%d] = %d",
+			i, ctx_data->clk_info.clk_rate[i]);
+	}
+
+	return 0;
+}
+
+static int cam_ope_ctx_clk_info_init(struct cam_ope_ctx *ctx_data)
+{
+	int i;
+
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+	ctx_data->clk_info.uncompressed_bw = 0;
+	ctx_data->clk_info.compressed_bw = 0;
+
+	for (i = 0; i < CAM_OPE_MAX_PER_PATH_VOTES; i++) {
+		ctx_data->clk_info.axi_path[i].camnoc_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ab_bw = 0;
+		ctx_data->clk_info.axi_path[i].mnoc_ib_bw = 0;
+	}
+
+	cam_ope_supported_clk_rates(ope_hw_mgr, ctx_data);
+
+	return 0;
+}
+
+static int32_t cam_ope_deinit_idle_clk(void *priv, void *data)
+{
+	struct cam_ope_hw_mgr *hw_mgr = (struct cam_ope_hw_mgr *)priv;
+	struct ope_clk_work_data *task_data = (struct ope_clk_work_data *)data;
+	struct cam_ope_clk_info *clk_info =
+		(struct cam_ope_clk_info *)task_data->data;
+	uint32_t id;
+	uint32_t i;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_hw_intf *dev_intf = NULL;
+	int rc = 0;
+	bool busy = false;
+
+	clk_info->base_clk = 0;
+	clk_info->curr_clk = 0;
+	clk_info->over_clked = 0;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx[i];
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (ctx_data->ctx_state == OPE_CTX_STATE_ACQUIRED) {
+			busy = cam_ope_is_pending_request(ctx_data);
+			if (busy) {
+				mutex_unlock(&ctx_data->ctx_mutex);
+				break;
+			}
+			cam_ope_ctx_clk_info_init(ctx_data);
+		}
+		mutex_unlock(&ctx_data->ctx_mutex);
+	}
+
+	if (busy) {
+		cam_ope_device_timer_reset(hw_mgr);
+		rc = -EBUSY;
+		goto done;
+	}
+
+	dev_intf = hw_mgr->ope_dev_intf[0];
+	id = OPE_HW_CLK_DISABLE;
+
+	CAM_DBG(CAM_OPE, "Disable %d", clk_info->hw_type);
+
+	dev_intf->hw_ops.process_cmd(dev_intf->hw_priv, id,	NULL, 0);
+
+done:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static void cam_ope_device_timer_cb(struct timer_list *timer_data)
+{
+	unsigned long flags;
+	struct crm_workq_task *task;
+	struct ope_clk_work_data *task_data;
+	struct cam_req_mgr_timer *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+
+	spin_lock_irqsave(&ope_hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->timer_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		spin_unlock_irqrestore(&ope_hw_mgr->hw_mgr_lock, flags);
+		return;
+	}
+
+	task_data = (struct ope_clk_work_data *)task->payload;
+	task_data->data = timer->parent;
+	task_data->type = OPE_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_ope_deinit_idle_clk;
+	cam_req_mgr_workq_enqueue_task(task, ope_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&ope_hw_mgr->hw_mgr_lock, flags);
+}
+
+static int cam_ope_device_timer_start(struct cam_ope_hw_mgr *hw_mgr)
+{
+	int rc = 0;
+	int i;
+
+	for (i = 0; i < CLK_HW_MAX; i++)  {
+		if (!hw_mgr->clk_info.watch_dog) {
+			rc = crm_timer_init(&hw_mgr->clk_info.watch_dog,
+				OPE_DEVICE_IDLE_TIMEOUT, &hw_mgr->clk_info,
+				&cam_ope_device_timer_cb);
+
+			if (rc)
+				CAM_ERR(CAM_OPE, "Failed to start timer %d", i);
+
+			hw_mgr->clk_info.watch_dog_reset_counter = 0;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ope_get_actual_clk_rate_idx(
+	struct cam_ope_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return i;
+
+	/*
+	 * Caller has to ensure returned index is within array
+	 * size bounds while accessing that index.
+	 */
+
+	return i;
+}
+
+static bool cam_ope_is_over_clk(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info)
+{
+	int base_clk_idx;
+	int curr_clk_idx;
+
+	base_clk_idx = cam_ope_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->base_clk);
+
+	curr_clk_idx = cam_ope_get_actual_clk_rate_idx(ctx_data,
+		hw_mgr_clk_info->curr_clk);
+
+	CAM_DBG(CAM_OPE, "bc_idx = %d cc_idx = %d %d %d",
+		base_clk_idx, curr_clk_idx, hw_mgr_clk_info->base_clk,
+		hw_mgr_clk_info->curr_clk);
+
+	if (curr_clk_idx > base_clk_idx)
+		return true;
+
+	return false;
+}
+
+
+static int cam_ope_get_lower_clk_rate(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_ope_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	while (i > 0) {
+		if (ctx_data->clk_info.clk_rate[i - 1])
+			return ctx_data->clk_info.clk_rate[i - 1];
+		i--;
+	}
+
+	CAM_DBG(CAM_OPE, "Already clk at lower level");
+
+	return base_clk;
+}
+
+static int cam_ope_get_next_clk_rate(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	i = cam_ope_get_actual_clk_rate_idx(ctx_data, base_clk);
+
+	while (i < CAM_MAX_VOTE - 1) {
+		if (ctx_data->clk_info.clk_rate[i + 1])
+			return ctx_data->clk_info.clk_rate[i + 1];
+		i++;
+	}
+
+	CAM_DBG(CAM_OPE, "Already clk at higher level");
+
+	return base_clk;
+}
+
+static int cam_ope_get_actual_clk_rate(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t base_clk)
+{
+	int i;
+
+	for (i = 0; i < CAM_MAX_VOTE; i++)
+		if (ctx_data->clk_info.clk_rate[i] >= base_clk)
+			return ctx_data->clk_info.clk_rate[i];
+
+	return base_clk;
+}
+
+static int cam_ope_calc_total_clk(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_clk_info *hw_mgr_clk_info, uint32_t dev_type)
+{
+	int i;
+	struct cam_ope_ctx *ctx_data;
+
+	hw_mgr_clk_info->base_clk = 0;
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		ctx_data = &hw_mgr->ctx[i];
+		if (ctx_data->ctx_state == OPE_CTX_STATE_ACQUIRED)
+			hw_mgr_clk_info->base_clk +=
+				ctx_data->clk_info.base_clk;
+	}
+
+	return 0;
+}
+
+static uint32_t cam_ope_mgr_calc_base_clk(uint32_t frame_cycles,
+	uint64_t budget)
+{
+	uint64_t mul = 1000000000;
+	uint64_t base_clk = frame_cycles * mul;
+
+	do_div(base_clk, budget);
+
+	CAM_DBG(CAM_OPE, "budget = %lld fc = %d ib = %lld base_clk = %lld",
+		budget, frame_cycles,
+		(long long)(frame_cycles * mul), base_clk);
+
+	return base_clk;
+}
+
+static bool cam_ope_update_clk_overclk_free(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info,
+	struct cam_ope_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	int rc = false;
+
+	/*
+	 * In caseof no pending packets case
+	 *    1. In caseof overclk cnt is less than threshold, increase
+	 *       overclk count and no update in the clock rate
+	 *    2. In caseof overclk cnt is greater than or equal to threshold
+	 *       then lower clock rate by one level and update hw_mgr current
+	 *       clock value.
+	 *        a. In case of new clock rate greater than sum of clock
+	 *           rates, reset overclk count value to zero if it is
+	 *           overclock
+	 *        b. if it is less than sum of base clocks then go to next
+	 *           level of clock and make overclk count to zero
+	 *        c. if it is same as sum of base clock rates update overclock
+	 *           cnt to 0
+	 */
+	if (hw_mgr_clk_info->over_clked < hw_mgr_clk_info->threshold) {
+		hw_mgr_clk_info->over_clked++;
+		rc = false;
+	} else {
+		hw_mgr_clk_info->curr_clk =
+			cam_ope_get_lower_clk_rate(hw_mgr, ctx_data,
+			hw_mgr_clk_info->curr_clk);
+		if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk) {
+			if (cam_ope_is_over_clk(hw_mgr, ctx_data,
+				hw_mgr_clk_info))
+				hw_mgr_clk_info->over_clked = 0;
+		} else if (hw_mgr_clk_info->curr_clk <
+			hw_mgr_clk_info->base_clk) {
+			hw_mgr_clk_info->curr_clk =
+			cam_ope_get_next_clk_rate(hw_mgr, ctx_data,
+				hw_mgr_clk_info->curr_clk);
+				hw_mgr_clk_info->over_clked = 0;
+		} else if (hw_mgr_clk_info->curr_clk ==
+			hw_mgr_clk_info->base_clk) {
+			hw_mgr_clk_info->over_clked = 0;
+		}
+		rc = true;
+	}
+
+	return rc;
+}
+
+static bool cam_ope_update_clk_free(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info,
+	struct cam_ope_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	int rc = false;
+	bool over_clocked = false;
+
+	ctx_data->clk_info.curr_fc = clk_info->frame_cycles;
+	ctx_data->clk_info.base_clk = base_clk;
+	cam_ope_calc_total_clk(hw_mgr, hw_mgr_clk_info,
+		ctx_data->ope_acquire.dev_type);
+
+	/*
+	 * Current clock is not always sum of base clocks, due to
+	 * clock scales update to next higher or lower levels, it
+	 * equals to one of discrete clock values supported by hardware.
+	 * So even current clock is higher than sum of base clocks, we
+	 * can not consider it is over clocked. if it is greater than
+	 * discrete clock level then only it is considered as over clock.
+	 * 1. Handle over clock case
+	 * 2. If current clock is less than sum of base clocks
+	 *    update current clock
+	 * 3. If current clock is same as sum of base clocks no action
+	 */
+
+	over_clocked = cam_ope_is_over_clk(hw_mgr, ctx_data,
+		hw_mgr_clk_info);
+
+	if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk &&
+		over_clocked) {
+		rc = cam_ope_update_clk_overclk_free(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+	} else if (hw_mgr_clk_info->curr_clk > hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->over_clked = 0;
+		rc = false;
+	}  else if (hw_mgr_clk_info->curr_clk < hw_mgr_clk_info->base_clk) {
+		hw_mgr_clk_info->curr_clk = cam_ope_get_actual_clk_rate(hw_mgr,
+			ctx_data, hw_mgr_clk_info->base_clk);
+		rc = true;
+	}
+
+	return rc;
+}
+
+static bool cam_ope_update_clk_busy(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info,
+	struct cam_ope_clk_bw_request *clk_info,
+	uint32_t base_clk)
+{
+	uint32_t next_clk_level;
+	uint32_t actual_clk;
+	bool rc = false;
+
+	/* 1. if current request frame cycles(fc) are more than previous
+	 *      frame fc
+	 *      Calculate the new base clock.
+	 *      if sum of base clocks are more than next available clk level
+	 *       Update clock rate, change curr_clk_rate to sum of base clock
+	 *       rates and make over_clked to zero
+	 *      else
+	 *       Update clock rate to next level, update curr_clk_rate and make
+	 *       overclked cnt to zero
+	 * 2. if current fc is less than or equal to previous  frame fc
+	 *      Still Bump up the clock to next available level
+	 *      if it is available, then update clock, make overclk cnt to
+	 *      zero. If the clock is already at highest clock rate then
+	 *      no need to update the clock
+	 */
+	ctx_data->clk_info.base_clk = base_clk;
+	hw_mgr_clk_info->over_clked = 0;
+	if (clk_info->frame_cycles > ctx_data->clk_info.curr_fc) {
+		cam_ope_calc_total_clk(hw_mgr, hw_mgr_clk_info,
+			ctx_data->ope_acquire.dev_type);
+		actual_clk = cam_ope_get_actual_clk_rate(hw_mgr,
+			ctx_data, base_clk);
+		if (hw_mgr_clk_info->base_clk > actual_clk) {
+			hw_mgr_clk_info->curr_clk = hw_mgr_clk_info->base_clk;
+		} else {
+			next_clk_level = cam_ope_get_next_clk_rate(hw_mgr,
+				ctx_data, hw_mgr_clk_info->curr_clk);
+			hw_mgr_clk_info->curr_clk = next_clk_level;
+		}
+		rc = true;
+	} else {
+		next_clk_level =
+			cam_ope_get_next_clk_rate(hw_mgr, ctx_data,
+				hw_mgr_clk_info->curr_clk);
+		if (hw_mgr_clk_info->curr_clk < next_clk_level) {
+			hw_mgr_clk_info->curr_clk = next_clk_level;
+			rc = true;
+		}
+	}
+	ctx_data->clk_info.curr_fc = clk_info->frame_cycles;
+
+	return rc;
+}
+
+static bool cam_ope_check_clk_update(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, int idx)
+{
+	bool busy = false, rc = false;
+	uint32_t base_clk;
+	struct cam_ope_clk_bw_request *clk_info;
+	uint64_t req_id;
+	struct cam_ope_clk_info *hw_mgr_clk_info;
+
+	/* TODO: Have default clock rates update */
+	/* TODO: Add support for debug clock updates */
+	cam_ope_req_timer_reset(ctx_data);
+	cam_ope_device_timer_reset(hw_mgr);
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+	req_id = ctx_data->req_list[idx]->request_id;
+	if (ctx_data->req_cnt > 1)
+		busy = true;
+
+	CAM_DBG(CAM_OPE, "busy = %d req_id = %lld", busy, req_id);
+
+	clk_info = &ctx_data->req_list[idx]->clk_info;
+
+	/* Calculate base clk rate */
+	base_clk = cam_ope_mgr_calc_base_clk(
+		clk_info->frame_cycles, clk_info->budget_ns);
+	ctx_data->clk_info.rt_flag = clk_info->rt_flag;
+
+	if (busy)
+		rc = cam_ope_update_clk_busy(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+	else
+		rc = cam_ope_update_clk_free(hw_mgr, ctx_data,
+			hw_mgr_clk_info, clk_info, base_clk);
+
+	CAM_DBG(CAM_OPE, "bc = %d cc = %d busy = %d overclk = %d uc = %d",
+		hw_mgr_clk_info->base_clk, hw_mgr_clk_info->curr_clk,
+		busy, hw_mgr_clk_info->over_clked, rc);
+
+	return rc;
+}
+
+static int cam_ope_mgr_update_clk_rate(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data)
+{
+	struct cam_ope_dev_clk_update clk_upd_cmd;
+	int i;
+
+	clk_upd_cmd.clk_rate = hw_mgr->clk_info.curr_clk;
+
+	CAM_DBG(CAM_PERF, "clk_rate %u for dev_type %d", clk_upd_cmd.clk_rate,
+		ctx_data->ope_acquire.dev_type);
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv,
+			OPE_HW_CLK_UPDATE,
+			&clk_upd_cmd, sizeof(clk_upd_cmd));
+	}
+
+	return 0;
+}
+
+static int cam_ope_mgr_calculate_num_path(
+	struct cam_ope_clk_bw_req_internal_v2 *clk_info,
+	struct cam_ope_ctx *ctx_data)
+{
+	int i, path_index = 0;
+
+	for (i = 0; i < CAM_OPE_MAX_PER_PATH_VOTES; i++) {
+		if ((clk_info->axi_path[i].path_data_type <
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET) ||
+			(clk_info->axi_path[i].path_data_type >
+			CAM_AXI_PATH_DATA_OPE_MAX_OFFSET) ||
+			((clk_info->axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET) >=
+			CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_DBG(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		path_index = clk_info->axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		CAM_DBG(CAM_OPE,
+			"clk_info: i[%d]: [%s %s] bw [%lld %lld] num_path: %d",
+			i,
+			cam_cpas_axi_util_trans_type_to_string(
+			clk_info->axi_path[i].transac_type),
+			cam_cpas_axi_util_path_type_to_string(
+			clk_info->axi_path[i].path_data_type),
+			clk_info->axi_path[i].camnoc_bw,
+			clk_info->axi_path[i].mnoc_ab_bw,
+			clk_info->num_paths);
+	}
+
+	return (path_index+1);
+}
+
+static bool cam_ope_update_bw_v2(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_ope_clk_info *hw_mgr_clk_info,
+	struct cam_ope_clk_bw_req_internal_v2 *clk_info,
+	bool busy)
+{
+	int i, path_index;
+	bool update_required = true;
+
+	/*
+	 * If current request bandwidth is different from previous frames, then
+	 * recalculate bandwidth of all contexts of same hardware and update
+	 * voting of bandwidth
+	 */
+
+	for (i = 0; i < clk_info->num_paths; i++)
+		CAM_DBG(CAM_OPE, "clk_info camnoc = %lld busy = %d",
+			clk_info->axi_path[i].camnoc_bw, busy);
+
+	if (clk_info->num_paths == ctx_data->clk_info.num_paths) {
+		update_required = false;
+		for (i = 0; i < clk_info->num_paths; i++) {
+			if ((clk_info->axi_path[i].transac_type ==
+			ctx_data->clk_info.axi_path[i].transac_type) &&
+				(clk_info->axi_path[i].path_data_type ==
+			ctx_data->clk_info.axi_path[i].path_data_type) &&
+				(clk_info->axi_path[i].camnoc_bw ==
+			ctx_data->clk_info.axi_path[i].camnoc_bw) &&
+				(clk_info->axi_path[i].mnoc_ab_bw ==
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw)) {
+				continue;
+			} else {
+				update_required = true;
+				break;
+			}
+		}
+	}
+
+	if (!update_required) {
+		CAM_DBG(CAM_OPE,
+		"Incoming BW hasn't changed, no update required");
+		return false;
+	}
+
+	if (busy) {
+		for (i = 0; i < clk_info->num_paths; i++) {
+			if (ctx_data->clk_info.axi_path[i].camnoc_bw >
+				clk_info->axi_path[i].camnoc_bw)
+				return false;
+		}
+	}
+
+	/*
+	 * Remove previous vote of this context from hw mgr first.
+	 * hw_mgr_clk_info has all valid paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index =
+		ctx_data->clk_info.axi_path[i].path_data_type -
+		CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_WARN_RATE_LIMIT(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+	hw_mgr_clk_info->axi_path[path_index].camnoc_bw -=
+		ctx_data->clk_info.axi_path[i].camnoc_bw;
+	hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw -=
+		ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+	hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw -=
+		ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+	hw_mgr_clk_info->axi_path[path_index].ddr_ab_bw -=
+		ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+	hw_mgr_clk_info->axi_path[path_index].ddr_ib_bw -=
+		ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+	}
+
+	ctx_data->clk_info.num_paths =
+		cam_ope_mgr_calculate_num_path(clk_info, ctx_data);
+
+	memcpy(&ctx_data->clk_info.axi_path[0],
+		&clk_info->axi_path[0],
+		clk_info->num_paths * sizeof(struct cam_axi_per_path_bw_vote));
+
+	/*
+	 * Add new vote of this context in hw mgr.
+	 * hw_mgr_clk_info has all paths, with each path in its own index
+	 */
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index =
+		ctx_data->clk_info.axi_path[i].path_data_type -
+			CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_WARN_RATE_LIMIT(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+		hw_mgr_clk_info->axi_path[path_index].path_data_type =
+			ctx_data->clk_info.axi_path[i].path_data_type;
+		hw_mgr_clk_info->axi_path[path_index].transac_type =
+			ctx_data->clk_info.axi_path[i].transac_type;
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw +=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw +=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ab_bw +=
+			ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ib_bw +=
+			ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+		CAM_DBG(CAM_OPE,
+			"Consolidate Path Vote : Dev[%s] i[%d] path_idx[%d] : [%s %s] [%lld %lld]",
+			ctx_data->ope_acquire.dev_name,
+			i, path_index,
+			cam_cpas_axi_util_trans_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].transac_type),
+			cam_cpas_axi_util_path_type_to_string(
+			hw_mgr_clk_info->axi_path[path_index].path_data_type),
+			hw_mgr_clk_info->axi_path[path_index].camnoc_bw,
+			hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw);
+	}
+
+	if (hw_mgr_clk_info->num_paths < ctx_data->clk_info.num_paths)
+		hw_mgr_clk_info->num_paths = ctx_data->clk_info.num_paths;
+
+	return true;
+}
+
+static bool cam_ope_check_bw_update(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, int idx)
+{
+	bool busy = false, bw_updated = false;
+	int i;
+	struct cam_ope_clk_bw_req_internal_v2 *clk_info_v2;
+	struct cam_ope_clk_info *hw_mgr_clk_info;
+	uint64_t req_id;
+
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+	req_id = ctx_data->req_list[idx]->request_id;
+	if (ctx_data->req_cnt > 1)
+		busy = true;
+
+	clk_info_v2 = &ctx_data->req_list[idx]->clk_info_v2;
+
+	bw_updated = cam_ope_update_bw_v2(hw_mgr, ctx_data,
+		hw_mgr_clk_info, clk_info_v2, busy);
+
+	for (i = 0; i < hw_mgr_clk_info->num_paths; i++) {
+		CAM_DBG(CAM_OPE,
+			"Final path_type: %s, transac_type: %s, camnoc_bw = %lld mnoc_ab_bw = %lld, mnoc_ib_bw = %lld, device: %s",
+			cam_cpas_axi_util_path_type_to_string(
+			hw_mgr_clk_info->axi_path[i].path_data_type),
+			cam_cpas_axi_util_trans_type_to_string(
+			hw_mgr_clk_info->axi_path[i].transac_type),
+			hw_mgr_clk_info->axi_path[i].camnoc_bw,
+			hw_mgr_clk_info->axi_path[i].mnoc_ab_bw,
+			hw_mgr_clk_info->axi_path[i].mnoc_ib_bw,
+			ctx_data->ope_acquire.dev_name);
+	}
+
+	return bw_updated;
+}
+
+static int cam_ope_update_cpas_vote(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data)
+{
+	int i = 0;
+	struct cam_ope_clk_info *clk_info;
+	struct cam_ope_dev_bw_update bw_update = {{0}, {0}, 0, 0};
+
+	clk_info = &hw_mgr->clk_info;
+
+	bw_update.ahb_vote.type = CAM_VOTE_DYNAMIC;
+	bw_update.ahb_vote.vote.freq = 0;
+	bw_update.ahb_vote_valid = false;
+
+
+	bw_update.axi_vote.num_paths = clk_info->num_paths;
+	memcpy(&bw_update.axi_vote.axi_path[0],
+		&clk_info->axi_path[0],
+		bw_update.axi_vote.num_paths *
+		sizeof(struct cam_axi_per_path_bw_vote));
+
+	bw_update.axi_vote_valid = true;
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv,
+			OPE_HW_BW_UPDATE,
+			&bw_update, sizeof(bw_update));
+	}
+
+	return 0;
+}
+
+static int cam_ope_mgr_ope_clk_update(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, int idx)
+{
+	int rc = 0;
+
+	if (cam_ope_check_clk_update(hw_mgr, ctx_data, idx))
+		rc = cam_ope_mgr_update_clk_rate(hw_mgr, ctx_data);
+
+	if (cam_ope_check_bw_update(hw_mgr, ctx_data, idx))
+		rc |= cam_ope_update_cpas_vote(hw_mgr, ctx_data);
+
+	return rc;
+}
+
+static void cam_ope_ctx_cdm_callback(uint32_t handle, void *userdata,
+	enum cam_cdm_cb_status status, uint64_t cookie)
+{
+	int rc = 0;
+	struct cam_ope_ctx *ctx;
+	struct cam_ope_request *ope_req;
+	struct cam_hw_done_event_data buf_data;
+	struct timespec64 ts;
+	uint32_t evt_id = CAM_CTX_EVT_ID_SUCCESS;
+	bool dump_flag = true;
+	int i;
+
+	if (!userdata) {
+		CAM_ERR(CAM_OPE, "Invalid ctx from CDM callback");
+		return;
+	}
+
+	if (cookie >= CAM_CTX_REQ_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid reqIdx = %llu", cookie);
+		return;
+	}
+
+	ctx = userdata;
+	mutex_lock(&ctx->ctx_mutex);
+
+	if (!test_bit(cookie, ctx->bitmap)) {
+		CAM_ERR(CAM_OPE, "Req not present reqIdx = %d for ctx_id = %d",
+			cookie, ctx->ctx_id);
+		goto end;
+	}
+
+	ope_req = ctx->req_list[cookie];
+
+	ktime_get_boottime_ts64(&ts);
+	ope_hw_mgr->last_callback_time = (uint64_t)((ts.tv_sec * 1000000000) +
+		ts.tv_nsec);
+
+	CAM_DBG(CAM_REQ,
+		"hdl=%x, udata=%pK, status=%d, cookie=%d",
+		handle, userdata, status, cookie);
+	CAM_DBG(CAM_REQ, "req_id= %llu ctx_id= %d lcb=%llu",
+		ope_req->request_id, ctx->ctx_id,
+		ope_hw_mgr->last_callback_time);
+
+	if (ctx->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		CAM_ERR(CAM_OPE, "ctx %u is in %d state",
+			ctx->ctx_id, ctx->ctx_state);
+		mutex_unlock(&ctx->ctx_mutex);
+		return;
+	}
+
+	if (status == CAM_CDM_CB_STATUS_BL_SUCCESS) {
+		CAM_DBG(CAM_OPE,
+			"hdl=%x, udata=%pK, status=%d, cookie=%d  req_id=%llu ctx_id=%d",
+			handle, userdata, status, cookie,
+			ope_req->request_id, ctx->ctx_id);
+		cam_ope_req_timer_reset(ctx);
+		cam_ope_device_timer_reset(ope_hw_mgr);
+		buf_data.evt_param = CAM_SYNC_COMMON_EVENT_SUCCESS;
+	} else if (status == CAM_CDM_CB_STATUS_HW_RESUBMIT) {
+		CAM_INFO(CAM_OPE, "After reset of CDM and OPE, reapply req");
+		buf_data.evt_param = CAM_SYNC_OPE_EVENT_HW_RESUBMIT;
+		rc = cam_ope_mgr_reapply_config(ope_hw_mgr, ctx, ope_req);
+		if (!rc)
+			goto end;
+	} else {
+		CAM_INFO(CAM_OPE,
+			"CDM hdl=%x, udata=%pK, status=%d, cookie=%d req_id = %llu ctx_id=%d",
+			 handle, userdata, status, cookie,
+			 ope_req->request_id, ctx->ctx_id);
+		CAM_INFO(CAM_OPE, "Rst of CDM and OPE for error reqid = %lld",
+			ope_req->request_id);
+
+		if (status != CAM_CDM_CB_STATUS_HW_FLUSH) {
+			cam_ope_dump_req_data(ope_req);
+			dump_flag = false;
+
+			CAM_INFO(CAM_OPE, "bach_size: %d", ctx->req_list[cookie]->num_batch);
+			for (i = 0; i < ctx->req_list[cookie]->num_batch; i++)
+				CAM_INFO(CAM_OPE, "i: %d num_stripes: %d",
+					i, ctx->req_list[cookie]->num_stripes[i]);
+		}
+		rc = cam_ope_mgr_reset_hw();
+		evt_id = CAM_CTX_EVT_ID_ERROR;
+
+		if (status == CAM_CDM_CB_STATUS_PAGEFAULT)
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_PAGE_FAULT;
+		else if (status == CAM_CDM_CB_STATUS_HW_FLUSH)
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_HW_FLUSH;
+		else if (status == CAM_CDM_CB_STATUS_HW_RESET_DONE)
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_HW_RESET_DONE;
+		else if (status == CAM_CDM_CB_STATUS_HW_ERROR)
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_HW_ERROR;
+		else
+			buf_data.evt_param = CAM_SYNC_OPE_EVENT_UNKNOWN;
+	}
+
+	if (ope_hw_mgr->dump_req_data_enable && dump_flag)
+		cam_ope_dump_req_data(ope_req);
+
+	ctx->req_cnt--;
+
+	buf_data.request_id = ope_req->request_id;
+	ope_req->request_id = 0;
+	cam_free_clear((void *)ctx->req_list[cookie]->cdm_cmd);
+	ctx->req_list[cookie]->cdm_cmd = NULL;
+	cam_ope_free_io_config(ctx->req_list[cookie]);
+	cam_free_clear((void *)ctx->req_list[cookie]);
+	ctx->req_list[cookie] = NULL;
+	clear_bit(cookie, ctx->bitmap);
+	ctx->ctxt_event_cb(ctx->context_priv, evt_id, &buf_data);
+
+end:
+	mutex_unlock(&ctx->ctx_mutex);
+}
+
+int32_t cam_ope_hw_mgr_cb(uint32_t irq_status, void *data)
+{
+	int32_t rc = 0;
+	unsigned long flags;
+	struct cam_ope_hw_mgr *hw_mgr = data;
+	struct crm_workq_task *task;
+	struct ope_msg_work_data *task_data;
+
+	if (!data) {
+		CAM_ERR(CAM_OPE, "irq cb data is NULL");
+		return rc;
+	}
+
+	spin_lock_irqsave(&hw_mgr->hw_mgr_lock, flags);
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->msg_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+		return -ENOMEM;
+	}
+
+	task_data = (struct ope_msg_work_data *)task->payload;
+	task_data->data = hw_mgr;
+	task_data->irq_status = irq_status;
+	task_data->type = OPE_WORKQ_TASK_MSG_TYPE;
+	task->process_cb = cam_ope_mgr_process_msg;
+	rc = cam_req_mgr_workq_enqueue_task(task, ope_hw_mgr,
+		CRM_TASK_PRIORITY_0);
+	spin_unlock_irqrestore(&hw_mgr->hw_mgr_lock, flags);
+
+	return rc;
+}
+
+static int cam_ope_mgr_create_kmd_buf(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uintptr_t   ope_cmd_buf_addr)
+{
+	int i, rc = 0;
+	struct cam_ope_dev_prepare_req prepare_req;
+
+	prepare_req.ctx_data = ctx_data;
+	prepare_req.hw_mgr = hw_mgr;
+	prepare_req.packet = packet;
+	prepare_req.prepare_args = prepare_args;
+	prepare_req.req_idx = req_idx;
+	prepare_req.kmd_buf_offset = 0;
+	prepare_req.frame_process =
+		(struct ope_frame_process *)ope_cmd_buf_addr;
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv,
+			OPE_HW_PREPARE, &prepare_req, sizeof(prepare_req));
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Dev prepare failed: %d", rc);
+			goto end;
+		}
+	}
+end:
+	return rc;
+}
+
+static int cam_ope_mgr_process_io_cfg(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet,
+	struct cam_hw_prepare_update_args *prep_arg,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx)
+{
+	int i, j = 0, k = 0, l, rc = 0;
+	struct ope_io_buf *io_buf;
+	int32_t sync_in_obj[CAM_MAX_IN_RES];
+	int32_t merged_sync_in_obj;
+	struct cam_ope_request *ope_request;
+
+	ope_request = ctx_data->req_list[req_idx];
+	prep_arg->num_out_map_entries = 0;
+	prep_arg->num_in_map_entries = 0;
+
+	ope_request = ctx_data->req_list[req_idx];
+	CAM_DBG(CAM_OPE, "E: req_idx = %u %x", req_idx, packet);
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (l = 0; l < ope_request->num_io_bufs[i]; l++) {
+			io_buf = ope_request->io_buf[i][l];
+			if (io_buf->direction == CAM_BUF_INPUT) {
+				if (io_buf->fence != -1) {
+					if (j < CAM_MAX_IN_RES) {
+						sync_in_obj[j++] =
+							io_buf->fence;
+						prep_arg->num_in_map_entries++;
+					} else {
+						CAM_ERR(CAM_OPE,
+						"reached max in_res %d %d",
+						io_buf->resource_type,
+						ope_request->request_id);
+					}
+				} else {
+					CAM_ERR(CAM_OPE, "Invalid fence %d %d",
+						io_buf->resource_type,
+						ope_request->request_id);
+				}
+			} else {
+				if (io_buf->fence != -1) {
+					prep_arg->out_map_entries[k].sync_id =
+						io_buf->fence;
+					k++;
+					prep_arg->num_out_map_entries++;
+				} else {
+					if (io_buf->resource_type
+						!= OPE_OUT_RES_STATS_LTM) {
+						CAM_ERR(CAM_OPE,
+						"Invalid fence %d %d",
+						io_buf->resource_type,
+						ope_request->request_id);
+					}
+				}
+			}
+			CAM_DBG(CAM_REQ,
+				"ctx_id: %u req_id: %llu dir[%d] %u, fence: %d",
+				ctx_data->ctx_id, packet->header.request_id, i,
+				io_buf->direction, io_buf->fence);
+			CAM_DBG(CAM_REQ, "rsc_type = %u fmt = %d",
+				io_buf->resource_type,
+				io_buf->format);
+		}
+	}
+
+	if (prep_arg->num_in_map_entries > 1 &&
+		prep_arg->num_in_map_entries <= CAM_MAX_IN_RES)
+		prep_arg->num_in_map_entries =
+			cam_common_util_remove_duplicate_arr(
+			sync_in_obj, prep_arg->num_in_map_entries);
+
+	if (prep_arg->num_in_map_entries > 1 &&
+		prep_arg->num_in_map_entries <= CAM_MAX_IN_RES) {
+		rc = cam_sync_merge(&sync_in_obj[0],
+			prep_arg->num_in_map_entries, &merged_sync_in_obj);
+		if (rc) {
+			prep_arg->num_out_map_entries = 0;
+			prep_arg->num_in_map_entries = 0;
+			return rc;
+		}
+
+		ope_request->in_resource = merged_sync_in_obj;
+
+		prep_arg->in_map_entries[0].sync_id = merged_sync_in_obj;
+		prep_arg->num_in_map_entries = 1;
+		CAM_DBG(CAM_REQ, "ctx_id: %u req_id: %llu Merged Sync obj: %d",
+			ctx_data->ctx_id, packet->header.request_id,
+			merged_sync_in_obj);
+	} else if (prep_arg->num_in_map_entries == 1) {
+		prep_arg->in_map_entries[0].sync_id = sync_in_obj[0];
+		prep_arg->num_in_map_entries = 1;
+		ope_request->in_resource = 0;
+		CAM_DBG(CAM_OPE, "fence = %d", sync_in_obj[0]);
+	} else {
+		CAM_DBG(CAM_OPE, "Invalid count of input fences, count: %d",
+			prep_arg->num_in_map_entries);
+		prep_arg->num_in_map_entries = 0;
+		ope_request->in_resource = 0;
+		rc = -EINVAL;
+	}
+	return rc;
+}
+
+static void cam_ope_mgr_print_stripe_info(uint32_t batch,
+	uint32_t io_buf, uint32_t plane, uint32_t stripe,
+	struct ope_stripe_io *stripe_info, uint64_t iova_addr)
+{
+	CAM_DBG(CAM_OPE, "b:%d io:%d p:%d s:%d: E",
+		batch, io_buf, plane, stripe);
+	CAM_DBG(CAM_OPE, "width: %d s_h: %u s_s: %u",
+		stripe_info->width, stripe_info->height,
+		stripe_info->stride);
+	CAM_DBG(CAM_OPE, "s_xinit = %u iova = %x s_loc = %u",
+		stripe_info->x_init, iova_addr, stripe_info->s_location);
+	CAM_DBG(CAM_OPE, "s_off = %u s_format = %u s_len = %u d_bus %d",
+		stripe_info->offset, stripe_info->format,
+		stripe_info->len, stripe_info->disable_bus);
+	CAM_DBG(CAM_OPE, "s_align = %u s_pack = %u s_unpack = %u",
+		stripe_info->alignment, stripe_info->pack_format,
+		stripe_info->unpack_format);
+	CAM_DBG(CAM_OPE, "b:%d io:%d p:%d s:%d: E",
+		batch, io_buf, plane, stripe);
+}
+
+static int cam_ope_mgr_process_cmd_io_buf_req(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet, struct cam_ope_ctx *ctx_data,
+	uintptr_t frame_process_addr, size_t length, uint32_t req_idx)
+{
+	int rc = 0;
+	int i, j, k, l;
+	dma_addr_t iova_addr;
+	size_t len;
+	struct ope_frame_process *in_frame_process;
+	struct ope_frame_set *in_frame_set;
+	struct ope_io_buf_info *in_io_buf;
+	struct ope_stripe_info *in_stripe_info;
+	struct cam_ope_request *ope_request;
+	struct ope_io_buf *io_buf;
+	struct ope_stripe_io *stripe_info;
+	uint32_t alignment;
+	uint32_t rsc_idx;
+	uint32_t pack_format;
+	uint32_t unpack_format;
+	struct ope_in_res_info *in_res;
+	struct ope_out_res_info *out_res;
+	bool is_secure;
+
+	in_frame_process = (struct ope_frame_process *)frame_process_addr;
+
+	ope_request = ctx_data->req_list[req_idx];
+	ope_request->num_batch = in_frame_process->batch_size;
+
+	for (i = 0; i < in_frame_process->batch_size; i++) {
+		in_frame_set = &in_frame_process->frame_set[i];
+		for (j = 0; j < in_frame_set->num_io_bufs; j++) {
+			in_io_buf = &in_frame_set->io_buf[j];
+			for (k = 0; k < in_io_buf->num_planes; k++) {
+				if (!in_io_buf->num_stripes[k]) {
+					CAM_ERR(CAM_OPE, "Null num_stripes");
+					return -EINVAL;
+				}
+				for (l = 0; l < in_io_buf->num_stripes[k];
+					l++) {
+					in_stripe_info =
+						&in_io_buf->stripe_info[k][l];
+				}
+			}
+		}
+	}
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		in_frame_set = &in_frame_process->frame_set[i];
+		ope_request->num_io_bufs[i] = in_frame_set->num_io_bufs;
+		if (in_frame_set->num_io_bufs > OPE_MAX_IO_BUFS) {
+			CAM_ERR(CAM_OPE, "Wrong number of io buffers: %d",
+				in_frame_set->num_io_bufs);
+			return -EINVAL;
+		}
+
+		for (j = 0; j < in_frame_set->num_io_bufs; j++) {
+			in_io_buf = &in_frame_set->io_buf[j];
+			ope_request->io_buf[i][j] =
+				kzalloc(sizeof(struct ope_io_buf), GFP_KERNEL);
+			if (!ope_request->io_buf[i][j]) {
+				CAM_ERR(CAM_OPE,
+					"IO config allocation failure");
+				cam_ope_free_io_config(ope_request);
+				return -ENOMEM;
+			}
+			io_buf = ope_request->io_buf[i][j];
+			if (in_io_buf->num_planes > OPE_MAX_PLANES) {
+				CAM_ERR(CAM_OPE, "wrong number of planes: %u",
+					in_io_buf->num_planes);
+				return -EINVAL;
+			}
+
+			io_buf->num_planes = in_io_buf->num_planes;
+			io_buf->resource_type = in_io_buf->resource_type;
+			io_buf->direction = in_io_buf->direction;
+			io_buf->fence = in_io_buf->fence;
+			io_buf->format = in_io_buf->format;
+
+			rc = cam_ope_mgr_get_rsc_idx(ctx_data, in_io_buf);
+			if (rc < 0) {
+				CAM_ERR(CAM_OPE, "Invalid rsc idx = %d", rc);
+				return rc;
+			}
+			rsc_idx = rc;
+			if (in_io_buf->direction == CAM_BUF_INPUT) {
+				in_res =
+					&ctx_data->ope_acquire.in_res[rsc_idx];
+				alignment = in_res->alignment;
+				unpack_format = in_res->unpacker_format;
+				pack_format = 0;
+				if (in_io_buf->pix_pattern >
+					PIXEL_PATTERN_CRYCBY) {
+					CAM_ERR(CAM_OPE,
+						 "Invalid pix pattern = %u",
+						in_io_buf->pix_pattern);
+					return -EINVAL;
+				}
+				io_buf->pix_pattern = in_io_buf->pix_pattern;
+			} else if (in_io_buf->direction == CAM_BUF_OUTPUT) {
+				out_res =
+					&ctx_data->ope_acquire.out_res[rsc_idx];
+				alignment = out_res->alignment;
+				pack_format = out_res->packer_format;
+				unpack_format = 0;
+			}
+
+			for (k = 0; k < in_io_buf->num_planes; k++) {
+				io_buf->num_stripes[k] =
+					in_io_buf->num_stripes[k];
+				is_secure = cam_mem_is_secure_buf(
+					in_io_buf->mem_handle[k]);
+				if (is_secure)
+					rc = cam_mem_get_io_buf(
+						in_io_buf->mem_handle[k],
+						hw_mgr->iommu_sec_hdl,
+						&iova_addr, &len);
+				else
+					rc = cam_mem_get_io_buf(
+						in_io_buf->mem_handle[k],
+						hw_mgr->iommu_hdl,
+						&iova_addr, &len);
+
+				if (rc) {
+					CAM_ERR(CAM_OPE, "get buf failed: %d",
+						rc);
+					return -EINVAL;
+				}
+				if (len < in_io_buf->length[k]) {
+					CAM_ERR(CAM_OPE, "Invalid length");
+					return -EINVAL;
+				}
+				iova_addr += in_io_buf->plane_offset[k];
+				CAM_DBG(CAM_OPE,
+					"E rsc %d stripes %d dir %d plane %d",
+					in_io_buf->resource_type,
+					in_io_buf->direction,
+					in_io_buf->num_stripes[k], k);
+				for (l = 0; l < in_io_buf->num_stripes[k];
+					l++) {
+					in_stripe_info =
+						&in_io_buf->stripe_info[k][l];
+					stripe_info = &io_buf->s_io[k][l];
+					stripe_info->offset =
+						in_stripe_info->offset;
+					stripe_info->format = in_io_buf->format;
+					stripe_info->s_location =
+						in_stripe_info->stripe_location;
+					stripe_info->iova_addr =
+						iova_addr + stripe_info->offset;
+					stripe_info->width =
+						in_stripe_info->width;
+					stripe_info->height =
+						in_stripe_info->height;
+					stripe_info->stride =
+						in_io_buf->plane_stride[k];
+					stripe_info->x_init =
+						in_stripe_info->x_init;
+					stripe_info->len = len;
+					stripe_info->alignment = alignment;
+					stripe_info->pack_format = pack_format;
+					stripe_info->unpack_format =
+						unpack_format;
+					stripe_info->disable_bus =
+						in_stripe_info->disable_bus;
+					cam_ope_mgr_print_stripe_info(i, j,
+						k, l, stripe_info, iova_addr);
+				}
+				CAM_DBG(CAM_OPE,
+					"X rsc %d stripes %d dir %d plane %d",
+					in_io_buf->resource_type,
+					in_io_buf->direction,
+					in_io_buf->num_stripes[k], k);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet, struct cam_ope_ctx *ctx_data,
+	uintptr_t frame_process_addr, size_t length, uint32_t req_idx)
+{
+	int rc = 0;
+	int i, j;
+	dma_addr_t iova_addr;
+	dma_addr_t iova_cdm_addr;
+	uintptr_t cpu_addr;
+	size_t len;
+	struct ope_frame_process *frame_process;
+	struct ope_cmd_buf_info *cmd_buf;
+	struct cam_ope_request *ope_request;
+	bool is_kmd_buf_valid = false;
+
+	frame_process = (struct ope_frame_process *)frame_process_addr;
+
+	if (frame_process->batch_size > OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch: %d",
+			frame_process->batch_size);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < frame_process->batch_size; i++) {
+		if (frame_process->num_cmd_bufs[i] > OPE_MAX_CMD_BUFS) {
+			CAM_ERR(CAM_OPE, "Invalid cmd bufs for batch %d %d",
+				i, frame_process->num_cmd_bufs[i]);
+			return -EINVAL;
+		}
+	}
+
+	CAM_DBG(CAM_OPE, "cmd buf for req id = %lld b_size = %d",
+		packet->header.request_id, frame_process->batch_size);
+
+	for (i = 0; i < frame_process->batch_size; i++) {
+		CAM_DBG(CAM_OPE, "batch: %d count %d", i,
+			frame_process->num_cmd_bufs[i]);
+		for (j = 0; j < frame_process->num_cmd_bufs[i]; j++) {
+			CAM_DBG(CAM_OPE, "batch: %d cmd_buf_idx :%d mem_hdl:%x",
+				i, j, frame_process->cmd_buf[i][j].mem_handle);
+			CAM_DBG(CAM_OPE, "size = %u scope = %d buf_type = %d",
+				frame_process->cmd_buf[i][j].size,
+				frame_process->cmd_buf[i][j].cmd_buf_scope,
+				frame_process->cmd_buf[i][j].type);
+			CAM_DBG(CAM_OPE, "usage = %d buffered = %d s_idx = %d",
+			frame_process->cmd_buf[i][j].cmd_buf_usage,
+			frame_process->cmd_buf[i][j].cmd_buf_buffered,
+			frame_process->cmd_buf[i][j].stripe_idx);
+		}
+	}
+
+	ope_request = ctx_data->req_list[req_idx];
+	ope_request->num_batch = frame_process->batch_size;
+
+	for (i = 0; i < frame_process->batch_size; i++) {
+		for (j = 0; j < frame_process->num_cmd_bufs[i]; j++) {
+			cmd_buf = &frame_process->cmd_buf[i][j];
+
+			switch (cmd_buf->cmd_buf_scope) {
+			case OPE_CMD_BUF_SCOPE_FRAME: {
+				rc = cam_mem_get_io_buf(cmd_buf->mem_handle,
+					hw_mgr->iommu_hdl, &iova_addr, &len);
+				if (rc) {
+					CAM_ERR(CAM_OPE, "get cmd buffailed %x",
+						hw_mgr->iommu_hdl);
+					goto end;
+				}
+				iova_addr = iova_addr + cmd_buf->offset;
+
+				rc = cam_mem_get_io_buf(cmd_buf->mem_handle,
+					hw_mgr->iommu_cdm_hdl,
+					&iova_cdm_addr, &len);
+				if (rc) {
+					CAM_ERR(CAM_OPE, "get cmd buffailed %x",
+						hw_mgr->iommu_hdl);
+					goto end;
+				}
+				iova_cdm_addr = iova_cdm_addr + cmd_buf->offset;
+
+				rc = cam_mem_get_cpu_buf(cmd_buf->mem_handle,
+					&cpu_addr, &len);
+				if (rc || !cpu_addr) {
+					CAM_ERR(CAM_OPE, "get cmd buffailed %x",
+						hw_mgr->iommu_hdl);
+					goto end;
+				}
+				if ((len <= frame_process->cmd_buf[i][j].offset) ||
+					(frame_process->cmd_buf[i][j].size <
+					frame_process->cmd_buf[i][j].length) ||
+					((len - frame_process->cmd_buf[i][j].offset) <
+					 frame_process->cmd_buf[i][j].length)) {
+					CAM_ERR(CAM_OPE, "Invalid offset.");
+					return -EINVAL;
+				}
+				cpu_addr = cpu_addr +
+					frame_process->cmd_buf[i][j].offset;
+				CAM_DBG(CAM_OPE, "Hdl %x size %d len %d off %d",
+					cmd_buf->mem_handle, cmd_buf->size,
+					cmd_buf->length,
+					cmd_buf->offset);
+				if (cmd_buf->cmd_buf_usage == OPE_CMD_BUF_KMD) {
+					ope_request->ope_kmd_buf.mem_handle =
+						cmd_buf->mem_handle;
+					ope_request->ope_kmd_buf.cpu_addr =
+						cpu_addr;
+					ope_request->ope_kmd_buf.iova_addr =
+						iova_addr;
+					ope_request->ope_kmd_buf.iova_cdm_addr =
+						iova_cdm_addr;
+					ope_request->ope_kmd_buf.len = len;
+					ope_request->ope_kmd_buf.offset =
+						cmd_buf->offset;
+					ope_request->ope_kmd_buf.size =
+						cmd_buf->size;
+					is_kmd_buf_valid = true;
+					CAM_DBG(CAM_OPE, "kbuf:%x io:%x cdm:%x",
+					ope_request->ope_kmd_buf.cpu_addr,
+					ope_request->ope_kmd_buf.iova_addr,
+					ope_request->ope_kmd_buf.iova_cdm_addr);
+					cam_mem_put_cpu_buf(cmd_buf->mem_handle);
+					break;
+				} else if (cmd_buf->cmd_buf_usage ==
+					OPE_CMD_BUF_DEBUG) {
+					ope_request->ope_debug_buf.cpu_addr =
+						cpu_addr;
+					ope_request->ope_debug_buf.iova_addr =
+						iova_addr;
+					ope_request->ope_debug_buf.len =
+						cmd_buf->length;
+					ope_request->ope_debug_buf.size =
+						len;
+					ope_request->ope_debug_buf.offset =
+						cmd_buf->offset;
+					CAM_DBG(CAM_OPE, "dbg buf = %x",
+					ope_request->ope_debug_buf.cpu_addr);
+					cam_mem_put_cpu_buf(cmd_buf->mem_handle);
+					break;
+				}
+				cam_mem_put_cpu_buf(cmd_buf->mem_handle);
+				break;
+			}
+			case OPE_CMD_BUF_SCOPE_STRIPE: {
+				uint32_t num_cmd_bufs = 0;
+				uint32_t s_idx = 0;
+
+				s_idx = cmd_buf->stripe_idx;
+				if (s_idx < 0 || s_idx >= OPE_MAX_STRIPES) {
+					CAM_ERR(CAM_OPE, "Invalid index.");
+					return -EINVAL;
+				}
+				num_cmd_bufs =
+				ope_request->num_stripe_cmd_bufs[i][s_idx];
+
+				if (!num_cmd_bufs)
+					ope_request->num_stripes[i]++;
+
+				ope_request->num_stripe_cmd_bufs[i][s_idx]++;
+				break;
+			}
+
+			default:
+				break;
+			}
+		}
+	}
+
+
+	for (i = 0; i < frame_process->batch_size; i++) {
+		CAM_DBG(CAM_OPE, "num of stripes for batch %d is %d",
+			i, ope_request->num_stripes[i]);
+		for (j = 0; j < ope_request->num_stripes[i]; j++) {
+			CAM_DBG(CAM_OPE, "cmd buffers for stripe: %d:%d is %d",
+				i, j, ope_request->num_stripe_cmd_bufs[i][j]);
+		}
+	}
+
+	if (!is_kmd_buf_valid) {
+		CAM_DBG(CAM_OPE, "Invalid kmd buffer");
+		rc = -EINVAL;
+	}
+end:
+	return rc;
+}
+
+static int cam_ope_mgr_process_cmd_desc(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_packet *packet, struct cam_ope_ctx *ctx_data,
+	uintptr_t *ope_cmd_buf_addr, uint32_t req_idx)
+{
+	int rc = 0;
+	int i;
+	int num_cmd_buf = 0;
+	size_t len;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	uintptr_t cpu_addr = 0;
+	struct cam_ope_request *ope_request;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+
+	*ope_cmd_buf_addr = 0;
+	for (i = 0; i < packet->num_cmd_buf; i++, num_cmd_buf++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
+			cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
+			continue;
+
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&cpu_addr, &len);
+		if (rc || !cpu_addr) {
+			CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+				hw_mgr->iommu_hdl);
+			goto end;
+		}
+		if ((len <= cmd_desc[i].offset) ||
+			(cmd_desc[i].size < cmd_desc[i].length) ||
+			((len - cmd_desc[i].offset) <
+			cmd_desc[i].length)) {
+			CAM_ERR(CAM_OPE, "Invalid offset or length");
+			goto end;
+		}
+		cpu_addr = cpu_addr + cmd_desc[i].offset;
+		*ope_cmd_buf_addr = cpu_addr;
+	}
+
+	if (!cpu_addr) {
+		CAM_ERR(CAM_OPE, "invalid number of cmd buf");
+		*ope_cmd_buf_addr = 0;
+		return -EINVAL;
+	}
+
+	ope_request = ctx_data->req_list[req_idx];
+	ope_request->request_id = packet->header.request_id;
+	ope_request->req_idx = req_idx;
+
+	rc = cam_ope_mgr_process_cmd_buf_req(hw_mgr, packet, ctx_data,
+		cpu_addr, len, req_idx);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "Process OPE cmd request is failed: %d", rc);
+		goto end;
+	}
+
+	rc = cam_ope_mgr_process_cmd_io_buf_req(hw_mgr, packet, ctx_data,
+		cpu_addr, len, req_idx);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "Process OPE cmd io request is failed: %d",
+			rc);
+		goto end;
+	}
+
+	return rc;
+
+end:
+	*ope_cmd_buf_addr = 0;
+	return rc;
+}
+
+static bool cam_ope_mgr_is_valid_inconfig(struct cam_packet *packet)
+{
+	int i, num_in_map_entries = 0;
+	bool in_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+					packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT)
+			num_in_map_entries++;
+
+	if (num_in_map_entries <= OPE_IN_RES_MAX) {
+		in_config_valid = true;
+	} else {
+		CAM_ERR(CAM_OPE, "In config entries(%u) more than allowed(%u)",
+				num_in_map_entries, OPE_IN_RES_MAX);
+	}
+
+	CAM_DBG(CAM_OPE, "number of in_config info: %u %u %u %u",
+			packet->num_io_configs, OPE_MAX_IO_BUFS,
+			num_in_map_entries, OPE_IN_RES_MAX);
+
+	return in_config_valid;
+}
+
+static bool cam_ope_mgr_is_valid_outconfig(struct cam_packet *packet)
+{
+	int i, num_out_map_entries = 0;
+	bool out_config_valid = false;
+	struct cam_buf_io_cfg *io_cfg_ptr = NULL;
+
+	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload_flex +
+					packet->io_configs_offset/4);
+
+	for (i = 0 ; i < packet->num_io_configs; i++)
+		if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT)
+			num_out_map_entries++;
+
+	if (num_out_map_entries <= OPE_OUT_RES_MAX) {
+		out_config_valid = true;
+	} else {
+		CAM_ERR(CAM_OPE, "Out config entries(%u) more than allowed(%u)",
+				num_out_map_entries, OPE_OUT_RES_MAX);
+	}
+
+	CAM_DBG(CAM_OPE, "number of out_config info: %u %u %u %u",
+			packet->num_io_configs, OPE_MAX_IO_BUFS,
+			num_out_map_entries, OPE_OUT_RES_MAX);
+
+	return out_config_valid;
+}
+
+static int cam_ope_mgr_pkt_validation(struct cam_packet *packet)
+{
+	if ((packet->header.op_code & 0xff) !=
+		OPE_OPCODE_CONFIG) {
+		CAM_ERR(CAM_OPE, "Invalid Opcode in pkt: %d",
+			packet->header.op_code & 0xff);
+		return -EINVAL;
+	}
+
+	if (!packet->num_io_configs ||
+		packet->num_io_configs > OPE_MAX_IO_BUFS) {
+		CAM_ERR(CAM_OPE, "Invalid number of io configs: %d %d",
+			OPE_MAX_IO_BUFS, packet->num_io_configs);
+		return -EINVAL;
+	}
+
+	if (!packet->num_cmd_buf ||
+		packet->num_cmd_buf > OPE_PACKET_MAX_CMD_BUFS) {
+		CAM_ERR(CAM_OPE, "Invalid number of cmd buffers: %d %d",
+			OPE_PACKET_MAX_CMD_BUFS, packet->num_cmd_buf);
+		return -EINVAL;
+	}
+
+	if (!cam_ope_mgr_is_valid_inconfig(packet) ||
+		!cam_ope_mgr_is_valid_outconfig(packet)) {
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_OPE, "number of cmd/patch info: %u %u %u %u",
+			packet->num_cmd_buf,
+			packet->num_io_configs, OPE_MAX_IO_BUFS,
+			packet->num_patches);
+	return 0;
+}
+
+static int cam_ope_get_acquire_info(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_acquire_args *args,
+	struct cam_ope_ctx *ctx)
+{
+	int i = 0;
+
+	if (args->num_acq > 1) {
+		CAM_ERR(CAM_OPE, "Invalid number of resources: %d",
+			args->num_acq);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&ctx->ope_acquire,
+		(void __user *)args->acquire_info,
+		sizeof(struct ope_acquire_dev_info))) {
+		CAM_ERR(CAM_OPE, "Failed in acquire");
+		return -EFAULT;
+	}
+
+	if (ctx->ope_acquire.secure_mode > CAM_SECURE_MODE_SECURE) {
+		CAM_ERR(CAM_OPE, "Invalid mode:%d",
+			ctx->ope_acquire.secure_mode);
+		return -EINVAL;
+	}
+
+	if (ctx->ope_acquire.num_out_res > OPE_OUT_RES_MAX) {
+		CAM_ERR(CAM_OPE, "num of out resources exceeding : %u",
+			ctx->ope_acquire.num_out_res);
+		return -EINVAL;
+	}
+
+	if (ctx->ope_acquire.num_in_res > OPE_IN_RES_MAX) {
+		CAM_ERR(CAM_OPE, "num of in resources exceeding : %u",
+			ctx->ope_acquire.num_in_res);
+		return -EINVAL;
+	}
+
+	if (ctx->ope_acquire.dev_type >= OPE_DEV_TYPE_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid device type: %d",
+			ctx->ope_acquire.dev_type);
+		return -EFAULT;
+	}
+
+	if (ctx->ope_acquire.hw_type >= OPE_HW_TYPE_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid HW type: %d",
+			ctx->ope_acquire.hw_type);
+		return -EFAULT;
+	}
+
+	CAM_DBG(CAM_OPE, "top: %u %u %s %u %u %u %u %u",
+		ctx->ope_acquire.hw_type, ctx->ope_acquire.dev_type,
+		ctx->ope_acquire.dev_name,
+		ctx->ope_acquire.nrt_stripes_for_arb,
+		ctx->ope_acquire.secure_mode, ctx->ope_acquire.batch_size,
+		ctx->ope_acquire.num_in_res, ctx->ope_acquire.num_out_res);
+
+	for (i = 0; i < ctx->ope_acquire.num_in_res; i++) {
+		CAM_DBG(CAM_OPE, "IN: %u %u %u %u %u %u %u %u",
+		ctx->ope_acquire.in_res[i].res_id,
+		ctx->ope_acquire.in_res[i].format,
+		ctx->ope_acquire.in_res[i].width,
+		ctx->ope_acquire.in_res[i].height,
+		ctx->ope_acquire.in_res[i].alignment,
+		ctx->ope_acquire.in_res[i].unpacker_format,
+		ctx->ope_acquire.in_res[i].max_stripe_size,
+		ctx->ope_acquire.in_res[i].fps);
+	}
+
+	for (i = 0; i < ctx->ope_acquire.num_out_res; i++) {
+		CAM_DBG(CAM_OPE, "OUT: %u %u %u %u %u %u %u %u",
+		ctx->ope_acquire.out_res[i].res_id,
+		ctx->ope_acquire.out_res[i].format,
+		ctx->ope_acquire.out_res[i].width,
+		ctx->ope_acquire.out_res[i].height,
+		ctx->ope_acquire.out_res[i].alignment,
+		ctx->ope_acquire.out_res[i].packer_format,
+		ctx->ope_acquire.out_res[i].subsample_period,
+		ctx->ope_acquire.out_res[i].subsample_pattern);
+	}
+
+	return 0;
+}
+
+static int cam_ope_get_free_ctx(struct cam_ope_hw_mgr *hw_mgr)
+{
+	int i;
+
+	i = find_first_zero_bit(hw_mgr->ctx_bitmap, hw_mgr->ctx_bits);
+	if (i >= OPE_CTX_MAX || i < 0) {
+		CAM_ERR(CAM_OPE, "Invalid ctx id = %d", i);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx[i].ctx_mutex);
+	if (hw_mgr->ctx[i].ctx_state != OPE_CTX_STATE_FREE) {
+		CAM_ERR(CAM_OPE, "Invalid ctx %d state %d",
+			i, hw_mgr->ctx[i].ctx_state);
+		mutex_unlock(&hw_mgr->ctx[i].ctx_mutex);
+		return -EINVAL;
+	}
+	set_bit(i, hw_mgr->ctx_bitmap);
+	mutex_unlock(&hw_mgr->ctx[i].ctx_mutex);
+
+	return i;
+}
+
+
+static int cam_ope_put_free_ctx(struct cam_ope_hw_mgr *hw_mgr, uint32_t ctx_id)
+{
+	if (ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid ctx_id: %d", ctx_id);
+		return 0;
+	}
+
+	hw_mgr->ctx[ctx_id].ctx_state = OPE_CTX_STATE_FREE;
+	clear_bit(ctx_id, hw_mgr->ctx_bitmap);
+
+	return 0;
+}
+
+static int cam_ope_mgr_get_hw_caps(void *hw_priv, void *hw_caps_args)
+{
+	struct cam_ope_hw_mgr *hw_mgr;
+	struct cam_query_cap_cmd *query_cap = hw_caps_args;
+	struct ope_hw_ver hw_ver;
+	int rc = 0, i;
+
+	if (!hw_priv || !hw_caps_args) {
+		CAM_ERR(CAM_OPE, "Invalid args: %x %x", hw_priv, hw_caps_args);
+		return -EINVAL;
+	}
+
+	hw_mgr = hw_priv;
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	if (copy_from_user(&hw_mgr->ope_caps,
+		u64_to_user_ptr(query_cap->caps_handle),
+		sizeof(struct ope_query_cap_cmd))) {
+		CAM_ERR(CAM_OPE, "copy_from_user failed: size = %d",
+			sizeof(struct ope_query_cap_cmd));
+		rc = -EFAULT;
+		goto end;
+	}
+
+	for (i = 0; i < hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.get_hw_caps(
+			hw_mgr->ope_dev_intf[i]->hw_priv,
+			&hw_ver, sizeof(hw_ver));
+		if (rc)
+			goto end;
+
+		hw_mgr->ope_caps.hw_ver[i] = hw_ver;
+	}
+
+	hw_mgr->ope_caps.dev_iommu_handle.non_secure = hw_mgr->iommu_hdl;
+	hw_mgr->ope_caps.dev_iommu_handle.secure = hw_mgr->iommu_sec_hdl;
+	hw_mgr->ope_caps.cdm_iommu_handle.non_secure = hw_mgr->iommu_cdm_hdl;
+	hw_mgr->ope_caps.cdm_iommu_handle.secure = hw_mgr->iommu_sec_cdm_hdl;
+	hw_mgr->ope_caps.num_ope = hw_mgr->num_ope;
+
+	CAM_DBG(CAM_OPE, "iommu sec %d iommu ns %d cdm s %d cdm ns %d",
+		hw_mgr->ope_caps.dev_iommu_handle.secure,
+		hw_mgr->ope_caps.dev_iommu_handle.non_secure,
+		hw_mgr->ope_caps.cdm_iommu_handle.secure,
+		hw_mgr->ope_caps.cdm_iommu_handle.non_secure);
+
+	if (copy_to_user(u64_to_user_ptr(query_cap->caps_handle),
+		&hw_mgr->ope_caps, sizeof(struct ope_query_cap_cmd))) {
+		CAM_ERR(CAM_OPE, "copy_to_user failed: size = %d",
+			sizeof(struct ope_query_cap_cmd));
+		rc = -EFAULT;
+	}
+
+end:
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_ope_mgr_acquire_hw(void *hw_priv, void *hw_acquire_args)
+{
+	int rc = 0, i;
+	int ctx_id;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_ope_ctx *ctx;
+	struct cam_hw_acquire_args *args = hw_acquire_args;
+	struct cam_ope_dev_acquire ope_dev_acquire;
+	struct cam_ope_dev_release ope_dev_release;
+	struct cam_cdm_acquire_data *cdm_acquire;
+	struct cam_ope_dev_init init;
+	struct cam_ope_dev_clk_update clk_update;
+	struct cam_ope_dev_bw_update *bw_update;
+	struct cam_ope_set_irq_cb irq_cb;
+	struct cam_hw_info *dev = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	int32_t idx;
+
+	if ((!hw_priv) || (!hw_acquire_args)) {
+		CAM_ERR(CAM_OPE, "Invalid args: %x %x",
+			hw_priv, hw_acquire_args);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	ctx_id = cam_ope_get_free_ctx(hw_mgr);
+	if (ctx_id < 0) {
+		CAM_ERR(CAM_OPE, "No free ctx");
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return ctx_id;
+	}
+
+	ctx = &hw_mgr->ctx[ctx_id];
+	ctx->ctx_id = ctx_id;
+	mutex_lock(&ctx->ctx_mutex);
+	rc = cam_ope_get_acquire_info(hw_mgr, args, ctx);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "get_acquire info failed: %d", rc);
+		goto end;
+	}
+
+	cdm_acquire = kzalloc(sizeof(struct cam_cdm_acquire_data), GFP_KERNEL);
+	if (!cdm_acquire) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		goto end;
+	}
+	strscpy(cdm_acquire->identifier, "ope", sizeof("ope"));
+	if (ctx->ope_acquire.dev_type == OPE_DEV_TYPE_OPE_RT) {
+		cdm_acquire->priority = CAM_CDM_BL_FIFO_3;
+		ctx->req_timer_timeout = OPE_REQUEST_RT_TIMEOUT;
+	}
+	else if (ctx->ope_acquire.dev_type ==
+		OPE_DEV_TYPE_OPE_NRT) {
+		cdm_acquire->priority = CAM_CDM_BL_FIFO_0;
+		ctx->req_timer_timeout = OPE_REQUEST_NRT_TIMEOUT;
+	}
+	else
+		goto free_cdm_acquire;
+
+	cdm_acquire->cell_index = 0;
+	cdm_acquire->handle = 0;
+	cdm_acquire->userdata = ctx;
+	cdm_acquire->cam_cdm_callback = cam_ope_ctx_cdm_callback;
+	cdm_acquire->id = CAM_CDM_VIRTUAL;
+	cdm_acquire->base_array_cnt = 1;
+	cdm_acquire->base_array[0] = hw_mgr->cdm_reg_map[OPE_DEV_OPE][0];
+
+	rc = cam_cdm_acquire(cdm_acquire);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "cdm_acquire is failed: %d", rc);
+		goto cdm_acquire_failed;
+	}
+
+	ctx->ope_cdm.cdm_ops = cdm_acquire->ops;
+	ctx->ope_cdm.cdm_handle = cdm_acquire->handle;
+
+	rc = cam_cdm_stream_on(cdm_acquire->handle);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "cdm stream on failure: %d", rc);
+		goto cdm_stream_on_failure;
+	}
+
+	if (!hw_mgr->ope_ctx_cnt) {
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			init.hfi_en = ope_hw_mgr->hfi_en;
+			rc = hw_mgr->ope_dev_intf[i]->hw_ops.init(
+				hw_mgr->ope_dev_intf[i]->hw_priv, &init,
+				sizeof(init));
+			if (rc) {
+				CAM_ERR(CAM_OPE, "OPE Dev init failed: %d", rc);
+				goto ope_dev_init_failure;
+			}
+		}
+
+		/* Install IRQ CB */
+		irq_cb.ope_hw_mgr_cb = cam_ope_hw_mgr_cb;
+		irq_cb.data = hw_mgr;
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			init.hfi_en = ope_hw_mgr->hfi_en;
+			rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				OPE_HW_SET_IRQ_CB,
+				&irq_cb, sizeof(irq_cb));
+			if (rc) {
+				CAM_ERR(CAM_OPE, "OPE Dev init failed: %d", rc);
+				goto ope_irq_set_failed;
+			}
+		}
+
+		dev = (struct cam_hw_info *)hw_mgr->ope_dev_intf[0]->hw_priv;
+		soc_info = &dev->soc_info;
+		idx = soc_info->src_clk_idx;
+
+		hw_mgr->clk_info.base_clk =
+			soc_info->clk_rate[CAM_TURBO_VOTE][idx];
+		hw_mgr->clk_info.threshold = 5;
+		hw_mgr->clk_info.over_clked = 0;
+
+		for (i = 0; i < CAM_OPE_MAX_PER_PATH_VOTES; i++) {
+			hw_mgr->clk_info.axi_path[i].camnoc_bw = 0;
+			hw_mgr->clk_info.axi_path[i].mnoc_ab_bw = 0;
+			hw_mgr->clk_info.axi_path[i].mnoc_ib_bw = 0;
+			hw_mgr->clk_info.axi_path[i].ddr_ab_bw = 0;
+			hw_mgr->clk_info.axi_path[i].ddr_ib_bw = 0;
+		}
+	}
+
+	ope_dev_acquire.ctx_id = ctx_id;
+	ope_dev_acquire.ope_acquire = &ctx->ope_acquire;
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_ACQUIRE,
+			&ope_dev_acquire, sizeof(ope_dev_acquire));
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Dev acquire failed: %d", rc);
+			goto ope_dev_acquire_failed;
+		}
+	}
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		dev = (struct cam_hw_info *)hw_mgr->ope_dev_intf[i]->hw_priv;
+		soc_info = &dev->soc_info;
+		idx = soc_info->src_clk_idx;
+		clk_update.clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][idx];
+		hw_mgr->clk_info.curr_clk =
+			soc_info->clk_rate[CAM_TURBO_VOTE][idx];
+
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_CLK_UPDATE,
+			&clk_update, sizeof(clk_update));
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Dev clk update failed: %d", rc);
+			goto ope_clk_update_failed;
+		}
+	}
+
+	bw_update = kzalloc(sizeof(struct cam_ope_dev_bw_update), GFP_KERNEL);
+	if (!bw_update) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		goto ope_clk_update_failed;
+	}
+	bw_update->ahb_vote_valid = false;
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		bw_update->axi_vote.num_paths = 1;
+		bw_update->axi_vote_valid = true;
+		bw_update->axi_vote.axi_path[0].camnoc_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].mnoc_ab_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].mnoc_ib_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].ddr_ab_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].ddr_ib_bw = 600000000;
+		bw_update->axi_vote.axi_path[0].transac_type =
+			CAM_AXI_TRANSACTION_WRITE;
+		bw_update->axi_vote.axi_path[0].path_data_type =
+			CAM_AXI_PATH_DATA_ALL;
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_BW_UPDATE,
+			bw_update, sizeof(*bw_update));
+		if (rc) {
+			CAM_ERR(CAM_OPE, "OPE Dev clk update failed: %d", rc);
+			goto free_bw_update;
+		}
+	}
+
+	cam_ope_start_req_timer(ctx);
+	cam_ope_device_timer_start(hw_mgr);
+	hw_mgr->ope_ctx_cnt++;
+	ctx->context_priv = args->context_data;
+	args->ctxt_to_hw_map = ctx;
+	ctx->ctxt_event_cb = args->event_cb;
+	cam_ope_ctx_clk_info_init(ctx);
+	ctx->ctx_state = OPE_CTX_STATE_ACQUIRED;
+	cam_free_clear((void *)cdm_acquire);
+	cdm_acquire = NULL;
+	cam_free_clear((void *)bw_update);
+	bw_update = NULL;
+
+	mutex_unlock(&ctx->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_INFO(CAM_OPE, "OPE: %d acquire succesfull rc %d", ctx_id, rc);
+	return rc;
+
+free_bw_update:
+	cam_free_clear((void *)bw_update);
+	bw_update = NULL;
+ope_clk_update_failed:
+	ope_dev_release.ctx_id = ctx_id;
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		if (hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RELEASE,
+			&ope_dev_release, sizeof(ope_dev_release)))
+			CAM_ERR(CAM_OPE, "OPE Dev release failed");
+	}
+ope_dev_acquire_failed:
+	if (!hw_mgr->ope_ctx_cnt) {
+		irq_cb.ope_hw_mgr_cb = NULL;
+		irq_cb.data = hw_mgr;
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			init.hfi_en = ope_hw_mgr->hfi_en;
+			if (hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				OPE_HW_SET_IRQ_CB,
+				&irq_cb, sizeof(irq_cb)))
+				CAM_ERR(CAM_OPE,
+					"OPE IRQ de register failed");
+		}
+	}
+ope_irq_set_failed:
+	if (!hw_mgr->ope_ctx_cnt) {
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			if (hw_mgr->ope_dev_intf[i]->hw_ops.deinit(
+				hw_mgr->ope_dev_intf[i]->hw_priv, NULL, 0))
+				CAM_ERR(CAM_OPE, "OPE deinit fail");
+			if (hw_mgr->ope_dev_intf[i]->hw_ops.stop(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				NULL, 0))
+				CAM_ERR(CAM_OPE, "OPE stop fail");
+		}
+	}
+ope_dev_init_failure:
+cdm_stream_on_failure:
+	cam_cdm_release(cdm_acquire->handle);
+	ctx->ope_cdm.cdm_ops = NULL;
+	ctx->ope_cdm.cdm_handle = 0;
+
+cdm_acquire_failed:
+free_cdm_acquire:
+	cam_free_clear((void *)cdm_acquire);
+	cdm_acquire = NULL;
+end:
+	args->ctxt_to_hw_map = NULL;
+	cam_ope_put_free_ctx(hw_mgr, ctx_id);
+	mutex_unlock(&ctx->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_ope_mgr_remove_bw(struct cam_ope_hw_mgr *hw_mgr, int ctx_id)
+{
+	int i, path_index, rc = 0;
+	struct cam_ope_ctx *ctx_data = NULL;
+	struct cam_ope_clk_info *hw_mgr_clk_info;
+
+	ctx_data = &hw_mgr->ctx[ctx_id];
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+
+	for (i = 0; i < ctx_data->clk_info.num_paths; i++) {
+		path_index =
+		ctx_data->clk_info.axi_path[i].path_data_type -
+		CAM_AXI_PATH_DATA_OPE_START_OFFSET;
+
+		if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_WARN_RATE_LIMIT(CAM_OPE,
+				"Invalid path %d, start offset=%d, max=%d",
+				ctx_data->clk_info.axi_path[i].path_data_type,
+				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
+				CAM_OPE_MAX_PER_PATH_VOTES);
+			continue;
+		}
+
+		hw_mgr_clk_info->axi_path[path_index].camnoc_bw -=
+			ctx_data->clk_info.axi_path[i].camnoc_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ab_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].mnoc_ib_bw -=
+			ctx_data->clk_info.axi_path[i].mnoc_ib_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ab_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ab_bw;
+		hw_mgr_clk_info->axi_path[path_index].ddr_ib_bw -=
+			ctx_data->clk_info.axi_path[i].ddr_ib_bw;
+	}
+
+	rc = cam_ope_update_cpas_vote(hw_mgr, ctx_data);
+
+	return rc;
+}
+
+static int cam_ope_mgr_ope_clk_remove(struct cam_ope_hw_mgr *hw_mgr, int ctx_id)
+{
+	struct cam_ope_ctx *ctx_data = NULL;
+	struct cam_ope_clk_info *hw_mgr_clk_info;
+
+	ctx_data = &hw_mgr->ctx[ctx_id];
+	hw_mgr_clk_info = &hw_mgr->clk_info;
+
+	if (hw_mgr_clk_info->base_clk >= ctx_data->clk_info.base_clk)
+		hw_mgr_clk_info->base_clk -= ctx_data->clk_info.base_clk;
+
+	/* reset clock info */
+	ctx_data->clk_info.curr_fc = 0;
+	ctx_data->clk_info.base_clk = 0;
+
+	return 0;
+}
+
+static int cam_ope_mgr_release_ctx(struct cam_ope_hw_mgr *hw_mgr, int ctx_id)
+{
+	int i = 0, rc = 0;
+	struct cam_ope_dev_release ope_dev_release;
+
+	if (ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "ctx_id is wrong: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+	if (hw_mgr->ctx[ctx_id].ctx_state !=
+		OPE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+		CAM_DBG(CAM_OPE, "ctx id: %d not in right state: %d",
+			ctx_id, hw_mgr->ctx[ctx_id].ctx_state);
+		return 0;
+	}
+
+	hw_mgr->ctx[ctx_id].ctx_state = OPE_CTX_STATE_RELEASE;
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		ope_dev_release.ctx_id = ctx_id;
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RELEASE,
+			&ope_dev_release, sizeof(ope_dev_release));
+		if (rc)
+			CAM_ERR(CAM_OPE, "OPE Dev release failed: %d", rc);
+	}
+
+	rc = cam_cdm_stream_off(hw_mgr->ctx[ctx_id].ope_cdm.cdm_handle);
+	if (rc)
+		CAM_ERR(CAM_OPE, "OPE CDM streamoff failed: %d", rc);
+
+	rc = cam_cdm_release(hw_mgr->ctx[ctx_id].ope_cdm.cdm_handle);
+	if (rc)
+		CAM_ERR(CAM_OPE, "OPE CDM relase failed: %d", rc);
+
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		if (!hw_mgr->ctx[ctx_id].req_list[i])
+			continue;
+
+		if (hw_mgr->ctx[ctx_id].req_list[i]->cdm_cmd) {
+			cam_free_clear((void *)hw_mgr->ctx[ctx_id].req_list[i]->cdm_cmd);
+			hw_mgr->ctx[ctx_id].req_list[i]->cdm_cmd = NULL;
+		}
+		cam_ope_free_io_config(hw_mgr->ctx[ctx_id].req_list[i]);
+		cam_free_clear((void *)hw_mgr->ctx[ctx_id].req_list[i]);
+		hw_mgr->ctx[ctx_id].req_list[i] = NULL;
+		clear_bit(i, hw_mgr->ctx[ctx_id].bitmap);
+	}
+
+	cam_ope_req_timer_stop(&hw_mgr->ctx[ctx_id]);
+	hw_mgr->ctx[ctx_id].ope_cdm.cdm_handle = 0;
+	hw_mgr->ctx[ctx_id].req_cnt = 0;
+	hw_mgr->ctx[ctx_id].last_flush_req = 0;
+	cam_ope_put_free_ctx(hw_mgr, ctx_id);
+
+	rc = cam_ope_mgr_ope_clk_remove(hw_mgr, ctx_id);
+	if (rc)
+		CAM_ERR(CAM_OPE, "OPE clk update failed: %d", rc);
+
+	hw_mgr->ope_ctx_cnt--;
+	mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+	CAM_DBG(CAM_OPE, "X: ctx_id = %d", ctx_id);
+
+	return 0;
+}
+
+static int cam_ope_mgr_release_hw(void *hw_priv, void *hw_release_args)
+{
+	int i, rc = 0;
+	int ctx_id = 0;
+	struct cam_hw_release_args *release_hw = hw_release_args;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_ope_ctx *ctx_data = NULL;
+	struct cam_ope_set_irq_cb irq_cb;
+	struct cam_hw_intf *dev_intf;
+
+	if (!release_hw || !hw_mgr) {
+		CAM_ERR(CAM_OPE, "Invalid args: %pK %pK", release_hw, hw_mgr);
+		return -EINVAL;
+	}
+
+	ctx_data = release_hw->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "NULL ctx data");
+		return -EINVAL;
+	}
+
+	ctx_id = ctx_data->ctx_id;
+	if (ctx_id < 0 || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid ctx id: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+	if (hw_mgr->ctx[ctx_id].ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		CAM_DBG(CAM_OPE, "ctx is not in use: %d", ctx_id);
+		mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(&hw_mgr->ctx[ctx_id].ctx_mutex);
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	rc = cam_ope_mgr_release_ctx(hw_mgr, ctx_id);
+	if (!hw_mgr->ope_ctx_cnt) {
+		CAM_DBG(CAM_OPE, "Last Release");
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			dev_intf = hw_mgr->ope_dev_intf[i];
+			irq_cb.ope_hw_mgr_cb = NULL;
+			irq_cb.data = NULL;
+			rc = dev_intf->hw_ops.process_cmd(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				OPE_HW_SET_IRQ_CB,
+				&irq_cb, sizeof(irq_cb));
+			if (rc)
+				CAM_ERR(CAM_OPE, "IRQ dereg failed: %d", rc);
+		}
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			dev_intf = hw_mgr->ope_dev_intf[i];
+			rc = dev_intf->hw_ops.deinit(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				NULL, 0);
+			if (rc)
+				CAM_ERR(CAM_OPE, "deinit failed: %d", rc);
+		}
+		cam_ope_device_timer_stop(hw_mgr);
+	}
+
+	rc = cam_ope_mgr_remove_bw(hw_mgr, ctx_id);
+	if (rc)
+		CAM_ERR(CAM_OPE, "OPE remove bw failed: %d", rc);
+
+	if (!hw_mgr->ope_ctx_cnt) {
+		for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+			dev_intf = hw_mgr->ope_dev_intf[i];
+			rc = dev_intf->hw_ops.stop(
+				hw_mgr->ope_dev_intf[i]->hw_priv,
+				NULL, 0);
+			if (rc)
+				CAM_ERR(CAM_OPE, "stop failed: %d", rc);
+		}
+	}
+
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	CAM_DBG(CAM_OPE, "Release done for ctx_id %d", ctx_id);
+	return rc;
+}
+
+
+static int cam_ope_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	struct cam_ope_clk_bw_request *clk_info;
+	struct ope_clk_bw_request_v2 *soc_req_v2;
+	struct cam_ope_clk_bw_req_internal_v2 *clk_info_v2;
+	struct ope_cmd_generic_blob *blob;
+	struct cam_ope_ctx *ctx_data;
+	uint32_t index;
+	size_t clk_update_size;
+	int rc = 0;
+
+	if (!blob_data || (blob_size == 0)) {
+		CAM_ERR(CAM_OPE, "Invalid blob info %pK %d", blob_data,
+		blob_size);
+		return -EINVAL;
+	}
+
+	blob = (struct ope_cmd_generic_blob *)user_data;
+	ctx_data = blob->ctx;
+	index = blob->req_idx;
+
+	switch (blob_type) {
+	case OPE_CMD_GENERIC_BLOB_CLK_V2:
+		if (blob_size < sizeof(struct ope_clk_bw_request_v2)) {
+			CAM_ERR(CAM_OPE, "Mismatch blob size %d expected %lu",
+				blob_size,
+				sizeof(struct ope_clk_bw_request_v2));
+			return -EINVAL;
+		}
+
+		soc_req_v2 = (struct ope_clk_bw_request_v2 *)blob_data;
+		if (soc_req_v2->num_paths > CAM_OPE_MAX_PER_PATH_VOTES) {
+			CAM_ERR(CAM_OPE, "Invalid num paths: %d",
+				soc_req_v2->num_paths);
+			return -EINVAL;
+		}
+
+		/* Check for integer overflow */
+		if (soc_req_v2->num_paths != 1) {
+			if (sizeof(struct cam_axi_per_path_bw_vote) >
+				((UINT_MAX -
+				sizeof(struct ope_clk_bw_request_v2)) /
+				(soc_req_v2->num_paths - 1))) {
+				CAM_ERR(CAM_OPE,
+					"Size exceeds limit paths:%u size per path:%lu",
+					soc_req_v2->num_paths - 1,
+					sizeof(
+					struct cam_axi_per_path_bw_vote));
+			return -EINVAL;
+			}
+		}
+
+		clk_update_size = sizeof(struct ope_clk_bw_request_v2) +
+			((soc_req_v2->num_paths - 1) *
+			sizeof(struct cam_axi_per_path_bw_vote));
+		if (blob_size < clk_update_size) {
+			CAM_ERR(CAM_OPE, "Invalid blob size: %u",
+				blob_size);
+			return -EINVAL;
+		}
+
+		clk_info = &ctx_data->req_list[index]->clk_info;
+		clk_info_v2 = &ctx_data->req_list[index]->clk_info_v2;
+
+		memcpy(clk_info_v2, soc_req_v2, clk_update_size);
+
+		/* Use v1 structure for clk fields */
+		clk_info->budget_ns = clk_info_v2->budget_ns;
+		clk_info->frame_cycles = clk_info_v2->frame_cycles;
+		clk_info->rt_flag = clk_info_v2->rt_flag;
+
+		CAM_DBG(CAM_OPE, "budget=%llu, frame_cycle=%llu, rt_flag=%d",
+			clk_info_v2->budget_ns, clk_info_v2->frame_cycles,
+			clk_info_v2->rt_flag);
+		break;
+
+	default:
+		CAM_WARN(CAM_OPE, "Invalid blob type %d", blob_type);
+		break;
+	}
+	return rc;
+}
+
+static int cam_ope_process_generic_cmd_buffer(
+	struct cam_packet *packet,
+	struct cam_ope_ctx *ctx_data,
+	int32_t index,
+	uint64_t *io_buf_addr)
+{
+	int i, rc = 0;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct ope_cmd_generic_blob cmd_generic_blob;
+
+	cmd_generic_blob.ctx = ctx_data;
+	cmd_generic_blob.req_idx = index;
+	cmd_generic_blob.io_buf_addr = io_buf_addr;
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *) &packet->payload_flex + packet->cmd_buf_offset/4);
+
+	for (i = 0; i < packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data != OPE_CMD_META_GENERIC_BLOB)
+			continue;
+
+		rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+			cam_ope_packet_generic_blob_handler, &cmd_generic_blob);
+		if (rc)
+			CAM_ERR(CAM_OPE, "Failed in processing blobs %d", rc);
+	}
+
+	return rc;
+}
+
+static int cam_ope_mgr_prepare_hw_update(void *hw_priv,
+	void *hw_prepare_update_args)
+{
+	int rc = 0;
+	struct cam_packet *packet = NULL;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_prepare_update_args *prepare_args =
+		hw_prepare_update_args;
+	struct cam_ope_ctx *ctx_data = NULL;
+	uintptr_t   ope_cmd_buf_addr;
+	uint32_t request_idx = 0;
+	struct cam_ope_request *ope_req;
+	struct timespec64 ts;
+
+	if ((!prepare_args) || (!hw_mgr) || (!prepare_args->packet)) {
+		CAM_ERR(CAM_OPE, "Invalid args: %x %x",
+			prepare_args, hw_mgr);
+		return -EINVAL;
+	}
+
+	ctx_data = prepare_args->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "Invalid Context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE, "ctx id %u is not acquired state: %d",
+			ctx_data->ctx_id, ctx_data->ctx_state);
+		return -EINVAL;
+	}
+
+	packet = prepare_args->packet;
+	rc = cam_packet_util_validate_packet(packet, prepare_args->remain_len);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE,
+			"packet validation failed: %d req_id: %d ctx: %d",
+			rc, packet->header.request_id, ctx_data->ctx_id);
+		return rc;
+	}
+
+	rc = cam_ope_mgr_pkt_validation(packet);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE,
+			"ope packet validation failed: %d req_id: %d ctx: %d",
+			rc, packet->header.request_id, ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	rc = cam_packet_util_process_patches(packet, hw_mgr->iommu_cdm_hdl,
+		hw_mgr->iommu_sec_cdm_hdl);
+	if (rc) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE, "Patching failed: %d req_id: %d ctx: %d",
+			rc, packet->header.request_id, ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	request_idx  = find_first_zero_bit(ctx_data->bitmap, ctx_data->bits);
+	if (request_idx >= CAM_CTX_REQ_MAX || request_idx < 0) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		CAM_ERR(CAM_OPE, "Invalid ctx req slot = %d", request_idx);
+		return -EINVAL;
+	}
+
+	ctx_data->req_list[request_idx] =
+		kzalloc(sizeof(struct cam_ope_request), GFP_KERNEL);
+	if (!ctx_data->req_list[request_idx]) {
+		CAM_ERR(CAM_OPE, "mem allocation failed ctx:%d req_idx:%d",
+			ctx_data->ctx_id, request_idx);
+		rc = -ENOMEM;
+		goto req_mem_alloc_failed;
+	}
+
+	ope_req = ctx_data->req_list[request_idx];
+	ope_req->cdm_cmd =
+		kzalloc(((sizeof(struct cam_cdm_bl_request)) +
+			((OPE_MAX_CDM_BLS - 1) *
+			sizeof(struct cam_cdm_bl_cmd))),
+			GFP_KERNEL);
+	if (!ope_req->cdm_cmd) {
+		CAM_ERR(CAM_OPE, "Cdm mem alloc failed ctx:%d req_idx:%d",
+			ctx_data->ctx_id, request_idx);
+		rc = -ENOMEM;
+		goto req_cdm_mem_alloc_failed;
+	}
+
+	rc = cam_ope_mgr_process_cmd_desc(hw_mgr, packet,
+		ctx_data, &ope_cmd_buf_addr, request_idx);
+	if (rc) {
+		CAM_ERR(CAM_OPE,
+			"cmd desc processing failed :%d ctx: %d req_id:%d",
+			rc, ctx_data->ctx_id, packet->header.request_id);
+		goto end;
+	}
+
+	rc = cam_ope_mgr_process_io_cfg(hw_mgr, packet, prepare_args,
+		ctx_data, request_idx);
+	if (rc) {
+		CAM_ERR(CAM_OPE,
+			"IO cfg processing failed: %d ctx: %d req_id:%d",
+			rc, ctx_data->ctx_id, packet->header.request_id);
+		goto end;
+	}
+
+	rc = cam_ope_mgr_create_kmd_buf(hw_mgr, packet, prepare_args,
+		ctx_data, request_idx, ope_cmd_buf_addr);
+	if (rc) {
+		CAM_ERR(CAM_OPE,
+			"create kmd buf failed: %d ctx: %d request_id:%d",
+			rc, ctx_data->ctx_id, packet->header.request_id);
+		goto end;
+	}
+
+	rc = cam_ope_process_generic_cmd_buffer(packet, ctx_data,
+		request_idx, NULL);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "Failed: %d ctx: %d req_id: %d req_idx: %d",
+			rc, ctx_data->ctx_id, packet->header.request_id,
+			request_idx);
+		goto end;
+	}
+	prepare_args->num_hw_update_entries = 1;
+	prepare_args->hw_update_entries[0].addr =
+		(uintptr_t)ctx_data->req_list[request_idx]->cdm_cmd;
+	prepare_args->priv = ctx_data->req_list[request_idx];
+	prepare_args->pf_data->packet = packet;
+	prepare_args->pf_data->req    = ope_req;
+	CAM_INFO(CAM_REQ, "OPE req %x num_batch %d", ope_req, ope_req->num_batch);
+	ope_req->hang_data.packet = packet;
+	ktime_get_boottime_ts64(&ts);
+	ctx_data->last_req_time = (uint64_t)((ts.tv_sec * 1000000000) +
+		ts.tv_nsec);
+	CAM_DBG(CAM_REQ, "req_id= %llu ctx_id= %d lrt=%llu",
+		packet->header.request_id, ctx_data->ctx_id,
+		ctx_data->last_req_time);
+	cam_ope_req_timer_modify(ctx_data, ctx_data->req_timer_timeout);
+	set_bit(request_idx, ctx_data->bitmap);
+	cam_ope_mgr_put_cmd_buf(packet);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	CAM_DBG(CAM_REQ, "Prepare Hw update Successful request_id: %d  ctx: %d",
+		packet->header.request_id, ctx_data->ctx_id);
+	return rc;
+
+end:
+	cam_free_clear((void *)ctx_data->req_list[request_idx]->cdm_cmd);
+	cam_ope_mgr_put_cmd_buf(packet);
+	ctx_data->req_list[request_idx]->cdm_cmd = NULL;
+req_cdm_mem_alloc_failed:
+	cam_free_clear((void *)ctx_data->req_list[request_idx]);
+	ctx_data->req_list[request_idx] = NULL;
+req_mem_alloc_failed:
+	clear_bit(request_idx, ctx_data->bitmap);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	return rc;
+}
+
+static int cam_ope_mgr_handle_config_err(
+	struct cam_hw_config_args *config_args,
+	struct cam_ope_ctx *ctx_data)
+{
+	struct cam_hw_done_event_data buf_data;
+	struct cam_ope_request *ope_req;
+	uint32_t req_idx;
+
+	ope_req = config_args->priv;
+
+	buf_data.request_id = ope_req->request_id;
+	buf_data.evt_param = CAM_SYNC_OPE_EVENT_CONFIG_ERR;
+	ctx_data->ctxt_event_cb(ctx_data->context_priv, CAM_CTX_EVT_ID_ERROR,
+		&buf_data);
+
+	req_idx = ope_req->req_idx;
+	ope_req->request_id = 0;
+	cam_free_clear((void *)ctx_data->req_list[req_idx]->cdm_cmd);
+	ctx_data->req_list[req_idx]->cdm_cmd = NULL;
+	cam_ope_free_io_config(ctx_data->req_list[req_idx]);
+	cam_free_clear((void *)ctx_data->req_list[req_idx]);
+	ctx_data->req_list[req_idx] = NULL;
+	clear_bit(req_idx, ctx_data->bitmap);
+
+	return 0;
+}
+
+static int cam_ope_mgr_enqueue_config(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	struct cam_hw_config_args *config_args)
+{
+	int rc = 0;
+	uint64_t request_id = 0;
+	struct crm_workq_task *task;
+	struct ope_cmd_work_data *task_data;
+	struct cam_hw_update_entry *hw_update_entries;
+	struct cam_ope_request *ope_req = NULL;
+
+	ope_req = config_args->priv;
+	request_id = config_args->request_id;
+	hw_update_entries = config_args->hw_update_entries;
+
+	CAM_DBG(CAM_OPE, "req_id = %lld %pK", request_id, config_args->priv);
+
+	task = cam_req_mgr_workq_get_task(ope_hw_mgr->cmd_work);
+	if (!task) {
+		CAM_ERR(CAM_OPE, "no empty task");
+		return -ENOMEM;
+	}
+
+	task_data = (struct ope_cmd_work_data *)task->payload;
+	task_data->data = (void *)hw_update_entries->addr;
+	task_data->req_id = request_id;
+	task_data->type = OPE_WORKQ_TASK_CMD_TYPE;
+	task->process_cb = cam_ope_mgr_process_cmd;
+	rc = cam_req_mgr_workq_enqueue_task(task, ctx_data,
+		CRM_TASK_PRIORITY_0);
+
+	return rc;
+}
+
+static int cam_ope_mgr_config_hw(void *hw_priv, void *hw_config_args)
+{
+	int rc = 0;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_config_args *config_args = hw_config_args;
+	struct cam_ope_ctx *ctx_data = NULL;
+	struct cam_ope_request *ope_req = NULL;
+	struct cam_cdm_bl_request *cdm_cmd;
+
+	CAM_DBG(CAM_OPE, "E");
+	if (!hw_mgr || !config_args) {
+		CAM_ERR(CAM_OPE, "Invalid arguments %pK %pK",
+			hw_mgr, config_args);
+		return -EINVAL;
+	}
+
+	if (!config_args->num_hw_update_entries) {
+		CAM_ERR(CAM_OPE, "No hw update enteries are available");
+		return -EINVAL;
+	}
+
+	ctx_data = config_args->ctxt_to_hw_map;
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	mutex_lock(&ctx_data->ctx_mutex);
+	if (ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		CAM_ERR(CAM_OPE, "ctx id :%u is not in use",
+			ctx_data->ctx_id);
+		return -EINVAL;
+	}
+
+	ope_req = config_args->priv;
+	cdm_cmd = (struct cam_cdm_bl_request *)
+		config_args->hw_update_entries->addr;
+	cdm_cmd->cookie = ope_req->req_idx;
+
+	cam_ope_mgr_ope_clk_update(hw_mgr, ctx_data, ope_req->req_idx);
+	ctx_data->req_list[ope_req->req_idx]->submit_timestamp = ktime_get();
+
+	if (ope_req->request_id <= ctx_data->last_flush_req)
+		CAM_WARN(CAM_OPE,
+			"Anomaly submitting flushed req %llu [last_flush %llu] in ctx %u",
+			ope_req->request_id, ctx_data->last_flush_req,
+			ctx_data->ctx_id);
+
+	rc = cam_ope_mgr_enqueue_config(hw_mgr, ctx_data, config_args);
+	if (rc)
+		goto config_err;
+
+	CAM_DBG(CAM_REQ, "req_id %llu, ctx_id %u io config",
+		ope_req->request_id, ctx_data->ctx_id);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+
+	return rc;
+config_err:
+	cam_ope_mgr_handle_config_err(config_args, ctx_data);
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return rc;
+}
+
+static int cam_ope_mgr_cmd(void *hw_mgr_priv, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_hw_cmd_args *hw_cmd_args = cmd_args;
+	struct cam_ope_hw_mgr  *hw_mgr = hw_mgr_priv;
+
+	if (!hw_mgr_priv || !cmd_args) {
+		CAM_ERR(CAM_OPE, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	switch (hw_cmd_args->cmd_type) {
+	case CAM_HW_MGR_CMD_DUMP_PF_INFO:
+		cam_ope_mgr_dump_pf_data(hw_mgr, hw_cmd_args);
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Invalid cmd: %d",
+			hw_cmd_args->cmd_type);
+	}
+
+	return rc;
+}
+
+static int cam_ope_mgr_hw_open_u(void *hw_priv, void *fw_download_args)
+{
+	struct cam_ope_hw_mgr *hw_mgr;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_OPE, "Invalid args: %pK", hw_priv);
+		return -EINVAL;
+	}
+
+	hw_mgr = hw_priv;
+	if (!hw_mgr->open_cnt) {
+		hw_mgr->open_cnt++;
+	} else {
+		rc = -EBUSY;
+		CAM_ERR(CAM_OPE, "Multiple opens are not supported");
+	}
+
+	return rc;
+}
+
+static int cam_ope_mgr_hw_close_u(void *hw_priv, void *hw_close_args)
+{
+	struct cam_ope_hw_mgr *hw_mgr;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_OPE, "Invalid args: %pK", hw_priv);
+		return -EINVAL;
+	}
+
+	hw_mgr = hw_priv;
+	if (!hw_mgr->open_cnt) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_OPE, "device is already closed");
+	} else {
+		hw_mgr->open_cnt--;
+	}
+
+	return rc;
+}
+
+static int cam_ope_mgr_flush_req(struct cam_ope_ctx *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	int idx;
+	int64_t request_id;
+
+	request_id = *(int64_t *)flush_args->flush_req_pending[0];
+	for (idx = 0; idx < CAM_CTX_REQ_MAX; idx++) {
+		if (!ctx_data->req_list[idx])
+			continue;
+
+		if (ctx_data->req_list[idx]->request_id != request_id)
+			continue;
+
+		ctx_data->req_list[idx]->request_id = 0;
+		cam_free_clear((void *)ctx_data->req_list[idx]->cdm_cmd);
+		ctx_data->req_list[idx]->cdm_cmd = NULL;
+		cam_ope_free_io_config(ctx_data->req_list[idx]);
+		cam_free_clear((void *)ctx_data->req_list[idx]);
+		ctx_data->req_list[idx] = NULL;
+		clear_bit(idx, ctx_data->bitmap);
+	}
+
+	return 0;
+}
+
+static int cam_ope_mgr_flush_all(struct cam_ope_ctx *ctx_data,
+	struct cam_hw_flush_args *flush_args)
+{
+	int i, rc;
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+
+	rc = cam_cdm_flush_hw(ctx_data->ope_cdm.cdm_handle);
+
+	mutex_lock(&ctx_data->ctx_mutex);
+	for (i = 0; i < hw_mgr->num_ope; i++) {
+		rc = hw_mgr->ope_dev_intf[i]->hw_ops.process_cmd(
+			hw_mgr->ope_dev_intf[i]->hw_priv, OPE_HW_RESET,
+			NULL, 0);
+		if (rc)
+			CAM_ERR(CAM_OPE, "OPE Dev reset failed: %d", rc);
+	}
+
+	for (i = 0; i < CAM_CTX_REQ_MAX; i++) {
+		if (!ctx_data->req_list[i])
+			continue;
+
+		ctx_data->req_list[i]->request_id = 0;
+		cam_free_clear((void *)ctx_data->req_list[i]->cdm_cmd);
+		ctx_data->req_list[i]->cdm_cmd = NULL;
+		cam_ope_free_io_config(ctx_data->req_list[i]);
+		cam_free_clear((void *)ctx_data->req_list[i]);
+		ctx_data->req_list[i] = NULL;
+		clear_bit(i, ctx_data->bitmap);
+	}
+	mutex_unlock(&ctx_data->ctx_mutex);
+
+	return rc;
+}
+
+static int cam_ope_mgr_hw_dump(void *hw_priv, void *hw_dump_args)
+{
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_hw_mgr *hw_mgr = hw_priv;
+	struct cam_hw_dump_args  *dump_args;
+	int idx;
+	ktime_t cur_time;
+	struct timespec64 cur_ts, req_ts;
+	uint64_t diff;
+
+	if ((!hw_priv) || (!hw_dump_args)) {
+		CAM_ERR(CAM_OPE, "Invalid params %pK %pK",
+			hw_priv, hw_dump_args);
+		return -EINVAL;
+	}
+
+	dump_args = (struct cam_hw_dump_args *)hw_dump_args;
+	ctx_data = dump_args->ctxt_to_hw_map;
+
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "Invalid context");
+		return -EINVAL;
+	}
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
+	mutex_lock(&ctx_data->ctx_mutex);
+
+	CAM_INFO(CAM_OPE, "Req %lld", dump_args->request_id);
+	for (idx = 0; idx < CAM_CTX_REQ_MAX; idx++) {
+		if (!ctx_data->req_list[idx])
+			continue;
+
+		if (ctx_data->req_list[idx]->request_id ==
+			dump_args->request_id)
+			break;
+	}
+
+	/* no matching request found */
+	if (idx == CAM_CTX_REQ_MAX) {
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return 0;
+	}
+
+	cur_time = ktime_get();
+	diff = ktime_us_delta(cur_time,
+			ctx_data->req_list[idx]->submit_timestamp);
+	cur_ts = ktime_to_timespec64(cur_time);
+	req_ts = ktime_to_timespec64(ctx_data->req_list[idx]->submit_timestamp);
+
+	if (diff < (ctx_data->req_timer_timeout * 1000)) {
+		CAM_INFO(CAM_OPE, "No Error req %llu %ld:%06ld %ld:%06ld",
+			dump_args->request_id,
+			req_ts.tv_sec,
+			req_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec,
+			cur_ts.tv_nsec/NSEC_PER_USEC);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return 0;
+	}
+
+	CAM_ERR(CAM_OPE, "Error req %llu %ld:%06ld %ld:%06ld",
+		dump_args->request_id,
+		req_ts.tv_sec,
+		req_ts.tv_nsec/NSEC_PER_USEC,
+		cur_ts.tv_sec,
+		cur_ts.tv_nsec/NSEC_PER_USEC);
+
+	mutex_unlock(&ctx_data->ctx_mutex);
+	mutex_unlock(&hw_mgr->hw_mgr_mutex);
+	return 0;
+}
+
+static int cam_ope_mgr_hw_flush(void *hw_priv, void *hw_flush_args)
+{
+	struct cam_hw_flush_args *flush_args = hw_flush_args;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;
+
+	if ((!hw_priv) || (!hw_flush_args)) {
+		CAM_ERR(CAM_OPE, "Input params are Null");
+		return -EINVAL;
+	}
+
+	ctx_data = flush_args->ctxt_to_hw_map;
+	if (!ctx_data) {
+		CAM_ERR(CAM_OPE, "Ctx data is NULL");
+		return -EINVAL;
+	}
+
+	if ((flush_args->flush_type >= CAM_FLUSH_TYPE_MAX) ||
+		(flush_args->flush_type < CAM_FLUSH_TYPE_REQ)) {
+		CAM_ERR(CAM_OPE, "Invalid flush type: %d",
+			flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	switch (flush_args->flush_type) {
+	case CAM_FLUSH_TYPE_ALL:
+		mutex_lock(&hw_mgr->hw_mgr_mutex);
+		ctx_data->last_flush_req = flush_args->last_flush_req;
+
+		CAM_DBG(CAM_REQ, "ctx_id %d Flush type %d last_flush_req %u",
+				ctx_data->ctx_id, flush_args->flush_type,
+				ctx_data->last_flush_req);
+
+		cam_ope_mgr_flush_all(ctx_data, flush_args);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		break;
+	case CAM_FLUSH_TYPE_REQ:
+		mutex_lock(&ctx_data->ctx_mutex);
+		if (flush_args->num_req_active) {
+			CAM_ERR(CAM_OPE, "Flush request is not supported");
+			mutex_unlock(&ctx_data->ctx_mutex);
+			return -EINVAL;
+		}
+		if (flush_args->num_req_pending)
+			cam_ope_mgr_flush_req(ctx_data, flush_args);
+		mutex_unlock(&ctx_data->ctx_mutex);
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Invalid flush type: %d",
+				flush_args->flush_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_ope_mgr_alloc_devs(struct device_node *of_node)
+{
+	int rc;
+	uint32_t num_dev;
+
+	rc = of_property_read_u32(of_node, "num-ope", &num_dev);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "getting num of ope failed: %d", rc);
+		return -EINVAL;
+	}
+
+	ope_hw_mgr->devices[OPE_DEV_OPE] = kzalloc(
+		sizeof(struct cam_hw_intf *) * num_dev, GFP_KERNEL);
+	if (!ope_hw_mgr->devices[OPE_DEV_OPE])
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int cam_ope_mgr_init_devs(struct device_node *of_node)
+{
+	int rc = 0;
+	int count, i;
+	const char *name = NULL;
+	struct device_node *child_node = NULL;
+	struct platform_device *child_pdev = NULL;
+	struct cam_hw_intf *child_dev_intf = NULL;
+	struct cam_hw_info *ope_dev;
+	struct cam_hw_soc_info *soc_info = NULL;
+
+	rc = cam_ope_mgr_alloc_devs(of_node);
+	if (rc)
+		return rc;
+
+	count = of_property_count_strings(of_node, "compat-hw-name");
+	if (!count) {
+		CAM_ERR(CAM_OPE, "no compat hw found in dev tree, cnt = %d",
+			count);
+		rc = -EINVAL;
+		goto compat_hw_name_failed;
+	}
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node, "compat-hw-name",
+			i, &name);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "getting dev object name failed");
+			goto compat_hw_name_failed;
+		}
+
+		child_node = of_find_node_by_name(NULL, name);
+		if (!child_node) {
+			CAM_ERR(CAM_OPE, "Cannot find node in dtsi %s", name);
+			rc = -ENODEV;
+			goto compat_hw_name_failed;
+		}
+
+		child_pdev = of_find_device_by_node(child_node);
+		if (!child_pdev) {
+			CAM_ERR(CAM_OPE, "failed to find device on bus %s",
+				child_node->name);
+			rc = -ENODEV;
+			of_node_put(child_node);
+			goto compat_hw_name_failed;
+		}
+
+		child_dev_intf = (struct cam_hw_intf *)platform_get_drvdata(
+			child_pdev);
+		if (!child_dev_intf) {
+			CAM_ERR(CAM_OPE, "no child device");
+			of_node_put(child_node);
+			goto compat_hw_name_failed;
+		}
+		ope_hw_mgr->devices[child_dev_intf->hw_type]
+			[child_dev_intf->hw_idx] = child_dev_intf;
+
+		if (!child_dev_intf->hw_ops.process_cmd)
+			goto compat_hw_name_failed;
+
+		of_node_put(child_node);
+	}
+
+	ope_hw_mgr->num_ope = count;
+
+	for (i = 0; i < count; i++) {
+		ope_hw_mgr->ope_dev_intf[i] =
+			ope_hw_mgr->devices[OPE_DEV_OPE][i];
+		ope_dev = ope_hw_mgr->ope_dev_intf[i]->hw_priv;
+		soc_info = &ope_dev->soc_info;
+		ope_hw_mgr->cdm_reg_map[i][0] =
+			soc_info->reg_map[0].mem_base;
+	}
+
+	ope_hw_mgr->hfi_en = of_property_read_bool(of_node, "hfi_en");
+
+	return 0;
+compat_hw_name_failed:
+	kfree(ope_hw_mgr->devices[OPE_DEV_OPE]);
+	ope_hw_mgr->devices[OPE_DEV_OPE] = NULL;
+	return rc;
+}
+
+static void cam_req_mgr_process_ope_command_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_ope_msg_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static void cam_req_mgr_process_ope_timer_queue(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+static int cam_ope_mgr_create_wq(void)
+{
+
+	int rc;
+	int i;
+
+	rc = cam_req_mgr_workq_create("ope_command_queue", OPE_WORKQ_NUM_TASK,
+		&ope_hw_mgr->cmd_work, CRM_WORKQ_USAGE_NON_IRQ,
+		0, cam_req_mgr_process_ope_command_queue);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "unable to create a command worker");
+		goto cmd_work_failed;
+	}
+
+	rc = cam_req_mgr_workq_create("ope_message_queue", OPE_WORKQ_NUM_TASK,
+		&ope_hw_mgr->msg_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_ope_msg_queue);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "unable to create a message worker");
+		goto msg_work_failed;
+	}
+
+	rc = cam_req_mgr_workq_create("ope_timer_queue", OPE_WORKQ_NUM_TASK,
+		&ope_hw_mgr->timer_work, CRM_WORKQ_USAGE_IRQ, 0,
+		cam_req_mgr_process_ope_timer_queue);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "unable to create a timer worker");
+		goto timer_work_failed;
+	}
+
+	ope_hw_mgr->cmd_work_data =
+		kzalloc(sizeof(struct ope_cmd_work_data) * OPE_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!ope_hw_mgr->cmd_work_data) {
+		rc = -ENOMEM;
+		goto cmd_work_data_failed;
+	}
+
+	ope_hw_mgr->msg_work_data =
+		kzalloc(sizeof(struct ope_msg_work_data) * OPE_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!ope_hw_mgr->msg_work_data) {
+		rc = -ENOMEM;
+		goto msg_work_data_failed;
+	}
+
+	ope_hw_mgr->timer_work_data =
+		kzalloc(sizeof(struct ope_clk_work_data) * OPE_WORKQ_NUM_TASK,
+		GFP_KERNEL);
+	if (!ope_hw_mgr->timer_work_data) {
+		rc = -ENOMEM;
+		goto timer_work_data_failed;
+	}
+
+	for (i = 0; i < OPE_WORKQ_NUM_TASK; i++)
+		ope_hw_mgr->msg_work->task.pool[i].payload =
+				&ope_hw_mgr->msg_work_data[i];
+
+	for (i = 0; i < OPE_WORKQ_NUM_TASK; i++)
+		ope_hw_mgr->cmd_work->task.pool[i].payload =
+				&ope_hw_mgr->cmd_work_data[i];
+
+	for (i = 0; i < OPE_WORKQ_NUM_TASK; i++)
+		ope_hw_mgr->timer_work->task.pool[i].payload =
+				&ope_hw_mgr->timer_work_data[i];
+	return 0;
+
+
+timer_work_data_failed:
+	kfree(ope_hw_mgr->msg_work_data);
+msg_work_data_failed:
+	kfree(ope_hw_mgr->cmd_work_data);
+cmd_work_data_failed:
+	cam_req_mgr_workq_destroy(&ope_hw_mgr->timer_work);
+timer_work_failed:
+	cam_req_mgr_workq_destroy(&ope_hw_mgr->msg_work);
+msg_work_failed:
+	cam_req_mgr_workq_destroy(&ope_hw_mgr->cmd_work);
+cmd_work_failed:
+	return rc;
+}
+
+static int cam_ope_create_debug_fs(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_ope", NULL);
+
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_OPE, "failed to create dentry");
+		rc = ENOMEM;
+		goto end;
+	}
+
+	ope_hw_mgr->dentry = dbgfileptr;
+
+	debugfs_create_bool("frame_dump_enable", 0644,
+		ope_hw_mgr->dentry, &ope_hw_mgr->frame_dump_enable);
+
+	debugfs_create_bool("dump_req_data_enable", 0644,
+		ope_hw_mgr->dentry, &ope_hw_mgr->dump_req_data_enable);
+
+end:
+	return rc;
+
+}
+
+
+int cam_ope_hw_mgr_init(struct device_node *of_node, uint64_t *hw_mgr_hdl,
+	int *iommu_hdl)
+{
+	int i, rc = 0, j;
+	struct cam_hw_mgr_intf *hw_mgr_intf;
+	struct cam_iommu_handle cdm_handles;
+
+	if (!of_node || !hw_mgr_hdl) {
+		CAM_ERR(CAM_OPE, "Invalid args of_node %pK hw_mgr %pK",
+			of_node, hw_mgr_hdl);
+		return -EINVAL;
+	}
+	hw_mgr_intf = (struct cam_hw_mgr_intf *)hw_mgr_hdl;
+
+	ope_hw_mgr = kzalloc(sizeof(struct cam_ope_hw_mgr), GFP_KERNEL);
+	if (!ope_hw_mgr) {
+		CAM_ERR(CAM_OPE, "Unable to allocate mem for: size = %d",
+			sizeof(struct cam_ope_hw_mgr));
+		return -ENOMEM;
+	}
+
+	hw_mgr_intf->hw_mgr_priv = ope_hw_mgr;
+	hw_mgr_intf->hw_get_caps = cam_ope_mgr_get_hw_caps;
+	hw_mgr_intf->hw_acquire  = cam_ope_mgr_acquire_hw;
+	hw_mgr_intf->hw_release  = cam_ope_mgr_release_hw;
+	hw_mgr_intf->hw_start    = NULL;
+	hw_mgr_intf->hw_stop     = NULL;
+	hw_mgr_intf->hw_prepare_update = cam_ope_mgr_prepare_hw_update;
+	hw_mgr_intf->hw_config_stream_settings = NULL;
+	hw_mgr_intf->hw_config = cam_ope_mgr_config_hw;
+	hw_mgr_intf->hw_read   = NULL;
+	hw_mgr_intf->hw_write  = NULL;
+	hw_mgr_intf->hw_cmd    = cam_ope_mgr_cmd;
+	hw_mgr_intf->hw_open   = cam_ope_mgr_hw_open_u;
+	hw_mgr_intf->hw_close  = cam_ope_mgr_hw_close_u;
+	hw_mgr_intf->hw_flush  = cam_ope_mgr_hw_flush;
+	hw_mgr_intf->hw_dump   = cam_ope_mgr_hw_dump;
+
+	ope_hw_mgr->secure_mode = false;
+	mutex_init(&ope_hw_mgr->hw_mgr_mutex);
+	spin_lock_init(&ope_hw_mgr->hw_mgr_lock);
+
+	for (i = 0; i < OPE_CTX_MAX; i++) {
+		ope_hw_mgr->ctx[i].bitmap_size =
+			BITS_TO_LONGS(CAM_CTX_REQ_MAX) *
+			sizeof(long);
+		ope_hw_mgr->ctx[i].bitmap = kzalloc(
+			ope_hw_mgr->ctx[i].bitmap_size, GFP_KERNEL);
+		if (!ope_hw_mgr->ctx[i].bitmap) {
+			CAM_ERR(CAM_OPE, "bitmap allocation failed: size = %d",
+				ope_hw_mgr->ctx[i].bitmap_size);
+			rc = -ENOMEM;
+			goto ope_ctx_bitmap_failed;
+		}
+		ope_hw_mgr->ctx[i].bits = ope_hw_mgr->ctx[i].bitmap_size *
+			BITS_PER_BYTE;
+		mutex_init(&ope_hw_mgr->ctx[i].ctx_mutex);
+	}
+
+	rc = cam_ope_mgr_init_devs(of_node);
+	if (rc)
+		goto dev_init_failed;
+
+	ope_hw_mgr->ctx_bitmap_size =
+		BITS_TO_LONGS(OPE_CTX_MAX) * sizeof(long);
+	ope_hw_mgr->ctx_bitmap = kzalloc(ope_hw_mgr->ctx_bitmap_size,
+		GFP_KERNEL);
+	if (!ope_hw_mgr->ctx_bitmap) {
+		rc = -ENOMEM;
+		goto ctx_bitmap_alloc_failed;
+	}
+
+	ope_hw_mgr->ctx_bits = ope_hw_mgr->ctx_bitmap_size *
+		BITS_PER_BYTE;
+
+	for (i = 0; i < OPE_DEV_MAX; i++) {
+		rc = cam_ope_hw_init(&ope_hw_mgr->ope_dev_data[i], i);
+		if (rc)
+			goto ctx_bitmap_alloc_failed;
+	}
+
+	rc = cam_smmu_get_handle("ope", &ope_hw_mgr->iommu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "get mmu handle failed: %d", rc);
+		goto ope_get_hdl_failed;
+	}
+
+	rc = cam_smmu_get_handle("cam-secure", &ope_hw_mgr->iommu_sec_hdl);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "get secure mmu handle failed: %d", rc);
+		goto secure_hdl_failed;
+	}
+
+	rc = cam_cdm_get_iommu_handle("ope", &cdm_handles);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "ope cdm handle get is failed: %d", rc);
+		goto ope_cdm_hdl_failed;
+	}
+
+	ope_hw_mgr->iommu_cdm_hdl = cdm_handles.non_secure;
+	ope_hw_mgr->iommu_sec_cdm_hdl = cdm_handles.secure;
+	CAM_DBG(CAM_OPE, "iommu hdls %x %x cdm %x %x",
+		ope_hw_mgr->iommu_hdl, ope_hw_mgr->iommu_sec_hdl,
+		ope_hw_mgr->iommu_cdm_hdl,
+		ope_hw_mgr->iommu_sec_cdm_hdl);
+
+	rc = cam_ope_mgr_create_wq();
+	if (rc)
+		goto ope_wq_create_failed;
+
+	cam_ope_create_debug_fs();
+
+	if (iommu_hdl)
+		*iommu_hdl = ope_hw_mgr->iommu_hdl;
+
+	return rc;
+
+ope_wq_create_failed:
+	ope_hw_mgr->iommu_cdm_hdl = -1;
+	ope_hw_mgr->iommu_sec_cdm_hdl = -1;
+ope_cdm_hdl_failed:
+	cam_smmu_destroy_handle(ope_hw_mgr->iommu_sec_hdl);
+	ope_hw_mgr->iommu_sec_hdl = -1;
+secure_hdl_failed:
+	cam_smmu_destroy_handle(ope_hw_mgr->iommu_hdl);
+	ope_hw_mgr->iommu_hdl = -1;
+ope_get_hdl_failed:
+	cam_free_clear((void *)ope_hw_mgr->ctx_bitmap);
+	ope_hw_mgr->ctx_bitmap = NULL;
+	ope_hw_mgr->ctx_bitmap_size = 0;
+	ope_hw_mgr->ctx_bits = 0;
+ctx_bitmap_alloc_failed:
+	cam_free_clear((void *)ope_hw_mgr->devices[OPE_DEV_OPE]);
+	ope_hw_mgr->devices[OPE_DEV_OPE] = NULL;
+dev_init_failed:
+ope_ctx_bitmap_failed:
+	mutex_destroy(&ope_hw_mgr->hw_mgr_mutex);
+	for (j = i - 1; j >= 0; j--) {
+		mutex_destroy(&ope_hw_mgr->ctx[j].ctx_mutex);
+		cam_free_clear((void *)ope_hw_mgr->ctx[j].bitmap);
+		ope_hw_mgr->ctx[j].bitmap = NULL;
+		ope_hw_mgr->ctx[j].bitmap_size = 0;
+		ope_hw_mgr->ctx[j].bits = 0;
+	}
+	cam_free_clear((void *)ope_hw_mgr);
+	ope_hw_mgr = NULL;
+
+	return rc;
+}
+
+static void cam_ope_mgr_dump_pf_data(
+	struct cam_ope_hw_mgr  *hw_mgr,
+	struct cam_hw_cmd_args *hw_cmd_args)
+{
+	struct cam_ope_ctx             *ctx_data;
+	struct cam_packet              *packet;
+	struct cam_buf_io_cfg          *io_cfg = NULL;
+	struct cam_ope_request         *ope_request;
+	struct ope_io_buf              *io_buf = NULL;
+	struct cam_ope_match_pid_args  ope_pid_mid_args;
+
+	dma_addr_t   iova_addr;
+	int          device_idx;
+	bool         *ctx_found;
+	bool         io_buf_found = false;
+	size_t       src_buf_size;
+	int          i, j;
+	int32_t      mmu_hdl;
+	bool         hw_pid_support = true;
+	bool         hw_id_found = false;
+	uint32_t     *resource_type;
+	int          stripe_num;
+	int          rc = 0;
+
+	ctx_data    = (struct cam_ope_ctx *)hw_cmd_args->ctxt_to_hw_map;
+	packet      = hw_cmd_args->u.pf_args.pf_data.packet;
+	ope_request = hw_cmd_args->u.pf_args.pf_data.req;
+
+	ope_pid_mid_args.fault_mid = hw_cmd_args->u.pf_args.mid;
+	ope_pid_mid_args.fault_pid = hw_cmd_args->u.pf_args.pid;
+	ctx_found = hw_cmd_args->u.pf_args.ctx_found;
+	resource_type = hw_cmd_args->u.pf_args.resource_type;
+
+	if (ctx_data->pf_mid_found)
+		goto stripedump;
+
+	if (*ctx_found && *resource_type) {
+		hw_pid_support = false;
+		goto stripedump;
+	} else {
+		*ctx_found = false;
+	}
+
+	for (i = 0; i < ope_hw_mgr->num_ope; i++) {
+		if (!ope_hw_mgr->ope_dev_data[i]->hw_intf)
+			continue;
+		for (j = 0; j < ope_hw_mgr->ope_dev_data[i]->num_hw_pid; j++) {
+			if (ope_hw_mgr->ope_dev_data[i]->hw_pid[j] ==
+					hw_cmd_args->u.pf_args.pid) {
+				hw_id_found = true;
+				device_idx = i;
+				*ctx_found = true;
+				break;
+			}
+		}
+		if (hw_id_found)
+			break;
+	}
+
+	if (i == ope_hw_mgr->num_ope) {
+		CAM_INFO(CAM_OPE,
+			"PID:%d  is not matching with any OPE HW PIDs ctx id:%d",
+			hw_cmd_args->u.pf_args.pid, ctx_data->ctx_id);
+		return;
+	}
+
+	ope_pid_mid_args.device_idx = device_idx;
+
+	rc = hw_mgr->devices[OPE_DEV_OPE][device_idx]->hw_ops.process_cmd(
+		hw_mgr->devices[OPE_DEV_OPE][device_idx]->hw_priv,
+		OPE_HW_MATCH_PID_MID,
+		&ope_pid_mid_args, sizeof(ope_pid_mid_args));
+	if (rc) {
+		CAM_ERR(CAM_OPE,
+			"CAM_OPE_CMD_MATCH_PID_MID failed %d", rc);
+			return;
+	}
+
+	*resource_type = ope_pid_mid_args.match_res;
+	CAM_INFO(CAM_OPE, "Fault port %d", *resource_type);
+
+stripedump:
+	io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload_flex +
+			packet->io_configs_offset / 4);
+
+	if (!ope_request)
+		goto iodump;
+
+	CAM_INFO(CAM_OPE, "req_id %d Num of batches %d",
+			ope_request->request_id, ope_request->num_batch);
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = 0; j < ope_request->num_io_bufs[i]; j++) {
+			io_buf = ope_request->io_buf[i][j];
+			if (io_buf) {
+				if (io_buf->resource_type == *resource_type) {
+					io_buf_found = true;
+					break;
+				}
+			}
+		}
+		if (io_buf_found)
+			break;
+	}
+iodump:
+	for (i = 0; i < packet->num_io_configs; i++) {
+		if (hw_pid_support) {
+			if (io_cfg[i].resource_type !=
+				*resource_type)
+				continue;
+		}
+
+		for (j = 0; j < CAM_PACKET_MAX_PLANES; j++) {
+			if (!io_cfg[i].mem_handle[j])
+				break;
+			CAM_INFO(CAM_OPE, "port: %d f: %u format: %d dir %d",
+				io_cfg[i].resource_type,
+				io_cfg[i].fence,
+				io_cfg[i].format,
+				io_cfg[i].direction);
+
+			mmu_hdl = cam_mem_is_secure_buf(
+					io_cfg[i].mem_handle[j]) ?
+					hw_mgr->iommu_sec_hdl :
+					hw_mgr->iommu_hdl;
+			rc = cam_mem_get_io_buf(io_cfg[i].mem_handle[j],
+					mmu_hdl, &iova_addr, &src_buf_size);
+			if (rc < 0) {
+				CAM_ERR(CAM_UTIL, "get src buf address fail");
+				continue;
+			}
+			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {
+				CAM_ERR(CAM_OPE, "Invalid mapped address");
+				rc = -EINVAL;
+				continue;
+			}
+			CAM_INFO(CAM_OPE,
+				"pln %u w %u h %u stride %u slice %u size %d addr 0x%x offset 0x%x memh %x",
+				j, io_cfg[i].planes[j].width,
+				io_cfg[i].planes[j].height,
+				io_cfg[i].planes[j].plane_stride,
+				io_cfg[i].planes[j].slice_height,
+				(int32_t)src_buf_size,
+				(unsigned int)iova_addr,
+				io_cfg[i].offsets[j],
+				io_cfg[i].mem_handle[j]);
+
+			if (io_buf_found) {
+				if (j >= OPE_MAX_PLANES) {
+					CAM_ERR(CAM_OPE, "Invalid plane idx: %d", j);
+					break;
+				}
+
+				for (stripe_num = 0; stripe_num < io_buf->num_stripes[j];
+						stripe_num++) {
+					CAM_INFO(CAM_OPE,
+						"pln_num %d stripe_num %d width %d height %d stride %d io vaddr 0x%x",
+						j, stripe_num, io_buf->s_io[j][stripe_num].width,
+						io_buf->s_io[j][stripe_num].height,
+						io_buf->s_io[j][stripe_num].stride,
+						io_buf->s_io[j][stripe_num].iova_addr);
+				}
+			}
+		}
+		if (hw_pid_support)
+			return;
+	}
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.h
@@ -0,0 +1,628 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_HW_MGR_H
+#define CAM_OPE_HW_MGR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "ope_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_mem_mgr.h"
+#include "cam_smmu_api.h"
+#include "cam_soc_util.h"
+#include "cam_req_mgr_timer.h"
+#include "cam_context.h"
+#include "ope_hw.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_req_mgr_timer.h"
+
+#define OPE_CTX_MAX               32
+#define CAM_FRAME_CMD_MAX         20
+
+
+#define OPE_WORKQ_NUM_TASK        100
+#define OPE_WORKQ_TASK_CMD_TYPE   1
+#define OPE_WORKQ_TASK_MSG_TYPE   2
+
+#define OPE_PACKET_SIZE           0
+#define OPE_PACKET_TYPE           1
+#define OPE_PACKET_OPCODE         2
+
+#define OPE_PACKET_MAX_CMD_BUFS   4
+
+#define OPE_MAX_OUTPUT_SUPPORTED  8
+#define OPE_MAX_INPUT_SUPPORTED   3
+
+#define OPE_FRAME_PROCESS_SUCCESS 0
+#define OPE_FRAME_PROCESS_FAILURE 1
+
+#define OPE_CTX_STATE_FREE        0
+#define OPE_CTX_STATE_IN_USE      1
+#define OPE_CTX_STATE_ACQUIRED    2
+#define OPE_CTX_STATE_RELEASE     3
+
+#define OPE_CMDS                  OPE_MAX_CMD_BUFS
+#define CAM_MAX_IN_RES            8
+
+#define OPE_MAX_CDM_BLS           32
+
+#define CAM_OPE_MAX_PER_PATH_VOTES 6
+#define CAM_OPE_BW_CONFIG_UNKNOWN  0
+#define CAM_OPE_BW_CONFIG_V2       2
+
+#define CLK_HW_OPE                 0x0
+#define CLK_HW_MAX                 0x1
+
+#define OPE_DEVICE_IDLE_TIMEOUT    400
+#define OPE_REQUEST_RT_TIMEOUT        200
+#define OPE_REQUEST_NRT_TIMEOUT        400
+
+/**
+ * struct cam_ope_clk_bw_request_v2
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @reserved: Reserved for future use
+ * @num_paths: Number of paths for per path bw vote
+ * @axi_path: Per path vote info for OPE
+ */
+struct cam_ope_clk_bw_req_internal_v2 {
+	uint64_t budget_ns;
+	uint32_t frame_cycles;
+	uint32_t rt_flag;
+	uint32_t reserved;
+	uint32_t num_paths;
+	struct cam_axi_per_path_bw_vote axi_path[CAM_OPE_MAX_PER_PATH_VOTES];
+};
+
+/**
+ * struct cam_ope_clk_bw_request
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @uncompressed_bw: Bandwidth required to process frame
+ * @compressed_bw: Compressed bandwidth to process frame
+ */
+struct cam_ope_clk_bw_request {
+	uint64_t budget_ns;
+	uint32_t frame_cycles;
+	uint32_t rt_flag;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+};
+
+/**
+ * struct cam_ctx_clk_info
+ * @curr_fc: Context latest request frame cycles
+ * @rt_flag: Flag to indicate real time request
+ * @base_clk: Base clock to process the request
+ * @reserved: Reserved field
+ * @uncompressed_bw: Current bandwidth voting
+ * @compressed_bw: Current compressed bandwidth voting
+ * @clk_rate: Supported clock rates for the context
+ * @num_paths: Number of valid AXI paths
+ * @axi_path: ctx based per path bw vote
+ */
+struct cam_ctx_clk_info {
+	uint32_t curr_fc;
+	uint32_t rt_flag;
+	uint32_t base_clk;
+	uint32_t reserved;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+	int32_t clk_rate[CAM_MAX_VOTE];
+	uint32_t num_paths;
+	struct cam_axi_per_path_bw_vote axi_path[CAM_OPE_MAX_PER_PATH_VOTES];
+};
+
+/**
+ * struct ope_cmd_generic_blob
+ * @ctx: Current context info
+ * @req_info_idx: Index used for request
+ * @io_buf_addr: pointer to io buffer address
+ */
+struct ope_cmd_generic_blob {
+	struct cam_ope_ctx *ctx;
+	uint32_t req_idx;
+	uint64_t *io_buf_addr;
+};
+
+/**
+ * struct cam_ope_clk_info
+ * @base_clk: Base clock to process request
+ * @curr_clk: Current clock of hadrware
+ * @threshold: Threshold for overclk count
+ * @over_clked: Over clock count
+ * @uncompressed_bw: Current bandwidth voting
+ * @compressed_bw: Current compressed bandwidth voting
+ * @num_paths: Number of AXI vote paths
+ * @axi_path: Current per path bw vote info
+ * @hw_type: IPE/BPS device type
+ * @watch_dog: watchdog timer handle
+ * @watch_dog_reset_counter: Counter for watch dog reset
+ */
+struct cam_ope_clk_info {
+	uint32_t base_clk;
+	uint32_t curr_clk;
+	uint32_t threshold;
+	uint32_t over_clked;
+	uint64_t uncompressed_bw;
+	uint64_t compressed_bw;
+	uint32_t num_paths;
+	struct cam_axi_per_path_bw_vote axi_path[CAM_OPE_MAX_PER_PATH_VOTES];
+	uint32_t hw_type;
+	struct cam_req_mgr_timer *watch_dog;
+	uint32_t watch_dog_reset_counter;
+};
+
+/**
+ * struct ope_cmd_work_data
+ *
+ * @type:       Type of work data
+ * @data:       Private data
+ * @req_id:     Request Id
+ */
+struct ope_cmd_work_data {
+	uint32_t type;
+	void *data;
+	int64_t req_id;
+};
+
+/**
+ * struct ope_msg_work_data
+ *
+ * @type:       Type of work data
+ * @data:       Private data
+ * @irq_status: IRQ status
+ */
+struct ope_msg_work_data {
+	uint32_t type;
+	void *data;
+	uint32_t irq_status;
+};
+
+/**
+ * struct ope_clk_work_data
+ *
+ * @type: Type of work data
+ * @data: Private data
+ */
+struct ope_clk_work_data {
+	uint32_t type;
+	void *data;
+};
+
+/**
+ * struct cdm_dmi_cmd
+ *
+ * @length:   Number of bytes in LUT
+ * @reserved: reserved bits
+ * @cmd:      Command ID (CDMCmd)
+ * @addr:     Address of the LUT in memory
+ * @DMIAddr:  Address of the target DMI config register
+ * @DMISel:   DMI identifier
+ */
+struct cdm_dmi_cmd {
+	unsigned int length   : 16;
+	unsigned int reserved : 8;
+	unsigned int cmd      : 8;
+	unsigned int addr;
+	unsigned int DMIAddr  : 24;
+	unsigned int DMISel   : 8;
+} __attribute__((__packed__));
+
+/**
+ * struct ope_debug_buffer
+ *
+ * @cpu_addr:         CPU address
+ * @iova_addr:        IOVA address
+ * @len:              Buffer length
+ * @size:             Buffer Size
+ * @offset:	      buffer offset
+ */
+struct ope_debug_buffer {
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	size_t len;
+	uint32_t size;
+	uint32_t offset;
+};
+
+/**
+ * struct ope_kmd_buffer
+ *
+ * @mem_handle:       Memory handle
+ * @cpu_addr:         CPU address
+ * @iova_addr:        IOVA address
+ * @iova_cdm_addr:    CDM IOVA address
+ * @offset:           Offset of buffer
+ * @len:              Buffer length
+ * @size:             Buffer Size
+ */
+struct ope_kmd_buffer {
+	uint32_t mem_handle;
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	dma_addr_t iova_cdm_addr;
+	uint32_t offset;
+	size_t len;
+	uint32_t size;
+};
+
+struct ope_stripe_settings {
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	size_t len;
+	uint32_t size;
+	uint32_t buf_type;
+	uint32_t type_buffered;
+};
+
+/**
+ * struct ope_pass_settings
+ *
+ * @cpu_addr:         CPU address
+ * @iova_addr:        IOVA address
+ * @len:              Buffer length
+ * @size:             Buffer Size
+ * @idx:              Pass Index
+ * @buf_type:         Direct/Indirect type
+ * @type_buffered:    SB/DB types
+ */
+struct ope_pass_settings {
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	size_t len;
+	uint32_t size;
+	uint32_t idx;
+	uint32_t buf_type;
+	uint32_t type_buffered;
+};
+
+/**
+ * struct ope_frame_settings
+ *
+ * @cpu_addr:         CPU address
+ * @iova_addr:        IOVA address
+ * @offset:           offset
+ * @len:              Buffer length
+ * @size:             Buffer Size
+ * @buf_type:         Direct/Indirect type
+ * @type_buffered:    SB/DB types
+ * @prefecth_disable: Disable prefetch
+ */
+struct ope_frame_settings {
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	uint32_t offset;
+	size_t len;
+	uint32_t size;
+	uint32_t buf_type;
+	uint32_t type_buffered;
+	uint32_t prefecth_disable;
+};
+
+/**
+ * struct ope_stripe_io
+ *
+ * @format:            Stripe format
+ * @s_location:        Stripe location
+ * @cpu_addr:          Stripe CPU address
+ * @iova_addr:         Stripe IOVA address
+ * @width:             Stripe width
+ * @height:            Stripe height
+ * @stride:            Stripe stride
+ * @unpack_format:     Unpack format
+ * @pack_format:       Packing format
+ * @alignment:         Stripe alignment
+ * @offset:            Stripe offset
+ * @x_init:            X_init
+ * @subsample_period:  Subsample period
+ * @subsample_pattern: Subsample pattern
+ * @len:               Stripe buffer length
+ * @disable_bus:       disable bus for the stripe
+ */
+struct ope_stripe_io {
+	uint32_t format;
+	uint32_t s_location;
+	uintptr_t cpu_addr;
+	dma_addr_t iova_addr;
+	uint32_t width;
+	uint32_t height;
+	uint32_t stride;
+	uint32_t unpack_format;
+	uint32_t pack_format;
+	uint32_t alignment;
+	uint32_t offset;
+	uint32_t x_init;
+	uint32_t subsample_period;
+	uint32_t subsample_pattern;
+	size_t len;
+	uint32_t disable_bus;
+};
+
+/**
+ * struct ope_io_buf
+ *
+ * @direction:     Direction of a buffer
+ * @resource_type: Resource type of IO Buffer
+ * @format:        Format
+ * @fence:         Fence
+ * @num_planes:    Number of planes
+ * @num_stripes:   Number of stripes
+ * @s_io:          Stripe info
+ */
+struct ope_io_buf {
+	uint32_t direction;
+	uint32_t resource_type;
+	uint32_t format;
+	uint32_t fence;
+	uint32_t num_planes;
+	uint32_t pix_pattern;
+	uint32_t num_stripes[OPE_MAX_PLANES];
+	struct ope_stripe_io s_io[OPE_MAX_PLANES][OPE_MAX_STRIPES];
+};
+
+/**
+ * struct cam_ope_request
+ *
+ * @request_id:          Request Id
+ * @req_idx:             Index in request list
+ * @state:               Request state
+ * @num_batch:           Number of batches
+ * @num_cmd_bufs:        Number of command buffers
+ * @num_frame_bufs:      Number of frame buffers
+ * @num_pass_bufs:       Number of pass Buffers
+ * @num_stripes:         Number of Stripes
+ * @num_io_bufs:         Number of IO Buffers
+ * @in_resource:         Input resource
+ * @num_stripe_cmd_bufs: Command buffers per stripe
+ * @ope_kmd_buf:         KMD buffer for OPE programming
+ * @ope_debug_buf:       Debug buffer
+ * @io_buf:              IO config info of a request
+ * @cdm_cmd:             CDM command for OPE CDM
+ * @clk_info:            Clock Info V1
+ * @clk_info_v2:         Clock Info V2
+ * @hang_data:           Debug data for HW error
+ * @submit_timestamp:    Submit timestamp to hw
+ */
+struct cam_ope_request {
+	uint64_t request_id;
+	uint32_t req_idx;
+	uint32_t state;
+	uint32_t num_batch;
+	uint32_t num_cmd_bufs;
+	uint32_t num_frame_bufs;
+	uint32_t num_pass_bufs;
+	uint32_t num_stripes[OPE_MAX_BATCH_SIZE];
+	uint32_t num_io_bufs[OPE_MAX_BATCH_SIZE];
+	uint32_t in_resource;
+	uint8_t num_stripe_cmd_bufs[OPE_MAX_BATCH_SIZE][OPE_MAX_STRIPES];
+	struct ope_kmd_buffer ope_kmd_buf;
+	struct ope_debug_buffer ope_debug_buf;
+	struct ope_io_buf *io_buf[OPE_MAX_BATCH_SIZE][OPE_MAX_IO_BUFS];
+	struct cam_cdm_bl_request *cdm_cmd;
+	struct cam_ope_clk_bw_request clk_info;
+	struct cam_ope_clk_bw_req_internal_v2 clk_info_v2;
+	struct cam_hw_mgr_dump_pf_data hang_data;
+	ktime_t submit_timestamp;
+};
+
+/**
+ * struct cam_ope_cdm
+ *
+ * @cdm_handle: OPE CDM Handle
+ * @cdm_ops:    OPE CDM Operations
+ */
+struct cam_ope_cdm {
+	uint32_t cdm_handle;
+	struct cam_cdm_utils_ops *cdm_ops;
+};
+
+/**
+ * struct cam_ope_ctx
+ *
+ * @context_priv:    Private data of context
+ * @bitmap:          Context bit map
+ * @bitmap_size:     Context bit map size
+ * @bits:            Context bit map bits
+ * @ctx_id:          Context ID
+ * @ctx_state:       State of a context
+ * @req_cnt:         Requests count
+ * @ctx_mutex:       Mutex for context
+ * @acquire_dev_cmd: Cam acquire command
+ * @ope_acquire:     OPE acquire command
+ * @ctxt_event_cb:   Callback of a context
+ * @req_list:        Request List
+ * @ope_cdm:         OPE CDM info
+ * @last_req_time:   Timestamp of last request
+ * @req_watch_dog:   Watchdog for requests
+ * @req_watch_dog_reset_counter: Request reset counter
+ * @clk_info:        OPE Ctx clock info
+ * @clk_watch_dog:   Clock watchdog
+ * @clk_watch_dog_reset_counter: Reset counter
+ * @last_flush_req: last flush req for this ctx
+ * @req_timer_timeout: req timer timeout value
+ */
+struct cam_ope_ctx {
+	void *context_priv;
+	size_t bitmap_size;
+	void *bitmap;
+	size_t bits;
+	uint32_t ctx_id;
+	uint32_t ctx_state;
+	uint32_t req_cnt;
+	struct mutex ctx_mutex;
+	struct cam_acquire_dev_cmd acquire_dev_cmd;
+	struct ope_acquire_dev_info ope_acquire;
+	cam_hw_event_cb_func ctxt_event_cb;
+	struct cam_ope_request *req_list[CAM_CTX_REQ_MAX];
+	struct cam_ope_cdm ope_cdm;
+	uint64_t last_req_time;
+	struct cam_req_mgr_timer *req_watch_dog;
+	uint32_t req_watch_dog_reset_counter;
+	struct cam_ctx_clk_info clk_info;
+	struct cam_req_mgr_timer *clk_watch_dog;
+	uint32_t clk_watch_dog_reset_counter;
+	uint64_t last_flush_req;
+	bool pf_mid_found;
+	uint64_t req_timer_timeout;
+};
+
+/**
+ * struct cam_ope_hw_intf_data - OPE hw intf data
+ *
+ * @Brief:        ope hw intf pointer and pid list data
+ *
+ * @devices:      ope hw intf pointer
+ * @num_devices:  Number of OPE devices
+ * @num_hw_pid:   Number of pids for this hw
+ * @hw_pid:       ope hw pid values
+ *
+ */
+struct cam_ope_hw_intf_data {
+	struct cam_hw_intf  *hw_intf;
+	uint32_t             num_hw_pid;
+	uint32_t             hw_pid[OPE_DEV_MAX];
+};
+
+/**
+ * struct cam_ope_hw_mgr
+ *
+ * @open_cnt:             OPE device open count
+ * @ope_ctx_cnt:          Open context count
+ * @hw_mgr_mutex:         Mutex for HW manager
+ * @hw_mgr_lock:          Spinlock for HW manager
+ * @hfi_en:               Flag for HFI
+ * @iommu_hdl:            OPE Handle
+ * @iommu_sec_hdl:        OPE Handle for secure
+ * @iommu_cdm_hdl:        CDM Handle
+ * @iommu_sec_cdm_hdl:    CDM Handle for secure
+ * @num_ope:              Number of OPE
+ * @secure_mode:          Mode of OPE operation
+ * @ctx_bitmap:           Context bit map
+ * @ctx_bitmap_size:      Context bit map size
+ * @ctx_bits:             Context bit map bits
+ * @ctx:                  OPE context
+ * @devices:              OPE devices
+ * @ope_dev_data:         OPE device specific data
+ * @ope_caps:             OPE capabilities
+ * @cmd_work:             Command work
+ * @msg_work:             Message work
+ * @timer_work:           Timer work
+ * @cmd_work_data:        Command work data
+ * @msg_work_data:        Message work data
+ * @timer_work_data:      Timer work data
+ * @ope_dev_intf:         OPE device interface
+ * @cdm_reg_map:          OPE CDM register map
+ * @clk_info:             OPE clock Info for HW manager
+ * @dentry:               Pointer to OPE debugfs directory
+ * @frame_dump_enable:    OPE frame setting dump enablement
+ * @dump_req_data_enable: OPE hang dump enablement
+ */
+struct cam_ope_hw_mgr {
+	int32_t             open_cnt;
+	uint32_t            ope_ctx_cnt;
+	struct mutex        hw_mgr_mutex;
+	spinlock_t          hw_mgr_lock;
+	bool                hfi_en;
+	int32_t             iommu_hdl;
+	int32_t             iommu_sec_hdl;
+	int32_t             iommu_cdm_hdl;
+	int32_t             iommu_sec_cdm_hdl;
+	uint32_t            num_ope;
+	bool                secure_mode;
+	void *ctx_bitmap;
+	size_t ctx_bitmap_size;
+	size_t ctx_bits;
+	struct cam_ope_ctx  ctx[OPE_CTX_MAX];
+	struct cam_hw_intf **devices[OPE_DEV_MAX];
+	struct cam_ope_hw_intf_data *ope_dev_data[OPE_DEV_MAX];
+	struct ope_query_cap_cmd ope_caps;
+	uint64_t last_callback_time;
+
+	struct cam_req_mgr_core_workq *cmd_work;
+	struct cam_req_mgr_core_workq *msg_work;
+	struct cam_req_mgr_core_workq *timer_work;
+	struct ope_cmd_work_data *cmd_work_data;
+	struct ope_msg_work_data *msg_work_data;
+	struct ope_clk_work_data *timer_work_data;
+	struct cam_hw_intf *ope_dev_intf[OPE_DEV_MAX];
+	struct cam_soc_reg_map *cdm_reg_map[OPE_DEV_MAX][OPE_BASE_MAX];
+	struct cam_ope_clk_info clk_info;
+	struct dentry *dentry;
+	bool   frame_dump_enable;
+	bool   dump_req_data_enable;
+};
+
+/**
+ * struct cam_ope_buf_entry
+ *
+ * @fd:                FD of cmd buffer
+ * @memhdl:           Memhandle of cmd buffer
+ * @iova:              IOVA address of cmd buffer
+ * @offset:            Offset of cmd buffer
+ * @len:               Length of cmd buffer
+ * @size:              Size of cmd buffer
+ */
+struct cam_ope_buf_entry {
+	uint32_t          fd;
+	uint64_t          memhdl;
+	uint64_t          iova;
+	uint64_t          offset;
+	uint64_t          len;
+	uint64_t          size;
+};
+
+/**
+ * struct cam_ope_bl_entry
+ *
+ * @base:              Base IOVA address of BL
+ * @len:               Length of BL
+ * @arbitration:       Arbitration bit
+ */
+struct cam_ope_bl_entry {
+	uint32_t         base;
+	uint32_t         len;
+	uint32_t         arbitration;
+};
+
+/**
+ * struct cam_ope_output_info
+ *
+ * @iova:              IOVA address of output buffer
+ * @offset:            Offset of buffer
+ * @len:               Length of buffer
+ */
+struct cam_ope_output_info {
+	uint64_t    iova;
+	uint64_t    offset;
+	uint64_t    len;
+};
+
+/**
+ * struct cam_ope_hang_dump
+ *
+ * @num_bls:           count of BLs for request
+ * @num_bufs:          Count of buffer related to request
+ * @num_outputs:       Count of output beffers
+ * @entries:           Buffers info
+ * @bl_entries:        BLs info
+ * @outputs:           Output info
+ */
+struct cam_ope_hang_dump {
+	uint32_t num_bls;
+	uint32_t num_bufs;
+	uint64_t num_outputs;
+	struct cam_ope_buf_entry entries[OPE_MAX_BATCH_SIZE * OPE_MAX_CMD_BUFS];
+	struct cam_ope_bl_entry bl_entries[OPE_MAX_CDM_BLS];
+	struct cam_ope_output_info outputs
+		[OPE_MAX_BATCH_SIZE * OPE_OUT_RES_MAX];
+};
+#endif /* CAM_OPE_HW_MGR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr_intf.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_HW_MGR_INTF_H
+#define CAM_OPE_HW_MGR_INTF_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "cam_ope_hw_mgr.h"
+
+int cam_ope_hw_mgr_init(struct device_node *of_node, uint64_t *hw_mgr_hdl,
+	int *iommu_hdl);
+
+int cam_ope_hw_init(struct cam_ope_hw_intf_data **ope_hw_intf_data,
+	uint32_t hw_idx);
+
+#endif /* CAM_OPE_HW_MGR_INTF_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.c
@@ -0,0 +1,873 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include <media/cam_ope.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "cam_cdm_util.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+#include "ope_bus_rd.h"
+
+static struct ope_bus_rd *bus_rd;
+
+enum cam_ope_bus_unpacker_format {
+	UNPACKER_FMT_PLAIN_128                   = 0x0,
+	UNPACKER_FMT_PLAIN_8                     = 0x1,
+	UNPACKER_FMT_PLAIN_16_10BPP              = 0x2,
+	UNPACKER_FMT_PLAIN_16_12BPP              = 0x3,
+	UNPACKER_FMT_PLAIN_16_14BPP              = 0x4,
+	UNPACKER_FMT_PLAIN_32_20BPP              = 0x5,
+	UNPACKER_FMT_ARGB_16_10BPP               = 0x6,
+	UNPACKER_FMT_ARGB_16_12BPP               = 0x7,
+	UNPACKER_FMT_ARGB_16_14BPP               = 0x8,
+	UNPACKER_FMT_PLAIN_32                    = 0x9,
+	UNPACKER_FMT_PLAIN_64                    = 0xA,
+	UNPACKER_FMT_TP_10                       = 0xB,
+	UNPACKER_FMT_MIPI_8                      = 0xC,
+	UNPACKER_FMT_MIPI_10                     = 0xD,
+	UNPACKER_FMT_MIPI_12                     = 0xE,
+	UNPACKER_FMT_MIPI_14                     = 0xF,
+	UNPACKER_FMT_PLAIN_16_16BPP              = 0x10,
+	UNPACKER_FMT_PLAIN_128_ODD_EVEN          = 0x11,
+	UNPACKER_FMT_PLAIN_8_ODD_EVEN            = 0x12,
+	UNPACKER_FMT_MAX                         = 0x13,
+};
+
+static int cam_ope_bus_rd_in_port_idx(uint32_t input_port_id)
+{
+	int i;
+
+	for (i = 0; i < OPE_IN_RES_MAX; i++)
+		if (bus_rd->in_port_to_rm[i].input_port_id ==
+			input_port_id)
+			return i;
+
+	return -EINVAL;
+}
+
+static int cam_ope_bus_rd_combo_idx(uint32_t format)
+{
+	int rc = -EINVAL;
+
+	switch (format) {
+	case CAM_FORMAT_YUV422:
+	case CAM_FORMAT_NV21:
+	case CAM_FORMAT_NV12:
+		rc = BUS_RD_YUV;
+		break;
+	case CAM_FORMAT_MIPI_RAW_6:
+	case CAM_FORMAT_MIPI_RAW_8:
+	case CAM_FORMAT_MIPI_RAW_10:
+	case CAM_FORMAT_MIPI_RAW_12:
+	case CAM_FORMAT_MIPI_RAW_14:
+	case CAM_FORMAT_MIPI_RAW_16:
+	case CAM_FORMAT_MIPI_RAW_20:
+	case CAM_FORMAT_QTI_RAW_8:
+	case CAM_FORMAT_QTI_RAW_10:
+	case CAM_FORMAT_QTI_RAW_12:
+	case CAM_FORMAT_QTI_RAW_14:
+	case CAM_FORMAT_PLAIN8:
+	case CAM_FORMAT_PLAIN16_8:
+	case CAM_FORMAT_PLAIN16_10:
+	case CAM_FORMAT_PLAIN16_12:
+	case CAM_FORMAT_PLAIN16_14:
+	case CAM_FORMAT_PLAIN16_16:
+	case CAM_FORMAT_PLAIN32_20:
+	case CAM_FORMAT_PLAIN64:
+	case CAM_FORMAT_PLAIN128:
+		rc = BUS_RD_BAYER;
+		break;
+	default:
+		break;
+		}
+
+	CAM_DBG(CAM_OPE, "Input format = %u rc = %d",
+		format, rc);
+	return rc;
+}
+
+static int cam_ope_bus_is_rm_enabled(
+	struct cam_ope_request *ope_request,
+	uint32_t batch_idx,
+	uint32_t rm_id)
+{
+	int i, k;
+	int32_t combo_idx;
+	struct ope_io_buf *io_buf;
+	struct ope_bus_in_port_to_rm *in_port_to_rm;
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ope_request->num_io_bufs[batch_idx]; i++) {
+		io_buf = ope_request->io_buf[batch_idx][i];
+		if (io_buf->direction != CAM_BUF_INPUT)
+			continue;
+		in_port_to_rm =
+			&bus_rd->in_port_to_rm[io_buf->resource_type - 1];
+		combo_idx = cam_ope_bus_rd_combo_idx(io_buf->format);
+		if (combo_idx < 0) {
+			CAM_ERR(CAM_OPE, "Invalid combo_idx");
+			return -EINVAL;
+		}
+		for (k = 0; k < io_buf->num_planes; k++) {
+			if (rm_id ==
+				in_port_to_rm->rm_port_id[combo_idx][k])
+				return true;
+		}
+	}
+
+	return false;
+}
+
+static uint32_t *cam_ope_bus_rd_update(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t *kmd_buf, int batch_idx,
+	int io_idx, struct cam_ope_dev_prepare_req *prepare,
+	int32_t *num_stripes)
+{
+	int k, l, m;
+	uint32_t idx;
+	int32_t combo_idx;
+	uint32_t req_idx, count = 0, temp;
+	uint32_t temp_reg[128] = {0};
+	uint32_t rm_id, header_size;
+	uint32_t rsc_type;
+	struct cam_hw_prepare_update_args *prepare_args;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_request *ope_request;
+	struct ope_io_buf *io_buf;
+	struct ope_stripe_io *stripe_io;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+	struct cam_ope_bus_rd_reg *rd_reg;
+	struct cam_ope_bus_rd_client_reg *rd_reg_client;
+	struct cam_ope_bus_rd_reg_val *rd_reg_val;
+	struct cam_ope_bus_rd_client_reg_val *rd_res_val_client;
+	struct ope_bus_in_port_to_rm *in_port_to_rm;
+	struct ope_bus_rd_io_port_cdm_info *io_port_cdm;
+	struct cam_cdm_utils_ops *cdm_ops;
+	struct ope_bus_rd_io_port_info *io_port_info;
+
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, prepare);
+		return NULL;
+	}
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return NULL;
+	}
+
+	if (io_idx >= OPE_MAX_IO_BUFS) {
+		CAM_ERR(CAM_OPE, "Invalid IO idx: %d", io_idx);
+		return NULL;
+	}
+
+	prepare_args = prepare->prepare_args;
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	ope_request = ctx_data->req_list[req_idx];
+	CAM_DBG(CAM_OPE, "req_idx = %d req_id = %lld KMDbuf %x offset %d",
+		req_idx, ope_request->request_id,
+		kmd_buf, prepare->kmd_buf_offset);
+	bus_rd_ctx = bus_rd->bus_rd_ctx[ctx_id];
+	io_port_info = &bus_rd_ctx->io_port_info;
+	rd_reg = ope_hw_info->bus_rd_reg;
+	rd_reg_val = ope_hw_info->bus_rd_reg_val;
+	io_buf = ope_request->io_buf[batch_idx][io_idx];
+
+	CAM_DBG(CAM_OPE,
+		"req_idx = %d req_id = %lld KMDbuf 0x%x offset %d rsc %d",
+		req_idx, ope_request->request_id,
+		kmd_buf, prepare->kmd_buf_offset,
+		io_buf->resource_type);
+	CAM_DBG(CAM_OPE, "batch:%d iobuf:%d direction:%d",
+		batch_idx, io_idx, io_buf->direction);
+	io_port_cdm =
+	&bus_rd_ctx->io_port_cdm_batch.io_port_cdm[batch_idx];
+	in_port_to_rm =
+	&bus_rd->in_port_to_rm[io_buf->resource_type - 1];
+	combo_idx = cam_ope_bus_rd_combo_idx(io_buf->format);
+	if (combo_idx < 0) {
+		CAM_ERR(CAM_OPE, "Invalid combo_idx");
+		return NULL;
+	}
+
+	for (k = 0; k < io_buf->num_planes; k++) {
+		for (l = 0; l < io_buf->num_stripes[k]; l++) {
+			*num_stripes = io_buf->num_stripes[k];
+			stripe_io = &io_buf->s_io[k][l];
+			rsc_type = io_buf->resource_type - 1;
+			/* frame level info */
+			/* stripe level info */
+			rm_id = in_port_to_rm->rm_port_id[combo_idx][k];
+			rd_reg_client = &rd_reg->rd_clients[rm_id];
+			rd_res_val_client = &rd_reg_val->rd_clients[rm_id];
+
+			/* security cfg */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg->security_cfg;
+			temp_reg[count++] =
+				ctx_data->ope_acquire.secure_mode;
+
+			/* enable client */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->core_cfg;
+			temp_reg[count++] = 1;
+
+			/* ccif meta data */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->ccif_meta_data;
+			temp = 0;
+			temp |= stripe_io->s_location &
+				rd_res_val_client->stripe_location_mask;
+			temp |= (io_buf->pix_pattern &
+				rd_res_val_client->pix_pattern_mask) <<
+				rd_res_val_client->pix_pattern_shift;
+			temp_reg[count++] = temp;
+
+			/* Address of the Image */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->img_addr;
+			temp_reg[count++] = stripe_io->iova_addr;
+
+			/* Buffer size */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->img_cfg;
+			temp = 0;
+			temp = stripe_io->height;
+			temp |=
+			(stripe_io->width &
+				rd_res_val_client->img_width_mask) <<
+				rd_res_val_client->img_width_shift;
+			temp_reg[count++] = temp;
+
+			/* stride */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->stride;
+			temp_reg[count++] = stripe_io->stride;
+
+			/*
+			 * In case of NV12, change the unpacker format of
+			 * chroma plane to odd even byte swapped format.
+			 */
+			if (k == 1 && stripe_io->format == CAM_FORMAT_NV12)
+				stripe_io->unpack_format =
+					UNPACKER_FMT_PLAIN_8_ODD_EVEN;
+
+			/* Unpack cfg : Mode and alignment */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->unpack_cfg;
+			temp = 0;
+			temp |= (stripe_io->unpack_format &
+				rd_res_val_client->mode_mask) <<
+				rd_res_val_client->mode_shift;
+			temp |= (stripe_io->alignment &
+				rd_res_val_client->alignment_mask) <<
+				rd_res_val_client->alignment_shift;
+			temp_reg[count++] = temp;
+
+			/* latency buffer allocation */
+			temp_reg[count++] = rd_reg->offset +
+				rd_reg_client->latency_buf_allocation;
+			temp_reg[count++] = io_port_info->latency_buf_size;
+
+			header_size = cdm_ops->cdm_get_cmd_header_size(
+				CAM_CDM_CMD_REG_RANDOM);
+			idx = io_port_cdm->num_s_cmd_bufs[l];
+			io_port_cdm->s_cdm_info[l][idx].len = sizeof(temp) *
+				(count + header_size);
+			io_port_cdm->s_cdm_info[l][idx].offset =
+				prepare->kmd_buf_offset;
+			io_port_cdm->s_cdm_info[l][idx].addr = kmd_buf;
+			io_port_cdm->num_s_cmd_bufs[l]++;
+
+			kmd_buf = cdm_ops->cdm_write_regrandom(
+				kmd_buf, count/2, temp_reg);
+			prepare->kmd_buf_offset += ((count + header_size) *
+				sizeof(temp));
+			CAM_DBG(CAM_OPE, "b:%d io:%d p:%d s:%d",
+				batch_idx, io_idx, k, l);
+			for (m = 0; m < count; m += 2)
+				CAM_DBG(CAM_OPE, "%d: off: 0x%x val: 0x%x",
+					m, temp_reg[m], temp_reg[m+1]);
+			CAM_DBG(CAM_OPE, "kmd_buf:%x offset:%d",
+				kmd_buf, prepare->kmd_buf_offset);
+			CAM_DBG(CAM_OPE, "RD cmdbufs:%d off:%d len %d",
+				io_port_cdm->num_s_cmd_bufs[l],
+				io_port_cdm->s_cdm_info[l][idx].offset,
+				io_port_cdm->s_cdm_info[l][idx].len);
+			count = 0;
+		}
+	}
+
+	return kmd_buf;
+}
+
+static uint32_t *cam_ope_bus_rm_disable(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, struct cam_ope_dev_prepare_req *prepare,
+	int batch_idx, int rm_idx,
+	uint32_t *kmd_buf, uint32_t num_stripes)
+{
+	int l;
+	uint32_t idx;
+	uint32_t req_idx;
+	uint32_t temp_reg[128];
+	uint32_t count = 0;
+	uint32_t temp = 0;
+	uint32_t header_size;
+	struct cam_ope_ctx *ctx_data;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+	struct cam_ope_bus_rd_reg *rd_reg;
+	struct cam_ope_bus_rd_client_reg *rd_reg_client;
+	struct ope_bus_rd_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_rd_io_port_cdm_info *io_port_cdm;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, prepare);
+		return NULL;
+	}
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return NULL;
+	}
+
+	if (rm_idx >= MAX_RD_CLIENTS) {
+		CAM_ERR(CAM_OPE, "Invalid read client: %d", rm_idx);
+		return NULL;
+	}
+
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	bus_rd_ctx = bus_rd->bus_rd_ctx[ctx_id];
+	io_port_cdm_batch = &bus_rd_ctx->io_port_cdm_batch;
+	rd_reg = ope_hw_info->bus_rd_reg;
+
+	CAM_DBG(CAM_OPE,
+		"kmd_buf = 0x%x req_idx = %d offset = %d rd_idx %d b %d",
+		kmd_buf, req_idx, prepare->kmd_buf_offset, rm_idx, batch_idx);
+
+	io_port_cdm =
+		&bus_rd_ctx->io_port_cdm_batch.io_port_cdm[batch_idx];
+
+	for (l = 0; l < num_stripes; l++) {
+		/* stripe level info */
+		rd_reg_client = &rd_reg->rd_clients[rm_idx];
+
+		/* Core cfg: enable, Mode */
+		temp_reg[count++] = rd_reg->offset +
+			rd_reg_client->core_cfg;
+		temp_reg[count++] = 0;
+
+		header_size = cdm_ops->cdm_get_cmd_header_size(
+			CAM_CDM_CMD_REG_RANDOM);
+		idx = io_port_cdm->num_s_cmd_bufs[l];
+		io_port_cdm->s_cdm_info[l][idx].len =
+			sizeof(temp) * (count + header_size);
+		io_port_cdm->s_cdm_info[l][idx].offset =
+			prepare->kmd_buf_offset;
+		io_port_cdm->s_cdm_info[l][idx].addr = kmd_buf;
+		io_port_cdm->num_s_cmd_bufs[l]++;
+
+		kmd_buf = cdm_ops->cdm_write_regrandom(
+			kmd_buf, count/2, temp_reg);
+		prepare->kmd_buf_offset += ((count + header_size) *
+			sizeof(temp));
+
+		CAM_DBG(CAM_OPE, "RD cmd bufs = %d",
+			io_port_cdm->num_s_cmd_bufs[l]);
+		CAM_DBG(CAM_OPE, "stripe %d off:%d len:%d",
+			l, io_port_cdm->s_cdm_info[l][idx].offset,
+			io_port_cdm->s_cdm_info[l][idx].len);
+		count = 0;
+	}
+
+	prepare->rd_cdm_batch = &bus_rd_ctx->io_port_cdm_batch;
+
+	return kmd_buf;
+}
+
+static int cam_ope_bus_rd_prepare(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	int i, j;
+	int32_t combo_idx;
+	uint32_t req_idx, count = 0, temp;
+	uint32_t temp_reg[32] = {0};
+	uint32_t header_size;
+	uint32_t *kmd_buf;
+	int is_rm_enabled;
+	struct cam_ope_dev_prepare_req *prepare;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_request *ope_request;
+	struct ope_io_buf *io_buf;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+	struct cam_ope_bus_rd_reg *rd_reg;
+	struct cam_ope_bus_rd_reg_val *rd_reg_val;
+	struct ope_bus_rd_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_rd_io_port_cdm_info *io_port_cdm = NULL;
+	struct cam_cdm_utils_ops *cdm_ops;
+	int32_t num_stripes = 0;
+
+	if (ctx_id < 0 || !data) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+	prepare = data;
+
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		prepare->kmd_buf_offset;
+	CAM_DBG(CAM_OPE, "req_idx = %d req_id = %lld",
+		req_idx, ope_request->request_id);
+	CAM_DBG(CAM_OPE, "KMD buf and offset = %x %d",
+		kmd_buf, prepare->kmd_buf_offset);
+	bus_rd_ctx = bus_rd->bus_rd_ctx[ctx_id];
+	io_port_cdm_batch =
+		&bus_rd_ctx->io_port_cdm_batch;
+	memset(io_port_cdm_batch, 0,
+		sizeof(struct ope_bus_rd_io_port_cdm_batch));
+	rd_reg = ope_hw_info->bus_rd_reg;
+	rd_reg_val = ope_hw_info->bus_rd_reg_val;
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = 0; j < ope_request->num_io_bufs[i]; j++) {
+			io_buf = ope_request->io_buf[i][j];
+			if (io_buf->direction != CAM_BUF_INPUT)
+				continue;
+
+			CAM_DBG(CAM_OPE, "batch:%d iobuf:%d direction:%d",
+				i, j, io_buf->direction);
+			io_port_cdm =
+			&bus_rd_ctx->io_port_cdm_batch.io_port_cdm[i];
+
+			combo_idx = cam_ope_bus_rd_combo_idx(io_buf->format);
+			if (combo_idx < 0) {
+				CAM_ERR(CAM_OPE, "Invalid combo_idx");
+				return combo_idx;
+			}
+
+			kmd_buf = cam_ope_bus_rd_update(ope_hw_info,
+				ctx_id, kmd_buf, i, j, prepare,
+				&num_stripes);
+			if (!kmd_buf) {
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+	}
+
+	if (!io_port_cdm) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Disable RMs which are not enabled */
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = 0; j < rd_reg_val->num_clients; j++) {
+			is_rm_enabled = cam_ope_bus_is_rm_enabled(
+				ope_request, i, j);
+			if (is_rm_enabled < 0) {
+				rc = -EINVAL;
+				goto end;
+			}
+			if (is_rm_enabled)
+				continue;
+
+			kmd_buf = cam_ope_bus_rm_disable(ope_hw_info,
+				ctx_id, prepare, i, j,
+				kmd_buf, num_stripes);
+			if (!kmd_buf) {
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+	}
+
+	/* Go command */
+	count = 0;
+	temp_reg[count++] = rd_reg->offset +
+		rd_reg->input_if_cmd;
+	temp = 0;
+	temp |= rd_reg_val->go_cmd;
+	temp_reg[count++] = temp;
+
+	header_size =
+	cdm_ops->cdm_get_cmd_header_size(CAM_CDM_CMD_REG_RANDOM);
+	for (i = 0; i < ope_request->num_batch; i++) {
+		io_port_cdm =
+			&bus_rd_ctx->io_port_cdm_batch.io_port_cdm[i];
+		io_port_cdm->go_cmd_addr = kmd_buf;
+		io_port_cdm->go_cmd_len =
+			sizeof(temp) * (count + header_size);
+		io_port_cdm->go_cmd_offset =
+			prepare->kmd_buf_offset;
+	}
+	kmd_buf = cdm_ops->cdm_write_regrandom(
+		kmd_buf, count/2, temp_reg);
+	prepare->kmd_buf_offset +=
+		((count + header_size) * sizeof(temp));
+	CAM_DBG(CAM_OPE, "kmd_buf:%x,offset:%d",
+		kmd_buf, prepare->kmd_buf_offset);
+	CAM_DBG(CAM_OPE, "t_reg:%xcount: %d size:%d",
+		 temp_reg, count, header_size);
+	prepare->rd_cdm_batch = &bus_rd_ctx->io_port_cdm_batch;
+
+end:
+	return rc;
+}
+
+static int cam_ope_bus_rd_release(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (ctx_id < 0 || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	vfree(bus_rd->bus_rd_ctx[ctx_id]);
+	bus_rd->bus_rd_ctx[ctx_id] = NULL;
+
+	return rc;
+}
+
+static int cam_ope_bus_rd_acquire(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i;
+	struct ope_acquire_dev_info *in_acquire;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+	struct ope_bus_in_port_to_rm *in_port_to_rm;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+	int combo_idx;
+	int in_port_idx;
+
+
+	if (ctx_id < 0 || !data || !ope_hw_info || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x %x",
+			ctx_id, data, ope_hw_info);
+		return -EINVAL;
+	}
+
+	bus_rd->bus_rd_ctx[ctx_id] = vzalloc(sizeof(struct ope_bus_rd_ctx));
+	if (!bus_rd->bus_rd_ctx[ctx_id]) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		return -ENOMEM;
+	}
+
+	bus_rd->bus_rd_ctx[ctx_id]->ope_acquire = data;
+	in_acquire = data;
+	bus_rd_ctx = bus_rd->bus_rd_ctx[ctx_id];
+	bus_rd_ctx->num_in_ports = in_acquire->num_in_res;
+	bus_rd_ctx->security_flag = in_acquire->secure_mode;
+	bus_rd_reg_val = ope_hw_info->bus_rd_reg_val;
+
+	for (i = 0; i < in_acquire->num_in_res; i++) {
+		if (!in_acquire->in_res[i].width)
+			continue;
+
+		CAM_DBG(CAM_OPE, "i = %d format = %u width = %x height = %x",
+			i, in_acquire->in_res[i].format,
+			in_acquire->in_res[i].width,
+			in_acquire->in_res[i].height);
+		CAM_DBG(CAM_OPE, "pix_pattern:%u alignment:%u unpack_format:%u",
+			in_acquire->in_res[i].pixel_pattern,
+			in_acquire->in_res[i].alignment,
+			in_acquire->in_res[i].unpacker_format);
+		CAM_DBG(CAM_OPE, "max_stripe = %u fps = %u",
+			in_acquire->in_res[i].max_stripe_size,
+			in_acquire->in_res[i].fps);
+
+		in_port_idx = cam_ope_bus_rd_in_port_idx(i + 1);
+		if (in_port_idx < 0) {
+			CAM_ERR(CAM_OPE, "Invalid in_port_idx: %d", i + 1);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		in_port_to_rm = &bus_rd->in_port_to_rm[in_port_idx];
+		combo_idx = cam_ope_bus_rd_combo_idx(
+			in_acquire->in_res[i].format);
+		if (combo_idx < 0) {
+			CAM_ERR(CAM_OPE, "Invalid format: %d",
+				in_acquire->in_res[i].format);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (!in_port_to_rm->num_rm[combo_idx]) {
+			CAM_ERR(CAM_OPE, "Invalid format for Input port");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		bus_rd_ctx->io_port_info.input_port_id[i] =
+			in_acquire->in_res[i].res_id;
+		bus_rd_ctx->io_port_info.input_format_type[i] =
+			in_acquire->in_res[i].format;
+		if (in_acquire->in_res[i].pixel_pattern >
+			PIXEL_PATTERN_CRYCBY) {
+			CAM_ERR(CAM_OPE, "Invalid pix pattern = %u",
+				in_acquire->in_res[i].pixel_pattern);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		bus_rd_ctx->io_port_info.pixel_pattern[i] =
+			in_acquire->in_res[i].pixel_pattern;
+		bus_rd_ctx->io_port_info.latency_buf_size =
+			bus_rd_reg_val->latency_buf_size;
+
+		CAM_DBG(CAM_OPE, "i:%d port_id = %u format %u pix_pattern = %u",
+			i, bus_rd_ctx->io_port_info.input_port_id[i],
+			bus_rd_ctx->io_port_info.input_format_type[i],
+			bus_rd_ctx->io_port_info.pixel_pattern[i]);
+		CAM_DBG(CAM_OPE, "latency_buf_size = %u",
+			bus_rd_ctx->io_port_info.latency_buf_size);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ope_bus_rd_init(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+	struct cam_ope_bus_rd_reg *bus_rd_reg;
+	struct cam_ope_dev_init *dev_init = data;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	bus_rd_reg_val = ope_hw_info->bus_rd_reg_val;
+	bus_rd_reg = ope_hw_info->bus_rd_reg;
+	bus_rd_reg->base = dev_init->core_info->ope_hw_info->ope_bus_rd_base;
+
+	/* OPE SW RESET */
+	init_completion(&bus_rd->reset_complete);
+
+	/* enable interrupt mask */
+	cam_io_w_mb(bus_rd_reg_val->irq_mask,
+		ope_hw_info->bus_rd_reg->base + bus_rd_reg->irq_mask);
+
+	cam_io_w_mb(bus_rd_reg_val->sw_reset,
+		ope_hw_info->bus_rd_reg->base + bus_rd_reg->sw_reset);
+
+	rc = wait_for_completion_timeout(
+		&bus_rd->reset_complete, msecs_to_jiffies(30000));
+
+	if (!rc || rc < 0) {
+		CAM_ERR(CAM_OPE, "reset error result = %d", rc);
+		if (!rc)
+			rc = -ETIMEDOUT;
+	} else {
+		rc = 0;
+	}
+
+	cam_io_w_mb(bus_rd_reg_val->irq_mask,
+		ope_hw_info->bus_rd_reg->base + bus_rd_reg->irq_mask);
+
+	return rc;
+}
+
+static int cam_ope_bus_rd_probe(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i, j, combo_idx, k;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+	struct cam_ope_bus_rd_reg *bus_rd_reg;
+	struct ope_bus_in_port_to_rm *in_port_to_rm;
+	uint32_t input_port_idx;
+	uint32_t rm_idx;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+	bus_rd = kzalloc(sizeof(struct ope_bus_rd), GFP_KERNEL);
+	if (!bus_rd) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		return -ENOMEM;
+	}
+	bus_rd->ope_hw_info = ope_hw_info;
+	bus_rd_reg_val = ope_hw_info->bus_rd_reg_val;
+	bus_rd_reg = ope_hw_info->bus_rd_reg;
+
+	for (i = 0; i < bus_rd_reg_val->num_clients; i++) {
+		input_port_idx =
+			bus_rd_reg_val->rd_clients[i].input_port_id - 1;
+		in_port_to_rm = &bus_rd->in_port_to_rm[input_port_idx];
+		if (bus_rd_reg_val->rd_clients[i].format_type &
+			BUS_RD_COMBO_BAYER_MASK) {
+			combo_idx = BUS_RD_BAYER;
+			rm_idx = in_port_to_rm->num_rm[combo_idx];
+			in_port_to_rm->input_port_id =
+				bus_rd_reg_val->rd_clients[i].input_port_id;
+			in_port_to_rm->rm_port_id[combo_idx][rm_idx] =
+				bus_rd_reg_val->rd_clients[i].rm_port_id;
+			if (!in_port_to_rm->num_rm[combo_idx])
+				in_port_to_rm->num_combos++;
+			in_port_to_rm->num_rm[combo_idx]++;
+		}
+		if (bus_rd_reg_val->rd_clients[i].format_type &
+			BUS_RD_COMBO_YUV_MASK) {
+			combo_idx = BUS_RD_YUV;
+			rm_idx = in_port_to_rm->num_rm[combo_idx];
+			in_port_to_rm->input_port_id =
+				bus_rd_reg_val->rd_clients[i].input_port_id;
+			in_port_to_rm->rm_port_id[combo_idx][rm_idx] =
+				bus_rd_reg_val->rd_clients[i].rm_port_id;
+			if (!in_port_to_rm->num_rm[combo_idx])
+				in_port_to_rm->num_combos++;
+			in_port_to_rm->num_rm[combo_idx]++;
+		}
+	}
+
+	for (i = 0; i < OPE_IN_RES_MAX; i++) {
+		in_port_to_rm = &bus_rd->in_port_to_rm[i];
+		CAM_DBG(CAM_OPE, "input port id = %d num_combos = %d",
+			in_port_to_rm->input_port_id,
+			in_port_to_rm->num_combos);
+		for (j = 0; j < in_port_to_rm->num_combos; j++) {
+			CAM_DBG(CAM_OPE, "combo idx = %d num_rms = %d",
+				j, in_port_to_rm->num_rm[j]);
+			for (k = 0; k < in_port_to_rm->num_rm[j]; k++) {
+				CAM_DBG(CAM_OPE, "rm port id = %d",
+					in_port_to_rm->rm_port_id[j][k]);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ope_bus_rd_isr(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	uint32_t irq_status;
+	struct cam_ope_bus_rd_reg *bus_rd_reg;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+	struct cam_ope_irq_data *irq_data = data;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	bus_rd_reg = ope_hw_info->bus_rd_reg;
+	bus_rd_reg_val = ope_hw_info->bus_rd_reg_val;
+
+	/* Read and Clear Top Interrupt status */
+	irq_status = cam_io_r_mb(bus_rd_reg->base + bus_rd_reg->irq_status);
+	cam_io_w_mb(irq_status,
+		bus_rd_reg->base + bus_rd_reg->irq_clear);
+
+	cam_io_w_mb(bus_rd_reg_val->irq_set_clear,
+		bus_rd_reg->base + bus_rd_reg->irq_cmd);
+
+	if (irq_status & bus_rd_reg_val->rst_done) {
+		complete(&bus_rd->reset_complete);
+		CAM_DBG(CAM_OPE, "ope bus rd reset done");
+	}
+
+	if ((irq_status & bus_rd_reg_val->violation) ==
+		bus_rd_reg_val->violation) {
+		irq_data->error = 1;
+		CAM_ERR(CAM_OPE, "ope bus rd CCIF vioalation");
+	}
+
+	return rc;
+}
+
+int cam_ope_bus_rd_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data)
+{
+	int rc = -EINVAL;
+
+	switch (cmd_id) {
+	case OPE_HW_PROBE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: E");
+		rc = cam_ope_bus_rd_probe(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: X");
+		break;
+	case OPE_HW_INIT:
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: E");
+		rc = cam_ope_bus_rd_init(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: X");
+		break;
+	case OPE_HW_ACQUIRE:
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: E");
+		rc = cam_ope_bus_rd_acquire(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: X");
+		break;
+	case OPE_HW_RELEASE:
+		CAM_DBG(CAM_OPE, "OPE_HW_RELEASE: E");
+		rc = cam_ope_bus_rd_release(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_RELEASE: X");
+		break;
+	case OPE_HW_PREPARE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PREPARE: E");
+		rc = cam_ope_bus_rd_prepare(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PREPARE: X");
+		break;
+	case OPE_HW_ISR:
+		rc = cam_ope_bus_rd_isr(ope_hw_info, 0, data);
+		break;
+	case OPE_HW_DEINIT:
+	case OPE_HW_START:
+	case OPE_HW_STOP:
+	case OPE_HW_FLUSH:
+	case OPE_HW_CLK_UPDATE:
+	case OPE_HW_BW_UPDATE:
+	case OPE_HW_RESET:
+	case OPE_HW_SET_IRQ_CB:
+		rc = 0;
+		CAM_DBG(CAM_OPE, "Unhandled cmds: %d", cmd_id);
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Unsupported cmd: %d", cmd_id);
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_rd/ope_bus_rd.h
@@ -0,0 +1,138 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef OPE_BUS_RD_H
+#define OPE_BUS_RD_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "ope_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_soc_util.h"
+#include "cam_context.h"
+#include "cam_ope_context.h"
+#include "cam_ope_hw_mgr.h"
+
+/**
+ * struct ope_bus_rd_cdm_info
+ *
+ * @offset: Offset
+ * @addr:   Address
+ * @len:    Length
+ */
+struct ope_bus_rd_cdm_info {
+	uint32_t offset;
+	uint32_t *addr;
+	uint32_t len;
+};
+
+/**
+ * struct ope_bus_rd_io_port_cdm_info
+ *
+ * @num_frames_cmds: Number of frame commands
+ * @f_cdm_info:      Frame cdm info
+ * @num_stripes:     Number of stripes
+ * @num_s_cmd_bufs:  Number of stripe commands
+ * @s_cdm_info:      Stripe cdm info
+ * @go_cmd_addr:     GO command address
+ * @go_cmd_len:      GO command length
+ */
+struct ope_bus_rd_io_port_cdm_info {
+	uint32_t num_frames_cmds;
+	struct ope_bus_rd_cdm_info f_cdm_info[MAX_RD_CLIENTS];
+	uint32_t num_stripes;
+	uint32_t num_s_cmd_bufs[OPE_MAX_STRIPES];
+	struct ope_bus_rd_cdm_info s_cdm_info[OPE_MAX_STRIPES][MAX_RD_CLIENTS];
+	uint32_t go_cmd_offset;
+	uint32_t *go_cmd_addr;
+	uint32_t go_cmd_len;
+};
+
+/**
+ * struct ope_bus_rd_io_port_cdm_batch
+ *
+ * num_batch:   Number of batches
+ * io_port_cdm: CDM IO Port Info
+ */
+struct ope_bus_rd_io_port_cdm_batch {
+	uint32_t num_batch;
+	struct ope_bus_rd_io_port_cdm_info io_port_cdm[OPE_MAX_BATCH_SIZE];
+};
+
+/**
+ * struct ope_bus_rd_rm
+ *
+ * @rm_port_id:  RM port ID
+ * @format_type: Format type
+ */
+struct ope_bus_rd_rm {
+	uint32_t rm_port_id;
+	uint32_t format_type;
+};
+
+/**
+ * struct ope_bus_in_port_to_rm
+ *
+ * @input_port_id:  Intput port ID
+ * @num_combos:     Number of combos
+ * @num_rm:         Number of RMs
+ * @rm_port_id:     RM port Id
+ */
+struct ope_bus_in_port_to_rm {
+	uint32_t input_port_id;
+	uint32_t num_combos;
+	uint32_t num_rm[BUS_RD_COMBO_MAX];
+	uint32_t rm_port_id[BUS_RD_COMBO_MAX][MAX_RD_CLIENTS];
+};
+
+/**
+ * struct ope_bus_rd_io_port_info
+ *
+ * @pixel_pattern:      Pixel pattern
+ * @input_port_id:      Port Id
+ * @input_format_type:  Format type
+ * @latency_buf_size:   Latency buffer size
+ */
+struct ope_bus_rd_io_port_info {
+	uint32_t pixel_pattern[OPE_IN_RES_MAX];
+	uint32_t input_port_id[OPE_IN_RES_MAX];
+	uint32_t input_format_type[OPE_IN_RES_MAX];
+	uint32_t latency_buf_size;
+};
+
+/**
+ * struct ope_bus_rd_ctx
+ *
+ * @ope_acquire:       OPE acquire structure
+ * @security_flag:     security flag
+ * @num_in_ports:      Number of in ports
+ * @io_port_info:      IO port info
+ * @io_port_cdm_batch: IO port cdm info
+ */
+struct ope_bus_rd_ctx {
+	struct ope_acquire_dev_info *ope_acquire;
+	bool security_flag;
+	uint32_t num_in_ports;
+	struct ope_bus_rd_io_port_info io_port_info;
+	struct ope_bus_rd_io_port_cdm_batch io_port_cdm_batch;
+};
+
+/**
+ * struct ope_bus_rd
+ *
+ * @ope_hw_info:    OPE hardware info
+ * @in_port_to_rm:  IO port to RM mapping
+ * @bus_rd_ctx:     RM context
+ */
+struct ope_bus_rd {
+	struct ope_hw *ope_hw_info;
+	struct ope_bus_in_port_to_rm in_port_to_rm[OPE_IN_RES_MAX];
+	struct ope_bus_rd_ctx *bus_rd_ctx[OPE_CTX_MAX];
+	struct completion reset_complete;
+};
+#endif /* OPE_BUS_RD_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.c
@@ -0,0 +1,802 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include <media/cam_ope.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+#include "ope_bus_wr.h"
+#include "cam_cdm_util.h"
+
+static struct ope_bus_wr *wr_info;
+
+enum cam_ope_bus_packer_format {
+	PACKER_FMT_PLAIN_128                   = 0x0,
+	PACKER_FMT_PLAIN_8                     = 0x1,
+	PACKER_FMT_PLAIN_8_ODD_EVEN            = 0x2,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10          = 0x3,
+	PACKER_FMT_PLAIN_8_LSB_MSB_10_ODD_EVEN = 0x4,
+	PACKER_FMT_PLAIN_16_10BPP              = 0x5,
+	PACKER_FMT_PLAIN_16_12BPP              = 0x6,
+	PACKER_FMT_PLAIN_16_14BPP              = 0x7,
+	PACKER_FMT_PLAIN_16_16BPP              = 0x8,
+	PACKER_FMT_PLAIN_32                    = 0x9,
+	PACKER_FMT_PLAIN_64                    = 0xA,
+	PACKER_FMT_TP_10                       = 0xB,
+	PACKER_FMT_MIPI_10                     = 0xC,
+	PACKER_FMT_MIPI_12                     = 0xD,
+	PACKER_FMT_MAX                         = 0xE,
+};
+
+static int cam_ope_bus_en_port_idx(
+	struct cam_ope_request *ope_request,
+	uint32_t batch_idx,
+	uint32_t output_port_id)
+{
+	int i;
+	struct ope_io_buf *io_buf;
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ope_request->num_io_bufs[batch_idx]; i++) {
+		io_buf = ope_request->io_buf[batch_idx][i];
+		if (io_buf->direction != CAM_BUF_OUTPUT)
+			continue;
+		if (io_buf->resource_type == output_port_id)
+			return i;
+	}
+
+	return -EINVAL;
+}
+static int cam_ope_bus_wr_out_port_idx(uint32_t output_port_id)
+{
+	int i;
+
+	for (i = 0; i < OPE_OUT_RES_MAX; i++)
+		if (wr_info->out_port_to_wm[i].output_port_id == output_port_id)
+			return i;
+
+	return -EINVAL;
+}
+
+
+static int cam_ope_bus_wr_subsample(
+	struct cam_ope_ctx *ctx_data,
+	struct ope_hw *ope_hw_info,
+	struct cam_ope_bus_wr_client_reg *wr_reg_client,
+	struct ope_io_buf *io_buf,
+	uint32_t *temp_reg, uint32_t count,
+	int plane_idx, int stripe_idx)
+{
+	int k, l;
+	struct cam_ope_bus_wr_reg *wr_reg;
+	struct cam_ope_bus_wr_reg_val *wr_reg_val;
+
+	wr_reg = ope_hw_info->bus_wr_reg;
+	wr_reg_val = ope_hw_info->bus_wr_reg_val;
+
+	if (plane_idx >= OPE_MAX_PLANES) {
+		CAM_ERR(CAM_OPE, "Invalid plane idx: %d", plane_idx);
+		return count;
+	}
+	k = plane_idx;
+	l = stripe_idx;
+
+	/* subsample period and pattern */
+	if ((ctx_data->ope_acquire.dev_type ==
+		OPE_DEV_TYPE_OPE_RT) && l == 0) {
+		temp_reg[count++] = wr_reg->offset +
+			wr_reg_client->subsample_period;
+		temp_reg[count++] = io_buf->num_stripes[k];
+
+		temp_reg[count++] = wr_reg->offset +
+			wr_reg_client->subsample_pattern;
+		temp_reg[count++] = 1 <<
+			(io_buf->num_stripes[k] - 1);
+	} else if ((ctx_data->ope_acquire.dev_type ==
+		OPE_DEV_TYPE_OPE_NRT) &&
+		((l %
+		ctx_data->ope_acquire.nrt_stripes_for_arb) ==
+		0)) {
+		if (io_buf->num_stripes[k] >=
+			(l +
+			ctx_data->ope_acquire.nrt_stripes_for_arb)){
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->subsample_period;
+			temp_reg[count++] =
+				ctx_data->ope_acquire.nrt_stripes_for_arb;
+
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->subsample_pattern;
+			temp_reg[count++] = 1 <<
+				(ctx_data->ope_acquire.nrt_stripes_for_arb -
+				1);
+		} else {
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->subsample_period;
+			temp_reg[count++] = io_buf->num_stripes[k] - l;
+
+			/* subsample pattern */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->subsample_pattern;
+			temp_reg[count++] = 1 << (io_buf->num_stripes[k] -
+				l - 1);
+		}
+	}
+	return count;
+}
+
+static int cam_ope_bus_wr_release(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (ctx_id < 0 || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	vfree(wr_info->bus_wr_ctx[ctx_id]);
+	wr_info->bus_wr_ctx[ctx_id] = NULL;
+
+	return rc;
+}
+
+static uint32_t *cam_ope_bus_wr_update(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, struct cam_ope_dev_prepare_req *prepare,
+	int batch_idx, int io_idx,
+	uint32_t *kmd_buf, uint32_t *num_stripes)
+{
+	int k, l, m, out_port_idx;
+	uint32_t idx;
+	uint32_t num_wm_ports;
+	uint32_t comb_idx;
+	uint32_t req_idx;
+	uint32_t temp_reg[128];
+	uint32_t count = 0;
+	uint32_t temp = 0;
+	uint32_t wm_port_id;
+	uint32_t header_size;
+	struct cam_hw_prepare_update_args *prepare_args;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_request *ope_request;
+	struct ope_io_buf *io_buf;
+	struct ope_stripe_io *stripe_io;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct cam_ope_bus_wr_reg *wr_reg;
+	struct cam_ope_bus_wr_client_reg *wr_reg_client;
+	struct cam_ope_bus_wr_reg_val *wr_reg_val;
+	struct cam_ope_bus_wr_client_reg_val *wr_res_val_client;
+	struct ope_bus_out_port_to_wm *out_port_to_wm;
+	struct ope_bus_wr_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_wr_io_port_cdm_info *io_port_cdm;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, prepare);
+		return NULL;
+	}
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return NULL;
+	}
+
+	if (io_idx >= OPE_MAX_IO_BUFS) {
+		CAM_ERR(CAM_OPE, "Invalid IO idx: %d", io_idx);
+		return NULL;
+	}
+
+	prepare_args = prepare->prepare_args;
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	ope_request = ctx_data->req_list[req_idx];
+	bus_wr_ctx = wr_info->bus_wr_ctx[ctx_id];
+	io_port_cdm_batch = &bus_wr_ctx->io_port_cdm_batch;
+	wr_reg = ope_hw_info->bus_wr_reg;
+	wr_reg_val = ope_hw_info->bus_wr_reg_val;
+
+	CAM_DBG(CAM_OPE, "kmd_buf = %x req_idx = %d req_id = %lld offset = %d",
+		kmd_buf, req_idx, ope_request->request_id,
+		prepare->kmd_buf_offset);
+
+	io_buf = ope_request->io_buf[batch_idx][io_idx];
+	CAM_DBG(CAM_OPE, "batch = %d io buf num = %d dir = %d rsc %d",
+		batch_idx, io_idx, io_buf->direction, io_buf->resource_type);
+
+	io_port_cdm =
+		&bus_wr_ctx->io_port_cdm_batch.io_port_cdm[batch_idx];
+	out_port_idx =
+		cam_ope_bus_wr_out_port_idx(io_buf->resource_type);
+	if (out_port_idx < 0) {
+		CAM_ERR(CAM_OPE, "Invalid idx for rsc type: %d",
+			io_buf->resource_type);
+		return NULL;
+	}
+	out_port_to_wm = &wr_info->out_port_to_wm[out_port_idx];
+	comb_idx = BUS_WR_YUV;
+	num_wm_ports = out_port_to_wm->num_wm[comb_idx];
+
+	for (k = 0; k < io_buf->num_planes; k++) {
+		*num_stripes = io_buf->num_stripes[k];
+		for (l = 0; l < io_buf->num_stripes[k]; l++) {
+			stripe_io = &io_buf->s_io[k][l];
+			CAM_DBG(CAM_OPE, "comb_idx = %d p_idx = %d s_idx = %d",
+				comb_idx, k, l);
+			/* frame level info */
+			/* stripe level info */
+			wm_port_id = out_port_to_wm->wm_port_id[comb_idx][k];
+			wr_reg_client = &wr_reg->wr_clients[wm_port_id];
+			wr_res_val_client = &wr_reg_val->wr_clients[wm_port_id];
+
+			/* Core cfg: enable, Mode */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->core_cfg;
+			temp = 0;
+			if (!stripe_io->disable_bus)
+				temp = wr_res_val_client->core_cfg_en;
+			temp |= ((wr_res_val_client->mode &
+				wr_res_val_client->mode_mask) <<
+				wr_res_val_client->mode_shift);
+			temp_reg[count++] = temp;
+
+			/* Address of the Image */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->img_addr;
+			temp_reg[count++] = stripe_io->iova_addr;
+
+			/* Buffer size */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->img_cfg;
+			temp = 0;
+			temp = stripe_io->width;
+			temp |= (stripe_io->height &
+				wr_res_val_client->height_mask) <<
+				wr_res_val_client->height_shift;
+			temp_reg[count++] = temp;
+
+			/* x_init */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->x_init;
+			temp_reg[count++] = stripe_io->x_init;
+
+			/* stride */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->stride;
+			temp_reg[count++] = stripe_io->stride;
+
+			/* pack cfg : Format and alignment */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->pack_cfg;
+			temp = 0;
+
+			/*
+			 * In case of NV12, change the packer format of chroma
+			 * plane to odd even byte swapped format
+			 */
+
+			if (k == 1 && stripe_io->format == CAM_FORMAT_NV12)
+				stripe_io->pack_format =
+					PACKER_FMT_PLAIN_8_ODD_EVEN;
+
+			temp |= ((stripe_io->pack_format &
+				wr_res_val_client->format_mask) <<
+				wr_res_val_client->format_shift);
+			temp |= ((stripe_io->alignment &
+				wr_res_val_client->alignment_mask) <<
+				wr_res_val_client->alignment_shift);
+			temp_reg[count++] = temp;
+
+			/* subsample period and pattern */
+			count = cam_ope_bus_wr_subsample(
+					ctx_data, ope_hw_info,
+					wr_reg_client, io_buf,
+					temp_reg, count, k, l);
+
+			header_size = cdm_ops->cdm_get_cmd_header_size(
+				CAM_CDM_CMD_REG_RANDOM);
+			idx = io_port_cdm->num_s_cmd_bufs[l];
+			io_port_cdm->s_cdm_info[l][idx].len =
+				sizeof(temp) * (count + header_size);
+			io_port_cdm->s_cdm_info[l][idx].offset =
+				prepare->kmd_buf_offset;
+			io_port_cdm->s_cdm_info[l][idx].addr = kmd_buf;
+			io_port_cdm->num_s_cmd_bufs[l]++;
+
+			kmd_buf = cdm_ops->cdm_write_regrandom(
+				kmd_buf, count/2, temp_reg);
+			prepare->kmd_buf_offset += ((count + header_size) *
+				sizeof(temp));
+
+			CAM_DBG(CAM_OPE, "b:%d io:%d p:%d s:%d",
+				batch_idx, io_idx, k, l);
+			for (m = 0; m < count; m += 2)
+				CAM_DBG(CAM_OPE, "%d: off: 0x%x val: 0x%x",
+					m, temp_reg[m], temp_reg[m+1]);
+			CAM_DBG(CAM_OPE, "kmdbuf:%x, offset:%d",
+				kmd_buf, prepare->kmd_buf_offset);
+			CAM_DBG(CAM_OPE, "WR cmd bufs = %d off:%d len:%d",
+				io_port_cdm->num_s_cmd_bufs[l],
+				io_port_cdm->s_cdm_info[l][idx].offset,
+				io_port_cdm->s_cdm_info[l][idx].len);
+			count = 0;
+		}
+	}
+
+	return kmd_buf;
+}
+
+static uint32_t *cam_ope_bus_wm_disable(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, struct cam_ope_dev_prepare_req *prepare,
+	int batch_idx, int io_idx,
+	uint32_t *kmd_buf, uint32_t num_stripes)
+{
+	int k, l;
+	uint32_t idx;
+	uint32_t num_wm_ports;
+	uint32_t comb_idx;
+	uint32_t req_idx;
+	uint32_t temp_reg[128];
+	uint32_t count = 0;
+	uint32_t temp = 0;
+	uint32_t wm_port_id;
+	uint32_t header_size;
+	struct cam_ope_ctx *ctx_data;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct cam_ope_bus_wr_reg *wr_reg;
+	struct cam_ope_bus_wr_client_reg *wr_reg_client;
+	struct ope_bus_out_port_to_wm *out_port_to_wm;
+	struct ope_bus_wr_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_wr_io_port_cdm_info *io_port_cdm;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+
+	if (ctx_id < 0 || !prepare) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, prepare);
+		return NULL;
+	}
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid batch idx: %d", batch_idx);
+		return NULL;
+	}
+
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	bus_wr_ctx = wr_info->bus_wr_ctx[ctx_id];
+	io_port_cdm_batch = &bus_wr_ctx->io_port_cdm_batch;
+	wr_reg = ope_hw_info->bus_wr_reg;
+
+	CAM_DBG(CAM_OPE,
+		"kmd_buf = %x req_idx = %d offset = %d out_idx %d b %d",
+		kmd_buf, req_idx, prepare->kmd_buf_offset, io_idx, batch_idx);
+
+	io_port_cdm =
+		&bus_wr_ctx->io_port_cdm_batch.io_port_cdm[batch_idx];
+	out_port_to_wm = &wr_info->out_port_to_wm[io_idx];
+	comb_idx = BUS_WR_YUV;
+	num_wm_ports = out_port_to_wm->num_wm[comb_idx];
+
+	for (k = 0; k < num_wm_ports; k++) {
+		for (l = 0; l < num_stripes; l++) {
+			/* frame level info */
+			/* stripe level info */
+			wm_port_id = out_port_to_wm->wm_port_id[comb_idx][k];
+			wr_reg_client = &wr_reg->wr_clients[wm_port_id];
+
+			/* Core cfg: enable, Mode */
+			temp_reg[count++] = wr_reg->offset +
+				wr_reg_client->core_cfg;
+			temp_reg[count++] = 0;
+
+			header_size = cdm_ops->cdm_get_cmd_header_size(
+				CAM_CDM_CMD_REG_RANDOM);
+			idx = io_port_cdm->num_s_cmd_bufs[l];
+			io_port_cdm->s_cdm_info[l][idx].len =
+				sizeof(temp) * (count + header_size);
+			io_port_cdm->s_cdm_info[l][idx].offset =
+				prepare->kmd_buf_offset;
+			io_port_cdm->s_cdm_info[l][idx].addr = kmd_buf;
+			io_port_cdm->num_s_cmd_bufs[l]++;
+
+			kmd_buf = cdm_ops->cdm_write_regrandom(
+				kmd_buf, count/2, temp_reg);
+			prepare->kmd_buf_offset += ((count + header_size) *
+				sizeof(temp));
+
+			CAM_DBG(CAM_OPE, "WR cmd bufs = %d",
+				io_port_cdm->num_s_cmd_bufs[l]);
+			CAM_DBG(CAM_OPE, "s:%d off:%d len:%d",
+				l, io_port_cdm->s_cdm_info[l][idx].offset,
+				io_port_cdm->s_cdm_info[l][idx].len);
+			count = 0;
+		}
+	}
+
+	prepare->wr_cdm_batch = &bus_wr_ctx->io_port_cdm_batch;
+
+	return kmd_buf;
+}
+
+static int cam_ope_bus_wr_prepare(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	int i, j = 0;
+	uint32_t req_idx;
+	uint32_t *kmd_buf;
+	struct cam_ope_dev_prepare_req *prepare;
+	struct cam_ope_ctx *ctx_data;
+	struct cam_ope_request *ope_request;
+	struct ope_io_buf *io_buf;
+	uint32_t temp;
+	int io_buf_idx;
+	uint32_t num_stripes = 0;
+	struct ope_bus_wr_io_port_cdm_batch *io_port_cdm_batch;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+
+	if (ctx_id < 0 || !data) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+	prepare = data;
+	ctx_data = prepare->ctx_data;
+	req_idx = prepare->req_idx;
+	bus_wr_ctx = wr_info->bus_wr_ctx[ctx_id];
+
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		(prepare->kmd_buf_offset / sizeof(temp));
+
+
+	CAM_DBG(CAM_OPE, "kmd_buf = %x req_idx = %d req_id = %lld offset = %d",
+		kmd_buf, req_idx, ope_request->request_id,
+		prepare->kmd_buf_offset);
+
+	io_port_cdm_batch = &wr_info->bus_wr_ctx[ctx_id]->io_port_cdm_batch;
+	memset(io_port_cdm_batch, 0,
+		sizeof(struct ope_bus_wr_io_port_cdm_batch));
+
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = 0; j < ope_request->num_io_bufs[i]; j++) {
+			io_buf = ope_request->io_buf[i][j];
+			CAM_DBG(CAM_OPE, "batch = %d io buf num = %d dir = %d",
+				i, j, io_buf->direction);
+			if (io_buf->direction != CAM_BUF_OUTPUT)
+				continue;
+
+			kmd_buf = cam_ope_bus_wr_update(ope_hw_info,
+				ctx_id, prepare, i, j,
+				kmd_buf, &num_stripes);
+			if (!kmd_buf) {
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+	}
+
+	/* Disable WMs which are not enabled */
+	for (i = 0; i < ope_request->num_batch; i++) {
+		for (j = OPE_OUT_RES_VIDEO; j <= OPE_OUT_RES_MAX; j++) {
+			io_buf_idx = cam_ope_bus_en_port_idx(ope_request, i, j);
+			if (io_buf_idx >= 0)
+				continue;
+
+			io_buf_idx = cam_ope_bus_wr_out_port_idx(j);
+			if (io_buf_idx < 0) {
+				CAM_ERR(CAM_OPE, "Invalid idx for rsc type:%d",
+					j);
+				return io_buf_idx;
+			}
+			kmd_buf = cam_ope_bus_wm_disable(ope_hw_info,
+				ctx_id, prepare, i, io_buf_idx,
+				kmd_buf, num_stripes);
+		}
+	}
+	prepare->wr_cdm_batch = &bus_wr_ctx->io_port_cdm_batch;
+
+end:
+	return rc;
+}
+
+static int cam_ope_bus_wr_acquire(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i;
+	struct ope_acquire_dev_info *in_acquire;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct ope_bus_out_port_to_wm *out_port_to_wr;
+	int combo_idx;
+	int out_port_idx;
+
+	if (ctx_id < 0 || !data || ctx_id >= OPE_CTX_MAX) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+
+	wr_info->bus_wr_ctx[ctx_id] = vzalloc(sizeof(struct ope_bus_wr_ctx));
+	if (!wr_info->bus_wr_ctx[ctx_id]) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		return -ENOMEM;
+	}
+
+	wr_info->bus_wr_ctx[ctx_id]->ope_acquire = data;
+	in_acquire = data;
+	bus_wr_ctx = wr_info->bus_wr_ctx[ctx_id];
+	bus_wr_ctx->num_out_ports = in_acquire->num_out_res;
+	bus_wr_ctx->security_flag = in_acquire->secure_mode;
+
+	for (i = 0; i < in_acquire->num_out_res; i++) {
+		if (!in_acquire->out_res[i].width)
+			continue;
+
+		CAM_DBG(CAM_OPE, "i = %d format = %u width = %x height = %x",
+			i, in_acquire->out_res[i].format,
+			in_acquire->out_res[i].width,
+			in_acquire->out_res[i].height);
+		CAM_DBG(CAM_OPE, "pix_pattern:%u alignment:%u packer_format:%u",
+			in_acquire->out_res[i].pixel_pattern,
+			in_acquire->out_res[i].alignment,
+			in_acquire->out_res[i].packer_format);
+		CAM_DBG(CAM_OPE, "subsample_period = %u subsample_pattern = %u",
+			in_acquire->out_res[i].subsample_period,
+			in_acquire->out_res[i].subsample_pattern);
+
+		out_port_idx =
+		cam_ope_bus_wr_out_port_idx(in_acquire->out_res[i].res_id);
+		if (out_port_idx < 0) {
+			CAM_DBG(CAM_OPE, "Invalid in_port_idx: %d",
+				in_acquire->out_res[i].res_id);
+			rc = -EINVAL;
+			goto end;
+		}
+		out_port_to_wr = &wr_info->out_port_to_wm[out_port_idx];
+		combo_idx = BUS_WR_YUV;
+		if (!out_port_to_wr->num_wm[combo_idx]) {
+			CAM_DBG(CAM_OPE, "Invalid format for Input port");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		bus_wr_ctx->io_port_info.output_port_id[i] =
+			in_acquire->out_res[i].res_id;
+		bus_wr_ctx->io_port_info.output_format_type[i] =
+			in_acquire->out_res[i].format;
+		if (in_acquire->out_res[i].pixel_pattern >
+			PIXEL_PATTERN_CRYCBY) {
+			CAM_DBG(CAM_OPE, "Invalid pix pattern = %u",
+				in_acquire->out_res[i].pixel_pattern);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		bus_wr_ctx->io_port_info.pixel_pattern[i] =
+			in_acquire->out_res[i].pixel_pattern;
+		bus_wr_ctx->io_port_info.latency_buf_size = 4096;
+		CAM_DBG(CAM_OPE, "i:%d port_id = %u format %u pix_pattern = %u",
+			i, bus_wr_ctx->io_port_info.output_port_id[i],
+			bus_wr_ctx->io_port_info.output_format_type[i],
+			bus_wr_ctx->io_port_info.pixel_pattern[i]);
+		CAM_DBG(CAM_OPE, "latency_buf_size = %u",
+			bus_wr_ctx->io_port_info.latency_buf_size);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_ope_bus_wr_init(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_ope_bus_wr_reg_val *bus_wr_reg_val;
+	struct cam_ope_bus_wr_reg *bus_wr_reg;
+	struct cam_ope_dev_init *dev_init = data;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	wr_info->ope_hw_info = ope_hw_info;
+	bus_wr_reg_val = ope_hw_info->bus_wr_reg_val;
+	bus_wr_reg = ope_hw_info->bus_wr_reg;
+	bus_wr_reg->base = dev_init->core_info->ope_hw_info->ope_bus_wr_base;
+
+	cam_io_w_mb(bus_wr_reg_val->irq_mask_0,
+		ope_hw_info->bus_wr_reg->base + bus_wr_reg->irq_mask_0);
+	cam_io_w_mb(bus_wr_reg_val->irq_mask_1,
+		ope_hw_info->bus_wr_reg->base + bus_wr_reg->irq_mask_1);
+
+	return rc;
+}
+
+static int cam_ope_bus_wr_probe(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0, i, j, combo_idx, k;
+	struct cam_ope_bus_wr_reg_val *bus_wr_reg_val;
+	struct ope_bus_out_port_to_wm *out_port_to_wm;
+	uint32_t output_port_idx;
+	uint32_t wm_idx;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+	wr_info = kzalloc(sizeof(struct ope_bus_wr), GFP_KERNEL);
+	if (!wr_info) {
+		CAM_ERR(CAM_OPE, "Out of memory");
+		return -ENOMEM;
+	}
+
+	wr_info->ope_hw_info = ope_hw_info;
+	bus_wr_reg_val = ope_hw_info->bus_wr_reg_val;
+
+	for (i = 0; i < bus_wr_reg_val->num_clients; i++) {
+		output_port_idx =
+			bus_wr_reg_val->wr_clients[i].output_port_id - 1;
+		out_port_to_wm = &wr_info->out_port_to_wm[output_port_idx];
+		combo_idx = BUS_WR_YUV;
+		wm_idx = out_port_to_wm->num_wm[combo_idx];
+		out_port_to_wm->output_port_id =
+			bus_wr_reg_val->wr_clients[i].output_port_id;
+		out_port_to_wm->wm_port_id[combo_idx][wm_idx] =
+			bus_wr_reg_val->wr_clients[i].wm_port_id;
+		if (!out_port_to_wm->num_wm[combo_idx])
+			out_port_to_wm->num_combos++;
+		out_port_to_wm->num_wm[combo_idx]++;
+	}
+
+	for (i = 0; i < OPE_OUT_RES_MAX; i++) {
+		out_port_to_wm = &wr_info->out_port_to_wm[i];
+		CAM_DBG(CAM_OPE, "output port id = %d num_combos = %d",
+			out_port_to_wm->output_port_id,
+			out_port_to_wm->num_combos);
+		for (j = 0; j < out_port_to_wm->num_combos; j++) {
+			CAM_DBG(CAM_OPE, "combo idx = %d num_wms = %d",
+				j, out_port_to_wm->num_wm[j]);
+			for (k = 0; k < out_port_to_wm->num_wm[j]; k++) {
+				CAM_DBG(CAM_OPE, "wm port id = %d",
+					out_port_to_wm->wm_port_id[j][k]);
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ope_bus_wr_isr(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	uint32_t irq_status_0, irq_status_1, violation_status;
+	struct cam_ope_bus_wr_reg *bus_wr_reg;
+	struct cam_ope_bus_wr_reg_val *bus_wr_reg_val;
+	struct cam_ope_irq_data *irq_data = data;
+
+	if (!ope_hw_info || !irq_data) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	bus_wr_reg = ope_hw_info->bus_wr_reg;
+	bus_wr_reg_val = ope_hw_info->bus_wr_reg_val;
+
+	/* Read and Clear Top Interrupt status */
+	irq_status_0 = cam_io_r_mb(bus_wr_reg->base + bus_wr_reg->irq_status_0);
+	irq_status_1 = cam_io_r_mb(bus_wr_reg->base + bus_wr_reg->irq_status_1);
+	cam_io_w_mb(irq_status_0,
+		bus_wr_reg->base + bus_wr_reg->irq_clear_0);
+	cam_io_w_mb(irq_status_1,
+		bus_wr_reg->base + bus_wr_reg->irq_clear_1);
+
+	cam_io_w_mb(bus_wr_reg_val->irq_set_clear,
+		bus_wr_reg->base + bus_wr_reg->irq_cmd);
+
+	if (irq_status_0 & bus_wr_reg_val->cons_violation) {
+		irq_data->error = 1;
+		CAM_ERR(CAM_OPE, "ope bus wr cons_violation");
+	}
+
+	if (irq_status_0 & bus_wr_reg_val->violation) {
+		irq_data->error = 1;
+		violation_status = cam_io_r_mb(bus_wr_reg->base +
+			bus_wr_reg->violation_status);
+		CAM_ERR(CAM_OPE,
+			"ope bus wr violation, violation_status 0x%x",
+			violation_status);
+	}
+
+	if (irq_status_0 & bus_wr_reg_val->img_size_violation) {
+		irq_data->error = 1;
+		violation_status = cam_io_r_mb(bus_wr_reg->base +
+			bus_wr_reg->image_size_violation_status);
+		CAM_ERR(CAM_OPE,
+			"ope bus wr img_size_violation, violation_status 0x%x",
+			violation_status);
+	}
+
+	return rc;
+}
+
+int cam_ope_bus_wr_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data)
+{
+	int rc = 0;
+
+	switch (cmd_id) {
+	case OPE_HW_PROBE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: E");
+		rc = cam_ope_bus_wr_probe(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: X");
+		break;
+	case OPE_HW_INIT:
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: E");
+		rc = cam_ope_bus_wr_init(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: X");
+		break;
+	case OPE_HW_ACQUIRE:
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: E");
+		rc = cam_ope_bus_wr_acquire(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: X");
+		break;
+	case OPE_HW_RELEASE:
+		CAM_DBG(CAM_OPE, "OPE_HW_RELEASE: E");
+		rc = cam_ope_bus_wr_release(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_RELEASE: X");
+		break;
+	case OPE_HW_PREPARE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PREPARE: E");
+		rc = cam_ope_bus_wr_prepare(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PREPARE: X");
+		break;
+	case OPE_HW_DEINIT:
+	case OPE_HW_START:
+	case OPE_HW_STOP:
+	case OPE_HW_FLUSH:
+	case OPE_HW_CLK_UPDATE:
+	case OPE_HW_BW_UPDATE:
+	case OPE_HW_RESET:
+	case OPE_HW_SET_IRQ_CB:
+		rc = 0;
+		CAM_DBG(CAM_OPE, "Unhandled cmds: %d", cmd_id);
+		break;
+	case OPE_HW_ISR:
+		rc = cam_ope_bus_wr_isr(ope_hw_info, 0, data);
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Unsupported cmd: %d", cmd_id);
+		break;
+	}
+
+	return rc;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/bus_wr/ope_bus_wr.h
@@ -0,0 +1,137 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef OPE_BUS_WR_H
+#define OPE_BUS_WR_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "ope_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_soc_util.h"
+#include "cam_context.h"
+#include "cam_ope_context.h"
+#include "cam_ope_hw_mgr.h"
+
+/**
+ * struct ope_bus_wr_cdm_info
+ *
+ * @offset: Offset
+ * @addr:   Address
+ * @len:    Length
+ */
+struct ope_bus_wr_cdm_info {
+	uint32_t offset;
+	uint32_t *addr;
+	uint32_t len;
+};
+
+/**
+ * struct ope_bus_wr_io_port_cdm_info
+ *
+ * @num_frames_cmds: Number of frame commands
+ * @f_cdm_info:      Frame cdm info
+ * @num_stripes:     Number of stripes
+ * @num_s_cmd_bufs:  Number of stripe commands
+ * @s_cdm_info:      Stripe cdm info
+ * @go_cmd_addr:     GO command address
+ * @go_cmd_len:      GO command length
+ */
+struct ope_bus_wr_io_port_cdm_info {
+	uint32_t num_frames_cmds;
+	struct ope_bus_wr_cdm_info f_cdm_info[MAX_WR_CLIENTS];
+	uint32_t num_stripes;
+	uint32_t num_s_cmd_bufs[OPE_MAX_STRIPES];
+	struct ope_bus_wr_cdm_info s_cdm_info[OPE_MAX_STRIPES][MAX_WR_CLIENTS];
+	uint32_t *go_cmd_addr;
+	uint32_t go_cmd_len;
+};
+
+/**
+ * struct ope_bus_wr_io_port_cdm_batch
+ *
+ * num_batch:   Number of batches
+ * io_port_cdm: CDM IO Port Info
+ */
+struct ope_bus_wr_io_port_cdm_batch {
+	uint32_t num_batch;
+	struct ope_bus_wr_io_port_cdm_info io_port_cdm[OPE_MAX_BATCH_SIZE];
+};
+
+/**
+ * struct ope_bus_wr_wm
+ *
+ * @wm_port_id:  WM port ID
+ * @format_type: Format type
+ */
+struct ope_bus_wr_wm {
+	uint32_t wm_port_id;
+	uint32_t format_type;
+};
+
+/**
+ * struct ope_bus_out_port_to_wm
+ *
+ * @output_port_id: Output port ID
+ * @num_combos:     Number of combos
+ * @num_wm:         Number of WMs
+ * @wm_port_id:     WM port Id
+ */
+struct ope_bus_out_port_to_wm {
+	uint32_t output_port_id;
+	uint32_t num_combos;
+	uint32_t num_wm[BUS_WR_COMBO_MAX];
+	uint32_t wm_port_id[BUS_WR_COMBO_MAX][MAX_WR_CLIENTS];
+};
+
+/**
+ * struct ope_bus_wr_io_port_info
+ *
+ * @pixel_pattern:      Pixel pattern
+ * @output_port_id:     Port Id
+ * @output_format_type: Format type
+ * @latency_buf_size:   Latency buffer size
+ */
+struct ope_bus_wr_io_port_info {
+	uint32_t pixel_pattern[OPE_OUT_RES_MAX];
+	uint32_t output_port_id[OPE_OUT_RES_MAX];
+	uint32_t output_format_type[OPE_OUT_RES_MAX];
+	uint32_t latency_buf_size;
+};
+
+/**
+ * struct ope_bus_wr_ctx
+ *
+ * @ope_acquire:       OPE acquire structure
+ * @security_flag:     security flag
+ * @num_out_ports:     Number of out ports
+ * @io_port_info:      IO port info
+ * @io_port_cdm_batch: IO port cdm info
+ */
+struct ope_bus_wr_ctx {
+	struct ope_acquire_dev_info *ope_acquire;
+	bool security_flag;
+	uint32_t num_out_ports;
+	struct ope_bus_wr_io_port_info io_port_info;
+	struct ope_bus_wr_io_port_cdm_batch io_port_cdm_batch;
+};
+
+/**
+ * struct ope_bus_wr
+ *
+ * @ope_hw_info:    OPE hardware info
+ * @out_port_to_wm: IO port to WM mapping
+ * @bus_wr_ctx:     WM context
+ */
+struct ope_bus_wr {
+	struct ope_hw *ope_hw_info;
+	struct ope_bus_out_port_to_wm out_port_to_wm[OPE_OUT_RES_MAX];
+	struct ope_bus_wr_ctx *bus_wr_ctx[OPE_CTX_MAX];
+};
+
+#endif /* OPE_BUS_WR_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.c
@@ -0,0 +1,1818 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include <media/cam_ope.h>
+
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+#include "cam_cdm_util.h"
+#include "ope_bus_rd.h"
+#include "ope_bus_wr.h"
+#include "cam_compat.h"
+
+static int cam_ope_caps_vote(struct cam_ope_device_core_info *core_info,
+	struct cam_ope_dev_bw_update *cpas_vote)
+{
+	int rc = 0;
+
+	if (cpas_vote->ahb_vote_valid)
+		rc = cam_cpas_update_ahb_vote(core_info->cpas_handle,
+			&cpas_vote->ahb_vote);
+	if (cpas_vote->axi_vote_valid)
+		rc = cam_cpas_update_axi_vote(core_info->cpas_handle,
+			&cpas_vote->axi_vote);
+	if (rc)
+		CAM_ERR(CAM_OPE, "cpas vote is failed: %d", rc);
+
+	return rc;
+}
+
+int cam_ope_get_hw_caps(void *hw_priv, void *get_hw_cap_args,
+	uint32_t arg_size)
+{
+	struct cam_hw_info *ope_dev = hw_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ope_device_core_info *core_info = NULL;
+	struct ope_hw_ver *ope_hw_ver;
+	struct cam_ope_top_reg_val *top_reg_val;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ope_dev->soc_info;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_OPE, "soc_info = %x core_info = %x",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	if (!get_hw_cap_args) {
+		CAM_ERR(CAM_OPE, "Invalid caps");
+		return -EINVAL;
+	}
+
+	top_reg_val = core_info->ope_hw_info->ope_hw->top_reg_val;
+	ope_hw_ver = get_hw_cap_args;
+	ope_hw_ver->hw_type = core_info->hw_type;
+	ope_hw_ver->hw_ver.major =
+		(core_info->hw_version & top_reg_val->major_mask) >>
+		top_reg_val->major_shift;
+	ope_hw_ver->hw_ver.minor =
+		(core_info->hw_version & top_reg_val->minor_mask) >>
+		top_reg_val->minor_shift;
+	ope_hw_ver->hw_ver.incr =
+		(core_info->hw_version & top_reg_val->incr_mask) >>
+		top_reg_val->incr_shift;
+
+	return 0;
+}
+
+int cam_ope_start(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	return 0;
+}
+
+int cam_ope_stop(void *hw_priv, void *start_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ope_dev = hw_priv;
+	struct cam_ope_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!hw_priv) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	if (!core_info) {
+		CAM_ERR(CAM_OPE, "core_info = %pK", core_info);
+		return -EINVAL;
+	}
+
+	if (core_info->cpas_start) {
+		if (cam_cpas_stop(core_info->cpas_handle))
+			CAM_ERR(CAM_OPE, "cpas stop is failed");
+		else
+			core_info->cpas_start = false;
+	}
+
+	return rc;
+}
+
+int cam_ope_flush(void *hw_priv, void *flush_args, uint32_t arg_size)
+{
+	return 0;
+}
+
+static int cam_ope_dev_process_init(struct ope_hw *ope_hw,
+	void *cmd_args)
+{
+	int rc = 0;
+
+	rc = cam_ope_top_process(ope_hw, 0, OPE_HW_INIT, cmd_args);
+	if (rc)
+		goto top_init_fail;
+
+	rc = cam_ope_bus_rd_process(ope_hw, 0, OPE_HW_INIT, cmd_args);
+		if (rc)
+			goto bus_rd_init_fail;
+
+	rc = cam_ope_bus_wr_process(ope_hw, 0, OPE_HW_INIT, cmd_args);
+		if (rc)
+			goto bus_wr_init_fail;
+
+	return rc;
+
+bus_wr_init_fail:
+	rc = cam_ope_bus_rd_process(ope_hw, 0,
+		OPE_HW_DEINIT, NULL);
+bus_rd_init_fail:
+	rc = cam_ope_top_process(ope_hw, 0,
+		OPE_HW_DEINIT, NULL);
+top_init_fail:
+	return rc;
+}
+
+static int cam_ope_process_init(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_init(ope_hw, cmd_args);
+
+	CAM_ERR(CAM_OPE, "hfi_en is not supported");
+	return -EINVAL;
+}
+
+int cam_ope_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ope_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ope_device_core_info *core_info = NULL;
+	struct cam_ope_cpas_vote *cpas_vote;
+	int rc = 0;
+	struct cam_ope_dev_init *init;
+	struct ope_hw *ope_hw;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	soc_info = &ope_dev->soc_info;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_OPE, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		rc = -EINVAL;
+		goto end;
+	}
+	ope_hw = core_info->ope_hw_info->ope_hw;
+
+	cpas_vote = kzalloc(sizeof(struct cam_ope_cpas_vote), GFP_KERNEL);
+	if (!cpas_vote) {
+		CAM_ERR(CAM_ISP, "Out of memory");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	cpas_vote->ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote->ahb_vote.vote.level = CAM_SVS_VOTE;
+	cpas_vote->axi_vote.num_paths = 1;
+	cpas_vote->axi_vote.axi_path[0].path_data_type =
+		CAM_AXI_PATH_DATA_ALL;
+	cpas_vote->axi_vote.axi_path[0].transac_type =
+		CAM_AXI_TRANSACTION_WRITE;
+	cpas_vote->axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].ddr_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote->axi_vote.axi_path[0].ddr_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote->ahb_vote, &cpas_vote->axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "cpass start failed: %d", rc);
+		goto free_cpas_vote;
+	}
+	core_info->cpas_start = true;
+
+	rc = cam_ope_enable_soc_resources(soc_info);
+	if (rc)
+		goto enable_soc_resource_failed;
+	else
+		core_info->clk_enable = true;
+
+	init = init_hw_args;
+
+	core_info->ope_hw_info->hfi_en = init->hfi_en;
+	init->core_info = core_info;
+	rc = cam_ope_process_init(ope_hw, init_hw_args, init->hfi_en);
+	if (rc)
+		goto process_init_failed;
+	else
+		goto free_cpas_vote;
+
+process_init_failed:
+	if (cam_ope_disable_soc_resources(soc_info, core_info->clk_enable))
+		CAM_ERR(CAM_OPE, "disable soc resource failed");
+enable_soc_resource_failed:
+	if (cam_cpas_stop(core_info->cpas_handle))
+		CAM_ERR(CAM_OPE, "cpas stop is failed");
+	else
+		core_info->cpas_start = false;
+free_cpas_vote:
+	cam_free_clear((void *)cpas_vote);
+	cpas_vote = NULL;
+end:
+	return rc;
+}
+
+int cam_ope_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size)
+{
+	struct cam_hw_info *ope_dev = device_priv;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct cam_ope_device_core_info *core_info = NULL;
+	int rc = 0;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info");
+		return -EINVAL;
+	}
+
+	soc_info = &ope_dev->soc_info;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_OPE, "soc_info = %pK core_info = %pK",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	rc = cam_ope_disable_soc_resources(soc_info, core_info->clk_enable);
+	if (rc)
+		CAM_ERR(CAM_OPE, "soc disable is failed : %d", rc);
+	core_info->clk_enable = false;
+
+	return rc;
+}
+
+static int cam_ope_dev_process_dump_debug_reg(struct ope_hw *ope_hw)
+{
+	int rc = 0;
+
+	rc = cam_ope_top_process(ope_hw, -1,
+		OPE_HW_DUMP_DEBUG, NULL);
+
+	return rc;
+}
+
+static int cam_ope_dev_process_reset(struct ope_hw *ope_hw, void *cmd_args)
+{
+	int rc = 0;
+
+	rc = cam_ope_top_process(ope_hw, -1,
+		OPE_HW_RESET, NULL);
+
+	return rc;
+}
+
+static int cam_ope_dev_process_release(struct ope_hw *ope_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_ope_dev_release *ope_dev_release;
+
+	ope_dev_release = cmd_args;
+	rc = cam_ope_top_process(ope_hw, ope_dev_release->ctx_id,
+		OPE_HW_RELEASE, NULL);
+
+	rc |= cam_ope_bus_rd_process(ope_hw, ope_dev_release->ctx_id,
+		OPE_HW_RELEASE, NULL);
+
+	rc |= cam_ope_bus_wr_process(ope_hw, ope_dev_release->ctx_id,
+		OPE_HW_RELEASE, NULL);
+
+	return rc;
+}
+
+static int cam_ope_dev_process_acquire(struct ope_hw *ope_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_ope_dev_acquire *ope_dev_acquire;
+
+	if (!cmd_args || !ope_hw) {
+		CAM_ERR(CAM_OPE, "Invalid arguments: %pK %pK",
+		cmd_args, ope_hw);
+		return -EINVAL;
+	}
+
+	ope_dev_acquire = cmd_args;
+	rc = cam_ope_top_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_ACQUIRE, ope_dev_acquire->ope_acquire);
+	if (rc)
+		goto top_acquire_fail;
+
+	rc = cam_ope_bus_rd_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_ACQUIRE, ope_dev_acquire->ope_acquire);
+	if (rc)
+		goto bus_rd_acquire_fail;
+
+	rc = cam_ope_bus_wr_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_ACQUIRE, ope_dev_acquire->ope_acquire);
+	if (rc)
+		goto bus_wr_acquire_fail;
+
+	return 0;
+
+bus_wr_acquire_fail:
+	cam_ope_bus_rd_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_RELEASE, ope_dev_acquire->ope_acquire);
+bus_rd_acquire_fail:
+	cam_ope_top_process(ope_hw, ope_dev_acquire->ctx_id,
+		OPE_HW_RELEASE, ope_dev_acquire->ope_acquire);
+top_acquire_fail:
+	return rc;
+}
+
+static int cam_ope_dev_prepare_cdm_request(
+	struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t kmd_buf_offset,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req,
+	uint32_t len, bool arbitrate)
+{
+	int i;
+	struct cam_ope_request *ope_request;
+	struct cam_cdm_bl_request *cdm_cmd;
+	uint32_t *kmd_buf;
+
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_cmd = ope_request->cdm_cmd;
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		kmd_buf_offset;
+
+	cdm_cmd->type = CAM_CDM_BL_CMD_TYPE_MEM_HANDLE;
+	cdm_cmd->flag = true;
+	cdm_cmd->userdata = ctx_data;
+	cdm_cmd->cookie = req_idx;
+	cdm_cmd->gen_irq_arb = true;
+
+	i = cdm_cmd->cmd_arrary_count;
+	cdm_cmd->cmd_flex[i].bl_addr.mem_handle =
+		ope_request->ope_kmd_buf.mem_handle;
+	cdm_cmd->cmd_flex[i].offset = kmd_buf_offset +
+		ope_request->ope_kmd_buf.offset;
+	cdm_cmd->cmd_flex[i].len = len;
+	cdm_cmd->cmd_flex[i].arbitrate = arbitrate;
+	cdm_cmd->cmd_flex[i].enable_debug_gen_irq = false;
+
+	cdm_cmd->cmd_arrary_count++;
+
+	CAM_DBG(CAM_OPE, "CDM cmd:Req idx = %d req_id = %lld array cnt = %d",
+		cdm_cmd->cookie, ope_request->request_id,
+		cdm_cmd->cmd_arrary_count);
+	CAM_DBG(CAM_OPE, "CDM cmd:mem_hdl = %d offset = %d len = %d, iova 0x%x",
+		ope_request->ope_kmd_buf.mem_handle, kmd_buf_offset, len,
+		cdm_cmd->cmd_flex[i].bl_addr.hw_iova);
+
+	return 0;
+}
+
+
+static int dump_dmi_cmd(uint32_t print_idx,
+	uint32_t *print_ptr, struct cdm_dmi_cmd *dmi_cmd,
+	uint32_t *temp)
+{
+	CAM_DBG(CAM_OPE, "%d:dma_ptr:%x l:%d",
+		print_idx, print_ptr,
+		dmi_cmd->length);
+	CAM_DBG(CAM_OPE, "%d:cmd:%hhx addr:%x",
+		print_ptr, dmi_cmd->cmd,
+		dmi_cmd->addr);
+	CAM_DBG(CAM_OPE, "%d: dmiadr:%x sel:%d",
+		print_idx, dmi_cmd->DMIAddr,
+		dmi_cmd->DMISel);
+	CAM_DBG(CAM_OPE, "%d: %x %x %x",
+		print_idx,
+		temp[0], temp[1], temp[2]);
+
+	return 0;
+}
+
+static int dump_direct_cmd(uint32_t print_idx,
+	uint32_t *print_ptr,
+	struct ope_frame_process *frm_proc,
+	int batch_idx, int cmd_buf_idx)
+{
+	int len;
+
+	if (cmd_buf_idx >= OPE_MAX_CMD_BUFS ||
+		batch_idx >= OPE_MAX_BATCH_SIZE)
+		return 0;
+
+	len = frm_proc->cmd_buf[batch_idx][cmd_buf_idx].length / 4;
+	CAM_DBG(CAM_OPE, "Frame DB : direct: E");
+	for (print_idx = 0; print_idx < len; print_idx++)
+		CAM_DBG(CAM_OPE, "%d: %x", print_idx, print_ptr[print_idx]);
+	CAM_DBG(CAM_OPE, "Frame DB : direct: X");
+
+	return 0;
+}
+
+static int dump_frame_cmd(struct ope_frame_process *frm_proc,
+	int i, int j, uint64_t iova_addr, uint32_t *kmd_buf, uint32_t buf_len)
+{
+	if (j >= OPE_MAX_CMD_BUFS || i >= OPE_MAX_BATCH_SIZE)
+		return 0;
+
+	CAM_DBG(CAM_OPE, "Frame DB:scope:%d buffer:%d type:%d",
+		frm_proc->cmd_buf[i][j].cmd_buf_scope,
+		frm_proc->cmd_buf[i][j].cmd_buf_buffered,
+		frm_proc->cmd_buf[i][j].type);
+	CAM_DBG(CAM_OPE, "kmdbuf:%x memhdl:%x iova:%x %pK",
+		kmd_buf,
+		frm_proc->cmd_buf[i][j].mem_handle,
+		iova_addr, iova_addr);
+	CAM_DBG(CAM_OPE, "buflen:%d len:%d offset:%d",
+		buf_len,
+		frm_proc->cmd_buf[i][j].length,
+		frm_proc->cmd_buf[i][j].offset);
+
+	return 0;
+}
+
+static int dump_stripe_cmd(struct ope_frame_process *frm_proc,
+	uint32_t stripe_idx, int i, int k, uint64_t iova_addr,
+	uint32_t *kmd_buf, uint32_t buf_len)
+{
+	if (k >= OPE_MAX_CMD_BUFS)
+		return 0;
+
+	CAM_DBG(CAM_OPE, "Stripe:%d scope:%d buffer:%d",
+		stripe_idx,
+		frm_proc->cmd_buf[i][k].cmd_buf_scope,
+		frm_proc->cmd_buf[i][k].cmd_buf_buffered);
+	CAM_DBG(CAM_OPE, "type:%d kmdbuf:%x memhdl:%x",
+		frm_proc->cmd_buf[i][k].type, kmd_buf,
+		frm_proc->cmd_buf[i][k].mem_handle);
+	CAM_DBG(CAM_OPE, "iova:%x %pK buflen:%d len:%d",
+		iova_addr, iova_addr, buf_len,
+		frm_proc->cmd_buf[i][k].length);
+	CAM_DBG(CAM_OPE, "offset:%d",
+		frm_proc->cmd_buf[i][k].offset);
+	return 0;
+}
+
+static uint32_t *ope_create_frame_cmd_batch(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf, uint32_t buffered, int batch_idx,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0, i, j;
+	uint32_t temp[3];
+	struct cam_ope_request *ope_request;
+	struct cdm_dmi_cmd *dmi_cmd;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	dma_addr_t iova_addr;
+	uintptr_t cpu_addr;
+	size_t buf_len;
+	uint32_t print_idx;
+	uint32_t *print_ptr;
+	int num_dmi = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[0];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[0];
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid input: %d", batch_idx);
+		return NULL;
+	}
+	i = batch_idx;
+
+	for (j = 0; j < frm_proc->num_cmd_bufs[i]; j++) {
+		if (frm_proc->cmd_buf[i][j].cmd_buf_scope !=
+			OPE_CMD_BUF_SCOPE_FRAME)
+			continue;
+
+		if (frm_proc->cmd_buf[i][j].cmd_buf_usage ==
+			OPE_CMD_BUF_KMD ||
+			frm_proc->cmd_buf[i][j].cmd_buf_usage ==
+			OPE_CMD_BUF_DEBUG)
+			continue;
+
+		if (frm_proc->cmd_buf[i][j].cmd_buf_buffered !=
+			buffered)
+			continue;
+
+		if (!frm_proc->cmd_buf[i][j].mem_handle)
+			continue;
+
+		rc = cam_mem_get_io_buf(
+			frm_proc->cmd_buf[i][j].mem_handle,
+			hw_mgr->iommu_cdm_hdl, &iova_addr, &buf_len);
+		if (rc) {
+			CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+				hw_mgr->iommu_hdl);
+			return NULL;
+		}
+		iova_addr = iova_addr + frm_proc->cmd_buf[i][j].offset;
+
+		rc = cam_mem_get_cpu_buf(
+			frm_proc->cmd_buf[i][j].mem_handle,
+			&cpu_addr, &buf_len);
+		if (rc || !cpu_addr) {
+			CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+				hw_mgr->iommu_hdl);
+			return NULL;
+		}
+
+		cpu_addr = cpu_addr + frm_proc->cmd_buf[i][j].offset;
+		if (frm_proc->cmd_buf[i][j].type ==
+			OPE_CMD_BUF_TYPE_DIRECT) {
+			kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+				iova_addr,
+				frm_proc->cmd_buf[i][j].length);
+			print_ptr = (uint32_t *)cpu_addr;
+			dump_direct_cmd(print_idx, print_ptr,
+				frm_proc, i, j);
+		} else {
+			num_dmi = frm_proc->cmd_buf[i][j].length /
+				sizeof(struct cdm_dmi_cmd);
+			CAM_DBG(CAM_OPE, "Frame DB : In direct: E");
+			print_ptr = (uint32_t *)cpu_addr;
+			for (print_idx = 0;
+				print_idx < num_dmi; print_idx++) {
+				memcpy(temp, (const void *)print_ptr,
+					sizeof(struct cdm_dmi_cmd));
+				dmi_cmd = (struct cdm_dmi_cmd *)temp;
+				if (!dmi_cmd->addr) {
+					CAM_ERR(CAM_OPE, "Null dmi cmd addr");
+					cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][j].mem_handle);
+					return NULL;
+				}
+
+				kmd_buf = cdm_ops->cdm_write_dmi(
+					kmd_buf,
+					0, dmi_cmd->DMIAddr,
+					dmi_cmd->DMISel, dmi_cmd->addr,
+					dmi_cmd->length);
+				if (hw_mgr->frame_dump_enable)
+					dump_dmi_cmd(print_idx,
+						print_ptr, dmi_cmd, temp);
+				print_ptr +=
+					sizeof(struct cdm_dmi_cmd) /
+					sizeof(uint32_t);
+			}
+			CAM_DBG(CAM_OPE, "Frame DB : In direct: X");
+		}
+		if (hw_mgr->frame_dump_enable)
+			dump_frame_cmd(frm_proc, i, j,
+				iova_addr, kmd_buf, buf_len);
+
+		cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][j].mem_handle);
+	}
+	return kmd_buf;
+
+}
+
+static uint32_t *ope_create_frame_wr(struct cam_ope_ctx *ctx_data,
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info,
+	uint32_t *kmd_buf, struct cam_ope_request *ope_request)
+{
+	struct cam_cdm_utils_ops *cdm_ops;
+	int i;
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	for (i = 0; i < wr_cdm_info->num_frames_cmds; i++) {
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			wr_cdm_info->f_cdm_info[i].offset,
+			wr_cdm_info->f_cdm_info[i].len);
+		CAM_DBG(CAM_OPE, "FrameWR:i:%d kmdbuf:%x len:%d iova:%x %pK",
+			i, kmd_buf, wr_cdm_info->f_cdm_info[i].len,
+			ope_request->ope_kmd_buf.iova_cdm_addr,
+			ope_request->ope_kmd_buf.iova_cdm_addr);
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_frame_rd(struct cam_ope_ctx *ctx_data,
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info,
+	uint32_t *kmd_buf, struct cam_ope_request *ope_request)
+{
+	struct cam_cdm_utils_ops *cdm_ops;
+	int i;
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	/* Frame 0 RD */
+	for (i = 0; i < rd_cdm_info->num_frames_cmds; i++) {
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			rd_cdm_info->f_cdm_info[i].offset,
+			rd_cdm_info->f_cdm_info[i].len);
+		CAM_DBG(CAM_OPE, "FrameRD:i:%d kmdbuf:%x len:%d iova:%x %pK",
+			 i, kmd_buf, rd_cdm_info->f_cdm_info[i].len,
+			 ope_request->ope_kmd_buf.iova_cdm_addr,
+			 ope_request->ope_kmd_buf.iova_cdm_addr);
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_frame_cmd(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf, uint32_t buffered,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0, i, j;
+	uint32_t temp[3];
+	struct cam_ope_request *ope_request;
+	struct cdm_dmi_cmd *dmi_cmd;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	dma_addr_t iova_addr;
+	uintptr_t cpu_addr;
+	size_t buf_len;
+	uint32_t print_idx;
+	uint32_t *print_ptr;
+	int num_dmi = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[0];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[0];
+
+	for (i = 0; i < frm_proc->batch_size; i++) {
+		for (j = 0; j < frm_proc->num_cmd_bufs[i]; j++) {
+			if (frm_proc->cmd_buf[i][j].cmd_buf_scope !=
+				OPE_CMD_BUF_SCOPE_FRAME)
+				continue;
+
+			if (frm_proc->cmd_buf[i][j].cmd_buf_usage ==
+				OPE_CMD_BUF_KMD ||
+				frm_proc->cmd_buf[i][j].cmd_buf_usage ==
+				OPE_CMD_BUF_DEBUG)
+				continue;
+
+			if (frm_proc->cmd_buf[i][j].cmd_buf_buffered !=
+				buffered)
+				continue;
+
+			if (!frm_proc->cmd_buf[i][j].mem_handle)
+				continue;
+
+			rc = cam_mem_get_io_buf(
+				frm_proc->cmd_buf[i][j].mem_handle,
+				hw_mgr->iommu_cdm_hdl, &iova_addr, &buf_len);
+			if (rc) {
+				CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+					hw_mgr->iommu_hdl);
+				return NULL;
+			}
+			iova_addr = iova_addr + frm_proc->cmd_buf[i][j].offset;
+
+			rc = cam_mem_get_cpu_buf(
+				frm_proc->cmd_buf[i][j].mem_handle,
+				&cpu_addr, &buf_len);
+			if (rc || !cpu_addr) {
+				CAM_ERR(CAM_OPE, "get cmd buf failed %x",
+					hw_mgr->iommu_hdl);
+				return NULL;
+			}
+
+			cpu_addr = cpu_addr + frm_proc->cmd_buf[i][j].offset;
+			if (frm_proc->cmd_buf[i][j].type ==
+				OPE_CMD_BUF_TYPE_DIRECT) {
+				kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+					iova_addr,
+					frm_proc->cmd_buf[i][j].length);
+				print_ptr = (uint32_t *)cpu_addr;
+				if (hw_mgr->frame_dump_enable)
+					dump_direct_cmd(print_idx, print_ptr,
+						frm_proc, i, j);
+			} else {
+				num_dmi = frm_proc->cmd_buf[i][j].length /
+					sizeof(struct cdm_dmi_cmd);
+				CAM_DBG(CAM_OPE, "Frame DB : In direct: E");
+				print_ptr = (uint32_t *)cpu_addr;
+				for (print_idx = 0;
+					print_idx < num_dmi; print_idx++) {
+					memcpy(temp, (const void *)print_ptr,
+						sizeof(struct cdm_dmi_cmd));
+					dmi_cmd = (struct cdm_dmi_cmd *)temp;
+					if (!dmi_cmd->addr) {
+						CAM_ERR(CAM_OPE,
+							"Null dmi cmd addr");
+						cam_mem_put_cpu_buf(
+							frm_proc->cmd_buf[i][j].mem_handle);
+						return NULL;
+					}
+
+					kmd_buf = cdm_ops->cdm_write_dmi(
+						kmd_buf,
+						0, dmi_cmd->DMIAddr,
+						dmi_cmd->DMISel, dmi_cmd->addr,
+						dmi_cmd->length);
+					if (hw_mgr->frame_dump_enable)
+						dump_dmi_cmd(print_idx,
+							print_ptr, dmi_cmd,
+							temp);
+					print_ptr +=
+						sizeof(struct cdm_dmi_cmd) /
+						sizeof(uint32_t);
+				}
+				CAM_DBG(CAM_OPE, "Frame DB : In direct: X");
+			}
+			if (hw_mgr->frame_dump_enable)
+				dump_frame_cmd(frm_proc, i, j,
+					iova_addr, kmd_buf, buf_len);
+
+			cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][j].mem_handle);
+		}
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripe_cmd(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data,
+	uint32_t *kmd_buf,
+	int batch_idx,
+	int s_idx,
+	uint32_t stripe_idx,
+	struct ope_frame_process *frm_proc)
+{
+	int rc = 0, i, j, k;
+	uint32_t temp[3];
+	struct cdm_dmi_cmd *dmi_cmd;
+	dma_addr_t iova_addr;
+	uintptr_t cpu_addr;
+	size_t buf_len;
+	uint32_t print_idx;
+	uint32_t *print_ptr;
+	int num_dmi = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+	uint32_t reg_val_pair[2];
+	struct cam_hw_info *ope_dev;
+	struct cam_ope_device_core_info *core_info;
+	struct ope_hw *ope_hw;
+	struct cam_ope_top_reg *top_reg;
+
+	if (s_idx >= OPE_MAX_CMD_BUFS ||
+		batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid inputs: %d %d",
+			batch_idx, s_idx);
+		return NULL;
+	}
+
+	i = batch_idx;
+	j = s_idx;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	/* cmd buffer stripes */
+	for (k = 0; k < frm_proc->num_cmd_bufs[i]; k++) {
+		if (frm_proc->cmd_buf[i][k].cmd_buf_scope !=
+			OPE_CMD_BUF_SCOPE_STRIPE)
+			continue;
+
+		if (frm_proc->cmd_buf[i][k].stripe_idx !=
+			stripe_idx)
+			continue;
+
+		if (!frm_proc->cmd_buf[i][k].mem_handle)
+			continue;
+
+		CAM_DBG(CAM_OPE, "process stripe %d", stripe_idx);
+		rc = cam_mem_get_io_buf(frm_proc->cmd_buf[i][k].mem_handle,
+			hw_mgr->iommu_cdm_hdl,
+			&iova_addr, &buf_len);
+		if (rc) {
+			CAM_DBG(CAM_OPE, "get cmd buf fail %x",
+				hw_mgr->iommu_hdl);
+			return NULL;
+		}
+		iova_addr = iova_addr + frm_proc->cmd_buf[i][k].offset;
+		rc = cam_mem_get_cpu_buf(frm_proc->cmd_buf[i][k].mem_handle,
+			&cpu_addr, &buf_len);
+		if (rc || !cpu_addr) {
+			CAM_DBG(CAM_OPE, "get cmd buf fail %x",
+				hw_mgr->iommu_hdl);
+			return NULL;
+		}
+		cpu_addr = cpu_addr + frm_proc->cmd_buf[i][k].offset;
+
+		if (frm_proc->cmd_buf[i][k].type == OPE_CMD_BUF_TYPE_DIRECT) {
+			kmd_buf = cdm_ops->cdm_write_indirect(
+				kmd_buf,
+				iova_addr,
+				frm_proc->cmd_buf[i][k].length);
+			print_ptr = (uint32_t *)cpu_addr;
+			CAM_DBG(CAM_OPE, "Stripe:%d direct:E",
+				stripe_idx);
+			if (hw_mgr->frame_dump_enable)
+				dump_direct_cmd(print_idx, print_ptr,
+					frm_proc, i, k);
+			CAM_DBG(CAM_OPE, "Stripe:%d direct:X", stripe_idx);
+		} else if (frm_proc->cmd_buf[i][k].type ==
+			OPE_CMD_BUF_TYPE_INDIRECT) {
+			num_dmi = frm_proc->cmd_buf[i][j].length /
+				sizeof(struct cdm_dmi_cmd);
+			CAM_DBG(CAM_OPE, "Stripe:%d Indirect:E", stripe_idx);
+			print_ptr = (uint32_t *)cpu_addr;
+			for (print_idx = 0; print_idx < num_dmi; print_idx++) {
+				memcpy(temp, (const void *)print_ptr,
+					sizeof(struct cdm_dmi_cmd));
+				dmi_cmd = (struct cdm_dmi_cmd *)temp;
+				if (!dmi_cmd->addr) {
+					CAM_ERR(CAM_OPE, "Null dmi cmd addr");
+					cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][k].mem_handle);
+					return NULL;
+				}
+
+				kmd_buf = cdm_ops->cdm_write_dmi(kmd_buf,
+					0, dmi_cmd->DMIAddr, dmi_cmd->DMISel,
+					dmi_cmd->addr, dmi_cmd->length);
+				if (hw_mgr->frame_dump_enable)
+					dump_dmi_cmd(print_idx,
+						print_ptr, dmi_cmd, temp);
+				print_ptr += sizeof(struct cdm_dmi_cmd) /
+					sizeof(uint32_t);
+			}
+			CAM_DBG(CAM_OPE, "Stripe:%d Indirect:X", stripe_idx);
+		}
+
+		if (hw_mgr->frame_dump_enable)
+			dump_stripe_cmd(frm_proc, stripe_idx, i, k,
+				iova_addr, kmd_buf, buf_len);
+
+		cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][k].mem_handle);
+	}
+
+	ope_dev = hw_mgr->ope_dev_intf[0]->hw_priv;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	ope_hw = core_info->ope_hw_info->ope_hw;
+	top_reg = ope_hw->top_reg;
+
+	reg_val_pair[0] = top_reg->offset + top_reg->scratch_reg;
+	reg_val_pair[1] = stripe_idx;
+	kmd_buf = cdm_ops->cdm_write_regrandom(kmd_buf, 1, reg_val_pair);
+
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripe_wr(struct cam_ope_ctx *ctx_data,
+	uint32_t stripe_idx, struct ope_bus_wr_io_port_cdm_info *wr_cdm_info,
+	struct cam_ope_request *ope_request, uint32_t *kmd_buf)
+{
+	struct cam_cdm_utils_ops *cdm_ops;
+	int k;
+
+	if (stripe_idx >= OPE_MAX_STRIPES) {
+		CAM_ERR(CAM_OPE, "invalid s_idx = %d", stripe_idx);
+		return NULL;
+	}
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	for (k = 0; k < wr_cdm_info->num_s_cmd_bufs[stripe_idx]; k++) {
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			wr_cdm_info->s_cdm_info[stripe_idx][k].offset,
+			wr_cdm_info->s_cdm_info[stripe_idx][k].len);
+		CAM_DBG(CAM_OPE, "WR stripe:%d %d kmdbuf:%x",
+			stripe_idx, k, kmd_buf);
+		CAM_DBG(CAM_OPE, "offset:%d len:%d iova:%x %pK",
+			wr_cdm_info->s_cdm_info[stripe_idx][k].offset,
+			wr_cdm_info->s_cdm_info[stripe_idx][k].len,
+			ope_request->ope_kmd_buf.iova_cdm_addr,
+			ope_request->ope_kmd_buf.iova_cdm_addr);
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripe_rd(struct cam_ope_ctx *ctx_data,
+	uint32_t stripe_idx, struct ope_bus_rd_io_port_cdm_info *rd_cdm_info,
+	struct cam_ope_request *ope_request, uint32_t *kmd_buf)
+{
+	struct cam_cdm_utils_ops *cdm_ops;
+	int k;
+
+	if (stripe_idx >= OPE_MAX_STRIPES) {
+		CAM_ERR(CAM_OPE, "invalid s_idx = %d", stripe_idx);
+		return NULL;
+	}
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	for (k = 0; k < rd_cdm_info->num_s_cmd_bufs[stripe_idx]; k++) {
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			rd_cdm_info->s_cdm_info[stripe_idx][k].offset,
+			rd_cdm_info->s_cdm_info[stripe_idx][k].len);
+		CAM_DBG(CAM_OPE, "WR stripe:%d %d kmdbuf:%x",
+			stripe_idx, k, kmd_buf);
+		CAM_DBG(CAM_OPE, "offset:%d len:%d iova:%x %pK",
+			rd_cdm_info->s_cdm_info[stripe_idx][k].offset,
+			rd_cdm_info->s_cdm_info[stripe_idx][k].len,
+			ope_request->ope_kmd_buf.iova_cdm_addr,
+			ope_request->ope_kmd_buf.iova_cdm_addr);
+	}
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripes_batch(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf, int batch_idx,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int i, j;
+	struct cam_ope_request *ope_request;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	uint32_t stripe_idx = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	if (batch_idx >= OPE_MAX_BATCH_SIZE) {
+		CAM_ERR(CAM_OPE, "Invalid input: %d", batch_idx);
+		return NULL;
+	}
+	i = batch_idx;
+	/* Stripes */
+
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[i];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[i];
+	for (j = 0; j < ope_request->num_stripes[i]; j++) {
+		/* cmd buffer stripes */
+		kmd_buf = ope_create_stripe_cmd(hw_mgr, ctx_data,
+			kmd_buf, i, j, stripe_idx, frm_proc);
+		if (!kmd_buf)
+			goto end;
+
+		/* WR stripes */
+		kmd_buf = ope_create_stripe_wr(ctx_data, stripe_idx,
+			wr_cdm_info, ope_request, kmd_buf);
+		if (!kmd_buf)
+			goto end;
+
+		/* RD stripes */
+		kmd_buf = ope_create_stripe_rd(ctx_data, stripe_idx,
+			rd_cdm_info, ope_request, kmd_buf);
+		if (!kmd_buf)
+			goto end;
+
+		/* add go command */
+		kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+		(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+		rd_cdm_info->go_cmd_offset,
+		rd_cdm_info->go_cmd_len);
+
+		CAM_DBG(CAM_OPE, "Go cmd for stripe:%d kmd_buf:%x",
+			stripe_idx, kmd_buf);
+		CAM_DBG(CAM_OPE, "iova:%x %pK",
+			ope_request->ope_kmd_buf.iova_cdm_addr,
+			ope_request->ope_kmd_buf.iova_cdm_addr);
+
+		/* wait for RUP done */
+		kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+			OPE_WAIT_COMP_RUP, 0x0);
+		CAM_DBG(CAM_OPE, "wait RUP cmd stripe:%d kmd_buf:%x",
+			stripe_idx, kmd_buf);
+		stripe_idx++;
+	}
+
+end:
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripes(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int i, j;
+	struct cam_ope_request *ope_request;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	uint32_t stripe_idx = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	/* Stripes */
+	for (i = 0; i < frm_proc->batch_size; i++) {
+		wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[i];
+		rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[i];
+		for (j = 0; j < ope_request->num_stripes[i]; j++) {
+			/* cmd buffer stripes */
+			kmd_buf = ope_create_stripe_cmd(hw_mgr, ctx_data,
+				kmd_buf, i, j, stripe_idx, frm_proc);
+			if (!kmd_buf)
+				goto end;
+
+			/* WR stripes */
+			kmd_buf = ope_create_stripe_wr(ctx_data, stripe_idx,
+				wr_cdm_info, ope_request, kmd_buf);
+			if (!kmd_buf)
+				goto end;
+
+			/* RD stripes */
+			kmd_buf = ope_create_stripe_rd(ctx_data, stripe_idx,
+				rd_cdm_info, ope_request, kmd_buf);
+			if (!kmd_buf)
+				goto end;
+
+			/* add go command */
+			kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			rd_cdm_info->go_cmd_offset,
+			rd_cdm_info->go_cmd_len);
+
+			CAM_DBG(CAM_OPE, "Go cmd for stripe:%d kmd_buf:%x",
+				stripe_idx, kmd_buf);
+			CAM_DBG(CAM_OPE, "iova:%x %pK",
+				ope_request->ope_kmd_buf.iova_cdm_addr,
+				ope_request->ope_kmd_buf.iova_cdm_addr);
+
+			/* wait for RUP done */
+			kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+				OPE_WAIT_COMP_RUP, 0x0);
+			CAM_DBG(CAM_OPE, "wait RUP cmd stripe:%d kmd_buf:%x",
+				stripe_idx, kmd_buf);
+			stripe_idx++;
+		}
+	}
+end:
+	return kmd_buf;
+}
+
+static uint32_t *ope_create_stripes_nrt(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t *kmd_buf,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req,
+	uint32_t *kmd_buf_offset, uint32_t **cdm_kmd_start_addr)
+{
+	int i, j;
+	struct cam_ope_request *ope_request;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	uint32_t stripe_idx = 0;
+	struct cam_cdm_utils_ops *cdm_ops;
+	uint32_t len;
+	int num_nrt_stripes, num_arb;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	num_nrt_stripes = ctx_data->ope_acquire.nrt_stripes_for_arb;
+	num_arb = ope_request->num_stripes[0] /
+		ctx_data->ope_acquire.nrt_stripes_for_arb;
+	if (ope_request->num_stripes[0] %
+		ctx_data->ope_acquire.nrt_stripes_for_arb)
+		num_arb++;
+	CAM_DBG(CAM_OPE, "Number of ARB for snap: %d", num_arb);
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	/* Stripes */
+	for (i = 0; i < frm_proc->batch_size; i++) {
+		wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[i];
+		rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[i];
+		for (j = 0; j < ope_request->num_stripes[i]; j++) {
+			CAM_DBG(CAM_OPE, "num_nrt_stripes = %d num_arb = %d",
+				num_nrt_stripes, num_arb);
+			if (!num_nrt_stripes) {
+				kmd_buf = cdm_ops->cdm_write_wait_comp_event(
+					kmd_buf,
+					OPE_WAIT_COMP_IDLE, 0x0);
+				len = (kmd_buf - *cdm_kmd_start_addr) *
+					sizeof(uint32_t);
+				cam_ope_dev_prepare_cdm_request(
+					ope_dev_prepare_req->hw_mgr,
+					ope_dev_prepare_req->prepare_args,
+					ope_dev_prepare_req->ctx_data,
+					ope_dev_prepare_req->req_idx,
+					*kmd_buf_offset, ope_dev_prepare_req,
+					len, true);
+				*cdm_kmd_start_addr = kmd_buf;
+				*kmd_buf_offset += len;
+			}
+			/* cmd buffer stripes */
+			kmd_buf = ope_create_stripe_cmd(hw_mgr, ctx_data,
+				kmd_buf, i, j, stripe_idx, frm_proc);
+			if (!kmd_buf)
+				goto end;
+
+			/* WR stripes */
+			kmd_buf = ope_create_stripe_wr(ctx_data, stripe_idx,
+				wr_cdm_info, ope_request, kmd_buf);
+			if (!kmd_buf)
+				goto end;
+
+			/* RD stripes */
+			kmd_buf = ope_create_stripe_rd(ctx_data, stripe_idx,
+				rd_cdm_info, ope_request, kmd_buf);
+			if (!kmd_buf)
+				goto end;
+
+			if (!num_nrt_stripes) {
+				/* For num_nrt_stripes create CDM BL with ARB */
+				/* Add Frame level cmds in this condition */
+				/* Frame 0 DB */
+				kmd_buf = ope_create_frame_cmd(hw_mgr,
+					ctx_data, req_idx,
+					kmd_buf, OPE_CMD_BUF_DOUBLE_BUFFERED,
+					ope_dev_prepare_req);
+				if (!kmd_buf)
+					goto end;
+
+				/* Frame 0 SB */
+				kmd_buf = ope_create_frame_cmd(hw_mgr,
+					ctx_data, req_idx,
+					kmd_buf, OPE_CMD_BUF_SINGLE_BUFFERED,
+					ope_dev_prepare_req);
+				if (!kmd_buf)
+					goto end;
+
+				/* Frame 0 WR */
+				kmd_buf = ope_create_frame_wr(ctx_data,
+					wr_cdm_info, kmd_buf, ope_request);
+				if (!kmd_buf)
+					goto end;
+
+				/* Frame 0 RD */
+				kmd_buf = ope_create_frame_rd(ctx_data,
+					rd_cdm_info, kmd_buf, ope_request);
+				if (!kmd_buf)
+					goto end;
+				num_arb--;
+				num_nrt_stripes =
+				ctx_data->ope_acquire.nrt_stripes_for_arb;
+			}
+			// add go command
+			kmd_buf = cdm_ops->cdm_write_indirect(kmd_buf,
+			(uint32_t)ope_request->ope_kmd_buf.iova_cdm_addr +
+			rd_cdm_info->go_cmd_offset,
+			rd_cdm_info->go_cmd_len);
+
+			CAM_DBG(CAM_OPE, "Go cmd for stripe:%d kmd_buf:%x",
+				stripe_idx, kmd_buf);
+			CAM_DBG(CAM_OPE, "iova:%x %pK",
+				ope_request->ope_kmd_buf.iova_cdm_addr,
+				ope_request->ope_kmd_buf.iova_cdm_addr);
+
+			// wait for RUP done
+			kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+				OPE_WAIT_COMP_RUP, 0x0);
+			CAM_DBG(CAM_OPE, "wait RUP cmd stripe:%d kmd_buf:%x",
+				stripe_idx, kmd_buf);
+			stripe_idx++;
+			num_nrt_stripes--;
+		}
+	}
+end:
+	return kmd_buf;
+}
+
+static int cam_ope_dev_create_kmd_buf_nrt(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t kmd_buf_offset,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0;
+	uint32_t len;
+	struct cam_ope_request *ope_request;
+	uint32_t *kmd_buf;
+	uint32_t *cdm_kmd_start_addr;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		(kmd_buf_offset / sizeof(len));
+	cdm_kmd_start_addr = kmd_buf;
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[0];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[0];
+
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+
+	kmd_buf = cdm_ops->cdm_write_clear_comp_event(kmd_buf,
+				OPE_WAIT_COMP_IDLE|OPE_WAIT_COMP_RUP, 0x0);
+
+	/* Frame 0 DB */
+	kmd_buf = ope_create_frame_cmd(hw_mgr,
+		ctx_data, req_idx,
+		kmd_buf, OPE_CMD_BUF_DOUBLE_BUFFERED,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 SB */
+	kmd_buf = ope_create_frame_cmd(hw_mgr,
+		ctx_data, req_idx,
+		kmd_buf, OPE_CMD_BUF_SINGLE_BUFFERED,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 WR */
+	kmd_buf = ope_create_frame_wr(ctx_data,
+		wr_cdm_info, kmd_buf, ope_request);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 RD */
+	kmd_buf = ope_create_frame_rd(ctx_data,
+		rd_cdm_info, kmd_buf, ope_request);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Stripes */
+	kmd_buf = ope_create_stripes_nrt(hw_mgr, ctx_data, req_idx, kmd_buf,
+		ope_dev_prepare_req, &kmd_buf_offset, &cdm_kmd_start_addr);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Last arbitration if there are odd number of stripes */
+	/* wait_idle_irq */
+	kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+		OPE_WAIT_COMP_IDLE, 0x0);
+
+	/* prepare CDM submit packet */
+	len = (kmd_buf - cdm_kmd_start_addr) * sizeof(uint32_t);
+	cam_ope_dev_prepare_cdm_request(ope_dev_prepare_req->hw_mgr,
+		ope_dev_prepare_req->prepare_args,
+		ope_dev_prepare_req->ctx_data, ope_dev_prepare_req->req_idx,
+		kmd_buf_offset, ope_dev_prepare_req,
+		len, false);
+end:
+	return rc;
+}
+
+static int cam_ope_dev_create_kmd_buf_batch(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t kmd_buf_offset,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0, i;
+	uint32_t len;
+	struct cam_ope_request *ope_request;
+	uint32_t *kmd_buf;
+	uint32_t *cdm_kmd_start_addr;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct ope_frame_process *frm_proc;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+	frm_proc = ope_dev_prepare_req->frame_process;
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		(kmd_buf_offset / sizeof(len));
+	cdm_kmd_start_addr = kmd_buf;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	kmd_buf = cdm_ops->cdm_write_clear_comp_event(kmd_buf,
+				OPE_WAIT_COMP_IDLE|OPE_WAIT_COMP_RUP, 0x0);
+
+	for (i = 0; i < frm_proc->batch_size; i++) {
+		wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[i];
+		rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[i];
+
+		/* After second batch DB programming add prefecth dis */
+		if (i) {
+			kmd_buf =
+				cdm_ops->cdm_write_wait_prefetch_disable(
+				kmd_buf, 0x0,
+				OPE_WAIT_COMP_IDLE, 0x0);
+		}
+
+		/* Frame i DB */
+		kmd_buf = ope_create_frame_cmd_batch(hw_mgr,
+			ctx_data, req_idx,
+			kmd_buf, OPE_CMD_BUF_DOUBLE_BUFFERED, i,
+			ope_dev_prepare_req);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Frame i SB */
+		kmd_buf = ope_create_frame_cmd_batch(hw_mgr,
+			ctx_data, req_idx,
+			kmd_buf, OPE_CMD_BUF_SINGLE_BUFFERED, i,
+			ope_dev_prepare_req);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Frame i WR */
+		kmd_buf = ope_create_frame_wr(ctx_data,
+			wr_cdm_info, kmd_buf, ope_request);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Frame i RD */
+		kmd_buf = ope_create_frame_rd(ctx_data,
+			rd_cdm_info, kmd_buf, ope_request);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Stripe level programming for batch i */
+			/* Stripes */
+		kmd_buf = ope_create_stripes_batch(hw_mgr, ctx_data, req_idx,
+			kmd_buf, i, ope_dev_prepare_req);
+		if (!kmd_buf) {
+			rc = -EINVAL;
+			goto end;
+		}
+	}
+
+	/* wait_idle_irq */
+	kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+			OPE_WAIT_COMP_IDLE, 0x0);
+
+	/* prepare CDM submit packet */
+	len = (kmd_buf - cdm_kmd_start_addr) * sizeof(uint32_t);
+	cam_ope_dev_prepare_cdm_request(ope_dev_prepare_req->hw_mgr,
+		ope_dev_prepare_req->prepare_args,
+		ope_dev_prepare_req->ctx_data, ope_dev_prepare_req->req_idx,
+		kmd_buf_offset, ope_dev_prepare_req,
+		len, false);
+
+end:
+	return rc;
+}
+
+static int cam_ope_dev_create_kmd_buf(struct cam_ope_hw_mgr *hw_mgr,
+	struct cam_hw_prepare_update_args *prepare_args,
+	struct cam_ope_ctx *ctx_data, uint32_t req_idx,
+	uint32_t kmd_buf_offset,
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req)
+{
+	int rc = 0;
+	uint32_t len;
+	struct cam_ope_request *ope_request;
+	uint32_t *kmd_buf;
+	uint32_t *cdm_kmd_start_addr;
+	struct ope_bus_wr_io_port_cdm_info *wr_cdm_info;
+	struct ope_bus_rd_io_port_cdm_info *rd_cdm_info;
+	struct cam_cdm_utils_ops *cdm_ops;
+
+
+	if (ctx_data->ope_acquire.dev_type == OPE_DEV_TYPE_OPE_NRT) {
+		return cam_ope_dev_create_kmd_buf_nrt(
+			ope_dev_prepare_req->hw_mgr,
+			ope_dev_prepare_req->prepare_args,
+			ope_dev_prepare_req->ctx_data,
+			ope_dev_prepare_req->req_idx,
+			ope_dev_prepare_req->kmd_buf_offset,
+			ope_dev_prepare_req);
+	}
+
+	if (ctx_data->ope_acquire.batch_size > 1) {
+		return cam_ope_dev_create_kmd_buf_batch(
+		ope_dev_prepare_req->hw_mgr,
+		ope_dev_prepare_req->prepare_args,
+		ope_dev_prepare_req->ctx_data,
+		ope_dev_prepare_req->req_idx,
+		ope_dev_prepare_req->kmd_buf_offset,
+		ope_dev_prepare_req);
+	}
+
+	ope_request = ctx_data->req_list[req_idx];
+	kmd_buf = (uint32_t *)ope_request->ope_kmd_buf.cpu_addr +
+		(kmd_buf_offset / sizeof(len));
+	cdm_kmd_start_addr = kmd_buf;
+	cdm_ops = ctx_data->ope_cdm.cdm_ops;
+	wr_cdm_info =
+		&ope_dev_prepare_req->wr_cdm_batch->io_port_cdm[0];
+	rd_cdm_info =
+		&ope_dev_prepare_req->rd_cdm_batch->io_port_cdm[0];
+
+
+	CAM_DBG(CAM_OPE, "kmd_buf:%x req_idx:%d req_id:%lld offset:%d",
+		kmd_buf, req_idx, ope_request->request_id, kmd_buf_offset);
+
+	kmd_buf = cdm_ops->cdm_write_clear_comp_event(kmd_buf,
+				OPE_WAIT_COMP_IDLE|OPE_WAIT_COMP_RUP, 0x0);
+	/* Frame 0 DB */
+	kmd_buf = ope_create_frame_cmd(hw_mgr,
+		ctx_data, req_idx,
+		kmd_buf, OPE_CMD_BUF_DOUBLE_BUFFERED,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 SB */
+	kmd_buf = ope_create_frame_cmd(hw_mgr,
+		ctx_data, req_idx,
+		kmd_buf, OPE_CMD_BUF_SINGLE_BUFFERED,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 WR */
+	kmd_buf = ope_create_frame_wr(ctx_data,
+		wr_cdm_info, kmd_buf, ope_request);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Frame 0 RD */
+	kmd_buf = ope_create_frame_rd(ctx_data,
+		rd_cdm_info, kmd_buf, ope_request);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* Stripes */
+	kmd_buf = ope_create_stripes(hw_mgr, ctx_data, req_idx, kmd_buf,
+		ope_dev_prepare_req);
+	if (!kmd_buf) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+	/* wait_idle_irq */
+	kmd_buf = cdm_ops->cdm_write_wait_comp_event(kmd_buf,
+			OPE_WAIT_COMP_IDLE, 0x0);
+
+	CAM_DBG(CAM_OPE, "wait for idle IRQ: kmd_buf:%x", kmd_buf);
+
+	/* prepare CDM submit packet */
+	len = (kmd_buf - cdm_kmd_start_addr) * sizeof(uint32_t);
+	CAM_DBG(CAM_OPE, "kmd_start_addr:%x kmdbuf_addr:%x len:%d",
+		cdm_kmd_start_addr, kmd_buf, len);
+	cam_ope_dev_prepare_cdm_request(
+		ope_dev_prepare_req->hw_mgr,
+		ope_dev_prepare_req->prepare_args,
+		ope_dev_prepare_req->ctx_data,
+		ope_dev_prepare_req->req_idx,
+		ope_dev_prepare_req->kmd_buf_offset,
+		ope_dev_prepare_req,
+		len, false);
+end:
+	return rc;
+}
+
+static int cam_ope_dev_process_prepare(struct ope_hw *ope_hw, void *cmd_args)
+{
+	int rc = 0;
+	struct cam_ope_dev_prepare_req *ope_dev_prepare_req;
+
+	ope_dev_prepare_req = cmd_args;
+
+	rc = cam_ope_top_process(ope_hw, ope_dev_prepare_req->ctx_data->ctx_id,
+		OPE_HW_PREPARE, ope_dev_prepare_req);
+	if (rc)
+		goto end;
+
+	rc = cam_ope_bus_rd_process(ope_hw,
+		ope_dev_prepare_req->ctx_data->ctx_id,
+		OPE_HW_PREPARE, ope_dev_prepare_req);
+	if (rc)
+		goto end;
+
+	rc = cam_ope_bus_wr_process(ope_hw,
+		ope_dev_prepare_req->ctx_data->ctx_id,
+		OPE_HW_PREPARE, ope_dev_prepare_req);
+	if (rc)
+		goto end;
+
+	rc = cam_ope_dev_create_kmd_buf(ope_dev_prepare_req->hw_mgr,
+			ope_dev_prepare_req->prepare_args,
+			ope_dev_prepare_req->ctx_data,
+			ope_dev_prepare_req->req_idx,
+			ope_dev_prepare_req->kmd_buf_offset,
+			ope_dev_prepare_req);
+
+end:
+	return rc;
+}
+
+static int cam_ope_dev_process_probe(struct ope_hw *ope_hw,
+	void *cmd_args)
+{
+	cam_ope_top_process(ope_hw, -1, OPE_HW_PROBE, NULL);
+	cam_ope_bus_rd_process(ope_hw, -1, OPE_HW_PROBE, NULL);
+	cam_ope_bus_wr_process(ope_hw, -1, OPE_HW_PROBE, NULL);
+
+	return 0;
+}
+
+static int cam_ope_process_probe(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	struct cam_ope_dev_probe *ope_probe = cmd_args;
+
+	if (!ope_probe->hfi_en)
+		return cam_ope_dev_process_probe(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_dump_debug_reg(struct ope_hw *ope_hw,
+	bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_dump_debug_reg(ope_hw);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_reset(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_reset(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_release(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_release(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_acquire(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_acquire(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+static int cam_ope_process_prepare(struct ope_hw *ope_hw,
+	void *cmd_args, bool hfi_en)
+{
+	if (!hfi_en)
+		return cam_ope_dev_process_prepare(ope_hw, cmd_args);
+
+	return -EINVAL;
+}
+
+int cam_ope_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size)
+{
+	int rc = 0;
+	struct    cam_hw_info *ope_dev = device_priv;
+	struct    cam_hw_soc_info *soc_info = NULL;
+	struct    cam_ope_device_core_info *core_info = NULL;
+	struct    cam_ope_match_pid_args  *match_pid_mid = NULL;
+	struct    ope_hw *ope_hw;
+	bool      hfi_en;
+	unsigned long flags;
+	int i;
+	uint32_t device_idx;
+
+	if (!device_priv) {
+		CAM_ERR(CAM_OPE, "Invalid args %x for cmd %u",
+			device_priv, cmd_type);
+		return -EINVAL;
+	}
+
+	soc_info = &ope_dev->soc_info;
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	if ((!soc_info) || (!core_info)) {
+		CAM_ERR(CAM_OPE, "soc_info = %x core_info = %x",
+			soc_info, core_info);
+		return -EINVAL;
+	}
+
+	hfi_en = core_info->ope_hw_info->hfi_en;
+	ope_hw = core_info->ope_hw_info->ope_hw;
+	if (!ope_hw) {
+		CAM_ERR(CAM_OPE, "Invalid ope hw info");
+		return -EINVAL;
+	}
+
+	switch (cmd_type) {
+	case OPE_HW_PROBE:
+		rc = cam_ope_process_probe(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_ACQUIRE:
+		rc = cam_ope_process_acquire(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_RELEASE:
+		rc = cam_ope_process_release(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_PREPARE:
+		rc = cam_ope_process_prepare(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_START:
+		break;
+	case OPE_HW_STOP:
+		break;
+	case OPE_HW_FLUSH:
+		break;
+	case OPE_HW_RESET:
+		rc = cam_ope_process_reset(ope_hw, cmd_args, hfi_en);
+		break;
+	case OPE_HW_CLK_UPDATE: {
+		struct cam_ope_dev_clk_update *clk_upd_cmd =
+			(struct cam_ope_dev_clk_update *)cmd_args;
+
+		if (core_info->clk_enable == false) {
+			rc = cam_soc_util_clk_enable_default(soc_info,
+				CAM_SVS_VOTE);
+			if (rc) {
+				CAM_ERR(CAM_OPE, "Clock enable is failed");
+				return rc;
+			}
+			core_info->clk_enable = true;
+		}
+
+		rc = cam_ope_update_clk_rate(soc_info, clk_upd_cmd->clk_rate);
+		if (rc)
+			CAM_ERR(CAM_OPE, "Failed to update clk: %d", rc);
+		}
+		break;
+	case OPE_HW_CLK_DISABLE: {
+		if (core_info->clk_enable == true)
+			cam_soc_util_clk_disable_default(soc_info);
+
+		core_info->clk_enable = false;
+		}
+		break;
+	case OPE_HW_BW_UPDATE: {
+		struct cam_ope_dev_bw_update *cpas_vote = cmd_args;
+
+		if (!cmd_args)
+			return -EINVAL;
+
+		rc = cam_ope_caps_vote(core_info, cpas_vote);
+		if (rc)
+			CAM_ERR(CAM_OPE, "failed to update bw: %d", rc);
+		}
+		break;
+	case OPE_HW_SET_IRQ_CB: {
+		struct cam_ope_set_irq_cb *irq_cb = cmd_args;
+
+		if (!cmd_args) {
+			CAM_ERR(CAM_OPE, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		spin_lock_irqsave(&ope_dev->hw_lock, flags);
+		core_info->irq_cb.ope_hw_mgr_cb = irq_cb->ope_hw_mgr_cb;
+		core_info->irq_cb.data = irq_cb->data;
+		spin_unlock_irqrestore(&ope_dev->hw_lock, flags);
+		}
+		break;
+	case OPE_HW_DUMP_DEBUG:
+		rc = cam_ope_process_dump_debug_reg(ope_hw, hfi_en);
+		break;
+	case OPE_HW_MATCH_PID_MID:
+		if (!cmd_args) {
+			CAM_ERR(CAM_OPE, "cmd args NULL");
+			return -EINVAL;
+		}
+
+		match_pid_mid = (struct cam_ope_match_pid_args *)cmd_args;
+		match_pid_mid->mid_match_found = false;
+
+		device_idx = match_pid_mid->device_idx;
+
+		for (i = 0; i < MAX_RW_CLIENTS; i++) {
+			if ((match_pid_mid->fault_mid ==
+				ope_hw->common->ope_mid_info[device_idx][i].mid) &&
+				(match_pid_mid->fault_pid ==
+				ope_hw->common->ope_mid_info[device_idx][i].pid)) {
+				match_pid_mid->match_res =
+				ope_hw->common->ope_mid_info[device_idx][i].cam_ope_res_type;
+				match_pid_mid->mid_match_found = true;
+				break;
+			}
+		}
+		if (!match_pid_mid->mid_match_found) {
+			rc = -1;
+			CAM_INFO(CAM_OPE, "mid match not found");
+		}
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+irqreturn_t cam_ope_irq(int irq_num, void *data)
+{
+	struct cam_hw_info *ope_dev = data;
+	struct cam_ope_device_core_info *core_info = NULL;
+	struct ope_hw *ope_hw;
+	struct cam_ope_irq_data irq_data;
+
+	if (!data) {
+		CAM_ERR(CAM_OPE, "Invalid cam_dev_info or query_cap args");
+		return IRQ_HANDLED;
+	}
+
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	ope_hw = core_info->ope_hw_info->ope_hw;
+
+	irq_data.error = 0;
+	cam_ope_top_process(ope_hw, 0, OPE_HW_ISR, &irq_data);
+	cam_ope_bus_rd_process(ope_hw, 0, OPE_HW_ISR, &irq_data);
+	cam_ope_bus_wr_process(ope_hw, 0, OPE_HW_ISR, &irq_data);
+
+
+	spin_lock(&ope_dev->hw_lock);
+	if (core_info->irq_cb.ope_hw_mgr_cb && core_info->irq_cb.data)
+		if (irq_data.error)
+			core_info->irq_cb.ope_hw_mgr_cb(irq_data.error,
+				core_info->irq_cb.data);
+	spin_unlock(&ope_dev->hw_lock);
+
+
+	return IRQ_HANDLED;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.h
@@ -0,0 +1,102 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_CORE_H
+#define CAM_OPE_CORE_H
+
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/dma-buf.h>
+#include <media/cam_ope.h>
+#include "cam_cpas_api.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+
+#define CAM_OPE_HW_MAX_NUM_PID 2
+
+/**
+ * struct cam_ope_cpas_vote
+ * @ahb_vote: AHB vote info
+ * @axi_vote: AXI vote info
+ * @ahb_vote_valid: Flag for ahb vote data
+ * @axi_vote_valid: flag for axi vote data
+ */
+struct cam_ope_cpas_vote {
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote;
+	uint32_t ahb_vote_valid;
+	uint32_t axi_vote_valid;
+};
+
+/**
+ * struct cam_ope_device_hw_info
+ *
+ * @ope_hw:          OPE hardware
+ * @hw_idx:          Hardware index
+ * @ope_cdm_base:    Base address of CDM
+ * @ope_top_base:    Base address of top
+ * @ope_qos_base:    Base address of QOS
+ * @ope_pp_base:     Base address of PP
+ * @ope_bus_rd_base: Base address of RD
+ * @ope_bus_wr_base: Base address of WM
+ * @hfi_en:          HFI flag enable
+ * @reserved:        Reserved
+ */
+struct cam_ope_device_hw_info {
+	struct ope_hw *ope_hw;
+	uint32_t hw_idx;
+	void *ope_cdm_base;
+	void *ope_top_base;
+	void *ope_qos_base;
+	void *ope_pp_base;
+	void *ope_bus_rd_base;
+	void *ope_bus_wr_base;
+	bool hfi_en;
+	uint32_t reserved;
+};
+
+/**
+ * struct cam_ope_device_core_info
+ *
+ * @ope_hw_info: OPE hardware info
+ * @hw_version:  Hardware version
+ * @hw_idx:      Hardware Index
+ * @hw_type:     Hardware Type
+ * @cpas_handle: CPAS Handle
+ * @cpas_start:  CPAS start flag
+ * @clk_enable:  Clock enable flag
+ * @irq_cb:      IRQ Callback
+ */
+struct cam_ope_device_core_info {
+	struct cam_ope_device_hw_info *ope_hw_info;
+	uint32_t hw_version;
+	uint32_t hw_idx;
+	uint32_t hw_type;
+	uint32_t cpas_handle;
+	bool cpas_start;
+	bool clk_enable;
+	struct cam_ope_set_irq_cb irq_cb;
+};
+
+int cam_ope_init_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ope_deinit_hw(void *device_priv,
+	void *init_hw_args, uint32_t arg_size);
+int cam_ope_start(void *device_priv,
+	void *start_args, uint32_t arg_size);
+int cam_ope_stop(void *device_priv,
+	void *stop_args, uint32_t arg_size);
+int cam_ope_flush(void *device_priv,
+	void *flush_args, uint32_t arg_size);
+int cam_ope_get_hw_caps(void *device_priv,
+	void *get_hw_cap_args, uint32_t arg_size);
+int cam_ope_process_cmd(void *device_priv, uint32_t cmd_type,
+	void *cmd_args, uint32_t arg_size);
+irqreturn_t cam_ope_irq(int irq_num, void *data);
+
+#endif /* CAM_OPE_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev.c
@@ -0,0 +1,338 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/mod_devicetable.h>
+#include <linux/of_device.h>
+#include <linux/timer.h>
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_hw.h"
+#include "ope_hw.h"
+#include "cam_hw_intf.h"
+#include "cam_io_util.h"
+#include "cam_ope_hw_mgr_intf.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "ope_hw_100.h"
+#include "ope_dev_intf.h"
+#include "camera_main.h"
+
+static struct cam_ope_hw_intf_data cam_ope_dev_list[OPE_DEV_MAX];
+static struct cam_ope_device_hw_info ope_hw_info;
+struct cam_ope_soc_private ope_soc_info;
+EXPORT_SYMBOL(ope_soc_info);
+
+static struct hw_version_reg ope_hw_version_reg = {
+	.hw_ver = 0x0,
+};
+
+static char ope_dev_name[8];
+
+static int cam_ope_init_hw_version(struct cam_hw_soc_info *soc_info,
+	struct cam_ope_device_core_info *core_info)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_OPE, "soc_info = %x core_info = %x",
+		soc_info, core_info);
+	CAM_DBG(CAM_OPE, "CDM:%x TOP: %x QOS: %x PP: %x RD: %x WR: %x",
+		soc_info->reg_map[OPE_CDM_BASE].mem_base,
+		soc_info->reg_map[OPE_TOP_BASE].mem_base,
+		soc_info->reg_map[OPE_QOS_BASE].mem_base,
+		soc_info->reg_map[OPE_PP_BASE].mem_base,
+		soc_info->reg_map[OPE_BUS_RD].mem_base,
+		soc_info->reg_map[OPE_BUS_WR].mem_base);
+	CAM_DBG(CAM_OPE, "core: %x",
+		core_info->ope_hw_info->ope_cdm_base);
+
+	core_info->ope_hw_info->ope_cdm_base =
+		soc_info->reg_map[OPE_CDM_BASE].mem_base;
+	core_info->ope_hw_info->ope_top_base =
+		soc_info->reg_map[OPE_TOP_BASE].mem_base;
+	core_info->ope_hw_info->ope_qos_base =
+		soc_info->reg_map[OPE_QOS_BASE].mem_base;
+	core_info->ope_hw_info->ope_pp_base =
+		soc_info->reg_map[OPE_PP_BASE].mem_base;
+	core_info->ope_hw_info->ope_bus_rd_base =
+		soc_info->reg_map[OPE_BUS_RD].mem_base;
+	core_info->ope_hw_info->ope_bus_wr_base =
+		soc_info->reg_map[OPE_BUS_WR].mem_base;
+
+	core_info->hw_version = cam_io_r_mb(
+			core_info->ope_hw_info->ope_top_base +
+			ope_hw_version_reg.hw_ver);
+
+	switch (core_info->hw_version) {
+	case OPE_HW_VER_1_0_0:
+	case OPE_HW_VER_1_1_0:
+		core_info->ope_hw_info->ope_hw = &ope_hw_100;
+		break;
+	default:
+		CAM_ERR(CAM_OPE, "Unsupported version : %u",
+			core_info->hw_version);
+		rc = -EINVAL;
+		break;
+	}
+
+	ope_hw_100.top_reg->base = core_info->ope_hw_info->ope_top_base;
+	ope_hw_100.bus_rd_reg->base = core_info->ope_hw_info->ope_bus_rd_base;
+	ope_hw_100.bus_wr_reg->base = core_info->ope_hw_info->ope_bus_wr_base;
+	ope_hw_100.pp_reg->base = core_info->ope_hw_info->ope_pp_base;
+
+	return rc;
+}
+
+int cam_ope_register_cpas(struct cam_hw_soc_info *soc_info,
+	struct cam_ope_device_core_info *core_info,
+	uint32_t hw_idx)
+{
+	struct cam_cpas_register_params cpas_register_params;
+	int rc;
+
+	cpas_register_params.dev = &soc_info->pdev->dev;
+	memcpy(cpas_register_params.identifier, "ope", sizeof("ope"));
+	cpas_register_params.cam_cpas_client_cb = NULL;
+	cpas_register_params.cell_index = hw_idx;
+	cpas_register_params.userdata = NULL;
+
+	rc = cam_cpas_register_client(&cpas_register_params);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "failed: %d", rc);
+		return rc;
+	}
+	core_info->cpas_handle = cpas_register_params.client_handle;
+
+	return rc;
+}
+
+static int cam_ope_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_hw_intf                *ope_dev_intf = NULL;
+	struct cam_hw_info                *ope_dev = NULL;
+	const struct of_device_id         *match_dev = NULL;
+	struct cam_ope_device_core_info   *core_info = NULL;
+	struct cam_ope_dev_probe           ope_probe;
+	struct cam_ope_cpas_vote           cpas_vote;
+	struct cam_ope_soc_private        *soc_private;
+	int i;
+	uint32_t hw_idx;
+	int rc = 0;
+
+	struct platform_device *pdev = to_platform_device(dev);
+
+	of_property_read_u32(pdev->dev.of_node,
+		"cell-index", &hw_idx);
+
+	ope_dev_intf = kzalloc(sizeof(struct cam_hw_intf), GFP_KERNEL);
+	if (!ope_dev_intf)
+		return -ENOMEM;
+
+	ope_dev_intf->hw_idx = hw_idx;
+	ope_dev_intf->hw_type = OPE_DEV_OPE;
+	ope_dev = kzalloc(sizeof(struct cam_hw_info), GFP_KERNEL);
+	if (!ope_dev) {
+		rc = -ENOMEM;
+		goto ope_dev_alloc_failed;
+	}
+
+	memset(ope_dev_name, 0, sizeof(ope_dev_name));
+	snprintf(ope_dev_name, sizeof(ope_dev_name),
+		"ope%1u", ope_dev_intf->hw_idx);
+
+	ope_dev->soc_info.pdev = pdev;
+	ope_dev->soc_info.dev = &pdev->dev;
+	ope_dev->soc_info.dev_name = ope_dev_name;
+	ope_dev_intf->hw_priv = ope_dev;
+	ope_dev_intf->hw_ops.init = cam_ope_init_hw;
+	ope_dev_intf->hw_ops.deinit = cam_ope_deinit_hw;
+	ope_dev_intf->hw_ops.get_hw_caps = cam_ope_get_hw_caps;
+	ope_dev_intf->hw_ops.start = cam_ope_start;
+	ope_dev_intf->hw_ops.stop = cam_ope_stop;
+	ope_dev_intf->hw_ops.flush = cam_ope_flush;
+	ope_dev_intf->hw_ops.process_cmd = cam_ope_process_cmd;
+
+	CAM_DBG(CAM_OPE, "type %d index %d",
+		ope_dev_intf->hw_type,
+		ope_dev_intf->hw_idx);
+
+	if (ope_dev_intf->hw_idx < OPE_DEV_MAX)
+		cam_ope_dev_list[ope_dev_intf->hw_idx].hw_intf =
+			ope_dev_intf;
+
+	platform_set_drvdata(pdev, ope_dev_intf);
+
+
+	ope_dev->core_info = kzalloc(sizeof(struct cam_ope_device_core_info),
+		GFP_KERNEL);
+	if (!ope_dev->core_info) {
+		rc = -ENOMEM;
+		goto ope_core_alloc_failed;
+	}
+	core_info = (struct cam_ope_device_core_info *)ope_dev->core_info;
+	core_info->ope_hw_info = &ope_hw_info;
+	ope_dev->soc_info.soc_private = &ope_soc_info;
+
+	match_dev = of_match_device(pdev->dev.driver->of_match_table,
+		&pdev->dev);
+	if (!match_dev) {
+		rc = -EINVAL;
+		CAM_DBG(CAM_OPE, "No ope hardware info");
+		goto ope_match_dev_failed;
+	}
+
+	rc = cam_ope_init_soc_resources(&ope_dev->soc_info, cam_ope_irq,
+		ope_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "failed to init_soc");
+		goto init_soc_failed;
+	}
+	core_info->hw_type = OPE_DEV_OPE;
+	core_info->hw_idx = hw_idx;
+	rc = cam_ope_register_cpas(&ope_dev->soc_info,
+		core_info, ope_dev_intf->hw_idx);
+	if (rc < 0)
+		goto register_cpas_failed;
+
+	rc = cam_ope_enable_soc_resources(&ope_dev->soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_OPE, "enable soc resorce failed: %d", rc);
+		goto enable_soc_failed;
+	}
+	cpas_vote.ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	cpas_vote.ahb_vote.vote.level = CAM_SVS_VOTE;
+	cpas_vote.axi_vote.num_paths = 1;
+	cpas_vote.axi_vote.axi_path[0].path_data_type =
+		CAM_AXI_PATH_DATA_OPE_WR_VID;
+	cpas_vote.axi_vote.axi_path[0].transac_type =
+		CAM_AXI_TRANSACTION_WRITE;
+	cpas_vote.axi_vote.axi_path[0].camnoc_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].mnoc_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].ddr_ab_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+	cpas_vote.axi_vote.axi_path[0].ddr_ib_bw =
+		CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(core_info->cpas_handle,
+		&cpas_vote.ahb_vote, &cpas_vote.axi_vote);
+
+	rc = cam_ope_init_hw_version(&ope_dev->soc_info, ope_dev->core_info);
+	if (rc)
+		goto init_hw_failure;
+
+	cam_ope_disable_soc_resources(&ope_dev->soc_info, true);
+	cam_cpas_stop(core_info->cpas_handle);
+	ope_dev->hw_state = CAM_HW_STATE_POWER_DOWN;
+
+	ope_probe.hfi_en = ope_soc_info.hfi_en;
+	cam_ope_process_cmd(ope_dev, OPE_HW_PROBE,
+		&ope_probe, sizeof(ope_probe));
+	mutex_init(&ope_dev->hw_mutex);
+	spin_lock_init(&ope_dev->hw_lock);
+	init_completion(&ope_dev->hw_complete);
+
+	CAM_DBG(CAM_OPE, "OPE:%d component bound successfully",
+		ope_dev_intf->hw_idx);
+	soc_private = ope_dev->soc_info.soc_private;
+	cam_ope_dev_list[ope_dev_intf->hw_idx].num_hw_pid =
+		soc_private->num_pid;
+
+	for (i = 0; i < soc_private->num_pid; i++)
+		cam_ope_dev_list[ope_dev_intf->hw_idx].hw_pid[i] =
+			soc_private->pid[i];
+
+	return rc;
+
+init_hw_failure:
+enable_soc_failed:
+register_cpas_failed:
+init_soc_failed:
+ope_match_dev_failed:
+	kfree(ope_dev->core_info);
+ope_core_alloc_failed:
+	kfree(ope_dev);
+ope_dev_alloc_failed:
+	kfree(ope_dev_intf);
+	return rc;
+}
+
+static void cam_ope_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_OPE, "Unbinding component: %s", pdev->name);
+}
+
+int cam_ope_hw_init(struct cam_ope_hw_intf_data **ope_hw_intf_data,
+		uint32_t hw_idx)
+{
+	int rc = 0;
+
+	if (cam_ope_dev_list[hw_idx].hw_intf) {
+		*ope_hw_intf_data = &cam_ope_dev_list[hw_idx];
+		rc = 0;
+	} else {
+		CAM_ERR(CAM_OPE, "inval param");
+		*ope_hw_intf_data = NULL;
+		rc = -ENODEV;
+	}
+	return rc;
+}
+
+const static struct component_ops cam_ope_component_ops = {
+	.bind = cam_ope_component_bind,
+	.unbind = cam_ope_component_unbind,
+};
+
+int cam_ope_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_OPE, "Adding OPE component");
+	rc = component_add(&pdev->dev, &cam_ope_component_ops);
+	if (rc)
+		CAM_ERR(CAM_OPE, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static const struct of_device_id cam_ope_dt_match[] = {
+	{
+		.compatible = "qcom,ope",
+		.data = &ope_hw_version_reg,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_ope_dt_match);
+
+struct platform_driver cam_ope_driver = {
+	.probe = cam_ope_probe,
+	.driver = {
+		.name = "ope",
+		.of_match_table = cam_ope_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_ope_init_module(void)
+{
+	return platform_driver_register(&cam_ope_driver);
+}
+
+void cam_ope_exit_module(void)
+{
+	platform_driver_unregister(&cam_ope_driver);
+}
+
+MODULE_DESCRIPTION("CAM OPE driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_dev_intf.h
@@ -0,0 +1,186 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_DEV_INTF_H
+#define CAM_OPE_DEV_INTF_H
+
+#include <media/cam_ope.h>
+#include "cam_ope_hw_mgr.h"
+#include "cam_cdm_intf_api.h"
+#include "cam_cpas_api.h"
+
+
+#define OPE_HW_INIT          0x1
+#define OPE_HW_DEINIT        0x2
+#define OPE_HW_ACQUIRE       0x3
+#define OPE_HW_RELEASE       0x4
+#define OPE_HW_START         0x5
+#define OPE_HW_STOP          0x6
+#define OPE_HW_FLUSH         0x7
+#define OPE_HW_PREPARE       0x8
+#define OPE_HW_ISR           0x9
+#define OPE_HW_PROBE         0xA
+#define OPE_HW_CLK_UPDATE    0xB
+#define OPE_HW_BW_UPDATE     0xC
+#define OPE_HW_RESET         0xD
+#define OPE_HW_SET_IRQ_CB    0xE
+#define OPE_HW_CLK_DISABLE   0xF
+#define OPE_HW_CLK_ENABLE    0x10
+#define OPE_HW_DUMP_DEBUG    0x11
+#define OPE_HW_MATCH_PID_MID     0x12
+
+struct cam_ope_match_pid_args {
+	uint32_t    fault_pid;
+	uint32_t    fault_mid;
+	uint32_t    match_res;
+	uint32_t    device_idx;
+	bool        mid_match_found;
+};
+
+/**
+ * struct cam_ope_dev_probe
+ *
+ * @hfi_en: HFI enable flag
+ */
+struct cam_ope_dev_probe {
+	bool hfi_en;
+};
+
+/**
+ * struct cam_ope_dev_init
+ *
+ * @hfi_en:    HFI enable flag
+ * @core_info: OPE core info
+ */
+struct cam_ope_dev_init {
+	bool hfi_en;
+	struct cam_ope_device_core_info *core_info;
+};
+
+/**
+ * struct cam_ope_dev_clk_update
+ *
+ * @clk_rate: Clock rate
+ */
+struct cam_ope_dev_clk_update {
+	uint32_t clk_rate;
+};
+
+/**
+ * struct cam_ope_dev_bw_update
+ *
+ * @ahb_vote:       AHB vote info
+ * @axi_vote:       AXI vote info
+ * @ahb_vote_valid: Flag for ahb vote
+ * @axi_vote_valid: Flag for axi vote
+ */
+struct cam_ope_dev_bw_update {
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote;
+	uint32_t ahb_vote_valid;
+	uint32_t axi_vote_valid;
+};
+
+/**
+ * struct cam_ope_dev_caps
+ *
+ * @hw_idx: Hardware index
+ * @hw_ver: Hardware version info
+ */
+struct cam_ope_dev_caps {
+	uint32_t hw_idx;
+	struct ope_hw_ver hw_ver;
+};
+
+/**
+ * struct cam_ope_dev_acquire
+ *
+ * @ctx_id:      Context id
+ * @ope_acquire: OPE acquire info
+ * @bus_wr_ctx:  Bus Write context
+ * @bus_rd_ctx:  Bus Read context
+ */
+struct cam_ope_dev_acquire {
+	uint32_t ctx_id;
+	struct ope_acquire_dev_info *ope_acquire;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+};
+
+/**
+ * struct cam_ope_dev_release
+ *
+ * @ctx_id:      Context id
+ * @bus_wr_ctx:  Bus Write context
+ * @bus_rd_ctx:  Bus Read context
+ */
+struct cam_ope_dev_release {
+	uint32_t ctx_id;
+	struct ope_bus_wr_ctx *bus_wr_ctx;
+	struct ope_bus_rd_ctx *bus_rd_ctx;
+};
+
+/**
+ * struct cam_ope_set_irq_cb
+ *
+ * @ope_hw_mgr_cb: Callback to hardware manager
+ * @data:          Private data
+ */
+struct cam_ope_set_irq_cb {
+	int32_t (*ope_hw_mgr_cb)(uint32_t irq_status, void *data);
+	void *data;
+};
+
+/**
+ * struct cam_ope_irq_data
+ *
+ * @error: IRQ error
+ */
+struct cam_ope_irq_data {
+	uint32_t error;
+};
+
+/**
+ * struct cam_ope_dev_prepare_req
+ *
+ * @hw_mgr:         OPE hardware manager
+ * @packet:         Packet
+ * @prepare_args:   Prepare request args
+ * @ctx_data:       Context data
+ * @wr_cdm_batch:   WM request
+ * @rd_cdm_batch:   RD master request
+ * @frame_process:  Frame process command
+ * @req_idx:        Request Index
+ * @kmd_buf_offset: KMD buffer offset
+ */
+struct cam_ope_dev_prepare_req {
+	struct cam_ope_hw_mgr *hw_mgr;
+	struct cam_packet *packet;
+	struct cam_hw_prepare_update_args *prepare_args;
+	struct cam_ope_ctx *ctx_data;
+	struct ope_bus_wr_io_port_cdm_batch *wr_cdm_batch;
+	struct ope_bus_rd_io_port_cdm_batch *rd_cdm_batch;
+	struct ope_frame_process *frame_process;
+	uint32_t req_idx;
+	uint32_t kmd_buf_offset;
+};
+
+int cam_ope_top_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data);
+
+int cam_ope_bus_rd_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data);
+
+int cam_ope_bus_wr_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data);
+
+int cam_ope_init_module(void);
+void cam_ope_exit_module(void);
+
+int cam_ope_subdev_init_module(void);
+void cam_ope_subdev_exit_module(void);
+
+#endif /* CAM_OPE_DEV_INTF_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_hw.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_hw.h
@@ -0,0 +1,435 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_HW_H
+#define CAM_OPE_HW_H
+
+#define OPE_HW_VER_1_0_0 0x10000000
+#define OPE_HW_VER_1_1_0 0x10010000
+
+#define OPE_DEV_OPE  0
+#define OPE_DEV_MAX  1
+
+#define MAX_RD_CLIENTS   3
+#define MAX_WR_CLIENTS   8
+#define MAX_PP_CLIENTS   32
+
+#define MAX_RW_CLIENTS   (MAX_RD_CLIENTS + MAX_WR_CLIENTS)
+
+#define OPE_CDM_BASE     0x0
+#define OPE_TOP_BASE     0x1
+#define OPE_QOS_BASE     0x2
+#define OPE_PP_BASE      0x3
+#define OPE_BUS_RD       0x4
+#define OPE_BUS_WR       0x5
+#define OPE_BASE_MAX     0x6
+
+#define BUS_RD_COMBO_BAYER_MASK   0x1
+#define BUS_RD_COMBO_YUV_MASK     0x2
+#define BUS_RD_COMBO_MAX          0x2
+
+#define BUS_RD_BAYER         0x0
+#define BUS_RD_YUV           0x1
+
+#define BUS_WR_COMBO_YUV_MASK    0x1
+#define BUS_WR_COMBO_MAX         0x1
+
+#define BUS_WR_YUV           0x0
+
+#define BUS_WR_VIDEO_Y       0x0
+#define BUS_WR_VIDEO_C       0x1
+#define BUS_WR_DISP_Y        0x2
+#define BUS_WR_DISP_C        0x3
+#define BUS_WR_ARGB          0x4
+#define BUS_WR_STATS_RS      0x5
+#define BUS_WR_STATS_IHIST   0x6
+#define BUS_WR_STATS_LTM     0x7
+
+#define OPE_WAIT_COMP_RUP     0x1
+#define OPE_WAIT_COMP_WR_DONE 0x2
+#define OPE_WAIT_COMP_IDLE    0x4
+#define OPE_WAIT_COMP_GEN_IRQ 0x8
+
+#define OPE_MAX_DEBUG_REGISTER 30
+
+struct cam_ope_pid_mid_info {
+	int cam_ope_res_type;
+	uint32_t pid;
+	uint32_t mid;
+	bool read;
+};
+
+struct cam_ope_common {
+	uint32_t mode[CAM_FORMAT_MAX];
+	struct cam_ope_pid_mid_info (*ope_mid_info)[MAX_RW_CLIENTS];
+};
+
+struct cam_ope_top_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t reset_cmd;
+	uint32_t core_clk_cfg_ctrl_0;
+	uint32_t ahb_clk_cgc_ctrl;
+	uint32_t core_cfg;
+	uint32_t irq_status;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_set;
+	uint32_t irq_cmd;
+	uint32_t violation_status;
+	uint32_t throttle_cnt_cfg;
+	uint32_t debug_cfg;
+	uint32_t scratch_reg;
+	uint32_t num_debug_registers;
+	struct cam_ope_debug_register *debug_regs;
+};
+
+struct cam_ope_top_reg_val {
+	uint32_t hw_version;
+	uint32_t major_mask;
+	uint32_t major_shift;
+	uint32_t minor_mask;
+	uint32_t minor_shift;
+	uint32_t incr_mask;
+	uint32_t incr_shift;
+	uint32_t irq_mask;
+	uint32_t irq_set_clear;
+	uint32_t sw_reset_cmd;
+	uint32_t hw_reset_cmd;
+	uint32_t core_clk_cfg_ctrl_0;
+	uint32_t ahb_clk_cgc_ctrl;
+	uint32_t input_format;
+	uint32_t input_format_mask;
+	uint32_t color_correct_src_sel;
+	uint32_t color_correct_src_sel_mask;
+	uint32_t stats_ihist_src_sel;
+	uint32_t stats_ihist_src_sel_mask;
+	uint32_t chroma_up_src_sel;
+	uint32_t chroma_up_src_sel_mask;
+	uint32_t argb_alpha;
+	uint32_t argb_alpha_mask;
+	uint32_t rs_throttle_cnt;
+	uint32_t rs_throttle_cnt_mask;
+	uint32_t ihist_throttle_cnt;
+	uint32_t ihist_throttle_cnt_mask;
+	uint32_t rst_done;
+	uint32_t we_done;
+	uint32_t fe_done;
+	uint32_t ope_violation;
+	uint32_t idle;
+	uint32_t debug_cfg_val;
+};
+
+struct cam_ope_qos_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t hw_status;
+	uint32_t module_cfg;
+	uint32_t curve_cfg_0;
+	uint32_t curve_cfg_1;
+	uint32_t window_cfg;
+	uint32_t eos_status_0;
+	uint32_t eos_status_1;
+	uint32_t eos_status_2;
+};
+
+struct cam_ope_qos_reg_val {
+	uint32_t hw_version;
+	uint32_t proc_interval;
+	uint32_t proc_interval_mask;
+	uint32_t static_health;
+	uint32_t static_health_mask;
+	uint32_t module_cfg_en;
+	uint32_t module_cfg_en_mask;
+	uint32_t yexp_ymin_dec;
+	uint32_t yexp_ymin_dec_mask;
+	uint32_t ymin_inc;
+	uint32_t ymin_inc_mask;
+	uint32_t initial_delta;
+	uint32_t initial_delta_mask;
+	uint32_t window_cfg;
+};
+
+struct cam_ope_bus_rd_client_reg {
+	uint32_t core_cfg;
+	uint32_t ccif_meta_data;
+	uint32_t img_addr;
+	uint32_t img_cfg;
+	uint32_t stride;
+	uint32_t unpack_cfg;
+	uint32_t latency_buf_allocation;
+	uint32_t misr_cfg_0;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_val;
+};
+
+struct cam_ope_bus_rd_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t sw_reset;
+	uint32_t cgc_override;
+	uint32_t irq_mask;
+	uint32_t irq_clear;
+	uint32_t irq_cmd;
+	uint32_t irq_status;
+	uint32_t input_if_cmd;
+	uint32_t irq_set;
+	uint32_t misr_reset;
+	uint32_t security_cfg;
+	uint32_t iso_cfg;
+	uint32_t iso_seed;
+
+	uint32_t num_clients;
+	struct cam_ope_bus_rd_client_reg rd_clients[MAX_RD_CLIENTS];
+};
+
+struct cam_ope_bus_rd_client_reg_val {
+	uint32_t core_cfg;
+	uint32_t stripe_location;
+	uint32_t stripe_location_mask;
+	uint32_t stripe_location_shift;
+	uint32_t pix_pattern;
+	uint32_t pix_pattern_mask;
+	uint32_t pix_pattern_shift;
+	uint32_t img_addr;
+	uint32_t img_width;
+	uint32_t img_width_mask;
+	uint32_t img_width_shift;
+	uint32_t img_height;
+	uint32_t img_height_mask;
+	uint32_t img_height_shift;
+	uint32_t stride;
+	uint32_t mode;
+	uint32_t mode_mask;
+	uint32_t mode_shift;
+	uint32_t alignment;
+	uint32_t alignment_mask;
+	uint32_t alignment_shift;
+	uint32_t latency_buf_allocation;
+	uint32_t misr_cfg_samp_mode;
+	uint32_t misr_cfg_samp_mode_mask;
+	uint32_t misr_cfg_en;
+	uint32_t misr_cfg_en_mask;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_val;
+	uint32_t input_port_id;
+	uint32_t rm_port_id;
+	uint32_t format_type;
+	uint32_t num_combos_supported;
+};
+
+struct cam_ope_bus_rd_reg_val {
+	uint32_t hw_version;
+	uint32_t sw_reset;
+	uint32_t cgc_override;
+	uint32_t irq_mask;
+	uint32_t go_cmd;
+	uint32_t go_cmd_mask;
+	uint32_t ica_en;
+	uint32_t ica_en_mask;
+	uint32_t static_prg;
+	uint32_t static_prg_mask;
+	uint32_t go_cmd_sel;
+	uint32_t go_cmd_sel_mask;
+	uint32_t fs_sync_en;
+	uint32_t fs_sync_en_mask;
+	uint32_t misr_reset;
+	uint32_t security_cfg;
+	uint32_t iso_bpp_select;
+	uint32_t iso_bpp_select_mask;
+	uint32_t iso_pattern_select;
+	uint32_t iso_pattern_select_mask;
+	uint32_t iso_en;
+	uint32_t iso_en_mask;
+	uint32_t iso_seed;
+	uint32_t irq_set_clear;
+	uint32_t rst_done;
+	uint32_t rup_done;
+	uint32_t rd_buf_done;
+	uint32_t violation;
+	uint32_t latency_buf_size;
+
+	uint32_t num_clients;
+	struct cam_ope_bus_rd_client_reg_val rd_clients[MAX_RD_CLIENTS];
+};
+
+struct cam_ope_bus_wr_client_reg {
+	uint32_t core_cfg;
+	uint32_t img_addr;
+	uint32_t img_cfg;
+	uint32_t x_init;
+	uint32_t stride;
+	uint32_t pack_cfg;
+	uint32_t bw_limit;
+	uint32_t frame_header_addr;
+	uint32_t subsample_period;
+	uint32_t subsample_pattern;
+};
+
+struct cam_ope_bus_wr_reg {
+	void *base;
+	uint32_t offset;
+	uint32_t hw_version;
+	uint32_t cgc_override;
+	uint32_t irq_mask_0;
+	uint32_t irq_mask_1;
+	uint32_t irq_clear_0;
+	uint32_t irq_clear_1;
+	uint32_t irq_status_0;
+	uint32_t irq_status_1;
+	uint32_t irq_cmd;
+	uint32_t frame_header_cfg_0;
+	uint32_t local_frame_header_cfg_0;
+	uint32_t irq_set_0;
+	uint32_t irq_set_1;
+	uint32_t iso_cfg;
+	uint32_t violation_status;
+	uint32_t image_size_violation_status;
+	uint32_t misr_cfg_0;
+	uint32_t misr_cfg_1;
+	uint32_t misr_rd_sel;
+	uint32_t misr_reset;
+	uint32_t misr_val;
+	uint32_t num_clients;
+	struct cam_ope_bus_wr_client_reg wr_clients[MAX_WR_CLIENTS];
+};
+
+struct cam_ope_bus_wr_client_reg_val {
+	uint32_t core_cfg_en;
+	uint32_t core_cfg_en_mask;
+	uint32_t core_cfg_en_shift;
+	uint32_t virtual_frame_en;
+	uint32_t virtual_frame_en_mask;
+	uint32_t virtual_frame_en_shift;
+	uint32_t frame_header_en;
+	uint32_t frame_header_en_mask;
+	uint32_t frame_header_en_shift;
+	uint32_t auto_recovery_en;
+	uint32_t auto_recovery_en_mask;
+	uint32_t auto_recovery_en_shift;
+	uint32_t mode;
+	uint32_t mode_mask;
+	uint32_t mode_shift;
+	uint32_t img_addr;
+	uint32_t width;
+	uint32_t width_mask;
+	uint32_t width_shift;
+	uint32_t height;
+	uint32_t height_mask;
+	uint32_t height_shift;
+	uint32_t x_init;
+	uint32_t stride;
+	uint32_t format;
+	uint32_t format_mask;
+	uint32_t format_shift;
+	uint32_t alignment;
+	uint32_t alignment_mask;
+	uint32_t alignment_shift;
+	uint32_t bw_limit_en;
+	uint32_t bw_limit_en_mask;
+	uint32_t bw_limit_counter;
+	uint32_t bw_limit_counter_mask;
+	uint32_t frame_header_addr;
+	uint32_t subsample_period;
+	uint32_t subsample_pattern;
+	uint32_t output_port_id;
+	uint32_t wm_port_id;
+	uint32_t format_type;
+	uint32_t num_combos_supported;
+};
+
+struct cam_ope_bus_wr_reg_val {
+	uint32_t hw_version;
+	uint32_t cgc_override;
+	uint32_t irq_mask_0;
+	uint32_t irq_mask_1;
+	uint32_t irq_set_clear;
+	uint32_t comp_rup_done;
+	uint32_t comp_buf_done;
+	uint32_t cons_violation;
+	uint32_t violation;
+	uint32_t img_size_violation;
+	uint32_t frame_header_cfg_0;
+	uint32_t local_frame_header_cfg_0;
+	uint32_t iso_cfg;
+	uint32_t misr_0_en;
+	uint32_t misr_0_en_mask;
+	uint32_t misr_1_en;
+	uint32_t misr_1_en_mask;
+	uint32_t misr_2_en;
+	uint32_t misr_2_en_mask;
+	uint32_t misr_3_en;
+	uint32_t misr_3_en_mask;
+	uint32_t misr_0_samp_mode;
+	uint32_t misr_0_samp_mode_mask;
+	uint32_t misr_1_samp_mode;
+	uint32_t misr_1_samp_mode_mask;
+	uint32_t misr_2_samp_mode;
+	uint32_t misr_2_samp_mode_mask;
+	uint32_t misr_3_samp_mode;
+	uint32_t misr_3_samp_mode_mask;
+	uint32_t misr_0_id;
+	uint32_t misr_0_id_mask;
+	uint32_t misr_1_id;
+	uint32_t misr_1_id_mask;
+	uint32_t misr_2_id;
+	uint32_t misr_2_id_mask;
+	uint32_t misr_3_id;
+	uint32_t misr_3_id_mask;
+	uint32_t misr_rd_misr_sel;
+	uint32_t misr_rd_misr_sel_mask;
+	uint32_t misr_rd_word_sel;
+	uint32_t misr_rd_word_sel_mask;
+	uint32_t misr_reset;
+	uint32_t misr_val;
+
+
+	uint32_t num_clients;
+	struct cam_ope_bus_wr_client_reg_val wr_clients[MAX_WR_CLIENTS];
+};
+
+struct cam_ope_debug_register {
+	uint32_t offset;
+};
+
+struct cam_ope_bus_pp_client_reg {
+	uint32_t hw_status;
+};
+
+struct cam_ope_pp_reg {
+	void *base;
+	uint32_t offset;
+
+	uint32_t num_clients;
+	struct cam_ope_bus_pp_client_reg pp_clients[MAX_PP_CLIENTS];
+};
+
+struct ope_hw {
+	struct cam_ope_top_reg        *top_reg;
+	struct cam_ope_top_reg_val    *top_reg_val;
+
+	struct cam_ope_bus_rd_reg     *bus_rd_reg;
+	struct cam_ope_bus_rd_reg_val *bus_rd_reg_val;
+
+	struct cam_ope_bus_wr_reg     *bus_wr_reg;
+	struct cam_ope_bus_wr_reg_val *bus_wr_reg_val;
+
+	struct cam_ope_qos_reg        *qos_reg;
+	struct cam_ope_qos_reg_val    *qos_reg_val;
+
+	struct cam_ope_common         *common;
+
+	struct cam_ope_pp_reg        *pp_reg;
+};
+
+struct hw_version_reg {
+	uint32_t hw_ver;
+	uint32_t reserved;
+};
+
+#endif /* CAM_OPE_HW_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_hw_100.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_hw_100.h
@@ -0,0 +1,752 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_HW_100_H
+#define CAM_OPE_HW_100_H
+
+#define OPE_BUS_RD_TYPE_BAYER            0x0
+#define OPE_BUS_RD_TYPE_YUV_Y            0x0
+#define OPE_BUS_RD_TYPE_YUC_C            0x1
+#define OPE_BUS_RD_TYPE_CDM              0x2
+
+#define OPE_BUS_WR_TYPE_VID_Y            0x0
+#define OPE_BUS_WR_TYPE_VID_C            0x1
+#define OPE_BUS_WR_TYPE_DISP_Y           0x2
+#define OPE_BUS_WR_TYPE_DISP_C           0x3
+#define OPE_BUS_WR_TYPE_ARGB             0x4
+#define OPE_BUS_WR_TYPE_RS               0x5
+#define OPE_BUS_WR_TYPE_IHIST            0x6
+#define OPE_BUS_WR_TYPE_LTM              0x7
+
+static struct cam_ope_pid_mid_info g_ope_mid_info[OPE_DEV_MAX][MAX_RW_CLIENTS] = {
+	{
+		{
+			.cam_ope_res_type = OPE_IN_RES_FULL,
+			.pid = 0,
+			.mid = 0,
+			.read = true,
+		},
+		{
+			.cam_ope_res_type = OPE_IN_RES_FULL,
+			.pid = 0,
+			.mid = 1,
+			.read = true,
+		},
+		{
+			.cam_ope_res_type = OPE_IN_RES_FULL,
+			.pid = 0,
+			.mid = 2,
+			.read = true,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_VIDEO,
+			.pid = 1,
+			.mid = 16,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_VIDEO,
+			.pid = 1,
+			.mid = 17,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_DISP,
+			.pid = 1,
+			.mid = 18,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_DISP,
+			.pid = 1,
+			.mid = 19,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_ARGB,
+			.pid = 1,
+			.mid = 20,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_STATS_RS,
+			.pid = 1,
+			.mid = 21,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_STATS_IHIST,
+			.pid = 1,
+			.mid = 22,
+			.read = false,
+		},
+		{
+			.cam_ope_res_type = OPE_OUT_RES_STATS_LTM,
+			.pid = 1,
+			.mid = 23,
+			.read = false,
+		},
+	},
+};
+
+static struct cam_ope_common common_data = {
+	.ope_mid_info = g_ope_mid_info,
+};
+
+enum cam_ope_bus_rd_unpacker_format {
+	BUS_RD_VER1_PACKER_FMT_PLAIN_128_BYPASS            = 0x0,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_8                     = 0x1,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_16_10BPP              = 0x2,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_16_12BPP              = 0x3,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_16_14BPP              = 0x4,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_32_20BPP              = 0x5,
+	BUS_RD_VER1_PACKER_FMT_ARGB16_10                   = 0x6,
+	BUS_RD_VER1_PACKER_FMT_ARGB16_12                   = 0x7,
+	BUS_RD_VER1_PACKER_FMT_ARGB16_14                   = 0x8,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_32                    = 0x9,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_64                    = 0xA,
+	BUS_RD_VER1_PACKER_FMT_TP_10                       = 0xB,
+	BUS_RD_VER1_PACKER_FMT_MIPI_8                      = 0xC,
+	BUS_RD_VER1_PACKER_FMT_MIPI_10                     = 0xD,
+	BUS_RD_VER1_PACKER_FMT_MIPI_12                     = 0xE,
+	BUS_RD_VER1_PACKER_FMT_MIPI_14                     = 0xF,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_16_16BPP              = 0x10,
+	BUS_RD_VER1_PACKER_FMT_BYPASS_SWAP                 = 0x11,
+	BUS_RD_VER1_PACKER_FMT_PLAIN_8_SWAP                = 0x12,
+	BUS_RD_VER1_PACKER_FMT_MAX                         = 0x13,
+};
+
+static struct cam_ope_debug_register ope_debug_regs[OPE_MAX_DEBUG_REGISTER] = {
+	{
+		.offset = 0xA0,
+	},
+	{
+		.offset = 0xA4
+	},
+	{
+		.offset = 0xA8,
+	},
+	{
+		.offset = 0xAC,
+	},
+	{
+		.offset = 0xB0,
+	},
+	{
+		.offset = 0xB4,
+	},
+	{
+		.offset = 0xB8,
+	},
+	{
+		.offset = 0xBC,
+	},
+	{
+		.offset = 0xD0,
+	},
+	{
+		.offset = 0xD4,
+	},
+};
+
+static struct cam_ope_top_reg ope_top_reg = {
+	.offset              = 0x400,
+	.hw_version          = 0x0,
+	.reset_cmd           = 0x4,
+	.core_clk_cfg_ctrl_0 = 0x8,
+	.ahb_clk_cgc_ctrl    = 0xC,
+	.core_cfg            = 0x10,
+	.irq_status          = 0x14,
+	.irq_mask            = 0x18,
+	.irq_clear           = 0x1C,
+	.irq_set             = 0x20,
+	.irq_cmd             = 0x24,
+	.violation_status    = 0x28,
+	.throttle_cnt_cfg    = 0x2C,
+	.debug_cfg           = 0xDC,
+	.scratch_reg         = 0x1F0,
+	.num_debug_registers = 10,
+	.debug_regs          = ope_debug_regs,
+};
+
+static struct cam_ope_top_reg_val ope_top_reg_val = {
+	.hw_version    = 0x10000000,
+	.major_mask    = 0xFFFF,
+	.major_shift   = 0x0,
+	.minor_mask    = 0x0FFF0000,
+	.minor_shift   = 0xF,
+	.incr_mask     = 0xF0000000,
+	.incr_shift    = 0x1B,
+	.irq_mask      = 0x0000000F,
+	.sw_reset_cmd  = 0x2,
+	.hw_reset_cmd  = 0x1,
+	.irq_set_clear = 0x1,
+	.rst_done      = 0x1,
+	.we_done       = 0x2,
+	.fe_done       = 0x4,
+	.ope_violation = 0x8,
+	.idle          = 0x10,
+	.debug_cfg_val = 0x1,
+};
+
+
+static struct cam_ope_bus_rd_reg_val ope_bus_rd_reg_val = {
+	.hw_version = 0x00050000,
+	.sw_reset = 0x1,
+	.cgc_override = 0x0,
+	.irq_mask   = 0x30001,
+	.irq_set_clear = 0x1,
+	.rst_done      = 0x1,
+	.rup_done      = 0x2,
+	.rd_buf_done   = 0xC,
+	.violation     = 0x3000,
+	.go_cmd = 0x1,
+	.security_cfg = 0x0,
+	.latency_buf_size = 4096,
+	.num_clients = 0x2,
+	.rd_clients = {
+		{
+			.core_cfg = 0x1,
+			.stripe_location_mask = 0x3,
+			.stripe_location_shift = 0x0,
+			.pix_pattern_mask = 0x3F,
+			.pix_pattern_shift = 0x2,
+			.img_width_mask = 0xFFFF,
+			.img_width_shift = 0x10,
+			.img_height_mask = 0xFFFF,
+			.img_height_shift = 0x0,
+			.mode_mask = 0x1F,
+			.mode_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x5,
+			.latency_buf_allocation = 4096,
+			.input_port_id = OPE_IN_RES_FULL,
+			.rm_port_id = 0,
+			.format_type = BUS_RD_COMBO_BAYER_MASK |
+				BUS_RD_COMBO_YUV_MASK,
+			.num_combos_supported = 2,
+		},
+		{
+			.core_cfg = 0x1,
+			.stripe_location_mask = 0x3,
+			.stripe_location_shift = 0x0,
+			.pix_pattern_mask = 0x3F,
+			.pix_pattern_shift = 0x2,
+			.img_width_mask = 0xFFFF,
+			.img_width_shift = 0x10,
+			.img_height_mask = 0xFFFF,
+			.img_height_shift = 0x0,
+			.mode_mask = 0x1F,
+			.mode_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x5,
+			.latency_buf_allocation = 4096,
+			.input_port_id = OPE_IN_RES_FULL,
+			.rm_port_id = 1,
+			.format_type = BUS_RD_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+
+		},
+	},
+};
+
+static struct cam_ope_bus_rd_reg ope_bus_rd_reg = {
+	.offset = 0x4C00,
+	.hw_version = 0x0,
+	.sw_reset = 0x4,
+	.cgc_override = 0x8,
+	.irq_mask = 0xC,
+	.irq_clear = 0x10,
+	.irq_cmd = 0x14,
+	.irq_status = 0x18,
+	.input_if_cmd = 0x1C,
+	.irq_set = 0x20,
+	.misr_reset = 0x24,
+	.security_cfg = 0x28,
+	.iso_cfg = 0x2C,
+	.iso_seed = 0x30,
+	.num_clients = 0x2,
+	.rd_clients = {
+		{
+			.core_cfg = 0x50,
+			.ccif_meta_data = 0x54,
+			.img_addr = 0x58,
+			.img_cfg = 0x5C,
+			.stride = 0x60,
+			.unpack_cfg = 0x64,
+			.latency_buf_allocation = 0x78,
+			.misr_cfg_0 =  0x80,
+			.misr_cfg_1 =  0x84,
+			.misr_rd_val = 0x88,
+		},
+		{
+			.core_cfg = 0xF0,
+			.ccif_meta_data = 0xF4,
+			.img_addr = 0xF8,
+			.img_cfg = 0xFC,
+			.stride = 0x100,
+			.unpack_cfg = 0x104,
+			.latency_buf_allocation = 0x118,
+			.misr_cfg_0 =  0x120,
+			.misr_cfg_1 =  0x124,
+			.misr_rd_val = 0x128,
+		},
+	},
+};
+
+static struct cam_ope_bus_wr_reg ope_bus_wr_reg = {
+	.offset = 0x4D90,
+	.hw_version = 0x0,
+	.cgc_override = 0x8,
+	.irq_mask_0 = 0x18,
+	.irq_mask_1 = 0x1C,
+	.irq_clear_0 = 0x20,
+	.irq_clear_1 = 0x24,
+	.irq_status_0 = 0x28,
+	.irq_status_1 = 0x2C,
+	.irq_cmd = 0x30,
+	.frame_header_cfg_0 = 0x34,
+	.local_frame_header_cfg_0 = 0x4C,
+	.irq_set_0 = 0x50,
+	.irq_set_1 = 0x54,
+	.iso_cfg = 0x5C,
+	.violation_status = 0x64,
+	.image_size_violation_status  = 0x70,
+	.misr_cfg_0 = 0xB8,
+	.misr_cfg_1 = 0xBC,
+	.misr_rd_sel = 0xC8,
+	.misr_reset = 0xCC,
+	.misr_val = 0xD0,
+	.num_clients = 0x8,
+	.wr_clients = {
+		{
+			.core_cfg = 0x200,
+			.img_addr = 0x204,
+			.img_cfg = 0x20C,
+			.x_init = 0x210,
+			.stride = 0x214,
+			.pack_cfg = 0x218,
+			.bw_limit = 0x21C,
+			.frame_header_addr = 0x220,
+			.subsample_period = 0x230,
+			.subsample_pattern = 0x234,
+		},
+		{
+			.core_cfg = 0x300,
+			.img_addr = 0x304,
+			.img_cfg = 0x30C,
+			.x_init = 0x310,
+			.stride = 0x314,
+			.pack_cfg = 0x318,
+			.bw_limit = 0x31C,
+			.frame_header_addr = 0x320,
+			.subsample_period = 0x330,
+			.subsample_pattern = 0x334,
+		},
+		{
+			.core_cfg = 0x400,
+			.img_addr = 0x404,
+			.img_cfg = 0x40C,
+			.x_init = 0x410,
+			.stride = 0x414,
+			.pack_cfg = 0x418,
+			.bw_limit = 0x41C,
+			.frame_header_addr = 0x420,
+			.subsample_period = 0x430,
+			.subsample_pattern = 0x434,
+		},
+		{
+			.core_cfg = 0x500,
+			.img_addr = 0x504,
+			.img_cfg = 0x50C,
+			.x_init = 0x510,
+			.stride = 0x514,
+			.pack_cfg = 0x518,
+			.bw_limit = 0x51C,
+			.frame_header_addr = 0x520,
+			.subsample_period = 0x530,
+			.subsample_pattern = 0x534,
+		},
+		{
+			.core_cfg = 0x600,
+			.img_addr = 0x604,
+			.img_cfg = 0x60C,
+			.x_init = 0x610,
+			.stride = 0x614,
+			.pack_cfg = 0x618,
+			.bw_limit = 0x61C,
+			.frame_header_addr = 0x620,
+			.subsample_period = 0x630,
+			.subsample_pattern = 0x634,
+		},
+		{
+			.core_cfg = 0x700,
+			.img_addr = 0x704,
+			.img_cfg = 0x70C,
+			.x_init = 0x710,
+			.stride = 0x714,
+			.pack_cfg = 0x718,
+			.bw_limit = 0x71C,
+			.frame_header_addr = 0x720,
+			.subsample_period = 0x730,
+			.subsample_pattern = 0x734,
+		},
+		{
+			.core_cfg = 0x800,
+			.img_addr = 0x804,
+			.img_cfg = 0x80C,
+			.x_init = 0x810,
+			.stride = 0x814,
+			.pack_cfg = 0x818,
+			.bw_limit = 0x81C,
+			.frame_header_addr = 0x820,
+			.subsample_period = 0x830,
+			.subsample_pattern = 0x834,
+		},
+		{
+			.core_cfg = 0x900,
+			.img_addr = 0x904,
+			.img_cfg = 0x90C,
+			.x_init = 0x910,
+			.stride = 0x914,
+			.pack_cfg = 0x918,
+			.bw_limit = 0x91C,
+			.frame_header_addr = 0x920,
+			.subsample_period = 0x930,
+			.subsample_pattern = 0x934,
+		},
+	},
+};
+
+static struct cam_ope_bus_wr_reg_val ope_bus_wr_reg_val = {
+	.hw_version = 0x20010000,
+	.irq_mask_0 = 0xD0000000,
+	.irq_mask_1 = 0x0,
+	.irq_set_clear = 0x1,
+	.comp_rup_done = 0x1,
+	.comp_buf_done = 0x100,
+	.cons_violation = 0x10000000,
+	.violation = 0x40000000,
+	.img_size_violation = 0x80000000,
+	.num_clients = 0x8,
+	.wr_clients = {
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_VIDEO,
+			.wm_port_id = BUS_WR_VIDEO_Y,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_VIDEO,
+			.wm_port_id = BUS_WR_VIDEO_C,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_DISP,
+			.wm_port_id = BUS_WR_DISP_Y,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_DISP,
+			.wm_port_id = BUS_WR_DISP_C,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_ARGB,
+			.wm_port_id = BUS_WR_ARGB,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_STATS_RS,
+			.wm_port_id = BUS_WR_STATS_RS,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_STATS_IHIST,
+			.wm_port_id = BUS_WR_STATS_IHIST,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+		{
+			.core_cfg_en = 0x1,
+			.core_cfg_en_mask = 0x1,
+			.core_cfg_en_shift = 0x0,
+			.virtual_frame_en_mask = 0x1,
+			.virtual_frame_en_shift = 0x1,
+			.frame_header_en_mask = 0x1,
+			.frame_header_en_shift = 0x2,
+			.auto_recovery_en_mask = 0x1,
+			.auto_recovery_en_shift = 0x4,
+			.mode_mask = 0x3,
+			.mode_shift = 0x10,
+			.width_mask = 0xFFFF,
+			.width_shift = 0x0,
+			.height_mask = 0xFFFF,
+			.height_shift = 0x10,
+			.format_mask = 0xF,
+			.format_shift = 0x0,
+			.alignment_mask = 0x1,
+			.alignment_shift = 0x4,
+			.output_port_id = OPE_OUT_RES_STATS_LTM,
+			.wm_port_id = BUS_WR_STATS_LTM,
+			.format_type = BUS_WR_COMBO_YUV_MASK,
+			.num_combos_supported = 1,
+		},
+	},
+};
+
+static struct cam_ope_pp_reg ope_pp_reg = {
+	.offset = 0x800,
+	.num_clients = MAX_PP_CLIENTS,
+	.pp_clients = {
+		{
+			.hw_status = 0x4,
+		},
+		{
+			.hw_status = 0x204,
+		},
+		{
+			.hw_status = 0x404,
+		},
+		{
+			.hw_status = 0x604,
+		},
+		{
+			.hw_status = 0x804,
+		},
+		{
+			.hw_status = 0xA04,
+		},
+		{
+			.hw_status = 0xC04,
+		},
+		{
+			.hw_status = 0xE04,
+		},
+		{
+			.hw_status = 0x1004,
+		},
+		{
+			.hw_status = 0x1204,
+		},
+		{
+			.hw_status = 0x1404,
+		},
+		{
+			.hw_status = 0x1604,
+		},
+		{
+			.hw_status = 0x1804,
+		},
+		{
+			.hw_status = 0x1A04,
+		},
+		{
+			.hw_status = 0x1C04,
+		},
+		{
+			.hw_status = 0x1E04,
+		},
+		{
+			.hw_status = 0x2204,
+		},
+		{
+			.hw_status = 0x2604,
+		},
+		{
+			.hw_status = 0x2804,
+		},
+		{
+			.hw_status = 0x2A04,
+		},
+		{
+			.hw_status = 0x2C04,
+		},
+		{
+			.hw_status = 0x2E04,
+		},
+		{
+			.hw_status = 0x3004,
+		},
+		{
+			.hw_status = 0x3204,
+		},
+		{
+			.hw_status = 0x3404,
+		},
+		{
+			.hw_status = 0x3604,
+		},
+		{
+			.hw_status = 0x3804,
+		},
+		{
+			.hw_status = 0x3A04,
+		},
+		{
+			.hw_status = 0x3C04,
+		},
+		{
+			.hw_status = 0x3E04,
+		},
+		{
+			.hw_status = 0x4004,
+		},
+		{
+			.hw_status = 0x4204,
+		},
+	},
+};
+
+static struct ope_hw ope_hw_100 = {
+	.top_reg     = &ope_top_reg,
+	.top_reg_val = &ope_top_reg_val,
+	.bus_rd_reg  = &ope_bus_rd_reg,
+	.bus_rd_reg_val  = &ope_bus_rd_reg_val,
+	.bus_wr_reg  = &ope_bus_wr_reg,
+	.bus_wr_reg_val  = &ope_bus_wr_reg_val,
+	.pp_reg  = &ope_pp_reg,
+	.common  = &common_data,
+};
+
+#endif /* CAM_OPE_HW_100_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.c
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/dma-buf.h>
+#include <media/cam_defs.h>
+#include <media/cam_ope.h>
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+
+static int cam_ope_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	struct platform_device *pdev = NULL;
+	struct device_node *of_node = NULL;
+	struct cam_ope_soc_private *ope_soc_info;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_OPE, "soc_info is NULL");
+		return -EINVAL;
+	}
+
+	pdev = soc_info->pdev;
+	of_node = pdev->dev.of_node;
+	ope_soc_info = soc_info->soc_private;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0)
+		CAM_ERR(CAM_OPE, "get ope dt prop is failed: %d", rc);
+
+	ope_soc_info->hfi_en = of_property_read_bool(of_node, "hfi_en");
+
+	return rc;
+}
+
+static int cam_ope_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t ope_irq_handler, void *irq_data)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_request_platform_resource(soc_info, ope_irq_handler,
+		irq_data);
+
+	return rc;
+}
+
+int cam_ope_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ope_irq_handler, void *irq_data)
+{
+	struct cam_ope_soc_private  *soc_private;
+	struct platform_device *pdev = NULL;
+	int num_pid = 0, i = 0;
+	int rc = 0;
+
+	soc_private = kzalloc(sizeof(struct cam_ope_soc_private), GFP_KERNEL);
+	if (!soc_private) {
+		CAM_DBG(CAM_ISP, "Error! soc_private Alloc Failed");
+			return -ENOMEM;
+	}
+	soc_info->soc_private = soc_private;
+
+	rc = cam_ope_get_dt_properties(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_ope_request_platform_resource(soc_info, ope_irq_handler,
+		irq_data);
+	if (rc < 0)
+		return rc;
+
+	soc_private->num_pid = 0;
+	pdev = soc_info->pdev;
+	num_pid = of_property_count_u32_elems(pdev->dev.of_node, "cam_hw_pid");
+	CAM_DBG(CAM_OPE, "ope: %d pid count %d", soc_info->index, num_pid);
+
+	if (num_pid <= 0  || num_pid > CAM_OPE_HW_MAX_NUM_PID)
+		goto end;
+
+	soc_private->num_pid  = num_pid;
+
+	for (i = 0; i < num_pid; i++)
+		of_property_read_u32_index(pdev->dev.of_node, "cam_hw_pid", i,
+				&soc_private->pid[i]);
+end:
+	return rc;
+}
+
+int cam_ope_enable_soc_resources(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_SVS_VOTE, true);
+	if (rc) {
+		CAM_ERR(CAM_OPE, "enable platform failed");
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_ope_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, disable_clk,
+		true);
+	if (rc)
+		CAM_ERR(CAM_OPE, "enable platform failed");
+
+	return rc;
+}
+
+int cam_ope_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate)
+{
+	int32_t src_clk_idx;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_OPE, "Invalid soc info");
+		return -EINVAL;
+	}
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	CAM_DBG(CAM_OPE, "clk_rate = %u src_clk_index = %d",
+		clk_rate, src_clk_idx);
+	if ((soc_info->clk_level_valid[CAM_TURBO_VOTE] == true) &&
+		(soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx] != 0) &&
+		(clk_rate > soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx])) {
+		CAM_DBG(CAM_OPE, "clk_rate %d greater than max, reset to %d",
+			clk_rate,
+			soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx]);
+		clk_rate = soc_info->clk_rate[CAM_TURBO_VOTE][src_clk_idx];
+	}
+
+	CAM_DBG(CAM_OPE, "clk_rate = %u src_clk_index = %d",
+		clk_rate, src_clk_idx);
+	return cam_soc_util_set_src_clk_rate(soc_info, clk_rate);
+}
+
+int cam_ope_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable)
+{
+	int rc = 0;
+
+	if (clk_enable)
+		rc = cam_soc_util_clk_enable_default(soc_info, CAM_SVS_VOTE);
+	else
+		cam_soc_util_clk_disable_default(soc_info);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_soc.h
@@ -0,0 +1,41 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef CAM_OPE_SOC_H
+#define CAM_OPE_SOC_H
+
+#include "cam_soc_util.h"
+
+#define CAM_OPE_HW_MAX_NUM_PID 2
+
+/**
+ * struct cam_ope_soc_private
+ *
+ * @hfi_en:  HFI enable flag
+ * @num_pid: OPE number of pids
+ * @pid:     OPE pid value list
+ */
+struct cam_ope_soc_private {
+	uint32_t hfi_en;
+	uint32_t num_pid;
+	uint32_t pid[CAM_OPE_HW_MAX_NUM_PID];
+};
+
+
+
+int cam_ope_init_soc_resources(struct cam_hw_soc_info *soc_info,
+	irq_handler_t ope_irq_handler, void *irq_data);
+
+
+int cam_ope_enable_soc_resources(struct cam_hw_soc_info *soc_info);
+
+int cam_ope_disable_soc_resources(struct cam_hw_soc_info *soc_info,
+	bool disable_clk);
+
+int cam_ope_update_clk_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_rate);
+
+int cam_ope_toggle_clk(struct cam_hw_soc_info *soc_info, bool clk_enable);
+#endif /* CAM_OPE_SOC_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.c
@@ -0,0 +1,378 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/debugfs.h>
+#include <linux/videodev2.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/iopoll.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "cam_io_util.h"
+#include "cam_hw.h"
+#include "cam_hw_intf.h"
+#include "ope_core.h"
+#include "ope_soc.h"
+#include "cam_soc_util.h"
+#include "cam_io_util.h"
+#include "cam_cpas_api.h"
+#include "cam_debug_util.h"
+#include "ope_hw.h"
+#include "ope_dev_intf.h"
+#include "ope_top.h"
+
+static struct ope_top ope_top_info;
+
+static int cam_ope_top_dump_debug_reg(struct ope_hw *ope_hw_info)
+{
+	uint32_t i, val[3];
+	struct cam_ope_top_reg *top_reg;
+	struct cam_ope_pp_reg *pp_reg;
+	uint32_t pp_hw_status = 0;
+
+	top_reg = ope_hw_info->top_reg;
+	pp_reg = ope_hw_info->pp_reg;
+
+	for (i = 0; i < top_reg->num_debug_registers; i = i+3) {
+		val[0] = cam_io_r_mb(top_reg->base +
+			top_reg->debug_regs[i].offset);
+		val[1] = ((i+1) < top_reg->num_debug_registers) ?
+			cam_io_r_mb(top_reg->base +
+			top_reg->debug_regs[i+1].offset) : 0;
+		val[2] = ((i+2) < top_reg->num_debug_registers) ?
+			cam_io_r_mb(top_reg->base +
+			top_reg->debug_regs[i+2].offset) : 0;
+
+		CAM_INFO(CAM_OPE, "status[%d-%d] : 0x%x 0x%x 0x%x",
+			i, i+2, val[0], val[1], val[2]);
+	}
+
+	CAM_INFO(CAM_OPE, "scrath reg: 0x%x, stripe_idx: %d",
+		top_reg->offset + top_reg->scratch_reg,
+		cam_io_r_mb(top_reg->base + top_reg->scratch_reg));
+
+	for (i = 0; i < pp_reg->num_clients ; i++) {
+		pp_hw_status = 0;
+		pp_hw_status =
+			cam_io_r_mb(pp_reg->base +
+				pp_reg->pp_clients[i]
+					.hw_status);
+
+		if (pp_hw_status)
+			CAM_ERR(CAM_OPE,
+				"ope pp hw_status offset 0x%x val 0x%x",
+				pp_reg->pp_clients[i].hw_status,
+				pp_hw_status);
+	}
+	return 0;
+}
+
+static int cam_ope_top_reset(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_ope_top_reg *top_reg;
+	struct cam_ope_top_reg_val *top_reg_val;
+	uint32_t irq_mask, irq_status;
+	unsigned long flags;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	top_reg = ope_hw_info->top_reg;
+	top_reg_val = ope_hw_info->top_reg_val;
+
+	mutex_lock(&ope_top_info.ope_hw_mutex);
+	reinit_completion(&ope_top_info.reset_complete);
+
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		ope_hw_info->top_reg->base + top_reg->irq_mask);
+
+	/* OPE SW RESET */
+	cam_io_w_mb(top_reg_val->sw_reset_cmd,
+		ope_hw_info->top_reg->base + top_reg->reset_cmd);
+
+	rc = wait_for_completion_timeout(
+			&ope_top_info.reset_complete,
+			msecs_to_jiffies(60));
+
+	cam_io_w_mb(top_reg_val->debug_cfg_val,
+		top_reg->base + top_reg->debug_cfg);
+
+	if (!rc || rc < 0) {
+		spin_lock_irqsave(&ope_top_info.hw_lock, flags);
+		if (!completion_done(&ope_top_info.reset_complete)) {
+			CAM_DBG(CAM_OPE,
+				"IRQ delayed, checking the status registers");
+			irq_mask = cam_io_r_mb(ope_hw_info->top_reg->base +
+				top_reg->irq_mask);
+			irq_status = cam_io_r_mb(ope_hw_info->top_reg->base +
+				top_reg->irq_status);
+			if (irq_status & top_reg_val->rst_done) {
+				CAM_DBG(CAM_OPE, "ope reset done");
+				cam_io_w_mb(irq_status,
+					top_reg->base + top_reg->irq_clear);
+				cam_io_w_mb(top_reg_val->irq_set_clear,
+					top_reg->base + top_reg->irq_cmd);
+			} else {
+				CAM_ERR(CAM_OPE,
+					"irq mask 0x%x irq status 0x%x",
+					irq_mask, irq_status);
+				cam_ope_top_dump_debug_reg(ope_hw_info);
+				rc = -ETIMEDOUT;
+			}
+		} else {
+			rc = 0;
+		}
+		spin_unlock_irqrestore(&ope_top_info.hw_lock, flags);
+	} else {
+		rc = 0;
+	}
+
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		ope_hw_info->top_reg->base + top_reg->irq_mask);
+
+	mutex_unlock(&ope_top_info.ope_hw_mutex);
+	return rc;
+}
+
+static int cam_ope_top_release(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (ctx_id < 0) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d", ctx_id);
+		return -EINVAL;
+	}
+
+	ope_top_info.top_ctx[ctx_id].ope_acquire = NULL;
+
+	return rc;
+}
+
+static int cam_ope_top_acquire(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (ctx_id < 0 || !data) {
+		CAM_ERR(CAM_OPE, "Invalid data: %d %x", ctx_id, data);
+		return -EINVAL;
+	}
+
+	ope_top_info.top_ctx[ctx_id].ope_acquire = data;
+
+	return rc;
+}
+
+static int cam_ope_top_init(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	struct cam_ope_top_reg *top_reg;
+	struct cam_ope_top_reg_val *top_reg_val;
+	struct cam_ope_dev_init *dev_init = data;
+	uint32_t irq_mask, irq_status;
+	unsigned long flags;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	top_reg = ope_hw_info->top_reg;
+	top_reg_val = ope_hw_info->top_reg_val;
+
+	top_reg->base = dev_init->core_info->ope_hw_info->ope_top_base;
+
+	mutex_init(&ope_top_info.ope_hw_mutex);
+	/* OPE SW RESET */
+	init_completion(&ope_top_info.reset_complete);
+
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		ope_hw_info->top_reg->base + top_reg->irq_mask);
+	cam_io_w_mb(top_reg_val->sw_reset_cmd,
+		ope_hw_info->top_reg->base + top_reg->reset_cmd);
+
+	rc = wait_for_completion_timeout(
+			&ope_top_info.reset_complete,
+			msecs_to_jiffies(60));
+
+	cam_io_w_mb(top_reg_val->debug_cfg_val,
+		top_reg->base + top_reg->debug_cfg);
+
+	if (!rc || rc < 0) {
+		spin_lock_irqsave(&ope_top_info.hw_lock, flags);
+		if (!completion_done(&ope_top_info.reset_complete)) {
+			CAM_DBG(CAM_OPE,
+				"IRQ delayed, checking the status registers");
+			irq_mask = cam_io_r_mb(ope_hw_info->top_reg->base +
+				top_reg->irq_mask);
+			irq_status = cam_io_r_mb(ope_hw_info->top_reg->base +
+				top_reg->irq_status);
+			if (irq_status & top_reg_val->rst_done) {
+				CAM_DBG(CAM_OPE, "ope reset done");
+				cam_io_w_mb(irq_status,
+					top_reg->base + top_reg->irq_clear);
+				cam_io_w_mb(top_reg_val->irq_set_clear,
+					top_reg->base + top_reg->irq_cmd);
+			} else {
+				CAM_ERR(CAM_OPE,
+					"irq mask 0x%x irq status 0x%x",
+					irq_mask, irq_status);
+				cam_ope_top_dump_debug_reg(ope_hw_info);
+				rc = -ETIMEDOUT;
+			}
+		} else {
+			CAM_DBG(CAM_OPE, "reset done");
+			rc = 0;
+		}
+		spin_unlock_irqrestore(&ope_top_info.hw_lock, flags);
+	} else {
+		rc = 0;
+	}
+	/* enable interrupt mask */
+	cam_io_w_mb(top_reg_val->irq_mask,
+		ope_hw_info->top_reg->base + top_reg->irq_mask);
+
+	return rc;
+}
+
+static int cam_ope_top_probe(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	ope_top_info.ope_hw_info = ope_hw_info;
+	spin_lock_init(&ope_top_info.hw_lock);
+
+	return rc;
+}
+
+static int cam_ope_top_isr(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, void *data)
+{
+	int rc = 0;
+	uint32_t irq_status;
+	uint32_t violation_status;
+	uint32_t pp_hw_status = 0;
+	struct cam_ope_top_reg *top_reg;
+	struct cam_ope_top_reg_val *top_reg_val;
+	struct cam_ope_pp_reg *pp_reg;
+	struct cam_ope_irq_data *irq_data = data;
+	int i;
+
+	if (!ope_hw_info) {
+		CAM_ERR(CAM_OPE, "Invalid ope_hw_info");
+		return -EINVAL;
+	}
+
+	top_reg = ope_hw_info->top_reg;
+	top_reg_val = ope_hw_info->top_reg_val;
+	pp_reg = ope_hw_info->pp_reg;
+
+	spin_lock(&ope_top_info.hw_lock);
+	/* Read and Clear Top Interrupt status */
+	irq_status = cam_io_r_mb(top_reg->base + top_reg->irq_status);
+	cam_io_w_mb(irq_status,
+		top_reg->base + top_reg->irq_clear);
+
+	cam_io_w_mb(top_reg_val->irq_set_clear,
+		top_reg->base + top_reg->irq_cmd);
+
+	if (irq_status & top_reg_val->rst_done) {
+		CAM_DBG(CAM_OPE, "ope reset done");
+		complete(&ope_top_info.reset_complete);
+	}
+
+	if (irq_status & top_reg_val->ope_violation) {
+		violation_status = cam_io_r_mb(top_reg->base +
+			top_reg->violation_status);
+		irq_data->error = 1;
+		CAM_ERR(CAM_OPE, "ope violation: %x", violation_status);
+
+		for (i = 0; i < pp_reg->num_clients ; i++) {
+			pp_hw_status = 0;
+			pp_hw_status =
+				cam_io_r_mb(pp_reg->base +
+					pp_reg->pp_clients[i]
+						.hw_status);
+
+			if (pp_hw_status)
+				CAM_ERR(CAM_OPE,
+					"ope pp hw_status offset 0x%x val 0x%x",
+					pp_reg->pp_clients[i].hw_status,
+					pp_hw_status);
+		}
+	}
+	spin_unlock(&ope_top_info.hw_lock);
+
+	return rc;
+}
+
+int cam_ope_top_process(struct ope_hw *ope_hw_info,
+	int32_t ctx_id, uint32_t cmd_id, void *data)
+{
+	int rc = 0;
+
+	switch (cmd_id) {
+	case OPE_HW_PROBE:
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: E");
+		rc = cam_ope_top_probe(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_PROBE: X");
+		break;
+	case OPE_HW_INIT:
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: E");
+		rc = cam_ope_top_init(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_INIT: X");
+		break;
+	case OPE_HW_DEINIT:
+		break;
+	case OPE_HW_ACQUIRE:
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: E");
+		rc = cam_ope_top_acquire(ope_hw_info, ctx_id, data);
+		CAM_DBG(CAM_OPE, "OPE_HW_ACQUIRE: X");
+		break;
+	case OPE_HW_PREPARE:
+		break;
+	case OPE_HW_RELEASE:
+		rc = cam_ope_top_release(ope_hw_info, ctx_id, data);
+		break;
+	case OPE_HW_START:
+		break;
+	case OPE_HW_STOP:
+		break;
+	case OPE_HW_FLUSH:
+		break;
+	case OPE_HW_ISR:
+		rc = cam_ope_top_isr(ope_hw_info, 0, data);
+		break;
+	case OPE_HW_RESET:
+		rc = cam_ope_top_reset(ope_hw_info, 0, 0);
+		break;
+	case OPE_HW_DUMP_DEBUG:
+		rc = cam_ope_top_dump_debug_reg(ope_hw_info);
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_ope/ope_hw_mgr/ope_hw/top/ope_top.h
@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef OPE_TOP_H
+#define OPE_TOP_H
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <media/cam_ope.h>
+#include "ope_hw.h"
+#include "cam_hw_mgr_intf.h"
+#include "cam_hw_intf.h"
+#include "cam_soc_util.h"
+#include "cam_context.h"
+#include "cam_ope_context.h"
+#include "cam_ope_hw_mgr.h"
+
+/**
+ * struct ope_top_ctx
+ *
+ * @ope_acquire: OPE acquire info
+ */
+struct ope_top_ctx {
+	struct ope_acquire_dev_info *ope_acquire;
+};
+
+/**
+ * struct ope_top
+ *
+ * @ope_hw_info:    OPE hardware info
+ * @top_ctx:        OPE top context
+ * @reset_complete: Reset complete flag
+ * @ope_mutex:      OPE hardware mutex
+ * @hw_lock:        OPE hardware spinlock
+ */
+struct ope_top {
+	struct ope_hw *ope_hw_info;
+	struct ope_top_ctx top_ctx[OPE_CTX_MAX];
+	struct completion reset_complete;
+	struct mutex      ope_hw_mutex;
+	spinlock_t        hw_lock;
+};
+#endif /* OPE_TOP_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_mem_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_mem_mgr.c
@@ -0,0 +1,1897 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/dma-buf.h>
+#include <linux/version.h>
+#include <linux/debugfs.h>
+#include <linux/hashtable.h>
+
+#include "cam_compat.h"
+#include "cam_req_mgr_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_smmu_api.h"
+#include "cam_debug_util.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+
+static struct cam_mem_table tbl;
+static atomic_t cam_mem_mgr_state = ATOMIC_INIT(CAM_MEM_MGR_UNINITIALIZED);
+
+static void cam_mem_mgr_print_tbl(void)
+{
+	int i;
+	uint64_t ms, tmp, hrs, min, sec;
+	struct timespec64 *ts =  NULL;
+	struct timespec64 current_ts;
+
+	ktime_get_real_ts64(&(current_ts));
+	tmp = current_ts.tv_sec;
+	ms = (current_ts.tv_nsec) / 1000000;
+	sec = do_div(tmp, 60);
+	min = do_div(tmp, 60);
+	hrs = do_div(tmp, 24);
+
+	CAM_INFO(CAM_MEM, "***%llu:%llu:%llu:%llu Mem mgr table dump***",
+		hrs, min, sec, ms);
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
+		if (tbl.bufq[i].active) {
+			ts = &tbl.bufq[i].timestamp;
+			tmp = ts->tv_sec;
+			ms = (ts->tv_nsec) / 1000000;
+			sec = do_div(tmp, 60);
+			min = do_div(tmp, 60);
+			hrs = do_div(tmp, 24);
+			CAM_INFO(CAM_MEM,
+				"%llu:%llu:%llu:%llu idx %d fd %d size %zu krefCount %d urefCount %d",
+				hrs, min, sec, ms, i, tbl.bufq[i].fd,
+				tbl.bufq[i].len, kref_read(&tbl.bufq[i].krefcount),
+				kref_read(&tbl.bufq[i].urefcount));
+		}
+	}
+
+}
+
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+static void cam_mem_mgr_put_dma_heaps(void);
+static int cam_mem_mgr_get_dma_heaps(void);
+#endif
+
+static int cam_mem_util_get_dma_dir(uint32_t flags)
+{
+	int rc = -EINVAL;
+
+	if (flags & CAM_MEM_FLAG_HW_READ_ONLY)
+		rc = DMA_TO_DEVICE;
+	else if (flags & CAM_MEM_FLAG_HW_WRITE_ONLY)
+		rc = DMA_FROM_DEVICE;
+	else if (flags & CAM_MEM_FLAG_HW_READ_WRITE)
+		rc = DMA_BIDIRECTIONAL;
+	else if (flags & CAM_MEM_FLAG_PROTECTED_MODE)
+		rc = DMA_BIDIRECTIONAL;
+
+	return rc;
+}
+
+static int cam_mem_util_map_cpu_va(struct dma_buf *dmabuf,
+	uintptr_t *vaddr, size_t *len)
+{
+	int rc = 0;
+
+	/*
+	 * dma_buf_begin_cpu_access() and dma_buf_end_cpu_access()
+	 * need to be called in pair to avoid stability issue.
+	 */
+	rc = dma_buf_begin_cpu_access(dmabuf, DMA_BIDIRECTIONAL);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "dma begin access failed rc=%d", rc);
+		return rc;
+	}
+
+	rc = cam_compat_util_get_dmabuf_va(dmabuf, vaddr);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "kernel vmap fail rc = %d", rc);
+		*len = 0;
+		dma_buf_end_cpu_access(dmabuf, DMA_BIDIRECTIONAL);
+	}
+	else {
+		*len = dmabuf->size;
+		CAM_DBG(CAM_MEM, "vaddr = %llu, len = %zu", *vaddr, *len);
+	}
+
+	return rc;
+}
+
+static int cam_mem_util_unmap_cpu_va(struct dma_buf *dmabuf,
+	uint64_t vaddr)
+{
+	int rc = 0;
+
+	if (!dmabuf || !vaddr) {
+		CAM_ERR(CAM_MEM, "Invalid input args %pK %llX", dmabuf, vaddr);
+		return -EINVAL;
+	}
+
+	cam_compat_util_put_dmabuf_va(dmabuf, (void *)vaddr);
+
+	/*
+	 * dma_buf_begin_cpu_access() and
+	 * dma_buf_end_cpu_access() need to be called in pair
+	 * to avoid stability issue.
+	 */
+	rc = dma_buf_end_cpu_access(dmabuf, DMA_BIDIRECTIONAL);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Failed in end cpu access, dmabuf=%pK",
+			dmabuf);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int cam_mem_mgr_create_debug_fs(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_memmgr", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_MEM,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	tbl.dentry = dbgfileptr;
+
+	debugfs_create_bool("alloc_profile_enable", 0644,
+		tbl.dentry, &tbl.alloc_profile_enable);
+
+end:
+	return rc;
+}
+
+int cam_mem_mgr_init(void)
+{
+	int i;
+	int bitmap_size;
+	int rc = 0;
+
+	memset(tbl.bufq, 0, sizeof(tbl.bufq));
+
+	if (cam_smmu_need_force_alloc_cached(&tbl.force_cache_allocs)) {
+		CAM_ERR(CAM_MEM, "Error in getting force cache alloc flag");
+		return -EINVAL;
+	}
+
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+	rc = cam_mem_mgr_get_dma_heaps();
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Failed in getting dma heaps rc=%d", rc);
+		return rc;
+	}
+#endif
+	bitmap_size = BITS_TO_LONGS(CAM_MEM_BUFQ_MAX) * sizeof(long);
+	tbl.bitmap = kzalloc(bitmap_size, GFP_KERNEL);
+	if (!tbl.bitmap) {
+		rc = -ENOMEM;
+		goto put_heaps;
+	}
+
+	tbl.bits = bitmap_size * BITS_PER_BYTE;
+	bitmap_zero(tbl.bitmap, tbl.bits);
+	/* We need to reserve slot 0 because 0 is invalid */
+	set_bit(0, tbl.bitmap);
+
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
+		tbl.bufq[i].fd = -1;
+		tbl.bufq[i].buf_handle = -1;
+		mutex_init(&tbl.bufq[i].q_lock);
+	}
+	mutex_init(&tbl.m_lock);
+
+	atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_INITIALIZED);
+
+	cam_mem_mgr_create_debug_fs();
+
+	return 0;
+put_heaps:
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+	cam_mem_mgr_put_dma_heaps();
+#endif
+	return rc;
+}
+
+static int32_t cam_mem_get_slot(void)
+{
+	int32_t idx;
+
+	mutex_lock(&tbl.m_lock);
+	idx = find_first_zero_bit(tbl.bitmap, tbl.bits);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		mutex_unlock(&tbl.m_lock);
+		return -ENOMEM;
+	}
+	set_bit(idx, tbl.bitmap);
+	mutex_unlock(&tbl.m_lock);
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	tbl.bufq[idx].active = true;
+	ktime_get_real_ts64(&(tbl.bufq[idx].timestamp));
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	return idx;
+}
+
+static void cam_mem_put_slot(int32_t idx)
+{
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	tbl.bufq[idx].active = false;
+	tbl.bufq[idx].is_internal = false;
+	memset(&tbl.bufq[idx].timestamp, 0, sizeof(struct timespec64));
+	kref_init(&tbl.bufq[idx].krefcount);
+	kref_init(&tbl.bufq[idx].urefcount);
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	mutex_lock(&tbl.m_lock);
+	clear_bit(idx, tbl.bitmap);
+	mutex_unlock(&tbl.m_lock);
+}
+
+int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
+	dma_addr_t *iova_ptr, size_t *len_ptr)
+{
+	int rc = 0, idx;
+
+	*len_ptr = 0;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0)
+		return -ENOENT;
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "Buffer at idx=%d is already unmapped,",
+			idx);
+		rc = -EAGAIN;
+		goto handle_mismatch;
+	}
+
+	if (buf_handle != tbl.bufq[idx].buf_handle) {
+		rc = -EINVAL;
+		goto handle_mismatch;
+	}
+
+	if (CAM_MEM_MGR_IS_SECURE_HDL(buf_handle))
+		rc = cam_smmu_get_stage2_iova(mmu_handle,
+			tbl.bufq[idx].fd,
+			iova_ptr,
+			len_ptr);
+	else
+		rc = cam_smmu_get_iova(mmu_handle,
+			tbl.bufq[idx].fd,
+			iova_ptr,
+			len_ptr);
+	if (rc) {
+		CAM_ERR(CAM_MEM,
+			"fail to map buf_hdl:0x%x, mmu_hdl: 0x%x for fd:%d",
+			buf_handle, mmu_handle, tbl.bufq[idx].fd);
+		goto handle_mismatch;
+	}
+
+	CAM_DBG(CAM_MEM,
+		"handle:0x%x fd:%d iova_ptr:%pK len_ptr:%llu",
+		mmu_handle, tbl.bufq[idx].fd, iova_ptr, *len_ptr);
+handle_mismatch:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_get_io_buf);
+
+int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr, size_t *len)
+{
+	int idx, rc = 0;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!buf_handle || !vaddr_ptr || !len)
+		return -EINVAL;
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
+
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0)
+		return -EINVAL;
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "Buffer at idx=%d is already unmapped,",
+			idx);
+		rc = -EPERM;
+		goto end;
+	}
+
+	if (buf_handle != tbl.bufq[idx].buf_handle) {
+		CAM_ERR(CAM_MEM, "idx: %d Invalid buf handle %d",
+				idx, buf_handle);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!(tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS)) {
+		CAM_ERR(CAM_MEM, "idx: %d Invalid flag 0x%x",
+					idx, tbl.bufq[idx].flags);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tbl.bufq[idx].kmdvaddr && kref_get_unless_zero(&tbl.bufq[idx].krefcount)) {
+		*vaddr_ptr = tbl.bufq[idx].kmdvaddr;
+		*len = tbl.bufq[idx].len;
+	} else {
+		CAM_ERR(CAM_MEM, "No KMD access requested, kmdvddr= %pK, idx= %d, buf_handle= 0x%x",
+			(void *)tbl.bufq[idx].kmdvaddr, idx, buf_handle);
+		rc = -EINVAL;
+	}
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return 0;
+}
+EXPORT_SYMBOL(cam_mem_get_cpu_buf);
+
+int cam_mem_mgr_cache_ops(struct cam_mem_cache_ops_cmd *cmd)
+{
+	int rc = 0, idx;
+	uint32_t cache_dir;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!cmd)
+		return -EINVAL;
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(cmd->buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0)
+		return -EINVAL;
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "Buffer at idx=%d is already unmapped,",
+			idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cmd->buf_handle != tbl.bufq[idx].buf_handle) {
+		rc = -EINVAL;
+		goto end;
+	}
+
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+	CAM_DBG(CAM_MEM, "Calling dmap buf APIs for cache operations");
+	cache_dir = DMA_BIDIRECTIONAL;
+#else
+	unsigned long dmabuf_flag = 0;
+	rc = dma_buf_get_flags(tbl.bufq[idx].dma_buf, &dmabuf_flag);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "cache get flags failed %d", rc);
+		goto end;
+	}
+
+	if (dmabuf_flag & ION_FLAG_CACHED) {
+		switch (cmd->mem_cache_ops) {
+		case CAM_MEM_CLEAN_CACHE:
+			cache_dir = DMA_TO_DEVICE;
+			break;
+		case CAM_MEM_INV_CACHE:
+			cache_dir = DMA_FROM_DEVICE;
+			break;
+		case CAM_MEM_CLEAN_INV_CACHE:
+			cache_dir = DMA_BIDIRECTIONAL;
+			break;
+		default:
+			CAM_ERR(CAM_MEM,
+				"invalid cache ops :%d", cmd->mem_cache_ops);
+			rc = -EINVAL;
+			goto end;
+		}
+	} else {
+		CAM_DBG(CAM_MEM, "BUF is not cached");
+		goto end;
+	}
+#endif
+	rc = dma_buf_begin_cpu_access(tbl.bufq[idx].dma_buf,
+		(cmd->mem_cache_ops == CAM_MEM_CLEAN_INV_CACHE) ?
+		DMA_BIDIRECTIONAL : DMA_TO_DEVICE);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "dma begin access failed rc=%d", rc);
+		goto end;
+	}
+
+	rc = dma_buf_end_cpu_access(tbl.bufq[idx].dma_buf,
+		cache_dir);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "dma end access failed rc=%d", rc);
+		goto end;
+	}
+
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_cache_ops);
+
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+
+#define CAM_MAX_VMIDS 4
+
+static void cam_mem_mgr_put_dma_heaps(void)
+{
+	CAM_DBG(CAM_MEM, "Releasing DMA Buf heaps usage");
+}
+
+static int cam_mem_mgr_get_dma_heaps(void)
+{
+	int rc = 0;
+
+	tbl.system_heap = NULL;
+	tbl.system_uncached_heap = NULL;
+	tbl.camera_heap = NULL;
+	tbl.camera_uncached_heap = NULL;
+	tbl.secure_display_heap = NULL;
+
+	tbl.system_heap = dma_heap_find("system");
+	if (IS_ERR_OR_NULL(tbl.system_heap)) {
+		rc = PTR_ERR(tbl.system_heap);
+		CAM_ERR(CAM_MEM, "system heap not found, rc=%d", rc);
+		tbl.system_heap = NULL;
+		goto put_heaps;
+	}
+
+	tbl.system_uncached_heap = dma_heap_find("qcom,system-uncached");
+	if (IS_ERR_OR_NULL(tbl.system_uncached_heap)) {
+		if (tbl.force_cache_allocs) {
+			/* optional, we anyway do not use uncached */
+			CAM_DBG(CAM_MEM,
+				"qcom system-uncached heap not found, err=%d",
+				PTR_ERR(tbl.system_uncached_heap));
+			tbl.system_uncached_heap = NULL;
+		} else {
+			/* fatal, must need uncached heaps */
+			rc = PTR_ERR(tbl.system_uncached_heap);
+			CAM_ERR(CAM_MEM,
+				"qcom system-uncached heap not found, rc=%d",
+				rc);
+			tbl.system_uncached_heap = NULL;
+			goto put_heaps;
+		}
+	}
+
+	tbl.secure_display_heap = dma_heap_find("qcom,display");
+	if (IS_ERR_OR_NULL(tbl.secure_display_heap)) {
+		rc = PTR_ERR(tbl.secure_display_heap);
+		CAM_ERR(CAM_MEM, "qcom,display heap not found, rc=%d",
+			rc);
+		tbl.secure_display_heap = NULL;
+		goto put_heaps;
+	}
+
+	tbl.camera_heap = dma_heap_find("qcom,camera");
+	if (IS_ERR_OR_NULL(tbl.camera_heap)) {
+		/* optional heap, not a fatal error */
+		CAM_DBG(CAM_MEM, "qcom camera heap not found, err=%d",
+			PTR_ERR(tbl.camera_heap));
+		tbl.camera_heap = NULL;
+	}
+
+	tbl.camera_uncached_heap = dma_heap_find("qcom,camera-uncached");
+	if (IS_ERR_OR_NULL(tbl.camera_uncached_heap)) {
+		/* optional heap, not a fatal error */
+		CAM_DBG(CAM_MEM, "qcom camera heap not found, err=%d",
+			PTR_ERR(tbl.camera_uncached_heap));
+		tbl.camera_uncached_heap = NULL;
+	}
+
+	CAM_INFO(CAM_MEM,
+		"Heaps : system=%pK, system_uncached=%pK, camera=%pK, camera-uncached=%pK, secure_display=%pK",
+		tbl.system_heap, tbl.system_uncached_heap,
+		tbl.camera_heap, tbl.camera_uncached_heap,
+		tbl.secure_display_heap);
+
+	return 0;
+put_heaps:
+	cam_mem_mgr_put_dma_heaps();
+	return rc;
+}
+
+static int cam_mem_util_get_dma_buf(size_t len,
+	unsigned int cam_flags,
+	struct dma_buf **buf)
+{
+	int rc = 0;
+	struct dma_heap *heap;
+	struct dma_heap *try_heap = NULL;
+	struct timespec64 ts1, ts2;
+	long microsec = 0;
+	bool use_cached_heap = false;
+#ifdef CONFIG_SPECTRA_SECURE
+	struct mem_buf_lend_kernel_arg arg;
+	int vmids[CAM_MAX_VMIDS];
+	int perms[CAM_MAX_VMIDS];
+	int num_vmids = 0;
+#endif /* CONFIG_SPECTRA_SECURE */
+
+	if (!buf) {
+		CAM_ERR(CAM_MEM, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (tbl.alloc_profile_enable)
+		CAM_GET_TIMESTAMP(ts1);
+
+	if ((cam_flags & CAM_MEM_FLAG_CACHE) ||
+		(tbl.force_cache_allocs &&
+		(!(cam_flags & CAM_MEM_FLAG_PROTECTED_MODE)))) {
+		CAM_DBG(CAM_MEM,
+			"Using CACHED heap, cam_flags=0x%x, force_cache_allocs=%d",
+			cam_flags, tbl.force_cache_allocs);
+		use_cached_heap = true;
+	} else if (cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) {
+		use_cached_heap = true;
+		CAM_DBG(CAM_MEM,
+			"Using CACHED heap for secure, cam_flags=0x%x, force_cache_allocs=%d",
+			cam_flags, tbl.force_cache_allocs);
+	} else {
+		use_cached_heap = false;
+		CAM_DBG(CAM_MEM,
+			"Using UNCACHED heap, cam_flags=0x%x, force_cache_allocs=%d",
+			cam_flags, tbl.force_cache_allocs);
+	}
+
+#ifdef CONFIG_SPECTRA_SECURE
+	if (cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) {
+		heap = tbl.secure_display_heap;
+
+		vmids[num_vmids] = VMID_CP_CAMERA;
+		perms[num_vmids] = PERM_READ | PERM_WRITE;
+		num_vmids++;
+
+		if (cam_flags & CAM_MEM_FLAG_CDSP_OUTPUT) {
+			CAM_DBG(CAM_MEM, "Secure mode CDSP flags");
+
+			vmids[num_vmids] = VMID_CP_CDSP;
+			perms[num_vmids] = PERM_READ | PERM_WRITE;
+			num_vmids++;
+		}
+	} else
+#endif /* CONFIG_SPECTRA_SECURE */
+	if (use_cached_heap) {
+		try_heap = tbl.camera_heap;
+		heap = tbl.system_heap;
+	} else {
+		try_heap = tbl.camera_uncached_heap;
+		heap = tbl.system_heap;
+	}
+
+	CAM_DBG(CAM_MEM, "Using heaps : try=%pK, heap=%pK", try_heap, heap);
+
+	*buf = NULL;
+
+	if (!try_heap && !heap) {
+		CAM_ERR(CAM_MEM,
+			"No heap available for allocation, cant allocate");
+		return -EINVAL;
+	}
+
+	if (try_heap) {
+		*buf = dma_heap_buffer_alloc(try_heap, len, O_RDWR, 0);
+		if (IS_ERR_OR_NULL(*buf)) {
+			CAM_WARN(CAM_MEM,
+				"Failed in allocating from try heap, heap=%pK, len=%zu, err=%ld",
+				try_heap, len, PTR_ERR(*buf));
+			*buf = NULL;
+		}
+	}
+
+	if (*buf == NULL) {
+		*buf = dma_heap_buffer_alloc(heap, len, O_RDWR, 0);
+		if (IS_ERR_OR_NULL(*buf)) {
+			rc = PTR_ERR(*buf);
+			CAM_ERR(CAM_MEM,
+				"Failed in allocating from heap, heap=%pK, len=%zu, err=%d",
+				heap, len, rc);
+			*buf = NULL;
+			return rc;
+		}
+	}
+#ifdef CONFIG_SPECTRA_SECURE
+	if (cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) {
+		if (num_vmids >= CAM_MAX_VMIDS) {
+			CAM_ERR(CAM_MEM, "Insufficient array size for vmids %d", num_vmids);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		arg.nr_acl_entries = num_vmids;
+		arg.vmids = vmids;
+		arg.perms = perms;
+
+		rc = mem_buf_lend(*buf, &arg);
+		if (rc) {
+			CAM_ERR(CAM_MEM,
+				"Failed in buf lend rc=%d, buf=%pK, vmids [0]=0x%x, [1]=0x%x, [2]=0x%x",
+				rc, *buf, vmids[0], vmids[1], vmids[2]);
+			goto end;
+		}
+	}
+#endif /* CONFIG_SPECTRA_SECURE */
+
+	CAM_DBG(CAM_MEM, "Allocate success, len=%zu, *buf=%pK", len, *buf);
+
+	if (tbl.alloc_profile_enable) {
+		CAM_GET_TIMESTAMP(ts2);
+		CAM_GET_TIMESTAMP_DIFF_IN_MICRO(ts1, ts2, microsec);
+		trace_cam_log_event("IONAllocProfile", "size and time in micro",
+			len, microsec);
+	}
+
+	return rc;
+
+#ifdef CONFIG_SPECTRA_SECURE
+end:
+	dma_buf_put(*buf);
+	return rc;
+#endif /* CONFIG_SPECTRA_SECURE */
+}
+#else
+static int cam_mem_util_get_dma_buf(size_t len,
+	unsigned int cam_flags,
+	struct dma_buf **buf)
+{
+	int rc = 0;
+	unsigned int heap_id;
+	int32_t ion_flag = 0;
+	struct timespec64 ts1, ts2;
+	long microsec = 0;
+
+	if (!buf) {
+		CAM_ERR(CAM_MEM, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (tbl.alloc_profile_enable)
+		CAM_GET_TIMESTAMP(ts1);
+
+	if ((cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) &&
+		(cam_flags & CAM_MEM_FLAG_CDSP_OUTPUT)) {
+		heap_id = ION_HEAP(ION_SECURE_DISPLAY_HEAP_ID);
+		ion_flag |=
+			ION_FLAG_SECURE | ION_FLAG_CP_CAMERA | ION_FLAG_CP_CDSP;
+	} else if (cam_flags & CAM_MEM_FLAG_PROTECTED_MODE) {
+		heap_id = ION_HEAP(ION_SECURE_DISPLAY_HEAP_ID);
+		ion_flag |= ION_FLAG_SECURE | ION_FLAG_CP_CAMERA;
+	} else {
+		heap_id = ION_HEAP(ION_SYSTEM_HEAP_ID) |
+			ION_HEAP(ION_CAMERA_HEAP_ID);
+	}
+
+	if (cam_flags & CAM_MEM_FLAG_CACHE)
+		ion_flag |= ION_FLAG_CACHED;
+	else
+		ion_flag &= ~ION_FLAG_CACHED;
+
+	if (tbl.force_cache_allocs && (!(ion_flag & ION_FLAG_SECURE)))
+		ion_flag |= ION_FLAG_CACHED;
+
+	*buf = ion_alloc(len, heap_id, ion_flag);
+	if (IS_ERR_OR_NULL(*buf))
+		return -ENOMEM;
+
+	if (tbl.alloc_profile_enable) {
+		CAM_GET_TIMESTAMP(ts2);
+		CAM_GET_TIMESTAMP_DIFF_IN_MICRO(ts1, ts2, microsec);
+		trace_cam_log_event("IONAllocProfile", "size and time in micro",
+			len, microsec);
+	}
+
+	return rc;
+}
+#endif
+
+static int cam_mem_util_buffer_alloc(struct cam_mem_mgr_alloc_cmd_v2 *cmd,
+	struct dma_buf **dmabuf,
+	int *fd)
+{
+	int rc;
+	struct dma_buf *temp_dmabuf = NULL;
+
+	rc = cam_mem_util_get_dma_buf(cmd->len,
+		cmd->flags,
+		dmabuf);
+	if (rc) {
+		CAM_ERR(CAM_MEM,
+			"Error allocating dma buf : len=%llu, flags=0x%x",
+			cmd->len, cmd->flags);
+		return rc;
+	}
+
+	*fd = dma_buf_fd(*dmabuf, O_CLOEXEC);
+	if (*fd < 0) {
+		CAM_ERR(CAM_MEM, "get fd fail, *fd=%d", *fd);
+		rc = -EINVAL;
+		goto put_buf;
+	}
+
+	CAM_DBG(CAM_MEM, "Alloc success : len=%zu, *dmabuf=%pK, fd=%d",
+		cmd->len, *dmabuf, *fd);
+
+	/*
+	 * increment the ref count so that ref count becomes 2 here
+	 * when we close fd, refcount becomes 1 and when we do
+	 * dmap_put_buf, ref count becomes 0 and memory will be freed.
+	 */
+	temp_dmabuf = dma_buf_get(*fd);
+	if (IS_ERR_OR_NULL(temp_dmabuf)) {
+		CAM_ERR(CAM_MEM, "dma_buf_get failed, *fd=%d", *fd);
+		rc = -EINVAL;
+		goto put_buf;
+	}
+
+	return rc;
+
+put_buf:
+	dma_buf_put(*dmabuf);
+	return rc;
+}
+
+
+static int cam_mem_util_check_alloc_flags(struct cam_mem_mgr_alloc_cmd_v2 *cmd)
+{
+	if (cmd->num_hdl > CAM_MEM_MMU_MAX_HANDLE) {
+		CAM_ERR(CAM_MEM, "Num of mmu hdl exceeded maximum(%d)",
+			CAM_MEM_MMU_MAX_HANDLE);
+		return -EINVAL;
+	}
+
+	if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE &&
+		cmd->flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		CAM_ERR(CAM_MEM, "Kernel mapping in secure mode not allowed");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_mem_util_check_map_flags(struct cam_mem_mgr_map_cmd_v2 *cmd)
+{
+	if (!cmd->flags) {
+		CAM_ERR(CAM_MEM, "Invalid flags");
+		return -EINVAL;
+	}
+
+	if (cmd->num_hdl > CAM_MEM_MMU_MAX_HANDLE) {
+		CAM_ERR(CAM_MEM, "Num of mmu hdl %d exceeded maximum(%d)",
+			cmd->num_hdl, CAM_MEM_MMU_MAX_HANDLE);
+		return -EINVAL;
+	}
+
+	if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE &&
+		cmd->flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		CAM_ERR(CAM_MEM,
+			"Kernel mapping in secure mode not allowed, flags=0x%x",
+			cmd->flags);
+		return -EINVAL;
+	}
+
+	if (cmd->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) {
+		CAM_ERR(CAM_MEM,
+			"Shared memory buffers are not allowed to be mapped");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_mem_util_map_hw_va(uint32_t flags,
+	int32_t *mmu_hdls,
+	int32_t num_hdls,
+	int fd, struct dma_buf *dmabuf,
+	dma_addr_t *hw_vaddr,
+	size_t *len,
+	enum cam_smmu_region_id region,
+	bool is_internal)
+{
+	int i;
+	int rc = -1;
+	int dir = cam_mem_util_get_dma_dir(flags);
+	bool dis_delayed_unmap = false;
+
+	if (dir < 0) {
+		CAM_ERR(CAM_MEM, "fail to map DMA direction, dir=%d", dir);
+		return dir;
+	}
+
+	if (flags & CAM_MEM_FLAG_DISABLE_DELAYED_UNMAP)
+		dis_delayed_unmap = true;
+
+	CAM_DBG(CAM_MEM,
+		"map_hw_va : fd = %d,  flags = 0x%x, dir=%d, num_hdls=%d",
+		fd, flags, dir, num_hdls);
+
+	if (flags & CAM_MEM_FLAG_PROTECTED_MODE) {
+		for (i = 0; i < num_hdls; i++) {
+			rc = cam_smmu_map_stage2_iova(mmu_hdls[i],
+				fd,
+				dir,
+				hw_vaddr,
+				len,
+				dmabuf);
+
+			if (rc < 0) {
+				CAM_ERR(CAM_MEM,
+					"Failed to securely map to smmu, i=%d, fd=%d, dir=%d, mmu_hdl=%d, rc=%d",
+					i, fd, dir, mmu_hdls[i], rc);
+				goto multi_map_fail;
+			}
+		}
+	} else {
+		for (i = 0; i < num_hdls; i++) {
+			rc = cam_smmu_map_user_iova(mmu_hdls[i],
+				fd,
+				dis_delayed_unmap,
+				dir,
+				(dma_addr_t *)hw_vaddr,
+				len,
+				region,
+				is_internal,
+				dmabuf);
+
+			if (rc < 0) {
+				CAM_ERR(CAM_MEM,
+					"Failed to map to smmu, i=%d, fd=%d, dir=%d, mmu_hdl=%d, region=%d, rc=%d",
+					i, fd, dir, mmu_hdls[i], region, rc);
+				goto multi_map_fail;
+			}
+		}
+	}
+
+	return rc;
+multi_map_fail:
+	if (flags & CAM_MEM_FLAG_PROTECTED_MODE)
+		for (--i; i >= 0; i--)
+			cam_smmu_unmap_stage2_iova(mmu_hdls[i], fd);
+	else
+		for (--i; i >= 0; i--)
+			cam_smmu_unmap_user_iova(mmu_hdls[i],
+				fd,
+				CAM_SMMU_REGION_IO);
+	return rc;
+
+}
+
+int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd_v2 *cmd)
+{
+	int rc;
+	int32_t idx;
+	struct dma_buf *dmabuf = NULL;
+	int fd = -1;
+	dma_addr_t hw_vaddr = 0;
+	size_t len;
+	uintptr_t kvaddr = 0;
+	size_t klen;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_MEM, " Invalid argument");
+		return -EINVAL;
+	}
+	len = cmd->len;
+
+	rc = cam_mem_util_check_alloc_flags(cmd);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Invalid flags: flags = 0x%X, rc=%d",
+			cmd->flags, rc);
+		return rc;
+	}
+
+	rc = cam_mem_util_buffer_alloc(cmd,
+		&dmabuf,
+		&fd);
+	if (rc) {
+		CAM_ERR(CAM_MEM,
+			"Ion Alloc failed, len=%llu, align=%llu, flags=0x%x, num_hdl=%d",
+			cmd->len, cmd->align, cmd->flags, cmd->num_hdl);
+		cam_mem_mgr_print_tbl();
+		return rc;
+	}
+
+	idx = cam_mem_get_slot();
+	if (idx < 0) {
+		CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d", idx);
+		rc = -ENOMEM;
+		goto slot_fail;
+	}
+
+	if (cam_dma_buf_set_name(dmabuf, cmd->buf_name))
+		CAM_ERR(CAM_MEM, "set dma buffer name(%s) failed", cmd->buf_name);
+
+	if ((cmd->flags & CAM_MEM_FLAG_HW_READ_WRITE) ||
+		(cmd->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) ||
+		(cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)) {
+
+		enum cam_smmu_region_id region;
+
+		if (cmd->flags & CAM_MEM_FLAG_HW_READ_WRITE)
+			region = CAM_SMMU_REGION_IO;
+
+
+		if (cmd->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS)
+			region = CAM_SMMU_REGION_SHARED;
+
+		if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)
+			region = CAM_SMMU_REGION_SECHEAP;
+
+		rc = cam_mem_util_map_hw_va(cmd->flags,
+			cmd->mmu_hdls,
+			cmd->num_hdl,
+			fd,
+			dmabuf,
+			&hw_vaddr,
+			&len,
+			region,
+			true);
+
+		if (rc) {
+			CAM_ERR(CAM_MEM,
+				"Failed in map_hw_va len=%zu, flags=0x%x, fd=%d, region=%d, num_hdl=%d, rc=%d",
+				len, cmd->flags,
+				fd, region, cmd->num_hdl, rc);
+			if (rc == -EALREADY) {
+				if ((size_t)dmabuf->size != len)
+					rc = -EBADR;
+				cam_mem_mgr_print_tbl();
+			}
+			goto map_hw_fail;
+		}
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	tbl.bufq[idx].fd = fd;
+	tbl.bufq[idx].dma_buf = NULL;
+	tbl.bufq[idx].flags = cmd->flags;
+	tbl.bufq[idx].buf_handle = GET_MEM_HANDLE(idx, fd);
+	tbl.bufq[idx].is_internal = true;
+	if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)
+		CAM_MEM_MGR_SET_SECURE_HDL(tbl.bufq[idx].buf_handle, true);
+
+	if (cmd->flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		rc = cam_mem_util_map_cpu_va(dmabuf, &kvaddr, &klen);
+		if (rc) {
+			CAM_ERR(CAM_MEM, "dmabuf: %pK mapping failed: %d",
+				dmabuf, rc);
+			goto map_kernel_fail;
+		}
+	}
+
+	if (cmd->flags & CAM_MEM_FLAG_KMD_DEBUG_FLAG)
+		tbl.dbg_buf_idx = idx;
+
+	tbl.bufq[idx].kmdvaddr = kvaddr;
+	tbl.bufq[idx].vaddr = hw_vaddr;
+	tbl.bufq[idx].dma_buf = dmabuf;
+	tbl.bufq[idx].len = len;
+	tbl.bufq[idx].num_hdl = cmd->num_hdl;
+	memcpy(tbl.bufq[idx].hdls, cmd->mmu_hdls,
+		sizeof(int32_t) * cmd->num_hdl);
+	tbl.bufq[idx].is_imported = false;
+
+	if (cmd->flags & CAM_MEM_FLAG_KMD_ACCESS)
+		kref_init(&tbl.bufq[idx].krefcount);
+
+	kref_init(&tbl.bufq[idx].urefcount);
+
+	tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_USER;
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	cmd->out.buf_handle = tbl.bufq[idx].buf_handle;
+	cmd->out.fd = tbl.bufq[idx].fd;
+	cmd->out.vaddr = 0;
+
+	CAM_DBG(CAM_MEM,
+		"fd=%d, flags=0x%x, num_hdl=%d, idx=%d, buf handle=%x, len=%zu name:%s",
+		cmd->out.fd, cmd->flags, cmd->num_hdl, idx, cmd->out.buf_handle,
+		tbl.bufq[idx].len, cmd->buf_name);
+
+	return rc;
+
+map_kernel_fail:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+map_hw_fail:
+	cam_mem_put_slot(idx);
+slot_fail:
+	dma_buf_put(dmabuf);
+	return rc;
+}
+
+static bool cam_mem_util_is_map_internal(int32_t fd)
+{
+	uint32_t i;
+	bool is_internal = false;
+
+	mutex_lock(&tbl.m_lock);
+	for_each_set_bit(i, tbl.bitmap, tbl.bits) {
+		if (tbl.bufq[i].fd == fd) {
+			is_internal = tbl.bufq[i].is_internal;
+			break;
+		}
+	}
+	mutex_unlock(&tbl.m_lock);
+
+	return is_internal;
+}
+
+int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd_v2 *cmd)
+{
+	int32_t idx;
+	int rc;
+	struct dma_buf *dmabuf;
+	dma_addr_t hw_vaddr = 0;
+	size_t len = 0;
+	bool is_internal = false;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!cmd || (cmd->fd < 0)) {
+		CAM_ERR(CAM_MEM, "Invalid argument");
+		return -EINVAL;
+	}
+
+	if (cmd->num_hdl > CAM_MEM_MMU_MAX_HANDLE) {
+		CAM_ERR(CAM_MEM, "Num of mmu hdl %d exceeded maximum(%d)",
+			cmd->num_hdl, CAM_MEM_MMU_MAX_HANDLE);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_util_check_map_flags(cmd);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Invalid flags: flags = %X", cmd->flags);
+		return rc;
+	}
+
+	dmabuf = dma_buf_get(cmd->fd);
+	if (IS_ERR_OR_NULL((void *)(dmabuf))) {
+		CAM_ERR(CAM_MEM, "Failed to import dma_buf fd");
+		return -EINVAL;
+	}
+
+	is_internal = cam_mem_util_is_map_internal(cmd->fd);
+
+	idx = cam_mem_get_slot();
+	if (idx < 0) {
+		CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d, fd=%d",
+			idx, cmd->fd);
+		rc = -ENOMEM;
+		goto slot_fail;
+	}
+
+	if (cam_dma_buf_set_name(dmabuf, cmd->buf_name))
+		CAM_ERR(CAM_MEM, "set dma buffer name(%s) failed", cmd->buf_name);
+
+	if ((cmd->flags & CAM_MEM_FLAG_HW_READ_WRITE) ||
+		(cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)) {
+		rc = cam_mem_util_map_hw_va(cmd->flags,
+			cmd->mmu_hdls,
+			cmd->num_hdl,
+			cmd->fd,
+			dmabuf,
+			&hw_vaddr,
+			&len,
+			CAM_SMMU_REGION_IO,
+			is_internal);
+		if (rc) {
+			CAM_ERR(CAM_MEM,
+				"Failed in map_hw_va, flags=0x%x, fd=%d, len=%zu, region=%d, num_hdl=%d, rc=%d",
+				cmd->flags, cmd->fd, len,
+				CAM_SMMU_REGION_IO, cmd->num_hdl, rc);
+			if (rc == -EALREADY) {
+				if ((size_t)dmabuf->size != len) {
+					rc = -EBADR;
+					cam_mem_mgr_print_tbl();
+				}
+			}
+			goto map_fail;
+		}
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	tbl.bufq[idx].fd = cmd->fd;
+	tbl.bufq[idx].dma_buf = NULL;
+	tbl.bufq[idx].flags = cmd->flags;
+	tbl.bufq[idx].buf_handle = GET_MEM_HANDLE(idx, cmd->fd);
+	if (cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)
+		CAM_MEM_MGR_SET_SECURE_HDL(tbl.bufq[idx].buf_handle, true);
+	tbl.bufq[idx].kmdvaddr = 0;
+
+	if (cmd->num_hdl > 0)
+		tbl.bufq[idx].vaddr = hw_vaddr;
+	else
+		tbl.bufq[idx].vaddr = 0;
+
+	tbl.bufq[idx].dma_buf = dmabuf;
+	tbl.bufq[idx].len = len;
+	tbl.bufq[idx].num_hdl = cmd->num_hdl;
+	memcpy(tbl.bufq[idx].hdls, cmd->mmu_hdls,
+		sizeof(int32_t) * cmd->num_hdl);
+	tbl.bufq[idx].is_imported = true;
+	tbl.bufq[idx].is_internal = is_internal;
+	if (cmd->flags & CAM_MEM_FLAG_KMD_ACCESS)
+		kref_init(&tbl.bufq[idx].krefcount);
+	kref_init(&tbl.bufq[idx].urefcount);
+	tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_USER;
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	cmd->out.buf_handle = tbl.bufq[idx].buf_handle;
+	cmd->out.vaddr = 0;
+	cmd->out.size = (uint32_t)len;
+	CAM_DBG(CAM_MEM,
+		"fd=%d, flags=0x%x, num_hdl=%d, idx=%d, buf handle=%x, len=%zu name:%s",
+		cmd->fd, cmd->flags, cmd->num_hdl, idx, cmd->out.buf_handle,
+		tbl.bufq[idx].len, cmd->buf_name);
+
+	return rc;
+map_fail:
+	cam_mem_put_slot(idx);
+slot_fail:
+	dma_buf_put(dmabuf);
+	return rc;
+}
+
+static int cam_mem_util_unmap_hw_va(int32_t idx,
+	enum cam_smmu_region_id region,
+	enum cam_smmu_mapping_client client)
+{
+	int i;
+	uint32_t flags;
+	int32_t *mmu_hdls;
+	int num_hdls;
+	int fd;
+	int rc = 0;
+
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index");
+		return -EINVAL;
+	}
+
+	flags = tbl.bufq[idx].flags;
+	mmu_hdls = tbl.bufq[idx].hdls;
+	num_hdls = tbl.bufq[idx].num_hdl;
+	fd = tbl.bufq[idx].fd;
+
+	CAM_DBG(CAM_MEM,
+		"unmap_hw_va : idx=%d, fd=%x, flags=0x%x, num_hdls=%d, client=%d",
+		idx, fd, flags, num_hdls, client);
+
+	if (flags & CAM_MEM_FLAG_PROTECTED_MODE) {
+		for (i = 0; i < num_hdls; i++) {
+			rc = cam_smmu_unmap_stage2_iova(mmu_hdls[i], fd);
+			if (rc < 0) {
+				CAM_ERR(CAM_MEM,
+					"Failed in secure unmap, i=%d, fd=%d, mmu_hdl=%d, rc=%d",
+					i, fd, mmu_hdls[i], rc);
+				goto unmap_end;
+			}
+		}
+	} else {
+		for (i = 0; i < num_hdls; i++) {
+			if (client == CAM_SMMU_MAPPING_USER) {
+				rc = cam_smmu_unmap_user_iova(mmu_hdls[i],
+					fd, region);
+			} else if (client == CAM_SMMU_MAPPING_KERNEL) {
+				rc = cam_smmu_unmap_kernel_iova(mmu_hdls[i],
+					tbl.bufq[idx].dma_buf, region);
+			} else {
+				CAM_ERR(CAM_MEM,
+					"invalid caller for unmapping : %d",
+					client);
+				rc = -EINVAL;
+			}
+			if (rc < 0) {
+				CAM_ERR(CAM_MEM,
+					"Failed in unmap, i=%d, fd=%d, mmu_hdl=%d, region=%d, rc=%d",
+					i, fd, mmu_hdls[i], region, rc);
+				goto unmap_end;
+			}
+		}
+	}
+
+	return rc;
+
+unmap_end:
+	CAM_ERR(CAM_MEM, "unmapping failed");
+	return rc;
+}
+
+static void cam_mem_mgr_unmap_active_buf(int idx)
+{
+	enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED;
+
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_SHARED_ACCESS)
+		region = CAM_SMMU_REGION_SHARED;
+	else if (tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_READ_WRITE)
+		region = CAM_SMMU_REGION_IO;
+
+	cam_mem_util_unmap_hw_va(idx, region, CAM_SMMU_MAPPING_USER);
+
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS)
+		cam_mem_util_unmap_cpu_va(tbl.bufq[idx].dma_buf,
+			tbl.bufq[idx].kmdvaddr);
+}
+
+static int cam_mem_mgr_cleanup_table(void)
+{
+	int i;
+
+	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
+		mutex_lock(&tbl.bufq[i].q_lock);
+		if (!tbl.bufq[i].active) {
+			CAM_DBG(CAM_MEM,
+				"Buffer inactive at idx=%d, continuing", i);
+			mutex_unlock(&tbl.bufq[i].q_lock);
+			mutex_destroy(&tbl.bufq[i].q_lock);
+			continue;
+		} else {
+			CAM_DBG(CAM_MEM,
+			"Active buffer at idx=%d, possible leak needs unmapping",
+			i);
+			cam_mem_mgr_unmap_active_buf(i);
+		}
+
+		mutex_lock(&tbl.bufq[i].q_lock);
+		if (tbl.bufq[i].dma_buf) {
+			dma_buf_put(tbl.bufq[i].dma_buf);
+			tbl.bufq[i].dma_buf = NULL;
+		}
+		tbl.bufq[i].fd = -1;
+		tbl.bufq[i].flags = 0;
+		tbl.bufq[i].buf_handle = -1;
+		tbl.bufq[i].vaddr = 0;
+		tbl.bufq[i].len = 0;
+		memset(tbl.bufq[i].hdls, 0,
+			sizeof(int32_t) * tbl.bufq[i].num_hdl);
+		tbl.bufq[i].num_hdl = 0;
+		tbl.bufq[i].dma_buf = NULL;
+		tbl.bufq[i].active = false;
+		tbl.bufq[i].is_internal = false;
+		kref_init(&tbl.bufq[i].krefcount);
+		kref_init(&tbl.bufq[i].urefcount);
+		mutex_unlock(&tbl.bufq[i].q_lock);
+		mutex_destroy(&tbl.bufq[i].q_lock);
+	}
+	mutex_lock(&tbl.m_lock);
+	bitmap_zero(tbl.bitmap, tbl.bits);
+	/* We need to reserve slot 0 because 0 is invalid */
+	set_bit(0, tbl.bitmap);
+	mutex_unlock(&tbl.m_lock);
+
+	return 0;
+}
+
+void cam_mem_mgr_deinit(void)
+{
+	atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_UNINITIALIZED);
+	cam_mem_mgr_cleanup_table();
+	debugfs_remove_recursive(tbl.dentry);
+	mutex_lock(&tbl.m_lock);
+	bitmap_zero(tbl.bitmap, tbl.bits);
+	kfree(tbl.bitmap);
+	tbl.bitmap = NULL;
+	tbl.dbg_buf_idx = -1;
+	mutex_unlock(&tbl.m_lock);
+	mutex_destroy(&tbl.m_lock);
+}
+
+static void cam_mem_util_unmap_dummy(struct kref *kref)
+{
+	CAM_DBG(CAM_MEM, "Cam mem util unmap dummy");
+}
+
+static void cam_mem_util_unmap(int32_t idx)
+{
+	int rc = 0;
+	enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED;
+	enum cam_smmu_mapping_client client;
+
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index");
+		return;
+	}
+
+	client = tbl.bufq[idx].smmu_mapping_client;
+
+	CAM_DBG(CAM_MEM, "Flags = %X idx %d", tbl.bufq[idx].flags, idx);
+
+	if ((!tbl.bufq[idx].active) &&
+		(tbl.bufq[idx].vaddr) == 0) {
+		CAM_WARN(CAM_MEM, "Buffer at idx=%d is already unmapped,",
+			idx);
+		return;
+	}
+
+	/* Deactivate the buffer queue to prevent multiple unmap */
+	tbl.bufq[idx].active = false;
+	tbl.bufq[idx].vaddr = 0;
+
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		if (tbl.bufq[idx].dma_buf && tbl.bufq[idx].kmdvaddr) {
+			rc = cam_mem_util_unmap_cpu_va(tbl.bufq[idx].dma_buf,
+				tbl.bufq[idx].kmdvaddr);
+			if (rc)
+				CAM_ERR(CAM_MEM,
+					"Failed, dmabuf=%pK, kmdvaddr=%pK",
+					tbl.bufq[idx].dma_buf,
+					(void *) tbl.bufq[idx].kmdvaddr);
+		}
+	}
+
+	/* SHARED flag gets precedence, all other flags after it */
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) {
+		region = CAM_SMMU_REGION_SHARED;
+	} else {
+		if (tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_READ_WRITE)
+			region = CAM_SMMU_REGION_IO;
+	}
+
+	if ((tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_READ_WRITE) ||
+		(tbl.bufq[idx].flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) ||
+		(tbl.bufq[idx].flags & CAM_MEM_FLAG_PROTECTED_MODE)) {
+		if (cam_mem_util_unmap_hw_va(idx, region, client))
+			CAM_ERR(CAM_MEM, "Failed, dmabuf=%pK",
+				tbl.bufq[idx].dma_buf);
+	}
+
+	tbl.bufq[idx].flags = 0;
+	tbl.bufq[idx].buf_handle = -1;
+	memset(tbl.bufq[idx].hdls, 0,
+		sizeof(int32_t) * CAM_MEM_MMU_MAX_HANDLE);
+
+	CAM_DBG(CAM_MEM,
+		"Ion buf at idx = %d freeing fd = %d, imported %d, dma_buf %pK",
+		idx, tbl.bufq[idx].fd,
+		tbl.bufq[idx].is_imported,
+		tbl.bufq[idx].dma_buf);
+
+	dma_buf_put(tbl.bufq[idx].dma_buf);
+
+	tbl.bufq[idx].fd = -1;
+	tbl.bufq[idx].dma_buf = NULL;
+	tbl.bufq[idx].is_imported = false;
+	tbl.bufq[idx].is_internal = false;
+	tbl.bufq[idx].len = 0;
+	tbl.bufq[idx].num_hdl = 0;
+	memset(&tbl.bufq[idx].timestamp, 0, sizeof(struct timespec64));
+	memset(&tbl.bufq[idx].krefcount, 0, sizeof(struct kref));
+	memset(&tbl.bufq[idx].urefcount, 0, sizeof(struct kref));
+
+	mutex_lock(&tbl.m_lock);
+	clear_bit(idx, tbl.bitmap);
+	mutex_unlock(&tbl.m_lock);
+
+}
+
+static void cam_mem_util_unmap_wrapper(struct kref *kref)
+{
+	int32_t idx;
+	struct cam_mem_buf_queue *bufq = container_of(kref, typeof(*bufq), krefcount);
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(bufq->buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "idx: %d not valid", idx);
+		return;
+	}
+
+	cam_mem_util_unmap(idx);
+}
+
+void cam_mem_put_cpu_buf(int32_t buf_handle)
+{
+	int idx;
+	uint32_t krefcount = 0, urefcount = 0;
+	bool unmap = false;
+
+	if (!buf_handle) {
+		CAM_ERR(CAM_MEM, "Invalid buf_handle");
+		return;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "idx: %d not valid", idx);
+		return;
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "idx: %d not active", idx);
+		goto end;
+	}
+
+	if (buf_handle != tbl.bufq[idx].buf_handle) {
+		CAM_ERR(CAM_MEM, "idx: %d Invalid buf handle %d",
+				idx, buf_handle);
+		goto end;
+	}
+
+	kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap_dummy);
+
+	krefcount = kref_read(&tbl.bufq[idx].krefcount);
+	urefcount = kref_read(&tbl.bufq[idx].urefcount);
+
+	if ((krefcount == 1) && (urefcount == 0))
+		unmap = true;
+
+	if (unmap) {
+		cam_mem_util_unmap(idx);
+		CAM_DBG(CAM_MEM,
+			"Called unmap from here, buf_handle: %u, idx: %d", buf_handle, idx);
+	} else if (krefcount == 0) {
+		CAM_ERR(CAM_MEM,
+			"Unbalanced release Called buf_handle: %u, idx: %d",
+			tbl.bufq[idx].buf_handle, idx);
+	}
+
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+}
+EXPORT_SYMBOL(cam_mem_put_cpu_buf);
+
+
+int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd)
+{
+	int idx;
+	int rc = 0;
+	uint32_t krefcount = 0, urefcount = 0;
+	bool unmap = false;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		CAM_ERR(CAM_MEM, "Invalid argument");
+		return -EINVAL;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(cmd->buf_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index %d extracted from mem handle",
+			idx);
+		return -EINVAL;
+	}
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		CAM_ERR(CAM_MEM, "Released buffer state should be active");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tbl.bufq[idx].buf_handle != cmd->buf_handle) {
+		CAM_ERR(CAM_MEM,
+			"Released buf handle %d not matching within table %d, idx=%d",
+			cmd->buf_handle, tbl.bufq[idx].buf_handle, idx);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_MEM, "Releasing hdl = %x, idx = %d", cmd->buf_handle, idx);
+
+	kref_put(&tbl.bufq[idx].urefcount, cam_mem_util_unmap_dummy);
+
+	urefcount = kref_read(&tbl.bufq[idx].urefcount);
+
+	if (tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS) {
+		krefcount = kref_read(&tbl.bufq[idx].krefcount);
+		if ((krefcount == 1) && (urefcount == 0))
+			unmap = true;
+	} else {
+		if (urefcount == 0)
+			unmap = true;
+	}
+
+	if (unmap) {
+		cam_mem_util_unmap(idx);
+		CAM_DBG(CAM_MEM,
+			"Called unmap from here, buf_handle: %u, idx: %d", cmd->buf_handle, idx);
+	}
+
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+
+int cam_mem_mgr_request_mem(struct cam_mem_mgr_request_desc *inp,
+	struct cam_mem_mgr_memory_desc *out)
+{
+	struct dma_buf *buf = NULL;
+	int ion_fd = -1;
+	int rc = 0;
+	uintptr_t kvaddr;
+	dma_addr_t iova = 0;
+	size_t request_len = 0;
+	uint32_t mem_handle;
+	int32_t idx;
+	int32_t smmu_hdl = 0;
+	int32_t num_hdl = 0;
+
+	enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!inp || !out) {
+		CAM_ERR(CAM_MEM, "Invalid params");
+		return -EINVAL;
+	}
+
+	if (!(inp->flags & CAM_MEM_FLAG_HW_READ_WRITE ||
+		inp->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS ||
+		inp->flags & CAM_MEM_FLAG_CACHE)) {
+		CAM_ERR(CAM_MEM, "Invalid flags for request mem");
+		return -EINVAL;
+	}
+
+	rc = cam_mem_util_get_dma_buf(inp->size, inp->flags, &buf);
+
+	if (rc) {
+		CAM_ERR(CAM_MEM, "ION alloc failed for shared buffer");
+		goto ion_fail;
+	} else {
+		CAM_DBG(CAM_MEM, "Got dma_buf = %pK", buf);
+	}
+
+	/*
+	 * we are mapping kva always here,
+	 * update flags so that we do unmap properly
+	 */
+	inp->flags |= CAM_MEM_FLAG_KMD_ACCESS;
+	rc = cam_mem_util_map_cpu_va(buf, &kvaddr, &request_len);
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Failed to get kernel vaddr");
+		goto map_fail;
+	}
+
+	if (!inp->smmu_hdl) {
+		CAM_ERR(CAM_MEM, "Invalid SMMU handle");
+		rc = -EINVAL;
+		goto smmu_fail;
+	}
+
+	/* SHARED flag gets precedence, all other flags after it */
+	if (inp->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) {
+		region = CAM_SMMU_REGION_SHARED;
+	} else {
+		if (inp->flags & CAM_MEM_FLAG_HW_READ_WRITE)
+			region = CAM_SMMU_REGION_IO;
+	}
+
+	rc = cam_smmu_map_kernel_iova(inp->smmu_hdl,
+		buf,
+		CAM_SMMU_MAP_RW,
+		&iova,
+		&request_len,
+		region);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_MEM, "SMMU mapping failed");
+		goto smmu_fail;
+	}
+
+	smmu_hdl = inp->smmu_hdl;
+	num_hdl = 1;
+
+	idx = cam_mem_get_slot();
+	if (idx < 0) {
+		CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d", idx);
+		rc = -ENOMEM;
+		goto slot_fail;
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	mem_handle = GET_MEM_HANDLE(idx, ion_fd);
+	tbl.bufq[idx].dma_buf = buf;
+	tbl.bufq[idx].fd = -1;
+	tbl.bufq[idx].flags = inp->flags;
+	tbl.bufq[idx].buf_handle = mem_handle;
+	tbl.bufq[idx].kmdvaddr = kvaddr;
+
+	tbl.bufq[idx].vaddr = iova;
+
+	tbl.bufq[idx].len = inp->size;
+	tbl.bufq[idx].num_hdl = num_hdl;
+	memcpy(tbl.bufq[idx].hdls, &smmu_hdl,
+		sizeof(int32_t));
+	tbl.bufq[idx].is_imported = false;
+	kref_init(&tbl.bufq[idx].krefcount);
+	tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_KERNEL;
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	out->kva = kvaddr;
+	out->iova = (uint32_t)iova;
+	out->smmu_hdl = smmu_hdl;
+	out->mem_handle = mem_handle;
+	out->len = inp->size;
+	out->region = region;
+
+	return rc;
+slot_fail:
+	cam_smmu_unmap_kernel_iova(inp->smmu_hdl,
+		buf, region);
+smmu_fail:
+	cam_mem_util_unmap_cpu_va(buf, kvaddr);
+map_fail:
+	dma_buf_put(buf);
+ion_fail:
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_request_mem);
+
+int cam_mem_mgr_release_mem(struct cam_mem_mgr_memory_desc *inp)
+{
+	int32_t idx;
+	int rc = 0;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!inp) {
+		CAM_ERR(CAM_MEM, "Invalid argument");
+		return -EINVAL;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(inp->mem_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index extracted from mem handle");
+		return -EINVAL;
+	}
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		if (tbl.bufq[idx].vaddr == 0) {
+			CAM_ERR(CAM_MEM, "buffer is released already");
+			mutex_unlock(&tbl.bufq[idx].q_lock);
+			return 0;
+		}
+		CAM_ERR(CAM_MEM, "Released buffer state should be active");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tbl.bufq[idx].buf_handle != inp->mem_handle) {
+		CAM_ERR(CAM_MEM,
+			"Released buf handle not matching within table");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_MEM, "Releasing hdl = %X", inp->mem_handle);
+	if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap_wrapper))
+		CAM_DBG(CAM_MEM,
+			"Called unmap from here, buf_handle: %u, idx: %d",
+			tbl.bufq[idx].buf_handle, idx);
+	else
+		rc = -EINVAL;
+
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_release_mem);
+
+int cam_mem_mgr_reserve_memory_region(struct cam_mem_mgr_request_desc *inp,
+	enum cam_smmu_region_id region,
+	struct cam_mem_mgr_memory_desc *out)
+{
+	struct dma_buf *buf = NULL;
+	int rc = 0;
+	int ion_fd = -1;
+	dma_addr_t iova = 0;
+	size_t request_len = 0;
+	uint32_t mem_handle;
+	int32_t idx;
+	int32_t smmu_hdl = 0;
+	int32_t num_hdl = 0;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!inp || !out) {
+		CAM_ERR(CAM_MEM, "Invalid param(s)");
+		return -EINVAL;
+	}
+
+	if (!inp->smmu_hdl) {
+		CAM_ERR(CAM_MEM, "Invalid SMMU handle");
+		return -EINVAL;
+	}
+
+	if (region != CAM_SMMU_REGION_SECHEAP) {
+		CAM_ERR(CAM_MEM, "Only secondary heap supported");
+		return -EINVAL;
+	}
+
+	rc = cam_mem_util_get_dma_buf(inp->size, 0, &buf);
+
+	if (rc) {
+		CAM_ERR(CAM_MEM, "ION alloc failed for sec heap buffer");
+		goto ion_fail;
+	} else {
+		CAM_DBG(CAM_MEM, "Got dma_buf = %pK", buf);
+	}
+
+	rc = cam_smmu_reserve_sec_heap(inp->smmu_hdl,
+		buf,
+		&iova,
+		&request_len);
+
+	if (rc) {
+		CAM_ERR(CAM_MEM, "Reserving secondary heap failed");
+		goto smmu_fail;
+	}
+
+	smmu_hdl = inp->smmu_hdl;
+	num_hdl = 1;
+
+	idx = cam_mem_get_slot();
+	if (idx < 0) {
+		CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d", idx);
+		rc = -ENOMEM;
+		goto slot_fail;
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	mem_handle = GET_MEM_HANDLE(idx, ion_fd);
+	tbl.bufq[idx].fd = -1;
+	tbl.bufq[idx].dma_buf = buf;
+	tbl.bufq[idx].flags = inp->flags;
+	tbl.bufq[idx].buf_handle = mem_handle;
+	tbl.bufq[idx].kmdvaddr = 0;
+
+	tbl.bufq[idx].vaddr = iova;
+
+	tbl.bufq[idx].len = request_len;
+	tbl.bufq[idx].num_hdl = num_hdl;
+	memcpy(tbl.bufq[idx].hdls, &smmu_hdl,
+		sizeof(int32_t));
+	tbl.bufq[idx].is_imported = false;
+	kref_init(&tbl.bufq[idx].krefcount);
+	tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_KERNEL;
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+
+	out->kva = 0;
+	out->iova = (uint32_t)iova;
+	out->smmu_hdl = smmu_hdl;
+	out->mem_handle = mem_handle;
+	out->len = request_len;
+	out->region = region;
+
+	return rc;
+
+slot_fail:
+	cam_smmu_release_sec_heap(smmu_hdl);
+smmu_fail:
+	dma_buf_put(buf);
+ion_fail:
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_reserve_memory_region);
+
+int cam_mem_mgr_free_memory_region(struct cam_mem_mgr_memory_desc *inp)
+{
+	int32_t idx;
+	int rc;
+	int32_t smmu_hdl;
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!inp) {
+		CAM_ERR(CAM_MEM, "Invalid argument");
+		return -EINVAL;
+	}
+
+	if (inp->region != CAM_SMMU_REGION_SECHEAP) {
+		CAM_ERR(CAM_MEM, "Only secondary heap supported");
+		return -EINVAL;
+	}
+
+	idx = CAM_MEM_MGR_GET_HDL_IDX(inp->mem_handle);
+	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) {
+		CAM_ERR(CAM_MEM, "Incorrect index extracted from mem handle");
+		return -EINVAL;
+	}
+
+	mutex_lock(&tbl.bufq[idx].q_lock);
+	if (!tbl.bufq[idx].active) {
+		if (tbl.bufq[idx].vaddr == 0) {
+			CAM_ERR(CAM_MEM, "buffer is released already");
+			mutex_unlock(&tbl.bufq[idx].q_lock);
+			return 0;
+		}
+		CAM_ERR(CAM_MEM, "Released buffer state should be active");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tbl.bufq[idx].buf_handle != inp->mem_handle) {
+		CAM_ERR(CAM_MEM,
+			"Released buf handle not matching within table");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (tbl.bufq[idx].num_hdl != 1) {
+		CAM_ERR(CAM_MEM,
+			"Sec heap region should have only one smmu hdl");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	memcpy(&smmu_hdl, tbl.bufq[idx].hdls,
+		sizeof(int32_t));
+	if (inp->smmu_hdl != smmu_hdl) {
+		CAM_ERR(CAM_MEM,
+			"Passed SMMU handle doesn't match with internal hdl");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	rc = cam_smmu_release_sec_heap(inp->smmu_hdl);
+	if (rc) {
+		CAM_ERR(CAM_MEM,
+			"Sec heap region release failed");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	CAM_DBG(CAM_MEM, "Releasing hdl = %X", inp->mem_handle);
+	if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap_wrapper))
+		CAM_DBG(CAM_MEM,
+			"Called unmap from here, buf_handle: %u, idx: %d",
+			inp->mem_handle, idx);
+	else
+		rc = -EINVAL;
+
+end:
+	mutex_unlock(&tbl.bufq[idx].q_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_mem_mgr_free_memory_region);
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_mem_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_mem_mgr.h
@@ -0,0 +1,156 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_MEM_MGR_H_
+#define _CAM_MEM_MGR_H_
+
+#include <linux/mutex.h>
+#include <linux/dma-buf.h>
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+#include <linux/dma-heap.h>
+#endif
+#include <media/cam_req_mgr.h>
+#include "cam_mem_mgr_api.h"
+
+/* Enum for possible mem mgr states */
+enum cam_mem_mgr_state {
+	CAM_MEM_MGR_UNINITIALIZED,
+	CAM_MEM_MGR_INITIALIZED,
+};
+
+/*Enum for possible SMMU operations */
+enum cam_smmu_mapping_client {
+	CAM_SMMU_MAPPING_USER,
+	CAM_SMMU_MAPPING_KERNEL,
+};
+
+/**
+ * struct cam_mem_buf_queue
+ *
+ * @dma_buf:        pointer to the allocated dma_buf in the table
+ * @q_lock:         mutex lock for buffer
+ * @hdls:           list of mapped handles
+ * @num_hdl:        number of handles
+ * @fd:             file descriptor of buffer
+ * @buf_handle:     unique handle for buffer
+ * @align:          alignment for allocation
+ * @len:            size of buffer
+ * @flags:          attributes of buffer
+ * @vaddr:          IOVA of buffer
+ * @kmdvaddr:       Kernel virtual address
+ * @active:         state of the buffer
+ * @is_imported:    Flag indicating if buffer is imported from an FD in user space
+ * @is_internal:    Flag indicating kernel allocated buffer
+ * @timestamp:      Timestamp at which this entry in tbl was made
+ * @krefcount:      Reference counter to track whether the buffer is
+ *                  mapped and in use by kmd
+ * @smmu_mapping_client: Client buffer (User or kernel)
+ * @urefcount:      Reference counter to track whether the buffer is
+ *                  mapped and in use by umd
+ */
+struct cam_mem_buf_queue {
+	struct dma_buf *dma_buf;
+	struct mutex q_lock;
+	int32_t hdls[CAM_MEM_MMU_MAX_HANDLE];
+	int32_t num_hdl;
+	int32_t fd;
+	int32_t buf_handle;
+	int32_t align;
+	size_t len;
+	uint32_t flags;
+	uint64_t vaddr;
+	uintptr_t kmdvaddr;
+	bool active;
+	bool is_imported;
+	bool is_internal;
+	struct timespec64 timestamp;
+	struct kref krefcount;
+	enum cam_smmu_mapping_client smmu_mapping_client;
+	struct kref urefcount;
+};
+
+/**
+ * struct cam_mem_table
+ *
+ * @m_lock: mutex lock for table
+ * @bitmap: bitmap of the mem mgr utility
+ * @bits: max bits of the utility
+ * @bufq: array of buffers
+ * @dentry: Debugfs entry
+ * @alloc_profile_enable: Whether to enable alloc profiling
+ * @dbg_buf_idx: debug buffer index to get usecases info
+ * @force_cache_allocs: Force all internal buffer allocations with cache
+ */
+struct cam_mem_table {
+	struct mutex m_lock;
+	void *bitmap;
+	size_t bits;
+	struct cam_mem_buf_queue bufq[CAM_MEM_BUFQ_MAX];
+	struct dentry *dentry;
+	bool alloc_profile_enable;
+	size_t dbg_buf_idx;
+	bool force_cache_allocs;
+#if IS_REACHABLE(CONFIG_DMABUF_HEAPS)
+	struct dma_heap *system_heap;
+	struct dma_heap *system_uncached_heap;
+	struct dma_heap *camera_heap;
+	struct dma_heap *camera_uncached_heap;
+	struct dma_heap *secure_display_heap;
+#endif
+
+};
+
+/**
+ * @brief: Allocates and maps buffer
+ *
+ * @cmd:   Allocation information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd_v2 *cmd);
+
+/**
+ * @brief: Releases a buffer reference
+ *
+ * @cmd:   Buffer release information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd);
+
+/**
+ * @brief Maps a buffer
+ *
+ * @cmd: Buffer mapping information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd_v2 *cmd);
+
+/**
+ * @brief: Perform cache ops on the buffer
+ *
+ * @cmd:   Cache ops information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_cache_ops(struct cam_mem_cache_ops_cmd *cmd);
+
+/**
+ * @brief: Initializes the memory manager
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_init(void);
+
+/**
+ * @brief:  Tears down the memory manager
+ *
+ * @return None
+ */
+void cam_mem_mgr_deinit(void);
+
+#endif /* _CAM_MEM_MGR_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_core.c
@@ -0,0 +1,4646 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include "cam_req_mgr_interface.h"
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_core.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_req_mgr_debug.h"
+#include "cam_trace.h"
+#include "cam_debug_util.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_req_mgr_debug.h"
+
+static struct cam_req_mgr_core_device *g_crm_core_dev;
+static struct cam_req_mgr_core_link g_links[MAXIMUM_LINKS_PER_SESSION];
+
+static void cam_req_mgr_core_link_reset(struct cam_req_mgr_core_link *link)
+{
+	uint32_t pd = 0;
+	int i = 0;
+
+	link->link_hdl = 0;
+	link->num_devs = 0;
+	link->max_delay = CAM_PIPELINE_DELAY_0;
+	link->workq = NULL;
+	link->pd_mask = 0;
+	link->l_dev = NULL;
+	link->req.in_q = NULL;
+	link->req.l_tbl = NULL;
+	link->req.num_tbl = 0;
+	link->watchdog = NULL;
+	link->state = CAM_CRM_LINK_STATE_AVAILABLE;
+	link->parent = NULL;
+	link->sync_link_sof_skip = false;
+	link->open_req_cnt = 0;
+	link->last_flush_id = 0;
+	link->initial_sync_req = -1;
+	link->dual_trigger = false;
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_EOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_EOF] = 0;
+	link->in_msync_mode = false;
+	link->retry_cnt = 0;
+	link->is_shutdown = false;
+	link->initial_skip = true;
+	link->sof_timestamp = 0;
+	link->prev_sof_timestamp = 0;
+	link->skip_init_frame = false;
+	link->num_sync_links = 0;
+	link->last_sof_trigger_jiffies = 0;
+	link->wq_congestion = false;
+	atomic_set(&link->eof_event_cnt, 0);
+
+	for (pd = 0; pd < CAM_PIPELINE_DELAY_MAX; pd++) {
+		link->req.apply_data[pd].req_id = -1;
+		link->req.prev_apply_data[pd].req_id = -1;
+	}
+
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION - 1; i++)
+		link->sync_link[i] = NULL;
+}
+
+void cam_req_mgr_handle_core_shutdown(void)
+{
+	struct cam_req_mgr_core_session *session;
+	struct cam_req_mgr_core_session *tsession;
+	struct cam_req_mgr_session_info ses_info;
+
+	if (!list_empty(&g_crm_core_dev->session_head)) {
+		list_for_each_entry_safe(session, tsession,
+			&g_crm_core_dev->session_head, entry) {
+			ses_info.session_hdl =
+				session->session_hdl;
+			cam_req_mgr_destroy_session(&ses_info, true);
+		}
+	}
+}
+
+static int __cam_req_mgr_setup_payload(struct cam_req_mgr_core_workq *workq)
+{
+	int32_t                  i = 0;
+	int                      rc = 0;
+	struct crm_task_payload *task_data = NULL;
+
+	task_data = kcalloc(
+		workq->task.num_task, sizeof(*task_data),
+		GFP_KERNEL);
+	if (!task_data) {
+		rc = -ENOMEM;
+	} else {
+		for (i = 0; i < workq->task.num_task; i++)
+			workq->task.pool[i].payload = &task_data[i];
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_find_pd_tbl()
+ *
+ * @brief    : Find pipeline delay based table pointer which matches delay
+ * @tbl      : Pointer to list of request table
+ * @delay    : Pipeline delay value to be searched for comparison
+ *
+ * @return   : pointer to request table for matching pipeline delay table.
+ *
+ */
+static struct cam_req_mgr_req_tbl *__cam_req_mgr_find_pd_tbl(
+	struct cam_req_mgr_req_tbl *tbl, int32_t delay)
+{
+	if (!tbl)
+		return NULL;
+
+	do {
+		if (delay != tbl->pd)
+			tbl = tbl->next;
+		else
+			return tbl;
+	} while (tbl != NULL);
+
+	return NULL;
+}
+
+/**
+ * __cam_req_mgr_inc_idx()
+ *
+ * @brief    : Increment val passed by step size and rollover after max_val
+ * @val      : value to be incremented
+ * @step     : amount/step by which val is incremented
+ * @max_val  : max val after which idx will roll over
+ *
+ */
+static void __cam_req_mgr_inc_idx(int32_t *val, int32_t step, int32_t max_val)
+{
+	*val = (*val + step) % max_val;
+}
+
+/**
+ * __cam_req_mgr_dec_idx()
+ *
+ * @brief    : Decrement val passed by step size and rollover after max_val
+ * @val      : value to be decremented
+ * @step     : amount/step by which val is decremented
+ * @max_val  : after zero value will roll over to max val
+ *
+ */
+static void __cam_req_mgr_dec_idx(int32_t *val, int32_t step, int32_t max_val)
+{
+	*val = *val - step;
+	if (*val < 0)
+		*val = max_val + (*val);
+}
+
+/**
+ * __cam_req_mgr_inject_delay()
+ *
+ * @brief         : Check if any pd device is injecting delay
+ * @tbl           : cam_req_mgr_req_tbl
+ * @curr_idx      : slot idx
+ * @trigger       : Trigger point
+ *
+ * @return   : 0 for success, negative for failure
+ */
+static int __cam_req_mgr_inject_delay(
+	struct cam_req_mgr_req_tbl *tbl,
+	int32_t curr_idx, uint32_t trigger)
+{
+	struct cam_req_mgr_tbl_slot *slot = NULL;
+	int rc = 0;
+
+	while (tbl) {
+		slot = &tbl->slot[curr_idx];
+		if ((trigger == CAM_TRIGGER_POINT_SOF) &&
+			(slot->inject_delay_at_sof > 0)) {
+			slot->inject_delay_at_sof--;
+			CAM_DBG(CAM_CRM,
+				"Delay injected by pd %d device at SOF",
+				tbl->pd);
+			rc = -EAGAIN;
+		} else if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+			(slot->inject_delay_at_eof > 0)) {
+			slot->inject_delay_at_eof--;
+			CAM_DBG(CAM_CRM,
+				"Delay injected by pd %d device at EOF",
+				tbl->pd);
+			rc = -EAGAIN;
+		}
+		__cam_req_mgr_dec_idx(&curr_idx, tbl->pd_delta,
+			tbl->num_slots);
+		tbl = tbl->next;
+	}
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_find_dev_name()
+ *
+ * @brief      : Find the dev name whose req is not ready
+ * @link       : link info
+ * @req_id     : req_id which is not ready
+ * @pd         : pipeline delay
+ * @masked_val : masked value holds the bit for all devices
+ *               that don't have the req_id ready for a given
+ *               pipeline delay
+ * @pd         : pipeline delay
+ *
+ */
+static void __cam_req_mgr_find_dev_name(
+	struct cam_req_mgr_core_link *link,
+	int64_t req_id, uint32_t pd, uint32_t masked_val)
+{
+	int i = 0;
+	struct cam_req_mgr_connected_device *dev = NULL;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (dev->dev_info.p_delay == pd) {
+			if (masked_val & (1 << dev->dev_bit))
+				continue;
+			if (link->wq_congestion)
+				CAM_INFO_RATE_LIMIT(CAM_CRM,
+					"WQ congestion, Skip Frame: req: %lld not ready on link: 0x%x for pd: %d dev: %s open_req count: %d",
+					req_id, link->link_hdl, pd,
+					dev->dev_info.name, link->open_req_cnt);
+			else
+				CAM_INFO(CAM_CRM,
+					"Skip Frame: req: %lld not ready on link: 0x%x for pd: %d dev: %s open_req count: %d",
+					req_id, link->link_hdl, pd,
+					dev->dev_info.name, link->open_req_cnt);
+		}
+	}
+}
+
+/**
+ * __cam_req_mgr_notify_frame_skip()
+ *
+ * @brief : Notify all devices of frame skipping
+ * @link  : link on which we are applying these settings
+ *
+ */
+static int __cam_req_mgr_notify_frame_skip(
+	struct cam_req_mgr_core_link *link,
+	uint32_t trigger)
+{
+	int                                  rc = 0, i, pd, idx;
+	struct cam_req_mgr_apply_request     frame_skip;
+	struct cam_req_mgr_apply            *apply_data = NULL;
+	struct cam_req_mgr_connected_device *dev = NULL;
+	struct cam_req_mgr_tbl_slot         *slot = NULL;
+
+	apply_data = link->req.prev_apply_data;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (!dev)
+			continue;
+
+		pd = dev->dev_info.p_delay;
+		if (pd >= CAM_PIPELINE_DELAY_MAX) {
+			CAM_WARN(CAM_CRM, "pd %d greater than max",
+				pd);
+			continue;
+		}
+
+		idx = apply_data[pd].idx;
+		slot = &dev->pd_tbl->slot[idx];
+
+		if ((slot->ops.dev_hdl == dev->dev_hdl) &&
+			(slot->ops.is_applied)) {
+			slot->ops.is_applied = false;
+			continue;
+		}
+
+		/*
+		 * If apply_at_eof is enabled do not apply at SOF
+		 * e.x. Flash device
+		 */
+		if ((trigger == CAM_TRIGGER_POINT_SOF) &&
+			(dev->dev_hdl == slot->ops.dev_hdl) &&
+			(slot->ops.apply_at_eof))
+			continue;
+
+		/*
+		 * If apply_at_eof is not enabled ignore EOF
+		 */
+		if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+			(dev->dev_hdl == slot->ops.dev_hdl) &&
+			(!slot->ops.apply_at_eof))
+			continue;
+
+		frame_skip.dev_hdl = dev->dev_hdl;
+		frame_skip.link_hdl = link->link_hdl;
+		frame_skip.request_id =
+			apply_data[pd].req_id;
+		frame_skip.trigger_point = trigger;
+		frame_skip.report_if_bubble = 0;
+
+		CAM_DBG(CAM_REQ,
+			"Notify_frame_skip: pd %d req_id %lld",
+			link->link_hdl, pd, apply_data[pd].req_id);
+		if ((dev->ops) && (dev->ops->notify_frame_skip))
+			dev->ops->notify_frame_skip(&frame_skip);
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_notify_error_on_link()
+ *
+ * @brief : Notify userspace on exceeding max retry
+ *          attempts to apply same req
+ * @link  : link on which the req could not be applied
+ *
+ */
+static int __cam_req_mgr_notify_error_on_link(
+	struct cam_req_mgr_core_link    *link,
+	struct cam_req_mgr_connected_device *dev)
+{
+	struct cam_req_mgr_core_session *session = NULL;
+	struct cam_req_mgr_message       msg;
+	int rc = 0, pd;
+
+	session = (struct cam_req_mgr_core_session *)link->parent;
+	if (!session) {
+		CAM_WARN(CAM_CRM, "session ptr NULL %x", link->link_hdl);
+		return -EINVAL;
+	}
+
+	pd = dev->dev_info.p_delay;
+	if (pd >= CAM_PIPELINE_DELAY_MAX) {
+		CAM_ERR(CAM_CRM, "pd : %d is more than expected", pd);
+		return -EINVAL;
+	}
+
+	CAM_ERR_RATE_LIMIT(CAM_CRM,
+		"Notifying userspace to trigger recovery on link 0x%x for session %d",
+		link->link_hdl, session->session_hdl);
+
+	memset(&msg, 0, sizeof(msg));
+
+	msg.session_hdl = session->session_hdl;
+	msg.u.err_msg.error_type = CAM_REQ_MGR_ERROR_TYPE_RECOVERY;
+	msg.u.err_msg.request_id =
+		link->req.apply_data[pd].req_id;
+	msg.u.err_msg.link_hdl   = link->link_hdl;
+
+	CAM_DBG(CAM_CRM, "Failed for device: %s while applying request: %lld",
+		dev->dev_info.name, link->req.apply_data[pd].req_id);
+
+	rc = cam_req_mgr_notify_message(&msg,
+		V4L_EVENT_CAM_REQ_MGR_ERROR,
+		V4L_EVENT_CAM_REQ_MGR_EVENT);
+
+	if (rc)
+		CAM_ERR_RATE_LIMIT(CAM_CRM,
+			"Error in notifying recovery for session %d link 0x%x rc %d",
+			session->session_hdl, link->link_hdl, rc);
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_traverse()
+ *
+ * @brief    : Traverse through pd tables, it will internally cover all linked
+ *             pd tables. Each pd table visited will check if idx passed to its
+ *             in ready state. If ready means all devices linked to the pd table
+ *             have this request id packet ready. Then it calls subsequent pd
+ *             tbl with new idx. New idx value takes into account the delta
+ *             between current pd table and next one.
+ * @traverse_data: contains all the info to traverse through pd tables
+ *
+ * @return: 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_traverse(struct cam_req_mgr_traverse *traverse_data)
+{
+	int                          rc = 0;
+	int32_t                      next_idx = traverse_data->idx;
+	int32_t                      curr_idx = traverse_data->idx;
+	struct cam_req_mgr_req_tbl  *tbl;
+	struct cam_req_mgr_apply    *apply_data;
+	struct cam_req_mgr_tbl_slot *slot = NULL;
+
+	if (!traverse_data->tbl || !traverse_data->apply_data) {
+		CAM_ERR(CAM_CRM, "NULL pointer %pK %pK",
+			traverse_data->tbl, traverse_data->apply_data);
+		traverse_data->result = 0;
+		return -EINVAL;
+	}
+
+	tbl = traverse_data->tbl;
+	apply_data = traverse_data->apply_data;
+	slot = &tbl->slot[curr_idx];
+	CAM_DBG(CAM_CRM,
+		"Enter pd %d idx %d state %d skip %d status %d skip_idx %d",
+		tbl->pd, curr_idx, tbl->slot[curr_idx].state,
+		tbl->skip_traverse, traverse_data->in_q->slot[curr_idx].status,
+		traverse_data->in_q->slot[curr_idx].skip_idx);
+
+	/* Check if req is ready or in skip mode or pd tbl is in skip mode */
+	if (tbl->slot[curr_idx].state == CRM_REQ_STATE_READY ||
+		traverse_data->in_q->slot[curr_idx].skip_idx == 1 ||
+		tbl->skip_traverse > 0) {
+		if (tbl->next) {
+			__cam_req_mgr_dec_idx(&next_idx, tbl->pd_delta,
+				tbl->num_slots);
+			traverse_data->idx = next_idx;
+			traverse_data->tbl = tbl->next;
+			rc = __cam_req_mgr_traverse(traverse_data);
+		}
+		if (rc >= 0) {
+			SET_SUCCESS_BIT(traverse_data->result, tbl->pd);
+
+			if (traverse_data->validate_only == false) {
+				apply_data[tbl->pd].pd = tbl->pd;
+				apply_data[tbl->pd].req_id =
+					CRM_GET_REQ_ID(
+					traverse_data->in_q, curr_idx);
+				apply_data[tbl->pd].idx = curr_idx;
+
+				CAM_DBG(CAM_CRM, "req_id: %lld with pd of %d",
+				apply_data[tbl->pd].req_id,
+				apply_data[tbl->pd].pd);
+				/*
+				 * If traverse is successful decrement
+				 * traverse skip
+				 */
+				if (tbl->skip_traverse > 0) {
+					apply_data[tbl->pd].req_id = -1;
+					tbl->skip_traverse--;
+				}
+			}
+		} else {
+			/* linked pd table is not ready for this traverse yet */
+			return rc;
+		}
+	} else {
+		/* This pd table is not ready to proceed with asked idx */
+		traverse_data->result_data.req_id =
+			CRM_GET_REQ_ID(traverse_data->in_q, curr_idx);
+		traverse_data->result_data.pd = tbl->pd;
+		traverse_data->result_data.masked_value =
+			(tbl->dev_mask & slot->req_ready_map);
+		SET_FAILURE_BIT(traverse_data->result, tbl->pd);
+		return -EAGAIN;
+	}
+
+	return 0;
+}
+
+/**
+ * __cam_req_mgr_in_q_skip_idx()
+ *
+ * @brief    : Decrement val passed by step size and rollover after max_val
+ * @in_q     : input queue pointer
+ * @idx      : Sets skip_idx bit of the particular slot to true so when traverse
+ *             happens for this idx, no req will be submitted for devices
+ *             handling this idx.
+ *
+ */
+static void __cam_req_mgr_in_q_skip_idx(struct cam_req_mgr_req_queue *in_q,
+	int32_t idx)
+{
+	in_q->slot[idx].req_id = -1;
+	in_q->slot[idx].skip_idx = 1;
+	in_q->slot[idx].status = CRM_SLOT_STATUS_REQ_ADDED;
+	CAM_DBG(CAM_CRM, "SET IDX SKIP on slot= %d", idx);
+}
+
+/**
+ * __cam_req_mgr_tbl_set_id()
+ *
+ * @brief    : Set unique id to table
+ * @tbl      : pipeline based table which requires new id
+ * @req      : pointer to request data wihch contains num_tables counter
+ *
+ */
+static void __cam_req_mgr_tbl_set_id(struct cam_req_mgr_req_tbl *tbl,
+	struct cam_req_mgr_req_data *req)
+{
+	if (!tbl)
+		return;
+	do {
+		tbl->id = req->num_tbl++;
+		CAM_DBG(CAM_CRM, "%d: pd %d skip_traverse %d delta %d",
+			tbl->id, tbl->pd, tbl->skip_traverse,
+			tbl->pd_delta);
+		tbl = tbl->next;
+	} while (tbl != NULL);
+}
+
+/**
+ * __cam_req_mgr_tbl_set_all_skip_cnt()
+ *
+ * @brief    : Each pd table sets skip value based on delta between itself and
+ *             max pd value. During initial streamon or bubble case this is
+ *             used. That way each pd table skips required num of traverse and
+ *             align themselve with req mgr connected devs.
+ * @l_tbl    : iterates through list of pd tables and sets skip traverse
+ *
+ */
+static void __cam_req_mgr_tbl_set_all_skip_cnt(
+	struct cam_req_mgr_req_tbl **l_tbl)
+{
+	struct cam_req_mgr_req_tbl *tbl = *l_tbl;
+	int32_t                     max_pd;
+
+	if (!tbl)
+		return;
+
+	max_pd = tbl->pd;
+	do {
+		tbl->skip_traverse = max_pd - tbl->pd;
+		CAM_DBG(CAM_CRM, "%d: pd %d skip_traverse %d delta %d",
+			tbl->id, tbl->pd, tbl->skip_traverse,
+			tbl->pd_delta);
+		tbl = tbl->next;
+	} while (tbl != NULL);
+}
+
+/**
+ * __cam_req_mgr_flush_req_slot()
+ *
+ * @brief    : reset all the slots/pd tables when flush is
+ *             invoked
+ * @link     : link pointer
+ *
+ */
+static void __cam_req_mgr_flush_req_slot(
+	struct cam_req_mgr_core_link *link)
+{
+	int                           idx = 0;
+	struct cam_req_mgr_slot      *slot;
+	struct cam_req_mgr_req_tbl   *tbl;
+	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
+
+	for (idx = 0; idx < in_q->num_slots; idx++) {
+		slot = &in_q->slot[idx];
+		tbl = link->req.l_tbl;
+		CAM_DBG(CAM_CRM,
+			"RESET idx: %d req_id: %lld slot->status: %d",
+			idx, slot->req_id, slot->status);
+
+		/* Reset input queue slot */
+		slot->req_id = -1;
+		slot->skip_idx = 1;
+		slot->recover = 0;
+		slot->additional_timeout = 0;
+		slot->sync_mode = CAM_REQ_MGR_SYNC_MODE_NO_SYNC;
+		slot->status = CRM_SLOT_STATUS_NO_REQ;
+
+		/* Reset all pd table slot */
+		while (tbl != NULL) {
+			CAM_DBG(CAM_CRM, "pd: %d: idx %d state %d",
+				tbl->pd, idx, tbl->slot[idx].state);
+			tbl->slot[idx].req_ready_map = 0;
+			tbl->slot[idx].state = CRM_REQ_STATE_EMPTY;
+			tbl->slot[idx].ops.apply_at_eof = false;
+			tbl->slot[idx].ops.dev_hdl = -1;
+			tbl->slot[idx].ops.is_applied = false;
+			tbl = tbl->next;
+		}
+	}
+
+	atomic_set(&link->eof_event_cnt, 0);
+	in_q->wr_idx = 0;
+	in_q->rd_idx = 0;
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_EOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_EOF] = 0;
+}
+
+/**
+ * __cam_req_mgr_reset_req_slot()
+ *
+ * @brief    : reset specified idx/slot in input queue as well as all pd tables
+ * @link     : link pointer
+ * @idx      : slot index which will be reset
+ *
+ */
+static void __cam_req_mgr_reset_req_slot(struct cam_req_mgr_core_link *link,
+	int32_t idx)
+{
+	struct cam_req_mgr_slot      *slot;
+	struct cam_req_mgr_req_tbl   *tbl = link->req.l_tbl;
+	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
+
+	slot = &in_q->slot[idx];
+	CAM_DBG(CAM_CRM, "RESET: idx: %d: slot->status %d", idx, slot->status);
+
+	/* Check if CSL has already pushed new request*/
+	if (slot->status == CRM_SLOT_STATUS_REQ_ADDED ||
+		in_q->last_applied_idx == idx ||
+		idx < 0)
+		return;
+
+	/* Reset input queue slot */
+	slot->req_id = -1;
+	slot->skip_idx = 0;
+	slot->recover = 0;
+	slot->additional_timeout = 0;
+	slot->sync_mode = CAM_REQ_MGR_SYNC_MODE_NO_SYNC;
+	slot->status = CRM_SLOT_STATUS_NO_REQ;
+
+	/* Reset all pd table slot */
+	while (tbl != NULL) {
+		CAM_DBG(CAM_CRM, "pd: %d: idx %d state %d",
+			tbl->pd, idx, tbl->slot[idx].state);
+		tbl->slot[idx].req_ready_map = 0;
+		tbl->slot[idx].state = CRM_REQ_STATE_EMPTY;
+		tbl->slot[idx].inject_delay_at_sof = 0;
+		tbl->slot[idx].inject_delay_at_eof = 0;
+		tbl->slot[idx].ops.apply_at_eof = false;
+		tbl->slot[idx].ops.dev_hdl = -1;
+		tbl->slot[idx].ops.is_applied = false;
+		tbl = tbl->next;
+	}
+}
+
+/**
+ * __cam_req_mgr_validate_crm_wd_timer()
+ *
+ * @brief    : Validate/modify the wd timer based on associated
+ *             timeout with the request
+ * @link     : link pointer
+ *
+ */
+static void __cam_req_mgr_validate_crm_wd_timer(
+	struct cam_req_mgr_core_link *link)
+{
+	int idx = 0;
+	int next_frame_timeout = 0, current_frame_timeout = 0;
+	int64_t current_req_id, next_req_id;
+	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
+
+	if (link->skip_init_frame) {
+		CAM_DBG(CAM_CRM,
+			"skipping modifying wd timer for first frame after streamon");
+		link->skip_init_frame = false;
+		return;
+	}
+
+	idx = in_q->rd_idx;
+	__cam_req_mgr_dec_idx(
+		&idx, (link->max_delay - 1),
+		in_q->num_slots);
+	next_frame_timeout = in_q->slot[idx].additional_timeout;
+	next_req_id = in_q->slot[idx].req_id;
+	CAM_DBG(CAM_CRM,
+		"rd_idx: %d idx: %d next_req_id: %lld next_frame_timeout: %d ms",
+		in_q->rd_idx, idx, next_req_id, next_frame_timeout);
+
+	idx = in_q->rd_idx;
+	__cam_req_mgr_dec_idx(
+		&idx, link->max_delay,
+		in_q->num_slots);
+	current_frame_timeout = in_q->slot[idx].additional_timeout;
+	current_req_id = in_q->slot[idx].req_id;
+	CAM_DBG(CAM_CRM,
+		"rd_idx: %d idx: %d curr_req_id: %lld current_frame_timeout: %d ms",
+		in_q->rd_idx, idx, current_req_id, current_frame_timeout);
+
+	if ((current_req_id == -1) && (next_req_id == -1)) {
+		CAM_DBG(CAM_CRM,
+			"Skip modifying wd timer, continue with same timeout");
+		return;
+	}
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->watchdog) {
+		if ((next_frame_timeout + CAM_REQ_MGR_WATCHDOG_TIMEOUT) >
+			link->watchdog->expires) {
+			CAM_DBG(CAM_CRM,
+				"Modifying wd timer expiry from %d ms to %d ms",
+				link->watchdog->expires,
+				(next_frame_timeout +
+				 CAM_REQ_MGR_WATCHDOG_TIMEOUT));
+			crm_timer_modify(link->watchdog,
+				next_frame_timeout +
+				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
+		} else if (current_frame_timeout) {
+			CAM_DBG(CAM_CRM,
+				"Reset wd timer to frame from %d ms to %d ms",
+				link->watchdog->expires,
+				(current_frame_timeout +
+				 CAM_REQ_MGR_WATCHDOG_TIMEOUT));
+			crm_timer_modify(link->watchdog,
+				current_frame_timeout +
+				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
+		} else if (!next_frame_timeout && (link->watchdog->expires >
+			CAM_REQ_MGR_WATCHDOG_TIMEOUT)) {
+			CAM_DBG(CAM_CRM,
+				"Reset wd timer to default from %d ms to %d ms",
+				link->watchdog->expires,
+				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
+			crm_timer_modify(link->watchdog,
+				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
+		}
+	} else {
+		CAM_WARN(CAM_CRM, "Watchdog timer exited already");
+	}
+	spin_unlock_bh(&link->link_state_spin_lock);
+}
+
+/**
+ * __cam_req_mgr_check_for_lower_pd_devices()
+ *
+ * @brief    : Checks if there are any devices on the link having a lesser
+ *             pd than the max pd of the link
+ * @link     : Pointer to link which needs to be checked
+ *
+ * @return   : 0 if a lower pd device is found negative otherwise
+ */
+static int __cam_req_mgr_check_for_lower_pd_devices(
+	struct cam_req_mgr_core_link	*link)
+{
+	int i = 0;
+	struct cam_req_mgr_connected_device *dev = NULL;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (dev->dev_info.p_delay < link->max_delay)
+			return 0;
+	}
+
+	return -EAGAIN;
+}
+
+/**
+ * __cam_req_mgr_check_next_req_slot()
+ *
+ * @brief    : While streaming if input queue does not contain any pending
+ *             request, req mgr still needs to submit pending request ids to
+ *             devices with lower pipeline delay value.
+ * @in_q     : Pointer to input queue where req mgr wil peep into
+ *
+ * @return   : 0 for success, negative for failure
+ */
+static int __cam_req_mgr_check_next_req_slot(
+	struct cam_req_mgr_core_link *link)
+{
+	int rc = 0;
+	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
+	int32_t idx = in_q->rd_idx;
+	struct cam_req_mgr_slot *slot;
+
+	__cam_req_mgr_inc_idx(&idx, 1, in_q->num_slots);
+	slot = &in_q->slot[idx];
+
+	CAM_DBG(CAM_CRM, "idx: %d: slot->status %d", idx, slot->status);
+
+	/*
+	 * Some slot can't be reset due to irq congestion and
+	 * performance issue, we need to reset it when we
+	 * want to move to this slot.
+	 */
+	if (slot->status == CRM_SLOT_STATUS_REQ_APPLIED) {
+		CAM_WARN(CAM_CRM,
+			"slot[%d] wasn't reset, reset it now",
+			idx);
+		if (in_q->last_applied_idx == idx) {
+			CAM_WARN(CAM_CRM,
+				"last_applied_idx: %d",
+				in_q->last_applied_idx);
+			in_q->last_applied_idx = -1;
+		}
+		__cam_req_mgr_reset_req_slot(link, idx);
+	}
+
+	/* Check if there is new req from CSL, if not complete req */
+	if (slot->status == CRM_SLOT_STATUS_NO_REQ) {
+		rc = __cam_req_mgr_check_for_lower_pd_devices(link);
+		if (rc) {
+			CAM_DBG(CAM_CRM, "No lower pd devices on link 0x%x",
+				link->link_hdl);
+			return rc;
+		}
+		__cam_req_mgr_in_q_skip_idx(in_q, idx);
+		if (in_q->wr_idx != idx)
+			CAM_WARN(CAM_CRM,
+				"CHECK here wr %d, rd %d", in_q->wr_idx, idx);
+		__cam_req_mgr_inc_idx(&in_q->wr_idx, 1, in_q->num_slots);
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_send_req()
+ *
+ * @brief    : send request id to be applied to each device connected on link
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through
+ * @in_q     : pointer to input request queue
+ *
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_send_req(struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_req_queue *in_q, uint32_t trigger,
+	struct cam_req_mgr_connected_device **failed_dev)
+{
+	int                                  rc = 0, pd, i, idx;
+	struct cam_req_mgr_connected_device *dev = NULL;
+	struct cam_req_mgr_apply_request     apply_req;
+	struct cam_req_mgr_link_evt_data     evt_data;
+	struct cam_req_mgr_tbl_slot          *slot = NULL;
+	struct cam_req_mgr_apply             *apply_data = NULL;
+
+	apply_req.link_hdl = link->link_hdl;
+	apply_req.report_if_bubble = 0;
+	apply_req.re_apply = false;
+	if (link->retry_cnt > 0) {
+		if (g_crm_core_dev->recovery_on_apply_fail)
+			apply_req.re_apply = true;
+	}
+
+	apply_data = link->req.apply_data;
+
+	/*
+	 * This For loop is to address the special operation requested
+	 * by device
+	 */
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (!dev)
+			continue;
+		pd = dev->dev_info.p_delay;
+		if (pd >= CAM_PIPELINE_DELAY_MAX) {
+			CAM_WARN(CAM_CRM, "pd %d greater than max",
+				pd);
+			continue;
+		}
+
+		idx = apply_data[pd].idx;
+		slot = &dev->pd_tbl->slot[idx];
+
+		if (slot->ops.dev_hdl < 0) {
+			CAM_DBG(CAM_CRM,
+				"No special ops detected for slot %d dev %s",
+				idx, dev->dev_info.name);
+			continue;
+		}
+
+		if (dev->dev_hdl != slot->ops.dev_hdl) {
+			CAM_DBG(CAM_CRM,
+				"Dev_hdl : %d Not matched:: Expected dev_hdl: %d",
+				dev->dev_hdl, slot->ops.dev_hdl);
+			continue;
+		}
+
+		if (apply_data[pd].skip_idx ||
+			(apply_data[pd].req_id < 0)) {
+			CAM_DBG(CAM_CRM,
+				"dev %s skip %d req_id %lld",
+				dev->dev_info.name,
+				apply_data[pd].skip_idx,
+				apply_data[pd].req_id);
+			apply_req.dev_hdl = dev->dev_hdl;
+			apply_req.request_id =
+				link->req.prev_apply_data[pd].req_id;
+			apply_req.trigger_point = 0;
+			apply_req.report_if_bubble = 0;
+			if ((dev->ops) && (dev->ops->notify_frame_skip))
+				dev->ops->notify_frame_skip(&apply_req);
+			continue;
+		}
+
+		/* This one is to prevent EOF request to apply on SOF*/
+		if ((trigger == CAM_TRIGGER_POINT_SOF) &&
+			(slot->ops.apply_at_eof)) {
+			CAM_DBG(CAM_CRM, "EOF event cannot be applied at SOF");
+			break;
+		}
+
+		if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+			(!slot->ops.apply_at_eof)) {
+			CAM_DBG(CAM_CRM, "NO EOF DATA FOR REQ: %llu",
+				apply_data[pd].req_id);
+			break;
+		}
+
+		apply_req.dev_hdl = dev->dev_hdl;
+		apply_req.request_id =
+			apply_data[pd].req_id;
+		apply_req.trigger_point = trigger;
+		if ((dev->ops) && (dev->ops->apply_req) &&
+			(!slot->ops.is_applied)) {
+			rc = dev->ops->apply_req(&apply_req);
+			if (rc) {
+				*failed_dev = dev;
+				__cam_req_mgr_notify_frame_skip(link,
+					trigger);
+				return rc;
+			}
+		} else {
+			CAM_DBG(CAM_REQ,
+				"link_hdl: %x pd: %d req_id %lld has applied",
+				link->link_hdl, pd, apply_req.request_id);
+			break;
+		}
+
+		CAM_DBG(CAM_REQ,
+			"SEND: link_hdl %x dev %s pd %d req_id %lld",
+			link->link_hdl, dev->dev_info.name,
+			pd, apply_req.request_id);
+
+		if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+			(slot->ops.apply_at_eof)) {
+			slot->ops.is_applied = true;
+			slot->ops.apply_at_eof = false;
+			if (atomic_read(&link->eof_event_cnt) > 0)
+				atomic_dec(&link->eof_event_cnt);
+			return 0;
+		}
+	}
+
+	/* For regular send requests */
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (dev) {
+			pd = dev->dev_info.p_delay;
+			if (pd >= CAM_PIPELINE_DELAY_MAX) {
+				CAM_WARN(CAM_CRM, "pd %d greater than max",
+					pd);
+				continue;
+			}
+
+			if (!(dev->dev_info.trigger & trigger))
+				continue;
+
+			if (apply_data[pd].skip_idx ||
+				(apply_data[pd].req_id < 0)) {
+				CAM_DBG(CAM_CRM,
+					"dev %s skip %d req_id %lld",
+					dev->dev_info.name,
+					apply_data[pd].skip_idx,
+					apply_data[pd].req_id);
+				apply_req.dev_hdl = dev->dev_hdl;
+				apply_req.request_id =
+					link->req.prev_apply_data[pd].req_id;
+				apply_req.trigger_point = 0;
+				apply_req.report_if_bubble = 0;
+				if ((dev->ops) && (dev->ops->notify_frame_skip))
+					dev->ops->notify_frame_skip(&apply_req);
+				continue;
+			}
+
+			apply_req.dev_hdl = dev->dev_hdl;
+			apply_req.request_id =
+				apply_data[pd].req_id;
+			idx = apply_data[pd].idx;
+			slot = &dev->pd_tbl->slot[idx];
+			apply_req.report_if_bubble =
+				in_q->slot[idx].recover;
+
+			/*
+			 * If it is dual trigger usecase, need to tell
+			 * devices that the req is re-applied, then the
+			 * devices need to skip applying if the req has
+			 * been handled.
+			 * e.x. ISP device
+			 */
+			if (link->retry_cnt > 0) {
+				if (!apply_req.report_if_bubble &&
+					link->dual_trigger)
+					apply_req.re_apply = true;
+			}
+
+			if ((slot->ops.dev_hdl == dev->dev_hdl) &&
+				(slot->ops.is_applied)) {
+				slot->ops.is_applied = false;
+				continue;
+			}
+
+			/*
+			 * If apply_at_eof is enabled do not apply at SOF
+			 * e.x. Flash device
+			 */
+			if ((trigger == CAM_TRIGGER_POINT_SOF) &&
+				(dev->dev_hdl == slot->ops.dev_hdl) &&
+				(slot->ops.apply_at_eof))
+				continue;
+
+			/*
+			 * If apply_at_eof is not enabled ignore EOF
+			 */
+			if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+				(dev->dev_hdl == slot->ops.dev_hdl) &&
+				(!slot->ops.apply_at_eof))
+				continue;
+
+			apply_req.trigger_point = trigger;
+			CAM_DBG(CAM_REQ,
+				"SEND: link_hdl %x dev %s pd %d req_id %lld",
+				link->link_hdl, dev->dev_info.name,
+				pd, apply_req.request_id);
+			if (dev->ops && dev->ops->apply_req) {
+				rc = dev->ops->apply_req(&apply_req);
+				if (rc < 0) {
+					*failed_dev = dev;
+					break;
+				}
+			}
+			trace_cam_req_mgr_apply_request(link, &apply_req, dev);
+		}
+	}
+	if (rc < 0) {
+		CAM_WARN_RATE_LIMIT(CAM_CRM, "APPLY FAILED pd %d req_id %lld",
+			dev->dev_info.p_delay, apply_req.request_id);
+		/* Apply req failed notify already applied devs */
+		for (; i >= 0; i--) {
+			dev = &link->l_dev[i];
+			evt_data.evt_type = CAM_REQ_MGR_LINK_EVT_ERR;
+			evt_data.dev_hdl = dev->dev_hdl;
+			evt_data.link_hdl =  link->link_hdl;
+			evt_data.req_id = apply_req.request_id;
+			evt_data.u.error = CRM_KMD_ERR_BUBBLE;
+			if (dev->ops && dev->ops->process_evt)
+				dev->ops->process_evt(&evt_data);
+		}
+		__cam_req_mgr_notify_frame_skip(link, trigger);
+	} else {
+		memcpy(link->req.prev_apply_data, link->req.apply_data,
+			CAM_PIPELINE_DELAY_MAX *
+			sizeof(struct cam_req_mgr_apply));
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_check_link_is_ready()
+ *
+ * @brief    : traverse through all request tables and see if all devices are
+ *             ready to apply request settings.
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through
+ * @idx      : index within input request queue
+ * @validate_only : Whether to validate only and/or update settings
+ *
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_check_link_is_ready(struct cam_req_mgr_core_link *link,
+	int32_t idx, bool validate_only)
+{
+	int                            rc;
+	struct cam_req_mgr_traverse    traverse_data;
+	struct cam_req_mgr_req_queue  *in_q;
+	struct cam_req_mgr_apply      *apply_data;
+
+	in_q = link->req.in_q;
+
+	apply_data = link->req.apply_data;
+
+	if (validate_only == false) {
+		memset(apply_data, 0,
+		    sizeof(struct cam_req_mgr_apply) * CAM_PIPELINE_DELAY_MAX);
+	}
+
+	traverse_data.apply_data = apply_data;
+	traverse_data.idx = idx;
+	traverse_data.tbl = link->req.l_tbl;
+	traverse_data.in_q = in_q;
+	traverse_data.result = 0;
+	traverse_data.result_data.masked_value = 0;
+	traverse_data.result_data.pd = 0;
+	traverse_data.result_data.req_id = 0;
+	traverse_data.validate_only = validate_only;
+	traverse_data.open_req_cnt = link->open_req_cnt;
+
+	/*
+	 * Some no-sync mode requests are processed after link config,
+	 * then process the sync mode requests after no-sync mode requests
+	 * are handled, the initial_skip should be false when processing
+	 * the sync mode requests.
+	 */
+	if (link->initial_skip) {
+		CAM_DBG(CAM_CRM,
+			"Set initial_skip to false for link %x",
+			link->link_hdl);
+		link->initial_skip = false;
+	}
+
+	/*
+	 *  Traverse through all pd tables, if result is success,
+	 *  apply the settings
+	 */
+	rc = __cam_req_mgr_traverse(&traverse_data);
+	CAM_DBG(CAM_CRM,
+		"SOF: idx %d result %x pd_mask %x rc %d",
+		idx, traverse_data.result, link->pd_mask, rc);
+
+	if (!rc && traverse_data.result == link->pd_mask) {
+		CAM_DBG(CAM_CRM,
+			"READY: link_hdl= %x idx= %d, req_id= %lld :%lld :%lld",
+			link->link_hdl, idx,
+			apply_data[2].req_id,
+			apply_data[1].req_id,
+			apply_data[0].req_id);
+	} else {
+		rc = -EAGAIN;
+		__cam_req_mgr_find_dev_name(link,
+			traverse_data.result_data.req_id,
+			traverse_data.result_data.pd,
+			traverse_data.result_data.masked_value);
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_find_slot_for_req()
+ *
+ * @brief    : Find idx from input queue at which req id is enqueued
+ * @in_q     : input request queue pointer
+ * @req_id   : request id which needs to be searched in input queue
+ *
+ * @return   : slot index where passed request id is stored, -1 for failure
+ *
+ */
+static int32_t __cam_req_mgr_find_slot_for_req(
+	struct cam_req_mgr_req_queue *in_q, int64_t req_id)
+{
+	int32_t                   idx, i;
+	struct cam_req_mgr_slot  *slot;
+
+	idx = in_q->rd_idx;
+	for (i = 0; i < in_q->num_slots; i++) {
+		slot = &in_q->slot[idx];
+		if (slot->req_id == req_id) {
+			CAM_DBG(CAM_CRM,
+				"req: %lld found at idx: %d status: %d sync_mode: %d",
+				req_id, idx, slot->status, slot->sync_mode);
+			break;
+		}
+		__cam_req_mgr_dec_idx(&idx, 1, in_q->num_slots);
+	}
+	if (i >= in_q->num_slots)
+		idx = -1;
+
+	return idx;
+}
+
+/**
+ * __cam_req_mgr_check_sync_for_mslave()
+ *
+ * @brief    : Processes requests during sync mode [master-slave]
+ *             Here master corresponds to the link having a higher
+ *             max_delay (pd) compared to the slave link.
+ * @link     : Pointer to link whose input queue and req tbl are
+ *             traversed through
+ * @slot     : Pointer to the current slot being processed
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_check_sync_for_mslave(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_core_link *sync_link,
+	struct cam_req_mgr_slot *slot)
+{
+	struct cam_req_mgr_slot      *sync_slot = NULL;
+	int sync_slot_idx = 0, prev_idx, next_idx, rd_idx, sync_rd_idx, rc = 0;
+	int64_t req_id = 0, sync_req_id = 0;
+	int32_t sync_num_slots = 0;
+
+	if (!sync_link  || !link) {
+		CAM_ERR(CAM_CRM, "Sync link or link is null");
+		return -EINVAL;
+	}
+
+	req_id = slot->req_id;
+
+	if (!sync_link->req.in_q) {
+		CAM_ERR(CAM_CRM, "Link hdl %x in_q is NULL",
+			sync_link->link_hdl);
+		return -EINVAL;
+	}
+
+	sync_num_slots = sync_link->req.in_q->num_slots;
+	sync_rd_idx = sync_link->req.in_q->rd_idx;
+
+	CAM_DBG(CAM_CRM,
+		"link_hdl %x req %lld frame_skip_flag %d open_req_cnt:%d initial_sync_req [%lld,%lld] is_master:%d",
+		link->link_hdl, req_id, link->sync_link_sof_skip,
+		link->open_req_cnt, link->initial_sync_req,
+		sync_link->initial_sync_req, link->is_master);
+
+	if (sync_link->sync_link_sof_skip) {
+		CAM_DBG(CAM_CRM,
+			"No req applied on corresponding SOF on sync link: %x",
+				sync_link->link_hdl);
+		sync_link->sync_link_sof_skip = false;
+		return -EAGAIN;
+	}
+
+	if (link->in_msync_mode &&
+		sync_link->in_msync_mode &&
+		(req_id - sync_link->req.in_q->slot[sync_rd_idx].req_id >
+		link->max_delay - sync_link->max_delay)) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld on link:%x need to hold for link: %x req:%d",
+			req_id,
+			link->link_hdl,
+			sync_link->link_hdl,
+			sync_link->req.in_q->slot[sync_rd_idx].req_id);
+		return -EINVAL;
+	}
+
+	if (link->is_master) {
+		if (sync_link->initial_skip) {
+			CAM_DBG(CAM_CRM,  "Link 0x%x [slave] not streamed on",
+				sync_link->link_hdl);
+			return -EAGAIN;
+		}
+
+		rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, true);
+		if (rc) {
+			CAM_DBG(CAM_CRM,
+				"Req: %lld [master] not ready on link: %x, rc=%d",
+				req_id, link->link_hdl, rc);
+			link->sync_link_sof_skip = true;
+			return rc;
+		}
+
+		prev_idx = slot->idx;
+		__cam_req_mgr_dec_idx(&prev_idx,
+			(link->max_delay - sync_link->max_delay),
+			link->req.in_q->num_slots);
+
+		rd_idx = sync_link->req.in_q->rd_idx;
+		sync_req_id = link->req.in_q->slot[prev_idx].req_id;
+		if ((sync_link->initial_sync_req != -1) &&
+			(sync_link->initial_sync_req <= sync_req_id)) {
+			sync_slot_idx = __cam_req_mgr_find_slot_for_req(
+				sync_link->req.in_q, sync_req_id);
+			if (sync_slot_idx == -1) {
+				CAM_DBG(CAM_CRM,
+					"Prev Req: %lld [master] not found on link: %x [slave]",
+					sync_req_id, sync_link->link_hdl);
+				link->sync_link_sof_skip = true;
+				return -EINVAL;
+			}
+
+			if ((sync_link->req.in_q->slot[sync_slot_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED) &&
+				(((sync_slot_idx - rd_idx + sync_num_slots) %
+				sync_num_slots) >= 1) &&
+				(sync_link->req.in_q->slot[rd_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED)) {
+				CAM_DBG(CAM_CRM,
+					"Prev Req: %lld [master] not next on link: %x [slave]",
+					sync_req_id,
+					sync_link->link_hdl);
+				return -EINVAL;
+			}
+
+			rc = __cam_req_mgr_check_link_is_ready(sync_link,
+				sync_slot_idx, true);
+			if (rc &&
+				(sync_link->req.in_q->slot[sync_slot_idx].status
+				!= CRM_SLOT_STATUS_REQ_APPLIED)) {
+				CAM_DBG(CAM_CRM,
+					"Req: %lld not ready on [slave] link: %x, rc=%d",
+					sync_req_id, sync_link->link_hdl, rc);
+				link->sync_link_sof_skip = true;
+				return rc;
+			}
+		}
+	} else {
+		if (link->initial_skip)
+			link->initial_skip = false;
+
+		rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, true);
+		if (rc) {
+			CAM_DBG(CAM_CRM,
+				"Req: %lld [slave] not ready on link: %x, rc=%d",
+				req_id, link->link_hdl, rc);
+			link->sync_link_sof_skip = true;
+			return rc;
+		}
+
+		next_idx = link->req.in_q->rd_idx;
+		rd_idx = sync_link->req.in_q->rd_idx;
+		__cam_req_mgr_inc_idx(&next_idx,
+			(sync_link->max_delay - link->max_delay),
+			link->req.in_q->num_slots);
+
+		sync_req_id = link->req.in_q->slot[next_idx].req_id;
+
+		if ((sync_link->initial_sync_req != -1) &&
+			(sync_link->initial_sync_req <= sync_req_id)) {
+			sync_slot_idx = __cam_req_mgr_find_slot_for_req(
+				sync_link->req.in_q, sync_req_id);
+			if (sync_slot_idx == -1) {
+				CAM_DBG(CAM_CRM,
+					"Next Req: %lld [slave] not found on link: %x [master]",
+					sync_req_id, sync_link->link_hdl);
+				link->sync_link_sof_skip = true;
+				return -EINVAL;
+			}
+
+			if ((sync_link->req.in_q->slot[sync_slot_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED) &&
+				(((sync_slot_idx - rd_idx + sync_num_slots) %
+				sync_num_slots) >= 1) &&
+				(sync_link->req.in_q->slot[rd_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED)) {
+				CAM_DBG(CAM_CRM,
+					"Next Req: %lld [slave] not next on link: %x [master]",
+					sync_req_id, sync_link->link_hdl);
+				return -EINVAL;
+			}
+
+			sync_slot = &sync_link->req.in_q->slot[sync_slot_idx];
+			rc = __cam_req_mgr_check_link_is_ready(sync_link,
+				sync_slot_idx, true);
+			if (rc && (sync_slot->status !=
+				CRM_SLOT_STATUS_REQ_APPLIED)) {
+				CAM_DBG(CAM_CRM,
+					"Next Req: %lld [slave] not ready on [master] link: %x, rc=%d",
+					sync_req_id, sync_link->link_hdl, rc);
+				link->sync_link_sof_skip = true;
+				return rc;
+			}
+		}
+	}
+
+	CAM_DBG(CAM_REQ,
+		"Req: %lld ready to apply on link: %x [validation successful]",
+		req_id, link->link_hdl);
+
+	return 0;
+}
+
+
+/**
+ * __cam_req_mgr_check_sync_request_is_ready()
+ *
+ * @brief    : processes requests during sync mode
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through
+ * @slot     : pointer to the current slot being processed
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_check_sync_req_is_ready(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_core_link *sync_link,
+	struct cam_req_mgr_slot *slot,
+	uint32_t trigger)
+{
+	struct cam_req_mgr_slot *sync_rd_slot = NULL;
+	int64_t req_id = 0, sync_req_id = 0;
+	int sync_slot_idx = 0, sync_rd_idx = 0, rc = 0;
+	int32_t sync_num_slots = 0;
+	uint64_t sync_frame_duration = 0;
+	uint64_t sof_timestamp_delta = 0;
+	uint64_t master_slave_diff = 0;
+	bool ready = true, sync_ready = true;
+	int slot_idx_diff = 0;
+
+	if (!sync_link || !link) {
+		CAM_ERR(CAM_CRM, "Sync link null");
+		return -EINVAL;
+	}
+
+	req_id = slot->req_id;
+
+	if (!sync_link->req.in_q) {
+		CAM_ERR(CAM_CRM, "Link hdl %x in_q is NULL",
+			sync_link->link_hdl);
+		return -EINVAL;
+	}
+
+	sync_num_slots = sync_link->req.in_q->num_slots;
+	sync_rd_idx    = sync_link->req.in_q->rd_idx;
+	sync_rd_slot   = &sync_link->req.in_q->slot[sync_rd_idx];
+	sync_req_id    = sync_rd_slot->req_id;
+
+	CAM_DBG(CAM_REQ,
+		"link_hdl %x sync link_hdl %x req %lld",
+		link->link_hdl, sync_link->link_hdl, req_id);
+
+	if (sync_link->initial_skip) {
+		link->initial_skip = false;
+		CAM_DBG(CAM_CRM,
+			"sync link %x not streamed on",
+			sync_link->link_hdl);
+		return -EAGAIN;
+	}
+
+	if (sync_link->prev_sof_timestamp)
+		sync_frame_duration = sync_link->sof_timestamp -
+			sync_link->prev_sof_timestamp;
+	else
+		sync_frame_duration = DEFAULT_FRAME_DURATION;
+
+	sof_timestamp_delta =
+		link->sof_timestamp >= sync_link->sof_timestamp
+		? link->sof_timestamp - sync_link->sof_timestamp
+		: sync_link->sof_timestamp - link->sof_timestamp;
+
+	CAM_DBG(CAM_CRM,
+		"sync link %x last frame_duration is %d ns",
+		sync_link->link_hdl, sync_frame_duration);
+
+	if (link->initial_skip) {
+		link->initial_skip = false;
+
+		if ((link->sof_timestamp > sync_link->sof_timestamp) &&
+			(sync_link->sof_timestamp > 0) &&
+			(link->sof_timestamp - sync_link->sof_timestamp) <
+			(sync_frame_duration / 2)) {
+			/*
+			 * If this frame sync with the previous frame of sync
+			 * link, then we need to skip this frame, since the
+			 * previous frame of sync link is also skipped.
+			 */
+			CAM_DBG(CAM_CRM,
+				"This frame sync with previous sync_link %x frame",
+				sync_link->link_hdl);
+			return -EAGAIN;
+		} else if (link->sof_timestamp <= sync_link->sof_timestamp) {
+			/*
+			 * Sometimes, link receives the SOF event is eariler
+			 * than sync link in IFE CSID side, but link's SOF
+			 * event is processed later than sync link's, then
+			 * we need to skip this SOF event since the sync
+			 * link's SOF event is also skipped.
+			 */
+			CAM_DBG(CAM_CRM,
+				"The previous frame of sync link is skipped");
+			return -EAGAIN;
+		}
+	}
+
+	if (sync_link->sync_link_sof_skip) {
+		CAM_DBG(CAM_REQ,
+			"No req applied on corresponding SOF on sync link: %x",
+			sync_link->link_hdl);
+		sync_link->sync_link_sof_skip = false;
+		return -EAGAIN;
+	}
+
+	sync_slot_idx = __cam_req_mgr_find_slot_for_req(
+		sync_link->req.in_q, req_id);
+	if (sync_slot_idx == -1) {
+		CAM_DBG(CAM_CRM, "Req: %lld not found on link: %x [other link]",
+			req_id, sync_link->link_hdl);
+		sync_ready = false;
+		return -EAGAIN;
+	}
+
+	slot_idx_diff = (sync_slot_idx - sync_rd_idx + sync_num_slots) %
+		sync_num_slots;
+	if ((sync_link->req.in_q->slot[sync_slot_idx].status !=
+		CRM_SLOT_STATUS_REQ_APPLIED) &&
+		((slot_idx_diff > 1) ||
+		((slot_idx_diff == 1) &&
+		(sync_rd_slot->status !=
+		CRM_SLOT_STATUS_REQ_APPLIED)))) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld [other link] not next req to be applied on link: %x",
+			req_id, sync_link->link_hdl);
+		return -EAGAIN;
+	}
+
+	rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, true);
+	if (rc) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld [My link] not ready on link: %x, rc=%d",
+			req_id, link->link_hdl, rc);
+		ready = false;
+	}
+
+	if (sync_link->req.in_q) {
+		rc = __cam_req_mgr_check_link_is_ready(sync_link,
+			sync_slot_idx, true);
+		if (rc && (sync_link->req.in_q->slot[sync_slot_idx].status !=
+				CRM_SLOT_STATUS_REQ_APPLIED)) {
+			CAM_DBG(CAM_CRM,
+				"Req: %lld not ready on link: %x, rc=%d",
+				req_id, sync_link->link_hdl, rc);
+			sync_ready = false;
+		}
+	} else {
+		CAM_ERR(CAM_CRM, "Link hdl %x in_q is NULL",
+			sync_link->link_hdl);
+		return -EINVAL;
+	}
+
+	/*
+	 * If both of them are ready or not ready, then just
+	 * skip this sof and don't skip sync link next SOF.
+	 */
+	if (sync_ready != ready) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld ready %d sync_ready %d, ignore sync link next SOF",
+			req_id, ready, sync_ready);
+
+		/*
+		 * Only skip the frames if current frame sync with
+		 * next frame of sync link.
+		 */
+		if (link->sof_timestamp - sync_link->sof_timestamp >
+			sync_frame_duration / 2)
+			link->sync_link_sof_skip = true;
+		return -EINVAL;
+	} else if (!ready) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld not ready on link: %x",
+			req_id, link->link_hdl);
+		return -EINVAL;
+	}
+
+	/*
+	 * Do the self-correction when the frames are sync,
+	 * we consider that the frames are synced if the
+	 * difference of two SOF timestamp less than
+	 * (sync_frame_duration / 5).
+	 */
+	master_slave_diff = sync_frame_duration;
+	do_div(master_slave_diff, 5);
+	if ((trigger == CAM_TRIGGER_POINT_SOF) &&
+		(sync_link->sof_timestamp > 0) &&
+		(sof_timestamp_delta < master_slave_diff) &&
+		(sync_rd_slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC)) {
+
+		/*
+		 * This means current frame should sync with next
+		 * frame of sync link, then the request id of in
+		 * rd slot of two links should be same.
+		 */
+		CAM_DBG(CAM_CRM,
+			"link %x req_id %lld, sync_link %x req_id %lld",
+			link->link_hdl, req_id,
+			sync_link->link_hdl, sync_req_id);
+
+		if (req_id > sync_req_id) {
+			CAM_DBG(CAM_CRM,
+				"link %x too quickly, skip this frame",
+				link->link_hdl);
+			return -EAGAIN;
+		} else if (req_id < sync_req_id) {
+			CAM_DBG(CAM_CRM,
+				"sync link %x too quickly, skip next frame of sync link",
+				sync_link->link_hdl);
+			link->sync_link_sof_skip = true;
+		} else if (sync_link->req.in_q->slot[sync_slot_idx].status !=
+			CRM_SLOT_STATUS_REQ_APPLIED) {
+			CAM_DBG(CAM_CRM,
+				"link %x other not applied", link->link_hdl);
+			return -EAGAIN;
+		}
+	}
+	CAM_DBG(CAM_REQ,
+		"Req: %lld ready to apply on link: %x [validation successful]",
+		req_id, link->link_hdl);
+
+	return 0;
+}
+
+static int __cam_req_mgr_check_multi_sync_link_ready(
+	struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_slot *slot,
+	uint32_t trigger)
+{
+	int i, rc = 0;
+
+	if (link->state == CAM_CRM_LINK_STATE_IDLE) {
+		CAM_ERR(CAM_CRM, "link hdl %x is in idle state",
+				link->link_hdl);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < link->num_sync_links; i++) {
+		if (link->sync_link[i]) {
+			if (link->sync_link[i]->state ==
+				CAM_CRM_LINK_STATE_IDLE) {
+				CAM_ERR(CAM_CRM, "sync link hdl %x is idle",
+					link->sync_link[i]->link_hdl);
+				return -EINVAL;
+			}
+			if (link->max_delay == link->sync_link[i]->max_delay) {
+				rc = __cam_req_mgr_check_sync_req_is_ready(
+						link, link->sync_link[i],
+						slot, trigger);
+				if (rc < 0) {
+					CAM_DBG(CAM_CRM, "link %x not ready",
+						link->link_hdl);
+					return rc;
+				}
+			} else if (link->max_delay >
+					link->sync_link[i]->max_delay) {
+				link->is_master = true;
+				link->sync_link[i]->is_master = false;
+				rc = __cam_req_mgr_check_sync_for_mslave(
+					link, link->sync_link[i], slot);
+				if (rc < 0) {
+					CAM_DBG(CAM_CRM, "link%x not ready",
+						link->link_hdl);
+					return rc;
+				}
+			} else {
+				link->is_master = false;
+				link->sync_link[i]->is_master = true;
+				rc = __cam_req_mgr_check_sync_for_mslave(
+						link, link->sync_link[i], slot);
+				if (rc < 0) {
+					CAM_DBG(CAM_CRM, "link %x not ready",
+						link->link_hdl);
+					return rc;
+				}
+			}
+		} else {
+			CAM_ERR(CAM_REQ, "Sync link is null");
+			return -EINVAL;
+		}
+	}
+
+	rc = __cam_req_mgr_inject_delay(link->req.l_tbl,
+		slot->idx, trigger);
+	if (rc < 0) {
+		CAM_DBG(CAM_CRM,
+			"Req: %lld needs to inject delay at %s",
+			slot->req_id,
+			(trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF");
+		return -EINVAL;
+	}
+
+	/*
+	 *  At this point all validation is successfully done
+	 *  and we can proceed to apply the given request.
+	 *  Ideally the next call should return success.
+	 */
+	rc = __cam_req_mgr_check_link_is_ready(link, slot->idx, false);
+	if (rc)
+		CAM_WARN(CAM_CRM, "Unexpected return value rc: %d", rc);
+
+	return 0;
+}
+
+/**
+ * __cam_req_mgr_check_for_eof()
+ *
+ * @brief    : Checks for eof trigger type
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through
+ *
+ * @return   : eof trigger type
+ *
+ */
+static enum crm_req_eof_trigger_type __cam_req_mgr_check_for_eof(
+	struct cam_req_mgr_core_link *link)
+{
+	int32_t                        curr_idx;
+	struct cam_req_mgr_req_queue  *in_q;
+	enum crm_req_eof_trigger_type  eof_trigger_type;
+	struct cam_req_mgr_tbl_slot   *slot = NULL;
+	struct cam_req_mgr_req_tbl    *tbl;
+
+	in_q = link->req.in_q;
+	tbl = link->req.l_tbl;
+	curr_idx = in_q->rd_idx;
+	eof_trigger_type = CAM_REQ_EOF_TRIGGER_NONE;
+
+	while (tbl != NULL) {
+		slot = &tbl->slot[curr_idx];
+
+		if (slot->ops.is_applied) {
+			eof_trigger_type = CAM_REQ_EOF_TRIGGER_APPLIED;
+			break;
+		} else if (slot->ops.apply_at_eof) {
+			eof_trigger_type = CAM_REQ_EOF_TRIGGER_NOT_APPLY;
+			break;
+		}
+
+		if (tbl->next)
+			__cam_req_mgr_dec_idx(&curr_idx, tbl->pd_delta,
+				tbl->num_slots);
+
+		tbl = tbl->next;
+	}
+
+	CAM_DBG(CAM_REQ,
+		"Req[%lld] idx %d req_status %d link_hdl %x eof_trigger_type %x",
+		in_q->slot[in_q->rd_idx].req_id, in_q->rd_idx,
+		in_q->slot[in_q->rd_idx].status, link->link_hdl,
+		eof_trigger_type);
+
+	return eof_trigger_type;
+}
+
+/**
+ * __cam_req_mgr_process_req()
+ *
+ * @brief    : processes read index in request queue and traverse through table
+ * @link     : pointer to link whose input queue and req tbl are
+ *             traversed through
+ *
+ * @return   : 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_process_req(struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_trigger_notify *trigger_data)
+{
+	int                                  rc = 0, idx, i;
+	int                                  reset_step = 0;
+	uint32_t                             trigger = trigger_data->trigger;
+	struct cam_req_mgr_slot             *slot = NULL;
+	struct cam_req_mgr_req_queue        *in_q;
+	struct cam_req_mgr_core_session     *session;
+	struct cam_req_mgr_connected_device *dev = NULL;
+	struct cam_req_mgr_core_link        *tmp_link = NULL;
+	uint32_t                             max_retry = 0;
+	enum crm_req_eof_trigger_type        eof_trigger_type;
+
+	session = (struct cam_req_mgr_core_session *)link->parent;
+	if (!session) {
+		CAM_WARN(CAM_CRM, "session ptr NULL %x", link->link_hdl);
+		return -EINVAL;
+	}
+
+	mutex_lock(&session->lock);
+	/*
+	 * During session destroy/unlink the link state is updated and session
+	 * mutex is released when flushing the workq. In case the wq is scheduled
+	 * thereafter this API will then check the updated link state and exit
+	 */
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state == CAM_CRM_LINK_STATE_IDLE) {
+		spin_unlock_bh(&link->link_state_spin_lock);
+		mutex_unlock(&session->lock);
+		return -EPERM;
+	}
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	in_q = link->req.in_q;
+	/*
+	 * Check if new read index,
+	 * - if in pending  state, traverse again to complete
+	 *    transaction of this read index.
+	 * - if in applied_state, somthign wrong.
+	 * - if in no_req state, no new req
+	 */
+	CAM_DBG(CAM_REQ,
+		"%s Req[%lld] idx %d req_status %d link_hdl %x wd_timeout %d ms trigger:%d",
+		((trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF"),
+		in_q->slot[in_q->rd_idx].req_id, in_q->rd_idx,
+		in_q->slot[in_q->rd_idx].status, link->link_hdl,
+		in_q->slot[in_q->rd_idx].additional_timeout, trigger);
+
+	slot = &in_q->slot[in_q->rd_idx];
+	if (slot->status == CRM_SLOT_STATUS_NO_REQ) {
+		CAM_DBG(CAM_CRM, "No Pending req");
+		rc = 0;
+		goto end;
+	}
+
+	if ((trigger != CAM_TRIGGER_POINT_SOF) &&
+		(trigger != CAM_TRIGGER_POINT_EOF))
+		goto end;
+
+	eof_trigger_type = __cam_req_mgr_check_for_eof(link);
+
+	if ((trigger == CAM_TRIGGER_POINT_EOF) &&
+		(eof_trigger_type == CAM_REQ_EOF_TRIGGER_NONE)) {
+		CAM_DBG(CAM_CRM, "Not any request to schedule at EOF");
+		goto end;
+	}
+
+	if (trigger == CAM_TRIGGER_POINT_SOF) {
+		/*
+		 * Update the timestamp in session lock protection
+		 * to avoid timing issue.
+		 */
+		link->prev_sof_timestamp = link->sof_timestamp;
+		link->sof_timestamp = trigger_data->sof_timestamp_val;
+
+		/* Check for WQ congestion */
+		if (jiffies_to_msecs(jiffies -
+			link->last_sof_trigger_jiffies) <
+			MINIMUM_WORKQUEUE_SCHED_TIME_IN_MS)
+			link->wq_congestion = true;
+		else
+			link->wq_congestion = false;
+	}
+
+	if (slot->status != CRM_SLOT_STATUS_REQ_READY) {
+		if (slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+			rc = __cam_req_mgr_check_multi_sync_link_ready(
+				link, slot, trigger);
+		} else {
+			if (link->in_msync_mode) {
+				CAM_DBG(CAM_CRM,
+					"Settings master-slave non sync mode for link 0x%x",
+					link->link_hdl);
+				link->in_msync_mode = false;
+				link->initial_sync_req = -1;
+				for (i = 0; i < link->num_sync_links; i++) {
+					if (link->sync_link[i]) {
+						tmp_link = link->sync_link[i];
+						tmp_link->initial_sync_req = -1;
+						tmp_link->in_msync_mode = false;
+					}
+				}
+			}
+
+			/*
+			 * Validate that if the req is ready to apply before
+			 * checking the inject delay.
+			 */
+			rc = __cam_req_mgr_check_link_is_ready(link,
+				slot->idx, true);
+
+			if (!rc) {
+				rc = __cam_req_mgr_inject_delay(link->req.l_tbl,
+					slot->idx, trigger);
+				if (rc < 0)
+					CAM_DBG(CAM_CRM,
+						"Req: %lld needs to inject delay at %s",
+						slot->req_id,
+						(trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF");
+
+				if (!rc)
+					rc = __cam_req_mgr_check_link_is_ready(link,
+						slot->idx, false);
+			}
+		}
+
+		if (!rc) {
+			if ((trigger == CAM_TRIGGER_POINT_SOF) &&
+				(eof_trigger_type == CAM_REQ_EOF_TRIGGER_NOT_APPLY)) {
+				CAM_DBG(CAM_CRM, "EOF apply first");
+				rc = -EAGAIN;
+			}
+		}
+
+		if (rc < 0) {
+			/*
+			 * If traverse result is not success, then some devices
+			 * are not ready with packet for the asked request id,
+			 * hence try again in next sof
+			 */
+			slot->status = CRM_SLOT_STATUS_REQ_PENDING;
+			spin_lock_bh(&link->link_state_spin_lock);
+			if (link->state == CAM_CRM_LINK_STATE_ERR) {
+				/*
+				 * During error recovery all tables should be
+				 * ready, don't expect to enter here.
+				 * @TODO: gracefully handle if recovery fails.
+				 */
+				CAM_ERR_RATE_LIMIT(CAM_CRM,
+					"FATAL recovery cant finish idx %d status %d",
+					in_q->rd_idx,
+					in_q->slot[in_q->rd_idx].status);
+				rc = -EPERM;
+			}
+			spin_unlock_bh(&link->link_state_spin_lock);
+			__cam_req_mgr_notify_frame_skip(link, trigger);
+			__cam_req_mgr_validate_crm_wd_timer(link);
+			goto end;
+		} else {
+			slot->status = CRM_SLOT_STATUS_REQ_READY;
+			CAM_DBG(CAM_REQ,
+				"linx_hdl %x Req[%lld] idx %d ready to apply",
+				link->link_hdl, in_q->slot[in_q->rd_idx].req_id,
+				in_q->rd_idx);
+		}
+	}
+
+	rc = __cam_req_mgr_send_req(link, link->req.in_q, trigger, &dev);
+	if (rc < 0) {
+		/* Apply req failed retry at next sof */
+		slot->status = CRM_SLOT_STATUS_REQ_PENDING;
+		max_retry = MAXIMUM_RETRY_ATTEMPTS;
+		if (link->max_delay == 1)
+			max_retry++;
+
+		if (!link->wq_congestion && dev) {
+			link->retry_cnt++;
+			if (link->retry_cnt == max_retry) {
+				CAM_DBG(CAM_CRM,
+					"Max retry attempts (count %d) reached on link[0x%x] for req [%lld]",
+					max_retry, link->link_hdl,
+					in_q->slot[in_q->rd_idx].req_id);
+
+				cam_req_mgr_debug_delay_detect();
+				trace_cam_delay_detect("CRM",
+					"Max retry attempts reached",
+					in_q->slot[in_q->rd_idx].req_id,
+					CAM_DEFAULT_VALUE,
+					link->link_hdl,
+					CAM_DEFAULT_VALUE, rc);
+
+				__cam_req_mgr_notify_error_on_link(link, dev);
+				link->retry_cnt = 0;
+			}
+		} else
+			CAM_WARN_RATE_LIMIT(CAM_CRM,
+				"workqueue congestion, last applied idx:%d rd idx:%d",
+				in_q->last_applied_idx,
+				in_q->rd_idx);
+	} else {
+		if (link->retry_cnt)
+			link->retry_cnt = 0;
+
+		/* Check for any long exposure settings */
+		__cam_req_mgr_validate_crm_wd_timer(link);
+
+		CAM_DBG(CAM_CRM, "Applied req[%lld] on link[%x] success",
+			slot->req_id, link->link_hdl);
+		spin_lock_bh(&link->link_state_spin_lock);
+		if (link->state == CAM_CRM_LINK_STATE_ERR) {
+			CAM_WARN(CAM_CRM, "Err recovery done idx %d",
+				in_q->rd_idx);
+			link->state = CAM_CRM_LINK_STATE_READY;
+		}
+		spin_unlock_bh(&link->link_state_spin_lock);
+
+		if (link->sync_link_sof_skip)
+			link->sync_link_sof_skip = false;
+
+		/*
+		 * Below two cases can move slot to APPLIED status,
+		 * 1# there is no eof trigger request
+		 * 2# eof trigger is applied and the devcies which need to
+		 * be applied at SOF are also applied.
+		 */
+		if (((eof_trigger_type == CAM_REQ_EOF_TRIGGER_NONE) ||
+			(eof_trigger_type == CAM_REQ_EOF_TRIGGER_APPLIED)) &&
+			(trigger == CAM_TRIGGER_POINT_SOF)) {
+			slot->status = CRM_SLOT_STATUS_REQ_APPLIED;
+
+			CAM_DBG(CAM_CRM, "req %d is applied on link %x",
+				slot->req_id,
+				link->link_hdl);
+			idx = in_q->rd_idx;
+			reset_step = link->max_delay;
+
+			for (i = 0; i < link->num_sync_links; i++) {
+				if (link->sync_link[i]) {
+					if ((link->in_msync_mode) &&
+						(link->sync_link[i]->max_delay >
+							reset_step))
+						reset_step =
+						link->sync_link[i]->max_delay;
+				}
+			}
+
+			if (slot->req_id > 0)
+				in_q->last_applied_idx = idx;
+
+			__cam_req_mgr_dec_idx(
+				&idx, reset_step + 1,
+				in_q->num_slots);
+			__cam_req_mgr_reset_req_slot(link, idx);
+			link->open_req_cnt--;
+		}
+	}
+end:
+	/*
+	 * Only update the jiffies for SOF trigger,
+	 * since it is used to protect from
+	 * applying fails in ISP which is triggered at SOF.
+	 */
+	if (trigger == CAM_TRIGGER_POINT_SOF)
+		link->last_sof_trigger_jiffies = jiffies;
+	mutex_unlock(&session->lock);
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_add_tbl_to_link()
+ *
+ * @brief    : Add table to list under link sorted by pd decremeting order
+ * @l_tbl    : list of pipeline delay tables.
+ * @new_tbl  : new tbl which will be appended to above list as per its pd value
+ *
+ */
+static void __cam_req_mgr_add_tbl_to_link(struct cam_req_mgr_req_tbl **l_tbl,
+	struct cam_req_mgr_req_tbl *new_tbl)
+{
+	struct cam_req_mgr_req_tbl *tbl;
+
+	if (!(*l_tbl) || (*l_tbl)->pd < new_tbl->pd) {
+		new_tbl->next = *l_tbl;
+		if (*l_tbl) {
+			new_tbl->pd_delta =
+				new_tbl->pd - (*l_tbl)->pd;
+		}
+		*l_tbl = new_tbl;
+	} else {
+		tbl = *l_tbl;
+
+		/* Reach existing  tbl which has less pd value */
+		while (tbl->next != NULL &&
+			new_tbl->pd < tbl->next->pd) {
+			tbl = tbl->next;
+		}
+		if (tbl->next != NULL) {
+			new_tbl->pd_delta =
+				new_tbl->pd - tbl->next->pd;
+		} else {
+			/* This is last table in linked list*/
+			new_tbl->pd_delta = 0;
+		}
+		new_tbl->next = tbl->next;
+		tbl->next = new_tbl;
+		tbl->pd_delta = tbl->pd - new_tbl->pd;
+	}
+	CAM_DBG(CAM_CRM, "added pd %d tbl to link delta %d", new_tbl->pd,
+		new_tbl->pd_delta);
+}
+
+/**
+ * __cam_req_mgr_create_pd_tbl()
+ *
+ * @brief    : Creates new request table for new delay value
+ * @delay    : New pd table allocated will have this delay value
+ *
+ * @return   : pointer to newly allocated table, NULL for failure
+ *
+ */
+static struct cam_req_mgr_req_tbl *__cam_req_mgr_create_pd_tbl(int32_t delay)
+{
+	int i = 0;
+
+	struct cam_req_mgr_req_tbl *tbl =
+		kzalloc(sizeof(struct cam_req_mgr_req_tbl), GFP_KERNEL);
+	if (tbl != NULL) {
+		tbl->num_slots = MAX_REQ_SLOTS;
+		CAM_DBG(CAM_CRM, "pd= %d slots= %d", delay, tbl->num_slots);
+		for (i = 0; i < MAX_REQ_SLOTS; i++) {
+			tbl->slot[i].ops.apply_at_eof = false;
+			tbl->slot[i].ops.dev_hdl = -1;
+			tbl->slot[i].ops.is_applied = false;
+		}
+	}
+
+	return tbl;
+}
+
+/**
+ * __cam_req_mgr_destroy_all_tbl()
+ *
+ * @brief   : This func will destroy all pipeline delay based req table structs
+ * @l_tbl    : pointer to first table in list and it has max pd .
+ *
+ */
+static void __cam_req_mgr_destroy_all_tbl(struct cam_req_mgr_req_tbl **l_tbl)
+{
+	struct cam_req_mgr_req_tbl  *tbl = *l_tbl, *temp;
+
+	CAM_DBG(CAM_CRM, "*l_tbl %pK", tbl);
+	while (tbl != NULL) {
+		temp = tbl->next;
+		kfree(tbl);
+		tbl = temp;
+	}
+	*l_tbl = NULL;
+}
+
+/**
+ * __cam_req_mgr_setup_in_q()
+ *
+ * @brief : Initialize req table data
+ * @req   : request data pointer
+ *
+ * @return: 0 for success, negative for failure
+ *
+ */
+static int  __cam_req_mgr_setup_in_q(struct cam_req_mgr_req_data *req)
+{
+	int                           i;
+	struct cam_req_mgr_req_queue *in_q = req->in_q;
+
+	if (!in_q) {
+		CAM_ERR(CAM_CRM, "NULL in_q");
+		return -EINVAL;
+	}
+
+	mutex_lock(&req->lock);
+	in_q->num_slots = MAX_REQ_SLOTS;
+
+	for (i = 0; i < in_q->num_slots; i++) {
+		in_q->slot[i].idx = i;
+		in_q->slot[i].req_id = -1;
+		in_q->slot[i].skip_idx = 0;
+		in_q->slot[i].status = CRM_SLOT_STATUS_NO_REQ;
+	}
+
+	in_q->wr_idx = 0;
+	in_q->rd_idx = 0;
+	mutex_unlock(&req->lock);
+
+	return 0;
+}
+
+/**
+ * __cam_req_mgr_reset_req_tbl()
+ *
+ * @brief : Initialize req table data
+ * @req   : request queue pointer
+ *
+ * @return: 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_reset_in_q(struct cam_req_mgr_req_data *req)
+{
+	struct cam_req_mgr_req_queue *in_q = req->in_q;
+
+	if (!in_q) {
+		CAM_ERR(CAM_CRM, "NULL in_q");
+		return -EINVAL;
+	}
+
+	mutex_lock(&req->lock);
+	memset(in_q->slot, 0,
+		sizeof(struct cam_req_mgr_slot) * in_q->num_slots);
+	in_q->num_slots = 0;
+
+	in_q->wr_idx = 0;
+	in_q->rd_idx = 0;
+	mutex_unlock(&req->lock);
+
+	return 0;
+}
+
+/**
+ * __cam_req_mgr_notify_sof_freeze()
+ *
+ * @brief : Notify devices on link on detecting a SOF freeze
+ * @link  : link on which the sof freeze was detected
+ *
+ */
+static void __cam_req_mgr_notify_sof_freeze(
+	struct cam_req_mgr_core_link *link)
+{
+	int                                  i = 0;
+	struct cam_req_mgr_link_evt_data     evt_data;
+	struct cam_req_mgr_connected_device *dev = NULL;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		evt_data.evt_type = CAM_REQ_MGR_LINK_EVT_SOF_FREEZE;
+		evt_data.dev_hdl = dev->dev_hdl;
+		evt_data.link_hdl =  link->link_hdl;
+		evt_data.req_id = 0;
+		evt_data.u.error = CRM_KMD_ERR_FATAL;
+		if (dev->ops && dev->ops->process_evt)
+			dev->ops->process_evt(&evt_data);
+	}
+}
+
+/**
+ * __cam_req_mgr_process_sof_freeze()
+ *
+ * @brief : Apoptosis - Handles case when connected devices are not responding
+ * @priv  : link information
+ * @data  : task data
+ *
+ */
+static int __cam_req_mgr_process_sof_freeze(void *priv, void *data)
+{
+	struct cam_req_mgr_core_link    *link = NULL;
+	struct cam_req_mgr_req_queue    *in_q = NULL;
+	struct cam_req_mgr_core_session *session = NULL;
+	struct cam_req_mgr_message       msg;
+	int rc = 0;
+	int64_t last_applied_req_id = -EINVAL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		return -EINVAL;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	session = (struct cam_req_mgr_core_session *)link->parent;
+	if (!session) {
+		CAM_WARN(CAM_CRM, "session ptr NULL %x", link->link_hdl);
+		return -EINVAL;
+	}
+
+	in_q = link->req.in_q;
+	if (in_q) {
+		mutex_lock(&link->req.lock);
+		if (in_q->last_applied_idx >= 0)
+			last_applied_req_id =
+				in_q->slot[in_q->last_applied_idx].req_id;
+		mutex_unlock(&link->req.lock);
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if ((link->watchdog) && (link->watchdog->pause_timer)) {
+		CAM_INFO(CAM_CRM,
+			"link:%x watchdog paused, maybe stream on/off is delayed",
+			link->link_hdl);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		return rc;
+	}
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	CAM_ERR(CAM_CRM,
+		"SOF freeze for session: %d link: 0x%x max_pd: %d last_req_id:%lld",
+		session->session_hdl, link->link_hdl, link->max_delay,
+		last_applied_req_id);
+
+	__cam_req_mgr_notify_sof_freeze(link);
+	memset(&msg, 0, sizeof(msg));
+
+	msg.session_hdl = session->session_hdl;
+	msg.u.err_msg.error_type = CAM_REQ_MGR_ERROR_TYPE_SOF_FREEZE;
+	msg.u.err_msg.request_id = 0;
+	msg.u.err_msg.link_hdl   = link->link_hdl;
+
+	rc = cam_req_mgr_notify_message(&msg,
+		V4L_EVENT_CAM_REQ_MGR_ERROR, V4L_EVENT_CAM_REQ_MGR_EVENT);
+
+	if (rc)
+		CAM_ERR(CAM_CRM,
+			"Error notifying SOF freeze for session %d link 0x%x rc %d",
+			session->session_hdl, link->link_hdl, rc);
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_sof_freeze()
+ *
+ * @brief : Callback function for timer timeout indicating SOF freeze
+ * @data  : timer pointer
+ *
+ */
+static void __cam_req_mgr_sof_freeze(struct timer_list *timer_data)
+{
+	struct cam_req_mgr_timer     *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+	struct crm_workq_task               *task = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct crm_task_payload             *task_data;
+
+	if (!timer) {
+		CAM_ERR(CAM_CRM, "NULL timer");
+		return;
+	}
+
+	link = (struct cam_req_mgr_core_link *)timer->parent;
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR(CAM_CRM, "No empty task");
+		return;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_NOTIFY_FREEZE;
+	task->process_cb = &__cam_req_mgr_process_sof_freeze;
+	cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+}
+
+/**
+ * __cam_req_mgr_create_subdevs()
+ *
+ * @brief   : Create new crm  subdev to link with realtime devices
+ * @l_dev   : list of subdevs internal to crm
+ * @num_dev : num of subdevs to be created for link
+ *
+ * @return  : pointer to allocated list of devices
+ */
+static int __cam_req_mgr_create_subdevs(
+	struct cam_req_mgr_connected_device **l_dev, int32_t num_dev)
+{
+	int rc = 0;
+	*l_dev = kzalloc(sizeof(struct cam_req_mgr_connected_device) *
+		num_dev, GFP_KERNEL);
+	if (!*l_dev)
+		rc = -ENOMEM;
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_destroy_subdev()
+ *
+ * @brief    : Cleans up the subdevs allocated by crm for link
+ * @l_device : pointer to list of subdevs crm created
+ *
+ */
+static void __cam_req_mgr_destroy_subdev(
+	struct cam_req_mgr_connected_device **l_device)
+{
+	CAM_DBG(CAM_CRM, "*l_device %pK", *l_device);
+	if (*(l_device) != NULL) {
+		kfree(*(l_device));
+		*l_device = NULL;
+	}
+}
+
+/**
+ * __cam_req_mgr_destroy_link_info()
+ *
+ * @brief    : Unlinks all devices on the link
+ * @link     : pointer to link
+ *
+ * @return   : returns if unlink for any device was success or failure
+ */
+static int __cam_req_mgr_disconnect_link(struct cam_req_mgr_core_link *link)
+{
+	int32_t                                 i = 0;
+	struct cam_req_mgr_connected_device    *dev;
+	struct cam_req_mgr_core_dev_link_setup  link_data;
+	int                                     rc = 0;
+
+	link_data.link_enable = 0;
+	link_data.link_hdl = link->link_hdl;
+	link_data.crm_cb = NULL;
+
+	/* Using device ops unlink devices */
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+		if (dev == NULL)
+			continue;
+
+		link_data.dev_hdl = dev->dev_hdl;
+		if (dev->ops && dev->ops->link_setup) {
+			rc = dev->ops->link_setup(&link_data);
+			if (rc)
+				CAM_ERR(CAM_CRM,
+					"Unlink failed dev name %s hdl %x",
+					dev->dev_info.name,
+					dev->dev_hdl);
+		}
+		dev->dev_hdl = 0;
+		dev->parent = NULL;
+		dev->ops = NULL;
+	}
+
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_destroy_link_info()
+ *
+ * @brief    : Cleans up the mem allocated while linking
+ * @link     : pointer to link, mem associated with this link is freed
+ */
+static void __cam_req_mgr_destroy_link_info(struct cam_req_mgr_core_link *link)
+{
+	__cam_req_mgr_destroy_all_tbl(&link->req.l_tbl);
+	__cam_req_mgr_reset_in_q(&link->req);
+	link->req.num_tbl = 0;
+	mutex_destroy(&link->req.lock);
+
+	link->pd_mask = 0;
+	link->num_devs = 0;
+	link->max_delay = 0;
+}
+
+/**
+ * __cam_req_mgr_reserve_link()
+ *
+ * @brief: Reserves one link data struct within session
+ * @session: session identifier
+ *
+ * @return: pointer to link reserved
+ *
+ */
+static struct cam_req_mgr_core_link *__cam_req_mgr_reserve_link(
+	struct cam_req_mgr_core_session *session)
+{
+	struct cam_req_mgr_core_link *link;
+	struct cam_req_mgr_req_queue *in_q;
+	int i;
+
+	if (!session || !g_crm_core_dev) {
+		CAM_ERR(CAM_CRM, "NULL session/core_dev ptr");
+		return NULL;
+	}
+
+	if (session->num_links >= MAXIMUM_LINKS_PER_SESSION) {
+		CAM_ERR(CAM_CRM, "Reached max links %d per session limit %d",
+			session->num_links, MAXIMUM_LINKS_PER_SESSION);
+		return NULL;
+	}
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION; i++) {
+		if (!atomic_cmpxchg(&g_links[i].is_used, 0, 1)) {
+			link = &g_links[i];
+			CAM_DBG(CAM_CRM, "alloc link index %d", i);
+			cam_req_mgr_core_link_reset(link);
+			break;
+		}
+	}
+	if (i == MAXIMUM_LINKS_PER_SESSION)
+		return NULL;
+
+	in_q = kzalloc(sizeof(struct cam_req_mgr_req_queue),
+		GFP_KERNEL);
+	if (!in_q) {
+		CAM_ERR(CAM_CRM, "failed to create input queue, no mem");
+		return NULL;
+	}
+
+	mutex_lock(&link->lock);
+	link->num_devs = 0;
+	link->max_delay = 0;
+	memset(in_q->slot, 0,
+		sizeof(struct cam_req_mgr_slot) * MAX_REQ_SLOTS);
+	link->req.in_q = in_q;
+	in_q->num_slots = 0;
+	link->state = CAM_CRM_LINK_STATE_IDLE;
+	link->parent = (void *)session;
+
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION - 1; i++)
+		link->sync_link[i] = NULL;
+
+	mutex_unlock(&link->lock);
+
+	mutex_lock(&session->lock);
+	/*  Loop through and find a free index */
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION; i++) {
+		if (!session->links[i]) {
+			CAM_DBG(CAM_CRM,
+				"Free link index %d found, num_links=%d",
+				i, session->num_links);
+			session->links[i] = link;
+			break;
+		}
+	}
+
+	if (i == MAXIMUM_LINKS_PER_SESSION) {
+		CAM_ERR(CAM_CRM, "Free link index not found");
+		goto error;
+	}
+
+	session->num_links++;
+	CAM_DBG(CAM_CRM, "Active session links (%d)",
+		session->num_links);
+	mutex_unlock(&session->lock);
+
+	return link;
+error:
+	mutex_unlock(&session->lock);
+	kfree(in_q);
+	return NULL;
+}
+
+/*
+ * __cam_req_mgr_free_link()
+ *
+ * @brief: Frees the link and its request queue
+ *
+ * @link: link identifier
+ *
+ */
+static void __cam_req_mgr_free_link(struct cam_req_mgr_core_link *link)
+{
+	ptrdiff_t i;
+	kfree(link->req.in_q);
+	link->req.in_q = NULL;
+	link->parent = NULL;
+	i = link - g_links;
+	CAM_DBG(CAM_CRM, "free link index %d", i);
+	cam_req_mgr_core_link_reset(link);
+	atomic_set(&g_links[i].is_used, 0);
+}
+
+/**
+ * __cam_req_mgr_unreserve_link()
+ *
+ * @brief  : Removes the link data struct from the session and frees it
+ * @session: session identifier
+ * @link   : link identifier
+ *
+ */
+static void __cam_req_mgr_unreserve_link(
+	struct cam_req_mgr_core_session *session,
+	struct cam_req_mgr_core_link *link)
+{
+	int i, j;
+
+	if (!session || !link) {
+		CAM_ERR(CAM_CRM, "NULL session/link ptr %pK %pK",
+			session, link);
+		return;
+	}
+
+	mutex_lock(&session->lock);
+	if (!session->num_links) {
+		CAM_WARN(CAM_CRM, "No active link or invalid state: hdl %x",
+			link->link_hdl);
+		mutex_unlock(&session->lock);
+		return;
+	}
+
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION; i++) {
+		if (session->links[i] == link)
+			session->links[i] = NULL;
+		for (j = 0; j < MAXIMUM_LINKS_PER_SESSION - 1; j++) {
+			if (link->sync_link[j]) {
+				if (link->sync_link[j] == session->links[i])
+					session->links[i]->sync_link[j] = NULL;
+			}
+		}
+	}
+
+	for (j = 0; j < MAXIMUM_LINKS_PER_SESSION - 1; j++)
+		link->sync_link[j] = NULL;
+	session->num_links--;
+	CAM_DBG(CAM_CRM, "Active session links (%d)", session->num_links);
+	mutex_unlock(&session->lock);
+	__cam_req_mgr_free_link(link);
+}
+
+/* Workqueue context processing section */
+
+/**
+ * cam_req_mgr_process_flush_req()
+ *
+ * @brief: This runs in workque thread context. Call core funcs to check
+ *         which requests need to be removed/cancelled.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+static int cam_req_mgr_process_flush_req(void *priv, void *data)
+{
+	int                                  rc = 0, i = 0, idx = -1;
+	uint32_t                             pd = 0;
+	struct cam_req_mgr_flush_info       *flush_info = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_req_queue        *in_q = NULL;
+	struct cam_req_mgr_slot             *slot = NULL;
+	struct cam_req_mgr_connected_device *device = NULL;
+	struct cam_req_mgr_flush_request     flush_req;
+	struct crm_task_payload             *task_data = NULL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	flush_info  = (struct cam_req_mgr_flush_info *)&task_data->u;
+	CAM_DBG(CAM_REQ, "link_hdl %x req_id %lld type %d",
+		flush_info->link_hdl,
+		flush_info->req_id,
+		flush_info->flush_type);
+
+	in_q = link->req.in_q;
+
+	trace_cam_flush_req(link, flush_info);
+
+	mutex_lock(&link->req.lock);
+	if (flush_info->flush_type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		link->last_flush_id = flush_info->req_id;
+		CAM_INFO(CAM_CRM, "Last request id to flush is %lld",
+			flush_info->req_id);
+		__cam_req_mgr_flush_req_slot(link);
+	} else if (flush_info->flush_type ==
+		CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+		idx = __cam_req_mgr_find_slot_for_req(in_q, flush_info->req_id);
+		if (idx < 0) {
+			CAM_ERR(CAM_CRM, "req_id %lld not found in input queue",
+			flush_info->req_id);
+		} else {
+			CAM_DBG(CAM_CRM, "req_id %lld found at idx %d",
+				flush_info->req_id, idx);
+			slot = &in_q->slot[idx];
+			if (slot->status == CRM_SLOT_STATUS_REQ_PENDING ||
+				slot->status == CRM_SLOT_STATUS_REQ_APPLIED) {
+				CAM_WARN(CAM_CRM,
+					"req_id %lld can not be cancelled",
+					flush_info->req_id);
+				mutex_unlock(&link->req.lock);
+				return -EINVAL;
+			}
+			slot->additional_timeout = 0;
+			__cam_req_mgr_in_q_skip_idx(in_q, idx);
+		}
+	}
+
+	for (i = 0; i < link->num_devs; i++) {
+		device = &link->l_dev[i];
+		flush_req.link_hdl = flush_info->link_hdl;
+		flush_req.dev_hdl = device->dev_hdl;
+		flush_req.req_id = flush_info->req_id;
+		flush_req.type = flush_info->flush_type;
+		/* @TODO: error return handling from drivers */
+		if (device->ops && device->ops->flush_req)
+			rc = device->ops->flush_req(&flush_req);
+	}
+
+	for (pd = 0; pd < CAM_PIPELINE_DELAY_MAX; pd++) {
+		link->req.apply_data[pd].req_id = -1;
+		link->req.prev_apply_data[pd].req_id = -1;
+	}
+
+	complete(&link->workq_comp);
+	mutex_unlock(&link->req.lock);
+
+end:
+	return rc;
+}
+
+/**
+ * cam_req_mgr_process_sched_req()
+ *
+ * @brief: This runs in workque thread context. Call core funcs to check
+ *         which peding requests can be processed.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+static int cam_req_mgr_process_sched_req(void *priv, void *data)
+{
+	int                               rc = 0, i;
+	struct cam_req_mgr_sched_request *sched_req = NULL;
+	struct cam_req_mgr_core_link     *link = NULL;
+	struct cam_req_mgr_req_queue     *in_q = NULL;
+	struct cam_req_mgr_slot          *slot = NULL;
+	struct crm_task_payload          *task_data = NULL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	sched_req  = (struct cam_req_mgr_sched_request *)&task_data->u;
+	in_q = link->req.in_q;
+
+	CAM_DBG(CAM_CRM,
+		"link_hdl %x req_id %lld at slot %d sync_mode %d is_master %d exp_timeout_val %d ms",
+		sched_req->link_hdl, sched_req->req_id,
+		in_q->wr_idx, sched_req->sync_mode,
+		link->is_master,
+		sched_req->additional_timeout);
+
+	mutex_lock(&link->req.lock);
+	slot = &in_q->slot[in_q->wr_idx];
+
+	if (slot->status != CRM_SLOT_STATUS_NO_REQ &&
+		slot->status != CRM_SLOT_STATUS_REQ_APPLIED)
+		CAM_WARN(CAM_CRM, "in_q overwrite %d", slot->status);
+
+	slot->status = CRM_SLOT_STATUS_REQ_ADDED;
+	slot->req_id = sched_req->req_id;
+	slot->sync_mode = sched_req->sync_mode;
+	slot->skip_idx = 0;
+	slot->recover = sched_req->bubble_enable;
+	if (sched_req->additional_timeout < 0) {
+		CAM_WARN(CAM_CRM,
+			"Requested timeout is invalid [%dms]",
+			sched_req->additional_timeout);
+		slot->additional_timeout = 0;
+	} else if (sched_req->additional_timeout >
+		CAM_REQ_MGR_WATCHDOG_TIMEOUT_MAX) {
+		CAM_WARN(CAM_CRM,
+			"Requested timeout [%dms] max supported timeout [%dms] resetting to max",
+			sched_req->additional_timeout,
+			CAM_REQ_MGR_WATCHDOG_TIMEOUT_MAX);
+		slot->additional_timeout = CAM_REQ_MGR_WATCHDOG_TIMEOUT_MAX;
+	} else {
+		slot->additional_timeout = sched_req->additional_timeout;
+	}
+
+	link->open_req_cnt++;
+	__cam_req_mgr_inc_idx(&in_q->wr_idx, 1, in_q->num_slots);
+
+	if (slot->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+		if (link->initial_sync_req == -1)
+			link->initial_sync_req = slot->req_id;
+	} else {
+		link->initial_sync_req = -1;
+		for (i = 0; i < link->num_sync_links; i++) {
+			if (link->sync_link[i])
+				link->sync_link[i]->initial_sync_req = -1;
+		}
+	}
+
+	mutex_unlock(&link->req.lock);
+
+end:
+	return rc;
+}
+
+/**
+ * cam_req_mgr_process_add_req()
+ *
+ * @brief: This runs in workque thread context. Call core funcs to check
+ *         which peding requests can be processed.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+static int cam_req_mgr_process_add_req(void *priv, void *data)
+{
+	int                                  rc = 0, i = 0, idx;
+	struct cam_req_mgr_add_request      *add_req = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_connected_device *device = NULL;
+	struct cam_req_mgr_req_tbl          *tbl = NULL;
+	struct cam_req_mgr_tbl_slot         *slot = NULL;
+	struct crm_task_payload             *task_data = NULL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	add_req = (struct cam_req_mgr_add_request *)&task_data->u;
+
+	for (i = 0; i < link->num_devs; i++) {
+		device = &link->l_dev[i];
+		if (device->dev_hdl == add_req->dev_hdl) {
+			tbl = device->pd_tbl;
+			break;
+		}
+	}
+	if (!tbl) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "dev_hdl not found %x, %x %x",
+			add_req->dev_hdl,
+			link->l_dev[0].dev_hdl,
+			link->l_dev[1].dev_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+	/*
+	 * Go through request table and add
+	 * request id to proper table
+	 * 1. find req slot in in_q matching req_id.sent by dev
+	 * 2. goto table of this device based on p_delay
+	 * 3. mark req_ready_map with this dev_bit.
+	 */
+
+	mutex_lock(&link->req.lock);
+	idx = __cam_req_mgr_find_slot_for_req(link->req.in_q, add_req->req_id);
+	if (idx < 0) {
+		CAM_ERR(CAM_CRM,
+			"req %lld not found in in_q for dev %s on link 0x%x",
+			add_req->req_id, device->dev_info.name, link->link_hdl);
+		rc = -EBADSLT;
+		mutex_unlock(&link->req.lock);
+		goto end;
+	}
+
+	slot = &tbl->slot[idx];
+	slot->ops.is_applied = false;
+
+	if ((add_req->skip_at_sof & 0xFF) > slot->inject_delay_at_sof) {
+		slot->inject_delay_at_sof = (add_req->skip_at_sof & 0xFF);
+		CAM_DBG(CAM_CRM,
+			"Req_id %llu injecting delay %llu frame at SOF by %s",
+			add_req->req_id,
+			slot->inject_delay_at_sof,
+			device->dev_info.name);
+	}
+
+	if ((add_req->skip_at_eof & 0xFF) > slot->inject_delay_at_eof) {
+		slot->inject_delay_at_eof = (add_req->skip_at_eof & 0xFF);
+		CAM_DBG(CAM_CRM,
+			"Req_id %llu injecting delay %llu frame at EOF by %s",
+			add_req->req_id,
+			slot->inject_delay_at_eof,
+			device->dev_info.name);
+	}
+
+	if (add_req->trigger_eof) {
+		slot->ops.apply_at_eof = true;
+		slot->ops.dev_hdl = add_req->dev_hdl;
+		CAM_DBG(CAM_REQ,
+			"Req_id %llu slot:%d added for EOF tigger for Device: %s",
+			add_req->req_id, idx, device->dev_info.name);
+	}
+
+	if (slot->state != CRM_REQ_STATE_PENDING &&
+		slot->state != CRM_REQ_STATE_EMPTY) {
+		CAM_WARN(CAM_CRM,
+			"Unexpected state %d for slot %d map %x for dev %s on link 0x%x",
+			slot->state, idx, slot->req_ready_map,
+			device->dev_info.name, link->link_hdl);
+	}
+
+	slot->state = CRM_REQ_STATE_PENDING;
+	slot->req_ready_map |= (1 << device->dev_bit);
+
+	CAM_DBG(CAM_CRM, "idx %d dev_hdl %x req_id %lld pd %d ready_map %x",
+		idx, add_req->dev_hdl, add_req->req_id, tbl->pd,
+		slot->req_ready_map);
+
+	trace_cam_req_mgr_add_req(link, idx, add_req, tbl, device);
+
+	if (slot->req_ready_map == tbl->dev_mask) {
+		CAM_DBG(CAM_REQ,
+			"link 0x%x idx %d req_id %lld pd %d SLOT READY",
+			link->link_hdl, idx, add_req->req_id, tbl->pd);
+		slot->state = CRM_REQ_STATE_READY;
+	}
+	mutex_unlock(&link->req.lock);
+
+end:
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_apply_on_bubble()
+ *
+ * @brief    : This API tries to apply settings to the device
+ *             with highest pd on the bubbled frame
+ * @link     : link information.
+ * @err_info : contains information about frame_id, trigger etc.
+ *
+ */
+static void __cam_req_mgr_apply_on_bubble(
+	struct cam_req_mgr_core_link    *link,
+	struct cam_req_mgr_error_notify *err_info)
+{
+	int rc = 0;
+	struct cam_req_mgr_trigger_notify trigger_data;
+
+	trigger_data.dev_hdl = err_info->dev_hdl;
+	trigger_data.frame_id = err_info->frame_id;
+	trigger_data.link_hdl = err_info->link_hdl;
+	trigger_data.sof_timestamp_val =
+		err_info->sof_timestamp_val;
+	trigger_data.trigger = err_info->trigger;
+
+	rc = __cam_req_mgr_process_req(link, &trigger_data);
+	if (rc)
+		CAM_ERR(CAM_CRM,
+			"Failed to apply request on bubbled frame");
+}
+
+/**
+ * cam_req_mgr_process_error()
+ *
+ * @brief: This runs in workque thread context. bubble /err recovery.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+static int cam_req_mgr_process_error(void *priv, void *data)
+{
+	int                                  rc = 0, idx = -1, i;
+	struct cam_req_mgr_error_notify     *err_info = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_req_queue        *in_q = NULL;
+	struct cam_req_mgr_slot             *slot = NULL;
+	struct cam_req_mgr_connected_device *device = NULL;
+	struct cam_req_mgr_link_evt_data     evt_data;
+	struct crm_task_payload             *task_data = NULL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	err_info  = (struct cam_req_mgr_error_notify *)&task_data->u;
+	CAM_DBG(CAM_CRM, "link_hdl %x req_id %lld error %d",
+		err_info->link_hdl,
+		err_info->req_id,
+		err_info->error);
+
+	in_q = link->req.in_q;
+
+	mutex_lock(&link->req.lock);
+	if (err_info->error == CRM_KMD_ERR_BUBBLE) {
+		idx = __cam_req_mgr_find_slot_for_req(in_q, err_info->req_id);
+		if (idx < 0) {
+			CAM_ERR_RATE_LIMIT(CAM_CRM,
+				"req_id %lld not found in input queue",
+				err_info->req_id);
+		} else {
+			CAM_DBG(CAM_CRM, "req_id %lld found at idx %d",
+				err_info->req_id, idx);
+			slot = &in_q->slot[idx];
+			if (!slot->recover) {
+				CAM_WARN(CAM_CRM,
+					"err recovery disabled req_id %lld",
+					err_info->req_id);
+				mutex_unlock(&link->req.lock);
+				return 0;
+			} else if (slot->status != CRM_SLOT_STATUS_REQ_PENDING
+			&& slot->status != CRM_SLOT_STATUS_REQ_APPLIED) {
+				CAM_WARN(CAM_CRM,
+					"req_id %lld can not be recovered %d",
+					err_info->req_id, slot->status);
+				mutex_unlock(&link->req.lock);
+				return -EINVAL;
+			}
+			/* Notify all devices in the link about error */
+			for (i = 0; i < link->num_devs; i++) {
+				device = &link->l_dev[i];
+				if (device != NULL) {
+					evt_data.dev_hdl = device->dev_hdl;
+					evt_data.evt_type =
+						CAM_REQ_MGR_LINK_EVT_ERR;
+					evt_data.link_hdl = link->link_hdl;
+					evt_data.req_id = err_info->req_id;
+					evt_data.u.error = err_info->error;
+					if (device->ops &&
+						device->ops->process_evt)
+						rc = device->ops->process_evt(
+							&evt_data);
+				}
+			}
+			/* Bring processing pointer to bubbled req id */
+			__cam_req_mgr_tbl_set_all_skip_cnt(&link->req.l_tbl);
+			in_q->rd_idx = idx;
+			in_q->slot[idx].status = CRM_SLOT_STATUS_REQ_ADDED;
+
+			if (link->sync_link[0]) {
+				in_q->slot[idx].sync_mode = 0;
+				__cam_req_mgr_inc_idx(&idx, 1,
+					link->req.l_tbl->num_slots);
+				in_q->slot[idx].sync_mode = 0;
+			}
+
+			/* The next req may also be applied */
+			idx = in_q->rd_idx;
+			__cam_req_mgr_inc_idx(&idx, 1,
+				link->req.l_tbl->num_slots);
+
+			if (in_q->slot[idx].status == CRM_SLOT_STATUS_REQ_APPLIED)
+				in_q->slot[idx].status = CRM_SLOT_STATUS_REQ_ADDED;
+
+			spin_lock_bh(&link->link_state_spin_lock);
+			link->state = CAM_CRM_LINK_STATE_ERR;
+			spin_unlock_bh(&link->link_state_spin_lock);
+			link->open_req_cnt++;
+			__cam_req_mgr_apply_on_bubble(link, err_info);
+		}
+	}
+	mutex_unlock(&link->req.lock);
+
+end:
+	return rc;
+}
+
+/**
+ * cam_req_mgr_process_stop()
+ *
+ * @brief: This runs in workque thread context. stop notification.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+static int cam_req_mgr_process_stop(void *priv, void *data)
+{
+	int                                  rc = 0;
+	struct cam_req_mgr_core_link        *link = NULL;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	__cam_req_mgr_flush_req_slot(link);
+end:
+	return rc;
+}
+
+/**
+ * cam_req_mgr_process_trigger()
+ *
+ * @brief: This runs in workque thread context. Call core funcs to check
+ *         which peding requests can be processed.
+ * @priv : link information.
+ * @data : contains information about frame_id, link etc.
+ *
+ * @return: 0 on success.
+ */
+static int cam_req_mgr_process_trigger(void *priv, void *data)
+{
+	int                                  rc = 0;
+	int32_t                              idx = -1;
+	struct cam_req_mgr_trigger_notify   *trigger_data = NULL;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_req_queue        *in_q = NULL;
+	struct crm_task_payload             *task_data = NULL;
+	int                                  reset_step = 0;
+	int                                  i = 0;
+
+	if (!data || !priv) {
+		CAM_ERR(CAM_CRM, "input args NULL %pK %pK", data, priv);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = (struct cam_req_mgr_core_link *)priv;
+	task_data = (struct crm_task_payload *)data;
+	trigger_data = (struct cam_req_mgr_trigger_notify *)&task_data->u;
+
+	CAM_DBG(CAM_REQ, "link_hdl %x frame_id %lld, trigger %x\n",
+		trigger_data->link_hdl,
+		trigger_data->frame_id,
+		trigger_data->trigger);
+
+	in_q = link->req.in_q;
+
+	mutex_lock(&link->req.lock);
+
+	if (trigger_data->trigger == CAM_TRIGGER_POINT_SOF) {
+		idx = __cam_req_mgr_find_slot_for_req(in_q,
+			trigger_data->req_id);
+		if (idx >= 0) {
+			if (idx == in_q->last_applied_idx)
+				in_q->last_applied_idx = -1;
+			if (idx == in_q->rd_idx)
+				__cam_req_mgr_dec_idx(&idx, 1, in_q->num_slots);
+
+			reset_step = link->max_delay;
+			for (i = 0; i < link->num_sync_links; i++) {
+				if (link->sync_link[i]) {
+					if ((link->in_msync_mode) &&
+						(link->sync_link[i]->max_delay >
+							reset_step))
+						reset_step =
+						link->sync_link[i]->max_delay;
+				}
+			}
+
+			__cam_req_mgr_dec_idx(
+				&idx, reset_step + 1,
+				in_q->num_slots);
+
+			__cam_req_mgr_reset_req_slot(link, idx);
+		}
+	}
+
+	/*
+	 * Check if current read index is in applied state, if yes make it free
+	 *    and increment read index to next slot.
+	 */
+	CAM_DBG(CAM_CRM, "link_hdl %x curent idx %d req_status %d",
+		link->link_hdl, in_q->rd_idx, in_q->slot[in_q->rd_idx].status);
+
+	spin_lock_bh(&link->link_state_spin_lock);
+
+	if (link->state < CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN(CAM_CRM, "invalid link state:%d for link 0x%x",
+			link->state, link->link_hdl);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto release_lock;
+	}
+
+	if (link->state == CAM_CRM_LINK_STATE_ERR)
+		CAM_WARN_RATE_LIMIT(CAM_CRM, "Error recovery idx %d status %d",
+			in_q->rd_idx,
+			in_q->slot[in_q->rd_idx].status);
+
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	/*
+	 * Move to next req at SOF only in case
+	 * the rd_idx is updated at EOF.
+	 */
+	if (in_q->slot[in_q->rd_idx].status == CRM_SLOT_STATUS_REQ_APPLIED) {
+		/*
+		 * Do NOT reset req q slot data here, it can not be done
+		 * here because we need to preserve the data to handle bubble.
+		 *
+		 * Check if any new req is pending in slot, if not finish the
+		 * lower pipeline delay device with available req ids.
+		 */
+		CAM_DBG(CAM_CRM, "link[%x] Req[%lld] invalidating slot",
+			link->link_hdl, in_q->slot[in_q->rd_idx].req_id);
+		rc = __cam_req_mgr_check_next_req_slot(link);
+		if (rc) {
+			CAM_DBG(CAM_REQ,
+				"No pending req to apply to lower pd devices");
+			rc = 0;
+			__cam_req_mgr_inc_idx(&in_q->rd_idx,
+				1, in_q->num_slots);
+			goto release_lock;
+		}
+		__cam_req_mgr_inc_idx(&in_q->rd_idx, 1, in_q->num_slots);
+	}
+
+	rc = __cam_req_mgr_process_req(link, trigger_data);
+
+release_lock:
+	mutex_unlock(&link->req.lock);
+end:
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_dev_handle_to_name()
+ *
+ * @brief    : Finds device name based on the device handle
+ * @dev_hdl  : Device handle whose name is to be found
+ * @link     : Link on which the device is connected
+ * @return   : String containing the device name
+ *
+ */
+static const char *__cam_req_mgr_dev_handle_to_name(
+	int32_t dev_hdl, struct cam_req_mgr_core_link *link)
+{
+	struct cam_req_mgr_connected_device *dev = NULL;
+	int i = 0;
+
+	for (i = 0; i < link->num_devs; i++) {
+		dev = &link->l_dev[i];
+
+		if (dev_hdl == dev->dev_hdl)
+			return dev->dev_info.name;
+	}
+
+	return "Invalid dev_hdl";
+}
+
+/* Linked devices' Callback section */
+
+/**
+ * cam_req_mgr_cb_add_req()
+ *
+ * @brief    : Drivers call this function to notify new packet is available.
+ * @add_req  : Information about new request available at a device.
+ *
+ * @return   : 0 on success, negative in case of failure
+ *
+ */
+static int cam_req_mgr_cb_add_req(struct cam_req_mgr_add_request *add_req)
+{
+	int                             rc = 0, idx;
+	struct crm_workq_task          *task = NULL;
+	struct cam_req_mgr_core_link   *link = NULL;
+	struct cam_req_mgr_add_request *dev_req;
+	struct crm_task_payload        *task_data;
+
+	if (!add_req) {
+		CAM_ERR(CAM_CRM, "sof_data is NULL");
+		return -EINVAL;
+	}
+
+	link = cam_get_link_priv(add_req->link_hdl);
+	if (!link) {
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", add_req->link_hdl);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_REQ,
+		"dev name %s dev_hdl %d dev req %lld, trigger_eof %d link_state %d",
+		__cam_req_mgr_dev_handle_to_name(add_req->dev_hdl, link),
+		add_req->dev_hdl, add_req->req_id, add_req->trigger_eof,
+		link->state);
+
+	mutex_lock(&link->lock);
+	/* Validate if req id is present in input queue */
+	idx = __cam_req_mgr_find_slot_for_req(link->req.in_q, add_req->req_id);
+	if (idx < 0) {
+		if (((uint32_t)add_req->req_id) <= (link->last_flush_id)) {
+			CAM_ERR(CAM_CRM,
+				"req %lld not found in in_q; it has been flushed [last_flush_req %u]",
+				add_req->req_id, link->last_flush_id);
+			rc = -EBADR;
+		} else {
+			CAM_ERR(CAM_CRM,
+				"req %lld not found in in_q",
+				add_req->req_id);
+			rc = -ENOENT;
+		}
+		goto end;
+	}
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "no empty task dev %x req %lld",
+			add_req->dev_hdl, add_req->req_id);
+		rc = -EBUSY;
+		goto end;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_DEV_ADD_REQ;
+	dev_req = (struct cam_req_mgr_add_request *)&task_data->u;
+	dev_req->req_id = add_req->req_id;
+	dev_req->link_hdl = add_req->link_hdl;
+	dev_req->dev_hdl = add_req->dev_hdl;
+	dev_req->trigger_eof = add_req->trigger_eof;
+	dev_req->skip_at_sof = add_req->skip_at_sof;
+	dev_req->skip_at_eof = add_req->skip_at_eof;
+	if (dev_req->trigger_eof) {
+		atomic_inc(&link->eof_event_cnt);
+		CAM_DBG(CAM_REQ, "Req_id: %llu, eof_event_cnt: %d",
+			dev_req->req_id, link->eof_event_cnt);
+	}
+
+	task->process_cb = &cam_req_mgr_process_add_req;
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+	CAM_DBG(CAM_CRM, "X: dev %x dev req %lld",
+		add_req->dev_hdl, add_req->req_id);
+
+end:
+	mutex_unlock(&link->lock);
+	return rc;
+}
+
+/**
+ * cam_req_mgr_cb_notify_err()
+ *
+ * @brief    : Error received from device, sends bubble recovery
+ * @err_info : contains information about error occurred like bubble/overflow
+ *
+ * @return   : 0 on success, negative in case of failure
+ *
+ */
+static int cam_req_mgr_cb_notify_err(
+	struct cam_req_mgr_error_notify *err_info)
+{
+	int                              rc = 0;
+	struct crm_workq_task           *task = NULL;
+	struct cam_req_mgr_core_link    *link = NULL;
+	struct cam_req_mgr_error_notify *notify_err;
+	struct crm_task_payload         *task_data;
+
+	if (!err_info) {
+		CAM_ERR(CAM_CRM, "err_info is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = cam_get_link_priv(err_info->link_hdl);
+	if (!link) {
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", err_info->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state != CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN(CAM_CRM, "invalid link state:%d", link->state);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto end;
+	}
+	crm_timer_reset(link->watchdog);
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR(CAM_CRM, "no empty task req_id %lld", err_info->req_id);
+		rc = -EBUSY;
+		goto end;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_NOTIFY_ERR;
+	notify_err = (struct cam_req_mgr_error_notify *)&task_data->u;
+	notify_err->req_id = err_info->req_id;
+	notify_err->link_hdl = err_info->link_hdl;
+	notify_err->dev_hdl = err_info->dev_hdl;
+	notify_err->error = err_info->error;
+	notify_err->trigger = err_info->trigger;
+	task->process_cb = &cam_req_mgr_process_error;
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+
+end:
+	return rc;
+}
+
+static int __cam_req_mgr_check_for_dual_trigger(
+	struct cam_req_mgr_core_link    *link,
+	uint32_t                         trigger)
+{
+	int rc  = -EAGAIN;
+
+	CAM_DBG(CAM_CRM, "%s trigger_cnt [%u: %u]",
+		(trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF",
+		link->trigger_cnt[0][trigger], link->trigger_cnt[1][trigger]);
+
+	if (link->trigger_cnt[0][trigger] == link->trigger_cnt[1][trigger]) {
+		link->trigger_cnt[0][trigger] = 0;
+		link->trigger_cnt[1][trigger] = 0;
+		rc = 0;
+		return rc;
+	}
+
+	if ((link->trigger_cnt[0][trigger] &&
+		(link->trigger_cnt[0][trigger] - link->trigger_cnt[1][trigger] > 1)) ||
+		(link->trigger_cnt[1][trigger] &&
+		(link->trigger_cnt[1][trigger] - link->trigger_cnt[0][trigger] > 1))) {
+
+		CAM_WARN(CAM_CRM,
+			"One of the devices could not generate trigger");
+
+		link->trigger_cnt[0][trigger] = 0;
+		link->trigger_cnt[1][trigger] = 0;
+		CAM_DBG(CAM_CRM, "Reset the trigger cnt");
+		return rc;
+	}
+
+	CAM_DBG(CAM_CRM, "Only one device has generated trigger for %s",
+		(trigger == CAM_TRIGGER_POINT_SOF) ? "SOF" : "EOF");
+
+	return rc;
+}
+
+/**
+ * cam_req_mgr_cb_notify_timer()
+ *
+ * @brief      : Notify SOF timer to pause after flush
+ * @timer_data : contains information about frame_id, link etc.
+ *
+ * @return  : 0 on success
+ *
+ */
+static int cam_req_mgr_cb_notify_timer(
+	struct cam_req_mgr_timer_notify *timer_data)
+{
+	int                              rc = 0;
+	struct cam_req_mgr_core_link    *link = NULL;
+
+	if (!timer_data) {
+		CAM_ERR(CAM_CRM, "timer data  is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = cam_get_link_priv(timer_data->link_hdl);
+	if (!link) {
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", timer_data->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state < CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN(CAM_CRM, "invalid link state:%d", link->state);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto end;
+	}
+	if (link->watchdog) {
+		if (!timer_data->state)
+			link->watchdog->pause_timer = true;
+		else
+			link->watchdog->pause_timer = false;
+		crm_timer_reset(link->watchdog);
+		CAM_DBG(CAM_CRM, "link %x pause_timer %d",
+			link->link_hdl, link->watchdog->pause_timer);
+	}
+
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+end:
+	return rc;
+}
+
+/*
+ * cam_req_mgr_cb_notify_stop()
+ *
+ * @brief    : Stop received from device, resets the morked slots
+ * @err_info : contains information about error occurred like bubble/overflow
+ *
+ * @return   : 0 on success, negative in case of failure
+ *
+ */
+static int cam_req_mgr_cb_notify_stop(
+	struct cam_req_mgr_notify_stop *stop_info)
+{
+	int                              rc = 0;
+	struct crm_workq_task           *task = NULL;
+	struct cam_req_mgr_core_link    *link = NULL;
+	struct cam_req_mgr_notify_stop  *notify_stop;
+	struct crm_task_payload         *task_data;
+
+	if (!stop_info) {
+		CAM_ERR(CAM_CRM, "stop_info is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = cam_get_link_priv(stop_info->link_hdl);
+	if (!link) {
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", stop_info->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state != CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN(CAM_CRM, "invalid link state:%d", link->state);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto end;
+	}
+	crm_timer_reset(link->watchdog);
+	link->watchdog->pause_timer = true;
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR(CAM_CRM, "no empty task");
+		rc = -EBUSY;
+		goto end;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_NOTIFY_ERR;
+	notify_stop = (struct cam_req_mgr_notify_stop *)&task_data->u;
+	notify_stop->link_hdl = stop_info->link_hdl;
+	task->process_cb = &cam_req_mgr_process_stop;
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+
+end:
+	return rc;
+}
+
+
+
+/**
+ * cam_req_mgr_cb_notify_trigger()
+ *
+ * @brief   : SOF received from device, sends trigger through workqueue
+ * @sof_data: contains information about frame_id, link etc.
+ *
+ * @return  : 0 on success
+ *
+ */
+static int cam_req_mgr_cb_notify_trigger(
+	struct cam_req_mgr_trigger_notify *trigger_data)
+{
+	int32_t                          rc = 0, trigger_id = 0;
+	uint32_t                         trigger;
+	struct crm_workq_task           *task = NULL;
+	struct cam_req_mgr_core_link    *link = NULL;
+	struct cam_req_mgr_trigger_notify   *notify_trigger;
+	struct crm_task_payload         *task_data;
+
+	if (!trigger_data) {
+		CAM_ERR(CAM_CRM, "trigger_data is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	link = cam_get_link_priv(trigger_data->link_hdl);
+	if (!link) {
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", trigger_data->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_REQ, "link_hdl %x frame_id %lld, trigger %x\n",
+		trigger_data->link_hdl,
+		trigger_data->frame_id,
+		trigger_data->trigger);
+
+	trigger_id = trigger_data->trigger_id;
+	trigger = trigger_data->trigger;
+
+	/*
+	 * Reduce the workq overhead when there is
+	 * not any eof event found.
+	 */
+	if ((!atomic_read(&link->eof_event_cnt)) &&
+		(trigger == CAM_TRIGGER_POINT_EOF)) {
+		CAM_DBG(CAM_CRM, "Not any request to schedule at EOF");
+		goto end;
+	}
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	if (link->state < CAM_CRM_LINK_STATE_READY) {
+		CAM_WARN(CAM_CRM, "invalid link state:%d", link->state);
+		spin_unlock_bh(&link->link_state_spin_lock);
+		rc = -EPERM;
+		goto end;
+	}
+
+	if ((link->watchdog) && (link->watchdog->pause_timer) &&
+		(trigger == CAM_TRIGGER_POINT_SOF))
+		link->watchdog->pause_timer = false;
+
+	if (link->dual_trigger) {
+		if ((trigger_id >= 0) && (trigger_id <
+			CAM_REQ_MGR_MAX_TRIGGERS)) {
+			link->trigger_cnt[trigger_id][trigger]++;
+			rc = __cam_req_mgr_check_for_dual_trigger(link, trigger);
+			if (rc) {
+				spin_unlock_bh(&link->link_state_spin_lock);
+				goto end;
+			}
+		} else {
+			CAM_ERR(CAM_CRM, "trigger_id invalid %d", trigger_id);
+			rc = -EINVAL;
+			spin_unlock_bh(&link->link_state_spin_lock);
+			goto end;
+		}
+	}
+
+	if (trigger_data->trigger == CAM_TRIGGER_POINT_SOF)
+		crm_timer_reset(link->watchdog);
+
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "no empty task frame %lld",
+			trigger_data->frame_id);
+		rc = -EBUSY;
+		spin_lock_bh(&link->link_state_spin_lock);
+		if ((link->watchdog) && !(link->watchdog->pause_timer))
+			link->watchdog->pause_timer = true;
+		spin_unlock_bh(&link->link_state_spin_lock);
+		goto end;
+	}
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = (trigger_data->trigger == CAM_TRIGGER_POINT_SOF) ?
+		CRM_WORKQ_TASK_NOTIFY_SOF : CRM_WORKQ_TASK_NOTIFY_EOF;
+	notify_trigger = (struct cam_req_mgr_trigger_notify *)&task_data->u;
+	notify_trigger->frame_id = trigger_data->frame_id;
+	notify_trigger->link_hdl = trigger_data->link_hdl;
+	notify_trigger->dev_hdl = trigger_data->dev_hdl;
+	notify_trigger->trigger = trigger_data->trigger;
+	notify_trigger->req_id = trigger_data->req_id;
+	notify_trigger->sof_timestamp_val = trigger_data->sof_timestamp_val;
+	task->process_cb = &cam_req_mgr_process_trigger;
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+
+end:
+	return rc;
+}
+
+static struct cam_req_mgr_crm_cb cam_req_mgr_ops = {
+	.notify_trigger = cam_req_mgr_cb_notify_trigger,
+	.notify_err     = cam_req_mgr_cb_notify_err,
+	.add_req        = cam_req_mgr_cb_add_req,
+	.notify_timer   = cam_req_mgr_cb_notify_timer,
+	.notify_stop    = cam_req_mgr_cb_notify_stop,
+};
+
+/**
+ * __cam_req_mgr_setup_link_info()
+ *
+ * @brief     : Sets up input queue, create pd based tables, communicate with
+ *              devs connected on this link and setup communication.
+ * @link      : pointer to link to setup
+ * @link_info : link_info coming from CSL to prepare link
+ *
+ * @return    : 0 on success, negative in case of failure
+ *
+ */
+static int __cam_req_mgr_setup_link_info(struct cam_req_mgr_core_link *link,
+	struct cam_req_mgr_ver_info *link_info)
+{
+	int                                     rc = 0, i = 0, num_devices = 0;
+	struct cam_req_mgr_core_dev_link_setup  link_data;
+	struct cam_req_mgr_connected_device    *dev;
+	struct cam_req_mgr_req_tbl             *pd_tbl;
+	enum cam_pipeline_delay                 max_delay;
+	uint32_t num_trigger_devices = 0;
+	if (link_info->version == VERSION_1) {
+		if (link_info->u.link_info_v1.num_devices >
+			CAM_REQ_MGR_MAX_HANDLES)
+			return -EPERM;
+	} else if (link_info->version == VERSION_2) {
+		if (link_info->u.link_info_v2.num_devices >
+			CAM_REQ_MGR_MAX_HANDLES_V2)
+			return -EPERM;
+	}
+
+	mutex_init(&link->req.lock);
+	CAM_DBG(CAM_CRM, "LOCK_DBG in_q lock %pK", &link->req.lock);
+	link->req.num_tbl = 0;
+
+	rc = __cam_req_mgr_setup_in_q(&link->req);
+	if (rc < 0)
+		return rc;
+
+	max_delay = CAM_PIPELINE_DELAY_0;
+	if (link_info->version == VERSION_1)
+		num_devices = link_info->u.link_info_v1.num_devices;
+	else if (link_info->version == VERSION_2)
+		num_devices = link_info->u.link_info_v2.num_devices;
+	for (i = 0; i < num_devices; i++) {
+		dev = &link->l_dev[i];
+		/* Using dev hdl, get ops ptr to communicate with device */
+		if (link_info->version == VERSION_1)
+			dev->ops = (struct cam_req_mgr_kmd_ops *)
+					cam_get_device_ops(
+					link_info->u.link_info_v1.dev_hdls[i]);
+		else if (link_info->version == VERSION_2)
+			dev->ops = (struct cam_req_mgr_kmd_ops *)
+					cam_get_device_ops(
+					link_info->u.link_info_v2.dev_hdls[i]);
+		if (!dev->ops ||
+			!dev->ops->get_dev_info ||
+			!dev->ops->link_setup) {
+			CAM_ERR(CAM_CRM, "FATAL: device ops NULL");
+			rc = -ENXIO;
+			goto error;
+		}
+		if (link_info->version == VERSION_1)
+			dev->dev_hdl = link_info->u.link_info_v1.dev_hdls[i];
+		else if (link_info->version == VERSION_2)
+			dev->dev_hdl = link_info->u.link_info_v2.dev_hdls[i];
+		dev->parent = (void *)link;
+		dev->dev_info.dev_hdl = dev->dev_hdl;
+		rc = dev->ops->get_dev_info(&dev->dev_info);
+
+		trace_cam_req_mgr_connect_device(link, &dev->dev_info);
+		if (link_info->version == VERSION_1)
+			CAM_DBG(CAM_CRM,
+				"%x: connected: %s, id %d, delay %d, trigger %x",
+				link_info->u.link_info_v1.session_hdl,
+				dev->dev_info.name,
+				dev->dev_info.dev_id, dev->dev_info.p_delay,
+				dev->dev_info.trigger);
+		else if (link_info->version == VERSION_2)
+			CAM_DBG(CAM_CRM,
+				"%x: connected: %s, id %d, delay %d, trigger %x",
+				link_info->u.link_info_v2.session_hdl,
+				dev->dev_info.name,
+				dev->dev_info.dev_id, dev->dev_info.p_delay,
+				dev->dev_info.trigger);
+		if (rc < 0 ||
+			dev->dev_info.p_delay >=
+			CAM_PIPELINE_DELAY_MAX ||
+			dev->dev_info.p_delay <
+			CAM_PIPELINE_DELAY_0) {
+			CAM_ERR(CAM_CRM, "get device info failed");
+			goto error;
+		} else {
+			if (link_info->version == VERSION_1) {
+				CAM_DBG(CAM_CRM, "%x: connected: %s, delay %d",
+					link_info->u.link_info_v1.session_hdl,
+					dev->dev_info.name,
+					dev->dev_info.p_delay);
+				}
+			else if (link_info->version == VERSION_2) {
+				CAM_DBG(CAM_CRM, "%x: connected: %s, delay %d",
+					link_info->u.link_info_v2.session_hdl,
+					dev->dev_info.name,
+					dev->dev_info.p_delay);
+				}
+			if (dev->dev_info.p_delay > max_delay)
+				max_delay = dev->dev_info.p_delay;
+		}
+
+		if (dev->dev_info.trigger_on)
+			num_trigger_devices++;
+	}
+
+	if (num_trigger_devices > CAM_REQ_MGR_MAX_TRIGGERS) {
+		CAM_ERR(CAM_CRM,
+			"Unsupported number of trigger devices %u",
+			num_trigger_devices);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	link_data.link_enable = 1;
+	link_data.link_hdl = link->link_hdl;
+	link_data.crm_cb = &cam_req_mgr_ops;
+	link_data.max_delay = max_delay;
+	if (num_trigger_devices == CAM_REQ_MGR_MAX_TRIGGERS)
+		link->dual_trigger = true;
+
+	num_trigger_devices = 0;
+	for (i = 0; i < num_devices; i++) {
+		dev = &link->l_dev[i];
+
+		link_data.dev_hdl = dev->dev_hdl;
+		/*
+		 * For unique pipeline delay table create request
+		 * tracking table
+		 */
+		if (link->pd_mask & (1 << dev->dev_info.p_delay)) {
+			pd_tbl = __cam_req_mgr_find_pd_tbl(link->req.l_tbl,
+				dev->dev_info.p_delay);
+			if (!pd_tbl) {
+				CAM_ERR(CAM_CRM, "pd %d tbl not found",
+					dev->dev_info.p_delay);
+				rc = -ENXIO;
+				goto error;
+			}
+		} else {
+			pd_tbl = __cam_req_mgr_create_pd_tbl(
+				dev->dev_info.p_delay);
+			if (pd_tbl == NULL) {
+				CAM_ERR(CAM_CRM, "create new pd tbl failed");
+				rc = -ENXIO;
+				goto error;
+			}
+			pd_tbl->pd = dev->dev_info.p_delay;
+			link->pd_mask |= (1 << pd_tbl->pd);
+			/*
+			 * Add table to list and also sort list
+			 * from max pd to lowest
+			 */
+			__cam_req_mgr_add_tbl_to_link(&link->req.l_tbl, pd_tbl);
+		}
+		dev->dev_bit = pd_tbl->dev_count++;
+		dev->pd_tbl = pd_tbl;
+		pd_tbl->dev_mask |= (1 << dev->dev_bit);
+		CAM_DBG(CAM_CRM, "dev_bit %u name %s pd %u mask %d",
+			dev->dev_bit, dev->dev_info.name, pd_tbl->pd,
+			pd_tbl->dev_mask);
+		link_data.trigger_id = -1;
+		if ((dev->dev_info.trigger_on) && (link->dual_trigger)) {
+			link_data.trigger_id = num_trigger_devices;
+			num_trigger_devices++;
+		}
+
+		/* Communicate with dev to establish the link */
+		dev->ops->link_setup(&link_data);
+
+		if (link->max_delay < dev->dev_info.p_delay)
+			link->max_delay = dev->dev_info.p_delay;
+	}
+	link->num_devs = num_devices;
+
+	/* Assign id for pd tables */
+	__cam_req_mgr_tbl_set_id(link->req.l_tbl, &link->req);
+
+	/* At start, expect max pd devices, all are in skip state */
+	__cam_req_mgr_tbl_set_all_skip_cnt(&link->req.l_tbl);
+
+	return 0;
+
+error:
+	__cam_req_mgr_destroy_link_info(link);
+	return rc;
+}
+
+/* IOCTLs handling section */
+int cam_req_mgr_create_session(
+	struct cam_req_mgr_session_info *ses_info)
+{
+	int                              rc = 0;
+	int32_t                          session_hdl;
+	struct cam_req_mgr_core_session *cam_session = NULL;
+
+	if (!ses_info) {
+		CAM_DBG(CAM_CRM, "NULL session info pointer");
+		return -EINVAL;
+	}
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	cam_session = kzalloc(sizeof(*cam_session),
+		GFP_KERNEL);
+	if (!cam_session) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	session_hdl = cam_create_session_hdl((void *)cam_session);
+	if (session_hdl < 0) {
+		CAM_ERR(CAM_CRM, "unable to create session_hdl = %x",
+			session_hdl);
+		rc = session_hdl;
+		kfree(cam_session);
+		goto end;
+	}
+	ses_info->session_hdl = session_hdl;
+
+	mutex_init(&cam_session->lock);
+	CAM_DBG(CAM_CRM, "LOCK_DBG session lock %pK hdl 0x%x",
+		&cam_session->lock, session_hdl);
+
+	mutex_lock(&cam_session->lock);
+	cam_session->session_hdl = session_hdl;
+	cam_session->num_links = 0;
+	cam_session->sync_mode = CAM_REQ_MGR_SYNC_MODE_NO_SYNC;
+	list_add(&cam_session->entry, &g_crm_core_dev->session_head);
+	mutex_unlock(&cam_session->lock);
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+/**
+ * __cam_req_mgr_unlink()
+ *
+ * @brief  : Unlink devices on a link structure from the session
+ *           This API is to be invoked with session mutex held
+ * @session: session of the link
+ * @link   : Pointer to the link structure
+ *
+ * @return: 0 for success, negative for failure
+ *
+ */
+static int __cam_req_mgr_unlink(
+	struct cam_req_mgr_core_session *session,
+	struct cam_req_mgr_core_link *link)
+{
+	int rc;
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	link->state = CAM_CRM_LINK_STATE_IDLE;
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	if (!link->is_shutdown) {
+		rc = __cam_req_mgr_disconnect_link(link);
+		if (rc)
+			CAM_ERR(CAM_CORE,
+				"Unlink for all devices was not successful");
+	}
+
+	mutex_lock(&link->lock);
+	spin_lock_bh(&link->link_state_spin_lock);
+	/* Destroy timer of link */
+	crm_timer_exit(&link->watchdog);
+	spin_unlock_bh(&link->link_state_spin_lock);
+	/* Release session mutex for workq processing */
+	mutex_unlock(&session->lock);
+	/* Destroy workq of link */
+	cam_req_mgr_workq_destroy(&link->workq);
+	/* Acquire session mutex after workq flush */
+	mutex_lock(&session->lock);
+	/* Cleanup request tables and unlink devices */
+	__cam_req_mgr_destroy_link_info(link);
+	/* Free memory holding data of linked devs */
+
+	__cam_req_mgr_destroy_subdev(&link->l_dev);
+
+	/* Destroy the link handle */
+	rc = cam_destroy_link_hdl(link->link_hdl);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM, "error destroying link hdl %x rc %d",
+			link->link_hdl, rc);
+	} else
+		link->link_hdl = -1;
+
+	mutex_unlock(&link->lock);
+	return rc;
+}
+
+int cam_req_mgr_destroy_session(
+		struct cam_req_mgr_session_info *ses_info,
+		bool is_shutdown)
+{
+	int rc;
+	int i;
+	struct cam_req_mgr_core_session *cam_session = NULL;
+	struct cam_req_mgr_core_link *link;
+
+	if (!ses_info) {
+		CAM_DBG(CAM_CRM, "NULL session info pointer");
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	cam_session = cam_get_session_priv(ses_info->session_hdl);
+	if (!cam_session || (cam_session->session_hdl != ses_info->session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, ses_info->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), ses_info->session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		rc = -ENOENT;
+		goto end;
+
+	}
+
+	mutex_lock(&cam_session->lock);
+	if (cam_session->num_links) {
+		CAM_DBG(CAM_CRM, "destroy session %x num_active_links %d",
+			ses_info->session_hdl,
+			cam_session->num_links);
+
+		for (i = 0; i < MAXIMUM_LINKS_PER_SESSION; i++) {
+			link = cam_session->links[i];
+			if (!link)
+				continue;
+
+			CAM_DBG(CAM_CRM, "Unlink link hdl 0x%x",
+				link->link_hdl);
+			/* Ignore return value since session is going away */
+			link->is_shutdown = is_shutdown;
+			__cam_req_mgr_unlink(cam_session, link);
+			__cam_req_mgr_free_link(link);
+		}
+	}
+	list_del(&cam_session->entry);
+	mutex_unlock(&cam_session->lock);
+	mutex_destroy(&cam_session->lock);
+
+	kfree(cam_session);
+
+	rc = cam_destroy_session_hdl(ses_info->session_hdl);
+	if (rc < 0)
+		CAM_ERR(CAM_CRM, "unable to destroy session_hdl = %x rc %d",
+			ses_info->session_hdl, rc);
+
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+static void cam_req_mgr_process_workq_link_worker(struct work_struct *w)
+{
+	cam_req_mgr_process_workq(w);
+}
+
+int cam_req_mgr_link(struct cam_req_mgr_ver_info *link_info)
+{
+	int                                     rc = 0;
+	int                                     wq_flag = 0;
+	char                                    buf[128];
+	struct cam_create_dev_hdl               root_dev;
+	struct cam_req_mgr_core_session        *cam_session;
+	struct cam_req_mgr_core_link           *link;
+
+	if (!link_info) {
+		CAM_DBG(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+	if (link_info->u.link_info_v1.num_devices > CAM_REQ_MGR_MAX_HANDLES) {
+		CAM_ERR(CAM_CRM, "Invalid num devices %d",
+			link_info->u.link_info_v1.num_devices);
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+
+	/* session hdl's priv data is cam session struct */
+	cam_session = cam_get_session_priv(link_info->u.link_info_v1.session_hdl);
+	if (!cam_session || (cam_session->session_hdl != link_info->u.link_info_v1.session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, link_info->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), link_info->u.link_info_v1.session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+
+	/* Allocate link struct and map it with session's request queue */
+	link = __cam_req_mgr_reserve_link(cam_session);
+	if (!link) {
+		CAM_ERR(CAM_CRM, "failed to reserve new link");
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_CRM, "link reserved %pK %x", link, link->link_hdl);
+
+	memset(&root_dev, 0, sizeof(struct cam_create_dev_hdl));
+	root_dev.session_hdl = link_info->u.link_info_v1.session_hdl;
+	root_dev.priv = (void *)link;
+	root_dev.dev_id = CAM_CRM;
+	mutex_lock(&link->lock);
+	/* Create unique handle for link */
+	link->link_hdl = cam_create_link_hdl(&root_dev);
+	if (link->link_hdl < 0) {
+		CAM_ERR(CAM_CRM,
+			"Insufficient memory to create new device handle");
+		rc = link->link_hdl;
+		goto link_hdl_fail;
+	}
+	link_info->u.link_info_v1.link_hdl = link->link_hdl;
+	link->last_flush_id = 0;
+
+	/* Allocate memory to hold data of all linked devs */
+	rc = __cam_req_mgr_create_subdevs(&link->l_dev,
+		link_info->u.link_info_v1.num_devices);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM,
+			"Insufficient memory to create new crm subdevs");
+		goto create_subdev_failed;
+	}
+
+	/* Using device ops query connected devs, prepare request tables */
+	rc = __cam_req_mgr_setup_link_info(link, link_info);
+	if (rc < 0)
+		goto setup_failed;
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	link->state = CAM_CRM_LINK_STATE_READY;
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	/* Create worker for current link */
+	snprintf(buf, sizeof(buf), "%x-%x",
+		link_info->u.link_info_v1.session_hdl, link->link_hdl);
+	wq_flag = CAM_WORKQ_FLAG_HIGH_PRIORITY | CAM_WORKQ_FLAG_SERIAL;
+	rc = cam_req_mgr_workq_create(buf, CRM_WORKQ_NUM_TASKS,
+		&link->workq, CRM_WORKQ_USAGE_NON_IRQ, wq_flag,
+		cam_req_mgr_process_workq_link_worker);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM, "FATAL: unable to create worker");
+		__cam_req_mgr_destroy_link_info(link);
+		goto setup_failed;
+	}
+
+	/* Assign payload to workqueue tasks */
+	rc = __cam_req_mgr_setup_payload(link->workq);
+	if (rc < 0) {
+		__cam_req_mgr_destroy_link_info(link);
+		cam_req_mgr_workq_destroy(&link->workq);
+		goto setup_failed;
+	}
+
+	mutex_unlock(&link->lock);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+setup_failed:
+	__cam_req_mgr_destroy_subdev(&link->l_dev);
+create_subdev_failed:
+	cam_destroy_link_hdl(link->link_hdl);
+	link_info->u.link_info_v1.link_hdl = -1;
+link_hdl_fail:
+	mutex_unlock(&link->lock);
+	__cam_req_mgr_unreserve_link(cam_session, link);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_link_v2(struct cam_req_mgr_ver_info *link_info)
+{
+	int                                     rc = 0;
+	int                                     wq_flag = 0;
+	char                                    buf[128];
+	struct cam_create_dev_hdl               root_dev;
+	struct cam_req_mgr_core_session        *cam_session;
+	struct cam_req_mgr_core_link           *link;
+
+	if (!link_info) {
+		CAM_DBG(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+	if (link_info->u.link_info_v2.num_devices >
+		CAM_REQ_MGR_MAX_HANDLES_V2) {
+		CAM_ERR(CAM_CRM, "Invalid num devices %d",
+			link_info->u.link_info_v2.num_devices);
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+
+	/* session hdl's priv data is cam session struct */
+	cam_session = cam_get_session_priv(link_info->u.link_info_v2.session_hdl);
+	if (!cam_session || (cam_session->session_hdl != link_info->u.link_info_v2.session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, link_info->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), link_info->u.link_info_v2.session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+
+	/* Allocate link struct and map it with session's request queue */
+	link = __cam_req_mgr_reserve_link(cam_session);
+	if (!link) {
+		CAM_ERR(CAM_CRM, "failed to reserve new link");
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_CRM, "link reserved %pK %x", link, link->link_hdl);
+
+	memset(&root_dev, 0, sizeof(struct cam_create_dev_hdl));
+	root_dev.session_hdl = link_info->u.link_info_v2.session_hdl;
+	root_dev.priv = (void *)link;
+	root_dev.dev_id = CAM_CRM;
+
+	mutex_lock(&link->lock);
+	/* Create unique handle for link */
+	link->link_hdl = cam_create_link_hdl(&root_dev);
+	if (link->link_hdl < 0) {
+		CAM_ERR(CAM_CRM,
+			"Insufficient memory to create new device handle");
+		rc = link->link_hdl;
+		goto link_hdl_fail;
+	}
+	link_info->u.link_info_v2.link_hdl = link->link_hdl;
+	link->last_flush_id = 0;
+
+	/* Allocate memory to hold data of all linked devs */
+	rc = __cam_req_mgr_create_subdevs(&link->l_dev,
+		link_info->u.link_info_v2.num_devices);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM,
+			"Insufficient memory to create new crm subdevs");
+		goto create_subdev_failed;
+	}
+
+	/* Using device ops query connected devs, prepare request tables */
+	rc = __cam_req_mgr_setup_link_info(link, link_info);
+	if (rc < 0)
+		goto setup_failed;
+
+	spin_lock_bh(&link->link_state_spin_lock);
+	link->state = CAM_CRM_LINK_STATE_READY;
+	spin_unlock_bh(&link->link_state_spin_lock);
+
+	/* Create worker for current link */
+	snprintf(buf, sizeof(buf), "%x-%x",
+		link_info->u.link_info_v2.session_hdl, link->link_hdl);
+	wq_flag = CAM_WORKQ_FLAG_HIGH_PRIORITY | CAM_WORKQ_FLAG_SERIAL;
+	rc = cam_req_mgr_workq_create(buf, CRM_WORKQ_NUM_TASKS,
+		&link->workq, CRM_WORKQ_USAGE_NON_IRQ, wq_flag,
+		cam_req_mgr_process_workq_link_worker);
+	if (rc < 0) {
+		CAM_ERR(CAM_CRM, "FATAL: unable to create worker");
+		__cam_req_mgr_destroy_link_info(link);
+		goto setup_failed;
+	}
+
+	/* Assign payload to workqueue tasks */
+	rc = __cam_req_mgr_setup_payload(link->workq);
+	if (rc < 0) {
+		__cam_req_mgr_destroy_link_info(link);
+		cam_req_mgr_workq_destroy(&link->workq);
+		goto setup_failed;
+	}
+
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[0][CAM_TRIGGER_POINT_EOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_SOF] = 0;
+	link->trigger_cnt[1][CAM_TRIGGER_POINT_EOF] = 0;
+
+	mutex_unlock(&link->lock);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+setup_failed:
+	__cam_req_mgr_destroy_subdev(&link->l_dev);
+create_subdev_failed:
+	cam_destroy_link_hdl(link->link_hdl);
+	link_info->u.link_info_v2.link_hdl = -1;
+link_hdl_fail:
+	mutex_unlock(&link->lock);
+	__cam_req_mgr_unreserve_link(cam_session, link);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+
+int cam_req_mgr_unlink(struct cam_req_mgr_unlink_info *unlink_info)
+{
+	int                              rc = 0;
+	struct cam_req_mgr_core_session *cam_session;
+	struct cam_req_mgr_core_link    *link;
+
+	if (!unlink_info) {
+		CAM_ERR(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	CAM_DBG(CAM_CRM, "link_hdl %x", unlink_info->link_hdl);
+
+	/* session hdl's priv data is cam session struct */
+	cam_session = cam_get_session_priv(unlink_info->session_hdl);
+	if (!cam_session || (cam_session->session_hdl != unlink_info->session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, unlink_info->ses_hdl:%x, cam_session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), unlink_info->session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+
+	/* link hdl's priv data is core_link struct */
+	link = cam_get_link_priv(unlink_info->link_hdl);
+	if (!link || (link->link_hdl != unlink_info->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, unlink_info->link_hdl:%x, link->link_hdl:%x",
+			CAM_IS_NULL_TO_STR(link), unlink_info->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto done;
+	}
+	mutex_lock(&cam_session->lock);
+	rc = __cam_req_mgr_unlink(cam_session, link);
+	mutex_unlock(&cam_session->lock);
+
+	/* Free curent link and put back into session's free pool of links */
+	__cam_req_mgr_unreserve_link(cam_session, link);
+
+done:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_schedule_request(
+			struct cam_req_mgr_sched_request *sched_req)
+{
+	int                               rc = 0;
+	struct cam_req_mgr_core_link     *link = NULL;
+	struct cam_req_mgr_core_session  *session = NULL;
+	struct cam_req_mgr_sched_request *sched;
+	struct crm_task_payload           task_data;
+
+	if (!sched_req) {
+		CAM_ERR(CAM_CRM, "csl_req is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	link = cam_get_link_priv(sched_req->link_hdl);
+	if (!link || (link->link_hdl != sched_req->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, sched_req->link_hdl:%x, link->link_hdl:%x",
+			CAM_IS_NULL_TO_STR(link), sched_req->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	session = (struct cam_req_mgr_core_session *)link->parent;
+	if (!session) {
+		CAM_WARN(CAM_CRM, "session ptr NULL %x", sched_req->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (sched_req->req_id <= link->last_flush_id) {
+		CAM_INFO(CAM_CRM,
+			"request %lld is flushed, last_flush_id to flush %d",
+			sched_req->req_id, link->last_flush_id);
+		rc = -EBADR;
+		goto end;
+	}
+
+	if (sched_req->req_id > link->last_flush_id)
+		link->last_flush_id = 0;
+
+	CAM_DBG(CAM_CRM, "link 0x%x req %lld, sync_mode %d",
+		sched_req->link_hdl, sched_req->req_id, sched_req->sync_mode);
+
+	task_data.type = CRM_WORKQ_TASK_SCHED_REQ;
+	sched = (struct cam_req_mgr_sched_request *)&task_data.u;
+	sched->req_id = sched_req->req_id;
+	sched->sync_mode = sched_req->sync_mode;
+	sched->link_hdl = sched_req->link_hdl;
+	sched->additional_timeout = sched_req->additional_timeout;
+	if (session->force_err_recovery == AUTO_RECOVERY) {
+		sched->bubble_enable = sched_req->bubble_enable;
+	} else {
+		sched->bubble_enable =
+		(session->force_err_recovery == FORCE_ENABLE_RECOVERY) ? 1 : 0;
+	}
+
+	rc = cam_req_mgr_process_sched_req(link, &task_data);
+
+	CAM_DBG(CAM_REQ, "Open req %lld on link 0x%x with sync_mode %d",
+		sched_req->req_id, sched_req->link_hdl, sched_req->sync_mode);
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_sync_config(
+	struct cam_req_mgr_sync_mode *sync_info)
+{
+	int                              i, j, rc = 0;
+	int                              sync_idx = 0;
+	struct cam_req_mgr_core_session *cam_session;
+	struct cam_req_mgr_core_link    *link[MAX_LINKS_PER_SESSION];
+
+	if (!sync_info) {
+		CAM_ERR(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+
+	if ((sync_info->num_links < 0) ||
+		(sync_info->num_links >
+		MAX_LINKS_PER_SESSION)) {
+		CAM_ERR(CAM_CRM, "Invalid num links %d", sync_info->num_links);
+		return -EINVAL;
+	}
+
+	if ((sync_info->sync_mode != CAM_REQ_MGR_SYNC_MODE_SYNC) &&
+		(sync_info->sync_mode != CAM_REQ_MGR_SYNC_MODE_NO_SYNC)) {
+		CAM_ERR(CAM_CRM, "Invalid sync mode %d", sync_info->sync_mode);
+		return -EINVAL;
+	}
+
+	if ((!sync_info->link_hdls[0]) || (!sync_info->link_hdls[1])) {
+		CAM_WARN(CAM_CRM, "Invalid link handles 0x%x 0x%x",
+			sync_info->link_hdls[0], sync_info->link_hdls[1]);
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	/* session hdl's priv data is cam session struct */
+	cam_session = cam_get_session_priv(sync_info->session_hdl);
+	if (!cam_session || (cam_session->session_hdl != sync_info->session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, sync_info->session_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(cam_session), sync_info->session_hdl,
+			(!cam_session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : cam_session->session_hdl);
+		mutex_unlock(&g_crm_core_dev->crm_lock);
+		return -EINVAL;
+	}
+
+	mutex_lock(&cam_session->lock);
+
+	for (i = 0; i < sync_info->num_links; i++) {
+
+		if (!sync_info->link_hdls[i]) {
+			CAM_ERR(CAM_CRM, "link handle %d is null", i);
+			rc = -EINVAL;
+			goto done;
+		}
+
+		link[i] = cam_get_link_priv(sync_info->link_hdls[i]);
+		if (!link[i] || (link[i]->link_hdl != sync_info->link_hdls[i])) {
+			CAM_ERR(CAM_CRM, "link: %s, sync_info->link_hdl:%x, link->link_hdl:%x",
+				CAM_IS_NULL_TO_STR(link[i]), sync_info->link_hdls[i],
+				(!link[i]) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link[i]->link_hdl);
+			rc = -EINVAL;
+			goto done;
+		}
+
+		link[i]->sync_link_sof_skip = false;
+		link[i]->is_master = false;
+		link[i]->in_msync_mode = false;
+		link[i]->initial_sync_req = -1;
+		link[i]->num_sync_links = 0;
+
+		for (j = 0; j < sync_info->num_links-1; j++)
+			link[i]->sync_link[j] = NULL;
+	}
+
+	if (sync_info->sync_mode == CAM_REQ_MGR_SYNC_MODE_SYNC) {
+		for (i = 0; i < sync_info->num_links; i++) {
+			j = 0;
+			sync_idx = 0;
+			CAM_DBG(CAM_REQ, "link %x adds sync link:",
+				link[i]->link_hdl);
+			while (j < sync_info->num_links) {
+				if (i != j) {
+					link[i]->sync_link[sync_idx++] =
+						link[j];
+					link[i]->num_sync_links++;
+					CAM_DBG(CAM_REQ, "sync_link[%d] : %x",
+						sync_idx-1, link[j]->link_hdl);
+				}
+				j++;
+			}
+			link[i]->initial_skip = true;
+			link[i]->sof_timestamp = 0;
+		}
+	} else {
+		for (j = 0; j < sync_info->num_links; j++) {
+			link[j]->initial_skip = true;
+			link[j]->sof_timestamp = 0;
+		}
+	}
+
+	cam_session->sync_mode = sync_info->sync_mode;
+	CAM_DBG(CAM_REQ,
+		"Sync config completed on %d links with sync_mode %d",
+		sync_info->num_links, sync_info->sync_mode);
+
+done:
+	mutex_unlock(&cam_session->lock);
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_flush_requests(
+	struct cam_req_mgr_flush_info *flush_info)
+{
+	int                               rc = 0;
+	struct crm_workq_task            *task = NULL;
+	struct cam_req_mgr_core_link     *link = NULL;
+	struct cam_req_mgr_flush_info    *flush;
+	struct crm_task_payload          *task_data;
+	struct cam_req_mgr_core_session  *session = NULL;
+
+	if (!flush_info) {
+		CAM_ERR(CAM_CRM, "flush req is NULL");
+		return -EFAULT;
+	}
+	if (flush_info->flush_type >= CAM_REQ_MGR_FLUSH_TYPE_MAX) {
+		CAM_ERR(CAM_CRM, "incorrect flush type %x",
+			flush_info->flush_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+
+	/* session hdl's priv data is cam session struct */
+	session = cam_get_session_priv(flush_info->session_hdl);
+	if (!session || (session->session_hdl != flush_info->session_hdl)) {
+		CAM_ERR(CAM_CRM, "session: %s, flush_info->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(session), flush_info->session_hdl,
+			(!session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : session->session_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+	if (session->num_links <= 0) {
+		CAM_WARN(CAM_CRM, "No active links in session %x",
+		flush_info->session_hdl);
+		goto end;
+	}
+
+	link = cam_get_link_priv(flush_info->link_hdl);
+	if (!link || (link->link_hdl != flush_info->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, flush_info->link_hdl:%x, link->link_hdl:%x",
+			CAM_IS_NULL_TO_STR(link), flush_info->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	task = cam_req_mgr_workq_get_task(link->workq);
+	if (!task) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	task_data = (struct crm_task_payload *)task->payload;
+	task_data->type = CRM_WORKQ_TASK_FLUSH_REQ;
+	flush = (struct cam_req_mgr_flush_info *)&task_data->u;
+	flush->req_id = flush_info->req_id;
+	flush->link_hdl = flush_info->link_hdl;
+	flush->flush_type = flush_info->flush_type;
+	task->process_cb = &cam_req_mgr_process_flush_req;
+	init_completion(&link->workq_comp);
+	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
+
+	/* Blocking call */
+	rc = wait_for_completion_timeout(
+		&link->workq_comp,
+		msecs_to_jiffies(CAM_REQ_MGR_SCHED_REQ_TIMEOUT));
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return rc;
+}
+
+int cam_req_mgr_link_control(struct cam_req_mgr_link_control *control)
+{
+	int                               rc = 0;
+	int                               i, j;
+	struct cam_req_mgr_core_link     *link = NULL;
+
+	struct cam_req_mgr_connected_device *dev = NULL;
+	struct cam_req_mgr_link_evt_data     evt_data;
+	int                                init_timeout = 0;
+
+	if (!control) {
+		CAM_ERR(CAM_CRM, "Control command is NULL");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((control->num_links <= 0) ||
+		(control->num_links > MAX_LINKS_PER_SESSION)) {
+		CAM_ERR(CAM_CRM, "Invalid number of links %d",
+			control->num_links);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	for (i = 0; i < control->num_links; i++) {
+		link = cam_get_link_priv(control->link_hdls[i]);
+		if (!link || (link->link_hdl != control->link_hdls[i])) {
+			CAM_ERR(CAM_CRM, "link: %s, control->link_hdl:%x, link->link_hdl:%x",
+				CAM_IS_NULL_TO_STR(link), control->link_hdls[i],
+				(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+			rc = -EINVAL;
+			break;
+		}
+
+		mutex_lock(&link->lock);
+		if (control->ops == CAM_REQ_MGR_LINK_ACTIVATE) {
+			spin_lock_bh(&link->link_state_spin_lock);
+			link->state = CAM_CRM_LINK_STATE_READY;
+			spin_unlock_bh(&link->link_state_spin_lock);
+			if (control->init_timeout[i])
+				link->skip_init_frame = true;
+			init_timeout = (2 * control->init_timeout[i]);
+			CAM_DBG(CAM_CRM,
+				"Activate link: 0x%x init_timeout: %d ms",
+				link->link_hdl, control->init_timeout[i]);
+			/* Start SOF watchdog timer */
+			rc = crm_timer_init(&link->watchdog,
+				(init_timeout + CAM_REQ_MGR_WATCHDOG_TIMEOUT),
+				link, &__cam_req_mgr_sof_freeze);
+			if (rc < 0) {
+				CAM_ERR(CAM_CRM,
+					"SOF timer start fails: link=0x%x",
+					link->link_hdl);
+				rc = -EFAULT;
+			}
+			/* Pause the timer before sensor stream on */
+			link->watchdog->pause_timer = true;
+			/* notify nodes */
+			for (j = 0; j < link->num_devs; j++) {
+				dev = &link->l_dev[j];
+				evt_data.evt_type = CAM_REQ_MGR_LINK_EVT_RESUME;
+				evt_data.link_hdl =  link->link_hdl;
+				evt_data.dev_hdl = dev->dev_hdl;
+				evt_data.req_id = 0;
+				if (dev->ops && dev->ops->process_evt)
+					dev->ops->process_evt(&evt_data);
+			}
+		} else if (control->ops == CAM_REQ_MGR_LINK_DEACTIVATE) {
+			/* notify nodes */
+			for (j = 0; j < link->num_devs; j++) {
+				dev = &link->l_dev[j];
+				evt_data.evt_type = CAM_REQ_MGR_LINK_EVT_PAUSE;
+				evt_data.link_hdl =  link->link_hdl;
+				evt_data.dev_hdl = dev->dev_hdl;
+				evt_data.req_id = 0;
+				if (dev->ops && dev->ops->process_evt)
+					dev->ops->process_evt(&evt_data);
+			}
+			/* Destroy SOF watchdog timer */
+			spin_lock_bh(&link->link_state_spin_lock);
+			link->state = CAM_CRM_LINK_STATE_IDLE;
+			link->skip_init_frame = false;
+			crm_timer_exit(&link->watchdog);
+			spin_unlock_bh(&link->link_state_spin_lock);
+			CAM_DBG(CAM_CRM,
+				"De-activate link: 0x%x", link->link_hdl);
+		} else {
+			CAM_ERR(CAM_CRM, "Invalid link control command");
+			rc = -EINVAL;
+		}
+		mutex_unlock(&link->lock);
+	}
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+end:
+	return rc;
+}
+
+int cam_req_mgr_dump_request(struct cam_dump_req_cmd *dump_req)
+{
+	int                                  rc = 0;
+	int                                  i;
+	struct cam_req_mgr_dump_info         info;
+	struct cam_req_mgr_core_link        *link = NULL;
+	struct cam_req_mgr_core_session     *session = NULL;
+	struct cam_req_mgr_connected_device *device = NULL;
+
+	if (!dump_req) {
+		CAM_ERR(CAM_CRM, "dump req is NULL");
+		return -EFAULT;
+	}
+
+	mutex_lock(&g_crm_core_dev->crm_lock);
+	/* session hdl's priv data is cam session struct */
+	session = cam_get_session_priv(dump_req->session_handle);
+	if (!session || (session->session_hdl != dump_req->session_handle)) {
+		CAM_ERR(CAM_CRM, "session: %s, dump_req->ses_hdl:%x, session->ses_hdl:%x",
+			CAM_IS_NULL_TO_STR(session), dump_req->session_handle,
+			(!session) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : session->session_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+	if (session->num_links <= 0) {
+		CAM_WARN(CAM_CRM, "No active links in session %x",
+			dump_req->session_handle);
+		goto end;
+	}
+
+	link = cam_get_link_priv(dump_req->link_hdl);
+	if (!link || (link->link_hdl != dump_req->link_hdl)) {
+		CAM_ERR(CAM_CRM, "link: %s, dump_req->link_hdl:%x, link->link_hdl:%x",
+			CAM_IS_NULL_TO_STR(link), dump_req->link_hdl,
+			(!link) ? CAM_REQ_MGR_DEFAULT_HDL_VAL : link->link_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+	info.offset = dump_req->offset;
+	for (i = 0; i < link->num_devs; i++) {
+		device = &link->l_dev[i];
+		info.link_hdl = dump_req->link_hdl;
+		info.dev_hdl = device->dev_hdl;
+		info.req_id = dump_req->issue_req_id;
+		info.buf_handle = dump_req->buf_handle;
+		info.error_type = dump_req->error_type;
+		if (device->ops && device->ops->dump_req) {
+			rc = device->ops->dump_req(&info);
+			if (rc)
+				CAM_ERR(CAM_REQ,
+					"Fail dump req %llu dev %d rc %d",
+					info.req_id, device->dev_hdl, rc);
+		}
+	}
+	dump_req->offset = info.offset;
+	CAM_INFO(CAM_REQ, "req %llu, offset %zu",
+		dump_req->issue_req_id, dump_req->offset);
+end:
+	mutex_unlock(&g_crm_core_dev->crm_lock);
+	return 0;
+}
+
+int cam_req_mgr_core_device_init(void)
+{
+	int i;
+	CAM_DBG(CAM_CRM, "Enter g_crm_core_dev %pK", g_crm_core_dev);
+
+	if (g_crm_core_dev) {
+		CAM_WARN(CAM_CRM, "core device is already initialized");
+		return 0;
+	}
+	g_crm_core_dev = kzalloc(sizeof(*g_crm_core_dev),
+		GFP_KERNEL);
+	if (!g_crm_core_dev)
+		return -ENOMEM;
+
+	CAM_DBG(CAM_CRM, "g_crm_core_dev %pK", g_crm_core_dev);
+	INIT_LIST_HEAD(&g_crm_core_dev->session_head);
+	mutex_init(&g_crm_core_dev->crm_lock);
+	cam_req_mgr_debug_register(g_crm_core_dev);
+
+	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION; i++) {
+		mutex_init(&g_links[i].lock);
+		spin_lock_init(&g_links[i].link_state_spin_lock);
+		atomic_set(&g_links[i].is_used, 0);
+		cam_req_mgr_core_link_reset(&g_links[i]);
+	}
+	return 0;
+}
+
+int cam_req_mgr_core_device_deinit(void)
+{
+	if (!g_crm_core_dev) {
+		CAM_ERR(CAM_CRM, "NULL pointer");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CRM, "g_crm_core_dev %pK", g_crm_core_dev);
+	cam_req_mgr_debug_unregister();
+	mutex_destroy(&g_crm_core_dev->crm_lock);
+	kfree(g_crm_core_dev);
+	g_crm_core_dev = NULL;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_core.h
@@ -0,0 +1,561 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAM_REQ_MGR_CORE_H_
+#define _CAM_REQ_MGR_CORE_H_
+
+#include <linux/spinlock.h>
+#include "cam_req_mgr_interface.h"
+#include "cam_req_mgr_core_defs.h"
+#include "cam_req_mgr_timer.h"
+
+#define CAM_REQ_MGR_MAX_LINKED_DEV     16
+#define MAX_REQ_SLOTS                  48
+
+#define CAM_REQ_MGR_WATCHDOG_TIMEOUT          1000
+#define CAM_REQ_MGR_WATCHDOG_TIMEOUT_DEFAULT  5000
+#define CAM_REQ_MGR_WATCHDOG_TIMEOUT_MAX      50000
+#define CAM_REQ_MGR_SCHED_REQ_TIMEOUT         1000
+#define CAM_REQ_MGR_SIMULATE_SCHED_REQ        30
+#define CAM_REQ_MGR_DEFAULT_HDL_VAL           0
+
+#define FORCE_DISABLE_RECOVERY  2
+#define FORCE_ENABLE_RECOVERY   1
+#define AUTO_RECOVERY           0
+
+#define CRM_WORKQ_NUM_TASKS 60
+
+#define MAX_SYNC_COUNT 65535
+
+/* Default frame rate is 30 */
+#define DEFAULT_FRAME_DURATION 33333333
+
+#define SYNC_LINK_SOF_CNT_MAX_LMT 1
+
+#define MAXIMUM_LINKS_PER_SESSION  4
+
+#define MAXIMUM_RETRY_ATTEMPTS 2
+
+#define MINIMUM_WORKQUEUE_SCHED_TIME_IN_MS 5
+
+#define VERSION_1  1
+#define VERSION_2  2
+#define CAM_REQ_MGR_MAX_TRIGGERS   2
+
+/**
+ * enum crm_req_eof_trigger_type
+ * @codes: to identify which type of eof trigger for next slot
+ */
+enum crm_req_eof_trigger_type {
+	CAM_REQ_EOF_TRIGGER_NONE,
+	CAM_REQ_EOF_TRIGGER_NOT_APPLY,
+	CAM_REQ_EOF_TRIGGER_APPLIED,
+};
+
+/**
+ * enum crm_workq_task_type
+ * @codes: to identify which type of task is present
+ */
+enum crm_workq_task_type {
+	CRM_WORKQ_TASK_GET_DEV_INFO,
+	CRM_WORKQ_TASK_SETUP_LINK,
+	CRM_WORKQ_TASK_DEV_ADD_REQ,
+	CRM_WORKQ_TASK_APPLY_REQ,
+	CRM_WORKQ_TASK_NOTIFY_SOF,
+	CRM_WORKQ_TASK_NOTIFY_EOF,
+	CRM_WORKQ_TASK_NOTIFY_ERR,
+	CRM_WORKQ_TASK_NOTIFY_FREEZE,
+	CRM_WORKQ_TASK_SCHED_REQ,
+	CRM_WORKQ_TASK_FLUSH_REQ,
+	CRM_WORKQ_TASK_INVALID,
+};
+
+/**
+ * struct crm_task_payload
+ * @type           : to identify which type of task is present
+ * @u              : union of payload of all types of tasks supported
+ * @sched_req      : contains info of  incoming reqest from CSL to CRM
+ * @flush_info     : contains info of cancelled reqest
+ * @dev_req        : contains tracking info of available req id at device
+ * @send_req       : contains info of apply settings to be sent to devs in link
+ * @notify_trigger : contains notification from IFE to CRM about trigger
+ * @notify_err     : contains error info happened while processing request
+ * -
+ */
+struct crm_task_payload {
+	enum crm_workq_task_type type;
+	union {
+		struct cam_req_mgr_sched_request        sched_req;
+		struct cam_req_mgr_flush_info           flush_info;
+		struct cam_req_mgr_add_request          dev_req;
+		struct cam_req_mgr_send_request         send_req;
+		struct cam_req_mgr_trigger_notify       notify_trigger;
+		struct cam_req_mgr_error_notify         notify_err;
+	} u;
+};
+
+/**
+ * enum crm_req_state
+ * State machine for life cycle of request in pd table
+ * EMPTY   : indicates req slot is empty
+ * PENDING : indicates req slot is waiting for reqs from all devs
+ * READY   : indicates req slot is ready to be sent to devs
+ * INVALID : indicates req slot is not in valid state
+ */
+enum crm_req_state {
+	CRM_REQ_STATE_EMPTY,
+	CRM_REQ_STATE_PENDING,
+	CRM_REQ_STATE_READY,
+	CRM_REQ_STATE_INVALID,
+};
+
+/**
+ * enum crm_slot_status
+ * State machine for life cycle of request in input queue
+ * NO_REQ     : empty slot
+ * REQ_ADDED  : new entry in slot
+ * REQ_PENDING    : waiting for next trigger to apply
+ * REQ_READY      : req is ready
+ * REQ_APPLIED    : req is sent to all devices
+ * INVALID    : invalid state
+ */
+enum crm_slot_status {
+	CRM_SLOT_STATUS_NO_REQ,
+	CRM_SLOT_STATUS_REQ_ADDED,
+	CRM_SLOT_STATUS_REQ_PENDING,
+	CRM_SLOT_STATUS_REQ_READY,
+	CRM_SLOT_STATUS_REQ_APPLIED,
+	CRM_SLOT_STATUS_INVALID,
+};
+
+/**
+ * enum cam_req_mgr_link_state
+ * State machine for life cycle of link in crm
+ * AVAILABLE  : link available
+ * IDLE       : link initialized but not ready yet
+ * READY      : link is ready for use
+ * ERR        : link has encountered error
+ * MAX        : invalid state
+ */
+enum cam_req_mgr_link_state {
+	CAM_CRM_LINK_STATE_AVAILABLE,
+	CAM_CRM_LINK_STATE_IDLE,
+	CAM_CRM_LINK_STATE_READY,
+	CAM_CRM_LINK_STATE_ERR,
+	CAM_CRM_LINK_STATE_MAX,
+};
+
+/**
+ * struct cam_req_mgr_traverse_result
+ * @req_id        : Req id that is not ready
+ * @pd            : pipeline delay
+ * @masked_value  : Holds the dev bit for devices not ready
+ *                  for the given request
+ */
+struct cam_req_mgr_traverse_result {
+	int64_t  req_id;
+	uint32_t pd;
+	uint32_t masked_value;
+};
+
+/**
+ * struct cam_req_mgr_traverse
+ * @idx              : slot index
+ * @result           : contains which all tables were able to apply successfully
+ * @result_data      : holds the result of traverse in case it fails
+ * @tbl              : pointer of pipeline delay based request table
+ * @apply_data       : pointer which various tables will update during traverse
+ * @in_q             : input request queue pointer
+ * @validate_only    : Whether to validate only and/or update settings
+ * @open_req_cnt     : Count of open requests yet to be serviced in the kernel.
+ */
+struct cam_req_mgr_traverse {
+	int32_t                            idx;
+	uint32_t                           result;
+	struct cam_req_mgr_traverse_result result_data;
+	struct cam_req_mgr_req_tbl        *tbl;
+	struct cam_req_mgr_apply          *apply_data;
+	struct cam_req_mgr_req_queue      *in_q;
+	bool                               validate_only;
+	int32_t                            open_req_cnt;
+};
+
+/**
+ * struct cam_req_mgr_apply
+ * @idx      : corresponding input queue slot index
+ * @pd       : pipeline delay of device
+ * @req_id   : req id for dev with above pd to process
+ * @skip_idx: skip applying settings when this is set.
+ */
+struct cam_req_mgr_apply {
+	int32_t idx;
+	int32_t pd;
+	int64_t req_id;
+	int32_t skip_idx;
+};
+
+/**
+ * struct crm_tbl_slot_special_ops
+ * @dev_hdl         : Device handle who requested for special ops
+ * @apply_at_eof    : Boolean Identifier for request to be applied at EOF
+ * @is_applied      : Flag to identify if request is already applied to device
+ *                    in previous frame
+ */
+struct crm_tbl_slot_special_ops {
+	int32_t dev_hdl;
+	bool apply_at_eof;
+	bool is_applied;
+};
+
+/**
+ * struct cam_req_mgr_tbl_slot
+ * @idx                 : slot index
+ * @req_ready_map       : mask tracking which all devices have request ready
+ * @state               : state machine for life cycle of a slot
+ * @inject_delay_at_sof : insert extra bubbling for flash type of use cases
+ * @inject_delay_at_eof : insert extra bubbling for flash type of use cases
+ * @ops                 : special operation for the table slot
+ *                        e.g.
+ *                        skip_next frame: in case of applying one device
+ *                        and skip others
+ *                        apply_at_eof: device that needs to apply at EOF
+ */
+struct cam_req_mgr_tbl_slot {
+	int32_t                                idx;
+	uint32_t                               req_ready_map;
+	enum crm_req_state                     state;
+	uint32_t                               inject_delay_at_sof;
+	uint32_t                               inject_delay_at_eof;
+	struct  crm_tbl_slot_special_ops       ops;
+};
+
+/**
+ * struct cam_req_mgr_req_tbl
+ * @id            : table indetifier
+ * @pd            : pipeline delay of table
+ * @dev_count     : num of devices having same pipeline delay
+ * @dev_mask      : mask to track which devices are linked
+ * @skip_traverse : to indicate how many traverses need to be dropped
+ *                  by this table especially in the beginning or bubble recovery
+ * @next          : pointer to next pipeline delay request table
+ * @pd_delta      : differnce between this table's pipeline delay and next
+ * @num_slots     : number of request slots present in the table
+ * @slot          : array of slots tracking requests availability at devices
+ */
+struct cam_req_mgr_req_tbl {
+	int32_t                     id;
+	int32_t                     pd;
+	int32_t                     dev_count;
+	int32_t                     dev_mask;
+	int32_t                     skip_traverse;
+	struct cam_req_mgr_req_tbl *next;
+	int32_t                     pd_delta;
+	int32_t                     num_slots;
+	struct cam_req_mgr_tbl_slot slot[MAX_REQ_SLOTS];
+};
+
+/**
+ * struct cam_req_mgr_slot
+ * - Internal Book keeping
+ * @idx                : slot index
+ * @skip_idx           : if req id in this slot needs to be skipped/not applied
+ * @status             : state machine for life cycle of a slot
+ * - members updated due to external events
+ * @recover            : if user enabled recovery for this request.
+ * @req_id             : mask tracking which all devices have request ready
+ * @sync_mode          : Sync mode in which req id in this slot has to applied
+ * @additional_timeout : Adjusted watchdog timeout value associated with
+ * this request
+ */
+struct cam_req_mgr_slot {
+	int32_t               idx;
+	int32_t               skip_idx;
+	enum crm_slot_status  status;
+	int32_t               recover;
+	int64_t               req_id;
+	int32_t               sync_mode;
+	int32_t               additional_timeout;
+};
+
+/**
+ * struct cam_req_mgr_req_queue
+ * @num_slots   : max num of input queue slots
+ * @slot        : request slot holding incoming request id and bubble info.
+ * @rd_idx      : indicates slot index currently in process.
+ * @wr_idx      : indicates slot index to hold new upcoming req.
+ * @last_applied_idx : indicates slot index last applied successfully.
+ */
+struct cam_req_mgr_req_queue {
+	int32_t                     num_slots;
+	struct cam_req_mgr_slot     slot[MAX_REQ_SLOTS];
+	int32_t                     rd_idx;
+	int32_t                     wr_idx;
+	int32_t                     last_applied_idx;
+};
+
+/**
+ * struct cam_req_mgr_req_data
+ * @in_q             : Poiner to Input request queue
+ * @l_tbl            : unique pd request tables.
+ * @num_tbl          : how many unique pd value devices are present
+ * @apply_data       : Holds information about request id for a request
+ * @prev_apply_data  : Holds information about request id for a previous
+ *                     applied request
+ * @lock             : mutex lock protecting request data ops.
+ */
+struct cam_req_mgr_req_data {
+	struct cam_req_mgr_req_queue *in_q;
+	struct cam_req_mgr_req_tbl   *l_tbl;
+	int32_t                       num_tbl;
+	struct cam_req_mgr_apply      apply_data[CAM_PIPELINE_DELAY_MAX];
+	struct cam_req_mgr_apply      prev_apply_data[CAM_PIPELINE_DELAY_MAX];
+	struct mutex                  lock;
+};
+
+/**
+ * struct cam_req_mgr_connected_device
+ * - Device Properties
+ * @dev_hdl  : device handle
+ * @dev_bit  : unique bit assigned to device in link
+ * - Device characteristics
+ * @pd_tbl   : tracks latest available req id at this device
+ * @dev_info : holds dev characteristics such as pipeline delay, dev name
+ * @ops      : holds func pointer to call methods on this device
+ * @parent   : pvt data - like link which this dev hdl belongs to
+ */
+struct cam_req_mgr_connected_device {
+	int32_t                         dev_hdl;
+	int64_t                         dev_bit;
+	struct cam_req_mgr_req_tbl     *pd_tbl;
+	struct cam_req_mgr_device_info  dev_info;
+	struct cam_req_mgr_kmd_ops     *ops;
+	void                           *parent;
+};
+
+/**
+ * struct cam_req_mgr_core_link
+ * -  Link Properties
+ * @link_hdl             : Link identifier
+ * @num_devs             : num of connected devices to this link
+ * @max_delay            : Max of pipeline delay of all connected devs
+ * @workq                : Pointer to handle workq related jobs
+ * @pd_mask              : each set bit indicates the device with pd equal to
+ *                          bit position is available.
+ * - List of connected devices
+ * @l_dev                : List of connected devices to this link
+ * - Request handling data struct
+ * @req                  : req data holder.
+ * - Timer
+ * @watchdog             : watchdog timer to recover from sof freeze
+ * - Link private data
+ * @workq_comp           : conditional variable to block user thread for workq
+ *                          to finish schedule request processing
+ * @state                : link state machine
+ * @parent               : pvt data - link's parent is session
+ * @lock                 : mutex lock to guard link data operations
+ * @link_state_spin_lock : spin lock to protect link state variable
+ * @sync_link            : array of pointer to the sync link for synchronization
+ * @num_sync_links       : num of links sync associated with this link
+ * @sync_link_sof_skip   : flag determines if a pkt is not available for a given
+ *                         frame in a particular link skip corresponding
+ *                         frame in sync link as well.
+ * @open_req_cnt         : Counter to keep track of open requests that are yet
+ *                         to be serviced in the kernel.
+ * @last_flush_id        : Last request to flush
+ * @is_used              : 1 if link is in use else 0
+ * @is_master            : Based on pd among links, the link with the highest pd
+ *                         is assigned as master
+ * @initial_skip         : Flag to determine if slave has started streaming in
+ *                         master-slave sync
+ * @in_msync_mode        : Flag to determine if a link is in master-slave mode
+ * @initial_sync_req     : The initial req which is required to sync with the
+ *                         other link
+ * @retry_cnt            : Counter that tracks number of attempts to apply
+ *                         the same req
+ * @is_shutdown          : Flag to indicate if link needs to be disconnected
+ *                         as part of shutdown.
+ * @sof_timestamp_value  : SOF timestamp value
+ * @prev_sof_timestamp   : Previous SOF timestamp value
+ * @dual_trigger         : Links needs to wait for two triggers prior to
+ *                         applying the settings
+ * @trigger_cnt          : trigger count value per device initiating the trigger
+ * @eof_event_cnt        : Atomic variable to track the number of EOF requests
+ * @skip_init_frame      : skip initial frames crm_wd_timer validation in the
+ *                         case of long exposure use case
+ * @last_sof_trigger_jiffies : Record the jiffies of last sof trigger jiffies
+ * @wq_congestion        : Indicates if WQ congestion is detected or not
+ */
+struct cam_req_mgr_core_link {
+	int32_t                              link_hdl;
+	int32_t                              num_devs;
+	enum cam_pipeline_delay              max_delay;
+	struct cam_req_mgr_core_workq       *workq;
+	int32_t                              pd_mask;
+	struct cam_req_mgr_connected_device *l_dev;
+	struct cam_req_mgr_req_data          req;
+	struct cam_req_mgr_timer            *watchdog;
+	struct completion                    workq_comp;
+	enum cam_req_mgr_link_state          state;
+	void                                *parent;
+	struct mutex                         lock;
+	spinlock_t                           link_state_spin_lock;
+	struct cam_req_mgr_core_link
+			*sync_link[MAXIMUM_LINKS_PER_SESSION - 1];
+	int32_t                              num_sync_links;
+	bool                                 sync_link_sof_skip;
+	int32_t                              open_req_cnt;
+	uint32_t                             last_flush_id;
+	atomic_t                             is_used;
+	bool                                 is_master;
+	bool                                 initial_skip;
+	bool                                 in_msync_mode;
+	int64_t                              initial_sync_req;
+	uint32_t                             retry_cnt;
+	bool                                 is_shutdown;
+	uint64_t                             sof_timestamp;
+	uint64_t                             prev_sof_timestamp;
+	bool                                 dual_trigger;
+	uint32_t trigger_cnt[CAM_REQ_MGR_MAX_TRIGGERS]
+				[CAM_TRIGGER_MAX_POINTS + 1];
+	atomic_t                             eof_event_cnt;
+	bool                                 skip_init_frame;
+	uint64_t                             last_sof_trigger_jiffies;
+	bool                                 wq_congestion;
+};
+
+/**
+ * struct cam_req_mgr_core_session
+ * - Session Properties
+ * @session_hdl        : session identifier
+ * @num_links          : num of active links for current session
+ * - Links of this session
+ * @links              : pointer to array of links within session
+ * - Session private data
+ * @entry              : pvt data - entry in the list of sessions
+ * @lock               : pvt data - spin lock to guard session data
+ * - Debug data
+ * @force_err_recovery : For debugging, we can force bubble recovery
+ *                       to be always ON or always OFF using debugfs.
+ * @sync_mode          : Sync mode for this session links
+ */
+struct cam_req_mgr_core_session {
+	int32_t                       session_hdl;
+	uint32_t                      num_links;
+	struct cam_req_mgr_core_link *links[MAXIMUM_LINKS_PER_SESSION];
+	struct list_head              entry;
+	struct mutex                  lock;
+	int32_t                       force_err_recovery;
+	int32_t                       sync_mode;
+};
+
+/**
+ * struct cam_req_mgr_core_device
+ * - Core camera request manager data struct
+ * @session_head : list head holding sessions
+ * @crm_lock     : mutex lock to protect session creation & destruction
+ * @recovery_on_apply_fail : Recovery on apply failure using debugfs.
+ */
+struct cam_req_mgr_core_device {
+	struct list_head             session_head;
+	struct mutex                 crm_lock;
+	bool                         recovery_on_apply_fail;
+};
+
+/**
+ * cam_req_mgr_create_session()
+ * @brief    : creates session
+ * @ses_info : output param for session handle
+ *
+ * called as part of session creation.
+ */
+int cam_req_mgr_create_session(struct cam_req_mgr_session_info *ses_info);
+
+/**
+ * cam_req_mgr_destroy_session()
+ * @brief    : destroy session
+ * @ses_info : session handle info, input param
+ * @is_shutdown: To indicate if devices on link need to be disconnected.
+ *
+ * Called as part of session destroy
+ * return success/failure
+ */
+int cam_req_mgr_destroy_session(struct cam_req_mgr_session_info *ses_info,
+	bool is_shutdown);
+
+/**
+ * cam_req_mgr_link()
+ * @brief     : creates a link for a session
+ * @link_info : handle and session info to create a link
+ *
+ * link is formed in a session for multiple devices. it creates
+ * a unique link handle for the link and is specific to a
+ * session. Returns link handle
+ */
+int cam_req_mgr_link(struct cam_req_mgr_ver_info *link_info);
+int cam_req_mgr_link_v2(struct cam_req_mgr_ver_info *link_info);
+
+
+/**
+ * cam_req_mgr_unlink()
+ * @brief       : destroy a link in a session
+ * @unlink_info : session and link handle info
+ *
+ * link is destroyed in a session
+ */
+int cam_req_mgr_unlink(struct cam_req_mgr_unlink_info *unlink_info);
+
+/**
+ * cam_req_mgr_schedule_request()
+ * @brief: Request is scheduled
+ * @sched_req: request id, session and link id info, bubble recovery info
+ */
+int cam_req_mgr_schedule_request(struct cam_req_mgr_sched_request *sched_req);
+
+/**
+ * cam_req_mgr_sync_mode_setup()
+ * @brief: sync for links in a session
+ * @sync_info: session, links info and master link info
+ */
+int cam_req_mgr_sync_config(struct cam_req_mgr_sync_mode *sync_info);
+
+/**
+ * cam_req_mgr_flush_requests()
+ * @brief: flush all requests
+ * @flush_info: requests related to link and session
+ */
+int cam_req_mgr_flush_requests(struct cam_req_mgr_flush_info *flush_info);
+
+/**
+ * cam_req_mgr_core_device_init()
+ * @brief: initialize crm core
+ */
+int cam_req_mgr_core_device_init(void);
+
+/**
+ * cam_req_mgr_core_device_deinit()
+ * @brief: cleanp crm core
+ */
+int cam_req_mgr_core_device_deinit(void);
+
+/**
+ * cam_req_mgr_handle_core_shutdown()
+ * @brief: Handles camera close
+ */
+void cam_req_mgr_handle_core_shutdown(void);
+
+/**
+ * cam_req_mgr_link_control()
+ * @brief:   Handles link control operations
+ * @control: Link control command
+ */
+int cam_req_mgr_link_control(struct cam_req_mgr_link_control *control);
+
+/**
+ * cam_req_mgr_dump_request()
+ * @brief:   Dumps the request information
+ * @dump_req: Dump request
+ */
+int cam_req_mgr_dump_request(struct cam_dump_req_cmd *dump_req);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_core_defs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_core_defs.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_REQ_MGR_CORE_DEFS_H_
+#define _CAM_REQ_MGR_CORE_DEFS_H_
+
+#define CRM_TRACE_ENABLE 0
+#define CRM_DEBUG_MUTEX 0
+
+#define SET_SUCCESS_BIT(ret, pd)  (ret |= (1 << (pd)))
+
+#define SET_FAILURE_BIT(ret, pd)  (ret &= (~(1 << (pd))))
+
+#define CRM_GET_REQ_ID(in_q, idx) in_q->slot[idx].req_id
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_debug.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_debug.c
@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_req_mgr_debug.h"
+
+#define MAX_SESS_INFO_LINE_BUFF_LEN 256
+
+static char sess_info_buffer[MAX_SESS_INFO_LINE_BUFF_LEN];
+static int cam_debug_mgr_delay_detect;
+
+static int cam_req_mgr_debug_set_bubble_recovery(void *data, u64 val)
+{
+	struct cam_req_mgr_core_device  *core_dev = data;
+	struct cam_req_mgr_core_session *session;
+	int rc = 0;
+
+	mutex_lock(&core_dev->crm_lock);
+
+	if (!list_empty(&core_dev->session_head)) {
+		list_for_each_entry(session,
+			&core_dev->session_head, entry) {
+			session->force_err_recovery = val;
+		}
+	}
+
+	mutex_unlock(&core_dev->crm_lock);
+
+	return rc;
+}
+
+static int cam_req_mgr_debug_get_bubble_recovery(void *data, u64 *val)
+{
+	struct cam_req_mgr_core_device *core_dev = data;
+	struct cam_req_mgr_core_session *session;
+
+	mutex_lock(&core_dev->crm_lock);
+
+	if (!list_empty(&core_dev->session_head)) {
+		session = list_first_entry(&core_dev->session_head,
+			struct cam_req_mgr_core_session,
+			entry);
+		*val = session->force_err_recovery;
+	}
+	mutex_unlock(&core_dev->crm_lock);
+
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(bubble_recovery, cam_req_mgr_debug_get_bubble_recovery,
+	cam_req_mgr_debug_set_bubble_recovery, "%lld\n");
+
+static int session_info_open(struct inode *inode, struct file *file)
+{
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+static ssize_t session_info_read(struct file *t_file, char *t_char,
+	size_t t_size_t, loff_t *t_loff_t)
+{
+	int i;
+	char *out_buffer = sess_info_buffer;
+	char line_buffer[MAX_SESS_INFO_LINE_BUFF_LEN] = {0};
+	struct cam_req_mgr_core_device *core_dev =
+		(struct cam_req_mgr_core_device *) t_file->private_data;
+	struct cam_req_mgr_core_session *session;
+
+	memset(out_buffer, 0, MAX_SESS_INFO_LINE_BUFF_LEN);
+
+	mutex_lock(&core_dev->crm_lock);
+
+	if (!list_empty(&core_dev->session_head)) {
+		list_for_each_entry(session,
+			&core_dev->session_head, entry) {
+			snprintf(line_buffer, sizeof(line_buffer),
+				"session_hdl = %x \t"
+				"num_links = %d\n",
+				session->session_hdl, session->num_links);
+			strlcat(out_buffer, line_buffer,
+				sizeof(sess_info_buffer));
+			for (i = 0; i < session->num_links; i++) {
+				snprintf(line_buffer, sizeof(line_buffer),
+					"link_hdl[%d] = 0x%x, num_devs connected = %d\n",
+					i, session->links[i]->link_hdl,
+					session->links[i]->num_devs);
+				strlcat(out_buffer, line_buffer,
+					sizeof(sess_info_buffer));
+			}
+		}
+	}
+
+	mutex_unlock(&core_dev->crm_lock);
+
+	return simple_read_from_buffer(t_char, t_size_t,
+		t_loff_t, out_buffer, strlen(out_buffer));
+}
+
+static ssize_t session_info_write(struct file *t_file,
+	const char *t_char, size_t t_size_t, loff_t *t_loff_t)
+{
+	memset(sess_info_buffer, 0, MAX_SESS_INFO_LINE_BUFF_LEN);
+
+	return 0;
+}
+
+static const struct file_operations session_info = {
+	.open = session_info_open,
+	.read = session_info_read,
+	.write = session_info_write,
+};
+
+static struct dentry *debugfs_root;
+int cam_req_mgr_debug_register(struct cam_req_mgr_core_device *core_dev)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("cam_req_mgr", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_MEM,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	debugfs_root = dbgfileptr;
+
+	debugfs_create_file("sessions_info", 0644, debugfs_root,
+		core_dev, &session_info);
+	debugfs_create_file("bubble_recovery", 0644,
+		debugfs_root, core_dev, &bubble_recovery);
+	debugfs_create_bool("recovery_on_apply_fail", 0644,
+		debugfs_root, &core_dev->recovery_on_apply_fail);
+	debugfs_create_u32("delay_detect_count", 0644, debugfs_root,
+		&cam_debug_mgr_delay_detect);
+
+end:
+	return rc;
+}
+
+int cam_req_mgr_debug_unregister(void)
+{
+	debugfs_remove_recursive(debugfs_root);
+	return 0;
+}
+
+void cam_req_mgr_debug_delay_detect(void)
+{
+	cam_debug_mgr_delay_detect += 1;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_debug.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_debug.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_DEBUG_H_
+#define _CAM_REQ_MGR_DEBUG_H_
+
+#include <linux/debugfs.h>
+#include "cam_req_mgr_core.h"
+#include "cam_debug_util.h"
+
+int cam_req_mgr_debug_register(struct cam_req_mgr_core_device *core_dev);
+int cam_req_mgr_debug_unregister(void);
+
+/* cam_req_mgr_debug_delay_detect()
+ * @brief    : increment debug_fs varaible by 1 whenever delay occurred.
+ */
+void cam_req_mgr_debug_delay_detect(void);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_dev.c
@@ -0,0 +1,1022 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/highmem.h>
+#include <linux/types.h>
+#include <linux/rwsem.h>
+
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/cam_req_mgr.h>
+#include <media/cam_defs.h>
+
+#include "cam_req_mgr_dev.h"
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_core.h"
+#include "cam_subdev.h"
+#include "cam_mem_mgr.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+#include "cam_cpas_hw.h"
+
+#define CAM_REQ_MGR_EVENT_MAX 30
+
+static struct cam_req_mgr_device g_dev;
+struct kmem_cache *g_cam_req_mgr_timer_cachep;
+static struct list_head cam_req_mgr_ordered_sd_list;
+
+DECLARE_RWSEM(rwsem_lock);
+
+static struct device_attribute camera_debug_sysfs_attr =
+	__ATTR(debug_node, 0600, NULL, cam_debug_sysfs_node_store);
+
+static int cam_media_device_setup(struct device *dev)
+{
+	int rc;
+
+	g_dev.v4l2_dev->mdev = kzalloc(sizeof(*g_dev.v4l2_dev->mdev),
+		GFP_KERNEL);
+	if (!g_dev.v4l2_dev->mdev) {
+		rc = -ENOMEM;
+		goto mdev_fail;
+	}
+
+	media_device_init(g_dev.v4l2_dev->mdev);
+	g_dev.v4l2_dev->mdev->dev = dev;
+	strscpy(g_dev.v4l2_dev->mdev->model, CAM_REQ_MGR_VNODE_NAME,
+		sizeof(g_dev.v4l2_dev->mdev->model));
+
+	rc = media_device_register(g_dev.v4l2_dev->mdev);
+	if (rc)
+		goto media_fail;
+
+	return rc;
+
+media_fail:
+	kfree(g_dev.v4l2_dev->mdev);
+	g_dev.v4l2_dev->mdev = NULL;
+mdev_fail:
+	return rc;
+}
+
+static void cam_media_device_cleanup(void)
+{
+	media_device_unregister(g_dev.v4l2_dev->mdev);
+	media_device_cleanup(g_dev.v4l2_dev->mdev);
+	kfree(g_dev.v4l2_dev->mdev);
+	g_dev.v4l2_dev->mdev = NULL;
+}
+
+static int cam_v4l2_device_setup(struct device *dev)
+{
+	int rc;
+
+	g_dev.v4l2_dev = kzalloc(sizeof(*g_dev.v4l2_dev),
+		GFP_KERNEL);
+	if (!g_dev.v4l2_dev)
+		return -ENOMEM;
+
+	rc = v4l2_device_register(dev, g_dev.v4l2_dev);
+	if (rc)
+		goto reg_fail;
+
+	return rc;
+
+reg_fail:
+	kfree(g_dev.v4l2_dev);
+	g_dev.v4l2_dev = NULL;
+	return rc;
+}
+
+static void cam_v4l2_device_cleanup(void)
+{
+	v4l2_device_unregister(g_dev.v4l2_dev);
+	kfree(g_dev.v4l2_dev);
+	g_dev.v4l2_dev = NULL;
+}
+
+
+void cam_req_mgr_rwsem_read_op(enum cam_subdev_rwsem lock)
+{
+	if (lock == CAM_SUBDEV_LOCK)
+		down_read(&rwsem_lock);
+	else if (lock == CAM_SUBDEV_UNLOCK)
+		up_read(&rwsem_lock);
+}
+
+static void cam_req_mgr_rwsem_write_op(enum cam_subdev_rwsem lock)
+{
+	if (lock == CAM_SUBDEV_LOCK)
+		down_write(&rwsem_lock);
+	else if (lock == CAM_SUBDEV_UNLOCK)
+		up_write(&rwsem_lock);
+}
+
+static int cam_req_mgr_open(struct file *filep)
+{
+	int rc;
+
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK);
+
+	mutex_lock(&g_dev.cam_lock);
+	if (g_dev.open_cnt >= 1) {
+		rc = -EALREADY;
+		goto end;
+	}
+
+	rc = v4l2_fh_open(filep);
+	if (rc) {
+		CAM_ERR(CAM_CRM, "v4l2_fh_open failed: %d", rc);
+		goto end;
+	}
+
+	spin_lock_bh(&g_dev.cam_eventq_lock);
+	g_dev.cam_eventq = filep->private_data;
+	spin_unlock_bh(&g_dev.cam_eventq_lock);
+
+	g_dev.open_cnt++;
+	rc = cam_mem_mgr_init();
+	if (rc) {
+		g_dev.open_cnt--;
+		CAM_ERR(CAM_CRM, "mem mgr init failed");
+		goto mem_mgr_init_fail;
+	}
+
+	mutex_unlock(&g_dev.cam_lock);
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
+	return rc;
+
+mem_mgr_init_fail:
+	v4l2_fh_release(filep);
+end:
+	mutex_unlock(&g_dev.cam_lock);
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
+	return rc;
+}
+
+static unsigned int cam_req_mgr_poll(struct file *f,
+	struct poll_table_struct *pll_table)
+{
+	int rc = 0;
+	struct v4l2_fh *eventq = f->private_data;
+
+	if (!eventq)
+		return -EINVAL;
+
+	poll_wait(f, &eventq->wait, pll_table);
+	if (v4l2_event_pending(eventq))
+		rc = POLLPRI;
+
+	return rc;
+}
+
+static int cam_req_mgr_close(struct file *filep)
+{
+	struct v4l2_subdev *sd;
+	struct cam_subdev *csd;
+	struct v4l2_fh *vfh = filep->private_data;
+	struct v4l2_subdev_fh *subdev_fh = to_v4l2_subdev_fh(vfh);
+
+	CAM_WARN(CAM_CRM,
+		"release invoked associated userspace process has died, open_cnt: %d",
+		g_dev.open_cnt);
+
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK);
+
+	mutex_lock(&g_dev.cam_lock);
+
+	if (g_dev.open_cnt <= 0) {
+		mutex_unlock(&g_dev.cam_lock);
+		cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
+		return -EINVAL;
+	}
+
+	cam_req_mgr_handle_core_shutdown();
+	g_dev.shutdown_state = true;
+
+	list_for_each_entry(csd, &cam_req_mgr_ordered_sd_list, list) {
+		sd = &csd->sd;
+		if (!(sd->flags & V4L2_SUBDEV_FL_HAS_DEVNODE))
+			continue;
+		if (sd->internal_ops) {
+			CAM_DBG(CAM_CRM, "Invoke subdev close for device %s",
+				sd->name);
+			v4l2_subdev_call(sd, core, ioctl,
+				CAM_SD_SHUTDOWN, subdev_fh);
+		}
+	}
+
+	g_dev.open_cnt--;
+	g_dev.shutdown_state = false;
+	v4l2_fh_release(filep);
+
+	spin_lock_bh(&g_dev.cam_eventq_lock);
+	g_dev.cam_eventq = NULL;
+	spin_unlock_bh(&g_dev.cam_eventq_lock);
+
+	cam_req_mgr_util_free_hdls();
+	cam_mem_mgr_deinit();
+	mutex_unlock(&g_dev.cam_lock);
+
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
+
+	return 0;
+}
+
+static struct v4l2_file_operations g_cam_fops = {
+	.owner  = THIS_MODULE,
+	.open   = cam_req_mgr_open,
+	.poll   = cam_req_mgr_poll,
+	.release = cam_req_mgr_close,
+	.unlocked_ioctl   = video_ioctl2,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = video_ioctl2,
+#endif
+};
+
+static void cam_v4l2_event_queue_notify_error(const struct v4l2_event *old,
+	struct v4l2_event *new)
+{
+	struct cam_req_mgr_message *ev_header;
+
+	ev_header = CAM_REQ_MGR_GET_PAYLOAD_PTR((*old),
+		struct cam_req_mgr_message);
+
+	switch (old->id) {
+	case V4L_EVENT_CAM_REQ_MGR_SOF:
+	case V4L_EVENT_CAM_REQ_MGR_SOF_BOOT_TS:
+		if (ev_header->u.frame_msg.request_id)
+			CAM_ERR(CAM_CRM,
+				"Failed to notify %s Sess %X FrameId %lld FrameMeta %d ReqId %lld link %X",
+				((old->id == V4L_EVENT_CAM_REQ_MGR_SOF) ?
+				"SOF_TS" : "BOOT_TS"),
+				ev_header->session_hdl,
+				ev_header->u.frame_msg.frame_id,
+				ev_header->u.frame_msg.frame_id_meta,
+				ev_header->u.frame_msg.request_id,
+				ev_header->u.frame_msg.link_hdl);
+		else
+			CAM_WARN_RATE_LIMIT_CUSTOM(CAM_CRM, 5, 1,
+				"Failed to notify %s Sess %X FrameId %lld FrameMeta %d ReqId %lld link %X",
+				((old->id == V4L_EVENT_CAM_REQ_MGR_SOF) ?
+				"SOF_TS" : "BOOT_TS"),
+				ev_header->session_hdl,
+				ev_header->u.frame_msg.frame_id,
+				ev_header->u.frame_msg.frame_id_meta,
+				ev_header->u.frame_msg.request_id,
+				ev_header->u.frame_msg.link_hdl);
+		break;
+	case V4L_EVENT_CAM_REQ_MGR_ERROR:
+		CAM_ERR_RATE_LIMIT(CAM_CRM,
+			"Failed to notify ERROR Sess %X ReqId %d Link %X Type %d",
+			ev_header->session_hdl,
+			ev_header->u.err_msg.request_id,
+			ev_header->u.err_msg.link_hdl,
+			ev_header->u.err_msg.error_type);
+		break;
+	default:
+		CAM_ERR(CAM_CRM, "Failed to notify crm event id %d",
+			old->id);
+	}
+}
+
+static struct v4l2_subscribed_event_ops g_cam_v4l2_ops = {
+	.merge = cam_v4l2_event_queue_notify_error,
+};
+
+static int cam_subscribe_event(struct v4l2_fh *fh,
+	const struct v4l2_event_subscription *sub)
+{
+	return v4l2_event_subscribe(fh, sub, CAM_REQ_MGR_EVENT_MAX,
+		&g_cam_v4l2_ops);
+}
+
+static int cam_unsubscribe_event(struct v4l2_fh *fh,
+	const struct v4l2_event_subscription *sub)
+{
+	return v4l2_event_unsubscribe(fh, sub);
+}
+
+static long cam_private_ioctl(struct file *file, void *fh,
+	bool valid_prio, unsigned int cmd, void *arg)
+{
+	int rc;
+	struct cam_control *k_ioctl;
+
+	if ((!arg) || (cmd != VIDIOC_CAM_CONTROL))
+		return -EINVAL;
+
+	k_ioctl = (struct cam_control *)arg;
+
+	if (!k_ioctl->handle)
+		return -EINVAL;
+
+	switch (k_ioctl->op_code) {
+	case CAM_REQ_MGR_CREATE_SESSION: {
+		struct cam_req_mgr_session_info ses_info;
+
+		if (k_ioctl->size != sizeof(ses_info))
+			return -EINVAL;
+
+		if (copy_from_user(&ses_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_session_info))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_create_session(&ses_info);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&ses_info,
+				sizeof(struct cam_req_mgr_session_info)))
+				rc = -EFAULT;
+		}
+		break;
+
+	case CAM_REQ_MGR_DESTROY_SESSION: {
+		struct cam_req_mgr_session_info ses_info;
+
+		if (k_ioctl->size != sizeof(ses_info))
+			return -EINVAL;
+
+		if (copy_from_user(&ses_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_session_info))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_destroy_session(&ses_info, false);
+		}
+		break;
+
+	case CAM_REQ_MGR_LINK: {
+		struct cam_req_mgr_ver_info ver_info;
+
+		if (k_ioctl->size != sizeof(ver_info.u.link_info_v1))
+			return -EINVAL;
+
+		if (copy_from_user(&ver_info.u.link_info_v1,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_link_info))) {
+			return -EFAULT;
+		}
+		ver_info.version = VERSION_1;
+		rc = cam_req_mgr_link(&ver_info);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&ver_info.u.link_info_v1,
+				sizeof(struct cam_req_mgr_link_info)))
+				rc = -EFAULT;
+		}
+		break;
+
+	case CAM_REQ_MGR_LINK_V2: {
+		struct cam_req_mgr_ver_info ver_info;
+
+		if (k_ioctl->size != sizeof(ver_info.u.link_info_v2))
+			return -EINVAL;
+
+		if (copy_from_user(&ver_info.u.link_info_v2,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_link_info_v2))) {
+			return -EFAULT;
+		}
+
+		ver_info.version = VERSION_2;
+		rc = cam_req_mgr_link_v2(&ver_info);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&ver_info.u.link_info_v2,
+				sizeof(struct cam_req_mgr_link_info_v2)))
+				rc = -EFAULT;
+			}
+		break;
+
+	case CAM_REQ_MGR_UNLINK: {
+		struct cam_req_mgr_unlink_info unlink_info;
+
+		if (k_ioctl->size != sizeof(unlink_info))
+			return -EINVAL;
+
+		if (copy_from_user(&unlink_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_unlink_info))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_unlink(&unlink_info);
+		}
+		break;
+
+	case CAM_REQ_MGR_SCHED_REQ: {
+		struct cam_req_mgr_sched_request sched_req;
+
+		if (k_ioctl->size != sizeof(sched_req))
+			return -EINVAL;
+
+		if (copy_from_user(&sched_req,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_sched_request))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_schedule_request(&sched_req);
+		}
+		break;
+
+	case CAM_REQ_MGR_FLUSH_REQ: {
+		struct cam_req_mgr_flush_info flush_info;
+
+		if (k_ioctl->size != sizeof(flush_info))
+			return -EINVAL;
+
+		if (copy_from_user(&flush_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_flush_info))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_flush_requests(&flush_info);
+		}
+		break;
+
+	case CAM_REQ_MGR_SYNC_MODE: {
+		struct cam_req_mgr_sync_mode sync_info;
+
+		if (k_ioctl->size != sizeof(sync_info))
+			return -EINVAL;
+
+		if (copy_from_user(&sync_info,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_sync_mode))) {
+			return -EFAULT;
+		}
+
+		rc = cam_req_mgr_sync_config(&sync_info);
+		}
+		break;
+	case CAM_REQ_MGR_ALLOC_BUF: {
+		struct cam_mem_mgr_alloc_cmd cmd;
+		struct cam_mem_mgr_alloc_cmd_v2 cmd_v2 = {0};
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_alloc_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		strscpy(cmd_v2.buf_name, "UNKNOWN", CAM_DMA_BUF_NAME_LEN);
+		memcpy(cmd_v2.mmu_hdls, cmd.mmu_hdls,
+			sizeof(__s32) * CAM_MEM_MMU_MAX_HANDLE);
+		cmd_v2.num_hdl = cmd.num_hdl;
+		cmd_v2.flags = cmd.flags;
+		cmd_v2.len = cmd.len;
+		cmd_v2.align = cmd.align;
+
+		rc = cam_mem_mgr_alloc_and_map(&cmd_v2);
+		memcpy(&cmd.out, &cmd_v2.out, sizeof(cmd.out));
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&cmd, sizeof(struct cam_mem_mgr_alloc_cmd))) {
+				rc = -EFAULT;
+				break;
+			}
+		}
+		break;
+	case CAM_REQ_MGR_ALLOC_BUF_V2: {
+		struct cam_mem_mgr_alloc_cmd_v2 cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_alloc_cmd_v2))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_mem_mgr_alloc_and_map(&cmd);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&cmd, sizeof(struct cam_mem_mgr_alloc_cmd_v2))) {
+				rc = -EFAULT;
+				break;
+			}
+		}
+		break;
+	case CAM_REQ_MGR_MAP_BUF: {
+		struct cam_mem_mgr_map_cmd cmd;
+		struct cam_mem_mgr_map_cmd_v2 cmd_v2 = {0};
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_map_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		strscpy(cmd_v2.buf_name, "UNKNOWN", CAM_DMA_BUF_NAME_LEN);
+		memcpy(cmd_v2.mmu_hdls, cmd.mmu_hdls,
+			sizeof(__s32) * CAM_MEM_MMU_MAX_HANDLE);
+		cmd_v2.num_hdl = cmd.num_hdl;
+		cmd_v2.flags = cmd.flags;
+		cmd_v2.fd = cmd.fd;
+
+		rc = cam_mem_mgr_map(&cmd_v2);
+		memcpy(&cmd.out, &cmd_v2.out, sizeof(cmd.out));
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&cmd, sizeof(struct cam_mem_mgr_map_cmd))) {
+				rc = -EFAULT;
+				break;
+			}
+		}
+		break;
+	case CAM_REQ_MGR_MAP_BUF_V2: {
+		struct cam_mem_mgr_map_cmd_v2 cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_map_cmd_v2))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_mem_mgr_map(&cmd);
+		if (!rc)
+			if (copy_to_user(
+				u64_to_user_ptr(k_ioctl->handle),
+				&cmd, sizeof(struct cam_mem_mgr_map_cmd_v2))) {
+				rc = -EFAULT;
+				break;
+			}
+		}
+		break;
+	case CAM_REQ_MGR_RELEASE_BUF: {
+		struct cam_mem_mgr_release_cmd cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_mgr_release_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_mem_mgr_release(&cmd);
+		}
+		break;
+	case CAM_REQ_MGR_CACHE_OPS: {
+		struct cam_mem_cache_ops_cmd cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_mem_cache_ops_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_mem_mgr_cache_ops(&cmd);
+		if (rc)
+			rc = -EINVAL;
+		}
+		break;
+	case CAM_REQ_MGR_LINK_CONTROL: {
+		struct cam_req_mgr_link_control cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_req_mgr_link_control))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		rc = cam_req_mgr_link_control(&cmd);
+		if (rc)
+			rc = -EINVAL;
+		}
+		break;
+	case CAM_REQ_MGR_REQUEST_DUMP: {
+		struct cam_dump_req_cmd cmd;
+
+		if (k_ioctl->size != sizeof(cmd))
+			return -EINVAL;
+
+		if (copy_from_user(&cmd,
+			u64_to_user_ptr(k_ioctl->handle),
+			sizeof(struct cam_dump_req_cmd))) {
+			rc = -EFAULT;
+			break;
+		}
+		rc = cam_req_mgr_dump_request(&cmd);
+		if (rc) {
+			CAM_ERR(CAM_CORE, "dump fail for dev %d req %llu rc %d",
+				cmd.dev_handle, cmd.issue_req_id, rc);
+			break;
+		}
+		if (copy_to_user(
+			u64_to_user_ptr(k_ioctl->handle),
+			&cmd, sizeof(struct cam_dump_req_cmd)))
+			rc = -EFAULT;
+		}
+		break;
+	default:
+		return -ENOIOCTLCMD;
+	}
+
+	return rc;
+}
+
+static const struct v4l2_ioctl_ops g_cam_ioctl_ops = {
+	.vidioc_subscribe_event = cam_subscribe_event,
+	.vidioc_unsubscribe_event = cam_unsubscribe_event,
+	.vidioc_default = cam_private_ioctl,
+};
+
+static int cam_video_device_setup(void)
+{
+	int rc;
+
+	g_dev.video = video_device_alloc();
+	if (!g_dev.video) {
+		rc = -ENOMEM;
+		goto video_fail;
+	}
+
+	g_dev.video->v4l2_dev = g_dev.v4l2_dev;
+
+	strscpy(g_dev.video->name, "cam-req-mgr", sizeof(g_dev.video->name));
+	g_dev.video->release = video_device_release_empty;
+	g_dev.video->fops = &g_cam_fops;
+	g_dev.video->ioctl_ops = &g_cam_ioctl_ops;
+	g_dev.video->minor = -1;
+	g_dev.video->vfl_type = VFL_TYPE_VIDEO;
+	g_dev.video->device_caps |= V4L2_CAP_VIDEO_CAPTURE;
+	rc = video_register_device(g_dev.video, VFL_TYPE_VIDEO, -1);
+	if (rc) {
+		CAM_ERR(CAM_CRM,
+			"video device registration failure rc = %d, name = %s, device_caps = %d",
+			rc, g_dev.video->name, g_dev.video->device_caps);
+		goto v4l2_fail;
+	}
+
+	rc = media_entity_pads_init(&g_dev.video->entity, 0, NULL);
+	if (rc)
+		goto entity_fail;
+
+	g_dev.video->entity.function = CAM_VNODE_DEVICE_TYPE;
+	g_dev.video->entity.name = video_device_node_name(g_dev.video);
+
+	return rc;
+
+entity_fail:
+	video_unregister_device(g_dev.video);
+v4l2_fail:
+	video_device_release(g_dev.video);
+	g_dev.video = NULL;
+video_fail:
+	return rc;
+}
+
+int cam_req_mgr_notify_message(struct cam_req_mgr_message *msg,
+	uint32_t id,
+	uint32_t type)
+{
+	struct v4l2_event event;
+	struct cam_req_mgr_message *ev_header;
+
+	if (!msg)
+		return -EINVAL;
+
+	event.id = id;
+	event.type = type;
+	ev_header = CAM_REQ_MGR_GET_PAYLOAD_PTR(event,
+		struct cam_req_mgr_message);
+	memcpy(ev_header, msg, sizeof(struct cam_req_mgr_message));
+	v4l2_event_queue(g_dev.video, &event);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_req_mgr_notify_message);
+
+static void cam_video_device_cleanup(void)
+{
+	media_entity_cleanup(&g_dev.video->entity);
+	video_unregister_device(g_dev.video);
+	video_device_release(g_dev.video);
+	g_dev.video = NULL;
+}
+
+void cam_subdev_notify_message(u32 subdev_type,
+		enum cam_subdev_message_type_t message_type,
+		uint32_t data)
+{
+	struct v4l2_subdev *sd = NULL;
+	struct cam_subdev *csd = NULL;
+
+	list_for_each_entry(sd, &g_dev.v4l2_dev->subdevs, list) {
+		if (sd->entity.function == subdev_type) {
+			csd = container_of(sd, struct cam_subdev, sd);
+			if (csd->msg_cb != NULL)
+				csd->msg_cb(sd, message_type, data);
+		}
+	}
+}
+EXPORT_SYMBOL(cam_subdev_notify_message);
+
+bool cam_req_mgr_is_open(void)
+{
+	bool crm_status = false;
+
+	mutex_lock(&g_dev.cam_lock);
+	crm_status = g_dev.open_cnt ? true : false;
+	mutex_unlock(&g_dev.cam_lock);
+
+	return crm_status;
+}
+EXPORT_SYMBOL(cam_req_mgr_is_open);
+
+bool cam_req_mgr_is_shutdown(void)
+{
+	return g_dev.shutdown_state;
+}
+EXPORT_SYMBOL(cam_req_mgr_is_shutdown);
+
+int cam_register_subdev(struct cam_subdev *csd)
+{
+	struct v4l2_subdev *sd;
+	int rc;
+
+	if (!g_dev.state) {
+		CAM_DBG(CAM_CRM, "camera root device not ready yet");
+		return -EPROBE_DEFER;
+	}
+
+	if (!csd || !csd->name) {
+		CAM_ERR(CAM_CRM, "invalid arguments");
+		return -EINVAL;
+	}
+
+	mutex_lock(&g_dev.dev_lock);
+
+	sd = &csd->sd;
+	v4l2_subdev_init(sd, csd->ops);
+	sd->internal_ops = csd->internal_ops;
+	snprintf(sd->name, sizeof(sd->name), "%s", csd->name);
+	v4l2_set_subdevdata(sd, csd->token);
+
+	sd->flags = csd->sd_flags;
+	sd->entity.num_pads = 0;
+	sd->entity.pads = NULL;
+	sd->entity.function = csd->ent_function;
+
+	list_add(&csd->list, &cam_req_mgr_ordered_sd_list);
+	list_sort(NULL, &cam_req_mgr_ordered_sd_list,
+		cam_req_mgr_ordered_list_cmp);
+
+	rc = v4l2_device_register_subdev(g_dev.v4l2_dev, sd);
+	if (rc) {
+		CAM_ERR(CAM_CRM, "register subdev failed");
+		goto reg_fail;
+	}
+
+	rc = v4l2_device_register_subdev_nodes(g_dev.v4l2_dev);
+	if (rc) {
+		CAM_ERR(CAM_CRM, "Failed to register subdev node: %s, rc: %d",
+			sd->name, rc);
+		goto reg_fail;
+	}
+
+	if (sd->flags & V4L2_SUBDEV_FL_HAS_DEVNODE) {
+		sd->entity.name = video_device_node_name(sd->devnode);
+		CAM_DBG(CAM_CRM, "created node :%s", sd->entity.name);
+	}
+
+	g_dev.count++;
+
+reg_fail:
+	mutex_unlock(&g_dev.dev_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_register_subdev);
+
+int cam_unregister_subdev(struct cam_subdev *csd)
+{
+	if (!g_dev.state) {
+		CAM_ERR(CAM_CRM, "camera root device not ready yet");
+		return -ENODEV;
+	}
+
+	mutex_lock(&g_dev.dev_lock);
+	v4l2_device_unregister_subdev(&csd->sd);
+	g_dev.count--;
+	mutex_unlock(&g_dev.dev_lock);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_unregister_subdev);
+
+static int cam_req_mgr_component_master_bind(struct device *dev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CRM, "Master bind called");
+	rc = cam_v4l2_device_setup(dev);
+	if (rc)
+		return rc;
+
+	rc = cam_media_device_setup(dev);
+	if (rc)
+		goto media_setup_fail;
+
+	rc = cam_video_device_setup();
+	if (rc)
+		goto video_setup_fail;
+
+	g_dev.open_cnt = 0;
+	g_dev.shutdown_state = false;
+	mutex_init(&g_dev.cam_lock);
+	spin_lock_init(&g_dev.cam_eventq_lock);
+	mutex_init(&g_dev.dev_lock);
+
+	rc = cam_req_mgr_util_init();
+	if (rc) {
+		CAM_ERR(CAM_CRM, "cam req mgr util init is failed");
+		goto req_mgr_util_fail;
+	}
+
+	rc = cam_req_mgr_core_device_init();
+	if (rc) {
+		CAM_ERR(CAM_CRM, "core device setup failed");
+		goto req_mgr_core_fail;
+	}
+
+	g_dev.state = true;
+	INIT_LIST_HEAD(&cam_req_mgr_ordered_sd_list);
+
+	if (g_cam_req_mgr_timer_cachep == NULL) {
+		g_cam_req_mgr_timer_cachep = KMEM_CACHE(cam_req_mgr_timer, 0x0);
+
+		if (!g_cam_req_mgr_timer_cachep)
+			CAM_ERR(CAM_CRM,
+				"Failed to create kmem_cache for crm_timer");
+		else
+			CAM_DBG(CAM_CRM, "Name : cam_req_mgr_timer");
+	}
+
+	CAM_INFO(CAM_CRM, "All probes done, binding slave components");
+	rc = component_bind_all(dev, NULL);
+	if (rc) {
+		CAM_ERR(CAM_CRM,
+			"Error in binding all components rc: %d, Camera initialization failed!",
+			rc);
+		goto req_mgr_device_deinit;
+	}
+
+	CAM_DBG(CAM_CRM, "All camera components bound successfully");
+	rc = sysfs_create_file(&dev->kobj, &camera_debug_sysfs_attr.attr);
+	if (rc < 0) {
+		CAM_ERR(CAM_CPAS,
+			"Failed to create debug attribute, rc=%d\n", rc);
+		goto sysfs_fail;
+	}
+
+	return rc;
+
+sysfs_fail:
+	sysfs_remove_file(&dev->kobj, &camera_debug_sysfs_attr.attr);
+req_mgr_device_deinit:
+	cam_req_mgr_core_device_deinit();
+req_mgr_core_fail:
+	cam_req_mgr_util_deinit();
+req_mgr_util_fail:
+	mutex_destroy(&g_dev.dev_lock);
+	mutex_destroy(&g_dev.cam_lock);
+	cam_video_device_cleanup();
+video_setup_fail:
+	cam_media_device_cleanup();
+media_setup_fail:
+	cam_v4l2_device_cleanup();
+	g_dev.state = false;
+	return rc;
+}
+
+static void cam_req_mgr_component_master_unbind(struct device *dev)
+{
+	/* Unbinding all slave components first */
+	component_unbind_all(dev, NULL);
+
+	/* Now proceed with unbinding master */
+	sysfs_remove_file(&dev->kobj, &camera_debug_sysfs_attr.attr);
+	cam_req_mgr_core_device_deinit();
+	cam_req_mgr_util_deinit();
+	cam_media_device_cleanup();
+	cam_video_device_cleanup();
+	cam_v4l2_device_cleanup();
+	mutex_destroy(&g_dev.dev_lock);
+	g_dev.state = false;
+}
+
+static const struct component_master_ops cam_req_mgr_component_master_ops = {
+	.bind = cam_req_mgr_component_master_bind,
+	.unbind = cam_req_mgr_component_master_unbind,
+};
+
+static int cam_req_mgr_remove(struct platform_device *pdev)
+{
+	component_master_del(&pdev->dev, &cam_req_mgr_component_master_ops);
+	return 0;
+}
+
+static int cam_req_mgr_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+	struct component_match *match_list = NULL;
+	struct device *dev = &pdev->dev;
+
+	rc = camera_component_match_add_drivers(dev, &match_list);
+	if (rc) {
+		CAM_ERR(CAM_CRM,
+			"Unable to match components, probe failed rc: %d",
+			rc);
+		goto end;
+	}
+
+	/* Supply match_list to master for handing over control */
+	rc = component_master_add_with_match(dev,
+		&cam_req_mgr_component_master_ops, match_list);
+	if (rc) {
+		CAM_ERR(CAM_CRM,
+			"Unable to add master, probe failed rc: %d",
+			rc);
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+static const struct of_device_id cam_req_mgr_dt_match[] = {
+	{.compatible = "qcom,cam-req-mgr"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_req_mgr_dt_match);
+
+struct platform_driver cam_req_mgr_driver = {
+	.probe = cam_req_mgr_probe,
+	.remove = cam_req_mgr_remove,
+	.driver = {
+		.name = "cam_req_mgr",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_req_mgr_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_req_mgr_init(void)
+{
+	return platform_driver_register(&cam_req_mgr_driver);
+}
+EXPORT_SYMBOL(cam_req_mgr_init);
+
+void cam_req_mgr_exit(void)
+{
+	platform_driver_unregister(&cam_req_mgr_driver);
+}
+
+MODULE_DESCRIPTION("Camera Request Manager");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_dev.h
@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_DEV_H_
+#define _CAM_REQ_MGR_DEV_H_
+
+#include "media/cam_req_mgr.h"
+/**
+ * struct cam_req_mgr_device - a camera request manager device
+ *
+ * @video: pointer to struct video device.
+ * @v4l2_dev: pointer to struct v4l2 device.
+ * @count: number of subdevices registered.
+ * @dev_lock: lock for the subdevice count.
+ * @state: state of the root device.
+ * @open_cnt: open count of subdev
+ * @cam_lock: per file handle lock
+ * @cam_eventq: event queue
+ * @cam_eventq_lock: lock for event queue
+ * @shutdown_state: shutdown state
+ */
+struct cam_req_mgr_device {
+	struct video_device *video;
+	struct v4l2_device *v4l2_dev;
+	int count;
+	struct mutex dev_lock;
+	bool state;
+	int32_t open_cnt;
+	struct mutex cam_lock;
+	struct v4l2_fh *cam_eventq;
+	spinlock_t cam_eventq_lock;
+	bool shutdown_state;
+};
+
+#define CAM_REQ_MGR_GET_PAYLOAD_PTR(ev, type)        \
+	(type *)((char *)ev.u.data)
+
+int cam_req_mgr_notify_message(struct cam_req_mgr_message *msg,
+	uint32_t id,
+	uint32_t type);
+
+/**
+ * @brief : API to register REQ_MGR to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_req_mgr_init(void);
+
+/**
+ * @brief : API to remove REQ_MGR from platform framework.
+ */
+void cam_req_mgr_exit(void);
+
+#endif /* _CAM_REQ_MGR_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_interface.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_req_mgr_interface.h
@@ -0,0 +1,411 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_INTERFACE_H
+#define _CAM_REQ_MGR_INTERFACE_H
+
+#include <linux/types.h>
+#include <media/cam_req_mgr.h>
+#include "cam_req_mgr_core_defs.h"
+#include "cam_req_mgr_util.h"
+
+struct cam_req_mgr_trigger_notify;
+struct cam_req_mgr_error_notify;
+struct cam_req_mgr_add_request;
+struct cam_req_mgr_timer_notify;
+struct cam_req_mgr_notify_stop;
+struct cam_req_mgr_device_info;
+struct cam_req_mgr_core_dev_link_setup;
+struct cam_req_mgr_apply_request;
+struct cam_req_mgr_flush_request;
+struct cam_req_mgr_link_evt_data;
+struct cam_req_mgr_dump_info;
+
+/* Request Manager -- camera device driver interface */
+/**
+ * @brief: camera kernel drivers to cam req mgr communication
+ *
+ * @cam_req_mgr_notify_trigger: for device which generates trigger to inform CRM
+ * @cam_req_mgr_notify_err    : device use this to inform about different errors
+ * @cam_req_mgr_add_req       : to info CRM about new rqeuest received from
+ *                              userspace
+ * @cam_req_mgr_notify_timer  : start the timer
+ */
+typedef int (*cam_req_mgr_notify_trigger)(struct cam_req_mgr_trigger_notify *);
+typedef int (*cam_req_mgr_notify_err)(struct cam_req_mgr_error_notify *);
+typedef int (*cam_req_mgr_add_req)(struct cam_req_mgr_add_request *);
+typedef int (*cam_req_mgr_notify_timer)(struct cam_req_mgr_timer_notify *);
+typedef int (*cam_req_mgr_notify_stop)(struct cam_req_mgr_notify_stop *);
+
+/**
+ * @brief: cam req mgr to camera device drivers
+ *
+ * @cam_req_mgr_get_dev_info     : to fetch details about device linked
+ * @cam_req_mgr_link_setup       : to establish link with device for a session
+ * @cam_req_mgr_apply_req        : CRM asks device to apply certain request id
+ * @cam_req_mgr_notify_frame_skip: CRM asks device to apply setting for
+ *                                 frame skip
+ * @cam_req_mgr_flush_req        : Flush or cancel request
+ * cam_req_mgr_process_evt       : generic events
+ * @cam_req_mgr_dump_req         : dump request
+ */
+typedef int (*cam_req_mgr_get_dev_info) (struct cam_req_mgr_device_info *);
+typedef int (*cam_req_mgr_link_setup)(struct cam_req_mgr_core_dev_link_setup *);
+typedef int (*cam_req_mgr_apply_req)(struct cam_req_mgr_apply_request *);
+typedef int (*cam_req_mgr_notify_frame_skip)(
+	struct cam_req_mgr_apply_request *);
+typedef int (*cam_req_mgr_flush_req)(struct cam_req_mgr_flush_request *);
+typedef int (*cam_req_mgr_process_evt)(struct cam_req_mgr_link_evt_data *);
+typedef int (*cam_req_mgr_dump_req)(struct cam_req_mgr_dump_info *);
+
+/**
+ * @brief          : cam_req_mgr_crm_cb - func table
+ *
+ * @notify_trigger : payload for trigger indication event
+ * @notify_err     : payload for different error occurred at device
+ * @add_req        : payload to inform which device and what request is received
+ * @notify_timer   : payload for timer start event
+ * @notify_stop    : payload to inform stop event
+ */
+struct cam_req_mgr_crm_cb {
+	cam_req_mgr_notify_trigger  notify_trigger;
+	cam_req_mgr_notify_err      notify_err;
+	cam_req_mgr_add_req         add_req;
+	cam_req_mgr_notify_timer    notify_timer;
+	cam_req_mgr_notify_stop     notify_stop;
+};
+
+/**
+ * @brief        : cam_req_mgr_kmd_ops - func table
+ *
+ * @get_dev_info     : payload to fetch device details
+ * @link_setup       : payload to establish link with device
+ * @apply_req        : payload to apply request id on a device linked
+ * @notify_frame_skip: payload to notify frame skip
+ * @flush_req        : payload to flush request
+ * @process_evt      : payload to generic event
+ * @dump_req         : payload to dump request
+ */
+struct cam_req_mgr_kmd_ops {
+	cam_req_mgr_get_dev_info      get_dev_info;
+	cam_req_mgr_link_setup        link_setup;
+	cam_req_mgr_apply_req         apply_req;
+	cam_req_mgr_notify_frame_skip notify_frame_skip;
+	cam_req_mgr_flush_req         flush_req;
+	cam_req_mgr_process_evt       process_evt;
+	cam_req_mgr_dump_req          dump_req;
+};
+
+/**
+ * enum cam_pipeline_delay
+ * @brief     : enumerator for different pipeline delays in camera
+ *
+ * @DELAY_0   : device processed settings on same frame
+ * @DELAY_1   : device processed settings after 1 frame
+ * @DELAY_2   : device processed settings after 2 frames
+ * @DELAY_MAX : maximum supported pipeline delay
+ */
+enum cam_pipeline_delay {
+	CAM_PIPELINE_DELAY_0,
+	CAM_PIPELINE_DELAY_1,
+	CAM_PIPELINE_DELAY_2,
+	CAM_PIPELINE_DELAY_MAX,
+};
+
+/**
+ * @CAM_TRIGGER_POINT_SOF   : Trigger point for Start Of Frame
+ * @CAM_TRIGGER_POINT_EOF   : Trigger point for End Of Frame
+ * @CAM_TRIGGER_MAX_POINTS  : Maximum number of trigger point
+ */
+#define CAM_TRIGGER_POINT_SOF     (1 << 0)
+#define CAM_TRIGGER_POINT_EOF     (1 << 1)
+#define CAM_TRIGGER_MAX_POINTS    2
+
+/**
+ * enum cam_req_status
+ * @brief   : enumerator for request status
+ *
+ * @SUCCESS : device processed settings successfully
+ * @FAILED  : device processed settings failed
+ * @MAX     : invalid status value
+ */
+enum cam_req_status {
+	CAM_REQ_STATUS_SUCCESS,
+	CAM_REQ_STATUS_FAILED,
+	CAM_REQ_STATUS_MAX,
+};
+
+/**
+ * enum cam_req_mgr_device_error
+ * @brief      : enumerator for different errors occurred at device
+ *
+ * @NOT_FOUND  : settings asked by request manager is not found
+ * @BUBBLE     : device hit timing issue and is able to recover
+ * @FATAL      : device is in bad shape and can not recover from error
+ * @PAGE_FAULT : Page fault while accessing memory
+ * @OVERFLOW   : Bus Overflow for IFE/VFE
+ * @TIMEOUT    : Timeout from cci or bus.
+ * @MAX        : Invalid error value
+ */
+enum cam_req_mgr_device_error {
+	CRM_KMD_ERR_NOT_FOUND,
+	CRM_KMD_ERR_BUBBLE,
+	CRM_KMD_ERR_FATAL,
+	CRM_KMD_ERR_PAGE_FAULT,
+	CRM_KMD_ERR_OVERFLOW,
+	CRM_KMD_ERR_TIMEOUT,
+	CRM_KMD_ERR_STOPPED,
+	CRM_KMD_ERR_MAX,
+};
+
+/**
+ * enum cam_req_mgr_device_id
+ * @brief       : enumerator for different devices in subsystem
+ *
+ * @CAM_REQ_MGR : request manager itself
+ * @SENSOR      : sensor device
+ * @FLASH       : LED flash or dual LED device
+ * @ACTUATOR    : lens mover
+ * @IFE         : Image processing device
+ * @CUSTOM      : Custom HW block
+ * @EXTERNAL_1  : third party device
+ * @EXTERNAL_2  : third party device
+ * @EXTERNAL_3  : third party device
+ * @MAX         : invalid device id
+ */
+enum cam_req_mgr_device_id {
+	CAM_REQ_MGR_DEVICE,
+	CAM_REQ_MGR_DEVICE_SENSOR,
+	CAM_REQ_MGR_DEVICE_FLASH,
+	CAM_REQ_MGR_DEVICE_ACTUATOR,
+	CAM_REQ_MGR_DEVICE_IFE,
+	CAM_REQ_MGR_DEVICE_CUSTOM_HW,
+	CAM_REQ_MGR_DEVICE_EXTERNAL_1,
+	CAM_REQ_MGR_DEVICE_EXTERNAL_2,
+	CAM_REQ_MGR_DEVICE_EXTERNAL_3,
+	CAM_REQ_MGR_DEVICE_ID_MAX,
+};
+
+/* Camera device driver to Req Mgr device interface */
+
+/**
+ * enum cam_req_mgr_link_evt_type
+ * @CAM_REQ_MGR_LINK_EVT_ERR             : error on the link from any of the
+ *                                         connected devices
+ * @CAM_REQ_MGR_LINK_EVT_PAUSE           : to pause the link
+ * @CAM_REQ_MGR_LINK_EVT_RESUME          : resumes the link which was paused
+ * @CAM_REQ_MGR_LINK_EVT_SOF_FREEZE      : request manager has detected an
+ *                                         sof freeze
+ * @CAM_REQ_MGR_LINK_EVT_MAX             : invalid event type
+ */
+enum cam_req_mgr_link_evt_type {
+	CAM_REQ_MGR_LINK_EVT_ERR,
+	CAM_REQ_MGR_LINK_EVT_PAUSE,
+	CAM_REQ_MGR_LINK_EVT_RESUME,
+	CAM_REQ_MGR_LINK_EVT_SOF_FREEZE,
+	CAM_REQ_MGR_LINK_EVT_MAX,
+};
+
+/**
+ * struct cam_req_mgr_trigger_notify
+ * @link_hdl : link identifier
+ * @dev_hdl  : device handle which has sent this req id
+ * @frame_id : frame id for internal tracking
+ * @trigger  : trigger point of this notification, CRM will send apply
+ *             only to the devices which subscribe to this point.
+ * @sof_timestamp_val: Captured time stamp value at sof hw event
+ * @req_id   : req id which returned buf_done
+ * @trigger_id: ID to differentiate between the trigger devices
+ */
+struct cam_req_mgr_trigger_notify {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	int64_t  frame_id;
+	uint32_t trigger;
+	uint64_t sof_timestamp_val;
+	uint64_t req_id;
+	int32_t  trigger_id;
+};
+
+/**
+ * struct cam_req_mgr_timer_notify
+ * @link_hdl : link identifier
+ * @dev_hdl  : device handle which has sent this req id
+ * @state    : timer state i.e ON or OFF
+ */
+struct cam_req_mgr_timer_notify {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	bool     state;
+};
+
+/**
+ * struct cam_req_mgr_error_notify
+ * @link_hdl : link identifier
+ * @dev_hdl  : device handle which has sent this req id
+ * @req_id   : req id which hit error
+ * @frame_id : frame id for internal tracking
+ * @trigger  : trigger point of this notification, CRM will send apply
+ * @sof_timestamp_val : Captured time stamp value at sof hw event
+ * @error    : what error device hit while processing this req
+ */
+struct cam_req_mgr_error_notify {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	uint64_t req_id;
+	int64_t  frame_id;
+	uint32_t trigger;
+	uint64_t sof_timestamp_val;
+	enum cam_req_mgr_device_error error;
+};
+
+/**
+ * struct cam_req_mgr_add_request
+ * @link_hdl             : link identifier
+ * @dev_hdl              : device handle which has sent this req id
+ * @req_id               : req id which device is ready to process
+ * @skip_at_sof          : before applying req mgr introduce bubble
+ *                         by not sending request to devices. ex: IFE and Flash
+ * @skip_at_eof          : before applying req mgr introduce bubble
+ *                         by not sending request to devices. ex: IFE and Flash
+ * @trigger_eof          : to identify that one of the device at this slot needs
+ *                         to be apply at EOF
+ */
+struct cam_req_mgr_add_request {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	uint64_t req_id;
+	uint32_t skip_at_sof;
+	uint32_t skip_at_eof;
+	bool     trigger_eof;
+};
+
+
+/**
+ * struct cam_req_mgr_notify_stop
+ * @link_hdl             : link identifier
+ *
+ */
+struct cam_req_mgr_notify_stop {
+	int32_t  link_hdl;
+};
+
+
+/* CRM to KMD devices */
+/**
+ * struct cam_req_mgr_device_info
+ * @dev_hdl : Input_param : device handle for reference
+ * @name    : link link or unlink
+ * @dev_id  : device id info
+ * @p_delay : delay between time settings applied and take effect
+ * @trigger : Trigger point for the client
+ * @trigger_on : This device provides trigger
+ */
+struct cam_req_mgr_device_info {
+	int32_t                     dev_hdl;
+	char                        name[256];
+	enum cam_req_mgr_device_id  dev_id;
+	enum cam_pipeline_delay     p_delay;
+	uint32_t                    trigger;
+	bool                        trigger_on;
+};
+
+/**
+ * struct cam_req_mgr_core_dev_link_setup
+ * @link_enable     : link or unlink
+ * @link_hdl        : link identifier
+ * @dev_hdl         : device handle for reference
+ * @max_delay       : max pipeline delay on this link
+ * @crm_cb          : callback funcs to communicate with req mgr
+ * @trigger_id      : Unique ID provided to the triggering device
+ */
+struct cam_req_mgr_core_dev_link_setup {
+	int32_t                    link_enable;
+	int32_t                    link_hdl;
+	int32_t                    dev_hdl;
+	enum cam_pipeline_delay    max_delay;
+	struct cam_req_mgr_crm_cb *crm_cb;
+	int32_t                    trigger_id;
+};
+
+/**
+ * struct cam_req_mgr_apply_request
+ * @link_hdl         : link identifier
+ * @dev_hdl          : device handle for cross check
+ * @request_id       : request id settings to apply
+ * @report_if_bubble : report to crm if failure in applying
+ * @trigger_point    : the trigger point of this apply
+ * @re_apply         : to skip re_apply for buf_done request
+ *
+ */
+struct cam_req_mgr_apply_request {
+	int32_t    link_hdl;
+	int32_t    dev_hdl;
+	uint64_t   request_id;
+	int32_t    report_if_bubble;
+	uint32_t   trigger_point;
+	bool       re_apply;
+};
+
+/**
+ * struct cam_req_mgr_flush_request
+ * @link_hdl    : link identifier
+ * @dev_hdl     : device handle for cross check
+ * @type        : cancel request type flush all or a request
+ * @req_id      : request id to cancel
+ *
+ */
+struct cam_req_mgr_flush_request {
+	int32_t     link_hdl;
+	int32_t     dev_hdl;
+	uint32_t    type;
+	uint64_t    req_id;
+};
+
+/**
+ * struct cam_req_mgr_event_data
+ * @link_hdl          : link handle
+ * @req_id            : request id
+ * @evt_type          : link event
+ */
+struct cam_req_mgr_link_evt_data {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	uint64_t req_id;
+	enum cam_req_mgr_link_evt_type evt_type;
+	union {
+		enum cam_req_mgr_device_error error;
+	} u;
+};
+
+/**
+ * struct cam_req_mgr_send_request
+ * @link_hdl   : link identifier
+ * @in_q       : input request queue pointer
+ */
+struct cam_req_mgr_send_request {
+	int32_t    link_hdl;
+	struct cam_req_mgr_req_queue *in_q;
+};
+
+/**
+ * struct cam_req_mgr_dump_info
+ * @req_id      : request id to dump
+ * @offset      : offset of buffer
+ * @error_type  : error type
+ * @buf_handle  : buf handle
+ * @link_hdl    : link identifier
+ * @dev_hdl     : device handle for cross check
+ *
+ */
+struct cam_req_mgr_dump_info {
+	uint64_t    req_id;
+	size_t      offset;
+	uint32_t    error_type;
+	uint32_t    buf_handle;
+	int32_t     link_hdl;
+	int32_t     dev_hdl;
+};
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_subdev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_req_mgr/cam_subdev.h
@@ -0,0 +1,174 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SUBDEV_H_
+#define _CAM_SUBDEV_H_
+
+#include <linux/types.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+
+#define CAM_SUBDEVICE_EVENT_MAX 30
+
+enum cam_subdev_message_type_t {
+	CAM_SUBDEV_MESSAGE_IRQ_ERR = 0x1,
+	CAM_SUBDEV_MESSAGE_CLOCK_UPDATE
+};
+
+/* Enum for close sequence priority */
+enum cam_subdev_close_seq_priority {
+	CAM_SD_CLOSE_HIGH_PRIORITY,
+	CAM_SD_CLOSE_MEDIUM_PRIORITY,
+	CAM_SD_CLOSE_LOW_PRIORITY
+};
+
+enum cam_subdev_rwsem {
+	CAM_SUBDEV_LOCK = 1,
+	CAM_SUBDEV_UNLOCK,
+};
+
+/**
+ * struct cam_subdev - describes a camera sub-device
+ *
+ * @pdev:                  Pointer to the platform device
+ * @sd:                    V4l2 subdevice
+ * @ops:                   V4l2 subdecie operations
+ * @internal_ops:          V4l2 subdevice internal operations
+ * @name:                  Name of the sub-device. Please notice that the name
+ *                             must be unique.
+ * @sd_flags:              Subdev flags. Can be:
+ *                             %V4L2_SUBDEV_FL_HAS_DEVNODE - Set this flag if
+ *                                 this subdev needs a device node.
+ *                             %V4L2_SUBDEV_FL_HAS_EVENTS -  Set this flag if
+ *                                 this subdev generates events.
+ * @token:                 Pointer to cookie of the client driver
+ * @ent_function:          Media entity function type. Can be:
+ *                             %CAM_IFE_DEVICE_TYPE - identifies as IFE device.
+ *                             %CAM_ICP_DEVICE_TYPE - identifies as ICP device.
+ * @list:                  list pointer
+ * @close_seq_prior:         cam_subdev_close_seq_priority type
+ *
+ * Each instance of a subdev driver should create this struct, either
+ * stand-alone or embedded in a larger struct. This structure should be
+ * initialized/registered by cam_register_subdev
+ *
+ */
+struct cam_subdev {
+	struct platform_device                *pdev;
+	struct v4l2_subdev                     sd;
+	const struct v4l2_subdev_ops          *ops;
+	const struct v4l2_subdev_internal_ops *internal_ops;
+	char                                  *name;
+	u32                                    sd_flags;
+	void                                  *token;
+	u32                                    ent_function;
+	void                                  (*msg_cb)(
+					struct v4l2_subdev *sd,
+					enum cam_subdev_message_type_t msg_type,
+					uint32_t data);
+	struct list_head                       list;
+	enum cam_subdev_close_seq_priority     close_seq_prior;
+};
+
+/**
+ * cam_subdev_notify_message()
+ *
+ * @brief:  Notify message to a subdevs of specific type
+ *
+ * @subdev_type:           Subdev type
+ * @message_type:          message type
+ * @data:                  data to be delivered.
+ *
+ */
+void cam_subdev_notify_message(u32 subdev_type,
+		enum cam_subdev_message_type_t message_type,
+		uint32_t data);
+
+/**
+ * cam_subdev_probe()
+ *
+ * @brief:      Camera Subdevice node probe function for v4l2 setup
+ *
+ * @sd:                    Camera subdevice object
+ * @name:                  Name of the subdevice node
+ * @dev_type:              Subdevice node type
+ *
+ */
+int cam_subdev_probe(struct cam_subdev *sd, struct platform_device *pdev,
+	char *name, uint32_t dev_type);
+
+/**
+ * cam_subdev_register()
+ *
+ * @brief:      Camera Subdevice node probe function for v4l2 setup
+ *
+ * @sd:                    Camera subdevice object
+ * @pdev:                  Pointer to the platform device
+ *
+ */
+int cam_subdev_register(struct cam_subdev *sd, struct platform_device *pdev);
+
+/**
+ * cam_subdev_remove()
+ *
+ * @brief:      Called when subdevice node is unloaded
+ *
+ * @sd:                    Camera subdevice node object
+ *
+ */
+int cam_subdev_remove(struct cam_subdev *sd);
+
+/**
+ * cam_register_subdev()
+ *
+ * @brief:   This is the common utility function to be called by each camera
+ *           subdevice node when it tries to register itself to the camera
+ *           request manager
+ *
+ * @sd:                    Pointer to struct cam_subdev.
+ */
+int cam_register_subdev(struct cam_subdev *sd);
+
+/**
+ * cam_unregister_subdev()
+ *
+ * @brief:    This is the common utility function to be called by each camera
+ *            subdevice node when it tries to unregister itself from the
+ *            camera request manger
+ *
+ * @sd:                    Pointer to struct cam_subdev.
+ */
+int cam_unregister_subdev(struct cam_subdev *sd);
+
+/**
+ * cam_req_mgr_rwsem_read_op()
+ *
+ * @brief : API to acquire read semaphore lock to platform framework.
+ *
+ * @lock  : value indicates to lock or unlock the read lock
+ */
+void cam_req_mgr_rwsem_read_op(enum cam_subdev_rwsem lock);
+
+/**
+ * cam_req_mgr_is_open()
+ *
+ * @brief:    This common utility function returns the crm active status
+ *
+ */
+bool  cam_req_mgr_is_open(void);
+
+/**
+ * cam_req_mgr_is_shutdown()
+ *
+ * @brief:    This common utility function returns the shutdown state
+ */
+bool cam_req_mgr_is_shutdown(void);
+
+#endif /* _CAM_SUBDEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c
@@ -0,0 +1,1098 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <cam_sensor_cmn_header.h>
+#include "cam_actuator_core.h"
+#include "cam_sensor_util.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+
+int32_t cam_actuator_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int rc = 0;
+
+	power_info->power_setting_size = 1;
+	power_info->power_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_setting)
+		return -ENOMEM;
+
+	power_info->power_setting[0].seq_type = SENSOR_VAF;
+	power_info->power_setting[0].seq_val = CAM_VAF;
+	power_info->power_setting[0].config_val = 1;
+	power_info->power_setting[0].delay = 2;
+
+	power_info->power_down_setting_size = 1;
+	power_info->power_down_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_down_setting) {
+		rc = -ENOMEM;
+		goto free_power_settings;
+	}
+
+	power_info->power_down_setting[0].seq_type = SENSOR_VAF;
+	power_info->power_down_setting[0].seq_val = CAM_VAF;
+	power_info->power_down_setting[0].config_val = 0;
+
+	return rc;
+
+free_power_settings:
+	kfree(power_info->power_setting);
+	power_info->power_setting = NULL;
+	power_info->power_setting_size = 0;
+	return rc;
+}
+
+static int32_t cam_actuator_power_up(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	int rc = 0;
+	struct cam_hw_soc_info  *soc_info =
+		&a_ctrl->soc_info;
+	struct cam_actuator_soc_private  *soc_private;
+	struct cam_sensor_power_ctrl_t *power_info;
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	if ((power_info->power_setting == NULL) &&
+		(power_info->power_down_setting == NULL)) {
+		CAM_INFO(CAM_ACTUATOR,
+			"Using default power settings");
+		rc = cam_actuator_construct_default_power_setting(power_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Construct default actuator power setting failed.");
+			return rc;
+		}
+	}
+
+	/* Parse and fill vreg params for power up settings */
+	rc = msm_camera_fill_vreg_params(
+		&a_ctrl->soc_info,
+		power_info->power_setting,
+		power_info->power_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR,
+			"failed to fill vreg params for power up rc:%d", rc);
+		return rc;
+	}
+
+	/* Parse and fill vreg params for power down settings*/
+	rc = msm_camera_fill_vreg_params(
+		&a_ctrl->soc_info,
+		power_info->power_down_setting,
+		power_info->power_down_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR,
+			"failed to fill vreg params power down rc:%d", rc);
+		return rc;
+	}
+
+	power_info->dev = soc_info->dev;
+
+	rc = cam_sensor_core_power_up(power_info, soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR,
+			"failed in actuator power up rc %d", rc);
+		return rc;
+	}
+
+	rc = camera_io_init(&a_ctrl->io_master_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "cci init failed: rc: %d", rc);
+		goto cci_failure;
+	}
+
+	return rc;
+cci_failure:
+	if (cam_sensor_util_power_down(power_info, soc_info))
+		CAM_ERR(CAM_ACTUATOR, "Power down failure");
+
+	return rc;
+}
+
+static int32_t cam_actuator_power_down(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_power_ctrl_t *power_info;
+	struct cam_hw_soc_info *soc_info = &a_ctrl->soc_info;
+	struct cam_actuator_soc_private  *soc_private;
+
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "failed: a_ctrl %pK", a_ctrl);
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+	soc_info = &a_ctrl->soc_info;
+
+	if (!power_info) {
+		CAM_ERR(CAM_ACTUATOR, "failed: power_info %pK", power_info);
+		return -EINVAL;
+	}
+	rc = cam_sensor_util_power_down(power_info, soc_info);
+	if (rc) {
+		CAM_ERR(CAM_ACTUATOR, "power down the core is failed:%d", rc);
+		return rc;
+	}
+
+	camera_io_release(&a_ctrl->io_master_info);
+
+	return rc;
+}
+
+static int32_t cam_actuator_i2c_modes_util(
+	struct camera_io_master *io_master_info,
+	struct i2c_settings_list *i2c_list)
+{
+	int32_t rc = 0;
+	uint32_t i, size;
+
+	if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_RANDOM) {
+		rc = camera_io_dev_write(io_master_info,
+			&(i2c_list->i2c_settings));
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to random write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_SEQ) {
+		rc = camera_io_dev_write_continuous(
+			io_master_info,
+			&(i2c_list->i2c_settings),
+			0);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to seq write I2C settings: %d",
+				rc);
+			return rc;
+			}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_BURST) {
+		rc = camera_io_dev_write_continuous(
+			io_master_info,
+			&(i2c_list->i2c_settings),
+			1);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to burst write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_POLL) {
+		size = i2c_list->i2c_settings.size;
+		for (i = 0; i < size; i++) {
+			rc = camera_io_dev_poll(
+			io_master_info,
+			i2c_list->i2c_settings.reg_setting[i].reg_addr,
+			i2c_list->i2c_settings.reg_setting[i].reg_data,
+			i2c_list->i2c_settings.reg_setting[i].data_mask,
+			i2c_list->i2c_settings.addr_type,
+			i2c_list->i2c_settings.data_type,
+			i2c_list->i2c_settings.reg_setting[i].delay);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR,
+					"i2c poll apply setting Fail: %d", rc);
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int32_t cam_actuator_slaveInfo_pkt_parser(struct cam_actuator_ctrl_t *a_ctrl,
+	uint32_t *cmd_buf, size_t len)
+{
+	int32_t rc = 0;
+	struct cam_cmd_i2c_info *i2c_info;
+
+	if (!a_ctrl || !cmd_buf || (len < sizeof(struct cam_cmd_i2c_info))) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+	if (a_ctrl->io_master_info.master_type == CCI_MASTER) {
+		a_ctrl->io_master_info.cci_client->cci_i2c_master =
+			a_ctrl->cci_i2c_master;
+		a_ctrl->io_master_info.cci_client->i2c_freq_mode =
+			i2c_info->i2c_freq_mode;
+		a_ctrl->io_master_info.cci_client->sid =
+			i2c_info->slave_addr >> 1;
+		CAM_DBG(CAM_ACTUATOR, "Slave addr: 0x%x Freq Mode: %d",
+			i2c_info->slave_addr, i2c_info->i2c_freq_mode);
+	} else if (a_ctrl->io_master_info.master_type == I2C_MASTER) {
+		a_ctrl->io_master_info.client->addr = i2c_info->slave_addr;
+		CAM_DBG(CAM_ACTUATOR, "Slave addr: 0x%x", i2c_info->slave_addr);
+	} else {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Master type: %d",
+			a_ctrl->io_master_info.master_type);
+		 rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int32_t cam_actuator_apply_settings(struct cam_actuator_ctrl_t *a_ctrl,
+	struct i2c_settings_array *i2c_set)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0;
+
+	if (a_ctrl == NULL || i2c_set == NULL) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (i2c_set->is_settings_valid != 1) {
+		CAM_ERR(CAM_ACTUATOR, " Invalid settings");
+		return -EINVAL;
+	}
+
+	list_for_each_entry(i2c_list,
+		&(i2c_set->list_head), list) {
+		rc = cam_actuator_i2c_modes_util(
+			&(a_ctrl->io_master_info),
+			i2c_list);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to apply settings: %d",
+				rc);
+		} else {
+			CAM_DBG(CAM_ACTUATOR,
+				"Success:request ID: %d",
+				i2c_set->request_id);
+		}
+	}
+
+	return rc;
+}
+
+int32_t cam_actuator_apply_request(struct cam_req_mgr_apply_request *apply)
+{
+	int32_t rc = 0, request_id, del_req_id;
+	struct cam_actuator_ctrl_t *a_ctrl = NULL;
+
+	if (!apply) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Input Args");
+		return -EINVAL;
+	}
+
+	a_ctrl = (struct cam_actuator_ctrl_t *)
+		cam_get_device_priv(apply->dev_hdl);
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Device data is NULL");
+		return -EINVAL;
+	}
+	request_id = apply->request_id % MAX_PER_FRAME_ARRAY;
+
+	trace_cam_apply_req("Actuator", apply->request_id);
+
+	CAM_DBG(CAM_ACTUATOR, "Request Id: %lld", apply->request_id);
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	if ((apply->request_id ==
+		a_ctrl->i2c_data.per_frame[request_id].request_id) &&
+		(a_ctrl->i2c_data.per_frame[request_id].is_settings_valid)
+		== 1) {
+		rc = cam_actuator_apply_settings(a_ctrl,
+			&a_ctrl->i2c_data.per_frame[request_id]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in applying the request: %lld\n",
+				apply->request_id);
+			goto release_mutex;
+		}
+	}
+	del_req_id = (request_id +
+		MAX_PER_FRAME_ARRAY - MAX_SYSTEM_PIPELINE_DELAY) %
+		MAX_PER_FRAME_ARRAY;
+
+	if (apply->request_id >
+		a_ctrl->i2c_data.per_frame[del_req_id].request_id) {
+		a_ctrl->i2c_data.per_frame[del_req_id].request_id = 0;
+		rc = delete_request(&a_ctrl->i2c_data.per_frame[del_req_id]);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Fail deleting the req: %d err: %d\n",
+				del_req_id, rc);
+			goto release_mutex;
+		}
+	} else {
+		CAM_DBG(CAM_ACTUATOR, "No Valid Req to clean Up");
+	}
+
+release_mutex:
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+	return rc;
+}
+
+int32_t cam_actuator_establish_link(
+	struct cam_req_mgr_core_dev_link_setup *link)
+{
+	struct cam_actuator_ctrl_t *a_ctrl = NULL;
+
+	if (!link) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	a_ctrl = (struct cam_actuator_ctrl_t *)
+		cam_get_device_priv(link->dev_hdl);
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	if (link->link_enable) {
+		a_ctrl->bridge_intf.link_hdl = link->link_hdl;
+		a_ctrl->bridge_intf.crm_cb = link->crm_cb;
+	} else {
+		a_ctrl->bridge_intf.link_hdl = -1;
+		a_ctrl->bridge_intf.crm_cb = NULL;
+	}
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+
+	return 0;
+}
+
+static int cam_actuator_update_req_mgr(
+	struct cam_actuator_ctrl_t *a_ctrl,
+	struct cam_packet *csl_packet)
+{
+	int rc = 0;
+	struct cam_req_mgr_add_request add_req;
+
+	memset(&add_req, 0, sizeof(add_req));
+	add_req.link_hdl = a_ctrl->bridge_intf.link_hdl;
+	add_req.req_id = csl_packet->header.request_id;
+	add_req.dev_hdl = a_ctrl->bridge_intf.device_hdl;
+
+	if (a_ctrl->bridge_intf.crm_cb &&
+		a_ctrl->bridge_intf.crm_cb->add_req) {
+		rc = a_ctrl->bridge_intf.crm_cb->add_req(&add_req);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Adding request: %llu failed: rc: %d",
+				csl_packet->header.request_id, rc);
+			return rc;
+		}
+		CAM_DBG(CAM_ACTUATOR, "Request Id: %lld added to CRM",
+			add_req.req_id);
+	} else {
+		CAM_ERR(CAM_ACTUATOR, "Can't add Request ID: %lld to CRM",
+			csl_packet->header.request_id);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int32_t cam_actuator_publish_dev_info(struct cam_req_mgr_device_info *info)
+{
+	if (!info) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	info->dev_id = CAM_REQ_MGR_DEVICE_ACTUATOR;
+	strscpy(info->name, CAM_ACTUATOR_NAME, sizeof(info->name));
+	info->p_delay = 1;
+	info->trigger = CAM_TRIGGER_POINT_SOF;
+
+	return 0;
+}
+
+static int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
+	void *arg)
+{
+	int32_t  rc = 0;
+	int32_t  i = 0;
+	uint32_t total_cmd_buf_in_bytes = 0;
+	size_t   len_of_buff = 0;
+	size_t   remain_len = 0;
+	uint32_t *offset = NULL;
+	uint32_t *cmd_buf = NULL;
+	uintptr_t generic_ptr;
+	uintptr_t generic_pkt_ptr;
+	struct common_header      *cmm_hdr = NULL;
+	struct cam_control        *ioctl_ctrl = NULL;
+	struct cam_packet         *csl_packet = NULL;
+	struct cam_config_dev_cmd config;
+	struct i2c_data_settings  *i2c_data = NULL;
+	struct i2c_settings_array *i2c_reg_settings = NULL;
+	struct cam_cmd_buf_desc   *cmd_desc = NULL;
+	struct cam_actuator_soc_private *soc_private = NULL;
+	struct cam_sensor_power_ctrl_t  *power_info = NULL;
+
+	if (!a_ctrl || !arg) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+
+	power_info = &soc_private->power_info;
+
+	ioctl_ctrl = (struct cam_control *)arg;
+	if (copy_from_user(&config,
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(config)))
+		return -EFAULT;
+	rc = cam_mem_get_cpu_buf(config.packet_handle,
+		&generic_pkt_ptr, &len_of_buff);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "Error in converting command Handle %d",
+			rc);
+		return rc;
+	}
+
+	remain_len = len_of_buff;
+	if ((sizeof(struct cam_packet) > len_of_buff) ||
+		((size_t)config.offset >= len_of_buff -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_ACTUATOR,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len_of_buff);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	remain_len -= (size_t)config.offset;
+	csl_packet = (struct cam_packet *)
+			(generic_pkt_ptr + (uint32_t)config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid packet params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ACTUATOR, "Pkt opcode: %d",	csl_packet->header.op_code);
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) !=
+		CAM_ACTUATOR_PACKET_OPCODE_INIT &&
+		csl_packet->header.request_id <= a_ctrl->last_flush_req
+		&& a_ctrl->last_flush_req != 0) {
+		CAM_DBG(CAM_ACTUATOR,
+			"reject request %lld, last request to flush %lld",
+			csl_packet->header.request_id, a_ctrl->last_flush_req);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (csl_packet->header.request_id > a_ctrl->last_flush_req)
+		a_ctrl->last_flush_req = 0;
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_ACTUATOR_PACKET_OPCODE_INIT:
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+		/* Loop through multiple command buffers */
+		for (i = 0; i < csl_packet->num_cmd_buf; i++) {
+			rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+			if (rc)
+				return rc;
+
+			total_cmd_buf_in_bytes = cmd_desc[i].length;
+			if (!total_cmd_buf_in_bytes)
+				continue;
+			rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+					&generic_ptr, &len_of_buff);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR, "Failed to get cpu buf");
+				goto end;
+			}
+			cmd_buf = (uint32_t *)generic_ptr;
+			if (!cmd_buf) {
+				CAM_ERR(CAM_ACTUATOR, "invalid cmd buf");
+				rc = -EINVAL;
+				goto end;
+			}
+			if ((len_of_buff < sizeof(struct common_header)) ||
+				(cmd_desc[i].offset > (len_of_buff -
+				sizeof(struct common_header)))) {
+				CAM_ERR(CAM_ACTUATOR,
+					"Invalid length for sensor cmd");
+				rc = -EINVAL;
+				goto end;
+			}
+			remain_len = len_of_buff - cmd_desc[i].offset;
+			cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+			cmm_hdr = (struct common_header *)cmd_buf;
+
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				CAM_DBG(CAM_ACTUATOR,
+					"Received slave info buffer");
+				rc = cam_actuator_slaveInfo_pkt_parser(
+					a_ctrl, cmd_buf, remain_len);
+				if (rc < 0) {
+					CAM_ERR(CAM_ACTUATOR,
+					"Failed to parse slave info: %d", rc);
+					goto end;
+				}
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
+			case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
+				CAM_DBG(CAM_ACTUATOR,
+					"Received power settings buffer");
+				rc = cam_sensor_update_power_settings(
+					cmd_buf,
+					total_cmd_buf_in_bytes,
+					power_info, remain_len);
+				if (rc) {
+					CAM_ERR(CAM_ACTUATOR,
+					"Failed:parse power settings: %d",
+					rc);
+					goto end;
+				}
+				break;
+			default:
+				CAM_DBG(CAM_ACTUATOR,
+					"Received initSettings buffer");
+				i2c_data = &(a_ctrl->i2c_data);
+				i2c_reg_settings =
+					&i2c_data->init_settings;
+
+				i2c_reg_settings->request_id = 0;
+				i2c_reg_settings->is_settings_valid = 1;
+				rc = cam_sensor_i2c_command_parser(
+					&a_ctrl->io_master_info,
+					i2c_reg_settings,
+					&cmd_desc[i], 1, NULL);
+				if (rc < 0) {
+					CAM_ERR(CAM_ACTUATOR,
+					"Failed:parse init settings: %d",
+					rc);
+					goto end;
+				}
+				break;
+			}
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+		}
+
+		if (a_ctrl->cam_act_state == CAM_ACTUATOR_ACQUIRE) {
+			rc = cam_actuator_power_up(a_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR,
+					" Actuator Power up failed");
+				goto end;
+			}
+			a_ctrl->cam_act_state = CAM_ACTUATOR_CONFIG;
+		}
+
+		rc = cam_actuator_apply_settings(a_ctrl,
+			&a_ctrl->i2c_data.init_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR, "Cannot apply Init settings");
+			goto end;
+		}
+
+		/* Delete the request even if the apply is failed */
+		rc = delete_request(&a_ctrl->i2c_data.init_settings);
+		if (rc < 0) {
+			CAM_WARN(CAM_ACTUATOR,
+				"Fail in deleting the Init settings");
+			rc = 0;
+		}
+		break;
+	case CAM_ACTUATOR_PACKET_AUTO_MOVE_LENS:
+		if (a_ctrl->cam_act_state < CAM_ACTUATOR_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+				"Not in right state to move lens: %d",
+				a_ctrl->cam_act_state);
+			goto end;
+		}
+		a_ctrl->setting_apply_state = ACT_APPLY_SETTINGS_NOW;
+
+		i2c_data = &(a_ctrl->i2c_data);
+		i2c_reg_settings = &i2c_data->init_settings;
+
+		i2c_data->init_settings.request_id =
+			csl_packet->header.request_id;
+		i2c_reg_settings->is_settings_valid = 1;
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += csl_packet->cmd_buf_offset / sizeof(uint32_t);
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_sensor_i2c_command_parser(
+			&a_ctrl->io_master_info,
+			i2c_reg_settings,
+			cmd_desc, 1, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Auto move lens parsing failed: %d", rc);
+			goto end;
+		}
+		rc = cam_actuator_update_req_mgr(a_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in adding request to request manager");
+			goto end;
+		}
+		break;
+	case CAM_ACTUATOR_PACKET_MANUAL_MOVE_LENS:
+		if (a_ctrl->cam_act_state < CAM_ACTUATOR_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+				"Not in right state to move lens: %d",
+				a_ctrl->cam_act_state);
+			goto end;
+		}
+
+		a_ctrl->setting_apply_state = ACT_APPLY_SETTINGS_LATER;
+		i2c_data = &(a_ctrl->i2c_data);
+		i2c_reg_settings = &i2c_data->per_frame[
+			csl_packet->header.request_id % MAX_PER_FRAME_ARRAY];
+
+		 i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+		i2c_reg_settings->is_settings_valid = 1;
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += csl_packet->cmd_buf_offset / sizeof(uint32_t);
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_sensor_i2c_command_parser(
+			&a_ctrl->io_master_info,
+			i2c_reg_settings,
+			cmd_desc, 1, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Manual move lens parsing failed: %d", rc);
+			goto end;
+		}
+
+		rc = cam_actuator_update_req_mgr(a_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in adding request to request manager");
+			goto end;
+		}
+		break;
+	case CAM_PKT_NOP_OPCODE:
+		if (a_ctrl->cam_act_state < CAM_ACTUATOR_CONFIG) {
+			CAM_WARN(CAM_ACTUATOR,
+				"Received NOP packets in invalid state: %d",
+				a_ctrl->cam_act_state);
+			rc = -EINVAL;
+			goto end;
+		}
+		rc = cam_actuator_update_req_mgr(a_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in adding request to request manager");
+			goto end;
+		}
+		break;
+	case CAM_ACTUATOR_PACKET_OPCODE_READ: {
+		struct cam_buf_io_cfg *io_cfg;
+		struct i2c_settings_array i2c_read_settings;
+
+		if (a_ctrl->cam_act_state < CAM_ACTUATOR_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+				"Not in right state to read actuator: %d",
+				a_ctrl->cam_act_state);
+			goto end;
+		}
+		CAM_DBG(CAM_ACTUATOR, "number of I/O configs: %d:",
+			csl_packet->num_io_configs);
+		if (csl_packet->num_io_configs == 0) {
+			CAM_ERR(CAM_ACTUATOR, "No I/O configs to process");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		INIT_LIST_HEAD(&(i2c_read_settings.list_head));
+
+		io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+			&csl_packet->payload_flex +
+			csl_packet->io_configs_offset);
+
+		if (io_cfg == NULL) {
+			CAM_ERR(CAM_ACTUATOR, "I/O config is invalid(NULL)");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		i2c_read_settings.is_settings_valid = 1;
+		i2c_read_settings.request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&a_ctrl->io_master_info,
+			&i2c_read_settings,
+			cmd_desc, 1, io_cfg);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"actuator read pkt parsing failed: %d", rc);
+			goto end;
+		}
+
+		rc = cam_sensor_i2c_read_data(
+			&i2c_read_settings,
+			&a_ctrl->io_master_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR, "cannot read data, rc:%d", rc);
+			delete_request(&i2c_read_settings);
+			goto end;
+		}
+
+		rc = delete_request(&i2c_read_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in deleting the read settings");
+			goto end;
+		}
+		break;
+		}
+	default:
+		CAM_ERR(CAM_ACTUATOR, "Wrong Opcode: %d",
+			csl_packet->header.op_code & 0xFFFFFF);
+		rc = -EINVAL;
+		goto end;
+	}
+
+end:
+	cam_mem_put_cpu_buf(config.packet_handle);
+	return rc;
+}
+
+void cam_actuator_shutdown(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	int rc = 0;
+	struct cam_actuator_soc_private  *soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info =
+		&soc_private->power_info;
+
+	if (a_ctrl->cam_act_state == CAM_ACTUATOR_INIT)
+		return;
+
+	if (a_ctrl->cam_act_state >= CAM_ACTUATOR_CONFIG) {
+		rc = cam_actuator_power_down(a_ctrl);
+		if (rc < 0)
+			CAM_ERR(CAM_ACTUATOR, "Actuator Power down failed");
+		a_ctrl->cam_act_state = CAM_ACTUATOR_ACQUIRE;
+	}
+
+	if (a_ctrl->cam_act_state >= CAM_ACTUATOR_ACQUIRE) {
+		rc = cam_destroy_device_hdl(a_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_ACTUATOR, "destroying  dhdl failed");
+		a_ctrl->bridge_intf.device_hdl = -1;
+		a_ctrl->bridge_intf.link_hdl = -1;
+		a_ctrl->bridge_intf.session_hdl = -1;
+	}
+
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_setting_size = 0;
+	power_info->power_down_setting_size = 0;
+	a_ctrl->last_flush_req = 0;
+
+	a_ctrl->cam_act_state = CAM_ACTUATOR_INIT;
+}
+
+int32_t cam_actuator_driver_cmd(struct cam_actuator_ctrl_t *a_ctrl,
+	void *arg)
+{
+	int rc = 0;
+	struct cam_control *cmd = (struct cam_control *)arg;
+	struct cam_actuator_soc_private *soc_private = NULL;
+	struct cam_sensor_power_ctrl_t  *power_info = NULL;
+
+	if (!a_ctrl || !cmd) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+
+	power_info = &soc_private->power_info;
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ACTUATOR, "Opcode to Actuator: %d", cmd->op_code);
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	switch (cmd->op_code) {
+	case CAM_ACQUIRE_DEV: {
+		struct cam_sensor_acquire_dev actuator_acq_dev;
+		struct cam_create_dev_hdl bridge_params;
+
+		if (a_ctrl->bridge_intf.device_hdl != -1) {
+			CAM_ERR(CAM_ACTUATOR, "Device is already acquired");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = copy_from_user(&actuator_acq_dev,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(actuator_acq_dev));
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR, "Failed Copying from user\n");
+			goto release_mutex;
+		}
+
+		bridge_params.session_hdl = actuator_acq_dev.session_handle;
+		bridge_params.ops = &a_ctrl->bridge_intf.ops;
+		bridge_params.v4l2_sub_dev_flag = 0;
+		bridge_params.media_entity_flag = 0;
+		bridge_params.priv = a_ctrl;
+		bridge_params.dev_id = CAM_ACTUATOR;
+
+		actuator_acq_dev.device_handle =
+			cam_create_device_hdl(&bridge_params);
+		if (actuator_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_ACTUATOR, "Can not create device handle");
+			goto release_mutex;
+		}
+		a_ctrl->bridge_intf.device_hdl = actuator_acq_dev.device_handle;
+		a_ctrl->bridge_intf.session_hdl =
+			actuator_acq_dev.session_handle;
+
+		CAM_DBG(CAM_ACTUATOR, "Device Handle: %d",
+			actuator_acq_dev.device_handle);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&actuator_acq_dev,
+			sizeof(struct cam_sensor_acquire_dev))) {
+			CAM_ERR(CAM_ACTUATOR, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+
+		a_ctrl->cam_act_state = CAM_ACTUATOR_ACQUIRE;
+	}
+		break;
+	case CAM_RELEASE_DEV: {
+		if (a_ctrl->cam_act_state == CAM_ACTUATOR_START) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+				"Cant release actuator: in start state");
+			goto release_mutex;
+		}
+
+		if (a_ctrl->cam_act_state == CAM_ACTUATOR_CONFIG) {
+			rc = cam_actuator_power_down(a_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR,
+					"Actuator Power down failed");
+				goto release_mutex;
+			}
+		}
+
+		if (a_ctrl->bridge_intf.device_hdl == -1) {
+			CAM_ERR(CAM_ACTUATOR, "link hdl: %d device hdl: %d",
+				a_ctrl->bridge_intf.device_hdl,
+				a_ctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (a_ctrl->bridge_intf.link_hdl != -1) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Device [%d] still active on link 0x%x",
+				a_ctrl->cam_act_state,
+				a_ctrl->bridge_intf.link_hdl);
+			rc = -EAGAIN;
+			goto release_mutex;
+		}
+
+		rc = cam_destroy_device_hdl(a_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_ACTUATOR, "destroying the device hdl");
+		a_ctrl->bridge_intf.device_hdl = -1;
+		a_ctrl->bridge_intf.link_hdl = -1;
+		a_ctrl->bridge_intf.session_hdl = -1;
+		a_ctrl->cam_act_state = CAM_ACTUATOR_INIT;
+		a_ctrl->last_flush_req = 0;
+		kfree(power_info->power_setting);
+		kfree(power_info->power_down_setting);
+		power_info->power_setting = NULL;
+		power_info->power_down_setting = NULL;
+		power_info->power_down_setting_size = 0;
+		power_info->power_setting_size = 0;
+	}
+		break;
+	case CAM_QUERY_CAP: {
+		struct cam_actuator_query_cap actuator_cap = {0};
+
+		actuator_cap.slot_info = a_ctrl->soc_info.index;
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&actuator_cap,
+			sizeof(struct cam_actuator_query_cap))) {
+			CAM_ERR(CAM_ACTUATOR, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+	}
+		break;
+	case CAM_START_DEV: {
+		if (a_ctrl->cam_act_state != CAM_ACTUATOR_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+			"Not in right state to start : %d",
+			a_ctrl->cam_act_state);
+			goto release_mutex;
+		}
+		a_ctrl->cam_act_state = CAM_ACTUATOR_START;
+		a_ctrl->last_flush_req = 0;
+	}
+		break;
+	case CAM_STOP_DEV: {
+		struct i2c_settings_array *i2c_set = NULL;
+		int i;
+
+		if (a_ctrl->cam_act_state != CAM_ACTUATOR_START) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_ACTUATOR,
+			"Not in right state to stop : %d",
+			a_ctrl->cam_act_state);
+			goto release_mutex;
+		}
+
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			i2c_set = &(a_ctrl->i2c_data.per_frame[i]);
+
+			if (i2c_set->is_settings_valid == 1) {
+				rc = delete_request(i2c_set);
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"delete request: %lld rc: %d",
+						i2c_set->request_id, rc);
+			}
+		}
+		a_ctrl->last_flush_req = 0;
+		a_ctrl->cam_act_state = CAM_ACTUATOR_CONFIG;
+	}
+		break;
+	case CAM_CONFIG_DEV: {
+		a_ctrl->setting_apply_state =
+			ACT_APPLY_SETTINGS_LATER;
+		rc = cam_actuator_i2c_pkt_parse(a_ctrl, arg);
+		if (rc < 0) {
+			CAM_ERR(CAM_ACTUATOR, "Failed in actuator Parsing");
+			goto release_mutex;
+		}
+
+		if (a_ctrl->setting_apply_state ==
+			ACT_APPLY_SETTINGS_NOW) {
+			rc = cam_actuator_apply_settings(a_ctrl,
+				&a_ctrl->i2c_data.init_settings);
+			if ((rc == -EAGAIN) &&
+			(a_ctrl->io_master_info.master_type == CCI_MASTER)) {
+				CAM_WARN(CAM_ACTUATOR,
+					"CCI HW is in resetting mode:: Reapplying Init settings");
+				usleep_range(1000, 1010);
+				rc = cam_actuator_apply_settings(a_ctrl,
+					&a_ctrl->i2c_data.init_settings);
+			}
+
+			if (rc < 0)
+				CAM_ERR(CAM_ACTUATOR,
+					"Failed to apply Init settings: rc = %d",
+					rc);
+			/* Delete the request even if the apply is failed */
+			rc = delete_request(&a_ctrl->i2c_data.init_settings);
+			if (rc < 0) {
+				CAM_ERR(CAM_ACTUATOR,
+					"Failed in Deleting the Init Pkt: %d",
+					rc);
+				goto release_mutex;
+			}
+		}
+	}
+		break;
+	default:
+		CAM_ERR(CAM_ACTUATOR, "Invalid Opcode %d", cmd->op_code);
+	}
+
+release_mutex:
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+
+	return rc;
+}
+
+int32_t cam_actuator_flush_request(struct cam_req_mgr_flush_request *flush_req)
+{
+	int32_t rc = 0, i;
+	uint32_t cancel_req_id_found = 0;
+	struct cam_actuator_ctrl_t *a_ctrl = NULL;
+	struct i2c_settings_array *i2c_set = NULL;
+
+	if (!flush_req)
+		return -EINVAL;
+
+	a_ctrl = (struct cam_actuator_ctrl_t *)
+		cam_get_device_priv(flush_req->dev_hdl);
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	if (a_ctrl->i2c_data.per_frame == NULL) {
+		CAM_ERR(CAM_ACTUATOR, "i2c frame data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		a_ctrl->last_flush_req = flush_req->req_id;
+		CAM_DBG(CAM_ACTUATOR, "last reqest to flush is %lld",
+			flush_req->req_id);
+	}
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		i2c_set = &(a_ctrl->i2c_data.per_frame[i]);
+
+		if ((flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ)
+				&& (i2c_set->request_id != flush_req->req_id))
+			continue;
+
+		if (i2c_set->is_settings_valid == 1) {
+			rc = delete_request(i2c_set);
+			if (rc < 0)
+				CAM_ERR(CAM_ACTUATOR,
+					"delete request: %lld rc: %d",
+					i2c_set->request_id, rc);
+
+			if (flush_req->type ==
+				CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+				cancel_req_id_found = 1;
+				break;
+			}
+		}
+	}
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ &&
+		!cancel_req_id_found)
+		CAM_DBG(CAM_ACTUATOR,
+			"Flush request id:%lld not found in the pending list",
+			flush_req->req_id);
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.h
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ACTUATOR_CORE_H_
+#define _CAM_ACTUATOR_CORE_H_
+
+#include "cam_actuator_dev.h"
+
+/**
+ * @power_info: power setting info to control the power
+ *
+ * This API construct the default actuator power setting.
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int32_t cam_actuator_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info);
+
+/**
+ * @apply: Req mgr structure for applying request
+ *
+ * This API applies the request that is mentioned
+ */
+int32_t cam_actuator_apply_request(struct cam_req_mgr_apply_request *apply);
+
+/**
+ * @info: Sub device info to req mgr
+ *
+ * This API publish the subdevice info to req mgr
+ */
+int32_t cam_actuator_publish_dev_info(struct cam_req_mgr_device_info *info);
+
+/**
+ * @flush: Req mgr structure for flushing request
+ *
+ * This API flushes the request that is mentioned
+ */
+int cam_actuator_flush_request(struct cam_req_mgr_flush_request *flush);
+
+
+/**
+ * @link: Link setup info
+ *
+ * This API establishes link actuator subdevice with req mgr
+ */
+int32_t cam_actuator_establish_link(
+	struct cam_req_mgr_core_dev_link_setup *link);
+
+/**
+ * @a_ctrl: Actuator ctrl structure
+ * @arg:    Camera control command argument
+ *
+ * This API handles the camera control argument reached to actuator
+ */
+int32_t cam_actuator_driver_cmd(struct cam_actuator_ctrl_t *a_ctrl, void *arg);
+
+/**
+ * @a_ctrl: Actuator ctrl structure
+ *
+ * This API handles the shutdown ioctl/close
+ */
+void cam_actuator_shutdown(struct cam_actuator_ctrl_t *a_ctrl);
+
+#endif /* _CAM_ACTUATOR_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.c
@@ -0,0 +1,506 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_actuator_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_actuator_soc.h"
+#include "cam_actuator_core.h"
+#include "cam_trace.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+
+int cam_actuator_i2c_driver_remove_common(struct i2c_client *client)
+{
+	int rc = 0;
+	struct cam_actuator_ctrl_t      *a_ctrl =
+		i2c_get_clientdata(client);
+	struct cam_actuator_soc_private *soc_private;
+	struct cam_sensor_power_ctrl_t  *power_info;
+
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Actuator device is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	CAM_INFO(CAM_ACTUATOR, "i2c remove invoked");
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	cam_actuator_shutdown(a_ctrl);
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+	rc = cam_unregister_subdev(&(a_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_ACTUATOR, "unregistering actuator subdev is unsucessful");
+
+	cam_actuator_release_power_domain(a_ctrl);
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	/*Free Allocated Mem */
+	kfree(a_ctrl->i2c_data.per_frame);
+	a_ctrl->i2c_data.per_frame = NULL;
+	a_ctrl->soc_info.soc_private = NULL;
+	v4l2_set_subdevdata(&a_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(a_ctrl);
+
+	return rc;
+}
+
+static int cam_actuator_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_actuator_ctrl_t *a_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "a_ctrl ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	cam_actuator_shutdown(a_ctrl);
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+
+	return 0;
+}
+
+static int cam_actuator_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_ACTUATOR,
+			"CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_actuator_subdev_close_internal(sd, fh);
+}
+
+static long cam_actuator_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int rc = 0;
+	struct cam_actuator_ctrl_t *a_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_actuator_driver_cmd(a_ctrl, arg);
+		if (rc)
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed for driver_cmd: %d", rc);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_actuator_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR(CAM_ACTUATOR, "Invalid ioctl cmd: %u", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_actuator_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_ACTUATOR,
+			"Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		cmd = VIDIOC_CAM_CONTROL;
+		rc = cam_actuator_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in actuator subdev handling rc: %d",
+				rc);
+			return rc;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_ACTUATOR, "Invalid compat ioctl: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+	return rc;
+}
+#endif
+
+static struct v4l2_subdev_core_ops cam_actuator_subdev_core_ops = {
+	.ioctl = cam_actuator_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_actuator_init_subdev_do_ioctl,
+#endif
+};
+
+static struct v4l2_subdev_ops cam_actuator_subdev_ops = {
+	.core = &cam_actuator_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cam_actuator_internal_ops = {
+	.close = cam_actuator_subdev_close,
+};
+
+static int cam_actuator_init_subdev(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	int rc = 0;
+
+	a_ctrl->v4l2_dev_str.internal_ops =
+		&cam_actuator_internal_ops;
+	a_ctrl->v4l2_dev_str.ops =
+		&cam_actuator_subdev_ops;
+	strscpy(a_ctrl->device_name, CAMX_ACTUATOR_DEV_NAME,
+		sizeof(a_ctrl->device_name));
+	a_ctrl->v4l2_dev_str.name =
+		a_ctrl->device_name;
+	a_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	a_ctrl->v4l2_dev_str.ent_function =
+		CAM_ACTUATOR_DEVICE_TYPE;
+	a_ctrl->v4l2_dev_str.token = a_ctrl;
+	a_ctrl->v4l2_dev_str.close_seq_prior =
+		 CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(a_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_ACTUATOR,
+			"Fail with cam_register_subdev rc: %d", rc);
+
+	return rc;
+}
+
+static int32_t cam_actuator_i2c_driver_probe(struct i2c_client *client)
+{
+	int32_t                         rc = 0;
+	int32_t                         i = 0;
+	struct cam_actuator_ctrl_t      *a_ctrl;
+	struct cam_hw_soc_info          *soc_info = NULL;
+	struct cam_actuator_soc_private *soc_private = NULL;
+
+	if (client == NULL) {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_ACTUATOR, "%s :: i2c_check_functionality failed",
+			 client->name);
+		rc = -EFAULT;
+		return rc;
+	}
+
+	/* Create sensor control structure */
+	a_ctrl = kzalloc(sizeof(*a_ctrl), GFP_KERNEL);
+	if (!a_ctrl)
+		return -ENOMEM;
+
+	i2c_set_clientdata(client, a_ctrl);
+
+	soc_private = kzalloc(sizeof(struct cam_actuator_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto free_ctrl;
+	}
+	a_ctrl->soc_info.soc_private = soc_private;
+
+	a_ctrl->io_master_info.client = client;
+	soc_info = &a_ctrl->soc_info;
+	soc_info->dev = &client->dev;
+	soc_info->dev_name = client->name;
+	a_ctrl->io_master_info.master_type = I2C_MASTER;
+
+	rc = cam_actuator_parse_dt(a_ctrl, &client->dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "failed: cam_sensor_parse_dt rc %d", rc);
+		goto free_soc;
+	}
+
+	rc = cam_actuator_init_subdev(a_ctrl);
+	if (rc)
+		goto free_soc;
+
+	if (soc_private->i2c_info.slave_addr != 0)
+		a_ctrl->io_master_info.client->addr =
+			soc_private->i2c_info.slave_addr;
+
+	a_ctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (a_ctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto unreg_subdev;
+	}
+
+	INIT_LIST_HEAD(&(a_ctrl->i2c_data.init_settings.list_head));
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
+		INIT_LIST_HEAD(&(a_ctrl->i2c_data.per_frame[i].list_head));
+
+	a_ctrl->bridge_intf.device_hdl = -1;
+	a_ctrl->bridge_intf.link_hdl = -1;
+	a_ctrl->bridge_intf.ops.get_dev_info =
+		cam_actuator_publish_dev_info;
+	a_ctrl->bridge_intf.ops.link_setup =
+		cam_actuator_establish_link;
+	a_ctrl->bridge_intf.ops.apply_req =
+		cam_actuator_apply_request;
+	a_ctrl->last_flush_req = 0;
+	a_ctrl->cam_act_state = CAM_ACTUATOR_INIT;
+
+	return rc;
+
+unreg_subdev:
+	cam_unregister_subdev(&(a_ctrl->v4l2_dev_str));
+free_soc:
+	kfree(soc_private);
+free_ctrl:
+	kfree(a_ctrl);
+	return rc;
+}
+
+static int cam_actuator_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t                          rc = 0;
+	int32_t                          i = 0;
+	struct cam_actuator_ctrl_t       *a_ctrl = NULL;
+	struct cam_actuator_soc_private  *soc_private = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	/* Create actuator control structure */
+	a_ctrl = devm_kzalloc(&pdev->dev,
+		sizeof(struct cam_actuator_ctrl_t), GFP_KERNEL);
+	if (!a_ctrl)
+		return -ENOMEM;
+
+	/*fill in platform device*/
+	a_ctrl->v4l2_dev_str.pdev = pdev;
+	a_ctrl->soc_info.pdev = pdev;
+	a_ctrl->soc_info.dev = &pdev->dev;
+	a_ctrl->soc_info.dev_name = pdev->name;
+	a_ctrl->io_master_info.master_type = CCI_MASTER;
+
+	a_ctrl->io_master_info.cci_client = kzalloc(sizeof(
+		struct cam_sensor_cci_client), GFP_KERNEL);
+	if (!(a_ctrl->io_master_info.cci_client)) {
+		rc = -ENOMEM;
+		goto free_ctrl;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_actuator_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto free_cci_client;
+	}
+	a_ctrl->soc_info.soc_private = soc_private;
+	soc_private->power_info.dev = &pdev->dev;
+
+	a_ctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (a_ctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto free_soc;
+	}
+
+	INIT_LIST_HEAD(&(a_ctrl->i2c_data.init_settings.list_head));
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
+		INIT_LIST_HEAD(&(a_ctrl->i2c_data.per_frame[i].list_head));
+
+	rc = cam_actuator_parse_dt(a_ctrl, &(pdev->dev));
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "Paring actuator dt failed rc %d", rc);
+		goto free_mem;
+	}
+
+	/* Fill platform device id*/
+	pdev->id = a_ctrl->soc_info.index;
+
+	rc = cam_actuator_init_subdev(a_ctrl);
+	if (rc)
+		goto free_mem;
+
+	a_ctrl->bridge_intf.device_hdl = -1;
+	a_ctrl->bridge_intf.link_hdl = -1;
+	a_ctrl->bridge_intf.ops.get_dev_info =
+		cam_actuator_publish_dev_info;
+	a_ctrl->bridge_intf.ops.link_setup =
+		cam_actuator_establish_link;
+	a_ctrl->bridge_intf.ops.apply_req =
+		cam_actuator_apply_request;
+	a_ctrl->bridge_intf.ops.flush_req =
+		cam_actuator_flush_request;
+	a_ctrl->last_flush_req = 0;
+
+	platform_set_drvdata(pdev, a_ctrl);
+	a_ctrl->cam_act_state = CAM_ACTUATOR_INIT;
+	CAM_DBG(CAM_ACTUATOR, "Component bound successfully");
+
+	return rc;
+
+free_mem:
+	kfree(a_ctrl->i2c_data.per_frame);
+free_soc:
+	kfree(soc_private);
+free_cci_client:
+	kfree(a_ctrl->io_master_info.cci_client);
+free_ctrl:
+	devm_kfree(&pdev->dev, a_ctrl);
+	return rc;
+}
+
+static void cam_actuator_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_actuator_ctrl_t      *a_ctrl;
+	struct cam_actuator_soc_private *soc_private;
+	struct cam_sensor_power_ctrl_t  *power_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	a_ctrl = platform_get_drvdata(pdev);
+	if (!a_ctrl) {
+		CAM_ERR(CAM_ACTUATOR, "Actuator device is NULL");
+		return;
+	}
+
+	mutex_lock(&(a_ctrl->actuator_mutex));
+	cam_actuator_shutdown(a_ctrl);
+	mutex_unlock(&(a_ctrl->actuator_mutex));
+	cam_unregister_subdev(&(a_ctrl->v4l2_dev_str));
+
+	cam_actuator_release_power_domain(a_ctrl);
+
+	soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	kfree(a_ctrl->io_master_info.cci_client);
+	a_ctrl->io_master_info.cci_client = NULL;
+	kfree(a_ctrl->soc_info.soc_private);
+	a_ctrl->soc_info.soc_private = NULL;
+	kfree(a_ctrl->i2c_data.per_frame);
+	a_ctrl->i2c_data.per_frame = NULL;
+	v4l2_set_subdevdata(&a_ctrl->v4l2_dev_str.sd, NULL);
+	platform_set_drvdata(pdev, NULL);
+	devm_kfree(&pdev->dev, a_ctrl);
+	CAM_INFO(CAM_ACTUATOR, "Actuator component unbinded");
+}
+
+const static struct component_ops cam_actuator_component_ops = {
+	.bind = cam_actuator_component_bind,
+	.unbind = cam_actuator_component_unbind,
+};
+
+static int32_t cam_actuator_platform_remove(
+	struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_actuator_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_actuator_driver_dt_match[] = {
+	{.compatible = "qcom,actuator"},
+	{}
+};
+
+static int32_t cam_actuator_driver_platform_probe(
+	struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_ACTUATOR, "Adding sensor actuator component");
+	rc = component_add(&pdev->dev, &cam_actuator_component_ops);
+	if (rc)
+		CAM_ERR(CAM_ICP, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+MODULE_DEVICE_TABLE(of, cam_actuator_driver_dt_match);
+
+struct platform_driver cam_actuator_platform_driver = {
+	.probe = cam_actuator_driver_platform_probe,
+	.driver = {
+		.name = "qcom,actuator",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_actuator_driver_dt_match,
+		.suppress_bind_attrs = true,
+	},
+	.remove = cam_actuator_platform_remove,
+};
+
+static const struct i2c_device_id i2c_id[] = {
+	{ACTUATOR_DRIVER_I2C, (kernel_ulong_t)NULL},
+	{ }
+};
+
+static struct i2c_driver cam_actuator_i2c_driver = {
+	.id_table = i2c_id,
+	.probe  = cam_actuator_i2c_driver_probe,
+	.remove = cam_actuator_i2c_driver_remove,
+	.driver = {
+		.name = ACTUATOR_DRIVER_I2C,
+	},
+};
+
+int cam_actuator_driver_init(void)
+{
+	int rc = 0;
+
+	rc = platform_driver_register(&cam_actuator_platform_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR,
+			"platform_driver_register failed rc = %d", rc);
+		return rc;
+	}
+	rc = i2c_add_driver(&cam_actuator_i2c_driver);
+	if (rc)
+		CAM_ERR(CAM_ACTUATOR, "i2c_add_driver failed rc = %d", rc);
+
+	return rc;
+}
+
+void cam_actuator_driver_exit(void)
+{
+	platform_driver_unregister(&cam_actuator_platform_driver);
+	i2c_del_driver(&cam_actuator_i2c_driver);
+}
+
+MODULE_DESCRIPTION("cam_actuator_driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_dev.h
@@ -0,0 +1,136 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+
+#ifndef _CAM_ACTUATOR_DEV_H_
+#define _CAM_ACTUATOR_DEV_H_
+
+#include <cam_sensor_io.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <cam_cci_dev.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_subdev.h>
+#include "cam_sensor_util.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_context.h"
+
+#define NUM_MASTERS 2
+#define NUM_QUEUES 2
+
+#define ACTUATOR_DRIVER_I2C "i2c_actuator"
+#define CAMX_ACTUATOR_DEV_NAME "cam-actuator-driver"
+
+#define MSM_ACTUATOR_MAX_VREGS (10)
+#define ACTUATOR_MAX_POLL_COUNT 10
+
+enum cam_actuator_apply_state_t {
+	ACT_APPLY_SETTINGS_NOW,
+	ACT_APPLY_SETTINGS_LATER,
+};
+
+enum cam_actuator_state {
+	CAM_ACTUATOR_INIT,
+	CAM_ACTUATOR_ACQUIRE,
+	CAM_ACTUATOR_CONFIG,
+	CAM_ACTUATOR_START,
+};
+
+/**
+ * struct cam_actuator_i2c_info_t - I2C info
+ * @slave_addr      :   slave address
+ * @i2c_freq_mode   :   i2c frequency mode
+ */
+struct cam_actuator_i2c_info_t {
+	uint16_t slave_addr;
+	uint8_t i2c_freq_mode;
+};
+
+struct cam_actuator_soc_private {
+	struct cam_actuator_i2c_info_t i2c_info;
+	struct cam_sensor_power_ctrl_t power_info;
+};
+
+/**
+ * struct actuator_intf_params
+ * @device_hdl: Device Handle
+ * @session_hdl: Session Handle
+ * @ops: KMD operations
+ * @crm_cb: Callback API pointers
+ */
+struct actuator_intf_params {
+	int32_t device_hdl;
+	int32_t session_hdl;
+	int32_t link_hdl;
+	struct cam_req_mgr_kmd_ops ops;
+	struct cam_req_mgr_crm_cb *crm_cb;
+};
+
+/**
+ * struct cam_actuator_ctrl_t
+ * @device_name: Device name
+ * @i2c_driver: I2C device info
+ * @pdev: Platform device
+ * @cci_i2c_master: I2C structure
+ * @io_master_info: Information about the communication master
+ * @actuator_mutex: Actuator mutex
+ * @act_apply_state: Actuator settings aRegulator config
+ * @id: Cell Index
+ * @res_apply_state: Actuator settings apply state
+ * @cam_act_state:   Actuator state
+ * @gconf: GPIO config
+ * @pinctrl_info: Pinctrl information
+ * @v4l2_dev_str: V4L2 device structure
+ * @i2c_data: I2C register settings structure
+ * @act_info: Sensor query cap structure
+ * @of_node: Node ptr
+ * @last_flush_req: Last request to flush
+ */
+struct cam_actuator_ctrl_t {
+	char device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct i2c_driver *i2c_driver;
+	enum cci_i2c_master_t cci_i2c_master;
+	enum cci_device_num cci_num;
+	struct camera_io_master io_master_info;
+	struct cam_hw_soc_info soc_info;
+	struct mutex actuator_mutex;
+	uint32_t id;
+	enum cam_actuator_apply_state_t setting_apply_state;
+	enum cam_actuator_state cam_act_state;
+	uint8_t cam_pinctrl_status;
+	struct cam_subdev v4l2_dev_str;
+	struct i2c_data_settings i2c_data;
+	struct cam_actuator_query_cap act_info;
+	struct actuator_intf_params bridge_intf;
+	uint32_t last_flush_req;
+};
+
+/**
+ * @brief : API to remove Actuator i2c Hw from driver framework.
+ * *@return return 0 on success.
+ */
+int cam_actuator_i2c_driver_remove_common(struct i2c_client *client);
+
+/**
+ * @brief : API to register Actuator hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_actuator_driver_init(void);
+
+/**
+ * @brief : API to remove Actuator Hw from platform framework.
+ */
+void cam_actuator_driver_exit(void);
+#endif /* _CAM_ACTUATOR_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.c
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_sensor_util.h>
+#include <cam_sensor_io.h>
+#include <cam_req_mgr_util.h>
+#include "cam_actuator_soc.h"
+#include "cam_soc_util.h"
+
+int32_t cam_actuator_parse_dt(struct cam_actuator_ctrl_t *a_ctrl,
+	struct device *dev)
+{
+	int32_t                         rc = 0;
+	struct cam_hw_soc_info          *soc_info = &a_ctrl->soc_info;
+	struct cam_actuator_soc_private *soc_private =
+		(struct cam_actuator_soc_private *)a_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t  *power_info = &soc_private->power_info;
+	struct device_node              *of_node = NULL;
+	struct device_node              *of_parent = NULL;
+
+	/* Initialize mutex */
+	mutex_init(&(a_ctrl->actuator_mutex));
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "parsing common soc dt(rc %d)", rc);
+		return rc;
+	}
+
+	of_node = soc_info->dev->of_node;
+
+	if (a_ctrl->io_master_info.master_type == CCI_MASTER) {
+		rc = of_property_read_u32(of_node, "cci-master",
+			&(a_ctrl->cci_i2c_master));
+		CAM_DBG(CAM_ACTUATOR, "cci-master %d, rc %d",
+			a_ctrl->cci_i2c_master, rc);
+		if ((rc < 0) || (a_ctrl->cci_i2c_master >= MASTER_MAX)) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Wrong info: rc: %d, dt CCI master:%d",
+				rc, a_ctrl->cci_i2c_master);
+			rc = -EFAULT;
+			return rc;
+		}
+
+		of_parent = of_get_parent(of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&a_ctrl->cci_num) < 0)
+			/* Set default master 0 */
+			a_ctrl->cci_num = CCI_DEVICE_0;
+		a_ctrl->io_master_info.cci_client->cci_device = a_ctrl->cci_num;
+		CAM_DBG(CAM_ACTUATOR, "cci-device %d", a_ctrl->cci_num);
+	}
+
+	rc = cam_sensor_util_regulator_powerup(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_sensor_util_request_power_domain(soc_info);
+	if (rc < 0)
+		return rc;
+
+	if (!soc_info->gpio_data) {
+		CAM_DBG(CAM_ACTUATOR, "No GPIO found");
+		rc = 0;
+		return rc;
+	}
+
+	if (!soc_info->gpio_data->cam_gpio_common_tbl_size) {
+		CAM_DBG(CAM_ACTUATOR, "No GPIO found");
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
+		&power_info->gpio_num_info);
+	if ((rc < 0) || (!power_info->gpio_num_info)) {
+		CAM_ERR(CAM_ACTUATOR, "No/Error Actuator GPIOs");
+		return -EINVAL;
+	}
+	return rc;
+}
+
+void cam_actuator_release_power_domain(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	struct cam_hw_soc_info *soc_info = &a_ctrl->soc_info;
+
+	cam_sensor_util_release_power_domain(soc_info);
+}
\ No newline at end of file
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_actuator/cam_actuator_soc.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_ACTUATOR_SOC_H_
+#define _CAM_ACTUATOR_SOC_H_
+
+#include "cam_actuator_dev.h"
+
+/**
+ * @a_ctrl: Actuator ctrl structure
+ *
+ * This API parses actuator device tree
+ */
+int cam_actuator_parse_dt(struct cam_actuator_ctrl_t *a_ctrl,
+	struct device *dev);
+
+/**
+ * @a_ctrl: Actuator ctrl structure
+ *
+ * This API serves for releasing power domain
+ */
+void cam_actuator_release_power_domain(struct cam_actuator_ctrl_t *a_ctrl);
+
+#endif /* _CAM_ACTUATOR_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_core.c
@@ -0,0 +1,1922 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_cci_core.h"
+#include "cam_cci_dev.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+static int32_t cam_cci_convert_type_to_num_bytes(
+	enum camera_sensor_i2c_type type)
+{
+	int32_t num_bytes;
+
+	switch (type) {
+	case CAMERA_SENSOR_I2C_TYPE_BYTE:
+		num_bytes = 1;
+		break;
+	case CAMERA_SENSOR_I2C_TYPE_WORD:
+		num_bytes = 2;
+		break;
+	case CAMERA_SENSOR_I2C_TYPE_3B:
+		num_bytes = 3;
+		break;
+	case CAMERA_SENSOR_I2C_TYPE_DWORD:
+		num_bytes = 4;
+		break;
+	default:
+		CAM_ERR(CAM_CCI, "Wrong Sensor I2c Type: %d", type);
+		num_bytes = 0;
+		break;
+	}
+	return num_bytes;
+}
+
+static void cam_cci_flush_queue(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master)
+{
+	int32_t rc = 0;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+
+	cam_io_w_mb(1 << master, base + CCI_HALT_REQ_ADDR);
+	if (!cci_dev->cci_master_info[master].status)
+		reinit_completion(&cci_dev->cci_master_info[master]
+			.reset_complete);
+	if (!wait_for_completion_timeout(
+		&cci_dev->cci_master_info[master].reset_complete,
+		CCI_TIMEOUT)) {
+		CAM_DBG(CAM_CCI,
+			"wait timeout for reset complete for cci:%d master: %d",
+			cci_dev->soc_info.index, master);
+
+		/* Set reset pending flag to true */
+		cci_dev->cci_master_info[master].reset_pending = true;
+		cci_dev->cci_master_info[master].status = 0;
+
+		/* Set proper mask to RESET CMD address based on MASTER */
+		if (master == MASTER_0)
+			cam_io_w_mb(CCI_M0_RESET_RMSK,
+				base + CCI_RESET_CMD_ADDR);
+		else
+			cam_io_w_mb(CCI_M1_RESET_RMSK,
+				base + CCI_RESET_CMD_ADDR);
+
+		/* wait for reset done irq */
+		if (!wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].reset_complete,
+			CCI_TIMEOUT)) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_CCI,
+				"Retry:: wait timeout for reset complete for cci: %d master: %d",
+				cci_dev->soc_info.index, master);
+		}
+		cci_dev->cci_master_info[master].status = 0;
+	}
+
+	if (!rc)
+		CAM_DBG(CAM_CCI,
+			"Success: Reset complete: for cci: %d master: %d",
+			cci_dev->soc_info.index, master);
+}
+
+static int32_t cam_cci_validate_queue(struct cci_device *cci_dev,
+	uint32_t len,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+	uint32_t read_val = 0;
+	uint32_t reg_offset = master * 0x200 + queue * 0x100;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	unsigned long flags;
+
+	read_val = cam_io_r_mb(base +
+		CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+	CAM_DBG(CAM_CCI, "CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR %d len %d max %d",
+		read_val, len,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size);
+	if ((read_val + len + 1) >
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size) {
+		uint32_t reg_val = 0;
+		uint32_t report_id =
+			cci_dev->cci_i2c_queue_info[master][queue].report_id;
+		uint32_t report_val = CCI_I2C_REPORT_CMD | (1 << 8) |
+			(1 << 9) | (report_id << 4);
+
+		CAM_DBG(CAM_CCI, "CCI_I2C_REPORT_CMD");
+		cam_io_w_mb(report_val,
+			base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+			reg_offset);
+		read_val++;
+		cci_dev->cci_i2c_queue_info[master][queue].report_id++;
+		if (cci_dev->cci_i2c_queue_info[master][queue].report_id == REPORT_IDSIZE)
+			cci_dev->cci_i2c_queue_info[master][queue].report_id = 0;
+
+		CAM_DBG(CAM_CCI,
+			"CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR %d, queue: %d",
+			read_val, queue);
+		cam_io_w_mb(read_val, base +
+			CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+		reg_val = 1 << ((master * 2) + queue);
+		CAM_DBG(CAM_CCI, "CCI_QUEUE_START_ADDR");
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		atomic_set(
+			&cci_dev->cci_master_info[master].done_pending[queue],
+			1);
+		cam_io_w_mb(reg_val, base + CCI_QUEUE_START_ADDR);
+		atomic_set(&cci_dev->cci_master_info[master].q_free[queue], 1);
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		if (!wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].report_q[queue],
+			CCI_TIMEOUT)) {
+			CAM_ERR(CAM_CCI,
+				"Wait timeout cci: %d, Master:%d, report_q: %d, rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			cam_cci_flush_queue(cci_dev, master);
+			return -EINVAL;
+		}
+		rc = cci_dev->cci_master_info[master].status;
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI, "cci: %d is in error state",
+				cci_dev->soc_info.index);
+			cci_dev->cci_master_info[master].status = 0;
+		}
+	}
+
+	return rc;
+}
+
+static int32_t cam_cci_write_i2c_queue(struct cci_device *cci_dev,
+	uint32_t val,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+	uint32_t reg_offset = master * 0x200 + queue * 0x100;
+	struct cam_hw_soc_info *soc_info = NULL;
+	void __iomem *base = NULL;
+
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+
+	soc_info = &cci_dev->soc_info;
+	base = soc_info->reg_map[0].mem_base;
+
+	rc = cam_cci_validate_queue(cci_dev, 1, master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI,
+			"Failed to validate:: cci: %d, Master: %d, Queue:%d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		return rc;
+	}
+	CAM_DBG(CAM_CCI, "CCI_I2C_M0_Q0_LOAD_DATA_ADDR:val 0x%x:0x%x",
+		CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset, val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset);
+
+	return rc;
+}
+
+static int32_t cam_cci_lock_queue(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue, uint32_t en)
+{
+	uint32_t val;
+
+	if (queue != PRIORITY_QUEUE)
+		return 0;
+
+	val = en ? CCI_I2C_LOCK_CMD : CCI_I2C_UNLOCK_CMD;
+	return cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+}
+
+
+void cam_cci_dump_registers(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master, enum cci_i2c_queue_t queue)
+{
+	uint32_t dump_en = 0;
+	uint32_t read_val = 0;
+	uint32_t i = 0;
+	uint32_t reg_offset = 0;
+	void __iomem *base = cci_dev->soc_info.reg_map[0].mem_base;
+
+	dump_en = cci_dev->dump_en;
+	if (!(dump_en & CAM_CCI_NACK_DUMP_EN) &&
+		!(dump_en & CAM_CCI_TIMEOUT_DUMP_EN)) {
+		CAM_DBG(CAM_CCI,
+			"Nack and Timeout dump is not enabled");
+		return;
+	}
+
+	CAM_INFO(CAM_CCI, "**** CCI:%d register dump ****",
+		cci_dev->soc_info.index);
+
+	/* CCI Top Registers */
+	CAM_INFO(CAM_CCI, "****CCI TOP Registers ****");
+	for (i = 0; i < DEBUG_TOP_REG_COUNT; i++) {
+		reg_offset = DEBUG_TOP_REG_START + i * 4;
+		read_val = cam_io_r_mb(base + reg_offset);
+		CAM_INFO(CAM_CCI, "offset = 0x%X value = 0x%X",
+			reg_offset, read_val);
+	}
+
+	/* CCI Master registers */
+	CAM_INFO(CAM_CCI, "****CCI MASTER %d Registers ****",
+		master);
+	for (i = 0; i < DEBUG_MASTER_REG_COUNT; i++) {
+		if ((i * 4) == 0x18)
+			continue;
+
+		reg_offset = DEBUG_MASTER_REG_START + master*0x100 + i * 4;
+		read_val = cam_io_r_mb(base + reg_offset);
+		CAM_INFO(CAM_CCI, "offset = 0x%X value = 0x%X",
+			reg_offset, read_val);
+	}
+
+	/* CCI Master Queue registers */
+	CAM_INFO(CAM_CCI, " **** CCI MASTER%d QUEUE%d Registers ****",
+		master, queue);
+	for (i = 0; i < DEBUG_MASTER_QUEUE_REG_COUNT; i++) {
+		reg_offset = DEBUG_MASTER_QUEUE_REG_START +  master*0x200 +
+			queue*0x100 + i * 4;
+		read_val = cam_io_r_mb(base + reg_offset);
+		CAM_INFO(CAM_CCI, "offset = 0x%X value = 0x%X",
+			reg_offset, read_val);
+	}
+
+	/* CCI Interrupt registers */
+	CAM_INFO(CAM_CCI, " ****CCI Interrupt Registers ****");
+	for (i = 0; i < DEBUG_INTR_REG_COUNT; i++) {
+		reg_offset = DEBUG_INTR_REG_START + i * 4;
+		read_val = cam_io_r_mb(base + reg_offset);
+		CAM_INFO(CAM_CCI, "offset = 0x%X value = 0x%X",
+			reg_offset, read_val);
+	}
+}
+EXPORT_SYMBOL(cam_cci_dump_registers);
+
+static uint32_t cam_cci_wait(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev pointer is NULL");
+		return -EINVAL;
+	}
+
+	if (!wait_for_completion_timeout(
+		&cci_dev->cci_master_info[master].report_q[queue],
+		CCI_TIMEOUT)) {
+		cam_cci_dump_registers(cci_dev, master, queue);
+
+		CAM_ERR(CAM_CCI,
+			"wait timeout for cci:%d, Maser:%d, Queue:%d, rc=%d",
+			cci_dev->soc_info.index, master, queue, rc);
+		rc = -ETIMEDOUT;
+		cam_cci_flush_queue(cci_dev, master);
+		return rc;
+	}
+
+	rc = cci_dev->cci_master_info[master].status;
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "cci: %d is in error state",
+			cci_dev->soc_info.index);
+		cci_dev->cci_master_info[master].status = 0;
+		return rc;
+	}
+
+	return 0;
+}
+
+static void cam_cci_load_report_cmd(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+
+	uint32_t reg_offset = master * 0x200 + queue * 0x100;
+	uint32_t read_val = cam_io_r_mb(base +
+		CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+	uint32_t report_id =
+		cci_dev->cci_i2c_queue_info[master][queue].report_id;
+	uint32_t report_val = CCI_I2C_REPORT_CMD | (1 << 8) |
+		(1 << 9) | (report_id << 4);
+
+	CAM_DBG(CAM_CCI, "CCI_I2C_REPORT_CMD curr_w_cnt: %d report_id %d",
+		read_val, report_id);
+	cam_io_w_mb(report_val,
+		base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset);
+	read_val++;
+
+	cci_dev->cci_i2c_queue_info[master][queue].report_id++;
+	if (cci_dev->cci_i2c_queue_info[master][queue].report_id == REPORT_IDSIZE)
+		cci_dev->cci_i2c_queue_info[master][queue].report_id = 0;
+
+	CAM_DBG(CAM_CCI, "CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR %d", read_val);
+	cam_io_w_mb(read_val, base +
+		CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+}
+
+static int32_t cam_cci_wait_report_cmd(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	unsigned long flags;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+
+	uint32_t reg_val = 1 << ((master * 2) + queue);
+
+	cam_cci_load_report_cmd(cci_dev, master, queue);
+	spin_lock_irqsave(
+		&cci_dev->cci_master_info[master].lock_q[queue], flags);
+	atomic_set(&cci_dev->cci_master_info[master].q_free[queue], 1);
+	atomic_set(&cci_dev->cci_master_info[master].done_pending[queue], 1);
+	spin_unlock_irqrestore(
+		&cci_dev->cci_master_info[master].lock_q[queue], flags);
+	cam_io_w_mb(reg_val, base + CCI_QUEUE_START_ADDR);
+
+	return cam_cci_wait(cci_dev, master, queue);
+}
+
+static int32_t cam_cci_transfer_end(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+	unsigned long flags;
+
+	spin_lock_irqsave(
+		&cci_dev->cci_master_info[master].lock_q[queue], flags);
+	if (atomic_read(&cci_dev->cci_master_info[master].q_free[queue]) == 0) {
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		rc = cam_cci_lock_queue(cci_dev, master, queue, 0);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"Failed to lock for cci: %d, master: %d, queue: %d, rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+		rc = cam_cci_wait_report_cmd(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"Failed for wait_report_cmd for cci: %d, master: %d, queue: %d, rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+	} else {
+		atomic_set(
+			&cci_dev->cci_master_info[master].done_pending[queue],
+			1);
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		rc = cam_cci_wait(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"Failed with cci_wait for cci: %d, master: %d, queue: %d, rc %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+		rc = cam_cci_lock_queue(cci_dev, master, queue, 0);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"Failed to lock_queue for cci: %d, master: %d, queue: %d, rc %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+		rc = cam_cci_wait_report_cmd(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"Failed in wait_report_cmd for cci: %d, master: %d, queue: %d, rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int32_t cam_cci_get_queue_free_size(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	uint32_t read_val = 0;
+	uint32_t reg_offset = master * 0x200 + queue * 0x100;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+
+	read_val = cam_io_r_mb(base +
+		CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+	CAM_DBG(CAM_CCI, "CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR %d max %d", read_val,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size);
+	return ((cci_dev->cci_i2c_queue_info[master][queue].max_queue_size) -
+			read_val);
+}
+
+static void cam_cci_process_half_q(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	unsigned long flags;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	uint32_t reg_val = 1 << ((master * 2) + queue);
+
+	spin_lock_irqsave(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+	if (atomic_read(&cci_dev->cci_master_info[master].q_free[queue]) == 0) {
+		cam_cci_load_report_cmd(cci_dev, master, queue);
+		atomic_set(&cci_dev->cci_master_info[master].q_free[queue], 1);
+		cam_io_w_mb(reg_val, base +
+			CCI_QUEUE_START_ADDR);
+	}
+	spin_unlock_irqrestore(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+}
+
+static int32_t cam_cci_process_full_q(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master,
+	enum cci_i2c_queue_t queue)
+{
+	int32_t rc = 0;
+	unsigned long flags;
+
+
+	spin_lock_irqsave(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+	if (atomic_read(&cci_dev->cci_master_info[master].q_free[queue]) == 1) {
+		atomic_set(
+			&cci_dev->cci_master_info[master].done_pending[queue],
+			1);
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		rc = cam_cci_wait(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"cci_wait failed for cci: %d, master: %d, queue: %d, rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+	} else {
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[master].lock_q[queue], flags);
+		rc = cam_cci_wait_report_cmd(cci_dev, master, queue);
+		if (rc < 0) {
+			CAM_ERR(CAM_CCI,
+				"Failed in wait_report for cci: %d, master: %d, queue: %d, rc: %d",
+				cci_dev->soc_info.index, master, queue, rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int32_t cam_cci_calc_cmd_len(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl, uint32_t cmd_size,
+	 struct cam_sensor_i2c_reg_array *i2c_cmd, uint32_t *pack)
+{
+	uint8_t i;
+	uint32_t len = 0;
+	uint8_t data_len = 0, addr_len = 0;
+	uint8_t pack_max_len;
+	struct cam_sensor_i2c_reg_setting *msg;
+	struct cam_sensor_i2c_reg_array *cmd = i2c_cmd;
+	uint32_t size = cmd_size;
+
+	if (!cci_dev || !c_ctrl) {
+		CAM_ERR(CAM_CCI, "Invalid arguments cci_dev:%p, c_ctrl:%p",
+			cci_dev, c_ctrl);
+		return -EINVAL;
+	}
+
+	msg = &c_ctrl->cfg.cci_i2c_write_cfg;
+	*pack = 0;
+
+	if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ ||
+		c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST) {
+		addr_len = cam_cci_convert_type_to_num_bytes(msg->addr_type);
+		len = (size + addr_len) <= (cci_dev->payload_size) ?
+			(size + addr_len):cci_dev->payload_size;
+	} else {
+		addr_len = cam_cci_convert_type_to_num_bytes(msg->addr_type);
+		data_len = cam_cci_convert_type_to_num_bytes(msg->data_type);
+		len = data_len + addr_len;
+		pack_max_len = size < (cci_dev->payload_size-len) ?
+			size : (cci_dev->payload_size-len);
+		for (i = 0; i < pack_max_len;) {
+			if (cmd->delay || ((cmd - i2c_cmd) >= (cmd_size - 1)))
+				break;
+			if (cmd->reg_addr + 1 ==
+				(cmd+1)->reg_addr) {
+				len += data_len;
+				if (len > cci_dev->payload_size) {
+					len = len - data_len;
+					break;
+				}
+				(*pack)++;
+			} else {
+				break;
+			}
+			i += data_len;
+			cmd++;
+		}
+	}
+
+	if (len > cci_dev->payload_size) {
+		CAM_ERR(CAM_CCI, "Len error: len: %u expected_len: %u",
+			len, cci_dev->payload_size);
+		return -EINVAL;
+	}
+
+	len += 1; /*add i2c WR command*/
+	len = len/4 + 1;
+
+	return len;
+}
+
+static uint32_t cam_cci_cycles_per_ms(unsigned long clk)
+{
+	uint32_t cycles_per_us;
+
+	if (clk) {
+		cycles_per_us = ((clk/1000)*256)/1000;
+	} else {
+		CAM_ERR(CAM_CCI, "Failed: Can use default: %d",
+			CYCLES_PER_MICRO_SEC_DEFAULT);
+		cycles_per_us = CYCLES_PER_MICRO_SEC_DEFAULT;
+	}
+
+	return cycles_per_us;
+}
+
+void cam_cci_get_clk_rates(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl)
+
+{
+	int32_t src_clk_idx, j;
+	uint32_t cci_clk_src;
+	unsigned long clk;
+	struct cam_cci_clk_params_t *clk_params = NULL;
+
+	enum i2c_freq_mode i2c_freq_mode = c_ctrl->cci_info->i2c_freq_mode;
+	struct cam_hw_soc_info *soc_info = &cci_dev->soc_info;
+
+	if (i2c_freq_mode >= I2C_MAX_MODES ||
+		i2c_freq_mode < I2C_STANDARD_MODE) {
+		CAM_ERR(CAM_CCI, "Invalid frequency mode: %d",
+			(int32_t)i2c_freq_mode);
+		cci_dev->clk_level_index = -1;
+		return;
+	}
+
+	clk_params = &cci_dev->cci_clk_params[i2c_freq_mode];
+	cci_clk_src = clk_params->cci_clk_src;
+
+	src_clk_idx = soc_info->src_clk_idx;
+
+	if (src_clk_idx < 0) {
+		cci_dev->cycles_per_us = CYCLES_PER_MICRO_SEC_DEFAULT;
+		cci_dev->clk_level_index = 0;
+		return;
+	}
+
+	if (cci_clk_src == 0) {
+		clk = soc_info->clk_rate[0][src_clk_idx];
+		cci_dev->cycles_per_us = cam_cci_cycles_per_ms(clk);
+		cci_dev->clk_level_index = 0;
+		return;
+	}
+
+	for (j = 0; j < CAM_MAX_VOTE; j++) {
+		clk = soc_info->clk_rate[j][src_clk_idx];
+		if (clk == cci_clk_src) {
+			cci_dev->cycles_per_us = cam_cci_cycles_per_ms(clk);
+			cci_dev->clk_level_index = j;
+			return;
+		}
+	}
+}
+
+static int32_t cam_cci_set_clk_param(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	struct cam_cci_clk_params_t *clk_params = NULL;
+	enum cci_i2c_master_t master = c_ctrl->cci_info->cci_i2c_master;
+	enum i2c_freq_mode i2c_freq_mode = c_ctrl->cci_info->i2c_freq_mode;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+
+	if ((i2c_freq_mode >= I2C_MAX_MODES) || (i2c_freq_mode < 0)) {
+		CAM_ERR(CAM_CCI, "invalid i2c_freq_mode = %d", i2c_freq_mode);
+		return -EINVAL;
+	}
+
+	clk_params = &cci_dev->cci_clk_params[i2c_freq_mode];
+
+	if (cci_dev->i2c_freq_mode[master] == i2c_freq_mode)
+		return 0;
+	if (master == MASTER_0) {
+		cam_io_w_mb(clk_params->hw_thigh << 16 |
+			clk_params->hw_tlow,
+			base + CCI_I2C_M0_SCL_CTL_ADDR);
+		cam_io_w_mb(clk_params->hw_tsu_sto << 16 |
+			clk_params->hw_tsu_sta,
+			base + CCI_I2C_M0_SDA_CTL_0_ADDR);
+		cam_io_w_mb(clk_params->hw_thd_dat << 16 |
+			clk_params->hw_thd_sta,
+			base + CCI_I2C_M0_SDA_CTL_1_ADDR);
+		cam_io_w_mb(clk_params->hw_tbuf,
+			base + CCI_I2C_M0_SDA_CTL_2_ADDR);
+		cam_io_w_mb(clk_params->hw_scl_stretch_en << 8 |
+			clk_params->hw_trdhld << 4 | clk_params->hw_tsp,
+			base + CCI_I2C_M0_MISC_CTL_ADDR);
+	} else if (master == MASTER_1) {
+		cam_io_w_mb(clk_params->hw_thigh << 16 |
+			clk_params->hw_tlow,
+			base + CCI_I2C_M1_SCL_CTL_ADDR);
+		cam_io_w_mb(clk_params->hw_tsu_sto << 16 |
+			clk_params->hw_tsu_sta,
+			base + CCI_I2C_M1_SDA_CTL_0_ADDR);
+		cam_io_w_mb(clk_params->hw_thd_dat << 16 |
+			clk_params->hw_thd_sta,
+			base + CCI_I2C_M1_SDA_CTL_1_ADDR);
+		cam_io_w_mb(clk_params->hw_tbuf,
+			base + CCI_I2C_M1_SDA_CTL_2_ADDR);
+		cam_io_w_mb(clk_params->hw_scl_stretch_en << 8 |
+			clk_params->hw_trdhld << 4 | clk_params->hw_tsp,
+			base + CCI_I2C_M1_MISC_CTL_ADDR);
+	}
+	cci_dev->i2c_freq_mode[master] = i2c_freq_mode;
+
+	return 0;
+}
+
+static int32_t cam_cci_data_queue(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl, enum cci_i2c_queue_t queue,
+	enum cci_i2c_sync sync_en)
+{
+	bool insufficient_space = false;
+	uint16_t i = 0, j = 0, k = 0, h = 0, len = 0;
+	int32_t rc = 0, free_size = 0, en_seq_write = 0;
+	uint8_t data[12];
+	struct cam_sensor_i2c_reg_setting *i2c_msg =
+		&c_ctrl->cfg.cci_i2c_write_cfg;
+	struct cam_sensor_i2c_reg_array *i2c_cmd = i2c_msg->reg_setting;
+	enum cci_i2c_master_t master = c_ctrl->cci_info->cci_i2c_master;
+	uint16_t reg_addr = 0, cmd_size = i2c_msg->size;
+	uint32_t read_val = 0, reg_offset, val, delay = 0;
+	uint32_t max_queue_size, queue_size = 0, cmd = 0;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	unsigned long flags;
+
+	if (i2c_cmd == NULL) {
+		CAM_ERR(CAM_CCI, "Failed: i2c cmd is NULL");
+		return -EINVAL;
+	}
+
+	if ((!cmd_size) || (cmd_size > CCI_I2C_MAX_WRITE)) {
+		CAM_ERR(CAM_CCI, "failed: invalid cmd_size %d",
+			cmd_size);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CCI, "addr type %d data type %d cmd_size %d",
+		i2c_msg->addr_type, i2c_msg->data_type, cmd_size);
+
+	if (i2c_msg->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "failed: invalid addr_type 0x%X",
+			i2c_msg->addr_type);
+		return -EINVAL;
+	}
+	if (i2c_msg->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "failed: invalid data_type 0x%X",
+			i2c_msg->data_type);
+		return -EINVAL;
+	}
+	reg_offset = master * 0x200 + queue * 0x100;
+
+	cam_io_w_mb(cci_dev->cci_wait_sync_cfg.cid,
+		base + CCI_SET_CID_SYNC_TIMER_ADDR +
+		cci_dev->cci_wait_sync_cfg.csid *
+		CCI_SET_CID_SYNC_TIMER_OFFSET);
+
+	val = CCI_I2C_SET_PARAM_CMD | c_ctrl->cci_info->sid << 4 |
+		c_ctrl->cci_info->retries << 16 |
+		c_ctrl->cci_info->id_map << 18;
+
+	CAM_DBG(CAM_CCI, "CCI_I2C_M0_Q0_LOAD_DATA_ADDR:val 0x%x:0x%x",
+		CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset, val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+		reg_offset);
+
+	spin_lock_irqsave(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+	atomic_set(&cci_dev->cci_master_info[master].q_free[queue], 0);
+	spin_unlock_irqrestore(&cci_dev->cci_master_info[master].lock_q[queue],
+		flags);
+
+	max_queue_size =
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size;
+
+	if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ)
+		queue_size = max_queue_size;
+	else
+		queue_size = max_queue_size/2;
+	reg_addr = i2c_cmd->reg_addr;
+
+	if (sync_en == MSM_SYNC_ENABLE && cci_dev->valid_sync &&
+		cmd_size < max_queue_size) {
+		val = CCI_I2C_WAIT_SYNC_CMD |
+			((cci_dev->cci_wait_sync_cfg.line) << 4);
+		cam_io_w_mb(val,
+			base + CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+			reg_offset);
+	}
+
+	rc = cam_cci_lock_queue(cci_dev, master, queue, 1);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI,
+			"Failed to lock_queue for cci: %d, Master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		return rc;
+	}
+
+	while (cmd_size) {
+		uint32_t pack = 0;
+
+		len = cam_cci_calc_cmd_len(cci_dev, c_ctrl, cmd_size,
+			i2c_cmd, &pack);
+		if (len <= 0) {
+			CAM_ERR(CAM_CCI,
+				"Calculate comamnd len failed, len:%d", len);
+			return -EINVAL;
+		}
+
+		read_val = cam_io_r_mb(base +
+			CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+		CAM_DBG(CAM_CCI, "CUR_WORD_CNT_ADDR %d len %d max %d",
+			read_val, len, max_queue_size);
+		/* + 1 - space alocation for Report CMD */
+		if ((read_val + len + 1) > queue_size) {
+			if ((read_val + len + 1) > max_queue_size) {
+				rc = cam_cci_process_full_q(cci_dev,
+					master, queue);
+				if (rc < 0) {
+					CAM_ERR(CAM_CCI,
+						"Failed to process full queue rc: %d",
+						rc);
+					return rc;
+				}
+				continue;
+			}
+			cam_cci_process_half_q(cci_dev, master, queue);
+		}
+
+		CAM_DBG(CAM_CCI, "cmd_size %d addr 0x%x data 0x%x",
+			cmd_size, i2c_cmd->reg_addr, i2c_cmd->reg_data);
+		delay = i2c_cmd->delay;
+		i = 0;
+		data[i++] = CCI_I2C_WRITE_CMD;
+
+		/*
+		 * in case of multiple command
+		 * MSM_CCI_I2C_WRITE : address is not continuous, so update
+		 *	address for a new packet.
+		 * MSM_CCI_I2C_WRITE_SEQ : address is continuous, need to keep
+		 *	the incremented address for a
+		 *	new packet
+		 */
+		if (c_ctrl->cmd == MSM_CCI_I2C_WRITE ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_ASYNC ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_SYNC ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_SYNC_BLOCK)
+			reg_addr = i2c_cmd->reg_addr;
+
+		if (en_seq_write == 0) {
+			/* either byte or word addr */
+			if (i2c_msg->addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE)
+				data[i++] = reg_addr;
+			else {
+				data[i++] = (reg_addr & 0xFF00) >> 8;
+				data[i++] = reg_addr & 0x00FF;
+			}
+		}
+		/* max of 10 data bytes */
+		do {
+			if (i2c_msg->data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+				data[i++] = i2c_cmd->reg_data;
+				if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ)
+					reg_addr++;
+			} else {
+				switch (i2c_msg->data_type) {
+				case CAMERA_SENSOR_I2C_TYPE_DWORD:
+					if ((i + 3) > cci_dev->payload_size) {
+						insufficient_space = true;
+						break;
+					}
+					data[i++] = (i2c_cmd->reg_data &
+						0xFF000000) >> 24;
+					fallthrough;
+				case CAMERA_SENSOR_I2C_TYPE_3B:
+					if ((i + 2) > cci_dev->payload_size) {
+						insufficient_space = true;
+						break;
+					}
+					data[i++] = (i2c_cmd->reg_data &
+						0x00FF0000) >> 16;
+					fallthrough;
+				case CAMERA_SENSOR_I2C_TYPE_WORD:
+					if ((i + 1) > cci_dev->payload_size) {
+						insufficient_space = true;
+						break;
+					}
+					data[i++] = (i2c_cmd->reg_data &
+						0x0000FF00) >> 8;
+					fallthrough;
+				case CAMERA_SENSOR_I2C_TYPE_BYTE:
+					if (i > cci_dev->payload_size) {
+						insufficient_space = true;
+						break;
+					}
+					data[i++] = i2c_cmd->reg_data &
+						0x000000FF;
+					break;
+				default:
+					CAM_ERR(CAM_CCI,
+						"invalid data type: %d",
+						i2c_msg->data_type);
+					return -EINVAL;
+				}
+
+				if (c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ &&
+					insufficient_space == false)
+					reg_addr++;
+			}
+			i2c_cmd++;
+			--cmd_size;
+		} while (((c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST) || pack--) &&
+				(cmd_size > 0) && insufficient_space == false);
+		free_size = cam_cci_get_queue_free_size(cci_dev, master,
+				queue);
+		if ((c_ctrl->cmd == MSM_CCI_I2C_WRITE_SEQ ||
+			c_ctrl->cmd == MSM_CCI_I2C_WRITE_BURST) &&
+			((i-1) == MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11) &&
+			cci_dev->support_seq_write && cmd_size > 0 &&
+			free_size > BURST_MIN_FREE_SIZE) {
+			data[0] |= 0xF0;
+			en_seq_write = 1;
+		} else {
+			data[0] |= ((i-1) << 4);
+			en_seq_write = 0;
+		}
+		len = ((i-1)/4) + 1;
+
+		read_val = cam_io_r_mb(base +
+			CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR + reg_offset);
+		for (h = 0, k = 0; h < len; h++) {
+			cmd = 0;
+			for (j = 0; (j < 4 && k < i); j++)
+				cmd |= (data[k++] << (j * 8));
+			CAM_DBG(CAM_CCI,
+				"LOAD_DATA_ADDR 0x%x, q: %d, len:%d, cnt: %d",
+				cmd, queue, len, read_val);
+			cam_io_w_mb(cmd, base +
+				CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+				master * 0x200 + queue * 0x100);
+
+			read_val += 1;
+			cam_io_w_mb(read_val, base +
+				CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+		}
+
+		if ((delay > 0) && (delay < CCI_MAX_DELAY) &&
+			en_seq_write == 0) {
+			cmd = (uint32_t)((delay * cci_dev->cycles_per_us) /
+				0x100);
+			cmd <<= 4;
+			cmd |= CCI_I2C_WAIT_CMD;
+			CAM_DBG(CAM_CCI,
+				"CCI_I2C_M0_Q0_LOAD_DATA_ADDR 0x%x", cmd);
+			cam_io_w_mb(cmd, base +
+				CCI_I2C_M0_Q0_LOAD_DATA_ADDR +
+				master * 0x200 + queue * 0x100);
+			read_val += 1;
+			cam_io_w_mb(read_val, base +
+				CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR + reg_offset);
+		}
+	}
+
+	rc = cam_cci_transfer_end(cci_dev, master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Slave: 0x%x failed rc %d",
+			(c_ctrl->cci_info->sid << 1), rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int32_t cam_cci_burst_read(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	uint32_t val = 0, i = 0, j = 0, irq_mask_update = 0;
+	unsigned long rem_jiffies, flags;
+	int32_t read_words = 0, exp_words = 0;
+	int32_t index = 0, first_byte = 0, total_read_words = 0;
+	enum cci_i2c_master_t master;
+	enum cci_i2c_queue_t queue = QUEUE_1;
+	struct cci_device                  *cci_dev = NULL;
+	struct cam_cci_read_cfg            *read_cfg = NULL;
+	struct cam_hw_soc_info             *soc_info = NULL;
+	void __iomem                       *base = NULL;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	master = c_ctrl->cci_info->cci_i2c_master;
+	read_cfg = &c_ctrl->cfg.cci_i2c_read_cfg;
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+		|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "Invalid I2C master addr");
+		return -EINVAL;
+	}
+
+	/* Set the I2C Frequency */
+	rc = cam_cci_set_clk_param(cci_dev, c_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "cam_cci_set_clk_param failed rc = %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&cci_dev->cci_master_info[master].mutex_q[queue]);
+	cci_dev->is_burst_read[master] = true;
+	reinit_completion(&cci_dev->cci_master_info[master].report_q[queue]);
+
+	soc_info = &cci_dev->soc_info;
+	base = soc_info->reg_map[0].mem_base;
+
+	/*
+	 * Call validate queue to make sure queue is empty before starting.
+	 * If this call fails, don't proceed with i2c_read call. This is to
+	 * avoid overflow / underflow of queue
+	 */
+	rc = cam_cci_validate_queue(cci_dev,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size - 1,
+		master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Initial validataion failed rc:%d", rc);
+		goto rel_mutex_q;
+	}
+
+	if (c_ctrl->cci_info->retries > CCI_I2C_READ_MAX_RETRIES) {
+		CAM_ERR(CAM_CCI,
+			"Invalid read retries info retries from slave: %d, max retries : %d",
+			c_ctrl->cci_info->retries, CCI_I2C_READ_MAX_RETRIES);
+		goto rel_mutex_q;
+	}
+
+	if (read_cfg->data == NULL) {
+		CAM_ERR(CAM_CCI, "Data ptr is NULL");
+		goto rel_mutex_q;
+	}
+
+	if (read_cfg->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "failed : Invalid addr type: %u",
+			read_cfg->addr_type);
+		rc = -EINVAL;
+		goto rel_mutex_q;
+	}
+
+	CAM_DBG(CAM_CCI, "set param sid 0x%x retries %d id_map %d",
+		c_ctrl->cci_info->sid, c_ctrl->cci_info->retries,
+		c_ctrl->cci_info->id_map);
+	val = CCI_I2C_SET_PARAM_CMD | c_ctrl->cci_info->sid << 4 |
+		c_ctrl->cci_info->retries << 16 |
+		c_ctrl->cci_info->id_map << 18;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"Failed to write param_cmd for cci: %d, master:%d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_LOCK_CMD;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"failed to write lock_cmd for cci: %d, master:%d, queue:%d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_WRITE_DISABLE_P_CMD | (read_cfg->addr_type << 4);
+	for (i = 0; i < read_cfg->addr_type; i++) {
+		val |= ((read_cfg->addr >> (i << 3)) & 0xFF)  <<
+		((read_cfg->addr_type - i) << 3);
+	}
+
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"Failed to write disable cmd for cci: %d, master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_READ_CMD | (read_cfg->num_byte << 4);
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"Failed to write read_cmd for cci: %d, master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_UNLOCK_CMD;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"Failed to write unlock_cmd for cci: %d, master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = cam_io_r_mb(base + CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR
+			+ master * 0x200 + queue * 0x100);
+	CAM_DBG(CAM_CCI, "cur word cnt 0x%x", val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR
+			+ master * 0x200 + queue * 0x100);
+
+	val = 1 << ((master * 2) + queue);
+	cam_io_w_mb(val, base + CCI_QUEUE_START_ADDR);
+
+	exp_words = ((read_cfg->num_byte / 4) + 1);
+	CAM_DBG(CAM_CCI, "waiting for threshold [exp_words %d]", exp_words);
+
+	while (total_read_words != exp_words) {
+		rem_jiffies = wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].th_complete,
+			CCI_TIMEOUT);
+		if (!rem_jiffies) {
+			rc = -ETIMEDOUT;
+			val = cam_io_r_mb(base +
+				CCI_I2C_M0_READ_BUF_LEVEL_ADDR +
+				master * 0x100);
+			CAM_ERR(CAM_CCI,
+				"wait timeout for th_complete cci: %d, master: %d, FIFO buf_lvl:0x%x, rc: %d",
+				cci_dev->soc_info.index, master, val, rc);
+			cam_cci_dump_registers(cci_dev, master, queue);
+
+			cam_cci_flush_queue(cci_dev, master);
+			goto rel_mutex_q;
+		}
+
+		if (cci_dev->cci_master_info[master].status) {
+			CAM_ERR(CAM_CCI,
+				"Error with Slave: 0x%x on cci_dev: %d, master: %d",
+				(c_ctrl->cci_info->sid << 1),
+				cci_dev->soc_info.index, master);
+			rc = -EINVAL;
+			cci_dev->cci_master_info[master].status = 0;
+			goto rel_mutex_q;
+		}
+
+		while (true) {
+			read_words = cam_io_r_mb(base +
+				CCI_I2C_M0_READ_BUF_LEVEL_ADDR +
+				master * 0x100);
+			if (read_words <= 0) {
+				CAM_DBG(CAM_CCI, "FIFO Buffer lvl is 0");
+				break;
+			}
+
+			j++;
+			CAM_DBG(CAM_CCI, "Iteration: %u read_words %d",
+				j, read_words);
+
+			total_read_words += read_words;
+			while (read_words > 0) {
+				val = cam_io_r_mb(base +
+					CCI_I2C_M0_READ_DATA_ADDR +
+					master * 0x100);
+				for (i = 0; (i < 4) &&
+					(index < read_cfg->num_byte); i++) {
+					CAM_DBG(CAM_CCI, "i:%d index:%d",
+						i, index);
+					if (!first_byte) {
+						CAM_DBG(CAM_CCI, "sid 0x%x",
+							val & 0xFF);
+						first_byte++;
+					} else {
+						read_cfg->data[index] =
+							(val  >> (i * 8)) & 0xFF;
+						CAM_DBG(CAM_CCI, "data[%d] 0x%x",
+							index,
+							read_cfg->data[index]);
+						index++;
+					}
+				}
+				read_words--;
+			}
+
+			CAM_DBG(CAM_CCI,
+				"Iteration:%u total_read_words %d",
+				j, total_read_words);
+		}
+
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		if (cci_dev->irqs_disabled) {
+			irq_mask_update =
+				cam_io_r_mb(base + CCI_IRQ_MASK_1_ADDR);
+			if (master == MASTER_0 && cci_dev->irqs_disabled &
+				CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD)
+				irq_mask_update |=
+					CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+			else if (master == MASTER_1 && cci_dev->irqs_disabled &
+				CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD)
+				irq_mask_update |=
+					CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+			cam_io_w_mb(irq_mask_update,
+				base + CCI_IRQ_MASK_1_ADDR);
+		}
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+
+		if (total_read_words == exp_words) {
+		   /*
+		    * This wait is for RD_DONE irq, if RD_DONE is
+		    * triggered we will call complete on both threshold
+		    * & read done waits. As part of the threshold wait
+		    * we will be draining the entire buffer out. This
+		    * wait is to compensate for the complete invoked for
+		    * RD_DONE exclusively.
+		    */
+			rem_jiffies = wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].rd_done,
+			CCI_TIMEOUT);
+			if (!rem_jiffies) {
+				rc = -ETIMEDOUT;
+				val = cam_io_r_mb(base +
+					CCI_I2C_M0_READ_BUF_LEVEL_ADDR +
+					master * 0x100);
+				CAM_ERR(CAM_CCI,
+					"wait timeout for RD_DONE irq for cci: %d, master: %d, FIFO buf_lvl:0x%x, rc: %d",
+					cci_dev->soc_info.index, master,
+					val, rc);
+				cam_cci_dump_registers(cci_dev,
+						master, queue);
+
+				cam_cci_flush_queue(cci_dev, master);
+				goto rel_mutex_q;
+			}
+
+			if (cci_dev->cci_master_info[master].status) {
+				CAM_ERR(CAM_CCI, "Error with Slave 0x%x",
+					(c_ctrl->cci_info->sid << 1));
+				rc = -EINVAL;
+				cci_dev->cci_master_info[master].status = 0;
+				goto rel_mutex_q;
+			}
+			break;
+		}
+	}
+
+	CAM_DBG(CAM_CCI, "Burst read successful words_read %d",
+		total_read_words);
+
+rel_mutex_q:
+	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[queue]);
+
+	spin_lock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	if (--cci_dev->cci_master_info[master].freq_ref_cnt == 0)
+		up(&cci_dev->cci_master_info[master].master_sem);
+	spin_unlock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	return rc;
+}
+
+static int32_t cam_cci_read(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	uint32_t val = 0;
+	int32_t read_words = 0, exp_words = 0;
+	int32_t index = 0, first_byte = 0;
+	uint32_t i = 0;
+	enum cci_i2c_master_t master;
+	enum cci_i2c_queue_t queue = QUEUE_1;
+	struct cci_device *cci_dev = NULL;
+	struct cam_cci_read_cfg *read_cfg = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	void __iomem *base = NULL;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	master = c_ctrl->cci_info->cci_i2c_master;
+	read_cfg = &c_ctrl->cfg.cci_i2c_read_cfg;
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+		|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "Invalid I2C master addr:%d",
+			c_ctrl->cci_info->cci_i2c_master);
+		return -EINVAL;
+	}
+
+	/* Set the I2C Frequency */
+	rc = cam_cci_set_clk_param(cci_dev, c_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "cam_cci_set_clk_param failed rc = %d", rc);
+		return rc;
+	}
+
+	mutex_lock(&cci_dev->cci_master_info[master].mutex_q[queue]);
+	cci_dev->is_burst_read[master] = false;
+	reinit_completion(&cci_dev->cci_master_info[master].report_q[queue]);
+
+	soc_info = &cci_dev->soc_info;
+	base = soc_info->reg_map[0].mem_base;
+
+	/*
+	 * Call validate queue to make sure queue is empty before starting.
+	 * If this call fails, don't proceed with i2c_read call. This is to
+	 * avoid overflow / underflow of queue
+	 */
+	rc = cam_cci_validate_queue(cci_dev,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size - 1,
+		master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Initial validataion failed rc %d", rc);
+		goto rel_mutex_q;
+	}
+
+	if (c_ctrl->cci_info->retries > CCI_I2C_READ_MAX_RETRIES) {
+		CAM_ERR(CAM_CCI,
+			"Invalid read retries info retries from slave: %d, max retries : %d",
+			c_ctrl->cci_info->retries, CCI_I2C_READ_MAX_RETRIES);
+		goto rel_mutex_q;
+	}
+
+	if (read_cfg->data == NULL) {
+		CAM_ERR(CAM_CCI, "Data ptr is NULL");
+		goto rel_mutex_q;
+	}
+
+	CAM_DBG(CAM_CCI, "master %d, queue %d", master, queue);
+	CAM_DBG(CAM_CCI, "set param sid 0x%x retries %d id_map %d",
+		c_ctrl->cci_info->sid, c_ctrl->cci_info->retries,
+		c_ctrl->cci_info->id_map);
+	val = CCI_I2C_SET_PARAM_CMD | c_ctrl->cci_info->sid << 4 |
+		c_ctrl->cci_info->retries << 16 |
+		c_ctrl->cci_info->id_map << 18;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"Failed to write param_cmd for cci: %d, master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_LOCK_CMD;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"Failed to write lock_cmd for cci: %d, master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	if (read_cfg->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_CCI, "Failed : Invalid addr type: %u",
+			read_cfg->addr_type);
+		rc = -EINVAL;
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_WRITE_DISABLE_P_CMD | (read_cfg->addr_type << 4);
+	for (i = 0; i < read_cfg->addr_type; i++) {
+		val |= ((read_cfg->addr >> (i << 3)) & 0xFF)  <<
+		((read_cfg->addr_type - i) << 3);
+	}
+
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"Failed to write disable_cmd for cci: %d, master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_READ_CMD | (read_cfg->num_byte << 4);
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"Failed to write read_cmd for cci: %d, master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = CCI_I2C_UNLOCK_CMD;
+	rc = cam_cci_write_i2c_queue(cci_dev, val, master, queue);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI,
+			"Failed to write unlock_cmd for cci: %d, master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto rel_mutex_q;
+	}
+
+	val = cam_io_r_mb(base + CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR
+			+ master * 0x200 + queue * 0x100);
+	CAM_DBG(CAM_CCI, "cur word cnt 0x%x", val);
+	cam_io_w_mb(val, base + CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR
+			+ master * 0x200 + queue * 0x100);
+
+	val = 1 << ((master * 2) + queue);
+	cam_io_w_mb(val, base + CCI_QUEUE_START_ADDR);
+	CAM_DBG(CAM_CCI, "exp_words to be read: %d",
+		((read_cfg->num_byte / 4) + 1));
+
+	if (!wait_for_completion_timeout(
+		&cci_dev->cci_master_info[master].rd_done, CCI_TIMEOUT)) {
+		cam_cci_dump_registers(cci_dev, master, queue);
+
+		rc = -ETIMEDOUT;
+		val = cam_io_r_mb(base +
+			CCI_I2C_M0_READ_BUF_LEVEL_ADDR + master * 0x100);
+		CAM_ERR(CAM_CCI,
+			"wait timeout rd_done for cci: %d, master: %d, queue: %d, FIFO buf_lvl: 0x%x, rc: %d",
+			cci_dev->soc_info.index, master, queue, val, rc);
+		cam_cci_flush_queue(cci_dev, master);
+		goto rel_mutex_q;
+	}
+
+	if (cci_dev->cci_master_info[master].status) {
+		CAM_ERR(CAM_CCI, "ERROR with Slave 0x%x:",
+			(c_ctrl->cci_info->sid << 1));
+		rc = -EINVAL;
+		cci_dev->cci_master_info[master].status = 0;
+		goto rel_mutex_q;
+	}
+
+	read_words = cam_io_r_mb(base +
+		CCI_I2C_M0_READ_BUF_LEVEL_ADDR + master * 0x100);
+	exp_words = ((read_cfg->num_byte / 4) + 1);
+	if (read_words != exp_words) {
+		CAM_ERR(CAM_CCI, "read_words = %d, exp words = %d",
+			read_words, exp_words);
+		memset(read_cfg->data, 0, read_cfg->num_byte);
+		rc = -EINVAL;
+		goto rel_mutex_q;
+	}
+	index = 0;
+	CAM_DBG(CAM_CCI, "index %d num_type %d", index, read_cfg->num_byte);
+	first_byte = 0;
+	while (read_words > 0) {
+		val = cam_io_r_mb(base +
+			CCI_I2C_M0_READ_DATA_ADDR + master * 0x100);
+		CAM_DBG(CAM_CCI, "read val 0x%x", val);
+		for (i = 0; (i < 4) && (index < read_cfg->num_byte); i++) {
+			CAM_DBG(CAM_CCI, "i:%d index:%d", i, index);
+			if (!first_byte) {
+				CAM_DBG(CAM_CCI, "sid 0x%x", val & 0xFF);
+				first_byte++;
+			} else {
+				read_cfg->data[index] =
+					(val  >> (i * 8)) & 0xFF;
+				CAM_DBG(CAM_CCI, "data[%d] 0x%x", index,
+					read_cfg->data[index]);
+				index++;
+			}
+		}
+		read_words--;
+	}
+rel_mutex_q:
+	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[queue]);
+
+	spin_lock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	if (--cci_dev->cci_master_info[master].freq_ref_cnt == 0)
+		up(&cci_dev->cci_master_info[master].master_sem);
+	spin_unlock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	return rc;
+}
+
+static int32_t cam_cci_i2c_write(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl, enum cci_i2c_queue_t queue,
+	enum cci_i2c_sync sync_en)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev;
+	enum cci_i2c_master_t master;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+
+	if (cci_dev->cci_state != CCI_STATE_ENABLED) {
+		CAM_ERR(CAM_CCI, "invalid cci state %d",
+			cci_dev->cci_state);
+		return -EINVAL;
+	}
+	master = c_ctrl->cci_info->cci_i2c_master;
+	if (master >= MASTER_MAX || master < 0
+		|| queue >= QUEUE_INVALID || queue < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Invalid I2C master addr or queue %d",
+			cci_dev->soc_info.index, master, queue);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CCI, "set param sid 0x%x retries %d id_map %d",
+		c_ctrl->cci_info->sid, c_ctrl->cci_info->retries,
+		c_ctrl->cci_info->id_map);
+
+	/* Set the I2C Frequency */
+	rc = cam_cci_set_clk_param(cci_dev, c_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "cam_cci_set_clk_param failed rc = %d", rc);
+		return rc;
+	}
+	reinit_completion(&cci_dev->cci_master_info[master].report_q[queue]);
+	/*
+	 * Call validate queue to make sure queue is empty before starting.
+	 * If this call fails, don't proceed with i2c_write call. This is to
+	 * avoid overflow / underflow of queue
+	 */
+	rc = cam_cci_validate_queue(cci_dev,
+		cci_dev->cci_i2c_queue_info[master][queue].max_queue_size-1,
+		master, queue);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Initial validataion failed rc %d",
+			rc);
+		goto ERROR;
+	}
+	if (c_ctrl->cci_info->retries > CCI_I2C_READ_MAX_RETRIES) {
+		CAM_ERR(CAM_CCI,
+			"Invalid read retries info retries from slave: %d, max retries : %d",
+			c_ctrl->cci_info->retries, CCI_I2C_READ_MAX_RETRIES);
+		goto ERROR;
+	}
+	rc = cam_cci_data_queue(cci_dev, c_ctrl, queue, sync_en);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI,
+			"Failed in queueing the data for cci: %d, master: %d, queue: %d, rc: %d",
+			cci_dev->soc_info.index, master, queue, rc);
+		goto ERROR;
+	}
+
+ERROR:
+	spin_lock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	if (--cci_dev->cci_master_info[master].freq_ref_cnt == 0)
+		up(&cci_dev->cci_master_info[master].master_sem);
+	spin_unlock(&cci_dev->cci_master_info[master].freq_cnt_lock);
+	return rc;
+}
+
+static void cam_cci_write_async_helper(struct work_struct *work)
+{
+	int rc;
+	struct cci_device *cci_dev;
+	struct cci_write_async *write_async =
+		container_of(work, struct cci_write_async, work);
+	struct cam_sensor_i2c_reg_setting *i2c_msg;
+	enum cci_i2c_master_t master;
+	struct cam_cci_master_info *cci_master_info;
+
+	cam_common_util_thread_switch_delay_detect(
+		"CCI workq schedule",
+		write_async->workq_scheduled_ts,
+		CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+	cci_dev = write_async->cci_dev;
+	i2c_msg = &write_async->c_ctrl.cfg.cci_i2c_write_cfg;
+	master = write_async->c_ctrl.cci_info->cci_i2c_master;
+	if (master >= MASTER_MAX || master < 0) {
+		CAM_ERR(CAM_CCI, "CCI%d_I2C_M%d Invalid I2C master addr",
+			cci_dev->soc_info.index, master);
+		return;
+	}
+
+	cci_master_info = &cci_dev->cci_master_info[master];
+
+	mutex_lock(&cci_master_info->mutex_q[write_async->queue]);
+	rc = cam_cci_i2c_write(&(cci_dev->v4l2_dev_str.sd),
+		&write_async->c_ctrl, write_async->queue, write_async->sync_en);
+	mutex_unlock(&cci_master_info->mutex_q[write_async->queue]);
+	if (rc < 0)
+		CAM_ERR(CAM_CCI, "Failed rc: %d", rc);
+
+	kfree(write_async->c_ctrl.cfg.cci_i2c_write_cfg.reg_setting);
+	kfree(write_async);
+}
+
+static int32_t cam_cci_i2c_write_async(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl, enum cci_i2c_queue_t queue,
+	enum cci_i2c_sync sync_en)
+{
+	int32_t rc = 0;
+	struct cci_write_async *write_async;
+	struct cci_device *cci_dev;
+	struct cam_sensor_i2c_reg_setting *cci_i2c_write_cfg;
+	struct cam_sensor_i2c_reg_setting *cci_i2c_write_cfg_w;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+
+	write_async = kzalloc(sizeof(*write_async), GFP_KERNEL);
+	if (!write_async) {
+		CAM_ERR(CAM_CCI, "Memory allocation failed for write_async");
+		return -ENOMEM;
+	}
+
+
+	INIT_WORK(&write_async->work, cam_cci_write_async_helper);
+	write_async->cci_dev = cci_dev;
+	write_async->c_ctrl = *c_ctrl;
+	write_async->queue = queue;
+	write_async->sync_en = sync_en;
+
+	cci_i2c_write_cfg = &c_ctrl->cfg.cci_i2c_write_cfg;
+	cci_i2c_write_cfg_w = &write_async->c_ctrl.cfg.cci_i2c_write_cfg;
+
+	if (cci_i2c_write_cfg->size == 0) {
+		kfree(write_async);
+		return -EINVAL;
+	}
+
+	cci_i2c_write_cfg_w->reg_setting =
+		kzalloc(sizeof(struct cam_sensor_i2c_reg_array)*
+		cci_i2c_write_cfg->size, GFP_KERNEL);
+	if (!cci_i2c_write_cfg_w->reg_setting) {
+		CAM_ERR(CAM_CCI, "Couldn't allocate memory for reg_setting");
+		kfree(write_async);
+		return -ENOMEM;
+	}
+	memcpy(cci_i2c_write_cfg_w->reg_setting,
+		cci_i2c_write_cfg->reg_setting,
+		(sizeof(struct cam_sensor_i2c_reg_array)*
+						cci_i2c_write_cfg->size));
+
+	cci_i2c_write_cfg_w->addr_type = cci_i2c_write_cfg->addr_type;
+	cci_i2c_write_cfg_w->addr_type = cci_i2c_write_cfg->addr_type;
+	cci_i2c_write_cfg_w->data_type = cci_i2c_write_cfg->data_type;
+	cci_i2c_write_cfg_w->size = cci_i2c_write_cfg->size;
+	cci_i2c_write_cfg_w->delay = cci_i2c_write_cfg->delay;
+
+	write_async->workq_scheduled_ts = ktime_get();
+	queue_work(cci_dev->write_wq[write_async->queue], &write_async->work);
+
+	return rc;
+}
+
+static int32_t cam_cci_read_bytes_v_1_2(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev = NULL;
+	enum cci_i2c_master_t master;
+	struct cam_cci_read_cfg *read_cfg = NULL;
+	uint16_t read_bytes = 0;
+
+	if (!sd || !c_ctrl) {
+		CAM_ERR(CAM_CCI, "sd %pK c_ctrl %pK", sd, c_ctrl);
+		return -EINVAL;
+	}
+	if (!c_ctrl->cci_info) {
+		CAM_ERR(CAM_CCI, "cci_info NULL");
+		return -EINVAL;
+	}
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+	if (cci_dev->cci_state != CCI_STATE_ENABLED) {
+		CAM_ERR(CAM_CCI, "invalid cci state %d", cci_dev->cci_state);
+		return -EINVAL;
+	}
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+			|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "Invalid I2C master addr");
+		return -EINVAL;
+	}
+
+	master = c_ctrl->cci_info->cci_i2c_master;
+	read_cfg = &c_ctrl->cfg.cci_i2c_read_cfg;
+	if ((!read_cfg->num_byte) || (read_cfg->num_byte > CCI_I2C_MAX_READ)) {
+		CAM_ERR(CAM_CCI, "read num bytes 0");
+		rc = -EINVAL;
+		goto ERROR;
+	}
+
+	reinit_completion(&cci_dev->cci_master_info[master].rd_done);
+	read_bytes = read_cfg->num_byte;
+	CAM_DBG(CAM_CCI, "Bytes to read %u", read_bytes);
+	do {
+		if (read_bytes >= CCI_READ_MAX_V_1_2)
+			read_cfg->num_byte = CCI_READ_MAX_V_1_2;
+		else
+			read_cfg->num_byte = read_bytes;
+
+		cci_dev->is_burst_read[master] = false;
+		rc = cam_cci_read(sd, c_ctrl);
+		if (rc) {
+			CAM_ERR(CAM_CCI, "failed to read rc:%d", rc);
+			goto ERROR;
+		}
+
+		if (read_bytes >= CCI_READ_MAX_V_1_2) {
+			read_cfg->addr += CCI_READ_MAX_V_1_2;
+			read_cfg->data += CCI_READ_MAX_V_1_2;
+			read_bytes -= CCI_READ_MAX_V_1_2;
+		} else {
+			read_bytes = 0;
+		}
+	} while (read_bytes);
+
+ERROR:
+	return rc;
+}
+
+static int32_t cam_cci_read_bytes(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev = NULL;
+	enum cci_i2c_master_t master;
+	struct cam_cci_read_cfg *read_cfg = NULL;
+	uint16_t read_bytes = 0;
+
+	if (!sd || !c_ctrl) {
+		CAM_ERR(CAM_CCI, "Invalid arg sd %pK c_ctrl %pK", sd, c_ctrl);
+		return -EINVAL;
+	}
+	if (!c_ctrl->cci_info) {
+		CAM_ERR(CAM_CCI, "cci_info NULL");
+		return -EINVAL;
+	}
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "cci_dev NULL");
+		return -EINVAL;
+	}
+	if (cci_dev->cci_state != CCI_STATE_ENABLED) {
+		CAM_ERR(CAM_CCI, "invalid cci state %d", cci_dev->cci_state);
+		return -EINVAL;
+	}
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+			|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "Invalid I2C master addr");
+		return -EINVAL;
+	}
+
+	master = c_ctrl->cci_info->cci_i2c_master;
+	read_cfg = &c_ctrl->cfg.cci_i2c_read_cfg;
+	if ((!read_cfg->num_byte) || (read_cfg->num_byte > CCI_I2C_MAX_READ)) {
+		CAM_ERR(CAM_CCI, "read num bytes 0");
+		rc = -EINVAL;
+		goto ERROR;
+	}
+
+	read_bytes = read_cfg->num_byte;
+
+	/*
+	 * To avoid any conflicts due to back to back trigger of
+	 * THRESHOLD irq's, we reinit the threshold wait before
+	 * we load the burst read cmd.
+	 */
+	mutex_lock(&cci_dev->cci_master_info[master].mutex_q[QUEUE_1]);
+	reinit_completion(&cci_dev->cci_master_info[master].rd_done);
+	reinit_completion(&cci_dev->cci_master_info[master].th_complete);
+	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[QUEUE_1]);
+
+	CAM_DBG(CAM_CCI, "Bytes to read %u", read_bytes);
+	do {
+		if (read_bytes >= CCI_I2C_MAX_BYTE_COUNT)
+			read_cfg->num_byte = CCI_I2C_MAX_BYTE_COUNT;
+		else
+			read_cfg->num_byte = read_bytes;
+
+		if (read_cfg->num_byte >= CCI_READ_MAX) {
+			rc = cam_cci_burst_read(sd, c_ctrl);
+		} else {
+			rc = cam_cci_read(sd, c_ctrl);
+		}
+		if (rc) {
+			CAM_ERR(CAM_CCI, "Failed to read rc:%d", rc);
+			goto ERROR;
+		}
+
+		if (read_bytes >= CCI_I2C_MAX_BYTE_COUNT) {
+			read_cfg->addr += (CCI_I2C_MAX_BYTE_COUNT /
+				read_cfg->data_type);
+			read_cfg->data += CCI_I2C_MAX_BYTE_COUNT;
+			read_bytes -= CCI_I2C_MAX_BYTE_COUNT;
+		} else {
+			read_bytes = 0;
+		}
+	} while (read_bytes);
+
+ERROR:
+	return rc;
+}
+
+static int32_t cam_cci_i2c_set_sync_prms(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev || !c_ctrl) {
+		CAM_ERR(CAM_CCI,
+			"Failed: invalid params cci_dev:%pK, c_ctrl:%pK",
+			cci_dev, c_ctrl);
+		rc = -EINVAL;
+		return rc;
+	}
+	cci_dev->cci_wait_sync_cfg = c_ctrl->cfg.cci_wait_sync_cfg;
+	cci_dev->valid_sync = cci_dev->cci_wait_sync_cfg.csid < 0 ? 0 : 1;
+
+	return rc;
+}
+
+static int32_t cam_cci_release(struct v4l2_subdev *sd,
+	enum cci_i2c_master_t master)
+{
+	uint8_t rc = 0;
+	struct cci_device *cci_dev;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+
+	rc = cam_cci_soc_release(cci_dev, master);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Failed in releasing the cci: %d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int32_t cam_cci_write(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev;
+	enum cci_i2c_master_t master;
+	struct cam_cci_master_info *cci_master_info;
+	uint32_t i;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev || !c_ctrl) {
+		CAM_ERR(CAM_CCI,
+			"Failed: invalid params cci_dev:%pK, c_ctrl:%pK",
+			cci_dev, c_ctrl);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	master = c_ctrl->cci_info->cci_i2c_master;
+
+	if (c_ctrl->cci_info->cci_i2c_master >= MASTER_MAX
+		|| c_ctrl->cci_info->cci_i2c_master < 0) {
+		CAM_ERR(CAM_CCI, "Invalid I2C master addr");
+		return -EINVAL;
+	}
+
+	cci_master_info = &cci_dev->cci_master_info[master];
+
+	CAM_DBG(CAM_CCI, "ctrl_cmd = %d", c_ctrl->cmd);
+	switch (c_ctrl->cmd) {
+	case MSM_CCI_I2C_WRITE_SYNC_BLOCK:
+		mutex_lock(&cci_master_info->mutex_q[SYNC_QUEUE]);
+		rc = cam_cci_i2c_write(sd, c_ctrl,
+			SYNC_QUEUE, MSM_SYNC_ENABLE);
+		mutex_unlock(&cci_master_info->mutex_q[SYNC_QUEUE]);
+		break;
+	case MSM_CCI_I2C_WRITE_SYNC:
+		rc = cam_cci_i2c_write_async(sd, c_ctrl,
+			SYNC_QUEUE, MSM_SYNC_ENABLE);
+		break;
+	case MSM_CCI_I2C_WRITE:
+	case MSM_CCI_I2C_WRITE_SEQ:
+	case MSM_CCI_I2C_WRITE_BURST:
+		for (i = 0; i < NUM_QUEUES; i++) {
+			if (mutex_trylock(&cci_master_info->mutex_q[i])) {
+				rc = cam_cci_i2c_write(sd, c_ctrl, i,
+					MSM_SYNC_DISABLE);
+				mutex_unlock(&cci_master_info->mutex_q[i]);
+				return rc;
+			}
+		}
+		mutex_lock(&cci_master_info->mutex_q[PRIORITY_QUEUE]);
+		rc = cam_cci_i2c_write(sd, c_ctrl,
+			PRIORITY_QUEUE, MSM_SYNC_DISABLE);
+		mutex_unlock(&cci_master_info->mutex_q[PRIORITY_QUEUE]);
+		break;
+	case MSM_CCI_I2C_WRITE_ASYNC:
+		rc = cam_cci_i2c_write_async(sd, c_ctrl,
+			PRIORITY_QUEUE, MSM_SYNC_DISABLE);
+		break;
+	default:
+		rc = -ENOIOCTLCMD;
+	}
+
+	return rc;
+}
+
+int32_t cam_cci_core_cfg(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *cci_ctrl)
+{
+	int32_t rc = 0;
+	struct cci_device *cci_dev = v4l2_get_subdevdata(sd);
+	enum cci_i2c_master_t master = MASTER_MAX;
+
+	if (!cci_dev) {
+		CAM_ERR(CAM_CCI, "CCI_DEV IS NULL");
+		return -EINVAL;
+	}
+
+	if (!cci_ctrl) {
+		CAM_ERR(CAM_CCI, "CCI_CTRL IS NULL");
+		return -EINVAL;
+	}
+
+	master = cci_ctrl->cci_info->cci_i2c_master;
+	if (master >= MASTER_MAX) {
+		CAM_ERR(CAM_CCI, "INVALID MASTER: %d", master);
+		return -EINVAL;
+	}
+
+	if (cci_dev->cci_master_info[master].status < 0) {
+		CAM_WARN(CAM_CCI, "CCI hardware is resetting");
+		return -EAGAIN;
+	}
+	CAM_DBG(CAM_CCI, "master = %d, cmd = %d", master, cci_ctrl->cmd);
+
+	switch (cci_ctrl->cmd) {
+	case MSM_CCI_INIT:
+		mutex_lock(&cci_dev->init_mutex);
+		rc = cam_cci_init(sd, cci_ctrl);
+		mutex_unlock(&cci_dev->init_mutex);
+		break;
+	case MSM_CCI_RELEASE:
+		mutex_lock(&cci_dev->init_mutex);
+		rc = cam_cci_release(sd, master);
+		mutex_unlock(&cci_dev->init_mutex);
+		break;
+	case MSM_CCI_I2C_READ:
+		/*
+		 * CCI version 1.2 does not support burst read
+		 * due to the absence of the read threshold register
+		 */
+		if (cci_dev->hw_version == CCI_VERSION_1_2_9) {
+			CAM_DBG(CAM_CCI, "cci-v1.2 no burst read");
+			rc = cam_cci_read_bytes_v_1_2(sd, cci_ctrl);
+		} else {
+			rc = cam_cci_read_bytes(sd, cci_ctrl);
+		}
+		break;
+	case MSM_CCI_I2C_WRITE:
+	case MSM_CCI_I2C_WRITE_SEQ:
+	case MSM_CCI_I2C_WRITE_BURST:
+	case MSM_CCI_I2C_WRITE_SYNC:
+	case MSM_CCI_I2C_WRITE_ASYNC:
+	case MSM_CCI_I2C_WRITE_SYNC_BLOCK:
+		rc = cam_cci_write(sd, cci_ctrl);
+		break;
+	case MSM_CCI_GPIO_WRITE:
+		break;
+	case MSM_CCI_SET_SYNC_CID:
+		rc = cam_cci_i2c_set_sync_prms(sd, cci_ctrl);
+		break;
+
+	default:
+		rc = -ENOIOCTLCMD;
+	}
+
+	cci_ctrl->status = rc;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_core.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_CCI_CORE_H_
+#define _CAM_CCI_CORE_H_
+
+#include <linux/irqreturn.h>
+#include <media/cam_sensor.h>
+#include "cam_cci_dev.h"
+#include "cam_cci_soc.h"
+
+/**
+ * @cci_dev: CCI device structure
+ * @c_ctrl: CCI control structure
+ *
+ * This API gets CCI clk rates
+ */
+void cam_cci_get_clk_rates(struct cci_device *cci_dev,
+	struct cam_cci_ctrl *c_ctrl);
+
+/**
+ * @sd: V4L2 sub device
+ * @c_ctrl: CCI control structure
+ *
+ * This API handles I2C operations for CCI
+ */
+int32_t cam_cci_core_cfg(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *cci_ctrl);
+
+/**
+ * @irq_num: IRQ number
+ * @data: CCI private structure
+ *
+ * This API handles CCI IRQs
+ */
+irqreturn_t cam_cci_irq(int irq_num, void *data);
+
+#endif /* _CAM_CCI_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_dev.c
@@ -0,0 +1,612 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_cci_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_cci_soc.h"
+#include "cam_cci_core.h"
+#include "camera_main.h"
+
+#define CCI_MAX_DELAY 1000000
+
+static struct v4l2_subdev *g_cci_subdev[MAX_CCI];
+static struct dentry *debugfs_root;
+
+struct v4l2_subdev *cam_cci_get_subdev(int cci_dev_index)
+{
+	struct v4l2_subdev *sub_device = NULL;
+
+	if (cci_dev_index < MAX_CCI)
+		sub_device = g_cci_subdev[cci_dev_index];
+	else
+		CAM_WARN(CAM_CCI, "Index: %u is beyond max num CCI allowed: %u",
+			cci_dev_index,
+			MAX_CCI);
+
+	return sub_device;
+}
+
+static long cam_cci_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int32_t rc = 0;
+
+	if (arg == NULL) {
+		CAM_ERR(CAM_CCI, "Args is Null");
+		return -EINVAL;
+	}
+
+	switch (cmd) {
+	case VIDIOC_MSM_CCI_CFG:
+		rc = cam_cci_core_cfg(sd, arg);
+		break;
+	case VIDIOC_CAM_CONTROL:
+		break;
+	default:
+		CAM_ERR(CAM_CCI, "Invalid ioctl cmd: %d", cmd);
+		rc = -ENOIOCTLCMD;
+	}
+
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_cci_subdev_compat_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	return cam_cci_subdev_ioctl(sd, cmd, NULL);
+}
+#endif
+
+irqreturn_t cam_cci_irq(int irq_num, void *data)
+{
+	uint32_t irq_status0, irq_status1, reg_bmsk;
+	uint32_t irq_update_rd_done = 0;
+	struct cci_device *cci_dev = data;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+	void __iomem *base = soc_info->reg_map[0].mem_base;
+	unsigned long flags;
+	bool rd_done_th_assert = false;
+
+	irq_status0 = cam_io_r_mb(base + CCI_IRQ_STATUS_0_ADDR);
+	irq_status1 = cam_io_r_mb(base + CCI_IRQ_STATUS_1_ADDR);
+	CAM_DBG(CAM_CCI,
+		"BASE: %pK, irq0:%x irq1:%x",
+		base, irq_status0, irq_status1);
+
+	cam_io_w_mb(irq_status0, base + CCI_IRQ_CLEAR_0_ADDR);
+	cam_io_w_mb(irq_status1, base + CCI_IRQ_CLEAR_1_ADDR);
+
+	reg_bmsk = CCI_IRQ_MASK_1_RMSK;
+	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD) &&
+	!(irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK)) {
+		reg_bmsk &= ~CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		cci_dev->irqs_disabled |=
+			CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+
+	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD) &&
+	!(irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK)) {
+		reg_bmsk &= ~CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		cci_dev->irqs_disabled |=
+			CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+
+	if (reg_bmsk != CCI_IRQ_MASK_1_RMSK) {
+		cam_io_w_mb(reg_bmsk, base + CCI_IRQ_MASK_1_ADDR);
+		CAM_DBG(CAM_CCI, "Updating the reg mask for irq1: 0x%x",
+			reg_bmsk);
+	} else if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK ||
+		irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) {
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) {
+			spin_lock_irqsave(&cci_dev->lock_status, flags);
+			if (cci_dev->irqs_disabled &
+				CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD) {
+				irq_update_rd_done |=
+					CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+				cci_dev->irqs_disabled &=
+					~CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD;
+			}
+			spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) {
+			spin_lock_irqsave(&cci_dev->lock_status, flags);
+			if (cci_dev->irqs_disabled &
+				CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD) {
+				irq_update_rd_done |=
+					CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+				cci_dev->irqs_disabled &=
+					~CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD;
+			}
+			spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+		}
+	}
+
+	if (irq_update_rd_done != 0) {
+		irq_update_rd_done |= cam_io_r_mb(base + CCI_IRQ_MASK_1_ADDR);
+		cam_io_w_mb(irq_update_rd_done, base + CCI_IRQ_MASK_1_ADDR);
+	}
+
+	cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
+
+	if (irq_status0 & CCI_IRQ_STATUS_0_RST_DONE_ACK_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+		if (cci_dev->cci_master_info[MASTER_0].reset_pending == true) {
+			cci_master_info = &cci_dev->cci_master_info[MASTER_0];
+			cci_dev->cci_master_info[MASTER_0].reset_pending =
+				false;
+			if (!cci_master_info->status)
+				complete(&cci_master_info->reset_complete);
+
+			complete_all(&cci_master_info->rd_done);
+			complete_all(&cci_master_info->th_complete);
+		}
+		if (cci_dev->cci_master_info[MASTER_1].reset_pending == true) {
+			cci_master_info = &cci_dev->cci_master_info[MASTER_1];
+			cci_dev->cci_master_info[MASTER_1].reset_pending =
+				false;
+			if (!cci_master_info->status)
+				complete(&cci_master_info->reset_complete);
+
+			complete_all(&cci_master_info->rd_done);
+			complete_all(&cci_master_info->th_complete);
+		}
+	}
+
+	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) &&
+		(irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD)) {
+		cci_dev->cci_master_info[MASTER_0].status = 0;
+		rd_done_th_assert = true;
+		complete(&cci_dev->cci_master_info[MASTER_0].th_complete);
+		complete(&cci_dev->cci_master_info[MASTER_0].rd_done);
+	}
+	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) &&
+		(!rd_done_th_assert)) {
+		cci_dev->cci_master_info[MASTER_0].status = 0;
+		rd_done_th_assert = true;
+		if (cci_dev->is_burst_read[MASTER_0])
+			complete(
+			&cci_dev->cci_master_info[MASTER_0].th_complete);
+		complete(&cci_dev->cci_master_info[MASTER_0].rd_done);
+	}
+	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD) &&
+		(!rd_done_th_assert)) {
+		cci_dev->cci_master_info[MASTER_0].status = 0;
+		complete(&cci_dev->cci_master_info[MASTER_0].th_complete);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0_REPORT_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+
+		cci_master_info = &cci_dev->cci_master_info[MASTER_0];
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[MASTER_0].lock_q[QUEUE_0],
+			flags);
+		atomic_set(&cci_master_info->q_free[QUEUE_0], 0);
+		cci_master_info->status = 0;
+		if (atomic_read(&cci_master_info->done_pending[QUEUE_0]) == 1) {
+			complete(&cci_master_info->report_q[QUEUE_0]);
+			atomic_set(&cci_master_info->done_pending[QUEUE_0], 0);
+		}
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[MASTER_0].lock_q[QUEUE_0],
+			flags);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q1_REPORT_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+
+		cci_master_info = &cci_dev->cci_master_info[MASTER_0];
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[MASTER_0].lock_q[QUEUE_1],
+			flags);
+		atomic_set(&cci_master_info->q_free[QUEUE_1], 0);
+		cci_master_info->status = 0;
+		if (atomic_read(&cci_master_info->done_pending[QUEUE_1]) == 1) {
+			complete(&cci_master_info->report_q[QUEUE_1]);
+			atomic_set(&cci_master_info->done_pending[QUEUE_1], 0);
+		}
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[MASTER_0].lock_q[QUEUE_1],
+			flags);
+	}
+	rd_done_th_assert = false;
+	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) &&
+		(irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD)) {
+		cci_dev->cci_master_info[MASTER_1].status = 0;
+		rd_done_th_assert = true;
+		complete(&cci_dev->cci_master_info[MASTER_1].th_complete);
+		complete(&cci_dev->cci_master_info[MASTER_1].rd_done);
+	}
+	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) &&
+		(!rd_done_th_assert)) {
+		cci_dev->cci_master_info[MASTER_1].status = 0;
+		rd_done_th_assert = true;
+		if (cci_dev->is_burst_read[MASTER_1])
+			complete(
+			&cci_dev->cci_master_info[MASTER_1].th_complete);
+		complete(&cci_dev->cci_master_info[MASTER_1].rd_done);
+	}
+	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD) &&
+		(!rd_done_th_assert)) {
+		cci_dev->cci_master_info[MASTER_1].status = 0;
+		complete(&cci_dev->cci_master_info[MASTER_1].th_complete);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0_REPORT_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+
+		cci_master_info = &cci_dev->cci_master_info[MASTER_1];
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_0],
+			flags);
+		atomic_set(&cci_master_info->q_free[QUEUE_0], 0);
+		cci_master_info->status = 0;
+		if (atomic_read(&cci_master_info->done_pending[QUEUE_0]) == 1) {
+			complete(&cci_master_info->report_q[QUEUE_0]);
+			atomic_set(&cci_master_info->done_pending[QUEUE_0], 0);
+		}
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_0],
+			flags);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q1_REPORT_BMSK) {
+		struct cam_cci_master_info *cci_master_info;
+
+		cci_master_info = &cci_dev->cci_master_info[MASTER_1];
+		spin_lock_irqsave(
+			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_1],
+			flags);
+		atomic_set(&cci_master_info->q_free[QUEUE_1], 0);
+		cci_master_info->status = 0;
+		if (atomic_read(&cci_master_info->done_pending[QUEUE_1]) == 1) {
+			complete(&cci_master_info->report_q[QUEUE_1]);
+			atomic_set(&cci_master_info->done_pending[QUEUE_1], 0);
+		}
+		spin_unlock_irqrestore(
+			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_1],
+			flags);
+	}
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_PAUSE)
+		CAM_DBG(CAM_CCI, "RD_PAUSE ON MASTER_0");
+
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_PAUSE)
+		CAM_DBG(CAM_CCI, "RD_PAUSE ON MASTER_1");
+
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_HALT_ACK_BMSK) {
+		cci_dev->cci_master_info[MASTER_0].reset_pending = true;
+		cam_io_w_mb(CCI_M0_RESET_RMSK,
+			base + CCI_RESET_CMD_ADDR);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0Q1_HALT_ACK_BMSK) {
+		cci_dev->cci_master_info[MASTER_1].reset_pending = true;
+		cam_io_w_mb(CCI_M1_RESET_RMSK,
+			base + CCI_RESET_CMD_ADDR);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_ERROR_BMSK) {
+		cci_dev->cci_master_info[MASTER_0].status = -EINVAL;
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0_NACK_ERROR_BMSK) {
+			CAM_ERR(CAM_CCI,
+				"Base:%pK,cci: %d, M0_Q0 NACK ERROR: 0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+			cam_cci_dump_registers(cci_dev, MASTER_0,
+					QUEUE_0);
+			complete_all(&cci_dev->cci_master_info[MASTER_0]
+				.report_q[QUEUE_0]);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q1_NACK_ERROR_BMSK) {
+			CAM_ERR(CAM_CCI,
+				"Base:%pK,cci: %d, M0_Q1 NACK ERROR: 0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+			cam_cci_dump_registers(cci_dev, MASTER_0,
+					QUEUE_1);
+			complete_all(&cci_dev->cci_master_info[MASTER_0]
+			.report_q[QUEUE_1]);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_ERROR_BMSK)
+			CAM_ERR(CAM_CCI,
+			"Base:%pK, cci: %d, M0 QUEUE_OVER/UNDER_FLOW OR CMD ERR: 0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_ERROR_BMSK)
+			CAM_ERR(CAM_CCI,
+				"Base: %pK, M0 RD_OVER/UNDER_FLOW ERROR: 0x%x",
+				base, irq_status0);
+
+		cci_dev->cci_master_info[MASTER_0].reset_pending = true;
+		cam_io_w_mb(CCI_M0_RESET_RMSK, base + CCI_RESET_CMD_ADDR);
+	}
+	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_ERROR_BMSK) {
+		cci_dev->cci_master_info[MASTER_1].status = -EINVAL;
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0_NACK_ERROR_BMSK) {
+			CAM_ERR(CAM_CCI,
+				"Base:%pK, cci: %d, M1_Q0 NACK ERROR: 0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+			cam_cci_dump_registers(cci_dev, MASTER_1,
+					QUEUE_0);
+			complete_all(&cci_dev->cci_master_info[MASTER_1]
+			.report_q[QUEUE_0]);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q1_NACK_ERROR_BMSK) {
+			CAM_ERR(CAM_CCI,
+				"Base:%pK, cci: %d, M1_Q1 NACK ERROR: 0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+			cam_cci_dump_registers(cci_dev, MASTER_1,
+				QUEUE_1);
+			complete_all(&cci_dev->cci_master_info[MASTER_1]
+			.report_q[QUEUE_1]);
+		}
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0Q1_ERROR_BMSK)
+			CAM_ERR(CAM_CCI,
+			"Base:%pK, cci: %d, M1 QUEUE_OVER_UNDER_FLOW OR CMD ERROR:0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+		if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_ERROR_BMSK)
+			CAM_ERR(CAM_CCI,
+				"Base:%pK, cci: %d, M1 RD_OVER/UNDER_FLOW ERROR: 0x%x",
+				base, cci_dev->soc_info.index, irq_status0);
+
+		cci_dev->cci_master_info[MASTER_1].reset_pending = true;
+		cam_io_w_mb(CCI_M1_RESET_RMSK, base + CCI_RESET_CMD_ADDR);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int cam_cci_irq_routine(struct v4l2_subdev *sd, u32 status,
+	bool *handled)
+{
+	struct cci_device *cci_dev = v4l2_get_subdevdata(sd);
+	irqreturn_t ret;
+	struct cam_hw_soc_info *soc_info =
+		&cci_dev->soc_info;
+
+	ret = cam_cci_irq(soc_info->irq_num, cci_dev);
+	*handled = true;
+	return 0;
+}
+
+static struct v4l2_subdev_core_ops cci_subdev_core_ops = {
+	.ioctl = cam_cci_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_cci_subdev_compat_ioctl,
+#endif
+	.interrupt_service_routine = cam_cci_irq_routine,
+};
+
+static const struct v4l2_subdev_ops cci_subdev_ops = {
+	.core = &cci_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cci_subdev_intern_ops;
+
+static int cam_cci_get_debug(void *data, u64 *val)
+{
+	struct cci_device *cci_dev = (struct cci_device *)data;
+
+	*val = cci_dev->dump_en;
+
+	return 0;
+}
+
+static int cam_cci_set_debug(void *data, u64 val)
+{
+	struct cci_device *cci_dev = (struct cci_device *)data;
+
+	cci_dev->dump_en = val;
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(cam_cci_debug,
+	cam_cci_get_debug,
+	cam_cci_set_debug, "%16llu\n");
+
+static int cam_cci_create_debugfs_entry(struct cci_device *cci_dev)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!debugfs_root) {
+		dbgfileptr = debugfs_create_dir("cam_cci", NULL);
+		if (!dbgfileptr) {
+			CAM_ERR(CAM_CCI, "debugfs directory creation fail");
+			rc = -ENOENT;
+			goto end;
+		}
+		debugfs_root = dbgfileptr;
+	}
+
+	if (cci_dev->soc_info.index == 0) {
+		dbgfileptr = debugfs_create_file("en_dump_cci0", 0644,
+			debugfs_root, cci_dev, &cam_cci_debug);
+		if (IS_ERR(dbgfileptr)) {
+			if (PTR_ERR(dbgfileptr) == -ENODEV)
+				CAM_WARN(CAM_CCI, "DebugFS not enabled");
+			else {
+				rc = PTR_ERR(dbgfileptr);
+				goto end;
+			}
+		}
+	} else {
+		dbgfileptr = debugfs_create_file("en_dump_cci1", 0644,
+			debugfs_root, cci_dev, &cam_cci_debug);
+		if (IS_ERR(dbgfileptr)) {
+			if (PTR_ERR(dbgfileptr) == -ENODEV)
+				CAM_WARN(CAM_CCI, "DebugFS not enabled");
+			else {
+				rc = PTR_ERR(dbgfileptr);
+				goto end;
+			}
+		}
+	}
+end:
+	return rc;
+}
+
+static int cam_cci_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_cpas_register_params cpas_parms;
+	struct cci_device *new_cci_dev;
+	struct cam_hw_soc_info *soc_info = NULL;
+	int rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	new_cci_dev = devm_kzalloc(&pdev->dev, sizeof(struct cci_device),
+		GFP_KERNEL);
+	if (!new_cci_dev) {
+		CAM_ERR(CAM_CCI, "Memory allocation failed for cci_dev");
+		return -ENOMEM;
+	}
+	soc_info = &new_cci_dev->soc_info;
+
+	new_cci_dev->v4l2_dev_str.pdev = pdev;
+
+	soc_info->pdev = pdev;
+	soc_info->dev = &pdev->dev;
+	soc_info->dev_name = pdev->name;
+
+	rc = cam_cci_parse_dt_info(pdev, new_cci_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Resource get Failed rc:%d", rc);
+		goto cci_no_resource;
+	}
+
+	new_cci_dev->v4l2_dev_str.internal_ops =
+		&cci_subdev_intern_ops;
+	new_cci_dev->v4l2_dev_str.ops =
+		&cci_subdev_ops;
+	strscpy(new_cci_dev->device_name, CAMX_CCI_DEV_NAME,
+		sizeof(new_cci_dev->device_name));
+	new_cci_dev->v4l2_dev_str.name =
+		new_cci_dev->device_name;
+	new_cci_dev->v4l2_dev_str.sd_flags = V4L2_SUBDEV_FL_HAS_EVENTS;
+	new_cci_dev->v4l2_dev_str.ent_function =
+		CAM_CCI_DEVICE_TYPE;
+	new_cci_dev->v4l2_dev_str.token =
+		new_cci_dev;
+
+	rc = cam_register_subdev(&(new_cci_dev->v4l2_dev_str));
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Fail with cam_register_subdev rc: %d", rc);
+		goto cci_no_resource;
+	}
+
+	platform_set_drvdata(pdev, &(new_cci_dev->v4l2_dev_str.sd));
+	v4l2_set_subdevdata(&new_cci_dev->v4l2_dev_str.sd, new_cci_dev);
+	if (soc_info->index >= MAX_CCI) {
+		CAM_ERR(CAM_CCI, "Invalid index: %d max supported:%d",
+			soc_info->index, MAX_CCI-1);
+		goto cci_no_resource;
+	}
+
+	g_cci_subdev[soc_info->index] = &new_cci_dev->v4l2_dev_str.sd;
+	mutex_init(&(new_cci_dev->init_mutex));
+	CAM_DBG(CAM_CCI, "Device Type :%d", soc_info->index);
+
+	cpas_parms.cam_cpas_client_cb = NULL;
+	cpas_parms.cell_index = soc_info->index;
+	cpas_parms.dev = &pdev->dev;
+	cpas_parms.userdata = new_cci_dev;
+	strscpy(cpas_parms.identifier, "cci", CAM_HW_IDENTIFIER_LENGTH);
+	rc = cam_cpas_register_client(&cpas_parms);
+	if (rc) {
+		CAM_ERR(CAM_CCI, "CPAS registration failed rc:%d", rc);
+		goto cci_unregister_subdev;
+	}
+
+	CAM_DBG(CAM_CCI, "CPAS registration successful handle=%d",
+		cpas_parms.client_handle);
+	new_cci_dev->cpas_handle = cpas_parms.client_handle;
+
+	rc = cam_cci_create_debugfs_entry(new_cci_dev);
+	if (rc) {
+		CAM_WARN(CAM_CCI, "debugfs creation failed");
+		rc = 0;
+	}
+	CAM_DBG(CAM_CCI, "Component bound successfully");
+	return rc;
+
+cci_unregister_subdev:
+	cam_unregister_subdev(&(new_cci_dev->v4l2_dev_str));
+cci_no_resource:
+	devm_kfree(&pdev->dev, new_cci_dev);
+	return rc;
+}
+
+static void cam_cci_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	struct v4l2_subdev *subdev = platform_get_drvdata(pdev);
+	struct cci_device *cci_dev =
+		v4l2_get_subdevdata(subdev);
+
+	cam_cpas_unregister_client(cci_dev->cpas_handle);
+	debugfs_remove_recursive(debugfs_root);
+	cam_cci_soc_remove(pdev, cci_dev);
+	rc = cam_unregister_subdev(&(cci_dev->v4l2_dev_str));
+	if (rc < 0)
+		CAM_ERR(CAM_CCI, "Fail with cam_unregister_subdev. rc:%d", rc);
+
+	devm_kfree(&pdev->dev, cci_dev);
+}
+
+const static struct component_ops cam_cci_component_ops = {
+	.bind = cam_cci_component_bind,
+	.unbind = cam_cci_component_unbind,
+};
+
+static int cam_cci_platform_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CCI, "Adding CCI component");
+	rc = component_add(&pdev->dev, &cam_cci_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CCI, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_cci_device_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_cci_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_cci_dt_match[] = {
+	{.compatible = "qcom,cci"},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_cci_dt_match);
+
+struct platform_driver cci_driver = {
+	.probe = cam_cci_platform_probe,
+	.remove = cam_cci_device_remove,
+	.driver = {
+		.name = CAMX_CCI_DEV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_cci_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_cci_init_module(void)
+{
+	return platform_driver_register(&cci_driver);
+}
+
+void cam_cci_exit_module(void)
+{
+	platform_driver_unregister(&cci_driver);
+}
+
+MODULE_DESCRIPTION("MSM CCI driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_dev.h
@@ -0,0 +1,319 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CCI_DEV_H_
+#define _CAM_CCI_DEV_H_
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/of_platform.h>
+#include <linux/module.h>
+#include <linux/irqreturn.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/debugfs.h>
+#include <linux/platform_device.h>
+#include <linux/semaphore.h>
+#include <media/cam_sensor.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_io_util.h>
+#include <cam_sensor_util.h>
+#include "cam_subdev.h"
+#include <cam_cpas_api.h>
+#include "cam_cci_hwreg.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_req_mgr_workq.h"
+
+#define CCI_I2C_QUEUE_0_SIZE 128
+#define CCI_I2C_QUEUE_1_SIZE 32
+#define CCI_I2C_QUEUE_0_SIZE_V_1_2 64
+#define CCI_I2C_QUEUE_1_SIZE_V_1_2 16
+#define CYCLES_PER_MICRO_SEC_DEFAULT 4915
+#define CCI_MAX_DELAY 1000000
+
+#define CCI_TIMEOUT msecs_to_jiffies(1500)
+#define NUM_QUEUES 2
+
+#define MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11 11
+#define BURST_MIN_FREE_SIZE 8
+
+/* Max bytes that can be read per CCI read transaction */
+#define CCI_READ_MAX 256
+#define CCI_READ_MAX_V_1_2 0xE
+#define CCI_I2C_READ_MAX_RETRIES 3
+#define CCI_I2C_MAX_READ 20480
+#define CCI_I2C_MAX_WRITE 20480
+#define CCI_I2C_MAX_BYTE_COUNT 65535
+
+#define CAMX_CCI_DEV_NAME "cam-cci-driver"
+
+#define MAX_CCI 2
+
+#define PRIORITY_QUEUE (QUEUE_0)
+#define SYNC_QUEUE (QUEUE_1)
+
+#define CAM_CCI_NACK_DUMP_EN      BIT(1)
+#define CAM_CCI_TIMEOUT_DUMP_EN   BIT(2)
+
+#define CCI_VERSION_1_2_9 0x10020009
+#define REPORT_IDSIZE 16
+enum cci_i2c_sync {
+	MSM_SYNC_DISABLE,
+	MSM_SYNC_ENABLE,
+};
+
+enum cam_cci_cmd_type {
+	MSM_CCI_INIT,
+	MSM_CCI_RELEASE,
+	MSM_CCI_SET_SID,
+	MSM_CCI_SET_FREQ,
+	MSM_CCI_SET_SYNC_CID,
+	MSM_CCI_I2C_READ,
+	MSM_CCI_I2C_WRITE,
+	MSM_CCI_I2C_WRITE_SEQ,
+	MSM_CCI_I2C_WRITE_BURST,
+	MSM_CCI_I2C_WRITE_ASYNC,
+	MSM_CCI_GPIO_WRITE,
+	MSM_CCI_I2C_WRITE_SYNC,
+	MSM_CCI_I2C_WRITE_SYNC_BLOCK,
+};
+
+enum cci_i2c_queue_t {
+	QUEUE_0,
+	QUEUE_1,
+	QUEUE_INVALID,
+};
+
+struct cam_cci_wait_sync_cfg {
+	uint16_t cid;
+	int16_t csid;
+	uint16_t line;
+	uint16_t delay;
+};
+
+struct cam_cci_gpio_cfg {
+	uint16_t gpio_queue;
+	uint16_t i2c_queue;
+};
+
+struct cam_cci_read_cfg {
+	uint32_t addr;
+	uint16_t addr_type;
+	uint8_t *data;
+	uint16_t num_byte;
+	uint16_t data_type;
+};
+
+struct cam_cci_i2c_queue_info {
+	uint32_t max_queue_size;
+	uint32_t report_id;
+	uint32_t irq_en;
+	uint32_t capture_rep_data;
+};
+
+struct cam_cci_master_info {
+	int32_t status;
+	atomic_t q_free[NUM_QUEUES];
+	uint8_t q_lock[NUM_QUEUES];
+	uint8_t reset_pending;
+	struct mutex mutex;
+	struct completion reset_complete;
+	struct completion rd_done;
+	struct completion th_complete;
+	struct mutex mutex_q[NUM_QUEUES];
+	struct completion report_q[NUM_QUEUES];
+	atomic_t done_pending[NUM_QUEUES];
+	spinlock_t lock_q[NUM_QUEUES];
+	struct semaphore master_sem;
+	spinlock_t freq_cnt_lock;
+	uint16_t freq_ref_cnt;
+	bool is_initilized;
+};
+
+struct cam_cci_clk_params_t {
+	uint16_t hw_thigh;
+	uint16_t hw_tlow;
+	uint16_t hw_tsu_sto;
+	uint16_t hw_tsu_sta;
+	uint16_t hw_thd_dat;
+	uint16_t hw_thd_sta;
+	uint16_t hw_tbuf;
+	uint8_t hw_scl_stretch_en;
+	uint8_t hw_trdhld;
+	uint8_t hw_tsp;
+	uint32_t cci_clk_src;
+};
+
+enum cam_cci_state_t {
+	CCI_STATE_ENABLED,
+	CCI_STATE_DISABLED,
+};
+
+/**
+ * struct cci_device
+ * @pdev:                       Platform device
+ * @subdev:                     V4L2 sub device
+ * @base:                       Base address of CCI device
+ * @hw_version:                 Hardware version
+ * @ref_count:                  Reference Count
+ * @cci_state:                  CCI state machine
+ * @num_clk:                    Number of CCI clock
+ * @cci_clk:                    CCI clock structure
+ * @cci_clk_info:               CCI clock information
+ * @cam_cci_i2c_queue_info:     CCI queue information
+ * @i2c_freq_mode:              I2C frequency of operations
+ * @master_active_slave:        Number of active/connected slaves for master
+ * @cci_clk_params:             CCI hw clk params
+ * @cci_gpio_tbl:               CCI GPIO table
+ * @cci_gpio_tbl_size:          GPIO table size
+ * @cci_pinctrl:                Pinctrl structure
+ * @cci_pinctrl_status:         CCI pinctrl status
+ * @cci_clk_src:                CCI clk src rate
+ * @cci_vreg:                   CCI regulator structure
+ * @cci_reg_ptr:                CCI individual regulator structure
+ * @regulator_count:            Regulator count
+ * @support_seq_write:          Set this flag when sequential write is enabled
+ * @write_wq:                   Work queue structure
+ * @valid_sync:                 Is it a valid sync with CSID
+ * @v4l2_dev_str:               V4L2 device structure
+ * @cci_wait_sync_cfg:          CCI sync config
+ * @cycles_per_us:              Cycles per micro sec
+ * @payload_size:               CCI packet payload size
+ * @irq_status1:                Store irq_status1 to be cleared after
+ *                              draining FIFO buffer for burst read
+ * @lock_status:                to protect changes to irq_status1
+ * @is_burst_read:              Flag to determine if we are performing
+ *                              a burst read operation or not
+ * @irqs_disabled:              Mask for IRQs that are disabled
+ * @init_mutex:                 Mutex for maintaining refcount for attached
+ *                              devices to cci during init/deinit.
+ * @dump_en:                    To enable the selective dump
+ */
+struct cci_device {
+	struct v4l2_subdev subdev;
+	struct cam_hw_soc_info soc_info;
+	uint32_t hw_version;
+	uint8_t ref_count;
+	enum cam_cci_state_t cci_state;
+	struct cam_cci_i2c_queue_info
+		cci_i2c_queue_info[MASTER_MAX][NUM_QUEUES];
+	struct cam_cci_master_info cci_master_info[MASTER_MAX];
+	enum i2c_freq_mode i2c_freq_mode[MASTER_MAX];
+	uint8_t master_active_slave[MASTER_MAX];
+	struct cam_cci_clk_params_t cci_clk_params[I2C_MAX_MODES];
+	struct msm_pinctrl_info cci_pinctrl;
+	uint8_t cci_pinctrl_status;
+	uint8_t support_seq_write;
+	struct workqueue_struct *write_wq[MASTER_MAX];
+	struct cam_cci_wait_sync_cfg cci_wait_sync_cfg;
+	uint8_t valid_sync;
+	struct cam_subdev v4l2_dev_str;
+	uint32_t cycles_per_us;
+	int32_t clk_level_index;
+	uint8_t payload_size;
+	char device_name[20];
+	uint32_t cpas_handle;
+	uint32_t irq_status1;
+	spinlock_t lock_status;
+	bool is_burst_read[MASTER_MAX];
+	uint32_t irqs_disabled;
+	struct mutex init_mutex;
+	uint64_t  dump_en;
+};
+
+enum cam_cci_i2c_cmd_type {
+	CCI_I2C_SET_PARAM_CMD = 1,
+	CCI_I2C_WAIT_CMD,
+	CCI_I2C_WAIT_SYNC_CMD,
+	CCI_I2C_WAIT_GPIO_EVENT_CMD,
+	CCI_I2C_TRIG_I2C_EVENT_CMD,
+	CCI_I2C_LOCK_CMD,
+	CCI_I2C_UNLOCK_CMD,
+	CCI_I2C_REPORT_CMD,
+	CCI_I2C_WRITE_CMD,
+	CCI_I2C_READ_CMD,
+	CCI_I2C_WRITE_DISABLE_P_CMD,
+	CCI_I2C_READ_DISABLE_P_CMD,
+	CCI_I2C_WRITE_CMD2,
+	CCI_I2C_WRITE_CMD3,
+	CCI_I2C_REPEAT_CMD,
+	CCI_I2C_INVALID_CMD,
+};
+
+enum cam_cci_gpio_cmd_type {
+	CCI_GPIO_SET_PARAM_CMD = 1,
+	CCI_GPIO_WAIT_CMD,
+	CCI_GPIO_WAIT_SYNC_CMD,
+	CCI_GPIO_WAIT_GPIO_IN_EVENT_CMD,
+	CCI_GPIO_WAIT_I2C_Q_TRIG_EVENT_CMD,
+	CCI_GPIO_OUT_CMD,
+	CCI_GPIO_TRIG_EVENT_CMD,
+	CCI_GPIO_REPORT_CMD,
+	CCI_GPIO_REPEAT_CMD,
+	CCI_GPIO_CONTINUE_CMD,
+	CCI_GPIO_INVALID_CMD,
+};
+
+struct cam_sensor_cci_client {
+	struct v4l2_subdev *cci_subdev;
+	uint32_t freq;
+	enum i2c_freq_mode i2c_freq_mode;
+	enum cci_i2c_master_t cci_i2c_master;
+	uint16_t sid;
+	uint16_t cid;
+	uint32_t timeout;
+	uint16_t retries;
+	uint16_t id_map;
+	uint16_t cci_device;
+};
+
+struct cam_cci_ctrl {
+	int32_t status;
+	struct cam_sensor_cci_client *cci_info;
+	enum cam_cci_cmd_type cmd;
+	union {
+		struct cam_sensor_i2c_reg_setting cci_i2c_write_cfg;
+		struct cam_cci_read_cfg cci_i2c_read_cfg;
+		struct cam_cci_wait_sync_cfg cci_wait_sync_cfg;
+		struct cam_cci_gpio_cfg gpio_cfg;
+	} cfg;
+};
+
+struct cci_write_async {
+	struct cci_device *cci_dev;
+	struct cam_cci_ctrl c_ctrl;
+	enum cci_i2c_queue_t queue;
+	struct work_struct work;
+	ktime_t workq_scheduled_ts;
+	enum cci_i2c_sync sync_en;
+};
+
+irqreturn_t cam_cci_irq(int irq_num, void *data);
+
+struct v4l2_subdev *cam_cci_get_subdev(int cci_dev_index);
+void cam_cci_dump_registers(struct cci_device *cci_dev,
+		enum cci_i2c_master_t master, enum cci_i2c_queue_t queue);
+
+/**
+ * @brief : API to register CCI hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_cci_init_module(void);
+
+/**
+ * @brief : API to remove CCI Hw from platform framework.
+ */
+void cam_cci_exit_module(void);
+#define VIDIOC_MSM_CCI_CFG \
+	_IOWR('V', BASE_VIDIOC_PRIVATE + 23, struct cam_cci_ctrl)
+
+#endif /* _CAM_CCI_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_hwreg.h
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2015, 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CCI_HWREG_
+#define _CAM_CCI_HWREG_
+
+#define CCI_HW_VERSION_ADDR                                         0x00000000
+#define CCI_RESET_CMD_ADDR                                          0x00000004
+#define CCI_RESET_CMD_RMSK                                          0x0f73f3f7
+#define CCI_M0_RESET_RMSK                                                0x3F1
+#define CCI_M1_RESET_RMSK                                              0x3F001
+#define CCI_QUEUE_START_ADDR                                        0x00000008
+#define CCI_SET_CID_SYNC_TIMER_ADDR                                 0x00000010
+#define CCI_SET_CID_SYNC_TIMER_OFFSET                               0x00000004
+#define CCI_I2C_M0_SCL_CTL_ADDR                                     0x00000100
+#define CCI_I2C_M0_SDA_CTL_0_ADDR                                   0x00000104
+#define CCI_I2C_M0_SDA_CTL_1_ADDR                                   0x00000108
+#define CCI_I2C_M0_SDA_CTL_2_ADDR                                   0x0000010c
+#define CCI_I2C_M0_READ_DATA_ADDR                                   0x00000118
+#define CCI_I2C_M0_MISC_CTL_ADDR                                    0x00000110
+#define CCI_I2C_M0_READ_BUF_LEVEL_ADDR                              0x0000011C
+#define CCI_HALT_REQ_ADDR                                           0x00000034
+#define CCI_M0_HALT_REQ_RMSK                                               0x1
+#define CCI_M1_HALT_REQ_RMSK                                               0x2
+#define CCI_I2C_M1_SCL_CTL_ADDR                                     0x00000200
+#define CCI_I2C_M1_SDA_CTL_0_ADDR                                   0x00000204
+#define CCI_I2C_M1_SDA_CTL_1_ADDR                                   0x00000208
+#define CCI_I2C_M1_SDA_CTL_2_ADDR                                   0x0000020c
+#define CCI_I2C_M1_MISC_CTL_ADDR                                    0x00000210
+#define CCI_I2C_M0_Q0_CUR_WORD_CNT_ADDR                             0x00000304
+#define CCI_I2C_M0_Q0_CUR_CMD_ADDR                                  0x00000308
+#define CCI_I2C_M0_Q0_REPORT_STATUS_ADDR                            0x0000030c
+#define CCI_I2C_M0_Q0_EXEC_WORD_CNT_ADDR                            0x00000300
+#define CCI_I2C_M0_Q0_LOAD_DATA_ADDR                                0x00000310
+#define CCI_IRQ_MASK_0_ADDR                                         0x00000c04
+#define CCI_IRQ_MASK_0_RMSK                                         0x7fff7ff7
+#define CCI_IRQ_MASK_1_ADDR                                         0x00000c10
+#define CCI_IRQ_MASK_1_RMSK                                         0x00110000
+#define CCI_IRQ_CLEAR_0_ADDR                                        0x00000c08
+#define CCI_IRQ_CLEAR_1_ADDR                                        0x00000c14
+#define CCI_IRQ_STATUS_0_ADDR                                       0x00000c0c
+#define CCI_IRQ_STATUS_1_ADDR                                       0x00000c18
+#define CCI_IRQ_STATUS_0_I2C_M1_Q0Q1_HALT_ACK_BMSK                   0x4000000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_HALT_ACK_BMSK                   0x2000000
+#define CCI_IRQ_STATUS_0_RST_DONE_ACK_BMSK                           0x1000000
+#define CCI_IRQ_STATUS_0_I2C_M1_Q1_REPORT_BMSK                        0x100000
+#define CCI_IRQ_STATUS_0_I2C_M1_Q0_REPORT_BMSK                         0x10000
+#define CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK                            0x1000
+#define CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD                          0x100000
+#define CCI_IRQ_STATUS_1_I2C_M1_RD_PAUSE                              0x200000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q1_REPORT_BMSK                           0x100
+#define CCI_IRQ_STATUS_0_I2C_M0_Q0_REPORT_BMSK                            0x10
+#define CCI_IRQ_STATUS_0_I2C_M0_ERROR_BMSK                          0x18000EE6
+#define CCI_IRQ_STATUS_0_I2C_M1_ERROR_BMSK                          0x60EE6000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q0_NACK_ERROR_BMSK                   0x8000000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q1_NACK_ERROR_BMSK                  0x10000000
+#define CCI_IRQ_STATUS_0_I2C_M1_Q0_NACK_ERROR_BMSK                  0x20000000
+#define CCI_IRQ_STATUS_0_I2C_M1_Q1_NACK_ERROR_BMSK                  0x40000000
+#define CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_ERROR_BMSK                          0xEE0
+#define CCI_IRQ_STATUS_0_I2C_M1_Q0Q1_ERROR_BMSK                       0xEE0000
+#define CCI_IRQ_STATUS_0_I2C_M0_RD_ERROR_BMSK                              0x6
+#define CCI_IRQ_STATUS_0_I2C_M1_RD_ERROR_BMSK                           0x6000
+#define CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK                               0x1
+#define CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD                           0x10000
+#define CCI_IRQ_STATUS_1_I2C_M0_RD_PAUSE                               0x20000
+#define CCI_I2C_M0_RD_THRESHOLD_ADDR                                0x00000120
+#define CCI_I2C_M1_RD_THRESHOLD_ADDR                                0x00000220
+#define CCI_I2C_RD_THRESHOLD_VALUE                                        0x30
+#define CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR                               0x00000c00
+
+#define DEBUG_TOP_REG_START                                                0x0
+#define DEBUG_TOP_REG_COUNT                                                 14
+#define DEBUG_MASTER_REG_START                                           0x100
+#define DEBUG_MASTER_REG_COUNT                                               9
+#define DEBUG_MASTER_QUEUE_REG_START                                     0x300
+#define DEBUG_MASTER_QUEUE_REG_COUNT                                         7
+#define DEBUG_INTR_REG_START                                             0xC00
+#define DEBUG_INTR_REG_COUNT                                                 7
+#endif /* _CAM_CCI_HWREG_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_soc.c
@@ -0,0 +1,445 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_cci_dev.h"
+#include "cam_cci_core.h"
+
+static int cam_cci_init_master(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master)
+{
+	int i = 0, rc = 0;
+	void __iomem *base = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	uint32_t max_queue_0_size = 0, max_queue_1_size = 0;
+
+	soc_info = &cci_dev->soc_info;
+	base = soc_info->reg_map[0].mem_base;
+
+	if (cci_dev->hw_version == CCI_VERSION_1_2_9) {
+		max_queue_0_size = CCI_I2C_QUEUE_0_SIZE_V_1_2;
+		max_queue_1_size = CCI_I2C_QUEUE_1_SIZE_V_1_2;
+	} else {
+		max_queue_0_size = CCI_I2C_QUEUE_0_SIZE;
+		max_queue_1_size = CCI_I2C_QUEUE_1_SIZE;
+	}
+
+	cci_dev->master_active_slave[master]++;
+	if (!cci_dev->cci_master_info[master].is_initilized) {
+		/* Re-initialize the completion */
+		reinit_completion(
+		&cci_dev->cci_master_info[master].reset_complete);
+		reinit_completion(&cci_dev->cci_master_info[master].rd_done);
+
+		/* reinit the reports for the queue */
+		for (i = 0; i < NUM_QUEUES; i++)
+			reinit_completion(
+			&cci_dev->cci_master_info[master].report_q[i]);
+
+		/* Set reset pending flag to true */
+		cci_dev->cci_master_info[master].reset_pending = true;
+		cci_dev->cci_master_info[master].status = 0;
+		if (cci_dev->ref_count == 1) {
+			cam_io_w_mb(CCI_RESET_CMD_RMSK,
+				base + CCI_RESET_CMD_ADDR);
+			cam_io_w_mb(0x1, base + CCI_RESET_CMD_ADDR);
+		} else {
+			cam_io_w_mb((master == MASTER_0) ?
+				CCI_M0_RESET_RMSK : CCI_M1_RESET_RMSK,
+				base + CCI_RESET_CMD_ADDR);
+		}
+		if (!wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].reset_complete,
+			CCI_TIMEOUT)) {
+			CAM_ERR(CAM_CCI,
+				"Failed: reset complete timeout for master: %d",
+				master);
+			rc = -ETIMEDOUT;
+			cci_dev->master_active_slave[master]--;
+			return rc;
+		}
+
+		flush_workqueue(cci_dev->write_wq[master]);
+
+		/* Setting up the queue size for master */
+		cci_dev->cci_i2c_queue_info[master][QUEUE_0].max_queue_size
+					= max_queue_0_size;
+		cci_dev->cci_i2c_queue_info[master][QUEUE_1].max_queue_size
+					= max_queue_1_size;
+
+		CAM_DBG(CAM_CCI, "CCI Master[%d] :: Q0: %d Q1: %d", master,
+			cci_dev->cci_i2c_queue_info[master][QUEUE_0]
+				.max_queue_size,
+			cci_dev->cci_i2c_queue_info[master][QUEUE_1]
+				.max_queue_size);
+
+		cci_dev->cci_master_info[master].status = 0;
+		cci_dev->cci_master_info[master].is_initilized = true;
+		cci_dev->is_burst_read[master] = false;
+	}
+
+	return 0;
+}
+
+int cam_cci_init(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl)
+{
+	uint8_t i = 0;
+	int32_t rc = 0;
+	struct cci_device *cci_dev;
+	enum cci_i2c_master_t master = c_ctrl->cci_info->cci_i2c_master;
+	struct cam_ahb_vote ahb_vote;
+	struct cam_axi_vote axi_vote = {0};
+	struct cam_hw_soc_info *soc_info = NULL;
+	void __iomem *base = NULL;
+
+	cci_dev = v4l2_get_subdevdata(sd);
+	if (!cci_dev || !c_ctrl) {
+		CAM_ERR(CAM_CCI,
+			"failed: invalid params cci_dev:%pK, c_ctrl:%pK",
+			cci_dev, c_ctrl);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	soc_info = &cci_dev->soc_info;
+	base = soc_info->reg_map[0].mem_base;
+
+	if (!soc_info || !base) {
+		CAM_ERR(CAM_CCI,
+			"failed: invalid params soc_info:%pK, base:%pK",
+			soc_info, base);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (master >= MASTER_MAX || master < 0) {
+		CAM_ERR(CAM_CCI, "Incorrect Master: %d", master);
+		return -EINVAL;
+	}
+
+	if (!cci_dev->write_wq[master]) {
+		CAM_ERR(CAM_CCI, "Null memory for write wq[:%d]", master);
+		rc = -ENOMEM;
+		return rc;
+	}
+
+	if (cci_dev->ref_count++) {
+		rc = cam_cci_init_master(cci_dev, master);
+		if (rc) {
+			CAM_ERR(CAM_CCI, "Failed to init: Master: %d: rc: %d",
+				master, rc);
+			cci_dev->ref_count--;
+		}
+		CAM_DBG(CAM_CCI, "ref_count %d, master: %d",
+			cci_dev->ref_count, master);
+		return rc;
+	}
+
+	ahb_vote.type = CAM_VOTE_ABSOLUTE;
+	ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+	axi_vote.num_paths = 1;
+	axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+	axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+	axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+	axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+	rc = cam_cpas_start(cci_dev->cpas_handle, &ahb_vote, &axi_vote);
+	if (rc) {
+		CAM_ERR(CAM_CCI, "CPAS start failed rc= %d", rc);
+		return rc;
+	}
+
+	cam_cci_get_clk_rates(cci_dev, c_ctrl);
+
+	/* Enable Regulators and IRQ*/
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		CAM_LOWSVS_VOTE, true);
+	if (rc < 0) {
+		CAM_DBG(CAM_CCI, "request platform resources failed, rc: %d",
+			rc);
+		goto platform_enable_failed;
+	}
+
+	cci_dev->hw_version = cam_io_r_mb(base + CCI_HW_VERSION_ADDR);
+	CAM_DBG(CAM_CCI, "hw_version = 0x%x", cci_dev->hw_version);
+
+	cci_dev->payload_size = MSM_CCI_WRITE_DATA_PAYLOAD_SIZE_11;
+	cci_dev->support_seq_write = 1;
+
+	rc = cam_cci_init_master(cci_dev, master);
+	if (rc) {
+		CAM_ERR(CAM_CCI, "Failed to init: Master: %d, rc: %d",
+			master, rc);
+		goto reset_complete_failed;
+	}
+
+	for (i = 0; i < MASTER_MAX; i++)
+		cci_dev->i2c_freq_mode[i] = I2C_MAX_MODES;
+
+	cam_io_w_mb(CCI_IRQ_MASK_0_RMSK, base + CCI_IRQ_MASK_0_ADDR);
+	cam_io_w_mb(CCI_IRQ_MASK_0_RMSK, base + CCI_IRQ_CLEAR_0_ADDR);
+	cam_io_w_mb(CCI_IRQ_MASK_1_RMSK, base + CCI_IRQ_MASK_1_ADDR);
+	cam_io_w_mb(CCI_IRQ_MASK_1_RMSK, base + CCI_IRQ_CLEAR_1_ADDR);
+	cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
+
+	/* Set RD FIFO threshold for M0 & M1 */
+	if (cci_dev->hw_version != CCI_VERSION_1_2_9) {
+		cam_io_w_mb(CCI_I2C_RD_THRESHOLD_VALUE,
+				base + CCI_I2C_M0_RD_THRESHOLD_ADDR);
+		cam_io_w_mb(CCI_I2C_RD_THRESHOLD_VALUE,
+				base + CCI_I2C_M1_RD_THRESHOLD_ADDR);
+	}
+
+	cci_dev->cci_state = CCI_STATE_ENABLED;
+
+	return 0;
+
+reset_complete_failed:
+	cam_soc_util_disable_platform_resource(soc_info, 1, 1);
+platform_enable_failed:
+	cci_dev->ref_count--;
+	cam_cpas_stop(cci_dev->cpas_handle);
+
+	return rc;
+}
+
+void cam_cci_soc_remove(struct platform_device *pdev,
+	struct cci_device *cci_dev)
+{
+	struct cam_hw_soc_info *soc_info = &cci_dev->soc_info;
+
+	cam_soc_util_release_platform_resource(soc_info);
+}
+
+static void cam_cci_init_cci_params(struct cci_device *new_cci_dev)
+{
+	uint8_t i = 0, j = 0;
+
+	for (i = 0; i < MASTER_MAX; i++) {
+		new_cci_dev->cci_master_info[i].status = 0;
+		new_cci_dev->cci_master_info[i].freq_ref_cnt = 0;
+		new_cci_dev->cci_master_info[i].is_initilized = false;
+		mutex_init(&new_cci_dev->cci_master_info[i].mutex);
+		sema_init(&new_cci_dev->cci_master_info[i].master_sem, 1);
+		spin_lock_init(&new_cci_dev->cci_master_info[i].freq_cnt_lock);
+		init_completion(
+			&new_cci_dev->cci_master_info[i].reset_complete);
+		init_completion(
+			&new_cci_dev->cci_master_info[i].th_complete);
+		init_completion(
+			&new_cci_dev->cci_master_info[i].rd_done);
+
+		for (j = 0; j < NUM_QUEUES; j++) {
+			mutex_init(&new_cci_dev->cci_master_info[i].mutex_q[j]);
+			init_completion(
+				&new_cci_dev->cci_master_info[i].report_q[j]);
+			spin_lock_init(
+				&new_cci_dev->cci_master_info[i].lock_q[j]);
+		}
+	}
+	spin_lock_init(&new_cci_dev->lock_status);
+}
+
+static void cam_cci_init_default_clk_params(struct cci_device *cci_dev,
+	uint8_t index)
+{
+	/* default clock params are for 100Khz */
+	cci_dev->cci_clk_params[index].hw_thigh = 201;
+	cci_dev->cci_clk_params[index].hw_tlow = 174;
+	cci_dev->cci_clk_params[index].hw_tsu_sto = 204;
+	cci_dev->cci_clk_params[index].hw_tsu_sta = 231;
+	cci_dev->cci_clk_params[index].hw_thd_dat = 22;
+	cci_dev->cci_clk_params[index].hw_thd_sta = 162;
+	cci_dev->cci_clk_params[index].hw_tbuf = 227;
+	cci_dev->cci_clk_params[index].hw_scl_stretch_en = 0;
+	cci_dev->cci_clk_params[index].hw_trdhld = 6;
+	cci_dev->cci_clk_params[index].hw_tsp = 3;
+	cci_dev->cci_clk_params[index].cci_clk_src = 37500000;
+}
+
+static void cam_cci_init_clk_params(struct cci_device *cci_dev)
+{
+	int32_t rc = 0;
+	uint32_t val = 0;
+	uint8_t count = 0;
+	struct device_node *of_node = cci_dev->v4l2_dev_str.pdev->dev.of_node;
+	struct device_node *src_node = NULL;
+
+	for (count = 0; count < I2C_MAX_MODES; count++) {
+
+		if (count == I2C_STANDARD_MODE)
+			src_node = of_find_node_by_name(of_node,
+				"qcom,i2c_standard_mode");
+		else if (count == I2C_FAST_MODE)
+			src_node = of_find_node_by_name(of_node,
+				"qcom,i2c_fast_mode");
+		else if (count == I2C_FAST_PLUS_MODE)
+			src_node = of_find_node_by_name(of_node,
+				"qcom,i2c_fast_plus_mode");
+		else
+			src_node = of_find_node_by_name(of_node,
+				"qcom,i2c_custom_mode");
+
+		rc = of_property_read_u32(src_node, "hw-thigh", &val);
+		CAM_DBG(CAM_CCI, "hw-thigh %d, rc %d", val, rc);
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_thigh = val;
+			rc = of_property_read_u32(src_node, "hw-tlow",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tlow %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tlow = val;
+			rc = of_property_read_u32(src_node, "hw-tsu-sto",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tsu-sto %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tsu_sto = val;
+			rc = of_property_read_u32(src_node, "hw-tsu-sta",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tsu-sta %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tsu_sta = val;
+			rc = of_property_read_u32(src_node, "hw-thd-dat",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-thd-dat %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_thd_dat = val;
+			rc = of_property_read_u32(src_node, "hw-thd-sta",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-thd-sta %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_thd_sta = val;
+			rc = of_property_read_u32(src_node, "hw-tbuf",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tbuf %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tbuf = val;
+			rc = of_property_read_u32(src_node,
+				"hw-scl-stretch-en", &val);
+			CAM_DBG(CAM_CCI, "hw-scl-stretch-en %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_scl_stretch_en = val;
+			rc = of_property_read_u32(src_node, "hw-trdhld",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-trdhld %d, rc %d",
+				val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_trdhld = val;
+			rc = of_property_read_u32(src_node, "hw-tsp",
+				&val);
+			CAM_DBG(CAM_CCI, "hw-tsp %d, rc %d", val, rc);
+		}
+		if (!rc) {
+			cci_dev->cci_clk_params[count].hw_tsp = val;
+			val = 0;
+			rc = of_property_read_u32(src_node, "cci-clk-src",
+				&val);
+			CAM_DBG(CAM_CCI, "cci-clk-src %d, rc %d", val, rc);
+			cci_dev->cci_clk_params[count].cci_clk_src = val;
+		} else
+			cam_cci_init_default_clk_params(cci_dev, count);
+
+		of_node_put(src_node);
+	}
+}
+
+int cam_cci_parse_dt_info(struct platform_device *pdev,
+	struct cci_device *new_cci_dev)
+{
+	int rc = 0, i = 0;
+	struct cam_hw_soc_info *soc_info =
+		&new_cci_dev->soc_info;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "Parsing DT data failed:%d", rc);
+		return -EINVAL;
+	}
+
+	new_cci_dev->ref_count = 0;
+
+	rc = cam_soc_util_request_platform_resource(soc_info,
+		cam_cci_irq, new_cci_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_CCI, "requesting platform resources failed:%d", rc);
+		return -EINVAL;
+	}
+	new_cci_dev->v4l2_dev_str.pdev = pdev;
+	cam_cci_init_cci_params(new_cci_dev);
+	cam_cci_init_clk_params(new_cci_dev);
+
+	for (i = 0; i < MASTER_MAX; i++) {
+		new_cci_dev->write_wq[i] = create_singlethread_workqueue(
+			"cam_cci_wq");
+		if (!new_cci_dev->write_wq[i])
+			CAM_ERR(CAM_CCI, "Failed to create write wq");
+	}
+	CAM_DBG(CAM_CCI, "Exit");
+	return 0;
+}
+
+int cam_cci_soc_release(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master)
+{
+	uint8_t i = 0, rc = 0;
+	struct cam_hw_soc_info *soc_info = &cci_dev->soc_info;
+
+	if (!cci_dev->ref_count || cci_dev->cci_state != CCI_STATE_ENABLED ||
+			!cci_dev->master_active_slave[master]) {
+		CAM_ERR(CAM_CCI,
+			"invalid cci_dev_ref count %u | cci state %d | master_ref_count %u",
+			cci_dev->ref_count, cci_dev->cci_state,
+			cci_dev->master_active_slave[master]);
+		return -EINVAL;
+	}
+
+	if (!(--cci_dev->master_active_slave[master])) {
+		cci_dev->cci_master_info[master].is_initilized = false;
+		CAM_DBG(CAM_CCI,
+			"All submodules are released for master: %d", master);
+	}
+
+	if (--cci_dev->ref_count) {
+		CAM_DBG(CAM_CCI, "Submodule release: Ref_count: %d",
+			cci_dev->ref_count);
+		return 0;
+	}
+
+	for (i = 0; i < MASTER_MAX; i++) {
+		if (cci_dev->write_wq[i])
+			flush_workqueue(cci_dev->write_wq[i]);
+		cci_dev->i2c_freq_mode[i] = I2C_MAX_MODES;
+	}
+
+	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	if (rc) {
+		CAM_ERR(CAM_CCI, "platform resources disable failed, rc=%d",
+			rc);
+		return rc;
+	}
+
+	cci_dev->cci_state = CCI_STATE_DISABLED;
+	cci_dev->cycles_per_us = 0;
+
+	cam_cpas_stop(cci_dev->cpas_handle);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_cci/cam_cci_soc.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CCI_SOC_H_
+#define _CAM_CCI_SOC_H_
+
+#include "cam_cci_core.h"
+#include "cam_soc_util.h"
+
+/**
+ * @sd: V4L2 sub device
+ * @c_ctrl: CCI control structure
+ *
+ * This API initializes the CCI and acquires SOC resources
+ */
+int cam_cci_init(struct v4l2_subdev *sd,
+	struct cam_cci_ctrl *c_ctrl);
+
+/**
+ * @cci_dev: CCI device structure
+ *
+ * This API releases the CCI and its SOC resources
+ */
+int cam_cci_soc_release(struct cci_device *cci_dev,
+	enum cci_i2c_master_t master);
+
+/**
+ * @pdev: Platform device
+ * @new_cci_dev: CCI device structure
+ *
+ * This API parses CCI device tree
+ */
+int cam_cci_parse_dt_info(struct platform_device *pdev,
+	struct cci_device *new_cci_dev);
+
+/**
+ * @pdev: Platform device
+ * @cci_dev: CCI device structure
+ *
+ * This API puts all SOC resources
+ */
+void cam_cci_soc_remove(struct platform_device *pdev,
+	struct cci_device *cci_dev);
+#endif /* _CAM_CCI_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
@@ -0,0 +1,1674 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+
+#include <dt-bindings/msm-camera.h>
+
+#include "cam_compat.h"
+#include "cam_csiphy_core.h"
+#include "cam_csiphy_dev.h"
+#include "cam_csiphy_soc.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_cpas_api.h"
+#include "cam_compat.h"
+#include "cam_subdev.h"
+
+#define SCM_SVC_CAMERASS 0x18
+#define SECURE_SYSCALL_ID 0x6
+#define SECURE_SYSCALL_ID_2 0x7
+
+#define LANE_MASK_2PH 0x1F
+#define LANE_MASK_3PH 0x7
+
+/* Size of CPAS_SEC_LANE_CP_CTRL register mask */
+#define SEC_LANE_CP_REG_LEN 32
+/*
+ * PHY index at which CPAS_SEC_LANE_CP_CTRL register mask
+ * changes depending on PHY HW version
+ */
+#define MAX_PHY_MSK_PER_REG 4
+
+/* Mask to enable skew calibration registers */
+#define SKEW_CAL_MASK 0x2
+
+static void cam_csiphy_cphy_irq_disable(struct csiphy_device *csiphy_dev) __attribute__((unused));
+static DEFINE_MUTEX(active_csiphy_cnt_mutex);
+
+static int csiphy_dump;
+module_param(csiphy_dump, int, 0644);
+
+struct g_csiphy_data {
+	void __iomem *base_address;
+	uint8_t is_3phase;
+};
+
+static struct g_csiphy_data g_phy_data[MAX_CSIPHY] = {{0, 0}};
+static int active_csiphy_hw_cnt;
+
+static int32_t cam_csiphy_get_instance_offset(
+	struct csiphy_device *csiphy_dev,
+	int32_t dev_handle)
+{
+	int32_t i = 0;
+
+	if ((csiphy_dev->acquire_count >
+		csiphy_dev->session_max_device_support) ||
+		(csiphy_dev->acquire_count < 0)) {
+		CAM_ERR(CAM_CSIPHY,
+			"Invalid acquire count: %d, Max supported device for session: %u",
+			csiphy_dev->acquire_count,
+			csiphy_dev->session_max_device_support);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < csiphy_dev->acquire_count; i++) {
+		if (dev_handle ==
+			csiphy_dev->csiphy_info[i].hdl_data.device_hdl)
+			break;
+	}
+
+	return i;
+}
+
+static void cam_csiphy_reset_phyconfig_param(struct csiphy_device *csiphy_dev,
+	int32_t index)
+{
+	CAM_DBG(CAM_CSIPHY, "Resetting phyconfig param at index: %d", index);
+	csiphy_dev->csiphy_info[index].lane_cnt = 0;
+	csiphy_dev->csiphy_info[index].lane_assign = 0;
+	csiphy_dev->csiphy_info[index].lane_enable = 0;
+	csiphy_dev->csiphy_info[index].settle_time = 0;
+	csiphy_dev->csiphy_info[index].data_rate = 0;
+	csiphy_dev->csiphy_info[index].secure_mode = 0;
+	csiphy_dev->csiphy_info[index].hdl_data.device_hdl = -1;
+}
+
+static void cam_csiphy_query_cap(struct csiphy_device *csiphy_dev,
+	struct cam_csiphy_query_cap *csiphy_cap)
+{
+	struct cam_hw_soc_info *soc_info = &csiphy_dev->soc_info;
+
+	csiphy_cap->slot_info = soc_info->index;
+	csiphy_cap->version = csiphy_dev->hw_version;
+	csiphy_cap->clk_lane = csiphy_dev->clk_lane;
+}
+
+void cam_csiphy_reset(struct csiphy_device *csiphy_dev)
+{
+	int32_t  i;
+	void __iomem *base = NULL;
+	uint32_t size =
+		csiphy_dev->ctrl_reg->csiphy_reg.csiphy_reset_array_size;
+	struct cam_hw_soc_info *soc_info = &csiphy_dev->soc_info;
+
+	base = soc_info->reg_map[0].mem_base;
+
+	for (i = 0; i < size; i++) {
+		cam_io_w_mb(
+			csiphy_dev->ctrl_reg->csiphy_reset_reg[i].reg_data,
+			base +
+			csiphy_dev->ctrl_reg->csiphy_reset_reg[i].reg_addr);
+		if (csiphy_dev->ctrl_reg->csiphy_reset_reg[i].delay > 0)
+			usleep_range(
+			csiphy_dev->ctrl_reg->csiphy_reset_reg[i].delay,
+			csiphy_dev->ctrl_reg->csiphy_reset_reg[i].delay
+			+ 5);
+	}
+}
+
+static void cam_csiphy_prgm_cmn_data(
+	struct csiphy_device *csiphy_dev,
+	bool reset)
+{
+	int csiphy_idx = 0;
+	uint32_t size = 0;
+	int i = 0;
+	void __iomem *csiphybase;
+	bool is_3phase = false;
+	struct csiphy_reg_t *csiphy_common_reg = NULL;
+
+	size = csiphy_dev->ctrl_reg->csiphy_reg.csiphy_common_array_size;
+
+	if (active_csiphy_hw_cnt < 0 || active_csiphy_hw_cnt >= MAX_CSIPHY) {
+		CAM_WARN(CAM_CSIPHY,
+			"MisMatched in active phy hw: %d and Max supported: %d",
+			active_csiphy_hw_cnt, MAX_CSIPHY);
+		return;
+	}
+
+	if (active_csiphy_hw_cnt == 0) {
+		CAM_DBG(CAM_CSIPHY, "CSIPHYs HW state needs to be %s",
+			reset ? "reset" : "set");
+	} else {
+		CAM_DBG(CAM_CSIPHY, "Active CSIPHY hws are %d",
+			active_csiphy_hw_cnt);
+		return;
+	}
+
+	for (csiphy_idx = 0; csiphy_idx < MAX_CSIPHY; csiphy_idx++) {
+		csiphybase = g_phy_data[csiphy_idx].base_address;
+		is_3phase = g_phy_data[csiphy_idx].is_3phase;
+
+		if (!csiphybase) {
+			CAM_DBG(CAM_CSIPHY, "CSIPHY: %d is not available in platform",
+				csiphy_idx);
+			continue;
+		}
+
+		for (i = 0; i < size; i++) {
+			csiphy_common_reg =
+				&csiphy_dev->ctrl_reg->csiphy_common_reg[i];
+			switch (csiphy_common_reg->csiphy_param_type) {
+			case CSIPHY_DEFAULT_PARAMS:
+				cam_io_w_mb(reset ? 0x00 :
+					csiphy_common_reg->reg_data,
+					csiphybase +
+					csiphy_common_reg->reg_addr);
+				break;
+			default:
+				break;
+			}
+			if (csiphy_common_reg->delay > 0)
+				usleep_range(csiphy_common_reg->delay,
+					csiphy_common_reg->delay + 5);
+		}
+	}
+}
+
+static int32_t cam_csiphy_update_secure_info(
+	struct csiphy_device *csiphy_dev, int32_t index)
+{
+	uint32_t adj_lane_mask = 0;
+	uint16_t lane_assign = 0;
+	uint32_t phy_mask_len = 0;
+	uint8_t lane_cnt = 0;
+
+	lane_assign = csiphy_dev->csiphy_info[index].lane_assign;
+	lane_cnt = csiphy_dev->csiphy_info[index].lane_cnt;
+
+	while (lane_cnt--) {
+		if ((lane_assign & 0xF) == 0x0)
+			adj_lane_mask |= 0x1;
+		else
+			adj_lane_mask |= (1 << (lane_assign & 0xF));
+
+		lane_assign >>= 4;
+	}
+
+	switch (csiphy_dev->hw_version) {
+	case CSIPHY_VERSION_V201:
+	case CSIPHY_VERSION_V125:
+		phy_mask_len =
+		CAM_CSIPHY_MAX_DPHY_LANES + CAM_CSIPHY_MAX_CPHY_LANES + 1;
+		break;
+	case CSIPHY_VERSION_V121:
+	case CSIPHY_VERSION_V123:
+	case CSIPHY_VERSION_V124:
+		phy_mask_len =
+		(csiphy_dev->soc_info.index < MAX_PHY_MSK_PER_REG) ?
+		(CAM_CSIPHY_MAX_DPHY_LANES + CAM_CSIPHY_MAX_CPHY_LANES) :
+		(CAM_CSIPHY_MAX_DPHY_LANES + CAM_CSIPHY_MAX_CPHY_LANES + 1);
+		break;
+	default:
+		phy_mask_len =
+		CAM_CSIPHY_MAX_DPHY_LANES + CAM_CSIPHY_MAX_CPHY_LANES;
+		break;
+	}
+
+	if (csiphy_dev->soc_info.index < MAX_PHY_MSK_PER_REG) {
+		csiphy_dev->csiphy_info[index].csiphy_cpas_cp_reg_mask =
+			adj_lane_mask <<
+			((csiphy_dev->soc_info.index * phy_mask_len) +
+			(!csiphy_dev->csiphy_info[index].csiphy_3phase) *
+			(CAM_CSIPHY_MAX_CPHY_LANES));
+	} else {
+		csiphy_dev->csiphy_info[index].csiphy_cpas_cp_reg_mask =
+			((uint64_t)adj_lane_mask) <<
+			((csiphy_dev->soc_info.index - MAX_PHY_MSK_PER_REG) *
+			phy_mask_len + SEC_LANE_CP_REG_LEN +
+			(!csiphy_dev->csiphy_info[index].csiphy_3phase) *
+			(CAM_CSIPHY_MAX_CPHY_LANES));
+	}
+
+	CAM_DBG(CAM_CSIPHY, "csi phy idx:%d, cp_reg_mask:0x%lx",
+		csiphy_dev->soc_info.index,
+		csiphy_dev->csiphy_info[index].csiphy_cpas_cp_reg_mask);
+
+	return 0;
+}
+
+static int cam_csiphy_get_lane_enable(
+	struct csiphy_device *csiphy, int index,
+	uint16_t lane_assign, uint32_t *lane_enable)
+{
+	uint32_t lane_select = 0;
+
+	if (csiphy->csiphy_info[index].csiphy_3phase) {
+		switch (lane_assign & 0xF) {
+		case 0x0:
+			lane_select |= CPHY_LANE_0;
+			break;
+		case 0x1:
+			lane_select |= CPHY_LANE_1;
+			break;
+		case 0x2:
+			lane_select |= CPHY_LANE_2;
+			break;
+		default:
+			CAM_ERR(CAM_CSIPHY,
+				"Wrong lane configuration for CPHY : %d",
+				lane_assign);
+			*lane_enable = 0;
+			return -EINVAL;
+		}
+	} else {
+		switch (lane_assign & 0xF) {
+		case 0x0:
+			lane_select |= DPHY_LANE_0;
+			lane_select |= DPHY_CLK_LN;
+			break;
+		case 0x1:
+			lane_select |= DPHY_LANE_1;
+			lane_select |= DPHY_CLK_LN;
+			break;
+		case 0x2:
+			lane_select |= DPHY_LANE_2;
+			if (csiphy->combo_mode)
+				lane_select |= DPHY_LANE_3;
+			else
+				lane_select |= DPHY_CLK_LN;
+			break;
+		case 0x3:
+			if (csiphy->combo_mode) {
+				CAM_ERR(CAM_CSIPHY,
+					"Wrong lane configuration for DPHYCombo: %d",
+					lane_assign);
+				*lane_enable = 0;
+				return -EINVAL;
+			}
+			lane_select |= DPHY_LANE_3;
+			lane_select |= DPHY_CLK_LN;
+			break;
+		default:
+			CAM_ERR(CAM_CSIPHY,
+				"Wrong lane configuration for DPHY: %d",
+				lane_assign);
+			*lane_enable = 0;
+			return -EINVAL;
+		}
+	}
+
+	CAM_DBG(CAM_CSIPHY, "Lane_enable: 0x%x", lane_enable);
+	*lane_enable = lane_select;
+
+	return 0;
+}
+
+static int cam_csiphy_sanitize_lane_cnt(
+	struct csiphy_device *csiphy_dev,
+	int32_t index, uint8_t lane_cnt)
+{
+	uint8_t max_supported_lanes = 0;
+
+	if (csiphy_dev->combo_mode) {
+		if (csiphy_dev->csiphy_info[index].csiphy_3phase)
+			max_supported_lanes = 1;
+		else
+			max_supported_lanes = 2;
+	} else if (csiphy_dev->cphy_dphy_combo_mode) {
+		/* 2DPHY + 1CPHY or 2CPHY + 1DPHY */
+		if (csiphy_dev->csiphy_info[index].csiphy_3phase)
+			max_supported_lanes = 2;
+		else
+			max_supported_lanes = 2;
+	} else {
+		/* Mission Mode */
+		if (csiphy_dev->csiphy_info[index].csiphy_3phase)
+			max_supported_lanes = 3;
+		else
+			max_supported_lanes = 4;
+	}
+
+	if (lane_cnt <= 0 || lane_cnt > max_supported_lanes) {
+		CAM_ERR(CAM_CSIPHY,
+			"wrong lane_cnt configuration: expected max lane_cnt: %u received lane_cnt: %u",
+			max_supported_lanes, lane_cnt);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
+	struct cam_config_dev_cmd *cfg_dev)
+{
+	int                      rc = 0;
+	uintptr_t                generic_ptr;
+	uintptr_t                generic_pkt_ptr;
+	struct cam_packet       *csl_packet = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	uint32_t                *cmd_buf = NULL;
+	struct cam_csiphy_info  *cam_cmd_csiphy_info = NULL;
+	size_t                  len;
+	size_t                  remain_len;
+	int                     index;
+	uint32_t                lane_enable = 0;
+	uint16_t                lane_assign = 0;
+	uint8_t                 lane_cnt = 0;
+
+	if (!cfg_dev || !csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "Invalid Args");
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf((int32_t) cfg_dev->packet_handle,
+		&generic_pkt_ptr, &len);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "Failed to get packet Mem address: %d", rc);
+		return rc;
+	}
+
+	remain_len = len;
+	if ((sizeof(struct cam_packet) > len) ||
+		((size_t)cfg_dev->offset >= len - sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_CSIPHY,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	remain_len -= (size_t)cfg_dev->offset;
+	csl_packet = (struct cam_packet *)
+		(generic_pkt_ptr + (uint32_t)cfg_dev->offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_CSIPHY, "Invalid packet params");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (csl_packet->num_cmd_buf)
+		cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint32_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset / 4);
+	else {
+		CAM_ERR(CAM_CSIPHY, "num_cmd_buffers = %d", csl_packet->num_cmd_buf);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	rc = cam_packet_util_validate_cmd_desc(cmd_desc);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY, "Invalid cmd desc ret: %d", rc);
+		return rc;
+	}
+
+	rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+		&generic_ptr, &len);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY,
+			"Failed to get cmd buf Mem address : %d", rc);
+		return rc;
+	}
+
+	if ((len < sizeof(struct cam_csiphy_info)) ||
+		(cmd_desc->offset > (len - sizeof(struct cam_csiphy_info)))) {
+		CAM_ERR(CAM_CSIPHY,
+			"Not enough buffer provided for cam_cisphy_info");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	cmd_buf = (uint32_t *)generic_ptr;
+	cmd_buf += cmd_desc->offset / 4;
+	cam_cmd_csiphy_info = (struct cam_csiphy_info *)cmd_buf;
+
+	index = cam_csiphy_get_instance_offset(csiphy_dev, cfg_dev->dev_handle);
+	if (index < 0 || index  >= csiphy_dev->session_max_device_support) {
+		CAM_ERR(CAM_CSIPHY, "index in invalid: %d", index);
+		return -EINVAL;
+	}
+
+	rc = cam_csiphy_sanitize_lane_cnt(csiphy_dev, index,
+		cam_cmd_csiphy_info->lane_cnt);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY,
+			"Wrong configuration lane_cnt: %u",
+			cam_cmd_csiphy_info->lane_cnt);
+		return rc;
+	}
+
+	csiphy_dev->csiphy_info[index].lane_cnt = cam_cmd_csiphy_info->lane_cnt;
+	csiphy_dev->csiphy_info[index].lane_assign =
+		cam_cmd_csiphy_info->lane_assign;
+
+	csiphy_dev->csiphy_info[index].settle_time =
+		cam_cmd_csiphy_info->settle_time;
+	csiphy_dev->csiphy_info[index].data_rate =
+		cam_cmd_csiphy_info->data_rate;
+	csiphy_dev->csiphy_info[index].secure_mode =
+		cam_cmd_csiphy_info->secure_mode;
+	csiphy_dev->csiphy_info[index].mipi_flags =
+		cam_cmd_csiphy_info->mipi_flags;
+
+	lane_assign = csiphy_dev->csiphy_info[index].lane_assign;
+	lane_cnt = csiphy_dev->csiphy_info[index].lane_cnt;
+
+	while (lane_cnt--) {
+		rc = cam_csiphy_get_lane_enable(csiphy_dev, index,
+			(lane_assign & 0xF), &lane_enable);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY, "Wrong lane configuration: %d",
+				csiphy_dev->csiphy_info[index].lane_assign);
+			if ((csiphy_dev->combo_mode) ||
+				(csiphy_dev->cphy_dphy_combo_mode)) {
+				CAM_DBG(CAM_CSIPHY,
+					"Resetting error to zero for other devices to configure");
+				rc = 0;
+			}
+			lane_enable = 0;
+			csiphy_dev->csiphy_info[index].lane_enable = lane_enable;
+			goto reset_settings;
+		}
+		csiphy_dev->csiphy_info[index].lane_enable |= lane_enable;
+		lane_assign >>= 4;
+	}
+
+	if (cam_cmd_csiphy_info->secure_mode == 1)
+		cam_csiphy_update_secure_info(csiphy_dev,
+			index);
+
+	CAM_DBG(CAM_CSIPHY,
+		"phy version:%d, phy_idx: %d",
+		csiphy_dev->hw_version,
+		csiphy_dev->soc_info.index);
+	CAM_DBG(CAM_CSIPHY,
+		"3phase:%d, combo mode:%d, secure mode:%d",
+		csiphy_dev->csiphy_info[index].csiphy_3phase,
+		csiphy_dev->combo_mode,
+		cam_cmd_csiphy_info->secure_mode);
+	CAM_DBG(CAM_CSIPHY,
+		"lane_cnt: 0x%x, lane_assign: 0x%x, lane_enable: 0x%x, settle time:%llu, datarate:%llu",
+		csiphy_dev->csiphy_info[index].lane_cnt,
+		csiphy_dev->csiphy_info[index].lane_assign,
+		csiphy_dev->csiphy_info[index].lane_enable,
+		csiphy_dev->csiphy_info[index].settle_time,
+		csiphy_dev->csiphy_info[index].data_rate);
+
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	cam_mem_put_cpu_buf(cfg_dev->packet_handle);
+	return rc;
+
+reset_settings:
+	cam_csiphy_reset_phyconfig_param(csiphy_dev, index);
+	cam_mem_put_cpu_buf(cfg_dev->packet_handle);
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+
+	return rc;
+}
+
+void cam_csiphy_cphy_irq_config(struct csiphy_device *csiphy_dev)
+{
+	int32_t i;
+	void __iomem *csiphybase =
+		csiphy_dev->soc_info.reg_map[0].mem_base;
+
+	for (i = 0; i < csiphy_dev->num_irq_registers; i++)
+		cam_io_w_mb(
+			csiphy_dev->ctrl_reg->csiphy_irq_reg[i].reg_data,
+			csiphybase +
+			csiphy_dev->ctrl_reg->csiphy_irq_reg[i].reg_addr);
+}
+
+static void cam_csiphy_cphy_irq_disable(struct csiphy_device *csiphy_dev)
+{
+	int32_t i;
+	void __iomem *csiphybase =
+		csiphy_dev->soc_info.reg_map[0].mem_base;
+
+	for (i = 0; i < csiphy_dev->num_irq_registers; i++)
+		cam_io_w_mb(0x0, csiphybase +
+			csiphy_dev->ctrl_reg->csiphy_irq_reg[i].reg_addr);
+}
+
+irqreturn_t cam_csiphy_irq(int irq_num, void *data)
+{
+	struct csiphy_device *csiphy_dev =
+		(struct csiphy_device *)data;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct csiphy_reg_parms_t *csiphy_reg = NULL;
+	void __iomem *base = NULL;
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "Invalid Args");
+		return IRQ_NONE;
+	}
+
+	soc_info = &csiphy_dev->soc_info;
+	base = csiphy_dev->soc_info.reg_map[0].mem_base;
+	csiphy_reg = &csiphy_dev->ctrl_reg->csiphy_reg;
+
+	if (csiphy_dev->enable_irq_dump) {
+		cam_csiphy_status_dmp(csiphy_dev);
+		cam_io_w_mb(0x1,
+			base + csiphy_reg->mipi_csiphy_glbl_irq_cmd_addr);
+		cam_io_w_mb(0x0,
+			base + csiphy_reg->mipi_csiphy_glbl_irq_cmd_addr);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int cam_csiphy_cphy_get_data_rate_lane_idx(
+	struct csiphy_device *csiphy_dev, int32_t index,
+	uint16_t lane_assign,
+	struct data_rate_reg_info_t *drate_settings)
+{
+	int rc = 0;
+	int idx = -1;
+	uint32_t lane_enable;
+
+	rc = cam_csiphy_get_lane_enable(csiphy_dev, index,
+		lane_assign, &lane_enable);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY,
+			"Wrong configuration for lane_assign: %u", lane_assign);
+		return rc;
+	}
+
+	for (idx =  0; idx < CAM_CSIPHY_MAX_CPHY_LANES; idx++) {
+		if (lane_enable & drate_settings->per_lane_info[idx].lane_identifier)
+			return idx;
+	}
+
+	if (idx == CAM_CSIPHY_MAX_CPHY_LANES) {
+		CAM_ERR(CAM_CSIPHY,
+			"Lane not found in datarate table");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_csiphy_cphy_data_rate_config(
+	struct csiphy_device *csiphy_device, int32_t idx)
+{
+	int i = 0;
+	int lane_idx = -1;
+	int data_rate_idx = -1;
+	uint64_t phy_data_rate = 0;
+	void __iomem *csiphybase = NULL;
+	ssize_t num_table_entries = 0;
+	struct data_rate_settings_t *settings_table = NULL;
+	struct csiphy_cphy_per_lane_info *per_lane = NULL;
+	uint32_t lane_enable = 0;
+	uint8_t lane_cnt = 0;
+	uint16_t lane_assign = 0;
+	uint64_t intermediate_var = 0;
+	uint16_t settle_cnt = 0;
+	uint32_t reg_addr = 0, reg_data = 0, reg_param_type = 0;
+	uint8_t  skew_cal_enable = 0;
+	int32_t  delay = 0;
+
+	if ((csiphy_device == NULL) ||
+		(csiphy_device->ctrl_reg == NULL) ||
+		(csiphy_device->ctrl_reg->data_rates_settings_table == NULL)) {
+		CAM_DBG(CAM_CSIPHY,
+			"Data rate specific register table not found");
+		return -EINVAL;
+	}
+
+	phy_data_rate = csiphy_device->csiphy_info[idx].data_rate;
+	csiphybase =
+		csiphy_device->soc_info.reg_map[0].mem_base;
+	settings_table =
+		csiphy_device->ctrl_reg->data_rates_settings_table;
+	num_table_entries =
+		settings_table->num_data_rate_settings;
+	lane_cnt = csiphy_device->csiphy_info[idx].lane_cnt;
+
+	intermediate_var = csiphy_device->csiphy_info[idx].settle_time;
+	do_div(intermediate_var, 200000000);
+	settle_cnt = intermediate_var;
+	skew_cal_enable =
+		csiphy_device->csiphy_info[idx].mipi_flags & SKEW_CAL_MASK;
+
+	CAM_DBG(CAM_CSIPHY, "required data rate : %llu", phy_data_rate);
+	for (data_rate_idx = 0; data_rate_idx < num_table_entries;
+			data_rate_idx++) {
+		struct data_rate_reg_info_t *drate_settings =
+			settings_table->data_rate_settings;
+		uint64_t bandwidth = drate_settings[data_rate_idx].bandwidth;
+		ssize_t  num_reg_entries =
+			drate_settings[data_rate_idx].data_rate_reg_array_size;
+		if (phy_data_rate > bandwidth) {
+			CAM_DBG(CAM_CSIPHY,
+				"Skipping table [%d] with BW: %llu, Required data_rate: %llu",
+				data_rate_idx, bandwidth, phy_data_rate);
+			continue;
+		}
+
+		CAM_DBG(CAM_CSIPHY, "table[%d] BW : %llu Selected",
+			data_rate_idx, bandwidth);
+		lane_enable = csiphy_device->csiphy_info[idx].lane_enable;
+		lane_assign = csiphy_device->csiphy_info[idx].lane_assign;
+		lane_idx = -1;
+
+		while (lane_cnt--) {
+			lane_idx = cam_csiphy_cphy_get_data_rate_lane_idx(
+				csiphy_device, idx, (lane_assign & 0xF),
+				&drate_settings[data_rate_idx]);
+			if (lane_idx < 0) {
+				CAM_ERR(CAM_CSIPHY,
+					"Lane_assign %u failed to find the lane for datarate_idx: %d",
+					lane_assign, data_rate_idx);
+				return -EINVAL;
+			}
+
+			lane_assign >>= 4;
+			per_lane = &drate_settings[data_rate_idx].per_lane_info[lane_idx];
+
+			for (i = 0; i < num_reg_entries; i++) {
+				reg_addr = per_lane->csiphy_data_rate_regs[i]
+					.reg_addr;
+				reg_data = per_lane->csiphy_data_rate_regs[i]
+					.reg_data;
+				reg_param_type =
+					per_lane->csiphy_data_rate_regs[i]
+					.csiphy_param_type;
+				delay = per_lane->csiphy_data_rate_regs[i]
+					.delay;
+				CAM_DBG(CAM_CSIPHY,
+					"param_type: %d writing reg : %x val : %x delay: %dus",
+					reg_param_type, reg_addr, reg_data,
+					delay);
+				switch (reg_param_type) {
+				case CSIPHY_DEFAULT_PARAMS:
+					cam_io_w_mb(reg_data,
+						csiphybase + reg_addr);
+				break;
+				case CSIPHY_SETTLE_CNT_LOWER_BYTE:
+					cam_io_w_mb(settle_cnt & 0xFF,
+						csiphybase + reg_addr);
+				break;
+				case CSIPHY_SETTLE_CNT_HIGHER_BYTE:
+					cam_io_w_mb((settle_cnt >> 8) & 0xFF,
+						csiphybase + reg_addr);
+				break;
+				case CSIPHY_SKEW_CAL:
+				if (skew_cal_enable)
+					cam_io_w_mb(reg_data,
+						csiphybase + reg_addr);
+				break;
+				default:
+					CAM_DBG(CAM_CSIPHY, "Do Nothing");
+				break;
+				}
+				if (delay > 0)
+					usleep_range(delay, delay + 5);
+			}
+		}
+		break;
+	}
+
+	return 0;
+}
+
+static int32_t cam_csiphy_config_dev(struct csiphy_device *csiphy_dev,
+	int32_t dev_handle)
+{
+	int32_t      rc = 0;
+	uint32_t     lane_enable = 0;
+	uint32_t     size = 0;
+	uint16_t     i = 0, cfg_size = 0;
+	uint16_t     lane_assign = 0;
+	uint8_t      lane_cnt;
+	int          max_lanes = 0;
+	uint16_t     settle_cnt = 0;
+	uint8_t      skew_cal_enable = 0;
+	uint64_t     intermediate_var;
+	uint8_t      lane_pos = 0;
+	int          index;
+	void __iomem *csiphybase;
+	struct csiphy_reg_t *csiphy_common_reg = NULL;
+	struct csiphy_reg_t (*reg_array)[MAX_SETTINGS_PER_LANE];
+	bool         is_3phase = false;
+	csiphybase = csiphy_dev->soc_info.reg_map[0].mem_base;
+
+	CAM_DBG(CAM_CSIPHY, "ENTER");
+	if (!csiphybase) {
+		CAM_ERR(CAM_CSIPHY, "csiphybase NULL");
+		return -EINVAL;
+	}
+
+	index = cam_csiphy_get_instance_offset(csiphy_dev, dev_handle);
+	if (index < 0 || index >= csiphy_dev->session_max_device_support) {
+		CAM_ERR(CAM_CSIPHY, "index is invalid: %d", index);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CSIPHY,
+		"Index: %d: expected dev_hdl: 0x%x : derived dev_hdl: 0x%x",
+		index, dev_handle,
+		csiphy_dev->csiphy_info[index].hdl_data.device_hdl);
+	csiphy_dev->num_irq_registers = 11;
+
+	if (csiphy_dev->csiphy_info[index].csiphy_3phase)
+		is_3phase = true;
+
+	if (csiphy_dev->combo_mode) {
+		/* for CPHY(3Phase) or DPHY(2Phase) combo mode selection */
+		if (is_3phase) {
+			/* CPHY combo mode */
+			if (csiphy_dev->ctrl_reg->csiphy_3ph_combo_reg) {
+				reg_array = csiphy_dev->ctrl_reg
+					->csiphy_3ph_combo_reg;
+			} else {
+				CAM_WARN(CAM_CSIPHY,
+					"CPHY combo mode reg settings not found");
+				reg_array =
+					csiphy_dev->ctrl_reg->csiphy_3ph_reg;
+			}
+			cfg_size = csiphy_dev->ctrl_reg->csiphy_reg
+				.csiphy_3ph_config_array_size;
+			max_lanes = CAM_CSIPHY_MAX_CPHY_LANES;
+		} else {
+			/* DPHY combo mode*/
+			if (csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg) {
+				reg_array = csiphy_dev
+					->ctrl_reg->csiphy_2ph_combo_mode_reg;
+			} else {
+				CAM_WARN(CAM_CSIPHY,
+					"DPHY combo mode reg settings not found");
+				reg_array = csiphy_dev
+					->ctrl_reg->csiphy_2ph_reg;
+			}
+			cfg_size = csiphy_dev->ctrl_reg->csiphy_reg
+					.csiphy_2ph_config_array_size;
+			max_lanes = MAX_LANES;
+		}
+	} else if (csiphy_dev->cphy_dphy_combo_mode) {
+		/* for CPHY and DPHY combo mode selection */
+		if (csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg) {
+			reg_array = csiphy_dev
+				->ctrl_reg->csiphy_2ph_3ph_mode_reg;
+			cfg_size = csiphy_dev->ctrl_reg->csiphy_reg
+				.csiphy_2ph_3ph_config_array_size;
+			max_lanes = CAM_CSIPHY_MAX_CPHY_DPHY_COMBO_LN;
+		} else {
+			reg_array = csiphy_dev->ctrl_reg->csiphy_3ph_reg;
+			cfg_size =
+				csiphy_dev->ctrl_reg->csiphy_reg
+					.csiphy_3ph_config_array_size;
+			CAM_WARN(CAM_CSIPHY,
+					"Unsupported configuration, Falling back to CPHY mission mode");
+			max_lanes = CAM_CSIPHY_MAX_CPHY_LANES;
+		}
+	} else {
+		/* for CPHY(3Phase) or DPHY(2Phase) Non combe mode selection */
+		if (is_3phase) {
+			CAM_DBG(CAM_CSIPHY,
+				"3phase Non combo mode reg array selected");
+			reg_array = csiphy_dev->ctrl_reg->csiphy_3ph_reg;
+			max_lanes = CAM_CSIPHY_MAX_CPHY_LANES;
+			cfg_size = csiphy_dev->ctrl_reg->csiphy_reg
+				.csiphy_3ph_config_array_size;
+		} else {
+			CAM_DBG(CAM_CSIPHY,
+				"2PHASE Non combo mode reg array selected");
+			reg_array = csiphy_dev->ctrl_reg->csiphy_2ph_reg;
+			cfg_size = csiphy_dev->ctrl_reg->csiphy_reg
+				.csiphy_2ph_config_array_size;
+			max_lanes = MAX_LANES;
+		}
+	}
+
+	lane_cnt = csiphy_dev->csiphy_info[index].lane_cnt;
+	lane_assign = csiphy_dev->csiphy_info[index].lane_assign;
+	lane_enable = csiphy_dev->csiphy_info[index].lane_enable;
+
+	size = csiphy_dev->ctrl_reg->csiphy_reg.csiphy_common_array_size;
+	for (i = 0; i < size; i++) {
+		csiphy_common_reg = &csiphy_dev->ctrl_reg->csiphy_common_reg[i];
+		switch (csiphy_common_reg->csiphy_param_type) {
+		case CSIPHY_LANE_ENABLE:
+			CAM_DBG(CAM_CSIPHY, "LANE_ENABLE: 0x%x", lane_enable);
+			cam_io_w_mb(lane_enable,
+				csiphybase + csiphy_common_reg->reg_addr);
+			break;
+		case CSIPHY_DEFAULT_PARAMS:
+			cam_io_w_mb(csiphy_common_reg->reg_data,
+				csiphybase + csiphy_common_reg->reg_addr);
+			break;
+		case CSIPHY_2PH_REGS:
+			if (!is_3phase) {
+				cam_io_w_mb(csiphy_common_reg->reg_data,
+					csiphybase +
+					csiphy_common_reg->reg_addr);
+			}
+			break;
+		case CSIPHY_3PH_REGS:
+			if (is_3phase) {
+				cam_io_w_mb(csiphy_common_reg->reg_data,
+					csiphybase +
+					csiphy_common_reg->reg_addr);
+			}
+			break;
+		default:
+			break;
+		}
+		if (csiphy_common_reg->delay > 0)
+			usleep_range(csiphy_common_reg->delay,
+				csiphy_common_reg->delay + 5);
+	}
+
+	intermediate_var = csiphy_dev->csiphy_info[index].settle_time;
+	do_div(intermediate_var, 200000000);
+	settle_cnt = intermediate_var;
+	skew_cal_enable =
+		csiphy_dev->csiphy_info[index].mipi_flags & SKEW_CAL_MASK;
+
+	for (lane_pos = 0; lane_pos < max_lanes; lane_pos++) {
+		CAM_DBG(CAM_CSIPHY, "lane_pos: %d is configuring", lane_pos);
+		for (i = 0; i < cfg_size; i++) {
+			switch (reg_array[lane_pos][i].csiphy_param_type) {
+			case CSIPHY_LANE_ENABLE:
+				cam_io_w_mb(lane_enable,
+					csiphybase +
+					reg_array[lane_pos][i].reg_addr);
+			break;
+			case CSIPHY_DEFAULT_PARAMS:
+				cam_io_w_mb(reg_array[lane_pos][i].reg_data,
+					csiphybase +
+					reg_array[lane_pos][i].reg_addr);
+			break;
+			case CSIPHY_SETTLE_CNT_LOWER_BYTE:
+				cam_io_w_mb(settle_cnt & 0xFF,
+					csiphybase +
+					reg_array[lane_pos][i].reg_addr);
+			break;
+			case CSIPHY_SETTLE_CNT_HIGHER_BYTE:
+				cam_io_w_mb((settle_cnt >> 8) & 0xFF,
+					csiphybase +
+					reg_array[lane_pos][i].reg_addr);
+			break;
+			case CSIPHY_SKEW_CAL:
+			if (skew_cal_enable)
+				cam_io_w_mb(reg_array[lane_pos][i].reg_data,
+					csiphybase +
+					reg_array[lane_pos][i].reg_addr);
+			break;
+			default:
+				CAM_DBG(CAM_CSIPHY, "Do Nothing");
+			break;
+			}
+			if (reg_array[lane_pos][i].delay > 0) {
+				usleep_range(reg_array[lane_pos][i].delay,
+					reg_array[lane_pos][i].delay + 5);
+			}
+		}
+	}
+
+	if (csiphy_dev->csiphy_info[index].csiphy_3phase) {
+		rc = cam_csiphy_cphy_data_rate_config(csiphy_dev, index);
+		if (rc) {
+			CAM_ERR(CAM_CSIPHY,
+				"Date rate specific configuration failed rc: %d",
+				rc);
+			return rc;
+		}
+	}
+
+	cam_csiphy_cphy_irq_config(csiphy_dev);
+
+	CAM_DBG(CAM_CSIPHY, "EXIT");
+	return rc;
+}
+
+void cam_csiphy_shutdown(struct csiphy_device *csiphy_dev)
+{
+	struct cam_hw_soc_info *soc_info;
+	int32_t i = 0;
+
+	if (csiphy_dev->csiphy_state == CAM_CSIPHY_INIT)
+		return;
+
+	if (!csiphy_dev->acquire_count)
+		return;
+
+	if (csiphy_dev->acquire_count >= CSIPHY_MAX_INSTANCES_PER_PHY) {
+		CAM_WARN(CAM_CSIPHY, "acquire count is invalid: %u",
+			csiphy_dev->acquire_count);
+		csiphy_dev->acquire_count =
+			CSIPHY_MAX_INSTANCES_PER_PHY;
+	}
+
+	if (csiphy_dev->csiphy_state == CAM_CSIPHY_START) {
+		soc_info = &csiphy_dev->soc_info;
+
+		for (i = 0; i < csiphy_dev->acquire_count; i++) {
+#ifdef CONFIG_SECURE_CAMERA
+			if (csiphy_dev->csiphy_info[i].secure_mode)
+				cam_csiphy_notify_secure_mode(
+					csiphy_dev,
+					CAM_SECURE_MODE_NON_SECURE, i);
+#endif
+			csiphy_dev->csiphy_info[i].secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+
+			cam_csiphy_reset_phyconfig_param(csiphy_dev, i);
+		}
+
+		if (csiphy_dev->ctrl_reg->csiphy_reg
+			.prgm_cmn_reg_across_csiphy) {
+			mutex_lock(&active_csiphy_cnt_mutex);
+			active_csiphy_hw_cnt--;
+			mutex_unlock(&active_csiphy_cnt_mutex);
+
+			cam_csiphy_prgm_cmn_data(csiphy_dev, true);
+		}
+
+		cam_csiphy_reset(csiphy_dev);
+		cam_soc_util_disable_platform_resource(soc_info, true, true);
+
+		cam_cpas_stop(csiphy_dev->cpas_handle);
+		csiphy_dev->csiphy_state = CAM_CSIPHY_ACQUIRE;
+	}
+
+	if (csiphy_dev->csiphy_state == CAM_CSIPHY_ACQUIRE) {
+		for (i = 0; i < csiphy_dev->acquire_count; i++) {
+			if (csiphy_dev->csiphy_info[i].hdl_data.device_hdl
+				!= -1)
+				cam_destroy_device_hdl(
+				csiphy_dev->csiphy_info[i]
+				.hdl_data.device_hdl);
+			csiphy_dev->csiphy_info[i].hdl_data.device_hdl = -1;
+			csiphy_dev->csiphy_info[i].hdl_data.session_hdl = -1;
+		}
+	}
+
+	csiphy_dev->ref_count = 0;
+	csiphy_dev->acquire_count = 0;
+	csiphy_dev->start_dev_count = 0;
+	csiphy_dev->csiphy_state = CAM_CSIPHY_INIT;
+}
+
+static int32_t cam_csiphy_external_cmd(struct csiphy_device *csiphy_dev,
+	struct cam_config_dev_cmd *p_submit_cmd)
+{
+	struct cam_csiphy_info cam_cmd_csiphy_info;
+	int32_t rc = 0;
+	int32_t  index = -1;
+
+	if (copy_from_user(&cam_cmd_csiphy_info,
+		u64_to_user_ptr(p_submit_cmd->packet_handle),
+		sizeof(struct cam_csiphy_info))) {
+		CAM_ERR(CAM_CSIPHY, "failed to copy cam_csiphy_info\n");
+		rc = -EFAULT;
+	} else {
+		index = cam_csiphy_get_instance_offset(csiphy_dev,
+			p_submit_cmd->dev_handle);
+		if (index < 0 ||
+			index >= csiphy_dev->session_max_device_support) {
+			CAM_ERR(CAM_CSIPHY, "index is invalid: %d", index);
+			return -EINVAL;
+		}
+
+		csiphy_dev->csiphy_info[index].lane_cnt =
+			cam_cmd_csiphy_info.lane_cnt;
+		csiphy_dev->csiphy_info[index].lane_assign =
+			cam_cmd_csiphy_info.lane_assign;
+		csiphy_dev->csiphy_info[index].settle_time =
+			cam_cmd_csiphy_info.settle_time;
+		csiphy_dev->csiphy_info[index].data_rate =
+			cam_cmd_csiphy_info.data_rate;
+		CAM_DBG(CAM_CSIPHY,
+			"%s CONFIG_DEV_EXT settle_time= %lld lane_cnt=%d",
+			__func__,
+			csiphy_dev->csiphy_info[index].settle_time,
+			csiphy_dev->csiphy_info[index].lane_cnt);
+	}
+
+	return rc;
+}
+
+static int cam_csiphy_update_lane(
+	struct csiphy_device *csiphy, int index, bool enable)
+{
+	int i = 0;
+	uint32_t lane_enable = 0;
+	uint32_t size = 0;
+	uint16_t lane_assign;
+	void __iomem *base_address;
+	struct csiphy_reg_t *csiphy_common_reg = NULL;
+
+	base_address = csiphy->soc_info.reg_map[0].mem_base;
+	size = csiphy->ctrl_reg->csiphy_reg.csiphy_common_array_size;
+
+	for (i = 0; i < size; i++) {
+		csiphy_common_reg = &csiphy->ctrl_reg->csiphy_common_reg[i];
+		switch (csiphy_common_reg->csiphy_param_type) {
+		case CSIPHY_LANE_ENABLE:
+			CAM_DBG(CAM_CSIPHY, "LANE_ENABLE: %d", lane_enable);
+			lane_enable = cam_io_r(base_address +
+				csiphy_common_reg->reg_addr);
+			break;
+		}
+	}
+
+	lane_assign = csiphy->csiphy_info[index].lane_assign;
+
+	if (enable)
+		lane_enable |= csiphy->csiphy_info[index].lane_enable;
+	else
+		lane_enable &= ~csiphy->csiphy_info[index].lane_enable;
+
+	CAM_DBG(CAM_CSIPHY, "lane_assign: 0x%x, lane_enable: 0x%x",
+		lane_assign, lane_enable);
+	for (i = 0; i < size; i++) {
+		csiphy_common_reg = &csiphy->ctrl_reg->csiphy_common_reg[i];
+		switch (csiphy_common_reg->csiphy_param_type) {
+		case CSIPHY_LANE_ENABLE:
+			CAM_DBG(CAM_CSIPHY, "LANE_ENABLE: %d", lane_enable);
+			cam_io_w_mb(lane_enable,
+				base_address + csiphy_common_reg->reg_addr);
+			if (csiphy_common_reg->delay)
+				usleep_range(csiphy_common_reg->delay,
+					csiphy_common_reg->delay + 5);
+			break;
+		}
+	}
+
+	return 0;
+}
+
+int32_t cam_csiphy_core_cfg(void *phy_dev,
+			void *arg)
+{
+	struct csiphy_device *csiphy_dev =
+		(struct csiphy_device *)phy_dev;
+	struct cam_control   *cmd = (struct cam_control *)arg;
+	int32_t              rc = 0;
+
+	if (!csiphy_dev || !cmd) {
+		CAM_ERR(CAM_CSIPHY, "Invalid input args");
+		return -EINVAL;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_CSIPHY, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_CSIPHY, "Opcode received: %d", cmd->op_code);
+	mutex_lock(&csiphy_dev->mutex);
+	switch (cmd->op_code) {
+	case CAM_ACQUIRE_DEV: {
+		struct cam_sensor_acquire_dev csiphy_acq_dev;
+		struct cam_csiphy_acquire_dev_info csiphy_acq_params;
+		int index;
+		struct cam_create_dev_hdl bridge_params;
+
+		CAM_DBG(CAM_CSIPHY, "ACQUIRE_CNT: %d COMBO_MODE: %d",
+			csiphy_dev->acquire_count,
+			csiphy_dev->combo_mode);
+		if ((csiphy_dev->csiphy_state == CAM_CSIPHY_START) &&
+			(csiphy_dev->combo_mode == 0) &&
+			(csiphy_dev->mux_mode == 0) &&
+			(csiphy_dev->acquire_count > 0)) {
+			CAM_ERR(CAM_CSIPHY,
+				"NonComboMode or mux mode do not support multiple acquire: Acquire_count: %d",
+				csiphy_dev->acquire_count);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if ((csiphy_dev->acquire_count) &&
+			(csiphy_dev->acquire_count >=
+			csiphy_dev->session_max_device_support)) {
+			CAM_ERR(CAM_CSIPHY,
+				"Max acquires are allowed in combo mode: %d",
+				csiphy_dev->session_max_device_support);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		rc = copy_from_user(&csiphy_acq_dev,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(csiphy_acq_dev));
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			goto release_mutex;
+		}
+
+		csiphy_acq_params.combo_mode = 0;
+		csiphy_acq_params.cphy_dphy_combo_mode = 0;
+		csiphy_acq_params.mux_mode = 0;
+
+		if (copy_from_user(&csiphy_acq_params,
+			u64_to_user_ptr(csiphy_acq_dev.info_handle),
+			sizeof(csiphy_acq_params))) {
+			CAM_ERR(CAM_CSIPHY,
+				"Failed copying from User");
+			goto release_mutex;
+		}
+
+		if (csiphy_acq_params.combo_mode &&
+			csiphy_acq_params.cphy_dphy_combo_mode) {
+			CAM_ERR(CAM_CSIPHY,
+				"Cannot support both Combo_mode and cphy_dphy_combo_mode");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (csiphy_acq_params.combo_mode == 1) {
+			CAM_DBG(CAM_CSIPHY, "combo mode stream detected");
+			csiphy_dev->combo_mode = 1;
+			if (csiphy_acq_params.csiphy_3phase)
+				csiphy_dev->session_max_device_support =
+					CSIPHY_MAX_INSTANCES_PER_PHY;
+			else
+				csiphy_dev->session_max_device_support =
+					CSIPHY_MAX_INSTANCES_PER_PHY - 1;
+		}
+
+		if (csiphy_acq_params.mux_mode == 1) {
+			CAM_DBG(CAM_CSIPHY, "Mux Mode stream detected");
+			csiphy_dev->mux_mode = 1;
+			/* Currently Mux mode support Dual GSML only.
+			 * This can be done with architecture specific with
+			 * introducing MACRO for max support device.
+			 */
+			csiphy_dev->session_max_device_support =
+				CSIPHY_MAX_INSTANCES_PER_PHY - 1;
+
+		}
+
+		if (csiphy_acq_params.cphy_dphy_combo_mode == 1) {
+			CAM_DBG(CAM_CSIPHY,
+				"cphy_dphy_combo_mode stream detected");
+			csiphy_dev->cphy_dphy_combo_mode = 1;
+			csiphy_dev->session_max_device_support =
+				CSIPHY_MAX_INSTANCES_PER_PHY - 1;
+		}
+
+		if (!csiphy_acq_params.combo_mode &&
+			!csiphy_acq_params.mux_mode &&
+			!csiphy_acq_params.cphy_dphy_combo_mode) {
+			CAM_DBG(CAM_CSIPHY, "Non Combo/Mux Mode stream");
+			csiphy_dev->session_max_device_support = 1;
+		}
+
+		bridge_params.ops = NULL;
+		bridge_params.session_hdl = csiphy_acq_dev.session_handle;
+		bridge_params.v4l2_sub_dev_flag = 0;
+		bridge_params.media_entity_flag = 0;
+		bridge_params.priv = csiphy_dev;
+		bridge_params.dev_id = CAM_CSIPHY;
+		index = csiphy_dev->acquire_count;
+		csiphy_acq_dev.device_handle =
+			cam_create_device_hdl(&bridge_params);
+		if (csiphy_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_CSIPHY, "Can not create device handle");
+			goto release_mutex;
+		}
+
+		csiphy_dev->csiphy_info[index].hdl_data.device_hdl =
+			csiphy_acq_dev.device_handle;
+		csiphy_dev->csiphy_info[index].hdl_data.session_hdl =
+			csiphy_acq_dev.session_handle;
+		csiphy_dev->csiphy_info[index].csiphy_3phase =
+			csiphy_acq_params.csiphy_3phase;
+
+		CAM_DBG(CAM_CSIPHY, "Add dev_handle:0x%x at index: %d ",
+			csiphy_dev->csiphy_info[index].hdl_data.device_hdl,
+			index);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+				&csiphy_acq_dev,
+				sizeof(struct cam_sensor_acquire_dev))) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (!csiphy_dev->acquire_count) {
+			g_phy_data[csiphy_dev->soc_info.index].is_3phase =
+					csiphy_acq_params.csiphy_3phase;
+			CAM_DBG(CAM_CSIPHY,
+					"g_csiphy data is updated for index: %d is_3phase: %u",
+					csiphy_dev->soc_info.index,
+					g_phy_data[csiphy_dev->soc_info.index].is_3phase);
+		}
+
+		csiphy_dev->acquire_count++;
+		CAM_DBG(CAM_CSIPHY, "ACQUIRE_CNT: %d",
+			csiphy_dev->acquire_count);
+		if (csiphy_dev->csiphy_state == CAM_CSIPHY_INIT)
+			csiphy_dev->csiphy_state = CAM_CSIPHY_ACQUIRE;
+	}
+		break;
+	case CAM_QUERY_CAP: {
+		struct cam_csiphy_query_cap csiphy_cap = {0};
+
+		cam_csiphy_query_cap(csiphy_dev, &csiphy_cap);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&csiphy_cap, sizeof(struct cam_csiphy_query_cap))) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+	}
+		break;
+	case CAM_STOP_DEV: {
+		int32_t offset, rc = 0;
+		struct cam_start_stop_dev_cmd config;
+
+		rc = copy_from_user(&config, (void __user *)cmd->handle,
+					sizeof(config));
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			goto release_mutex;
+		}
+
+		if (csiphy_dev->csiphy_state != CAM_CSIPHY_START) {
+			CAM_ERR(CAM_CSIPHY, "Not in right state to stop : %d",
+				csiphy_dev->csiphy_state);
+			goto release_mutex;
+		}
+
+		offset = cam_csiphy_get_instance_offset(csiphy_dev,
+			config.dev_handle);
+		if (offset < 0 ||
+			offset >= csiphy_dev->session_max_device_support) {
+			CAM_ERR(CAM_CSIPHY, "Index is invalid: %d", offset);
+			goto release_mutex;
+		}
+
+		if (--csiphy_dev->start_dev_count) {
+			CAM_DBG(CAM_CSIPHY, "Stop Dev ref Cnt: %d",
+				csiphy_dev->start_dev_count);
+#ifdef CONFIG_SECURE_CAMERA
+			if (csiphy_dev->csiphy_info[offset].secure_mode)
+				cam_csiphy_notify_secure_mode(
+					csiphy_dev,
+					CAM_SECURE_MODE_NON_SECURE, offset);
+#endif
+
+			csiphy_dev->csiphy_info[offset].secure_mode =
+				CAM_SECURE_MODE_NON_SECURE;
+			csiphy_dev->csiphy_info[offset].csiphy_cpas_cp_reg_mask
+				= 0;
+
+			/* MuxMode uses same data lanes for the csiphy.
+			 * this condition is to prevent disabling datalanes
+			 * for streaming sensor in MuxMode.
+			 */
+			if (!csiphy_dev->mux_mode)
+				cam_csiphy_update_lane(csiphy_dev, offset, false);
+
+			goto release_mutex;
+		}
+
+		/* Below condition is explicitly disabling all data lanes
+		 * when all sensors are requested for stop.
+		 */
+		if (csiphy_dev->mux_mode && !csiphy_dev->start_dev_count)
+			cam_csiphy_update_lane(csiphy_dev, offset, false);
+
+#ifdef CONFIG_SECURE_CAMERA
+		if (csiphy_dev->csiphy_info[offset].secure_mode)
+			cam_csiphy_notify_secure_mode(
+				csiphy_dev,
+				CAM_SECURE_MODE_NON_SECURE, offset);
+#endif
+		csiphy_dev->csiphy_info[offset].secure_mode =
+			CAM_SECURE_MODE_NON_SECURE;
+
+		csiphy_dev->csiphy_info[offset].csiphy_cpas_cp_reg_mask = 0x0;
+
+		if (csiphy_dev->ctrl_reg->csiphy_reg
+			.prgm_cmn_reg_across_csiphy) {
+			mutex_lock(&active_csiphy_cnt_mutex);
+			active_csiphy_hw_cnt--;
+			mutex_unlock(&active_csiphy_cnt_mutex);
+
+			cam_csiphy_prgm_cmn_data(csiphy_dev, true);
+		}
+
+		rc = cam_csiphy_disable_hw(csiphy_dev);
+		if (rc < 0)
+			CAM_ERR(CAM_CSIPHY, "Failed in csiphy release");
+
+		rc = cam_cpas_stop(csiphy_dev->cpas_handle);
+		if (rc < 0)
+			CAM_ERR(CAM_CSIPHY, "de-voting CPAS: %d", rc);
+
+		CAM_DBG(CAM_CSIPHY, "All PHY devices stopped");
+		csiphy_dev->csiphy_state = CAM_CSIPHY_ACQUIRE;
+
+		CAM_INFO(CAM_CSIPHY,
+			"CAM_STOP_PHYDEV: CSIPHY_IDX: %d, Device_slot: %d, Datarate: %llu, Settletime: %llu",
+			csiphy_dev->soc_info.index, offset,
+			csiphy_dev->csiphy_info[offset].data_rate,
+			csiphy_dev->csiphy_info[offset].settle_time);
+	}
+		break;
+	case CAM_RELEASE_DEV: {
+		int32_t offset;
+		struct cam_release_dev_cmd release;
+
+		if (!csiphy_dev->acquire_count) {
+			CAM_ERR(CAM_CSIPHY, "No valid devices to release");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (copy_from_user(&release,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(release))) {
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+
+		offset = cam_csiphy_get_instance_offset(csiphy_dev,
+			release.dev_handle);
+		if (offset < 0 ||
+			offset >= csiphy_dev->session_max_device_support) {
+			CAM_ERR(CAM_CSIPHY, "index is invalid: %d", offset);
+			goto release_mutex;
+		}
+#ifdef CONFIG_SECURE_CAMERA
+		if (csiphy_dev->csiphy_info[offset].secure_mode)
+			cam_csiphy_notify_secure_mode(
+				csiphy_dev,
+				CAM_SECURE_MODE_NON_SECURE, offset);
+#endif
+		csiphy_dev->csiphy_info[offset].secure_mode =
+			CAM_SECURE_MODE_NON_SECURE;
+
+		csiphy_dev->csiphy_cpas_cp_reg_mask[offset] = 0x0;
+
+		rc = cam_destroy_device_hdl(release.dev_handle);
+		if (rc < 0)
+			CAM_ERR(CAM_CSIPHY, "destroying the device hdl");
+		csiphy_dev->csiphy_info[offset].hdl_data.device_hdl = -1;
+		csiphy_dev->csiphy_info[offset].hdl_data.session_hdl = -1;
+
+		cam_csiphy_reset_phyconfig_param(csiphy_dev, offset);
+
+		if (csiphy_dev->acquire_count) {
+			csiphy_dev->acquire_count--;
+			CAM_DBG(CAM_CSIPHY, "Acquire_cnt: %d",
+				csiphy_dev->acquire_count);
+		}
+
+		if (csiphy_dev->acquire_count == 0) {
+			CAM_DBG(CAM_CSIPHY, "All PHY devices released");
+			csiphy_dev->combo_mode = 0;
+			csiphy_dev->csiphy_state = CAM_CSIPHY_INIT;
+		}
+
+		break;
+	}
+	case CAM_CONFIG_DEV: {
+		struct cam_config_dev_cmd config;
+
+		if (copy_from_user(&config,
+			u64_to_user_ptr(cmd->handle),
+					sizeof(config))) {
+			rc = -EFAULT;
+		} else {
+			rc = cam_cmd_buf_parser(csiphy_dev, &config);
+			if (rc < 0) {
+				CAM_ERR(CAM_CSIPHY, "Fail in cmd buf parser");
+				goto release_mutex;
+			}
+		}
+		break;
+	}
+	case CAM_START_DEV: {
+		struct cam_ahb_vote ahb_vote;
+		struct cam_axi_vote axi_vote = {0};
+		struct cam_start_stop_dev_cmd config;
+		int32_t i, offset;
+		int clk_vote_level = -1;
+		unsigned long clk_rate = 0;
+
+		rc = copy_from_user(&config, (void __user *)cmd->handle,
+			sizeof(config));
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "Failed copying from User");
+			goto release_mutex;
+		}
+
+		if ((csiphy_dev->csiphy_state == CAM_CSIPHY_START) &&
+			(csiphy_dev->start_dev_count >
+			csiphy_dev->session_max_device_support)) {
+			CAM_ERR(CAM_CSIPHY,
+				"Invalid start count: %d, Max supported devices: %u",
+				csiphy_dev->start_dev_count,
+				csiphy_dev->session_max_device_support);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		offset = cam_csiphy_get_instance_offset(csiphy_dev,
+			config.dev_handle);
+		if (offset < 0 ||
+			offset >= csiphy_dev->session_max_device_support) {
+			CAM_ERR(CAM_CSIPHY, "index is invalid: %d", offset);
+			goto release_mutex;
+		}
+
+		if (csiphy_dev->start_dev_count) {
+			clk_vote_level =
+				csiphy_dev->ctrl_reg->getclockvoting(
+					csiphy_dev, offset);
+			rc = cam_soc_util_set_clk_rate_level(
+				&csiphy_dev->soc_info, clk_vote_level, false);
+			if (rc) {
+				CAM_WARN(CAM_CSIPHY,
+					"Failed to set the clk_rate level: %d",
+					clk_vote_level);
+				rc = 0;
+			}
+
+			for (i = 0; i < csiphy_dev->soc_info.num_clk; i++) {
+				if (i == csiphy_dev->soc_info.src_clk_idx) {
+					CAM_DBG(CAM_CSIPHY, "Skipping call back for src clk %s",
+						csiphy_dev->soc_info.clk_name[i]);
+					continue;
+				}
+				clk_rate = cam_soc_util_get_clk_rate_applied(
+					&csiphy_dev->soc_info, i, false, clk_vote_level);
+				if(clk_rate > 0) {
+					cam_subdev_notify_message(CAM_TFE_DEVICE_TYPE,
+						CAM_SUBDEV_MESSAGE_CLOCK_UPDATE,
+						clk_rate);
+				}
+			}
+#ifdef CONFIG_SECURE_CAMERA
+			if (csiphy_dev->csiphy_info[offset].secure_mode == 1) {
+				if (!cam_cpas_is_feature_supported(
+					CAM_CPAS_SECURE_CAMERA_ENABLE,
+					CAM_CPAS_HW_IDX_ANY, NULL)) {
+					CAM_ERR(CAM_CSIPHY,
+						"sec_cam: camera fuse bit not set");
+					goto release_mutex;
+				}
+
+				rc = cam_csiphy_notify_secure_mode(csiphy_dev,
+					CAM_SECURE_MODE_SECURE, offset);
+				if (rc < 0) {
+					csiphy_dev->csiphy_info[offset]
+						.secure_mode =
+						CAM_SECURE_MODE_NON_SECURE;
+					CAM_ERR(CAM_CSIPHY,
+						"sec_cam: notify failed: rc: %d",
+						rc);
+					goto release_mutex;
+				}
+			}
+#endif
+			if (csiphy_dev->csiphy_info[offset].csiphy_3phase) {
+				rc = cam_csiphy_cphy_data_rate_config(
+					csiphy_dev, offset);
+				if (rc) {
+					CAM_ERR(CAM_CSIPHY,
+						"Data rate specific configuration failed rc: %d",
+						rc);
+					goto release_mutex;
+				}
+			}
+
+			/* For Mux mode we can bypass this as well, but leave it
+			 * intentionally with the expectation in case of both
+			 * sensors may use differnt data lanes. In case of all
+			 * datalane enabled by first sensor, and redo the same
+			 * operation when sencond sensor request for start will not
+			 * have any impact on csiphy operation.
+			 */
+			rc = cam_csiphy_update_lane(csiphy_dev, offset, true);
+			if (csiphy_dump == 1)
+				cam_csiphy_mem_dmp(&csiphy_dev->soc_info);
+			if (rc) {
+				CAM_ERR(CAM_CSIPHY,
+					"Update enable lane failed, rc: %d", rc);
+				goto release_mutex;
+			}
+
+			csiphy_dev->start_dev_count++;
+			goto release_mutex;
+		}
+
+		CAM_DBG(CAM_CSIPHY, "Start_dev_cnt: %d",
+			csiphy_dev->start_dev_count);
+
+		ahb_vote.type = CAM_VOTE_ABSOLUTE;
+		ahb_vote.vote.level = CAM_LOWSVS_VOTE;
+		axi_vote.num_paths = 1;
+		axi_vote.axi_path[0].path_data_type = CAM_AXI_PATH_DATA_ALL;
+		axi_vote.axi_path[0].transac_type = CAM_AXI_TRANSACTION_WRITE;
+		axi_vote.axi_path[0].camnoc_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		axi_vote.axi_path[0].mnoc_ab_bw = CAM_CPAS_DEFAULT_AXI_BW;
+		axi_vote.axi_path[0].mnoc_ib_bw = CAM_CPAS_DEFAULT_AXI_BW;
+
+		rc = cam_cpas_start(csiphy_dev->cpas_handle,
+			&ahb_vote, &axi_vote);
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "voting CPAS: %d", rc);
+			goto release_mutex;
+		}
+#ifdef CONFIG_SECURE_CAMERA
+		if (csiphy_dev->csiphy_info[offset].secure_mode == 1) {
+			if (!cam_cpas_is_feature_supported(
+					CAM_CPAS_SECURE_CAMERA_ENABLE,
+					CAM_CPAS_HW_IDX_ANY, NULL)) {
+				CAM_ERR(CAM_CSIPHY,
+					"sec_cam: camera fuse bit not set");
+				cam_cpas_stop(csiphy_dev->cpas_handle);
+				rc = -EINVAL;
+				goto release_mutex;
+			}
+
+			rc = cam_csiphy_notify_secure_mode(
+				csiphy_dev,
+				CAM_SECURE_MODE_SECURE, offset);
+			if (rc < 0) {
+				csiphy_dev->csiphy_info[offset].secure_mode =
+					CAM_SECURE_MODE_NON_SECURE;
+				cam_cpas_stop(csiphy_dev->cpas_handle);
+				goto release_mutex;
+			}
+		}
+#endif
+		rc = cam_csiphy_enable_hw(csiphy_dev, offset);
+		if (rc != 0) {
+			CAM_ERR(CAM_CSIPHY, "cam_csiphy_enable_hw failed");
+			cam_cpas_stop(csiphy_dev->cpas_handle);
+			goto release_mutex;
+		}
+		rc = cam_csiphy_config_dev(csiphy_dev, config.dev_handle);
+		if (csiphy_dump == 1)
+			cam_csiphy_mem_dmp(&csiphy_dev->soc_info);
+
+		if (rc < 0) {
+			CAM_ERR(CAM_CSIPHY, "cam_csiphy_config_dev failed");
+			cam_csiphy_disable_hw(csiphy_dev);
+			cam_cpas_stop(csiphy_dev->cpas_handle);
+			goto release_mutex;
+		}
+		csiphy_dev->start_dev_count++;
+
+		if (csiphy_dev->ctrl_reg->csiphy_reg
+			.prgm_cmn_reg_across_csiphy) {
+			cam_csiphy_prgm_cmn_data(csiphy_dev, false);
+
+			mutex_lock(&active_csiphy_cnt_mutex);
+			active_csiphy_hw_cnt++;
+			mutex_unlock(&active_csiphy_cnt_mutex);
+		}
+
+		CAM_DBG(CAM_CSIPHY, "START DEV CNT: %d",
+			csiphy_dev->start_dev_count);
+		csiphy_dev->csiphy_state = CAM_CSIPHY_START;
+
+		CAM_INFO(CAM_CSIPHY,
+			"CAM_START_PHYDEV: CSIPHY_IDX: %d, Device_slot: %d, cp_mode: %d, Datarate: %llu, Settletime: %llu",
+			csiphy_dev->soc_info.index, offset,
+			csiphy_dev->csiphy_info[offset].secure_mode,
+			csiphy_dev->csiphy_info[offset].data_rate,
+			csiphy_dev->csiphy_info[offset].settle_time);
+	}
+		break;
+	case CAM_CONFIG_DEV_EXTERNAL: {
+		struct cam_config_dev_cmd submit_cmd;
+
+		if (copy_from_user(&submit_cmd,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(struct cam_config_dev_cmd))) {
+			CAM_ERR(CAM_CSIPHY, "failed copy config ext\n");
+			rc = -EFAULT;
+		} else {
+			rc = cam_csiphy_external_cmd(csiphy_dev, &submit_cmd);
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_CSIPHY, "Invalid Opcode: %d", cmd->op_code);
+		rc = -EINVAL;
+		goto release_mutex;
+	}
+
+release_mutex:
+	mutex_unlock(&csiphy_dev->mutex);
+
+	return rc;
+}
+
+void cam_csiphy_register_baseaddress(struct csiphy_device *csiphy_dev)
+{
+	if (!csiphy_dev) {
+		CAM_WARN(CAM_CSIPHY, "Data is NULL");
+		return;
+	}
+
+	if (csiphy_dev->soc_info.index >= MAX_CSIPHY) {
+		CAM_ERR(CAM_CSIPHY, "Invalid soc index: %u Max soc index: %u",
+			csiphy_dev->soc_info.index, MAX_CSIPHY);
+		return;
+	}
+
+	g_phy_data[csiphy_dev->soc_info.index].base_address =
+		csiphy_dev->soc_info.reg_map[0].mem_base;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_CORE_H_
+#define _CAM_CSIPHY_CORE_H_
+
+#include <linux/irqreturn.h>
+#include "cam_csiphy_dev.h"
+#include <cam_mem_mgr.h>
+#include <cam_req_mgr_util.h>
+#include <cam_io_util.h>
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API programs CSIPhy IRQ  registers
+ */
+void cam_csiphy_cphy_irq_config(struct csiphy_device *csiphy_dev);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API resets CSIPhy hardware
+ */
+void cam_csiphy_reset(struct csiphy_device *csiphy_dev);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ * @arg:    Camera control command argument
+ *
+ * This API handles the camera control argument reached to CSIPhy
+ */
+int cam_csiphy_core_cfg(void *csiphy_dev, void *arg);
+
+/**
+ * @irq_num: IRQ number
+ * @data: CSIPhy device structure
+ *
+ * This API handles CSIPhy IRQs
+ */
+irqreturn_t cam_csiphy_irq(int irq_num, void *data);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API handles the CSIPhy close
+ */
+void cam_csiphy_shutdown(struct csiphy_device *csiphy_dev);
+
+/**
+ * @soc_idx : CSIPHY cell index
+ *
+ * This API registers base address per soc_idx
+ */
+void cam_csiphy_register_baseaddress(struct csiphy_device *csiphy_dev);
+
+#endif /* _CAM_CSIPHY_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.c
@@ -0,0 +1,399 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_csiphy_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_csiphy_soc.h"
+#include "cam_csiphy_core.h"
+#include <media/cam_sensor.h>
+#include <dt-bindings/msm-camera.h>
+#include "camera_main.h"
+
+static struct dentry *root_dentry;
+
+static void cam_csiphy_subdev_handle_message(
+		struct v4l2_subdev *sd,
+		enum cam_subdev_message_type_t message_type,
+		uint32_t data)
+{
+	struct csiphy_device *csiphy_dev = v4l2_get_subdevdata(sd);
+
+	switch (message_type) {
+	case CAM_SUBDEV_MESSAGE_IRQ_ERR:
+		CAM_INFO(CAM_CSIPHY, "subdev index : %d CSIPHY index: %d",
+				csiphy_dev->soc_info.index, data);
+		if (data == csiphy_dev->soc_info.index)
+			cam_csiphy_status_dmp(csiphy_dev);
+		break;
+	default:
+		break;
+	}
+}
+
+static int cam_csiphy_debug_register(struct csiphy_device *csiphy_dev)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+	char debugfs_name[25];
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "null CSIPHY dev ptr");
+		return -EINVAL;
+	}
+
+	if (!root_dentry) {
+		dbgfileptr = debugfs_create_dir("camera_csiphy", NULL);
+		if (!dbgfileptr) {
+			CAM_ERR(CAM_CSIPHY,
+				"Debugfs could not create directory!");
+			rc = -ENOENT;
+			goto end;
+		}
+		/* Store parent inode for cleanup in caller */
+		root_dentry = dbgfileptr;
+	}
+
+	snprintf(debugfs_name, 25, "%s%d%s", "csiphy",
+		csiphy_dev->soc_info.index,
+		"_en_irq_dump");
+	debugfs_create_bool(debugfs_name, 0644,
+		root_dentry, &csiphy_dev->enable_irq_dump);
+
+end:
+	return rc;
+}
+
+static void cam_csiphy_debug_unregister(void)
+{
+	debugfs_remove_recursive(root_dentry);
+	root_dentry = NULL;
+}
+
+static int cam_csiphy_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct csiphy_device *csiphy_dev =
+		v4l2_get_subdevdata(sd);
+
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "csiphy_dev ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&csiphy_dev->mutex);
+	cam_csiphy_shutdown(csiphy_dev);
+	mutex_unlock(&csiphy_dev->mutex);
+
+	return 0;
+}
+
+static int cam_csiphy_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_CSIPHY, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_csiphy_subdev_close_internal(sd, fh);
+}
+
+static long cam_csiphy_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	struct csiphy_device *csiphy_dev = v4l2_get_subdevdata(sd);
+	int rc = 0;
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_csiphy_core_cfg(csiphy_dev, arg);
+		if (rc)
+			CAM_ERR(CAM_CSIPHY,
+				"Failed in configuring the device: %d", rc);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_csiphy_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR_RATE_LIMIT(CAM_CSIPHY, "Wrong ioctl : %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_csiphy_subdev_compat_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	int32_t rc = 0;
+	struct cam_control cmd_data;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_CSIPHY, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	/* All the arguments converted to 64 bit here
+	 * Passed to the api in core.c
+	 */
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_csiphy_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc)
+			CAM_ERR(CAM_CSIPHY,
+				"Failed in subdev_ioctl: %d", rc);
+		break;
+	default:
+		CAM_ERR(CAM_CSIPHY, "Invalid compat ioctl cmd: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_CSIPHY,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+static struct v4l2_subdev_core_ops csiphy_subdev_core_ops = {
+	.ioctl = cam_csiphy_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_csiphy_subdev_compat_ioctl,
+#endif
+};
+
+static const struct v4l2_subdev_ops csiphy_subdev_ops = {
+	.core = &csiphy_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops csiphy_subdev_intern_ops = {
+	.close = cam_csiphy_subdev_close,
+};
+
+static int cam_csiphy_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_cpas_register_params cpas_parms;
+	struct csiphy_device *new_csiphy_dev;
+	int32_t               rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+	int i;
+
+	new_csiphy_dev = devm_kzalloc(&pdev->dev,
+		sizeof(struct csiphy_device), GFP_KERNEL);
+	if (!new_csiphy_dev)
+		return -ENOMEM;
+
+	new_csiphy_dev->ctrl_reg = kzalloc(sizeof(struct csiphy_ctrl_t),
+		GFP_KERNEL);
+	if (!new_csiphy_dev->ctrl_reg) {
+		devm_kfree(&pdev->dev, new_csiphy_dev);
+		return -ENOMEM;
+	}
+
+	mutex_init(&new_csiphy_dev->mutex);
+	new_csiphy_dev->v4l2_dev_str.pdev = pdev;
+
+	new_csiphy_dev->soc_info.pdev = pdev;
+	new_csiphy_dev->soc_info.dev = &pdev->dev;
+	new_csiphy_dev->soc_info.dev_name = pdev->name;
+	new_csiphy_dev->ref_count = 0;
+
+	rc = cam_csiphy_parse_dt_info(pdev, new_csiphy_dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "DT parsing failed: %d", rc);
+		goto csiphy_no_resource;
+	}
+	/* validate PHY FUSE only for CSIPHY4 */
+	if ((new_csiphy_dev->soc_info.index == 4) &&
+		!cam_cpas_is_feature_supported(
+			CAM_CPAS_CSIPHY_FUSE,
+			(1 << new_csiphy_dev->soc_info.index), NULL)) {
+		CAM_ERR(CAM_CSIPHY, "PHY%d is not supported",
+			new_csiphy_dev->soc_info.index);
+		goto csiphy_no_resource;
+	}
+
+	new_csiphy_dev->v4l2_dev_str.internal_ops =
+		&csiphy_subdev_intern_ops;
+	new_csiphy_dev->v4l2_dev_str.ops =
+		&csiphy_subdev_ops;
+	strscpy(new_csiphy_dev->device_name, CAMX_CSIPHY_DEV_NAME,
+		sizeof(new_csiphy_dev->device_name));
+	new_csiphy_dev->v4l2_dev_str.name =
+		new_csiphy_dev->device_name;
+	new_csiphy_dev->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	new_csiphy_dev->v4l2_dev_str.ent_function =
+		CAM_CSIPHY_DEVICE_TYPE;
+	new_csiphy_dev->v4l2_dev_str.msg_cb =
+		cam_csiphy_subdev_handle_message;
+	new_csiphy_dev->v4l2_dev_str.token =
+		new_csiphy_dev;
+	new_csiphy_dev->v4l2_dev_str.close_seq_prior =
+		CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(new_csiphy_dev->v4l2_dev_str));
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "cam_register_subdev Failed rc: %d", rc);
+		goto csiphy_no_resource;
+	}
+
+	platform_set_drvdata(pdev, &(new_csiphy_dev->v4l2_dev_str.sd));
+
+	for (i = 0; i < CSIPHY_MAX_INSTANCES_PER_PHY; i++) {
+		new_csiphy_dev->csiphy_info[i].hdl_data.device_hdl = -1;
+		new_csiphy_dev->csiphy_info[i].hdl_data.session_hdl = -1;
+		new_csiphy_dev->csiphy_info[i].csiphy_3phase = -1;
+		new_csiphy_dev->csiphy_info[i].data_rate = 0;
+		new_csiphy_dev->csiphy_info[i].settle_time = 0;
+		new_csiphy_dev->csiphy_info[i].lane_cnt = 0;
+		new_csiphy_dev->csiphy_info[i].lane_assign = 0;
+		new_csiphy_dev->csiphy_info[i].lane_enable = 0;
+	}
+
+	new_csiphy_dev->ops.get_dev_info = NULL;
+	new_csiphy_dev->ops.link_setup = NULL;
+	new_csiphy_dev->ops.apply_req = NULL;
+
+	new_csiphy_dev->combo_mode = 0;
+	new_csiphy_dev->cphy_dphy_combo_mode = 0;
+	new_csiphy_dev->mux_mode = 0;
+
+	new_csiphy_dev->acquire_count = 0;
+	new_csiphy_dev->start_dev_count = 0;
+
+	cpas_parms.cam_cpas_client_cb = NULL;
+	cpas_parms.cell_index = new_csiphy_dev->soc_info.index;
+	cpas_parms.dev = &pdev->dev;
+	cpas_parms.userdata = new_csiphy_dev;
+
+	strscpy(cpas_parms.identifier, "csiphy", CAM_HW_IDENTIFIER_LENGTH);
+
+	rc = cam_cpas_register_client(&cpas_parms);
+	if (rc) {
+		CAM_ERR(CAM_CSIPHY, "CPAS registration failed rc: %d", rc);
+		goto csiphy_unregister_subdev;
+	}
+
+	CAM_DBG(CAM_CSIPHY, "CPAS registration successful handle=%d",
+		cpas_parms.client_handle);
+	new_csiphy_dev->cpas_handle = cpas_parms.client_handle;
+
+	cam_csiphy_register_baseaddress(new_csiphy_dev);
+
+	CAM_DBG(CAM_CSIPHY, "%s component bound successfully",
+		pdev->name);
+
+	cam_csiphy_debug_register(new_csiphy_dev);
+
+	return rc;
+
+csiphy_unregister_subdev:
+	cam_unregister_subdev(&(new_csiphy_dev->v4l2_dev_str));
+csiphy_no_resource:
+	mutex_destroy(&new_csiphy_dev->mutex);
+	kfree(new_csiphy_dev->ctrl_reg);
+	devm_kfree(&pdev->dev, new_csiphy_dev);
+	return rc;
+}
+
+static void cam_csiphy_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	struct v4l2_subdev *subdev = platform_get_drvdata(pdev);
+	struct csiphy_device *csiphy_dev = v4l2_get_subdevdata(subdev);
+
+	cam_csiphy_debug_unregister();
+	CAM_INFO(CAM_CSIPHY, "Unbind CSIPHY component");
+	cam_cpas_unregister_client(csiphy_dev->cpas_handle);
+	cam_csiphy_soc_release(csiphy_dev);
+	mutex_lock(&csiphy_dev->mutex);
+	cam_csiphy_shutdown(csiphy_dev);
+	mutex_unlock(&csiphy_dev->mutex);
+	cam_unregister_subdev(&(csiphy_dev->v4l2_dev_str));
+	kfree(csiphy_dev->ctrl_reg);
+	csiphy_dev->ctrl_reg = NULL;
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&(csiphy_dev->v4l2_dev_str.sd), NULL);
+	devm_kfree(&pdev->dev, csiphy_dev);
+}
+
+const static struct component_ops cam_csiphy_component_ops = {
+	.bind = cam_csiphy_component_bind,
+	.unbind = cam_csiphy_component_unbind,
+};
+
+static int32_t cam_csiphy_platform_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_CSIPHY, "Adding CSIPHY component");
+	rc = component_add(&pdev->dev, &cam_csiphy_component_ops);
+	if (rc)
+		CAM_ERR(CAM_CSIPHY, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+
+static int32_t cam_csiphy_device_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_csiphy_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_csiphy_dt_match[] = {
+	{.compatible = "qcom,csiphy"},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_csiphy_dt_match);
+
+struct platform_driver csiphy_driver = {
+	.probe = cam_csiphy_platform_probe,
+	.remove = cam_csiphy_device_remove,
+	.driver = {
+		.name = CAMX_CSIPHY_DEV_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = cam_csiphy_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int32_t cam_csiphy_init_module(void)
+{
+	return platform_driver_register(&csiphy_driver);
+}
+
+void cam_csiphy_exit_module(void)
+{
+	platform_driver_unregister(&csiphy_driver);
+}
+
+MODULE_DESCRIPTION("CAM CSIPHY driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.h
@@ -0,0 +1,317 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_DEV_H_
+#define _CAM_CSIPHY_DEV_H_
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/irqreturn.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_defs.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_req_mgr_interface.h>
+#include <cam_subdev.h>
+#include <cam_io_util.h>
+#include <cam_cpas_api.h>
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_context.h"
+
+#define MAX_CSIPHY                  6
+
+#define CSIPHY_NUM_CLK_MAX          16
+
+#define MAX_LANES                   5
+#define MAX_SETTINGS_PER_LANE       43
+#define MAX_DATA_RATES              4
+#define MAX_DATA_RATE_REGS          30
+
+#define CAMX_CSIPHY_DEV_NAME "cam-csiphy-driver"
+#define CAM_CSIPHY_RX_CLK_SRC "cphy_rx_src_clk"
+
+#define CSIPHY_DEFAULT_PARAMS            0
+#define CSIPHY_LANE_ENABLE               1
+#define CSIPHY_SETTLE_CNT_LOWER_BYTE     2
+#define CSIPHY_SETTLE_CNT_HIGHER_BYTE    3
+#define CSIPHY_DNP_PARAMS                4
+#define CSIPHY_2PH_REGS                  5
+#define CSIPHY_3PH_REGS                  6
+#define CSIPHY_SKEW_CAL                  7
+
+#define CSIPHY_MAX_INSTANCES_PER_PHY     3
+
+#define CAM_CSIPHY_MAX_DPHY_LANES    4
+#define CAM_CSIPHY_MAX_CPHY_LANES    3
+#define CAM_CSIPHY_MAX_CPHY_DPHY_COMBO_LN    3
+
+#define DPHY_LANE_0    BIT(0)
+#define CPHY_LANE_0    BIT(1)
+#define DPHY_LANE_1    BIT(2)
+#define CPHY_LANE_1    BIT(3)
+#define DPHY_LANE_2    BIT(4)
+#define CPHY_LANE_2    BIT(5)
+#define DPHY_LANE_3    BIT(6)
+#define DPHY_CLK_LN    BIT(7)
+
+enum cam_csiphy_state {
+	CAM_CSIPHY_INIT,
+	CAM_CSIPHY_ACQUIRE,
+	CAM_CSIPHY_START,
+};
+
+/**
+ * struct csiphy_reg_parms_t
+ * @mipi_csiphy_glbl_irq_cmd_addr: CSIPhy irq addr
+ * @mipi_csiphy_interrupt_status0_addr:
+ *     CSIPhy interrupt status addr
+ * @mipi_csiphy_interrupt_mask0_addr:
+ *     CSIPhy interrupt mask addr
+ * @mipi_csiphy_interrupt_mask_val:
+ *      CSIPhy interrupt mask val
+ * @mipi_csiphy_interrupt_clear0_addr:
+ *     CSIPhy interrupt clear addr
+ * @csiphy_version: CSIPhy Version
+ * @csiphy_common_array_size: CSIPhy common array size
+ * @csiphy_reset_array_size: CSIPhy reset array size
+ * @csiphy_2ph_config_array_size: 2ph settings size
+ * @csiphy_3ph_config_array_size: 3ph settings size
+ * @csiphy_cpas_cp_bits_per_phy: CP bits per phy
+ * @csiphy_cpas_cp_is_interleaved: checks whether cp bits
+ *      are interleaved or not
+ * @csiphy_cpas_cp_2ph_offset: cp register 2ph offset
+ * @csiphy_cpas_cp_3ph_offset: cp register 3ph offset
+ * @csiphy_2ph_clock_lane: clock lane in 2ph
+ * @csiphy_2ph_combo_ck_ln: clk lane in combo 2ph
+ */
+struct csiphy_reg_parms_t {
+/*MIPI CSI PHY registers*/
+	uint32_t mipi_csiphy_glbl_irq_cmd_addr;
+	uint32_t mipi_csiphy_interrupt_status0_addr;
+	uint32_t mipi_csiphy_interrupt_mask0_addr;
+	uint32_t mipi_csiphy_interrupt_mask_val;
+	uint32_t mipi_csiphy_interrupt_mask_addr;
+	uint32_t mipi_csiphy_interrupt_clear0_addr;
+	uint32_t csiphy_version;
+	uint32_t csiphy_interrupt_status_size;
+	uint32_t csiphy_common_array_size;
+	uint32_t csiphy_reset_array_size;
+	uint32_t csiphy_2ph_config_array_size;
+	uint32_t csiphy_3ph_config_array_size;
+	uint32_t csiphy_2ph_3ph_config_array_size;
+	uint32_t csiphy_cpas_cp_bits_per_phy;
+	uint32_t csiphy_cpas_cp_is_interleaved;
+	uint32_t csiphy_cpas_cp_2ph_offset;
+	uint32_t csiphy_cpas_cp_3ph_offset;
+	uint32_t csiphy_2ph_clock_lane;
+	uint32_t csiphy_2ph_combo_ck_ln;
+	uint32_t prgm_cmn_reg_across_csiphy;
+};
+
+/**
+ * struct csiphy_intf_params
+ * @device_hdl: Device Handle
+ * @session_hdl: Session Handle
+ */
+struct csiphy_hdl_tbl {
+	int32_t device_hdl;
+	int32_t session_hdl;
+};
+
+/**
+ * struct csiphy_reg_t
+ * @reg_addr:          Register address
+ * @reg_data:          Register data
+ * @delay:             Delay in us
+ * @csiphy_param_type: CSIPhy parameter type
+ */
+struct csiphy_reg_t {
+	int32_t  reg_addr;
+	int32_t  reg_data;
+	int32_t  delay;
+	uint32_t csiphy_param_type;
+};
+
+struct csiphy_device;
+
+struct csiphy_cphy_per_lane_info {
+	uint8_t lane_identifier;
+	struct csiphy_reg_t csiphy_data_rate_regs[MAX_DATA_RATE_REGS];
+};
+
+/*
+ * struct data_rate_reg_info_t
+ * @bandwidth: max bandwidth supported by this reg settings
+ * @data_rate_reg_array_size: number of reg value pairs in the array
+ * @csiphy_data_rate_regs: array of data rate specific reg value pairs
+ */
+struct data_rate_reg_info_t {
+	uint64_t bandwidth;
+	ssize_t  data_rate_reg_array_size;
+	struct   csiphy_cphy_per_lane_info per_lane_info[
+			CAM_CSIPHY_MAX_CPHY_LANES];
+};
+
+/**
+ * struct data_rate_settings_t
+ * @num_data_rate_settings: number of valid settings
+ *                          present in the data rate settings array
+ * @data_rate_settings: array of regsettings which are specific to
+ *                      data rate
+ */
+struct data_rate_settings_t {
+	ssize_t num_data_rate_settings;
+	struct data_rate_reg_info_t data_rate_settings[MAX_DATA_RATES];
+};
+
+/**
+ * struct csiphy_ctrl_t
+ * @csiphy_reg: Register address
+ * @csiphy_common_reg: Common register set
+ * @csiphy_reset_reg: Reset register set
+ * @csiphy_2ph_reg: 2phase register set
+ * @csiphy_2ph_combo_mode_reg:
+ *     2phase combo register set
+ * @csiphy_3ph_reg: 3phase register set
+ * @csiphy_2ph_3ph_mode_reg:
+ *     2 phase 3phase combo register set
+ * @getclockvoting: function pointer which
+ *      is used to find the clock voting
+ *      for the sensor output data rate
+ * @data_rate_settings_table:
+ *      Table which maintains the resgister
+ *      settings specific to data rate
+ */
+struct csiphy_ctrl_t {
+	struct csiphy_reg_parms_t csiphy_reg;
+	struct csiphy_reg_t *csiphy_common_reg;
+	struct csiphy_reg_t *csiphy_irq_reg;
+	struct csiphy_reg_t *csiphy_reset_reg;
+	struct csiphy_reg_t (*csiphy_2ph_reg)[MAX_SETTINGS_PER_LANE];
+	struct csiphy_reg_t (*csiphy_2ph_combo_mode_reg)[MAX_SETTINGS_PER_LANE];
+	struct csiphy_reg_t (*csiphy_3ph_reg)[MAX_SETTINGS_PER_LANE];
+	struct csiphy_reg_t (*csiphy_3ph_combo_reg)[MAX_SETTINGS_PER_LANE];
+	struct csiphy_reg_t (*csiphy_2ph_3ph_mode_reg)[MAX_SETTINGS_PER_LANE];
+	enum   cam_vote_level (*getclockvoting)(struct csiphy_device *phy_dev,
+		int32_t index);
+	struct data_rate_settings_t *data_rates_settings_table;
+};
+
+/**
+ * cam_csiphy_param            :  Provides cmdbuffer structure
+ * @lane_assign                :  Lane sensor will be using
+ * @lane_cnt                   :  Total number of lanes
+ * @secure_mode                :  To identify whether stream is secure/nonsecure
+ * @lane_enable                :  Data Lane selection
+ * @settle_time                :  Settling time in ms
+ * @data_rate                  :  Data rate in mbps
+ * @csiphy_3phase              :  To identify DPHY or CPHY
+ * @mipi_flags                 :  MIPI phy flags
+ * @csiphy_cpas_cp_reg_mask    :  CP reg mask for phy instance
+ * @hdl_data                   :  CSIPHY handle table
+ */
+struct cam_csiphy_param {
+	uint16_t                   lane_assign;
+	uint8_t                    lane_cnt;
+	uint8_t                    secure_mode;
+	uint32_t                   lane_enable;
+	uint64_t                   settle_time;
+	uint64_t                   data_rate;
+	int                        csiphy_3phase;
+	uint16_t                   mipi_flags;
+	uint64_t                   csiphy_cpas_cp_reg_mask;
+	struct csiphy_hdl_tbl      hdl_data;
+};
+
+/**
+ * struct csiphy_device
+ * @device_name:                Device name
+ * @pdev:                       Platform device
+ * @irq:                        Interrupt structure
+ * @base:                       Base address
+ * @hw_version:                 Hardware Version
+ * @csiphy_state:               CSIPhy state
+ * @ctrl_reg:                   CSIPhy control registers
+ * @num_clk:                    Number of clocks
+ * @csiphy_max_clk:             Max timer clock rate
+ * @num_vreg:                   Number of regulators
+ * @csiphy_clk:                 Clock structure
+ * @csiphy_clk_info:            Clock information structure
+ * @csiphy_vreg:                Regulator structure
+ * @csiphy_reg_ptr:             Regulator structure
+ * @csiphy_3p_clk_info:         3Phase clock information
+ * @csiphy_3p_clk:              3Phase clocks structure
+ * @csi_3phase:                 Is it a 3Phase mode
+ * @ref_count:                  Reference count
+ * @clk_lane:                   Clock lane
+ * @rx_clk_src_idx:             Phy src clk index
+ * @acquire_count:              Acquire device count
+ * @start_dev_count:            Start count
+ * @soc_info:                   SOC information
+ * @cpas_handle:                CPAS handle
+ * @current_data_rate:          Data rate in mbps
+ * @csiphy_3phase:              To identify DPHY or CPHY at top level
+ * @combo_mode:                 Info regarding combo_mode is enable / disable
+ * @cphy_dphy_combo_mode:       Info regarding CPHY and DPHY combo mode
+ * @mux_mod:                    Info regarding Mux Mode is enable / disable
+ * @ops:                        KMD operations
+ * @crm_cb:                     Callback API pointers
+ * @enable_irq_dump:            Debugfs variable to enable hw IRQ register dump
+ */
+struct csiphy_device {
+	char                           device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct mutex                   mutex;
+	uint32_t                       hw_version;
+	enum cam_csiphy_state          csiphy_state;
+	struct csiphy_ctrl_t          *ctrl_reg;
+	uint32_t                       csiphy_max_clk;
+	struct msm_cam_clk_info        csiphy_3p_clk_info[2];
+	struct clk                    *csiphy_3p_clk[2];
+	int32_t                        ref_count;
+	uint16_t                       lane_mask[MAX_CSIPHY];
+	uint8_t                        is_csiphy_3phase_hw;
+	uint8_t                        is_divisor_32_comp;
+	uint8_t                        num_irq_registers;
+	struct cam_subdev              v4l2_dev_str;
+	struct cam_csiphy_param        csiphy_info[
+					CSIPHY_MAX_INSTANCES_PER_PHY];
+	uint32_t                       clk_lane;
+	uint8_t                        rx_clk_src_idx;
+	uint32_t                       acquire_count;
+	uint32_t                       start_dev_count;
+	struct cam_hw_soc_info         soc_info;
+	uint32_t                       cpas_handle;
+	uint64_t                       current_data_rate;
+	uint64_t                       csiphy_cpas_cp_reg_mask[
+					CSIPHY_MAX_INSTANCES_PER_PHY];
+	uint8_t                        session_max_device_support;
+	uint8_t                        combo_mode;
+	uint8_t                        cphy_dphy_combo_mode;
+	uint8_t                        mux_mode;
+	struct cam_req_mgr_kmd_ops     ops;
+	struct cam_req_mgr_crm_cb     *crm_cb;
+	bool                           enable_irq_dump;
+};
+
+/**
+ * @brief : API to register CSIPHY hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int32_t cam_csiphy_init_module(void);
+
+/**
+ * @brief : API to remove CSIPHY Hw from platform framework.
+ */
+void cam_csiphy_exit_module(void);
+#endif /* _CAM_CSIPHY_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.c
@@ -0,0 +1,566 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_csiphy_soc.h"
+#include "cam_csiphy_core.h"
+#include "include/cam_csiphy_1_1_hwreg.h"
+#include "include/cam_csiphy_1_0_hwreg.h"
+#include "include/cam_csiphy_1_2_hwreg.h"
+#include "include/cam_csiphy_1_2_1_hwreg.h"
+#include "include/cam_csiphy_1_2_2_hwreg.h"
+#include "include/cam_csiphy_1_2_3_hwreg.h"
+#include "include/cam_csiphy_1_2_5_hwreg.h"
+#include "include/cam_csiphy_2_0_hwreg.h"
+#include "include/cam_csiphy_2_1_0_hwreg.h"
+#include "cam_subdev.h"
+
+/* Clock divide factor for CPHY spec v1.0 */
+#define CSIPHY_DIVISOR_16           16
+/* Clock divide factor for CPHY spec v1.2 and up */
+#define CSIPHY_DIVISOR_32           32
+/* Clock divide factor for DPHY */
+#define CSIPHY_DIVISOR_8             8
+
+#define BYTES_PER_REGISTER           4
+#define NUM_REGISTER_PER_LINE        4
+#define REG_OFFSET(__start, __i)    ((__start) + ((__i) * BYTES_PER_REGISTER))
+
+static int cam_io_phy_dump(void __iomem *base_addr,
+	uint32_t start_offset, int size)
+{
+	char          line_str[128];
+	char         *p_str;
+	int           i;
+	uint32_t      data;
+
+	CAM_INFO(CAM_CSIPHY, "addr=%pK offset=0x%x size=%d",
+		base_addr, start_offset, size);
+
+	if (!base_addr || (size <= 0))
+		return -EINVAL;
+
+	line_str[0] = '\0';
+	p_str = line_str;
+	for (i = 0; i < size; i++) {
+		if (i % NUM_REGISTER_PER_LINE == 0) {
+			snprintf(p_str, 12, "0x%08x: ",
+				REG_OFFSET(start_offset, i));
+			p_str += 11;
+		}
+		data = readl_relaxed(base_addr + REG_OFFSET(start_offset, i));
+		snprintf(p_str, 9, "%08x ", data);
+		p_str += 8;
+		if ((i + 1) % NUM_REGISTER_PER_LINE == 0) {
+			CAM_ERR(CAM_CSIPHY, "%s", line_str);
+			line_str[0] = '\0';
+			p_str = line_str;
+		}
+	}
+	if (line_str[0] != '\0')
+		CAM_ERR(CAM_CSIPHY, "%s", line_str);
+
+	return 0;
+}
+
+int32_t cam_csiphy_mem_dmp(struct cam_hw_soc_info *soc_info)
+{
+	int32_t rc = 0;
+	resource_size_t size = 0;
+	void __iomem *addr = NULL;
+
+	if (!soc_info) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CSIPHY, "invalid input %d", rc);
+		return rc;
+	}
+	addr = soc_info->reg_map[0].mem_base;
+	size = resource_size(soc_info->mem_block[0]);
+	rc = cam_io_phy_dump(addr, 0, (size >> 2));
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "generating dump failed %d", rc);
+		return rc;
+	}
+	return rc;
+}
+
+int32_t cam_csiphy_status_dmp(struct csiphy_device *csiphy_dev)
+{
+	struct csiphy_reg_parms_t *csiphy_reg = NULL;
+	int32_t                    rc = 0;
+	resource_size_t            size = 0;
+	void __iomem              *phy_base = NULL;
+	int                        reg_id = 0;
+	uint32_t                   irq, status_reg, clear_reg;
+
+	if (!csiphy_dev) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CSIPHY, "invalid input %d", rc);
+		return rc;
+	}
+
+	csiphy_reg = &csiphy_dev->ctrl_reg->csiphy_reg;
+	phy_base = csiphy_dev->soc_info.reg_map[0].mem_base;
+	status_reg = csiphy_reg->mipi_csiphy_interrupt_status0_addr;
+	clear_reg = csiphy_reg->mipi_csiphy_interrupt_clear0_addr;
+	size = csiphy_reg->csiphy_interrupt_status_size;
+
+	CAM_INFO(CAM_CSIPHY, "PHY base addr=%pK offset=0x%x size=%d",
+		phy_base, status_reg, size);
+
+	if (phy_base != NULL) {
+		for (reg_id = 0; reg_id < size; reg_id++) {
+			irq = cam_io_r(phy_base + status_reg + (0x4 * reg_id));
+			cam_io_w_mb(irq, phy_base + clear_reg + (0x4 * reg_id));
+
+			CAM_INFO(CAM_CSIPHY,
+				"CSIPHY%d_IRQ_STATUS_ADDR%d = 0x%x",
+				csiphy_dev->soc_info.index, reg_id, irq);
+		}
+	} else {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CSIPHY, "phy base is NULL  %d", rc);
+		return rc;
+	}
+	return rc;
+}
+
+static enum cam_vote_level get_clk_vote_default(struct csiphy_device *csiphy_dev,
+	int32_t index)
+{
+	CAM_DBG(CAM_CSIPHY, "voting for SVS");
+	return CAM_SVS_VOTE;
+}
+
+static enum cam_vote_level get_clk_voting_dynamic(
+	struct csiphy_device *csiphy_dev, int32_t index)
+{
+	uint32_t cam_vote_level = 0;
+	uint32_t last_valid_vote = 0;
+	struct cam_hw_soc_info *soc_info;
+	uint64_t phy_data_rate = csiphy_dev->csiphy_info[index].data_rate;
+
+	soc_info = &csiphy_dev->soc_info;
+	phy_data_rate = max(phy_data_rate, csiphy_dev->current_data_rate);
+
+	if (csiphy_dev->csiphy_info[index].csiphy_3phase) {
+		if (csiphy_dev->is_divisor_32_comp)
+			do_div(phy_data_rate, CSIPHY_DIVISOR_32);
+		else
+			do_div(phy_data_rate, CSIPHY_DIVISOR_16);
+	} else {
+		do_div(phy_data_rate, CSIPHY_DIVISOR_8);
+	}
+
+	 /* round off to next integer */
+	phy_data_rate += 1;
+	csiphy_dev->current_data_rate = phy_data_rate;
+
+	for (cam_vote_level = 0;
+			cam_vote_level < CAM_MAX_VOTE; cam_vote_level++) {
+		if (soc_info->clk_level_valid[cam_vote_level] != true)
+			continue;
+
+		if (soc_info->clk_rate[cam_vote_level]
+			[csiphy_dev->rx_clk_src_idx] > phy_data_rate) {
+			CAM_DBG(CAM_CSIPHY,
+				"match detected %s : %llu:%d level : %d",
+				soc_info->clk_name[csiphy_dev->rx_clk_src_idx],
+				phy_data_rate,
+				soc_info->clk_rate[cam_vote_level]
+				[csiphy_dev->rx_clk_src_idx],
+				cam_vote_level);
+			return cam_vote_level;
+		}
+		last_valid_vote = cam_vote_level;
+	}
+	return last_valid_vote;
+}
+
+int32_t cam_csiphy_enable_hw(struct csiphy_device *csiphy_dev, int32_t index)
+{
+	int32_t rc = 0;
+	struct cam_hw_soc_info   *soc_info;
+	enum cam_vote_level vote_level = CAM_SVS_VOTE;
+	unsigned long clk_rate = 0;
+
+	soc_info = &csiphy_dev->soc_info;
+
+	if (csiphy_dev->ref_count++) {
+		CAM_ERR(CAM_CSIPHY, "csiphy refcount = %d",
+			csiphy_dev->ref_count);
+		return rc;
+	}
+
+	vote_level = csiphy_dev->ctrl_reg->getclockvoting(csiphy_dev, index);
+	rc = cam_soc_util_enable_platform_resource(soc_info, true,
+		vote_level, true);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "failed to enable platform resources %d",
+			rc);
+		return rc;
+	}
+
+	rc = cam_soc_util_set_src_clk_rate(soc_info,
+		soc_info->clk_rate[0][soc_info->src_clk_idx]);
+	clk_rate = cam_soc_util_get_clk_rate_applied(soc_info,
+		csiphy_dev->rx_clk_src_idx, true, vote_level);
+	cam_subdev_notify_message(CAM_TFE_DEVICE_TYPE,
+		CAM_SUBDEV_MESSAGE_CLOCK_UPDATE,
+		clk_rate);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "csiphy_clk_set_rate failed rc: %d", rc);
+		goto csiphy_disable_platform_resource;
+	}
+
+	cam_csiphy_reset(csiphy_dev);
+
+	return rc;
+
+
+csiphy_disable_platform_resource:
+	cam_soc_util_disable_platform_resource(soc_info, true, true);
+
+	return rc;
+}
+
+int32_t cam_csiphy_disable_hw(struct csiphy_device *csiphy_dev)
+{
+	struct cam_hw_soc_info   *soc_info;
+
+	if (!csiphy_dev || !csiphy_dev->ref_count) {
+		CAM_ERR(CAM_CSIPHY, "csiphy dev NULL / ref_count ZERO");
+		return 0;
+	}
+	soc_info = &csiphy_dev->soc_info;
+
+	if (--csiphy_dev->ref_count) {
+		CAM_ERR(CAM_CSIPHY, "csiphy refcount = %d",
+			csiphy_dev->ref_count);
+		return 0;
+	}
+
+	cam_csiphy_reset(csiphy_dev);
+
+	cam_soc_util_disable_platform_resource(soc_info, true, true);
+
+	return 0;
+}
+
+int32_t cam_csiphy_parse_dt_info(struct platform_device *pdev,
+	struct csiphy_device *csiphy_dev)
+{
+	int32_t   rc = 0, i = 0;
+	uint32_t  clk_cnt = 0;
+	char      *csi_3p_clk_name = "csi_phy_3p_clk";
+	char      *csi_3p_clk_src_name = "csiphy_3p_clk_src";
+	struct cam_hw_soc_info   *soc_info;
+
+	csiphy_dev->is_csiphy_3phase_hw = 0;
+	soc_info = &csiphy_dev->soc_info;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_CSIPHY, "parsing common soc dt(rc %d)", rc);
+		return  rc;
+	}
+
+	csiphy_dev->is_csiphy_3phase_hw = 0;
+
+	if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v1.0")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v1_0_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+				csiphy_2ph_v1_0_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v1_0_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg =
+				csiphy_3ph_v1_0_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_1_0;
+		csiphy_dev->ctrl_reg->csiphy_common_reg = csiphy_common_reg_1_0;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg = csiphy_reset_reg_1_0;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v1_0;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_vote_default;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V10;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = false;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table = NULL;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v1.1")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v1_1_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v1_1_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v1_1_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg =
+			csiphy_3ph_v1_1_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_1_1;
+		csiphy_dev->ctrl_reg->csiphy_common_reg =
+			csiphy_common_reg_1_1;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg =
+			csiphy_reset_reg_1_1;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v1_1;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_vote_default;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = false;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V11;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table = NULL;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v1.2")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v1_2_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v1_2_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v1_2_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_1_2;
+		csiphy_dev->ctrl_reg->csiphy_common_reg =
+			csiphy_common_reg_1_2;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg =
+			csiphy_reset_reg_1_2;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_voting_dynamic;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v1_2;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V12;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table =
+			&data_rate_delta_table_1_2;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v1.2.1")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v1_2_1_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v1_2_1_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v1_2_1_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_1_2_1;
+		csiphy_dev->ctrl_reg->csiphy_common_reg =
+			csiphy_common_reg_1_2_1;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg =
+			csiphy_reset_reg_1_2_1;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v1_2_1;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_voting_dynamic;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V121;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table =
+			&data_rate_delta_table_1_2_1;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v1.2.2")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v1_2_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v1_2_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v1_2_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_1_2;
+		csiphy_dev->ctrl_reg->csiphy_common_reg =
+			csiphy_common_reg_1_2;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg =
+			csiphy_reset_reg_1_2;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_vote_default;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v1_2;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = false;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V12;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table =
+			&data_rate_delta_table_1_2;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v1.2.2.2")) {
+		/* settings for lito v2 */
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v1_2_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v1_2_2_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v1_2_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_1_2;
+		csiphy_dev->ctrl_reg->csiphy_common_reg =
+			csiphy_common_reg_1_2_2;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg =
+			csiphy_reset_reg_1_2;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_vote_default;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v1_2_2;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = false;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V12;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table =
+			&data_rate_delta_table_1_2;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v1.2.3")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v1_2_3_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v1_2_3_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v1_2_3_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_1_2_3;
+		csiphy_dev->ctrl_reg->csiphy_common_reg =
+			csiphy_common_reg_1_2_3;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg =
+			csiphy_reset_reg_1_2_3;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_vote_default;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v1_2_3;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V123;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table =
+			&data_rate_delta_table_1_2_3;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v1.2.4")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v1_2_3_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v1_2_3_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v1_2_3_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_1_2_3;
+		csiphy_dev->ctrl_reg->csiphy_common_reg =
+			csiphy_common_reg_1_2_3;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg =
+			csiphy_reset_reg_1_2_3;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_voting_dynamic;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v1_2_3;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V124;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table =
+			&data_rate_delta_table_1_2_3;
+	}  else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v1.2.5")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v1_2_5_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v1_2_5_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v1_2_5_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_1_2_5;
+		csiphy_dev->ctrl_reg->csiphy_common_reg =
+			csiphy_common_reg_1_2_5;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg =
+			csiphy_reset_reg_1_2_5;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_vote_default;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v1_2_5;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = false;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V125;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table =
+			&data_rate_delta_table_1_2_5;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v2.0")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v2_0_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v2_0_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v2_0_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_2_0;
+		csiphy_dev->ctrl_reg->csiphy_common_reg = csiphy_common_reg_2_0;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg = csiphy_reset_reg_2_0;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v2_0;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_vote_default;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V20;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = false;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table = NULL;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v2.0.1")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v2_0_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v2_0_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v2_0_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_2_0;
+		csiphy_dev->ctrl_reg->csiphy_common_reg = csiphy_common_reg_2_0;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg = csiphy_reset_reg_2_0;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v2_0;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_vote_default;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V201;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = false;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table = &data_rate_delta_table_2_0;
+	} else if (of_device_is_compatible(soc_info->dev->of_node,
+		"qcom,csiphy-v2.1.0")) {
+		csiphy_dev->ctrl_reg->csiphy_2ph_reg = csiphy_2ph_v2_1_0_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_combo_mode_reg =
+			csiphy_2ph_v2_1_0_combo_mode_reg;
+		csiphy_dev->ctrl_reg->csiphy_3ph_reg = csiphy_3ph_v2_1_0_reg;
+		csiphy_dev->ctrl_reg->csiphy_2ph_3ph_mode_reg = NULL;
+		csiphy_dev->ctrl_reg->csiphy_irq_reg = csiphy_irq_reg_2_1_0;
+		csiphy_dev->ctrl_reg->csiphy_common_reg =
+			csiphy_common_reg_2_1_0;
+		csiphy_dev->ctrl_reg->csiphy_reset_reg = csiphy_reset_reg_2_1_0;
+		csiphy_dev->ctrl_reg->csiphy_reg = csiphy_v2_1_0;
+		csiphy_dev->ctrl_reg->getclockvoting = get_clk_vote_default;
+		csiphy_dev->hw_version = CSIPHY_VERSION_V210;
+		csiphy_dev->is_csiphy_3phase_hw = CSI_3PHASE_HW;
+		csiphy_dev->is_divisor_32_comp = true;
+		csiphy_dev->clk_lane = 0;
+		csiphy_dev->ctrl_reg->data_rates_settings_table =
+			&data_rate_delta_table_2_1_0;
+	} else {
+		CAM_ERR(CAM_CSIPHY, "invalid hw version : 0x%x",
+			csiphy_dev->hw_version);
+		rc =  -EINVAL;
+		return rc;
+	}
+
+	if (soc_info->num_clk > CSIPHY_NUM_CLK_MAX) {
+		CAM_ERR(CAM_CSIPHY, "invalid clk count=%d, max is %d",
+			soc_info->num_clk, CSIPHY_NUM_CLK_MAX);
+		return -EINVAL;
+	}
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (!strcmp(soc_info->clk_name[i],
+			csi_3p_clk_src_name)) {
+			csiphy_dev->csiphy_3p_clk_info[0].clk_name =
+				soc_info->clk_name[i];
+			csiphy_dev->csiphy_3p_clk_info[0].clk_rate =
+				soc_info->clk_rate[0][i];
+			csiphy_dev->csiphy_3p_clk[0] =
+				soc_info->clk[i];
+			continue;
+		} else if (!strcmp(soc_info->clk_name[i],
+				csi_3p_clk_name)) {
+			csiphy_dev->csiphy_3p_clk_info[1].clk_name =
+				soc_info->clk_name[i];
+			csiphy_dev->csiphy_3p_clk_info[1].clk_rate =
+				soc_info->clk_rate[0][i];
+			csiphy_dev->csiphy_3p_clk[1] =
+				soc_info->clk[i];
+			continue;
+		} else if (!strcmp(soc_info->clk_name[i],
+				CAM_CSIPHY_RX_CLK_SRC)) {
+			csiphy_dev->rx_clk_src_idx = i;
+			continue;
+		}
+
+		CAM_DBG(CAM_CSIPHY, "clk_rate[%d] = %d", clk_cnt,
+			soc_info->clk_rate[0][clk_cnt]);
+		clk_cnt++;
+	}
+
+	csiphy_dev->csiphy_max_clk =
+		soc_info->clk_rate[0][soc_info->src_clk_idx];
+
+	rc = cam_soc_util_request_platform_resource(&csiphy_dev->soc_info,
+		cam_csiphy_irq, csiphy_dev);
+
+	return rc;
+}
+
+int32_t cam_csiphy_soc_release(struct csiphy_device *csiphy_dev)
+{
+	if (!csiphy_dev) {
+		CAM_ERR(CAM_CSIPHY, "csiphy dev NULL");
+		return 0;
+	}
+
+	cam_soc_util_release_platform_resource(&csiphy_dev->soc_info);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_soc.h
@@ -0,0 +1,80 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_SOC_H_
+#define _CAM_CSIPHY_SOC_H_
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/irqreturn.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include "cam_csiphy_dev.h"
+#include "cam_csiphy_core.h"
+
+#define CSI_3PHASE_HW                               1
+#define CSIPHY_VERSION_V10                        0x10
+#define CSIPHY_VERSION_V11                        0x11
+#define CSIPHY_VERSION_V12                        0x12
+#define CSIPHY_VERSION_V121                       0x121
+#define CSIPHY_VERSION_V123                       0x123
+#define CSIPHY_VERSION_V124                       0x124
+#define CSIPHY_VERSION_V125                       0x125
+#define CSIPHY_VERSION_V20                        0x20
+#define CSIPHY_VERSION_V201                       0x201
+#define CSIPHY_VERSION_V210                       0x210
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API release SOC related parameters
+ */
+int cam_csiphy_soc_release(struct csiphy_device *csiphy_dev);
+
+/**
+ * @pdev: Platform device
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API parses csiphy device tree information
+ */
+int cam_csiphy_parse_dt_info(struct platform_device *pdev,
+	struct csiphy_device *csiphy_dev);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API enables SOC related parameters
+ */
+int cam_csiphy_enable_hw(struct csiphy_device *csiphy_dev, int32_t index);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API disables SOC related parameters
+ */
+int cam_csiphy_disable_hw(struct csiphy_device *csiphy_dev);
+
+/**
+ * @soc_info: Soc info of cam hw driver module
+ *
+ * This API dumps memory for the entire mapped region
+ * (needs to be macro enabled before use)
+ */
+int cam_csiphy_mem_dmp(struct cam_hw_soc_info *soc_info);
+
+/**
+ * @csiphy_dev: CSIPhy device structure
+ *
+ * This API dumps memory for the entire status region
+ */
+int32_t cam_csiphy_status_dmp(struct csiphy_device *csiphy_dev);
+#endif /* _CAM_CSIPHY_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_0_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_0_hwreg.h
@@ -0,0 +1,349 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_1_0_HWREG_H_
+#define _CAM_CSIPHY_1_0_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct csiphy_reg_parms_t csiphy_v1_0 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x8B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x858,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x828,
+	.csiphy_interrupt_status_size = 11,
+	.csiphy_common_array_size = 5,
+	.csiphy_reset_array_size = 5,
+	.csiphy_2ph_config_array_size = 14,
+	.csiphy_3ph_config_array_size = 19,
+};
+
+struct csiphy_reg_t csiphy_common_reg_1_0[] = {
+	{0x0814, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_reg_1_0[] = {
+	{0x0814, 0x00, 0x05, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_1_0[] = {
+	{0x082c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0xFB, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083c, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0840, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0844, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0848, 0xEF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x084c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0850, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0854, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v1_0_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x00, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x000c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x14, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0760, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0764, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x020C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x00, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x040C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0660, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0664, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+	csiphy_2ph_v1_0_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x0A, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x00, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x14, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0760, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0764, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x0A, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x00, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0660, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0664, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t csiphy_3ph_v1_0_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x015C, 0x63, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0168, 0xAC, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x016C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x010C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0150, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0118, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0144, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0x51, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x035C, 0x63, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0368, 0xAC, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x036C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x030C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0350, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0318, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0344, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0x51, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x055C, 0x63, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0568, 0xAC, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x056C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x050C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0550, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0518, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0544, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0x51, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+	csiphy_3ph_v1_0_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x015C, 0x63, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0168, 0xAC, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x016C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x010C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0150, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0118, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0144, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0x51, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x035C, 0x63, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0368, 0xAC, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x036C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x030C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0350, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0318, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0344, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0x51, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x055C, 0x63, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0568, 0xAC, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x056C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x050C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0550, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0518, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0544, 0x12, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0x51, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+#endif /* _CAM_CSIPHY_1_0_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_1_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_1_hwreg.h
@@ -0,0 +1,500 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_1_1_HWREG_H_
+#define _CAM_CSIPHY_1_1_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct csiphy_reg_parms_t csiphy_v1_1 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x8B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x858,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x828,
+	.csiphy_interrupt_status_size = 11,
+	.csiphy_common_array_size = 5,
+	.csiphy_reset_array_size = 5,
+	.csiphy_2ph_config_array_size = 14,
+	.csiphy_3ph_config_array_size = 43,
+	.csiphy_2ph_clock_lane = 0x1,
+	.csiphy_2ph_combo_ck_ln = 0x10,
+};
+
+struct csiphy_reg_t csiphy_common_reg_1_1[] = {
+	{0x0814, 0xd5, 0x00, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_reset_reg_1_1[] = {
+	{0x0814, 0x00, 0x05, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_1_1[] = {
+	{0x082c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0xFB, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083c, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0840, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0844, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0848, 0xEF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x084c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0850, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0854, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct
+csiphy_reg_t csiphy_2ph_v1_1_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x90, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x000c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0760, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0764, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x90, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x020C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x90, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x040C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x90, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0660, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0664, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+	csiphy_2ph_v1_1_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x000C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0760, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0764, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x020C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x040C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x0E, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0660, 0x31, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0664, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct
+csiphy_reg_t csiphy_3ph_v1_1_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0144, 0xB6, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x015C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0990, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0990, 0x48, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x098C, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x098C, 0x5F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0168, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x016C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x010C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0150, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0188, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x018C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0190, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0118, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0144, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x015C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0980, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x24, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x015C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0984, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0988, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09AC, 0x55, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x2B, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0344, 0xB6, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x035C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A90, 0x48, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A8C, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A8C, 0x5F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0368, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x036C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x030C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0350, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0388, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x038C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0390, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0318, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0344, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x035C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A80, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x24, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x035C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A88, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AAC, 0x55, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x2B, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0544, 0xB6, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x055C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B90, 0x48, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B8C, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B8C, 0x5F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0568, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x056C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x050C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0550, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0588, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x058C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0590, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0518, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0544, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x055C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B80, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x24, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x055C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B88, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BAC, 0x55, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x2B, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+	csiphy_3ph_v1_1_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0144, 0xB6, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x015C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0990, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0990, 0x48, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x098C, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x098C, 0x5F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0168, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x016C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x010C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0150, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0188, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x018C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0190, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0118, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0144, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x015C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0980, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x015C, 0x48, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0984, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0988, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09AC, 0x55, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x2B, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0344, 0xB6, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x035C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A90, 0x48, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A8C, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A8C, 0x5F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0368, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x036C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x030C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0350, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0388, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x038C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0390, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0318, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0344, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x035C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A80, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x035C, 0x48, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A88, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AAC, 0x55, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x2B, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0544, 0xB6, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x055C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B90, 0x48, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B8C, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B8C, 0x5F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0568, 0x8E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x056C, 0x59, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x050C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0550, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0588, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x058C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0590, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0518, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0544, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x055C, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B80, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x055C, 0x48, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B88, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BAC, 0x55, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x2B, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+#endif /* _CAM_CSIPHY_D5_0_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_1_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_1_hwreg.h
@@ -0,0 +1,530 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_1_2_1_HWREG_H_
+#define _CAM_CSIPHY_1_2_1_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct csiphy_reg_parms_t csiphy_v1_2_1 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x8B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x858,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x828,
+	.csiphy_interrupt_status_size = 11,
+	.csiphy_common_array_size = 7,
+	.csiphy_reset_array_size = 5,
+	.csiphy_2ph_config_array_size = 20,
+	.csiphy_3ph_config_array_size = 33,
+	.csiphy_2ph_clock_lane = 0x1,
+	.csiphy_2ph_combo_ck_ln = 0x10,
+};
+
+struct csiphy_reg_t csiphy_common_reg_1_2_1[] = {
+	{0x0814, 0xd5, 0x00, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x081C, 0x52, 0x00, CSIPHY_3PH_REGS},
+	{0x0800, 0x03, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x0800, 0x0E, 0x00, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_reset_reg_1_2_1[] = {
+	{0x0814, 0x00, 0x05, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_1_2_1[] = {
+	{0x082c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0xFB, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083c, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0840, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0844, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0848, 0xEF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x084c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0850, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0854, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct
+csiphy_reg_t csiphy_2ph_v1_2_1_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0900, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0908, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0904, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0904, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0010, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0000, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x000c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0024, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0730, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C80, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C88, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C84, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x070c, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0724, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0230, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A00, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A08, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0210, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0200, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x020c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0224, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B00, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B08, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0410, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0400, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x040c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0424, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0630, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C00, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C08, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0600, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x060c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0638, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0624, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+	csiphy_2ph_v1_2_1_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0900, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0908, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0904, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0904, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0010, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0000, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x000c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0024, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0730, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C80, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C88, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C84, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x070c, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0724, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0230, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A00, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A08, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0210, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0200, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x020c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0224, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B00, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B08, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0410, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0400, 0x8D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x040C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0424, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0630, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C00, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C08, 0x10, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0600, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x060C, 0xA5, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0624, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct
+csiphy_reg_t csiphy_3ph_v1_2_1_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0990, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0990, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x098C, 0xAF, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x015C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0168, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x010C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0150, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0188, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x018C, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0190, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0118, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0984, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0988, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0980, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09AC, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0A90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A90, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A8C, 0xAF, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x035C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0368, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x030C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0350, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0388, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x038C, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0390, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0318, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A84, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A80, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AAC, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0B90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B90, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B8C, 0xAF, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x055C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0568, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x050C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0550, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0588, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x058C, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0590, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0518, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B84, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B88, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B80, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BAC, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_1_2_1 = {
+	.num_data_rate_settings = 3,
+	.data_rate_settings = {
+		{
+			/* (2.5 * 10**3 * 2.28) rounded value*/
+			.bandwidth = 5700000000,
+			.data_rate_reg_array_size = 3,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x144, 0x32, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x164, 0x0B, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x16C, 0x25, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x344, 0x32, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x364, 0x0B, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x36C, 0x25, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x544, 0x32, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x564, 0x0B, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x56C, 0x25, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (3.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 7980000000,
+			.data_rate_reg_array_size = 4,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x144, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x164, 0x33, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x16C, 0x1D, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x9B4, 0x03, 0x01,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x344, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x364, 0x33, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x36C, 0x1D, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xAB4, 0x03, 0x01,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x544, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x564, 0x33, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x56C, 0x1D, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xBB4, 0x03, 0x01,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (4.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 10260000000,
+			.data_rate_reg_array_size = 4,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x144, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x164, 0x33, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x16C, 0x25, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x9B4, 0x02, 0x01,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x344, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x364, 0x33, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x36C, 0x25, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xAB4, 0x02, 0x01,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x544, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x564, 0x33, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x56C, 0x25, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xBB4, 0x02, 0x01,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+	},
+};
+#endif /* _CAM_CSIPHY_1_2_1_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_2_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_2_hwreg.h
@@ -0,0 +1,139 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_1_2_2_HWREG_H_
+#define _CAM_CSIPHY_1_2_2_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct csiphy_reg_parms_t csiphy_v1_2_2 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x8B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x858,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x828,
+	.csiphy_interrupt_status_size = 11,
+	.csiphy_common_array_size = 8,
+	.csiphy_reset_array_size = 5,
+	.csiphy_2ph_config_array_size = 18,
+	.csiphy_3ph_config_array_size = 33,
+	.csiphy_2ph_clock_lane = 0x1,
+	.csiphy_2ph_combo_ck_ln = 0x10,
+};
+
+struct csiphy_reg_t csiphy_common_reg_1_2_2[] = {
+	{0x0814, 0xd5, 0x00, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x5A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x03, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0884, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x088C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0824, 0x72, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct csiphy_reg_t
+csiphy_2ph_v1_2_2_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0024, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x005C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0730, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0724, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0230, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0224, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x025C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0424, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x045C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0630, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0624, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+};
+
+#endif /* _CAM_CSIPHY_1_2_2_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_3_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_3_hwreg.h
@@ -0,0 +1,512 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_1_2_3_HWREG_H_
+#define _CAM_CSIPHY_1_2_3_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct csiphy_reg_parms_t csiphy_v1_2_3 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x8B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x858,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x828,
+	.csiphy_interrupt_status_size = 11,
+	.csiphy_common_array_size = 5,
+	.csiphy_reset_array_size = 2,
+	.csiphy_2ph_config_array_size = 16,
+	.csiphy_3ph_config_array_size = 28,
+	.csiphy_2ph_3ph_config_array_size = 0,
+	.csiphy_2ph_clock_lane = 0x1,
+	.csiphy_2ph_combo_ck_ln = 0x10,
+	.prgm_cmn_reg_across_csiphy = 1,
+};
+
+struct csiphy_reg_t csiphy_common_reg_1_2_3[] = {
+	{0x0814, 0xd5, 0x00, CSIPHY_2PH_REGS},
+	{0x0814, 0x2A, 0x00, CSIPHY_3PH_REGS},
+	{0x0818, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x5A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0824, 0x72, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_reset_reg_1_2_3[] = {
+	{0x0800, 0x01, 0x02, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_1_2_3[] = {
+	{0x082c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0xFB, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083c, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0840, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0844, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0848, 0xEF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x084c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0850, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0854, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v1_2_3_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0024, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x000c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0730, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0724, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x070c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0230, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0224, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0200, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x020c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0424, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0400, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x040c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0630, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0624, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0600, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x060c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0638, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+	csiphy_2ph_v1_2_3_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0024, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x000c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0730, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0724, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x070C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0230, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0224, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0200, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x020c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0424, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x040c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0630, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0624, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x060c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct
+csiphy_reg_t csiphy_3ph_v1_2_3_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0990, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x098C, 0xAF, 0x64, CSIPHY_DEFAULT_PARAMS},
+		{0x0168, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x016C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x015C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x010C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0150, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0188, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x018C, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0190, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0118, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0984, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0A90, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A8C, 0xAF, 0x64, CSIPHY_DEFAULT_PARAMS},
+		{0x0368, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x036C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x035C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x030C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0350, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0388, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x038C, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0390, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0318, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A84, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0B90, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B8C, 0xAF, 0x64, CSIPHY_DEFAULT_PARAMS},
+		{0x0568, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x056C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x055C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x050C, 0x08, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0550, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0588, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x058C, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0590, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0518, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B84, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_1_2_3 = {
+	.num_data_rate_settings = 4,
+	.data_rate_settings = {
+		{
+			/* (1.9 * 10**3 * 2.28) rounded value*/
+			.bandwidth = 4332000000,
+			.data_rate_reg_array_size = 2,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x144, 0x22, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x9B4, 0x08, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x344, 0x22, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xAB4, 0x08, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x544, 0x22, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xBB4, 0x08, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (3 * 10**3 * 2.28) rounded value */
+			.bandwidth = 6840000000,
+			.data_rate_reg_array_size = 4,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x144, 0xA2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x988, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x980, 0x61, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x9B4, 0x08, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x344, 0xA2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA80, 0x61, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xAB4, 0x08, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x544, 0xA2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB80, 0x61, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xBB4, 0x08, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (3.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 7980000000,
+			.data_rate_reg_array_size = 4,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x144, 0xA2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x988, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x980, 0x61, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x9B4, 0x04, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x344, 0xA2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA80, 0x61, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xAB4, 0x04, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x544, 0xA2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB80, 0x61, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xBB4, 0x04, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (4.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 10260000000,
+			.data_rate_reg_array_size = 4,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x144, 0xA2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x988, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x980, 0x61, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x9B4, 0x04, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x344, 0xA2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA80, 0x61, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xAB4, 0x04, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x544, 0xA2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB80, 0x61, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xBB4, 0x04, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+	},
+};
+
+#endif /* _CAM_CSIPHY_1_2_3_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_5_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_5_hwreg.h
@@ -0,0 +1,563 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_1_2_5_HWREG_H_
+#define _CAM_CSIPHY_1_2_5_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct csiphy_reg_parms_t csiphy_v1_2_5 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x8B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x858,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x828,
+	.csiphy_interrupt_status_size = 11,
+	.csiphy_common_array_size = 6,
+	.csiphy_reset_array_size = 5,
+	.csiphy_2ph_config_array_size = 21,
+	.csiphy_3ph_config_array_size = 30,
+	.csiphy_2ph_clock_lane = 0x1,
+	.csiphy_2ph_combo_ck_ln = 0x10,
+};
+
+struct csiphy_reg_t csiphy_common_reg_1_2_5[] = {
+	{0x0814, 0xd5, 0x00, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x03, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x0800, 0x0E, 0x00, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_reset_reg_1_2_5[] = {
+	{0x0814, 0x00, 0x05, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_1_2_5[] = {
+	{0x082c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0xFB, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083c, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0840, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0844, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0848, 0xEF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x084c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0850, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0854, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct
+csiphy_reg_t csiphy_2ph_v1_2_5_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0904, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0910, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0900, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0908, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0904, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0010, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0730, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C80, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C88, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C84, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0230, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A00, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A08, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0210, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B00, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B08, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0410, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0630, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C00, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C08, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+	csiphy_2ph_v1_2_5_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0904, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0910, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0900, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0908, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0904, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0010, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0730, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C84, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C80, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C88, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C84, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0230, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A00, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A08, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0210, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B00, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B08, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0410, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0630, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C10, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C00, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C08, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x07, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct
+csiphy_reg_t csiphy_3ph_v1_2_5_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x015C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0990, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x098C, 0xAF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0168, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x016C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x010C, 0x07, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0150, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0188, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x018C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0190, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0118, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0144, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0984, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B4, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x035C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A90, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A8C, 0xAF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0368, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x036C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x030C, 0x07, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0350, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0388, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x038C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0390, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0318, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0344, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A84, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB4, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x055C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B90, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B8C, 0xAF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0568, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x056C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x050C, 0x07, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0550, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0588, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x058C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0590, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0518, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0544, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B84, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB4, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_1_2_5 = {
+	.num_data_rate_settings = 3,
+	.data_rate_settings = {
+		{
+			/* (2.5 * 10**3 * 2.28) rounded value*/
+			.bandwidth = 5700000000,
+			.data_rate_reg_array_size = 4,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x010C, 0x12, 0x00,
+						CSIPHY_SETTLE_CNT_LOWER_BYTE},
+						{0x0108, 0x00, 0x00,
+						CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+						{0x144, 0x22, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x9B4, 0x03, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x030C, 0x12, 0x00,
+						CSIPHY_SETTLE_CNT_LOWER_BYTE},
+						{0x0308, 0x00, 0x00,
+						CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+						{0x344, 0x22, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xAB4, 0x03, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x050C, 0x12, 0x00,
+						CSIPHY_SETTLE_CNT_LOWER_BYTE},
+						{0x0508, 0x00, 0x00,
+						CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+						{0x544, 0x22, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xBB4, 0x03, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (3.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 7980000000,
+			.data_rate_reg_array_size = 6,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x010C, 0x08, 0x00,
+						CSIPHY_SETTLE_CNT_LOWER_BYTE},
+						{0x0108, 0x00, 0x00,
+						CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+						{0x144, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x988, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x980, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x9B4, 0x02, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x030C, 0x08, 0x00,
+						CSIPHY_SETTLE_CNT_LOWER_BYTE},
+						{0x0308, 0x00, 0x00,
+						CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+						{0x344, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA80, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xAB4, 0x02, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x050C, 0x08, 0x00,
+						CSIPHY_SETTLE_CNT_LOWER_BYTE},
+						{0x0508, 0x00, 0x00,
+						CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+						{0x544, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB80, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xBB4, 0x02, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (4.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 10260000000,
+			.data_rate_reg_array_size = 6,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x010C, 0x08, 0x00,
+						CSIPHY_SETTLE_CNT_LOWER_BYTE},
+						{0x0108, 0x00, 0x00,
+						CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+						{0x144, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x988, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x980, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x9B4, 0x01, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x030C, 0x08, 0x00,
+						CSIPHY_SETTLE_CNT_LOWER_BYTE},
+						{0x0308, 0x00, 0x00,
+						CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+						{0x344, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA80, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xAB4, 0x01, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x050C, 0x08, 0x00,
+						CSIPHY_SETTLE_CNT_LOWER_BYTE},
+						{0x0508, 0x00, 0x00,
+						CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+						{0x544, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB80, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xBB4, 0x01, 0x0A,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+	},
+};
+
+#endif /* _CAM_CSIPHY_1_2_5_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_1_2_hwreg.h
@@ -0,0 +1,510 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_1_2_HWREG_H_
+#define _CAM_CSIPHY_1_2_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct csiphy_reg_parms_t csiphy_v1_2 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x8B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x858,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x828,
+	.csiphy_interrupt_status_size = 11,
+	.csiphy_common_array_size = 7,
+	.csiphy_reset_array_size = 5,
+	.csiphy_2ph_config_array_size = 18,
+	.csiphy_3ph_config_array_size = 33,
+	.csiphy_2ph_clock_lane = 0x1,
+	.csiphy_2ph_combo_ck_ln = 0x10,
+};
+
+struct csiphy_reg_t csiphy_common_reg_1_2[] = {
+	{0x0814, 0xd5, 0x00, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x5A, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x03, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0824, 0x72, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_reset_reg_1_2[] = {
+	{0x0814, 0x00, 0x05, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_1_2[] = {
+	{0x082c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0xFB, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083c, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0840, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0844, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0848, 0xEF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x084c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0850, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0854, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct
+csiphy_reg_t csiphy_2ph_v1_2_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0024, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x000c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x005C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0730, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0724, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070c, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0230, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0224, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x020c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x025C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0424, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x040c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x045C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0630, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0624, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060c, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0638, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x065C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0660, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0664, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+csiphy_2ph_v1_2_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0024, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x005C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0730, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0714, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0724, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+	{
+		{0x0230, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0210, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0214, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0224, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0238, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x025C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0x91, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0424, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x045C, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x7F, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0630, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0614, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0624, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+	},
+};
+
+struct
+csiphy_reg_t csiphy_3ph_v1_2_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x015C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0990, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0990, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0994, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0998, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x098C, 0xAF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0168, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x016C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x010C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0150, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0188, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x018C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0190, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0118, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0144, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0984, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x09B4, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x035C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A90, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A98, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A8C, 0xAF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0368, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x036C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x030C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0350, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0388, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x038C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0390, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0318, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0344, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A84, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AB4, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x055C, 0x46, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B90, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B90, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B98, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B8C, 0xAF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0568, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x056C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x050C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0550, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0588, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x058C, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0590, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0518, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0544, 0x22, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x33, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05DC, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB0, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0800, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B84, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0BB4, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_1_2 = {
+	.num_data_rate_settings = 3,
+	.data_rate_settings = {
+		{
+			/* (2.5 * 10**3 * 2.28) rounded value*/
+			.bandwidth = 5700000000,
+			.data_rate_reg_array_size = 1,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x144, 0x22, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x344, 0x22, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x544, 0x22, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (3.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 7980000000,
+			.data_rate_reg_array_size = 5,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x9B4, 0x02, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x144, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x988, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x980, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x10C, 0x08, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0xAB4, 0x02, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x344, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA80, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x30C, 0x08, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0xBB4, 0x02, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x544, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB80, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x50C, 0x08, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (4.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 10260000000,
+			.data_rate_reg_array_size = 5,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x9B4, 0x02, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x144, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x988, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x980, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x10C, 0x08, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0xAB4, 0x02, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x344, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xA88, 0x05, 0x00,
+						CSIPHY_DEFAULT_PARAMS},
+						{0xA80, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x30C, 0x08, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0xBB4, 0x02, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x544, 0xB2, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB88, 0x05, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0xB80, 0x60, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x50C, 0x08, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+	},
+};
+#endif /* _CAM_CSIPHY_1_2_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_0_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_0_hwreg.h
@@ -0,0 +1,351 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_2_0_HWREG_H_
+#define _CAM_CSIPHY_2_0_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct csiphy_reg_parms_t csiphy_v2_0 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x8B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x858,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x828,
+	.csiphy_interrupt_status_size = 11,
+	.csiphy_common_array_size = 8,
+	.csiphy_reset_array_size = 5,
+	.csiphy_2ph_config_array_size = 15,
+	.csiphy_3ph_config_array_size = 17,
+	.csiphy_2ph_clock_lane = 0x1,
+	.csiphy_2ph_combo_ck_ln = 0x10,
+};
+
+struct csiphy_reg_t csiphy_common_reg_2_0[] = {
+	{0x0814, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x06, 0x00, CSIPHY_3PH_REGS},
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0164, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x0364, 0x00, 0x00, CSIPHY_2PH_REGS},
+	{0x0564, 0x00, 0x00, CSIPHY_2PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_reset_reg_2_0[] = {
+	{0x0814, 0x00, 0x05, CSIPHY_LANE_ENABLE},
+	{0x0818, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x081C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0800, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_2_0[] = {
+	{0x082c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0830, 0xff, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x0834, 0xfb, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0838, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x083c, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0840, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0844, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0848, 0xef, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x084c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0850, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x0854, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_0_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x04, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0xD7, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x000C, 0xFF, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0010, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0038, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0730, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0760, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0764, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0230, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x04, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0xD7, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x020C, 0xFF, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0210, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0238, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0430, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x04, 0x00, CSIPHY_DNP_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0xD7, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x040C, 0xFF, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0410, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0438, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0630, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x04, 0x00, CSIPHY_DNP_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0xD7, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060C, 0xFF, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0610, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0660, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0664, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+	csiphy_2ph_v2_0_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0030, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x04, 0x00, CSIPHY_DNP_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0000, 0xD7, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x000C, 0xFF, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0010, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0038, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0060, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0064, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0730, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x072C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0734, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x073C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x071C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0700, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0704, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0708, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x070C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0738, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0760, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0764, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0230, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0234, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x04, 0x00, CSIPHY_DNP_PARAMS},
+		{0x023C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0200, 0xD7, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x020C, 0xFF, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0210, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0238, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0430, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0400, 0xD7, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x040C, 0xFF, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0410, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0438, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0460, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0464, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0630, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0634, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x063C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0600, 0xC0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x060C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0610, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0638, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0660, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0664, 0x3F, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t csiphy_3ph_v2_0_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x015C, 0x23, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0104, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x010C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0108, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0114, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0168, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x016C, 0x17, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0118, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x011C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0120, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0124, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0128, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x012C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0144, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0160, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x01CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0164, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x035C, 0x23, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0304, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x030C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0308, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0314, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0368, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x036C, 0x17, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0318, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x031C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0320, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0328, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x032C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0344, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0360, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x03CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0364, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+		{
+		{0x055C, 0x23, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0504, 0x06, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x050C, 0x12, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0508, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0514, 0x20, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0568, 0x70, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x056C, 0x17, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0518, 0x3e, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x051C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0520, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0524, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0528, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x052C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0544, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0560, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x05CC, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0564, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_2_0 = {
+	.num_data_rate_settings = 2,
+	.data_rate_settings = {
+		{
+			/* (2 * 10**9 * 2.28) rounded value*/
+			.bandwidth = 4560000000,
+			.data_rate_reg_array_size = 1,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x164, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x364, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x564, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+		{
+			/* (2.5 * 10**9 * 2.28) rounded value*/
+			.bandwidth = 5700000000,
+			.data_rate_reg_array_size = 1,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x164, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x364, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x564, 0x40, 0x00, CSIPHY_DEFAULT_PARAMS},
+					},
+				},
+			},
+		},
+	},
+
+};
+
+#endif /* _CAM_CSIPHY_2_0_HWREG_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_0_hwreg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_csiphy/include/cam_csiphy_2_1_0_hwreg.h
@@ -0,0 +1,520 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CSIPHY_2_1_0_HWREG_H_
+#define _CAM_CSIPHY_2_1_0_HWREG_H_
+
+#include "../cam_csiphy_dev.h"
+
+struct csiphy_reg_parms_t csiphy_v2_1_0 = {
+	.mipi_csiphy_interrupt_status0_addr = 0x10B0,
+	.mipi_csiphy_interrupt_clear0_addr = 0x1058,
+	.mipi_csiphy_glbl_irq_cmd_addr = 0x1028,
+	.csiphy_common_array_size = 6,
+	.csiphy_reset_array_size = 5,
+	.csiphy_2ph_config_array_size = 23,
+	.csiphy_3ph_config_array_size = 29,
+	.csiphy_2ph_clock_lane = 0x1,
+	.csiphy_2ph_combo_ck_ln = 0x10,
+};
+
+struct csiphy_reg_t csiphy_common_reg_2_1_0[] = {
+	{0x1014, 0xd5, 0x00, CSIPHY_LANE_ENABLE},
+	{0x1018, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x101C, 0x5a, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1000, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x1000, 0x02, 0x00, CSIPHY_2PH_REGS},
+	{0x1000, 0x0E, 0x00, CSIPHY_3PH_REGS},
+};
+
+struct csiphy_reg_t csiphy_reset_reg_2_1_0[] = {
+	{0x1014, 0x00, 0x00, CSIPHY_LANE_ENABLE},
+	{0x1018, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x101C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1000, 0x01, 0x01, CSIPHY_DEFAULT_PARAMS},
+	{0x1000, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_irq_reg_2_1_0[] = {
+	{0x102c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1030, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1034, 0xfb, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1038, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x103c, 0x7f, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1040, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1044, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1048, 0xef, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x104c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1050, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+	{0x1054, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
+};
+
+struct csiphy_reg_t csiphy_2ph_v2_1_0_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x000C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+		{0x0060, 0xF1, 0x00, CSIPHY_SKEW_CAL},
+		{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+		{0x1000, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E00, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E5C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0E60, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0E64, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x1000, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0400, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x040C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+		{0x0460, 0xF1, 0x00, CSIPHY_SKEW_CAL},
+		{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+		{0x1000, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0828, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x080C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+		{0x0860, 0xF1, 0x00, CSIPHY_SKEW_CAL},
+		{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+		{0x1000, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C28, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0C00, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C0C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0C38, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C5C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+		{0x0C60, 0xF1, 0x00, CSIPHY_SKEW_CAL},
+		{0x0C64, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+		{0x1000, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t
+	csiphy_2ph_v2_1_0_combo_mode_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0094, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x00A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0090, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0098, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0094, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0030, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0000, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x000C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0038, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x002C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0034, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x001C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0014, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x003C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0004, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0008, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0010, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x005C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+		{0x0060, 0xF1, 0x00, CSIPHY_SKEW_CAL},
+		{0x0064, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+		{0x1000, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0E94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0EA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0E30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E00, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E28, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0E2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0E10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0E5C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0E60, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0E64, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x1000, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0494, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x04A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0490, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0498, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0494, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0430, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0028, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0400, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x040C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0438, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0428, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x042C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0434, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x041C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0414, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x043C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0404, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0408, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0410, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x045C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+		{0x0460, 0xF1, 0x00, CSIPHY_SKEW_CAL},
+		{0x0464, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+		{0x1000, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0894, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x08A0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0890, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0898, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0894, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0830, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0828, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0800, 0xD4, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x080C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0838, 0xFE, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0828, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x082C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0834, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x081C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0814, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x083C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0804, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0820, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0808, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0810, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x085C, 0x00, 0x00, CSIPHY_SKEW_CAL},
+		{0x0860, 0xF1, 0x00, CSIPHY_SKEW_CAL},
+		{0x0864, 0x7F, 0x00, CSIPHY_SKEW_CAL},
+		{0x1000, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0C94, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0CA0, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C90, 0x0f, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C98, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C94, 0x07, 0x01, CSIPHY_DEFAULT_PARAMS},
+		{0x0C30, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C28, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C00, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C0C, 0xFF, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C38, 0x1F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C28, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C2C, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C34, 0x0F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C1C, 0x0A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C14, 0x60, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C3C, 0xB8, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C04, 0x0C, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C20, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C08, 0x10, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
+		{0x0C10, 0x52, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0C5C, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0C60, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x0C64, 0x00, 0x00, CSIPHY_DNP_PARAMS},
+		{0x1000, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct csiphy_reg_t csiphy_3ph_v2_1_0_reg[MAX_LANES][MAX_SETTINGS_PER_LANE] = {
+	{
+		{0x0294, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x02F4, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x02F8, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x02FC, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x02F0, 0xEF, 0x03, CSIPHY_DEFAULT_PARAMS},
+		{0x0324, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0294, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0278, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0268, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x026C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0204, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0208, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0214, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0260, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0240, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x02E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x02E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x02EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0218, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x021C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0220, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0224, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0228, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x022C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0264, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0244, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0310, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x025C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x1000, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0694, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x06F4, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x06F8, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x06FC, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x06F0, 0xEF, 0x03, CSIPHY_DEFAULT_PARAMS},
+		{0x0724, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0694, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0678, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0668, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x066C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0604, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0608, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0614, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0660, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0640, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x06E4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x06E8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x06EC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0618, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x061C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0620, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0624, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0628, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x062C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0664, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0644, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0710, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x065C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x1000, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+	{
+		{0x0A94, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AF4, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AF8, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AFC, 0x1A, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AF0, 0xEF, 0x03, CSIPHY_DEFAULT_PARAMS},
+		{0x0B24, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A94, 0x0D, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A78, 0x03, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A68, 0xA0, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A6C, 0x25, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A04, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A08, 0x00, 0x00, CSIPHY_SETTLE_CNT_HIGHER_BYTE},
+		{0x0A14, 0x05, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A60, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A40, 0x80, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AE4, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AE8, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0AEC, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A18, 0x3E, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A1C, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A20, 0x41, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A24, 0x7F, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A28, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A2C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A64, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A44, 0x32, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0B10, 0x35, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x0A5C, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
+		{0x1000, 0x0E, 0x00, CSIPHY_DEFAULT_PARAMS},
+	},
+};
+
+struct data_rate_settings_t data_rate_delta_table_2_1_0 = {
+	.num_data_rate_settings = 3,
+	.data_rate_settings = {
+		{
+			/* (2.5 * 10**3 * 2.28) rounded value*/
+			.bandwidth = 5700000000,
+			.data_rate_reg_array_size = 2,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x0290, 0x02, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x020C, 0x03, 0x00,
+							CSIPHY_SETTLE_CNT_LOWER_BYTE},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x0690, 0x02, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x060C, 0x03, 0x00,
+							CSIPHY_SETTLE_CNT_LOWER_BYTE},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x0A90, 0x02, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x0A0C, 0x03, 0x00,
+							CSIPHY_SETTLE_CNT_LOWER_BYTE},
+					},
+				},
+			},
+		},
+		{
+			/* (4.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 10260000000,
+			.data_rate_reg_array_size = 2,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x0290, 0x03, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x020C, 0x03, 0x00,
+							CSIPHY_SETTLE_CNT_LOWER_BYTE},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x0690, 0x03, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x060C, 0x03, 0x00,
+							CSIPHY_SETTLE_CNT_LOWER_BYTE},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x0A90, 0x03, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x0A0C, 0x03, 0x00,
+							CSIPHY_SETTLE_CNT_LOWER_BYTE},
+					},
+				},
+			},
+		},
+		{
+			/* (6.5 * 10**3 * 2.28) rounded value */
+			.bandwidth = 14820000000,
+			.data_rate_reg_array_size = 2,
+			.per_lane_info = {
+				{
+					.lane_identifier = CPHY_LANE_0,
+					.csiphy_data_rate_regs = {
+						{0x0290, 0x03, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x020C, 0x07, 0x00,
+							CSIPHY_SETTLE_CNT_LOWER_BYTE},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_1,
+					.csiphy_data_rate_regs = {
+						{0x0690, 0x03, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x060C, 0x07, 0x00,
+							CSIPHY_SETTLE_CNT_LOWER_BYTE},
+					},
+				},
+				{
+					.lane_identifier = CPHY_LANE_2,
+					.csiphy_data_rate_regs = {
+						{0x0A90, 0x03, 0x00,
+							CSIPHY_DEFAULT_PARAMS},
+						{0x0A0C, 0x07, 0x00,
+							CSIPHY_SETTLE_CNT_LOWER_BYTE},
+					},
+				},
+			},
+		},
+	},
+};
+
+#endif /* _CAM_CSIPHY_2_1_0_HWREG_H_ */
\ No newline at end of file
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_dp_bdg/cam_dp_bdg_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_dp_bdg/cam_dp_bdg_core.c
@@ -0,0 +1,1238 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/module.h>
+#include <linux/firmware.h>
+#include <cam_sensor_cmn_header.h>
+#include "cam_sensor_core.h"
+#include "cam_sensor_util.h"
+#include "cam_soc_util.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+#include "cam_dp_bdg_core.h"
+
+static struct cam_sensor_ctrl_t *cam_dp_bdg_cam_ctrl = NULL;
+
+enum lt7911_fw_status lt7911_fw_status;
+
+static int lt7911_get_fw_state(void)
+{
+	return lt7911_fw_status;
+}
+
+static void lt7911_set_fw_state(int fw_status)
+{
+	lt7911_fw_status = fw_status;
+}
+
+static int lt7911_flash_write_en(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [6] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe1,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x03,
+		.reg_data = 0x2e,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x03,
+		.reg_data = 0xee,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x04,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 6;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to flash write enable rc %d", rc);
+
+	return rc;
+}
+
+static int lt7911_flash_write_config(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [4] = {
+	{
+		.reg_addr = 0x5E,
+		.reg_data = 0xdf,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x20,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x58,
+		.reg_data = 0x21,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 4;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to flash write config rc %d", rc);
+	return rc;
+}
+
+static int lt7911_write (struct cam_sensor_ctrl_t *s_ctrl, u8 reg,
+				const u8 *buf, int size)
+{
+	int32_t rc = 0;
+	u8 i2c_wbuf[64];
+	int i;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs[32];
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	memset(i2c_wbuf, 0, 64);
+	memcpy(i2c_wbuf, buf, size);
+	for (i=0 ; i<size ; i++) {
+		 m_i2c_write_regs[i].reg_addr=reg;
+		 m_i2c_write_regs[i].reg_data=i2c_wbuf[i];
+		 m_i2c_write_regs[i].delay=0x00;
+		 m_i2c_write_regs[i].data_mask=0x00;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = size;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	/* burst setting. */
+	rc = camera_io_dev_write_continuous(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings, CAM_SENSOR_I2C_WRITE_BURST);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to write data rc %d", rc);
+
+	return rc;
+	}
+
+static int lt7911_flash_write_addr_set(struct cam_sensor_ctrl_t *s_ctrl, u32 addr)
+	{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [5] = {
+	{
+		.reg_addr = 0x5B,
+		.reg_data = (addr & 0xFF0000) >> 16,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5C,
+		.reg_data = (addr & 0xFF00) >> 8,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5D,
+		.reg_data = addr & 0xFF,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x10,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 5;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0)
+	CAM_ERR(CAM_SENSOR,"Failed to flash write addr rc %d", rc);
+
+	return rc;
+}
+
+static int lt7911_write_over_config(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [2] = {
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x08,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 2;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to write over config rc %d", rc);
+
+	return rc;
+}
+
+static int lt7911_firmware_write(struct cam_sensor_ctrl_t *s_ctrl, const u8 *f_data,
+			int size)
+{
+	int32_t rc = 0;
+	u8 last_buf[32];
+	int i = 0, page_size = 32;
+	int start_addr = 0, total_page = 0, rest_data = 0;
+
+	total_page = size / page_size;
+	rest_data = size % page_size;
+
+	for (i = 0; i < total_page; i++) {
+            /* reset fifo */
+	    rc = lt7911_flash_write_en(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write enable rc %d", rc);
+			return rc;
+		}
+
+		rc = lt7911_flash_write_config(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write config rc %d", rc);
+			break;
+		}
+		rc = lt7911_write(s_ctrl, 0x59, f_data, page_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to write data rc %d", rc);
+			break;
+		}
+		rc = lt7911_flash_write_addr_set(s_ctrl, start_addr);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write addr rc %d", rc);
+			break;
+		}
+		start_addr += page_size;
+		f_data += page_size;
+	}
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write firmware rc %d", rc);
+		return rc;
+	}
+
+	if (rest_data > 0) {
+		memset(last_buf, 0xFF, 32);
+		memcpy(last_buf, f_data, rest_data);
+
+	    rc = lt7911_flash_write_en(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write enable rc %d", rc);
+			return rc;
+		}
+
+		rc = lt7911_flash_write_config(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write config rc %d", rc);
+			return rc;
+		}
+		rc = lt7911_write(s_ctrl, 0x59, last_buf, rest_data);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to write data rc %d", rc);
+			return rc;
+		}
+		rc = lt7911_flash_write_addr_set(s_ctrl, start_addr);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write addr rc %d", rc);
+			return rc;
+		}
+	}
+
+	rc = lt7911_write_over_config(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write over config rc %d", rc);
+		return rc;
+	}
+
+	CAM_INFO(CAM_SENSOR, "LT7911 FW write over, total size: %d, "
+			"page: %d, reset: %d", size, total_page, rest_data);
+	return rc;
+}
+
+static int lt7911_block_erase(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [9] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xEE,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x04,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5B,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5C,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5D,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs_2 [9] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xEE,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x04,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5B,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5C,
+		.reg_data = 0x80,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5D,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings_2;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 9;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 500;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to erase block rc %d", rc);
+
+	m_i2c_write_settings_2.reg_setting = m_i2c_write_regs_2;
+	m_i2c_write_settings_2.size = 9;
+	m_i2c_write_settings_2.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings_2.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings_2.delay = 500;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings_2);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to erase block rc %d", rc);
+
+	return rc;
+}
+
+static int lt7911_config(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [8] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xEE,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5E,
+		.reg_data = 0xc1,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x58,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x59,
+		.reg_data = 0x50,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x10,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x58,
+		.reg_data = 0x21,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 8;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to write config settings rc = %d", rc);
+
+	return rc;
+}
+
+static int lt7911_flash_read_addr_set(struct cam_sensor_ctrl_t *s_ctrl, u32 addr)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [9] = {
+	{
+		.reg_addr = 0x5E,
+		.reg_data = 0x5f,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x20,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5B,
+		.reg_data = (addr & 0xFF0000) >> 16,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5C,
+		.reg_data = (addr & 0xFF00) >> 8,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5D,
+		.reg_data = addr & 0xFF,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x10,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x58,
+		.reg_data = 0x21,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 9;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to flash read addr rc %d", rc);
+
+	return rc;
+}
+
+static int lt7911_read(struct cam_sensor_ctrl_t *s_ctrl, u8 reg,
+			char *buf, u32 size)
+{
+	uint8_t data[32];
+	int rc = 0;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	if (size > 32) {
+		CAM_ERR(CAM_SENSOR, "Invalid read size %d", size);
+		return -EINVAL;
+	}
+
+	memset(data, 0x0, size);
+	rc = camera_io_dev_read_seq(&(s_ctrl->io_master_info), reg, data,
+			CAMERA_SENSOR_I2C_TYPE_BYTE, CAMERA_SENSOR_I2C_TYPE_BYTE, size);
+	if (!rc)
+		memcpy(buf, data, size);
+
+	return rc;
+}
+
+static int lt7911_fw_read_back(struct cam_sensor_ctrl_t *s_ctrl, u8 *buff, int size)
+{
+	u8 page_data[32];
+	int page_number = 0, i = 0, addr = 0;
+	int rest_data = 0;
+	int rc = 0;
+
+	struct cam_sensor_i2c_reg_array m_i2c_write_regs[2];
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	/*
+	 * Read 32 bytes once.
+	 */
+	page_number = size / 32;
+	rest_data = size % 32;
+
+	for (i = 0; i < page_number; i++) {
+		memset(page_data, 0x0, 32);
+		rc = lt7911_flash_read_addr_set(s_ctrl, addr);
+		if (rc < 0)
+			return rc;
+
+		rc = lt7911_read(s_ctrl, 0x5F, page_data, 32);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to read rc %d", rc);
+			return rc;
+		}
+		memcpy(buff, page_data, 32);
+		buff += 32;
+		addr += 32;
+	}
+
+	if(rest_data != 0) {
+		memset(page_data, 0x0, rest_data);
+		rc = lt7911_flash_read_addr_set(s_ctrl, addr);
+		if (rc < 0)
+			return rc;
+		rc = lt7911_read(s_ctrl, 0x5F, page_data, rest_data);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to read rc %d", rc);
+			return rc;
+		}
+		memcpy(buff, page_data, rest_data);
+		buff += rest_data;
+		addr += rest_data;
+	}
+
+	rc = lt7911_write_over_config(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write over config rc %d", rc);
+		return rc;
+	}
+
+	/* disable external i2c control */
+	m_i2c_write_regs[0].reg_addr=0xFF;
+	m_i2c_write_regs[0].reg_data=0xe0;
+	m_i2c_write_regs[1].reg_addr=0xEE;
+	m_i2c_write_regs[1].reg_data=0x00;
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 2;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write settings rc %d", rc);
+		return rc;
+	}
+
+	CAM_INFO(CAM_SENSOR, "lt7911_fw_read_back:read data size : %d",addr);
+
+	return rc;
+}
+
+static int lt7911_firmware_upgrade(struct cam_sensor_ctrl_t *s_ctrl,
+			const struct firmware *cfg)
+{
+	int i = 0;
+	u8 *fw_read_data = NULL;
+
+	int data_len = 0;
+	int rc = -1;
+
+	if (NULL == cfg) {
+		CAM_ERR(CAM_SENSOR, "Invalid args");
+		return -EINVAL;
+	}
+
+	data_len = (int)cfg->size;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	fw_read_data = kzalloc(ALIGN(data_len, 32), GFP_KERNEL);
+	if (!fw_read_data)
+		return rc;
+
+	lt7911_fw_status = LT7911_UPDATE_RUNNING;
+	rc = lt7911_config(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write config settings rc %d", rc);
+		goto end;
+	}
+
+	/*
+	* Need erase block 2 times here.
+	* Sometimes, erase can fail.
+	*/
+	for (i = 0; i < 2; i++) {
+		rc = lt7911_block_erase(s_ctrl);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,"Failed to erase block rc %d, retrying...", rc);
+		else
+			break;
+	}
+
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to erase blocks rc %d", rc);
+		goto end;
+	}
+
+	rc = lt7911_firmware_write(s_ctrl, cfg->data, data_len);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write firmware rc %d", rc);
+		goto end;
+	}
+
+	rc = lt7911_fw_read_back(s_ctrl, fw_read_data, data_len);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to read back firmware rc %d", rc);
+		goto end;
+	}
+	if (!memcmp(cfg->data, fw_read_data, data_len)) {
+		lt7911_fw_status = LT7911_UPDATE_SUCCESS;
+		CAM_INFO(CAM_SENSOR, "LT7911 Firmware upgrade success.");
+		kfree(fw_read_data);
+		return rc;
+	}
+end:
+	lt7911_fw_status = LT7911_UPDATE_FAILED;
+	kfree(fw_read_data);
+	return rc;
+}
+
+static void lt7911_firmware_cb(const struct firmware *cfg, void *data)
+{
+	struct cam_sensor_ctrl_t *s_ctrl = (struct cam_sensor_ctrl_t *)data;
+	int rc = 0;
+
+	if (!cfg) {
+		CAM_ERR(CAM_SENSOR,"LT7911 get firmware failed");
+		lt7911_set_fw_state(LT7911_UPDATE_FAILED);
+		return;
+	}
+
+	rc = lt7911_firmware_upgrade(s_ctrl, cfg);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to upgrade firmware rc %d", rc);
+	release_firmware(cfg);
+}
+
+uint32_t cam_dp_bdg_get_fw_version(void)
+{
+	struct cam_sensor_ctrl_t *s_ctrl = cam_dp_bdg_cam_ctrl;
+	uint32_t version = 0;
+	uint32_t buf = 0;
+	int rc = 0;
+
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [3] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xEE,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, "LT7911GXC is not ready.");
+		return -EINVAL;
+	}
+	if (s_ctrl->sensordata == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed sensordata: %pK", s_ctrl->sensordata);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 3;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info), &m_i2c_write_settings);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write registers rc %d", rc);
+		goto end;
+	}
+
+	/* version byte 1 read */
+	rc = camera_io_dev_read(
+			&(s_ctrl->io_master_info),
+			0x80,
+			&buf,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if(!rc)
+		version += (buf & 0xFF) << 24;
+	else {
+		CAM_ERR(CAM_SENSOR,"LT7911 get revison failed");
+		goto end;
+	}
+
+
+	/* version byte 2 read */
+	rc = camera_io_dev_read(
+			&(s_ctrl->io_master_info),
+			0x81,
+			&buf,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if(!rc)
+		version += (buf & 0xFF) << 16;
+	else {
+		CAM_ERR(CAM_SENSOR,"LT7911 get revison failed");
+		goto end;
+	}
+
+	/* version byte 3 read */
+	rc = camera_io_dev_read(
+			&(s_ctrl->io_master_info),
+			0x82,
+			&buf,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if(!rc)
+		version += (buf & 0xFF) << 8;
+	else {
+		CAM_ERR(CAM_SENSOR,"LT7911 get revison failed");
+		goto end;
+	}
+
+	/* version byte 4 read */
+	rc = camera_io_dev_read(
+			&(s_ctrl->io_master_info),
+			0x83,
+			&buf,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if(!rc)
+		version += buf & 0xFF;
+	else {
+		CAM_ERR(CAM_SENSOR,"LT7911 get revison failed");
+		goto end;
+	}
+
+	m_i2c_write_regs[0].reg_addr = 0xFF;
+	m_i2c_write_regs[0].reg_data = 0xe0;
+	m_i2c_write_regs[1].reg_addr = 0xEE;
+	m_i2c_write_regs[1].reg_data = 0x00;
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 2;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write registers rc %d", rc);
+		goto end;
+	}
+	return version;
+end:
+	version = 0;
+	return version;
+}
+
+int cam_dp_bdg_set_cam_ctrl(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0;
+	struct cam_camera_slave_info *slave_info;
+
+	if (!s_ctrl || !s_ctrl->sensordata) {
+		CAM_ERR(CAM_SENSOR, "Invalid ptr");
+		return -EINVAL;
+	}
+
+	slave_info = &(s_ctrl->sensordata->slave_info);
+	if (!slave_info) {
+		CAM_ERR(CAM_SENSOR, " failed slave_info: %pK", slave_info);
+		return -EINVAL;
+	}
+	if (slave_info->sensor_id == DP_BDG_SENSOR_ID) {
+		cam_dp_bdg_cam_ctrl = s_ctrl;
+		CAM_ERR(CAM_SENSOR, "Setting sctrl for dp");
+		rc = 0;
+	} else {
+		cam_dp_bdg_cam_ctrl = NULL;
+		rc = -EINVAL;
+	}
+	return rc;
+}
+
+void cam_dp_bdg_unset_cam_ctrl(void)
+{
+	cam_dp_bdg_cam_ctrl = NULL;
+}
+
+int cam_dp_bdg_upgrade_firmware(void)
+{
+	int32_t rc = 0;
+	struct cam_camera_slave_info *slave_info;
+	struct cam_sensor_ctrl_t *s_ctrl = cam_dp_bdg_cam_ctrl;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, "LT7911UXC is not ready.");
+		return -EINVAL;
+	}
+	if (s_ctrl->sensordata == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed sensordata: %pK", s_ctrl->sensordata);
+		return -EINVAL;
+	}
+
+	slave_info = &(s_ctrl->sensordata->slave_info);
+
+	if (!slave_info) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", slave_info);
+		return -EINVAL;
+	}
+
+	if (slave_info->sensor_id == DP_BDG_SENSOR_ID) {
+		int max_wait_times = 25;
+
+		CAM_INFO(CAM_SENSOR,"LT7911 firmare version before upgrade: 0x%08x",
+			cam_dp_bdg_get_fw_version());
+
+		rc = request_firmware_nowait(THIS_MODULE, true,
+				"lt7911_fw.bin", s_ctrl->soc_info.dev, GFP_KERNEL,
+				s_ctrl, lt7911_firmware_cb);
+		if (rc < 0)
+			return rc;
+
+		/* wait for firmware upgrade over, max wait time is 50 seconds */
+		CAM_INFO(CAM_SENSOR, "LT7911 starts upgrade, "
+				"waiting for about 50s...");
+
+		while (max_wait_times >= 0) {
+			msleep(2000);
+			if (lt7911_get_fw_state() != LT7911_UPDATE_RUNNING)
+				break;
+			max_wait_times--;
+
+			CAM_INFO(CAM_SENSOR, "LT7911 fw upgrade: "
+				"%d seconds have passed,most often %d seconds "
+				"have to be waited...",((50-max_wait_times)*2),
+				(max_wait_times*2));
+		}
+	}
+	if (lt7911_get_fw_state() != LT7911_UPDATE_SUCCESS)
+		rc = -1;
+
+	return rc;
+}
+
+int cam_dp_bdg_get_src_resolution(bool *signal_stable,
+	int *width,
+	int *height,
+	int *id)
+{
+	int rc = 0;
+	u32 hactive_h, hactive_l;
+	u32 vactive_h, vactive_l;
+	u32 dp_signal_status;
+	struct cam_sensor_i2c_reg_setting m_i2cWriteSettings;
+	struct cam_sensor_i2c_reg_array m_i2cWriteRegArray;
+
+	if (!cam_dp_bdg_cam_ctrl) {
+		CAM_ERR(CAM_SENSOR, "LT7911GXC is not ready.");
+		*signal_stable = false;
+		*height = -1;
+		*width = -1;
+		return -EINVAL;
+	}
+	/* camera_io_init(&(cam_dp_bdg_cam_ctrl->io_master_info));*/
+	/* cam_sensor_power_up(cam_dp_bdg_cam_ctrl);*/
+	mutex_lock(&(cam_dp_bdg_cam_ctrl->cam_sensor_mutex));
+	memset(&m_i2cWriteSettings, 0, sizeof(m_i2cWriteSettings));
+
+	m_i2cWriteSettings.reg_setting = &m_i2cWriteRegArray;
+	m_i2cWriteSettings.size = 1;
+	m_i2cWriteSettings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2cWriteSettings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2cWriteSettings.delay = 0;
+
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_dp_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	m_i2cWriteRegArray.reg_addr = 0xee;
+	m_i2cWriteRegArray.reg_data = 0x01;
+	rc = camera_io_dev_write(&(cam_dp_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_dp_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	m_i2cWriteRegArray.reg_addr = 0xb0;
+	m_i2cWriteRegArray.reg_data = 0x01;
+	rc = camera_io_dev_write(&(cam_dp_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	/* Check dp signal first*/
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_dp_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_dp_bdg_cam_ctrl->io_master_info),
+			0x84, &dp_signal_status,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	CAM_INFO(CAM_SENSOR, "lt7911gxc signal stable %x", dp_signal_status);
+	if (rc < 0)
+		goto fail;
+
+	if (dp_signal_status == DP_BDG_DP_DISCONNECTED) {
+		*signal_stable = false;
+		*height = 0;
+		*width = 0;
+		*id = cam_dp_bdg_cam_ctrl->id;
+		goto end;
+	}
+	if (dp_signal_status > 0xFF) {
+		/* Read value from I2C should not upper than 0xFF.*/
+		/* If so, it means LT7911UXC is closed.*/
+		*signal_stable = false;
+		*height = -1;
+		*width = -1;
+		*id = cam_dp_bdg_cam_ctrl->id;
+		goto end;
+	}
+
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_dp_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_dp_bdg_cam_ctrl->io_master_info),
+			0x8c, &hactive_h,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_dp_bdg_cam_ctrl->io_master_info),
+			0x8d, &hactive_l,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_dp_bdg_cam_ctrl->io_master_info),
+			0x8e, &vactive_h,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_dp_bdg_cam_ctrl->io_master_info),
+			0x8f, &vactive_l,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if (rc < 0)
+		goto fail;
+
+	*signal_stable = true;
+	*height = (vactive_h << 8) | vactive_l;
+	*width = (hactive_h << 8) | hactive_l;
+	*id = cam_dp_bdg_cam_ctrl->id;
+	CAM_INFO(CAM_SENSOR, "signal stable %d %d, x %d id %d",
+			*signal_stable, *width,
+			*height, *id);
+
+end:
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_dp_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	m_i2cWriteRegArray.reg_addr = 0xee;
+	m_i2cWriteRegArray.reg_data = 0x00;
+	rc = camera_io_dev_write(&(cam_dp_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	mutex_unlock(&(cam_dp_bdg_cam_ctrl->cam_sensor_mutex));
+	return rc;
+
+fail:
+	*signal_stable = false;
+	*height = -1;
+	*width = -1;
+	mutex_unlock(&(cam_dp_bdg_cam_ctrl->cam_sensor_mutex));
+	return rc;
+}
+EXPORT_SYMBOL(cam_dp_bdg_get_src_resolution);
+EXPORT_SYMBOL(cam_dp_bdg_get_fw_version);
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_dp_bdg/cam_dp_bdg_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_dp_bdg/cam_dp_bdg_core.h
@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAMDPBDGCORE_H_
+#define _CAMDPBDGCORE_H_
+
+#include <linux/firmware.h>
+#include "cam_sensor_dev.h"
+
+#define DP_BDG_SENSOR_ID 0x1901
+#define DP_BDG_DP_CONNECTED    0x01
+#define DP_BDG_DP_DISCONNECTED 0x00
+#define DP_SENSOR_NAME "lt7911uxc"
+
+enum lt7911_fw_status {
+	LT7911_UPDATE_SUCCESS = 0,
+	LT7911_UPDATE_RUNNING = 1,
+	LT7911_UPDATE_FAILED  = 2,
+};
+
+/**
+ * This API upgrade lt7911 firmware.
+ */
+int cam_dp_bdg_upgrade_firmware(void);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * This API set lt7911 camera struct for irq handle.
+ */
+int cam_dp_bdg_set_cam_ctrl(struct cam_sensor_ctrl_t *s_ctrl);
+
+/**
+ * This API unset lt7911 camera struct for irq handle.
+ */
+void cam_dp_bdg_unset_cam_ctrl(void);
+
+int cam_dp_bdg_get_src_resolution(bool *signal_stable,
+		int *width, int *height, int *id);
+
+uint32_t cam_dp_bdg_get_fw_version(void);
+
+/**
+ * @brief : API to register DP dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int dp_bdg_irq_handler_init(void);
+
+/**
+ * @brief : API to remove DP dev from platform framework.
+ */
+void dp_bdg_irq_handler_exit(void);
+
+#endif /* _CAMHDMIBDGCORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_dp_bdg/cam_dp_bdg_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_dp_bdg/cam_dp_bdg_dev.c
@@ -0,0 +1,274 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/cdev.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/workqueue.h>
+#include <linux/of_gpio.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include "cam_dp_bdg_core.h"
+#include "camera_main.h"
+
+#define DP_BDG_IRQ_HANDLER_DEVNAME             "dp_bdg_irq_handler"
+#define DP_BDG_IRQ_HANDLER_MAGIC_NUM           0xff
+#define DP_BDG_IRQ_HANDLER_IOCTL_GETRES        0x05
+#define DP_BDG_IRQ_HANDLER_IOCTL_GETRES_DIR    0x06
+#define DP_BDG_IRQ_HANDLER_IOCTL_RST           0x07
+#define DP_BDG_IRQ_HANDLER_IOCTL_UPGRADE_FW    0x08
+
+struct dp_bdg_res_info {
+	int32_t width;
+	int32_t height;
+	bool have_dp_signal;
+	int32_t id;
+};
+
+#define DP_BDG_IRQ_HANDLER_IOCTL_CMD_GETRES   \
+	_IOR(DP_BDG_IRQ_HANDLER_MAGIC_NUM,        \
+	DP_BDG_IRQ_HANDLER_IOCTL_GETRES, \
+			struct dp_bdg_res_info)
+#define DP_BDG_IRQ_HANDLER_IOCTL_CMD_GETRES_DIR   \
+	_IOR(DP_BDG_IRQ_HANDLER_MAGIC_NUM,            \
+	DP_BDG_IRQ_HANDLER_IOCTL_GETRES_DIR, \
+			struct dp_bdg_res_info)
+#define DP_BDG_IRQ_HANDLER_IOCTL_CMD_RST   \
+	_IO(DP_BDG_IRQ_HANDLER_MAGIC_NUM,      \
+	DP_BDG_IRQ_HANDLER_IOCTL_RST)
+#define DP_BDG_IRQ_HANDLER_IOCTL_CMD_UPGRADE_FW   \
+	_IO(DP_BDG_IRQ_HANDLER_MAGIC_NUM,      \
+	DP_BDG_IRQ_HANDLER_IOCTL_UPGRADE_FW)
+
+
+static const struct  of_device_id dp_bdg_irq_handler_dev_id[] = {
+	{ .compatible = "dp_bdg_irq_handler" },
+	{},
+};
+
+static bool is_irq_happen;
+static int dp_bdg_irq;
+static int dp_bdg_irq_gpio;
+static wait_queue_head_t dp_bdg_read_wq;
+static struct dp_bdg_res_info s_dp_bdg_res_info;
+static struct cdev *dp_bdg_irq_handler_cdev;
+static dev_t dp_bdg_irq_handler_dev;
+static struct class *dp_bdg_irq_handler_class;
+static struct device *dp_bdg_irq_handler_device;
+
+MODULE_DEVICE_TABLE(of, dp_bdg_irq_handler_dev_id);
+
+static int dp_bdg_irq_handler_dev_open(struct inode *inodp, struct file *filp)
+{
+	return 0;
+}
+static int dp_bdg_irq_handler_dev_release(struct inode *inodp,
+		struct file *filp)
+{
+	wake_up_all(&dp_bdg_read_wq);
+	return 0;
+}
+static ssize_t dp_bdg_irq_handler_dev_read(struct file *filp,
+		char __user *buf, size_t n_read, loff_t *off)
+{
+	CAM_INFO(CAM_SENSOR, "dp_bdg_irq_handler: wait IRQ happened");
+	wait_event_interruptible(dp_bdg_read_wq, is_irq_happen);
+	CAM_INFO(CAM_SENSOR, "dp_bdg_irq_handler: IRQ happened");
+	is_irq_happen = false;
+	return 0;
+}
+
+static long dp_bdg_irq_handler_dev_ioctl(struct file *filp,
+		unsigned int cmd, unsigned long arg)
+{
+	int rc = 0;
+
+	switch (cmd) {
+	case DP_BDG_IRQ_HANDLER_IOCTL_CMD_GETRES:
+		rc = copy_to_user((struct dp_bdg_res_info *)arg,
+			&s_dp_bdg_res_info,
+			sizeof(s_dp_bdg_res_info));
+		if (rc != 0)
+			CAM_ERR(CAM_SENSOR, "dp_bdg_irq_handler: IOCTL read error!");
+		break;
+	case DP_BDG_IRQ_HANDLER_IOCTL_CMD_GETRES_DIR:
+		CAM_INFO(CAM_SENSOR, "LT7911 firmare version: 0x%08x", cam_dp_bdg_get_fw_version());
+		rc = cam_dp_bdg_get_src_resolution(
+			&s_dp_bdg_res_info.have_dp_signal,
+			&s_dp_bdg_res_info.width,
+			&s_dp_bdg_res_info.height,
+			&s_dp_bdg_res_info.id);
+		if (!rc) {
+			CAM_INFO(CAM_SENSOR, "DP_BDG Input resolution = %d x %d",
+				s_dp_bdg_res_info.width,
+				s_dp_bdg_res_info.height);
+		}
+		rc = copy_to_user((struct dp_bdg_res_info *)arg,
+			&s_dp_bdg_res_info,
+			sizeof(s_dp_bdg_res_info));
+		if (rc != 0)
+			CAM_ERR(CAM_SENSOR, "dp_bdg_irq_handler: IOCTL read error!");
+		break;
+	case DP_BDG_IRQ_HANDLER_IOCTL_CMD_RST:
+		s_dp_bdg_res_info.width = -1;
+		s_dp_bdg_res_info.height = -1;
+		s_dp_bdg_res_info.have_dp_signal = false;
+		s_dp_bdg_res_info.id = 0;
+		break;
+	case DP_BDG_IRQ_HANDLER_IOCTL_CMD_UPGRADE_FW:
+		CAM_INFO(CAM_SENSOR, "dp_bdg_irq_handler: Upgrading firmware...");
+		rc = cam_dp_bdg_upgrade_firmware();
+		CAM_INFO(CAM_SENSOR, "dp_bdg_irq_handler: rc %d", rc);
+		break;
+	default:
+		CAM_ERR(CAM_SENSOR, "dp_bdg_irq_handler: IOCTL unknown command!");
+		break;
+	}
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long dp_bdg_irq_handler_dev_compat_ioctl(struct file *filp,
+		unsigned int cmd, unsigned long arg)
+{
+	return dp_bdg_irq_handler_dev_ioctl(filp, cmd,
+		(unsigned long)compat_ptr(arg));
+}
+#endif
+
+static const struct file_operations dp_bdg_irq_handler_dev_fops = {
+	.owner = THIS_MODULE,
+	.read = dp_bdg_irq_handler_dev_read,
+	.open = dp_bdg_irq_handler_dev_open,
+	.unlocked_ioctl = dp_bdg_irq_handler_dev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = dp_bdg_irq_handler_dev_compat_ioctl,
+#endif
+	.release = dp_bdg_irq_handler_dev_release,
+};
+
+static irqreturn_t dp_bdg_irq_handler(int irq, void *p)
+{
+	int rc = 0;
+
+	CAM_INFO(CAM_SENSOR, "dp hotplug happened");
+	rc = cam_dp_bdg_get_src_resolution(
+			&s_dp_bdg_res_info.have_dp_signal,
+			&s_dp_bdg_res_info.width,
+			&s_dp_bdg_res_info.height,
+			&s_dp_bdg_res_info.id);
+	if (!rc) {
+		CAM_INFO(CAM_SENSOR, "DP_BDG Input resolution = %d x %d",
+				s_dp_bdg_res_info.width,
+				s_dp_bdg_res_info.height);
+		is_irq_happen = true;
+		wake_up_all(&dp_bdg_read_wq);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Get resolution failed!");
+	}
+	return IRQ_HANDLED;
+}
+
+static int dp_bdg_irq_handler_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	dp_bdg_irq_gpio = of_get_named_gpio(pdev->dev.of_node,
+		"dp_bdg_irq_pin", 0);
+	ret = gpio_request(dp_bdg_irq_gpio, "dp_bdg_irq_pin");
+	if (ret) {
+		CAM_ERR(CAM_SENSOR, "Error! can't request irq pin %x", dp_bdg_irq_gpio);
+		ret = -EINVAL;
+		goto fail_exit;
+	}
+	dp_bdg_irq = gpio_to_irq(dp_bdg_irq_gpio);
+	ret = request_threaded_irq(dp_bdg_irq, NULL,
+			dp_bdg_irq_handler,
+			IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+			"dp_bdg_irq", NULL);
+	if (ret) {
+		CAM_ERR(CAM_SENSOR, "Failed to request irq");
+		ret = -EINVAL;
+		goto fail_exit;
+	}
+
+	dp_bdg_irq_handler_cdev = cdev_alloc();
+	if (!dp_bdg_irq_handler_cdev) {
+		ret = -ENOMEM;
+		goto fail_exit;
+	}
+	dp_bdg_irq_handler_cdev->ops = &dp_bdg_irq_handler_dev_fops;
+	dp_bdg_irq_handler_cdev->owner = THIS_MODULE;
+	ret = alloc_chrdev_region(&dp_bdg_irq_handler_dev, 0, 1,
+			DP_BDG_IRQ_HANDLER_DEVNAME);
+	if (ret) {
+		CAM_ERR(CAM_SENSOR, "alloc_chrdev_region failed with error code %d", ret);
+		goto fail_cdev_del;
+	}
+	ret = cdev_add(dp_bdg_irq_handler_cdev, dp_bdg_irq_handler_dev, 1);
+	if (ret)
+		goto fail_cdev_del;
+	dp_bdg_irq_handler_class = class_create(DP_BDG_IRQ_HANDLER_DEVNAME);
+	if (IS_ERR(dp_bdg_irq_handler_class)) {
+		ret = PTR_ERR(dp_bdg_irq_handler_class);
+		goto fail_cdev_del;
+	}
+	dp_bdg_irq_handler_device = device_create(dp_bdg_irq_handler_class,
+			NULL, dp_bdg_irq_handler_dev, NULL,
+			DP_BDG_IRQ_HANDLER_DEVNAME);
+	if (IS_ERR(dp_bdg_irq_handler_device)) {
+		ret = PTR_ERR(dp_bdg_irq_handler_device);
+		goto fail_class_destroy;
+	}
+	init_waitqueue_head(&dp_bdg_read_wq);
+	return 0;
+
+fail_class_destroy:
+	class_destroy(dp_bdg_irq_handler_class);
+fail_cdev_del:
+	cdev_del(dp_bdg_irq_handler_cdev);
+fail_exit:
+	return ret;
+}
+
+static int dp_bdg_irq_handler_remove(struct platform_device *pdev)
+{
+	gpio_free(dp_bdg_irq_gpio);
+	disable_irq(dp_bdg_irq);
+	wake_up_all(&dp_bdg_read_wq);
+
+	cdev_del(dp_bdg_irq_handler_cdev);
+	device_destroy(dp_bdg_irq_handler_class, dp_bdg_irq_handler_dev);
+	class_destroy(dp_bdg_irq_handler_class);
+	unregister_chrdev_region(dp_bdg_irq_handler_dev, 1);
+	return 0;
+}
+
+struct platform_driver dp_bdg_irq_handler_driver = {
+	.probe = dp_bdg_irq_handler_probe,
+	.remove = dp_bdg_irq_handler_remove,
+	.suspend = NULL,
+	.resume = NULL,
+	.driver = {
+		.name = DP_BDG_IRQ_HANDLER_DEVNAME,
+		.of_match_table = of_match_ptr(dp_bdg_irq_handler_dev_id),
+	},
+};
+
+int dp_bdg_irq_handler_init(void)
+{
+	return platform_driver_register(&dp_bdg_irq_handler_driver);
+}
+
+void dp_bdg_irq_handler_exit(void)
+{
+	platform_driver_unregister(&dp_bdg_irq_handler_driver);
+}
+
+MODULE_DESCRIPTION("dp driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
@@ -0,0 +1,1553 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/crc32.h>
+#include <media/cam_sensor.h>
+
+#include "cam_eeprom_core.h"
+#include "cam_eeprom_soc.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+
+#define MAX_READ_SIZE  0x7FFFF
+
+/**
+ * cam_eeprom_read_memory() - read map data into buffer
+ * @e_ctrl:     eeprom control struct
+ * @block:      block to be read
+ *
+ * This function iterates through blocks stored in block->map, reads each
+ * region and concatenate them into the pre-allocated block->mapdata
+ */
+static int cam_eeprom_read_memory(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_eeprom_memory_block_t *block)
+{
+	int                                rc = 0;
+	int                                j;
+	struct cam_sensor_i2c_reg_setting  i2c_reg_settings = {0};
+	struct cam_sensor_i2c_reg_array    i2c_reg_array = {0};
+	struct cam_eeprom_memory_map_t    *emap = block->map;
+	struct cam_eeprom_soc_private     *eb_info = NULL;
+	uint8_t                           *memptr = block->mapdata;
+
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "e_ctrl is NULL");
+		return -EINVAL;
+	}
+
+	eb_info = (struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+
+	for (j = 0; j < block->num_map; j++) {
+		CAM_DBG(CAM_EEPROM, "slave-addr = 0x%X", emap[j].saddr);
+		if (emap[j].saddr) {
+			eb_info->i2c_info.slave_addr = emap[j].saddr;
+			rc = cam_eeprom_update_i2c_info(e_ctrl,
+				&eb_info->i2c_info);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM,
+					"failed: to update i2c info rc %d",
+					rc);
+				return rc;
+			}
+		}
+
+		if (emap[j].page.valid_size) {
+			i2c_reg_settings.addr_type = emap[j].page.addr_type;
+			i2c_reg_settings.data_type = emap[j].page.data_type;
+			i2c_reg_settings.size = 1;
+			i2c_reg_array.reg_addr = emap[j].page.addr;
+			i2c_reg_array.reg_data = emap[j].page.data;
+			i2c_reg_array.delay = emap[j].page.delay;
+			i2c_reg_settings.reg_setting = &i2c_reg_array;
+			rc = camera_io_dev_write(&e_ctrl->io_master_info,
+				&i2c_reg_settings);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM, "page write failed rc %d",
+					rc);
+				return rc;
+			}
+		}
+
+		if (emap[j].pageen.valid_size) {
+			i2c_reg_settings.addr_type = emap[j].pageen.addr_type;
+			i2c_reg_settings.data_type = emap[j].pageen.data_type;
+			i2c_reg_settings.size = 1;
+			i2c_reg_array.reg_addr = emap[j].pageen.addr;
+			i2c_reg_array.reg_data = emap[j].pageen.data;
+			i2c_reg_array.delay = emap[j].pageen.delay;
+			i2c_reg_settings.reg_setting = &i2c_reg_array;
+			rc = camera_io_dev_write(&e_ctrl->io_master_info,
+				&i2c_reg_settings);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM, "page enable failed rc %d",
+					rc);
+				return rc;
+			}
+		}
+
+		if (emap[j].poll.valid_size) {
+			rc = camera_io_dev_poll(&e_ctrl->io_master_info,
+				emap[j].poll.addr, emap[j].poll.data,
+				0, emap[j].poll.addr_type,
+				emap[j].poll.data_type,
+				emap[j].poll.delay);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM, "poll failed rc %d",
+					rc);
+				return rc;
+			}
+		}
+
+		if (emap[j].mem.valid_size) {
+			rc = camera_io_dev_read_seq(&e_ctrl->io_master_info,
+				emap[j].mem.addr, memptr,
+				emap[j].mem.addr_type,
+				emap[j].mem.data_type,
+				emap[j].mem.valid_size);
+			if (rc < 0) {
+				CAM_ERR(CAM_EEPROM, "read failed rc %d",
+					rc);
+				return rc;
+			}
+			memptr += emap[j].mem.valid_size;
+		}
+
+		if (emap[j].pageen.valid_size) {
+			i2c_reg_settings.addr_type = emap[j].pageen.addr_type;
+			i2c_reg_settings.data_type = emap[j].pageen.data_type;
+			i2c_reg_settings.size = 1;
+			i2c_reg_array.reg_addr = emap[j].pageen.addr;
+			i2c_reg_array.reg_data = 0;
+			i2c_reg_array.delay = emap[j].pageen.delay;
+			i2c_reg_settings.reg_setting = &i2c_reg_array;
+			rc = camera_io_dev_write(&e_ctrl->io_master_info,
+				&i2c_reg_settings);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM,
+					"page disable failed rc %d",
+					rc);
+				return rc;
+			}
+		}
+	}
+	return rc;
+}
+
+/**
+ * cam_eeprom_power_up - Power up eeprom hardware
+ * @e_ctrl:     ctrl structure
+ * @power_info: power up/down info for eeprom
+ *
+ * Returns success or failure
+ */
+static int cam_eeprom_power_up(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int32_t                 rc = 0;
+	struct cam_hw_soc_info *soc_info =
+		&e_ctrl->soc_info;
+
+	/* Parse and fill vreg params for power up settings */
+	rc = msm_camera_fill_vreg_params(
+		&e_ctrl->soc_info,
+		power_info->power_setting,
+		power_info->power_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM,
+			"failed to fill power up vreg params rc:%d", rc);
+		return rc;
+	}
+
+	/* Parse and fill vreg params for power down settings*/
+	rc = msm_camera_fill_vreg_params(
+		&e_ctrl->soc_info,
+		power_info->power_down_setting,
+		power_info->power_down_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM,
+			"failed to fill power down vreg params  rc:%d", rc);
+		return rc;
+	}
+
+	power_info->dev = soc_info->dev;
+
+	rc = cam_sensor_core_power_up(power_info, soc_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed in eeprom power up rc %d", rc);
+		return rc;
+	}
+
+	if (e_ctrl->io_master_info.master_type == CCI_MASTER) {
+		rc = camera_io_init(&(e_ctrl->io_master_info));
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "cci_init failed");
+			goto cci_failure;
+		}
+	}
+	return rc;
+cci_failure:
+	if (cam_sensor_util_power_down(power_info, soc_info))
+		CAM_ERR(CAM_EEPROM, "Power down failure");
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_power_down - Power down eeprom hardware
+ * @e_ctrl:    ctrl structure
+ *
+ * Returns success or failure
+ */
+static int cam_eeprom_power_down(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	struct cam_sensor_power_ctrl_t *power_info;
+	struct cam_hw_soc_info         *soc_info;
+	struct cam_eeprom_soc_private  *soc_private;
+	int                             rc = 0;
+
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "failed: e_ctrl %pK", e_ctrl);
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+	soc_info = &e_ctrl->soc_info;
+
+	if (!power_info) {
+		CAM_ERR(CAM_EEPROM, "failed: power_info %pK", power_info);
+		return -EINVAL;
+	}
+	rc = cam_sensor_util_power_down(power_info, soc_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "power down the core is failed:%d", rc);
+		return rc;
+	}
+
+	if (e_ctrl->io_master_info.master_type == CCI_MASTER)
+		camera_io_release(&(e_ctrl->io_master_info));
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_match_id - match eeprom id
+ * @e_ctrl:     ctrl structure
+ *
+ * Returns success or failure
+ */
+static int cam_eeprom_match_id(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int                      rc;
+	struct camera_io_master *client = &e_ctrl->io_master_info;
+	uint8_t                  id[2];
+
+	rc = cam_spi_query_id(client, 0, CAMERA_SENSOR_I2C_TYPE_WORD,
+		&id[0], 2);
+	if (rc)
+		return rc;
+	CAM_DBG(CAM_EEPROM, "read 0x%x 0x%x, check 0x%x 0x%x",
+		id[0], id[1], client->spi_client->mfr_id0,
+		client->spi_client->device_id0);
+	if (id[0] != client->spi_client->mfr_id0
+		|| id[1] != client->spi_client->device_id0)
+		return -ENODEV;
+	return 0;
+}
+
+/**
+ * cam_eeprom_parse_read_memory_map - Parse memory map
+ * @of_node:    device node
+ * @e_ctrl:     ctrl structure
+ *
+ * Returns success or failure
+ */
+int32_t cam_eeprom_parse_read_memory_map(struct device_node *of_node,
+	struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int32_t                         rc = 0;
+	struct cam_eeprom_soc_private  *soc_private;
+	struct cam_sensor_power_ctrl_t *power_info;
+
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "failed: e_ctrl is NULL");
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	rc = cam_eeprom_parse_dt_memory_map(of_node, &e_ctrl->cal_data);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: eeprom dt parse rc %d", rc);
+		return rc;
+	}
+	rc = cam_eeprom_power_up(e_ctrl, power_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: eeprom power up rc %d", rc);
+		goto data_mem_free;
+	}
+
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_CONFIG;
+	if (e_ctrl->eeprom_device_type == MSM_CAMERA_SPI_DEVICE) {
+		rc = cam_eeprom_match_id(e_ctrl);
+		if (rc) {
+			CAM_DBG(CAM_EEPROM, "eeprom not matching %d", rc);
+			goto power_down;
+		}
+	}
+	rc = cam_eeprom_read_memory(e_ctrl, &e_ctrl->cal_data);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "read_eeprom_memory failed");
+		goto power_down;
+	}
+
+	rc = cam_eeprom_power_down(e_ctrl);
+	if (rc)
+		CAM_ERR(CAM_EEPROM, "failed: eeprom power down rc %d", rc);
+
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+	return rc;
+power_down:
+	cam_eeprom_power_down(e_ctrl);
+data_mem_free:
+	vfree(e_ctrl->cal_data.mapdata);
+	vfree(e_ctrl->cal_data.map);
+	e_ctrl->cal_data.num_data = 0;
+	e_ctrl->cal_data.num_map = 0;
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+	return rc;
+}
+
+/**
+ * cam_eeprom_get_dev_handle - get device handle
+ * @e_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_get_dev_handle(struct cam_eeprom_ctrl_t *e_ctrl,
+	void *arg)
+{
+	struct cam_sensor_acquire_dev    eeprom_acq_dev;
+	struct cam_create_dev_hdl        bridge_params;
+	struct cam_control              *cmd = (struct cam_control *)arg;
+
+	if (e_ctrl->bridge_intf.device_hdl != -1) {
+		CAM_ERR(CAM_EEPROM, "Device is already acquired");
+		return -EFAULT;
+	}
+	if (copy_from_user(&eeprom_acq_dev,
+		u64_to_user_ptr(cmd->handle),
+		sizeof(eeprom_acq_dev))) {
+		CAM_ERR(CAM_EEPROM,
+			"EEPROM:ACQUIRE_DEV: copy from user failed");
+		return -EFAULT;
+	}
+
+	bridge_params.session_hdl = eeprom_acq_dev.session_handle;
+	bridge_params.ops = &e_ctrl->bridge_intf.ops;
+	bridge_params.v4l2_sub_dev_flag = 0;
+	bridge_params.media_entity_flag = 0;
+	bridge_params.priv = e_ctrl;
+	bridge_params.dev_id = CAM_EEPROM;
+
+	eeprom_acq_dev.device_handle =
+		cam_create_device_hdl(&bridge_params);
+	if (eeprom_acq_dev.device_handle <= 0) {
+		CAM_ERR(CAM_EEPROM, "Can not create device handle");
+		return -EFAULT;
+	}
+	e_ctrl->bridge_intf.device_hdl = eeprom_acq_dev.device_handle;
+	e_ctrl->bridge_intf.session_hdl = eeprom_acq_dev.session_handle;
+
+	CAM_DBG(CAM_EEPROM, "Device Handle: %d", eeprom_acq_dev.device_handle);
+	if (copy_to_user(u64_to_user_ptr(cmd->handle),
+		&eeprom_acq_dev, sizeof(struct cam_sensor_acquire_dev))) {
+		CAM_ERR(CAM_EEPROM, "EEPROM:ACQUIRE_DEV: copy to user failed");
+		return -EFAULT;
+	}
+	return 0;
+}
+
+/**
+ * cam_eeprom_update_slaveInfo - Update slave info
+ * @e_ctrl:     ctrl structure
+ * @cmd_buf:    command buffer
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_update_slaveInfo(struct cam_eeprom_ctrl_t *e_ctrl,
+	void *cmd_buf)
+{
+	int32_t                         rc = 0;
+	struct cam_eeprom_soc_private  *soc_private;
+	struct cam_cmd_i2c_info        *cmd_i2c_info = NULL;
+
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	cmd_i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+	soc_private->i2c_info.slave_addr = cmd_i2c_info->slave_addr;
+	soc_private->i2c_info.i2c_freq_mode = cmd_i2c_info->i2c_freq_mode;
+
+	rc = cam_eeprom_update_i2c_info(e_ctrl,
+		&soc_private->i2c_info);
+	CAM_DBG(CAM_EEPROM, "Slave addr: 0x%x Freq Mode: %d",
+		soc_private->i2c_info.slave_addr,
+		soc_private->i2c_info.i2c_freq_mode);
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_parse_memory_map - Parse memory map info
+ * @data:             memory block data
+ * @cmd_buf:          command buffer
+ * @cmd_length:       command buffer length
+ * @num_map:          memory map size
+ * @cmd_length_bytes: command length processed in this function
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_parse_memory_map(
+	struct cam_eeprom_memory_block_t *data,
+	void *cmd_buf, int cmd_length, uint32_t *cmd_length_bytes,
+	int *num_map, size_t remain_buf_len)
+{
+	int32_t                            rc = 0;
+	int32_t                            cnt = 0;
+	int32_t                            processed_size = 0;
+	int32_t                            payload_count;
+	uint8_t                            generic_op_code;
+	struct cam_eeprom_memory_map_t    *map = data->map;
+	struct common_header              *cmm_hdr =
+		(struct common_header *)cmd_buf;
+	uint16_t                           cmd_length_in_bytes = 0;
+	struct cam_cmd_i2c_random_wr      *i2c_random_wr = NULL;
+	struct cam_cmd_i2c_continuous_rd  *i2c_cont_rd = NULL;
+	struct cam_cmd_conditional_wait   *i2c_poll = NULL;
+	struct cam_cmd_unconditional_wait *i2c_uncond_wait = NULL;
+	size_t                             validate_size = 0;
+
+	generic_op_code = cmm_hdr->fifth_byte;
+
+	if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR)
+		validate_size = sizeof(struct cam_cmd_i2c_random_wr);
+	else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD)
+		validate_size = sizeof(struct cam_cmd_i2c_continuous_rd);
+	else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)
+		validate_size = sizeof(struct cam_cmd_unconditional_wait);
+
+	if (remain_buf_len < validate_size ||
+	    *num_map >= (MSM_EEPROM_MAX_MEM_MAP_CNT *
+		MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) {
+		CAM_ERR(CAM_EEPROM, "not enough buffer");
+		return -EINVAL;
+	}
+	switch (cmm_hdr->cmd_type) {
+	case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR:
+		i2c_random_wr = (struct cam_cmd_i2c_random_wr *)cmd_buf;
+		payload_count = i2c_random_wr->header.count;
+
+		if (payload_count == 0 ||
+		    payload_count >= MSM_EEPROM_MAX_MEM_MAP_CNT ||
+		    (size_t)*num_map >= ((MSM_EEPROM_MAX_MEM_MAP_CNT *
+				MSM_EEPROM_MEMORY_MAP_MAX_SIZE) -
+				payload_count)) {
+			CAM_ERR(CAM_EEPROM, "OOB Error");
+			return -EINVAL;
+		}
+		cmd_length_in_bytes   = sizeof(struct cam_cmd_i2c_random_wr) +
+			((payload_count - 1) *
+			sizeof(struct i2c_random_wr_payload));
+
+		if (cmd_length_in_bytes > remain_buf_len) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer remaining");
+			return -EINVAL;
+		}
+		for (cnt = 0; cnt < (payload_count);
+			cnt++) {
+			map[*num_map + cnt].page.addr =
+				i2c_random_wr->random_wr_payload_flex[cnt].reg_addr;
+			map[*num_map + cnt].page.addr_type =
+				i2c_random_wr->header.addr_type;
+			map[*num_map + cnt].page.data =
+				i2c_random_wr->random_wr_payload_flex[cnt].reg_data;
+			map[*num_map + cnt].page.data_type =
+				i2c_random_wr->header.data_type;
+			map[*num_map + cnt].page.valid_size = 1;
+		}
+
+		*num_map += (payload_count - 1);
+		cmd_buf += cmd_length_in_bytes / sizeof(int32_t);
+		processed_size +=
+			cmd_length_in_bytes;
+		break;
+	case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD:
+		i2c_cont_rd = (struct cam_cmd_i2c_continuous_rd *)cmd_buf;
+		cmd_length_in_bytes = sizeof(struct cam_cmd_i2c_continuous_rd);
+		payload_count = i2c_cont_rd->header.count;
+
+		if (payload_count >= U32_MAX - data->num_data) {
+			CAM_ERR(CAM_EEPROM,
+				"int overflow on eeprom memory block");
+			return -EINVAL;
+		}
+		map[*num_map].mem.addr = i2c_cont_rd->reg_addr;
+		map[*num_map].mem.addr_type = i2c_cont_rd->header.addr_type;
+		map[*num_map].mem.data_type = i2c_cont_rd->header.data_type;
+		map[*num_map].mem.valid_size =
+			payload_count;
+		cmd_buf += cmd_length_in_bytes / sizeof(int32_t);
+		processed_size +=
+			cmd_length_in_bytes;
+		data->num_data += map[*num_map].mem.valid_size;
+		break;
+	case CAMERA_SENSOR_CMD_TYPE_WAIT:
+		if (generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_HW_UCND ||
+			generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_SW_UCND) {
+			i2c_uncond_wait =
+				(struct cam_cmd_unconditional_wait *)cmd_buf;
+			cmd_length_in_bytes =
+				sizeof(struct cam_cmd_unconditional_wait);
+
+			if (*num_map < 1) {
+				CAM_ERR(CAM_EEPROM,
+					"invalid map number, num_map=%d",
+					*num_map);
+				return -EINVAL;
+			}
+
+			/*
+			 * Though delay is added all of them, but delay will
+			 * be applicable to only one of them as only one of
+			 * them will have valid_size set to >= 1.
+			 */
+			map[*num_map - 1].mem.delay = i2c_uncond_wait->delay;
+			map[*num_map - 1].page.delay = i2c_uncond_wait->delay;
+			map[*num_map - 1].pageen.delay = i2c_uncond_wait->delay;
+		} else if (generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_COND) {
+			i2c_poll = (struct cam_cmd_conditional_wait *)cmd_buf;
+			cmd_length_in_bytes =
+				sizeof(struct cam_cmd_conditional_wait);
+
+			map[*num_map].poll.addr = i2c_poll->reg_addr;
+			map[*num_map].poll.addr_type = i2c_poll->addr_type;
+			map[*num_map].poll.data = i2c_poll->reg_data;
+			map[*num_map].poll.data_type = i2c_poll->data_type;
+			map[*num_map].poll.delay = i2c_poll->timeout;
+			map[*num_map].poll.valid_size = 1;
+		}
+		cmd_buf += cmd_length_in_bytes / sizeof(int32_t);
+		processed_size +=
+			cmd_length_in_bytes;
+		break;
+	default:
+		break;
+	}
+
+	*cmd_length_bytes = processed_size;
+	return rc;
+}
+
+static struct i2c_settings_list*
+	cam_eeprom_get_i2c_ptr(struct i2c_settings_array *i2c_reg_settings,
+		uint32_t size)
+{
+	struct i2c_settings_list *tmp;
+
+	tmp = kzalloc(sizeof(struct i2c_settings_list), GFP_KERNEL);
+
+	if (tmp != NULL)
+		list_add_tail(&(tmp->list),
+			&(i2c_reg_settings->list_head));
+	else
+		return NULL;
+
+	tmp->seq_settings.reg_data =
+		kcalloc(size, sizeof(uint8_t), GFP_KERNEL);
+	if (tmp->seq_settings.reg_data == NULL) {
+		list_del(&(tmp->list));
+		kfree(tmp);
+		tmp = NULL;
+		return NULL;
+	}
+	tmp->seq_settings.size = size;
+
+	return tmp;
+}
+
+static int32_t cam_eeprom_handle_continuous_write(
+	struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_cmd_i2c_continuous_wr *cam_cmd_i2c_continuous_wr,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0, cnt = 0;
+
+
+	CAM_DBG(CAM_EEPROM, "Total Size: %d",
+		cam_cmd_i2c_continuous_wr->header.count);
+
+	i2c_list = cam_eeprom_get_i2c_ptr(i2c_reg_settings,
+		cam_cmd_i2c_continuous_wr->header.count);
+	if (i2c_list == NULL ||
+		i2c_list->seq_settings.reg_data == NULL) {
+		CAM_ERR(CAM_SENSOR, "Failed in allocating i2c_list");
+		return -ENOMEM;
+	}
+
+	*cmd_length_in_bytes = (sizeof(struct i2c_rdwr_header) +
+		sizeof(cam_cmd_i2c_continuous_wr->reg_addr) +
+		sizeof(struct cam_cmd_read) *
+		(cam_cmd_i2c_continuous_wr->header.count));
+	if (cam_cmd_i2c_continuous_wr->header.op_code ==
+		CAMERA_SENSOR_I2C_OP_CONT_WR_BRST)
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_BURST;
+	else if (cam_cmd_i2c_continuous_wr->header.op_code ==
+		CAMERA_SENSOR_I2C_OP_CONT_WR_SEQN)
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_SEQ;
+	else {
+		rc = -EINVAL;
+		goto deallocate_i2c_list;
+	}
+
+	i2c_list->seq_settings.addr_type =
+		cam_cmd_i2c_continuous_wr->header.addr_type;
+
+	CAM_ERR(CAM_EEPROM, "Write Address: 0x%x",
+		cam_cmd_i2c_continuous_wr->reg_addr);
+	if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_SEQ) {
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_RANDOM;
+		e_ctrl->eebin_info.start_address =
+			cam_cmd_i2c_continuous_wr->reg_addr;
+		e_ctrl->eebin_info.size =
+			cam_cmd_i2c_continuous_wr->header.count;
+		CAM_DBG(CAM_EEPROM, "Header Count: %d",
+			cam_cmd_i2c_continuous_wr->header.count);
+		e_ctrl->eebin_info.is_valid = 1;
+
+		i2c_list->seq_settings.reg_addr =
+			cam_cmd_i2c_continuous_wr->reg_addr;
+	} else
+		CAM_ERR(CAM_EEPROM, "Burst Mode Not Supported\n");
+
+	(*offset) += cnt;
+	*list = &(i2c_list->list);
+	return rc;
+deallocate_i2c_list:
+	kfree(i2c_list);
+	return rc;
+}
+
+static int32_t cam_eeprom_handle_delay(
+	uint32_t **cmd_buf,
+	uint16_t generic_op_code,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t offset, uint32_t *byte_cnt,
+	struct list_head *list_ptr,
+	size_t remain_buf_len)
+{
+	int32_t rc = 0;
+	struct i2c_settings_list *i2c_list = NULL;
+	struct cam_cmd_unconditional_wait *cmd_uncond_wait =
+		(struct cam_cmd_unconditional_wait *) *cmd_buf;
+
+	if (remain_buf_len < (sizeof(struct cam_cmd_unconditional_wait))) {
+		CAM_ERR(CAM_EEPROM, "Not Enough buffer");
+		return -EINVAL;
+	}
+
+	if (list_ptr == NULL) {
+		CAM_ERR(CAM_SENSOR, "Invalid list ptr");
+		return -EINVAL;
+	}
+
+	if (offset > 0) {
+		i2c_list =
+			list_entry(list_ptr, struct i2c_settings_list, list);
+		if (generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_HW_UCND)
+			i2c_list->i2c_settings.reg_setting[offset - 1].delay =
+				cmd_uncond_wait->delay;
+		else
+			i2c_list->i2c_settings.delay =
+				cmd_uncond_wait->delay;
+		(*cmd_buf) +=
+			sizeof(
+			struct cam_cmd_unconditional_wait) / sizeof(uint32_t);
+		(*byte_cnt) +=
+			sizeof(
+			struct cam_cmd_unconditional_wait);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Delay Rxed before any buffer: %d", offset);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_parse_write_memory_packet - Write eeprom packet
+ * @csl_packet:   csl packet received
+ * @e_ctrl:       ctrl structure
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_parse_write_memory_packet(
+	struct cam_packet *csl_packet,
+	struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	struct cam_cmd_buf_desc        *cmd_desc = NULL;
+	uint32_t                       *offset = NULL;
+	int32_t                         i, rc = 0;
+	uint32_t                       *cmd_buf = NULL;
+	uintptr_t                       generic_pkt_addr;
+	size_t                          pkt_len = 0;
+	size_t                          remain_len = 0;
+	uint32_t                        total_cmd_buf_in_bytes = 0;
+	uint32_t                        processed_cmd_buf_in_bytes = 0;
+	struct common_header           *cmm_hdr = NULL;
+	uint32_t                        cmd_length_in_bytes = 0;
+	struct cam_cmd_i2c_info        *i2c_info = NULL;
+
+
+	offset = (uint32_t *)&csl_packet->payload_flex;
+	offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+	cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+	CAM_DBG(CAM_EEPROM, "Number of Command Buffers: %d",
+		csl_packet->num_cmd_buf);
+	for (i = 0; i < csl_packet->num_cmd_buf; i++) {
+		struct list_head               *list = NULL;
+		uint16_t                       generic_op_code;
+		uint32_t                       off = 0;
+		int                            master;
+		struct cam_sensor_cci_client   *cci;
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		total_cmd_buf_in_bytes = cmd_desc[i].length;
+		processed_cmd_buf_in_bytes = 0;
+
+		if (!total_cmd_buf_in_bytes)
+			continue;
+
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&generic_pkt_addr, &pkt_len);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "Failed to get cpu buf");
+			return rc;
+		}
+
+		cmd_buf = (uint32_t *)generic_pkt_addr;
+		if (!cmd_buf) {
+			CAM_ERR(CAM_EEPROM, "invalid cmd buf");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if ((pkt_len < sizeof(struct common_header) ||
+			(cmd_desc[i].offset) > (pkt_len -
+			sizeof(struct common_header)))) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		remain_len = pkt_len - cmd_desc[i].offset;
+		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+
+		if (total_cmd_buf_in_bytes > remain_len) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer for command");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		master = e_ctrl->io_master_info.master_type;
+		cci = e_ctrl->io_master_info.cci_client;
+		while (processed_cmd_buf_in_bytes < total_cmd_buf_in_bytes) {
+			if ((remain_len - processed_cmd_buf_in_bytes) <
+				sizeof(struct common_header)) {
+				CAM_ERR(CAM_EEPROM, "Not Enough buffer");
+				rc = -EINVAL;
+				goto end;
+			}
+			cmm_hdr = (struct common_header *)cmd_buf;
+			generic_op_code = cmm_hdr->fifth_byte;
+
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+				if ((remain_len - processed_cmd_buf_in_bytes) <
+					sizeof(struct cam_cmd_i2c_info)) {
+					CAM_ERR(CAM_EEPROM, "Not enough buf");
+					rc = -EINVAL;
+					goto end;
+				}
+				if (master == CCI_MASTER) {
+					cci->cci_i2c_master =
+						e_ctrl->cci_i2c_master;
+					cci->i2c_freq_mode =
+						i2c_info->i2c_freq_mode;
+					cci->sid =
+						i2c_info->slave_addr >> 1;
+					CAM_DBG(CAM_EEPROM,
+						"Slave addr: 0x%x Freq Mode: %d",
+						i2c_info->slave_addr,
+						i2c_info->i2c_freq_mode);
+				} else if (master == I2C_MASTER) {
+					e_ctrl->io_master_info.client->addr =
+						i2c_info->slave_addr;
+					CAM_DBG(CAM_EEPROM,
+						"Slave addr: 0x%x",
+						i2c_info->slave_addr);
+				} else if (master == SPI_MASTER) {
+					CAM_ERR(CAM_EEPROM,
+						"No Need of Slave Info");
+				} else {
+					CAM_ERR(CAM_EEPROM,
+						"Invalid Master type: %d",
+						master);
+					rc = -EINVAL;
+					goto end;
+				}
+				cmd_length_in_bytes =
+					sizeof(struct cam_cmd_i2c_info);
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/4;
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_WR: {
+				struct cam_cmd_i2c_continuous_wr
+					*cam_cmd_i2c_continuous_wr =
+					(struct cam_cmd_i2c_continuous_wr *)
+					cmd_buf;
+				if ((remain_len - processed_cmd_buf_in_bytes) <
+				sizeof(struct cam_cmd_i2c_continuous_wr)) {
+					CAM_ERR(CAM_EEPROM, "Not enough buf");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				CAM_DBG(CAM_EEPROM,
+					"CAMERA_SENSOR_CMD_TYPE_I2C_CONT_WR");
+				rc = cam_eeprom_handle_continuous_write(
+					e_ctrl,
+					cam_cmd_i2c_continuous_wr,
+					&(e_ctrl->wr_settings),
+					&cmd_length_in_bytes, &off, &list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+					"Failed in continuous write %d", rc);
+					goto end;
+				}
+
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_WAIT: {
+				CAM_DBG(CAM_EEPROM,
+					"CAMERA_SENSOR_CMD_TYPE_WAIT");
+				if (generic_op_code ==
+					CAMERA_SENSOR_WAIT_OP_HW_UCND ||
+					generic_op_code ==
+						CAMERA_SENSOR_WAIT_OP_SW_UCND) {
+
+					rc = cam_eeprom_handle_delay(
+						&cmd_buf, generic_op_code,
+						&(e_ctrl->wr_settings), off,
+						&cmd_length_in_bytes,
+						list, (remain_len -
+						processed_cmd_buf_in_bytes));
+					if (rc < 0) {
+						CAM_ERR(CAM_EEPROM,
+							"delay hdl failed: %d",
+							rc);
+						goto end;
+					}
+					processed_cmd_buf_in_bytes +=
+						cmd_length_in_bytes;
+					cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				} else {
+					CAM_ERR(CAM_EEPROM,
+						"Wrong Wait Command: %d",
+						generic_op_code);
+					rc = -EINVAL;
+					goto end;
+				}
+				break;
+			}
+			default:
+				CAM_ERR(CAM_EEPROM,
+					"Invalid Cmd_type rxed: %d\n",
+					cmm_hdr->cmd_type);
+				rc = -EINVAL;
+				break;
+			}
+		}
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+	return rc;
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	return rc;
+}
+
+/**
+ * cam_eeprom_init_pkt_parser - Parse eeprom packet
+ * @e_ctrl:       ctrl structure
+ * @csl_packet:	  csl packet received
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_packet *csl_packet)
+{
+	int32_t                         rc = 0;
+	int                             i = 0;
+	struct cam_cmd_buf_desc        *cmd_desc = NULL;
+	uint32_t                       *offset = NULL;
+	uint32_t                       *cmd_buf = NULL;
+	uintptr_t                        generic_pkt_addr;
+	size_t                          pkt_len = 0;
+	size_t                          remain_len = 0;
+	uint32_t                        total_cmd_buf_in_bytes = 0;
+	uint32_t                        processed_cmd_buf_in_bytes = 0;
+	struct common_header           *cmm_hdr = NULL;
+	uint32_t                        cmd_length_in_bytes = 0;
+	struct cam_cmd_i2c_info        *i2c_info = NULL;
+	int                             num_map = -1;
+	struct cam_eeprom_memory_map_t *map = NULL;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+
+	e_ctrl->cal_data.map = vzalloc((MSM_EEPROM_MEMORY_MAP_MAX_SIZE *
+		MSM_EEPROM_MAX_MEM_MAP_CNT) *
+		(sizeof(struct cam_eeprom_memory_map_t)));
+	if (!e_ctrl->cal_data.map) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_EEPROM, "failed");
+		return rc;
+	}
+	map = e_ctrl->cal_data.map;
+
+	offset = (uint32_t *)&csl_packet->payload_flex;
+	offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+	cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+	/* Loop through multiple command buffers */
+	for (i = 0; i < csl_packet->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		total_cmd_buf_in_bytes = cmd_desc[i].length;
+		processed_cmd_buf_in_bytes = 0;
+		if (!total_cmd_buf_in_bytes)
+			continue;
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&generic_pkt_addr, &pkt_len);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "Failed to get cpu buf");
+			return rc;
+		}
+		cmd_buf = (uint32_t *)generic_pkt_addr;
+		if (!cmd_buf) {
+			CAM_ERR(CAM_EEPROM, "invalid cmd buf");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if ((pkt_len < sizeof(struct common_header)) ||
+			(cmd_desc[i].offset > (pkt_len -
+			sizeof(struct common_header)))) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer");
+			rc = -EINVAL;
+			goto end;
+		}
+		remain_len = pkt_len - cmd_desc[i].offset;
+		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+
+		if (total_cmd_buf_in_bytes > remain_len) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer for command");
+			rc = -EINVAL;
+			goto end;
+		}
+		/* Loop through multiple cmd formats in one cmd buffer */
+		while (processed_cmd_buf_in_bytes < total_cmd_buf_in_bytes) {
+			if ((remain_len - processed_cmd_buf_in_bytes) <
+				sizeof(struct common_header)) {
+				CAM_ERR(CAM_EEPROM, "Not enough buf");
+				rc = -EINVAL;
+				goto end;
+			}
+			cmm_hdr = (struct common_header *)cmd_buf;
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+				if ((remain_len - processed_cmd_buf_in_bytes) <
+					sizeof(struct cam_cmd_i2c_info)) {
+					CAM_ERR(CAM_EEPROM, "Not enough buf");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				if ((num_map + 1) >= (MSM_EEPROM_MAX_MEM_MAP_CNT *
+						MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) {
+					CAM_ERR(CAM_EEPROM, "OOB map read error");
+					rc = -EINVAL;
+					goto end;
+				}
+				/* Configure the following map slave address */
+
+				map[num_map + 1].saddr = i2c_info->slave_addr;
+				rc = cam_eeprom_update_slaveInfo(e_ctrl,
+					cmd_buf);
+				cmd_length_in_bytes =
+					sizeof(struct cam_cmd_i2c_info);
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/
+					sizeof(uint32_t);
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
+			case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
+				cmd_length_in_bytes = total_cmd_buf_in_bytes;
+				rc = cam_sensor_update_power_settings(cmd_buf,
+					cmd_length_in_bytes, power_info,
+					(remain_len -
+					processed_cmd_buf_in_bytes));
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/
+					sizeof(uint32_t);
+				if (rc) {
+					CAM_ERR(CAM_EEPROM, "Failed");
+					goto end;
+				}
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR:
+			case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD:
+			case CAMERA_SENSOR_CMD_TYPE_WAIT:
+				num_map++;
+				rc = cam_eeprom_parse_memory_map(
+					&e_ctrl->cal_data, cmd_buf,
+					total_cmd_buf_in_bytes,
+					&cmd_length_in_bytes, &num_map,
+					(remain_len -
+					processed_cmd_buf_in_bytes));
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/sizeof(uint32_t);
+				break;
+			default:
+				CAM_ERR(CAM_EEPROM, "Invalid cmd_type 0x%x",
+					cmm_hdr->cmd_type);
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+		e_ctrl->cal_data.num_map = num_map + 1;
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+	return rc;
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	return rc;
+}
+
+/**
+ * cam_eeprom_get_cal_data - parse the userspace IO config and
+ *                                        copy read data to share with userspace
+ * @e_ctrl:     ctrl structure
+ * @csl_packet: csl packet received
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_packet *csl_packet)
+{
+	struct cam_buf_io_cfg *io_cfg;
+	uint32_t              i = 0;
+	size_t                plane_offset;
+	int32_t               mem_handle;
+	int                   rc = 0;
+	uintptr_t              buf_addr;
+	size_t                buf_size;
+	uint8_t               *read_buffer;
+	size_t                remain_len = 0;
+
+	io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+		&csl_packet->payload_flex +
+		csl_packet->io_configs_offset);
+	plane_offset = io_cfg->offsets[0];
+	mem_handle   = io_cfg->mem_handle[0];
+
+	CAM_DBG(CAM_EEPROM, "number of IO configs: %d:",
+		csl_packet->num_io_configs);
+
+	for (i = 0; i < csl_packet->num_io_configs; i++) {
+		CAM_DBG(CAM_EEPROM, "Direction: %d:", io_cfg->direction);
+		if (io_cfg->direction == CAM_BUF_OUTPUT) {
+			rc = cam_mem_get_cpu_buf(mem_handle,
+				&buf_addr, &buf_size);
+			if (rc) {
+				CAM_ERR(CAM_EEPROM, "Fail in get buffer: %d",
+					rc);
+				return rc;
+			}
+			if (buf_size <= plane_offset) {
+				CAM_ERR(CAM_EEPROM, "Not enough buffer");
+				cam_mem_put_cpu_buf(mem_handle);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			remain_len = buf_size - plane_offset;
+			CAM_DBG(CAM_EEPROM, "buf_addr : %pK, buf_size : %zu\n",
+				(void *)buf_addr, buf_size);
+
+			read_buffer = (uint8_t *)buf_addr;
+			if (!read_buffer) {
+				CAM_ERR(CAM_EEPROM,
+					"invalid buffer to copy data");
+				cam_mem_put_cpu_buf(mem_handle);
+				rc = -EINVAL;
+				return rc;
+			}
+			read_buffer += plane_offset;
+
+			if (remain_len < e_ctrl->cal_data.num_data) {
+				CAM_ERR(CAM_EEPROM,
+					"failed to copy, Invalid size");
+				cam_mem_put_cpu_buf(mem_handle);
+				rc = -EINVAL;
+				return rc;
+			}
+
+			CAM_DBG(CAM_EEPROM, "copy the data, len:%d",
+				e_ctrl->cal_data.num_data);
+			memcpy(read_buffer, e_ctrl->cal_data.mapdata,
+					e_ctrl->cal_data.num_data);
+			cam_mem_put_cpu_buf(mem_handle);
+		} else {
+			CAM_ERR(CAM_EEPROM, "Invalid direction");
+			rc = -EINVAL;
+		}
+	}
+
+	return rc;
+}
+
+static int32_t delete_eeprom_request(struct i2c_settings_array *i2c_array)
+{
+	struct i2c_settings_list *i2c_list = NULL, *i2c_next = NULL;
+	int32_t rc = 0;
+
+	if (i2c_array == NULL) {
+		CAM_ERR(CAM_SENSOR, "FATAL:: Invalid argument");
+		return -EINVAL;
+	}
+
+	list_for_each_entry_safe(i2c_list, i2c_next,
+		&(i2c_array->list_head), list) {
+		kfree(i2c_list->seq_settings.reg_data);
+		list_del(&(i2c_list->list));
+		kfree(i2c_list);
+	}
+	INIT_LIST_HEAD(&(i2c_array->list_head));
+	i2c_array->is_settings_valid = 0;
+
+	return rc;
+}
+
+/**
+ * cam_eeprom_write - Write Packet
+ * @e_ctrl:     ctrl structure
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_write(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int32_t rc = 0;
+	struct i2c_settings_array *i2c_set = NULL;
+	struct i2c_settings_list *i2c_list = NULL;
+
+	i2c_set = &e_ctrl->wr_settings;
+
+	if (i2c_set->is_settings_valid == 1) {
+		list_for_each_entry(i2c_list,
+			&(i2c_set->list_head), list) {
+			rc = camera_io_dev_write_continuous(
+				&e_ctrl->io_master_info,
+				&i2c_list->i2c_settings, 1);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM,
+				"Error in EEPROM write");
+			goto del_req;
+		}
+		}
+	}
+
+del_req:
+	delete_eeprom_request(i2c_set);
+	return rc;
+}
+
+/**
+ * cam_eeprom_pkt_parse - Parse csl packet
+ * @e_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
+{
+	int32_t                         rc = 0;
+	struct cam_control             *ioctl_ctrl = NULL;
+	struct cam_config_dev_cmd       dev_config;
+	uintptr_t                        generic_pkt_addr;
+	size_t                          pkt_len;
+	size_t                          remain_len = 0;
+	struct cam_packet              *csl_packet = NULL;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+
+	ioctl_ctrl = (struct cam_control *)arg;
+
+	if (copy_from_user(&dev_config,
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(dev_config)))
+		return -EFAULT;
+	rc = cam_mem_get_cpu_buf(dev_config.packet_handle,
+		&generic_pkt_addr, &pkt_len);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM,
+			"error in converting command Handle Error: %d", rc);
+		return rc;
+	}
+
+	remain_len = pkt_len;
+	if ((sizeof(struct cam_packet) > pkt_len) ||
+		((size_t)dev_config.offset >= pkt_len -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_EEPROM,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), pkt_len);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	remain_len -= (size_t)dev_config.offset;
+	csl_packet = (struct cam_packet *)
+		(generic_pkt_addr + (uint32_t)dev_config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_EEPROM, "Invalid packet params");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_EEPROM_PACKET_OPCODE_INIT:
+		if (e_ctrl->userspace_probe == false) {
+			rc = cam_eeprom_parse_read_memory_map(
+					e_ctrl->soc_info.dev->of_node, e_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
+				return rc;
+			}
+			rc = cam_eeprom_get_cal_data(e_ctrl, csl_packet);
+			vfree(e_ctrl->cal_data.mapdata);
+			vfree(e_ctrl->cal_data.map);
+			e_ctrl->cal_data.num_data = 0;
+			e_ctrl->cal_data.num_map = 0;
+			CAM_DBG(CAM_EEPROM,
+				"Returning the data using kernel probe");
+			break;
+		}
+		rc = cam_eeprom_init_pkt_parser(e_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM,
+				"Failed in parsing the pkt");
+			return rc;
+		}
+
+		e_ctrl->cal_data.mapdata =
+			vzalloc(e_ctrl->cal_data.num_data);
+		if (!e_ctrl->cal_data.mapdata) {
+			rc = -ENOMEM;
+			CAM_ERR(CAM_EEPROM, "failed");
+			goto error;
+		}
+
+		if (e_ctrl->eeprom_device_type == MSM_CAMERA_SPI_DEVICE) {
+			rc = cam_eeprom_match_id(e_ctrl);
+			if (rc) {
+				CAM_DBG(CAM_EEPROM,
+					"eeprom not matching %d", rc);
+				goto memdata_free;
+			}
+		}
+
+		rc = cam_eeprom_power_up(e_ctrl,
+			&soc_private->power_info);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "failed rc %d", rc);
+			goto memdata_free;
+		}
+
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_CONFIG;
+		rc = cam_eeprom_read_memory(e_ctrl, &e_ctrl->cal_data);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM,
+				"read_eeprom_memory failed");
+			goto power_down;
+		}
+
+		rc = cam_eeprom_get_cal_data(e_ctrl, csl_packet);
+		rc = cam_eeprom_power_down(e_ctrl);
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+		vfree(e_ctrl->cal_data.mapdata);
+		vfree(e_ctrl->cal_data.map);
+		kfree(power_info->power_setting);
+		kfree(power_info->power_down_setting);
+		power_info->power_setting = NULL;
+		power_info->power_down_setting = NULL;
+		power_info->power_setting_size = 0;
+		power_info->power_down_setting_size = 0;
+		e_ctrl->cal_data.num_data = 0;
+		e_ctrl->cal_data.num_map = 0;
+		break;
+	case CAM_EEPROM_WRITE: {
+		struct i2c_settings_array *i2c_reg_settings =
+			&e_ctrl->wr_settings;
+
+		i2c_reg_settings->is_settings_valid = 1;
+		rc = cam_eeprom_parse_write_memory_packet(
+			csl_packet, e_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
+			return rc;
+		}
+
+		rc = cam_eeprom_power_up(e_ctrl,
+			&soc_private->power_info);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "failed power up rc %d", rc);
+			goto memdata_free;
+		}
+
+		usleep_range(10*1000, 11*1000);
+		CAM_DBG(CAM_EEPROM,
+			"Calling Erase : %d start Address: 0x%x size: %d",
+			rc, e_ctrl->eebin_info.start_address,
+			e_ctrl->eebin_info.size);
+
+		rc = camera_io_dev_erase(&e_ctrl->io_master_info,
+			e_ctrl->eebin_info.start_address,
+			e_ctrl->eebin_info.size);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "Failed in erase : %d", rc);
+			return rc;
+		}
+
+		/* Buffer time margin */
+		usleep_range(10*1000, 11*1000);
+
+		rc = cam_eeprom_write(e_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
+			return rc;
+		}
+
+		rc = cam_eeprom_power_down(e_ctrl);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "failed power down rc %d", rc);
+			goto memdata_free;
+		}
+
+		break;
+	}
+	default:
+		CAM_ERR(CAM_EEPROM, "Invalid op-code 0x%x",
+			csl_packet->header.op_code & 0xFFFFFF);
+		rc = -EINVAL;
+		break;
+	}
+
+	cam_mem_put_cpu_buf(dev_config.packet_handle);
+	return rc;
+power_down:
+	cam_eeprom_power_down(e_ctrl);
+memdata_free:
+	vfree(e_ctrl->cal_data.mapdata);
+error:
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	vfree(e_ctrl->cal_data.map);
+	e_ctrl->cal_data.num_data = 0;
+	e_ctrl->cal_data.num_map = 0;
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+	return rc;
+}
+
+void cam_eeprom_shutdown(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int rc;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+
+	if (e_ctrl->cam_eeprom_state == CAM_EEPROM_INIT)
+		return;
+
+	if (e_ctrl->cam_eeprom_state == CAM_EEPROM_CONFIG) {
+		rc = cam_eeprom_power_down(e_ctrl);
+		if (rc < 0)
+			CAM_ERR(CAM_EEPROM, "EEPROM Power down failed");
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+	}
+
+	if (e_ctrl->cam_eeprom_state == CAM_EEPROM_ACQUIRE) {
+		rc = cam_destroy_device_hdl(e_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_EEPROM, "destroying the device hdl");
+
+		e_ctrl->bridge_intf.device_hdl = -1;
+		e_ctrl->bridge_intf.link_hdl = -1;
+		e_ctrl->bridge_intf.session_hdl = -1;
+
+		kfree(power_info->power_setting);
+		kfree(power_info->power_down_setting);
+		power_info->power_setting = NULL;
+		power_info->power_down_setting = NULL;
+		power_info->power_setting_size = 0;
+		power_info->power_down_setting_size = 0;
+	}
+
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_INIT;
+}
+
+/**
+ * cam_eeprom_driver_cmd - Handle eeprom cmds
+ * @e_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+int32_t cam_eeprom_driver_cmd(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
+{
+	int                            rc = 0;
+	struct cam_eeprom_query_cap_t  eeprom_cap = {0};
+	struct cam_control            *cmd = (struct cam_control *)arg;
+
+	if (!e_ctrl || !cmd) {
+		CAM_ERR(CAM_EEPROM, "Invalid Arguments");
+		return -EINVAL;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_EEPROM, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	switch (cmd->op_code) {
+	case CAM_QUERY_CAP:
+		eeprom_cap.slot_info = e_ctrl->soc_info.index;
+		if (e_ctrl->userspace_probe == false)
+			eeprom_cap.eeprom_kernel_probe = true;
+		else
+			eeprom_cap.eeprom_kernel_probe = false;
+
+		eeprom_cap.is_multimodule_mode =
+			e_ctrl->is_multimodule_mode;
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&eeprom_cap,
+			sizeof(struct cam_eeprom_query_cap_t))) {
+			CAM_ERR(CAM_EEPROM, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		CAM_DBG(CAM_EEPROM, "eeprom_cap: ID: %d", eeprom_cap.slot_info);
+		break;
+	case CAM_ACQUIRE_DEV:
+		rc = cam_eeprom_get_dev_handle(e_ctrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "Failed to acquire dev");
+			goto release_mutex;
+		}
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
+		break;
+	case CAM_RELEASE_DEV:
+		if (e_ctrl->cam_eeprom_state != CAM_EEPROM_ACQUIRE) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_EEPROM,
+			"Not in right state to release : %d",
+			e_ctrl->cam_eeprom_state);
+			goto release_mutex;
+		}
+
+		if (e_ctrl->bridge_intf.device_hdl == -1) {
+			CAM_ERR(CAM_EEPROM,
+				"Invalid Handles: link hdl: %d device hdl: %d",
+				e_ctrl->bridge_intf.device_hdl,
+				e_ctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = cam_destroy_device_hdl(e_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_EEPROM,
+				"failed in destroying the device hdl");
+		e_ctrl->bridge_intf.device_hdl = -1;
+		e_ctrl->bridge_intf.link_hdl = -1;
+		e_ctrl->bridge_intf.session_hdl = -1;
+		e_ctrl->cam_eeprom_state = CAM_EEPROM_INIT;
+		break;
+	case CAM_CONFIG_DEV:
+		rc = cam_eeprom_pkt_parse(e_ctrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "Failed in eeprom pkt Parsing");
+			goto release_mutex;
+		}
+		break;
+	default:
+		CAM_DBG(CAM_EEPROM, "invalid opcode");
+		break;
+	}
+
+release_mutex:
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_EEPROM_CORE_H_
+#define _CAM_EEPROM_CORE_H_
+
+#include "cam_eeprom_dev.h"
+
+int32_t cam_eeprom_driver_cmd(struct cam_eeprom_ctrl_t *e_ctrl, void *arg);
+int32_t cam_eeprom_parse_read_memory_map(struct device_node *of_node,
+	struct cam_eeprom_ctrl_t *e_ctrl);
+/**
+ * @e_ctrl: EEPROM ctrl structure
+ *
+ * This API handles the shutdown ioctl/close
+ */
+void cam_eeprom_shutdown(struct cam_eeprom_ctrl_t *e_ctrl);
+
+#endif
+/* _CAM_EEPROM_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.c
@@ -0,0 +1,661 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_eeprom_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_eeprom_soc.h"
+#include "cam_eeprom_core.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+static int cam_eeprom_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_eeprom_ctrl_t *e_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "e_ctrl ptr is NULL");
+			return -EINVAL;
+	}
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_shutdown(e_ctrl);
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+
+	return 0;
+}
+
+static int cam_eeprom_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_EEPROM, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_eeprom_subdev_close_internal(sd, fh);
+}
+
+static long cam_eeprom_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int                       rc     = 0;
+	struct cam_eeprom_ctrl_t *e_ctrl = v4l2_get_subdevdata(sd);
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_eeprom_driver_cmd(e_ctrl, arg);
+		if (rc)
+			CAM_ERR(CAM_EEPROM,
+				"Failed in Driver cmd: %d", rc);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_eeprom_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	return rc;
+}
+
+int32_t cam_eeprom_update_i2c_info(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_eeprom_i2c_info_t *i2c_info)
+{
+	struct cam_sensor_cci_client        *cci_client = NULL;
+
+	if (e_ctrl->io_master_info.master_type == CCI_MASTER) {
+		cci_client = e_ctrl->io_master_info.cci_client;
+		if (!cci_client) {
+			CAM_ERR(CAM_EEPROM, "failed: cci_client %pK",
+				cci_client);
+			return -EINVAL;
+		}
+		cci_client->cci_i2c_master = e_ctrl->cci_i2c_master;
+		cci_client->sid = (i2c_info->slave_addr) >> 1;
+		cci_client->retries = 3;
+		cci_client->id_map = 0;
+		cci_client->i2c_freq_mode = i2c_info->i2c_freq_mode;
+	} else if (e_ctrl->io_master_info.master_type == I2C_MASTER) {
+		e_ctrl->io_master_info.client->addr = i2c_info->slave_addr;
+		CAM_DBG(CAM_EEPROM, "Slave addr: 0x%x", i2c_info->slave_addr);
+	} else if (e_ctrl->io_master_info.master_type == SPI_MASTER) {
+		CAM_ERR(CAM_EEPROM, "Slave addr: 0x%x Freq Mode: %d",
+		i2c_info->slave_addr, i2c_info->i2c_freq_mode);
+	}
+	return 0;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_eeprom_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_EEPROM,
+			"Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_eeprom_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM,
+				"Failed in eeprom suddev handling rc %d",
+				rc);
+			return rc;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_EEPROM, "Invalid compat ioctl: %d", cmd);
+		rc = -EINVAL;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_EEPROM,
+				"Failed to copy from user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+	return rc;
+}
+#endif
+
+static const struct v4l2_subdev_internal_ops cam_eeprom_internal_ops = {
+	.close = cam_eeprom_subdev_close,
+};
+
+static struct v4l2_subdev_core_ops cam_eeprom_subdev_core_ops = {
+	.ioctl = cam_eeprom_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_eeprom_init_subdev_do_ioctl,
+#endif
+};
+
+static struct v4l2_subdev_ops cam_eeprom_subdev_ops = {
+	.core = &cam_eeprom_subdev_core_ops,
+};
+
+static int cam_eeprom_init_subdev(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int rc = 0;
+
+	e_ctrl->v4l2_dev_str.internal_ops = &cam_eeprom_internal_ops;
+	e_ctrl->v4l2_dev_str.ops = &cam_eeprom_subdev_ops;
+	strscpy(e_ctrl->device_name, CAM_EEPROM_NAME,
+		sizeof(e_ctrl->device_name));
+	e_ctrl->v4l2_dev_str.name = e_ctrl->device_name;
+	e_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	e_ctrl->v4l2_dev_str.ent_function = CAM_EEPROM_DEVICE_TYPE;
+	e_ctrl->v4l2_dev_str.token = e_ctrl;
+	e_ctrl->v4l2_dev_str.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(e_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "Fail with cam_register_subdev");
+
+	return rc;
+}
+
+static int cam_eeprom_i2c_driver_probe(struct i2c_client *client)
+{
+	int                             rc = 0;
+	struct cam_eeprom_ctrl_t       *e_ctrl = NULL;
+	struct cam_eeprom_soc_private  *soc_private = NULL;
+	struct cam_hw_soc_info         *soc_info = NULL;
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_EEPROM, "i2c_check_functionality failed");
+		goto probe_failure;
+	}
+
+	e_ctrl = kzalloc(sizeof(*e_ctrl), GFP_KERNEL);
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "kzalloc failed");
+		rc = -ENOMEM;
+		goto probe_failure;
+	}
+
+	soc_private = kzalloc(sizeof(*soc_private), GFP_KERNEL);
+	if (!soc_private)
+		goto ectrl_free;
+
+	e_ctrl->soc_info.soc_private = soc_private;
+
+	i2c_set_clientdata(client, e_ctrl);
+
+	mutex_init(&(e_ctrl->eeprom_mutex));
+
+	INIT_LIST_HEAD(&(e_ctrl->wr_settings.list_head));
+	soc_info = &e_ctrl->soc_info;
+	soc_info->dev = &client->dev;
+	soc_info->dev_name = client->name;
+	e_ctrl->io_master_info.master_type = I2C_MASTER;
+	e_ctrl->io_master_info.client = client;
+	e_ctrl->eeprom_device_type = MSM_CAMERA_I2C_DEVICE;
+	e_ctrl->cal_data.mapdata = NULL;
+	e_ctrl->cal_data.map = NULL;
+	e_ctrl->userspace_probe = false;
+
+	rc = cam_eeprom_parse_dt(e_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: soc init rc %d", rc);
+		goto free_soc;
+	}
+
+	rc = cam_eeprom_update_i2c_info(e_ctrl, &soc_private->i2c_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: to update i2c info rc %d", rc);
+		goto free_soc;
+	}
+
+	rc = cam_eeprom_init_subdev(e_ctrl);
+	if (rc)
+		goto free_soc;
+
+	if (soc_private->i2c_info.slave_addr != 0)
+		e_ctrl->io_master_info.client->addr =
+			soc_private->i2c_info.slave_addr;
+
+	e_ctrl->bridge_intf.device_hdl = -1;
+	e_ctrl->bridge_intf.ops.get_dev_info = NULL;
+	e_ctrl->bridge_intf.ops.link_setup = NULL;
+	e_ctrl->bridge_intf.ops.apply_req = NULL;
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_INIT;
+
+	return rc;
+free_soc:
+	kfree(soc_private);
+ectrl_free:
+	kfree(e_ctrl);
+probe_failure:
+	return rc;
+}
+
+int cam_eeprom_i2c_driver_remove_common(struct i2c_client *client)
+{
+	int rc = 0;
+	int i = 0;
+	struct v4l2_subdev             *sd = i2c_get_clientdata(client);
+	struct cam_eeprom_ctrl_t       *e_ctrl;
+	struct cam_eeprom_soc_private  *soc_private;
+	struct cam_hw_soc_info         *soc_info = NULL;
+
+	if (!sd) {
+		CAM_ERR(CAM_EEPROM, "Subdevice is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	e_ctrl = (struct cam_eeprom_ctrl_t *)v4l2_get_subdevdata(sd);
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "eeprom device is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	if (!soc_private) {
+		CAM_ERR(CAM_EEPROM, "soc_info.soc_private is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	CAM_INFO(CAM_EEPROM, "i2c driver remove invoked");
+	soc_info = &e_ctrl->soc_info;
+	for (i = 0; i < soc_info->num_clk; i++)
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_shutdown(e_ctrl);
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_release_power_domain(e_ctrl);
+	mutex_destroy(&(e_ctrl->eeprom_mutex));
+	rc = cam_unregister_subdev(&(e_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_EEPROM, "unregistering eeprom subdev is not sucessful");
+
+	kfree(soc_private);
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(e_ctrl);
+
+	return rc;
+}
+
+static int cam_eeprom_spi_setup(struct spi_device *spi)
+{
+	struct cam_eeprom_ctrl_t       *e_ctrl = NULL;
+	struct cam_hw_soc_info         *soc_info = NULL;
+	struct cam_sensor_spi_client   *spi_client;
+	struct cam_eeprom_soc_private  *eb_info;
+	struct cam_sensor_power_ctrl_t *power_info = NULL;
+	int                             rc = 0;
+
+	e_ctrl = kzalloc(sizeof(*e_ctrl), GFP_KERNEL);
+	if (!e_ctrl)
+		return -ENOMEM;
+
+	soc_info = &e_ctrl->soc_info;
+	soc_info->dev = &spi->dev;
+	soc_info->dev_name = spi->modalias;
+
+	e_ctrl->v4l2_dev_str.ops = &cam_eeprom_subdev_ops;
+	e_ctrl->userspace_probe = false;
+	e_ctrl->cal_data.mapdata = NULL;
+	e_ctrl->cal_data.map = NULL;
+
+	spi_client = kzalloc(sizeof(*spi_client), GFP_KERNEL);
+	if (!spi_client) {
+		kfree(e_ctrl);
+		return -ENOMEM;
+	}
+
+	eb_info = kzalloc(sizeof(*eb_info), GFP_KERNEL);
+	if (!eb_info)
+		goto spi_free;
+	e_ctrl->soc_info.soc_private = eb_info;
+
+	e_ctrl->eeprom_device_type = MSM_CAMERA_SPI_DEVICE;
+	e_ctrl->io_master_info.spi_client = spi_client;
+	e_ctrl->io_master_info.master_type = SPI_MASTER;
+	spi_client->spi_master = spi;
+	INIT_LIST_HEAD(&(e_ctrl->wr_settings.list_head));
+	power_info = &eb_info->power_info;
+	power_info->dev = &spi->dev;
+
+	/* set spi instruction info */
+	spi_client->retry_delay = 1;
+	spi_client->retries = 0;
+
+	/* Initialize mutex */
+	mutex_init(&(e_ctrl->eeprom_mutex));
+
+	e_ctrl->bridge_intf.device_hdl = -1;
+	rc = cam_eeprom_parse_dt(e_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: spi soc init rc %d", rc);
+		goto board_free;
+	}
+
+	rc = cam_eeprom_spi_parse_of(spi_client);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "Device tree parsing error");
+		goto board_free;
+	}
+
+	rc = cam_eeprom_init_subdev(e_ctrl);
+	if (rc)
+		goto board_free;
+
+	e_ctrl->bridge_intf.ops.get_dev_info = NULL;
+	e_ctrl->bridge_intf.ops.link_setup = NULL;
+	e_ctrl->bridge_intf.ops.apply_req = NULL;
+
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, e_ctrl);
+	return rc;
+
+board_free:
+	kfree(e_ctrl->soc_info.soc_private);
+spi_free:
+	kfree(spi_client);
+	kfree(e_ctrl);
+	return rc;
+}
+
+static int cam_eeprom_spi_driver_probe(struct spi_device *spi)
+{
+	spi->bits_per_word = 8;
+	spi->mode = SPI_MODE_0;
+	spi_setup(spi);
+
+	CAM_DBG(CAM_EEPROM, "irq[%d] cs[%x] CPHA[%x] CPOL[%x] CS_HIGH[%x]",
+		spi->irq, spi->chip_select, (spi->mode & SPI_CPHA) ? 1 : 0,
+		(spi->mode & SPI_CPOL) ? 1 : 0,
+		(spi->mode & SPI_CS_HIGH) ? 1 : 0);
+	CAM_DBG(CAM_EEPROM, "max_speed[%u]", spi->max_speed_hz);
+
+	return cam_eeprom_spi_setup(spi);
+}
+
+int cam_eeprom_spi_driver_remove_common(struct spi_device *sdev)
+{
+	struct v4l2_subdev             *sd = spi_get_drvdata(sdev);
+	struct cam_eeprom_ctrl_t       *e_ctrl;
+	struct cam_eeprom_soc_private  *soc_private;
+	struct cam_hw_soc_info         *soc_info;
+	int rc = 0;
+	int i = 0;
+
+	if (!sd) {
+		CAM_ERR(CAM_EEPROM, "Subdevice is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	e_ctrl = (struct cam_eeprom_ctrl_t *)v4l2_get_subdevdata(sd);
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "eeprom device is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	soc_info = &e_ctrl->soc_info;
+	for (i = 0; i < soc_info->num_clk; i++)
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_shutdown(e_ctrl);
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_release_power_domain(e_ctrl);
+	mutex_destroy(&(e_ctrl->eeprom_mutex));
+	rc = cam_unregister_subdev(&(e_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_EEPROM, "unregistering eeprom spi subdevis unsucessful");
+
+	kfree(e_ctrl->io_master_info.spi_client);
+	e_ctrl->io_master_info.spi_client = NULL;
+	soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	if (soc_private) {
+		kfree(soc_private->power_info.gpio_num_info);
+		soc_private->power_info.gpio_num_info = NULL;
+		kfree(soc_private);
+		soc_private = NULL;
+	}
+
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(e_ctrl);
+	return rc;
+}
+
+static int cam_eeprom_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t                         rc = 0;
+	struct cam_eeprom_ctrl_t       *e_ctrl = NULL;
+	struct cam_eeprom_soc_private  *soc_private = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	e_ctrl = kzalloc(sizeof(struct cam_eeprom_ctrl_t), GFP_KERNEL);
+	if (!e_ctrl)
+		return -ENOMEM;
+
+	e_ctrl->soc_info.pdev = pdev;
+	e_ctrl->soc_info.dev = &pdev->dev;
+	e_ctrl->soc_info.dev_name = pdev->name;
+	e_ctrl->eeprom_device_type = MSM_CAMERA_PLATFORM_DEVICE;
+	e_ctrl->cal_data.mapdata = NULL;
+	e_ctrl->cal_data.map = NULL;
+	e_ctrl->userspace_probe = false;
+
+	e_ctrl->io_master_info.master_type = CCI_MASTER;
+	e_ctrl->io_master_info.cci_client = kzalloc(
+		sizeof(struct cam_sensor_cci_client), GFP_KERNEL);
+	if (!e_ctrl->io_master_info.cci_client) {
+		rc = -ENOMEM;
+		goto free_e_ctrl;
+	}
+
+	soc_private = kzalloc(sizeof(struct cam_eeprom_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto free_cci_client;
+	}
+	e_ctrl->soc_info.soc_private = soc_private;
+	soc_private->power_info.dev = &pdev->dev;
+
+	/* Initialize mutex */
+	mutex_init(&(e_ctrl->eeprom_mutex));
+	rc = cam_eeprom_parse_dt(e_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: soc init rc %d", rc);
+		goto free_soc;
+	}
+	rc = cam_eeprom_update_i2c_info(e_ctrl, &soc_private->i2c_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: to update i2c info rc %d", rc);
+		goto free_soc;
+	}
+
+	INIT_LIST_HEAD(&(e_ctrl->wr_settings.list_head));
+	rc = cam_eeprom_init_subdev(e_ctrl);
+	if (rc)
+		goto free_soc;
+
+	e_ctrl->bridge_intf.device_hdl = -1;
+	e_ctrl->bridge_intf.ops.get_dev_info = NULL;
+	e_ctrl->bridge_intf.ops.link_setup = NULL;
+	e_ctrl->bridge_intf.ops.apply_req = NULL;
+	platform_set_drvdata(pdev, e_ctrl);
+	e_ctrl->cam_eeprom_state = CAM_EEPROM_INIT;
+	CAM_DBG(CAM_EEPROM, "Component bound successfully");
+
+	return rc;
+free_soc:
+	kfree(soc_private);
+free_cci_client:
+	kfree(e_ctrl->io_master_info.cci_client);
+free_e_ctrl:
+	kfree(e_ctrl);
+
+	return rc;
+}
+
+static void cam_eeprom_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                        i;
+	struct cam_eeprom_ctrl_t  *e_ctrl;
+	struct cam_hw_soc_info    *soc_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	e_ctrl = platform_get_drvdata(pdev);
+	if (!e_ctrl) {
+		CAM_ERR(CAM_EEPROM, "eeprom device is NULL");
+		return;
+	}
+
+	CAM_DBG(CAM_EEPROM, "Component unbind called for: %s", pdev->name);
+	soc_info = &e_ctrl->soc_info;
+
+	for (i = 0; i < soc_info->num_clk; i++)
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+
+	mutex_lock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_shutdown(e_ctrl);
+	mutex_unlock(&(e_ctrl->eeprom_mutex));
+	cam_eeprom_release_power_domain(e_ctrl);
+	mutex_destroy(&(e_ctrl->eeprom_mutex));
+	cam_unregister_subdev(&(e_ctrl->v4l2_dev_str));
+	kfree(soc_info->soc_private);
+	kfree(e_ctrl->io_master_info.cci_client);
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(e_ctrl);
+}
+
+const static struct component_ops cam_eeprom_component_ops = {
+	.bind = cam_eeprom_component_bind,
+	.unbind = cam_eeprom_component_unbind,
+};
+
+static int32_t cam_eeprom_platform_driver_probe(
+	struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_EEPROM, "Adding EEPROM Sensor component");
+	rc = component_add(&pdev->dev, &cam_eeprom_component_ops);
+	if (rc)
+		CAM_ERR(CAM_EEPROM, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_eeprom_platform_driver_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_eeprom_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_eeprom_dt_match[] = {
+	{ .compatible = "qcom,eeprom" },
+	{ }
+};
+
+
+MODULE_DEVICE_TABLE(of, cam_eeprom_dt_match);
+
+struct platform_driver cam_eeprom_platform_driver = {
+	.driver = {
+		.name = "qcom,eeprom",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_eeprom_dt_match,
+		.suppress_bind_attrs = true,
+	},
+	.probe = cam_eeprom_platform_driver_probe,
+	.remove = cam_eeprom_platform_driver_remove,
+};
+
+static const struct i2c_device_id cam_eeprom_i2c_id[] = {
+	{ "msm_eeprom", (kernel_ulong_t)NULL},
+	{ }
+};
+
+static struct i2c_driver cam_eeprom_i2c_driver = {
+	.id_table = cam_eeprom_i2c_id,
+	.probe  = cam_eeprom_i2c_driver_probe,
+	.remove = cam_eeprom_i2c_driver_remove,
+	.driver = {
+		.name = "msm_eeprom",
+	},
+};
+
+static struct spi_driver cam_eeprom_spi_driver = {
+	.driver = {
+		.name = "qcom_eeprom",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_eeprom_dt_match,
+	},
+	.probe = cam_eeprom_spi_driver_probe,
+	.remove = cam_eeprom_spi_driver_remove,
+};
+int cam_eeprom_driver_init(void)
+{
+	int rc = 0;
+
+	rc = platform_driver_register(&cam_eeprom_platform_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "platform_driver_register failed rc = %d",
+			rc);
+		return rc;
+	}
+
+	rc = spi_register_driver(&cam_eeprom_spi_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "spi_register_driver failed rc = %d", rc);
+		return rc;
+	}
+
+	rc = i2c_add_driver(&cam_eeprom_i2c_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "i2c_add_driver failed rc = %d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+void cam_eeprom_driver_exit(void)
+{
+	platform_driver_unregister(&cam_eeprom_platform_driver);
+	spi_unregister_driver(&cam_eeprom_spi_driver);
+	i2c_del_driver(&cam_eeprom_i2c_driver);
+}
+
+MODULE_DESCRIPTION("CAM EEPROM driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_dev.h
@@ -0,0 +1,209 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_EEPROM_DEV_H_
+#define _CAM_EEPROM_DEV_H_
+
+#include <linux/i2c.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/gpio.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-ioctl.h>
+#include <cam_sensor_i2c.h>
+#include <cam_sensor_spi.h>
+#include <cam_sensor_io.h>
+#include <cam_cci_dev.h>
+#include <cam_req_mgr_util.h>
+#include <cam_req_mgr_interface.h>
+#include <cam_mem_mgr.h>
+#include <cam_subdev.h>
+#include <media/cam_sensor.h>
+#include "cam_soc_util.h"
+#include "cam_context.h"
+
+#define DEFINE_MSM_MUTEX(mutexname) \
+	static struct mutex mutexname = __MUTEX_INITIALIZER(mutexname)
+
+#define PROPERTY_MAXSIZE 32
+
+#define MSM_EEPROM_MEMORY_MAP_MAX_SIZE         80
+#define MSM_EEPROM_MAX_MEM_MAP_CNT             100
+#define MSM_EEPROM_MEM_MAP_PROPERTIES_CNT      8
+
+enum cam_eeprom_state {
+	CAM_EEPROM_INIT,
+	CAM_EEPROM_ACQUIRE,
+	CAM_EEPROM_CONFIG,
+};
+
+/**
+ * struct cam_eeprom_map_t - eeprom map
+ * @data_type       :   Data type
+ * @addr_type       :   Address type
+ * @addr            :   Address
+ * @data            :   data
+ * @delay           :   Delay
+ *
+ */
+struct cam_eeprom_map_t {
+	uint32_t valid_size;
+	uint32_t addr;
+	uint32_t addr_type;
+	uint32_t data;
+	uint32_t data_type;
+	uint32_t delay;
+};
+
+/**
+ * struct cam_eeprom_memory_map_t - eeprom memory map types
+ * @page            :   page memory
+ * @pageen          :   pageen memory
+ * @poll            :   poll memory
+ * @mem             :   mem
+ * @saddr           :   slave addr
+ *
+ */
+struct cam_eeprom_memory_map_t {
+	struct cam_eeprom_map_t page;
+	struct cam_eeprom_map_t pageen;
+	struct cam_eeprom_map_t poll;
+	struct cam_eeprom_map_t mem;
+	uint32_t saddr;
+};
+
+/**
+ * struct cam_eeprom_memory_block_t - eeprom mem block info
+ * @map             :   eeprom memory map
+ * @num_map         :   number of map blocks
+ * @mapdata         :   map data
+ * @cmd_type        :   size of total mapdata
+ *
+ */
+struct cam_eeprom_memory_block_t {
+	struct cam_eeprom_memory_map_t *map;
+	uint32_t num_map;
+	uint8_t *mapdata;
+	uint32_t num_data;
+};
+
+/**
+ * struct cam_eeprom_cmm_t - camera multimodule
+ * @cmm_support     :   cmm support flag
+ * @cmm_compression :   cmm compression flag
+ * @cmm_offset      :   cmm data start offset
+ * @cmm_size        :   cmm data size
+ *
+ */
+struct cam_eeprom_cmm_t {
+	uint32_t cmm_support;
+	uint32_t cmm_compression;
+	uint32_t cmm_offset;
+	uint32_t cmm_size;
+};
+
+/**
+ * struct cam_eeprom_i2c_info_t - I2C info
+ * @slave_addr      :   slave address
+ * @i2c_freq_mode   :   i2c frequency mode
+ *
+ */
+struct cam_eeprom_i2c_info_t {
+	uint16_t slave_addr;
+	uint8_t i2c_freq_mode;
+};
+
+/**
+ * struct cam_eeprom_soc_private - eeprom soc private data structure
+ * @eeprom_name     :   eeprom name
+ * @i2c_info        :   i2c info structure
+ * @power_info      :   eeprom power info
+ * @cmm_data        :   cmm data
+ *
+ */
+struct cam_eeprom_soc_private {
+	const char *eeprom_name;
+	struct cam_eeprom_i2c_info_t i2c_info;
+	struct cam_sensor_power_ctrl_t power_info;
+	struct cam_eeprom_cmm_t cmm_data;
+};
+
+/**
+ * struct cam_eeprom_intf_params - bridge interface params
+ * @device_hdl   : Device Handle
+ * @session_hdl  : Session Handle
+ * @ops          : KMD operations
+ * @crm_cb       : Callback API pointers
+ */
+struct cam_eeprom_intf_params {
+	int32_t device_hdl;
+	int32_t session_hdl;
+	int32_t link_hdl;
+	struct cam_req_mgr_kmd_ops ops;
+	struct cam_req_mgr_crm_cb *crm_cb;
+};
+
+struct eebin_info {
+	uint32_t start_address;
+	uint32_t size;
+	uint32_t is_valid;
+};
+
+/**
+ * struct cam_eeprom_ctrl_t - EEPROM control structure
+ * @device_name         :   Device name
+ * @pdev                :   platform device
+ * @spi                 :   spi device
+ * @eeprom_mutex        :   eeprom mutex
+ * @soc_info            :   eeprom soc related info
+ * @io_master_info      :   Information about the communication master
+ * @gpio_num_info       :   gpio info
+ * @cci_i2c_master      :   I2C structure
+ * @v4l2_dev_str        :   V4L2 device structure
+ * @bridge_intf         :   bridge interface params
+ * @cam_eeprom_state    :   eeprom_device_state
+ * @userspace_probe     :   flag indicates userspace or kernel probe
+ * @cal_data            :   Calibration data
+ * @device_name         :   Device name
+ * @is_multimodule_mode :   To identify multimodule node
+ * @wr_settings         :   I2C write settings
+ * @eebin_info          :   EEBIN address, size info
+ */
+struct cam_eeprom_ctrl_t {
+	char device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct platform_device *pdev;
+	struct spi_device *spi;
+	struct mutex eeprom_mutex;
+	struct cam_hw_soc_info soc_info;
+	struct camera_io_master io_master_info;
+	struct msm_camera_gpio_num_info *gpio_num_info;
+	enum cci_i2c_master_t cci_i2c_master;
+	enum cci_device_num cci_num;
+	struct cam_subdev v4l2_dev_str;
+	struct cam_eeprom_intf_params bridge_intf;
+	enum msm_camera_device_type_t eeprom_device_type;
+	enum cam_eeprom_state cam_eeprom_state;
+	bool userspace_probe;
+	struct cam_eeprom_memory_block_t cal_data;
+	uint16_t is_multimodule_mode;
+	struct i2c_settings_array wr_settings;
+	struct eebin_info eebin_info;
+};
+
+int32_t cam_eeprom_update_i2c_info(struct cam_eeprom_ctrl_t *e_ctrl,
+	struct cam_eeprom_i2c_info_t *i2c_info);
+
+/**
+ * @brief : API to register EEPROM hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_eeprom_driver_init(void);
+
+/**
+ * @brief : API to remove EEPROM Hw from platform framework.
+ */
+void cam_eeprom_driver_exit(void);
+
+#endif /*_CAM_EEPROM_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.c
@@ -0,0 +1,399 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_sensor_util.h>
+#include <cam_sensor_io.h>
+#include <cam_req_mgr_util.h>
+
+#include "cam_eeprom_soc.h"
+#include "cam_debug_util.h"
+
+#define cam_eeprom_spi_parse_cmd(spi_dev, name, out)          \
+	{                                                     \
+		spi_dev->cmd_tbl.name.opcode = out[0];        \
+		spi_dev->cmd_tbl.name.addr_len = out[1];      \
+		spi_dev->cmd_tbl.name.dummy_len = out[2];     \
+		spi_dev->cmd_tbl.name.delay_intv = out[3];    \
+		spi_dev->cmd_tbl.name.delay_count = out[4];   \
+	}
+
+int cam_eeprom_spi_parse_of(struct cam_sensor_spi_client *spi_dev)
+{
+	int rc = -EFAULT;
+	uint32_t tmp[5];
+
+	rc  = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-read", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, read, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get read data");
+		return -EFAULT;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-readseq", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, read_seq, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get readseq data");
+		return -EFAULT;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-queryid", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, query_id, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get queryid data");
+		return -EFAULT;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-pprog", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, page_program, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get page program data");
+		return -EFAULT;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-wenable", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, write_enable, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get write enable data");
+		return rc;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-readst", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, read_status, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get readdst data");
+		return rc;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"spiop-erase", tmp, 5);
+	if (!rc) {
+		cam_eeprom_spi_parse_cmd(spi_dev, erase, tmp);
+	} else {
+		CAM_ERR(CAM_EEPROM, "Failed to get erase data");
+		return rc;
+	}
+
+	rc = of_property_read_u32_array(spi_dev->spi_master->dev.of_node,
+		"eeprom-id", tmp, 2);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "Failed to get eeprom id");
+		return rc;
+	}
+
+	spi_dev->mfr_id0 = tmp[0];
+	spi_dev->device_id0 = tmp[1];
+
+	return 0;
+}
+
+/*
+ * cam_eeprom_parse_memory_map() - parse memory map in device node
+ * @of:         device node
+ * @data:       memory block for output
+ *
+ * This functions parses @of to fill @data.  It allocates map itself, parses
+ * the @of node, calculate total data length, and allocates required buffer.
+ * It only fills the map, but does not perform actual reading.
+ */
+int cam_eeprom_parse_dt_memory_map(struct device_node *node,
+	struct cam_eeprom_memory_block_t *data)
+{
+	int       i, rc = 0;
+	char      property[PROPERTY_MAXSIZE];
+	uint32_t  count = MSM_EEPROM_MEM_MAP_PROPERTIES_CNT;
+	struct    cam_eeprom_memory_map_t *map;
+
+	snprintf(property, PROPERTY_MAXSIZE, "num-blocks");
+	rc = of_property_read_u32(node, property, &data->num_map);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "failed: num-blocks not available rc %d",
+			rc);
+		return rc;
+	}
+
+	map = vzalloc((sizeof(*map) * data->num_map));
+	if (!map) {
+		rc = -ENOMEM;
+		return rc;
+	}
+	data->map = map;
+
+	for (i = 0; i < data->num_map; i++) {
+		snprintf(property, PROPERTY_MAXSIZE, "page%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].page, count);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "failed: page not available rc %d",
+				rc);
+			goto ERROR;
+		}
+
+		snprintf(property, PROPERTY_MAXSIZE, "pageen%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].pageen, count);
+		if (rc < 0)
+			CAM_DBG(CAM_EEPROM, "pageen not needed");
+
+		snprintf(property, PROPERTY_MAXSIZE, "saddr%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].saddr, 1);
+		if (rc < 0)
+			CAM_DBG(CAM_EEPROM, "saddr not needed - block %d", i);
+
+		snprintf(property, PROPERTY_MAXSIZE, "poll%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].poll, count);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "failed: poll not available rc %d",
+				rc);
+			goto ERROR;
+		}
+
+		snprintf(property, PROPERTY_MAXSIZE, "mem%d", i);
+		rc = of_property_read_u32_array(node, property,
+			(uint32_t *) &map[i].mem, count);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "failed: mem not available rc %d",
+				rc);
+			goto ERROR;
+		}
+		data->num_data += map[i].mem.valid_size;
+	}
+
+	data->mapdata = vzalloc(data->num_data);
+	if (!data->mapdata) {
+		rc = -ENOMEM;
+		goto ERROR;
+	}
+	return rc;
+
+ERROR:
+	vfree(data->map);
+	memset(data, 0, sizeof(*data));
+	return rc;
+}
+
+/**
+ * @e_ctrl: ctrl structure
+ *
+ * Parses eeprom dt
+ */
+static int cam_eeprom_get_dt_data(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int                             rc = 0;
+	struct cam_hw_soc_info         *soc_info = &e_ctrl->soc_info;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+	struct device_node             *of_node = NULL;
+
+	of_node = soc_info->dev->of_node;
+
+	if (e_ctrl->userspace_probe == false) {
+		rc = cam_get_dt_power_setting_data(of_node,
+			soc_info, power_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM, "failed in getting power settings");
+			return rc;
+		}
+	}
+
+	if (!soc_info->gpio_data) {
+		CAM_INFO(CAM_EEPROM, "No GPIO found");
+		return 0;
+	}
+
+	if (!soc_info->gpio_data->cam_gpio_common_tbl_size) {
+		CAM_INFO(CAM_EEPROM, "No GPIO found");
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
+		&power_info->gpio_num_info);
+	if ((rc < 0) || (!power_info->gpio_num_info)) {
+		CAM_ERR(CAM_EEPROM, "No/Error EEPROM GPIOs");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+/**
+ * @eb_info: eeprom private data structure
+ * @of_node: eeprom device node
+ *
+ * This function parses the eeprom dt to get the MM data
+ */
+static int cam_eeprom_cmm_dts(struct cam_eeprom_soc_private *eb_info,
+	struct device_node *of_node)
+{
+	int                      rc = 0;
+	struct cam_eeprom_cmm_t *cmm_data = &eb_info->cmm_data;
+
+	cmm_data->cmm_support =
+		of_property_read_bool(of_node, "cmm-data-support");
+	if (!cmm_data->cmm_support) {
+		CAM_DBG(CAM_EEPROM, "No cmm support");
+		return 0;
+	}
+
+	cmm_data->cmm_compression =
+		of_property_read_bool(of_node, "cmm-data-compressed");
+
+	rc = of_property_read_u32(of_node, "cmm-data-offset",
+		&cmm_data->cmm_offset);
+	if (rc < 0)
+		CAM_DBG(CAM_EEPROM, "No MM offset data rc %d", rc);
+
+	rc = of_property_read_u32(of_node, "cmm-data-size",
+		&cmm_data->cmm_size);
+	if (rc < 0)
+		CAM_DBG(CAM_EEPROM, "No MM size data rc %d", rc);
+
+	CAM_DBG(CAM_EEPROM, "cmm_compr %d, cmm_offset %d, cmm_size %d",
+		cmm_data->cmm_compression, cmm_data->cmm_offset,
+		cmm_data->cmm_size);
+	return 0;
+}
+
+/**
+ * @e_ctrl: ctrl structure
+ *
+ * This function is called from cam_eeprom_platform/i2c/spi_driver_probe
+ * it parses the eeprom dt node and decides for userspace or kernel probe.
+ */
+int cam_eeprom_parse_dt(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int                             i, rc = 0;
+	struct cam_hw_soc_info         *soc_info = &e_ctrl->soc_info;
+	struct device_node             *of_node = NULL;
+	struct device_node             *of_parent = NULL;
+	struct cam_eeprom_soc_private  *soc_private =
+		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
+	uint32_t                        temp;
+
+	if (!soc_info->dev) {
+		CAM_ERR(CAM_EEPROM, "Dev is NULL");
+		return -EINVAL;
+	}
+
+	e_ctrl->is_multimodule_mode = false;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "Failed to read DT properties rc : %d", rc);
+		return rc;
+	}
+
+	of_node = soc_info->dev->of_node;
+
+	if (of_property_read_bool(of_node, "multimodule-support")) {
+		CAM_DBG(CAM_UTIL, "Multi Module is Supported");
+		e_ctrl->is_multimodule_mode = true;
+	}
+
+	rc = of_property_read_string(of_node, "eeprom-name",
+		&soc_private->eeprom_name);
+	if (rc < 0) {
+		CAM_DBG(CAM_EEPROM, "kernel probe is not enabled");
+		e_ctrl->userspace_probe = true;
+	}
+
+	if (e_ctrl->io_master_info.master_type == CCI_MASTER) {
+		rc = of_property_read_u32(of_node, "cci-master",
+			&e_ctrl->cci_i2c_master);
+		if (rc < 0 || (e_ctrl->cci_i2c_master >= MASTER_MAX)) {
+			CAM_DBG(CAM_EEPROM, "failed rc %d", rc);
+			rc = -EFAULT;
+			return rc;
+		}
+
+		of_parent = of_get_parent(of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&e_ctrl->cci_num) < 0)
+			/* Set default master 0 */
+			e_ctrl->cci_num = CCI_DEVICE_0;
+
+		e_ctrl->io_master_info.cci_client->cci_device = e_ctrl->cci_num;
+		CAM_DBG(CAM_EEPROM, "cci-index %d", e_ctrl->cci_num, rc);
+	}
+
+	if (e_ctrl->io_master_info.master_type == SPI_MASTER) {
+		rc = cam_eeprom_cmm_dts(soc_private, soc_info->dev->of_node);
+		if (rc < 0)
+			CAM_DBG(CAM_EEPROM, "MM data not available rc %d", rc);
+	}
+
+	rc = cam_eeprom_get_dt_data(e_ctrl);
+	if (rc < 0)
+		CAM_DBG(CAM_EEPROM, "failed: eeprom get dt data rc %d", rc);
+
+	if ((e_ctrl->userspace_probe == false) &&
+			(e_ctrl->io_master_info.master_type != SPI_MASTER)) {
+		rc = of_property_read_u32(of_node, "slave-addr", &temp);
+		if (rc < 0)
+			CAM_DBG(CAM_EEPROM, "failed: no slave-addr rc %d", rc);
+
+		soc_private->i2c_info.slave_addr = temp;
+
+		rc = of_property_read_u32(of_node, "i2c-freq-mode", &temp);
+		soc_private->i2c_info.i2c_freq_mode = temp;
+		if (rc < 0) {
+			CAM_ERR(CAM_EEPROM,
+				"i2c-freq-mode read fail %d", rc);
+			soc_private->i2c_info.i2c_freq_mode = 0;
+		}
+		if (soc_private->i2c_info.i2c_freq_mode >= I2C_MAX_MODES) {
+			CAM_ERR(CAM_EEPROM, "invalid i2c_freq_mode = %d",
+				soc_private->i2c_info.i2c_freq_mode);
+			soc_private->i2c_info.i2c_freq_mode = 0;
+		}
+		CAM_DBG(CAM_EEPROM, "slave-addr = 0x%X",
+			soc_private->i2c_info.slave_addr);
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		soc_info->clk[i] = devm_clk_get(soc_info->dev,
+			soc_info->clk_name[i]);
+		if (!soc_info->clk[i]) {
+			CAM_ERR(CAM_EEPROM, "get failed for %s",
+				soc_info->clk_name[i]);
+			rc = -ENOENT;
+			return rc;
+		}
+	}
+
+	rc = cam_sensor_util_regulator_powerup(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_sensor_util_request_power_domain(soc_info);
+	if (rc < 0)
+		return rc;
+
+	return rc;
+}
+
+void cam_eeprom_release_power_domain(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	struct cam_hw_soc_info *soc_info = &e_ctrl->soc_info;
+
+	cam_sensor_util_release_power_domain(soc_info);
+}
\ No newline at end of file
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_soc.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_EEPROM_SOC_H_
+#define _CAM_EEPROM_SOC_H_
+
+#include "cam_eeprom_dev.h"
+
+int cam_eeprom_spi_parse_of(struct cam_sensor_spi_client *client);
+
+int cam_eeprom_parse_dt_memory_map(struct device_node *of,
+	struct cam_eeprom_memory_block_t *data);
+
+int cam_eeprom_parse_dt(struct cam_eeprom_ctrl_t *e_ctrl);
+
+void cam_eeprom_release_power_domain(struct cam_eeprom_ctrl_t *e_ctrl);
+#endif/* _CAM_EEPROM_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_core.c
@@ -0,0 +1,1991 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+
+#include "cam_sensor_cmn_header.h"
+#include "cam_flash_core.h"
+#include "cam_res_mgr_api.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+#include <linux/math64.h>
+
+static uint default_on_timer = 2;
+module_param(default_on_timer, uint, 0644);
+
+int cam_flash_led_prepare(struct led_trigger *trigger, int options,
+	int *max_current, bool is_wled)
+{
+	int rc = 0;
+
+	if (is_wled) {
+#if IS_REACHABLE(CONFIG_BACKLIGHT_QCOM_SPMI_WLED)
+		rc = wled_flash_led_prepare(trigger, options, max_current);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "enable reg failed: rc: %d",
+				rc);
+			return rc;
+		}
+#else
+	return -EPERM;
+#endif
+	} else {
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2)
+		rc = qpnp_flash_led_prepare(trigger, options, max_current);
+#elif IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+		rc = qti_flash_led_prepare(trigger, options, max_current);
+#endif
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"Regulator enable failed rc = %d", rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_flash_pmic_flush_nrt(struct cam_flash_ctrl *fctrl)
+{
+	int j = 0;
+	struct cam_flash_frame_setting *nrt_settings;
+
+	if (!fctrl)
+		return -EINVAL;
+
+	nrt_settings = &fctrl->nrt_info;
+
+	if (nrt_settings->cmn_attr.cmd_type ==
+		CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO) {
+		fctrl->flash_init_setting.cmn_attr.is_settings_valid = false;
+	} else if ((nrt_settings->cmn_attr.cmd_type ==
+		CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET) ||
+		(nrt_settings->cmn_attr.cmd_type ==
+		CAMERA_SENSOR_FLASH_CMD_TYPE_RER) ||
+		(nrt_settings->cmn_attr.cmd_type ==
+		CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE)) {
+		fctrl->nrt_info.cmn_attr.is_settings_valid = false;
+		fctrl->nrt_info.cmn_attr.count = 0;
+		fctrl->nrt_info.num_iterations = 0;
+		fctrl->nrt_info.led_on_delay_ms = 0;
+		fctrl->nrt_info.led_off_delay_ms = 0;
+		for (j = 0; j < CAM_FLASH_MAX_LED_TRIGGERS; j++)
+			fctrl->nrt_info.led_current_ma[j] = 0;
+	}
+
+	return 0;
+}
+
+static int cam_flash_i2c_flush_nrt(struct cam_flash_ctrl *fctrl)
+{
+	int rc = 0;
+
+	if (fctrl->i2c_data.init_settings.is_settings_valid == true) {
+		rc = delete_request(&fctrl->i2c_data.init_settings);
+		if (rc) {
+			CAM_WARN(CAM_FLASH,
+				"Failed to delete Init i2c_setting: %d",
+				rc);
+			return rc;
+		}
+	}
+	if (fctrl->i2c_data.config_settings.is_settings_valid == true) {
+		rc = delete_request(&fctrl->i2c_data.config_settings);
+		if (rc) {
+			CAM_WARN(CAM_FLASH,
+				"Failed to delete NRT i2c_setting: %d",
+				rc);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_flash_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int rc = 0;
+
+	power_info->power_setting_size = 1;
+	power_info->power_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_setting)
+		return -ENOMEM;
+
+	power_info->power_setting[0].seq_type = SENSOR_CUSTOM_REG1;
+	power_info->power_setting[0].seq_val = CAM_V_CUSTOM1;
+	power_info->power_setting[0].config_val = 0;
+	power_info->power_setting[0].delay = 2;
+
+	power_info->power_down_setting_size = 1;
+	power_info->power_down_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_down_setting) {
+		rc = -ENOMEM;
+		goto free_power_settings;
+	}
+
+	power_info->power_down_setting[0].seq_type = SENSOR_CUSTOM_REG1;
+	power_info->power_down_setting[0].seq_val = CAM_V_CUSTOM1;
+	power_info->power_down_setting[0].config_val = 0;
+
+	return rc;
+
+free_power_settings:
+	kfree(power_info->power_setting);
+	power_info->power_setting = NULL;
+	power_info->power_setting_size = 0;
+	return rc;
+}
+
+int cam_flash_i2c_power_ops(struct cam_flash_ctrl *fctrl,
+	bool regulator_enable)
+{
+	int rc = 0;
+	struct cam_hw_soc_info *soc_info = &fctrl->soc_info;
+	struct cam_sensor_power_ctrl_t *power_info =
+		&fctrl->power_info;
+
+	if (!power_info || !soc_info) {
+		CAM_ERR(CAM_FLASH, "Power Info is NULL");
+		return -EINVAL;
+	}
+	power_info->dev = soc_info->dev;
+
+	if (regulator_enable && (fctrl->is_regulator_enabled == false)) {
+		if ((power_info->power_setting == NULL) &&
+			(power_info->power_down_setting == NULL)) {
+			CAM_INFO(CAM_FLASH,
+				"Using default power settings");
+			rc = cam_flash_construct_default_power_setting(
+					power_info);
+			if (rc < 0) {
+				CAM_ERR(CAM_FLASH,
+				"Construct default pwr setting failed rc: %d",
+				rc);
+				return rc;
+			}
+		}
+
+		rc = cam_sensor_core_power_up(power_info, soc_info);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "power up the core is failed:%d",
+				rc);
+			goto free_pwr_settings;
+		}
+
+		rc = camera_io_init(&(fctrl->io_master_info));
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "cci_init failed: rc: %d", rc);
+			cam_sensor_util_power_down(power_info, soc_info);
+			goto free_pwr_settings;
+		}
+		fctrl->is_regulator_enabled = true;
+	} else if ((!regulator_enable) &&
+		(fctrl->is_regulator_enabled == true)) {
+		rc = cam_sensor_util_power_down(power_info, soc_info);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "power down the core is failed:%d",
+				rc);
+			return rc;
+		}
+		camera_io_release(&(fctrl->io_master_info));
+		fctrl->is_regulator_enabled = false;
+		goto free_pwr_settings;
+	}
+	return rc;
+
+free_pwr_settings:
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_setting_size = 0;
+	power_info->power_down_setting_size = 0;
+
+	return rc;
+}
+
+int cam_flash_pmic_flush_request(struct cam_flash_ctrl *fctrl,
+	enum cam_flash_flush_type type, uint64_t req_id)
+{
+	int rc = 0;
+	int i = 0, j = 0;
+	int frame_offset = 0;
+	bool is_off_needed = false;
+	struct cam_flash_frame_setting *flash_data = NULL;
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	if (type == FLUSH_ALL) {
+	/* flush all requests*/
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			flash_data =
+				&fctrl->per_frame[i];
+			if ((flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_OFF) &&
+				(flash_data->cmn_attr.request_id > 0) &&
+				flash_data->cmn_attr.is_settings_valid) {
+				is_off_needed = true;
+				CAM_DBG(CAM_FLASH,
+					"FLASH_ALL: Turn off the flash for req %llu",
+					flash_data->cmn_attr.request_id);
+			}
+
+			flash_data->cmn_attr.request_id = 0;
+			flash_data->cmn_attr.is_settings_valid = false;
+			flash_data->cmn_attr.count = 0;
+			for (j = 0; j < CAM_FLASH_MAX_LED_TRIGGERS; j++)
+				flash_data->led_current_ma[j] = 0;
+		}
+
+		cam_flash_pmic_flush_nrt(fctrl);
+	} else if ((type == FLUSH_REQ) && (req_id != 0)) {
+	/* flush request with req_id*/
+		frame_offset = req_id % MAX_PER_FRAME_ARRAY;
+		flash_data =
+			&fctrl->per_frame[frame_offset];
+
+		if (flash_data->opcode ==
+			CAMERA_SENSOR_FLASH_OP_OFF) {
+			is_off_needed = true;
+			CAM_DBG(CAM_FLASH,
+				"FLASH_REQ: Turn off the flash for req %llu",
+				flash_data->cmn_attr.request_id);
+		}
+
+		flash_data->cmn_attr.request_id = 0;
+		flash_data->cmn_attr.is_settings_valid =
+			false;
+		flash_data->cmn_attr.count = 0;
+		for (i = 0; i < CAM_FLASH_MAX_LED_TRIGGERS; i++)
+			flash_data->led_current_ma[i] = 0;
+	} else if ((type == FLUSH_REQ) && (req_id == 0)) {
+		/* Handels NonRealTime usecase */
+		cam_flash_pmic_flush_nrt(fctrl);
+	} else {
+		CAM_ERR(CAM_FLASH, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (is_off_needed)
+		cam_flash_off(fctrl);
+
+	return rc;
+}
+
+int cam_flash_i2c_flush_request(struct cam_flash_ctrl *fctrl,
+	enum cam_flash_flush_type type, uint64_t req_id)
+{
+	int rc = 0;
+	int i = 0;
+	uint32_t cancel_req_id_found = 0;
+	struct i2c_settings_array *i2c_set = NULL;
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Device data is NULL");
+		return -EINVAL;
+	}
+	if ((type == FLUSH_REQ) && (req_id == 0)) {
+		/* This setting will be called only when NonRealTime
+		 * settings needs to clean.
+		 */
+		cam_flash_i2c_flush_nrt(fctrl);
+	} else {
+		/* All other usecase will be handle here */
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			i2c_set = &(fctrl->i2c_data.per_frame[i]);
+
+			if ((type == FLUSH_REQ) &&
+				(i2c_set->request_id != req_id))
+				continue;
+
+			if (i2c_set->is_settings_valid == 1) {
+				rc = delete_request(i2c_set);
+				if (rc < 0)
+					CAM_ERR(CAM_FLASH,
+						"delete request: %lld rc: %d",
+						i2c_set->request_id, rc);
+
+				if (type == FLUSH_REQ) {
+					cancel_req_id_found = 1;
+					break;
+				}
+			}
+		}
+	}
+
+	if ((type == FLUSH_REQ) && (req_id != 0) &&
+			(!cancel_req_id_found))
+		CAM_DBG(CAM_FLASH,
+			"Flush request id:%lld not found in the pending list",
+			req_id);
+
+	return rc;
+}
+
+int cam_flash_flush_request(struct cam_req_mgr_flush_request *flush)
+{
+	int rc = 0;
+	struct cam_flash_ctrl *fctrl = NULL;
+
+	fctrl = (struct cam_flash_ctrl *) cam_get_device_priv(flush->dev_hdl);
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&fctrl->flash_mutex);
+	if (fctrl->flash_state == CAM_FLASH_STATE_INIT)
+		goto end;
+
+	if (flush->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		fctrl->last_flush_req = flush->req_id;
+		CAM_DBG(CAM_FLASH, "last reqest to flush is %lld",
+			flush->req_id);
+		rc = fctrl->func_tbl.flush_req(fctrl, FLUSH_ALL, 0);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "FLUSH_TYPE_ALL failed rc: %d", rc);
+			goto end;
+		}
+	} else if (flush->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+		rc = fctrl->func_tbl.flush_req(fctrl,
+				FLUSH_REQ, flush->req_id);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "FLUSH_REQ failed rc: %d", rc);
+			goto end;
+		}
+	}
+end:
+	mutex_unlock(&fctrl->flash_mutex);
+	return rc;
+}
+
+static int cam_flash_ops(struct cam_flash_ctrl *flash_ctrl,
+	struct cam_flash_frame_setting *flash_data, enum camera_flash_opcode op)
+{
+	uint32_t curr = 0, max_current = 0;
+	struct cam_flash_private_soc *soc_private = NULL;
+	int i = 0;
+
+	if (!flash_ctrl || !flash_data) {
+		CAM_ERR(CAM_FLASH, "Fctrl or Data NULL");
+		return -EINVAL;
+	}
+
+	soc_private = (struct cam_flash_private_soc *)
+		flash_ctrl->soc_info.soc_private;
+
+	if (op == CAMERA_SENSOR_FLASH_OP_FIRELOW) {
+		for (i = 0; i < flash_ctrl->torch_num_sources; i++) {
+			if (flash_ctrl->torch_trigger[i]) {
+				max_current = soc_private->torch_max_current[i];
+				if (flash_data->led_current_ma[i] <=
+					max_current)
+					curr = flash_data->led_current_ma[i];
+				else
+					curr = max_current;
+			}
+			CAM_DBG(CAM_FLASH, "Led_Torch[%d]: Current: %d",
+				i, curr);
+			cam_res_mgr_led_trigger_event(
+				flash_ctrl->torch_trigger[i], curr);
+		}
+	} else if ((op == CAMERA_SENSOR_FLASH_OP_FIREHIGH) ||
+		(op == CAMERA_SENSOR_FLASH_OP_FIREDURATION)) {
+		for (i = 0; i < flash_ctrl->flash_num_sources; i++) {
+			if (flash_ctrl->flash_trigger[i]) {
+				max_current = soc_private->flash_max_current[i];
+				if (flash_data->led_current_ma[i] <=
+					max_current)
+					curr = flash_data->led_current_ma[i];
+				else
+					curr = max_current;
+			}
+			CAM_DBG(CAM_FLASH, "LED_Flash[%d]: Current: %d",
+				i, curr);
+			cam_res_mgr_led_trigger_event(
+				flash_ctrl->flash_trigger[i], curr);
+		}
+	} else {
+		CAM_ERR(CAM_FLASH, "Wrong Operation: %d", op);
+		return -EINVAL;
+	}
+
+	if (flash_ctrl->switch_trigger) {
+#if IS_ENABLED(CONFIG_LEDS_QTI_FLASH)
+		int rc = 0;
+
+		if (op == CAMERA_SENSOR_FLASH_OP_FIREDURATION) {
+			struct flash_led_param param;
+
+			param.off_time_ms =
+				flash_data->flash_active_time_ms;
+			/* This is to dynamically change the turn on time */
+			param.on_time_ms = default_on_timer;
+			CAM_DBG(CAM_FLASH,
+				"Precise flash_on time: %u, Precise flash_off time: %u",
+				param.on_time_ms, param.off_time_ms);
+			rc = qti_flash_led_set_param(
+				flash_ctrl->switch_trigger,
+				param);
+			if (rc) {
+				CAM_ERR(CAM_FLASH,
+					"LED set param fail rc= %d", rc);
+				return rc;
+			}
+		}
+#else
+		if (op == CAMERA_SENSOR_FLASH_OP_FIREDURATION) {
+			CAM_ERR(CAM_FLASH, "FIREDURATION op not supported");
+			return -EINVAL;
+		}
+#endif
+		cam_res_mgr_led_trigger_event(
+			flash_ctrl->switch_trigger,
+			(enum led_brightness)LED_SWITCH_ON);
+	}
+
+	return 0;
+}
+
+int cam_flash_off(struct cam_flash_ctrl *flash_ctrl)
+{
+	int rc = 0;
+
+	if (!flash_ctrl) {
+		CAM_ERR(CAM_FLASH, "Flash control Null");
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_FLASH, "Flash OFF Triggered");
+	if (flash_ctrl->switch_trigger)
+		cam_res_mgr_led_trigger_event(flash_ctrl->switch_trigger,
+			(enum led_brightness)LED_SWITCH_OFF);
+
+	if ((flash_ctrl->i2c_data.streamoff_settings.is_settings_valid) &&
+		(flash_ctrl->i2c_data.streamoff_settings.request_id == 0)) {
+		flash_ctrl->apply_streamoff = true;
+		rc = cam_flash_i2c_apply_setting(flash_ctrl, 0);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+			"cannot apply streamoff settings");
+		}
+	}
+	return 0;
+}
+
+static int cam_flash_low(
+	struct cam_flash_ctrl *flash_ctrl,
+	struct cam_flash_frame_setting *flash_data)
+{
+	int i = 0, rc = 0;
+
+	if (!flash_data) {
+		CAM_ERR(CAM_FLASH, "Flash Data Null");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < flash_ctrl->flash_num_sources; i++)
+		if (flash_ctrl->flash_trigger[i])
+			cam_res_mgr_led_trigger_event(
+				flash_ctrl->flash_trigger[i],
+				LED_OFF);
+
+	rc = cam_flash_ops(flash_ctrl, flash_data,
+		CAMERA_SENSOR_FLASH_OP_FIRELOW);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Fire Torch failed: %d", rc);
+
+	return rc;
+}
+
+static int cam_flash_high(
+	struct cam_flash_ctrl *flash_ctrl,
+	struct cam_flash_frame_setting *flash_data)
+{
+	int i = 0, rc = 0;
+
+	if (!flash_data) {
+		CAM_ERR(CAM_FLASH, "Flash Data Null");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < flash_ctrl->torch_num_sources; i++)
+		if (flash_ctrl->torch_trigger[i])
+			cam_res_mgr_led_trigger_event(
+				flash_ctrl->torch_trigger[i],
+				LED_OFF);
+
+	rc = cam_flash_ops(flash_ctrl, flash_data,
+		CAMERA_SENSOR_FLASH_OP_FIREHIGH);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Fire Flash Failed: %d", rc);
+
+	return rc;
+}
+
+static int cam_flash_duration(struct cam_flash_ctrl *fctrl,
+	struct cam_flash_frame_setting *flash_data)
+{
+	int i = 0, rc = 0;
+
+	if (!flash_data) {
+		CAM_ERR(CAM_FLASH, "Flash Data NULL");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < fctrl->torch_num_sources; i++)
+		if (fctrl->torch_trigger[i])
+			cam_res_mgr_led_trigger_event(
+				fctrl->torch_trigger[i],
+				LED_OFF);
+
+	rc = cam_flash_ops(fctrl, flash_data,
+		CAMERA_SENSOR_FLASH_OP_FIREDURATION);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Fire PreciseFlash Failed: %d", rc);
+
+	return rc;
+}
+
+static int cam_flash_i2c_delete_req(struct cam_flash_ctrl *fctrl,
+	uint64_t req_id)
+{
+	int i = 0, rc = 0;
+	uint64_t top = 0, del_req_id = 0;
+
+	if (req_id != 0) {
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			if ((req_id >=
+				fctrl->i2c_data.per_frame[i].request_id) &&
+				(top <
+				fctrl->i2c_data.per_frame[i].request_id) &&
+				(fctrl->i2c_data.per_frame[i].is_settings_valid
+					== 1)) {
+				del_req_id = top;
+				top = fctrl->i2c_data.per_frame[i].request_id;
+			}
+		}
+
+		if (top < req_id) {
+			if ((((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) >= BATCH_SIZE_MAX) ||
+				(((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) <= -BATCH_SIZE_MAX))
+				del_req_id = req_id;
+		}
+
+		if (!del_req_id)
+			return rc;
+
+		CAM_DBG(CAM_FLASH, "top: %llu, del_req_id:%llu",
+			top, del_req_id);
+
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			if ((del_req_id >
+				 fctrl->i2c_data.per_frame[i].request_id) && (
+				 fctrl->i2c_data.per_frame[i].is_settings_valid
+					== 1)) {
+				fctrl->i2c_data.per_frame[i].request_id = 0;
+				rc = delete_request(
+					&(fctrl->i2c_data.per_frame[i]));
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"Delete request Fail:%lld rc:%d",
+						del_req_id, rc);
+			}
+		}
+	}
+
+	cam_flash_i2c_flush_nrt(fctrl);
+
+	return 0;
+}
+
+static int cam_flash_pmic_delete_req(struct cam_flash_ctrl *fctrl,
+	uint64_t req_id)
+{
+	int i = 0;
+	struct cam_flash_frame_setting *flash_data = NULL;
+	uint64_t top = 0, del_req_id = 0;
+	int frame_offset = 0;
+
+	if (req_id != 0) {
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			flash_data = &fctrl->per_frame[i];
+			if (req_id >= flash_data->cmn_attr.request_id &&
+				flash_data->cmn_attr.is_settings_valid
+				== 1) {
+				if (top < flash_data->cmn_attr.request_id) {
+					del_req_id = top;
+					top = flash_data->cmn_attr.request_id;
+				} else if (top >
+					flash_data->cmn_attr.request_id &&
+					del_req_id <
+					flash_data->cmn_attr.request_id) {
+					del_req_id =
+						flash_data->cmn_attr.request_id;
+				}
+			}
+		}
+
+		if (top < req_id) {
+			if ((((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) >= BATCH_SIZE_MAX) ||
+				(((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) <= -BATCH_SIZE_MAX))
+				del_req_id = req_id;
+		}
+
+		if (!del_req_id)
+			return 0;
+
+		CAM_DBG(CAM_FLASH, "top: %llu, del_req_id:%llu",
+			top, del_req_id);
+	}
+
+	/* delete the request */
+	frame_offset = del_req_id % MAX_PER_FRAME_ARRAY;
+	flash_data = &fctrl->per_frame[frame_offset];
+	flash_data->cmn_attr.request_id = 0;
+	flash_data->cmn_attr.is_settings_valid = false;
+	flash_data->cmn_attr.count = 0;
+
+	for (i = 0; i < CAM_FLASH_MAX_LED_TRIGGERS; i++)
+		flash_data->led_current_ma[i] = 0;
+
+	return 0;
+}
+
+static int32_t cam_flash_slaveInfo_pkt_parser(struct cam_flash_ctrl *fctrl,
+	uint32_t *cmd_buf, size_t len)
+{
+	int32_t rc = 0;
+	struct cam_cmd_i2c_info *i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+
+	if (len < sizeof(struct cam_cmd_i2c_info)) {
+		CAM_ERR(CAM_FLASH, "Not enough buffer");
+		return -EINVAL;
+	}
+	if (fctrl->io_master_info.master_type == CCI_MASTER) {
+		fctrl->io_master_info.cci_client->cci_i2c_master =
+			fctrl->cci_i2c_master;
+		fctrl->io_master_info.cci_client->i2c_freq_mode =
+			i2c_info->i2c_freq_mode;
+		fctrl->io_master_info.cci_client->sid =
+			i2c_info->slave_addr >> 1;
+		CAM_DBG(CAM_FLASH, "Slave addr: 0x%x Freq Mode: %d",
+			i2c_info->slave_addr, i2c_info->i2c_freq_mode);
+	} else if (fctrl->io_master_info.master_type == I2C_MASTER) {
+		fctrl->io_master_info.client->addr = i2c_info->slave_addr;
+		CAM_DBG(CAM_FLASH, "Slave addr: 0x%x", i2c_info->slave_addr);
+	} else {
+		CAM_ERR(CAM_FLASH, "Invalid Master type: %d",
+			fctrl->io_master_info.master_type);
+		 rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int cam_flash_i2c_apply_setting(struct cam_flash_ctrl *fctrl,
+	uint64_t req_id)
+{
+	struct i2c_settings_list *i2c_list;
+	struct i2c_settings_array *i2c_set = NULL;
+	int frame_offset = 0, rc = 0;
+	CAM_DBG(CAM_FLASH, "req_id=%llu", req_id);
+	if (req_id == 0) {
+		/* NonRealTime Init settings*/
+		if (fctrl->apply_streamoff == true) {
+			fctrl->apply_streamoff = false;
+			i2c_set = &fctrl->i2c_data.streamoff_settings;
+			list_for_each_entry(i2c_list,
+				&(i2c_set->list_head),
+				list) {
+				rc = cam_sensor_util_i2c_apply_setting
+					(&(fctrl->io_master_info), i2c_list);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"Failed to apply stream on settings: %d", rc);
+					return rc;
+				}
+				break;
+			}
+		} else if (fctrl->i2c_data.init_settings.is_settings_valid == true) {
+			list_for_each_entry(i2c_list,
+				&(fctrl->i2c_data.init_settings.list_head),
+				list) {
+				rc = cam_sensor_util_i2c_apply_setting
+					(&(fctrl->io_master_info), i2c_list);
+				if ((rc == -EAGAIN) &&
+					(fctrl->io_master_info.master_type ==
+					CCI_MASTER)) {
+					CAM_WARN(CAM_FLASH,
+						"CCI HW is in reset mode: Reapplying Init settings");
+					usleep_range(1000, 1010);
+					rc = cam_sensor_util_i2c_apply_setting
+					(&(fctrl->io_master_info), i2c_list);
+				}
+
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"Failed to apply init settings: %d",
+					rc);
+					return rc;
+				}
+			}
+		}
+		/* NonRealTime (Widget/RER/INIT_FIRE settings) */
+		if (fctrl->i2c_data.config_settings.is_settings_valid == true) {
+			list_for_each_entry(i2c_list,
+				&(fctrl->i2c_data.config_settings.list_head),
+				list) {
+				rc = cam_sensor_util_i2c_apply_setting
+					(&(fctrl->io_master_info), i2c_list);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"Failed to apply NRT settings: %d", rc);
+					return rc;
+				}
+			}
+		}
+	} else {
+		/* RealTime */
+		frame_offset = req_id % MAX_PER_FRAME_ARRAY;
+		i2c_set = &fctrl->i2c_data.per_frame[frame_offset];
+		if ((i2c_set->is_settings_valid == true) &&
+			(i2c_set->request_id == req_id)) {
+			list_for_each_entry(i2c_list,
+				&(i2c_set->list_head), list) {
+				rc = cam_sensor_util_i2c_apply_setting(
+					&(fctrl->io_master_info), i2c_list);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"Failed to apply settings: %d", rc);
+					return rc;
+				}
+			}
+		}
+	}
+
+	cam_flash_i2c_delete_req(fctrl, req_id);
+	return rc;
+}
+
+int cam_flash_pmic_apply_setting(struct cam_flash_ctrl *fctrl,
+	uint64_t req_id)
+{
+	int rc = 0, i = 0;
+	int frame_offset = 0;
+	uint16_t num_iterations;
+	struct cam_flash_frame_setting *flash_data = NULL;
+
+	if (req_id == 0) {
+		if (fctrl->nrt_info.cmn_attr.cmd_type ==
+			CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE) {
+			flash_data = &fctrl->nrt_info;
+			CAM_DBG(CAM_REQ,
+				"FLASH_INIT_FIRE req_id: %u flash_opcode: %d",
+				req_id, flash_data->opcode);
+
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_FIREHIGH) {
+				if (fctrl->flash_state ==
+					CAM_FLASH_STATE_START) {
+					CAM_WARN(CAM_FLASH,
+					"Wrong state :Prev state: %d",
+					fctrl->flash_state);
+					return -EINVAL;
+				}
+
+				rc = cam_flash_high(fctrl, flash_data);
+				if (rc)
+					CAM_ERR(CAM_FLASH,
+						"FLASH ON failed : %d", rc);
+			}
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_FIRELOW) {
+				if (fctrl->flash_state ==
+					CAM_FLASH_STATE_START) {
+					CAM_WARN(CAM_FLASH,
+					"Wrong state :Prev state: %d",
+					fctrl->flash_state);
+					return -EINVAL;
+				}
+
+				rc = cam_flash_low(fctrl, flash_data);
+				if (rc)
+					CAM_ERR(CAM_FLASH,
+						"TORCH ON failed : %d", rc);
+			}
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_OFF) {
+				rc = cam_flash_off(fctrl);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"LED OFF FAILED: %d",
+					rc);
+					return rc;
+				}
+			}
+		} else if (fctrl->nrt_info.cmn_attr.cmd_type ==
+			CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET) {
+			flash_data = &fctrl->nrt_info;
+			CAM_DBG(CAM_REQ,
+				"FLASH_WIDGET req_id: %u flash_opcode: %d",
+				req_id, flash_data->opcode);
+
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_FIRELOW) {
+				rc = cam_flash_low(fctrl, flash_data);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Torch ON failed : %d",
+						rc);
+					goto nrt_del_req;
+				}
+			} else if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_OFF) {
+				rc = cam_flash_off(fctrl);
+				if (rc)
+					CAM_ERR(CAM_FLASH,
+					"LED off failed: %d",
+					rc);
+			}
+		} else if (fctrl->nrt_info.cmn_attr.cmd_type ==
+			CAMERA_SENSOR_FLASH_CMD_TYPE_RER) {
+			flash_data = &fctrl->nrt_info;
+			if (fctrl->flash_state != CAM_FLASH_STATE_START) {
+				rc = cam_flash_off(fctrl);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Flash off failed: %d",
+						rc);
+					goto nrt_del_req;
+				}
+			}
+			CAM_DBG(CAM_REQ, "FLASH_RER req_id: %u", req_id);
+
+			num_iterations = flash_data->num_iterations;
+			for (i = 0; i < num_iterations; i++) {
+				/* Turn On Torch */
+				if (fctrl->flash_state ==
+					CAM_FLASH_STATE_START) {
+					rc = cam_flash_low(fctrl, flash_data);
+					if (rc) {
+						CAM_ERR(CAM_FLASH,
+							"Fire Torch Failed");
+						goto nrt_del_req;
+					}
+
+					usleep_range(
+					flash_data->led_on_delay_ms * 1000,
+					flash_data->led_on_delay_ms * 1000 +
+						100);
+				}
+				/* Turn Off Torch */
+				rc = cam_flash_off(fctrl);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Flash off failed: %d", rc);
+					continue;
+				}
+				fctrl->flash_state = CAM_FLASH_STATE_START;
+				usleep_range(
+				flash_data->led_off_delay_ms * 1000,
+				flash_data->led_off_delay_ms * 1000 + 100);
+			}
+		}
+	} else {
+		frame_offset = req_id % MAX_PER_FRAME_ARRAY;
+		flash_data = &fctrl->per_frame[frame_offset];
+		CAM_DBG(CAM_REQ, "FLASH_RT req_id: %u flash_opcode: %d",
+			req_id, flash_data->opcode);
+
+		if ((flash_data->opcode == CAMERA_SENSOR_FLASH_OP_FIREHIGH) &&
+			(flash_data->cmn_attr.is_settings_valid) &&
+			(flash_data->cmn_attr.request_id == req_id)) {
+			/* Turn On Flash */
+			if (fctrl->flash_state == CAM_FLASH_STATE_START) {
+				rc = cam_flash_high(fctrl, flash_data);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Flash ON failed: rc= %d",
+						rc);
+					goto apply_setting_err;
+				}
+			}
+		} else if ((flash_data->opcode ==
+			CAMERA_SENSOR_FLASH_OP_FIRELOW) &&
+			(flash_data->cmn_attr.is_settings_valid) &&
+			(flash_data->cmn_attr.request_id == req_id)) {
+			/* Turn On Torch */
+			if (fctrl->flash_state == CAM_FLASH_STATE_START) {
+				rc = cam_flash_low(fctrl, flash_data);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"Torch ON failed: rc= %d",
+						rc);
+					goto apply_setting_err;
+				}
+			}
+		} else if ((flash_data->opcode == CAMERA_SENSOR_FLASH_OP_OFF) &&
+			(flash_data->cmn_attr.is_settings_valid) &&
+			(flash_data->cmn_attr.request_id == req_id)) {
+			rc = cam_flash_off(fctrl);
+			if (rc) {
+				CAM_ERR(CAM_FLASH,
+					"Flash off failed %d", rc);
+				goto apply_setting_err;
+			}
+		} else if ((flash_data->opcode ==
+			CAMERA_SENSOR_FLASH_OP_FIREDURATION) &&
+			(flash_data->cmn_attr.is_settings_valid) &&
+			(flash_data->cmn_attr.request_id == req_id)) {
+			if (fctrl->flash_state == CAM_FLASH_STATE_START) {
+				rc = cam_flash_duration(fctrl, flash_data);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+						"PreciaseFlash op failed:%d",
+						rc);
+					goto apply_setting_err;
+				}
+			}
+		} else if (flash_data->opcode == CAM_PKT_NOP_OPCODE) {
+			CAM_DBG(CAM_FLASH, "NOP Packet");
+		} else {
+			rc = -EINVAL;
+			CAM_ERR(CAM_FLASH, "Invalid opcode: %d req_id: %llu",
+				flash_data->opcode, req_id);
+			goto apply_setting_err;
+		}
+	}
+
+nrt_del_req:
+	cam_flash_pmic_delete_req(fctrl, req_id);
+apply_setting_err:
+	return rc;
+}
+
+int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
+{
+	int rc = 0, i = 0;
+	uintptr_t generic_ptr;
+	uint32_t total_cmd_buf_in_bytes = 0;
+	uint32_t processed_cmd_buf_in_bytes = 0;
+	uint16_t cmd_length_in_bytes = 0;
+	uint32_t *cmd_buf =  NULL;
+	uint32_t *offset = NULL;
+	uint32_t frm_offset = 0;
+	size_t len_of_buffer;
+	size_t remain_len;
+	struct cam_flash_init *flash_init = NULL;
+	struct common_header  *cmn_hdr = NULL;
+	struct cam_control *ioctl_ctrl = NULL;
+	struct cam_packet *csl_packet = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct cam_config_dev_cmd config;
+	struct cam_req_mgr_add_request add_req;
+	struct i2c_data_settings *i2c_data = NULL;
+	struct i2c_settings_array *i2c_reg_settings = NULL;
+	struct cam_sensor_power_ctrl_t *power_info = NULL;
+
+	if (!fctrl || !arg) {
+		CAM_ERR(CAM_FLASH, "fctrl/arg is NULL");
+		return -EINVAL;
+	}
+	/* getting CSL Packet */
+	ioctl_ctrl = (struct cam_control *)arg;
+
+	if (copy_from_user((&config), (void __user *) ioctl_ctrl->handle,
+		sizeof(config))) {
+		CAM_ERR(CAM_FLASH, "Copy cmd handle from user failed");
+		return -EFAULT;
+	}
+
+	rc = cam_mem_get_cpu_buf(config.packet_handle,
+		&generic_ptr, &len_of_buffer);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "Failed in getting the packet : %d", rc);
+		return rc;
+	}
+	remain_len = len_of_buffer;
+	if ((sizeof(struct cam_packet) > len_of_buffer) ||
+		((size_t)config.offset >= len_of_buffer -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_FLASH,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len_of_buffer);
+		return -EINVAL;
+	}
+
+	remain_len -= (size_t)config.offset;
+	/* Add offset to the flash csl header */
+	csl_packet = (struct cam_packet *)(generic_ptr + config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_FLASH, "Invalid packet params");
+		return -EINVAL;
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) !=
+		CAM_FLASH_PACKET_OPCODE_INIT &&
+		csl_packet->header.request_id <= fctrl->last_flush_req
+		&& fctrl->last_flush_req != 0) {
+		CAM_DBG(CAM_FLASH,
+			"reject request %lld, last request to flush %lld",
+			csl_packet->header.request_id, fctrl->last_flush_req);
+		return -EINVAL;
+	}
+
+	if (csl_packet->header.request_id > fctrl->last_flush_req)
+		fctrl->last_flush_req = 0;
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_FLASH_PACKET_OPCODE_INIT: {
+		/* INIT packet*/
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+		/* Loop through multiple command buffers */
+		for (i = 1; i < csl_packet->num_cmd_buf; i++) {
+			rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+			if (rc)
+				return rc;
+
+			total_cmd_buf_in_bytes = cmd_desc[i].length;
+			processed_cmd_buf_in_bytes = 0;
+			if (!total_cmd_buf_in_bytes)
+				continue;
+			rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+				&generic_ptr, &len_of_buffer);
+			if (rc < 0) {
+				CAM_ERR(CAM_FLASH, "Failed to get cpu buf");
+				return rc;
+			}
+			cmd_buf = (uint32_t *)generic_ptr;
+			if (!cmd_buf) {
+				CAM_ERR(CAM_FLASH, "invalid cmd buf");
+				return -EINVAL;
+			}
+
+			if ((len_of_buffer < sizeof(struct common_header)) ||
+				(cmd_desc[i].offset >
+				(len_of_buffer -
+				sizeof(struct common_header)))) {
+				CAM_ERR(CAM_FLASH, "invalid cmd buf length");
+				return -EINVAL;
+			}
+			remain_len = len_of_buffer - cmd_desc[i].offset;
+			cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+			cmn_hdr = (struct common_header *)cmd_buf;
+
+			/* Loop through cmd formats in one cmd buffer */
+			CAM_DBG(CAM_FLASH,
+				"command Type: %d,Processed: %d,Total: %d",
+				cmn_hdr->cmd_type, processed_cmd_buf_in_bytes,
+				total_cmd_buf_in_bytes);
+			switch (cmn_hdr->cmd_type) {
+			case CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO:
+				if (len_of_buffer <
+					sizeof(struct cam_flash_init)) {
+					CAM_ERR(CAM_FLASH, "Not enough buffer");
+					return -EINVAL;
+				}
+
+				flash_init = (struct cam_flash_init *)cmd_buf;
+				fctrl->flash_type = flash_init->flash_type;
+				cmd_length_in_bytes =
+					sizeof(struct cam_flash_init);
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/
+						sizeof(uint32_t);
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				rc = cam_flash_slaveInfo_pkt_parser(
+					fctrl, cmd_buf, remain_len);
+				if (rc < 0) {
+					CAM_ERR(CAM_FLASH,
+					"Failed parsing slave info: rc: %d",
+					rc);
+					return rc;
+				}
+				cmd_length_in_bytes =
+					sizeof(struct cam_cmd_i2c_info);
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/
+						sizeof(uint32_t);
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
+			case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
+				CAM_DBG(CAM_FLASH,
+					"Received power settings");
+				cmd_length_in_bytes =
+					total_cmd_buf_in_bytes;
+				rc = cam_sensor_update_power_settings(
+					cmd_buf,
+					total_cmd_buf_in_bytes,
+					&fctrl->power_info, remain_len);
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/
+						sizeof(uint32_t);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"Failed update power settings");
+					return rc;
+				}
+				break;
+			default:
+				CAM_DBG(CAM_FLASH,
+					"Received initSettings");
+				i2c_data = &(fctrl->i2c_data);
+				i2c_reg_settings =
+					&fctrl->i2c_data.init_settings;
+
+				i2c_reg_settings->request_id = 0;
+				i2c_reg_settings->is_settings_valid = 1;
+				rc = cam_sensor_i2c_command_parser(
+					&fctrl->io_master_info,
+					i2c_reg_settings,
+					&cmd_desc[i], 1, NULL);
+				if (rc < 0) {
+					CAM_ERR(CAM_FLASH,
+					"pkt parsing failed: %d", rc);
+					return rc;
+				}
+				cmd_length_in_bytes =
+					cmd_desc[i].length;
+				processed_cmd_buf_in_bytes +=
+					cmd_length_in_bytes;
+				cmd_buf += cmd_length_in_bytes/
+						sizeof(uint32_t);
+
+				break;
+			}
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+		}
+		power_info = &fctrl->power_info;
+		if (!power_info) {
+			CAM_ERR(CAM_FLASH, "Power_info is NULL");
+			return -EINVAL;
+		}
+
+		/* Parse and fill vreg params for power up settings */
+		rc = msm_camera_fill_vreg_params(&fctrl->soc_info,
+			power_info->power_setting,
+			power_info->power_setting_size);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"failed to fill vreg params for power up rc:%d",
+				rc);
+			return rc;
+		}
+
+		/* Parse and fill vreg params for power down settings*/
+		rc = msm_camera_fill_vreg_params(
+			&fctrl->soc_info,
+			power_info->power_down_setting,
+			power_info->power_down_setting_size);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"failed to fill vreg params power down rc:%d",
+				rc);
+			return rc;
+		}
+
+		rc = fctrl->func_tbl.power_ops(fctrl, true);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"Enable Regulator Failed rc = %d", rc);
+			return rc;
+		}
+
+		rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "cannot apply settings rc = %d", rc);
+			return rc;
+		}
+
+		fctrl->flash_state = CAM_FLASH_STATE_CONFIG;
+		break;
+	}
+	case CAM_FLASH_PACKET_OPCODE_SET_OPS: {
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		frm_offset = csl_packet->header.request_id %
+			MAX_PER_FRAME_ARRAY;
+		/* add support for handling i2c_data*/
+		i2c_reg_settings =
+			&fctrl->i2c_data.per_frame[frm_offset];
+		if (i2c_reg_settings->is_settings_valid == true) {
+			CAM_DBG(CAM_FLASH, "settings already valid");
+			i2c_reg_settings->request_id = 0;
+			i2c_reg_settings->is_settings_valid = false;
+			goto update_req_mgr;
+		}
+		i2c_reg_settings->is_settings_valid = true;
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_sensor_i2c_command_parser(
+			&fctrl->io_master_info,
+			i2c_reg_settings, cmd_desc, 1, NULL);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+			"Failed in parsing i2c packets");
+			return rc;
+		}
+		if ((fctrl->flash_state == CAM_FLASH_STATE_ACQUIRE) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_CONFIG)) {
+			fctrl->flash_state = CAM_FLASH_STATE_CONFIG;
+			rc = fctrl->func_tbl.apply_setting(fctrl, 1);
+			if (rc) {
+				CAM_ERR(CAM_FLASH, "cannot apply fire settings rc = %d", rc);
+				return rc;
+			}
+			return rc;
+		}
+		break;
+	}
+	case CAM_FLASH_PACKET_OPCODE_NON_REALTIME_SET_OPS: {
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+
+		/* add support for handling i2c_data*/
+		i2c_reg_settings = &fctrl->i2c_data.config_settings;
+		if (i2c_reg_settings->is_settings_valid == true) {
+			i2c_reg_settings->request_id = 0;
+			i2c_reg_settings->is_settings_valid = false;
+
+			rc = delete_request(i2c_reg_settings);
+			if (rc) {
+				CAM_ERR(CAM_FLASH,
+				"Failed in Deleting the err: %d", rc);
+				return rc;
+			}
+		}
+		i2c_reg_settings->is_settings_valid = true;
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_sensor_i2c_command_parser(
+			&fctrl->io_master_info,
+			i2c_reg_settings, cmd_desc, 1, NULL);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+			"Failed in parsing i2c NRT packets");
+			return rc;
+		}
+		rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+		if (rc)
+			CAM_ERR(CAM_FLASH,
+			"Apply setting failed: %d", rc);
+		return rc;
+	}
+	case CAM_PKT_NOP_OPCODE: {
+		frm_offset = csl_packet->header.request_id %
+			MAX_PER_FRAME_ARRAY;
+		if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_ACQUIRE)) {
+			CAM_WARN(CAM_FLASH,
+				"Rxed NOP packets without linking");
+			fctrl->i2c_data.per_frame[frm_offset].is_settings_valid
+				= false;
+			return 0;
+		}
+		i2c_reg_settings =
+			&fctrl->i2c_data.per_frame[frm_offset];
+		i2c_reg_settings->is_settings_valid = true;
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+		CAM_DBG(CAM_FLASH, "NOP Packet is Received: req_id: %u",
+			csl_packet->header.request_id);
+		goto update_req_mgr;
+	}
+	case CAM_FLASH_PACKET_OPCODE_STREAM_OFF: {
+		if (fctrl->streamoff_count > 0)
+			return rc;
+
+		CAM_DBG(CAM_FLASH, "Received Stream off Settings");
+		i2c_data = &(fctrl->i2c_data);
+		fctrl->streamoff_count = fctrl->streamoff_count + 1;
+		i2c_reg_settings       = &i2c_data->streamoff_settings;
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload +
+			csl_packet->cmd_buf_offset);
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_sensor_i2c_command_parser(&fctrl->io_master_info,
+				i2c_reg_settings,
+				cmd_desc, 1, NULL);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+			"Failed in parsing i2c Stream off packets");
+			return rc;
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_FLASH, "Wrong Opcode : %d",
+			(csl_packet->header.op_code & 0xFFFFFF));
+		return -EINVAL;
+	}
+update_req_mgr:
+	if (((csl_packet->header.op_code  & 0xFFFFF) ==
+		CAM_PKT_NOP_OPCODE) ||
+		((csl_packet->header.op_code & 0xFFFFF) ==
+		CAM_FLASH_PACKET_OPCODE_SET_OPS)) {
+		memset(&add_req, 0, sizeof(add_req));
+		add_req.link_hdl = fctrl->bridge_intf.link_hdl;
+		add_req.req_id = csl_packet->header.request_id;
+		add_req.dev_hdl = fctrl->bridge_intf.device_hdl;
+
+		if ((csl_packet->header.op_code & 0xFFFFF) ==
+			CAM_FLASH_PACKET_OPCODE_SET_OPS) {
+			add_req.trigger_eof = true;
+			add_req.skip_at_sof = 1;
+		}
+
+		if (fctrl->bridge_intf.crm_cb &&
+			fctrl->bridge_intf.crm_cb->add_req) {
+			rc = fctrl->bridge_intf.crm_cb->add_req(&add_req);
+			if  (rc) {
+				CAM_ERR(CAM_FLASH,
+					"Failed in adding request: %llu to request manager",
+					csl_packet->header.request_id);
+				return rc;
+			}
+			CAM_DBG(CAM_FLASH,
+				"add req %lld to req_mgr, trigger_eof %d",
+				add_req.req_id, add_req.trigger_eof);
+		}
+	}
+	cam_mem_put_cpu_buf(config.packet_handle);
+	return rc;
+}
+
+int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
+{
+	int rc = 0, i = 0;
+	uintptr_t generic_ptr, cmd_buf_ptr;
+	uint32_t *cmd_buf =  NULL;
+	uint32_t *offset = NULL;
+	uint32_t frm_offset = 0;
+	size_t len_of_buffer;
+	size_t remain_len;
+	struct cam_control *ioctl_ctrl = NULL;
+	struct cam_packet *csl_packet = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct common_header *cmn_hdr;
+	struct cam_config_dev_cmd config;
+	struct cam_req_mgr_add_request add_req = {0};
+	struct cam_flash_init *cam_flash_info = NULL;
+	struct cam_flash_set_rer *flash_rer_info = NULL;
+	struct cam_flash_set_on_off *flash_operation_info = NULL;
+	struct cam_flash_query_curr *flash_query_info = NULL;
+	struct cam_flash_frame_setting *flash_data = NULL;
+	struct cam_flash_private_soc *soc_private = NULL;
+
+	if (!fctrl || !arg) {
+		CAM_ERR(CAM_FLASH, "fctrl/arg is NULL");
+		return -EINVAL;
+	}
+
+	soc_private = (struct cam_flash_private_soc *)
+		fctrl->soc_info.soc_private;
+
+	/* getting CSL Packet */
+	ioctl_ctrl = (struct cam_control *)arg;
+
+	if (copy_from_user((&config),
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(config))) {
+		CAM_ERR(CAM_FLASH, "Copy cmd handle from user failed");
+		rc = -EFAULT;
+		return rc;
+	}
+
+	rc = cam_mem_get_cpu_buf(config.packet_handle,
+		&generic_ptr, &len_of_buffer);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "Failed in getting the packet: %d", rc);
+		return rc;
+	}
+
+	remain_len = len_of_buffer;
+	if ((sizeof(struct cam_packet) > len_of_buffer) ||
+		((size_t)config.offset >= len_of_buffer -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_FLASH,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len_of_buffer);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	remain_len -= (size_t)config.offset;
+	/* Add offset to the flash csl header */
+	csl_packet = (struct cam_packet *)(generic_ptr + config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_FLASH, "Invalid packet params");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) !=
+		CAM_FLASH_PACKET_OPCODE_INIT &&
+		csl_packet->header.request_id <= fctrl->last_flush_req
+		&& fctrl->last_flush_req != 0) {
+		CAM_WARN(CAM_FLASH,
+			"reject request %lld, last request to flush %d",
+			csl_packet->header.request_id, fctrl->last_flush_req);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (csl_packet->header.request_id > fctrl->last_flush_req)
+		fctrl->last_flush_req = 0;
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_FLASH_PACKET_OPCODE_INIT: {
+		/* INIT packet*/
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+			&cmd_buf_ptr, &len_of_buffer);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
+			return rc;
+		}
+		if ((len_of_buffer < sizeof(struct cam_flash_init)) ||
+			(cmd_desc->offset >
+			(len_of_buffer - sizeof(struct cam_flash_init)))) {
+			CAM_ERR(CAM_FLASH, "Not enough buffer");
+			rc = -EINVAL;
+			return rc;
+		}
+		remain_len = len_of_buffer - cmd_desc->offset;
+		cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
+			cmd_desc->offset);
+		cam_flash_info = (struct cam_flash_init *)cmd_buf;
+
+		switch (cam_flash_info->cmd_type) {
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO: {
+			CAM_DBG(CAM_FLASH, "INIT_INFO CMD CALLED");
+			fctrl->flash_init_setting.cmn_attr.request_id = 0;
+			fctrl->flash_init_setting.cmn_attr.is_settings_valid =
+				true;
+			fctrl->flash_type = cam_flash_info->flash_type;
+			fctrl->is_regulator_enabled = false;
+			fctrl->nrt_info.cmn_attr.cmd_type =
+				CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO;
+
+			fctrl->flash_state =
+				CAM_FLASH_STATE_CONFIG;
+			break;
+		}
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE: {
+			CAM_DBG(CAM_FLASH, "INIT_FIRE Operation");
+
+			if (remain_len < sizeof(struct cam_flash_set_on_off)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				return rc;
+			}
+
+			flash_operation_info =
+				(struct cam_flash_set_on_off *) cmd_buf;
+			if (!flash_operation_info) {
+				CAM_ERR(CAM_FLASH,
+					"flash_operation_info Null");
+				rc = -EINVAL;
+				return rc;
+			}
+			if (flash_operation_info->count >
+				CAM_FLASH_MAX_LED_TRIGGERS) {
+				CAM_ERR(CAM_FLASH, "led count out of limit");
+				rc = -EINVAL;
+				return rc;
+			}
+			fctrl->nrt_info.cmn_attr.count =
+				flash_operation_info->count;
+			fctrl->nrt_info.cmn_attr.request_id = 0;
+			fctrl->nrt_info.opcode =
+				flash_operation_info->opcode;
+			fctrl->nrt_info.cmn_attr.cmd_type =
+				CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE;
+			for (i = 0;
+				i < flash_operation_info->count; i++)
+				fctrl->nrt_info.led_current_ma[i] =
+				flash_operation_info->led_current_ma[i];
+
+			rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+			if (rc)
+				CAM_ERR(CAM_FLASH,
+					"Apply setting failed: %d",
+					rc);
+
+			fctrl->flash_state = CAM_FLASH_STATE_CONFIG;
+			break;
+		}
+		default:
+			CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
+				cam_flash_info->cmd_type);
+			rc = -EINVAL;
+			return rc;
+		}
+
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		break;
+	}
+	case CAM_FLASH_PACKET_OPCODE_SET_OPS: {
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		frm_offset = csl_packet->header.request_id %
+			MAX_PER_FRAME_ARRAY;
+		flash_data = &fctrl->per_frame[frm_offset];
+
+		if (flash_data->cmn_attr.is_settings_valid == true) {
+			flash_data->cmn_attr.request_id = 0;
+			flash_data->cmn_attr.is_settings_valid = false;
+			for (i = 0; i < flash_data->cmn_attr.count; i++)
+				flash_data->led_current_ma[i] = 0;
+		}
+
+		flash_data->cmn_attr.request_id = csl_packet->header.request_id;
+		flash_data->cmn_attr.is_settings_valid = true;
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+			&cmd_buf_ptr, &len_of_buffer);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "Fail in get buffer: 0x%x",
+				cmd_desc->mem_handle);
+			return rc;
+		}
+
+		if ((len_of_buffer < sizeof(struct common_header)) ||
+			(cmd_desc->offset >
+			(len_of_buffer - sizeof(struct common_header)))) {
+			CAM_ERR(CAM_FLASH, "not enough buffer");
+			rc = -EINVAL;
+			return rc;
+		}
+		remain_len = len_of_buffer - cmd_desc->offset;
+
+		cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
+			cmd_desc->offset);
+		if (!cmd_buf) {
+			rc = -EINVAL;
+			return rc;
+		}
+		cmn_hdr = (struct common_header *)cmd_buf;
+
+		switch (cmn_hdr->cmd_type) {
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_FIRE: {
+			CAM_DBG(CAM_FLASH,
+				"CAMERA_SENSOR_FLASH_CMD_TYPE_FIRE cmd called, req:%lld",
+				csl_packet->header.request_id);
+			if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+				(fctrl->flash_state ==
+					CAM_FLASH_STATE_ACQUIRE)) {
+				CAM_WARN(CAM_FLASH,
+					"Rxed Flash fire ops without linking");
+				flash_data->cmn_attr.is_settings_valid = false;
+				return -EINVAL;
+			}
+			if (remain_len < sizeof(struct cam_flash_set_on_off)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				return rc;
+			}
+
+			flash_operation_info =
+				(struct cam_flash_set_on_off *) cmd_buf;
+			if (!flash_operation_info) {
+				CAM_ERR(CAM_FLASH,
+					"flash_operation_info Null");
+				rc = -EINVAL;
+				return rc;
+			}
+			if (flash_operation_info->count >
+				CAM_FLASH_MAX_LED_TRIGGERS) {
+				CAM_ERR(CAM_FLASH, "led count out of limit");
+				rc = -EINVAL;
+				return rc;
+			}
+
+			flash_data->opcode = flash_operation_info->opcode;
+			flash_data->cmn_attr.count =
+				flash_operation_info->count;
+			for (i = 0; i < flash_operation_info->count; i++)
+				flash_data->led_current_ma[i]
+				= flash_operation_info->led_current_ma[i];
+
+			CAM_DBG(CAM_FLASH,
+				"FLASH_CMD_TYPE op:%d, req:%lld",
+				flash_data->opcode, csl_packet->header.request_id);
+
+			if (flash_data->opcode ==
+				CAMERA_SENSOR_FLASH_OP_FIREDURATION) {
+				add_req.trigger_eof = true;
+				/* Active time for the preflash */
+				flash_data->flash_active_time_ms =
+				div_u64(flash_operation_info->time_on_duration_ns, 1000000);
+				CAM_DBG(CAM_FLASH,
+					"PRECISE FLASH: active_time: %llu",
+					flash_data->flash_active_time_ms);
+			}
+		}
+		break;
+		default:
+			CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
+				cmn_hdr->cmd_type);
+			rc = -EINVAL;
+			return rc;
+		}
+
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		break;
+	}
+	case CAM_FLASH_PACKET_OPCODE_NON_REALTIME_SET_OPS: {
+		offset = (uint32_t *)((uint8_t *)&csl_packet->payload_flex +
+			csl_packet->cmd_buf_offset);
+		fctrl->nrt_info.cmn_attr.is_settings_valid = true;
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+			&cmd_buf_ptr, &len_of_buffer);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
+			return rc;
+		}
+
+		if ((len_of_buffer < sizeof(struct common_header)) ||
+			(cmd_desc->offset >
+			(len_of_buffer - sizeof(struct common_header)))) {
+			CAM_ERR(CAM_FLASH, "Not enough buffer");
+			rc = -EINVAL;
+			return rc;
+		}
+		remain_len = len_of_buffer - cmd_desc->offset;
+		cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
+			cmd_desc->offset);
+		cmn_hdr = (struct common_header *)cmd_buf;
+
+		switch (cmn_hdr->cmd_type) {
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET: {
+			CAM_DBG(CAM_FLASH, "Widget Flash Operation");
+			if (remain_len < sizeof(struct cam_flash_set_on_off)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				return rc;
+			}
+			flash_operation_info =
+				(struct cam_flash_set_on_off *) cmd_buf;
+			if (!flash_operation_info) {
+				CAM_ERR(CAM_FLASH,
+					"flash_operation_info Null");
+				rc = -EINVAL;
+				return rc;
+			}
+			if (flash_operation_info->count >
+				CAM_FLASH_MAX_LED_TRIGGERS) {
+				CAM_ERR(CAM_FLASH, "led count out of limit");
+				rc = -EINVAL;
+				return rc;
+			}
+
+			fctrl->nrt_info.cmn_attr.count =
+				flash_operation_info->count;
+			fctrl->nrt_info.cmn_attr.request_id = 0;
+			fctrl->nrt_info.opcode =
+				flash_operation_info->opcode;
+			fctrl->nrt_info.cmn_attr.cmd_type =
+				CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET;
+
+			for (i = 0; i < flash_operation_info->count; i++)
+				fctrl->nrt_info.led_current_ma[i] =
+					flash_operation_info->led_current_ma[i];
+
+			rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+			if (rc)
+				CAM_ERR(CAM_FLASH, "Apply setting failed: %d",
+					rc);
+			return rc;
+		}
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_QUERYCURR: {
+			int query_curr_ma = 0;
+
+			if (remain_len < sizeof(struct cam_flash_query_curr)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				return rc;
+			}
+			flash_query_info =
+				(struct cam_flash_query_curr *)cmd_buf;
+
+			rc = cam_flash_led_prepare(fctrl->switch_trigger,
+				BIT(2), &query_curr_ma,
+				soc_private->is_wled_flash);
+
+			CAM_DBG(CAM_FLASH, "query_curr_ma = %d",
+				query_curr_ma);
+			if (rc) {
+				CAM_ERR(CAM_FLASH,
+				"Query current failed with rc=%d", rc);
+				return rc;
+			}
+			flash_query_info->query_current_ma = query_curr_ma;
+			break;
+		}
+		case CAMERA_SENSOR_FLASH_CMD_TYPE_RER: {
+			rc = 0;
+			if (remain_len < sizeof(struct cam_flash_set_rer)) {
+				CAM_ERR(CAM_FLASH, "Not enough buffer");
+				rc = -EINVAL;
+				return rc;
+			}
+			flash_rer_info = (struct cam_flash_set_rer *)cmd_buf;
+			if (!flash_rer_info) {
+				CAM_ERR(CAM_FLASH,
+					"flash_rer_info Null");
+				rc = -EINVAL;
+				return rc;
+			}
+			if (flash_rer_info->count >
+				CAM_FLASH_MAX_LED_TRIGGERS) {
+				CAM_ERR(CAM_FLASH, "led count out of limit");
+				rc = -EINVAL;
+				return rc;
+			}
+
+			fctrl->nrt_info.cmn_attr.cmd_type =
+				CAMERA_SENSOR_FLASH_CMD_TYPE_RER;
+			fctrl->nrt_info.opcode = flash_rer_info->opcode;
+			fctrl->nrt_info.cmn_attr.count = flash_rer_info->count;
+			fctrl->nrt_info.cmn_attr.request_id = 0;
+			fctrl->nrt_info.num_iterations =
+				flash_rer_info->num_iteration;
+			fctrl->nrt_info.led_on_delay_ms =
+				flash_rer_info->led_on_delay_ms;
+			fctrl->nrt_info.led_off_delay_ms =
+				flash_rer_info->led_off_delay_ms;
+
+			for (i = 0; i < flash_rer_info->count; i++)
+				fctrl->nrt_info.led_current_ma[i] =
+					flash_rer_info->led_current_ma[i];
+
+			rc = fctrl->func_tbl.apply_setting(fctrl, 0);
+			if (rc)
+				CAM_ERR(CAM_FLASH, "apply_setting failed: %d",
+					rc);
+			return rc;
+		}
+		default:
+			CAM_ERR(CAM_FLASH, "Wrong cmd_type : %d",
+				cmn_hdr->cmd_type);
+			rc = -EINVAL;
+			return rc;
+		}
+
+		cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+		break;
+	}
+	case CAM_PKT_NOP_OPCODE: {
+		frm_offset = csl_packet->header.request_id %
+			MAX_PER_FRAME_ARRAY;
+		if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_ACQUIRE)) {
+			CAM_WARN(CAM_FLASH,
+				"Rxed NOP packets without linking");
+			fctrl->per_frame[frm_offset].cmn_attr.is_settings_valid
+				= false;
+			return -EINVAL;
+		}
+
+		fctrl->per_frame[frm_offset].cmn_attr.is_settings_valid = false;
+		fctrl->per_frame[frm_offset].cmn_attr.request_id = 0;
+		fctrl->per_frame[frm_offset].opcode = CAM_PKT_NOP_OPCODE;
+		CAM_DBG(CAM_FLASH, "NOP Packet is Received: req_id: %llu",
+			csl_packet->header.request_id);
+		break;
+	}
+	default:
+		CAM_ERR(CAM_FLASH, "Wrong Opcode : %d",
+			(csl_packet->header.op_code & 0xFFFFFF));
+		rc = -EINVAL;
+		return rc;
+	}
+
+	if (((csl_packet->header.op_code  & 0xFFFFF) ==
+		CAM_PKT_NOP_OPCODE) ||
+		((csl_packet->header.op_code & 0xFFFFF) ==
+		CAM_FLASH_PACKET_OPCODE_SET_OPS)) {
+		memset(&add_req, 0, sizeof(add_req));
+		add_req.link_hdl = fctrl->bridge_intf.link_hdl;
+		add_req.req_id = csl_packet->header.request_id;
+		add_req.dev_hdl = fctrl->bridge_intf.device_hdl;
+
+		if ((csl_packet->header.op_code & 0xFFFFF) ==
+			CAM_FLASH_PACKET_OPCODE_SET_OPS) {
+			add_req.trigger_eof = true;
+			if (flash_data->opcode == CAMERA_SENSOR_FLASH_OP_OFF) {
+				add_req.skip_at_sof = 1;
+				add_req.skip_at_eof = 1;
+			} else
+				add_req.skip_at_sof = 1;
+		}
+
+		if (fctrl->bridge_intf.crm_cb &&
+			fctrl->bridge_intf.crm_cb->add_req) {
+			rc = fctrl->bridge_intf.crm_cb->add_req(&add_req);
+			if  (rc) {
+				CAM_ERR(CAM_FLASH,
+					"Failed in adding request: %llu to request manager",
+					csl_packet->header.request_id);
+				return rc;
+			}
+			CAM_DBG(CAM_FLASH,
+				"add req %lld to req_mgr, trigger_eof %d",
+				add_req.req_id, add_req.trigger_eof);
+		}
+	}
+
+	cam_mem_put_cpu_buf(config.packet_handle);
+	return rc;
+}
+
+int cam_flash_publish_dev_info(struct cam_req_mgr_device_info *info)
+{
+	info->dev_id = CAM_REQ_MGR_DEVICE_FLASH;
+	strscpy(info->name, CAM_FLASH_NAME, sizeof(info->name));
+	info->p_delay = CAM_FLASH_PIPELINE_DELAY;
+	info->trigger = CAM_TRIGGER_POINT_SOF;
+	return 0;
+}
+
+int cam_flash_establish_link(struct cam_req_mgr_core_dev_link_setup *link)
+{
+	struct cam_flash_ctrl *fctrl = NULL;
+
+	if (!link)
+		return -EINVAL;
+
+	fctrl = (struct cam_flash_ctrl *)cam_get_device_priv(link->dev_hdl);
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, " Device data is NULL");
+		return -EINVAL;
+	}
+	mutex_lock(&fctrl->flash_mutex);
+	if (link->link_enable) {
+		fctrl->bridge_intf.link_hdl = link->link_hdl;
+		fctrl->bridge_intf.crm_cb = link->crm_cb;
+	} else {
+		fctrl->bridge_intf.link_hdl = -1;
+		fctrl->bridge_intf.crm_cb = NULL;
+	}
+	mutex_unlock(&fctrl->flash_mutex);
+
+	return 0;
+}
+
+int cam_flash_release_dev(struct cam_flash_ctrl *fctrl)
+{
+	int rc = 0;
+
+	if (fctrl->i2c_data.streamoff_settings.is_settings_valid == true) {
+		fctrl->i2c_data.streamoff_settings.is_settings_valid = false;
+		rc = delete_request(&fctrl->i2c_data.streamoff_settings);
+		if (rc) {
+			CAM_WARN(CAM_FLASH,
+				"Failed to delete Stream off i2c_setting: %d",
+				rc);
+		}
+	}
+
+	if (fctrl->bridge_intf.device_hdl != 1) {
+		rc = cam_destroy_device_hdl(fctrl->bridge_intf.device_hdl);
+		if (rc)
+			CAM_ERR(CAM_FLASH,
+				"Failed in destroying device handle rc = %d",
+				rc);
+		fctrl->bridge_intf.device_hdl = -1;
+		fctrl->bridge_intf.link_hdl = -1;
+		fctrl->bridge_intf.session_hdl = -1;
+		fctrl->last_flush_req = 0;
+		fctrl->streamoff_count = 0;
+	}
+
+	return rc;
+}
+
+void cam_flash_shutdown(struct cam_flash_ctrl *fctrl)
+{
+	int rc;
+
+	if (fctrl->flash_state == CAM_FLASH_STATE_INIT)
+		return;
+
+	if ((fctrl->flash_state == CAM_FLASH_STATE_CONFIG) ||
+		(fctrl->flash_state == CAM_FLASH_STATE_START)) {
+		fctrl->func_tbl.flush_req(fctrl, FLUSH_ALL, 0);
+		rc = cam_flash_off(fctrl);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"LED OFF FAILED: %d", rc);
+		}
+		if (fctrl->func_tbl.power_ops) {
+			rc = fctrl->func_tbl.power_ops(fctrl, false);
+			if (rc)
+				CAM_ERR(CAM_FLASH, "Power Down Failed rc: %d",
+					rc);
+		}
+	}
+
+	rc = cam_flash_release_dev(fctrl);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Release failed rc: %d", rc);
+
+	fctrl->flash_state = CAM_FLASH_STATE_INIT;
+}
+
+int cam_flash_apply_request(struct cam_req_mgr_apply_request *apply)
+{
+	int rc = 0;
+	struct cam_flash_ctrl *fctrl = NULL;
+
+	if (!apply)
+		return -EINVAL;
+
+	fctrl = (struct cam_flash_ctrl *) cam_get_device_priv(apply->dev_hdl);
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&fctrl->flash_mutex);
+	rc = fctrl->func_tbl.apply_setting(fctrl, apply->request_id);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "apply_setting failed with rc=%d",
+			rc);
+	mutex_unlock(&fctrl->flash_mutex);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_core.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FLASH_CORE_H_
+#define _CAM_FLASH_CORE_H_
+
+#include <media/cam_sensor.h>
+#include "cam_flash_dev.h"
+
+int cam_flash_publish_dev_info(struct cam_req_mgr_device_info *info);
+int cam_flash_establish_link(struct cam_req_mgr_core_dev_link_setup *link);
+int cam_flash_apply_request(struct cam_req_mgr_apply_request *apply);
+int cam_flash_process_evt(struct cam_req_mgr_link_evt_data *event_data);
+int cam_flash_flush_request(struct cam_req_mgr_flush_request *flush);
+int cam_flash_led_prepare(struct led_trigger *trigger, int options,
+	int *max_current, bool is_wled);
+
+
+#endif /*_CAM_FLASH_CORE_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_dev.c
@@ -0,0 +1,774 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include "cam_flash_dev.h"
+#include "cam_flash_soc.h"
+#include "cam_flash_core.h"
+#include "cam_common_util.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+static int32_t cam_flash_driver_cmd(struct cam_flash_ctrl *fctrl,
+		void *arg, struct cam_flash_private_soc *soc_private)
+{
+	int rc = 0;
+	int i = 0;
+	struct cam_control *cmd = (struct cam_control *)arg;
+
+	if (!fctrl || !arg) {
+		CAM_ERR(CAM_FLASH, "fctrl/arg is NULL with arg:%pK fctrl%pK",
+			fctrl, arg);
+		return -EINVAL;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_FLASH, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&(fctrl->flash_mutex));
+	switch (cmd->op_code) {
+	case CAM_ACQUIRE_DEV: {
+		struct cam_sensor_acquire_dev flash_acq_dev;
+		struct cam_create_dev_hdl bridge_params;
+
+		CAM_DBG(CAM_FLASH, "CAM_ACQUIRE_DEV");
+
+		if (fctrl->flash_state != CAM_FLASH_STATE_INIT) {
+			CAM_ERR(CAM_FLASH,
+				"Cannot apply Acquire dev: Prev state: %d",
+				fctrl->flash_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (fctrl->bridge_intf.device_hdl != -1) {
+			CAM_ERR(CAM_FLASH, "Device is already acquired");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		rc = copy_from_user(&flash_acq_dev,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(flash_acq_dev));
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "Failed Copying from User");
+			goto release_mutex;
+		}
+
+		bridge_params.session_hdl = flash_acq_dev.session_handle;
+		bridge_params.ops = &fctrl->bridge_intf.ops;
+		bridge_params.v4l2_sub_dev_flag = 0;
+		bridge_params.media_entity_flag = 0;
+		bridge_params.priv = fctrl;
+		bridge_params.dev_id = CAM_FLASH;
+
+		flash_acq_dev.device_handle =
+			cam_create_device_hdl(&bridge_params);
+		if (flash_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_FLASH, "Can not create device handle");
+			goto release_mutex;
+		}
+		fctrl->bridge_intf.device_hdl =
+			flash_acq_dev.device_handle;
+		fctrl->bridge_intf.session_hdl =
+			flash_acq_dev.session_handle;
+		fctrl->apply_streamoff = false;
+
+		rc = copy_to_user(u64_to_user_ptr(cmd->handle),
+			&flash_acq_dev,
+			sizeof(struct cam_sensor_acquire_dev));
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "Failed Copy to User with rc = %d",
+				rc);
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		fctrl->flash_state = CAM_FLASH_STATE_ACQUIRE;
+		break;
+	}
+	case CAM_RELEASE_DEV: {
+		CAM_DBG(CAM_FLASH, "CAM_RELEASE_DEV");
+		if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_START)) {
+			CAM_WARN(CAM_FLASH,
+				"Wrong state for Release dev: Prev state:%d",
+				fctrl->flash_state);
+		}
+
+		if (fctrl->bridge_intf.device_hdl == -1 &&
+			fctrl->flash_state == CAM_FLASH_STATE_ACQUIRE) {
+			CAM_ERR(CAM_FLASH,
+				"Invalid Handle: Link Hdl: %d device hdl: %d",
+				fctrl->bridge_intf.device_hdl,
+				fctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (fctrl->bridge_intf.link_hdl != -1) {
+			CAM_ERR(CAM_FLASH,
+				"Device [%d] still active on link 0x%x",
+				fctrl->flash_state,
+				fctrl->bridge_intf.link_hdl);
+			rc = -EAGAIN;
+			goto release_mutex;
+		}
+
+		if ((fctrl->flash_state == CAM_FLASH_STATE_CONFIG) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_START))
+			fctrl->func_tbl.flush_req(fctrl, FLUSH_ALL, 0);
+
+		if (cam_flash_release_dev(fctrl))
+			CAM_WARN(CAM_FLASH,
+				"Failed in destroying the device Handle");
+
+		if (fctrl->func_tbl.power_ops) {
+			if (fctrl->func_tbl.power_ops(fctrl, false))
+				CAM_WARN(CAM_FLASH, "Power Down Failed");
+		}
+
+		fctrl->streamoff_count = 0;
+		fctrl->flash_state = CAM_FLASH_STATE_INIT;
+		break;
+	}
+	case CAM_QUERY_CAP: {
+		struct cam_flash_query_cap_info flash_cap = {0};
+
+		CAM_DBG(CAM_FLASH, "CAM_QUERY_CAP");
+		flash_cap.slot_info  = fctrl->soc_info.index;
+		flash_cap.flash_type = soc_private->flash_type;
+		for (i = 0; i < fctrl->flash_num_sources; i++) {
+			flash_cap.max_current_flash[i] =
+				soc_private->flash_max_current[i];
+			flash_cap.max_duration_flash[i] =
+				soc_private->flash_max_duration[i];
+		}
+
+		for (i = 0; i < fctrl->torch_num_sources; i++)
+			flash_cap.max_current_torch[i] =
+				soc_private->torch_max_current[i];
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&flash_cap, sizeof(struct cam_flash_query_cap_info))) {
+			CAM_ERR(CAM_FLASH, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		break;
+	}
+	case CAM_START_DEV: {
+		CAM_DBG(CAM_FLASH, "CAM_START_DEV");
+		if ((fctrl->flash_state == CAM_FLASH_STATE_INIT) ||
+			(fctrl->flash_state == CAM_FLASH_STATE_START)) {
+			CAM_WARN(CAM_FLASH,
+				"Cannot apply Start Dev: Prev state: %d",
+				fctrl->flash_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		fctrl->apply_streamoff = false;
+		fctrl->flash_state = CAM_FLASH_STATE_START;
+		break;
+	}
+	case CAM_STOP_DEV: {
+		CAM_DBG(CAM_FLASH, "CAM_STOP_DEV ENTER");
+		if (fctrl->flash_state != CAM_FLASH_STATE_START) {
+			CAM_WARN(CAM_FLASH,
+				"Cannot apply Stop dev: Prev state is: %d",
+				fctrl->flash_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		fctrl->func_tbl.flush_req(fctrl, FLUSH_ALL, 0);
+		fctrl->last_flush_req = 0;
+		cam_flash_off(fctrl);
+		fctrl->flash_state = CAM_FLASH_STATE_ACQUIRE;
+		break;
+	}
+	case CAM_CONFIG_DEV: {
+		CAM_DBG(CAM_FLASH, "CAM_CONFIG_DEV");
+		rc = fctrl->func_tbl.parser(fctrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_FLASH, "Failed Flash Config: rc=%d\n", rc);
+			goto release_mutex;
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_FLASH, "Invalid Opcode: %d", cmd->op_code);
+		rc = -EINVAL;
+	}
+
+release_mutex:
+	mutex_unlock(&(fctrl->flash_mutex));
+	return rc;
+}
+
+static int32_t cam_flash_init_default_params(struct cam_flash_ctrl *fctrl)
+{
+	/* Validate input parameters */
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "failed: invalid params fctrl %pK",
+			fctrl);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_FLASH,
+		"master_type: %d", fctrl->io_master_info.master_type);
+	/* Initialize cci_client */
+	if (fctrl->io_master_info.master_type == CCI_MASTER) {
+		fctrl->io_master_info.cci_client = kzalloc(sizeof(
+			struct cam_sensor_cci_client), GFP_KERNEL);
+		if (!(fctrl->io_master_info.cci_client))
+			return -ENOMEM;
+	} else if (fctrl->io_master_info.master_type == I2C_MASTER) {
+		if (!(fctrl->io_master_info.client))
+			return -EINVAL;
+	} else {
+		CAM_ERR(CAM_FLASH,
+			"Invalid master / Master type Not supported");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static const struct of_device_id cam_flash_dt_match[] = {
+	{.compatible = "qcom,camera-flash", .data = NULL},
+	{}
+};
+
+static int cam_flash_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_flash_ctrl *fctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Flash ctrl ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&fctrl->flash_mutex);
+	cam_flash_shutdown(fctrl);
+	mutex_unlock(&fctrl->flash_mutex);
+
+	return 0;
+}
+
+static int cam_flash_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_FLASH, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_flash_subdev_close_internal(sd, fh);
+}
+
+static long cam_flash_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int rc = 0;
+	struct cam_flash_ctrl *fctrl = NULL;
+	struct cam_flash_private_soc *soc_private = NULL;
+
+	CAM_DBG(CAM_FLASH, "Enter");
+
+	fctrl = v4l2_get_subdevdata(sd);
+	soc_private = fctrl->soc_info.soc_private;
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL: {
+		rc = cam_flash_driver_cmd(fctrl, arg,
+			soc_private);
+		if (rc)
+			CAM_ERR(CAM_FLASH,
+				"Failed in driver cmd: %d", rc);
+		break;
+	}
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_flash_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR(CAM_FLASH, "Invalid ioctl cmd type");
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	CAM_DBG(CAM_FLASH, "Exit");
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_flash_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_FLASH,
+			"Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL: {
+		rc = cam_flash_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc)
+			CAM_ERR(CAM_FLASH, "cam_flash_ioctl failed");
+		break;
+	}
+	default:
+		CAM_ERR(CAM_FLASH, "Invalid compat ioctl cmd_type:%d",
+			cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_FLASH,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+int cam_flash_i2c_driver_remove_common(struct i2c_client *client)
+{
+	int rc = 0;
+	struct cam_flash_ctrl *fctrl = i2c_get_clientdata(client);
+	/* Handle I2C Devices */
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Flash device is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+	CAM_INFO(CAM_FLASH, "i2c driver remove invoked");
+	/*Free Allocated Mem */
+	kfree(fctrl->i2c_data.per_frame);
+	fctrl->i2c_data.per_frame = NULL;
+	kfree(fctrl);
+
+	return 0;
+}
+
+static struct v4l2_subdev_core_ops cam_flash_subdev_core_ops = {
+	.ioctl = cam_flash_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_flash_subdev_do_ioctl
+#endif
+};
+
+static struct v4l2_subdev_ops cam_flash_subdev_ops = {
+	.core = &cam_flash_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cam_flash_internal_ops = {
+	.close = cam_flash_subdev_close,
+};
+
+static int cam_flash_init_subdev(struct cam_flash_ctrl *fctrl)
+{
+	int rc = 0;
+
+	strscpy(fctrl->device_name, CAM_FLASH_NAME,
+		sizeof(fctrl->device_name));
+	fctrl->v4l2_dev_str.internal_ops =
+		&cam_flash_internal_ops;
+	fctrl->v4l2_dev_str.ops = &cam_flash_subdev_ops;
+	fctrl->v4l2_dev_str.name = CAMX_FLASH_DEV_NAME;
+	fctrl->v4l2_dev_str.sd_flags =
+		V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+	fctrl->v4l2_dev_str.ent_function = CAM_FLASH_DEVICE_TYPE;
+	fctrl->v4l2_dev_str.token = fctrl;
+	fctrl->v4l2_dev_str.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(fctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_FLASH, "Fail to create subdev with %d", rc);
+
+	return rc;
+}
+
+static int cam_flash_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t rc = 0, i = 0;
+	struct cam_flash_ctrl *fctrl = NULL;
+	struct device_node *of_parent = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+	struct cam_hw_soc_info *soc_info = NULL;
+
+	CAM_DBG(CAM_FLASH, "Binding flash component");
+	if (!pdev->dev.of_node) {
+		CAM_ERR(CAM_FLASH, "of_node NULL");
+		return -EINVAL;
+	}
+
+	fctrl = kzalloc(sizeof(struct cam_flash_ctrl), GFP_KERNEL);
+	if (!fctrl)
+		return -ENOMEM;
+
+	fctrl->pdev = pdev;
+	fctrl->of_node = pdev->dev.of_node;
+	fctrl->soc_info.pdev = pdev;
+	fctrl->soc_info.dev = &pdev->dev;
+	fctrl->soc_info.dev_name = pdev->name;
+
+	platform_set_drvdata(pdev, fctrl);
+
+	rc = cam_flash_get_dt_data(fctrl, &fctrl->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "cam_flash_get_dt_data failed with %d", rc);
+		kfree(fctrl);
+		return -EINVAL;
+	}
+
+	if (of_find_property(pdev->dev.of_node, "cci-master", NULL)) {
+		/* Get CCI master */
+		rc = of_property_read_u32(pdev->dev.of_node, "cci-master",
+			&fctrl->cci_i2c_master);
+		CAM_DBG(CAM_FLASH, "cci-master %d, rc %d",
+			fctrl->cci_i2c_master, rc);
+		if (rc < 0) {
+			/* Set default master 0 */
+			fctrl->cci_i2c_master = MASTER_0;
+			rc = 0;
+		}
+
+		fctrl->io_master_info.master_type = CCI_MASTER;
+		rc = cam_flash_init_default_params(fctrl);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"failed: cam_flash_init_default_params rc %d",
+				rc);
+			return rc;
+		}
+
+		of_parent = of_get_parent(pdev->dev.of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&fctrl->cci_num) < 0)
+		/* Set default master 0 */
+			fctrl->cci_num = CCI_DEVICE_0;
+
+		fctrl->io_master_info.cci_client->cci_device = fctrl->cci_num;
+		CAM_DBG(CAM_FLASH, "cci-index %d", fctrl->cci_num, rc);
+
+		soc_info = &fctrl->soc_info;
+		rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
+			&fctrl->power_info.gpio_num_info);
+		if ((rc < 0) || (!fctrl->power_info.gpio_num_info)) {
+			CAM_ERR(CAM_FLASH, "No/Error Flash GPIOs");
+			return -EINVAL;
+		}
+		rc = cam_sensor_util_regulator_powerup(soc_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_FLASH, "regulator power up for flash failed %d",  rc);
+			return rc;
+		}
+
+		fctrl->i2c_data.per_frame =
+			kzalloc(sizeof(struct i2c_settings_array) *
+			MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+		if (fctrl->i2c_data.per_frame == NULL) {
+			CAM_ERR(CAM_FLASH, "No Memory");
+			rc = -ENOMEM;
+			goto free_cci_resource;
+		}
+
+		INIT_LIST_HEAD(&(fctrl->i2c_data.init_settings.list_head));
+		INIT_LIST_HEAD(&(fctrl->i2c_data.config_settings.list_head));
+		INIT_LIST_HEAD(&(fctrl->i2c_data.streamoff_settings.list_head));
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
+			INIT_LIST_HEAD(
+				&(fctrl->i2c_data.per_frame[i].list_head));
+
+		fctrl->func_tbl.parser = cam_flash_i2c_pkt_parser;
+		fctrl->func_tbl.apply_setting = cam_flash_i2c_apply_setting;
+		fctrl->func_tbl.power_ops = cam_flash_i2c_power_ops;
+		fctrl->func_tbl.flush_req = cam_flash_i2c_flush_request;
+	} else {
+		/* PMIC Flash */
+		fctrl->func_tbl.parser = cam_flash_pmic_pkt_parser;
+		fctrl->func_tbl.apply_setting = cam_flash_pmic_apply_setting;
+		fctrl->func_tbl.power_ops = NULL;
+		fctrl->func_tbl.flush_req = cam_flash_pmic_flush_request;
+	}
+
+	rc = cam_flash_init_subdev(fctrl);
+	if (rc) {
+		if (fctrl->io_master_info.cci_client != NULL)
+			goto free_cci_resource;
+		else
+			goto free_resource;
+	}
+
+	fctrl->bridge_intf.device_hdl = -1;
+	fctrl->bridge_intf.link_hdl = -1;
+	fctrl->bridge_intf.ops.get_dev_info = cam_flash_publish_dev_info;
+	fctrl->bridge_intf.ops.link_setup = cam_flash_establish_link;
+	fctrl->bridge_intf.ops.apply_req = cam_flash_apply_request;
+	fctrl->bridge_intf.ops.flush_req = cam_flash_flush_request;
+	fctrl->last_flush_req = 0;
+
+	mutex_init(&(fctrl->flash_mutex));
+
+	fctrl->flash_state = CAM_FLASH_STATE_INIT;
+	CAM_DBG(CAM_FLASH, "Component bound successfully");
+	return rc;
+
+free_cci_resource:
+	kfree(fctrl->io_master_info.cci_client);
+	fctrl->io_master_info.cci_client = NULL;
+free_resource:
+	kfree(fctrl->i2c_data.per_frame);
+	kfree(fctrl->soc_info.soc_private);
+	cam_soc_util_release_platform_resource(&fctrl->soc_info);
+	fctrl->i2c_data.per_frame = NULL;
+	fctrl->soc_info.soc_private = NULL;
+	kfree(fctrl);
+	fctrl = NULL;
+	return rc;
+}
+
+static void cam_flash_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_flash_ctrl *fctrl;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	fctrl = platform_get_drvdata(pdev);
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "Flash device is NULL");
+		return;
+	}
+
+	mutex_lock(&fctrl->flash_mutex);
+	cam_flash_shutdown(fctrl);
+	mutex_unlock(&fctrl->flash_mutex);
+	cam_unregister_subdev(&(fctrl->v4l2_dev_str));
+	cam_flash_put_source_node_data(fctrl);
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&fctrl->v4l2_dev_str.sd, NULL);
+	kfree(fctrl);
+	CAM_INFO(CAM_FLASH, "Flash Sensor component unbind");
+}
+
+const static struct component_ops cam_flash_component_ops = {
+	.bind = cam_flash_component_bind,
+	.unbind = cam_flash_component_unbind,
+};
+
+static int cam_flash_platform_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_flash_component_ops);
+	return 0;
+}
+
+static int32_t cam_flash_platform_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_FLASH, "Adding Flash Sensor component");
+	rc = component_add(&pdev->dev, &cam_flash_component_ops);
+	if (rc)
+		CAM_ERR(CAM_FLASH, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int32_t cam_flash_i2c_driver_probe(struct i2c_client *client)
+{
+	int32_t rc = 0, i = 0;
+	struct cam_flash_ctrl *fctrl;
+	struct cam_hw_soc_info *soc_info = NULL;
+
+	if (client == NULL) {
+		CAM_ERR(CAM_FLASH, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_FLASH, "%s :: i2c_check_functionality failed",
+			 client->name);
+		return -EFAULT;
+	}
+
+	/* Create sensor control structure */
+	fctrl = kzalloc(sizeof(*fctrl), GFP_KERNEL);
+	if (!fctrl)
+		return -ENOMEM;
+
+	client->dev.driver_data = fctrl;
+	fctrl->io_master_info.client = client;
+	fctrl->of_node = client->dev.of_node;
+	fctrl->soc_info.dev = &client->dev;
+	fctrl->soc_info.dev_name = client->name;
+	fctrl->io_master_info.master_type = I2C_MASTER;
+
+	rc = cam_flash_get_dt_data(fctrl, &fctrl->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "failed: cam_sensor_parse_dt rc %d", rc);
+		goto free_ctrl;
+	}
+
+	rc = cam_flash_init_default_params(fctrl);
+	if (rc) {
+		CAM_ERR(CAM_FLASH,
+				"failed: cam_flash_init_default_params rc %d",
+				rc);
+		goto free_ctrl;
+	}
+
+	soc_info = &fctrl->soc_info;
+	rc = cam_sensor_util_regulator_powerup(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_FLASH, "regulator power up for flash failed %d",
+				rc);
+		goto free_ctrl;
+	}
+
+	if (!soc_info->gpio_data) {
+		CAM_DBG(CAM_FLASH, "No GPIO found");
+		rc = 0;
+		return rc;
+	}
+
+	if (!soc_info->gpio_data->cam_gpio_common_tbl_size) {
+		CAM_DBG(CAM_FLASH, "No GPIO found");
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
+			&fctrl->power_info.gpio_num_info);
+	if ((rc < 0) || (!fctrl->power_info.gpio_num_info)) {
+		CAM_ERR(CAM_FLASH, "No/Error Flash GPIOs");
+		goto free_ctrl;
+	}
+
+	rc = cam_flash_init_subdev(fctrl);
+	if (rc)
+		goto free_ctrl;
+
+	fctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (fctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto unreg_subdev;
+	}
+
+	INIT_LIST_HEAD(&(fctrl->i2c_data.init_settings.list_head));
+	INIT_LIST_HEAD(&(fctrl->i2c_data.config_settings.list_head));
+	INIT_LIST_HEAD(&(fctrl->i2c_data.streamoff_settings.list_head));
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
+		INIT_LIST_HEAD(&(fctrl->i2c_data.per_frame[i].list_head));
+
+	fctrl->func_tbl.parser = cam_flash_i2c_pkt_parser;
+	fctrl->func_tbl.apply_setting = cam_flash_i2c_apply_setting;
+	fctrl->func_tbl.power_ops = cam_flash_i2c_power_ops;
+	fctrl->func_tbl.flush_req = cam_flash_i2c_flush_request;
+
+	fctrl->bridge_intf.device_hdl = -1;
+	fctrl->bridge_intf.link_hdl = -1;
+	fctrl->bridge_intf.ops.get_dev_info = cam_flash_publish_dev_info;
+	fctrl->bridge_intf.ops.link_setup = cam_flash_establish_link;
+	fctrl->bridge_intf.ops.apply_req = cam_flash_apply_request;
+	fctrl->bridge_intf.ops.flush_req = cam_flash_flush_request;
+	fctrl->last_flush_req = 0;
+
+	mutex_init(&(fctrl->flash_mutex));
+	fctrl->flash_state = CAM_FLASH_STATE_INIT;
+
+	return rc;
+
+unreg_subdev:
+	cam_unregister_subdev(&(fctrl->v4l2_dev_str));
+free_ctrl:
+	kfree(fctrl);
+	fctrl = NULL;
+	return rc;
+}
+
+MODULE_DEVICE_TABLE(of, cam_flash_dt_match);
+
+struct platform_driver cam_flash_platform_driver = {
+	.probe = cam_flash_platform_probe,
+	.remove = cam_flash_platform_remove,
+	.driver = {
+		.name = "CAM-FLASH-DRIVER",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_flash_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+static const struct i2c_device_id i2c_id[] = {
+	{FLASH_DRIVER_I2C, (kernel_ulong_t)NULL},
+	{ }
+};
+
+static struct i2c_driver cam_flash_i2c_driver = {
+	.id_table = i2c_id,
+	.probe  = cam_flash_i2c_driver_probe,
+	.remove = cam_flash_i2c_driver_remove,
+	.driver = {
+		.name = FLASH_DRIVER_I2C,
+		.of_match_table = cam_flash_dt_match,
+	},
+};
+
+int32_t cam_flash_init_module(void)
+{
+	int32_t rc = 0;
+
+	rc = platform_driver_register(&cam_flash_platform_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_FLASH, "platform probe failed rc: %d", rc);
+		return rc;
+	}
+
+	rc = i2c_add_driver(&cam_flash_i2c_driver);
+	if (rc < 0)
+		CAM_ERR(CAM_FLASH, "i2c_add_driver failed rc: %d", rc);
+
+	return rc;
+}
+
+void cam_flash_exit_module(void)
+{
+	platform_driver_unregister(&cam_flash_platform_driver);
+	i2c_del_driver(&cam_flash_i2c_driver);
+}
+
+MODULE_DESCRIPTION("CAM FLASH");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_dev.h
@@ -0,0 +1,253 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FLASH_DEV_H_
+#define _CAM_FLASH_DEV_H_
+
+#include <linux/leds.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-event.h>
+#include <media/cam_sensor.h>
+#include <media/cam_req_mgr.h>
+
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2)
+#include <linux/leds-qpnp-flash.h>
+#elif IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+#include <linux/leds-qti-flash.h>
+#endif
+
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_interface.h"
+#include "cam_subdev.h"
+#include "cam_mem_mgr.h"
+#include "cam_sensor_cmn_header.h"
+#include "cam_sensor_util.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_sensor_io.h"
+#include "cam_flash_core.h"
+#include "cam_context.h"
+
+#define CAMX_FLASH_DEV_NAME "cam-flash-dev"
+
+#define CAM_FLASH_PIPELINE_DELAY 1
+
+#define FLASH_DRIVER_I2C "i2c_flash"
+
+#define CAM_FLASH_PACKET_OPCODE_INIT                 0
+#define CAM_FLASH_PACKET_OPCODE_SET_OPS              1
+#define CAM_FLASH_PACKET_OPCODE_NON_REALTIME_SET_OPS 2
+#define CAM_FLASH_PACKET_OPCODE_STREAM_OFF           3
+
+struct cam_flash_ctrl;
+
+enum cam_flash_switch_trigger_ops {
+	LED_SWITCH_OFF = 0,
+	LED_SWITCH_ON,
+};
+
+enum cam_flash_state {
+	CAM_FLASH_STATE_INIT,
+	CAM_FLASH_STATE_ACQUIRE,
+	CAM_FLASH_STATE_CONFIG,
+	CAM_FLASH_STATE_START,
+};
+
+enum cam_flash_flush_type {
+	FLUSH_ALL = 0,
+	FLUSH_REQ,
+	FLUSH_MAX,
+};
+
+/**
+ * struct cam_flash_intf_params
+ * @device_hdl   : Device Handle
+ * @session_hdl  : Session Handle
+ * @link_hdl     : Link Handle
+ * @ops          : KMD operations
+ * @crm_cb       : Callback API pointers
+ */
+struct cam_flash_intf_params {
+	int32_t                     device_hdl;
+	int32_t                     session_hdl;
+	int32_t                     link_hdl;
+	struct cam_req_mgr_kmd_ops  ops;
+	struct cam_req_mgr_crm_cb  *crm_cb;
+};
+
+/**
+ * struct cam_flash_common_attr
+ * @is_settings_valid  : Notify the valid settings
+ * @request_id         : Request id provided by umd
+ * @count              : Number of led count
+ * @cmd_type           : Command buffer type
+ */
+struct cam_flash_common_attr {
+	bool      is_settings_valid;
+	uint64_t  request_id;
+	uint32_t  count;
+	uint8_t   cmd_type;
+};
+
+/**
+ * struct flash_init_packet
+ * @cmn_attr   : Provides common attributes
+ * @flash_type : Flash type(PMIC/I2C/GPIO)
+ */
+struct cam_flash_init_packet {
+	struct cam_flash_common_attr  cmn_attr;
+	uint32_t                      flash_type;
+};
+
+/**
+ * struct flash_frame_setting
+ * @cmn_attr             : Provides common attributes
+ * @num_iterations       : Iterations used to perform RER
+ * @led_on_delay_ms      : LED on time in milisec
+ * @led_off_delay_ms     : LED off time in milisec
+ * @opcode               : Command buffer opcode
+ * @led_current_ma[]     : LED current array in miliamps
+ * @flash_active_time_ms : Flash_On time with precise flash
+ */
+struct cam_flash_frame_setting {
+	struct cam_flash_common_attr cmn_attr;
+	uint16_t                     num_iterations;
+	uint16_t                     led_on_delay_ms;
+	uint16_t                     led_off_delay_ms;
+	int8_t                       opcode;
+	uint32_t                     led_current_ma[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint64_t                     flash_active_time_ms;
+};
+
+/**
+ *  struct cam_flash_private_soc
+ * @switch_trigger_name : Switch trigger name
+ * @flash_trigger_name  : Flash trigger name array
+ * @flash_op_current    : Flash operational current
+ * @flash_max_current   : Max supported current for LED in flash mode
+ * @flash_max_duration  : Max turn on duration for LED in Flash mode
+ * @torch_trigger_name  : Torch trigger name array
+ * @torch_op_current    : Torch operational current
+ * @torch_max_current   : Max supported current for LED in torch mode
+ * @is_wled_flash       : Detection between WLED/LED flash
+ * @flash_type          : Flash type
+ */
+
+struct cam_flash_private_soc {
+	const char   *switch_trigger_name;
+	const char   *flash_trigger_name[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     flash_op_current[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     flash_max_current[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     flash_max_duration[CAM_FLASH_MAX_LED_TRIGGERS];
+	const char   *torch_trigger_name[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     torch_op_current[CAM_FLASH_MAX_LED_TRIGGERS];
+	uint32_t     torch_max_current[CAM_FLASH_MAX_LED_TRIGGERS];
+	bool         is_wled_flash;
+	uint32_t     flash_type;
+};
+
+struct cam_flash_func_tbl {
+	int (*parser)(struct cam_flash_ctrl *fctrl, void *arg);
+	int (*apply_setting)(struct cam_flash_ctrl *fctrl, uint64_t req_id);
+	int (*power_ops)(struct cam_flash_ctrl *fctrl, bool regulator_enable);
+	int (*flush_req)(struct cam_flash_ctrl *fctrl,
+		enum cam_flash_flush_type type, uint64_t req_id);
+};
+
+/**
+ *  struct cam_flash_ctrl
+ * @device_name         : Device name
+ * @soc_info            : Soc related information
+ * @pdev                : Platform device
+ * @per_frame[]         : Per_frame setting array
+ * @nrt_info            : NonRealTime settings
+ * @of_node             : Of Node ptr
+ * @v4l2_dev_str        : V4L2 device structure
+ * @bridge_intf         : CRM interface
+ * @flash_init_setting  : Init command buffer structure
+ * @switch_trigger      : Switch trigger ptr
+ * @flash_num_sources   : Number of flash sources
+ * @torch_num_source    : Number of torch sources
+ * @flash_mutex         : Mutex for flash operations
+ * @flash_state         : Current flash state (LOW/OFF/ON/INIT)
+ * @flash_type          : Flash types (PMIC/I2C/GPIO)
+ * @is_regulator_enable : Regulator disable/enable notifier
+ * @func_tbl            : Function table for different HW
+ *	                      (e.g. i2c/pmic/gpio)
+ * @flash_trigger       : Flash trigger ptr
+ * @torch_trigger       : Torch trigger ptr
+ * @cci_i2c_master      : I2C structure
+ * @cci_device_num      : cci parent cell index
+ * @io_master_info      : Information about the communication master
+ * @i2c_data            : I2C register settings
+ * @last_flush_req      : last request to flush
+ * @streamoff_count     : Count to hold the number of times stream off called
+ * @apply_streamoff     : variable to store when to apply stream off
+ */
+struct cam_flash_ctrl {
+	char device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct cam_hw_soc_info              soc_info;
+	struct platform_device             *pdev;
+	struct cam_sensor_power_ctrl_t      power_info;
+	struct cam_flash_frame_setting      per_frame[MAX_PER_FRAME_ARRAY];
+	struct cam_flash_frame_setting      nrt_info;
+	struct device_node                 *of_node;
+	struct cam_subdev                   v4l2_dev_str;
+	struct cam_flash_intf_params        bridge_intf;
+	struct cam_flash_init_packet        flash_init_setting;
+	struct led_trigger                 *switch_trigger;
+	uint32_t                            flash_num_sources;
+	uint32_t                            torch_num_sources;
+	struct mutex                        flash_mutex;
+	enum   cam_flash_state              flash_state;
+	uint8_t                             flash_type;
+	bool                                is_regulator_enabled;
+	struct cam_flash_func_tbl           func_tbl;
+	struct led_trigger           *flash_trigger[CAM_FLASH_MAX_LED_TRIGGERS];
+	struct led_trigger           *torch_trigger[CAM_FLASH_MAX_LED_TRIGGERS];
+/* I2C related setting */
+	enum   cci_i2c_master_t             cci_i2c_master;
+	enum   cci_device_num               cci_num;
+	struct camera_io_master             io_master_info;
+	struct i2c_data_settings            i2c_data;
+	uint32_t                            last_flush_req;
+	uint32_t                            streamoff_count;
+	int32_t                             apply_streamoff;
+};
+
+int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg);
+int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg);
+int cam_flash_pmic_apply_setting(struct cam_flash_ctrl *fctrl, uint64_t req_id);
+int cam_flash_i2c_apply_setting(struct cam_flash_ctrl *fctrl, uint64_t req_id);
+int cam_flash_off(struct cam_flash_ctrl *fctrl);
+int cam_flash_pmic_power_ops(struct cam_flash_ctrl *fctrl,
+	bool regulator_enable);
+int cam_flash_i2c_power_ops(struct cam_flash_ctrl *fctrl,
+	bool regulator_enable);
+int cam_flash_i2c_flush_request(struct cam_flash_ctrl *fctrl,
+	enum cam_flash_flush_type type, uint64_t req_id);
+int cam_flash_pmic_flush_request(struct cam_flash_ctrl *fctrl,
+	enum cam_flash_flush_type, uint64_t req_id);
+void cam_flash_shutdown(struct cam_flash_ctrl *fctrl);
+int cam_flash_release_dev(struct cam_flash_ctrl *fctrl);
+
+/**
+ * @brief : API to register FLASH hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int32_t cam_flash_init_module(void);
+
+/**
+ * @brief : API to remove FLASH Hw from platform framework.
+ */
+void cam_flash_exit_module(void);
+#endif /*_CAM_FLASH_DEV_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_soc.c
@@ -0,0 +1,324 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include "cam_flash_soc.h"
+#include "cam_res_mgr_api.h"
+#include <dt-bindings/msm-camera.h>
+
+void cam_flash_put_source_node_data(struct cam_flash_ctrl *fctrl)
+{
+	uint32_t count = 0, i = 0;
+	struct cam_flash_private_soc *soc_private = NULL;
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "NULL flash control structure");
+		return;
+	}
+
+	soc_private = fctrl->soc_info.soc_private;
+
+	if (fctrl->switch_trigger) {
+		CAM_DBG(CAM_FLASH, "switch trigger: %s",
+			soc_private->switch_trigger_name);
+		cam_res_mgr_led_trigger_unregister(fctrl->switch_trigger);
+	}
+
+	if (fctrl->flash_num_sources) {
+		if (fctrl->flash_num_sources > CAM_FLASH_MAX_LED_TRIGGERS) {
+			CAM_ERR(CAM_FLASH, "Invalid LED count: %d", count);
+			return;
+		}
+
+		count = fctrl->flash_num_sources;
+
+		for (i = 0; i < count; i++) {
+			CAM_DBG(CAM_FLASH, "Flash default trigger %s",
+				soc_private->flash_trigger_name[i]);
+			cam_res_mgr_led_trigger_unregister(
+				fctrl->flash_trigger[i]);
+		}
+	}
+
+	if (fctrl->torch_num_sources) {
+		if (fctrl->torch_num_sources > CAM_FLASH_MAX_LED_TRIGGERS) {
+			CAM_ERR(CAM_FLASH, "Invalid LED count: %d", count);
+			return;
+		}
+
+		count = fctrl->torch_num_sources;
+
+		for (i = 0; i < count; i++) {
+			CAM_DBG(CAM_FLASH, "Flash default trigger %s",
+				soc_private->flash_trigger_name[i]);
+			cam_res_mgr_led_trigger_unregister(
+				fctrl->torch_trigger[i]);
+		}
+	}
+}
+
+static int32_t cam_get_source_node_info(
+	struct device_node *of_node,
+	struct cam_flash_ctrl *fctrl,
+	struct cam_flash_private_soc *soc_private)
+{
+	int32_t rc = 0;
+	uint32_t count = 0, i = 0;
+	struct device_node *flash_src_node = NULL;
+	struct device_node *torch_src_node = NULL;
+	struct device_node *switch_src_node = NULL;
+
+	soc_private->is_wled_flash =
+		of_property_read_bool(of_node, "wled-flash-support");
+
+	rc = of_property_read_u32(of_node, "flash-type", &soc_private->flash_type);
+	if (rc) {
+		CAM_ERR(CAM_FLASH,
+			"flash-type read failed rc=%d", rc);
+		soc_private->flash_type = CAM_FLASH_TYPE_PMIC; // default to PMIC flash
+	}
+
+	switch_src_node = of_parse_phandle(of_node, "switch-source", 0);
+	if (!switch_src_node) {
+		CAM_WARN(CAM_FLASH, "switch_src_node NULL");
+	} else {
+		rc = of_property_read_string(switch_src_node,
+			"qcom,default-led-trigger",
+			&soc_private->switch_trigger_name);
+		if (rc) {
+			CAM_ERR(CAM_FLASH,
+				"default-led-trigger read failed rc=%d", rc);
+		} else {
+			CAM_DBG(CAM_FLASH, "switch trigger %s",
+				soc_private->switch_trigger_name);
+			cam_res_mgr_led_trigger_register(
+				soc_private->switch_trigger_name,
+				&fctrl->switch_trigger);
+		}
+
+		of_node_put(switch_src_node);
+	}
+
+	if (of_get_property(of_node, "flash-source", &count)) {
+		count /= sizeof(uint32_t);
+
+		if (count > CAM_FLASH_MAX_LED_TRIGGERS) {
+			CAM_ERR(CAM_FLASH, "Invalid LED count: %d", count);
+			return -EINVAL;
+		}
+
+		fctrl->flash_num_sources = count;
+
+		for (i = 0; i < count; i++) {
+			flash_src_node = of_parse_phandle(of_node,
+				"flash-source", i);
+			if (!flash_src_node) {
+				CAM_WARN(CAM_FLASH, "flash_src_node NULL");
+				continue;
+			}
+
+			rc = of_property_read_string(flash_src_node,
+				"qcom,default-led-trigger",
+				&soc_private->flash_trigger_name[i]);
+			if (rc) {
+				CAM_WARN(CAM_FLASH,
+				"defalut-led-trigger read failed rc=%d", rc);
+				of_node_put(flash_src_node);
+				continue;
+			}
+
+			CAM_DBG(CAM_FLASH, "Flash default trigger %s",
+				soc_private->flash_trigger_name[i]);
+			cam_res_mgr_led_trigger_register(
+				soc_private->flash_trigger_name[i],
+				&fctrl->flash_trigger[i]);
+
+			if (soc_private->is_wled_flash) {
+				rc = cam_flash_led_prepare(
+					fctrl->flash_trigger[i],
+					BIT(2), &soc_private->flash_max_current[i],
+					true);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"WLED FLASH max_current read fail: %d",
+						rc);
+					of_node_put(flash_src_node);
+					rc = 0;
+					continue;
+				}
+			} else {
+				rc = of_property_read_u32(flash_src_node,
+					"qcom,max-current",
+					&soc_private->flash_max_current[i]);
+				rc &= of_property_read_u32(flash_src_node,
+					"qcom,max-current-ma",
+					&soc_private->flash_max_current[i]);
+				if (rc < 0) {
+					CAM_WARN(CAM_FLASH,
+					"LED FLASH max-current read fail: %d",
+						rc);
+					of_node_put(flash_src_node);
+					continue;
+				}
+			}
+
+			/* Read operational-current */
+			rc = of_property_read_u32(flash_src_node,
+				"qcom,current-ma",
+				&soc_private->flash_op_current[i]);
+			if (rc) {
+				CAM_DBG(CAM_FLASH, "op-current: read failed");
+				rc = 0;
+			}
+
+			/* Read max-duration */
+			rc = of_property_read_u32(flash_src_node,
+				"qcom,duration-ms",
+				&soc_private->flash_max_duration[i]);
+			if (rc) {
+				CAM_DBG(CAM_FLASH,
+					"max-duration prop unavailable: %d",
+					rc);
+				rc = 0;
+			}
+			of_node_put(flash_src_node);
+
+			CAM_DBG(CAM_FLASH, "MainFlashMaxCurrent[%d]: %d",
+				i, soc_private->flash_max_current[i]);
+		}
+	}
+
+	if (of_get_property(of_node, "torch-source", &count)) {
+		count /= sizeof(uint32_t);
+		if (count > CAM_FLASH_MAX_LED_TRIGGERS) {
+			CAM_ERR(CAM_FLASH, "Invalid LED count : %d", count);
+			return -EINVAL;
+		}
+
+		fctrl->torch_num_sources = count;
+
+		CAM_DBG(CAM_FLASH, "torch_num_sources = %d",
+			fctrl->torch_num_sources);
+		for (i = 0; i < count; i++) {
+			torch_src_node = of_parse_phandle(of_node,
+				"torch-source", i);
+			if (!torch_src_node) {
+				CAM_WARN(CAM_FLASH, "torch_src_node NULL");
+				continue;
+			}
+
+			rc = of_property_read_string(torch_src_node,
+				"qcom,default-led-trigger",
+				&soc_private->torch_trigger_name[i]);
+			if (rc < 0) {
+				CAM_WARN(CAM_FLASH,
+					"default-trigger read failed");
+				of_node_put(torch_src_node);
+				continue;
+			}
+
+			CAM_DBG(CAM_FLASH, "Torch default trigger %s",
+				soc_private->torch_trigger_name[i]);
+			cam_res_mgr_led_trigger_register(
+				soc_private->torch_trigger_name[i],
+				&fctrl->torch_trigger[i]);
+
+			if (soc_private->is_wled_flash) {
+				rc = cam_flash_led_prepare(
+					fctrl->torch_trigger[i],
+					BIT(2), &soc_private->torch_max_current[i],
+					true);
+				if (rc) {
+					CAM_ERR(CAM_FLASH,
+					"WLED TORCH max_current read fail: %d",
+					rc);
+					of_node_put(torch_src_node);
+					continue;
+				}
+			} else {
+				rc = of_property_read_u32(torch_src_node,
+					"qcom,max-current",
+					&soc_private->torch_max_current[i]);
+				rc &= of_property_read_u32(torch_src_node,
+					"qcom,max-current-ma",
+					&soc_private->torch_max_current[i]);
+				if (rc < 0) {
+					CAM_WARN(CAM_FLASH,
+					"LED-TORCH max-current read failed: %d",
+						rc);
+					of_node_put(torch_src_node);
+					continue;
+				}
+			}
+
+			/* Read operational-current */
+			rc = of_property_read_u32(torch_src_node,
+				"qcom,current-ma",
+				&soc_private->torch_op_current[i]);
+			if (rc < 0) {
+				CAM_WARN(CAM_FLASH,
+					"op-current prop unavailable: %d", rc);
+				rc = 0;
+			}
+
+			of_node_put(torch_src_node);
+
+			CAM_DBG(CAM_FLASH, "TorchMaxCurrent[%d]: %d",
+				i, soc_private->torch_max_current[i]);
+		}
+	}
+
+	return rc;
+}
+
+int cam_flash_get_dt_data(struct cam_flash_ctrl *fctrl,
+	struct cam_hw_soc_info *soc_info)
+{
+	int32_t rc = 0;
+	struct device_node *of_node = NULL;
+
+	if (!fctrl) {
+		CAM_ERR(CAM_FLASH, "NULL flash control structure");
+		return -EINVAL;
+	}
+
+	soc_info->soc_private =
+		kzalloc(sizeof(struct cam_flash_private_soc), GFP_KERNEL);
+	if (!soc_info->soc_private) {
+		rc = -ENOMEM;
+		goto release_soc_res;
+	}
+
+	if (fctrl->of_node == NULL) {
+		CAM_ERR(CAM_FLASH, "device node is NULL");
+		rc = -EINVAL;
+		goto free_soc_private;
+	}
+
+	of_node = fctrl->of_node;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_FLASH, "Get_dt_properties failed rc %d", rc);
+		goto free_soc_private;
+	}
+
+	rc = cam_get_source_node_info(of_node, fctrl, soc_info->soc_private);
+	if (rc) {
+		CAM_ERR(CAM_FLASH,
+			"cam_flash_get_pmic_source_info failed rc %d", rc);
+		goto free_soc_private;
+	}
+	return rc;
+
+free_soc_private:
+	kfree(soc_info->soc_private);
+	soc_info->soc_private = NULL;
+release_soc_res:
+	cam_soc_util_release_platform_resource(soc_info);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_soc.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_FLASH_SOC_H_
+#define _CAM_FLASH_SOC_H_
+
+#include "cam_flash_dev.h"
+
+int cam_flash_get_dt_data(struct cam_flash_ctrl *fctrl,
+	struct cam_hw_soc_info *soc_info);
+
+void cam_flash_put_source_node_data(struct cam_flash_ctrl *fctrl);
+#endif /*_CAM_FLASH_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_hdmi_bdg/cam_hdmi_bdg_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_hdmi_bdg/cam_hdmi_bdg_core.c
@@ -0,0 +1,1233 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/module.h>
+#include <linux/firmware.h>
+#include <cam_sensor_cmn_header.h>
+#include "cam_sensor_core.h"
+#include "cam_sensor_util.h"
+#include "cam_soc_util.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+#include "cam_hdmi_bdg_core.h"
+
+static struct cam_sensor_ctrl_t *cam_hdmi_bdg_cam_ctrl = NULL;
+
+enum lt6911_fw_status lt6911_fw_status;
+
+static int lt6911_get_fw_state(void)
+{
+	return lt6911_fw_status;
+}
+
+static void lt6911_set_fw_state(int fw_status)
+{
+	lt6911_fw_status = fw_status;
+}
+
+static int lt6911_flash_write_en(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [6] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe1,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x03,
+		.reg_data = 0x2e,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x03,
+		.reg_data = 0xee,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x04,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 6;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to flash write enable rc %d", rc);
+
+	return rc;
+}
+
+static int lt6911_flash_write_config(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [4] = {
+	{
+		.reg_addr = 0x5E,
+		.reg_data = 0xdf,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x20,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x58,
+		.reg_data = 0x21,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 4;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to flash write config rc %d", rc);
+	return rc;
+}
+
+static int lt6911_write (struct cam_sensor_ctrl_t *s_ctrl, u8 reg,
+				const u8 *buf, int size)
+{
+	int32_t rc = 0;
+	u8 i2c_wbuf[64];
+	int i;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs[32];
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	memset(i2c_wbuf, 0, 64);
+	memcpy(i2c_wbuf, buf, size);
+	for (i=0 ; i<size ; i++) {
+		 m_i2c_write_regs[i].reg_addr=reg;
+		 m_i2c_write_regs[i].reg_data=i2c_wbuf[i];
+		 m_i2c_write_regs[i].delay=0x00;
+		 m_i2c_write_regs[i].data_mask=0x00;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = size;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	/* burst setting. */
+	rc = camera_io_dev_write_continuous(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings, CAM_SENSOR_I2C_WRITE_BURST);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to write data rc %d", rc);
+
+	return rc;
+	}
+
+static int lt6911_flash_write_addr_set(struct cam_sensor_ctrl_t *s_ctrl, u32 addr)
+	{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [5] = {
+	{
+		.reg_addr = 0x5B,
+		.reg_data = (addr & 0xFF0000) >> 16,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5C,
+		.reg_data = (addr & 0xFF00) >> 8,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5D,
+		.reg_data = addr & 0xFF,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x10,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 5;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0)
+	CAM_ERR(CAM_SENSOR,"Failed to flash write addr rc %d", rc);
+
+	return rc;
+}
+
+static int lt6911_write_over_config(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [2] = {
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x08,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 2;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to write over config rc %d", rc);
+
+	return rc;
+}
+
+static int lt6911_firmware_write(struct cam_sensor_ctrl_t *s_ctrl, const u8 *f_data,
+			int size)
+{
+	int32_t rc = 0;
+	u8 last_buf[32];
+	int i = 0, page_size = 32;
+	int start_addr = 0, total_page = 0, rest_data = 0;
+
+	total_page = size / page_size;
+	rest_data = size % page_size;
+
+	for (i = 0; i < total_page; i++) {
+            /* reset fifo */
+	    rc = lt6911_flash_write_en(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write enable rc %d", rc);
+			return rc;
+		}
+
+		rc = lt6911_flash_write_config(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write config rc %d", rc);
+			break;
+		}
+		rc = lt6911_write(s_ctrl, 0x59, f_data, page_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to write data rc %d", rc);
+			break;
+		}
+		rc = lt6911_flash_write_addr_set(s_ctrl, start_addr);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write addr rc %d", rc);
+			break;
+		}
+		start_addr += page_size;
+		f_data += page_size;
+	}
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write firmware rc %d", rc);
+		return rc;
+	}
+
+	if (rest_data > 0) {
+		memset(last_buf, 0xFF, 32);
+		memcpy(last_buf, f_data, rest_data);
+
+	    rc = lt6911_flash_write_en(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write enable rc %d", rc);
+			return rc;
+		}
+
+		rc = lt6911_flash_write_config(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write config rc %d", rc);
+			return rc;
+		}
+		rc = lt6911_write(s_ctrl, 0x59, last_buf, rest_data);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to write data rc %d", rc);
+			return rc;
+		}
+		rc = lt6911_flash_write_addr_set(s_ctrl, start_addr);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to flash write addr rc %d", rc);
+			return rc;
+		}
+	}
+
+	rc = lt6911_write_over_config(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write over config rc %d", rc);
+		return rc;
+	}
+
+	CAM_INFO(CAM_SENSOR, "LT6911 FW write over, total size: %d, "
+			"page: %d, reset: %d", size, total_page, rest_data);
+	return rc;
+}
+
+static int lt6911_block_erase(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [9] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xEE,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x04,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5B,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5C,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5D,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs_2 [9] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xEE,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x04,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5B,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5C,
+		.reg_data = 0x80,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5D,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings_2;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 9;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 500;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to erase block rc %d", rc);
+
+	m_i2c_write_settings_2.reg_setting = m_i2c_write_regs_2;
+	m_i2c_write_settings_2.size = 9;
+	m_i2c_write_settings_2.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings_2.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings_2.delay = 500;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings_2);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to erase block rc %d", rc);
+
+	return rc;
+}
+
+static int lt6911_config(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [8] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xEE,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5E,
+		.reg_data = 0xc1,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x58,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x59,
+		.reg_data = 0x50,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x10,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x58,
+		.reg_data = 0x21,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 8;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to write config settings rc = %d", rc);
+
+	return rc;
+}
+
+static int lt6911_flash_read_addr_set(struct cam_sensor_ctrl_t *s_ctrl, u32 addr)
+{
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [9] = {
+	{
+		.reg_addr = 0x5E,
+		.reg_data = 0x5f,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x20,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5B,
+		.reg_data = (addr & 0xFF0000) >> 16,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5C,
+		.reg_data = (addr & 0xFF00) >> 8,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5D,
+		.reg_data = addr & 0xFF,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x10,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x5A,
+		.reg_data = 0x00,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0x58,
+		.reg_data = 0x21,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 9;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to flash read addr rc %d", rc);
+
+	return rc;
+}
+
+static int lt6911_read(struct cam_sensor_ctrl_t *s_ctrl, u8 reg,
+			char *buf, u32 size)
+{
+	uint8_t data[32];
+	int rc = 0;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	memset(data, 0x0, size);
+	rc = camera_io_dev_read_seq(&(s_ctrl->io_master_info), reg, data,
+			CAMERA_SENSOR_I2C_TYPE_BYTE, CAMERA_SENSOR_I2C_TYPE_BYTE, size);
+	if (!rc)
+		memcpy(buf, data, size);
+
+	return rc;
+}
+
+static int lt6911_fw_read_back(struct cam_sensor_ctrl_t *s_ctrl, u8 *buff, int size)
+{
+	u8 page_data[32];
+	int page_number = 0, i = 0, addr = 0;
+	int rest_data = 0;
+	int rc = 0;
+
+	struct cam_sensor_i2c_reg_array m_i2c_write_regs[2];
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	/*
+	 * Read 32 bytes once.
+	 */
+	page_number = size / 32;
+	rest_data = size % 32;
+
+	for (i = 0; i < page_number; i++) {
+		memset(page_data, 0x0, 32);
+		rc = lt6911_flash_read_addr_set(s_ctrl, addr);
+		if (rc < 0)
+			return rc;
+
+		rc = lt6911_read(s_ctrl, 0x5F, page_data, 32);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to read rc %d", rc);
+			return rc;
+		}
+		memcpy(buff, page_data, 32);
+		buff += 32;
+		addr += 32;
+	}
+
+	if(rest_data != 0) {
+		memset(page_data, 0x0, rest_data);
+		rc = lt6911_flash_read_addr_set(s_ctrl, addr);
+		if (rc < 0)
+			return rc;
+		rc = lt6911_read(s_ctrl, 0x5F, page_data, rest_data);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,"Failed to read rc %d", rc);
+			return rc;
+		}
+		memcpy(buff, page_data, rest_data);
+		buff += rest_data;
+		addr += rest_data;
+	}
+
+	rc = lt6911_write_over_config(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write over config rc %d", rc);
+		return rc;
+	}
+
+	/* disable external i2c control */
+	m_i2c_write_regs[0].reg_addr=0xFF;
+	m_i2c_write_regs[0].reg_data=0xe0;
+	m_i2c_write_regs[1].reg_addr=0xEE;
+	m_i2c_write_regs[1].reg_data=0x00;
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 2;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write settings rc %d", rc);
+		return rc;
+	}
+
+	CAM_INFO(CAM_SENSOR, "lt6911_fw_read_back:read data size : %d",addr);
+
+	return rc;
+}
+
+static int lt6911_firmware_upgrade(struct cam_sensor_ctrl_t *s_ctrl,
+			const struct firmware *cfg)
+{
+	int i = 0;
+	u8 *fw_read_data = NULL;
+
+	int data_len = 0;
+	int rc = -1;
+
+	if (NULL == cfg) {
+		CAM_ERR(CAM_SENSOR, "Invalid args");
+		return -EINVAL;
+	}
+
+	data_len = (int)cfg->size;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	fw_read_data = kzalloc(ALIGN(data_len, 32), GFP_KERNEL);
+	if (!fw_read_data)
+		return rc;
+
+	lt6911_fw_status = UPDATE_RUNNING;
+	rc = lt6911_config(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write config settings rc %d", rc);
+		goto end;
+	}
+
+	/*
+	* Need erase block 2 times here.
+	* Sometimes, erase can fail.
+	*/
+	for (i = 0; i < 2; i++) {
+		rc = lt6911_block_erase(s_ctrl);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,"Failed to erase block rc %d, retrying...", rc);
+		else
+			break;
+	}
+
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to erase blocks rc %d", rc);
+		goto end;
+	}
+
+	rc = lt6911_firmware_write(s_ctrl, cfg->data, data_len);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write firmware rc %d", rc);
+		goto end;
+	}
+
+	rc = lt6911_fw_read_back(s_ctrl, fw_read_data, data_len);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to read back firmware rc %d", rc);
+		goto end;
+	}
+	if (!memcmp(cfg->data, fw_read_data, data_len)) {
+		lt6911_fw_status = UPDATE_SUCCESS;
+		CAM_INFO(CAM_SENSOR, "LT6911 Firmware upgrade success.");
+		kfree(fw_read_data);
+		return rc;
+	}
+end:
+	lt6911_fw_status = UPDATE_FAILED;
+	kfree(fw_read_data);
+	return rc;
+}
+
+static void lt6911_firmware_cb(const struct firmware *cfg, void *data)
+{
+	struct cam_sensor_ctrl_t *s_ctrl = (struct cam_sensor_ctrl_t *)data;
+	int rc = 0;
+
+	if (!cfg) {
+		CAM_ERR(CAM_SENSOR,"LT6911 get firmware failed");
+		lt6911_set_fw_state(UPDATE_FAILED);
+		return;
+	}
+
+	rc = lt6911_firmware_upgrade(s_ctrl, cfg);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR,"Failed to upgrade firmware rc %d", rc);
+	release_firmware(cfg);
+}
+
+uint32_t cam_hdmi_bdg_get_fw_version(void)
+{
+	struct cam_sensor_ctrl_t *s_ctrl = cam_hdmi_bdg_cam_ctrl;
+	uint32_t version = 0;
+	uint32_t buf = 0;
+	int rc = 0;
+
+	struct cam_sensor_i2c_reg_array  m_i2c_write_regs [3] = {
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xEE,
+		.reg_data = 0x01,
+		.delay = 0x01,
+		.data_mask = 0x00
+	},
+	{
+		.reg_addr = 0xFF,
+		.reg_data = 0xe0,
+		.delay = 0x01,
+		.data_mask = 0x00
+	}};
+
+	struct cam_sensor_i2c_reg_setting m_i2c_write_settings;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, "LT6911GXC is not ready.");
+		return -EINVAL;
+	}
+	if (s_ctrl->sensordata == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed sensordata: %pK", s_ctrl->sensordata);
+		return -EINVAL;
+	}
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 3;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info), &m_i2c_write_settings);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write registers rc %d", rc);
+		goto end;
+	}
+
+	/* version byte 1 read */
+	rc = camera_io_dev_read(
+			&(s_ctrl->io_master_info),
+			0x80,
+			&buf,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if(!rc)
+		version += (buf & 0xFF) << 24;
+	else {
+		CAM_ERR(CAM_SENSOR,"LT6911 get revison failed");
+		goto end;
+	}
+
+
+	/* version byte 2 read */
+	rc = camera_io_dev_read(
+			&(s_ctrl->io_master_info),
+			0x81,
+			&buf,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if(!rc)
+		version += (buf & 0xFF) << 16;
+	else {
+		CAM_ERR(CAM_SENSOR,"LT6911 get revison failed");
+		goto end;
+	}
+
+	/* version byte 3 read */
+	rc = camera_io_dev_read(
+			&(s_ctrl->io_master_info),
+			0x82,
+			&buf,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if(!rc)
+		version += (buf & 0xFF) << 8;
+	else {
+		CAM_ERR(CAM_SENSOR,"LT6911 get revison failed");
+		goto end;
+	}
+
+	/* version byte 4 read */
+	rc = camera_io_dev_read(
+			&(s_ctrl->io_master_info),
+			0x83,
+			&buf,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if(!rc)
+		version += buf & 0xFF;
+	else {
+		CAM_ERR(CAM_SENSOR,"LT6911 get revison failed");
+		goto end;
+	}
+
+	m_i2c_write_regs[0].reg_addr = 0xFF;
+	m_i2c_write_regs[0].reg_data = 0xe0;
+	m_i2c_write_regs[1].reg_addr = 0xEE;
+	m_i2c_write_regs[1].reg_data = 0x00;
+
+	m_i2c_write_settings.reg_setting = m_i2c_write_regs;
+	m_i2c_write_settings.size = 2;
+	m_i2c_write_settings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2c_write_settings.delay = 0;
+
+	rc = camera_io_dev_write(&(s_ctrl->io_master_info),
+			&m_i2c_write_settings);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,"Failed to write registers rc %d", rc);
+		goto end;
+	}
+	return version;
+end:
+	version = 0;
+	return version;
+}
+
+int cam_hdmi_bdg_set_cam_ctrl(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0;
+	struct cam_camera_slave_info *slave_info;
+
+	if (!s_ctrl || !s_ctrl->sensordata) {
+		CAM_ERR(CAM_SENSOR, "Invalid ptr");
+		return -EINVAL;
+	}
+
+	slave_info = &(s_ctrl->sensordata->slave_info);
+	if (!slave_info) {
+		CAM_ERR(CAM_SENSOR, " failed slave_info: %pK", slave_info);
+		return -EINVAL;
+	}
+	if (slave_info->sensor_id == HDMI_BDG_SENSOR_ID) {
+		cam_hdmi_bdg_cam_ctrl = s_ctrl;
+		CAM_ERR(CAM_SENSOR, "Setting sctrl for HDMI");
+		rc = 0;
+	} else {
+		cam_hdmi_bdg_cam_ctrl = NULL;
+		rc = -EINVAL;
+	}
+	return rc;
+}
+
+void cam_hdmi_bdg_unset_cam_ctrl(void)
+{
+	cam_hdmi_bdg_cam_ctrl = NULL;
+}
+
+int cam_hdmi_bdg_upgrade_firmware(void)
+{
+	int32_t rc = 0;
+	struct cam_camera_slave_info *slave_info;
+	struct cam_sensor_ctrl_t *s_ctrl = cam_hdmi_bdg_cam_ctrl;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, "LT6911GXC is not ready.");
+		return -EINVAL;
+	}
+	if (s_ctrl->sensordata == NULL) {
+		CAM_ERR(CAM_SENSOR, " failed sensordata: %pK", s_ctrl->sensordata);
+		return -EINVAL;
+	}
+
+	slave_info = &(s_ctrl->sensordata->slave_info);
+
+	if (!slave_info) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK", slave_info);
+		return -EINVAL;
+	}
+
+	if (slave_info->sensor_id == HDMI_BDG_SENSOR_ID) {
+		int max_wait_times = 25;
+
+		CAM_INFO(CAM_SENSOR,"LT6911 firmare version before upgrade: 0x%08x",
+			cam_hdmi_bdg_get_fw_version());
+
+		rc = request_firmware_nowait(THIS_MODULE, true,
+				"lt6911_fw.bin", s_ctrl->soc_info.dev, GFP_KERNEL,
+				s_ctrl, lt6911_firmware_cb);
+		if (rc < 0)
+			return rc;
+
+		/* wait for firmware upgrade over, max wait time is 50 seconds */
+		CAM_INFO(CAM_SENSOR, "LT6911 starts upgrade, "
+				"waiting for about 50s...");
+
+		while (max_wait_times >= 0) {
+			msleep(2000);
+			if (lt6911_get_fw_state() != UPDATE_RUNNING)
+				break;
+			max_wait_times--;
+
+			CAM_INFO(CAM_SENSOR, "LT6911 fw upgrade: "
+				"%d seconds have passed,most often %d seconds "
+				"have to be waited...",((25-max_wait_times)*2),
+				(max_wait_times*2));
+		}
+	}
+	if (lt6911_get_fw_state() != UPDATE_SUCCESS)
+		rc = -1;
+
+	return rc;
+}
+
+int cam_hdmi_bdg_get_src_resolution(bool *signal_stable,
+	int *width,
+	int *height,
+	int *id)
+{
+	int rc = 0;
+	u32 hactive_h, hactive_l;
+	u32 vactive_h, vactive_l;
+	u32 hdmi_signal_status;
+	struct cam_sensor_i2c_reg_setting m_i2cWriteSettings;
+	struct cam_sensor_i2c_reg_array m_i2cWriteRegArray;
+
+	if (!cam_hdmi_bdg_cam_ctrl) {
+		CAM_ERR(CAM_SENSOR, "LT6911GXC is not ready.");
+		*signal_stable = false;
+		*height = -1;
+		*width = -1;
+		return -EINVAL;
+	}
+	/* camera_io_init(&(cam_hdmi_bdg_cam_ctrl->io_master_info));*/
+	/* cam_sensor_power_up(cam_hdmi_bdg_cam_ctrl);*/
+	mutex_lock(&(cam_hdmi_bdg_cam_ctrl->cam_sensor_mutex));
+	memset(&m_i2cWriteSettings, 0, sizeof(m_i2cWriteSettings));
+
+	m_i2cWriteSettings.reg_setting = &m_i2cWriteRegArray;
+	m_i2cWriteSettings.size = 1;
+	m_i2cWriteSettings.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2cWriteSettings.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	m_i2cWriteSettings.delay = 0;
+
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	m_i2cWriteRegArray.reg_addr = 0xee;
+	m_i2cWriteRegArray.reg_data = 0x01;
+	rc = camera_io_dev_write(&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	m_i2cWriteRegArray.reg_addr = 0xb0;
+	m_i2cWriteRegArray.reg_data = 0x01;
+	rc = camera_io_dev_write(&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	/* Check HDMI signal first*/
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			0x84, &hdmi_signal_status,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	CAM_INFO(CAM_SENSOR, "lt6911gxc signal stable %x", hdmi_signal_status);
+	if (rc < 0)
+		goto fail;
+
+	if (hdmi_signal_status == HDMI_BDG_HDMI_DISCONNECTED) {
+		*signal_stable = false;
+		*height = 0;
+		*width = 0;
+		*id = cam_hdmi_bdg_cam_ctrl->id;
+		goto end;
+	}
+	if (hdmi_signal_status > 0xFF) {
+		/* Read value from I2C should not upper than 0xFF.*/
+		/* If so, it means LT6911GXC is closed.*/
+		*signal_stable = false;
+		*height = -1;
+		*width = -1;
+		*id = cam_hdmi_bdg_cam_ctrl->id;
+		goto end;
+	}
+
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			0x8c, &hactive_h,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			0x8d, &hactive_l,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			0x8e, &vactive_h,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if (rc < 0)
+		goto fail;
+
+	rc = camera_io_dev_read(
+			&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			0x8f, &vactive_l,
+			CAMERA_SENSOR_I2C_TYPE_BYTE,
+			CAMERA_SENSOR_I2C_TYPE_BYTE);
+	if (rc < 0)
+		goto fail;
+
+	*signal_stable = true;
+	*height = (vactive_h << 8) | vactive_l;
+	*width = (hactive_h << 8) | hactive_l;
+	*id = cam_hdmi_bdg_cam_ctrl->id;
+	CAM_INFO(CAM_SENSOR, "signal stable %d %d, x %d id %d",
+			*signal_stable, *width,
+			*height, *id);
+
+end:
+	m_i2cWriteRegArray.reg_addr = 0xff;
+	m_i2cWriteRegArray.reg_data = 0xe0;
+	rc = camera_io_dev_write(&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	m_i2cWriteRegArray.reg_addr = 0xee;
+	m_i2cWriteRegArray.reg_data = 0x00;
+	rc = camera_io_dev_write(&(cam_hdmi_bdg_cam_ctrl->io_master_info),
+			&m_i2cWriteSettings);
+	if (rc < 0)
+		goto fail;
+
+	mutex_unlock(&(cam_hdmi_bdg_cam_ctrl->cam_sensor_mutex));
+	return rc;
+
+fail:
+	*signal_stable = false;
+	*height = -1;
+	*width = -1;
+	mutex_unlock(&(cam_hdmi_bdg_cam_ctrl->cam_sensor_mutex));
+	return rc;
+}
+EXPORT_SYMBOL(cam_hdmi_bdg_get_src_resolution);
+EXPORT_SYMBOL(cam_hdmi_bdg_get_fw_version);
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_hdmi_bdg/cam_hdmi_bdg_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_hdmi_bdg/cam_hdmi_bdg_core.h
@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _CAMHDMIBDGCORE_H_
+#define _CAMHDMIBDGCORE_H_
+
+#include <linux/firmware.h>
+#include "cam_sensor_dev.h"
+
+#define HDMI_BDG_SENSOR_ID 0x1901
+#define HDMI_BDG_HDMI_CONNECTED    0x01
+#define HDMI_BDG_HDMI_DISCONNECTED 0x00
+#define HDMI_SENSOR_NAME "lt6911gxc"
+
+enum lt6911_fw_status {
+	UPDATE_SUCCESS = 0,
+	UPDATE_RUNNING = 1,
+	UPDATE_FAILED = 2,
+};
+
+/**
+ * This API upgrade lt6911 firmware.
+ */
+int cam_hdmi_bdg_upgrade_firmware(void);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * This API set lt6911 camera struct for irq handle.
+ */
+int cam_hdmi_bdg_set_cam_ctrl(struct cam_sensor_ctrl_t *s_ctrl);
+
+/**
+ * This API unset lt6911 camera struct for irq handle.
+ */
+void cam_hdmi_bdg_unset_cam_ctrl(void);
+
+int cam_hdmi_bdg_get_src_resolution(bool *signal_stable,
+		int *width, int *height, int *id);
+
+uint32_t cam_hdmi_bdg_get_fw_version(void);
+
+/**
+ * @brief : API to register HMDI dev to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int hdmi_bdg_irq_handler_init(void);
+
+/**
+ * @brief : API to remove HMDI dev from platform framework.
+ */
+void hdmi_bdg_irq_handler_exit(void);
+
+#endif /* _CAMHDMIBDGCORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_hdmi_bdg/cam_hdmi_bdg_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_hdmi_bdg/cam_hdmi_bdg_dev.c
@@ -0,0 +1,274 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/cdev.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/workqueue.h>
+#include <linux/of_gpio.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include "cam_hdmi_bdg_core.h"
+#include "camera_main.h"
+
+#define HDMI_BDG_IRQ_HANDLER_DEVNAME             "hdmi_bdg_irq_handler"
+#define HDMI_BDG_IRQ_HANDLER_MAGIC_NUM           0xee
+#define HDMI_BDG_IRQ_HANDLER_IOCTL_GETRES        0x01
+#define HDMI_BDG_IRQ_HANDLER_IOCTL_GETRES_DIR    0x02
+#define HDMI_BDG_IRQ_HANDLER_IOCTL_RST           0x03
+#define HDMI_BDG_IRQ_HANDLER_IOCTL_UPGRADE_FW    0x04
+
+struct hdmi_bdg_res_info {
+	int32_t width;
+	int32_t height;
+	bool have_hdmi_signal;
+	int32_t id;
+};
+
+#define HDMI_BDG_IRQ_HANDLER_IOCTL_CMD_GETRES   \
+	_IOR(HDMI_BDG_IRQ_HANDLER_MAGIC_NUM,        \
+	HDMI_BDG_IRQ_HANDLER_IOCTL_GETRES, \
+			struct hdmi_bdg_res_info)
+#define HDMI_BDG_IRQ_HANDLER_IOCTL_CMD_GETRES_DIR   \
+	_IOR(HDMI_BDG_IRQ_HANDLER_MAGIC_NUM,            \
+	HDMI_BDG_IRQ_HANDLER_IOCTL_GETRES_DIR, \
+			struct hdmi_bdg_res_info)
+#define HDMI_BDG_IRQ_HANDLER_IOCTL_CMD_RST   \
+	_IO(HDMI_BDG_IRQ_HANDLER_MAGIC_NUM,      \
+	HDMI_BDG_IRQ_HANDLER_IOCTL_RST)
+#define HDMI_BDG_IRQ_HANDLER_IOCTL_CMD_UPGRADE_FW   \
+	_IO(HDMI_BDG_IRQ_HANDLER_MAGIC_NUM,      \
+	HDMI_BDG_IRQ_HANDLER_IOCTL_UPGRADE_FW)
+
+
+static const struct  of_device_id hdmi_bdg_irq_handler_dev_id[] = {
+	{ .compatible = "hdmi_bdg_irq_handler" },
+	{},
+};
+
+static bool is_irq_happen;
+static int hdmi_bdg_irq;
+static int hdmi_bdg_irq_gpio;
+static wait_queue_head_t hdmi_bdg_read_wq;
+static struct hdmi_bdg_res_info s_hdmi_bdg_res_info;
+static struct cdev *hdmi_bdg_irq_handler_cdev;
+static dev_t hdmi_bdg_irq_handler_dev;
+static struct class *hdmi_bdg_irq_handler_class;
+static struct device *hdmi_bdg_irq_handler_device;
+
+MODULE_DEVICE_TABLE(of, hdmi_bdg_irq_handler_dev_id);
+
+static int hdmi_bdg_irq_handler_dev_open(struct inode *inodp, struct file *filp)
+{
+	return 0;
+}
+static int hdmi_bdg_irq_handler_dev_release(struct inode *inodp,
+		struct file *filp)
+{
+	wake_up_all(&hdmi_bdg_read_wq);
+	return 0;
+}
+static ssize_t hdmi_bdg_irq_handler_dev_read(struct file *filp,
+		char __user *buf, size_t n_read, loff_t *off)
+{
+	CAM_INFO(CAM_SENSOR, "hdmi_bdg_irq_handler: wait IRQ happened");
+	wait_event_interruptible(hdmi_bdg_read_wq, is_irq_happen);
+	CAM_INFO(CAM_SENSOR, "hdmi_bdg_irq_handler: IRQ happened");
+	is_irq_happen = false;
+	return 0;
+}
+
+static long hdmi_bdg_irq_handler_dev_ioctl(struct file *filp,
+		unsigned int cmd, unsigned long arg)
+{
+	int rc = 0;
+
+	switch (cmd) {
+	case HDMI_BDG_IRQ_HANDLER_IOCTL_CMD_GETRES:
+		rc = copy_to_user((struct hdmi_bdg_res_info *)arg,
+			&s_hdmi_bdg_res_info,
+			sizeof(s_hdmi_bdg_res_info));
+		if (rc != 0)
+			CAM_ERR(CAM_SENSOR, "hdmi_bdg_irq_handler: IOCTL read error!");
+		break;
+	case HDMI_BDG_IRQ_HANDLER_IOCTL_CMD_GETRES_DIR:
+		CAM_INFO(CAM_SENSOR, "LT6911 firmare version: 0x%08x", cam_hdmi_bdg_get_fw_version());
+		rc = cam_hdmi_bdg_get_src_resolution(
+			&s_hdmi_bdg_res_info.have_hdmi_signal,
+			&s_hdmi_bdg_res_info.width,
+			&s_hdmi_bdg_res_info.height,
+			&s_hdmi_bdg_res_info.id);
+		if (!rc) {
+			CAM_INFO(CAM_SENSOR, "HDMI_BDG Input resolution = %d x %d",
+				s_hdmi_bdg_res_info.width,
+				s_hdmi_bdg_res_info.height);
+		}
+		rc = copy_to_user((struct hdmi_bdg_res_info *)arg,
+			&s_hdmi_bdg_res_info,
+			sizeof(s_hdmi_bdg_res_info));
+		if (rc != 0)
+			CAM_ERR(CAM_SENSOR, "hdmi_bdg_irq_handler: IOCTL read error!");
+		break;
+	case HDMI_BDG_IRQ_HANDLER_IOCTL_CMD_RST:
+		s_hdmi_bdg_res_info.width = -1;
+		s_hdmi_bdg_res_info.height = -1;
+		s_hdmi_bdg_res_info.have_hdmi_signal = false;
+		s_hdmi_bdg_res_info.id = 0;
+		break;
+	case HDMI_BDG_IRQ_HANDLER_IOCTL_CMD_UPGRADE_FW:
+		CAM_INFO(CAM_SENSOR, "hdmi_bdg_irq_handler: Upgrading firmware...");
+		rc = cam_hdmi_bdg_upgrade_firmware();
+		CAM_INFO(CAM_SENSOR, "hdmi_bdg_irq_handler: rc %d", rc);
+		break;
+	default:
+		CAM_ERR(CAM_SENSOR, "hdmi_bdg_irq_handler: IOCTL unknown command!");
+		break;
+	}
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long hdmi_bdg_irq_handler_dev_compat_ioctl(struct file *filp,
+		unsigned int cmd, unsigned long arg)
+{
+	return hdmi_bdg_irq_handler_dev_ioctl(filp, cmd,
+		(unsigned long)compat_ptr(arg));
+}
+#endif
+
+static const struct file_operations hdmi_bdg_irq_handler_dev_fops = {
+	.owner = THIS_MODULE,
+	.read = hdmi_bdg_irq_handler_dev_read,
+	.open = hdmi_bdg_irq_handler_dev_open,
+	.unlocked_ioctl = hdmi_bdg_irq_handler_dev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = hdmi_bdg_irq_handler_dev_compat_ioctl,
+#endif
+	.release = hdmi_bdg_irq_handler_dev_release,
+};
+
+static irqreturn_t hdmi_bdg_irq_handler(int irq, void *p)
+{
+	int rc = 0;
+
+	CAM_INFO(CAM_SENSOR, "HDMI hotplug happened");
+	rc = cam_hdmi_bdg_get_src_resolution(
+			&s_hdmi_bdg_res_info.have_hdmi_signal,
+			&s_hdmi_bdg_res_info.width,
+			&s_hdmi_bdg_res_info.height,
+			&s_hdmi_bdg_res_info.id);
+	if (!rc) {
+		CAM_INFO(CAM_SENSOR, "HDMI_BDG Input resolution = %d x %d",
+				s_hdmi_bdg_res_info.width,
+				s_hdmi_bdg_res_info.height);
+		is_irq_happen = true;
+		wake_up_all(&hdmi_bdg_read_wq);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Get resolution failed!");
+	}
+	return IRQ_HANDLED;
+}
+
+static int hdmi_bdg_irq_handler_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	hdmi_bdg_irq_gpio = of_get_named_gpio(pdev->dev.of_node,
+		"hdmi_bdg_irq_pin", 0);
+	ret = gpio_request(hdmi_bdg_irq_gpio, "hdmi_bdg_irq_pin");
+	if (ret) {
+		CAM_ERR(CAM_SENSOR, "Error! can't request irq pin %x", hdmi_bdg_irq_gpio);
+		ret = -EINVAL;
+		goto fail_exit;
+	}
+	hdmi_bdg_irq = gpio_to_irq(hdmi_bdg_irq_gpio);
+	ret = request_threaded_irq(hdmi_bdg_irq, NULL,
+			hdmi_bdg_irq_handler,
+			IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+			"hdmi_bdg_irq", NULL);
+	if (ret) {
+		CAM_ERR(CAM_SENSOR, "Failed to request irq");
+		ret = -EINVAL;
+		goto fail_exit;
+	}
+
+	hdmi_bdg_irq_handler_cdev = cdev_alloc();
+	if (!hdmi_bdg_irq_handler_cdev) {
+		ret = -ENOMEM;
+		goto fail_exit;
+	}
+	hdmi_bdg_irq_handler_cdev->ops = &hdmi_bdg_irq_handler_dev_fops;
+	hdmi_bdg_irq_handler_cdev->owner = THIS_MODULE;
+	ret = alloc_chrdev_region(&hdmi_bdg_irq_handler_dev, 0, 1,
+			HDMI_BDG_IRQ_HANDLER_DEVNAME);
+	if (ret) {
+		CAM_ERR(CAM_SENSOR, "alloc_chrdev_region failed with error code %d", ret);
+		goto fail_cdev_del;
+	}
+	ret = cdev_add(hdmi_bdg_irq_handler_cdev, hdmi_bdg_irq_handler_dev, 1);
+	if (ret)
+		goto fail_cdev_del;
+	hdmi_bdg_irq_handler_class = class_create(HDMI_BDG_IRQ_HANDLER_DEVNAME);
+	if (IS_ERR(hdmi_bdg_irq_handler_class)) {
+		ret = PTR_ERR(hdmi_bdg_irq_handler_class);
+		goto fail_cdev_del;
+	}
+	hdmi_bdg_irq_handler_device = device_create(hdmi_bdg_irq_handler_class,
+			NULL, hdmi_bdg_irq_handler_dev, NULL,
+			HDMI_BDG_IRQ_HANDLER_DEVNAME);
+	if (IS_ERR(hdmi_bdg_irq_handler_device)) {
+		ret = PTR_ERR(hdmi_bdg_irq_handler_device);
+		goto fail_class_destroy;
+	}
+	init_waitqueue_head(&hdmi_bdg_read_wq);
+	return 0;
+
+fail_class_destroy:
+	class_destroy(hdmi_bdg_irq_handler_class);
+fail_cdev_del:
+	cdev_del(hdmi_bdg_irq_handler_cdev);
+fail_exit:
+	return ret;
+}
+
+static int hdmi_bdg_irq_handler_remove(struct platform_device *pdev)
+{
+	gpio_free(hdmi_bdg_irq_gpio);
+	disable_irq(hdmi_bdg_irq);
+	wake_up_all(&hdmi_bdg_read_wq);
+
+	cdev_del(hdmi_bdg_irq_handler_cdev);
+	device_destroy(hdmi_bdg_irq_handler_class, hdmi_bdg_irq_handler_dev);
+	class_destroy(hdmi_bdg_irq_handler_class);
+	unregister_chrdev_region(hdmi_bdg_irq_handler_dev, 1);
+	return 0;
+}
+
+struct platform_driver hdmi_bdg_irq_handler_driver = {
+	.probe = hdmi_bdg_irq_handler_probe,
+	.remove = hdmi_bdg_irq_handler_remove,
+	.suspend = NULL,
+	.resume = NULL,
+	.driver = {
+		.name = HDMI_BDG_IRQ_HANDLER_DEVNAME,
+		.of_match_table = of_match_ptr(hdmi_bdg_irq_handler_dev_id),
+	},
+};
+
+int hdmi_bdg_irq_handler_init(void)
+{
+	return platform_driver_register(&hdmi_bdg_irq_handler_driver);
+}
+
+void hdmi_bdg_irq_handler_exit(void)
+{
+	platform_driver_unregister(&hdmi_bdg_irq_handler_driver);
+}
+
+MODULE_DESCRIPTION("HDMI driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_core.c
@@ -0,0 +1,63 @@
+/* Copyright (c) 2019,2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "cam_ir_led_core.h"
+
+int cam_ir_led_stop_dev(struct cam_ir_led_ctrl *ictrl)
+{
+	int rc = 0;
+
+	if (ictrl->func_tbl->camera_ir_led_off != NULL)
+		rc = ictrl->func_tbl->camera_ir_led_off(ictrl);
+
+	if (ictrl->func_tbl->camera_ir_cut_off != NULL)
+		rc = ictrl->func_tbl->camera_ir_cut_off(ictrl);
+
+	return rc;
+}
+
+int cam_ir_led_release_dev(struct cam_ir_led_ctrl *ictrl)
+{
+	int rc = 0;
+
+	if (ictrl->device_hdl != -1) {
+		rc = cam_destroy_device_hdl(ictrl->device_hdl);
+		if (rc)
+			CAM_ERR(CAM_IR_LED,
+				"Failed in destroying device handle rc = %d",
+				rc);
+		ictrl->device_hdl = -1;
+	}
+
+	return rc;
+}
+
+void cam_ir_led_shutdown(struct cam_ir_led_ctrl *ictrl)
+{
+	int rc;
+
+	if (ictrl->ir_led_state == CAM_IR_LED_STATE_INIT)
+		return;
+
+	if (ictrl->ir_led_state == CAM_IR_LED_STATE_ON) {
+		rc = cam_ir_led_stop_dev(ictrl);
+		if (rc)
+			CAM_ERR(CAM_IR_LED, "Stop Failed rc: %d", rc);
+	}
+
+	rc = cam_ir_led_release_dev(ictrl);
+	if (rc)
+		CAM_ERR(CAM_IR_LED, "Release failed rc: %d", rc);
+	else
+		ictrl->ir_led_state = CAM_IR_LED_STATE_INIT;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_core.h
@@ -0,0 +1,21 @@
+/* Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef _CAM_IR_LED_CORE_H_
+#define _CAM_IR_LED_CORE_H_
+#include "cam_ir_led_dev.h"
+
+void cam_ir_led_shutdown(struct cam_ir_led_ctrl *ir_led_ctrl);
+int cam_ir_led_stop_dev(struct cam_ir_led_ctrl *ir_led_ctrl);
+int cam_ir_led_release_dev(struct cam_ir_led_ctrl *fctrl);
+#endif /*_CAM_IR_LED_CORE_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_dev.c
@@ -0,0 +1,974 @@
+/* Copyright (c) 2019-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/pwm.h>
+#include "cam_ir_led_dev.h"
+#include "cam_ir_led_soc.h"
+#include "cam_ir_led_core.h"
+#include "camera_main.h"
+
+#define PCA963X_LED_FULLY_ON  0x1     /* LED driver on */
+#define PCA963X_LED_FULLY_OFF 0x00    /* LED driver all off */
+#define PCA963X_LED_PWM       0x2     /* Controlled through PWM */
+#define PCA963X_LED0_MASK     0x3     /* LED0 output state control */
+#define PCA963X_MODE1_REG     0x00
+#define PCA963X_MODE2_REG     0x01
+#define PCA963X_PWM_BASE_REG  0x02
+#define PCA963X_LEDOUT_REG    0x08
+#define PCA963X_MODE2         0x11
+
+static int32_t cam_ir_cut_on(struct cam_ir_led_ctrl *ictrl);
+
+static struct cam_ir_led_table cam_pmic_ir_led_table;
+static struct cam_ir_led_table cam_gpio_ir_led_table;
+static struct cam_ir_led_table cam_i2c_ir_led_table;
+
+static struct cam_ir_led_table *ir_led_table[] = {
+	&cam_pmic_ir_led_table,
+	&cam_gpio_ir_led_table,
+	&cam_i2c_ir_led_table,
+};
+
+static int32_t cam_pmic_ir_led_init(
+	struct cam_ir_led_ctrl *ictrl)
+{
+	return ictrl->func_tbl->camera_ir_led_off(ictrl);
+}
+
+static int32_t cam_i2c_ir_led_init(
+	struct cam_ir_led_ctrl *ictrl)
+{
+	if(!ictrl->io_master_info.client) {
+		CAM_ERR(CAM_IR_LED, "client is null");
+		return -EINVAL;
+	}
+
+	/* Turn off LEDs by default */
+	i2c_smbus_write_byte_data(ictrl->io_master_info.client, PCA963X_LEDOUT_REG, PCA963X_LED_FULLY_OFF);
+	/* Disable LED all-call address and power down initially */
+	i2c_smbus_write_byte_data(ictrl->io_master_info.client, PCA963X_MODE1_REG, BIT(4));
+
+	i2c_smbus_write_byte_data(ictrl->io_master_info.client, PCA963X_MODE2_REG, PCA963X_MODE2);
+	return 0;
+}
+
+static int32_t cam_pmic_ir_led_release(
+	struct cam_ir_led_ctrl *ictrl)
+{
+	int32_t rc = 0;
+
+	CAM_DBG(CAM_IR_LED, "Enter");
+	rc = ictrl->func_tbl->camera_ir_led_off(ictrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_IR_LED, "camera_ir_led_off failed (%d)", rc);
+		return rc;
+	}
+	return rc;
+}
+
+static int32_t cam_pmic_ir_led_off(struct cam_ir_led_ctrl *ictrl)
+{
+	int32_t rc = 0;
+
+	CAM_DBG(CAM_IR_LED, "Enter");
+	if (ictrl->pwm_dev) {
+		pwm_disable(ictrl->pwm_dev);
+	} else {
+		CAM_ERR(CAM_IR_LED, "pwm device is null");
+		return -EINVAL;
+	}
+
+	rc = gpio_direction_input(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio);
+	if (rc)
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+
+	CAM_INFO(CAM_IR_LED, "CAM_IR_CUT_PACKET_OPCODE_OFF_Output_GPIO_1:%d",
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio,
+		0);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	CAM_INFO(CAM_IR_LED, "CAM_IR_CUT_PACKET_OPCODE_OFF_Output_GPIO_2:%d",
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio,
+		1);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	msleep(CAM_IR_MSLEEP_VALUE);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio,
+		0);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	return rc;
+}
+
+static int32_t cam_pmic_ir_led_on(
+	struct cam_ir_led_ctrl *ictrl,
+	struct cam_ir_led_set_on_off *ir_led_data)
+{
+	int rc;
+
+	if (ictrl->pwm_dev) {
+		rc = pwm_config(ictrl->pwm_dev,
+			ir_led_data->pwm_duty_on_ns,
+			ir_led_data->pwm_period_ns);
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "PWM config failed (%d)", rc);
+			return rc;
+		}
+
+		rc = pwm_enable(ictrl->pwm_dev);
+		CAM_DBG(CAM_IR_LED, "enabled=%d, period=%llu, duty_cycle=%llu",
+			ictrl->pwm_dev->state.enabled,
+			ictrl->pwm_dev->state.period,
+			ictrl->pwm_dev->state.duty_cycle);
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "PWM enable failed(%d)", rc);
+			return rc;
+		}
+		rc = gpio_direction_output(
+			ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio,
+			1);
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+			return rc;
+		}
+		msleep(CAM_IR_MSLEEP_VALUE);
+		rc = gpio_direction_output(
+			ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio,
+			1);
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+			return rc;
+		}
+	} else {
+		CAM_ERR(CAM_IR_LED, "pwm device is null");
+	}
+
+	return 0;
+}
+
+static int32_t cam_pmic_ir_cut_off(struct cam_ir_led_ctrl *ictrl)
+{
+	int32_t rc = 0;
+	CAM_DBG(CAM_IR_LED, "Enter");
+
+	rc = gpio_direction_input(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio);
+	if (rc)
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+
+	CAM_INFO(CAM_IR_LED, "CAM_IR_CUT_PACKET_OPCODE_OFF_Output_GPIO_1:%d",
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio,
+		0);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	CAM_INFO(CAM_IR_LED, "CAM_IR_CUT_PACKET_OPCODE_OFF_Output_GPIO_2:%d",
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio,
+		1);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	msleep(CAM_IR_MSLEEP_VALUE);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio,
+		0);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	return rc;
+}
+
+static int32_t cam_pmic_ir_cut_on(
+	struct cam_ir_led_ctrl *ictrl,
+	struct cam_ir_led_set_on_off *ir_led_data)
+{
+    int32_t rc = 0;
+    CAM_DBG(CAM_IR_LED, "Enter");
+
+    if (ictrl->ir_led_state == CAM_IR_LED_STATE_ON) {
+        if (ictrl->pwm_dev)
+            pwm_disable(ictrl->pwm_dev);
+    }
+
+    rc = gpio_direction_output(
+            ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio,
+            1);
+    if (rc) {
+        CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+        return rc;
+    }
+    msleep(CAM_IR_MSLEEP_VALUE);
+    rc = gpio_direction_output(
+            ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio,
+            1);
+    if (rc) {
+        CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+        return rc;
+    }
+    return rc;
+}
+
+static int32_t cam_ir_cut_on(struct cam_ir_led_ctrl *ictrl)
+{
+	int rc = 0;
+
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio,
+			1);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	msleep(CAM_IR_MSLEEP_VALUE);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio,
+		0);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	return 0;
+}
+
+static int32_t cam_i2c_ir_led_off(struct cam_ir_led_ctrl *ictrl)
+{
+	int rc = 0;
+	uint8_t mask  = PCA963X_LED0_MASK;
+	uint32_t ledout_addr = PCA963X_LEDOUT_REG;
+	uint32_t ledout;
+
+	CAM_DBG(CAM_IR_LED, "Enter");
+
+	ledout = i2c_smbus_read_byte_data(ictrl->io_master_info.client, ledout_addr);
+
+	rc = i2c_smbus_write_byte_data(ictrl->io_master_info.client,
+		ledout_addr, ledout & ~mask);
+
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "I2C IRLED disable failed(%d)", rc);
+		return rc;
+	}
+
+	if ((ledout & ~mask) == 0) {
+		rc = i2c_smbus_write_byte_data(ictrl->io_master_info.client,
+			PCA963X_MODE1_REG, BIT(4));
+	}
+
+	rc = gpio_direction_input(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio);
+	if (rc)
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+
+	CAM_INFO(CAM_IR_LED, "CAM_IR_CUT_PACKET_OPCODE_OFF_Output_GPIO_1:%d",
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[0].gpio,
+		0);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	CAM_INFO(CAM_IR_LED, "CAM_IR_CUT_PACKET_OPCODE_OFF_Output_GPIO_2:%d",
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio,
+		1);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	msleep(CAM_IR_MSLEEP_VALUE);
+	rc = gpio_direction_output(
+		ictrl->soc_info.gpio_data->cam_gpio_common_tbl[1].gpio,
+		0);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "gpio operation failed(%d)", rc);
+		return rc;
+	}
+	return rc;
+}
+
+static int32_t cam_i2c_ir_led_on(
+	struct cam_ir_led_ctrl *ictrl,
+	struct cam_ir_led_set_on_off *ir_led_data)
+{
+	int ret = 0;
+	uint32_t ledout_addr = PCA963X_LEDOUT_REG;
+	uint32_t ledout;
+	uint8_t mask = PCA963X_LED0_MASK;
+	uint8_t brightness = ir_led_data->brightness;
+
+	CAM_INFO(CAM_IR_LED, "Enter IRLED_ON");
+
+	ledout = i2c_smbus_read_byte_data(ictrl->io_master_info.client, ledout_addr);
+
+	switch (brightness) {
+	case LED_FULL:
+		ret = i2c_smbus_write_byte_data(ictrl->io_master_info.client,
+			ledout_addr, (ledout & ~mask) | PCA963X_LED_FULLY_ON);
+
+		if (ret) {
+			CAM_ERR(CAM_IR_LED, "I2C IRLED enable failed(%d)", ret);
+			return ret;
+		}
+		break;
+	default:
+		ret = i2c_smbus_write_byte_data(ictrl->io_master_info.client,
+			PCA963X_PWM_BASE_REG, brightness);
+
+		if (ret) {
+			CAM_ERR(CAM_IR_LED, "I2C PWM brightness setup failed(%d)", ret);
+			return ret;
+		}
+
+		ret = i2c_smbus_write_byte_data(ictrl->io_master_info.client,
+			ledout_addr, (ledout & ~mask) | PCA963X_LED_PWM);
+
+		if (ret) {
+			CAM_ERR(CAM_IR_LED, "I2C PWM enable failed(%d)", ret);
+			return ret;
+		}
+		break;
+	}
+
+	ret = i2c_smbus_write_byte_data(ictrl->io_master_info.client,
+		PCA963X_MODE1_REG, 0);
+
+	if (ret) {
+		CAM_ERR(CAM_IR_LED, "I2C PWM normal mode enable failed(%d)", ret);
+		return ret;
+	}
+
+
+	if (ictrl->ir_led_state != CAM_IR_LED_STATE_ON) {
+		ret = cam_ir_cut_on(ictrl);
+	}
+
+	return ret;
+}
+
+static int32_t cam_i2c_ir_cut_on(
+	struct cam_ir_led_ctrl *ictrl,
+	struct cam_ir_led_set_on_off *ir_led_data)
+{
+	CAM_INFO(CAM_IR_LED, "Enter IRCUT ON");
+
+	if (ictrl->ir_led_state == CAM_IR_LED_STATE_ON) {
+		cam_i2c_ir_led_off(ictrl);
+	}
+
+	return cam_ir_cut_on(ictrl);
+}
+
+static int32_t cam_ir_led_handle_init(
+	struct cam_ir_led_ctrl *ictrl)
+{
+	uint32_t i = 0;
+	int32_t rc = -EFAULT;
+	enum cam_ir_led_driver_type ir_led_driver_type =
+					ictrl->ir_led_driver_type;
+
+	CAM_DBG(CAM_IR_LED, "IRLED HW type=%d", ir_led_driver_type);
+	for (i = 0; i < ARRAY_SIZE(ir_led_table); i++) {
+		if (ir_led_driver_type == ir_led_table[i]->ir_led_driver_type) {
+			ictrl->func_tbl = &ir_led_table[i]->func_tbl;
+			rc = 0;
+			break;
+		}
+	}
+
+	if (rc < 0) {
+		CAM_ERR(CAM_IR_LED, "failed invalid ir_led_driver_type %d",
+				ir_led_driver_type);
+		return -EINVAL;
+	}
+
+	if (ictrl->func_tbl->camera_ir_led_init != NULL) {
+		rc = ictrl->func_tbl->camera_ir_led_init(ictrl);
+		if (rc < 0)
+			CAM_ERR(CAM_IR_LED, "ir_led init failed (%d)", rc);
+	}
+
+	return rc;
+}
+static int32_t cam_ir_led_config(struct cam_ir_led_ctrl *ictrl,
+	void *arg)
+{
+	int rc = 0;
+	uint32_t  *cmd_buf =  NULL;
+	uintptr_t generic_ptr;
+	uint32_t  *offset = NULL;
+	size_t len_of_buffer;
+	struct cam_control *ioctl_ctrl = NULL;
+	struct cam_packet *csl_packet = NULL;
+	struct cam_config_dev_cmd config;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct cam_ir_led_set_on_off *cam_ir_led_info = NULL;
+
+	if (!ictrl || !arg) {
+		CAM_ERR(CAM_IR_LED, "ictrl/arg is NULL");
+		return -EINVAL;
+	}
+	/* getting CSL Packet */
+	ioctl_ctrl = (struct cam_control *)arg;
+
+	if (copy_from_user((&config), u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(config))) {
+		CAM_ERR(CAM_IR_LED, "Copy cmd handle from user failed");
+		rc = -EFAULT;
+		return rc;
+	}
+
+	rc = cam_mem_get_cpu_buf(config.packet_handle,
+		(uintptr_t *)&generic_ptr, &len_of_buffer);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "Failed in getting the buffer : %d", rc);
+		return rc;
+	}
+
+	if (config.offset > len_of_buffer) {
+		CAM_ERR(CAM_IR_LED,
+			"offset is out of bounds: offset: %lld len: %zu",
+			config.offset, len_of_buffer);
+		return -EINVAL;
+	}
+
+	/* Add offset to the ir_led csl header */
+	csl_packet = (struct cam_packet *)(uintptr_t)(generic_ptr +
+			config.offset);
+
+	offset = (uint32_t *)((uint8_t *)&csl_packet->payload +
+		csl_packet->cmd_buf_offset);
+	cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+	rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
+		(uintptr_t *)&generic_ptr, &len_of_buffer);
+	if (rc < 0) {
+		CAM_ERR(CAM_IR_LED, "Failed to get the command Buffer");
+		return -EINVAL;
+	}
+
+	cmd_buf = (uint32_t *)((uint8_t *)generic_ptr +
+		cmd_desc->offset);
+	cam_ir_led_info = (struct cam_ir_led_set_on_off *)cmd_buf;
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_IR_LED_PACKET_OPCODE_ON:
+		if (ictrl->func_tbl->camera_ir_led_on != NULL) {
+			rc = ictrl->func_tbl->camera_ir_led_on(
+					ictrl, cam_ir_led_info);
+			if (rc < 0) {
+				CAM_ERR(CAM_IR_LED,
+					"Fail to turn irled ON rc=%d", rc);
+				return rc;
+			}
+			ictrl->ir_led_state = CAM_IR_LED_STATE_ON;
+		}
+		break;
+	case CAM_IR_LED_PACKET_OPCODE_OFF:
+		if (ictrl->ir_led_state != CAM_IR_LED_STATE_ON) {
+			CAM_DBG(CAM_IR_LED,
+				"IRLED_OFF NA, Already OFF, state:%d",
+				ictrl->ir_led_state);
+			return 0;
+		}
+		if (ictrl->func_tbl->camera_ir_led_off != NULL) {
+			rc = ictrl->func_tbl->camera_ir_led_off(ictrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_IR_LED,
+					"Fail to turn irled OFF rc=%d", rc);
+				return rc;
+			}
+
+			if (ictrl->func_tbl->camera_ir_cut_off != NULL)
+				rc = ictrl->func_tbl->camera_ir_cut_off(ictrl);
+
+			ictrl->ir_led_state = CAM_IR_LED_STATE_OFF;
+		}
+		break;
+	case CAM_IR_CUT_PACKET_OPCODE_ON:
+		if (ictrl->func_tbl->camera_ir_cut_on != NULL) {
+			rc = ictrl->func_tbl->camera_ir_cut_on(
+					ictrl, cam_ir_led_info);
+			if (rc < 0) {
+				CAM_ERR(CAM_IR_LED,
+					"Fail to turn ircut ON rc=%d", rc);
+				return rc;
+			}
+			ictrl->ir_led_state = CAM_IR_LED_STATE_OFF;
+		}
+		break;
+	case CAM_IR_CUT_PACKET_OPCODE_OFF:
+		if (ictrl->func_tbl->camera_ir_cut_off != NULL) {
+			rc = ictrl->func_tbl->camera_ir_cut_off(ictrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_IR_LED,
+					"Fail to turn ircut OFF rc=%d", rc);
+				return rc;
+			}
+		}
+		break;
+	case CAM_PKT_NOP_OPCODE:
+		CAM_DBG(CAM_IR_LED, "CAM_PKT_NOP_OPCODE");
+		break;
+	default:
+		CAM_ERR(CAM_IR_LED, "Invalid Opcode : %d",
+			(csl_packet->header.op_code & 0xFFFFFF));
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int32_t cam_ir_led_driver_cmd(struct cam_ir_led_ctrl *ictrl,
+		void *arg, struct cam_ir_led_private_soc *soc_private)
+{
+	int rc = 0;
+	struct cam_control *cmd = (struct cam_control *)arg;
+	struct cam_sensor_acquire_dev ir_led_acq_dev;
+	struct cam_create_dev_hdl dev_hdl;
+	struct cam_ir_led_query_cap_info ir_led_cap = {0};
+
+	if (!ictrl || !arg) {
+		CAM_ERR(CAM_IR_LED, "ictrl/arg is NULL with arg:%pK ictrl%pK",
+			ictrl, arg);
+		return -EINVAL;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_IR_LED, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	mutex_lock(&(ictrl->ir_led_mutex));
+	CAM_DBG(CAM_IR_LED, "cmd->op_code %d", cmd->op_code);
+	switch (cmd->op_code) {
+	case CAM_ACQUIRE_DEV:
+		if (ictrl->ir_led_state != CAM_IR_LED_STATE_INIT) {
+			CAM_ERR(CAM_IR_LED,
+				"Cannot apply Acquire dev: Prev state: %d",
+				ictrl->ir_led_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		rc = copy_from_user(&ir_led_acq_dev,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(ir_led_acq_dev));
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "Failed Copy from User rc=%d", rc);
+			goto release_mutex;
+		}
+
+		dev_hdl.priv = ictrl;
+
+		ir_led_acq_dev.device_handle =
+			cam_create_device_hdl(&dev_hdl);
+		ictrl->device_hdl =
+			ir_led_acq_dev.device_handle;
+
+		rc = copy_to_user(u64_to_user_ptr(cmd->handle), &ir_led_acq_dev,
+			sizeof(struct cam_sensor_acquire_dev));
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "Failed Copy to User rc=%d", rc);
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		rc = cam_ir_led_handle_init(ictrl);
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "Failed ACQUIRE_DEV: rc=%d", rc);
+			goto release_mutex;
+		}
+
+		ictrl->ir_led_state = CAM_IR_LED_STATE_ACQUIRE;
+		break;
+	case CAM_RELEASE_DEV:
+		if ((ictrl->ir_led_state == CAM_IR_LED_STATE_INIT) ||
+			(ictrl->ir_led_state == CAM_IR_LED_STATE_START)) {
+			CAM_WARN(CAM_IR_LED,
+				" Cannot apply Release dev: Prev state:%d",
+				ictrl->ir_led_state);
+		}
+
+		if (ictrl->device_hdl == -1 &&
+			ictrl->ir_led_state == CAM_IR_LED_STATE_ACQUIRE) {
+			CAM_ERR(CAM_IR_LED,
+				" Invalid Handle: device hdl: %d",
+				ictrl->device_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = cam_ir_led_release_dev(ictrl);
+		if (rc)
+			CAM_ERR(CAM_IR_LED,
+				" Failed in destroying the device Handle rc= %d",
+				rc);
+		ictrl->ir_led_state = CAM_IR_LED_STATE_INIT;
+		break;
+	case CAM_QUERY_CAP:
+		ir_led_cap.slot_info = ictrl->soc_info.index;
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle), &ir_led_cap,
+			sizeof(struct cam_ir_led_query_cap_info))) {
+			CAM_ERR(CAM_IR_LED, " Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		break;
+	case CAM_START_DEV:
+		if (ictrl->ir_led_state != CAM_IR_LED_STATE_ACQUIRE) {
+			CAM_ERR(CAM_IR_LED,
+				"Cannot apply Start Dev: Prev state: %d",
+				ictrl->ir_led_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		ictrl->ir_led_state = CAM_IR_LED_STATE_START;
+		break;
+	case CAM_STOP_DEV:
+		rc = cam_ir_led_stop_dev(ictrl);
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "Failed STOP_DEV: rc=%d", rc);
+			goto release_mutex;
+		}
+		ictrl->ir_led_state = CAM_IR_LED_STATE_ACQUIRE;
+		break;
+	case CAM_CONFIG_DEV:
+		if ((ictrl->ir_led_state == CAM_IR_LED_STATE_INIT) ||
+			(ictrl->ir_led_state == CAM_IR_LED_STATE_ACQUIRE)) {
+			CAM_ERR(CAM_IR_LED,
+				"Cannot apply Config Dev: Prev state: %d",
+				ictrl->ir_led_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = cam_ir_led_config(ictrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "Failed CONFIG_DEV: rc=%d", rc);
+			goto release_mutex;
+		}
+		break;
+	case CAM_FLUSH_REQ:
+		rc = cam_ir_led_stop_dev(ictrl);
+		if (rc) {
+			CAM_ERR(CAM_IR_LED, "Failed FLUSH_REQ: rc=%d", rc);
+			goto release_mutex;
+		}
+		ictrl->ir_led_state = CAM_IR_LED_STATE_ACQUIRE;
+		break;
+	default:
+		CAM_ERR(CAM_IR_LED, "Invalid Opcode:%d", cmd->op_code);
+		rc = -EINVAL;
+	}
+
+release_mutex:
+	mutex_unlock(&(ictrl->ir_led_mutex));
+	return rc;
+}
+
+static const struct of_device_id cam_ir_led_dt_match[] = {
+	{.compatible = "qcom,camera-ir-led", .data = NULL},
+	{}
+};
+
+static long cam_ir_led_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int rc = 0;
+	struct cam_ir_led_ctrl *ictrl = NULL;
+	struct cam_ir_led_private_soc *soc_private = NULL;
+
+	CAM_DBG(CAM_IR_LED, "Enter");
+
+	ictrl = v4l2_get_subdevdata(sd);
+	soc_private = ictrl->soc_info.soc_private;
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_ir_led_driver_cmd(ictrl, arg,
+			soc_private);
+		break;
+	default:
+		CAM_ERR(CAM_IR_LED, " Invalid ioctl cmd type %u", cmd);
+		rc = -EINVAL;
+		break;
+	}
+
+	CAM_DBG(CAM_IR_LED, "Exit");
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_ir_led_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_IR_LED,
+			" Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_ir_led_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc)
+			CAM_ERR(CAM_IR_LED, "cam_ir_led_ioctl failed");
+		break;
+	default:
+		CAM_ERR(CAM_IR_LED, " Invalid compat ioctl cmd_type:%d",
+			cmd);
+		rc = -EINVAL;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_IR_LED,
+				" Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+#endif
+
+static int cam_ir_led_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_ir_led_ctrl *ictrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!ictrl) {
+		CAM_ERR(CAM_IR_LED, " Ir_led ctrl ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&ictrl->ir_led_mutex);
+	cam_ir_led_shutdown(ictrl);
+	mutex_unlock(&ictrl->ir_led_mutex);
+
+	return 0;
+}
+
+static struct v4l2_subdev_core_ops cam_ir_led_subdev_core_ops = {
+	.ioctl = cam_ir_led_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_ir_led_subdev_do_ioctl
+#endif
+};
+
+static struct v4l2_subdev_ops cam_ir_led_subdev_ops = {
+	.core = &cam_ir_led_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cam_ir_led_internal_ops = {
+	.close = cam_ir_led_subdev_close,
+};
+
+static int cam_ir_led_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct cam_ir_led_ctrl *ictrl = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_IR_LED, "Enter");
+	if (!pdev->dev.of_node) {
+		CAM_ERR(CAM_IR_LED, "of_node NULL");
+		return -EINVAL;
+	}
+
+	ictrl = kzalloc(sizeof(struct cam_ir_led_ctrl), GFP_KERNEL);
+	if (!ictrl) {
+		CAM_ERR(CAM_IR_LED, "kzalloc failed!!");
+		return -ENOMEM;
+	}
+
+	ictrl->pdev = pdev;
+	ictrl->soc_info.pdev = pdev;
+	ictrl->soc_info.dev = &pdev->dev;
+	ictrl->soc_info.dev_name = pdev->name;
+
+	rc = cam_ir_led_get_dt_data(ictrl, &ictrl->soc_info);
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "cam_ir_led_get_dt_data failed rc=%d", rc);
+		if (ictrl->soc_info.soc_private != NULL) {
+			kfree(ictrl->soc_info.soc_private);
+			ictrl->soc_info.soc_private = NULL;
+		}
+		kfree(ictrl);
+		ictrl = NULL;
+		return -EINVAL;
+	}
+
+	ictrl->v4l2_dev_str.internal_ops =
+		&cam_ir_led_internal_ops;
+	ictrl->v4l2_dev_str.ops = &cam_ir_led_subdev_ops;
+	ictrl->v4l2_dev_str.name = CAMX_IR_LED_DEV_NAME;
+	ictrl->v4l2_dev_str.sd_flags =
+		V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+	ictrl->v4l2_dev_str.ent_function = CAM_IRLED_DEVICE_TYPE;
+	ictrl->v4l2_dev_str.token = ictrl;
+
+	rc = cam_register_subdev(&(ictrl->v4l2_dev_str));
+	if (rc) {
+		CAM_ERR(CAM_IR_LED, "Fail to create subdev with %d", rc);
+		kfree(ictrl);
+		return rc;
+	}
+
+	ictrl->device_hdl = -1;
+	platform_set_drvdata(pdev, ictrl);
+	v4l2_set_subdevdata(&ictrl->v4l2_dev_str.sd, ictrl);
+	mutex_init(&(ictrl->ir_led_mutex));
+	ictrl->ir_led_state = CAM_IR_LED_STATE_INIT;
+	cam_i2c_ir_led_init(ictrl);
+	cam_pmic_ir_cut_off(ictrl);
+	CAM_DBG(CAM_IR_LED, "%s component bound successfully", pdev->name);
+	return rc;
+}
+
+static void cam_ir_led_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct cam_ir_led_ctrl *ictrl;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	ictrl = platform_get_drvdata(pdev);
+	if (!ictrl) {
+		CAM_ERR(CAM_IR_LED, " Ir_led device is NULL");
+		return;
+	}
+
+	kfree(ictrl);
+}
+
+const static struct component_ops cam_ir_led_component_ops = {
+	.bind = cam_ir_led_component_bind,
+	.unbind = cam_ir_led_component_unbind,
+};
+
+static int cam_ir_led_platform_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	rc = component_add(&pdev->dev, &cam_ir_led_component_ops);
+	if (rc)
+		CAM_ERR(CAM_IR_LED, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_ir_led_platform_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ir_led_component_ops);
+	return 0;
+}
+
+static struct cam_ir_led_table cam_pmic_ir_led_table = {
+	.ir_led_driver_type = IR_LED_DRIVER_PMIC,
+	.func_tbl = {
+		.camera_ir_led_init = &cam_pmic_ir_led_init,
+		.camera_ir_led_release = &cam_pmic_ir_led_release,
+		.camera_ir_led_off = &cam_pmic_ir_led_off,
+		.camera_ir_led_on = &cam_pmic_ir_led_on,
+		.camera_ir_cut_off = &cam_pmic_ir_cut_off,
+		.camera_ir_cut_on = &cam_pmic_ir_cut_on,
+	},
+};
+
+static struct cam_ir_led_table cam_gpio_ir_led_table = {
+	.ir_led_driver_type = IR_LED_DRIVER_GPIO,
+	.func_tbl = {
+		.camera_ir_led_init = NULL,
+		.camera_ir_led_release = NULL,
+		.camera_ir_led_off = NULL,
+		.camera_ir_led_on = NULL,
+		.camera_ir_cut_off = NULL,
+		.camera_ir_cut_on = NULL,
+	},
+};
+
+static struct cam_ir_led_table cam_i2c_ir_led_table = {
+	.ir_led_driver_type = IR_LED_DRIVER_I2C,
+	.func_tbl = {
+		.camera_ir_led_init = &cam_i2c_ir_led_init,
+		.camera_ir_led_release = &cam_pmic_ir_led_release,
+		.camera_ir_led_off = &cam_i2c_ir_led_off,
+		.camera_ir_led_on = &cam_i2c_ir_led_on,
+		.camera_ir_cut_off = &cam_pmic_ir_cut_off,
+		.camera_ir_cut_on = &cam_i2c_ir_cut_on,
+	},
+};
+
+MODULE_DEVICE_TABLE(of, cam_ir_led_dt_match);
+
+struct platform_driver cam_ir_led_platform_driver = {
+	.probe = cam_ir_led_platform_probe,
+	.remove = cam_ir_led_platform_remove,
+	.driver = {
+		.name = "CAM-IR-LED-DRIVER",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ir_led_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int32_t cam_ir_led_init_module(void)
+{
+	int32_t rc = 0;
+
+	rc = platform_driver_register(&cam_ir_led_platform_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_IR_LED, "platform probe failed rc: %d", rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+void cam_ir_led_exit_module(void)
+{
+	platform_driver_unregister(&cam_ir_led_platform_driver);
+}
+
+MODULE_DESCRIPTION("CAM IR_LED");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_dev.h
@@ -0,0 +1,189 @@
+/* Copyright (c) 2019,2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#ifndef _CAM_IR_LED_DEV_H_
+#define _CAM_IR_LED_DEV_H_
+
+#include <linux/leds.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/gpio.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-event.h>
+#include <media/cam_sensor.h>
+#include <media/cam_req_mgr.h>
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_interface.h"
+#include "cam_subdev.h"
+#include "cam_mem_mgr.h"
+#include "cam_sensor_cmn_header.h"
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_sensor_io.h"
+
+/* msleep value as per specs from older SPs
+ will be updated as per new HW specs, as and when support is provided for current SP */
+#define CAM_IR_MSLEEP_VALUE 100
+
+#define CAMX_IR_LED_DEV_NAME "cam-ir-led-dev"
+#define CAM_IR_LED_PIPELINE_DELAY 1
+#define CAM_IR_LED_PACKET_OPCODE_OFF 0
+#define CAM_IR_LED_PACKET_OPCODE_ON  1
+#define CAM_IR_CUT_PACKET_OPCODE_ON  3
+#define CAM_IR_CUT_PACKET_OPCODE_OFF 4
+
+enum cam_ir_led_switch_trigger_ops {
+	IR_LED_SWITCH_OFF = 0,
+	IR_LED_SWITCH_ON,
+};
+
+enum cam_ir_led_driver_type {
+	IR_LED_DRIVER_GPIO,
+	IR_LED_DRIVER_PMIC,
+	IR_LED_DRIVER_I2C,
+	IR_LED_DRIVER_DEFAULT,
+};
+
+enum cam_ir_led_state {
+	CAM_IR_LED_STATE_INIT = 0,
+	CAM_IR_LED_STATE_ACQUIRE,
+	CAM_IR_LED_STATE_START,
+	CAM_IR_LED_STATE_ON,
+	CAM_IR_LED_STATE_OFF,
+};
+
+/**
+ * struct cam_ir_led_intf_params
+ * @device_hdl   : Device Handle
+ * @session_hdl  : Session Handle
+ * @link_hdl     : Link Handle
+ * @ops          : KMD operations
+ * @crm_cb       : Callback API pointers
+ */
+struct cam_ir_led_intf_params {
+	int32_t                     device_hdl;
+	int32_t                     session_hdl;
+	int32_t                     link_hdl;
+	struct cam_req_mgr_kmd_ops  ops;
+	struct cam_req_mgr_crm_cb  *crm_cb;
+};
+
+/**
+ * struct cam_ir_led_common_attr
+ * @is_settings_valid  : Notify the valid settings
+ * @request_id         : Request id provided by umd
+ * @count              : Number of led count
+ * @cmd_type           : Command buffer type
+ */
+struct cam_ir_led_common_attr {
+	bool      is_settings_valid;
+	uint64_t  request_id;
+	uint16_t  count;
+	uint8_t   cmd_type;
+};
+
+/**
+ * struct ir_led_init_packet
+ * @cmn_attr   : Provides common attributes
+ * @ir_led_type : Ir_led type(PMIC/I2C/GPIO)
+ */
+struct cam_ir_led_init_packet {
+	struct cam_ir_led_common_attr cmn_attr;
+	uint8_t                       ir_led_type;
+};
+
+/**
+ *  struct cam_ir_led_private_soc
+ * @switch_trigger_name : Switch trigger name
+ * @ir_led_trigger_name  : Ir_led trigger name array
+ * @ir_led_op_current    : Ir_led operational current
+ * @ir_led_max_current   : Max supported current for LED in ir_led mode
+ * @ir_led_max_duration  : Max turn on duration for LED in Ir_led mode
+ * @torch_trigger_name  : Torch trigger name array
+ * @torch_op_current    : Torch operational current
+ * @torch_max_current   : Max supported current for LED in torch mode
+ */
+
+struct cam_ir_led_private_soc {
+	const char   *switch_trigger_name;
+	const char   *ir_led_trigger_name;
+	uint32_t     ir_led_op_current;
+	uint32_t     ir_led_max_current;
+	uint32_t     ir_led_max_duration;
+	const char   *torch_trigger_name;
+	uint32_t     torch_op_current;
+	uint32_t     torch_max_current;
+};
+
+/**
+ *  struct cam_ir_led_ctrl
+ * @soc_info            : Soc related information
+ * @pdev                : Platform device
+ * @pwm_dev             : PWM device handle
+ * @func_tbl            : structure of h/w specific function pointers
+ * @of_node             : Of Node ptr
+ * @v4l2_dev_str        : V4L2 device structure
+ * @ir_led_mutex        : Mutex for ir_led operations
+ * @ir_led_state        : Current ir_led state (INIT/ACQUIRE/START/ON/OFF)
+ * @device_hdl          : Device Handle
+ * @ir_led_driver_type  : ir_led driver type (GPIO/PWM)
+ * @io_master_info      : Information about the communication master
+ */
+struct cam_ir_led_ctrl {
+	struct cam_hw_soc_info      soc_info;
+	struct platform_device      *pdev;
+	struct pwm_device           *pwm_dev;
+	struct cam_ir_led_func      *func_tbl;
+	struct device_node          *of_node;
+	struct cam_subdev           v4l2_dev_str;
+	struct mutex                ir_led_mutex;
+	enum   cam_ir_led_state     ir_led_state;
+	int32_t                     device_hdl;
+	enum cam_ir_led_driver_type ir_led_driver_type;
+	struct camera_io_master     io_master_info;
+};
+
+struct cam_ir_led_func {
+	int32_t (*camera_ir_led_init)(struct cam_ir_led_ctrl *);
+	int32_t (*camera_ir_led_release)(struct cam_ir_led_ctrl *);
+	int32_t (*camera_ir_led_off)(struct cam_ir_led_ctrl *);
+	int32_t (*camera_ir_led_on)(struct cam_ir_led_ctrl *,
+		struct cam_ir_led_set_on_off *);
+	int32_t (*camera_ir_cut_off)(struct cam_ir_led_ctrl *);
+	int32_t (*camera_ir_cut_on)(struct cam_ir_led_ctrl *,
+		struct cam_ir_led_set_on_off *);
+};
+
+struct cam_ir_led_table {
+	enum cam_ir_led_driver_type ir_led_driver_type;
+	struct cam_ir_led_func func_tbl;
+};
+
+/**
+ * @brief : API to register IR LED hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_ir_led_init_module(void);
+
+/**
+ * @brief : API to remove IR LED Hw from platform framework.
+ */
+void cam_ir_led_exit_module(void);
+
+#endif /*_CAM_IR_LED_DEV_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_soc.c
@@ -0,0 +1,76 @@
+/* Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/pwm.h>
+#include "cam_ir_led_soc.h"
+#include "cam_res_mgr_api.h"
+#include "linux/i2c.h"
+
+int cam_ir_led_get_dt_data(struct cam_ir_led_ctrl *ictrl,
+	struct cam_hw_soc_info *soc_info)
+{
+	int32_t rc = 0;
+
+	if (!ictrl) {
+		CAM_ERR(CAM_IR_LED, "NULL ir_led control structure");
+		return -EINVAL;
+	}
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_IR_LED, "get_dt_properties failed rc %d", rc);
+		return rc;
+	}
+
+	soc_info->soc_private =
+		kzalloc(sizeof(struct cam_ir_led_private_soc), GFP_KERNEL);
+	if (!soc_info->soc_private) {
+		CAM_ERR(CAM_IR_LED, "soc_info->soc_private is NULL");
+		rc = -ENOMEM;
+		goto release_soc_res;
+	}
+
+	if (of_property_read_bool(soc_info->dev->of_node, "pwms")) {
+		ictrl->pwm_dev = pwm_get(soc_info->dev, NULL);
+		if (ictrl->pwm_dev == NULL)
+			CAM_ERR(CAM_IR_LED, "Cannot get PWM device");
+		ictrl->ir_led_driver_type = IR_LED_DRIVER_PMIC;
+	} else if (of_property_read_bool(soc_info->dev->of_node, "i2c")) {
+		struct device_node *PCA9632 = of_parse_phandle(ictrl->pdev->dev.of_node, "i2c", 0);
+		if (PCA9632 == NULL)
+			CAM_ERR(CAM_IR_LED, "Cannot get PCA9632 device");
+		else {
+			ictrl->io_master_info.client =
+				of_find_i2c_device_by_node(PCA9632);
+
+			if (ictrl->io_master_info.client != NULL) {
+				ictrl->io_master_info.master_type = I2C_MASTER;
+				ictrl->ir_led_driver_type = IR_LED_DRIVER_I2C;
+			} else {
+				CAM_ERR(CAM_IR_LED, "Cannot get PCA9632 I2C device");
+			}
+
+			of_node_put(PCA9632);
+		}
+	} else {
+		ictrl->ir_led_driver_type = IR_LED_DRIVER_GPIO;
+	}
+
+	return rc;
+
+release_soc_res:
+	cam_soc_util_release_platform_resource(soc_info);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ir_led/cam_ir_led_soc.h
@@ -0,0 +1,22 @@
+/* Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef _CAM_IR_LED_SOC_H_
+#define _CAM_IR_LED_SOC_H_
+
+#include "cam_ir_led_dev.h"
+
+int cam_ir_led_get_dt_data(struct cam_ir_led_ctrl *fctrl,
+	struct cam_hw_soc_info *soc_info);
+
+#endif /*_CAM_IR_LED_SOC_H_*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_core.c
@@ -0,0 +1,1071 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/firmware.h>
+
+#include <cam_sensor_cmn_header.h>
+#include "cam_ois_core.h"
+#include "cam_ois_soc.h"
+#include "cam_sensor_util.h"
+#include "cam_debug_util.h"
+#include "cam_res_mgr_api.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+
+int32_t cam_ois_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int rc = 0;
+
+	power_info->power_setting_size = 1;
+	power_info->power_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_setting)
+		return -ENOMEM;
+
+	power_info->power_setting[0].seq_type = SENSOR_VAF;
+	power_info->power_setting[0].seq_val = CAM_VAF;
+	power_info->power_setting[0].config_val = 1;
+	power_info->power_setting[0].delay = 2;
+
+	power_info->power_down_setting_size = 1;
+	power_info->power_down_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting),
+			GFP_KERNEL);
+	if (!power_info->power_down_setting) {
+		rc = -ENOMEM;
+		goto free_power_settings;
+	}
+
+	power_info->power_down_setting[0].seq_type = SENSOR_VAF;
+	power_info->power_down_setting[0].seq_val = CAM_VAF;
+	power_info->power_down_setting[0].config_val = 0;
+
+	return rc;
+
+free_power_settings:
+	kfree(power_info->power_setting);
+	power_info->power_setting = NULL;
+	power_info->power_setting_size = 0;
+	return rc;
+}
+
+
+/**
+ * cam_ois_get_dev_handle - get device handle
+ * @o_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+static int cam_ois_get_dev_handle(struct cam_ois_ctrl_t *o_ctrl,
+	void *arg)
+{
+	struct cam_sensor_acquire_dev    ois_acq_dev;
+	struct cam_create_dev_hdl        bridge_params;
+	struct cam_control              *cmd = (struct cam_control *)arg;
+
+	if (o_ctrl->bridge_intf.device_hdl != -1) {
+		CAM_ERR(CAM_OIS, "Device is already acquired");
+		return -EFAULT;
+	}
+	if (copy_from_user(&ois_acq_dev, u64_to_user_ptr(cmd->handle),
+		sizeof(ois_acq_dev)))
+		return -EFAULT;
+
+	bridge_params.session_hdl = ois_acq_dev.session_handle;
+	bridge_params.ops = &o_ctrl->bridge_intf.ops;
+	bridge_params.v4l2_sub_dev_flag = 0;
+	bridge_params.media_entity_flag = 0;
+	bridge_params.priv = o_ctrl;
+	bridge_params.dev_id = CAM_OIS;
+
+	ois_acq_dev.device_handle =
+		cam_create_device_hdl(&bridge_params);
+	if (ois_acq_dev.device_handle <= 0) {
+		CAM_ERR(CAM_OIS, "Can not create device handle");
+		return -EFAULT;
+	}
+	o_ctrl->bridge_intf.device_hdl = ois_acq_dev.device_handle;
+	o_ctrl->bridge_intf.session_hdl = ois_acq_dev.session_handle;
+
+	CAM_DBG(CAM_OIS, "Device Handle: %d", ois_acq_dev.device_handle);
+	if (copy_to_user(u64_to_user_ptr(cmd->handle), &ois_acq_dev,
+		sizeof(struct cam_sensor_acquire_dev))) {
+		CAM_ERR(CAM_OIS, "ACQUIRE_DEV: copy to user failed");
+		return -EFAULT;
+	}
+	return 0;
+}
+
+static int cam_ois_power_up(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int                             rc = 0;
+	struct cam_hw_soc_info          *soc_info =
+		&o_ctrl->soc_info;
+	struct cam_ois_soc_private *soc_private;
+	struct cam_sensor_power_ctrl_t  *power_info;
+
+	soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	if ((power_info->power_setting == NULL) &&
+		(power_info->power_down_setting == NULL)) {
+		CAM_INFO(CAM_OIS,
+			"Using default power settings");
+		rc = cam_ois_construct_default_power_setting(power_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Construct default ois power setting failed.");
+			return rc;
+		}
+	}
+
+	/* Parse and fill vreg params for power up settings */
+	rc = msm_camera_fill_vreg_params(
+		soc_info,
+		power_info->power_setting,
+		power_info->power_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_OIS,
+			"failed to fill vreg params for power up rc:%d", rc);
+		return rc;
+	}
+
+	/* Parse and fill vreg params for power down settings*/
+	rc = msm_camera_fill_vreg_params(
+		soc_info,
+		power_info->power_down_setting,
+		power_info->power_down_setting_size);
+	if (rc) {
+		CAM_ERR(CAM_OIS,
+			"failed to fill vreg params for power down rc:%d", rc);
+		return rc;
+	}
+
+	power_info->dev = soc_info->dev;
+
+	rc = cam_sensor_core_power_up(power_info, soc_info);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "failed in ois power up rc %d", rc);
+		return rc;
+	}
+
+	rc = camera_io_init(&o_ctrl->io_master_info);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "cci_init failed: rc: %d", rc);
+		goto cci_failure;
+	}
+
+	return rc;
+cci_failure:
+	if (cam_sensor_util_power_down(power_info, soc_info))
+		CAM_ERR(CAM_OIS, "Power Down failed");
+
+	return rc;
+}
+
+/**
+ * cam_ois_power_down - power down OIS device
+ * @o_ctrl:     ctrl structure
+ *
+ * Returns success or failure
+ */
+static int cam_ois_power_down(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int32_t                         rc = 0;
+	struct cam_sensor_power_ctrl_t  *power_info;
+	struct cam_hw_soc_info          *soc_info =
+		&o_ctrl->soc_info;
+	struct cam_ois_soc_private *soc_private;
+
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "failed: o_ctrl %pK", o_ctrl);
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+	soc_info = &o_ctrl->soc_info;
+
+	if (!power_info) {
+		CAM_ERR(CAM_OIS, "failed: power_info %pK", power_info);
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_power_down(power_info, soc_info);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "power down the core is failed:%d", rc);
+		return rc;
+	}
+
+	camera_io_release(&o_ctrl->io_master_info);
+
+	return rc;
+}
+
+static int cam_ois_update_time(struct i2c_settings_array *i2c_set)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0;
+	uint32_t size = 0;
+	uint32_t i = 0;
+	uint64_t qtime_ns = 0;
+
+	if (i2c_set == NULL) {
+		CAM_ERR(CAM_OIS, "Invalid Args");
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_get_current_qtimer_ns(&qtime_ns);
+	if (rc < 0) {
+		CAM_ERR(CAM_OIS,
+			"Failed to get current qtimer value: %d",
+			rc);
+		return rc;
+	}
+
+	list_for_each_entry(i2c_list,
+		&(i2c_set->list_head), list) {
+		if (i2c_list->op_code ==  CAM_SENSOR_I2C_WRITE_SEQ) {
+			size = i2c_list->i2c_settings.size;
+			/* qtimer is 8 bytes so validate here*/
+			if (size < 8) {
+				CAM_ERR(CAM_OIS, "Invalid write time settings");
+				return -EINVAL;
+			}
+			for (i = 0; i < size; i++) {
+				CAM_DBG(CAM_OIS, "time: reg_data[%d]: 0x%x",
+					i, (qtime_ns & 0xFF));
+				i2c_list->i2c_settings.reg_setting[i].reg_data =
+					(qtime_ns & 0xFF);
+				qtime_ns >>= 8;
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ois_apply_settings(struct cam_ois_ctrl_t *o_ctrl,
+	struct i2c_settings_array *i2c_set)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0;
+	uint32_t i, size;
+
+	if (o_ctrl == NULL || i2c_set == NULL) {
+		CAM_ERR(CAM_OIS, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (i2c_set->is_settings_valid != 1) {
+		CAM_ERR(CAM_OIS, " Invalid settings");
+		return -EINVAL;
+	}
+
+	list_for_each_entry(i2c_list,
+		&(i2c_set->list_head), list) {
+		if (i2c_list->op_code ==  CAM_SENSOR_I2C_WRITE_RANDOM) {
+			rc = camera_io_dev_write(&(o_ctrl->io_master_info),
+				&(i2c_list->i2c_settings));
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+					"Failed in Applying i2c wrt settings");
+				return rc;
+			}
+		} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_SEQ) {
+			rc = camera_io_dev_write_continuous(
+				&(o_ctrl->io_master_info),
+				&(i2c_list->i2c_settings),
+				0);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+					"Failed to seq write I2C settings: %d",
+					rc);
+				return rc;
+			}
+		} else if (i2c_list->op_code == CAM_SENSOR_I2C_POLL) {
+			size = i2c_list->i2c_settings.size;
+			for (i = 0; i < size; i++) {
+				rc = camera_io_dev_poll(
+				&(o_ctrl->io_master_info),
+				i2c_list->i2c_settings.reg_setting[i].reg_addr,
+				i2c_list->i2c_settings.reg_setting[i].reg_data,
+				i2c_list->i2c_settings.reg_setting[i].data_mask,
+				i2c_list->i2c_settings.addr_type,
+				i2c_list->i2c_settings.data_type,
+				i2c_list->i2c_settings.reg_setting[i].delay);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+						"i2c poll apply setting Fail");
+					return rc;
+				}
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int cam_ois_slaveInfo_pkt_parser(struct cam_ois_ctrl_t *o_ctrl,
+	uint32_t *cmd_buf, size_t len)
+{
+	int32_t rc = 0;
+	struct cam_cmd_ois_info *ois_info;
+
+	if (!o_ctrl || !cmd_buf || len < sizeof(struct cam_cmd_ois_info)) {
+		CAM_ERR(CAM_OIS, "Invalid Args");
+		return -EINVAL;
+	}
+
+	ois_info = (struct cam_cmd_ois_info *)cmd_buf;
+	if (o_ctrl->io_master_info.master_type == CCI_MASTER) {
+		o_ctrl->io_master_info.cci_client->i2c_freq_mode =
+			ois_info->i2c_freq_mode;
+		o_ctrl->io_master_info.cci_client->sid =
+			ois_info->slave_addr >> 1;
+		o_ctrl->ois_fw_flag = ois_info->ois_fw_flag;
+		o_ctrl->is_ois_calib = ois_info->is_ois_calib;
+		memcpy(o_ctrl->ois_name, ois_info->ois_name, OIS_NAME_LEN);
+		o_ctrl->ois_name[OIS_NAME_LEN - 1] = '\0';
+		o_ctrl->io_master_info.cci_client->retries = 3;
+		o_ctrl->io_master_info.cci_client->id_map = 0;
+		memcpy(&(o_ctrl->opcode), &(ois_info->opcode),
+			sizeof(struct cam_ois_opcode));
+		CAM_DBG(CAM_OIS, "Slave addr: 0x%x Freq Mode: %d",
+			ois_info->slave_addr, ois_info->i2c_freq_mode);
+	} else if (o_ctrl->io_master_info.master_type == I2C_MASTER) {
+		o_ctrl->io_master_info.client->addr = ois_info->slave_addr;
+		CAM_DBG(CAM_OIS, "Slave addr: 0x%x", ois_info->slave_addr);
+	} else {
+		CAM_ERR(CAM_OIS, "Invalid Master type : %d",
+			o_ctrl->io_master_info.master_type);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_ois_fw_download(struct cam_ois_ctrl_t *o_ctrl)
+{
+	uint16_t                           total_bytes = 0;
+	uint8_t                           *ptr = NULL;
+	int32_t                            rc = 0, cnt;
+	uint32_t                           fw_size;
+	const struct firmware             *fw = NULL;
+	const char                        *fw_name_prog = NULL;
+	const char                        *fw_name_coeff = NULL;
+	char                               name_prog[32] = {0};
+	char                               name_coeff[32] = {0};
+	struct device                     *dev = &(o_ctrl->pdev->dev);
+	struct cam_sensor_i2c_reg_setting  i2c_reg_setting;
+	void                              *vaddr = NULL;
+
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "Invalid Args");
+		return -EINVAL;
+	}
+
+	snprintf(name_coeff, 32, "%s.coeff", o_ctrl->ois_name);
+
+	snprintf(name_prog, 32, "%s.prog", o_ctrl->ois_name);
+
+	/* cast pointer as const pointer*/
+	fw_name_prog = name_prog;
+	fw_name_coeff = name_coeff;
+
+	/* Load FW */
+	rc = request_firmware(&fw, fw_name_prog, dev);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "Failed to locate %s", fw_name_prog);
+		return rc;
+	}
+
+	total_bytes = fw->size;
+	i2c_reg_setting.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	i2c_reg_setting.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	i2c_reg_setting.size = total_bytes;
+	i2c_reg_setting.delay = 0;
+	fw_size = (sizeof(struct cam_sensor_i2c_reg_array) * total_bytes);
+	vaddr = vmalloc(fw_size);
+	if (!vaddr) {
+		CAM_ERR(CAM_OIS,
+			"Failed in allocating i2c_array: fw_size: %u", fw_size);
+		release_firmware(fw);
+		return -ENOMEM;
+	}
+
+	i2c_reg_setting.reg_setting = (struct cam_sensor_i2c_reg_array *) (
+		vaddr);
+
+	for (cnt = 0, ptr = (uint8_t *)fw->data; cnt < total_bytes;
+		cnt++, ptr++) {
+		i2c_reg_setting.reg_setting[cnt].reg_addr =
+			o_ctrl->opcode.prog;
+		i2c_reg_setting.reg_setting[cnt].reg_data = *ptr;
+		i2c_reg_setting.reg_setting[cnt].delay = 0;
+		i2c_reg_setting.reg_setting[cnt].data_mask = 0;
+	}
+
+	rc = camera_io_dev_write_continuous(&(o_ctrl->io_master_info),
+		&i2c_reg_setting, 1);
+	if (rc < 0) {
+		CAM_ERR(CAM_OIS, "OIS FW download failed %d", rc);
+		goto release_firmware;
+	}
+	vfree(vaddr);
+	vaddr = NULL;
+	fw_size = 0;
+	release_firmware(fw);
+
+	rc = request_firmware(&fw, fw_name_coeff, dev);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "Failed to locate %s", fw_name_coeff);
+		return rc;
+	}
+
+	total_bytes = fw->size;
+	i2c_reg_setting.addr_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	i2c_reg_setting.data_type = CAMERA_SENSOR_I2C_TYPE_BYTE;
+	i2c_reg_setting.size = total_bytes;
+	i2c_reg_setting.delay = 0;
+	fw_size = (sizeof(struct cam_sensor_i2c_reg_array) * total_bytes);
+	vaddr = vmalloc(fw_size);
+	if (!vaddr) {
+		CAM_ERR(CAM_OIS,
+			"Failed in allocating i2c_array: fw_size: %u", fw_size);
+		release_firmware(fw);
+		return -ENOMEM;
+	}
+
+	i2c_reg_setting.reg_setting = (struct cam_sensor_i2c_reg_array *) (
+		vaddr);
+
+	for (cnt = 0, ptr = (uint8_t *)fw->data; cnt < total_bytes;
+		cnt++, ptr++) {
+		i2c_reg_setting.reg_setting[cnt].reg_addr =
+			o_ctrl->opcode.coeff;
+		i2c_reg_setting.reg_setting[cnt].reg_data = *ptr;
+		i2c_reg_setting.reg_setting[cnt].delay = 0;
+		i2c_reg_setting.reg_setting[cnt].data_mask = 0;
+	}
+
+	rc = camera_io_dev_write_continuous(&(o_ctrl->io_master_info),
+		&i2c_reg_setting, 1);
+	if (rc < 0)
+		CAM_ERR(CAM_OIS, "OIS FW download failed %d", rc);
+
+release_firmware:
+	vfree(vaddr);
+	vaddr = NULL;
+	fw_size = 0;
+	release_firmware(fw);
+	return rc;
+}
+
+/**
+ * cam_ois_pkt_parse - Parse csl packet
+ * @o_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
+{
+	int32_t                         rc = 0;
+	int32_t                         i = 0;
+	uint32_t                        total_cmd_buf_in_bytes = 0;
+	struct common_header           *cmm_hdr = NULL;
+	uintptr_t                       generic_ptr;
+	struct cam_control             *ioctl_ctrl = NULL;
+	struct cam_config_dev_cmd       dev_config;
+	struct i2c_settings_array      *i2c_reg_settings = NULL;
+	struct cam_cmd_buf_desc        *cmd_desc = NULL;
+	uintptr_t                       generic_pkt_addr;
+	size_t                          pkt_len;
+	size_t                          remain_len = 0;
+	struct cam_packet              *csl_packet = NULL;
+	struct cam_packet              *csl_packet_u = NULL;
+	size_t                          len_of_buff = 0;
+	uint32_t                       *offset = NULL, *cmd_buf;
+	struct cam_ois_soc_private     *soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t  *power_info = &soc_private->power_info;
+	size_t                           packet_size = 0;
+
+	ioctl_ctrl = (struct cam_control *)arg;
+	if (copy_from_user(&dev_config,
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(dev_config)))
+		return -EFAULT;
+	rc = cam_mem_get_cpu_buf(dev_config.packet_handle,
+		&generic_pkt_addr, &pkt_len);
+	if (rc) {
+		CAM_ERR(CAM_OIS,
+			"error in converting command Handle Error: %d", rc);
+		return rc;
+	}
+
+	remain_len = pkt_len;
+	if ((sizeof(struct cam_packet) > pkt_len) ||
+		((size_t)dev_config.offset >= pkt_len -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_OIS,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), pkt_len);
+		rc = -EINVAL;
+		goto put_ref;
+	}
+
+	remain_len -= (size_t)dev_config.offset;
+	csl_packet_u = (struct cam_packet *)
+		(generic_pkt_addr + (uint32_t)dev_config.offset);
+	packet_size = csl_packet_u->header.size;
+	if (packet_size <= remain_len) {
+		rc = cam_common_mem_kdup((void **)&csl_packet,
+			csl_packet_u, packet_size);
+		if (rc) {
+			CAM_ERR(CAM_OIS, "Alloc and copy request %lld packet fail",
+				csl_packet_u->header.request_id);
+			goto put_ref;
+		}
+	} else {
+		CAM_ERR(CAM_OIS, "Invalid packet header size %u",
+			packet_size);
+		rc = -EINVAL;
+		goto put_ref;
+	}
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_OIS, "Invalid packet params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_OIS_PACKET_OPCODE_INIT:
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+		/* Loop through multiple command buffers */
+		for (i = 0; i < csl_packet->num_cmd_buf; i++) {
+			rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+			if (rc) {
+				CAM_ERR(CAM_OIS, "Invalid cmd desc");
+				goto end;
+			}
+
+			total_cmd_buf_in_bytes = cmd_desc[i].length;
+			if (!total_cmd_buf_in_bytes)
+				continue;
+
+			rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+				&generic_ptr, &len_of_buff);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS, "Failed to get cpu buf : 0x%x",
+					cmd_desc[i].mem_handle);
+				goto end;
+			}
+			cmd_buf = (uint32_t *)generic_ptr;
+			if (!cmd_buf) {
+				CAM_ERR(CAM_OIS, "invalid cmd buf");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				goto end;
+			}
+
+			if ((len_of_buff < sizeof(struct common_header)) ||
+				(cmd_desc[i].offset > (len_of_buff -
+				sizeof(struct common_header)))) {
+				CAM_ERR(CAM_OIS,
+					"Invalid length for sensor cmd");
+				rc = -EINVAL;
+				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+				goto end;
+			}
+			remain_len = len_of_buff - cmd_desc[i].offset;
+			cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+			cmm_hdr = (struct common_header *)cmd_buf;
+
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
+				rc = cam_ois_slaveInfo_pkt_parser(
+					o_ctrl, cmd_buf, remain_len);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+					"Failed in parsing slave info");
+					break;
+				}
+				break;
+			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
+			case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
+				CAM_DBG(CAM_OIS,
+					"Received power settings buffer");
+				rc = cam_sensor_update_power_settings(
+					cmd_buf,
+					total_cmd_buf_in_bytes,
+					power_info, remain_len);
+				if (rc) {
+					CAM_ERR(CAM_OIS,
+					"Failed: parse power settings");
+					break;
+				}
+				break;
+			default:
+			if (o_ctrl->i2c_init_data.is_settings_valid == 0) {
+				CAM_DBG(CAM_OIS,
+				"Received init settings");
+				i2c_reg_settings =
+					&(o_ctrl->i2c_init_data);
+				i2c_reg_settings->is_settings_valid = 1;
+				i2c_reg_settings->request_id = 0;
+				rc = cam_sensor_i2c_command_parser(
+					&o_ctrl->io_master_info,
+					i2c_reg_settings,
+					&cmd_desc[i], 1, NULL);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+					"init parsing failed: %d", rc);
+					break;
+				}
+			} else if ((o_ctrl->is_ois_calib != 0) &&
+				(o_ctrl->i2c_calib_data.is_settings_valid ==
+				0)) {
+				CAM_DBG(CAM_OIS,
+					"Received calib settings");
+				i2c_reg_settings = &(o_ctrl->i2c_calib_data);
+				i2c_reg_settings->is_settings_valid = 1;
+				i2c_reg_settings->request_id = 0;
+				rc = cam_sensor_i2c_command_parser(
+					&o_ctrl->io_master_info,
+					i2c_reg_settings,
+					&cmd_desc[i], 1, NULL);
+				if (rc < 0) {
+					CAM_ERR(CAM_OIS,
+						"Calib parsing failed: %d", rc);
+					break;
+				}
+			}
+			break;
+			}
+			cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+
+			if (rc < 0)
+				goto end;
+		}
+
+		if (o_ctrl->cam_ois_state != CAM_OIS_CONFIG) {
+			rc = cam_ois_power_up(o_ctrl);
+			if (rc) {
+				CAM_ERR(CAM_OIS, " OIS Power up failed");
+				goto end;
+			}
+			o_ctrl->cam_ois_state = CAM_OIS_CONFIG;
+		}
+
+		if (o_ctrl->ois_fw_flag) {
+			rc = cam_ois_fw_download(o_ctrl);
+			if (rc) {
+				CAM_ERR(CAM_OIS, "Failed OIS FW Download");
+				goto pwr_dwn;
+			}
+		}
+
+		rc = cam_ois_apply_settings(o_ctrl, &o_ctrl->i2c_init_data);
+		if ((rc == -EAGAIN) &&
+			(o_ctrl->io_master_info.master_type == CCI_MASTER)) {
+			CAM_WARN(CAM_OIS,
+				"CCI HW is restting: Reapplying INIT settings");
+			usleep_range(1000, 1010);
+			rc = cam_ois_apply_settings(o_ctrl,
+				&o_ctrl->i2c_init_data);
+		}
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Cannot apply Init settings: rc = %d",
+				rc);
+			goto pwr_dwn;
+		}
+
+		if (o_ctrl->is_ois_calib) {
+			rc = cam_ois_apply_settings(o_ctrl,
+				&o_ctrl->i2c_calib_data);
+			if (rc) {
+				CAM_ERR(CAM_OIS, "Cannot apply calib data");
+				goto pwr_dwn;
+			}
+		}
+
+		rc = delete_request(&o_ctrl->i2c_init_data);
+		if (rc < 0) {
+			CAM_WARN(CAM_OIS,
+				"Fail deleting Init data: rc: %d", rc);
+			rc = 0;
+		}
+		rc = delete_request(&o_ctrl->i2c_calib_data);
+		if (rc < 0) {
+			CAM_WARN(CAM_OIS,
+				"Fail deleting Calibration data: rc: %d", rc);
+			rc = 0;
+		}
+		break;
+	case CAM_OIS_PACKET_OPCODE_OIS_CONTROL:
+		if (o_ctrl->cam_ois_state < CAM_OIS_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+				"Not in right state to control OIS: %d",
+				o_ctrl->cam_ois_state);
+			goto end;
+		}
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		i2c_reg_settings = &(o_ctrl->i2c_mode_data);
+		i2c_reg_settings->is_settings_valid = 1;
+		i2c_reg_settings->request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&o_ctrl->io_master_info,
+			i2c_reg_settings,
+			cmd_desc, 1, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc);
+			goto end;
+		}
+
+		rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "Cannot apply mode settings");
+			goto end;
+		}
+
+		rc = delete_request(i2c_reg_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Fail deleting Mode data: rc: %d", rc);
+			goto end;
+		}
+		break;
+	case CAM_OIS_PACKET_OPCODE_READ: {
+		struct cam_buf_io_cfg *io_cfg;
+		struct i2c_settings_array i2c_read_settings;
+
+		if (o_ctrl->cam_ois_state < CAM_OIS_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+				"Not in right state to read OIS: %d",
+				o_ctrl->cam_ois_state);
+			goto end;
+		}
+		CAM_DBG(CAM_OIS, "number of I/O configs: %d:",
+			csl_packet->num_io_configs);
+		if (csl_packet->num_io_configs == 0) {
+			CAM_ERR(CAM_OIS, "No I/O configs to process");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		INIT_LIST_HEAD(&(i2c_read_settings.list_head));
+
+		io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+			&csl_packet->payload_flex +
+			csl_packet->io_configs_offset);
+
+		/* validate read data io config */
+		if (io_cfg == NULL) {
+			CAM_ERR(CAM_OIS, "I/O config is invalid(NULL)");
+			rc = -EINVAL;
+			goto end;
+		}
+
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		i2c_read_settings.is_settings_valid = 1;
+		i2c_read_settings.request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&o_ctrl->io_master_info,
+			&i2c_read_settings,
+			cmd_desc, 1, &io_cfg[0]);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "OIS read pkt parsing failed: %d", rc);
+			goto end;
+		}
+
+		rc = cam_sensor_i2c_read_data(
+			&i2c_read_settings,
+			&o_ctrl->io_master_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "cannot read data rc: %d", rc);
+			delete_request(&i2c_read_settings);
+			goto end;
+		}
+
+		if (csl_packet->num_io_configs > 1) {
+			rc = cam_sensor_util_write_qtimer_to_io_buffer(
+				&io_cfg[1]);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS,
+					"write qtimer failed rc: %d", rc);
+				delete_request(&i2c_read_settings);
+				goto end;
+			}
+		}
+
+		rc = delete_request(&i2c_read_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Failed in deleting the read settings");
+			goto end;
+		}
+		break;
+	}
+	case CAM_OIS_PACKET_OPCODE_WRITE_TIME: {
+		if (o_ctrl->cam_ois_state < CAM_OIS_CONFIG) {
+			rc = -EINVAL;
+			CAM_ERR(CAM_OIS,
+				"Not in right state to write time to OIS: %d",
+				o_ctrl->cam_ois_state);
+			goto end;
+		}
+		offset = (uint32_t *)&csl_packet->payload_flex;
+		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
+		cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+		i2c_reg_settings = &(o_ctrl->i2c_time_data);
+		i2c_reg_settings->is_settings_valid = 1;
+		i2c_reg_settings->request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&o_ctrl->io_master_info,
+			i2c_reg_settings,
+			cmd_desc, 1, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc);
+			goto end;
+		}
+
+		rc = cam_ois_update_time(i2c_reg_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "Cannot update time");
+			goto end;
+		}
+
+		rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS, "Cannot apply mode settings");
+			goto end;
+		}
+
+		rc = delete_request(i2c_reg_settings);
+		if (rc < 0) {
+			CAM_ERR(CAM_OIS,
+				"Fail deleting Mode data: rc: %d", rc);
+			goto end;
+		}
+		break;
+	}
+	default:
+		CAM_ERR(CAM_OIS, "Invalid Opcode: %d",
+			(csl_packet->header.op_code & 0xFFFFFF));
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!rc)
+		goto end;
+
+pwr_dwn:
+	cam_ois_power_down(o_ctrl);
+end:
+	cam_common_mem_free(csl_packet);
+put_ref:
+	cam_mem_put_cpu_buf(dev_config.packet_handle);
+	return rc;
+}
+
+void cam_ois_shutdown(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int rc = 0;
+	struct cam_ois_soc_private *soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+
+	if (o_ctrl->cam_ois_state == CAM_OIS_INIT)
+		return;
+
+	if (o_ctrl->cam_ois_state >= CAM_OIS_CONFIG) {
+		rc = cam_ois_power_down(o_ctrl);
+		if (rc < 0)
+			CAM_ERR(CAM_OIS, "OIS Power down failed");
+		o_ctrl->cam_ois_state = CAM_OIS_ACQUIRE;
+	}
+
+	if (o_ctrl->cam_ois_state >= CAM_OIS_ACQUIRE) {
+		rc = cam_destroy_device_hdl(o_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_OIS, "destroying the device hdl");
+		o_ctrl->bridge_intf.device_hdl = -1;
+		o_ctrl->bridge_intf.link_hdl = -1;
+		o_ctrl->bridge_intf.session_hdl = -1;
+	}
+
+	if (o_ctrl->i2c_mode_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_mode_data);
+
+	if (o_ctrl->i2c_calib_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_calib_data);
+
+	if (o_ctrl->i2c_init_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_init_data);
+
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_down_setting_size = 0;
+	power_info->power_setting_size = 0;
+
+	o_ctrl->cam_ois_state = CAM_OIS_INIT;
+}
+
+/**
+ * cam_ois_driver_cmd - Handle ois cmds
+ * @e_ctrl:     ctrl structure
+ * @arg:        Camera control command argument
+ *
+ * Returns success or failure
+ */
+int cam_ois_driver_cmd(struct cam_ois_ctrl_t *o_ctrl, void *arg)
+{
+	int                              rc = 0;
+	struct cam_ois_query_cap_t       ois_cap = {0};
+	struct cam_control              *cmd = (struct cam_control *)arg;
+	struct cam_ois_soc_private      *soc_private = NULL;
+	struct cam_sensor_power_ctrl_t  *power_info = NULL;
+
+	if (!o_ctrl || !cmd) {
+		CAM_ERR(CAM_OIS, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_OIS, "Invalid handle type: %d",
+			cmd->handle_type);
+		return -EINVAL;
+	}
+
+	soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	mutex_lock(&(o_ctrl->ois_mutex));
+	switch (cmd->op_code) {
+	case CAM_QUERY_CAP:
+		ois_cap.slot_info = o_ctrl->soc_info.index;
+
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&ois_cap,
+			sizeof(struct cam_ois_query_cap_t))) {
+			CAM_ERR(CAM_OIS, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		CAM_DBG(CAM_OIS, "ois_cap: ID: %d", ois_cap.slot_info);
+		break;
+	case CAM_ACQUIRE_DEV:
+		rc = cam_ois_get_dev_handle(o_ctrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_OIS, "Failed to acquire dev");
+			goto release_mutex;
+		}
+
+		o_ctrl->cam_ois_state = CAM_OIS_ACQUIRE;
+		break;
+	case CAM_START_DEV:
+		if (o_ctrl->cam_ois_state != CAM_OIS_CONFIG) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+			"Not in right state for start : %d",
+			o_ctrl->cam_ois_state);
+			goto release_mutex;
+		}
+		o_ctrl->cam_ois_state = CAM_OIS_START;
+		break;
+	case CAM_CONFIG_DEV:
+		rc = cam_ois_pkt_parse(o_ctrl, arg);
+		if (rc) {
+			CAM_ERR(CAM_OIS, "Failed in ois pkt Parsing");
+			goto release_mutex;
+		}
+		break;
+	case CAM_RELEASE_DEV:
+		if (o_ctrl->cam_ois_state == CAM_OIS_START) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+				"Cant release ois: in start state");
+			goto release_mutex;
+		}
+
+		if (o_ctrl->cam_ois_state == CAM_OIS_CONFIG) {
+			rc = cam_ois_power_down(o_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_OIS, "OIS Power down failed");
+				goto release_mutex;
+			}
+		}
+
+		if (o_ctrl->bridge_intf.device_hdl == -1) {
+			CAM_ERR(CAM_OIS, "link hdl: %d device hdl: %d",
+				o_ctrl->bridge_intf.device_hdl,
+				o_ctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = cam_destroy_device_hdl(o_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_OIS, "destroying the device hdl");
+		o_ctrl->bridge_intf.device_hdl = -1;
+		o_ctrl->bridge_intf.link_hdl = -1;
+		o_ctrl->bridge_intf.session_hdl = -1;
+		o_ctrl->cam_ois_state = CAM_OIS_INIT;
+
+		kfree(power_info->power_setting);
+		kfree(power_info->power_down_setting);
+		power_info->power_setting = NULL;
+		power_info->power_down_setting = NULL;
+		power_info->power_down_setting_size = 0;
+		power_info->power_setting_size = 0;
+
+		if (o_ctrl->i2c_mode_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_mode_data);
+
+		if (o_ctrl->i2c_calib_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_calib_data);
+
+		if (o_ctrl->i2c_init_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_init_data);
+
+		break;
+	case CAM_STOP_DEV:
+		if (o_ctrl->cam_ois_state != CAM_OIS_START) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_OIS,
+			"Not in right state for stop : %d",
+			o_ctrl->cam_ois_state);
+		}
+		o_ctrl->cam_ois_state = CAM_OIS_CONFIG;
+		break;
+	default:
+		CAM_ERR(CAM_OIS, "invalid opcode");
+		goto release_mutex;
+	}
+release_mutex:
+	mutex_unlock(&(o_ctrl->ois_mutex));
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_core.h
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_OIS_CORE_H_
+#define _CAM_OIS_CORE_H_
+
+#include <linux/cma.h>
+#include "cam_ois_dev.h"
+
+#define OIS_NAME_LEN 32
+
+/**
+ * @power_info: power setting info to control the power
+ *
+ * This API construct the default ois power setting.
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int32_t cam_ois_construct_default_power_setting(
+	struct cam_sensor_power_ctrl_t *power_info);
+
+
+int cam_ois_driver_cmd(struct cam_ois_ctrl_t *e_ctrl, void *arg);
+
+/**
+ * @o_ctrl: OIS ctrl structure
+ *
+ * This API handles the shutdown ioctl/close
+ */
+void cam_ois_shutdown(struct cam_ois_ctrl_t *o_ctrl);
+
+#endif
+/* _CAM_OIS_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_dev.c
@@ -0,0 +1,477 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_ois_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_ois_soc.h"
+#include "cam_ois_core.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+static int cam_ois_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_ois_ctrl_t *o_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "o_ctrl ptr is NULL");
+			return -EINVAL;
+	}
+
+	mutex_lock(&(o_ctrl->ois_mutex));
+	cam_ois_shutdown(o_ctrl);
+	mutex_unlock(&(o_ctrl->ois_mutex));
+
+	return 0;
+}
+
+static int cam_ois_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_OIS, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_ois_subdev_close_internal(sd, fh);
+}
+
+static long cam_ois_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int                       rc     = 0;
+	struct cam_ois_ctrl_t *o_ctrl = v4l2_get_subdevdata(sd);
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_ois_driver_cmd(o_ctrl, arg);
+		if (rc)
+			CAM_ERR(CAM_OIS,
+				"Failed with driver cmd: %d", rc);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+		rc = cam_ois_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR(CAM_OIS, "Wrong IOCTL cmd: %u", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	return rc;
+}
+
+static int32_t cam_ois_update_i2c_info(struct cam_ois_ctrl_t *o_ctrl,
+	struct cam_ois_i2c_info_t *i2c_info)
+{
+	struct cam_sensor_cci_client        *cci_client = NULL;
+
+	if (o_ctrl->io_master_info.master_type == CCI_MASTER) {
+		cci_client = o_ctrl->io_master_info.cci_client;
+		if (!cci_client) {
+			CAM_ERR(CAM_OIS, "failed: cci_client %pK",
+				cci_client);
+			return -EINVAL;
+		}
+		cci_client->cci_i2c_master = o_ctrl->cci_i2c_master;
+		cci_client->sid = (i2c_info->slave_addr) >> 1;
+		cci_client->retries = 3;
+		cci_client->id_map = 0;
+		cci_client->i2c_freq_mode = i2c_info->i2c_freq_mode;
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_ois_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_OIS,
+			"Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_ois_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc) {
+			CAM_ERR(CAM_OIS,
+				"Failed in ois suddev handling rc %d",
+				rc);
+			return rc;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_OIS, "Invalid compat ioctl: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_OIS,
+				"Failed to copy from user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+	return rc;
+}
+#endif
+
+static const struct v4l2_subdev_internal_ops cam_ois_internal_ops = {
+	.close = cam_ois_subdev_close,
+};
+
+static struct v4l2_subdev_core_ops cam_ois_subdev_core_ops = {
+	.ioctl = cam_ois_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_ois_init_subdev_do_ioctl,
+#endif
+};
+
+static struct v4l2_subdev_ops cam_ois_subdev_ops = {
+	.core = &cam_ois_subdev_core_ops,
+};
+
+static int cam_ois_init_subdev_param(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int rc = 0;
+
+	o_ctrl->v4l2_dev_str.internal_ops = &cam_ois_internal_ops;
+	o_ctrl->v4l2_dev_str.ops = &cam_ois_subdev_ops;
+	strscpy(o_ctrl->device_name, CAM_OIS_NAME,
+		sizeof(o_ctrl->device_name));
+	o_ctrl->v4l2_dev_str.name = o_ctrl->device_name;
+	o_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	o_ctrl->v4l2_dev_str.ent_function = CAM_OIS_DEVICE_TYPE;
+	o_ctrl->v4l2_dev_str.token = o_ctrl;
+	 o_ctrl->v4l2_dev_str.close_seq_prior = CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(o_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_OIS, "fail to create subdev");
+
+	return rc;
+}
+
+static int cam_ois_i2c_driver_probe(struct i2c_client *client)
+{
+	int                          rc = 0;
+	struct cam_ois_ctrl_t       *o_ctrl = NULL;
+	struct cam_ois_soc_private  *soc_private = NULL;
+
+	if (client == NULL) {
+		CAM_ERR(CAM_OIS, "Invalid Args client: %pK ",
+			client);
+		return -EINVAL;
+	}
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_OIS, "i2c_check_functionality failed");
+		goto probe_failure;
+	}
+
+	o_ctrl = kzalloc(sizeof(*o_ctrl), GFP_KERNEL);
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "kzalloc failed");
+		rc = -ENOMEM;
+		goto probe_failure;
+	}
+
+	i2c_set_clientdata(client, o_ctrl);
+
+	o_ctrl->soc_info.dev = &client->dev;
+	o_ctrl->soc_info.dev_name = client->name;
+	o_ctrl->ois_device_type = MSM_CAMERA_I2C_DEVICE;
+	o_ctrl->io_master_info.master_type = I2C_MASTER;
+	o_ctrl->io_master_info.client = client;
+
+	soc_private = kzalloc(sizeof(struct cam_ois_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto octrl_free;
+	}
+
+	o_ctrl->soc_info.soc_private = soc_private;
+	rc = cam_ois_driver_soc_init(o_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "failed: cam_sensor_parse_dt rc %d", rc);
+		goto soc_free;
+	}
+
+	rc = cam_ois_init_subdev_param(o_ctrl);
+	if (rc)
+		goto soc_free;
+
+	o_ctrl->cam_ois_state = CAM_OIS_INIT;
+
+	return rc;
+
+soc_free:
+	kfree(soc_private);
+octrl_free:
+	kfree(o_ctrl);
+probe_failure:
+	return rc;
+}
+
+int cam_ois_i2c_driver_remove_common(struct i2c_client *client)
+{
+	int i = 0;
+	struct cam_hw_soc_info         *soc_info =    NULL;
+	struct cam_ois_soc_private     *soc_private = NULL;
+	struct cam_sensor_power_ctrl_t *power_info  = NULL;
+	int rc = 0;
+	struct cam_ois_ctrl_t  *o_ctrl = i2c_get_clientdata(client);
+
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "ois device is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	CAM_INFO(CAM_OIS, "i2c driver remove invoked");
+	soc_info = &o_ctrl->soc_info;
+
+	for (i = 0; i < soc_info->num_clk; i++)
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+
+	mutex_lock(&(o_ctrl->ois_mutex));
+	cam_ois_shutdown(o_ctrl);
+	mutex_unlock(&(o_ctrl->ois_mutex));
+	rc = cam_unregister_subdev(&(o_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_OIS, "ois unregistering device is not sucessful");
+
+	soc_private =
+		(struct cam_ois_soc_private *)soc_info->soc_private;
+	power_info = &soc_private->power_info;
+
+	kfree(o_ctrl->soc_info.soc_private);
+	v4l2_set_subdevdata(&o_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(o_ctrl);
+
+	return rc;
+}
+
+static int cam_ois_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t                         rc = 0;
+	struct cam_ois_ctrl_t          *o_ctrl = NULL;
+	struct cam_ois_soc_private     *soc_private = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	o_ctrl = kzalloc(sizeof(struct cam_ois_ctrl_t), GFP_KERNEL);
+	if (!o_ctrl)
+		return -ENOMEM;
+
+	o_ctrl->soc_info.pdev = pdev;
+	o_ctrl->pdev = pdev;
+	o_ctrl->soc_info.dev = &pdev->dev;
+	o_ctrl->soc_info.dev_name = pdev->name;
+
+	o_ctrl->ois_device_type = MSM_CAMERA_PLATFORM_DEVICE;
+
+	o_ctrl->io_master_info.master_type = CCI_MASTER;
+	o_ctrl->io_master_info.cci_client = kzalloc(
+		sizeof(struct cam_sensor_cci_client), GFP_KERNEL);
+	if (!o_ctrl->io_master_info.cci_client)
+		goto free_o_ctrl;
+
+	soc_private = kzalloc(sizeof(struct cam_ois_soc_private),
+		GFP_KERNEL);
+	if (!soc_private) {
+		rc = -ENOMEM;
+		goto free_cci_client;
+	}
+	o_ctrl->soc_info.soc_private = soc_private;
+	soc_private->power_info.dev  = &pdev->dev;
+
+	INIT_LIST_HEAD(&(o_ctrl->i2c_init_data.list_head));
+	INIT_LIST_HEAD(&(o_ctrl->i2c_calib_data.list_head));
+	INIT_LIST_HEAD(&(o_ctrl->i2c_mode_data.list_head));
+	mutex_init(&(o_ctrl->ois_mutex));
+	rc = cam_ois_driver_soc_init(o_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "failed: soc init rc %d", rc);
+		goto free_soc;
+	}
+
+	rc = cam_ois_init_subdev_param(o_ctrl);
+	if (rc)
+		goto free_soc;
+
+	rc = cam_ois_update_i2c_info(o_ctrl, &soc_private->i2c_info);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "failed: to update i2c info rc %d", rc);
+		goto unreg_subdev;
+	}
+	o_ctrl->bridge_intf.device_hdl = -1;
+
+	platform_set_drvdata(pdev, o_ctrl);
+	o_ctrl->cam_ois_state = CAM_OIS_INIT;
+	CAM_DBG(CAM_OIS, "Component bound successfully");
+	return rc;
+unreg_subdev:
+	cam_unregister_subdev(&(o_ctrl->v4l2_dev_str));
+free_soc:
+	kfree(soc_private);
+free_cci_client:
+	kfree(o_ctrl->io_master_info.cci_client);
+free_o_ctrl:
+	kfree(o_ctrl);
+	return rc;
+}
+
+static void cam_ois_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                             i;
+	struct cam_ois_ctrl_t          *o_ctrl;
+	struct cam_ois_soc_private     *soc_private;
+	struct cam_sensor_power_ctrl_t *power_info;
+	struct cam_hw_soc_info         *soc_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	o_ctrl = platform_get_drvdata(pdev);
+	if (!o_ctrl) {
+		CAM_ERR(CAM_OIS, "ois device is NULL");
+		return;
+	}
+
+	CAM_INFO(CAM_OIS, "platform driver remove invoked");
+	soc_info = &o_ctrl->soc_info;
+	for (i = 0; i < soc_info->num_clk; i++)
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+
+	mutex_lock(&(o_ctrl->ois_mutex));
+	cam_ois_shutdown(o_ctrl);
+	mutex_unlock(&(o_ctrl->ois_mutex));
+	cam_unregister_subdev(&(o_ctrl->v4l2_dev_str));
+
+	soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	power_info = &soc_private->power_info;
+
+	kfree(o_ctrl->soc_info.soc_private);
+	kfree(o_ctrl->io_master_info.cci_client);
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&o_ctrl->v4l2_dev_str.sd, NULL);
+	kfree(o_ctrl);
+}
+
+const static struct component_ops cam_ois_component_ops = {
+	.bind = cam_ois_component_bind,
+	.unbind = cam_ois_component_unbind,
+};
+
+static int32_t cam_ois_platform_driver_probe(
+	struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_OIS, "Adding OIS Sensor component");
+	rc = component_add(&pdev->dev, &cam_ois_component_ops);
+	if (rc)
+		CAM_ERR(CAM_OIS, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_ois_platform_driver_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_ois_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_ois_dt_match[] = {
+	{ .compatible = "qcom,ois" },
+	{ }
+};
+
+
+MODULE_DEVICE_TABLE(of, cam_ois_dt_match);
+
+struct platform_driver cam_ois_platform_driver = {
+	.driver = {
+		.name = "qcom,ois",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_ois_dt_match,
+	},
+	.probe = cam_ois_platform_driver_probe,
+	.remove = cam_ois_platform_driver_remove,
+};
+static const struct i2c_device_id cam_ois_i2c_id[] = {
+	{ "msm_ois", (kernel_ulong_t)NULL},
+	{ }
+};
+
+static struct i2c_driver cam_ois_i2c_driver = {
+	.id_table = cam_ois_i2c_id,
+	.probe  = cam_ois_i2c_driver_probe,
+	.remove = cam_ois_i2c_driver_remove,
+	.driver = {
+		.name = "msm_ois",
+	},
+};
+
+static struct cam_ois_registered_driver_t registered_driver = {
+	0, 0};
+
+int cam_ois_driver_init(void)
+{
+	int rc = 0;
+
+	rc = platform_driver_register(&cam_ois_platform_driver);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "platform_driver_register failed rc = %d",
+			rc);
+		return rc;
+	}
+
+	registered_driver.platform_driver = 1;
+
+	rc = i2c_add_driver(&cam_ois_i2c_driver);
+	if (rc) {
+		CAM_ERR(CAM_OIS, "i2c_add_driver failed rc = %d", rc);
+		return rc;
+	}
+
+	registered_driver.i2c_driver = 1;
+	return rc;
+}
+
+void cam_ois_driver_exit(void)
+{
+	if (registered_driver.platform_driver)
+		platform_driver_unregister(&cam_ois_platform_driver);
+
+	if (registered_driver.i2c_driver)
+		i2c_del_driver(&cam_ois_i2c_driver);
+}
+
+MODULE_DESCRIPTION("CAM OIS driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_dev.h
@@ -0,0 +1,139 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_OIS_DEV_H_
+#define _CAM_OIS_DEV_H_
+
+#include <linux/i2c.h>
+#include <linux/gpio.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-ioctl.h>
+#include <media/cam_sensor.h>
+#include <cam_sensor_i2c.h>
+#include <cam_sensor_spi.h>
+#include <cam_sensor_io.h>
+#include <cam_cci_dev.h>
+#include <cam_req_mgr_util.h>
+#include <cam_req_mgr_interface.h>
+#include <cam_mem_mgr.h>
+#include <cam_subdev.h>
+#include "cam_soc_util.h"
+#include "cam_context.h"
+
+#define DEFINE_MSM_MUTEX(mutexname) \
+	static struct mutex mutexname = __MUTEX_INITIALIZER(mutexname)
+
+enum cam_ois_state {
+	CAM_OIS_INIT,
+	CAM_OIS_ACQUIRE,
+	CAM_OIS_CONFIG,
+	CAM_OIS_START,
+};
+
+/**
+ * struct cam_ois_registered_driver_t - registered driver info
+ * @platform_driver      :   flag indicates if platform driver is registered
+ * @i2c_driver           :   flag indicates if i2c driver is registered
+ *
+ */
+struct cam_ois_registered_driver_t {
+	bool platform_driver;
+	bool i2c_driver;
+};
+
+/**
+ * struct cam_ois_i2c_info_t - I2C info
+ * @slave_addr      :   slave address
+ * @i2c_freq_mode   :   i2c frequency mode
+ *
+ */
+struct cam_ois_i2c_info_t {
+	uint16_t slave_addr;
+	uint8_t i2c_freq_mode;
+};
+
+/**
+ * struct cam_ois_soc_private - ois soc private data structure
+ * @ois_name        :   ois name
+ * @i2c_info        :   i2c info structure
+ * @power_info      :   ois power info
+ *
+ */
+struct cam_ois_soc_private {
+	const char *ois_name;
+	struct cam_ois_i2c_info_t i2c_info;
+	struct cam_sensor_power_ctrl_t power_info;
+};
+
+/**
+ * struct cam_ois_intf_params - bridge interface params
+ * @device_hdl   : Device Handle
+ * @session_hdl  : Session Handle
+ * @ops          : KMD operations
+ * @crm_cb       : Callback API pointers
+ */
+struct cam_ois_intf_params {
+	int32_t device_hdl;
+	int32_t session_hdl;
+	int32_t link_hdl;
+	struct cam_req_mgr_kmd_ops ops;
+	struct cam_req_mgr_crm_cb *crm_cb;
+};
+
+/**
+ * struct cam_ois_ctrl_t - OIS ctrl private data
+ * @device_name     :   ois device_name
+ * @pdev            :   platform device
+ * @ois_mutex       :   ois mutex
+ * @soc_info        :   ois soc related info
+ * @io_master_info  :   Information about the communication master
+ * @cci_i2c_master  :   I2C structure
+ * @v4l2_dev_str    :   V4L2 device structure
+ * @bridge_intf     :   bridge interface params
+ * @i2c_init_data   :   ois i2c init settings
+ * @i2c_mode_data   :   ois i2c mode settings
+ * @i2c_time_data   :   ois i2c time write settings
+ * @i2c_calib_data  :   ois i2c calib settings
+ * @ois_device_type :   ois device type
+ * @cam_ois_state   :   ois_device_state
+ * @ois_fw_flag     :   flag for firmware download
+ * @is_ois_calib    :   flag for Calibration data
+ * @opcode          :   ois opcode
+ * @device_name     :   Device name
+ *
+ */
+struct cam_ois_ctrl_t {
+	char device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct platform_device *pdev;
+	struct mutex ois_mutex;
+	struct cam_hw_soc_info soc_info;
+	struct camera_io_master io_master_info;
+	enum cci_i2c_master_t cci_i2c_master;
+	enum cci_device_num cci_num;
+	struct cam_subdev v4l2_dev_str;
+	struct cam_ois_intf_params bridge_intf;
+	struct i2c_settings_array i2c_init_data;
+	struct i2c_settings_array i2c_calib_data;
+	struct i2c_settings_array i2c_mode_data;
+	struct i2c_settings_array i2c_time_data;
+	enum msm_camera_device_type_t ois_device_type;
+	enum cam_ois_state cam_ois_state;
+	char ois_name[32];
+	uint8_t ois_fw_flag;
+	uint8_t is_ois_calib;
+	struct cam_ois_opcode opcode;
+};
+
+/**
+ * @brief : API to register OIS hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_ois_driver_init(void);
+
+/**
+ * @brief : API to remove OIS Hw from platform framework.
+ */
+void cam_ois_driver_exit(void);
+#endif /*_CAM_OIS_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_soc.c
@@ -0,0 +1,126 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_sensor_util.h>
+#include <cam_sensor_io.h>
+#include <cam_req_mgr_util.h>
+
+#include "cam_ois_soc.h"
+#include "cam_debug_util.h"
+
+/**
+ * @e_ctrl: ctrl structure
+ *
+ * Parses ois dt
+ */
+static int cam_ois_get_dt_data(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int                             i, rc = 0;
+	struct cam_hw_soc_info         *soc_info = &o_ctrl->soc_info;
+	struct cam_ois_soc_private     *soc_private =
+		(struct cam_ois_soc_private *)o_ctrl->soc_info.soc_private;
+	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
+	struct device_node             *of_node = NULL;
+
+	of_node = soc_info->dev->of_node;
+
+	if (!of_node) {
+		CAM_ERR(CAM_OIS, "of_node is NULL, device type %d",
+			o_ctrl->ois_device_type);
+		return -EINVAL;
+	}
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_OIS, "cam_soc_util_get_dt_properties rc %d",
+			rc);
+		return rc;
+	}
+
+	rc = cam_sensor_util_regulator_powerup(soc_info);
+	if (rc < 0)
+		return rc;
+
+	if (!soc_info->gpio_data) {
+		CAM_INFO(CAM_OIS, "No GPIO found");
+		return 0;
+	}
+
+	if (!soc_info->gpio_data->cam_gpio_common_tbl_size) {
+		CAM_INFO(CAM_OIS, "No GPIO found");
+		return -EINVAL;
+	}
+
+	rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
+		&power_info->gpio_num_info);
+	if ((rc < 0) || (!power_info->gpio_num_info)) {
+		CAM_ERR(CAM_OIS, "No/Error OIS GPIOs");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		soc_info->clk[i] = devm_clk_get(soc_info->dev,
+			soc_info->clk_name[i]);
+		if (!soc_info->clk[i]) {
+			CAM_ERR(CAM_SENSOR, "get failed for %s",
+				soc_info->clk_name[i]);
+			rc = -ENOENT;
+			return rc;
+		}
+	}
+
+	return rc;
+}
+/**
+ * @o_ctrl: ctrl structure
+ *
+ * This function is called from cam_ois_platform/i2c_driver_probe, it parses
+ * the ois dt node.
+ */
+int cam_ois_driver_soc_init(struct cam_ois_ctrl_t *o_ctrl)
+{
+	int                             rc = 0;
+	struct cam_hw_soc_info         *soc_info = &o_ctrl->soc_info;
+	struct device_node             *of_node = NULL;
+	struct device_node             *of_parent = NULL;
+
+	if (!soc_info->dev) {
+		CAM_ERR(CAM_OIS, "soc_info is not initialized");
+		return -EINVAL;
+	}
+
+	of_node = soc_info->dev->of_node;
+	if (!of_node) {
+		CAM_ERR(CAM_OIS, "dev.of_node NULL");
+		return -EINVAL;
+	}
+
+	if (o_ctrl->ois_device_type == MSM_CAMERA_PLATFORM_DEVICE) {
+		rc = of_property_read_u32(of_node, "cci-master",
+			&o_ctrl->cci_i2c_master);
+		if (rc < 0) {
+			CAM_DBG(CAM_OIS, "failed rc %d", rc);
+			return rc;
+		}
+
+		of_parent = of_get_parent(of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&o_ctrl->cci_num) < 0)
+			/* Set default master 0 */
+			o_ctrl->cci_num = CCI_DEVICE_0;
+
+		o_ctrl->io_master_info.cci_client->cci_device = o_ctrl->cci_num;
+		CAM_DBG(CAM_OIS, "cci-device %d", o_ctrl->cci_num, rc);
+
+	}
+
+	rc = cam_ois_get_dt_data(o_ctrl);
+	if (rc < 0)
+		CAM_DBG(CAM_OIS, "failed: ois get dt data rc %d", rc);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_ois/cam_ois_soc.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+#ifndef _CAM_OIS_SOC_H_
+#define _CAM_OIS_SOC_H_
+
+#include "cam_ois_dev.h"
+
+int cam_ois_driver_soc_init(struct cam_ois_ctrl_t *o_ctrl);
+
+#endif/* _CAM_OIS_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c
@@ -0,0 +1,1001 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/pinctrl/consumer.h>
+#include "cam_debug_util.h"
+#include "cam_res_mgr_api.h"
+#include "cam_res_mgr_private.h"
+#include "camera_main.h"
+
+static struct cam_res_mgr *cam_res;
+
+static void cam_res_mgr_free_res(void)
+{
+	struct cam_dev_res *dev_res, *dev_temp;
+	struct cam_gpio_res *gpio_res, *gpio_temp;
+	struct cam_flash_res *flash_res, *flash_temp;
+
+	if (!cam_res)
+		return;
+
+	mutex_lock(&cam_res->gpio_res_lock);
+	list_for_each_entry_safe(gpio_res, gpio_temp,
+		&cam_res->gpio_res_list, list) {
+		list_for_each_entry_safe(dev_res, dev_temp,
+			&gpio_res->dev_list, list) {
+			list_del_init(&dev_res->list);
+			kfree(dev_res);
+		}
+		list_del_init(&gpio_res->list);
+		kfree(gpio_res);
+	}
+	mutex_unlock(&cam_res->gpio_res_lock);
+
+	mutex_lock(&cam_res->flash_res_lock);
+	list_for_each_entry_safe(flash_res, flash_temp,
+		&cam_res->flash_res_list, list) {
+		list_del_init(&flash_res->list);
+		kfree(flash_res);
+	}
+	mutex_unlock(&cam_res->flash_res_lock);
+}
+
+void cam_res_mgr_led_trigger_register(const char *name, struct led_trigger **tp)
+{
+	bool found = false;
+	struct cam_flash_res *flash_res;
+
+	if (!cam_res) {
+		/*
+		 * If this driver not probed, then just register the
+		 * led trigger.
+		 */
+		led_trigger_register_simple(name, tp);
+		return;
+	}
+
+	mutex_lock(&cam_res->flash_res_lock);
+	list_for_each_entry(flash_res, &cam_res->flash_res_list, list) {
+		if (!strcmp(flash_res->name, name)) {
+			found = true;
+			break;
+		}
+	}
+	mutex_unlock(&cam_res->flash_res_lock);
+
+	if (found) {
+		*tp = flash_res->trigger;
+	} else {
+		flash_res = kzalloc(sizeof(struct cam_flash_res), GFP_KERNEL);
+		if (!flash_res) {
+			CAM_ERR(CAM_RES,
+				"Failed to malloc memory for flash_res:%s",
+				name);
+			*tp = NULL;
+			return;
+		}
+
+		led_trigger_register_simple(name, tp);
+		INIT_LIST_HEAD(&flash_res->list);
+		flash_res->trigger = *tp;
+		flash_res->name = name;
+
+		mutex_lock(&cam_res->flash_res_lock);
+		list_add_tail(&flash_res->list, &cam_res->flash_res_list);
+		mutex_unlock(&cam_res->flash_res_lock);
+	}
+}
+EXPORT_SYMBOL(cam_res_mgr_led_trigger_register);
+
+void cam_res_mgr_led_trigger_unregister(struct led_trigger *tp)
+{
+	bool found = false;
+	struct cam_flash_res *flash_res;
+
+	if (!cam_res) {
+		/*
+		 * If this driver not probed, then just unregister the
+		 * led trigger.
+		 */
+		led_trigger_unregister_simple(tp);
+		return;
+	}
+
+	mutex_lock(&cam_res->flash_res_lock);
+	list_for_each_entry(flash_res, &cam_res->flash_res_list, list) {
+		if (flash_res->trigger == tp) {
+			found = true;
+			break;
+		}
+	}
+
+	if (found) {
+		led_trigger_unregister_simple(tp);
+		list_del_init(&flash_res->list);
+		kfree(flash_res);
+	}
+	mutex_unlock(&cam_res->flash_res_lock);
+}
+EXPORT_SYMBOL(cam_res_mgr_led_trigger_unregister);
+
+void cam_res_mgr_led_trigger_event(struct led_trigger *trig,
+	enum led_brightness brightness)
+{
+	bool found = false;
+	struct cam_flash_res *flash_res;
+
+	if (!cam_res) {
+		/*
+		 * If this driver not probed, then just trigger
+		 * the led event.
+		 */
+		led_trigger_event(trig, brightness);
+		return;
+	}
+
+	mutex_lock(&cam_res->flash_res_lock);
+	list_for_each_entry(flash_res, &cam_res->flash_res_list, list) {
+		if (flash_res->trigger == trig) {
+			found = true;
+			break;
+		}
+	}
+	mutex_unlock(&cam_res->flash_res_lock);
+
+	if (found)
+		led_trigger_event(trig, brightness);
+}
+EXPORT_SYMBOL(cam_res_mgr_led_trigger_event);
+
+int cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(
+	uint gpio)
+{
+	int index = 0;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	for (index = 0; index < dt->num_shared_pctrl_gpio; index++) {
+		if (gpio == dt->shared_pctrl_gpio[index])
+			break;
+	}
+
+	if (index == dt->num_shared_pctrl_gpio)
+		return -EINVAL;
+
+	return index;
+}
+EXPORT_SYMBOL(cam_res_mgr_util_get_idx_from_shared_pctrl_gpio);
+
+int cam_res_mgr_util_get_idx_from_shared_gpio(
+	uint gpio)
+{
+	int index = 0;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	for (index = 0; index < dt->num_shared_gpio; index++) {
+		if (gpio == dt->shared_gpio[index])
+			break;
+	}
+
+	if (index == dt->num_shared_gpio)
+		return -EINVAL;
+
+	return index;
+}
+EXPORT_SYMBOL(cam_res_mgr_util_get_idx_from_shared_gpio);
+
+static bool cam_res_mgr_gpio_is_in_shared_pctrl_gpio(
+	uint gpio)
+{
+	int index = 0;
+	bool found = false;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	for (index = 0; index < dt->num_shared_pctrl_gpio; index++) {
+		if (gpio == dt->shared_pctrl_gpio[index]) {
+			found = true;
+			break;
+		}
+	}
+
+	return found;
+}
+
+static bool cam_res_mgr_gpio_is_in_shared_gpio(
+	uint gpio)
+{
+	int index = 0;
+	bool found = false;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	for (; index < dt->num_shared_gpio; index++) {
+		if (gpio == dt->shared_gpio[index]) {
+			found = true;
+			break;
+		}
+	}
+
+	return found;
+}
+
+int cam_res_mgr_util_shared_gpio_check_hold(uint gpio)
+{
+	int index = 0;
+	int dev_num = 0;
+	struct list_head *list;
+	struct cam_gpio_res *gpio_res = NULL;
+	struct cam_res_mgr_dt *dt =  NULL;
+	bool is_shared_gpio = false;
+	bool is_shared_pctrl_gpio = false;
+
+	if (!cam_res) {
+		CAM_DBG(CAM_RES, "res mgr is not initilized");
+		return 0;
+	}
+
+	if (!cam_res->shared_gpio_enabled) {
+		CAM_DBG(CAM_RES, "Res_mgr is not sharing any gpios");
+		return 0;
+	}
+
+	dt = &cam_res->dt;
+
+	is_shared_gpio =
+		cam_res_mgr_gpio_is_in_shared_gpio(gpio);
+	is_shared_pctrl_gpio =
+		cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio);
+
+	if (is_shared_gpio && is_shared_pctrl_gpio) {
+		CAM_ERR(CAM_RES,
+			"gpio cannot be shared between pinctrl and gpio");
+		return -EINVAL;
+	}
+
+	if (is_shared_gpio) {
+		index = cam_res_mgr_util_get_idx_from_shared_gpio(gpio);
+		if (index < 0) {
+			CAM_ERR(CAM_RES, "Gpio%u not found in shared gpio list",
+				gpio);
+			return -EINVAL;
+		}
+
+		list_for_each_entry(gpio_res,
+			&cam_res->gpio_res_list, list) {
+
+			if (gpio_res->gpio ==
+				dt->shared_gpio[index]) {
+				list_for_each(list, &gpio_res->dev_list)
+					dev_num++;
+
+				if (dev_num >= 2) {
+					return RES_MGR_GPIO_NEED_HOLD;
+				}
+			}
+		}
+	}
+
+	if (is_shared_pctrl_gpio) {
+		index = cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(gpio);
+		if (index < 0) {
+			CAM_ERR(CAM_RES,
+				"gpio%u not found in shared pctrl gpio list",
+				gpio);
+			return -EINVAL;
+		}
+
+		list_for_each_entry(gpio_res,
+			&cam_res->gpio_res_list, list) {
+			if (gpio_res->gpio ==
+				dt->shared_pctrl_gpio[index]) {
+				list_for_each(list, &gpio_res->dev_list)
+					dev_num++;
+
+				if (dev_num >= 2) {
+					CAM_DBG(CAM_RES,
+						"gpio: %u needs to hold", gpio);
+					return RES_MGR_GPIO_NEED_HOLD;
+				}
+			}
+		}
+	}
+
+	for (index = 0; index < dt->num_shared_gpio; index++) {
+		list_for_each_entry(gpio_res,
+			&cam_res->gpio_res_list, list) {
+
+			if (gpio_res->gpio ==
+				dt->shared_gpio[index]) {
+				list_for_each(list, &gpio_res->dev_list)
+					dev_num++;
+
+				if (dev_num >= 2) {
+					CAM_DBG(CAM_RES,
+						"gpio: %u needs to hold", gpio);
+					return RES_MGR_GPIO_NEED_HOLD;
+				}
+			}
+		}
+	}
+
+	for (index = 0; index < dt->num_shared_pctrl_gpio; index++) {
+		list_for_each_entry(gpio_res,
+			&cam_res->gpio_res_list, list) {
+
+			if (gpio_res->gpio ==
+				dt->shared_pctrl_gpio[index]) {
+				list_for_each(list, &gpio_res->dev_list)
+					dev_num++;
+
+				if (dev_num >= 2) {
+					CAM_DBG(CAM_RES,
+						"gpio: %u needs to hold", gpio);
+					return RES_MGR_GPIO_NEED_HOLD;
+				}
+			}
+		}
+	}
+
+	CAM_DBG(CAM_RES, "gpio: %u can free the resource", gpio);
+	return RES_MGR_GPIO_CAN_FREE;
+}
+EXPORT_SYMBOL(cam_res_mgr_util_shared_gpio_check_hold);
+
+static int cam_res_mgr_shared_pinctrl_select_state(
+	int idx, bool active)
+{
+	int rc = 0;
+
+	if (!cam_res || !cam_res->shared_gpio_enabled) {
+		CAM_DBG(CAM_RES, "Not support shared gpio.");
+		return 0;
+	}
+
+	if (cam_res->pctrl_res[idx].pstatus == PINCTRL_STATUS_PUT) {
+		CAM_DBG(CAM_RES, "The shared pinctrl alerady been put.!");
+		return 0;
+	}
+
+	if (active &&
+		(cam_res->pctrl_res[idx].pstatus != PINCTRL_STATUS_ACTIVE)) {
+		CAM_DBG(CAM_RES,
+			"pinctrl select state to active for the shared_pctrl_gpio idx: %d",
+			idx);
+		rc = pinctrl_select_state(cam_res->pinctrl,
+			cam_res->pctrl_res[idx].active);
+		cam_res->pctrl_res[idx].pstatus = PINCTRL_STATUS_ACTIVE;
+	} else if (!active &&
+		(cam_res->pctrl_res[idx].pstatus == PINCTRL_STATUS_ACTIVE)) {
+		CAM_DBG(CAM_RES,
+			"pinctrl select state to suspend for the shared_pctrl_gpio idx: %d",
+			idx);
+		rc = pinctrl_select_state(cam_res->pinctrl,
+			cam_res->pctrl_res[idx].suspend);
+		cam_res->pctrl_res[idx].pstatus = PINCTRL_STATUS_SUSPEND;
+	}
+
+	return rc;
+}
+
+static int cam_res_mgr_add_device(struct device *dev,
+	struct cam_gpio_res *gpio_res)
+{
+	struct cam_dev_res *dev_res = NULL;
+
+	dev_res = kzalloc(sizeof(struct cam_dev_res), GFP_KERNEL);
+	if (!dev_res)
+		return -ENOMEM;
+
+	dev_res->dev = dev;
+	INIT_LIST_HEAD(&dev_res->list);
+	list_add_tail(&dev_res->list, &gpio_res->dev_list);
+
+	return 0;
+}
+
+static struct cam_gpio_res *cam_res_mgr_find_if_gpio_in_list(uint gpio)
+{
+	struct cam_gpio_res *gpio_res = NULL;
+
+	list_for_each_entry(gpio_res, &cam_res->gpio_res_list, list) {
+		if (gpio == gpio_res->gpio)
+			return gpio_res;
+	}
+
+	return NULL;
+}
+
+static bool __cam_res_mgr_find_if_gpio_is_shared(uint gpio)
+{
+	bool found_in_shared_gpio = false;
+	bool found_in_shared_pctrl_gpio = false;
+
+	found_in_shared_gpio = cam_res_mgr_gpio_is_in_shared_gpio(gpio);
+
+	found_in_shared_pctrl_gpio =
+		cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio);
+
+	if (found_in_shared_pctrl_gpio && found_in_shared_gpio) {
+		CAM_WARN(CAM_RES, "gpio: %u cannot be shared in both list",
+			gpio);
+		return false;
+	}
+
+	if (found_in_shared_pctrl_gpio || found_in_shared_gpio)
+		return true;
+
+	return false;
+}
+
+
+int cam_res_mgr_gpio_request(struct device *dev, uint gpio,
+		unsigned long flags, const char *label)
+{
+	int                          rc = 0;
+	bool                         dev_found = false;
+	bool                         gpio_found = false;
+	int                          pctrl_idx = -1;
+	struct cam_gpio_res         *gpio_res = NULL;
+
+	mutex_lock(&cam_res->gpio_res_lock);
+	if (cam_res && cam_res->shared_gpio_enabled) {
+		gpio_res = cam_res_mgr_find_if_gpio_in_list(gpio);
+		if (gpio_res == NULL)
+			gpio_found = false;
+		else
+			gpio_found = true;
+	}
+
+	/*
+	 * gpio_found equal to false has two situation:
+	 * 1. shared gpio/pinctrl_gpio not enabled
+	 * 2. shared gpio/pinctrl_gpio enabled, but not find this gpio
+	 *    from the gpio_res_list
+	 * These two situations both need request gpio.
+	 */
+	if (!gpio_found) {
+		CAM_DBG(CAM_RES, "gpio: %u not found in gpio_res list", gpio);
+		rc = gpio_request_one(gpio, flags, label);
+		if (rc) {
+			CAM_ERR(CAM_RES, "gpio %d:%s request fails rc = %d",
+				gpio, label, rc);
+			goto end;
+		}
+	}
+
+	/*
+	 * If the gpio is in the shared list, and not find
+	 * from gpio_res_list, then insert a cam_gpio_res
+	 * to gpio_res_list.
+	 */
+	if ((!gpio_found && cam_res
+		&& cam_res->shared_gpio_enabled) &&
+		(cam_res_mgr_gpio_is_in_shared_gpio(gpio) ||
+		(cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio)))) {
+		CAM_DBG(CAM_RES, "gpio: %u is shared", gpio);
+
+		gpio_res = kzalloc(sizeof(struct cam_gpio_res), GFP_KERNEL);
+		if (!gpio_res) {
+			rc = -ENOMEM;
+			goto end;
+		}
+		gpio_res->gpio = gpio;
+		gpio_res->power_on_count = 0;
+		INIT_LIST_HEAD(&gpio_res->list);
+		INIT_LIST_HEAD(&gpio_res->dev_list);
+
+		rc = cam_res_mgr_add_device(dev, gpio_res);
+		if (rc) {
+			kfree(gpio_res);
+			goto end;
+		}
+
+		list_add_tail(&gpio_res->list, &cam_res->gpio_res_list);
+	}
+
+	/* if shared gpio is in pinctrl gpio list */
+	if (!gpio_found && cam_res
+		&& cam_res->shared_gpio_enabled &&
+		cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio)) {
+		pctrl_idx =
+			cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(gpio);
+		CAM_DBG(CAM_RES,
+			"shared_pctrl_gpio is at idx: %d", pctrl_idx);
+		if (pctrl_idx < 0) {
+			CAM_ERR(CAM_RES,
+				"pctrl_gpio: %u not found", gpio);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		/* Update Pinctrl state to active */
+		cam_res_mgr_shared_pinctrl_select_state(pctrl_idx, true);
+	}
+
+	if (gpio_found && cam_res
+		&& cam_res->shared_gpio_enabled) {
+		struct cam_dev_res *dev_res = NULL;
+
+		list_for_each_entry(dev_res, &gpio_res->dev_list, list) {
+			if (dev_res->dev == dev) {
+				dev_found = true;
+				break;
+			}
+		}
+
+		if (!dev_found) {
+			rc = cam_res_mgr_add_device(dev, gpio_res);
+			if (rc) {
+				CAM_ERR(CAM_RES,
+					"add device to gpio res list failed rc: %d",
+					rc);
+				goto end;
+			}
+		}
+	}
+
+end:
+	mutex_unlock(&cam_res->gpio_res_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_res_mgr_gpio_request);
+
+bool cam_res_mgr_util_check_if_gpio_is_shared(
+	struct gpio *gpio_tbl, uint8_t size)
+{
+	int i = 0;
+	bool found = false;
+
+	if (!cam_res) {
+		CAM_DBG(CAM_RES, "cam_res data is not avaialbe");
+		return false;
+	}
+
+	if (!cam_res->shared_gpio_enabled) {
+		CAM_DBG(CAM_RES, "shared gpio support is not enabled");
+		return false;
+	}
+
+	for (i = 0; i < size; i++) {
+		found = __cam_res_mgr_find_if_gpio_is_shared(gpio_tbl[i].gpio);
+		if (found)
+			return found;
+	}
+
+	return false;
+}
+EXPORT_SYMBOL(cam_res_mgr_util_check_if_gpio_is_shared);
+
+static void cam_res_mgr_gpio_free(struct device *dev, uint gpio)
+{
+	bool                   gpio_found = false;
+	bool                   need_free = true;
+	int                    dev_num = 0;
+	struct cam_gpio_res   *gpio_res = NULL;
+	bool                   is_shared_pctrl_gpio = false;
+	int                    pctrl_idx = -1;
+
+	is_shared_pctrl_gpio =
+			cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio);
+
+	mutex_lock(&cam_res->gpio_res_lock);
+	if (cam_res && cam_res->shared_gpio_enabled) {
+		list_for_each_entry(gpio_res, &cam_res->gpio_res_list, list) {
+			if (gpio == gpio_res->gpio) {
+				gpio_found = true;
+				break;
+			}
+		}
+	}
+
+	if (gpio_found && cam_res
+		&& cam_res->shared_gpio_enabled) {
+		struct list_head *list;
+		struct cam_dev_res *dev_res = NULL;
+
+		/* Count the dev number in the dev_list */
+		list_for_each(list, &gpio_res->dev_list)
+			dev_num++;
+
+		/*
+		 * Need free the gpio if only has last 1 device
+		 * in the dev_list, otherwise, not free this
+		 * gpio.
+		 */
+		if (dev_num == 1) {
+			dev_res = list_first_entry(&gpio_res->dev_list,
+				struct cam_dev_res, list);
+			list_del_init(&dev_res->list);
+			kfree(dev_res);
+			list_del_init(&gpio_res->list);
+			kfree(gpio_res);
+		} else {
+			list_for_each_entry(dev_res,
+				&gpio_res->dev_list, list) {
+				if (dev_res->dev == dev) {
+					list_del_init(&dev_res->list);
+					kfree(dev_res);
+					need_free = false;
+					break;
+				}
+			}
+		}
+	}
+
+	if (need_free) {
+		if (is_shared_pctrl_gpio) {
+			pctrl_idx =
+				cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(
+					gpio);
+			if (pctrl_idx >= 0) {
+				cam_res_mgr_shared_pinctrl_select_state(
+					pctrl_idx, false);
+			}
+			else {
+				CAM_ERR(CAM_RES, "Invalid PinCtrl Idx: %d", pctrl_idx);
+			}
+		}
+
+		CAM_DBG(CAM_RES, "freeing gpio: %u", gpio);
+		gpio_free(gpio);
+	}
+
+	mutex_unlock(&cam_res->gpio_res_lock);
+}
+
+void cam_res_mgr_gpio_free_arry(struct device *dev,
+		const struct gpio *array, size_t num)
+{
+	while (num--)
+		cam_res_mgr_gpio_free(dev, (array[num]).gpio);
+}
+EXPORT_SYMBOL(cam_res_mgr_gpio_free_arry);
+
+int cam_res_mgr_gpio_set_value(unsigned int gpio, int value)
+{
+	int rc = 0;
+	bool found = false;
+	struct cam_gpio_res *gpio_res = NULL;
+
+	mutex_lock(&cam_res->gpio_res_lock);
+	if (cam_res && cam_res->shared_gpio_enabled) {
+		list_for_each_entry(gpio_res, &cam_res->gpio_res_list, list) {
+			if (gpio == gpio_res->gpio) {
+				found = true;
+				break;
+			}
+		}
+	}
+
+	/*
+	 * Set the value directly if can't find the gpio from
+	 * gpio_res_list, otherwise, need add ref count support
+	 **/
+	if (!found) {
+		gpio_set_value_cansleep(gpio, value);
+	} else {
+		if (value) {
+			gpio_res->power_on_count++;
+			if (gpio_res->power_on_count < 2) {
+				gpio_set_value_cansleep(gpio, value);
+				CAM_DBG(CAM_RES,
+					"Shared GPIO(%d) : HIGH", gpio);
+			}
+		} else {
+			gpio_res->power_on_count--;
+			if (gpio_res->power_on_count < 1) {
+				gpio_set_value_cansleep(gpio, value);
+				CAM_DBG(CAM_RES,
+					"Shared GPIO(%d) : LOW", gpio);
+			}
+		}
+	}
+
+	mutex_unlock(&cam_res->gpio_res_lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_res_mgr_gpio_set_value);
+
+static int cam_res_mgr_shared_pinctrl_init(
+	struct device *dev)
+{
+	int i = 0;
+	char pctrl_active[50];
+	char pctrl_suspend[50];
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	cam_res->pinctrl = devm_pinctrl_get(dev);
+	if (IS_ERR_OR_NULL(cam_res->pinctrl)) {
+		CAM_ERR(CAM_RES, "Pinctrl not available");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < dt->num_shared_pctrl_gpio; i++) {
+		memset(pctrl_active, '\0', sizeof(pctrl_active));
+		memset(pctrl_suspend, '\0', sizeof(pctrl_suspend));
+		snprintf(pctrl_active, sizeof(pctrl_active),
+			"%s%s",
+			cam_res->dt.pctrl_name[i],
+			"_active");
+		CAM_DBG(CAM_RES, "pctrl_active at index: %d name: %s",
+			i, pctrl_active);
+		snprintf(pctrl_suspend, sizeof(pctrl_suspend),
+			"%s%s",
+			cam_res->dt.pctrl_name[i],
+			"_suspend");
+		CAM_DBG(CAM_RES, "pctrl_suspend at index: %d name: %s",
+			i, pctrl_suspend);
+		cam_res->pctrl_res[i].active =
+			pinctrl_lookup_state(cam_res->pinctrl,
+			pctrl_active);
+		if (IS_ERR_OR_NULL(cam_res->pctrl_res[i].active)) {
+			CAM_ERR(CAM_RES,
+				"Failed to get the active state pinctrl handle");
+			return -EINVAL;
+		}
+		cam_res->pctrl_res[i].suspend =
+			pinctrl_lookup_state(cam_res->pinctrl,
+			pctrl_suspend);
+		if (IS_ERR_OR_NULL(cam_res->pctrl_res[i].active)) {
+			CAM_ERR(CAM_RES,
+				"Failed to get the active state pinctrl handle");
+			return -EINVAL;
+		}
+		cam_res->pctrl_res[i].pstatus = PINCTRL_STATUS_GOT;
+	}
+
+	cam_res->pstatus = PINCTRL_STATUS_GOT;
+
+	return 0;
+}
+
+static int cam_res_mgr_parse_dt_shared_gpio(
+	struct device *dev)
+{
+	int rc = 0;
+	struct device_node *of_node = NULL;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	of_node = dev->of_node;
+	dt->num_shared_gpio = of_property_count_u32_elems(of_node,
+		"gpios-shared");
+
+	if (dt->num_shared_gpio <= 0) {
+		CAM_DBG(CAM_RES,
+			"Not found any shared gpio");
+		return -ENODEV;
+	}
+
+	if (dt->num_shared_gpio >= MAX_SHARED_GPIO_SIZE) {
+		CAM_ERR(CAM_RES,
+			"shared_gpio: %d max supported: %d",
+			MAX_SHARED_GPIO_SIZE,
+			dt->num_shared_gpio);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32_array(of_node, "gpios-shared",
+		dt->shared_gpio, dt->num_shared_gpio);
+	if (rc) {
+		CAM_ERR(CAM_RES, "Get shared gpio array failed.");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_res_mgr_parse_dt_shared_pinctrl_gpio(
+	struct device *dev)
+{
+	int rc = 0, i = 0;
+	int pinctrl_name_nodes = 0;
+	struct device_node *of_node = NULL;
+	struct cam_res_mgr_dt *dt = &cam_res->dt;
+
+	of_node = dev->of_node;
+	dt->num_shared_pctrl_gpio = of_property_count_u32_elems(of_node,
+		"gpios-shared-pinctrl");
+
+	if (dt->num_shared_pctrl_gpio <= 0) {
+		CAM_DBG(CAM_RES,
+			"Not found any shared pinctrl res");
+		return -ENODEV;
+	}
+
+	if (dt->num_shared_pctrl_gpio >= MAX_SHARED_PCTRL_GPIO_SIZE) {
+		CAM_ERR(CAM_RES,
+			"Invalid Pinctrl GPIO number %d. No shared gpio.",
+			dt->num_shared_pctrl_gpio);
+		return -EINVAL;
+	}
+
+	pinctrl_name_nodes = of_property_count_strings(of_node,
+		"shared-pctrl-gpio-names");
+
+	if (pinctrl_name_nodes != dt->num_shared_pctrl_gpio) {
+		CAM_ERR(CAM_RES,
+			"Mismatch between entries:: pctrl_gpio: %d and pctrl_name: %d",
+			dt->num_shared_pctrl_gpio,
+			pinctrl_name_nodes);
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_RES,
+		"number of pctrl_gpio: %d", dt->num_shared_pctrl_gpio);
+
+	rc = of_property_read_u32_array(of_node, "gpios-shared-pinctrl",
+		dt->shared_pctrl_gpio, dt->num_shared_pctrl_gpio);
+	if (rc) {
+		CAM_ERR(CAM_RES, "Get shared pinctrl gpio array failed.");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < pinctrl_name_nodes; i++) {
+		rc = of_property_read_string_index(of_node,
+			"shared-pctrl-gpio-names",
+			i, &(dt->pctrl_name[i]));
+		CAM_INFO(CAM_RES, "shared-pctrl-gpio-names[%d] = %s",
+			i, dt->pctrl_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_RES,
+				"i= %d pinctrl_name_nodes= %d reading clock-names failed",
+				i, pinctrl_name_nodes);
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_res_mgr_parse_dt(struct device *dev)
+{
+	int rc = 0;
+
+	rc = cam_res_mgr_parse_dt_shared_gpio(dev);
+	if (rc) {
+		if (rc == -ENODEV) {
+			CAM_DBG(CAM_RES,
+				"Shared GPIO resources not available");
+		} else {
+			CAM_ERR(CAM_RES,
+				"Shared gpio parsing failed: rc: %d", rc);
+			return rc;
+		}
+	}
+
+	rc = cam_res_mgr_parse_dt_shared_pinctrl_gpio(dev);
+	if (rc) {
+		if (rc == -ENODEV) {
+			CAM_DBG(CAM_RES,
+				"Pinctrl shared resources not available");
+		} else {
+			CAM_ERR(CAM_RES,  "Pinctrl parsing failed: rc: %d",
+				rc);
+			return rc;
+		}
+	} else {
+		/* When shared pinctrl is detected do the init */
+		rc = cam_res_mgr_shared_pinctrl_init(dev);
+		if (rc) {
+			CAM_ERR(CAM_RES, "Pinctrl init failed rc: %d", rc);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int cam_res_mgr_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	cam_res = kzalloc(sizeof(*cam_res), GFP_KERNEL);
+	if (!cam_res) {
+		CAM_ERR(CAM_RES, "Not Enough Mem");
+		return -ENOMEM;
+	}
+	cam_res->dev = &pdev->dev;
+
+	CAM_DBG(CAM_RES, "ENTER");
+	rc = cam_res_mgr_parse_dt(&pdev->dev);
+	if (rc) {
+		CAM_ERR(CAM_RES,
+			"Error in parsing device tree, rc: %d", rc);
+		kfree(cam_res);
+		return rc;
+	}
+
+	if (cam_res->dt.num_shared_gpio || cam_res->dt.num_shared_pctrl_gpio) {
+		CAM_DBG(CAM_RES, "Enable shared gpio support.");
+		cam_res->shared_gpio_enabled = true;
+	} else {
+		CAM_DBG(CAM_RES, "Disable shared gpio support.");
+		cam_res->shared_gpio_enabled = false;
+	}
+
+	mutex_init(&cam_res->flash_res_lock);
+	mutex_init(&cam_res->gpio_res_lock);
+
+	INIT_LIST_HEAD(&cam_res->gpio_res_list);
+	INIT_LIST_HEAD(&cam_res->flash_res_list);
+
+	CAM_DBG(CAM_RES, "Component bound successfully");
+	return 0;
+}
+
+static void cam_res_mgr_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	if (cam_res) {
+		cam_res_mgr_free_res();
+		devm_pinctrl_put(cam_res->pinctrl);
+		cam_res->pinctrl = NULL;
+		cam_res->pstatus = PINCTRL_STATUS_PUT;
+		kfree(cam_res);
+		cam_res = NULL;
+	}
+
+	CAM_DBG(CAM_RES, "Component unbound successfully");
+}
+
+const static struct component_ops cam_res_mgr_component_ops = {
+	.bind = cam_res_mgr_component_bind,
+	.unbind = cam_res_mgr_component_unbind,
+};
+
+static int cam_res_mgr_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_RES, "Adding Res mgr component");
+	rc = component_add(&pdev->dev, &cam_res_mgr_component_ops);
+	if (rc)
+		CAM_ERR(CAM_RES, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_res_mgr_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_res_mgr_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_res_mgr_dt_match[] = {
+	{.compatible = "qcom,cam-res-mgr"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, cam_res_mgr_dt_match);
+
+struct platform_driver cam_res_mgr_driver = {
+	.probe = cam_res_mgr_probe,
+	.remove = cam_res_mgr_remove,
+	.driver = {
+		.name = "cam_res_mgr",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_res_mgr_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_res_mgr_init(void)
+{
+	return platform_driver_register(&cam_res_mgr_driver);
+}
+
+void cam_res_mgr_exit(void)
+{
+	platform_driver_unregister(&cam_res_mgr_driver);
+}
+
+MODULE_DESCRIPTION("Camera resource manager driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr_api.h
@@ -0,0 +1,135 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __CAM_RES_MGR_API_H__
+#define __CAM_RES_MGR_API_H__
+
+#include <linux/leds.h>
+
+/**
+ * @brief: Register the led trigger
+ *
+ *  The newly registered led trigger is assigned to flash_res_list.
+ *
+ * @name  : Pointer to int led trigger name
+ * @tp    : Save the returned led trigger
+ *
+ * @return None
+ */
+void cam_res_mgr_led_trigger_register(const char *name,
+	struct led_trigger **tp);
+
+/**
+ * @brief: Unregister the led trigger
+ *
+ *  Free the flash_res if this led trigger isn't used by other device .
+ *
+ * @tp : Pointer to the led trigger
+ *
+ * @return None
+ */
+void cam_res_mgr_led_trigger_unregister(struct led_trigger *tp);
+
+/**
+ * @brief: Trigger the event to led core
+ *
+ * @trig       : Pointer to the led trigger
+ * @brightness : The brightness need to fire
+ *
+ * @return None
+ */
+void cam_res_mgr_led_trigger_event(struct led_trigger *trig,
+	enum led_brightness brightness);
+
+/**
+ * @brief: Check for shared gpio
+ *
+ *  Will check whether requested device shares the gpio with other
+ *  device. This function check against gpio table from device and
+ *  shared gpio resources has been defined at res-mgr level
+ *
+ * @gpio_tbl  : The GPIO table for respective device
+ * @size      : GPIO table size
+ * @return Status of operation. False if not shared, true otherwise.
+ */
+bool cam_res_mgr_util_check_if_gpio_is_shared(
+	struct gpio *gpio_tbl, uint8_t size);
+
+/**
+ * @brief: Request a gpio
+ *
+ *  Will alloc a gpio_res for the new gpio, other find the corresponding
+ *  gpio_res.
+ *
+ * @dev   : Pointer to the device
+ * @gpio  : The GPIO number
+ * @flags : GPIO configuration as specified by GPIOF_*
+ * @label : A literal description string of this GPIO
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_res_mgr_gpio_request(struct device *dev, unsigned int gpio,
+		unsigned long flags, const char *label);
+
+/**
+ * @brief: Free a array GPIO
+ *
+ *  Free the GPIOs and release corresponding gpio_res.
+ *
+ * @dev   : Pointer to the device
+ * @gpio  : Array of the GPIO number
+ * @num   : The number of gpio
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+void cam_res_mgr_gpio_free_arry(struct device *dev,
+	const struct gpio *array, size_t num);
+
+/**
+ * @brief: Set GPIO power level
+ *
+ *  Add ref count support for shared GPIOs.
+ *
+ * @gpio   : The GPIO number
+ * @value  : The power level need to setup
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ * -EINVAL will be returned if the gpio can't be found in gpio_res_list.
+ */
+int cam_res_mgr_gpio_set_value(unsigned int gpio, int value);
+
+
+/**
+ * @brief : API to register RES_MGR to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_res_mgr_init(void);
+
+/**
+ * @brief : API to remove RES_MGR from platform framework.
+ */
+void cam_res_mgr_exit(void);
+
+/**
+ * @brief : API to get gpio idx from shared gpio list.
+ * @return idx for Success and error if gpio not found or invalid.
+ */
+int cam_res_mgr_util_get_idx_from_shared_gpio(uint gpio);
+
+/**
+ * @brief : API to get gpio idx from shared pinctrl gpio list.
+ * @return idx for Success and error if gpio not found or invalid.
+ */
+int cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(uint gpio);
+
+/**
+ * @brief : API to check whether gpio is in use or can be free.
+ * @return NEED_HOLD macro if gpio is in use CAN_FREE if gpio can be free,
+ *	error if operation is not valid, 0 in case of res_mgr is not
+ *	available.
+ */
+int cam_res_mgr_util_shared_gpio_check_hold(uint gpio);
+
+#endif /* __CAM_RES_MGR_API_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr_private.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr_private.h
@@ -0,0 +1,125 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __CAM_RES_MGR_PRIVATE_H__
+#define __CAM_RES_MGR_PRIVATE_H__
+
+#include <linux/list.h>
+#include <linux/leds.h>
+#include "cam_soc_util.h"
+#include "cam_sensor_util.h"
+
+#define MAX_SHARED_GPIO_SIZE         16
+#define MAX_SHARED_PCTRL_GPIO_SIZE   10
+
+/**
+ * enum pinctrl_status - Enum for pinctrl status
+ */
+enum pinctrl_status {
+	PINCTRL_STATUS_GOT = 0,
+	PINCTRL_STATUS_ACTIVE,
+	PINCTRL_STATUS_SUSPEND,
+	PINCTRL_STATUS_PUT,
+};
+
+/**
+ * struct cam_dev_res
+ *
+ * @list : List member used to append this node to a dev list
+ * @dev  : Device pointer associated with device
+ */
+struct cam_dev_res {
+	struct list_head list;
+	struct device    *dev;
+};
+
+/**
+ * struct cam_gpio_res
+ *
+ * @list           : List member used to append this node to a gpio list
+ * @dev_list       : List the device which request this gpio
+ * @gpio           : Gpio value
+ * @power_on_count : Record the power on times of this gpio
+ */
+struct cam_gpio_res {
+	struct list_head list;
+	struct list_head dev_list;
+	unsigned int     gpio;
+	int              power_on_count;
+};
+
+/**
+ * struct cam_pinctrl_res
+ *
+ * @list           : List member used to append this node to a linked list
+ * @name           : Pointer to the flash trigger's name.
+ * @trigger        : Pointer to the flash trigger
+ */
+struct cam_flash_res {
+	struct list_head   list;
+	const char         *name;
+	struct led_trigger *trigger;
+};
+
+/**
+ * struct cam_pinctrl_res
+ *
+ * @active         : Pinctrl state pointer for active state
+ * @suspend        : Pinctrl state pointer for suspend state
+ * @pstatus        : Pinctrl status holder
+ */
+struct cam_pinctrl_res {
+	struct pinctrl_state  *active;
+	struct pinctrl_state  *suspend;
+	enum pinctrl_status   pstatus;
+};
+
+/**
+ * struct cam_res_mgr_dt
+ *
+ * @shared_gpio            : Shared gpios list
+ * @shared_pctrl_gpio      : Shared pinctrl gpio list
+ * @num_shared_gpio        : Number of shared gpio
+ * @num_shared_pctrl_gpio  : Number of shared pinctrl gpio
+ * @pctrl_name             : Pinctrl name from shared pinctrl gpio list
+ */
+struct cam_res_mgr_dt {
+	uint                shared_gpio[MAX_SHARED_GPIO_SIZE];
+	uint                shared_pctrl_gpio[MAX_SHARED_PCTRL_GPIO_SIZE];
+	int                 num_shared_gpio;
+	int                 num_shared_pctrl_gpio;
+	const char         *pctrl_name[MAX_SHARED_PCTRL_GPIO_SIZE];
+};
+
+/**
+ * struct cam_pinctrl_res
+ *
+ * @dev                 : Pointer to the device
+ * @dt                  : Device tree resource
+ * @shared_gpio_enabled : The flag to indicate if support shared gpio
+ * @pstatus             : Top level device pinctrl status
+ * @pinctrl             : Device pinctrl pointer
+ * @pctrl_res           : Pinctrl resource array
+ * @gpio_res_list       : List head of the gpio resource
+ * @flash_res_list      : List head of the flash resource
+ * @gpio_res_lock       : GPIO resource lock
+ * @flash_res_lock      : Flash resource lock
+ */
+struct cam_res_mgr {
+	struct device          *dev;
+	struct cam_res_mgr_dt   dt;
+	bool                    shared_gpio_enabled;
+
+	enum pinctrl_status     pstatus;
+	struct pinctrl         *pinctrl;
+	struct cam_pinctrl_res  pctrl_res[MAX_SHARED_PCTRL_GPIO_SIZE];
+
+	struct list_head        gpio_res_list;
+	struct list_head        flash_res_list;
+	struct mutex            gpio_res_lock;
+	struct mutex            flash_res_lock;
+};
+
+#endif /* __CAM_RES_MGR_PRIVATE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c
@@ -0,0 +1,1712 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <cam_sensor_cmn_header.h>
+#include "cam_sensor_core.h"
+#include "cam_sensor_util.h"
+#include "cam_soc_util.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+#include "cam_packet_util.h"
+#include "cam_hdmi_bdg_core.h"
+#include "cam_dp_bdg_core.h"
+
+
+static int cam_sensor_update_req_mgr(
+	struct cam_sensor_ctrl_t *s_ctrl,
+	struct cam_packet *csl_packet)
+{
+	int rc = 0;
+	struct cam_req_mgr_add_request add_req;
+
+	memset(&add_req, 0, sizeof(add_req));
+	add_req.link_hdl = s_ctrl->bridge_intf.link_hdl;
+	add_req.req_id = csl_packet->header.request_id;
+	CAM_DBG(CAM_SENSOR, " Rxed Req Id: %llu",
+		csl_packet->header.request_id);
+	add_req.dev_hdl = s_ctrl->bridge_intf.device_hdl;
+	if (s_ctrl->bridge_intf.crm_cb &&
+		s_ctrl->bridge_intf.crm_cb->add_req) {
+		rc = s_ctrl->bridge_intf.crm_cb->add_req(&add_req);
+		if (rc) {
+			CAM_ERR(CAM_SENSOR,
+				"Adding request: %llu failed with request manager rc: %d",
+				csl_packet->header.request_id, rc);
+			return rc;
+		}
+	}
+
+	CAM_DBG(CAM_SENSOR, "Successfully add req: %llu to req mgr",
+			add_req.req_id);
+	return rc;
+}
+
+static void cam_sensor_release_stream_rsc(
+	struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct i2c_settings_array *i2c_set = NULL;
+	int rc;
+
+	i2c_set = &(s_ctrl->i2c_data.streamoff_settings);
+	if (i2c_set->is_settings_valid == 1) {
+		i2c_set->is_settings_valid = -1;
+		rc = delete_request(i2c_set);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"failed while deleting Streamoff settings");
+	}
+
+	i2c_set = &(s_ctrl->i2c_data.streamon_settings);
+	if (i2c_set->is_settings_valid == 1) {
+		i2c_set->is_settings_valid = -1;
+		rc = delete_request(i2c_set);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"failed while deleting Streamon settings");
+	}
+}
+
+static void cam_sensor_free_power_reg_rsc(
+	struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct i2c_settings_array *i2c_set = NULL;
+	int rc;
+
+	i2c_set = &(s_ctrl->i2c_data.poweron_reg_settings);
+	if (i2c_set->is_settings_valid == 1) {
+		i2c_set->is_settings_valid = -1;
+		rc = delete_request(i2c_set);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"failed while deleting PowerOnReg settings");
+	}
+
+	i2c_set = &(s_ctrl->i2c_data.poweroff_reg_settings);
+	if (i2c_set->is_settings_valid == 1) {
+		i2c_set->is_settings_valid = -1;
+		rc = delete_request(i2c_set);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"failed while deleting PowerOffReg settings");
+	}
+}
+
+static void cam_sensor_release_per_frame_resource(
+	struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct i2c_settings_array *i2c_set = NULL;
+	int i, rc;
+
+	if (s_ctrl->i2c_data.per_frame != NULL) {
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			i2c_set = &(s_ctrl->i2c_data.per_frame[i]);
+			if (i2c_set->is_settings_valid == 1) {
+				i2c_set->is_settings_valid = -1;
+				rc = delete_request(i2c_set);
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"delete request: %lld rc: %d",
+						i2c_set->request_id, rc);
+			}
+		}
+	}
+
+	if (s_ctrl->i2c_data.frame_skip != NULL) {
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			i2c_set = &(s_ctrl->i2c_data.frame_skip[i]);
+			if (i2c_set->is_settings_valid == 1) {
+				i2c_set->is_settings_valid = -1;
+				rc = delete_request(i2c_set);
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"delete request: %lld rc: %d",
+						i2c_set->request_id, rc);
+			}
+		}
+	}
+}
+
+static int32_t cam_sensor_i2c_pkt_parse(struct cam_sensor_ctrl_t *s_ctrl,
+	void *arg)
+{
+	int32_t rc = 0;
+	uintptr_t generic_ptr;
+	struct cam_control *ioctl_ctrl = NULL;
+	struct cam_packet *csl_packet = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	struct cam_buf_io_cfg *io_cfg = NULL;
+	struct i2c_settings_array *i2c_reg_settings = NULL;
+	size_t len_of_buff = 0;
+	size_t remain_len = 0;
+	uint32_t *offset = NULL;
+	struct cam_config_dev_cmd config;
+	struct i2c_data_settings *i2c_data = NULL;
+
+	ioctl_ctrl = (struct cam_control *)arg;
+
+	if (ioctl_ctrl->handle_type != CAM_HANDLE_USER_POINTER) {
+		CAM_ERR(CAM_SENSOR, "Invalid Handle Type");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&config,
+		u64_to_user_ptr(ioctl_ctrl->handle),
+		sizeof(config)))
+		return -EFAULT;
+
+	rc = cam_mem_get_cpu_buf(
+		config.packet_handle,
+		&generic_ptr,
+		&len_of_buff);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed in getting the packet: %d", rc);
+		return rc;
+	}
+
+	remain_len = len_of_buff;
+	if ((sizeof(struct cam_packet) > len_of_buff) ||
+		((size_t)config.offset >= len_of_buff -
+		sizeof(struct cam_packet))) {
+		CAM_ERR(CAM_SENSOR,
+			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
+			 sizeof(struct cam_packet), len_of_buff);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	remain_len -= (size_t)config.offset;
+	csl_packet = (struct cam_packet *)(generic_ptr +
+		(uint32_t)config.offset);
+
+	if (cam_packet_util_validate_packet(csl_packet,
+		remain_len)) {
+		CAM_ERR(CAM_SENSOR, "Invalid packet params");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) !=
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG &&
+		csl_packet->header.request_id <= s_ctrl->last_flush_req
+		&& s_ctrl->last_flush_req != 0) {
+		CAM_ERR(CAM_SENSOR,
+			"reject request %lld, last request to flush %u",
+			csl_packet->header.request_id, s_ctrl->last_flush_req);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (csl_packet->header.request_id > s_ctrl->last_flush_req)
+		s_ctrl->last_flush_req = 0;
+
+	i2c_data = &(s_ctrl->i2c_data);
+	CAM_DBG(CAM_SENSOR, "Header OpCode: %d", csl_packet->header.op_code);
+	switch (csl_packet->header.op_code & 0xFFFFFF) {
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG: {
+		i2c_reg_settings = &i2c_data->init_settings;
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_CONFIG: {
+		i2c_reg_settings = &i2c_data->config_settings;
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMON: {
+		if (s_ctrl->streamon_count > 0)
+			goto end;
+
+		s_ctrl->streamon_count = s_ctrl->streamon_count + 1;
+		i2c_reg_settings = &i2c_data->streamon_settings;
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF: {
+		if (s_ctrl->streamoff_count > 0)
+			goto end;
+
+		s_ctrl->streamoff_count = s_ctrl->streamoff_count + 1;
+		i2c_reg_settings = &i2c_data->streamoff_settings;
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_READ: {
+		i2c_reg_settings = &(i2c_data->read_settings);
+		i2c_reg_settings->request_id = 0;
+		i2c_reg_settings->is_settings_valid = 1;
+
+		CAM_DBG(CAM_SENSOR, "number of IO configs: %d:",
+			csl_packet->num_io_configs);
+		if (csl_packet->num_io_configs == 0) {
+			CAM_ERR(CAM_SENSOR, "No I/O configs to process");
+			goto end;
+		}
+
+		io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *)
+			&csl_packet->payload +
+			csl_packet->io_configs_offset);
+
+		if (io_cfg == NULL) {
+			CAM_ERR(CAM_SENSOR, "I/O config is invalid(NULL)");
+			goto end;
+		}
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE: {
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_ACQUIRE)) {
+			CAM_WARN(CAM_SENSOR,
+				"Rxed Update packets without linking");
+			goto end;
+		}
+
+		i2c_reg_settings =
+			&i2c_data->per_frame[csl_packet->header.request_id %
+				MAX_PER_FRAME_ARRAY];
+		CAM_DBG(CAM_SENSOR, "Received Packet: %lld req: %lld",
+			csl_packet->header.request_id % MAX_PER_FRAME_ARRAY,
+			csl_packet->header.request_id);
+		if (i2c_reg_settings->is_settings_valid == 1) {
+			CAM_ERR(CAM_SENSOR,
+				"Already some pkt in offset req : %lld",
+				csl_packet->header.request_id);
+			/*
+			 * Update req mgr even in case of failure.
+			 * This will help not to wait indefinitely
+			 * and freeze. If this log is triggered then
+			 * fix it.
+			 */
+			rc = cam_sensor_update_req_mgr(s_ctrl, csl_packet);
+			if (rc)
+				CAM_ERR(CAM_SENSOR,
+					"Failed in adding request to req_mgr");
+			goto end;
+		}
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE: {
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_ACQUIRE)) {
+			CAM_WARN(CAM_SENSOR,
+				"Rxed Update packets without linking");
+			goto end;
+		}
+
+		i2c_reg_settings =
+			&i2c_data->frame_skip[csl_packet->header.request_id %
+				MAX_PER_FRAME_ARRAY];
+		CAM_DBG(CAM_SENSOR, "Received not ready packet: %lld req: %lld",
+			csl_packet->header.request_id % MAX_PER_FRAME_ARRAY,
+			csl_packet->header.request_id);
+		break;
+	}
+	case CAM_SENSOR_PACKET_OPCODE_SENSOR_NOP: {
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_ACQUIRE)) {
+			CAM_WARN(CAM_SENSOR,
+				"Rxed NOP packets without linking");
+			goto end;
+		}
+
+		i2c_reg_settings =
+			&i2c_data->per_frame[csl_packet->header.request_id %
+				MAX_PER_FRAME_ARRAY];
+		i2c_reg_settings->request_id = csl_packet->header.request_id;
+		i2c_reg_settings->is_settings_valid = 1;
+
+		rc = cam_sensor_update_req_mgr(s_ctrl, csl_packet);
+		if (rc)
+			CAM_ERR(CAM_SENSOR,
+				"Failed in adding request to req_mgr");
+		goto end;
+	}
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Packet Header");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	offset = (uint32_t *)&csl_packet->payload;
+	offset += csl_packet->cmd_buf_offset / 4;
+	cmd_desc = (struct cam_cmd_buf_desc *)(offset);
+
+	rc = cam_sensor_i2c_command_parser(&s_ctrl->io_master_info,
+			i2c_reg_settings, cmd_desc, 1, io_cfg);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Fail parsing I2C Pkt: %d", rc);
+		goto end;
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) ==
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE) {
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+		rc = cam_sensor_update_req_mgr(s_ctrl, csl_packet);
+		if (rc) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed in adding request to req_mgr");
+			goto end;
+		}
+	}
+
+	if ((csl_packet->header.op_code & 0xFFFFFF) ==
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE) {
+		i2c_reg_settings->request_id =
+			csl_packet->header.request_id;
+	}
+
+end:
+	cam_mem_put_cpu_buf(config.packet_handle);
+	return rc;
+}
+
+static int32_t cam_sensor_update_i2c_info(struct cam_cmd_i2c_info *i2c_info,
+	struct cam_sensor_ctrl_t *s_ctrl,
+	bool isInit)
+{
+	int32_t rc = 0;
+	struct cam_sensor_cci_client   *cci_client = NULL;
+
+	switch (s_ctrl->io_master_info.master_type) {
+	case CCI_MASTER:
+		cci_client = s_ctrl->io_master_info.cci_client;
+		if (!cci_client) {
+			CAM_ERR(CAM_SENSOR, "failed: cci_client %pK",
+				cci_client);
+			return -EINVAL;
+		}
+		cci_client->cci_i2c_master = s_ctrl->cci_i2c_master;
+		cci_client->sid = i2c_info->slave_addr >> 1;
+		cci_client->retries = 3;
+		cci_client->id_map = 0;
+		cci_client->i2c_freq_mode = i2c_info->i2c_freq_mode;
+		CAM_DBG(CAM_SENSOR, " Master: %d sid: 0x%x freq_mode: %d",
+			cci_client->cci_i2c_master, i2c_info->slave_addr,
+			i2c_info->i2c_freq_mode);
+		break;
+
+	case I2C_MASTER:
+		s_ctrl->io_master_info.client->addr = i2c_info->slave_addr;
+		break;
+
+	case SPI_MASTER:
+		break;
+
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid master type: %d",
+			s_ctrl->io_master_info.master_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	if (isInit) {
+		s_ctrl->sensordata->slave_info.sensor_slave_addr =
+			i2c_info->slave_addr;
+		s_ctrl->sensordata->slave_info.i2c_freq_mode =
+			i2c_info->i2c_freq_mode;
+	}
+
+	return rc;
+}
+
+static int32_t cam_sensor_i2c_modes_util(
+	struct cam_sensor_ctrl_t *s_ctrl,
+	struct i2c_settings_list *i2c_list)
+{
+	int32_t rc = 0;
+	uint32_t i, size;
+	struct camera_io_master *io_master_info;
+
+	if (s_ctrl == NULL) {
+		CAM_ERR(CAM_SENSOR, "Invalid args");
+		return -EINVAL;
+	}
+
+	io_master_info = &s_ctrl->io_master_info;
+
+	if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_RANDOM) {
+		rc = camera_io_dev_write(io_master_info,
+			&(i2c_list->i2c_settings));
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to random write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_SEQ) {
+		rc = camera_io_dev_write_continuous(
+			io_master_info,
+			&(i2c_list->i2c_settings),
+			0);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to seq write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_WRITE_BURST) {
+		rc = camera_io_dev_write_continuous(
+			io_master_info,
+			&(i2c_list->i2c_settings),
+			1);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to burst write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_POLL) {
+		size = i2c_list->i2c_settings.size;
+		for (i = 0; i < size; i++) {
+			rc = camera_io_dev_poll(
+			io_master_info,
+			i2c_list->i2c_settings.reg_setting[i].reg_addr,
+			i2c_list->i2c_settings.reg_setting[i].reg_data,
+			i2c_list->i2c_settings.reg_setting[i].data_mask,
+			i2c_list->i2c_settings.addr_type,
+			i2c_list->i2c_settings.data_type,
+			i2c_list->i2c_settings.reg_setting[i].delay);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"i2c poll apply setting Fail: %d", rc);
+				return rc;
+			}
+		}
+	} else if (i2c_list->op_code == CAM_SENSOR_I2C_SET_I2C_INFO) {
+		rc = cam_sensor_update_i2c_info(&i2c_list->slave_info,
+			s_ctrl,
+			false);
+	} else if ((i2c_list->op_code == CAM_SENSOR_I2C_READ_RANDOM) ||
+		(i2c_list->op_code == CAM_SENSOR_I2C_READ_SEQ)) {
+		rc = cam_sensor_i2c_read_data(
+			&s_ctrl->i2c_data.read_settings,
+			&s_ctrl->io_master_info);
+	}
+
+	return rc;
+}
+
+static int32_t cam_sensor_update_slave_info(struct cam_cmd_probe *probe_info,
+	struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+
+	s_ctrl->sensordata->slave_info.sensor_id_reg_addr =
+		probe_info->reg_addr;
+	s_ctrl->sensordata->slave_info.sensor_id =
+		probe_info->expected_data;
+	s_ctrl->sensordata->slave_info.sensor_id_mask =
+		probe_info->data_mask;
+	/* Userspace passes the pipeline delay in reserved field */
+	s_ctrl->pipeline_delay =
+		probe_info->reserved;
+
+	s_ctrl->sensor_probe_addr_type =  probe_info->addr_type;
+	s_ctrl->sensor_probe_data_type =  probe_info->data_type;
+	CAM_DBG(CAM_SENSOR,
+		"Sensor Addr: 0x%x sensor_id: 0x%x sensor_mask: 0x%x sensor_pipeline_delay:0x%x",
+		s_ctrl->sensordata->slave_info.sensor_id_reg_addr,
+		s_ctrl->sensordata->slave_info.sensor_id,
+		s_ctrl->sensordata->slave_info.sensor_id_mask,
+		s_ctrl->pipeline_delay);
+	return rc;
+}
+
+static int32_t cam_handle_cmd_buffers_for_probe(void *cmd_buf,
+	struct cam_sensor_ctrl_t *s_ctrl,
+	int32_t cmd_buf_num, uint32_t cmd_buf_length, size_t remain_len,
+	struct cam_cmd_buf_desc   *cmd_desc)
+{
+	int32_t rc = 0;
+
+	switch (cmd_buf_num) {
+	case 0: {
+		struct cam_cmd_i2c_info *i2c_info = NULL;
+		struct cam_cmd_probe *probe_info;
+
+		if (remain_len <
+			(sizeof(struct cam_cmd_i2c_info) +
+			sizeof(struct cam_cmd_probe))) {
+			CAM_ERR(CAM_SENSOR,
+				"not enough buffer for cam_cmd_i2c_info");
+			return -EINVAL;
+		}
+		i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+		rc = cam_sensor_update_i2c_info(i2c_info, s_ctrl, true);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "Failed in Updating the i2c Info");
+			return rc;
+		}
+		probe_info = (struct cam_cmd_probe *)
+			(cmd_buf + sizeof(struct cam_cmd_i2c_info));
+		rc = cam_sensor_update_slave_info(probe_info, s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "Updating the slave Info");
+			return rc;
+		}
+		cmd_buf = probe_info;
+	}
+		break;
+	case 1: {
+		rc = cam_sensor_update_power_settings(cmd_buf,
+			cmd_buf_length, &s_ctrl->sensordata->power_info,
+			remain_len);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed in updating power settings");
+			return rc;
+		}
+	}
+		break;
+	case 2: {
+		struct i2c_settings_array *i2c_reg_settings = NULL;
+		struct i2c_data_settings *i2c_data = NULL;
+		struct cam_buf_io_cfg *io_cfg = NULL;
+
+		CAM_DBG(CAM_SENSOR, "poweron_reg_settings");
+		i2c_data = &(s_ctrl->i2c_data);
+		i2c_reg_settings = &i2c_data->poweron_reg_settings;
+		i2c_reg_settings->request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&s_ctrl->io_master_info,
+				i2c_reg_settings, cmd_desc, 1, io_cfg);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed in updating power register settings");
+			return rc;
+		}
+	}
+		break;
+	case 3: {
+		struct i2c_settings_array *i2c_reg_settings = NULL;
+		struct i2c_data_settings *i2c_data = NULL;
+		struct cam_buf_io_cfg *io_cfg = NULL;
+
+		CAM_DBG(CAM_SENSOR, "poweroff_reg_settings");
+		i2c_data = &(s_ctrl->i2c_data);
+		i2c_reg_settings = &i2c_data->poweroff_reg_settings;
+		i2c_reg_settings->request_id = 0;
+		rc = cam_sensor_i2c_command_parser(&s_ctrl->io_master_info,
+				i2c_reg_settings, cmd_desc, 1, io_cfg);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed in updating power register settings");
+			return rc;
+		}
+	}
+		break;
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid command buffer");
+		break;
+	}
+	return rc;
+}
+
+static int32_t cam_handle_mem_ptr(uint64_t handle, struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0, i;
+	uint32_t *cmd_buf;
+	void *ptr;
+	size_t len;
+	struct cam_packet *pkt = NULL;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+	uintptr_t cmd_buf1 = 0;
+	uintptr_t packet = 0;
+	size_t    remain_len = 0;
+
+	rc = cam_mem_get_cpu_buf(handle,
+		&packet, &len);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed to get the command Buffer");
+		return -EINVAL;
+	}
+
+	pkt = (struct cam_packet *)packet;
+	if (pkt == NULL) {
+		CAM_ERR(CAM_SENSOR, "packet pos is invalid");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((len < sizeof(struct cam_packet)) ||
+		(pkt->cmd_buf_offset >= (len - sizeof(struct cam_packet)))) {
+		CAM_ERR(CAM_SENSOR, "Not enough buf provided");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cmd_desc = (struct cam_cmd_buf_desc *)
+		((uint32_t *)&pkt->payload_flex + pkt->cmd_buf_offset/4);
+	if (cmd_desc == NULL) {
+		CAM_ERR(CAM_SENSOR, "command descriptor pos is invalid");
+		rc = -EINVAL;
+		goto end;
+	}
+	if (pkt->num_cmd_buf < 2) {
+		CAM_ERR(CAM_SENSOR, "Expected More Command Buffers : %d",
+			 pkt->num_cmd_buf);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	for (i = 0; i < pkt->num_cmd_buf; i++) {
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		if (!(cmd_desc[i].length))
+			continue;
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&cmd_buf1, &len);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to parse the command Buffer Header");
+			goto end;
+		}
+		if (cmd_desc[i].offset >= len) {
+			CAM_ERR(CAM_SENSOR,
+				"offset past length of buffer");
+			rc = -EINVAL;
+			goto end;
+		}
+		remain_len = len - cmd_desc[i].offset;
+		if (cmd_desc[i].length > remain_len) {
+			CAM_ERR(CAM_SENSOR,
+				"Not enough buffer provided for cmd");
+			rc = -EINVAL;
+			goto end;
+		}
+		cmd_buf = (uint32_t *)cmd_buf1;
+		cmd_buf += cmd_desc[i].offset/4;
+		ptr = (void *) cmd_buf;
+
+		rc = cam_handle_cmd_buffers_for_probe(ptr, s_ctrl,
+			i, cmd_desc[i].length, remain_len, &cmd_desc[i]);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to parse the command Buffer Header");
+			goto end;
+		}
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+
+end:
+	cam_mem_put_cpu_buf(handle);
+	return rc;
+}
+
+static void cam_sensor_query_cap(struct cam_sensor_ctrl_t *s_ctrl,
+	struct  cam_sensor_query_cap *query_cap)
+{
+	query_cap->pos_roll = s_ctrl->sensordata->pos_roll;
+	query_cap->pos_pitch = s_ctrl->sensordata->pos_pitch;
+	query_cap->pos_yaw = s_ctrl->sensordata->pos_yaw;
+	query_cap->secure_camera = 0;
+	query_cap->actuator_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_ACTUATOR];
+	query_cap->csiphy_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_CSIPHY];
+	query_cap->eeprom_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_EEPROM];
+	query_cap->flash_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_LED_FLASH];
+	query_cap->ois_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_OIS];
+	query_cap->ir_led_slot_id =
+		s_ctrl->sensordata->subdev_id[SUB_MODULE_IR_LED];
+	query_cap->slot_info =
+		s_ctrl->soc_info.index;
+}
+
+static uint16_t cam_sensor_id_by_mask(struct cam_sensor_ctrl_t *s_ctrl,
+	uint32_t chipid)
+{
+	uint16_t sensor_id = (uint16_t)(chipid & 0xFFFF);
+	int16_t sensor_id_mask = s_ctrl->sensordata->slave_info.sensor_id_mask;
+
+	if (!sensor_id_mask)
+		sensor_id_mask = ~sensor_id_mask;
+
+	sensor_id &= sensor_id_mask;
+	sensor_id_mask &= -sensor_id_mask;
+	sensor_id_mask -= 1;
+	while (sensor_id_mask) {
+		sensor_id_mask >>= 1;
+		sensor_id >>= 1;
+	}
+	return sensor_id;
+}
+
+void cam_sensor_shutdown(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct cam_sensor_power_ctrl_t *power_info =
+		&s_ctrl->sensordata->power_info;
+	int rc = 0;
+
+	if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) &&
+		(s_ctrl->is_probe_succeed == 0))
+		return;
+
+	cam_sensor_release_stream_rsc(s_ctrl);
+	cam_sensor_release_per_frame_resource(s_ctrl);
+
+	if (s_ctrl->sensor_state != CAM_SENSOR_INIT)
+		cam_sensor_power_down(s_ctrl);
+
+	if (s_ctrl->bridge_intf.device_hdl != -1) {
+		rc = cam_destroy_device_hdl(s_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"dhdl already destroyed: rc = %d", rc);
+	}
+
+	s_ctrl->bridge_intf.device_hdl = -1;
+	s_ctrl->bridge_intf.link_hdl = -1;
+	s_ctrl->bridge_intf.session_hdl = -1;
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_setting_size = 0;
+	power_info->power_down_setting_size = 0;
+	s_ctrl->streamon_count = 0;
+	s_ctrl->streamoff_count = 0;
+	s_ctrl->is_probe_succeed = 0;
+	s_ctrl->last_flush_req = 0;
+	s_ctrl->sensor_state = CAM_SENSOR_INIT;
+}
+
+static int cam_sensor_match_id(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0;
+	uint32_t chipid = 0;
+	struct cam_camera_slave_info *slave_info;
+
+	slave_info = &(s_ctrl->sensordata->slave_info);
+
+	if (!slave_info) {
+		CAM_ERR(CAM_SENSOR, " failed: %pK",
+			 slave_info);
+		return -EINVAL;
+	}
+
+	rc = camera_io_dev_read(
+		&(s_ctrl->io_master_info),
+		slave_info->sensor_id_reg_addr,
+		&chipid,
+		s_ctrl->sensor_probe_addr_type,
+		s_ctrl->sensor_probe_data_type);
+
+	CAM_DBG(CAM_SENSOR, "read id: 0x%x expected id 0x%x:",
+		chipid, slave_info->sensor_id);
+
+	if (cam_sensor_id_by_mask(s_ctrl, chipid) != slave_info->sensor_id) {
+		CAM_WARN(CAM_SENSOR, "read id: 0x%x expected id 0x%x:",
+				chipid, slave_info->sensor_id);
+		return -ENODEV;
+	}
+	return rc;
+}
+
+int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl,
+	void *arg)
+{
+	int rc = 0, pkt_opcode = 0;
+	struct cam_control *cmd = (struct cam_control *)arg;
+	struct cam_sensor_power_ctrl_t *power_info = NULL;
+	if (!s_ctrl || !arg) {
+		CAM_ERR(CAM_SENSOR, "s_ctrl is NULL");
+		return -EINVAL;
+	}
+
+	power_info = &s_ctrl->sensordata->power_info;
+
+	if (cmd->op_code != CAM_SENSOR_PROBE_CMD) {
+		if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
+			CAM_ERR(CAM_SENSOR, "Invalid handle type: %d",
+				cmd->handle_type);
+			return -EINVAL;
+		}
+	}
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	switch (cmd->op_code) {
+	case CAM_SENSOR_PROBE_CMD: {
+		if (s_ctrl->is_probe_succeed == 1) {
+			CAM_ERR(CAM_SENSOR,
+				"Already Sensor Probed in the slot");
+			break;
+		}
+
+		if (cmd->handle_type ==
+			CAM_HANDLE_MEM_HANDLE) {
+			rc = cam_handle_mem_ptr(cmd->handle, s_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "Get Buffer Handle Failed");
+				goto release_mutex;
+			}
+		} else {
+			CAM_ERR(CAM_SENSOR, "Invalid Command Type: %d",
+				 cmd->handle_type);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		/* Parse and fill vreg params for powerup settings */
+		rc = msm_camera_fill_vreg_params(
+			&s_ctrl->soc_info,
+			s_ctrl->sensordata->power_info.power_setting,
+			s_ctrl->sensordata->power_info.power_setting_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Fail in filling vreg params for PUP rc %d",
+				 rc);
+			goto free_power_settings;
+		}
+
+		/* Parse and fill vreg params for powerdown settings*/
+		rc = msm_camera_fill_vreg_params(
+			&s_ctrl->soc_info,
+			s_ctrl->sensordata->power_info.power_down_setting,
+			s_ctrl->sensordata->power_info.power_down_setting_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Fail in filling vreg params for PDOWN rc %d",
+				 rc);
+			goto free_power_settings;
+		}
+
+		/* Power up and probe sensor */
+		rc = cam_sensor_power_up(s_ctrl);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "power up failed");
+			goto free_power_settings;
+		}
+		if (s_ctrl->i2c_data.poweron_reg_settings.is_settings_valid) {
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_POWERON_REG);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "PowerOn REG_WR failed");
+				goto free_power_settings;
+			}
+
+			if (!strcmp(HDMI_SENSOR_NAME,s_ctrl->io_master_info.client->name))
+			{
+				cam_hdmi_bdg_set_cam_ctrl(s_ctrl);
+			}
+			if (!strcmp(DP_SENSOR_NAME,s_ctrl->io_master_info.client->name))
+			{
+				cam_dp_bdg_set_cam_ctrl(s_ctrl);
+			}
+		}
+
+		/* Match sensor ID */
+		s_ctrl->is_always_on = 0;
+		rc = cam_sensor_match_id(s_ctrl);
+		if (rc < 0) {
+			cam_sensor_power_down(s_ctrl);
+			msleep(20);
+			goto free_power_settings;
+		}
+
+		if (s_ctrl->i2c_data.poweroff_reg_settings.is_settings_valid
+			&& !rc) {
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_POWEROFF_REG);
+			s_ctrl->is_always_on = 1;
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "PowerOff REG_WR failed");
+				goto free_power_settings;
+			}
+		}
+
+		if (s_ctrl->is_always_on == 0) {
+			rc = cam_sensor_power_down(s_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+						"fail in Sensor Power Down");
+				goto free_power_settings;
+			}
+		}
+
+		CAM_INFO(CAM_SENSOR,
+			"Probe success,slot:%d,slave_addr:0x%x,sensor_id:0x%x, is always on: %d",
+			s_ctrl->soc_info.index,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr,
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->is_always_on);
+
+		cam_sensor_free_power_reg_rsc(s_ctrl);
+		/*
+		 * Set probe succeeded flag to 1 so that no other camera shall
+		 * probed on this slot
+		 */
+		s_ctrl->is_probe_succeed = 1;
+		s_ctrl->sensor_state = CAM_SENSOR_INIT;
+	}
+		break;
+	case CAM_ACQUIRE_DEV: {
+		struct cam_sensor_acquire_dev sensor_acq_dev;
+		struct cam_create_dev_hdl bridge_params;
+
+		if ((s_ctrl->is_probe_succeed == 0) ||
+			(s_ctrl->sensor_state != CAM_SENSOR_INIT)) {
+			CAM_WARN(CAM_SENSOR,
+				"Not in right state to aquire %d",
+				s_ctrl->sensor_state);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+
+		if (s_ctrl->bridge_intf.device_hdl != -1) {
+			CAM_ERR(CAM_SENSOR, "Device is already acquired");
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = copy_from_user(&sensor_acq_dev,
+			u64_to_user_ptr(cmd->handle),
+			sizeof(sensor_acq_dev));
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "Failed Copying from user");
+			goto release_mutex;
+		}
+
+		bridge_params.session_hdl = sensor_acq_dev.session_handle;
+		bridge_params.ops = &s_ctrl->bridge_intf.ops;
+		bridge_params.v4l2_sub_dev_flag = 0;
+		bridge_params.media_entity_flag = 0;
+		bridge_params.priv = s_ctrl;
+		bridge_params.dev_id = CAM_SENSOR;
+
+		sensor_acq_dev.device_handle =
+			cam_create_device_hdl(&bridge_params);
+		if (sensor_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_SENSOR, "Can not create device handle");
+			goto release_mutex;
+		}
+		s_ctrl->bridge_intf.device_hdl = sensor_acq_dev.device_handle;
+		s_ctrl->bridge_intf.session_hdl = sensor_acq_dev.session_handle;
+
+		CAM_DBG(CAM_SENSOR, "Device Handle: %d",
+			sensor_acq_dev.device_handle);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&sensor_acq_dev,
+			sizeof(struct cam_sensor_acquire_dev))) {
+			CAM_ERR(CAM_SENSOR, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+
+		if (!s_ctrl->is_always_on) {
+			rc = cam_sensor_power_up(s_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "Sensor Power up failed");
+				goto release_mutex;
+			}
+		}
+
+		s_ctrl->sensor_state = CAM_SENSOR_ACQUIRE;
+		s_ctrl->last_flush_req = 0;
+		CAM_INFO(CAM_SENSOR,
+			"CAM_ACQUIRE_DEV Success, sensor_id:0x%x,sensor_slave_addr:0x%x, is always on: %d",
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr,
+			s_ctrl->is_always_on);
+	}
+		break;
+	case CAM_RELEASE_DEV: {
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_START)) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_SENSOR,
+			"Not in right state to release : %d",
+			s_ctrl->sensor_state);
+			goto release_mutex;
+		}
+
+		if (s_ctrl->bridge_intf.link_hdl != -1) {
+			CAM_ERR(CAM_SENSOR,
+				"Device [%d] still active on link 0x%x",
+				s_ctrl->sensor_state,
+				s_ctrl->bridge_intf.link_hdl);
+			rc = -EAGAIN;
+			goto release_mutex;
+		}
+
+		if (!s_ctrl->is_always_on) {
+			rc = cam_sensor_power_down(s_ctrl);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "Sensor Power Down failed");
+				goto release_mutex;
+			}
+		}
+
+		cam_sensor_release_per_frame_resource(s_ctrl);
+		cam_sensor_release_stream_rsc(s_ctrl);
+		if (s_ctrl->bridge_intf.device_hdl == -1) {
+			CAM_ERR(CAM_SENSOR,
+				"Invalid Handles: link hdl: %d device hdl: %d",
+				s_ctrl->bridge_intf.device_hdl,
+				s_ctrl->bridge_intf.link_hdl);
+			rc = -EINVAL;
+			goto release_mutex;
+		}
+		rc = cam_destroy_device_hdl(s_ctrl->bridge_intf.device_hdl);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR,
+				"failed in destroying the device hdl");
+		s_ctrl->bridge_intf.device_hdl = -1;
+		s_ctrl->bridge_intf.link_hdl = -1;
+		s_ctrl->bridge_intf.session_hdl = -1;
+
+		s_ctrl->sensor_state = CAM_SENSOR_INIT;
+		CAM_INFO(CAM_SENSOR,
+			"CAM_RELEASE_DEV Success, sensor_id:0x%x,sensor_slave_addr:0x%x",
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr);
+		s_ctrl->streamon_count = 0;
+		s_ctrl->streamoff_count = 0;
+		s_ctrl->last_flush_req = 0;
+	}
+		break;
+	case CAM_QUERY_CAP: {
+		struct  cam_sensor_query_cap sensor_cap;
+
+		cam_sensor_query_cap(s_ctrl, &sensor_cap);
+		if (copy_to_user(u64_to_user_ptr(cmd->handle),
+			&sensor_cap, sizeof(struct  cam_sensor_query_cap))) {
+			CAM_ERR(CAM_SENSOR, "Failed Copy to User");
+			rc = -EFAULT;
+			goto release_mutex;
+		}
+		break;
+	}
+	case CAM_START_DEV: {
+		struct cam_req_mgr_timer_notify timer;
+		if ((s_ctrl->sensor_state == CAM_SENSOR_INIT) ||
+			(s_ctrl->sensor_state == CAM_SENSOR_START)) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_SENSOR,
+			"Not in right state to start : %d",
+			s_ctrl->sensor_state);
+			goto release_mutex;
+		}
+
+		if (s_ctrl->i2c_data.streamon_settings.is_settings_valid &&
+			(s_ctrl->i2c_data.streamon_settings.request_id == 0)) {
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMON);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"cannot apply streamon settings");
+				goto release_mutex;
+			}
+		}
+		s_ctrl->sensor_state = CAM_SENSOR_START;
+
+		if (s_ctrl->bridge_intf.crm_cb &&
+			s_ctrl->bridge_intf.crm_cb->notify_timer) {
+			timer.link_hdl = s_ctrl->bridge_intf.link_hdl;
+			timer.dev_hdl = s_ctrl->bridge_intf.device_hdl;
+			timer.state = true;
+			rc = s_ctrl->bridge_intf.crm_cb->notify_timer(&timer);
+			if (rc) {
+				CAM_ERR(CAM_SENSOR,
+					"Enable CRM SOF freeze timer failed rc: %d",
+					rc);
+				return rc;
+			}
+		}
+
+		CAM_INFO(CAM_SENSOR,
+			"CAM_START_DEV Success, sensor_id:0x%x,sensor_slave_addr:0x%x",
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr);
+	}
+		break;
+	case CAM_STOP_DEV: {
+		if (s_ctrl->sensor_state != CAM_SENSOR_START) {
+			rc = -EINVAL;
+			CAM_WARN(CAM_SENSOR,
+			"Not in right state to stop : %d",
+			s_ctrl->sensor_state);
+			goto release_mutex;
+		}
+
+		if (s_ctrl->i2c_data.streamoff_settings.is_settings_valid &&
+			(s_ctrl->i2c_data.streamoff_settings.request_id == 0)) {
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+				"cannot apply streamoff settings");
+			}
+		}
+
+		cam_sensor_release_per_frame_resource(s_ctrl);
+		s_ctrl->last_flush_req = 0;
+		s_ctrl->sensor_state = CAM_SENSOR_ACQUIRE;
+		CAM_INFO(CAM_SENSOR,
+			"CAM_STOP_DEV Success, sensor_id:0x%x,sensor_slave_addr:0x%x",
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr);
+	}
+		break;
+	case CAM_CONFIG_DEV: {
+		rc = cam_sensor_i2c_pkt_parse(s_ctrl, arg);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "Failed i2c pkt parse: %d", rc);
+			goto release_mutex;
+		}
+		if (s_ctrl->i2c_data.init_settings.is_settings_valid &&
+			(s_ctrl->i2c_data.init_settings.request_id == 0)) {
+
+			pkt_opcode =
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG;
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				pkt_opcode);
+
+			if ((rc == -EAGAIN) &&
+			(s_ctrl->io_master_info.master_type == CCI_MASTER)) {
+				/* If CCI hardware is resetting we need to wait
+				 * for sometime before reapply
+				 */
+				CAM_WARN(CAM_SENSOR,
+					"Reapplying the Init settings due to cci hw reset");
+				usleep_range(1000, 1010);
+				rc = cam_sensor_apply_settings(s_ctrl, 0,
+					pkt_opcode);
+			}
+			s_ctrl->i2c_data.init_settings.request_id = -1;
+
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"cannot apply init settings rc= %d",
+					rc);
+				delete_request(&s_ctrl->i2c_data.init_settings);
+				goto release_mutex;
+			}
+			rc = delete_request(&s_ctrl->i2c_data.init_settings);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"Fail in deleting the Init settings");
+				goto release_mutex;
+			}
+		}
+
+		if (s_ctrl->i2c_data.config_settings.is_settings_valid &&
+			(s_ctrl->i2c_data.config_settings.request_id == 0)) {
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_CONFIG);
+
+			s_ctrl->i2c_data.config_settings.request_id = -1;
+
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"cannot apply config settings");
+				delete_request(
+					&s_ctrl->i2c_data.config_settings);
+				goto release_mutex;
+			}
+			rc = delete_request(&s_ctrl->i2c_data.config_settings);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"Fail in deleting the config settings");
+				goto release_mutex;
+			}
+			s_ctrl->sensor_state = CAM_SENSOR_CONFIG;
+		}
+
+		if (s_ctrl->i2c_data.read_settings.is_settings_valid) {
+			rc = cam_sensor_apply_settings(s_ctrl, 0,
+				CAM_SENSOR_PACKET_OPCODE_SENSOR_READ);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"cannot apply read settings");
+				delete_request(
+					&s_ctrl->i2c_data.read_settings);
+				goto release_mutex;
+			}
+			rc = delete_request(
+				&s_ctrl->i2c_data.read_settings);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"Fail in deleting the read settings");
+				goto release_mutex;
+			}
+		}
+
+		CAM_DBG(CAM_SENSOR,
+			"CAM_CONFIG_DEV done sensor_id:0x%x,sensor_slave_addr:0x%x",
+			s_ctrl->sensordata->slave_info.sensor_id,
+			s_ctrl->sensordata->slave_info.sensor_slave_addr);
+	}
+		break;
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid Opcode: %d", cmd->op_code);
+		rc = -EINVAL;
+		goto release_mutex;
+	}
+
+release_mutex:
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+
+free_power_settings:
+	kfree(power_info->power_setting);
+	kfree(power_info->power_down_setting);
+	power_info->power_setting = NULL;
+	power_info->power_down_setting = NULL;
+	power_info->power_down_setting_size = 0;
+	power_info->power_setting_size = 0;
+	cam_sensor_free_power_reg_rsc(s_ctrl);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+}
+
+int cam_sensor_publish_dev_info(struct cam_req_mgr_device_info *info)
+{
+	int rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+
+	if (!info)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(info->dev_hdl);
+
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	info->dev_id = CAM_REQ_MGR_DEVICE_SENSOR;
+	strscpy(info->name, CAM_SENSOR_NAME, sizeof(info->name));
+	if (s_ctrl->pipeline_delay >= 1 && s_ctrl->pipeline_delay <= 3)
+		info->p_delay = s_ctrl->pipeline_delay;
+	else
+		info->p_delay = 2;
+	info->trigger = CAM_TRIGGER_POINT_SOF;
+
+	return rc;
+}
+
+int cam_sensor_establish_link(struct cam_req_mgr_core_dev_link_setup *link)
+{
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+
+	if (!link)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(link->dev_hdl);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&s_ctrl->cam_sensor_mutex);
+	if (link->link_enable) {
+		s_ctrl->bridge_intf.link_hdl = link->link_hdl;
+		s_ctrl->bridge_intf.crm_cb = link->crm_cb;
+	} else {
+		s_ctrl->bridge_intf.link_hdl = -1;
+		s_ctrl->bridge_intf.crm_cb = NULL;
+	}
+	mutex_unlock(&s_ctrl->cam_sensor_mutex);
+
+	return 0;
+}
+
+int cam_sensor_power(struct v4l2_subdev *sd, int on)
+{
+	struct cam_sensor_ctrl_t *s_ctrl = v4l2_get_subdevdata(sd);
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	if (!on && s_ctrl->sensor_state == CAM_SENSOR_START) {
+		cam_sensor_power_down(s_ctrl);
+		s_ctrl->sensor_state = CAM_SENSOR_ACQUIRE;
+	}
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+
+	return 0;
+}
+
+int cam_sensor_power_up(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc;
+	struct cam_sensor_power_ctrl_t *power_info;
+	struct cam_camera_slave_info *slave_info;
+	struct cam_hw_soc_info *soc_info;
+
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "failed: %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	power_info = &s_ctrl->sensordata->power_info;
+	slave_info = &(s_ctrl->sensordata->slave_info);
+
+	if (!power_info || !slave_info) {
+		CAM_ERR(CAM_SENSOR, "failed: %pK %pK", power_info, slave_info);
+		return -EINVAL;
+	}
+
+	soc_info = &s_ctrl->soc_info;
+
+	if (s_ctrl->bob_pwm_switch) {
+		rc = cam_sensor_bob_pwm_mode_switch(soc_info,
+			s_ctrl->bob_reg_index, true);
+		if (rc) {
+			CAM_WARN(CAM_SENSOR,
+			"BoB PWM setup failed rc: %d", rc);
+			rc = 0;
+		}
+	}
+
+	rc = cam_sensor_core_power_up(power_info, soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "power up the core is failed:%d", rc);
+		return rc;
+	}
+
+	rc = camera_io_init(&(s_ctrl->io_master_info));
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "cci_init failed: rc: %d", rc);
+		goto cci_failure;
+	}
+
+	return rc;
+cci_failure:
+	if (cam_sensor_util_power_down(power_info, soc_info))
+		CAM_ERR(CAM_SENSOR, "power down failure");
+
+	return rc;
+
+}
+
+int cam_sensor_power_down(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct cam_sensor_power_ctrl_t *power_info;
+	struct cam_hw_soc_info *soc_info;
+	int rc = 0;
+
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "failed: s_ctrl %pK", s_ctrl);
+		return -EINVAL;
+	}
+
+	power_info = &s_ctrl->sensordata->power_info;
+	soc_info = &s_ctrl->soc_info;
+
+	if (!power_info) {
+		CAM_ERR(CAM_SENSOR, "failed: power_info %pK", power_info);
+		return -EINVAL;
+	}
+	rc = cam_sensor_util_power_down(power_info, soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "power down the core is failed:%d", rc);
+		return rc;
+	}
+
+	if (s_ctrl->bob_pwm_switch) {
+		rc = cam_sensor_bob_pwm_mode_switch(soc_info,
+			s_ctrl->bob_reg_index, false);
+		if (rc) {
+			CAM_WARN(CAM_SENSOR,
+				"BoB PWM setup failed rc: %d", rc);
+			rc = 0;
+		}
+	}
+
+	camera_io_release(&(s_ctrl->io_master_info));
+
+	return rc;
+}
+
+int cam_sensor_apply_settings(struct cam_sensor_ctrl_t *s_ctrl,
+	uint64_t req_id, enum cam_sensor_packet_opcodes opcode)
+{
+	int rc = 0, offset, i;
+	uint64_t top = 0, del_req_id = 0;
+	struct i2c_settings_array *i2c_set = NULL;
+	struct i2c_settings_list *i2c_list;
+
+	if (req_id == 0) {
+		switch (opcode) {
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMON: {
+			i2c_set = &s_ctrl->i2c_data.streamon_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG: {
+			i2c_set = &s_ctrl->i2c_data.init_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_CONFIG: {
+			i2c_set = &s_ctrl->i2c_data.config_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF: {
+			i2c_set = &s_ctrl->i2c_data.streamoff_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_READ: {
+			i2c_set = &s_ctrl->i2c_data.read_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_POWERON_REG: {
+			i2c_set = &s_ctrl->i2c_data.poweron_reg_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_POWEROFF_REG: {
+			i2c_set = &s_ctrl->i2c_data.poweroff_reg_settings;
+			break;
+		}
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE:
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE:
+		case CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE:
+		default:
+			return 0;
+		}
+		if (i2c_set->is_settings_valid == 1) {
+			list_for_each_entry(i2c_list,
+				&(i2c_set->list_head), list) {
+				rc = cam_sensor_i2c_modes_util(s_ctrl,
+					i2c_list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+						"Failed to apply settings: %d",
+						rc);
+					return rc;
+				}
+			}
+		}
+	} else if (req_id > 0) {
+		offset = req_id % MAX_PER_FRAME_ARRAY;
+
+		if (opcode == CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE)
+			i2c_set = s_ctrl->i2c_data.frame_skip;
+		else
+			i2c_set = s_ctrl->i2c_data.per_frame;
+
+		if (i2c_set[offset].is_settings_valid == 1 &&
+			i2c_set[offset].request_id == req_id) {
+			list_for_each_entry(i2c_list,
+				&(i2c_set[offset].list_head), list) {
+				rc = cam_sensor_i2c_modes_util(s_ctrl,
+					i2c_list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+						"Failed to apply settings: %d",
+						rc);
+					return rc;
+				}
+			}
+			CAM_DBG(CAM_SENSOR, "applied req_id: %llu", req_id);
+		} else {
+			CAM_DBG(CAM_SENSOR,
+				"Invalid/NOP request to apply: %lld", req_id);
+		}
+
+		/* Change the logic dynamically */
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			if ((req_id >=
+				i2c_set[i].request_id) &&
+				(top <
+				i2c_set[i].request_id) &&
+				(i2c_set[i].is_settings_valid
+					== 1)) {
+				del_req_id = top;
+				top = i2c_set[i].request_id;
+			}
+		}
+
+		if (top < req_id) {
+			if ((((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) >= BATCH_SIZE_MAX) ||
+				(((top % MAX_PER_FRAME_ARRAY) - (req_id %
+				MAX_PER_FRAME_ARRAY)) <= -BATCH_SIZE_MAX))
+				del_req_id = req_id;
+		}
+
+		if (!del_req_id)
+			return rc;
+
+		CAM_DBG(CAM_SENSOR, "top: %llu, del_req_id:%llu",
+			top, del_req_id);
+
+		for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+			if ((del_req_id >
+				 i2c_set[i].request_id) && (
+				 i2c_set[i].is_settings_valid
+					== 1)) {
+				i2c_set[i].request_id = 0;
+				rc = delete_request(
+					&(i2c_set[i]));
+				if (rc < 0)
+					CAM_ERR(CAM_SENSOR,
+						"Delete request Fail:%lld rc:%d",
+						del_req_id, rc);
+			}
+		}
+	}
+
+	return rc;
+}
+
+int32_t cam_sensor_apply_request(struct cam_req_mgr_apply_request *apply)
+{
+	int32_t rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	enum cam_sensor_packet_opcodes opcode =
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE;
+
+	if (!apply)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(apply->dev_hdl);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_REQ, " Sensor[%d] update req id: %lld",
+		s_ctrl->soc_info.index, apply->request_id);
+	trace_cam_apply_req("Sensor", apply->request_id);
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	rc = cam_sensor_apply_settings(s_ctrl, apply->request_id,
+		opcode);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+}
+
+int32_t cam_sensor_notify_frame_skip(struct cam_req_mgr_apply_request *apply)
+{
+	int32_t rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	enum cam_sensor_packet_opcodes opcode =
+		CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE;
+
+	if (!apply)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(apply->dev_hdl);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_REQ, " Sensor[%d] handle frame skip for req id: %lld",
+		s_ctrl->soc_info.index, apply->request_id);
+	trace_cam_notify_frame_skip("Sensor", apply->request_id);
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	rc = cam_sensor_apply_settings(s_ctrl, apply->request_id,
+		opcode);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+}
+
+int32_t cam_sensor_flush_request(struct cam_req_mgr_flush_request *flush_req)
+{
+	int32_t rc = 0, i;
+	uint32_t cancel_req_id_found = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	struct i2c_settings_array *i2c_set = NULL;
+
+	if (!flush_req)
+		return -EINVAL;
+
+	s_ctrl = (struct cam_sensor_ctrl_t *)
+		cam_get_device_priv(flush_req->dev_hdl);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "Device data is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	if ((s_ctrl->sensor_state != CAM_SENSOR_START) &&
+		(s_ctrl->sensor_state != CAM_SENSOR_CONFIG)) {
+		mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+		return rc;
+	}
+
+	if (s_ctrl->i2c_data.per_frame == NULL) {
+		CAM_ERR(CAM_SENSOR, "i2c frame data is NULL");
+		mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+		return -EINVAL;
+	}
+
+	if (s_ctrl->i2c_data.frame_skip == NULL) {
+		CAM_ERR(CAM_SENSOR, "i2c not ready data is NULL");
+		mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+		return -EINVAL;
+	}
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_ALL) {
+		s_ctrl->last_flush_req = flush_req->req_id;
+		CAM_DBG(CAM_SENSOR, "last reqest to flush is %lld",
+			flush_req->req_id);
+	}
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		i2c_set = &(s_ctrl->i2c_data.per_frame[i]);
+
+		if ((flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ)
+				&& (i2c_set->request_id != flush_req->req_id))
+			continue;
+
+		if (i2c_set->is_settings_valid == 1) {
+			rc = delete_request(i2c_set);
+			if (rc < 0)
+				CAM_ERR(CAM_SENSOR,
+					"delete request: %lld rc: %d",
+					i2c_set->request_id, rc);
+
+			if (flush_req->type ==
+				CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+				cancel_req_id_found = 1;
+				break;
+			}
+		}
+	}
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		i2c_set = &(s_ctrl->i2c_data.frame_skip[i]);
+
+		if ((flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ)
+				&& (i2c_set->request_id != flush_req->req_id))
+			continue;
+
+		if (i2c_set->is_settings_valid == 1) {
+			rc = delete_request(i2c_set);
+			if (rc < 0)
+				CAM_ERR(CAM_SENSOR,
+					"delete request for not ready packet: %lld rc: %d",
+					i2c_set->request_id, rc);
+
+			if (flush_req->type ==
+				CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+				cancel_req_id_found = 1;
+				break;
+			}
+		}
+	}
+
+	if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ &&
+		!cancel_req_id_found)
+		CAM_DBG(CAM_SENSOR,
+			"Flush request id:%lld not found in the pending list",
+			flush_req->req_id);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.h
@@ -0,0 +1,93 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018,2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_CORE_H_
+#define _CAM_SENSOR_CORE_H_
+
+#include "cam_sensor_dev.h"
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * This API powers up the camera sensor module
+ */
+int cam_sensor_power_up(struct cam_sensor_ctrl_t *s_ctrl);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * This API powers down the camera sensor module
+ */
+int cam_sensor_power_down(struct cam_sensor_ctrl_t *s_ctrl);
+
+/**
+ * @sd: V4L2 subdevice
+ * @on: Turn off/on flag
+ *
+ * This API powers down the sensor module
+ */
+int cam_sensor_power(struct v4l2_subdev *sd, int on);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ * @req_id: Request id
+ * @opcode: opcode for settings
+ *
+ * This API applies the req_id settings to sensor
+ */
+int cam_sensor_apply_settings(struct cam_sensor_ctrl_t *s_ctrl, uint64_t req_id,
+	enum cam_sensor_packet_opcodes opcode);
+
+/**
+ * @apply: Req mgr structure for applying request
+ *
+ * This API applies the request that is mentioned
+ */
+int cam_sensor_apply_request(struct cam_req_mgr_apply_request *apply);
+
+/**
+ * @apply: Req mgr structure for notifying frame skip
+ *
+ * This API notifies a frame is skipped
+ */
+int cam_sensor_notify_frame_skip(struct cam_req_mgr_apply_request *apply);
+
+/**
+ * @flush: Req mgr structure for flushing request
+ *
+ * This API flushes the request that is mentioned
+ */
+int cam_sensor_flush_request(struct cam_req_mgr_flush_request *flush);
+
+/**
+ * @info: Sub device info to req mgr
+ *
+ * Publish the subdevice info
+ */
+int cam_sensor_publish_dev_info(struct cam_req_mgr_device_info *info);
+
+/**
+ * @link: Link setup info
+ *
+ * This API establishes link with sensor subdevice with req mgr
+ */
+int cam_sensor_establish_link(struct cam_req_mgr_core_dev_link_setup *link);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ * @arg:    Camera control command argument
+ *
+ * This API handles the camera control argument reached to sensor
+ */
+int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl, void *arg);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * This API handles the camera sensor close/shutdown
+ */
+void cam_sensor_shutdown(struct cam_sensor_ctrl_t *s_ctrl);
+
+#endif /* _CAM_SENSOR_CORE_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.c
@@ -0,0 +1,514 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sensor_dev.h"
+#include "cam_req_mgr_dev.h"
+#include "cam_sensor_soc.h"
+#include "cam_sensor_core.h"
+#include "camera_main.h"
+#include "cam_compat.h"
+
+static int cam_sensor_subdev_close_internal(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	struct cam_sensor_ctrl_t *s_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "s_ctrl ptr is NULL");
+		return -EINVAL;
+	}
+
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_shutdown(s_ctrl);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+
+	return 0;
+}
+
+static int cam_sensor_subdev_close(struct v4l2_subdev *sd,
+	struct v4l2_subdev_fh *fh)
+{
+	bool crm_active = cam_req_mgr_is_open();
+
+	if (crm_active) {
+		CAM_DBG(CAM_SENSOR, "CRM is ACTIVE, close should be from CRM");
+		return 0;
+	}
+
+	return cam_sensor_subdev_close_internal(sd, fh);
+}
+
+static long cam_sensor_subdev_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, void *arg)
+{
+	int rc = 0;
+	struct cam_sensor_ctrl_t *s_ctrl =
+		v4l2_get_subdevdata(sd);
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_sensor_driver_cmd(s_ctrl, arg);
+		if (rc)
+			CAM_ERR(CAM_SENSOR,
+				"Failed in Driver cmd: %d", rc);
+		break;
+	case CAM_SD_SHUTDOWN:
+		if (!cam_req_mgr_is_shutdown()) {
+			CAM_ERR(CAM_CORE, "SD shouldn't come from user space");
+			return 0;
+		}
+
+		rc = cam_sensor_subdev_close_internal(sd, NULL);
+		break;
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid ioctl cmd: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long cam_sensor_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_SENSOR, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_sensor_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR, "cam_sensor_subdev_ioctl failed");
+		break;
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid compat ioctl cmd_type: %d", cmd);
+		rc = -ENOIOCTLCMD;
+		break;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+
+#endif
+static struct v4l2_subdev_core_ops cam_sensor_subdev_core_ops = {
+	.ioctl = cam_sensor_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_sensor_init_subdev_do_ioctl,
+#endif
+	.s_power = cam_sensor_power,
+};
+
+static struct v4l2_subdev_ops cam_sensor_subdev_ops = {
+	.core = &cam_sensor_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cam_sensor_internal_ops = {
+	.close = cam_sensor_subdev_close,
+};
+
+static int cam_sensor_init_subdev_params(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0;
+
+	s_ctrl->v4l2_dev_str.internal_ops =
+		&cam_sensor_internal_ops;
+	s_ctrl->v4l2_dev_str.ops =
+		&cam_sensor_subdev_ops;
+	strscpy(s_ctrl->device_name, CAMX_SENSOR_DEV_NAME,
+		sizeof(s_ctrl->device_name));
+	s_ctrl->v4l2_dev_str.name =
+		s_ctrl->device_name;
+	s_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	s_ctrl->v4l2_dev_str.ent_function =
+		CAM_SENSOR_DEVICE_TYPE;
+	s_ctrl->v4l2_dev_str.token = s_ctrl;
+	s_ctrl->v4l2_dev_str.close_seq_prior =
+		CAM_SD_CLOSE_MEDIUM_PRIORITY;
+
+	rc = cam_register_subdev(&(s_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "Fail with cam_register_subdev rc: %d", rc);
+
+	return rc;
+}
+
+static int32_t cam_sensor_i2c_driver_probe(struct i2c_client *client)
+{
+	int32_t rc = 0;
+	int i = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	struct cam_hw_soc_info   *soc_info = NULL;
+
+	if (client == NULL) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args client: %pK",
+			client);
+		return -EINVAL;
+	}
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+		CAM_ERR(CAM_SENSOR,
+			"%s :i2c_check_functionality failed", client->name);
+		return -EFAULT;
+	}
+
+	/* Create sensor control structure */
+	s_ctrl = kzalloc(sizeof(*s_ctrl), GFP_KERNEL);
+	if (!s_ctrl)
+		return -ENOMEM;
+
+	i2c_set_clientdata(client, s_ctrl);
+
+	s_ctrl->io_master_info.client = client;
+	soc_info = &s_ctrl->soc_info;
+	soc_info->dev = &client->dev;
+	soc_info->dev_name = client->name;
+
+	/* Initialize sensor device type */
+	s_ctrl->of_node = client->dev.of_node;
+	s_ctrl->io_master_info.master_type = I2C_MASTER;
+	s_ctrl->is_probe_succeed = 0;
+	s_ctrl->last_flush_req = 0;
+
+	rc = cam_sensor_parse_dt(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "cam_sensor_parse_dt rc %d", rc);
+		goto free_s_ctrl;
+	}
+
+	rc = cam_sensor_init_subdev_params(s_ctrl);
+	if (rc)
+		goto free_s_ctrl;
+
+	s_ctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto unreg_subdev;
+	}
+
+	s_ctrl->i2c_data.frame_skip =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.frame_skip == NULL) {
+		rc = -ENOMEM;
+		goto free_perframe;
+	}
+
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.init_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.config_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.streamon_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.streamoff_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.poweron_reg_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.poweroff_reg_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.read_settings.list_head));
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.per_frame[i].list_head));
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.frame_skip[i].list_head));
+	}
+
+	s_ctrl->bridge_intf.device_hdl = -1;
+	s_ctrl->bridge_intf.link_hdl = -1;
+	s_ctrl->bridge_intf.ops.get_dev_info = cam_sensor_publish_dev_info;
+	s_ctrl->bridge_intf.ops.link_setup = cam_sensor_establish_link;
+	s_ctrl->bridge_intf.ops.apply_req = cam_sensor_apply_request;
+	s_ctrl->bridge_intf.ops.notify_frame_skip =
+		cam_sensor_notify_frame_skip;
+	s_ctrl->bridge_intf.ops.flush_req = cam_sensor_flush_request;
+
+	s_ctrl->sensordata->power_info.dev = soc_info->dev;
+
+	return rc;
+free_perframe:
+	kfree(s_ctrl->i2c_data.per_frame);
+unreg_subdev:
+	cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
+free_s_ctrl:
+	kfree(s_ctrl);
+	return rc;
+}
+
+static int cam_sensor_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int32_t rc = 0, i = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	struct cam_hw_soc_info *soc_info = NULL;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	/* Create sensor control structure */
+	s_ctrl = devm_kzalloc(&pdev->dev,
+		sizeof(struct cam_sensor_ctrl_t), GFP_KERNEL);
+	if (!s_ctrl)
+		return -ENOMEM;
+
+	soc_info = &s_ctrl->soc_info;
+	soc_info->pdev = pdev;
+	soc_info->dev = &pdev->dev;
+	soc_info->dev_name = pdev->name;
+
+	/* Initialize sensor device type */
+	s_ctrl->of_node = pdev->dev.of_node;
+	s_ctrl->is_probe_succeed = 0;
+	s_ctrl->last_flush_req = 0;
+
+	/*fill in platform device*/
+	s_ctrl->pdev = pdev;
+
+	s_ctrl->io_master_info.master_type = CCI_MASTER;
+
+	rc = cam_sensor_parse_dt(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed: cam_sensor_parse_dt rc %d", rc);
+		goto free_s_ctrl;
+	}
+
+	/* Fill platform device id*/
+	pdev->id = soc_info->index;
+
+	rc = cam_sensor_init_subdev_params(s_ctrl);
+	if (rc)
+		goto free_s_ctrl;
+
+	s_ctrl->i2c_data.per_frame =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto unreg_subdev;
+	}
+
+	s_ctrl->i2c_data.frame_skip =
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.frame_skip == NULL) {
+		rc = -ENOMEM;
+		goto free_perframe;
+	}
+
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.init_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.config_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.streamon_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.streamoff_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.poweron_reg_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.poweroff_reg_settings.list_head));
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.read_settings.list_head));
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++) {
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.per_frame[i].list_head));
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.frame_skip[i].list_head));
+	}
+
+	s_ctrl->bridge_intf.device_hdl = -1;
+	s_ctrl->bridge_intf.link_hdl = -1;
+	s_ctrl->bridge_intf.ops.get_dev_info = cam_sensor_publish_dev_info;
+	s_ctrl->bridge_intf.ops.link_setup = cam_sensor_establish_link;
+	s_ctrl->bridge_intf.ops.apply_req = cam_sensor_apply_request;
+	s_ctrl->bridge_intf.ops.notify_frame_skip =
+		cam_sensor_notify_frame_skip;
+	s_ctrl->bridge_intf.ops.flush_req = cam_sensor_flush_request;
+
+	s_ctrl->sensordata->power_info.dev = &pdev->dev;
+	platform_set_drvdata(pdev, s_ctrl);
+	s_ctrl->sensor_state = CAM_SENSOR_INIT;
+	CAM_DBG(CAM_SENSOR, "Component bound successfully");
+
+	return rc;
+
+free_perframe:
+	kfree(s_ctrl->i2c_data.per_frame);
+unreg_subdev:
+	cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
+free_s_ctrl:
+	devm_kfree(&pdev->dev, s_ctrl);
+	return rc;
+}
+
+static void cam_sensor_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int                        i;
+	struct cam_sensor_ctrl_t  *s_ctrl;
+	struct cam_hw_soc_info    *soc_info;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	s_ctrl = platform_get_drvdata(pdev);
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "sensor device is NULL");
+		return;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Component unbind called for: %s", pdev->name);
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_shutdown(s_ctrl);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_release_power_domain(s_ctrl);
+	cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
+	soc_info = &s_ctrl->soc_info;
+	for (i = 0; i < soc_info->num_clk; i++)
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+
+	kfree(s_ctrl->i2c_data.per_frame);
+	kfree(s_ctrl->i2c_data.frame_skip);
+	platform_set_drvdata(pdev, NULL);
+	v4l2_set_subdevdata(&(s_ctrl->v4l2_dev_str.sd), NULL);
+	devm_kfree(&pdev->dev, s_ctrl);
+}
+
+const static struct component_ops cam_sensor_component_ops = {
+	.bind = cam_sensor_component_bind,
+	.unbind = cam_sensor_component_unbind,
+};
+
+static int cam_sensor_platform_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_sensor_component_ops);
+	return 0;
+}
+
+int cam_sensor_i2c_driver_remove_common(struct i2c_client *client)
+{
+
+	int i;
+	struct cam_hw_soc_info    *soc_info;
+	int rc = 0;
+	struct cam_sensor_ctrl_t  *s_ctrl = i2c_get_clientdata(client);
+
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "sensor device is NULL");
+		rc = -EINVAL;
+		return rc;
+	}
+
+	CAM_DBG(CAM_SENSOR, "i2c remove invoked");
+	mutex_lock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_shutdown(s_ctrl);
+	mutex_unlock(&(s_ctrl->cam_sensor_mutex));
+	cam_sensor_release_power_domain(s_ctrl);
+	rc = cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
+
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "unregistering sensor subdev is not sucessful");
+
+	soc_info = &s_ctrl->soc_info;
+
+	for (i = 0; i < soc_info->num_clk; i++)
+		devm_clk_put(soc_info->dev, soc_info->clk[i]);
+
+	kfree(s_ctrl->i2c_data.per_frame);
+	kfree(s_ctrl->i2c_data.frame_skip);
+	v4l2_set_subdevdata(&(s_ctrl->v4l2_dev_str.sd), NULL);
+	kfree(s_ctrl);
+
+	return rc;
+}
+
+static const struct of_device_id cam_sensor_driver_dt_match[] = {
+	{.compatible = "qcom,cam-sensor"},
+	{.compatible = "lt,lt6911gxc"},
+	{.compatible = "lt,lt7911uxc"},
+	{}
+};
+
+static const struct of_device_id cam_sensor_driver_platform_dt_match[] = {
+	{.compatible = "qcom,cam-sensor"},
+	{}
+};
+
+static const struct of_device_id cam_sensor_driver_i2c_dt_match[] = {
+	{.compatible = "lt,lt6911gxc"},
+	{.compatible = "lt,lt7911uxc"},
+	{}
+};
+
+static int32_t cam_sensor_driver_platform_probe(
+	struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_SENSOR, "Adding Sensor component");
+	rc = component_add(&pdev->dev, &cam_sensor_component_ops);
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+MODULE_DEVICE_TABLE(of, cam_sensor_driver_dt_match);
+
+struct platform_driver cam_sensor_platform_driver = {
+	.probe = cam_sensor_driver_platform_probe,
+	.driver = {
+		.name = "qcom,camera",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_sensor_driver_platform_dt_match,
+		.suppress_bind_attrs = true,
+	},
+	.remove = cam_sensor_platform_remove,
+};
+
+static const struct i2c_device_id i2c_id[] = {
+	{SENSOR_DRIVER_I2C, (kernel_ulong_t)NULL},
+	{ }
+};
+
+static struct i2c_driver cam_sensor_driver_i2c = {
+	.id_table = i2c_id,
+	.probe = cam_sensor_i2c_driver_probe,
+	.remove = cam_sensor_i2c_driver_remove,
+	.driver = {
+		.name = SENSOR_DRIVER_I2C,
+		.of_match_table = cam_sensor_driver_i2c_dt_match,
+	},
+};
+
+int cam_sensor_driver_init(void)
+{
+	int32_t rc = 0;
+
+	rc = platform_driver_register(&cam_sensor_platform_driver);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "platform_driver_register Failed: rc = %d",
+			rc);
+		return rc;
+	}
+
+	rc = i2c_add_driver(&cam_sensor_driver_i2c);
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "i2c_add_driver failed rc = %d", rc);
+
+	return rc;
+}
+
+void cam_sensor_driver_exit(void)
+{
+	platform_driver_unregister(&cam_sensor_platform_driver);
+	i2c_del_driver(&cam_sensor_driver_i2c);
+}
+
+MODULE_DESCRIPTION("cam_sensor_driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_dev.h
@@ -0,0 +1,136 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_DEV_H_
+#define _CAM_SENSOR_DEV_H_
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/irqreturn.h>
+#include <linux/iommu.h>
+#include <linux/timer.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
+#include <cam_cci_dev.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_subdev.h>
+#include <cam_sensor_io.h>
+#include "cam_debug_util.h"
+#include "cam_context.h"
+
+#define NUM_MASTERS 2
+#define NUM_QUEUES 2
+
+#undef CDBG
+#ifdef CAM_SENSOR_DEBUG
+#define CDBG(fmt, args...) pr_err(fmt, ##args)
+#else
+#define CDBG(fmt, args...) pr_debug(fmt, ##args)
+#endif
+
+#define SENSOR_DRIVER_I2C "i2c_camera"
+#define CAMX_SENSOR_DEV_NAME "cam-sensor-driver"
+
+enum cam_sensor_state_t {
+	CAM_SENSOR_INIT,
+	CAM_SENSOR_ACQUIRE,
+	CAM_SENSOR_CONFIG,
+	CAM_SENSOR_START,
+};
+
+/**
+ * struct sensor_intf_params
+ * @device_hdl: Device Handle
+ * @session_hdl: Session Handle
+ * @link_hdl: Link Handle
+ * @ops: KMD operations
+ * @crm_cb: Callback API pointers
+ */
+struct sensor_intf_params {
+	int32_t device_hdl;
+	int32_t session_hdl;
+	int32_t link_hdl;
+	struct cam_req_mgr_kmd_ops ops;
+	struct cam_req_mgr_crm_cb *crm_cb;
+};
+
+/**
+ * struct cam_sensor_ctrl_t: Camera control structure
+ * @device_name: Sensor device name
+ * @pdev: Platform device
+ * @cam_sensor_mutex: Sensor mutex
+ * @sensordata: Sensor board Information
+ * @cci_i2c_master: I2C structure
+ * @io_master_info: Information about the communication master
+ * @sensor_state: Sensor states
+ * @is_probe_succeed: Probe succeeded or not
+ * @is_always_on: sensor need always on or not
+ * @id: Cell Index
+ * @of_node: Of node ptr
+ * @v4l2_dev_str: V4L2 device structure
+ * @sensor_probe_addr_type: Sensor probe address type
+ * @sensor_probe_data_type: Sensor probe data type
+ * @i2c_data: Sensor I2C register settings
+ * @sensor_info: Sensor query cap structure
+ * @bridge_intf: Bridge interface structure
+ * @streamon_count: Count to hold the number of times stream on called
+ * @streamoff_count: Count to hold the number of times stream off called
+ * @bob_reg_index: Hold to BoB regulator index
+ * @bob_pwm_switch: Boolean flag to switch into PWM mode for BoB regulator
+ * @last_flush_req: Last request to flush
+ * @pipeline_delay: Sensor pipeline delay
+ */
+struct cam_sensor_ctrl_t {
+	char device_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
+	struct platform_device *pdev;
+	struct cam_hw_soc_info soc_info;
+	struct mutex cam_sensor_mutex;
+	struct cam_sensor_board_info *sensordata;
+	enum cci_i2c_master_t cci_i2c_master;
+	enum cci_device_num cci_num;
+	struct camera_io_master io_master_info;
+	enum cam_sensor_state_t sensor_state;
+	uint8_t is_probe_succeed;
+	uint8_t is_always_on;
+	uint32_t id;
+	struct device_node *of_node;
+	struct cam_subdev v4l2_dev_str;
+	uint8_t sensor_probe_addr_type;
+	uint8_t sensor_probe_data_type;
+	struct i2c_data_settings i2c_data;
+	struct  cam_sensor_query_cap sensor_info;
+	struct sensor_intf_params bridge_intf;
+	uint32_t streamon_count;
+	uint32_t streamoff_count;
+	int bob_reg_index;
+	bool bob_pwm_switch;
+	uint32_t last_flush_req;
+	uint16_t pipeline_delay;
+};
+
+/**
+ * @brief : API to remove SENSOR Hw from platform framework.
+ * @return: return 0 on success.
+ */
+int cam_sensor_i2c_driver_remove_common(struct i2c_client *client);
+
+/**
+ * @brief : API to register SENSOR hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_sensor_driver_init(void);
+
+/**
+ * @brief : API to remove SENSOR Hw from platform framework.
+ */
+void cam_sensor_driver_exit(void);
+
+#endif /* _CAM_SENSOR_DEV_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.c
@@ -0,0 +1,317 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <cam_sensor_cmn_header.h>
+#include <cam_sensor_util.h>
+#include <cam_sensor_io.h>
+#include <cam_req_mgr_util.h>
+#include "cam_sensor_soc.h"
+#include "cam_soc_util.h"
+
+static int32_t cam_sensor_get_sub_module_index(struct device_node *of_node,
+	struct cam_sensor_board_info *s_info)
+{
+	int rc = 0, i = 0;
+	uint32_t val = 0;
+	struct device_node *src_node = NULL;
+	struct cam_sensor_board_info *sensor_info;
+
+	sensor_info = s_info;
+
+	for (i = 0; i < SUB_MODULE_MAX; i++)
+		sensor_info->subdev_id[i] = -1;
+
+	src_node = of_parse_phandle(of_node, "actuator-src", 0);
+	if (!src_node) {
+		CAM_DBG(CAM_SENSOR, "src_node NULL");
+	} else {
+		rc = of_property_read_u32(src_node, "cell-index", &val);
+		CAM_DBG(CAM_SENSOR, "actuator cell index %d, rc %d", val, rc);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed %d", rc);
+			of_node_put(src_node);
+			return rc;
+		}
+		sensor_info->subdev_id[SUB_MODULE_ACTUATOR] = val;
+		of_node_put(src_node);
+	}
+
+	src_node = of_parse_phandle(of_node, "ois-src", 0);
+	if (!src_node) {
+		CAM_DBG(CAM_SENSOR, "src_node NULL");
+	} else {
+		rc = of_property_read_u32(src_node, "cell-index", &val);
+		CAM_DBG(CAM_SENSOR, " ois cell index %d, rc %d", val, rc);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed %d",  rc);
+			of_node_put(src_node);
+			return rc;
+		}
+		sensor_info->subdev_id[SUB_MODULE_OIS] = val;
+		of_node_put(src_node);
+	}
+
+	src_node = of_parse_phandle(of_node, "eeprom-src", 0);
+	if (!src_node) {
+		CAM_DBG(CAM_SENSOR, "eeprom src_node NULL");
+	} else {
+		rc = of_property_read_u32(src_node, "cell-index", &val);
+		CAM_DBG(CAM_SENSOR, "eeprom cell index %d, rc %d", val, rc);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed %d", rc);
+			of_node_put(src_node);
+			return rc;
+		}
+		sensor_info->subdev_id[SUB_MODULE_EEPROM] = val;
+		of_node_put(src_node);
+	}
+
+	src_node = of_parse_phandle(of_node, "led-flash-src", 0);
+	if (!src_node) {
+		CAM_DBG(CAM_SENSOR, " src_node NULL");
+	} else {
+		rc = of_property_read_u32(src_node, "cell-index", &val);
+		CAM_DBG(CAM_SENSOR, "led flash cell index %d, rc %d", val, rc);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed %d", rc);
+			of_node_put(src_node);
+			return rc;
+		}
+		sensor_info->subdev_id[SUB_MODULE_LED_FLASH] = val;
+		of_node_put(src_node);
+	}
+
+	rc = of_property_read_u32(of_node, "csiphy-sd-index", &val);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "paring the dt node for csiphy rc %d", rc);
+	else
+		sensor_info->subdev_id[SUB_MODULE_CSIPHY] = val;
+
+	src_node = of_parse_phandle(of_node, "ir-led-src", 0);
+	if (!src_node) {
+		CAM_DBG(CAM_SENSOR, "ir led src_node NULL");
+	} else {
+		rc = of_property_read_u32(src_node, "cell-index", &val);
+		CAM_DBG(CAM_SENSOR, "ir led cell index %d, rc %d", val, rc);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed %d", rc);
+			of_node_put(src_node);
+			return rc;
+		}
+		sensor_info->subdev_id[SUB_MODULE_IR_LED] = val;
+		of_node_put(src_node);
+	}
+
+	return rc;
+}
+
+static int32_t cam_sensor_driver_get_dt_data(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t rc = 0;
+	int i = 0;
+	struct cam_sensor_board_info *sensordata = NULL;
+	struct device_node *of_node = s_ctrl->of_node;
+	struct device_node *of_parent = NULL;
+	struct cam_hw_soc_info *soc_info = &s_ctrl->soc_info;
+
+	s_ctrl->sensordata = kzalloc(sizeof(*sensordata), GFP_KERNEL);
+	if (!s_ctrl->sensordata)
+		return -ENOMEM;
+
+	sensordata = s_ctrl->sensordata;
+
+	rc = cam_soc_util_get_dt_properties(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed to read DT properties rc %d", rc);
+		goto FREE_SENSOR_DATA;
+	}
+
+	rc =  cam_sensor_util_init_gpio_pin_tbl(soc_info,
+			&sensordata->power_info.gpio_num_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed to read gpios %d", rc);
+		goto FREE_SENSOR_DATA;
+	}
+
+	s_ctrl->id = soc_info->index;
+
+	/* Validate cell_id */
+	if (s_ctrl->id >= MAX_CAMERAS) {
+		CAM_ERR(CAM_SENSOR, "Failed invalid cell_id %d", s_ctrl->id);
+		rc = -EINVAL;
+		goto FREE_SENSOR_DATA;
+	}
+
+	/* Store the index of BoB regulator if it is available */
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		if (!strcmp(soc_info->rgltr_name[i],
+			"cam_bob")) {
+			CAM_DBG(CAM_SENSOR,
+				"i: %d cam_bob", i);
+			s_ctrl->bob_reg_index = i;
+			soc_info->rgltr[i] = devm_regulator_get(soc_info->dev,
+				soc_info->rgltr_name[i]);
+			if (IS_ERR_OR_NULL(soc_info->rgltr[i])) {
+				CAM_WARN(CAM_SENSOR,
+					"Regulator: %s get failed",
+					soc_info->rgltr_name[i]);
+				soc_info->rgltr[i] = NULL;
+			} else {
+				if (!of_property_read_bool(of_node,
+					"pwm-switch")) {
+					CAM_DBG(CAM_SENSOR,
+					"No BoB PWM switch param defined");
+					s_ctrl->bob_pwm_switch = false;
+				} else {
+					s_ctrl->bob_pwm_switch = true;
+				}
+			}
+		}
+	}
+
+	/* Read subdev info */
+	rc = cam_sensor_get_sub_module_index(of_node, sensordata);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed to get sub module index, rc=%d",
+			 rc);
+		goto FREE_SENSOR_DATA;
+	}
+
+	if (s_ctrl->io_master_info.master_type == CCI_MASTER) {
+		/* Get CCI master */
+		rc = of_property_read_u32(of_node, "cci-master",
+			&s_ctrl->cci_i2c_master);
+		CAM_DBG(CAM_SENSOR, "cci-master %d, rc %d",
+			s_ctrl->cci_i2c_master, rc);
+		if (rc < 0) {
+			/* Set default master 0 */
+			s_ctrl->cci_i2c_master = MASTER_0;
+			rc = 0;
+		}
+
+		of_parent = of_get_parent(of_node);
+		if (of_property_read_u32(of_parent, "cell-index",
+				&s_ctrl->cci_num) < 0)
+			/* Set default master 0 */
+			s_ctrl->cci_num = CCI_DEVICE_0;
+
+		CAM_DBG(CAM_SENSOR, "cci-index %d", s_ctrl->cci_num);
+	}
+
+	if (of_property_read_u32(of_node, "sensor-position-pitch",
+		&sensordata->pos_pitch) < 0) {
+		CAM_DBG(CAM_SENSOR, "Invalid sensor position");
+		sensordata->pos_pitch = 360;
+	}
+	if (of_property_read_u32(of_node, "sensor-position-roll",
+		&sensordata->pos_roll) < 0) {
+		CAM_DBG(CAM_SENSOR, "Invalid sensor position");
+		sensordata->pos_roll = 360;
+	}
+	if (of_property_read_u32(of_node, "sensor-position-yaw",
+		&sensordata->pos_yaw) < 0) {
+		CAM_DBG(CAM_SENSOR, "Invalid sensor position");
+		sensordata->pos_yaw = 360;
+	}
+
+	return rc;
+
+FREE_SENSOR_DATA:
+	kfree(sensordata);
+	return rc;
+}
+
+static int32_t msm_sensor_init_default_params(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	/* Validate input parameters */
+	if (!s_ctrl) {
+		CAM_ERR(CAM_SENSOR, "failed: invalid params s_ctrl %pK",
+			s_ctrl);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SENSOR,
+		"master_type: %d", s_ctrl->io_master_info.master_type);
+	/* Initialize cci_client */
+	if (s_ctrl->io_master_info.master_type == CCI_MASTER) {
+		s_ctrl->io_master_info.cci_client = kzalloc(sizeof(
+			struct cam_sensor_cci_client), GFP_KERNEL);
+		if (!(s_ctrl->io_master_info.cci_client))
+			return -ENOMEM;
+
+		s_ctrl->io_master_info.cci_client->cci_device
+			= s_ctrl->cci_num;
+	} else if (s_ctrl->io_master_info.master_type == I2C_MASTER) {
+		if (!(s_ctrl->io_master_info.client))
+			return -EINVAL;
+	} else {
+		CAM_ERR(CAM_SENSOR,
+			"Invalid master / Master type Not supported");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int32_t cam_sensor_parse_dt(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int32_t i, rc = 0;
+	struct cam_hw_soc_info *soc_info = &s_ctrl->soc_info;
+
+	/* Parse dt information and store in sensor control structure */
+	rc = cam_sensor_driver_get_dt_data(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed to get dt data rc %d", rc);
+		return rc;
+	}
+
+	/* Initialize mutex */
+	mutex_init(&(s_ctrl->cam_sensor_mutex));
+
+	/* Initialize default parameters */
+	for (i = 0; i < soc_info->num_clk; i++) {
+		soc_info->clk[i] = devm_clk_get(soc_info->dev,
+					soc_info->clk_name[i]);
+		if (!soc_info->clk[i]) {
+			CAM_ERR(CAM_SENSOR, "get failed for %s",
+				 soc_info->clk_name[i]);
+			rc = -ENOENT;
+			return rc;
+		}
+	}
+
+	rc = cam_sensor_util_regulator_powerup(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = cam_sensor_util_request_power_domain(soc_info);
+	if (rc < 0)
+		return rc;
+
+	rc = msm_sensor_init_default_params(s_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR,
+			"failed: msm_sensor_init_default_params rc %d", rc);
+		goto FREE_DT_DATA;
+	}
+
+	return rc;
+
+FREE_DT_DATA:
+	kfree(s_ctrl->sensordata);
+	s_ctrl->sensordata = NULL;
+
+	return rc;
+}
+
+void cam_sensor_release_power_domain(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	struct cam_hw_soc_info *soc_info = &s_ctrl->soc_info;
+
+	cam_sensor_util_release_power_domain(soc_info);
+}
\ No newline at end of file
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor/cam_sensor_soc.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_SOC_H_
+#define _CAM_SENSOR_SOC_H_
+
+#include "cam_sensor_dev.h"
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * Parses sensor dt
+ */
+int cam_sensor_parse_dt(struct cam_sensor_ctrl_t *s_ctrl);
+
+/**
+ * @s_ctrl: Sensor ctrl structure
+ *
+ * Release power domain
+ */
+void cam_sensor_release_power_domain(struct cam_sensor_ctrl_t *s_ctrl);
+
+#endif /* _CAM_SENSOR_SOC_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_cci_i2c.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_cci_i2c.c
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_sensor_cmn_header.h"
+#include "cam_sensor_i2c.h"
+#include "cam_cci_dev.h"
+
+int32_t cam_cci_i2c_read(struct cam_sensor_cci_client *cci_client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	int32_t rc = -EINVAL;
+	unsigned char buf[CAMERA_SENSOR_I2C_TYPE_DWORD];
+	struct cam_cci_ctrl cci_ctrl;
+
+	if (addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		return rc;
+
+	cci_ctrl.cmd = MSM_CCI_I2C_READ;
+	cci_ctrl.cci_info = cci_client;
+	cci_ctrl.cfg.cci_i2c_read_cfg.addr = addr;
+	cci_ctrl.cfg.cci_i2c_read_cfg.addr_type = addr_type;
+	cci_ctrl.cfg.cci_i2c_read_cfg.data_type = data_type;
+	cci_ctrl.cfg.cci_i2c_read_cfg.data = buf;
+	cci_ctrl.cfg.cci_i2c_read_cfg.num_byte = data_type;
+	rc = v4l2_subdev_call(cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "rc = %d", rc);
+		return rc;
+	}
+
+	rc = cci_ctrl.status;
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE)
+		*data = buf[0];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD)
+		*data = buf[0] << 8 | buf[1];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B)
+		*data = buf[0] << 16 | buf[1] << 8 | buf[2];
+	else
+		*data = buf[0] << 24 | buf[1] << 16 |
+			buf[2] << 8 | buf[3];
+
+	return rc;
+}
+
+int32_t cam_camera_cci_i2c_read_seq(struct cam_sensor_cci_client *cci_client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t num_byte)
+{
+	int32_t                    rc = -EFAULT;
+	unsigned char             *buf = NULL;
+	int                        i = 0;
+	struct cam_cci_ctrl        cci_ctrl;
+
+	if ((addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		|| (data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		|| (num_byte > I2C_REG_DATA_MAX)) {
+		CAM_ERR(CAM_SENSOR, "addr_type %d num_byte %d", addr_type,
+			num_byte);
+		return rc;
+	}
+
+	buf = kzalloc(num_byte, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	cci_ctrl.cmd = MSM_CCI_I2C_READ;
+	cci_ctrl.cci_info = cci_client;
+	cci_ctrl.cfg.cci_i2c_read_cfg.addr = addr;
+	cci_ctrl.cfg.cci_i2c_read_cfg.addr_type = addr_type;
+	cci_ctrl.cfg.cci_i2c_read_cfg.data_type = data_type;
+	cci_ctrl.cfg.cci_i2c_read_cfg.data = buf;
+	cci_ctrl.cfg.cci_i2c_read_cfg.num_byte = num_byte;
+	cci_ctrl.status = -EFAULT;
+	rc = v4l2_subdev_call(cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	rc = cci_ctrl.status;
+	CAM_DBG(CAM_SENSOR, "addr = 0x%x, rc = %d", addr, rc);
+	for (i = 0; i < num_byte; i++) {
+		data[i] = buf[i];
+		CAM_DBG(CAM_SENSOR, "Byte %d: Data: 0x%x\n", i, data[i]);
+	}
+	kfree(buf);
+	return rc;
+}
+
+static int32_t cam_cci_i2c_write_table_cmd(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	enum cam_cci_cmd_type cmd)
+{
+	int32_t rc = -EINVAL;
+	struct cam_cci_ctrl cci_ctrl;
+
+	if (!client || !write_setting)
+		return rc;
+
+	if (write_setting->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| write_setting->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		return rc;
+
+	cci_ctrl.cmd = cmd;
+	cci_ctrl.cci_info = client->cci_client;
+	cci_ctrl.cfg.cci_i2c_write_cfg.reg_setting =
+		write_setting->reg_setting;
+	cci_ctrl.cfg.cci_i2c_write_cfg.data_type = write_setting->data_type;
+	cci_ctrl.cfg.cci_i2c_write_cfg.addr_type = write_setting->addr_type;
+	cci_ctrl.cfg.cci_i2c_write_cfg.size = write_setting->size;
+	rc = v4l2_subdev_call(client->cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed rc = %d", rc);
+		return rc;
+	}
+	rc = cci_ctrl.status;
+	if (write_setting->delay > 20)
+		msleep(write_setting->delay);
+	else if (write_setting->delay)
+		usleep_range(write_setting->delay * 1000, (write_setting->delay
+			* 1000) + 1000);
+
+	return rc;
+}
+
+
+int32_t cam_cci_i2c_write_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	return cam_cci_i2c_write_table_cmd(client, write_setting,
+		MSM_CCI_I2C_WRITE);
+}
+
+int32_t cam_cci_i2c_write_continuous_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag)
+{
+	int32_t rc = 0;
+
+	if (cam_sensor_i2c_write_flag == 1)
+		rc = cam_cci_i2c_write_table_cmd(client, write_setting,
+			MSM_CCI_I2C_WRITE_BURST);
+	else if (cam_sensor_i2c_write_flag == 0)
+		rc = cam_cci_i2c_write_table_cmd(client, write_setting,
+			MSM_CCI_I2C_WRITE_SEQ);
+
+	return rc;
+}
+
+static int32_t cam_cci_i2c_compare(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type data_type,
+	enum camera_sensor_i2c_type addr_type)
+{
+	int32_t rc;
+	uint32_t reg_data = 0;
+
+	rc = cam_cci_i2c_read(client, addr, &reg_data,
+		addr_type, data_type);
+	if (rc < 0)
+		return rc;
+
+	reg_data = reg_data & 0xFFFF;
+	if (data == (reg_data & ~data_mask))
+		return I2C_COMPARE_MATCH;
+	return I2C_COMPARE_MISMATCH;
+}
+
+int32_t cam_cci_i2c_poll(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type data_type,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t delay_ms)
+{
+	int32_t rc = -EINVAL;
+	int32_t i = 0;
+
+	CAM_DBG(CAM_SENSOR, "addr: 0x%x data: 0x%x dt: %d",
+		addr, data, data_type);
+
+	if (delay_ms > MAX_POLL_DELAY_MS) {
+		CAM_ERR(CAM_SENSOR, "invalid delay = %d max_delay = %d",
+			delay_ms, MAX_POLL_DELAY_MS);
+		return -EINVAL;
+	}
+	for (i = 0; i < delay_ms; i++) {
+		rc = cam_cci_i2c_compare(client,
+			addr, data, data_mask, data_type, addr_type);
+		if (!rc)
+			return rc;
+
+		usleep_range(1000, 1010);
+	}
+
+	/* If rc is 1 then read is successful but poll is failure */
+	if (rc == 1)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d(non-fatal)",	rc);
+
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d", rc);
+
+	return rc;
+}
+
+int32_t cam_sensor_cci_i2c_util(struct cam_sensor_cci_client *cci_client,
+	uint16_t cci_cmd)
+{
+	int32_t rc = 0;
+	struct cam_cci_ctrl cci_ctrl;
+
+	cci_ctrl.cmd = cci_cmd;
+	cci_ctrl.cci_info = cci_client;
+	rc = v4l2_subdev_call(cci_client->cci_subdev,
+		core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "Failed rc = %d", rc);
+		return rc;
+	}
+	return cci_ctrl.status;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_i2c.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_i2c.h
@@ -0,0 +1,174 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_I2C_H_
+#define _CAM_SENSOR_I2C_H_
+
+#include <linux/delay.h>
+#include <media/v4l2-subdev.h>
+#include <media/cam_sensor.h>
+#include "cam_cci_dev.h"
+#include "cam_sensor_io.h"
+
+#define I2C_POLL_TIME_MS 5
+#define MAX_POLL_DELAY_MS 100
+
+#define I2C_COMPARE_MATCH 0
+#define I2C_COMPARE_MISMATCH 1
+
+#define I2C_REG_DATA_MAX (20*1024)
+
+/**
+ * @client: CCI client structure
+ * @data: I2C data
+ * @addr_type: I2c address type
+ * @data_type: I2C data type
+ *
+ * This API handles CCI read
+ */
+int32_t cam_cci_i2c_read(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type);
+
+/**
+ * @client: CCI client structure
+ * @addr: I2c address
+ * @data: I2C data
+ * @addr_type: I2c address type
+ * @data_type: I2c data type
+ * @num_byte: number of bytes
+ *
+ * This API handles CCI sequential read
+ */
+int32_t cam_camera_cci_i2c_read_seq(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t num_byte);
+
+/**
+ * @client: CCI client structure
+ * @write_setting: I2C register setting
+ *
+ * This API handles CCI random write
+ */
+int32_t cam_cci_i2c_write_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+/**
+ * @client: CCI client structure
+ * @write_setting: I2C register setting
+ * @cam_sensor_i2c_write_flag: burst or seq write
+ *
+ * This API handles CCI continuous write
+ */
+int32_t cam_cci_i2c_write_continuous_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag);
+
+/**
+ * @cci_client: CCI client structure
+ * @cci_cmd: CCI command type
+ *
+ * Does I2C call to I2C functionalities
+ */
+int32_t cam_sensor_cci_i2c_util(struct cam_sensor_cci_client *cci_client,
+	uint16_t cci_cmd);
+
+/**
+ * @client: CCI client structure
+ * @addr: I2C address
+ * @data: I2C data
+ * @data_mask: I2C data mask
+ * @data_type: I2C data type
+ * @addr_type: I2C addr type
+ * @delay_ms: Delay in milli seconds
+ *
+ * This API implements CCI based I2C poll
+ */
+int32_t cam_cci_i2c_poll(struct cam_sensor_cci_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type data_type,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t delay_ms);
+
+
+/**
+ * cam_qup_i2c_read : QUP based i2c read
+ * @client    : QUP I2C client structure
+ * @data      : I2C data
+ * @addr_type : I2c address type
+ * @data_type : I2C data type
+ *
+ * This API handles QUP I2C read
+ */
+
+int32_t cam_qup_i2c_read(struct i2c_client *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type);
+
+/**
+ * cam_qup_i2c_read_seq : QUP based I2C sequential read
+ * @client    : QUP I2C client structure
+ * @data      : I2C data
+ * @addr_type : I2c address type
+ * @num_bytes : number of bytes to read
+ * This API handles QUP I2C Sequential read
+ */
+
+int32_t cam_qup_i2c_read_seq(struct i2c_client *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte);
+
+/**
+ * cam_qup_i2c_poll : QUP based I2C poll operation
+ * @client    : QUP I2C client structure
+ * @addr      : I2C address
+ * @data      : I2C data
+ * @data_mask : I2C data mask
+ * @data_type : I2C data type
+ * @addr_type : I2C addr type
+ * @delay_ms  : Delay in milli seconds
+ *
+ * This API implements QUP based I2C poll
+ */
+
+int32_t cam_qup_i2c_poll(struct i2c_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms);
+
+/**
+ * cam_qup_i2c_write_table : QUP based I2C write random
+ * @client        : QUP I2C client structure
+ * @write_setting : I2C register settings
+ *
+ * This API handles QUP I2C random write
+ */
+
+int32_t cam_qup_i2c_write_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+/**
+ * cam_qup_i2c_write_continuous_write: QUP based I2C write continuous(Burst/Seq)
+ * @client: QUP I2C client structure
+ * @write_setting: I2C register setting
+ * @cam_sensor_i2c_write_flag: burst or seq write
+ *
+ * This API handles QUP continuous write
+ */
+int32_t cam_qup_i2c_write_continuous_table(
+	struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag);
+
+#endif /*_CAM_SENSOR_I2C_H*/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.c
@@ -0,0 +1,217 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_sensor_io.h"
+#include "cam_sensor_i2c.h"
+
+int32_t camera_io_dev_poll(struct camera_io_master *io_master_info,
+	uint32_t addr, uint16_t data, uint32_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms)
+{
+	int16_t mask = data_mask & 0xFF;
+
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (io_master_info->master_type == CCI_MASTER) {
+		return cam_cci_i2c_poll(io_master_info->cci_client,
+			addr, data, mask, data_type, addr_type, delay_ms);
+	} else if (io_master_info->master_type == I2C_MASTER) {
+		return cam_qup_i2c_poll(io_master_info->client,
+			addr, data, data_mask, addr_type, data_type,
+			delay_ms);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid Comm. Master:%d",
+			io_master_info->master_type);
+		return -EINVAL;
+	}
+}
+
+int32_t camera_io_dev_erase(struct camera_io_master *io_master_info,
+	uint32_t addr, uint32_t size)
+{
+	int rc = 0;
+
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (size == 0)
+		return rc;
+
+	if (io_master_info->master_type == SPI_MASTER) {
+		CAM_DBG(CAM_SENSOR, "Calling SPI Erase");
+		return cam_spi_erase(io_master_info, addr,
+			CAMERA_SENSOR_I2C_TYPE_WORD, size);
+	} else if (io_master_info->master_type == I2C_MASTER ||
+		io_master_info->master_type == CCI_MASTER) {
+		CAM_ERR(CAM_SENSOR, "Erase not supported on master :%d",
+			io_master_info->master_type);
+		rc = -EINVAL;
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid Comm. Master:%d",
+			io_master_info->master_type);
+		rc = -EINVAL;
+	}
+	return rc;
+}
+
+int32_t camera_io_dev_read(struct camera_io_master *io_master_info,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (io_master_info->master_type == CCI_MASTER) {
+		return cam_cci_i2c_read(io_master_info->cci_client,
+			addr, data, addr_type, data_type);
+	} else if (io_master_info->master_type == I2C_MASTER) {
+		return cam_qup_i2c_read(io_master_info->client,
+			addr, data, addr_type, data_type);
+	} else if (io_master_info->master_type == SPI_MASTER) {
+		return cam_spi_read(io_master_info,
+			addr, data, addr_type, data_type);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid Comm. Master:%d",
+			io_master_info->master_type);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int32_t camera_io_dev_read_seq(struct camera_io_master *io_master_info,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type, int32_t num_bytes)
+{
+	if (io_master_info->master_type == CCI_MASTER) {
+		return cam_camera_cci_i2c_read_seq(io_master_info->cci_client,
+			addr, data, addr_type, data_type, num_bytes);
+	} else if (io_master_info->master_type == I2C_MASTER) {
+		return cam_qup_i2c_read_seq(io_master_info->client,
+			addr, data, addr_type, num_bytes);
+	} else if (io_master_info->master_type == SPI_MASTER) {
+		return cam_spi_read_seq(io_master_info,
+			addr, data, addr_type, num_bytes);
+	} else if (io_master_info->master_type == SPI_MASTER) {
+		return cam_spi_write_seq(io_master_info,
+			addr, data, addr_type, num_bytes);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid Comm. Master:%d",
+			io_master_info->master_type);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int32_t camera_io_dev_write(struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	if (!write_setting || !io_master_info) {
+		CAM_ERR(CAM_SENSOR,
+			"Input parameters not valid ws: %pK ioinfo: %pK",
+			write_setting, io_master_info);
+		return -EINVAL;
+	}
+
+	if (!write_setting->reg_setting) {
+		CAM_ERR(CAM_SENSOR, "Invalid Register Settings");
+		return -EINVAL;
+	}
+
+	if (io_master_info->master_type == CCI_MASTER) {
+		return cam_cci_i2c_write_table(io_master_info,
+			write_setting);
+	} else if (io_master_info->master_type == I2C_MASTER) {
+		return cam_qup_i2c_write_table(io_master_info,
+			write_setting);
+	} else if (io_master_info->master_type == SPI_MASTER) {
+		return cam_spi_write_table(io_master_info,
+			write_setting);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid Comm. Master:%d",
+			io_master_info->master_type);
+		return -EINVAL;
+	}
+}
+
+int32_t camera_io_dev_write_continuous(struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag)
+{
+	if (!write_setting || !io_master_info) {
+		CAM_ERR(CAM_SENSOR,
+			"Input parameters not valid ws: %pK ioinfo: %pK",
+			write_setting, io_master_info);
+		return -EINVAL;
+	}
+
+	if (!write_setting->reg_setting) {
+		CAM_ERR(CAM_SENSOR, "Invalid Register Settings");
+		return -EINVAL;
+	}
+
+	if (io_master_info->master_type == CCI_MASTER) {
+		return cam_cci_i2c_write_continuous_table(io_master_info,
+			write_setting, cam_sensor_i2c_write_flag);
+	} else if (io_master_info->master_type == I2C_MASTER) {
+		return cam_qup_i2c_write_continuous_table(io_master_info,
+			write_setting, cam_sensor_i2c_write_flag);
+	} else if (io_master_info->master_type == SPI_MASTER) {
+		return cam_spi_write_table(io_master_info,
+			write_setting);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid Comm. Master:%d",
+			io_master_info->master_type);
+		return -EINVAL;
+	}
+}
+
+int32_t camera_io_init(struct camera_io_master *io_master_info)
+{
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (io_master_info->master_type == CCI_MASTER) {
+		io_master_info->cci_client->cci_subdev =
+		cam_cci_get_subdev(io_master_info->cci_client->cci_device);
+		return cam_sensor_cci_i2c_util(io_master_info->cci_client,
+			MSM_CCI_INIT);
+	} else if ((io_master_info->master_type == I2C_MASTER) ||
+			(io_master_info->master_type == SPI_MASTER)) {
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+int32_t camera_io_release(struct camera_io_master *io_master_info)
+{
+	if (!io_master_info) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args");
+		return -EINVAL;
+	}
+
+	if (io_master_info->master_type == CCI_MASTER) {
+		return cam_sensor_cci_i2c_util(io_master_info->cci_client,
+			MSM_CCI_RELEASE);
+	} else if ((io_master_info->master_type == I2C_MASTER) ||
+			(io_master_info->master_type == SPI_MASTER)) {
+		return 0;
+	}
+
+	return -EINVAL;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_io.h
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_IO_H_
+#define _CAM_SENSOR_IO_H_
+
+#include <media/cam_sensor.h>
+
+#include "cam_sensor_cmn_header.h"
+
+#define CCI_MASTER 1
+#define I2C_MASTER 2
+#define SPI_MASTER 3
+
+/**
+ * @master_type: CCI master type
+ * @client: I2C client information structure
+ * @cci_client: CCI client information structure
+ * @spi_client: SPI client information structure
+ */
+struct camera_io_master {
+	int master_type;
+	struct i2c_client *client;
+	struct cam_sensor_cci_client *cci_client;
+	struct cam_sensor_spi_client *spi_client;
+};
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @addr: I2C address
+ * @data: I2C data
+ * @addr_type: I2C addr_type
+ * @data_type: I2C data type
+ *
+ * This API abstracts read functionality based on master type
+ */
+int32_t camera_io_dev_read(struct camera_io_master *io_master_info,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @addr: I2C address
+ * @data: I2C data
+ * @addr_type: I2C addr type
+ * @data_type: I2C data type
+ * @num_bytes: number of bytes
+ *
+ * This API abstracts read functionality based on master type
+ */
+int32_t camera_io_dev_read_seq(struct camera_io_master *io_master_info,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	int32_t num_bytes);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ *
+ * This API initializes the I2C/SPI master based on master type
+ */
+int32_t camera_io_init(struct camera_io_master *io_master_info);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ *
+ * This API releases the I2C/SPI master based on master type
+ */
+int32_t camera_io_release(struct camera_io_master *io_master_info);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @write_setting: write settings information
+ *
+ * This API abstracts write functionality based on master type
+ */
+int32_t camera_io_dev_write(struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+/**
+ * @io_master_info: I2C/SPI master information
+ * @write_setting: write settings information
+ * @cam_sensor_i2c_write_flag: differentiate between burst & seq
+ *
+ * This API abstracts write functionality based on master type and
+ * write flag for continuous write
+ */
+int32_t camera_io_dev_write_continuous(struct camera_io_master *io_master_info,
+	struct cam_sensor_i2c_reg_setting *write_setting,
+	uint8_t cam_sensor_i2c_write_flag);
+
+int32_t camera_io_dev_erase(struct camera_io_master *io_master_info,
+	uint32_t addr, uint32_t size);
+/**
+ * @io_master_info: I2C/SPI master information
+ * @addr: I2C address
+ * @data: I2C data
+ * @data_mask: I2C data mask
+ * @data_type: I2C data type
+ * @addr_type: I2C address type
+ * @delay_ms: delay in milli seconds
+ *
+ * This API abstracts poll functionality based on master type
+ */
+int32_t camera_io_dev_poll(struct camera_io_master *io_master_info,
+	uint32_t addr, uint16_t data, uint32_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms);
+
+#include "cam_sensor_i2c.h"
+#include "cam_sensor_spi.h"
+#endif /* _CAM_SENSOR_IO_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_qup_i2c.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_qup_i2c.c
@@ -0,0 +1,539 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_sensor_cmn_header.h"
+#include "cam_sensor_i2c.h"
+#include "cam_sensor_io.h"
+
+#define I2C_REG_MAX_BUF_SIZE   8
+
+static int32_t cam_qup_i2c_rxdata(
+	struct i2c_client *dev_client, unsigned char *rxdata,
+	enum camera_sensor_i2c_type addr_type,
+	int data_length)
+{
+	int32_t rc = 0;
+	uint16_t saddr = dev_client->addr >> 1;
+	struct i2c_msg msgs[] = {
+		{
+			.addr  = saddr,
+			.flags = 0,
+			.len   = addr_type,
+			.buf   = rxdata,
+		},
+		{
+			.addr  = saddr,
+			.flags = I2C_M_RD,
+			.len   = data_length,
+			.buf   = rxdata,
+		},
+	};
+	rc = i2c_transfer(dev_client->adapter, msgs, 2);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed 0x%x", saddr);
+		return rc;
+	}
+	/* Returns negative errno */
+	/* else the number of messages executed. */
+	/* So positive values are not errors. */
+	return 0;
+}
+
+
+static int32_t cam_qup_i2c_txdata(
+	struct camera_io_master *dev_client, unsigned char *txdata,
+	int length)
+{
+	int32_t rc = 0;
+	uint16_t saddr = dev_client->client->addr >> 1;
+	struct i2c_msg msg[] = {
+		{
+			.addr = saddr,
+			.flags = 0,
+			.len = length,
+			.buf = txdata,
+		 },
+	};
+	rc = i2c_transfer(dev_client->client->adapter, msg, 1);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed 0x%x", saddr);
+		return rc;
+	}
+	/* Returns negative errno, */
+	/* else the number of messages executed. */
+	/* So positive values are not errors. */
+	return 0;
+}
+
+int32_t cam_qup_i2c_read(struct i2c_client *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	int32_t rc = -EINVAL;
+	unsigned char *buf = NULL;
+
+	if (addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| data_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr/data_type verfication");
+		return rc;
+	}
+
+	buf = kzalloc(addr_type + data_type, GFP_KERNEL);
+
+	if (!buf)
+		return -ENOMEM;
+
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = addr >> 8;
+		buf[1] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = addr >> 16;
+		buf[1] = addr >> 8;
+		buf[2] = addr;
+	} else {
+		buf[0] = addr >> 24;
+		buf[1] = addr >> 16;
+		buf[2] = addr >> 8;
+		buf[3] = addr;
+	}
+
+	rc = cam_qup_i2c_rxdata(client, buf, addr_type, data_type);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+		goto read_fail;
+	}
+
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE)
+		*data = buf[0];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD)
+		*data = buf[0] << 8 | buf[1];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B)
+		*data = buf[0] << 16 | buf[1] << 8 | buf[2];
+	else
+		*data = buf[0] << 24 | buf[1] << 16 |
+			buf[2] << 8 | buf[3];
+
+	CAM_DBG(CAM_SENSOR, "addr = 0x%x data: 0x%x", addr, *data);
+read_fail:
+	kfree(buf);
+	buf = NULL;
+	return rc;
+}
+
+int32_t cam_qup_i2c_read_seq(struct i2c_client *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte)
+{
+	int32_t rc = -EFAULT;
+	unsigned char *buf = NULL;
+	int i;
+
+	if (addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr_type verification");
+		return rc;
+	}
+
+	if ((num_byte == 0) || (num_byte > I2C_REG_DATA_MAX)) {
+		CAM_ERR(CAM_SENSOR, "num_byte:0x%x max supported:0x%x",
+			num_byte, I2C_REG_DATA_MAX);
+		return rc;
+	}
+
+	buf = kzalloc(addr_type + num_byte, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = addr >> BITS_PER_BYTE;
+		buf[1] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = addr >> 16;
+		buf[1] = addr >> 8;
+		buf[2] = addr;
+	} else {
+		buf[0] = addr >> 24;
+		buf[1] = addr >> 16;
+		buf[2] = addr >> 8;
+		buf[3] = addr;
+	}
+
+	rc = cam_qup_i2c_rxdata(client, buf, addr_type, num_byte);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+		goto read_seq_fail;
+	}
+
+	for (i = 0; i < num_byte; i++)
+		data[i] = buf[i];
+
+read_seq_fail:
+	kfree(buf);
+	buf = NULL;
+	return rc;
+}
+
+static int32_t cam_qup_i2c_compare(struct i2c_client *client,
+	uint32_t addr, uint32_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type data_type,
+	enum camera_sensor_i2c_type addr_type)
+{
+	int32_t rc;
+	uint32_t reg_data = 0;
+
+	rc = cam_qup_i2c_read(client, addr, &reg_data,
+		addr_type, data_type);
+	if (rc < 0)
+		return rc;
+
+	reg_data = reg_data & 0xFFFF;
+	if (data != (reg_data & ~data_mask))
+		return I2C_COMPARE_MISMATCH;
+
+	return I2C_COMPARE_MATCH;
+}
+
+int32_t cam_qup_i2c_poll(struct i2c_client *client,
+	uint32_t addr, uint16_t data, uint16_t data_mask,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type,
+	uint32_t delay_ms)
+{
+	int32_t rc = 0;
+	int i = 0;
+
+	if ((delay_ms > MAX_POLL_DELAY_MS) || (delay_ms == 0)) {
+		CAM_ERR(CAM_SENSOR, "invalid delay = %d max_delay = %d",
+			delay_ms, MAX_POLL_DELAY_MS);
+		return -EINVAL;
+	}
+
+	if ((addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| data_type >= CAMERA_SENSOR_I2C_TYPE_MAX))
+		return -EINVAL;
+
+	for (i = 0; i < delay_ms; i++) {
+		rc = cam_qup_i2c_compare(client,
+			addr, data, data_mask, data_type, addr_type);
+		if (rc == I2C_COMPARE_MATCH)
+			return rc;
+
+		usleep_range(1000, 1010);
+	}
+	/* If rc is MISMATCH then read is successful but poll is failure */
+	if (rc == I2C_COMPARE_MISMATCH)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d(non-fatal)", rc);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "poll failed rc=%d", rc);
+
+	return rc;
+}
+
+static int32_t cam_qup_i2c_write(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_array *reg_setting,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	int32_t rc = 0;
+	unsigned char *buf = NULL;
+	uint8_t len = 0;
+
+	buf = kzalloc(I2C_REG_MAX_BUF_SIZE, GFP_KERNEL | GFP_DMA);
+	if (!buf) {
+		CAM_ERR(CAM_SENSOR, "Buffer memory allocation failed");
+		return -ENOMEM;
+	}
+
+	CAM_DBG(CAM_SENSOR, "reg addr = 0x%x data type: %d",
+			reg_setting->reg_addr, data_type);
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = reg_setting->reg_addr;
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[len]);
+		len = 1;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = reg_setting->reg_addr >> 8;
+		buf[1] = reg_setting->reg_addr;
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[len]);
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len+1, buf[len+1]);
+		len = 2;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = reg_setting->reg_addr >> 16;
+		buf[1] = reg_setting->reg_addr >> 8;
+		buf[2] = reg_setting->reg_addr;
+		len = 3;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+		buf[0] = reg_setting->reg_addr >> 24;
+		buf[1] = reg_setting->reg_addr >> 16;
+		buf[2] = reg_setting->reg_addr >> 8;
+		buf[3] = reg_setting->reg_addr;
+		len = 4;
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid I2C addr type");
+		rc = -EINVAL;
+		goto deallocate_buffer;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Data: 0x%x", reg_setting->reg_data);
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[len] = reg_setting->reg_data;
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[len]);
+		len += 1;
+	} else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[len] = reg_setting->reg_data >> 8;
+		buf[len+1] = reg_setting->reg_data;
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[len]);
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+1, buf[len+1]);
+		len += 2;
+	} else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[len] = reg_setting->reg_data >> 16;
+		buf[len + 1] = reg_setting->reg_data >> 8;
+		buf[len + 2] = reg_setting->reg_data;
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[len]);
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+1, buf[len+1]);
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+2, buf[len+2]);
+		len += 3;
+	} else if (data_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+		buf[len] = reg_setting->reg_data >> 24;
+		buf[len + 1] = reg_setting->reg_data >> 16;
+		buf[len + 2] = reg_setting->reg_data >> 8;
+		buf[len + 3] = reg_setting->reg_data;
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len, buf[len]);
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+1, buf[len+1]);
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+2, buf[len+2]);
+		CAM_DBG(CAM_SENSOR, "Byte %d: 0x%x", len+3, buf[len+3]);
+		len += 4;
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid Data Type");
+		rc = -EINVAL;
+		goto deallocate_buffer;
+	}
+
+	rc = cam_qup_i2c_txdata(client, buf, len);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+
+deallocate_buffer:
+	kfree(buf);
+	return rc;
+}
+
+int32_t cam_qup_i2c_write_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	int i;
+	int32_t rc = -EINVAL;
+	struct cam_sensor_i2c_reg_array *reg_setting;
+
+	if (!client || !write_setting)
+		return rc;
+
+	if ((write_setting->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| (write_setting->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_setting->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)))
+		return rc;
+
+	reg_setting = write_setting->reg_setting;
+
+	for (i = 0; i < write_setting->size; i++) {
+		CAM_DBG(CAM_SENSOR, "addr 0x%x data 0x%x",
+			reg_setting->reg_addr, reg_setting->reg_data);
+
+		rc = cam_qup_i2c_write(client, reg_setting,
+			write_setting->addr_type, write_setting->data_type);
+		if (rc < 0)
+			break;
+		reg_setting++;
+	}
+
+	if (write_setting->delay > 20)
+		msleep(write_setting->delay);
+	else if (write_setting->delay)
+		usleep_range(write_setting->delay * 1000, (write_setting->delay
+			* 1000) + 1000);
+
+	return rc;
+}
+
+static int32_t cam_qup_i2c_write_seq(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	int i;
+	int32_t rc = 0;
+	struct cam_sensor_i2c_reg_array *reg_setting;
+
+	reg_setting = write_setting->reg_setting;
+
+	for (i = 0; i < write_setting->size; i++) {
+		reg_setting->reg_addr += i;
+		rc = cam_qup_i2c_write(client, reg_setting,
+			write_setting->addr_type, write_setting->data_type);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Sequential i2c write failed: rc: %d", rc);
+			break;
+		}
+		reg_setting++;
+	}
+
+	if (write_setting->delay > 20)
+		msleep(write_setting->delay);
+	else if (write_setting->delay)
+		usleep_range(write_setting->delay * 1000, (write_setting->delay
+			* 1000) + 1000);
+
+	return rc;
+}
+
+static int32_t cam_qup_i2c_write_burst(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	int i;
+	int32_t rc = 0;
+	uint32_t len = 0;
+	unsigned char *buf = NULL;
+	struct cam_sensor_i2c_reg_array *reg_setting;
+	enum camera_sensor_i2c_type addr_type;
+	enum camera_sensor_i2c_type data_type;
+
+	buf = kzalloc((write_setting->addr_type +
+			(write_setting->size * write_setting->data_type)),
+			GFP_KERNEL);
+
+	if (!buf) {
+		CAM_ERR(CAM_SENSOR, "BUF is NULL");
+		return -ENOMEM;
+	}
+
+	reg_setting = write_setting->reg_setting;
+	addr_type = write_setting->addr_type;
+	data_type = write_setting->data_type;
+
+	CAM_DBG(CAM_SENSOR, "reg addr = 0x%x data type: %d",
+			reg_setting->reg_addr, data_type);
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = reg_setting->reg_addr;
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[len]);
+		len = 1;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = reg_setting->reg_addr >> 8;
+		buf[1] = reg_setting->reg_addr;
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len, buf[len]);
+		CAM_DBG(CAM_SENSOR, "byte %d: 0x%x", len+1, buf[len+1]);
+		len = 2;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = reg_setting->reg_addr >> 16;
+		buf[1] = reg_setting->reg_addr >> 8;
+		buf[2] = reg_setting->reg_addr;
+		len = 3;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+		buf[0] = reg_setting->reg_addr >> 24;
+		buf[1] = reg_setting->reg_addr >> 16;
+		buf[2] = reg_setting->reg_addr >> 8;
+		buf[3] = reg_setting->reg_addr;
+		len = 4;
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid I2C addr type");
+		rc = -EINVAL;
+		goto free_res;
+	}
+
+	for (i = 0; i < write_setting->size; i++) {
+		if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+			buf[len] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			len += 1;
+		} else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+			buf[len] = reg_setting->reg_data >> 8;
+			buf[len+1] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+1, buf[len+1]);
+			len += 2;
+		} else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+			buf[len] = reg_setting->reg_data >> 16;
+			buf[len + 1] = reg_setting->reg_data >> 8;
+			buf[len + 2] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+1, buf[len+1]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+2, buf[len+2]);
+			len += 3;
+		} else if (data_type == CAMERA_SENSOR_I2C_TYPE_DWORD) {
+			buf[len] = reg_setting->reg_data >> 24;
+			buf[len + 1] = reg_setting->reg_data >> 16;
+			buf[len + 2] = reg_setting->reg_data >> 8;
+			buf[len + 3] = reg_setting->reg_data;
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len, buf[len]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+1, buf[len+1]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+2, buf[len+2]);
+			CAM_DBG(CAM_SENSOR,
+				"Byte %d: 0x%x", len+3, buf[len+3]);
+			len += 4;
+		} else {
+			CAM_ERR(CAM_SENSOR, "Invalid Data Type");
+			rc = -EINVAL;
+			goto free_res;
+		}
+		reg_setting++;
+	}
+
+	if (len > (write_setting->addr_type +
+		(write_setting->size * write_setting->data_type))) {
+		CAM_ERR(CAM_SENSOR, "Invalid Length: %u | Expected length: %u",
+			len, (write_setting->addr_type +
+			(write_setting->size * write_setting->data_type)));
+		rc = -EINVAL;
+		goto free_res;
+	}
+
+	rc = cam_qup_i2c_txdata(client, buf, len);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "failed rc: %d", rc);
+
+free_res:
+	kfree(buf);
+	return rc;
+}
+
+int32_t cam_qup_i2c_write_continuous_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_settings,
+	uint8_t cam_sensor_i2c_write_flag)
+{
+	int32_t rc = 0;
+
+	if (!client || !write_settings)
+		return -EINVAL;
+
+	if ((write_settings->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_settings->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| (write_settings->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| write_settings->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX)))
+		return -EINVAL;
+
+	if (cam_sensor_i2c_write_flag == CAM_SENSOR_I2C_WRITE_BURST)
+		rc = cam_qup_i2c_write_burst(client, write_settings);
+	else if (cam_sensor_i2c_write_flag == CAM_SENSOR_I2C_WRITE_SEQ)
+		rc = cam_qup_i2c_write_seq(client, write_settings);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.c
@@ -0,0 +1,622 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_sensor_spi.h"
+#include "cam_debug_util.h"
+
+static int cam_spi_txfr(struct spi_device *spi, char *txbuf,
+	char *rxbuf, int num_byte)
+{
+	struct spi_transfer txfr;
+	struct spi_message msg;
+
+	memset(&txfr, 0, sizeof(txfr));
+	txfr.tx_buf = txbuf;
+	txfr.rx_buf = rxbuf;
+	txfr.len = num_byte;
+	spi_message_init(&msg);
+	spi_message_add_tail(&txfr, &msg);
+
+	return spi_sync(spi, &msg);
+}
+
+static int cam_spi_txfr_read(struct spi_device *spi, char *txbuf,
+	char *rxbuf, int txlen, int rxlen)
+{
+	struct spi_transfer tx;
+	struct spi_transfer rx;
+	struct spi_message m;
+
+	memset(&tx, 0, sizeof(tx));
+	memset(&rx, 0, sizeof(rx));
+	tx.tx_buf = txbuf;
+	rx.rx_buf = rxbuf;
+	tx.len = txlen;
+	rx.len = rxlen;
+	spi_message_init(&m);
+	spi_message_add_tail(&tx, &m);
+	spi_message_add_tail(&rx, &m);
+	return spi_sync(spi, &m);
+}
+
+/**
+ * cam_set_addr() - helper function to set transfer address
+ * @addr:	device address
+ * @addr_len:	the addr field length of an instruction
+ * @type:	type (i.e. byte-length) of @addr
+ * @str:	shifted address output, must be zeroed when passed in
+ *
+ * This helper function sets @str based on the addr field length of an
+ * instruction and the data length.
+ */
+static void cam_set_addr(uint32_t addr, uint8_t addr_len,
+	enum camera_sensor_i2c_type addr_type,
+	char *str)
+{
+	if (!addr_len)
+		return;
+
+	if (addr_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		str[0] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		str[0] = addr >> 8;
+		str[1] = addr;
+	} else if (addr_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		str[0] = addr >> 16;
+		str[1] = addr >> 8;
+		str[2] = addr;
+	} else {
+		str[0] = addr >> 24;
+		str[1] = addr >> 16;
+		str[2] = addr >> 8;
+		str[3] = addr;
+	}
+}
+
+/**
+ * cam_spi_tx_helper() - wrapper for SPI transaction
+ * @client:     io client
+ * @inst:       inst of this transaction
+ * @addr:       device addr following the inst
+ * @data:       output byte array (could be NULL)
+ * @num_byte:   size of @data
+ * @tx, rx:     optional transfer buffer.  It must be at least header
+ *              + @num_byte long.
+ *
+ * This is the core function for SPI transaction, except for writes.  It first
+ * checks address type, then allocates required memory for tx/rx buffers.
+ * It sends out <opcode><addr>, and optionally receives @num_byte of response,
+ * if @data is not NULL.  This function does not check for wait conditions,
+ * and will return immediately once bus transaction finishes.
+ *
+ * This function will allocate buffers of header + @num_byte long.  For
+ * large transfers, the allocation could fail.  External buffer @tx, @rx
+ * should be passed in to bypass allocation.  The size of buffer should be
+ * at least header + num_byte long.  Since buffer is managed externally,
+ * @data will be ignored, and read results will be in @rx.
+ * @tx, @rx also can be used for repeated transfers to improve performance.
+ */
+static int32_t cam_spi_tx_helper(struct camera_io_master *client,
+	struct cam_camera_spi_inst *inst, uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte, char *tx, char *rx)
+{
+	int32_t rc = -EINVAL;
+	struct spi_device *spi = client->spi_client->spi_master;
+	struct device *dev = NULL;
+	char *ctx = NULL, *crx = NULL;
+	uint32_t len, hlen;
+	uint8_t retries = client->spi_client->retries;
+	uint32_t txr = 0, rxr = 0;
+	void  *vaddr_tx = NULL;
+	void  *vaddr_rx = NULL;
+
+	hlen = cam_camera_spi_get_hlen(inst);
+	len = hlen + num_byte;
+	dev = &(spi->dev);
+
+	if (!dev) {
+		CAM_ERR(CAM_SENSOR, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (tx) {
+		ctx = tx;
+	} else {
+		txr = len;
+		vaddr_tx = vmalloc(txr);
+		if (!vaddr_tx) {
+			CAM_ERR(CAM_SENSOR,
+				 "Fail to allocate Memory: len: %u", txr);
+			return -ENOMEM;
+		}
+
+		ctx = (char *)vaddr_tx;
+	}
+
+	if (num_byte) {
+		if (rx) {
+			crx = rx;
+		} else {
+			rxr = len;
+			vaddr_rx = vmalloc(rxr);
+			if (!vaddr_rx) {
+				if (!tx)
+					vfree(vaddr_tx);
+				CAM_ERR(CAM_SENSOR,
+					"Fail to allocate memory: len: %u",
+					rxr);
+				return -ENOMEM;
+			}
+			crx = (char *)vaddr_rx;
+		}
+	} else {
+		crx = NULL;
+	}
+
+	ctx[0] = inst->opcode;
+	cam_set_addr(addr, inst->addr_len, addr_type, ctx + 1);
+	while ((rc = cam_spi_txfr(spi, ctx, crx, len)) && retries) {
+		retries--;
+		msleep(client->spi_client->retry_delay);
+	}
+	if (rc < 0) {
+		CAM_ERR(CAM_EEPROM, "failed: spi txfr rc %d", rc);
+		goto out;
+	}
+	if (data && num_byte && !rx)
+		memcpy(data, crx + hlen, num_byte);
+
+out:
+	if (!tx) {
+		vfree(vaddr_tx);
+		vaddr_tx = NULL;
+	}
+	if (!rx) {
+		vfree(vaddr_rx);
+		vaddr_rx = NULL;
+	}
+	return rc;
+}
+
+static int32_t cam_spi_tx_read(struct camera_io_master *client,
+	struct cam_camera_spi_inst *inst, uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint32_t num_byte, char *tx, char *rx)
+{
+	int32_t rc = -EINVAL;
+	struct spi_device *spi = client->spi_client->spi_master;
+	char *ctx = NULL, *crx = NULL;
+	uint32_t hlen;
+	uint8_t retries = client->spi_client->retries;
+
+	hlen = cam_camera_spi_get_hlen(inst);
+	if (tx) {
+		ctx = tx;
+	} else {
+		ctx = kzalloc(hlen, GFP_KERNEL | GFP_DMA);
+		if (!ctx)
+			return -ENOMEM;
+	}
+	if (num_byte) {
+		if (rx) {
+			crx = rx;
+		} else {
+			crx = kzalloc(num_byte, GFP_KERNEL | GFP_DMA);
+			if (!crx) {
+				if (!tx)
+					kfree(ctx);
+				return -ENOMEM;
+			}
+		}
+	} else {
+		crx = NULL;
+	}
+
+	ctx[0] = inst->opcode;
+	cam_set_addr(addr, inst->addr_len, addr_type, ctx + 1);
+
+	CAM_DBG(CAM_EEPROM, "tx(%u): %02x %02x %02x %02x", hlen, ctx[0],
+		ctx[1], ctx[2],	ctx[3]);
+	while ((rc = cam_spi_txfr_read(spi, ctx, crx, hlen, num_byte))
+			&& retries) {
+		retries--;
+		msleep(client->spi_client->retry_delay);
+	}
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed %d", rc);
+		goto out;
+	}
+	if (data && num_byte && !rx)
+		memcpy(data, crx, num_byte);
+out:
+	if (!tx)
+		kfree(ctx);
+	if (!rx)
+		kfree(crx);
+	return rc;
+}
+
+int cam_spi_read(struct camera_io_master *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	int rc = -EINVAL;
+	uint8_t temp[CAMERA_SENSOR_I2C_TYPE_MAX];
+
+	if (addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX
+		|| data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID
+		|| data_type >= CAMERA_SENSOR_I2C_TYPE_MAX) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr/data_type verification");
+		return rc;
+	}
+
+	rc = cam_spi_tx_read(client,
+		&client->spi_client->cmd_tbl.read, addr, &temp[0],
+		addr_type, data_type, NULL, NULL);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed %d", rc);
+		return rc;
+	}
+
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE)
+		*data = temp[0];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD)
+		*data = (temp[0] << BITS_PER_BYTE) | temp[1];
+	else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B)
+		*data = (temp[0] << 16 | temp[1] << 8 | temp[2]);
+	else
+		*data = (temp[0] << 24 | temp[1] << 16 | temp[2] << 8 |
+			temp[3]);
+
+	CAM_DBG(CAM_SENSOR, "addr 0x%x, data %u", addr, *data);
+	return rc;
+}
+
+int32_t cam_spi_read_seq(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type, int32_t num_bytes)
+{
+	if ((addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX)) {
+		CAM_ERR(CAM_SENSOR, "Failed with addr_type verification");
+		return -EINVAL;
+	}
+
+	if (num_bytes == 0) {
+		CAM_ERR(CAM_SENSOR, "num_byte: 0x%x", num_bytes);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Read Seq addr: 0x%x NB:%d",
+		addr, num_bytes);
+	return cam_spi_tx_helper(client,
+		&client->spi_client->cmd_tbl.read_seq, addr, data,
+		addr_type, num_bytes, NULL, NULL);
+}
+
+int cam_spi_query_id(struct camera_io_master *client,
+	uint32_t addr, enum camera_sensor_i2c_type addr_type,
+	uint8_t *data, uint32_t num_byte)
+{
+	CAM_DBG(CAM_SENSOR, "SPI Queryid : 0x%x, addr: 0x%x",
+		client->spi_client->cmd_tbl.query_id, addr);
+	return cam_spi_tx_helper(client,
+		&client->spi_client->cmd_tbl.query_id,
+		addr, data, addr_type, num_byte, NULL, NULL);
+}
+
+static int32_t cam_spi_read_status_reg(
+	struct camera_io_master *client, uint8_t *status,
+	enum camera_sensor_i2c_type addr_type)
+{
+	struct cam_camera_spi_inst *rs =
+		&client->spi_client->cmd_tbl.read_status;
+
+	if (rs->addr_len != 0) {
+		CAM_ERR(CAM_SENSOR, "not implemented yet");
+		return -ENXIO;
+	}
+	return cam_spi_tx_helper(client, rs, 0, status,
+		addr_type, 1, NULL, NULL);
+}
+
+static int32_t cam_spi_device_busy(struct camera_io_master *client,
+	uint8_t *busy, enum camera_sensor_i2c_type addr_type)
+{
+	int rc;
+	uint8_t st = 0;
+
+	rc = cam_spi_read_status_reg(client, &st, addr_type);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed to read status reg");
+		return rc;
+	}
+	*busy = st & client->spi_client->busy_mask;
+	return 0;
+}
+
+static int32_t cam_spi_wait(struct camera_io_master *client,
+	struct cam_camera_spi_inst *inst,
+	enum camera_sensor_i2c_type addr_type)
+{
+	uint8_t busy;
+	int i, rc;
+
+	CAM_DBG(CAM_SENSOR, "op 0x%x wait start", inst->opcode);
+	for (i = 0; i < inst->delay_count; i++) {
+		rc = cam_spi_device_busy(client, &busy, addr_type);
+		if (rc < 0)
+			return rc;
+		if (!busy)
+			break;
+		msleep(inst->delay_intv);
+		CAM_DBG(CAM_SENSOR, "op 0x%x wait", inst->opcode);
+	}
+	if (i > inst->delay_count) {
+		CAM_ERR(CAM_SENSOR, "op %x timed out", inst->opcode);
+		return -ETIMEDOUT;
+	}
+	CAM_DBG(CAM_SENSOR, "op %x finished", inst->opcode);
+	return 0;
+}
+
+static int32_t cam_spi_write_enable(struct camera_io_master *client,
+	enum camera_sensor_i2c_type addr_type)
+{
+	struct cam_camera_spi_inst *we =
+		&client->spi_client->cmd_tbl.write_enable;
+	int rc;
+
+	if (we->opcode == 0)
+		return 0;
+	if (we->addr_len != 0) {
+		CAM_ERR(CAM_SENSOR, "not implemented yet");
+		return -EINVAL;
+	}
+	rc = cam_spi_tx_helper(client, we, 0, NULL, addr_type,
+		0, NULL, NULL);
+	if (rc < 0)
+		CAM_ERR(CAM_SENSOR, "write enable failed");
+	return rc;
+}
+
+/**
+ * cam_spi_page_program() - core function to perform write
+ * @client: need for obtaining SPI device
+ * @addr: address to program on device
+ * @data: data to write
+ * @len: size of data
+ * @tx: tx buffer, size >= header + len
+ *
+ * This function performs SPI write, and has no boundary check.  Writing range
+ * should not cross page boundary, or data will be corrupted.  Transaction is
+ * guaranteed to be finished when it returns.  This function should never be
+ * used outside cam_spi_write_seq().
+ */
+static int32_t cam_spi_page_program(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	uint16_t len, uint8_t *tx)
+{
+	int rc;
+	struct cam_camera_spi_inst *pg =
+		&client->spi_client->cmd_tbl.page_program;
+	struct spi_device *spi = client->spi_client->spi_master;
+	uint8_t retries = client->spi_client->retries;
+	uint8_t header_len = sizeof(pg->opcode) + pg->addr_len + pg->dummy_len;
+
+	CAM_DBG(CAM_SENSOR, "addr 0x%x, size 0x%x", addr, len);
+	rc = cam_spi_write_enable(client, addr_type);
+	if (rc < 0)
+		return rc;
+	memset(tx, 0, header_len);
+	tx[0] = pg->opcode;
+	cam_set_addr(addr, pg->addr_len, addr_type, tx + 1);
+	memcpy(tx + header_len, data, len);
+	CAM_DBG(CAM_SENSOR, "tx(%u): %02x %02x %02x %02x",
+		len, tx[0], tx[1], tx[2], tx[3]);
+	while ((rc = spi_write(spi, tx, len + header_len)) && retries) {
+		rc = cam_spi_wait(client, pg, addr_type);
+		msleep(client->spi_client->retry_delay);
+		retries--;
+	}
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed %d", rc);
+		return rc;
+	}
+	rc = cam_spi_wait(client, pg, addr_type);
+		return rc;
+}
+
+int cam_spi_write(struct camera_io_master *client,
+	uint32_t addr, uint32_t data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type)
+{
+	struct cam_camera_spi_inst *pg =
+		&client->spi_client->cmd_tbl.page_program;
+	uint8_t header_len = sizeof(pg->opcode) + pg->addr_len + pg->dummy_len;
+	uint16_t len = 0;
+	char buf[CAMERA_SENSOR_I2C_TYPE_MAX];
+	char *tx;
+	int rc = -EINVAL;
+
+	if ((addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		|| (data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (data_type != CAMERA_SENSOR_I2C_TYPE_MAX))
+		return rc;
+
+	CAM_DBG(CAM_EEPROM, "Data: 0x%x", data);
+	len = header_len + (uint8_t)data_type;
+	tx = kmalloc(len, GFP_KERNEL | GFP_DMA);
+	if (!tx)
+		goto NOMEM;
+
+	if (data_type == CAMERA_SENSOR_I2C_TYPE_BYTE) {
+		buf[0] = data;
+		CAM_DBG(CAM_EEPROM, "Byte %d: 0x%x", len, buf[0]);
+	} else if (data_type == CAMERA_SENSOR_I2C_TYPE_WORD) {
+		buf[0] = (data >> BITS_PER_BYTE) & 0x00FF;
+		buf[1] = (data & 0x00FF);
+	} else if (data_type == CAMERA_SENSOR_I2C_TYPE_3B) {
+		buf[0] = (data >> 16) & 0x00FF;
+		buf[1] = (data >> 8) & 0x00FF;
+		buf[2] = (data & 0x00FF);
+	} else {
+		buf[0] = (data >> 24) & 0x00FF;
+		buf[1] = (data >> 16) & 0x00FF;
+		buf[2] = (data >> 8) & 0x00FF;
+		buf[3] = (data & 0x00FF);
+	}
+
+	rc = cam_spi_page_program(client, addr, buf,
+		addr_type, data_type, tx);
+	if (rc < 0)
+		goto ERROR;
+	goto OUT;
+NOMEM:
+	CAM_ERR(CAM_SENSOR, "memory allocation failed");
+	return -ENOMEM;
+ERROR:
+	CAM_ERR(CAM_SENSOR, "error write");
+OUT:
+	kfree(tx);
+	return rc;
+}
+
+int32_t cam_spi_write_seq(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type, uint32_t num_byte)
+{
+	struct cam_camera_spi_inst *pg =
+		&client->spi_client->cmd_tbl.page_program;
+	const uint32_t page_size = client->spi_client->page_size;
+	uint8_t header_len = sizeof(pg->opcode) + pg->addr_len + pg->dummy_len;
+	uint16_t len;
+	uint32_t cur_len, end;
+	char *tx, *pdata = data;
+	int rc = -EINVAL;
+
+	if ((addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX) ||
+		(addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID))
+		return rc;
+    /* single page write */
+	if ((addr % page_size) + num_byte <= page_size) {
+		len = header_len + num_byte;
+		tx = kmalloc(len, GFP_KERNEL | GFP_DMA);
+		if (!tx)
+			goto NOMEM;
+		rc = cam_spi_page_program(client, addr, data, addr_type,
+			num_byte, tx);
+		if (rc < 0)
+			goto ERROR;
+		goto OUT;
+	}
+	/* multi page write */
+	len = header_len + page_size;
+	tx = kmalloc(len, GFP_KERNEL | GFP_DMA);
+	if (!tx)
+		goto NOMEM;
+	while (num_byte) {
+		end = min(page_size, (addr % page_size) + num_byte);
+		cur_len = end - (addr % page_size);
+		CAM_ERR(CAM_SENSOR, "Addr: 0x%x curr_len: 0x%x pgSize: %d",
+			addr, cur_len, page_size);
+		rc = cam_spi_page_program(client, addr, pdata, addr_type,
+			cur_len, tx);
+		if (rc < 0)
+			goto ERROR;
+		addr += cur_len;
+		pdata += cur_len;
+		num_byte -= cur_len;
+	}
+	goto OUT;
+NOMEM:
+	pr_err("%s: memory allocation failed\n", __func__);
+	return -ENOMEM;
+ERROR:
+	pr_err("%s: error write\n", __func__);
+OUT:
+	kfree(tx);
+	return rc;
+}
+
+int cam_spi_write_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting)
+{
+	int i;
+	int rc = -EFAULT;
+	struct cam_sensor_i2c_reg_array *reg_setting;
+	uint16_t client_addr_type;
+	enum camera_sensor_i2c_type addr_type;
+
+	if (!client || !write_setting)
+		return rc;
+
+	if ((write_setting->addr_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (write_setting->addr_type >= CAMERA_SENSOR_I2C_TYPE_MAX)
+		|| (write_setting->data_type <= CAMERA_SENSOR_I2C_TYPE_INVALID)
+		|| (write_setting->data_type >= CAMERA_SENSOR_I2C_TYPE_MAX))
+		return rc;
+
+	reg_setting = write_setting->reg_setting;
+	client_addr_type = write_setting->addr_type;
+	addr_type = write_setting->addr_type;
+	for (i = 0; i < write_setting->size; i++) {
+		CAM_DBG(CAM_SENSOR, "addr %x data %x",
+			reg_setting->reg_addr, reg_setting->reg_data);
+		rc = cam_spi_write(client,
+			reg_setting->reg_addr, reg_setting->reg_data,
+			write_setting->addr_type, write_setting->data_type);
+		if (rc < 0)
+			break;
+		reg_setting++;
+	}
+		if (write_setting->delay > 20)
+			msleep(write_setting->delay);
+		else if (write_setting->delay)
+			usleep_range(write_setting->delay * 1000,
+			(write_setting->delay
+			* 1000) + 1000);
+	addr_type = client_addr_type;
+	return rc;
+}
+
+int cam_spi_erase(struct camera_io_master *client, uint32_t addr,
+	enum camera_sensor_i2c_type addr_type, uint32_t size)
+{
+	struct cam_camera_spi_inst *se = &client->spi_client->cmd_tbl.erase;
+	int rc = 0;
+	uint32_t cur;
+	uint32_t end = addr + size;
+	uint32_t erase_size = client->spi_client->erase_size;
+
+	end = addr + size;
+	for (cur = rounddown(addr, erase_size); cur < end; cur += erase_size) {
+		CAM_ERR(CAM_SENSOR, "%s: erasing 0x%x size: %d\n",
+			__func__, cur, erase_size);
+		rc = cam_spi_write_enable(client, addr_type);
+		if (rc < 0)
+			return rc;
+		rc = cam_spi_tx_helper(client, se, cur, NULL, addr_type, 0,
+			NULL, NULL);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "%s: erase failed\n", __func__);
+			return rc;
+		}
+		rc = cam_spi_wait(client, se, addr_type);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "%s: erase timedout\n", __func__);
+			return rc;
+		}
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.h
@@ -0,0 +1,103 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_SPI_H_
+#define _CAM_SENSOR_SPI_H_
+
+#include <linux/spi/spi.h>
+#include <linux/cma.h>
+#include <media/cam_sensor.h>
+#include "cam_sensor_i2c.h"
+
+#define MAX_SPI_SIZE 110
+#define SPI_DYNAMIC_ALLOC
+
+struct cam_camera_spi_inst {
+	uint8_t opcode;
+	uint8_t addr_len;
+	uint8_t dummy_len;
+	uint8_t delay_intv;
+	uint8_t delay_count;
+};
+
+struct cam_spi_write_burst_data {
+	u8 data_msb;
+	u8 data_lsb;
+};
+
+struct cam_spi_write_burst_packet {
+	u8 cmd;
+	u8 addr_msb;
+	u8 addr_lsb;
+	struct cam_spi_write_burst_data data_arr[MAX_SPI_SIZE];
+};
+
+struct cam_camera_burst_info {
+	uint32_t burst_addr;
+	uint32_t burst_start;
+	uint32_t burst_len;
+	uint32_t chunk_size;
+};
+
+struct cam_camera_spi_inst_tbl {
+	struct cam_camera_spi_inst read;
+	struct cam_camera_spi_inst read_seq;
+	struct cam_camera_spi_inst query_id;
+	struct cam_camera_spi_inst page_program;
+	struct cam_camera_spi_inst write_enable;
+	struct cam_camera_spi_inst read_status;
+	struct cam_camera_spi_inst erase;
+};
+
+struct cam_sensor_spi_client {
+	struct spi_device *spi_master;
+	struct cam_camera_spi_inst_tbl cmd_tbl;
+	uint8_t device_id0;
+	uint8_t device_id1;
+	uint8_t mfr_id0;
+	uint8_t mfr_id1;
+	uint8_t retry_delay;
+	uint8_t retries;
+	uint8_t busy_mask;
+	uint16_t page_size;
+	uint32_t erase_size;
+};
+static __always_inline
+uint16_t cam_camera_spi_get_hlen(struct cam_camera_spi_inst *inst)
+{
+	return sizeof(inst->opcode) + inst->addr_len + inst->dummy_len;
+}
+
+int cam_spi_read(struct camera_io_master *client,
+	uint32_t addr, uint32_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type);
+
+int cam_spi_read_seq(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type,
+	int32_t num_bytes);
+
+int cam_spi_query_id(struct camera_io_master *client,
+	uint32_t addr,
+	enum camera_sensor_i2c_type addr_type,
+	uint8_t *data, uint32_t num_byte);
+
+int cam_spi_write(struct camera_io_master *client,
+	uint32_t addr, uint32_t data,
+	enum camera_sensor_i2c_type addr_type,
+	enum camera_sensor_i2c_type data_type);
+
+int cam_spi_write_table(struct camera_io_master *client,
+	struct cam_sensor_i2c_reg_setting *write_setting);
+
+int cam_spi_erase(struct camera_io_master *client,
+	uint32_t addr, enum camera_sensor_i2c_type addr_type,
+	uint32_t size);
+
+int cam_spi_write_seq(struct camera_io_master *client,
+	uint32_t addr, uint8_t *data,
+	enum camera_sensor_i2c_type addr_type, uint32_t num_byte);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_cmn_header.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_cmn_header.h
@@ -0,0 +1,425 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_CMN_HEADER_
+#define _CAM_SENSOR_CMN_HEADER_
+
+#include <linux/i2c.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/timer.h>
+#include <linux/delay.h>
+#include <linux/list.h>
+#include <media/cam_sensor.h>
+#include <media/cam_req_mgr.h>
+
+#define MAX_POWER_CONFIG    12
+
+#define MAX_PER_FRAME_ARRAY 32
+#define BATCH_SIZE_MAX      16
+
+#define CAM_SENSOR_NAME    "cam-sensor"
+#define CAM_ACTUATOR_NAME  "cam-actuator"
+#define CAM_CSIPHY_NAME    "cam-csiphy"
+#define CAM_FLASH_NAME     "cam-flash"
+#define CAM_EEPROM_NAME    "cam-eeprom"
+#define CAM_OIS_NAME       "cam-ois"
+
+#define MAX_SYSTEM_PIPELINE_DELAY 2
+
+#define CAM_PKT_NOP_OPCODE 127
+
+enum camera_sensor_cmd_type {
+	CAMERA_SENSOR_CMD_TYPE_INVALID,
+	CAMERA_SENSOR_CMD_TYPE_PROBE,
+	CAMERA_SENSOR_CMD_TYPE_PWR_UP,
+	CAMERA_SENSOR_CMD_TYPE_PWR_DOWN,
+	CAMERA_SENSOR_CMD_TYPE_I2C_INFO,
+	CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR,
+	CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_RD,
+	CAMERA_SENSOR_CMD_TYPE_I2C_CONT_WR,
+	CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD,
+	CAMERA_SENSOR_CMD_TYPE_WAIT,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_FIRE,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_RER,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_QUERYCURR,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_WIDGET,
+	CAMERA_SENSOR_CMD_TYPE_RD_DATA,
+	CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_FIRE,
+	CAMERA_SENSOR_CMD_TYPE_MAX,
+};
+
+enum camera_sensor_i2c_op_code {
+	CAMERA_SENSOR_I2C_OP_INVALID,
+	CAMERA_SENSOR_I2C_OP_RNDM_WR,
+	CAMERA_SENSOR_I2C_OP_RNDM_WR_VERF,
+	CAMERA_SENSOR_I2C_OP_CONT_WR_BRST,
+	CAMERA_SENSOR_I2C_OP_CONT_WR_BRST_VERF,
+	CAMERA_SENSOR_I2C_OP_CONT_WR_SEQN,
+	CAMERA_SENSOR_I2C_OP_CONT_WR_SEQN_VERF,
+	CAMERA_SENSOR_I2C_OP_MAX,
+};
+
+enum camera_sensor_wait_op_code {
+	CAMERA_SENSOR_WAIT_OP_INVALID,
+	CAMERA_SENSOR_WAIT_OP_COND,
+	CAMERA_SENSOR_WAIT_OP_HW_UCND,
+	CAMERA_SENSOR_WAIT_OP_SW_UCND,
+	CAMERA_SENSOR_WAIT_OP_MAX,
+};
+
+enum camera_flash_opcode {
+	CAMERA_SENSOR_FLASH_OP_INVALID,
+	CAMERA_SENSOR_FLASH_OP_OFF,
+	CAMERA_SENSOR_FLASH_OP_FIRELOW,
+	CAMERA_SENSOR_FLASH_OP_FIREHIGH,
+	CAMERA_SENSOR_FLASH_OP_FIREDURATION,
+	CAMERA_SENSOR_FLASH_OP_MAX,
+};
+
+enum camera_sensor_i2c_type {
+	CAMERA_SENSOR_I2C_TYPE_INVALID,
+	CAMERA_SENSOR_I2C_TYPE_BYTE,
+	CAMERA_SENSOR_I2C_TYPE_WORD,
+	CAMERA_SENSOR_I2C_TYPE_3B,
+	CAMERA_SENSOR_I2C_TYPE_DWORD,
+	CAMERA_SENSOR_I2C_TYPE_MAX,
+};
+
+enum i2c_freq_mode {
+	I2C_STANDARD_MODE,
+	I2C_FAST_MODE,
+	I2C_CUSTOM_MODE,
+	I2C_FAST_PLUS_MODE,
+	I2C_MAX_MODES,
+};
+
+enum position_roll {
+	ROLL_0       = 0,
+	ROLL_90      = 90,
+	ROLL_180     = 180,
+	ROLL_270     = 270,
+	ROLL_INVALID = 360,
+};
+
+enum position_yaw {
+	FRONT_CAMERA_YAW = 0,
+	REAR_CAMERA_YAW  = 180,
+	INVALID_YAW      = 360,
+};
+
+enum position_pitch {
+	LEVEL_PITCH    = 0,
+	INVALID_PITCH  = 360,
+};
+
+enum sensor_sub_module {
+	SUB_MODULE_SENSOR,
+	SUB_MODULE_ACTUATOR,
+	SUB_MODULE_EEPROM,
+	SUB_MODULE_LED_FLASH,
+	SUB_MODULE_CSID,
+	SUB_MODULE_CSIPHY,
+	SUB_MODULE_OIS,
+	SUB_MODULE_IR_LED,
+	SUB_MODULE_EXT,
+	SUB_MODULE_MAX,
+};
+
+enum msm_camera_power_seq_type {
+	SENSOR_MCLK,
+	SENSOR_VANA,
+	SENSOR_VDIG,
+	SENSOR_VIO,
+	SENSOR_VAF,
+	SENSOR_VAF_PWDM,
+	SENSOR_CUSTOM_REG1,
+	SENSOR_CUSTOM_REG2,
+	SENSOR_RESET,
+	SENSOR_STANDBY,
+	SENSOR_CUSTOM_GPIO1,
+	SENSOR_CUSTOM_GPIO2,
+	SENSOR_VANA1,
+	SENSOR_SEQ_TYPE_MAX,
+};
+
+enum cam_sensor_packet_opcodes {
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMON,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_UPDATE,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_INITIAL_CONFIG,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_PROBE,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_CONFIG,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_READ,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_FRAME_SKIP_UPDATE,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_POWERON_REG,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_POWEROFF_REG,
+	CAM_SENSOR_PACKET_OPCODE_SENSOR_NOP = 127
+};
+
+enum cam_actuator_packet_opcodes {
+	CAM_ACTUATOR_PACKET_OPCODE_INIT,
+	CAM_ACTUATOR_PACKET_AUTO_MOVE_LENS,
+	CAM_ACTUATOR_PACKET_MANUAL_MOVE_LENS,
+	CAM_ACTUATOR_PACKET_OPCODE_READ
+};
+
+enum cam_eeprom_packet_opcodes {
+	CAM_EEPROM_PACKET_OPCODE_INIT,
+	CAM_EEPROM_WRITE
+};
+
+enum cam_ois_packet_opcodes {
+	CAM_OIS_PACKET_OPCODE_INIT,
+	CAM_OIS_PACKET_OPCODE_OIS_CONTROL,
+	CAM_OIS_PACKET_OPCODE_READ,
+	CAM_OIS_PACKET_OPCODE_WRITE_TIME
+};
+
+enum msm_bus_perf_setting {
+	S_INIT,
+	S_PREVIEW,
+	S_VIDEO,
+	S_CAPTURE,
+	S_ZSL,
+	S_STEREO_VIDEO,
+	S_STEREO_CAPTURE,
+	S_DEFAULT,
+	S_LIVESHOT,
+	S_DUAL,
+	S_EXIT
+};
+
+enum msm_camera_device_type_t {
+	MSM_CAMERA_I2C_DEVICE,
+	MSM_CAMERA_PLATFORM_DEVICE,
+	MSM_CAMERA_SPI_DEVICE,
+};
+
+enum cam_flash_device_type {
+	CAMERA_FLASH_DEVICE_TYPE_PMIC = 0,
+	CAMERA_FLASH_DEVICE_TYPE_I2C,
+	CAMERA_FLASH_DEVICE_TYPE_GPIO,
+};
+
+enum cci_i2c_master_t {
+	MASTER_0,
+	MASTER_1,
+	MASTER_MAX,
+};
+
+enum cci_device_num {
+	CCI_DEVICE_0,
+	CCI_DEVICE_1,
+	CCI_DEVICE_MAX,
+};
+
+enum camera_vreg_type {
+	VREG_TYPE_DEFAULT,
+	VREG_TYPE_CUSTOM,
+};
+
+enum cam_sensor_i2c_cmd_type {
+	CAM_SENSOR_I2C_WRITE_RANDOM,
+	CAM_SENSOR_I2C_WRITE_BURST,
+	CAM_SENSOR_I2C_WRITE_SEQ,
+	CAM_SENSOR_I2C_READ_RANDOM,
+	CAM_SENSOR_I2C_READ_SEQ,
+	CAM_SENSOR_I2C_POLL,
+	CAM_SENSOR_I2C_SET_I2C_INFO
+};
+
+struct common_header {
+	uint32_t    first_word;
+	uint8_t     fifth_byte;
+	uint8_t     cmd_type;
+	uint16_t    reserved;
+};
+
+struct camera_vreg_t {
+	const char *reg_name;
+	int min_voltage;
+	int max_voltage;
+	int op_mode;
+	uint32_t delay;
+	const char *custom_vreg_name;
+	enum camera_vreg_type type;
+};
+
+struct msm_camera_gpio_num_info {
+	uint16_t gpio_num[SENSOR_SEQ_TYPE_MAX];
+	uint8_t valid[SENSOR_SEQ_TYPE_MAX];
+};
+
+struct msm_cam_clk_info {
+	const char *clk_name;
+	long clk_rate;
+	uint32_t delay;
+};
+
+struct msm_pinctrl_info {
+	struct pinctrl *pinctrl;
+	struct pinctrl_state *gpio_state_active;
+	struct pinctrl_state *gpio_state_suspend;
+	bool use_pinctrl;
+};
+
+struct cam_sensor_i2c_reg_array {
+	uint32_t reg_addr;
+	uint32_t reg_data;
+	uint32_t delay;
+	uint32_t data_mask;
+};
+
+struct cam_sensor_i2c_reg_setting {
+	struct cam_sensor_i2c_reg_array *reg_setting;
+	uint32_t size;
+	enum camera_sensor_i2c_type addr_type;
+	enum camera_sensor_i2c_type data_type;
+	unsigned short delay;
+	uint8_t *read_buff;
+	uint32_t read_buff_len;
+};
+
+struct cam_sensor_i2c_seq_reg {
+	uint32_t reg_addr;
+	uint8_t  *reg_data;
+	uint32_t size;
+	enum camera_sensor_i2c_type addr_type;
+};
+
+struct i2c_settings_list {
+	struct cam_sensor_i2c_reg_setting i2c_settings;
+	struct cam_sensor_i2c_seq_reg seq_settings;
+	struct cam_cmd_i2c_info slave_info;
+	enum cam_sensor_i2c_cmd_type op_code;
+	struct list_head list;
+};
+
+struct i2c_settings_array {
+	struct list_head list_head;
+	int32_t is_settings_valid;
+	int64_t request_id;
+};
+
+struct i2c_data_settings {
+	struct i2c_settings_array init_settings;
+	struct i2c_settings_array config_settings;
+	struct i2c_settings_array streamon_settings;
+	struct i2c_settings_array streamoff_settings;
+	struct i2c_settings_array read_settings;
+	struct i2c_settings_array poweron_reg_settings;
+	struct i2c_settings_array poweroff_reg_settings;
+	struct i2c_settings_array *per_frame;
+	struct i2c_settings_array *frame_skip;
+};
+
+struct cam_sensor_power_ctrl_t {
+	struct device *dev;
+	struct cam_sensor_power_setting *power_setting;
+	uint16_t power_setting_size;
+	struct cam_sensor_power_setting *power_down_setting;
+	uint16_t power_down_setting_size;
+	struct msm_camera_gpio_num_info *gpio_num_info;
+	struct msm_pinctrl_info pinctrl_info;
+	uint8_t cam_pinctrl_status;
+};
+
+struct cam_camera_slave_info {
+	uint16_t sensor_slave_addr;
+	uint16_t sensor_id_reg_addr;
+	uint16_t sensor_id;
+	uint16_t sensor_id_mask;
+	uint8_t  i2c_freq_mode;
+};
+
+struct msm_sensor_init_params {
+	int modes_supported;
+	unsigned int sensor_mount_angle;
+};
+
+enum msm_sensor_camera_id_t {
+	CAMERA_0,
+	CAMERA_1,
+	CAMERA_2,
+	CAMERA_3,
+	CAMERA_4,
+	CAMERA_5,
+	CAMERA_6,
+	CAMERA_7,
+	CAMERA_8,
+	CAMERA_9,
+	CAMERA_10,
+	CAMERA_11,
+	CAMERA_12,
+	CAMERA_13,
+	CAMERA_14,
+	CAMERA_15,
+	MAX_CAMERAS,
+};
+
+struct msm_sensor_id_info_t {
+	unsigned short sensor_id_reg_addr;
+	unsigned short sensor_id;
+	unsigned short sensor_id_mask;
+};
+
+enum msm_sensor_output_format_t {
+	MSM_SENSOR_BAYER,
+	MSM_SENSOR_YCBCR,
+	MSM_SENSOR_META,
+};
+
+struct cam_sensor_power_setting {
+	enum msm_camera_power_seq_type seq_type;
+	unsigned short seq_val;
+	long config_val;
+	unsigned short delay;
+	void *data[10];
+};
+
+struct cam_sensor_board_info {
+	struct cam_camera_slave_info slave_info;
+	int32_t sensor_mount_angle;
+	int32_t secure_mode;
+	int modes_supported;
+	int32_t pos_roll;
+	int32_t pos_yaw;
+	int32_t pos_pitch;
+	int32_t  subdev_id[SUB_MODULE_MAX];
+	int32_t  subdev_intf[SUB_MODULE_MAX];
+	const char *misc_regulator;
+	struct cam_sensor_power_ctrl_t power_info;
+};
+
+enum msm_camera_vreg_name_t {
+	CAM_VDIG,
+	CAM_VIO,
+	CAM_VANA,
+	CAM_VAF,
+	CAM_V_CUSTOM1,
+	CAM_V_CUSTOM2,
+	CAM_VREG_MAX,
+};
+
+struct msm_camera_gpio_conf {
+	void *cam_gpiomux_conf_tbl;
+	uint8_t cam_gpiomux_conf_tbl_size;
+	struct gpio *cam_gpio_common_tbl;
+	uint8_t cam_gpio_common_tbl_size;
+	struct gpio *cam_gpio_req_tbl;
+	uint8_t cam_gpio_req_tbl_size;
+	uint32_t gpio_no_mux;
+	uint32_t *camera_off_table;
+	uint8_t camera_off_table_size;
+	uint32_t *camera_on_table;
+	uint8_t camera_on_table_size;
+	struct msm_camera_gpio_num_info *gpio_num_info;
+};
+
+#endif /* _CAM_SENSOR_CMN_HEADER_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
@@ -0,0 +1,2567 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/kernel.h>
+#include <linux/pinctrl/consumer.h>
+#include <clocksource/arm_arch_timer.h>
+#include <linux/pm_domain.h>
+#include <linux/pm_runtime.h>
+#include "cam_sensor_util.h"
+#include "cam_mem_mgr.h"
+#include "cam_res_mgr_api.h"
+
+#define CAM_SENSOR_PINCTRL_STATE_SLEEP "cam_suspend"
+#define CAM_SENSOR_PINCTRL_STATE_DEFAULT "cam_default"
+
+#define VALIDATE_VOLTAGE(min, max, config_val) ((config_val) && \
+	(config_val >= min) && (config_val <= max))
+
+static struct i2c_settings_list*
+	cam_sensor_get_i2c_ptr(struct i2c_settings_array *i2c_reg_settings,
+		uint32_t size)
+{
+	struct i2c_settings_list *tmp;
+
+	tmp = kzalloc(sizeof(struct i2c_settings_list), GFP_KERNEL);
+
+	if (tmp != NULL)
+		list_add_tail(&(tmp->list),
+			&(i2c_reg_settings->list_head));
+	else
+		return NULL;
+
+	tmp->i2c_settings.reg_setting = (struct cam_sensor_i2c_reg_array *)
+		vzalloc(size * sizeof(struct cam_sensor_i2c_reg_array));
+	if (tmp->i2c_settings.reg_setting == NULL) {
+		list_del(&(tmp->list));
+		kfree(tmp);
+		return NULL;
+	}
+	tmp->i2c_settings.size = size;
+
+	return tmp;
+}
+
+int32_t cam_sensor_util_get_current_qtimer_ns(uint64_t *qtime_ns)
+{
+	uint64_t ticks = 0;
+	int32_t rc = 0;
+
+	ticks = arch_timer_read_counter();
+	if (ticks == 0) {
+		CAM_ERR(CAM_SENSOR, "qtimer returned 0, rc:%d", rc);
+		return -EINVAL;
+	}
+
+	if (qtime_ns != NULL) {
+		*qtime_ns = mul_u64_u32_div(ticks,
+			QTIMER_MUL_FACTOR, QTIMER_DIV_FACTOR);
+		CAM_DBG(CAM_SENSOR, "Qtimer time: 0x%x", *qtime_ns);
+	} else {
+		CAM_ERR(CAM_SENSOR, "NULL pointer passed");
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int32_t cam_sensor_util_regulator_powerup(struct cam_hw_soc_info *soc_info)
+{
+	int32_t i, rc = 0;
+	/* Initialize regulators to default parameters */
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		soc_info->rgltr[i] = devm_regulator_get(soc_info->dev,
+					soc_info->rgltr_name[i]);
+		if (IS_ERR_OR_NULL(soc_info->rgltr[i])) {
+			rc = PTR_ERR(soc_info->rgltr[i]);
+			rc = rc ? rc : -EINVAL;
+			CAM_ERR(CAM_SENSOR, "get failed for regulator %s %d",
+				 soc_info->rgltr_name[i], rc);
+			return rc;
+		}
+		CAM_DBG(CAM_SENSOR, "get for regulator %s",
+			soc_info->rgltr_name[i]);
+	}
+
+	return rc;
+}
+
+int32_t delete_request(struct i2c_settings_array *i2c_array)
+{
+	struct i2c_settings_list *i2c_list = NULL, *i2c_next = NULL;
+	int32_t rc = 0;
+
+	if (i2c_array == NULL) {
+		CAM_ERR(CAM_SENSOR, "FATAL:: Invalid argument");
+		return -EINVAL;
+	}
+
+	list_for_each_entry_safe(i2c_list, i2c_next,
+		&(i2c_array->list_head), list) {
+		vfree(i2c_list->i2c_settings.reg_setting);
+		list_del(&(i2c_list->list));
+		kfree(i2c_list);
+	}
+	INIT_LIST_HEAD(&(i2c_array->list_head));
+	i2c_array->is_settings_valid = 0;
+
+	return rc;
+}
+
+static int32_t cam_sensor_handle_delay(
+	uint32_t **cmd_buf,
+	uint16_t generic_op_code,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t offset, uint32_t *byte_cnt,
+	struct list_head *list_ptr)
+{
+	int32_t rc = 0;
+	struct cam_cmd_unconditional_wait *cmd_uncond_wait =
+		(struct cam_cmd_unconditional_wait *) *cmd_buf;
+	struct i2c_settings_list *i2c_list = NULL;
+
+	if (list_ptr == NULL) {
+		CAM_ERR(CAM_SENSOR, "Invalid list ptr");
+		return -EINVAL;
+	}
+
+	if (offset > 0) {
+		i2c_list =
+			list_entry(list_ptr, struct i2c_settings_list, list);
+		if (generic_op_code ==
+			CAMERA_SENSOR_WAIT_OP_HW_UCND)
+			i2c_list->i2c_settings.reg_setting[offset - 1].delay =
+				cmd_uncond_wait->delay;
+		else
+			i2c_list->i2c_settings.delay = cmd_uncond_wait->delay;
+		(*cmd_buf) +=
+			sizeof(
+			struct cam_cmd_unconditional_wait) / sizeof(uint32_t);
+		(*byte_cnt) +=
+			sizeof(
+			struct cam_cmd_unconditional_wait);
+	} else {
+		CAM_ERR(CAM_SENSOR, "Delay Rxed Before any buffer: %d", offset);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int32_t cam_sensor_handle_poll(
+	uint32_t **cmd_buf,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *byte_cnt, int32_t *offset,
+	struct list_head **list_ptr)
+{
+	struct i2c_settings_list  *i2c_list;
+	int32_t rc = 0;
+	struct cam_cmd_conditional_wait *cond_wait
+		= (struct cam_cmd_conditional_wait *) *cmd_buf;
+
+	i2c_list =
+		cam_sensor_get_i2c_ptr(i2c_reg_settings, 1);
+	if (!i2c_list || !i2c_list->i2c_settings.reg_setting) {
+		CAM_ERR(CAM_SENSOR, "Failed in allocating mem for list");
+		return -ENOMEM;
+	}
+
+	i2c_list->op_code = CAM_SENSOR_I2C_POLL;
+	i2c_list->i2c_settings.data_type =
+		cond_wait->data_type;
+	i2c_list->i2c_settings.addr_type =
+		cond_wait->addr_type;
+	i2c_list->i2c_settings.reg_setting->reg_addr =
+		cond_wait->reg_addr;
+	i2c_list->i2c_settings.reg_setting->reg_data =
+		cond_wait->reg_data;
+	i2c_list->i2c_settings.reg_setting->delay =
+		cond_wait->timeout;
+
+	(*cmd_buf) += sizeof(struct cam_cmd_conditional_wait) /
+		sizeof(uint32_t);
+	(*byte_cnt) += sizeof(struct cam_cmd_conditional_wait);
+
+	*offset = 1;
+	*list_ptr = &(i2c_list->list);
+
+	return rc;
+}
+
+static int32_t cam_sensor_handle_random_write(
+	struct cam_cmd_i2c_random_wr *cam_cmd_i2c_random_wr,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list)
+{
+	struct i2c_settings_list  *i2c_list;
+	int32_t rc = 0, cnt, payload_count;
+
+	payload_count = cam_cmd_i2c_random_wr->header.count;
+	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
+						payload_count);
+	if (i2c_list == NULL ||
+		i2c_list->i2c_settings.reg_setting == NULL) {
+		CAM_ERR(CAM_SENSOR, "Failed in allocating i2c_list");
+		return -ENOMEM;
+	}
+
+	*cmd_length_in_bytes = (sizeof(struct i2c_rdwr_header) +
+		sizeof(struct i2c_random_wr_payload) *
+		payload_count);
+	i2c_list->op_code = CAM_SENSOR_I2C_WRITE_RANDOM;
+	i2c_list->i2c_settings.addr_type =
+		cam_cmd_i2c_random_wr->header.addr_type;
+	i2c_list->i2c_settings.data_type =
+		cam_cmd_i2c_random_wr->header.data_type;
+
+	for (cnt = 0; cnt < payload_count; cnt++) {
+		i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
+			cam_cmd_i2c_random_wr->random_wr_payload_flex[cnt].reg_addr;
+		i2c_list->i2c_settings.reg_setting[cnt].reg_data =
+			cam_cmd_i2c_random_wr->random_wr_payload_flex[cnt].reg_data;
+		i2c_list->i2c_settings.reg_setting[cnt].data_mask = 0;
+	}
+	*offset = cnt;
+	*list = &(i2c_list->list);
+
+	return rc;
+}
+
+static int32_t cam_sensor_handle_continuous_write(
+	struct cam_cmd_i2c_continuous_wr *cam_cmd_i2c_continuous_wr,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint32_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0, cnt, payload_count;
+
+	payload_count = cam_cmd_i2c_continuous_wr->header.count;
+	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
+						payload_count);
+	if (i2c_list == NULL ||
+		i2c_list->i2c_settings.reg_setting == NULL) {
+		CAM_ERR(CAM_SENSOR, "Failed in allocating i2c_list");
+		return -ENOMEM;
+	}
+
+	*cmd_length_in_bytes = (sizeof(struct i2c_rdwr_header) +
+		sizeof(cam_cmd_i2c_continuous_wr->reg_addr) +
+		sizeof(struct cam_cmd_read) *
+		(payload_count));
+	if (cam_cmd_i2c_continuous_wr->header.op_code ==
+		CAMERA_SENSOR_I2C_OP_CONT_WR_BRST)
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_BURST;
+	else if (cam_cmd_i2c_continuous_wr->header.op_code ==
+		CAMERA_SENSOR_I2C_OP_CONT_WR_SEQN)
+		i2c_list->op_code = CAM_SENSOR_I2C_WRITE_SEQ;
+	else
+		return -EINVAL;
+
+	i2c_list->i2c_settings.addr_type =
+		cam_cmd_i2c_continuous_wr->header.addr_type;
+	i2c_list->i2c_settings.data_type =
+		cam_cmd_i2c_continuous_wr->header.data_type;
+	i2c_list->i2c_settings.size =
+		cam_cmd_i2c_continuous_wr->header.count;
+
+	for (cnt = 0; cnt < payload_count; cnt++) {
+		i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
+			cam_cmd_i2c_continuous_wr->reg_addr;
+		i2c_list->i2c_settings.reg_setting[cnt].reg_data =
+			cam_cmd_i2c_continuous_wr->data_read_flex[cnt].reg_data;
+		i2c_list->i2c_settings.reg_setting[cnt].data_mask = 0;
+	}
+	*offset = cnt;
+	*list = &(i2c_list->list);
+
+	return rc;
+}
+
+static int32_t cam_sensor_get_io_buffer(
+	struct cam_buf_io_cfg *io_cfg,
+	struct cam_sensor_i2c_reg_setting *i2c_settings)
+{
+	uintptr_t buf_addr = 0x0;
+	size_t buf_size = 0;
+	int32_t rc = 0;
+
+	if (io_cfg == NULL || i2c_settings == NULL) {
+		CAM_ERR(CAM_SENSOR,
+			"Invalid args, io buf or i2c settings is NULL");
+		return -EINVAL;
+	}
+
+	if (io_cfg->direction == CAM_BUF_OUTPUT) {
+		rc = cam_mem_get_cpu_buf(io_cfg->mem_handle[0],
+			&buf_addr, &buf_size);
+		if ((rc < 0) || (!buf_addr)) {
+			CAM_ERR(CAM_SENSOR,
+				"invalid buffer, rc: %d, buf_addr: %pK",
+				rc, buf_addr);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_SENSOR,
+			"buf_addr: %pK, buf_size: %zu, offsetsize: %d",
+			(void *)buf_addr, buf_size, io_cfg->offsets[0]);
+		if (io_cfg->offsets[0] >= buf_size) {
+			CAM_ERR(CAM_SENSOR,
+				"invalid size:io_cfg->offsets[0]: %d, buf_size: %d",
+				io_cfg->offsets[0], buf_size);
+			return -EINVAL;
+		}
+		i2c_settings->read_buff =
+			 (uint8_t *)buf_addr + io_cfg->offsets[0];
+		i2c_settings->read_buff_len =
+			buf_size - io_cfg->offsets[0];
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid direction: %d",
+			io_cfg->direction);
+		rc = -EINVAL;
+	}
+	cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
+	return rc;
+}
+
+int32_t cam_sensor_util_write_qtimer_to_io_buffer(
+	struct cam_buf_io_cfg *io_cfg)
+{
+	uintptr_t buf_addr = 0x0, target_buf = 0x0;
+	size_t buf_size = 0, target_size = 0;
+	int32_t rc = 0;
+	uint64_t qtime_ns = 0;
+
+	if (io_cfg == NULL) {
+		CAM_ERR(CAM_SENSOR,
+			"Invalid args, io buf is NULL");
+		return -EINVAL;
+	}
+
+	if (io_cfg->direction == CAM_BUF_OUTPUT) {
+		rc = cam_mem_get_cpu_buf(io_cfg->mem_handle[0],
+			&buf_addr, &buf_size);
+		if ((rc < 0) || (!buf_addr)) {
+			CAM_ERR(CAM_SENSOR,
+				"invalid buffer, rc: %d, buf_addr: %pK",
+				rc, buf_addr);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_SENSOR,
+			"buf_addr: %pK, buf_size: %zu, offsetsize: %d",
+			(void *)buf_addr, buf_size, io_cfg->offsets[0]);
+		if (io_cfg->offsets[0] >= buf_size) {
+			CAM_ERR(CAM_SENSOR,
+				"invalid size:io_cfg->offsets[0]: %d, buf_size: %d",
+				io_cfg->offsets[0], buf_size);
+			return -EINVAL;
+		}
+
+		target_buf  = buf_addr + io_cfg->offsets[0];
+		target_size = buf_size - io_cfg->offsets[0];
+
+		if (target_size < sizeof(uint64_t)) {
+			CAM_ERR(CAM_SENSOR,
+				"not enough size for qtimer, target_size:%d",
+				target_size);
+			return -EINVAL;
+		}
+
+		rc = cam_sensor_util_get_current_qtimer_ns(&qtime_ns);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed to get qtimer rc:%d", rc);
+			return rc;
+		}
+
+		memcpy((void *)target_buf, &qtime_ns, sizeof(uint64_t));
+	} else {
+		CAM_ERR(CAM_SENSOR, "Invalid direction: %d",
+			io_cfg->direction);
+		rc = -EINVAL;
+	}
+	cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
+	return rc;
+}
+
+static int32_t cam_sensor_handle_random_read(
+	struct cam_cmd_i2c_random_rd *cmd_i2c_random_rd,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint16_t *cmd_length_in_bytes,
+	int32_t *offset,
+	struct list_head **list,
+	struct cam_buf_io_cfg *io_cfg)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0, cnt = 0, payload_count = 0;
+
+	payload_count = cmd_i2c_random_rd->header.count;
+	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
+		payload_count);
+	if ((i2c_list == NULL) ||
+		(i2c_list->i2c_settings.reg_setting == NULL)) {
+		CAM_ERR(CAM_SENSOR,
+			"Failed in allocating i2c_list: %pK",
+			i2c_list);
+		return -ENOMEM;
+	}
+
+	rc = cam_sensor_get_io_buffer(io_cfg, &(i2c_list->i2c_settings));
+	if (rc) {
+		CAM_ERR(CAM_SENSOR, "Failed to get read buffer: %d", rc);
+	} else {
+		*cmd_length_in_bytes = sizeof(struct i2c_rdwr_header) +
+			(sizeof(struct cam_cmd_read) *
+			payload_count);
+		i2c_list->op_code = CAM_SENSOR_I2C_READ_RANDOM;
+		i2c_list->i2c_settings.addr_type =
+			cmd_i2c_random_rd->header.addr_type;
+		i2c_list->i2c_settings.data_type =
+			cmd_i2c_random_rd->header.data_type;
+		i2c_list->i2c_settings.size =
+			cmd_i2c_random_rd->header.count;
+
+		for (cnt = 0; cnt < payload_count; cnt++) {
+			i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
+				cmd_i2c_random_rd->data_read_flex[cnt].reg_data;
+		}
+		*offset = cnt;
+		*list = &(i2c_list->list);
+	}
+
+	return rc;
+}
+
+static int32_t cam_sensor_handle_continuous_read(
+	struct cam_cmd_i2c_continuous_rd *cmd_i2c_continuous_rd,
+	struct i2c_settings_array *i2c_reg_settings,
+	uint16_t *cmd_length_in_bytes, int32_t *offset,
+	struct list_head **list,
+	struct cam_buf_io_cfg *io_cfg)
+{
+	struct i2c_settings_list *i2c_list;
+	int32_t rc = 0, cnt = 0;
+
+	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings, 1);
+	if ((i2c_list == NULL) ||
+		(i2c_list->i2c_settings.reg_setting == NULL)) {
+		CAM_ERR(CAM_SENSOR,
+			"Failed in allocating i2c_list: %pK",
+			i2c_list);
+		return -ENOMEM;
+	}
+
+	rc = cam_sensor_get_io_buffer(io_cfg, &(i2c_list->i2c_settings));
+	if (rc) {
+		CAM_ERR(CAM_SENSOR, "Failed to get read buffer: %d", rc);
+	} else {
+		*cmd_length_in_bytes = sizeof(struct cam_cmd_i2c_continuous_rd);
+		i2c_list->op_code = CAM_SENSOR_I2C_READ_SEQ;
+
+		i2c_list->i2c_settings.addr_type =
+			cmd_i2c_continuous_rd->header.addr_type;
+		i2c_list->i2c_settings.data_type =
+			cmd_i2c_continuous_rd->header.data_type;
+		i2c_list->i2c_settings.size =
+			cmd_i2c_continuous_rd->header.count;
+		i2c_list->i2c_settings.reg_setting[0].reg_addr =
+			cmd_i2c_continuous_rd->reg_addr;
+
+		*offset = cnt;
+		*list = &(i2c_list->list);
+	}
+
+	return rc;
+}
+
+static int cam_sensor_handle_slave_info(
+	uint32_t *cmd_buf,
+	struct i2c_settings_array *i2c_reg_settings,
+	struct list_head **list_ptr)
+{
+	int rc = 0;
+	struct cam_cmd_i2c_info *i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
+	struct i2c_settings_list  *i2c_list;
+
+	i2c_list =
+		cam_sensor_get_i2c_ptr(i2c_reg_settings, 1);
+	if (!i2c_list || !i2c_list->i2c_settings.reg_setting) {
+		CAM_ERR(CAM_SENSOR, "Failed in allocating mem for list");
+		return -ENOMEM;
+	}
+
+	i2c_list->op_code = CAM_SENSOR_I2C_SET_I2C_INFO;
+	i2c_list->slave_info = *i2c_info;
+
+	return rc;
+}
+
+/**
+ * Name : cam_sensor_i2c_command_parser
+ * Description : Parse CSL CCI packet and apply register settings
+ * Parameters :  io_master        input  master information
+ *               i2c_reg_settings output register settings to fill
+ *               cmd_desc         input  command description
+ *               num_cmd_buffers  input  number of command buffers to process
+ *               io_cfg           input  buffer details for read operation only
+ * Description :
+ * Handle multiple I2C RD/WR and WAIT cmd formats in one command
+ * buffer, for example, a command buffer of m x RND_WR + 1 x HW_
+ * WAIT + n x RND_WR with num_cmd_buf = 1. Do not exepect RD/WR
+ * with different cmd_type and op_code in one command buffer.
+ */
+int cam_sensor_i2c_command_parser(
+	struct camera_io_master *io_master,
+	struct i2c_settings_array *i2c_reg_settings,
+	struct cam_cmd_buf_desc   *cmd_desc,
+	int32_t num_cmd_buffers,
+	struct cam_buf_io_cfg *io_cfg)
+{
+	int16_t                   rc = 0, i = 0;
+	size_t                    len_of_buff = 0;
+	uintptr_t                 generic_ptr;
+	uint16_t                  cmd_length_in_bytes = 0;
+	size_t                    remain_len = 0;
+	size_t                    tot_size = 0;
+
+	for (i = 0; i < num_cmd_buffers; i++) {
+		uint32_t                  *cmd_buf = NULL;
+		struct common_header      *cmm_hdr;
+		uint16_t                  generic_op_code;
+		uint32_t                  byte_cnt = 0;
+		uint32_t                  j = 0;
+		struct list_head          *list = NULL;
+
+		/*
+		 * It is not expected the same settings to
+		 * be spread across multiple cmd buffers
+		 */
+		CAM_DBG(CAM_SENSOR, "Total cmd Buf in Bytes: %d",
+			cmd_desc[i].length);
+
+		if (!cmd_desc[i].length)
+			continue;
+
+		rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
+			&generic_ptr, &len_of_buff);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"cmd hdl failed:%d, Err: %d, Buffer_len: %zd",
+				cmd_desc[i].mem_handle, rc, len_of_buff);
+			return rc;
+		}
+
+		remain_len = len_of_buff;
+		if ((len_of_buff < sizeof(struct common_header)) ||
+			(cmd_desc[i].offset >
+			(len_of_buff - sizeof(struct common_header)))) {
+			CAM_ERR(CAM_SENSOR, "buffer provided too small");
+			return -EINVAL;
+		}
+		cmd_buf = (uint32_t *)generic_ptr;
+		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
+
+		remain_len -= cmd_desc[i].offset;
+		if (remain_len < cmd_desc[i].length) {
+			CAM_ERR(CAM_SENSOR, "buffer provided too small");
+			return -EINVAL;
+		}
+
+		while (byte_cnt < cmd_desc[i].length) {
+			if ((remain_len - byte_cnt) <
+				sizeof(struct common_header)) {
+				CAM_ERR(CAM_SENSOR, "Not enough buffer");
+				rc = -EINVAL;
+				goto end;
+			}
+			cmm_hdr = (struct common_header *)cmd_buf;
+			generic_op_code = cmm_hdr->fifth_byte;
+			switch (cmm_hdr->cmd_type) {
+			case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR: {
+				uint32_t cmd_length_in_bytes   = 0;
+				struct cam_cmd_i2c_random_wr
+					*cam_cmd_i2c_random_wr =
+					(struct cam_cmd_i2c_random_wr *)cmd_buf;
+
+				if ((remain_len - byte_cnt) <
+					sizeof(struct cam_cmd_i2c_random_wr)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+				tot_size = sizeof(struct i2c_rdwr_header) +
+					(sizeof(struct i2c_random_wr_payload) *
+					cam_cmd_i2c_random_wr->header.count);
+
+				if (tot_size > (remain_len - byte_cnt)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_random_write(
+					cam_cmd_i2c_random_wr,
+					i2c_reg_settings,
+					&cmd_length_in_bytes, &j, &list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+					"Failed in random write %d", rc);
+					rc = -EINVAL;
+					goto end;
+				}
+
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_WR: {
+				uint32_t cmd_length_in_bytes   = 0;
+				struct cam_cmd_i2c_continuous_wr
+				*cam_cmd_i2c_continuous_wr =
+				(struct cam_cmd_i2c_continuous_wr *)
+				cmd_buf;
+
+				if ((remain_len - byte_cnt) <
+				sizeof(struct cam_cmd_i2c_continuous_wr)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				tot_size = sizeof(struct i2c_rdwr_header) +
+				sizeof(cam_cmd_i2c_continuous_wr->reg_addr) +
+				(sizeof(struct cam_cmd_read) *
+				cam_cmd_i2c_continuous_wr->header.count);
+
+				if (tot_size > (remain_len - byte_cnt)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer provided");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_continuous_write(
+					cam_cmd_i2c_continuous_wr,
+					i2c_reg_settings,
+					&cmd_length_in_bytes, &j, &list);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+					"Failed in continuous write %d", rc);
+					goto end;
+				}
+
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_WAIT: {
+				if ((remain_len - byte_cnt) <
+				sizeof(struct cam_cmd_unconditional_wait)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer space");
+					rc = -EINVAL;
+					goto end;
+				}
+				if (generic_op_code ==
+					CAMERA_SENSOR_WAIT_OP_HW_UCND ||
+					generic_op_code ==
+						CAMERA_SENSOR_WAIT_OP_SW_UCND) {
+					rc = cam_sensor_handle_delay(
+						&cmd_buf, generic_op_code,
+						i2c_reg_settings, j, &byte_cnt,
+						list);
+					if (rc < 0) {
+						CAM_ERR(CAM_SENSOR,
+							"delay hdl failed: %d",
+							rc);
+						goto end;
+					}
+
+				} else if (generic_op_code ==
+					CAMERA_SENSOR_WAIT_OP_COND) {
+					rc = cam_sensor_handle_poll(
+						&cmd_buf, i2c_reg_settings,
+						&byte_cnt, &j, &list);
+					if (rc < 0) {
+						CAM_ERR(CAM_SENSOR,
+							"Random read fail: %d",
+							rc);
+						goto end;
+					}
+				} else {
+					CAM_ERR(CAM_SENSOR,
+						"Wrong Wait Command: %d",
+						generic_op_code);
+					rc = -EINVAL;
+					goto end;
+				}
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO: {
+				if (remain_len - byte_cnt <
+					sizeof(struct cam_cmd_i2c_info)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer space");
+					rc = -EINVAL;
+					goto end;
+				}
+				rc = cam_sensor_handle_slave_info(
+					cmd_buf, i2c_reg_settings, &list);
+				if (rc) {
+					CAM_ERR(CAM_SENSOR,
+					"Handle slave info failed with rc: %d",
+					rc);
+					goto end;
+				}
+				cmd_length_in_bytes =
+					sizeof(struct cam_cmd_i2c_info);
+				cmd_buf +=
+					cmd_length_in_bytes / sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_RD: {
+				uint16_t cmd_length_in_bytes   = 0;
+				struct cam_cmd_i2c_random_rd *i2c_random_rd =
+				(struct cam_cmd_i2c_random_rd *)cmd_buf;
+
+				if (remain_len - byte_cnt <
+					sizeof(struct cam_cmd_i2c_random_rd)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer space");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				tot_size = sizeof(struct i2c_rdwr_header) +
+					(sizeof(struct cam_cmd_read) *
+					i2c_random_rd->header.count);
+
+				if (tot_size > (remain_len - byte_cnt)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer provided %d, %d, %d",
+						tot_size, remain_len, byte_cnt);
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_random_read(
+					i2c_random_rd,
+					i2c_reg_settings,
+					&cmd_length_in_bytes, &j, &list,
+					io_cfg);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+					"Failed in random read %d", rc);
+					goto end;
+				}
+
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD: {
+				uint16_t cmd_length_in_bytes   = 0;
+				struct cam_cmd_i2c_continuous_rd
+				*i2c_continuous_rd =
+				(struct cam_cmd_i2c_continuous_rd *)cmd_buf;
+
+				if (remain_len - byte_cnt <
+				    sizeof(struct cam_cmd_i2c_continuous_rd)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer space");
+					rc = -EINVAL;
+					goto end;
+				}
+
+				tot_size =
+				sizeof(struct cam_cmd_i2c_continuous_rd);
+
+				if (tot_size > (remain_len - byte_cnt)) {
+					CAM_ERR(CAM_SENSOR,
+						"Not enough buffer provided %d, %d, %d",
+						tot_size, remain_len, byte_cnt);
+					rc = -EINVAL;
+					goto end;
+				}
+
+				rc = cam_sensor_handle_continuous_read(
+					i2c_continuous_rd,
+					i2c_reg_settings,
+					&cmd_length_in_bytes, &j, &list,
+					io_cfg);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+					"Failed in continuous read %d", rc);
+					goto end;
+				}
+
+				cmd_buf += cmd_length_in_bytes /
+					sizeof(uint32_t);
+				byte_cnt += cmd_length_in_bytes;
+				break;
+			}
+			default:
+				CAM_ERR(CAM_SENSOR, "Invalid Command Type:%d",
+					 cmm_hdr->cmd_type);
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+		i2c_reg_settings->is_settings_valid = 1;
+		cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	}
+	return rc;
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
+	return rc;
+}
+
+int cam_sensor_util_i2c_apply_setting(
+	struct camera_io_master *io_master_info,
+	struct i2c_settings_list *i2c_list)
+{
+	int32_t rc = 0;
+	uint32_t i, size;
+
+	switch (i2c_list->op_code) {
+	case CAM_SENSOR_I2C_WRITE_RANDOM: {
+		rc = camera_io_dev_write(io_master_info,
+			&(i2c_list->i2c_settings));
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to random write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	break;
+	}
+	case CAM_SENSOR_I2C_WRITE_SEQ: {
+		rc = camera_io_dev_write_continuous(
+			io_master_info, &(i2c_list->i2c_settings), 0);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to seq write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	break;
+	}
+	case CAM_SENSOR_I2C_WRITE_BURST: {
+		rc = camera_io_dev_write_continuous(
+			io_master_info, &(i2c_list->i2c_settings), 1);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to burst write I2C settings: %d",
+				rc);
+			return rc;
+		}
+	break;
+	}
+	case CAM_SENSOR_I2C_POLL: {
+		size = i2c_list->i2c_settings.size;
+		for (i = 0; i < size; i++) {
+			rc = camera_io_dev_poll(
+			io_master_info,
+			i2c_list->i2c_settings.reg_setting[i].reg_addr,
+			i2c_list->i2c_settings.reg_setting[i].reg_data,
+			i2c_list->i2c_settings.reg_setting[i].data_mask,
+			i2c_list->i2c_settings.addr_type,
+			i2c_list->i2c_settings.data_type,
+			i2c_list->i2c_settings.reg_setting[i].delay);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"i2c poll apply setting Fail: %d", rc);
+				return rc;
+			}
+		}
+	break;
+	}
+	default:
+		CAM_ERR(CAM_SENSOR, "Wrong Opcode: %d", i2c_list->op_code);
+		rc = -EINVAL;
+	break;
+	}
+
+	return rc;
+}
+
+int32_t cam_sensor_i2c_read_data(
+	struct i2c_settings_array *i2c_settings,
+	struct camera_io_master *io_master_info)
+{
+	int32_t                   rc = 0;
+	struct i2c_settings_list  *i2c_list;
+	uint32_t                  cnt = 0;
+	uint8_t                   *read_buff = NULL;
+	uint32_t                  buff_length = 0;
+	uint32_t                  read_length = 0;
+
+	list_for_each_entry(i2c_list,
+		&(i2c_settings->list_head), list) {
+		if (i2c_list->op_code == CAM_SENSOR_I2C_SET_I2C_INFO) {
+			CAM_DBG(CAM_SENSOR,
+				"CAM_SENSOR_I2C_SET_I2C_INFO continue");
+			continue;
+		}
+
+		read_buff = i2c_list->i2c_settings.read_buff;
+		buff_length = i2c_list->i2c_settings.read_buff_len;
+		if ((read_buff == NULL) || (buff_length == 0)) {
+			CAM_ERR(CAM_SENSOR,
+				"Invalid input buffer, buffer: %pK, length: %d",
+				read_buff, buff_length);
+			return -EINVAL;
+		}
+
+		if (i2c_list->op_code == CAM_SENSOR_I2C_READ_RANDOM) {
+			read_length = i2c_list->i2c_settings.data_type *
+				i2c_list->i2c_settings.size;
+			if ((read_length > buff_length) ||
+				(read_length < i2c_list->i2c_settings.size)) {
+				CAM_ERR(CAM_SENSOR,
+				"Invalid size, readLen:%d, bufLen:%d, size: %d",
+				read_length, buff_length,
+				i2c_list->i2c_settings.size);
+				return -EINVAL;
+			}
+			for (cnt = 0; cnt < (i2c_list->i2c_settings.size);
+				cnt++) {
+				struct cam_sensor_i2c_reg_array *reg_setting =
+				&(i2c_list->i2c_settings.reg_setting[cnt]);
+				rc = camera_io_dev_read(io_master_info,
+					reg_setting->reg_addr,
+					&reg_setting->reg_data,
+					i2c_list->i2c_settings.addr_type,
+					i2c_list->i2c_settings.data_type);
+				if (rc < 0) {
+					CAM_ERR(CAM_SENSOR,
+					"Failed: random read I2C settings: %d",
+					rc);
+					return rc;
+				}
+				if (i2c_list->i2c_settings.data_type <
+					CAMERA_SENSOR_I2C_TYPE_MAX) {
+					memcpy(read_buff,
+					&reg_setting->reg_data,
+					i2c_list->i2c_settings.data_type);
+					read_buff +=
+					i2c_list->i2c_settings.data_type;
+				}
+			}
+		} else if (i2c_list->op_code == CAM_SENSOR_I2C_READ_SEQ) {
+			read_length = i2c_list->i2c_settings.size;
+			if (read_length > buff_length) {
+				CAM_ERR(CAM_SENSOR,
+				"Invalid buffer size, readLen: %d, bufLen: %d",
+				read_length, buff_length);
+				return -EINVAL;
+			}
+			rc = camera_io_dev_read_seq(
+				io_master_info,
+				i2c_list->i2c_settings.reg_setting[0].reg_addr,
+				read_buff,
+				i2c_list->i2c_settings.addr_type,
+				i2c_list->i2c_settings.data_type,
+				i2c_list->i2c_settings.size);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"failed: seq read I2C settings: %d",
+					rc);
+				return rc;
+			}
+		}
+	}
+
+	return rc;
+}
+
+int32_t msm_camera_fill_vreg_params(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_sensor_power_setting *power_setting,
+	uint16_t power_setting_size)
+{
+	int32_t rc = 0, j = 0, i = 0;
+	int num_vreg;
+
+	/* Validate input parameters */
+	if (!soc_info || !power_setting) {
+		CAM_ERR(CAM_SENSOR, "failed: soc_info %pK power_setting %pK",
+			soc_info, power_setting);
+		return -EINVAL;
+	}
+
+	num_vreg = soc_info->num_rgltr;
+
+	if ((num_vreg <= 0) || (num_vreg > CAM_SOC_MAX_REGULATOR)) {
+		CAM_ERR(CAM_SENSOR, "failed: num_vreg %d", num_vreg);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < power_setting_size; i++) {
+
+		if (power_setting[i].seq_type < SENSOR_MCLK ||
+			power_setting[i].seq_type >= SENSOR_SEQ_TYPE_MAX) {
+			CAM_ERR(CAM_SENSOR, "failed: Invalid Seq type: %d",
+				power_setting[i].seq_type);
+			return -EINVAL;
+		}
+
+		switch (power_setting[i].seq_type) {
+		case SENSOR_VDIG:
+			for (j = 0; j < num_vreg; j++) {
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vdig")) {
+
+					CAM_DBG(CAM_SENSOR,
+						"i: %d j: %d cam_vdig", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val)) {
+						soc_info->rgltr_min_volt[j] =
+						soc_info->rgltr_max_volt[j] =
+						power_setting[i].config_val;
+					}
+					break;
+				}
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_VIO:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vio")) {
+					CAM_DBG(CAM_SENSOR,
+						"i: %d j: %d cam_vio", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val)) {
+						soc_info->rgltr_min_volt[j] =
+						soc_info->rgltr_max_volt[j] =
+						power_setting[i].config_val;
+					}
+					break;
+				}
+
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_VANA:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vana")) {
+					CAM_DBG(CAM_SENSOR,
+						"i: %d j: %d cam_vana", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val)) {
+						soc_info->rgltr_min_volt[j] =
+						soc_info->rgltr_max_volt[j] =
+						power_setting[i].config_val;
+					}
+					break;
+				}
+
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_VANA1:
+			for (j = 0; j < num_vreg; j++) {
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vana1")) {
+					CAM_DBG(CAM_SENSOR,
+						"i: %d j: %d cam_vana1", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val)) {
+						soc_info->rgltr_min_volt[j] =
+						soc_info->rgltr_max_volt[j] =
+						power_setting[i].config_val;
+					}
+					break;
+				}
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_VAF:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_vaf")) {
+					CAM_DBG(CAM_SENSOR,
+						"i: %d j: %d cam_vaf", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val)) {
+						soc_info->rgltr_min_volt[j] =
+						soc_info->rgltr_max_volt[j] =
+						power_setting[i].config_val;
+					}
+
+					break;
+				}
+
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+
+		case SENSOR_CUSTOM_REG1:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_v_custom1")) {
+					CAM_DBG(CAM_SENSOR,
+						"i:%d j:%d cam_vcustom1", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val)) {
+						soc_info->rgltr_min_volt[j] =
+						soc_info->rgltr_max_volt[j] =
+						power_setting[i].config_val;
+					}
+					break;
+				}
+
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+		case SENSOR_CUSTOM_REG2:
+			for (j = 0; j < num_vreg; j++) {
+
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_v_custom2")) {
+					CAM_DBG(CAM_SENSOR,
+						"i:%d j:%d cam_vcustom2", i, j);
+					power_setting[i].seq_val = j;
+
+					if (VALIDATE_VOLTAGE(
+						soc_info->rgltr_min_volt[j],
+						soc_info->rgltr_max_volt[j],
+						power_setting[i].config_val)) {
+						soc_info->rgltr_min_volt[j] =
+						soc_info->rgltr_max_volt[j] =
+						power_setting[i].config_val;
+					}
+					break;
+				}
+			}
+			if (j == num_vreg)
+				power_setting[i].seq_val = INVALID_VREG;
+			break;
+		default:
+			break;
+		}
+	}
+
+	return rc;
+}
+
+int cam_sensor_util_request_gpio_table(
+		struct cam_hw_soc_info *soc_info, int gpio_en)
+{
+	int rc = 0, i = 0;
+	uint8_t size = 0;
+	struct cam_soc_gpio_data *gpio_conf =
+			soc_info->gpio_data;
+	struct gpio *gpio_tbl = NULL;
+
+	if (!gpio_conf) {
+		CAM_INFO(CAM_SENSOR, "No GPIO data");
+		return 0;
+	}
+
+	if (gpio_conf->cam_gpio_common_tbl_size <= 0) {
+		CAM_INFO(CAM_SENSOR, "No GPIO entry");
+		return -EINVAL;
+	}
+
+	gpio_tbl = gpio_conf->cam_gpio_req_tbl;
+	size = gpio_conf->cam_gpio_req_tbl_size;
+
+	if (!gpio_tbl || !size) {
+		CAM_ERR(CAM_SENSOR, "invalid gpio_tbl %pK / size %d",
+			gpio_tbl, size);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < size; i++) {
+		CAM_DBG(CAM_SENSOR, "%s%d, i: %d, gpio %d dir %lld",
+			soc_info->dev_name, soc_info->index, i,
+			gpio_tbl[i].gpio, gpio_tbl[i].flags);
+	}
+
+	if (gpio_en) {
+		for (i = 0; i < size; i++) {
+			rc = cam_res_mgr_gpio_request(soc_info->dev,
+					gpio_tbl[i].gpio,
+					gpio_tbl[i].flags, gpio_tbl[i].label);
+			if (rc) {
+				/*
+				 * After GPIO request fails, contine to
+				 * apply new gpios, outout a error message
+				 * for driver bringup debug
+				 */
+				CAM_ERR(CAM_SENSOR, "gpio %d:%s request fails",
+					gpio_tbl[i].gpio, gpio_tbl[i].label);
+			}
+		}
+	} else {
+		cam_res_mgr_gpio_free_arry(soc_info->dev, gpio_tbl, size);
+	}
+
+	return rc;
+}
+
+bool cam_sensor_util_check_gpio_is_shared(
+	struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+	uint8_t size = 0;
+	struct cam_soc_gpio_data *gpio_conf =
+			soc_info->gpio_data;
+	struct gpio *gpio_tbl = NULL;
+
+	if (!gpio_conf) {
+		CAM_DBG(CAM_SENSOR, "No GPIO data");
+		return false;
+	}
+
+	if (gpio_conf->cam_gpio_common_tbl_size <= 0) {
+		CAM_DBG(CAM_SENSOR, "No GPIO entry");
+		return false;
+	}
+
+	gpio_tbl = gpio_conf->cam_gpio_req_tbl;
+	size = gpio_conf->cam_gpio_req_tbl_size;
+
+	if (!gpio_tbl || !size) {
+		CAM_ERR(CAM_SENSOR, "invalid gpio_tbl %pK / size %d",
+			gpio_tbl, size);
+		return false;
+	}
+
+	rc = cam_res_mgr_util_check_if_gpio_is_shared(
+		gpio_tbl, size);
+	if (!rc) {
+		CAM_DBG(CAM_SENSOR,
+			"dev: %s don't have shared gpio resources",
+			soc_info->dev_name);
+		return false;
+	}
+
+	return true;
+}
+
+static int32_t cam_sensor_validate(void *ptr, size_t remain_buf)
+{
+	struct common_header *cmm_hdr = (struct common_header *)ptr;
+	size_t validate_size = 0;
+
+	if (remain_buf < sizeof(struct common_header))
+		return -EINVAL;
+
+	if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_PWR_UP ||
+		cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_PWR_DOWN)
+		validate_size = sizeof(struct cam_cmd_power);
+	else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)
+		validate_size = sizeof(struct cam_cmd_unconditional_wait);
+
+	if (remain_buf < validate_size) {
+		CAM_ERR(CAM_SENSOR, "Invalid cmd_buf len %zu min %zu",
+			remain_buf, validate_size);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int32_t cam_sensor_update_power_settings(void *cmd_buf,
+	uint32_t cmd_length, struct cam_sensor_power_ctrl_t *power_info,
+	size_t cmd_buf_len)
+{
+	int32_t rc = 0, tot_size = 0, last_cmd_type = 0;
+	int32_t i = 0, pwr_up = 0, pwr_down = 0;
+	struct cam_sensor_power_setting *pwr_settings;
+	void *ptr = cmd_buf, *scr;
+	struct common_header *cmm_hdr = (struct common_header *)cmd_buf;
+	struct cam_cmd_power *pwr_cmd =
+		kzalloc(sizeof(struct cam_cmd_power), GFP_KERNEL);
+	if (!pwr_cmd)
+		return -ENOMEM;
+	memcpy(pwr_cmd, cmd_buf, sizeof(struct cam_cmd_power));
+
+	if (!pwr_cmd || !cmd_length || cmd_buf_len < (size_t)cmd_length ||
+		cam_sensor_validate(cmd_buf, cmd_buf_len)) {
+		CAM_ERR(CAM_SENSOR, "Invalid Args: pwr_cmd %pK, cmd_length: %d",
+			pwr_cmd, cmd_length);
+		rc = -EINVAL;
+		goto free_power_command;
+	}
+
+	power_info->power_setting_size = 0;
+	power_info->power_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting) *
+			MAX_POWER_CONFIG, GFP_KERNEL);
+	if (!power_info->power_setting) {
+		rc = -ENOMEM;
+		goto free_power_command;
+	}
+
+	power_info->power_down_setting_size = 0;
+	power_info->power_down_setting =
+		kzalloc(sizeof(struct cam_sensor_power_setting) *
+			MAX_POWER_CONFIG, GFP_KERNEL);
+	if (!power_info->power_down_setting) {
+		kfree(power_info->power_setting);
+		power_info->power_setting = NULL;
+		power_info->power_setting_size = 0;
+		rc = -ENOMEM;
+		goto free_power_command;
+	}
+
+	while (tot_size < cmd_length) {
+		if (cam_sensor_validate(ptr, (cmd_length - tot_size))) {
+			rc = -EINVAL;
+			goto free_power_settings;
+		}
+		if (cmm_hdr->cmd_type ==
+			CAMERA_SENSOR_CMD_TYPE_PWR_UP) {
+			struct cam_cmd_power *pwr_cmd =
+				(struct cam_cmd_power *)ptr;
+
+			if ((U16_MAX - power_info->power_setting_size) <
+				pwr_cmd->count) {
+				CAM_ERR(CAM_SENSOR, "ERR: Overflow occurs");
+				rc = -EINVAL;
+				goto free_power_settings;
+			}
+
+			power_info->power_setting_size += pwr_cmd->count;
+			if ((power_info->power_setting_size > MAX_POWER_CONFIG)
+				|| (pwr_cmd->count >= SENSOR_SEQ_TYPE_MAX)) {
+				CAM_ERR(CAM_SENSOR,
+				"pwr_up setting size %d, pwr_cmd->count: %d",
+					power_info->power_setting_size,
+					pwr_cmd->count);
+				rc = -EINVAL;
+				goto free_power_settings;
+			}
+			scr = ptr + sizeof(struct cam_cmd_power);
+			tot_size = tot_size + sizeof(struct cam_cmd_power);
+
+			if (pwr_cmd->count == 0)
+				CAM_WARN(CAM_SENSOR, "pwr_up_size is zero");
+
+			for (i = 0; i < pwr_cmd->count; i++, pwr_up++) {
+				power_info->power_setting[pwr_up].seq_type =
+				pwr_cmd->power_settings_flex[i].power_seq_type;
+				power_info->power_setting[pwr_up].config_val =
+				pwr_cmd->power_settings_flex[i].config_val_low;
+				power_info->power_setting[pwr_up].delay = 0;
+				if (i) {
+					scr = scr +
+						sizeof(
+						struct cam_power_settings);
+					tot_size = tot_size +
+						sizeof(
+						struct cam_power_settings);
+				}
+				if (tot_size > cmd_length) {
+					CAM_ERR(CAM_SENSOR,
+						"Error: Cmd Buffer is wrong");
+					rc = -EINVAL;
+					goto free_power_settings;
+				}
+				CAM_DBG(CAM_SENSOR,
+				"Seq Type[%d]: %d Config_val: %ld", pwr_up,
+				power_info->power_setting[pwr_up].seq_type,
+				power_info->power_setting[pwr_up].config_val);
+			}
+			last_cmd_type = CAMERA_SENSOR_CMD_TYPE_PWR_UP;
+			ptr = (void *) scr;
+			cmm_hdr = (struct common_header *)ptr;
+		} else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT) {
+			struct cam_cmd_unconditional_wait *wait_cmd =
+				(struct cam_cmd_unconditional_wait *)ptr;
+			if ((wait_cmd->op_code ==
+				CAMERA_SENSOR_WAIT_OP_SW_UCND) &&
+				(last_cmd_type ==
+				CAMERA_SENSOR_CMD_TYPE_PWR_UP)) {
+				if (pwr_up > 0) {
+					pwr_settings =
+					&power_info->power_setting[pwr_up - 1];
+					pwr_settings->delay +=
+						wait_cmd->delay;
+				} else {
+					CAM_ERR(CAM_SENSOR,
+					"Delay is expected only after valid power up setting");
+				}
+			} else if ((wait_cmd->op_code ==
+				CAMERA_SENSOR_WAIT_OP_SW_UCND) &&
+				(last_cmd_type ==
+				CAMERA_SENSOR_CMD_TYPE_PWR_DOWN)) {
+				if (pwr_down > 0) {
+					pwr_settings =
+					&power_info->power_down_setting[
+						pwr_down - 1];
+					pwr_settings->delay +=
+						wait_cmd->delay;
+				} else {
+					CAM_ERR(CAM_SENSOR,
+					"Delay is expected only after valid power up setting");
+				}
+			} else {
+				CAM_DBG(CAM_SENSOR, "Invalid op code: %d",
+					wait_cmd->op_code);
+			}
+
+			tot_size = tot_size +
+				sizeof(struct cam_cmd_unconditional_wait);
+			if (tot_size > cmd_length) {
+				CAM_ERR(CAM_SENSOR, "Command Buffer is wrong");
+				return -EINVAL;
+			}
+			scr = (void *) (wait_cmd);
+			ptr = (void *)
+				(scr +
+				sizeof(struct cam_cmd_unconditional_wait));
+			CAM_DBG(CAM_SENSOR, "ptr: %pK sizeof: %d Next: %pK",
+				scr, (int32_t)sizeof(
+				struct cam_cmd_unconditional_wait), ptr);
+
+			cmm_hdr = (struct common_header *)ptr;
+		} else if (cmm_hdr->cmd_type ==
+			CAMERA_SENSOR_CMD_TYPE_PWR_DOWN) {
+			struct cam_cmd_power *pwr_cmd =
+				(struct cam_cmd_power *)ptr;
+
+			scr = ptr + sizeof(struct cam_cmd_power);
+			tot_size = tot_size + sizeof(struct cam_cmd_power);
+			if ((U16_MAX - power_info->power_down_setting_size) <
+				pwr_cmd->count) {
+				CAM_ERR(CAM_SENSOR, "ERR: Overflow");
+				rc = -EINVAL;
+				goto free_power_settings;
+			}
+
+			power_info->power_down_setting_size += pwr_cmd->count;
+			if ((power_info->power_down_setting_size >
+				MAX_POWER_CONFIG) || (pwr_cmd->count >=
+				SENSOR_SEQ_TYPE_MAX)) {
+				CAM_ERR(CAM_SENSOR,
+				"pwr_down_setting_size %d, pwr_cmd->count: %d",
+					power_info->power_down_setting_size,
+					pwr_cmd->count);
+				rc = -EINVAL;
+				goto free_power_settings;
+			}
+
+			if (pwr_cmd->count == 0)
+				CAM_ERR(CAM_SENSOR, "pwr_down size is zero");
+
+			for (i = 0; i < pwr_cmd->count; i++, pwr_down++) {
+				pwr_settings =
+				&power_info->power_down_setting[pwr_down];
+				pwr_settings->seq_type =
+				pwr_cmd->power_settings_flex[i].power_seq_type;
+				pwr_settings->config_val =
+				pwr_cmd->power_settings_flex[i].config_val_low;
+				power_info->power_down_setting[pwr_down].delay
+					= 0;
+				if (i) {
+					scr = scr +
+						sizeof(
+						struct cam_power_settings);
+					tot_size =
+						tot_size +
+						sizeof(
+						struct cam_power_settings);
+				}
+				if (tot_size > cmd_length) {
+					CAM_ERR(CAM_SENSOR,
+						"Command Buffer is wrong");
+					rc = -EINVAL;
+					goto free_power_settings;
+				}
+				CAM_DBG(CAM_SENSOR,
+					"Seq Type[%d]: %d Config_val: %ld",
+					pwr_down, pwr_settings->seq_type,
+					pwr_settings->config_val);
+			}
+			last_cmd_type = CAMERA_SENSOR_CMD_TYPE_PWR_DOWN;
+			ptr = (void *) scr;
+			cmm_hdr = (struct common_header *)ptr;
+		} else {
+			CAM_ERR(CAM_SENSOR,
+				"Error: Un expected Header Type: %d",
+				cmm_hdr->cmd_type);
+			rc = -EINVAL;
+			goto free_power_settings;
+		}
+	}
+
+	goto free_power_command;
+free_power_settings:
+	kfree(power_info->power_down_setting);
+	kfree(power_info->power_setting);
+	power_info->power_down_setting = NULL;
+	power_info->power_setting = NULL;
+	power_info->power_down_setting_size = 0;
+	power_info->power_setting_size = 0;
+free_power_command:
+	kfree(pwr_cmd);
+	pwr_cmd = NULL;
+	return rc;
+}
+
+int cam_get_dt_power_setting_data(struct device_node *of_node,
+	struct cam_hw_soc_info *soc_info,
+	struct cam_sensor_power_ctrl_t *power_info)
+{
+	int rc = 0, i;
+	int count = 0;
+	const char *seq_name = NULL;
+	uint32_t *array = NULL;
+	struct cam_sensor_power_setting *ps;
+	int c, end;
+
+	if (!power_info)
+		return -EINVAL;
+
+	count = of_property_count_strings(of_node, "qcom,cam-power-seq-type");
+	power_info->power_setting_size = count;
+
+	CAM_DBG(CAM_SENSOR, "qcom,cam-power-seq-type count %d", count);
+
+	if (count <= 0)
+		return 0;
+
+	ps = kcalloc(count, sizeof(*ps), GFP_KERNEL);
+	if (!ps)
+		return -ENOMEM;
+	power_info->power_setting = ps;
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node,
+			"qcom,cam-power-seq-type", i, &seq_name);
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "failed");
+			goto ERROR1;
+		}
+		CAM_DBG(CAM_SENSOR, "seq_name[%d] = %s", i, seq_name);
+		if (!strcmp(seq_name, "cam_vio")) {
+			ps[i].seq_type = SENSOR_VIO;
+		} else if (!strcmp(seq_name, "cam_vana")) {
+			ps[i].seq_type = SENSOR_VANA;
+		} else if (!strcmp(seq_name, "cam_vana1")) {
+			ps[i].seq_type = SENSOR_VANA1;
+		} else if (!strcmp(seq_name, "cam_clk")) {
+			ps[i].seq_type = SENSOR_MCLK;
+		} else {
+			CAM_ERR(CAM_SENSOR, "unrecognized seq-type %s",
+				seq_name);
+			rc = -EILSEQ;
+			goto ERROR1;
+		}
+		CAM_DBG(CAM_SENSOR, "seq_type[%d] %d", i, ps[i].seq_type);
+	}
+
+	array = kcalloc(count, sizeof(uint32_t), GFP_KERNEL);
+	if (!array) {
+		rc = -ENOMEM;
+		goto ERROR1;
+	}
+
+	rc = of_property_read_u32_array(of_node, "qcom,cam-power-seq-cfg-val",
+		array, count);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed ");
+		goto ERROR2;
+	}
+
+	for (i = 0; i < count; i++) {
+		ps[i].config_val = array[i];
+		CAM_DBG(CAM_SENSOR, "power_setting[%d].config_val = %ld", i,
+			ps[i].config_val);
+	}
+
+	rc = of_property_read_u32_array(of_node, "qcom,cam-power-seq-delay",
+		array, count);
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "failed");
+		goto ERROR2;
+	}
+	for (i = 0; i < count; i++) {
+		ps[i].delay = array[i];
+		CAM_DBG(CAM_SENSOR, "power_setting[%d].delay = %d", i,
+			ps[i].delay);
+	}
+	kfree(array);
+
+	power_info->power_down_setting =
+		kcalloc(count, sizeof(*ps), GFP_KERNEL);
+
+	if (!power_info->power_down_setting) {
+		CAM_ERR(CAM_SENSOR, "failed");
+		rc = -ENOMEM;
+		goto ERROR1;
+	}
+
+	power_info->power_down_setting_size = count;
+
+	end = count - 1;
+
+	for (c = 0; c < count; c++) {
+		power_info->power_down_setting[c] = ps[end];
+		end--;
+	}
+	return rc;
+ERROR2:
+	kfree(array);
+ERROR1:
+	kfree(ps);
+	return rc;
+}
+
+int cam_sensor_util_init_gpio_pin_tbl(
+	struct cam_hw_soc_info *soc_info,
+	struct msm_camera_gpio_num_info **pgpio_num_info)
+{
+	int rc = 0, val = 0;
+	uint32_t gpio_array_size;
+	struct device_node *of_node = NULL;
+	struct cam_soc_gpio_data *gconf = NULL;
+	struct msm_camera_gpio_num_info *gpio_num_info = NULL;
+
+	if (!soc_info->dev) {
+		CAM_ERR(CAM_SENSOR, "device node NULL");
+		return -EINVAL;
+	}
+
+	of_node = soc_info->dev->of_node;
+
+	gconf = soc_info->gpio_data;
+	if (!gconf) {
+		CAM_ERR(CAM_SENSOR, "No gpio_common_table is found");
+		return -EINVAL;
+	}
+
+	if (!gconf->cam_gpio_common_tbl) {
+		CAM_ERR(CAM_SENSOR, "gpio_common_table is not initialized");
+		return -EINVAL;
+	}
+
+	gpio_array_size = gconf->cam_gpio_common_tbl_size;
+
+	if (!gpio_array_size) {
+		CAM_ERR(CAM_SENSOR, "invalid size of gpio table");
+		return -EINVAL;
+	}
+
+	*pgpio_num_info = kzalloc(sizeof(struct msm_camera_gpio_num_info),
+		GFP_KERNEL);
+	if (!*pgpio_num_info)
+		return -ENOMEM;
+	gpio_num_info = *pgpio_num_info;
+
+	rc = of_property_read_u32(of_node, "gpio-vana", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "read gpio-vana failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-vana invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VANA] =
+				gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VANA] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-vana %d",
+			gpio_num_info->gpio_num[SENSOR_VANA]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-vana1", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "read gpio-vana1 failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-vana1 invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VANA1] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VANA1] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-vana1 %d",
+			gpio_num_info->gpio_num[SENSOR_VANA1]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-vio", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "read gpio-vio failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-vio invalid %d", val);
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VIO] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VIO] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-vio %d",
+			gpio_num_info->gpio_num[SENSOR_VIO]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-vaf", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "read gpio-vaf failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-vaf invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VAF] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VAF] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-vaf %d",
+			gpio_num_info->gpio_num[SENSOR_VAF]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-vdig", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "read gpio-vdig failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-vdig invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VDIG] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VDIG] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-vdig %d",
+				gpio_num_info->gpio_num[SENSOR_VDIG]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-reset", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR, "read gpio-reset failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-reset invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_RESET] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_RESET] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-reset %d",
+			gpio_num_info->gpio_num[SENSOR_RESET]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-standby", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"read gpio-standby failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-standby invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_STANDBY] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_STANDBY] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-standby %d",
+			gpio_num_info->gpio_num[SENSOR_STANDBY]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-af-pwdm", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"read gpio-af-pwdm failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-af-pwdm invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_VAF_PWDM] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_VAF_PWDM] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-af-pwdm %d",
+			gpio_num_info->gpio_num[SENSOR_VAF_PWDM]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-custom1", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"read gpio-custom1 failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-custom1 invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_CUSTOM_GPIO1] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_CUSTOM_GPIO1] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-custom1 %d",
+			gpio_num_info->gpio_num[SENSOR_CUSTOM_GPIO1]);
+	}
+
+	rc = of_property_read_u32(of_node, "gpio-custom2", &val);
+	if (rc != -EINVAL) {
+		if (rc < 0) {
+			CAM_ERR(CAM_SENSOR,
+				"read gpio-custom2 failed rc %d", rc);
+			goto free_gpio_info;
+		} else if (val >= gpio_array_size) {
+			CAM_ERR(CAM_SENSOR, "gpio-custom2 invalid %d", val);
+			rc = -EINVAL;
+			goto free_gpio_info;
+		}
+		gpio_num_info->gpio_num[SENSOR_CUSTOM_GPIO2] =
+			gconf->cam_gpio_common_tbl[val].gpio;
+		gpio_num_info->valid[SENSOR_CUSTOM_GPIO2] = 1;
+
+		CAM_DBG(CAM_SENSOR, "gpio-custom2 %d",
+			gpio_num_info->gpio_num[SENSOR_CUSTOM_GPIO2]);
+	} else {
+		rc = 0;
+	}
+
+	return rc;
+
+free_gpio_info:
+	kfree(gpio_num_info);
+	gpio_num_info = NULL;
+	return rc;
+}
+
+int msm_camera_pinctrl_init(
+	struct msm_pinctrl_info *sensor_pctrl, struct device *dev)
+{
+
+	sensor_pctrl->pinctrl = devm_pinctrl_get(dev);
+	if (IS_ERR_OR_NULL(sensor_pctrl->pinctrl)) {
+		CAM_DBG(CAM_SENSOR, "Getting pinctrl handle failed");
+		return -EINVAL;
+	}
+	sensor_pctrl->gpio_state_active =
+		pinctrl_lookup_state(sensor_pctrl->pinctrl,
+				CAM_SENSOR_PINCTRL_STATE_DEFAULT);
+	if (IS_ERR_OR_NULL(sensor_pctrl->gpio_state_active)) {
+		CAM_ERR(CAM_SENSOR,
+			"Failed to get the active state pinctrl handle");
+		return -EINVAL;
+	}
+	sensor_pctrl->gpio_state_suspend
+		= pinctrl_lookup_state(sensor_pctrl->pinctrl,
+				CAM_SENSOR_PINCTRL_STATE_SLEEP);
+	if (IS_ERR_OR_NULL(sensor_pctrl->gpio_state_suspend)) {
+		CAM_ERR(CAM_SENSOR,
+			"Failed to get the suspend state pinctrl handle");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_sensor_bob_pwm_mode_switch(struct cam_hw_soc_info *soc_info,
+	int bob_reg_idx, bool flag)
+{
+	int rc = 0;
+	uint32_t op_current =
+		(flag == true) ? soc_info->rgltr_op_mode[bob_reg_idx] : 0;
+
+	if (soc_info->rgltr[bob_reg_idx] != NULL) {
+		rc = regulator_set_load(soc_info->rgltr[bob_reg_idx],
+			op_current);
+		if (rc)
+			CAM_WARN(CAM_SENSOR,
+				"BoB PWM SetLoad failed rc: %d", rc);
+	}
+
+	return rc;
+}
+
+static int msm_cam_sensor_handle_reg_gpio(int seq_type,
+	struct msm_camera_gpio_num_info *gpio_num_info, int val)
+{
+	int gpio_offset = -1;
+
+	if (!gpio_num_info) {
+		CAM_INFO(CAM_SENSOR, "Input Parameters are not proper");
+		return 0;
+	}
+
+	CAM_DBG(CAM_SENSOR, "Seq type: %d, config: %d", seq_type, val);
+
+	gpio_offset = seq_type;
+
+	if (gpio_num_info->valid[gpio_offset] == 1) {
+		CAM_DBG(CAM_SENSOR, "VALID GPIO offset: %d, seqtype: %d",
+			 gpio_offset, seq_type);
+		cam_res_mgr_gpio_set_value(
+			gpio_num_info->gpio_num
+			[gpio_offset], val);
+	}
+
+	return 0;
+}
+
+static int cam_config_mclk_reg(struct cam_sensor_power_ctrl_t *ctrl,
+	struct cam_hw_soc_info *soc_info, int32_t index)
+{
+	int32_t num_vreg = 0, j = 0, rc = 0, idx = 0;
+	struct cam_sensor_power_setting *ps = NULL;
+	struct cam_sensor_power_setting *pd = NULL;
+
+	num_vreg = soc_info->num_rgltr;
+
+	pd = &ctrl->power_down_setting[index];
+
+	for (j = 0; j < num_vreg; j++) {
+		if (!strcmp(soc_info->rgltr_name[j], "cam_clk")) {
+			ps = NULL;
+			for (idx = 0; idx < ctrl->power_setting_size; idx++) {
+				if (ctrl->power_setting[idx].seq_type ==
+					pd->seq_type) {
+					ps = &ctrl->power_setting[idx];
+					break;
+				}
+			}
+
+			if (ps != NULL) {
+				CAM_DBG(CAM_SENSOR, "Disable MCLK Regulator");
+				rc = cam_soc_util_regulator_disable(
+					soc_info->rgltr[j],
+					soc_info->rgltr_name[j],
+					soc_info->rgltr_min_volt[j],
+					soc_info->rgltr_max_volt[j],
+					soc_info->rgltr_op_mode[j],
+					soc_info->rgltr_delay[j]);
+
+				if (rc) {
+					CAM_ERR(CAM_SENSOR,
+						"MCLK REG DISALBE FAILED: %d",
+						rc);
+					return rc;
+				}
+
+				ps->data[0] =
+					soc_info->rgltr[j];
+			}
+		}
+	}
+
+	return rc;
+}
+
+int cam_sensor_util_request_power_domain(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = cam_soc_util_configure_pd(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_SENSOR, "Failed to configure Genpd");
+		return rc;
+	}
+
+	pm_runtime_enable(soc_info->dev);
+
+	/*
+	 * Doing a pm_runtime_get_sync() and pm_runtime_put_sync() after pm_runtime_enable
+	 * makes sure that the GDSC is off and only enabled later by the usecase when there
+	 * is such a requirement.
+	 */
+	cam_soc_util_power_domain_enable_default(soc_info);
+	cam_soc_util_power_domain_disable_default(soc_info);
+
+	return rc;
+}
+
+void cam_sensor_util_release_power_domain(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+
+	pm_runtime_disable(soc_info->dev);
+
+	for (i = 0; i < soc_info->num_genpd; i++) {
+		if (!soc_info->genpd)
+			continue;
+		if (!soc_info->genpd[i])
+			continue;
+		dev_pm_domain_detach(soc_info->genpd[i], true);
+	}
+}
+
+int cam_sensor_core_power_up(struct cam_sensor_power_ctrl_t *ctrl,
+		struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0, index = 0, no_gpio = 0, ret = 0, num_vreg, j = 0, i = 0;
+	int32_t vreg_idx = -1;
+	struct cam_sensor_power_setting *power_setting = NULL;
+	struct msm_camera_gpio_num_info *gpio_num_info = NULL;
+
+	CAM_DBG(CAM_SENSOR, "Enter");
+	if (!ctrl) {
+		CAM_ERR(CAM_SENSOR, "Invalid ctrl handle");
+		return -EINVAL;
+	}
+
+	gpio_num_info = ctrl->gpio_num_info;
+	num_vreg = soc_info->num_rgltr;
+
+	if ((num_vreg <= 0) || (num_vreg > CAM_SOC_MAX_REGULATOR)) {
+		CAM_ERR(CAM_SENSOR, "failed: num_vreg %d", num_vreg);
+		return -EINVAL;
+	}
+
+	ret = msm_camera_pinctrl_init(&(ctrl->pinctrl_info), ctrl->dev);
+	if (ret < 0) {
+		/* Some sensor subdev no pinctrl. */
+		CAM_DBG(CAM_SENSOR, "Initialization of pinctrl failed");
+		ctrl->cam_pinctrl_status = 0;
+	} else {
+		ctrl->cam_pinctrl_status = 1;
+	}
+
+	rc = cam_sensor_util_request_gpio_table(soc_info, 1);
+	if (rc < 0) {
+		no_gpio = rc;
+	}
+
+	if (ctrl->cam_pinctrl_status) {
+		ret = pinctrl_select_state(
+			ctrl->pinctrl_info.pinctrl,
+			ctrl->pinctrl_info.gpio_state_active);
+		if (ret)
+			CAM_ERR(CAM_SENSOR, "cannot set pin to active state");
+	}
+
+	CAM_DBG(CAM_SENSOR, "power setting size: %d", ctrl->power_setting_size);
+
+	for (index = 0; index < ctrl->power_setting_size; index++) {
+		CAM_DBG(CAM_SENSOR, "index: %d", index);
+		power_setting = &ctrl->power_setting[index];
+		if (!power_setting) {
+			CAM_ERR(CAM_SENSOR,
+				"Invalid power up settings for index %d",
+				index);
+			return -EINVAL;
+		}
+
+		CAM_DBG(CAM_SENSOR, "seq_type %d", power_setting->seq_type);
+
+		switch (power_setting->seq_type) {
+		case SENSOR_MCLK:
+			if (power_setting->seq_val >= soc_info->num_clk) {
+				CAM_ERR(CAM_SENSOR, "clk index %d >= max %u",
+					power_setting->seq_val,
+					soc_info->num_clk);
+				goto power_up_failed;
+			}
+			for (j = 0; j < num_vreg; j++) {
+				if (!strcmp(soc_info->rgltr_name[j],
+					"cam_clk")) {
+					CAM_DBG(CAM_SENSOR,
+						"Enable cam_clk: %d", j);
+
+					if (IS_ERR_OR_NULL(
+						soc_info->rgltr[j])) {
+						rc = PTR_ERR(
+							soc_info->rgltr[j]);
+						rc = rc ? rc : -EINVAL;
+						CAM_ERR(CAM_SENSOR,
+							"vreg %s %d",
+							soc_info->rgltr_name[j],
+							rc);
+						soc_info->rgltr[j] = NULL;
+						goto power_up_failed;
+					}
+
+					rc =  cam_soc_util_regulator_enable(
+					soc_info->rgltr[j],
+					soc_info->rgltr_name[j],
+					soc_info->rgltr_min_volt[j],
+					soc_info->rgltr_max_volt[j],
+					soc_info->rgltr_op_mode[j],
+					soc_info->rgltr_delay[j]);
+					if (rc) {
+						CAM_ERR(CAM_SENSOR,
+							"Reg enable failed");
+						goto power_up_failed;
+					}
+					power_setting->data[0] =
+						soc_info->rgltr[j];
+				}
+			}
+			if (power_setting->config_val)
+				soc_info->clk_rate[0][power_setting->seq_val] =
+					power_setting->config_val;
+
+			for (j = 0; j < soc_info->num_clk; j++) {
+				rc = cam_soc_util_clk_enable(soc_info->clk[j],
+					soc_info->clk_name[j],
+					soc_info->clk_rate[0][j],
+					NULL);
+				if (rc)
+					break;
+			}
+
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR, "clk enable failed");
+				goto power_up_failed;
+			}
+			break;
+		case SENSOR_RESET:
+		case SENSOR_STANDBY:
+		case SENSOR_CUSTOM_GPIO1:
+		case SENSOR_CUSTOM_GPIO2:
+			if (no_gpio) {
+				CAM_ERR(CAM_SENSOR, "request gpio failed");
+				goto power_up_failed;
+			}
+			if (!gpio_num_info) {
+				CAM_ERR(CAM_SENSOR, "Invalid gpio_num_info");
+				goto power_up_failed;
+			}
+			CAM_DBG(CAM_SENSOR, "gpio set val %d",
+				gpio_num_info->gpio_num
+				[power_setting->seq_type]);
+
+			rc = msm_cam_sensor_handle_reg_gpio(
+				power_setting->seq_type,
+				gpio_num_info,
+				(int) power_setting->config_val);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"Error in handling VREG GPIO");
+				goto power_up_failed;
+			}
+			break;
+		case SENSOR_VANA:
+		case SENSOR_VANA1:
+		case SENSOR_VDIG:
+		case SENSOR_VIO:
+		case SENSOR_VAF:
+		case SENSOR_VAF_PWDM:
+		case SENSOR_CUSTOM_REG1:
+		case SENSOR_CUSTOM_REG2:
+			if (power_setting->seq_val == INVALID_VREG)
+				break;
+
+			if (power_setting->seq_val >= CAM_VREG_MAX) {
+				CAM_ERR(CAM_SENSOR, "vreg index %d >= max %d",
+					power_setting->seq_val,
+					CAM_VREG_MAX);
+				goto power_up_failed;
+			}
+			if (power_setting->seq_val < num_vreg) {
+				CAM_DBG(CAM_SENSOR, "Enable Regulator");
+				vreg_idx = power_setting->seq_val;
+
+				if (IS_ERR_OR_NULL(
+					soc_info->rgltr[vreg_idx])) {
+					rc = PTR_ERR(soc_info->rgltr[vreg_idx]);
+					rc = rc ? rc : -EINVAL;
+
+					CAM_ERR(CAM_SENSOR, "%s get failed %d",
+						soc_info->rgltr_name[vreg_idx],
+						rc);
+
+					soc_info->rgltr[vreg_idx] = NULL;
+					goto power_up_failed;
+				}
+
+				rc =  cam_soc_util_regulator_enable(
+					soc_info->rgltr[vreg_idx],
+					soc_info->rgltr_name[vreg_idx],
+					soc_info->rgltr_min_volt[vreg_idx],
+					soc_info->rgltr_max_volt[vreg_idx],
+					soc_info->rgltr_op_mode[vreg_idx],
+					soc_info->rgltr_delay[vreg_idx]);
+				if (rc) {
+					CAM_ERR(CAM_SENSOR,
+						"Reg Enable failed for %s",
+						soc_info->rgltr_name[vreg_idx]);
+					goto power_up_failed;
+				}
+				power_setting->data[0] =
+						soc_info->rgltr[vreg_idx];
+			} else {
+				CAM_ERR(CAM_SENSOR, "usr_idx:%d dts_idx:%d",
+					power_setting->seq_val, num_vreg);
+			}
+
+			rc = cam_soc_util_power_domain_enable_default(soc_info);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"Power domain enable failed with rc = %d", rc);
+				goto power_up_failed;
+			}
+			rc = msm_cam_sensor_handle_reg_gpio(
+				power_setting->seq_type,
+				gpio_num_info, 1);
+			if (rc < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"Error in handling VREG GPIO");
+				goto power_up_failed;
+			}
+			break;
+		default:
+			CAM_ERR(CAM_SENSOR, "error power seq type %d",
+				power_setting->seq_type);
+			break;
+		}
+		if (power_setting->delay > 20)
+			msleep(power_setting->delay);
+		else if (power_setting->delay)
+			usleep_range(power_setting->delay * 1000,
+				(power_setting->delay * 1000) + 1000);
+	}
+
+	return 0;
+power_up_failed:
+	CAM_ERR(CAM_SENSOR, "failed");
+	for (index--; index >= 0; index--) {
+		CAM_DBG(CAM_SENSOR, "index %d",  index);
+		power_setting = &ctrl->power_setting[index];
+		CAM_DBG(CAM_SENSOR, "type %d",
+			power_setting->seq_type);
+		switch (power_setting->seq_type) {
+		case SENSOR_MCLK:
+			for (i = soc_info->num_clk - 1; i >= 0; i--) {
+				cam_soc_util_clk_disable(soc_info->clk[i],
+					soc_info->clk_name[i]);
+			}
+			ret = cam_config_mclk_reg(ctrl, soc_info, index);
+			if (ret < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"config clk reg failed rc: %d", ret);
+				continue;
+			}
+			break;
+		case SENSOR_RESET:
+		case SENSOR_STANDBY:
+		case SENSOR_CUSTOM_GPIO1:
+		case SENSOR_CUSTOM_GPIO2:
+			if (!gpio_num_info)
+				continue;
+			if (!gpio_num_info->valid
+				[power_setting->seq_type])
+				continue;
+			cam_res_mgr_gpio_set_value(
+				gpio_num_info->gpio_num
+				[power_setting->seq_type], GPIOF_OUT_INIT_LOW);
+			break;
+		case SENSOR_VANA:
+		case SENSOR_VANA1:
+		case SENSOR_VDIG:
+		case SENSOR_VIO:
+		case SENSOR_VAF:
+		case SENSOR_VAF_PWDM:
+		case SENSOR_CUSTOM_REG1:
+		case SENSOR_CUSTOM_REG2:
+			if (power_setting->seq_val < num_vreg) {
+				CAM_DBG(CAM_SENSOR, "Disable Regulator");
+				vreg_idx = power_setting->seq_val;
+
+				rc =  cam_soc_util_regulator_disable(
+					soc_info->rgltr[vreg_idx],
+					soc_info->rgltr_name[vreg_idx],
+					soc_info->rgltr_min_volt[vreg_idx],
+					soc_info->rgltr_max_volt[vreg_idx],
+					soc_info->rgltr_op_mode[vreg_idx],
+					soc_info->rgltr_delay[vreg_idx]);
+
+				if (rc) {
+					CAM_ERR(CAM_SENSOR,
+					"Fail to disalbe reg: %s",
+					soc_info->rgltr_name[vreg_idx]);
+					soc_info->rgltr[vreg_idx] = NULL;
+					msm_cam_sensor_handle_reg_gpio(
+						power_setting->seq_type,
+						gpio_num_info,
+						GPIOF_OUT_INIT_LOW);
+					continue;
+				}
+				power_setting->data[0] =
+						soc_info->rgltr[vreg_idx];
+
+			} else {
+				CAM_ERR(CAM_SENSOR, "seq_val:%d > num_vreg: %d",
+					power_setting->seq_val, num_vreg);
+			}
+
+			cam_soc_util_power_domain_disable_default(soc_info);
+
+			msm_cam_sensor_handle_reg_gpio(power_setting->seq_type,
+				gpio_num_info, GPIOF_OUT_INIT_LOW);
+
+			break;
+		default:
+			CAM_ERR(CAM_SENSOR, "error power seq type %d",
+				power_setting->seq_type);
+			break;
+		}
+		if (power_setting->delay > 20) {
+			msleep(power_setting->delay);
+		} else if (power_setting->delay) {
+			usleep_range(power_setting->delay * 1000,
+				(power_setting->delay * 1000) + 1000);
+		}
+	}
+
+	if (ctrl->cam_pinctrl_status) {
+		ret = pinctrl_select_state(
+			ctrl->pinctrl_info.pinctrl,
+			ctrl->pinctrl_info.gpio_state_suspend);
+		if (ret)
+			CAM_ERR(CAM_SENSOR, "cannot set pin to suspend state");
+		devm_pinctrl_put(ctrl->pinctrl_info.pinctrl);
+	}
+
+	ctrl->cam_pinctrl_status = 0;
+	cam_sensor_util_request_gpio_table(soc_info, 0);
+
+	return rc;
+}
+
+static struct cam_sensor_power_setting*
+msm_camera_get_power_settings(struct cam_sensor_power_ctrl_t *ctrl,
+				enum msm_camera_power_seq_type seq_type,
+				uint16_t seq_val)
+{
+	struct cam_sensor_power_setting *power_setting, *ps = NULL;
+	int idx;
+
+	for (idx = 0; idx < ctrl->power_setting_size; idx++) {
+		power_setting = &ctrl->power_setting[idx];
+		if (power_setting->seq_type == seq_type &&
+			power_setting->seq_val ==  seq_val) {
+			ps = power_setting;
+			return ps;
+		}
+
+	}
+
+	return ps;
+}
+
+int cam_sensor_util_power_down(struct cam_sensor_power_ctrl_t *ctrl,
+		struct cam_hw_soc_info *soc_info)
+{
+	int index = 0, ret = 0, num_vreg = 0, i;
+	struct cam_sensor_power_setting *pd = NULL;
+	struct cam_sensor_power_setting *ps = NULL;
+	struct msm_camera_gpio_num_info *gpio_num_info = NULL;
+
+	CAM_DBG(CAM_SENSOR, "Enter");
+	if (!ctrl || !soc_info) {
+		CAM_ERR(CAM_SENSOR, "failed ctrl %pK",  ctrl);
+		return -EINVAL;
+	}
+
+	gpio_num_info = ctrl->gpio_num_info;
+	num_vreg = soc_info->num_rgltr;
+
+	if ((num_vreg <= 0) || (num_vreg > CAM_SOC_MAX_REGULATOR)) {
+		CAM_ERR(CAM_SENSOR, "failed: num_vreg %d", num_vreg);
+		return -EINVAL;
+	}
+
+	if (ctrl->power_down_setting_size > MAX_POWER_CONFIG) {
+		CAM_ERR(CAM_SENSOR, "Invalid: power setting size %d",
+			ctrl->power_setting_size);
+		return -EINVAL;
+	}
+
+	for (index = 0; index < ctrl->power_down_setting_size; index++) {
+		CAM_DBG(CAM_SENSOR, "power_down_index %d",  index);
+		pd = &ctrl->power_down_setting[index];
+		if (!pd) {
+			CAM_ERR(CAM_SENSOR,
+				"Invalid power down settings for index %d",
+				index);
+			return -EINVAL;
+		}
+
+		ps = NULL;
+		CAM_DBG(CAM_SENSOR, "seq_type %d",  pd->seq_type);
+		switch (pd->seq_type) {
+		case SENSOR_MCLK:
+			for (i = soc_info->num_clk - 1; i >= 0; i--) {
+				cam_soc_util_clk_disable(soc_info->clk[i],
+					soc_info->clk_name[i]);
+			}
+
+			ret = cam_config_mclk_reg(ctrl, soc_info, index);
+			if (ret < 0) {
+				CAM_ERR(CAM_SENSOR,
+					"config clk reg failed rc: %d", ret);
+				continue;
+			}
+			break;
+		case SENSOR_RESET:
+		case SENSOR_STANDBY:
+		case SENSOR_CUSTOM_GPIO1:
+		case SENSOR_CUSTOM_GPIO2:
+
+			if (!gpio_num_info) {
+				CAM_ERR(CAM_SENSOR, "failed: No gpio");
+				continue;
+			}
+			if (!gpio_num_info->valid[pd->seq_type])
+				continue;
+
+			cam_res_mgr_gpio_set_value(
+				gpio_num_info->gpio_num
+				[pd->seq_type],
+				(int) pd->config_val);
+
+			break;
+		case SENSOR_VANA:
+		case SENSOR_VANA1:
+		case SENSOR_VDIG:
+		case SENSOR_VIO:
+		case SENSOR_VAF:
+		case SENSOR_VAF_PWDM:
+		case SENSOR_CUSTOM_REG1:
+		case SENSOR_CUSTOM_REG2:
+			if (pd->seq_val == INVALID_VREG)
+				break;
+
+			ps = msm_camera_get_power_settings(
+				ctrl, pd->seq_type,
+				pd->seq_val);
+			if (ps) {
+				if (pd->seq_val < num_vreg) {
+					CAM_DBG(CAM_SENSOR,
+						"Disable Regulator");
+					ret =  cam_soc_util_regulator_disable(
+					soc_info->rgltr[ps->seq_val],
+					soc_info->rgltr_name[ps->seq_val],
+					soc_info->rgltr_min_volt[ps->seq_val],
+					soc_info->rgltr_max_volt[ps->seq_val],
+					soc_info->rgltr_op_mode[ps->seq_val],
+					soc_info->rgltr_delay[ps->seq_val]);
+					if (ret) {
+						CAM_ERR(CAM_SENSOR,
+						"Reg: %s disable failed",
+						soc_info->rgltr_name[
+							ps->seq_val]);
+						soc_info->rgltr[ps->seq_val] =
+							NULL;
+						msm_cam_sensor_handle_reg_gpio(
+							pd->seq_type,
+							gpio_num_info,
+							GPIOF_OUT_INIT_LOW);
+						continue;
+					}
+					ps->data[0] =
+						soc_info->rgltr[ps->seq_val];
+				} else {
+					CAM_ERR(CAM_SENSOR,
+						"seq_val:%d > num_vreg: %d",
+						 pd->seq_val,
+						num_vreg);
+				}
+			} else
+				CAM_ERR(CAM_SENSOR,
+					"error in power up/down seq");
+
+			cam_soc_util_power_domain_disable_default(soc_info);
+
+			ret = msm_cam_sensor_handle_reg_gpio(pd->seq_type,
+				gpio_num_info, GPIOF_OUT_INIT_LOW);
+
+			if (ret < 0)
+				CAM_ERR(CAM_SENSOR,
+					"Error disabling VREG GPIO");
+			break;
+		default:
+			CAM_ERR(CAM_SENSOR, "error power seq type %d",
+				pd->seq_type);
+			break;
+		}
+		if (pd->delay > 20)
+			msleep(pd->delay);
+		else if (pd->delay)
+			usleep_range(pd->delay * 1000,
+				(pd->delay * 1000) + 1000);
+	}
+
+	if (ctrl->cam_pinctrl_status) {
+		ret = pinctrl_select_state(
+				ctrl->pinctrl_info.pinctrl,
+				ctrl->pinctrl_info.gpio_state_suspend);
+		if (ret)
+			CAM_ERR(CAM_SENSOR, "cannot set pin to suspend state");
+
+		devm_pinctrl_put(ctrl->pinctrl_info.pinctrl);
+	}
+
+	cam_sensor_util_request_gpio_table(soc_info, 0);
+	ctrl->cam_pinctrl_status = 0;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.h
@@ -0,0 +1,94 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SENSOR_UTIL_H_
+#define _CAM_SENSOR_UTIL_H_
+
+#include <linux/kernel.h>
+#include <linux/regulator/consumer.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <linux/of.h>
+#include "cam_sensor_cmn_header.h"
+#include "cam_req_mgr_util.h"
+#include "cam_req_mgr_interface.h"
+#include <cam_mem_mgr.h>
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_sensor_io.h"
+
+#define INVALID_VREG 100
+#define RES_MGR_GPIO_NEED_HOLD   1
+#define RES_MGR_GPIO_CAN_FREE    2
+
+/*
+ * Constant Factors needed to change QTimer ticks to nanoseconds
+ * QTimer Freq = 19.2 MHz
+ * Time(us) = ticks/19.2
+ * Time(ns) = ticks/19.2 * 1000
+ */
+#define QTIMER_MUL_FACTOR   10000
+#define QTIMER_DIV_FACTOR   192
+
+int cam_get_dt_power_setting_data(struct device_node *of_node,
+	struct cam_hw_soc_info *soc_info,
+	struct cam_sensor_power_ctrl_t *power_info);
+
+int msm_camera_pinctrl_init
+	(struct msm_pinctrl_info *sensor_pctrl, struct device *dev);
+
+int32_t cam_sensor_util_get_current_qtimer_ns(uint64_t *qtime_ns);
+
+int32_t cam_sensor_util_regulator_powerup(
+	struct cam_hw_soc_info *soc_info);
+
+int32_t cam_sensor_util_write_qtimer_to_io_buffer(
+	struct cam_buf_io_cfg *io_cfg);
+
+int cam_sensor_i2c_command_parser(struct camera_io_master *io_master,
+	struct i2c_settings_array *i2c_reg_settings,
+	struct cam_cmd_buf_desc *cmd_desc, int32_t num_cmd_buffers,
+	struct cam_buf_io_cfg *io_cfg);
+
+int cam_sensor_util_i2c_apply_setting(struct camera_io_master *io_master_info,
+	struct i2c_settings_list *i2c_list);
+
+int32_t cam_sensor_i2c_read_data(
+	struct i2c_settings_array *i2c_settings,
+	struct camera_io_master *io_master_info);
+
+int32_t delete_request(struct i2c_settings_array *i2c_array);
+int cam_sensor_util_request_gpio_table(
+	struct cam_hw_soc_info *soc_info, int gpio_en);
+
+int cam_sensor_util_init_gpio_pin_tbl(
+	struct cam_hw_soc_info *soc_info,
+	struct msm_camera_gpio_num_info **pgpio_num_info);
+
+int cam_sensor_util_request_power_domain(
+	struct cam_hw_soc_info *soc_info);
+
+void cam_sensor_util_release_power_domain(
+	struct cam_hw_soc_info *soc_info);
+
+int cam_sensor_core_power_up(struct cam_sensor_power_ctrl_t *ctrl,
+		struct cam_hw_soc_info *soc_info);
+
+int cam_sensor_util_power_down(struct cam_sensor_power_ctrl_t *ctrl,
+		struct cam_hw_soc_info *soc_info);
+
+int msm_camera_fill_vreg_params(struct cam_hw_soc_info *soc_info,
+	struct cam_sensor_power_setting *power_setting,
+	uint16_t power_setting_size);
+
+int32_t cam_sensor_update_power_settings(void *cmd_buf,
+	uint32_t cmd_length, struct cam_sensor_power_ctrl_t *power_info,
+	size_t cmd_buf_len);
+
+int cam_sensor_bob_pwm_mode_switch(struct cam_hw_soc_info *soc_info,
+	int bob_reg_idx, bool flag);
+
+bool cam_sensor_util_check_gpio_is_shared(struct cam_hw_soc_info *soc_info);
+#endif /* _CAM_SENSOR_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_smmu/cam_smmu_api.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_smmu/cam_smmu_api.c
@@ -0,0 +1,4288 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/dma-buf.h>
+#include <linux/dma-direction.h>
+#include <linux/of_platform.h>
+#include <linux/iommu.h>
+#include <linux/slab.h>
+#include <linux/dma-mapping.h>
+#include <linux/of_address.h>
+#include <linux/workqueue.h>
+#include <linux/genalloc.h>
+#include <linux/debugfs.h>
+
+#include <media/cam_req_mgr.h>
+
+#include "cam_compat.h"
+#include "cam_smmu_api.h"
+#include "cam_debug_util.h"
+#include "camera_main.h"
+#include "cam_trace.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+
+#define IO_MEM_POOL_GRANULARITY 12
+#define SHARED_MEM_POOL_GRANULARITY 16
+
+#define IOMMU_INVALID_DIR -1
+#define BYTE_SIZE 8
+#define COOKIE_NUM_BYTE 2
+#define COOKIE_SIZE (BYTE_SIZE*COOKIE_NUM_BYTE)
+#define COOKIE_MASK ((1<<COOKIE_SIZE)-1)
+#define HANDLE_INIT (-1)
+#define CAM_SMMU_CB_MAX 6
+#define CAM_SMMU_SHARED_HDL_MAX 6
+
+#define GET_SMMU_HDL(x, y) (((x) << COOKIE_SIZE) | ((y) & COOKIE_MASK))
+#define GET_SMMU_TABLE_IDX(x) (((x) >> COOKIE_SIZE) & COOKIE_MASK)
+
+#define CAM_SMMU_MONITOR_MAX_ENTRIES   100
+#define CAM_SMMU_INC_MONITOR_HEAD(head, ret) \
+	div_u64_rem(atomic64_add_return(1, head),\
+	CAM_SMMU_MONITOR_MAX_ENTRIES, (ret))
+
+static int g_num_pf_handled = 1;
+module_param(g_num_pf_handled, int, 0644);
+
+struct platform_device *g_camsmmu_pdev = NULL;
+
+struct cam_fw_alloc_info icp_fw;
+
+struct cam_smmu_work_payload {
+	int idx;
+	struct iommu_domain *domain;
+	struct device *dev;
+	unsigned long iova;
+	int flags;
+	void *token;
+	struct list_head list;
+};
+
+enum cam_io_coherency_mode {
+	CAM_SMMU_NO_COHERENCY,
+	CAM_SMMU_DMA_COHERENT,
+	CAM_SMMU_DMA_COHERENT_HINT_CACHED,
+};
+
+enum cam_protection_type {
+	CAM_PROT_INVALID,
+	CAM_NON_SECURE,
+	CAM_SECURE,
+	CAM_PROT_MAX,
+};
+
+enum cam_iommu_type {
+	CAM_SMMU_INVALID,
+	CAM_QSMMU,
+	CAM_ARM_SMMU,
+	CAM_SMMU_MAX,
+};
+
+enum cam_smmu_buf_state {
+	CAM_SMMU_BUFF_EXIST,
+	CAM_SMMU_BUFF_NOT_EXIST,
+};
+
+enum cam_smmu_init_dir {
+	CAM_SMMU_TABLE_INIT,
+	CAM_SMMU_TABLE_DEINIT,
+};
+
+struct scratch_mapping {
+	void *bitmap;
+	size_t bits;
+	unsigned int order;
+	dma_addr_t base;
+};
+
+struct secheap_buf_info {
+	struct dma_buf *buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *table;
+};
+
+struct cam_smmu_monitor {
+	struct timespec64       timestamp;
+	bool                    is_map;
+
+	/* map-unmap info */
+	int                     ion_fd;
+	dma_addr_t              paddr;
+	size_t                  len;
+	enum cam_smmu_region_id region_id;
+};
+
+struct cam_context_bank_info {
+	struct device *dev;
+	struct iommu_domain *domain;
+	dma_addr_t va_start;
+	size_t va_len;
+	const char *name[CAM_SMMU_SHARED_HDL_MAX];
+	bool is_secure;
+	uint8_t scratch_buf_support;
+	uint8_t firmware_support;
+	uint8_t shared_support;
+	uint8_t io_support;
+	uint8_t secheap_support;
+	uint8_t qdss_support;
+	dma_addr_t qdss_phy_addr;
+	bool is_fw_allocated;
+	bool is_secheap_allocated;
+	bool is_qdss_allocated;
+
+	struct scratch_mapping scratch_map;
+	struct gen_pool *shared_mem_pool;
+	struct gen_pool *io_mem_pool;
+
+	struct cam_smmu_region_info scratch_info;
+	struct cam_smmu_region_info firmware_info;
+	struct cam_smmu_region_info shared_info;
+	struct cam_smmu_region_info io_info;
+	struct cam_smmu_region_info secheap_info;
+	struct cam_smmu_region_info qdss_info;
+	struct secheap_buf_info secheap_buf;
+
+	struct list_head smmu_buf_list;
+	struct list_head smmu_buf_kernel_list;
+	struct mutex lock;
+	int handle;
+	enum cam_smmu_ops_param state;
+
+	void (*handler[CAM_SMMU_CB_MAX]) (struct cam_smmu_pf_info  *pf_info);
+	void *token[CAM_SMMU_CB_MAX];
+	int cb_count;
+	int secure_count;
+	int pf_count;
+	size_t io_mapping_size;
+	size_t shared_mapping_size;
+	bool is_mul_client;
+	int device_count;
+	int num_shared_hdl;
+	enum cam_io_coherency_mode coherency_mode;
+
+	/* discard iova - non-zero values are valid */
+	dma_addr_t discard_iova_start;
+	size_t discard_iova_len;
+
+	atomic64_t  monitor_head;
+	struct cam_smmu_monitor monitor_entries[CAM_SMMU_MONITOR_MAX_ENTRIES];
+};
+
+struct cam_iommu_cb_set {
+	struct cam_context_bank_info *cb_info;
+	u32 cb_num;
+	u32 cb_init_count;
+	struct work_struct smmu_work;
+	struct mutex payload_list_lock;
+	struct list_head payload_list;
+	u32 non_fatal_fault;
+	struct dentry *dentry;
+	bool cb_dump_enable;
+	bool map_profile_enable;
+	bool force_cache_allocs;
+};
+
+static const struct of_device_id msm_cam_smmu_dt_match[] = {
+	{ .compatible = "qcom,msm-cam-smmu", },
+	{ .compatible = "qcom,msm-cam-smmu-cb", },
+	{ .compatible = "qcom,msm-cam-smmu-fw-dev", },
+	{}
+};
+
+struct cam_dma_buff_info {
+	struct dma_buf *buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *table;
+	enum dma_data_direction dir;
+	enum cam_smmu_region_id region_id;
+	int iommu_dir;
+	int ref_count;
+	dma_addr_t paddr;
+	struct list_head list;
+	int ion_fd;
+	size_t len;
+	size_t phys_len;
+	bool is_internal;
+	struct timespec64 ts;
+};
+
+struct cam_sec_buff_info {
+	struct dma_buf *buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *table;
+	enum dma_data_direction dir;
+	int ref_count;
+	dma_addr_t paddr;
+	struct list_head list;
+	int ion_fd;
+	size_t len;
+};
+
+static const char *qdss_region_name = "qdss";
+
+static struct cam_iommu_cb_set iommu_cb_set;
+
+static enum dma_data_direction cam_smmu_translate_dir(
+	enum cam_smmu_map_dir dir);
+
+static bool cam_smmu_is_hdl_nonunique_or_null(int hdl);
+
+static int cam_smmu_create_iommu_handle(int idx);
+
+static int cam_smmu_create_add_handle_in_table(char *name,
+	int *hdl);
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_ion_index(int idx,
+	int ion_fd);
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_dma_buf(int idx,
+	struct dma_buf *buf);
+
+static struct cam_sec_buff_info *cam_smmu_find_mapping_by_sec_buf_idx(int idx,
+	int ion_fd);
+
+static int cam_smmu_init_scratch_map(struct scratch_mapping *scratch_map,
+	dma_addr_t base, size_t size,
+	int order);
+
+static int cam_smmu_alloc_scratch_va(struct scratch_mapping *mapping,
+	size_t size,
+	dma_addr_t *iova);
+
+static int cam_smmu_free_scratch_va(struct scratch_mapping *mapping,
+	dma_addr_t addr, size_t size);
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_virt_address(int idx,
+	dma_addr_t virt_addr);
+
+static int cam_smmu_map_buffer_and_add_to_list(int idx, int ion_fd,
+	bool dis_delayed_unmap, enum dma_data_direction dma_dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id, bool is_internal, struct dma_buf *dmabuf);
+
+static int cam_smmu_map_kernel_buffer_and_add_to_list(int idx,
+	struct dma_buf *buf, enum dma_data_direction dma_dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id);
+
+static int cam_smmu_alloc_scratch_buffer_add_to_list(int idx,
+	size_t virt_len,
+	size_t phys_len,
+	unsigned int iommu_dir,
+	dma_addr_t *virt_addr);
+
+static int cam_smmu_unmap_buf_and_remove_from_list(
+	struct cam_dma_buff_info *mapping_info, int idx);
+
+static int cam_smmu_free_scratch_buffer_remove_from_list(
+	struct cam_dma_buff_info *mapping_info,
+	int idx);
+
+static void cam_smmu_clean_user_buffer_list(int idx);
+
+static void cam_smmu_clean_kernel_buffer_list(int idx);
+
+static void cam_smmu_dump_cb_info(int idx);
+
+static void cam_smmu_print_user_list(int idx);
+
+static void cam_smmu_print_kernel_list(int idx);
+
+static void cam_smmu_print_table(void);
+
+static int cam_smmu_probe(struct platform_device *pdev);
+
+static uint32_t cam_smmu_find_closest_mapping(int idx, void *vaddr);
+
+static void cam_smmu_update_monitor_array(
+	struct cam_context_bank_info *cb_info,
+	bool is_map,
+	struct cam_dma_buff_info *mapping_info)
+{
+	int iterator;
+
+	CAM_SMMU_INC_MONITOR_HEAD(&cb_info->monitor_head, &iterator);
+
+	ktime_get_real_ts64(&cb_info->monitor_entries[iterator].timestamp);
+
+	cb_info->monitor_entries[iterator].is_map = is_map;
+	cb_info->monitor_entries[iterator].ion_fd = mapping_info->ion_fd;
+	cb_info->monitor_entries[iterator].paddr = mapping_info->paddr;
+	cb_info->monitor_entries[iterator].len = mapping_info->len;
+	cb_info->monitor_entries[iterator].region_id = mapping_info->region_id;
+}
+
+static void cam_smmu_dump_monitor_array(
+	struct cam_context_bank_info *cb_info)
+{
+	int i = 0;
+	int64_t state_head = 0;
+	uint32_t index, num_entries, oldest_entry;
+	uint64_t ms, tmp, hrs, min, sec;
+	struct timespec64 *ts = NULL;
+
+	state_head = atomic64_read(&cb_info->monitor_head);
+
+	if (state_head == -1) {
+		return;
+	} else if (state_head < CAM_SMMU_MONITOR_MAX_ENTRIES) {
+		num_entries = state_head;
+		oldest_entry = 0;
+	} else {
+		num_entries = CAM_SMMU_MONITOR_MAX_ENTRIES;
+		div_u64_rem(state_head + 1,
+			CAM_SMMU_MONITOR_MAX_ENTRIES, &oldest_entry);
+	}
+
+	CAM_INFO(CAM_SMMU,
+		"========Dumping monitor information for cb %s===========",
+		cb_info->name[0]);
+
+	index = oldest_entry;
+
+	for (i = 0; i < num_entries; i++) {
+		ts = &cb_info->monitor_entries[index].timestamp;
+		tmp = ts->tv_sec;
+		ms = (ts->tv_nsec) / 1000000;
+		sec = do_div(tmp, 60);
+		min = do_div(tmp, 60);
+		hrs = do_div(tmp, 24);
+
+		CAM_INFO(CAM_SMMU,
+		"**** %llu:%llu:%llu.%llu : Index[%d] [%s] : ion_fd=%d start=0x%p end=0x%llx len=%u region=%d",
+		hrs, min, sec, ms,
+		index,
+		cb_info->monitor_entries[index].is_map ? "MAP" : "UNMAP",
+		cb_info->monitor_entries[index].ion_fd,
+		(void *)cb_info->monitor_entries[index].paddr,
+		((uint64_t)cb_info->monitor_entries[index].paddr +
+		(uint64_t)cb_info->monitor_entries[index].len),
+		(unsigned int)cb_info->monitor_entries[index].len,
+		cb_info->monitor_entries[index].region_id);
+
+		index = (index + 1) % CAM_SMMU_MONITOR_MAX_ENTRIES;
+	}
+}
+
+int cam_smmu_need_force_alloc_cached(bool *force_alloc_cached)
+{
+	int idx;
+	uint32_t curr_mode = 0, final_mode = 0;
+	bool validate = false;
+
+	if (!force_alloc_cached) {
+		CAM_ERR(CAM_SMMU, "Invalid arg");
+		return -EINVAL;
+	}
+
+	CAM_INFO(CAM_SMMU, "force_cache_allocs=%d",
+		iommu_cb_set.force_cache_allocs);
+
+	/*
+	 * First validate whether all SMMU CBs are properly setup to comply with
+	 * iommu_cb_set.force_alloc_cached flag.
+	 * This helps as a validation check to make sure a valid DT combination
+	 * is set for a given chipset.
+	 */
+	for (idx = 0; idx < iommu_cb_set.cb_num; idx++) {
+		/* ignore secure cb for now. need to revisit */
+		if (iommu_cb_set.cb_info[idx].is_secure)
+			continue;
+
+		curr_mode = iommu_cb_set.cb_info[idx].coherency_mode;
+
+		/*
+		 * 1. No coherency:
+		 *    We can map both CACHED and UNCACHED buffers into same CB.
+		 *    We need to allocate UNCACHED buffers for Cmdbuffers
+		 *    and Shared Buffers. UNCAHE support must exists with memory
+		 *    allocators (ion or dma-buf-heaps) for CmdBuffers,
+		 *    SharedBuffers to work - as it is difficult to do
+		 *    cache operations on these buffers in camera design.
+		 *    ImageBuffers can be CACHED or UNCACHED. If CACHED, clients
+		 *    need to make required CACHE operations.
+		 *    Cannot force all allocations to CACHE.
+		 * 2. dma-coherent:
+		 *    We cannot map CACHED and UNCACHED buffers into the same CB
+		 *    This means, we must force allocate all buffers to be
+		 *    CACHED.
+		 * 3. dma-coherent-hint-cached
+		 *    We can map both CACHED and UNCACHED buffers into the same
+		 *    CB. So any option is fine force_cache_allocs.
+		 *    Forcing to cache is preferable though.
+		 *
+		 * Other rule we are enforcing is - all camera CBs (except
+		 * secure CB) must have same coherency mode set. Assume one CB
+		 * is having no_coherency mode  and other CB is having
+		 * dma_coherent. For no_coherency CB to work - we must not force
+		 * buffers to be CACHE (exa cmd buffers), for dma_coherent mode
+		 * we must force all buffers to be CACHED. But at the time of
+		 * allocation, we dont know to which CB we will be mapping this
+		 * buffer. So it becomes difficult to generalize cache
+		 * allocations and io coherency mode that we want to support.
+		 * So, to simplify, all camera CBs will have same mode.
+		 */
+
+		CAM_DBG(CAM_SMMU, "[%s] : curr_mode=%d",
+			iommu_cb_set.cb_info[idx].name[0], curr_mode);
+
+		if (curr_mode == CAM_SMMU_NO_COHERENCY) {
+			if (iommu_cb_set.force_cache_allocs) {
+				CAM_ERR(CAM_SMMU,
+					"[%s] Can't force alloc cache with no coherency",
+					iommu_cb_set.cb_info[idx].name[0]);
+				return -EINVAL;
+			}
+		} else if (curr_mode == CAM_SMMU_DMA_COHERENT) {
+			if (!iommu_cb_set.force_cache_allocs) {
+				CAM_ERR(CAM_SMMU,
+					"[%s] Must force cache allocs for dma coherent device",
+					iommu_cb_set.cb_info[idx].name[0]);
+				return -EINVAL;
+			}
+		}
+
+		if (validate) {
+			if (curr_mode !=  final_mode) {
+				CAM_ERR(CAM_SMMU,
+					"[%s] CBs having different coherency modes final=%d, curr=%d",
+					iommu_cb_set.cb_info[idx].name[0],
+					final_mode, curr_mode);
+				return -EINVAL;
+			}
+		} else {
+			validate = true;
+			final_mode = curr_mode;
+		}
+	}
+
+	/*
+	 * To be more accurate - if this flag is TRUE and if this buffer will
+	 * be mapped to external devices like CVP - we need to ensure we do
+	 * one of below :
+	 * 1. CVP CB having dma-coherent or dma-coherent-hint-cached
+	 * 2. camera/cvp sw layers properly doing required cache operations. We
+	 *    cannot anymore assume these buffers (camera <--> cvp) are uncached
+	 */
+	*force_alloc_cached = iommu_cb_set.force_cache_allocs;
+
+	return 0;
+}
+
+static void cam_smmu_page_fault_work(struct work_struct *work)
+{
+	int j;
+	int idx;
+	struct cam_smmu_work_payload *payload;
+	uint32_t buf_info;
+	struct cam_smmu_pf_info pf_info;
+
+	mutex_lock(&iommu_cb_set.payload_list_lock);
+	if (list_empty(&iommu_cb_set.payload_list)) {
+		CAM_ERR(CAM_SMMU, "Payload list empty");
+		mutex_unlock(&iommu_cb_set.payload_list_lock);
+		return;
+	}
+
+	payload = list_first_entry(&iommu_cb_set.payload_list,
+		struct cam_smmu_work_payload,
+		list);
+	list_del(&payload->list);
+	mutex_unlock(&iommu_cb_set.payload_list_lock);
+
+	cam_check_iommu_faults(payload->domain, &pf_info);
+
+	/* Dereference the payload to call the handler */
+	idx = payload->idx;
+	buf_info = cam_smmu_find_closest_mapping(idx, (void *)payload->iova);
+	if (buf_info != 0)
+		CAM_INFO(CAM_SMMU, "closest buf 0x%x idx %d", buf_info, idx);
+
+	pf_info.domain = payload->domain;
+	pf_info.dev    = payload->dev;
+	pf_info.iova  = payload->iova;
+	pf_info.flags = payload->flags;
+	pf_info.buf_info = buf_info;
+
+	for (j = 0; j < CAM_SMMU_CB_MAX; j++) {
+		if ((iommu_cb_set.cb_info[idx].handler[j])) {
+			pf_info.token = iommu_cb_set.cb_info[idx].token[j];
+			iommu_cb_set.cb_info[idx].handler[j](&pf_info);
+		}
+	}
+	cam_smmu_dump_cb_info(idx);
+	kfree(payload);
+}
+
+static void cam_smmu_dump_cb_info(int idx)
+{
+	struct cam_dma_buff_info *mapping, *mapping_temp;
+	size_t shared_reg_len = 0, io_reg_len = 0;
+	size_t shared_free_len = 0, io_free_len = 0;
+	uint32_t i = 0;
+	uint64_t ms, tmp, hrs, min, sec;
+	struct timespec64 *ts = NULL;
+	struct timespec64 current_ts;
+	struct cam_context_bank_info *cb_info =
+		&iommu_cb_set.cb_info[idx];
+
+	if (cb_info->shared_support) {
+		shared_reg_len = cb_info->shared_info.iova_len;
+		shared_free_len = shared_reg_len - cb_info->shared_mapping_size;
+	}
+
+	if (cb_info->io_support) {
+		io_reg_len = cb_info->io_info.iova_len;
+		io_free_len = io_reg_len - cb_info->io_mapping_size;
+	}
+
+	ktime_get_real_ts64(&(current_ts));
+	tmp = current_ts.tv_sec;
+	ms = (current_ts.tv_nsec) / 1000000;
+	sec = do_div(tmp, 60);
+	min = do_div(tmp, 60);
+	hrs = do_div(tmp, 24);
+	CAM_ERR(CAM_SMMU,
+		"********** %llu:%llu:%llu:%llu Context bank dump for %s **********",
+		hrs, min, sec, ms, cb_info->name[0]);
+	CAM_ERR(CAM_SMMU,
+		"Usage: shared_usage=%u io_usage=%u shared_free=%u io_free=%u",
+		(unsigned int)cb_info->shared_mapping_size,
+		(unsigned int)cb_info->io_mapping_size,
+		(unsigned int)shared_free_len,
+		(unsigned int)io_free_len);
+
+	if (iommu_cb_set.cb_dump_enable) {
+		list_for_each_entry_safe(mapping, mapping_temp,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+			i++;
+			ts = &mapping->ts;
+			tmp = ts->tv_sec;
+			ms = (ts->tv_nsec) / 1000000;
+			sec = do_div(tmp, 60);
+			min = do_div(tmp, 60);
+			hrs = do_div(tmp, 24);
+			CAM_ERR(CAM_SMMU,
+				"%llu:%llu:%llu:%llu: %u ion_fd=%d start=0x%p end=0x%llx len=%u region=%d",
+				hrs, min, sec, ms, i, mapping->ion_fd,
+				(void *)mapping->paddr,
+				((uint64_t)mapping->paddr +
+				(uint64_t)mapping->len),
+				(unsigned int)mapping->len,
+				mapping->region_id);
+		}
+
+		cam_smmu_dump_monitor_array(&iommu_cb_set.cb_info[idx]);
+	}
+}
+
+static void cam_smmu_print_user_list(int idx)
+{
+	struct cam_dma_buff_info *mapping;
+
+	CAM_ERR(CAM_SMMU, "index = %d", idx);
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		CAM_ERR(CAM_SMMU,
+			"ion_fd = %d, paddr= 0x%pK, len = %u, region = %d",
+			 mapping->ion_fd, (void *)mapping->paddr,
+			 (unsigned int)mapping->len,
+			 mapping->region_id);
+	}
+}
+
+static void cam_smmu_print_kernel_list(int idx)
+{
+	struct cam_dma_buff_info *mapping;
+
+	CAM_ERR(CAM_SMMU, "index = %d", idx);
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list, list) {
+		CAM_ERR(CAM_SMMU,
+			"dma_buf = %pK, paddr= 0x%pK, len = %u, region = %d",
+			 mapping->buf, (void *)mapping->paddr,
+			 (unsigned int)mapping->len,
+			 mapping->region_id);
+	}
+}
+
+static void cam_smmu_print_table(void)
+{
+	int i, j;
+
+	for (i = 0; i < iommu_cb_set.cb_num; i++) {
+		for (j = 0; j < iommu_cb_set.cb_info[i].num_shared_hdl; j++) {
+			CAM_ERR(CAM_SMMU,
+				"i= %d, handle= %d, name_addr=%pK name %s",
+				i, (int)iommu_cb_set.cb_info[i].handle,
+				(void *)iommu_cb_set.cb_info[i].name[j],
+				iommu_cb_set.cb_info[i].name[j]);
+		}
+		CAM_ERR(CAM_SMMU, "dev = %pK", iommu_cb_set.cb_info[i].dev);
+	}
+}
+
+static uint32_t cam_smmu_find_closest_mapping(int idx, void *vaddr)
+{
+	struct cam_dma_buff_info *mapping, *closest_mapping =  NULL;
+	unsigned long start_addr, end_addr, current_addr;
+	uint32_t buf_handle = 0;
+
+	long delta = 0, lowest_delta = 0;
+
+	current_addr = (unsigned long)vaddr;
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		start_addr = (unsigned long)mapping->paddr;
+		end_addr = (unsigned long)mapping->paddr + mapping->len;
+
+		if (start_addr <= current_addr && current_addr <= end_addr) {
+			closest_mapping = mapping;
+			CAM_INFO(CAM_SMMU,
+				"Found va 0x%lx in:0x%lx-0x%lx, fd %d cb:%s",
+				current_addr, start_addr,
+				end_addr, mapping->ion_fd,
+				iommu_cb_set.cb_info[idx].name[0]);
+			goto end;
+		} else {
+			if (start_addr > current_addr)
+				delta =  start_addr - current_addr;
+			else
+				delta = current_addr - end_addr - 1;
+
+			if (delta < lowest_delta || lowest_delta == 0) {
+				lowest_delta = delta;
+				closest_mapping = mapping;
+			}
+			CAM_DBG(CAM_SMMU,
+				"approx va %lx not in range: %lx-%lx fd = %0x",
+				current_addr, start_addr,
+				end_addr, mapping->ion_fd);
+		}
+	}
+
+end:
+	if (closest_mapping) {
+		buf_handle = GET_MEM_HANDLE(idx, closest_mapping->ion_fd);
+		CAM_INFO(CAM_SMMU,
+			"Closest map fd %d 0x%lx %zu-%zu 0x%lx-0x%lx buf=%pK mem %0x",
+			closest_mapping->ion_fd, current_addr,
+			mapping->len, closest_mapping->len,
+			(unsigned long)closest_mapping->paddr,
+			(unsigned long)closest_mapping->paddr + mapping->len,
+			closest_mapping->buf,
+			buf_handle);
+	} else
+		CAM_ERR(CAM_SMMU,
+			"Cannot find vaddr:%lx in SMMU %s virt address",
+			current_addr, iommu_cb_set.cb_info[idx].name[0]);
+
+	return buf_handle;
+}
+
+void cam_smmu_set_client_page_fault_handler(int handle,
+	void (*handler_cb)(struct cam_smmu_pf_info  *pf_info), void *token)
+{
+	int idx, i = 0;
+
+	if (!token || (handle == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: token is NULL or invalid handle");
+		return;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return;
+	}
+
+	if (handler_cb) {
+		if (iommu_cb_set.cb_info[idx].cb_count == CAM_SMMU_CB_MAX) {
+			CAM_ERR(CAM_SMMU,
+				"%s Should not regiester more handlers",
+				iommu_cb_set.cb_info[idx].name[0]);
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return;
+		}
+
+		iommu_cb_set.cb_info[idx].cb_count++;
+
+		for (i = 0; i < iommu_cb_set.cb_info[idx].cb_count; i++) {
+			if (iommu_cb_set.cb_info[idx].token[i] == NULL) {
+				iommu_cb_set.cb_info[idx].token[i] = token;
+				iommu_cb_set.cb_info[idx].handler[i] =
+					handler_cb;
+				break;
+			}
+		}
+	} else {
+		for (i = 0; i < CAM_SMMU_CB_MAX; i++) {
+			if (iommu_cb_set.cb_info[idx].token[i] == token) {
+				iommu_cb_set.cb_info[idx].token[i] = NULL;
+				iommu_cb_set.cb_info[idx].handler[i] =
+					NULL;
+				iommu_cb_set.cb_info[idx].cb_count--;
+				break;
+			}
+		}
+		if (i == CAM_SMMU_CB_MAX)
+			CAM_ERR(CAM_SMMU,
+				"Error: hdl %x no matching tokens: %s",
+				handle, iommu_cb_set.cb_info[idx].name[0]);
+	}
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+}
+
+void cam_smmu_unset_client_page_fault_handler(int handle, void *token)
+{
+	int idx, i = 0;
+
+	if (!token || (handle == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: token is NULL or invalid handle");
+		return;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return;
+	}
+
+	for (i = 0; i < CAM_SMMU_CB_MAX; i++) {
+		if (iommu_cb_set.cb_info[idx].token[i] == token) {
+			iommu_cb_set.cb_info[idx].token[i] = NULL;
+			iommu_cb_set.cb_info[idx].handler[i] =
+				NULL;
+			iommu_cb_set.cb_info[idx].cb_count--;
+			break;
+		}
+	}
+	if (i == CAM_SMMU_CB_MAX)
+		CAM_ERR(CAM_SMMU, "Error: hdl %x no matching tokens: %s",
+			handle, iommu_cb_set.cb_info[idx].name[0]);
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+}
+
+static int cam_smmu_iommu_fault_handler(struct iommu_domain *domain,
+	struct device *dev, unsigned long iova,
+	int flags, void *token)
+{
+	char *cb_name;
+	int idx;
+	struct cam_smmu_work_payload *payload;
+
+	if (!token) {
+		CAM_ERR(CAM_SMMU, "Error: token is NULL");
+		CAM_ERR(CAM_SMMU, "Error: domain = %pK, device = %pK",
+			domain, dev);
+		CAM_ERR(CAM_SMMU, "iova = %lX, flags = %d", iova, flags);
+		return -EINVAL;
+	}
+
+	cb_name = (char *)token;
+	/* Check whether it is in the table */
+	for (idx = 0; idx < iommu_cb_set.cb_num; idx++) {
+		if (!strcmp(iommu_cb_set.cb_info[idx].name[0], cb_name))
+			break;
+	}
+
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: index is not valid, index = %d, token = %s",
+			idx, cb_name);
+		return -EINVAL;
+	}
+
+	if (++iommu_cb_set.cb_info[idx].pf_count > g_num_pf_handled) {
+		CAM_INFO_RATE_LIMIT(CAM_SMMU, "PF already handled %d %d %d",
+			g_num_pf_handled, idx,
+			iommu_cb_set.cb_info[idx].pf_count);
+		return -EINVAL;
+	}
+
+	payload = kzalloc(sizeof(struct cam_smmu_work_payload), GFP_ATOMIC);
+	if (!payload)
+		return -EINVAL;
+
+	payload->domain = domain;
+	payload->dev = dev;
+	payload->iova = iova;
+	payload->flags = flags;
+	payload->token = token;
+	payload->idx = idx;
+
+	mutex_lock(&iommu_cb_set.payload_list_lock);
+	list_add_tail(&payload->list, &iommu_cb_set.payload_list);
+	mutex_unlock(&iommu_cb_set.payload_list_lock);
+
+	cam_smmu_page_fault_work(&iommu_cb_set.smmu_work);
+
+	return -EINVAL;
+}
+
+void cam_smmu_reset_cb_page_fault_cnt(void)
+{
+	int idx;
+
+	for (idx = 0; idx < iommu_cb_set.cb_num; idx++)
+		iommu_cb_set.cb_info[idx].pf_count = 0;
+
+}
+
+static int cam_smmu_translate_dir_to_iommu_dir(
+	enum cam_smmu_map_dir dir)
+{
+	switch (dir) {
+	case CAM_SMMU_MAP_READ:
+		return IOMMU_READ;
+	case CAM_SMMU_MAP_WRITE:
+		return IOMMU_WRITE;
+	case CAM_SMMU_MAP_RW:
+		return IOMMU_READ|IOMMU_WRITE;
+	case CAM_SMMU_MAP_INVALID:
+	default:
+		CAM_ERR(CAM_SMMU, "Error: Direction is invalid. dir = %d", dir);
+		break;
+	};
+	return IOMMU_INVALID_DIR;
+}
+
+static enum dma_data_direction cam_smmu_translate_dir(
+	enum cam_smmu_map_dir dir)
+{
+	switch (dir) {
+	case CAM_SMMU_MAP_READ:
+		return DMA_FROM_DEVICE;
+	case CAM_SMMU_MAP_WRITE:
+		return DMA_TO_DEVICE;
+	case CAM_SMMU_MAP_RW:
+		return DMA_BIDIRECTIONAL;
+	case CAM_SMMU_MAP_INVALID:
+	default:
+		CAM_ERR(CAM_SMMU, "Error: Direction is invalid. dir = %d",
+			(int)dir);
+		break;
+	}
+	return DMA_NONE;
+}
+
+static void cam_smmu_reset_iommu_table(enum cam_smmu_init_dir ops)
+{
+	unsigned int i;
+	int j = 0;
+
+	for (i = 0; i < iommu_cb_set.cb_num; i++) {
+		iommu_cb_set.cb_info[i].handle = HANDLE_INIT;
+		INIT_LIST_HEAD(&iommu_cb_set.cb_info[i].smmu_buf_list);
+		INIT_LIST_HEAD(&iommu_cb_set.cb_info[i].smmu_buf_kernel_list);
+		iommu_cb_set.cb_info[i].state = CAM_SMMU_DETACH;
+		iommu_cb_set.cb_info[i].dev = NULL;
+		iommu_cb_set.cb_info[i].cb_count = 0;
+		iommu_cb_set.cb_info[i].pf_count = 0;
+		for (j = 0; j < CAM_SMMU_CB_MAX; j++) {
+			iommu_cb_set.cb_info[i].token[j] = NULL;
+			iommu_cb_set.cb_info[i].handler[j] = NULL;
+		}
+		if (ops == CAM_SMMU_TABLE_INIT)
+			mutex_init(&iommu_cb_set.cb_info[i].lock);
+		else
+			mutex_destroy(&iommu_cb_set.cb_info[i].lock);
+	}
+}
+
+static bool cam_smmu_is_hdl_nonunique_or_null(int hdl)
+{
+	int i;
+
+	if ((hdl == HANDLE_INIT) || (!hdl)) {
+		CAM_DBG(CAM_SMMU, "iommu handle: %d is not valid", hdl);
+		return 1;
+	}
+
+	for (i = 0; i < iommu_cb_set.cb_num; i++) {
+		if (iommu_cb_set.cb_info[i].handle == HANDLE_INIT)
+			continue;
+
+		if (iommu_cb_set.cb_info[i].handle == hdl) {
+			CAM_DBG(CAM_SMMU, "iommu handle %d conflicts",
+				(int)hdl);
+			return 1;
+		}
+	}
+	return 0;
+}
+
+/**
+ *  use low 2 bytes for handle cookie
+ */
+static int cam_smmu_create_iommu_handle(int idx)
+{
+	int rand, hdl = 0;
+
+	get_random_bytes(&rand, COOKIE_NUM_BYTE);
+	hdl = GET_SMMU_HDL(idx, rand);
+	CAM_DBG(CAM_SMMU, "create handle value = %x", (int)hdl);
+	return hdl;
+}
+
+static int cam_smmu_attach_device(int idx)
+{
+	int rc;
+	struct cam_context_bank_info *cb = &iommu_cb_set.cb_info[idx];
+
+	/* attach the mapping to device */
+	rc = iommu_attach_device(cb->domain, cb->dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: ARM IOMMU attach failed. ret = %d",
+			rc);
+		rc = -ENODEV;
+	}
+
+	return rc;
+}
+
+static int cam_smmu_create_add_handle_in_table(char *name,
+	int *hdl)
+{
+	int i, j, rc = -EINVAL;
+	int handle;
+
+	/* create handle and add in the iommu hardware table */
+	for (i = 0; i < iommu_cb_set.cb_num; i++) {
+		for (j = 0; j < iommu_cb_set.cb_info[i].num_shared_hdl; j++) {
+			if (strcmp(iommu_cb_set.cb_info[i].name[j], name))
+				continue;
+
+			if (iommu_cb_set.cb_info[i].handle == HANDLE_INIT) {
+				mutex_lock(&iommu_cb_set.cb_info[i].lock);
+				/* make sure handle is unique and non-zero*/
+				do {
+					handle =
+						cam_smmu_create_iommu_handle(i);
+				} while (cam_smmu_is_hdl_nonunique_or_null(
+						handle));
+
+				/* put handle in the table */
+				iommu_cb_set.cb_info[i].handle = handle;
+				iommu_cb_set.cb_info[i].cb_count = 0;
+				if (iommu_cb_set.cb_info[i].is_secure)
+					iommu_cb_set.cb_info[i].secure_count++;
+
+				if (iommu_cb_set.cb_info[i].is_mul_client)
+					iommu_cb_set.cb_info[i].device_count++;
+
+				*hdl = handle;
+				CAM_DBG(CAM_SMMU, "%s creates handle 0x%x",
+					name, handle);
+				mutex_unlock(&iommu_cb_set.cb_info[i].lock);
+				rc = 0;
+				goto end;
+			} else {
+				mutex_lock(&iommu_cb_set.cb_info[i].lock);
+				if (iommu_cb_set.cb_info[i].is_secure) {
+					iommu_cb_set.cb_info[i].secure_count++;
+					*hdl = iommu_cb_set.cb_info[i].handle;
+					mutex_unlock(
+						&iommu_cb_set.cb_info[i].lock);
+					return 0;
+				}
+
+				if (iommu_cb_set.cb_info[i].is_mul_client) {
+					iommu_cb_set.cb_info[i].device_count++;
+					*hdl = iommu_cb_set.cb_info[i].handle;
+					mutex_unlock(
+						&iommu_cb_set.cb_info[i].lock);
+					CAM_DBG(CAM_SMMU,
+						"%s already got handle 0x%x",
+						name,
+						iommu_cb_set.cb_info[i].handle);
+					return 0;
+				}
+
+				CAM_ERR(CAM_SMMU,
+					"Error: %s already got handle 0x%x",
+					name, iommu_cb_set.cb_info[i].handle);
+				mutex_unlock(&iommu_cb_set.cb_info[i].lock);
+				rc = -EALREADY;
+				goto end;
+			}
+		}
+	}
+
+	CAM_ERR(CAM_SMMU, "Error: Cannot find name %s or all handle exist",
+		name);
+	cam_smmu_print_table();
+end:
+	return rc;
+}
+
+static int cam_smmu_init_scratch_map(struct scratch_mapping *scratch_map,
+					dma_addr_t base, size_t size,
+					int order)
+{
+	unsigned int count = size >> (PAGE_SHIFT + order);
+	unsigned int bitmap_size = BITS_TO_LONGS(count) * sizeof(long);
+	int err = 0;
+
+	if (!count) {
+		err = -EINVAL;
+		CAM_ERR(CAM_SMMU, "Page count is zero, size passed = %zu",
+			size);
+		goto bail;
+	}
+
+	scratch_map->bitmap = kzalloc(bitmap_size, GFP_KERNEL);
+	if (!scratch_map->bitmap) {
+		err = -ENOMEM;
+		goto bail;
+	}
+
+	scratch_map->base = base;
+	scratch_map->bits = BITS_PER_BYTE * bitmap_size;
+	scratch_map->order = order;
+
+bail:
+	return err;
+}
+
+static int cam_smmu_alloc_scratch_va(struct scratch_mapping *mapping,
+	size_t size,
+	dma_addr_t *iova)
+{
+	unsigned int order = get_order(size);
+	unsigned int align = 0;
+	unsigned int count, start;
+
+	count = ((PAGE_ALIGN(size) >> PAGE_SHIFT) +
+		 (1 << mapping->order) - 1) >> mapping->order;
+
+	/*
+	 * Transparently, add a guard page to the total count of pages
+	 * to be allocated
+	 */
+	count++;
+
+	if (order > mapping->order)
+		align = (1 << (order - mapping->order)) - 1;
+
+	start = bitmap_find_next_zero_area(mapping->bitmap, mapping->bits, 0,
+					   count, align);
+
+	if (start > mapping->bits)
+		return -ENOMEM;
+
+	bitmap_set(mapping->bitmap, start, count);
+	*iova = mapping->base + (start << (mapping->order + PAGE_SHIFT));
+
+	return 0;
+}
+
+static int cam_smmu_free_scratch_va(struct scratch_mapping *mapping,
+	dma_addr_t addr, size_t size)
+{
+	unsigned int start = (addr - mapping->base) >>
+			     (mapping->order + PAGE_SHIFT);
+	unsigned int count = ((size >> PAGE_SHIFT) +
+			      (1 << mapping->order) - 1) >> mapping->order;
+
+	if (!addr) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid address");
+		return -EINVAL;
+	}
+
+	if (start + count > mapping->bits) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid page bits in scratch map");
+		return -EINVAL;
+	}
+
+	/*
+	 * Transparently, add a guard page to the total count of pages
+	 * to be freed
+	 */
+	count++;
+	bitmap_clear(mapping->bitmap, start, count);
+
+	return 0;
+}
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_virt_address(int idx,
+	dma_addr_t virt_addr)
+{
+	struct cam_dma_buff_info *mapping;
+
+	list_for_each_entry(mapping, &iommu_cb_set.cb_info[idx].smmu_buf_list,
+			list) {
+		if (mapping->paddr == virt_addr) {
+			CAM_DBG(CAM_SMMU, "Found virtual address %lx",
+				 (unsigned long)virt_addr);
+			return mapping;
+		}
+	}
+
+	CAM_ERR(CAM_SMMU, "Error: Cannot find virtual address %lx by index %d",
+		(unsigned long)virt_addr, idx);
+	return NULL;
+}
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_ion_index(int idx,
+	int ion_fd)
+{
+	struct cam_dma_buff_info *mapping;
+
+	if (ion_fd < 0) {
+		CAM_ERR(CAM_SMMU, "Invalid fd %d", ion_fd);
+		return NULL;
+	}
+
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list,
+			list) {
+		if (mapping->ion_fd == ion_fd) {
+			CAM_DBG(CAM_SMMU, "find ion_fd %d", ion_fd);
+			return mapping;
+		}
+	}
+
+	CAM_ERR(CAM_SMMU, "Error: Cannot find entry by index %d", idx);
+
+	return NULL;
+}
+
+static struct cam_dma_buff_info *cam_smmu_find_mapping_by_dma_buf(int idx,
+	struct dma_buf *buf)
+{
+	struct cam_dma_buff_info *mapping;
+
+	if (!buf) {
+		CAM_ERR(CAM_SMMU, "Invalid dma_buf");
+		return NULL;
+	}
+
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list,
+			list) {
+		if (mapping->buf == buf) {
+			CAM_DBG(CAM_SMMU, "find dma_buf %pK", buf);
+			return mapping;
+		}
+	}
+
+	CAM_ERR(CAM_SMMU, "Error: Cannot find entry by index %d", idx);
+
+	return NULL;
+}
+
+static struct cam_sec_buff_info *cam_smmu_find_mapping_by_sec_buf_idx(int idx,
+	int ion_fd)
+{
+	struct cam_sec_buff_info *mapping;
+
+	list_for_each_entry(mapping, &iommu_cb_set.cb_info[idx].smmu_buf_list,
+		list) {
+		if (mapping->ion_fd == ion_fd) {
+			CAM_DBG(CAM_SMMU, "find ion_fd %d", ion_fd);
+			return mapping;
+		}
+	}
+	CAM_ERR(CAM_SMMU, "Error: Cannot find fd %d by index %d",
+		ion_fd, idx);
+	return NULL;
+}
+
+static void cam_smmu_clean_user_buffer_list(int idx)
+{
+	int ret;
+	struct cam_dma_buff_info *mapping_info, *temp;
+
+	list_for_each_entry_safe(mapping_info, temp,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		CAM_DBG(CAM_SMMU, "Free mapping address %pK, i = %d, fd = %d",
+			(void *)mapping_info->paddr, idx,
+			mapping_info->ion_fd);
+
+		if (mapping_info->ion_fd == 0xDEADBEEF)
+			/* Clean up scratch buffers */
+			ret = cam_smmu_free_scratch_buffer_remove_from_list(
+							mapping_info, idx);
+		else
+			/* Clean up regular mapped buffers */
+			ret = cam_smmu_unmap_buf_and_remove_from_list(
+					mapping_info,
+					idx);
+
+		if (ret < 0) {
+			CAM_ERR(CAM_SMMU, "Buffer delete failed: idx = %d",
+				idx);
+			CAM_ERR(CAM_SMMU,
+				"Buffer delete failed: addr = %lx, fd = %d",
+				(unsigned long)mapping_info->paddr,
+				mapping_info->ion_fd);
+			/*
+			 * Ignore this error and continue to delete other
+			 * buffers in the list
+			 */
+			continue;
+		}
+	}
+}
+
+static void cam_smmu_clean_kernel_buffer_list(int idx)
+{
+	int ret;
+	struct cam_dma_buff_info *mapping_info, *temp;
+
+	list_for_each_entry_safe(mapping_info, temp,
+			&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list, list) {
+		CAM_DBG(CAM_SMMU,
+			"Free mapping address %pK, i = %d, dma_buf = %pK",
+			(void *)mapping_info->paddr, idx,
+			mapping_info->buf);
+
+		/* Clean up regular mapped buffers */
+		ret = cam_smmu_unmap_buf_and_remove_from_list(
+				mapping_info,
+				idx);
+
+		if (ret < 0) {
+			CAM_ERR(CAM_SMMU,
+				"Buffer delete in kernel list failed: idx = %d",
+				idx);
+			CAM_ERR(CAM_SMMU,
+				"Buffer delete failed: addr = %lx, dma_buf = %pK",
+				(unsigned long)mapping_info->paddr,
+				mapping_info->buf);
+			/*
+			 * Ignore this error and continue to delete other
+			 * buffers in the list
+			 */
+			continue;
+		}
+	}
+}
+
+static int cam_smmu_attach(int idx)
+{
+	int ret;
+
+	if (iommu_cb_set.cb_info[idx].state == CAM_SMMU_ATTACH) {
+		ret = -EALREADY;
+	} else if (iommu_cb_set.cb_info[idx].state == CAM_SMMU_DETACH) {
+		ret = cam_smmu_attach_device(idx);
+		if (ret < 0) {
+			CAM_ERR(CAM_SMMU, "Error: ATTACH fail");
+			return -ENODEV;
+		}
+		iommu_cb_set.cb_info[idx].state = CAM_SMMU_ATTACH;
+		ret = 0;
+	} else {
+		CAM_ERR(CAM_SMMU, "Error: Not detach/attach: %d",
+			iommu_cb_set.cb_info[idx].state);
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+static int cam_smmu_detach_device(int idx)
+{
+	int rc = 0;
+	struct cam_context_bank_info *cb = &iommu_cb_set.cb_info[idx];
+
+	/* detach the mapping to device if not already detached */
+	if (iommu_cb_set.cb_info[idx].state == CAM_SMMU_DETACH) {
+		rc = -EALREADY;
+	} else if (iommu_cb_set.cb_info[idx].state == CAM_SMMU_ATTACH) {
+		iommu_detach_device(cb->domain, cb->dev);
+		iommu_cb_set.cb_info[idx].state = CAM_SMMU_DETACH;
+	}
+
+	return rc;
+}
+
+int cam_smmu_alloc_firmware(int32_t smmu_hdl,
+	dma_addr_t *iova,
+	uintptr_t *cpuva,
+	size_t *len)
+{
+	int rc;
+	int prot = 0;
+	int32_t idx;
+	size_t firmware_len = 0;
+	size_t firmware_start = 0;
+	struct iommu_domain *domain;
+
+	if (!iova || !len || !cpuva || (smmu_hdl == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: Input args are invalid");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].firmware_support) {
+		CAM_ERR(CAM_SMMU,
+			"Firmware memory not supported for this SMMU handle");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_fw_allocated) {
+		CAM_ERR(CAM_SMMU, "Trying to allocate twice");
+		rc = -ENOMEM;
+		goto unlock_and_end;
+	}
+
+	firmware_len = iommu_cb_set.cb_info[idx].firmware_info.iova_len;
+	firmware_start = iommu_cb_set.cb_info[idx].firmware_info.iova_start;
+	CAM_DBG(CAM_SMMU, "Firmware area len from DT = %zu", firmware_len);
+
+	rc = cam_reserve_icp_fw(&icp_fw, firmware_len);
+	if (rc)
+		goto unlock_and_end;
+	else
+		CAM_DBG(CAM_SMMU, "DMA alloc returned fw = %pK, hdl = %pK",
+			icp_fw.fw_kva, (void *)icp_fw.fw_hdl);
+
+	domain = iommu_cb_set.cb_info[idx].domain;
+
+	/*
+	 * Revisit this - what should we map this with - CACHED or UNCACHED?
+	 * chipsets using dma-coherent-hint-cached - leaving it like this is
+	 * fine as we can map both CACHED and UNCACHED on same CB.
+	 * But on chipsets which use dma-coherent - all the buffers that are
+	 * being mapped to this CB must be CACHED
+	 */
+	prot |= IOMMU_READ | IOMMU_WRITE | IOMMU_PRIV;
+	if (iommu_cb_set.force_cache_allocs)
+		prot |= IOMMU_CACHE;
+
+	rc = iommu_map(domain,
+		firmware_start,
+		(phys_addr_t) icp_fw.fw_hdl,
+		firmware_len, prot, GFP_KERNEL);
+
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "Failed to map FW into IOMMU rc:%d", rc);
+		rc = -ENOMEM;
+		goto alloc_fail;
+	}
+	iommu_cb_set.cb_info[idx].is_fw_allocated = true;
+
+	*iova = iommu_cb_set.cb_info[idx].firmware_info.iova_start;
+	*cpuva = (uintptr_t)icp_fw.fw_kva;
+	*len = firmware_len;
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+
+	return rc;
+
+alloc_fail:
+	cam_unreserve_icp_fw(&icp_fw, firmware_len);
+unlock_and_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+end:
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_alloc_firmware);
+
+int cam_smmu_dealloc_firmware(int32_t smmu_hdl)
+{
+	int rc = 0;
+	int32_t idx;
+	size_t firmware_len = 0;
+	size_t firmware_start = 0;
+	struct iommu_domain *domain;
+	size_t unmapped = 0;
+
+	if (smmu_hdl == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].firmware_support) {
+		CAM_ERR(CAM_SMMU,
+			"Firmware memory not supported for this SMMU handle");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (!iommu_cb_set.cb_info[idx].is_fw_allocated) {
+		CAM_ERR(CAM_SMMU,
+			"Trying to deallocate firmware that is not allocated");
+		rc = -ENOMEM;
+		goto unlock_and_end;
+	}
+
+	firmware_len = iommu_cb_set.cb_info[idx].firmware_info.iova_len;
+	firmware_start = iommu_cb_set.cb_info[idx].firmware_info.iova_start;
+	domain = iommu_cb_set.cb_info[idx].domain;
+	unmapped = iommu_unmap(domain,
+		firmware_start,
+		firmware_len);
+
+	if (unmapped != firmware_len) {
+		CAM_ERR(CAM_SMMU, "Only %zu unmapped out of total %zu",
+			unmapped,
+			firmware_len);
+		rc = -EINVAL;
+	}
+
+	cam_unreserve_icp_fw(&icp_fw, firmware_len);
+
+	icp_fw.fw_kva = NULL;
+	icp_fw.fw_hdl = 0;
+
+	iommu_cb_set.cb_info[idx].is_fw_allocated = false;
+
+unlock_and_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+end:
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_dealloc_firmware);
+
+int cam_smmu_alloc_qdss(int32_t smmu_hdl,
+	dma_addr_t *iova,
+	size_t *len)
+{
+	int rc, prot = 0;
+	int32_t idx;
+	size_t qdss_len = 0;
+	size_t qdss_start = 0;
+	dma_addr_t qdss_phy_addr;
+	struct iommu_domain *domain;
+
+	if (!iova || !len || (smmu_hdl == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: Input args are invalid");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].qdss_support) {
+		CAM_ERR(CAM_SMMU,
+			"QDSS memory not supported for this SMMU handle");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_qdss_allocated) {
+		CAM_ERR(CAM_SMMU, "Trying to allocate twice");
+		rc = -ENOMEM;
+		goto unlock_and_end;
+	}
+
+	qdss_len = iommu_cb_set.cb_info[idx].qdss_info.iova_len;
+	qdss_start = iommu_cb_set.cb_info[idx].qdss_info.iova_start;
+	qdss_phy_addr = iommu_cb_set.cb_info[idx].qdss_phy_addr;
+	CAM_DBG(CAM_SMMU, "QDSS area len from DT = %zu", qdss_len);
+
+	domain = iommu_cb_set.cb_info[idx].domain;
+
+	/*
+	 * Revisit this - what should we map this with - CACHED or UNCACHED?
+	 * chipsets using dma-coherent-hint-cached - leaving it like this is
+	 * fine as we can map both CACHED and UNCACHED on same CB.
+	 * But on chipsets which use dma-coherent - all the buffers that are
+	 * being mapped to this CB must be CACHED
+	 */
+	if (iommu_cb_set.force_cache_allocs)
+		prot |= IOMMU_CACHE;
+
+	prot |= IOMMU_READ | IOMMU_WRITE;
+	rc = iommu_map(domain, qdss_start, qdss_phy_addr,
+		qdss_len, prot, GFP_KERNEL);
+
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "Failed to map QDSS into IOMMU rc %d", rc);
+		goto unlock_and_end;
+	}
+
+	iommu_cb_set.cb_info[idx].is_qdss_allocated = true;
+
+	*iova = iommu_cb_set.cb_info[idx].qdss_info.iova_start;
+	*len = qdss_len;
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+
+	return rc;
+
+unlock_and_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+end:
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_alloc_qdss);
+
+int cam_smmu_dealloc_qdss(int32_t smmu_hdl)
+{
+	int rc = 0;
+	int32_t idx;
+	size_t qdss_len = 0;
+	size_t qdss_start = 0;
+	struct iommu_domain *domain;
+	size_t unmapped = 0;
+
+	if (smmu_hdl == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].qdss_support) {
+		CAM_ERR(CAM_SMMU,
+			"QDSS memory not supported for this SMMU handle");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (!iommu_cb_set.cb_info[idx].is_qdss_allocated) {
+		CAM_ERR(CAM_SMMU,
+			"Trying to deallocate qdss that is not allocated");
+		rc = -ENOMEM;
+		goto unlock_and_end;
+	}
+
+	qdss_len = iommu_cb_set.cb_info[idx].qdss_info.iova_len;
+	qdss_start = iommu_cb_set.cb_info[idx].qdss_info.iova_start;
+	domain = iommu_cb_set.cb_info[idx].domain;
+	unmapped = iommu_unmap(domain, qdss_start, qdss_len);
+
+	if (unmapped != qdss_len) {
+		CAM_ERR(CAM_SMMU, "Only %zu unmapped out of total %zu",
+			unmapped,
+			qdss_len);
+		rc = -EINVAL;
+	}
+
+	iommu_cb_set.cb_info[idx].is_qdss_allocated = false;
+
+unlock_and_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+end:
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_dealloc_qdss);
+
+int cam_smmu_get_io_region_info(int32_t smmu_hdl,
+	dma_addr_t *iova, size_t *len,
+	dma_addr_t *discard_iova_start, size_t *discard_iova_len)
+{
+	int32_t idx;
+
+	if (!iova || !len || !discard_iova_start || !discard_iova_len ||
+		(smmu_hdl == HANDLE_INIT)) {
+		CAM_ERR(CAM_SMMU, "Error: Input args are invalid");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].io_support) {
+		CAM_ERR(CAM_SMMU,
+			"I/O memory not supported for this SMMU handle");
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	*iova = iommu_cb_set.cb_info[idx].io_info.iova_start;
+	*len = iommu_cb_set.cb_info[idx].io_info.iova_len;
+	*discard_iova_start =
+		iommu_cb_set.cb_info[idx].io_info.discard_iova_start;
+	*discard_iova_len =
+		iommu_cb_set.cb_info[idx].io_info.discard_iova_len;
+
+	CAM_DBG(CAM_SMMU,
+		"I/O area for hdl = %x Region:[%pK %zu] Discard:[%pK %zu]",
+		smmu_hdl, *iova, *len,
+		*discard_iova_start, *discard_iova_len);
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+
+	return 0;
+}
+
+int cam_smmu_get_region_info(int32_t smmu_hdl,
+	enum cam_smmu_region_id region_id,
+	struct cam_smmu_region_info *region_info)
+{
+	int32_t idx;
+	struct cam_context_bank_info *cb = NULL;
+
+	if (!region_info) {
+		CAM_ERR(CAM_SMMU, "Invalid region_info pointer");
+		return -EINVAL;
+	}
+
+	if (smmu_hdl == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU, "Handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	cb = &iommu_cb_set.cb_info[idx];
+	if (!cb) {
+		CAM_ERR(CAM_SMMU, "SMMU context bank pointer invalid");
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return -EINVAL;
+	}
+
+	switch (region_id) {
+	case CAM_SMMU_REGION_FIRMWARE:
+		if (!cb->firmware_support) {
+			CAM_ERR(CAM_SMMU, "Firmware not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+		region_info->iova_start = cb->firmware_info.iova_start;
+		region_info->iova_len = cb->firmware_info.iova_len;
+		break;
+	case CAM_SMMU_REGION_SHARED:
+		if (!cb->shared_support) {
+			CAM_ERR(CAM_SMMU, "Shared mem not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+		region_info->iova_start = cb->shared_info.iova_start;
+		region_info->iova_len = cb->shared_info.iova_len;
+		break;
+	case CAM_SMMU_REGION_SCRATCH:
+		if (!cb->scratch_buf_support) {
+			CAM_ERR(CAM_SMMU, "Scratch memory not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+		region_info->iova_start = cb->scratch_info.iova_start;
+		region_info->iova_len = cb->scratch_info.iova_len;
+		break;
+	case CAM_SMMU_REGION_IO:
+		if (!cb->io_support) {
+			CAM_ERR(CAM_SMMU, "IO memory not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+		region_info->iova_start = cb->io_info.iova_start;
+		region_info->iova_len = cb->io_info.iova_len;
+		break;
+	case CAM_SMMU_REGION_SECHEAP:
+		if (!cb->secheap_support) {
+			CAM_ERR(CAM_SMMU, "Secondary heap not supported");
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -ENODEV;
+		}
+		region_info->iova_start = cb->secheap_info.iova_start;
+		region_info->iova_len = cb->secheap_info.iova_len;
+		break;
+	default:
+		CAM_ERR(CAM_SMMU, "Invalid region id: %d for smmu hdl: %X",
+			smmu_hdl, region_id);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return -EINVAL;
+	}
+
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return 0;
+}
+EXPORT_SYMBOL(cam_smmu_get_region_info);
+
+static int cam_smmu_map_to_pool(struct iommu_domain *domain,
+				struct gen_pool *pool, struct sg_table *table,
+				int prot, dma_addr_t *iova, size_t *size)
+{
+	struct scatterlist *sg;
+	size_t buffer_size;
+	size_t mapped_size;
+	int i;
+
+	if (!pool)
+		return -EINVAL;
+
+	buffer_size = 0;
+	for_each_sg(table->sgl, sg, table->orig_nents, i)
+		buffer_size += sg->length;
+
+	/*
+	 * The real buffer size is less than it was requested by the caller.
+	 * Handle this gracefully by allocating more IOVA space. This will
+	 * prevent out of bounds access, which instead will result in IOMMU
+	 * page faults.
+	 */
+	if (buffer_size < *size)
+		buffer_size = *size;
+
+	*iova = gen_pool_alloc(pool, buffer_size);
+	if (!*iova)
+		return -ENOMEM;
+
+	mapped_size = iommu_map_sgtable(domain, *iova, table, prot);
+	if (mapped_size < *size) {
+		CAM_ERR(CAM_SMMU, "iommu_map_sgtable() failed");
+		goto err_free_iova;
+	}
+	*size = mapped_size;
+
+	return 0;
+
+err_free_iova:
+	gen_pool_free(pool, *iova, buffer_size);
+
+	return -ENOMEM;
+}
+
+static void cam_smmu_unmap_from_pool(struct iommu_domain *domain,
+				     struct gen_pool *pool,
+				     dma_addr_t iova, size_t size)
+{
+	if (!pool)
+		return;
+
+	iommu_unmap(domain, iova, size);
+	gen_pool_free(pool, iova, size);
+}
+
+static struct gen_pool *
+cam_smmu_get_pool_for_region(struct cam_context_bank_info *cb,
+			     enum cam_smmu_region_id region_id)
+{
+	switch (region_id) {
+	case CAM_SMMU_REGION_SHARED:
+		return cb->shared_mem_pool;
+	case CAM_SMMU_REGION_IO:
+		return cb->io_mem_pool;
+	default:
+		return NULL;
+	}
+}
+
+int cam_smmu_reserve_sec_heap(int32_t smmu_hdl,
+	struct dma_buf *buf,
+	dma_addr_t *iova,
+	size_t *request_len)
+{
+	struct secheap_buf_info *secheap_buf = NULL;
+	size_t size = 0;
+	uint32_t sec_heap_iova = 0;
+	size_t sec_heap_iova_len = 0;
+	int idx;
+	int rc = 0;
+	int prot = 0;
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].secheap_support) {
+		CAM_ERR(CAM_SMMU, "Secondary heap not supported");
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+
+	if (iommu_cb_set.cb_info[idx].is_secheap_allocated) {
+		CAM_ERR(CAM_SMMU, "Trying to allocate secheap twice");
+		rc = -ENOMEM;
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return rc;
+	}
+
+	if (IS_ERR_OR_NULL(buf)) {
+		rc = PTR_ERR(buf);
+		CAM_ERR(CAM_SMMU,
+			"Error: dma get buf failed. rc = %d", rc);
+		goto err_out;
+	}
+
+	secheap_buf = &iommu_cb_set.cb_info[idx].secheap_buf;
+	secheap_buf->buf = buf;
+	secheap_buf->attach = dma_buf_attach(secheap_buf->buf,
+		iommu_cb_set.cb_info[idx].dev);
+	if (IS_ERR_OR_NULL(secheap_buf->attach)) {
+		rc = PTR_ERR(secheap_buf->attach);
+		CAM_ERR(CAM_SMMU, "Error: dma buf attach failed");
+		goto err_put;
+	}
+
+	secheap_buf->table = dma_buf_map_attachment(secheap_buf->attach,
+		DMA_BIDIRECTIONAL);
+	if (IS_ERR_OR_NULL(secheap_buf->table)) {
+		rc = PTR_ERR(secheap_buf->table);
+		CAM_ERR(CAM_SMMU, "Error: dma buf map attachment failed");
+		goto err_detach;
+	}
+
+	sec_heap_iova = iommu_cb_set.cb_info[idx].secheap_info.iova_start;
+	sec_heap_iova_len = iommu_cb_set.cb_info[idx].secheap_info.iova_len;
+
+	prot = IOMMU_READ | IOMMU_WRITE;
+	if (iommu_cb_set.force_cache_allocs)
+		prot |= IOMMU_CACHE;
+
+	size = iommu_map_sg(iommu_cb_set.cb_info[idx].domain,
+		sec_heap_iova,
+		secheap_buf->table->sgl,
+		secheap_buf->table->orig_nents,
+		prot, GFP_KERNEL);
+	if (size != sec_heap_iova_len) {
+		CAM_ERR(CAM_SMMU,
+			"IOMMU mapping failed size=%zu, sec_heap_iova_len=%zu",
+			size, sec_heap_iova_len);
+		goto err_unmap_sg;
+	}
+
+	iommu_cb_set.cb_info[idx].is_secheap_allocated = true;
+	*iova = (uint32_t)sec_heap_iova;
+	*request_len = sec_heap_iova_len;
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+
+	return rc;
+
+err_unmap_sg:
+	dma_buf_unmap_attachment(secheap_buf->attach,
+		secheap_buf->table,
+		DMA_BIDIRECTIONAL);
+err_detach:
+	dma_buf_detach(secheap_buf->buf,
+		secheap_buf->attach);
+err_put:
+	dma_buf_put(secheap_buf->buf);
+err_out:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_reserve_sec_heap);
+
+int cam_smmu_release_sec_heap(int32_t smmu_hdl)
+{
+	int idx;
+	size_t size = 0;
+	uint32_t sec_heap_iova = 0;
+	size_t sec_heap_iova_len = 0;
+	struct secheap_buf_info *secheap_buf = NULL;
+
+	idx = GET_SMMU_TABLE_IDX(smmu_hdl);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, smmu_hdl);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].secheap_support) {
+		CAM_ERR(CAM_SMMU, "Secondary heap not supported");
+		return -EINVAL;
+	}
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+
+	if (!iommu_cb_set.cb_info[idx].is_secheap_allocated) {
+		CAM_ERR(CAM_SMMU, "Trying to release secheap twice");
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return -ENOMEM;
+	}
+
+	secheap_buf = &iommu_cb_set.cb_info[idx].secheap_buf;
+	sec_heap_iova = iommu_cb_set.cb_info[idx].secheap_info.iova_start;
+	sec_heap_iova_len = iommu_cb_set.cb_info[idx].secheap_info.iova_len;
+
+	size = iommu_unmap(iommu_cb_set.cb_info[idx].domain,
+		sec_heap_iova,
+		sec_heap_iova_len);
+	if (size != sec_heap_iova_len) {
+		CAM_ERR(CAM_SMMU, "Failed: Unmapped = %zu, requested = %zu",
+			size,
+			sec_heap_iova_len);
+	}
+
+	dma_buf_unmap_attachment(secheap_buf->attach,
+		secheap_buf->table, DMA_BIDIRECTIONAL);
+	dma_buf_detach(secheap_buf->buf, secheap_buf->attach);
+	dma_buf_put(secheap_buf->buf);
+	iommu_cb_set.cb_info[idx].is_secheap_allocated = false;
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_smmu_release_sec_heap);
+
+static int cam_smmu_map_buffer_validate(struct dma_buf *buf,
+	int idx, enum dma_data_direction dma_dir, dma_addr_t *paddr_ptr,
+	size_t *len_ptr, enum cam_smmu_region_id region_id,
+	bool dis_delayed_unmap, struct cam_dma_buff_info **mapping_info)
+{
+	struct cam_context_bank_info *cb = &iommu_cb_set.cb_info[idx];
+	struct dma_buf_attachment *attach = NULL;
+	struct sg_table *table = NULL;
+	struct gen_pool *pool;
+	uint32_t iova = 0;
+	int rc = 0, prot = 0;
+	struct timespec64 ts1, ts2;
+	long microsec = 0;
+
+	if (IS_ERR_OR_NULL(buf)) {
+		rc = PTR_ERR(buf);
+		CAM_ERR(CAM_SMMU,
+			"Error: invalid dma_buf rc = %d", rc);
+		goto err_out;
+	}
+
+	if (!mapping_info) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_SMMU, "Error: mapping_info is invalid");
+		goto err_out;
+	}
+
+	if (iommu_cb_set.map_profile_enable)
+		CAM_GET_TIMESTAMP(ts1);
+
+	attach = dma_buf_attach(buf, cb->dev);
+	if (IS_ERR_OR_NULL(attach)) {
+		rc = PTR_ERR(attach);
+		CAM_ERR(CAM_SMMU, "Error: dma buf attach failed");
+		goto err_out;
+	}
+
+	table = dma_buf_map_attachment(attach, dma_dir);
+	if (IS_ERR_OR_NULL(table)) {
+		rc = PTR_ERR(table);
+		CAM_ERR(CAM_SMMU, "Error: dma map attachment failed");
+		goto err_buf_detach;
+	}
+
+	pool = cam_smmu_get_pool_for_region(cb, region_id);
+	if (!pool) {
+		CAM_ERR(CAM_SMMU, "Error: Wrong region requested");
+		rc = -EINVAL;
+		goto err_buf_unmap_attach;
+	}
+
+	if (iommu_cb_set.force_cache_allocs)
+		prot |= IOMMU_CACHE;
+
+	prot |= IOMMU_READ | IOMMU_WRITE;
+	rc = cam_smmu_map_to_pool(cb->domain, pool, table, prot, paddr_ptr, len_ptr);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"Buffer map failed, region_id=%u, size=%zu, idx=%d, handle=%d",
+			region_id, *len_ptr, idx,
+			iommu_cb_set.cb_info[idx].handle);
+		goto err_free_iova;
+	}
+
+	if (region_id == CAM_SMMU_REGION_SHARED)
+		cb->shared_mapping_size += *len_ptr;
+	else
+		cb->io_mapping_size += *len_ptr;
+
+	CAM_DBG(CAM_SMMU,
+		"iova=%pK, region_id=%d, paddr=%pK, len=%d",
+		iova, region_id, *paddr_ptr, *len_ptr);
+
+	if (iommu_cb_set.map_profile_enable) {
+		CAM_GET_TIMESTAMP(ts2);
+		CAM_GET_TIMESTAMP_DIFF_IN_MICRO(ts1, ts2, microsec);
+		trace_cam_log_event("SMMUMapProfile", "size and time in micro",
+			*len_ptr, microsec);
+	}
+
+	CAM_DBG(CAM_SMMU,
+		"DMA buf: %pK, device: %pK, attach: %pK, table: %pK",
+		(void *)buf,
+		(void *)iommu_cb_set.cb_info[idx].dev,
+		(void *)attach, (void *)table);
+	CAM_DBG(CAM_SMMU, "table sgl: %pK, rc: %d, dma_address: 0x%x",
+		(void *)table->sgl, rc,
+		(unsigned int)table->sgl->dma_address);
+
+	/* fill up mapping_info */
+	*mapping_info = kzalloc(sizeof(struct cam_dma_buff_info), GFP_KERNEL);
+	if (!(*mapping_info)) {
+		rc = -ENOSPC;
+		goto err_free_iova;
+	}
+
+	(*mapping_info)->buf = buf;
+	(*mapping_info)->attach = attach;
+	(*mapping_info)->table = table;
+	(*mapping_info)->paddr = *paddr_ptr;
+	(*mapping_info)->len = *len_ptr;
+	(*mapping_info)->dir = dma_dir;
+	(*mapping_info)->ref_count = 1;
+	(*mapping_info)->region_id = region_id;
+
+	if (!*paddr_ptr || !*len_ptr) {
+		CAM_ERR(CAM_SMMU, "Error: Space Allocation failed");
+		kfree(*mapping_info);
+		*mapping_info = NULL;
+		rc = -ENOSPC;
+		goto err_free_iova;
+	}
+
+	CAM_DBG(CAM_SMMU, "idx=%d, dma_buf=%pK, dev=%pK, paddr=%pK, len=%u",
+		idx, buf, (void *)iommu_cb_set.cb_info[idx].dev,
+		(void *)*paddr_ptr, (unsigned int)*len_ptr);
+
+	dma_buf_unmap_attachment(attach, table, dma_dir);
+
+	return 0;
+
+err_free_iova:
+	cam_smmu_unmap_from_pool(cb->domain, pool, *len_ptr, *paddr_ptr);
+err_buf_unmap_attach:
+	dma_buf_unmap_attachment(attach, table, dma_dir);
+err_buf_detach:
+	dma_buf_detach(buf, attach);
+err_out:
+	return rc;
+}
+
+
+static int cam_smmu_map_buffer_and_add_to_list(int idx, int ion_fd,
+	bool dis_delayed_unmap, enum dma_data_direction dma_dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id, bool is_internal, struct dma_buf *buf)
+{
+	int rc = -1;
+	struct cam_dma_buff_info *mapping_info = NULL;
+
+	rc = cam_smmu_map_buffer_validate(buf, idx, dma_dir, paddr_ptr, len_ptr,
+		region_id, dis_delayed_unmap, &mapping_info);
+
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "buffer validation failure");
+		return rc;
+	}
+
+	mapping_info->ion_fd = ion_fd;
+	mapping_info->is_internal = is_internal;
+	ktime_get_real_ts64(&mapping_info->ts);
+	/* add to the list */
+	list_add(&mapping_info->list,
+		&iommu_cb_set.cb_info[idx].smmu_buf_list);
+
+	cam_smmu_update_monitor_array(&iommu_cb_set.cb_info[idx], true,
+		mapping_info);
+
+	return 0;
+}
+
+static int cam_smmu_map_kernel_buffer_and_add_to_list(int idx,
+	struct dma_buf *buf, enum dma_data_direction dma_dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id)
+{
+	int rc = -1;
+	struct cam_dma_buff_info *mapping_info = NULL;
+
+	rc = cam_smmu_map_buffer_validate(buf, idx, dma_dir, paddr_ptr, len_ptr,
+		region_id, false, &mapping_info);
+
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "buffer validation failure");
+		return rc;
+	}
+
+	mapping_info->ion_fd = -1;
+	ktime_get_real_ts64(&mapping_info->ts);
+	/* add to the list */
+	list_add(&mapping_info->list,
+		&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list);
+
+	cam_smmu_update_monitor_array(&iommu_cb_set.cb_info[idx], true,
+		mapping_info);
+
+	return 0;
+}
+
+
+static int cam_smmu_unmap_buf_and_remove_from_list(
+	struct cam_dma_buff_info *mapping_info,
+	int idx)
+{
+	struct cam_context_bank_info *cb = &iommu_cb_set.cb_info[idx];
+	struct gen_pool *pool = NULL;
+	struct timespec64 ts1, ts2;
+	long microsec = 0;
+
+	if ((!mapping_info->buf) || (!mapping_info->table) ||
+		(!mapping_info->attach)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params dev = %pK, table = %pK",
+			(void *)iommu_cb_set.cb_info[idx].dev,
+			(void *)mapping_info->table);
+		CAM_ERR(CAM_SMMU, "Error:dma_buf = %pK, attach = %pK",
+			(void *)mapping_info->buf,
+			(void *)mapping_info->attach);
+		return -EINVAL;
+	}
+
+	cam_smmu_update_monitor_array(&iommu_cb_set.cb_info[idx], false,
+		mapping_info);
+
+	CAM_DBG(CAM_SMMU, "region_id=%d, paddr=%pK, len=%d",
+		mapping_info->region_id, mapping_info->paddr, mapping_info->len);
+
+	if (iommu_cb_set.map_profile_enable)
+		CAM_GET_TIMESTAMP(ts1);
+
+	pool = cam_smmu_get_pool_for_region(cb, mapping_info->region_id);
+	cam_smmu_unmap_from_pool(cb->domain, pool,
+				 mapping_info->paddr,
+				 mapping_info->len);
+	if (mapping_info->region_id == CAM_SMMU_REGION_SHARED)
+		cb->shared_mapping_size -= mapping_info->len;
+	else
+		cb->io_mapping_size -= mapping_info->len;
+
+	dma_buf_detach(mapping_info->buf, mapping_info->attach);
+
+	if (iommu_cb_set.map_profile_enable) {
+		CAM_GET_TIMESTAMP(ts2);
+		CAM_GET_TIMESTAMP_DIFF_IN_MICRO(ts1, ts2, microsec);
+		trace_cam_log_event("SMMUUnmapProfile",
+			"size and time in micro", mapping_info->len, microsec);
+	}
+
+	mapping_info->buf = NULL;
+
+	list_del_init(&mapping_info->list);
+
+	/* free one buffer */
+	kfree(mapping_info);
+	return 0;
+}
+
+static enum cam_smmu_buf_state cam_smmu_check_fd_in_list(int idx,
+	int ion_fd, dma_addr_t *paddr_ptr, size_t *len_ptr,
+	struct timespec64 **ts_mapping)
+{
+	struct cam_dma_buff_info *mapping;
+
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		if (mapping->ion_fd == ion_fd) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			*ts_mapping = &mapping->ts;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+static enum cam_smmu_buf_state cam_smmu_user_reuse_fd_in_list(int idx,
+	int ion_fd, dma_addr_t *paddr_ptr, size_t *len_ptr,
+	struct timespec64 **ts_mapping)
+{
+	struct cam_dma_buff_info *mapping;
+
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {
+		if (mapping->ion_fd == ion_fd) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			*ts_mapping = &mapping->ts;
+			mapping->ref_count++;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+static enum cam_smmu_buf_state cam_smmu_check_dma_buf_in_list(int idx,
+	struct dma_buf *buf, dma_addr_t *paddr_ptr, size_t *len_ptr)
+{
+	struct cam_dma_buff_info *mapping;
+
+	list_for_each_entry(mapping,
+		&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list, list) {
+		if (mapping->buf == buf) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+static enum cam_smmu_buf_state cam_smmu_check_secure_fd_in_list(int idx,
+					int ion_fd, dma_addr_t *paddr_ptr,
+					size_t *len_ptr)
+{
+	struct cam_sec_buff_info *mapping;
+
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list,
+			list) {
+		if (mapping->ion_fd == ion_fd) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			mapping->ref_count++;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+static enum cam_smmu_buf_state cam_smmu_validate_secure_fd_in_list(int idx,
+	int ion_fd, dma_addr_t *paddr_ptr, size_t *len_ptr)
+{
+	struct cam_sec_buff_info *mapping;
+
+	list_for_each_entry(mapping,
+			&iommu_cb_set.cb_info[idx].smmu_buf_list,
+			list) {
+		if (mapping->ion_fd == ion_fd) {
+			*paddr_ptr = mapping->paddr;
+			*len_ptr = mapping->len;
+			return CAM_SMMU_BUFF_EXIST;
+		}
+	}
+
+	return CAM_SMMU_BUFF_NOT_EXIST;
+}
+
+int cam_smmu_get_handle(char *identifier, int *handle_ptr)
+{
+	int rc = 0;
+
+	if (!identifier) {
+		CAM_ERR(CAM_SMMU, "Error: iommu hardware name is NULL");
+		return -EINVAL;
+	}
+
+	if (!handle_ptr) {
+		CAM_ERR(CAM_SMMU, "Error: handle pointer is NULL");
+		return -EINVAL;
+	}
+
+	/* create and put handle in the table */
+	rc = cam_smmu_create_add_handle_in_table(identifier, handle_ptr);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "Error: %s get handle fail, rc %d",
+			identifier, rc);
+
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_get_handle);
+
+int cam_smmu_ops(int handle, enum cam_smmu_ops_param ops)
+{
+	int ret = 0, idx;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU, "Error: Index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return -EINVAL;
+	}
+
+	switch (ops) {
+	case CAM_SMMU_ATTACH: {
+		ret = cam_smmu_attach(idx);
+		break;
+	}
+	case CAM_SMMU_DETACH: {
+		ret = cam_smmu_detach_device(idx);
+		break;
+	}
+	case CAM_SMMU_VOTE:
+	case CAM_SMMU_DEVOTE:
+	default:
+		CAM_ERR(CAM_SMMU, "Error: idx = %d, ops = %d", idx, ops);
+		ret = -EINVAL;
+	}
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return ret;
+}
+EXPORT_SYMBOL(cam_smmu_ops);
+
+static int cam_smmu_alloc_scratch_buffer_add_to_list(int idx,
+	size_t virt_len,
+	size_t phys_len,
+	unsigned int iommu_dir,
+	dma_addr_t *virt_addr)
+{
+	unsigned long nents = virt_len / phys_len;
+	struct cam_dma_buff_info *mapping_info = NULL;
+	size_t unmapped;
+	dma_addr_t iova = 0;
+	struct scatterlist *sg;
+	int i = 0;
+	int rc;
+	struct iommu_domain *domain = NULL;
+	struct page *page;
+	struct sg_table *table = NULL;
+
+	CAM_DBG(CAM_SMMU, "nents = %lu, idx = %d, virt_len  = %zx",
+		nents, idx, virt_len);
+	CAM_DBG(CAM_SMMU, "phys_len = %zx, iommu_dir = %d, virt_addr = %pK",
+		phys_len, iommu_dir, virt_addr);
+
+	/*
+	 * This table will go inside the 'mapping' structure
+	 * where it will be held until put_scratch_buffer is called
+	 */
+	table = kzalloc(sizeof(struct sg_table), GFP_KERNEL);
+	if (!table) {
+		rc = -ENOMEM;
+		goto err_table_alloc;
+	}
+
+	rc = sg_alloc_table(table, nents, GFP_KERNEL);
+	if (rc < 0) {
+		rc = -EINVAL;
+		goto err_sg_alloc;
+	}
+
+	page = alloc_pages(GFP_KERNEL, get_order(phys_len));
+	if (!page) {
+		rc = -ENOMEM;
+		goto err_page_alloc;
+	}
+
+	/* Now we create the sg list */
+	for_each_sg(table->sgl, sg, table->nents, i)
+		sg_set_page(sg, page, phys_len, 0);
+
+
+	/* Get the domain from within our cb_set struct and map it*/
+	domain = iommu_cb_set.cb_info[idx].domain;
+
+	rc = cam_smmu_alloc_scratch_va(&iommu_cb_set.cb_info[idx].scratch_map,
+		virt_len, &iova);
+
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"Could not find valid iova for scratch buffer");
+		goto err_iommu_map;
+	}
+
+	if (iommu_cb_set.force_cache_allocs)
+		iommu_dir |= IOMMU_CACHE;
+
+	if (iommu_map_sg(domain,
+		iova,
+		table->sgl,
+		table->nents,
+		iommu_dir, GFP_KERNEL) != virt_len) {
+		CAM_ERR(CAM_SMMU, "iommu_map_sg() failed");
+		goto err_iommu_map;
+	}
+
+	/* Now update our mapping information within the cb_set struct */
+	mapping_info = kzalloc(sizeof(struct cam_dma_buff_info), GFP_KERNEL);
+	if (!mapping_info) {
+		rc = -ENOMEM;
+		goto err_mapping_info;
+	}
+
+	mapping_info->ion_fd = 0xDEADBEEF;
+	mapping_info->buf = NULL;
+	mapping_info->attach = NULL;
+	mapping_info->table = table;
+	mapping_info->paddr = iova;
+	mapping_info->len = virt_len;
+	mapping_info->iommu_dir = iommu_dir;
+	mapping_info->ref_count = 1;
+	mapping_info->phys_len = phys_len;
+	mapping_info->region_id = CAM_SMMU_REGION_SCRATCH;
+
+	CAM_DBG(CAM_SMMU, "paddr = %pK, len = %zx, phys_len = %zx",
+		(void *)mapping_info->paddr,
+		mapping_info->len, mapping_info->phys_len);
+
+	list_add(&mapping_info->list, &iommu_cb_set.cb_info[idx].smmu_buf_list);
+
+	*virt_addr = (dma_addr_t)iova;
+
+	CAM_DBG(CAM_SMMU, "mapped virtual address = %lx",
+		(unsigned long)*virt_addr);
+	return 0;
+
+err_mapping_info:
+	unmapped = iommu_unmap(domain, iova,  virt_len);
+	if (unmapped != virt_len)
+		CAM_ERR(CAM_SMMU, "Unmapped only %zx instead of %zx",
+			unmapped, virt_len);
+err_iommu_map:
+	__free_pages(page, get_order(phys_len));
+err_page_alloc:
+	sg_free_table(table);
+err_sg_alloc:
+	kfree(table);
+err_table_alloc:
+	return rc;
+}
+
+static int cam_smmu_free_scratch_buffer_remove_from_list(
+	struct cam_dma_buff_info *mapping_info,
+	int idx)
+{
+	int rc = 0;
+	size_t unmapped;
+	struct iommu_domain *domain =
+		iommu_cb_set.cb_info[idx].domain;
+	struct scratch_mapping *scratch_map =
+		&iommu_cb_set.cb_info[idx].scratch_map;
+
+	if (!mapping_info->table) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params: dev = %pK, table = %pK",
+			(void *)iommu_cb_set.cb_info[idx].dev,
+			(void *)mapping_info->table);
+		return -EINVAL;
+	}
+
+	/* Clean up the mapping_info struct from the list */
+	unmapped = iommu_unmap(domain, mapping_info->paddr, mapping_info->len);
+	if (unmapped != mapping_info->len)
+		CAM_ERR(CAM_SMMU, "Unmapped only %zx instead of %zx",
+			unmapped, mapping_info->len);
+
+	rc = cam_smmu_free_scratch_va(scratch_map,
+		mapping_info->paddr,
+		mapping_info->len);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid iova while freeing scratch buffer");
+		rc = -EINVAL;
+	}
+
+	__free_pages(sg_page(mapping_info->table->sgl),
+			get_order(mapping_info->phys_len));
+	sg_free_table(mapping_info->table);
+	kfree(mapping_info->table);
+	list_del_init(&mapping_info->list);
+
+	kfree(mapping_info);
+	mapping_info = NULL;
+
+	return rc;
+}
+
+int cam_smmu_get_scratch_iova(int handle,
+	enum cam_smmu_map_dir dir,
+	dma_addr_t *paddr_ptr,
+	size_t virt_len,
+	size_t phys_len)
+{
+	int idx, rc;
+	unsigned int iommu_dir;
+
+	if (!paddr_ptr || !virt_len || !phys_len) {
+		CAM_ERR(CAM_SMMU, "Error: Input pointer or lengths invalid");
+		return -EINVAL;
+	}
+
+	if (virt_len < phys_len) {
+		CAM_ERR(CAM_SMMU, "Error: virt_len > phys_len");
+		return -EINVAL;
+	}
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	iommu_dir = cam_smmu_translate_dir_to_iommu_dir(dir);
+	if (iommu_dir == IOMMU_INVALID_DIR) {
+		CAM_ERR(CAM_SMMU,
+			"Error: translate direction failed. dir = %d", dir);
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].scratch_buf_support) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Context bank does not support scratch bufs");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	CAM_DBG(CAM_SMMU, "smmu handle = %x, idx = %d, dir = %d",
+		handle, idx, dir);
+	CAM_DBG(CAM_SMMU, "virt_len = %zx, phys_len  = %zx",
+		phys_len, virt_len);
+
+	if (iommu_cb_set.cb_info[idx].state != CAM_SMMU_ATTACH) {
+		CAM_ERR(CAM_SMMU,
+			"Err:Dev %s should call SMMU attach before map buffer",
+			iommu_cb_set.cb_info[idx].name[0]);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	if (!IS_ALIGNED(virt_len, PAGE_SIZE)) {
+		CAM_ERR(CAM_SMMU,
+			"Requested scratch buffer length not page aligned");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	if (!IS_ALIGNED(virt_len, phys_len)) {
+		CAM_ERR(CAM_SMMU,
+			"Requested virt length not aligned with phys length");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	rc = cam_smmu_alloc_scratch_buffer_add_to_list(idx,
+		virt_len,
+		phys_len,
+		iommu_dir,
+		paddr_ptr);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "Error: mapping or add list fail");
+
+error:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+
+int cam_smmu_put_scratch_iova(int handle,
+	dma_addr_t paddr)
+{
+	int idx;
+	int rc = -1;
+	struct cam_dma_buff_info *mapping_info;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* find index in the iommu_cb_set.cb_info */
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto handle_err;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].scratch_buf_support) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Context bank does not support scratch buffers");
+		rc = -EINVAL;
+		goto handle_err;
+	}
+
+	/* Based on virtual address and index, we can find mapping info
+	 * of the scratch buffer
+	 */
+	mapping_info = cam_smmu_find_mapping_by_virt_address(idx, paddr);
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid params");
+		rc = -ENODEV;
+		goto handle_err;
+	}
+
+	/* unmapping one buffer from device */
+	rc = cam_smmu_free_scratch_buffer_remove_from_list(mapping_info, idx);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: unmap or remove list fail");
+		goto handle_err;
+	}
+
+handle_err:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+
+static int cam_smmu_map_stage2_buffer_and_add_to_list(int idx, int ion_fd,
+		 enum dma_data_direction dma_dir, dma_addr_t *paddr_ptr,
+		 size_t *len_ptr, struct dma_buf *dmabuf)
+{
+	int rc = 0;
+	struct dma_buf_attachment *attach = NULL;
+	struct sg_table *table = NULL;
+	struct cam_sec_buff_info *mapping_info;
+
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	*len_ptr = (size_t)0;
+
+	/*
+	 * ion_phys() is deprecated. call dma_buf_attach() and
+	 * dma_buf_map_attachment() to get the buffer's physical
+	 * address.
+	 */
+	attach = dma_buf_attach(dmabuf, iommu_cb_set.cb_info[idx].dev);
+	if (IS_ERR_OR_NULL(attach)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: dma buf attach failed, idx=%d, ion_fd=%d",
+			idx, ion_fd);
+		rc = PTR_ERR(attach);
+		goto err_out;
+	}
+
+	table = dma_buf_map_attachment(attach, dma_dir);
+	if (IS_ERR_OR_NULL(table)) {
+		CAM_ERR(CAM_SMMU, "Error: dma buf map attachment failed");
+		rc = PTR_ERR(table);
+		goto err_detach;
+	}
+
+	/* return addr and len to client */
+	*paddr_ptr = sg_phys(table->sgl);
+	*len_ptr = (size_t)sg_dma_len(table->sgl);
+
+	/* fill up mapping_info */
+	mapping_info = kzalloc(sizeof(struct cam_sec_buff_info), GFP_KERNEL);
+	if (!mapping_info) {
+		rc = -ENOMEM;
+		goto err_unmap_sg;
+	}
+
+	mapping_info->ion_fd = ion_fd;
+	mapping_info->paddr = *paddr_ptr;
+	mapping_info->len = *len_ptr;
+	mapping_info->dir = dma_dir;
+	mapping_info->ref_count = 1;
+	mapping_info->buf = dmabuf;
+	mapping_info->attach = attach;
+	mapping_info->table = table;
+
+	CAM_DBG(CAM_SMMU, "idx=%d, ion_fd=%d, dev=%pK, paddr=%pK, len=%u",
+			idx, ion_fd,
+			(void *)iommu_cb_set.cb_info[idx].dev,
+			(void *)*paddr_ptr, (unsigned int)*len_ptr);
+
+	/* add to the list */
+	list_add(&mapping_info->list, &iommu_cb_set.cb_info[idx].smmu_buf_list);
+
+	return 0;
+
+err_unmap_sg:
+	dma_buf_unmap_attachment(attach, table, dma_dir);
+err_detach:
+	dma_buf_detach(dmabuf, attach);
+err_out:
+	return rc;
+}
+
+int cam_smmu_map_stage2_iova(int handle,
+		int ion_fd, enum cam_smmu_map_dir dir,
+		dma_addr_t *paddr_ptr, size_t *len_ptr,
+		struct dma_buf *dmabuf)
+{
+	int idx, rc;
+	enum dma_data_direction dma_dir;
+	enum cam_smmu_buf_state buf_state;
+
+	if (!paddr_ptr || !len_ptr) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid inputs, paddr_ptr:%pK, len_ptr: %pK",
+			paddr_ptr, len_ptr);
+		return -EINVAL;
+	}
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	*len_ptr = (size_t)0;
+
+	dma_dir = cam_smmu_translate_dir(dir);
+	if (dma_dir == DMA_NONE) {
+		CAM_ERR(CAM_SMMU,
+			"Error: translate direction failed. dir = %d", dir);
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if ((handle == HANDLE_INIT) ||
+		(idx < 0) ||
+		(idx >= iommu_cb_set.cb_num)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't map secure mem to non secure cb, idx=%d",
+			idx);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, idx=%d, table_hdl=%x, hdl=%x",
+			idx, iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_check_secure_fd_in_list(idx, ion_fd, paddr_ptr,
+			len_ptr);
+	if (buf_state == CAM_SMMU_BUFF_EXIST) {
+		CAM_DBG(CAM_SMMU,
+			"fd:%d already in list idx:%d, handle=%d give same addr back",
+			ion_fd, idx, handle);
+		rc = 0;
+		goto get_addr_end;
+	}
+	rc = cam_smmu_map_stage2_buffer_and_add_to_list(idx, ion_fd, dma_dir,
+			paddr_ptr, len_ptr, dmabuf);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"Error: mapping or add list fail, idx=%d, handle=%d, fd=%d, rc=%d",
+			idx, handle, ion_fd, rc);
+		goto get_addr_end;
+	}
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_map_stage2_iova);
+
+static int cam_smmu_secure_unmap_buf_and_remove_from_list(
+		struct cam_sec_buff_info *mapping_info,
+		int idx)
+{
+	if ((!mapping_info->buf) || (!mapping_info->table) ||
+		(!mapping_info->attach)) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid params dev = %pK, table = %pK",
+			(void *)iommu_cb_set.cb_info[idx].dev,
+			(void *)mapping_info->table);
+		CAM_ERR(CAM_SMMU, "Error:dma_buf = %pK, attach = %pK\n",
+			(void *)mapping_info->buf,
+			(void *)mapping_info->attach);
+		return -EINVAL;
+	}
+
+	/* iommu buffer clean up */
+	dma_buf_unmap_attachment(mapping_info->attach,
+		mapping_info->table, mapping_info->dir);
+	dma_buf_detach(mapping_info->buf, mapping_info->attach);
+	mapping_info->buf = NULL;
+
+	list_del_init(&mapping_info->list);
+
+	CAM_DBG(CAM_SMMU, "unmap fd: %d, idx : %d", mapping_info->ion_fd, idx);
+
+	/* free one buffer */
+	kfree(mapping_info);
+	return 0;
+}
+
+int cam_smmu_unmap_stage2_iova(int handle, int ion_fd)
+{
+	int idx, rc;
+	struct cam_sec_buff_info *mapping_info;
+
+	/* find index in the iommu_cb_set.cb_info */
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if ((handle == HANDLE_INIT) ||
+		(idx < 0) ||
+		(idx >= iommu_cb_set.cb_num)) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't unmap secure mem from non secure cb");
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto put_addr_end;
+	}
+
+	/* based on ion fd and index, we can find mapping info of buffer */
+	mapping_info = cam_smmu_find_mapping_by_sec_buf_idx(idx, ion_fd);
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params! idx = %d, fd = %d",
+			idx, ion_fd);
+		rc = -EINVAL;
+		goto put_addr_end;
+	}
+
+	mapping_info->ref_count--;
+	if (mapping_info->ref_count > 0) {
+		CAM_DBG(CAM_SMMU,
+			"idx: %d fd = %d ref_count: %d",
+			idx, ion_fd, mapping_info->ref_count);
+		rc = 0;
+		goto put_addr_end;
+	}
+	mapping_info->ref_count = 0;
+
+	/* unmapping one buffer from device */
+	rc = cam_smmu_secure_unmap_buf_and_remove_from_list(mapping_info, idx);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "Error: unmap or remove list fail");
+		goto put_addr_end;
+	}
+
+put_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_unmap_stage2_iova);
+
+static int cam_smmu_map_iova_validate_params(int handle,
+	enum cam_smmu_map_dir dir,
+	dma_addr_t *paddr_ptr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id)
+{
+	int idx, rc = 0;
+	enum dma_data_direction dma_dir;
+
+	if (!paddr_ptr || !len_ptr) {
+		CAM_ERR(CAM_SMMU, "Input pointers are invalid");
+		return -EINVAL;
+	}
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Invalid handle");
+		return -EINVAL;
+	}
+
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	if (region_id != CAM_SMMU_REGION_SHARED)
+		*len_ptr = (size_t)0;
+
+	dma_dir = cam_smmu_translate_dir(dir);
+	if (dma_dir == DMA_NONE) {
+		CAM_ERR(CAM_SMMU, "translate direction failed. dir = %d", dir);
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU, "handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int cam_smmu_map_user_iova(int handle, int ion_fd, bool dis_delayed_unmap,
+	enum cam_smmu_map_dir dir, dma_addr_t *paddr_ptr,
+	size_t *len_ptr, enum cam_smmu_region_id region_id,
+	bool is_internal, struct dma_buf *dmabuf)
+{
+	int idx, rc = 0;
+	struct timespec64 *ts = NULL;
+	enum cam_smmu_buf_state buf_state;
+	enum dma_data_direction dma_dir;
+
+	rc = cam_smmu_map_iova_validate_params(handle, dir, paddr_ptr,
+		len_ptr, region_id);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "initial checks failed, unable to proceed");
+		return rc;
+	}
+
+	dma_dir = (enum dma_data_direction)dir;
+	idx = GET_SMMU_TABLE_IDX(handle);
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't map non-secure mem to secure cb idx=%d",
+			idx);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"hdl is not valid, idx=%d, table_hdl = %x, hdl = %x",
+			idx, iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].state != CAM_SMMU_ATTACH) {
+		CAM_ERR(CAM_SMMU,
+			"Err:Dev %s should call SMMU attach before map buffer",
+			iommu_cb_set.cb_info[idx].name[0]);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_user_reuse_fd_in_list(idx, ion_fd, paddr_ptr,
+		len_ptr, &ts);
+	if (buf_state == CAM_SMMU_BUFF_EXIST) {
+		uint64_t ms = 0, tmp = 0, hrs = 0, min = 0, sec = 0;
+
+		if (ts) {
+			tmp = ts->tv_sec;
+			ms = (ts->tv_nsec) / 1000000;
+			sec = do_div(tmp, 60);
+			min = do_div(tmp, 60);
+			hrs = do_div(tmp, 24);
+		}
+		CAM_ERR(CAM_SMMU,
+			"fd=%d already in list [%llu:%llu:%llu:%llu] cb=%s idx=%d handle=%d len=%zu,give same addr back",
+			ion_fd, hrs, min, sec, ms,
+			iommu_cb_set.cb_info[idx].name[0],
+			idx, handle, *len_ptr);
+		rc = 0;
+		goto get_addr_end;
+	}
+
+	rc = cam_smmu_map_buffer_and_add_to_list(idx, ion_fd,
+		dis_delayed_unmap, dma_dir, paddr_ptr, len_ptr,
+		region_id, is_internal, dmabuf);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"mapping or add list fail cb:%s idx=%d, fd=%d, region=%d, rc=%d",
+			iommu_cb_set.cb_info[idx].name[0], idx,
+			ion_fd, region_id, rc);
+		cam_smmu_dump_cb_info(idx);
+	}
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_map_user_iova);
+
+int cam_smmu_map_kernel_iova(int handle, struct dma_buf *buf,
+	enum cam_smmu_map_dir dir, dma_addr_t *paddr_ptr,
+	size_t *len_ptr, enum cam_smmu_region_id region_id)
+{
+	int idx, rc = 0;
+	enum cam_smmu_buf_state buf_state;
+	enum dma_data_direction dma_dir;
+
+	rc = cam_smmu_map_iova_validate_params(handle, dir, paddr_ptr,
+		len_ptr, region_id);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "initial checks failed, unable to proceed");
+		return rc;
+	}
+
+	dma_dir = cam_smmu_translate_dir(dir);
+	idx = GET_SMMU_TABLE_IDX(handle);
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't map non-secure mem to secure cb");
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU, "hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].state != CAM_SMMU_ATTACH) {
+		CAM_ERR(CAM_SMMU,
+			"Err:Dev %s should call SMMU attach before map buffer",
+			iommu_cb_set.cb_info[idx].name[0]);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_check_dma_buf_in_list(idx, buf,
+		paddr_ptr, len_ptr);
+	if (buf_state == CAM_SMMU_BUFF_EXIST) {
+		CAM_ERR(CAM_SMMU,
+			"dma_buf :%pK already in the list", buf);
+		rc = -EALREADY;
+		goto get_addr_end;
+	}
+
+	rc = cam_smmu_map_kernel_buffer_and_add_to_list(idx, buf, dma_dir,
+			paddr_ptr, len_ptr, region_id);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "mapping or add list fail");
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_map_kernel_iova);
+
+int cam_smmu_get_iova(int handle, int ion_fd,
+	dma_addr_t *paddr_ptr, size_t *len_ptr)
+{
+	int idx, rc = 0;
+	struct timespec64 *ts = NULL;
+	enum cam_smmu_buf_state buf_state;
+
+	if (!paddr_ptr || !len_ptr) {
+		CAM_ERR(CAM_SMMU, "Error: Input pointers are invalid");
+		return -EINVAL;
+	}
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	*len_ptr = (size_t)0;
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't get non-secure mem from secure cb");
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_check_fd_in_list(idx, ion_fd, paddr_ptr,
+		len_ptr, &ts);
+	if (buf_state == CAM_SMMU_BUFF_NOT_EXIST) {
+		CAM_ERR(CAM_SMMU, "ion_fd:%d not in the mapped list", ion_fd);
+		rc = -EINVAL;
+		cam_smmu_dump_cb_info(idx);
+		goto get_addr_end;
+	}
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_get_iova);
+
+int cam_smmu_get_stage2_iova(int handle, int ion_fd,
+	dma_addr_t *paddr_ptr, size_t *len_ptr)
+{
+	int idx, rc = 0;
+	enum cam_smmu_buf_state buf_state;
+
+	if (!paddr_ptr || !len_ptr) {
+		CAM_ERR(CAM_SMMU, "Error: Input pointers are invalid");
+		return -EINVAL;
+	}
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* clean the content from clients */
+	*paddr_ptr = (dma_addr_t)NULL;
+	*len_ptr = (size_t)0;
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	if (!iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't get secure mem from non secure cb");
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+	buf_state = cam_smmu_validate_secure_fd_in_list(idx,
+		ion_fd,
+		paddr_ptr,
+		len_ptr);
+
+	if (buf_state == CAM_SMMU_BUFF_NOT_EXIST) {
+		CAM_ERR(CAM_SMMU, "ion_fd:%d not in the mapped list", ion_fd);
+		rc = -EINVAL;
+		goto get_addr_end;
+	}
+
+get_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_get_stage2_iova);
+
+static int cam_smmu_unmap_validate_params(int handle)
+{
+	int idx;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* find index in the iommu_cb_set.cb_info */
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_smmu_unmap_user_iova(int handle,
+	int ion_fd, enum cam_smmu_region_id region_id)
+{
+	int idx, rc;
+	struct cam_dma_buff_info *mapping_info;
+
+	rc = cam_smmu_unmap_validate_params(handle);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "unmap util validation failure");
+		return rc;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't unmap non-secure mem from secure cb");
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	/* Based on ion_fd & index, we can find mapping info of buffer */
+	mapping_info = cam_smmu_find_mapping_by_ion_index(idx, ion_fd);
+
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params idx = %d, fd = %d",
+			idx, ion_fd);
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	mapping_info->ref_count--;
+	if (mapping_info->ref_count > 0) {
+		CAM_DBG(CAM_SMMU,
+			"idx: %d fd = %d ref_count: %d",
+			idx, ion_fd, mapping_info->ref_count);
+		rc = 0;
+		goto unmap_end;
+	}
+	mapping_info->ref_count = 0;
+
+	/* Unmapping one buffer from device */
+	CAM_DBG(CAM_SMMU, "SMMU: removing buffer idx = %d", idx);
+	rc = cam_smmu_unmap_buf_and_remove_from_list(mapping_info, idx);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "Error: unmap or remove list fail");
+
+unmap_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_unmap_user_iova);
+
+int cam_smmu_unmap_kernel_iova(int handle,
+	struct dma_buf *buf, enum cam_smmu_region_id region_id)
+{
+	int idx, rc;
+	struct cam_dma_buff_info *mapping_info;
+
+	rc = cam_smmu_unmap_validate_params(handle);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "unmap util validation failure");
+		return rc;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		CAM_ERR(CAM_SMMU,
+			"Error: can't unmap non-secure mem from secure cb");
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	/* Based on dma_buf & index, we can find mapping info of buffer */
+	mapping_info = cam_smmu_find_mapping_by_dma_buf(idx, buf);
+
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU,
+			"Error: Invalid params idx = %d, dma_buf = %pK",
+			idx, buf);
+		rc = -EINVAL;
+		goto unmap_end;
+	}
+
+	/* Unmapping one buffer from device */
+	CAM_DBG(CAM_SMMU, "SMMU: removing buffer idx = %d", idx);
+	rc = cam_smmu_unmap_buf_and_remove_from_list(mapping_info, idx);
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "Error: unmap or remove list fail");
+
+unmap_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_unmap_kernel_iova);
+
+
+int cam_smmu_put_iova(int handle, int ion_fd)
+{
+	int idx;
+	int rc = 0;
+	struct cam_dma_buff_info *mapping_info;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	/* find index in the iommu_cb_set.cb_info */
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		rc = -EINVAL;
+		goto put_addr_end;
+	}
+
+	/* based on ion fd and index, we can find mapping info of buffer */
+	mapping_info = cam_smmu_find_mapping_by_ion_index(idx, ion_fd);
+	if (!mapping_info) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid params idx = %d, fd = %d",
+			idx, ion_fd);
+		rc = -EINVAL;
+		goto put_addr_end;
+	}
+
+put_addr_end:
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return rc;
+}
+EXPORT_SYMBOL(cam_smmu_put_iova);
+
+int cam_smmu_destroy_handle(int handle)
+{
+	int idx;
+
+	if (handle == HANDLE_INIT) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid handle");
+		return -EINVAL;
+	}
+
+	idx = GET_SMMU_TABLE_IDX(handle);
+	if (idx < 0 || idx >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU,
+			"Error: handle or index invalid. idx = %d hdl = %x",
+			idx, handle);
+		return -EINVAL;
+	}
+
+	mutex_lock(&iommu_cb_set.cb_info[idx].lock);
+	if (iommu_cb_set.cb_info[idx].handle != handle) {
+		CAM_ERR(CAM_SMMU,
+			"Error: hdl is not valid, table_hdl = %x, hdl = %x",
+			iommu_cb_set.cb_info[idx].handle, handle);
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return -EINVAL;
+	}
+
+	if (!list_empty_careful(&iommu_cb_set.cb_info[idx].smmu_buf_list)) {
+		CAM_ERR(CAM_SMMU, "UMD %s buffer list is not clean",
+			iommu_cb_set.cb_info[idx].name[0]);
+		cam_smmu_print_user_list(idx);
+		cam_smmu_clean_user_buffer_list(idx);
+	}
+
+	if (!list_empty_careful(
+		&iommu_cb_set.cb_info[idx].smmu_buf_kernel_list)) {
+		CAM_ERR(CAM_SMMU, "KMD %s buffer list is not clean",
+			iommu_cb_set.cb_info[idx].name[0]);
+		cam_smmu_print_kernel_list(idx);
+		cam_smmu_clean_kernel_buffer_list(idx);
+	}
+
+	if (iommu_cb_set.cb_info[idx].is_secure) {
+		if (iommu_cb_set.cb_info[idx].secure_count == 0) {
+			mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+			return -EPERM;
+		}
+
+		iommu_cb_set.cb_info[idx].secure_count--;
+		if (iommu_cb_set.cb_info[idx].secure_count == 0) {
+			iommu_cb_set.cb_info[idx].cb_count = 0;
+			iommu_cb_set.cb_info[idx].handle = HANDLE_INIT;
+		}
+
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return 0;
+	}
+
+	if (iommu_cb_set.cb_info[idx].is_mul_client &&
+		iommu_cb_set.cb_info[idx].device_count) {
+		iommu_cb_set.cb_info[idx].device_count--;
+
+		if (!iommu_cb_set.cb_info[idx].device_count) {
+			iommu_cb_set.cb_info[idx].cb_count = 0;
+			iommu_cb_set.cb_info[idx].handle = HANDLE_INIT;
+		}
+		mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+		return 0;
+	}
+
+	iommu_cb_set.cb_info[idx].device_count = 0;
+	iommu_cb_set.cb_info[idx].cb_count = 0;
+	iommu_cb_set.cb_info[idx].handle = HANDLE_INIT;
+	mutex_unlock(&iommu_cb_set.cb_info[idx].lock);
+	return 0;
+}
+EXPORT_SYMBOL(cam_smmu_destroy_handle);
+
+static void cam_smmu_deinit_cb(struct cam_context_bank_info *cb)
+{
+	if (cb->io_support) {
+		gen_pool_destroy(cb->io_mem_pool);
+		cb->domain = NULL;
+	}
+
+	if (cb->shared_support) {
+		gen_pool_destroy(cb->shared_mem_pool);
+		cb->shared_mem_pool = NULL;
+	}
+
+	if (cb->scratch_buf_support) {
+		kfree(cb->scratch_map.bitmap);
+		cb->scratch_map.bitmap = NULL;
+	}
+}
+
+static void cam_smmu_release_cb(struct platform_device *pdev)
+{
+	int i = 0;
+
+	for (i = 0; i < iommu_cb_set.cb_num; i++)
+		cam_smmu_deinit_cb(&iommu_cb_set.cb_info[i]);
+
+	devm_kfree(&pdev->dev, iommu_cb_set.cb_info);
+	iommu_cb_set.cb_num = 0;
+}
+
+static struct gen_pool *
+cam_smmu_pool_create(size_t iova_start, size_t iova_len, int granularity)
+{
+	struct gen_pool *pool;
+	int rc;
+
+	pool = gen_pool_create(granularity, -1);
+	if (!pool)
+		return ERR_PTR(-ENOMEM);
+
+	rc = gen_pool_add(pool, iova_start, iova_len, -1);
+	if (rc) {
+		CAM_ERR(CAM_SMMU, "Genpool chunk creation failed");
+		gen_pool_destroy(pool);
+		return ERR_PTR(rc);
+	}
+
+	return pool;
+}
+
+static int cam_smmu_setup_cb(struct cam_context_bank_info *cb,
+	struct device *dev)
+{
+	int rc = 0;
+
+	if (!cb || !dev) {
+		CAM_ERR(CAM_SMMU, "Error: invalid input params");
+		return -EINVAL;
+	}
+
+	cb->dev = dev;
+	cb->is_fw_allocated = false;
+	cb->is_secheap_allocated = false;
+
+	atomic64_set(&cb->monitor_head, -1);
+
+	/* Create a pool with 64K granularity for supporting shared memory */
+	if (cb->shared_support) {
+		cb->shared_mem_pool =
+			cam_smmu_pool_create(cb->shared_info.iova_start,
+					     cb->shared_info.iova_len,
+					     SHARED_MEM_POOL_GRANULARITY);
+		if (IS_ERR(cb->shared_mem_pool)) {
+			CAM_ERR(CAM_SMMU, "Shared memory pool creation failed");
+			return PTR_ERR(cb->shared_mem_pool);
+		}
+
+		CAM_DBG(CAM_SMMU, "Shared mem start->%lX",
+			(unsigned long)cb->shared_info.iova_start);
+		CAM_DBG(CAM_SMMU, "Shared mem len->%zu",
+			cb->shared_info.iova_len);
+	}
+
+	if (cb->scratch_buf_support) {
+		rc = cam_smmu_init_scratch_map(&cb->scratch_map,
+			cb->scratch_info.iova_start,
+			cb->scratch_info.iova_len,
+			0);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU,
+				"Error: failed to create scratch map");
+			rc = -ENODEV;
+			goto end;
+		}
+	}
+
+	/* create a virtual mapping */
+	if (cb->io_support) {
+		cb->io_mem_pool =
+			cam_smmu_pool_create(cb->io_info.iova_start,
+					     cb->io_info.iova_len,
+					     IO_MEM_POOL_GRANULARITY);
+		if (IS_ERR(cb->io_mem_pool)) {
+			CAM_ERR(CAM_SMMU, "IO memory pool creation failed");
+			rc = PTR_ERR(cb->io_mem_pool);
+			goto end;
+		}
+
+		//TODO: handle discard region
+		/* Enable custom iommu features, if applicable */
+		cam_smmu_util_iommu_custom(dev, cb->discard_iova_start,
+				cb->discard_iova_len);
+
+		cb->state = CAM_SMMU_ATTACH;
+	} else {
+		CAM_ERR(CAM_SMMU, "Context bank does not have IO region");
+		rc = -ENODEV;
+		goto end;
+	}
+
+	return rc;
+end:
+	if (cb->shared_support) {
+		gen_pool_destroy(cb->shared_mem_pool);
+		cb->shared_mem_pool = NULL;
+	}
+
+	if (cb->scratch_buf_support) {
+		kfree(cb->scratch_map.bitmap);
+		cb->scratch_map.bitmap = NULL;
+	}
+
+	return rc;
+}
+
+static int cam_alloc_smmu_context_banks(struct device *dev)
+{
+	struct device_node *domains_child_node = NULL;
+
+	if (!dev) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid device");
+		return -ENODEV;
+	}
+
+	iommu_cb_set.cb_num = 0;
+
+	/* traverse thru all the child nodes and increment the cb count */
+	for_each_available_child_of_node(dev->of_node, domains_child_node) {
+		if (of_device_is_compatible(domains_child_node,
+			"qcom,msm-cam-smmu-cb"))
+			iommu_cb_set.cb_num++;
+
+		if (of_device_is_compatible(domains_child_node,
+			"qcom,qsmmu-cam-cb"))
+			iommu_cb_set.cb_num++;
+	}
+
+	if (iommu_cb_set.cb_num == 0) {
+		CAM_ERR(CAM_SMMU, "Error: no context banks present");
+		return -ENOENT;
+	}
+
+	/* allocate memory for the context banks */
+	iommu_cb_set.cb_info = devm_kzalloc(dev,
+		iommu_cb_set.cb_num * sizeof(struct cam_context_bank_info),
+		GFP_KERNEL);
+
+	if (!iommu_cb_set.cb_info) {
+		CAM_ERR(CAM_SMMU, "Error: cannot allocate context banks");
+		return -ENOMEM;
+	}
+
+	cam_smmu_reset_iommu_table(CAM_SMMU_TABLE_INIT);
+	iommu_cb_set.cb_init_count = 0;
+
+	CAM_DBG(CAM_SMMU, "no of context banks :%d", iommu_cb_set.cb_num);
+	return 0;
+}
+
+static int cam_smmu_get_discard_memory_regions(struct device_node *of_node,
+	dma_addr_t *discard_iova_start, size_t *discard_iova_len)
+{
+	uint32_t discard_iova[2] = { 0 };
+	int num_values = 0;
+	int rc = 0;
+
+	if (!discard_iova_start || !discard_iova_len)
+		return -EINVAL;
+
+	*discard_iova_start = 0;
+	*discard_iova_len = 0;
+
+	num_values = of_property_count_u32_elems(of_node,
+		"iova-region-discard");
+	if (num_values <= 0) {
+		CAM_DBG(CAM_UTIL, "No discard region specified");
+		return 0;
+	} else if (num_values != 2) {
+		CAM_ERR(CAM_UTIL, "Invalid discard region specified %d",
+			num_values);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32_array(of_node,
+		"iova-region-discard",
+		discard_iova, num_values);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Can not read discard region %d", num_values);
+		return rc;
+	} else if (!discard_iova[0] || !discard_iova[1]) {
+		CAM_ERR(CAM_UTIL,
+			"Incorrect Discard region specified [0x%x 0x%x]",
+			discard_iova[0], discard_iova[1]);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_UTIL, "Discard region [0x%x 0x%x]",
+		discard_iova[0], discard_iova[0] + discard_iova[1]);
+
+	*discard_iova_start = discard_iova[0];
+	*discard_iova_len = discard_iova[1];
+
+	return 0;
+}
+
+static int cam_smmu_get_memory_regions_info(struct device_node *of_node,
+	struct cam_context_bank_info *cb)
+{
+	int rc = 0;
+	struct device_node *mem_map_node = NULL;
+	struct device_node *child_node = NULL;
+	const char *region_name;
+	int num_regions = 0;
+
+	if (!of_node || !cb) {
+		CAM_ERR(CAM_SMMU, "Invalid argument(s)");
+		return -EINVAL;
+	}
+
+	mem_map_node = of_get_child_by_name(of_node, "iova-mem-map");
+	cb->is_secure = of_property_read_bool(of_node, "qcom,secure-cb");
+
+	/*
+	 * We always expect a memory map node, except when it is a secure
+	 * context bank.
+	 */
+	if (!mem_map_node) {
+		if (cb->is_secure)
+			return 0;
+		CAM_ERR(CAM_SMMU, "iova-mem-map not present");
+		return -EINVAL;
+	}
+
+	for_each_available_child_of_node(mem_map_node, child_node) {
+		uint32_t region_start;
+		uint32_t region_len;
+		uint32_t region_id;
+		uint32_t qdss_region_phy_addr = 0;
+
+		num_regions++;
+		rc = of_property_read_string(child_node,
+			"iova-region-name", &region_name);
+		if (rc < 0) {
+			of_node_put(mem_map_node);
+			CAM_ERR(CAM_SMMU, "IOVA region not found");
+			return -EINVAL;
+		}
+
+		rc = of_property_read_u32(child_node,
+			"iova-region-start", &region_start);
+		if (rc < 0) {
+			of_node_put(mem_map_node);
+			CAM_ERR(CAM_SMMU, "Failed to read iova-region-start");
+			return -EINVAL;
+		}
+
+		rc = of_property_read_u32(child_node,
+			"iova-region-len", &region_len);
+		if (rc < 0) {
+			of_node_put(mem_map_node);
+			CAM_ERR(CAM_SMMU, "Failed to read iova-region-len");
+			return -EINVAL;
+		}
+
+		rc = of_property_read_u32(child_node,
+			"iova-region-id", &region_id);
+		if (rc < 0) {
+			of_node_put(mem_map_node);
+			CAM_ERR(CAM_SMMU, "Failed to read iova-region-id");
+			return -EINVAL;
+		}
+
+		if (strcmp(region_name, qdss_region_name) == 0) {
+			rc = of_property_read_u32(child_node,
+				"qdss-phy-addr", &qdss_region_phy_addr);
+			if (rc < 0) {
+				of_node_put(mem_map_node);
+				CAM_ERR(CAM_SMMU,
+					"Failed to read qdss phy addr");
+				return -EINVAL;
+			}
+		}
+
+		switch (region_id) {
+		case CAM_SMMU_REGION_FIRMWARE:
+			cb->firmware_support = 1;
+			cb->firmware_info.iova_start = region_start;
+			cb->firmware_info.iova_len = region_len;
+			break;
+		case CAM_SMMU_REGION_SHARED:
+			cb->shared_support = 1;
+			cb->shared_info.iova_start = region_start;
+			cb->shared_info.iova_len = region_len;
+			break;
+		case CAM_SMMU_REGION_SCRATCH:
+			cb->scratch_buf_support = 1;
+			cb->scratch_info.iova_start = region_start;
+			cb->scratch_info.iova_len = region_len;
+			break;
+		case CAM_SMMU_REGION_IO:
+			cb->io_support = 1;
+			cb->io_info.iova_start = region_start;
+			cb->io_info.iova_len = region_len;
+			rc = cam_smmu_get_discard_memory_regions(child_node,
+				&cb->io_info.discard_iova_start,
+				&cb->io_info.discard_iova_len);
+			if (rc) {
+				CAM_ERR(CAM_SMMU,
+					"Invalid Discard region specified in IO region, rc=%d",
+					rc);
+				of_node_put(mem_map_node);
+				return -EINVAL;
+			}
+			break;
+		case CAM_SMMU_REGION_SECHEAP:
+			cb->secheap_support = 1;
+			cb->secheap_info.iova_start = region_start;
+			cb->secheap_info.iova_len = region_len;
+			break;
+		case CAM_SMMU_REGION_QDSS:
+			cb->qdss_support = 1;
+			cb->qdss_info.iova_start = region_start;
+			cb->qdss_info.iova_len = region_len;
+			cb->qdss_phy_addr = qdss_region_phy_addr;
+			break;
+		default:
+			CAM_ERR(CAM_SMMU,
+				"Incorrect region id present in DT file: %d",
+				region_id);
+		}
+
+		CAM_DBG(CAM_SMMU, "Found label -> %s", cb->name[0]);
+		CAM_DBG(CAM_SMMU, "Found region -> %s", region_name);
+		CAM_DBG(CAM_SMMU, "region_start -> %X", region_start);
+		CAM_DBG(CAM_SMMU, "region_len -> %X", region_len);
+		CAM_DBG(CAM_SMMU, "region_id -> %X", region_id);
+	}
+
+	if (cb->io_support) {
+		rc = cam_smmu_get_discard_memory_regions(of_node,
+			&cb->discard_iova_start,
+			&cb->discard_iova_len);
+		if (rc) {
+			CAM_ERR(CAM_SMMU,
+				"Invalid Discard region specified in CB, rc=%d",
+				rc);
+			of_node_put(mem_map_node);
+			return -EINVAL;
+		}
+
+		/* Make sure Discard region is properly specified */
+		if ((cb->discard_iova_start !=
+			cb->io_info.discard_iova_start) ||
+			(cb->discard_iova_len !=
+			cb->io_info.discard_iova_len)) {
+			CAM_ERR(CAM_SMMU,
+				"Mismatch Discard region specified, [0x%llx 0x%zx] [0x%llx 0x%zx]",
+				cb->discard_iova_start,
+				cb->discard_iova_len,
+				cb->io_info.discard_iova_start,
+				cb->io_info.discard_iova_len);
+			of_node_put(mem_map_node);
+			return -EINVAL;
+		} else if (cb->discard_iova_start && cb->discard_iova_len) {
+			if ((cb->discard_iova_start <=
+			cb->io_info.iova_start) ||
+			(cb->discard_iova_start >=
+			cb->io_info.iova_start + cb->io_info.iova_len) ||
+			(cb->discard_iova_start + cb->discard_iova_len >=
+			cb->io_info.iova_start + cb->io_info.iova_len)) {
+				CAM_ERR(CAM_SMMU,
+				"[%s] : Incorrect Discard region specified [0x%llx 0x%llx] in [0x%llx 0x%llx]",
+				cb->name[0],
+				cb->discard_iova_start,
+				cb->discard_iova_start + cb->discard_iova_len,
+				cb->io_info.iova_start,
+				cb->io_info.iova_start + cb->io_info.iova_len);
+				of_node_put(mem_map_node);
+				return -EINVAL;
+			}
+
+			CAM_INFO(CAM_SMMU,
+				"[%s] : Discard region specified [0x%llx 0x%llx] in [0x%llx 0x%llx]",
+				cb->name[0],
+				cb->discard_iova_start,
+				cb->discard_iova_start + cb->discard_iova_len,
+				cb->io_info.iova_start,
+				cb->io_info.iova_start + cb->io_info.iova_len);
+		}
+	}
+
+	of_node_put(mem_map_node);
+
+	if (!num_regions) {
+		CAM_ERR(CAM_SMMU,
+			"No memory regions found, at least one needed");
+		rc = -ENODEV;
+	}
+
+	return rc;
+}
+
+static int cam_populate_smmu_context_banks(struct device *dev,
+	enum cam_iommu_type type)
+{
+	int rc = 0;
+	struct cam_context_bank_info *cb;
+	struct device *ctx = NULL;
+	int i = 0;
+	bool dma_coherent, dma_coherent_hint;
+
+	if (!dev) {
+		CAM_ERR(CAM_SMMU, "Error: Invalid device");
+		return -ENODEV;
+	}
+
+	/* check the bounds */
+	if (iommu_cb_set.cb_init_count >= iommu_cb_set.cb_num) {
+		CAM_ERR(CAM_SMMU, "Error: populate more than allocated cb");
+		rc = -EBADHANDLE;
+		goto cb_init_fail;
+	}
+
+	/* read the context bank from cb set */
+	cb = &iommu_cb_set.cb_info[iommu_cb_set.cb_init_count];
+
+	cb->is_mul_client =
+		of_property_read_bool(dev->of_node, "multiple-client-devices");
+
+	cb->num_shared_hdl = of_property_count_strings(dev->of_node,
+		"cam-smmu-label");
+
+	if (cb->num_shared_hdl >
+		CAM_SMMU_SHARED_HDL_MAX) {
+		CAM_ERR(CAM_CDM, "Invalid count of client names count=%d",
+			cb->num_shared_hdl);
+		rc = -EINVAL;
+		return rc;
+	}
+
+	/* set the name of the context bank */
+	for (i = 0; i < cb->num_shared_hdl; i++)
+		rc = of_property_read_string_index(dev->of_node,
+		"cam-smmu-label", i, &cb->name[i]);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU,
+			"Error: failed to read label from sub device");
+		goto cb_init_fail;
+	}
+
+	rc = cam_smmu_get_memory_regions_info(dev->of_node,
+		cb);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: Getting region info");
+		return rc;
+	}
+
+	if (cb->is_secure) {
+		/* increment count to next bank */
+		cb->dev = dev;
+		iommu_cb_set.cb_init_count++;
+		return 0;
+	}
+
+	/* set up the iommu mapping for the  context bank */
+	if (type == CAM_QSMMU) {
+		CAM_ERR(CAM_SMMU, "Error: QSMMU ctx not supported for : %s",
+			cb->name[0]);
+		return -ENODEV;
+	}
+
+	ctx = dev;
+	CAM_DBG(CAM_SMMU, "getting Arm SMMU ctx : %s", cb->name[0]);
+
+	cb->coherency_mode = CAM_SMMU_NO_COHERENCY;
+
+	dma_coherent = of_property_read_bool(dev->of_node, "dma-coherent");
+	dma_coherent_hint = of_property_read_bool(dev->of_node,
+		"dma-coherent-hint-cached");
+
+	if (dma_coherent && dma_coherent_hint) {
+		CAM_ERR(CAM_SMMU,
+			"[%s] : Cannot enable both dma-coherent and dma-coherent-hint-cached",
+			cb->name[0]);
+		return -EBADR;
+	}
+
+	if (dma_coherent)
+		cb->coherency_mode = CAM_SMMU_DMA_COHERENT;
+	else if (dma_coherent_hint)
+		cb->coherency_mode = CAM_SMMU_DMA_COHERENT_HINT_CACHED;
+
+	CAM_DBG(CAM_SMMU, "[%s] : io cohereny mode %d", cb->name[0],
+		cb->coherency_mode);
+
+	rc = cam_smmu_setup_cb(cb, ctx);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: failed to setup cb : %s",
+			cb->name[0]);
+		goto cb_init_fail;
+	}
+
+	cb->domain = iommu_get_domain_for_dev(dev);
+	if (IS_ERR_OR_NULL(cb->domain)) {
+		CAM_ERR(CAM_SMMU, "Invalid domain for device");
+		rc= PTR_ERR(cb->domain);
+		goto cb_init_fail;
+	}
+	if (cb->io_support && cb->domain)
+		iommu_set_fault_handler(cb->domain,
+			cam_smmu_iommu_fault_handler,
+			(void *)cb->name[0]);
+
+	if (!dev->dma_parms)
+		dev->dma_parms = devm_kzalloc(dev,
+			sizeof(*dev->dma_parms), GFP_KERNEL);
+
+	if (!dev->dma_parms) {
+		CAM_WARN(CAM_SMMU,
+			"Failed to allocate dma_params");
+		dev->dma_parms = NULL;
+		goto end;
+	}
+
+	dma_set_max_seg_size(dev, DMA_BIT_MASK(32));
+	dma_set_seg_boundary(dev, (unsigned long)DMA_BIT_MASK(64));
+
+end:
+	/* increment count to next bank */
+	iommu_cb_set.cb_init_count++;
+	CAM_DBG(CAM_SMMU, "X: cb init count :%d", iommu_cb_set.cb_init_count);
+
+cb_init_fail:
+	return rc;
+}
+
+static int cam_smmu_create_debug_fs(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_smmu", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_SMMU,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	iommu_cb_set.dentry = dbgfileptr;
+
+	debugfs_create_bool("cb_dump_enable", 0644,
+		iommu_cb_set.dentry, &iommu_cb_set.cb_dump_enable);
+	debugfs_create_bool("map_profile_enable", 0644,
+		iommu_cb_set.dentry, &iommu_cb_set.map_profile_enable);
+
+end:
+	return rc;
+}
+
+static int cam_smmu_fw_dev_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	icp_fw.fw_dev = &pdev->dev;
+	icp_fw.fw_kva = NULL;
+	icp_fw.fw_hdl = 0;
+
+	CAM_DBG(CAM_SMMU, "FW dev component bound successfully");
+	return 0;
+}
+
+static void cam_smmu_fw_dev_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_SMMU, "Unbinding component: %s", pdev->name);
+}
+
+const static struct component_ops cam_smmu_fw_dev_component_ops = {
+	.bind = cam_smmu_fw_dev_component_bind,
+	.unbind = cam_smmu_fw_dev_component_unbind,
+};
+
+static int cam_smmu_cb_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	rc = cam_populate_smmu_context_banks(dev, CAM_ARM_SMMU);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Error: populating context banks");
+		cam_smmu_release_cb(pdev);
+		return -ENOMEM;
+	}
+
+	CAM_DBG(CAM_SMMU, "CB component bound successfully");
+	return 0;
+}
+
+static void cam_smmu_cb_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_SMMU, "Unbinding component: %s", pdev->name);
+}
+
+const static struct component_ops cam_smmu_cb_component_ops = {
+	.bind = cam_smmu_cb_component_bind,
+	.unbind = cam_smmu_cb_component_unbind,
+};
+
+static int cam_smmu_cb_qsmmu_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc = 0;
+
+	rc = cam_populate_smmu_context_banks(dev, CAM_QSMMU);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Failed in populating context banks");
+		return -ENOMEM;
+	}
+
+	CAM_DBG(CAM_SMMU, "QSMMU CB component bound successfully");
+	return 0;
+}
+
+static void cam_smmu_cb_qsmmu_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	CAM_DBG(CAM_SMMU, "Unbinding component: %s", pdev->name);
+}
+
+const static struct component_ops cam_smmu_cb_qsmmu_component_ops = {
+	.bind = cam_smmu_cb_qsmmu_component_bind,
+	.unbind = cam_smmu_cb_qsmmu_component_unbind,
+};
+
+static int cam_smmu_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	INIT_WORK(&iommu_cb_set.smmu_work, cam_smmu_page_fault_work);
+	mutex_init(&iommu_cb_set.payload_list_lock);
+	INIT_LIST_HEAD(&iommu_cb_set.payload_list);
+	cam_smmu_create_debug_fs();
+
+	iommu_cb_set.force_cache_allocs =
+		of_property_read_bool(dev->of_node, "force_cache_allocs");
+
+	CAM_DBG(CAM_SMMU, "Main component bound successfully");
+	return 0;
+}
+
+static void cam_smmu_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	/* release all the context banks and memory allocated */
+	cam_smmu_reset_iommu_table(CAM_SMMU_TABLE_DEINIT);
+	if (dev && dev->dma_parms) {
+		devm_kfree(dev, dev->dma_parms);
+		dev->dma_parms = NULL;
+	}
+
+	cam_smmu_release_cb(pdev);
+	debugfs_remove_recursive(iommu_cb_set.dentry);
+	iommu_cb_set.dentry = NULL;
+}
+
+const static struct component_ops cam_smmu_component_ops = {
+	.bind = cam_smmu_component_bind,
+	.unbind = cam_smmu_component_unbind,
+};
+
+static int cam_smmu_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+	struct device *dev = &pdev->dev;
+	g_camsmmu_pdev = pdev;
+
+	dev->dma_parms = NULL;
+	CAM_DBG(CAM_SMMU, "Adding SMMU component: %s", pdev->name);
+	if (of_device_is_compatible(dev->of_node, "qcom,msm-cam-smmu")) {
+		rc = cam_alloc_smmu_context_banks(dev);
+		if (rc < 0) {
+			CAM_ERR(CAM_SMMU, "Failed in allocating context banks");
+			return -ENOMEM;
+		}
+
+		rc = component_add(&pdev->dev, &cam_smmu_component_ops);
+	} else if (of_device_is_compatible(dev->of_node,
+		"qcom,msm-cam-smmu-cb")) {
+		rc = component_add(&pdev->dev, &cam_smmu_cb_component_ops);
+	} else if (of_device_is_compatible(dev->of_node, "qcom,qsmmu-cam-cb")) {
+		rc = component_add(&pdev->dev,
+			&cam_smmu_cb_qsmmu_component_ops);
+	} else if (of_device_is_compatible(dev->of_node,
+		"qcom,msm-cam-smmu-fw-dev")) {
+		rc = component_add(&pdev->dev, &cam_smmu_fw_dev_component_ops);
+	} else {
+		CAM_ERR(CAM_SMMU, "Unrecognized child device: %s", pdev->name);
+		rc = -ENODEV;
+	}
+
+	if (rc < 0)
+		CAM_ERR(CAM_SMMU, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_smmu_remove(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+
+	CAM_DBG(CAM_SMMU, "Removing SMMU component: %s", pdev->name);
+	if (of_device_is_compatible(dev->of_node, "qcom,msm-cam-smmu")) {
+		component_del(&pdev->dev, &cam_smmu_component_ops);
+	} else if (of_device_is_compatible(dev->of_node,
+		"qcom,msm-cam-smmu-cb")) {
+		component_del(&pdev->dev, &cam_smmu_cb_component_ops);
+	} else if (of_device_is_compatible(dev->of_node, "qcom,qsmmu-cam-cb")) {
+		component_del(&pdev->dev, &cam_smmu_cb_qsmmu_component_ops);
+	} else if (of_device_is_compatible(dev->of_node,
+		"qcom,msm-cam-smmu-fw-dev")) {
+		component_del(&pdev->dev, &cam_smmu_fw_dev_component_ops);
+	} else {
+		CAM_ERR(CAM_SMMU, "Unrecognized child device: %s", pdev->name);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+struct platform_driver cam_smmu_driver = {
+	.probe = cam_smmu_probe,
+	.remove = cam_smmu_remove,
+	.driver = {
+		.name = "msm_cam_smmu",
+		.owner = THIS_MODULE,
+		.of_match_table = msm_cam_smmu_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_smmu_init_module(void)
+{
+	return platform_driver_register(&cam_smmu_driver);
+}
+
+void cam_smmu_exit_module(void)
+{
+	platform_driver_unregister(&cam_smmu_driver);
+}
+
+MODULE_DESCRIPTION("MSM Camera SMMU driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_smmu/cam_smmu_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_smmu/cam_smmu_api.h
@@ -0,0 +1,442 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2014-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SMMU_API_H_
+#define _CAM_SMMU_API_H_
+
+#include <linux/dma-direction.h>
+#include <linux/module.h>
+#include <linux/dma-buf.h>
+#include <linux/dma-direction.h>
+#include <linux/of_platform.h>
+#include <linux/iommu.h>
+#include <linux/random.h>
+#include <linux/spinlock_types.h>
+#include <linux/mutex.h>
+
+/*Enum for possible CAM SMMU operations */
+enum cam_smmu_ops_param {
+	CAM_SMMU_ATTACH,
+	CAM_SMMU_DETACH,
+	CAM_SMMU_VOTE,
+	CAM_SMMU_DEVOTE,
+	CAM_SMMU_OPS_INVALID
+};
+
+enum cam_smmu_map_dir {
+	CAM_SMMU_MAP_READ,
+	CAM_SMMU_MAP_WRITE,
+	CAM_SMMU_MAP_RW,
+	CAM_SMMU_MAP_INVALID
+};
+
+enum cam_smmu_region_id {
+	CAM_SMMU_REGION_FIRMWARE,
+	CAM_SMMU_REGION_SHARED,
+	CAM_SMMU_REGION_SCRATCH,
+	CAM_SMMU_REGION_IO,
+	CAM_SMMU_REGION_SECHEAP,
+	CAM_SMMU_REGION_QDSS
+};
+
+/**
+ * @brief          : cam_smmu_pf_info
+ *
+ * @param domain   : Iommu domain received in iommu page fault handler
+ * @param dev      : Device received in iommu page fault handler
+ * @param iova     : IOVA where page fault occurred
+ * @param flags    : Flags received in iommu page fault handler
+ * @param token    : Userdata given during callback registration
+ * @param buf_info : Closest mapped buffer info
+ * @bid            : bus id
+ * @pid            : unique id for hw group of ports
+ * @mid            : port id of hw
+ */
+
+struct cam_smmu_pf_info {
+	struct iommu_domain *domain;
+	struct device        *dev;
+	unsigned long        iova;
+	int                  flags;
+	void                *token;
+	uint32_t             buf_info;
+	uint32_t             bid;
+	uint32_t             pid;
+	uint32_t             mid;
+};
+
+/**
+ * @brief            : Structure to store region information
+ *
+ * @param iova_start         : Start address of region
+ * @param iova_len           : length of region
+ * @param discard_iova_start : iova addr start from where should not be used
+ * @param discard_iova_len   : length of discard iova region
+ */
+struct cam_smmu_region_info {
+	dma_addr_t iova_start;
+	size_t iova_len;
+	dma_addr_t discard_iova_start;
+	size_t discard_iova_len;
+};
+
+extern struct platform_device *g_camsmmu_pdev;
+
+/**
+ * @brief           : Gets an smmu handle
+ *
+ * @param identifier: Unique identifier to be used by clients which they
+ *                    should get from device tree. CAM SMMU driver will
+ *                    not enforce how this string is obtained and will
+ *                    only validate this against the list of permitted
+ *                    identifiers
+ * @param handle_ptr: Based on the indentifier, CAM SMMU drivier will
+ *                    fill the handle pointed by handle_ptr
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_handle(char *identifier, int *handle_ptr);
+
+/**
+ * @brief       : Performs IOMMU operations
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param op    : Operation to be performed. Can be either CAM_SMMU_ATTACH
+ *                or CAM_SMMU_DETACH
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_ops(int handle, enum cam_smmu_ops_param op);
+
+/**
+ * @brief       : Maps user space IOVA for calling driver
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param ion_fd: ION handle identifying the memory buffer.
+ * @param dis_delayed_unmap: Whether to disable Delayed Unmap feature
+ *                           for this mapping
+ * @dir         : Mapping direction: which will traslate toDMA_BIDIRECTIONAL,
+ *                DMA_TO_DEVICE or DMA_FROM_DEVICE
+ * @dma_addr    : Pointer to physical address where mapped address will be
+ *                returned if region_id is CAM_SMMU_REGION_IO. If region_id is
+ *                CAM_SMMU_REGION_SHARED, dma_addr is used as an input parameter
+ *                which specifies the cpu virtual address to map.
+ * @len_ptr     : Length of buffer mapped returned by CAM SMMU driver.
+ * @region_id   : Memory region identifier
+ * @is_internal: Specifies if this buffer is kernel allocated.
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_map_user_iova(int handle, int ion_fd, bool dis_delayed_unmap,
+	enum cam_smmu_map_dir dir, dma_addr_t *dma_addr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id, bool is_internal, struct dma_buf *dmabuf);
+
+/**
+ * @brief        : Maps kernel space IOVA for calling driver
+ *
+ * @param handle : Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param buf    : dma_buf allocated for kernel usage in mem_mgr
+ * @dir          : Mapping direction: which will traslate toDMA_BIDIRECTIONAL,
+ *                 DMA_TO_DEVICE or DMA_FROM_DEVICE
+ * @dma_addr     : Pointer to physical address where mapped address will be
+ *                 returned if region_id is CAM_SMMU_REGION_IO. If region_id is
+ *                 CAM_SMMU_REGION_SHARED, dma_addr is used as an input
+ *                 parameter which specifies the cpu virtual address to map.
+ * @len_ptr      : Length of buffer mapped returned by CAM SMMU driver.
+ * @region_id    : Memory region identifier
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_map_kernel_iova(int handle,
+	struct dma_buf *buf, enum cam_smmu_map_dir dir,
+	dma_addr_t *dma_addr, size_t *len_ptr,
+	enum cam_smmu_region_id region_id);
+
+/**
+ * @brief       : Unmaps user space IOVA for calling driver
+ *
+ * @param handle: Handle to identify the CAMSMMU client (VFE, CPP, FD etc.)
+ * @param ion_fd: ION handle identifying the memory buffer.
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_unmap_user_iova(int handle,
+	int ion_fd, enum cam_smmu_region_id region_id);
+
+/**
+ * @brief       : Unmaps kernel IOVA for calling driver
+ *
+ * @param handle: Handle to identify the CAMSMMU client (VFE, CPP, FD etc.)
+ * @param buf   : dma_buf allocated for the kernel
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_unmap_kernel_iova(int handle,
+	struct dma_buf *buf, enum cam_smmu_region_id region_id);
+
+/**
+ * @brief          : Allocates a scratch buffer
+ *
+ * This function allocates a scratch virtual buffer of length virt_len in the
+ * device virtual address space mapped to phys_len physically contiguous bytes
+ * in that device's SMMU.
+ *
+ * virt_len and phys_len are expected to be aligned to PAGE_SIZE and with each
+ * other, otherwise -EINVAL is returned.
+ *
+ * -EINVAL will be returned if virt_len is less than phys_len.
+ *
+ * Passing a too large phys_len might also cause failure if that much size is
+ * not available for allocation in a physically contiguous way.
+ *
+ * @param handle   : Handle to identify the CAMSMMU client (VFE, CPP, FD etc.)
+ * @param dir      : Direction of mapping which will translate to IOMMU_READ
+ *                   IOMMU_WRITE or a bit mask of both.
+ * @param paddr_ptr: Device virtual address that the client device will be
+ *                   able to read from/write to
+ * @param virt_len : Virtual length of the scratch buffer
+ * @param phys_len : Physical length of the scratch buffer
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+
+int cam_smmu_get_scratch_iova(int handle,
+	enum cam_smmu_map_dir dir,
+	dma_addr_t *paddr_ptr,
+	size_t virt_len,
+	size_t phys_len);
+
+/**
+ * @brief          : Frees a scratch buffer
+ *
+ * This function frees a scratch buffer and releases the corresponding SMMU
+ * mappings.
+ *
+ * @param handle   : Handle to identify the CAMSMMU client (IFE, ICP, etc.)
+ * @param paddr    : Device virtual address of client's scratch buffer that
+ *                   will be freed.
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+
+int cam_smmu_put_scratch_iova(int handle,
+	dma_addr_t paddr);
+
+/**
+ *@brief        : Destroys an smmu handle
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_destroy_handle(int handle);
+
+/**
+ * @brief       : Finds index by handle in the smmu client table
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @return Index of SMMU client. Nagative in case of error.
+ */
+int cam_smmu_find_index_by_handle(int hdl);
+
+/**
+ * @brief       : Registers smmu fault handler for client
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param handler_cb: It is triggered in IOMMU page fault
+ * @param token: It is input param when trigger page fault handler
+ */
+void cam_smmu_set_client_page_fault_handler(int handle,
+	void (*handler_cb)(struct cam_smmu_pf_info  *pf_info), void *token);
+
+/**
+ * @brief       : Unregisters smmu fault handler for client
+ *
+ * @param handle: Handle to identify the CAM SMMU client (VFE, CPP, FD etc.)
+ * @param token: It is input param when trigger page fault handler
+ */
+void cam_smmu_unset_client_page_fault_handler(int handle, void *token);
+
+/**
+ * @brief Maps memory from an ION fd into IOVA space
+ *
+ * @param handle: SMMU handle identifying the context bank to map to
+ * @param ion_fd: ION fd of memory to map to
+ * @param paddr_ptr: Pointer IOVA address that will be returned
+ * @param len_ptr: Length of memory mapped
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_iova(int handle, int ion_fd,
+	dma_addr_t *paddr_ptr, size_t *len_ptr);
+
+/**
+ * @brief Maps memory from an ION fd into IOVA space
+ *
+ * @param handle: SMMU handle identifying the secure context bank to map to
+ * @param ion_fd: ION fd of memory to map to
+ * @param paddr_ptr: Pointer IOVA address that will be returned
+ * @param len_ptr: Length of memory mapped
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_stage2_iova(int handle, int ion_fd,
+	dma_addr_t *paddr_ptr, size_t *len_ptr);
+
+/**
+ * @brief Unmaps memory from context bank
+ *
+ * @param handle: SMMU handle identifying the context bank
+ * @param ion_fd: ION fd of memory to unmap
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_put_iova(int handle, int ion_fd);
+
+/**
+ * @brief Maps secure memory for SMMU handle
+ *
+ * @param handle: SMMU handle identifying secure context bank
+ * @param ion_fd: ION fd to map securely
+ * @param dir: DMA Direction for the mapping
+ * @param dma_addr: Returned IOVA address after mapping
+ * @param len_ptr: Length of memory mapped
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_map_stage2_iova(int handle,
+	int ion_fd, enum cam_smmu_map_dir dir, dma_addr_t *dma_addr,
+	size_t *len_ptr, struct dma_buf *dmabuf);
+
+/**
+ * @brief Unmaps secure memopry for SMMU handle
+ *
+ * @param handle: SMMU handle identifying secure context bank
+ * @param ion_fd: ION fd to unmap
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_unmap_stage2_iova(int handle, int ion_fd);
+
+/**
+ * @brief Allocates firmware for context bank
+ *
+ * @param smmu_hdl: SMMU handle identifying context bank
+ * @param iova: IOVA address of allocated firmware
+ * @param kvaddr: CPU mapped address of allocated firmware
+ * @param len: Length of allocated firmware memory
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_alloc_firmware(int32_t smmu_hdl,
+	dma_addr_t *iova,
+	uintptr_t *kvaddr,
+	size_t *len);
+
+/**
+ * @brief Deallocates firmware memory for context bank
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_dealloc_firmware(int32_t smmu_hdl);
+
+/**
+ * @brief Gets region information specified by smmu handle and region id
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ * @param region_id: Region id for which information is desired
+ * @param region_info: Struct populated with region information
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_region_info(int32_t smmu_hdl,
+	enum cam_smmu_region_id region_id,
+	struct cam_smmu_region_info *region_info);
+
+/**
+ * @brief Reserves secondary heap
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ * @param iova: IOVA of secondary heap after reservation has completed
+ * @param buf: Allocated dma_buf for secondary heap
+ * @param request_len: Length of secondary heap after reservation has completed
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_reserve_sec_heap(int32_t smmu_hdl,
+	struct dma_buf *buf,
+	dma_addr_t *iova,
+	size_t *request_len);
+
+/**
+ * @brief Releases secondary heap
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_release_sec_heap(int32_t smmu_hdl);
+
+/**
+ * @brief Allocates qdss for context bank
+ *
+ * @param smmu_hdl: SMMU handle identifying context bank
+ * @param iova: IOVA address of allocated qdss
+ * @param len: Length of allocated qdss memory
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_alloc_qdss(int32_t smmu_hdl,
+	dma_addr_t *iova,
+	size_t *len);
+
+/**
+ * @brief Deallocates qdss memory for context bank
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_dealloc_qdss(int32_t smmu_hdl);
+
+/**
+ * @brief Get start addr & len of I/O region for a given cb
+ *
+ * @param smmu_hdl: SMMU handle identifying the context bank
+ * @param iova: IOVA address of allocated I/O region
+ * @param len: Length of allocated I/O memory
+ * @param discard_iova_start: Start address of io space to discard
+ * @param discard_iova_len: Length of io space to discard
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_smmu_get_io_region_info(int32_t smmu_hdl,
+	dma_addr_t *iova, size_t *len,
+	dma_addr_t *discard_iova_start, size_t *discard_iova_len);
+
+/**
+ * @brief : API to reset the call context bank page fault count
+ *          This should be done on the starting of new camera open
+ * @return void.
+ */
+void cam_smmu_reset_cb_page_fault_cnt(void);
+
+/**
+ * @brief : API to register SMMU hw to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_smmu_init_module(void);
+
+/**
+ * @brief : API to remove SMMU Hw from platform framework.
+ */
+void cam_smmu_exit_module(void);
+
+/**
+ * @brief : API to determine whether to force all allocations to CACHED
+ */
+int cam_smmu_need_force_alloc_cached(bool *force_alloc_cached);
+
+
+#endif /* _CAM_SMMU_API_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync.c
@@ -0,0 +1,1318 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/irqflags.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/debugfs.h>
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+#include <synx_api.h>
+#endif
+
+#include "cam_sync_util.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+#include "cam_compat.h"
+#include "camera_main.h"
+#include "cam_req_mgr_workq.h"
+
+struct sync_device *sync_dev;
+
+/*
+ * Flag to determine whether to enqueue cb of a
+ * signaled fence onto the workq or invoke it
+ * directly in the same context
+ */
+static bool trigger_cb_without_switch;
+
+static void cam_sync_print_fence_table(void)
+{
+	int idx;
+
+	for (idx = 0; idx < CAM_SYNC_MAX_OBJS; idx++) {
+		spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+		CAM_INFO(CAM_SYNC,
+			"index[%u]: sync_id=%d, name=%s, type=%d, state=%d, ref_cnt=%d",
+			idx,
+			sync_dev->sync_table[idx].sync_id,
+			sync_dev->sync_table[idx].name,
+			sync_dev->sync_table[idx].type,
+			sync_dev->sync_table[idx].state,
+			atomic_read(&sync_dev->sync_table[idx].ref_cnt));
+		spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+	}
+}
+
+int cam_sync_create(int32_t *sync_obj, const char *name)
+{
+	int rc;
+	long idx;
+	bool bit;
+
+	do {
+		idx = find_first_zero_bit(sync_dev->bitmap, CAM_SYNC_MAX_OBJS);
+		if (idx >= CAM_SYNC_MAX_OBJS) {
+			CAM_ERR(CAM_SYNC,
+				"Error: Unable to create sync idx = %ld reached max!",
+				idx);
+			cam_sync_print_fence_table();
+			return -ENOMEM;
+		}
+		CAM_DBG(CAM_SYNC, "Index location available at idx: %ld", idx);
+		bit = test_and_set_bit(idx, sync_dev->bitmap);
+	} while (bit);
+
+	spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+	rc = cam_sync_init_row(sync_dev->sync_table, idx, name,
+		CAM_SYNC_TYPE_INDV);
+	if (rc) {
+		CAM_ERR(CAM_SYNC, "Error: Unable to init row at idx = %ld",
+			idx);
+		clear_bit(idx, sync_dev->bitmap);
+		spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+		return -EINVAL;
+	}
+
+	*sync_obj = idx;
+	CAM_DBG(CAM_SYNC, "sync_obj: %i", *sync_obj);
+	spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+
+	return rc;
+}
+
+int cam_sync_register_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj)
+{
+	struct sync_callback_info *sync_cb;
+	struct sync_table_row *row = NULL;
+	int status = 0;
+
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0 || !cb_func)
+		return -EINVAL;
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj %d",
+			sync_obj);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		return -EINVAL;
+	}
+
+	sync_cb = kzalloc(sizeof(*sync_cb), GFP_ATOMIC);
+	if (!sync_cb) {
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		return -ENOMEM;
+	}
+
+	/* Trigger callback if sync object is already in SIGNALED state */
+	if (((row->state == CAM_SYNC_STATE_SIGNALED_SUCCESS) ||
+		(row->state == CAM_SYNC_STATE_SIGNALED_ERROR) ||
+		(row->state == CAM_SYNC_STATE_SIGNALED_CANCEL)) &&
+		(!row->remaining)) {
+		if (trigger_cb_without_switch) {
+			CAM_DBG(CAM_SYNC, "Invoke callback for sync object:%d",
+				sync_obj);
+			status = row->state;
+			kfree(sync_cb);
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+			cb_func(sync_obj, status, userdata);
+		} else {
+			sync_cb->callback_func = cb_func;
+			sync_cb->cb_data = userdata;
+			sync_cb->sync_obj = sync_obj;
+			INIT_WORK(&sync_cb->cb_dispatch_work,
+				cam_sync_util_cb_dispatch);
+			sync_cb->status = row->state;
+			CAM_DBG(CAM_SYNC, "Enqueue callback for sync object:%d",
+				sync_cb->sync_obj);
+			sync_cb->workq_scheduled_ts = ktime_get();
+			queue_work(sync_dev->work_queue,
+				&sync_cb->cb_dispatch_work);
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		}
+
+		return 0;
+	}
+
+	sync_cb->callback_func = cb_func;
+	sync_cb->cb_data = userdata;
+	sync_cb->sync_obj = sync_obj;
+	INIT_WORK(&sync_cb->cb_dispatch_work, cam_sync_util_cb_dispatch);
+	list_add_tail(&sync_cb->list, &row->callback_list);
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+
+	return 0;
+}
+
+int cam_sync_deregister_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+	struct sync_callback_info *sync_cb, *temp;
+	bool found = false;
+
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)
+		return -EINVAL;
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row = sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %d",
+			sync_obj);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_SYNC, "deregistered callback for sync object:%d",
+		sync_obj);
+	list_for_each_entry_safe(sync_cb, temp, &row->callback_list, list) {
+		if (sync_cb->callback_func == cb_func &&
+			sync_cb->cb_data == userdata) {
+			list_del_init(&sync_cb->list);
+			kfree(sync_cb);
+			found = true;
+		}
+	}
+
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return found ? 0 : -ENOENT;
+}
+
+int cam_sync_signal(int32_t sync_obj, uint32_t status, uint32_t event_cause)
+{
+	struct sync_table_row *row = NULL;
+	struct sync_table_row *parent_row = NULL;
+	struct sync_parent_info *parent_info, *temp_parent_info;
+	struct list_head parents_list;
+	int rc = 0;
+
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0) {
+		CAM_ERR(CAM_SYNC, "Error: Out of range sync obj (0 <= %d < %d)",
+			sync_obj, CAM_SYNC_MAX_OBJS);
+		return -EINVAL;
+	}
+	row = sync_dev->sync_table + sync_obj;
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %d",
+			sync_obj);
+		return -EINVAL;
+	}
+
+	if (row->type == CAM_SYNC_TYPE_GROUP) {
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		CAM_ERR(CAM_SYNC,
+			"Error: Signaling a GROUP sync object = %d",
+			sync_obj);
+		return -EINVAL;
+	}
+
+	if (row->state != CAM_SYNC_STATE_ACTIVE) {
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		CAM_ERR(CAM_SYNC,
+			"Error: Sync object already signaled sync_obj = %d",
+			sync_obj);
+		return -EALREADY;
+	}
+
+	if ((status != CAM_SYNC_STATE_SIGNALED_SUCCESS) &&
+		(status != CAM_SYNC_STATE_SIGNALED_ERROR) &&
+		(status != CAM_SYNC_STATE_SIGNALED_CANCEL)) {
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		CAM_ERR(CAM_SYNC,
+			"Error: signaling with undefined status = %d event reason = %u",
+			status, event_cause);
+		return -EINVAL;
+	}
+
+	if (!atomic_dec_and_test(&row->ref_cnt)) {
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		return 0;
+	}
+
+	row->state = status;
+	cam_sync_util_dispatch_signaled_cb(sync_obj, status, event_cause);
+
+	/* copy parent list to local and release child lock */
+	INIT_LIST_HEAD(&parents_list);
+	list_splice_init(&row->parents_list, &parents_list);
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+
+	if (list_empty(&parents_list))
+		return 0;
+
+	/*
+	 * Now iterate over all parents of this object and if they too need to
+	 * be signaled dispatch cb's
+	 */
+	list_for_each_entry_safe(parent_info,
+		temp_parent_info,
+		&parents_list,
+		list) {
+		parent_row = sync_dev->sync_table + parent_info->sync_id;
+		spin_lock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+		parent_row->remaining--;
+
+		rc = cam_sync_util_update_parent_state(
+			parent_row,
+			status);
+		if (rc) {
+			CAM_ERR(CAM_SYNC, "Invalid parent state %d",
+				parent_row->state);
+			spin_unlock_bh(
+				&sync_dev->row_spinlocks[parent_info->sync_id]);
+			kfree(parent_info);
+			continue;
+		}
+
+		if (!parent_row->remaining)
+			cam_sync_util_dispatch_signaled_cb(
+				parent_info->sync_id, parent_row->state,
+				event_cause);
+
+		spin_unlock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+		list_del_init(&parent_info->list);
+		kfree(parent_info);
+	}
+
+	return 0;
+}
+
+int cam_sync_merge(int32_t *sync_obj, uint32_t num_objs, int32_t *merged_obj)
+{
+	int rc;
+	long idx = 0;
+	bool bit;
+	int i = 0;
+
+	if (!sync_obj || !merged_obj) {
+		CAM_ERR(CAM_SYNC, "Invalid pointer(s)");
+		return -EINVAL;
+	}
+
+	if (num_objs <= 1) {
+		CAM_ERR(CAM_SYNC, "Single object merge is not allowed");
+		return -EINVAL;
+	}
+
+	if (cam_common_util_remove_duplicate_arr(sync_obj, num_objs)
+		!= num_objs) {
+		CAM_ERR(CAM_SYNC, "The obj list has duplicate fence");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_objs; i++) {
+		rc = cam_sync_check_valid(sync_obj[i]);
+		if (rc) {
+			CAM_ERR(CAM_SYNC, "Sync_obj[%d] %d valid check fail",
+				i, sync_obj[i]);
+			return rc;
+		}
+	}
+	do {
+		idx = find_first_zero_bit(sync_dev->bitmap, CAM_SYNC_MAX_OBJS);
+		if (idx >= CAM_SYNC_MAX_OBJS)
+			return -ENOMEM;
+		bit = test_and_set_bit(idx, sync_dev->bitmap);
+	} while (bit);
+
+	spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+	rc = cam_sync_init_group_object(sync_dev->sync_table,
+		idx, sync_obj,
+		num_objs);
+	if (rc < 0) {
+		CAM_ERR(CAM_SYNC, "Error: Unable to init row at idx = %ld",
+			idx);
+		clear_bit(idx, sync_dev->bitmap);
+		spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+		return -EINVAL;
+	}
+	CAM_DBG(CAM_SYNC, "Init row at idx:%ld to merge objects", idx);
+	*merged_obj = idx;
+	spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+
+	return 0;
+}
+
+int cam_sync_get_obj_ref(int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)
+		return -EINVAL;
+
+	row = sync_dev->sync_table + sync_obj;
+
+	spin_lock(&sync_dev->row_spinlocks[sync_obj]);
+
+	if (row->state != CAM_SYNC_STATE_ACTIVE) {
+		spin_unlock(&sync_dev->row_spinlocks[sync_obj]);
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %d",
+			sync_obj);
+		return -EINVAL;
+	}
+
+	atomic_inc(&row->ref_cnt);
+	spin_unlock(&sync_dev->row_spinlocks[sync_obj]);
+	CAM_DBG(CAM_SYNC, "get ref for obj %d", sync_obj);
+
+	return 0;
+}
+
+int cam_sync_put_obj_ref(int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)
+		return -EINVAL;
+
+	row = sync_dev->sync_table + sync_obj;
+	atomic_dec(&row->ref_cnt);
+	CAM_DBG(CAM_SYNC, "put ref for obj %d", sync_obj);
+
+	return 0;
+}
+
+int cam_sync_destroy(int32_t sync_obj)
+{
+	CAM_DBG(CAM_SYNC, "sync_obj: %i", sync_obj);
+	return cam_sync_deinit_object(sync_dev->sync_table, sync_obj);
+}
+
+int cam_sync_check_valid(int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)
+		return -EINVAL;
+
+	row = sync_dev->sync_table + sync_obj;
+
+	if (!test_bit(sync_obj, sync_dev->bitmap)) {
+		CAM_ERR(CAM_SYNC, "Error: Released sync obj received %d",
+			sync_obj);
+		return -EINVAL;
+	}
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %d",
+			sync_obj);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int cam_sync_wait(int32_t sync_obj, uint64_t timeout_ms)
+{
+	unsigned long timeleft;
+	int rc = -EINVAL;
+	struct sync_table_row *row = NULL;
+
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)
+		return -EINVAL;
+
+	row = sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %d",
+			sync_obj);
+		return -EINVAL;
+	}
+
+	timeleft = wait_for_completion_timeout(&row->signaled,
+		msecs_to_jiffies(timeout_ms));
+
+	if (!timeleft) {
+		CAM_ERR(CAM_SYNC,
+			"Error: timed out for sync obj = %d", sync_obj);
+		rc = -ETIMEDOUT;
+	} else {
+		switch (row->state) {
+		case CAM_SYNC_STATE_INVALID:
+		case CAM_SYNC_STATE_ACTIVE:
+		case CAM_SYNC_STATE_SIGNALED_ERROR:
+		case CAM_SYNC_STATE_SIGNALED_CANCEL:
+			CAM_ERR(CAM_SYNC,
+				"Error: Wait on invalid state = %d, obj = %d",
+				row->state, sync_obj);
+			rc = -EINVAL;
+			break;
+		case CAM_SYNC_STATE_SIGNALED_SUCCESS:
+			rc = 0;
+			break;
+		default:
+			rc = -EINVAL;
+			break;
+		}
+	}
+
+	return rc;
+}
+
+static int cam_sync_handle_create(struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_info sync_create;
+	int result;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_info))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_create,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		k_ioctl->size))
+		return -EFAULT;
+	sync_create.name[SYNC_DEBUG_NAME_LEN] = '\0';
+
+	result = cam_sync_create(&sync_create.sync_obj,
+		sync_create.name);
+
+	if (!result)
+		if (copy_to_user(
+			u64_to_user_ptr(k_ioctl->ioctl_ptr),
+			&sync_create,
+			k_ioctl->size))
+			return -EFAULT;
+
+	return result;
+}
+
+static int cam_sync_handle_signal(struct cam_private_ioctl_arg *k_ioctl)
+{
+	int rc = 0;
+	struct cam_sync_signal sync_signal;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_signal))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_signal,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		k_ioctl->size))
+		return -EFAULT;
+
+	/* need to get ref for UMD signaled fences */
+	rc = cam_sync_get_obj_ref(sync_signal.sync_obj);
+	if (rc) {
+		CAM_DBG(CAM_SYNC,
+			"Error: cannot signal an uninitialized sync obj = %d",
+			sync_signal.sync_obj);
+		return rc;
+	}
+
+	return cam_sync_signal(sync_signal.sync_obj,
+		sync_signal.sync_state,
+		CAM_SYNC_COMMON_SYNC_SIGNAL_EVENT);
+}
+
+static int cam_sync_handle_merge(struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_merge sync_merge;
+	uint32_t *sync_objs;
+	uint32_t num_objs;
+	uint32_t size;
+	int result;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_merge))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_merge,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		k_ioctl->size))
+		return -EFAULT;
+
+	if (sync_merge.num_objs >= CAM_SYNC_MAX_OBJS)
+		return -EINVAL;
+
+	size = sizeof(uint32_t) * sync_merge.num_objs;
+	sync_objs = kzalloc(size, GFP_ATOMIC);
+
+	if (!sync_objs)
+		return -ENOMEM;
+
+	if (copy_from_user(sync_objs,
+		u64_to_user_ptr(sync_merge.sync_objs),
+		sizeof(uint32_t) * sync_merge.num_objs)) {
+		kfree(sync_objs);
+		return -EFAULT;
+	}
+
+	num_objs = sync_merge.num_objs;
+
+	result = cam_sync_merge(sync_objs,
+		num_objs,
+		&sync_merge.merged);
+
+	if (!result)
+		if (copy_to_user(
+			u64_to_user_ptr(k_ioctl->ioctl_ptr),
+			&sync_merge,
+			k_ioctl->size)) {
+			kfree(sync_objs);
+			return -EFAULT;
+	}
+
+	kfree(sync_objs);
+
+	return result;
+}
+
+static int cam_sync_handle_wait(struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_wait sync_wait;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_wait))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_wait,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		k_ioctl->size))
+		return -EFAULT;
+
+	k_ioctl->result = cam_sync_wait(sync_wait.sync_obj,
+		sync_wait.timeout_ms);
+
+	return 0;
+}
+
+static int cam_sync_handle_destroy(struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_info sync_create;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_info))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&sync_create,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		k_ioctl->size))
+		return -EFAULT;
+
+	return cam_sync_destroy(sync_create.sync_obj);
+}
+
+static int cam_sync_handle_register_user_payload(
+	struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_userpayload_info userpayload_info;
+	struct sync_user_payload *user_payload_kernel;
+	struct sync_user_payload *user_payload_iter;
+	struct sync_user_payload *temp_upayload_kernel;
+	uint32_t sync_obj;
+	struct sync_table_row *row = NULL;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_userpayload_info))
+		return -EINVAL;
+
+	if (!k_ioctl->ioctl_ptr)
+		return -EINVAL;
+
+	if (copy_from_user(&userpayload_info,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		k_ioctl->size))
+		return -EFAULT;
+
+	sync_obj = userpayload_info.sync_obj;
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)
+		return -EINVAL;
+
+	user_payload_kernel = kzalloc(sizeof(*user_payload_kernel), GFP_KERNEL);
+	if (!user_payload_kernel)
+		return -ENOMEM;
+
+	memcpy(user_payload_kernel->payload_data,
+		userpayload_info.payload,
+		CAM_SYNC_PAYLOAD_WORDS * sizeof(__u64));
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row =  sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %d",
+			sync_obj);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		kfree(user_payload_kernel);
+		return -EINVAL;
+	}
+
+	if ((row->state == CAM_SYNC_STATE_SIGNALED_SUCCESS) ||
+		(row->state == CAM_SYNC_STATE_SIGNALED_ERROR) ||
+		(row->state == CAM_SYNC_STATE_SIGNALED_CANCEL)) {
+
+		cam_sync_util_send_v4l2_event(CAM_SYNC_V4L_EVENT_ID_CB_TRIG,
+			sync_obj,
+			row->state,
+			user_payload_kernel->payload_data,
+			CAM_SYNC_USER_PAYLOAD_SIZE * sizeof(__u64),
+			CAM_SYNC_COMMON_REG_PAYLOAD_EVENT);
+
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		kfree(user_payload_kernel);
+		return 0;
+	}
+
+	list_for_each_entry_safe(user_payload_iter,
+		temp_upayload_kernel,
+		&row->user_payload_list,
+		list) {
+		if (user_payload_iter->payload_data[0] ==
+				user_payload_kernel->payload_data[0] &&
+			user_payload_iter->payload_data[1] ==
+				user_payload_kernel->payload_data[1]) {
+
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+			kfree(user_payload_kernel);
+			return -EALREADY;
+		}
+	}
+
+	list_add_tail(&user_payload_kernel->list, &row->user_payload_list);
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return 0;
+}
+
+static int cam_sync_handle_deregister_user_payload(
+	struct cam_private_ioctl_arg *k_ioctl)
+{
+	struct cam_sync_userpayload_info userpayload_info;
+	struct sync_user_payload *user_payload_kernel, *temp;
+	uint32_t sync_obj;
+	struct sync_table_row *row = NULL;
+
+	if (k_ioctl->size != sizeof(struct cam_sync_userpayload_info)) {
+		CAM_ERR(CAM_SYNC, "Incorrect ioctl size");
+		return -EINVAL;
+	}
+
+	if (!k_ioctl->ioctl_ptr) {
+		CAM_ERR(CAM_SYNC, "Invalid embedded ioctl ptr");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&userpayload_info,
+		u64_to_user_ptr(k_ioctl->ioctl_ptr),
+		k_ioctl->size))
+		return -EFAULT;
+
+	sync_obj = userpayload_info.sync_obj;
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)
+		return -EINVAL;
+
+	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	row =  sync_dev->sync_table + sync_obj;
+
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %d",
+			sync_obj);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		return -EINVAL;
+	}
+
+	list_for_each_entry_safe(user_payload_kernel, temp,
+				&row->user_payload_list, list) {
+		if (user_payload_kernel->payload_data[0] ==
+				userpayload_info.payload[0] &&
+				user_payload_kernel->payload_data[1] ==
+				userpayload_info.payload[1]) {
+			list_del_init(&user_payload_kernel->list);
+			kfree(user_payload_kernel);
+		}
+	}
+
+	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+	return 0;
+}
+
+static long cam_sync_dev_ioctl(struct file *filep, void *fh,
+		bool valid_prio, unsigned int cmd, void *arg)
+{
+	int32_t rc;
+	struct sync_device *sync_dev = video_drvdata(filep);
+	struct cam_private_ioctl_arg k_ioctl;
+
+	if (!sync_dev) {
+		CAM_ERR(CAM_SYNC, "sync_dev NULL");
+		return -EINVAL;
+	}
+
+	if (!arg)
+		return -EINVAL;
+
+	if (cmd != CAM_PRIVATE_IOCTL_CMD)
+		return -ENOIOCTLCMD;
+
+	k_ioctl = *(struct cam_private_ioctl_arg *)arg;
+
+	switch (k_ioctl.id) {
+	case CAM_SYNC_CREATE:
+		rc = cam_sync_handle_create(&k_ioctl);
+		break;
+	case CAM_SYNC_DESTROY:
+		rc = cam_sync_handle_destroy(&k_ioctl);
+		break;
+	case CAM_SYNC_REGISTER_PAYLOAD:
+		rc = cam_sync_handle_register_user_payload(
+			&k_ioctl);
+		break;
+	case CAM_SYNC_DEREGISTER_PAYLOAD:
+		rc = cam_sync_handle_deregister_user_payload(
+			&k_ioctl);
+		break;
+	case CAM_SYNC_SIGNAL:
+		rc = cam_sync_handle_signal(&k_ioctl);
+		break;
+	case CAM_SYNC_MERGE:
+		rc = cam_sync_handle_merge(&k_ioctl);
+		break;
+	case CAM_SYNC_WAIT:
+		rc = cam_sync_handle_wait(&k_ioctl);
+		((struct cam_private_ioctl_arg *)arg)->result =
+			k_ioctl.result;
+		break;
+	default:
+		rc = -ENOIOCTLCMD;
+	}
+
+	return rc;
+}
+
+static unsigned int cam_sync_poll(struct file *f,
+	struct poll_table_struct *pll_table)
+{
+	int rc = 0;
+	struct v4l2_fh *eventq = f->private_data;
+
+	if (!eventq)
+		return -EINVAL;
+
+	poll_wait(f, &eventq->wait, pll_table);
+
+	if (v4l2_event_pending(eventq))
+		rc = POLLPRI;
+
+	return rc;
+}
+
+static int cam_sync_open(struct file *filep)
+{
+	int rc;
+	struct sync_device *sync_dev = video_drvdata(filep);
+
+	if (!sync_dev) {
+		CAM_ERR(CAM_SYNC, "Sync device NULL");
+		return -ENODEV;
+	}
+
+	mutex_lock(&sync_dev->table_lock);
+	if (sync_dev->open_cnt >= 1) {
+		mutex_unlock(&sync_dev->table_lock);
+		return -EALREADY;
+	}
+
+	rc = v4l2_fh_open(filep);
+	if (!rc) {
+		sync_dev->open_cnt++;
+		spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
+		sync_dev->cam_sync_eventq = filep->private_data;
+		spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
+	} else {
+		CAM_ERR(CAM_SYNC, "v4l2_fh_open failed : %d", rc);
+	}
+	mutex_unlock(&sync_dev->table_lock);
+
+	return rc;
+}
+
+static int cam_sync_close(struct file *filep)
+{
+	int rc = 0;
+	int i;
+	struct sync_device *sync_dev = video_drvdata(filep);
+
+	if (!sync_dev) {
+		CAM_ERR(CAM_SYNC, "Sync device NULL");
+		rc = -ENODEV;
+		return rc;
+	}
+	mutex_lock(&sync_dev->table_lock);
+	sync_dev->open_cnt--;
+	if (!sync_dev->open_cnt) {
+		for (i = 1; i < CAM_SYNC_MAX_OBJS; i++) {
+			struct sync_table_row *row =
+			sync_dev->sync_table + i;
+
+			/*
+			 * Signal all ACTIVE objects as ERR, but we don't
+			 * care about the return status here apart from logging
+			 * it.
+			 */
+			if (row->state == CAM_SYNC_STATE_ACTIVE) {
+				rc = cam_sync_signal(i,
+					CAM_SYNC_STATE_SIGNALED_ERROR,
+					CAM_SYNC_COMMON_RELEASE_EVENT);
+				if (rc < 0)
+					CAM_ERR(CAM_SYNC,
+					  "Cleanup signal fail idx:%d\n",
+					  i);
+			}
+		}
+
+		/*
+		 * Flush the work queue to wait for pending signal callbacks to
+		 * finish
+		 */
+		flush_workqueue(sync_dev->work_queue);
+
+		/*
+		 * Now that all callbacks worker threads have finished,
+		 * destroy the sync objects
+		 */
+		for (i = 1; i < CAM_SYNC_MAX_OBJS; i++) {
+			struct sync_table_row *row =
+			sync_dev->sync_table + i;
+
+			if (row->state != CAM_SYNC_STATE_INVALID) {
+				rc = cam_sync_destroy(i);
+				if (rc < 0)
+					CAM_ERR(CAM_SYNC,
+					  "Cleanup destroy fail:idx:%d\n",
+					  i);
+			}
+		}
+	}
+	mutex_unlock(&sync_dev->table_lock);
+	spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
+	sync_dev->cam_sync_eventq = NULL;
+	spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
+	v4l2_fh_release(filep);
+
+	return rc;
+}
+
+static void cam_sync_event_queue_notify_error(const struct v4l2_event *old,
+	struct v4l2_event *new)
+{
+	if (sync_dev->version == CAM_SYNC_V4L_EVENT_V2) {
+		struct cam_sync_ev_header_v2 *ev_header;
+
+		ev_header = CAM_SYNC_GET_HEADER_PTR_V2((*old));
+		CAM_ERR(CAM_CRM,
+			"Failed to notify event id %d fence %d statue %d reason %u %u %u %u",
+			old->id, ev_header->sync_obj, ev_header->status,
+			ev_header->evt_param[0], ev_header->evt_param[1],
+			ev_header->evt_param[2], ev_header->evt_param[3]);
+
+	} else {
+		struct cam_sync_ev_header *ev_header;
+
+		ev_header = CAM_SYNC_GET_HEADER_PTR((*old));
+		CAM_ERR(CAM_CRM,
+			"Failed to notify event id %d fence %d statue %d",
+			old->id, ev_header->sync_obj, ev_header->status);
+	}
+}
+
+static struct v4l2_subscribed_event_ops cam_sync_v4l2_ops = {
+	.merge = cam_sync_event_queue_notify_error,
+};
+
+static int cam_sync_subscribe_event(struct v4l2_fh *fh,
+		const struct v4l2_event_subscription *sub)
+{
+	if (!((sub->type == CAM_SYNC_V4L_EVENT) ||
+	(sub->type == CAM_SYNC_V4L_EVENT_V2))) {
+		CAM_ERR(CAM_SYNC, "Non supported event type 0x%x", sub->type);
+		return -EINVAL;
+	}
+
+	sync_dev->version = sub->type;
+	CAM_DBG(CAM_SYNC, "Sync event verion type 0x%x", sync_dev->version);
+	return v4l2_event_subscribe(fh, sub, CAM_SYNC_MAX_V4L2_EVENTS,
+		&cam_sync_v4l2_ops);
+}
+
+static int cam_sync_unsubscribe_event(struct v4l2_fh *fh,
+		const struct v4l2_event_subscription *sub)
+{
+	if (!((sub->type == CAM_SYNC_V4L_EVENT) ||
+	(sub->type == CAM_SYNC_V4L_EVENT_V2))) {
+		CAM_ERR(CAM_SYNC, "Non supported event type 0x%x", sub->type);
+		return -EINVAL;
+	}
+
+	return v4l2_event_unsubscribe(fh, sub);
+}
+
+static const struct v4l2_ioctl_ops g_cam_sync_ioctl_ops = {
+	.vidioc_subscribe_event = cam_sync_subscribe_event,
+	.vidioc_unsubscribe_event = cam_sync_unsubscribe_event,
+	.vidioc_default = cam_sync_dev_ioctl,
+};
+
+static struct v4l2_file_operations cam_sync_v4l2_fops = {
+	.owner = THIS_MODULE,
+	.open  = cam_sync_open,
+	.release = cam_sync_close,
+	.poll = cam_sync_poll,
+	.unlocked_ioctl   = video_ioctl2,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = video_ioctl2,
+#endif
+};
+
+#if IS_REACHABLE(CONFIG_MEDIA_CONTROLLER)
+static int cam_sync_media_controller_init(struct sync_device *sync_dev,
+	struct platform_device *pdev)
+{
+	int rc;
+
+	sync_dev->v4l2_dev.mdev = kzalloc(sizeof(struct media_device),
+		GFP_KERNEL);
+	if (!sync_dev->v4l2_dev.mdev)
+		return -ENOMEM;
+
+	media_device_init(sync_dev->v4l2_dev.mdev);
+	strscpy(sync_dev->v4l2_dev.mdev->model, CAM_SYNC_DEVICE_NAME,
+		sizeof(sync_dev->v4l2_dev.mdev->model));
+	sync_dev->v4l2_dev.mdev->dev = &(pdev->dev);
+
+	rc = media_device_register(sync_dev->v4l2_dev.mdev);
+	if (rc < 0)
+		goto register_fail;
+
+	rc = media_entity_pads_init(&sync_dev->vdev->entity, 0, NULL);
+	if (rc < 0)
+		goto entity_fail;
+
+	return 0;
+
+entity_fail:
+	media_device_unregister(sync_dev->v4l2_dev.mdev);
+register_fail:
+	media_device_cleanup(sync_dev->v4l2_dev.mdev);
+	return rc;
+}
+
+static void cam_sync_media_controller_cleanup(struct sync_device *sync_dev)
+{
+	media_entity_cleanup(&sync_dev->vdev->entity);
+	media_device_unregister(sync_dev->v4l2_dev.mdev);
+	media_device_cleanup(sync_dev->v4l2_dev.mdev);
+	kfree(sync_dev->v4l2_dev.mdev);
+}
+
+static void cam_sync_init_entity(struct sync_device *sync_dev)
+{
+	sync_dev->vdev->entity.function = CAM_SYNC_DEVICE_TYPE;
+	sync_dev->vdev->entity.name =
+				video_device_node_name(sync_dev->vdev);
+}
+#else
+static int cam_sync_media_controller_init(struct sync_device *sync_dev,
+	struct platform_device *pdev)
+{
+	return 0;
+}
+
+static void cam_sync_media_controller_cleanup(struct sync_device *sync_dev)
+{
+}
+
+static void cam_sync_init_entity(struct sync_device *sync_dev)
+{
+}
+#endif
+
+static int cam_sync_create_debugfs(void)
+{
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	dbgfileptr = debugfs_create_dir("camera_sync", NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_SYNC,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	sync_dev->dentry = dbgfileptr;
+
+	debugfs_create_bool("trigger_cb_without_switch", 0644,
+		sync_dev->dentry, &trigger_cb_without_switch);
+
+end:
+	return rc;
+}
+
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+int cam_synx_sync_signal(int32_t sync_obj, uint32_t synx_status)
+{
+	int rc = 0;
+	uint32_t sync_status = synx_status;
+
+	switch (synx_status) {
+	case SYNX_STATE_ACTIVE:
+		sync_status = CAM_SYNC_STATE_ACTIVE;
+		break;
+	case SYNX_STATE_SIGNALED_SUCCESS:
+		sync_status = CAM_SYNC_STATE_SIGNALED_SUCCESS;
+		break;
+	case SYNX_STATE_SIGNALED_ERROR:
+		sync_status = CAM_SYNC_STATE_SIGNALED_ERROR;
+		break;
+	case 4: /* SYNX_STATE_SIGNALED_CANCEL: */
+		sync_status = CAM_SYNC_STATE_SIGNALED_CANCEL;
+		break;
+	default:
+		CAM_ERR(CAM_SYNC, "Invalid synx status %d for obj %d",
+			synx_status, sync_obj);
+		sync_status = CAM_SYNC_STATE_SIGNALED_ERROR;
+		break;
+	}
+
+	rc = cam_sync_signal(sync_obj, sync_status, CAM_SYNC_COMMON_EVENT_SYNX);
+	if (rc) {
+		CAM_ERR(CAM_SYNC,
+			"synx signal failed with %d, sync_obj=%d, synx_status=%d, sync_status=%d",
+			sync_obj, synx_status, sync_status, rc);
+	}
+
+	return rc;
+}
+
+static int cam_sync_register_synx_bind_ops(
+	struct synx_register_params *object)
+{
+	int rc = 0;
+
+	rc = synx_register_ops(object);
+	if (rc)
+		CAM_ERR(CAM_SYNC, "synx registration fail with rc=%d", rc);
+
+	return rc;
+}
+
+static void cam_sync_unregister_synx_bind_ops(
+	struct synx_register_params *object)
+{
+	int rc = 0;
+
+	rc = synx_deregister_ops(object);
+	if (rc)
+		CAM_ERR(CAM_SYNC, "sync unregistration fail with %d", rc);
+}
+
+static void cam_sync_configure_synx_obj(struct synx_register_params *object)
+{
+	struct synx_register_params *params = object;
+
+	params->name = CAM_SYNC_NAME;
+	params->type = SYNX_TYPE_CSL;
+	params->ops.register_callback = cam_sync_register_callback;
+	params->ops.deregister_callback = cam_sync_deregister_callback;
+	params->ops.enable_signaling = cam_sync_get_obj_ref;
+	params->ops.signal = cam_synx_sync_signal;
+}
+#endif
+
+static int cam_sync_component_bind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int rc;
+	int idx;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	sync_dev = kzalloc(sizeof(*sync_dev), GFP_KERNEL);
+	if (!sync_dev)
+		return -ENOMEM;
+
+	mutex_init(&sync_dev->table_lock);
+	spin_lock_init(&sync_dev->cam_sync_eventq_lock);
+
+	for (idx = 0; idx < CAM_SYNC_MAX_OBJS; idx++)
+		spin_lock_init(&sync_dev->row_spinlocks[idx]);
+
+	sync_dev->vdev = video_device_alloc();
+	if (!sync_dev->vdev) {
+		rc = -ENOMEM;
+		goto vdev_fail;
+	}
+
+	rc = cam_sync_media_controller_init(sync_dev, pdev);
+	if (rc < 0)
+		goto mcinit_fail;
+
+	sync_dev->vdev->v4l2_dev = &sync_dev->v4l2_dev;
+
+	rc = v4l2_device_register(&(pdev->dev), sync_dev->vdev->v4l2_dev);
+	if (rc < 0)
+		goto register_fail;
+
+	strscpy(sync_dev->vdev->name, CAM_SYNC_NAME,
+		sizeof(sync_dev->vdev->name));
+	sync_dev->vdev->release  = video_device_release_empty;
+	sync_dev->vdev->fops     = &cam_sync_v4l2_fops;
+	sync_dev->vdev->ioctl_ops = &g_cam_sync_ioctl_ops;
+	sync_dev->vdev->minor     = -1;
+	sync_dev->vdev->device_caps |= V4L2_CAP_VIDEO_CAPTURE;
+	sync_dev->vdev->vfl_type  = VFL_TYPE_VIDEO;
+	rc = video_register_device(sync_dev->vdev,
+		VFL_TYPE_VIDEO, -1);
+	if (rc < 0) {
+		CAM_ERR(CAM_SYNC,
+			"video device registration failure rc = %d, name = %s, device_caps = %d",
+			rc, sync_dev->vdev->name, sync_dev->vdev->device_caps);
+		goto v4l2_fail;
+	}
+
+	cam_sync_init_entity(sync_dev);
+	video_set_drvdata(sync_dev->vdev, sync_dev);
+	memset(&sync_dev->sync_table, 0, sizeof(sync_dev->sync_table));
+	memset(&sync_dev->bitmap, 0, sizeof(sync_dev->bitmap));
+	bitmap_zero(sync_dev->bitmap, CAM_SYNC_MAX_OBJS);
+
+	/*
+	 * We treat zero as invalid handle, so we will keep the 0th bit set
+	 * always
+	 */
+	set_bit(0, sync_dev->bitmap);
+
+	sync_dev->work_queue = alloc_workqueue(CAM_SYNC_WORKQUEUE_NAME,
+		WQ_HIGHPRI | WQ_UNBOUND, 1);
+
+	if (!sync_dev->work_queue) {
+		CAM_ERR(CAM_SYNC,
+			"Error: high priority work queue creation failed");
+		rc = -ENOMEM;
+		goto v4l2_fail;
+	}
+
+	trigger_cb_without_switch = false;
+	cam_sync_create_debugfs();
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+	CAM_DBG(CAM_SYNC, "Registering with synx driver");
+	cam_sync_configure_synx_obj(&sync_dev->params);
+	rc = cam_sync_register_synx_bind_ops(&sync_dev->params);
+	if (rc)
+		goto v4l2_fail;
+#endif
+	CAM_DBG(CAM_SYNC, "Component bound successfully");
+	return rc;
+
+v4l2_fail:
+	v4l2_device_unregister(sync_dev->vdev->v4l2_dev);
+register_fail:
+	cam_sync_media_controller_cleanup(sync_dev);
+mcinit_fail:
+	video_unregister_device(sync_dev->vdev);
+	video_device_release(sync_dev->vdev);
+vdev_fail:
+	mutex_destroy(&sync_dev->table_lock);
+	kfree(sync_dev);
+	return rc;
+}
+
+static void cam_sync_component_unbind(struct device *dev,
+	struct device *master_dev, void *data)
+{
+	int i;
+
+	v4l2_device_unregister(sync_dev->vdev->v4l2_dev);
+	cam_sync_media_controller_cleanup(sync_dev);
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+	cam_sync_unregister_synx_bind_ops(&sync_dev->params);
+#endif
+	video_unregister_device(sync_dev->vdev);
+	video_device_release(sync_dev->vdev);
+	debugfs_remove_recursive(sync_dev->dentry);
+	sync_dev->dentry = NULL;
+
+	for (i = 0; i < CAM_SYNC_MAX_OBJS; i++)
+		spin_lock_init(&sync_dev->row_spinlocks[i]);
+
+	kfree(sync_dev);
+	sync_dev = NULL;
+}
+
+const static struct component_ops cam_sync_component_ops = {
+	.bind = cam_sync_component_bind,
+	.unbind = cam_sync_component_unbind,
+};
+
+static int cam_sync_probe(struct platform_device *pdev)
+{
+	int rc = 0;
+
+	CAM_DBG(CAM_SYNC, "Adding Sync component");
+	rc = component_add(&pdev->dev, &cam_sync_component_ops);
+	if (rc)
+		CAM_ERR(CAM_SYNC, "failed to add component rc: %d", rc);
+
+	return rc;
+}
+
+static int cam_sync_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &cam_sync_component_ops);
+	return 0;
+}
+
+static const struct of_device_id cam_sync_dt_match[] = {
+	{.compatible = "qcom,cam-sync"},
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, cam_sync_dt_match);
+
+struct platform_driver cam_sync_driver = {
+	.probe = cam_sync_probe,
+	.remove = cam_sync_remove,
+	.driver = {
+		.name = "cam_sync",
+		.owner = THIS_MODULE,
+		.of_match_table = cam_sync_dt_match,
+		.suppress_bind_attrs = true,
+	},
+};
+
+int cam_sync_init(void)
+{
+	return platform_driver_register(&cam_sync_driver);
+}
+
+void cam_sync_exit(void)
+{
+	platform_driver_unregister(&cam_sync_driver);
+}
+
+MODULE_DESCRIPTION("Camera sync driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync_api.h
@@ -0,0 +1,164 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __CAM_SYNC_API_H__
+#define __CAM_SYNC_API_H__
+
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/completion.h>
+#include <linux/videodev2.h>
+#include <media/cam_sync.h>
+
+#define SYNC_DEBUG_NAME_LEN 63
+typedef void (*sync_callback)(int32_t sync_obj, int status, void *data);
+
+/* Kernel APIs */
+
+/**
+ * @brief: Creates a sync object
+ *
+ *  The newly created sync obj is assigned to sync_obj.
+ *  sync object.
+ *
+ * @param sync_obj   : Pointer to int referencing the sync object.
+ * @param name : Optional parameter associating a name with the sync object for
+ * debug purposes. Only first SYNC_DEBUG_NAME_LEN bytes are accepted,
+ * rest will be ignored.
+ *
+ * @return Status of operation. Zero in case of success.
+ * -EINVAL will be returned if sync_obj is an invalid pointer.
+ * -ENOMEM will be returned if the kernel can't allocate space for
+ * sync object.
+ */
+int cam_sync_create(int32_t *sync_obj, const char *name);
+
+/**
+ * @brief: Registers a callback with a sync object
+ *
+ * @param cb_func:  Pointer to callback to be registered
+ * @param userdata: Opaque pointer which will be passed back with callback.
+ * @param sync_obj: int referencing the sync object.
+ *
+ * @return Status of operation. Zero in case of success.
+ * -EINVAL will be returned if userdata is invalid.
+ * -ENOMEM will be returned if cb_func is invalid.
+ *
+ */
+int cam_sync_register_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj);
+
+/**
+ * @brief: De-registers a callback with a sync object
+ *
+ * @param cb_func:  Pointer to callback to be de-registered
+ * @param userdata: Opaque pointer which will be passed back with callback.
+ * @param sync_obj: int referencing the sync object.
+ *
+ * @return Status of operation. Zero in case of success.
+ * -EINVAL will be returned if userdata is invalid.
+ * -ENOMEM will be returned if cb_func is invalid.
+ */
+int cam_sync_deregister_callback(sync_callback cb_func,
+	void *userdata, int32_t sync_obj);
+
+/**
+ * @brief: Signals a sync object with the status argument.
+ *
+ * This function will signal the sync object referenced by the sync_obj
+ * parameter and when doing so, will trigger callbacks in both user space and
+ * kernel. Callbacks will triggered asynchronously and their order of execution
+ * is not guaranteed. The status parameter will indicate whether the entity
+ * performing the signaling wants to convey an error case or a success case.
+ *
+ * @param sync_obj: int referencing the sync object.
+ * @param status: Status of the signaling. Can be either SYNC_SIGNAL_ERROR or
+ * SYNC_SIGNAL_SUCCESS.
+ * @param evt_param: Event parameter
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_signal(int32_t sync_obj, uint32_t status, uint32_t evt_param);
+
+/**
+ * @brief: Merges multiple sync objects
+ *
+ * This function will merge multiple sync objects into a sync group.
+ *
+ * @param sync_obj: pointer to a block of ints to be merged
+ * @param num_objs: Number of ints in the block
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_merge(int32_t *sync_obj, uint32_t num_objs, int32_t *merged_obj);
+
+/**
+ * @brief: get ref count of sync obj
+ *
+ * This function will increment ref count for the sync object, and the ref
+ * count will be decremented when this sync object is signaled.
+ *
+ * @param sync_obj: sync object
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_get_obj_ref(int32_t sync_obj);
+
+/**
+ * @brief: put ref count of sync obj
+ *
+ * This function will decrement ref count for the sync object.
+ *
+ * @param sync_obj: sync object
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_put_obj_ref(int32_t sync_obj);
+
+/**
+ * @brief: Destroys a sync object
+ *
+ * @param sync_obj: int referencing the sync object to be destroyed
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_destroy(int32_t sync_obj);
+
+/**
+ * @brief: Waits for a sync object synchronously
+ *
+ * Does a wait on the sync object identified by sync_obj for a maximum
+ * of timeout_ms milliseconds. Must not be called from interrupt context as
+ * this API can sleep. Should be called from process context only.
+ *
+ * @param sync_obj: int referencing the sync object to be waited upon
+ * @timeout_ms sync_obj: Timeout in ms.
+ *
+ * @return 0 upon success, -EINVAL if sync object is in bad state or arguments
+ * are invalid, -ETIMEDOUT if wait times out.
+ */
+int cam_sync_wait(int32_t sync_obj, uint64_t timeout_ms);
+
+/**
+ * @brief: Check if sync object is valid
+ *
+ * @param sync_obj: int referencing the sync object to be checked
+ *
+ * @return 0 upon success, -EINVAL if sync object is in bad state or arguments
+ * are invalid
+ */
+int cam_sync_check_valid(int32_t sync_obj);
+
+/**
+ * @brief : API to register SYNC to platform framework.
+ * @return struct platform_device pointer on on success, or ERR_PTR() on error.
+ */
+int cam_sync_init(void);
+
+/**
+ * @brief : API to remove SYNC from platform framework.
+ */
+void cam_sync_exit(void);
+#endif /* __CAM_SYNC_API_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync_private.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync_private.h
@@ -0,0 +1,209 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __CAM_SYNC_PRIVATE_H__
+#define __CAM_SYNC_PRIVATE_H__
+
+#include <linux/bitmap.h>
+#include <linux/videodev2.h>
+#include <linux/workqueue.h>
+#include <linux/interrupt.h>
+#include <linux/debugfs.h>
+#include <media/v4l2-fh.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include "cam_sync_api.h"
+
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+#include <synx_api.h>
+#endif
+
+#ifdef CONFIG_CAM_SYNC_DBG
+#define CDBG(fmt, args...) pr_err(fmt, ##args)
+#else
+#define CDBG(fmt, args...) pr_debug(fmt, ##args)
+#endif
+
+#define CAM_SYNC_OBJ_NAME_LEN           64
+#define CAM_SYNC_MAX_OBJS               2048
+#define CAM_SYNC_MAX_V4L2_EVENTS        250
+#define CAM_SYNC_DEBUG_FILENAME         "cam_debug"
+#define CAM_SYNC_DEBUG_BASEDIR          "cam"
+#define CAM_SYNC_DEBUG_BUF_SIZE         32
+#define CAM_SYNC_PAYLOAD_WORDS          2
+#define CAM_SYNC_NAME                   "cam_sync"
+#define CAM_SYNC_WORKQUEUE_NAME         "HIPRIO_SYNC_WORK_QUEUE"
+
+#define CAM_SYNC_TYPE_INDV              0
+#define CAM_SYNC_TYPE_GROUP             1
+
+/**
+ * enum sync_type - Enum to indicate the type of sync object,
+ * i.e. individual or group.
+ *
+ * @SYNC_TYPE_INDV  : Object is an individual sync object
+ * @SYNC_TYPE_GROUP : Object is a group sync object
+ */
+enum sync_type {
+	SYNC_TYPE_INDV,
+	SYNC_TYPE_GROUP
+};
+
+/**
+ * enum sync_list_clean_type - Enum to indicate the type of list clean action
+ * to be peformed, i.e. specific sync ID or all list sync ids.
+ *
+ * @SYNC_CLEAN_ONE : Specific object to be cleaned in the list
+ * @SYNC_CLEAN_ALL : Clean all objects in the list
+ */
+enum sync_list_clean_type {
+	SYNC_LIST_CLEAN_ONE,
+	SYNC_LIST_CLEAN_ALL
+};
+
+/**
+ * struct sync_parent_info - Single node of information about a parent
+ * of a sync object, usually part of the parents linked list
+ *
+ * @sync_id  : Sync object id of parent
+ * @list     : List member used to append this node to a linked list
+ */
+struct sync_parent_info {
+	int32_t sync_id;
+	struct list_head list;
+};
+
+/**
+ * struct sync_parent_info - Single node of information about a child
+ * of a sync object, usually part of the children linked list
+ *
+ * @sync_id  : Sync object id of child
+ * @list     : List member used to append this node to a linked list
+ */
+struct sync_child_info {
+	int32_t sync_id;
+	struct list_head list;
+};
+
+
+/**
+ * struct sync_callback_info - Single node of information about a kernel
+ * callback registered on a sync object
+ *
+ * @callback_func      : Callback function, registered by client driver
+ * @cb_data            : Callback data, registered by client driver
+ * @status             : Status with which callback will be invoked in client
+ * @sync_obj           : Sync id of the object for which callback is registered
+ * @workq_scheduled_ts : workqueue scheduled timestamp
+ * @cb_dispatch_work   : Work representing the call dispatch
+ * @list               : List member used to append this node to a linked list
+ */
+struct sync_callback_info {
+	sync_callback callback_func;
+	void *cb_data;
+	int status;
+	int32_t sync_obj;
+	ktime_t workq_scheduled_ts;
+	struct work_struct cb_dispatch_work;
+	struct list_head list;
+};
+
+/**
+ * struct sync_user_payload - Single node of information about a user space
+ * payload registered from user space
+ *
+ * @payload_data    : Payload data, opaque to kernel
+ * @list            : List member used to append this node to a linked list
+ */
+struct sync_user_payload {
+	uint64_t payload_data[CAM_SYNC_PAYLOAD_WORDS];
+	struct list_head list;
+};
+
+/**
+ * struct sync_table_row - Single row of information about a sync object, used
+ * for internal book keeping in the sync driver
+ *
+ * @name              : Optional string representation of the sync object
+ * @type              : Type of the sync object (individual or group)
+ * @sync_id           : Integer id representing this sync object
+ * @parents_list      : Linked list of parents of this sync object
+ * @children_list     : Linked list of children of this sync object
+ * @state             : State (INVALID, ACTIVE, SIGNALED_SUCCESS or
+ *                      SIGNALED_ERROR)
+ * @remaining         : Count of remaining children that not been signaled
+ * @signaled          : Completion variable on which block calls will wait
+ * @callback_list     : Linked list of kernel callbacks registered
+ * @user_payload_list : LInked list of user space payloads registered
+ * @ref_cnt           : ref count of the number of usage of the fence.
+ */
+struct sync_table_row {
+	char name[CAM_SYNC_OBJ_NAME_LEN];
+	enum sync_type type;
+	int32_t sync_id;
+	/* List of parents, which are merged objects */
+	struct list_head parents_list;
+	/* List of children, which constitute the merged object */
+	struct list_head children_list;
+	uint32_t state;
+	uint32_t remaining;
+	struct completion signaled;
+	struct list_head callback_list;
+	struct list_head user_payload_list;
+	atomic_t ref_cnt;
+};
+
+/**
+ * struct cam_signalable_info - Information for a single sync object that is
+ * ready to be signaled
+ *
+ * @sync_obj : Sync object id of signalable object
+ * @status   : Status with which to signal
+ * @list     : List member used to append this node to a linked list
+ */
+struct cam_signalable_info {
+	int32_t sync_obj;
+	uint32_t status;
+	struct list_head list;
+};
+
+/**
+ * struct sync_device - Internal struct to book keep sync driver details
+ *
+ * @vdev            : Video device
+ * @v4l2_dev        : V4L2 device
+ * @sync_table      : Table of all sync objects
+ * @row_spinlocks   : Spinlock array, one for each row in the table
+ * @table_lock      : Mutex used to lock the table
+ * @open_cnt        : Count of file open calls made on the sync driver
+ * @dentry          : Debugfs entry
+ * @work_queue      : Work queue used for dispatching kernel callbacks
+ * @cam_sync_eventq : Event queue used to dispatch user payloads to user space
+ * @bitmap          : Bitmap representation of all sync objects
+ * @params          : Parameters for synx call back registration
+ * @version         : version support
+ */
+struct sync_device {
+	struct video_device *vdev;
+	struct v4l2_device v4l2_dev;
+	struct sync_table_row sync_table[CAM_SYNC_MAX_OBJS];
+	spinlock_t row_spinlocks[CAM_SYNC_MAX_OBJS];
+	struct mutex table_lock;
+	int open_cnt;
+	struct dentry *dentry;
+	struct workqueue_struct *work_queue;
+	struct v4l2_fh *cam_sync_eventq;
+	spinlock_t cam_sync_eventq_lock;
+	DECLARE_BITMAP(bitmap, CAM_SYNC_MAX_OBJS);
+#if IS_REACHABLE(CONFIG_MSM_GLOBAL_SYNX)
+	struct synx_register_params params;
+#endif
+	uint32_t version;
+};
+
+
+#endif /* __CAM_SYNC_PRIVATE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync_util.c
@@ -0,0 +1,475 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2018, 2020-2021 The Linux Foundation. All rights reserved.
+ */
+
+#include "cam_sync_util.h"
+#include "cam_req_mgr_workq.h"
+#include "cam_common_util.h"
+
+int cam_sync_util_find_and_set_empty_row(struct sync_device *sync_dev,
+	long *idx)
+{
+	int rc = 0;
+
+	mutex_lock(&sync_dev->table_lock);
+
+	*idx = find_first_zero_bit(sync_dev->bitmap, CAM_SYNC_MAX_OBJS);
+
+	if (*idx < CAM_SYNC_MAX_OBJS)
+		set_bit(*idx, sync_dev->bitmap);
+	else
+		rc = -1;
+
+	mutex_unlock(&sync_dev->table_lock);
+
+	return rc;
+}
+
+int cam_sync_init_row(struct sync_table_row *table,
+	uint32_t idx, const char *name, uint32_t type)
+{
+	struct sync_table_row *row = table + idx;
+
+	if (!table || idx <= 0 || idx >= CAM_SYNC_MAX_OBJS)
+		return -EINVAL;
+
+	memset(row, 0, sizeof(*row));
+
+	if (name)
+		strscpy(row->name, name, SYNC_DEBUG_NAME_LEN);
+	INIT_LIST_HEAD(&row->parents_list);
+	INIT_LIST_HEAD(&row->children_list);
+	row->type = type;
+	row->sync_id = idx;
+	row->state = CAM_SYNC_STATE_ACTIVE;
+	row->remaining = 0;
+	atomic_set(&row->ref_cnt, 0);
+	init_completion(&row->signaled);
+	INIT_LIST_HEAD(&row->callback_list);
+	INIT_LIST_HEAD(&row->user_payload_list);
+	CAM_DBG(CAM_SYNC,
+		"row name:%s sync_id:%i [idx:%u] row_state:%u ",
+		row->name, row->sync_id, idx, row->state);
+
+	return 0;
+}
+
+int cam_sync_init_group_object(struct sync_table_row *table,
+	uint32_t idx,
+	uint32_t *sync_objs,
+	uint32_t num_objs)
+{
+	int i, rc = 0;
+	struct sync_child_info *child_info;
+	struct sync_parent_info *parent_info;
+	struct sync_table_row *row = table + idx;
+	struct sync_table_row *child_row = NULL;
+
+	cam_sync_init_row(table, idx, "merged_fence", CAM_SYNC_TYPE_GROUP);
+
+	/*
+	 * While traversing for children, parent's row list is updated with
+	 * child info and each child's row is updated with parent info.
+	 * If any child state is ERROR or SUCCESS, it will not be added to list.
+	 */
+	for (i = 0; i < num_objs; i++) {
+		child_row = table + sync_objs[i];
+		spin_lock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+
+		/* validate child */
+		if ((child_row->type == CAM_SYNC_TYPE_GROUP) ||
+			(child_row->state == CAM_SYNC_STATE_INVALID)) {
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			CAM_ERR(CAM_SYNC,
+				"Invalid child fence:%i state:%u type:%u",
+				child_row->sync_id, child_row->state,
+				child_row->type);
+			rc = -EINVAL;
+			goto clean_children_info;
+		}
+
+		/* check for child's state */
+		if ((child_row->state == CAM_SYNC_STATE_SIGNALED_ERROR) ||
+			(child_row->state == CAM_SYNC_STATE_SIGNALED_CANCEL)) {
+			row->state = child_row->state;
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			continue;
+		}
+		if (child_row->state != CAM_SYNC_STATE_ACTIVE) {
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			continue;
+		}
+
+		row->remaining++;
+
+		/* Add child info */
+		child_info = kzalloc(sizeof(*child_info), GFP_ATOMIC);
+		if (!child_info) {
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			rc = -ENOMEM;
+			goto clean_children_info;
+		}
+		child_info->sync_id = sync_objs[i];
+		list_add_tail(&child_info->list, &row->children_list);
+
+		/* Add parent info */
+		parent_info = kzalloc(sizeof(*parent_info), GFP_ATOMIC);
+		if (!parent_info) {
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+			rc = -ENOMEM;
+			goto clean_children_info;
+		}
+		parent_info->sync_id = idx;
+		list_add_tail(&parent_info->list, &child_row->parents_list);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+	}
+
+	if (!row->remaining) {
+		if ((row->state != CAM_SYNC_STATE_SIGNALED_ERROR) &&
+			(row->state != CAM_SYNC_STATE_SIGNALED_CANCEL))
+			row->state = CAM_SYNC_STATE_SIGNALED_SUCCESS;
+		complete_all(&row->signaled);
+	}
+
+	return 0;
+
+clean_children_info:
+	row->state = CAM_SYNC_STATE_INVALID;
+	for (i = i-1; i >= 0; i--) {
+		spin_lock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+		child_row = table + sync_objs[i];
+		cam_sync_util_cleanup_parents_list(child_row,
+			SYNC_LIST_CLEAN_ONE, idx);
+		spin_unlock_bh(&sync_dev->row_spinlocks[sync_objs[i]]);
+	}
+
+	cam_sync_util_cleanup_children_list(row, SYNC_LIST_CLEAN_ALL, 0);
+	return rc;
+}
+
+int cam_sync_deinit_object(struct sync_table_row *table, uint32_t idx)
+{
+	struct sync_table_row      *row = table + idx;
+	struct sync_child_info     *child_info, *temp_child;
+	struct sync_callback_info  *sync_cb, *temp_cb;
+	struct sync_parent_info    *parent_info, *temp_parent;
+	struct sync_user_payload   *upayload_info, *temp_upayload;
+	struct sync_table_row      *child_row = NULL, *parent_row = NULL;
+	struct list_head            temp_child_list, temp_parent_list;
+
+	if (!table || idx <= 0 || idx >= CAM_SYNC_MAX_OBJS)
+		return -EINVAL;
+
+	CAM_DBG(CAM_SYNC,
+		"row name:%s sync_id:%i [idx:%u] row_state:%u",
+		row->name, row->sync_id, idx, row->state);
+
+	spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+	if (row->state == CAM_SYNC_STATE_INVALID) {
+		spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj: idx = %d",
+			idx);
+		return -EINVAL;
+	}
+
+	if (row->state == CAM_SYNC_STATE_ACTIVE)
+		CAM_DBG(CAM_SYNC,
+			"Destroying an active sync object name:%s id:%i",
+			row->name, row->sync_id);
+
+	row->state = CAM_SYNC_STATE_INVALID;
+
+	/* Object's child and parent objects will be added into this list */
+	INIT_LIST_HEAD(&temp_child_list);
+	INIT_LIST_HEAD(&temp_parent_list);
+
+	list_for_each_entry_safe(child_info, temp_child, &row->children_list,
+		list) {
+		if (child_info->sync_id <= 0)
+			continue;
+
+		list_del_init(&child_info->list);
+		list_add_tail(&child_info->list, &temp_child_list);
+	}
+
+	list_for_each_entry_safe(parent_info, temp_parent, &row->parents_list,
+		list) {
+		if (parent_info->sync_id <= 0)
+			continue;
+
+		list_del_init(&parent_info->list);
+		list_add_tail(&parent_info->list, &temp_parent_list);
+	}
+
+	spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+
+	/* Cleanup the child to parent link from child list */
+	while (!list_empty(&temp_child_list)) {
+		child_info = list_first_entry(&temp_child_list,
+			struct sync_child_info, list);
+		child_row = sync_dev->sync_table + child_info->sync_id;
+
+		spin_lock_bh(&sync_dev->row_spinlocks[child_info->sync_id]);
+
+		if (child_row->state == CAM_SYNC_STATE_INVALID) {
+			list_del_init(&child_info->list);
+			spin_unlock_bh(&sync_dev->row_spinlocks[
+				child_info->sync_id]);
+			kfree(child_info);
+			continue;
+		}
+
+		if (child_row->state == CAM_SYNC_STATE_ACTIVE)
+			CAM_DBG(CAM_SYNC,
+				"Warning: destroying active child sync obj = %d",
+				child_info->sync_id);
+
+		cam_sync_util_cleanup_parents_list(child_row,
+			SYNC_LIST_CLEAN_ONE, idx);
+
+		list_del_init(&child_info->list);
+		spin_unlock_bh(&sync_dev->row_spinlocks[child_info->sync_id]);
+		kfree(child_info);
+	}
+
+	/* Cleanup the parent to child link */
+	while (!list_empty(&temp_parent_list)) {
+		parent_info = list_first_entry(&temp_parent_list,
+			struct sync_parent_info, list);
+		parent_row = sync_dev->sync_table + parent_info->sync_id;
+
+		spin_lock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+
+		if (parent_row->state == CAM_SYNC_STATE_INVALID) {
+			list_del_init(&parent_info->list);
+			spin_unlock_bh(&sync_dev->row_spinlocks[
+				parent_info->sync_id]);
+			kfree(parent_info);
+			continue;
+		}
+
+		if (parent_row->state == CAM_SYNC_STATE_ACTIVE)
+			CAM_DBG(CAM_SYNC,
+				"Warning: destroying active parent sync obj = %d",
+				parent_info->sync_id);
+
+		cam_sync_util_cleanup_children_list(parent_row,
+			SYNC_LIST_CLEAN_ONE, idx);
+
+		list_del_init(&parent_info->list);
+		spin_unlock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+		kfree(parent_info);
+	}
+
+	spin_lock_bh(&sync_dev->row_spinlocks[idx]);
+	list_for_each_entry_safe(upayload_info, temp_upayload,
+			&row->user_payload_list, list) {
+		list_del_init(&upayload_info->list);
+		kfree(upayload_info);
+	}
+
+	list_for_each_entry_safe(sync_cb, temp_cb,
+			&row->callback_list, list) {
+		list_del_init(&sync_cb->list);
+		kfree(sync_cb);
+	}
+
+	memset(row, 0, sizeof(*row));
+	clear_bit(idx, sync_dev->bitmap);
+	INIT_LIST_HEAD(&row->callback_list);
+	INIT_LIST_HEAD(&row->parents_list);
+	INIT_LIST_HEAD(&row->children_list);
+	INIT_LIST_HEAD(&row->user_payload_list);
+	spin_unlock_bh(&sync_dev->row_spinlocks[idx]);
+
+	CAM_DBG(CAM_SYNC, "Destroying sync obj:%d successful", idx);
+	return 0;
+}
+
+void cam_sync_util_cb_dispatch(struct work_struct *cb_dispatch_work)
+{
+	struct sync_callback_info *cb_info = container_of(cb_dispatch_work,
+		struct sync_callback_info,
+		cb_dispatch_work);
+	sync_callback sync_data = cb_info->callback_func;
+
+	cam_common_util_thread_switch_delay_detect(
+		"CAM-SYNC workq schedule",
+		cb_info->workq_scheduled_ts,
+		CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+	sync_data(cb_info->sync_obj, cb_info->status, cb_info->cb_data);
+
+	kfree(cb_info);
+}
+
+void cam_sync_util_dispatch_signaled_cb(int32_t sync_obj,
+	uint32_t status, uint32_t event_cause)
+{
+	struct sync_callback_info  *sync_cb;
+	struct sync_user_payload   *payload_info;
+	struct sync_callback_info  *temp_sync_cb;
+	struct sync_table_row      *signalable_row;
+	struct sync_user_payload   *temp_payload_info;
+
+	signalable_row = sync_dev->sync_table + sync_obj;
+	if (signalable_row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_DBG(CAM_SYNC,
+			"Accessing invalid sync object:%i", sync_obj);
+		return;
+	}
+
+	/* Dispatch kernel callbacks if any were registered earlier */
+	list_for_each_entry_safe(sync_cb,
+		temp_sync_cb, &signalable_row->callback_list, list) {
+		sync_cb->status = status;
+		list_del_init(&sync_cb->list);
+		queue_work(sync_dev->work_queue,
+			&sync_cb->cb_dispatch_work);
+	}
+
+	/* Dispatch user payloads if any were registered earlier */
+	list_for_each_entry_safe(payload_info, temp_payload_info,
+		&signalable_row->user_payload_list, list) {
+		spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
+		if (!sync_dev->cam_sync_eventq) {
+			spin_unlock_bh(
+				&sync_dev->cam_sync_eventq_lock);
+			break;
+		}
+		spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
+		cam_sync_util_send_v4l2_event(
+			CAM_SYNC_V4L_EVENT_ID_CB_TRIG,
+			sync_obj,
+			status,
+			payload_info->payload_data,
+			CAM_SYNC_PAYLOAD_WORDS * sizeof(__u64),
+			event_cause);
+
+		list_del_init(&payload_info->list);
+		/*
+		 * We can free the list node here because
+		 * sending V4L event will make a deep copy
+		 * anyway
+		 */
+		 kfree(payload_info);
+	}
+
+	/*
+	 * This needs to be done because we want to unblock anyone
+	 * who might be blocked and waiting on this sync object
+	 */
+	complete_all(&signalable_row->signaled);
+}
+
+void cam_sync_util_send_v4l2_event(uint32_t id,
+	uint32_t sync_obj,
+	int status,
+	void *payload,
+	int len, uint32_t event_cause)
+{
+	struct v4l2_event event;
+	__u64 *payload_data = NULL;
+
+	if (sync_dev->version == CAM_SYNC_V4L_EVENT_V2) {
+		struct cam_sync_ev_header_v2 *ev_header = NULL;
+
+		event.id = id;
+		event.type = CAM_SYNC_V4L_EVENT_V2;
+
+		ev_header = CAM_SYNC_GET_HEADER_PTR_V2(event);
+		ev_header->sync_obj = sync_obj;
+		ev_header->status = status;
+		ev_header->version = sync_dev->version;
+		ev_header->evt_param[CAM_SYNC_EVENT_REASON_CODE_INDEX] =
+			event_cause;
+		payload_data = CAM_SYNC_GET_PAYLOAD_PTR_V2(event, __u64);
+	} else {
+		struct cam_sync_ev_header *ev_header = NULL;
+
+		event.id = id;
+		event.type = CAM_SYNC_V4L_EVENT;
+
+		ev_header = CAM_SYNC_GET_HEADER_PTR(event);
+		ev_header->sync_obj = sync_obj;
+		ev_header->status = status;
+		payload_data = CAM_SYNC_GET_PAYLOAD_PTR(event, __u64);
+	}
+
+	memcpy(payload_data, payload, len);
+	v4l2_event_queue(sync_dev->vdev, &event);
+	CAM_DBG(CAM_SYNC, "send v4l2 event version %d for sync_obj :%d",
+		sync_dev->version,
+		sync_obj);
+}
+
+int cam_sync_util_update_parent_state(struct sync_table_row *parent_row,
+	int new_state)
+{
+	int rc = 0;
+
+	switch (parent_row->state) {
+	case CAM_SYNC_STATE_ACTIVE:
+	case CAM_SYNC_STATE_SIGNALED_SUCCESS:
+		parent_row->state = new_state;
+		break;
+
+	case CAM_SYNC_STATE_SIGNALED_ERROR:
+	case CAM_SYNC_STATE_SIGNALED_CANCEL:
+		break;
+
+	case CAM_SYNC_STATE_INVALID:
+	default:
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+void cam_sync_util_cleanup_children_list(struct sync_table_row *row,
+	uint32_t list_clean_type, uint32_t sync_obj)
+{
+	struct sync_child_info *child_info = NULL;
+	struct sync_child_info *temp_child_info = NULL;
+	uint32_t                curr_sync_obj;
+
+	list_for_each_entry_safe(child_info,
+			temp_child_info, &row->children_list, list) {
+		if ((list_clean_type == SYNC_LIST_CLEAN_ONE) &&
+			(child_info->sync_id != sync_obj))
+			continue;
+
+		curr_sync_obj = child_info->sync_id;
+		list_del_init(&child_info->list);
+		kfree(child_info);
+
+		if ((list_clean_type == SYNC_LIST_CLEAN_ONE) &&
+			(curr_sync_obj == sync_obj))
+			break;
+	}
+}
+
+void cam_sync_util_cleanup_parents_list(struct sync_table_row *row,
+	uint32_t list_clean_type, uint32_t sync_obj)
+{
+	struct sync_parent_info *parent_info = NULL;
+	struct sync_parent_info *temp_parent_info = NULL;
+	uint32_t                 curr_sync_obj;
+
+	list_for_each_entry_safe(parent_info,
+			temp_parent_info, &row->parents_list, list) {
+		if ((list_clean_type == SYNC_LIST_CLEAN_ONE) &&
+			(parent_info->sync_id != sync_obj))
+			continue;
+
+		curr_sync_obj = parent_info->sync_id;
+		list_del_init(&parent_info->list);
+		kfree(parent_info);
+
+		if ((list_clean_type == SYNC_LIST_CLEAN_ONE) &&
+			(curr_sync_obj == sync_obj))
+			break;
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_sync/cam_sync_util.h
@@ -0,0 +1,147 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __CAM_SYNC_UTIL_H__
+#define __CAM_SYNC_UTIL_H__
+
+
+#include "cam_sync_private.h"
+#include "cam_debug_util.h"
+
+extern struct sync_device *sync_dev;
+
+/**
+ * @brief: Finds an empty row in the sync table and sets its corresponding bit
+ * in the bit array
+ *
+ * @param sync_dev : Pointer to the sync device instance
+ * @param idx      : Pointer to an long containing the index found in the bit
+ *                   array
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_util_find_and_set_empty_row(struct sync_device *sync_dev,
+	long *idx);
+
+/**
+ * @brief: Function to initialize an empty row in the sync table. This should be
+ *         called only for individual sync objects.
+ *
+ * @param table : Pointer to the sync objects table
+ * @param idx   : Index of row to initialize
+ * @param name  : Optional string representation of the sync object. Should be
+ *                63 characters or less
+ * @param type  : type of row to be initialized
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_init_row(struct sync_table_row *table,
+	uint32_t idx, const char *name, uint32_t type);
+
+/**
+ * @brief: Function to uninitialize a row in the sync table
+ *
+ * @param table : Pointer to the sync objects table
+ * @param idx   : Index of row to initialize
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_deinit_object(struct sync_table_row *table, uint32_t idx);
+
+/**
+ * @brief: Function to initialize a row in the sync table when the object is a
+ *         group object, also known as a merged sync object
+ *
+ * @param table     : Pointer to the sync objects table
+ * @param idx       : Index of row to initialize
+ * @param sync_objs : Array of sync objects which will merged
+ *                    or grouped together
+ * @param num_objs  : Number of sync objects in the array
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_init_group_object(struct sync_table_row *table,
+	uint32_t idx,
+	uint32_t *sync_objs,
+	uint32_t num_objs);
+
+int cam_sync_deinit_object(struct sync_table_row *table, uint32_t idx);
+
+/**
+ * @brief: Function to dispatch a kernel callback for a sync callback
+ *
+ * @param cb_dispatch_work : Pointer to the work_struct that needs to be
+ *                           dispatched
+ *
+ * @return None
+ */
+void cam_sync_util_cb_dispatch(struct work_struct *cb_dispatch_work);
+
+/**
+ * @brief: Function to dispatch callbacks for a signaled sync object
+ *
+ * @sync_obj    : Sync object that is signaled
+ * @status      : Status of the signaled object
+ * @evt_param   : Event paramaeter
+ *
+ * @return None
+ */
+void cam_sync_util_dispatch_signaled_cb(int32_t sync_obj,
+	uint32_t status, uint32_t evt_param);
+
+/**
+ * @brief: Function to send V4L event to user space
+ * @param id       : V4L event id to send
+ * @param sync_obj : Sync obj for which event needs to be sent
+ * @param status   : Status of the event
+ * @payload        : Payload that needs to be sent to user space
+ * @len            : Length of the payload
+ * @evt_param      : Event Paramenter
+ *
+ * @return None
+ */
+void cam_sync_util_send_v4l2_event(uint32_t id,
+	uint32_t sync_obj,
+	int status,
+	void *payload,
+	int len,
+	uint32_t evt_param);
+
+/**
+ * @brief: Function which gets the next state of the sync object based on the
+ *         current state and the new state
+ *
+ * @param current_state : Current state of the sync object
+ * @param new_state     : New state of the sync object
+ *
+ * @return Next state of the sync object
+ */
+int cam_sync_util_update_parent_state(struct sync_table_row *parent_row,
+	int new_state);
+
+/**
+ * @brief: Function to clean up the children of a sync object
+ * @row                 : Row whose child list to clean
+ * @list_clean_type     : Clean specific object or clean all objects
+ * @sync_obj            : Sync object to be clean if list clean type is
+ *                          SYNC_LIST_CLEAN_ONE
+ *
+ * @return None
+ */
+void cam_sync_util_cleanup_children_list(struct sync_table_row *row,
+	uint32_t list_clean_type, uint32_t sync_obj);
+
+/**
+ * @brief: Function to clean up the parents of a sync object
+ * @row                 : Row whose parent list to clean
+ * @list_clean_type     : Clean specific object or clean all objects
+ * @sync_obj            : Sync object to be clean if list clean type is
+ *                          SYNC_LIST_CLEAN_ONE
+ *
+ * @return None
+ */
+void cam_sync_util_cleanup_parents_list(struct sync_table_row *row,
+	uint32_t list_clean_type, uint32_t sync_obj);
+
+#endif /* __CAM_SYNC_UTIL_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_cx_ipeak.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_cx_ipeak.c
@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <soc/qcom/cx_ipeak.h>
+
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+
+static struct cx_ipeak_client *cam_cx_ipeak;
+static int cx_ipeak_level = CAM_NOMINAL_VOTE;
+static int cx_default_ipeak_mask;
+static int cx_current_ipeak_mask;
+static int cam_cx_client_cnt;
+
+int cam_cx_ipeak_register_cx_ipeak(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	soc_info->cam_cx_ipeak_enable = true;
+	soc_info->cam_cx_ipeak_bit = 1 << cam_cx_client_cnt++;
+	cx_default_ipeak_mask |= soc_info->cam_cx_ipeak_bit;
+
+	if (cam_cx_ipeak)
+		goto exit;
+
+	cam_cx_ipeak = cx_ipeak_register(soc_info->dev->of_node,
+		"qcom,cam-cx-ipeak");
+
+	if (cam_cx_ipeak) {
+		goto exit;
+	} else {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+exit:
+	CAM_DBG(CAM_UTIL, "cam_cx_ipeak is enabled for %s\n"
+		"mask = %x cx_default_ipeak_mask = %x",
+		soc_info->dev_name, soc_info->cam_cx_ipeak_bit,
+		cx_default_ipeak_mask);
+	return rc;
+}
+
+int cam_cx_ipeak_update_vote_cx_ipeak(struct cam_hw_soc_info *soc_info,
+	int32_t apply_level)
+{
+	int32_t soc_cx_ipeak_bit = soc_info->cam_cx_ipeak_bit;
+	int ret = 0;
+
+	CAM_DBG(CAM_UTIL, "E: apply_level = %d cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x",
+			apply_level, cx_current_ipeak_mask, soc_cx_ipeak_bit);
+
+	if (apply_level < cx_ipeak_level &&
+		(cx_current_ipeak_mask & soc_cx_ipeak_bit)) {
+		if (cx_current_ipeak_mask == cx_default_ipeak_mask) {
+			ret = cx_ipeak_update(cam_cx_ipeak, false);
+			if (ret)
+				goto exit;
+			CAM_DBG(CAM_UTIL,
+				"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+				"soc_cx_ipeak_bit = %x  %s UNVOTE",
+				apply_level, cx_current_ipeak_mask,
+				soc_cx_ipeak_bit, soc_info->dev_name);
+		}
+		cx_current_ipeak_mask &= (~soc_cx_ipeak_bit);
+		CAM_DBG(CAM_UTIL,
+			"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x  %s DISABLE_BIT",
+			apply_level, cx_current_ipeak_mask,
+			soc_cx_ipeak_bit, soc_info->dev_name);
+		goto exit;
+	} else if (apply_level < cx_ipeak_level) {
+		CAM_DBG(CAM_UTIL,
+			"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x NO AI",
+			apply_level, cx_current_ipeak_mask, soc_cx_ipeak_bit);
+		goto exit;
+	}
+
+	cx_current_ipeak_mask |= soc_cx_ipeak_bit;
+	CAM_DBG(CAM_UTIL,
+		"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+		"soc_cx_ipeak_bit = %x  %s ENABLE_BIT",
+		apply_level, cx_current_ipeak_mask,
+		soc_cx_ipeak_bit, soc_info->dev_name);
+	if (cx_current_ipeak_mask == cx_default_ipeak_mask) {
+		ret = cx_ipeak_update(cam_cx_ipeak, true);
+		if (ret)
+			goto exit;
+		CAM_DBG(CAM_UTIL,
+			"X: apply_level = %d cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x  %s VOTE",
+			apply_level, cx_current_ipeak_mask,
+			soc_cx_ipeak_bit, soc_info->dev_name);
+	}
+
+exit:
+	return ret;
+}
+
+int cam_cx_ipeak_unvote_cx_ipeak(struct cam_hw_soc_info *soc_info)
+{
+	int32_t soc_cx_ipeak_bit = soc_info->cam_cx_ipeak_bit;
+
+	CAM_DBG(CAM_UTIL, "E:cx_current_ipeak_mask = %x\n"
+		"soc_cx_ipeak_bit = %x",
+		cx_current_ipeak_mask, soc_cx_ipeak_bit);
+	if (cx_current_ipeak_mask == cx_default_ipeak_mask) {
+		if (cam_cx_ipeak)
+			cx_ipeak_update(cam_cx_ipeak, false);
+		CAM_DBG(CAM_UTIL, "X:cx_current_ipeak_mask = %x\n"
+			"soc_cx_ipeak_bit = %x UNVOTE",
+			cx_current_ipeak_mask, soc_cx_ipeak_bit);
+	}
+	cx_current_ipeak_mask &= (~soc_cx_ipeak_bit);
+	CAM_DBG(CAM_UTIL, "X:cx_current_ipeak_mask = %x\n"
+		"soc_cx_ipeak_bit = %x",
+		cx_current_ipeak_mask, soc_cx_ipeak_bit);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_cx_ipeak.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_cx_ipeak.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_CX_IPEAK_H_
+#define _CAM_CX_IPEAK_H_
+
+#include "cam_soc_util.h"
+
+#ifndef CONFIG_QCOM_CX_IPEAK
+static inline int cam_cx_ipeak_register_cx_ipeak
+	(struct cam_hw_soc_info *soc_info)
+{
+	return 0;
+}
+
+static inline int cam_cx_ipeak_update_vote_cx_ipeak
+	(struct cam_hw_soc_info *soc_info, int32_t apply_level)
+{
+	return 0;
+}
+
+static inline int cam_cx_ipeak_unvote_cx_ipeak
+	(struct cam_hw_soc_info *soc_info)
+{
+	return 0;
+}
+#else
+int cam_cx_ipeak_register_cx_ipeak(struct cam_hw_soc_info *soc_info);
+
+int cam_cx_ipeak_update_vote_cx_ipeak(struct cam_hw_soc_info *soc_info,
+	int32_t apply_level);
+int cam_cx_ipeak_unvote_cx_ipeak(struct cam_hw_soc_info *soc_info);
+#endif
+
+#endif /* _CAM_CX_IPEAK_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_packet_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_packet_util.c
@@ -0,0 +1,481 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/types.h>
+#include <linux/slab.h>
+
+#include "cam_mem_mgr.h"
+#include "cam_packet_util.h"
+#include "cam_debug_util.h"
+
+#define CAM_UNIQUE_SRC_HDL_MAX 50
+
+struct cam_patch_unique_src_buf_tbl {
+	int32_t       hdl;
+	dma_addr_t    iova;
+	size_t        buf_size;
+};
+
+int cam_packet_util_get_cmd_mem_addr(int handle, uint32_t **buf_addr,
+	size_t *len)
+{
+	int rc = 0;
+	uintptr_t kmd_buf_addr = 0;
+
+	rc = cam_mem_get_cpu_buf(handle, &kmd_buf_addr, len);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Unable to get the virtual address %d", rc);
+	} else {
+		if (kmd_buf_addr && *len) {
+			*buf_addr = (uint32_t *)kmd_buf_addr;
+		} else {
+			CAM_ERR(CAM_UTIL, "Invalid addr and length :%zd", *len);
+			rc = -ENOMEM;
+		}
+	}
+	return rc;
+}
+
+int cam_packet_util_validate_cmd_desc(struct cam_cmd_buf_desc *cmd_desc)
+{
+
+	if (!cmd_desc) {
+		CAM_ERR(CAM_UTIL, "Invalid cmd desc");
+		return -EINVAL;
+	}
+
+	if ((cmd_desc->length > cmd_desc->size) ||
+		(cmd_desc->mem_handle <= 0)) {
+		CAM_ERR(CAM_UTIL, "invalid cmd arg %d %d %d %d",
+			cmd_desc->offset, cmd_desc->length,
+			cmd_desc->mem_handle, cmd_desc->size);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_packet_util_validate_packet(struct cam_packet *packet,
+	size_t remain_len)
+{
+	size_t sum_cmd_desc = 0;
+	size_t sum_io_cfgs = 0;
+	size_t sum_patch_desc = 0;
+	size_t pkt_wo_payload = 0;
+
+	if (!packet)
+		return -EINVAL;
+
+	if ((size_t)packet->header.size > remain_len) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid packet size: %zu, CPU buf length: %zu",
+			(size_t)packet->header.size, remain_len);
+		return -EINVAL;
+	}
+
+
+	CAM_DBG(CAM_UTIL, "num cmd buf:%d num of io config:%d kmd buf index:%d",
+		packet->num_cmd_buf, packet->num_io_configs,
+		packet->kmd_cmd_buf_index);
+
+	sum_cmd_desc = packet->num_cmd_buf * sizeof(struct cam_cmd_buf_desc);
+	sum_io_cfgs = packet->num_io_configs * sizeof(struct cam_buf_io_cfg);
+	sum_patch_desc = packet->num_patches * sizeof(struct cam_patch_desc);
+	pkt_wo_payload = offsetof(struct cam_packet, payload);
+
+	if ((!packet->header.size) ||
+		((size_t)packet->header.size <= pkt_wo_payload) ||
+		((pkt_wo_payload + (size_t)packet->cmd_buf_offset +
+		sum_cmd_desc) > (size_t)packet->header.size) ||
+		((pkt_wo_payload + (size_t)packet->io_configs_offset +
+		sum_io_cfgs) > (size_t)packet->header.size) ||
+		((pkt_wo_payload + (size_t)packet->patch_offset +
+		sum_patch_desc) > (size_t)packet->header.size)) {
+		CAM_ERR(CAM_UTIL, "params not within mem len:%zu %zu %zu %zu",
+			(size_t)packet->header.size, sum_cmd_desc,
+			sum_io_cfgs, sum_patch_desc);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int cam_packet_util_get_kmd_buffer(struct cam_packet *packet,
+	struct cam_kmd_buf_info *kmd_buf)
+{
+	int                      rc = 0;
+	size_t                   len = 0;
+	size_t                   remain_len = 0;
+	struct cam_cmd_buf_desc *cmd_desc;
+	uint32_t                *cpu_addr;
+
+	if (!packet || !kmd_buf) {
+		CAM_ERR(CAM_UTIL, "Invalid arg %pK %pK", packet, kmd_buf);
+		return -EINVAL;
+	}
+
+	if (!packet->num_cmd_buf) {
+		CAM_ERR(CAM_UTIL, "Invalid num_cmd_buf = %d", packet->num_cmd_buf);
+		return -EINVAL;
+	}
+
+	if ((packet->kmd_cmd_buf_index < 0) ||
+		(packet->kmd_cmd_buf_index >= packet->num_cmd_buf)) {
+		CAM_ERR(CAM_UTIL, "Invalid kmd buf index: %d",
+			packet->kmd_cmd_buf_index);
+		return -EINVAL;
+	}
+
+	/* Take first command descriptor and add offset to it for kmd*/
+	cmd_desc = (struct cam_cmd_buf_desc *) ((uint8_t *)
+		&packet->payload_flex + packet->cmd_buf_offset);
+	cmd_desc += packet->kmd_cmd_buf_index;
+
+	rc = cam_packet_util_validate_cmd_desc(cmd_desc);
+	if (rc)
+		return rc;
+
+	rc = cam_packet_util_get_cmd_mem_addr(cmd_desc->mem_handle, &cpu_addr,
+		&len);
+	if (rc)
+		return rc;
+
+	remain_len = len;
+	if (((size_t)cmd_desc->offset >= len) ||
+		((size_t)cmd_desc->size > (len - (size_t)cmd_desc->offset))) {
+		CAM_ERR(CAM_UTIL, "invalid memory len:%zd and cmd desc size:%d",
+			len, cmd_desc->size);
+		rc = -EINVAL;
+		goto rel_kmd_buf;
+	}
+
+	remain_len -= (size_t)cmd_desc->offset;
+	if ((size_t)packet->kmd_cmd_buf_offset >= remain_len) {
+		CAM_ERR(CAM_UTIL, "Invalid kmd cmd buf offset: %zu",
+			(size_t)packet->kmd_cmd_buf_offset);
+		rc = -EINVAL;
+		goto rel_kmd_buf;
+	}
+
+	cpu_addr += (cmd_desc->offset / 4) + (packet->kmd_cmd_buf_offset / 4);
+	CAM_DBG(CAM_UTIL, "total size %d, cmd size: %d, KMD buffer size: %d",
+		cmd_desc->size, cmd_desc->length,
+		cmd_desc->size - cmd_desc->length);
+	CAM_DBG(CAM_UTIL, "hdl 0x%x, cmd offset %d, kmd offset %d, addr 0x%pK",
+		cmd_desc->mem_handle, cmd_desc->offset,
+		packet->kmd_cmd_buf_offset, cpu_addr);
+
+	kmd_buf->cpu_addr   = cpu_addr;
+	kmd_buf->handle     = cmd_desc->mem_handle;
+	kmd_buf->offset     = cmd_desc->offset + packet->kmd_cmd_buf_offset;
+	kmd_buf->size       = cmd_desc->size - cmd_desc->length;
+	kmd_buf->used_bytes = 0;
+
+rel_kmd_buf:
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+void cam_packet_dump_patch_info(struct cam_packet *packet,
+	int32_t iommu_hdl, int32_t sec_mmu_hdl)
+{
+	struct cam_patch_desc *patch_desc = NULL;
+	dma_addr_t iova_addr;
+	size_t     dst_buf_len;
+	size_t     src_buf_size;
+	int        i, rc = 0;
+	int32_t    hdl;
+	uintptr_t  cpu_addr = 0;
+	uint32_t  *dst_cpu_addr;
+	uint64_t   value = 0;
+
+	patch_desc = (struct cam_patch_desc *)
+			((uint32_t *) &packet->payload_flex +
+			packet->patch_offset/4);
+
+	CAM_INFO(CAM_UTIL, "Total num of patches : %d",
+		packet->num_patches);
+
+	for (i = 0; i < packet->num_patches; i++) {
+		hdl = cam_mem_is_secure_buf(patch_desc[i].src_buf_hdl) ?
+			sec_mmu_hdl : iommu_hdl;
+		rc = cam_mem_get_io_buf(patch_desc[i].src_buf_hdl,
+			hdl, &iova_addr, &src_buf_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_UTIL,
+				"unable to get src buf address for hdl 0x%x",
+				hdl);
+			return;
+		}
+
+		rc = cam_mem_get_cpu_buf(patch_desc[i].dst_buf_hdl,
+			&cpu_addr, &dst_buf_len);
+		if (rc < 0 || !cpu_addr || (dst_buf_len == 0)) {
+			CAM_ERR(CAM_UTIL, "unable to get dst buf address");
+			return;
+		}
+
+		dst_cpu_addr = (uint32_t *)cpu_addr;
+		dst_cpu_addr = (uint32_t *)((uint8_t *)dst_cpu_addr +
+			patch_desc[i].dst_offset);
+		value = *((uint64_t *)dst_cpu_addr);
+		CAM_INFO(CAM_UTIL,
+			"i = %d src_buf 0x%llx src_hdl 0x%x src_buf_with_offset 0x%llx size 0x%zx dst %p dst_offset %u dst_hdl 0x%x value 0x%llx",
+			i, iova_addr, patch_desc[i].src_buf_hdl,
+			(iova_addr + patch_desc[i].src_offset),
+			src_buf_size, dst_cpu_addr,
+			patch_desc[i].dst_offset,
+			patch_desc[i].dst_buf_hdl, value);
+
+		if (!(*dst_cpu_addr))
+			CAM_ERR(CAM_ICP, "Null at dst addr %p", dst_cpu_addr);
+
+		cam_mem_put_cpu_buf(patch_desc[i].dst_buf_hdl);
+	}
+}
+
+static int cam_packet_util_get_patch_iova(
+	struct cam_patch_unique_src_buf_tbl *tbl,
+	int32_t hdl, uint32_t buf_hdl, dma_addr_t *iova, size_t *buf_size)
+{
+	int idx = 0;
+	int rc = 0;
+	size_t src_buf_size;
+	dma_addr_t iova_addr;
+	bool is_found = false;
+
+	for (idx = 0; idx < CAM_UNIQUE_SRC_HDL_MAX; idx++) {
+		if (buf_hdl == tbl[idx].hdl) {
+			CAM_DBG(CAM_UTIL,
+				"Matched entry for src_buf_hdl: 0x%x with src_hdl[%d]: 0x%x",
+				buf_hdl, idx, tbl[idx].hdl);
+			*iova = tbl[idx].iova;
+			*buf_size = tbl[idx].buf_size;
+			is_found = true;
+			break;
+		} else if ((tbl[idx].hdl == 0) || (tbl[idx].iova == 0)) {
+			CAM_DBG(CAM_UTIL, "New src handle detected 0x%x",
+				buf_hdl);
+			is_found = false;
+			break;
+		}
+		CAM_DBG(CAM_UTIL,
+			"Index: %d is filled with differnt src_hdl: 0x%x",
+			idx, buf_hdl);
+	}
+
+	if (!is_found) {
+		CAM_DBG(CAM_UTIL, "src_hdl 0x%x not found in table entries",
+			buf_hdl);
+		rc = cam_mem_get_io_buf(buf_hdl, hdl,
+			&iova_addr, &src_buf_size);
+		if (rc < 0) {
+			CAM_ERR(CAM_UTIL,
+				"unable to get iova for src_hdl: 0x%x",
+				buf_hdl);
+			return rc;
+		}
+		/* Update the table entry with unique src buf handle */
+		if (idx < CAM_UNIQUE_SRC_HDL_MAX && tbl[idx].hdl == 0) {
+			tbl[idx].buf_size = src_buf_size;
+			tbl[idx].iova = iova_addr;
+			tbl[idx].hdl = buf_hdl;
+			CAM_DBG(CAM_UTIL,
+				"Updated table index: %d with src_buf_hdl: 0x%x",
+				idx, tbl[idx].hdl);
+		}
+		*iova = iova_addr;
+		*buf_size = src_buf_size;
+	}
+
+	return rc;
+}
+
+int cam_packet_util_process_patches(struct cam_packet *packet,
+	int32_t iommu_hdl, int32_t sec_mmu_hdl)
+{
+	struct cam_patch_desc *patch_desc = NULL;
+	dma_addr_t iova_addr;
+	uintptr_t  cpu_addr = 0;
+	uint32_t   temp;
+	uint32_t  *dst_cpu_addr;
+	uint32_t  *src_buf_iova_addr;
+	size_t     dst_buf_len;
+	size_t     src_buf_size;
+	int        i  = 0;
+	int        rc = 0;
+	int32_t    hdl;
+	struct cam_patch_unique_src_buf_tbl
+		tbl[CAM_UNIQUE_SRC_HDL_MAX];
+
+	memset(tbl, 0, CAM_UNIQUE_SRC_HDL_MAX *
+		sizeof(struct cam_patch_unique_src_buf_tbl));
+
+	/* process patch descriptor */
+	patch_desc = (struct cam_patch_desc *)
+			((uint32_t *) &packet->payload_flex +
+			packet->patch_offset/4);
+	CAM_DBG(CAM_UTIL, "packet = %pK patch_desc = %pK size = %lu",
+			(void *)packet, (void *)patch_desc,
+			sizeof(struct cam_patch_desc));
+
+	for (i = 0; i < packet->num_patches; i++) {
+		hdl = cam_mem_is_secure_buf(patch_desc[i].src_buf_hdl) ?
+			sec_mmu_hdl : iommu_hdl;
+
+		rc = cam_packet_util_get_patch_iova(&tbl[0], hdl,
+			patch_desc[i].src_buf_hdl, &iova_addr, &src_buf_size);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"get_iova failed for patch[%d], src_buf_hdl: 0x%x: rc: %d",
+				i, patch_desc[i].src_buf_hdl, rc);
+			return rc;
+		}
+
+		if ((size_t)patch_desc[i].src_offset >= src_buf_size) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid src buf patch offset: patch:src_offset: 0x%x, src_buf_size: %zu",
+				patch_desc[i].src_offset, src_buf_size);
+			return -EINVAL;
+		}
+
+		src_buf_iova_addr = (uint32_t *)iova_addr;
+		temp = iova_addr;
+
+		rc = cam_mem_get_cpu_buf(patch_desc[i].dst_buf_hdl,
+			&cpu_addr, &dst_buf_len);
+		if (rc < 0 || !cpu_addr || (dst_buf_len == 0)) {
+			CAM_ERR(CAM_UTIL, "unable to get dst buf address");
+			return rc;
+		}
+		dst_cpu_addr = (uint32_t *)cpu_addr;
+
+		CAM_DBG(CAM_UTIL, "i = %d patch info = %x %x %x %x", i,
+			patch_desc[i].dst_buf_hdl, patch_desc[i].dst_offset,
+			patch_desc[i].src_buf_hdl, patch_desc[i].src_offset);
+
+		if ((dst_buf_len < sizeof(void *)) ||
+			((dst_buf_len - sizeof(void *)) <
+			(size_t)patch_desc[i].dst_offset)) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid dst buf patch offset");
+			cam_mem_put_cpu_buf((int32_t)patch_desc[i].dst_buf_hdl);
+			return -EINVAL;
+		}
+
+		dst_cpu_addr = (uint32_t *)((uint8_t *)dst_cpu_addr +
+			patch_desc[i].dst_offset);
+		temp += patch_desc[i].src_offset;
+
+		*dst_cpu_addr = temp;
+
+		CAM_DBG(CAM_UTIL,
+			"patch is done for dst %pK with src %pK value %llx",
+			dst_cpu_addr, src_buf_iova_addr,
+			*((uint64_t *)dst_cpu_addr));
+		cam_mem_put_cpu_buf((int32_t)patch_desc[i].dst_buf_hdl);
+	}
+
+	return rc;
+}
+
+int cam_packet_util_process_generic_cmd_buffer(
+	struct cam_cmd_buf_desc *cmd_buf,
+	cam_packet_generic_blob_handler blob_handler_cb, void *user_data)
+{
+	int       rc = 0;
+	uintptr_t  cpu_addr = 0;
+	size_t    buf_size;
+	size_t    remain_len = 0;
+	uint32_t *blob_ptr;
+	uint32_t  blob_type, blob_size, blob_block_size, len_read;
+
+	if (!cmd_buf || !blob_handler_cb) {
+		CAM_ERR(CAM_UTIL, "Invalid args %pK %pK",
+			cmd_buf, blob_handler_cb);
+		return -EINVAL;
+	}
+
+	if (!cmd_buf->length || !cmd_buf->size) {
+		CAM_ERR(CAM_UTIL, "Invalid cmd buf size %d %d",
+			cmd_buf->length, cmd_buf->size);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(cmd_buf->mem_handle, &cpu_addr, &buf_size);
+	if (rc || !cpu_addr || (buf_size == 0)) {
+		CAM_ERR(CAM_UTIL, "Failed in Get cpu addr, rc=%d, cpu_addr=%pK",
+			rc, (void *)cpu_addr);
+		return rc;
+	}
+
+	remain_len = buf_size;
+	if ((buf_size < sizeof(uint32_t)) ||
+		((size_t)cmd_buf->offset > (buf_size - sizeof(uint32_t)))) {
+		CAM_ERR(CAM_UTIL, "Invalid offset for cmd buf: %zu",
+			(size_t)cmd_buf->offset);
+		rc = -EINVAL;
+		goto end;
+	}
+	remain_len -= (size_t)cmd_buf->offset;
+
+	if (remain_len < (size_t)cmd_buf->length) {
+		CAM_ERR(CAM_UTIL, "Invalid length for cmd buf: %zu",
+			(size_t)cmd_buf->length);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	blob_ptr = (uint32_t *)(((uint8_t *)cpu_addr) +
+		cmd_buf->offset);
+
+	CAM_DBG(CAM_UTIL,
+		"GenericCmdBuffer cpuaddr=%pK, blobptr=%pK, len=%d",
+		(void *)cpu_addr, (void *)blob_ptr, cmd_buf->length);
+
+	len_read = 0;
+	while (len_read < cmd_buf->length) {
+		blob_type =
+			((*blob_ptr) & CAM_GENERIC_BLOB_CMDBUFFER_TYPE_MASK) >>
+			CAM_GENERIC_BLOB_CMDBUFFER_TYPE_SHIFT;
+		blob_size =
+			((*blob_ptr) & CAM_GENERIC_BLOB_CMDBUFFER_SIZE_MASK) >>
+			CAM_GENERIC_BLOB_CMDBUFFER_SIZE_SHIFT;
+
+		blob_block_size = sizeof(uint32_t) +
+			(((blob_size + sizeof(uint32_t) - 1) /
+			sizeof(uint32_t)) * sizeof(uint32_t));
+
+		CAM_DBG(CAM_UTIL,
+			"Blob type=%d size=%d block_size=%d len_read=%d total=%d",
+			blob_type, blob_size, blob_block_size, len_read,
+			cmd_buf->length);
+
+		if (len_read + blob_block_size > cmd_buf->length) {
+			CAM_ERR(CAM_UTIL, "Invalid Blob %d %d %d %d",
+				blob_type, blob_size, len_read,
+				cmd_buf->length);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		len_read += blob_block_size;
+
+		rc = blob_handler_cb(user_data, blob_type, blob_size,
+			(uint8_t *)(blob_ptr + 1));
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Error in handling blob type %d %d",
+				blob_type, blob_size);
+			goto end;
+		}
+
+		blob_ptr += (blob_block_size / sizeof(uint32_t));
+	}
+
+end:
+	cam_mem_put_cpu_buf(cmd_buf->mem_handle);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_packet_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_packet_util.h
@@ -0,0 +1,140 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_PACKET_UTIL_H_
+#define _CAM_PACKET_UTIL_H_
+
+#include <media/cam_defs.h>
+
+/**
+ * @brief                  KMD scratch buffer information
+ *
+ * @handle:                Memory handle
+ * @cpu_addr:              Cpu address
+ * @offset:                Offset from the start of the buffer
+ * @size:                  Size of the buffer
+ * @used_bytes:            Used memory in bytes
+ *
+ */
+struct cam_kmd_buf_info {
+	int        handle;
+	uint32_t  *cpu_addr;
+	uint32_t   offset;
+	uint32_t   size;
+	uint32_t   used_bytes;
+};
+
+/* Generic Cmd Buffer blob callback function type */
+typedef int (*cam_packet_generic_blob_handler)(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data);
+
+/**
+ * cam_packet_util_get_cmd_mem_addr()
+ *
+ * @brief                  Get command buffer address
+ *
+ * @handle:                Command buffer memory handle
+ * @buf_addr:              Command buffer cpu mapped address
+ * @len:                   Command buffer length
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_packet_util_get_cmd_mem_addr(int handle, uint32_t **buf_addr,
+	size_t *len);
+
+/**
+ * cam_packet_util_validate_packet()
+ *
+ * @brief                  Validate the packet
+ *
+ * @packet:                Packet to be validated
+ *
+ * @remain_len:            CPU buff length after config offset
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_packet_util_validate_packet(struct cam_packet *packet,
+	size_t remain_len);
+
+/**
+ * cam_packet_util_validate_cmd_desc()
+ *
+ * @brief                  Validate the packet
+ *
+ * @cmd_desc:              Command descriptor to be validated
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_packet_util_validate_cmd_desc(struct cam_cmd_buf_desc *cmd_desc);
+
+/**
+ * cam_packet_util_get_kmd_buffer()
+ *
+ * @brief                  Get the kmd buffer from the packet command descriptor
+ *
+ * @packet:                Packet data
+ * @kmd_buf:               Extracted the KMD buffer information
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_packet_util_get_kmd_buffer(struct cam_packet *packet,
+	struct cam_kmd_buf_info *kmd_buf_info);
+
+/**
+ * cam_packet_dump_patch_info()
+ *
+ * @brief:              Dump patch info in case of page fault
+ *
+ * @packet:             Input packet containing Command Buffers and Patches
+ * @iommu_hdl:          IOMMU handle of the HW Device that received the packet
+ * @sec_iommu_hdl:      Secure IOMMU handle of the HW Device that
+ *                      received the packet
+ *
+ */
+void cam_packet_dump_patch_info(struct cam_packet *packet,
+	int32_t iommu_hdl, int32_t sec_mmu_hdl);
+
+/**
+ * cam_packet_util_process_patches()
+ *
+ * @brief:              Replace the handle in Packet to Address using the
+ *                      information from patches.
+ *
+ * @packet:             Input packet containing Command Buffers and Patches
+ * @iommu_hdl:          IOMMU handle of the HW Device that received the packet
+ * @sec_iommu_hdl:      Secure IOMMU handle of the HW Device that
+ *                      received the packet
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_packet_util_process_patches(struct cam_packet *packet,
+	int32_t iommu_hdl, int32_t sec_mmu_hdl);
+
+/**
+ * cam_packet_util_process_generic_cmd_buffer()
+ *
+ * @brief:              Process Generic Blob command buffer. This utility
+ *                      function process the command buffer and calls the
+ *                      blob_handle_cb callback for each blob that exists
+ *                      in the command buffer.
+ *
+ * @cmd_buf:            Generic Blob Cmd Buffer handle
+ * @blob_handler_cb:    Callback pointer to call for each blob exists in the
+ *                      command buffer
+ * @user_data:          User data to be passed while callback
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_packet_util_process_generic_cmd_buffer(
+	struct cam_cmd_buf_desc *cmd_buf,
+	cam_packet_generic_blob_handler blob_handler_cb, void *user_data);
+
+#endif /* _CAM_PACKET_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_soc_bus.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_soc_bus.c
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/msm-bus.h>
+#include "cam_soc_bus.h"
+
+/**
+ * struct cam_soc_bus_client_data : Bus client data
+ *
+ * @pdata: Bus pdata information
+ * @client_id: Bus client id
+ * @num_paths: Number of paths for this client
+ * @curr_vote_level: current voted index
+ * @dyn_vote: whether dynamic voting enabled
+ */
+struct cam_soc_bus_client_data {
+	struct msm_bus_scale_pdata *pdata;
+	uint32_t client_id;
+	int num_paths;
+	unsigned int curr_vote_level;
+	bool dyn_vote;
+};
+
+int cam_soc_bus_client_update_request(void *client, unsigned int idx)
+{
+	int rc = 0;
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) client;
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+
+	if (bus_client_data->dyn_vote) {
+		CAM_ERR(CAM_UTIL,
+			"Dyn update not allowed client[%d][%s], dyn_vote: %d",
+			bus_client_data->client_id,
+			bus_client->common_data->name,
+			bus_client_data->dyn_vote);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (idx >= bus_client->common_data->num_usecases) {
+		CAM_ERR(CAM_UTIL, "Invalid vote level=%d, usecases=%d", idx,
+			bus_client->common_data->num_usecases);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_PERF, "Bus client=[%d][%s] index[%d]",
+		bus_client_data->client_id, bus_client->common_data->name, idx);
+
+	rc = msm_bus_scale_client_update_request(bus_client_data->client_id,
+		idx);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Update request failed, client[%d][%s], idx: %d",
+			bus_client_data->client_id,
+			bus_client->common_data->name, idx);
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+int cam_soc_bus_client_update_bw(void *client, uint64_t ab, uint64_t ib)
+{
+	int idx = 0;
+	struct msm_bus_paths *path;
+	struct msm_bus_scale_pdata *pdata;
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) client;
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+	int rc = 0;
+
+	if ((bus_client->common_data->num_usecases != 2) ||
+		(bus_client_data->num_paths != 1) ||
+		(!bus_client_data->dyn_vote)) {
+		CAM_ERR(CAM_UTIL,
+			"dynamic update not allowed Bus client=[%d][%s], %d %d %d",
+			bus_client_data->client_id,
+			bus_client->common_data->name,
+			bus_client->common_data->num_usecases,
+			bus_client_data->num_paths,
+			bus_client_data->dyn_vote);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	idx = bus_client_data->curr_vote_level;
+	idx = 1 - idx;
+	bus_client_data->curr_vote_level = idx;
+
+	pdata = bus_client_data->pdata;
+	path = &(pdata->usecase[idx]);
+	path->vectors[0].ab = ab;
+	path->vectors[0].ib = ib;
+
+	CAM_DBG(CAM_PERF, "Bus client=[%d][%s] :ab[%llu] ib[%llu], index[%d]",
+		bus_client_data->client_id, bus_client->common_data->name, ab,
+		ib, idx);
+	rc = msm_bus_scale_client_update_request(bus_client_data->client_id,
+		idx);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Update request failed, client[%d][%s], idx: %d",
+			bus_client_data->client_id,
+			bus_client->common_data->name, idx);
+		return rc;
+	}
+
+end:
+	return rc;
+}
+
+int cam_soc_bus_client_register(struct platform_device *pdev,
+	struct device_node *dev_node, void **client,
+	struct cam_soc_bus_client_common_data *common_data)
+{
+	struct msm_bus_scale_pdata *pdata = NULL;
+	struct cam_soc_bus_client *bus_client = NULL;
+	struct cam_soc_bus_client_data *bus_client_data = NULL;
+	uint32_t client_id;
+	int rc;
+
+	bus_client = kzalloc(sizeof(struct cam_soc_bus_client), GFP_KERNEL);
+	if (!bus_client) {
+		CAM_ERR(CAM_UTIL, "Non Enought Memroy");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	*client = bus_client;
+
+	bus_client_data = kzalloc(sizeof(struct cam_soc_bus_client_data),
+		GFP_KERNEL);
+	if (!bus_client_data) {
+		kfree(bus_client);
+		*client = NULL;
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_client->client_data = bus_client_data;
+	pdata = msm_bus_pdata_from_node(pdev,
+		dev_node);
+	if (!pdata) {
+		CAM_ERR(CAM_UTIL, "failed get_pdata");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	if ((pdata->num_usecases == 0) ||
+		(pdata->usecase[0].num_paths == 0)) {
+		CAM_ERR(CAM_UTIL, "usecase=%d", pdata->num_usecases);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	client_id = msm_bus_scale_register_client(pdata);
+	if (!client_id) {
+		CAM_ERR(CAM_UTIL, "failed in register bus client_data");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	bus_client->common_data = common_data;
+
+	bus_client_data->dyn_vote = of_property_read_bool(dev_node,
+		"qcom,msm-bus-vector-dyn-vote");
+
+	if (bus_client_data->dyn_vote && (pdata->num_usecases != 2)) {
+		CAM_ERR(CAM_UTIL, "Excess or less vectors %d",
+			pdata->num_usecases);
+		rc = -EINVAL;
+		goto fail_unregister_client;
+	}
+
+	rc = msm_bus_scale_client_update_request(client_id, 0);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Bus client update request failed, rc = %d",
+			rc);
+		goto fail_unregister_client;
+	}
+
+	bus_client->common_data->src_id = pdata->usecase[0].vectors[0].src;
+	bus_client->common_data->dst_id = pdata->usecase[0].vectors[0].dst;
+	bus_client_data->pdata = pdata;
+	bus_client_data->client_id = client_id;
+	bus_client->common_data->num_usecases = pdata->num_usecases;
+	bus_client_data->num_paths = pdata->usecase[0].num_paths;
+	bus_client->common_data->name = pdata->name;
+
+	CAM_DBG(CAM_PERF, "Register Bus Client=[%d][%s] : src=%d, dst=%d",
+		bus_client_data->client_id, bus_client->common_data->name,
+		bus_client->common_data->src_id,
+		bus_client->common_data->dst_id);
+
+	return 0;
+fail_unregister_client:
+	msm_bus_scale_unregister_client(bus_client_data->client_id);
+error:
+	kfree(bus_client_data);
+	bus_client->client_data = NULL;
+	kfree(bus_client);
+	*client = NULL;
+end:
+	return rc;
+
+}
+
+void cam_soc_bus_client_unregister(void **client)
+{
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) (*client);
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+
+	if (bus_client_data->dyn_vote)
+		cam_soc_bus_client_update_bw(bus_client, 0, 0);
+	else
+		cam_soc_bus_client_update_request(bus_client, 0);
+
+	msm_bus_scale_unregister_client(bus_client_data->client_id);
+	kfree(bus_client_data);
+	bus_client->client_data = NULL;
+	kfree(bus_client);
+	*client = NULL;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_soc_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_soc_util.c
@@ -0,0 +1,2847 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/clk.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <linux/pm_domain.h>
+#include <linux/pm_runtime.h>
+#include <linux/pm_opp.h>
+#include <linux/pinctrl/consumer.h>
+#include "cam_soc_util.h"
+#include "cam_debug_util.h"
+#include "cam_cx_ipeak.h"
+#include "cam_mem_mgr.h"
+#include "cam_compat.h"
+
+static char supported_clk_info[256];
+
+int cam_soc_util_get_clk_level(struct cam_hw_soc_info *soc_info,
+	int64_t clk_rate, int clk_idx, int32_t *clk_lvl)
+{
+	int i;
+	long clk_rate_round;
+
+	if (!soc_info || (clk_idx < 0) || (clk_idx >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "Invalid src_clk_idx: %d", clk_idx);
+		*clk_lvl = -1;
+		return -EINVAL;
+	}
+
+	clk_rate_round = clk_round_rate(soc_info->clk[clk_idx], clk_rate);
+	if (clk_rate_round < 0) {
+		CAM_ERR(CAM_UTIL, "round failed rc = %ld",
+			clk_rate_round);
+		*clk_lvl = -1;
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_MAX_VOTE; i++) {
+		if ((soc_info->clk_level_valid[i]) &&
+			(soc_info->clk_rate[i][clk_idx] >=
+			clk_rate_round)) {
+			CAM_DBG(CAM_UTIL,
+				"soc = %d round rate = %ld actual = %lld",
+				soc_info->clk_rate[i][clk_idx],
+				clk_rate_round, clk_rate);
+			*clk_lvl = i;
+			return 0;
+		}
+	}
+
+	CAM_WARN(CAM_UTIL, "Invalid clock rate %ld", clk_rate_round);
+	*clk_lvl = -1;
+	return -EINVAL;
+}
+
+/**
+ * cam_soc_util_get_string_from_level()
+ *
+ * @brief:     Returns the string for a given clk level
+ *
+ * @level:     Clock level
+ *
+ * @return:    String corresponding to the clk level
+ */
+static const char *cam_soc_util_get_string_from_level(
+	enum cam_vote_level level)
+{
+	switch (level) {
+	case CAM_SUSPEND_VOTE:
+		return "";
+	case CAM_MINSVS_VOTE:
+		return "MINSVS[1]";
+	case CAM_LOWSVS_VOTE:
+		return "LOWSVS[2]";
+	case CAM_SVS_VOTE:
+		return "SVS[3]";
+	case CAM_SVSL1_VOTE:
+		return "SVSL1[4]";
+	case CAM_NOMINAL_VOTE:
+		return "NOM[5]";
+	case CAM_NOMINALL1_VOTE:
+		return "NOML1[6]";
+	case CAM_TURBO_VOTE:
+		return "TURBO[7]";
+	default:
+		return "";
+	}
+}
+
+/**
+ * cam_soc_util_get_supported_clk_levels()
+ *
+ * @brief:      Returns the string of all the supported clk levels for
+ *              the given device
+ *
+ * @soc_info:   Device soc information
+ *
+ * @return:     String containing all supported clk levels
+ */
+static const char *cam_soc_util_get_supported_clk_levels(
+	struct cam_hw_soc_info *soc_info)
+{
+	int i = 0;
+
+	memset(supported_clk_info, 0, sizeof(supported_clk_info));
+	strlcat(supported_clk_info, "Supported levels: ",
+		sizeof(supported_clk_info));
+
+	for (i = 0; i < CAM_MAX_VOTE; i++) {
+		if (soc_info->clk_level_valid[i] == true) {
+			strlcat(supported_clk_info,
+				cam_soc_util_get_string_from_level(i),
+				sizeof(supported_clk_info));
+			strlcat(supported_clk_info, " ",
+				sizeof(supported_clk_info));
+		}
+	}
+
+	strlcat(supported_clk_info, "\n", sizeof(supported_clk_info));
+	return supported_clk_info;
+}
+
+static int cam_soc_util_clk_lvl_options_open(struct inode *inode,
+	struct file *file)
+{
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+static ssize_t cam_soc_util_clk_lvl_options_read(struct file *file,
+	char __user *clk_info, size_t size_t, loff_t *loff_t)
+{
+	struct cam_hw_soc_info *soc_info =
+		(struct cam_hw_soc_info *)file->private_data;
+	const char *display_string =
+		cam_soc_util_get_supported_clk_levels(soc_info);
+
+	return simple_read_from_buffer(clk_info, size_t, loff_t, display_string,
+		strlen(display_string));
+}
+
+static const struct file_operations cam_soc_util_clk_lvl_options = {
+	.open = cam_soc_util_clk_lvl_options_open,
+	.read = cam_soc_util_clk_lvl_options_read,
+};
+
+static int cam_soc_util_set_clk_lvl(void *data, u64 val)
+{
+	struct cam_hw_soc_info *soc_info = (struct cam_hw_soc_info *)data;
+
+	if (val <= CAM_SUSPEND_VOTE || val >= CAM_MAX_VOTE)
+		return 0;
+
+	if (soc_info->clk_level_valid[val] == true)
+		soc_info->clk_level_override = val;
+	else
+		soc_info->clk_level_override = 0;
+
+	return 0;
+}
+
+static int cam_soc_util_get_clk_lvl(void *data, u64 *val)
+{
+	struct cam_hw_soc_info *soc_info = (struct cam_hw_soc_info *)data;
+
+	*val = soc_info->clk_level_override;
+
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cam_soc_util_clk_lvl_control,
+	cam_soc_util_get_clk_lvl, cam_soc_util_set_clk_lvl, "%08llu");
+
+/**
+ * cam_soc_util_create_clk_lvl_debugfs()
+ *
+ * @brief:      Creates debugfs files to view/control device clk rates
+ *
+ * @soc_info:   Device soc information
+ *
+ * @return:     Success or failure
+ */
+static int cam_soc_util_create_clk_lvl_debugfs(struct cam_hw_soc_info *soc_info)
+{
+	char debugfs_dir_name[64];
+	int rc = 0;
+	struct dentry *dbgfileptr = NULL;
+
+	if (!soc_info->dentry) {
+		CAM_DBG(CAM_UTIL, "Debugfs entry for %s already exist",
+			soc_info->dev_name);
+		goto end;
+	}
+
+	memset(debugfs_dir_name, 0, sizeof(debugfs_dir_name));
+	strlcat(debugfs_dir_name, "clk_dir_", sizeof(debugfs_dir_name));
+	strlcat(debugfs_dir_name, soc_info->dev_name, sizeof(debugfs_dir_name));
+
+	dbgfileptr = debugfs_create_dir(debugfs_dir_name, NULL);
+	if (!dbgfileptr) {
+		CAM_ERR(CAM_UTIL,"DebugFS could not create directory!");
+		rc = -ENOENT;
+		goto end;
+	}
+	/* Store parent inode for cleanup in caller */
+	soc_info->dentry = dbgfileptr;
+
+	debugfs_create_file("clk_lvl_options", 0444,
+		soc_info->dentry, soc_info, &cam_soc_util_clk_lvl_options);
+	debugfs_create_file("clk_lvl_control", 0644,
+		soc_info->dentry, soc_info, &cam_soc_util_clk_lvl_control);
+
+end:
+	return rc;
+}
+
+/**
+ * cam_soc_util_remove_clk_lvl_debugfs()
+ *
+ * @brief:      Removes the debugfs files used to view/control
+ *              device clk rates
+ *
+ * @soc_info:   Device soc information
+ *
+ */
+static void cam_soc_util_remove_clk_lvl_debugfs(
+	struct cam_hw_soc_info *soc_info)
+{
+	debugfs_remove_recursive(soc_info->dentry);
+}
+
+int cam_soc_util_get_level_from_string(const char *string,
+	enum cam_vote_level *level)
+{
+	if (!level)
+		return -EINVAL;
+
+	if (!strcmp(string, "suspend")) {
+		*level = CAM_SUSPEND_VOTE;
+	} else if (!strcmp(string, "minsvs")) {
+		*level = CAM_MINSVS_VOTE;
+	} else if (!strcmp(string, "lowsvs")) {
+		*level = CAM_LOWSVS_VOTE;
+	} else if (!strcmp(string, "svs")) {
+		*level = CAM_SVS_VOTE;
+	} else if (!strcmp(string, "svs_l1")) {
+		*level = CAM_SVSL1_VOTE;
+	} else if (!strcmp(string, "nominal")) {
+		*level = CAM_NOMINAL_VOTE;
+	} else if (!strcmp(string, "nominal_l1")) {
+		*level = CAM_NOMINALL1_VOTE;
+	} else if (!strcmp(string, "turbo")) {
+		*level = CAM_TURBO_VOTE;
+	} else {
+		CAM_ERR(CAM_UTIL, "Invalid string %s", string);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * cam_soc_util_get_clk_level_to_apply()
+ *
+ * @brief:              Get the clock level to apply. If the requested level
+ *                      is not valid, bump the level to next available valid
+ *                      level. If no higher level found, return failure.
+ *
+ * @soc_info:           Device soc struct to be populated
+ * @req_level:          Requested level
+ * @apply_level         Level to apply
+ *
+ * @return:             success or failure
+ */
+static int cam_soc_util_get_clk_level_to_apply(
+	struct cam_hw_soc_info *soc_info, enum cam_vote_level req_level,
+	enum cam_vote_level *apply_level)
+{
+	if (req_level >= CAM_MAX_VOTE) {
+		CAM_ERR(CAM_UTIL, "Invalid clock level parameter %d",
+			req_level);
+		return -EINVAL;
+	}
+
+	if (soc_info->clk_level_valid[req_level] == true) {
+		*apply_level = req_level;
+	} else {
+		int i;
+
+		for (i = (req_level + 1); i < CAM_MAX_VOTE; i++)
+			if (soc_info->clk_level_valid[i] == true) {
+				*apply_level = i;
+				break;
+			}
+
+		if (i == CAM_MAX_VOTE) {
+			CAM_ERR(CAM_UTIL,
+				"No valid clock level found to apply, req=%d",
+				req_level);
+			return -EINVAL;
+		}
+	}
+
+	CAM_DBG(CAM_UTIL, "Req level %d, Applying %d",
+		req_level, *apply_level);
+
+	return 0;
+}
+
+unsigned long cam_soc_util_get_clk_rate_applied(
+	struct cam_hw_soc_info *soc_info, int32_t index, bool is_src,
+	enum cam_vote_level clk_level)
+{
+	unsigned long clk_rate = 0;
+	struct clk *clk = NULL;
+	int rc = 0;
+	enum cam_vote_level apply_level;
+
+	if (is_src) {
+		clk = soc_info->clk[index];
+		clk_rate = clk_get_rate(clk);
+	}
+	else {
+		rc = cam_soc_util_get_clk_level_to_apply(soc_info, clk_level,
+			&apply_level);
+		if (rc)
+			return rc;
+		if(soc_info->clk_rate[apply_level][index] > 0) {
+				clk = soc_info->clk[index];
+				clk_rate = clk_get_rate(clk);
+		}
+	}
+	return clk_rate;
+}
+
+int cam_soc_util_irq_enable(struct cam_hw_soc_info *soc_info)
+{
+	if (!soc_info) {
+		CAM_ERR(CAM_UTIL, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (soc_info->irq_num < 0) {
+		CAM_ERR(CAM_UTIL, "No IRQ line available");
+		return -ENODEV;
+	}
+
+	enable_irq(soc_info->irq_num);
+
+	return 0;
+}
+
+int cam_soc_util_irq_disable(struct cam_hw_soc_info *soc_info)
+{
+	if (!soc_info) {
+		CAM_ERR(CAM_UTIL, "Invalid arguments");
+		return -EINVAL;
+	}
+
+	if (soc_info->irq_num < 0) {
+		CAM_ERR(CAM_UTIL, "No IRQ line available");
+		return -ENODEV;
+	}
+
+	disable_irq(soc_info->irq_num);
+
+	return 0;
+}
+
+int cam_soc_util_get_clk_rate(struct clk *clk, const char *clk_name,
+	uint32_t *clk_rate)
+{
+	uint32_t clk_rate_round;
+
+	clk_rate_round = clk_get_rate(clk);
+	if (clk_rate_round < 0) {
+		CAM_ERR(CAM_UTIL, "get_rate failed on %s", clk_name);
+		return clk_rate_round;
+	}
+
+	*clk_rate = clk_rate_round;
+	CAM_DBG(CAM_UTIL, "get rate %lld on %s", *clk_rate, clk_name);
+
+	return 0;
+}
+
+long cam_soc_util_get_clk_round_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_index, unsigned long clk_rate)
+{
+	if (!soc_info || (clk_index >= soc_info->num_clk) || (clk_rate == 0)) {
+		CAM_ERR(CAM_UTIL, "Invalid input params %pK, %d %lu",
+			soc_info, clk_index, clk_rate);
+		return clk_rate;
+	}
+
+	return clk_round_rate(soc_info->clk[clk_index], clk_rate);
+}
+
+/**
+ * cam_soc_util_set_clk_rate()
+ *
+ * @brief:            Sets the given rate for the clk requested for
+ *
+ * @clk:              Clock structure information for which rate is to be set
+ * @clk_name:         Name of the clock for which rate is being set
+ * @clk_rate:         Clock rate to be set
+ * @applied_clk_rate: Final clock rate set to the clk
+ *
+ * @return:         Success or failure
+ */
+static int cam_soc_util_set_clk_rate(struct clk *clk, const char *clk_name,
+	int64_t clk_rate, unsigned long *applied_clk_rate)
+{
+	int rc = 0;
+	long clk_rate_round = -1;
+
+	if (!clk || !clk_name)
+		return -EINVAL;
+
+	CAM_DBG(CAM_UTIL, "set %s, rate %lld", clk_name, clk_rate);
+	if (clk_rate > 0) {
+		clk_rate_round = clk_round_rate(clk, clk_rate);
+		CAM_DBG(CAM_UTIL, "new_rate %ld", clk_rate_round);
+		if (clk_rate_round < 0) {
+			CAM_ERR(CAM_UTIL, "round failed for clock %s rc = %ld",
+				clk_name, clk_rate_round);
+			return clk_rate_round;
+		}
+		rc = clk_set_rate(clk, clk_rate_round);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "set_rate failed on %s", clk_name);
+			return rc;
+		}
+	} else if (clk_rate == INIT_RATE) {
+		clk_rate_round = clk_get_rate(clk);
+		CAM_DBG(CAM_UTIL, "init new_rate %ld", clk_rate_round);
+		if (clk_rate_round == 0) {
+			clk_rate_round = clk_round_rate(clk, 0);
+			if (clk_rate_round <= 0) {
+				CAM_ERR(CAM_UTIL, "round rate failed on %s",
+					clk_name);
+				return clk_rate_round;
+			}
+		}
+		rc = clk_set_rate(clk, clk_rate_round);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "set_rate failed on %s", clk_name);
+			return rc;
+		}
+	}
+
+	if (applied_clk_rate)
+		*applied_clk_rate = clk_rate_round;
+
+	return rc;
+}
+
+int cam_soc_util_set_src_clk_rate(struct cam_hw_soc_info *soc_info,
+	int64_t clk_rate)
+{
+	int rc = 0;
+	int i = 0;
+	int32_t src_clk_idx;
+	int32_t scl_clk_idx;
+	struct clk *clk = NULL;
+	int32_t apply_level;
+	uint32_t clk_level_override = 0;
+
+	if (!soc_info || (soc_info->src_clk_idx < 0) ||
+		(soc_info->src_clk_idx >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "Invalid src_clk_idx: %d",
+			soc_info ? soc_info->src_clk_idx : -1);
+		return -EINVAL;
+	}
+
+	src_clk_idx = soc_info->src_clk_idx;
+	clk_level_override = soc_info->clk_level_override;
+	if (clk_level_override && clk_rate)
+		clk_rate =
+			soc_info->clk_rate[clk_level_override][src_clk_idx];
+
+	clk = soc_info->clk[src_clk_idx];
+	rc = cam_soc_util_get_clk_level(soc_info, clk_rate, src_clk_idx,
+		&apply_level);
+	if (rc || (apply_level < 0) || (apply_level >= CAM_MAX_VOTE)) {
+		CAM_ERR(CAM_UTIL,
+			"set %s, rate %lld dev_name = %s apply level = %d",
+			soc_info->clk_name[src_clk_idx], clk_rate,
+			soc_info->dev_name, apply_level);
+			return -EINVAL;
+	}
+
+	CAM_DBG(CAM_UTIL, "set %s, rate %lld dev_name = %s apply level = %d",
+		soc_info->clk_name[src_clk_idx], clk_rate,
+		soc_info->dev_name, apply_level);
+
+	if ((soc_info->cam_cx_ipeak_enable) && (clk_rate >= 0)) {
+		cam_cx_ipeak_update_vote_cx_ipeak(soc_info,
+			apply_level);
+	}
+
+	rc = dev_pm_opp_set_rate(soc_info->dev,
+			  soc_info->clk_rate[apply_level][soc_info->src_clk_idx]);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Unable to set operating point for dev %s clk_name %s rc %d",
+			soc_info->dev_name, soc_info->clk_name[soc_info->src_clk_idx],
+			rc);
+		return rc;
+	}
+
+	rc = cam_soc_util_set_clk_rate(clk,
+		soc_info->clk_name[src_clk_idx], clk_rate,
+		&soc_info->applied_src_clk_rate);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"SET_RATE Failed: src clk: %s, rate %lld, dev_name = %s rc: %d",
+			soc_info->clk_name[src_clk_idx], clk_rate,
+			soc_info->dev_name, rc);
+		return rc;
+	}
+
+	/* set clk rate for scalable clk if available */
+
+	for (i = 0; i < soc_info->scl_clk_count; i++) {
+		scl_clk_idx = soc_info->scl_clk_idx[i];
+		if (scl_clk_idx < 0) {
+			CAM_DBG(CAM_UTIL, "Scl clk index invalid");
+			continue;
+		}
+		clk = soc_info->clk[scl_clk_idx];
+		rc = cam_soc_util_set_clk_rate(clk,
+			soc_info->clk_name[scl_clk_idx],
+			soc_info->clk_rate[apply_level][scl_clk_idx],
+			NULL);
+		if (rc) {
+			CAM_WARN(CAM_UTIL,
+			"SET_RATE Failed: scl clk: %s, rate %d dev_name = %s, rc: %d",
+			soc_info->clk_name[scl_clk_idx],
+			soc_info->clk_rate[apply_level][scl_clk_idx],
+			soc_info->dev_name, rc);
+		}
+	}
+
+	return 0;
+}
+
+int cam_soc_util_clk_put(struct clk **clk)
+{
+	if (!(*clk)) {
+		CAM_ERR(CAM_UTIL, "Invalid params clk");
+		return -EINVAL;
+	}
+
+	clk_put(*clk);
+	*clk = NULL;
+
+	return 0;
+}
+
+static struct clk *cam_soc_util_option_clk_get(struct device_node *np,
+	int index)
+{
+	struct of_phandle_args clkspec;
+	struct clk *clk;
+	int rc;
+
+	if (index < 0)
+		return ERR_PTR(-EINVAL);
+
+	rc = of_parse_phandle_with_args(np, "clocks-option", "#clock-cells",
+		index, &clkspec);
+	if (rc)
+		return ERR_PTR(rc);
+
+	clk = of_clk_get_from_provider(&clkspec);
+	of_node_put(clkspec.np);
+
+	return clk;
+}
+
+int cam_soc_util_get_option_clk_by_name(struct cam_hw_soc_info *soc_info,
+	const char *clk_name, struct clk **clk, int32_t *clk_index,
+	int32_t *clk_rate)
+{
+	int index = 0;
+	int rc = 0;
+	struct device_node *of_node = NULL;
+
+	if (!soc_info || !clk_name || !clk) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid params soc_info %pK clk_name %s clk %pK",
+			soc_info, clk_name, clk);
+		return -EINVAL;
+	}
+
+	of_node = soc_info->dev->of_node;
+
+	index = of_property_match_string(of_node, "clock-names-option",
+		clk_name);
+	if (index < 0) {
+		CAM_DBG(CAM_UTIL, "No clk data for %s", clk_name);
+		*clk_index = -1;
+		*clk = ERR_PTR(-EINVAL);
+		return -EINVAL;
+	}
+
+	*clk = cam_soc_util_option_clk_get(of_node, index);
+	if (IS_ERR(*clk)) {
+		CAM_ERR(CAM_UTIL, "No clk named %s found. Dev %s", clk_name,
+			soc_info->dev_name);
+		*clk_index = -1;
+		*clk = NULL;
+		return -EFAULT;
+	}
+	*clk_index = index;
+
+	rc = of_property_read_u32_index(of_node, "clock-rates-option",
+		index, clk_rate);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Error reading clock-rates clk_name %s index %d",
+			clk_name, index);
+		cam_soc_util_clk_put(clk);
+		*clk_rate = 0;
+		return rc;
+	}
+
+	/*
+	 * Option clocks are assumed to be available to single Device here.
+	 * Hence use INIT_RATE instead of NO_SET_RATE.
+	 */
+	*clk_rate = (*clk_rate == 0) ? (int32_t)INIT_RATE : *clk_rate;
+
+	CAM_DBG(CAM_UTIL, "clk_name %s index %d clk_rate %d",
+		clk_name, *clk_index, *clk_rate);
+
+	return 0;
+}
+
+int cam_soc_util_clk_enable(struct clk *clk, const char *clk_name,
+	int32_t clk_rate, unsigned long *applied_clock_rate)
+{
+	int rc = 0;
+
+	if (!clk || !clk_name)
+		return -EINVAL;
+
+	rc = cam_soc_util_set_clk_rate(clk, clk_name, clk_rate,
+		applied_clock_rate);
+	if (rc)
+		return rc;
+
+	rc = clk_prepare_enable(clk);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "enable failed for %s: rc(%d)", clk_name, rc);
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_soc_util_clk_disable(struct clk *clk, const char *clk_name)
+{
+	if (!clk || !clk_name)
+		return -EINVAL;
+
+	CAM_DBG(CAM_UTIL, "disable %s", clk_name);
+	clk_disable_unprepare(clk);
+
+	return 0;
+}
+
+/**
+ * cam_soc_util_clk_enable_default()
+ *
+ * @brief:              This function enables the default clocks present
+ *                      in soc_info
+ *
+ * @soc_info:           Device soc struct to be populated
+ * @clk_level:          Clk level to apply while enabling
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_clk_enable_default(struct cam_hw_soc_info *soc_info,
+	enum cam_vote_level clk_level)
+{
+	int                          i, rc = 0;
+	enum cam_vote_level          apply_level;
+	unsigned long                applied_clk_rate;
+
+	if ((soc_info->num_clk == 0) ||
+		(soc_info->num_clk >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "Invalid number of clock %d",
+			soc_info->num_clk);
+		return -EINVAL;
+	}
+
+	rc = cam_soc_util_get_clk_level_to_apply(soc_info, clk_level,
+		&apply_level);
+	if (rc)
+		return rc;
+
+	if (soc_info->cam_cx_ipeak_enable)
+		cam_cx_ipeak_update_vote_cx_ipeak(soc_info, apply_level);
+
+	rc = dev_pm_opp_set_rate(soc_info->dev,
+			soc_info->clk_rate[apply_level][soc_info->src_clk_idx]);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Unable to set operating point for dev %s clk_name %s rc %d",
+			soc_info->dev_name, soc_info->clk_name[soc_info->src_clk_idx],
+			rc);
+		return rc;
+	}
+
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		rc = cam_soc_util_clk_enable(soc_info->clk[i],
+			soc_info->clk_name[i],
+			soc_info->clk_rate[apply_level][i],
+			&applied_clk_rate);
+		if (rc)
+			goto clk_disable;
+
+		if (i == soc_info->src_clk_idx)
+			soc_info->applied_src_clk_rate = applied_clk_rate;
+
+		if (soc_info->cam_cx_ipeak_enable) {
+			CAM_DBG(CAM_UTIL,
+			"dev name = %s clk name = %s idx = %d\n"
+			"apply_level = %d clc idx = %d",
+			soc_info->dev_name, soc_info->clk_name[i], i,
+			apply_level, i);
+		}
+
+	}
+
+	return rc;
+
+clk_disable:
+	if (soc_info->cam_cx_ipeak_enable)
+		cam_cx_ipeak_update_vote_cx_ipeak(soc_info, 0);
+	for (i--; i >= 0; i--) {
+		cam_soc_util_clk_disable(soc_info->clk[i],
+			soc_info->clk_name[i]);
+	}
+
+	return rc;
+}
+
+/**
+ * cam_soc_util_clk_disable_default()
+ *
+ * @brief:              This function disables the default clocks present
+ *                      in soc_info
+ *
+ * @soc_info:           device soc struct to be populated
+ *
+ * @return:             success or failure
+ */
+void cam_soc_util_clk_disable_default(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+
+	if (soc_info->num_clk == 0)
+		return;
+
+	if (soc_info->cam_cx_ipeak_enable)
+		cam_cx_ipeak_unvote_cx_ipeak(soc_info);
+
+	dev_pm_opp_set_rate(soc_info->dev, 0);
+	for (i = soc_info->num_clk - 1; i >= 0; i--)
+		cam_soc_util_clk_disable(soc_info->clk[i],
+			soc_info->clk_name[i]);
+}
+
+/**
+ * cam_soc_util_get_dt_clk_info()
+ *
+ * @brief:              Parse the DT and populate the Clock properties
+ *
+ * @soc_info:           device soc struct to be populated
+ * @src_clk_str         name of src clock that has rate control
+ *
+ * @return:             success or failure
+ */
+static int cam_soc_util_get_dt_clk_info(struct cam_hw_soc_info *soc_info)
+{
+	struct device_node *of_node = NULL;
+	int count;
+	int num_clk_rates, num_clk_levels;
+	int i, j, rc;
+	int32_t num_clk_level_strings;
+	const char *src_clk_str = NULL;
+	const char *scl_clk_str = NULL;
+	const char *clk_control_debugfs = NULL;
+	const char *clk_cntl_lvl_string = NULL;
+	enum cam_vote_level level;
+
+	if (!soc_info || !soc_info->dev)
+		return -EINVAL;
+
+	of_node = soc_info->dev->of_node;
+
+	if (!of_property_read_bool(of_node, "use-shared-clk")) {
+		CAM_DBG(CAM_UTIL, "No shared clk parameter defined");
+		soc_info->use_shared_clk = false;
+	} else {
+		soc_info->use_shared_clk = true;
+	}
+
+	count = of_property_count_strings(of_node, "clock-names");
+
+	CAM_DBG(CAM_UTIL, "E: dev_name = %s count = %d",
+		soc_info->dev_name, count);
+	if (count > CAM_SOC_MAX_CLK) {
+		CAM_ERR(CAM_UTIL, "invalid count of clocks, count=%d", count);
+		rc = -EINVAL;
+		return rc;
+	}
+	if (count <= 0) {
+		CAM_DBG(CAM_UTIL, "No clock-names found");
+		count = 0;
+		soc_info->num_clk = count;
+		return 0;
+	}
+	soc_info->num_clk = count;
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node, "clock-names",
+				i, &(soc_info->clk_name[i]));
+		CAM_DBG(CAM_UTIL, "clock-names[%d] = %s",
+			i, soc_info->clk_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"i= %d count= %d reading clock-names failed",
+				i, count);
+			return rc;
+		}
+	}
+
+	num_clk_rates = of_property_count_u32_elems(of_node, "clock-rates");
+	if (num_clk_rates <= 0) {
+		CAM_ERR(CAM_UTIL, "reading clock-rates count failed");
+		return -EINVAL;
+	}
+
+	if ((num_clk_rates % soc_info->num_clk) != 0) {
+		CAM_ERR(CAM_UTIL,
+			"mismatch clk/rates, No of clocks=%d, No of rates=%d",
+			soc_info->num_clk, num_clk_rates);
+		return -EINVAL;
+	}
+
+	num_clk_levels = (num_clk_rates / soc_info->num_clk);
+
+	num_clk_level_strings = of_property_count_strings(of_node,
+		"clock-cntl-level");
+	if (num_clk_level_strings != num_clk_levels) {
+		CAM_ERR(CAM_UTIL,
+			"Mismatch No of levels=%d, No of level string=%d",
+			num_clk_levels, num_clk_level_strings);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_clk_levels; i++) {
+		rc = of_property_read_string_index(of_node,
+			"clock-cntl-level", i, &clk_cntl_lvl_string);
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"Error reading clock-cntl-level, rc=%d", rc);
+			return rc;
+		}
+
+		rc = cam_soc_util_get_level_from_string(clk_cntl_lvl_string,
+			&level);
+		if (rc)
+			return rc;
+
+		CAM_DBG(CAM_UTIL,
+			"[%d] : %s %d", i, clk_cntl_lvl_string, level);
+		soc_info->clk_level_valid[level] = true;
+		for (j = 0; j < soc_info->num_clk; j++) {
+			rc = of_property_read_u32_index(of_node, "clock-rates",
+				((i * soc_info->num_clk) + j),
+				&soc_info->clk_rate[level][j]);
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Error reading clock-rates, rc=%d",
+					rc);
+				return rc;
+			}
+
+			soc_info->clk_rate[level][j] =
+				(soc_info->clk_rate[level][j] == 0) ?
+				(int32_t)NO_SET_RATE :
+				soc_info->clk_rate[level][j];
+
+			CAM_DBG(CAM_UTIL, "soc_info->clk_rate[%d][%d] = %d",
+				level, j,
+				soc_info->clk_rate[level][j]);
+		}
+	}
+
+	soc_info->src_clk_idx = -1;
+	rc = of_property_read_string_index(of_node, "src-clock-name", 0,
+		&src_clk_str);
+	if (rc || !src_clk_str) {
+		CAM_DBG(CAM_UTIL, "No src_clk_str found");
+		rc = 0;
+		goto end;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (strcmp(soc_info->clk_name[i], src_clk_str) == 0) {
+			soc_info->src_clk_idx = i;
+			CAM_DBG(CAM_UTIL, "src clock = %s, index = %d",
+				src_clk_str, i);
+			break;
+		}
+	}
+
+	/* scalable clk info parsing */
+	soc_info->scl_clk_count = 0;
+	soc_info->scl_clk_count = of_property_count_strings(of_node,
+		"scl-clk-names");
+	if ((soc_info->scl_clk_count <= 0) ||
+		(soc_info->scl_clk_count > CAM_SOC_MAX_CLK)) {
+		if (soc_info->scl_clk_count == -EINVAL) {
+			CAM_DBG(CAM_UTIL, "scl_clk_name prop not avialable");
+		} else if ((soc_info->scl_clk_count == -ENODATA) ||
+			(soc_info->scl_clk_count > CAM_SOC_MAX_CLK)) {
+			CAM_ERR(CAM_UTIL, "Invalid scl_clk_count: %d",
+				soc_info->scl_clk_count);
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_UTIL, "Invalid scl_clk count: %d",
+			soc_info->scl_clk_count);
+		soc_info->scl_clk_count = -1;
+	} else {
+		CAM_DBG(CAM_UTIL, "No of scalable clocks: %d",
+			soc_info->scl_clk_count);
+		for (i = 0; i < soc_info->scl_clk_count; i++) {
+			rc = of_property_read_string_index(of_node,
+				"scl-clk-names", i,
+				(const char **)&scl_clk_str);
+			if (rc || !scl_clk_str) {
+				CAM_WARN(CAM_UTIL, "scl_clk_str is NULL");
+				soc_info->scl_clk_idx[i] = -1;
+				continue;
+			}
+			for (j = 0; j < soc_info->num_clk; j++) {
+				if (strnstr(scl_clk_str, soc_info->clk_name[j],
+					strlen(scl_clk_str))) {
+					soc_info->scl_clk_idx[i] = j;
+					CAM_DBG(CAM_UTIL,
+						"scl clock = %s, index = %d",
+						scl_clk_str, j);
+					break;
+				}
+			}
+		}
+	}
+
+	rc = of_property_read_string_index(of_node,
+		"clock-control-debugfs", 0, &clk_control_debugfs);
+	if (rc || !clk_control_debugfs) {
+		CAM_DBG(CAM_UTIL, "No clock_control_debugfs property found");
+		rc = 0;
+		goto end;
+	}
+
+	if (strcmp("true", clk_control_debugfs) == 0)
+		soc_info->clk_control_enable = true;
+
+	CAM_DBG(CAM_UTIL, "X: dev_name = %s count = %d",
+		soc_info->dev_name, count);
+end:
+	return rc;
+}
+
+int cam_soc_util_set_clk_rate_level(struct cam_hw_soc_info *soc_info,
+	enum cam_vote_level clk_level, bool do_not_set_src_clk)
+{
+	int i, rc = 0;
+	enum cam_vote_level apply_level;
+	unsigned long applied_clk_rate;
+
+	if ((soc_info->num_clk == 0) ||
+		(soc_info->num_clk >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "Invalid number of clock %d",
+			soc_info->num_clk);
+		return -EINVAL;
+	}
+
+	rc = cam_soc_util_get_clk_level_to_apply(soc_info, clk_level,
+		&apply_level);
+	if (rc)
+		return rc;
+
+	if (soc_info->cam_cx_ipeak_enable)
+		cam_cx_ipeak_update_vote_cx_ipeak(soc_info, apply_level);
+
+	rc = dev_pm_opp_set_rate(soc_info->dev,
+			  soc_info->clk_rate[apply_level][soc_info->src_clk_idx]);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Unable to set operating point for dev %s clk_name %s rc %d",
+			soc_info->dev_name, soc_info->clk_name[soc_info->src_clk_idx],
+			rc);
+		return rc;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		if (do_not_set_src_clk && (i == soc_info->src_clk_idx)) {
+			CAM_DBG(CAM_UTIL, "Skipping set rate for src clk %s",
+				soc_info->clk_name[i]);
+			continue;
+		}
+
+		CAM_DBG(CAM_UTIL, "Set rate for clk %s rate %d",
+			soc_info->clk_name[i],
+			soc_info->clk_rate[apply_level][i]);
+
+		rc = cam_soc_util_set_clk_rate(soc_info->clk[i],
+			soc_info->clk_name[i],
+			soc_info->clk_rate[apply_level][i],
+			&applied_clk_rate);
+		if (rc < 0) {
+			CAM_DBG(CAM_UTIL,
+				"dev name = %s clk_name = %s idx = %d\n"
+				"apply_level = %d",
+				soc_info->dev_name, soc_info->clk_name[i],
+				i, apply_level);
+			if (soc_info->cam_cx_ipeak_enable)
+				cam_cx_ipeak_update_vote_cx_ipeak(soc_info, 0);
+			break;
+		}
+
+		if (i == soc_info->src_clk_idx)
+			soc_info->applied_src_clk_rate = applied_clk_rate;
+	}
+
+	return rc;
+};
+
+static int cam_soc_util_get_dt_gpio_req_tbl(struct device_node *of_node,
+	struct cam_soc_gpio_data *gconf, uint16_t *gpio_array,
+	uint16_t gpio_array_size)
+{
+	int32_t rc = 0, i = 0;
+	uint32_t count = 0;
+	uint32_t *val_array = NULL;
+
+	if (!of_get_property(of_node, "gpio-req-tbl-num", &count))
+		return 0;
+
+	count /= sizeof(uint32_t);
+	if (!count) {
+		CAM_ERR(CAM_UTIL, "gpio-req-tbl-num 0");
+		return 0;
+	}
+
+	val_array = kcalloc(count, sizeof(uint32_t), GFP_KERNEL);
+	if (!val_array)
+		return -ENOMEM;
+
+	gconf->cam_gpio_req_tbl = kcalloc(count, sizeof(struct gpio),
+		GFP_KERNEL);
+	if (!gconf->cam_gpio_req_tbl) {
+		rc = -ENOMEM;
+		goto free_val_array;
+	}
+	gconf->cam_gpio_req_tbl_size = count;
+
+	rc = of_property_read_u32_array(of_node, "gpio-req-tbl-num",
+		val_array, count);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "failed in reading gpio-req-tbl-num, rc = %d",
+			rc);
+		goto free_gpio_req_tbl;
+	}
+
+	for (i = 0; i < count; i++) {
+		if (val_array[i] >= gpio_array_size) {
+			CAM_ERR(CAM_UTIL, "gpio req tbl index %d invalid",
+				val_array[i]);
+			goto free_gpio_req_tbl;
+		}
+		gconf->cam_gpio_req_tbl[i].gpio = gpio_array[val_array[i]];
+		CAM_DBG(CAM_UTIL, "cam_gpio_req_tbl[%d].gpio = %d", i,
+			gconf->cam_gpio_req_tbl[i].gpio);
+	}
+
+	rc = of_property_read_u32_array(of_node, "gpio-req-tbl-flags",
+		val_array, count);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Failed in gpio-req-tbl-flags, rc %d", rc);
+		goto free_gpio_req_tbl;
+	}
+
+	for (i = 0; i < count; i++) {
+		gconf->cam_gpio_req_tbl[i].flags = val_array[i];
+		CAM_DBG(CAM_UTIL, "cam_gpio_req_tbl[%d].flags = %ld", i,
+			gconf->cam_gpio_req_tbl[i].flags);
+	}
+
+	for (i = 0; i < count; i++) {
+		rc = of_property_read_string_index(of_node,
+			"gpio-req-tbl-label", i,
+			&gconf->cam_gpio_req_tbl[i].label);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Failed rc %d", rc);
+			goto free_gpio_req_tbl;
+		}
+		CAM_DBG(CAM_UTIL, "cam_gpio_req_tbl[%d].label = %s", i,
+			gconf->cam_gpio_req_tbl[i].label);
+	}
+
+	kfree(val_array);
+
+	return rc;
+
+free_gpio_req_tbl:
+	kfree(gconf->cam_gpio_req_tbl);
+free_val_array:
+	kfree(val_array);
+	gconf->cam_gpio_req_tbl_size = 0;
+
+	return rc;
+}
+
+static int cam_soc_util_get_gpio_info(struct cam_hw_soc_info *soc_info)
+{
+	int32_t rc = 0, i = 0;
+	uint16_t *gpio_array = NULL;
+	int16_t gpio_array_size = 0;
+	struct cam_soc_gpio_data *gconf = NULL;
+	struct device_node *of_node = NULL;
+
+	if (!soc_info || !soc_info->dev)
+		return -EINVAL;
+
+	of_node = soc_info->dev->of_node;
+
+	/* Validate input parameters */
+	if (!of_node) {
+		CAM_ERR(CAM_UTIL, "Invalid param of_node");
+		return -EINVAL;
+	}
+
+	gpio_array_size = of_count_phandle_with_args(of_node, "gpios", "#gpio-cells");
+
+	if (gpio_array_size <= 0)
+		return 0;
+
+	CAM_DBG(CAM_UTIL, "gpio count %d", gpio_array_size);
+
+	gpio_array = kcalloc(gpio_array_size, sizeof(uint16_t), GFP_KERNEL);
+	if (!gpio_array)
+		goto free_gpio_conf;
+
+	for (i = 0; i < gpio_array_size; i++) {
+		gpio_array[i] = of_get_named_gpio(of_node, "gpios", i);
+		CAM_DBG(CAM_UTIL, "gpio_array[%d] = %d", i, gpio_array[i]);
+	}
+
+	gconf = kzalloc(sizeof(*gconf), GFP_KERNEL);
+	if (!gconf)
+		return -ENOMEM;
+
+	rc = cam_soc_util_get_dt_gpio_req_tbl(of_node, gconf, gpio_array,
+		gpio_array_size);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "failed in msm_camera_get_dt_gpio_req_tbl");
+		goto free_gpio_array;
+	}
+
+	gconf->cam_gpio_common_tbl = kcalloc(gpio_array_size,
+				sizeof(struct gpio), GFP_KERNEL);
+	if (!gconf->cam_gpio_common_tbl) {
+		rc = -ENOMEM;
+		goto free_gpio_array;
+	}
+
+	for (i = 0; i < gpio_array_size; i++)
+		gconf->cam_gpio_common_tbl[i].gpio = gpio_array[i];
+
+	gconf->cam_gpio_common_tbl_size = gpio_array_size;
+	soc_info->gpio_data = gconf;
+	kfree(gpio_array);
+
+	return rc;
+
+free_gpio_array:
+	kfree(gpio_array);
+free_gpio_conf:
+	kfree(gconf);
+	soc_info->gpio_data = NULL;
+
+	return rc;
+}
+
+static int cam_soc_util_request_gpio_table(
+	struct cam_hw_soc_info *soc_info, bool gpio_en)
+{
+	int rc = 0, i = 0;
+	uint8_t size = 0;
+	struct cam_soc_gpio_data *gpio_conf =
+			soc_info->gpio_data;
+	struct gpio *gpio_tbl = NULL;
+
+
+	if (!gpio_conf) {
+		CAM_DBG(CAM_UTIL, "No GPIO entry");
+		return 0;
+	}
+	if (gpio_conf->cam_gpio_common_tbl_size <= 0) {
+		CAM_ERR(CAM_UTIL, "GPIO table size is invalid");
+		return -EINVAL;
+	}
+	size = gpio_conf->cam_gpio_req_tbl_size;
+	gpio_tbl = gpio_conf->cam_gpio_req_tbl;
+
+	if (!gpio_tbl || !size) {
+		CAM_ERR(CAM_UTIL, "Invalid gpio_tbl %pK / size %d",
+			gpio_tbl, size);
+		return -EINVAL;
+	}
+	for (i = 0; i < size; i++) {
+		CAM_DBG(CAM_UTIL, "i=%d, gpio=%d dir=%ld", i,
+			gpio_tbl[i].gpio, gpio_tbl[i].flags);
+	}
+	if (gpio_en) {
+		for (i = 0; i < size; i++) {
+			rc = gpio_request_one(gpio_tbl[i].gpio,
+				gpio_tbl[i].flags, gpio_tbl[i].label);
+			if (rc) {
+				/*
+				 * After GPIO request fails, contine to
+				 * apply new gpios, outout a error message
+				 * for driver bringup debug
+				 */
+				CAM_ERR(CAM_UTIL, "gpio %d:%s request fails",
+					gpio_tbl[i].gpio, gpio_tbl[i].label);
+			}
+		}
+	} else {
+		gpio_free_array(gpio_tbl, size);
+	}
+
+	return rc;
+}
+
+static int cam_soc_util_get_dt_regulator_info
+	(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0, count = 0, i = 0;
+	struct device_node *of_node = NULL;
+
+	if (!soc_info || !soc_info->dev) {
+		CAM_ERR(CAM_UTIL, "Invalid parameters");
+		return -EINVAL;
+	}
+
+	of_node = soc_info->dev->of_node;
+
+	soc_info->num_rgltr = 0;
+	count = of_property_count_strings(of_node, "regulator-names");
+	if (count != -EINVAL) {
+		if (count <= 0) {
+			CAM_ERR(CAM_UTIL, "no regulators found");
+			count = 0;
+			return -EINVAL;
+		}
+
+		soc_info->num_rgltr = count;
+
+	} else {
+		CAM_DBG(CAM_UTIL, "No regulators node found");
+		return 0;
+	}
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		rc = of_property_read_string_index(of_node,
+			"regulator-names", i, &soc_info->rgltr_name[i]);
+		CAM_DBG(CAM_UTIL, "rgltr_name[%d] = %s",
+			i, soc_info->rgltr_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "no regulator resource at cnt=%d", i);
+			return -ENODEV;
+		}
+	}
+
+	if (!of_property_read_bool(of_node, "rgltr-cntrl-support")) {
+		CAM_DBG(CAM_UTIL, "No regulator control parameter defined");
+		soc_info->rgltr_ctrl_support = false;
+		return 0;
+	}
+
+	soc_info->rgltr_ctrl_support = true;
+
+	rc = of_property_read_u32_array(of_node, "rgltr-min-voltage",
+		soc_info->rgltr_min_volt, soc_info->num_rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "No minimum volatage value found, rc=%d", rc);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32_array(of_node, "rgltr-max-voltage",
+		soc_info->rgltr_max_volt, soc_info->num_rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "No maximum volatage value found, rc=%d", rc);
+		return -EINVAL;
+	}
+
+	rc = of_property_read_u32_array(of_node, "rgltr-load-current",
+		soc_info->rgltr_op_mode, soc_info->num_rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "No Load curent found rc=%d", rc);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int cam_soc_util_get_dt_properties(struct cam_hw_soc_info *soc_info)
+{
+	struct device_node *of_node = NULL;
+	int count = 0, i = 0, rc = 0;
+
+	if (!soc_info || !soc_info->dev)
+		return -EINVAL;
+
+	of_node = soc_info->dev->of_node;
+
+	rc = of_property_read_u32(of_node, "cell-index", &soc_info->index);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "device %s failed to read cell-index",
+			soc_info->dev_name);
+		return rc;
+	}
+
+	count = of_property_count_strings(of_node, "reg-names");
+	if (count <= 0) {
+		CAM_DBG(CAM_UTIL, "no reg-names found for: %s",
+			soc_info->dev_name);
+		count = 0;
+	}
+	soc_info->num_mem_block = count;
+
+	for (i = 0; i < soc_info->num_mem_block; i++) {
+		rc = of_property_read_string_index(of_node, "reg-names", i,
+			&soc_info->mem_block_name[i]);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "failed to read reg-names at %d", i);
+			return rc;
+		}
+		soc_info->mem_block[i] =
+			platform_get_resource_byname(soc_info->pdev,
+			IORESOURCE_MEM, soc_info->mem_block_name[i]);
+
+		if (!soc_info->mem_block[i]) {
+			CAM_ERR(CAM_UTIL, "no mem resource by name %s",
+				soc_info->mem_block_name[i]);
+			rc = -ENODEV;
+			return rc;
+		}
+	}
+
+	rc = of_property_read_string(of_node, "label", &soc_info->label_name);
+	if (rc)
+		CAM_DBG(CAM_UTIL, "Label is not available in the node: %d", rc);
+
+	if (soc_info->num_mem_block > 0) {
+		rc = of_property_read_u32_array(of_node, "reg-cam-base",
+			soc_info->mem_block_cam_base, soc_info->num_mem_block);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Error reading register offsets");
+			return rc;
+		}
+	}
+
+	rc = of_property_read_string_index(of_node, "interrupt-names", 0,
+		&soc_info->irq_name);
+	if (rc) {
+		CAM_DBG(CAM_UTIL, "No interrupt line preset for: %s",
+			soc_info->dev_name);
+		rc = 0;
+	} else {
+		rc = cam_compat_util_get_irq(soc_info);
+		if (rc < 0) {
+			CAM_ERR(CAM_UTIL, "get irq resource failed rc=%d", rc);
+			return rc;
+		}
+	}
+
+	rc = of_property_read_string_index(of_node, "compatible", 0,
+		(const char **)&soc_info->compatible);
+	if (rc) {
+		CAM_DBG(CAM_UTIL, "No compatible string present for: %s",
+			soc_info->dev_name);
+		rc = 0;
+	}
+
+	rc = cam_soc_util_get_dt_regulator_info(soc_info);
+	if (rc)
+		return rc;
+
+	rc = cam_soc_util_get_dt_clk_info(soc_info);
+	if (rc)
+		return rc;
+
+	rc = cam_soc_util_get_gpio_info(soc_info);
+	if (rc)
+		return rc;
+
+	if (of_find_property(of_node, "qcom,cam-cx-ipeak", NULL))
+		rc = cam_cx_ipeak_register_cx_ipeak(soc_info);
+
+	return rc;
+}
+
+/**
+ * cam_soc_util_get_regulator()
+ *
+ * @brief:              Get regulator resource named vdd
+ *
+ * @dev:                Device associated with regulator
+ * @reg:                Return pointer to be filled with regulator on success
+ * @rgltr_name:         Name of regulator to get
+ *
+ * @return:             0 for Success, negative value for failure
+ */
+static int cam_soc_util_get_regulator(struct device *dev,
+	struct regulator **reg, const char *rgltr_name)
+{
+	int rc = 0;
+	*reg = regulator_get(dev, rgltr_name);
+	if (IS_ERR_OR_NULL(*reg)) {
+		rc = PTR_ERR(*reg);
+		rc = rc ? rc : -EINVAL;
+		CAM_ERR(CAM_UTIL, "Regulator %s get failed %d", rgltr_name, rc);
+		*reg = NULL;
+	}
+	return rc;
+}
+
+int cam_soc_util_regulator_disable(struct regulator *rgltr,
+	const char *rgltr_name, uint32_t rgltr_min_volt,
+	uint32_t rgltr_max_volt, uint32_t rgltr_op_mode,
+	uint32_t rgltr_delay_ms)
+{
+	int32_t rc = 0;
+
+	if (!rgltr) {
+		CAM_ERR(CAM_UTIL, "Invalid NULL parameter");
+		return -EINVAL;
+	}
+
+	rc = regulator_disable(rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "%s regulator disable failed", rgltr_name);
+		return rc;
+	}
+
+	if (rgltr_delay_ms > 20)
+		msleep(rgltr_delay_ms);
+	else if (rgltr_delay_ms)
+		usleep_range(rgltr_delay_ms * 1000,
+			(rgltr_delay_ms * 1000) + 1000);
+
+	if (regulator_count_voltages(rgltr) > 0) {
+		regulator_set_load(rgltr, 0);
+		regulator_set_voltage(rgltr, 0, rgltr_max_volt);
+	}
+
+	return rc;
+}
+
+
+int cam_soc_util_regulator_enable(struct regulator *rgltr,
+	const char *rgltr_name,
+	uint32_t rgltr_min_volt, uint32_t rgltr_max_volt,
+	uint32_t rgltr_op_mode, uint32_t rgltr_delay)
+{
+	int32_t rc = 0;
+
+	if (!rgltr) {
+		CAM_ERR(CAM_UTIL, "Invalid NULL parameter");
+		return -EINVAL;
+	}
+
+	if (regulator_count_voltages(rgltr) > 0) {
+		CAM_DBG(CAM_UTIL, "voltage min=%d, max=%d",
+			rgltr_min_volt, rgltr_max_volt);
+
+		rc = regulator_set_voltage(
+			rgltr, rgltr_min_volt, rgltr_max_volt);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "%s set voltage failed", rgltr_name);
+			return rc;
+		}
+
+		rc = regulator_set_load(rgltr, rgltr_op_mode);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "%s set optimum mode failed",
+				rgltr_name);
+			return rc;
+		}
+	}
+
+	rc = regulator_enable(rgltr);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "%s regulator_enable failed", rgltr_name);
+		return rc;
+	}
+
+	if (rgltr_delay > 20)
+		msleep(rgltr_delay);
+	else if (rgltr_delay)
+		usleep_range(rgltr_delay * 1000,
+			(rgltr_delay * 1000) + 1000);
+
+	return rc;
+}
+
+static int cam_soc_util_request_pinctrl(
+	struct cam_hw_soc_info *soc_info)
+{
+
+	struct cam_soc_pinctrl_info *device_pctrl = &soc_info->pinctrl_info;
+	struct device *dev = soc_info->dev;
+
+	device_pctrl->pinctrl = devm_pinctrl_get(dev);
+	if (IS_ERR_OR_NULL(device_pctrl->pinctrl)) {
+		CAM_DBG(CAM_UTIL, "Pinctrl not available");
+		device_pctrl->pinctrl = NULL;
+		return 0;
+	}
+	device_pctrl->gpio_state_active =
+		pinctrl_lookup_state(device_pctrl->pinctrl,
+				CAM_SOC_PINCTRL_STATE_DEFAULT);
+	if (IS_ERR_OR_NULL(device_pctrl->gpio_state_active)) {
+		CAM_ERR(CAM_UTIL,
+			"Failed to get the active state pinctrl handle");
+		device_pctrl->gpio_state_active = NULL;
+		return -EINVAL;
+	}
+	device_pctrl->gpio_state_suspend
+		= pinctrl_lookup_state(device_pctrl->pinctrl,
+				CAM_SOC_PINCTRL_STATE_SLEEP);
+	if (IS_ERR_OR_NULL(device_pctrl->gpio_state_suspend)) {
+		CAM_ERR(CAM_UTIL,
+			"Failed to get the suspend state pinctrl handle");
+		device_pctrl->gpio_state_suspend = NULL;
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static void cam_soc_util_regulator_disable_default(
+	struct cam_hw_soc_info *soc_info)
+{
+	int j = 0;
+	uint32_t num_rgltr = soc_info->num_rgltr;
+
+	for (j = num_rgltr-1; j >= 0; j--) {
+		if (soc_info->rgltr_ctrl_support == true) {
+			cam_soc_util_regulator_disable(soc_info->rgltr[j],
+				soc_info->rgltr_name[j],
+				soc_info->rgltr_min_volt[j],
+				soc_info->rgltr_max_volt[j],
+				soc_info->rgltr_op_mode[j],
+				soc_info->rgltr_delay[j]);
+		} else {
+			if (soc_info->rgltr[j])
+				regulator_disable(soc_info->rgltr[j]);
+		}
+	}
+}
+
+void cam_soc_util_power_domain_disable_default(
+	struct cam_hw_soc_info *soc_info)
+{
+	int i, ret = 0, num_pds = soc_info->num_genpd;
+
+	if (num_pds < 1) {
+		CAM_DBG(CAM_UTIL,
+			"power-domains not defined for dev %s num_pds = %d",
+			num_pds, soc_info->dev_name);
+		return;
+	}
+
+	if (num_pds == 1) {
+		dev_pm_genpd_set_performance_state(soc_info->dev, 0);
+		ret = pm_runtime_put_sync(soc_info->dev);
+		CAM_DBG(CAM_UTIL,
+			"power-domain disabled for dev %s ret %d",
+			soc_info->dev_name, ret);
+		return;
+	}
+
+	for (i = num_pds - 1; i >= 0; i--) {
+		if (!soc_info->genpd)
+			continue;
+
+		if (!soc_info->genpd[i])
+			continue;
+
+		dev_pm_genpd_set_performance_state(soc_info->genpd[i], 0);
+		pm_runtime_put(soc_info->genpd[i]);
+	}
+}
+
+static int cam_soc_util_regulator_enable_default(
+	struct cam_hw_soc_info *soc_info)
+{
+	int j = 0, rc = 0;
+	uint32_t num_rgltr = soc_info->num_rgltr;
+
+	for (j = 0; j < num_rgltr; j++) {
+		if (soc_info->rgltr_ctrl_support == true) {
+			rc = cam_soc_util_regulator_enable(soc_info->rgltr[j],
+				soc_info->rgltr_name[j],
+				soc_info->rgltr_min_volt[j],
+				soc_info->rgltr_max_volt[j],
+				soc_info->rgltr_op_mode[j],
+				soc_info->rgltr_delay[j]);
+		} else {
+			if (soc_info->rgltr[j])
+				rc = regulator_enable(soc_info->rgltr[j]);
+		}
+
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "%s enable failed",
+				soc_info->rgltr_name[j]);
+			goto disable_rgltr;
+		}
+	}
+
+	return rc;
+disable_rgltr:
+
+	for (j--; j >= 0; j--) {
+		if (soc_info->rgltr_ctrl_support == true) {
+			cam_soc_util_regulator_disable(soc_info->rgltr[j],
+				soc_info->rgltr_name[j],
+				soc_info->rgltr_min_volt[j],
+				soc_info->rgltr_max_volt[j],
+				soc_info->rgltr_op_mode[j],
+				soc_info->rgltr_delay[j]);
+		} else {
+			if (soc_info->rgltr[j])
+				regulator_disable(soc_info->rgltr[j]);
+		}
+	}
+
+	return rc;
+}
+
+int cam_soc_util_power_domain_enable_default(
+	struct cam_hw_soc_info *soc_info)
+{
+	int i = 0, ret = 0;
+	int32_t num_pds = soc_info->num_genpd;
+
+	if (num_pds < 1) {
+		CAM_DBG(CAM_UTIL,
+			"power-domains not defined for dev %s num_pds = %d",
+			num_pds, soc_info->dev_name);
+		goto end;
+	}
+
+	if (num_pds == 1) {
+		dev_pm_genpd_set_performance_state(soc_info->dev, INT_MAX);
+		ret = pm_runtime_get_sync(soc_info->dev);
+		CAM_DBG(CAM_UTIL,
+			"power-domain enabled for dev %s ret %d",
+			soc_info->dev_name, ret);
+
+		if (ret < 0) {
+			CAM_ERR(CAM_UTIL,
+				"power-domain enable failed for dev %s ret %d",
+				soc_info->dev_name, ret);
+			pm_runtime_put(soc_info->dev);
+			dev_pm_genpd_set_performance_state(soc_info->dev, 0);
+		}
+
+		goto end;
+	}
+
+	for (i = 0; i < num_pds; i++) {
+		if (!soc_info->genpd)
+			continue;
+
+		if (!soc_info->genpd[i])
+			continue;
+
+		dev_pm_genpd_set_performance_state(soc_info->genpd[i], INT_MAX);
+		ret = pm_runtime_get_sync(soc_info->genpd[i]);
+		if (ret < 0) {
+			CAM_ERR(CAM_UTIL,
+				"power-domain enable failed for dev %s ret %d i %d",
+				soc_info->dev_name, ret, i);
+			goto disable_pds;
+		}
+	}
+
+	goto end;
+
+disable_pds:
+	for (i--; i >= 0; i--) {
+		if (!soc_info->genpd[i])
+			continue;
+
+		dev_pm_genpd_set_performance_state(soc_info->genpd[i], 0);
+		pm_runtime_put(soc_info->genpd[i]);
+	}
+end:
+	return ret;
+}
+
+int cam_soc_util_configure_pd(struct cam_hw_soc_info *soc_info)
+{
+	int i, ret = 0;
+
+	soc_info->num_genpd = of_count_phandle_with_args(soc_info->dev->of_node,
+							"power-domains",
+							"#power-domain-cells");
+	if (soc_info->num_genpd < 1) {
+		CAM_WARN(CAM_UTIL,
+			"DBG: power-domains not defined for %s",
+			soc_info->dev_name);
+		soc_info->num_genpd = 0;
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL,
+		"num_genpd defined for dev %s: %d",
+		soc_info->dev_name, soc_info->num_genpd);
+	/*
+	 * With only one power domain defined there is no need to have
+	 * references of genpd devices as the genpd attach will happen
+	 * during probe with dev_pm_domain_attach().
+	 */
+	if (soc_info->num_genpd == 1) {
+		goto end;
+	}
+
+	soc_info->genpd = devm_kmalloc_array(soc_info->dev, soc_info->num_genpd,
+					     sizeof(struct device), GFP_KERNEL);
+	if (!soc_info->genpd) {
+		CAM_ERR(CAM_UTIL,
+			"devm_kmalloc_array failed for dev %s, num_genpd %d",
+			soc_info->dev_name, soc_info->num_genpd);
+		ret = -ENOMEM;
+		goto end;
+	}
+
+	for (i = 0; i < soc_info->num_genpd; i++) {
+		soc_info->genpd[i] = dev_pm_domain_attach_by_id(soc_info->dev, i);
+		if (IS_ERR(soc_info->genpd[i])) {
+			CAM_ERR(CAM_UTIL,
+				"Error in pm_domain_attach");
+			ret = PTR_ERR(soc_info->genpd[i]);
+			goto fail_pm;
+		}
+	}
+
+	goto end;
+
+fail_pm:
+	for (--i ; i >= 0; i--)
+		dev_pm_domain_detach(soc_info->genpd[i], true);
+end:
+	return ret;
+}
+
+int cam_soc_util_configure_opp(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	rc = devm_pm_opp_set_clkname(soc_info->dev, soc_info->clk_name[soc_info->src_clk_idx]);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"OPP set_clkname failed for dev %s clk_name %s rc %d",
+			soc_info->dev_name, soc_info->clk_name[soc_info->src_clk_idx], rc);
+		return rc;
+	}
+
+	rc = devm_pm_opp_of_add_table(soc_info->dev);
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"OPP add_table failed for dev %s rc %d",
+			soc_info->dev_name, rc);
+	}
+	return rc;
+}
+
+int cam_soc_util_request_platform_resource(
+	struct cam_hw_soc_info *soc_info,
+	irq_handler_t handler, void *irq_data)
+{
+	int i = 0, rc = 0;
+
+	if (!soc_info || !soc_info->dev) {
+		CAM_ERR(CAM_UTIL, "Invalid parameters");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->num_mem_block; i++) {
+		if (soc_info->reserve_mem) {
+			if (!request_mem_region(soc_info->mem_block[i]->start,
+				resource_size(soc_info->mem_block[i]),
+				soc_info->mem_block_name[i])){
+				CAM_ERR(CAM_UTIL,
+					"Error Mem region request Failed:%s",
+					soc_info->mem_block_name[i]);
+				rc = -ENOMEM;
+				goto unmap_base;
+			}
+		}
+		soc_info->reg_map[i].mem_base = ioremap(
+			soc_info->mem_block[i]->start,
+			resource_size(soc_info->mem_block[i]));
+		if (!soc_info->reg_map[i].mem_base) {
+			CAM_ERR(CAM_UTIL, "i= %d base NULL", i);
+			rc = -ENOMEM;
+			goto unmap_base;
+		}
+		soc_info->reg_map[i].mem_cam_base =
+			soc_info->mem_block_cam_base[i];
+		soc_info->reg_map[i].size =
+			resource_size(soc_info->mem_block[i]);
+		soc_info->num_reg_map++;
+	}
+
+	for (i = 0; i < soc_info->num_rgltr; i++) {
+		if (soc_info->rgltr_name[i] == NULL) {
+			CAM_ERR(CAM_UTIL, "can't find regulator name");
+			goto put_regulator;
+		}
+
+		rc = cam_soc_util_get_regulator(soc_info->dev,
+			&soc_info->rgltr[i],
+			soc_info->rgltr_name[i]);
+		if (rc)
+			goto put_regulator;
+	}
+
+	rc = cam_soc_util_configure_pd(soc_info);
+	if (rc)
+		goto put_regulator;
+
+	pm_runtime_enable(soc_info->dev);
+
+	/*
+	 * Doing a pm_runtime_get_sync() and pm_runtime_put_sync() after pm_runtime_enable
+	 * makes sure that the GDSC is off and only enabled later by the usecase when there
+	 * is such a requirement.
+	 */
+	cam_soc_util_power_domain_enable_default(soc_info);
+	cam_soc_util_power_domain_disable_default(soc_info);
+
+	if (soc_info->irq_num > 0) {
+		rc = devm_request_irq(soc_info->dev, soc_info->irq_num,
+			handler, IRQF_TRIGGER_RISING,
+			soc_info->irq_name, irq_data);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "irq request fail");
+			rc = -EBUSY;
+			goto put_regulator;
+		}
+		disable_irq(soc_info->irq_num);
+		soc_info->irq_data = irq_data;
+	}
+
+	/* Get Clock */
+	for (i = 0; i < soc_info->num_clk; i++) {
+		soc_info->clk[i] = clk_get(soc_info->dev,
+			soc_info->clk_name[i]);
+		if (!soc_info->clk[i]) {
+			CAM_ERR(CAM_UTIL, "get failed for %s",
+				soc_info->clk_name[i]);
+			rc = -ENOENT;
+			goto put_clk;
+		}
+	}
+	rc = cam_soc_util_configure_opp(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Failed to configure OPP");
+		goto put_clk;
+	}
+
+	rc = cam_soc_util_request_pinctrl(soc_info);
+	if (rc)
+		CAM_DBG(CAM_UTIL, "Failed in request pinctrl, rc=%d", rc);
+
+	rc = cam_soc_util_request_gpio_table(soc_info, true);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Failed in request gpio table, rc=%d", rc);
+		goto put_clk;
+	}
+
+	if (soc_info->clk_control_enable)
+		cam_soc_util_create_clk_lvl_debugfs(soc_info);
+
+	return rc;
+
+put_clk:
+	if (i == -1)
+		i = soc_info->num_clk;
+	for (i = i - 1; i >= 0; i--) {
+		if (soc_info->clk[i]) {
+			clk_put(soc_info->clk[i]);
+			soc_info->clk[i] = NULL;
+		}
+	}
+
+	if (soc_info->irq_num > 0) {
+		disable_irq(soc_info->irq_num);
+		devm_free_irq(soc_info->dev,
+			soc_info->irq_num, irq_data);
+	}
+
+put_regulator:
+	if (i == -1)
+		i = soc_info->num_rgltr;
+	for (i = i - 1; i >= 0; i--) {
+		if (soc_info->rgltr[i]) {
+			regulator_disable(soc_info->rgltr[i]);
+			regulator_put(soc_info->rgltr[i]);
+			soc_info->rgltr[i] = NULL;
+		}
+	}
+
+unmap_base:
+	if (i == -1)
+		i = soc_info->num_reg_map;
+	for (i = i - 1; i >= 0; i--) {
+		if (soc_info->reserve_mem)
+			release_mem_region(soc_info->mem_block[i]->start,
+				resource_size(soc_info->mem_block[i]));
+		iounmap(soc_info->reg_map[i].mem_base);
+		soc_info->reg_map[i].mem_base = NULL;
+		soc_info->reg_map[i].size = 0;
+	}
+
+	return rc;
+}
+
+int cam_soc_util_release_platform_resource(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+
+	if (!soc_info || !soc_info->dev) {
+		CAM_ERR(CAM_UTIL, "Invalid parameter");
+		return -EINVAL;
+	}
+
+	for (i = soc_info->num_clk - 1; i >= 0; i--) {
+		clk_put(soc_info->clk[i]);
+		soc_info->clk[i] = NULL;
+	}
+
+	for (i = soc_info->num_rgltr - 1; i >= 0; i--) {
+		if (soc_info->rgltr[i]) {
+			regulator_put(soc_info->rgltr[i]);
+			soc_info->rgltr[i] = NULL;
+		}
+	}
+
+	pm_runtime_disable(soc_info->dev);
+	for (i = 0; i < soc_info->num_genpd; i++) {
+		if (!soc_info->genpd)
+			continue;
+		if (!soc_info->genpd[i])
+			continue;
+		dev_pm_domain_detach(soc_info->genpd[i], true);
+	}
+
+	for (i = soc_info->num_reg_map - 1; i >= 0; i--) {
+		iounmap(soc_info->reg_map[i].mem_base);
+		soc_info->reg_map[i].mem_base = NULL;
+		soc_info->reg_map[i].size = 0;
+	}
+
+	if (soc_info->irq_num > 0) {
+		disable_irq(soc_info->irq_num);
+		devm_free_irq(soc_info->dev,
+			soc_info->irq_num, soc_info->irq_data);
+	}
+
+	if (soc_info->pinctrl_info.pinctrl)
+		devm_pinctrl_put(soc_info->pinctrl_info.pinctrl);
+
+
+	/* release for gpio */
+	cam_soc_util_request_gpio_table(soc_info, false);
+
+	if (soc_info->clk_control_enable)
+		cam_soc_util_remove_clk_lvl_debugfs(soc_info);
+
+	return 0;
+}
+
+int cam_soc_util_enable_platform_resource(struct cam_hw_soc_info *soc_info,
+	bool enable_clocks, enum cam_vote_level clk_level, bool enable_irq)
+{
+	int rc = 0;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	rc = cam_soc_util_regulator_enable_default(soc_info);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Regulators enable failed");
+		return rc;
+	}
+
+	rc = cam_soc_util_power_domain_enable_default(soc_info);
+	if (rc < 0) {
+		CAM_ERR(CAM_UTIL, "Power domains enable failed");
+		goto disable_regulator;
+	}
+
+	if (enable_clocks) {
+		rc = cam_soc_util_clk_enable_default(soc_info, clk_level);
+		if (rc)
+			goto disable_power_domain;
+	}
+
+	if (enable_irq) {
+		rc  = cam_soc_util_irq_enable(soc_info);
+		if (rc)
+			goto disable_clk;
+	}
+
+	if (soc_info->pinctrl_info.pinctrl &&
+		soc_info->pinctrl_info.gpio_state_active) {
+		rc = pinctrl_select_state(soc_info->pinctrl_info.pinctrl,
+			soc_info->pinctrl_info.gpio_state_active);
+
+		if (rc)
+			goto disable_irq;
+	}
+
+	return rc;
+
+disable_irq:
+	if (enable_irq)
+		cam_soc_util_irq_disable(soc_info);
+
+disable_clk:
+	if (enable_clocks)
+		cam_soc_util_clk_disable_default(soc_info);
+
+disable_power_domain:
+	cam_soc_util_power_domain_disable_default(soc_info);
+
+disable_regulator:
+	cam_soc_util_regulator_disable_default(soc_info);
+
+
+	return rc;
+}
+
+int cam_soc_util_disable_platform_resource(struct cam_hw_soc_info *soc_info,
+	bool disable_clocks, bool disable_irq)
+{
+	int rc = 0;
+
+	if (!soc_info)
+		return -EINVAL;
+
+	if (disable_irq)
+		rc |= cam_soc_util_irq_disable(soc_info);
+
+	if (disable_clocks)
+		cam_soc_util_clk_disable_default(soc_info);
+
+	cam_soc_util_power_domain_disable_default(soc_info);
+
+	cam_soc_util_regulator_disable_default(soc_info);
+
+	if (soc_info->pinctrl_info.pinctrl &&
+		soc_info->pinctrl_info.gpio_state_suspend)
+		rc = pinctrl_select_state(soc_info->pinctrl_info.pinctrl,
+			soc_info->pinctrl_info.gpio_state_suspend);
+
+	return rc;
+}
+
+int cam_soc_util_reg_dump(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset, int size)
+{
+	void __iomem     *base_addr = NULL;
+
+	CAM_DBG(CAM_UTIL, "base_idx %u size=%d", base_index, size);
+
+	if (!soc_info || base_index >= soc_info->num_reg_map ||
+		size <= 0 || (offset + size) >=
+		CAM_SOC_GET_REG_MAP_SIZE(soc_info, base_index))
+		return -EINVAL;
+
+	base_addr = CAM_SOC_GET_REG_MAP_START(soc_info, base_index);
+
+	/*
+	 * All error checking already done above,
+	 * hence ignoring the return value below.
+	 */
+	cam_io_dump(base_addr, offset, size);
+
+	return 0;
+}
+
+static int cam_soc_util_dump_cont_reg_range(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_reg_range_read_desc *reg_read, uint32_t base_idx,
+	struct cam_reg_dump_out_buffer *dump_out_buf, uintptr_t cmd_buf_end)
+{
+	int         i = 0, rc = 0;
+	uint32_t    write_idx = 0;
+
+	if (!soc_info || !dump_out_buf || !reg_read || !cmd_buf_end) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input args soc_info: %pK, dump_out_buffer: %pK reg_read: %pK cmd_buf_end: %pK",
+			soc_info, dump_out_buf, reg_read, (void *)cmd_buf_end);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((reg_read->num_values) && ((reg_read->num_values > U32_MAX / 2) ||
+		(sizeof(uint32_t) > ((U32_MAX -
+		sizeof(struct cam_reg_dump_out_buffer) -
+		dump_out_buf->bytes_written) /
+		(reg_read->num_values * 2))))) {
+		CAM_ERR(CAM_UTIL,
+			"Integer Overflow bytes_written: [%u] num_values: [%u]",
+			dump_out_buf->bytes_written, reg_read->num_values);
+		rc = -EOVERFLOW;
+		goto end;
+	}
+
+	if ((cmd_buf_end - (uintptr_t)dump_out_buf) <=
+		(uintptr_t)(sizeof(struct cam_reg_dump_out_buffer)
+		- sizeof(uint32_t) + dump_out_buf->bytes_written +
+		(reg_read->num_values * 2 * sizeof(uint32_t)))) {
+		CAM_ERR(CAM_UTIL,
+			"Insufficient space in out buffer num_values: [%d] cmd_buf_end: %tu dump_out_buf: %pK",
+			reg_read->num_values, cmd_buf_end,
+			(void *)dump_out_buf);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	write_idx = dump_out_buf->bytes_written / sizeof(uint32_t);
+	for (i = 0; i < reg_read->num_values; i++) {
+		if ((reg_read->offset + (i * sizeof(uint32_t))) >
+			(uint32_t)soc_info->reg_map[base_idx].size) {
+			CAM_ERR(CAM_UTIL,
+				"Reg offset out of range, offset: 0x%lX reg_map size: 0x%X",
+				(reg_read->offset + (i * sizeof(uint32_t))),
+				(uint32_t)soc_info->reg_map[base_idx].size);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		dump_out_buf->dump_data_flex[write_idx++] = reg_read->offset +
+			(i * sizeof(uint32_t));
+		dump_out_buf->dump_data_flex[write_idx++] =
+			cam_soc_util_r(soc_info, base_idx,
+			(reg_read->offset + (i * sizeof(uint32_t))));
+		dump_out_buf->bytes_written += (2 * sizeof(uint32_t));
+	}
+
+end:
+	return rc;
+}
+
+static int cam_soc_util_dump_dmi_reg_range(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_dmi_read_desc *dmi_read, uint32_t base_idx,
+	struct cam_reg_dump_out_buffer *dump_out_buf, uintptr_t cmd_buf_end)
+{
+	int        i = 0, rc = 0;
+	uint32_t   write_idx = 0;
+
+	if (!soc_info || !dump_out_buf || !dmi_read || !cmd_buf_end) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input args soc_info: %pK, dump_out_buffer: %pK",
+			soc_info, dump_out_buf);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (dmi_read->num_pre_writes > CAM_REG_DUMP_DMI_CONFIG_MAX ||
+		dmi_read->num_post_writes > CAM_REG_DUMP_DMI_CONFIG_MAX) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid number of requested writes, pre: %d post: %d",
+			dmi_read->num_pre_writes, dmi_read->num_post_writes);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if ((dmi_read->num_pre_writes + dmi_read->dmi_data_read.num_values)
+		&& ((dmi_read->num_pre_writes > U32_MAX / 2) ||
+		(dmi_read->dmi_data_read.num_values > U32_MAX / 2) ||
+		((dmi_read->num_pre_writes * 2) > U32_MAX -
+		(dmi_read->dmi_data_read.num_values * 2)) ||
+		(sizeof(uint32_t) > ((U32_MAX -
+		sizeof(struct cam_reg_dump_out_buffer) -
+		dump_out_buf->bytes_written) / ((dmi_read->num_pre_writes +
+		dmi_read->dmi_data_read.num_values) * 2))))) {
+		CAM_ERR(CAM_UTIL,
+			"Integer Overflow bytes_written: [%u] num_pre_writes: [%u] num_values: [%u]",
+			dump_out_buf->bytes_written, dmi_read->num_pre_writes,
+			dmi_read->dmi_data_read.num_values);
+		rc = -EOVERFLOW;
+		goto end;
+	}
+
+	if ((cmd_buf_end - (uintptr_t)dump_out_buf) <=
+		(uintptr_t)(
+		sizeof(struct cam_reg_dump_out_buffer) - sizeof(uint32_t) +
+		(dump_out_buf->bytes_written +
+		(dmi_read->num_pre_writes * 2 * sizeof(uint32_t)) +
+		(dmi_read->dmi_data_read.num_values * 2 *
+		sizeof(uint32_t))))) {
+		CAM_ERR(CAM_UTIL,
+			"Insufficient space in out buffer num_read_val: [%d] num_write_val: [%d] cmd_buf_end: %pK dump_out_buf: %pK",
+			dmi_read->dmi_data_read.num_values,
+			dmi_read->num_pre_writes, (void *)cmd_buf_end,
+			(void *)dump_out_buf);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	write_idx = dump_out_buf->bytes_written / sizeof(uint32_t);
+	for (i = 0; i < dmi_read->num_pre_writes; i++) {
+		if (dmi_read->pre_read_config[i].offset >
+			(uint32_t)soc_info->reg_map[base_idx].size) {
+			CAM_ERR(CAM_UTIL,
+				"Reg offset out of range, offset: 0x%X reg_map size: 0x%X",
+				dmi_read->pre_read_config[i].offset,
+				(uint32_t)soc_info->reg_map[base_idx].size);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		cam_soc_util_w_mb(soc_info, base_idx,
+			dmi_read->pre_read_config[i].offset,
+			dmi_read->pre_read_config[i].value);
+		dump_out_buf->dump_data_flex[write_idx++] =
+			dmi_read->pre_read_config[i].offset;
+		dump_out_buf->dump_data_flex[write_idx++] =
+			dmi_read->pre_read_config[i].value;
+		dump_out_buf->bytes_written += (2 * sizeof(uint32_t));
+	}
+
+	if (dmi_read->dmi_data_read.offset >
+		(uint32_t)soc_info->reg_map[base_idx].size) {
+		CAM_ERR(CAM_UTIL,
+			"Reg offset out of range, offset: 0x%X reg_map size: 0x%X",
+			dmi_read->dmi_data_read.offset,
+			(uint32_t)soc_info->reg_map[base_idx].size);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	for (i = 0; i < dmi_read->dmi_data_read.num_values; i++) {
+		dump_out_buf->dump_data_flex[write_idx++] =
+			dmi_read->dmi_data_read.offset;
+		dump_out_buf->dump_data_flex[write_idx++] =
+			cam_soc_util_r_mb(soc_info, base_idx,
+			dmi_read->dmi_data_read.offset);
+		dump_out_buf->bytes_written += (2 * sizeof(uint32_t));
+	}
+
+	for (i = 0; i < dmi_read->num_post_writes; i++) {
+		if (dmi_read->post_read_config[i].offset >
+			(uint32_t)soc_info->reg_map[base_idx].size) {
+			CAM_ERR(CAM_UTIL,
+				"Reg offset out of range, offset: 0x%X reg_map size: 0x%X",
+				dmi_read->post_read_config[i].offset,
+				(uint32_t)soc_info->reg_map[base_idx].size);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		cam_soc_util_w_mb(soc_info, base_idx,
+			dmi_read->post_read_config[i].offset,
+			dmi_read->post_read_config[i].value);
+	}
+
+end:
+	return rc;
+}
+
+static int cam_soc_util_dump_dmi_reg_range_user_buf(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_dmi_read_desc *dmi_read, uint32_t base_idx,
+	struct cam_hw_soc_dump_args *dump_args)
+{
+	int                            i;
+	int                            rc;
+	size_t                         buf_len = 0;
+	uint8_t                       *dst;
+	size_t                         remain_len;
+	uint32_t                       min_len;
+	uint32_t                      *waddr, *start;
+	uintptr_t                      cpu_addr;
+	struct cam_hw_soc_dump_header *hdr;
+
+	if (!soc_info || !dump_args || !dmi_read) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input args soc_info: %pK, dump_args: %pK",
+			soc_info, dump_args);
+		return -EINVAL;
+	}
+
+	if (dmi_read->num_pre_writes > CAM_REG_DUMP_DMI_CONFIG_MAX ||
+		dmi_read->num_post_writes > CAM_REG_DUMP_DMI_CONFIG_MAX) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid number of requested writes, pre: %d post: %d",
+			dmi_read->num_pre_writes, dmi_read->num_post_writes);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(dump_args->buf_handle, &cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return -EINVAL;
+	}
+
+	if (buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_UTIL, "Dump offset overshoot offset %zu len %zu",
+			dump_args->offset, buf_len);
+		rc = -ENOSPC;
+		goto end;
+	}
+	remain_len = buf_len - dump_args->offset;
+	min_len = (dmi_read->num_pre_writes * 2 * sizeof(uint32_t)) +
+		(dmi_read->dmi_data_read.num_values * 2 * sizeof(uint32_t)) +
+		sizeof(uint32_t);
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_UTIL,
+			"Dump Buffer exhaust read %d write %d remain %zu min %u",
+			dmi_read->dmi_data_read.num_values,
+			dmi_read->num_pre_writes, remain_len,
+			min_len);
+		rc = -ENOSPC;
+		goto end;
+	}
+
+	dst = (uint8_t *)cpu_addr + dump_args->offset;
+	hdr = (struct cam_hw_soc_dump_header *)dst;
+	memset(hdr, 0, sizeof(struct cam_hw_soc_dump_header));
+	scnprintf(hdr->tag, CAM_SOC_HW_DUMP_TAG_MAX_LEN,
+		"DMI_DUMP:");
+	waddr = (uint32_t *)(dst + sizeof(struct cam_hw_soc_dump_header));
+	start = waddr;
+	hdr->word_size = sizeof(uint32_t);
+	*waddr = soc_info->index;
+	waddr++;
+	for (i = 0; i < dmi_read->num_pre_writes; i++) {
+		if (dmi_read->pre_read_config[i].offset >
+			(uint32_t)soc_info->reg_map[base_idx].size) {
+			CAM_ERR(CAM_UTIL,
+				"Reg offset out of range, offset: 0x%X reg_map size: 0x%X",
+				dmi_read->pre_read_config[i].offset,
+				(uint32_t)soc_info->reg_map[base_idx].size);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		cam_soc_util_w_mb(soc_info, base_idx,
+			dmi_read->pre_read_config[i].offset,
+			dmi_read->pre_read_config[i].value);
+		*waddr++ = dmi_read->pre_read_config[i].offset;
+		*waddr++ = dmi_read->pre_read_config[i].value;
+	}
+
+	if (dmi_read->dmi_data_read.offset >
+		(uint32_t)soc_info->reg_map[base_idx].size) {
+		CAM_ERR(CAM_UTIL,
+			"Reg offset out of range, offset: 0x%X reg_map size: 0x%X",
+			dmi_read->dmi_data_read.offset,
+			(uint32_t)soc_info->reg_map[base_idx].size);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	for (i = 0; i < dmi_read->dmi_data_read.num_values; i++) {
+		*waddr++ = dmi_read->dmi_data_read.offset;
+		*waddr++ = cam_soc_util_r_mb(soc_info, base_idx,
+			dmi_read->dmi_data_read.offset);
+	}
+
+	for (i = 0; i < dmi_read->num_post_writes; i++) {
+		if (dmi_read->post_read_config[i].offset >
+			(uint32_t)soc_info->reg_map[base_idx].size) {
+			CAM_ERR(CAM_UTIL,
+				"Reg offset out of range, offset: 0x%X reg_map size: 0x%X",
+				dmi_read->post_read_config[i].offset,
+				(uint32_t)soc_info->reg_map[base_idx].size);
+			rc = -EINVAL;
+			goto end;
+		}
+		cam_soc_util_w_mb(soc_info, base_idx,
+			dmi_read->post_read_config[i].offset,
+			dmi_read->post_read_config[i].value);
+	}
+	hdr->size = (waddr - start) * hdr->word_size;
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_hw_soc_dump_header);
+
+end:
+	if (dump_args)
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_soc_util_dump_cont_reg_range_user_buf(
+	struct cam_hw_soc_info *soc_info,
+	struct cam_reg_range_read_desc *reg_read,
+	uint32_t base_idx,
+	struct cam_hw_soc_dump_args *dump_args)
+{
+	int                            i;
+	int                            rc = 0;
+	size_t                         buf_len;
+	uint8_t                       *dst;
+	size_t                         remain_len;
+	uint32_t                       min_len;
+	uint32_t                      *waddr, *start;
+	uintptr_t                      cpu_addr;
+	struct cam_hw_soc_dump_header  *hdr;
+
+	if (!soc_info || !dump_args || !reg_read) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input args soc_info: %pK, dump_out_buffer: %pK reg_read: %pK",
+			soc_info, dump_args, reg_read);
+		rc = -EINVAL;
+		return rc;
+	}
+	rc = cam_mem_get_cpu_buf(dump_args->buf_handle, &cpu_addr, &buf_len);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Invalid handle %u rc %d",
+			dump_args->buf_handle, rc);
+		return rc;
+	}
+	if (buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_UTIL, "Dump offset overshoot %zu %zu",
+			dump_args->offset, buf_len);
+		rc = -ENOSPC;
+		goto end;
+	}
+	remain_len = buf_len - dump_args->offset;
+	min_len = (reg_read->num_values * 2 * sizeof(uint32_t)) +
+		sizeof(struct cam_hw_soc_dump_header) + sizeof(uint32_t);
+	if (remain_len < min_len) {
+		CAM_WARN(CAM_UTIL,
+			"Dump Buffer exhaust read_values %d remain %zu min %u",
+			reg_read->num_values,
+			remain_len,
+			min_len);
+		rc = -ENOSPC;
+		goto end;
+	}
+	dst = (uint8_t *)cpu_addr + dump_args->offset;
+	hdr = (struct cam_hw_soc_dump_header *)dst;
+	memset(hdr, 0, sizeof(struct cam_hw_soc_dump_header));
+	scnprintf(hdr->tag, CAM_SOC_HW_DUMP_TAG_MAX_LEN, "%s_REG:",
+		soc_info->dev_name);
+	waddr = (uint32_t *)(dst + sizeof(struct cam_hw_soc_dump_header));
+	start = waddr;
+	hdr->word_size = sizeof(uint32_t);
+	*waddr = soc_info->index;
+	waddr++;
+	for (i = 0; i < reg_read->num_values; i++) {
+		if ((reg_read->offset + (i * sizeof(uint32_t))) >
+			(uint32_t)soc_info->reg_map[base_idx].size) {
+			CAM_ERR(CAM_UTIL,
+				"Reg offset out of range, offset: 0x%lX reg_map size: 0x%X",
+				(reg_read->offset + (i * sizeof(uint32_t))),
+				(uint32_t)soc_info->reg_map[base_idx].size);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		waddr[0] = reg_read->offset + (i * sizeof(uint32_t));
+		waddr[1] = cam_soc_util_r(soc_info, base_idx,
+			(reg_read->offset + (i * sizeof(uint32_t))));
+		waddr += 2;
+	}
+	hdr->size = (waddr - start) * hdr->word_size;
+	dump_args->offset +=  hdr->size +
+		sizeof(struct cam_hw_soc_dump_header);
+end:
+	if (dump_args)
+		cam_mem_put_cpu_buf(dump_args->buf_handle);
+	return rc;
+}
+
+static int cam_soc_util_user_reg_dump(
+	struct cam_reg_dump_desc *reg_dump_desc,
+	struct cam_hw_soc_dump_args *dump_args,
+	struct cam_hw_soc_info *soc_info,
+	uint32_t reg_base_idx)
+{
+	int rc = 0;
+	int i;
+	struct cam_reg_read_info  *reg_read_info = NULL;
+
+	if (!dump_args || !reg_dump_desc || !soc_info) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input parameters %pK %pK %pK",
+			dump_args, reg_dump_desc, soc_info);
+		return -EINVAL;
+	}
+	for (i = 0; i < reg_dump_desc->num_read_range; i++) {
+
+		reg_read_info = &reg_dump_desc->read_range_flex[i];
+		if (reg_read_info->type ==
+				CAM_REG_DUMP_READ_TYPE_CONT_RANGE) {
+			rc = cam_soc_util_dump_cont_reg_range_user_buf(
+				soc_info,
+				&reg_read_info->reg_read,
+				reg_base_idx,
+				dump_args);
+		} else if (reg_read_info->type ==
+				CAM_REG_DUMP_READ_TYPE_DMI) {
+			rc = cam_soc_util_dump_dmi_reg_range_user_buf(
+				soc_info,
+				&reg_read_info->dmi_read,
+				reg_base_idx,
+				dump_args);
+		} else {
+			CAM_ERR(CAM_UTIL,
+					"Invalid Reg dump read type: %d",
+					reg_read_info->type);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (rc) {
+			CAM_ERR(CAM_UTIL,
+				"Reg range read failed rc: %d reg_base_idx: %d",
+				rc, reg_base_idx);
+			goto end;
+		}
+	}
+end:
+	return rc;
+}
+
+int cam_soc_util_reg_dump_to_cmd_buf(void *ctx,
+	struct cam_cmd_buf_desc *cmd_desc, uint64_t req_id,
+	cam_soc_util_regspace_data_cb reg_data_cb,
+	struct cam_hw_soc_dump_args *soc_dump_args,
+	bool user_triggered_dump)
+{
+	int                               rc = 0, i, j;
+	uintptr_t                         cpu_addr = 0;
+	uintptr_t                         cmd_buf_start = 0;
+	uintptr_t                         cmd_in_data_end = 0;
+	uintptr_t                         cmd_buf_end = 0;
+	uint32_t                          reg_base_type = 0;
+	size_t                            buf_size = 0, remain_len = 0;
+	struct cam_reg_dump_input_info   *reg_input_info = NULL;
+	struct cam_reg_dump_desc         *reg_dump_desc = NULL;
+	struct cam_reg_dump_out_buffer   *dump_out_buf = NULL;
+	struct cam_reg_read_info         *reg_read_info = NULL;
+	struct cam_hw_soc_info           *soc_info;
+	uint32_t                          reg_base_idx = 0;
+
+	if (!ctx || !cmd_desc || !reg_data_cb) {
+		CAM_ERR(CAM_UTIL, "Invalid args to reg dump [%pK] [%pK]",
+			cmd_desc, reg_data_cb);
+		return -EINVAL;
+	}
+
+	if (!cmd_desc->length || !cmd_desc->size) {
+		CAM_ERR(CAM_UTIL, "Invalid cmd buf size %d %d",
+			cmd_desc->length, cmd_desc->size);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle, &cpu_addr, &buf_size);
+	if (rc || !cpu_addr || (buf_size == 0)) {
+		CAM_ERR(CAM_UTIL, "Failed in Get cpu addr, rc=%d, cpu_addr=%pK",
+			rc, (void *)cpu_addr);
+		if (rc)
+			return rc;
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL, "Get cpu buf success req_id: %llu buf_size: %zu",
+		req_id, buf_size);
+	if ((buf_size < sizeof(uint32_t)) ||
+		((size_t)cmd_desc->offset > (buf_size - sizeof(uint32_t)))) {
+		CAM_ERR(CAM_UTIL, "Invalid offset for cmd buf: %zu",
+			(size_t)cmd_desc->offset);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	remain_len = buf_size - (size_t)cmd_desc->offset;
+	if ((remain_len < (size_t)cmd_desc->size) || (cmd_desc->size <
+		cmd_desc->length)) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid params for cmd buf len: %zu size: %zu remain_len: %zu",
+			(size_t)cmd_desc->length, (size_t)cmd_desc->length,
+			remain_len);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	cmd_buf_start = cpu_addr + (uintptr_t)cmd_desc->offset;
+	cmd_in_data_end = cmd_buf_start + (uintptr_t)cmd_desc->length;
+	cmd_buf_end = cmd_buf_start + (uintptr_t)cmd_desc->size;
+	if ((cmd_buf_end <= cmd_buf_start) ||
+		(cmd_in_data_end <= cmd_buf_start)) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid length or size for cmd buf: [%zu] [%zu]",
+			(size_t)cmd_desc->length, (size_t)cmd_desc->size);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL,
+		"Buffer params start [%pK] input_end [%pK] buf_end [%pK]",
+		cmd_buf_start, cmd_in_data_end, cmd_buf_end);
+	reg_input_info = (struct cam_reg_dump_input_info *) cmd_buf_start;
+	if ((reg_input_info->num_dump_sets > 1) && (sizeof(uint32_t) >
+		((U32_MAX - sizeof(struct cam_reg_dump_input_info)) /
+		(reg_input_info->num_dump_sets - 1)))) {
+		CAM_ERR(CAM_UTIL,
+			"Integer Overflow req_id: [%llu] num_dump_sets: [%u]",
+			req_id, reg_input_info->num_dump_sets);
+		rc = -EOVERFLOW;
+		goto end;
+	}
+
+	if ((!reg_input_info->num_dump_sets) ||
+		((cmd_in_data_end - cmd_buf_start) <= (uintptr_t)
+		(sizeof(struct cam_reg_dump_input_info) +
+		((reg_input_info->num_dump_sets - 1) * sizeof(uint32_t))))) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid number of dump sets, req_id: [%llu] num_dump_sets: [%u]",
+			req_id, reg_input_info->num_dump_sets);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	CAM_DBG(CAM_UTIL,
+		"reg_input_info req_id: %llu ctx %pK num_dump_sets: %d",
+		req_id, ctx, reg_input_info->num_dump_sets);
+	for (i = 0; i < reg_input_info->num_dump_sets; i++) {
+		if ((cmd_in_data_end - cmd_buf_start) <= (uintptr_t)
+			reg_input_info->dump_set_offsets_flex[i]) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid dump set offset: [%d], cmd_buf_start: [%pK] cmd_in_data_end: [%pK]",
+				reg_input_info->dump_set_offsets_flex[i],
+				(void *)cmd_buf_start, (void *)cmd_in_data_end);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		reg_dump_desc = (struct cam_reg_dump_desc *)
+			(cmd_buf_start +
+			(uintptr_t)reg_input_info->dump_set_offsets_flex[i]);
+		if ((reg_dump_desc->num_read_range > 1) &&
+			(sizeof(struct cam_reg_read_info) > ((U32_MAX -
+			sizeof(struct cam_reg_dump_desc)) /
+			(reg_dump_desc->num_read_range - 1)))) {
+			CAM_ERR(CAM_UTIL,
+				"Integer Overflow req_id: [%llu] num_read_range: [%u]",
+				req_id, reg_dump_desc->num_read_range);
+			rc = -EOVERFLOW;
+			goto end;
+		}
+
+		if ((!reg_dump_desc->num_read_range) ||
+			((cmd_in_data_end - (uintptr_t)reg_dump_desc) <=
+			(uintptr_t)(sizeof(struct cam_reg_dump_desc) +
+			((reg_dump_desc->num_read_range - 1) *
+			sizeof(struct cam_reg_read_info))))) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid number of read ranges, req_id: [%llu] num_read_range: [%d]",
+				req_id, reg_dump_desc->num_read_range);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if ((cmd_buf_end - cmd_buf_start) <= (uintptr_t)
+			(reg_dump_desc->dump_buffer_offset +
+			sizeof(struct cam_reg_dump_out_buffer))) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid out buffer offset: [%d],  cmd_buf_start: [%pK] cmd_buf_end: [%pK]",
+				reg_dump_desc->dump_buffer_offset,
+				(void *)cmd_buf_start, (void *)cmd_buf_end);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		reg_base_type = reg_dump_desc->reg_base_type;
+		if (reg_base_type == 0 || reg_base_type >
+			CAM_REG_DUMP_BASE_TYPE_CAMNOC) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid Reg dump base type: %d",
+				reg_base_type);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		rc = reg_data_cb(reg_base_type, ctx, &soc_info, &reg_base_idx);
+		if (rc || !soc_info) {
+			CAM_ERR(CAM_UTIL,
+				"Reg space data callback failed rc: %d soc_info: [%pK]",
+				rc, soc_info);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		if (reg_base_idx > soc_info->num_reg_map) {
+			CAM_ERR(CAM_UTIL,
+				"Invalid reg base idx: %d num reg map: %d",
+				reg_base_idx, soc_info->num_reg_map);
+			rc = -EINVAL;
+			goto end;
+		}
+
+		CAM_DBG(CAM_UTIL,
+			"Reg data callback success req_id: %llu base_type: %d base_idx: %d num_read_range: %d",
+			req_id, reg_base_type, reg_base_idx,
+			reg_dump_desc->num_read_range);
+
+		/* If the dump request is triggered by user space
+		 * buffer will be different from the buffer which is received
+		 * in init packet. In this case, dump the data to the
+		 * user provided buffer and exit.
+		 */
+		if (user_triggered_dump) {
+			rc = cam_soc_util_user_reg_dump(reg_dump_desc,
+				soc_dump_args, soc_info, reg_base_idx);
+			CAM_INFO(CAM_UTIL,
+				"%s reg_base_idx %d dumped offset %zu",
+				soc_info->dev_name, reg_base_idx,
+				soc_dump_args->offset);
+			goto end;
+		}
+
+		/* Below code is executed when data is dumped to the
+		 * out buffer received in init packet
+		 */
+		dump_out_buf = (struct cam_reg_dump_out_buffer *)
+			(cmd_buf_start +
+			(uintptr_t)reg_dump_desc->dump_buffer_offset);
+		dump_out_buf->req_id = req_id;
+		dump_out_buf->bytes_written = 0;
+
+		for (j = 0; j < reg_dump_desc->num_read_range; j++) {
+			CAM_DBG(CAM_UTIL,
+				"Number of bytes written to cmd buffer: %u req_id: %llu",
+				dump_out_buf->bytes_written, req_id);
+			reg_read_info = &reg_dump_desc->read_range_flex[j];
+			if (reg_read_info->type ==
+				CAM_REG_DUMP_READ_TYPE_CONT_RANGE) {
+				rc = cam_soc_util_dump_cont_reg_range(soc_info,
+					&reg_read_info->reg_read, reg_base_idx,
+					dump_out_buf, cmd_buf_end);
+			} else if (reg_read_info->type ==
+				CAM_REG_DUMP_READ_TYPE_DMI) {
+				rc = cam_soc_util_dump_dmi_reg_range(soc_info,
+					&reg_read_info->dmi_read, reg_base_idx,
+					dump_out_buf, cmd_buf_end);
+			} else {
+				CAM_ERR(CAM_UTIL,
+					"Invalid Reg dump read type: %d",
+					reg_read_info->type);
+				rc = -EINVAL;
+				goto end;
+			}
+
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"Reg range read failed rc: %d reg_base_idx: %d dump_out_buf: %pK",
+					rc, reg_base_idx, dump_out_buf);
+				goto end;
+			}
+		}
+	}
+
+end:
+	cam_mem_put_cpu_buf(cmd_desc->mem_handle);
+	return rc;
+}
+
+/**
+ * cam_soc_util_print_clk_freq()
+ *
+ * @brief:              This function gets the clk rates for each clk from clk
+ *                      driver and prints in log
+ *
+ * @soc_info:           Device soc struct to be populated
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_print_clk_freq(struct cam_hw_soc_info *soc_info)
+{
+	int i;
+	unsigned long clk_rate = 0;
+
+	if (!soc_info) {
+		CAM_ERR(CAM_UTIL, "Invalid soc info");
+		return -EINVAL;
+	}
+
+	if ((soc_info->num_clk == 0) ||
+		(soc_info->num_clk >= CAM_SOC_MAX_CLK)) {
+		CAM_ERR(CAM_UTIL, "[%s] Invalid number of clock %d",
+			soc_info->dev_name, soc_info->num_clk);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < soc_info->num_clk; i++) {
+		clk_rate = clk_get_rate(soc_info->clk[i]);
+
+		CAM_INFO(CAM_UTIL,
+			"[%s] idx = %d clk name = %s clk_rate=%ld",
+			soc_info->dev_name, i, soc_info->clk_name[i],
+			clk_rate);
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_soc_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_soc_util.h
@@ -0,0 +1,790 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_SOC_UTIL_H_
+#define _CAM_SOC_UTIL_H_
+
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/clk.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/regulator/consumer.h>
+#include <linux/debugfs.h>
+#include <linux/of_fdt.h>
+
+#include "cam_io_util.h"
+#include <media/cam_defs.h>
+
+#define NO_SET_RATE  -1
+#define INIT_RATE    -2
+
+/* maximum number of device block */
+#define CAM_SOC_MAX_BLOCK           7
+
+/* maximum number of device base */
+#define CAM_SOC_MAX_BASE            CAM_SOC_MAX_BLOCK
+
+/* maximum number of device regulator */
+#define CAM_SOC_MAX_REGULATOR       10
+
+/* maximum number of device clock */
+#define CAM_SOC_MAX_CLK             32
+
+/* DDR device types */
+#define DDR_TYPE_LPDDR4        6
+#define DDR_TYPE_LPDDR4X       7
+#define DDR_TYPE_LPDDR5        8
+#define DDR_TYPE_LPDDR5X       9
+
+/* Maximum length of tag while dumping */
+#define CAM_SOC_HW_DUMP_TAG_MAX_LEN 32
+
+/**
+ * enum cam_vote_level - Enum for voting level
+ *
+ * @CAM_SUSPEND_VOTE  : Suspend vote
+ * @CAM_MINSVS_VOTE   : Min SVS vote
+ * @CAM_LOWSVS_VOTE   : Low SVS vote
+ * @CAM_SVS_VOTE      : SVS vote
+ * @CAM_SVSL1_VOTE    : SVS Plus vote
+ * @CAM_NOMINAL_VOTE  : Nominal vote
+ * @CAM_NOMINALL1_VOTE: Nominal plus vote
+ * @CAM_TURBO_VOTE    : Turbo vote
+ * @CAM_MAX_VOTE      : Max voting level, This is invalid level.
+ */
+enum cam_vote_level {
+	CAM_SUSPEND_VOTE,
+	CAM_MINSVS_VOTE,
+	CAM_LOWSVS_VOTE,
+	CAM_SVS_VOTE,
+	CAM_SVSL1_VOTE,
+	CAM_NOMINAL_VOTE,
+	CAM_NOMINALL1_VOTE,
+	CAM_TURBO_VOTE,
+	CAM_MAX_VOTE,
+};
+
+/* pinctrl states */
+#define CAM_SOC_PINCTRL_STATE_SLEEP "cam_suspend"
+#define CAM_SOC_PINCTRL_STATE_DEFAULT "cam_default"
+
+/**
+ * struct cam_soc_reg_map:   Information about the mapped register space
+ *
+ * @mem_base:               Starting location of MAPPED register space
+ * @mem_cam_base:           Starting offset of this register space compared
+ *                          to ENTIRE Camera register space
+ * @size:                   Size of register space
+ **/
+struct cam_soc_reg_map {
+	void __iomem                   *mem_base;
+	uint32_t                        mem_cam_base;
+	resource_size_t                 size;
+};
+
+/**
+ * struct cam_soc_pinctrl_info:   Information about pinctrl data
+ *
+ * @pinctrl:               pintrl object
+ * @gpio_state_active:     default pinctrl state
+ * @gpio_state_suspend     suspend state of pinctrl
+ **/
+struct cam_soc_pinctrl_info {
+	struct pinctrl *pinctrl;
+	struct pinctrl_state *gpio_state_active;
+	struct pinctrl_state *gpio_state_suspend;
+};
+
+/**
+ * struct cam_soc_gpio_data:   Information about the gpio pins
+ *
+ * @cam_gpio_common_tbl:       It is list of al the gpios present in gpios node
+ * @cam_gpio_common_tbl_size:  It is equal to number of gpios prsent in
+ *                             gpios node in DTSI
+ * @cam_gpio_req_tbl            It is list of al the requesetd gpios
+ * @cam_gpio_req_tbl_size:      It is size of requested gpios
+ **/
+struct cam_soc_gpio_data {
+	struct gpio *cam_gpio_common_tbl;
+	uint8_t cam_gpio_common_tbl_size;
+	struct gpio *cam_gpio_req_tbl;
+	uint8_t cam_gpio_req_tbl_size;
+};
+
+/**
+ * struct cam_hw_soc_info:  Soc information pertaining to specific instance of
+ *                          Camera hardware driver module
+ *
+ * @pdev:                   Platform device pointer
+ * @device:                 Device pointer
+ * @hw_version:             Camera device version
+ * @index:                  Instance id for the camera device
+ * @dev_name:               Device Name
+ * @irq_name:               Name of the irq associated with the device
+ * @label_name:             label name
+ * @irq_line:               Irq resource
+ * @irq_num:                Irq number
+ * @irq_data:               Private data that is passed when IRQ is requested
+ * @compatible:             Compatible string associated with the device
+ * @num_mem_block:          Number of entry in the "reg-names"
+ * @mem_block_name:         Array of the reg block name
+ * @mem_block_cam_base:     Array of offset of this register space compared
+ *                          to ENTIRE Camera register space
+ * @mem_block:              Associated resource structs
+ * @reg_map:                Array of Mapped register info for the "reg-names"
+ * @num_reg_map:            Number of mapped register space associated
+ *                          with mem_block. num_reg_map = num_mem_block in
+ *                          most cases
+ * @reserve_mem:            Whether to reserve memory for Mem blocks
+ * @num_rgltr:              Number of regulators
+ * @rgltr_name:             Array of regulator names
+ * @rgltr_ctrl_support:     Whether regulator control is supported
+ * @rgltr_min_volt:         Array of minimum regulator voltage
+ * @rgltr_max_volt:         Array of maximum regulator voltage
+ * @rgltr_op_mode:          Array of regulator operation mode
+ * @rgltr_type:             Array of regulator names
+ * @rgltr:                  Array of associated regulator resources
+ * @rgltr_delay:            Array of regulator delay values
+ * @num_clk:                Number of clocks
+ * @clk_name:               Array of clock names
+ * @clk:                    Array of associated clock resources
+ * @clk_rate:               2D array of clock rates representing clock rate
+ *                          values at different vote levels
+ * @prev_clk_level          Last vote level
+ * @src_clk_idx:            Source clock index that is rate-controllable
+ * @clk_level_valid:        Indicates whether corresponding level is valid
+ * @scl_clk_count:          Number of scalable clocks present
+ * @scl_clk_idx:            Index of scalable clocks
+ * @applied_src_clk_rate    Current clock rate of the core source clk
+ * @gpio_data:              Pointer to gpio info
+ * @pinctrl_info:           Pointer to pinctrl info
+ * @dentry:                 Debugfs entry
+ * @clk_level_override:     Clk level set from debugfs
+ * @clk_control:            Enable/disable clk rate control through debugfs
+ * @cam_cx_ipeak_enable     cx-ipeak enable/disable flag
+ * @cam_cx_ipeak_bit        cx-ipeak mask for driver
+ * @soc_private:            Soc private data
+ */
+struct cam_hw_soc_info {
+	struct platform_device         *pdev;
+	struct device                  *dev;
+	uint32_t                        hw_version;
+	uint32_t                        index;
+	const char                     *dev_name;
+	const char                     *irq_name;
+	const char                     *label_name;
+	struct resource                *irq_line;
+	int                             irq_num;
+	void                           *irq_data;
+	const char                     *compatible;
+
+	uint32_t                        num_mem_block;
+	const char                     *mem_block_name[CAM_SOC_MAX_BLOCK];
+	uint32_t                        mem_block_cam_base[CAM_SOC_MAX_BLOCK];
+	struct resource                *mem_block[CAM_SOC_MAX_BLOCK];
+	struct cam_soc_reg_map          reg_map[CAM_SOC_MAX_BASE];
+	uint32_t                        num_reg_map;
+	uint32_t                        reserve_mem;
+
+	uint32_t                        num_rgltr;
+	const char                     *rgltr_name[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_ctrl_support;
+	uint32_t                        rgltr_min_volt[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_max_volt[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_op_mode[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_type[CAM_SOC_MAX_REGULATOR];
+	struct regulator               *rgltr[CAM_SOC_MAX_REGULATOR];
+	uint32_t                        rgltr_delay[CAM_SOC_MAX_REGULATOR];
+
+	int32_t                         num_genpd;
+	struct device                 **genpd;
+
+	uint32_t                        use_shared_clk;
+	uint32_t                        num_clk;
+	const char                     *clk_name[CAM_SOC_MAX_CLK];
+	struct clk                     *clk[CAM_SOC_MAX_CLK];
+	int32_t                         clk_rate[CAM_MAX_VOTE][CAM_SOC_MAX_CLK];
+	int32_t                         prev_clk_level;
+	int32_t                         src_clk_idx;
+	unsigned long                   applied_src_clk_rate;
+	bool                            clk_level_valid[CAM_MAX_VOTE];
+	int32_t                         scl_clk_count;
+	int32_t                         scl_clk_idx[CAM_SOC_MAX_CLK];
+
+	struct cam_soc_gpio_data       *gpio_data;
+	struct cam_soc_pinctrl_info     pinctrl_info;
+
+	struct dentry                  *dentry;
+	uint32_t                        clk_level_override;
+	bool                            clk_control_enable;
+	bool                            cam_cx_ipeak_enable;
+	int32_t                         cam_cx_ipeak_bit;
+
+	void                           *soc_private;
+};
+
+/**
+ * struct cam_hw_soc_dump_header - SOC dump header
+ *
+ * @Brief:        soc hw dump header
+ *
+ * @tag:          Tag name for the header
+ * @word_size:    Size of each word
+ * @size:         Total size of dumped data
+ */
+struct cam_hw_soc_dump_header {
+	uint8_t   tag[CAM_SOC_HW_DUMP_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * struct cam_hw_soc_dump_args:   SOC Dump args
+ *
+ * @request_id:          Issue request id
+ * @offset:              Buffer offset, updated as the informaton is dumped
+ * @buf_handle:          Buffer handle of the out buffer
+ */
+struct cam_hw_soc_dump_args {
+	uint64_t             request_id;
+	size_t               offset;
+	uint32_t             buf_handle;
+};
+
+/*
+ * CAM_SOC_GET_REG_MAP_START
+ *
+ * @brief:              This MACRO will get the mapped starting address
+ *                      where the register space can be accessed
+ *
+ * @__soc_info:         Device soc information
+ * @__base_index:       Index of register space in the HW block
+ *
+ * @return:             Returns a pointer to the mapped register memory
+ */
+#define CAM_SOC_GET_REG_MAP_START(__soc_info, __base_index)          \
+	((!__soc_info || __base_index >= __soc_info->num_reg_map) ?  \
+		NULL : __soc_info->reg_map[__base_index].mem_base)
+
+/*
+ * CAM_SOC_GET_REG_MAP_CAM_BASE
+ *
+ * @brief:              This MACRO will get the cam_base of the
+ *                      register space
+ *
+ * @__soc_info:         Device soc information
+ * @__base_index:       Index of register space in the HW block
+ *
+ * @return:             Returns an int32_t value.
+ *                        Failure: -1
+ *                        Success: Starting offset of register space compared
+ *                                 to entire Camera Register Map
+ */
+#define CAM_SOC_GET_REG_MAP_CAM_BASE(__soc_info, __base_index)       \
+	((!__soc_info || __base_index >= __soc_info->num_reg_map) ?  \
+		-1 : __soc_info->reg_map[__base_index].mem_cam_base)
+
+/*
+ * CAM_SOC_GET_REG_MAP_SIZE
+ *
+ * @brief:              This MACRO will get the size of the mapped
+ *                      register space
+ *
+ * @__soc_info:         Device soc information
+ * @__base_index:       Index of register space in the HW block
+ *
+ * @return:             Returns a uint32_t value.
+ *                        Failure: 0
+ *                        Success: Non-zero size of mapped register space
+ */
+#define CAM_SOC_GET_REG_MAP_SIZE(__soc_info, __base_index)           \
+	((!__soc_info || __base_index >= __soc_info->num_reg_map) ?  \
+		0 : __soc_info->reg_map[__base_index].size)
+
+/**
+ * cam_soc_util_get_level_from_string()
+ *
+ * @brief:              Get the associated vote level for the input string
+ *
+ * @string:             Input string to compare with.
+ * @level:              Vote level corresponds to input string.
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_get_level_from_string(const char *string,
+	enum cam_vote_level *level);
+
+/**
+ * cam_soc_util_get_dt_properties()
+ *
+ * @brief:              Parse the DT and populate the common properties that
+ *                      are part of the soc_info structure - register map,
+ *                      clocks, regulators, irq, etc.
+ *
+ * @soc_info:           Device soc struct to be populated
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_get_dt_properties(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_request_platform_resource()
+ *
+ * @brief:              Request regulator, irq, and clock resources
+ *
+ * @soc_info:           Device soc information
+ * @handler:            Irq handler function pointer
+ * @irq_data:           Irq handler function CB data
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_request_platform_resource(struct cam_hw_soc_info *soc_info,
+	irq_handler_t handler, void *irq_data);
+
+/**
+ * cam_soc_util_release_platform_resource()
+ *
+ * @brief:              Release regulator, irq, and clock resources
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_release_platform_resource(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_enable_platform_resource()
+ *
+ * @brief:              Enable regulator, irq resources
+ *
+ * @soc_info:           Device soc information
+ * @enable_clocks:      Boolean flag:
+ *                          TRUE: Enable all clocks in soc_info Now.
+ *                          False: Don't enable clocks Now. Driver will
+ *                                 enable independently.
+ * @clk_level:          Clock level to be applied.
+ *                      Applicable only if enable_clocks is true
+ *                          Valid range : 0 to (CAM_MAX_VOTE - 1)
+ * @enable_irq:         Boolean flag:
+ *                          TRUE: Enable IRQ in soc_info Now.
+ *                          False: Don't enable IRQ Now. Driver will
+ *                                 enable independently.
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_enable_platform_resource(struct cam_hw_soc_info *soc_info,
+	bool enable_clocks, enum cam_vote_level clk_level, bool enable_irq);
+
+/**
+ * cam_soc_util_disable_platform_resource()
+ *
+ * @brief:              Disable regulator, irq resources
+ *
+ * @soc_info:           Device soc information
+ * @disable_irq:        Boolean flag:
+ *                          TRUE: Disable IRQ in soc_info Now.
+ *                          False: Don't disable IRQ Now. Driver will
+ *                                 disable independently.
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_disable_platform_resource(struct cam_hw_soc_info *soc_info,
+	bool disable_clocks, bool disable_irq);
+
+/**
+ * cam_soc_util_get_clk_round_rate()
+ *
+ * @brief:              Get the rounded clock rate for the given clock's
+ *                      clock rate value
+ *
+ * @soc_info:           Device soc information
+ * @clk_index:          Clock index in soc_info for which round rate is needed
+ * @clk_rate:           Input clock rate for which rounded rate is needed
+ *
+ * @return:             Rounded clock rate
+ */
+long cam_soc_util_get_clk_round_rate(struct cam_hw_soc_info *soc_info,
+	uint32_t clk_index, unsigned long clk_rate);
+
+/**
+ * cam_soc_util_get_clk_rate()
+ *
+ * @brief:              Get the rate on the source clock.
+ * @clk:                Src clock reference pointer to get clock rate
+ * @clk_name:           Name of src clock
+ * @clk_rate:           Clock rate associated with the src clk
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_get_clk_rate(struct clk *clk, const char *clk_name,
+	uint32_t *clk_rate);
+
+/**
+ * cam_soc_util_set_src_clk_rate()
+ *
+ * @brief:              Set the rate on the source clock.
+ *
+ * @soc_info:           Device soc information
+ * @clk_rate:           Clock rate associated with the src clk
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_set_src_clk_rate(struct cam_hw_soc_info *soc_info,
+	int64_t clk_rate);
+
+/**
+ * cam_soc_util_get_option_clk_by_name()
+ *
+ * @brief:              Get reference to optional clk using name
+ *
+ * @soc_info:           Device soc information
+ * @clk_name:           Name of clock to find reference for
+ * @clk:                Clock reference pointer to be filled if Success
+ * @clk_index:          Clk index in the option clk array to be returned
+ * @clk_rate:           Clk rate in the option clk array
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_soc_util_get_option_clk_by_name(struct cam_hw_soc_info *soc_info,
+	const char *clk_name, struct clk **clk, int32_t *clk_index,
+	int32_t *clk_rate);
+
+/**
+ * cam_soc_util_clk_put()
+ *
+ * @brief:              Put clock specified in params
+ *
+ * @clk:                Reference to the Clock that needs to be put
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_clk_put(struct clk **clk);
+
+/**
+ * cam_soc_util_clk_enable()
+ *
+ * @brief:              Enable clock specified in params
+ *
+ * @clk:                Clock that needs to be turned ON
+ * @clk_name:           Clocks name associated with clk
+ * @clk_rate:           Clocks rate associated with clk
+ * @applied_clock_rate  Final Clock rate applied to the clk
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_clk_enable(struct clk *clk, const char *clk_name,
+	int32_t clk_rate, unsigned long *applied_clock_rate);
+
+/**
+ * cam_soc_util_set_clk_rate_level()
+ *
+ * @brief:              Apply clock rates for the requested level.
+ *                      This applies the new requested level for all
+ *                      the clocks listed in DT based on their values.
+ *
+ * @soc_info:           Device soc information
+ * @clk_level:          Clock level number to set
+ * @do_not_set_src_clk: If true, set clock rates except the src clk
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_set_clk_rate_level(struct cam_hw_soc_info *soc_info,
+	enum cam_vote_level clk_level, bool do_not_set_src_clk);
+
+/**
+ * cam_soc_util_clk_disable()
+ *
+ * @brief:              Disable clock specified in params
+ *
+ * @clk:                Clock that needs to be turned OFF
+ * @clk_name:           Clocks name associated with clk
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_clk_disable(struct clk *clk, const char *clk_name);
+
+/**
+ * cam_soc_util_irq_enable()
+ *
+ * @brief:              Enable IRQ in SOC
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_irq_enable(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_irq_disable()
+ *
+ * @brief:              Disable IRQ in SOC
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_irq_disable(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_regulator_enable()
+ *
+ * @brief:              Enable single regulator
+ *
+ * @rgltr               Regulator that needs to be turned ON
+ * @rgltr_name          Associated Regulator name
+ * @rgltr_min_volt:     Requested minimum volatage
+ * @rgltr_max_volt:     Requested maximum volatage
+ * @rgltr_op_mode:      Requested Load
+ * @rgltr_delay:        Requested delay needed aaftre enabling regulator
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_regulator_enable(struct regulator *rgltr,
+	const char *rgltr_name,
+	uint32_t rgltr_min_volt, uint32_t rgltr_max_volt,
+	uint32_t rgltr_op_mode, uint32_t rgltr_delay);
+
+/**
+ * cam_soc_util_regulator_enable()
+ *
+ * @brief:              Disable single regulator
+ *
+ * @rgltr               Regulator that needs to be turned ON
+ * @rgltr_name          Associated Regulator name
+ * @rgltr_min_volt:     Requested minimum volatage
+ * @rgltr_max_volt:     Requested maximum volatage
+ * @rgltr_op_mode:      Requested Load
+ * @rgltr_delay:        Requested delay needed aaftre enabling regulator
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_regulator_disable(struct regulator *rgltr,
+	const char *rgltr_name,
+	uint32_t rgltr_min_volt, uint32_t rgltr_max_volt,
+	uint32_t rgltr_op_mode, uint32_t rgltr_delay);
+
+/**
+ * cam_soc_util_configure_pd()
+ *
+ * @brief:              Configure power domain
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_configure_pd(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_power_domain_enable_default()
+ *
+ * @brief:              Enable power domain
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_power_domain_enable_default(
+	struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_power_domain_disable_default()
+ *
+ * @brief:              Disable power domain
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Null
+ */
+void cam_soc_util_power_domain_disable_default(
+	struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_configure_opp()
+ *
+ * @brief:              Configure OPP (operating performance points)
+ *
+ * @soc_info:           Device soc information
+ *
+ * @return:             Success or failure
+ */
+int cam_soc_util_configure_opp(struct cam_hw_soc_info *soc_info);
+
+/**
+ * cam_soc_util_w()
+ *
+ * @brief:              Camera SOC util for register write
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Offset of register to be read
+ * @data:               Value to be written
+ *
+ * @return:             Success or Failure
+ */
+static inline int cam_soc_util_w(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset, uint32_t data)
+{
+	if (!CAM_SOC_GET_REG_MAP_START(soc_info, base_index))
+		return -EINVAL;
+	return cam_io_w(data,
+		CAM_SOC_GET_REG_MAP_START(soc_info, base_index) + offset);
+}
+
+/**
+ * cam_soc_util_w_mb()
+ *
+ * @brief:              Camera SOC util for register write with memory barrier.
+ *                      Memory Barrier is only before the write to ensure the
+ *                      order. If need to ensure this write is also flushed
+ *                      call wmb() independently in the caller.
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Offset of register to be read
+ * @data:               Value to be written
+ *
+ * @return:             Success or Failure
+ */
+static inline int cam_soc_util_w_mb(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset, uint32_t data)
+{
+	if (!CAM_SOC_GET_REG_MAP_START(soc_info, base_index))
+		return -EINVAL;
+	return cam_io_w_mb(data,
+		CAM_SOC_GET_REG_MAP_START(soc_info, base_index) + offset);
+}
+
+/**
+ * cam_soc_util_r()
+ *
+ * @brief:              Camera SOC util for register read
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Offset of register to be read
+ *
+ * @return:             Value read from the register address
+ */
+static inline uint32_t cam_soc_util_r(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset)
+{
+	if (!CAM_SOC_GET_REG_MAP_START(soc_info, base_index))
+		return 0;
+	return cam_io_r(
+		CAM_SOC_GET_REG_MAP_START(soc_info, base_index) + offset);
+}
+
+/**
+ * cam_soc_util_r_mb()
+ *
+ * @brief:              Camera SOC util for register read with memory barrier.
+ *                      Memory Barrier is only before the write to ensure the
+ *                      order. If need to ensure this write is also flushed
+ *                      call rmb() independently in the caller.
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Offset of register to be read
+ *
+ * @return:             Value read from the register address
+ */
+static inline uint32_t cam_soc_util_r_mb(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset)
+{
+	if (!CAM_SOC_GET_REG_MAP_START(soc_info, base_index))
+		return 0;
+	return cam_io_r_mb(
+		CAM_SOC_GET_REG_MAP_START(soc_info, base_index) + offset);
+}
+
+/**
+ * cam_soc_util_reg_dump()
+ *
+ * @brief:              Camera SOC util for dumping a range of register
+ *
+ * @soc_info:           Device soc information
+ * @base_index:         Index of register space in the HW block
+ * @offset:             Start register offset for the dump
+ * @size:               Size specifying the range for dump
+ *
+ * @return:             Success or Failure
+ */
+int cam_soc_util_reg_dump(struct cam_hw_soc_info *soc_info,
+	uint32_t base_index, uint32_t offset, int size);
+
+void cam_soc_util_clk_disable_default(struct cam_hw_soc_info *soc_info);
+
+int cam_soc_util_clk_enable_default(struct cam_hw_soc_info *soc_info,
+	enum cam_vote_level clk_level);
+
+int cam_soc_util_get_clk_level(struct cam_hw_soc_info *soc_info,
+	int64_t clk_rate, int clk_idx, int32_t *clk_lvl);
+
+unsigned long cam_soc_util_get_clk_rate_applied(
+	struct cam_hw_soc_info *soc_info, int32_t index, bool is_src,
+	enum cam_vote_level clk_level);
+
+/* Callback to get reg space data for specific HW */
+typedef int (*cam_soc_util_regspace_data_cb)(uint32_t reg_base_type,
+	void *ctx, struct cam_hw_soc_info **soc_info_ptr,
+	uint32_t *reg_base_idx);
+
+/**
+ * cam_soc_util_reg_dump_to_cmd_buf()
+ *
+ * @brief:                 Camera SOC util for dumping sets of register ranges
+ *                         command buffer
+ *
+ * @ctx:                   Context info from specific hardware manager
+ * @cmd_desc:              Command buffer descriptor
+ * @req_id:                Last applied req id for which reg dump is required
+ * @reg_data_cb:           Callback function to get reg space info based on type
+ *                         in command buffer
+ * @soc_dump_args:         Dump buffer args to dump the soc information.
+ * @user_triggered_dump:   Flag to indicate if the dump request is issued by
+ *                         user.
+ * @return:                Success or Failure
+ */
+int cam_soc_util_reg_dump_to_cmd_buf(void *ctx,
+	struct cam_cmd_buf_desc *cmd_desc, uint64_t req_id,
+	cam_soc_util_regspace_data_cb reg_data_cb,
+	struct cam_hw_soc_dump_args *soc_dump_args,
+	bool user_triggered_dump);
+
+/**
+ * cam_soc_util_get_applied_src_clk()
+ *
+ * @brief:              Inline function to get applied src clk rate.
+
+ * @soc_info:           Device soc struct to be populated
+ * @is_max:             Is max of all hw clients if cesta is enabled
+ *
+ * @return:             success or failure
+ */
+static inline unsigned long cam_soc_util_get_applied_src_clk(
+	struct cam_hw_soc_info *soc_info, bool is_max)
+{
+	return -EINVAL;
+}
+
+/**
+ * cam_soc_util_print_clk_freq()
+ *
+ * @brief:              This function gets the clk rates for each clk from clk
+ *                      driver and prints in log
+ *
+ * @soc_info:           Device soc struct to be populated
+ *
+ * @return:             success or failure
+ */
+int cam_soc_util_print_clk_freq(struct cam_hw_soc_info *soc_info);
+
+#endif /* _CAM_SOC_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_trace.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_trace.c
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+/* Instantiate tracepoints */
+#define CREATE_TRACE_POINTS
+#include "cam_trace.h"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_trace.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/cam_utils/cam_trace.h
@@ -0,0 +1,394 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#if !defined(_CAM_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _CAM_TRACE_H
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM camera
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE ./cam_trace
+
+#include <linux/tracepoint.h>
+#include <media/cam_req_mgr.h>
+#include "cam_req_mgr_core.h"
+#include "cam_req_mgr_interface.h"
+#include "cam_context.h"
+
+#define CAM_DEFAULT_VALUE 0xFF
+#define CAM_TRACE_PRINT_MAX_LEN 512
+
+TRACE_EVENT(cam_context_state,
+	TP_PROTO(const char *name, struct cam_context *ctx),
+	TP_ARGS(name, ctx),
+	TP_STRUCT__entry(
+		__field(void*, ctx)
+		__field(uint32_t, state)
+		__string(name, name)
+	),
+	TP_fast_assign(
+		__entry->ctx = ctx;
+		__entry->state = ctx->state;
+		__assign_str(name, name);
+	),
+	TP_printk(
+		"%s: State ctx=%p ctx_state=%u",
+			__get_str(name), __entry->ctx, __entry->state
+	)
+);
+
+TRACE_EVENT(cam_isp_activated_irq,
+	TP_PROTO(struct cam_context *ctx, unsigned int substate,
+		unsigned int event, uint64_t timestamp),
+	TP_ARGS(ctx, substate, event, timestamp),
+	TP_STRUCT__entry(
+		__field(void*, ctx)
+		__field(uint32_t, state)
+		__field(uint32_t, substate)
+		__field(uint32_t, event)
+		__field(uint64_t, ts)
+	),
+	TP_fast_assign(
+		__entry->ctx = ctx;
+		__entry->state = ctx->state;
+		__entry->substate = substate;
+		__entry->event = event;
+		__entry->ts = timestamp;
+	),
+	TP_printk(
+		"ISP: IRQ ctx=%p ctx_state=%u substate=%u event=%u ts=%llu",
+			__entry->ctx, __entry->state, __entry->substate,
+			__entry->event, __entry->ts
+	)
+);
+
+TRACE_EVENT(cam_log_event,
+	TP_PROTO(const char *string1, const char *string2,
+		uint64_t val1, uint64_t val2),
+	TP_ARGS(string1, string2, val1, val2),
+	TP_STRUCT__entry(
+		__string(string1, string1)
+		__string(string2, string2)
+		__field(uint64_t, val1)
+		__field(uint64_t, val2)
+	),
+	TP_fast_assign(
+		__assign_str(string1, string1);
+		__assign_str(string2, string2);
+		__entry->val1 = val1;
+		__entry->val2 = val2;
+	),
+	TP_printk(
+		"%s: %s val1=%llu val2=%llu",
+			__get_str(string1), __get_str(string2),
+			__entry->val1, __entry->val2
+	)
+);
+
+TRACE_EVENT(cam_log_debug,
+	TP_PROTO(const char *fmt, va_list *args),
+	TP_ARGS(fmt, args),
+	TP_STRUCT__entry(
+		__dynamic_array(char, msg, CAM_TRACE_PRINT_MAX_LEN)
+	),
+	TP_fast_assign(
+		va_list ap;
+
+		va_copy(ap, *args);
+		vsnprintf(__get_dynamic_array(msg), CAM_TRACE_PRINT_MAX_LEN, fmt, ap);
+		va_end(ap);
+	),
+	TP_printk("%s", __get_str(msg))
+);
+
+TRACE_EVENT(cam_icp_fw_dbg,
+	TP_PROTO(char *dbg_message, uint64_t timestamp),
+	TP_ARGS(dbg_message, timestamp),
+	TP_STRUCT__entry(
+		__string(dbg_message, dbg_message)
+		__field(uint64_t, timestamp)
+	),
+	TP_fast_assign(
+		__assign_str(dbg_message, dbg_message);
+		__entry->timestamp = timestamp;
+	),
+	TP_printk(
+		"%llu %s: ",
+		 __entry->timestamp, __get_str(dbg_message)
+	)
+);
+
+TRACE_EVENT(cam_buf_done,
+	TP_PROTO(const char *ctx_type, struct cam_context *ctx,
+		struct cam_ctx_request *req),
+	TP_ARGS(ctx_type, ctx, req),
+	TP_STRUCT__entry(
+		__string(ctx_type, ctx_type)
+		__field(void*, ctx)
+		__field(uint64_t, request)
+	),
+	TP_fast_assign(
+		__assign_str(ctx_type, ctx_type);
+		__entry->ctx = ctx;
+		__entry->request = req->request_id;
+	),
+	TP_printk(
+		"%5s: BufDone ctx=%p request=%llu",
+			__get_str(ctx_type), __entry->ctx, __entry->request
+	)
+);
+
+TRACE_EVENT(cam_apply_req,
+	TP_PROTO(const char *entity, uint64_t req_id),
+	TP_ARGS(entity, req_id),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint64_t, req_id)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->req_id = req_id;
+	),
+	TP_printk(
+		"%8s: ApplyRequest request=%llu",
+			__get_str(entity), __entry->req_id
+	)
+);
+
+TRACE_EVENT(cam_notify_frame_skip,
+	TP_PROTO(const char *entity, uint64_t req_id),
+	TP_ARGS(entity, req_id),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint64_t, req_id)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->req_id = req_id;
+	),
+	TP_printk(
+		"%8s: NotifyFrameSkip request=%llu",
+			__get_str(entity), __entry->req_id
+	)
+);
+
+TRACE_EVENT(cam_flush_req,
+	TP_PROTO(struct cam_req_mgr_core_link *link,
+		struct cam_req_mgr_flush_info *info),
+	TP_ARGS(link, info),
+	TP_STRUCT__entry(
+		__field(uint32_t, type)
+		__field(int64_t, req_id)
+		__field(void*, link)
+		__field(void*, session)
+	),
+	TP_fast_assign(
+		__entry->type    = info->flush_type;
+		__entry->req_id  = info->req_id;
+		__entry->link    = link;
+		__entry->session = link->parent;
+	),
+	TP_printk(
+		"FlushRequest type=%u request=%llu link=%pK session=%pK",
+			__entry->type, __entry->req_id, __entry->link,
+			__entry->session
+	)
+);
+
+TRACE_EVENT(cam_req_mgr_connect_device,
+	TP_PROTO(struct cam_req_mgr_core_link *link,
+		struct cam_req_mgr_device_info *info),
+	TP_ARGS(link, info),
+	TP_STRUCT__entry(
+		__string(name, info->name)
+		__field(uint32_t, id)
+		__field(uint32_t, delay)
+		__field(void*, link)
+		__field(void*, session)
+	),
+	TP_fast_assign(
+		__assign_str(name, info->name);
+		__entry->id      = info->dev_id;
+		__entry->delay   = info->p_delay;
+		__entry->link    = link;
+		__entry->session = link->parent;
+	),
+	TP_printk(
+		"ReqMgr Connect name=%s id=%u pd=%d link=%pK session=%pK",
+			__get_str(name), __entry->id, __entry->delay,
+			__entry->link, __entry->session
+	)
+);
+
+TRACE_EVENT(cam_req_mgr_apply_request,
+	TP_PROTO(struct cam_req_mgr_core_link *link,
+		struct cam_req_mgr_apply_request *req,
+		struct cam_req_mgr_connected_device *dev),
+	TP_ARGS(link, req, dev),
+	TP_STRUCT__entry(
+		__string(name, dev->dev_info.name)
+		__field(uint32_t, dev_id)
+		__field(uint64_t, req_id)
+		__field(void*, link)
+		__field(void*, session)
+	),
+	TP_fast_assign(
+		__assign_str(name, dev->dev_info.name);
+		__entry->dev_id  = dev->dev_info.dev_id;
+		__entry->req_id  = req->request_id;
+		__entry->link    = link;
+		__entry->session = link->parent;
+	),
+	TP_printk(
+		"ReqMgr ApplyRequest devname=%s devid=%u request=%lld link=%pK session=%pK",
+			__get_str(name), __entry->dev_id, __entry->req_id,
+			__entry->link, __entry->session
+	)
+);
+
+TRACE_EVENT(cam_req_mgr_add_req,
+	TP_PROTO(struct cam_req_mgr_core_link *link,
+		int idx, struct cam_req_mgr_add_request *add_req,
+		struct cam_req_mgr_req_tbl *tbl,
+		struct cam_req_mgr_connected_device *dev),
+	TP_ARGS(link, idx, add_req, tbl, dev),
+	TP_STRUCT__entry(
+		__string(name, dev->dev_info.name)
+		__field(uint32_t, dev_id)
+		__field(uint64_t, req_id)
+		__field(uint32_t, slot_id)
+		__field(uint32_t, delay)
+		__field(uint32_t, readymap)
+		__field(uint32_t, devicemap)
+		__field(void*, link)
+		__field(void*, session)
+	),
+	TP_fast_assign(
+		__assign_str(name, dev->dev_info.name);
+		__entry->dev_id    = dev->dev_info.dev_id;
+		__entry->req_id    = add_req->req_id;
+		__entry->slot_id   = idx;
+		__entry->delay     = tbl->pd;
+		__entry->readymap  = tbl->slot[idx].req_ready_map;
+		__entry->devicemap = tbl->dev_mask;
+		__entry->link      = link;
+		__entry->session   = link->parent;
+	),
+	TP_printk(
+		"ReqMgr AddRequest devname=%s devid=%d request=%lld slot=%d pd=%d readymap=%x devicemap=%d link=%pK session=%pK",
+			__get_str(name), __entry->dev_id, __entry->req_id,
+			__entry->slot_id, __entry->delay, __entry->readymap,
+			__entry->devicemap, __entry->link, __entry->session
+	)
+);
+
+TRACE_EVENT(cam_delay_detect,
+	TP_PROTO(const char *entity,
+		const char *text, uint64_t req_id,
+		uint32_t ctx_id, int32_t link_hdl,
+		int32_t session_hdl, int rc),
+	TP_ARGS(entity, text, req_id, ctx_id,
+		link_hdl, session_hdl, rc),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__string(text, text)
+		__field(uint64_t, req_id)
+		__field(uint32_t, ctx_id)
+		__field(int32_t, link_hdl)
+		__field(int32_t, session_hdl)
+		__field(int32_t, rc)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__assign_str(text, text);
+		__entry->req_id      = req_id;
+		__entry->ctx_id      = ctx_id;
+		__entry->link_hdl    = link_hdl;
+		__entry->session_hdl = session_hdl;
+		__entry->rc          = rc;
+	),
+	TP_printk(
+		"%s: %s request=%llu ctx_id=%d link_hdl=0x%x session_hdl=0x%x rc=%u",
+			__get_str(entity), __get_str(text), __entry->req_id,
+			__entry->ctx_id, __entry->link_hdl,
+			__entry->session_hdl, __entry->rc
+	)
+);
+
+TRACE_EVENT(cam_submit_to_hw,
+	TP_PROTO(const char *entity, uint64_t req_id),
+	TP_ARGS(entity, req_id),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint64_t, req_id)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->req_id = req_id;
+	),
+	TP_printk(
+		"%8s: submit request=%llu",
+			__get_str(entity), __entry->req_id
+	)
+);
+
+TRACE_EVENT(cam_irq_activated,
+	TP_PROTO(const char *entity, uint32_t irq_type),
+	TP_ARGS(entity, irq_type),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint32_t, irq_type)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->irq_type = irq_type;
+	),
+	TP_printk(
+		"%8s: got irq type=%d",
+			__get_str(entity), __entry->irq_type
+	)
+);
+
+TRACE_EVENT(cam_irq_handled,
+	TP_PROTO(const char *entity, uint32_t irq_type),
+	TP_ARGS(entity, irq_type),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint32_t, irq_type)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->irq_type = irq_type;
+	),
+	TP_printk(
+		"%8s: handled irq type=%d",
+			__get_str(entity), __entry->irq_type
+	)
+);
+
+TRACE_EVENT(cam_cdm_cb,
+	TP_PROTO(const char *entity, uint32_t status),
+	TP_ARGS(entity, status),
+	TP_STRUCT__entry(
+		__string(entity, entity)
+		__field(uint32_t, status)
+	),
+	TP_fast_assign(
+		__assign_str(entity, entity);
+		__entry->status = status;
+	),
+	TP_printk(
+		"%8s: cdm cb status=%d",
+			__get_str(entity), __entry->status
+	)
+);
+
+#endif /* _CAM_TRACE_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/camera_main.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/camera_main.c
@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/module.h>
+#include <linux/build_bug.h>
+
+#include "cam_req_mgr_dev.h"
+#include "cam_sync_api.h"
+#include "cam_smmu_api.h"
+#include "cam_cpas_hw_intf.h"
+#include "cam_cdm_intf_api.h"
+
+#include "cam_ife_csid_dev.h"
+#include "cam_vfe.h"
+
+#ifdef CONFIG_SPECTRA_SFE
+#include "cam_sfe_dev.h"
+#endif /* CONFIG_SPECTRA_SFE */
+
+#include "cam_isp_dev.h"
+
+#include "cam_res_mgr_api.h"
+#include "cam_cci_dev.h"
+#include "cam_sensor_dev.h"
+#include "cam_actuator_dev.h"
+#include "cam_csiphy_dev.h"
+#include "cam_eeprom_dev.h"
+#include "cam_ois_dev.h"
+#include "cam_hdmi_bdg_core.h"
+#include "cam_dp_bdg_core.h"
+#include "cam_ir_led_dev.h"
+
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2) || \
+	IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+#include "cam_flash_dev.h"
+#endif
+
+#include "a5_core.h"
+#include "ipe_core.h"
+#include "bps_core.h"
+#include "cam_icp_subdev.h"
+
+#include "jpeg_dma_core.h"
+#include "jpeg_enc_core.h"
+#include "cam_jpeg_dev.h"
+
+#include "cam_fd_hw_intf.h"
+#include "cam_fd_dev.h"
+
+#include "cam_lrme_hw_intf.h"
+#include "cam_lrme_dev.h"
+
+#include "cam_custom_dev.h"
+#include "cam_custom_csid_dev.h"
+#include "cam_custom_sub_mod_dev.h"
+
+#include "cam_debug_util.h"
+
+#include "ope_dev_intf.h"
+
+#include "cam_top_tpg.h"
+
+#ifdef CONFIG_SPECTRA_TFE
+#include "cam_tfe_dev.h"
+#include "cam_tfe_csid530.h"
+#include "cam_csid_ppi100.h"
+#endif /* CONFIG_SPECTRA_TFE */
+
+#include "camera_main.h"
+
+struct camera_submodule_component {
+	int (*init)(void);
+	void (*exit)(void);
+};
+
+struct camera_submodule {
+	char *name;
+	uint num_component;
+	const struct camera_submodule_component *component;
+};
+
+static const struct camera_submodule_component camera_base[] = {
+	{&cam_req_mgr_init, &cam_req_mgr_exit},
+	{&cam_sync_init, &cam_sync_exit},
+	{&cam_smmu_init_module, &cam_smmu_exit_module},
+	{&cam_cpas_dev_init_module, &cam_cpas_dev_exit_module},
+	{&cam_cdm_intf_init_module, &cam_cdm_intf_exit_module},
+	{&cam_hw_cdm_init_module, &cam_hw_cdm_exit_module},
+};
+
+static const struct camera_submodule_component camera_tfe[] = {
+#ifdef CONFIG_SPECTRA_TFE
+	{&cam_csid_ppi100_init_module, &cam_csid_ppi100_exit_module},
+	{&cam_tfe_init_module, &cam_tfe_exit_module},
+	{&cam_tfe_csid530_init_module, &cam_tfe_csid530_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_isp[] = {
+#ifdef CONFIG_SPECTRA_ISP
+	{&cam_top_tpg_init_module, &cam_top_tpg_exit_module},
+	{&cam_ife_csid17x_init_module, &cam_ife_csid17x_exit_module},
+	{&cam_ife_csid_lite_init_module, &cam_ife_csid_lite_exit_module},
+	{&cam_vfe_init_module, &cam_vfe_exit_module},
+#ifdef CONFIG_SPECTRA_SFE
+	{&cam_sfe_init_module, &cam_sfe_exit_module},
+#endif
+	{&cam_isp_dev_init_module, &cam_isp_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_sensor[] = {
+#ifdef CONFIG_SPECTRA_SENSOR
+	{&cam_res_mgr_init, &cam_res_mgr_exit},
+	{&cam_cci_init_module, &cam_cci_exit_module},
+	{&cam_csiphy_init_module, &cam_csiphy_exit_module},
+	{&cam_actuator_driver_init, &cam_actuator_driver_exit},
+	{&cam_sensor_driver_init, &cam_sensor_driver_exit},
+	{&cam_eeprom_driver_init, &cam_eeprom_driver_exit},
+	{&cam_ois_driver_init, &cam_ois_driver_exit},
+	{&hdmi_bdg_irq_handler_init, &hdmi_bdg_irq_handler_exit},
+	{&dp_bdg_irq_handler_init, &dp_bdg_irq_handler_exit},
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2) || \
+	IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+	{&cam_flash_init_module, &cam_flash_exit_module},
+#endif
+	{&cam_ir_led_init_module, &cam_ir_led_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_icp[] = {
+#ifdef CONFIG_SPECTRA_ICP
+	{&cam_a5_init_module, &cam_a5_exit_module},
+	{&cam_ipe_init_module, &cam_ipe_exit_module},
+	{&cam_bps_init_module, &cam_bps_exit_module},
+	{&cam_icp_init_module, &cam_icp_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_ope[] = {
+#ifdef CONFIG_SPECTRA_OPE
+	{&cam_ope_init_module, &cam_ope_exit_module},
+	{&cam_ope_subdev_init_module, &cam_ope_subdev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_jpeg[] = {
+#ifdef CONFIG_SPECTRA_JPEG
+	{&cam_jpeg_enc_init_module, &cam_jpeg_enc_exit_module},
+	{&cam_jpeg_dma_init_module, &cam_jpeg_dma_exit_module},
+	{&cam_jpeg_dev_init_module, &cam_jpeg_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_fd[] = {
+#ifdef CONFIG_SPECTRA_FD
+	{&cam_fd_hw_init_module, &cam_fd_hw_exit_module},
+	{&cam_fd_dev_init_module, &cam_fd_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_lrme[] = {
+#ifdef CONFIG_SPECTRA_LRME
+	{&cam_lrme_hw_init_module, &cam_lrme_hw_exit_module},
+	{&cam_lrme_dev_init_module, &cam_lrme_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule_component camera_custom[] = {
+#ifdef CONFIG_SPECTRA_CUSTOM
+	{&cam_custom_hw_sub_module_init, &cam_custom_hw_sub_module_exit},
+	{&cam_custom_csid_driver_init, &cam_custom_csid_driver_exit},
+	{&cam_custom_dev_init_module, &cam_custom_dev_exit_module},
+#endif
+};
+
+static const struct camera_submodule submodule_table[] = {
+	{
+		.name = "Camera BASE",
+		.num_component = ARRAY_SIZE(camera_base),
+		.component = camera_base,
+	},
+	{
+		.name = "Camera TFE",
+		.num_component = ARRAY_SIZE(camera_tfe),
+		.component = camera_tfe,
+	},
+	{
+		.name = "Camera ISP",
+		.num_component = ARRAY_SIZE(camera_isp),
+		.component = camera_isp,
+	},
+	{
+		.name = "Camera SENSOR",
+		.num_component = ARRAY_SIZE(camera_sensor),
+		.component = camera_sensor
+	},
+	{
+		.name = "Camera ICP",
+		.num_component = ARRAY_SIZE(camera_icp),
+		.component = camera_icp,
+	},
+	{
+		.name = "Camera OPE",
+		.num_component = ARRAY_SIZE(camera_ope),
+		.component = camera_ope,
+	},
+	{
+		.name = "Camera JPEG",
+		.num_component = ARRAY_SIZE(camera_jpeg),
+		.component = camera_jpeg,
+	},
+	{
+		.name = "Camera FD",
+		.num_component = ARRAY_SIZE(camera_fd),
+		.component = camera_fd,
+	},
+	{
+		.name = "Camera LRME",
+		.num_component = ARRAY_SIZE(camera_lrme),
+		.component = camera_lrme,
+	},
+	{
+		.name = "Camera CUSTOM",
+		.num_component = ARRAY_SIZE(camera_custom),
+		.component = camera_custom,
+	}
+};
+
+static int camera_verify_submodules(void)
+{
+	int rc = 0;
+	int i, j, num_components;
+
+	for (i = 0; i < ARRAY_SIZE(submodule_table); i++) {
+		num_components = submodule_table[i].num_component;
+		for (j = 0; j < num_components; j++) {
+			if (!submodule_table[i].component[j].init ||
+				!submodule_table[i].component[j].exit) {
+				CAM_ERR(CAM_UTIL,
+					"%s module has init = %ps, exit = %ps",
+					submodule_table[i].name,
+					submodule_table[i].component[j].init,
+					submodule_table[i].component[j].exit);
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+	}
+
+end:
+	return rc;
+}
+
+static void __camera_exit(int i, int j)
+{
+	uint num_exits;
+
+	/* Exit from current submodule */
+	for (j -= 1; j >= 0; j--)
+		submodule_table[i].component[j].exit();
+
+	/* Exit remaining submodules */
+	for (i -= 1; i >= 0; i--) {
+		num_exits = submodule_table[i].num_component;
+		for (j = num_exits - 1; j >= 0; j--)
+			submodule_table[i].component[j].exit();
+	}
+}
+
+static int camera_init(void)
+{
+	int rc;
+	uint i, j, num_inits;
+
+	rc = camera_verify_submodules();
+	if (rc)
+		goto end_init;
+
+	/* For Probing all available submodules */
+	for (i = 0; i < ARRAY_SIZE(submodule_table); i++) {
+		num_inits = submodule_table[i].num_component;
+		CAM_DBG(CAM_UTIL, "Number of %s components: %u",
+			submodule_table[i].name, num_inits);
+		for (j = 0; j < num_inits; j++) {
+			rc = submodule_table[i].component[j].init();
+			if (rc) {
+				CAM_ERR(CAM_UTIL,
+					"%s module failure at %ps rc = %d",
+					submodule_table[i].name,
+					submodule_table[i].component[j].init,
+					rc);
+				__camera_exit(i, j);
+				goto end_init;
+			}
+		}
+	}
+
+	CAM_INFO(CAM_UTIL, "Spectra camera driver initialized");
+
+end_init:
+	return rc;
+}
+
+static void camera_exit(void)
+{
+	__camera_exit(ARRAY_SIZE(submodule_table), 0);
+
+	CAM_INFO(CAM_UTIL, "Spectra camera driver exited!");
+}
+
+module_init(camera_init);
+module_exit(camera_exit);
+
+MODULE_DESCRIPTION("Spectra camera driver");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/drivers/camera_main.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/drivers/camera_main.h
@@ -0,0 +1,150 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef CAMERA_MAIN_H
+#define CAMERA_MAIN_H
+
+#include <linux/platform_device.h>
+#include <linux/component.h>
+
+extern struct platform_driver cam_sync_driver;
+extern struct platform_driver cam_smmu_driver;
+extern struct platform_driver cam_cpas_driver;
+extern struct platform_driver cam_cdm_intf_driver;
+extern struct platform_driver cam_hw_cdm_driver;
+#ifdef CONFIG_SPECTRA_ISP
+extern struct platform_driver cam_top_tpg_driver;
+extern struct platform_driver cam_ife_csid17x_driver;
+extern struct platform_driver cam_ife_csid_lite_driver;
+extern struct platform_driver cam_vfe_driver;
+#ifdef CONFIG_SPECTRA_SFE
+extern struct platform_driver cam_sfe_driver;
+#endif
+extern struct platform_driver isp_driver;
+#endif
+#ifdef CONFIG_SPECTRA_TFE
+extern struct platform_driver cam_csid_ppi100_driver;
+extern struct platform_driver cam_tfe_driver;
+extern struct platform_driver cam_tfe_csid530_driver;
+#endif
+#ifdef CONFIG_SPECTRA_SENSOR
+extern struct platform_driver cam_res_mgr_driver;
+extern struct platform_driver cci_driver;
+extern struct platform_driver csiphy_driver;
+extern struct platform_driver cam_actuator_platform_driver;
+extern struct platform_driver cam_sensor_platform_driver;
+extern struct platform_driver cam_eeprom_platform_driver;
+extern struct platform_driver cam_ois_platform_driver;
+extern struct platform_driver hdmi_bdg_irq_handler_driver;
+extern struct platform_driver dp_bdg_irq_handler_driver;
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2) || \
+	IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+extern struct platform_driver cam_flash_platform_driver;
+#endif
+extern struct platform_driver cam_ir_led_platform_driver;
+#endif
+#ifdef CONFIG_SPECTRA_ICP
+extern struct platform_driver cam_a5_driver;
+extern struct platform_driver cam_ipe_driver;
+extern struct platform_driver cam_bps_driver;
+extern struct platform_driver cam_icp_driver;
+#endif
+#ifdef CONFIG_SPECTRA_OPE
+extern struct platform_driver cam_ope_driver;
+extern struct platform_driver cam_ope_subdev_driver;
+#endif
+#ifdef CONFIG_SPECTRA_JPEG
+extern struct platform_driver cam_jpeg_enc_driver;
+extern struct platform_driver cam_jpeg_dma_driver;
+extern struct platform_driver jpeg_driver;
+#endif
+#ifdef CONFIG_SPECTRA_FD
+extern struct platform_driver cam_fd_hw_driver;
+extern struct platform_driver cam_fd_driver;
+#endif
+#ifdef CONFIG_SPECTRA_LRME
+extern struct platform_driver cam_lrme_hw_driver;
+extern struct platform_driver cam_lrme_driver;
+#endif
+#ifdef CONFIG_SPECTRA_CUSTOM
+extern struct platform_driver cam_custom_hw_sub_mod_driver;
+extern struct platform_driver cam_custom_csid_driver;
+extern struct platform_driver custom_driver;
+#endif
+
+/*
+ * Drivers to be bound by component framework in this order with
+ * CRM as master
+ */
+static struct platform_driver *const cam_component_drivers[] = {
+/* BASE */
+	&cam_sync_driver,
+	&cam_smmu_driver,
+	&cam_cpas_driver,
+	&cam_cdm_intf_driver,
+	&cam_hw_cdm_driver,
+#ifdef CONFIG_SPECTRA_TFE
+	&cam_csid_ppi100_driver,
+	&cam_tfe_driver,
+	&cam_tfe_csid530_driver,
+#endif
+#ifdef CONFIG_SPECTRA_ISP
+	&cam_top_tpg_driver,
+	&cam_ife_csid17x_driver,
+	&cam_ife_csid_lite_driver,
+	&cam_vfe_driver,
+#ifdef CONFIG_SPECTRA_SFE
+	&cam_sfe_driver,
+#endif
+	&isp_driver,
+#endif
+#ifdef CONFIG_SPECTRA_SENSOR
+	&cam_res_mgr_driver,
+	&cci_driver,
+	&csiphy_driver,
+	&cam_actuator_platform_driver,
+	&cam_sensor_platform_driver,
+	&cam_eeprom_platform_driver,
+	&cam_ois_platform_driver,
+	&hdmi_bdg_irq_handler_driver,
+	&dp_bdg_irq_handler_driver,
+#if IS_REACHABLE(CONFIG_LEDS_QPNP_FLASH_V2) || \
+	IS_REACHABLE(CONFIG_LEDS_QTI_FLASH)
+	&cam_flash_platform_driver,
+#endif
+	&cam_ir_led_platform_driver,
+#endif
+#ifdef CONFIG_SPECTRA_ICP
+	&cam_a5_driver,
+	&cam_ipe_driver,
+	&cam_bps_driver,
+	&cam_icp_driver,
+#endif
+#ifdef CONFIG_SPECTRA_OPE
+	&cam_ope_driver,
+	&cam_ope_subdev_driver,
+#endif
+#ifdef CONFIG_SPECTRA_JPEG
+	&cam_jpeg_enc_driver,
+	&cam_jpeg_dma_driver,
+	&jpeg_driver,
+#endif
+#ifdef CONFIG_SPECTRA_FD
+	&cam_fd_hw_driver,
+	&cam_fd_driver,
+#endif
+#ifdef CONFIG_SPECTRA_LRME
+	&cam_lrme_hw_driver,
+	&cam_lrme_driver,
+#endif
+#ifdef CONFIG_SPECTRA_CUSTOM
+	&cam_custom_hw_sub_mod_driver,
+	&cam_custom_csid_driver,
+	&custom_driver,
+#endif
+};
+
+#endif /* CAMERA_MAIN_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/dt-bindings/msm-camera.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/dt-bindings/msm-camera.h
@@ -0,0 +1,108 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __MSM_CAMERA_H
+#define __MSM_CAMERA_H
+
+/* CPAS path data types */
+#define CAM_CPAS_PATH_DATA_IFE_START_OFFSET 0
+#define CAM_CPAS_PATH_DATA_IFE_LINEAR (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_IFE_VID (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_IFE_DISP (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_IFE_STATS (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_IFE_RDI0 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_IFE_RDI1 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_IFE_RDI2 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_IFE_RDI3 (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 7)
+#define CAM_CPAS_PATH_DATA_IFE_PDAF (CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 8)
+#define CAM_CPAS_PATH_DATA_IFE_PIXEL_RAW \
+	(CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 9)
+#define CAM_CPAS_PATH_DATA_IFE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_IFE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_IPE_START_OFFSET 32
+#define CAM_CPAS_PATH_DATA_IPE_RD_IN (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_IPE_RD_REF (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_IPE_WR_VID (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_IPE_WR_DISP (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_IPE_WR_REF (CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_IPE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_IPE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_OPE_START_OFFSET 64
+#define CAM_CPAS_PATH_DATA_OPE_RD_IN (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_OPE_RD_REF (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_OPE_WR_VID (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_OPE_WR_DISP (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_OPE_WR_REF (CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_OPE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_OPE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_SFE_START_OFFSET 96
+#define CAM_CPAS_PATH_DATA_SFE_NRDI    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 0)
+#define CAM_CPAS_PATH_DATA_SFE_RDI0    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_SFE_RDI1    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_SFE_RDI2    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_SFE_RDI3    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_SFE_RDI4    (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_SFE_STATS   (CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_SFE_MAX_OFFSET \
+	(CAM_CPAS_PATH_DATA_SFE_START_OFFSET + 31)
+
+#define CAM_CPAS_PATH_DATA_CONSO_OFFSET 256
+#define CAM_CPAS_PATH_DATA_ALL (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 0)
+
+/* IFE consolidated paths */
+#define CAM_CPAS_PATH_DATA_IFE_LINEAR_PDAF (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 1)
+#define CAM_CPAS_PATH_DATA_IFE_UBWC_STATS (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 2)
+#define CAM_CPAS_PATH_DATA_IFE_PIXEL_ALL (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 3)
+#define CAM_CPAS_PATH_DATA_IFE_RDI_PIXEL_RAW \
+	(CAM_CPAS_PATH_DATA_CONSO_OFFSET + 4)
+#define CAM_CPAS_PATH_DATA_IFE_RDI_ALL (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 5)
+#define CAM_CPAS_PATH_DATA_IFE_UBWC (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 6)
+#define CAM_CPAS_PATH_DATA_IFE_LINEAR_STATS \
+	(CAM_CPAS_PATH_DATA_CONSO_OFFSET + 6)
+
+/* IPE Consolidated paths */
+#define CAM_CPAS_PATH_DATA_IPE_WR_VID_DISP (CAM_CPAS_PATH_DATA_CONSO_OFFSET + 1)
+
+/* CPAS transaction types */
+#define CAM_CPAS_TRANSACTION_READ 0
+#define CAM_CPAS_TRANSACTION_WRITE 1
+
+/* CPAS traffic merge types */
+#define CAM_CPAS_TRAFFIC_MERGE_SUM 0
+#define CAM_CPAS_TRAFFIC_MERGE_SUM_INTERLEAVE 1
+
+/* Feature bit type */
+#define CAM_CPAS_FEATURE_TYPE_DISABLE 0
+#define CAM_CPAS_FEATURE_TYPE_ENABLE 1
+#define CAM_CPAS_FEATURE_TYPE_VALUE 2
+
+/* Feature support bit positions in feature fuse register*/
+#define CAM_CPAS_QCFA_BINNING_ENABLE 0
+#define CAM_CPAS_SECURE_CAMERA_ENABLE 1
+#define CAM_CPAS_MF_HDR_ENABLE 2
+#define CAM_CPAS_MP_LIMIT_FUSE 3
+#define CAM_CPAS_ISP_FUSE      4
+#define CAM_CPAS_ISP_PIX_FUSE  5
+#define CAM_CPAS_ISP_LITE_FUSE 6
+#define CAM_CPAS_SHDR_FUSE     7
+#define CAM_CPAS_CSIPHY_FUSE   8
+#define CAM_CPAS_RT_OT_FUSE    9
+#define CAM_CPAS_FUSE_FEATURE_MAX 10
+
+/* Flash type*/
+#define CAM_FLASH_TYPE_PMIC 0
+#define CAM_FLASH_TYPE_I2C  1
+#define CAM_FLASH_TYPE_GPIO 2
+
+/* CCI master */
+#define CCI_MASTER_0 0
+#define CCI_MASTER_1 1
+#define CCI_MASTER_MAX 2
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/Kbuild
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/Kbuild
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note
+
+# Legacy file used for kernel 4.19.x build system to install
+# UAPI headers.
+
+header-y += camera/media/cam_cpas.h
+header-y += camera/media/cam_custom.h
+header-y += camera/media/cam_defs.h
+header-y += camera/media/cam_fd.h
+header-y += camera/media/cam_icp.h
+header-y += camera/media/cam_isp_ife.h
+header-y += camera/media/cam_isp_vfe.h
+header-y += camera/media/cam_isp.h
+header-y += camera/media/cam_jpeg.h
+header-y += camera/media/cam_lrme.h
+header-y += camera/media/cam_req_mgr.h
+header-y += camera/media/cam_sensor.h
+header-y += camera/media/cam_sync.h
+header-y += camera/media/cam_ope.h
+header-y += camera/media/cam_isp_tfe.h
+header-y += camera/media/cam_tfe.h
+header-y += camera/media/cam_isp_sfe.h
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_cpas.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_cpas.h
@@ -0,0 +1,151 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_CPAS_H__
+#define __UAPI_CAM_CPAS_H__
+
+#include <media/cam_defs.h>
+
+#define CAM_FAMILY_CAMERA_SS     1
+#define CAM_FAMILY_CPAS_SS       2
+
+/* AXI BW Voting Version */
+#define CAM_AXI_BW_VOTING_V2                2
+
+/* AXI BW Voting Transaction Type */
+#define CAM_AXI_TRANSACTION_READ            0
+#define CAM_AXI_TRANSACTION_WRITE           1
+
+/* AXI BW Voting Path Data Type */
+#define CAM_AXI_PATH_DATA_IFE_START_OFFSET 0
+#define CAM_AXI_PATH_DATA_IFE_LINEAR    (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_IFE_VID       (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_IFE_DISP      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 2)
+#define CAM_AXI_PATH_DATA_IFE_STATS     (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 3)
+#define CAM_AXI_PATH_DATA_IFE_RDI0      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 4)
+#define CAM_AXI_PATH_DATA_IFE_RDI1      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 5)
+#define CAM_AXI_PATH_DATA_IFE_RDI2      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 6)
+#define CAM_AXI_PATH_DATA_IFE_RDI3      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 7)
+#define CAM_AXI_PATH_DATA_IFE_PDAF      (CAM_AXI_PATH_DATA_IFE_START_OFFSET + 8)
+#define CAM_AXI_PATH_DATA_IFE_PIXEL_RAW \
+	(CAM_AXI_PATH_DATA_IFE_START_OFFSET + 9)
+#define CAM_AXI_PATH_DATA_IFE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_IFE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_IPE_START_OFFSET 32
+#define CAM_AXI_PATH_DATA_IPE_RD_IN     (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_IPE_RD_REF    (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_IPE_WR_VID    (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 2)
+#define CAM_AXI_PATH_DATA_IPE_WR_DISP   (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 3)
+#define CAM_AXI_PATH_DATA_IPE_WR_REF    (CAM_AXI_PATH_DATA_IPE_START_OFFSET + 4)
+#define CAM_AXI_PATH_DATA_IPE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_IPE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_OPE_START_OFFSET 64
+#define CAM_AXI_PATH_DATA_OPE_RD_IN     (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_OPE_RD_REF    (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_OPE_WR_VID    (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 2)
+#define CAM_AXI_PATH_DATA_OPE_WR_DISP   (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 3)
+#define CAM_AXI_PATH_DATA_OPE_WR_REF    (CAM_AXI_PATH_DATA_OPE_START_OFFSET + 4)
+#define CAM_AXI_PATH_DATA_OPE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_OPE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_SFE_START_OFFSET 96
+#define CAM_AXI_PATH_DATA_SFE_NRDI      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 0)
+#define CAM_AXI_PATH_DATA_SFE_RDI0      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 1)
+#define CAM_AXI_PATH_DATA_SFE_RDI1      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 2)
+#define CAM_AXI_PATH_DATA_SFE_RDI2      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 3)
+#define CAM_AXI_PATH_DATA_SFE_RDI3      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 4)
+#define CAM_AXI_PATH_DATA_SFE_RDI4      (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 5)
+#define CAM_AXI_PATH_DATA_SFE_STATS     (CAM_AXI_PATH_DATA_SFE_START_OFFSET + 6)
+#define CAM_AXI_PATH_DATA_SFE_MAX_OFFSET \
+	(CAM_AXI_PATH_DATA_SFE_START_OFFSET + 31)
+
+#define CAM_AXI_PATH_DATA_ALL  256
+#define CAM_CPAS_FUSES_MAX     32
+
+/**
+ * struct cam_cpas_fuse_value - CPAS fuse value
+ *
+ * @fuse_id     : Camera fuse identification
+ * @fuse_val    : Camera Fuse Value
+ */
+struct cam_cpas_fuse_value {
+	__u32 fuse_id;
+	__u32 fuse_val;
+};
+
+/**
+ * struct cam_cpas_fuse_info - CPAS fuse info
+ *
+ * @num_fuses     : Number of fuses
+ * @fuse_val      : Array of different fuse info.
+ */
+struct cam_cpas_fuse_info {
+	__u32  num_fuses;
+	struct cam_cpas_fuse_value fuse_val[CAM_CPAS_FUSES_MAX];
+};
+
+/**
+ * struct cam_cpas_query_cap - CPAS query device capability payload
+ *
+ * @camera_family     : Camera family type
+ * @reserved          : Reserved field for alignment
+ * @camera_version    : Camera platform version
+ * @cpas_version      : Camera CPAS version within camera platform
+ *
+ */
+struct cam_cpas_query_cap {
+	__u32                 camera_family;
+	__u32                 reserved;
+	struct cam_hw_version camera_version;
+	struct cam_hw_version cpas_version;
+};
+
+/**
+ * struct cam_cpas_query_cap - CPAS query device capability payload
+ *
+ * @camera_family     : Camera family type
+ * @reserved          : Reserved field for alignment
+ * @camera_version    : Camera platform version
+ * @cpas_version      : Camera CPAS version within camera platform
+ * @fuse_info         : Camera fuse info
+ *
+ */
+struct cam_cpas_query_cap_v2 {
+	__u32                     camera_family;
+	__u32                     reserved;
+	struct cam_hw_version     camera_version;
+	struct cam_hw_version     cpas_version;
+	struct cam_cpas_fuse_info fuse_info;
+};
+
+/**
+ * struct cam_axi_per_path_bw_vote - Per path bandwidth vote information
+ *
+ * @usage_data               client usage data (left/right/rdi)
+ * @transac_type             Transaction type on the path (read/write)
+ * @path_data_type           Path for which vote is given (video, display, rdi)
+ * @reserved                 Reserved for alignment
+ * @camnoc_bw                CAMNOC bw for this path
+ * @mnoc_ab_bw               MNOC AB bw for this path
+ * @mnoc_ib_bw               MNOC IB bw for this path
+ * @ddr_ab_bw                DDR AB bw for this path
+ * @ddr_ib_bw                DDR IB bw for this path
+ */
+struct cam_axi_per_path_bw_vote {
+	__u32                      usage_data;
+	__u32                      transac_type;
+	__u32                      path_data_type;
+	__u32                      reserved;
+	__u64                      camnoc_bw;
+	__u64                      mnoc_ab_bw;
+	__u64                      mnoc_ib_bw;
+	__u64                      ddr_ab_bw;
+	__u64                      ddr_ib_bw;
+};
+
+#endif /* __UAPI_CAM_CPAS_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_custom.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_custom.h
@@ -0,0 +1,219 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_CUSTOM_H__
+#define __UAPI_CAM_CUSTOM_H__
+
+#include <media/cam_defs.h>
+
+/* Custom driver name */
+#define CAM_CUSTOM_DEV_NAME                    "cam-custom"
+
+#define CAM_CUSTOM_NUM_SUB_DEVICES             2
+
+/* HW type */
+#define CAM_CUSTOM_HW1                         0
+#define CAM_CUSTOM_HW2                         1
+
+/* output path resource id's */
+#define CAM_CUSTOM_OUT_RES_UDI_0               1
+#define CAM_CUSTOM_OUT_RES_UDI_1               2
+#define CAM_CUSTOM_OUT_RES_UDI_2               3
+
+/* input resource for custom hw */
+#define CAM_CUSTOM_IN_RES_UDI_0                1
+
+/* Resource ID */
+#define CAM_CUSTOM_RES_ID_PORT                 0
+
+/* Packet opcode for Custom */
+#define CAM_CUSTOM_PACKET_OP_BASE              0
+#define CAM_CUSTOM_PACKET_INIT_DEV             1
+#define CAM_CUSTOM_PACKET_UPDATE_DEV           2
+#define CAM_CUSTOM_PACKET_OP_MAX               3
+
+/* max number of vc-dt cfg for a given input */
+#define CAM_CUSTOM_VC_DT_CFG_MAX               4
+
+/* phy input resource types */
+#define CAM_CUSTOM_IN_RES_BASE                0x5000
+#define CAM_CUSTOM_IN_RES_PHY_0               (CAM_CUSTOM_IN_RES_BASE + 1)
+#define CAM_CUSTOM_IN_RES_PHY_1               (CAM_CUSTOM_IN_RES_BASE + 2)
+#define CAM_CUSTOM_IN_RES_PHY_2               (CAM_CUSTOM_IN_RES_BASE + 3)
+#define CAM_CUSTOM_IN_RES_PHY_3               (CAM_CUSTOM_IN_RES_BASE + 4)
+
+/* Query devices */
+/**
+ * struct cam_custom_dev_cap_info - A cap info for particular hw type
+ *
+ * @hw_type:            Custom HW type
+ * @hw_version:         Hardware version
+ *
+ */
+struct cam_custom_dev_cap_info {
+	__u32              hw_type;
+	__u32              hw_version;
+};
+
+/**
+ * struct cam_custom_query_cap_cmd - Custom HW query device capability payload
+ *
+ * @device_iommu:               returned iommu handles for device
+ * @cdm_iommu:                  returned iommu handles for cdm
+ * @num_dev:                    returned number of device capabilities
+ * @reserved:                   reserved field for alignment
+ * @dev_caps:                   returned device capability array
+ *
+ */
+struct cam_custom_query_cap_cmd {
+	struct cam_iommu_handle        device_iommu;
+	struct cam_iommu_handle        cdm_iommu;
+	__s32                          num_dev;
+	__u32                          reserved;
+	struct cam_custom_dev_cap_info dev_caps[CAM_CUSTOM_NUM_SUB_DEVICES];
+};
+
+/* Acquire Device */
+/**
+ * struct cam_custom_out_port_info - An output port resource info
+ *
+ * @res_type:              output resource type
+ * @format:                output format of the resource
+ * @custom_info 1-3:       custom params
+ * @reserved:              reserved field for alignment
+ *
+ */
+struct cam_custom_out_port_info {
+	__u32                res_type;
+	__u32                format;
+	__u32                custom_info1;
+	__u32                custom_info2;
+	__u32                custom_info3;
+	__u32                reserved;
+};
+
+/**
+ * struct cam_custom_in_port_info - An input port resource info
+ *
+ * @res_type:                   input resource type
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @num_valid_vc_dt:            number of valid vc-dt
+ * @format:                     input format
+ * @test_pattern:               test pattern for the testgen
+ * @usage_type:                 whether dual vfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_stop:                  left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ * @right_stop:                 right input stop offset in pixels.
+ * @right_width:                right input width in pixels.
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @pixel_clk;                  sensor output clock
+ * @num_out_byte:               number of valid output bytes per cycle
+ * @custom_info1:               custom_info1
+ * @custom_info2:               custom info 2
+ * @num_out_res:                number of the output resource associated
+ * @data:                       payload that contains the output resources
+ *
+ */
+struct cam_custom_in_port_info {
+	__u32                           res_type;
+	__u32                           lane_type;
+	__u32                           lane_num;
+	__u32                           lane_cfg;
+	__u32                           vc[CAM_CUSTOM_VC_DT_CFG_MAX];
+	__u32                           dt[CAM_CUSTOM_VC_DT_CFG_MAX];
+	__u32                           num_valid_vc_dt;
+	__u32                           format;
+	__u32                           test_pattern;
+	__u32                           usage_type;
+	__u32                           left_start;
+	__u32                           left_stop;
+	__u32                           left_width;
+	__u32                           right_start;
+	__u32                           right_stop;
+	__u32                           right_width;
+	__u32                           line_start;
+	__u32                           line_stop;
+	__u32                           height;
+	__u32                           pixel_clk;
+	__u32                           num_bytes_out;
+	__u32                           custom_info1;
+	__u32                           custom_info2;
+	__u32                           num_out_res;
+    union {
+        struct cam_custom_out_port_info data[1];
+        __DECLARE_FLEX_ARRAY(struct cam_custom_out_port_info, data_flex);
+    };
+};
+
+/**
+ * struct cam_custom_resource - A resource bundle
+ *
+ * @resoruce_id:                resource id for the resource bundle
+ * @length:                     length of the while resource blob
+ * @handle_type:                type of the resource handle
+ * @reserved:                   reserved field for alignment
+ * @res_hdl:                    resource handle that points to the
+ *                              resource array;
+ */
+struct cam_custom_resource {
+	__u32                       resource_id;
+	__u32                       length;
+	__u32                       handle_type;
+	__u32                       reserved;
+	__u64                       res_hdl;
+};
+
+/**
+ * struct cam_custom_acquire_hw_info - Custom acquire HW params
+ *
+ * @num_inputs           : Number of inputs
+ * @input_info_size      : Size of input info struct used
+ * @input_info_offset    : Offset of input info from start of data
+ * @reserved             : reserved
+ * @data                 : Start of data region
+ */
+struct cam_custom_acquire_hw_info {
+	__u32                num_inputs;
+	__u32                input_info_size;
+	__u32                input_info_offset;
+	__u32                reserved;
+	__u64                data;
+};
+
+/**
+ * struct cam_custom_cmd_buf_type_1 - cmd buf type 1
+ *
+ * @custom_info:                custom info
+ * @reserved:                   reserved
+ */
+struct cam_custom_cmd_buf_type_1 {
+	__u32                       custom_info;
+	__u32                       reserved;
+};
+
+/**
+ * struct cam_custom_cmd_buf_type_2 - cmd buf type 2
+ *
+ * @custom_info1:               Custom info 1
+ * @custom_info2:               Custom info 2
+ * @custom_info3:               Custom info 3
+ * @reserved:                   reserved
+ */
+struct cam_custom_cmd_buf_type_2 {
+	__u32                       custom_info1;
+	__u32                       custom_info2;
+	__u32                       custom_info3;
+	__u32                       reserved;
+};
+#endif /* __UAPI_CAM_CUSTOM_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_defs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_defs.h
@@ -0,0 +1,927 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_DEFS_H__
+#define __UAPI_CAM_DEFS_H__
+
+#include <linux/videodev2.h>
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+
+/* camera op codes */
+#define CAM_COMMON_OPCODE_BASE                  0x100
+#define CAM_QUERY_CAP                           (CAM_COMMON_OPCODE_BASE + 0x1)
+#define CAM_ACQUIRE_DEV                         (CAM_COMMON_OPCODE_BASE + 0x2)
+#define CAM_START_DEV                           (CAM_COMMON_OPCODE_BASE + 0x3)
+#define CAM_STOP_DEV                            (CAM_COMMON_OPCODE_BASE + 0x4)
+#define CAM_CONFIG_DEV                          (CAM_COMMON_OPCODE_BASE + 0x5)
+#define CAM_RELEASE_DEV                         (CAM_COMMON_OPCODE_BASE + 0x6)
+#define CAM_SD_SHUTDOWN                         (CAM_COMMON_OPCODE_BASE + 0x7)
+#define CAM_FLUSH_REQ                           (CAM_COMMON_OPCODE_BASE + 0x8)
+#define CAM_QUERY_CAP_V2                        (CAM_COMMON_OPCODE_BASE + 0x9)
+#define CAM_COMMON_OPCODE_MAX                   (CAM_COMMON_OPCODE_BASE + 0xa)
+
+#define CAM_COMMON_OPCODE_BASE_v2           0x150
+#define CAM_ACQUIRE_HW                      (CAM_COMMON_OPCODE_BASE_v2 + 0x1)
+#define CAM_RELEASE_HW                      (CAM_COMMON_OPCODE_BASE_v2 + 0x2)
+#define CAM_DUMP_REQ                        (CAM_COMMON_OPCODE_BASE_v2 + 0x3)
+
+#define CAM_EXT_OPCODE_BASE                     0x200
+#define CAM_CONFIG_DEV_EXTERNAL                 (CAM_EXT_OPCODE_BASE + 0x1)
+
+/* camera handle type */
+#define CAM_HANDLE_USER_POINTER                 1
+#define CAM_HANDLE_MEM_HANDLE                   2
+
+/* Generic Blob CmdBuffer header properties */
+#define CAM_GENERIC_BLOB_CMDBUFFER_SIZE_MASK    0xFFFFFF00
+#define CAM_GENERIC_BLOB_CMDBUFFER_SIZE_SHIFT   8
+#define CAM_GENERIC_BLOB_CMDBUFFER_TYPE_MASK    0xFF
+#define CAM_GENERIC_BLOB_CMDBUFFER_TYPE_SHIFT   0
+
+/* Command Buffer Types */
+#define CAM_CMD_BUF_DMI                     0x1
+#define CAM_CMD_BUF_DMI16                   0x2
+#define CAM_CMD_BUF_DMI32                   0x3
+#define CAM_CMD_BUF_DMI64                   0x4
+#define CAM_CMD_BUF_DIRECT                  0x5
+#define CAM_CMD_BUF_INDIRECT                0x6
+#define CAM_CMD_BUF_I2C                     0x7
+#define CAM_CMD_BUF_FW                      0x8
+#define CAM_CMD_BUF_GENERIC                 0x9
+#define CAM_CMD_BUF_LEGACY                  0xA
+
+/* UBWC API Version */
+#define CAM_UBWC_CFG_VERSION_1              1
+#define CAM_UBWC_CFG_VERSION_2              2
+
+#define CAM_MAX_ACQ_RES    5
+#define CAM_MAX_HW_SPLIT   3
+
+
+/**
+ * enum flush_type_t - Identifies the various flush types
+ *
+ * @CAM_FLUSH_TYPE_REQ:    Flush specific request
+ * @CAM_FLUSH_TYPE_ALL:    Flush all requests belonging to a context
+ * @CAM_FLUSH_TYPE_MAX:    Max enum to validate flush type
+ *
+ */
+enum flush_type_t {
+	CAM_FLUSH_TYPE_REQ,
+	CAM_FLUSH_TYPE_ALL,
+	CAM_FLUSH_TYPE_MAX
+};
+
+/**
+ * struct cam_control - Structure used by ioctl control for camera
+ *
+ * @op_code:            This is the op code for camera control
+ * @size:               Control command size
+ * @handle_type:        User pointer or shared memory handle
+ * @reserved:           Reserved field for 64 bit alignment
+ * @handle:             Control command payload
+ */
+struct cam_control {
+	__u32        op_code;
+	__u32        size;
+	__u32        handle_type;
+	__u32        reserved;
+	__u64        handle;
+};
+
+/* camera IOCTL */
+#define VIDIOC_CAM_CONTROL \
+	_IOWR('V', BASE_VIDIOC_PRIVATE, struct cam_control)
+
+/**
+ * struct cam_hw_version - Structure for HW version of camera devices
+ *
+ * @major    : Hardware version major
+ * @minor    : Hardware version minor
+ * @incr     : Hardware version increment
+ * @reserved : Reserved for 64 bit aligngment
+ */
+struct cam_hw_version {
+	__u32 major;
+	__u32 minor;
+	__u32 incr;
+	__u32 reserved;
+};
+
+/**
+ * struct cam_iommu_handle - Structure for IOMMU handles of camera hw devices
+ *
+ * @non_secure: Device Non Secure IOMMU handle
+ * @secure:     Device Secure IOMMU handle
+ *
+ */
+struct cam_iommu_handle {
+	__s32 non_secure;
+	__s32 secure;
+};
+
+/* camera secure mode */
+#define CAM_SECURE_MODE_NON_SECURE             0
+#define CAM_SECURE_MODE_SECURE                 1
+
+/* Camera Format Type */
+#define CAM_FORMAT_BASE                         0
+#define CAM_FORMAT_MIPI_RAW_6                   1
+#define CAM_FORMAT_MIPI_RAW_8                   2
+#define CAM_FORMAT_MIPI_RAW_10                  3
+#define CAM_FORMAT_MIPI_RAW_12                  4
+#define CAM_FORMAT_MIPI_RAW_14                  5
+#define CAM_FORMAT_MIPI_RAW_16                  6
+#define CAM_FORMAT_MIPI_RAW_20                  7
+#define CAM_FORMAT_QTI_RAW_8                    8
+#define CAM_FORMAT_QTI_RAW_10                   9
+#define CAM_FORMAT_QTI_RAW_12                   10
+#define CAM_FORMAT_QTI_RAW_14                   11
+#define CAM_FORMAT_PLAIN8                       12
+#define CAM_FORMAT_PLAIN16_8                    13
+#define CAM_FORMAT_PLAIN16_10                   14
+#define CAM_FORMAT_PLAIN16_12                   15
+#define CAM_FORMAT_PLAIN16_14                   16
+#define CAM_FORMAT_PLAIN16_16                   17
+#define CAM_FORMAT_PLAIN32_20                   18
+#define CAM_FORMAT_PLAIN64                      19
+#define CAM_FORMAT_PLAIN128                     20
+#define CAM_FORMAT_ARGB                         21
+#define CAM_FORMAT_ARGB_10                      22
+#define CAM_FORMAT_ARGB_12                      23
+#define CAM_FORMAT_ARGB_14                      24
+#define CAM_FORMAT_DPCM_10_6_10                 25
+#define CAM_FORMAT_DPCM_10_8_10                 26
+#define CAM_FORMAT_DPCM_12_6_12                 27
+#define CAM_FORMAT_DPCM_12_8_12                 28
+#define CAM_FORMAT_DPCM_14_8_14                 29
+#define CAM_FORMAT_DPCM_14_10_14                30
+#define CAM_FORMAT_NV21                         31
+#define CAM_FORMAT_NV12                         32
+#define CAM_FORMAT_TP10                         33
+#define CAM_FORMAT_YUV422                       34
+#define CAM_FORMAT_PD8                          35
+#define CAM_FORMAT_PD10                         36
+#define CAM_FORMAT_UBWC_NV12                    37
+#define CAM_FORMAT_UBWC_NV12_4R                 38
+#define CAM_FORMAT_UBWC_TP10                    39
+#define CAM_FORMAT_UBWC_P010                    40
+#define CAM_FORMAT_PLAIN8_SWAP                  41
+#define CAM_FORMAT_PLAIN8_10                    42
+#define CAM_FORMAT_PLAIN8_10_SWAP               43
+#define CAM_FORMAT_YV12                         44
+#define CAM_FORMAT_Y_ONLY                       45
+#define CAM_FORMAT_DPCM_12_10_12                46
+#define CAM_FORMAT_PLAIN32                      47
+#define CAM_FORMAT_ARGB_16                      48
+#define CAM_FORMAT_PLAIN16_10_LSB               49
+#define CAM_FORMAT_YUV422_10                    50
+#define CAM_FORMAT_MAX                          51
+
+/* Pixel Patterns */
+#define PIXEL_PATTERN_RGRGRG                    0x0
+#define PIXEL_PATTERN_GRGRGR                    0x1
+#define PIXEL_PATTERN_BGBGBG                    0x2
+#define PIXEL_PATTERN_GBGBGB                    0x3
+#define PIXEL_PATTERN_YCBYCR                    0x4
+#define PIXEL_PATTERN_YCRYCB                    0x5
+#define PIXEL_PATTERN_CBYCRY                    0x6
+#define PIXEL_PATTERN_CRYCBY                    0x7
+
+/* camera rotaion */
+#define CAM_ROTATE_CW_0_DEGREE                  0
+#define CAM_ROTATE_CW_90_DEGREE                 1
+#define CAM_RORATE_CW_180_DEGREE                2
+#define CAM_ROTATE_CW_270_DEGREE                3
+
+/* camera Color Space */
+#define CAM_COLOR_SPACE_BASE                    0
+#define CAM_COLOR_SPACE_BT601_FULL              1
+#define CAM_COLOR_SPACE_BT601625                2
+#define CAM_COLOR_SPACE_BT601525                3
+#define CAM_COLOR_SPACE_BT709                   4
+#define CAM_COLOR_SPACE_DEPTH                   5
+#define CAM_COLOR_SPACE_MAX                     6
+
+/* camera buffer direction */
+#define CAM_BUF_INPUT                           1
+#define CAM_BUF_OUTPUT                          2
+#define CAM_BUF_IN_OUT                          3
+
+/* camera packet device Type */
+#define CAM_PACKET_DEV_BASE                     0
+#define CAM_PACKET_DEV_IMG_SENSOR               1
+#define CAM_PACKET_DEV_ACTUATOR                 2
+#define CAM_PACKET_DEV_COMPANION                3
+#define CAM_PACKET_DEV_EEPOM                    4
+#define CAM_PACKET_DEV_CSIPHY                   5
+#define CAM_PACKET_DEV_OIS                      6
+#define CAM_PACKET_DEV_FLASH                    7
+#define CAM_PACKET_DEV_FD                       8
+#define CAM_PACKET_DEV_JPEG_ENC                 9
+#define CAM_PACKET_DEV_JPEG_DEC                 10
+#define CAM_PACKET_DEV_VFE                      11
+#define CAM_PACKET_DEV_CPP                      12
+#define CAM_PACKET_DEV_CSID                     13
+#define CAM_PACKET_DEV_ISPIF                    14
+#define CAM_PACKET_DEV_IFE                      15
+#define CAM_PACKET_DEV_ICP                      16
+#define CAM_PACKET_DEV_LRME                     17
+#define CAM_PACKET_DEV_TFE                      18
+#define CAM_PACKET_DEV_OPE                      19
+#define CAM_PACKET_DEV_MAX                      20
+
+/* Register base type */
+#define CAM_REG_DUMP_BASE_TYPE_ISP_LEFT         1
+#define CAM_REG_DUMP_BASE_TYPE_ISP_RIGHT        2
+#define CAM_REG_DUMP_BASE_TYPE_CAMNOC           3
+
+/* Register dump read type */
+#define CAM_REG_DUMP_READ_TYPE_CONT_RANGE       1
+#define CAM_REG_DUMP_READ_TYPE_DMI              2
+
+/* Max number of config writes to read from DMI */
+#define CAM_REG_DUMP_DMI_CONFIG_MAX             5
+
+
+/* constants */
+#define CAM_PACKET_MAX_PLANES                   3
+
+/**
+ * struct cam_plane_cfg - Plane configuration info
+ *
+ * @width:                      Plane width in pixels
+ * @height:                     Plane height in lines
+ * @plane_stride:               Plane stride in pixel
+ * @slice_height:               Slice height in line (not used by ISP)
+ * @meta_stride:                UBWC metadata stride
+ * @meta_size:                  UBWC metadata plane size
+ * @meta_offset:                UBWC metadata offset
+ * @packer_config:              UBWC packer config
+ * @mode_config:                UBWC mode config
+ * @tile_config:                UBWC tile config
+ * @h_init:                     UBWC horizontal initial coordinate in pixels
+ * @v_init:                     UBWC vertical initial coordinate in lines
+ *
+ */
+struct cam_plane_cfg {
+	__u32                width;
+	__u32                height;
+	__u32                plane_stride;
+	__u32                slice_height;
+	__u32                meta_stride;
+	__u32                meta_size;
+	__u32                meta_offset;
+	__u32                packer_config;
+	__u32                mode_config;
+	__u32                tile_config;
+	__u32                h_init;
+	__u32                v_init;
+};
+
+/**
+ * struct cam_ubwc_plane_cfg_v1 - UBWC Plane configuration info
+ *
+ * @port_type:                  Port Type
+ * @meta_stride:                UBWC metadata stride
+ * @meta_size:                  UBWC metadata plane size
+ * @meta_offset:                UBWC metadata offset
+ * @packer_config:              UBWC packer config
+ * @mode_config_0:              UBWC mode config 0
+ * @mode_config_1:              UBWC 3 mode config 1
+ * @tile_config:                UBWC tile config
+ * @h_init:                     UBWC horizontal initial coordinate in pixels
+ * @v_init:                     UBWC vertical initial coordinate in lines
+ *
+ */
+struct cam_ubwc_plane_cfg_v1 {
+	__u32                port_type;
+	__u32                meta_stride;
+	__u32                meta_size;
+	__u32                meta_offset;
+	__u32                packer_config;
+	__u32                mode_config_0;
+	__u32                mode_config_1;
+	__u32                tile_config;
+	__u32                h_init;
+	__u32                v_init;
+};
+
+/**
+ * struct cam_ubwc_plane_cfg_v2 - UBWC Plane configuration info
+ *
+ * @port_type:                  Port Type
+ * @meta_stride:                UBWC metadata stride
+ * @meta_size:                  UBWC metadata plane size
+ * @meta_offset:                UBWC metadata offset
+ * @packer_config:              UBWC packer config
+ * @mode_config:                UBWC mode config
+ * @static ctrl:                UBWC static ctrl
+ * @ctrl_2:                     UBWC ctrl 2
+ * @tile_config:                UBWC tile config
+ * @h_init:                     UBWC horizontal initial coordinate in pixels
+ * @v_init:                     UBWC vertical initial coordinate in lines
+ * @stats_ctrl_2:               UBWC stats control
+ * @lossy_threshold0            UBWC lossy threshold 0
+ * @lossy_threshold1            UBWC lossy threshold 1
+ * @lossy_var_offset            UBWC offset variance thrshold
+ *
+ */
+struct cam_ubwc_plane_cfg_v2 {
+	__u32                port_type;
+	__u32                meta_stride;
+	__u32                meta_size;
+	__u32                meta_offset;
+	__u32                packer_config;
+	__u32                mode_config_0;
+	__u32                mode_config_1;
+	__u32                tile_config;
+	__u32                h_init;
+	__u32                v_init;
+	__u32                static_ctrl;
+	__u32                ctrl_2;
+	__u32                stats_ctrl_2;
+	__u32                lossy_threshold_0;
+	__u32                lossy_threshold_1;
+	__u32                lossy_var_offset;
+	__u32                bandwidth_limit;
+	__u32                reserved[3];
+};
+/**
+ * struct cam_cmd_buf_desc - Command buffer descriptor
+ *
+ * @mem_handle:                 Command buffer handle
+ * @offset:                     Command start offset
+ * @size:                       Size of the command buffer in bytes
+ * @length:                     Used memory in command buffer in bytes
+ * @type:                       Type of the command buffer
+ * @meta_data:                  Data type for private command buffer
+ *                              Between UMD and KMD
+ *
+ */
+struct cam_cmd_buf_desc {
+	__s32                mem_handle;
+	__u32                offset;
+	__u32                size;
+	__u32                length;
+	__u32                type;
+	__u32                meta_data;
+};
+
+/**
+ * struct cam_buf_io_cfg - Buffer io configuration for buffers
+ *
+ * @mem_handle:                 Mem_handle array for the buffers.
+ * @offsets:                    Offsets for each planes in the buffer
+ * @planes:                     Per plane information
+ * @width:                      Main plane width in pixel
+ * @height:                     Main plane height in lines
+ * @format:                     Format of the buffer
+ * @color_space:                Color space for the buffer
+ * @color_pattern:              Color pattern in the buffer
+ * @bpp:                        Bit per pixel
+ * @rotation:                   Rotation information for the buffer
+ * @resource_type:              Resource type associated with the buffer
+ * @fence:                      Fence handle
+ * @early_fence:                Fence handle for early signal
+ * @aux_cmd_buf:                An auxiliary command buffer that may be
+ *                              used for programming the IO
+ * @direction:                  Direction of the config
+ * @batch_size:                 Batch size in HFR mode
+ * @subsample_pattern:          Subsample pattern. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @subsample_period:           Subsample period. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @framedrop_pattern:          Framedrop pattern
+ * @framedrop_period:           Framedrop period
+ * @flag:                       Flags for extra information
+ * @direction:                  Buffer direction: input or output
+ * @padding:                    Padding for the structure
+ *
+ */
+struct cam_buf_io_cfg {
+	__s32                   mem_handle[CAM_PACKET_MAX_PLANES];
+	__u32                   offsets[CAM_PACKET_MAX_PLANES];
+	struct cam_plane_cfg    planes[CAM_PACKET_MAX_PLANES];
+	__u32                   format;
+	__u32                   color_space;
+	__u32                   color_pattern;
+	__u32                   bpp;
+	__u32                   rotation;
+	__u32                   resource_type;
+	__s32                   fence;
+	__s32                   early_fence;
+	struct cam_cmd_buf_desc aux_cmd_buf;
+	__u32                   direction;
+	__u32                   batch_size;
+	__u32                   subsample_pattern;
+	__u32                   subsample_period;
+	__u32                   framedrop_pattern;
+	__u32                   framedrop_period;
+	__u32                   flag;
+	__u32                   padding;
+};
+
+/**
+ * struct cam_packet_header - Camera packet header
+ *
+ * @op_code:                    Camera packet opcode
+ * @size:                       Size of the camera packet in bytes
+ * @request_id:                 Request id for this camera packet
+ * @flags:                      Flags for the camera packet
+ * @padding:                    Padding
+ *
+ */
+struct cam_packet_header {
+	__u32                op_code;
+	__u32                size;
+	__u64                request_id;
+	__u32                flags;
+	__u32                padding;
+};
+
+/**
+ * struct cam_patch_desc - Patch structure
+ *
+ * @dst_buf_hdl:                Memory handle for the dest buffer
+ * @dst_offset:                 Offset byte in the dest buffer
+ * @src_buf_hdl:                Memory handle for the source buffer
+ * @src_offset:                 Offset byte in the source buffer
+ *
+ */
+struct cam_patch_desc {
+	__s32                dst_buf_hdl;
+	__u32                dst_offset;
+	__s32                src_buf_hdl;
+	__u32                src_offset;
+};
+
+/**
+ * struct cam_packet - Camera packet structure
+ *
+ * @header:                     Camera packet header
+ * @cmd_buf_offset:             Command buffer start offset
+ * @num_cmd_buf:                Number of the command buffer in the packet
+ * @io_config_offset:           Buffer io configuration start offset
+ * @num_io_configs:             Number of the buffer io configurations
+ * @patch_offset:               Patch offset for the patch structure
+ * @num_patches:                Number of the patch structure
+ * @kmd_cmd_buf_index:          Command buffer index which contains extra
+ *                              space for the KMD buffer
+ * @kmd_cmd_buf_offset:         Offset from the beginning of the command
+ *                              buffer for KMD usage.
+ * @payload:                    Camera packet payload
+ *
+ */
+struct cam_packet {
+	struct cam_packet_header     header;
+	__u32                        cmd_buf_offset;
+	__u32                        num_cmd_buf;
+	__u32                        io_configs_offset;
+	__u32                        num_io_configs;
+	__u32                        patch_offset;
+	__u32                        num_patches;
+	__u32                        kmd_cmd_buf_index;
+	__u32                        kmd_cmd_buf_offset;
+    union {
+        __u64                    payload[1];
+        __DECLARE_FLEX_ARRAY(__u64, payload_flex);
+    };
+
+};
+
+/**
+ * struct cam_release_dev_cmd - Control payload for release devices
+ *
+ * @session_handle:             Session handle for the release
+ * @dev_handle:                 Device handle for the release
+ */
+struct cam_release_dev_cmd {
+	__s32                 session_handle;
+	__s32                 dev_handle;
+};
+
+/**
+ * struct cam_start_stop_dev_cmd - Control payload for start/stop device
+ *
+ * @session_handle:             Session handle for the start/stop command
+ * @dev_handle:                 Device handle for the start/stop command
+ *
+ */
+struct cam_start_stop_dev_cmd {
+	__s32                 session_handle;
+	__s32                 dev_handle;
+};
+
+/**
+ * struct cam_config_dev_cmd - Command payload for configure device
+ *
+ * @session_handle:             Session handle for the command
+ * @dev_handle:                 Device handle for the command
+ * @offset:                     Offset byte in the packet handle.
+ * @packet_handle:              Packet memory handle for the actual packet:
+ *                              struct cam_packet.
+ *
+ */
+struct cam_config_dev_cmd {
+	__s32                session_handle;
+	__s32                dev_handle;
+	__u64                offset;
+	__u64                packet_handle;
+};
+
+/**
+ * struct cam_query_cap_cmd - Payload for query device capability
+ *
+ * @size:               Handle size
+ * @handle_type:        User pointer or shared memory handle
+ * @caps_handle:        Device specific query command payload
+ *
+ */
+struct cam_query_cap_cmd {
+	__u32        size;
+	__u32        handle_type;
+	__u64        caps_handle;
+};
+
+/**
+ * struct cam_acquire_dev_cmd - Control payload for acquire devices
+ *
+ * @session_handle:     Session handle for the acquire command
+ * @dev_handle:         Device handle to be returned
+ * @handle_type:        Resource handle type:
+ *                      1 = user pointer, 2 = mem handle
+ * @num_resources:      Number of the resources to be acquired
+ * @resources_hdl:      Resource handle that refers to the actual
+ *                      resource array. Each item in this
+ *                      array is device specific resource structure
+ *
+ */
+struct cam_acquire_dev_cmd {
+	__s32        session_handle;
+	__s32        dev_handle;
+	__u32        handle_type;
+	__u32        num_resources;
+	__u64        resource_hdl;
+};
+
+/*
+ * In old version, while acquiring device the num_resources in
+ * struct cam_acquire_dev_cmd will be a valid value. During ACQUIRE_DEV
+ * KMD driver will return dev_handle as well as associate HW to handle.
+ * If num_resources is set to the constant below, we are using
+ * the new version and we do not acquire HW in ACQUIRE_DEV IOCTL.
+ * ACQUIRE_DEV will only return handle and we should receive
+ * ACQUIRE_HW IOCTL after ACQUIRE_DEV and that is when the HW
+ * is associated with the dev_handle.
+ *
+ * (Data type): __u32
+ */
+#define CAM_API_COMPAT_CONSTANT                   0xFEFEFEFE
+
+#define CAM_ACQUIRE_HW_STRUCT_VERSION_1           1
+#define CAM_ACQUIRE_HW_STRUCT_VERSION_2           2
+
+/**
+ * struct cam_acquire_hw_cmd_v1 - Control payload for acquire HW IOCTL (Ver 1)
+ *
+ * @struct_version:     = CAM_ACQUIRE_HW_STRUCT_VERSION_1 for this struct
+ *                      This value should be the first 32-bits in any structure
+ *                      related to this IOCTL. So that if the struct needs to
+ *                      change, we can first read the starting 32-bits, get the
+ *                      version number and then typecast the data to struct
+ *                      accordingly.
+ * @reserved:           Reserved field for 64-bit alignment
+ * @session_handle:     Session handle for the acquire command
+ * @dev_handle:         Device handle to be returned
+ * @handle_type:        Tells you how to interpret the variable resource_hdl-
+ *                      1 = user pointer, 2 = mem handle
+ * @data_size:          Total size of data contained in memory pointed
+ *                      to by resource_hdl
+ * @resource_hdl:       Resource handle that refers to the actual
+ *                      resource data.
+ */
+struct cam_acquire_hw_cmd_v1 {
+	__u32        struct_version;
+	__u32        reserved;
+	__s32        session_handle;
+	__s32        dev_handle;
+	__u32        handle_type;
+	__u32        data_size;
+	__u64        resource_hdl;
+};
+
+/**
+ * struct cam_acquired_hw_info - Update the acquired hardware info
+ *
+ * @acquired_hw_id:     Acquired hardware mask
+ * @acquired_hw_path:   Acquired path mask for an input
+ *                      if input splits into multiple paths,
+ *                      its updated per hardware
+ * valid_acquired_hw:   Valid num of acquired hardware
+ */
+struct cam_acquired_hw_info {
+	__u32    acquired_hw_id[CAM_MAX_ACQ_RES];
+	__u32    acquired_hw_path[CAM_MAX_ACQ_RES][CAM_MAX_HW_SPLIT];
+	__u32    valid_acquired_hw;
+};
+
+/**
+ * struct cam_acquire_hw_cmd_v2 - Control payload for acquire HW IOCTL (Ver 2)
+ *
+ * @struct_version:     = CAM_ACQUIRE_HW_STRUCT_VERSION_2 for this struct
+ *                      This value should be the first 32-bits in any structure
+ *                      related to this IOCTL. So that if the struct needs to
+ *                      change, we can first read the starting 32-bits, get the
+ *                      version number and then typecast the data to struct
+ *                      accordingly.
+ * @reserved:           Reserved field for 64-bit alignment
+ * @session_handle:     Session handle for the acquire command
+ * @dev_handle:         Device handle to be returned
+ * @handle_type:        Tells you how to interpret the variable resource_hdl-
+ *                      1 = user pointer, 2 = mem handle
+ * @data_size:          Total size of data contained in memory pointed
+ *                      to by resource_hdl
+ * @resource_hdl:       Resource handle that refers to the actual
+ *                      resource data.
+ */
+struct cam_acquire_hw_cmd_v2 {
+	__u32                    struct_version;
+	__u32                    reserved;
+	__s32                    session_handle;
+	__s32                    dev_handle;
+	__u32                    handle_type;
+	__u32                    data_size;
+	__u64                    resource_hdl;
+	struct cam_acquired_hw_info hw_info;
+};
+
+#define CAM_RELEASE_HW_STRUCT_VERSION_1           1
+
+/**
+ * struct cam_release_hw_cmd_v1 - Control payload for release HW IOCTL (Ver 1)
+ *
+ * @struct_version:     = CAM_RELEASE_HW_STRUCT_VERSION_1 for this struct
+ *                      This value should be the first 32-bits in any structure
+ *                      related to this IOCTL. So that if the struct needs to
+ *                      change, we can first read the starting 32-bits, get the
+ *                      version number and then typecast the data to struct
+ *                      accordingly.
+ * @reserved:           Reserved field for 64-bit alignment
+ * @session_handle:     Session handle for the release
+ * @dev_handle:         Device handle for the release
+ */
+struct cam_release_hw_cmd_v1 {
+	__u32                struct_version;
+	__u32                reserved;
+	__s32                session_handle;
+	__s32                dev_handle;
+};
+
+/**
+ * struct cam_flush_dev_cmd - Control payload for flush devices
+ *
+ * @version:           Version
+ * @session_handle:    Session handle for the acquire command
+ * @dev_handle:        Device handle to be returned
+ * @flush_type:        Flush type:
+ *                     0 = flush specific request
+ *                     1 = flush all
+ * @reserved:          Reserved for 64 bit aligngment
+ * @req_id:            Request id that needs to cancel
+ *
+ */
+struct cam_flush_dev_cmd {
+	__u64       version;
+	__s32       session_handle;
+	__s32       dev_handle;
+	__u32       flush_type;
+	__u32       reserved;
+	__s64       req_id;
+};
+
+/**
+ * struct cam_ubwc_config - UBWC Configuration Payload
+ *
+ * @api_version:         UBWC config api version
+ * @num_ports:           Number of ports to be configured
+ * @ubwc_plane_config:   Array of UBWC configurations per port
+ *                       Size [CAM_PACKET_MAX_PLANES - 1] per port
+ *                       as UBWC is supported on Y & C planes
+ *                       and therefore a max size of 2 planes
+ *
+ */
+struct cam_ubwc_config {
+	__u32   api_version;
+	__u32   num_ports;
+	union {
+		struct cam_ubwc_plane_cfg_v1
+			ubwc_plane_cfg[1][CAM_PACKET_MAX_PLANES - 1];
+		struct {
+			struct { } __empty_ubwc_plane_cfg_array_flex;
+			struct cam_ubwc_plane_cfg_v1
+				ubwc_plane_cfg_array_flex[][CAM_PACKET_MAX_PLANES - 1];
+		};
+	};
+};
+
+/**
+ * struct cam_ubwc_config_v2 - UBWC Configuration Payload
+ *
+ * @api_version:         UBWC config api version
+ * @num_ports:           Number of ports to be configured
+ * @ubwc_plane_config:   Array of UBWC configurations per port
+ *                       Size [CAM_PACKET_MAX_PLANES - 1] per port
+ *                       as UBWC is supported on Y & C planes
+ *                       and therefore a max size of 2 planes
+ *
+ */
+struct cam_ubwc_config_v2 {
+	__u32   api_version;
+	__u32   num_ports;
+	union {
+		struct cam_ubwc_plane_cfg_v2
+			ubwc_plane_cfg[1][CAM_PACKET_MAX_PLANES - 1];
+		struct {
+			struct { } __empty_ubwc_plane_cfg_array_flex;
+			struct cam_ubwc_plane_cfg_v2
+				ubwc_plane_cfg_array_flex[][CAM_PACKET_MAX_PLANES - 1];
+		};
+	};
+};
+
+/**
+ * struct cam_cmd_mem_region_info -
+ *              Cmd buffer region info
+ *
+ * @mem_handle : Memory handle of the region
+ * @offset     : Offset if any
+ * @size       : Size of the region
+ * @flags      : Flags if any
+ */
+struct cam_cmd_mem_region_info {
+	__s32 mem_handle;
+	__u32 offset;
+	__u32 size;
+	__u32 flags;
+};
+
+/**
+ * struct cam_cmd_mem_regions -
+ *        List of multiple memory descriptors of
+ *        of different regions
+ *
+ * @version        : Version number
+ * @num_regions    : Number of regions
+ * @map_info_array : Array of all the regions
+ */
+struct cam_cmd_mem_regions {
+	__u32 version;
+	__u32 num_regions;
+    union {
+        struct cam_cmd_mem_region_info map_info_array[1];
+        __DECLARE_FLEX_ARRAY(struct cam_cmd_mem_region_info, map_info_array_flex);
+    };
+};
+
+/**
+ * struct cam_reg_write_desc - Register write descriptor
+ *
+ * @offset               : Register offset at which 'value' needs to written
+ * @value                : Register value to write
+ */
+struct cam_reg_write_desc {
+	__u32 offset;
+	__u32 value;
+};
+
+/**
+ * struct cam_reg_range_read_desc - Descriptor to provide read info
+ *
+ * @offset               : Register offset address to start with
+ * @num_values           : Number of values to read
+ */
+struct cam_reg_range_read_desc {
+	__u32   offset;
+	__u32   num_values;
+};
+
+/**
+ * struct cam_dmi_read_desc - Descriptor to provide DMI read info
+ *
+ * @num_pre_writes       : Number of registers to write before reading DMI data
+ * @num_post_writes      : Number of registers to write after reading DMI data
+ * @pre_read_config      : Registers to write before reading DMI data
+ * @dmi_data_read        : DMI Register, number of values to read to dump
+ *                         DMI data
+ * @post_read_config     : Registers to write after reading DMI data
+ */
+struct cam_dmi_read_desc {
+	__u32                         num_pre_writes;
+	__u32                         num_post_writes;
+	struct cam_reg_write_desc        pre_read_config[
+						CAM_REG_DUMP_DMI_CONFIG_MAX];
+	struct cam_reg_range_read_desc   dmi_data_read;
+	struct cam_reg_write_desc        post_read_config[
+						CAM_REG_DUMP_DMI_CONFIG_MAX];
+};
+
+/**
+ * struct cam_reg_read_info - Register read info for both reg continuous read
+ *                            or DMI read
+ *
+ * @type                 : Whether Register range read or DMI read
+ * @reg_read             : Range of registers to read
+ * @dmi_read             : DMI data to read
+ */
+struct cam_reg_read_info {
+	__u32                                  type;
+	__u32                                  reserved;
+	union {
+		struct cam_reg_range_read_desc reg_read;
+		struct cam_dmi_read_desc       dmi_read;
+	};
+};
+
+/**
+ * struct cam_reg_dump_out_buffer -Buffer info for dump data to be provided
+ *
+ * @req_id               : Request ID corresponding to reg dump data
+ * @bytes_written        : Number of bytes written
+ * @dump_data            : Register dump data
+ */
+struct cam_reg_dump_out_buffer {
+	__u64   req_id;
+	__u32   bytes_written;
+    union {
+        __u32   dump_data[1];
+        __DECLARE_FLEX_ARRAY(__u32, dump_data_flex);
+    };
+};
+
+/**
+ * struct cam_reg_dump_desc - Descriptor to provide dump info
+ *
+ * @reg_base_type        : Register base type, e.g. ISP_LEFT, ISP_RIGHT, CAMNOC
+ * @dump_buffer_offset   : Offset from base of mem_handle at which Register dump
+ *                         will be written for this set
+ * @dump_buffer_size     : Available size in bytes for writing dump values
+ * @num_read_range       : Number register range reads (Continuous + DMI)
+ * @read_range           : Read range info
+ */
+struct cam_reg_dump_desc {
+	__u32                    reg_base_type;
+	__u32                    dump_buffer_offset;
+	__u32                    dump_buffer_size;
+	__u32                    num_read_range;
+    union {
+        struct cam_reg_read_info read_range[1];
+        __DECLARE_FLEX_ARRAY(struct cam_reg_read_info, read_range_flex);
+    };
+};
+
+/**
+ * struct cam_reg_dump_input_info - Info about required dump sets
+ *
+ * @num_dump_sets        : Number of different dump sets (base types) given
+ * @dump_set_offsets     : Points to the given dump description structures
+ *                         (cam_reg_dump_desc)
+ */
+struct cam_reg_dump_input_info {
+	__u32                   num_dump_sets;
+    union {
+        __u32                   dump_set_offsets[1];
+        __DECLARE_FLEX_ARRAY(__u32, dump_set_offsets_flex);
+    };
+};
+
+/**
+ * struct cam_dump_req_cmd -
+ *        Dump the information of issue req id
+ *
+ * @issue_req_id   : Issue Request Id
+ * @offset         : Offset for the buffer
+ * @buf_handle     : Buffer Handle
+ * @error_type     : Error type, using it, dumping information can be extended
+ * @session_handle : Session Handle
+ * @link_hdl       : link handle
+ * @dev_handle     : Device Handle
+ */
+struct cam_dump_req_cmd {
+	__u64           issue_req_id;
+	__kernel_size_t offset;
+	__u32           buf_handle;
+	__u32           error_type;
+	__s32           session_handle;
+	__s32           link_hdl;
+	__s32           dev_handle;
+};
+
+#endif /* __UAPI_CAM_DEFS_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_fd.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_fd.h
@@ -0,0 +1,133 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_FD_H__
+#define __UAPI_CAM_FD_H__
+
+#include <media/cam_defs.h>
+
+#define CAM_FD_MAX_FACES                       35
+#define CAM_FD_RAW_RESULT_ENTRIES              512
+
+/* FD Op Codes */
+#define CAM_PACKET_OPCODES_FD_FRAME_UPDATE     0x0
+
+/* FD Command Buffer identifiers */
+#define CAM_FD_CMD_BUFFER_ID_GENERIC           0x0
+#define CAM_FD_CMD_BUFFER_ID_CDM               0x1
+#define CAM_FD_CMD_BUFFER_ID_MAX               0x2
+
+/* FD Blob types */
+#define CAM_FD_BLOB_TYPE_SOC_CLOCK_BW_REQUEST  0x0
+#define CAM_FD_BLOB_TYPE_RAW_RESULTS_REQUIRED  0x1
+
+/* FD Resource IDs */
+#define CAM_FD_INPUT_PORT_ID_IMAGE             0x0
+#define CAM_FD_INPUT_PORT_ID_MAX               0x1
+
+#define CAM_FD_OUTPUT_PORT_ID_RESULTS          0x0
+#define CAM_FD_OUTPUT_PORT_ID_RAW_RESULTS      0x1
+#define CAM_FD_OUTPUT_PORT_ID_WORK_BUFFER      0x2
+#define CAM_FD_OUTPUT_PORT_ID_MAX              0x3
+
+/**
+ * struct cam_fd_soc_clock_bw_request - SOC clock, bandwidth request info
+ *
+ * @clock_rate : Clock rate required while processing frame
+ * @bandwidth  : Bandwidth required while processing frame
+ * @reserved   : Reserved for future use
+ */
+struct cam_fd_soc_clock_bw_request {
+	__u64    clock_rate;
+	__u64    bandwidth;
+	__u64    reserved[4];
+};
+
+/**
+ * struct cam_fd_face - Face properties
+ *
+ * @prop1 : Property 1 of face
+ * @prop2 : Property 2 of face
+ * @prop3 : Property 3 of face
+ * @prop4 : Property 4 of face
+ *
+ * Do not change this layout, this is inline with how HW writes
+ * these values directly when the buffer is programmed to HW
+ */
+struct cam_fd_face {
+	__u32    prop1;
+	__u32    prop2;
+	__u32    prop3;
+	__u32    prop4;
+};
+
+/**
+ * struct cam_fd_results - FD results layout
+ *
+ * @faces      : Array of faces with face properties
+ * @face_count : Number of faces detected
+ * @reserved   : Reserved for alignment
+ *
+ * Do not change this layout, this is inline with how HW writes
+ * these values directly when the buffer is programmed to HW
+ */
+struct cam_fd_results {
+	struct cam_fd_face faces[CAM_FD_MAX_FACES];
+	__u32              face_count;
+	__u32              reserved[3];
+};
+
+/**
+ * struct cam_fd_hw_caps - Face properties
+ *
+ * @core_version          : FD core version
+ * @wrapper_version       : FD wrapper version
+ * @raw_results_available : Whether raw results are available on this HW
+ * @supported_modes       : Modes supported by this HW.
+ * @reserved              : Reserved for future use
+ */
+struct cam_fd_hw_caps {
+	struct cam_hw_version core_version;
+	struct cam_hw_version wrapper_version;
+	__u32                 raw_results_available;
+	__u32                 supported_modes;
+	__u64                 reserved;
+};
+
+/**
+ * struct cam_fd_query_cap_cmd - FD Query capabilities information
+ *
+ * @device_iommu : FD IOMMU handles
+ * @cdm_iommu    : CDM iommu handles
+ * @hw_caps      : FD HW capabilities
+ * @reserved     : Reserved for alignment
+ */
+struct cam_fd_query_cap_cmd {
+	struct cam_iommu_handle device_iommu;
+	struct cam_iommu_handle cdm_iommu;
+	struct cam_fd_hw_caps   hw_caps;
+	__u64                   reserved;
+};
+
+/**
+ * struct cam_fd_acquire_dev_info - FD acquire device information
+ *
+ * @clk_bw_request  : SOC clock, bandwidth request
+ * @priority        : Priority for this acquire
+ * @mode            : Mode in which to run FD HW.
+ * @get_raw_results : Whether this acquire needs face raw results
+ *                    while frame processing
+ * @reserved        : Reserved field for 64 bit alignment
+ */
+struct cam_fd_acquire_dev_info {
+	struct cam_fd_soc_clock_bw_request clk_bw_request;
+	__u32                              priority;
+	__u32                              mode;
+	__u32                              get_raw_results;
+	__u32                              reserved[13];
+};
+
+#endif /* __UAPI_CAM_FD_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_icp.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_icp.h
@@ -0,0 +1,220 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ICP_H__
+#define __UAPI_CAM_ICP_H__
+
+#include <media/cam_defs.h>
+#include <media/cam_cpas.h>
+
+/* icp, ipe, bps, cdm(ipe/bps) are used in querycap */
+#define CAM_ICP_DEV_TYPE_A5      1
+#define CAM_ICP_DEV_TYPE_IPE     2
+#define CAM_ICP_DEV_TYPE_BPS     3
+#define CAM_ICP_DEV_TYPE_IPE_CDM 4
+#define CAM_ICP_DEV_TYPE_BPS_CDM 5
+#define CAM_ICP_DEV_TYPE_MAX     5
+
+/* definitions needed for icp aquire device */
+#define CAM_ICP_RES_TYPE_BPS         1
+#define CAM_ICP_RES_TYPE_IPE_RT      2
+#define CAM_ICP_RES_TYPE_IPE         3
+#define CAM_ICP_RES_TYPE_IPE_SEMI_RT 4
+#define CAM_ICP_RES_TYPE_BPS_RT      5
+#define CAM_ICP_RES_TYPE_BPS_SEMI_RT 6
+#define CAM_ICP_RES_TYPE_MAX         7
+
+/* packet opcode types */
+#define CAM_ICP_OPCODE_IPE_UPDATE   0
+#define CAM_ICP_OPCODE_BPS_UPDATE   1
+#define CAM_ICP_OPCODE_IPE_SETTINGS 2
+#define CAM_ICP_OPCODE_BPS_SETTINGS 3
+
+
+/* IPE input port resource type */
+#define CAM_ICP_IPE_INPUT_IMAGE_FULL            0x0
+#define CAM_ICP_IPE_INPUT_IMAGE_DS4             0x1
+#define CAM_ICP_IPE_INPUT_IMAGE_DS16            0x2
+#define CAM_ICP_IPE_INPUT_IMAGE_DS64            0x3
+#define CAM_ICP_IPE_INPUT_IMAGE_FULL_REF        0x4
+#define CAM_ICP_IPE_INPUT_IMAGE_DS4_REF         0x5
+#define CAM_ICP_IPE_INPUT_IMAGE_DS16_REF        0x6
+#define CAM_ICP_IPE_INPUT_IMAGE_DS64_REF        0x7
+
+/* IPE output port resource type */
+#define CAM_ICP_IPE_OUTPUT_IMAGE_DISPLAY        0x8
+#define CAM_ICP_IPE_OUTPUT_IMAGE_VIDEO          0x9
+#define CAM_ICP_IPE_OUTPUT_IMAGE_FULL_REF       0xA
+#define CAM_ICP_IPE_OUTPUT_IMAGE_DS4_REF        0xB
+#define CAM_ICP_IPE_OUTPUT_IMAGE_DS16_REF       0xC
+#define CAM_ICP_IPE_OUTPUT_IMAGE_DS64_REF       0xD
+
+#define CAM_ICP_IPE_IMAGE_MAX                   0xE
+
+/* BPS input port resource type */
+#define CAM_ICP_BPS_INPUT_IMAGE                 0x0
+
+/* BPS output port resource type */
+#define CAM_ICP_BPS_OUTPUT_IMAGE_FULL           0x1
+#define CAM_ICP_BPS_OUTPUT_IMAGE_DS4            0x2
+#define CAM_ICP_BPS_OUTPUT_IMAGE_DS16           0x3
+#define CAM_ICP_BPS_OUTPUT_IMAGE_DS64           0x4
+#define CAM_ICP_BPS_OUTPUT_IMAGE_STATS_BG       0x5
+#define CAM_ICP_BPS_OUTPUT_IMAGE_STATS_BHIST    0x6
+#define CAM_ICP_BPS_OUTPUT_IMAGE_REG1           0x7
+#define CAM_ICP_BPS_OUTPUT_IMAGE_REG2           0x8
+
+#define CAM_ICP_BPS_IO_IMAGES_MAX               0x9
+
+/* Command meta types */
+#define CAM_ICP_CMD_META_GENERIC_BLOB           0x1
+
+/* Generic blob types */
+#define CAM_ICP_CMD_GENERIC_BLOB_CLK            0x1
+#define CAM_ICP_CMD_GENERIC_BLOB_CFG_IO         0x2
+#define CAM_ICP_CMD_GENERIC_BLOB_FW_MEM_MAP     0x3
+#define CAM_ICP_CMD_GENERIC_BLOB_FW_MEM_UNMAP   0x4
+#define CAM_ICP_CMD_GENERIC_BLOB_CLK_V2         0x5
+
+/**
+ * struct cam_icp_clk_bw_request_v2
+ *
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @reserved: For memory alignment
+ * @num_paths: Number of axi paths in bw request
+ * @axi_path: Per path vote info for IPE/BPS
+ */
+struct cam_icp_clk_bw_request_v2 {
+	__u64                           budget_ns;
+	__u32                           frame_cycles;
+	__u32                           rt_flag;
+	__u32                           reserved;
+	__u32                           num_paths;
+    union {
+        struct cam_axi_per_path_bw_vote axi_path[1];
+        __DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+    };
+};
+
+/**
+ * struct cam_icp_clk_bw_request
+ *
+ * @budget_ns: Time required to process frame
+ * @frame_cycles: Frame cycles needed to process the frame
+ * @rt_flag: Flag to indicate real time stream
+ * @uncompressed_bw: Bandwidth required to process frame
+ * @compressed_bw: Compressed bandwidth to process frame
+ */
+struct cam_icp_clk_bw_request {
+	__u64 budget_ns;
+	__u32 frame_cycles;
+	__u32 rt_flag;
+	__u64 uncompressed_bw;
+	__u64 compressed_bw;
+};
+
+/**
+ * struct cam_icp_dev_ver - Device information for particular hw type
+ *
+ * This is used to get device version info of
+ * ICP, IPE, BPS and CDM related IPE and BPS from firmware
+ * and use this info in CAM_QUERY_CAP IOCTL
+ *
+ * @dev_type: hardware type for the cap info(icp, ipe, bps, cdm(ipe/bps))
+ * @reserved: reserved field
+ * @hw_ver: major, minor and incr values of a device version
+ */
+struct cam_icp_dev_ver {
+	__u32                 dev_type;
+	__u32                 reserved;
+	struct cam_hw_version hw_ver;
+};
+
+/**
+ * struct cam_icp_ver - ICP version info
+ *
+ * This strcuture is used for fw and api version
+ * this is used to get firmware version and api version from firmware
+ * and use this info in CAM_QUERY_CAP IOCTL
+ *
+ * @major: FW version major
+ * @minor: FW version minor
+ * @revision: FW version increment
+ */
+struct cam_icp_ver {
+	__u32 major;
+	__u32 minor;
+	__u32 revision;
+	__u32 reserved;
+};
+
+/**
+ * struct cam_icp_query_cap_cmd - ICP query device capability payload
+ *
+ * @dev_iommu_handle: icp iommu handles for secure/non secure modes
+ * @cdm_iommu_handle: iommu handles for secure/non secure modes
+ * @fw_version: firmware version info
+ * @api_version: api version info
+ * @num_ipe: number of ipes
+ * @num_bps: number of bps
+ * @dev_ver: returned device capability array
+ */
+struct cam_icp_query_cap_cmd {
+	struct cam_iommu_handle dev_iommu_handle;
+	struct cam_iommu_handle cdm_iommu_handle;
+	struct cam_icp_ver      fw_version;
+	struct cam_icp_ver      api_version;
+	__u32                   num_ipe;
+	__u32                   num_bps;
+	struct cam_icp_dev_ver  dev_ver[CAM_ICP_DEV_TYPE_MAX];
+};
+
+/**
+ * struct cam_icp_res_info - ICP output resource info
+ *
+ * @format: format of the resource
+ * @width:  width in pixels
+ * @height: height in lines
+ * @fps:  fps
+ */
+struct cam_icp_res_info {
+	__u32 format;
+	__u32 width;
+	__u32 height;
+	__u32 fps;
+};
+
+/**
+ * struct cam_icp_acquire_dev_info - An ICP device info
+ *
+ * @scratch_mem_size: Output param - size of scratch memory
+ * @dev_type: device type (IPE_RT/IPE_NON_RT/BPS)
+ * @io_config_cmd_size: size of IO config command
+ * @io_config_cmd_handle: IO config command for each acquire
+ * @secure_mode: camera mode (secure/non secure)
+ * @chain_info: chaining info of FW device handles
+ * @in_res: resource info used for clock and bandwidth calculation
+ * @num_out_res: number of output resources
+ * @out_res: output resource
+ */
+struct cam_icp_acquire_dev_info {
+	__u32                   scratch_mem_size;
+	__u32                   dev_type;
+	__u32                   io_config_cmd_size;
+	__s32                   io_config_cmd_handle;
+	__u32                   secure_mode;
+	__s32                   chain_info;
+	struct cam_icp_res_info in_res;
+	__u32                   num_out_res;
+    union {
+        struct cam_icp_res_info out_res[1];
+        __DECLARE_FLEX_ARRAY(struct cam_icp_res_info, out_res_flex);
+    };
+} __attribute__((__packed__));
+
+#endif /* __UAPI_CAM_ICP_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp.h
@@ -0,0 +1,918 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_H__
+#define __UAPI_CAM_ISP_H__
+
+#include <media/cam_defs.h>
+#include <media/cam_isp_vfe.h>
+#include <media/cam_isp_ife.h>
+#include <media/cam_isp_sfe.h>
+#include <media/cam_cpas.h>
+
+/* ISP driver name */
+#define CAM_ISP_DEV_NAME                        "cam-isp"
+
+/* HW type */
+#define CAM_ISP_HW_BASE                         0
+#define CAM_ISP_HW_CSID                         1
+#define CAM_ISP_HW_VFE                          2
+#define CAM_ISP_HW_IFE                          3
+#define CAM_ISP_HW_ISPIF                        4
+#define CAM_ISP_HW_IFE_LITE                     5
+#define CAM_ISP_HW_CSID_LITE                    6
+#define CAM_ISP_HW_SFE                          7
+#define CAM_ISP_HW_MAX                          8
+
+/* Color Pattern */
+#define CAM_ISP_PATTERN_BAYER_RGRGRG            0
+#define CAM_ISP_PATTERN_BAYER_GRGRGR            1
+#define CAM_ISP_PATTERN_BAYER_BGBGBG            2
+#define CAM_ISP_PATTERN_BAYER_GBGBGB            3
+#define CAM_ISP_PATTERN_YUV_YCBYCR              4
+#define CAM_ISP_PATTERN_YUV_YCRYCB              5
+#define CAM_ISP_PATTERN_YUV_CBYCRY              6
+#define CAM_ISP_PATTERN_YUV_CRYCBY              7
+#define CAM_ISP_PATTERN_MAX                     8
+
+/* Usage Type */
+#define CAM_ISP_RES_USAGE_SINGLE                0
+#define CAM_ISP_RES_USAGE_DUAL                  1
+#define CAM_ISP_RES_USAGE_MAX                   2
+
+/* Resource ID */
+#define CAM_ISP_RES_ID_PORT                     0
+#define CAM_ISP_RES_ID_CLK                      1
+#define CAM_ISP_RES_ID_MAX                      2
+
+/* Resource Type - Type of resource for the resource id
+ * defined in cam_isp_vfe.h, cam_isp_ife.h
+ */
+
+/* Lane Type in input resource for Port */
+#define CAM_ISP_LANE_TYPE_DPHY                  0
+#define CAM_ISP_LANE_TYPE_CPHY                  1
+#define CAM_ISP_LANE_TYPE_MAX                   2
+
+/* ISP Resurce Composite Group ID */
+#define CAM_ISP_RES_COMP_GROUP_NONE             0
+#define CAM_ISP_RES_COMP_GROUP_ID_0             1
+#define CAM_ISP_RES_COMP_GROUP_ID_1             2
+#define CAM_ISP_RES_COMP_GROUP_ID_2             3
+#define CAM_ISP_RES_COMP_GROUP_ID_3             4
+#define CAM_ISP_RES_COMP_GROUP_ID_4             5
+#define CAM_ISP_RES_COMP_GROUP_ID_5             6
+#define CAM_ISP_RES_COMP_GROUP_ID_MAX           6
+
+/* ISP packet opcode for ISP */
+#define CAM_ISP_PACKET_OP_BASE                  0
+#define CAM_ISP_PACKET_INIT_DEV                 1
+#define CAM_ISP_PACKET_UPDATE_DEV               2
+#define CAM_ISP_PACKET_OP_MAX                   3
+
+/* ISP packet meta_data type for command buffer */
+#define CAM_ISP_PACKET_META_BASE                  0
+#define CAM_ISP_PACKET_META_LEFT                  1
+#define CAM_ISP_PACKET_META_RIGHT                 2
+#define CAM_ISP_PACKET_META_COMMON                3
+#define CAM_ISP_PACKET_META_DMI_LEFT              4
+#define CAM_ISP_PACKET_META_DMI_RIGHT             5
+#define CAM_ISP_PACKET_META_DMI_COMMON            6
+#define CAM_ISP_PACKET_META_CLOCK                 7
+#define CAM_ISP_PACKET_META_CSID                  8
+#define CAM_ISP_PACKET_META_DUAL_CONFIG           9
+#define CAM_ISP_PACKET_META_GENERIC_BLOB_LEFT     10
+#define CAM_ISP_PACKET_META_GENERIC_BLOB_RIGHT    11
+#define CAM_ISP_PACKET_META_GENERIC_BLOB_COMMON   12
+#define CAM_ISP_PACKET_META_REG_DUMP_PER_REQUEST  13
+#define CAM_ISP_PACKET_META_REG_DUMP_ON_FLUSH     14
+#define CAM_ISP_PACKET_META_REG_DUMP_ON_ERROR     15
+#define CAM_ISP_PACKET_META_MODE_SWITCH_CONFIG    16
+#define CAM_ISP_PACKET_META_CSID_LEFT             17
+#define CAM_ISP_PACKET_META_CSID_RIGHT            18
+#define CAM_ISP_PACKET_META_CSID_COMMON           19
+
+/* SFE packet meta_data type for command buffer */
+#define CAM_ISP_SFE_PACKET_META_LEFT              0x15
+#define CAM_ISP_SFE_PACKET_META_RIGHT             0x16
+#define CAM_ISP_SFE_PACKET_META_COMMON            0x17
+#define CAM_ISP_SFE_PACKET_META_DUAL_CONFIG       0x18
+
+/* DSP mode */
+#define CAM_ISP_DSP_MODE_NONE                   0
+#define CAM_ISP_DSP_MODE_ONE_WAY                1
+#define CAM_ISP_DSP_MODE_ROUND                  2
+
+/* ISP Generic Cmd Buffer Blob types */
+#define CAM_ISP_GENERIC_BLOB_TYPE_HFR_CONFIG                0
+#define CAM_ISP_GENERIC_BLOB_TYPE_CLOCK_CONFIG              1
+#define CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG                 2
+#define CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG               3
+#define CAM_ISP_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG         4
+#define CAM_ISP_GENERIC_BLOB_TYPE_FE_CONFIG                 5
+#define CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG_V2            6
+#define CAM_ISP_GENERIC_BLOB_TYPE_IFE_CORE_CONFIG           7
+#define CAM_ISP_GENERIC_BLOB_TYPE_VFE_OUT_CONFIG            8
+#define CAM_ISP_GENERIC_BLOB_TYPE_BW_CONFIG_V2              9
+#define CAM_ISP_GENERIC_BLOB_TYPE_CSID_CONFIG               10
+#define CAM_ISP_GENERIC_BLOB_TYPE_SENSOR_DIMENSION_CONFIG   11
+#define CAM_ISP_GENERIC_BLOB_TYPE_CSID_QCFA_CONFIG          12
+#define CAM_ISP_GENERIC_BLOB_TYPE_SENSOR_BLANKING_CONFIG    13
+#define CAM_ISP_GENERIC_BLOB_TYPE_TPG_CORE_CONFIG           14
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_CLOCK_CONFIG          21
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_CORE_CONFIG           22
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_OUT_CONFIG            23
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_HFR_CONFIG            24
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_FE_CONFIG             25
+#define CAM_ISP_GENERIC_BLOB_TYPE_SFE_SCRATCH_BUF_CFG       26
+
+#define CAM_ISP_VC_DT_CFG    4
+
+#define CAM_ISP_IFE0_HW          0x1
+#define CAM_ISP_IFE1_HW          0x2
+#define CAM_ISP_IFE0_LITE_HW     0x4
+#define CAM_ISP_IFE1_LITE_HW     0x8
+#define CAM_ISP_IFE2_LITE_HW     0x10
+#define CAM_ISP_IFE3_LITE_HW     0x20
+#define CAM_ISP_IFE4_LITE_HW     0x40
+#define CAM_ISP_IFE2_HW          0x100
+#define CAM_ISP_SFE0_HW          0x1000
+#define CAM_ISP_SFE1_HW          0x2000
+
+#define CAM_ISP_PXL_PATH          0x1
+#define CAM_ISP_PPP_PATH          0x2
+#define CAM_ISP_LCR_PATH          0x4
+#define CAM_ISP_RDI0_PATH         0x8
+#define CAM_ISP_RDI1_PATH         0x10
+#define CAM_ISP_RDI2_PATH         0x20
+#define CAM_ISP_RDI3_PATH         0x40
+
+/* Per Path Usage Data */
+#define CAM_ISP_USAGE_INVALID     0
+#define CAM_ISP_USAGE_LEFT_PX     1
+#define CAM_ISP_USAGE_RIGHT_PX    2
+#define CAM_ISP_USAGE_RDI         3
+#define CAM_ISP_USAGE_SFE_LEFT    4
+#define CAM_ISP_USAGE_SFE_RIGHT   5
+#define CAM_ISP_USAGE_SFE_RDI     6
+
+/* Acquire with custom hw */
+#define CAM_ISP_ACQ_CUSTOM_NONE       0
+#define CAM_ISP_ACQ_CUSTOM_PRIMARY    1
+#define CAM_ISP_ACQ_CUSTOM_SECONDARY  2
+
+#define CAM_IFE_CSID_RDI_MAX          4
+
+/* Feature Flag indicators */
+#define CAM_ISP_PARAM_FETCH_SECURITY_MODE  BIT(0)
+
+/* Feature flag indicator for IOT Dynamic RDI Allocation */
+#define CAM_ISP_PARAM_DYNAMIC_RDI_EN       BIT(10)
+
+/* ISP core cfg flag params */
+#define CAM_ISP_PARAM_CORE_CFG_HDR_MUX_SEL BIT(0)
+#define CAM_ISP_PARAM_CORE_CFG_PP_FORMAT   BIT(16)
+
+/* Query devices */
+/**
+ * struct cam_isp_dev_cap_info - A cap info for particular hw type
+ *
+ * @hw_type:            Hardware type for the cap info
+ * @num_hw:             Number of HW of type @hw_type
+ * @hw_version:         Hardware version
+ *
+ */
+struct cam_isp_dev_cap_info {
+	__u32              hw_type;
+	__u32              num_hw;
+	struct cam_hw_version hw_version;
+};
+
+/**
+ * struct cam_isp_query_cap_cmd - ISP query device capability payload
+ *
+ * @device_iommu:               returned iommu handles for device
+ * @cdm_iommu:                  returned iommu handles for cdm
+ * @num_dev:                    returned number of device capabilities
+ * @reserved:                   reserved field for alignment
+ * @dev_caps:                   returned device capability array
+ *
+ */
+struct cam_isp_query_cap_cmd {
+	struct cam_iommu_handle     device_iommu;
+	struct cam_iommu_handle     cdm_iommu;
+	__s32                       num_dev;
+	__u32                       reserved;
+	struct cam_isp_dev_cap_info dev_caps[CAM_ISP_HW_MAX];
+};
+
+/* Acquire Device */
+/**
+ * struct cam_isp_out_port_info - An output port resource info
+ *
+ * @res_type:                   output resource type defined in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @format:                     output format of the resource
+ * @wdith:                      output width in pixels
+ * @height:                     output height in lines
+ * @comp_grp_id:                composite group id for the resource.
+ * @split_point:                split point in pixels for the dual VFE.
+ * @secure_mode:                flag to tell if output should be run in secure
+ *                              mode or not. See cam_defs.h for definition
+ * @reserved:                   reserved field for alignment
+ *
+ */
+struct cam_isp_out_port_info {
+	__u32                res_type;
+	__u32                format;
+	__u32                width;
+	__u32                height;
+	__u32                comp_grp_id;
+	__u32                split_point;
+	__u32                secure_mode;
+	__u32                reserved;
+};
+
+/**
+ * struct cam_isp_out_port_info_v2 - An output port resource info
+ *
+ * @res_type:                   output resource type defined in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @format:                     output format of the resource
+ * @wdith:                      output width in pixels
+ * @height:                     output height in lines
+ * @comp_grp_id:                composite group id for the resource.
+ * @split_point:                split point in pixels for the dual VFE.
+ * @secure_mode:                flag to tell if output should be run in secure
+ *                              mode or not. See cam_defs.h for definition
+ * @wm_mode:                    WM mode
+ * @out_port_res1:              Output reserved field
+ * @out_port_res2:              Output reserved field
+ *
+ */
+struct cam_isp_out_port_info_v2 {
+	__u32                res_type;
+	__u32                format;
+	__u32                width;
+	__u32                height;
+	__u32                comp_grp_id;
+	__u32                split_point;
+	__u32                secure_mode;
+	__u32                wm_mode;
+	__u32                out_port_res1;
+	__u32                out_port_res2;
+};
+
+/**
+ * struct cam_isp_in_port_info - An input port resource info
+ *
+ * @res_type:                   input resource type define in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @format:                     input format
+ * @test_pattern:               test pattern for the testgen
+ * @usage_type:                 whether dual vfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_stop:                  left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ *                              Only for Dual VFE
+ * @right_stop:                 right input stop offset in pixels.
+ *                              Only for Dual VFE
+ * @right_width:                right input width in pixels.
+ *                              Only for dual VFE
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @pixel_clk;                  sensor output clock
+ * @batch_size:                 batch size for HFR mode
+ * @dsp_mode:                   DSP stream mode (Defines as CAM_ISP_DSP_MODE_*)
+ * @hbi_cnt:                    HBI count for the camif input
+ * @reserved:                   Reserved field for alignment
+ * @num_out_res:                number of the output resource associated
+ * @data:                       payload that contains the output resources
+ *
+ */
+struct cam_isp_in_port_info {
+	__u32                        res_type;
+	__u32                        lane_type;
+	__u32                        lane_num;
+	__u32                        lane_cfg;
+	__u32                        vc;
+	__u32                        dt;
+	__u32                        format;
+	__u32                        test_pattern;
+	__u32                        usage_type;
+	__u32                        left_start;
+	__u32                        left_stop;
+	__u32                        left_width;
+	__u32                        right_start;
+	__u32                        right_stop;
+	__u32                        right_width;
+	__u32                        line_start;
+	__u32                        line_stop;
+	__u32                        height;
+	__u32                        pixel_clk;
+	__u32                        batch_size;
+	__u32                        dsp_mode;
+	__u32                        hbi_cnt;
+	__u32                        reserved;
+	__u32                        num_out_res;
+    union {
+        struct cam_isp_out_port_info data[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_out_port_info, data_flex);
+    };
+};
+
+/**
+ * struct cam_isp_in_port_info_v2 - An input port resource info
+ *
+ * @res_type:                   input resource type define in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @num_valid_vc_dt:            valid vc and dt in array
+ * @format:                     input format
+ * @test_pattern:               test pattern for the testgen
+ * @usage_type:                 whether dual vfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_stop:                  left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ *                              Only for Dual VFE
+ * @right_stop:                 right input stop offset in pixels.
+ *                              only for Dual VFE
+ * @right_width:                right input width in pixels.
+ *                              only for dual VFE
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @pixel_clk;                  sensor output clock
+ * @batch_size:                 batch size for HFR mode
+ * @dsp_mode:                   DSP stream mode (Defines as CAM_ISP_DSP_MODE_*)
+ * @hbi_cnt:                    HBI count for the camif input
+ * @cust_node:                  if any custom HW block is present before IFE
+ * @num_out_res:                number of the output resource associated
+ * @horizontal_bin:             Horizontal Binning info
+ * @qcfa_bin:                   Quadra Binning info
+ * @sfe_in_path_type:           SFE input path type
+ *                              0:15 - refer to cam_isp_sfe.h for SFE paths
+ *                              16:31 - Corresponding IFE i/p path type
+ *                              Example:((CAM_ISP_PXL_PATH << 16) |
+ *                                        CAM_ISP_SFE_INLINE_PIX)
+ *                              This will acquire SFE inline IPP and IFE IPP
+ *                              PPP is an exception CSID PPP -> IFE PPP
+ * @feature_flag:               See the macros defined under feature flag above
+ * @ife_res_1:                  payload for future use
+ * @dynamic_rdi_rsrc_mask:      Updated RDI mapping mask when dynamic RDI allocation is enabled
+ *                              LSB 16 bits denote which actual hardware path was acquired
+ *                              MSB 16 bits denote which interface the just-acquired hw interface
+ *                              is mapped to in UMD. Each 2 bits denote a single RDI interface idx,
+ *                              and the value denote the interface that was mapped to.
+ * @data:                       payload that contains the output resources
+ *
+ */
+struct cam_isp_in_port_info_v2 {
+	__u32                           res_type;
+	__u32                           lane_type;
+	__u32                           lane_num;
+	__u32                           lane_cfg;
+	__u32                           vc[CAM_ISP_VC_DT_CFG];
+	__u32                           dt[CAM_ISP_VC_DT_CFG];
+	__u32                           num_valid_vc_dt;
+	__u32                           format;
+	__u32                           test_pattern;
+	__u32                           usage_type;
+	__u32                           left_start;
+	__u32                           left_stop;
+	__u32                           left_width;
+	__u32                           right_start;
+	__u32                           right_stop;
+	__u32                           right_width;
+	__u32                           line_start;
+	__u32                           line_stop;
+	__u32                           height;
+	__u32                           pixel_clk;
+	__u32                           batch_size;
+	__u32                           dsp_mode;
+	__u32                           hbi_cnt;
+	__u32                           cust_node;
+	__u32                           num_out_res;
+	__u32                           offline_mode;
+	__u32                           horizontal_bin;
+	__u32                           qcfa_bin;
+	__u32                           sfe_in_path_type;
+	__u32                           feature_flag;
+	__u32                           ife_res_1;
+	__u32                           dynamic_rdi_rsrc_mask;
+    union {
+        struct cam_isp_out_port_info_v2 data[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_out_port_info_v2, data_flex);
+    };
+};
+
+/**
+ * struct cam_isp_resource - A resource bundle
+ *
+ * @resoruce_id:                resource id for the resource bundle
+ * @length:                     length of the while resource blob
+ * @handle_type:                type of the resource handle
+ * @reserved:                   reserved field for alignment
+ * @res_hdl:                    resource handle that points to the
+ *                                     resource array;
+ *
+ */
+struct cam_isp_resource {
+	__u32                       resource_id;
+	__u32                       length;
+	__u32                       handle_type;
+	__u32                       reserved;
+	__u64                       res_hdl;
+};
+
+/**
+ * struct cam_isp_port_hfr_config - HFR configuration for this port
+ *
+ * @resource_type:              Resource type
+ * @subsample_pattern:          Subsample pattern. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @subsample_period:           Subsample period. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @framedrop_pattern:          Framedrop pattern
+ * @framedrop_period:           Framedrop period
+ * @reserved:                   Reserved for alignment
+ */
+struct cam_isp_port_hfr_config {
+	__u32                       resource_type;
+	__u32                       subsample_pattern;
+	__u32                       subsample_period;
+	__u32                       framedrop_pattern;
+	__u32                       framedrop_period;
+	__u32                       reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_resource_hfr_config - Resource HFR configuration
+ *
+ * @num_ports:                  Number of ports
+ * @reserved:                   Reserved for alignment
+ * @port_hfr_config:            HFR configuration for each IO port
+ */
+struct cam_isp_resource_hfr_config {
+	__u32                          num_ports;
+	__u32                          reserved;
+    union {
+        struct cam_isp_port_hfr_config port_hfr_config[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_port_hfr_config, port_hfr_config_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_dual_split_params - dual isp spilt parameters
+ *
+ * @split_point:                Split point information x, where (0 < x < width)
+ *                              left ISP's input ends at x + righ padding and
+ *                              Right ISP's input starts at x - left padding
+ * @right_padding:              Padding added past the split point for left
+ *                              ISP's input
+ * @left_padding:               Padding added before split point for right
+ *                              ISP's input
+ * @reserved:                   Reserved filed for alignment
+ *
+ */
+struct cam_isp_dual_split_params {
+	__u32                       split_point;
+	__u32                       right_padding;
+	__u32                       left_padding;
+	__u32                       reserved;
+};
+
+/**
+ * struct cam_isp_dual_stripe_config - stripe config per bus client
+ *
+ * @offset:                     Start horizontal offset relative to
+ *                              output buffer
+ *                              In UBWC mode, this value indicates the H_INIT
+ *                              value in pixel
+ * @width:                      Width of the stripe in bytes
+ * @tileconfig                  Ubwc meta tile config. Contain the partial
+ *                              tile info
+ * @port_id:                    port id of ISP output
+ *
+ */
+struct cam_isp_dual_stripe_config {
+	__u32                       offset;
+	__u32                       width;
+	__u32                       tileconfig;
+	__u32                       port_id;
+};
+
+/**
+ * struct cam_isp_dual_config - dual isp configuration
+ *
+ * @num_ports                   Number of isp output ports
+ * @reserved                    Reserved field for alignment
+ * @split_params:               Inpput split parameters
+ * @stripes:                    Stripe information
+ *
+ */
+struct cam_isp_dual_config {
+	__u32                             num_ports;
+	__u32                             reserved;
+	struct cam_isp_dual_split_params  split_params;
+    union {
+        struct cam_isp_dual_stripe_config stripes[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_dual_stripe_config, stripes_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_clock_config - Clock configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_rdi:                    Number of RDI votes
+ * @left_pix_hz:                Pixel Clock for Left ISP
+ * @right_pix_hz:               Pixel Clock for Right ISP, valid only if Dual
+ * @rdi_hz:                     RDI Clock. ISP clock will be max of RDI and
+ *                              PIX clocks. For a particular context which ISP
+ *                              HW the RDI is allocated to is not known to UMD.
+ *                              Hence pass the clock and let KMD decide.
+ */
+struct cam_isp_clock_config {
+	__u32                       usage_type;
+	__u32                       num_rdi;
+	__u64                       left_pix_hz;
+	__u64                       right_pix_hz;
+    union {
+        __u64                   rdi_hz[1];
+        __DECLARE_FLEX_ARRAY(__u64, rdi_hz_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_csid_clock_config - CSID clock configuration
+ *
+ * @csid_clock                  CSID clock
+ */
+struct cam_isp_csid_clock_config {
+	__u64                       csid_clock;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_csid_qcfa_config - CSID qcfa binning support configuration
+ *
+ * @csid_binning                CSID binning
+ */
+struct cam_isp_csid_qcfa_config {
+	__u32                       csid_binning;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_bw_vote - Bandwidth vote information
+ *
+ * @resource_id:                Resource ID
+ * @reserved:                   Reserved field for alignment
+ * @cam_bw_bps:                 Bandwidth vote for CAMNOC
+ * @ext_bw_bps:                 Bandwidth vote for path-to-DDR after CAMNOC
+ */
+struct cam_isp_bw_vote {
+	__u32                       resource_id;
+	__u32                       reserved;
+	__u64                       cam_bw_bps;
+	__u64                       ext_bw_bps;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_bw_config - Bandwidth configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_rdi:                    Number of RDI votes
+ * @left_pix_vote:              Bandwidth vote for left ISP
+ * @right_pix_vote:             Bandwidth vote for right ISP
+ * @rdi_vote:                   RDI bandwidth requirements
+ */
+struct cam_isp_bw_config {
+	__u32                       usage_type;
+	__u32                       num_rdi;
+	struct cam_isp_bw_vote      left_pix_vote;
+	struct cam_isp_bw_vote      right_pix_vote;
+    union {
+        struct cam_isp_bw_vote      rdi_vote[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_bw_vote, rdi_vote_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_bw_config_v2 - Bandwidth configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_paths:                  Number of axi data paths
+ * @axi_path                    Per path vote info
+ */
+struct cam_isp_bw_config_v2 {
+	__u32                             usage_type;
+	__u32                             num_paths;
+    union {
+        struct cam_axi_per_path_bw_vote   axi_path[1];
+        __DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_fe_config - Fetch Engine configuration
+ *
+ * @version:                    fetch engine veriosn
+ * @min_vbi:                    require min vbi
+ * @fs_mode:                    indicates if fs mode enabled
+ * @fs_line_sync_en:            frame level sync or line level
+ *                              sync for fetch engine
+ * @hbi_count:                  hbi count
+ * @fs_sync_enable:             indicates if fetch engine working
+ *                              wokring in sync with write engine
+ * @go_cmd_sel:                 softwrae go_cmd or hw go_cmd
+ * @client_enable:              enable read engine
+ * @source_addr:                adrress of buffer to read from
+ * @width:                      buffer width
+ * @height:                     buffer height
+ * @stride:                     buffer stride (here equal to width)
+ * @format:                     format of image in buffer
+ * @unpacker_cfg:               unpacker config type
+ * @latency_buf_size:           latency buffer for read engine
+ */
+struct cam_fe_config {
+	__u64    version;
+	__u32    min_vbi;
+	__u32    fs_mode;
+	__u32    fs_line_sync_en;
+	__u32    hbi_count;
+	__u32    fs_sync_enable;
+	__u32    go_cmd_sel;
+	__u32    client_enable;
+	__u32    source_addr;
+	__u32    width;
+	__u32    height;
+	__u32    stride;
+	__u32    format;
+	__u32    unpacker_cfg;
+	__u32    latency_buf_size;
+} __attribute__((packed));
+
+
+/**
+ * struct cam_isp_sensor_path_dimension
+ *
+ * @width             expected width
+ * @height            expected height
+ * @measure_enabled   flag to indicate if pixel measurement is to be enabled
+ */
+struct cam_isp_sensor_dimension {
+	__u32 width;
+	__u32 height;
+	__u32 measure_enabled;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sensor_blanking_config
+ *
+ * @hbi             HBI value
+ * @vbi             VBI value
+ */
+struct cam_isp_sensor_blanking_config {
+	__u32 hbi;
+	__u32 vbi;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sensor_config - Sensor Dimension configuration
+ *
+ * @ppp_path:                   expected ppp path configuration
+ * @ipp_path:                   expected ipp path configuration
+ * @rdi_path:                   expected rdi path configuration
+ * @hbi:                        HBI value
+ * @vbi:                        VBI value
+ */
+struct cam_isp_sensor_config {
+	struct cam_isp_sensor_dimension  ppp_path;
+	struct cam_isp_sensor_dimension  ipp_path;
+	struct cam_isp_sensor_dimension  rdi_path[CAM_IFE_CSID_RDI_MAX];
+	__u32                   hbi;
+	__u32                   vbi;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_core_config - ISP core registers configuration
+ *
+ * @version:                    Version info
+ * @vid_ds16_r2pd:              Enables Y and C merging PD output for video DS16
+ * @vid_ds4_r2pd:               Enables Y and C merging PD output for video DS4
+ * @disp_ds16_r2pd:             Enables Y and C merging PD output for disp DS16
+ * @disp_ds4_r2pd:              Enables Y and C merging PD output for disp DS4
+ * @dsp_streaming_tap_point:    This selects source for DSP streaming interface
+ * @ihist_src_sel:              Selects input for IHIST module
+ * @hdr_be_src_sel:             Selects input for HDR BE module
+ * @hdr_bhist_src_sel:          Selects input for HDR BHIST module
+ * @input_mux_sel_pdaf:         Selects input for PDAF
+ * @input_mux_sel_pp:           Selects input for Pixel Pipe
+ * @core_cfg_flag:              Core config flag to set HDR mux/PP
+ *                              input format type
+ */
+struct cam_isp_core_config {
+	__u32     version;
+	__u32     vid_ds16_r2pd;
+	__u32     vid_ds4_r2pd;
+	__u32     disp_ds16_r2pd;
+	__u32     disp_ds4_r2pd;
+	__u32     dsp_streaming_tap_point;
+	__u32     ihist_src_sel;
+	__u32     hdr_be_src_sel;
+	__u32     hdr_bhist_src_sel;
+	__u32     input_mux_sel_pdaf;
+	__u32     input_mux_sel_pp;
+	__u32     core_cfg_flag;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sfe_core_config - SFE core registers configuration
+ *
+ * @version       : Version info
+ * @mode_sel      : Selects core for sHDR/non-sHDR mode
+ * @ops_mode_cfg  : Selects core if is inline/offline mode
+ * @fs_mode_cfg   : Selects output in fast shutter mode
+ * @sfe_params    : SFE params for future use
+ */
+struct cam_isp_sfe_core_config {
+	__u32   version;
+	__u32   mode_sel;
+	__u32   ops_mode_cfg;
+	__u32   fs_mode_cfg;
+	__u32   sfe_params[6];
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_sfe_scratch_buf_info - Scratch buf info
+ *
+ * @mem_handle             : Scratch buffer handle
+ * @offset                 : Offset to the buffer
+ * @width                  : Width in pixels
+ * @height                 : Height in pixels
+ * @stride                 : Stride in pixels
+ * @slice_height           : Slice height in lines
+ * @resource_type          : rsrc type
+ * @scratch_buf_params     : for future use
+ */
+struct cam_isp_sfe_scratch_buf_info {
+	__s32     mem_handle;
+	__u32     offset;
+	__u32     width;
+	__u32     height;
+	__u32     stride;
+	__u32     slice_height;
+	__u32     resource_type;
+	__u32     scratch_buf_params[5];
+};
+
+/**
+ * struct cam_isp_sfe_init_scratch_buf_config - SFE init buffer cfg
+ *        Provides scratch buffer info for SFE ports
+ *        as part of INIT packet
+ *
+ * @num_ports         : Number of ports
+ * @reserved          : reserved
+ * @port_scratch_cfg  : scratch buffer info
+ */
+struct cam_isp_sfe_init_scratch_buf_config {
+	__u32  num_ports;
+	__u32  reserved;
+    union {
+        struct cam_isp_sfe_scratch_buf_info port_scratch_cfg[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_sfe_scratch_buf_info, port_scratch_cfg_flex);
+    };
+};
+
+/**
+ * struct cam_isp_tpg_core_config - TPG core registers configuration
+ *
+ * @version          : Version info
+ * @vc_dt_pattern_id : TPG pattern - SparsePD, sHDR etc.
+ * @qcfa_en          : Selects qcfa in color bar
+ * @pix_pattern      : Pix pattern color bar cfg
+ * @tpg_params       : TPG params for future use
+ */
+struct cam_isp_tpg_core_config {
+	__u32   version;
+	__u32   vc_dt_pattern_id;
+	__u32   qcfa_en;
+	__u32   pix_pattern;
+	__u32   tpg_params[6];
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_acquire_hw_info - ISP acquire HW params
+ *
+ * @common_info_version  : Version of common info struct used
+ * @common_info_size     : Size of common info struct used
+ * @common_info_offset   : Offset of common info from start of data
+ * @num_inputs           : Number of inputs
+ * @input_info_version   : Version of input info struct used
+ * @input_info_size      : Size of input info struct used
+ * @input_info_offset    : Offset of input info from start of data
+ * @data                 : Start of data region
+ */
+struct cam_isp_acquire_hw_info {
+	__u16             common_info_version;
+	__u16             common_info_size;
+	__u32             common_info_offset;
+	__u32             num_inputs;
+	__u32             input_info_version;
+	__u32             input_info_size;
+	__u32             input_info_offset;
+	__u64             data;
+};
+
+/**
+ * struct cam_isp_vfe_wm_config  -  VFE write master config per port
+ *
+ * @port_type        : Unique ID of output port
+ * @wm_mode          : Write master mode
+ *                     0x0 - Line based mode
+ *                     0x1 - Frame based mode
+ *                     0x2 - Index based mode, valid for BAF only
+ * @h_init           : Horizontal starting coordinate in pixels. Must be a
+ *                     multiple of 3 for TP10 format
+ * @height           : Height in pixels
+ * @width            : Width in pixels
+ * @virtual_frame_en : Enabling virtual frame will prevent actual request from
+ *                     being sent to NOC
+ * @stride           : Write master stride
+ * @offset           : Write master offset
+ * @addr_reuse_en    : Enabling addr-reuse will write output to the same addr
+ *                     after the last addr that was read from FIFO.
+ * @reserved_2       : Reserved field for Write master config
+ * @reserved_3       : Reserved field for Write master config
+ * @reserved_4       : Reserved field for Write master config
+ */
+struct cam_isp_vfe_wm_config {
+	__u32                      port_type;
+	__u32                      wm_mode;
+	__u32                      h_init;
+	__u32                      height;
+	__u32                      width;
+	__u32                      virtual_frame_en;
+	__u32                      stride;
+	__u32                      offset;
+	__u32                      addr_reuse_en;
+	__u32                      reserved_2;
+	__u32                      reserved_3;
+	__u32                      reserved_4;
+};
+
+/**
+ * struct cam_isp_vfe_out_config  -  VFE write master config
+ *
+ * @num_ports      : Number of ports
+ * @reserved       : Reserved field
+ * @wm_config      : VFE out config
+ */
+struct cam_isp_vfe_out_config {
+	__u32                        num_ports;
+	__u32                        reserved;
+    union {
+        struct cam_isp_vfe_wm_config wm_config[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_vfe_wm_config, wm_config_flex);
+    };
+};
+
+/**
+ * struct cam_isp_csid_epd_config  -  Support for EPD Packet config
+ *
+ * @is_epd_sensor      : flag to check if epd supported
+ */
+struct cam_isp_csid_epd_config {
+	__u32                      is_epd_supported;
+};
+
+#define CAM_ISP_ACQUIRE_COMMON_VER0         0x1000
+
+#define CAM_ISP_ACQUIRE_COMMON_SIZE_VER0    0x0
+
+#define CAM_ISP_ACQUIRE_INPUT_VER0          0x2000
+
+#define CAM_ISP_ACQUIRE_INPUT_SIZE_VER0     sizeof(struct cam_isp_in_port_info)
+
+#define CAM_ISP_ACQUIRE_OUT_VER0            0x3000
+
+#define CAM_ISP_ACQUIRE_OUT_SIZE_VER0       sizeof(struct cam_isp_out_port_info)
+
+#endif /* __UAPI_CAM_ISP_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp_ife.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp_ife.h
@@ -0,0 +1,62 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_IFE_H__
+#define __UAPI_CAM_ISP_IFE_H__
+
+/* IFE output port resource type (global unique)*/
+#define CAM_ISP_IFE_OUT_RES_BASE               0x3000
+
+#define CAM_ISP_IFE_OUT_RES_FULL               (CAM_ISP_IFE_OUT_RES_BASE + 0)
+#define CAM_ISP_IFE_OUT_RES_DS4                (CAM_ISP_IFE_OUT_RES_BASE + 1)
+#define CAM_ISP_IFE_OUT_RES_DS16               (CAM_ISP_IFE_OUT_RES_BASE + 2)
+#define CAM_ISP_IFE_OUT_RES_RAW_DUMP           (CAM_ISP_IFE_OUT_RES_BASE + 3)
+#define CAM_ISP_IFE_OUT_RES_FD                 (CAM_ISP_IFE_OUT_RES_BASE + 4)
+#define CAM_ISP_IFE_OUT_RES_PDAF               (CAM_ISP_IFE_OUT_RES_BASE + 5)
+#define CAM_ISP_IFE_OUT_RES_RDI_0              (CAM_ISP_IFE_OUT_RES_BASE + 6)
+#define CAM_ISP_IFE_OUT_RES_RDI_1              (CAM_ISP_IFE_OUT_RES_BASE + 7)
+#define CAM_ISP_IFE_OUT_RES_RDI_2              (CAM_ISP_IFE_OUT_RES_BASE + 8)
+#define CAM_ISP_IFE_OUT_RES_RDI_3              (CAM_ISP_IFE_OUT_RES_BASE + 9)
+#define CAM_ISP_IFE_OUT_RES_STATS_HDR_BE       (CAM_ISP_IFE_OUT_RES_BASE + 10)
+#define CAM_ISP_IFE_OUT_RES_STATS_HDR_BHIST    (CAM_ISP_IFE_OUT_RES_BASE + 11)
+#define CAM_ISP_IFE_OUT_RES_STATS_TL_BG        (CAM_ISP_IFE_OUT_RES_BASE + 12)
+#define CAM_ISP_IFE_OUT_RES_STATS_BF           (CAM_ISP_IFE_OUT_RES_BASE + 13)
+#define CAM_ISP_IFE_OUT_RES_STATS_AWB_BG       (CAM_ISP_IFE_OUT_RES_BASE + 14)
+#define CAM_ISP_IFE_OUT_RES_STATS_BHIST        (CAM_ISP_IFE_OUT_RES_BASE + 15)
+#define CAM_ISP_IFE_OUT_RES_STATS_RS           (CAM_ISP_IFE_OUT_RES_BASE + 16)
+#define CAM_ISP_IFE_OUT_RES_STATS_CS           (CAM_ISP_IFE_OUT_RES_BASE + 17)
+#define CAM_ISP_IFE_OUT_RES_STATS_IHIST        (CAM_ISP_IFE_OUT_RES_BASE + 18)
+#define CAM_ISP_IFE_OUT_RES_FULL_DISP          (CAM_ISP_IFE_OUT_RES_BASE + 19)
+#define CAM_ISP_IFE_OUT_RES_DS4_DISP           (CAM_ISP_IFE_OUT_RES_BASE + 20)
+#define CAM_ISP_IFE_OUT_RES_DS16_DISP          (CAM_ISP_IFE_OUT_RES_BASE + 21)
+#define CAM_ISP_IFE_OUT_RES_2PD                (CAM_ISP_IFE_OUT_RES_BASE + 22)
+#define CAM_ISP_IFE_OUT_RES_RDI_RD             (CAM_ISP_IFE_OUT_RES_BASE + 23)
+#define CAM_ISP_IFE_OUT_RES_LCR                (CAM_ISP_IFE_OUT_RES_BASE + 24)
+#define CAM_ISP_IFE_OUT_RES_SPARSE_PD          (CAM_ISP_IFE_OUT_RES_BASE + 25)
+#define CAM_ISP_IFE_OUT_RES_2PD_STATS          (CAM_ISP_IFE_OUT_RES_BASE + 26)
+#define CAM_ISP_IFE_OUT_RES_AWB_BFW            (CAM_ISP_IFE_OUT_RES_BASE + 27)
+#define CAM_ISP_IFE_OUT_RES_STATS_AEC_BE       (CAM_ISP_IFE_OUT_RES_BASE + 28)
+#define CAM_ISP_IFE_OUT_RES_LTM_STATS          (CAM_ISP_IFE_OUT_RES_BASE + 29)
+#define CAM_ISP_IFE_OUT_RES_STATS_GTM_BHIST    (CAM_ISP_IFE_OUT_RES_BASE + 30)
+#define CAM_ISP_IFE_LITE_OUT_RES_STATS_BE      (CAM_ISP_IFE_OUT_RES_BASE + 31)
+#define CAM_ISP_IFE_LITE_OUT_RES_GAMMA         (CAM_ISP_IFE_OUT_RES_BASE + 32)
+
+/* IFE input port resource type (global unique) */
+#define CAM_ISP_IFE_IN_RES_BASE                 0x4000
+
+#define CAM_ISP_IFE_IN_RES_TPG                 (CAM_ISP_IFE_IN_RES_BASE + 0)
+#define CAM_ISP_IFE_IN_RES_PHY_0               (CAM_ISP_IFE_IN_RES_BASE + 1)
+#define CAM_ISP_IFE_IN_RES_PHY_1               (CAM_ISP_IFE_IN_RES_BASE + 2)
+#define CAM_ISP_IFE_IN_RES_PHY_2               (CAM_ISP_IFE_IN_RES_BASE + 3)
+#define CAM_ISP_IFE_IN_RES_PHY_3               (CAM_ISP_IFE_IN_RES_BASE + 4)
+#define CAM_ISP_IFE_IN_RES_PHY_4               (CAM_ISP_IFE_IN_RES_BASE + 5)
+#define CAM_ISP_IFE_IN_RES_PHY_5               (CAM_ISP_IFE_IN_RES_BASE + 6)
+#define CAM_ISP_IFE_IN_RES_RD                  (CAM_ISP_IFE_IN_RES_BASE + 7)
+#define CAM_ISP_IFE_IN_RES_CPHY_TPG_0          (CAM_ISP_IFE_IN_RES_BASE + 8)
+#define CAM_ISP_IFE_IN_RES_CPHY_TPG_1          (CAM_ISP_IFE_IN_RES_BASE + 9)
+#define CAM_ISP_IFE_IN_RES_CPHY_TPG_2          (CAM_ISP_IFE_IN_RES_BASE + 10)
+#define CAM_ISP_IFE_IN_RES_MAX                 (CAM_ISP_IFE_IN_RES_BASE + 11)
+
+#endif /* __UAPI_CAM_ISP_IFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp_sfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp_sfe.h
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_SFE_H__
+#define __UAPI_CAM_ISP_SFE_H__
+
+/* SFE output port resource type */
+#define CAM_ISP_SFE_OUT_RES_BASE              0x6000
+
+#define CAM_ISP_SFE_OUT_RES_RDI_0             (CAM_ISP_SFE_OUT_RES_BASE + 0)
+#define CAM_ISP_SFE_OUT_RES_RDI_1             (CAM_ISP_SFE_OUT_RES_BASE + 1)
+#define CAM_ISP_SFE_OUT_RES_RDI_2             (CAM_ISP_SFE_OUT_RES_BASE + 2)
+#define CAM_ISP_SFE_OUT_RES_RDI_3             (CAM_ISP_SFE_OUT_RES_BASE + 3)
+#define CAM_ISP_SFE_OUT_RES_RDI_4             (CAM_ISP_SFE_OUT_RES_BASE + 4)
+#define CAM_ISP_SFE_OUT_BE_STATS_0            (CAM_ISP_SFE_OUT_RES_BASE + 5)
+#define CAM_ISP_SFE_OUT_BHIST_STATS_0         (CAM_ISP_SFE_OUT_RES_BASE + 6)
+#define CAM_ISP_SFE_OUT_BE_STATS_1            (CAM_ISP_SFE_OUT_RES_BASE + 7)
+#define CAM_ISP_SFE_OUT_BHIST_STATS_1         (CAM_ISP_SFE_OUT_RES_BASE + 8)
+#define CAM_ISP_SFE_OUT_BE_STATS_2            (CAM_ISP_SFE_OUT_RES_BASE + 9)
+#define CAM_ISP_SFE_OUT_BHIST_STATS_2         (CAM_ISP_SFE_OUT_RES_BASE + 10)
+#define CAM_ISP_SFE_OUT_RES_LCR               (CAM_ISP_SFE_OUT_RES_BASE + 11)
+#define CAM_ISP_SFE_OUT_RES_RAW_DUMP          (CAM_ISP_SFE_OUT_RES_BASE + 12)
+
+#define CAM_ISP_SFE_OUT_RES_MAX               (CAM_ISP_SFE_OUT_RES_BASE + 13)
+
+/* SFE input port resource type */
+#define CAM_ISP_SFE_IN_RES_BASE               0x5000
+
+#define CAM_ISP_SFE_INLINE_PIX                (CAM_ISP_SFE_IN_RES_BASE + 0)
+#define CAM_ISP_SFE_IN_RD_0                   (CAM_ISP_SFE_IN_RES_BASE + 1)
+#define CAM_ISP_SFE_IN_RD_1                   (CAM_ISP_SFE_IN_RES_BASE + 2)
+#define CAM_ISP_SFE_IN_RD_2                   (CAM_ISP_SFE_IN_RES_BASE + 3)
+#define CAM_ISP_SFE_IN_RES_MAX                (CAM_ISP_SFE_IN_RES_BASE + 4)
+
+#endif /* __UAPI_CAM_ISP_SFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp_tfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp_tfe.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_TFE_H__
+#define __UAPI_CAM_ISP_TFE_H__
+
+/* TFE output port resource id number */
+#define CAM_ISP_TFE_OUT_RES_BASE               0x1
+
+#define CAM_ISP_TFE_OUT_RES_FULL               (CAM_ISP_TFE_OUT_RES_BASE + 0)
+#define CAM_ISP_TFE_OUT_RES_RAW_DUMP           (CAM_ISP_TFE_OUT_RES_BASE + 1)
+#define CAM_ISP_TFE_OUT_RES_PDAF               (CAM_ISP_TFE_OUT_RES_BASE + 2)
+#define CAM_ISP_TFE_OUT_RES_RDI_0              (CAM_ISP_TFE_OUT_RES_BASE + 3)
+#define CAM_ISP_TFE_OUT_RES_RDI_1              (CAM_ISP_TFE_OUT_RES_BASE + 4)
+#define CAM_ISP_TFE_OUT_RES_RDI_2              (CAM_ISP_TFE_OUT_RES_BASE + 5)
+#define CAM_ISP_TFE_OUT_RES_STATS_HDR_BE       (CAM_ISP_TFE_OUT_RES_BASE + 6)
+#define CAM_ISP_TFE_OUT_RES_STATS_HDR_BHIST    (CAM_ISP_TFE_OUT_RES_BASE + 7)
+#define CAM_ISP_TFE_OUT_RES_STATS_TL_BG        (CAM_ISP_TFE_OUT_RES_BASE + 8)
+#define CAM_ISP_TFE_OUT_RES_STATS_BF           (CAM_ISP_TFE_OUT_RES_BASE + 9)
+#define CAM_ISP_TFE_OUT_RES_STATS_AWB_BG       (CAM_ISP_TFE_OUT_RES_BASE + 10)
+#define CAM_ISP_TFE_OUT_RES_MAX                (CAM_ISP_TFE_OUT_RES_BASE + 11)
+
+
+/* TFE input port resource type */
+#define CAM_ISP_TFE_IN_RES_BASE                 0x1
+
+#define CAM_ISP_TFE_IN_RES_TPG                 (CAM_ISP_TFE_IN_RES_BASE + 0)
+#define CAM_ISP_TFE_IN_RES_PHY_0               (CAM_ISP_TFE_IN_RES_BASE + 1)
+#define CAM_ISP_TFE_IN_RES_PHY_1               (CAM_ISP_TFE_IN_RES_BASE + 2)
+#define CAM_ISP_TFE_IN_RES_PHY_2               (CAM_ISP_TFE_IN_RES_BASE + 3)
+#define CAM_ISP_TFE_IN_RES_PHY_3               (CAM_ISP_TFE_IN_RES_BASE + 4)
+#define CAM_ISP_TFE_IN_RES_MAX                 (CAM_ISP_TFE_IN_RES_BASE + 5)
+
+#endif /* __UAPI_CAM_ISP_TFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp_vfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_isp_vfe.h
@@ -0,0 +1,51 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_ISP_VFE_H__
+#define __UAPI_CAM_ISP_VFE_H__
+
+/* VFE output port resource type  (global unique)  */
+#define CAM_ISP_VFE_OUT_RES_BASE               0x1000
+
+#define CAM_ISP_VFE_OUT_RES_ENC                (CAM_ISP_VFE_OUT_RES_BASE + 0)
+#define CAM_ISP_VFE_OUT_RES_VIEW               (CAM_ISP_VFE_OUT_RES_BASE + 1)
+#define CAM_ISP_VFE_OUT_RES_VID                (CAM_ISP_VFE_OUT_RES_BASE + 2)
+#define CAM_ISP_VFE_OUT_RES_RDI_0              (CAM_ISP_VFE_OUT_RES_BASE + 3)
+#define CAM_ISP_VFE_OUT_RES_RDI_1              (CAM_ISP_VFE_OUT_RES_BASE + 4)
+#define CAM_ISP_VFE_OUT_RES_RDI_2              (CAM_ISP_VFE_OUT_RES_BASE + 5)
+#define CAM_ISP_VFE_OUT_RES_RDI_3              (CAM_ISP_VFE_OUT_RES_BASE + 6)
+#define CAM_ISP_VFE_OUT_RES_STATS_AEC          (CAM_ISP_VFE_OUT_RES_BASE + 7)
+#define CAM_ISP_VFE_OUT_RES_STATS_AF           (CAM_ISP_VFE_OUT_RES_BASE + 8)
+#define CAM_ISP_VFE_OUT_RES_STATS_AWB          (CAM_ISP_VFE_OUT_RES_BASE + 9)
+#define CAM_ISP_VFE_OUT_RES_STATS_RS           (CAM_ISP_VFE_OUT_RES_BASE + 10)
+#define CAM_ISP_VFE_OUT_RES_STATS_CS           (CAM_ISP_VFE_OUT_RES_BASE + 11)
+#define CAM_ISP_VFE_OUT_RES_STATS_IHIST        (CAM_ISP_VFE_OUT_RES_BASE + 12)
+#define CAM_ISP_VFE_OUT_RES_STATS_SKIN         (CAM_ISP_VFE_OUT_RES_BASE + 13)
+#define CAM_ISP_VFE_OUT_RES_STATS_BG           (CAM_ISP_VFE_OUT_RES_BASE + 14)
+#define CAM_ISP_VFE_OUT_RES_STATS_BF           (CAM_ISP_VFE_OUT_RES_BASE + 15)
+#define CAM_ISP_VFE_OUT_RES_STATS_BE           (CAM_ISP_VFE_OUT_RES_BASE + 16)
+#define CAM_ISP_VFE_OUT_RES_STATS_BHIST        (CAM_ISP_VFE_OUT_RES_BASE + 17)
+#define CAM_ISP_VFE_OUT_RES_STATS_BF_SCALE     (CAM_ISP_VFE_OUT_RES_BASE + 18)
+#define CAM_ISP_VFE_OUT_RES_STATS_HDR_BE       (CAM_ISP_VFE_OUT_RES_BASE + 19)
+#define CAM_ISP_VFE_OUT_RES_STATS_HDR_BHIST    (CAM_ISP_VFE_OUT_RES_BASE + 20)
+#define CAM_ISP_VFE_OUT_RES_STATS_AEC_BG       (CAM_ISP_VFE_OUT_RES_BASE + 21)
+#define CAM_ISP_VFE_OUT_RES_CAMIF_RAW          (CAM_ISP_VFE_OUT_RES_BASE + 22)
+#define CAM_ISP_VFE_OUT_RES_IDEAL_RAW          (CAM_ISP_VFE_OUT_RES_BASE + 23)
+#define CAM_ISP_VFE_OUT_RES_MAX                (CAM_ISP_VFE_OUT_RES_BASE + 24)
+
+/* VFE input port_ resource type (global unique) */
+#define CAM_ISP_VFE_IN_RES_BASE                0x2000
+
+#define CAM_ISP_VFE_IN_RES_TPG                 (CAM_ISP_VFE_IN_RES_BASE + 0)
+#define CAM_ISP_VFE_IN_RES_PHY_0               (CAM_ISP_VFE_IN_RES_BASE + 1)
+#define CAM_ISP_VFE_IN_RES_PHY_1               (CAM_ISP_VFE_IN_RES_BASE + 2)
+#define CAM_ISP_VFE_IN_RES_PHY_2               (CAM_ISP_VFE_IN_RES_BASE + 3)
+#define CAM_ISP_VFE_IN_RES_PHY_3               (CAM_ISP_VFE_IN_RES_BASE + 4)
+#define CAM_ISP_VFE_IN_RES_PHY_4               (CAM_ISP_VFE_IN_RES_BASE + 5)
+#define CAM_ISP_VFE_IN_RES_PHY_5               (CAM_ISP_VFE_IN_RES_BASE + 6)
+#define CAM_ISP_VFE_IN_RES_FE                  (CAM_ISP_VFE_IN_RES_BASE + 7)
+#define CAM_ISP_VFE_IN_RES_MAX                 (CAM_ISP_VFE_IN_RES_BASE + 8)
+
+#endif /* __UAPI_CAM_ISP_VFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_jpeg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_jpeg.h
@@ -0,0 +1,123 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_JPEG_H__
+#define __UAPI_CAM_JPEG_H__
+
+#include <media/cam_defs.h>
+
+/* enc, dma, cdm(enc/dma) are used in querycap */
+#define CAM_JPEG_DEV_TYPE_ENC      0
+#define CAM_JPEG_DEV_TYPE_DMA      1
+#define CAM_JPEG_DEV_TYPE_MAX      2
+
+#define CAM_JPEG_NUM_DEV_PER_RES_MAX      1
+
+/* definitions needed for jpeg aquire device */
+#define CAM_JPEG_RES_TYPE_ENC        0
+#define CAM_JPEG_RES_TYPE_DMA        1
+#define CAM_JPEG_RES_TYPE_MAX        2
+
+/* packet opcode types */
+#define CAM_JPEG_OPCODE_ENC_UPDATE 0
+#define CAM_JPEG_OPCODE_DMA_UPDATE 1
+
+/* ENC input port resource type */
+#define CAM_JPEG_ENC_INPUT_IMAGE                 0x0
+
+/* ENC output port resource type */
+#define CAM_JPEG_ENC_OUTPUT_IMAGE                0x1
+
+#define CAM_JPEG_ENC_IO_IMAGES_MAX               0x2
+
+/* DMA input port resource type */
+#define CAM_JPEG_DMA_INPUT_IMAGE                 0x0
+
+/* DMA output port resource type */
+#define CAM_JPEG_DMA_OUTPUT_IMAGE                0x1
+
+#define CAM_JPEG_DMA_IO_IMAGES_MAX               0x2
+
+#define CAM_JPEG_IMAGE_MAX                       0x2
+
+/**
+ * struct cam_jpeg_dev_ver - Device information for particular hw type
+ *
+ * This is used to get device version info of JPEG ENC, JPEG DMA
+ * from hardware and use this info in CAM_QUERY_CAP IOCTL
+ *
+ * @size : Size of struct passed
+ * @dev_type: Hardware type for the cap info(jpeg enc, jpeg dma)
+ * @hw_ver: Major, minor and incr values of a device version
+ */
+struct cam_jpeg_dev_ver {
+	__u32                 size;
+	__u32                 dev_type;
+	struct cam_hw_version hw_ver;
+};
+
+/**
+ * struct cam_jpeg_query_cap_cmd - JPEG query device capability payload
+ *
+ * @dev_iommu_handle: Jpeg iommu handles for secure/non secure
+ *      modes
+ * @cdm_iommu_handle: Iommu handles for secure/non secure modes
+ * @num_enc: Number of encoder
+ * @num_dma: Number of dma
+ * @dev_ver: Returned device capability array
+ */
+struct cam_jpeg_query_cap_cmd {
+	struct cam_iommu_handle dev_iommu_handle;
+	struct cam_iommu_handle cdm_iommu_handle;
+	__u32                   num_enc;
+	__u32                   num_dma;
+	struct cam_jpeg_dev_ver dev_ver[CAM_JPEG_DEV_TYPE_MAX];
+};
+
+/**
+ * struct cam_jpeg_res_info - JPEG output resource info
+ *
+ * @format: Format of the resource
+ * @width:  Width in pixels
+ * @height: Height in lines
+ * @fps:  Fps
+ */
+struct cam_jpeg_res_info {
+	__u32 format;
+	__u32 width;
+	__u32 height;
+	__u32 fps;
+};
+
+/**
+ * struct cam_jpeg_acquire_dev_info - An JPEG device info
+ *
+ * @dev_type: Device type (ENC/DMA)
+ * @reserved: Reserved Bytes
+ * @in_res: In resource info
+ * @in_res: Iut resource info
+ */
+struct cam_jpeg_acquire_dev_info {
+	__u32                    dev_type;
+	__u32                    reserved;
+	struct cam_jpeg_res_info in_res;
+	struct cam_jpeg_res_info out_res;
+};
+
+/**
+ * struct cam_jpeg_config_inout_param_info - JPEG Config time
+ *     input output params
+ *
+ * @clk_index: Input Param- clock selection index.(-1 default)
+ * @output_size: Output Param - jpeg encode/dma output size in
+ *     bytes
+ */
+struct cam_jpeg_config_inout_param_info {
+	__s32 clk_index;
+	__s32 output_size;
+};
+
+#endif /* __UAPI_CAM_JPEG_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_lrme.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_lrme.h
@@ -0,0 +1,70 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_LRME_H__
+#define __UAPI_CAM_LRME_H__
+
+#include <media/cam_defs.h>
+
+/* LRME Resource Types */
+
+enum CAM_LRME_IO_TYPE {
+	CAM_LRME_IO_TYPE_TAR,
+	CAM_LRME_IO_TYPE_REF,
+	CAM_LRME_IO_TYPE_RES,
+	CAM_LRME_IO_TYPE_DS2,
+};
+
+#define CAM_LRME_INPUT_PORT_TYPE_TAR (1 << 0)
+#define CAM_LRME_INPUT_PORT_TYPE_REF (1 << 1)
+
+#define CAM_LRME_OUTPUT_PORT_TYPE_DS2 (1 << 0)
+#define CAM_LRME_OUTPUT_PORT_TYPE_RES (1 << 1)
+
+#define CAM_LRME_DEV_MAX 1
+
+
+struct cam_lrme_hw_version {
+	__u32 gen;
+	__u32 rev;
+	__u32 step;
+};
+
+struct cam_lrme_dev_cap {
+	struct cam_lrme_hw_version clc_hw_version;
+	struct cam_lrme_hw_version bus_rd_hw_version;
+	struct cam_lrme_hw_version bus_wr_hw_version;
+	struct cam_lrme_hw_version top_hw_version;
+	struct cam_lrme_hw_version top_titan_version;
+};
+
+/**
+ * struct cam_lrme_query_cap_cmd - LRME query device capability payload
+ *
+ * @dev_iommu_handle: LRME iommu handles for secure/non secure
+ *      modes
+ * @cdm_iommu_handle: Iommu handles for secure/non secure modes
+ * @num_devices: number of hardware devices
+ * @dev_caps: Returned device capability array
+ */
+struct cam_lrme_query_cap_cmd {
+	struct cam_iommu_handle device_iommu;
+	struct cam_iommu_handle cdm_iommu;
+	__u32                   num_devices;
+	struct cam_lrme_dev_cap dev_caps[CAM_LRME_DEV_MAX];
+};
+
+struct cam_lrme_soc_info {
+	__u64 clock_rate;
+	__u64 bandwidth;
+	__u64 reserved[4];
+};
+
+struct cam_lrme_acquire_args {
+	struct cam_lrme_soc_info lrme_soc_info;
+};
+
+#endif /* __UAPI_CAM_LRME_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_ope.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_ope.h
@@ -0,0 +1,339 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_OPE_H__
+#define __UAPI_OPE_H__
+
+#include <media/cam_defs.h>
+#include <media/cam_cpas.h>
+
+#define OPE_DEV_NAME_SIZE                  128
+
+/* OPE HW TYPE */
+#define OPE_HW_TYPE_OPE                     0x1
+#define OPE_HW_TYPE_OPE_CDM                 0x2
+#define OPE_HW_TYPE_MAX                     0x3
+
+/* OPE Device type */
+#define OPE_DEV_TYPE_OPE_RT                 0x1
+#define OPE_DEV_TYPE_OPE_NRT                0x2
+#define OPE_DEV_TYPE_OPE_SEMI_RT            0x3
+#define OPE_DEV_TYPE_MAX                    0x4
+
+/* OPE Input Res Ports */
+#define OPE_IN_RES_FULL                     0x1
+#define OPE_IN_RES_MAX                      OPE_IN_RES_FULL
+
+/* OPE Output Res Ports */
+#define OPE_OUT_RES_VIDEO                   0x1
+#define OPE_OUT_RES_DISP                    0x2
+#define OPE_OUT_RES_ARGB                    0x3
+#define OPE_OUT_RES_STATS_RS                0x4
+#define OPE_OUT_RES_STATS_IHIST             0x5
+#define OPE_OUT_RES_STATS_LTM               0x6
+#define OPE_OUT_RES_MAX                     OPE_OUT_RES_STATS_LTM
+
+/* OPE packet opcodes */
+#define OPE_OPCODE_CONFIG                   0x1
+
+/* OPE Command Buffer Scope */
+#define OPE_CMD_BUF_SCOPE_BATCH             0x1
+#define OPE_CMD_BUF_SCOPE_FRAME             0x2
+#define OPE_CMD_BUF_SCOPE_PASS              0x3
+#define OPE_CMD_BUF_SCOPE_STRIPE            0x4
+
+/* OPE Command Buffer Types */
+#define OPE_CMD_BUF_TYPE_DIRECT             0x1
+#define OPE_CMD_BUF_TYPE_INDIRECT           0x2
+
+/* OPE Command Buffer Usage */
+#define OPE_CMD_BUF_UMD                     0x1
+#define OPE_CMD_BUF_KMD                     0x2
+#define OPE_CMD_BUF_DEBUG                   0x3
+
+/* OPE Single/Double Buffered */
+#define OPE_CMD_BUF_SINGLE_BUFFERED         0x1
+#define OPE_CMD_BUF_DOUBLE_BUFFERED         0x2
+
+/* Command meta types */
+#define OPE_CMD_META_GENERIC_BLOB           0x1
+
+/* Generic blob types */
+#define OPE_CMD_GENERIC_BLOB_CLK_V2         0x1
+
+/* Stripe location */
+#define OPE_STRIPE_FULL                     0x0
+#define OPE_STRIPE_LEFT                     0x1
+#define OPE_STRIPE_RIGHT                    0x2
+#define OPE_STRIPE_MIDDLE                   0x3
+
+#define OPE_MAX_CMD_BUFS                    64
+#define OPE_MAX_IO_BUFS                     (OPE_OUT_RES_MAX + OPE_IN_RES_MAX)
+#define OPE_MAX_PASS                        1
+#define OPE_MAX_PLANES                      2
+#define OPE_MAX_STRIPES                     64
+#define OPE_MAX_BATCH_SIZE                  16
+
+/**
+ * struct ope_stripe_info - OPE stripe Info
+ *
+ * @offset:          Offset in Bytes
+ * @x_init:          X_init
+ * @stripe_location: Stripe location (OPE_STRIPE_XXX)
+ * @width:           Width of a stripe
+ * @height:          Height of a stripe
+ * @disable_bus:     Flag to disable BUS master
+ * @reserved:        Reserved
+ *
+ */
+struct ope_stripe_info {
+	__u32 offset;
+	__u32 x_init;
+	__u32 stripe_location;
+	__u32 width;
+	__u32 height;
+	__u32 disable_bus;
+	__u32 reserved;
+};
+
+/**
+ * struct ope_io_buf_info - OPE IO buffers meta
+ *
+ * @direction:     Direction of a buffer of a port(Input/Output)
+ * @resource_type: Port type
+ * @num_planes:    Number of planes for a port
+ * @pix_pattern:   Pixel pattern for raw input
+ * @num_stripes:   Stripes per plane
+ * @mem_handle:    Memhandles of each Input/Output Port
+ * @plane_offset:  Offsets of planes
+ * @length:        Length of a plane buffer
+ * @plane_stride:  Plane stride
+ * @height:        Height of a plane buffer
+ * @format:        Format
+ * @fence:         Fence of a Port
+ * @stripe_info:   Stripe Info
+ *
+ */
+struct ope_io_buf_info {
+	__u32 direction;
+	__u32 resource_type;
+	__u32 num_planes;
+	__u32 pix_pattern;
+	__u32 num_stripes[OPE_MAX_PLANES];
+	__u32 mem_handle[OPE_MAX_PLANES];
+	__u32 plane_offset[OPE_MAX_PLANES];
+	__u32 length[OPE_MAX_PLANES];
+	__u32 plane_stride[OPE_MAX_PLANES];
+	__u32 height[OPE_MAX_PLANES];
+	__u32 format;
+	__u32 fence;
+	struct ope_stripe_info stripe_info[OPE_MAX_PLANES][OPE_MAX_STRIPES];
+};
+
+/**
+ * struct ope_frame_set - OPE frameset
+ *
+ * @num_io_bufs: Number of I/O buffers
+ * @reserved:    Reserved
+ * @io_buf:      IO buffer info for all Input and Output ports
+ *
+ */
+struct ope_frame_set {
+	__u32 num_io_bufs;
+	__u32 reserved;
+	struct ope_io_buf_info io_buf[OPE_MAX_IO_BUFS];
+};
+
+/**
+ * struct ope_cmd_buf_info - OPE command buffer meta
+ *
+ * @mem_handle:              Memory handle for command buffer
+ * @offset:                  Offset of a command buffer
+ * @size:                    Size of command buffer
+ * @length:                  Length of a command buffer
+ * @cmd_buf_scope :          Scope of a command buffer (OPE_CMD_BUF_SCOPE_XXX)
+ * @type:                    Command buffer type (OPE_CMD_BUF_TYPE_XXX)
+ * @cmd_buf_usage:           Usage of command buffer ( OPE_CMD_BUF_USAGE_XXX)
+ * @stripe_idx:              Stripe index in a req, It is valid for SCOPE_STRIPE
+ * @cmd_buf_pass_idx:        Pass index
+ * @prefetch_disable:        Prefecth disable flag
+ *
+ */
+
+struct ope_cmd_buf_info {
+	__u32 mem_handle;
+	__u32 offset;
+	__u32 size;
+	__u32 length;
+	__u32 cmd_buf_scope;
+	__u32 type;
+	__u32 cmd_buf_usage;
+	__u32 cmd_buf_buffered;
+	__u32 stripe_idx;
+	__u32 cmd_buf_pass_idx;
+	__u32 prefetch_disable;
+};
+
+/**
+ * struct ope_packet_payload - payload for a request
+ *
+ * @num_cmd_bufs:         Number of command buffers
+ * @batch_size:           Batch size in HFR mode
+ * @ope_cmd_buf_info:     Command buffer meta data
+ * @ope_io_buf_info:      Io buffer Info
+ *
+ */
+struct ope_frame_process {
+	__u32 num_cmd_bufs[OPE_MAX_BATCH_SIZE];
+	__u32 batch_size;
+	struct ope_cmd_buf_info cmd_buf[OPE_MAX_BATCH_SIZE][OPE_MAX_CMD_BUFS];
+	struct ope_frame_set frame_set[OPE_MAX_BATCH_SIZE];
+};
+
+/**
+ * struct ope_clk_bw_request_v2 - clock and bandwidth for a request
+ *
+ * @budget_ns:       Time required to process frame
+ * @frame_cycles:    Frame cycles needed to process the frame
+ * @rt_flag:         Flag to indicate real time stream
+ * @reserved:        For memory alignment
+ * @axi_path:        Per path vote info for OPE
+ *
+ */
+struct ope_clk_bw_request_v2 {
+	__u64 budget_ns;
+	__u32 frame_cycles;
+	__u32 rt_flag;
+	__u32 reserved;
+	__u32 num_paths;
+    union {
+        struct cam_axi_per_path_bw_vote   axi_path[1];
+        __DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+    };
+};
+
+/**
+ * struct ope_hw_ver - Device information for OPE
+ *
+ * This is used to get device version info of
+ * OPE, CDM and use this info in CAM_QUERY_CAP IOCTL
+ *
+ * @hw_type:  Hardware type for the cap info(OPE_HW_TYPE_XXX)
+ * @reserved: Reserved field
+ * @hw_ver:   Major, minor and incr values of a hardware version
+ *
+ */
+struct ope_hw_ver {
+	__u32 hw_type;
+	__u32 reserved;
+	struct cam_hw_version hw_ver;
+};
+
+/**
+ * struct ope_query_cap_cmd - OPE query device capability payload
+ *
+ * @dev_iommu_handle: OPE iommu handles for secure/non secure modes
+ * @cdm_iommu_handle: CDM iommu handles for secure/non secure modes
+ * @num_ope:          Number of OPEs
+ * @reserved:         Reserved Parameter
+ * @hw_ver:           Hardware capability array
+ */
+struct ope_query_cap_cmd {
+	struct cam_iommu_handle dev_iommu_handle;
+	struct cam_iommu_handle cdm_iommu_handle;
+	__u32 num_ope;
+	__u32 reserved;
+	struct ope_hw_ver hw_ver[OPE_DEV_TYPE_MAX];
+};
+
+/**
+ * struct ope_out_res_info - OPE Output resource info
+ *
+ * @res_id:            Resource ID
+ * @format:            Output resource format
+ * @width:             Output width
+ * @height:            Output Height
+ * @alignment:         Alignment
+ * @packer_format:     Packer format
+ * @subsample_period:  Subsample period in HFR
+ * @subsample_pattern: Subsample pattern in HFR
+ * @pixel_pattern:     Pixel pattern
+ * @reserved:          Reserved Parameter
+ *
+ */
+struct ope_out_res_info {
+	__u32 res_id;
+	__u32 format;
+	__u32 width;
+	__u32 height;
+	__u32 alignment;
+	__u32 packer_format;
+	__u32 subsample_period;
+	__u32 subsample_pattern;
+	__u32 pixel_pattern;
+	__u32 reserved;
+};
+
+/**
+ * struct ope_in_res_info - OPE Input resource info
+ *
+ * @res_id:           Resource ID
+ * @format:           Input resource format
+ * @width:            Input width
+ * @height:           Input Height
+ * @pixel_pattern:    Pixel pattern
+ * @alignment:        Alignment
+ * @unpacker_format:  Unpacker format
+ * @max_stripe_size:  Max stripe size supported for this instance configuration
+ * @fps:              Frames per second
+ * @reserved:         Reserved Parameter
+ *
+ */
+struct ope_in_res_info {
+	__u32 res_id;
+	__u32 format;
+	__u32 width;
+	__u32 height;
+	__u32 pixel_pattern;
+	__u32 alignment;
+	__u32 unpacker_format;
+	__u32 max_stripe_size;
+	__u32 fps;
+	__u32 reserved;
+};
+
+/**
+ * struct ope_acquire_dev_info - OPE Acquire Info
+ *
+ * @hw_type:             OPE HW Types (OPE)
+ * @dev_type:            Nature of Device Instance (RT/NRT)
+ * @dev_name:            Name of Device Instance
+ * @nrt_stripes_for_arb: Program num stripes in OPE CDM for NRT device
+ *                       before setting ARB bit
+ * @secure_mode:         Mode of Device operation (Secure or Non Secure)
+ * @batch_size:          Batch size
+ * @num_in_res:          Number of input resources (OPE_IN_RES_XXX)
+ * @in_res:              Input resource info
+ * @num_out_res:         Number of output resources (OPE_OUT_RES_XXX)
+ * @reserved:            Reserved Parameter
+ * @out_res:             Output resource info
+ *
+ */
+struct ope_acquire_dev_info {
+	__u32                   hw_type;
+	__u32                   dev_type;
+	char                    dev_name[OPE_DEV_NAME_SIZE];
+	__u32                   nrt_stripes_for_arb;
+	__u32                   secure_mode;
+	__u32                   batch_size;
+	__u32                   num_in_res;
+	struct ope_in_res_info  in_res[OPE_IN_RES_MAX];
+	__u32                   num_out_res;
+	__u32                   reserved;
+	struct ope_out_res_info out_res[OPE_OUT_RES_MAX];
+} __attribute__((__packed__));
+
+#endif /* __UAPI_OPE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_req_mgr.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_req_mgr.h
@@ -0,0 +1,582 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_LINUX_CAM_REQ_MGR_H
+#define __UAPI_LINUX_CAM_REQ_MGR_H
+
+#include <linux/videodev2.h>
+#include <linux/types.h>
+#include <linux/ioctl.h>
+#include <linux/media.h>
+#include <media/cam_defs.h>
+
+#define CAM_REQ_MGR_VNODE_NAME "cam-req-mgr-devnode"
+
+#define CAM_DEVICE_TYPE_BASE      (MEDIA_ENT_F_OLD_BASE)
+#define CAM_VNODE_DEVICE_TYPE     (CAM_DEVICE_TYPE_BASE)
+#define CAM_SENSOR_DEVICE_TYPE    (CAM_DEVICE_TYPE_BASE + 1)
+#define CAM_IFE_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 2)
+#define CAM_ICP_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 3)
+#define CAM_LRME_DEVICE_TYPE      (CAM_DEVICE_TYPE_BASE + 4)
+#define CAM_JPEG_DEVICE_TYPE      (CAM_DEVICE_TYPE_BASE + 5)
+#define CAM_FD_DEVICE_TYPE        (CAM_DEVICE_TYPE_BASE + 6)
+#define CAM_CPAS_DEVICE_TYPE      (CAM_DEVICE_TYPE_BASE + 7)
+#define CAM_CSIPHY_DEVICE_TYPE    (CAM_DEVICE_TYPE_BASE + 8)
+#define CAM_ACTUATOR_DEVICE_TYPE  (CAM_DEVICE_TYPE_BASE + 9)
+#define CAM_CCI_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 10)
+#define CAM_FLASH_DEVICE_TYPE     (CAM_DEVICE_TYPE_BASE + 11)
+#define CAM_EEPROM_DEVICE_TYPE    (CAM_DEVICE_TYPE_BASE + 12)
+#define CAM_OIS_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 13)
+#define CAM_CUSTOM_DEVICE_TYPE    (CAM_DEVICE_TYPE_BASE + 14)
+#define CAM_OPE_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 15)
+#define CAM_TFE_DEVICE_TYPE       (CAM_DEVICE_TYPE_BASE + 16)
+#define CAM_IRLED_DEVICE_TYPE     (CAM_DEVICE_TYPE_BASE + 17)
+
+/* cam_req_mgr hdl info */
+#define CAM_REQ_MGR_HDL_IDX_POS           8
+#define CAM_REQ_MGR_HDL_IDX_MASK          ((1 << CAM_REQ_MGR_HDL_IDX_POS) - 1)
+#define CAM_REQ_MGR_GET_HDL_IDX(hdl)      (hdl & CAM_REQ_MGR_HDL_IDX_MASK)
+
+/**
+ * Max handles supported by cam_req_mgr
+ * It includes both session and device handles
+ */
+#define CAM_REQ_MGR_MAX_HANDLES           64
+#define CAM_REQ_MGR_MAX_HANDLES_V2        128
+#define MAX_LINKS_PER_SESSION             2
+
+/* V4L event type which user space will subscribe to */
+#define V4L_EVENT_CAM_REQ_MGR_EVENT       (V4L2_EVENT_PRIVATE_START + 0)
+
+/* Specific event ids to get notified in user space */
+#define V4L_EVENT_CAM_REQ_MGR_SOF            0
+#define V4L_EVENT_CAM_REQ_MGR_ERROR          1
+#define V4L_EVENT_CAM_REQ_MGR_SOF_BOOT_TS    2
+#define V4L_EVENT_CAM_REQ_MGR_CUSTOM_EVT     3
+#define V4L_EVENT_CAM_REQ_MGR_NODE_EVENT     4
+#define V4L_EVENT_CAM_REQ_MGR_SOF_UNIFIED_TS 5
+#define V4L_EVENT_CAM_REQ_MGR_PF_ERROR       6
+
+/* SOF Event status */
+#define CAM_REQ_MGR_SOF_EVENT_SUCCESS           0
+#define CAM_REQ_MGR_SOF_EVENT_ERROR             1
+
+/* Link control operations */
+#define CAM_REQ_MGR_LINK_ACTIVATE               0
+#define CAM_REQ_MGR_LINK_DEACTIVATE             1
+
+/* DMA buffer name length */
+#define CAM_DMA_BUF_NAME_LEN                    128
+#define CAM_REQ_MGR_ALLOC_BUF_WITH_NAME         1
+
+/**
+ * Request Manager : flush_type
+ * @CAM_REQ_MGR_FLUSH_TYPE_ALL: Req mgr will remove all the pending
+ * requests from input/processing queue.
+ * @CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ: Req mgr will remove only particular
+ * request id from input/processing queue.
+ * @CAM_REQ_MGR_FLUSH_TYPE_MAX: Max number of the flush type
+ * @opcode: CAM_REQ_MGR_FLUSH_REQ
+ */
+#define CAM_REQ_MGR_FLUSH_TYPE_ALL          0
+#define CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ   1
+#define CAM_REQ_MGR_FLUSH_TYPE_MAX          2
+
+/**
+ * Request Manager : Sync Mode type
+ * @CAM_REQ_MGR_SYNC_MODE_NO_SYNC: Req mgr will apply non-sync mode for this
+ * request.
+ * @CAM_REQ_MGR_SYNC_MODE_SYNC: Req mgr will apply sync mode for this request.
+ */
+#define CAM_REQ_MGR_SYNC_MODE_NO_SYNC   0
+#define CAM_REQ_MGR_SYNC_MODE_SYNC      1
+
+/**
+ * struct cam_req_mgr_event_data
+ * @session_hdl: session handle
+ * @link_hdl: link handle
+ * @frame_id: frame id
+ * @reserved: reserved for 64 bit aligngment
+ * @req_id: request id
+ * @tv_sec: timestamp in seconds
+ * @tv_usec: timestamp in micro seconds
+ */
+struct cam_req_mgr_event_data {
+	__s32   session_hdl;
+	__s32   link_hdl;
+	__s32   frame_id;
+	__s32   reserved;
+	__s64   req_id;
+	__u64  tv_sec;
+	__u64  tv_usec;
+};
+
+/**
+ * struct cam_req_mgr_session_info
+ * @session_hdl: In/Output param - session_handle
+ * @opcode1: CAM_REQ_MGR_CREATE_SESSION
+ * @opcode2: CAM_REQ_MGR_DESTROY_SESSION
+ */
+struct cam_req_mgr_session_info {
+	__s32 session_hdl;
+	__s32 reserved;
+};
+
+/**
+ * struct cam_req_mgr_link_info
+ * @session_hdl: Input param - Identifier for CSL session
+ * @num_devices: Input Param - Num of devices to be linked
+ * @dev_hdls: Input param - List of device handles to be linked
+ * @link_hdl: Output Param -Identifier for link
+ * @opcode: CAM_REQ_MGR_LINK
+ */
+struct cam_req_mgr_link_info {
+	__s32 session_hdl;
+	__u32 num_devices;
+	__s32 dev_hdls[CAM_REQ_MGR_MAX_HANDLES];
+	__s32 link_hdl;
+};
+
+struct cam_req_mgr_link_info_v2 {
+	__s32 session_hdl;
+	__u32 num_devices;
+	__s32 dev_hdls[CAM_REQ_MGR_MAX_HANDLES_V2];
+	__s32 link_hdl;
+};
+
+struct cam_req_mgr_ver_info {
+	__u32 version;
+	union {
+		struct cam_req_mgr_link_info link_info_v1;
+		struct cam_req_mgr_link_info_v2 link_info_v2;
+	} u;
+};
+/**
+ * struct cam_req_mgr_unlink_info
+ * @session_hdl: input param - session handle
+ * @link_hdl: input param - link handle
+ * @opcode: CAM_REQ_MGR_UNLINK
+ */
+struct cam_req_mgr_unlink_info {
+	__s32 session_hdl;
+	__s32 link_hdl;
+};
+
+/**
+ * struct cam_req_mgr_flush_info
+ * @brief: User can tell drivers to flush a particular request id or
+ * flush all requests from its pending processing queue. Flush is a
+ * blocking call and driver shall ensure all requests are flushed
+ * before returning.
+ * @session_hdl: Input param - Identifier for CSL session
+ * @link_hdl: Input Param -Identifier for link
+ * @flush_type: User can cancel a particular req id or can flush
+ * all requests in queue
+ * @reserved: reserved for 64 bit aligngment
+ * @req_id: field is valid only if flush type is cancel request
+ * for flush all this field value is not considered.
+ * @opcode: CAM_REQ_MGR_FLUSH_REQ
+ */
+struct cam_req_mgr_flush_info {
+	__s32 session_hdl;
+	__s32 link_hdl;
+	__u32 flush_type;
+	__u32 reserved;
+	__s64 req_id;
+};
+
+/** struct cam_req_mgr_sched_info
+ * @session_hdl: Input param - Identifier for CSL session
+ * @link_hdl: Input Param -Identifier for link
+ * inluding itself.
+ * @bubble_enable: Input Param - Cam req mgr will do bubble recovery if this
+ * flag is set.
+ * @sync_mode: Type of Sync mode for this request
+ * @additional_timeout: Additional timeout value (in ms) associated with
+ * this request. This value needs to be 0 in cases where long exposure is
+ * not configured for the sensor.The max timeout that will be supported
+ * is 50000 ms
+ * @reserved: Reserved
+ * @req_id: Input Param - Request Id from which all requests will be flushed
+ */
+struct cam_req_mgr_sched_request {
+	__s32 session_hdl;
+	__s32 link_hdl;
+	__s32 bubble_enable;
+	__s32 sync_mode;
+	__s32 additional_timeout;
+	__s32 reserved;
+	__s64 req_id;
+};
+
+/**
+ * struct cam_req_mgr_sync_mode
+ * @session_hdl:         Input param - Identifier for CSL session
+ * @sync_mode:           Input Param - Type of sync mode
+ * @num_links:           Input Param - Num of links in sync mode (Valid only
+ *                             when sync_mode is one of SYNC enabled modes)
+ * @link_hdls:           Input Param - Array of link handles to be in sync mode
+ *                             (Valid only when sync_mode is one of SYNC
+ *                             enabled modes)
+ * @master_link_hdl:     Input Param - To dictate which link's SOF drives system
+ *                             (Valid only when sync_mode is one of SYNC
+ *                             enabled modes)
+ *
+ * @opcode: CAM_REQ_MGR_SYNC_MODE
+ */
+struct cam_req_mgr_sync_mode {
+	__s32 session_hdl;
+	__s32 sync_mode;
+	__s32 num_links;
+	__s32 link_hdls[MAX_LINKS_PER_SESSION];
+	__s32 master_link_hdl;
+	__s32 reserved;
+};
+
+/**
+ * struct cam_req_mgr_link_control
+ * @ops:                 Link operations: activate/deactive
+ * @session_hdl:         Input param - Identifier for CSL session
+ * @num_links:           Input Param - Num of links
+ * @reserved:            reserved field
+ * @init_timeout:        To account for INIT exposure settings (ms)
+ *                       If there is no change in exp settings
+ *                       field needs to assigned to 0ms.
+ * @link_hdls:           Input Param - Links to be activated/deactivated
+ *
+ * @opcode: CAM_REQ_MGR_LINK_CONTROL
+ */
+struct cam_req_mgr_link_control {
+	__s32 ops;
+	__s32 session_hdl;
+	__s32 num_links;
+	__s32 reserved;
+	__s32 init_timeout[MAX_LINKS_PER_SESSION];
+	__s32 link_hdls[MAX_LINKS_PER_SESSION];
+};
+
+/**
+ * cam_req_mgr specific opcode ids
+ */
+#define CAM_REQ_MGR_CREATE_DEV_NODES            (CAM_COMMON_OPCODE_MAX + 1)
+#define CAM_REQ_MGR_CREATE_SESSION              (CAM_COMMON_OPCODE_MAX + 2)
+#define CAM_REQ_MGR_DESTROY_SESSION             (CAM_COMMON_OPCODE_MAX + 3)
+#define CAM_REQ_MGR_LINK                        (CAM_COMMON_OPCODE_MAX + 4)
+#define CAM_REQ_MGR_UNLINK                      (CAM_COMMON_OPCODE_MAX + 5)
+#define CAM_REQ_MGR_SCHED_REQ                   (CAM_COMMON_OPCODE_MAX + 6)
+#define CAM_REQ_MGR_FLUSH_REQ                   (CAM_COMMON_OPCODE_MAX + 7)
+#define CAM_REQ_MGR_SYNC_MODE                   (CAM_COMMON_OPCODE_MAX + 8)
+#define CAM_REQ_MGR_ALLOC_BUF                   (CAM_COMMON_OPCODE_MAX + 9)
+#define CAM_REQ_MGR_MAP_BUF                     (CAM_COMMON_OPCODE_MAX + 10)
+#define CAM_REQ_MGR_RELEASE_BUF                 (CAM_COMMON_OPCODE_MAX + 11)
+#define CAM_REQ_MGR_CACHE_OPS                   (CAM_COMMON_OPCODE_MAX + 12)
+#define CAM_REQ_MGR_LINK_CONTROL                (CAM_COMMON_OPCODE_MAX + 13)
+#define CAM_REQ_MGR_LINK_V2                     (CAM_COMMON_OPCODE_MAX + 14)
+#define CAM_REQ_MGR_REQUEST_DUMP                (CAM_COMMON_OPCODE_MAX + 15)
+#define CAM_REQ_MGR_ALLOC_BUF_V2                (CAM_COMMON_OPCODE_MAX + 18)
+#define CAM_REQ_MGR_MAP_BUF_V2                  (CAM_COMMON_OPCODE_MAX + 19)
+
+/* end of cam_req_mgr opcodes */
+
+#define CAM_MEM_FLAG_HW_READ_WRITE              (1<<0)
+#define CAM_MEM_FLAG_HW_READ_ONLY               (1<<1)
+#define CAM_MEM_FLAG_HW_WRITE_ONLY              (1<<2)
+#define CAM_MEM_FLAG_KMD_ACCESS                 (1<<3)
+#define CAM_MEM_FLAG_UMD_ACCESS                 (1<<4)
+#define CAM_MEM_FLAG_PROTECTED_MODE             (1<<5)
+#define CAM_MEM_FLAG_CMD_BUF_TYPE               (1<<6)
+#define CAM_MEM_FLAG_PIXEL_BUF_TYPE             (1<<7)
+#define CAM_MEM_FLAG_STATS_BUF_TYPE             (1<<8)
+#define CAM_MEM_FLAG_PACKET_BUF_TYPE            (1<<9)
+#define CAM_MEM_FLAG_CACHE                      (1<<10)
+#define CAM_MEM_FLAG_HW_SHARED_ACCESS           (1<<11)
+#define CAM_MEM_FLAG_CDSP_OUTPUT                (1<<12)
+#define CAM_MEM_FLAG_DISABLE_DELAYED_UNMAP      (1<<13)
+#define CAM_MEM_FLAG_KMD_DEBUG_FLAG             (1<<14)
+
+
+#define CAM_MEM_MMU_MAX_HANDLE                  16
+
+/* Maximum allowed buffers in existence */
+#define CAM_MEM_BUFQ_MAX                        2048
+
+#define CAM_MEM_MGR_SECURE_BIT_POS              15
+#define CAM_MEM_MGR_HDL_IDX_SIZE                15
+#define CAM_MEM_MGR_HDL_FD_SIZE                 16
+#define CAM_MEM_MGR_HDL_IDX_END_POS             16
+#define CAM_MEM_MGR_HDL_FD_END_POS              32
+
+#define CAM_MEM_MGR_HDL_IDX_MASK      ((1 << CAM_MEM_MGR_HDL_IDX_SIZE) - 1)
+
+#define GET_MEM_HANDLE(idx, fd) \
+	((idx & CAM_MEM_MGR_HDL_IDX_MASK) | \
+	(fd << (CAM_MEM_MGR_HDL_FD_END_POS - CAM_MEM_MGR_HDL_FD_SIZE))) \
+
+#define GET_FD_FROM_HANDLE(hdl) \
+	(hdl >> (CAM_MEM_MGR_HDL_FD_END_POS - CAM_MEM_MGR_HDL_FD_SIZE)) \
+
+#define CAM_MEM_MGR_GET_HDL_IDX(hdl) (hdl & CAM_MEM_MGR_HDL_IDX_MASK)
+
+#define CAM_MEM_MGR_SET_SECURE_HDL(hdl, flag) \
+	((flag) ? (hdl |= (1 << CAM_MEM_MGR_SECURE_BIT_POS)) : \
+	((hdl) &= ~(1 << CAM_MEM_MGR_SECURE_BIT_POS)))
+
+#define CAM_MEM_MGR_IS_SECURE_HDL(hdl) \
+	(((hdl) & \
+	(1<<CAM_MEM_MGR_SECURE_BIT_POS)) >> CAM_MEM_MGR_SECURE_BIT_POS)
+
+/**
+ * memory allocation type
+ */
+#define CAM_MEM_DMA_NONE                        0
+#define CAM_MEM_DMA_BIDIRECTIONAL               1
+#define CAM_MEM_DMA_TO_DEVICE                   2
+#define CAM_MEM_DMA_FROM_DEVICE                 3
+
+
+/**
+ * memory cache operation
+ */
+#define CAM_MEM_CLEAN_CACHE                     1
+#define CAM_MEM_INV_CACHE                       2
+#define CAM_MEM_CLEAN_INV_CACHE                 3
+
+
+/**
+ * struct cam_mem_alloc_out_params
+ * @buf_handle: buffer handle
+ * @fd: output buffer file descriptor
+ * @vaddr: virtual address pointer
+ */
+struct cam_mem_alloc_out_params {
+	__u32 buf_handle;
+	__s32 fd;
+	__u64 vaddr;
+};
+
+/**
+ * struct cam_mem_map_out_params
+ * @buf_handle: buffer handle
+ * @size: size of the buffer being mapped
+ * @vaddr: virtual address pointer
+ */
+struct cam_mem_map_out_params {
+	__u32 buf_handle;
+	__u32 size;
+	__u64 vaddr;
+};
+
+/**
+ * struct cam_mem_mgr_alloc_cmd
+ * @len: size of buffer to allocate
+ * @align: alignment of the buffer
+ * @mmu_hdls: array of mmu handles
+ * @num_hdl: number of handles
+ * @flags: flags of the buffer
+ * @out: out params
+ */
+/* CAM_REQ_MGR_ALLOC_BUF */
+struct cam_mem_mgr_alloc_cmd {
+	__u64                           len;
+	__u64                           align;
+	__s32                           mmu_hdls[CAM_MEM_MMU_MAX_HANDLE];
+	__u32                           num_hdl;
+	__u32                           flags;
+	struct cam_mem_alloc_out_params out;
+};
+
+/**
+ * struct cam_mem_mgr_alloc_cmd_v2
+ * @version: Struct version
+ * @num_hdl: number of handles
+ * @mmu_hdls: array of mmu handles
+ * @len: size of buffer to allocate
+ * @align: alignment of the buffer
+ * @vmids: reserved
+ * @buf_name: DMA buffer name
+ * @flags: flags of the buffer
+ * @num_valid_params: Valid number of params being used
+ * @valid_param_mask: Mask to indicate the field types in params
+ * @params: Additional params
+ * @out: out params
+ */
+/* CAM_REQ_MGR_ALLOC_BUF_V2 */
+struct cam_mem_mgr_alloc_cmd_v2 {
+	__u32                           version;
+	__u32                           num_hdl;
+	__s32                           mmu_hdls[CAM_MEM_MMU_MAX_HANDLE];
+	__u64                           len;
+	__u64                           align;
+	__u64                           vmids;
+	char                            buf_name[CAM_DMA_BUF_NAME_LEN];
+	__u32                           flags;
+	__u32                           num_valid_params;
+	__u32                           valid_param_mask;
+	__s32                           params[5];
+	struct cam_mem_alloc_out_params out;
+};
+
+/**
+ * struct cam_mem_mgr_map_cmd
+ * @mmu_hdls: array of mmu handles
+ * @num_hdl: number of handles
+ * @flags: flags of the buffer
+ * @fd: output buffer file descriptor
+ * @reserved: reserved field
+ * @out: out params
+ */
+
+/* CAM_REQ_MGR_MAP_BUF */
+struct cam_mem_mgr_map_cmd {
+	__s32                         mmu_hdls[CAM_MEM_MMU_MAX_HANDLE];
+	__u32                         num_hdl;
+	__u32                         flags;
+	__s32                         fd;
+	__u32                         reserved;
+	struct cam_mem_map_out_params out;
+};
+
+/**
+ * struct cam_mem_mgr_map_cmd_v2
+ * @version: Struct version
+ * @fd: output buffer file descriptor
+ * @mmu_hdls: array of mmu handles
+ * @num_hdl: number of handles
+ * @flags: flags of the buffer
+ * @vmids: reserved
+ * @buf_name: DMA buffer name
+ * @num_valid_params: Valid number of params being used
+ * @valid_param_mask: Mask to indicate the field types in params
+ * @params: Additional params
+ * @out: out params
+ */
+
+/* CAM_REQ_MGR_MAP_BUF_V2 */
+struct cam_mem_mgr_map_cmd_v2 {
+	__u32                         version;
+	__s32                         fd;
+	__s32                         mmu_hdls[CAM_MEM_MMU_MAX_HANDLE];
+	__u32                         num_hdl;
+	__u32                         flags;
+	__u64                         vmids;
+	char                          buf_name[CAM_DMA_BUF_NAME_LEN];
+	__u32                         num_valid_params;
+	__u32                         valid_param_mask;
+	__s32                         params[4];
+	struct cam_mem_map_out_params out;
+};
+
+/**
+ * struct cam_mem_mgr_map_cmd
+ * @buf_handle: buffer handle
+ * @reserved: reserved field
+ */
+/* CAM_REQ_MGR_RELEASE_BUF */
+struct cam_mem_mgr_release_cmd {
+	__s32 buf_handle;
+	__u32 reserved;
+};
+
+/**
+ * struct cam_mem_mgr_map_cmd
+ * @buf_handle: buffer handle
+ * @ops: cache operations
+ */
+/* CAM_REQ_MGR_CACHE_OPS */
+struct cam_mem_cache_ops_cmd {
+	__s32 buf_handle;
+	__u32 mem_cache_ops;
+};
+
+/**
+ * Request Manager : error message type
+ * @CAM_REQ_MGR_ERROR_TYPE_DEVICE: Device error message, fatal to session
+ * @CAM_REQ_MGR_ERROR_TYPE_REQUEST: Error on a single request, not fatal
+ * @CAM_REQ_MGR_ERROR_TYPE_BUFFER: Buffer was not filled, not fatal
+ * @CAM_REQ_MGR_ERROR_TYPE_RECOVERY: Fatal error, can be recovered
+ * @CAM_REQ_MGR_ERROR_TYPE_SOF_FREEZE: SOF freeze, can be recovered
+ * @CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY: Full recovery, can be recovered
+ * @CAM_REQ_MGR_ERROR_TYPE_PAGE_FAULT: page fault, can be recovered
+ */
+#define CAM_REQ_MGR_ERROR_TYPE_DEVICE           0
+#define CAM_REQ_MGR_ERROR_TYPE_REQUEST          1
+#define CAM_REQ_MGR_ERROR_TYPE_BUFFER           2
+#define CAM_REQ_MGR_ERROR_TYPE_RECOVERY         3
+#define CAM_REQ_MGR_ERROR_TYPE_SOF_FREEZE       4
+#define CAM_REQ_MGR_ERROR_TYPE_FULL_RECOVERY    5
+#define CAM_REQ_MGR_ERROR_TYPE_PAGE_FAULT       6
+
+/**
+ * struct cam_req_mgr_error_msg
+ * @error_type: type of error
+ * @request_id: request id of frame
+ * @device_hdl: device handle
+ * @linke_hdl: link_hdl
+ * @resource_size: size of the resource
+ */
+struct cam_req_mgr_error_msg {
+	__u32 error_type;
+	__u32 request_id;
+	__s32 device_hdl;
+	__s32 link_hdl;
+	__u64 resource_size;
+};
+
+/**
+ * struct cam_req_mgr_frame_msg
+ * @request_id: request id of the frame
+ * @frame_id: frame id of the frame
+ * @timestamp: timestamp of the frame
+ * @link_hdl: link handle associated with this message
+ * @sof_status: sof status success or fail
+ * @frame_id_meta: refers to the meta for
+ *                that frame in specific usecases
+ * @reserved: reserved
+ */
+struct cam_req_mgr_frame_msg {
+	__u64 request_id;
+	__u64 frame_id;
+	__u64 timestamp;
+	__s32 link_hdl;
+	__u32 sof_status;
+	__u32 frame_id_meta;
+	__u32 reserved;
+};
+
+/**
+ * struct cam_req_mgr_custom_msg
+ * @custom_type: custom type
+ * @request_id: request id of the frame
+ * @frame_id: frame id of the frame
+ * @timestamp: timestamp of the frame
+ * @link_hdl: link handle associated with this message
+ * @custom_data: custom data
+ */
+struct cam_req_mgr_custom_msg {
+	__u32 custom_type;
+	__u64 request_id;
+	__u64 frame_id;
+	__u64 timestamp;
+	__s32 link_hdl;
+	__u64 custom_data;
+};
+
+/**
+ * struct cam_req_mgr_message
+ * @session_hdl: session to which the frame belongs to
+ * @reserved: reserved field
+ * @u: union which can either be error/frame/custom message
+ */
+struct cam_req_mgr_message {
+	__s32 session_hdl;
+	__s32 reserved;
+	union {
+		struct cam_req_mgr_error_msg err_msg;
+		struct cam_req_mgr_frame_msg frame_msg;
+		struct cam_req_mgr_custom_msg custom_msg;
+	} u;
+};
+#endif /* __UAPI_LINUX_CAM_REQ_MGR_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_sensor.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_sensor.h
@@ -0,0 +1,536 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_SENSOR_H__
+#define __UAPI_CAM_SENSOR_H__
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+#include <media/cam_defs.h>
+
+#define CAM_SENSOR_PROBE_CMD   (CAM_COMMON_OPCODE_MAX + 1)
+#define CAM_FLASH_MAX_LED_TRIGGERS 2
+#define MAX_OIS_NAME_SIZE 32
+#define CAM_CSIPHY_SECURE_MODE_ENABLED 1
+#define CAM_IR_LED_SUPPORTED
+/**
+ * struct cam_sensor_query_cap - capabilities info for sensor
+ *
+ * @slot_info        :  Indicates about the slotId or cell Index
+ * @secure_camera    :  Camera is in secure/Non-secure mode
+ * @pos_pitch        :  Sensor position pitch
+ * @pos_roll         :  Sensor position roll
+ * @pos_yaw          :  Sensor position yaw
+ * @actuator_slot_id :  Actuator slot id which connected to sensor
+ * @eeprom_slot_id   :  EEPROM slot id which connected to sensor
+ * @ois_slot_id      :  OIS slot id which connected to sensor
+ * @flash_slot_id    :  Flash slot id which connected to sensor
+ * @csiphy_slot_id   :  CSIphy slot id which connected to sensor
+ * @irled_slot_id    :  IRLED slot id which connected to sensor
+ *
+ */
+struct  cam_sensor_query_cap {
+	__u32        slot_info;
+	__u32        secure_camera;
+	__u32        pos_pitch;
+	__u32        pos_roll;
+	__u32        pos_yaw;
+	__u32        actuator_slot_id;
+	__u32        eeprom_slot_id;
+	__u32        ois_slot_id;
+	__u32        flash_slot_id;
+	__u32        csiphy_slot_id;
+	__u32        ir_led_slot_id;
+} __attribute__((packed));
+
+/**
+ * struct cam_csiphy_query_cap - capabilities info for csiphy
+ *
+ * @slot_info        :  Indicates about the slotId or cell Index
+ * @version          :  CSIphy version
+ * @clk lane         :  Of the 5 lanes, informs lane configured
+ *                      as clock lane
+ * @reserved
+ */
+struct cam_csiphy_query_cap {
+	__u32            slot_info;
+	__u32            version;
+	__u32            clk_lane;
+	__u32            reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_actuator_query_cap - capabilities info for actuator
+ *
+ * @slot_info        :  Indicates about the slotId or cell Index
+ * @reserved
+ */
+struct cam_actuator_query_cap {
+	__u32            slot_info;
+	__u32            reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_eeprom_query_cap_t - capabilities info for eeprom
+ *
+ * @slot_info                  :  Indicates about the slotId or cell Index
+ * @eeprom_kernel_probe        :  Indicates about the kernel or userspace probe
+ */
+struct cam_eeprom_query_cap_t {
+	__u32            slot_info;
+	__u16            eeprom_kernel_probe;
+	__u16            is_multimodule_mode;
+} __attribute__((packed));
+
+/**
+ * struct cam_ois_query_cap_t - capabilities info for ois
+ *
+ * @slot_info                  :  Indicates about the slotId or cell Index
+ */
+struct cam_ois_query_cap_t {
+	__u32            slot_info;
+	__u16            reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_info - Contains slave I2C related info
+ *
+ * @slave_addr      :    Slave address
+ * @i2c_freq_mode   :    4 bits are used for I2c freq mode
+ * @cmd_type        :    Explains type of command
+ */
+struct cam_cmd_i2c_info {
+	__u32    slave_addr;
+	__u8     i2c_freq_mode;
+	__u8     cmd_type;
+	__u16    reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_ois_opcode - Contains OIS opcode
+ *
+ * @prog            :    OIS FW prog register address
+ * @coeff           :    OIS FW coeff register address
+ * @pheripheral     :    OIS pheripheral
+ * @memory          :    OIS memory
+ */
+struct cam_ois_opcode {
+	__u32 prog;
+	__u32 coeff;
+	__u32 pheripheral;
+	__u32 memory;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_ois_info - Contains OIS slave info
+ *
+ * @slave_addr            :    OIS i2c slave address
+ * @i2c_freq_mode         :    i2c frequency mode
+ * @cmd_type              :    Explains type of command
+ * @ois_fw_flag           :    indicates if fw is present or not
+ * @is_ois_calib          :    indicates the calibration data is available
+ * @ois_name              :    OIS name
+ * @opcode                :    opcode
+ */
+struct cam_cmd_ois_info {
+	__u32                 slave_addr;
+	__u8                  i2c_freq_mode;
+	__u8                  cmd_type;
+	__u8                  ois_fw_flag;
+	__u8                  is_ois_calib;
+	char                  ois_name[MAX_OIS_NAME_SIZE];
+	struct cam_ois_opcode opcode;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_probe - Contains sensor slave info
+ *
+ * @data_type       :   Slave register data type
+ * @addr_type       :   Slave register address type
+ * @op_code         :   Don't Care
+ * @cmd_type        :   Explains type of command
+ * @reg_addr        :   Slave register address
+ * @expected_data   :   Data expected at slave register address
+ * @data_mask       :   Data mask if only few bits are valid
+ * @camera_id       :   Indicates the slot to which camera
+ *                      needs to be probed
+ * @reserved
+ */
+struct cam_cmd_probe {
+	__u8     data_type;
+	__u8     addr_type;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u32    reg_addr;
+	__u32    expected_data;
+	__u32    data_mask;
+	__u16    camera_id;
+	__u16    reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_power_settings - Contains sensor power setting info
+ *
+ * @power_seq_type  :   Type of power sequence
+ * @reserved
+ * @config_val_low  :   Lower 32 bit value configuration value
+ * @config_val_high :   Higher 32 bit value configuration value
+ *
+ */
+struct cam_power_settings {
+	__u16    power_seq_type;
+	__u16    reserved;
+	__u32    config_val_low;
+	__u32    config_val_high;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_power - Explains about the power settings
+ *
+ * @count           :    Number of power settings follows
+ * @reserved
+ * @cmd_type        :    Explains type of command
+ * @power_settings  :    Contains power setting info
+ */
+struct cam_cmd_power {
+	__u32                       count;
+	__u8                        reserved;
+	__u8                        cmd_type;
+	__u16                       more_reserved;
+    union {
+        struct cam_power_settings   power_settings[1];
+        __DECLARE_FLEX_ARRAY(struct cam_power_settings, power_settings_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct i2c_rdwr_header - header of READ/WRITE I2C command
+ *
+ * @ count           :   Number of registers / data / reg-data pairs
+ * @ op_code         :   Operation code
+ * @ cmd_type        :   Command buffer type
+ * @ data_type       :   I2C data type
+ * @ addr_type       :   I2C address type
+ * @ reserved
+ */
+struct i2c_rdwr_header {
+	__u32    count;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u8     data_type;
+	__u8     addr_type;
+} __attribute__((packed));
+
+/**
+ * struct i2c_random_wr_payload - payload for I2C random write
+ *
+ * @ reg_addr        :   Register address
+ * @ reg_data        :   Register data
+ *
+ */
+struct i2c_random_wr_payload {
+	__u32     reg_addr;
+	__u32     reg_data;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_random_wr - I2C random write command
+ * @ header            :   header of READ/WRITE I2C command
+ * @ random_wr_payload :   payload for I2C random write
+ */
+struct cam_cmd_i2c_random_wr {
+	struct i2c_rdwr_header       header;
+    union {
+        struct i2c_random_wr_payload random_wr_payload[1];
+        __DECLARE_FLEX_ARRAY(struct i2c_random_wr_payload, random_wr_payload_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_read - I2C read command
+ * @ reg_data        :   Register data
+ * @ reserved
+ */
+struct cam_cmd_read {
+	__u32                reg_data;
+	__u32                reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_continuous_wr - I2C continuous write command
+ * @ header          :   header of READ/WRITE I2C command
+ * @ reg_addr        :   Register address
+ * @ data_read       :   I2C read command
+ */
+struct cam_cmd_i2c_continuous_wr {
+	struct i2c_rdwr_header header;
+	__u32                  reg_addr;
+    union {
+        struct cam_cmd_read    data_read[1];
+        __DECLARE_FLEX_ARRAY(struct cam_cmd_read, data_read_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_random_rd - I2C random read command
+ * @ header          :   header of READ/WRITE I2C command
+ * @ data_read       :   I2C read command
+ */
+struct cam_cmd_i2c_random_rd {
+	struct i2c_rdwr_header header;
+    union {
+        struct cam_cmd_read    data_read[1];
+        __DECLARE_FLEX_ARRAY(struct cam_cmd_read, data_read_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_i2c_continuous_rd - I2C continuous continuous read command
+ * @ header          :   header of READ/WRITE I2C command
+ * @ reg_addr        :   Register address
+ *
+ */
+struct cam_cmd_i2c_continuous_rd {
+	struct i2c_rdwr_header header;
+	__u32                  reg_addr;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_conditional_wait - Conditional wait command
+ * @data_type       :   Data type
+ * @addr_type       :   Address type
+ * @op_code         :   Opcode
+ * @cmd_type        :   Explains type of command
+ * @timeout         :   Timeout for retries
+ * @reserved
+ * @reg_addr        :   Register Address
+ * @reg_data        :   Register data
+ * @data_mask       :   Data mask if only few bits are valid
+ * @camera_id       :   Indicates the slot to which camera
+ *                      needs to be probed
+ *
+ */
+struct cam_cmd_conditional_wait {
+	__u8     data_type;
+	__u8     addr_type;
+	__u16    reserved;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u16    timeout;
+	__u32    reg_addr;
+	__u32    reg_data;
+	__u32    data_mask;
+} __attribute__((packed));
+
+/**
+ * struct cam_cmd_unconditional_wait - Un-conditional wait command
+ * @delay           :   Delay
+ * @op_code         :   Opcode
+ * @cmd_type        :   Explains type of command
+ */
+struct cam_cmd_unconditional_wait {
+	__s16    delay;
+	__s16    reserved;
+	__u8     op_code;
+	__u8     cmd_type;
+	__u16    reserved1;
+} __attribute__((packed));
+
+/**
+ * cam_csiphy_info       : Provides cmdbuffer structre
+ * @lane_assign          : Lane sensor will be using
+ * @mipi_flags           : MIPI phy flags
+ * @lane_cnt             : Total number of lanes
+ * @secure_mode          : Secure mode flag to enable / disable
+ * @settle_time          : Settling time in ms
+ * @data_rate            : Data rate
+ *
+ */
+struct cam_csiphy_info {
+	__u16    reserved;
+	__u16    lane_assign;
+	__u16    mipi_flags;
+	__u8     lane_cnt;
+	__u8     secure_mode;
+	__u64    settle_time;
+	__u64    data_rate;
+} __attribute__((packed));
+
+/**
+ * cam_csiphy_acquire_dev_info : Information needed for
+ *                               csiphy at the time of acquire
+ * @combo_mode                 : Indicates the device mode of operation
+ * @cphy_dphy_combo_mode       : Info regarding cphy_dphy_combo mode
+ * @csiphy_3phase              : Details whether 3Phase / 2Phase operation
+ * @mux_mode                   : Indication for Mux mode operation
+ *
+ */
+struct cam_csiphy_acquire_dev_info {
+	__u32    combo_mode;
+	__u16    cphy_dphy_combo_mode;
+	__u8     csiphy_3phase;
+	__u8     mux_mode;
+} __attribute__((packed));
+
+/**
+ * cam_sensor_acquire_dev : Updates sensor acuire cmd
+ * @device_handle  :    Updates device handle
+ * @session_handle :    Session handle for acquiring device
+ * @handle_type    :    Resource handle type
+ * @reserved
+ * @info_handle    :    Handle to additional info
+ *                      needed for sensor sub modules
+ *
+ */
+struct cam_sensor_acquire_dev {
+	__u32    session_handle;
+	__u32    device_handle;
+	__u32    handle_type;
+	__u32    reserved;
+	__u64    info_handle;
+} __attribute__((packed));
+
+/**
+ * cam_sensor_streamon_dev : StreamOn command for the sensor
+ * @session_handle :    Session handle for acquiring device
+ * @device_handle  :    Updates device handle
+ * @handle_type    :    Resource handle type
+ * @reserved
+ * @info_handle    :    Information Needed at the time of streamOn
+ *
+ */
+struct cam_sensor_streamon_dev {
+	__u32    session_handle;
+	__u32    device_handle;
+	__u32    handle_type;
+	__u32    reserved;
+	__u64    info_handle;
+} __attribute__((packed));
+
+/**
+ * struct cam_flash_init : Init command for the flash
+ * @flash_type  :    flash hw type
+ * @reserved
+ * @cmd_type    :    command buffer type
+ */
+struct cam_flash_init {
+	__u32    flash_type;
+	__u8     reserved;
+	__u8     cmd_type;
+	__u16    reserved1;
+} __attribute__((packed));
+
+/**
+ * struct cam_flash_set_rer : RedEyeReduction command buffer
+ *
+ * @count             :   Number of flash leds
+ * @opcode            :   Command buffer opcode
+ *			CAM_FLASH_FIRE_RER
+ * @cmd_type          :   command buffer operation type
+ * @num_iteration     :   Number of led turn on/off sequence
+ * @reserved
+ * @led_on_delay_ms   :   flash led turn on time in ms
+ * @led_off_delay_ms  :   flash led turn off time in ms
+ * @led_current_ma    :   flash led current in ma
+ *
+ */
+struct cam_flash_set_rer {
+	__u32    count;
+	__u8     opcode;
+	__u8     cmd_type;
+	__u16    num_iteration;
+	__u32    led_on_delay_ms;
+	__u32    led_off_delay_ms;
+	__u32    led_current_ma[CAM_FLASH_MAX_LED_TRIGGERS];
+} __attribute__((packed));
+
+/**
+ * struct cam_flash_set_on_off : led turn on/off command buffer
+ *
+ * @count                  : Number of Flash leds
+ * @opcode                 : Command buffer opcodes
+ *			     CAM_FLASH_FIRE_LOW
+ *			     CAM_FLASH_FIRE_HIGH
+ *			     CAM_FLASH_OFF
+ * @cmd_type               : Command buffer operation type
+ * @led_current_ma         : Flash led current in ma
+ * @time_on_duration_ms    : Flash time on duration in ns
+ *
+ */
+struct cam_flash_set_on_off {
+	__u32    count;
+	__u8     opcode;
+	__u8     cmd_type;
+	__u16    reserved;
+	__u32    led_current_ma[CAM_FLASH_MAX_LED_TRIGGERS];
+	__u64    time_on_duration_ns;
+} __attribute__((packed));
+
+/**
+ * struct cam_flash_query_curr : query current command buffer
+ *
+ * @reserved
+ * @opcode            :   command buffer opcode
+ * @cmd_type          :   command buffer operation type
+ * @query_current_ma  :   battery current in ma
+ *
+ */
+struct cam_flash_query_curr {
+	__u16    reserved;
+	__u8     opcode;
+	__u8     cmd_type;
+	__u32    query_current_ma;
+} __attribute__ ((packed));
+
+/**
+ * struct cam_flash_query_cap  :  capabilities info for flash
+ *
+ * @slot_info           :  Indicates about the slotId or cell Index
+ * @max_current_flash   :  max supported current for flash
+ * @max_duration_flash  :  max flash turn on duration
+ * @max_current_torch   :  max supported current for torch
+ * @flash_type          :  Indicates about the flash type -I2C,GPIO,PMIC
+ *
+ */
+struct cam_flash_query_cap_info {
+	__u32    slot_info;
+	__u32    max_current_flash[CAM_FLASH_MAX_LED_TRIGGERS];
+	__u32    max_duration_flash[CAM_FLASH_MAX_LED_TRIGGERS];
+	__u32    max_current_torch[CAM_FLASH_MAX_LED_TRIGGERS];
+	__u32    flash_type;
+} __attribute__ ((packed));
+/**
+ * struct cam_ir_led_query_cap  :  capabilities info for ir_led
+ *
+ * @slot_info           :  Indicates about the slotId or cell Index
+ *
+ */
+
+struct cam_ir_led_query_cap_info {
+       uint32_t    slot_info;
+} __attribute__ ((packed));
+
+/**
+ * struct cam_ir_ledset_on_off : led turn on/off command buffer
+ *
+ * @opcode             :   command buffer opcodes
+ * @cmd_type           :   command buffer operation type
+ * @ir_led_intensity   :   ir led intensity level
+ * @pwm_duty_on_ns     :   PWM duty cycle in ns for IRLED intensity
+ * @pwm_period_ns      :   PWM period in ns
+ * @brightness         :   IRLED brightness step for I2C control
+ *
+ */
+
+ struct cam_ir_led_set_on_off {
+       uint8_t     opcode;
+       uint8_t     cmd_type;
+       uint32_t    ir_led_intensity;
+       uint32_t    pwm_duty_on_ns;
+       uint32_t    pwm_period_ns;
+       uint8_t     brightness;
+} __attribute__((packed));
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_sync.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_sync.h
@@ -0,0 +1,238 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2016-2018, 2020 The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_SYNC_H__
+#define __UAPI_CAM_SYNC_H__
+
+#include <linux/videodev2.h>
+#include <linux/types.h>
+#include <linux/ioctl.h>
+#include <linux/media.h>
+
+#define CAM_SYNC_DEVICE_NAME                     "cam_sync_device"
+
+/* V4L event which user space will subscribe to */
+#define CAM_SYNC_V4L_EVENT                       (V4L2_EVENT_PRIVATE_START + 0)
+#define CAM_SYNC_V4L_EVENT_V2                    (V4L2_EVENT_PRIVATE_START + 1)
+
+/* Specific event ids to get notified in user space */
+#define CAM_SYNC_V4L_EVENT_ID_CB_TRIG            0
+
+/* Size of opaque payload sent to kernel for safekeeping until signal time */
+#define CAM_SYNC_USER_PAYLOAD_SIZE               2
+
+/* Device type for sync device needed for device discovery */
+#define CAM_SYNC_DEVICE_TYPE                     (MEDIA_ENT_F_OLD_BASE)
+
+#define CAM_SYNC_GET_PAYLOAD_PTR(ev, type)       \
+	(type *)((char *)ev.u.data + sizeof(struct cam_sync_ev_header))
+
+#define CAM_SYNC_GET_HEADER_PTR(ev)              \
+	((struct cam_sync_ev_header *)ev.u.data)
+
+#define CAM_SYNC_GET_PAYLOAD_PTR_V2(ev, type)       \
+	(type *)((char *)ev.u.data + sizeof(struct cam_sync_ev_header_v2))
+
+#define CAM_SYNC_GET_HEADER_PTR_V2(ev)              \
+	((struct cam_sync_ev_header_v2 *)ev.u.data)
+
+#define CAM_SYNC_STATE_INVALID                   0
+#define CAM_SYNC_STATE_ACTIVE                    1
+#define CAM_SYNC_STATE_SIGNALED_SUCCESS          2
+#define CAM_SYNC_STATE_SIGNALED_ERROR            3
+#define CAM_SYNC_STATE_SIGNALED_CANCEL           4
+
+/* Top level common sync event reason types */
+#define CAM_SYNC_COMMON_EVENT_START       0
+#define CAM_SYNC_COMMON_EVENT_UNUSED      (CAM_SYNC_COMMON_EVENT_START + 0)
+#define CAM_SYNC_COMMON_EVENT_SUCCESS     (CAM_SYNC_COMMON_EVENT_START + 1)
+#define CAM_SYNC_COMMON_EVENT_FLUSH       (CAM_SYNC_COMMON_EVENT_START + 2)
+#define CAM_SYNC_COMMON_EVENT_STOP        (CAM_SYNC_COMMON_EVENT_START + 3)
+#define CAM_SYNC_COMMON_EVENT_SYNX        (CAM_SYNC_COMMON_EVENT_START + 4)
+#define CAM_SYNC_COMMON_REG_PAYLOAD_EVENT (CAM_SYNC_COMMON_EVENT_START + 5)
+#define CAM_SYNC_COMMON_SYNC_SIGNAL_EVENT (CAM_SYNC_COMMON_EVENT_START + 6)
+#define CAM_SYNC_COMMON_RELEASE_EVENT     (CAM_SYNC_COMMON_EVENT_START + 7)
+#define CAM_SYNC_COMMON_EVENT_END         (CAM_SYNC_COMMON_EVENT_START + 50)
+
+/* ISP Sync event reason types */
+#define CAM_SYNC_ISP_EVENT_START          (CAM_SYNC_COMMON_EVENT_END + 1)
+#define CAM_SYNC_ISP_EVENT_UNKNOWN        (CAM_SYNC_ISP_EVENT_START + 0)
+#define CAM_SYNC_ISP_EVENT_BUBBLE         (CAM_SYNC_ISP_EVENT_START + 1)
+#define CAM_SYNC_ISP_EVENT_OVERFLOW       (CAM_SYNC_ISP_EVENT_START + 2)
+#define CAM_SYNC_ISP_EVENT_P2I_ERROR      (CAM_SYNC_ISP_EVENT_START + 3)
+#define CAM_SYNC_ISP_EVENT_VIOLATION      (CAM_SYNC_ISP_EVENT_START + 4)
+#define CAM_SYNC_ISP_EVENT_BUSIF_OVERFLOW (CAM_SYNC_ISP_EVENT_START + 5)
+#define CAM_SYNC_ISP_EVENT_FLUSH          (CAM_SYNC_ISP_EVENT_START + 6)
+#define CAM_SYNC_ISP_EVENT_HW_STOP        (CAM_SYNC_ISP_EVENT_START + 7)
+#define CAM_SYNC_ISP_EVENT_BAD_FRAME      (CAM_SYNC_ISP_EVENT_START + 8)
+#define CAM_SYNC_ISP_EVENT_END            (CAM_SYNC_ISP_EVENT_START + 50)
+
+/* ICP Sync event reason types */
+#define CAM_SYNC_ICP_EVENT_START                 (CAM_SYNC_ISP_EVENT_END + 1)
+#define CAM_SYNC_ICP_EVENT_UNKNOWN               (CAM_SYNC_ICP_EVENT_START + 0)
+#define CAM_SYNC_ICP_EVENT_FRAME_PROCESS_FAILURE (CAM_SYNC_ICP_EVENT_START + 1)
+#define CAM_SYNC_ICP_EVENT_CONFIG_ERR            (CAM_SYNC_ICP_EVENT_START + 2)
+#define CAM_SYNC_ICP_EVENT_END                   (CAM_SYNC_ICP_EVENT_START + 50)
+
+/* JPEG Sync event reason types */
+#define CAM_SYNC_JPEG_EVENT_START               (CAM_SYNC_ICP_EVENT_END + 1)
+#define CAM_SYNC_JPEG_EVENT_UNKNOWN             (CAM_SYNC_JPEG_EVENT_START + 0)
+#define CAM_SYNC_JPEG_EVENT_INVLD_CMD           (CAM_SYNC_JPEG_EVENT_START + 1)
+#define CAM_SYNC_JPEG_EVENT_SET_IRQ_CB          (CAM_SYNC_JPEG_EVENT_START + 2)
+#define CAM_SYNC_JPEG_EVENT_HW_RESET_FAILED     (CAM_SYNC_JPEG_EVENT_START + 3)
+#define CAM_SYNC_JPEG_EVENT_CDM_CHANGE_BASE_ERR (CAM_SYNC_JPEG_EVENT_START + 4)
+#define CAM_SYNC_JPEG_EVENT_CDM_CONFIG_ERR      (CAM_SYNC_JPEG_EVENT_START + 5)
+#define CAM_SYNC_JPEG_EVENT_START_HW_ERR        (CAM_SYNC_JPEG_EVENT_START + 6)
+#define CAM_SYNC_JPEG_EVENT_END                 (CAM_SYNC_JPEG_EVENT_START + 50)
+
+/* FD Sync event reason types */
+#define CAM_SYNC_FD_EVENT_START           (CAM_SYNC_JPEG_EVENT_END + 1)
+#define CAM_SYNC_FD_EVENT_UNKNOWN         (CAM_SYNC_FD_EVENT_START + 0)
+#define CAM_SYNC_FD_EVENT_IRQ_FRAME_DONE  (CAM_SYNC_FD_EVENT_START + 1)
+#define CAM_SYNC_FD_EVENT_IRQ_RESET_DONE  (CAM_SYNC_FD_EVENT_START + 2)
+#define CAM_SYNC_FD_EVENT_HALT            (CAM_SYNC_FD_EVENT_START + 3)
+#define CAM_SYNC_FD_EVENT_END             (CAM_SYNC_FD_EVENT_START + 50)
+
+/* LRME Sync event reason types */
+#define CAM_SYNC_LRME_EVENT_START           (CAM_SYNC_FD_EVENT_END + 1)
+#define CAM_SYNC_LRME_EVENT_UNKNOWN         (CAM_SYNC_LRME_EVENT_START + 0)
+#define CAM_SYNC_LRME_EVENT_CB_ERROR        (CAM_SYNC_LRME_EVENT_START + 1)
+#define CAM_SYNC_LRME_EVENT_END             (CAM_SYNC_LRME_EVENT_START + 50)
+
+/* OPE Sync event reason types */
+#define CAM_SYNC_OPE_EVENT_START              (CAM_SYNC_LRME_EVENT_END + 1)
+#define CAM_SYNC_OPE_EVENT_UNKNOWN            (CAM_SYNC_OPE_EVENT_START + 0)
+#define CAM_SYNC_OPE_EVENT_PAGE_FAULT         (CAM_SYNC_OPE_EVENT_START + 1)
+#define CAM_SYNC_OPE_EVENT_HW_HANG            (CAM_SYNC_OPE_EVENT_START + 2)
+#define CAM_SYNC_OPE_EVENT_HALT               (CAM_SYNC_OPE_EVENT_START + 3)
+#define CAM_SYNC_OPE_EVENT_CONFIG_ERR         (CAM_SYNC_OPE_EVENT_START + 4)
+#define CAM_SYNC_OPE_EVENT_HW_FLUSH           (CAM_SYNC_OPE_EVENT_START + 5)
+#define CAM_SYNC_OPE_EVENT_HW_RESUBMIT        (CAM_SYNC_OPE_EVENT_START + 6)
+#define CAM_SYNC_OPE_EVENT_HW_RESET_DONE      (CAM_SYNC_OPE_EVENT_START + 7)
+#define CAM_SYNC_OPE_EVENT_HW_ERROR           (CAM_SYNC_OPE_EVENT_START + 8)
+#define CAM_SYNC_OPE_EVENT_INVLD_CMD          (CAM_SYNC_OPE_EVENT_START + 9)
+#define CAM_SYNC_OPE_EVENT_HW_RESET_FAILED    (CAM_SYNC_OPE_EVENT_START + 10)
+#define CAM_SYNC_OPE_EVENT_END                (CAM_SYNC_OPE_EVENT_START + 50)
+
+#define CAM_SYNC_EVENT_CNT                7
+#define CAM_SYNC_EVENT_REASON_CODE_INDEX  0
+
+
+/**
+ * struct cam_sync_ev_header - Event header for sync event notification
+ *
+ * @sync_obj: Sync object
+ * @status:   Status of the object
+ */
+struct cam_sync_ev_header {
+	__s32 sync_obj;
+	__s32 status;
+};
+
+/**
+ * struct cam_sync_ev_header_v2 - Event header for sync event notification
+ *
+ * @sync_obj:    Sync object
+ * @status:      Status of the object
+ * @version:     sync driver version
+ * @evt_param:   event parameter
+ */
+struct cam_sync_ev_header_v2 {
+	__s32 sync_obj;
+	__s32 status;
+	uint32_t version;
+	uint32_t evt_param[CAM_SYNC_EVENT_CNT];
+};
+
+/**
+ * struct cam_sync_info - Sync object creation information
+ *
+ * @name:       Optional string representation of the sync object
+ * @sync_obj:   Sync object returned after creation in kernel
+ */
+struct cam_sync_info {
+	char  name[64];
+	__s32 sync_obj;
+};
+
+/**
+ * struct cam_sync_signal - Sync object signaling struct
+ *
+ * @sync_obj:   Sync object to be signaled
+ * @sync_state: State of the sync object to which it should be signaled
+ */
+struct cam_sync_signal {
+	__s32 sync_obj;
+	__u32 sync_state;
+};
+
+/**
+ * struct cam_sync_merge - Merge information for sync objects
+ *
+ * @sync_objs:  Pointer to sync objects
+ * @num_objs:   Number of objects in the array
+ * @merged:     Merged sync object
+ */
+struct cam_sync_merge {
+	__u64 sync_objs;
+	__u32 num_objs;
+	__s32 merged;
+};
+
+/**
+ * struct cam_sync_userpayload_info - Payload info from user space
+ *
+ * @sync_obj:   Sync object for which payload has to be registered for
+ * @reserved:   Reserved
+ * @payload:    Pointer to user payload
+ */
+struct cam_sync_userpayload_info {
+	__s32 sync_obj;
+	__u32 reserved;
+	__u64 payload[CAM_SYNC_USER_PAYLOAD_SIZE];
+};
+
+/**
+ * struct cam_sync_wait - Sync object wait information
+ *
+ * @sync_obj:   Sync object to wait on
+ * @reserved:   Reserved
+ * @timeout_ms: Timeout in milliseconds
+ */
+struct cam_sync_wait {
+	__s32    sync_obj;
+	__u32    reserved;
+	uint64_t timeout_ms;
+};
+
+/**
+ * struct cam_private_ioctl_arg - Sync driver ioctl argument
+ *
+ * @id:         IOCTL command id
+ * @size:       Size of command payload
+ * @result:     Result of command execution
+ * @reserved:   Reserved
+ * @ioctl_ptr:  Pointer to user data
+ */
+struct cam_private_ioctl_arg {
+	__u32 id;
+	__u32 size;
+	__u32 result;
+	__u32 reserved;
+	__u64 ioctl_ptr;
+};
+
+#define CAM_PRIVATE_IOCTL_CMD \
+	_IOWR('V', BASE_VIDIOC_PRIVATE, struct cam_private_ioctl_arg)
+
+#define CAM_SYNC_CREATE                          0
+#define CAM_SYNC_DESTROY                         1
+#define CAM_SYNC_SIGNAL                          2
+#define CAM_SYNC_MERGE                           3
+#define CAM_SYNC_REGISTER_PAYLOAD                4
+#define CAM_SYNC_DEREGISTER_PAYLOAD              5
+#define CAM_SYNC_WAIT                            6
+
+#endif /* __UAPI_CAM_SYNC_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_tfe.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/camera_kt/include/uapi/camera/media/cam_tfe.h
@@ -0,0 +1,412 @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __UAPI_CAM_TFE_H__
+#define __UAPI_CAM_TFE_H__
+
+#include <media/cam_defs.h>
+#include <media/cam_isp_tfe.h>
+#include <media/cam_cpas.h>
+
+
+/* ISP TFE driver name */
+#define CAM_ISP_TFE_DEV_NAME                        "cam-isp"
+
+/* HW type */
+#define CAM_ISP_TFE_HW_BASE                         0
+#define CAM_ISP_TFE_HW_CSID                         1
+#define CAM_ISP_TFE_HW_TFE                          2
+#define CAM_ISP_TFE_HW_MAX                          3
+
+/* Color Pattern */
+#define CAM_ISP_TFE_PATTERN_BAYER_RGRGRG            0
+#define CAM_ISP_TFE_PATTERN_BAYER_GRGRGR            1
+#define CAM_ISP_TFE_PATTERN_BAYER_BGBGBG            2
+#define CAM_ISP_TFE_PATTERN_BAYER_GBGBGB            3
+#define CAM_ISP_TFE_PATTERN_YUV_YCBYCR              4
+#define CAM_ISP_TFE_PATTERN_YUV_YCRYCB              5
+#define CAM_ISP_TFE_PATTERN_YUV_CBYCRY              6
+#define CAM_ISP_TFE_PATTERN_YUV_CRYCBY              7
+#define CAM_ISP_TFE_PATTERN_MAX                     8
+
+/* Usage Type */
+#define CAM_ISP_TFE_IN_RES_USAGE_SINGLE             0
+#define CAM_ISP_TFE_IN_RES_USAGE_DUAL               1
+#define CAM_ISP_TFE_IN_RES_USAGE_MAX                2
+
+/* Resource ID */
+#define CAM_ISP_TFE_RES_ID_PORT                     0
+#define CAM_ISP_TFE_RES_ID_MAX                      1
+
+/* Resource Type - Type of resource for the resource id
+ * defined in cam_isp_tfe.h
+ */
+
+/* Lane Type in input resource for Port */
+#define CAM_ISP_TFE_IN_LANE_TYPE_DPHY               0
+#define CAM_ISP_TFE_IN_LANE_TYPE_CPHY               1
+#define CAM_ISP_TFE_IN_LANE_TYPE_MAX                2
+
+/* ISP TFE packet opcode */
+#define CAM_ISP_TFE_PACKET_OP_BASE                  0
+#define CAM_ISP_TFE_PACKET_INIT_DEV                 1
+#define CAM_ISP_TFE_PACKET_CONFIG_DEV               2
+#define CAM_ISP_TFE_PACKET_OP_MAX                   3
+
+/* ISP TFE packet meta_data type for command buffer */
+#define CAM_ISP_TFE_PACKET_META_BASE                  0
+#define CAM_ISP_TFE_PACKET_META_LEFT                  1
+#define CAM_ISP_TFE_PACKET_META_RIGHT                 2
+#define CAM_ISP_TFE_PACKET_META_COMMON                3
+#define CAM_ISP_TFE_PACKET_META_DUAL_CONFIG           4
+#define CAM_ISP_TFE_PACKET_META_GENERIC_BLOB_COMMON   5
+#define CAM_ISP_TFE_PACKET_META_REG_DUMP_PER_REQUEST  6
+#define CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_FLUSH     7
+#define CAM_ISP_TFE_PACKET_META_REG_DUMP_ON_ERROR     8
+
+/* ISP TFE Generic Cmd Buffer Blob types */
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_HFR_CONFIG          0
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_CLOCK_CONFIG        1
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_BW_CONFIG_V2        2
+#define CAM_ISP_TFE_GENERIC_BLOB_TYPE_CSID_CLOCK_CONFIG   3
+
+/* DSP mode */
+#define CAM_ISP_TFE_DSP_MODE_NONE                   0
+#define CAM_ISP_TFE_DSP_MODE_ONE_WAY                1
+#define CAM_ISP_TFE_DSP_MODE_ROUND                  2
+
+/* Per Path Usage Data */
+#define CAM_ISP_TFE_USAGE_INVALID     0
+#define CAM_ISP_TFE_USAGE_LEFT_PX     1
+#define CAM_ISP_TFE_USAGE_RIGHT_PX    2
+#define CAM_ISP_TFE_USAGE_RDI         3
+
+/* Bus write master modes */
+#define CAM_ISP_TFE_WM_FRAME_BASED_MODE    0
+#define CAM_ISP_TFE_WM_LINE_BASED_MODE     1
+#define CAM_ISP_TFE_WM_INDEX_BASED_MODE    2
+
+/* Query devices */
+/**
+ * struct cam_isp_tfe_dev_cap_info - A cap info for particular hw type
+ *
+ * @hw_type:            Hardware type for the cap info
+ * @reserved:           reserved field for alignment
+ * @hw_version:         Hardware version
+ *
+ */
+struct cam_isp_tfe_dev_cap_info {
+	__u32                 hw_type;
+	__u32                 reserved;
+	struct cam_hw_version hw_version;
+};
+
+/**
+ * struct cam_isp_tfe_query_cap_cmd - ISP TFE query device
+ * capability payload
+ *
+ * @device_iommu:               returned iommu handles for device
+ * @cdm_iommu:                  returned iommu handles for cdm
+ * @num_dev:                    returned number of device capabilities
+ * @reserved:                   reserved field for alignment
+ * @dev_caps:                   returned device capability array
+ *
+ */
+struct cam_isp_tfe_query_cap_cmd {
+	struct cam_iommu_handle         device_iommu;
+	struct cam_iommu_handle         cdm_iommu;
+	__s32                           num_dev;
+	__u32                           reserved;
+	struct cam_isp_tfe_dev_cap_info dev_caps[CAM_ISP_TFE_HW_MAX];
+};
+
+/* Acquire Device */
+/**
+ * struct cam_isp_tfe_out_port_info - An output port resource info
+ *
+ * @res_id:                     output resource id defined in file
+ *                              cam_isp_tfe.h
+ * @format:                     output format of the resource
+ * @width:                      output width in pixels
+ * @height:                     output height in lines
+ * @stride:                     output stride
+ * @comp_grp_id:                composite group id for the resource.
+ * @secure_mode:                flag to tell if output should be run in secure
+ *                              mode or not. See cam_defs.h for definition
+ * @wm_mode:                    wm mode
+ * @reserved:                   reserved field for alignment
+ *
+ */
+struct cam_isp_tfe_out_port_info {
+	__u32                res_id;
+	__u32                format;
+	__u32                width;
+	__u32                height;
+	__u32                stride;
+	__u32                comp_grp_id;
+	__u32                secure_mode;
+	__u32                wm_mode;
+	__u32                reserved;
+};
+
+/**
+ * struct cam_isp_tfe_in_port_info - An input port resource info
+ *
+ * @res_id:                     input resource id CAM_ISP_TFE_IN_RES_XXX
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @format:                     input format
+ * @pix_pattern:                pixel pattern
+ * @usage_type:                 whether dual tfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_end:                   left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ *                              Only for Dual TFE
+ * @right_end:                  right input stop offset in
+ *                              pixels. Only for Dual TFE
+ * @right_width:                right input width in pixels.
+ *                              Only for dual TFE
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @batch_size:                 batch size for HFR mode
+ * @dsp_mode:                   DSP stream mode(Defines as
+ *                               CAM_ISP_TFE_DSP_MODE_*)
+ * @sensor_width:               sensor width
+ * @sensor_height:              sensor height
+ * @hbi_value:                  sensor HBI value
+ * @vbi_value:                  sensor VBI value
+ * @sensor_fps:                 sensor fps
+ * @init_frame_drop             init frame drop value.
+ * @num_out_res:                number of the output resource associated
+ * @data:                       payload that contains the output resources,
+ *                              array of cam_isp_tfe_out_port_info data
+ *
+ */
+struct cam_isp_tfe_in_port_info {
+	__u32                            res_id;
+	__u32                            lane_type;
+	__u32                            lane_num;
+	__u32                            lane_cfg;
+	__u32                            vc;
+	__u32                            dt;
+	__u32                            format;
+	__u32                            pix_pattern;
+	__u32                            usage_type;
+	__u32                            left_start;
+	__u32                            left_end;
+	__u32                            left_width;
+	__u32                            right_start;
+	__u32                            right_end;
+	__u32                            right_width;
+	__u32                            line_start;
+	__u32                            line_end;
+	__u32                            height;
+	__u32                            batch_size;
+	__u32                            dsp_mode;
+	__u32                            sensor_width;
+	__u32                            sensor_height;
+	__u32                            sensor_hbi;
+	__u32                            sensor_vbi;
+	__u32                            sensor_fps;
+	__u32                            init_frame_drop;
+	__u32                            num_out_res;
+    union {
+        struct cam_isp_tfe_out_port_info data[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_tfe_out_port_info, data_flex);
+    };
+};
+
+/**
+ * struct cam_isp_tfe_resource - A resource bundle
+ *
+ * @resoruce_id:                resource id for the resource bundle
+ * @length:                     length of the while resource blob
+ * @handle_type:                type of the resource handle
+ * @reserved:                   reserved field for alignment
+ * @res_hdl:                    resource handle that points to the
+ *                              resource array
+ *
+ */
+struct cam_isp_tfe_resource {
+	__u32                       resource_id;
+	__u32                       length;
+	__u32                       handle_type;
+	__u32                       reserved;
+	__u64                       res_hdl;
+};
+
+/**
+ * struct cam_isp_tfe_port_hfr_config - HFR configuration for
+ * this port
+ *
+ * @resource_type:              Resource type
+ * @subsample_pattern:          Subsample pattern. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @subsample_period:           Subsample period. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @framedrop_pattern:          Framedrop pattern
+ * @framedrop_period:           Framedrop period
+ * @reserved:                   Reserved for alignment
+ */
+struct cam_isp_tfe_port_hfr_config {
+	__u32                       resource_type;
+	__u32                       subsample_pattern;
+	__u32                       subsample_period;
+	__u32                       framedrop_pattern;
+	__u32                       framedrop_period;
+	__u32                       reserved;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_resource_hfr_config - Resource HFR
+ * configuration
+ *
+ * @num_ports:                  Number of ports
+ * @reserved:                   Reserved for alignment
+ * @port_hfr_config:            HFR configuration for each IO port
+ */
+struct cam_isp_tfe_resource_hfr_config {
+	__u32                              num_ports;
+	__u32                              reserved;
+    union {
+        struct cam_isp_tfe_port_hfr_config port_hfr_config[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_tfe_port_hfr_config, port_hfr_config_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_dual_stripe_config - stripe config per bus
+ * client
+ *
+ * @offset:                     Start horizontal offset relative to
+ *                              output buffer
+ * @width:                      Width of the stripe in pixels
+ * @port_id:                    Port id of ISP TFE output
+ * @reserved:                   Reserved for alignment
+ *
+ */
+struct cam_isp_tfe_dual_stripe_config {
+	__u32                       offset;
+	__u32                       width;
+	__u32                       port_id;
+	__u32                       reserved;
+};
+
+/**
+ * struct cam_isp_tfe_dual_config - dual isp configuration
+ *
+ * @num_ports                   Number of isp output ports
+ * @reserved                    Reserved field for alignment
+ * @stripes:                    Stripe information
+ *
+ */
+struct cam_isp_tfe_dual_config {
+	__u32                                 num_ports;
+    __u32                                 reserved;
+    union {
+        struct cam_isp_tfe_dual_stripe_config stripes[1];
+        __DECLARE_FLEX_ARRAY(struct cam_isp_tfe_dual_stripe_config, stripes_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_clock_config - Clock configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_rdi:                    Number of RDI votes
+ * @left_pix_hz:                Pixel Clock for Left ISP
+ * @right_pix_hz:               Pixel Clock for Right ISP
+ *                              valid only if Dual
+ * @rdi_hz:                     RDI Clock. ISP TFE clock will be
+ *                              max of RDI and PIX clocks. For a
+ *                              particular context which ISP TFE
+ *                              HW the RDI is allocated to is
+ *                              not known to UMD. Hence pass the
+ *                              clock and let KMD decide.
+ */
+struct cam_isp_tfe_clock_config {
+	__u32                       usage_type;
+	__u32                       num_rdi;
+	__u64                       left_pix_hz;
+	__u64                       right_pix_hz;
+    union {
+        __u64                   rdi_hz[1];
+        __DECLARE_FLEX_ARRAY(__u64, rdi_hz_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_csid_clock_config - CSID clock
+ * configuration
+ *
+ * @csid_clock                  CSID clock
+ * @csi_phy_clock               Phy clock valid if tpg is selected
+ */
+struct cam_isp_tfe_csid_clock_config {
+	__u64                       csid_clock;
+	__u64                       phy_clock;
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_tfe_bw_config_v2 - Bandwidth configuration
+ *
+ * @usage_type:                 Usage type (Single/Dual)
+ * @num_paths:                  Number of axi data paths
+ * @axi_path                    Per path vote info
+ */
+struct cam_isp_tfe_bw_config_v2 {
+	__u32                             usage_type;
+	__u32                             num_paths;
+    union {
+        struct cam_axi_per_path_bw_vote   axi_path[1];
+        __DECLARE_FLEX_ARRAY(struct cam_axi_per_path_bw_vote, axi_path_flex);
+    };
+} __attribute__((packed));
+
+/**
+ * struct cam_isp_acquire_hw_info - ISP TFE acquire HW params
+ *
+ * @common_info_version  : Version of common info struct used
+ * @common_info_size     : Size of common info struct used
+ * @common_info_offset   : Offset of common info from start of data
+ * @num_inputs           : Number of inputs
+ * @input_info_version   : Version of input info struct used
+ * @input_info_size      : Size of input info struct used
+ * @input_info_offset    : Offset of input info from start of data
+ * @data                 : Data pointer to point the cam_isp_tfe_in_port_info
+ *                         structure
+ */
+struct cam_isp_tfe_acquire_hw_info {
+	__u16                common_info_version;
+	__u16                common_info_size;
+	__u32                common_info_offset;
+	__u32                num_inputs;
+	__u32                input_info_version;
+	__u32                input_info_size;
+	__u32                input_info_offset;
+	__u64                data;
+};
+
+#define CAM_TFE_ACQUIRE_COMMON_VER0         0x1000
+
+#define CAM_TFE_ACQUIRE_COMMON_SIZE_VER0    0x0
+
+#define CAM_TFE_ACQUIRE_INPUT_VER0          0x2000
+
+#define CAM_TFE_ACQUIRE_INPUT_SIZE_VER0 sizeof(struct cam_isp_tfe_in_port_info)
+
+#define CAM_TFE_ACQUIRE_OUT_VER0            0x3000
+
+#define CAM_TFE_ACQUIRE_OUT_SIZE_VER0  sizeof(struct cam_isp_tfe_out_port_info)
+
+#endif /* __UAPI_CAM_TFE_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_common_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_common_util.c
@@ -0,0 +1,895 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2019, 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/timer.h>
+#include <linux/completion.h>
+#include <linux/module.h>
+#include <linux/iopoll.h>
+#include <linux/moduleparam.h>
+
+#include <media/cam_req_mgr.h>
+
+#include "cam_common_util.h"
+#include "cam_debug_util.h"
+#include "cam_hw.h"
+
+#if IS_REACHABLE(CONFIG_QCOM_VA_MINIDUMP)
+#include <soc/qcom/minidump.h>
+static struct cam_common_mini_dump_dev_info g_minidump_dev_info;
+#endif
+
+#define CAM_PRESIL_POLL_DELAY 20
+
+static struct cam_common_inject_evt_info g_inject_evt_info;
+
+static uint timeout_multiplier = 1;
+module_param(timeout_multiplier, uint, 0644);
+typedef int (*cam_common_evt_inject_cmd_parse_handler)(
+	struct cam_common_inject_evt_param *inject_params,
+	uint32_t param_counter, char *token);
+
+int cam_common_util_get_string_index(const char **strings,
+	uint32_t num_strings, const char *matching_string, uint32_t *index)
+{
+	int i;
+
+	for (i = 0; i < num_strings; i++) {
+		if (strnstr(strings[i], matching_string, strlen(strings[i]))) {
+			CAM_DBG(CAM_UTIL, "matched %s : %d\n",
+				matching_string, i);
+			*index = i;
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+uint32_t cam_common_util_remove_duplicate_arr(int32_t *arr, uint32_t num)
+{
+	int i, j;
+	uint32_t wr_idx = 1;
+
+	if (!arr) {
+		CAM_ERR(CAM_UTIL, "Null input array");
+		return 0;
+	}
+
+	for (i = 1; i < num; i++) {
+		for (j = 0; j < wr_idx ; j++) {
+			if (arr[i] == arr[j])
+				break;
+		}
+		if (j == wr_idx)
+			arr[wr_idx++] = arr[i];
+	}
+
+	return wr_idx;
+}
+
+unsigned long cam_common_wait_for_completion_timeout(
+	struct completion   *complete,
+	unsigned long        timeout_jiffies)
+{
+	unsigned long wait_jiffies;
+	unsigned long rem_jiffies;
+
+	if (!complete) {
+		CAM_ERR(CAM_UTIL, "Null complete pointer");
+		return 0;
+	}
+
+	if (timeout_multiplier < 1)
+		timeout_multiplier = 1;
+
+	wait_jiffies = timeout_jiffies * timeout_multiplier;
+	rem_jiffies = wait_for_completion_timeout(complete, wait_jiffies);
+
+	return rem_jiffies;
+}
+
+int cam_common_read_poll_timeout(
+	void __iomem        *addr,
+	unsigned long        delay,
+	unsigned long        timeout,
+	uint32_t             mask,
+	uint32_t             check_val,
+	uint32_t            *status)
+{
+	unsigned long wait_time_us;
+	int rc = -EINVAL;
+
+	if (!addr || !status) {
+		CAM_ERR(CAM_UTIL, "Invalid param addr: %pK status: %pK",
+			addr, status);
+		return rc;
+	}
+
+	if (timeout_multiplier < 1)
+		timeout_multiplier = 1;
+
+	wait_time_us = timeout * timeout_multiplier;
+
+	rc = readl_poll_timeout(addr, *status, (*status & mask) == check_val, delay,
+		wait_time_us);
+
+	return rc;
+}
+
+int cam_common_modify_timer(struct timer_list *timer, int32_t timeout_val)
+{
+	if (!timer) {
+		CAM_ERR(CAM_UTIL, "Invalid reference to system timer");
+		return -EINVAL;
+	}
+
+	if (timeout_multiplier < 1)
+		timeout_multiplier = 1;
+
+	CAM_DBG(CAM_UTIL, "Starting timer to fire in %d ms. (jiffies=%lu)\n",
+		(timeout_val * timeout_multiplier), jiffies);
+	mod_timer(timer,
+		(jiffies + msecs_to_jiffies(timeout_val * timeout_multiplier)));
+
+	return 0;
+}
+
+#ifdef CONFIG_SPECTRA_KT
+
+void cam_common_util_thread_switch_delay_detect(
+	const char *token, ktime_t scheduled_time, uint32_t threshold)
+{
+	uint64_t                         diff;
+	ktime_t                          cur_time;
+	struct timespec64                cur_ts;
+	struct timespec64                scheduled_ts;
+
+	cur_time = ktime_get();
+	diff = ktime_ms_delta(cur_time, scheduled_time);
+
+	if (diff > threshold) {
+		scheduled_ts  = ktime_to_timespec64(scheduled_time);
+		cur_ts = ktime_to_timespec64(cur_time);
+		CAM_WARN_RATE_LIMIT_CUSTOM(CAM_UTIL, 1, 1,
+			"%s delay detected %lld:%06ld cur %lld:%06ld diff %lld: threshold %d",
+			token, scheduled_ts.tv_sec,
+			scheduled_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec, cur_ts.tv_nsec/NSEC_PER_USEC,
+			diff, threshold);
+	}
+}
+
+#else
+
+void cam_common_util_thread_switch_delay_detect(char *wq_name, const char *state,
+	void *cb, ktime_t scheduled_time, uint32_t threshold)
+{
+	uint64_t                         diff;
+	ktime_t                          cur_time;
+	struct timespec64                cur_ts;
+	struct timespec64                scheduled_ts;
+
+	cur_time = ktime_get();
+	diff = ktime_ms_delta(cur_time, scheduled_time);
+
+	if (diff > threshold) {
+		scheduled_ts  = ktime_to_timespec64(scheduled_time);
+		cur_ts = ktime_to_timespec64(cur_time);
+		CAM_WARN_RATE_LIMIT_CUSTOM(CAM_UTIL, 1, 1,
+			"%s cb: %ps delay in %s detected %ld:%06ld cur %ld:%06ld\n"
+			"diff %ld: threshold %d",
+			wq_name, cb, state, scheduled_ts.tv_sec,
+			scheduled_ts.tv_nsec/NSEC_PER_USEC,
+			cur_ts.tv_sec, cur_ts.tv_nsec/NSEC_PER_USEC,
+			diff, threshold);
+	}
+}
+
+#endif /* ifdef CONFIG_SPECTRA_KT */
+
+#if IS_REACHABLE(CONFIG_QCOM_VA_MINIDUMP)
+static void cam_common_mini_dump_handler(void *dst, unsigned long len)
+{
+	int                               i = 0;
+	uint8_t                          *waddr;
+	unsigned long                     bytes_written = 0;
+	unsigned long                     remain_len = len;
+	struct cam_common_mini_dump_data *md;
+
+	if (len < sizeof(*md)) {
+	    CAM_WARN(CAM_UTIL, "Insufficient len %lu", len);
+	    return;
+	}
+
+	md = (struct cam_common_mini_dump_data *)dst;
+	waddr = (uint8_t *)md + sizeof(*md);
+	remain_len -= sizeof(*md);
+
+	for (i = 0; i < CAM_COMMON_MINI_DUMP_DEV_NUM; i++) {
+		if (!g_minidump_dev_info.dump_cb[i])
+			continue;
+
+		memcpy(md->name[i], g_minidump_dev_info.name[i],
+			strlen(g_minidump_dev_info.name[i]));
+		md->waddr[i] = (void *)waddr;
+		bytes_written = g_minidump_dev_info.dump_cb[i](
+			(void *)waddr, remain_len, g_minidump_dev_info.priv_data[i]);
+		md->size[i] = bytes_written;
+		if (bytes_written >= len) {
+			CAM_WARN(CAM_UTIL, "No more space to dump");
+			goto nomem;
+		}
+
+		remain_len -= bytes_written;
+		waddr += bytes_written;
+	}
+
+	return;
+nomem:
+    for (; i >=0; i--)
+	    CAM_WARN(CAM_UTIL, "%s: Dumped len: %lu", md->name[i], md->size[i]);
+}
+
+static int cam_common_md_notify_handler(struct notifier_block *this,
+	unsigned long event, void *ptr)
+{
+	struct va_md_entry cbentry;
+	int rc = 0;
+
+	cbentry.vaddr = 0x0;
+	strlcpy(cbentry.owner, "Camera", sizeof(cbentry.owner));
+	cbentry.size = CAM_COMMON_MINI_DUMP_SIZE;
+	cbentry.cb = cam_common_mini_dump_handler;
+	rc = qcom_va_md_add_region(&cbentry);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Va Region add falied %d", rc);
+		return NOTIFY_STOP_MASK;
+	}
+
+	return NOTIFY_OK;
+}
+
+static struct notifier_block cam_common_md_notify_blk = {
+	.notifier_call = cam_common_md_notify_handler,
+	.priority = INT_MAX,
+};
+
+int cam_common_register_mini_dump_cb(
+	cam_common_mini_dump_cb mini_dump_cb,
+	uint8_t *dev_name, void *priv_data)
+{
+	int rc = 0;
+	uint32_t idx;
+
+	if (g_minidump_dev_info.num_devs >= CAM_COMMON_MINI_DUMP_DEV_NUM) {
+		CAM_ERR(CAM_UTIL, "No free index available");
+		return -EINVAL;
+	}
+
+	if (!mini_dump_cb || !dev_name) {
+		CAM_ERR(CAM_UTIL, "Invalid params");
+		return -EINVAL;
+	}
+
+	idx = g_minidump_dev_info.num_devs;
+	g_minidump_dev_info.dump_cb[idx] =
+		mini_dump_cb;
+	scnprintf(g_minidump_dev_info.name[idx],
+		CAM_COMMON_MINI_DUMP_DEV_NAME_LEN, dev_name);
+	g_minidump_dev_info.priv_data[idx] = priv_data;
+	g_minidump_dev_info.num_devs++;
+	if (!g_minidump_dev_info.is_registered) {
+		rc = qcom_va_md_register("Camera", &cam_common_md_notify_blk);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Camera VA minidump register failed");
+			goto end;
+		}
+		g_minidump_dev_info.is_registered = true;
+	}
+end:
+	return rc;
+}
+#endif
+
+void *cam_common_user_dump_clock(
+	void *dump_struct, uint8_t *addr_ptr)
+{
+	struct cam_hw_info  *hw_info = NULL;
+	uint64_t            *addr = NULL;
+
+	hw_info = (struct cam_hw_info *)dump_struct;
+
+	if (!hw_info || !addr_ptr) {
+		CAM_ERR(CAM_ISP, "HW info or address pointer NULL");
+		return addr;
+	}
+
+	addr = (uint64_t *)addr_ptr;
+	*addr++ = cam_soc_util_get_applied_src_clk(&hw_info->soc_info, true);
+
+	return addr;
+}
+
+int cam_common_user_dump_helper(
+	void *cmd_args,
+	void *(*func)(void *dump_struct, uint8_t *addr_ptr),
+	void *dump_struct,
+	size_t size,
+	const char *tag, ...)
+{
+
+	uint8_t                                   *dst;
+	uint8_t                                   *addr, *start;
+	void                                      *returned_ptr;
+	struct cam_common_hw_dump_args            *dump_args;
+	struct cam_common_hw_dump_header          *hdr;
+	va_list                                    args;
+	void*(*func_ptr)(void *dump_struct, uint8_t *addr_ptr);
+
+	dump_args = (struct cam_common_hw_dump_args *)cmd_args;
+	if (!dump_args->cpu_addr || !dump_args->buf_len) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid params %pK %zu",
+			(void *)dump_args->cpu_addr,
+			dump_args->buf_len);
+		return -EINVAL;
+	}
+	if (dump_args->buf_len <= dump_args->offset) {
+		CAM_WARN(CAM_UTIL,
+			"Dump offset overshoot offset %zu buf_len %zu",
+			dump_args->offset, dump_args->buf_len);
+		return -ENOSPC;
+	}
+
+	dst = (uint8_t *)dump_args->cpu_addr + dump_args->offset;
+	hdr = (struct cam_common_hw_dump_header *)dst;
+
+	va_start(args, tag);
+	vscnprintf(hdr->tag, CAM_COMMON_HW_DUMP_TAG_MAX_LEN, tag, args);
+	va_end(args);
+
+	hdr->word_size = size;
+
+	addr = (uint8_t *)(dst + sizeof(struct cam_common_hw_dump_header));
+	start = addr;
+
+	func_ptr = func;
+	returned_ptr = func_ptr(dump_struct, addr);
+
+	if (IS_ERR(returned_ptr))
+		return PTR_ERR(returned_ptr);
+
+	addr = (uint8_t *)returned_ptr;
+	hdr->size = addr - start;
+	CAM_DBG(CAM_UTIL, "hdr size: %d, word size: %d, addr: %x, start: %x",
+		hdr->size, hdr->word_size, addr, start);
+	dump_args->offset += hdr->size +
+		sizeof(struct cam_common_hw_dump_header);
+
+	return 0;
+}
+
+int cam_common_register_evt_inject_cb(cam_common_evt_inject_cb evt_inject_cb,
+	enum cam_common_evt_inject_hw_id hw_id)
+{
+	int rc = 0;
+
+	if (g_inject_evt_info.num_hw_registered >= CAM_COMMON_EVT_INJECT_HW_MAX) {
+		CAM_ERR(CAM_UTIL, "No free index available");
+		return -EINVAL;
+	}
+
+	if (!evt_inject_cb || hw_id >= CAM_COMMON_EVT_INJECT_HW_MAX) {
+		CAM_ERR(CAM_UTIL, "Invalid params evt_inject_cb %s hw_id: %d",
+			CAM_IS_NULL_TO_STR(evt_inject_cb), hw_id);
+		return -EINVAL;
+	}
+
+	g_inject_evt_info.evt_inject_cb[hw_id] = evt_inject_cb;
+	g_inject_evt_info.num_hw_registered++;
+	CAM_DBG(CAM_UTIL, "Evt inject cb registered for HW_id: %d, total registered: %d", hw_id,
+		g_inject_evt_info.num_hw_registered);
+	return rc;
+}
+
+void cam_common_release_evt_params(int32_t dev_hdl)
+{
+	struct list_head *pos = NULL, *pos_next = NULL;
+	struct cam_common_inject_evt_param *inject_params;
+
+	if (!g_inject_evt_info.is_list_initialised)
+		return;
+
+	if (list_empty(&g_inject_evt_info.active_evt_ctx_list)) {
+		CAM_DBG(CAM_UTIL, "Event injection list is initialized but empty");
+		return;
+	}
+
+	list_for_each_safe(pos, pos_next, &g_inject_evt_info.active_evt_ctx_list) {
+		inject_params = list_entry(pos, struct cam_common_inject_evt_param, list);
+		if (inject_params->dev_hdl == dev_hdl) {
+			CAM_INFO(CAM_UTIL, "entry deleted for %d dev hdl", dev_hdl);
+			list_del(pos);
+			kfree(inject_params);
+		}
+	}
+}
+
+static inline int cam_common_evt_inject_get_hw_id(uint8_t *hw_id, char *token)
+{
+	if (strcmp(token, CAM_COMMON_IFE_NODE) == 0)
+		*hw_id = CAM_COMMON_EVT_INJECT_HW_IFE;
+	else if (strcmp(token, CAM_COMMON_TFE_NODE) == 0)
+		*hw_id = CAM_COMMON_EVT_INJECT_HW_TFE;
+	else if (strcmp(token, CAM_COMMON_ICP_NODE) == 0)
+		*hw_id = CAM_COMMON_EVT_INJECT_HW_ICP;
+	else if (strcmp(token, CAM_COMMON_JPEG_NODE) == 0)
+		*hw_id = CAM_COMMON_EVT_INJECT_HW_JPEG;
+	else {
+		CAM_ERR(CAM_UTIL, "Invalid camera hardware [ %s ]", token);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static inline int cam_common_evt_inject_get_str_id_type(uint8_t *id_type, char *token)
+{
+	if (!strcmp(token, CAM_COMMON_EVT_INJECT_BUFFER_ERROR))
+		*id_type = CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE;
+	else if (!strcmp(token, CAM_COMMON_EVT_INJECT_NOTIFY_EVENT))
+		*id_type = CAM_COMMON_EVT_INJECT_NOTIFY_EVENT_TYPE;
+	else {
+		CAM_ERR(CAM_UTIL, "Invalid string id: %s", token);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cam_common_evt_inject_parse_buffer_error_evt_params(
+	struct cam_common_inject_evt_param *inject_params,
+	uint32_t param_counter, char *token)
+{
+	struct cam_hw_inject_buffer_error_param *buf_err_params =
+		&inject_params->evt_params.u.buf_err_evt;
+	int rc = 0;
+
+	switch (param_counter) {
+	case SYNC_ERROR_CAUSE:
+		if (kstrtou32(token, 0, &buf_err_params->sync_error)) {
+			CAM_ERR(CAM_UTIL, "Invalid event type %s", token);
+			rc = -EINVAL;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_UTIL, "Invalid extra parameters: %s", token);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_common_evt_inject_parse_node_evt_params(
+	struct cam_common_inject_evt_param *inject_params,
+	uint32_t param_counter, char *token)
+{
+	struct cam_hw_inject_node_evt_param *node_params =
+		&inject_params->evt_params.u.evt_notify.u.node_evt_params;
+	int rc = 0;
+
+	switch (param_counter) {
+	case EVENT_TYPE:
+		if (kstrtou32(token, 0, &node_params->event_type)) {
+			CAM_ERR(CAM_UTIL, "Invalid event type %s", token);
+			rc = -EINVAL;
+		}
+		break;
+	case EVENT_CAUSE:
+		if (kstrtou32(token, 0, &node_params->event_cause)) {
+			CAM_ERR(CAM_UTIL, "Invalid event cause %s", token);
+			rc = -EINVAL;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_UTIL, "Invalid extra parameters: %s", token);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_common_evt_inject_parse_pf_params(
+	struct cam_common_inject_evt_param *inject_params,
+	uint32_t param_counter, char *token)
+{
+	struct cam_hw_inject_pf_evt_param *pf_params =
+		&inject_params->evt_params.u.evt_notify.u.pf_evt_params;
+	int rc = 0;
+
+	switch (param_counter) {
+	case PF_PARAM_CTX_FOUND:
+		if (kstrtobool(token, &pf_params->ctx_found)) {
+			CAM_ERR(CAM_UTIL, "Invalid context found value %s", token);
+			rc = -EINVAL;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_UTIL, "Invalid extra parameters %s", token);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_common_evt_inject_parse_err_evt_params(
+	struct cam_common_inject_evt_param *inject_params,
+	uint32_t param_counter, char *token)
+{
+	struct cam_hw_inject_err_evt_param *err_params =
+		&inject_params->evt_params.u.evt_notify.u.err_evt_params;
+	int rc = 0;
+
+	switch (param_counter) {
+	case ERR_PARAM_ERR_TYPE:
+		if (kstrtou32(token, 0, &err_params->err_type)) {
+			CAM_ERR(CAM_UTIL, "Invalid error type %s", token);
+			rc = -EINVAL;
+		}
+		break;
+	case ERR_PARAM_ERR_CODE:
+		if (kstrtou32(token, 0, &err_params->err_code)) {
+			CAM_ERR(CAM_UTIL, "Invalid error code %s", token);
+			rc = -EINVAL;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_UTIL, "Invalid extra parameters: %s", token);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_common_evt_inject_parse_event_notify(
+	struct cam_common_inject_evt_param *inject_params,
+	uint32_t param_counter, char *token)
+{
+	int rc = 0;
+
+	switch (param_counter) {
+	case EVT_NOTIFY_TYPE:
+		if (kstrtou32(token, 0,
+			&inject_params->evt_params.u.evt_notify.evt_notify_type)) {
+			CAM_ERR(CAM_UTIL, "Invalid Event notify type %s", token);
+			rc = -EINVAL;
+		}
+		break;
+	default:
+		CAM_ERR(CAM_UTIL, "Invalid extra parameters: %s", token);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_common_evt_inject_parse_common_params(
+	struct cam_common_inject_evt_param *inject_params,
+	uint32_t param_counter, char *token)
+{
+	int rc = 0;
+	struct cam_hw_inject_evt_param *evt_param = &inject_params->evt_params;
+
+	switch (param_counter) {
+	case STRING_ID:
+		rc = cam_common_evt_inject_get_str_id_type(&evt_param->inject_id, token);
+		break;
+	case HW_NAME:
+		rc = cam_common_evt_inject_get_hw_id(&inject_params->hw_id, token);
+		break;
+	case DEV_HDL:
+		if (kstrtos32(token, 0, &inject_params->dev_hdl)) {
+			CAM_ERR(CAM_UTIL, "Invalid device handle %s", token);
+			rc = -EINVAL;
+		}
+		break;
+	case REQ_ID:
+		if (kstrtou64(token, 0, &evt_param->req_id)) {
+			CAM_ERR(CAM_UTIL, "Invalid request id %s", token);
+			rc = -EINVAL;
+		}
+		break;
+	default:
+		 CAM_ERR(CAM_UTIL, "Invalid extra parameter: %s", token);
+		 rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_common_evt_inject_generic_command_parser(
+	struct cam_common_inject_evt_param *inject_params,
+	char **msg, uint32_t max_params, cam_common_evt_inject_cmd_parse_handler cmd_parse_cb)
+{
+	char *token = NULL;
+	int rc = 0, param_counter = 0;
+
+	token = strsep(msg, ":");
+	while (token != NULL) {
+		rc = cmd_parse_cb(inject_params, param_counter, token);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Parsed Command failed rc: %d", rc);
+			return rc;
+		}
+
+		param_counter++;
+		if (param_counter == max_params)
+			break;
+		token = strsep(msg, ":");
+	}
+
+	if (param_counter < max_params) {
+		CAM_ERR(CAM_UTIL,
+			"Insufficient parameters passed for total parameters: %u",
+			param_counter);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int cam_common_evt_inject_set(const char *kmessage,
+	const struct kernel_param *kp)
+{
+	struct   cam_common_inject_evt_param *inject_params   = NULL;
+	struct   cam_hw_inject_evt_param *hw_evt_params       = NULL;
+	cam_common_evt_inject_cmd_parse_handler parse_handler = NULL;
+	int      rc                                           = 0;
+	char     tmp_buff[CAM_COMMON_EVT_INJECT_BUFFER_LEN];
+	char    *msg                                          = NULL;
+	uint32_t param_output                                 = 0;
+
+	inject_params = kzalloc(sizeof(struct cam_common_inject_evt_param), GFP_KERNEL);
+	if (!inject_params) {
+		CAM_ERR(CAM_UTIL, "no free memory");
+		return -ENOMEM;
+	}
+
+	rc = strscpy(tmp_buff, kmessage, CAM_COMMON_EVT_INJECT_BUFFER_LEN);
+	if (rc == -E2BIG)
+		goto free;
+
+	CAM_INFO(CAM_UTIL, "parsing input param for cam event injection: %s", tmp_buff);
+
+	msg = tmp_buff;
+	hw_evt_params = &inject_params->evt_params;
+
+	rc = cam_common_evt_inject_generic_command_parser(inject_params, &msg,
+		COMMON_PARAM_MAX, cam_common_evt_inject_parse_common_params);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Fail to parse common params %d", rc);
+		goto free;
+	}
+
+	switch (hw_evt_params->inject_id) {
+	case CAM_COMMON_EVT_INJECT_NOTIFY_EVENT_TYPE:
+		rc = cam_common_evt_inject_generic_command_parser(inject_params, &msg,
+			EVT_NOTIFY_PARAM_MAX, cam_common_evt_inject_parse_event_notify);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Fail to parse event notify type param %d", rc);
+			goto free;
+		}
+
+		switch (hw_evt_params->u.evt_notify.evt_notify_type) {
+		case V4L_EVENT_CAM_REQ_MGR_ERROR:
+			parse_handler = cam_common_evt_inject_parse_err_evt_params;
+			param_output = ERR_PARAM_MAX;
+			break;
+		case V4L_EVENT_CAM_REQ_MGR_NODE_EVENT:
+			parse_handler = cam_common_evt_inject_parse_node_evt_params;
+			param_output = NODE_PARAM_MAX;
+			break;
+		case V4L_EVENT_CAM_REQ_MGR_PF_ERROR:
+			parse_handler = cam_common_evt_inject_parse_pf_params;
+			param_output = PF_PARAM_MAX;
+			break;
+		default:
+			CAM_ERR(CAM_UTIL, "Invalid event notification type: %u",
+				hw_evt_params->u.evt_notify.evt_notify_type);
+			goto free;
+		}
+		break;
+	case CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE:
+		parse_handler = cam_common_evt_inject_parse_buffer_error_evt_params;
+		param_output = BUFFER_ERROR_PARAM_MAX;
+		break;
+	default:
+		CAM_ERR(CAM_UTIL, "Invalid Injection id: %u", hw_evt_params->inject_id);
+	}
+
+	rc = cam_common_evt_inject_generic_command_parser(inject_params, &msg,
+		param_output, parse_handler);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Command Parsed failed with Inject id: %u rc: %d",
+			hw_evt_params->inject_id, rc);
+		goto free;
+	}
+
+	if (g_inject_evt_info.evt_inject_cb[inject_params->hw_id]) {
+		rc = g_inject_evt_info.evt_inject_cb[inject_params->hw_id](inject_params);
+		if (rc)
+			goto free;
+	} else {
+		CAM_ERR(CAM_UTIL, "Handler for HW_id [%hhu] not registered", inject_params->hw_id);
+		goto free;
+	}
+
+	if (!g_inject_evt_info.is_list_initialised) {
+		INIT_LIST_HEAD(&g_inject_evt_info.active_evt_ctx_list);
+		g_inject_evt_info.is_list_initialised = true;
+	}
+
+	list_add(&inject_params->list, &g_inject_evt_info.active_evt_ctx_list);
+
+	return rc;
+
+free:
+	kfree(inject_params);
+	return rc;
+}
+
+static int cam_common_evt_inject_get(char *buffer,
+	const struct kernel_param *kp)
+{
+	uint8_t hw_name[16], string_id[16];
+	uint16_t buff_max_size = CAM_COMMON_EVT_INJECT_MODULE_PARAM_MAX_LENGTH;
+	struct cam_common_inject_evt_param *inject_params = NULL;
+	struct cam_hw_inject_evt_param *evt_params = NULL;
+	uint32_t  ret = 0;
+
+	if (!g_inject_evt_info.is_list_initialised)
+		return scnprintf(buffer, buff_max_size, "uninitialised");
+
+	if (list_empty(&g_inject_evt_info.active_evt_ctx_list))
+		return scnprintf(buffer, buff_max_size, "Active err inject list is empty");
+
+	list_for_each_entry(inject_params, &g_inject_evt_info.active_evt_ctx_list, list) {
+		evt_params = &inject_params->evt_params;
+
+		switch (inject_params->hw_id) {
+		case CAM_COMMON_EVT_INJECT_HW_IFE:
+			strscpy(hw_name, CAM_COMMON_IFE_NODE, sizeof(hw_name));
+			break;
+		case CAM_COMMON_EVT_INJECT_HW_TFE:
+			strscpy(hw_name, CAM_COMMON_TFE_NODE, sizeof(hw_name));
+			break;
+		case CAM_COMMON_EVT_INJECT_HW_ICP:
+			strscpy(hw_name, CAM_COMMON_ICP_NODE, sizeof(hw_name));
+			break;
+		case CAM_COMMON_EVT_INJECT_HW_JPEG:
+			strscpy(hw_name, CAM_COMMON_JPEG_NODE, sizeof(hw_name));
+			break;
+		default:
+			ret += scnprintf(buffer+ret, buff_max_size, "Undefined HW id\n");
+			goto undefined_param;
+		}
+
+		switch (evt_params->inject_id) {
+		case CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE:
+			strscpy(string_id, CAM_COMMON_EVT_INJECT_BUFFER_ERROR, sizeof(string_id));
+			break;
+		case CAM_COMMON_EVT_INJECT_NOTIFY_EVENT_TYPE:
+			strscpy(string_id, CAM_COMMON_EVT_INJECT_NOTIFY_EVENT, sizeof(string_id));
+			break;
+		default:
+			ret += scnprintf(buffer+ret, buff_max_size, "Undefined string id\n");
+			goto undefined_param;
+		}
+
+		ret += scnprintf(buffer+ret, buff_max_size,
+			"string_id: %s hw_name: %s dev_hdl: %d req_id: %llu ",
+			string_id, hw_name,
+			inject_params->dev_hdl, evt_params->req_id);
+
+		if (buff_max_size > ret) {
+			buff_max_size -= ret;
+		} else {
+			CAM_WARN(CAM_UTIL, "out buff max limit reached");
+			break;
+		}
+
+		if (evt_params->inject_id ==
+			CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE) {
+			ret += scnprintf(buffer+ret, buff_max_size,
+				"sync_error: %u\n", evt_params->u.buf_err_evt.sync_error);
+		} else {
+			switch (evt_params->u.evt_notify.evt_notify_type) {
+			case V4L_EVENT_CAM_REQ_MGR_ERROR: {
+				struct cam_hw_inject_err_evt_param *err_evt_params =
+					&evt_params->u.evt_notify.u.err_evt_params;
+				ret += scnprintf(buffer+ret, buff_max_size,
+					"Error event: error type: %u error code: %u\n",
+					err_evt_params->err_type, err_evt_params->err_code);
+				break;
+			}
+			case V4L_EVENT_CAM_REQ_MGR_NODE_EVENT: {
+				struct cam_hw_inject_node_evt_param *node_evt_params =
+					&evt_params->u.evt_notify.u.node_evt_params;
+				ret += scnprintf(buffer+ret, buff_max_size,
+					"Node event: event type: %u event cause: %u\n",
+					node_evt_params->event_type, node_evt_params->event_cause);
+				break;
+			}
+			case V4L_EVENT_CAM_REQ_MGR_PF_ERROR: {
+				struct cam_hw_inject_pf_evt_param *pf_evt_params =
+					&evt_params->u.evt_notify.u.pf_evt_params;
+				ret += scnprintf(buffer+ret, buff_max_size,
+					"PF event: ctx found %hhu\n",
+					pf_evt_params->ctx_found);
+				break;
+			}
+			default:
+				ret += scnprintf(buffer+ret, buff_max_size,
+					"Undefined notification event\n");
+			}
+		}
+
+undefined_param:
+		CAM_DBG(CAM_UTIL, "output buffer: %s", buffer);
+
+		if (buff_max_size > ret) {
+			buff_max_size -= ret;
+		} else {
+			CAM_WARN(CAM_UTIL, "out buff max limit reached");
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static const struct kernel_param_ops cam_common_evt_inject = {
+	.set = cam_common_evt_inject_set,
+	.get = cam_common_evt_inject_get
+};
+
+module_param_cb(cam_event_inject, &cam_common_evt_inject, NULL, 0644);
+
+int cam_common_mem_kdup(void **dst,
+	void *src, size_t size)
+{
+	gfp_t flag = GFP_KERNEL;
+
+	if (!src || !dst || !size) {
+		CAM_ERR(CAM_UTIL, "Invalid params src: %pK dst: %pK size: %u",
+			src, dst, size);
+		return -EINVAL;
+	}
+
+	if (!in_task())
+		flag = GFP_ATOMIC;
+
+	*dst = kvzalloc(size, flag);
+	if (!*dst) {
+		CAM_ERR(CAM_UTIL, "Failed to allocate memory with size: %u", size);
+		return -ENOMEM;
+	}
+
+	memcpy(*dst, src, size);
+	CAM_DBG(CAM_UTIL, "Allocate and copy memory with size: %u", size);
+
+	return 0;
+}
+EXPORT_SYMBOL(cam_common_mem_kdup);
+
+void cam_common_mem_free(void *memory)
+{
+	kvfree(memory);
+}
+EXPORT_SYMBOL(cam_common_mem_free);
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_common_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_common_util.h
@@ -0,0 +1,449 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_COMMON_UTIL_H_
+#define _CAM_COMMON_UTIL_H_
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+
+#include "cam_hw_mgr_intf.h"
+
+#define CAM_BITS_MASK_SHIFT(x, mask, shift) (((x) & (mask)) >> shift)
+#define CAM_36BIT_INTF_GET_IOVA_BASE(iova) ((iova) >> 8)
+#define CAM_36BIT_INTF_GET_IOVA_OFFSET(iova) ((iova) & 0xff)
+
+#define CAM_COMMON_MINI_DUMP_DEV_NUM      6
+#define CAM_COMMON_MINI_DUMP_DEV_NAME_LEN 16
+#define CAM_COMMON_MINI_DUMP_SIZE         10 * 1024 * 1024
+
+#define CAM_COMMON_HW_DUMP_TAG_MAX_LEN 128
+#define CAM_MAX_NUM_CCI_PAYLOAD_BYTES     11
+
+#define CAM_COMMON_EVT_INJECT_MODULE_PARAM_MAX_LENGTH 4096
+#define CAM_COMMON_EVT_INJECT_BUFFER_LEN              200
+#define CAM_COMMON_EVT_INJECT_BUFFER_ERROR "Buffer_Error"
+#define CAM_COMMON_EVT_INJECT_NOTIFY_EVENT "Notify_Event"
+#define CAM_COMMON_IFE_NODE  "IFE"
+#define CAM_COMMON_ICP_NODE  "IPE"
+#define CAM_COMMON_JPEG_NODE "JPEG"
+#define CAM_COMMON_TFE_NODE "TFE"
+
+#define CAM_COMMON_NS_PER_MS              1000000ULL
+
+#define PTR_TO_U64(ptr) ((uint64_t)(uintptr_t)ptr)
+#define U64_TO_PTR(ptr) ((void *)(uintptr_t)ptr)
+
+#define CAM_TRIGGER_PANIC(format, args...) panic("CAMERA - " format "\n", ##args)
+
+#define CAM_GET_BOOT_TIMESTAMP(timestamp) ktime_get_boottime_ts64(&(timestamp))
+#define CAM_GET_TIMESTAMP(timestamp) ktime_get_real_ts64(&(timestamp))
+#define CAM_GET_TIMESTAMP_DIFF_IN_MICRO(ts_start, ts_end, diff_microsec)                     \
+({                                                                                           \
+	diff_microsec = 0;                                                                   \
+	if (ts_end.tv_nsec >= ts_start.tv_nsec) {                                            \
+		diff_microsec =                                                              \
+			(ts_end.tv_nsec - ts_start.tv_nsec) / 1000;                          \
+		diff_microsec +=                                                             \
+			(ts_end.tv_sec - ts_start.tv_sec) * 1000 * 1000;                     \
+	} else {                                                                             \
+		diff_microsec =                                                              \
+			(ts_end.tv_nsec +                                                    \
+			(1000*1000*1000 - ts_start.tv_nsec)) / 1000;                         \
+		diff_microsec +=                                                             \
+			(ts_end.tv_sec - ts_start.tv_sec - 1) * 1000 * 1000;                 \
+	}                                                                                    \
+})
+
+#define CAM_CONVERT_TIMESTAMP_FORMAT(ts, hrs, min, sec, ms)                                  \
+({                                                                                           \
+	uint64_t tmp = ((ts).tv_sec);                                                        \
+	(ms) = ((ts).tv_nsec) / 1000000;                                                     \
+	(sec) = do_div(tmp, 60);                                                             \
+	(min) = do_div(tmp, 60);                                                             \
+	(hrs) = do_div(tmp, 24);                                                             \
+})
+
+#define CAM_COMMON_WAIT_FOR_COMPLETION_TIMEOUT_ERRMSG(complete, timeout_jiffies, module_id,  \
+	fmt, args...)                                                                        \
+({                                                                                           \
+	struct timespec64 start_time, end_time;                                              \
+	unsigned long rem_jiffies;                                                           \
+	start_time = ktime_to_timespec64(ktime_get());                                       \
+	rem_jiffies = cam_common_wait_for_completion_timeout((complete), (timeout_jiffies)); \
+	if (!rem_jiffies) {                                                                  \
+		end_time = ktime_to_timespec64(ktime_get());                                 \
+		CAM_ERR(module_id,                                                           \
+		fmt " (timeout: %ums start: timestamp:[%lld.%06lld] end: timestamp:[%lld.%06lld])",\
+		##args, jiffies_to_msecs(timeout_jiffies),                                   \
+		start_time.tv_sec, (start_time.tv_nsec/NSEC_PER_USEC),                       \
+		end_time.tv_sec, (end_time.tv_nsec/NSEC_PER_USEC));                          \
+	}                                                                                    \
+	rem_jiffies;                                                                         \
+})
+
+typedef unsigned long (*cam_common_mini_dump_cb) (void *dst,
+	unsigned long len, void *priv_data);
+
+/**
+ * struct cam_common_mini_dump_dev_info
+ * @dump_cb       : address of data dumped
+ * @name          : Name of driver
+ * @num_devs      : Number of device registerd
+ * @is_registered : Bool to indicate if registered
+ */
+struct cam_common_mini_dump_dev_info {
+	cam_common_mini_dump_cb  dump_cb[CAM_COMMON_MINI_DUMP_DEV_NUM];
+	uint8_t                  name[CAM_COMMON_MINI_DUMP_DEV_NUM]
+				    [CAM_COMMON_MINI_DUMP_DEV_NAME_LEN];
+	void                    *priv_data[CAM_COMMON_MINI_DUMP_DEV_NUM];
+	uint8_t                  num_devs;
+	bool                     is_registered;
+};
+
+/**
+ * struct cam_common_mini_dump_data
+ * @link         : address of data dumped
+ * @name         : Name of driver
+ * @size         : Size dumped
+ */
+struct cam_common_mini_dump_data {
+	void          *waddr[CAM_COMMON_MINI_DUMP_DEV_NUM];
+	uint8_t        name[CAM_COMMON_MINI_DUMP_DEV_NUM][CAM_COMMON_MINI_DUMP_DEV_NAME_LEN];
+	unsigned long  size[CAM_COMMON_MINI_DUMP_DEV_NUM];
+};
+
+
+typedef int (*cam_common_evt_inject_cb) (void *inject_args);
+
+enum cam_common_evt_inject_str_id_type {
+	CAM_COMMON_EVT_INJECT_BUFFER_ERROR_TYPE,
+	CAM_COMMON_EVT_INJECT_NOTIFY_EVENT_TYPE
+};
+
+enum cam_common_evt_inject_hw_id {
+	CAM_COMMON_EVT_INJECT_HW_IFE,
+	CAM_COMMON_EVT_INJECT_HW_TFE,
+	CAM_COMMON_EVT_INJECT_HW_ICP,
+	CAM_COMMON_EVT_INJECT_HW_JPEG,
+	CAM_COMMON_EVT_INJECT_HW_MAX
+};
+
+enum cam_common_evt_inject_common_param_pos {
+	STRING_ID,
+	HW_NAME,
+	DEV_HDL,
+	REQ_ID,
+	COMMON_PARAM_MAX
+};
+
+enum cam_common_evt_inject_notify_event_pos {
+	EVT_NOTIFY_TYPE,
+	EVT_NOTIFY_PARAM_MAX
+};
+
+enum cam_evt_inject_buffer_error_event {
+	SYNC_ERROR_CAUSE,
+	BUFFER_ERROR_PARAM_MAX
+};
+
+enum cam_evt_inject_error_param_pos {
+	ERR_PARAM_ERR_TYPE,
+	ERR_PARAM_ERR_CODE,
+	ERR_PARAM_MAX
+};
+
+enum cam_evt_inject_node_param_pos {
+	EVENT_TYPE,
+	EVENT_CAUSE,
+	NODE_PARAM_MAX,
+};
+
+enum cam_evt_inject_pf_params_pos {
+	PF_PARAM_CTX_FOUND,
+	PF_PARAM_MAX
+};
+
+/**
+ * struct cam_common_evt_inject_data
+ * @buf_done_data: buf done data
+ * @evt_params   : event params for the injected event
+ */
+struct cam_common_evt_inject_data {
+	void                           *buf_done_data;
+	struct cam_hw_inject_evt_param *evt_params;
+};
+
+typedef int (*cam_common_evt_inject_ops) (void *cam_ctx,
+	struct cam_common_evt_inject_data *inject_evt);
+
+/**
+ * struct cam_common_inject_evt_param
+ * @evt_params : injection event params
+ * @dev_hdl    : device handle to match with ctx's dev_hdl
+ * @hw_id      : hw to be injected with the event
+ */
+struct cam_common_inject_evt_param {
+	struct list_head list;
+	struct cam_hw_inject_evt_param evt_params;
+	int32_t dev_hdl;
+	uint8_t hw_id;
+};
+
+/**
+ * struct cam_common_inject_evt_info
+ * @evt_inject_cb      : address of callback
+ * @active_err_ctx_list: list containing active evt inject requests
+ * @num_hw_registered  : number of callbacks registered
+ * @is_list_initialised: bool to check init for evt_inject list
+ */
+struct cam_common_inject_evt_info {
+	cam_common_evt_inject_cb    evt_inject_cb[CAM_COMMON_EVT_INJECT_HW_MAX];
+	struct list_head            active_evt_ctx_list;
+	uint8_t                     num_hw_registered;
+	bool                        is_list_initialised;
+};
+
+/**
+ * struct cam_common_hw_dump_args
+ * @req_id         : request id
+ * @cpu_addr       : address where dumping will start from
+ * @buf_len        : length of buffer where data is being dumped to
+ * @offset         : buffer offset from cpu_addr after each item dump
+ * @ctxt_to_hw_map : context to hw map
+ * @is_dump_all    : flag to indicate if all information or just bw/clk rate
+ * @
+ */
+struct cam_common_hw_dump_args {
+	uint64_t                req_id;
+	uintptr_t               cpu_addr;
+	size_t                  buf_len;
+	size_t                  offset;
+	void                   *ctxt_to_hw_map;
+	bool                    is_dump_all;
+};
+
+/**
+ * struct cam_common_hw_dump_header
+ * @tag        : string used by the parser to call parse functions
+ * @size       : size of the header in the buffer
+ * @word_size  : word size of the header
+ * @
+ */
+struct cam_common_hw_dump_header {
+	uint8_t   tag[CAM_COMMON_HW_DUMP_TAG_MAX_LEN];
+	uint64_t  size;
+	uint32_t  word_size;
+};
+
+/**
+ * @brief                 release all event inject params in the g_inject_evt_info
+ *                        for a specific dev_hdl
+ * @dev_hdl:              device handle to which the evt inject params belong to
+ */
+void cam_common_release_evt_params(int32_t dev_hdl);
+
+/**
+ * cam_common_util_get_string_index()
+ *
+ * @brief                  Match the string from list of strings to return
+ *                         matching index
+ *
+ * @strings:               Pointer to list of strings
+ * @num_strings:           Number of strings in 'strings'
+ * @matching_string:       String to match
+ * @index:                 Pointer to index to return matching index
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_common_util_get_string_index(const char **strings,
+	uint32_t num_strings, const char *matching_string, uint32_t *index);
+
+/**
+ * cam_common_util_remove_duplicate_arr()
+ *
+ * @brief                  Move all the unique integers to the start of
+ *                         the array and return the number of unique integers
+ *
+ * @array:                 Pointer to the first integer of array
+ * @num:                   Number of elements in array
+ *
+ * @return:                Number of unique integers in array
+ */
+uint32_t cam_common_util_remove_duplicate_arr(int32_t *array,
+	uint32_t num);
+
+/**
+ * cam_common_wait_for_completion_timeout()
+ *
+ * @brief                  common interface to implement wait for completion
+ *                         for slow environment like presil, single debug
+ *                         timeout variable can take care
+ *
+ * @complete:              Pointer to the first integer of array
+ * @timeout_jiffies:       Timeout value in jiffie
+ *
+ * @return:                Remaining jiffies, non-zero for success, zero
+ *                         in case of failure
+ */
+unsigned long cam_common_wait_for_completion_timeout(
+	struct completion   *complete,
+	unsigned long        timeout_jiffies);
+/**
+ * cam_common_read_poll_timeout()
+ *
+ * @brief                  common interface to read poll timeout
+ *
+ * @addr:                  Address of IO register
+ * @delay:                 Delay interval of poll
+ * @timeout:               Timeout for poll
+ * @mask:                  Mask to be checked
+ * @check_val:             Value to be compared to break poll
+ * @status:                Status of register of IO
+ *
+ * @return:                0 if success and negative if fail
+ * */
+int cam_common_read_poll_timeout(
+	void __iomem        *addr,
+	unsigned long        delay,
+	unsigned long        timeout,
+	uint32_t             mask,
+	uint32_t             check_val,
+	uint32_t            *status);
+
+/**
+ * cam_common_modify_timer()
+ *
+ * @brief                  common interface to modify timer,
+ *
+ * @timer:                 reference to system timer
+ * @timeout_val:           timeout value for timer
+ *
+ * @return:                0 if success and negative if fail
+ */
+int cam_common_modify_timer(struct timer_list *timer, int32_t timeout_val);
+
+#ifdef CONFIG_SPECTRA_KT
+
+/**
+ * cam_common_util_thread_switch_delay_detect()
+ *
+ * @brief                  Detect if there is any scheduling delay
+ *
+ * @token:                 String identifier to print workq name or tasklet
+ * @scheduled_time:        Time when workq or tasklet was scheduled
+ * @threshold:             Threshold time
+ *
+ */
+void cam_common_util_thread_switch_delay_detect(const char *token,
+	ktime_t scheduled_time, uint32_t threshold);
+
+#else
+
+/**
+ * cam_common_util_thread_switch_delay_detect()
+ *
+ * @brief                  Detect if there is any scheduling delay
+ *
+ * @wq_name:               workq name
+ * @state:                 either schedule or execution
+ * @cb:                    callback scheduled or executed
+ * @scheduled_time:        Time when workq or tasklet was scheduled
+ * @threshold:             Threshold time
+ *
+ */
+void cam_common_util_thread_switch_delay_detect(char *wq_name, const char *state,
+	void *cb, ktime_t scheduled_time, uint32_t threshold);
+
+#endif // CONFIG_SPECTRA_KT
+
+/**
+ * cam_common_register_mini_dump_cb()
+ *
+ * @brief                  common interface to register mini dump cb
+ *
+ * @mini_dump_cb:          Pointer to the mini_dump_cb
+ * @name:                  name of device registering
+ *
+ * @return:                0 if success in register non-zero if failes
+ */
+#if IS_REACHABLE(CONFIG_QCOM_VA_MINIDUMP)
+int cam_common_register_mini_dump_cb(
+	cam_common_mini_dump_cb mini_dump_cb, uint8_t *dev_name, void *priv_data);
+#else
+static inline int cam_common_register_mini_dump_cb(
+	cam_common_mini_dump_cb mini_dump_cb,
+	uint8_t *dev_name, void *priv_data)
+{
+	return 0;
+}
+#endif
+
+/**
+ * cam_common_user_dump_clock()
+ *
+ * @brief                  Handles clock rate dump
+ *
+ * @dump_struct:           Struct holding dump info
+ * @addr_ptr:              Pointer to buffer address pointer
+ */
+void *cam_common_user_dump_clock(
+	void     *dump_struct,
+	uint8_t  *addr_ptr);
+
+/**
+ * cam_common_user_dump_helper()
+ *
+ * @brief                  Handles buffer addressing and dumping for user dump
+ *
+ * @cmd_args:              Holds cam_common_hw_dump_args pointer
+ * @func:                  Function pointer for dump function
+ * @dump_struct:           Struct holding dump info
+ * @size:                  Size_t value used for header word size
+ * @tag:                   Tag for header, used by parser
+ * @...:                   Variadic arguments, appended to tag if given
+ */
+int cam_common_user_dump_helper(
+	void        *cmd_args,
+	void        *(*func)(void *, uint8_t *),
+	void        *dump_struct,
+	size_t       size,
+	const char  *tag,
+	...);
+
+/**
+ * cam_common_register_evt_inject_cb()
+ *
+ * @brief                  common interface to register evt inject cb
+ *
+ * @evt_inject_cb:         Pointer to evt_inject_cb
+ * @hw_id:                 HW id of the HW driver registering
+ *
+ * @return:                0 if success in register non-zero if failes
+ */
+int cam_common_register_evt_inject_cb(
+	cam_common_evt_inject_cb evt_inject_cb,
+	enum cam_common_evt_inject_hw_id hw_id);
+
+/**
+ * @brief:                 Memory alloc and copy
+ *
+ * @dst:                   Address of destination address of memory
+ * @src:                   Source address of memory
+ * @size:                  Length of memory
+ *
+ * @return                 0 if success in register non-zero if failes
+ */
+int cam_common_mem_kdup(void **dst, void *src, size_t size);
+
+/**
+ * @brief:                 Free the memory
+ *
+ * @memory:                Address of memory
+ */
+void cam_common_mem_free(void *memory);
+#endif /* _CAM_COMMON_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_compat.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_compat.c
@@ -0,0 +1,715 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/dma-buf.h>
+#include <linux/of_address.h>
+#include <linux/slab.h>
+
+#include <soc/qcom/rpmh.h>
+
+#include "cam_compat.h"
+#include "cam_debug_util.h"
+#include "cam_cpas_api.h"
+#include "camera_main.h"
+#include "cam_eeprom_dev.h"
+#include "cam_eeprom_core.h"
+
+#if IS_ENABLED(CONFIG_SPECTRA_USE_RPMH_DRV_API)
+#define CAM_RSC_DRV_IDENTIFIER "cam_rsc"
+
+const struct device *cam_cpas_get_rsc_dev_for_drv(uint32_t index)
+{
+	const struct device *rsc_dev;
+
+	rsc_dev = rpmh_get_device(CAM_RSC_DRV_IDENTIFIER, index);
+	if (!rsc_dev) {
+		CAM_ERR(CAM_CPAS, "Invalid dev for index: %u", index);
+		return NULL;
+	}
+
+	return rsc_dev;
+}
+
+int cam_cpas_start_drv_for_dev(const struct device *dev)
+{
+	int rc = 0;
+
+	if (!dev) {
+		CAM_ERR(CAM_CPAS, "Invalid dev for DRV enable");
+		return -EINVAL;
+	}
+
+	rc = rpmh_drv_start(dev);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "[%s] Failed in DRV start", dev_name(dev));
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_cpas_stop_drv_for_dev(const struct device *dev)
+{
+	int rc = 0;
+
+	if (!dev) {
+		CAM_ERR(CAM_CPAS, "Invalid dev for DRV disable");
+		return -EINVAL;
+	}
+
+	rc = rpmh_drv_stop(dev);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "[%s] Failed in DRV stop", dev_name(dev));
+		return rc;
+	}
+
+	return rc;
+}
+
+int cam_cpas_drv_channel_switch_for_dev(const struct device *dev)
+{
+	int rc = 0;
+
+	if (!dev) {
+		CAM_ERR(CAM_CPAS, "Invalid dev for DRV channel switch");
+		return -EINVAL;
+	}
+
+	rc = rpmh_write_sleep_and_wake_no_child(dev);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "[%s] Failed in DRV channel switch", dev_name(dev));
+		return rc;
+	}
+
+	return rc;
+}
+
+#else
+const struct device *cam_cpas_get_rsc_dev_for_drv(uint32_t index)
+{
+	return NULL;
+}
+
+int cam_cpas_start_drv_for_dev(const struct device *dev)
+
+{
+	return 0;
+}
+
+int cam_cpas_stop_drv_for_dev(const struct device *dev)
+{
+	return 0;
+}
+
+int cam_cpas_drv_channel_switch_for_dev(const struct device *dev)
+{
+	return 0;
+}
+#endif
+
+#ifndef CONFIG_SPECTRA_KT
+
+int cam_smmu_fetch_csf_version(struct cam_csf_version *csf_version)
+{
+#ifdef CONFIG_SPECTRA_SECURE
+	struct csf_version csf_ver;
+	int rc;
+
+	/* Fetch CSF version from SMMU proxy driver */
+	rc = smmu_proxy_get_csf_version(&csf_ver);
+	if (rc) {
+		CAM_ERR(CAM_SMMU,
+			"Failed to get CSF version from SMMU proxy: %d", rc);
+		return rc;
+	}
+
+	csf_version->arch_ver = csf_ver.arch_ver;
+	csf_version->max_ver = csf_ver.max_ver;
+	csf_version->min_ver = csf_ver.min_ver;
+#else
+	/* This defaults to the legacy version */
+	csf_version->arch_ver = 2;
+	csf_version->max_ver = 0;
+	csf_version->min_ver = 0;
+#endif /* CONFIG_SPECTRA_SECURE */
+	return 0;
+}
+
+#endif /* ifndef CONFIG_SPECTRA_KT */
+
+unsigned long cam_update_dma_map_attributes(unsigned long attrs)
+{
+#ifdef CONFIG_SPECTRA_SECURE
+	attrs |= DMA_ATTR_QTI_SMMU_PROXY_MAP;
+#endif /* CONFIG_SPECTRA_SECURE */
+	return attrs;
+}
+
+size_t cam_align_dma_buf_size(size_t len)
+{
+#ifdef CONFIG_SPECTRA_SECURE
+	len = ALIGN(len, SMMU_PROXY_MEM_ALIGNMENT);
+#endif /* CONFIG_SPECTRA_SECURE */
+	return len;
+}
+
+#ifdef CONFIG_SPECTRA_SECURE_CAMNOC_REG_UPDATE
+int cam_update_camnoc_qos_settings(uint32_t use_case_id,
+	uint32_t qos_cnt, struct qcom_scm_camera_qos *scm_buf)
+{
+	int rc = 0;
+
+	rc = qcom_scm_camera_update_camnoc_qos(use_case_id, qos_cnt, scm_buf);
+	if (rc)
+		CAM_ERR(CAM_CPAS, "scm call to update QoS failed: %d, use_case_id: %d",
+			rc, use_case_id);
+
+	return rc;
+}
+#else
+int cam_update_camnoc_qos_settings(uint32_t use_case_id,
+	uint32_t qos_cnt, struct qcom_scm_camera_qos *scm_buf)
+{
+	CAM_ERR(CAM_CPAS, "scm call to update QoS is not supported under this kernel");
+	return -EOPNOTSUPP;
+}
+#endif
+
+int cam_reserve_icp_fw(struct cam_fw_alloc_info *icp_fw, size_t fw_length)
+{
+	int rc = 0;
+	struct device_node *of_node;
+	struct device_node *mem_node;
+	struct resource     res;
+
+	of_node = (icp_fw->fw_dev)->of_node;
+	mem_node = of_parse_phandle(of_node, "memory-region", 0);
+	if (!mem_node) {
+		rc = -ENOMEM;
+		CAM_ERR(CAM_SMMU, "FW memory carveout not found");
+		goto end;
+	}
+	rc = of_address_to_resource(mem_node, 0, &res);
+	of_node_put(mem_node);
+	if (rc < 0) {
+		CAM_ERR(CAM_SMMU, "Unable to get start of FW mem carveout");
+		goto end;
+	}
+	icp_fw->fw_hdl = res.start;
+	icp_fw->fw_kva = ioremap_wc(icp_fw->fw_hdl, fw_length);
+	if (!icp_fw->fw_kva) {
+		CAM_ERR(CAM_SMMU, "Failed to map the FW.");
+		rc = -ENOMEM;
+		goto end;
+	}
+	memset_io(icp_fw->fw_kva, 0, fw_length);
+
+end:
+	return rc;
+}
+
+void cam_unreserve_icp_fw(struct cam_fw_alloc_info *icp_fw, size_t fw_length)
+{
+	iounmap(icp_fw->fw_kva);
+}
+
+#ifdef CONFIG_SPECTRA_SECURE
+int cam_ife_notify_safe_lut_scm(bool safe_trigger)
+{
+	const uint32_t smmu_se_ife = 0;
+	uint32_t camera_hw_version, rc = 0;
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (!rc && qcom_scm_smmu_notify_secure_lut(smmu_se_ife, safe_trigger)) {
+		switch (camera_hw_version) {
+		case CAM_CPAS_TITAN_170_V100:
+		case CAM_CPAS_TITAN_170_V110:
+		case CAM_CPAS_TITAN_175_V100:
+			CAM_ERR(CAM_ISP, "scm call to enable safe failed");
+			rc = -EINVAL;
+			break;
+		default:
+			break;
+		}
+	}
+
+	return rc;
+}
+
+int cam_csiphy_notify_secure_mode(struct csiphy_device *csiphy_dev,
+	bool protect, int32_t offset)
+{
+	int rc = 0;
+
+	if (offset >= CSIPHY_MAX_INSTANCES_PER_PHY) {
+		CAM_ERR(CAM_CSIPHY, "Invalid CSIPHY offset");
+		rc = -EINVAL;
+	} else if (qcom_scm_camera_protect_phy_lanes(protect,
+			csiphy_dev->csiphy_info[offset]
+				.csiphy_cpas_cp_reg_mask)) {
+		CAM_ERR(CAM_CSIPHY, "SCM call to hypervisor failed");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+void cam_cpastop_scm_write(struct cam_cpas_hw_errata_wa *errata_wa)
+{
+	int reg_val;
+
+	qcom_scm_io_readl(errata_wa->data.reg_info.offset, &reg_val);
+	reg_val |= errata_wa->data.reg_info.value;
+	qcom_scm_io_writel(errata_wa->data.reg_info.offset, reg_val);
+}
+#endif /* CONFIG_SPECTRA_SECURE */
+
+static int camera_platform_compare_dev(struct device *dev, const void *data)
+{
+	return platform_bus_type.match(dev, (struct device_driver *) data);
+}
+
+int camera_i2c_compare_dev(struct device *dev, const void *data)
+{
+	return i2c_bus_type.match(dev, (struct device_driver *) data);
+}
+void cam_free_clear(const void * ptr)
+{
+	kfree_sensitive(ptr);
+}
+
+/* Callback to compare device from match list before adding as component */
+static inline int camera_component_compare_dev(struct device *dev, void *data)
+{
+	return dev == data;
+}
+
+#ifdef CONFIG_SPECTRA_KT
+
+/* Add component matches to list for master of aggregate driver */
+int camera_component_match_add_drivers(struct device *master_dev,
+	struct component_match **match_list)
+{
+	int i, rc = 0;
+	struct platform_device *pdev = NULL;
+	struct device *start_dev = NULL, *match_dev = NULL;
+
+	if (!master_dev || !match_list) {
+		CAM_ERR(CAM_UTIL, "Invalid parameters for component match add");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(cam_component_drivers); i++) {
+		struct device_driver const *drv =
+			&cam_component_drivers[i]->driver;
+		const void *drv_ptr = (const void *)drv;
+		start_dev = NULL;
+		while ((match_dev = bus_find_device(&platform_bus_type,
+			start_dev, drv_ptr, &camera_platform_compare_dev))) {
+			put_device(start_dev);
+			pdev = to_platform_device(match_dev);
+			CAM_DBG(CAM_UTIL, "Adding matched component:%s", pdev->name);
+			component_match_add(master_dev, match_list,
+				camera_component_compare_dev, match_dev);
+			start_dev = match_dev;
+		}
+		put_device(start_dev);
+	}
+
+end:
+	return rc;
+}
+
+#else
+
+/* Add component matches to list for master of aggregate driver */
+int camera_component_match_add_drivers(struct device *master_dev,
+	struct component_match **match_list)
+{
+	int i, rc = 0;
+	struct platform_device *pdev = NULL;
+	struct i2c_client *client = NULL;
+	struct device *start_dev = NULL, *match_dev = NULL;
+
+	if (!master_dev || !match_list) {
+		CAM_ERR(CAM_UTIL, "Invalid parameters for component match add");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(cam_component_platform_drivers); i++) {
+		struct device_driver const *drv =
+			&cam_component_platform_drivers[i]->driver;
+		const void *drv_ptr = (const void *)drv;
+		start_dev = NULL;
+		while ((match_dev = bus_find_device(&platform_bus_type,
+			start_dev, drv_ptr, &camera_platform_compare_dev))) {
+			put_device(start_dev);
+			pdev = to_platform_device(match_dev);
+			CAM_DBG(CAM_UTIL, "Adding matched component:%s", pdev->name);
+			component_match_add(master_dev, match_list,
+				camera_component_compare_dev, match_dev);
+			start_dev = match_dev;
+		}
+		put_device(start_dev);
+	}
+
+	for (i = 0; i < ARRAY_SIZE(cam_component_i2c_drivers); i++) {
+		struct device_driver const *drv =
+			&cam_component_i2c_drivers[i]->driver;
+		const void *drv_ptr = (const void *)drv;
+		start_dev = NULL;
+		while ((match_dev = bus_find_device(&i2c_bus_type,
+			start_dev, drv_ptr, &camera_i2c_compare_dev))) {
+			put_device(start_dev);
+			client = to_i2c_client(match_dev);
+			CAM_DBG(CAM_UTIL, "Adding matched component:%s", client->name);
+			component_match_add(master_dev, match_list,
+				camera_component_compare_dev, match_dev);
+			start_dev = match_dev;
+		}
+		put_device(start_dev);
+	}
+
+end:
+	return rc;
+}
+
+#endif /* ifdef CONFIG_SPECTRA_KT */
+
+struct iommu_fault_ids {
+	int bid;
+	int pid;
+	int mid;
+};
+static int iommu_get_fault_ids(struct iommu_domain *domain, struct iommu_fault_ids *fault_ids)
+{
+	WARN_ONCE(1, "iommu_get_fault_ids unimplemented");
+	return 0;
+}
+void cam_check_iommu_faults(struct iommu_domain *domain,
+	struct cam_smmu_pf_info *pf_info)
+{
+	struct iommu_fault_ids fault_ids = {0, 0, 0};
+
+	if (iommu_get_fault_ids(domain, &fault_ids))
+		CAM_ERR(CAM_SMMU, "Error: Can not get smmu fault ids");
+
+	CAM_ERR(CAM_SMMU, "smmu fault ids bid:%d pid:%d mid:%d",
+		fault_ids.bid, fault_ids.pid, fault_ids.mid);
+
+	pf_info->bid = fault_ids.bid;
+	pf_info->pid = fault_ids.pid;
+	pf_info->mid = fault_ids.mid;
+}
+
+static int inline cam_subdev_list_cmp(struct cam_subdev *entry_1, struct cam_subdev *entry_2)
+{
+	if (entry_1->close_seq_prior > entry_2->close_seq_prior)
+		return 1;
+	else if (entry_1->close_seq_prior < entry_2->close_seq_prior)
+		return -1;
+	else
+		return 0;
+}
+
+int cam_compat_util_get_dmabuf_va(struct dma_buf *dmabuf, uintptr_t *vaddr)
+{
+	struct iosys_map mapping = {0};
+	int error_code = dma_buf_vmap(dmabuf, &mapping);
+
+	if (error_code) {
+		*vaddr = 0;
+	} else {
+		*vaddr = (mapping.is_iomem) ?
+			(uintptr_t)mapping.vaddr_iomem : (uintptr_t)mapping.vaddr;
+		CAM_DBG(CAM_MEM,
+			"dmabuf=%p, *vaddr=%p, is_iomem=%d, vaddr_iomem=%p, vaddr=%p",
+			dmabuf, *vaddr, mapping.is_iomem, mapping.vaddr_iomem, mapping.vaddr);
+	}
+
+	return error_code;
+}
+
+void cam_compat_util_put_dmabuf_va(struct dma_buf *dmabuf, void *vaddr)
+{
+	struct iosys_map mapping = IOSYS_MAP_INIT_VADDR(vaddr);
+
+	dma_buf_vunmap(dmabuf, &mapping);
+}
+
+void cam_smmu_util_iommu_custom(struct device *dev,
+	dma_addr_t discard_start, size_t discard_length)
+{
+	return;
+}
+
+int cam_get_ddr_type(void)
+{
+	int ret;
+	u64 ddr_type;
+	struct device_node *root_node;
+	struct device_node *mem_node = NULL;
+
+	root_node = of_find_node_by_path("/");
+
+	if (root_node == NULL) {
+		CAM_ERR(CAM_UTIL, "Unable to find root node");
+		return -ENOENT;
+	}
+
+	do {
+		mem_node = of_get_next_child(root_node, mem_node);
+		if (of_node_name_prefix(mem_node, "memory")) {
+			CAM_DBG(CAM_UTIL,
+					"memory node found with full name %s",
+					mem_node->full_name);
+			break;
+		}
+	} while (mem_node != NULL);
+
+	of_node_put(root_node);
+	if (mem_node == NULL) {
+		CAM_ERR(CAM_UTIL, "memory node not found");
+		return -ENOENT;
+	}
+
+	ret = of_property_read_u64(mem_node, "ddr_device_type", &ddr_type);
+
+	of_node_put(mem_node);
+	if (ret < 0) {
+		CAM_ERR(CAM_UTIL, "ddr_device_type read failed");
+		return ret;
+	}
+
+	CAM_DBG(CAM_UTIL, "DDR Type %lld", ddr_type);
+	return ddr_type;
+}
+
+int cam_req_mgr_ordered_list_cmp(void *priv,
+	const struct list_head *head_1, const struct list_head *head_2)
+{
+	return cam_subdev_list_cmp(list_entry(head_1, struct cam_subdev, list),
+		list_entry(head_2, struct cam_subdev, list));
+}
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_i3c_driver_remove(struct i3c_device *client)
+{
+	CAM_DBG(CAM_SENSOR, "I3C remove invoked for %s",
+		(client ? dev_name(&client->dev) : "none"));
+}
+#else
+int cam_i3c_driver_remove(struct i3c_device *client)
+{
+    CAM_DBG(CAM_SENSOR, "I3C remove invoked for %s",
+        (client ? dev_name(&client->dev) : "none"));
+    return 0;
+}
+#endif
+
+long cam_dma_buf_set_name(struct dma_buf *dmabuf, const char *name)
+{
+	return 0;
+}
+
+#ifdef CONFIG_SPECTRA_KT
+int cam_compat_util_get_irq(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	soc_info->irq_num = platform_get_irq(soc_info->pdev, 0);
+	if (soc_info->irq_num < 0) {
+		rc = soc_info->irq_num;
+		return rc;
+	}
+
+	return rc;
+}
+
+#else
+
+int cam_compat_util_get_irq(struct cam_hw_soc_info *soc_info)
+{
+	int rc = 0;
+
+	soc_info->irq_num[0] = platform_get_irq(soc_info->pdev, 0);
+	if (soc_info->irq_num[0] < 0) {
+		rc = soc_info->irq_num[0];
+		return rc;
+	}
+
+	return rc;
+}
+#endif /* ifdef CONFIG_SPECTRA_KT */
+
+#ifdef CONFIG_SPECTRA_PARTIAL_CAMERA
+int cam_get_subpart_info(uint32_t *part_info, uint32_t max_num_cam)
+{
+	int rc = 0;
+	int num_cam;
+
+	num_cam = socinfo_get_part_count(PART_CAMERA);
+	if (num_cam != max_num_cam) {
+		CAM_ERR(CAM_CPAS, "Unsupported number of parts: %d", num_cam);
+		return -EINVAL;
+	}
+
+	/*
+	 * If bit value in part_info is "0" then HW is available.
+	 * If bit value in part_info is "1" then HW is unavailable.
+	 */
+	rc = socinfo_get_subpart_info(PART_CAMERA, part_info, num_cam);
+	if (rc) {
+		CAM_ERR(CAM_CPAS, "Failed while getting subpart_info, rc = %d.", rc);
+		return rc;
+	}
+
+	return 0;
+}
+#else
+int cam_get_subpart_info(uint32_t *part_info, uint32_t max_num_cam)
+{
+	return 0;
+}
+#endif
+
+bool cam_secure_get_vfe_fd_port_config(void)
+{
+	return true;
+}
+
+inline struct icc_path *cam_icc_get_path(struct device *dev,
+		const int src_id, const int dst_id, const char *path_name, bool use_path_name)
+{
+	CAM_DBG(CAM_UTIL, "Get icc path name: %s src_id:%d dst_id:%d use_path_name:%s", path_name,
+		src_id, dst_id, CAM_BOOL_TO_YESNO(use_path_name));
+
+	if (!use_path_name) {
+		CAM_ERR(CAM_UTIL, "Must use path names to get icc path handle");
+		return NULL;
+	}
+
+	return of_icc_get(dev, path_name);
+}
+
+void qcom_clk_dump(struct clk *clk, void *regulator,
+		   bool calltrace)
+{
+	return;
+}
+
+#if CONFIG_SPECTRA_SENSOR
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_actuator_i2c_driver_remove(struct i2c_client *client)
+{
+	cam_actuator_i2c_driver_remove_common(client);
+
+	return;
+}
+#else
+static int32_t cam_actuator_i2c_driver_remove(struct i2c_client *client)
+{
+	int rc = 0;
+
+	rc = cam_actuator_i2c_driver_remove_common(client);
+
+	return rc;
+}
+#endif
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_sensor_i2c_driver_remove(struct i2c_client *client)
+{
+	cam_sensor_i2c_driver_remove_common(client);
+
+	return;
+}
+#else
+static int cam_sensor_i2c_driver_remove(struct i2c_client *client)
+{
+	int rc = 0;
+
+	rc = cam_sensor_i2c_driver_remove_common(client);
+
+	return rc;
+}
+#endif
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_flash_i2c_driver_remove(struct i2c_client *client)
+{
+	cam_flash_i2c_driver_remove_common(client);
+
+	return;
+}
+#else
+static int32_t cam_flash_i2c_driver_remove(struct i2c_client *client)
+{
+	int rc = 0;
+
+	rc = cam_flash_i2c_driver_remove_common(client);
+
+	return rc;
+}
+#endif
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_eeprom_i2c_driver_remove(struct i2c_client *client)
+{
+	cam_eeprom_i2c_driver_remove_common(client);
+
+	return;
+}
+#else
+static int cam_eeprom_i2c_driver_remove(struct i2c_client *client)
+{
+	int rc = 0;
+
+	rc = cam_eeprom_i2c_driver_remove_common(client);
+
+	return rc;
+}
+#endif
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_ois_i2c_driver_remove(struct i2c_client *client)
+{
+	cam_ois_i2c_driver_remove_common(client);
+
+	return;
+}
+#else
+static int cam_ois_i2c_driver_remove(struct i2c_client *client)
+{
+	int rc = 0;
+
+	rc = cam_ois_i2c_driver_remove_common(client);
+
+	return rc;
+}
+#endif
+
+#if KERNEL_VERSION(5, 18, 0) <= LINUX_VERSION_CODE
+void cam_eeprom_spi_driver_remove(struct spi_device *sdev)
+{
+	cam_eeprom_spi_driver_remove_common(sdev);
+
+	return;
+}
+#else
+static int32_t cam_eeprom_spi_driver_remove(struct spi_device *sdev)
+{
+	int rc = 0;
+
+	rc = cam_eeprom_spi_driver_remove_common(sdev);
+
+	return rc;
+}
+#endif
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_compat.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_compat.h
@@ -0,0 +1,149 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2014-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_COMPAT_H_
+#define _CAM_COMPAT_H_
+
+#include <linux/version.h>
+#include <linux/platform_device.h>
+#include <linux/component.h>
+#include <linux/iommu.h>
+#include <linux/list_sort.h>
+#include <linux/spi/spi.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/firmware/qcom/qcom_scm_addon.h>
+
+#include "cam_csiphy_dev.h"
+#include "cam_cpastop_hw.h"
+#include "cam_smmu_api.h"
+
+#include <linux/qcom-dma-mapping.h>
+#include <linux/i3c/master.h>
+
+#include <linux/interconnect.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
+MODULE_IMPORT_NS(DMA_BUF);
+#endif
+
+#ifdef CONFIG_DOMAIN_ID_SECURE_CAMERA
+#include <linux/IClientEnv.h>
+#include <linux/ITrustedCameraDriver.h>
+#include <linux/CTrustedCameraDriver.h>
+#endif
+
+#define IS_CSF25(x, y) ((((x) == 2) && ((y) == 5)) ? 1 : 0)
+
+struct cam_fw_alloc_info {
+	struct device *fw_dev;
+	void          *fw_kva;
+	uint64_t       fw_hdl;
+};
+
+int cam_reserve_icp_fw(struct cam_fw_alloc_info *icp_fw, size_t fw_length);
+void cam_unreserve_icp_fw(struct cam_fw_alloc_info *icp_fw, size_t fw_length);
+int camera_component_match_add_drivers(struct device *master_dev,
+	struct component_match **match_list);
+void cam_check_iommu_faults(struct iommu_domain *domain,
+	struct cam_smmu_pf_info *pf_info);
+void cam_free_clear(const void *);
+int cam_compat_util_get_dmabuf_va(struct dma_buf *dmabuf, uintptr_t *vaddr);
+void cam_compat_util_put_dmabuf_va(struct dma_buf *dmabuf, void *vaddr);
+void cam_smmu_util_iommu_custom(struct device *dev,
+	dma_addr_t discard_start, size_t discard_length);
+int cam_get_ddr_type(void);
+
+int cam_req_mgr_ordered_list_cmp(void *priv,
+	const struct list_head *head_1, const struct list_head *head_2);
+
+int cam_compat_util_get_irq(struct cam_hw_soc_info *soc_info);
+
+long cam_dma_buf_set_name(struct dma_buf *dmabuf, const char *name);
+
+const struct device *cam_cpas_get_rsc_dev_for_drv(uint32_t index);
+
+int cam_cpas_start_drv_for_dev(const struct device *dev);
+
+int cam_cpas_stop_drv_for_dev(const struct device *dev);
+
+int cam_cpas_drv_channel_switch_for_dev(const struct device *dev);
+
+inline struct icc_path *cam_icc_get_path(struct device *dev,
+	const int src_id, const int dst_id, const char *path_name, bool use_path_name);
+
+int cam_update_camnoc_qos_settings(uint32_t use_case_id,
+	uint32_t num_arg, struct qcom_scm_camera_qos *scm_buf);
+
+int camera_i2c_compare_dev(struct device *dev, const void *data);
+
+#ifdef CONFIG_SPECTRA_SECURE
+void cam_cpastop_scm_write(struct cam_cpas_hw_errata_wa *errata_wa);
+int cam_ife_notify_safe_lut_scm(bool safe_trigger);
+int cam_csiphy_notify_secure_mode(struct csiphy_device *csiphy_dev,
+	bool protect, int32_t offset);
+#endif /* CONFIG_SPECTRA_SECURE */
+
+void qcom_clk_dump(struct clk *clk, void *regulator,
+		   bool calltrace);
+
+int cam_actuator_i2c_driver_remove_common(struct i2c_client *client);
+int cam_eeprom_i2c_driver_remove_common(struct i2c_client *client);
+int cam_flash_i2c_driver_remove_common(struct i2c_client *client);
+int cam_ois_i2c_driver_remove_common(struct i2c_client *client);
+int cam_sensor_i2c_driver_remove_common(struct i2c_client *client);
+int cam_eeprom_spi_driver_remove_common(struct spi_device *sdev);
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_i3c_driver_remove(struct i3c_device *client);
+#else
+int cam_i3c_driver_remove(struct i3c_device *client);
+#endif
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_actuator_i2c_driver_remove(struct i2c_client *client);
+#else
+static int32_t cam_actuator_i2c_driver_remove(struct i2c_client *client);
+#endif
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_eeprom_i2c_driver_remove(struct i2c_client *client);
+#else
+static int32_t cam_eeprom_i2c_driver_remove(struct i2c_client *client);
+#endif
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_flash_i2c_driver_remove(struct i2c_client *client);
+#else
+static int32_t cam_flash_i2c_driver_remove(struct i2c_client *client);
+#endif
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_ois_i2c_driver_remove(struct i2c_client *client);
+#else
+static int32_t cam_ois_i2c_driver_remove(struct i2c_client *client);
+#endif
+
+#if KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE
+void cam_sensor_i2c_driver_remove(struct i2c_client *client);
+#else
+static int32_t cam_sensor_i2c_driver_remove(struct i2c_client *client);
+#endif
+
+#if KERNEL_VERSION(5, 18, 0) <= LINUX_VERSION_CODE
+void cam_eeprom_spi_driver_remove(struct spi_device *sdev);
+#else
+static int32_t cam_eeprom_spi_driver_remove(struct spi_device *sdev);
+#endif
+
+#ifndef CONFIG_SPECTRA_KT
+int cam_smmu_fetch_csf_version(struct cam_csf_version *csf_version);
+#endif /* ifndef CONFIG_SPECTRA_KT */
+
+bool cam_secure_get_vfe_fd_port_config(void);
+unsigned long cam_update_dma_map_attributes(unsigned long attr);
+size_t cam_align_dma_buf_size(size_t len);
+int cam_get_subpart_info(uint32_t *part_info, uint32_t max_num_cam);
+#endif /* _CAM_COMPAT_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_debug_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_debug_util.c
@@ -0,0 +1,351 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2020, The Linux Foundataion. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/debugfs.h>
+#include "cam_trace.h"
+
+#include "cam_debug_util.h"
+
+unsigned long long debug_mdl;
+module_param(debug_mdl, ullong, 0644);
+
+/* 0x0 - only logs, 0x1 - only trace, 0x2 - logs + trace */
+uint debug_type;
+module_param(debug_type, uint, 0644);
+
+uint debug_priority;
+module_param(debug_priority, uint, 0644);
+
+uint debug_drv;
+module_param(debug_drv, uint, 0644);
+
+uint debug_bypass_drivers;
+module_param(debug_bypass_drivers, uint, 0644);
+
+struct camera_debug_settings cam_debug;
+
+struct dentry *cam_debugfs_root;
+
+static const char *cam_debug_mod_name[CAM_DBG_MOD_MAX] = {
+	[CAM_CDM]         = "CAM-CDM",
+	[CAM_CORE]        = "CAM-CORE",
+	[CAM_CRM]         = "CAM-CRM",
+	[CAM_CPAS]        = "CAM-CPAS",
+	[CAM_ISP]         = "CAM-ISP",
+	[CAM_SENSOR]      = "CAM-SENSOR",
+	[CAM_SMMU]        = "CAM-SMMU",
+	[CAM_SYNC]        = "CAM-SYNC",
+	[CAM_ICP]         = "CAM-ICP",
+	[CAM_JPEG]        = "CAM-JPEG",
+	[CAM_FD]          = "CAM-FD",
+	[CAM_LRME]        = "CAM-LRME",
+	[CAM_FLASH]       = "CAM-FLASH",
+	[CAM_ACTUATOR]    = "CAM-ACTUATOR",
+	[CAM_CCI]         = "CAM-CCI",
+	[CAM_CSIPHY]      = "CAM-CSIPHY",
+	[CAM_EEPROM]      = "CAM-EEPROM",
+	[CAM_UTIL]        = "CAM-UTIL",
+	[CAM_CTXT]        = "CAM-CTXT",
+	[CAM_HFI]         = "CAM-HFI",
+	[CAM_OIS]         = "CAM-OIS",
+	[CAM_IRQ_CTRL]    = "CAM-IRQ-CTRL",
+	[CAM_MEM]         = "CAM-MEM",
+	[CAM_PERF]        = "CAM-PERF",
+	[CAM_REQ]         = "CAM-REQ",
+	[CAM_CUSTOM]      = "CAM-CUSTOM",
+	[CAM_OPE]         = "CAM-OPE",
+	[CAM_PRESIL]      = "CAM-PRESIL",
+	[CAM_RES]         = "CAM-RES",
+	[CAM_IO_ACCESS]   = "CAM-IO-ACCESS",
+	[CAM_SFE]         = "CAM-SFE",
+	[CAM_CRE]         = "CAM-CRE",
+	[CAM_PRESIL_CORE] = "CAM-CORE-PRESIL",
+	[CAM_TPG]         = "CAM-TPG",
+	[CAM_DMA_FENCE]   = "CAM-DMA-FENCE",
+	[CAM_SENSOR_UTIL] = "CAM-SENSOR-UTIL",
+	[CAM_SYNX]        = "CAM_SYNX",
+};
+
+static const char *cam_debug_tag_name[CAM_TYPE_MAX] = {
+	[CAM_TYPE_TRACE] = "CAM_TRACE",
+	[CAM_TYPE_ERR]   = "CAM_ERR",
+	[CAM_TYPE_WARN]  = "CAM_WARN",
+	[CAM_TYPE_INFO]  = "CAM_INFO",
+	[CAM_TYPE_DBG]   = "CAM_DBG",
+};
+
+#define CAM_DBG_MOD_NAME(module_id) \
+((module_id < CAM_DBG_MOD_MAX) ? cam_debug_mod_name[module_id] : "CAMERA")
+
+#define CAM_LOG_TAG_NAME(tag) ((tag < CAM_TYPE_MAX) ? cam_debug_tag_name[tag] : "CAM_LOG")
+
+void cam_debugfs_init(void)
+{
+	struct dentry *tmp;
+
+	if (!cam_debugfs_available()) {
+		cam_debugfs_root = NULL;
+		CAM_DBG(CAM_UTIL, "debugfs not available");
+		return;
+	}
+
+	if (cam_debugfs_root) {
+		CAM_WARN(CAM_UTIL, "already created debugfs root");
+		return;
+	}
+
+	tmp = debugfs_create_dir("camera", NULL);
+	if (IS_ERR_VALUE(tmp)) {
+		CAM_ERR(CAM_UTIL, "failed to create debugfs root folder (rc=%d)", PTR_ERR(tmp));
+		return;
+	}
+
+	cam_debugfs_root = tmp;
+	CAM_DBG(CAM_UTIL, "successfully created debugfs root");
+}
+
+void cam_debugfs_deinit(void)
+{
+	if (!cam_debugfs_available())
+		return;
+
+	debugfs_remove_recursive(cam_debugfs_root);
+	cam_debugfs_root = NULL;
+}
+
+int cam_debugfs_create_subdir(const char *name, struct dentry **subdir)
+{
+	struct dentry *tmp;
+
+	if (!cam_debugfs_root) {
+		CAM_WARN(CAM_UTIL, "debugfs root not created");
+		*subdir = NULL;
+		return -ENODEV;
+	}
+
+	if (!subdir) {
+		CAM_ERR(CAM_UTIL, "invalid subdir pointer %pK", subdir);
+		return -EINVAL;
+	}
+
+	tmp = debugfs_create_dir(name, cam_debugfs_root);
+	if (IS_ERR_VALUE(tmp)) {
+		CAM_ERR(CAM_UTIL, "failed to create debugfs subdir (name=%s, rc=%d)", name,
+			PTR_ERR(tmp));
+		return PTR_ERR(tmp);
+	}
+
+	*subdir = tmp;
+	return 0;
+}
+
+int cam_debugfs_lookup_subdir(const char *name, struct dentry **subdir)
+{
+	if (!cam_debugfs_root) {
+		CAM_WARN(CAM_UTIL, "debugfs root not created");
+		*subdir = NULL;
+		return -ENODEV;
+	}
+
+	if (!subdir) {
+		CAM_ERR(CAM_UTIL, "invalid subdir pointer %pK", subdir);
+		return -EINVAL;
+	}
+
+	*subdir = debugfs_lookup(name, cam_debugfs_root);
+	return (*subdir) ? 0 : -ENOENT;
+}
+
+const struct camera_debug_settings *cam_debug_get_settings(void)
+{
+	return &cam_debug;
+}
+
+static int cam_debug_parse_cpas_settings(const char *setting, u64 value)
+{
+	if (!strcmp(setting, "camnoc_bw")) {
+		cam_debug.cpas_settings.camnoc_bw = value;
+	} else if (!strcmp(setting, "mnoc_hf_0_ab_bw")) {
+		cam_debug.cpas_settings.mnoc_hf_0_ab_bw = value;
+	} else if (!strcmp(setting, "mnoc_hf_0_ib_bw")) {
+		cam_debug.cpas_settings.mnoc_hf_0_ib_bw = value;
+	} else if (!strcmp(setting, "mnoc_hf_1_ab_bw")) {
+		cam_debug.cpas_settings.mnoc_hf_1_ab_bw = value;
+	} else if (!strcmp(setting, "mnoc_hf_1_ib_bw")) {
+		cam_debug.cpas_settings.mnoc_hf_1_ib_bw = value;
+	} else if (!strcmp(setting, "mnoc_sf_0_ab_bw")) {
+		cam_debug.cpas_settings.mnoc_sf_0_ab_bw = value;
+	} else if (!strcmp(setting, "mnoc_sf_0_ib_bw")) {
+		cam_debug.cpas_settings.mnoc_sf_0_ib_bw = value;
+	} else if (!strcmp(setting, "mnoc_sf_1_ab_bw")) {
+		cam_debug.cpas_settings.mnoc_sf_1_ab_bw = value;
+	} else if (!strcmp(setting, "mnoc_sf_1_ib_bw")) {
+		cam_debug.cpas_settings.mnoc_sf_1_ib_bw = value;
+	} else if (!strcmp(setting, "mnoc_sf_icp_ab_bw")) {
+		cam_debug.cpas_settings.mnoc_sf_icp_ab_bw = value;
+	} else if (!strcmp(setting, "mnoc_sf_icp_ib_bw")) {
+		cam_debug.cpas_settings.mnoc_sf_icp_ib_bw = value;
+	} else if (!strcmp(setting, "cam_ife_0_drv_ab_high_bw")) {
+		cam_debug.cpas_settings.cam_ife_0_drv_ab_high_bw = value;
+	} else if (!strcmp(setting, "cam_ife_0_drv_ib_high_bw")) {
+		cam_debug.cpas_settings.cam_ife_0_drv_ib_high_bw = value;
+	} else if (!strcmp(setting, "cam_ife_1_drv_ab_high_bw")) {
+		cam_debug.cpas_settings.cam_ife_1_drv_ab_high_bw = value;
+	} else if (!strcmp(setting, "cam_ife_1_drv_ib_high_bw")) {
+		cam_debug.cpas_settings.cam_ife_1_drv_ib_high_bw = value;
+	} else if (!strcmp(setting, "cam_ife_2_drv_ab_high_bw")) {
+		cam_debug.cpas_settings.cam_ife_2_drv_ab_high_bw = value;
+	} else if (!strcmp(setting, "cam_ife_2_drv_ib_high_bw")) {
+		cam_debug.cpas_settings.cam_ife_2_drv_ib_high_bw = value;
+	} else if (!strcmp(setting, "cam_ife_0_drv_ab_low_bw")) {
+		cam_debug.cpas_settings.cam_ife_0_drv_ab_low_bw = value;
+	} else if (!strcmp(setting, "cam_ife_0_drv_ib_low_bw")) {
+		cam_debug.cpas_settings.cam_ife_0_drv_ib_low_bw = value;
+	} else if (!strcmp(setting, "cam_ife_1_drv_ab_low_bw")) {
+		cam_debug.cpas_settings.cam_ife_1_drv_ab_low_bw = value;
+	} else if (!strcmp(setting, "cam_ife_1_drv_ib_low_bw")) {
+		cam_debug.cpas_settings.cam_ife_1_drv_ib_low_bw = value;
+	} else if (!strcmp(setting, "cam_ife_2_drv_ab_low_bw")) {
+		cam_debug.cpas_settings.cam_ife_2_drv_ab_low_bw = value;
+	} else if (!strcmp(setting, "cam_ife_2_drv_ib_low_bw")) {
+		cam_debug.cpas_settings.cam_ife_2_drv_ib_low_bw = value;
+	} else if (!strcmp(setting, "cam_ife_0_drv_low_set_zero")) {
+		cam_debug.cpas_settings.cam_ife_0_drv_low_set_zero = value;
+	} else if (!strcmp(setting, "cam_ife_1_drv_low_set_zero")) {
+		cam_debug.cpas_settings.cam_ife_1_drv_low_set_zero = value;
+	} else if (!strcmp(setting, "cam_ife_2_drv_low_set_zero")) {
+		cam_debug.cpas_settings.cam_ife_2_drv_low_set_zero = value;
+	} else {
+		CAM_ERR(CAM_UTIL, "Unsupported cpas sysfs entry");
+		return -EINVAL;
+	}
+
+	cam_debug.cpas_settings.is_updated = true;
+	return 0;
+}
+
+ssize_t cam_debug_sysfs_node_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count)
+{
+	int rc = 0;
+	char *local_buf = NULL, *local_buf_temp = NULL;
+	char *driver;
+	char *setting = NULL;
+	char *value_str = NULL;
+	u64 value;
+
+	CAM_INFO(CAM_UTIL, "Sysfs debug attr name:[%s] buf:[%s] bytes:[%zu]",
+		attr->attr.name, buf, count);
+	local_buf = kmemdup(buf, (count + sizeof(char)), GFP_KERNEL);
+	local_buf_temp = local_buf;
+	driver = strsep(&local_buf, "#");
+	if (!driver) {
+		CAM_ERR(CAM_UTIL,
+			"Invalid input driver name buf:[%s], count:%zu",
+			buf, count);
+		goto error;
+	}
+
+	setting = strsep(&local_buf, "=");
+	if (!setting) {
+		CAM_ERR(CAM_UTIL, "Invalid input setting buf:[%s], count:%zu",
+			buf, count);
+		goto error;
+	}
+
+	value_str = strsep(&local_buf, "=");
+	if (!value_str) {
+		CAM_ERR(CAM_UTIL, "Invalid input value buf:[%s], count:%zu",
+			buf, count);
+		goto error;
+	}
+
+	rc = kstrtou64(value_str, 0, &value);
+	if (rc < 0) {
+		CAM_ERR(CAM_UTIL, "Error converting value:[%s], buf:[%s]",
+			value_str, buf);
+		goto error;
+	}
+
+	CAM_INFO(CAM_UTIL,
+		"Processing sysfs store for driver:[%s], setting:[%s], value:[%llu]",
+		driver, setting, value);
+
+	if (!strcmp(driver, "cpas")) {
+		rc = cam_debug_parse_cpas_settings(setting, value);
+		if (rc)
+			goto error;
+	} else {
+		CAM_ERR(CAM_UTIL, "Unsupported driver in camera debug node");
+		goto error;
+	}
+
+	kfree(local_buf_temp);
+	return count;
+
+error:
+	kfree(local_buf_temp);
+	return -EPERM;
+}
+
+static inline void __cam_print_to_buffer(char *buf, const size_t buf_size, size_t *len,
+	unsigned int tag, enum cam_debug_module_id module_id, const char *fmt, va_list args)
+{
+	size_t buf_len = *len;
+
+	buf_len += scnprintf(buf + buf_len, (buf_size - buf_len), "\n%-8s: %s:\t",
+			CAM_LOG_TAG_NAME(tag), CAM_DBG_MOD_NAME(module_id));
+	buf_len += vscnprintf(buf + buf_len, (buf_size - buf_len), fmt, args);
+	*len = buf_len;
+}
+
+void cam_print_to_buffer(char *buf, const size_t buf_size, size_t *len, unsigned int tag,
+	unsigned long long module_id, const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	__cam_print_to_buffer(buf, buf_size, len, tag, module_id, fmt, args);
+	va_end(args);
+}
+
+static void __cam_print_log(int type, const char *fmt, ...)
+{
+	va_list args1, args2, args;
+
+	va_start(args, fmt);
+	va_copy(args1, args);
+	va_copy(args2, args1);
+	if ((type & CAM_PRINT_LOG) && (debug_type != 1))
+		vprintk(fmt, args1);
+	if ((type & CAM_PRINT_TRACE) && (debug_type != 0)) {
+		/* skip the first character which is used by printk to identify the log level */
+		trace_cam_log_debug(fmt + sizeof(KERN_INFO) - 1, &args2);
+	}
+	va_end(args2);
+	va_end(args1);
+	va_end(args);
+}
+
+void cam_print_log(int type, int module, int tag, const char *func,
+	int line, const char *fmt, ...)
+{
+	char buf[CAM_LOG_BUF_LEN] = {0,};
+	va_list args;
+
+	if (!type)
+		return;
+
+	va_start(args, fmt);
+	vscnprintf(buf, CAM_LOG_BUF_LEN, fmt, args);
+	__cam_print_log(type, __CAM_LOG_FMT,
+		CAM_LOG_TAG_NAME(tag), CAM_DBG_MOD_NAME(module), func,
+		line, buf);
+	va_end(args);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_debug_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_debug_util.h
@@ -0,0 +1,392 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_DEBUG_UTIL_H_
+#define _CAM_DEBUG_UTIL_H_
+
+#include <msm-camera.h>
+#include <linux/platform_device.h>
+#include "cam_trace.h"
+
+#ifndef CONFIG_SPECTRA_KT
+#include "cam_presil_hw_access.h"
+#endif // !CONFIG_SPECTRA_KT
+
+extern unsigned long long debug_mdl;
+extern unsigned int debug_type;
+extern unsigned int debug_priority;
+extern unsigned int debug_drv;
+extern unsigned int debug_bypass_drivers;
+
+#define CAM_IS_NULL_TO_STR(ptr) ((ptr) ? "Non-NULL" : "NULL")
+
+#define CAM_LOG_BUF_LEN                  512
+#define BYPASS_VALUE       0xDEADBEEF
+#define DEFAULT_CLK_VALUE  19200000
+
+/* Module IDs used for debug logging */
+enum cam_debug_module_id {
+	CAM_CDM,                 /* bit 0 */
+	CAM_CORE,                /* bit 1 */
+	CAM_CPAS,                /* bit 2 */
+	CAM_ISP,                 /* bit 3 */
+	CAM_CRM,                 /* bit 4 */
+	CAM_SENSOR,              /* bit 5 */
+	CAM_SMMU,                /* bit 6 */
+	CAM_SYNC,                /* bit 7 */
+	CAM_ICP,                 /* bit 8 */
+	CAM_JPEG,                /* bit 9 */
+	CAM_FD,                  /* bit 10 */
+	CAM_LRME,                /* bit 11 */
+	CAM_FLASH,               /* bit 12 */
+	CAM_ACTUATOR,            /* bit 13 */
+	CAM_CCI,                 /* bit 14 */
+	CAM_CSIPHY,              /* bit 15 */
+	CAM_EEPROM,              /* bit 16 */
+	CAM_UTIL,                /* bit 17 */
+	CAM_HFI,                 /* bit 18 */
+	CAM_CTXT,                /* bit 19 */
+	CAM_OIS,                 /* bit 20 */
+	CAM_RES,                 /* bit 21 */
+	CAM_MEM,                 /* bit 22 */
+	CAM_IRQ_CTRL,            /* bit 23 */
+	CAM_REQ,                 /* bit 24 */
+	CAM_PERF,                /* bit 25 */
+	CAM_CUSTOM,              /* bit 26 */
+	CAM_PRESIL,              /* bit 27 */
+	CAM_OPE,                 /* bit 28 */
+	CAM_IO_ACCESS,           /* bit 29 */
+	CAM_SFE,                 /* bit 30 */
+	CAM_IR_LED,              /* bit 31 */
+	CAM_CRE,                 /* bit 32 */
+	CAM_PRESIL_CORE,         /* bit 33 */
+	CAM_TPG,                 /* bit 34 */
+	CAM_DMA_FENCE,           /* bit 35 */
+	CAM_SENSOR_UTIL,         /* bit 36 */
+	CAM_SYNX,                /* bit 37 */
+	CAM_DBG_MOD_MAX
+};
+
+/* Log level types */
+enum cam_debug_log_level {
+	CAM_TYPE_TRACE,
+	CAM_TYPE_ERR,
+	CAM_TYPE_WARN,
+	CAM_TYPE_INFO,
+	CAM_TYPE_DBG,
+	CAM_TYPE_MAX,
+};
+
+/*
+ * enum cam_debug_priority - Priority of debug log (0 = Lowest)
+ */
+enum cam_debug_priority {
+	CAM_DBG_PRIORITY_0,
+	CAM_DBG_PRIORITY_1,
+	CAM_DBG_PRIORITY_2,
+};
+
+#define ___CAM_DBG_MOD_NAME(module_id)                                      \
+__builtin_choose_expr(((module_id) == CAM_CDM), "CAM-CDM",                  \
+__builtin_choose_expr(((module_id) == CAM_CORE), "CAM-CORE",                \
+__builtin_choose_expr(((module_id) == CAM_CRM), "CAM-CRM",                  \
+__builtin_choose_expr(((module_id) == CAM_CPAS), "CAM-CPAS",                \
+__builtin_choose_expr(((module_id) == CAM_ISP), "CAM-ISP",                  \
+__builtin_choose_expr(((module_id) == CAM_SENSOR), "CAM-SENSOR",            \
+__builtin_choose_expr(((module_id) == CAM_SMMU), "CAM-SMMU",                \
+__builtin_choose_expr(((module_id) == CAM_SYNC), "CAM-SYNC",                \
+__builtin_choose_expr(((module_id) == CAM_ICP), "CAM-ICP",                  \
+__builtin_choose_expr(((module_id) == CAM_JPEG), "CAM-JPEG",                \
+__builtin_choose_expr(((module_id) == CAM_FD), "CAM-FD",                    \
+__builtin_choose_expr(((module_id) == CAM_LRME), "CAM-LRME",                \
+__builtin_choose_expr(((module_id) == CAM_FLASH), "CAM-FLASH",              \
+__builtin_choose_expr(((module_id) == CAM_ACTUATOR), "CAM-ACTUATOR",        \
+__builtin_choose_expr(((module_id) == CAM_CCI), "CAM-CCI",                  \
+__builtin_choose_expr(((module_id) == CAM_CSIPHY), "CAM-CSIPHY",            \
+__builtin_choose_expr(((module_id) == CAM_EEPROM), "CAM-EEPROM",            \
+__builtin_choose_expr(((module_id) == CAM_UTIL), "CAM-UTIL",                \
+__builtin_choose_expr(((module_id) == CAM_CTXT), "CAM-CTXT",                \
+__builtin_choose_expr(((module_id) == CAM_HFI), "CAM-HFI",                  \
+__builtin_choose_expr(((module_id) == CAM_OIS), "CAM-OIS",                  \
+__builtin_choose_expr(((module_id) == CAM_IRQ_CTRL), "CAM-IRQ-CTRL",        \
+__builtin_choose_expr(((module_id) == CAM_MEM), "CAM-MEM",                  \
+__builtin_choose_expr(((module_id) == CAM_PERF), "CAM-PERF",                \
+__builtin_choose_expr(((module_id) == CAM_REQ), "CAM-REQ",                  \
+__builtin_choose_expr(((module_id) == CAM_CUSTOM), "CAM-CUSTOM",            \
+__builtin_choose_expr(((module_id) == CAM_OPE), "CAM-OPE",                  \
+__builtin_choose_expr(((module_id) == CAM_PRESIL), "CAM-PRESIL",            \
+__builtin_choose_expr(((module_id) == CAM_RES), "CAM-RES",                  \
+__builtin_choose_expr(((module_id) == CAM_IO_ACCESS), "CAM-IO-ACCESS",      \
+__builtin_choose_expr(((module_id) == CAM_SFE), "CAM-SFE",                  \
+__builtin_choose_expr(((module_id) == CAM_CRE), "CAM-CRE",                  \
+__builtin_choose_expr(((module_id) == CAM_PRESIL_CORE), "CAM-CORE-PRESIL",  \
+__builtin_choose_expr(((module_id) == CAM_TPG), "CAM-TPG",                  \
+__builtin_choose_expr(((module_id) == CAM_DMA_FENCE), "CAM-DMA-FENCE",      \
+__builtin_choose_expr(((module_id) == CAM_SENSOR_UTIL), "CAM-SENSOR-UTIL",      \
+__builtin_choose_expr(((module_id) == CAM_SYNX), "CAM-SYNX",                \
+"CAMERA")))))))))))))))))))))))))))))))))))))
+
+enum cam_log_print_type {
+	CAM_PRINT_LOG   = 0x1,
+	CAM_PRINT_TRACE = 0x2,
+	CAM_PRINT_BOTH  = 0x3,
+};
+
+#define __CAM_LOG_FMT KERN_INFO "%s: %s: %s: %d: %s "
+
+/**
+ * cam_print_log() - function to print logs (internal use only, use macros instead)
+ *
+ * @type:      Corresponds to enum cam_log_print_type, selects if logs are printed in log buffer,
+ *        trace buffers or both
+ * @module_id: Module calling the log macro
+ * @tag:       Tag for log level
+ * @func:      Function string
+ * @line:      Line number
+ * @fmt:       Formatting string
+ */
+
+void cam_print_log(int type, int module, int tag, const char *func,
+	int line, const char *fmt, ...);
+
+#define __CAM_LOG(type, tag, module_id, fmt, args...)                               \
+({                                                                                  \
+	cam_print_log(type,                                      \
+		module_id, tag, __func__,   \
+		__LINE__,  fmt, ##args);                                                  \
+})
+
+#define CAM_LOG(tag, module_id, fmt, args...) \
+__CAM_LOG(CAM_PRINT_BOTH, tag, module_id, fmt, ##args)
+
+#define CAM_LOG_RL_CUSTOM(type, module_id, interval, burst, fmt, args...)                \
+({                                                                                       \
+	static DEFINE_RATELIMIT_STATE(_rs, (interval * HZ), burst);                      \
+	__CAM_LOG(__ratelimit(&_rs) ? CAM_PRINT_BOTH : CAM_PRINT_TRACE,                  \
+		type, module_id, fmt, ##args);                                           \
+})
+
+#define CAM_LOG_RL(type, module_id, fmt, args...)                                        \
+CAM_LOG_RL_CUSTOM(type, module_id, DEFAULT_RATELIMIT_INTERVAL, DEFAULT_RATELIMIT_BURST,  \
+fmt, ##args)
+
+#define __CAM_DBG(module_id, priority, fmt, args...)                                              \
+({                                                                                                \
+	if (unlikely((debug_mdl & BIT_ULL(module_id)) && (priority >= debug_priority))) {         \
+		CAM_LOG(CAM_TYPE_DBG, module_id, fmt, ##args);                                    \
+	}                                                                                         \
+})
+
+/**
+ * CAM_ERR / CAM_WARN / CAM_INFO / CAM_TRACE
+ *
+ * @brief: Macros to print logs at respective level error/warn/info/trace. All
+ * logs except CAM_TRACE are printed in both log and trace buffers.
+ *
+ * @__module: Respective enum cam_debug_module_id
+ * @fmt:      Format string
+ * @args:     Arguments to match with format
+ */
+#define CAM_ERR(__module, fmt, args...)  CAM_LOG(CAM_TYPE_ERR, __module, fmt, ##args)
+#define CAM_WARN(__module, fmt, args...) CAM_LOG(CAM_TYPE_WARN, __module, fmt, ##args)
+#define CAM_INFO(__module, fmt, args...) CAM_LOG(CAM_TYPE_INFO, __module, fmt, ##args)
+#define CAM_TRACE(__module, fmt, args...) \
+__CAM_LOG(CAM_PRINT_TRACE, CAM_TYPE_TRACE, __module, fmt, ##args)
+
+/**
+ * CAM_ERR_RATE_LIMIT / CAM_WARN_RATE_LIMIT / CAM_INFO_RATE_LIMIT
+ *
+ * @brief: Rate limited version of logs used to reduce log spew.
+ *
+ * @__module: Respective enum cam_debug_module_id
+ * @fmt:      Format string
+ * @args:     Arguments to match with format
+ */
+#define CAM_ERR_RATE_LIMIT(__module, fmt, args...)  CAM_LOG_RL(CAM_TYPE_ERR, __module, fmt, ##args)
+#define CAM_WARN_RATE_LIMIT(__module, fmt, args...) CAM_LOG_RL(CAM_TYPE_WARN, __module, fmt, ##args)
+#define CAM_INFO_RATE_LIMIT(__module, fmt, args...) CAM_LOG_RL(CAM_TYPE_INFO, __module, fmt, ##args)
+
+/**
+ * CAM_ERR_RATE_LIMIT_CUSTOM / CAM_WARN_RATE_LIMITT_CUSTOM/ CAM_INFO_RATE_LIMITT_CUSTOM
+ *
+ * @brief: Rate limited version of logs used to reduce log spew that can have
+ * customized burst rate
+ *
+ * @__module: Respective enum cam_debug_module_id
+ * @interval: Sliding window interval in which to count logs
+ * @burst:    Maximum number of logs in the specified interval
+ * @fmt:      Format string
+ * @args:     Arguments to match with format
+ */
+#define CAM_ERR_RATE_LIMIT_CUSTOM(__module, interval, burst, fmt, args...)  \
+	CAM_LOG_RL_CUSTOM(CAM_TYPE_ERR, __module, interval, burst, fmt, ##args)
+
+#define CAM_WARN_RATE_LIMIT_CUSTOM(__module, interval, burst, fmt, args...) \
+	CAM_LOG_RL_CUSTOM(CAM_TYPE_WARN, __module, interval, burst, fmt, ##args)
+
+#define CAM_INFO_RATE_LIMIT_CUSTOM(__module, interval, burst, fmt, args...) \
+	CAM_LOG_RL_CUSTOM(CAM_TYPE_INFO, __module, interval, burst, fmt, ##args)
+
+/*
+ * CAM_DBG
+ * @brief    :  This Macro will print debug logs when enabled using GROUP and
+ *              if its priority is greater than the priority parameter
+ *
+ * @__module :  Respective module id which is been calling this Macro
+ * @fmt      :  Formatted string which needs to be print in log
+ * @args     :  Arguments which needs to be print in log
+ */
+#define CAM_DBG(__module, fmt, args...)     __CAM_DBG(__module, CAM_DBG_PRIORITY_0, fmt, ##args)
+#define CAM_DBG_PR1(__module, fmt, args...) __CAM_DBG(__module, CAM_DBG_PRIORITY_1, fmt, ##args)
+#define CAM_DBG_PR2(__module, fmt, args...) __CAM_DBG(__module, CAM_DBG_PRIORITY_2, fmt, ##args)
+
+/**
+ * cam_print_to_buffer
+ * @brief:         Function to print to camera logs to a buffer. Don't use directly. Use macros
+ *                 provided below.
+ *
+ * @buf:           Buffer to print into
+ * @buf_size:      Total size of the buffer
+ * @len:           Pointer to variable used to keep track of the length
+ * @tag:           Log level tag to be prefixed
+ * @module_id:     Module id tag to be prefixed
+ * @fmt:           Formatted string which needs to be print in log
+ * @args:          Arguments which needs to be print in log
+ */
+void cam_print_to_buffer(char *buf, const size_t buf_size, size_t *len, unsigned int tag,
+	unsigned long long module_id, const char *fmt, ...);
+
+/**
+ * CAM_[ERR/WARN/INFO]_BUF
+ * @brief:         Macro to print a new line into log buffer.
+ *
+ * @module_id:     Module id tag to be prefixed
+ * @buf:           Buffer to print into
+ * @buf_size:      Total size of the buffer
+ * @len:           Pointer to the variable used to keep track of the length
+ * @fmt:           Formatted string which needs to be print in log
+ * @args:          Arguments which needs to be print in log
+ */
+#define CAM_ERR_BUF(module_id, buf, buf_size, len, fmt, args...)                                   \
+	cam_print_to_buffer(buf, buf_size, len, CAM_TYPE_ERR, module_id, fmt, ##args)
+#define CAM_WARN_BUF(module_id, buf, buf_size, len, fmt, args...)                                  \
+	cam_print_to_buffer(buf, buf_size, len, CAM_TYPE_WARN, module_id, fmt, ##args)
+#define CAM_INFO_BUF(module_id, buf, buf_size, len, fmt, args...)                                  \
+	cam_print_to_buffer(buf, buf_size, len, CAM_TYPE_INFO, module_id, fmt, ##args)
+
+#define CAM_BOOL_TO_YESNO(val) ((val) ? "Y" : "N")
+
+/**
+ * struct cam_cpas_debug_settings - Sysfs debug settings for cpas driver
+ */
+struct cam_cpas_debug_settings {
+	uint64_t mnoc_hf_0_ab_bw;
+	uint64_t mnoc_hf_0_ib_bw;
+	uint64_t mnoc_hf_1_ab_bw;
+	uint64_t mnoc_hf_1_ib_bw;
+	uint64_t mnoc_sf_0_ab_bw;
+	uint64_t mnoc_sf_0_ib_bw;
+	uint64_t mnoc_sf_1_ab_bw;
+	uint64_t mnoc_sf_1_ib_bw;
+	uint64_t mnoc_sf_icp_ab_bw;
+	uint64_t mnoc_sf_icp_ib_bw;
+	uint64_t camnoc_bw;
+	uint64_t cam_ife_0_drv_ab_high_bw;
+	uint64_t cam_ife_0_drv_ib_high_bw;
+	uint64_t cam_ife_1_drv_ab_high_bw;
+	uint64_t cam_ife_1_drv_ib_high_bw;
+	uint64_t cam_ife_2_drv_ab_high_bw;
+	uint64_t cam_ife_2_drv_ib_high_bw;
+	uint64_t cam_ife_0_drv_ab_low_bw;
+	uint64_t cam_ife_0_drv_ib_low_bw;
+	uint64_t cam_ife_1_drv_ab_low_bw;
+	uint64_t cam_ife_1_drv_ib_low_bw;
+	uint64_t cam_ife_2_drv_ab_low_bw;
+	uint64_t cam_ife_2_drv_ib_low_bw;
+	uint64_t cam_ife_0_drv_low_set_zero;
+	uint64_t cam_ife_1_drv_low_set_zero;
+	uint64_t cam_ife_2_drv_low_set_zero;
+	bool     is_updated;
+};
+
+/**
+ * struct camera_debug_settings - Sysfs debug settings for camera
+ *
+ * @cpas_settings: Debug settings for cpas driver.
+ */
+struct camera_debug_settings {
+	struct cam_cpas_debug_settings cpas_settings;
+};
+
+/**
+ * @brief : API to get camera debug settings
+ * @return const struct camera_debug_settings pointer.
+ */
+const struct camera_debug_settings *cam_debug_get_settings(void);
+
+/**
+ * @brief : API to parse and store input from sysfs debug node
+ * @return Number of bytes read from buffer on success, or -EPERM on error.
+ */
+ssize_t cam_debug_sysfs_node_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count);
+
+/**
+ * cam_debugfs_init()
+ *
+ * @brief: create camera debugfs root folder
+ */
+void cam_debugfs_init(void);
+
+/**
+ * cam_debugfs_deinit()
+ *
+ * @brief: remove camera debugfs root folder
+ */
+void cam_debugfs_deinit(void);
+
+/**
+ * cam_debugfs_create_subdir()
+ *
+ * @brief:  create a directory within the camera debugfs root folder
+ *
+ * @name:   name of the directory
+ * @subdir: pointer to the newly created directory entry
+ *
+ * @return: 0 on success, negative on failure
+ */
+int cam_debugfs_create_subdir(const char *name, struct dentry **subdir);
+
+/**
+ * cam_debugfs_lookup_subdir()
+ *
+ * @brief:  lookup a directory within the camera debugfs root folder
+ *
+ * @name:   name of the directory
+ * @subdir: pointer to the successfully found directory entry
+ *
+ * @return: 0 on success, negative on failure
+ */
+int cam_debugfs_lookup_subdir(const char *name, struct dentry **subdir);
+
+/**
+ * cam_debugfs_available()
+ *
+ * @brief:  Check if debugfs is enabled for camera. Use this function before creating any
+ *          debugfs entries.
+ *
+ * @return: true if enabled, false otherwise
+ */
+static inline bool cam_debugfs_available(void)
+{
+	#if defined(CONFIG_DEBUG_FS)
+		return true;
+	#else
+		return false;
+	#endif
+}
+
+#endif /* _CAM_DEBUG_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_io_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_io_util.c
@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2011-2014, 2017-2018, 2020, The Linux Foundation.
+ * All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/err.h>
+#include "cam_io_util.h"
+#include "cam_debug_util.h"
+
+int cam_io_w(uint32_t data, void __iomem *addr)
+{
+	if (!addr)
+		return -EINVAL;
+
+	CAM_DBG(CAM_IO_ACCESS, "0x%pK %08x", addr, data);
+	writel_relaxed(data, addr);
+
+	return 0;
+}
+
+int cam_io_w_mb(uint32_t data, void __iomem *addr)
+{
+	if (!addr)
+		return -EINVAL;
+
+	CAM_DBG(CAM_IO_ACCESS, "0x%pK %08x", addr, data);
+	writel(data, addr);
+
+	return 0;
+}
+
+uint32_t cam_io_r(void __iomem *addr)
+{
+	uint32_t data;
+
+	if (!addr) {
+		CAM_ERR(CAM_IO_ACCESS, "Invalid args");
+		return 0;
+	}
+
+	data = readl_relaxed(addr);
+	CAM_DBG(CAM_IO_ACCESS, "0x%pK %08x", addr, data);
+
+	return data;
+}
+
+uint32_t cam_io_r_mb(void __iomem *addr)
+{
+	uint32_t data;
+
+	if (!addr) {
+		CAM_ERR(CAM_IO_ACCESS, "Invalid args");
+		return 0;
+	}
+
+	data = readl(addr);
+	CAM_DBG(CAM_IO_ACCESS, "0x%pK %08x", addr, data);
+
+	return data;
+}
+
+int cam_io_memcpy(void __iomem *dest_addr,
+	void __iomem *src_addr, uint32_t len)
+{
+	int i;
+	uint32_t *d = (uint32_t *) dest_addr;
+	uint32_t *s = (uint32_t *) src_addr;
+
+	if (!dest_addr || !src_addr)
+		return -EINVAL;
+
+	CAM_DBG(CAM_IO_ACCESS, "%pK %pK %d", dest_addr, src_addr, len);
+
+	for (i = 0; i < len/4; i++) {
+		CAM_DBG(CAM_IO_ACCESS, "0x%pK %08x", d, *s);
+		writel_relaxed(*s++, d++);
+	}
+
+	return 0;
+}
+
+int  cam_io_memcpy_mb(void __iomem *dest_addr,
+	void __iomem *src_addr, uint32_t len)
+{
+	int i;
+	uint32_t *d = (uint32_t *) dest_addr;
+	uint32_t *s = (uint32_t *) src_addr;
+
+	if (!dest_addr || !src_addr)
+		return -EINVAL;
+
+	CAM_DBG(CAM_IO_ACCESS, "%pK %pK %d", dest_addr, src_addr, len);
+
+	/*
+	 * Do not use cam_io_w_mb to avoid double wmb() after a write
+	 * and before the next write.
+	 */
+	wmb();
+	for (i = 0; i < (len / 4); i++) {
+		CAM_DBG(CAM_IO_ACCESS, "0x%pK %08x", d, *s);
+		writel_relaxed(*s++, d++);
+	}
+	/* Ensure previous writes are done */
+	wmb();
+
+	return 0;
+}
+
+int cam_io_poll_value(void __iomem *addr, uint32_t wait_data, uint32_t retry,
+	unsigned long min_usecs, unsigned long max_usecs)
+{
+	uint32_t tmp, cnt = 0;
+	int rc = 0;
+
+	if (!addr)
+		return -EINVAL;
+
+	tmp = readl_relaxed(addr);
+	while ((tmp != wait_data) && (cnt++ < retry)) {
+		if (min_usecs > 0 && max_usecs > 0)
+			usleep_range(min_usecs, max_usecs);
+		tmp = readl_relaxed(addr);
+	}
+
+	if (cnt > retry) {
+		CAM_DBG(CAM_IO_ACCESS, "Poll failed by value");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int cam_io_poll_value_wmask(void __iomem *addr, uint32_t wait_data,
+	uint32_t bmask, uint32_t retry, unsigned long min_usecs,
+	unsigned long max_usecs)
+{
+	uint32_t tmp, cnt = 0;
+	int rc = 0;
+
+	if (!addr)
+		return -EINVAL;
+
+	tmp = readl_relaxed(addr);
+	while (((tmp & bmask) != wait_data) && (cnt++ < retry)) {
+		if (min_usecs > 0 && max_usecs > 0)
+			usleep_range(min_usecs, max_usecs);
+		tmp = readl_relaxed(addr);
+	}
+
+	if (cnt > retry) {
+		CAM_DBG(CAM_IO_ACCESS, "Poll failed with mask");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int cam_io_w_same_offset_block(const uint32_t *data, void __iomem *addr,
+	uint32_t len)
+{
+	int i;
+
+	if (!data || !len || !addr)
+		return -EINVAL;
+
+	for (i = 0; i < len; i++) {
+		CAM_DBG(CAM_IO_ACCESS, "i= %d len =%d val=%x addr =%pK",
+			i, len, data[i], addr);
+		writel_relaxed(data[i], addr);
+	}
+
+	return 0;
+}
+
+int cam_io_w_mb_same_offset_block(const uint32_t *data, void __iomem *addr,
+	uint32_t len)
+{
+	int i;
+
+	if (!data || !len || !addr)
+		return -EINVAL;
+
+	for (i = 0; i < len; i++) {
+		CAM_DBG(CAM_IO_ACCESS, "i= %d len =%d val=%x addr =%pK",
+			i, len, data[i], addr);
+		/* Ensure previous writes are done */
+		wmb();
+		writel_relaxed(data[i], addr);
+	}
+
+	return 0;
+}
+
+#define __OFFSET(__i)   (data[__i][0])
+#define __VAL(__i)      (data[__i][1])
+int cam_io_w_offset_val_block(const uint32_t data[][2],
+	void __iomem *addr_base, uint32_t len)
+{
+	int i;
+
+	if (!data || !len || !addr_base)
+		return -EINVAL;
+
+	for (i = 0; i < len; i++) {
+		CAM_DBG(CAM_IO_ACCESS,
+			"i= %d len =%d val=%x addr_base =%pK reg=%x",
+			i, len, __VAL(i), addr_base, __OFFSET(i));
+		writel_relaxed(__VAL(i), addr_base + __OFFSET(i));
+	}
+
+	return 0;
+}
+
+int cam_io_w_mb_offset_val_block(const uint32_t data[][2],
+	void __iomem *addr_base, uint32_t len)
+{
+	int i;
+
+	if (!data || !len || !addr_base)
+		return -EINVAL;
+
+	/* Ensure write is done */
+	wmb();
+	for (i = 0; i < len; i++) {
+		CAM_DBG(CAM_IO_ACCESS,
+			"i= %d len =%d val=%x addr_base =%pK reg=%x",
+			i, len, __VAL(i), addr_base, __OFFSET(i));
+		writel_relaxed(__VAL(i), addr_base + __OFFSET(i));
+	}
+
+	return 0;
+}
+
+#define BYTES_PER_REGISTER           4
+#define NUM_REGISTER_PER_LINE        4
+#define REG_OFFSET(__start, __i)    (__start + (__i * BYTES_PER_REGISTER))
+int cam_io_dump(void __iomem *base_addr, uint32_t start_offset, int size)
+{
+	char          line_str[128];
+	char         *p_str;
+	int           i;
+	uint32_t      data;
+
+	CAM_DBG(CAM_IO_ACCESS, "addr=%pK offset=0x%x size=%d",
+		base_addr, start_offset, size);
+
+	if (!base_addr || (size <= 0))
+		return -EINVAL;
+
+	line_str[0] = '\0';
+	p_str = line_str;
+	for (i = 0; i < size; i++) {
+		if (i % NUM_REGISTER_PER_LINE == 0) {
+			snprintf(p_str, 12, "0x%08x: ",
+				REG_OFFSET(start_offset, i));
+			p_str += 11;
+		}
+		data = readl_relaxed(base_addr + REG_OFFSET(start_offset, i));
+		snprintf(p_str, 10, "%08x  ", data);
+		p_str += 9;
+		if ((i + 1) % NUM_REGISTER_PER_LINE == 0) {
+			CAM_ERR(CAM_IO_ACCESS, "%s", line_str);
+			line_str[0] = '\0';
+			p_str = line_str;
+		}
+	}
+	if (line_str[0] != '\0')
+		CAM_ERR(CAM_IO_ACCESS, "%s", line_str);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_io_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_io_util.h
@@ -0,0 +1,232 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2011-2014, 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_IO_UTIL_H_
+#define _CAM_IO_UTIL_H_
+
+#include <linux/types.h>
+
+/**
+ * cam_io_w()
+ *
+ * @brief:              Camera IO util for register write
+ *
+ * @data:               Value to be written
+ * @addr:               Address used to write the value
+ *
+ * @return:             Success or Failure
+ */
+int cam_io_w(uint32_t data, void __iomem *addr);
+
+/**
+ * cam_io_w_mb()
+ *
+ * @brief:              Camera IO util for register write with memory barrier.
+ *                      Memory Barrier is only before the write to ensure the
+ *                      order. If need to ensure this write is also flushed
+ *                      call wmb() independently in the caller.
+ *
+ * @data:               Value to be written
+ * @addr:               Address used to write the value
+ *
+ * @return:             Success or Failure
+ */
+int cam_io_w_mb(uint32_t data, void __iomem *addr);
+
+/**
+ * cam_io_r()
+ *
+ * @brief:              Camera IO util for register read
+ *
+ * @addr:               Address of register to be read
+ *
+ * @return:             Value read from the register address
+ */
+uint32_t cam_io_r(void __iomem *addr);
+
+/**
+ * cam_io_r_mb()
+ *
+ * @brief:              Camera IO util for register read with memory barrier.
+ *                      Memory Barrier is only before the write to ensure the
+ *                      order. If need to ensure this write is also flushed
+ *                      call rmb() independently in the caller.
+ *
+ * @addr:               Address of register to be read
+ *
+ * @return:             Value read from the register address
+ */
+uint32_t cam_io_r_mb(void __iomem *addr);
+
+/**
+ * cam_io_memcpy()
+ *
+ * @brief:              Camera IO util for memory to register copy
+ *
+ * @dest_addr:          Destination register address
+ * @src_addr:           Source regiser address
+ * @len:                Range to be copied
+ *
+ * @return:             Success or Failure
+ */
+int cam_io_memcpy(void __iomem *dest_addr,
+		void __iomem *src_addr, uint32_t len);
+
+/**
+ * cam_io_memcpy_mb()
+ *
+ * @brief:              Camera IO util for memory to register copy
+ *                      with barrier.
+ *                      Memory Barrier is only before the write to ensure the
+ *                      order. If need to ensure this write is also flushed
+ *                      call wmb() independently in the caller.
+ *
+ * @dest_addr:          Destination register address
+ * @src_addr:           Source regiser address
+ * @len:                Range to be copied
+ *
+ * @return:             Success or Failure
+ */
+int cam_io_memcpy_mb(void __iomem *dest_addr,
+	void __iomem *src_addr, uint32_t len);
+
+/**
+ * cam_io_poll_value_wmask()
+ *
+ * @brief:              Poll register value with bitmask.
+ *
+ * @addr:               Register address to be polled
+ * @wait_data:          Wait until @bmask read from @addr matches this data
+ * @bmask:              Bit mask
+ * @retry:              Number of retry
+ * @min_usecs:          Minimum time to wait for retry
+ * @max_usecs:          Maximum time to wait for retry
+ *
+ * @return:             Success or Failure
+ *
+ * This function can sleep so it should not be called from interrupt
+ * handler, spin_lock etc.
+ */
+int cam_io_poll_value_wmask(void __iomem *addr, uint32_t wait_data,
+	uint32_t bmask, uint32_t retry, unsigned long min_usecs,
+	unsigned long max_usecs);
+
+/**
+ * cam_io_poll_value()
+ *
+ * @brief:              Poll register value
+ *
+ * @addr:               Register address to be polled
+ * @wait_data:          Wait until value read from @addr matches this data
+ * @retry:              Number of retry
+ * @min_usecs:          Minimum time to wait for retry
+ * @max_usecs:          Maximum time to wait for retry
+ *
+ * @return:             Success or Failure
+ *
+ * This function can sleep so it should not be called from interrupt
+ * handler, spin_lock etc.
+ */
+int cam_io_poll_value(void __iomem *addr, uint32_t wait_data, uint32_t retry,
+	unsigned long min_usecs, unsigned long max_usecs);
+
+/**
+ * cam_io_w_same_offset_block()
+ *
+ * @brief:              Write a block of data to same address
+ *
+ * @data:               Block data to be written
+ * @addr:               Register offset to be written.
+ * @len:                Number of the data to be written
+ *
+ * @return:             Success or Failure
+ */
+int cam_io_w_same_offset_block(const uint32_t *data, void __iomem *addr,
+	uint32_t len);
+
+/**
+ * cam_io_w_mb_same_offset_block()
+ *
+ * @brief:              Write a block of data to same address with barrier.
+ *                      Memory Barrier is only before the write to ensure the
+ *                      order. If need to ensure this write is also flushed
+ *                      call wmb() independently in the caller.
+ *
+ * @data:               Block data to be written
+ * @addr:               Register offset to be written.
+ * @len:                Number of the data to be written
+ *
+ * @return:             Success or Failure
+ */
+int cam_io_w_mb_same_offset_block(const uint32_t *data, void __iomem *addr,
+	uint32_t len);
+
+/**
+ * cam_io_w_offset_val_block()
+ *
+ * @brief:              This API is to write a block of registers
+ *                      represented by a 2 dimensional array table with
+ *                      register offset and value pair
+ *
+ *  offset0, value0,
+ *  offset1, value1,
+ *  offset2, value2,
+ *  and so on...
+ *
+ * @data:               Pointer to 2-dimensional offset-value array
+ * @addr_base:          Base address to which offset will be added to
+ *                      get the register address
+ * @len:                Length of offset-value pair array to be written in
+ *                      number of uin32_t
+ *
+ * @return:             Success or Failure
+ *
+ */
+int32_t cam_io_w_offset_val_block(const uint32_t data[][2],
+	void __iomem *addr_base, uint32_t len);
+
+/**
+ * cam_io_w_mb_offset_val_block()
+ *
+ * @brief:              This API is to write a block of registers
+ *                      represented by a 2 dimensional array table with
+ *                      register offset and value pair with memory barrier.
+ *                      Memory Barrier is only before the write to ensure the
+ *                      order. If need to ensure this write is also flushed
+ *                      call wmb() independently in the caller.
+ *                      The OFFSETS NEED to be different because of the way
+ *                      barrier is used here.
+ *
+ *  offset0, value0,
+ *  offset1, value1,
+ *  offset2, value2,
+ *  and so on...
+ *
+ * @data:               Pointer to 2-dimensional offset-value array
+ * @addr_base:          Base address to which offset will be added to
+ *                      get the register address
+ * @len:                Length of offset-value pair array to be written in
+ *                      number of uin32_t
+ *
+ * @return:             Success or Failure
+ *
+ */
+int32_t cam_io_w_mb_offset_val_block(const uint32_t data[][2],
+	void __iomem *addr_base, uint32_t len);
+
+/**
+ * cam_io_dump()
+ *
+ * @brief:              Camera IO util for dumping a range of register
+ *
+ * @base_addr:          Start register address for the dumping
+ * @start_offset:       Start register offset for the dump
+ * @size:               Size specifying the range for dumping
+ *
+ * @return:             Success or Failure
+ */
+int cam_io_dump(void __iomem *base_addr, uint32_t start_offset, int size);
+
+#endif /* _CAM_IO_UTIL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_mem_mgr_api.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_mem_mgr_api.h
@@ -0,0 +1,171 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_MEM_MGR_API_H_
+#define _CAM_MEM_MGR_API_H_
+
+#include <media/cam_req_mgr.h>
+#include "cam_smmu_api.h"
+
+/**
+ * struct cam_mem_mgr_request_desc
+ *
+ * @size    : Size of memory requested for allocation
+ * @align   : Alignment of requested memory
+ * @smmu_hdl: SMMU handle to identify context bank where memory will be mapped
+ * @flags: Flags to indicate cached/uncached property
+ */
+struct cam_mem_mgr_request_desc {
+	uint64_t size;
+	uint64_t align;
+	int32_t smmu_hdl;
+	uint32_t flags;
+};
+
+/**
+ * struct cam_mem_mgr_memory_desc
+ *
+ * @kva        : Kernel virtual address of allocated memory
+ * @iova       : IOVA of allocated memory
+ * @smmu_hdl   : SMMU handle of allocated memory
+ * @mem_handle : Mem handle identifying allocated memory
+ * @len        : Length of allocated memory
+ * @region     : Region to which allocated memory belongs
+ */
+struct cam_mem_mgr_memory_desc {
+	uintptr_t kva;
+	uint32_t iova;
+	int32_t smmu_hdl;
+	uint32_t mem_handle;
+	uint64_t len;
+	enum cam_smmu_region_id region;
+};
+
+/**
+ * @brief: Requests a memory buffer
+ *
+ * @inp:   Information specifying requested buffer properties
+ * @out:   Information about allocated buffer
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_request_mem(struct cam_mem_mgr_request_desc *inp,
+	struct cam_mem_mgr_memory_desc *out);
+
+/**
+ * @brief: Releases a memory buffer
+ *
+ * @inp:   Information specifying buffer to be released
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_release_mem(struct cam_mem_mgr_memory_desc *inp);
+
+#ifdef CONFIG_SPECTRA_KT
+
+/**
+ * @brief: Returns IOVA information about buffer
+ *
+ * @buf_handle: Handle of the buffer
+ * @mmu_handle: SMMU handle where buffer is mapped
+ * @iova_ptr  : Pointer to mmu's iova
+ * @len_ptr   : Length of the buffer
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
+	dma_addr_t *iova_ptr, size_t *len_ptr);
+
+#else
+
+/**
+ * @brief: Returns IOVA information about buffer
+ *
+ * @buf_handle: Handle of the buffer
+ * @mmu_handle: SMMU handle where buffer is mapped
+ * @iova_ptr  : Pointer to mmu's iova
+ * @len_ptr   : Length of the buffer
+ * @flags     : Flags the buffer was allocated with
+ * @buf_tracker: List of buffers we want to keep ref counts on
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
+	dma_addr_t *iova_ptr, size_t *len_ptr, uint32_t *flags,
+	struct list_head *buf_tracker);
+
+#endif // CONFIG_SPECTRA_KT
+
+/**
+ * @brief: This indicates begin of CPU access.
+ *         Also returns CPU address information about DMA buffer
+ *
+ * @buf_handle: Handle for the buffer
+ * @vaddr_ptr : pointer to kernel virtual address
+ * @len       : Length of the buffer
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr,
+	size_t *len);
+
+/**
+ * @brief: This indicates end of CPU access
+ *
+ * @buf_handle: Handle for the buffer
+ *
+ */
+void cam_mem_put_cpu_buf(int32_t buf_handle);
+
+/**
+ * @brief: decrements kref reference for a buf handle
+ *
+ * @buf_handle: Handle for the buffer
+ *
+ */
+void cam_mem_put_kref(int32_t buf_handle);
+
+static inline bool cam_mem_is_secure_buf(int32_t buf_handle)
+{
+	return CAM_MEM_MGR_IS_SECURE_HDL(buf_handle);
+}
+
+/**
+ * @brief: Reserves a memory region
+ *
+ * @inp:  Information specifying requested region properties
+ * @region : Region which is to be reserved
+ * @out   : Information about reserved region
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_reserve_memory_region(struct cam_mem_mgr_request_desc *inp,
+		enum cam_smmu_region_id region,
+		struct cam_mem_mgr_memory_desc *out);
+
+/**
+ * @brief: Frees a memory region
+ *
+ * @inp   : Information about region which is to be freed
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_mem_mgr_free_memory_region(struct cam_mem_mgr_memory_desc *inp);
+
+#ifndef CONFIG_SPECTRA_KT
+
+/**
+ * @brief: Translate fd into dmabuf
+ *
+ * @inp   : fd for buffer
+ *
+ * @return dmabuf .
+ */
+struct dma_buf * cam_mem_mgr_get_dma_buf(int fd);
+
+#endif // !CONFIG_SPECTRA_KT
+
+#endif /* _CAM_MEM_MGR_API_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_req_mgr_timer.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_req_mgr_timer.c
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_req_mgr_timer.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+
+extern struct kmem_cache *g_cam_req_mgr_timer_cachep;
+
+void crm_timer_reset(struct cam_req_mgr_timer *crm_timer)
+{
+	if (!crm_timer)
+		return;
+
+	cam_common_modify_timer(&crm_timer->sys_timer, crm_timer->expires);
+}
+
+static void crm_timer_callback(struct timer_list *timer_data)
+{
+	struct cam_req_mgr_timer *timer =
+		container_of(timer_data, struct cam_req_mgr_timer, sys_timer);
+	if (!timer) {
+		CAM_ERR(CAM_CRM, "NULL timer");
+		return;
+	}
+	CAM_DBG(CAM_CRM, "timer %pK parent %pK", timer, timer->parent);
+	crm_timer_reset(timer);
+}
+
+void crm_timer_modify(struct cam_req_mgr_timer *crm_timer,
+	int32_t expires)
+{
+	CAM_DBG(CAM_CRM, "new time %d", expires);
+	if (crm_timer) {
+		crm_timer->expires = expires;
+		crm_timer_reset(crm_timer);
+	}
+}
+
+int crm_timer_init(struct cam_req_mgr_timer **timer,
+	int32_t expires, void *parent, void (*timer_cb)(struct timer_list *))
+{
+	int                       ret = 0;
+	struct cam_req_mgr_timer *crm_timer = NULL;
+
+	CAM_DBG(CAM_CRM, "init timer %d %pK", expires, *timer);
+	if (*timer == NULL) {
+		if (g_cam_req_mgr_timer_cachep) {
+			crm_timer = kmem_cache_alloc(g_cam_req_mgr_timer_cachep,
+					__GFP_ZERO | GFP_KERNEL);
+			if (!crm_timer) {
+				ret = -ENOMEM;
+				goto end;
+			}
+		}
+
+		else {
+			ret = -ENOMEM;
+			goto end;
+		}
+
+		if (timer_cb != NULL)
+			crm_timer->timer_cb = timer_cb;
+		else
+			crm_timer->timer_cb = crm_timer_callback;
+
+		crm_timer->expires = expires;
+		crm_timer->parent = parent;
+		timer_setup(&crm_timer->sys_timer,
+			crm_timer->timer_cb, 0);
+		crm_timer_reset(crm_timer);
+		*timer = crm_timer;
+	} else {
+		CAM_WARN(CAM_CRM, "Timer already exists!!");
+		ret = -EINVAL;
+	}
+end:
+	return ret;
+}
+void crm_timer_exit(struct cam_req_mgr_timer **crm_timer)
+{
+	CAM_DBG(CAM_CRM, "destroy timer %pK @ %pK", *crm_timer, crm_timer);
+	if (*crm_timer) {
+		del_timer_sync(&(*crm_timer)->sys_timer);
+		if (g_cam_req_mgr_timer_cachep)
+			kmem_cache_free(g_cam_req_mgr_timer_cachep, *crm_timer);
+		*crm_timer = NULL;
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_req_mgr_timer.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_req_mgr_timer.h
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_TIMER_H_
+#define _CAM_REQ_MGR_TIMER_H_
+
+#include <linux/slab.h>
+#include <linux/timer.h>
+
+#include "cam_req_mgr_core_defs.h"
+
+/**
+ * struct cam_req_mgr_timer
+ * @expires      : timeout value for timer
+ * @sys_timer    : system timer variable
+ * @parent       : priv data - link pointer
+ * @timer_cb     : callback func which will be called when timeout expires
+ * @pause_timer  : flag to pause SOF timer
+ */
+struct cam_req_mgr_timer {
+	int32_t            expires;
+	struct timer_list  sys_timer;
+	void               *parent;
+	void               (*timer_cb)(struct timer_list *timer_data);
+	bool                pause_timer;
+};
+
+/**
+ * crm_timer_modify()
+ * @brief : modify expiry time.
+ * @timer : timer which will be reset to expires values
+ */
+void crm_timer_modify(struct cam_req_mgr_timer *crm_timer,
+	int32_t expires);
+
+/**
+ * crm_timer_reset()
+ * @brief : destroys the timer allocated.
+ * @timer : timer which will be reset to expires values
+ */
+void crm_timer_reset(struct cam_req_mgr_timer *timer);
+
+/**
+ * crm_timer_init()
+ * @brief    : create a new general purpose timer.
+ *             timer utility takes care of allocating memory and deleting
+ * @timer    : double pointer to new timer allocated
+ * @expires  : Timeout value to fire callback
+ * @parent   : void pointer which caller can use for book keeping
+ * @timer_cb : caller can chose to use its own callback function when
+ *             timer fires the timeout. If no value is set timer util
+ *             will use default.
+ */
+int crm_timer_init(struct cam_req_mgr_timer **timer,
+	int32_t expires, void *parent, void (*timer_cb)(struct timer_list *));
+
+/**
+ * crm_timer_exit()
+ * @brief : destroys the timer allocated.
+ * @timer : timer pointer which will be freed
+ */
+void crm_timer_exit(struct cam_req_mgr_timer **timer);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_req_mgr_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_req_mgr_util.c
@@ -0,0 +1,505 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
+#include <linux/random.h>
+
+#include <media/cam_req_mgr.h>
+
+#include "cam_req_mgr_util.h"
+#include "cam_debug_util.h"
+#include "cam_context.h"
+#include "cam_subdev.h"
+#include "cam_node.h"
+
+static struct cam_req_mgr_util_hdl_tbl *hdl_tbl;
+static DEFINE_SPINLOCK(hdl_tbl_lock);
+
+static uint64_t cam_get_dev_handle_status(void) __attribute__((unused));
+
+int cam_req_mgr_util_init(void)
+{
+	int rc = 0;
+	int bitmap_size;
+	static struct cam_req_mgr_util_hdl_tbl *hdl_tbl_local;
+
+	if (hdl_tbl) {
+		rc = -EINVAL;
+		CAM_ERR(CAM_CRM, "Hdl_tbl is already present");
+		goto hdl_tbl_check_failed;
+	}
+
+	hdl_tbl_local = kzalloc(sizeof(*hdl_tbl), GFP_KERNEL);
+	if (!hdl_tbl_local) {
+		rc = -ENOMEM;
+		goto hdl_tbl_alloc_failed;
+	}
+	bitmap_size = BITS_TO_LONGS(CAM_REQ_MGR_MAX_HANDLES_V2) * sizeof(long);
+	hdl_tbl_local->bitmap = kzalloc(bitmap_size, GFP_KERNEL);
+	if (!hdl_tbl_local->bitmap) {
+		rc = -ENOMEM;
+		goto bitmap_alloc_fail;
+	}
+	hdl_tbl_local->bits = bitmap_size * BITS_PER_BYTE;
+
+	spin_lock_bh(&hdl_tbl_lock);
+	if (hdl_tbl) {
+		spin_unlock_bh(&hdl_tbl_lock);
+		rc = -EEXIST;
+		kfree(hdl_tbl_local->bitmap);
+		kfree(hdl_tbl_local);
+		goto hdl_tbl_check_failed;
+	}
+	hdl_tbl = hdl_tbl_local;
+	spin_unlock_bh(&hdl_tbl_lock);
+
+	return rc;
+
+bitmap_alloc_fail:
+	kfree(hdl_tbl_local);
+	hdl_tbl = NULL;
+hdl_tbl_alloc_failed:
+hdl_tbl_check_failed:
+	return rc;
+}
+
+int cam_req_mgr_util_deinit(void)
+{
+	spin_lock_bh(&hdl_tbl_lock);
+	if (!hdl_tbl) {
+		CAM_ERR(CAM_CRM, "Hdl tbl is NULL");
+		spin_unlock_bh(&hdl_tbl_lock);
+		return -EINVAL;
+	}
+
+	kfree(hdl_tbl->bitmap);
+	hdl_tbl->bitmap = NULL;
+	kfree(hdl_tbl);
+	hdl_tbl = NULL;
+	spin_unlock_bh(&hdl_tbl_lock);
+
+	return 0;
+}
+
+int cam_handle_validate(int32_t session_hdl, int32_t handle)
+{
+	int idx, rc = 0;
+
+	spin_lock_bh(&hdl_tbl_lock);
+	if (!hdl_tbl) {
+		CAM_ERR(CAM_CRM, "Hdl tbl is NULL");
+		rc = -EINVAL;
+		goto out;
+	}
+
+	idx = CAM_REQ_MGR_GET_HDL_IDX(handle);
+	if (idx < 0 || idx >= CAM_REQ_MGR_MAX_HANDLES_V2) {
+		CAM_ERR(CAM_CRM, "Invalid index:%d for handle: 0x%x", idx, handle);
+		rc = -EINVAL;
+		goto out;
+	}
+
+	if (hdl_tbl->hdl[idx].state != HDL_ACTIVE) {
+		CAM_ERR(CAM_CRM, "Invalid state:%d", hdl_tbl->hdl[idx].state);
+		rc = -EINVAL;
+		goto out;
+	}
+
+	if (hdl_tbl->hdl[idx].session_hdl != session_hdl ||
+		hdl_tbl->hdl[idx].hdl_value != handle) {
+		CAM_ERR(CAM_CRM, "Exp ses_hdl: 0x%x ses_hdl: 0x%x Exp hdl: 0x%x hdl: 0x%x",
+			hdl_tbl->hdl[idx].session_hdl, session_hdl, hdl_tbl->hdl[idx].hdl_value,
+			handle);
+		rc = -EINVAL;
+		goto out;
+	}
+
+out:
+	spin_unlock_bh(&hdl_tbl_lock);
+	return rc;
+}
+
+int cam_req_mgr_util_free_hdls(void)
+{
+	int i = 0;
+
+	spin_lock_bh(&hdl_tbl_lock);
+	if (!hdl_tbl) {
+		CAM_ERR(CAM_CRM, "Hdl tbl is NULL");
+		spin_unlock_bh(&hdl_tbl_lock);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < CAM_REQ_MGR_MAX_HANDLES_V2; i++) {
+		if (hdl_tbl->hdl[i].state == HDL_ACTIVE) {
+			CAM_WARN(CAM_CRM, "Dev handle = %x session_handle = %x",
+				hdl_tbl->hdl[i].hdl_value,
+				hdl_tbl->hdl[i].session_hdl);
+			hdl_tbl->hdl[i].state = HDL_FREE;
+			clear_bit(i, hdl_tbl->bitmap);
+		}
+	}
+	bitmap_zero(hdl_tbl->bitmap, CAM_REQ_MGR_MAX_HANDLES_V2);
+	spin_unlock_bh(&hdl_tbl_lock);
+
+	return 0;
+}
+
+static int32_t cam_get_free_handle_index(void)
+{
+	int idx;
+
+	idx = find_first_zero_bit(hdl_tbl->bitmap, hdl_tbl->bits);
+
+	if (idx >= CAM_REQ_MGR_MAX_HANDLES_V2 || idx < 0) {
+		CAM_ERR(CAM_CRM, "No free index found idx: %d", idx);
+		return -ENOSR;
+	}
+
+	set_bit(idx, hdl_tbl->bitmap);
+
+	return idx;
+}
+
+static void cam_dump_tbl_info(void)
+{
+	int i;
+
+	for (i = 0; i < CAM_REQ_MGR_MAX_HANDLES_V2; i++)
+		CAM_INFO_RATE_LIMIT_CUSTOM(CAM_CRM, CAM_RATE_LIMIT_INTERVAL_5SEC,
+			CAM_REQ_MGR_MAX_HANDLES_V2,
+			"session_hdl=%x hdl_value=%x type=%d state=%d dev_id=%lld",
+			hdl_tbl->hdl[i].session_hdl, hdl_tbl->hdl[i].hdl_value,
+			hdl_tbl->hdl[i].type, hdl_tbl->hdl[i].state, hdl_tbl->hdl[i].dev_id);
+}
+
+int32_t cam_create_session_hdl(void *priv)
+{
+	int idx;
+	int rand = 0;
+	int32_t handle = 0;
+
+	spin_lock_bh(&hdl_tbl_lock);
+	if (!hdl_tbl) {
+		CAM_ERR(CAM_CRM, "Hdl tbl is NULL");
+		spin_unlock_bh(&hdl_tbl_lock);
+		return -EINVAL;
+	}
+
+	idx = cam_get_free_handle_index();
+	if (idx < 0) {
+		CAM_ERR(CAM_CRM, "Unable to create session handle(idx = %d)", idx);
+		cam_dump_tbl_info();
+		spin_unlock_bh(&hdl_tbl_lock);
+		return idx;
+	}
+
+	get_random_bytes(&rand, CAM_REQ_MGR_RND1_BYTES);
+	handle = GET_DEV_HANDLE(rand, HDL_TYPE_SESSION, idx);
+	hdl_tbl->hdl[idx].session_hdl = handle;
+	hdl_tbl->hdl[idx].hdl_value = handle;
+	hdl_tbl->hdl[idx].type = HDL_TYPE_SESSION;
+	hdl_tbl->hdl[idx].state = HDL_ACTIVE;
+	hdl_tbl->hdl[idx].priv = priv;
+	hdl_tbl->hdl[idx].ops = NULL;
+	hdl_tbl->hdl[idx].dev_id = CAM_CRM;
+	spin_unlock_bh(&hdl_tbl_lock);
+
+	return handle;
+}
+
+int32_t cam_create_device_hdl(struct cam_create_dev_hdl *hdl_data)
+{
+	int idx;
+	int rand = 0;
+	int32_t handle;
+	bool crm_active;
+
+	crm_active = cam_req_mgr_is_open();
+	if (!crm_active) {
+		CAM_ERR(CAM_CRM, "CRM is not ACTIVE");
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&hdl_tbl_lock);
+	if (!hdl_tbl) {
+		CAM_ERR(CAM_CRM, "Hdl tbl is NULL");
+		spin_unlock_bh(&hdl_tbl_lock);
+		return -EINVAL;
+	}
+
+	idx = cam_get_free_handle_index();
+	if (idx < 0) {
+		CAM_ERR(CAM_CRM, "Unable to create device handle(idx= %d)", idx);
+		cam_dump_tbl_info();
+		spin_unlock_bh(&hdl_tbl_lock);
+		return idx;
+	}
+
+	get_random_bytes(&rand, CAM_REQ_MGR_RND1_BYTES);
+	handle = GET_DEV_HANDLE(rand, HDL_TYPE_DEV, idx);
+	hdl_tbl->hdl[idx].session_hdl = hdl_data->session_hdl;
+	hdl_tbl->hdl[idx].hdl_value = handle;
+	hdl_tbl->hdl[idx].type = HDL_TYPE_DEV;
+	hdl_tbl->hdl[idx].state = HDL_ACTIVE;
+	hdl_tbl->hdl[idx].priv = hdl_data->priv;
+	hdl_tbl->hdl[idx].ops = hdl_data->ops;
+	hdl_tbl->hdl[idx].dev_id = hdl_data->dev_id;
+	spin_unlock_bh(&hdl_tbl_lock);
+
+	pr_debug("%s: handle = 0x%x idx = %d\n", __func__, handle, idx);
+	return handle;
+}
+
+int32_t cam_get_dev_handle_info(uint64_t handle,
+	struct cam_context **ctx, int32_t dev_index)
+{
+	int32_t idx;
+	struct v4l2_subdev *sd = (struct v4l2_subdev *)handle;
+
+	for (idx = dev_index + 1; idx < CAM_REQ_MGR_MAX_HANDLES_V2; idx++) {
+		if (hdl_tbl->hdl[idx].state == HDL_ACTIVE) {
+			*ctx = (struct cam_context *)cam_get_device_priv(
+					hdl_tbl->hdl[idx].hdl_value);
+			if ((*ctx) && !strcmp(sd->name, (*ctx)->dev_name))
+				return idx;
+		}
+	}
+	*ctx = NULL;
+	return CAM_REQ_MGR_MAX_HANDLES_V2;
+}
+
+static uint64_t cam_get_dev_handle_status(void)
+{
+	int32_t idx;
+	uint64_t active_dev_hdls = 0;
+
+	for (idx = 0; idx < CAM_REQ_MGR_MAX_HANDLES_V2; idx++)
+		if (hdl_tbl->hdl[idx].state == HDL_ACTIVE)
+			active_dev_hdls |= hdl_tbl->hdl[idx].dev_id;
+
+	return active_dev_hdls;
+}
+
+int32_t cam_create_link_hdl(struct cam_create_dev_hdl *hdl_data)
+{
+	int idx;
+	int rand = 0;
+	int32_t handle;
+
+	spin_lock_bh(&hdl_tbl_lock);
+	if (!hdl_tbl) {
+		CAM_ERR(CAM_CRM, "Hdl tbl is NULL");
+		spin_unlock_bh(&hdl_tbl_lock);
+		return -EINVAL;
+	}
+
+	idx = cam_get_free_handle_index();
+	if (idx < 0) {
+		CAM_ERR(CAM_CRM, "Unable to create link handle(idx = %d)", idx);
+		cam_dump_tbl_info();
+		spin_unlock_bh(&hdl_tbl_lock);
+		return idx;
+	}
+
+	get_random_bytes(&rand, CAM_REQ_MGR_RND1_BYTES);
+	handle = GET_DEV_HANDLE(rand, HDL_TYPE_LINK, idx);
+	hdl_tbl->hdl[idx].session_hdl = hdl_data->session_hdl;
+	hdl_tbl->hdl[idx].hdl_value = handle;
+	hdl_tbl->hdl[idx].type = HDL_TYPE_LINK;
+	hdl_tbl->hdl[idx].state = HDL_ACTIVE;
+	hdl_tbl->hdl[idx].priv = hdl_data->priv;
+	hdl_tbl->hdl[idx].ops = NULL;
+	hdl_tbl->hdl[idx].dev_id = hdl_data->dev_id;
+	spin_unlock_bh(&hdl_tbl_lock);
+
+	CAM_DBG(CAM_CRM, "handle = %x", handle);
+	return handle;
+}
+
+static void *cam_get_priv(int32_t dev_hdl, int handle_type)
+{
+	int idx;
+	int type;
+	void *priv;
+
+	spin_lock_bh(&hdl_tbl_lock);
+	if (!hdl_tbl) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "Hdl tbl is NULL");
+		goto device_priv_fail;
+	}
+
+	idx = CAM_REQ_MGR_GET_HDL_IDX(dev_hdl);
+	if (idx >= CAM_REQ_MGR_MAX_HANDLES_V2) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "Invalid idx:%d", idx);
+		goto device_priv_fail;
+	}
+
+	if (hdl_tbl->hdl[idx].hdl_value != dev_hdl) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "Invalid hdl [%d] [%d]",
+			dev_hdl, hdl_tbl->hdl[idx].hdl_value);
+		goto device_priv_fail;
+	}
+
+	if (hdl_tbl->hdl[idx].state != HDL_ACTIVE) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "Invalid state:%d",
+			hdl_tbl->hdl[idx].state);
+		goto device_priv_fail;
+	}
+
+	type = CAM_REQ_MGR_GET_HDL_TYPE(dev_hdl);
+	if (type != handle_type) {
+		CAM_ERR_RATE_LIMIT(CAM_CRM, "Invalid type:%d", type);
+		goto device_priv_fail;
+	}
+
+	priv = hdl_tbl->hdl[idx].priv;
+	spin_unlock_bh(&hdl_tbl_lock);
+
+	return priv;
+
+device_priv_fail:
+	spin_unlock_bh(&hdl_tbl_lock);
+	return NULL;
+}
+
+void *cam_get_device_priv(int32_t dev_hdl)
+{
+	void *priv;
+
+	priv = cam_get_priv(dev_hdl, HDL_TYPE_DEV);
+	return priv;
+}
+
+struct cam_req_mgr_core_session *cam_get_session_priv(int32_t dev_hdl)
+{
+	struct cam_req_mgr_core_session *priv;
+
+	priv = (struct cam_req_mgr_core_session *)
+		cam_get_priv(dev_hdl, HDL_TYPE_SESSION);
+
+	return priv;
+}
+
+struct cam_req_mgr_core_link *cam_get_link_priv(int32_t dev_hdl)
+{
+	struct cam_req_mgr_core_link *priv;
+
+	priv = (struct cam_req_mgr_core_link *)
+		cam_get_priv(dev_hdl, HDL_TYPE_LINK);
+
+	return priv;
+}
+
+void *cam_get_device_ops(int32_t dev_hdl)
+{
+	int idx;
+	int type;
+	void *ops;
+
+	spin_lock_bh(&hdl_tbl_lock);
+	if (!hdl_tbl) {
+		CAM_ERR(CAM_CRM, "Hdl tbl is NULL");
+		goto device_ops_fail;
+	}
+
+	idx = CAM_REQ_MGR_GET_HDL_IDX(dev_hdl);
+	if (idx >= CAM_REQ_MGR_MAX_HANDLES_V2) {
+		CAM_ERR(CAM_CRM, "Invalid idx");
+		goto device_ops_fail;
+	}
+
+	if (hdl_tbl->hdl[idx].state != HDL_ACTIVE) {
+		CAM_ERR(CAM_CRM, "Invalid state");
+		goto device_ops_fail;
+	}
+
+	type = CAM_REQ_MGR_GET_HDL_TYPE(dev_hdl);
+	if (HDL_TYPE_DEV != type && HDL_TYPE_SESSION != type && HDL_TYPE_LINK != type) {
+		CAM_ERR(CAM_CRM, "Invalid type");
+		goto device_ops_fail;
+	}
+
+	if (hdl_tbl->hdl[idx].hdl_value != dev_hdl) {
+		CAM_ERR(CAM_CRM, "Invalid hdl");
+		goto device_ops_fail;
+	}
+
+	ops = hdl_tbl->hdl[idx].ops;
+	spin_unlock_bh(&hdl_tbl_lock);
+
+	return ops;
+
+device_ops_fail:
+	spin_unlock_bh(&hdl_tbl_lock);
+	return NULL;
+}
+
+static int cam_destroy_hdl(int32_t dev_hdl, int dev_hdl_type)
+{
+	int idx;
+	int type;
+
+	spin_lock_bh(&hdl_tbl_lock);
+	if (!hdl_tbl) {
+		CAM_ERR(CAM_CRM, "Hdl tbl is NULL");
+		goto destroy_hdl_fail;
+	}
+
+	idx = CAM_REQ_MGR_GET_HDL_IDX(dev_hdl);
+	if (idx >= CAM_REQ_MGR_MAX_HANDLES_V2) {
+		CAM_ERR(CAM_CRM, "Invalid idx %d", idx);
+		goto destroy_hdl_fail;
+	}
+
+	if (hdl_tbl->hdl[idx].state != HDL_ACTIVE) {
+		CAM_ERR(CAM_CRM, "Invalid state");
+		goto destroy_hdl_fail;
+	}
+
+	type = CAM_REQ_MGR_GET_HDL_TYPE(dev_hdl);
+	if (type != dev_hdl_type) {
+		CAM_ERR(CAM_CRM, "Invalid type %d, %d", type, dev_hdl_type);
+		goto destroy_hdl_fail;
+	}
+
+	if (hdl_tbl->hdl[idx].hdl_value != dev_hdl) {
+		CAM_ERR(CAM_CRM, "Invalid hdl");
+		goto destroy_hdl_fail;
+	}
+
+	hdl_tbl->hdl[idx].state = HDL_FREE;
+	hdl_tbl->hdl[idx].ops   = NULL;
+	hdl_tbl->hdl[idx].priv  = NULL;
+	clear_bit(idx, hdl_tbl->bitmap);
+	spin_unlock_bh(&hdl_tbl_lock);
+
+	return 0;
+
+destroy_hdl_fail:
+	spin_unlock_bh(&hdl_tbl_lock);
+	return -EINVAL;
+}
+
+int cam_destroy_device_hdl(int32_t dev_hdl)
+{
+	return cam_destroy_hdl(dev_hdl, HDL_TYPE_DEV);
+}
+
+int cam_destroy_link_hdl(int32_t dev_hdl)
+{
+	CAM_DBG(CAM_CRM, "handle = %x", dev_hdl);
+	return cam_destroy_hdl(dev_hdl, HDL_TYPE_LINK);
+}
+
+int cam_destroy_session_hdl(int32_t dev_hdl)
+{
+	return cam_destroy_hdl(dev_hdl, HDL_TYPE_SESSION);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_req_mgr_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_req_mgr_util.h
@@ -0,0 +1,229 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_UTIL_API_H_
+#define _CAM_REQ_MGR_UTIL_API_H_
+
+#include <media/cam_req_mgr.h>
+#include "cam_req_mgr_util_priv.h"
+
+#ifdef CONFIG_SPECTRA_KT
+
+/* Interval for cam_info_rate_limit_custom() */
+#define CAM_RATE_LIMIT_INTERVAL_5SEC 5
+
+#endif
+
+/**
+ * state of a handle(session/device)
+ * @HDL_FREE: free handle
+ * @HDL_ACTIVE: active handles
+ */
+enum hdl_state {
+	HDL_FREE,
+	HDL_ACTIVE
+};
+
+/**
+ * handle type
+ * @HDL_TYPE_DEV: for device
+ * @HDL_TYPE_SESSION: for session
+ * @HDL_TYPE_LINK: for link
+ */
+enum hdl_type {
+	HDL_TYPE_DEV = 1,
+	HDL_TYPE_SESSION,
+	HDL_TYPE_LINK
+};
+
+/**
+ * struct handle
+ * @session_hdl: session handle
+ * @hdl_value: Allocated handle
+ * @type: session/device handle
+ * @state: free/used
+ * @dev_id: device id for handle
+ * @ops: ops structure
+ * @priv: private data of a handle
+ */
+struct handle {
+	int32_t session_hdl;
+	uint32_t hdl_value;
+	enum hdl_type type;
+	enum hdl_state state;
+	uint64_t dev_id;
+	void *ops;
+	void *priv;
+};
+
+/**
+ * struct cam_req_mgr_util_hdl_tbl
+ * @hdl: row of handles
+ * @bitmap: bit map to get free hdl row idx
+ * @bits: size of bit map in bits
+ */
+struct cam_req_mgr_util_hdl_tbl {
+	struct handle hdl[CAM_REQ_MGR_MAX_HANDLES_V2];
+	void *bitmap;
+	size_t bits;
+};
+
+/**
+ * cam_req_mgr_util APIs for KMD drivers and cam_req_mgr
+ * @session_hdl: session_hdl info
+ * @v4l2_sub_dev_flag: flag to create v4l2 sub device
+ * @media_entity_flag: flag for media entity
+ * @reserved: reserved field
+ * @dev_id: device id for handle
+ * @ops: ops pointer for a device handle
+ * @priv: private data for a device handle
+ */
+struct cam_create_dev_hdl {
+	int32_t session_hdl;
+	int32_t v4l2_sub_dev_flag;
+	int32_t media_entity_flag;
+	int32_t reserved;
+	uint64_t dev_id;
+	void *ops;
+	void *priv;
+};
+
+/**
+ * cam_handle_validate() - validate session/device handle
+ * @session_hdl: handle for a session
+ * @handle: handle for a session/device
+ *
+ * cam_req_mgr_core and KMD drivers use this function to
+ * validate session/device handle. Returns 0 on success,
+ * -EINVAL on failure.
+ */
+int cam_handle_validate(int32_t session_hdl, int32_t handle);
+
+/**
+ * cam_create_session_hdl() - create a session handle
+ * @priv: private data for a session handle
+ *
+ * cam_req_mgr core calls this function to get
+ * a unique session handle. Returns a unique session
+ * handle
+ */
+int32_t cam_create_session_hdl(void *priv);
+
+/**
+ * cam_create_device_hdl() - create a device handle
+ * @hdl_data: session hdl, flags, ops and priv dara as input
+ *
+ * cam_req_mgr_core calls this function to get
+ * session and link handles
+ * KMD drivers calls this function to create
+ * a device handle. Returns a unique device handle
+ */
+int32_t cam_create_device_hdl(struct cam_create_dev_hdl *hdl_data);
+
+/**
+ * cam_create_link_hdl() - create a link handle
+ * @hdl_data: session hdl, flags, ops and priv dara as input
+ *
+ * cam_req_mgr_core calls this function to get
+ * session and link handles
+ * KMD drivers calls this function to create
+ * a link handle. Returns a unique link handle
+ */
+int32_t cam_create_link_hdl(struct cam_create_dev_hdl *hdl_data);
+
+/**
+ * cam_get_device_priv() - get private data of a device handle
+ * @dev_hdl: handle for a device
+ *
+ * cam_req_mgr_core and KMD drivers use this function to
+ * get private data of a handle. Returns a private data
+ * structure pointer.
+ */
+void *cam_get_device_priv(int32_t dev_hdl);
+
+/**
+ * cam_get_session_priv() - get private data of a session handle
+ * @dev_hdl: handle for a session
+ *
+ * cam_req_mgr_core and KMD drivers use this function to
+ * get private data of a handle. Returns a private data
+ * structure pointer.
+ */
+struct cam_req_mgr_core_session *cam_get_session_priv(int32_t dev_hdl);
+
+/**
+ * cam_get_link_priv() - get private data of a link handle
+ * @dev_hdl: handle for a link
+ *
+ * cam_req_mgr_core and KMD drivers use this function to
+ * get private data of a handle. Returns a private data
+ * structure pointer.
+ */
+struct cam_req_mgr_core_link *cam_get_link_priv(int32_t dev_hdl);
+
+/**
+ * cam_get_device_ops() - get ops of a handle
+ * @dev_hdl: handle for a session/link/device
+ *
+ * cam_req_mgr_core and KMD drivers use this function to
+ * get ops of a handle. Returns a pointer to ops.
+ */
+void *cam_get_device_ops(int32_t dev_hdl);
+
+/**
+ * cam_destroy_device_hdl() - destroy device handle
+ * @dev_hdl: handle for a device.
+ *
+ * Returns success/failure
+ */
+int32_t cam_destroy_device_hdl(int32_t dev_hdl);
+
+/**
+ * cam_destroy_link_hdl() - destroy link handle
+ * @dev_hdl: handle for a link.
+ *
+ * Returns success/failure
+ */
+int32_t cam_destroy_link_hdl(int32_t dev_hdl);
+
+/**
+ * cam_destroy_session_hdl() - destroy device handle
+ * @dev_hdl: handle for a session
+ *
+ * Returns success/failure
+ */
+int32_t cam_destroy_session_hdl(int32_t dev_hdl);
+
+
+/* Internal functions */
+/**
+ * cam_req_mgr_util_init() - init function of cam_req_mgr_util
+ *
+ * This is called as part of probe function to initialize
+ * handle table, bitmap, locks
+ */
+int cam_req_mgr_util_init(void);
+
+/**
+ * cam_req_mgr_util_deinit() - deinit function of cam_req_mgr_util
+ *
+ * This function is called in case of probe failure
+ */
+int32_t cam_req_mgr_util_deinit(void);
+
+/**
+ * cam_req_mgr_util_free_hdls() - free handles in case of crash
+ *
+ * Called from cam_req_mgr_dev release function to make sure
+ * all data structures are cleaned to avoid leaks
+ *
+ * cam_req_mgr core can call this function at the end of
+ * camera to make sure all stale entries are printed and
+ * cleaned
+ */
+int32_t cam_req_mgr_util_free_hdls(void);
+
+#endif /* _CAM_REQ_MGR_UTIL_API_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_req_mgr_util_priv.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_req_mgr_util_priv.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_UTIL_PRIV_H_
+#define _CAM_REQ_MGR_UTIL_PRIV_H_
+
+/**
+ * handle format:
+ * @bits (0-7): handle index
+ * @bits (8-11): handle type
+ * @bits (12-15): reserved
+ * @bits (16-23): random bits
+ * @bits (24-31): zeros
+ */
+
+#define CAM_REQ_MGR_HDL_SIZE            32
+#define CAM_REQ_MGR_RND1_SIZE           8
+#define CAM_REQ_MGR_RVD_SIZE            4
+#define CAM_REQ_MGR_HDL_TYPE_SIZE       4
+#define CAM_REQ_MGR_HDL_IDX_SIZE        8
+
+#define CAM_REQ_MGR_RND1_POS            24
+#define CAM_REQ_MGR_RVD_POS             16
+#define CAM_REQ_MGR_HDL_TYPE_POS        12
+
+#define CAM_REQ_MGR_RND1_BYTES          1
+
+#define CAM_REQ_MGR_HDL_TYPE_MASK      ((1 << CAM_REQ_MGR_HDL_TYPE_SIZE) - 1)
+
+#define GET_DEV_HANDLE(rnd1, type, idx) \
+	((rnd1 << (CAM_REQ_MGR_RND1_POS - CAM_REQ_MGR_RND1_SIZE)) | \
+	(0x0  << (CAM_REQ_MGR_RVD_POS - CAM_REQ_MGR_RVD_SIZE)) | \
+	(type << (CAM_REQ_MGR_HDL_TYPE_POS - CAM_REQ_MGR_HDL_TYPE_SIZE)) | \
+	(idx << (CAM_REQ_MGR_HDL_IDX_POS - CAM_REQ_MGR_HDL_IDX_SIZE))) \
+
+#define CAM_REQ_MGR_GET_HDL_IDX(hdl) (hdl & CAM_REQ_MGR_HDL_IDX_MASK)
+#define CAM_REQ_MGR_GET_HDL_TYPE(hdl) \
+	((hdl >> CAM_REQ_MGR_HDL_IDX_POS) & CAM_REQ_MGR_HDL_TYPE_MASK)
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_req_mgr_workq.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_req_mgr_workq.c
@@ -0,0 +1,360 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "cam_req_mgr_workq.h"
+#include "cam_debug_util.h"
+#include "cam_common_util.h"
+
+#define WORKQ_ACQUIRE_LOCK(workq, flags) {\
+	if ((workq)->in_irq) \
+		spin_lock_irqsave(&(workq)->lock_bh, (flags)); \
+	else \
+		spin_lock_bh(&(workq)->lock_bh); \
+}
+
+#define WORKQ_RELEASE_LOCK(workq, flags) {\
+	if ((workq)->in_irq) \
+		spin_unlock_irqrestore(&(workq)->lock_bh, (flags)); \
+	else	\
+		spin_unlock_bh(&(workq)->lock_bh); \
+}
+
+struct crm_workq_task *cam_req_mgr_workq_get_task(
+	struct cam_req_mgr_core_workq *workq)
+{
+	struct crm_workq_task *task = NULL;
+	unsigned long flags = 0;
+
+	if (!workq)
+		return NULL;
+
+	WORKQ_ACQUIRE_LOCK(workq, flags);
+	if (list_empty(&workq->task.empty_head))
+		goto end;
+
+	task = list_first_entry(&workq->task.empty_head,
+		struct crm_workq_task, entry);
+	if (task) {
+		atomic_sub(1, &workq->task.free_cnt);
+		list_del_init(&task->entry);
+	}
+
+end:
+	WORKQ_RELEASE_LOCK(workq, flags);
+
+	return task;
+}
+
+static void cam_req_mgr_workq_put_task(struct crm_workq_task *task)
+{
+	struct cam_req_mgr_core_workq *workq =
+		(struct cam_req_mgr_core_workq *)task->parent;
+	unsigned long flags = 0;
+
+	list_del_init(&task->entry);
+	task->cancel = 0;
+	task->process_cb = NULL;
+	task->priv = NULL;
+	WORKQ_ACQUIRE_LOCK(workq, flags);
+	list_add_tail(&task->entry,
+		&workq->task.empty_head);
+	atomic_add(1, &workq->task.free_cnt);
+	WORKQ_RELEASE_LOCK(workq, flags);
+}
+
+void cam_req_mgr_workq_flush(struct cam_req_mgr_core_workq *workq)
+{
+	if (!workq) {
+		CAM_ERR(CAM_CRM, "workq is null");
+		return;
+	}
+
+	atomic_set(&workq->flush, 1);
+	cancel_work_sync(&workq->work);
+	atomic_set(&workq->flush, 0);
+}
+
+/**
+ * cam_req_mgr_process_task() - Process the enqueued task
+ * @task: pointer to task workq thread shall process
+ */
+static int cam_req_mgr_process_task(struct crm_workq_task *task)
+{
+	if (!task)
+		return -EINVAL;
+
+	if (task->process_cb)
+		task->process_cb(task->priv, task->payload);
+	else
+		CAM_WARN(CAM_CRM, "FATAL:no task handler registered for workq");
+	cam_req_mgr_workq_put_task(task);
+
+	return 0;
+}
+
+#ifdef CONFIG_SPECTRA_KT
+
+/**
+ * cam_req_mgr_process_workq() - main loop handling
+ * @w: workqueue task pointer
+ */
+void cam_req_mgr_process_workq(struct work_struct *w)
+{
+	struct cam_req_mgr_core_workq *workq = NULL;
+	struct crm_workq_task         *task;
+	int32_t                        i = CRM_TASK_PRIORITY_0;
+	unsigned long                  flags = 0;
+	ktime_t                        curr_time;
+
+	if (!w) {
+		CAM_ERR(CAM_CRM, "NULL task pointer can not schedule");
+		return;
+	}
+	workq = (struct cam_req_mgr_core_workq *)
+		container_of(w, struct cam_req_mgr_core_workq, work);
+
+	cam_common_util_thread_switch_delay_detect(
+		"CRM workq schedule",
+		workq->workq_scheduled_ts,
+		CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+	curr_time = ktime_get();
+	while (i < CRM_TASK_PRIORITY_MAX) {
+		WORKQ_ACQUIRE_LOCK(workq, flags);
+		while (!list_empty(&workq->task.process_head[i])) {
+			task = list_first_entry(&workq->task.process_head[i],
+				struct crm_workq_task, entry);
+			atomic_sub(1, &workq->task.pending_cnt);
+			list_del_init(&task->entry);
+			WORKQ_RELEASE_LOCK(workq, flags);
+			cam_req_mgr_process_task(task);
+			CAM_DBG(CAM_CRM, "processed task %pK free_cnt %d",
+				task, atomic_read(&workq->task.free_cnt));
+			WORKQ_ACQUIRE_LOCK(workq, flags);
+		}
+		WORKQ_RELEASE_LOCK(workq, flags);
+		i++;
+	}
+	cam_common_util_thread_switch_delay_detect(
+		"CRM workq execution",
+		curr_time,
+		CAM_WORKQ_EXE_TIME_THRESHOLD);
+}
+
+#else
+
+/**
+ * cam_req_mgr_process_workq() - main loop handling
+ * @w: workqueue task pointer
+ */
+void cam_req_mgr_process_workq(struct work_struct *w)
+{
+	struct cam_req_mgr_core_workq *workq = NULL;
+	struct crm_workq_task         *task;
+	int32_t                        i = CRM_TASK_PRIORITY_0;
+	unsigned long                  flags = 0;
+	ktime_t                        sched_start_time;
+	void                          *cb = NULL;
+
+	if (!w) {
+		CAM_ERR(CAM_CRM, "NULL task pointer can not schedule");
+		return;
+	}
+	workq = (struct cam_req_mgr_core_workq *)
+		container_of(w, struct cam_req_mgr_core_workq, work);
+
+	while (i < CRM_TASK_PRIORITY_MAX) {
+		WORKQ_ACQUIRE_LOCK(workq, flags);
+		while (!list_empty(&workq->task.process_head[i])) {
+			task = list_first_entry(&workq->task.process_head[i],
+				struct crm_workq_task, entry);
+			cb = (void *)task->process_cb;
+			cam_common_util_thread_switch_delay_detect(
+				workq->workq_name, "schedule", cb,
+				task->task_scheduled_ts,
+				CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+			sched_start_time = ktime_get();
+			atomic_sub(1, &workq->task.pending_cnt);
+			list_del_init(&task->entry);
+			WORKQ_RELEASE_LOCK(workq, flags);
+			if (!unlikely(atomic_read(&workq->flush)))
+				cam_req_mgr_process_task(task);
+			cam_common_util_thread_switch_delay_detect(
+				workq->workq_name, "execution", cb,
+				sched_start_time,
+				CAM_WORKQ_SCHEDULE_TIME_THRESHOLD);
+			CAM_DBG(CAM_CRM, "processed task %pK free_cnt %d",
+				task, atomic_read(&workq->task.free_cnt));
+			WORKQ_ACQUIRE_LOCK(workq, flags);
+		}
+		WORKQ_RELEASE_LOCK(workq, flags);
+		i++;
+	}
+}
+
+#endif /* ifdef CONFIG_SPECTRA_KT */
+
+int cam_req_mgr_workq_enqueue_task(struct crm_workq_task *task,
+	void *priv, int32_t prio)
+{
+	int rc = 0;
+	struct cam_req_mgr_core_workq *workq = NULL;
+	unsigned long flags = 0;
+
+	if (!task) {
+		CAM_WARN(CAM_CRM, "NULL task pointer can not schedule");
+		return -EINVAL;
+	}
+	workq = (struct cam_req_mgr_core_workq *)task->parent;
+	if (!workq) {
+		CAM_WARN_RATE_LIMIT(CAM_CRM, "NULL workq pointer suspect mem corruption");
+		return -EINVAL;
+	}
+
+	if (task->cancel == 1 || atomic_read(&workq->flush)) {
+		rc = 0;
+		goto abort;
+	}
+	task->priv = priv;
+	task->priority =
+		(prio < CRM_TASK_PRIORITY_MAX && prio >= CRM_TASK_PRIORITY_0)
+		? prio : CRM_TASK_PRIORITY_0;
+
+#ifndef CONFIG_SPECTRA_KT
+	task->task_scheduled_ts = ktime_get();
+#endif /* ifndef CONFIG_SPECTRA_KT */
+
+	WORKQ_ACQUIRE_LOCK(workq, flags);
+	if (!workq->job) {
+		rc = -EINVAL;
+		WORKQ_RELEASE_LOCK(workq, flags);
+		goto abort;
+	}
+
+	list_add_tail(&task->entry,
+		&workq->task.process_head[task->priority]);
+
+	atomic_add(1, &workq->task.pending_cnt);
+	CAM_DBG(CAM_CRM, "enq task %pK pending_cnt %d",
+		task, atomic_read(&workq->task.pending_cnt));
+
+	queue_work(workq->job, &workq->work);
+#ifdef CONFIG_SPECTRA_KT
+	workq->workq_scheduled_ts = ktime_get();
+#endif /* ifdef CONFIG_SPECTRA_KT */
+	WORKQ_RELEASE_LOCK(workq, flags);
+
+	return rc;
+abort:
+	cam_req_mgr_workq_put_task(task);
+	CAM_INFO(CAM_CRM, "task aborted and queued back to pool");
+	return rc;
+}
+
+int cam_req_mgr_workq_create(char *name, int32_t num_tasks,
+	struct cam_req_mgr_core_workq **workq, enum crm_workq_context in_irq,
+	int flags, void (*func)(struct work_struct *w))
+{
+	int32_t i, wq_flags = 0, max_active_tasks = 0;
+	struct crm_workq_task  *task;
+	struct cam_req_mgr_core_workq *crm_workq = NULL;
+	char buf[128] = "crm_workq-";
+
+	if (!*workq) {
+		crm_workq = kzalloc(sizeof(struct cam_req_mgr_core_workq),
+			GFP_KERNEL);
+		if (crm_workq == NULL)
+			return -ENOMEM;
+
+		wq_flags |= WQ_UNBOUND;
+		if (flags & CAM_WORKQ_FLAG_HIGH_PRIORITY)
+			wq_flags |= WQ_HIGHPRI;
+
+		if (flags & CAM_WORKQ_FLAG_SERIAL)
+			max_active_tasks = 1;
+
+		strlcat(buf, name, sizeof(buf));
+		CAM_DBG(CAM_CRM, "create workque crm_workq-%s", name);
+		crm_workq->job = alloc_workqueue(buf,
+			wq_flags, max_active_tasks, NULL);
+		if (!crm_workq->job) {
+			kfree(crm_workq);
+			return -ENOMEM;
+		}
+
+		/* Workq attributes initialization */
+		strscpy(crm_workq->workq_name, buf, sizeof(crm_workq->workq_name));
+		INIT_WORK(&crm_workq->work, func);
+		spin_lock_init(&crm_workq->lock_bh);
+		CAM_DBG(CAM_CRM, "LOCK_DBG workq %s lock %pK",
+			name, &crm_workq->lock_bh);
+
+		/* Task attributes initialization */
+		atomic_set(&crm_workq->task.pending_cnt, 0);
+		atomic_set(&crm_workq->task.free_cnt, 0);
+		for (i = CRM_TASK_PRIORITY_0; i < CRM_TASK_PRIORITY_MAX; i++)
+			INIT_LIST_HEAD(&crm_workq->task.process_head[i]);
+		INIT_LIST_HEAD(&crm_workq->task.empty_head);
+		atomic_set(&crm_workq->flush, 0);
+		crm_workq->in_irq = in_irq;
+		crm_workq->task.num_task = num_tasks;
+		crm_workq->task.pool = kcalloc(crm_workq->task.num_task,
+				sizeof(struct crm_workq_task), GFP_KERNEL);
+		if (!crm_workq->task.pool) {
+			CAM_WARN(CAM_CRM, "Insufficient memory %zu",
+				sizeof(struct crm_workq_task) *
+				crm_workq->task.num_task);
+			kfree(crm_workq);
+			return -ENOMEM;
+		}
+
+		for (i = 0; i < crm_workq->task.num_task; i++) {
+			task = &crm_workq->task.pool[i];
+			task->parent = (void *)crm_workq;
+			/* Put all tasks in free pool */
+			INIT_LIST_HEAD(&task->entry);
+			cam_req_mgr_workq_put_task(task);
+		}
+		*workq = crm_workq;
+		CAM_DBG(CAM_CRM, "free tasks %d",
+			atomic_read(&crm_workq->task.free_cnt));
+	}
+
+	return 0;
+}
+
+void cam_req_mgr_workq_destroy(struct cam_req_mgr_core_workq **crm_workq)
+{
+	unsigned long flags = 0;
+	struct workqueue_struct   *job;
+	struct cam_req_mgr_core_workq *workq;
+	int i;
+
+	if (crm_workq && *crm_workq) {
+		workq = *crm_workq;
+		CAM_DBG(CAM_CRM, "destroy workque %s", workq->workq_name);
+		WORKQ_ACQUIRE_LOCK(workq, flags);
+		/* prevent any processing of callbacks */
+		atomic_set(&workq->flush, 1);
+		if (workq->job) {
+			job = workq->job;
+			workq->job = NULL;
+			WORKQ_RELEASE_LOCK(workq, flags);
+			destroy_workqueue(job);
+			WORKQ_ACQUIRE_LOCK(workq, flags);
+		}
+		/* Destroy workq payload data */
+		kfree(workq->task.pool[0].payload);
+		kfree(workq->task.pool);
+
+		/* Leave lists in stable state after freeing pool */
+		INIT_LIST_HEAD(&workq->task.empty_head);
+		for (i = 0; i < CRM_TASK_PRIORITY_MAX; i++)
+			INIT_LIST_HEAD(&workq->task.process_head[i]);
+		*crm_workq = NULL;
+		WORKQ_RELEASE_LOCK(workq, flags);
+		kfree(workq);
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_req_mgr_workq.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_req_mgr_workq.h
@@ -0,0 +1,190 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _CAM_REQ_MGR_WORKQ_H_
+#define _CAM_REQ_MGR_WORKQ_H_
+
+#include<linux/kernel.h>
+#include<linux/module.h>
+#include<linux/init.h>
+#include<linux/sched.h>
+#include <linux/workqueue.h>
+#include <linux/slab.h>
+#include <linux/timer.h>
+
+/* Threshold for scheduling delay in ms */
+#define CAM_WORKQ_SCHEDULE_TIME_THRESHOLD   5
+
+/* Threshold for execution delay in ms */
+#define CAM_WORKQ_EXE_TIME_THRESHOLD        10
+
+/* Flag to create a high priority workq */
+#define CAM_WORKQ_FLAG_HIGH_PRIORITY             (1 << 0)
+
+/*
+ * This flag ensures only one task from a given
+ * workq will execute at any given point on any
+ * given CPU.
+ */
+#define CAM_WORKQ_FLAG_SERIAL                    (1 << 1)
+
+/* Task priorities, lower the number higher the priority*/
+enum crm_task_priority {
+	CRM_TASK_PRIORITY_0,
+	CRM_TASK_PRIORITY_1,
+	CRM_TASK_PRIORITY_MAX,
+};
+
+/* workqueue will be used from irq context or not */
+enum crm_workq_context {
+	CRM_WORKQ_USAGE_NON_IRQ,
+	CRM_WORKQ_USAGE_IRQ,
+	CRM_WORKQ_USAGE_INVALID,
+};
+
+/** struct crm_workq_task
+ * @priority         : caller can assign priority to task based on type.
+ * @payload          : depending of user of task this payload type will change
+ * @process_cb       : registered callback called by workq when task enqueued is
+ *                     ready for processing in workq thread context
+ * @parent           : workq's parent is link which is enqqueing taks to this workq
+ * @entry            : list head of this list entry is worker's empty_head
+ * @cancel           : if caller has got free task from pool but wants to abort
+ *                     or put back without using it
+ * @priv             : when task is enqueuer caller can attach priv along which
+ *                     it will get in process callback
+ * @ret              : return value in future to use for blocking calls
+ * @task_scheduled_ts: enqueue time of task
+ */
+struct crm_workq_task {
+	int32_t                    priority;
+	int32_t                    ret;
+	void                      *payload;
+	int32_t                  (*process_cb)(void *priv, void *data);
+	void                      *parent;
+	struct list_head           entry;
+	uint8_t                    cancel;
+	void                      *priv;
+	ktime_t                    task_scheduled_ts;
+};
+
+/** struct cam_req_mgr_core_workq
+ * @work        : work token used by workqueue
+ * @job         : workqueue internal job struct
+ * @lock_bh     : lock for task structs
+ * @in_irq      : set true if workque can be used in irq context
+ * @flush       : used to track if flush has been called on workqueue
+ * @work_q_name : name of the workq
+ * @workq_scheduled_ts: enqueue time of workq
+ * task -
+ * @lock        : Current task's lock handle
+ * @pending_cnt : # of tasks left in queue
+ * @free_cnt    : # of free/available tasks
+ * @process_head:
+ * @empty_head  : list  head of available taska which can be used
+ *                or acquired in order to enqueue a task to workq
+ * @pool        : pool of tasks used for handling events in workq context
+ * @num_task    : size of tasks pool
+ */
+struct cam_req_mgr_core_workq {
+	struct work_struct         work;
+	struct workqueue_struct   *job;
+	spinlock_t                 lock_bh;
+	uint32_t                   in_irq;
+	ktime_t                    workq_scheduled_ts;
+	atomic_t                   flush;
+	char                       workq_name[128];
+
+	/* tasks */
+	struct {
+		struct mutex           lock;
+		atomic_t               pending_cnt;
+		atomic_t               free_cnt;
+
+		struct list_head       process_head[CRM_TASK_PRIORITY_MAX];
+		struct list_head       empty_head;
+		struct crm_workq_task *pool;
+		uint32_t               num_task;
+	} task;
+};
+
+/**
+ * struct cam_req_mgr_core_workq_mini_dump
+ * @workq_scheduled_ts: scheduled ts
+ * task -
+ * @pending_cnt : # of tasks left in queue
+ * @free_cnt    : # of free/available tasks
+ * @num_task    : size of tasks pool
+ */
+struct cam_req_mgr_core_workq_mini_dump {
+	ktime_t                    workq_scheduled_ts;
+	/* tasks */
+	struct {
+		uint32_t               pending_cnt;
+		uint32_t               free_cnt;
+		uint32_t               num_task;
+	} task;
+};
+/**
+ * cam_req_mgr_process_workq() - main loop handling
+ * @w: workqueue task pointer
+ */
+void cam_req_mgr_process_workq(struct work_struct *w);
+
+/**
+ * cam_req_mgr_workq_create()
+ * @brief    : create a workqueue
+ * @name     : Name of the workque to be allocated, it is combination
+ *             of session handle and link handle
+ * @num_task : Num_tasks to be allocated for workq
+ * @workq    : Double pointer worker
+ * @in_irq   : Set to one if workq might be used in irq context
+ * @flags    : Bitwise OR of Flags for workq behavior.
+ *             e.g. CAM_REQ_MGR_WORKQ_HIGH_PRIORITY | CAM_REQ_MGR_WORKQ_SERIAL
+ * @func     : function pointer for cam_req_mgr_process_workq wrapper function
+ * This function will allocate and create workqueue and pass
+ * the workq pointer to caller.
+ */
+int cam_req_mgr_workq_create(char *name, int32_t num_tasks,
+	struct cam_req_mgr_core_workq **workq, enum crm_workq_context in_irq,
+	int flags, void (*func)(struct work_struct *w));
+
+/**
+ * cam_req_mgr_workq_destroy()
+ * @brief: destroy workqueue
+ * @workq: pointer to worker data struct
+ * this function will destroy workqueue and clean up resources
+ * associated with worker such as tasks.
+ */
+void cam_req_mgr_workq_destroy(struct cam_req_mgr_core_workq **workq);
+
+/**
+ * cam_req_mgr_workq_enqueue_task()
+ * @brief: Enqueue task in worker queue
+ * @task : task to be processed by worker
+ * @priv : clients private data
+ * @prio : task priority
+ * process callback func
+ */
+int cam_req_mgr_workq_enqueue_task(struct crm_workq_task *task,
+	void *priv, int32_t prio);
+
+/**
+ * cam_req_mgr_workq_get_task()
+ * @brief: Returns empty task pointer for use
+ * @workq: workque used for processing
+ */
+struct crm_workq_task *cam_req_mgr_workq_get_task(
+	struct cam_req_mgr_core_workq *workq);
+
+/**
+ * cam_req_mgr_workq_flush()
+ * @brief: Flushes the work queue. Function will sleep until any active task is complete.
+ * @workq: pointer to worker data struct
+ */
+void cam_req_mgr_workq_flush(struct cam_req_mgr_core_workq *workq);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_soc_bus.h
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_soc_bus.h
@@ -0,0 +1,171 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _CAM_SOC_BUS_H_
+#define _CAM_SOC_BUS_H_
+
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include "cam_debug_util.h"
+#include "cam_cpas.h"
+
+#ifdef CONFIG_SPECTRA_KT
+
+#define CAM_SOC_BUS_MAX_NUM_USECASES 8
+
+#else
+
+#define CAM_SOC_BUS_MAX_NUM_USECASES 9
+
+#endif // CONFIG_SPECTRA_KT
+
+
+enum cam_soc_bus_path_data {
+	CAM_SOC_BUS_PATH_DATA_HLOS,
+	CAM_SOC_BUS_PATH_DATA_DRV_HIGH,
+	CAM_SOC_BUS_PATH_DATA_DRV_LOW,
+	CAM_SOC_BUS_PATH_DATA_MAX,
+};
+
+/**
+ * struct cam_soc_bus_client_ab_ib : Bandwidth values for selected usecase
+ *
+ * @ab: Arbitrated Bandwidth
+ * @ib: Instantaneous Bandwidth
+ */
+struct cam_soc_bus_client_ab_ib {
+	uint64_t ab;
+	uint64_t ib;
+};
+
+#ifdef CONFIG_SPECTRA_KT
+
+/**
+ * struct cam_soc_bus_client_common_data : Common data fields for bus client
+ *
+ * @name: Name of bus client
+ * @src_id: Bus master/src id
+ * @dst_id: Bus slave/dst id
+ * @num_usecases: Number of use cases for this client
+ * @bw_pair: Bandwidth values for applicable usecases
+ */
+struct cam_soc_bus_client_common_data {
+	const char *name;
+	uint32_t src_id;
+	uint32_t dst_id;
+	int num_usecases;
+	struct cam_soc_bus_client_ab_ib bw_pair[CAM_SOC_BUS_MAX_NUM_USECASES];
+};
+
+#else
+
+/**
+ * struct cam_soc_bus_client_common_data : Common data fields for bus client
+ *
+ * @name: Name of bus client
+ * @src_id: Bus master/src id
+ * @dst_id: Bus slave/dst id
+ * @is_drv_port: If DRV bus client
+ * @num_usecases: Number of use cases for this client
+ * @bw_pair: Bandwidth values for applicable usecases
+ */
+struct cam_soc_bus_client_common_data {
+	const char *name;
+	uint32_t src_id;
+	uint32_t dst_id;
+	bool is_drv_port;
+	int num_usecases;
+	struct cam_soc_bus_client_ab_ib bw_pair[CAM_SOC_BUS_MAX_NUM_USECASES];
+};
+
+#endif // CONFIG_SPECTRA_KT
+
+/**
+ * struct cam_soc_bus_client : Bus client information
+ *
+ * @client_data: Bus client data
+ * @common_data: Common data fields for bus client
+ */
+struct cam_soc_bus_client {
+	void *client_data;
+	struct cam_soc_bus_client_common_data *common_data;
+};
+
+
+#if IS_REACHABLE(CONFIG_QCOM_BUS_SCALING) || \
+	IS_REACHABLE(CONFIG_INTERCONNECT_QCOM)
+
+const char *cam_soc_bus_path_data_to_str(enum cam_soc_bus_path_data bus_path_data);
+
+int cam_soc_bus_client_update_request(void *client, unsigned int idx);
+
+#ifdef CONFIG_SPECTRA_KT
+
+int cam_soc_bus_client_update_bw(void *client, uint64_t ab,
+	uint64_t ib);
+
+int cam_soc_bus_client_register(struct platform_device *pdev,
+	struct device_node *dev_node, void **client,
+	struct cam_soc_bus_client_common_data *common_data);
+
+#else
+
+int cam_soc_bus_client_update_bw(void *client, uint64_t ab, uint64_t ib,
+	enum cam_soc_bus_path_data bus_path_data);
+
+int cam_soc_bus_client_register(struct platform_device *pdev,
+	struct device_node *dev_node, void **client,
+	struct cam_soc_bus_client_common_data *common_data, bool use_path_name);
+
+#endif // CONFIG_SPECTRA_KT
+
+void cam_soc_bus_client_unregister(void **client);
+
+#else
+
+static const char *cam_soc_bus_path_data_to_str(enum cam_soc_bus_path_data bus_path_data)
+{
+	return NULL;
+}
+
+static inline int cam_soc_bus_client_update_request(void *client,
+	unsigned int idx)
+{
+	return 0;
+}
+
+#ifdef CONFIG_SPECTRA_KT
+
+static inline int cam_soc_bus_client_update_bw(void *client,
+	uint64_t ab, uint64_t ib)
+{
+	return 0;
+}
+
+#else
+
+int cam_soc_bus_client_update_bw(void *client, uint64_t ab, uint64_t ib,
+	enum cam_soc_bus_path_data bus_path_data)
+{
+	return 0;
+}
+
+#endif // CONFIG_SPECTRA_KT
+
+static inline int cam_soc_bus_client_register(
+	struct platform_device *pdev, struct device_node *dev_node,
+	void **client, struct cam_soc_bus_client_common_data *common_data)
+{
+	return 0;
+}
+
+static inline void cam_soc_bus_client_unregister(void **client)
+{
+}
+
+#endif
+
+#endif /* _CAM_SOC_BUS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/common/cam_soc_icc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/common/cam_soc_icc.c
@@ -0,0 +1,444 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/interconnect.h>
+#include <linux/math64.h>
+
+#include <dt-bindings/interconnect/qcom,icc.h>
+
+#include "cam_compat.h"
+#include "cam_soc_bus.h"
+
+#ifdef CONFIG_SPECTRA_KT
+
+/**
+ * struct cam_soc_bus_client_data : Bus client data
+ *
+ * @icc_data: Bus icc path information
+ */
+struct cam_soc_bus_client_data {
+	struct icc_path *icc_data;
+};
+
+#else
+
+/**
+ * struct cam_soc_bus_client_data : Bus client data
+ *
+ * @icc_data: Bus icc path information
+ */
+struct cam_soc_bus_client_data {
+	struct icc_path *icc_data[CAM_SOC_BUS_PATH_DATA_MAX];
+};
+
+#endif /* ifdef CONFIG_SPECTRA_KT */
+
+const char *cam_soc_bus_path_data_to_str(enum cam_soc_bus_path_data bus_path_data)
+{
+	switch (bus_path_data) {
+	case CAM_SOC_BUS_PATH_DATA_HLOS:
+		return "BUS_PATH_HLOS";
+	case CAM_SOC_BUS_PATH_DATA_DRV_HIGH:
+		return "BUS_PATH_DRV_HIGH";
+	case CAM_SOC_BUS_PATH_DATA_DRV_LOW:
+		return "BUS_PATH_DRV_LOW";
+	default:
+		return "BUS_PATH_INVALID";
+	}
+}
+
+#ifdef CONFIG_SPECTRA_KT
+int cam_soc_bus_client_update_request(void *client, unsigned int idx)
+{
+	int rc = 0;
+	uint64_t ab = 0, ib = 0;
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) client;
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+
+	if (idx >= bus_client->common_data->num_usecases) {
+		CAM_ERR(CAM_UTIL, "Invalid vote level=%d, usecases=%d", idx,
+			bus_client->common_data->num_usecases);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ab = bus_client->common_data->bw_pair[idx].ab;
+	ib = bus_client->common_data->bw_pair[idx].ib;
+
+	CAM_DBG(CAM_PERF, "Bus client=[%s] index[%d] ab[%llu] ib[%llu]",
+		bus_client->common_data->name, idx, ab, ib);
+
+	rc = icc_set_bw(bus_client_data->icc_data, div_u64(ab, 1000),
+		div_u64(ib, 1000));
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Update request failed, client[%s], idx: %d",
+			bus_client->common_data->name, idx);
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+int cam_soc_bus_client_update_bw(void *client, uint64_t ab, uint64_t ib)
+{
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) client;
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+	int rc = 0;
+
+	CAM_DBG(CAM_PERF, "Bus client=[%s] :ab[%llu] ib[%llu]",
+		bus_client->common_data->name, ab, ib);
+	rc = icc_set_bw(bus_client_data->icc_data, div_u64(ab, 1000),
+		div_u64(ib, 1000));
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Update request failed, client[%s]",
+			bus_client->common_data->name);
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+int cam_soc_bus_client_register(struct platform_device *pdev,
+	struct device_node *dev_node, void **client,
+	struct cam_soc_bus_client_common_data *common_data)
+{
+	struct cam_soc_bus_client *bus_client = NULL;
+	struct cam_soc_bus_client_data *bus_client_data = NULL;
+	int rc = 0;
+
+	bus_client = kzalloc(sizeof(struct cam_soc_bus_client), GFP_KERNEL);
+	if (!bus_client) {
+		CAM_ERR(CAM_UTIL, "soc bus client is NULL");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	*client = bus_client;
+
+	bus_client_data = kzalloc(sizeof(struct cam_soc_bus_client_data),
+		GFP_KERNEL);
+	if (!bus_client_data) {
+		kfree(bus_client);
+		*client = NULL;
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_client->client_data = bus_client_data;
+	bus_client->common_data = common_data;
+	bus_client_data->icc_data = of_icc_get(&pdev->dev,
+		bus_client->common_data->name);
+	if (IS_ERR_OR_NULL(bus_client_data->icc_data)) {
+		CAM_ERR(CAM_UTIL, "failed in register bus client");
+		rc = -EINVAL;
+		goto error;
+	}
+
+	rc = icc_set_bw(bus_client_data->icc_data, 0, 0);
+	if (rc) {
+		CAM_ERR(CAM_UTIL, "Bus client update request failed, rc = %d",
+			rc);
+		goto fail_unregister_client;
+	}
+
+	CAM_DBG(CAM_PERF, "Register Bus Client=[%s] : src=%d, dst=%d",
+		bus_client->common_data->name, bus_client->common_data->src_id,
+		bus_client->common_data->dst_id);
+
+	return 0;
+
+fail_unregister_client:
+	icc_put(bus_client_data->icc_data);
+error:
+	kfree(bus_client_data);
+	bus_client->client_data = NULL;
+	kfree(bus_client);
+	*client = NULL;
+end:
+	return rc;
+
+}
+
+void cam_soc_bus_client_unregister(void **client)
+{
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) (*client);
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+
+	icc_put(bus_client_data->icc_data);
+	kfree(bus_client_data);
+	bus_client->client_data = NULL;
+	kfree(bus_client);
+	*client = NULL;
+
+}
+
+#else
+
+static inline struct icc_path *cam_wrapper_icc_get(struct device *dev,
+	const int src_id, const int dst_id, const char *name, bool use_path_name)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_ICC) {
+		CAM_WARN(CAM_UTIL, "Bypass icc get for %d %d", src_id, dst_id);
+		return (struct icc_path *)BYPASS_VALUE;
+	}
+
+	return cam_icc_get_path(dev, src_id, dst_id, name, use_path_name);
+}
+
+static inline void cam_wrapper_icc_put(struct icc_path *path)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_ICC) {
+		CAM_WARN(CAM_UTIL, "Bypass icc put");
+		return;
+	}
+
+	return icc_put(path);
+}
+
+static inline int cam_wrapper_icc_set_bw(struct icc_path *path,
+	u32 avg_bw, u32 peak_bw)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_ICC) {
+		CAM_WARN(CAM_UTIL, "Bypass icc set bw");
+		return 0;
+	}
+
+	return icc_set_bw(path, avg_bw, peak_bw);
+}
+
+static inline void cam_wrapper_icc_set_tag(struct icc_path *path,
+	u32 tag)
+{
+	if (debug_bypass_drivers & CAM_BYPASS_ICC) {
+		CAM_WARN(CAM_UTIL, "Bypass icc set tag");
+		return;
+	}
+
+	icc_set_tag(path, tag);
+}
+
+int cam_soc_bus_client_update_request(void *client, unsigned int idx)
+{
+	int rc = 0;
+	uint64_t ab = 0, ib = 0;
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) client;
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+
+	if (idx >= bus_client->common_data->num_usecases) {
+		CAM_ERR(CAM_UTIL, "Invalid vote level=%d, usecases=%d", idx,
+			bus_client->common_data->num_usecases);
+		rc = -EINVAL;
+		goto end;
+	}
+
+	ab = bus_client->common_data->bw_pair[idx].ab;
+	ib = bus_client->common_data->bw_pair[idx].ib;
+
+	CAM_DBG(CAM_PERF, "Bus client=[%s] index[%d] ab[%llu] ib[%llu]",
+		bus_client->common_data->name, idx, ab, ib);
+
+	rc = cam_wrapper_icc_set_bw(
+		bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_HLOS],
+		Bps_to_icc(ab),
+		Bps_to_icc(ib));
+	if (rc) {
+		CAM_ERR(CAM_UTIL,
+			"Update request failed, client[%s], idx: %d",
+			bus_client->common_data->name, idx);
+		goto end;
+	}
+
+end:
+	return rc;
+}
+
+int cam_soc_bus_client_update_bw(void *client, uint64_t ab, uint64_t ib,
+	enum cam_soc_bus_path_data bus_path_data)
+{
+		struct cam_soc_bus_client *bus_client =
+			(struct cam_soc_bus_client *) client;
+		struct cam_soc_bus_client_data *bus_client_data =
+			(struct cam_soc_bus_client_data *) bus_client->client_data;
+		int rc = 0;
+
+		CAM_DBG(CAM_PERF, "Bus client=[%s] [%s] :ab[%llu] ib[%llu]",
+			bus_client->common_data->name, cam_soc_bus_path_data_to_str(bus_path_data),
+			ab, ib);
+		rc = cam_wrapper_icc_set_bw(
+			bus_client_data->icc_data[bus_path_data], Bps_to_icc(ab),
+			Bps_to_icc(ib));
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Update request failed, client[%s]",
+				bus_client->common_data->name);
+			goto end;
+		}
+
+end:
+	return rc;
+
+}
+
+int cam_soc_bus_client_register(struct platform_device *pdev,
+	struct device_node *dev_node, void **client,
+	struct cam_soc_bus_client_common_data *common_data, bool use_path_name)
+{
+	struct cam_soc_bus_client *bus_client = NULL;
+	struct cam_soc_bus_client_data *bus_client_data = NULL;
+	int rc = 0;
+
+	bus_client = kzalloc(sizeof(struct cam_soc_bus_client), GFP_KERNEL);
+	if (!bus_client) {
+		CAM_ERR(CAM_UTIL, "soc bus client is NULL");
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	*client = bus_client;
+
+	bus_client_data = kzalloc(sizeof(struct cam_soc_bus_client_data), GFP_KERNEL);
+	if (!bus_client_data) {
+		kfree(bus_client);
+		*client = NULL;
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	bus_client->client_data = bus_client_data;
+	bus_client->common_data = common_data;
+	if (bus_client->common_data->is_drv_port) {
+		bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_HIGH] =
+			cam_wrapper_icc_get(&pdev->dev,
+				bus_client->common_data->src_id, bus_client->common_data->dst_id,
+				bus_client->common_data->name, use_path_name);
+		if (IS_ERR_OR_NULL(bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_HIGH])) {
+			CAM_ERR(CAM_UTIL,
+				"Failed to register DRV bus client Bus Client=[%s] : src=%d, dst=%d bus_path:%d",
+				bus_client->common_data->src_id, bus_client->common_data->dst_id,
+				CAM_SOC_BUS_PATH_DATA_DRV_HIGH);
+			rc = -EINVAL;
+			goto error;
+		}
+
+		bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_LOW] =
+		cam_wrapper_icc_get(&pdev->dev,
+			bus_client->common_data->src_id, bus_client->common_data->dst_id,
+			bus_client->common_data->name, use_path_name);
+		if (IS_ERR_OR_NULL(bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_LOW])) {
+			CAM_ERR(CAM_UTIL,
+				"Failed to register DRV bus client Bus Client=[%s] : src=%d, dst=%d bus_path:%d",
+				bus_client->common_data->src_id, bus_client->common_data->dst_id,
+				CAM_SOC_BUS_PATH_DATA_DRV_LOW);
+			rc = -EINVAL;
+			goto error;
+		}
+
+		/* Set appropriate tags for HIGH and LOW vote paths */
+		cam_wrapper_icc_set_tag(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_HIGH],
+			QCOM_ICC_TAG_ACTIVE_ONLY);
+		cam_wrapper_icc_set_tag(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_LOW],
+			QCOM_ICC_TAG_SLEEP);
+
+		rc = cam_wrapper_icc_set_bw(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_HIGH], 0, 0);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Bus client[%s] update request failed, rc = %d",
+				bus_client->common_data->name, rc);
+			goto fail_unregister_client;
+		}
+
+		rc = cam_wrapper_icc_set_bw(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_LOW], 0, 0);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Bus client[%s] update request failed, rc = %d",
+				bus_client->common_data->name, rc);
+			goto fail_unregister_client;
+		}
+	} else {
+		bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_HLOS] =
+			cam_wrapper_icc_get(&pdev->dev,
+				bus_client->common_data->src_id, bus_client->common_data->dst_id,
+				bus_client->common_data->name, use_path_name);
+		if (IS_ERR_OR_NULL(bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_HLOS])) {
+			CAM_ERR(CAM_UTIL, "failed to register HLOS bus client");
+			rc = -EINVAL;
+			goto error;
+		}
+
+		rc = cam_wrapper_icc_set_bw(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_HLOS], 0, 0);
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Bus client[%s] update request failed, rc = %d",
+				bus_client->common_data->name, rc);
+			goto fail_unregister_client;
+		}
+	}
+
+	CAM_DBG(CAM_PERF, "Register Bus Client=[%s] : src=%d, dst=%d is_drv_port:%s",
+		bus_client->common_data->name, bus_client->common_data->src_id,
+		bus_client->common_data->dst_id,
+		CAM_BOOL_TO_YESNO(bus_client->common_data->is_drv_port));
+
+	return 0;
+
+fail_unregister_client:
+	if (bus_client->common_data->is_drv_port) {
+		cam_wrapper_icc_put(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_HIGH]);
+		cam_wrapper_icc_put(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_LOW]);
+	} else {
+		cam_wrapper_icc_put(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_HLOS]);
+	}
+
+error:
+	kfree(bus_client_data);
+	bus_client->client_data = NULL;
+	kfree(bus_client);
+	*client = NULL;
+end:
+	return rc;
+
+}
+
+void cam_soc_bus_client_unregister(void **client)
+{
+	struct cam_soc_bus_client *bus_client =
+		(struct cam_soc_bus_client *) (*client);
+	struct cam_soc_bus_client_data *bus_client_data =
+		(struct cam_soc_bus_client_data *) bus_client->client_data;
+
+	if (bus_client->common_data->is_drv_port) {
+		cam_wrapper_icc_put(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_HIGH]);
+		cam_wrapper_icc_put(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_DRV_LOW]);
+	} else {
+		cam_wrapper_icc_put(
+			bus_client_data->icc_data[CAM_SOC_BUS_PATH_DATA_HLOS]);
+	}
+
+	kfree(bus_client_data);
+	bus_client->client_data = NULL;
+	kfree(bus_client);
+	*client = NULL;
+
+}
+
+#endif /* ifdef CONFIG_SPECTRA_KT */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/config/qcm6490-camera.mk
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/config/qcm6490-camera.mk
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+CONFIG_SPECTRA_KT :=y
+CONFIG_SPECTRA_ISP := y
+CONFIG_SPECTRA_ICP := y
+CONFIG_SPECTRA_JPEG := y
+CONFIG_SPECTRA_LRME := y
+CONFIG_SPECTRA_SENSOR := y
+
+# Flags to pass into C preprocessor
+ccflags-y += -DCONFIG_SPECTRA_KT=1
+ccflags-y += -DCONFIG_SPECTRA_ISP=1
+ccflags-y += -DCONFIG_SPECTRA_ICP=1
+ccflags-y += -DCONFIG_SPECTRA_JPEG=1
+ccflags-y += -DCONFIG_SPECTRA_LRME=1
+ccflags-y += -DCONFIG_SPECTRA_SENSOR=1
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/config/qcs8300-camera.mk
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/config/qcs8300-camera.mk
@@ -0,0 +1,18 @@
+# Localized KCONFIG settings
+CONFIG_SPECTRA_ISP := y
+CONFIG_SPECTRA_SFE := y
+CONFIG_SPECTRA_ICP := y
+CONFIG_SPECTRA_SENSOR := y
+CONFIG_SPECTRA_SECURE_CAMNOC_REG_UPDATE := y
+
+# Flags to pass into C preprocessor
+ccflags-y += -DCONFIG_SPECTRA_ISP=1
+ccflags-y += -DCONFIG_SPECTRA_ICP=1
+ccflags-y += -DCONFIG_SPECTRA_SENSOR=1
+ccflags-y += -DCONFIG_SPECTRA_SECURE_CAMNOC_REG_UPDATE=1
+
+# External Dependencies
+# KBUILD_CPPFLAGS += -DCONFIG_MSM_MMRM=1
+ifeq ($(CONFIG_QCOM_VA_MINIDUMP), y)
+KBUILD_CPPFLAGS += -DCONFIG_QCOM_VA_MINIDUMP=1
+endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/config/qcs8550-camera.mk
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/config/qcs8550-camera.mk
@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Localized KCONFIG settings
+CONFIG_SPECTRA_ISP := y
+CONFIG_SPECTRA_ICP := y
+CONFIG_SPECTRA_JPEG := y
+CONFIG_SPECTRA_CRE := y
+CONFIG_SPECTRA_SENSOR := y
+# CONFIG_SPECTRA_LLCC_STALING := y
+# CONFIG_SPECTRA_USE_RPMH_DRV_API := y
+# CONFIG_SPECTRA_USE_CLK_CRM_API := y
+# CONFIG_DOMAIN_ID_SECURE_CAMERA := y
+# CONFIG_DYNAMIC_FD_PORT_CONFIG := y
+
+# Flags to pass into C preprocessor
+ccflags-y += -DCONFIG_SPECTRA_ISP=1
+ccflags-y += -DCONFIG_SPECTRA_ICP=1
+ccflags-y += -DCONFIG_SPECTRA_JPEG=1
+ccflags-y += -DCONFIG_SPECTRA_CRE=1
+ccflags-y += -DCONFIG_SPECTRA_SENSOR=1
+# ccflags-y += -DCONFIG_SPECTRA_LLCC_STALING=1
+# ccflags-y += -DCONFIG_SPECTRA_USE_RPMH_DRV_API=1
+# ccflags-y += -DCONFIG_SPECTRA_USE_CLK_CRM_API=1
+# ccflags-y += -DCONFIG_DOMAIN_ID_SECURE_CAMERA=1
+# ccflags-y += -DCONFIG_DYNAMIC_FD_PORT_CONFIG=1
+
+# External Dependencies
+# KBUILD_CPPFLAGS += -DCONFIG_MSM_MMRM=1
+ifeq ($(CONFIG_QCOM_VA_MINIDUMP), y)
+KBUILD_CPPFLAGS += -DCONFIG_QCOM_VA_MINIDUMP=1
+endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/config/qcs9100-camera.mk
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/config/qcs9100-camera.mk
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Localized KCONFIG settings
+CONFIG_SPECTRA_ISP := y
+CONFIG_SPECTRA_SFE := y
+CONFIG_SPECTRA_ICP := y
+CONFIG_SPECTRA_SENSOR := y
+CONFIG_SPECTRA_SECURE_CAMNOC_REG_UPDATE := y
+
+# Flags to pass into C preprocessor
+ccflags-y += -DCONFIG_SPECTRA_ISP=1
+ccflags-y += -DCONFIG_SPECTRA_ICP=1
+ccflags-y += -DCONFIG_SPECTRA_SENSOR=1
+ccflags-y += -DCONFIG_SPECTRA_SECURE_CAMNOC_REG_UPDATE=1
+
+# External Dependencies
+# KBUILD_CPPFLAGS += -DCONFIG_MSM_MMRM=1
+ifeq ($(CONFIG_QCOM_VA_MINIDUMP), y)
+KBUILD_CPPFLAGS += -DCONFIG_QCOM_VA_MINIDUMP=1
+endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/camera/sanitize_uapi.sh
+++ linux-qcom-6.8.0/ubuntu/qcom/camera/sanitize_uapi.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env sh
+
+# Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+# SPDX-License-Identifier: GPL-2.0-only
+
+mkdir -p $OUT_DIR
+
+for hfile in $( ls $IN_DIR )
+do
+	echo "Process file $IN_DIR/$hfile"
+	headers_install.sh $IN_DIR/$hfile $OUT_DIR/$hfile &
+done
+
+wait
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/Android.bp
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/Android.bp
@@ -0,0 +1,35 @@
+headers_src = [
+    "include/uapi/linux/*.h",
+]
+
+gfx_headers_out = [
+    "linux/msm_kgsl.h",
+]
+
+gfx_kernel_headers_verbose = "--verbose "
+genrule {
+    name: "qti_generate_gfx_kernel_headers",
+    tools: ["headers_install.sh",
+            "unifdef"
+    ],
+    tool_files: [
+         "gfx_kernel_headers.py",
+    ],
+    srcs: headers_src,
+    cmd: "python3 -u $(location gfx_kernel_headers.py) " +
+        gfx_kernel_headers_verbose +
+        "--header_arch arm64 " +
+        "--gen_dir $(genDir) " +
+        "--gfx_include_uapi $(locations include/uapi/linux/*.h) " +
+        "--unifdef $(location unifdef) " +
+        "--headers_install $(location headers_install.sh)",
+    out: gfx_headers_out,
+}
+
+cc_library_headers {
+    name: "qti_gfx_kernel_uapi",
+    generated_headers: ["qti_generate_gfx_kernel_headers"],
+    export_generated_headers: ["qti_generate_gfx_kernel_headers"],
+    vendor: true,
+    recovery_available: true
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/Android.mk
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/Android.mk
@@ -0,0 +1,53 @@
+ifeq ($(TARGET_USES_QMAA),true)
+	KGSL_ENABLED := false
+	ifeq ($(TARGET_USES_QMAA_OVERRIDE_GFX),true)
+		KGSL_ENABLED := true
+	endif # TARGET_USES_QMAA_OVERRIDE_GFX
+else
+	KGSL_ENABLED := true
+endif # TARGET_USES_QMAA
+
+ifeq ($(ENABLE_HYP), true)
+        KGSL_ENABLED := false
+endif
+
+LOCAL_MODULE_DDK_BUILD := true
+LOCAL_MODULE_DDK_ALLOW_UNSAFE_HEADERS := true
+
+ifeq ($(KGSL_ENABLED),true)
+KGSL_SELECT := CONFIG_QCOM_KGSL=m
+
+LOCAL_PATH := $(call my-dir)
+include $(CLEAR_VARS)
+
+# This makefile is only for DLKM
+ifneq ($(findstring vendor,$(LOCAL_PATH)),)
+
+DLKM_DIR   := device/qcom/common/dlkm
+
+KBUILD_OPTIONS += BOARD_PLATFORM=$(TARGET_BOARD_PLATFORM)
+KBUILD_OPTIONS += $(KGSL_SELECT)
+KBUILD_OPTIONS += MODNAME=msm_kgsl
+ifeq ($(TARGET_BOARD_PLATFORM), pineapple)
+	KBUILD_OPTIONS += KBUILD_EXTRA_SYMBOLS+=$(PWD)/$(call intermediates-dir-for,DLKM,hw-fence-module-symvers)/Module.symvers
+endif
+
+include $(CLEAR_VARS)
+# For incremental compilation
+LOCAL_SRC_FILES   := $(wildcard $(LOCAL_PATH)/**/*) $(wildcard $(LOCAL_PATH)/*)
+LOCAL_MODULE      := msm_kgsl.ko
+LOCAL_MODULE_KBUILD_NAME  := msm_kgsl.ko
+LOCAL_MODULE_TAGS         := optional
+LOCAL_MODULE_DEBUG_ENABLE := true
+LOCAL_MODULE_PATH := $(KERNEL_MODULES_OUT)
+
+ifeq ($(TARGET_BOARD_PLATFORM), pineapple)
+	LOCAL_REQUIRED_MODULES    := hw-fence-module-symvers
+	LOCAL_ADDITIONAL_DEPENDENCIES := $(call intermediates-dir-for,DLKM,hw-fence-module-symvers)/Module.symvers
+endif
+# Include msm_kgsl.ko in the /vendor/lib/modules (vendor.img)
+BOARD_VENDOR_KERNEL_MODULES += $(LOCAL_MODULE_PATH)/$(LOCAL_MODULE)
+include $(DLKM_DIR)/Build_external_kernelmodule.mk
+
+endif # DLKM check
+endif # KGSL_ENABLED
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/BUILD.bazel
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/BUILD.bazel
@@ -0,0 +1,5 @@
+load(":build/kgsl_defs.bzl", "define_target_module")
+
+define_target_module("pineapple")
+define_target_module("sun")
+define_target_module("blair")
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/Kbuild
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/Kbuild
@@ -0,0 +1,147 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+KDIR := $(TOP)/kernel_platform/common
+
+ifeq ($(KGSL_PATH),)
+KGSL_PATH=$(src)
+endif
+
+# If we're not GVM and not in an Android tree, select KGSL config
+ifeq ($(CONFIG_QTI_QUIN_GVM),)
+	ifeq ($(ANDROID_BUILD_TOP),)
+		CONFIG_QCOM_KGSL = m
+	endif
+endif
+
+include $(KGSL_PATH)/config/gki_k2c.conf
+
+ifeq ($(CONFIG_ARCH_WAIPIO), y)
+	include $(KGSL_PATH)/config/gki_waipiodisp.conf
+endif
+ifeq ($(CONFIG_ARCH_KALAMA), y)
+	include $(KGSL_PATH)/config/gki_kalama.conf
+endif
+ifeq ($(CONFIG_ARCH_PINEAPPLE), y)
+	include $(KGSL_PATH)/config/gki_pineapple.conf
+endif
+ifeq ($(CONFIG_ARCH_BLAIR), y)
+	include $(KGSL_PATH)/config/gki_blair.conf
+endif
+ifeq ($(CONFIG_ARCH_SA8155), y)
+	include $(KGSL_PATH)/config/gki_sa8155.conf
+endif
+ifeq ($(CONFIG_ARCH_KHAJE), y)
+	include $(KGSL_PATH)/config/gki_khajedisp.conf
+endif
+ifeq ($(CONFIG_ARCH_SA8195), y)
+	include $(KGSL_PATH)/config/gki_sa8155.conf
+endif
+ifeq ($(CONFIG_ARCH_SA6155), y)
+	include $(KGSL_PATH)/config/gki_sa8155.conf
+endif
+ifeq ($(CONFIG_ARCH_MONACO), y)
+	include $(KGSL_PATH)/config/gki_monaco.conf
+endif
+ifeq ($(CONFIG_ARCH_LEMANS), y)
+	include $(KGSL_PATH)/config/gki_lemans.conf
+endif
+ifeq ($(CONFIG_ARCH_KONA), y)
+        include $(KGSL_PATH)/config/gki_kona.conf
+endif
+ifeq ($(CONFIG_ARCH_TRINKET), y)
+	include $(KGSL_PATH)/config/gki_trinket.conf
+endif
+ifeq ($(CONFIG_ARCH_QCS405), y)
+	include $(KGSL_PATH)/config/gki_qcs405.conf
+endif
+ifeq ($(CONFIG_ARCH_HOLI), y)
+	include $(KGSL_PATH)/config/gki_blair.conf
+endif
+
+ccflags-y += -I$(KGSL_PATH) -I$(KGSL_PATH)/include/linux -I$(KGSL_PATH)/include -I$(KERNEL_SRC)/drivers/devfreq
+
+obj-$(CONFIG_QCOM_KGSL) += msm_kgsl.o
+
+msm_kgsl-y = \
+	kgsl.o \
+	kgsl_bus.o \
+	kgsl_drawobj.o \
+	kgsl_events.o \
+	kgsl_eventlog.o \
+	kgsl_gmu_core.o \
+	kgsl_ioctl.o \
+	kgsl_mmu.o \
+	kgsl_pwrctrl.o \
+	kgsl_pwrscale.o \
+	kgsl_regmap.o \
+	kgsl_sharedmem.o \
+	kgsl_snapshot.o \
+	kgsl_timeline.o \
+	kgsl_trace.o \
+	kgsl_util.o \
+	kgsl_vbo.o
+
+msm_kgsl-$(CONFIG_COMPAT) += kgsl_compat.o
+msm_kgsl-$(CONFIG_DEBUG_FS) += kgsl_debugfs.o
+msm_kgsl-$(CONFIG_ARM_SMMU) += kgsl_iommu.o
+msm_kgsl-$(CONFIG_SYNC_FILE) += kgsl_sync.o
+msm_kgsl-$(CONFIG_QCOM_KGSL_PROCESS_RECLAIM) += kgsl_reclaim.o
+
+ifndef CONFIG_QCOM_KGSL_USE_SHMEM
+	msm_kgsl-y += kgsl_pool.o
+endif
+
+msm_kgsl-y += \
+	adreno.o \
+	adreno_a3xx.o \
+	adreno_a3xx_perfcounter.o \
+	adreno_a3xx_ringbuffer.o \
+	adreno_a3xx_snapshot.o \
+	adreno_a5xx.o \
+	adreno_a5xx_perfcounter.o \
+	adreno_a5xx_preempt.o \
+	adreno_a5xx_ringbuffer.o \
+	adreno_a5xx_snapshot.o \
+	adreno_a6xx.o \
+	adreno_a6xx_gmu.o \
+	adreno_a6xx_gmu_snapshot.o \
+	adreno_a6xx_hfi.o \
+	adreno_a6xx_hwsched.o \
+	adreno_a6xx_hwsched_hfi.o \
+	adreno_a6xx_perfcounter.o \
+	adreno_a6xx_preempt.o \
+	adreno_a6xx_rgmu.o \
+	adreno_a6xx_ringbuffer.o \
+	adreno_a6xx_rpmh.o \
+	adreno_a6xx_snapshot.o \
+	adreno_cp_parser.o \
+	adreno_dispatch.o \
+	adreno_drawctxt.o \
+	adreno_gen7.o \
+	adreno_gen7_gmu.o \
+	adreno_gen7_gmu_snapshot.o \
+	adreno_gen7_hfi.o \
+	adreno_gen7_hwsched.o \
+	adreno_gen7_hwsched_hfi.o \
+	adreno_gen7_perfcounter.o \
+	adreno_gen7_preempt.o \
+	adreno_gen7_ringbuffer.o \
+	adreno_gen7_rpmh.o \
+	adreno_gen7_snapshot.o \
+	adreno_hwsched.o \
+	adreno_ioctl.o \
+	adreno_perfcounter.o \
+	adreno_ringbuffer.o \
+	adreno_snapshot.o \
+	adreno_sysfs.o \
+	adreno_trace.o \
+	governor_msm_adreno_tz.o \
+	governor_gpubw_mon.o
+
+msm_kgsl-$(CONFIG_COMPAT) += adreno_compat.o
+msm_kgsl-$(CONFIG_QCOM_KGSL_CORESIGHT) += adreno_coresight.o
+msm_kgsl-$(CONFIG_QCOM_KGSL_CORESIGHT) += adreno_a3xx_coresight.o
+msm_kgsl-$(CONFIG_QCOM_KGSL_CORESIGHT) += adreno_a5xx_coresight.o
+msm_kgsl-$(CONFIG_QCOM_KGSL_CORESIGHT) += adreno_a6xx_coresight.o
+msm_kgsl-$(CONFIG_QCOM_KGSL_CORESIGHT) += adreno_gen7_coresight.o
+msm_kgsl-$(CONFIG_DEBUG_FS) += adreno_debugfs.o adreno_profile.o
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/Kconfig
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/Kconfig
@@ -0,0 +1,126 @@
+# SPDX-License-Identifier: GPL-2.0-only
+config QCOM_KGSL
+	tristate "Qualcomm Technologies, Inc. 3D Graphics driver"
+	depends on ARCH_QCOM
+	depends on NVMEM_QCOM_QFPROM
+	select QCOM_MDT_LOADER
+	select INTERVAL_TREE
+	select TRACE_GPU_MEM
+	help
+	  3D graphics driver for the Adreno family of GPUs from QTI.
+	  Required to use hardware accelerated OpenGL, compute and Vulkan
+	  on QTI targets. This includes power management, memory management,
+	  and scheduling for the Adreno GPUs.
+
+config DEVFREQ_GOV_QCOM_ADRENO_TZ
+	tristate "Qualcomm Technologies, Inc. GPU frequency governor"
+	depends on PM_DEVFREQ
+	help
+	  GPU frequency governor for the Adreno GPU. Sets the frequency
+	  using an "on demand" algorithm in conjunction with other
+	  components on Adreno platforms. This is not useful for non-Adreno
+	  devices.
+
+config DEVFREQ_GOV_QCOM_GPUBW_MON
+	tristate "Qualcomm Technologies, Inc. GPU bandwidth governor"
+	depends on DEVFREQ_GOV_QCOM_ADRENO_TZ
+	help
+	  This governor works together with the Adreno GPU governor to
+	  select bus frequency votes using an "on-demand" algorithm.
+	  This governor will not be useful for non-Adreno based
+	  targets.
+
+config QCOM_KGSL_FENCE_TRACE
+	bool "Enable built-in tracing for adreno fence timeouts"
+	help
+	  A boolean flag used to create a KGSL-specific tracing instance
+	  under <tracefs>/tracing/instances/kgsl-fence that can be used
+	  for debugging timeouts for fences between KGSL-contexts and
+	  sync-point blocks. If unsure, say 'N' here.
+
+config QCOM_ADRENO_DEFAULT_GOVERNOR
+	string "devfreq governor for the adreno core"
+	default "msm-adreno-tz"
+
+config QCOM_KGSL_CORESIGHT
+	bool "Enable coresight support for the Adreno GPU"
+	depends on CORESIGHT
+	default y
+	help
+	  When enabled, the Adreno GPU is available as a source for Coresight
+	  data. On a6xx targets there are two sources available for the GX and
+	  CX domains respectively. Debug kernels should say 'Y' here.
+
+config QCOM_KGSL_IOCOHERENCY_DEFAULT
+	bool "Enable I/O coherency on cached GPU memory by default"
+	default y if ARCH_LAHAINA
+	help
+	 Say 'Y' here to enable I/O cache coherency by default on targets that
+	 support hardware I/O coherency. If enabled all cached GPU memory
+	 will use I/O coherency regardless of the user flags. If not enabled
+	 the user can still selectively enable I/O coherency with a flag.
+
+config QCOM_KGSL_IDLE_TIMEOUT
+	int
+	default 80
+	help
+	  GPU idle timeout for Adreno GPU. This value decides after how
+	  long the GPU will go into slumber. A higher value will mean that
+	  the GPU is powered ON for a longer duration which will have
+	  power costs.
+
+config QCOM_KGSL_CONTEXT_DEBUG
+	bool "Log kgsl context information for all processes"
+	help
+	  When enabled, total number of KGSL contexts, number of attached and
+	  detached contexts are dumped into kernel log for all the processes.
+	  This gives insight about the number of contexts held by each process.
+
+config QCOM_KGSL_SORT_POOL
+	bool "Sort pool page list based on physical address"
+	default y
+	help
+	  When enabled, the pool page list is sorted based on physical
+	  addresses. This can be turned on for targets where better DDR
+	  efficiency is attained on accesses for adjacent memory.
+
+config QCOM_KGSL_QDSS_STM
+	bool "Enable support for QDSS STM for Adreno GPU"
+	depends on CORESIGHT
+	help
+	  When enabled, the Adreno GPU QDSS STM support is enabled. GPU QDSS STM
+	  memory will be mapped to GPU and QDSS clock needed to access this memory
+	  is voted. Debug kernels should say 'Y' here.
+
+config QCOM_KGSL_USE_SHMEM
+	bool "Enable using shmem for memory allocations"
+	depends on SHMEM
+	help
+	  Say 'Y' to enable using shmem for memory allocations. If enabled,
+	  there will be no support for the memory pools and higher order pages.
+	  But using shmem will help in making kgsl pages available for
+	  reclaiming.
+
+config QCOM_KGSL_PROCESS_RECLAIM
+	bool "Make driver pages available for reclaim"
+	select QCOM_KGSL_USE_SHMEM
+	help
+	  Say 'Y' to make driver pages available for reclaiming. If enabled,
+	  shmem will be used for allocation. kgsl would know the process
+	  foreground/background activity through the sysfs entry exposed per
+	  process. Based on this kgsl can unpin given number of pages from
+	  background processes and make them available to the shrinker.
+
+config QCOM_KGSL_HIBERNATION
+	bool "Enable Hibernation support in KGSL"
+	depends on HIBERNATION
+	help
+	  Say 'Y' to enable hibernation support in kgsl. If enabled, kgsl
+	  will register necessary power manager callbacks to support
+	  hibernation.
+
+config QCOM_KGSL_UPSTREAM
+	bool "Enable KGSL compilation with upstream kernel"
+	help
+	  Say 'Y' to enable kgsl compilation with upstream kernel. If enabled,
+	  all downstream dependencies are stubbed out.
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/Makefile
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/Makefile
@@ -0,0 +1,18 @@
+ifeq ($(KGSL_MODULE_ROOT),)
+CUR_MKFILE = $(abspath $(lastword $(MAKEFILE_LIST)))
+KGSL_MODULE_ROOT = $(dir $(CUR_MKFILE))
+endif
+
+KBUILD_OPTIONS+=KGSL_PATH=$(KGSL_MODULE_ROOT)
+
+SRC := $(shell pwd)
+
+all:
+	$(MAKE) -C $(KERNEL_SRC) M=$(SRC) modules $(KBUILD_OPTIONS)
+
+modules_install:
+	$(MAKE) M=$(SRC) -C $(KERNEL_SRC) modules_install
+%:
+	$(MAKE) -C $(KERNEL_SRC) M=$(M) $@ $(KBUILD_OPTIONS)
+clean:
+	$(MAKE) -C $(KERNEL_SRC) M=$(SRC) clean
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/a3xx_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/a3xx_reg.h
@@ -0,0 +1,564 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2017,2019-2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _A300_REG_H
+#define _A300_REG_H
+
+/* Interrupt bit positions within RBBM_INT_0 */
+
+#define A3XX_INT_RBBM_GPU_IDLE 0
+#define A3XX_INT_RBBM_AHB_ERROR 1
+#define A3XX_INT_RBBM_REG_TIMEOUT 2
+#define A3XX_INT_RBBM_ME_MS_TIMEOUT 3
+#define A3XX_INT_RBBM_PFP_MS_TIMEOUT 4
+#define A3XX_INT_RBBM_ATB_BUS_OVERFLOW 5
+#define A3XX_INT_VFD_ERROR 6
+#define A3XX_INT_CP_SW_INT 7
+#define A3XX_INT_CP_T0_PACKET_IN_IB 8
+#define A3XX_INT_CP_OPCODE_ERROR 9
+#define A3XX_INT_CP_RESERVED_BIT_ERROR 10
+#define A3XX_INT_CP_HW_FAULT 11
+#define A3XX_INT_CP_DMA 12
+#define A3XX_INT_CP_IB2_INT 13
+#define A3XX_INT_CP_IB1_INT 14
+#define A3XX_INT_CP_RB_INT 15
+#define A3XX_INT_CP_REG_PROTECT_FAULT 16
+#define A3XX_INT_CP_RB_DONE_TS 17
+#define A3XX_INT_CP_VS_DONE_TS 18
+#define A3XX_INT_CP_PS_DONE_TS 19
+#define A3XX_INT_CACHE_FLUSH_TS 20
+#define A3XX_INT_CP_AHB_ERROR_HALT 21
+#define A3XX_INT_MISC_HANG_DETECT 24
+#define A3XX_INT_UCHE_OOB_ACCESS 25
+
+/* Register definitions */
+
+#define A3XX_RBBM_CLOCK_CTL 0x010
+#define A3XX_RBBM_SP_HYST_CNT 0x012
+#define A3XX_RBBM_SW_RESET_CMD 0x018
+#define A3XX_RBBM_AHB_CTL0 0x020
+#define A3XX_RBBM_AHB_CTL1 0x021
+#define A3XX_RBBM_AHB_CMD 0x022
+#define A3XX_RBBM_AHB_ERROR_STATUS 0x027
+#define A3XX_RBBM_GPR0_CTL 0x02E
+/* This the same register as on A2XX, just in a different place */
+#define A3XX_RBBM_STATUS 0x030
+#define A3XX_RBBM_WAIT_IDLE_CLOCKS_CTL 0x33
+#define A3XX_RBBM_INTERFACE_HANG_INT_CTL 0x50
+#define A3XX_RBBM_INT_CLEAR_CMD 0x061
+#define A3XX_RBBM_INT_0_MASK 0x063
+#define A3XX_RBBM_INT_0_STATUS 0x064
+#define A3XX_RBBM_PERFCTR_CTL 0x80
+#define A3XX_RBBM_PERFCTR_LOAD_CMD0 0x81
+#define A3XX_RBBM_PERFCTR_LOAD_CMD1 0x82
+#define A3XX_RBBM_PERFCTR_LOAD_VALUE_LO 0x84
+#define A3XX_RBBM_PERFCTR_LOAD_VALUE_HI 0x85
+#define A3XX_RBBM_PERFCOUNTER0_SELECT 0x86
+#define A3XX_RBBM_PERFCOUNTER1_SELECT 0x87
+#define A3XX_RBBM_GPU_BUSY_MASKED 0x88
+#define A3XX_RBBM_PERFCTR_CP_0_LO 0x90
+#define A3XX_RBBM_PERFCTR_CP_0_HI 0x91
+#define A3XX_RBBM_PERFCTR_RBBM_0_LO 0x92
+#define A3XX_RBBM_PERFCTR_RBBM_0_HI 0x93
+#define A3XX_RBBM_PERFCTR_RBBM_1_LO 0x94
+#define A3XX_RBBM_PERFCTR_RBBM_1_HI 0x95
+#define A3XX_RBBM_PERFCTR_PC_0_LO 0x96
+#define A3XX_RBBM_PERFCTR_PC_0_HI 0x97
+#define A3XX_RBBM_PERFCTR_PC_1_LO 0x98
+#define A3XX_RBBM_PERFCTR_PC_1_HI 0x99
+#define A3XX_RBBM_PERFCTR_PC_2_LO 0x9A
+#define A3XX_RBBM_PERFCTR_PC_2_HI 0x9B
+#define A3XX_RBBM_PERFCTR_PC_3_LO 0x9C
+#define A3XX_RBBM_PERFCTR_PC_3_HI 0x9D
+#define A3XX_RBBM_PERFCTR_VFD_0_LO 0x9E
+#define A3XX_RBBM_PERFCTR_VFD_0_HI 0x9F
+#define A3XX_RBBM_PERFCTR_VFD_1_LO 0xA0
+#define A3XX_RBBM_PERFCTR_VFD_1_HI 0xA1
+#define A3XX_RBBM_PERFCTR_HLSQ_0_LO 0xA2
+#define A3XX_RBBM_PERFCTR_HLSQ_0_HI 0xA3
+#define A3XX_RBBM_PERFCTR_HLSQ_1_LO 0xA4
+#define A3XX_RBBM_PERFCTR_HLSQ_1_HI 0xA5
+#define A3XX_RBBM_PERFCTR_HLSQ_2_LO 0xA6
+#define A3XX_RBBM_PERFCTR_HLSQ_2_HI 0xA7
+#define A3XX_RBBM_PERFCTR_HLSQ_3_LO 0xA8
+#define A3XX_RBBM_PERFCTR_HLSQ_3_HI 0xA9
+#define A3XX_RBBM_PERFCTR_HLSQ_4_LO 0xAA
+#define A3XX_RBBM_PERFCTR_HLSQ_4_HI 0xAB
+#define A3XX_RBBM_PERFCTR_HLSQ_5_LO 0xAC
+#define A3XX_RBBM_PERFCTR_HLSQ_5_HI 0xAD
+#define A3XX_RBBM_PERFCTR_VPC_0_LO 0xAE
+#define A3XX_RBBM_PERFCTR_VPC_0_HI 0xAF
+#define A3XX_RBBM_PERFCTR_VPC_1_LO 0xB0
+#define A3XX_RBBM_PERFCTR_VPC_1_HI 0xB1
+#define A3XX_RBBM_PERFCTR_TSE_0_LO 0xB2
+#define A3XX_RBBM_PERFCTR_TSE_0_HI 0xB3
+#define A3XX_RBBM_PERFCTR_TSE_1_LO 0xB4
+#define A3XX_RBBM_PERFCTR_TSE_1_HI 0xB5
+#define A3XX_RBBM_PERFCTR_RAS_0_LO 0xB6
+#define A3XX_RBBM_PERFCTR_RAS_0_HI 0xB7
+#define A3XX_RBBM_PERFCTR_RAS_1_LO 0xB8
+#define A3XX_RBBM_PERFCTR_RAS_1_HI 0xB9
+#define A3XX_RBBM_PERFCTR_UCHE_0_LO 0xBA
+#define A3XX_RBBM_PERFCTR_UCHE_0_HI 0xBB
+#define A3XX_RBBM_PERFCTR_UCHE_1_LO 0xBC
+#define A3XX_RBBM_PERFCTR_UCHE_1_HI 0xBD
+#define A3XX_RBBM_PERFCTR_UCHE_2_LO 0xBE
+#define A3XX_RBBM_PERFCTR_UCHE_2_HI 0xBF
+#define A3XX_RBBM_PERFCTR_UCHE_3_LO 0xC0
+#define A3XX_RBBM_PERFCTR_UCHE_3_HI 0xC1
+#define A3XX_RBBM_PERFCTR_UCHE_4_LO 0xC2
+#define A3XX_RBBM_PERFCTR_UCHE_4_HI 0xC3
+#define A3XX_RBBM_PERFCTR_UCHE_5_LO 0xC4
+#define A3XX_RBBM_PERFCTR_UCHE_5_HI 0xC5
+#define A3XX_RBBM_PERFCTR_TP_0_LO 0xC6
+#define A3XX_RBBM_PERFCTR_TP_0_HI 0xC7
+#define A3XX_RBBM_PERFCTR_TP_1_LO 0xC8
+#define A3XX_RBBM_PERFCTR_TP_1_HI 0xC9
+#define A3XX_RBBM_PERFCTR_TP_2_LO 0xCA
+#define A3XX_RBBM_PERFCTR_TP_2_HI 0xCB
+#define A3XX_RBBM_PERFCTR_TP_3_LO 0xCC
+#define A3XX_RBBM_PERFCTR_TP_3_HI 0xCD
+#define A3XX_RBBM_PERFCTR_TP_4_LO 0xCE
+#define A3XX_RBBM_PERFCTR_TP_4_HI 0xCF
+#define A3XX_RBBM_PERFCTR_TP_5_LO 0xD0
+#define A3XX_RBBM_PERFCTR_TP_5_HI 0xD1
+#define A3XX_RBBM_PERFCTR_SP_0_LO 0xD2
+#define A3XX_RBBM_PERFCTR_SP_0_HI 0xD3
+#define A3XX_RBBM_PERFCTR_SP_1_LO 0xD4
+#define A3XX_RBBM_PERFCTR_SP_1_HI 0xD5
+#define A3XX_RBBM_PERFCTR_SP_2_LO 0xD6
+#define A3XX_RBBM_PERFCTR_SP_2_HI 0xD7
+#define A3XX_RBBM_PERFCTR_SP_3_LO 0xD8
+#define A3XX_RBBM_PERFCTR_SP_3_HI 0xD9
+#define A3XX_RBBM_PERFCTR_SP_4_LO 0xDA
+#define A3XX_RBBM_PERFCTR_SP_4_HI 0xDB
+#define A3XX_RBBM_PERFCTR_SP_5_LO 0xDC
+#define A3XX_RBBM_PERFCTR_SP_5_HI 0xDD
+#define A3XX_RBBM_PERFCTR_SP_6_LO 0xDE
+#define A3XX_RBBM_PERFCTR_SP_6_HI 0xDF
+#define A3XX_RBBM_PERFCTR_SP_7_LO 0xE0
+#define A3XX_RBBM_PERFCTR_SP_7_HI 0xE1
+#define A3XX_RBBM_PERFCTR_RB_0_LO 0xE2
+#define A3XX_RBBM_PERFCTR_RB_0_HI 0xE3
+#define A3XX_RBBM_PERFCTR_RB_1_LO 0xE4
+#define A3XX_RBBM_PERFCTR_RB_1_HI 0xE5
+
+#define A3XX_RBBM_RBBM_CTL 0x100
+#define A3XX_RBBM_PERFCTR_PWR_0_LO 0x0EA
+#define A3XX_RBBM_PERFCTR_PWR_0_HI 0x0EB
+#define A3XX_RBBM_PERFCTR_PWR_1_LO 0x0EC
+#define A3XX_RBBM_PERFCTR_PWR_1_HI 0x0ED
+#define A3XX_RBBM_DEBUG_BUS_CTL 0x111
+#define A3XX_RBBM_DEBUG_BUS_DATA_STATUS 0x112
+#define A3XX_RBBM_DEBUG_BUS_STB_CTL0 0x11B
+#define A3XX_RBBM_DEBUG_BUS_STB_CTL1 0x11C
+#define A3XX_RBBM_INT_TRACE_BUS_CTL 0x11D
+#define A3XX_RBBM_EXT_TRACE_BUS_CTL 0x11E
+#define A3XX_RBBM_EXT_TRACE_STOP_CNT 0x11F
+#define A3XX_RBBM_EXT_TRACE_START_CNT 0x120
+#define A3XX_RBBM_EXT_TRACE_PERIOD_CNT 0x121
+#define A3XX_RBBM_EXT_TRACE_CMD 0x122
+#define A3XX_CP_RB_BASE 0x01C0
+#define A3XX_CP_RB_CNTL 0x01C1
+#define A3XX_CP_RB_RPTR 0x01C4
+#define A3XX_CP_RB_WPTR 0x01C5
+/* Following two are same as on A2XX, just in a different place */
+#define A3XX_CP_PFP_UCODE_ADDR 0x1C9
+#define A3XX_CP_PFP_UCODE_DATA 0x1CA
+#define A3XX_CP_ROQ_ADDR 0x1CC
+#define A3XX_CP_ROQ_DATA 0x1CD
+#define A3XX_CP_MERCIU_ADDR 0x1D1
+#define A3XX_CP_MERCIU_DATA 0x1D2
+#define A3XX_CP_MERCIU_DATA2 0x1D3
+#define A3XX_CP_QUEUE_THRESHOLDS 0x01D5
+#define A3XX_CP_MEQ_ADDR 0x1DA
+#define A3XX_CP_MEQ_DATA 0x1DB
+#define A3XX_CP_STATE_DEBUG_INDEX 0x01EC
+#define A3XX_CP_STATE_DEBUG_DATA 0x01ED
+#define A3XX_CP_CNTL 0x01F4
+#define A3XX_CP_WFI_PEND_CTR 0x01F5
+#define A3XX_CP_ME_CNTL 0x01F6
+#define A3XX_CP_ME_STATUS 0x01F7
+#define A3XX_CP_ME_RAM_WADDR 0x01F8
+#define A3XX_CP_ME_RAM_RADDR 0x01F9
+#define A3XX_CP_ME_RAM_DATA 0x01FA
+#define A3XX_CP_DEBUG 0x01FC
+
+#define A3XX_RBBM_PM_OVERRIDE2 0x039D
+
+#define A3XX_CP_PERFCOUNTER_SELECT 0x445
+#define A3XX_CP_IB1_BASE 0x0458
+#define A3XX_CP_IB1_BUFSZ 0x0459
+#define A3XX_CP_IB2_BASE 0x045A
+#define A3XX_CP_IB2_BUFSZ 0x045B
+
+#define A3XX_CP_HW_FAULT  0x45C
+#define A3XX_CP_PROTECT_CTRL 0x45E
+#define A3XX_CP_PROTECT_STATUS 0x45F
+#define A3XX_CP_PROTECT_REG_0 0x460
+#define A3XX_CP_STAT 0x047F
+#define A3XX_CP_SCRATCH_REG0 0x578
+#define A3XX_CP_SCRATCH_REG6 0x57E
+#define A3XX_CP_SCRATCH_REG7 0x57F
+#define A3XX_VSC_SIZE_ADDRESS 0xC02
+#define A3XX_VSC_PIPE_DATA_ADDRESS_0 0xC07
+#define A3XX_VSC_PIPE_DATA_LENGTH_0 0xC08
+#define A3XX_VSC_PIPE_DATA_ADDRESS_1 0xC0A
+#define A3XX_VSC_PIPE_DATA_LENGTH_1 0xC0B
+#define A3XX_VSC_PIPE_DATA_ADDRESS_2 0xC0D
+#define A3XX_VSC_PIPE_DATA_LENGTH_2 0xC0E
+#define A3XX_VSC_PIPE_DATA_ADDRESS_3 0xC10
+#define A3XX_VSC_PIPE_DATA_LENGTH_3 0xC11
+#define A3XX_VSC_PIPE_DATA_ADDRESS_4 0xC13
+#define A3XX_VSC_PIPE_DATA_LENGTH_4 0xC14
+#define A3XX_VSC_PIPE_DATA_ADDRESS_5 0xC16
+#define A3XX_VSC_PIPE_DATA_LENGTH_5 0xC17
+#define A3XX_VSC_PIPE_DATA_ADDRESS_6 0xC19
+#define A3XX_VSC_PIPE_DATA_LENGTH_6 0xC1A
+#define A3XX_VSC_PIPE_DATA_ADDRESS_7 0xC1C
+#define A3XX_VSC_PIPE_DATA_LENGTH_7 0xC1D
+#define A3XX_PC_PERFCOUNTER0_SELECT 0xC48
+#define A3XX_PC_PERFCOUNTER1_SELECT 0xC49
+#define A3XX_PC_PERFCOUNTER2_SELECT 0xC4A
+#define A3XX_PC_PERFCOUNTER3_SELECT 0xC4B
+#define A3XX_GRAS_TSE_DEBUG_ECO 0xC81
+#define A3XX_GRAS_PERFCOUNTER0_SELECT 0xC88
+#define A3XX_GRAS_PERFCOUNTER1_SELECT 0xC89
+#define A3XX_GRAS_PERFCOUNTER2_SELECT 0xC8A
+#define A3XX_GRAS_PERFCOUNTER3_SELECT 0xC8B
+#define A3XX_GRAS_CL_USER_PLANE_X0 0xCA0
+#define A3XX_GRAS_CL_USER_PLANE_Y0 0xCA1
+#define A3XX_GRAS_CL_USER_PLANE_Z0 0xCA2
+#define A3XX_GRAS_CL_USER_PLANE_W0 0xCA3
+#define A3XX_GRAS_CL_USER_PLANE_X1 0xCA4
+#define A3XX_GRAS_CL_USER_PLANE_Y1 0xCA5
+#define A3XX_GRAS_CL_USER_PLANE_Z1 0xCA6
+#define A3XX_GRAS_CL_USER_PLANE_W1 0xCA7
+#define A3XX_GRAS_CL_USER_PLANE_X2 0xCA8
+#define A3XX_GRAS_CL_USER_PLANE_Y2 0xCA9
+#define A3XX_GRAS_CL_USER_PLANE_Z2 0xCAA
+#define A3XX_GRAS_CL_USER_PLANE_W2 0xCAB
+#define A3XX_GRAS_CL_USER_PLANE_X3 0xCAC
+#define A3XX_GRAS_CL_USER_PLANE_Y3 0xCAD
+#define A3XX_GRAS_CL_USER_PLANE_Z3 0xCAE
+#define A3XX_GRAS_CL_USER_PLANE_W3 0xCAF
+#define A3XX_GRAS_CL_USER_PLANE_X4 0xCB0
+#define A3XX_GRAS_CL_USER_PLANE_Y4 0xCB1
+#define A3XX_GRAS_CL_USER_PLANE_Z4 0xCB2
+#define A3XX_GRAS_CL_USER_PLANE_W4 0xCB3
+#define A3XX_GRAS_CL_USER_PLANE_X5 0xCB4
+#define A3XX_GRAS_CL_USER_PLANE_Y5 0xCB5
+#define A3XX_GRAS_CL_USER_PLANE_Z5 0xCB6
+#define A3XX_GRAS_CL_USER_PLANE_W5 0xCB7
+#define A3XX_RB_GMEM_BASE_ADDR 0xCC0
+#define A3XX_RB_DEBUG_ECO_CONTROLS_ADDR 0xCC1
+#define A3XX_RB_PERFCOUNTER0_SELECT   0xCC6
+#define A3XX_RB_PERFCOUNTER1_SELECT   0xCC7
+#define A3XX_RB_FRAME_BUFFER_DIMENSION 0xCE0
+#define A3XX_SQ_GPR_MANAGEMENT 0x0D00
+#define A3XX_SQ_INST_STORE_MANAGEMENT 0x0D02
+#define A3XX_HLSQ_PERFCOUNTER0_SELECT 0xE00
+#define A3XX_HLSQ_PERFCOUNTER1_SELECT 0xE01
+#define A3XX_HLSQ_PERFCOUNTER2_SELECT 0xE02
+#define A3XX_HLSQ_PERFCOUNTER3_SELECT 0xE03
+#define A3XX_HLSQ_PERFCOUNTER4_SELECT 0xE04
+#define A3XX_HLSQ_PERFCOUNTER5_SELECT 0xE05
+#define A3XX_TP0_CHICKEN 0x0E1E
+#define A3XX_VFD_PERFCOUNTER0_SELECT 0xE44
+#define A3XX_VFD_PERFCOUNTER1_SELECT 0xE45
+#define A3XX_VPC_VPC_DEBUG_RAM_SEL 0xE61
+#define A3XX_VPC_VPC_DEBUG_RAM_READ 0xE62
+#define A3XX_VPC_PERFCOUNTER0_SELECT 0xE64
+#define A3XX_VPC_PERFCOUNTER1_SELECT 0xE65
+#define A3XX_UCHE_CACHE_MODE_CONTROL_REG 0xE82
+#define A3XX_UCHE_PERFCOUNTER0_SELECT 0xE84
+#define A3XX_UCHE_PERFCOUNTER1_SELECT 0xE85
+#define A3XX_UCHE_PERFCOUNTER2_SELECT 0xE86
+#define A3XX_UCHE_PERFCOUNTER3_SELECT 0xE87
+#define A3XX_UCHE_PERFCOUNTER4_SELECT 0xE88
+#define A3XX_UCHE_PERFCOUNTER5_SELECT 0xE89
+#define A3XX_UCHE_CACHE_INVALIDATE0_REG 0xEA0
+#define A3XX_UCHE_CACHE_INVALIDATE1_REG 0xEA1
+#define A3XX_UCHE_CACHE_WAYS_VFD 0xEA6
+#define A3XX_SP_PERFCOUNTER0_SELECT 0xEC4
+#define A3XX_SP_PERFCOUNTER1_SELECT 0xEC5
+#define A3XX_SP_PERFCOUNTER2_SELECT 0xEC6
+#define A3XX_SP_PERFCOUNTER3_SELECT 0xEC7
+#define A3XX_SP_PERFCOUNTER4_SELECT 0xEC8
+#define A3XX_SP_PERFCOUNTER5_SELECT 0xEC9
+#define A3XX_SP_PERFCOUNTER6_SELECT 0xECA
+#define A3XX_SP_PERFCOUNTER7_SELECT 0xECB
+#define A3XX_TP_PERFCOUNTER0_SELECT 0xF04
+#define A3XX_TP_PERFCOUNTER1_SELECT 0xF05
+#define A3XX_TP_PERFCOUNTER2_SELECT 0xF06
+#define A3XX_TP_PERFCOUNTER3_SELECT 0xF07
+#define A3XX_TP_PERFCOUNTER4_SELECT 0xF08
+#define A3XX_TP_PERFCOUNTER5_SELECT 0xF09
+#define A3XX_GRAS_CL_CLIP_CNTL 0x2040
+#define A3XX_GRAS_CL_GB_CLIP_ADJ 0x2044
+#define A3XX_GRAS_CL_VPORT_XOFFSET 0x2048
+#define A3XX_GRAS_CL_VPORT_XSCALE 0x2049
+#define A3XX_GRAS_CL_VPORT_YOFFSET 0x204A
+#define A3XX_GRAS_CL_VPORT_YSCALE 0x204B
+#define A3XX_GRAS_CL_VPORT_ZOFFSET 0x204C
+#define A3XX_GRAS_CL_VPORT_ZSCALE 0x204D
+#define A3XX_GRAS_SU_POINT_MINMAX 0x2068
+#define A3XX_GRAS_SU_POINT_SIZE 0x2069
+#define A3XX_GRAS_SU_POLY_OFFSET_SCALE 0x206C
+#define A3XX_GRAS_SU_POLY_OFFSET_OFFSET 0x206D
+#define A3XX_GRAS_SU_MODE_CONTROL 0x2070
+#define A3XX_GRAS_SC_CONTROL 0x2072
+#define A3XX_GRAS_SC_SCREEN_SCISSOR_TL 0x2074
+#define A3XX_GRAS_SC_SCREEN_SCISSOR_BR 0x2075
+#define A3XX_GRAS_SC_WINDOW_SCISSOR_TL 0x2079
+#define A3XX_GRAS_SC_WINDOW_SCISSOR_BR 0x207A
+#define A3XX_RB_MODE_CONTROL 0x20C0
+#define A3XX_RB_RENDER_CONTROL 0x20C1
+#define A3XX_RB_MSAA_CONTROL 0x20C2
+#define A3XX_RB_ALPHA_REFERENCE 0x20C3
+#define A3XX_RB_MRT_CONTROL0 0x20C4
+#define A3XX_RB_MRT_BUF_INFO0 0x20C5
+#define A3XX_RB_MRT_BUF_BASE0 0x20C6
+#define A3XX_RB_MRT_BLEND_CONTROL0 0x20C7
+#define A3XX_RB_MRT_CONTROL1 0x20C8
+#define A3XX_RB_MRT_BUF_INFO1 0x20C9
+#define A3XX_RB_MRT_BUF_BASE1 0x20CA
+#define A3XX_RB_MRT_BLEND_CONTROL1 0x20CB
+#define A3XX_RB_MRT_CONTROL2 0x20CC
+#define A3XX_RB_MRT_BUF_INFO2 0x20CD
+#define A3XX_RB_MRT_BUF_BASE2 0x20CE
+#define A3XX_RB_MRT_BLEND_CONTROL2 0x20CF
+#define A3XX_RB_MRT_CONTROL3 0x20D0
+#define A3XX_RB_MRT_BUF_INFO3 0x20D1
+#define A3XX_RB_MRT_BUF_BASE3 0x20D2
+#define A3XX_RB_MRT_BLEND_CONTROL3 0x20D3
+#define A3XX_RB_BLEND_RED 0x20E4
+#define A3XX_RB_BLEND_GREEN 0x20E5
+#define A3XX_RB_BLEND_BLUE 0x20E6
+#define A3XX_RB_BLEND_ALPHA 0x20E7
+#define A3XX_RB_CLEAR_COLOR_DW0 0x20E8
+#define A3XX_RB_CLEAR_COLOR_DW1 0x20E9
+#define A3XX_RB_CLEAR_COLOR_DW2 0x20EA
+#define A3XX_RB_CLEAR_COLOR_DW3 0x20EB
+#define A3XX_RB_COPY_CONTROL 0x20EC
+#define A3XX_RB_COPY_DEST_BASE 0x20ED
+#define A3XX_RB_COPY_DEST_PITCH 0x20EE
+#define A3XX_RB_COPY_DEST_INFO 0x20EF
+#define A3XX_RB_DEPTH_CONTROL 0x2100
+#define A3XX_RB_DEPTH_CLEAR 0x2101
+#define A3XX_RB_DEPTH_BUF_INFO 0x2102
+#define A3XX_RB_DEPTH_BUF_PITCH 0x2103
+#define A3XX_RB_STENCIL_CONTROL 0x2104
+#define A3XX_RB_STENCIL_CLEAR 0x2105
+#define A3XX_RB_STENCIL_BUF_INFO 0x2106
+#define A3XX_RB_STENCIL_BUF_PITCH 0x2107
+#define A3XX_RB_STENCIL_REF_MASK 0x2108
+#define A3XX_RB_STENCIL_REF_MASK_BF 0x2109
+#define A3XX_RB_LRZ_VSC_CONTROL 0x210C
+#define A3XX_RB_WINDOW_OFFSET 0x210E
+#define A3XX_RB_SAMPLE_COUNT_CONTROL 0x2110
+#define A3XX_RB_SAMPLE_COUNT_ADDR 0x2111
+#define A3XX_RB_Z_CLAMP_MIN 0x2114
+#define A3XX_RB_Z_CLAMP_MAX 0x2115
+#define A3XX_HLSQ_CONTROL_0_REG 0x2200
+#define A3XX_HLSQ_CONTROL_1_REG 0x2201
+#define A3XX_HLSQ_CONTROL_2_REG 0x2202
+#define A3XX_HLSQ_CONTROL_3_REG 0x2203
+#define A3XX_HLSQ_VS_CONTROL_REG 0x2204
+#define A3XX_HLSQ_FS_CONTROL_REG 0x2205
+#define A3XX_HLSQ_CONST_VSPRESV_RANGE_REG 0x2206
+#define A3XX_HLSQ_CONST_FSPRESV_RANGE_REG 0x2207
+#define A3XX_HLSQ_CL_NDRANGE_0_REG 0x220A
+#define A3XX_HLSQ_CL_NDRANGE_1_REG 0x220B
+#define A3XX_HLSQ_CL_NDRANGE_2_REG 0x220C
+#define A3XX_HLSQ_CL_NDRANGE_3_REG 0x220D
+#define A3XX_HLSQ_CL_NDRANGE_4_REG 0x220E
+#define A3XX_HLSQ_CL_NDRANGE_5_REG 0x220F
+#define A3XX_HLSQ_CL_NDRANGE_6_REG 0x2210
+#define A3XX_HLSQ_CL_CONTROL_0_REG 0x2211
+#define A3XX_HLSQ_CL_CONTROL_1_REG 0x2212
+#define A3XX_HLSQ_CL_KERNEL_CONST_REG 0x2214
+#define A3XX_HLSQ_CL_KERNEL_GROUP_X_REG 0x2215
+#define A3XX_HLSQ_CL_KERNEL_GROUP_Y_REG 0x2216
+#define A3XX_HLSQ_CL_KERNEL_GROUP_Z_REG 0x2217
+#define A3XX_HLSQ_CL_WG_OFFSET_REG 0x221A
+#define A3XX_VFD_FETCH_INSTR_1_0 0x2247
+#define A3XX_VFD_FETCH_INSTR_1_1 0x2249
+#define A3XX_VFD_FETCH_INSTR_1_2 0x224B
+#define A3XX_VFD_FETCH_INSTR_1_3 0x224D
+#define A3XX_VFD_FETCH_INSTR_1_4 0x224F
+#define A3XX_VFD_FETCH_INSTR_1_5 0x2251
+#define A3XX_VFD_FETCH_INSTR_1_6 0x2253
+#define A3XX_VFD_FETCH_INSTR_1_7 0x2255
+#define A3XX_VFD_FETCH_INSTR_1_8 0x2257
+#define A3XX_VFD_FETCH_INSTR_1_9 0x2259
+#define A3XX_VFD_FETCH_INSTR_1_A 0x225B
+#define A3XX_VFD_FETCH_INSTR_1_B 0x225D
+#define A3XX_VFD_FETCH_INSTR_1_C 0x225F
+#define A3XX_VFD_FETCH_INSTR_1_D 0x2261
+#define A3XX_VFD_FETCH_INSTR_1_E 0x2263
+#define A3XX_VFD_FETCH_INSTR_1_F 0x2265
+#define A3XX_SP_SP_CTRL_REG 0x22C0
+#define A3XX_SP_VS_CTRL_REG0 0x22C4
+#define A3XX_SP_VS_CTRL_REG1 0x22C5
+#define A3XX_SP_VS_PARAM_REG 0x22C6
+#define A3XX_SP_VS_OUT_REG_0 0x22C7
+#define A3XX_SP_VS_OUT_REG_1 0x22C8
+#define A3XX_SP_VS_OUT_REG_2 0x22C9
+#define A3XX_SP_VS_OUT_REG_3 0x22CA
+#define A3XX_SP_VS_OUT_REG_4 0x22CB
+#define A3XX_SP_VS_OUT_REG_5 0x22CC
+#define A3XX_SP_VS_OUT_REG_6 0x22CD
+#define A3XX_SP_VS_OUT_REG_7 0x22CE
+#define A3XX_SP_VS_VPC_DST_REG_0 0x22D0
+#define A3XX_SP_VS_VPC_DST_REG_1 0x22D1
+#define A3XX_SP_VS_VPC_DST_REG_2 0x22D2
+#define A3XX_SP_VS_VPC_DST_REG_3 0x22D3
+#define A3XX_SP_VS_OBJ_OFFSET_REG 0x22D4
+#define A3XX_SP_VS_OBJ_START_REG 0x22D5
+#define A3XX_SP_VS_PVT_MEM_PARAM_REG 0x22D6
+#define A3XX_SP_VS_PVT_MEM_ADDR_REG 0x22D7
+#define A3XX_SP_VS_PVT_MEM_SIZE_REG 0x22D8
+#define A3XX_SP_VS_LENGTH_REG 0x22DF
+#define A3XX_SP_FS_CTRL_REG0 0x22E0
+#define A3XX_SP_FS_CTRL_REG1 0x22E1
+#define A3XX_SP_FS_OBJ_OFFSET_REG 0x22E2
+#define A3XX_SP_FS_OBJ_START_REG 0x22E3
+#define A3XX_SP_FS_PVT_MEM_PARAM_REG 0x22E4
+#define A3XX_SP_FS_PVT_MEM_ADDR_REG 0x22E5
+#define A3XX_SP_FS_PVT_MEM_SIZE_REG 0x22E6
+#define A3XX_SP_FS_FLAT_SHAD_MODE_REG_0 0x22E8
+#define A3XX_SP_FS_FLAT_SHAD_MODE_REG_1 0x22E9
+#define A3XX_SP_FS_OUTPUT_REG 0x22EC
+#define A3XX_SP_FS_MRT_REG_0 0x22F0
+#define A3XX_SP_FS_MRT_REG_1 0x22F1
+#define A3XX_SP_FS_MRT_REG_2 0x22F2
+#define A3XX_SP_FS_MRT_REG_3 0x22F3
+#define A3XX_SP_FS_IMAGE_OUTPUT_REG_0 0x22F4
+#define A3XX_SP_FS_IMAGE_OUTPUT_REG_1 0x22F5
+#define A3XX_SP_FS_IMAGE_OUTPUT_REG_2 0x22F6
+#define A3XX_SP_FS_IMAGE_OUTPUT_REG_3 0x22F7
+#define A3XX_SP_FS_LENGTH_REG 0x22FF
+#define A3XX_PA_SC_AA_CONFIG 0x2301
+#define A3XX_VBIF_CLKON 0x3001
+#define A3XX_VBIF_ABIT_SORT 0x301C
+#define A3XX_VBIF_ABIT_SORT_CONF 0x301D
+#define A3XX_VBIF_GATE_OFF_WRREQ_EN 0x302A
+#define A3XX_VBIF_IN_RD_LIM_CONF0 0x302C
+#define A3XX_VBIF_IN_RD_LIM_CONF1 0x302D
+#define A3XX_VBIF_IN_WR_LIM_CONF0 0x3030
+#define A3XX_VBIF_IN_WR_LIM_CONF1 0x3031
+#define A3XX_VBIF_OUT_RD_LIM_CONF0 0x3034
+#define A3XX_VBIF_OUT_WR_LIM_CONF0 0x3035
+#define A3XX_VBIF_DDR_OUT_MAX_BURST 0x3036
+#define A3XX_VBIF_ARB_CTL 0x303C
+#define A3XX_VBIF_ROUND_ROBIN_QOS_ARB 0x3049
+#define A3XX_VBIF_OUT_AXI_AOOO_EN 0x305E
+#define A3XX_VBIF_OUT_AXI_AOOO 0x305F
+#define A3XX_VBIF_PERF_CNT0_LO 0x3073
+#define A3XX_VBIF_PERF_CNT0_HI 0x3074
+#define A3XX_VBIF_PERF_CNT1_LO 0x3075
+#define A3XX_VBIF_PERF_CNT1_HI 0x3076
+#define A3XX_VBIF_PERF_PWR_CNT0_LO 0x3077
+#define A3XX_VBIF_PERF_PWR_CNT0_HI 0x3078
+#define A3XX_VBIF_PERF_PWR_CNT1_LO 0x3079
+#define A3XX_VBIF_PERF_PWR_CNT1_HI 0x307a
+#define A3XX_VBIF_PERF_PWR_CNT2_LO 0x307b
+#define A3XX_VBIF_PERF_PWR_CNT2_HI 0x307c
+
+#define A3XX_VBIF_XIN_HALT_CTRL0 0x3080
+#define A3XX_VBIF_XIN_HALT_CTRL0_MASK 0x3F
+#define A30X_VBIF_XIN_HALT_CTRL0_MASK 0x7
+
+#define A3XX_VBIF_XIN_HALT_CTRL1 0x3081
+
+/* VBIF register offsets for A306 */
+#define A3XX_VBIF2_PERF_CNT_SEL0 0x30d0
+#define A3XX_VBIF2_PERF_CNT_SEL1 0x30d1
+#define A3XX_VBIF2_PERF_CNT_SEL2 0x30d2
+#define A3XX_VBIF2_PERF_CNT_SEL3 0x30d3
+#define A3XX_VBIF2_PERF_CNT_LOW0 0x30d8
+#define A3XX_VBIF2_PERF_CNT_LOW1 0x30d9
+#define A3XX_VBIF2_PERF_CNT_LOW2 0x30da
+#define A3XX_VBIF2_PERF_CNT_LOW3 0x30db
+#define A3XX_VBIF2_PERF_CNT_HIGH0 0x30e0
+#define A3XX_VBIF2_PERF_CNT_HIGH1 0x30e1
+#define A3XX_VBIF2_PERF_CNT_HIGH2 0x30e2
+#define A3XX_VBIF2_PERF_CNT_HIGH3 0x30e3
+
+#define A3XX_VBIF2_PERF_PWR_CNT_EN0 0x3100
+#define A3XX_VBIF2_PERF_PWR_CNT_EN1 0x3101
+#define A3XX_VBIF2_PERF_PWR_CNT_EN2 0x3102
+#define A3XX_VBIF2_PERF_PWR_CNT_LOW0 0x3110
+#define A3XX_VBIF2_PERF_PWR_CNT_LOW1 0x3111
+#define A3XX_VBIF2_PERF_PWR_CNT_LOW2 0x3112
+#define A3XX_VBIF2_PERF_PWR_CNT_HIGH0 0x3118
+#define A3XX_VBIF2_PERF_PWR_CNT_HIGH1 0x3119
+#define A3XX_VBIF2_PERF_PWR_CNT_HIGH2 0x311a
+
+#define A3XX_VBIF_DDR_OUTPUT_RECOVERABLE_HALT_CTRL0 0x3800
+#define A3XX_VBIF_DDR_OUTPUT_RECOVERABLE_HALT_CTRL1 0x3801
+
+/* RBBM Debug bus block IDs */
+#define RBBM_BLOCK_ID_CP               0x1
+#define RBBM_BLOCK_ID_RBBM             0x2
+#define RBBM_BLOCK_ID_VBIF             0x3
+#define RBBM_BLOCK_ID_HLSQ             0x4
+#define RBBM_BLOCK_ID_UCHE             0x5
+#define RBBM_BLOCK_ID_PC               0x8
+#define RBBM_BLOCK_ID_VFD              0x9
+#define RBBM_BLOCK_ID_VPC              0xa
+#define RBBM_BLOCK_ID_TSE              0xb
+#define RBBM_BLOCK_ID_RAS              0xc
+#define RBBM_BLOCK_ID_VSC              0xd
+#define RBBM_BLOCK_ID_SP_0             0x10
+#define RBBM_BLOCK_ID_SP_1             0x11
+#define RBBM_BLOCK_ID_SP_2             0x12
+#define RBBM_BLOCK_ID_SP_3             0x13
+#define RBBM_BLOCK_ID_TPL1_0           0x18
+#define RBBM_BLOCK_ID_TPL1_1           0x19
+#define RBBM_BLOCK_ID_TPL1_2           0x1a
+#define RBBM_BLOCK_ID_TPL1_3           0x1b
+#define RBBM_BLOCK_ID_RB_0             0x20
+#define RBBM_BLOCK_ID_RB_1             0x21
+#define RBBM_BLOCK_ID_RB_2             0x22
+#define RBBM_BLOCK_ID_RB_3             0x23
+#define RBBM_BLOCK_ID_MARB_0           0x28
+#define RBBM_BLOCK_ID_MARB_1           0x29
+#define RBBM_BLOCK_ID_MARB_2           0x2a
+#define RBBM_BLOCK_ID_MARB_3           0x2b
+
+/* RBBM_CLOCK_CTL default value */
+#define A3XX_RBBM_CLOCK_CTL_DEFAULT   0xAAAAAAAA
+#define A320_RBBM_CLOCK_CTL_DEFAULT   0xBFFFFFFF
+#define A330_RBBM_CLOCK_CTL_DEFAULT   0xBFFCFFFF
+
+#define A330_RBBM_GPR0_CTL_DEFAULT    0x00000000
+#define A330v2_RBBM_GPR0_CTL_DEFAULT  0x05515455
+#define A310_RBBM_GPR0_CTL_DEFAULT    0x000000AA
+
+/* COUNTABLE FOR SP PERFCOUNTER */
+#define SP_ALU_ACTIVE_CYCLES           0x1D
+#define SP0_ICL1_MISSES                0x1A
+#define SP_FS_CFLOW_INSTRUCTIONS       0x0C
+
+/* COUNTABLE FOR TSE PERFCOUNTER */
+#define TSE_INPUT_PRIM_NUM             0x0
+
+/* VBIF countables */
+#define VBIF_AXI_TOTAL_BEATS 85
+
+/* VBIF Recoverable HALT bit value */
+#define VBIF_RECOVERABLE_HALT_CTRL 0x1
+
+/*
+ * CP DEBUG settings for A3XX core:
+ * DYNAMIC_CLK_DISABLE [27] - turn off the dynamic clock control
+ * MIU_128BIT_WRITE_ENABLE [25] - Allow 128 bit writes to the VBIF
+ */
+#define A3XX_CP_DEBUG_DEFAULT ((1 << 27) | (1 << 25))
+
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/a5xx_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/a5xx_reg.h
@@ -0,0 +1,902 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2014-2016,2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _A5XX_REG_H
+#define _A5XX_REG_H
+
+/* A5XX interrupt bits */
+#define A5XX_INT_RBBM_GPU_IDLE           0
+#define A5XX_INT_RBBM_AHB_ERROR          1
+#define A5XX_INT_RBBM_TRANSFER_TIMEOUT   2
+#define A5XX_INT_RBBM_ME_MS_TIMEOUT      3
+#define A5XX_INT_RBBM_PFP_MS_TIMEOUT     4
+#define A5XX_INT_RBBM_ETS_MS_TIMEOUT     5
+#define A5XX_INT_RBBM_ATB_ASYNC_OVERFLOW 6
+#define A5XX_INT_RBBM_GPC_ERROR          7
+#define A5XX_INT_CP_SW                   8
+#define A5XX_INT_CP_HW_ERROR             9
+#define A5XX_INT_CP_CCU_FLUSH_DEPTH_TS   10
+#define A5XX_INT_CP_CCU_FLUSH_COLOR_TS   11
+#define A5XX_INT_CP_CCU_RESOLVE_TS       12
+#define A5XX_INT_CP_IB2                  13
+#define A5XX_INT_CP_IB1                  14
+#define A5XX_INT_CP_RB                   15
+#define A5XX_INT_CP_UNUSED_1             16
+#define A5XX_INT_CP_RB_DONE_TS           17
+#define A5XX_INT_CP_WT_DONE_TS           18
+#define A5XX_INT_UNKNOWN_1               19
+#define A5XX_INT_CP_CACHE_FLUSH_TS       20
+#define A5XX_INT_UNUSED_2                21
+#define A5XX_INT_RBBM_ATB_BUS_OVERFLOW   22
+#define A5XX_INT_MISC_HANG_DETECT        23
+#define A5XX_INT_UCHE_OOB_ACCESS         24
+#define A5XX_INT_UCHE_TRAP_INTR          25
+#define A5XX_INT_DEBBUS_INTR_0           26
+#define A5XX_INT_DEBBUS_INTR_1           27
+#define A5XX_INT_GPMU_VOLTAGE_DROOP      28
+#define A5XX_INT_GPMU_FIRMWARE           29
+#define A5XX_INT_ISDB_CPU_IRQ            30
+#define A5XX_INT_ISDB_UNDER_DEBUG        31
+
+/* CP Interrupt bits */
+#define A5XX_CP_OPCODE_ERROR               0
+#define A5XX_CP_RESERVED_BIT_ERROR         1
+#define A5XX_CP_HW_FAULT_ERROR             2
+#define A5XX_CP_DMA_ERROR                  3
+#define A5XX_CP_REGISTER_PROTECTION_ERROR  4
+#define A5XX_CP_AHB_ERROR                  5
+
+/* CP registers */
+#define A5XX_CP_RB_BASE                  0x800
+#define A5XX_CP_RB_BASE_HI               0x801
+#define A5XX_CP_RB_CNTL                  0x802
+#define A5XX_CP_RB_RPTR_ADDR_LO          0x804
+#define A5XX_CP_RB_RPTR_ADDR_HI          0x805
+#define A5XX_CP_RB_RPTR                  0x806
+#define A5XX_CP_RB_WPTR                  0x807
+#define A5XX_CP_PFP_STAT_ADDR            0x808
+#define A5XX_CP_PFP_STAT_DATA            0x809
+#define A5XX_CP_DRAW_STATE_ADDR          0x80B
+#define A5XX_CP_DRAW_STATE_DATA          0x80C
+#define A5XX_CP_CRASH_SCRIPT_BASE_LO     0x817
+#define A5XX_CP_CRASH_SCRIPT_BASE_HI     0x818
+#define A5XX_CP_CRASH_DUMP_CNTL          0x819
+#define A5XX_CP_ME_STAT_ADDR             0x81A
+#define A5XX_CP_ROQ_THRESHOLDS_1         0x81F
+#define A5XX_CP_ROQ_THRESHOLDS_2         0x820
+#define A5XX_CP_ROQ_DBG_ADDR             0x821
+#define A5XX_CP_ROQ_DBG_DATA             0x822
+#define A5XX_CP_MEQ_DBG_ADDR             0x823
+#define A5XX_CP_MEQ_DBG_DATA             0x824
+#define A5XX_CP_MEQ_THRESHOLDS           0x825
+#define A5XX_CP_MERCIU_SIZE              0x826
+#define A5XX_CP_MERCIU_DBG_ADDR          0x827
+#define A5XX_CP_MERCIU_DBG_DATA_1        0x828
+#define A5XX_CP_MERCIU_DBG_DATA_2        0x829
+#define A5XX_CP_PFP_UCODE_DBG_ADDR       0x82A
+#define A5XX_CP_PFP_UCODE_DBG_DATA       0x82B
+#define A5XX_CP_ME_UCODE_DBG_ADDR        0x82F
+#define A5XX_CP_ME_UCODE_DBG_DATA        0x830
+#define A5XX_CP_CNTL                     0x831
+#define A5XX_CP_ME_CNTL                  0x832
+#define A5XX_CP_CHICKEN_DBG              0x833
+#define A5XX_CP_PFP_INSTR_BASE_LO        0x835
+#define A5XX_CP_PFP_INSTR_BASE_HI        0x836
+#define A5XX_CP_PM4_INSTR_BASE_LO        0x838
+#define A5XX_CP_PM4_INSTR_BASE_HI        0x839
+#define A5XX_CP_CONTEXT_SWITCH_CNTL      0x83B
+#define A5XX_CP_CONTEXT_SWITCH_RESTORE_ADDR_LO   0x83C
+#define A5XX_CP_CONTEXT_SWITCH_RESTORE_ADDR_HI   0x83D
+#define A5XX_CP_CONTEXT_SWITCH_SAVE_ADDR_LO   0x83E
+#define A5XX_CP_CONTEXT_SWITCH_SAVE_ADDR_HI   0x83F
+#define A5XX_CP_CONTEXT_SWITCH_SMMU_INFO_LO   0x840
+#define A5XX_CP_CONTEXT_SWITCH_SMMU_INFO_HI   0x841
+#define A5XX_CP_ADDR_MODE_CNTL           0x860
+#define A5XX_CP_ME_STAT_DATA             0xB14
+#define A5XX_CP_WFI_PEND_CTR             0xB15
+#define A5XX_CP_INTERRUPT_STATUS         0xB18
+#define A5XX_CP_HW_FAULT                 0xB1A
+#define A5XX_CP_PROTECT_STATUS           0xB1C
+#define A5XX_CP_IB1_BASE                 0xB1F
+#define A5XX_CP_IB1_BASE_HI              0xB20
+#define A5XX_CP_IB1_BUFSZ                0xB21
+#define A5XX_CP_IB2_BASE                 0xB22
+#define A5XX_CP_IB2_BASE_HI              0xB23
+#define A5XX_CP_IB2_BUFSZ                0xB24
+#define A5XX_CP_PROTECT_REG_0            0x880
+#define A5XX_CP_PROTECT_CNTL             0x8A0
+#define A5XX_CP_AHB_FAULT                0xB1B
+#define A5XX_CP_PERFCTR_CP_SEL_0         0xBB0
+#define A5XX_CP_PERFCTR_CP_SEL_1         0xBB1
+#define A5XX_CP_PERFCTR_CP_SEL_2         0xBB2
+#define A5XX_CP_PERFCTR_CP_SEL_3         0xBB3
+#define A5XX_CP_PERFCTR_CP_SEL_4         0xBB4
+#define A5XX_CP_PERFCTR_CP_SEL_5         0xBB5
+#define A5XX_CP_PERFCTR_CP_SEL_6         0xBB6
+#define A5XX_CP_PERFCTR_CP_SEL_7         0xBB7
+
+#define A5XX_VSC_ADDR_MODE_CNTL          0xBC1
+
+/* CP Power Counter Registers Select */
+#define A5XX_CP_POWERCTR_CP_SEL_0        0xBBA
+#define A5XX_CP_POWERCTR_CP_SEL_1        0xBBB
+#define A5XX_CP_POWERCTR_CP_SEL_2        0xBBC
+#define A5XX_CP_POWERCTR_CP_SEL_3        0xBBD
+
+/* RBBM registers */
+#define A5XX_RBBM_CFG_DBGBUS_SEL_A               0x4
+#define A5XX_RBBM_CFG_DBGBUS_SEL_B               0x5
+#define A5XX_RBBM_CFG_DBGBUS_SEL_C               0x6
+#define A5XX_RBBM_CFG_DBGBUS_SEL_D               0x7
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PING_INDEX_SHIFT    0x0
+#define A5XX_RBBM_CFG_DBGBUS_SEL_PING_BLK_SEL_SHIFT  0x8
+
+#define A5XX_RBBM_CFG_DBGBUS_CNTLT               0x8
+#define A5XX_RBBM_CFG_DBGBUS_CNTLM               0x9
+#define A5XX_RBBM_CFG_DEBBUS_CTLTM_ENABLE_SHIFT  0x18
+#define A5XX_RBBM_CFG_DBGBUS_OPL                 0xA
+#define A5XX_RBBM_CFG_DBGBUS_OPE                 0xB
+#define A5XX_RBBM_CFG_DBGBUS_IVTL_0              0xC
+#define A5XX_RBBM_CFG_DBGBUS_IVTL_1              0xD
+#define A5XX_RBBM_CFG_DBGBUS_IVTL_2              0xE
+#define A5XX_RBBM_CFG_DBGBUS_IVTL_3              0xF
+#define A5XX_RBBM_CFG_DBGBUS_MASKL_0             0x10
+#define A5XX_RBBM_CFG_DBGBUS_MASKL_1             0x11
+#define A5XX_RBBM_CFG_DBGBUS_MASKL_2             0x12
+#define A5XX_RBBM_CFG_DBGBUS_MASKL_3             0x13
+#define A5XX_RBBM_CFG_DBGBUS_BYTEL_0             0x14
+#define A5XX_RBBM_CFG_DBGBUS_BYTEL_1             0x15
+#define A5XX_RBBM_CFG_DBGBUS_IVTE_0              0x16
+#define A5XX_RBBM_CFG_DBGBUS_IVTE_1              0x17
+#define A5XX_RBBM_CFG_DBGBUS_IVTE_2              0x18
+#define A5XX_RBBM_CFG_DBGBUS_IVTE_3              0x19
+#define A5XX_RBBM_CFG_DBGBUS_MASKE_0             0x1A
+#define A5XX_RBBM_CFG_DBGBUS_MASKE_1             0x1B
+#define A5XX_RBBM_CFG_DBGBUS_MASKE_2             0x1C
+#define A5XX_RBBM_CFG_DBGBUS_MASKE_3             0x1D
+#define A5XX_RBBM_CFG_DBGBUS_NIBBLEE             0x1E
+#define A5XX_RBBM_CFG_DBGBUS_PTRC0               0x1F
+#define A5XX_RBBM_CFG_DBGBUS_PTRC1               0x20
+#define A5XX_RBBM_CFG_DBGBUS_LOADREG             0x21
+#define A5XX_RBBM_CFG_DBGBUS_IDX                 0x22
+#define A5XX_RBBM_CFG_DBGBUS_CLRC                0x23
+#define A5XX_RBBM_CFG_DBGBUS_LOADIVT             0x24
+#define A5XX_RBBM_INTERFACE_HANG_INT_CNTL        0x2F
+#define A5XX_RBBM_INT_CLEAR_CMD                  0x37
+#define A5XX_RBBM_INT_0_MASK                     0x38
+#define A5XX_RBBM_AHB_DBG_CNTL                   0x3F
+#define A5XX_RBBM_EXT_VBIF_DBG_CNTL              0x41
+#define A5XX_RBBM_SW_RESET_CMD                   0x43
+#define A5XX_RBBM_BLOCK_SW_RESET_CMD             0x45
+#define A5XX_RBBM_BLOCK_SW_RESET_CMD2            0x46
+#define A5XX_RBBM_DBG_LO_HI_GPIO                 0x48
+#define A5XX_RBBM_EXT_TRACE_BUS_CNTL             0x49
+#define A5XX_RBBM_CLOCK_CNTL_TP0                 0x4A
+#define A5XX_RBBM_CLOCK_CNTL_TP1                 0x4B
+#define A5XX_RBBM_CLOCK_CNTL_TP2                 0x4C
+#define A5XX_RBBM_CLOCK_CNTL_TP3                 0x4D
+#define A5XX_RBBM_CLOCK_CNTL2_TP0                0x4E
+#define A5XX_RBBM_CLOCK_CNTL2_TP1                0x4F
+#define A5XX_RBBM_CLOCK_CNTL2_TP2                0x50
+#define A5XX_RBBM_CLOCK_CNTL2_TP3                0x51
+#define A5XX_RBBM_CLOCK_CNTL3_TP0                0x52
+#define A5XX_RBBM_CLOCK_CNTL3_TP1                0x53
+#define A5XX_RBBM_CLOCK_CNTL3_TP2                0x54
+#define A5XX_RBBM_CLOCK_CNTL3_TP3                0x55
+#define A5XX_RBBM_READ_AHB_THROUGH_DBG           0x59
+#define A5XX_RBBM_CLOCK_CNTL_UCHE                0x5A
+#define A5XX_RBBM_CLOCK_CNTL2_UCHE               0x5B
+#define A5XX_RBBM_CLOCK_CNTL3_UCHE               0x5C
+#define A5XX_RBBM_CLOCK_CNTL4_UCHE               0x5D
+#define A5XX_RBBM_CLOCK_HYST_UCHE                0x5E
+#define A5XX_RBBM_CLOCK_DELAY_UCHE               0x5F
+#define A5XX_RBBM_CLOCK_MODE_GPC                 0x60
+#define A5XX_RBBM_CLOCK_DELAY_GPC                0x61
+#define A5XX_RBBM_CLOCK_HYST_GPC                 0x62
+#define A5XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM        0x63
+#define A5XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM        0x64
+#define A5XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM       0x65
+#define A5XX_RBBM_CLOCK_DELAY_HLSQ               0x66
+#define A5XX_RBBM_CLOCK_CNTL                     0x67
+#define A5XX_RBBM_CLOCK_CNTL_SP0                 0x68
+#define A5XX_RBBM_CLOCK_CNTL_SP1                 0x69
+#define A5XX_RBBM_CLOCK_CNTL_SP2                 0x6A
+#define A5XX_RBBM_CLOCK_CNTL_SP3                 0x6B
+#define A5XX_RBBM_CLOCK_CNTL2_SP0                0x6C
+#define A5XX_RBBM_CLOCK_CNTL2_SP1                0x6D
+#define A5XX_RBBM_CLOCK_CNTL2_SP2                0x6E
+#define A5XX_RBBM_CLOCK_CNTL2_SP3                0x6F
+#define A5XX_RBBM_CLOCK_HYST_SP0                 0x70
+#define A5XX_RBBM_CLOCK_HYST_SP1                 0x71
+#define A5XX_RBBM_CLOCK_HYST_SP2                 0x72
+#define A5XX_RBBM_CLOCK_HYST_SP3                 0x73
+#define A5XX_RBBM_CLOCK_DELAY_SP0                0x74
+#define A5XX_RBBM_CLOCK_DELAY_SP1                0x75
+#define A5XX_RBBM_CLOCK_DELAY_SP2                0x76
+#define A5XX_RBBM_CLOCK_DELAY_SP3                0x77
+#define A5XX_RBBM_CLOCK_CNTL_RB0                 0x78
+#define A5XX_RBBM_CLOCK_CNTL_RB1                 0x79
+#define A5XX_RBBM_CLOCK_CNTL_RB2                 0x7a
+#define A5XX_RBBM_CLOCK_CNTL_RB3                 0x7B
+#define A5XX_RBBM_CLOCK_CNTL2_RB0                0x7C
+#define A5XX_RBBM_CLOCK_CNTL2_RB1                0x7D
+#define A5XX_RBBM_CLOCK_CNTL2_RB2                0x7E
+#define A5XX_RBBM_CLOCK_CNTL2_RB3                0x7F
+#define A5XX_RBBM_CLOCK_HYST_RAC                 0x80
+#define A5XX_RBBM_CLOCK_DELAY_RAC                0x81
+#define A5XX_RBBM_CLOCK_CNTL_CCU0                0x82
+#define A5XX_RBBM_CLOCK_CNTL_CCU1                0x83
+#define A5XX_RBBM_CLOCK_CNTL_CCU2                0x84
+#define A5XX_RBBM_CLOCK_CNTL_CCU3                0x85
+#define A5XX_RBBM_CLOCK_HYST_RB_CCU0             0x86
+#define A5XX_RBBM_CLOCK_HYST_RB_CCU1             0x87
+#define A5XX_RBBM_CLOCK_HYST_RB_CCU2             0x88
+#define A5XX_RBBM_CLOCK_HYST_RB_CCU3             0x89
+#define A5XX_RBBM_CLOCK_CNTL_RAC                 0x8A
+#define A5XX_RBBM_CLOCK_CNTL2_RAC                0x8B
+#define A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_0        0x8C
+#define A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_1        0x8D
+#define A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_2        0x8E
+#define A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_3        0x8F
+#define A5XX_RBBM_CLOCK_HYST_VFD                 0x90
+#define A5XX_RBBM_CLOCK_MODE_VFD                 0x91
+#define A5XX_RBBM_CLOCK_DELAY_VFD                0x92
+#define A5XX_RBBM_AHB_CNTL0                      0x93
+#define A5XX_RBBM_AHB_CNTL1                      0x94
+#define A5XX_RBBM_AHB_CNTL2                      0x95
+#define A5XX_RBBM_AHB_CMD                        0x96
+#define A5XX_RBBM_INTERFACE_HANG_MASK_CNTL11     0x9C
+#define A5XX_RBBM_INTERFACE_HANG_MASK_CNTL12     0x9D
+#define A5XX_RBBM_INTERFACE_HANG_MASK_CNTL13     0x9E
+#define A5XX_RBBM_INTERFACE_HANG_MASK_CNTL14     0x9F
+#define A5XX_RBBM_INTERFACE_HANG_MASK_CNTL15     0xA0
+#define A5XX_RBBM_INTERFACE_HANG_MASK_CNTL16     0xA1
+#define A5XX_RBBM_INTERFACE_HANG_MASK_CNTL17     0xA2
+#define A5XX_RBBM_INTERFACE_HANG_MASK_CNTL18     0xA3
+#define A5XX_RBBM_CLOCK_DELAY_TP0                0xA4
+#define A5XX_RBBM_CLOCK_DELAY_TP1                0xA5
+#define A5XX_RBBM_CLOCK_DELAY_TP2                0xA6
+#define A5XX_RBBM_CLOCK_DELAY_TP3                0xA7
+#define A5XX_RBBM_CLOCK_DELAY2_TP0               0xA8
+#define A5XX_RBBM_CLOCK_DELAY2_TP1               0xA9
+#define A5XX_RBBM_CLOCK_DELAY2_TP2               0xAA
+#define A5XX_RBBM_CLOCK_DELAY2_TP3               0xAB
+#define A5XX_RBBM_CLOCK_DELAY3_TP0               0xAC
+#define A5XX_RBBM_CLOCK_DELAY3_TP1               0xAD
+#define A5XX_RBBM_CLOCK_DELAY3_TP2               0xAE
+#define A5XX_RBBM_CLOCK_DELAY3_TP3               0xAF
+#define A5XX_RBBM_CLOCK_HYST_TP0                 0xB0
+#define A5XX_RBBM_CLOCK_HYST_TP1                 0xB1
+#define A5XX_RBBM_CLOCK_HYST_TP2                 0xB2
+#define A5XX_RBBM_CLOCK_HYST_TP3                 0xB3
+#define A5XX_RBBM_CLOCK_HYST2_TP0                0xB4
+#define A5XX_RBBM_CLOCK_HYST2_TP1                0xB5
+#define A5XX_RBBM_CLOCK_HYST2_TP2                0xB6
+#define A5XX_RBBM_CLOCK_HYST2_TP3                0xB7
+#define A5XX_RBBM_CLOCK_HYST3_TP0                0xB8
+#define A5XX_RBBM_CLOCK_HYST3_TP1                0xB9
+#define A5XX_RBBM_CLOCK_HYST3_TP2                0xBA
+#define A5XX_RBBM_CLOCK_HYST3_TP3                0xBB
+#define A5XX_RBBM_CLOCK_CNTL_GPMU                0xC8
+#define A5XX_RBBM_CLOCK_DELAY_GPMU               0xC9
+#define A5XX_RBBM_CLOCK_HYST_GPMU                0xCA
+#define A5XX_RBBM_PERFCTR_CP_0_LO                0x3A0
+#define A5XX_RBBM_PERFCTR_CP_0_HI                0x3A1
+#define A5XX_RBBM_PERFCTR_CP_1_LO                0x3A2
+#define A5XX_RBBM_PERFCTR_CP_1_HI                0x3A3
+#define A5XX_RBBM_PERFCTR_CP_2_LO                0x3A4
+#define A5XX_RBBM_PERFCTR_CP_2_HI                0x3A5
+#define A5XX_RBBM_PERFCTR_CP_3_LO                0x3A6
+#define A5XX_RBBM_PERFCTR_CP_3_HI                0x3A7
+#define A5XX_RBBM_PERFCTR_CP_4_LO                0x3A8
+#define A5XX_RBBM_PERFCTR_CP_4_HI                0x3A9
+#define A5XX_RBBM_PERFCTR_CP_5_LO                0x3AA
+#define A5XX_RBBM_PERFCTR_CP_5_HI                0x3AB
+#define A5XX_RBBM_PERFCTR_CP_6_LO                0x3AC
+#define A5XX_RBBM_PERFCTR_CP_6_HI                0x3AD
+#define A5XX_RBBM_PERFCTR_CP_7_LO                0x3AE
+#define A5XX_RBBM_PERFCTR_CP_7_HI                0x3AF
+#define A5XX_RBBM_PERFCTR_RBBM_0_LO              0x3B0
+#define A5XX_RBBM_PERFCTR_RBBM_0_HI              0x3B1
+#define A5XX_RBBM_PERFCTR_RBBM_1_LO              0x3B2
+#define A5XX_RBBM_PERFCTR_RBBM_1_HI              0x3B3
+#define A5XX_RBBM_PERFCTR_RBBM_2_LO              0x3B4
+#define A5XX_RBBM_PERFCTR_RBBM_2_HI              0x3B5
+#define A5XX_RBBM_PERFCTR_RBBM_3_LO              0x3B6
+#define A5XX_RBBM_PERFCTR_RBBM_3_HI              0x3B7
+#define A5XX_RBBM_PERFCTR_PC_0_LO                0x3B8
+#define A5XX_RBBM_PERFCTR_PC_0_HI                0x3B9
+#define A5XX_RBBM_PERFCTR_PC_1_LO                0x3BA
+#define A5XX_RBBM_PERFCTR_PC_1_HI                0x3BB
+#define A5XX_RBBM_PERFCTR_PC_2_LO                0x3BC
+#define A5XX_RBBM_PERFCTR_PC_2_HI                0x3BD
+#define A5XX_RBBM_PERFCTR_PC_3_LO                0x3BE
+#define A5XX_RBBM_PERFCTR_PC_3_HI                0x3BF
+#define A5XX_RBBM_PERFCTR_PC_4_LO                0x3C0
+#define A5XX_RBBM_PERFCTR_PC_4_HI                0x3C1
+#define A5XX_RBBM_PERFCTR_PC_5_LO                0x3C2
+#define A5XX_RBBM_PERFCTR_PC_5_HI                0x3C3
+#define A5XX_RBBM_PERFCTR_PC_6_LO                0x3C4
+#define A5XX_RBBM_PERFCTR_PC_6_HI                0x3C5
+#define A5XX_RBBM_PERFCTR_PC_7_LO                0x3C6
+#define A5XX_RBBM_PERFCTR_PC_7_HI                0x3C7
+#define A5XX_RBBM_PERFCTR_VFD_0_LO               0x3C8
+#define A5XX_RBBM_PERFCTR_VFD_0_HI               0x3C9
+#define A5XX_RBBM_PERFCTR_VFD_1_LO               0x3CA
+#define A5XX_RBBM_PERFCTR_VFD_1_HI               0x3CB
+#define A5XX_RBBM_PERFCTR_VFD_2_LO               0x3CC
+#define A5XX_RBBM_PERFCTR_VFD_2_HI               0x3CD
+#define A5XX_RBBM_PERFCTR_VFD_3_LO               0x3CE
+#define A5XX_RBBM_PERFCTR_VFD_3_HI               0x3CF
+#define A5XX_RBBM_PERFCTR_VFD_4_LO               0x3D0
+#define A5XX_RBBM_PERFCTR_VFD_4_HI               0x3D1
+#define A5XX_RBBM_PERFCTR_VFD_5_LO               0x3D2
+#define A5XX_RBBM_PERFCTR_VFD_5_HI               0x3D3
+#define A5XX_RBBM_PERFCTR_VFD_6_LO               0x3D4
+#define A5XX_RBBM_PERFCTR_VFD_6_HI               0x3D5
+#define A5XX_RBBM_PERFCTR_VFD_7_LO               0x3D6
+#define A5XX_RBBM_PERFCTR_VFD_7_HI               0x3D7
+#define A5XX_RBBM_PERFCTR_HLSQ_0_LO              0x3D8
+#define A5XX_RBBM_PERFCTR_HLSQ_0_HI              0x3D9
+#define A5XX_RBBM_PERFCTR_HLSQ_1_LO              0x3DA
+#define A5XX_RBBM_PERFCTR_HLSQ_1_HI              0x3DB
+#define A5XX_RBBM_PERFCTR_HLSQ_2_LO              0x3DC
+#define A5XX_RBBM_PERFCTR_HLSQ_2_HI              0x3DD
+#define A5XX_RBBM_PERFCTR_HLSQ_3_LO              0x3DE
+#define A5XX_RBBM_PERFCTR_HLSQ_3_HI              0x3DF
+#define A5XX_RBBM_PERFCTR_HLSQ_4_LO              0x3E0
+#define A5XX_RBBM_PERFCTR_HLSQ_4_HI              0x3E1
+#define A5XX_RBBM_PERFCTR_HLSQ_5_LO              0x3E2
+#define A5XX_RBBM_PERFCTR_HLSQ_5_HI              0x3E3
+#define A5XX_RBBM_PERFCTR_HLSQ_6_LO              0x3E4
+#define A5XX_RBBM_PERFCTR_HLSQ_6_HI              0x3E5
+#define A5XX_RBBM_PERFCTR_HLSQ_7_LO              0x3E6
+#define A5XX_RBBM_PERFCTR_HLSQ_7_HI              0x3E7
+#define A5XX_RBBM_PERFCTR_VPC_0_LO               0x3E8
+#define A5XX_RBBM_PERFCTR_VPC_0_HI               0x3E9
+#define A5XX_RBBM_PERFCTR_VPC_1_LO               0x3EA
+#define A5XX_RBBM_PERFCTR_VPC_1_HI               0x3EB
+#define A5XX_RBBM_PERFCTR_VPC_2_LO               0x3EC
+#define A5XX_RBBM_PERFCTR_VPC_2_HI               0x3ED
+#define A5XX_RBBM_PERFCTR_VPC_3_LO               0x3EE
+#define A5XX_RBBM_PERFCTR_VPC_3_HI               0x3EF
+#define A5XX_RBBM_PERFCTR_CCU_0_LO               0x3F0
+#define A5XX_RBBM_PERFCTR_CCU_0_HI               0x3F1
+#define A5XX_RBBM_PERFCTR_CCU_1_LO               0x3F2
+#define A5XX_RBBM_PERFCTR_CCU_1_HI               0x3F3
+#define A5XX_RBBM_PERFCTR_CCU_2_LO               0x3F4
+#define A5XX_RBBM_PERFCTR_CCU_2_HI               0x3F5
+#define A5XX_RBBM_PERFCTR_CCU_3_LO               0x3F6
+#define A5XX_RBBM_PERFCTR_CCU_3_HI               0x3F7
+#define A5XX_RBBM_PERFCTR_TSE_0_LO               0x3F8
+#define A5XX_RBBM_PERFCTR_TSE_0_HI               0x3F9
+#define A5XX_RBBM_PERFCTR_TSE_1_LO               0x3FA
+#define A5XX_RBBM_PERFCTR_TSE_1_HI               0x3FB
+#define A5XX_RBBM_PERFCTR_TSE_2_LO               0x3FC
+#define A5XX_RBBM_PERFCTR_TSE_2_HI               0x3FD
+#define A5XX_RBBM_PERFCTR_TSE_3_LO               0x3FE
+#define A5XX_RBBM_PERFCTR_TSE_3_HI               0x3FF
+#define A5XX_RBBM_PERFCTR_RAS_0_LO               0x400
+#define A5XX_RBBM_PERFCTR_RAS_0_HI               0x401
+#define A5XX_RBBM_PERFCTR_RAS_1_LO               0x402
+#define A5XX_RBBM_PERFCTR_RAS_1_HI               0x403
+#define A5XX_RBBM_PERFCTR_RAS_2_LO               0x404
+#define A5XX_RBBM_PERFCTR_RAS_2_HI               0x405
+#define A5XX_RBBM_PERFCTR_RAS_3_LO               0x406
+#define A5XX_RBBM_PERFCTR_RAS_3_HI               0x407
+#define A5XX_RBBM_PERFCTR_UCHE_0_LO              0x408
+#define A5XX_RBBM_PERFCTR_UCHE_0_HI              0x409
+#define A5XX_RBBM_PERFCTR_UCHE_1_LO              0x40A
+#define A5XX_RBBM_PERFCTR_UCHE_1_HI              0x40B
+#define A5XX_RBBM_PERFCTR_UCHE_2_LO              0x40C
+#define A5XX_RBBM_PERFCTR_UCHE_2_HI              0x40D
+#define A5XX_RBBM_PERFCTR_UCHE_3_LO              0x40E
+#define A5XX_RBBM_PERFCTR_UCHE_3_HI              0x40F
+#define A5XX_RBBM_PERFCTR_UCHE_4_LO              0x410
+#define A5XX_RBBM_PERFCTR_UCHE_4_HI              0x411
+#define A5XX_RBBM_PERFCTR_UCHE_5_LO              0x412
+#define A5XX_RBBM_PERFCTR_UCHE_5_HI              0x413
+#define A5XX_RBBM_PERFCTR_UCHE_6_LO              0x414
+#define A5XX_RBBM_PERFCTR_UCHE_6_HI              0x415
+#define A5XX_RBBM_PERFCTR_UCHE_7_LO              0x416
+#define A5XX_RBBM_PERFCTR_UCHE_7_HI              0x417
+#define A5XX_RBBM_PERFCTR_TP_0_LO                0x418
+#define A5XX_RBBM_PERFCTR_TP_0_HI                0x419
+#define A5XX_RBBM_PERFCTR_TP_1_LO                0x41A
+#define A5XX_RBBM_PERFCTR_TP_1_HI                0x41B
+#define A5XX_RBBM_PERFCTR_TP_2_LO                0x41C
+#define A5XX_RBBM_PERFCTR_TP_2_HI                0x41D
+#define A5XX_RBBM_PERFCTR_TP_3_LO                0x41E
+#define A5XX_RBBM_PERFCTR_TP_3_HI                0x41F
+#define A5XX_RBBM_PERFCTR_TP_4_LO                0x420
+#define A5XX_RBBM_PERFCTR_TP_4_HI                0x421
+#define A5XX_RBBM_PERFCTR_TP_5_LO                0x422
+#define A5XX_RBBM_PERFCTR_TP_5_HI                0x423
+#define A5XX_RBBM_PERFCTR_TP_6_LO                0x424
+#define A5XX_RBBM_PERFCTR_TP_6_HI                0x425
+#define A5XX_RBBM_PERFCTR_TP_7_LO                0x426
+#define A5XX_RBBM_PERFCTR_TP_7_HI                0x427
+#define A5XX_RBBM_PERFCTR_SP_0_LO                0x428
+#define A5XX_RBBM_PERFCTR_SP_0_HI                0x429
+#define A5XX_RBBM_PERFCTR_SP_1_LO                0x42A
+#define A5XX_RBBM_PERFCTR_SP_1_HI                0x42B
+#define A5XX_RBBM_PERFCTR_SP_2_LO                0x42C
+#define A5XX_RBBM_PERFCTR_SP_2_HI                0x42D
+#define A5XX_RBBM_PERFCTR_SP_3_LO                0x42E
+#define A5XX_RBBM_PERFCTR_SP_3_HI                0x42F
+#define A5XX_RBBM_PERFCTR_SP_4_LO                0x430
+#define A5XX_RBBM_PERFCTR_SP_4_HI                0x431
+#define A5XX_RBBM_PERFCTR_SP_5_LO                0x432
+#define A5XX_RBBM_PERFCTR_SP_5_HI                0x433
+#define A5XX_RBBM_PERFCTR_SP_6_LO                0x434
+#define A5XX_RBBM_PERFCTR_SP_6_HI                0x435
+#define A5XX_RBBM_PERFCTR_SP_7_LO                0x436
+#define A5XX_RBBM_PERFCTR_SP_7_HI                0x437
+#define A5XX_RBBM_PERFCTR_SP_8_LO                0x438
+#define A5XX_RBBM_PERFCTR_SP_8_HI                0x439
+#define A5XX_RBBM_PERFCTR_SP_9_LO                0x43A
+#define A5XX_RBBM_PERFCTR_SP_9_HI                0x43B
+#define A5XX_RBBM_PERFCTR_SP_10_LO               0x43C
+#define A5XX_RBBM_PERFCTR_SP_10_HI               0x43D
+#define A5XX_RBBM_PERFCTR_SP_11_LO               0x43E
+#define A5XX_RBBM_PERFCTR_SP_11_HI               0x43F
+#define A5XX_RBBM_PERFCTR_RB_0_LO                0x440
+#define A5XX_RBBM_PERFCTR_RB_0_HI                0x441
+#define A5XX_RBBM_PERFCTR_RB_1_LO                0x442
+#define A5XX_RBBM_PERFCTR_RB_1_HI                0x443
+#define A5XX_RBBM_PERFCTR_RB_2_LO                0x444
+#define A5XX_RBBM_PERFCTR_RB_2_HI                0x445
+#define A5XX_RBBM_PERFCTR_RB_3_LO                0x446
+#define A5XX_RBBM_PERFCTR_RB_3_HI                0x447
+#define A5XX_RBBM_PERFCTR_RB_4_LO                0x448
+#define A5XX_RBBM_PERFCTR_RB_4_HI                0x449
+#define A5XX_RBBM_PERFCTR_RB_5_LO                0x44A
+#define A5XX_RBBM_PERFCTR_RB_5_HI                0x44B
+#define A5XX_RBBM_PERFCTR_RB_6_LO                0x44C
+#define A5XX_RBBM_PERFCTR_RB_6_HI                0x44D
+#define A5XX_RBBM_PERFCTR_RB_7_LO                0x44E
+#define A5XX_RBBM_PERFCTR_RB_7_HI                0x44F
+#define A5XX_RBBM_PERFCTR_VSC_0_LO               0x450
+#define A5XX_RBBM_PERFCTR_VSC_0_HI               0x451
+#define A5XX_RBBM_PERFCTR_VSC_1_LO               0x452
+#define A5XX_RBBM_PERFCTR_VSC_1_HI               0x453
+#define A5XX_RBBM_PERFCTR_LRZ_0_LO               0x454
+#define A5XX_RBBM_PERFCTR_LRZ_0_HI               0x455
+#define A5XX_RBBM_PERFCTR_LRZ_1_LO               0x456
+#define A5XX_RBBM_PERFCTR_LRZ_1_HI               0x457
+#define A5XX_RBBM_PERFCTR_LRZ_2_LO               0x458
+#define A5XX_RBBM_PERFCTR_LRZ_2_HI               0x459
+#define A5XX_RBBM_PERFCTR_LRZ_3_LO               0x45A
+#define A5XX_RBBM_PERFCTR_LRZ_3_HI               0x45B
+#define A5XX_RBBM_PERFCTR_CMP_0_LO               0x45C
+#define A5XX_RBBM_PERFCTR_CMP_0_HI               0x45D
+#define A5XX_RBBM_PERFCTR_CMP_1_LO               0x45E
+#define A5XX_RBBM_PERFCTR_CMP_1_HI               0x45F
+#define A5XX_RBBM_PERFCTR_CMP_2_LO               0x460
+#define A5XX_RBBM_PERFCTR_CMP_2_HI               0x461
+#define A5XX_RBBM_PERFCTR_CMP_3_LO               0x462
+#define A5XX_RBBM_PERFCTR_CMP_3_HI               0x463
+#define A5XX_RBBM_PERFCTR_RBBM_SEL_0             0x46B
+#define A5XX_RBBM_PERFCTR_RBBM_SEL_1             0x46C
+#define A5XX_RBBM_PERFCTR_RBBM_SEL_2             0x46D
+#define A5XX_RBBM_PERFCTR_RBBM_SEL_3             0x46E
+#define A5XX_RBBM_ALWAYSON_COUNTER_LO            0x4D2
+#define A5XX_RBBM_ALWAYSON_COUNTER_HI            0x4D3
+#define A5XX_RBBM_STATUS                         0x4F5
+#define A5XX_RBBM_STATUS3                        0x530
+#define A5XX_RBBM_INT_0_STATUS                   0x4E1
+#define A5XX_RBBM_AHB_ME_SPLIT_STATUS            0x4F0
+#define A5XX_RBBM_AHB_PFP_SPLIT_STATUS           0x4F1
+#define A5XX_RBBM_AHB_ERROR_STATUS               0x4F4
+#define A5XX_RBBM_PERFCTR_CNTL                   0x464
+#define A5XX_RBBM_PERFCTR_LOAD_CMD0              0x465
+#define A5XX_RBBM_PERFCTR_LOAD_CMD1              0x466
+#define A5XX_RBBM_PERFCTR_LOAD_CMD2              0x467
+#define A5XX_RBBM_PERFCTR_LOAD_CMD3              0x468
+#define A5XX_RBBM_PERFCTR_LOAD_VALUE_LO          0x469
+#define A5XX_RBBM_PERFCTR_LOAD_VALUE_HI          0x46A
+#define A5XX_RBBM_PERFCTR_RBBM_SEL_0             0x46B
+#define A5XX_RBBM_PERFCTR_RBBM_SEL_1             0x46C
+#define A5XX_RBBM_PERFCTR_RBBM_SEL_2             0x46D
+#define A5XX_RBBM_PERFCTR_RBBM_SEL_3             0x46E
+#define A5XX_RBBM_PERFCTR_GPU_BUSY_MASKED        0x46F
+#define A5XX_RBBM_CFG_DBGBUS_EVENT_LOGIC         0x504
+#define A5XX_RBBM_CFG_DBGBUS_OVER                0x505
+#define A5XX_RBBM_CFG_DBGBUS_COUNT0              0x506
+#define A5XX_RBBM_CFG_DBGBUS_COUNT1              0x507
+#define A5XX_RBBM_CFG_DBGBUS_COUNT2              0x508
+#define A5XX_RBBM_CFG_DBGBUS_COUNT3              0x509
+#define A5XX_RBBM_CFG_DBGBUS_COUNT4              0x50A
+#define A5XX_RBBM_CFG_DBGBUS_COUNT5              0x50B
+#define A5XX_RBBM_CFG_DBGBUS_TRACE_ADDR          0x50C
+#define A5XX_RBBM_CFG_DBGBUS_TRACE_BUF0          0x50D
+#define A5XX_RBBM_CFG_DBGBUS_TRACE_BUF1          0x50E
+#define A5XX_RBBM_CFG_DBGBUS_TRACE_BUF2          0x50F
+#define A5XX_RBBM_CFG_DBGBUS_TRACE_BUF3          0x510
+#define A5XX_RBBM_CFG_DBGBUS_TRACE_BUF4          0x511
+#define A5XX_RBBM_CFG_DBGBUS_MISR0               0x512
+#define A5XX_RBBM_CFG_DBGBUS_MISR1               0x513
+#define A5XX_RBBM_ISDB_CNT                       0x533
+#define A5XX_RBBM_SECVID_TRUST_CONFIG            0xF000
+#define A5XX_RBBM_SECVID_TRUST_CNTL              0xF400
+#define A5XX_RBBM_SECVID_TSB_TRUSTED_BASE_LO     0xF800
+#define A5XX_RBBM_SECVID_TSB_TRUSTED_BASE_HI     0xF801
+#define A5XX_RBBM_SECVID_TSB_TRUSTED_SIZE        0xF802
+#define A5XX_RBBM_SECVID_TSB_CNTL                0xF803
+#define A5XX_RBBM_SECVID_TSB_ADDR_MODE_CNTL      0xF810
+
+/* VSC registers */
+#define A5XX_VSC_PERFCTR_VSC_SEL_0          0xC60
+#define A5XX_VSC_PERFCTR_VSC_SEL_1          0xC61
+
+#define A5XX_GRAS_ADDR_MODE_CNTL            0xC81
+
+/* TSE registers */
+#define A5XX_GRAS_PERFCTR_TSE_SEL_0         0xC90
+#define A5XX_GRAS_PERFCTR_TSE_SEL_1         0xC91
+#define A5XX_GRAS_PERFCTR_TSE_SEL_2         0xC92
+#define A5XX_GRAS_PERFCTR_TSE_SEL_3         0xC93
+
+/* RAS registers */
+#define A5XX_GRAS_PERFCTR_RAS_SEL_0         0xC94
+#define A5XX_GRAS_PERFCTR_RAS_SEL_1         0xC95
+#define A5XX_GRAS_PERFCTR_RAS_SEL_2         0xC96
+#define A5XX_GRAS_PERFCTR_RAS_SEL_3         0xC97
+
+/* LRZ registers */
+#define A5XX_GRAS_PERFCTR_LRZ_SEL_0         0xC98
+#define A5XX_GRAS_PERFCTR_LRZ_SEL_1         0xC99
+#define A5XX_GRAS_PERFCTR_LRZ_SEL_2         0xC9A
+#define A5XX_GRAS_PERFCTR_LRZ_SEL_3         0xC9B
+
+
+/* RB registers */
+#define A5XX_RB_DBG_ECO_CNT                 0xCC4
+#define A5XX_RB_ADDR_MODE_CNTL              0xCC5
+#define A5XX_RB_MODE_CNTL                   0xCC6
+#define A5XX_RB_PERFCTR_RB_SEL_0            0xCD0
+#define A5XX_RB_PERFCTR_RB_SEL_1            0xCD1
+#define A5XX_RB_PERFCTR_RB_SEL_2            0xCD2
+#define A5XX_RB_PERFCTR_RB_SEL_3            0xCD3
+#define A5XX_RB_PERFCTR_RB_SEL_4            0xCD4
+#define A5XX_RB_PERFCTR_RB_SEL_5            0xCD5
+#define A5XX_RB_PERFCTR_RB_SEL_6            0xCD6
+#define A5XX_RB_PERFCTR_RB_SEL_7            0xCD7
+
+/* CCU registers */
+#define A5XX_RB_PERFCTR_CCU_SEL_0           0xCD8
+#define A5XX_RB_PERFCTR_CCU_SEL_1           0xCD9
+#define A5XX_RB_PERFCTR_CCU_SEL_2           0xCDA
+#define A5XX_RB_PERFCTR_CCU_SEL_3           0xCDB
+
+/* RB Power Counter RB Registers Select */
+#define A5XX_RB_POWERCTR_RB_SEL_0           0xCE0
+#define A5XX_RB_POWERCTR_RB_SEL_1           0xCE1
+#define A5XX_RB_POWERCTR_RB_SEL_2           0xCE2
+#define A5XX_RB_POWERCTR_RB_SEL_3           0xCE3
+
+/* RB Power Counter CCU Registers Select */
+#define A5XX_RB_POWERCTR_CCU_SEL_0          0xCE4
+#define A5XX_RB_POWERCTR_CCU_SEL_1          0xCE5
+
+/* CMP registers */
+#define A5XX_RB_PERFCTR_CMP_SEL_0           0xCEC
+#define A5XX_RB_PERFCTR_CMP_SEL_1           0xCED
+#define A5XX_RB_PERFCTR_CMP_SEL_2           0xCEE
+#define A5XX_RB_PERFCTR_CMP_SEL_3           0xCEF
+
+/* PC registers */
+#define A5XX_PC_DBG_ECO_CNTL                0xD00
+#define A5XX_PC_ADDR_MODE_CNTL              0xD01
+#define A5XX_PC_PERFCTR_PC_SEL_0            0xD10
+#define A5XX_PC_PERFCTR_PC_SEL_1            0xD11
+#define A5XX_PC_PERFCTR_PC_SEL_2            0xD12
+#define A5XX_PC_PERFCTR_PC_SEL_3            0xD13
+#define A5XX_PC_PERFCTR_PC_SEL_4            0xD14
+#define A5XX_PC_PERFCTR_PC_SEL_5            0xD15
+#define A5XX_PC_PERFCTR_PC_SEL_6            0xD16
+#define A5XX_PC_PERFCTR_PC_SEL_7            0xD17
+
+/* HLSQ registers */
+#define A5XX_HLSQ_DBG_ECO_CNTL		    0xE04
+#define A5XX_HLSQ_ADDR_MODE_CNTL            0xE05
+#define A5XX_HLSQ_PERFCTR_HLSQ_SEL_0        0xE10
+#define A5XX_HLSQ_PERFCTR_HLSQ_SEL_1        0xE11
+#define A5XX_HLSQ_PERFCTR_HLSQ_SEL_2        0xE12
+#define A5XX_HLSQ_PERFCTR_HLSQ_SEL_3        0xE13
+#define A5XX_HLSQ_PERFCTR_HLSQ_SEL_4        0xE14
+#define A5XX_HLSQ_PERFCTR_HLSQ_SEL_5        0xE15
+#define A5XX_HLSQ_PERFCTR_HLSQ_SEL_6        0xE16
+#define A5XX_HLSQ_PERFCTR_HLSQ_SEL_7        0xE17
+#define A5XX_HLSQ_DBG_READ_SEL              0xBC00
+#define A5XX_HLSQ_DBG_AHB_READ_APERTURE     0xA000
+
+/* VFD registers */
+#define A5XX_VFD_ADDR_MODE_CNTL             0xE41
+#define A5XX_VFD_PERFCTR_VFD_SEL_0          0xE50
+#define A5XX_VFD_PERFCTR_VFD_SEL_1          0xE51
+#define A5XX_VFD_PERFCTR_VFD_SEL_2          0xE52
+#define A5XX_VFD_PERFCTR_VFD_SEL_3          0xE53
+#define A5XX_VFD_PERFCTR_VFD_SEL_4          0xE54
+#define A5XX_VFD_PERFCTR_VFD_SEL_5          0xE55
+#define A5XX_VFD_PERFCTR_VFD_SEL_6          0xE56
+#define A5XX_VFD_PERFCTR_VFD_SEL_7          0xE57
+
+/* VPC registers */
+#define A5XX_VPC_DBG_ECO_CNTL		    0xE60
+#define A5XX_VPC_ADDR_MODE_CNTL             0xE61
+#define A5XX_VPC_PERFCTR_VPC_SEL_0          0xE64
+#define A5XX_VPC_PERFCTR_VPC_SEL_1          0xE65
+#define A5XX_VPC_PERFCTR_VPC_SEL_2          0xE66
+#define A5XX_VPC_PERFCTR_VPC_SEL_3          0xE67
+
+/* UCHE registers */
+#define A5XX_UCHE_ADDR_MODE_CNTL            0xE80
+#define A5XX_UCHE_MODE_CNTL                 0xE81
+#define A5XX_UCHE_WRITE_THRU_BASE_LO        0xE87
+#define A5XX_UCHE_WRITE_THRU_BASE_HI        0xE88
+#define A5XX_UCHE_TRAP_BASE_LO              0xE89
+#define A5XX_UCHE_TRAP_BASE_HI              0xE8A
+#define A5XX_UCHE_GMEM_RANGE_MIN_LO         0xE8B
+#define A5XX_UCHE_GMEM_RANGE_MIN_HI         0xE8C
+#define A5XX_UCHE_GMEM_RANGE_MAX_LO         0xE8D
+#define A5XX_UCHE_GMEM_RANGE_MAX_HI         0xE8E
+#define A5XX_UCHE_DBG_ECO_CNTL_2            0xE8F
+#define A5XX_UCHE_INVALIDATE0               0xE95
+#define A5XX_UCHE_CACHE_WAYS                0xE96
+#define A5XX_UCHE_PERFCTR_UCHE_SEL_0        0xEA0
+#define A5XX_UCHE_PERFCTR_UCHE_SEL_1        0xEA1
+#define A5XX_UCHE_PERFCTR_UCHE_SEL_2        0xEA2
+#define A5XX_UCHE_PERFCTR_UCHE_SEL_3        0xEA3
+#define A5XX_UCHE_PERFCTR_UCHE_SEL_4        0xEA4
+#define A5XX_UCHE_PERFCTR_UCHE_SEL_5        0xEA5
+#define A5XX_UCHE_PERFCTR_UCHE_SEL_6        0xEA6
+#define A5XX_UCHE_PERFCTR_UCHE_SEL_7        0xEA7
+
+/* UCHE Power Counter UCHE Registers Select */
+#define A5XX_UCHE_POWERCTR_UCHE_SEL_0       0xEA8
+#define A5XX_UCHE_POWERCTR_UCHE_SEL_1       0xEA9
+#define A5XX_UCHE_POWERCTR_UCHE_SEL_2       0xEAA
+#define A5XX_UCHE_POWERCTR_UCHE_SEL_3       0xEAB
+
+/* SP registers */
+#define A5XX_SP_DBG_ECO_CNTL                0xEC0
+#define A5XX_SP_ADDR_MODE_CNTL              0xEC1
+#define A5XX_SP_PERFCTR_SP_SEL_0            0xED0
+#define A5XX_SP_PERFCTR_SP_SEL_1            0xED1
+#define A5XX_SP_PERFCTR_SP_SEL_2            0xED2
+#define A5XX_SP_PERFCTR_SP_SEL_3            0xED3
+#define A5XX_SP_PERFCTR_SP_SEL_4            0xED4
+#define A5XX_SP_PERFCTR_SP_SEL_5            0xED5
+#define A5XX_SP_PERFCTR_SP_SEL_6            0xED6
+#define A5XX_SP_PERFCTR_SP_SEL_7            0xED7
+#define A5XX_SP_PERFCTR_SP_SEL_8            0xED8
+#define A5XX_SP_PERFCTR_SP_SEL_9            0xED9
+#define A5XX_SP_PERFCTR_SP_SEL_10           0xEDA
+#define A5XX_SP_PERFCTR_SP_SEL_11           0xEDB
+
+/* SP Power Counter SP Registers Select */
+#define A5XX_SP_POWERCTR_SP_SEL_0           0xEDC
+#define A5XX_SP_POWERCTR_SP_SEL_1           0xEDD
+#define A5XX_SP_POWERCTR_SP_SEL_2           0xEDE
+#define A5XX_SP_POWERCTR_SP_SEL_3           0xEDF
+
+/* TP registers */
+#define A5XX_TPL1_ADDR_MODE_CNTL            0xF01
+#define A5XX_TPL1_MODE_CNTL                 0xF02
+#define A5XX_TPL1_PERFCTR_TP_SEL_0          0xF10
+#define A5XX_TPL1_PERFCTR_TP_SEL_1          0xF11
+#define A5XX_TPL1_PERFCTR_TP_SEL_2          0xF12
+#define A5XX_TPL1_PERFCTR_TP_SEL_3          0xF13
+#define A5XX_TPL1_PERFCTR_TP_SEL_4          0xF14
+#define A5XX_TPL1_PERFCTR_TP_SEL_5          0xF15
+#define A5XX_TPL1_PERFCTR_TP_SEL_6          0xF16
+#define A5XX_TPL1_PERFCTR_TP_SEL_7          0xF17
+
+/* TP Power Counter TP Registers Select */
+#define A5XX_TPL1_POWERCTR_TP_SEL_0         0xF18
+#define A5XX_TPL1_POWERCTR_TP_SEL_1         0xF19
+#define A5XX_TPL1_POWERCTR_TP_SEL_2         0xF1A
+#define A5XX_TPL1_POWERCTR_TP_SEL_3         0xF1B
+
+/* VBIF registers */
+#define A5XX_VBIF_VERSION                       0x3000
+#define A5XX_VBIF_CLKON                         0x3001
+#define A5XX_VBIF_CLKON_FORCE_ON_TESTBUS_MASK   0x1
+#define A5XX_VBIF_CLKON_FORCE_ON_TESTBUS_SHIFT  0x1
+
+#define A5XX_VBIF_ROUND_ROBIN_QOS_ARB      0x3049
+#define A5XX_VBIF_GATE_OFF_WRREQ_EN        0x302A
+
+#define A5XX_VBIF_XIN_HALT_CTRL0	   0x3080
+#define A5XX_VBIF_XIN_HALT_CTRL0_MASK	   0xF
+#define A510_VBIF_XIN_HALT_CTRL0_MASK	   0x7
+#define A5XX_VBIF_XIN_HALT_CTRL1	   0x3081
+
+#define A5XX_VBIF_TEST_BUS_OUT_CTRL            0x3084
+#define A5XX_VBIF_TEST_BUS_OUT_CTRL_EN_MASK    0x1
+#define A5XX_VBIF_TEST_BUS_OUT_CTRL_EN_SHIFT   0x0
+
+#define A5XX_VBIF_TEST_BUS1_CTRL0                0x3085
+#define A5XX_VBIF_TEST_BUS1_CTRL1                0x3086
+#define A5XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_MASK  0xF
+#define A5XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_SHIFT 0x0
+
+#define A5XX_VBIF_TEST_BUS2_CTRL0                   0x3087
+#define A5XX_VBIF_TEST_BUS2_CTRL1                   0x3088
+#define A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_MASK     0x1FF
+#define A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_SHIFT    0x0
+
+#define A5XX_VBIF_TEST_BUS_OUT             0x308c
+
+#define A5XX_VBIF_PERF_CNT_SEL0            0x30D0
+#define A5XX_VBIF_PERF_CNT_SEL1            0x30D1
+#define A5XX_VBIF_PERF_CNT_SEL2            0x30D2
+#define A5XX_VBIF_PERF_CNT_SEL3            0x30D3
+#define A5XX_VBIF_PERF_CNT_LOW0            0x30D8
+#define A5XX_VBIF_PERF_CNT_LOW1            0x30D9
+#define A5XX_VBIF_PERF_CNT_LOW2            0x30DA
+#define A5XX_VBIF_PERF_CNT_LOW3            0x30DB
+#define A5XX_VBIF_PERF_CNT_HIGH0           0x30E0
+#define A5XX_VBIF_PERF_CNT_HIGH1           0x30E1
+#define A5XX_VBIF_PERF_CNT_HIGH2           0x30E2
+#define A5XX_VBIF_PERF_CNT_HIGH3           0x30E3
+
+#define A5XX_VBIF_PERF_PWR_CNT_EN0         0x3100
+#define A5XX_VBIF_PERF_PWR_CNT_EN1         0x3101
+#define A5XX_VBIF_PERF_PWR_CNT_EN2         0x3102
+
+#define A5XX_VBIF_PERF_PWR_CNT_LOW0        0x3110
+#define A5XX_VBIF_PERF_PWR_CNT_LOW1        0x3111
+#define A5XX_VBIF_PERF_PWR_CNT_LOW2        0x3112
+
+#define A5XX_VBIF_PERF_PWR_CNT_HIGH0       0x3118
+#define A5XX_VBIF_PERF_PWR_CNT_HIGH1       0x3119
+#define A5XX_VBIF_PERF_PWR_CNT_HIGH2       0x311A
+
+/* GPMU registers */
+#define A5XX_GPMU_INST_RAM_BASE            0x8800
+#define A5XX_GPMU_DATA_RAM_BASE            0x9800
+#define A5XX_GPMU_SP_POWER_CNTL            0xA881
+#define A5XX_GPMU_RBCCU_CLOCK_CNTL         0xA886
+#define A5XX_GPMU_RBCCU_POWER_CNTL         0xA887
+#define A5XX_GPMU_SP_PWR_CLK_STATUS        0xA88B
+#define A5XX_GPMU_RBCCU_PWR_CLK_STATUS     0xA88D
+#define A5XX_GPMU_PWR_COL_STAGGER_DELAY    0xA891
+#define A5XX_GPMU_PWR_COL_INTER_FRAME_CTRL 0xA892
+#define A5XX_GPMU_PWR_COL_INTER_FRAME_HYST 0xA893
+#define A5XX_GPMU_PWR_COL_BINNING_CTRL     0xA894
+#define A5XX_GPMU_CLOCK_THROTTLE_CTRL      0xA8A3
+#define A5XX_GPMU_WFI_CONFIG               0xA8C1
+#define A5XX_GPMU_RBBM_INTR_INFO           0xA8D6
+#define A5XX_GPMU_CM3_SYSRESET             0xA8D8
+#define A5XX_GPMU_GENERAL_0                0xA8E0
+#define A5XX_GPMU_GENERAL_1                0xA8E1
+
+/* COUNTABLE FOR SP PERFCOUNTER */
+#define A5XX_SP_ALU_ACTIVE_CYCLES          0x1
+#define A5XX_SP0_ICL1_MISSES               0x35
+#define A5XX_SP_FS_CFLOW_INSTRUCTIONS      0x27
+
+/* COUNTABLE FOR TSE PERFCOUNTER */
+#define A5XX_TSE_INPUT_PRIM_NUM            0x6
+
+/* COUNTABLE FOR RBBM PERFCOUNTER */
+#define A5XX_RBBM_ALWAYS_COUNT		0x0
+
+/* GPMU POWER COUNTERS */
+#define A5XX_SP_POWER_COUNTER_0_LO		0xA840
+#define A5XX_SP_POWER_COUNTER_0_HI		0xA841
+#define A5XX_SP_POWER_COUNTER_1_LO		0xA842
+#define A5XX_SP_POWER_COUNTER_1_HI		0xA843
+#define A5XX_SP_POWER_COUNTER_2_LO		0xA844
+#define A5XX_SP_POWER_COUNTER_2_HI		0xA845
+#define A5XX_SP_POWER_COUNTER_3_LO		0xA846
+#define A5XX_SP_POWER_COUNTER_3_HI		0xA847
+
+#define A5XX_TP_POWER_COUNTER_0_LO		0xA848
+#define A5XX_TP_POWER_COUNTER_0_HI		0xA849
+#define A5XX_TP_POWER_COUNTER_1_LO		0xA84A
+#define A5XX_TP_POWER_COUNTER_1_HI		0xA84B
+#define A5XX_TP_POWER_COUNTER_2_LO		0xA84C
+#define A5XX_TP_POWER_COUNTER_2_HI		0xA84D
+#define A5XX_TP_POWER_COUNTER_3_LO		0xA84E
+#define A5XX_TP_POWER_COUNTER_3_HI		0xA84F
+
+#define A5XX_RB_POWER_COUNTER_0_LO		0xA850
+#define A5XX_RB_POWER_COUNTER_0_HI		0xA851
+#define A5XX_RB_POWER_COUNTER_1_LO		0xA852
+#define A5XX_RB_POWER_COUNTER_1_HI		0xA853
+#define A5XX_RB_POWER_COUNTER_2_LO		0xA854
+#define A5XX_RB_POWER_COUNTER_2_HI		0xA855
+#define A5XX_RB_POWER_COUNTER_3_LO		0xA856
+#define A5XX_RB_POWER_COUNTER_3_HI		0xA857
+
+#define A5XX_CCU_POWER_COUNTER_0_LO		0xA858
+#define A5XX_CCU_POWER_COUNTER_0_HI		0xA859
+#define A5XX_CCU_POWER_COUNTER_1_LO		0xA85A
+#define A5XX_CCU_POWER_COUNTER_1_HI		0xA85B
+
+#define A5XX_UCHE_POWER_COUNTER_0_LO		0xA85C
+#define A5XX_UCHE_POWER_COUNTER_0_HI		0xA85D
+#define A5XX_UCHE_POWER_COUNTER_1_LO		0xA85E
+#define A5XX_UCHE_POWER_COUNTER_1_HI		0xA85F
+#define A5XX_UCHE_POWER_COUNTER_2_LO		0xA860
+#define A5XX_UCHE_POWER_COUNTER_2_HI		0xA861
+#define A5XX_UCHE_POWER_COUNTER_3_LO		0xA862
+#define A5XX_UCHE_POWER_COUNTER_3_HI		0xA863
+
+#define A5XX_CP_POWER_COUNTER_0_LO		0xA864
+#define A5XX_CP_POWER_COUNTER_0_HI		0xA865
+#define A5XX_CP_POWER_COUNTER_1_LO		0xA866
+#define A5XX_CP_POWER_COUNTER_1_HI		0xA867
+#define A5XX_CP_POWER_COUNTER_2_LO		0xA868
+#define A5XX_CP_POWER_COUNTER_2_HI		0xA869
+#define A5XX_CP_POWER_COUNTER_3_LO		0xA86A
+#define A5XX_CP_POWER_COUNTER_3_HI		0xA86B
+
+#define A5XX_GPMU_POWER_COUNTER_0_LO		0xA86C
+#define A5XX_GPMU_POWER_COUNTER_0_HI		0xA86D
+#define A5XX_GPMU_POWER_COUNTER_1_LO		0xA86E
+#define A5XX_GPMU_POWER_COUNTER_1_HI		0xA86F
+#define A5XX_GPMU_POWER_COUNTER_2_LO		0xA870
+#define A5XX_GPMU_POWER_COUNTER_2_HI		0xA871
+#define A5XX_GPMU_POWER_COUNTER_3_LO		0xA872
+#define A5XX_GPMU_POWER_COUNTER_3_HI		0xA873
+#define A5XX_GPMU_POWER_COUNTER_4_LO		0xA874
+#define A5XX_GPMU_POWER_COUNTER_4_HI		0xA875
+#define A5XX_GPMU_POWER_COUNTER_5_LO		0xA876
+#define A5XX_GPMU_POWER_COUNTER_5_HI		0xA877
+
+#define A5XX_GPMU_POWER_COUNTER_ENABLE		0xA878
+#define A5XX_GPMU_ALWAYS_ON_COUNTER_LO		0xA879
+#define A5XX_GPMU_ALWAYS_ON_COUNTER_HI		0xA87A
+#define A5XX_GPMU_ALWAYS_ON_COUNTER_RESET	0xA87B
+#define A5XX_GPMU_POWER_COUNTER_SELECT_0	0xA87C
+#define A5XX_GPMU_POWER_COUNTER_SELECT_1	0xA87D
+#define A5XX_GPMU_GPMU_SP_CLOCK_CONTROL		0xA880
+
+#define A5XX_GPMU_CLOCK_THROTTLE_CTRL		0xA8A3
+#define A5XX_GPMU_THROTTLE_UNMASK_FORCE_CTRL	0xA8A8
+
+#define A5XX_GPMU_TEMP_SENSOR_ID		0xAC00
+#define A5XX_GPMU_TEMP_SENSOR_CONFIG		0xAC01
+#define A5XX_GPMU_DELTA_TEMP_THRESHOLD		0xAC03
+#define A5XX_GPMU_TEMP_THRESHOLD_INTR_EN_MASK	0xAC06
+
+#define A5XX_GPMU_LEAKAGE_TEMP_COEFF_0_1	0xAC40
+#define A5XX_GPMU_LEAKAGE_TEMP_COEFF_2_3	0xAC41
+#define A5XX_GPMU_LEAKAGE_VTG_COEFF_0_1		0xAC42
+#define A5XX_GPMU_LEAKAGE_VTG_COEFF_2_3		0xAC43
+#define A5XX_GPMU_BASE_LEAKAGE			0xAC46
+
+#define A5XX_GPMU_GPMU_VOLTAGE			0xAC60
+#define A5XX_GPMU_GPMU_VOLTAGE_INTR_STATUS	0xAC61
+#define A5XX_GPMU_GPMU_VOLTAGE_INTR_EN_MASK	0xAC62
+#define A5XX_GPMU_GPMU_PWR_THRESHOLD		0xAC80
+#define A5XX_GPMU_GPMU_LLM_GLM_SLEEP_CTRL	0xACC4
+#define A5XX_GPMU_GPMU_LLM_GLM_SLEEP_STATUS	0xACC5
+#define A5XX_GPMU_GPMU_ISENSE_CTRL		0xACD0
+
+#define A5XX_GDPM_CONFIG1			0xB80C
+#define A5XX_GDPM_INT_EN			0xB80F
+#define A5XX_GDPM_INT_MASK			0xB811
+#define A5XX_GPMU_BEC_ENABLE			0xB9A0
+
+/* ISENSE registers */
+#define A5XX_GPU_CS_DECIMAL_ALIGN		0xC16A
+#define A5XX_GPU_CS_SENSOR_PARAM_CORE_1	0xC126
+#define A5XX_GPU_CS_SENSOR_PARAM_CORE_2	0xC127
+#define A5XX_GPU_CS_SW_OV_FUSE_EN		0xC168
+#define A5XX_GPU_CS_SENSOR_GENERAL_STATUS	0xC41A
+#define A5XX_GPU_CS_AMP_CALIBRATION_STATUS1_0	0xC41D
+#define A5XX_GPU_CS_AMP_CALIBRATION_STATUS1_2	0xC41F
+#define A5XX_GPU_CS_AMP_CALIBRATION_STATUS1_4	0xC421
+#define A5XX_GPU_CS_ENABLE_REG			0xC520
+#define A5XX_GPU_CS_AMP_CALIBRATION_CONTROL1	0xC557
+#define A5XX_GPU_CS_AMP_CALIBRATION_DONE	0xC565
+#define A5XX_GPU_CS_ENDPOINT_CALIBRATION_DONE   0xC556
+#endif /* _A5XX_REG_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/a6xx_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/a6xx_reg.h
@@ -0,0 +1,1245 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _A6XX_REG_H
+#define _A6XX_REG_H
+
+/* A6XX interrupt bits */
+#define A6XX_INT_RBBM_GPU_IDLE          0
+#define A6XX_INT_CP_AHB_ERROR           1
+#define A6XX_INT_ATB_ASYNCFIFO_OVERFLOW 6
+#define A6XX_INT_RBBM_GPC_ERROR         7
+#define A6XX_INT_CP_SW                  8
+#define A6XX_INT_CP_HW_ERROR            9
+#define A6XX_INT_CP_CCU_FLUSH_DEPTH_TS  10
+#define A6XX_INT_CP_CCU_FLUSH_COLOR_TS  11
+#define A6XX_INT_CP_CCU_RESOLVE_TS      12
+#define A6XX_INT_CP_IB2                 13
+#define A6XX_INT_CP_IB1                 14
+#define A6XX_INT_CP_RB                  15
+#define A6XX_INT_CP_RB_DONE_TS          17
+#define A6XX_INT_CP_WT_DONE_TS          18
+#define A6XX_INT_CP_CACHE_FLUSH_TS      20
+#define A6XX_INT_RBBM_ATB_BUS_OVERFLOW  22
+#define A6XX_INT_RBBM_HANG_DETECT       23
+#define A6XX_INT_UCHE_OOB_ACCESS        24
+#define A6XX_INT_UCHE_TRAP_INTR         25
+#define A6XX_INT_DEBBUS_INTR_0          26
+#define A6XX_INT_DEBBUS_INTR_1          27
+#define A6XX_INT_TSB_WRITE_ERROR	28
+#define A6XX_INT_ISDB_CPU_IRQ           30
+#define A6XX_INT_ISDB_UNDER_DEBUG       31
+
+/* CP Interrupt bits */
+#define A6XX_CP_OPCODE_ERROR                    0
+#define A6XX_CP_UCODE_ERROR                     1
+#define A6XX_CP_HW_FAULT_ERROR                  2
+#define A6XX_CP_REGISTER_PROTECTION_ERROR       4
+#define A6XX_CP_AHB_ERROR                       5
+#define A6XX_CP_VSD_PARITY_ERROR                6
+#define A6XX_CP_ILLEGAL_INSTR_ERROR             7
+
+/* CP registers */
+#define A6XX_CP_RB_BASE                  0x800
+#define A6XX_CP_RB_BASE_HI               0x801
+#define A6XX_CP_RB_CNTL                  0x802
+#define A6XX_CP_RB_RPTR_ADDR_LO          0x804
+#define A6XX_CP_RB_RPTR_ADDR_HI          0x805
+#define A6XX_CP_RB_RPTR                  0x806
+#define A6XX_CP_RB_WPTR                  0x807
+#define A6XX_CP_SQE_CNTL                 0x808
+#define A6XX_CP_CP2GMU_STATUS            0x812
+#define A6XX_CP_HW_FAULT                 0x821
+#define A6XX_CP_INTERRUPT_STATUS         0x823
+#define A6XX_CP_PROTECT_STATUS           0x824
+#define A6XX_CP_STATUS_1                 0x825
+#define A6XX_CP_SQE_INSTR_BASE_LO        0x830
+#define A6XX_CP_SQE_INSTR_BASE_HI        0x831
+#define A6XX_CP_MISC_CNTL                0x840
+#define A6XX_CP_APRIV_CNTL               0X844
+#define A6XX_CP_ROQ_THRESHOLDS_1         0x8C1
+#define A6XX_CP_ROQ_THRESHOLDS_2         0x8C2
+#define A6XX_CP_MEM_POOL_SIZE            0x8C3
+#define A6XX_CP_CHICKEN_DBG              0x841
+#define A6XX_CP_ADDR_MODE_CNTL           0x842
+#define A6XX_CP_DBG_ECO_CNTL             0x843
+#define A6XX_CP_PROTECT_CNTL             0x84F
+#define A6XX_CP_PROTECT_REG              0x850
+#define A6XX_CP_CONTEXT_SWITCH_CNTL      0x8A0
+#define A6XX_CP_CONTEXT_SWITCH_SMMU_INFO_LO   0x8A1
+#define A6XX_CP_CONTEXT_SWITCH_SMMU_INFO_HI   0x8A2
+#define A6XX_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_LO   0x8A3
+#define A6XX_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_HI   0x8A4
+#define A6XX_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_LO   0x8A5
+#define A6XX_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_HI   0x8A6
+#define A6XX_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_LO   0x8A7
+#define A6XX_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_HI   0x8A8
+#define A6XX_CP_CONTEXT_SWITCH_LEVEL_STATUS 0x8AB
+#define A6XX_CP_PERFCTR_CP_SEL_0         0x8D0
+#define A6XX_CP_PERFCTR_CP_SEL_1         0x8D1
+#define A6XX_CP_PERFCTR_CP_SEL_2         0x8D2
+#define A6XX_CP_PERFCTR_CP_SEL_3         0x8D3
+#define A6XX_CP_PERFCTR_CP_SEL_4         0x8D4
+#define A6XX_CP_PERFCTR_CP_SEL_5         0x8D5
+#define A6XX_CP_PERFCTR_CP_SEL_6         0x8D6
+#define A6XX_CP_PERFCTR_CP_SEL_7         0x8D7
+#define A6XX_CP_PERFCTR_CP_SEL_8         0x8D8
+#define A6XX_CP_PERFCTR_CP_SEL_9         0x8D9
+#define A6XX_CP_PERFCTR_CP_SEL_10        0x8DA
+#define A6XX_CP_PERFCTR_CP_SEL_11        0x8DB
+#define A6XX_CP_PERFCTR_CP_SEL_12        0x8DC
+#define A6XX_CP_PERFCTR_CP_SEL_13        0x8DD
+#define A6XX_CP_CRASH_SCRIPT_BASE_LO     0x900
+#define A6XX_CP_CRASH_SCRIPT_BASE_HI     0x901
+#define A6XX_CP_CRASH_DUMP_CNTL          0x902
+#define A6XX_CP_CRASH_DUMP_STATUS        0x903
+#define A6XX_CP_SQE_STAT_ADDR            0x908
+#define A6XX_CP_SQE_STAT_DATA            0x909
+#define A6XX_CP_DRAW_STATE_ADDR          0x90A
+#define A6XX_CP_DRAW_STATE_DATA          0x90B
+#define A6XX_CP_ROQ_DBG_ADDR             0x90C
+#define A6XX_CP_ROQ_DBG_DATA             0x90D
+#define A6XX_CP_MEM_POOL_DBG_ADDR        0x90E
+#define A6XX_CP_MEM_POOL_DBG_DATA        0x90F
+#define A6XX_CP_SQE_UCODE_DBG_ADDR       0x910
+#define A6XX_CP_SQE_UCODE_DBG_DATA       0x911
+#define A6XX_CP_IB1_BASE                 0x928
+#define A6XX_CP_IB1_BASE_HI              0x929
+#define A6XX_CP_IB1_REM_SIZE             0x92A
+#define A6XX_CP_IB2_BASE                 0x92B
+#define A6XX_CP_IB2_BASE_HI              0x92C
+#define A6XX_CP_IB2_REM_SIZE             0x92D
+#define A6XX_CP_ALWAYS_ON_COUNTER_LO     0x980
+#define A6XX_CP_ALWAYS_ON_COUNTER_HI     0x981
+#define A6XX_CP_ALWAYS_ON_CONTEXT_LO     0x982
+#define A6XX_CP_ALWAYS_ON_CONTEXT_HI     0x983
+#define A6XX_CP_AHB_CNTL                 0x98D
+#define A6XX_CP_APERTURE_CNTL_HOST       0xA00
+#define A6XX_CP_APERTURE_CNTL_CD         0xA03
+#define A6XX_VSC_ADDR_MODE_CNTL          0xC01
+
+/* LPAC registers */
+#define A6XX_CP_LPAC_DRAW_STATE_ADDR     0xB0A
+#define A6XX_CP_LPAC_DRAW_STATE_DATA     0xB0B
+#define A6XX_CP_LPAC_ROQ_DBG_ADDR        0xB0C
+#define A6XX_CP_SQE_AC_UCODE_DBG_ADDR    0xB27
+#define A6XX_CP_SQE_AC_UCODE_DBG_DATA    0xB28
+#define A6XX_CP_SQE_AC_STAT_ADDR         0xB29
+#define A6XX_CP_SQE_AC_STAT_DATA         0xB2A
+#define A6XX_CP_LPAC_ROQ_THRESHOLDS_1    0xB32
+#define A6XX_CP_LPAC_ROQ_THRESHOLDS_2    0xB33
+#define A6XX_CP_LPAC_PROG_FIFO_SIZE      0xB34
+#define A6XX_CP_LPAC_ROQ_DBG_DATA        0xB35
+#define A6XX_CP_LPAC_FIFO_DBG_DATA       0xB36
+#define A6XX_CP_LPAC_FIFO_DBG_ADDR       0xB40
+
+/* RBBM registers */
+#define A6XX_RBBM_INT_0_STATUS                   0x201
+#define A6XX_RBBM_STATUS                         0x210
+#define A6XX_RBBM_STATUS3                        0x213
+#define A6XX_RBBM_VBIF_GX_RESET_STATUS           0x215
+#define A6XX_RBBM_PERFCTR_CP_0_LO                0x400
+#define A6XX_RBBM_PERFCTR_CP_0_HI                0x401
+#define A6XX_RBBM_PERFCTR_CP_1_LO                0x402
+#define A6XX_RBBM_PERFCTR_CP_1_HI                0x403
+#define A6XX_RBBM_PERFCTR_CP_2_LO                0x404
+#define A6XX_RBBM_PERFCTR_CP_2_HI                0x405
+#define A6XX_RBBM_PERFCTR_CP_3_LO                0x406
+#define A6XX_RBBM_PERFCTR_CP_3_HI                0x407
+#define A6XX_RBBM_PERFCTR_CP_4_LO                0x408
+#define A6XX_RBBM_PERFCTR_CP_4_HI                0x409
+#define A6XX_RBBM_PERFCTR_CP_5_LO                0x40a
+#define A6XX_RBBM_PERFCTR_CP_5_HI                0x40b
+#define A6XX_RBBM_PERFCTR_CP_6_LO                0x40c
+#define A6XX_RBBM_PERFCTR_CP_6_HI                0x40d
+#define A6XX_RBBM_PERFCTR_CP_7_LO                0x40e
+#define A6XX_RBBM_PERFCTR_CP_7_HI                0x40f
+#define A6XX_RBBM_PERFCTR_CP_8_LO                0x410
+#define A6XX_RBBM_PERFCTR_CP_8_HI                0x411
+#define A6XX_RBBM_PERFCTR_CP_9_LO                0x412
+#define A6XX_RBBM_PERFCTR_CP_9_HI                0x413
+#define A6XX_RBBM_PERFCTR_CP_10_LO               0x414
+#define A6XX_RBBM_PERFCTR_CP_10_HI               0x415
+#define A6XX_RBBM_PERFCTR_CP_11_LO               0x416
+#define A6XX_RBBM_PERFCTR_CP_11_HI               0x417
+#define A6XX_RBBM_PERFCTR_CP_12_LO               0x418
+#define A6XX_RBBM_PERFCTR_CP_12_HI               0x419
+#define A6XX_RBBM_PERFCTR_CP_13_LO               0x41a
+#define A6XX_RBBM_PERFCTR_CP_13_HI               0x41b
+#define A6XX_RBBM_PERFCTR_RBBM_0_LO              0x41c
+#define A6XX_RBBM_PERFCTR_RBBM_0_HI              0x41d
+#define A6XX_RBBM_PERFCTR_RBBM_1_LO              0x41e
+#define A6XX_RBBM_PERFCTR_RBBM_1_HI              0x41f
+#define A6XX_RBBM_PERFCTR_RBBM_2_LO              0x420
+#define A6XX_RBBM_PERFCTR_RBBM_2_HI              0x421
+#define A6XX_RBBM_PERFCTR_RBBM_3_LO              0x422
+#define A6XX_RBBM_PERFCTR_RBBM_3_HI              0x423
+#define A6XX_RBBM_PERFCTR_PC_0_LO                0x424
+#define A6XX_RBBM_PERFCTR_PC_0_HI                0x425
+#define A6XX_RBBM_PERFCTR_PC_1_LO                0x426
+#define A6XX_RBBM_PERFCTR_PC_1_HI                0x427
+#define A6XX_RBBM_PERFCTR_PC_2_LO                0x428
+#define A6XX_RBBM_PERFCTR_PC_2_HI                0x429
+#define A6XX_RBBM_PERFCTR_PC_3_LO                0x42a
+#define A6XX_RBBM_PERFCTR_PC_3_HI                0x42b
+#define A6XX_RBBM_PERFCTR_PC_4_LO                0x42c
+#define A6XX_RBBM_PERFCTR_PC_4_HI                0x42d
+#define A6XX_RBBM_PERFCTR_PC_5_LO                0x42e
+#define A6XX_RBBM_PERFCTR_PC_5_HI                0x42f
+#define A6XX_RBBM_PERFCTR_PC_6_LO                0x430
+#define A6XX_RBBM_PERFCTR_PC_6_HI                0x431
+#define A6XX_RBBM_PERFCTR_PC_7_LO                0x432
+#define A6XX_RBBM_PERFCTR_PC_7_HI                0x433
+#define A6XX_RBBM_PERFCTR_VFD_0_LO               0x434
+#define A6XX_RBBM_PERFCTR_VFD_0_HI               0x435
+#define A6XX_RBBM_PERFCTR_VFD_1_LO               0x436
+#define A6XX_RBBM_PERFCTR_VFD_1_HI               0x437
+#define A6XX_RBBM_PERFCTR_VFD_2_LO               0x438
+#define A6XX_RBBM_PERFCTR_VFD_2_HI               0x439
+#define A6XX_RBBM_PERFCTR_VFD_3_LO               0x43a
+#define A6XX_RBBM_PERFCTR_VFD_3_HI               0x43b
+#define A6XX_RBBM_PERFCTR_VFD_4_LO               0x43c
+#define A6XX_RBBM_PERFCTR_VFD_4_HI               0x43d
+#define A6XX_RBBM_PERFCTR_VFD_5_LO               0x43e
+#define A6XX_RBBM_PERFCTR_VFD_5_HI               0x43f
+#define A6XX_RBBM_PERFCTR_VFD_6_LO               0x440
+#define A6XX_RBBM_PERFCTR_VFD_6_HI               0x441
+#define A6XX_RBBM_PERFCTR_VFD_7_LO               0x442
+#define A6XX_RBBM_PERFCTR_VFD_7_HI               0x443
+#define A6XX_RBBM_PERFCTR_HLSQ_0_LO              0x444
+#define A6XX_RBBM_PERFCTR_HLSQ_0_HI              0x445
+#define A6XX_RBBM_PERFCTR_HLSQ_1_LO              0x446
+#define A6XX_RBBM_PERFCTR_HLSQ_1_HI              0x447
+#define A6XX_RBBM_PERFCTR_HLSQ_2_LO              0x448
+#define A6XX_RBBM_PERFCTR_HLSQ_2_HI              0x449
+#define A6XX_RBBM_PERFCTR_HLSQ_3_LO              0x44a
+#define A6XX_RBBM_PERFCTR_HLSQ_3_HI              0x44b
+#define A6XX_RBBM_PERFCTR_HLSQ_4_LO              0x44c
+#define A6XX_RBBM_PERFCTR_HLSQ_4_HI              0x44d
+#define A6XX_RBBM_PERFCTR_HLSQ_5_LO              0x44e
+#define A6XX_RBBM_PERFCTR_HLSQ_5_HI              0x44f
+#define A6XX_RBBM_PERFCTR_VPC_0_LO               0x450
+#define A6XX_RBBM_PERFCTR_VPC_0_HI               0x451
+#define A6XX_RBBM_PERFCTR_VPC_1_LO               0x452
+#define A6XX_RBBM_PERFCTR_VPC_1_HI               0x453
+#define A6XX_RBBM_PERFCTR_VPC_2_LO               0x454
+#define A6XX_RBBM_PERFCTR_VPC_2_HI               0x455
+#define A6XX_RBBM_PERFCTR_VPC_3_LO               0x456
+#define A6XX_RBBM_PERFCTR_VPC_3_HI               0x457
+#define A6XX_RBBM_PERFCTR_VPC_4_LO               0x458
+#define A6XX_RBBM_PERFCTR_VPC_4_HI               0x459
+#define A6XX_RBBM_PERFCTR_VPC_5_LO               0x45a
+#define A6XX_RBBM_PERFCTR_VPC_5_HI               0x45b
+#define A6XX_RBBM_PERFCTR_CCU_0_LO               0x45c
+#define A6XX_RBBM_PERFCTR_CCU_0_HI               0x45d
+#define A6XX_RBBM_PERFCTR_CCU_1_LO               0x45e
+#define A6XX_RBBM_PERFCTR_CCU_1_HI               0x45f
+#define A6XX_RBBM_PERFCTR_CCU_2_LO               0x460
+#define A6XX_RBBM_PERFCTR_CCU_2_HI               0x461
+#define A6XX_RBBM_PERFCTR_CCU_3_LO               0x462
+#define A6XX_RBBM_PERFCTR_CCU_3_HI               0x463
+#define A6XX_RBBM_PERFCTR_CCU_4_LO               0x464
+#define A6XX_RBBM_PERFCTR_CCU_4_HI               0x465
+#define A6XX_RBBM_PERFCTR_TSE_0_LO               0x466
+#define A6XX_RBBM_PERFCTR_TSE_0_HI               0x467
+#define A6XX_RBBM_PERFCTR_TSE_1_LO               0x468
+#define A6XX_RBBM_PERFCTR_TSE_1_HI               0x469
+#define A6XX_RBBM_PERFCTR_TSE_2_LO               0x46a
+#define A6XX_RBBM_PERFCTR_CCU_4_HI               0x465
+#define A6XX_RBBM_PERFCTR_TSE_0_LO               0x466
+#define A6XX_RBBM_PERFCTR_TSE_0_HI               0x467
+#define A6XX_RBBM_PERFCTR_TSE_1_LO               0x468
+#define A6XX_RBBM_PERFCTR_TSE_1_HI               0x469
+#define A6XX_RBBM_PERFCTR_TSE_2_LO               0x46a
+#define A6XX_RBBM_PERFCTR_TSE_2_HI               0x46b
+#define A6XX_RBBM_PERFCTR_TSE_3_LO               0x46c
+#define A6XX_RBBM_PERFCTR_TSE_3_HI               0x46d
+#define A6XX_RBBM_PERFCTR_RAS_0_LO               0x46e
+#define A6XX_RBBM_PERFCTR_RAS_0_HI               0x46f
+#define A6XX_RBBM_PERFCTR_RAS_1_LO               0x470
+#define A6XX_RBBM_PERFCTR_RAS_1_HI               0x471
+#define A6XX_RBBM_PERFCTR_RAS_2_LO               0x472
+#define A6XX_RBBM_PERFCTR_RAS_2_HI               0x473
+#define A6XX_RBBM_PERFCTR_RAS_3_LO               0x474
+#define A6XX_RBBM_PERFCTR_RAS_3_HI               0x475
+#define A6XX_RBBM_PERFCTR_UCHE_0_LO              0x476
+#define A6XX_RBBM_PERFCTR_UCHE_0_HI              0x477
+#define A6XX_RBBM_PERFCTR_UCHE_1_LO              0x478
+#define A6XX_RBBM_PERFCTR_UCHE_1_HI              0x479
+#define A6XX_RBBM_PERFCTR_UCHE_2_LO              0x47a
+#define A6XX_RBBM_PERFCTR_UCHE_2_HI              0x47b
+#define A6XX_RBBM_PERFCTR_UCHE_3_LO              0x47c
+#define A6XX_RBBM_PERFCTR_UCHE_3_HI              0x47d
+#define A6XX_RBBM_PERFCTR_UCHE_4_LO              0x47e
+#define A6XX_RBBM_PERFCTR_UCHE_4_HI              0x47f
+#define A6XX_RBBM_PERFCTR_UCHE_5_LO              0x480
+#define A6XX_RBBM_PERFCTR_UCHE_5_HI              0x481
+#define A6XX_RBBM_PERFCTR_UCHE_6_LO              0x482
+#define A6XX_RBBM_PERFCTR_UCHE_6_HI              0x483
+#define A6XX_RBBM_PERFCTR_UCHE_7_LO              0x484
+#define A6XX_RBBM_PERFCTR_UCHE_7_HI              0x485
+#define A6XX_RBBM_PERFCTR_UCHE_8_LO              0x486
+#define A6XX_RBBM_PERFCTR_UCHE_8_HI              0x487
+#define A6XX_RBBM_PERFCTR_UCHE_9_LO              0x488
+#define A6XX_RBBM_PERFCTR_UCHE_9_HI              0x489
+#define A6XX_RBBM_PERFCTR_UCHE_10_LO             0x48a
+#define A6XX_RBBM_PERFCTR_UCHE_10_HI             0x48b
+#define A6XX_RBBM_PERFCTR_UCHE_11_LO             0x48c
+#define A6XX_RBBM_PERFCTR_UCHE_11_HI             0x48d
+#define A6XX_RBBM_PERFCTR_TP_0_LO                0x48e
+#define A6XX_RBBM_PERFCTR_TP_0_HI                0x48f
+#define A6XX_RBBM_PERFCTR_TP_1_LO                0x490
+#define A6XX_RBBM_PERFCTR_TP_1_HI                0x491
+#define A6XX_RBBM_PERFCTR_TP_2_LO                0x492
+#define A6XX_RBBM_PERFCTR_TP_2_HI                0x493
+#define A6XX_RBBM_PERFCTR_TP_3_LO                0x494
+#define A6XX_RBBM_PERFCTR_TP_3_HI                0x495
+#define A6XX_RBBM_PERFCTR_TP_4_LO                0x496
+#define A6XX_RBBM_PERFCTR_TP_4_HI                0x497
+#define A6XX_RBBM_PERFCTR_TP_5_LO                0x498
+#define A6XX_RBBM_PERFCTR_TP_5_HI                0x499
+#define A6XX_RBBM_PERFCTR_TP_6_LO                0x49a
+#define A6XX_RBBM_PERFCTR_TP_6_HI                0x49b
+#define A6XX_RBBM_PERFCTR_TP_7_LO                0x49c
+#define A6XX_RBBM_PERFCTR_TP_7_HI                0x49d
+#define A6XX_RBBM_PERFCTR_TP_8_LO                0x49e
+#define A6XX_RBBM_PERFCTR_TP_8_HI                0x49f
+#define A6XX_RBBM_PERFCTR_TP_9_LO                0x4a0
+#define A6XX_RBBM_PERFCTR_TP_9_HI                0x4a1
+#define A6XX_RBBM_PERFCTR_TP_10_LO               0x4a2
+#define A6XX_RBBM_PERFCTR_TP_10_HI               0x4a3
+#define A6XX_RBBM_PERFCTR_TP_11_LO               0x4a4
+#define A6XX_RBBM_PERFCTR_TP_11_HI               0x4a5
+#define A6XX_RBBM_PERFCTR_SP_0_LO                0x4a6
+#define A6XX_RBBM_PERFCTR_SP_0_HI                0x4a7
+#define A6XX_RBBM_PERFCTR_SP_1_LO                0x4a8
+#define A6XX_RBBM_PERFCTR_SP_1_HI                0x4a9
+#define A6XX_RBBM_PERFCTR_SP_2_LO                0x4aa
+#define A6XX_RBBM_PERFCTR_SP_2_HI                0x4ab
+#define A6XX_RBBM_PERFCTR_SP_3_LO                0x4ac
+#define A6XX_RBBM_PERFCTR_SP_3_HI                0x4ad
+#define A6XX_RBBM_PERFCTR_SP_4_LO                0x4ae
+#define A6XX_RBBM_PERFCTR_SP_4_HI                0x4af
+#define A6XX_RBBM_PERFCTR_SP_5_LO                0x4b0
+#define A6XX_RBBM_PERFCTR_SP_5_HI                0x4b1
+#define A6XX_RBBM_PERFCTR_SP_6_LO                0x4b2
+#define A6XX_RBBM_PERFCTR_SP_6_HI                0x4b3
+#define A6XX_RBBM_PERFCTR_SP_7_LO                0x4b4
+#define A6XX_RBBM_PERFCTR_SP_7_HI                0x4b5
+#define A6XX_RBBM_PERFCTR_SP_8_LO                0x4b6
+#define A6XX_RBBM_PERFCTR_SP_8_HI                0x4b7
+#define A6XX_RBBM_PERFCTR_SP_9_LO                0x4b8
+#define A6XX_RBBM_PERFCTR_SP_9_HI                0x4b9
+#define A6XX_RBBM_PERFCTR_SP_10_LO               0x4ba
+#define A6XX_RBBM_PERFCTR_SP_10_HI               0x4bb
+#define A6XX_RBBM_PERFCTR_SP_11_LO               0x4bc
+#define A6XX_RBBM_PERFCTR_SP_11_HI               0x4bd
+#define A6XX_RBBM_PERFCTR_SP_12_LO               0x4be
+#define A6XX_RBBM_PERFCTR_SP_12_HI               0x4bf
+#define A6XX_RBBM_PERFCTR_SP_13_LO               0x4c0
+#define A6XX_RBBM_PERFCTR_SP_13_HI               0x4c1
+#define A6XX_RBBM_PERFCTR_SP_14_LO               0x4c2
+#define A6XX_RBBM_PERFCTR_SP_14_HI               0x4c3
+#define A6XX_RBBM_PERFCTR_SP_15_LO               0x4c4
+#define A6XX_RBBM_PERFCTR_SP_15_HI               0x4c5
+#define A6XX_RBBM_PERFCTR_SP_16_LO               0x4c6
+#define A6XX_RBBM_PERFCTR_SP_16_HI               0x4c7
+#define A6XX_RBBM_PERFCTR_SP_17_LO               0x4c8
+#define A6XX_RBBM_PERFCTR_SP_17_HI               0x4c9
+#define A6XX_RBBM_PERFCTR_SP_18_LO               0x4ca
+#define A6XX_RBBM_PERFCTR_SP_18_HI               0x4cb
+#define A6XX_RBBM_PERFCTR_SP_19_LO               0x4cc
+#define A6XX_RBBM_PERFCTR_SP_19_HI               0x4cd
+#define A6XX_RBBM_PERFCTR_SP_20_LO               0x4ce
+#define A6XX_RBBM_PERFCTR_SP_20_HI               0x4cf
+#define A6XX_RBBM_PERFCTR_SP_21_LO               0x4d0
+#define A6XX_RBBM_PERFCTR_SP_21_HI               0x4d1
+#define A6XX_RBBM_PERFCTR_SP_22_LO               0x4d2
+#define A6XX_RBBM_PERFCTR_SP_22_HI               0x4d3
+#define A6XX_RBBM_PERFCTR_SP_23_LO               0x4d4
+#define A6XX_RBBM_PERFCTR_SP_23_HI               0x4d5
+#define A6XX_RBBM_PERFCTR_RB_0_LO                0x4d6
+#define A6XX_RBBM_PERFCTR_RB_0_HI                0x4d7
+#define A6XX_RBBM_PERFCTR_RB_1_LO                0x4d8
+#define A6XX_RBBM_PERFCTR_RB_1_HI                0x4d9
+#define A6XX_RBBM_PERFCTR_RB_2_LO                0x4da
+#define A6XX_RBBM_PERFCTR_RB_2_HI                0x4db
+#define A6XX_RBBM_PERFCTR_RB_3_LO                0x4dc
+#define A6XX_RBBM_PERFCTR_RB_3_HI                0x4dd
+#define A6XX_RBBM_PERFCTR_RB_4_LO                0x4de
+#define A6XX_RBBM_PERFCTR_RB_4_HI                0x4df
+#define A6XX_RBBM_PERFCTR_RB_5_LO                0x4e0
+#define A6XX_RBBM_PERFCTR_RB_5_HI                0x4e1
+#define A6XX_RBBM_PERFCTR_RB_6_LO                0x4e2
+#define A6XX_RBBM_PERFCTR_RB_6_HI                0x4e3
+#define A6XX_RBBM_PERFCTR_RB_7_LO                0x4e4
+#define A6XX_RBBM_PERFCTR_RB_7_HI                0x4e5
+#define A6XX_RBBM_PERFCTR_VSC_0_LO               0x4e6
+#define A6XX_RBBM_PERFCTR_VSC_0_HI               0x4e7
+#define A6XX_RBBM_PERFCTR_VSC_1_LO               0x4e8
+#define A6XX_RBBM_PERFCTR_VSC_1_HI               0x4e9
+#define A6XX_RBBM_PERFCTR_LRZ_0_LO               0x4ea
+#define A6XX_RBBM_PERFCTR_LRZ_0_HI               0x4eb
+#define A6XX_RBBM_PERFCTR_LRZ_1_LO               0x4ec
+#define A6XX_RBBM_PERFCTR_LRZ_1_HI               0x4ed
+#define A6XX_RBBM_PERFCTR_LRZ_2_LO               0x4ee
+#define A6XX_RBBM_PERFCTR_LRZ_2_HI               0x4ef
+#define A6XX_RBBM_PERFCTR_LRZ_3_LO               0x4f0
+#define A6XX_RBBM_PERFCTR_LRZ_3_HI               0x4f1
+#define A6XX_RBBM_PERFCTR_CMP_0_LO               0x4f2
+#define A6XX_RBBM_PERFCTR_CMP_0_HI               0x4f3
+#define A6XX_RBBM_PERFCTR_CMP_1_LO               0x4f4
+#define A6XX_RBBM_PERFCTR_CMP_1_HI               0x4f5
+#define A6XX_RBBM_PERFCTR_CMP_2_LO               0x4f6
+#define A6XX_RBBM_PERFCTR_CMP_2_HI               0x4f7
+#define A6XX_RBBM_PERFCTR_CMP_3_LO               0x4f8
+#define A6XX_RBBM_PERFCTR_CMP_3_HI               0x4f9
+#define A6XX_RBBM_PERFCTR_CNTL                   0x500
+#define A6XX_RBBM_PERFCTR_LOAD_CMD0              0x501
+#define A6XX_RBBM_PERFCTR_LOAD_CMD1              0x502
+#define A6XX_RBBM_PERFCTR_LOAD_CMD2              0x503
+#define A6XX_RBBM_PERFCTR_LOAD_CMD3              0x504
+#define A6XX_RBBM_PERFCTR_LOAD_VALUE_LO          0x505
+#define A6XX_RBBM_PERFCTR_LOAD_VALUE_HI          0x506
+#define A6XX_RBBM_PERFCTR_RBBM_SEL_0             0x507
+#define A6XX_RBBM_PERFCTR_RBBM_SEL_1             0x508
+#define A6XX_RBBM_PERFCTR_RBBM_SEL_2             0x509
+#define A6XX_RBBM_PERFCTR_RBBM_SEL_3             0x50A
+#define A6XX_RBBM_PERFCTR_GPU_BUSY_MASKED        0x50B
+#define A6XX_RBBM_PERFCTR_SRAM_INIT_CMD          0x50e
+#define A6XX_RBBM_PERFCTR_SRAM_INIT_STATUS       0x50f
+
+#define A6XX_RBBM_ISDB_CNT                       0x533
+#define A6XX_RBBM_NC_MODE_CNTL                   0X534
+#define A6XX_RBBM_SNAPSHOT_STATUS                0x535
+#define A6XX_RBBM_LPAC_GBIF_CLIENT_QOS_CNTL      0x5ff
+
+#define A6XX_RBBM_SECVID_TRUST_CNTL              0xF400
+#define A6XX_RBBM_SECVID_TSB_TRUSTED_BASE_LO     0xF800
+#define A6XX_RBBM_SECVID_TSB_TRUSTED_BASE_HI     0xF801
+#define A6XX_RBBM_SECVID_TSB_TRUSTED_SIZE        0xF802
+#define A6XX_RBBM_SECVID_TSB_CNTL                0xF803
+#define A6XX_RBBM_SECVID_TSB_ADDR_MODE_CNTL      0xF810
+
+#define A6XX_RBBM_VBIF_CLIENT_QOS_CNTL   0x00010
+#define A6XX_RBBM_GBIF_CLIENT_QOS_CNTL   0x00011
+#define A6XX_RBBM_GBIF_HALT              0x00016
+#define A6XX_RBBM_GBIF_HALT_ACK          0x00017
+#define A6XX_RBBM_GPR0_CNTL              0x00018
+#define A6XX_RBBM_INTERFACE_HANG_INT_CNTL 0x0001f
+#define A6XX_RBBM_INT_CLEAR_CMD          0x00037
+#define A6XX_RBBM_INT_0_MASK             0x00038
+#define A6XX_RBBM_INT_2_MASK             0x0003A
+#define A6XX_RBBM_SP_HYST_CNT            0x00042
+#define A6XX_RBBM_SW_RESET_CMD           0x00043
+#define A6XX_RBBM_RAC_THRESHOLD_CNT      0x00044
+#define A6XX_RBBM_BLOCK_SW_RESET_CMD     0x00045
+#define A6XX_RBBM_BLOCK_SW_RESET_CMD2    0x00046
+#define A6XX_RBBM_BLOCK_GX_RETENTION_CNTL 0x00050
+#define A6XX_RBBM_CLOCK_CNTL             0x000ae
+#define A6XX_RBBM_CLOCK_CNTL_SP0         0x000b0
+#define A6XX_RBBM_CLOCK_CNTL_SP1         0x000b1
+#define A6XX_RBBM_CLOCK_CNTL_SP2         0x000b2
+#define A6XX_RBBM_CLOCK_CNTL_SP3         0x000b3
+#define A6XX_RBBM_CLOCK_CNTL2_SP0        0x000b4
+#define A6XX_RBBM_CLOCK_CNTL2_SP1        0x000b5
+#define A6XX_RBBM_CLOCK_CNTL2_SP2        0x000b6
+#define A6XX_RBBM_CLOCK_CNTL2_SP3        0x000b7
+#define A6XX_RBBM_CLOCK_DELAY_SP0        0x000b8
+#define A6XX_RBBM_CLOCK_DELAY_SP1        0x000b9
+#define A6XX_RBBM_CLOCK_DELAY_SP2        0x000ba
+#define A6XX_RBBM_CLOCK_DELAY_SP3        0x000bb
+#define A6XX_RBBM_CLOCK_HYST_SP0         0x000bc
+#define A6XX_RBBM_CLOCK_HYST_SP1         0x000bd
+#define A6XX_RBBM_CLOCK_HYST_SP2         0x000be
+#define A6XX_RBBM_CLOCK_HYST_SP3         0x000bf
+#define A6XX_RBBM_CLOCK_CNTL_TP0         0x000c0
+#define A6XX_RBBM_CLOCK_CNTL_TP1         0x000c1
+#define A6XX_RBBM_CLOCK_CNTL_TP2         0x000c2
+#define A6XX_RBBM_CLOCK_CNTL_TP3         0x000c3
+#define A6XX_RBBM_CLOCK_CNTL2_TP0        0x000c4
+#define A6XX_RBBM_CLOCK_CNTL2_TP1        0x000c5
+#define A6XX_RBBM_CLOCK_CNTL2_TP2        0x000c6
+#define A6XX_RBBM_CLOCK_CNTL2_TP3        0x000c7
+#define A6XX_RBBM_CLOCK_CNTL3_TP0        0x000c8
+#define A6XX_RBBM_CLOCK_CNTL3_TP1        0x000c9
+#define A6XX_RBBM_CLOCK_CNTL3_TP2        0x000ca
+#define A6XX_RBBM_CLOCK_CNTL3_TP3        0x000cb
+#define A6XX_RBBM_CLOCK_CNTL4_TP0        0x000cc
+#define A6XX_RBBM_CLOCK_CNTL4_TP1        0x000cd
+#define A6XX_RBBM_CLOCK_CNTL4_TP2        0x000ce
+#define A6XX_RBBM_CLOCK_CNTL4_TP3        0x000cf
+#define A6XX_RBBM_CLOCK_DELAY_TP0        0x000d0
+#define A6XX_RBBM_CLOCK_DELAY_TP1        0x000d1
+#define A6XX_RBBM_CLOCK_DELAY_TP2        0x000d2
+#define A6XX_RBBM_CLOCK_DELAY_TP3        0x000d3
+#define A6XX_RBBM_CLOCK_DELAY2_TP0       0x000d4
+#define A6XX_RBBM_CLOCK_DELAY2_TP1       0x000d5
+#define A6XX_RBBM_CLOCK_DELAY2_TP2       0x000d6
+#define A6XX_RBBM_CLOCK_DELAY2_TP3       0x000d7
+#define A6XX_RBBM_CLOCK_DELAY3_TP0       0x000d8
+#define A6XX_RBBM_CLOCK_DELAY3_TP1       0x000d9
+#define A6XX_RBBM_CLOCK_DELAY3_TP2       0x000da
+#define A6XX_RBBM_CLOCK_DELAY3_TP3       0x000db
+#define A6XX_RBBM_CLOCK_DELAY4_TP0       0x000dc
+#define A6XX_RBBM_CLOCK_DELAY4_TP1       0x000dd
+#define A6XX_RBBM_CLOCK_DELAY4_TP2       0x000de
+#define A6XX_RBBM_CLOCK_DELAY4_TP3       0x000df
+#define A6XX_RBBM_CLOCK_HYST_TP0         0x000e0
+#define A6XX_RBBM_CLOCK_HYST_TP1         0x000e1
+#define A6XX_RBBM_CLOCK_HYST_TP2         0x000e2
+#define A6XX_RBBM_CLOCK_HYST_TP3         0x000e3
+#define A6XX_RBBM_CLOCK_HYST2_TP0        0x000e4
+#define A6XX_RBBM_CLOCK_HYST2_TP1        0x000e5
+#define A6XX_RBBM_CLOCK_HYST2_TP2        0x000e6
+#define A6XX_RBBM_CLOCK_HYST2_TP3        0x000e7
+#define A6XX_RBBM_CLOCK_HYST3_TP0        0x000e8
+#define A6XX_RBBM_CLOCK_HYST3_TP1        0x000e9
+#define A6XX_RBBM_CLOCK_HYST3_TP2        0x000ea
+#define A6XX_RBBM_CLOCK_HYST3_TP3        0x000eb
+#define A6XX_RBBM_CLOCK_HYST4_TP0        0x000ec
+#define A6XX_RBBM_CLOCK_HYST4_TP1        0x000ed
+#define A6XX_RBBM_CLOCK_HYST4_TP2        0x000ee
+#define A6XX_RBBM_CLOCK_HYST4_TP3        0x000ef
+#define A6XX_RBBM_CLOCK_CNTL_RB0         0x000f0
+#define A6XX_RBBM_CLOCK_CNTL_RB1         0x000f1
+#define A6XX_RBBM_CLOCK_CNTL_RB2         0x000f2
+#define A6XX_RBBM_CLOCK_CNTL_RB3         0x000f3
+#define A6XX_RBBM_CLOCK_CNTL2_RB0        0x000f4
+#define A6XX_RBBM_CLOCK_CNTL2_RB1        0x000f5
+#define A6XX_RBBM_CLOCK_CNTL2_RB2        0x000f6
+#define A6XX_RBBM_CLOCK_CNTL2_RB3        0x000f7
+#define A6XX_RBBM_CLOCK_CNTL_CCU0        0x000f8
+#define A6XX_RBBM_CLOCK_CNTL_CCU1        0x000f9
+#define A6XX_RBBM_CLOCK_CNTL_CCU2        0x000fa
+#define A6XX_RBBM_CLOCK_CNTL_CCU3        0x000fb
+#define A6XX_RBBM_CLOCK_HYST_RB_CCU0     0x00100
+#define A6XX_RBBM_CLOCK_HYST_RB_CCU1     0x00101
+#define A6XX_RBBM_CLOCK_HYST_RB_CCU2     0x00102
+#define A6XX_RBBM_CLOCK_HYST_RB_CCU3     0x00103
+#define A6XX_RBBM_CLOCK_CNTL_RAC         0x00104
+#define A6XX_RBBM_CLOCK_CNTL2_RAC        0x00105
+#define A6XX_RBBM_CLOCK_DELAY_RAC        0x00106
+#define A6XX_RBBM_CLOCK_HYST_RAC         0x00107
+#define A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM 0x00108
+#define A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM 0x00109
+#define A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM 0x0010a
+#define A6XX_RBBM_CLOCK_CNTL_UCHE        0x0010b
+#define A6XX_RBBM_CLOCK_CNTL2_UCHE       0x0010c
+#define A6XX_RBBM_CLOCK_CNTL3_UCHE       0x0010d
+#define A6XX_RBBM_CLOCK_CNTL4_UCHE       0x0010e
+#define A6XX_RBBM_CLOCK_DELAY_UCHE       0x0010f
+#define A6XX_RBBM_CLOCK_HYST_UCHE        0x00110
+#define A6XX_RBBM_CLOCK_MODE_VFD         0x00111
+#define A6XX_RBBM_CLOCK_DELAY_VFD        0x00112
+#define A6XX_RBBM_CLOCK_HYST_VFD         0x00113
+#define A6XX_RBBM_CLOCK_MODE_GPC         0x00114
+#define A6XX_RBBM_CLOCK_DELAY_GPC        0x00115
+#define A6XX_RBBM_CLOCK_HYST_GPC         0x00116
+#define A6XX_RBBM_CLOCK_DELAY_HLSQ_2	 0x00117
+#define A6XX_RBBM_CLOCK_CNTL_GMU_GX      0x00118
+#define A6XX_RBBM_CLOCK_DELAY_GMU_GX     0x00119
+#define A6XX_RBBM_CLOCK_CNTL_TEX_FCHE    0x00120
+#define A6XX_RBBM_CLOCK_DELAY_TEX_FCHE   0x00121
+#define A6XX_RBBM_CLOCK_HYST_TEX_FCHE    0x00122
+#define A6XX_RBBM_CLOCK_HYST_GMU_GX      0x0011a
+#define A6XX_RBBM_CLOCK_MODE_HLSQ	 0x0011b
+#define A6XX_RBBM_CLOCK_DELAY_HLSQ       0x0011c
+#define A6XX_RBBM_CLOCK_HYST_HLSQ        0x0011d
+#define A6XX_RBBM_CLOCK_CNTL_FCHE        0x00123
+#define A6XX_RBBM_CLOCK_DELAY_FCHE       0x00124
+#define A6XX_RBBM_CLOCK_HYST_FCHE        0x00125
+#define A6XX_RBBM_CLOCK_CNTL_MHUB        0x00126
+#define A6XX_RBBM_CLOCK_DELAY_MHUB       0x00127
+#define A6XX_RBBM_CLOCK_HYST_MHUB        0x00128
+#define A6XX_RBBM_CLOCK_DELAY_GLC        0x00129
+#define A6XX_RBBM_CLOCK_HYST_GLC         0x0012a
+#define A6XX_RBBM_CLOCK_CNTL_GLC         0x0012b
+
+#define A6XX_GMUAO_GMU_CGC_MODE_CNTL     0x23b09
+#define A6XX_GMUAO_GMU_CGC_DELAY_CNTL    0x23b0a
+#define A6XX_GMUAO_GMU_CGC_HYST_CNTL     0x23b0b
+#define A6XX_GMUCX_GMU_WFI_CONFIG        0x1f802
+#define A6XX_GMUGX_GMU_SP_RF_CONTROL_0   0x1a883
+#define A6XX_GMUGX_GMU_SP_RF_CONTROL_1   0x1a884
+
+/* DBGC_CFG registers */
+#define A6XX_DBGC_CFG_DBGBUS_SEL_A                  0x600
+#define A6XX_DBGC_CFG_DBGBUS_SEL_B                  0x601
+#define A6XX_DBGC_CFG_DBGBUS_SEL_C                  0x602
+#define A6XX_DBGC_CFG_DBGBUS_SEL_D                  0x603
+#define A6XX_DBGC_CFG_DBGBUS_SEL_PING_INDEX_SHIFT   0x0
+#define A6XX_DBGC_CFG_DBGBUS_SEL_PING_BLK_SEL_SHIFT 0x8
+#define A6XX_DBGC_CFG_DBGBUS_CNTLT                  0x604
+#define A6XX_DBGC_CFG_DBGBUS_CNTLT_TRACEEN_SHIFT    0x0
+#define A6XX_DBGC_CFG_DBGBUS_CNTLT_GRANU_SHIFT      0xC
+#define A6XX_DBGC_CFG_DBGBUS_CNTLT_SEGT_SHIFT       0x1C
+#define A6XX_DBGC_CFG_DBGBUS_CNTLM                  0x605
+#define A6XX_DBGC_CFG_DBGBUS_CTLTM_ENABLE_SHIFT     0x18
+#define A6XX_DBGC_CFG_DBGBUS_OPL                    0x606
+#define A6XX_DBGC_CFG_DBGBUS_OPE                    0x607
+#define A6XX_DBGC_CFG_DBGBUS_IVTL_0                 0x608
+#define A6XX_DBGC_CFG_DBGBUS_IVTL_1                 0x609
+#define A6XX_DBGC_CFG_DBGBUS_IVTL_2                 0x60a
+#define A6XX_DBGC_CFG_DBGBUS_IVTL_3                 0x60b
+#define A6XX_DBGC_CFG_DBGBUS_MASKL_0                0x60c
+#define A6XX_DBGC_CFG_DBGBUS_MASKL_1                0x60d
+#define A6XX_DBGC_CFG_DBGBUS_MASKL_2                0x60e
+#define A6XX_DBGC_CFG_DBGBUS_MASKL_3                0x60f
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL_0                0x610
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL_1                0x611
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL0_SHIFT           0x0
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL1_SHIFT           0x4
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL2_SHIFT           0x8
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL3_SHIFT           0xC
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL4_SHIFT           0x10
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL5_SHIFT           0x14
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL6_SHIFT           0x18
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL7_SHIFT           0x1C
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL8_SHIFT           0x0
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL9_SHIFT           0x4
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL10_SHIFT          0x8
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL11_SHIFT          0xC
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL12_SHIFT          0x10
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL13_SHIFT          0x14
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL14_SHIFT          0x18
+#define A6XX_DBGC_CFG_DBGBUS_BYTEL15_SHIFT          0x1C
+#define A6XX_DBGC_CFG_DBGBUS_IVTE_0                 0x612
+#define A6XX_DBGC_CFG_DBGBUS_IVTE_1                 0x613
+#define A6XX_DBGC_CFG_DBGBUS_IVTE_2                 0x614
+#define A6XX_DBGC_CFG_DBGBUS_IVTE_3                 0x615
+#define A6XX_DBGC_CFG_DBGBUS_MASKE_0                0x616
+#define A6XX_DBGC_CFG_DBGBUS_MASKE_1                0x617
+#define A6XX_DBGC_CFG_DBGBUS_MASKE_2                0x618
+#define A6XX_DBGC_CFG_DBGBUS_MASKE_3                0x619
+#define A6XX_DBGC_CFG_DBGBUS_NIBBLEE                0x61a
+#define A6XX_DBGC_CFG_DBGBUS_PTRC0                  0x61b
+#define A6XX_DBGC_CFG_DBGBUS_PTRC1                  0x61c
+#define A6XX_DBGC_CFG_DBGBUS_LOADREG                0x61d
+#define A6XX_DBGC_CFG_DBGBUS_IDX                    0x61e
+#define A6XX_DBGC_CFG_DBGBUS_CLRC                   0x61f
+#define A6XX_DBGC_CFG_DBGBUS_LOADIVT                0x620
+#define A6XX_DBGC_VBIF_DBG_CNTL                     0x621
+#define A6XX_DBGC_DBG_LO_HI_GPIO                    0x622
+#define A6XX_DBGC_EXT_TRACE_BUS_CNTL                0x623
+#define A6XX_DBGC_READ_AHB_THROUGH_DBG              0x624
+#define A6XX_DBGC_CFG_DBGBUS_TRACE_BUF1             0x62f
+#define A6XX_DBGC_CFG_DBGBUS_TRACE_BUF2             0x630
+#define A6XX_DBGC_EVT_CFG                           0x640
+#define A6XX_DBGC_EVT_INTF_SEL_0                    0x641
+#define A6XX_DBGC_EVT_INTF_SEL_1                    0x642
+#define A6XX_DBGC_PERF_ATB_CFG                      0x643
+#define A6XX_DBGC_PERF_ATB_COUNTER_SEL_0            0x644
+#define A6XX_DBGC_PERF_ATB_COUNTER_SEL_1            0x645
+#define A6XX_DBGC_PERF_ATB_COUNTER_SEL_2            0x646
+#define A6XX_DBGC_PERF_ATB_COUNTER_SEL_3            0x647
+#define A6XX_DBGC_PERF_ATB_TRIG_INTF_SEL_0          0x648
+#define A6XX_DBGC_PERF_ATB_TRIG_INTF_SEL_1          0x649
+#define A6XX_DBGC_PERF_ATB_DRAIN_CMD                0x64a
+#define A6XX_DBGC_ECO_CNTL                          0x650
+#define A6XX_DBGC_AHB_DBG_CNTL                      0x651
+
+/* VSC registers */
+#define A6XX_VSC_PERFCTR_VSC_SEL_0          0xCD8
+#define A6XX_VSC_PERFCTR_VSC_SEL_1          0xCD9
+
+/* GRAS registers */
+#define A6XX_GRAS_ADDR_MODE_CNTL            0x8601
+#define A6XX_GRAS_PERFCTR_TSE_SEL_0         0x8610
+#define A6XX_GRAS_PERFCTR_TSE_SEL_1         0x8611
+#define A6XX_GRAS_PERFCTR_TSE_SEL_2         0x8612
+#define A6XX_GRAS_PERFCTR_TSE_SEL_3         0x8613
+#define A6XX_GRAS_PERFCTR_RAS_SEL_0         0x8614
+#define A6XX_GRAS_PERFCTR_RAS_SEL_1         0x8615
+#define A6XX_GRAS_PERFCTR_RAS_SEL_2         0x8616
+#define A6XX_GRAS_PERFCTR_RAS_SEL_3         0x8617
+#define A6XX_GRAS_PERFCTR_LRZ_SEL_0         0x8618
+#define A6XX_GRAS_PERFCTR_LRZ_SEL_1         0x8619
+#define A6XX_GRAS_PERFCTR_LRZ_SEL_2         0x861A
+#define A6XX_GRAS_PERFCTR_LRZ_SEL_3         0x861B
+
+/* RB registers */
+#define A6XX_RB_ADDR_MODE_CNTL              0x8E05
+#define A6XX_RB_NC_MODE_CNTL                0x8E08
+#define A6XX_RB_PERFCTR_RB_SEL_0            0x8E10
+#define A6XX_RB_PERFCTR_RB_SEL_1            0x8E11
+#define A6XX_RB_PERFCTR_RB_SEL_2            0x8E12
+#define A6XX_RB_PERFCTR_RB_SEL_3            0x8E13
+#define A6XX_RB_PERFCTR_RB_SEL_4            0x8E14
+#define A6XX_RB_PERFCTR_RB_SEL_5            0x8E15
+#define A6XX_RB_PERFCTR_RB_SEL_6            0x8E16
+#define A6XX_RB_PERFCTR_RB_SEL_7            0x8E17
+#define A6XX_RB_PERFCTR_CCU_SEL_0           0x8E18
+#define A6XX_RB_PERFCTR_CCU_SEL_1           0x8E19
+#define A6XX_RB_PERFCTR_CCU_SEL_2           0x8E1A
+#define A6XX_RB_PERFCTR_CCU_SEL_3           0x8E1B
+#define A6XX_RB_PERFCTR_CCU_SEL_4           0x8E1C
+#define A6XX_RB_PERFCTR_CMP_SEL_0           0x8E2C
+#define A6XX_RB_PERFCTR_CMP_SEL_1           0x8E2D
+#define A6XX_RB_PERFCTR_CMP_SEL_2           0x8E2E
+#define A6XX_RB_PERFCTR_CMP_SEL_3           0x8E2F
+#define A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_HOST  0x8E3B
+#define A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_CD    0x8E3D
+#define A6XX_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE 0x8E50
+
+/* PC registers */
+#define A6XX_PC_DBG_ECO_CNTL                0x9E00
+#define A6XX_PC_ADDR_MODE_CNTL              0x9E01
+#define A6XX_PC_PERFCTR_PC_SEL_0            0x9E34
+#define A6XX_PC_PERFCTR_PC_SEL_1            0x9E35
+#define A6XX_PC_PERFCTR_PC_SEL_2            0x9E36
+#define A6XX_PC_PERFCTR_PC_SEL_3            0x9E37
+#define A6XX_PC_PERFCTR_PC_SEL_4            0x9E38
+#define A6XX_PC_PERFCTR_PC_SEL_5            0x9E39
+#define A6XX_PC_PERFCTR_PC_SEL_6            0x9E3A
+#define A6XX_PC_PERFCTR_PC_SEL_7            0x9E3B
+
+/* HLSQ registers */
+#define A6XX_HLSQ_ADDR_MODE_CNTL            0xBE05
+#define A6XX_HLSQ_PERFCTR_HLSQ_SEL_0        0xBE10
+#define A6XX_HLSQ_PERFCTR_HLSQ_SEL_1        0xBE11
+#define A6XX_HLSQ_PERFCTR_HLSQ_SEL_2        0xBE12
+#define A6XX_HLSQ_PERFCTR_HLSQ_SEL_3        0xBE13
+#define A6XX_HLSQ_PERFCTR_HLSQ_SEL_4        0xBE14
+#define A6XX_HLSQ_PERFCTR_HLSQ_SEL_5        0xBE15
+#define A6XX_HLSQ_DBG_AHB_READ_APERTURE     0xC800
+#define A6XX_HLSQ_DBG_READ_SEL              0xD000
+
+/* VFD registers */
+#define A6XX_VFD_ADDR_MODE_CNTL             0xA601
+#define A6XX_VFD_PERFCTR_VFD_SEL_0          0xA610
+#define A6XX_VFD_PERFCTR_VFD_SEL_1          0xA611
+#define A6XX_VFD_PERFCTR_VFD_SEL_2          0xA612
+#define A6XX_VFD_PERFCTR_VFD_SEL_3          0xA613
+#define A6XX_VFD_PERFCTR_VFD_SEL_4          0xA614
+#define A6XX_VFD_PERFCTR_VFD_SEL_5          0xA615
+#define A6XX_VFD_PERFCTR_VFD_SEL_6          0xA616
+#define A6XX_VFD_PERFCTR_VFD_SEL_7          0xA617
+
+/* VPC registers */
+#define A6XX_VPC_ADDR_MODE_CNTL             0x9601
+#define A6XX_VPC_PERFCTR_VPC_SEL_0          0x9604
+#define A6XX_VPC_PERFCTR_VPC_SEL_1          0x9605
+#define A6XX_VPC_PERFCTR_VPC_SEL_2          0x9606
+#define A6XX_VPC_PERFCTR_VPC_SEL_3          0x9607
+#define A6XX_VPC_PERFCTR_VPC_SEL_4          0x9608
+#define A6XX_VPC_PERFCTR_VPC_SEL_5          0x9609
+
+/* UCHE registers */
+#define A6XX_UCHE_ADDR_MODE_CNTL            0xE00
+#define A6XX_UCHE_MODE_CNTL                 0xE01
+#define A6XX_UCHE_WRITE_RANGE_MAX_LO        0xE05
+#define A6XX_UCHE_WRITE_RANGE_MAX_HI        0xE06
+#define A6XX_UCHE_WRITE_THRU_BASE_LO        0xE07
+#define A6XX_UCHE_WRITE_THRU_BASE_HI        0xE08
+#define A6XX_UCHE_TRAP_BASE_LO              0xE09
+#define A6XX_UCHE_TRAP_BASE_HI              0xE0A
+#define A6XX_UCHE_GMEM_RANGE_MIN_LO         0xE0B
+#define A6XX_UCHE_GMEM_RANGE_MIN_HI         0xE0C
+#define A6XX_UCHE_GMEM_RANGE_MAX_LO         0xE0D
+#define A6XX_UCHE_GMEM_RANGE_MAX_HI         0xE0E
+#define A6XX_UCHE_CACHE_WAYS                0xE17
+#define A6XX_UCHE_FILTER_CNTL               0xE18
+#define A6XX_UCHE_CLIENT_PF                 0xE19
+#define A6XX_UCHE_CLIENT_PF_CLIENT_ID_MASK  0x7
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_0        0xE1C
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_1        0xE1D
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_2        0xE1E
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_3        0xE1F
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_4        0xE20
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_5        0xE21
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_6        0xE22
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_7        0xE23
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_8        0xE24
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_9        0xE25
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_10       0xE26
+#define A6XX_UCHE_PERFCTR_UCHE_SEL_11       0xE27
+#define A6XX_UCHE_GBIF_GX_CONFIG            0xE3A
+#define A6XX_UCHE_CMDQ_CONFIG               0xE3C
+
+/* SP registers */
+#define A6XX_SP_DBG_ECO_CNTL                0xAE00
+#define A6XX_SP_ADDR_MODE_CNTL              0xAE01
+#define A6XX_SP_NC_MODE_CNTL                0xAE02
+#define A6XX_SP_PERFCTR_SP_SEL_0            0xAE10
+#define A6XX_SP_PERFCTR_SP_SEL_1            0xAE11
+#define A6XX_SP_PERFCTR_SP_SEL_2            0xAE12
+#define A6XX_SP_PERFCTR_SP_SEL_3            0xAE13
+#define A6XX_SP_PERFCTR_SP_SEL_4            0xAE14
+#define A6XX_SP_PERFCTR_SP_SEL_5            0xAE15
+#define A6XX_SP_PERFCTR_SP_SEL_6            0xAE16
+#define A6XX_SP_PERFCTR_SP_SEL_7            0xAE17
+#define A6XX_SP_PERFCTR_SP_SEL_8            0xAE18
+#define A6XX_SP_PERFCTR_SP_SEL_9            0xAE19
+#define A6XX_SP_PERFCTR_SP_SEL_10           0xAE1A
+#define A6XX_SP_PERFCTR_SP_SEL_11           0xAE1B
+#define A6XX_SP_PERFCTR_SP_SEL_12           0xAE1C
+#define A6XX_SP_PERFCTR_SP_SEL_13           0xAE1D
+#define A6XX_SP_PERFCTR_SP_SEL_14           0xAE1E
+#define A6XX_SP_PERFCTR_SP_SEL_15           0xAE1F
+#define A6XX_SP_PERFCTR_SP_SEL_16           0xAE20
+#define A6XX_SP_PERFCTR_SP_SEL_17           0xAE21
+#define A6XX_SP_PERFCTR_SP_SEL_18           0xAE22
+#define A6XX_SP_PERFCTR_SP_SEL_19           0xAE23
+#define A6XX_SP_PERFCTR_SP_SEL_20           0xAE24
+#define A6XX_SP_PERFCTR_SP_SEL_21           0xAE25
+#define A6XX_SP_PERFCTR_SP_SEL_22           0xAE26
+#define A6XX_SP_PERFCTR_SP_SEL_23           0xAE27
+
+/* TP registers */
+#define A6XX_TPL1_ADDR_MODE_CNTL            0xB601
+#define A6XX_TPL1_NC_MODE_CNTL              0xB604
+#define A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_0   0xB608
+#define A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_1   0xB609
+#define A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_2   0xB60A
+#define A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_3   0xB60B
+#define A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_4   0xB60C
+#define A6XX_TPL1_PERFCTR_TP_SEL_0          0xB610
+#define A6XX_TPL1_PERFCTR_TP_SEL_1          0xB611
+#define A6XX_TPL1_PERFCTR_TP_SEL_2          0xB612
+#define A6XX_TPL1_PERFCTR_TP_SEL_3          0xB613
+#define A6XX_TPL1_PERFCTR_TP_SEL_4          0xB614
+#define A6XX_TPL1_PERFCTR_TP_SEL_5          0xB615
+#define A6XX_TPL1_PERFCTR_TP_SEL_6          0xB616
+#define A6XX_TPL1_PERFCTR_TP_SEL_7          0xB617
+#define A6XX_TPL1_PERFCTR_TP_SEL_8          0xB618
+#define A6XX_TPL1_PERFCTR_TP_SEL_9          0xB619
+#define A6XX_TPL1_PERFCTR_TP_SEL_10         0xB61A
+#define A6XX_TPL1_PERFCTR_TP_SEL_11         0xB61B
+
+/* VBIF registers */
+#define A6XX_VBIF_VERSION                       0x3000
+#define A6XX_VBIF_CLKON                         0x3001
+#define A6XX_VBIF_CLKON_FORCE_ON_TESTBUS_MASK   0x1
+#define A6XX_VBIF_CLKON_FORCE_ON_TESTBUS_SHIFT  0x1
+#define A6XX_VBIF_GATE_OFF_WRREQ_EN             0x302A
+#define A6XX_VBIF_XIN_HALT_CTRL0                0x3080
+#define A6XX_VBIF_XIN_HALT_CTRL0_MASK           0xF
+#define A6XX_VBIF_XIN_HALT_CTRL1                0x3081
+#define A6XX_VBIF_TEST_BUS_OUT_CTRL             0x3084
+#define A6XX_VBIF_TEST_BUS_OUT_CTRL_EN_MASK     0x1
+#define A6XX_VBIF_TEST_BUS_OUT_CTRL_EN_SHIFT    0x0
+#define A6XX_VBIF_TEST_BUS1_CTRL0               0x3085
+#define A6XX_VBIF_TEST_BUS1_CTRL1               0x3086
+#define A6XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_MASK 0xF
+#define A6XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_SHIFT 0x0
+#define A6XX_VBIF_TEST_BUS2_CTRL0               0x3087
+#define A6XX_VBIF_TEST_BUS2_CTRL1               0x3088
+#define A6XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_MASK 0x1FF
+#define A6XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_SHIFT 0x0
+#define A6XX_VBIF_TEST_BUS_OUT                  0x308C
+#define A6XX_VBIF_PERF_CNT_SEL0                 0x30d0
+#define A6XX_VBIF_PERF_CNT_SEL1                 0x30d1
+#define A6XX_VBIF_PERF_CNT_SEL2                 0x30d2
+#define A6XX_VBIF_PERF_CNT_SEL3                 0x30d3
+#define A6XX_VBIF_PERF_CNT_LOW0                 0x30d8
+#define A6XX_VBIF_PERF_CNT_LOW1                 0x30d9
+#define A6XX_VBIF_PERF_CNT_LOW2                 0x30da
+#define A6XX_VBIF_PERF_CNT_LOW3                 0x30db
+#define A6XX_VBIF_PERF_CNT_HIGH0                0x30e0
+#define A6XX_VBIF_PERF_CNT_HIGH1                0x30e1
+#define A6XX_VBIF_PERF_CNT_HIGH2                0x30e2
+#define A6XX_VBIF_PERF_CNT_HIGH3                0x30e3
+#define A6XX_VBIF_PERF_PWR_CNT_EN0              0x3100
+#define A6XX_VBIF_PERF_PWR_CNT_EN1              0x3101
+#define A6XX_VBIF_PERF_PWR_CNT_EN2              0x3102
+#define A6XX_VBIF_PERF_PWR_CNT_LOW0             0x3110
+#define A6XX_VBIF_PERF_PWR_CNT_LOW1             0x3111
+#define A6XX_VBIF_PERF_PWR_CNT_LOW2             0x3112
+#define A6XX_VBIF_PERF_PWR_CNT_HIGH0            0x3118
+#define A6XX_VBIF_PERF_PWR_CNT_HIGH1            0x3119
+#define A6XX_VBIF_PERF_PWR_CNT_HIGH2            0x311a
+
+/* GBIF countables */
+#define GBIF_AXI0_READ_DATA_TOTAL_BEATS    34
+#define GBIF_AXI1_READ_DATA_TOTAL_BEATS    35
+#define GBIF_AXI0_WRITE_DATA_TOTAL_BEATS   46
+#define GBIF_AXI1_WRITE_DATA_TOTAL_BEATS   47
+
+/* GBIF registers */
+#define A6XX_GBIF_CX_CONFIG               0x3c00
+#define A6XX_GBIF_SCACHE_CNTL0            0x3c01
+#define A6XX_GBIF_SCACHE_CNTL1            0x3c02
+#define A6XX_GBIF_QSB_SIDE0               0x3c03
+#define A6XX_GBIF_QSB_SIDE1               0x3c04
+#define A6XX_GBIF_QSB_SIDE2               0x3c05
+#define A6XX_GBIF_QSB_SIDE3               0x3c06
+#define A6XX_GBIF_HALT                    0x3c45
+#define A6XX_GBIF_HALT_ACK                0x3c46
+
+#define A6XX_GBIF_CLIENT_HALT_MASK        BIT(0)
+#define A6XX_GBIF_ARB_HALT_MASK           BIT(1)
+#define A6XX_GBIF_GX_HALT_MASK            BIT(0)
+
+#define A6XX_GBIF_PERF_PWR_CNT_EN         0x3cc0
+#define A6XX_GBIF_PERF_CNT_SEL            0x3cc2
+#define A6XX_GBIF_PERF_PWR_CNT_SEL        0x3cc3
+#define A6XX_GBIF_PERF_CNT_LOW0           0x3cc4
+#define A6XX_GBIF_PERF_CNT_LOW1           0x3cc5
+#define A6XX_GBIF_PERF_CNT_LOW2           0x3cc6
+#define A6XX_GBIF_PERF_CNT_LOW3           0x3cc7
+#define A6XX_GBIF_PERF_CNT_HIGH0          0x3cc8
+#define A6XX_GBIF_PERF_CNT_HIGH1          0x3cc9
+#define A6XX_GBIF_PERF_CNT_HIGH2          0x3cca
+#define A6XX_GBIF_PERF_CNT_HIGH3          0x3ccb
+#define A6XX_GBIF_PWR_CNT_LOW0            0x3ccc
+#define A6XX_GBIF_PWR_CNT_LOW1            0x3ccd
+#define A6XX_GBIF_PWR_CNT_LOW2            0x3cce
+#define A6XX_GBIF_PWR_CNT_HIGH0           0x3ccf
+#define A6XX_GBIF_PWR_CNT_HIGH1           0x3cd0
+#define A6XX_GBIF_PWR_CNT_HIGH2           0x3cd1
+
+
+/* CX_DBGC_CFG registers */
+#define A6XX_CX_DBGC_CFG_DBGBUS_SEL_A                   0x18400
+#define A6XX_CX_DBGC_CFG_DBGBUS_SEL_B                   0x18401
+#define A6XX_CX_DBGC_CFG_DBGBUS_SEL_C                   0x18402
+#define A6XX_CX_DBGC_CFG_DBGBUS_SEL_D                   0x18403
+#define A6XX_CX_DBGC_CFG_DBGBUS_SEL_PING_INDEX_SHIFT    0x0
+#define A6XX_CX_DBGC_CFG_DBGBUS_SEL_PING_BLK_SEL_SHIFT  0x8
+#define A6XX_CX_DBGC_CFG_DBGBUS_CNTLT                   0x18404
+#define A6XX_CX_DBGC_CFG_DBGBUS_CNTLT_TRACEEN_SHIFT     0x0
+#define A6XX_CX_DBGC_CFG_DBGBUS_CNTLT_GRANU_SHIFT       0xC
+#define A6XX_CX_DBGC_CFG_DBGBUS_CNTLT_SEGT_SHIFT        0x1C
+#define A6XX_CX_DBGC_CFG_DBGBUS_CNTLM                   0x18405
+#define A6XX_CX_DBGC_CFG_DBGBUS_CNTLM_ENABLE_SHIFT      0x18
+#define A6XX_CX_DBGC_CFG_DBGBUS_OPL                     0x18406
+#define A6XX_CX_DBGC_CFG_DBGBUS_OPE                     0x18407
+#define A6XX_CX_DBGC_CFG_DBGBUS_IVTL_0                  0x18408
+#define A6XX_CX_DBGC_CFG_DBGBUS_IVTL_1                  0x18409
+#define A6XX_CX_DBGC_CFG_DBGBUS_IVTL_2                  0x1840A
+#define A6XX_CX_DBGC_CFG_DBGBUS_IVTL_3                  0x1840B
+#define A6XX_CX_DBGC_CFG_DBGBUS_MASKL_0                 0x1840C
+#define A6XX_CX_DBGC_CFG_DBGBUS_MASKL_1                 0x1840D
+#define A6XX_CX_DBGC_CFG_DBGBUS_MASKL_2                 0x1840E
+#define A6XX_CX_DBGC_CFG_DBGBUS_MASKL_3                 0x1840F
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_0                 0x18410
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_1                 0x18411
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL0_SHIFT            0x0
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL1_SHIFT            0x4
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL2_SHIFT            0x8
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL3_SHIFT            0xC
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL4_SHIFT            0x10
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL5_SHIFT            0x14
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL6_SHIFT            0x18
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL7_SHIFT            0x1C
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL8_SHIFT            0x0
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL9_SHIFT            0x4
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL10_SHIFT           0x8
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL11_SHIFT           0xC
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL12_SHIFT           0x10
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL13_SHIFT           0x14
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL14_SHIFT           0x18
+#define A6XX_CX_DBGC_CFG_DBGBUS_BYTEL15_SHIFT           0x1C
+#define A6XX_CX_DBGC_CFG_DBGBUS_IVTE_0                  0x18412
+#define A6XX_CX_DBGC_CFG_DBGBUS_IVTE_1                  0x18413
+#define A6XX_CX_DBGC_CFG_DBGBUS_IVTE_2                  0x18414
+#define A6XX_CX_DBGC_CFG_DBGBUS_IVTE_3                  0x18415
+#define A6XX_CX_DBGC_CFG_DBGBUS_MASKE_0                 0x18416
+#define A6XX_CX_DBGC_CFG_DBGBUS_MASKE_1                 0x18417
+#define A6XX_CX_DBGC_CFG_DBGBUS_MASKE_2                 0x18418
+#define A6XX_CX_DBGC_CFG_DBGBUS_MASKE_3                 0x18419
+#define A6XX_CX_DBGC_CFG_DBGBUS_NIBBLEE                 0x1841A
+#define A6XX_CX_DBGC_CFG_DBGBUS_PTRC0                   0x1841B
+#define A6XX_CX_DBGC_CFG_DBGBUS_PTRC1                   0x1841C
+#define A6XX_CX_DBGC_CFG_DBGBUS_LOADREG                 0x1841D
+#define A6XX_CX_DBGC_CFG_DBGBUS_IDX                     0x1841E
+#define A6XX_CX_DBGC_CFG_DBGBUS_CLRC                    0x1841F
+#define A6XX_CX_DBGC_CFG_DBGBUS_LOADIVT                 0x18420
+#define A6XX_CX_DBGC_VBIF_DBG_CNTL                      0x18421
+#define A6XX_CX_DBGC_DBG_LO_HI_GPIO                     0x18422
+#define A6XX_CX_DBGC_EXT_TRACE_BUS_CNTL                 0x18423
+#define A6XX_CX_DBGC_READ_AHB_THROUGH_DBG               0x18424
+#define A6XX_CX_DBGC_CFG_DBGBUS_TRACE_BUF1              0x1842F
+#define A6XX_CX_DBGC_CFG_DBGBUS_TRACE_BUF2              0x18430
+#define A6XX_CX_DBGC_EVT_CFG                            0x18440
+#define A6XX_CX_DBGC_EVT_INTF_SEL_0                     0x18441
+#define A6XX_CX_DBGC_EVT_INTF_SEL_1                     0x18442
+#define A6XX_CX_DBGC_PERF_ATB_CFG                       0x18443
+#define A6XX_CX_DBGC_PERF_ATB_COUNTER_SEL_0             0x18444
+#define A6XX_CX_DBGC_PERF_ATB_COUNTER_SEL_1             0x18445
+#define A6XX_CX_DBGC_PERF_ATB_COUNTER_SEL_2             0x18446
+#define A6XX_CX_DBGC_PERF_ATB_COUNTER_SEL_3             0x18447
+#define A6XX_CX_DBGC_PERF_ATB_TRIG_INTF_SEL_0           0x18448
+#define A6XX_CX_DBGC_PERF_ATB_TRIG_INTF_SEL_1           0x18449
+#define A6XX_CX_DBGC_PERF_ATB_DRAIN_CMD                 0x1844A
+#define A6XX_CX_DBGC_ECO_CNTL                           0x18450
+#define A6XX_CX_DBGC_AHB_DBG_CNTL                       0x18451
+
+/* GMU control registers */
+#define A6XX_GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL   0x1A880
+#define A6XX_GMU_GX_SPTPRAC_POWER_CONTROL	0x1A881
+#define A6XX_GMU_CM3_ITCM_START			0x1B400
+#define A6XX_GMU_CM3_DTCM_START			0x1C400
+#define A6XX_GMU_NMI_CONTROL_STATUS		0x1CBF0
+#define A6XX_GMU_BOOT_SLUMBER_OPTION		0x1CBF8
+#define A6XX_GMU_GX_VOTE_IDX			0x1CBF9
+#define A6XX_GMU_MX_VOTE_IDX			0x1CBFA
+#define A6XX_GMU_DCVS_ACK_OPTION		0x1CBFC
+#define A6XX_GMU_DCVS_PERF_SETTING		0x1CBFD
+#define A6XX_GMU_DCVS_BW_SETTING		0x1CBFE
+#define A6XX_GMU_DCVS_RETURN			0x1CBFF
+#define A6XX_GMU_ICACHE_CONFIG			0x1F400
+#define A6XX_GMU_DCACHE_CONFIG			0x1F401
+#define A6XX_GMU_SYS_BUS_CONFIG			0x1F40F
+#define A6XX_GMU_CM3_SYSRESET			0x1F800
+#define A6XX_GMU_CM3_BOOT_CONFIG		0x1F801
+#define A6XX_GMU_CX_GMU_WFI_CONFIG		0x1F802
+#define A6XX_GMU_CX_GMU_WDOG_CTRL		0x1F813
+#define A6XX_GMU_CM3_FW_BUSY			0x1F81A
+#define A6XX_GMU_CM3_FW_INIT_RESULT		0x1F81C
+#define A6XX_GMU_CM3_CFG			0x1F82D
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_ENABLE	0x1F840
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_0	0x1F841
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_1	0x1F842
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L	0x1F844
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_H	0x1F845
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_L	0x1F846
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_H	0x1F847
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_L	0x1F848
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_H	0x1F849
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_L	0x1F84A
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_H	0x1F84B
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_L	0x1F84C
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_H	0x1F84D
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_5_L	0x1F84E
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_5_H	0x1F84F
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_GMUCLK_0_L 0x1F850
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_GMUCLK_0_H 0x1F851
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_GMUCLK_1_L 0x1F852
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_GMUCLK_1_H 0x1F853
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_2	0x1F860
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_6_L	0x1F870
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_6_H	0x1F871
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_7_L	0x1F872
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_7_H	0x1F843
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_8_L	0x1F874
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_8_H	0x1F875
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_9_L	0x1F876
+#define A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_9_H	0x1F877
+#define A6XX_GMU_CX_GMU_ALWAYS_ON_COUNTER_L	0x1F888
+#define A6XX_GMU_CX_GMU_ALWAYS_ON_COUNTER_H	0x1F889
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_ENABLE	0x1F8A0
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_SELECT_0	0x1F8A1
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_SELECT_1	0x1F8A2
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_0_L	0x1F8A4
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_0_H	0x1F8A5
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_1_L	0x1F8A6
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_1_H	0x1F8A7
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_2_L	0x1F8A8
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_2_H	0x1F8A9
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_3_L	0x1F8AA
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_3_H	0x1F8AB
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_4_L	0x1F8AC
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_4_H	0x1F8AD
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_5_L	0x1F8AE
+#define A6XX_GMU_CX_GMU_PERF_COUNTER_5_H	0x1F8AF
+#define A6XX_GMU_PWR_COL_INTER_FRAME_CTRL	0x1F8C0
+#define A6XX_GMU_PWR_COL_INTER_FRAME_HYST	0x1F8C1
+#define A6XX_GMU_PWR_COL_SPTPRAC_HYST		0x1F8C2
+#define A6XX_GMU_SPTPRAC_PWR_CLK_STATUS		0x1F8D0
+#define A6XX_GMU_GPU_NAP_CTRL			0x1F8E4
+#define A6XX_GMU_RPMH_CTRL			0x1F8E8
+#define A6XX_GMU_RPMH_HYST_CTRL			0x1F8E9
+#define A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE    0x1F8EC
+#define A6XX_GPU_GMU_CX_GMU_PWR_COL_CP_MSG      0x1F900
+#define A6XX_GPU_GMU_CX_GMU_PWR_COL_CP_RESP     0x1F901
+#define A6XX_GMU_BOOT_KMD_LM_HANDSHAKE		0x1F9F0
+#define A6XX_GMU_LLM_GLM_SLEEP_CTRL		0x1F957
+#define A6XX_GMU_LLM_GLM_SLEEP_STATUS		0x1F958
+
+/* HFI registers*/
+#define A6XX_GMU_ALWAYS_ON_COUNTER_L		0x1F888
+#define A6XX_GMU_ALWAYS_ON_COUNTER_H		0x1F889
+#define A6XX_GMU_GMU_PWR_COL_KEEPALIVE		0x1F8C3
+#define A6XX_GMU_PWR_COL_PREEMPT_KEEPALIVE      0x1F8C4
+#define A6XX_GMU_HFI_CTRL_STATUS		0x1F980
+#define A6XX_GMU_HFI_VERSION_INFO		0x1F981
+#define A6XX_GMU_HFI_SFR_ADDR			0x1F982
+#define A6XX_GMU_HFI_MMAP_ADDR			0x1F983
+#define A6XX_GMU_HFI_QTBL_INFO			0x1F984
+#define A6XX_GMU_HFI_QTBL_ADDR			0x1F985
+#define A6XX_GMU_HFI_CTRL_INIT			0x1F986
+#define A6XX_GMU_GMU2HOST_INTR_SET		0x1F990
+#define A6XX_GMU_GMU2HOST_INTR_CLR		0x1F991
+#define A6XX_GMU_GMU2HOST_INTR_INFO		0x1F992
+#define A6XX_GMU_GMU2HOST_INTR_MASK		0x1F993
+#define A6XX_GMU_HOST2GMU_INTR_SET		0x1F994
+#define A6XX_GMU_HOST2GMU_INTR_CLR		0x1F995
+#define A6XX_GMU_HOST2GMU_INTR_RAW_INFO		0x1F996
+#define A6XX_GMU_HOST2GMU_INTR_EN_0		0x1F997
+#define A6XX_GMU_HOST2GMU_INTR_EN_1		0x1F998
+#define A6XX_GMU_HOST2GMU_INTR_EN_2		0x1F999
+#define A6XX_GMU_HOST2GMU_INTR_EN_3		0x1F99A
+#define A6XX_GMU_HOST2GMU_INTR_INFO_0		0x1F99B
+#define A6XX_GMU_HOST2GMU_INTR_INFO_1		0x1F99C
+#define A6XX_GMU_HOST2GMU_INTR_INFO_2		0x1F99D
+#define A6XX_GMU_HOST2GMU_INTR_INFO_3		0x1F99E
+#define A6XX_GMU_GENERAL_0			0x1F9C5
+#define A6XX_GMU_GENERAL_1			0x1F9C6
+#define A6XX_GMU_GENERAL_6			0x1F9CB
+#define A6XX_GMU_GENERAL_7			0x1F9CC
+#define A6XX_GMU_GENERAL_11			0x1F9D0
+
+/* ISENSE registers */
+#define A6XX_GMU_ISENSE_CTRL			0x1F95D
+#define A6XX_GPU_GMU_CX_GMU_ISENSE_CTRL		0x1f95d
+#define A6XX_GPU_CS_ENABLE_REG			0x23120
+
+/* LM registers */
+#define A6XX_GPU_GMU_CX_GMU_PWR_THRESHOLD       0x1F94D
+
+/* FAL10 veto register */
+#define A6XX_GPU_GMU_CX_GMU_CX_FAL_INTF         0x1F8F0
+#define A6XX_GPU_GMU_CX_GMU_CX_FALNEXT_INTF     0x1F8F1
+
+#define A6XX_GMU_AO_INTERRUPT_EN		0x23B03
+#define A6XX_GMU_AO_HOST_INTERRUPT_CLR		0x23B04
+#define A6XX_GMU_AO_HOST_INTERRUPT_STATUS	0x23B05
+#define A6XX_GMU_AO_HOST_INTERRUPT_MASK		0x23B06
+#define A6XX_GPU_GMU_AO_GMU_CGC_MODE_CNTL       0x23B09
+#define A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL      0x23B0A
+#define A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL       0x23B0B
+#define A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS	0x23B0C
+#define A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS2	0x23B0D
+#define A6XX_GPU_GMU_AO_GPU_CX_BUSY_MASK	0x23B0E
+#define A6XX_GMU_AO_AHB_FENCE_CTRL		0x23B10
+#define A6XX_GMU_AHB_FENCE_STATUS		0x23B13
+#define A6XX_GMU_AHB_FENCE_STATUS_CLR           0x23B14
+#define A6XX_GMU_RBBM_INT_UNMASKED_STATUS	0x23B15
+#define A6XX_GMU_AO_SPARE_CNTL			0x23B16
+
+/* RGMU GLM registers */
+#define A6XX_GMU_AO_RGMU_GLM_SLEEP_CTRL		0x23B80
+#define A6XX_GMU_AO_RGMU_GLM_SLEEP_STATUS	0x23B81
+#define A6XX_GMU_AO_RGMU_GLM_HW_CRC_DISABLE	0x23B82
+
+/* GMU RSC control registers */
+#define A6XX_GMU_RSCC_CONTROL_REQ		0x23B07
+#define A6XX_GMU_RSCC_CONTROL_ACK		0x23B08
+
+/* FENCE control registers */
+#define A6XX_GMU_AHB_FENCE_RANGE_0		0x23B11
+#define A6XX_GMU_AHB_FENCE_RANGE_1		0x23B12
+
+/* GMU countables */
+#define A6XX_GMU_CM3_BUSY_CYCLES		0
+
+/* GPUCC registers */
+#define A6XX_GPU_CC_GX_GDSCR                   0x24403
+#define A6XX_GPU_CC_GX_DOMAIN_MISC             0x24542
+#define A6XX_GPU_CC_GX_DOMAIN_MISC3            0x24563
+#define A6XX_GPU_CC_CX_GDSCR                   0x2441B
+
+/* GPUCC offsets are different for A662 */
+#define A662_GPU_CC_GX_GDSCR                   0x26417
+#define A662_GPU_CC_GX_DOMAIN_MISC3            0x26541
+#define A662_GPU_CC_CX_GDSCR                   0x26442
+
+/* GPU CPR registers */
+#define A6XX_GPU_CPR_FSM_CTL			0x26801
+
+/* GPU RSC sequencer registers */
+#define A6XX_GPU_RSCC_RSC_STATUS0_DRV0			0x00004
+#define A6XX_RSCC_PDC_SEQ_START_ADDR			0x00008
+#define A6XX_RSCC_PDC_MATCH_VALUE_LO			0x00009
+#define A6XX_RSCC_PDC_MATCH_VALUE_HI			0x0000A
+#define A6XX_RSCC_PDC_SLAVE_ID_DRV0			0x0000B
+#define A6XX_RSCC_HIDDEN_TCS_CMD0_ADDR			0x0000D
+#define A6XX_RSCC_HIDDEN_TCS_CMD0_DATA			0x0000E
+#define A6XX_RSCC_TIMESTAMP_UNIT0_TIMESTAMP_L_DRV0	0x00082
+#define A6XX_RSCC_TIMESTAMP_UNIT0_TIMESTAMP_H_DRV0	0x00083
+#define A6XX_RSCC_TIMESTAMP_UNIT1_EN_DRV0		0x00089
+#define A6XX_RSCC_TIMESTAMP_UNIT1_OUTPUT_DRV0		0x0008C
+#define A6XX_RSCC_OVERRIDE_START_ADDR			0x00100
+#define A6XX_RSCC_SEQ_BUSY_DRV0				0x00101
+#define A6XX_RSCC_SEQ_MEM_0_DRV0			0x00180
+#define A6XX_RSCC_TCS0_DRV0_STATUS			0x00346
+#define A6XX_RSCC_TCS1_DRV0_STATUS                      0x003EE
+#define A6XX_RSCC_TCS2_DRV0_STATUS                      0x00496
+#define A6XX_RSCC_TCS3_DRV0_STATUS                      0x0053E
+#define A6XX_RSCC_TCS4_DRV0_STATUS                      0x005E6
+#define A6XX_RSCC_TCS5_DRV0_STATUS                      0x0068E
+#define A6XX_RSCC_TCS6_DRV0_STATUS                      0x00736
+#define A6XX_RSCC_TCS7_DRV0_STATUS                      0x007DE
+#define A6XX_RSCC_TCS8_DRV0_STATUS                      0x00886
+#define A6XX_RSCC_TCS9_DRV0_STATUS                      0x0092E
+
+/* GPU PDC sequencer registers in AOSS.RPMh domain */
+#define PDC_GPU_ENABLE_PDC			0x1140
+#define PDC_GPU_SEQ_START_ADDR			0x1148
+#define PDC_GPU_TCS0_CONTROL			0x1540
+#define PDC_GPU_TCS0_CMD_ENABLE_BANK		0x1541
+#define PDC_GPU_TCS0_CMD_WAIT_FOR_CMPL_BANK	0x1542
+#define PDC_GPU_TCS0_CMD0_MSGID			0x1543
+#define PDC_GPU_TCS0_CMD0_ADDR			0x1544
+#define PDC_GPU_TCS0_CMD0_DATA			0x1545
+#define PDC_GPU_TCS1_CONTROL			0x1572
+#define PDC_GPU_TCS1_CMD_ENABLE_BANK		0x1573
+#define PDC_GPU_TCS1_CMD_WAIT_FOR_CMPL_BANK	0x1574
+#define PDC_GPU_TCS1_CMD0_MSGID			0x1575
+#define PDC_GPU_TCS1_CMD0_ADDR			0x1576
+#define PDC_GPU_TCS1_CMD0_DATA			0x1577
+#define PDC_GPU_TCS2_CONTROL			0x15A4
+#define PDC_GPU_TCS2_CMD_ENABLE_BANK		0x15A5
+#define PDC_GPU_TCS2_CMD_WAIT_FOR_CMPL_BANK	0x15A6
+#define PDC_GPU_TCS2_CMD0_MSGID			0x15A7
+#define PDC_GPU_TCS2_CMD0_ADDR			0x15A8
+#define PDC_GPU_TCS2_CMD0_DATA			0x15A9
+#define PDC_GPU_TCS3_CONTROL			0x15D6
+#define PDC_GPU_TCS3_CMD_ENABLE_BANK		0x15D7
+#define PDC_GPU_TCS3_CMD_WAIT_FOR_CMPL_BANK	0x15D8
+#define PDC_GPU_TCS3_CMD0_MSGID			0x15D9
+#define PDC_GPU_TCS3_CMD0_ADDR			0x15DA
+#define PDC_GPU_TCS3_CMD0_DATA			0x15DB
+
+/*
+ * Legacy DTSI used an offset from the start of the PDC resource
+ * for PDC SEQ programming. We are now using PDC subsections so
+ * start the PDC SEQ offset at zero.
+ */
+#define PDC_GPU_SEQ_MEM_0			0x0
+
+/*
+ * Legacy RSCC register range was a part of the GMU register space
+ * now we are using a separate section for RSCC regsiters. Add the
+ * offset for backward compatibility.
+ */
+#define RSCC_OFFSET_LEGACY			0x23400
+
+/* RGMU(PCC) registers in A6X_GMU_CX_0_NON_CONTEXT_DEC domain */
+#define A6XX_RGMU_CX_INTR_GEN_EN		0x1F80F
+#define A6XX_RGMU_CX_RGMU_TIMER0		0x1F834
+#define A6XX_RGMU_CX_RGMU_TIMER1		0x1F835
+#define A6XX_RGMU_CX_PCC_CTRL			0x1F838
+#define A6XX_RGMU_CX_PCC_INIT_RESULT		0x1F839
+#define A6XX_RGMU_CX_PCC_BKPT_CFG		0x1F83A
+#define A6XX_RGMU_CX_PCC_BKPT_ADDR		0x1F83B
+#define A6XX_RGMU_CX_PCC_STATUS			0x1F83C
+#define A6XX_RGMU_CX_PCC_DEBUG			0x1F83D
+
+/* GPU CX_MISC registers */
+#define A6XX_GPU_CX_MISC_SYSTEM_CACHE_CNTL_0	0x1
+#define A6XX_GPU_CX_MISC_SYSTEM_CACHE_CNTL_1	0x2
+#define A6XX_LLC_NUM_GPU_SCIDS			5
+#define A6XX_GPU_LLC_SCID_NUM_BITS		5
+#define A6XX_GPU_LLC_SCID_MASK \
+	((1 << (A6XX_LLC_NUM_GPU_SCIDS * A6XX_GPU_LLC_SCID_NUM_BITS)) - 1)
+#define A6XX_GPUHTW_LLC_SCID_SHIFT		25
+#define A6XX_GPUHTW_LLC_SCID_MASK \
+	(((1 << A6XX_GPU_LLC_SCID_NUM_BITS) - 1) << A6XX_GPUHTW_LLC_SCID_SHIFT)
+
+/* FUSA registers */
+#define A6XX_GPU_FUSA_REG_BASE			0x3FC00
+#define A6XX_GPU_FUSA_REG_ECC_CTRL			0x3FC00
+#define A6XX_GPU_FUSA_REG_CSR_PRIY			0x3FC52
+#define A6XX_GPU_FUSA_DISABLE_NUM_BITS			4
+#define A6XX_GPU_FUSA_DISABLE_BITS			0x5
+#define A6XX_GPU_FUSA_DISABLE_MASK \
+	((1 << A6XX_GPU_FUSA_DISABLE_NUM_BITS) - 1)
+
+#endif /* _A6XX_REG_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno-gpulist.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno-gpulist.h
@@ -0,0 +1,2622 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define ANY_ID (~0)
+
+#define DEFINE_ADRENO_REV(_rev, _core, _major, _minor, _patchid) \
+	.gpurev = _rev, .core = _core, .major = _major, .minor = _minor, \
+	.patchid = _patchid
+
+#define DEFINE_DEPRECATED_CORE(_name, _rev, _core, _major, _minor, _patchid) \
+static const struct adreno_gpu_core adreno_gpu_core_##_name = { \
+	DEFINE_ADRENO_REV(_rev, _core, _major, _minor, _patchid), \
+	.features = ADRENO_DEPRECATED, \
+}
+
+static const struct kgsl_regmap_list a306_vbif_regs[] = {
+	{ A3XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x0003 },
+	{ A3XX_VBIF_OUT_RD_LIM_CONF0, 0x0000000A },
+	{ A3XX_VBIF_OUT_WR_LIM_CONF0, 0x0000000A },
+};
+
+static const struct adreno_a3xx_core adreno_gpu_core_a306 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A306, 3, 0, 6, 0),
+		.features = ADRENO_SOFT_FAULT_DETECT,
+		.gpudev = &adreno_a3xx_gpudev,
+		.perfcounters = &adreno_a3xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_128K,
+		.bus_width = 0,
+		.snapshot_size = 600 * SZ_1K,
+	},
+	.pm4fw_name = "a300_pm4.fw",
+	.pfpfw_name = "a300_pfp.fw",
+	.vbif = a306_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a306_vbif_regs),
+};
+
+static const struct kgsl_regmap_list a306a_vbif_regs[] = {
+	{ A3XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x0003 },
+	{ A3XX_VBIF_OUT_RD_LIM_CONF0, 0x00000010 },
+	{ A3XX_VBIF_OUT_WR_LIM_CONF0, 0x00000010 },
+};
+
+static const struct adreno_a3xx_core adreno_gpu_core_a306a = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A306A, 3, 0, 6, 0x20),
+		.features = ADRENO_SOFT_FAULT_DETECT,
+		.gpudev = &adreno_a3xx_gpudev,
+		.perfcounters = &adreno_a3xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_128K,
+		.bus_width = 16,
+		.snapshot_size = 600 * SZ_1K,
+	},
+	.pm4fw_name = "a300_pm4.fw",
+	.pfpfw_name = "a300_pfp.fw",
+	.vbif = a306a_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a306a_vbif_regs),
+};
+
+static const struct kgsl_regmap_list a304_vbif_regs[] = {
+	{ A3XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x0003 },
+};
+
+static const struct adreno_a3xx_core adreno_gpu_core_a304 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A304, 3, 0, 4, 0),
+		.features = ADRENO_SOFT_FAULT_DETECT,
+		.gpudev = &adreno_a3xx_gpudev,
+		.perfcounters = &adreno_a3xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = (SZ_64K + SZ_32K),
+		.bus_width = 0,
+		.snapshot_size = 600 * SZ_1K,
+	},
+	.pm4fw_name = "a300_pm4.fw",
+	.pfpfw_name = "a300_pfp.fw",
+	.vbif = a304_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a304_vbif_regs),
+};
+
+DEFINE_DEPRECATED_CORE(a405, ADRENO_REV_A405, 4, 0, 5, ANY_ID);
+DEFINE_DEPRECATED_CORE(a418, ADRENO_REV_A418, 4, 1, 8, ANY_ID);
+DEFINE_DEPRECATED_CORE(a420, ADRENO_REV_A420, 4, 2, 0, ANY_ID);
+DEFINE_DEPRECATED_CORE(a430, ADRENO_REV_A430, 4, 3, 0, ANY_ID);
+DEFINE_DEPRECATED_CORE(a530v1, ADRENO_REV_A530, 5, 3, 0, 0);
+
+static const struct kgsl_regmap_list a530_hwcg_regs[] = {
+	{A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL_SP2, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL_SP3, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A5XX_RBBM_CLOCK_CNTL2_SP1, 0x02222220},
+	{A5XX_RBBM_CLOCK_CNTL2_SP2, 0x02222220},
+	{A5XX_RBBM_CLOCK_CNTL2_SP3, 0x02222220},
+	{A5XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_HYST_SP1, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_HYST_SP2, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_HYST_SP3, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A5XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
+	{A5XX_RBBM_CLOCK_DELAY_SP2, 0x00000080},
+	{A5XX_RBBM_CLOCK_DELAY_SP3, 0x00000080},
+	{A5XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_TP1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_TP2, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_TP3, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP2, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP3, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP0, 0x00002222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP1, 0x00002222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP2, 0x00002222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP3, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST_TP2, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST_TP3, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP2, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP3, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST3_TP0, 0x00007777},
+	{A5XX_RBBM_CLOCK_HYST3_TP1, 0x00007777},
+	{A5XX_RBBM_CLOCK_HYST3_TP2, 0x00007777},
+	{A5XX_RBBM_CLOCK_HYST3_TP3, 0x00007777},
+	{A5XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY_TP2, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY_TP3, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP2, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP3, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP0, 0x00001111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP1, 0x00001111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP2, 0x00001111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP3, 0x00001111},
+	{A5XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{A5XX_RBBM_CLOCK_HYST_UCHE, 0x00444444},
+	{A5XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A5XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_RB2, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_RB3, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB0, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB1, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB2, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB3, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL_CCU0, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_CCU1, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_CCU2, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_CCU3, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_RAC, 0x05522222},
+	{A5XX_RBBM_CLOCK_CNTL2_RAC, 0x00505555},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU0, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU1, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU2, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU3, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RAC, 0x07444044},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_0, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_1, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_2, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_3, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RAC, 0x00010011},
+	{A5XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A5XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{A5XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A5XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A5XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A5XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+};
+
+/* VBIF control registers for a530, a510, a508, a505 and a506 */
+static const struct kgsl_regmap_list a530_vbif_regs[] = {
+	{A5XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x00000003},
+};
+
+static const struct adreno_a5xx_core adreno_gpu_core_a530v2 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A530, 5, 3, 0, 1),
+		.features = ADRENO_SPTP_PC | ADRENO_LM |
+			ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION,
+		.gpudev = &adreno_a5xx_gpudev,
+		.perfcounters = &adreno_a5xx_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_1M,
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.gpmu_tsens = 0x00060007,
+	.max_power = 5448,
+	.pm4fw_name = "a530_pm4.fw",
+	.pfpfw_name = "a530_pfp.fw",
+	.gpmufw_name = "a530_gpmu.fw2",
+	.regfw_name = "a530v2_seq.fw2",
+	.zap_name = "a530_zap.mdt",
+	.hwcg = a530_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a530_hwcg_regs),
+	.vbif = a530_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a530_vbif_regs),
+	.highest_bank_bit = 15,
+};
+
+static const struct adreno_a5xx_core adreno_gpu_core_a530v3 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A530, 5, 3, 0, ANY_ID),
+		.features = ADRENO_SPTP_PC | ADRENO_LM |
+			ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION,
+		.gpudev = &adreno_a5xx_gpudev,
+		.perfcounters = &adreno_a5xx_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_1M,
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.gpmu_tsens = 0x00060007,
+	.max_power = 5448,
+	.pm4fw_name = "a530_pm4.fw",
+	.pfpfw_name = "a530_pfp.fw",
+	.gpmufw_name = "a530v3_gpmu.fw2",
+	.regfw_name = "a530v3_seq.fw2",
+	.zap_name = "a530_zap.mdt",
+	.hwcg = a530_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a530_hwcg_regs),
+	.vbif = a530_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a530_vbif_regs),
+	.highest_bank_bit = 15,
+};
+
+/* For a505, a506 and a508 */
+static const struct kgsl_regmap_list a50x_hwcg_regs[] = {
+	{A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A5XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A5XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP0, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST3_TP0, 0x00007777},
+	{A5XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP0, 0x00001111},
+	{A5XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_HYST_UCHE, 0x00FFFFF4},
+	{A5XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A5XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB0, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL_CCU0, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_RAC, 0x05522222},
+	{A5XX_RBBM_CLOCK_CNTL2_RAC, 0x00505555},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU0, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RAC, 0x07444044},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_0, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RAC, 0x00010011},
+	{A5XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A5XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{A5XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A5XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A5XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A5XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222}
+};
+
+static const struct adreno_a5xx_core adreno_gpu_core_a505 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A505, 5, 0, 5, ANY_ID),
+		.features = ADRENO_PREEMPTION,
+		.gpudev = &adreno_a5xx_gpudev,
+		.perfcounters = &adreno_a5xx_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = (SZ_128K + SZ_8K),
+		.bus_width = 16,
+		.snapshot_size = SZ_1M,
+	},
+	.pm4fw_name = "a530_pm4.fw",
+	.pfpfw_name = "a530_pfp.fw",
+	.hwcg = a50x_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a50x_hwcg_regs),
+	.vbif = a530_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a530_vbif_regs),
+};
+
+static const struct adreno_a5xx_core adreno_gpu_core_a506 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A506, 5, 0, 6, ANY_ID),
+		.features = ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION | ADRENO_CPZ_RETENTION,
+		.gpudev = &adreno_a5xx_gpudev,
+		.perfcounters = &adreno_a5xx_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = (SZ_128K + SZ_8K),
+		.bus_width = 16,
+		.snapshot_size = SZ_1M,
+	},
+	.pm4fw_name = "a530_pm4.fw",
+	.pfpfw_name = "a530_pfp.fw",
+	.zap_name = "a506_zap.mdt",
+	.hwcg = a50x_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a50x_hwcg_regs),
+	.vbif = a530_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a530_vbif_regs),
+	.highest_bank_bit = 14,
+};
+
+static const struct kgsl_regmap_list a510_hwcg_regs[] = {
+	{A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A5XX_RBBM_CLOCK_CNTL2_SP1, 0x02222220},
+	{A5XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_HYST_SP1, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A5XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
+	{A5XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_TP1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP0, 0x00002222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP1, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST3_TP0, 0x00007777},
+	{A5XX_RBBM_CLOCK_HYST3_TP1, 0x00007777},
+	{A5XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP0, 0x00001111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP1, 0x00001111},
+	{A5XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{A5XX_RBBM_CLOCK_HYST_UCHE, 0x00444444},
+	{A5XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A5XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB0, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB1, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL_CCU0, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_CCU1, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_RAC, 0x05522222},
+	{A5XX_RBBM_CLOCK_CNTL2_RAC, 0x00505555},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU0, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU1, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RAC, 0x07444044},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_0, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_1, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RAC, 0x00010011},
+	{A5XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A5XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{A5XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A5XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A5XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A5XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+};
+
+static const struct adreno_a5xx_core adreno_gpu_core_a510 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A510, 5, 1, 0, ANY_ID),
+		.gpudev = &adreno_a5xx_gpudev,
+		.perfcounters = &adreno_a5xx_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_256K,
+		.bus_width = 16,
+		.snapshot_size = SZ_1M,
+	},
+	.pm4fw_name = "a530_pm4.fw",
+	.pfpfw_name = "a530_pfp.fw",
+	.hwcg = a510_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a510_hwcg_regs),
+	.vbif = a530_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a530_vbif_regs),
+};
+
+DEFINE_DEPRECATED_CORE(a540v1, ADRENO_REV_A540, 5, 4, 0, 0);
+
+static const struct kgsl_regmap_list a540_hwcg_regs[] = {
+	{A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL_SP2, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL_SP3, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A5XX_RBBM_CLOCK_CNTL2_SP1, 0x02222220},
+	{A5XX_RBBM_CLOCK_CNTL2_SP2, 0x02222220},
+	{A5XX_RBBM_CLOCK_CNTL2_SP3, 0x02222220},
+	{A5XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_HYST_SP1, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_HYST_SP2, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_HYST_SP3, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A5XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
+	{A5XX_RBBM_CLOCK_DELAY_SP2, 0x00000080},
+	{A5XX_RBBM_CLOCK_DELAY_SP3, 0x00000080},
+	{A5XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_TP1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_TP2, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_TP3, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP2, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP3, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP0, 0x00002222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP1, 0x00002222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP2, 0x00002222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP3, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST_TP2, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST_TP3, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP2, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP3, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST3_TP0, 0x00007777},
+	{A5XX_RBBM_CLOCK_HYST3_TP1, 0x00007777},
+	{A5XX_RBBM_CLOCK_HYST3_TP2, 0x00007777},
+	{A5XX_RBBM_CLOCK_HYST3_TP3, 0x00007777},
+	{A5XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY_TP2, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY_TP3, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP2, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP3, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP0, 0x00001111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP1, 0x00001111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP2, 0x00001111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP3, 0x00001111},
+	{A5XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{A5XX_RBBM_CLOCK_HYST_UCHE, 0x00444444},
+	{A5XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A5XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_RB2, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_RB3, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB0, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB1, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB2, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB3, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL_CCU0, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_CCU1, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_CCU2, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_CCU3, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_RAC, 0x05522222},
+	{A5XX_RBBM_CLOCK_CNTL2_RAC, 0x00505555},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU0, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU1, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU2, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU3, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RAC, 0x07444044},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_0, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_1, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_2, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_3, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RAC, 0x00010011},
+	{A5XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A5XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{A5XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A5XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A5XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A5XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_GPMU, 0x00000222},
+	{A5XX_RBBM_CLOCK_DELAY_GPMU, 0x00000770},
+	{A5XX_RBBM_CLOCK_HYST_GPMU, 0x00000004},
+};
+
+static const struct kgsl_regmap_list a540_vbif_regs[] = {
+	{A5XX_VBIF_ROUND_ROBIN_QOS_ARB, 0x00000003},
+	{A5XX_VBIF_GATE_OFF_WRREQ_EN, 0x00000009},
+};
+
+static const struct adreno_a5xx_core adreno_gpu_core_a540v2 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A540, 5, 4, 0, ANY_ID),
+		.features = ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION |
+			ADRENO_SPTP_PC,
+		.gpudev = &adreno_a5xx_gpudev,
+		.perfcounters = &adreno_a5xx_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_1M,
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.gpmu_tsens = 0x000c000d,
+	.max_power = 5448,
+	.pm4fw_name = "a530_pm4.fw",
+	.pfpfw_name = "a530_pfp.fw",
+	.gpmufw_name = "a540_gpmu.fw2",
+	.zap_name = "a540_zap.mdt",
+	.hwcg = a540_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a540_hwcg_regs),
+	.vbif = a540_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a540_vbif_regs),
+	.highest_bank_bit = 15,
+};
+
+static const struct kgsl_regmap_list a512_hwcg_regs[] = {
+	{A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
+	{A5XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A5XX_RBBM_CLOCK_CNTL2_SP1, 0x02222220},
+	{A5XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_HYST_SP1, 0x0000F3CF},
+	{A5XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A5XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
+	{A5XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_TP1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP0, 0x00002222},
+	{A5XX_RBBM_CLOCK_CNTL3_TP1, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{A5XX_RBBM_CLOCK_HYST3_TP0, 0x00007777},
+	{A5XX_RBBM_CLOCK_HYST3_TP1, 0x00007777},
+	{A5XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP0, 0x00001111},
+	{A5XX_RBBM_CLOCK_DELAY3_TP1, 0x00001111},
+	{A5XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{A5XX_RBBM_CLOCK_HYST_UCHE, 0x00444444},
+	{A5XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A5XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB0, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL2_RB1, 0x00222222},
+	{A5XX_RBBM_CLOCK_CNTL_CCU0, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_CCU1, 0x00022220},
+	{A5XX_RBBM_CLOCK_CNTL_RAC, 0x05522222},
+	{A5XX_RBBM_CLOCK_CNTL2_RAC, 0x00505555},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU0, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RB_CCU1, 0x04040404},
+	{A5XX_RBBM_CLOCK_HYST_RAC, 0x07444044},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_0, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RB_CCU_L1_1, 0x00000002},
+	{A5XX_RBBM_CLOCK_DELAY_RAC, 0x00010011},
+	{A5XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A5XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{A5XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A5XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A5XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A5XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A5XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A5XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+};
+
+static const struct adreno_a5xx_core adreno_gpu_core_a512 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A512, 5, 1, 2, ANY_ID),
+		.features = ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION | ADRENO_CPZ_RETENTION,
+		.gpudev = &adreno_a5xx_gpudev,
+		.perfcounters = &adreno_a5xx_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = (SZ_256K + SZ_16K),
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.pm4fw_name = "a530_pm4.fw",
+	.pfpfw_name = "a530_pfp.fw",
+	.zap_name = "a512_zap.mdt",
+	.hwcg = a512_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a512_hwcg_regs),
+	.highest_bank_bit = 14,
+};
+
+static const struct adreno_a5xx_core adreno_gpu_core_a508 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A508, 5, 0, 8, ANY_ID),
+		.features = ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION | ADRENO_CPZ_RETENTION,
+		.gpudev = &adreno_a5xx_gpudev,
+		.perfcounters = &adreno_a5xx_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = (SZ_128K + SZ_8K),
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.pm4fw_name = "a530_pm4.fw",
+	.pfpfw_name = "a530_pfp.fw",
+	.zap_name = "a508_zap.mdt",
+	.hwcg = a50x_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a50x_hwcg_regs),
+	.vbif = a530_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a530_vbif_regs),
+	.highest_bank_bit = 14,
+};
+
+DEFINE_DEPRECATED_CORE(a630v1, ADRENO_REV_A630, 6, 3, 0, 0);
+
+static const struct kgsl_regmap_list a630_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL_SP2, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL_SP3, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02022220},
+	{A6XX_RBBM_CLOCK_CNTL2_SP1, 0x02022220},
+	{A6XX_RBBM_CLOCK_CNTL2_SP2, 0x02022220},
+	{A6XX_RBBM_CLOCK_CNTL2_SP3, 0x02022220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A6XX_RBBM_CLOCK_DELAY_SP1, 0x00000080},
+	{A6XX_RBBM_CLOCK_DELAY_SP2, 0x00000080},
+	{A6XX_RBBM_CLOCK_DELAY_SP3, 0x00000080},
+	{A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_HYST_SP1, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_HYST_SP2, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_HYST_SP3, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL_TP1, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL_TP2, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL_TP3, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP2, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP3, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP1, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP2, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP3, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP1, 0x00022222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP2, 0x00022222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP3, 0x00022222},
+	{A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST_TP1, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST_TP2, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST_TP3, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP2, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP3, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP1, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP2, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP3, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{A6XX_RBBM_CLOCK_HYST4_TP1, 0x00077777},
+	{A6XX_RBBM_CLOCK_HYST4_TP2, 0x00077777},
+	{A6XX_RBBM_CLOCK_HYST4_TP3, 0x00077777},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY_TP2, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY_TP3, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP2, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP3, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP1, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP2, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP3, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP1, 0x00011111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP2, 0x00011111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP3, 0x00011111},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL_RB1, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL_RB2, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL_RB3, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x00002222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB1, 0x00002222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB2, 0x00002222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB3, 0x00002222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_CNTL_CCU1, 0x00002220},
+	{A6XX_RBBM_CLOCK_CNTL_CCU2, 0x00002220},
+	{A6XX_RBBM_CLOCK_CNTL_CCU3, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU1, 0x00040F00},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU2, 0x00040F00},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU3, 0x00040F00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x05022022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+};
+
+static const struct kgsl_regmap_list a630_vbif_regs[] = {
+	{A6XX_VBIF_GATE_OFF_WRREQ_EN, 0x00000009},
+	{A6XX_RBBM_VBIF_CLIENT_QOS_CNTL, 0x3},
+};
+
+
+/* For a615, a616, a618, A619, a630, a640 and a680 */
+static const struct adreno_protected_regs a630_protected_regs[] = {
+	{ A6XX_CP_PROTECT_REG + 0, 0x00000, 0x004ff, 0 },
+	{ A6XX_CP_PROTECT_REG + 1, 0x00501, 0x00506, 0 },
+	{ A6XX_CP_PROTECT_REG + 2, 0x0050b, 0x007ff, 0 },
+	{ A6XX_CP_PROTECT_REG + 3, 0x0050e, 0x0050e, 1 },
+	{ A6XX_CP_PROTECT_REG + 4, 0x00510, 0x00510, 1 },
+	{ A6XX_CP_PROTECT_REG + 5, 0x00534, 0x00534, 1 },
+	{ A6XX_CP_PROTECT_REG + 6, 0x00800, 0x00882, 1 },
+	{ A6XX_CP_PROTECT_REG + 7, 0x008a0, 0x008a8, 1 },
+	{ A6XX_CP_PROTECT_REG + 8, 0x008ab, 0x008cf, 1 },
+	{ A6XX_CP_PROTECT_REG + 9, 0x008d0, 0x0098c, 0 },
+	{ A6XX_CP_PROTECT_REG + 10, 0x00900, 0x0094d, 1 },
+	{ A6XX_CP_PROTECT_REG + 11, 0x0098d, 0x00bff, 1 },
+	{ A6XX_CP_PROTECT_REG + 12, 0x00e00, 0x00e01, 1 },
+	{ A6XX_CP_PROTECT_REG + 13, 0x00e03, 0x00e0f, 1 },
+	{ A6XX_CP_PROTECT_REG + 14, 0x03c00, 0x03cc3, 1 },
+	{ A6XX_CP_PROTECT_REG + 15, 0x03cc4, 0x05cc3, 0 },
+	{ A6XX_CP_PROTECT_REG + 16, 0x08630, 0x087ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 17, 0x08e00, 0x08e00, 1 },
+	{ A6XX_CP_PROTECT_REG + 18, 0x08e08, 0x08e08, 1 },
+	{ A6XX_CP_PROTECT_REG + 19, 0x08e50, 0x08e6f, 1 },
+	{ A6XX_CP_PROTECT_REG + 20, 0x09624, 0x097ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 21, 0x09e70, 0x09e71, 1 },
+	{ A6XX_CP_PROTECT_REG + 22, 0x09e78, 0x09fff, 1 },
+	{ A6XX_CP_PROTECT_REG + 23, 0x0a630, 0x0a7ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 24, 0x0ae02, 0x0ae02, 1 },
+	{ A6XX_CP_PROTECT_REG + 25, 0x0ae50, 0x0b17f, 1 },
+	{ A6XX_CP_PROTECT_REG + 26, 0x0b604, 0x0b604, 1 },
+	{ A6XX_CP_PROTECT_REG + 27, 0x0be02, 0x0be03, 1 },
+	{ A6XX_CP_PROTECT_REG + 28, 0x0be20, 0x0d5ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 29, 0x0f000, 0x0fbff, 1 },
+	{ A6XX_CP_PROTECT_REG + 30, 0x0fc00, 0x11bff, 0 },
+	{ A6XX_CP_PROTECT_REG + 31, 0x11c00, 0x11c00, 1 },
+	{ 0 },
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a630v2 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A630, 6, 3, 0, ANY_ID),
+		.features = ADRENO_IFPC | ADRENO_CONTENT_PROTECTION |
+			ADRENO_IOCOHERENT | ADRENO_PREEMPTION,
+		.gpudev = &adreno_a630_gpudev.base,
+		.perfcounters = &adreno_a630_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_1M,
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.prim_fifo_threshold = 0x0018000,
+	.gmu_major = 1,
+	.gmu_minor = 3,
+	.sqefw_name = "a630_sqe.fw",
+	.gmufw_name = "a630_gmu.bin",
+	.zap_name = "a630_zap.mdt",
+	.hwcg = a630_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a630_hwcg_regs),
+	.vbif = a630_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a630_vbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = a630_protected_regs,
+	.highest_bank_bit = 15,
+};
+
+/* For a615, a616, a618 and a619 */
+static const struct kgsl_regmap_list a615_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0,  0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A6XX_RBBM_CLOCK_HYST_SP0,  0x0000F3CF},
+	{A6XX_RBBM_CLOCK_CNTL_TP0,  0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL_TP1,  0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP1, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP1, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP1, 0x00022222},
+	{A6XX_RBBM_CLOCK_HYST_TP0,  0x77777777},
+	{A6XX_RBBM_CLOCK_HYST_TP1,  0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP1, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP1, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{A6XX_RBBM_CLOCK_HYST4_TP1, 0x00077777},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY_TP1, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP1, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP1, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP1, 0x00011111},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE,  0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_UCHE, 0x00222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE,  0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x00002222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_CNTL_CCU1, 0x00002220},
+	{A6XX_RBBM_CLOCK_CNTL_CCU2, 0x00002220},
+	{A6XX_RBBM_CLOCK_CNTL_CCU3, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU1, 0x00040F00},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU2, 0x00040F00},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU3, 0x00040F00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x05022022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555}
+};
+
+/* For a615, a616, a618 and a619 */
+static const struct kgsl_regmap_list a615_gbif_regs[] = {
+	{A6XX_RBBM_VBIF_CLIENT_QOS_CNTL, 0x3},
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a615 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A615, 6, 1, 5, ANY_ID),
+		.features = ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION | ADRENO_IFPC |
+			ADRENO_IOCOHERENT,
+		.gpudev = &adreno_a630_gpudev.base,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = 600 * SZ_1K,
+	},
+	.prim_fifo_threshold = 0x0018000,
+	.gmu_major = 1,
+	.gmu_minor = 3,
+	.sqefw_name = "a630_sqe.fw",
+	.gmufw_name = "a630_gmu.bin",
+	.zap_name = "a615_zap.mdt",
+	.hwcg = a615_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a615_hwcg_regs),
+	.vbif = a615_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a615_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = a630_protected_regs,
+	.highest_bank_bit = 14,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a618 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A618, 6, 1, 8, ANY_ID),
+		.features = ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION | ADRENO_IFPC |
+			ADRENO_IOCOHERENT,
+		.gpudev = &adreno_a630_gpudev.base,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.prim_fifo_threshold = 0x0018000,
+	.gmu_major = 1,
+	.gmu_minor = 7,
+	.sqefw_name = "a630_sqe.fw",
+	.gmufw_name = "a630_gmu.bin",
+	.zap_name = "a615_zap.mdt",
+	.hwcg = a615_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a615_hwcg_regs),
+	.vbif = a615_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a615_gbif_regs),
+	.hang_detect_cycles = 0x3fffff,
+	.protected_regs = a630_protected_regs,
+	.highest_bank_bit = 14,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a619 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A619, 6, 1, 9, ANY_ID),
+		.features = ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION | ADRENO_IFPC |
+			ADRENO_IOCOHERENT,
+		.gpudev = &adreno_a630_gpudev.base,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x0018000,
+	.gmu_major = 1,
+	.gmu_minor = 9,
+	.sqefw_name = "a630_sqe.fw",
+	.gmufw_name = "a619_gmu.bin",
+	.zap_name = "a615_zap.mdt",
+	.hwcg = a615_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a615_hwcg_regs),
+	.vbif = a615_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a615_gbif_regs),
+	.hang_detect_cycles = 0x3fffff,
+	.protected_regs = a630_protected_regs,
+	.highest_bank_bit = 14,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a619_variant = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A619, 6, 1, 9, ANY_ID),
+		.compatible = "qcom,adreno-gpu-a619-holi",
+		.features =  ADRENO_PREEMPTION | ADRENO_CONTENT_PROTECTION,
+		.gpudev = &adreno_a619_holi_gpudev,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x0018000,
+	.sqefw_name = "a630_sqe.fw",
+	.zap_name = "gen6_3_25_0_zap.mdt",
+	.hwcg = a615_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a615_hwcg_regs),
+	.vbif = a615_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a615_gbif_regs),
+	.hang_detect_cycles = 0x3fffff,
+	.protected_regs = a630_protected_regs,
+	.gx_cpr_toggle = true,
+	.highest_bank_bit = 14,
+};
+
+static const struct kgsl_regmap_list a620_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000777},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+};
+
+/* a620, a621 and a650 */
+static const struct kgsl_regmap_list a650_gbif_regs[] = {
+	{A6XX_GBIF_QSB_SIDE0, 0x00071620},
+	{A6XX_GBIF_QSB_SIDE1, 0x00071620},
+	{A6XX_GBIF_QSB_SIDE2, 0x00071620},
+	{A6XX_GBIF_QSB_SIDE3, 0x00071620},
+	{A6XX_RBBM_GBIF_CLIENT_QOS_CNTL, 0x3},
+};
+
+/* These are for a620, a621 and a650 */
+static const struct adreno_protected_regs a620_protected_regs[] = {
+	{ A6XX_CP_PROTECT_REG + 0, 0x00000, 0x004ff, 0 },
+	{ A6XX_CP_PROTECT_REG + 1, 0x00501, 0x00506, 0 },
+	{ A6XX_CP_PROTECT_REG + 2, 0x0050b, 0x007ff, 0 },
+	{ A6XX_CP_PROTECT_REG + 3, 0x0050e, 0x0050e, 1 },
+	{ A6XX_CP_PROTECT_REG + 4, 0x00510, 0x00510, 1 },
+	{ A6XX_CP_PROTECT_REG + 5, 0x00534, 0x00534, 1 },
+	{ A6XX_CP_PROTECT_REG + 6, 0x00800, 0x00882, 1 },
+	{ A6XX_CP_PROTECT_REG + 7, 0x008a0, 0x008a8, 1 },
+	{ A6XX_CP_PROTECT_REG + 8, 0x008ab, 0x008cf, 1 },
+	{ A6XX_CP_PROTECT_REG + 9, 0x008d0, 0x0098c, 0 },
+	{ A6XX_CP_PROTECT_REG + 10, 0x00900, 0x0094d, 1 },
+	{ A6XX_CP_PROTECT_REG + 11, 0x0098d, 0x00bff, 1 },
+	{ A6XX_CP_PROTECT_REG + 12, 0x00e00, 0x00e01, 1 },
+	{ A6XX_CP_PROTECT_REG + 13, 0x00e03, 0x00e0f, 1 },
+	{ A6XX_CP_PROTECT_REG + 14, 0x03c00, 0x03cc3, 1 },
+	{ A6XX_CP_PROTECT_REG + 15, 0x03cc4, 0x05cc3, 0 },
+	{ A6XX_CP_PROTECT_REG + 16, 0x08630, 0x087ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 17, 0x08e00, 0x08e00, 1 },
+	{ A6XX_CP_PROTECT_REG + 18, 0x08e08, 0x08e08, 1 },
+	{ A6XX_CP_PROTECT_REG + 19, 0x08e50, 0x08e6f, 1 },
+	{ A6XX_CP_PROTECT_REG + 20, 0x08e80, 0x090ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 21, 0x09624, 0x097ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 22, 0x09e60, 0x09e71, 1 },
+	{ A6XX_CP_PROTECT_REG + 23, 0x09e78, 0x09fff, 1 },
+	{ A6XX_CP_PROTECT_REG + 24, 0x0a630, 0x0a7ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 25, 0x0ae02, 0x0ae02, 1 },
+	{ A6XX_CP_PROTECT_REG + 26, 0x0ae50, 0x0b17f, 1 },
+	{ A6XX_CP_PROTECT_REG + 27, 0x0b604, 0x0b604, 1 },
+	{ A6XX_CP_PROTECT_REG + 28, 0x0b608, 0x0b60f, 1 },
+	{ A6XX_CP_PROTECT_REG + 29, 0x0be02, 0x0be03, 1 },
+	{ A6XX_CP_PROTECT_REG + 30, 0x0be20, 0x0d5ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 31, 0x0f000, 0x0fbff, 1 },
+	{ A6XX_CP_PROTECT_REG + 32, 0x0fc00, 0x11bff, 0 },
+	{ A6XX_CP_PROTECT_REG + 33, 0x18400, 0x1a3ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 34, 0x1a800, 0x1c7ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 35, 0x1c800, 0x1e7ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 36, 0x1f400, 0x1f843, 1 },
+	{ A6XX_CP_PROTECT_REG + 37, 0x1f844, 0x1f8bf, 0 },
+	{ A6XX_CP_PROTECT_REG + 38, 0x1f887, 0x1f8a2, 1 },
+	{ A6XX_CP_PROTECT_REG + 47, 0x1f8c0, 0x1f8c0, 1 },
+	{ 0 },
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a620 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A620, 6, 2, 0, ANY_ID),
+		.features = ADRENO_CONTENT_PROTECTION | ADRENO_IOCOHERENT |
+			ADRENO_IFPC | ADRENO_PREEMPTION | ADRENO_ACD |
+			ADRENO_APRIV,
+		.gpudev = &adreno_a630_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = 2 * SZ_1M,
+	},
+	.prim_fifo_threshold = 0x0010000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a650_sqe.fw",
+	.gmufw_name = "a650_gmu.bin",
+	.zap_name = "a620_zap.mdt",
+	.hwcg = a620_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a620_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.veto_fal10 = true,
+	.hang_detect_cycles = 0x3ffff,
+	.protected_regs = a620_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 14,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a621 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A621, 6, 2, 1, ANY_ID),
+		.compatible = "qcom,adreno-gpu-a621",
+		.features = ADRENO_CONTENT_PROTECTION | ADRENO_IOCOHERENT |
+			ADRENO_APRIV | ADRENO_LSR | ADRENO_PREEMPTION |
+			ADRENO_IFPC,
+		.gpudev = &adreno_a6xx_hwsched_gpudev.base,
+		.perfcounters = &adreno_a6xx_hwsched_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = 2 * SZ_1M,
+	},
+	.prim_fifo_threshold = 0x0010000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a650_sqe.fw",
+	.gmufw_name = "a621_gmu.bin",
+	.zap_name = "a620_zap.mdt",
+	.hwcg = a620_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a620_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.veto_fal10 = true,
+	.pdc_in_aop = true,
+	.hang_detect_cycles = 0x3ffff,
+	.protected_regs = a620_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 13,
+};
+
+static const struct kgsl_regmap_list a640_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x05222022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+};
+
+static const struct kgsl_regmap_list a680_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_HYST_TP0, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x05222022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_CLOCK_CNTL, 0x8AA8AA82},
+	{A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{A6XX_GMUGX_GMU_SP_RF_CONTROL_0, 0x00000001},
+	{A6XX_GMUGX_GMU_SP_RF_CONTROL_1, 0x00000001},
+};
+
+/* These apply to a640, a680, a612, a610 and a702 */
+static const struct kgsl_regmap_list a640_vbif_regs[] = {
+	{A6XX_GBIF_QSB_SIDE0, 0x00071620},
+	{A6XX_GBIF_QSB_SIDE1, 0x00071620},
+	{A6XX_GBIF_QSB_SIDE2, 0x00071620},
+	{A6XX_GBIF_QSB_SIDE3, 0x00071620},
+	{A6XX_RBBM_GBIF_CLIENT_QOS_CNTL, 0x3},
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a640 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A640, 6, 4, 0, ANY_ID),
+		.features = ADRENO_CONTENT_PROTECTION | ADRENO_IOCOHERENT |
+			ADRENO_IFPC | ADRENO_PREEMPTION | ADRENO_L3_VOTE,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_1M, //Verified 1MB
+		.bus_width = 32,
+		.snapshot_size = 2 * SZ_1M,
+	},
+	.prim_fifo_threshold = 0x00200000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a630_sqe.fw",
+	.gmufw_name = "a640_gmu.bin",
+	.zap_name = "a640_zap.mdt",
+	.hwcg = a640_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a640_hwcg_regs),
+	.vbif = a640_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a640_vbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = a630_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 15,
+};
+
+static const struct kgsl_regmap_list a650_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_CNTL_TP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000777},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a650 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A650, 6, 5, 0, 0),
+		.features = ADRENO_IOCOHERENT | ADRENO_CONTENT_PROTECTION |
+			ADRENO_IFPC | ADRENO_APRIV | ADRENO_L3_VOTE,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_1M + SZ_128K, /* verified 1152kB */
+		.bus_width = 32,
+		.snapshot_size = 2 * SZ_1M,
+	},
+	.prim_fifo_threshold = 0x00300000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a650_sqe.fw",
+	.gmufw_name = "a650_gmu.bin",
+	.zap_name = "a650_zap.mdt",
+	.hwcg = a650_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a650_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.veto_fal10 = true,
+	.pdc_in_aop = true,
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = a620_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 16,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a650v2 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A650, 6, 5, 0, ANY_ID),
+		.features = ADRENO_IOCOHERENT | ADRENO_CONTENT_PROTECTION |
+			ADRENO_IFPC | ADRENO_PREEMPTION | ADRENO_ACD |
+			ADRENO_LM | ADRENO_APRIV | ADRENO_L3_VOTE,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_1M + SZ_128K, /* verified 1152kB */
+		.bus_width = 32,
+		.snapshot_size = 2 * SZ_1M,
+	},
+	.prim_fifo_threshold = 0x00300000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a650_sqe.fw",
+	.gmufw_name = "a650_gmu.bin",
+	.zap_name = "a650_zap.mdt",
+	.hwcg = a650_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a650_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.veto_fal10 = true,
+	.pdc_in_aop = true,
+	.hang_detect_cycles = 0x3ffff,
+	.protected_regs = a620_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 16,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a680 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A680, 6, 8, 0, ANY_ID),
+		.features = ADRENO_IOCOHERENT | ADRENO_CONTENT_PROTECTION |
+			ADRENO_IFPC | ADRENO_PREEMPTION,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_2M,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x00400000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a630_sqe.fw",
+	.gmufw_name = "a640_gmu.bin",
+	.zap_name = "a640_zap.mdt",
+	.hwcg = a680_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a680_hwcg_regs),
+	.vbif = a640_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a640_vbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = a630_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 16,
+};
+
+static const struct kgsl_regmap_list a612_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000081},
+	{A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01202222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x05522022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a612 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A612, 6, 1, 2, ANY_ID),
+		.features = ADRENO_CONTENT_PROTECTION |
+			ADRENO_IOCOHERENT | ADRENO_PREEMPTION | ADRENO_IFPC,
+		.gpudev = &adreno_a6xx_rgmu_gpudev,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = (SZ_128K + SZ_4K),
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.prim_fifo_threshold = 0x00080000,
+	.sqefw_name = "a630_sqe.fw",
+	.gmufw_name = "a612_rgmu.bin",
+	.zap_name = "a612_zap.mdt",
+	.hwcg = a612_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a612_hwcg_regs),
+	.vbif = a640_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a640_vbif_regs),
+	.hang_detect_cycles = 0x3fffff,
+	.protected_regs = a630_protected_regs,
+	.highest_bank_bit = 14,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a616 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A616, 6, 1, 6, ANY_ID),
+		.features = ADRENO_PREEMPTION |
+			ADRENO_CONTENT_PROTECTION | ADRENO_IFPC |
+			ADRENO_IOCOHERENT,
+		.gpudev = &adreno_a630_gpudev.base,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.prim_fifo_threshold = 0x0018000,
+	.gmu_major = 1,
+	.gmu_minor = 3,
+	.sqefw_name = "a630_sqe.fw",
+	.gmufw_name = "a630_gmu.bin",
+	.zap_name = "a615_zap.mdt",
+	.hwcg = a615_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a615_hwcg_regs),
+	.vbif = a615_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a615_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = a630_protected_regs,
+	.highest_bank_bit = 14,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a610 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A610, 6, 1, 0, ANY_ID),
+		.features = ADRENO_CONTENT_PROTECTION |
+			ADRENO_PREEMPTION,
+		.gpudev = &adreno_a6xx_gpudev,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.uche_gmem_alignment = SZ_1M,
+		.gmem_size = (SZ_128K + SZ_4K),
+		.bus_width = 32,
+		.snapshot_size = SZ_1M,
+	},
+	.prim_fifo_threshold = 0x00080000,
+	.sqefw_name = "a630_sqe.fw",
+	.zap_name = "a610_zap.mdt",
+	.hwcg = a612_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a612_hwcg_regs),
+	.vbif = a640_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a640_vbif_regs),
+	.hang_detect_cycles = 0x3ffff,
+	.protected_regs = a630_protected_regs,
+	.highest_bank_bit = 14,
+};
+
+static const struct kgsl_regmap_list a660_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+};
+
+/* A660 protected register list */
+static const struct adreno_protected_regs a660_protected_regs[] = {
+	{ A6XX_CP_PROTECT_REG + 0, 0x00000, 0x004ff, 0 },
+	{ A6XX_CP_PROTECT_REG + 1, 0x00501, 0x00506, 0 },
+	{ A6XX_CP_PROTECT_REG + 2, 0x0050b, 0x007ff, 0 },
+	{ A6XX_CP_PROTECT_REG + 3, 0x0050e, 0x0050e, 1 },
+	{ A6XX_CP_PROTECT_REG + 4, 0x00510, 0x00510, 1 },
+	{ A6XX_CP_PROTECT_REG + 5, 0x00534, 0x00534, 1 },
+	{ A6XX_CP_PROTECT_REG + 6, 0x00800, 0x00882, 1 },
+	{ A6XX_CP_PROTECT_REG + 7, 0x008a0, 0x008a8, 1 },
+	{ A6XX_CP_PROTECT_REG + 8, 0x008ab, 0x008cf, 1 },
+	{ A6XX_CP_PROTECT_REG + 9, 0x008d0, 0x0098c, 0 },
+	{ A6XX_CP_PROTECT_REG + 10, 0x00900, 0x0094d, 1 },
+	{ A6XX_CP_PROTECT_REG + 11, 0x0098d, 0x00bff, 1 },
+	{ A6XX_CP_PROTECT_REG + 12, 0x00e00, 0x00e01, 1 },
+	{ A6XX_CP_PROTECT_REG + 13, 0x00e03, 0x00e0f, 1 },
+	{ A6XX_CP_PROTECT_REG + 14, 0x03c00, 0x03cc3, 1 },
+	{ A6XX_CP_PROTECT_REG + 15, 0x03cc4, 0x05cc3, 0 },
+	{ A6XX_CP_PROTECT_REG + 16, 0x08630, 0x087ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 17, 0x08e00, 0x08e00, 1 },
+	{ A6XX_CP_PROTECT_REG + 18, 0x08e08, 0x08e08, 1 },
+	{ A6XX_CP_PROTECT_REG + 19, 0x08e50, 0x08e6f, 1 },
+	{ A6XX_CP_PROTECT_REG + 20, 0x08e80, 0x090ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 21, 0x09624, 0x097ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 22, 0x09e60, 0x09e71, 1 },
+	{ A6XX_CP_PROTECT_REG + 23, 0x09e78, 0x09fff, 1 },
+	{ A6XX_CP_PROTECT_REG + 24, 0x0a630, 0x0a7ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 25, 0x0ae02, 0x0ae02, 1 },
+	{ A6XX_CP_PROTECT_REG + 26, 0x0ae50, 0x0af7f, 1 },
+	{ A6XX_CP_PROTECT_REG + 27, 0x0b604, 0x0b604, 1 },
+	{ A6XX_CP_PROTECT_REG + 28, 0x0b608, 0x0b60e, 1 },
+	{ A6XX_CP_PROTECT_REG + 29, 0x0be02, 0x0be03, 1 },
+	{ A6XX_CP_PROTECT_REG + 30, 0x0be20, 0x0bf7f, 1 },
+	{ A6XX_CP_PROTECT_REG + 31, 0x0d000, 0x0d5ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 32, 0x0f000, 0x0fbff, 1 },
+	{ A6XX_CP_PROTECT_REG + 33, 0x0fc00, 0x11bff, 0 },
+	{ A6XX_CP_PROTECT_REG + 34, 0x18400, 0x1a3ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 35, 0x1a400, 0x1c3ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 36, 0x1c400, 0x1e3ff, 1 },
+	{ A6XX_CP_PROTECT_REG + 37, 0x1f400, 0x1f843, 1 },
+	{ A6XX_CP_PROTECT_REG + 38, 0x1f844, 0x1f8bf, 0 },
+	{ A6XX_CP_PROTECT_REG + 39, 0x1f860, 0x1f860, 1 },
+	{ A6XX_CP_PROTECT_REG + 40, 0x1f887, 0x1f8a2, 1 },
+	{ A6XX_CP_PROTECT_REG + 47, 0x1f8c0, 0x1f8c0, 1 },
+	{ 0 },
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a660 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A660, 6, 6, 0, 0),
+		.features = ADRENO_APRIV |
+				ADRENO_IOCOHERENT | ADRENO_CONTENT_PROTECTION |
+				ADRENO_IFPC | ADRENO_PREEMPTION | ADRENO_L3_VOTE,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_1M + SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x00300000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a660_sqe.fw",
+	.gmufw_name = "a660_gmu.bin",
+	.zap_name = "a660_zap.mdt",
+	.hwcg = a660_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a660_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.veto_fal10 = true,
+	.protected_regs = a660_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 16,
+	.pdc_in_aop = true,
+	.ctxt_record_size = 2496 * 1024,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a660v2 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A660, 6, 6, 0, ANY_ID),
+		.features = ADRENO_APRIV |
+				ADRENO_IOCOHERENT | ADRENO_CONTENT_PROTECTION |
+				ADRENO_IFPC | ADRENO_PREEMPTION | ADRENO_ACD |
+				ADRENO_L3_VOTE,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_1M + SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x00300000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a660_sqe.fw",
+	.gmufw_name = "a660_gmu.bin",
+	.zap_name = "a660_zap.mdt",
+	.hwcg = a660_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a660_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.veto_fal10 = true,
+	.protected_regs = a660_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 16,
+	.pdc_in_aop = true,
+	.ctxt_record_size = 2496 * 1024,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a660_shima = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A660, 6, 6, 0, ANY_ID),
+		.compatible = "qcom,adreno-gpu-a660-shima",
+		.features = ADRENO_APRIV |
+				ADRENO_IOCOHERENT | ADRENO_CONTENT_PROTECTION |
+				ADRENO_IFPC | ADRENO_PREEMPTION | ADRENO_ACD,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_1M + SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x00300000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a660_sqe.fw",
+	.gmufw_name = "a660_gmu.bin",
+	.zap_name = "a660_zap.mdt",
+	.hwcg = a660_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a660_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.hang_detect_cycles = 0x3ffff,
+	.veto_fal10 = true,
+	.protected_regs = a660_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 15,
+	.pdc_in_aop = true,
+	.ctxt_record_size = 2496 * 1024,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a642l = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A642, ANY_ID, ANY_ID, ANY_ID, ANY_ID),
+		.compatible = "qcom,adreno-gpu-a642l",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT |
+				ADRENO_CONTENT_PROTECTION,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x00200000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a660_sqe.fw",
+	.gmufw_name = "a660_gmu.bin",
+	.zap_name = "a660_zap.mdt",
+	.hwcg = a660_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a660_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.hang_detect_cycles = 0x3ffff,
+	.veto_fal10 = true,
+	.protected_regs = a660_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 15,
+	.pdc_in_aop = true,
+	.ctxt_record_size = 2496 * 1024,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a643 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A643, ANY_ID, ANY_ID, ANY_ID, ANY_ID),
+		.compatible = "qcom,adreno-gpu-a643",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT |
+				ADRENO_CONTENT_PROTECTION | ADRENO_PREEMPTION |
+				ADRENO_IFPC,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x00200000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a660_sqe.fw",
+	.gmufw_name = "a660_gmu.bin",
+	.zap_name = "a660_zap.mdt",
+	.hwcg = a660_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a660_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.hang_detect_cycles = 0x3ffff,
+	.veto_fal10 = true,
+	.protected_regs = a660_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 15,
+	.pdc_in_aop = true,
+	.ctxt_record_size = 2496 * 1024,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a662 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A662, ANY_ID, ANY_ID, ANY_ID, ANY_ID),
+		.compatible = "qcom,adreno-gpu-a662",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT |
+			ADRENO_CONTENT_PROTECTION | ADRENO_PREEMPTION |
+			ADRENO_IFPC | ADRENO_BCL | ADRENO_ACD,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_1M + SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x00300000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a660_sqe.fw",
+	.gmufw_name = "a662_gmu.bin",
+	.zap_name = "a662_zap.mdt",
+	.hwcg = a660_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a660_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.hang_detect_cycles = 0x3ffff,
+	.veto_fal10 = true,
+	.protected_regs = a660_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 15,
+	.pdc_in_aop = true,
+	.ctxt_record_size = 2496 * 1024,
+};
+
+extern const struct gen7_snapshot_block_list gen7_0_0_snapshot_block_list;
+
+static const struct kgsl_regmap_list gen7_0_0_gbif_regs[] = {
+	{ GEN7_GBIF_QSB_SIDE0, 0x00071620 },
+	{ GEN7_GBIF_QSB_SIDE1, 0x00071620 },
+	{ GEN7_GBIF_QSB_SIDE2, 0x00071620 },
+	{ GEN7_GBIF_QSB_SIDE3, 0x00071620 },
+	{ GEN7_RBBM_GBIF_CLIENT_QOS_CNTL, 0x2120212 },
+};
+
+static const struct kgsl_regmap_list a702_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000081},
+	{A6XX_RBBM_CLOCK_HYST_SP0, 0x0000f3cf},
+	{A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01202222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040f00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x05522022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x02222222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{A6XX_RBBM_CLOCK_CNTL_FCHE, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_FCHE, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_FCHE, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_GLC, 0x00222222},
+	{A6XX_RBBM_CLOCK_DELAY_GLC, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GLC, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_MHUB, 0x00000002},
+	{A6XX_RBBM_CLOCK_DELAY_MHUB, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_MHUB, 0x00000000},
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a702 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A702, 7, 0, 2, ANY_ID),
+		.features = ADRENO_CONTENT_PROTECTION |
+					ADRENO_APRIV | ADRENO_PREEMPTION,
+		.gpudev = &adreno_a6xx_gpudev,
+		.perfcounters = &adreno_a6xx_legacy_perfcounters,
+		.gmem_size = SZ_128K,
+		.bus_width = 16,
+		.snapshot_size = SZ_1M,
+	},
+	.prim_fifo_threshold = 0x0000c000,
+	.sqefw_name = "a702_sqe.fw",
+	.zap_name = "a702_zap.mdt",
+	.hwcg = a702_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a702_hwcg_regs),
+	.vbif = a640_vbif_regs,
+	.vbif_count = ARRAY_SIZE(a640_vbif_regs),
+	.hang_detect_cycles = 0x3ffff,
+	.protected_regs = a620_protected_regs,
+	.highest_bank_bit = 14,
+};
+
+static const struct kgsl_regmap_list gen7_0_0_hwcg_regs[] = {
+	{ GEN7_RBBM_CLOCK_CNTL_SP0, 0x02222222 },
+	{ GEN7_RBBM_CLOCK_CNTL2_SP0, 0x02022222 },
+	{ GEN7_RBBM_CLOCK_HYST_SP0, 0x0000f3cf },
+	{ GEN7_RBBM_CLOCK_DELAY_SP0, 0x00000080 },
+	{ GEN7_RBBM_CLOCK_CNTL_TP0, 0x22222220 },
+	{ GEN7_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
+	{ GEN7_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
+	{ GEN7_RBBM_CLOCK_CNTL4_TP0, 0x00222222 },
+	{ GEN7_RBBM_CLOCK_HYST_TP0, 0x77777777 },
+	{ GEN7_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
+	{ GEN7_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
+	{ GEN7_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
+	{ GEN7_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
+	{ GEN7_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
+	{ GEN7_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
+	{ GEN7_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
+	{ GEN7_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
+	{ GEN7_RBBM_CLOCK_HYST_UCHE, 0x00000004 },
+	{ GEN7_RBBM_CLOCK_DELAY_UCHE, 0x00000002 },
+	{ GEN7_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
+	{ GEN7_RBBM_CLOCK_CNTL2_RB0, 0x01002222 },
+	{ GEN7_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
+	{ GEN7_RBBM_CLOCK_HYST_RB_CCU0, 0x44000f00 },
+	{ GEN7_RBBM_CLOCK_CNTL_RAC, 0x25222022 },
+	{ GEN7_RBBM_CLOCK_CNTL2_RAC, 0x00555555 },
+	{ GEN7_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
+	{ GEN7_RBBM_CLOCK_HYST_RAC, 0x00440044 },
+	{ GEN7_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
+	{ GEN7_RBBM_CLOCK_MODE2_GRAS, 0x00000222 },
+	{ GEN7_RBBM_CLOCK_MODE_BV_GRAS, 0x00222222 },
+	{ GEN7_RBBM_CLOCK_MODE_GPC, 0x02222223 },
+	{ GEN7_RBBM_CLOCK_MODE_VFD, 0x00002222 },
+	{ GEN7_RBBM_CLOCK_MODE_BV_GPC, 0x00222222 },
+	{ GEN7_RBBM_CLOCK_MODE_BV_VFD, 0x00002222 },
+	{ GEN7_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_HYST_GPC, 0x04104004 },
+	{ GEN7_RBBM_CLOCK_HYST_VFD, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000 },
+	{ GEN7_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
+	{ GEN7_RBBM_CLOCK_DELAY_VFD, 0x00002222 },
+	{ GEN7_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
+	{ GEN7_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002 },
+	{ GEN7_RBBM_CLOCK_MODE_BV_LRZ, 0x55555552 },
+	{ GEN7_RBBM_CLOCK_MODE_CP, 0x00000223 },
+	{ GEN7_RBBM_CLOCK_CNTL, 0x8aa8aa82 },
+	{ GEN7_RBBM_ISDB_CNT, 0x00000182 },
+	{ GEN7_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
+	{ GEN7_RBBM_SP_HYST_CNT, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
+	{ GEN7_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
+	{ GEN7_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
+};
+
+static const struct kgsl_regmap_list gen7_0_0_ao_hwcg_regs[] = {
+	{ GEN7_GPU_GMU_AO_GMU_CGC_MODE_CNTL, 0x00020000 },
+	{ GEN7_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x00010111 },
+	{ GEN7_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x00005555 },
+};
+
+/* GEN7_0_0 protected register list */
+static const struct gen7_protected_regs gen7_0_0_protected_regs[] = {
+	{ GEN7_CP_PROTECT_REG + 0, 0x00000, 0x004ff, 0 },
+	{ GEN7_CP_PROTECT_REG + 1, 0x0050b, 0x00563, 0 },
+	{ GEN7_CP_PROTECT_REG + 2, 0x0050e, 0x0050e, 1 },
+	{ GEN7_CP_PROTECT_REG + 3, 0x00510, 0x00510, 1 },
+	{ GEN7_CP_PROTECT_REG + 4, 0x00534, 0x00534, 1 },
+	{ GEN7_CP_PROTECT_REG + 5, 0x005fb, 0x00698, 0 },
+	{ GEN7_CP_PROTECT_REG + 6, 0x00699, 0x00882, 1 },
+	{ GEN7_CP_PROTECT_REG + 7, 0x008a0, 0x008a8, 1 },
+	{ GEN7_CP_PROTECT_REG + 8, 0x008ab, 0x008cf, 1 },
+	{ GEN7_CP_PROTECT_REG + 9, 0x008d0, 0x00a40, 0 },
+	{ GEN7_CP_PROTECT_REG + 10, 0x00900, 0x0094d, 1 },
+	{ GEN7_CP_PROTECT_REG + 11, 0x0098d, 0x00a3f, 1 },
+	{ GEN7_CP_PROTECT_REG + 12, 0x00a41, 0x00bff, 1 },
+	{ GEN7_CP_PROTECT_REG + 13, 0x00df0, 0x00df1, 1 },
+	{ GEN7_CP_PROTECT_REG + 14, 0x00e01, 0x00e01, 1 },
+	{ GEN7_CP_PROTECT_REG + 15, 0x00e07, 0x00e0f, 1 },
+	{ GEN7_CP_PROTECT_REG + 16, 0x03c00, 0x03cc3, 1 },
+	{ GEN7_CP_PROTECT_REG + 17, 0x03cc4, 0x05cc3, 0 },
+	{ GEN7_CP_PROTECT_REG + 18, 0x08630, 0x087ff, 1 },
+	{ GEN7_CP_PROTECT_REG + 19, 0x08e00, 0x08e00, 1 },
+	{ GEN7_CP_PROTECT_REG + 20, 0x08e08, 0x08e08, 1 },
+	{ GEN7_CP_PROTECT_REG + 21, 0x08e50, 0x08e6f, 1 },
+	{ GEN7_CP_PROTECT_REG + 22, 0x08e80, 0x09100, 1 },
+	{ GEN7_CP_PROTECT_REG + 23, 0x09624, 0x097ff, 1 },
+	{ GEN7_CP_PROTECT_REG + 24, 0x09e40, 0x09e40, 1 },
+	{ GEN7_CP_PROTECT_REG + 25, 0x09e64, 0x09e71, 1 },
+	{ GEN7_CP_PROTECT_REG + 26, 0x09e78, 0x09fff, 1 },
+	{ GEN7_CP_PROTECT_REG + 27, 0x0a630, 0x0a7ff, 1 },
+	{ GEN7_CP_PROTECT_REG + 28, 0x0ae02, 0x0ae02, 1 },
+	{ GEN7_CP_PROTECT_REG + 29, 0x0ae50, 0x0ae5f, 1 },
+	{ GEN7_CP_PROTECT_REG + 30, 0x0ae66, 0x0ae69, 1 },
+	{ GEN7_CP_PROTECT_REG + 31, 0x0ae6f, 0x0ae72, 1 },
+	{ GEN7_CP_PROTECT_REG + 32, 0x0b604, 0x0b607, 1 },
+	{ GEN7_CP_PROTECT_REG + 33, 0x0ec00, 0x0fbff, 1 },
+	{ GEN7_CP_PROTECT_REG + 34, 0x0fc00, 0x11bff, 0 },
+	{ GEN7_CP_PROTECT_REG + 35, 0x18400, 0x1844a, 1 },
+	{ GEN7_CP_PROTECT_REG + 36, 0x1844b, 0x1857f, 0 },
+	{ GEN7_CP_PROTECT_REG + 37, 0x1844c, 0x18453, 1 },
+	{ GEN7_CP_PROTECT_REG + 38, 0x18580, 0x1a57f, 1 },
+	{ GEN7_CP_PROTECT_REG + 39, 0x1a580, 0x1c57f, 1 },
+	{ GEN7_CP_PROTECT_REG + 40, 0x1c580, 0x1e57f, 1 },
+	{ GEN7_CP_PROTECT_REG + 41, 0x1f400, 0x1f843, 1 },
+	{ GEN7_CP_PROTECT_REG + 42, 0x1f844, 0x1f8bf, 0 },
+	{ GEN7_CP_PROTECT_REG + 43, 0x1f860, 0x1f860, 1 },
+	{ GEN7_CP_PROTECT_REG + 44, 0x1f87f, 0x1f8a2, 1 },
+	{ GEN7_CP_PROTECT_REG + 47, 0x1f8c0, 0x1f8c0, 1 },
+	{ 0 },
+};
+
+static const struct adreno_gen7_core adreno_gpu_core_gen7_0_0 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_GEN7_0_0,
+				UINT_MAX, UINT_MAX, UINT_MAX, 0),
+		.compatible = "qcom,adreno-gpu-gen7-0-0",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT |
+				ADRENO_CONTENT_PROTECTION | ADRENO_IFPC |
+				ADRENO_ACD | ADRENO_L3_VOTE | ADRENO_BCL |
+				ADRENO_PREEMPTION,
+		.gpudev = &adreno_gen7_gmu_gpudev.base,
+		.perfcounters = &adreno_gen7_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_2M,
+		.bus_width = 32,
+		.snapshot_size = SZ_4M,
+	},
+	.gmu_fw_version = GMU_VERSION(4, 0, 0),
+	.sqefw_name = "a730_sqe.fw",
+	.gmufw_name = "gmu_gen70000.bin",
+	.gmufw_bak_name = "c500_gmu.bin",
+	.zap_name = "a730_zap.mdt",
+	.hwcg = gen7_0_0_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(gen7_0_0_hwcg_regs),
+	.ao_hwcg = gen7_0_0_ao_hwcg_regs,
+	.ao_hwcg_count = ARRAY_SIZE(gen7_0_0_ao_hwcg_regs),
+	.gbif = gen7_0_0_gbif_regs,
+	.gbif_count = ARRAY_SIZE(gen7_0_0_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = gen7_0_0_protected_regs,
+	.highest_bank_bit = 16,
+	.gen7_snapshot_block_list = &gen7_0_0_snapshot_block_list,
+	.preempt_level = 1,
+	.ctxt_record_size = (2860 * SZ_1K),
+};
+
+static const struct adreno_gen7_core adreno_gpu_core_gen7_0_1 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_GEN7_0_1,
+				UINT_MAX, UINT_MAX, UINT_MAX, ANY_ID),
+		.compatible = "qcom,adreno-gpu-gen7-0-1",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT |
+				ADRENO_CONTENT_PROTECTION | ADRENO_IFPC |
+				ADRENO_ACD | ADRENO_L3_VOTE | ADRENO_BCL |
+				ADRENO_PREEMPTION,
+		.gpudev = &adreno_gen7_gmu_gpudev.base,
+		.perfcounters = &adreno_gen7_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_2M,
+		.bus_width = 32,
+		.snapshot_size = SZ_4M,
+	},
+	.gmu_fw_version = GMU_VERSION(4, 0, 0),
+	.sqefw_name = "a730_sqe.fw",
+	.gmufw_name = "gmu_gen70000.bin",
+	.gmufw_bak_name = "c500_gmu.bin",
+	.zap_name = "a730_zap.mdt",
+	.hwcg = gen7_0_0_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(gen7_0_0_hwcg_regs),
+	.ao_hwcg = gen7_0_0_ao_hwcg_regs,
+	.ao_hwcg_count = ARRAY_SIZE(gen7_0_0_ao_hwcg_regs),
+	.gbif = gen7_0_0_gbif_regs,
+	.gbif_count = ARRAY_SIZE(gen7_0_0_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = gen7_0_0_protected_regs,
+	.highest_bank_bit = 16,
+	.gen7_snapshot_block_list = &gen7_0_0_snapshot_block_list,
+	.preempt_level = 1,
+	.ctxt_record_size = (2860 * SZ_1K),
+};
+
+extern const struct gen7_snapshot_block_list gen7_2_0_snapshot_block_list;
+
+static const struct kgsl_regmap_list gen7_2_0_gbif_regs[] = {
+	{ GEN7_GBIF_QSB_SIDE0, 0x00071620 },
+	{ GEN7_GBIF_QSB_SIDE1, 0x00071620 },
+	{ GEN7_GBIF_QSB_SIDE2, 0x00071620 },
+	{ GEN7_GBIF_QSB_SIDE3, 0x00071620 },
+	{ GEN7_RBBM_GBIF_CLIENT_QOS_CNTL, 0x2120212 },
+	{ GEN7_GMU_CX_MRC_GBIF_QOS_CTRL, 0x33 },
+};
+
+static const struct kgsl_regmap_list gen7_2_0_hwcg_regs[] = {
+	{ GEN7_RBBM_CLOCK_CNTL_SP0, 0x02222222 },
+	{ GEN7_RBBM_CLOCK_CNTL2_SP0, 0x22022222 },
+	{ GEN7_RBBM_CLOCK_HYST_SP0, 0x003cf3cf },
+	{ GEN7_RBBM_CLOCK_DELAY_SP0, 0x00000080 },
+	{ GEN7_RBBM_CLOCK_CNTL_TP0, 0x22222220 },
+	{ GEN7_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
+	{ GEN7_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
+	{ GEN7_RBBM_CLOCK_CNTL4_TP0, 0x00222222 },
+	{ GEN7_RBBM_CLOCK_HYST_TP0, 0x77777777 },
+	{ GEN7_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
+	{ GEN7_RBBM_CLOCK_HYST3_TP0, 0x77777777 },
+	{ GEN7_RBBM_CLOCK_HYST4_TP0, 0x00077777 },
+	{ GEN7_RBBM_CLOCK_DELAY_TP0, 0x11111111 },
+	{ GEN7_RBBM_CLOCK_DELAY2_TP0, 0x11111111 },
+	{ GEN7_RBBM_CLOCK_DELAY3_TP0, 0x11111111 },
+	{ GEN7_RBBM_CLOCK_DELAY4_TP0, 0x00011111 },
+	{ GEN7_RBBM_CLOCK_CNTL_UCHE, 0x22222222 },
+	{ GEN7_RBBM_CLOCK_CNTL2_UCHE, 0x00222222 },
+	{ GEN7_RBBM_CLOCK_HYST_UCHE, 0x00000444 },
+	{ GEN7_RBBM_CLOCK_DELAY_UCHE, 0x00000222 },
+	{ GEN7_RBBM_CLOCK_CNTL_RB0, 0x22222222 },
+	{ GEN7_RBBM_CLOCK_CNTL2_RB0, 0x01002222 },
+	{ GEN7_RBBM_CLOCK_CNTL_CCU0, 0x00002220 },
+	{ GEN7_RBBM_CLOCK_HYST_RB_CCU0, 0x44000f00 },
+	{ GEN7_RBBM_CLOCK_CNTL_RAC, 0x25222022 },
+	{ GEN7_RBBM_CLOCK_CNTL2_RAC, 0x00555555 },
+	{ GEN7_RBBM_CLOCK_DELAY_RAC, 0x00000011 },
+	{ GEN7_RBBM_CLOCK_HYST_RAC, 0x00440044 },
+	{ GEN7_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222 },
+	{ GEN7_RBBM_CLOCK_MODE2_GRAS, 0x00000222 },
+	{ GEN7_RBBM_CLOCK_MODE_BV_GRAS, 0x00222222 },
+	{ GEN7_RBBM_CLOCK_MODE_GPC, 0x02222223 },
+	{ GEN7_RBBM_CLOCK_MODE_VFD, 0x00222222 },
+	{ GEN7_RBBM_CLOCK_MODE_BV_GPC, 0x00222222 },
+	{ GEN7_RBBM_CLOCK_MODE_BV_VFD, 0x00002222 },
+	{ GEN7_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_HYST_GPC, 0x04104004 },
+	{ GEN7_RBBM_CLOCK_HYST_VFD, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_DELAY_GPC, 0x00000200 },
+	{ GEN7_RBBM_CLOCK_DELAY_VFD, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_MODE_HLSQ, 0x00002222 },
+	{ GEN7_RBBM_CLOCK_DELAY_HLSQ, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_HYST_HLSQ, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_MODE_BV_LRZ, 0x55555552 },
+	{ GEN7_RBBM_CLOCK_HYST2_VFD, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_MODE_CP, 0x00000222 },
+	{ GEN7_RBBM_CLOCK_CNTL, 0x8aa8aa82 },
+	{ GEN7_RBBM_ISDB_CNT, 0x00000182 },
+	{ GEN7_RBBM_RAC_THRESHOLD_CNT, 0x00000000 },
+	{ GEN7_RBBM_SP_HYST_CNT, 0x00000000 },
+	{ GEN7_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222 },
+	{ GEN7_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111 },
+	{ GEN7_RBBM_CLOCK_HYST_GMU_GX, 0x00000555 },
+};
+
+static const struct kgsl_regmap_list gen7_2_0_ao_hwcg_regs[] = {
+	{ GEN7_GPU_GMU_AO_GMU_CGC_MODE_CNTL, 0x00020202 },
+	{ GEN7_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x00010111 },
+	{ GEN7_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x00005555 },
+};
+
+static const struct adreno_gen7_core adreno_gpu_core_gen7_2_0 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_GEN7_2_0,
+				UINT_MAX, UINT_MAX, UINT_MAX, ANY_ID),
+		.compatible = "qcom,adreno-gpu-gen7-2-0",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT | ADRENO_IFPC |
+				ADRENO_CONTENT_PROTECTION | ADRENO_ACD |
+				ADRENO_LPAC | ADRENO_BCL | ADRENO_L3_VOTE |
+				ADRENO_PREEMPTION | ADRENO_DMS,
+		.gpudev = &adreno_gen7_hwsched_gpudev.base,
+		.perfcounters = &adreno_gen7_hwsched_perfcounters,
+		.uche_gmem_alignment = SZ_16M,
+		.gmem_size = 3 * SZ_1M,
+		.bus_width = 32,
+		.snapshot_size = SZ_8M,
+	},
+	.gmu_fw_version = GMU_VERSION(4, 1, 0),
+	.sqefw_name = "a740_sqe.fw",
+	.gmufw_name = "gmu_gen70200.bin",
+	.zap_name = "a740_zap.mbn",
+	.hwcg = gen7_2_0_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(gen7_2_0_hwcg_regs),
+	.ao_hwcg = gen7_2_0_ao_hwcg_regs,
+	.ao_hwcg_count = ARRAY_SIZE(gen7_2_0_ao_hwcg_regs),
+	.gbif = gen7_2_0_gbif_regs,
+	.gbif_count = ARRAY_SIZE(gen7_2_0_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = gen7_0_0_protected_regs,
+	.highest_bank_bit = 16,
+	.gmu_hub_clk_freq = 200000000,
+	.gen7_snapshot_block_list = &gen7_2_0_snapshot_block_list,
+	.bcl_data = 1,
+	.preempt_level = 1,
+	.ctxt_record_size = (4192 * SZ_1K),
+};
+
+static const struct adreno_gen7_core adreno_gpu_core_gen7_2_1 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_GEN7_2_1,
+				UINT_MAX, UINT_MAX, UINT_MAX, ANY_ID),
+		.compatible = "qcom,adreno-gpu-gen7-2-1",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT | ADRENO_IFPC |
+				ADRENO_CONTENT_PROTECTION | ADRENO_LPAC |
+				ADRENO_BCL | ADRENO_L3_VOTE | ADRENO_ACD |
+				ADRENO_PREEMPTION | ADRENO_DMS,
+		.gpudev = &adreno_gen7_hwsched_gpudev.base,
+		.perfcounters = &adreno_gen7_hwsched_perfcounters,
+		.uche_gmem_alignment = SZ_16M,
+		.gmem_size = 3 * SZ_1M,
+		.bus_width = 32,
+		.snapshot_size = SZ_8M,
+	},
+	.gmu_fw_version = GMU_VERSION(4, 1, 0),
+	.sqefw_name = "a740_sqe.fw",
+	.gmufw_name = "gmu_gen70200.bin",
+	.zap_name = "a740_zap.mbn",
+	.hwcg = gen7_2_0_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(gen7_2_0_hwcg_regs),
+	.ao_hwcg = gen7_2_0_ao_hwcg_regs,
+	.ao_hwcg_count = ARRAY_SIZE(gen7_2_0_ao_hwcg_regs),
+	.gbif = gen7_2_0_gbif_regs,
+	.gbif_count = ARRAY_SIZE(gen7_2_0_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = gen7_0_0_protected_regs,
+	.highest_bank_bit = 16,
+	.gmu_hub_clk_freq = 200000000,
+	.gen7_snapshot_block_list = &gen7_2_0_snapshot_block_list,
+	.bcl_data = 1,
+	.preempt_level = 1,
+	.ctxt_record_size = (4192 * SZ_1K),
+};
+
+static const struct adreno_gen7_core adreno_gpu_core_gen7_4_0 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_GEN7_4_0,
+				UINT_MAX, UINT_MAX, UINT_MAX, ANY_ID),
+		.compatible = "qcom,adreno-gpu-gen7-4-0",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT |
+				ADRENO_CONTENT_PROTECTION | ADRENO_L3_VOTE |
+				ADRENO_PREEMPTION | ADRENO_IFPC | ADRENO_ACD |
+				ADRENO_BCL,
+		.gpudev = &adreno_gen7_gmu_gpudev.base,
+		.perfcounters = &adreno_gen7_perfcounters,
+		.uche_gmem_alignment = 0,
+		.gmem_size = SZ_2M,
+		.bus_width = 32,
+		.snapshot_size = SZ_4M,
+	},
+	.gmu_fw_version = GMU_VERSION(4, 0, 7),
+	.sqefw_name = "a730_sqe.fw",
+	.gmufw_name = "gmu_gen70000.bin",
+	.gmufw_bak_name = "c500_gmu.bin",
+	.zap_name = "a730_zap.mdt",
+	.hwcg = gen7_0_0_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(gen7_0_0_hwcg_regs),
+	.ao_hwcg = gen7_0_0_ao_hwcg_regs,
+	.ao_hwcg_count = ARRAY_SIZE(gen7_0_0_ao_hwcg_regs),
+	.gbif = gen7_0_0_gbif_regs,
+	.gbif_count = ARRAY_SIZE(gen7_0_0_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = gen7_0_0_protected_regs,
+	.highest_bank_bit = 16,
+	.gen7_snapshot_block_list = &gen7_0_0_snapshot_block_list,
+	.preempt_level = 1,
+	.ctxt_record_size = (2860 * SZ_1K),
+};
+
+extern const struct gen7_snapshot_block_list gen7_9_0_snapshot_block_list;
+
+/* GEN7_9_0 protected register list */
+static const struct gen7_protected_regs gen7_9_0_protected_regs[] = {
+	{ GEN7_CP_PROTECT_REG + 0, 0x00000, 0x004ff, 0 },
+	{ GEN7_CP_PROTECT_REG + 1, 0x0050b, 0x00563, 0 },
+	{ GEN7_CP_PROTECT_REG + 2, 0x00584, 0x006c1, 0 },
+	{ GEN7_CP_PROTECT_REG + 3, 0x00706, 0x00706, 0 },
+	{ GEN7_CP_PROTECT_REG + 4, 0x00720, 0x0073f, 0 },
+	{ GEN7_CP_PROTECT_REG + 5, 0x00760, 0x007ff, 0 },
+	{ GEN7_CP_PROTECT_REG + 6, 0x00800, 0x00882, 1 },
+	{ GEN7_CP_PROTECT_REG + 7, 0x008a0, 0x008a8, 1 },
+	{ GEN7_CP_PROTECT_REG + 8, 0x008ab, 0x00a40, 0 },
+	{ GEN7_CP_PROTECT_REG + 9, 0x00900, 0x0094d, 1 },
+	{ GEN7_CP_PROTECT_REG + 10, 0x0098d, 0x00a3f, 1 },
+	{ GEN7_CP_PROTECT_REG + 11, 0x00a41, 0x00bff, 1 },
+	{ GEN7_CP_PROTECT_REG + 12, 0x00df0, 0x00df1, 1 },
+	{ GEN7_CP_PROTECT_REG + 13, 0x00e01, 0x00e01, 1 },
+	{ GEN7_CP_PROTECT_REG + 14, 0x00e07, 0x00e0f, 1 },
+	{ GEN7_CP_PROTECT_REG + 15, 0x02840, 0x03cc3, 1 },
+	{ GEN7_CP_PROTECT_REG + 16, 0x03cc4, 0x05cc3, 0 },
+	{ GEN7_CP_PROTECT_REG + 17, 0x08630, 0x087ff, 1 },
+	{ GEN7_CP_PROTECT_REG + 18, 0x08e00, 0x08e00, 1 },
+	{ GEN7_CP_PROTECT_REG + 19, 0x08e08, 0x08e08, 1 },
+	{ GEN7_CP_PROTECT_REG + 20, 0x08e50, 0x08e6f, 1 },
+	{ GEN7_CP_PROTECT_REG + 21, 0x08e79, 0x09100, 1 },
+	{ GEN7_CP_PROTECT_REG + 22, 0x09624, 0x097ff, 1 },
+	{ GEN7_CP_PROTECT_REG + 23, 0x09b0b, 0x09dff, 0 },
+	{ GEN7_CP_PROTECT_REG + 24, 0x09e1a, 0x09e1b, 1 },
+	{ GEN7_CP_PROTECT_REG + 25, 0x09e40, 0x09e40, 1 },
+	{ GEN7_CP_PROTECT_REG + 26, 0x09e64, 0x09e64, 1 },
+	{ GEN7_CP_PROTECT_REG + 27, 0x09e70, 0x09e71, 1 },
+	{ GEN7_CP_PROTECT_REG + 28, 0x09e78, 0x09fff, 1 },
+	{ GEN7_CP_PROTECT_REG + 29, 0x0a630, 0x0a7ff, 1 },
+	{ GEN7_CP_PROTECT_REG + 30, 0x0ae02, 0x0ae02, 1 },
+	{ GEN7_CP_PROTECT_REG + 31, 0x0ae50, 0x0ae5f, 1 },
+	{ GEN7_CP_PROTECT_REG + 32, 0x0ae66, 0x0ae69, 1 },
+	{ GEN7_CP_PROTECT_REG + 33, 0x0ae6f, 0x0ae72, 1 },
+	{ GEN7_CP_PROTECT_REG + 34, 0x0b602, 0x0b607, 1 },
+	{ GEN7_CP_PROTECT_REG + 35, 0x0ec00, 0x0fbff, 1 },
+	{ GEN7_CP_PROTECT_REG + 36, 0x0fc00, 0x11bff, 0 },
+	{ GEN7_CP_PROTECT_REG + 37, 0x18400, 0x1857f, 0 },
+	{ GEN7_CP_PROTECT_REG + 38, 0x18580, 0x1a57f, 1 },
+	{ GEN7_CP_PROTECT_REG + 39, 0x1a580, 0x1c57f, 1 },
+	{ GEN7_CP_PROTECT_REG + 40, 0x1c580, 0x1e57f, 1 },
+	{ GEN7_CP_PROTECT_REG + 41, 0x1f400, 0x1f843, 1 },
+	{ GEN7_CP_PROTECT_REG + 42, 0x1f844, 0x1f8b7, 0 },
+	{ GEN7_CP_PROTECT_REG + 43, 0x1f87f, 0x1f8a2, 1 },
+	{ GEN7_CP_PROTECT_REG + 44, 0x1f8b8, 0x218b7, 1 },
+	{ GEN7_CP_PROTECT_REG + 45, 0x27800, 0x2787f, 1 },
+	{ GEN7_CP_PROTECT_REG + 46, 0x27880, 0x27c01, 0 },
+	{ GEN7_CP_PROTECT_REG + 47, 0x27c02, 0x27c02, 1 },
+	{ 0 },
+};
+
+static const struct adreno_gen7_core adreno_gpu_core_gen7_9_0 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_GEN7_9_0,
+				  UINT_MAX, UINT_MAX, UINT_MAX, ANY_ID),
+		.compatible = "qcom,adreno-gpu-gen7-9-0",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT | ADRENO_AQE |
+			ADRENO_CONTENT_PROTECTION | ADRENO_LPAC | ADRENO_IFPC |
+			ADRENO_L3_VOTE | ADRENO_BCL | ADRENO_DMS |
+			ADRENO_HW_FENCE | ADRENO_PREEMPTION | ADRENO_ACD |
+			ADRENO_GMU_WARMBOOT,
+		.gpudev = &adreno_gen7_9_0_hwsched_gpudev.base,
+		.perfcounters = &adreno_gen7_9_0_hwsched_perfcounters,
+		.uche_gmem_alignment = SZ_16M,
+		.gmem_size = 3 * SZ_1M,
+		.bus_width = 32,
+		.snapshot_size = SZ_8M,
+	},
+	.aqefw_name = "gen70900_aqe.fw",
+	.sqefw_name = "gen70900_sqe.fw",
+	.gmufw_name = "gmu_gen70900.bin",
+	.zap_name = "gen70900_zap.mbn",
+	.ao_hwcg = gen7_2_0_ao_hwcg_regs,
+	.ao_hwcg_count = ARRAY_SIZE(gen7_2_0_ao_hwcg_regs),
+	.gbif = gen7_2_0_gbif_regs,
+	.gbif_count = ARRAY_SIZE(gen7_2_0_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = gen7_9_0_protected_regs,
+	.highest_bank_bit = 16,
+	.gmu_hub_clk_freq = 200000000,
+	.gen7_snapshot_block_list = &gen7_9_0_snapshot_block_list,
+	.bcl_data = 1,
+	.acv_perfmode_vote = BIT(2),
+	.ctxt_record_size = (3572 * SZ_1K),
+	.preempt_level = 1,
+};
+
+static const struct adreno_gen7_core adreno_gpu_core_gen7_9_1 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_GEN7_9_1,
+				  UINT_MAX, UINT_MAX, UINT_MAX, ANY_ID),
+		.compatible = "qcom,adreno-gpu-gen7-9-1",
+		.features = ADRENO_APRIV | ADRENO_IOCOHERENT | ADRENO_AQE |
+			ADRENO_CONTENT_PROTECTION | ADRENO_LPAC | ADRENO_IFPC |
+			ADRENO_L3_VOTE | ADRENO_BCL | ADRENO_DMS |
+			ADRENO_HW_FENCE | ADRENO_PREEMPTION | ADRENO_ACD |
+			ADRENO_GMU_WARMBOOT,
+		.gpudev = &adreno_gen7_9_0_hwsched_gpudev.base,
+		.perfcounters = &adreno_gen7_9_0_hwsched_perfcounters,
+		.uche_gmem_alignment = SZ_16M,
+		.gmem_size = 3 * SZ_1M,
+		.bus_width = 32,
+		.snapshot_size = SZ_8M,
+	},
+	.aqefw_name = "gen70900_aqe.fw",
+	.sqefw_name = "gen70900_sqe.fw",
+	.gmufw_name = "gmu_gen70900.bin",
+	.zap_name = "gen70900_zap.mbn",
+	.ao_hwcg = gen7_2_0_ao_hwcg_regs,
+	.ao_hwcg_count = ARRAY_SIZE(gen7_2_0_ao_hwcg_regs),
+	.gbif = gen7_0_0_gbif_regs,
+	.gbif_count = ARRAY_SIZE(gen7_0_0_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.protected_regs = gen7_9_0_protected_regs,
+	.highest_bank_bit = 16,
+	.gmu_hub_clk_freq = 200000000,
+	.gen7_snapshot_block_list = &gen7_9_0_snapshot_block_list,
+	.bcl_data = 1,
+	.acv_perfmode_vote = BIT(2),
+	.ctxt_record_size = (3572 * SZ_1K),
+	.preempt_level = 1,
+};
+
+static const struct kgsl_regmap_list a663_hwcg_regs[] = {
+	{A6XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
+	{A6XX_RBBM_CLOCK_CNTL2_SP0, 0x02222220},
+	{A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080},
+	{A6XX_RBBM_CLOCK_HYST_SP0, 0x0000F3CF},
+	{A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00022222},
+	{A6XX_RBBM_CLOCK_DELAY_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY2_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY3_TP0, 0x11111111},
+	{A6XX_RBBM_CLOCK_DELAY4_TP0, 0x00011111},
+	{A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST3_TP0, 0x77777777},
+	{A6XX_RBBM_CLOCK_HYST4_TP0, 0x00077777},
+	{A6XX_RBBM_CLOCK_CNTL_RB0, 0x22222222},
+	{A6XX_RBBM_CLOCK_CNTL2_RB0, 0x01002222},
+	{A6XX_RBBM_CLOCK_CNTL_CCU0, 0x00002220},
+	{A6XX_RBBM_CLOCK_HYST_RB_CCU0, 0x00040F00},
+	{A6XX_RBBM_CLOCK_CNTL_RAC, 0x25222022},
+	{A6XX_RBBM_CLOCK_CNTL2_RAC, 0x00005555},
+	{A6XX_RBBM_CLOCK_DELAY_RAC, 0x00000011},
+	{A6XX_RBBM_CLOCK_HYST_RAC, 0x00445044},
+	{A6XX_RBBM_CLOCK_CNTL_TSE_RAS_RBBM, 0x04222222},
+	{A6XX_RBBM_CLOCK_MODE_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_MODE_GPC, 0x00222222},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ_2, 0x00000002},
+	{A6XX_RBBM_CLOCK_MODE_HLSQ, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_TSE_RAS_RBBM, 0x00004000},
+	{A6XX_RBBM_CLOCK_DELAY_VFD, 0x00002222},
+	{A6XX_RBBM_CLOCK_DELAY_GPC, 0x00000200},
+	{A6XX_RBBM_CLOCK_DELAY_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_TSE_RAS_RBBM, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_VFD, 0x00000000},
+	{A6XX_RBBM_CLOCK_HYST_GPC, 0x04104004},
+	{A6XX_RBBM_CLOCK_HYST_HLSQ, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_TEX_FCHE, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_TEX_FCHE, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_TEX_FCHE, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_UCHE, 0x22222222},
+	{A6XX_RBBM_CLOCK_HYST_UCHE, 0x00000004},
+	{A6XX_RBBM_CLOCK_DELAY_UCHE, 0x00000002},
+	{A6XX_RBBM_CLOCK_CNTL, 0x8AA8AA82},
+	{A6XX_RBBM_ISDB_CNT, 0x00000182},
+	{A6XX_RBBM_RAC_THRESHOLD_CNT, 0x00000000},
+	{A6XX_RBBM_SP_HYST_CNT, 0x00000000},
+	{A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222},
+	{A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111},
+	{A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555},
+	{A6XX_GMUAO_GMU_CGC_MODE_CNTL, 0x00020200},
+	{A6XX_GMUAO_GMU_CGC_DELAY_CNTL, 0x00010111},
+	{A6XX_GMUAO_GMU_CGC_HYST_CNTL, 0x00005555},
+	{A6XX_GMUCX_GMU_WFI_CONFIG, 0x00000000},
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a663 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A663, 6, 6, 3, ANY_ID),
+		.features = ADRENO_APRIV |
+				ADRENO_IOCOHERENT | ADRENO_CONTENT_PROTECTION |
+				ADRENO_PREEMPTION | ADRENO_ACD,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.gmem_size = SZ_1M + SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x00300000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a660_sqe.fw",
+	.gmufw_name = "a663_gmu.bin",
+	.zap_name = "a663_zap.mdt",
+	.hwcg = a663_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a663_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.hang_detect_cycles = 0xcfffff,
+	.veto_fal10 = true,
+	.protected_regs = a660_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 13,
+	.pdc_in_aop = true,
+	.ctxt_record_size = 2496 * 1024,
+};
+
+static const struct adreno_a6xx_core adreno_gpu_core_a623 = {
+	.base = {
+		DEFINE_ADRENO_REV(ADRENO_REV_A623, 6, 2, 3, ANY_ID),
+		.features = ADRENO_APRIV |
+				ADRENO_IOCOHERENT | ADRENO_CONTENT_PROTECTION |
+				ADRENO_PREEMPTION | ADRENO_ACD,
+		.gpudev = &adreno_a6xx_gmu_gpudev.base,
+		.perfcounters = &adreno_a6xx_perfcounters,
+		.uche_gmem_alignment = SZ_1M + SZ_512K,
+		.gmem_size = SZ_512K,
+		.bus_width = 32,
+		.snapshot_size = SZ_2M,
+	},
+	.prim_fifo_threshold = 0x0010000,
+	.gmu_major = 2,
+	.gmu_minor = 0,
+	.sqefw_name = "a650_sqe.fw",
+	.gmufw_name = "a663_gmu.bin",
+	.zap_name = "a623_zap.mdt",
+	.hwcg = a620_hwcg_regs,
+	.hwcg_count = ARRAY_SIZE(a620_hwcg_regs),
+	.vbif = a650_gbif_regs,
+	.vbif_count = ARRAY_SIZE(a650_gbif_regs),
+	.hang_detect_cycles = 0xc3ffff,
+	.veto_fal10 = true,
+	.protected_regs = a620_protected_regs,
+	.disable_tseskip = true,
+	.highest_bank_bit = 16,
+	.pdc_in_aop = true,
+	.ctxt_record_size = 2496 * 1024,
+};
+
+static const struct adreno_gpu_core *adreno_gpulist[] = {
+	&adreno_gpu_core_a306.base,
+	&adreno_gpu_core_a306a.base,
+	&adreno_gpu_core_a304.base,
+	&adreno_gpu_core_a405,		/* Deprecated */
+	&adreno_gpu_core_a418,		/* Deprecated */
+	&adreno_gpu_core_a420,		/* Deprecated */
+	&adreno_gpu_core_a430,		/* Deprecated */
+	&adreno_gpu_core_a530v1,	/* Deprecated */
+	&adreno_gpu_core_a530v2.base,
+	&adreno_gpu_core_a530v3.base,
+	&adreno_gpu_core_a505.base,
+	&adreno_gpu_core_a506.base,
+	&adreno_gpu_core_a510.base,
+	&adreno_gpu_core_a540v1,	/* Deprecated */
+	&adreno_gpu_core_a540v2.base,
+	&adreno_gpu_core_a512.base,
+	&adreno_gpu_core_a508.base,
+	&adreno_gpu_core_a630v1,	/* Deprecated */
+	&adreno_gpu_core_a630v2.base,
+	&adreno_gpu_core_a615.base,
+	&adreno_gpu_core_a618.base,
+	&adreno_gpu_core_a619.base,
+	&adreno_gpu_core_a619_variant.base,
+	&adreno_gpu_core_a620.base,
+	&adreno_gpu_core_a621.base,
+	&adreno_gpu_core_a623.base,
+	&adreno_gpu_core_a640.base,
+	&adreno_gpu_core_a642l.base,
+	&adreno_gpu_core_a643.base,
+	&adreno_gpu_core_a650.base,
+	&adreno_gpu_core_a650v2.base,
+	&adreno_gpu_core_a660.base,
+	&adreno_gpu_core_a660v2.base,
+	&adreno_gpu_core_a663.base,
+	&adreno_gpu_core_a680.base,
+	&adreno_gpu_core_a612.base,
+	&adreno_gpu_core_a616.base,
+	&adreno_gpu_core_a610.base,
+	&adreno_gpu_core_a660_shima.base,
+	&adreno_gpu_core_a702.base,
+	&adreno_gpu_core_gen7_0_0.base,
+	&adreno_gpu_core_gen7_0_1.base,
+	&adreno_gpu_core_a662.base,
+	&adreno_gpu_core_gen7_2_0.base,
+	&adreno_gpu_core_gen7_2_1.base,
+	&adreno_gpu_core_gen7_4_0.base,
+	&adreno_gpu_core_gen7_9_0.base,
+	&adreno_gpu_core_gen7_9_1.base,
+
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno.c
@@ -0,0 +1,3732 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/component.h>
+#include <linux/delay.h>
+#include <linux/firmware.h>
+#include <linux/input.h>
+#include <linux/interconnect.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/of_fdt.h>
+#include <linux/module.h>
+#include <linux/msm_kgsl.h>
+#include <linux/regulator/consumer.h>
+#include <linux/nvmem-consumer.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+#include <linux/trace.h>
+#include <linux/version.h>
+#include <soc/qcom/dcvs.h>
+#include <soc/qcom/socinfo.h>
+#include <linux/suspend.h>
+
+#include "adreno.h"
+#include "adreno_a3xx.h"
+#include "adreno_a5xx.h"
+#include "adreno_a6xx.h"
+#include "adreno_compat.h"
+#include "adreno_pm4types.h"
+#include "adreno_trace.h"
+#include "kgsl_bus.h"
+#include "kgsl_reclaim.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+/* Include the master list of GPU cores that are supported */
+#include "adreno-gpulist.h"
+
+static void adreno_unbind(struct device *dev);
+static void adreno_input_work(struct work_struct *work);
+static int adreno_soft_reset(struct kgsl_device *device);
+static unsigned int counter_delta(struct kgsl_device *device,
+	unsigned int reg, unsigned int *counter);
+static struct device_node *
+	adreno_get_gpu_model_node(struct platform_device *pdev);
+
+static struct adreno_device device_3d0;
+static bool adreno_preemption_enable;
+
+/* Nice level for the higher priority GPU start thread */
+int adreno_wake_nice = -7;
+
+/* Number of milliseconds to stay active active after a wake on touch */
+unsigned int adreno_wake_timeout = 100;
+
+static u32 get_ucode_version(const u32 *data)
+{
+	u32 version;
+
+	version = data[1];
+
+	if ((version & 0xf) != 0xa)
+		return version;
+
+	version &= ~0xfff;
+	return  version | ((data[3] & 0xfff000) >> 12);
+}
+
+int adreno_get_firmware(struct adreno_device *adreno_dev,
+		const char *fwfile, struct adreno_firmware *firmware)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct firmware *fw = NULL;
+	int ret;
+
+	if (!IS_ERR_OR_NULL(firmware->memdesc))
+		return 0;
+
+	ret = request_firmware(&fw, fwfile, &device->pdev->dev);
+
+	if (ret) {
+		dev_err(device->dev, "request_firmware(%s) failed: %d\n",
+				fwfile, ret);
+		return ret;
+	}
+
+	firmware->memdesc = kgsl_allocate_global(device, fw->size - 4, 0,
+				KGSL_MEMFLAGS_GPUREADONLY, KGSL_MEMDESC_UCODE,
+				"ucode");
+
+	ret = PTR_ERR_OR_ZERO(firmware->memdesc);
+	if (!ret) {
+		memcpy(firmware->memdesc->hostptr, &fw->data[4], fw->size - 4);
+		firmware->size = (fw->size - 4) / sizeof(u32);
+		firmware->version = get_ucode_version((u32 *)fw->data);
+	}
+
+	release_firmware(fw);
+	return ret;
+}
+
+
+int adreno_zap_shader_load(struct adreno_device *adreno_dev,
+		const char *name)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (!name || adreno_dev->zap_loaded || IS_ENABLED(CONFIG_QCOM_KVM_ENABLED))
+		return 0;
+
+	ret = kgsl_zap_shader_load(&device->pdev->dev, name);
+	if (!ret)
+		adreno_dev->zap_loaded = true;
+
+	return ret;
+}
+
+#if (IS_ENABLED(CONFIG_QCOM_KGSL_HIBERNATION) || IS_ENABLED(CONFIG_DEEPSLEEP))
+static void adreno_zap_shader_unload(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (adreno_dev->zap_loaded) {
+		ret = kgsl_zap_shader_unload(&device->pdev->dev);
+		if (!ret)
+			adreno_dev->zap_loaded = false;
+	}
+}
+#endif
+
+/**
+ * adreno_readreg64() - Read a 64bit register by getting its offset from the
+ * offset array defined in gpudev node
+ * @adreno_dev:		Pointer to the the adreno device
+ * @lo:	lower 32bit register enum that is to be read
+ * @hi:	higher 32bit register enum that is to be read
+ * @val: 64 bit Register value read is placed here
+ */
+void adreno_readreg64(struct adreno_device *adreno_dev,
+		enum adreno_regs lo, enum adreno_regs hi, uint64_t *val)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	unsigned int val_lo = 0, val_hi = 0;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (adreno_checkreg_off(adreno_dev, lo))
+		kgsl_regread(device, gpudev->reg_offsets[lo], &val_lo);
+	if (adreno_checkreg_off(adreno_dev, hi))
+		kgsl_regread(device, gpudev->reg_offsets[hi], &val_hi);
+
+	*val = (val_lo | ((uint64_t)val_hi << 32));
+}
+
+/**
+ * adreno_get_rptr() - Get the current ringbuffer read pointer
+ * @rb: Pointer the ringbuffer to query
+ *
+ * Get the latest rptr
+ */
+unsigned int adreno_get_rptr(struct adreno_ringbuffer *rb)
+{
+	struct adreno_device *adreno_dev = ADRENO_RB_DEVICE(rb);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 rptr = 0;
+
+	if (adreno_is_a3xx(adreno_dev))
+		kgsl_regread(device, A3XX_CP_RB_RPTR, &rptr);
+	else
+		kgsl_sharedmem_readl(device->scratch, &rptr,
+				SCRATCH_RB_OFFSET(rb->id, rptr));
+
+	return rptr;
+}
+
+static void adreno_touch_wakeup(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/*
+	 * Don't schedule adreno_start in a high priority workqueue, we are
+	 * already in a workqueue which should be sufficient
+	 */
+	kgsl_pwrctrl_change_state(device, KGSL_STATE_ACTIVE);
+
+	/*
+	 * When waking up from a touch event we want to stay active long enough
+	 * for the user to send a draw command.  The default idle timer timeout
+	 * is shorter than we want so go ahead and push the idle timer out
+	 * further for this special case
+	 */
+	mod_timer(&device->idle_timer,
+		jiffies + msecs_to_jiffies(adreno_wake_timeout));
+
+}
+
+/*
+ * A workqueue callback responsible for actually turning on the GPU after a
+ * touch event. kgsl_pwrctrl_change_state(ACTIVE) is used without any
+ * active_count protection to avoid the need to maintain state.  Either
+ * somebody will start using the GPU or the idle timer will fire and put the
+ * GPU back into slumber.
+ */
+static void adreno_input_work(struct work_struct *work)
+{
+	struct adreno_device *adreno_dev = container_of(work,
+			struct adreno_device, input_work);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_power_ops *ops = ADRENO_POWER_OPS(adreno_dev);
+
+	mutex_lock(&device->mutex);
+
+	adreno_dev->wake_on_touch = true;
+
+	ops->touch_wakeup(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+}
+
+/* Wake up the touch event kworker to initiate GPU wakeup */
+void adreno_touch_wake(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	/*
+	 * Don't do anything if anything hasn't been rendered since we've been
+	 * here before
+	 */
+
+	if (adreno_dev->wake_on_touch)
+		return;
+
+	if (gmu_core_isenabled(device) || (device->state == KGSL_STATE_SLUMBER))
+		schedule_work(&adreno_dev->input_work);
+}
+
+/*
+ * Process input events and schedule work if needed.  At this point we are only
+ * interested in groking EV_ABS touchscreen events
+ */
+static void adreno_input_event(struct input_handle *handle, unsigned int type,
+		unsigned int code, int value)
+{
+	struct kgsl_device *device = handle->handler->private;
+
+	/* Only consider EV_ABS (touch) events */
+	if (type == EV_ABS)
+		adreno_touch_wake(device);
+}
+
+#ifdef CONFIG_INPUT
+static int adreno_input_connect(struct input_handler *handler,
+		struct input_dev *dev, const struct input_device_id *id)
+{
+	struct input_handle *handle;
+	int ret;
+
+	handle = kzalloc(sizeof(*handle), GFP_KERNEL);
+	if (handle == NULL)
+		return -ENOMEM;
+
+	handle->dev = dev;
+	handle->handler = handler;
+	handle->name = handler->name;
+
+	ret = input_register_handle(handle);
+	if (ret) {
+		kfree(handle);
+		return ret;
+	}
+
+	ret = input_open_device(handle);
+	if (ret) {
+		input_unregister_handle(handle);
+		kfree(handle);
+	}
+
+	return ret;
+}
+
+static void adreno_input_disconnect(struct input_handle *handle)
+{
+	input_close_device(handle);
+	input_unregister_handle(handle);
+	kfree(handle);
+}
+#else
+static int adreno_input_connect(struct input_handler *handler,
+		struct input_dev *dev, const struct input_device_id *id)
+{
+	return 0;
+}
+static void adreno_input_disconnect(struct input_handle *handle) {}
+#endif
+
+/*
+ * We are only interested in EV_ABS events so only register handlers for those
+ * input devices that have EV_ABS events
+ */
+static const struct input_device_id adreno_input_ids[] = {
+	{
+		.flags = INPUT_DEVICE_ID_MATCH_EVBIT,
+		.evbit = { BIT_MASK(EV_ABS) },
+		/* assumption: MT_.._X & MT_.._Y are in the same long */
+		.absbit = { [BIT_WORD(ABS_MT_POSITION_X)] =
+				BIT_MASK(ABS_MT_POSITION_X) |
+				BIT_MASK(ABS_MT_POSITION_Y) },
+	},
+	{ },
+};
+
+static struct input_handler adreno_input_handler = {
+	.event = adreno_input_event,
+	.connect = adreno_input_connect,
+	.disconnect = adreno_input_disconnect,
+	.name = "kgsl",
+	.id_table = adreno_input_ids,
+};
+
+/*
+ * _soft_reset() - Soft reset GPU
+ * @adreno_dev: Pointer to adreno device
+ *
+ * Soft reset the GPU by doing a AHB write of value 1 to RBBM_SW_RESET
+ * register. This is used when we want to reset the GPU without
+ * turning off GFX power rail. The reset when asserted resets
+ * all the HW logic, restores GPU registers to default state and
+ * flushes out pending VBIF transactions.
+ */
+static void _soft_reset(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+	unsigned int reg;
+
+	adreno_writereg(adreno_dev, ADRENO_REG_RBBM_SW_RESET_CMD, 1);
+	/*
+	 * Do a dummy read to get a brief read cycle delay for the
+	 * reset to take effect
+	 */
+	adreno_readreg(adreno_dev, ADRENO_REG_RBBM_SW_RESET_CMD, &reg);
+	adreno_writereg(adreno_dev, ADRENO_REG_RBBM_SW_RESET_CMD, 0);
+
+	/* The SP/TP regulator gets turned off after a soft reset */
+
+	clear_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED, &adreno_dev->priv);
+	if (gpudev->regulator_enable)
+		gpudev->regulator_enable(adreno_dev);
+}
+
+/**
+ * adreno_irqctrl() - Enables/disables the RBBM interrupt mask
+ * @adreno_dev: Pointer to an adreno_device
+ * @state: 1 for masked or 0 for unmasked
+ * Power: The caller of this function must make sure to use OOBs
+ * so that we know that the GPU is powered on
+ */
+void adreno_irqctrl(struct adreno_device *adreno_dev, int state)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	adreno_writereg(adreno_dev, ADRENO_REG_RBBM_INT_0_MASK,
+		state ? adreno_dev->irq_mask : 0);
+
+	if (gpudev->swfuse_irqctrl)
+		gpudev->swfuse_irqctrl(adreno_dev, state);
+}
+
+/*
+ * adreno_hang_int_callback() - Isr for fatal interrupts that hang GPU
+ * @adreno_dev: Pointer to device
+ * @bit: Interrupt bit
+ */
+void adreno_hang_int_callback(struct adreno_device *adreno_dev, int bit)
+{
+	dev_crit_ratelimited(KGSL_DEVICE(adreno_dev)->dev,
+				"MISC: GPU hang detected\n");
+	adreno_irqctrl(adreno_dev, 0);
+
+	/* Trigger a fault in the dispatcher - this will effect a restart */
+	adreno_dispatcher_fault(adreno_dev, ADRENO_HARD_FAULT);
+}
+
+/*
+ * adreno_cp_callback() - CP interrupt handler
+ * @adreno_dev: Adreno device pointer
+ * @irq: irq number
+ *
+ * Handle the cp interrupt generated by GPU.
+ */
+void adreno_cp_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	adreno_dispatcher_schedule(device);
+}
+
+static irqreturn_t adreno_irq_handler(int irq, void *data)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	irqreturn_t ret;
+
+	atomic_inc(&adreno_dev->pending_irq_refcnt);
+	/* Ensure this increment is done before the IRQ status is updated */
+	smp_mb__after_atomic();
+
+	ret = gpudev->irq_handler(adreno_dev);
+
+	/* Make sure the regwrites are done before the decrement */
+	smp_mb__before_atomic();
+	atomic_dec(&adreno_dev->pending_irq_refcnt);
+	/* Ensure other CPUs see the decrement */
+	smp_mb__after_atomic();
+
+	return ret;
+}
+
+irqreturn_t adreno_irq_callbacks(struct adreno_device *adreno_dev,
+		const struct adreno_irq_funcs *funcs, u32 status)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	irqreturn_t ret = IRQ_NONE;
+
+	/* Loop through all set interrupts and call respective handlers */
+	while (status) {
+		int i = fls(status) - 1;
+
+		if (funcs[i].func) {
+			if (adreno_dev->irq_mask & BIT(i))
+				funcs[i].func(adreno_dev, i);
+		} else
+			dev_crit_ratelimited(device->dev,
+				"Unhandled interrupt bit %x\n", i);
+
+		ret = IRQ_HANDLED;
+
+		status &= ~BIT(i);
+	}
+
+	return ret;
+}
+
+static int adreno_get_chipid(struct platform_device *pdev, u32 *chipid);
+
+static inline bool _rev_match(unsigned int id, unsigned int entry)
+{
+	return (entry == ANY_ID || entry == id);
+}
+
+static const struct adreno_gpu_core *
+_get_gpu_core(struct platform_device *pdev, u32 *chipid)
+{
+	int i;
+	struct device_node *node;
+
+	/*
+	 * When "qcom,gpu-models" is defined, use gpu model node to match
+	 * on a compatible string, otherwise match using legacy way.
+	 */
+	node = adreno_get_gpu_model_node(pdev);
+	if (!node || !of_find_property(node, "compatible", NULL))
+		node = pdev->dev.of_node;
+
+	*chipid = 0;
+
+	/* Check to see if any of the entries match on a compatible string */
+	for (i = 0; i < ARRAY_SIZE(adreno_gpulist); i++) {
+		if (adreno_gpulist[i]->compatible &&
+				of_device_is_compatible(node,
+					adreno_gpulist[i]->compatible)) {
+			/*
+			 * We matched compat string, set chipid based on
+			 * dtsi, else fail.
+			 */
+			if (!adreno_get_chipid(pdev, chipid))
+				return adreno_gpulist[i];
+
+			dev_crit(&pdev->dev,
+					"No chipid associated with %s\n",
+					adreno_gpulist[i]->compatible);
+			return NULL;
+		}
+	}
+
+	/* No compatible string so try and match on chipid */
+	if (!adreno_get_chipid(pdev, chipid)) {
+		unsigned int core = ADRENO_CHIPID_CORE(*chipid);
+		unsigned int major = ADRENO_CHIPID_MAJOR(*chipid);
+		unsigned int minor = ADRENO_CHIPID_MINOR(*chipid);
+		unsigned int patchid = ADRENO_CHIPID_PATCH(*chipid);
+
+		for (i = 0; i < ARRAY_SIZE(adreno_gpulist); i++) {
+			if (core == adreno_gpulist[i]->core &&
+				_rev_match(major, adreno_gpulist[i]->major) &&
+				_rev_match(minor, adreno_gpulist[i]->minor) &&
+				_rev_match(patchid, adreno_gpulist[i]->patchid))
+				return adreno_gpulist[i];
+		}
+	}
+
+	dev_crit(&pdev->dev, "Unknown GPU chip ID %8.8x\n", *chipid);
+	return NULL;
+}
+
+static struct {
+	unsigned int quirk;
+	const char *prop;
+} adreno_quirks[] = {
+	 { ADRENO_QUIRK_TWO_PASS_USE_WFI, "qcom,gpu-quirk-two-pass-use-wfi" },
+	 { ADRENO_QUIRK_CRITICAL_PACKETS, "qcom,gpu-quirk-critical-packets" },
+	 { ADRENO_QUIRK_FAULT_DETECT_MASK, "qcom,gpu-quirk-fault-detect-mask" },
+	 { ADRENO_QUIRK_DISABLE_RB_DP2CLOCKGATING,
+			"qcom,gpu-quirk-dp2clockgating-disable" },
+	 { ADRENO_QUIRK_DISABLE_LMLOADKILL,
+			"qcom,gpu-quirk-lmloadkill-disable" },
+	{ ADRENO_QUIRK_HFI_USE_REG, "qcom,gpu-quirk-hfi-use-reg" },
+	{ ADRENO_QUIRK_SECVID_SET_ONCE, "qcom,gpu-quirk-secvid-set-once" },
+	{ ADRENO_QUIRK_LIMIT_UCHE_GBIF_RW,
+			"qcom,gpu-quirk-limit-uche-gbif-rw" },
+	{ ADRENO_QUIRK_CX_GDSC, "qcom,gpu-quirk-cx-gdsc" },
+};
+
+static int adreno_get_chipid(struct platform_device *pdev, u32 *chipid)
+{
+	u32 id;
+
+	if (!of_property_read_u32(pdev->dev.of_node, "qcom,chipid", chipid))
+		return 0;
+
+	id = socinfo_get_partinfo_chip_id(SOCINFO_PART_GPU);
+	if (id)
+		*chipid = id;
+
+	return id ? 0 : -EINVAL;
+}
+
+static void
+adreno_update_soc_hw_revision_quirks(struct adreno_device *adreno_dev,
+		struct platform_device *pdev)
+{
+	struct device_node *node = pdev->dev.of_node;
+	int i;
+
+	/* update quirk */
+	for (i = 0; i < ARRAY_SIZE(adreno_quirks); i++) {
+		if (of_property_read_bool(node, adreno_quirks[i].prop))
+			adreno_dev->quirks |= adreno_quirks[i].quirk;
+	}
+}
+
+static const struct adreno_gpu_core *
+adreno_identify_gpu(struct platform_device *pdev, u32 *chipid)
+{
+	const struct adreno_gpu_core *gpucore;
+
+	gpucore = _get_gpu_core(pdev, chipid);
+	if (!gpucore)
+		return ERR_PTR(-ENODEV);
+
+	/*
+	 * Identify non-longer supported targets and spins and print a helpful
+	 * message
+	 */
+	if (gpucore->features & ADRENO_DEPRECATED) {
+		if (gpucore->compatible)
+			dev_err(&pdev->dev,
+				"Support for GPU %s has been deprecated\n",
+				gpucore->compatible);
+		else
+			dev_err(&pdev->dev,
+				"Support for GPU %x.%d.%x.%d has been deprecated\n",
+				gpucore->core, gpucore->major,
+				gpucore->minor, gpucore->patchid);
+		return ERR_PTR(-ENODEV);
+	}
+
+	return gpucore;
+}
+
+static const struct of_device_id adreno_match_table[] = {
+	{ .compatible = "qcom,kgsl-3d0", .data = &device_3d0 },
+	{ .compatible = "qcom,kgsl", .data = &device_3d0 },
+	{ },
+};
+
+MODULE_DEVICE_TABLE(of, adreno_match_table);
+
+/* Dynamically build the OPP table for the GPU device */
+static void adreno_build_opp_table(struct device *dev, struct kgsl_pwrctrl *pwr)
+{
+	int i;
+
+	/* Skip if the table has already been populated */
+	if (dev_pm_opp_get_opp_count(dev) > 0)
+		return;
+
+	/* Add all the supported frequencies into the tree */
+	for (i = 0; i < pwr->num_pwrlevels; i++)
+		dev_pm_opp_add(dev, pwr->pwrlevels[i].gpu_freq, 0);
+}
+
+static int adreno_of_parse_pwrlevels(struct adreno_device *adreno_dev,
+		struct device_node *node)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct device_node *child;
+	int ret;
+
+	pwr->num_pwrlevels = 0;
+
+	for_each_child_of_node(node, child) {
+		u32 index, freq = 0, voltage, bus;
+		struct kgsl_pwrlevel *level;
+
+		ret = of_property_read_u32(child, "reg", &index);
+		if (ret) {
+			dev_err(device->dev, "%pOF: powerlevel index not found\n",
+				child);
+			goto out;
+		}
+
+		ret = of_property_read_u32(child, "qcom,gpu-freq", &freq);
+		if (ret) {
+			dev_err(device->dev, "%pOF: Unable to read qcom,gpu-freq\n",
+				child);
+			goto out;
+		}
+
+		/* Ignore "zero" powerlevels */
+		if (!freq)
+			continue;
+
+		ret = of_property_read_u32(child, "qcom,level", &voltage);
+		if (ret) {
+			dev_err(device->dev, "%pOF: Unable to read qcom,level\n",
+				child);
+			goto out;
+		}
+
+		ret = kgsl_of_property_read_ddrtype(child, "qcom,bus-freq",
+			&bus);
+		if (ret) {
+			dev_err(device->dev, "%pOF:Unable to read qcom,bus-freq\n",
+				child);
+			goto out;
+		}
+
+		if (index >= ARRAY_SIZE(pwr->pwrlevels)) {
+			dev_err(device->dev, "%pOF: Pwrlevel index %d is out of range\n",
+				child, index);
+			continue;
+		}
+
+		if (index >= pwr->num_pwrlevels)
+			pwr->num_pwrlevels = index + 1;
+
+		level = &pwr->pwrlevels[index];
+
+		level->gpu_freq = freq;
+		level->bus_freq = bus;
+		level->voltage_level = voltage;
+		level->cx_level = 0xffffffff;
+
+		of_property_read_u32(child, "qcom,acd-level",
+			&level->acd_level);
+
+		of_property_read_u32(child, "qcom,cx-level",
+			&level->cx_level);
+
+		level->bus_min = level->bus_freq;
+		kgsl_of_property_read_ddrtype(child,
+			"qcom,bus-min", &level->bus_min);
+
+		level->bus_max = level->bus_freq;
+		kgsl_of_property_read_ddrtype(child,
+			"qcom,bus-max", &level->bus_max);
+	}
+
+	adreno_build_opp_table(&device->pdev->dev, pwr);
+	return 0;
+out:
+	of_node_put(child);
+	return ret;
+}
+
+static void adreno_of_get_initial_pwrlevels(struct kgsl_pwrctrl *pwr,
+		struct device_node *node)
+{
+	int level;
+
+	/* Get and set the initial power level */
+	if (of_property_read_u32(node, "qcom,initial-pwrlevel", &level))
+		level = 1;
+
+	if (level < 0 || level >= pwr->num_pwrlevels)
+		level = 1;
+
+	pwr->active_pwrlevel = level;
+	pwr->default_pwrlevel = level;
+
+	/* Set the max power level */
+	pwr->max_pwrlevel = 0;
+
+	/* Get and set the min power level */
+	if (of_property_read_u32(node, "qcom,initial-min-pwrlevel", &level))
+		level = pwr->num_pwrlevels - 1;
+
+	if (level < 0 || level >= pwr->num_pwrlevels || level < pwr->default_pwrlevel)
+		level = pwr->num_pwrlevels - 1;
+
+	pwr->min_pwrlevel = level;
+}
+
+static void adreno_of_get_limits(struct adreno_device *adreno_dev,
+		struct device_node *node)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwrctrl = &device->pwrctrl;
+	unsigned int throttle_level;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_LM) || of_property_read_u32(node,
+				"qcom,throttle-pwrlevel", &throttle_level))
+		return;
+
+	throttle_level = min(throttle_level, pwrctrl->num_pwrlevels - 1);
+
+	pwrctrl->throttle_mask = GENMASK(pwrctrl->num_pwrlevels - 1,
+			pwrctrl->num_pwrlevels - 1 - throttle_level);
+
+	adreno_dev->lm_enabled = true;
+}
+
+static int adreno_of_get_legacy_pwrlevels(struct adreno_device *adreno_dev,
+		struct device_node *parent)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct device_node *node;
+	int ret;
+
+	node = of_find_node_by_name(parent, "qcom,gpu-pwrlevels");
+
+	if (node == NULL) {
+		dev_err(&device->pdev->dev,
+			"Unable to find 'qcom,gpu-pwrlevels'\n");
+		return -EINVAL;
+	}
+
+	ret = adreno_of_parse_pwrlevels(adreno_dev, node);
+
+	if (!ret) {
+		adreno_of_get_initial_pwrlevels(&device->pwrctrl, parent);
+		adreno_of_get_limits(adreno_dev, parent);
+	}
+
+	of_node_put(node);
+	return ret;
+}
+
+static int adreno_of_get_pwrlevels(struct adreno_device *adreno_dev,
+		struct device_node *parent)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct device_node *node, *child;
+	int feature_code, pcode;
+	u32 soc_code;
+
+	node = of_find_node_by_name(parent, "qcom,gpu-pwrlevel-bins");
+	if (node == NULL)
+		return adreno_of_get_legacy_pwrlevels(adreno_dev, parent);
+
+	feature_code = max_t(int, socinfo_get_feature_code(), SOCINFO_FC_UNKNOWN);
+	pcode = (feature_code >= SOCINFO_FC_Y0 && feature_code < SOCINFO_FC_INT_RESERVE) ?
+		max_t(int, socinfo_get_pcode(), SOCINFO_PCODE_UNKNOWN) : SOCINFO_PCODE_UNKNOWN;
+
+	soc_code = FIELD_PREP(GENMASK(31, 16), pcode) | FIELD_PREP(GENMASK(15, 0), feature_code);
+
+	for_each_child_of_node(node, child) {
+		bool match = false;
+		int tbl_size;
+		u32 bin = 0;
+
+		/* Check if the bin has a speed-bin requirement */
+		if (!of_property_read_u32(child, "qcom,speed-bin", &bin))
+			match = (bin == device->speed_bin);
+
+		/* Check if the bin has a sku-code requirement */
+		if (of_get_property(child, "qcom,sku-codes", &tbl_size)) {
+			int num_codes = tbl_size / sizeof(u32);
+			int i;
+			u32 sku_code;
+
+			/*
+			 * If we have a speed-bin requirement that did not match
+			 * keep searching.
+			 */
+			if (bin && !match)
+				continue;
+
+			/* Check if the soc_code matches any of the sku codes */
+			match = false;
+			for (i = 0; i < num_codes; i++) {
+				if (!of_property_read_u32_index(child, "qcom,sku-codes",
+								i, &sku_code) &&
+					(sku_code == 0 || soc_code == sku_code)) {
+					match = true;
+					break;
+				}
+			}
+		}
+
+		if (match) {
+			int ret;
+
+			ret = adreno_of_parse_pwrlevels(adreno_dev, child);
+			if (ret) {
+				of_node_put(child);
+				return ret;
+			}
+
+			adreno_of_get_initial_pwrlevels(&device->pwrctrl, child);
+
+			/*
+			 * Check for global throttle-pwrlevel first and override
+			 * with speedbin specific one if found.
+			 */
+			adreno_of_get_limits(adreno_dev, parent);
+			adreno_of_get_limits(adreno_dev, child);
+
+			of_node_put(child);
+			return 0;
+		}
+	}
+
+	dev_err(&device->pdev->dev,
+		"No match for speed_bin:%d and soc_code:0x%x\n",
+		device->speed_bin, soc_code);
+	return -ENODEV;
+}
+
+static int register_l3_voter(struct kgsl_device *device)
+{
+	int ret = 0;
+
+	mutex_lock(&device->mutex);
+
+	if (!device->l3_vote)
+		goto done;
+
+	/* This indicates that we are already set up */
+	if (device->num_l3_pwrlevels != 0)
+		goto done;
+
+	memset(device->l3_freq, 0x0, sizeof(device->l3_freq));
+
+	ret = qcom_dcvs_register_voter(KGSL_L3_DEVICE, DCVS_L3, DCVS_SLOW_PATH);
+	if (ret) {
+		dev_err_once(&device->pdev->dev,
+			"Unable to register l3 dcvs voter: %d\n", ret);
+		goto done;
+	}
+
+	ret = qcom_dcvs_hw_minmax_get(DCVS_L3, &device->l3_freq[1],
+		&device->l3_freq[2]);
+	if (ret) {
+		dev_err_once(&device->pdev->dev,
+			"Unable to get min/max for l3 dcvs: %d\n", ret);
+		qcom_dcvs_unregister_voter(KGSL_L3_DEVICE, DCVS_L3,
+			DCVS_SLOW_PATH);
+		memset(device->l3_freq, 0x0, sizeof(device->l3_freq));
+		goto done;
+	}
+
+	device->num_l3_pwrlevels = 3;
+
+done:
+	mutex_unlock(&device->mutex);
+
+	return ret;
+}
+
+static int adreno_of_get_power(struct adreno_device *adreno_dev,
+		struct platform_device *pdev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	ret = adreno_of_get_pwrlevels(adreno_dev, pdev->dev.of_node);
+	if (ret)
+		return ret;
+
+	device->pwrctrl.interval_timeout = CONFIG_QCOM_KGSL_IDLE_TIMEOUT;
+
+	/* Set default bus control to true on all targets */
+	device->pwrctrl.bus_control = true;
+
+	return 0;
+}
+
+static void adreno_cx_misc_probe(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct resource *res;
+
+	res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM,
+					   "cx_misc");
+
+	if (res == NULL)
+		return;
+
+	adreno_dev->cx_misc_len = resource_size(res);
+	adreno_dev->cx_misc_virt = devm_ioremap(&device->pdev->dev,
+					res->start, adreno_dev->cx_misc_len);
+}
+
+static void adreno_isense_probe(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct resource *res;
+
+	res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM,
+			"isense_cntl");
+	if (res == NULL)
+		return;
+
+	adreno_dev->isense_base = res->start - device->regmap.base->start;
+	adreno_dev->isense_len = resource_size(res);
+	adreno_dev->isense_virt = devm_ioremap(&device->pdev->dev, res->start,
+					adreno_dev->isense_len);
+	if (adreno_dev->isense_virt == NULL)
+		dev_warn(device->dev, "isense ioremap failed\n");
+}
+
+/* Read the fuse through the new and fancy nvmem method */
+static int adreno_read_speed_bin(struct platform_device *pdev)
+{
+	struct nvmem_cell *cell = nvmem_cell_get(&pdev->dev, "speed_bin");
+	int ret = PTR_ERR_OR_ZERO(cell);
+	void *buf;
+	int val = 0;
+	size_t len;
+
+	if (ret) {
+		if (ret == -ENOENT)
+			return 0;
+
+		return ret;
+	}
+
+	buf = nvmem_cell_read(cell, &len);
+	nvmem_cell_put(cell);
+
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
+
+	memcpy(&val, buf, min(len, sizeof(val)));
+	kfree(buf);
+
+	return val;
+}
+
+static int adreno_read_gpu_model_fuse(struct platform_device *pdev)
+{
+	struct nvmem_cell *cell = nvmem_cell_get(&pdev->dev, "gpu_model");
+	void *buf;
+	int val = 0;
+	size_t len;
+
+	if (IS_ERR(cell))
+		return PTR_ERR(cell);
+
+	buf = nvmem_cell_read(cell, &len);
+	nvmem_cell_put(cell);
+
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
+
+	memcpy(&val, buf, min(len, sizeof(val)));
+	kfree(buf);
+
+	return val;
+}
+
+static struct device_node *
+adreno_get_gpu_model_node(struct platform_device *pdev)
+{
+	struct device_node *node, *child;
+	int fuse_model = adreno_read_gpu_model_fuse(pdev);
+
+	if (fuse_model < 0)
+		return NULL;
+
+	node = of_find_node_by_name(pdev->dev.of_node, "qcom,gpu-models");
+	if (node == NULL)
+		return NULL;
+
+	for_each_child_of_node(node, child) {
+		u32 model;
+
+		if (of_property_read_u32(child, "qcom,gpu-model-id", &model))
+			continue;
+
+		if (model == fuse_model) {
+			of_node_put(node);
+			return child;
+		}
+	}
+
+	of_node_put(node);
+
+	return NULL;
+}
+
+const char *adreno_get_gpu_model(struct kgsl_device *device)
+{
+	struct device_node *node;
+	static char gpu_model[32];
+	const char *model;
+	int ret;
+
+	if (strlen(gpu_model))
+		return gpu_model;
+
+	node = adreno_get_gpu_model_node(device->pdev);
+	if (!node)
+		node = of_node_get(device->pdev->dev.of_node);
+
+	ret = of_property_read_string(node, "qcom,gpu-model", &model);
+	of_node_put(node);
+
+	if (!ret)
+		goto done;
+
+	model = socinfo_get_partinfo_part_name(SOCINFO_PART_GPU);
+	if (model)
+		goto done;
+
+	scnprintf(gpu_model, sizeof(gpu_model), "Adreno%u%u%uv%u",
+		(u32)ADRENO_CHIPID_CORE(ADRENO_DEVICE(device)->chipid),
+		(u32)ADRENO_CHIPID_MAJOR(ADRENO_DEVICE(device)->chipid),
+		(u32)ADRENO_CHIPID_MINOR(ADRENO_DEVICE(device)->chipid),
+		(u32)ADRENO_CHIPID_PATCH(ADRENO_DEVICE(device)->chipid) + 1);
+
+	return gpu_model;
+
+done:
+	strscpy(gpu_model, model, sizeof(gpu_model));
+	return gpu_model;
+}
+
+static u32 adreno_get_vk_device_id(struct kgsl_device *device)
+{
+	struct device_node *node;
+	static u32 device_id;
+	u32 vk_id;
+	int ret;
+
+	if (device_id)
+		return device_id;
+
+	node = adreno_get_gpu_model_node(device->pdev);
+	if (!node)
+		node = of_node_get(device->pdev->dev.of_node);
+
+	ret = of_property_read_u32(node, "qcom,vk-device-id", &device_id);
+	of_node_put(node);
+	if (!ret)
+		return device_id;
+
+	vk_id = socinfo_get_partinfo_vulkan_id(SOCINFO_PART_GPU);
+	device_id = vk_id ? vk_id : ADRENO_DEVICE(device)->chipid;
+
+	return device_id;
+}
+
+#if IS_ENABLED(CONFIG_QCOM_LLCC)
+static int adreno_probe_llcc(struct adreno_device *adreno_dev,
+		struct platform_device *pdev)
+{
+	int ret;
+
+	/* Get the system cache slice descriptor for GPU */
+	adreno_dev->gpu_llc_slice = llcc_slice_getd(LLCC_GPU);
+	ret = PTR_ERR_OR_ZERO(adreno_dev->gpu_llc_slice);
+
+	if (ret) {
+		/* Propagate EPROBE_DEFER back to the probe function */
+		if (ret == -EPROBE_DEFER)
+			return ret;
+
+		if (ret != -ENOENT)
+			dev_warn(&pdev->dev,
+				"Unable to get the GPU LLC slice: %d\n", ret);
+	} else
+		adreno_dev->gpu_llc_slice_enable = true;
+
+	/* Get the system cache slice descriptor for GPU pagetables */
+	adreno_dev->gpuhtw_llc_slice = llcc_slice_getd(LLCC_GPUHTW);
+	ret = PTR_ERR_OR_ZERO(adreno_dev->gpuhtw_llc_slice);
+	if (ret) {
+		if (ret == -EPROBE_DEFER) {
+			llcc_slice_putd(adreno_dev->gpu_llc_slice);
+			return ret;
+		}
+
+		if (ret != -ENOENT)
+			dev_warn(&pdev->dev,
+				"Unable to get GPU HTW LLC slice: %d\n", ret);
+	} else
+		adreno_dev->gpuhtw_llc_slice_enable = true;
+
+	return 0;
+}
+#else
+static int adreno_probe_llcc(struct adreno_device *adreno_dev,
+		struct platform_device *pdev)
+{
+	return 0;
+}
+#endif
+
+static void adreno_regmap_op_preaccess(struct kgsl_regmap_region *region)
+{
+	struct kgsl_device *device = region->priv;
+	/*
+	 * kgsl panic notifier will be called in atomic context to get
+	 * GPU snapshot. Also panic handler will skip snapshot dumping
+	 * incase GPU is in SLUMBER state. So we can safely ignore the
+	 * kgsl_pre_hwaccess().
+	 */
+	if (!device->snapshot_atomic && !in_interrupt())
+		kgsl_pre_hwaccess(device);
+}
+
+static const struct kgsl_regmap_ops adreno_regmap_ops = {
+	.preaccess = adreno_regmap_op_preaccess,
+};
+
+static const struct kgsl_functable adreno_functable;
+
+static void adreno_setup_device(struct adreno_device *adreno_dev)
+{
+	u32 i;
+
+	adreno_dev->dev.name = "kgsl-3d0";
+	adreno_dev->dev.ftbl = &adreno_functable;
+
+	init_completion(&adreno_dev->dev.hwaccess_gate);
+	init_completion(&adreno_dev->dev.halt_gate);
+
+	idr_init(&adreno_dev->dev.context_idr);
+
+	mutex_init(&adreno_dev->dev.mutex);
+	INIT_LIST_HEAD(&adreno_dev->dev.globals);
+
+	/* Set the fault tolerance policy to replay, skip, throttle */
+	adreno_dev->ft_policy = BIT(KGSL_FT_REPLAY) |
+		BIT(KGSL_FT_SKIPCMD) | BIT(KGSL_FT_THROTTLE);
+
+	/* Enable command timeouts by default */
+	adreno_dev->long_ib_detect = true;
+
+	INIT_WORK(&adreno_dev->input_work, adreno_input_work);
+
+	INIT_LIST_HEAD(&adreno_dev->active_list);
+	spin_lock_init(&adreno_dev->active_list_lock);
+
+	for (i = 0; i < ARRAY_SIZE(adreno_dev->ringbuffers); i++) {
+		struct adreno_ringbuffer *rb = &adreno_dev->ringbuffers[i];
+
+		INIT_LIST_HEAD(&rb->events.group);
+	}
+
+	/*
+	 * Some GPUs needs specific alignment for UCHE GMEM base address.
+	 * Configure UCHE GMEM base based on GMEM size and align it accordingly.
+	 * This needs to be done based on GMEM size to avoid overlap between
+	 * RB and UCHE GMEM range.
+	 */
+	if (adreno_dev->gpucore->uche_gmem_alignment)
+		adreno_dev->uche_gmem_base =
+			ALIGN(adreno_dev->gpucore->gmem_size,
+				adreno_dev->gpucore->uche_gmem_alignment);
+}
+
+static const struct of_device_id adreno_component_match[] = {
+	{ .compatible = "qcom,gen7-gmu" },
+	{ .compatible = "qcom,gpu-gmu" },
+	{ .compatible = "qcom,gpu-rgmu" },
+	{ .compatible = "qcom,kgsl-smmu-v2" },
+	{ .compatible = "qcom,smmu-kgsl-cb" },
+	{},
+};
+
+int adreno_device_probe(struct platform_device *pdev,
+		struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct device *dev = &pdev->dev;
+	unsigned int priv = 0;
+	int status;
+	u32 size;
+
+	KGSL_BOOT_MARKER("GPU Init");
+
+	/* Initialize the adreno device structure */
+	adreno_setup_device(adreno_dev);
+
+	dev_set_drvdata(dev, device);
+
+	device->pdev = pdev;
+
+	adreno_update_soc_hw_revision_quirks(adreno_dev, pdev);
+
+	status = adreno_read_speed_bin(pdev);
+	if (status < 0)
+		goto err;
+
+	device->speed_bin = status;
+
+	status = adreno_of_get_power(adreno_dev, pdev);
+	if (status)
+		goto err;
+
+	status = kgsl_bus_init(device, pdev);
+	if (status)
+		goto err;
+
+	status = kgsl_regmap_init(pdev, &device->regmap, "kgsl_3d0_reg_memory",
+		&adreno_regmap_ops, device);
+	if (status)
+		goto err_bus_close;
+
+	/*
+	 * The SMMU APIs use unsigned long for virtual addresses which means
+	 * that we cannot use 64 bit virtual addresses on a 32 bit kernel even
+	 * though the hardware and the rest of the KGSL driver supports it.
+	 */
+	if (adreno_support_64bit(adreno_dev))
+		kgsl_mmu_set_feature(device, KGSL_MMU_64BIT);
+
+	/*
+	 * Set the SMMU aperture on A6XX/Gen7 targets to use per-process
+	 * pagetables.
+	 */
+	if (ADRENO_GPUREV(adreno_dev) >= 600)
+		kgsl_mmu_set_feature(device, KGSL_MMU_SMMU_APERTURE);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_IOCOHERENT))
+		kgsl_mmu_set_feature(device, KGSL_MMU_IO_COHERENT);
+
+	/*
+	 * Support VBOs on hardware where HLOS has access to PRR registers
+	 * configuration.
+	 */
+	if (!adreno_is_a650(adreno_dev))
+		kgsl_mmu_set_feature(device, KGSL_MMU_SUPPORT_VBO);
+
+	if (adreno_preemption_enable)
+		adreno_dev->preempt_override = true;
+
+	device->pwrctrl.bus_width = adreno_dev->gpucore->bus_width;
+
+	device->mmu.secured = (IS_ENABLED(CONFIG_QCOM_SECURE_BUFFER) &&
+		ADRENO_FEATURE(adreno_dev, ADRENO_CONTENT_PROTECTION));
+
+	/* Probe the LLCC - this could return -EPROBE_DEFER */
+	status = adreno_probe_llcc(adreno_dev, pdev);
+	if (status)
+		goto err_bus_close;
+
+	/*
+	 * IF the GPU HTW slice was successsful set the MMU feature so the
+	 * domain can set the appropriate attributes
+	 */
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		kgsl_mmu_set_feature(device, KGSL_MMU_LLCC_ENABLE);
+
+	 /* Bind the components before doing the KGSL platform probe. */
+	status = component_bind_all(dev, NULL);
+	if (status)
+		goto err_remove_llcc;
+
+	status = kgsl_request_irq(pdev, "kgsl_3d0_irq", adreno_irq_handler, device);
+	if (status < 0)
+		goto err_unbind;
+
+	device->pwrctrl.interrupt_num = status;
+
+	status = kgsl_device_platform_probe(device);
+	if (status)
+		goto err_unbind;
+
+	adreno_fence_trace_array_init(device);
+
+	/* Add CX_DBGC block to the regmap*/
+	kgsl_regmap_add_region(&device->regmap, pdev, "cx_dbgc", NULL, NULL);
+
+	/* Probe for the optional CX_MISC block */
+	adreno_cx_misc_probe(device);
+
+	adreno_isense_probe(device);
+
+	/* Allocate the memstore for storing timestamps and other useful info */
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_APRIV))
+		priv |= KGSL_MEMDESC_PRIVILEGED;
+
+	device->memstore = kgsl_allocate_global(device,
+		KGSL_MEMSTORE_SIZE, 0, 0, priv, "memstore");
+
+	status = PTR_ERR_OR_ZERO(device->memstore);
+	if (status) {
+		trace_array_put(device->fence_trace_array);
+		kgsl_device_platform_remove(device);
+		goto err_unbind;
+	}
+
+	/* Initialize the snapshot engine */
+	size = adreno_dev->gpucore->snapshot_size;
+
+	/*
+	 * Use a default size if one wasn't specified, but print a warning so
+	 * the developer knows to fix it
+	 */
+
+	if (WARN(!size, "The snapshot size was not specified in the gpucore\n"))
+		size = SZ_1M;
+
+	kgsl_device_snapshot_probe(device, size);
+
+	adreno_debugfs_init(adreno_dev);
+	adreno_profile_init(adreno_dev);
+
+	adreno_dev->perfcounter = false;
+
+	adreno_sysfs_init(adreno_dev);
+
+	/* Ignore return value, as driver can still function without pwrscale enabled */
+	kgsl_pwrscale_init(device, pdev, CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_L3_VOTE))
+		device->l3_vote = true;
+
+#ifdef CONFIG_INPUT
+
+	if (!of_property_read_bool(pdev->dev.of_node,
+			"qcom,disable-wake-on-touch")) {
+		adreno_input_handler.private = device;
+		/*
+		 * It isn't fatal if we cannot register the input handler.  Sad,
+		 * perhaps, but not fatal
+		 */
+		if (input_register_handler(&adreno_input_handler)) {
+			adreno_input_handler.private = NULL;
+			dev_err(device->dev,
+				     "Unable to register the input handler\n");
+		}
+	}
+#endif
+
+	kgsl_qcom_va_md_register(device);
+
+	KGSL_BOOT_MARKER("GPU Ready");
+
+	return 0;
+
+err_unbind:
+	component_unbind_all(dev, NULL);
+
+err_remove_llcc:
+	if (!IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice))
+		llcc_slice_putd(adreno_dev->gpu_llc_slice);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		llcc_slice_putd(adreno_dev->gpuhtw_llc_slice);
+
+err_bus_close:
+	kgsl_bus_close(device);
+
+err:
+	device->pdev = NULL;
+	dev_err_probe(&pdev->dev, status, "adreno device probe failed\n");
+	return status;
+}
+
+static int adreno_bind(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	const struct adreno_gpu_core *gpucore;
+	int ret;
+	u32 chipid;
+
+	gpucore = adreno_identify_gpu(pdev, &chipid);
+	if (IS_ERR(gpucore))
+		return PTR_ERR(gpucore);
+
+	ret = gpucore->gpudev->probe(pdev, chipid, gpucore);
+
+	if (!ret) {
+		struct kgsl_device *device = dev_get_drvdata(dev);
+
+		device->pdev_loaded = true;
+		srcu_init_notifier_head(&device->nh);
+	} else {
+		/*
+		 * Handle resource clean up through unbind, instead of a
+		 * lengthy goto error path.
+		 */
+		adreno_unbind(dev);
+	}
+
+	return ret;
+}
+
+static void adreno_unbind(struct device *dev)
+{
+	struct adreno_device *adreno_dev;
+	struct kgsl_device *device;
+	const struct adreno_gpudev *gpudev;
+
+	device = dev_get_drvdata(dev);
+	if (!device)
+		return;
+
+	/* Return if cleanup happens in adreno_device_probe */
+	if (!device->pdev)
+		return;
+
+	if (device->pdev_loaded) {
+		srcu_cleanup_notifier_head(&device->nh);
+		device->pdev_loaded = false;
+	}
+
+	adreno_dev = ADRENO_DEVICE(device);
+	gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	trace_array_put(device->fence_trace_array);
+
+	if (gpudev->remove != NULL)
+		gpudev->remove(adreno_dev);
+
+#ifdef CONFIG_INPUT
+	if (adreno_input_handler.private)
+		input_unregister_handler(&adreno_input_handler);
+#endif
+
+	kgsl_qcom_va_md_unregister(device);
+	adreno_coresight_remove(adreno_dev);
+	adreno_profile_close(adreno_dev);
+
+	/* Release the system cache slice descriptor */
+	if (!IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice))
+		llcc_slice_putd(adreno_dev->gpu_llc_slice);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		llcc_slice_putd(adreno_dev->gpuhtw_llc_slice);
+
+	kgsl_pwrscale_close(device);
+
+	if (adreno_dev->dispatch_ops && adreno_dev->dispatch_ops->close)
+		adreno_dev->dispatch_ops->close(adreno_dev);
+
+	kgsl_device_platform_remove(device);
+
+	component_unbind_all(dev, NULL);
+
+	kgsl_bus_close(device);
+	device->pdev = NULL;
+
+	if (device->num_l3_pwrlevels != 0)
+		qcom_dcvs_unregister_voter(KGSL_L3_DEVICE, DCVS_L3,
+			DCVS_SLOW_PATH);
+
+	clear_bit(ADRENO_DEVICE_PWRON_FIXUP, &adreno_dev->priv);
+	clear_bit(ADRENO_DEVICE_INITIALIZED, &adreno_dev->priv);
+}
+
+static void adreno_resume(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (device->state == KGSL_STATE_SUSPEND) {
+		adreno_put_gpu_halt(adreno_dev);
+		kgsl_pwrctrl_change_state(device, KGSL_STATE_SLUMBER);
+	} else if (device->state != KGSL_STATE_INIT) {
+		/*
+		 * This is an error situation so wait for the device to idle and
+		 * then put the device in SLUMBER state.  This will get us to
+		 * the right place when we resume.
+		 */
+		if (device->state == KGSL_STATE_ACTIVE)
+			adreno_idle(device);
+		kgsl_pwrctrl_change_state(device, KGSL_STATE_SLUMBER);
+		dev_err(device->dev, "resume invoked without a suspend\n");
+	}
+}
+
+static int adreno_pm_resume(struct device *dev)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct adreno_device *adreno_dev;
+	const struct adreno_power_ops *ops;
+
+	if (!device)
+		return 0;
+
+	adreno_dev = ADRENO_DEVICE(device);
+	ops = ADRENO_POWER_OPS(adreno_dev);
+
+#if IS_ENABLED(CONFIG_DEEPSLEEP)
+	if (pm_suspend_via_firmware()) {
+		struct kgsl_iommu *iommu = &device->mmu.iommu;
+		int status = kgsl_set_smmu_aperture(device, &iommu->user_context);
+
+		if (status)
+			return status;
+	}
+#endif
+
+	mutex_lock(&device->mutex);
+	ops->pm_resume(adreno_dev);
+	mutex_unlock(&device->mutex);
+
+	kgsl_reclaim_start();
+	return 0;
+}
+
+static int adreno_suspend(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int status = kgsl_pwrctrl_change_state(device, KGSL_STATE_SUSPEND);
+
+	if (!status && device->state == KGSL_STATE_SUSPEND)
+		adreno_get_gpu_halt(adreno_dev);
+
+	return status;
+}
+
+static int adreno_pm_suspend(struct device *dev)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct adreno_device *adreno_dev;
+	const struct adreno_power_ops *ops;
+	int status;
+
+	if (!device)
+		return 0;
+
+	adreno_dev = ADRENO_DEVICE(device);
+	ops = ADRENO_POWER_OPS(adreno_dev);
+
+	mutex_lock(&device->mutex);
+	status = ops->pm_suspend(adreno_dev);
+
+#if IS_ENABLED(CONFIG_DEEPSLEEP)
+	if (!status && pm_suspend_via_firmware())
+		adreno_zap_shader_unload(adreno_dev);
+#endif
+
+	mutex_unlock(&device->mutex);
+
+	if (status)
+		return status;
+
+	kgsl_reclaim_close();
+	kthread_flush_worker(device->events_worker);
+	flush_workqueue(kgsl_driver.lockless_workqueue);
+
+	return status;
+}
+
+void adreno_create_profile_buffer(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int priv = 0;
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_APRIV))
+		priv = KGSL_MEMDESC_PRIVILEGED;
+
+	adreno_allocate_global(device, &adreno_dev->profile_buffer,
+		PAGE_SIZE, 0, 0, priv, "alwayson");
+
+	adreno_dev->profile_index = 0;
+
+	if (!IS_ERR(adreno_dev->profile_buffer))
+		set_bit(ADRENO_DEVICE_DRAWOBJ_PROFILE,
+			&adreno_dev->priv);
+}
+
+static int adreno_init(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	int ret;
+
+	ret = kgsl_pwrctrl_change_state(device, KGSL_STATE_INIT);
+	if (ret)
+		return ret;
+
+	/*
+	 * initialization only needs to be done once initially until
+	 * device is shutdown
+	 */
+	if (test_bit(ADRENO_DEVICE_INITIALIZED, &adreno_dev->priv))
+		return 0;
+
+	ret = gpudev->init(adreno_dev);
+	if (ret)
+		return ret;
+
+	set_bit(ADRENO_DEVICE_INITIALIZED, &adreno_dev->priv);
+
+	return 0;
+}
+
+static bool gdscs_left_on(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	if (gmu_core_gpmu_isenabled(device))
+		return false;
+
+	if (pwr->cx_regulator)
+		if (regulator_is_enabled(pwr->cx_regulator))
+			return true;
+
+	if (pwr->gx_regulator)
+		return regulator_is_enabled(pwr->gx_regulator);
+
+	if (pwr->cx_pd)
+		if (kgsl_genpd_is_enabled(pwr->cx_pd))
+			return true;
+
+	if (pwr->gx_pd)
+		return kgsl_genpd_is_enabled(pwr->gx_pd);
+
+	return false;
+}
+
+void adreno_set_active_ctxs_null(struct adreno_device *adreno_dev)
+{
+	int i;
+	struct adreno_ringbuffer *rb;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		if (rb->drawctxt_active)
+			kgsl_context_put(&(rb->drawctxt_active->base));
+		rb->drawctxt_active = NULL;
+
+		kgsl_sharedmem_writel(device->scratch,
+			SCRATCH_RB_OFFSET(rb->id, current_rb_ptname),
+			0);
+	}
+}
+
+static int adreno_open(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/*
+	 * active_cnt special case: we are starting up for the first
+	 * time, so use this sequence instead of the kgsl_pwrctrl_wake()
+	 * which will be called by adreno_active_count_get().
+	 */
+	atomic_inc(&device->active_cnt);
+
+	memset(device->memstore->hostptr, 0, device->memstore->size);
+
+	ret = adreno_init(device);
+	if (ret)
+		goto err;
+
+	ret = adreno_start(device, 0);
+	if (ret)
+		goto err;
+
+	complete_all(&device->hwaccess_gate);
+	kgsl_pwrctrl_change_state(device, KGSL_STATE_ACTIVE);
+	adreno_active_count_put(adreno_dev);
+
+	return 0;
+err:
+	kgsl_pwrctrl_change_state(device, KGSL_STATE_INIT);
+	atomic_dec(&device->active_cnt);
+
+	return ret;
+}
+
+static int adreno_first_open(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_power_ops *ops = ADRENO_POWER_OPS(adreno_dev);
+
+	if (!device->pdev_loaded)
+		return -ENODEV;
+
+	return ops->first_open(adreno_dev);
+}
+
+static int adreno_close(struct adreno_device *adreno_dev)
+{
+	return kgsl_pwrctrl_change_state(KGSL_DEVICE(adreno_dev),
+			KGSL_STATE_INIT);
+}
+
+static int adreno_last_close(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_power_ops *ops = ADRENO_POWER_OPS(adreno_dev);
+
+	/*
+	 * Wait up to 1 second for the active count to go low
+	 * and then start complaining about it
+	 */
+	if (kgsl_active_count_wait(device, 0, HZ)) {
+		dev_err(device->dev,
+			"Waiting for the active count to become 0\n");
+
+		while (kgsl_active_count_wait(device, 0, HZ))
+			dev_err(device->dev,
+				"Still waiting for the active count\n");
+	}
+
+	return ops->last_close(adreno_dev);
+}
+
+static int adreno_pwrctrl_active_count_get(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = 0;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EINVAL;
+
+	if ((atomic_read(&device->active_cnt) == 0) &&
+		(device->state != KGSL_STATE_ACTIVE)) {
+		mutex_unlock(&device->mutex);
+		wait_for_completion(&device->hwaccess_gate);
+		mutex_lock(&device->mutex);
+		device->pwrctrl.superfast = true;
+		ret = kgsl_pwrctrl_change_state(device, KGSL_STATE_ACTIVE);
+	}
+	if (ret == 0)
+		atomic_inc(&device->active_cnt);
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+	return ret;
+}
+
+static void adreno_pwrctrl_active_count_put(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (WARN(atomic_read(&device->active_cnt) == 0,
+			"Unbalanced get/put calls to KGSL active count\n"))
+		return;
+
+	if (atomic_dec_and_test(&device->active_cnt)) {
+		kgsl_pwrscale_update_stats(device);
+		kgsl_pwrscale_update(device);
+
+		kgsl_start_idle_timer(device);
+	}
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	wake_up(&device->active_cnt_wq);
+}
+
+int adreno_active_count_get(struct adreno_device *adreno_dev)
+{
+	const struct adreno_power_ops *ops = ADRENO_POWER_OPS(adreno_dev);
+
+	return ops->active_count_get(adreno_dev);
+}
+
+void adreno_active_count_put(struct adreno_device *adreno_dev)
+{
+	const struct adreno_power_ops *ops = ADRENO_POWER_OPS(adreno_dev);
+
+	ops->active_count_put(adreno_dev);
+}
+
+void adreno_get_bus_counters(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = 0;
+
+	if (!device->pwrctrl.bus_control)
+		return;
+
+	/* VBIF waiting for RAM */
+	ret |= adreno_perfcounter_kernel_get(adreno_dev,
+		KGSL_PERFCOUNTER_GROUP_VBIF_PWR, 0,
+		&adreno_dev->starved_ram_lo, NULL);
+
+	/* Target has GBIF */
+	if (adreno_is_gen7(adreno_dev) ||
+		(adreno_is_a6xx(adreno_dev) && !adreno_is_a630(adreno_dev))) {
+		ret |= adreno_perfcounter_kernel_get(adreno_dev,
+			KGSL_PERFCOUNTER_GROUP_VBIF_PWR, 1,
+			&adreno_dev->starved_ram_lo_ch1, NULL);
+
+		ret |= adreno_perfcounter_kernel_get(adreno_dev,
+			KGSL_PERFCOUNTER_GROUP_VBIF,
+			GBIF_AXI0_READ_DATA_TOTAL_BEATS,
+			&adreno_dev->ram_cycles_lo, NULL);
+
+		ret |= adreno_perfcounter_kernel_get(adreno_dev,
+			KGSL_PERFCOUNTER_GROUP_VBIF,
+			GBIF_AXI1_READ_DATA_TOTAL_BEATS,
+			&adreno_dev->ram_cycles_lo_ch1_read, NULL);
+
+		ret |= adreno_perfcounter_kernel_get(adreno_dev,
+			KGSL_PERFCOUNTER_GROUP_VBIF,
+			GBIF_AXI0_WRITE_DATA_TOTAL_BEATS,
+			&adreno_dev->ram_cycles_lo_ch0_write, NULL);
+
+		ret |= adreno_perfcounter_kernel_get(adreno_dev,
+			KGSL_PERFCOUNTER_GROUP_VBIF,
+			GBIF_AXI1_WRITE_DATA_TOTAL_BEATS,
+			&adreno_dev->ram_cycles_lo_ch1_write, NULL);
+	} else {
+		/* VBIF DDR cycles */
+		ret |= adreno_perfcounter_kernel_get(adreno_dev,
+			KGSL_PERFCOUNTER_GROUP_VBIF,
+			VBIF_AXI_TOTAL_BEATS,
+			&adreno_dev->ram_cycles_lo, NULL);
+	}
+
+	if (ret)
+		dev_err(KGSL_DEVICE(adreno_dev)->dev,
+			"Unable to get perf counters for bus DCVS\n");
+}
+
+/**
+ * _adreno_start - Power up the GPU and prepare to accept commands
+ * @adreno_dev: Pointer to an adreno_device structure
+ *
+ * The core function that powers up and initalizes the GPU.  This function is
+ * called at init and after coming out of SLUMBER
+ */
+static int _adreno_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	int status;
+	unsigned int state = device->state;
+	bool gdsc_left_on;
+
+	/* make sure ADRENO_DEVICE_STARTED is not set here */
+	WARN_ON(test_bit(ADRENO_DEVICE_STARTED, &adreno_dev->priv));
+
+	gdsc_left_on = gdscs_left_on(device);
+
+	/* Clear any GPU faults that might have been left over */
+	adreno_clear_gpu_fault(adreno_dev);
+
+	/* Put the GPU in a responsive state */
+	status = kgsl_pwrctrl_change_state(device, KGSL_STATE_AWARE);
+	if (status)
+		goto error_pwr_off;
+
+	/* Set any stale active contexts to NULL */
+	adreno_set_active_ctxs_null(adreno_dev);
+
+	/* Set the bit to indicate that we've just powered on */
+	set_bit(ADRENO_DEVICE_PWRON, &adreno_dev->priv);
+
+	/* Clear the busy_data stats - we're starting over from scratch */
+	memset(&adreno_dev->busy_data, 0, sizeof(adreno_dev->busy_data));
+
+	/* Soft reset the GPU if a regulator is stuck on*/
+	if (gdsc_left_on)
+		_soft_reset(adreno_dev);
+
+	/* Start the GPU */
+	status = gpudev->start(adreno_dev);
+	if (status)
+		goto error_pwr_off;
+
+	/* Re-initialize the coresight registers if applicable */
+	adreno_coresight_start(adreno_dev);
+
+	adreno_irqctrl(adreno_dev, 1);
+
+	adreno_perfcounter_start(adreno_dev);
+
+	/* Clear FSR here in case it is set from a previous pagefault */
+	kgsl_mmu_clear_fsr(&device->mmu);
+
+	status = gpudev->rb_start(adreno_dev);
+	if (status)
+		goto error_pwr_off;
+
+	/*
+	 * At this point it is safe to assume that we recovered. Setting
+	 * this field allows us to take a new snapshot for the next failure
+	 * if we are prioritizing the first unrecoverable snapshot.
+	 */
+	if (device->snapshot)
+		device->snapshot->recovered = true;
+
+	/* Start the dispatcher */
+	adreno_dispatcher_start(device);
+
+	device->reset_counter++;
+
+	set_bit(ADRENO_DEVICE_STARTED, &adreno_dev->priv);
+
+	/*
+	 * There is a possible deadlock scenario during kgsl firmware reading
+	 * (request_firmware) and devfreq update calls. During first boot, kgsl
+	 * device mutex is held and then request_firmware is called for reading
+	 * firmware. request_firmware internally takes dev_pm_qos_mtx lock.
+	 * Whereas in case of devfreq update calls triggered by thermal/bcl or
+	 * devfreq sysfs, it first takes the same dev_pm_qos_mtx lock and then
+	 * tries to take kgsl device mutex as part of get_dev_status/target
+	 * calls. This results in deadlock when both thread are unable to acquire
+	 * the mutex held by other thread. Enable devfreq updates now as we are
+	 * done reading all firmware files.
+	 */
+	device->pwrscale.devfreq_enabled = true;
+
+	return 0;
+
+error_pwr_off:
+	/* set the state back to original state */
+	kgsl_pwrctrl_change_state(device, state);
+
+	return status;
+}
+
+/**
+ * adreno_start() - Power up and initialize the GPU
+ * @device: Pointer to the KGSL device to power up
+ * @priority:  Boolean flag to specify of the start should be scheduled in a low
+ * latency work queue
+ *
+ * Power up the GPU and initialize it.  If priority is specified then elevate
+ * the thread priority for the duration of the start operation
+ */
+int adreno_start(struct kgsl_device *device, int priority)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	int nice = task_nice(current);
+	int ret;
+
+	if (priority && (adreno_wake_nice < nice))
+		set_user_nice(current, adreno_wake_nice);
+
+	ret = _adreno_start(adreno_dev);
+
+	if (priority)
+		set_user_nice(current, nice);
+
+	return ret;
+}
+
+static int adreno_stop(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	int error = 0;
+
+	if (!test_bit(ADRENO_DEVICE_STARTED, &adreno_dev->priv))
+		return 0;
+
+	kgsl_pwrscale_update_stats(device);
+
+	adreno_irqctrl(adreno_dev, 0);
+
+	/* Save active coresight registers if applicable */
+	adreno_coresight_stop(adreno_dev);
+
+	/* Save physical performance counter values before GPU power down*/
+	adreno_perfcounter_save(adreno_dev);
+
+	if (gpudev->clear_pending_transactions)
+		gpudev->clear_pending_transactions(adreno_dev);
+
+	adreno_dispatcher_stop(adreno_dev);
+
+	adreno_ringbuffer_stop(adreno_dev);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpu_llc_slice);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpuhtw_llc_slice);
+
+	adreno_set_active_ctxs_null(adreno_dev);
+
+	clear_bit(ADRENO_DEVICE_STARTED, &adreno_dev->priv);
+
+	return error;
+}
+
+/**
+ * adreno_reset() - Helper function to reset the GPU
+ * @device: Pointer to the KGSL device structure for the GPU
+ * @fault: Type of fault. Needed to skip soft reset for MMU fault
+ *
+ * Try to reset the GPU to recover from a fault.  First, try to do a low latency
+ * soft reset.  If the soft reset fails for some reason, then bring out the big
+ * guns and toggle the footswitch.
+ */
+int adreno_reset(struct kgsl_device *device, int fault)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	int ret = -EINVAL;
+	int i;
+
+	if (gpudev->reset)
+		return gpudev->reset(adreno_dev);
+
+	/*
+	 * Try soft reset first Do not do soft reset for a IOMMU fault (because
+	 * the IOMMU hardware needs a reset too)
+	 */
+
+	if (!(fault & ADRENO_IOMMU_PAGE_FAULT))
+		ret = adreno_soft_reset(device);
+
+	if (ret) {
+		/* If soft reset failed/skipped, then pull the power */
+		kgsl_pwrctrl_change_state(device, KGSL_STATE_INIT);
+		/* since device is officially off now clear start bit */
+		clear_bit(ADRENO_DEVICE_STARTED, &adreno_dev->priv);
+
+		/* Try to reset the device */
+		ret = adreno_start(device, 0);
+
+		for (i = 0; ret && i < 4; i++) {
+			msleep(20);
+			ret = adreno_start(device, 0);
+		}
+
+		if (ret)
+			return ret;
+
+		if (i != 0)
+			dev_warn(device->dev,
+			      "Device hard reset tried %d tries\n", i);
+	}
+
+	/*
+	 * If active_cnt is non-zero then the system was active before
+	 * going into a reset - put it back in that state
+	 */
+
+	if (atomic_read(&device->active_cnt))
+		kgsl_pwrctrl_change_state(device, KGSL_STATE_ACTIVE);
+
+	return ret;
+}
+
+static int copy_prop(struct kgsl_device_getproperty *param,
+		void *src, size_t size)
+{
+	if (copy_to_user(param->value, src,
+		min_t(u32, size, param->sizebytes)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static int adreno_prop_device_info(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_devinfo devinfo = {
+		.device_id = device->id + 1,
+		.chip_id = adreno_dev->chipid,
+		.mmu_enabled = kgsl_mmu_has_feature(device, KGSL_MMU_PAGED),
+		.gmem_gpubaseaddr = 0,
+		.gmem_sizebytes = adreno_dev->gpucore->gmem_size,
+	};
+
+	return copy_prop(param, &devinfo, sizeof(devinfo));
+}
+
+static int adreno_prop_gpu_model(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	struct kgsl_gpu_model model = {0};
+
+	strscpy(model.gpu_model, adreno_get_gpu_model(device),
+		sizeof(model.gpu_model));
+
+	return copy_prop(param, &model, sizeof(model));
+}
+
+static int adreno_prop_device_shadow(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	struct kgsl_shadowprop shadowprop = { 0 };
+
+	if (device->memstore->hostptr) {
+		/* Pass a dummy address to identify memstore */
+		shadowprop.gpuaddr =  KGSL_MEMSTORE_TOKEN_ADDRESS;
+		shadowprop.size = device->memstore->size;
+
+		shadowprop.flags = KGSL_FLAGS_INITIALIZED |
+			KGSL_FLAGS_PER_CONTEXT_TIMESTAMPS;
+	}
+
+	return copy_prop(param, &shadowprop, sizeof(shadowprop));
+}
+
+static int adreno_prop_device_qdss_stm(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	struct kgsl_qdss_stm_prop qdssprop = {0};
+
+	if (!IS_ERR_OR_NULL(device->qdss_desc)) {
+		qdssprop.gpuaddr = device->qdss_desc->gpuaddr;
+		qdssprop.size = device->qdss_desc->size;
+	}
+
+	return copy_prop(param, &qdssprop, sizeof(qdssprop));
+}
+
+static int adreno_prop_device_qtimer(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	struct kgsl_qtimer_prop qtimerprop = {0};
+
+	if (!IS_ERR_OR_NULL(device->qtimer_desc)) {
+		qtimerprop.gpuaddr = device->qtimer_desc->gpuaddr;
+		qtimerprop.size = device->qtimer_desc->size;
+	}
+
+	return copy_prop(param, &qtimerprop, sizeof(qtimerprop));
+}
+
+static int adreno_prop_s32(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	int val = 0;
+
+	if (param->type == KGSL_PROP_MMU_ENABLE)
+		val = kgsl_mmu_has_feature(device, KGSL_MMU_PAGED);
+	else if (param->type == KGSL_PROP_INTERRUPT_WAITS)
+		val = 1;
+
+	return copy_prop(param, &val, sizeof(val));
+}
+
+static int adreno_prop_uche_gmem_addr(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	return copy_prop(param, &adreno_dev->uche_gmem_base,
+		sizeof(adreno_dev->uche_gmem_base));
+}
+
+static int adreno_prop_ucode_version(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_ucode_version ucode = {
+		.pfp = adreno_dev->fw[ADRENO_FW_PFP].version,
+		.pm4 = adreno_dev->fw[ADRENO_FW_PM4].version,
+	};
+
+	return copy_prop(param, &ucode, sizeof(ucode));
+}
+
+static int adreno_prop_gaming_bin(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	void *buf;
+	size_t len;
+	int ret;
+	struct nvmem_cell *cell;
+
+	cell = nvmem_cell_get(&device->pdev->dev, "gaming_bin");
+	if (IS_ERR(cell))
+		return -EINVAL;
+
+	buf = nvmem_cell_read(cell, &len);
+	nvmem_cell_put(cell);
+
+	if (!IS_ERR(buf)) {
+		ret = copy_prop(param, buf, len);
+		kfree(buf);
+		return ret;
+	}
+
+	dev_err(device->dev, "failed to read gaming_bin nvmem cell\n");
+	return -EINVAL;
+}
+
+static int adreno_prop_u32(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	u32 val = 0;
+
+	if (param->type == KGSL_PROP_HIGHEST_BANK_BIT) {
+		val = adreno_dev->highest_bank_bit;
+	} else if (param->type == KGSL_PROP_MIN_ACCESS_LENGTH)
+		of_property_read_u32(device->pdev->dev.of_node,
+			"qcom,min-access-length", &val);
+	else if (param->type == KGSL_PROP_UBWC_MODE)
+		of_property_read_u32(device->pdev->dev.of_node,
+			"qcom,ubwc-mode", &val);
+	else if (param->type == KGSL_PROP_DEVICE_BITNESS)
+		val = adreno_support_64bit(adreno_dev) ? 48 : 32;
+	else if (param->type == KGSL_PROP_SPEED_BIN)
+		val = device->speed_bin;
+	else if (param->type == KGSL_PROP_VK_DEVICE_ID)
+		val = adreno_get_vk_device_id(device);
+	else if (param->type == KGSL_PROP_IS_LPAC_ENABLED)
+		val = adreno_dev->lpac_enabled ? 1 : 0;
+	else if (param->type == KGSL_PROP_IS_RAYTRACING_ENABLED)
+		val =  adreno_dev->raytracing_enabled ? 1 : 0;
+	else if (param->type == KGSL_PROP_IS_FASTBLEND_ENABLED)
+		val = adreno_dev->fastblend_enabled ? 1 : 0;
+	else if (param->type == KGSL_PROP_IS_AQE_ENABLED)
+		val = ADRENO_FEATURE(adreno_dev, ADRENO_AQE) ? 1 : 0;
+
+	return copy_prop(param, &val, sizeof(val));
+}
+
+static int adreno_prop_uche_trap_base(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	u64 val = 0;
+
+	if (!gpudev->get_uche_trap_base)
+		return -EINVAL;
+
+	val = gpudev->get_uche_trap_base();
+
+	return copy_prop(param, &val, sizeof(val));
+}
+
+static const struct {
+	int type;
+	int (*func)(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param);
+} adreno_property_funcs[] = {
+	{ KGSL_PROP_DEVICE_INFO, adreno_prop_device_info },
+	{ KGSL_PROP_DEVICE_SHADOW, adreno_prop_device_shadow },
+	{ KGSL_PROP_DEVICE_QDSS_STM, adreno_prop_device_qdss_stm },
+	{ KGSL_PROP_DEVICE_QTIMER, adreno_prop_device_qtimer },
+	{ KGSL_PROP_MMU_ENABLE, adreno_prop_s32 },
+	{ KGSL_PROP_INTERRUPT_WAITS, adreno_prop_s32 },
+	{ KGSL_PROP_UCHE_GMEM_VADDR, adreno_prop_uche_gmem_addr },
+	{ KGSL_PROP_UCODE_VERSION, adreno_prop_ucode_version },
+	{ KGSL_PROP_HIGHEST_BANK_BIT, adreno_prop_u32 },
+	{ KGSL_PROP_MIN_ACCESS_LENGTH, adreno_prop_u32 },
+	{ KGSL_PROP_UBWC_MODE, adreno_prop_u32 },
+	{ KGSL_PROP_DEVICE_BITNESS, adreno_prop_u32 },
+	{ KGSL_PROP_SPEED_BIN, adreno_prop_u32 },
+	{ KGSL_PROP_GAMING_BIN, adreno_prop_gaming_bin },
+	{ KGSL_PROP_GPU_MODEL, adreno_prop_gpu_model},
+	{ KGSL_PROP_VK_DEVICE_ID, adreno_prop_u32},
+	{ KGSL_PROP_IS_LPAC_ENABLED, adreno_prop_u32 },
+	{ KGSL_PROP_IS_RAYTRACING_ENABLED, adreno_prop_u32},
+	{ KGSL_PROP_IS_FASTBLEND_ENABLED, adreno_prop_u32},
+	{ KGSL_PROP_UCHE_TRAP_BASE, adreno_prop_uche_trap_base },
+	{ KGSL_PROP_IS_AQE_ENABLED, adreno_prop_u32 },
+};
+
+static int adreno_getproperty(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(adreno_property_funcs); i++) {
+		if (param->type == adreno_property_funcs[i].type)
+			return adreno_property_funcs[i].func(device, param);
+	}
+
+	return -ENODEV;
+}
+
+static int adreno_query_property_list(struct kgsl_device *device, u32 *list,
+		u32 count)
+{
+	int i;
+
+	if (!list)
+		return ARRAY_SIZE(adreno_property_funcs);
+
+	for (i = 0; i < count && i < ARRAY_SIZE(adreno_property_funcs); i++)
+		list[i] = adreno_property_funcs[i].type;
+
+	return i;
+}
+
+int adreno_set_constraint(struct kgsl_device *device,
+				struct kgsl_context *context,
+				struct kgsl_device_constraint *constraint)
+{
+	int status = 0;
+
+	switch (constraint->type) {
+	case KGSL_CONSTRAINT_PWRLEVEL: {
+		struct kgsl_device_constraint_pwrlevel pwr;
+
+		if (constraint->size != sizeof(pwr)) {
+			status = -EINVAL;
+			break;
+		}
+
+		if (copy_from_user(&pwr,
+				(void __user *)constraint->data,
+				sizeof(pwr))) {
+			status = -EFAULT;
+			break;
+		}
+		if (pwr.level >= KGSL_CONSTRAINT_PWR_MAXLEVELS) {
+			status = -EINVAL;
+			break;
+		}
+
+		context->pwr_constraint.type =
+				KGSL_CONSTRAINT_PWRLEVEL;
+		context->pwr_constraint.sub_type = pwr.level;
+		trace_kgsl_user_pwrlevel_constraint(device,
+			context->id,
+			context->pwr_constraint.type,
+			context->pwr_constraint.sub_type);
+		}
+		break;
+	case KGSL_CONSTRAINT_NONE:
+		if (context->pwr_constraint.type == KGSL_CONSTRAINT_PWRLEVEL)
+			trace_kgsl_user_pwrlevel_constraint(device,
+				context->id,
+				KGSL_CONSTRAINT_NONE,
+				context->pwr_constraint.sub_type);
+		context->pwr_constraint.type = KGSL_CONSTRAINT_NONE;
+		break;
+	case KGSL_CONSTRAINT_L3_PWRLEVEL: {
+		struct kgsl_device_constraint_pwrlevel pwr;
+
+		if (constraint->size != sizeof(pwr)) {
+			status = -EINVAL;
+			break;
+		}
+
+		if (copy_from_user(&pwr, constraint->data, sizeof(pwr))) {
+			status = -EFAULT;
+			break;
+		}
+
+		status = register_l3_voter(device);
+		if (status)
+			break;
+
+		if (pwr.level >= KGSL_CONSTRAINT_PWR_MAXLEVELS)
+			pwr.level = KGSL_CONSTRAINT_PWR_MAXLEVELS - 1;
+
+		context->l3_pwr_constraint.type = KGSL_CONSTRAINT_L3_PWRLEVEL;
+		context->l3_pwr_constraint.sub_type = pwr.level;
+		trace_kgsl_user_pwrlevel_constraint(device, context->id,
+			context->l3_pwr_constraint.type,
+			context->l3_pwr_constraint.sub_type);
+		}
+		break;
+	case KGSL_CONSTRAINT_L3_NONE: {
+		unsigned int type = context->l3_pwr_constraint.type;
+
+		if (type == KGSL_CONSTRAINT_L3_PWRLEVEL)
+			trace_kgsl_user_pwrlevel_constraint(device, context->id,
+				KGSL_CONSTRAINT_L3_NONE,
+				context->l3_pwr_constraint.sub_type);
+		context->l3_pwr_constraint.type = KGSL_CONSTRAINT_L3_NONE;
+		}
+		break;
+	default:
+		status = -EINVAL;
+		break;
+	}
+
+	/* If a new constraint has been set for a context, cancel the old one */
+	if ((status == 0) &&
+		(context->id == device->pwrctrl.constraint.owner_id)) {
+		trace_kgsl_constraint(device, device->pwrctrl.constraint.type,
+					device->pwrctrl.active_pwrlevel, 0);
+		device->pwrctrl.constraint.type = KGSL_CONSTRAINT_NONE;
+	}
+
+	return status;
+}
+
+static int adreno_setproperty(struct kgsl_device_private *dev_priv,
+				unsigned int type,
+				void __user *value,
+				unsigned int sizebytes)
+{
+	int status = -EINVAL;
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	switch (type) {
+	case KGSL_PROP_PWR_CONSTRAINT:
+	case KGSL_PROP_L3_PWR_CONSTRAINT: {
+			struct kgsl_device_constraint constraint;
+			struct kgsl_context *context;
+
+			if (sizebytes != sizeof(constraint))
+				break;
+
+			if (copy_from_user(&constraint, value,
+				sizeof(constraint))) {
+				status = -EFAULT;
+				break;
+			}
+
+			context = kgsl_context_get_owner(dev_priv,
+							constraint.context_id);
+
+			if (context == NULL)
+				break;
+
+			status = adreno_set_constraint(device, context,
+								&constraint);
+
+			kgsl_context_put(context);
+		}
+		break;
+	default:
+		status = gpudev->setproperty(dev_priv, type, value, sizebytes);
+		break;
+	}
+
+	return status;
+}
+
+/*
+ * adreno_soft_reset -  Do a soft reset of the GPU hardware
+ * @device: KGSL device to soft reset
+ *
+ * "soft reset" the GPU hardware - this is a fast path GPU reset
+ * The GPU hardware is reset but we never pull power so we can skip
+ * a lot of the standard adreno_stop/adreno_start sequence
+ */
+static int adreno_soft_reset(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	int ret;
+
+	/*
+	 * Don't allow a soft reset for a304 because the SMMU needs to be hard
+	 * reset
+	 */
+	if (adreno_is_a304(adreno_dev))
+		return -ENODEV;
+
+	if (gpudev->clear_pending_transactions) {
+		ret = gpudev->clear_pending_transactions(adreno_dev);
+		if (ret)
+			return ret;
+	}
+
+	kgsl_pwrctrl_change_state(device, KGSL_STATE_AWARE);
+	adreno_set_active_ctxs_null(adreno_dev);
+
+	adreno_irqctrl(adreno_dev, 0);
+
+	adreno_clear_gpu_fault(adreno_dev);
+	/* since device is oficially off now clear start bit */
+	clear_bit(ADRENO_DEVICE_STARTED, &adreno_dev->priv);
+
+	/* save physical performance counter values before GPU soft reset */
+	adreno_perfcounter_save(adreno_dev);
+
+	_soft_reset(adreno_dev);
+
+	/* Clear the busy_data stats - we're starting over from scratch */
+	adreno_dev->busy_data.gpu_busy = 0;
+	adreno_dev->busy_data.bif_ram_cycles = 0;
+	adreno_dev->busy_data.bif_ram_cycles_read_ch1 = 0;
+	adreno_dev->busy_data.bif_ram_cycles_write_ch0 = 0;
+	adreno_dev->busy_data.bif_ram_cycles_write_ch1 = 0;
+	adreno_dev->busy_data.bif_starved_ram = 0;
+	adreno_dev->busy_data.bif_starved_ram_ch1 = 0;
+
+	/* Reinitialize the GPU */
+	gpudev->start(adreno_dev);
+
+	/* Re-initialize the coresight registers if applicable */
+	adreno_coresight_start(adreno_dev);
+
+	/* Enable IRQ */
+	adreno_irqctrl(adreno_dev, 1);
+
+	/* stop all ringbuffers to cancel RB events */
+	adreno_ringbuffer_stop(adreno_dev);
+
+	/* Start the ringbuffer(s) again */
+	ret = gpudev->rb_start(adreno_dev);
+	if (ret == 0) {
+		device->reset_counter++;
+		set_bit(ADRENO_DEVICE_STARTED, &adreno_dev->priv);
+	}
+
+	/* Restore physical performance counter values after soft reset */
+	adreno_perfcounter_restore(adreno_dev);
+
+	if (ret)
+		dev_err(device->dev, "Device soft reset failed: %d\n", ret);
+
+	return ret;
+}
+
+bool adreno_isidle(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb;
+	int i;
+
+	if (!kgsl_state_is_awake(KGSL_DEVICE(adreno_dev)))
+		return true;
+
+	/*
+	 * wptr is updated when we add commands to ringbuffer, add a barrier
+	 * to make sure updated wptr is compared to rptr
+	 */
+	smp_mb();
+
+	/*
+	 * ringbuffer is truly idle when all ringbuffers read and write
+	 * pointers are equal
+	 */
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		if (!adreno_rb_empty(rb))
+			return false;
+	}
+
+	return gpudev->hw_isidle(adreno_dev);
+}
+
+/**
+ * adreno_spin_idle() - Spin wait for the GPU to idle
+ * @adreno_dev: Pointer to an adreno device
+ * @timeout: milliseconds to wait before returning error
+ *
+ * Spin the CPU waiting for the RBBM status to return idle
+ */
+int adreno_spin_idle(struct adreno_device *adreno_dev, unsigned int timeout)
+{
+	unsigned long wait = jiffies + msecs_to_jiffies(timeout);
+
+	do {
+		/*
+		 * If we fault, stop waiting and return an error. The dispatcher
+		 * will clean up the fault from the work queue, but we need to
+		 * make sure we don't block it by waiting for an idle that
+		 * will never come.
+		 */
+
+		if (adreno_gpu_fault(adreno_dev) != 0)
+			return -EDEADLK;
+
+		if (adreno_isidle(adreno_dev))
+			return 0;
+
+	} while (time_before(jiffies, wait));
+
+	/*
+	 * Under rare conditions, preemption can cause the while loop to exit
+	 * without checking if the gpu is idle. check one last time before we
+	 * return failure.
+	 */
+	if (adreno_gpu_fault(adreno_dev) != 0)
+		return -EDEADLK;
+
+	if (adreno_isidle(adreno_dev))
+		return 0;
+
+	return -ETIMEDOUT;
+}
+
+/**
+ * adreno_idle() - wait for the GPU hardware to go idle
+ * @device: Pointer to the KGSL device structure for the GPU
+ *
+ * Wait up to ADRENO_IDLE_TIMEOUT milliseconds for the GPU hardware to go quiet.
+ * Caller must hold the device mutex, and must not hold the dispatcher mutex.
+ */
+
+int adreno_idle(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	int ret;
+
+	/*
+	 * Make sure the device mutex is held so the dispatcher can't send any
+	 * more commands to the hardware
+	 */
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EDEADLK;
+
+	/* Check if we are already idle before idling dispatcher */
+	if (adreno_isidle(adreno_dev))
+		return 0;
+	/*
+	 * Wait for dispatcher to finish completing commands
+	 * already submitted
+	 */
+	ret = adreno_dispatcher_idle(adreno_dev);
+	if (ret)
+		return ret;
+
+	return adreno_spin_idle(adreno_dev, ADRENO_IDLE_TIMEOUT);
+}
+
+static int adreno_drain_and_idle(struct kgsl_device *device)
+{
+	int ret;
+
+	reinit_completion(&device->halt_gate);
+
+	ret = kgsl_active_count_wait(device, 0, HZ);
+	if (ret)
+		return ret;
+
+	return adreno_idle(device);
+}
+
+/* Caller must hold the device mutex. */
+int adreno_suspend_context(struct kgsl_device *device)
+{
+	/* process any profiling results that are available */
+	adreno_profile_process_results(ADRENO_DEVICE(device));
+
+	/* Wait for the device to go idle */
+	return adreno_idle(device);
+}
+
+void adreno_cx_misc_regread(struct adreno_device *adreno_dev,
+	unsigned int offsetwords, unsigned int *value)
+{
+	unsigned int cx_misc_offset;
+
+	WARN_ONCE(!adreno_dev->cx_misc_virt,
+		  "cx_misc region is not defined in device tree");
+
+	cx_misc_offset = (offsetwords << 2);
+	if (!adreno_dev->cx_misc_virt ||
+		(cx_misc_offset >= adreno_dev->cx_misc_len))
+		return;
+
+	*value = __raw_readl(adreno_dev->cx_misc_virt + cx_misc_offset);
+
+	/*
+	 * ensure this read finishes before the next one.
+	 * i.e. act like normal readl()
+	 */
+	rmb();
+}
+
+void adreno_isense_regread(struct adreno_device *adreno_dev,
+	unsigned int offsetwords, unsigned int *value)
+{
+	unsigned int isense_offset;
+
+	isense_offset = (offsetwords << 2);
+	if (!adreno_dev->isense_virt ||
+		(isense_offset >= adreno_dev->isense_len))
+		return;
+
+	*value =  __raw_readl(adreno_dev->isense_virt + isense_offset);
+
+	/*
+	 * ensure this read finishes before the next one.
+	 * i.e. act like normal readl()
+	 */
+	rmb();
+}
+
+bool adreno_gx_is_on(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+
+	return gpudev->gx_is_on(adreno_dev);
+}
+
+void adreno_cx_misc_regwrite(struct adreno_device *adreno_dev,
+	unsigned int offsetwords, unsigned int value)
+{
+	unsigned int cx_misc_offset;
+
+	WARN_ONCE(!adreno_dev->cx_misc_virt,
+		  "cx_misc region is not defined in device tree");
+
+	cx_misc_offset = (offsetwords << 2);
+	if (!adreno_dev->cx_misc_virt ||
+		(cx_misc_offset >= adreno_dev->cx_misc_len))
+		return;
+
+	/*
+	 * ensure previous writes post before this one,
+	 * i.e. act like normal writel()
+	 */
+	wmb();
+	__raw_writel(value, adreno_dev->cx_misc_virt + cx_misc_offset);
+}
+
+void adreno_cx_misc_regrmw(struct adreno_device *adreno_dev,
+		unsigned int offsetwords,
+		unsigned int mask, unsigned int bits)
+{
+	unsigned int val = 0;
+
+	adreno_cx_misc_regread(adreno_dev, offsetwords, &val);
+	val &= ~mask;
+	adreno_cx_misc_regwrite(adreno_dev, offsetwords, val | bits);
+}
+
+void adreno_profile_submit_time(struct adreno_submit_time *time)
+{
+	struct kgsl_drawobj *drawobj;
+	struct kgsl_drawobj_cmd *cmdobj;
+	struct kgsl_mem_entry *entry;
+	struct kgsl_drawobj_profiling_buffer *profile_buffer;
+
+	if (!time)
+		return;
+
+	drawobj = time->drawobj;
+	if (drawobj == NULL)
+		return;
+
+	cmdobj = CMDOBJ(drawobj);
+	entry = cmdobj->profiling_buf_entry;
+	if (!entry)
+		return;
+
+	profile_buffer = kgsl_gpuaddr_to_vaddr(&entry->memdesc,
+			cmdobj->profiling_buffer_gpuaddr);
+
+	if (profile_buffer == NULL)
+		return;
+
+	/* Return kernel clock time to the client if requested */
+	if (drawobj->flags & KGSL_DRAWOBJ_PROFILING_KTIME) {
+		u64 secs = time->ktime;
+
+		profile_buffer->wall_clock_ns =
+			do_div(secs, NSEC_PER_SEC);
+		profile_buffer->wall_clock_s = secs;
+	} else {
+		profile_buffer->wall_clock_s = time->utime.tv_sec;
+		profile_buffer->wall_clock_ns = time->utime.tv_nsec;
+	}
+
+	profile_buffer->gpu_ticks_queued = time->ticks;
+
+	kgsl_memdesc_unmap(&entry->memdesc);
+}
+
+/**
+ * adreno_waittimestamp - sleep while waiting for the specified timestamp
+ * @device - pointer to a KGSL device structure
+ * @context - pointer to the active kgsl context
+ * @timestamp - GPU timestamp to wait for
+ * @msecs - amount of time to wait (in milliseconds)
+ *
+ * Wait up to 'msecs' milliseconds for the specified timestamp to expire.
+ */
+static int adreno_waittimestamp(struct kgsl_device *device,
+		struct kgsl_context *context,
+		unsigned int timestamp,
+		unsigned int msecs)
+{
+	int ret;
+
+	if (context == NULL) {
+		/* If they are doing then complain once */
+		dev_WARN_ONCE(device->dev, 1,
+			"IOCTL_KGSL_DEVICE_WAITTIMESTAMP is deprecated\n");
+		return -ENOTTY;
+	}
+
+	/* Return -ENOENT if the context has been detached */
+	if (kgsl_context_detached(context))
+		return -ENOENT;
+
+	ret = adreno_drawctxt_wait(ADRENO_DEVICE(device), context,
+		timestamp, msecs);
+
+	/* If the context got invalidated then return a specific error */
+	if (kgsl_context_invalid(context))
+		ret = -EDEADLK;
+
+	/*
+	 * Return -EPROTO if the device has faulted since the last time we
+	 * checked.  Userspace uses this as a marker for performing post
+	 * fault activities
+	 */
+
+	if (!ret && test_and_clear_bit(ADRENO_CONTEXT_FAULT, &context->priv))
+		ret = -EPROTO;
+
+	return ret;
+}
+
+/**
+ * __adreno_readtimestamp() - Reads the timestamp from memstore memory
+ * @adreno_dev: Pointer to an adreno device
+ * @index: Index into the memstore memory
+ * @type: Type of timestamp to read
+ * @timestamp: The out parameter where the timestamp is read
+ */
+static int __adreno_readtimestamp(struct adreno_device *adreno_dev, int index,
+				int type, unsigned int *timestamp)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int status = 0;
+
+	switch (type) {
+	case KGSL_TIMESTAMP_CONSUMED:
+		kgsl_sharedmem_readl(device->memstore, timestamp,
+			KGSL_MEMSTORE_OFFSET(index, soptimestamp));
+		break;
+	case KGSL_TIMESTAMP_RETIRED:
+		kgsl_sharedmem_readl(device->memstore, timestamp,
+			KGSL_MEMSTORE_OFFSET(index, eoptimestamp));
+		break;
+	default:
+		status = -EINVAL;
+		*timestamp = 0;
+		break;
+	}
+	return status;
+}
+
+/**
+ * adreno_rb_readtimestamp(): Return the value of given type of timestamp
+ * for a RB
+ * @adreno_dev: adreno device whose timestamp values are being queried
+ * @priv: The object being queried for a timestamp (expected to be a rb pointer)
+ * @type: The type of timestamp (one of 3) to be read
+ * @timestamp: Pointer to where the read timestamp is to be written to
+ *
+ * CONSUMED and RETIRED type timestamps are sorted by id and are constantly
+ * updated by the GPU through shared memstore memory. QUEUED type timestamps
+ * are read directly from context struct.
+
+ * The function returns 0 on success and timestamp value at the *timestamp
+ * address and returns -EINVAL on any read error/invalid type and timestamp = 0.
+ */
+int adreno_rb_readtimestamp(struct adreno_device *adreno_dev,
+		void *priv, enum kgsl_timestamp_type type,
+		unsigned int *timestamp)
+{
+	int status = 0;
+	struct adreno_ringbuffer *rb = priv;
+
+	if (type == KGSL_TIMESTAMP_QUEUED)
+		*timestamp = rb->timestamp;
+	else
+		status = __adreno_readtimestamp(adreno_dev,
+				rb->id + KGSL_MEMSTORE_MAX,
+				type, timestamp);
+
+	return status;
+}
+
+/**
+ * adreno_readtimestamp(): Return the value of given type of timestamp
+ * @device: GPU device whose timestamp values are being queried
+ * @priv: The object being queried for a timestamp (expected to be a context)
+ * @type: The type of timestamp (one of 3) to be read
+ * @timestamp: Pointer to where the read timestamp is to be written to
+ *
+ * CONSUMED and RETIRED type timestamps are sorted by id and are constantly
+ * updated by the GPU through shared memstore memory. QUEUED type timestamps
+ * are read directly from context struct.
+
+ * The function returns 0 on success and timestamp value at the *timestamp
+ * address and returns -EINVAL on any read error/invalid type and timestamp = 0.
+ */
+static int adreno_readtimestamp(struct kgsl_device *device,
+		void *priv, enum kgsl_timestamp_type type,
+		unsigned int *timestamp)
+{
+	int status = 0;
+	struct kgsl_context *context = priv;
+
+	if (type == KGSL_TIMESTAMP_QUEUED) {
+		struct adreno_context *ctxt = ADRENO_CONTEXT(context);
+
+		*timestamp = ctxt->timestamp;
+	} else
+		status = __adreno_readtimestamp(ADRENO_DEVICE(device),
+				context->id, type, timestamp);
+
+	return status;
+}
+
+/**
+ * adreno_device_private_create(): Allocate an adreno_device_private structure
+ */
+static struct kgsl_device_private *adreno_device_private_create(void)
+{
+	struct adreno_device_private *adreno_priv =
+			kzalloc(sizeof(*adreno_priv), GFP_KERNEL);
+
+	if (adreno_priv) {
+		INIT_LIST_HEAD(&adreno_priv->perfcounter_list);
+		return &adreno_priv->dev_priv;
+	}
+	return NULL;
+}
+
+/**
+ * adreno_device_private_destroy(): Destroy an adreno_device_private structure
+ * and release the perfcounters held by the kgsl fd.
+ * @dev_priv: The kgsl device private structure
+ */
+static void adreno_device_private_destroy(struct kgsl_device_private *dev_priv)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_device_private *adreno_priv =
+		container_of(dev_priv, struct adreno_device_private,
+		dev_priv);
+	struct adreno_perfcounter_list_node *p, *tmp;
+
+	mutex_lock(&device->mutex);
+	list_for_each_entry_safe(p, tmp, &adreno_priv->perfcounter_list, node) {
+		adreno_perfcounter_put(adreno_dev, p->groupid,
+					p->countable, PERFCOUNTER_FLAG_NONE);
+		list_del(&p->node);
+		kfree(p);
+	}
+	mutex_unlock(&device->mutex);
+
+	kfree(adreno_priv);
+}
+
+/**
+ * adreno_power_stats() - Reads the counters needed for freq decisions
+ * @device: Pointer to device whose counters are read
+ * @stats: Pointer to stats set that needs updating
+ * Power: The caller is expected to be in a clock enabled state as this
+ * function does reg reads
+ */
+static void adreno_power_stats(struct kgsl_device *device,
+				struct kgsl_power_stats *stats)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+
+	return gpudev->power_stats(adreno_dev, stats);
+}
+
+static int adreno_regulator_enable(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (gpudev->regulator_enable)
+		return gpudev->regulator_enable(adreno_dev);
+
+	return 0;
+}
+
+static bool adreno_is_hw_collapsible(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (!gpudev->is_hw_collapsible(adreno_dev))
+		return false;
+
+	if (gpudev->clear_pending_transactions(adreno_dev))
+		return false;
+
+	adreno_dispatcher_stop_fault_timer(device);
+
+	return true;
+}
+
+static void adreno_regulator_disable(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (gpudev->regulator_disable)
+		gpudev->regulator_disable(adreno_dev);
+}
+
+static void adreno_pwrlevel_change_settings(struct kgsl_device *device,
+		unsigned int prelevel, unsigned int postlevel, bool post)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (gpudev->pwrlevel_change_settings)
+		gpudev->pwrlevel_change_settings(adreno_dev, prelevel,
+					postlevel, post);
+}
+
+static bool adreno_is_hwcg_on(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	return adreno_dev->hwcg_enabled;
+}
+
+static int adreno_queue_cmds(struct kgsl_device_private *dev_priv,
+	struct kgsl_context *context, struct kgsl_drawobj *drawobj[],
+	u32 count, u32 *timestamp)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (WARN_ON(!adreno_dev->dispatch_ops || !adreno_dev->dispatch_ops->queue_cmds))
+		return -ENODEV;
+
+	return adreno_dev->dispatch_ops->queue_cmds(dev_priv, context, drawobj,
+		count, timestamp);
+}
+
+static inline bool _verify_ib(struct kgsl_device_private *dev_priv,
+		struct kgsl_context *context, struct kgsl_memobj_node *ib)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+
+	/* The maximum allowable size for an IB in the CP is 0xFFFFF dwords */
+	if (ib->size == 0 || ((ib->size >> 2) > 0xFFFFF)) {
+		pr_context(device, context, "ctxt %u invalid ib size %lld\n",
+			context->id, ib->size);
+		return false;
+	}
+
+	/* Make sure that the address is in range and dword aligned */
+	if (!kgsl_mmu_gpuaddr_in_range(private->pagetable, ib->gpuaddr,
+		ib->size) || !IS_ALIGNED(ib->gpuaddr, 4)) {
+		pr_context(device, context, "ctxt %u invalid ib gpuaddr %llX\n",
+			context->id, ib->gpuaddr);
+		return false;
+	}
+
+	return true;
+}
+
+int adreno_verify_cmdobj(struct kgsl_device_private *dev_priv,
+		struct kgsl_context *context, struct kgsl_drawobj *drawobj[],
+		uint32_t count)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_memobj_node *ib;
+	unsigned int i;
+
+	for (i = 0; i < count; i++) {
+		/* Verify the IBs before they get queued */
+		if (drawobj[i]->type == CMDOBJ_TYPE) {
+			struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj[i]);
+
+			list_for_each_entry(ib, &cmdobj->cmdlist, node)
+				if (!_verify_ib(dev_priv,
+					&ADRENO_CONTEXT(context)->base, ib))
+					return -EINVAL;
+
+			/*
+			 * Clear the wake on touch bit to indicate an IB has
+			 * been submitted since the last time we set it.
+			 * But only clear it when we have rendering commands.
+			 */
+			ADRENO_DEVICE(device)->wake_on_touch = false;
+		}
+
+		/* A3XX does not have support for drawobj profiling */
+		if (adreno_is_a3xx(ADRENO_DEVICE(device)) &&
+			(drawobj[i]->flags & KGSL_DRAWOBJ_PROFILING))
+			return -EOPNOTSUPP;
+	}
+
+	return 0;
+}
+
+static int adreno_queue_recurring_cmd(struct kgsl_device_private *dev_priv,
+	struct kgsl_context *context, struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+	struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj);
+	int ret;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_LSR))
+		return -EOPNOTSUPP;
+
+	if (!gpudev->send_recurring_cmdobj)
+		return -ENODEV;
+
+	ret = adreno_verify_cmdobj(dev_priv, context, &drawobj, 1);
+	if (ret)
+		return ret;
+
+	mutex_lock(&device->mutex);
+
+	/* Only one recurring command allowed */
+	if (hwsched->recurring_cmdobj) {
+		mutex_unlock(&device->mutex);
+		return -EINVAL;
+	}
+
+	ret = kgsl_check_context_state(context);
+	if (ret) {
+		mutex_unlock(&device->mutex);
+		return ret;
+	}
+
+	set_bit(CMDOBJ_RECURRING_START, &cmdobj->priv);
+
+	ret = gpudev->send_recurring_cmdobj(adreno_dev, cmdobj);
+	mutex_unlock(&device->mutex);
+
+	if (!ret)
+		srcu_notifier_call_chain(&device->nh, GPU_GMU_READY, NULL);
+
+	return ret;
+}
+
+static int adreno_dequeue_recurring_cmd(struct kgsl_device *device,
+	struct kgsl_context *context)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+	struct kgsl_drawobj *recurring_drawobj;
+	int ret;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_LSR))
+		return -EOPNOTSUPP;
+
+	if (!gpudev->send_recurring_cmdobj)
+		return -ENODEV;
+
+	mutex_lock(&device->mutex);
+
+	/* We can safely return here as recurring wokload is already untracked */
+	if (hwsched->recurring_cmdobj == NULL) {
+		mutex_unlock(&device->mutex);
+		return -EINVAL;
+	}
+
+	recurring_drawobj = DRAWOBJ(hwsched->recurring_cmdobj);
+
+	/* Check if the recurring command is for same context or not*/
+	if (recurring_drawobj->context != context) {
+		mutex_unlock(&device->mutex);
+		return -EINVAL;
+	}
+
+	ret = kgsl_check_context_state(context);
+	if (ret) {
+		mutex_unlock(&device->mutex);
+		return ret;
+	}
+
+	clear_bit(CMDOBJ_RECURRING_START, &hwsched->recurring_cmdobj->priv);
+	set_bit(CMDOBJ_RECURRING_STOP, &hwsched->recurring_cmdobj->priv);
+
+	ret = gpudev->send_recurring_cmdobj(adreno_dev, hwsched->recurring_cmdobj);
+
+	mutex_unlock(&device->mutex);
+
+	if (!ret)
+		srcu_notifier_call_chain(&device->nh, GPU_GMU_STOP, NULL);
+
+	return ret;
+}
+
+static void adreno_set_isdb_breakpoint_registers(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (gpudev->set_isdb_breakpoint_registers)
+		gpudev->set_isdb_breakpoint_registers(adreno_dev);
+
+	return;
+}
+
+static void adreno_drawctxt_sched(struct kgsl_device *device,
+		struct kgsl_context *context)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (WARN_ON(!adreno_dev->dispatch_ops || !adreno_dev->dispatch_ops->queue_context))
+		return;
+
+	adreno_dev->dispatch_ops->queue_context(adreno_dev,
+		ADRENO_CONTEXT(context));
+}
+
+void adreno_mark_for_coldboot(struct adreno_device *adreno_dev)
+{
+	if (!adreno_dev->warmboot_enabled)
+		return;
+
+	set_bit(ADRENO_DEVICE_FORCE_COLDBOOT, &adreno_dev->priv);
+}
+
+int adreno_power_cycle(struct adreno_device *adreno_dev,
+	void (*callback)(struct adreno_device *adreno_dev, void *priv),
+	void *priv)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_power_ops *ops = ADRENO_POWER_OPS(adreno_dev);
+	int ret;
+
+	mutex_lock(&device->mutex);
+	ret = ops->pm_suspend(adreno_dev);
+
+	if (!ret) {
+		callback(adreno_dev, priv);
+		adreno_mark_for_coldboot(adreno_dev);
+		ops->pm_resume(adreno_dev);
+	}
+
+	mutex_unlock(&device->mutex);
+
+	return ret;
+}
+
+struct cycle_data {
+	void *ptr;
+	void *val;
+};
+
+static void cycle_set_bool(struct adreno_device *adreno_dev, void *priv)
+{
+	struct cycle_data *data = priv;
+
+	*((bool *) data->ptr) = *((bool *) data->val);
+}
+
+int adreno_power_cycle_bool(struct adreno_device *adreno_dev,
+	bool *flag, bool val)
+{
+	struct cycle_data data = { .ptr = flag, .val = &val };
+
+	return adreno_power_cycle(adreno_dev, cycle_set_bool, &data);
+}
+
+static void cycle_set_u32(struct adreno_device *adreno_dev, void *priv)
+{
+	struct cycle_data *data = priv;
+
+	*((u32 *) data->ptr) = *((u32 *) data->val);
+}
+
+int adreno_power_cycle_u32(struct adreno_device *adreno_dev,
+	u32 *flag, u32 val)
+{
+	struct cycle_data data = { .ptr = flag, .val = &val };
+
+	return adreno_power_cycle(adreno_dev, cycle_set_u32, &data);
+}
+
+static int adreno_gpu_clock_set(struct kgsl_device *device, u32 pwrlevel)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_power_ops *ops = ADRENO_POWER_OPS(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct kgsl_pwrlevel *pl = &pwr->pwrlevels[pwrlevel];
+	int ret;
+
+	if (ops->gpu_clock_set)
+		return ops->gpu_clock_set(adreno_dev, pwrlevel);
+
+	ret = clk_set_rate(pwr->grp_clks[0], pl->gpu_freq);
+	if (ret)
+		dev_err(device->dev, "GPU clk freq set failure: %d\n", ret);
+
+	return ret;
+}
+
+static int adreno_interconnect_bus_set(struct adreno_device *adreno_dev,
+	int level, u32 ab)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	if ((level == pwr->cur_buslevel) && (ab == pwr->cur_ab))
+		return 0;
+
+	kgsl_icc_set_tag(pwr, level);
+	pwr->cur_buslevel = level;
+	pwr->cur_ab = ab;
+
+	icc_set_bw(pwr->icc_path, MBps_to_icc(ab),
+		kBps_to_icc(pwr->ddr_table[level]));
+
+	trace_kgsl_buslevel(device, pwr->active_pwrlevel, level, ab);
+
+	return 0;
+}
+
+static int adreno_gpu_bus_set(struct kgsl_device *device, int level, u32 ab)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_power_ops *ops = ADRENO_POWER_OPS(adreno_dev);
+
+	if (ops->gpu_bus_set)
+		return ops->gpu_bus_set(adreno_dev, level, ab);
+
+	return adreno_interconnect_bus_set(adreno_dev, level, ab);
+}
+
+static void adreno_deassert_gbif_halt(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (gpudev->deassert_gbif_halt)
+		gpudev->deassert_gbif_halt(adreno_dev);
+}
+
+static void adreno_create_hw_fence(struct kgsl_device *device, struct kgsl_sync_fence *kfence)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (WARN_ON(!adreno_dev->dispatch_ops))
+		return;
+
+	if (adreno_dev->dispatch_ops->create_hw_fence)
+		adreno_dev->dispatch_ops->create_hw_fence(adreno_dev, kfence);
+}
+
+u64 adreno_read_cx_timer(struct adreno_device *adreno_dev)
+{
+	/* Check if the CX timer is initialized */
+	if (!test_bit(ADRENO_DEVICE_CX_TIMER_INITIALIZED, &adreno_dev->priv))
+		return 0;
+
+	/* Since the GPU CX and CPU timers are synchronized return the CPU timer */
+	return arch_timer_read_counter();
+}
+
+static const struct kgsl_functable adreno_functable = {
+	/* Mandatory functions */
+	.suspend_context = adreno_suspend_context,
+	.first_open = adreno_first_open,
+	.start = adreno_start,
+	.stop = adreno_stop,
+	.last_close = adreno_last_close,
+	.getproperty = adreno_getproperty,
+	.getproperty_compat = adreno_getproperty_compat,
+	.waittimestamp = adreno_waittimestamp,
+	.readtimestamp = adreno_readtimestamp,
+	.queue_cmds = adreno_queue_cmds,
+	.ioctl = adreno_ioctl,
+	.compat_ioctl = adreno_compat_ioctl,
+	.power_stats = adreno_power_stats,
+	.snapshot = adreno_snapshot,
+	.drain_and_idle = adreno_drain_and_idle,
+	.device_private_create = adreno_device_private_create,
+	.device_private_destroy = adreno_device_private_destroy,
+	/* Optional functions */
+	.drawctxt_create = adreno_drawctxt_create,
+	.drawctxt_detach = adreno_drawctxt_detach,
+	.drawctxt_destroy = adreno_drawctxt_destroy,
+	.drawctxt_dump = adreno_drawctxt_dump,
+	.setproperty = adreno_setproperty,
+	.setproperty_compat = adreno_setproperty_compat,
+	.drawctxt_sched = adreno_drawctxt_sched,
+	.resume = adreno_dispatcher_start,
+	.regulator_enable = adreno_regulator_enable,
+	.is_hw_collapsible = adreno_is_hw_collapsible,
+	.regulator_disable = adreno_regulator_disable,
+	.pwrlevel_change_settings = adreno_pwrlevel_change_settings,
+	.query_property_list = adreno_query_property_list,
+	.is_hwcg_on = adreno_is_hwcg_on,
+	.gpu_clock_set = adreno_gpu_clock_set,
+	.gpu_bus_set = adreno_gpu_bus_set,
+	.deassert_gbif_halt = adreno_deassert_gbif_halt,
+	.queue_recurring_cmd = adreno_queue_recurring_cmd,
+	.dequeue_recurring_cmd = adreno_dequeue_recurring_cmd,
+	.set_isdb_breakpoint_registers = adreno_set_isdb_breakpoint_registers,
+	.create_hw_fence = adreno_create_hw_fence,
+};
+
+static const struct component_master_ops adreno_ops = {
+	.bind = adreno_bind,
+	.unbind = adreno_unbind,
+};
+
+const struct adreno_power_ops adreno_power_operations = {
+	.first_open = adreno_open,
+	.last_close = adreno_close,
+	.active_count_get = adreno_pwrctrl_active_count_get,
+	.active_count_put = adreno_pwrctrl_active_count_put,
+	.pm_suspend = adreno_suspend,
+	.pm_resume = adreno_resume,
+	.touch_wakeup = adreno_touch_wakeup,
+};
+
+static int _compare_of(struct device *dev, void *data)
+{
+	return (dev->of_node == data);
+}
+
+static void _release_of(struct device *dev, void *data)
+{
+	of_node_put(data);
+}
+
+static void adreno_add_components(struct device *dev,
+		struct component_match **match)
+{
+	struct device_node *node;
+
+	/*
+	 * Add kgsl-smmu, context banks and gmu as components, if supported.
+	 * Master bind (adreno_bind) will be called only once all added
+	 * components are available.
+	 */
+	for_each_matching_node(node, adreno_component_match) {
+		if (!of_device_is_available(node))
+			continue;
+
+		component_match_add_release(dev, match, _release_of, _compare_of, node);
+	}
+}
+
+static int adreno_probe(struct platform_device *pdev)
+{
+	struct component_match *match = NULL;
+
+	adreno_add_components(&pdev->dev, &match);
+
+	if (!match)
+		return -ENODEV;
+
+	return component_master_add_with_match(&pdev->dev,
+			&adreno_ops, match);
+}
+
+static int adreno_remove(struct platform_device *pdev)
+{
+	component_master_del(&pdev->dev, &adreno_ops);
+
+	return 0;
+}
+
+#if IS_ENABLED(CONFIG_QCOM_KGSL_HIBERNATION)
+#if IS_ENABLED(CONFIG_QCOM_SECURE_BUFFER)
+/*
+ * Issue hyp_assign call to assign non-used internal/userspace secure
+ * buffers to kernel.
+ */
+static int adreno_secure_pt_hibernate(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_process_private *process;
+	struct kgsl_mem_entry *entry;
+	struct kgsl_global_memdesc *md;
+	struct kgsl_memdesc *memdesc;
+	int ret, id;
+
+	read_lock(&kgsl_driver.proclist_lock);
+	list_for_each_entry(process, &kgsl_driver.process_list, list) {
+		idr_for_each_entry(&process->mem_idr, entry, id) {
+			memdesc = &entry->memdesc;
+			if (!kgsl_memdesc_is_secured(memdesc) ||
+				(memdesc->flags & KGSL_MEMFLAGS_USERMEM_ION) ||
+				(memdesc->priv & KGSL_MEMDESC_HYPASSIGNED_HLOS))
+				continue;
+
+			read_unlock(&kgsl_driver.proclist_lock);
+
+			if (kgsl_unlock_sgt(memdesc->sgt))
+				dev_err(device->dev, "kgsl_unlock_sgt failed\n");
+
+			memdesc->priv |= KGSL_MEMDESC_HYPASSIGNED_HLOS;
+
+			read_lock(&kgsl_driver.proclist_lock);
+		}
+	}
+	read_unlock(&kgsl_driver.proclist_lock);
+
+	list_for_each_entry(md, &device->globals, node) {
+		memdesc = &md->memdesc;
+		if (kgsl_memdesc_is_secured(memdesc) &&
+			!(memdesc->priv & KGSL_MEMDESC_HYPASSIGNED_HLOS)) {
+			ret = kgsl_unlock_sgt(memdesc->sgt);
+			if (ret) {
+				dev_err(device->dev, "kgsl_unlock_sgt failed ret %d\n", ret);
+				goto fail;
+			}
+			memdesc->priv |= KGSL_MEMDESC_HYPASSIGNED_HLOS;
+		}
+	}
+
+	return 0;
+
+fail:
+	list_for_each_entry(md, &device->globals, node) {
+		memdesc = &md->memdesc;
+		if (kgsl_memdesc_is_secured(memdesc) &&
+			(memdesc->priv & KGSL_MEMDESC_HYPASSIGNED_HLOS)) {
+			kgsl_lock_sgt(memdesc->sgt, memdesc->size);
+			memdesc->priv &= ~KGSL_MEMDESC_HYPASSIGNED_HLOS;
+		}
+	}
+
+	return -EBUSY;
+}
+
+static int adreno_secure_pt_restore(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_process_private *process;
+	struct kgsl_mem_entry *entry;
+	struct kgsl_memdesc *memdesc;
+	struct kgsl_global_memdesc *md;
+	int ret, id;
+
+	list_for_each_entry(md, &device->globals, node) {
+		memdesc = &md->memdesc;
+		if (kgsl_memdesc_is_secured(memdesc) &&
+			(memdesc->priv & KGSL_MEMDESC_HYPASSIGNED_HLOS)) {
+			ret = kgsl_lock_sgt(memdesc->sgt, memdesc->size);
+			if (ret) {
+				dev_err(device->dev, "kgsl_lock_sgt failed ret %d\n", ret);
+				return ret;
+			}
+			memdesc->priv &= ~KGSL_MEMDESC_HYPASSIGNED_HLOS;
+		}
+	}
+
+	read_lock(&kgsl_driver.proclist_lock);
+	list_for_each_entry(process, &kgsl_driver.process_list, list) {
+		idr_for_each_entry(&process->mem_idr, entry, id) {
+			memdesc = &entry->memdesc;
+			if (!kgsl_memdesc_is_secured(memdesc) ||
+				(memdesc->flags & KGSL_MEMFLAGS_USERMEM_ION) ||
+				!(memdesc->priv & KGSL_MEMDESC_HYPASSIGNED_HLOS))
+				continue;
+
+			read_unlock(&kgsl_driver.proclist_lock);
+
+			ret = kgsl_lock_sgt(memdesc->sgt, memdesc->size);
+			if (ret) {
+				dev_err(device->dev, "kgsl_lock_sgt failed ret %d\n", ret);
+				return ret;
+			}
+			memdesc->priv &= ~KGSL_MEMDESC_HYPASSIGNED_HLOS;
+
+			read_lock(&kgsl_driver.proclist_lock);
+		}
+	}
+	read_unlock(&kgsl_driver.proclist_lock);
+
+	return 0;
+}
+#else
+static int adreno_secure_pt_hibernate(struct adreno_device *adreno_dev)
+{
+	return 0;
+}
+
+static int adreno_secure_pt_restore(struct adreno_device *adreno_dev)
+{
+	return 0;
+}
+#endif /* IS_ENABLED(CONFIG_QCOM_SECURE_BUFFER) */
+
+static int adreno_hibernation_suspend(struct device *dev)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct adreno_device *adreno_dev;
+	const struct adreno_power_ops *ops;
+	int status;
+
+	if (!device)
+		return 0;
+
+	adreno_dev = ADRENO_DEVICE(device);
+	ops = ADRENO_POWER_OPS(adreno_dev);
+
+	mutex_lock(&device->mutex);
+
+	status = ops->pm_suspend(adreno_dev);
+	if (status)
+		goto err;
+
+	/*
+	 * Unload zap shader during device hibernation and reload it
+	 * during resume as there is possibility that TZ driver
+	 * is not aware of the hibernation.
+	 */
+	adreno_zap_shader_unload(adreno_dev);
+	status = adreno_secure_pt_hibernate(adreno_dev);
+
+err:
+	mutex_unlock(&device->mutex);
+	return status;
+}
+
+static int adreno_hibernation_resume(struct device *dev)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_iommu *iommu;
+	struct kgsl_pwrscale *pwrscale;
+	struct adreno_device *adreno_dev;
+	const struct adreno_power_ops *ops;
+	int ret;
+
+	if (!device)
+		return 0;
+
+	iommu = &device->mmu.iommu;
+	pwrscale = &device->pwrscale;
+	adreno_dev = ADRENO_DEVICE(device);
+	ops = ADRENO_POWER_OPS(adreno_dev);
+
+	mutex_lock(&device->mutex);
+
+	ret = adreno_secure_pt_restore(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = kgsl_set_smmu_aperture(device, &iommu->user_context);
+	if (ret)
+		goto err;
+
+	gmu_core_dev_force_first_boot(device);
+
+	msm_adreno_tz_reinit(pwrscale->devfreqptr);
+
+	ops->pm_resume(adreno_dev);
+
+err:
+	mutex_unlock(&device->mutex);
+	return ret;
+}
+
+static const struct dev_pm_ops adreno_pm_ops = {
+	.suspend  = adreno_pm_suspend,
+	.resume = adreno_pm_resume,
+	.freeze = adreno_hibernation_suspend,
+	.thaw = adreno_hibernation_resume,
+	.poweroff = adreno_hibernation_suspend,
+	.restore = adreno_hibernation_resume,
+};
+#else
+static const struct dev_pm_ops adreno_pm_ops = {
+	SET_SYSTEM_SLEEP_PM_OPS(adreno_pm_suspend, adreno_pm_resume)
+};
+#endif /* IS_ENABLED(CONFIG_QCOM_KGSL_HIBERNATION) */
+
+static struct platform_driver adreno_platform_driver = {
+	.probe = adreno_probe,
+	.remove = adreno_remove,
+	.driver = {
+		.name = "kgsl-3d",
+		.pm = &adreno_pm_ops,
+		.of_match_table = of_match_ptr(adreno_match_table),
+	}
+};
+
+static int __init kgsl_3d_init(void)
+{
+	int ret;
+
+	ret = kgsl_core_init();
+	if (ret)
+		return ret;
+
+	ret = kgsl_mmu_init();
+	if (ret) {
+		kgsl_core_exit();
+		return ret;
+	}
+
+	gmu_core_register();
+	ret = platform_driver_register(&adreno_platform_driver);
+	if (ret) {
+		gmu_core_unregister();
+		kgsl_mmu_exit();
+		kgsl_core_exit();
+	}
+
+	return ret;
+}
+
+static void __exit kgsl_3d_exit(void)
+{
+	platform_driver_unregister(&adreno_platform_driver);
+	gmu_core_unregister();
+	kgsl_mmu_exit();
+	kgsl_core_exit();
+}
+
+module_param_named(preempt_enable, adreno_preemption_enable, bool, 0600);
+MODULE_PARM_DESC(preempt_enable, "Enable GPU HW Preemption");
+
+module_init(kgsl_3d_init);
+module_exit(kgsl_3d_exit);
+
+MODULE_DESCRIPTION("3D Graphics driver");
+MODULE_LICENSE("GPL v2");
+MODULE_SOFTDEP("pre: arm_smmu nvmem_qfprom socinfo");
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0))
+MODULE_IMPORT_NS(DMA_BUF);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno.h
@@ -0,0 +1,1984 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2008-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_H
+#define __ADRENO_H
+
+#include <linux/iopoll.h>
+#include <linux/of.h>
+#include "adreno_coresight.h"
+#include "adreno_dispatch.h"
+#include "adreno_drawctxt.h"
+#include "adreno_hfi.h"
+#include "adreno_hwsched.h"
+#include "adreno_perfcounter.h"
+#include "adreno_profile.h"
+#include "adreno_ringbuffer.h"
+#include "kgsl_sharedmem.h"
+
+/* Used to point CP to the SMMU record during preemption */
+#define SET_PSEUDO_SMMU_INFO 0
+/* Used to inform CP where to save preemption data at the time of switch out */
+#define SET_PSEUDO_PRIV_NON_SECURE_SAVE_ADDR 1
+/* Used to inform CP where to save secure preemption data at the time of switch out */
+#define SET_PSEUDO_PRIV_SECURE_SAVE_ADDR 2
+/* Used to inform CP where to save per context non-secure data at the time of switch out */
+#define SET_PSEUDO_NON_PRIV_SAVE_ADDR 3
+/* Used to inform CP where to save preemption counter data at the time of switch out */
+#define SET_PSEUDO_COUNTER 4
+
+/* Index to preemption scratch buffer to store current QOS value */
+#define QOS_VALUE_IDX KGSL_PRIORITY_MAX_RB_LEVELS
+
+/* ADRENO_DEVICE - Given a kgsl_device return the adreno device struct */
+#define ADRENO_DEVICE(device) \
+		container_of(device, struct adreno_device, dev)
+
+/* KGSL_DEVICE - given an adreno_device, return the KGSL device struct */
+#define KGSL_DEVICE(_dev) (&((_dev)->dev))
+
+/* ADRENO_CONTEXT - Given a context return the adreno context struct */
+#define ADRENO_CONTEXT(context) \
+		container_of(context, struct adreno_context, base)
+
+/* ADRENO_GPU_DEVICE - Given an adreno device return the GPU specific struct */
+#define ADRENO_GPU_DEVICE(_a) ((_a)->gpucore->gpudev)
+
+/*
+ * ADRENO_POWER_OPS - Given an adreno device return the GPU specific power
+ * ops
+ */
+#define ADRENO_POWER_OPS(_a) ((_a)->gpucore->gpudev->power_ops)
+
+#define ADRENO_CHIPID_CORE(_id) FIELD_GET(GENMASK(31, 24), _id)
+#define ADRENO_CHIPID_MAJOR(_id) FIELD_GET(GENMASK(23, 16), _id)
+#define ADRENO_CHIPID_MINOR(_id) FIELD_GET(GENMASK(15, 8), _id)
+#define ADRENO_CHIPID_PATCH(_id) FIELD_GET(GENMASK(7, 0), _id)
+
+#define ADRENO_GMU_CHIPID(_id) \
+	(FIELD_PREP(GENMASK(31, 24), ADRENO_CHIPID_CORE(_id)) | \
+	 FIELD_PREP(GENMASK(23, 16), ADRENO_CHIPID_MAJOR(_id)) | \
+	 FIELD_PREP(GENMASK(15, 12), ADRENO_CHIPID_MINOR(_id)) | \
+	 FIELD_PREP(GENMASK(11, 8), ADRENO_CHIPID_PATCH(_id)))
+
+#define ADRENO_REV_MAJOR(_rev) FIELD_GET(GENMASK(23, 16), _rev)
+#define ADRENO_REV_MINOR(_rev) FIELD_GET(GENMASK(15, 8), _rev)
+#define ADRENO_REV_PATCH(_rev) FIELD_GET(GENMASK(7, 0), _rev)
+
+#define ADRENO_GMU_REV(_rev) \
+	(FIELD_PREP(GENMASK(31, 24), ADRENO_REV_MAJOR(_rev)) | \
+	 FIELD_PREP(GENMASK(23, 16), ADRENO_REV_MINOR(_rev)) | \
+	 FIELD_PREP(GENMASK(15, 8), ADRENO_REV_PATCH(_rev)))
+
+/* ADRENO_GPUREV - Return the GPU ID for the given adreno_device */
+#define ADRENO_GPUREV(_a) ((_a)->gpucore->gpurev)
+
+/*
+ * ADRENO_FEATURE - return true if the specified feature is supported by the GPU
+ * core
+ */
+#define ADRENO_FEATURE(_dev, _bit) \
+	((_dev)->gpucore->features & (_bit))
+
+/**
+ * ADRENO_QUIRK - return true if the specified quirk is required by the GPU
+ */
+#define ADRENO_QUIRK(_dev, _bit) \
+	((_dev)->quirks & (_bit))
+
+#define ADRENO_FW(a, f)		(&(a->fw[f]))
+
+/* Adreno core features */
+/* The core supports SP/TP hw controlled power collapse */
+#define ADRENO_SPTP_PC BIT(0)
+/* The GPU supports content protection */
+#define ADRENO_CONTENT_PROTECTION BIT(1)
+/* The GPU supports preemption */
+#define ADRENO_PREEMPTION BIT(2)
+/* The GPMU supports Limits Management */
+#define ADRENO_LM BIT(3)
+/* The GPU supports retention for cpz registers */
+#define ADRENO_CPZ_RETENTION BIT(4)
+/* The core has soft fault detection available */
+#define ADRENO_SOFT_FAULT_DETECT BIT(5)
+/* The GMU supports IFPC power management*/
+#define ADRENO_IFPC BIT(6)
+/* The core supports IO-coherent memory */
+#define ADRENO_IOCOHERENT BIT(7)
+/*
+ * The GMU supports Adaptive Clock Distribution (ACD)
+ * for droop mitigation
+ */
+#define ADRENO_ACD BIT(8)
+/* Cooperative reset enabled GMU */
+#define ADRENO_COOP_RESET BIT(9)
+/* Indicates that the specific target is no longer supported */
+#define ADRENO_DEPRECATED BIT(10)
+/* The target supports ringbuffer level APRIV */
+#define ADRENO_APRIV BIT(11)
+/* The GMU supports Battery Current Limiting */
+#define ADRENO_BCL BIT(12)
+/* L3 voting is supported with L3 constraints */
+#define ADRENO_L3_VOTE BIT(13)
+/* LPAC is supported  */
+#define ADRENO_LPAC BIT(14)
+/* Late Stage Reprojection (LSR) enablment for GMU */
+#define ADRENO_LSR BIT(15)
+/* GMU and kernel supports hardware fences */
+#define ADRENO_HW_FENCE BIT(16)
+/* Dynamic Mode Switching supported on this target */
+#define ADRENO_DMS BIT(17)
+/* AQE supported on this target */
+#define ADRENO_AQE BIT(18)
+/* Warm Boot supported on this target */
+#define ADRENO_GMU_WARMBOOT BIT(19)
+/* The GPU supports CLX */
+#define ADRENO_CLX BIT(20)
+
+/*
+ * Adreno GPU quirks - control bits for various workarounds
+ */
+
+/* Set TWOPASSUSEWFI in PC_DBG_ECO_CNTL (5XX/6XX) */
+#define ADRENO_QUIRK_TWO_PASS_USE_WFI BIT(0)
+/* Submit critical packets at GPU wake up */
+#define ADRENO_QUIRK_CRITICAL_PACKETS BIT(1)
+/* Mask out RB1-3 activity signals from HW hang detection logic */
+#define ADRENO_QUIRK_FAULT_DETECT_MASK BIT(2)
+/* Disable RB sampler datapath clock gating optimization */
+#define ADRENO_QUIRK_DISABLE_RB_DP2CLOCKGATING BIT(3)
+/* Disable local memory(LM) feature to avoid corner case error */
+#define ADRENO_QUIRK_DISABLE_LMLOADKILL BIT(4)
+/* Allow HFI to use registers to send message to GMU */
+#define ADRENO_QUIRK_HFI_USE_REG BIT(5)
+/* Only set protected SECVID registers once */
+#define ADRENO_QUIRK_SECVID_SET_ONCE BIT(6)
+/*
+ * Limit number of read and write transactions from
+ * UCHE block to GBIF to avoid possible deadlock
+ * between GBIF, SMMU and MEMNOC.
+ */
+#define ADRENO_QUIRK_LIMIT_UCHE_GBIF_RW BIT(8)
+/* Do explicit mode control of cx gdsc */
+#define ADRENO_QUIRK_CX_GDSC BIT(9)
+
+/* Command identifiers */
+#define CONTEXT_TO_MEM_IDENTIFIER	0x2EADBEEF
+#define CMD_IDENTIFIER			0x2EEDFACE
+#define CMD_INTERNAL_IDENTIFIER		0x2EEDD00D
+#define START_IB_IDENTIFIER		0x2EADEABE
+#define END_IB_IDENTIFIER		0x2ABEDEAD
+#define START_PROFILE_IDENTIFIER	0x2DEFADE1
+#define END_PROFILE_IDENTIFIER		0x2DEFADE2
+#define PWRON_FIXUP_IDENTIFIER		0x2AFAFAFA
+
+/* One cannot wait forever for the core to idle, so set an upper limit to the
+ * amount of time to wait for the core to go idle
+ */
+#define ADRENO_IDLE_TIMEOUT (20 * 1000)
+
+#define ADRENO_FW_PFP 0
+#define ADRENO_FW_SQE 0
+#define ADRENO_FW_PM4 1
+#define ADRENO_FW_AQE 1
+
+enum adreno_gpurev {
+	ADRENO_REV_UNKNOWN = 0,
+	ADRENO_REV_A304 = 304,
+	ADRENO_REV_A305 = 305,
+	ADRENO_REV_A305C = 306,
+	ADRENO_REV_A306 = 307,
+	ADRENO_REV_A306A = 308,
+	ADRENO_REV_A310 = 310,
+	ADRENO_REV_A320 = 320,
+	ADRENO_REV_A330 = 330,
+	ADRENO_REV_A305B = 335,
+	ADRENO_REV_A405 = 405,
+	ADRENO_REV_A418 = 418,
+	ADRENO_REV_A420 = 420,
+	ADRENO_REV_A430 = 430,
+	ADRENO_REV_A505 = 505,
+	ADRENO_REV_A506 = 506,
+	ADRENO_REV_A508 = 508,
+	ADRENO_REV_A510 = 510,
+	ADRENO_REV_A512 = 512,
+	ADRENO_REV_A530 = 530,
+	ADRENO_REV_A540 = 540,
+	ADRENO_REV_A610 = 610,
+	ADRENO_REV_A612 = 612,
+	ADRENO_REV_A615 = 615,
+	ADRENO_REV_A616 = 616,
+	ADRENO_REV_A618 = 618,
+	ADRENO_REV_A619 = 619,
+	ADRENO_REV_A620 = 620,
+	ADRENO_REV_A621 = 621,
+	ADRENO_REV_A623 = 623,
+	ADRENO_REV_A630 = 630,
+	ADRENO_REV_A640 = 640,
+	ADRENO_REV_A642 = 642,
+	ADRENO_REV_A643 = 643,
+	ADRENO_REV_A650 = 650,
+	ADRENO_REV_A660 = 660,
+	ADRENO_REV_A662 = 662,
+	ADRENO_REV_A663 = 663,
+	ADRENO_REV_A680 = 680,
+	ADRENO_REV_A702 = 702,
+	/*
+	 * Gen7 and higher version numbers may exceed 1 digit
+	 * Bits 16-23: Major
+	 * Bits 8-15: Minor
+	 * Bits 0-7: Patch id
+	 */
+	ADRENO_REV_GEN7_0_0 = 0x070000,
+	ADRENO_REV_GEN7_0_1 = 0x070001,
+	ADRENO_REV_GEN7_2_0 = 0x070200,
+	ADRENO_REV_GEN7_2_1 = 0x070201,
+	ADRENO_REV_GEN7_4_0 = 0x070400,
+	ADRENO_REV_GEN7_9_0 = 0x070900,
+	ADRENO_REV_GEN7_9_1 = 0x070901,
+};
+
+#define ADRENO_SOFT_FAULT BIT(0)
+#define ADRENO_HARD_FAULT BIT(1)
+#define ADRENO_TIMEOUT_FAULT BIT(2)
+#define ADRENO_IOMMU_PAGE_FAULT BIT(3)
+#define ADRENO_PREEMPT_FAULT BIT(4)
+#define ADRENO_GMU_FAULT BIT(5)
+#define ADRENO_CTX_DETATCH_TIMEOUT_FAULT BIT(6)
+#define ADRENO_GMU_FAULT_SKIP_SNAPSHOT BIT(7)
+
+/* number of throttle counters for DCVS adjustment */
+#define ADRENO_GPMU_THROTTLE_COUNTERS 4
+
+struct adreno_gpudev;
+
+/* Time to allow preemption to complete (in ms) */
+#define ADRENO_PREEMPT_TIMEOUT 10000
+
+#define PREEMPT_SCRATCH_OFFSET(id) (id * sizeof(u64))
+
+#define PREEMPT_SCRATCH_ADDR(dev, id) \
+	((dev)->preempt.scratch->gpuaddr + PREEMPT_SCRATCH_OFFSET(id))
+
+/**
+ * enum adreno_preempt_states
+ * ADRENO_PREEMPT_NONE: No preemption is scheduled
+ * ADRENO_PREEMPT_START: The S/W has started
+ * ADRENO_PREEMPT_TRIGGERED: A preeempt has been triggered in the HW
+ * ADRENO_PREEMPT_FAULTED: The preempt timer has fired
+ * ADRENO_PREEMPT_PENDING: The H/W has signaled preemption complete
+ * ADRENO_PREEMPT_COMPLETE: Preemption could not be finished in the IRQ handler,
+ * worker has been scheduled
+ */
+enum adreno_preempt_states {
+	ADRENO_PREEMPT_NONE = 0,
+	ADRENO_PREEMPT_START,
+	ADRENO_PREEMPT_TRIGGERED,
+	ADRENO_PREEMPT_FAULTED,
+	ADRENO_PREEMPT_PENDING,
+	ADRENO_PREEMPT_COMPLETE,
+};
+
+/**
+ * struct adreno_protected_regs - container for a protect register span
+ */
+struct adreno_protected_regs {
+	/** @reg: Physical protected mode register to write to */
+	u32 reg;
+	/** @start: Dword offset of the starting register in the range */
+	u32 start;
+	/**
+	 * @end: Dword offset of the ending register in the range
+	 * (inclusive)
+	 */
+	u32 end;
+	/**
+	 * @noaccess: 1 if the register should not be accessible from
+	 * userspace, 0 if it can be read (but not written)
+	 */
+	u32 noaccess;
+};
+
+/**
+ * struct adreno_preemption
+ * @state: The current state of preemption
+ * @scratch: Per-target scratch memory for implementation specific functionality
+ * @timer: A timer to make sure preemption doesn't stall
+ * @work: A work struct for the preemption worker (for 5XX)
+ * preempt_level: The level of preemption (for 6XX)
+ * skipsaverestore: To skip saverestore during L1 preemption (for 6XX)
+ * usesgmem: enable GMEM save/restore across preemption (for 6XX)
+ * count: Track the number of preemptions triggered
+ */
+struct adreno_preemption {
+	atomic_t state;
+	struct kgsl_memdesc *scratch;
+	struct timer_list timer;
+	struct work_struct work;
+	unsigned int preempt_level;
+	bool skipsaverestore;
+	bool usesgmem;
+	unsigned int count;
+	/* @postamble_len: Number of dwords in KMD postamble pm4 packet */
+	u32 postamble_len;
+	/*
+	 * @postamble_bootup_len: Number of dwords in KMD postamble pm4 packet
+	 * that needs to be sent before first submission to GPU.
+	 * Note: Postambles are not preserved across slumber.
+	 */
+	u32 postamble_bootup_len;
+};
+
+struct adreno_busy_data {
+	unsigned int gpu_busy;
+	unsigned int bif_ram_cycles;
+	unsigned int bif_ram_cycles_read_ch1;
+	unsigned int bif_ram_cycles_write_ch0;
+	unsigned int bif_ram_cycles_write_ch1;
+	unsigned int bif_starved_ram;
+	unsigned int bif_starved_ram_ch1;
+	unsigned int num_ifpc;
+	unsigned int throttle_cycles[ADRENO_GPMU_THROTTLE_COUNTERS];
+	u32 bcl_throttle;
+};
+
+/**
+ * struct adreno_firmware - Struct holding fw details
+ * @fwvirt: Buffer which holds the ucode
+ * @size: Size of ucode buffer
+ * @version: Version of ucode
+ * @memdesc: Memory descriptor which holds ucode buffer info
+ */
+struct adreno_firmware {
+	unsigned int *fwvirt;
+	size_t size;
+	unsigned int version;
+	struct kgsl_memdesc *memdesc;
+};
+
+/**
+ * struct adreno_perfcounter_list_node - struct to store perfcounters
+ * allocated by a process on a kgsl fd.
+ * @groupid: groupid of the allocated perfcounter
+ * @countable: countable assigned to the allocated perfcounter
+ * @node: list node for perfcounter_list of a process
+ */
+struct adreno_perfcounter_list_node {
+	unsigned int groupid;
+	unsigned int countable;
+	struct list_head node;
+};
+
+/**
+ * struct adreno_device_private - Adreno private structure per fd
+ * @dev_priv: the kgsl device private structure
+ * @perfcounter_list: list of perfcounters used by the process
+ */
+struct adreno_device_private {
+	struct kgsl_device_private dev_priv;
+	struct list_head perfcounter_list;
+};
+
+/**
+ * struct adreno_reglist_list - A container for list of registers and
+ * number of registers in the list
+ */
+struct adreno_reglist_list {
+	/** @reg: List of register **/
+	const u32 *regs;
+	/** @count: Number of registers in the list **/
+	u32 count;
+};
+
+/**
+ * struct adreno_power_ops - Container for target specific power up/down
+ * sequences
+ */
+struct adreno_power_ops {
+	/**
+	 * @first_open: Target specific function triggered when first kgsl
+	 * instance is opened
+	 */
+	int (*first_open)(struct adreno_device *adreno_dev);
+	/**
+	 * @last_close: Target specific function triggered when last kgsl
+	 * instance is closed
+	 */
+	int (*last_close)(struct adreno_device *adreno_dev);
+	/**
+	 * @active_count_get: Target specific function to keep gpu from power
+	 * collapsing
+	 */
+	int (*active_count_get)(struct adreno_device *adreno_dev);
+	/**
+	 * @active_count_put: Target specific function to allow gpu to power
+	 * collapse
+	 */
+	void (*active_count_put)(struct adreno_device *adreno_dev);
+	/** @pm_suspend: Target specific function to suspend the driver */
+	int (*pm_suspend)(struct adreno_device *adreno_dev);
+	/** @pm_resume: Target specific function to resume the driver */
+	void (*pm_resume)(struct adreno_device *adreno_dev);
+	/**
+	 * @touch_wakeup: Target specific function to start gpu on touch event
+	 */
+	void (*touch_wakeup)(struct adreno_device *adreno_dev);
+	/** @gpu_clock_set: Target specific function to set gpu frequency */
+	int (*gpu_clock_set)(struct adreno_device *adreno_dev, u32 pwrlevel);
+	/** @gpu_bus_set: Target specific function to set gpu bandwidth */
+	int (*gpu_bus_set)(struct adreno_device *adreno_dev, int bus_level,
+		u32 ab);
+};
+
+/**
+ * struct adreno_gpu_core - A specific GPU core definition
+ * @gpurev: Unique GPU revision identifier
+ * @core: Match for the core version of the GPU
+ * @major: Match for the major version of the GPU
+ * @minor: Match for the minor version of the GPU
+ * @patchid: Match for the patch revision of the GPU
+ * @features: Common adreno features supported by this core
+ * @gpudev: Pointer to the GPU family specific functions for this core
+ * @uche_gmem_alignment: Alignment required for UCHE GMEM base
+ * @gmem_size: Amount of binning memory (GMEM/OCMEM) to reserve for the core
+ * @bus_width: Bytes transferred in 1 cycle
+ */
+struct adreno_gpu_core {
+	enum adreno_gpurev gpurev;
+	unsigned int core, major, minor, patchid;
+	/**
+	 * @compatible: If specified, use the compatible string to match the
+	 * device
+	 */
+	const char *compatible;
+	unsigned long features;
+	const struct adreno_gpudev *gpudev;
+	const struct adreno_perfcounters *perfcounters;
+	u32 uche_gmem_alignment;
+	size_t gmem_size;
+	u32 bus_width;
+	/** @snapshot_size: Size of the static snapshot region in bytes */
+	u32 snapshot_size;
+};
+
+/**
+ * struct adreno_dispatch_ops - Common functions for dispatcher operations
+ */
+struct adreno_dispatch_ops {
+	/* @close: Shut down the dispatcher */
+	void (*close)(struct adreno_device *adreno_dev);
+	/* @queue_cmds: Queue a command on the context */
+	int (*queue_cmds)(struct kgsl_device_private *dev_priv,
+		struct kgsl_context *context, struct kgsl_drawobj *drawobj[],
+		u32 count, u32 *timestamp);
+	/* @queue_context: Queue a context to be dispatched */
+	void (*queue_context)(struct adreno_device *adreno_dev,
+			struct adreno_context *drawctxt);
+	void (*setup_context)(struct adreno_device *adreno_dev,
+			struct adreno_context *drawctxt);
+	void (*fault)(struct adreno_device *adreno_dev, u32 fault);
+	/* @create_hw_fence: Create a hardware fence */
+	void (*create_hw_fence)(struct adreno_device *adreno_dev, struct kgsl_sync_fence *kfence);
+};
+
+/**
+ * struct adreno_device - The mothership structure for all adreno related info
+ * @dev: Reference to struct kgsl_device
+ * @priv: Holds the private flags specific to the adreno_device
+ * @chipid: Chip ID specific to the GPU
+ * @cx_misc_len: Length of the CX MISC register block
+ * @cx_misc_virt: Pointer where the CX MISC block is mapped
+ * @isense_base: Base physical address of isense block
+ * @isense_len: Length of the isense register block
+ * @isense_virt: Pointer where isense block is mapped
+ * @gpucore: Pointer to the adreno_gpu_core structure
+ * @pfp_fw: Buffer which holds the pfp ucode
+ * @pfp_fw_size: Size of pfp ucode buffer
+ * @pfp_fw_version: Version of pfp ucode
+ * @pfp: Memory descriptor which holds pfp ucode buffer info
+ * @pm4_fw: Buffer which holds the pm4 ucode
+ * @pm4_fw_size: Size of pm4 ucode buffer
+ * @pm4_fw_version: Version of pm4 ucode
+ * @pm4: Memory descriptor which holds pm4 ucode buffer info
+ * @gpmu_cmds_size: Length of gpmu cmd stream
+ * @gpmu_cmds: gpmu cmd stream
+ * @ringbuffers: Array of pointers to adreno_ringbuffers
+ * @num_ringbuffers: Number of ringbuffers for the GPU
+ * @cur_rb: Pointer to the current ringbuffer
+ * @next_rb: Ringbuffer we are switching to during preemption
+ * @prev_rb: Ringbuffer we are switching from during preemption
+ * @fast_hang_detect: Software fault detection availability
+ * @ft_policy: Defines the fault tolerance policy
+ * @long_ib_detect: Long IB detection availability
+ * @cooperative_reset: Indicates if graceful death handshake is enabled
+ * between GMU and GPU
+ * @profile: Container for adreno profiler information
+ * @dispatcher: Container for adreno GPU dispatcher
+ * @pwron_fixup: Command buffer to run a post-power collapse shader workaround
+ * @pwron_fixup_dwords: Number of dwords in the command buffer
+ * @input_work: Work struct for turning on the GPU after a touch event
+ * @busy_data: Struct holding GPU VBIF busy stats
+ * @ram_cycles_lo: Number of DDR clock cycles for the monitor session (Only
+ * DDR channel 0 read cycles in case of GBIF)
+ * @ram_cycles_lo_ch1_read: Number of DDR channel 1 Read clock cycles for
+ * the monitor session
+ * @ram_cycles_lo_ch0_write: Number of DDR channel 0 Write clock cycles for
+ * the monitor session
+ * @ram_cycles_lo_ch1_write: Number of DDR channel 0 Write clock cycles for
+ * the monitor session
+ * @starved_ram_lo: Number of cycles VBIF/GBIF is stalled by DDR (Only channel 0
+ * stall cycles in case of GBIF)
+ * @starved_ram_lo_ch1: Number of cycles GBIF is stalled by DDR channel 1
+ * @halt: Atomic variable to check whether the GPU is currently halted
+ * @pending_irq_refcnt: Atomic variable to keep track of running IRQ handlers
+ * @ctx_d_debugfs: Context debugfs node
+ * @profile_buffer: Memdesc holding the drawobj profiling buffer
+ * @profile_index: Index to store the start/stop ticks in the profiling
+ * buffer
+ * @pwrup_reglist: Memdesc holding the power up register list
+ * which is used by CP during preemption and IFPC
+ * @lm_sequence: Pointer to the start of the register write sequence for LM
+ * @lm_size: The dword size of the LM sequence
+ * @lm_limit: limiting value for LM
+ * @lm_threshold_count: register value for counter for lm threshold breakin
+ * @lm_threshold_cross: number of current peaks exceeding threshold
+ * @ifpc_count: Number of times the GPU went into IFPC
+ * @highest_bank_bit: Value of the highest bank bit
+ * @csdev: Pointer to a coresight device (if applicable)
+ * @gpmu_throttle_counters - counteers for number of throttled clocks
+ * @irq_storm_work: Worker to handle possible interrupt storms
+ * @active_list: List to track active contexts
+ * @active_list_lock: Lock to protect active_list
+ * @gpu_llc_slice: GPU system cache slice descriptor
+ * @gpu_llc_slice_enable: To enable the GPU system cache slice or not
+ * @gpuhtw_llc_slice: GPU pagetables system cache slice descriptor
+ * @gpuhtw_llc_slice_enable: To enable the GPUHTW system cache slice or not
+ * @zap_loaded: Used to track if zap was successfully loaded or not
+ */
+struct adreno_device {
+	struct kgsl_device dev;    /* Must be first field in this struct */
+	unsigned long priv;
+	unsigned int chipid;
+	/** @uche_gmem_base: Base address of GMEM for UCHE access */
+	u64 uche_gmem_base;
+	unsigned int cx_misc_len;
+	void __iomem *cx_misc_virt;
+	unsigned long isense_base;
+	unsigned int isense_len;
+	void __iomem *isense_virt;
+	const struct adreno_gpu_core *gpucore;
+	struct adreno_firmware fw[2];
+	size_t gpmu_cmds_size;
+	unsigned int *gpmu_cmds;
+	struct adreno_ringbuffer ringbuffers[KGSL_PRIORITY_MAX_RB_LEVELS];
+	int num_ringbuffers;
+	struct adreno_ringbuffer *cur_rb;
+	struct adreno_ringbuffer *next_rb;
+	struct adreno_ringbuffer *prev_rb;
+	unsigned int fast_hang_detect;
+	unsigned long ft_policy;
+	bool long_ib_detect;
+	bool cooperative_reset;
+	struct adreno_profile profile;
+	struct adreno_dispatcher dispatcher;
+	struct kgsl_memdesc *pwron_fixup;
+	unsigned int pwron_fixup_dwords;
+	struct work_struct input_work;
+	struct adreno_busy_data busy_data;
+	unsigned int ram_cycles_lo;
+	unsigned int ram_cycles_lo_ch1_read;
+	unsigned int ram_cycles_lo_ch0_write;
+	unsigned int ram_cycles_lo_ch1_write;
+	unsigned int starved_ram_lo;
+	unsigned int starved_ram_lo_ch1;
+	atomic_t halt;
+	atomic_t pending_irq_refcnt;
+	struct dentry *ctx_d_debugfs;
+	/** @lm_enabled: True if limits management is enabled for this target */
+	bool lm_enabled;
+	/** @acd_enabled: True if acd is enabled for this target */
+	bool acd_enabled;
+	/** @hwcg_enabled: True if hardware clock gating is enabled */
+	bool hwcg_enabled;
+	/** @throttling_enabled: True if LM throttling is enabled on a5xx */
+	bool throttling_enabled;
+	/** @sptp_pc_enabled: True if SPTP power collapse is enabled on a5xx */
+	bool sptp_pc_enabled;
+	/** @bcl_enabled: True if BCL is enabled */
+	bool bcl_enabled;
+	/** @clx_enabled: True if CLX is enabled */
+	bool clx_enabled;
+	/** @lpac_enabled: True if LPAC is enabled */
+	bool lpac_enabled;
+	/** @dms_enabled: True if DMS is enabled */
+	bool dms_enabled;
+	/** @warmboot_enabled: True if warmboot is enabled */
+	bool warmboot_enabled;
+	/** @preempt_override: True if command line param enables preemption */
+	bool preempt_override;
+	struct kgsl_memdesc *profile_buffer;
+	unsigned int profile_index;
+	struct kgsl_memdesc *pwrup_reglist;
+	uint32_t *lm_sequence;
+	uint32_t lm_size;
+	struct adreno_preemption preempt;
+	struct work_struct gpmu_work;
+	uint32_t lm_leakage;
+	uint32_t lm_limit;
+	uint32_t lm_threshold_count;
+	uint32_t lm_threshold_cross;
+	uint32_t ifpc_count;
+
+	unsigned int highest_bank_bit;
+	unsigned int quirks;
+
+#ifdef CONFIG_QCOM_KGSL_CORESIGHT
+	/** @gx_coresight:  A coresight instance for GX */
+	struct adreno_coresight_device gx_coresight;
+	/** @gx_coresight:  A coresight instance for CX */
+	struct adreno_coresight_device cx_coresight;
+	/** @funnel_gfx:  A coresight instance for gfx funnel */
+	struct adreno_funnel_device funnel_gfx;
+#endif
+
+	uint32_t gpmu_throttle_counters[ADRENO_GPMU_THROTTLE_COUNTERS];
+	struct work_struct irq_storm_work;
+
+	struct list_head active_list;
+	spinlock_t active_list_lock;
+
+	void *gpu_llc_slice;
+	bool gpu_llc_slice_enable;
+	void *gpuhtw_llc_slice;
+	bool gpuhtw_llc_slice_enable;
+	unsigned int zap_loaded;
+	/**
+	 * @critpkts: Memory descriptor for 5xx critical packets if applicable
+	 */
+	struct kgsl_memdesc *critpkts;
+	/**
+	 * @critpkts: Memory descriptor for 5xx secure critical packets
+	 */
+	struct kgsl_memdesc *critpkts_secure;
+	/** @irq_mask: The current interrupt mask for the GPU device */
+	u32 irq_mask;
+	/*
+	 * @soft_ft_regs: an array of registers for soft fault detection on a3xx
+	 * targets
+	 */
+	u32 *soft_ft_regs;
+	/*
+	 * @soft_ft_vals: an array of register values for soft fault detection
+	 * on a3xx targets
+	 */
+	u32 *soft_ft_vals;
+	/*
+	 * @soft_ft_vals: number of elements in @soft_ft_regs and @soft_ft_vals
+	 */
+	int soft_ft_count;
+	/** @wake_on_touch: If true our last wakeup was due to a touch event */
+	bool wake_on_touch;
+	/* @dispatch_ops: A pointer to a set of adreno dispatch ops */
+	const struct adreno_dispatch_ops *dispatch_ops;
+	/** @hwsched: Container for the hardware dispatcher */
+	struct adreno_hwsched hwsched;
+	/*
+	 * @perfcounter: Flag to clear perfcounters across contexts and
+	 * controls perfcounter ioctl read
+	 */
+	bool perfcounter;
+	/** @gmu_hub_clk_freq: Gmu hub interface clock frequency */
+	u64 gmu_hub_clk_freq;
+	/* @patch_reglist: If false power up register list needs to be patched */
+	bool patch_reglist;
+	/*
+	 * @uche_client_pf: uche_client_pf client register configuration
+	 * for pf debugging
+	 */
+	u32 uche_client_pf;
+	/**
+	 * @bcl_data: bit 0 contains response type for bcl alarms and bits 1:24 controls
+	 * throttle level for bcl alarm levels 0-2. If not set, gmu fw sets default throttle levels.
+	 */
+	u32 bcl_data;
+	/*
+	 * @bcl_debugfs_dir: Debugfs directory node for bcl related nodes
+	 */
+	struct dentry *bcl_debugfs_dir;
+	/** @bcl_throttle_time_us: Total time in us spent in BCL throttling */
+	u32 bcl_throttle_time_us;
+	/* @preemption_debugfs_dir: Debugfs directory node for preemption related nodes */
+	struct dentry *preemption_debugfs_dir;
+	/* @hwsched_enabled: If true, hwsched is enabled */
+	bool hwsched_enabled;
+	/* @fastblend_enabled: True if fastblend feature is enabled */
+	bool fastblend_enabled;
+	/* @raytracing_enabled: True if raytracing feature is enabled */
+	bool raytracing_enabled;
+	/* @feature_fuse: feature fuse value read from HW */
+	u32 feature_fuse;
+	/** @gmu_ab: Track if GMU supports ab vote */
+	bool gmu_ab;
+	/** @ifpc_hyst: IFPC long hysteresis value */
+	u32 ifpc_hyst;
+	/** @ifpc_hyst_floor: IFPC long hysteresis floor value */
+	u32 ifpc_hyst_floor;
+	/** @cx_misc_base: CX MISC register block base offset */
+	u32 cx_misc_base;
+};
+
+/**
+ * enum adreno_device_flags - Private flags for the adreno_device
+ * @ADRENO_DEVICE_PWRON - Set during init after a power collapse
+ * @ADRENO_DEVICE_PWRON_FIXUP - Set if the target requires the shader fixup
+ * after power collapse
+ * @ADRENO_DEVICE_STARTED - Set if the device start sequence is in progress
+ * @ADRENO_DEVICE_FAULT - Set if the device is currently in fault (and shouldn't
+ * send any more commands to the ringbuffer)
+ * @ADRENO_DEVICE_DRAWOBJ_PROFILE - Set if the device supports drawobj
+ * profiling via the ALWAYSON counter
+ * @ADRENO_DEVICE_PREEMPTION - Turn on/off preemption
+ * @ADRENO_DEVICE_SOFT_FAULT_DETECT - Set if soft fault detect is enabled
+ * @ADRENO_DEVICE_GPMU_INITIALIZED - Set if GPMU firmware initialization succeed
+ * @ADRENO_DEVICE_ISDB_ENABLED - Set if the Integrated Shader DeBugger is
+ * attached and enabled
+ * @ADRENO_DEVICE_CACHE_FLUSH_TS_SUSPENDED - Set if a CACHE_FLUSH_TS irq storm
+ * is in progress
+ */
+enum adreno_device_flags {
+	ADRENO_DEVICE_PWRON = 0,
+	ADRENO_DEVICE_PWRON_FIXUP = 1,
+	ADRENO_DEVICE_INITIALIZED = 2,
+	ADRENO_DEVICE_STARTED = 5,
+	ADRENO_DEVICE_FAULT = 6,
+	ADRENO_DEVICE_DRAWOBJ_PROFILE = 7,
+	ADRENO_DEVICE_GPU_REGULATOR_ENABLED = 8,
+	ADRENO_DEVICE_PREEMPTION = 9,
+	ADRENO_DEVICE_SOFT_FAULT_DETECT = 10,
+	ADRENO_DEVICE_GPMU_INITIALIZED = 11,
+	ADRENO_DEVICE_ISDB_ENABLED = 12,
+	ADRENO_DEVICE_CACHE_FLUSH_TS_SUSPENDED = 13,
+	/** @ADRENO_DEVICE_DMS: Set if DMS is enabled */
+	ADRENO_DEVICE_DMS = 14,
+	/** @ADRENO_DEVICE_GMU_AB: Set if AB vote via GMU is enabled */
+	ADRENO_DEVICE_GMU_AB = 15,
+	/*
+	 * @ADRENO_DEVICE_FORCE_COLDBOOT: Set if a feature is toggled
+	 * via sysfs/debugfs or when we are doing fault recovery
+	 */
+	ADRENO_DEVICE_FORCE_COLDBOOT = 16,
+	/** @ADRENO_DEVICE_CX_TIMER_INITIALIZED: Set if the CX timer is initialized */
+	ADRENO_DEVICE_CX_TIMER_INITIALIZED = 17,
+};
+
+/**
+ * struct adreno_drawobj_profile_entry - a single drawobj entry in the
+ * kernel profiling buffer
+ * @started: Number of GPU ticks at start of the drawobj
+ * @retired: Number of GPU ticks at the end of the drawobj
+ * @ctx_start: CP_ALWAYS_ON_CONTEXT tick at start of the drawobj
+ * @ctx_end: CP_ALWAYS_ON_CONTEXT tick at end of the drawobj
+ */
+struct adreno_drawobj_profile_entry {
+	uint64_t started;
+	uint64_t retired;
+	uint64_t ctx_start;
+	uint64_t ctx_end;
+};
+
+#define ADRENO_DRAWOBJ_PROFILE_OFFSET(_index, _member) \
+	 ((_index) * sizeof(struct adreno_drawobj_profile_entry) \
+	  + offsetof(struct adreno_drawobj_profile_entry, _member))
+
+
+/**
+ * adreno_regs: List of registers that are used in kgsl driver for all
+ * 3D devices. Each device type has different offset value for the same
+ * register, so an array of register offsets are declared for every device
+ * and are indexed by the enumeration values defined in this enum
+ */
+enum adreno_regs {
+	ADRENO_REG_CP_ME_RAM_DATA,
+	ADRENO_REG_CP_RB_BASE,
+	ADRENO_REG_CP_RB_BASE_HI,
+	ADRENO_REG_CP_RB_RPTR_ADDR_LO,
+	ADRENO_REG_CP_RB_RPTR_ADDR_HI,
+	ADRENO_REG_CP_RB_RPTR,
+	ADRENO_REG_CP_RB_WPTR,
+	ADRENO_REG_CP_ME_CNTL,
+	ADRENO_REG_CP_RB_CNTL,
+	ADRENO_REG_CP_IB1_BASE,
+	ADRENO_REG_CP_IB1_BASE_HI,
+	ADRENO_REG_CP_IB1_BUFSZ,
+	ADRENO_REG_CP_IB2_BASE,
+	ADRENO_REG_CP_IB2_BASE_HI,
+	ADRENO_REG_CP_IB2_BUFSZ,
+	ADRENO_REG_CP_TIMESTAMP,
+	ADRENO_REG_CP_SCRATCH_REG6,
+	ADRENO_REG_CP_SCRATCH_REG7,
+	ADRENO_REG_CP_PROTECT_STATUS,
+	ADRENO_REG_CP_PREEMPT,
+	ADRENO_REG_CP_PREEMPT_DEBUG,
+	ADRENO_REG_CP_PREEMPT_DISABLE,
+	ADRENO_REG_CP_PROTECT_REG_0,
+	ADRENO_REG_CP_CONTEXT_SWITCH_SMMU_INFO_LO,
+	ADRENO_REG_CP_CONTEXT_SWITCH_SMMU_INFO_HI,
+	ADRENO_REG_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_LO,
+	ADRENO_REG_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_HI,
+	ADRENO_REG_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_LO,
+	ADRENO_REG_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_HI,
+	ADRENO_REG_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_LO,
+	ADRENO_REG_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_HI,
+	ADRENO_REG_CP_PREEMPT_LEVEL_STATUS,
+	ADRENO_REG_RBBM_STATUS,
+	ADRENO_REG_RBBM_STATUS3,
+	ADRENO_REG_RBBM_PERFCTR_LOAD_CMD0,
+	ADRENO_REG_RBBM_PERFCTR_LOAD_CMD1,
+	ADRENO_REG_RBBM_PERFCTR_LOAD_CMD2,
+	ADRENO_REG_RBBM_PERFCTR_LOAD_CMD3,
+	ADRENO_REG_RBBM_PERFCTR_PWR_1_LO,
+	ADRENO_REG_RBBM_INT_0_MASK,
+	ADRENO_REG_RBBM_PM_OVERRIDE2,
+	ADRENO_REG_RBBM_SW_RESET_CMD,
+	ADRENO_REG_RBBM_CLOCK_CTL,
+	ADRENO_REG_PA_SC_AA_CONFIG,
+	ADRENO_REG_SQ_GPR_MANAGEMENT,
+	ADRENO_REG_SQ_INST_STORE_MANAGEMENT,
+	ADRENO_REG_TP0_CHICKEN,
+	ADRENO_REG_RBBM_PERFCTR_LOAD_VALUE_LO,
+	ADRENO_REG_RBBM_PERFCTR_LOAD_VALUE_HI,
+	ADRENO_REG_GMU_AO_HOST_INTERRUPT_MASK,
+	ADRENO_REG_GMU_AHB_FENCE_STATUS,
+	ADRENO_REG_GMU_GMU2HOST_INTR_MASK,
+	ADRENO_REG_GPMU_POWER_COUNTER_ENABLE,
+	ADRENO_REG_REGISTER_MAX,
+};
+
+#define ADRENO_REG_UNUSED	0xFFFFFFFF
+#define ADRENO_REG_SKIP	0xFFFFFFFE
+#define ADRENO_REG_DEFINE(_offset, _reg)[_offset] = _reg
+
+struct adreno_irq_funcs {
+	void (*func)(struct adreno_device *adreno_dev, int mask);
+};
+#define ADRENO_IRQ_CALLBACK(_c) { .func = _c }
+
+/*
+ * struct adreno_debugbus_block - Holds info about debug buses of a chip
+ * @block_id: Bus identifier
+ * @dwords: Number of dwords of data that this block holds
+ */
+struct adreno_debugbus_block {
+	unsigned int block_id;
+	unsigned int dwords;
+};
+
+enum adreno_cp_marker_type {
+	IFPC_DISABLE,
+	IFPC_ENABLE,
+	IB1LIST_START,
+	IB1LIST_END,
+};
+
+struct adreno_gpudev {
+	/*
+	 * These registers are in a different location on different devices,
+	 * so define them in the structure and use them as variables.
+	 */
+	unsigned int *const reg_offsets;
+
+	/* GPU specific function hooks */
+	int (*probe)(struct platform_device *pdev, u32 chipid,
+		const struct adreno_gpu_core *gpucore);
+	void (*snapshot)(struct adreno_device *adreno_dev,
+				struct kgsl_snapshot *snapshot);
+	irqreturn_t (*irq_handler)(struct adreno_device *adreno_dev);
+	int (*init)(struct adreno_device *adreno_dev);
+	void (*remove)(struct adreno_device *adreno_dev);
+	int (*rb_start)(struct adreno_device *adreno_dev);
+	int (*start)(struct adreno_device *adreno_dev);
+	int (*regulator_enable)(struct adreno_device *adreno_dev);
+	void (*regulator_disable)(struct adreno_device *adreno_dev);
+	void (*pwrlevel_change_settings)(struct adreno_device *adreno_dev,
+				unsigned int prelevel, unsigned int postlevel,
+				bool post);
+	void (*preemption_schedule)(struct adreno_device *adreno_dev);
+	int (*preemption_context_init)(struct kgsl_context *context);
+	void (*context_detach)(struct adreno_context *drawctxt);
+	void (*pre_reset)(struct adreno_device *adreno_dev);
+	void (*gpu_keepalive)(struct adreno_device *adreno_dev,
+			bool state);
+	bool (*hw_isidle)(struct adreno_device *adreno_dev);
+	const char *(*iommu_fault_block)(struct kgsl_device *device,
+				unsigned int fsynr1);
+	int (*reset)(struct adreno_device *adreno_dev);
+	/** @read_alwayson: Return the current value of the alwayson counter */
+	u64 (*read_alwayson)(struct adreno_device *adreno_dev);
+	/**
+	 * @power_ops: Target specific function pointers to power up/down the
+	 * gpu
+	 */
+	const struct adreno_power_ops *power_ops;
+	int (*clear_pending_transactions)(struct adreno_device *adreno_dev);
+	void (*deassert_gbif_halt)(struct adreno_device *adreno_dev);
+	int (*ringbuffer_submitcmd)(struct adreno_device *adreno_dev,
+			struct kgsl_drawobj_cmd *cmdobj, u32 flags,
+			struct adreno_submit_time *time);
+	/**
+	 * @is_hw_collapsible: Return true if the hardware can be collapsed.
+	 * Only used by non GMU/RGMU targets
+	 */
+	bool (*is_hw_collapsible)(struct adreno_device *adreno_dev);
+	/**
+	 * @power_stats - Return the perfcounter statistics for DCVS
+	 */
+	void (*power_stats)(struct adreno_device *adreno_dev,
+			struct kgsl_power_stats *stats);
+	int (*setproperty)(struct kgsl_device_private *priv, u32 type,
+		void __user *value, u32 sizebytes);
+	int (*add_to_va_minidump)(struct adreno_device *adreno_dev);
+	/**
+	 * @gx_is_on - Return true if both gfx clock and gxgdsc are enabled.
+	 */
+	bool (*gx_is_on)(struct adreno_device *adreno_dev);
+	/**
+	 * @send_recurring_cmdobj - Target specific function to send recurring IBs to GMU
+	 */
+	int (*send_recurring_cmdobj)(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj);
+	/**
+	 * @perfcounter_remove: Remove perfcounter from the power up list
+	 */
+	int (*perfcounter_remove)(struct adreno_device *adreno_dev,
+			struct adreno_perfcount_register *reg, u32 groupid);
+	/**
+	 * @set_isdb_breakpoint_registers - Program isdb registers to issue break command
+	 */
+	void (*set_isdb_breakpoint_registers)(struct adreno_device *adreno_dev);
+	/**
+	 * @context_destroy: Target specific function called during context destruction
+	 */
+	void (*context_destroy)(struct adreno_device *adreno_dev, struct adreno_context *drawctxt);
+	/**
+	 * @swfuse_irqctrl: To enable/disable sw fuse violation interrupt
+	 */
+	void (*swfuse_irqctrl)(struct adreno_device *adreno_dev, bool state);
+	/**
+	 * @lpac_store: To enable/disable lpac at runtime
+	 */
+	int (*lpac_store)(struct adreno_device *adreno_dev, bool enable);
+	/*
+	 * @get_uche_trap_base: Return the UCHE_TRAP_BASE value
+	 */
+	u64 (*get_uche_trap_base)(void);
+};
+
+/**
+ * enum kgsl_ft_policy_bits - KGSL fault tolerance policy bits
+ * @KGSL_FT_OFF: Disable fault detection (not used)
+ * @KGSL_FT_REPLAY: Replay the faulting command
+ * @KGSL_FT_SKIPIB: Skip the faulting indirect buffer
+ * @KGSL_FT_SKIPFRAME: Skip the frame containing the faulting IB
+ * @KGSL_FT_DISABLE: Tells the dispatcher to disable FT for the command obj
+ * @KGSL_FT_TEMP_DISABLE: Disables FT for all commands
+ * @KGSL_FT_THROTTLE: Disable the context if it faults too often
+ * @KGSL_FT_SKIPCMD: Skip the command containing the faulting IB
+ */
+enum kgsl_ft_policy_bits {
+	KGSL_FT_OFF = 0,
+	KGSL_FT_REPLAY,
+	KGSL_FT_SKIPIB,
+	KGSL_FT_SKIPFRAME,
+	KGSL_FT_DISABLE,
+	KGSL_FT_TEMP_DISABLE,
+	KGSL_FT_THROTTLE,
+	KGSL_FT_SKIPCMD,
+	/* KGSL_FT_MAX_BITS is used to calculate the mask */
+	KGSL_FT_MAX_BITS,
+	/* Internal bits - set during GFT */
+	/* Skip the PM dump on replayed command obj's */
+	KGSL_FT_SKIP_PMDUMP = 31,
+};
+
+#define KGSL_FT_POLICY_MASK GENMASK(KGSL_FT_MAX_BITS - 1, 0)
+
+#define FOR_EACH_RINGBUFFER(_dev, _rb, _i)			\
+	for ((_i) = 0, (_rb) = &((_dev)->ringbuffers[0]);	\
+		(_i) < (_dev)->num_ringbuffers;			\
+		(_i)++, (_rb)++)
+
+extern const struct adreno_power_ops adreno_power_operations;
+
+extern const struct adreno_gpudev adreno_a3xx_gpudev;
+extern const struct adreno_gpudev adreno_a5xx_gpudev;
+extern const struct adreno_gpudev adreno_a6xx_gpudev;
+extern const struct adreno_gpudev adreno_a6xx_rgmu_gpudev;
+extern const struct adreno_gpudev adreno_a619_holi_gpudev;
+
+extern int adreno_wake_nice;
+extern unsigned int adreno_wake_timeout;
+
+int adreno_start(struct kgsl_device *device, int priority);
+long adreno_ioctl(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, unsigned long arg);
+
+long adreno_ioctl_helper(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, unsigned long arg,
+		const struct kgsl_ioctl *cmds, int len);
+
+int adreno_spin_idle(struct adreno_device *device, unsigned int timeout);
+int adreno_idle(struct kgsl_device *device);
+
+int adreno_set_constraint(struct kgsl_device *device,
+				struct kgsl_context *context,
+				struct kgsl_device_constraint *constraint);
+
+void adreno_snapshot(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot,
+		struct kgsl_context *context, struct kgsl_context *context_lpac);
+
+int adreno_reset(struct kgsl_device *device, int fault);
+
+void adreno_fault_skipcmd_detached(struct adreno_device *adreno_dev,
+					 struct adreno_context *drawctxt,
+					 struct kgsl_drawobj *drawobj);
+
+void adreno_hang_int_callback(struct adreno_device *adreno_dev, int bit);
+void adreno_cp_callback(struct adreno_device *adreno_dev, int bit);
+
+int adreno_sysfs_init(struct adreno_device *adreno_dev);
+
+void adreno_irqctrl(struct adreno_device *adreno_dev, int state);
+
+long adreno_ioctl_perfcounter_get(struct kgsl_device_private *dev_priv,
+	unsigned int cmd, void *data);
+
+long adreno_ioctl_perfcounter_put(struct kgsl_device_private *dev_priv,
+	unsigned int cmd, void *data);
+
+void adreno_cx_misc_regread(struct adreno_device *adreno_dev,
+		unsigned int offsetwords, unsigned int *value);
+void adreno_cx_misc_regwrite(struct adreno_device *adreno_dev,
+		unsigned int offsetwords, unsigned int value);
+void adreno_cx_misc_regrmw(struct adreno_device *adreno_dev,
+		unsigned int offsetwords,
+		unsigned int mask, unsigned int bits);
+void adreno_isense_regread(struct adreno_device *adreno_dev,
+		unsigned int offsetwords, unsigned int *value);
+bool adreno_gx_is_on(struct adreno_device *adreno_dev);
+
+u64 adreno_read_cx_timer(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_active_count_get - Wrapper for target specific active count get
+ * @adreno_dev: pointer to the adreno device
+ *
+ * Increase the active count for the KGSL device and execute slumber exit
+ * sequence if this is the first reference. Code paths that need to touch the
+ * hardware or wait for the hardware to complete an operation must hold an
+ * active count reference until they are finished. The device mutex must be held
+ * while calling this function.
+ *
+ * Return: 0 on success or negative error on failure to wake up the device
+ */
+int adreno_active_count_get(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_active_count_put - Wrapper for target specific active count put
+ * @adreno_dev: pointer to the adreno device
+ *
+ * Decrease the active or the KGSL device and schedule the idle thread to
+ * execute the slumber sequence if there are no remaining references. The
+ * device mutex must be held while calling this function.
+ */
+void adreno_active_count_put(struct adreno_device *adreno_dev);
+
+#define ADRENO_TARGET(_name, _id) \
+static inline int adreno_is_##_name(struct adreno_device *adreno_dev) \
+{ \
+	return (ADRENO_GPUREV(adreno_dev) == (_id)); \
+}
+
+static inline int adreno_is_a3xx(struct adreno_device *adreno_dev)
+{
+	return ((ADRENO_GPUREV(adreno_dev) >= 300) &&
+		(ADRENO_GPUREV(adreno_dev) < 400));
+}
+
+ADRENO_TARGET(a304, ADRENO_REV_A304)
+ADRENO_TARGET(a306, ADRENO_REV_A306)
+ADRENO_TARGET(a306a, ADRENO_REV_A306A)
+
+static inline int adreno_is_a5xx(struct adreno_device *adreno_dev)
+{
+	return ADRENO_GPUREV(adreno_dev) >= 500 &&
+			ADRENO_GPUREV(adreno_dev) < 600;
+}
+
+ADRENO_TARGET(a505, ADRENO_REV_A505)
+ADRENO_TARGET(a506, ADRENO_REV_A506)
+ADRENO_TARGET(a508, ADRENO_REV_A508)
+ADRENO_TARGET(a510, ADRENO_REV_A510)
+ADRENO_TARGET(a512, ADRENO_REV_A512)
+ADRENO_TARGET(a530, ADRENO_REV_A530)
+ADRENO_TARGET(a540, ADRENO_REV_A540)
+
+static inline int adreno_is_a530v2(struct adreno_device *adreno_dev)
+{
+	return (ADRENO_GPUREV(adreno_dev) == ADRENO_REV_A530) &&
+		(ADRENO_CHIPID_PATCH(adreno_dev->chipid) == 1);
+}
+
+static inline int adreno_is_a530v3(struct adreno_device *adreno_dev)
+{
+	return (ADRENO_GPUREV(adreno_dev) == ADRENO_REV_A530) &&
+		(ADRENO_CHIPID_PATCH(adreno_dev->chipid) == 2);
+}
+
+static inline int adreno_is_a505_or_a506(struct adreno_device *adreno_dev)
+{
+	return ADRENO_GPUREV(adreno_dev) >= 505 &&
+			ADRENO_GPUREV(adreno_dev) <= 506;
+}
+
+static inline int adreno_is_a6xx(struct adreno_device *adreno_dev)
+{
+	return ADRENO_GPUREV(adreno_dev) >= 600 &&
+			ADRENO_GPUREV(adreno_dev) <= 702;
+}
+
+static inline int adreno_is_a660_shima(struct adreno_device *adreno_dev)
+{
+	return (ADRENO_GPUREV(adreno_dev) == ADRENO_REV_A660) &&
+		(adreno_dev->gpucore->compatible &&
+		!strcmp(adreno_dev->gpucore->compatible,
+		"qcom,adreno-gpu-a660-shima"));
+}
+
+static inline int adreno_is_a642l(struct adreno_device *adreno_dev)
+{
+	return (adreno_dev->gpucore->compatible &&
+		!strcmp(adreno_dev->gpucore->compatible,
+		"qcom,adreno-gpu-a642l"));
+}
+
+ADRENO_TARGET(a610, ADRENO_REV_A610)
+ADRENO_TARGET(a612, ADRENO_REV_A612)
+ADRENO_TARGET(a618, ADRENO_REV_A618)
+ADRENO_TARGET(a619, ADRENO_REV_A619)
+ADRENO_TARGET(a621, ADRENO_REV_A621)
+ADRENO_TARGET(a623, ADRENO_REV_A623)
+ADRENO_TARGET(a630, ADRENO_REV_A630)
+ADRENO_TARGET(a662, ADRENO_REV_A662)
+ADRENO_TARGET(a640, ADRENO_REV_A640)
+ADRENO_TARGET(a643, ADRENO_REV_A643)
+ADRENO_TARGET(a650, ADRENO_REV_A650)
+ADRENO_TARGET(a663, ADRENO_REV_A663)
+ADRENO_TARGET(a680, ADRENO_REV_A680)
+ADRENO_TARGET(a702, ADRENO_REV_A702)
+
+/* A642l and A643 are derived from A660 and shares same logic */
+static inline int adreno_is_a660(struct adreno_device *adreno_dev)
+{
+	unsigned int rev = ADRENO_GPUREV(adreno_dev);
+
+	return (rev == ADRENO_REV_A660 || adreno_is_a642l(adreno_dev) ||
+		rev == ADRENO_REV_A643 || rev == ADRENO_REV_A662);
+}
+
+/*
+ * All the derived chipsets from A615 needs to be added to this
+ * list such as A616, A618, A619 etc.
+ */
+static inline int adreno_is_a615_family(struct adreno_device *adreno_dev)
+{
+	unsigned int rev = ADRENO_GPUREV(adreno_dev);
+
+	return (rev == ADRENO_REV_A615 || rev == ADRENO_REV_A616 ||
+			rev == ADRENO_REV_A618 || rev == ADRENO_REV_A619);
+}
+
+/*
+ * Derived GPUs from A640 needs to be added to this list.
+ * A640 and A680 belongs to this family.
+ */
+static inline int adreno_is_a640_family(struct adreno_device *adreno_dev)
+{
+	unsigned int rev = ADRENO_GPUREV(adreno_dev);
+
+	return (rev == ADRENO_REV_A640 || rev == ADRENO_REV_A680);
+}
+
+/*
+ * Derived GPUs from A650 needs to be added to this list.
+ * A650 is derived from A640 but register specs has been
+ * changed hence do not belongs to A640 family. A620, A621,
+ * A642l, A643, A660, A663, A690 follows the register specs of A650.
+ *
+ */
+static inline int adreno_is_a650_family(struct adreno_device *adreno_dev)
+{
+	unsigned int rev = ADRENO_GPUREV(adreno_dev);
+
+	return (rev == ADRENO_REV_A650 || rev == ADRENO_REV_A620 ||
+		rev == ADRENO_REV_A660 || adreno_is_a642l(adreno_dev) ||
+		rev == ADRENO_REV_A662 || rev == ADRENO_REV_A621 ||
+		rev == ADRENO_REV_A663 || rev == ADRENO_REV_A643 ||
+		rev == ADRENO_REV_A623);
+}
+
+static inline int adreno_is_a619_holi(struct adreno_device *adreno_dev)
+{
+	return of_device_is_compatible(adreno_dev->dev.pdev->dev.of_node,
+		"qcom,adreno-gpu-a619-holi");
+}
+
+static inline int adreno_is_a620(struct adreno_device *adreno_dev)
+{
+	unsigned int rev = ADRENO_GPUREV(adreno_dev);
+
+	return (rev == ADRENO_REV_A620 || rev == ADRENO_REV_A621 ||
+	    rev == ADRENO_REV_A623);
+}
+
+static inline int adreno_is_a640v2(struct adreno_device *adreno_dev)
+{
+	return (ADRENO_GPUREV(adreno_dev) == ADRENO_REV_A640) &&
+		(ADRENO_CHIPID_PATCH(adreno_dev->chipid) == 1);
+}
+
+static inline int adreno_is_gen7(struct adreno_device *adreno_dev)
+{
+	return ADRENO_GPUREV(adreno_dev) >= 0x070000 &&
+			ADRENO_GPUREV(adreno_dev) < 0x080000;
+}
+
+ADRENO_TARGET(gen7_0_0, ADRENO_REV_GEN7_0_0)
+ADRENO_TARGET(gen7_0_1, ADRENO_REV_GEN7_0_1)
+ADRENO_TARGET(gen7_2_0, ADRENO_REV_GEN7_2_0)
+ADRENO_TARGET(gen7_2_1, ADRENO_REV_GEN7_2_1)
+ADRENO_TARGET(gen7_4_0, ADRENO_REV_GEN7_4_0)
+ADRENO_TARGET(gen7_9_0, ADRENO_REV_GEN7_9_0)
+ADRENO_TARGET(gen7_9_1, ADRENO_REV_GEN7_9_1)
+
+static inline int adreno_is_gen7_9_x(struct adreno_device *adreno_dev)
+{
+	return adreno_is_gen7_9_0(adreno_dev) || adreno_is_gen7_9_1(adreno_dev);
+}
+
+static inline int adreno_is_gen7_0_x_family(struct adreno_device *adreno_dev)
+{
+	return adreno_is_gen7_0_0(adreno_dev) || adreno_is_gen7_0_1(adreno_dev) ||
+		adreno_is_gen7_4_0(adreno_dev);
+}
+
+static inline int adreno_is_gen7_2_x_family(struct adreno_device *adreno_dev)
+{
+	return adreno_is_gen7_2_0(adreno_dev) || adreno_is_gen7_2_1(adreno_dev) ||
+		adreno_is_gen7_9_x(adreno_dev);
+}
+
+/*
+ * adreno_checkreg_off() - Checks the validity of a register enum
+ * @adreno_dev:		Pointer to adreno device
+ * @offset_name:	The register enum that is checked
+ */
+static inline bool adreno_checkreg_off(struct adreno_device *adreno_dev,
+					enum adreno_regs offset_name)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (offset_name >= ADRENO_REG_REGISTER_MAX ||
+		gpudev->reg_offsets[offset_name] == ADRENO_REG_UNUSED)
+		return false;
+
+	/*
+	 * GPU register programming is kept common as much as possible
+	 * across the cores, Use ADRENO_REG_SKIP when certain register
+	 * programming needs to be skipped for certain GPU cores.
+	 * Example: Certain registers on a5xx like IB1_BASE are 64 bit.
+	 * Common programming programs 64bit register but upper 32 bits
+	 * are skipped in a3xx using ADRENO_REG_SKIP.
+	 */
+	if (gpudev->reg_offsets[offset_name] == ADRENO_REG_SKIP)
+		return false;
+
+	return true;
+}
+
+/*
+ * adreno_readreg() - Read a register by getting its offset from the
+ * offset array defined in gpudev node
+ * @adreno_dev:		Pointer to the the adreno device
+ * @offset_name:	The register enum that is to be read
+ * @val:		Register value read is placed here
+ */
+static inline void adreno_readreg(struct adreno_device *adreno_dev,
+				enum adreno_regs offset_name, unsigned int *val)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (adreno_checkreg_off(adreno_dev, offset_name))
+		kgsl_regread(KGSL_DEVICE(adreno_dev),
+				gpudev->reg_offsets[offset_name], val);
+	else
+		*val = 0;
+}
+
+/*
+ * adreno_writereg() - Write a register by getting its offset from the
+ * offset array defined in gpudev node
+ * @adreno_dev:		Pointer to the the adreno device
+ * @offset_name:	The register enum that is to be written
+ * @val:		Value to write
+ */
+static inline void adreno_writereg(struct adreno_device *adreno_dev,
+				enum adreno_regs offset_name, unsigned int val)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (adreno_checkreg_off(adreno_dev, offset_name))
+		kgsl_regwrite(KGSL_DEVICE(adreno_dev),
+				gpudev->reg_offsets[offset_name], val);
+}
+
+/*
+ * adreno_getreg() - Returns the offset value of a register from the
+ * register offset array in the gpudev node
+ * @adreno_dev:		Pointer to the the adreno device
+ * @offset_name:	The register enum whore offset is returned
+ */
+static inline unsigned int adreno_getreg(struct adreno_device *adreno_dev,
+				enum adreno_regs offset_name)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (!adreno_checkreg_off(adreno_dev, offset_name))
+		return ADRENO_REG_REGISTER_MAX;
+	return gpudev->reg_offsets[offset_name];
+}
+
+/*
+ * adreno_write_gmureg() - Write a GMU register by getting its offset from the
+ * offset array defined in gpudev node
+ * @adreno_dev:		Pointer to the the adreno device
+ * @offset_name:	The register enum that is to be written
+ * @val:		Value to write
+ */
+static inline void adreno_write_gmureg(struct adreno_device *adreno_dev,
+				enum adreno_regs offset_name, unsigned int val)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (adreno_checkreg_off(adreno_dev, offset_name))
+		gmu_core_regwrite(KGSL_DEVICE(adreno_dev),
+				gpudev->reg_offsets[offset_name], val);
+}
+
+/**
+ * adreno_gpu_fault() - Return the current state of the GPU
+ * @adreno_dev: A pointer to the adreno_device to query
+ *
+ * Return 0 if there is no fault or positive with the last type of fault that
+ * occurred
+ */
+static inline unsigned int adreno_gpu_fault(struct adreno_device *adreno_dev)
+{
+	/* make sure we're reading the latest value */
+	smp_rmb();
+	return atomic_read(&adreno_dev->dispatcher.fault);
+}
+
+/**
+ * adreno_set_gpu_fault() - Set the current fault status of the GPU
+ * @adreno_dev: A pointer to the adreno_device to set
+ * @state: fault state to set
+ *
+ */
+static inline void adreno_set_gpu_fault(struct adreno_device *adreno_dev,
+	int state)
+{
+	/* only set the fault bit w/o overwriting other bits */
+	atomic_or(state, &adreno_dev->dispatcher.fault);
+
+	/* make sure other CPUs see the update */
+	smp_wmb();
+}
+
+static inline bool adreno_gmu_gpu_fault(struct adreno_device *adreno_dev)
+{
+	return adreno_gpu_fault(adreno_dev) & ADRENO_GMU_FAULT;
+}
+
+/**
+ * adreno_clear_gpu_fault() - Clear the GPU fault register
+ * @adreno_dev: A pointer to an adreno_device structure
+ *
+ * Clear the GPU fault status for the adreno device
+ */
+
+static inline void adreno_clear_gpu_fault(struct adreno_device *adreno_dev)
+{
+	atomic_set(&adreno_dev->dispatcher.fault, 0);
+
+	/* make sure other CPUs see the update */
+	smp_wmb();
+}
+
+/**
+ * adreno_gpu_halt() - Return the GPU halt refcount
+ * @adreno_dev: A pointer to the adreno_device
+ */
+static inline int adreno_gpu_halt(struct adreno_device *adreno_dev)
+{
+	/* make sure we're reading the latest value */
+	smp_rmb();
+	return atomic_read(&adreno_dev->halt);
+}
+
+
+/**
+ * adreno_clear_gpu_halt() - Clear the GPU halt refcount
+ * @adreno_dev: A pointer to the adreno_device
+ */
+static inline void adreno_clear_gpu_halt(struct adreno_device *adreno_dev)
+{
+	atomic_set(&adreno_dev->halt, 0);
+
+	/* make sure other CPUs see the update */
+	smp_wmb();
+}
+
+/**
+ * adreno_get_gpu_halt() - Increment GPU halt refcount
+ * @adreno_dev: A pointer to the adreno_device
+ */
+static inline void adreno_get_gpu_halt(struct adreno_device *adreno_dev)
+{
+	atomic_inc(&adreno_dev->halt);
+}
+
+/**
+ * adreno_put_gpu_halt() - Decrement GPU halt refcount
+ * @adreno_dev: A pointer to the adreno_device
+ */
+static inline void adreno_put_gpu_halt(struct adreno_device *adreno_dev)
+{
+	/* Make sure the refcount is good */
+	int ret = atomic_dec_if_positive(&adreno_dev->halt);
+
+	WARN(ret < 0, "GPU halt refcount unbalanced\n");
+}
+
+
+#ifdef CONFIG_DEBUG_FS
+void adreno_debugfs_init(struct adreno_device *adreno_dev);
+void adreno_context_debugfs_init(struct adreno_device *adreno_dev,
+				struct adreno_context *ctx);
+#else
+static inline void adreno_debugfs_init(struct adreno_device *adreno_dev) { }
+static inline void adreno_context_debugfs_init(struct adreno_device *device,
+						struct adreno_context *context)
+{
+	context->debug_root = NULL;
+}
+#endif
+
+/**
+ * adreno_compare_pm4_version() - Compare the PM4 microcode version
+ * @adreno_dev: Pointer to the adreno_device struct
+ * @version: Version number to compare again
+ *
+ * Compare the current version against the specified version and return -1 if
+ * the current code is older, 0 if equal or 1 if newer.
+ */
+static inline int adreno_compare_pm4_version(struct adreno_device *adreno_dev,
+	unsigned int version)
+{
+	if (adreno_dev->fw[ADRENO_FW_PM4].version == version)
+		return 0;
+
+	return (adreno_dev->fw[ADRENO_FW_PM4].version > version) ? 1 : -1;
+}
+
+/**
+ * adreno_compare_pfp_version() - Compare the PFP microcode version
+ * @adreno_dev: Pointer to the adreno_device struct
+ * @version: Version number to compare against
+ *
+ * Compare the current version against the specified version and return -1 if
+ * the current code is older, 0 if equal or 1 if newer.
+ */
+static inline int adreno_compare_pfp_version(struct adreno_device *adreno_dev,
+	unsigned int version)
+{
+	if (adreno_dev->fw[ADRENO_FW_PFP].version == version)
+		return 0;
+
+	return (adreno_dev->fw[ADRENO_FW_PFP].version > version) ? 1 : -1;
+}
+
+/**
+ * adreno_in_preempt_state() - Check if preemption state is equal to given state
+ * @adreno_dev: Device whose preemption state is checked
+ * @state: State to compare against
+ */
+static inline bool adreno_in_preempt_state(struct adreno_device *adreno_dev,
+			enum adreno_preempt_states state)
+{
+	return atomic_read(&adreno_dev->preempt.state) == state;
+}
+/**
+ * adreno_set_preempt_state() - Set the specified preemption state
+ * @adreno_dev: Device to change preemption state
+ * @state: State to set
+ */
+static inline void adreno_set_preempt_state(struct adreno_device *adreno_dev,
+		enum adreno_preempt_states state)
+{
+	/*
+	 * atomic_set doesn't use barriers, so we need to do it ourselves.  One
+	 * before...
+	 */
+	smp_wmb();
+	atomic_set(&adreno_dev->preempt.state, state);
+
+	/* ... and one after */
+	smp_wmb();
+}
+
+static inline bool adreno_is_preemption_enabled(
+				struct adreno_device *adreno_dev)
+{
+	return test_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv);
+}
+
+
+/**
+ * adreno_preemption_feature_set() - Check whether adreno preemption feature is statically enabled
+ * either via adreno feature bit, or via the cmdline override
+ * @adreno_dev: Device whose preemption state is checked
+ */
+static inline bool adreno_preemption_feature_set(struct adreno_device *adreno_dev)
+{
+	return ADRENO_FEATURE(adreno_dev, ADRENO_PREEMPTION) || adreno_dev->preempt_override;
+}
+
+/*
+ * adreno_compare_prio_level() - Compares 2 priority levels based on enum values
+ * @p1: First priority level
+ * @p2: Second priority level
+ *
+ * Returns greater than 0 if p1 is higher priority, 0 if levels are equal else
+ * less than 0
+ */
+static inline int adreno_compare_prio_level(int p1, int p2)
+{
+	return p2 - p1;
+}
+
+void adreno_readreg64(struct adreno_device *adreno_dev,
+		enum adreno_regs lo, enum adreno_regs hi, uint64_t *val);
+
+void adreno_writereg64(struct adreno_device *adreno_dev,
+		enum adreno_regs lo, enum adreno_regs hi, uint64_t val);
+
+unsigned int adreno_get_rptr(struct adreno_ringbuffer *rb);
+
+void adreno_touch_wake(struct kgsl_device *device);
+
+static inline bool adreno_rb_empty(struct adreno_ringbuffer *rb)
+{
+	return (adreno_get_rptr(rb) == rb->wptr);
+}
+
+static inline bool adreno_soft_fault_detect(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->fast_hang_detect &&
+		!test_bit(ADRENO_DEVICE_ISDB_ENABLED, &adreno_dev->priv);
+}
+
+static inline bool adreno_long_ib_detect(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->long_ib_detect &&
+		!test_bit(ADRENO_DEVICE_ISDB_ENABLED, &adreno_dev->priv);
+}
+
+/**
+ * adreno_support_64bit - Return true if the GPU supports 64 bit addressing
+ * @adreno_dev: An Adreno GPU device handle
+ *
+ * Return: True if the device supports 64 bit addressing
+ */
+static inline bool adreno_support_64bit(struct adreno_device *adreno_dev)
+{
+	/*
+	 * The IOMMU API takes a unsigned long for the iova so we can't support
+	 * 64 bit addresses when the kernel is in 32 bit mode even if we wanted
+	 * so we need to check that we are using a5xx or newer and that the
+	 * unsigned long is big enough for our purposes.
+	 */
+	return (BITS_PER_LONG > 32 && ADRENO_GPUREV(adreno_dev) >= 500);
+}
+
+static inline void adreno_ringbuffer_set_pagetable(struct kgsl_device *device,
+	struct adreno_ringbuffer *rb, struct kgsl_pagetable *pt)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&rb->preempt_lock, flags);
+
+	kgsl_sharedmem_writel(device->scratch,
+		SCRATCH_RB_OFFSET(rb->id, current_rb_ptname), pt->name);
+
+	kgsl_sharedmem_writeq(device->scratch,
+		SCRATCH_RB_OFFSET(rb->id, ttbr0),
+		kgsl_mmu_pagetable_get_ttbr0(pt));
+
+	kgsl_sharedmem_writel(device->scratch,
+		SCRATCH_RB_OFFSET(rb->id, contextidr), 0);
+
+	spin_unlock_irqrestore(&rb->preempt_lock, flags);
+}
+
+static inline u32 counter_delta(struct kgsl_device *device,
+			unsigned int reg, unsigned int *counter)
+{
+	u32 val, ret = 0;
+
+	if (!reg)
+		return 0;
+
+	kgsl_regread(device, reg, &val);
+
+	if (*counter) {
+		if (val >= *counter)
+			ret = val - *counter;
+		else
+			ret = (UINT_MAX - *counter) + val;
+	}
+
+	*counter = val;
+	return ret;
+}
+
+static inline int adreno_perfcntr_active_oob_get(
+	struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = adreno_active_count_get(adreno_dev);
+
+	if (!ret) {
+		ret = gmu_core_dev_oob_set(device, oob_perfcntr);
+		if (ret)
+			adreno_active_count_put(adreno_dev);
+	}
+
+	return ret;
+}
+
+static inline void adreno_perfcntr_active_oob_put(
+	struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	gmu_core_dev_oob_clear(device, oob_perfcntr);
+	adreno_active_count_put(adreno_dev);
+}
+
+/**
+ * adreno_wait_for_halt_ack - wait for acknowlegement for a bus halt request
+ * @ack_reg: register offset to wait for acknowledge
+ * @mask: A mask value to wait for
+ *
+ * Return: 0 on success or -ETIMEDOUT if the request timed out
+ */
+static inline int adreno_wait_for_halt_ack(struct kgsl_device *device,
+	int ack_reg, unsigned int mask)
+{
+	u32 val;
+	int ret = kgsl_regmap_read_poll_timeout(&device->regmap, ack_reg,
+		val, (val & mask) == mask, 100, 100 * 1000);
+
+	if (ret)
+		dev_err(device->dev,
+			"GBIF/VBIF Halt ack timeout: reg=%08x mask=%08x status=%08x\n",
+			ack_reg, mask, val);
+
+	return ret;
+}
+
+/**
+ * adreno_move_preempt_state - Update the preemption state
+ * @adreno_dev: An Adreno GPU device handle
+ * @old: The current state of the preemption
+ * @new: The new state of the preemption
+ *
+ * Return: True if the state was updated or false if not
+ */
+static inline bool adreno_move_preempt_state(struct adreno_device *adreno_dev,
+	enum adreno_preempt_states old, enum adreno_preempt_states new)
+{
+	return (atomic_cmpxchg(&adreno_dev->preempt.state, old, new) == old);
+}
+
+/**
+ * adreno_reg_offset_init - Helper function to initialize reg_offsets
+ * @reg_offsets: Pointer to an array of register offsets
+ *
+ * Helper function to setup register_offsets for a target. Go through
+ * and set ADRENO_REG_UNUSED for all unused entries in the list.
+ */
+static inline void adreno_reg_offset_init(u32 *reg_offsets)
+{
+	int i;
+
+	/*
+	 * Initialize uninitialzed gpu registers, only needs to be done once.
+	 * Make all offsets that are not initialized to ADRENO_REG_UNUSED
+	 */
+	for (i = 0; i < ADRENO_REG_REGISTER_MAX; i++) {
+		if (!reg_offsets[i])
+			reg_offsets[i] = ADRENO_REG_UNUSED;
+	}
+}
+
+static inline u32 adreno_get_level(struct kgsl_context *context)
+{
+	u32 level;
+
+	if (kgsl_context_is_lpac(context))
+		return KGSL_LPAC_RB_ID;
+
+	level = context->priority / KGSL_PRIORITY_MAX_RB_LEVELS;
+
+	return min_t(u32, level, KGSL_PRIORITY_MAX_RB_LEVELS - 1);
+}
+
+
+/**
+ * adreno_get_firwmare - Load firmware into a adreno_firmware struct
+ * @adreno_dev: An Adreno GPU device handle
+ * @fwfile: Firmware file to load
+ * @firmware: A &struct adreno_firmware container for the firmware.
+ *
+ * Load the specified firmware file into the memdesc in &struct adreno_firmware
+ * and get the size and version from the data.
+ *
+ * Return: 0 on success or negative on failure
+ */
+int adreno_get_firmware(struct adreno_device *adreno_dev,
+		const char *fwfile, struct adreno_firmware *firmware);
+/**
+ * adreno_zap_shader_load - Helper function for loading the zap shader
+ * adreno_dev: A handle to an Adreno GPU device
+ * name: Name of the zap shader to load
+ *
+ * A target indepedent helper function for loading the zap shader.
+ *
+ * Return: 0 on success or negative on failure.
+ */
+int adreno_zap_shader_load(struct adreno_device *adreno_dev,
+		const char *name);
+
+/**
+ * adreno_irq_callbacks - Helper function to handle IRQ callbacks
+ * @adreno_dev: Adreno GPU device handle
+ * @funcs: List of callback functions
+ * @status: Interrupt status
+ *
+ * Walk the bits in the interrupt status and call any applicable callbacks.
+ * Return: IRQ_HANDLED if one or more interrupt callbacks were called.
+ */
+irqreturn_t adreno_irq_callbacks(struct adreno_device *adreno_dev,
+		const struct adreno_irq_funcs *funcs, u32 status);
+
+
+/**
+ * adreno_device_probe - Generic adreno device probe function
+ * @pdev: Pointer to the platform device
+ * @adreno_dev: Adreno GPU device handle
+ *
+ * Do the generic setup for the Adreno device. Called from the target specific
+ * probe functions.
+ *
+ * Return: 0 on success or negative on failure
+ */
+int adreno_device_probe(struct platform_device *pdev,
+		struct adreno_device *adreno_dev);
+
+/**
+ * adreno_power_cycle - Suspend and resume the device
+ * @adreno_dev: Pointer to the adreno device
+ * @callback: Function that needs to be executed
+ * @priv: Argument to be passed to the callback
+ *
+ * Certain properties that can be set via sysfs need to power
+ * cycle the device to take effect. This function suspends
+ * the device, executes the callback, and resumes the device.
+ *
+ * Return: 0 on success or negative on failure
+ */
+int adreno_power_cycle(struct adreno_device *adreno_dev,
+	void (*callback)(struct adreno_device *adreno_dev, void *priv),
+	void *priv);
+
+/**
+ * adreno_power_cycle_bool - Power cycle the device to change device setting
+ * @adreno_dev: Pointer to the adreno device
+ * @flag: Flag that needs to be set
+ * @val: The value flag should be set to
+ *
+ * Certain properties that can be set via sysfs need to power cycle the device
+ * to take effect. This function suspends the device, sets the flag, and
+ * resumes the device.
+ *
+ * Return: 0 on success or negative on failure
+ */
+int adreno_power_cycle_bool(struct adreno_device *adreno_dev,
+	bool *flag, bool val);
+
+/**
+ * adreno_power_cycle_u32 - Power cycle the device to change device setting
+ * @adreno_dev: Pointer to the adreno device
+ * @flag: Flag that needs to be set
+ * @val: The value flag should be set to
+ *
+ * Certain properties that can be set via sysfs need to power cycle the device
+ * to take effect. This function suspends the device, sets the flag, and
+ * resumes the device.
+ *
+ * Return: 0 on success or negative on failure
+ */
+int adreno_power_cycle_u32(struct adreno_device *adreno_dev,
+	u32 *flag, u32 val);
+
+/**
+ * adreno_set_active_ctxs_null - Give up active context refcount
+ * @adreno_dev: Adreno GPU device handle
+ *
+ * This puts back the reference for that last active context on
+ * each ringbuffer when going in and out of slumber.
+ */
+void adreno_set_active_ctxs_null(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_get_bus_counters - Allocate the bus dcvs counters
+ * @adreno_dev: Adreno GPU device handle
+ *
+ * This function allocates the various gpu counters to measure
+ * gpu bus usage for bus dcvs
+ */
+void adreno_get_bus_counters(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_suspend_context - Make sure device is idle
+ * @device: Pointer to the kgsl device
+ *
+ * This function processes the profiling results and checks if the
+ * device is idle so that it can be turned off safely
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int adreno_suspend_context(struct kgsl_device *device);
+
+/*
+ * adreno_profile_submit_time - Populate profiling buffer with timestamps
+ * @time: Container for the statistics
+ *
+ * Populate the draw object user profiling buffer with the timestamps
+ * recored in the adreno_submit_time structure at the time of draw object
+ * submission.
+ */
+void adreno_profile_submit_time(struct adreno_submit_time *time);
+
+void adreno_preemption_timer(struct timer_list *t);
+
+/**
+ * adreno_create_profile_buffer - Create a buffer to store profiling data
+ * @adreno_dev: Adreno GPU device handle
+ */
+void adreno_create_profile_buffer(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_isidle - return true if the hardware is idle
+ * @adreno_dev: Adreno GPU device handle
+ *
+ * Return: True if the hardware is idle
+ */
+bool adreno_isidle(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_allocate_global - Helper function to allocate a global GPU object
+ * @device: A GPU device handle
+ * @memdesc: Pointer to a &struct kgsl_memdesc pointer
+ * @size: Size of the allocation in bytes
+ * @padding: Amount of extra adding to add to the VA allocation
+ * @flags: Control flags for the allocation
+ * @priv: Internal flags for the allocation
+ * @name: Name of the allocation (for the debugfs file)
+ *
+ * Allocate a global object if it hasn't already been alllocated and put it in
+ * the pointer pointed to by @memdesc.
+ * Return: 0 on success or negative on error
+ */
+static inline int adreno_allocate_global(struct kgsl_device *device,
+		struct kgsl_memdesc **memdesc, u64 size, u32 padding, u64 flags,
+		u32 priv, const char *name)
+{
+	if (!IS_ERR_OR_NULL(*memdesc))
+		return 0;
+
+	*memdesc = kgsl_allocate_global(device, size, padding, flags, priv, name);
+	return PTR_ERR_OR_ZERO(*memdesc);
+}
+
+static inline void adreno_set_dispatch_ops(struct adreno_device *adreno_dev,
+		const struct adreno_dispatch_ops *ops)
+{
+	adreno_dev->dispatch_ops = ops;
+}
+
+#ifdef CONFIG_QCOM_KGSL_FENCE_TRACE
+/**
+ * adreno_fence_trace_array_init - Initialize an always on trace array
+ * @device: A GPU device handle
+ *
+ * Register an always-on trace array to for fence timeout debugging
+ */
+void adreno_fence_trace_array_init(struct kgsl_device *device);
+#else
+static inline void adreno_fence_trace_array_init(struct kgsl_device *device) {}
+#endif
+
+/*
+ * adreno_drawobj_set_constraint - Set a power constraint
+ * @device: Pointer to a KGSL device structure
+ * @drawobj: Draw object for which constraint is to be set
+ *
+ * Set the power constraint if requested by this context
+ */
+void adreno_drawobj_set_constraint(struct kgsl_device *device,
+		struct kgsl_drawobj *drawobj);
+
+/**
+ * adreno_get_gpu_model - Gets gpu model name from device tree (or) chipid
+ * @device: A GPU device handle
+ *
+ * Return: GPU model name string
+ */
+const char *adreno_get_gpu_model(struct kgsl_device *device);
+
+int adreno_verify_cmdobj(struct kgsl_device_private *dev_priv,
+		struct kgsl_context *context, struct kgsl_drawobj *drawobj[],
+		uint32_t count);
+
+/**
+ * adreno_mark_for_coldboot - Set a flag to coldboot gpu in the slumber exit
+ * @adreno_dev: Adreno device handle
+ *
+ */
+void adreno_mark_for_coldboot(struct adreno_device *adreno_dev);
+#endif /*__ADRENO_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a3xx.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a3xx.c
@@ -0,0 +1,1498 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk/qcom.h>
+#include <linux/firmware.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/slab.h>
+
+#include "adreno.h"
+#include "adreno_cp_parser.h"
+#include "adreno_a3xx.h"
+#include "adreno_pm4types.h"
+#include "adreno_snapshot.h"
+#include "adreno_trace.h"
+
+/*
+ * Define registers for a3xx that contain addresses used by the
+ * cp parser logic
+ */
+const unsigned int a3xx_cp_addr_regs[ADRENO_CP_ADDR_MAX] = {
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_0,
+				A3XX_VSC_PIPE_DATA_ADDRESS_0),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_0,
+				A3XX_VSC_PIPE_DATA_LENGTH_0),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_1,
+				A3XX_VSC_PIPE_DATA_ADDRESS_1),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_1,
+				A3XX_VSC_PIPE_DATA_LENGTH_1),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_2,
+				A3XX_VSC_PIPE_DATA_ADDRESS_2),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_2,
+				A3XX_VSC_PIPE_DATA_LENGTH_2),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_3,
+				A3XX_VSC_PIPE_DATA_ADDRESS_3),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_3,
+				A3XX_VSC_PIPE_DATA_LENGTH_3),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_4,
+				A3XX_VSC_PIPE_DATA_ADDRESS_4),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_4,
+				A3XX_VSC_PIPE_DATA_LENGTH_4),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_5,
+				A3XX_VSC_PIPE_DATA_ADDRESS_5),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_5,
+				A3XX_VSC_PIPE_DATA_LENGTH_5),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_6,
+				A3XX_VSC_PIPE_DATA_ADDRESS_6),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_6,
+				A3XX_VSC_PIPE_DATA_LENGTH_6),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_7,
+				A3XX_VSC_PIPE_DATA_ADDRESS_7),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_7,
+				A3XX_VSC_PIPE_DATA_LENGTH_7),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_0,
+				A3XX_VFD_FETCH_INSTR_1_0),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_1,
+				A3XX_VFD_FETCH_INSTR_1_1),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_2,
+				A3XX_VFD_FETCH_INSTR_1_2),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_3,
+				A3XX_VFD_FETCH_INSTR_1_3),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_4,
+				A3XX_VFD_FETCH_INSTR_1_4),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_5,
+				A3XX_VFD_FETCH_INSTR_1_5),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_6,
+				A3XX_VFD_FETCH_INSTR_1_6),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_7,
+				A3XX_VFD_FETCH_INSTR_1_7),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_8,
+				A3XX_VFD_FETCH_INSTR_1_8),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_9,
+				A3XX_VFD_FETCH_INSTR_1_9),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_10,
+				A3XX_VFD_FETCH_INSTR_1_A),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_11,
+				A3XX_VFD_FETCH_INSTR_1_B),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_12,
+				A3XX_VFD_FETCH_INSTR_1_C),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_13,
+				A3XX_VFD_FETCH_INSTR_1_D),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_14,
+				A3XX_VFD_FETCH_INSTR_1_E),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_15,
+				A3XX_VFD_FETCH_INSTR_1_F),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_VSC_SIZE_ADDRESS,
+				A3XX_VSC_SIZE_ADDRESS),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_SP_VS_PVT_MEM_ADDR,
+				A3XX_SP_VS_PVT_MEM_ADDR_REG),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_SP_FS_PVT_MEM_ADDR,
+				A3XX_SP_FS_PVT_MEM_ADDR_REG),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_SP_VS_OBJ_START_REG,
+				A3XX_SP_VS_OBJ_START_REG),
+	ADRENO_REG_DEFINE(ADRENO_CP_ADDR_SP_FS_OBJ_START_REG,
+				A3XX_SP_FS_OBJ_START_REG),
+};
+
+static const unsigned int _a3xx_pwron_fixup_fs_instructions[] = {
+	0x00000000, 0x302CC300, 0x00000000, 0x302CC304,
+	0x00000000, 0x302CC308, 0x00000000, 0x302CC30C,
+	0x00000000, 0x302CC310, 0x00000000, 0x302CC314,
+	0x00000000, 0x302CC318, 0x00000000, 0x302CC31C,
+	0x00000000, 0x302CC320, 0x00000000, 0x302CC324,
+	0x00000000, 0x302CC328, 0x00000000, 0x302CC32C,
+	0x00000000, 0x302CC330, 0x00000000, 0x302CC334,
+	0x00000000, 0x302CC338, 0x00000000, 0x302CC33C,
+	0x00000000, 0x00000400, 0x00020000, 0x63808003,
+	0x00060004, 0x63828007, 0x000A0008, 0x6384800B,
+	0x000E000C, 0x6386800F, 0x00120010, 0x63888013,
+	0x00160014, 0x638A8017, 0x001A0018, 0x638C801B,
+	0x001E001C, 0x638E801F, 0x00220020, 0x63908023,
+	0x00260024, 0x63928027, 0x002A0028, 0x6394802B,
+	0x002E002C, 0x6396802F, 0x00320030, 0x63988033,
+	0x00360034, 0x639A8037, 0x003A0038, 0x639C803B,
+	0x003E003C, 0x639E803F, 0x00000000, 0x00000400,
+	0x00000003, 0x80D60003, 0x00000007, 0x80D60007,
+	0x0000000B, 0x80D6000B, 0x0000000F, 0x80D6000F,
+	0x00000013, 0x80D60013, 0x00000017, 0x80D60017,
+	0x0000001B, 0x80D6001B, 0x0000001F, 0x80D6001F,
+	0x00000023, 0x80D60023, 0x00000027, 0x80D60027,
+	0x0000002B, 0x80D6002B, 0x0000002F, 0x80D6002F,
+	0x00000033, 0x80D60033, 0x00000037, 0x80D60037,
+	0x0000003B, 0x80D6003B, 0x0000003F, 0x80D6003F,
+	0x00000000, 0x03000000, 0x00000000, 0x00000000,
+};
+
+/**
+ * _a3xx_pwron_fixup() - Initialize a special command buffer to run a
+ * post-power collapse shader workaround
+ * @adreno_dev: Pointer to a adreno_device struct
+ *
+ * Some targets require a special workaround shader to be executed after
+ * power-collapse.  Construct the IB once at init time and keep it
+ * handy
+ *
+ * Returns: 0 on success or negative on error
+ */
+static int _a3xx_pwron_fixup(struct adreno_device *adreno_dev)
+{
+	unsigned int *cmds;
+	int count = ARRAY_SIZE(_a3xx_pwron_fixup_fs_instructions);
+
+	/* Return if the fixup is already in place */
+	if (test_bit(ADRENO_DEVICE_PWRON_FIXUP, &adreno_dev->priv))
+		return 0;
+
+	adreno_dev->pwron_fixup = kgsl_allocate_global(KGSL_DEVICE(adreno_dev),
+		PAGE_SIZE, 0, KGSL_MEMFLAGS_GPUREADONLY, 0, "pwron_fixup");
+
+	if (IS_ERR(adreno_dev->pwron_fixup))
+		return PTR_ERR(adreno_dev->pwron_fixup);
+
+	cmds = adreno_dev->pwron_fixup->hostptr;
+
+	*cmds++ = cp_type0_packet(A3XX_UCHE_CACHE_INVALIDATE0_REG, 2);
+	*cmds++ = 0x00000000;
+	*cmds++ = 0x90000000;
+	*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_REG_RMW, 3);
+	*cmds++ = A3XX_RBBM_CLOCK_CTL;
+	*cmds++ = 0xFFFCFFFF;
+	*cmds++ = 0x00010000;
+	*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CONTROL_0_REG, 1);
+	*cmds++ = 0x1E000150;
+	*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_SET_CONSTANT, 2);
+	*cmds++ = CP_REG(A3XX_HLSQ_CONTROL_0_REG);
+	*cmds++ = 0x1E000150;
+	*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CONTROL_0_REG, 1);
+	*cmds++ = 0x1E000150;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CONTROL_1_REG, 1);
+	*cmds++ = 0x00000040;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CONTROL_2_REG, 1);
+	*cmds++ = 0x80000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CONTROL_3_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_VS_CONTROL_REG, 1);
+	*cmds++ = 0x00000001;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_FS_CONTROL_REG, 1);
+	*cmds++ = 0x0D001002;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CONST_VSPRESV_RANGE_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CONST_FSPRESV_RANGE_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_NDRANGE_0_REG, 1);
+	*cmds++ = 0x00401101;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_NDRANGE_1_REG, 1);
+	*cmds++ = 0x00000400;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_NDRANGE_2_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_NDRANGE_3_REG, 1);
+	*cmds++ = 0x00000001;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_NDRANGE_4_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_NDRANGE_5_REG, 1);
+	*cmds++ = 0x00000001;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_NDRANGE_6_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_CONTROL_0_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_CONTROL_1_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_KERNEL_CONST_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_KERNEL_GROUP_X_REG, 1);
+	*cmds++ = 0x00000010;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_KERNEL_GROUP_Y_REG, 1);
+	*cmds++ = 0x00000001;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_KERNEL_GROUP_Z_REG, 1);
+	*cmds++ = 0x00000001;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_WG_OFFSET_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_SP_CTRL_REG, 1);
+	*cmds++ = 0x00040000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_CTRL_REG0, 1);
+	*cmds++ = 0x0000000A;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_CTRL_REG1, 1);
+	*cmds++ = 0x00000001;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_PARAM_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OUT_REG_0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OUT_REG_1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OUT_REG_2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OUT_REG_3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OUT_REG_4, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OUT_REG_5, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OUT_REG_6, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OUT_REG_7, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_VPC_DST_REG_0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_VPC_DST_REG_1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_VPC_DST_REG_2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_VPC_DST_REG_3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OBJ_OFFSET_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_OBJ_START_REG, 1);
+	*cmds++ = 0x00000004;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_PVT_MEM_PARAM_REG, 1);
+	*cmds++ = 0x04008001;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_PVT_MEM_ADDR_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_PVT_MEM_SIZE_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_VS_LENGTH_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_CTRL_REG0, 1);
+	*cmds++ = 0x0DB0400A;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_CTRL_REG1, 1);
+	*cmds++ = 0x00300402;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_OBJ_OFFSET_REG, 1);
+	*cmds++ = 0x00010000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_OBJ_START_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_PVT_MEM_PARAM_REG, 1);
+	*cmds++ = 0x04008001;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_PVT_MEM_ADDR_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_PVT_MEM_SIZE_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_FLAT_SHAD_MODE_REG_0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_FLAT_SHAD_MODE_REG_1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_OUTPUT_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_MRT_REG_0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_MRT_REG_1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_MRT_REG_2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_MRT_REG_3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_IMAGE_OUTPUT_REG_0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_IMAGE_OUTPUT_REG_1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_IMAGE_OUTPUT_REG_2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_IMAGE_OUTPUT_REG_3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_SP_FS_LENGTH_REG, 1);
+	*cmds++ = 0x0000000D;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_CLIP_CNTL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_GB_CLIP_ADJ, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_VPORT_XOFFSET, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_VPORT_XSCALE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_VPORT_YOFFSET, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_VPORT_YSCALE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_VPORT_ZOFFSET, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_VPORT_ZSCALE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_X0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Y0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Z0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_W0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_X1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Y1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Z1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_W1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_X2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Y2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Z2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_W2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_X3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Y3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Z3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_W3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_X4, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Y4, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Z4, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_W4, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_X5, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Y5, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_Z5, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_CL_USER_PLANE_W5, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SU_POINT_MINMAX, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SU_POINT_SIZE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SU_POLY_OFFSET_OFFSET, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SU_POLY_OFFSET_SCALE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SU_MODE_CONTROL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SC_CONTROL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SC_SCREEN_SCISSOR_TL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SC_SCREEN_SCISSOR_BR, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SC_WINDOW_SCISSOR_BR, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_SC_WINDOW_SCISSOR_TL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_TSE_DEBUG_ECO, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_PERFCOUNTER0_SELECT, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_PERFCOUNTER1_SELECT, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_PERFCOUNTER2_SELECT, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_GRAS_PERFCOUNTER3_SELECT, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MODE_CONTROL, 1);
+	*cmds++ = 0x00008000;
+	*cmds++ = cp_type0_packet(A3XX_RB_RENDER_CONTROL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MSAA_CONTROL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_ALPHA_REFERENCE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_CONTROL0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_CONTROL1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_CONTROL2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_CONTROL3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BUF_INFO0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BUF_INFO1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BUF_INFO2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BUF_INFO3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BUF_BASE0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BUF_BASE1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BUF_BASE2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BUF_BASE3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BLEND_CONTROL0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BLEND_CONTROL1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BLEND_CONTROL2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_MRT_BLEND_CONTROL3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_BLEND_RED, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_BLEND_GREEN, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_BLEND_BLUE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_BLEND_ALPHA, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_CLEAR_COLOR_DW0, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_CLEAR_COLOR_DW1, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_CLEAR_COLOR_DW2, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_CLEAR_COLOR_DW3, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_COPY_CONTROL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_COPY_DEST_BASE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_COPY_DEST_PITCH, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_COPY_DEST_INFO, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_DEPTH_CONTROL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_DEPTH_CLEAR, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_DEPTH_BUF_INFO, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_DEPTH_BUF_PITCH, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_STENCIL_CONTROL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_STENCIL_CLEAR, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_STENCIL_BUF_INFO, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_STENCIL_BUF_PITCH, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_STENCIL_REF_MASK, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_STENCIL_REF_MASK_BF, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_LRZ_VSC_CONTROL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_WINDOW_OFFSET, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_SAMPLE_COUNT_CONTROL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_SAMPLE_COUNT_ADDR, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_Z_CLAMP_MIN, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_Z_CLAMP_MAX, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_GMEM_BASE_ADDR, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_DEBUG_ECO_CONTROLS_ADDR, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_PERFCOUNTER0_SELECT, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_PERFCOUNTER1_SELECT, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_RB_FRAME_BUFFER_DIMENSION, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_LOAD_STATE, 4);
+	*cmds++ = (1 << CP_LOADSTATE_DSTOFFSET_SHIFT) |
+		(0 << CP_LOADSTATE_STATESRC_SHIFT) |
+		(6 << CP_LOADSTATE_STATEBLOCKID_SHIFT) |
+		(1 << CP_LOADSTATE_NUMOFUNITS_SHIFT);
+	*cmds++ = (1 << CP_LOADSTATE_STATETYPE_SHIFT) |
+		(0 << CP_LOADSTATE_EXTSRCADDR_SHIFT);
+	*cmds++ = 0x00400000;
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_LOAD_STATE, 4);
+	*cmds++ = (2 << CP_LOADSTATE_DSTOFFSET_SHIFT) |
+		(6 << CP_LOADSTATE_STATEBLOCKID_SHIFT) |
+		(1 << CP_LOADSTATE_NUMOFUNITS_SHIFT);
+	*cmds++ = (1 << CP_LOADSTATE_STATETYPE_SHIFT);
+	*cmds++ = 0x00400220;
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_LOAD_STATE, 4);
+	*cmds++ = (6 << CP_LOADSTATE_STATEBLOCKID_SHIFT) |
+		(1 << CP_LOADSTATE_NUMOFUNITS_SHIFT);
+	*cmds++ = (1 << CP_LOADSTATE_STATETYPE_SHIFT);
+	*cmds++ = 0x00000000;
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_LOAD_STATE, 2 + count);
+	*cmds++ = (6 << CP_LOADSTATE_STATEBLOCKID_SHIFT) |
+		(13 << CP_LOADSTATE_NUMOFUNITS_SHIFT);
+	*cmds++ = 0x00000000;
+
+	memcpy(cmds, _a3xx_pwron_fixup_fs_instructions, count << 2);
+
+	cmds += count;
+
+	*cmds++ = cp_type3_packet(CP_EXEC_CL, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CL_CONTROL_0_REG, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type0_packet(A3XX_HLSQ_CONTROL_0_REG, 1);
+	*cmds++ = 0x1E000150;
+	*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_SET_CONSTANT, 2);
+	*cmds++ = CP_REG(A3XX_HLSQ_CONTROL_0_REG);
+	*cmds++ = 0x1E000050;
+	*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_REG_RMW, 3);
+	*cmds++ = A3XX_RBBM_CLOCK_CTL;
+	*cmds++ = 0xFFFCFFFF;
+	*cmds++ = 0x00000000;
+	*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	*cmds++ = 0x00000000;
+
+	/*
+	 * Remember the number of dwords in the command buffer for when we
+	 * program the indirect buffer call in the ringbuffer
+	 */
+	adreno_dev->pwron_fixup_dwords =
+		(cmds - (unsigned int *) adreno_dev->pwron_fixup->hostptr);
+
+	/* Mark the flag in ->priv to show that we have the fix */
+	set_bit(ADRENO_DEVICE_PWRON_FIXUP, &adreno_dev->priv);
+	return 0;
+}
+
+static int a3xx_probe(struct platform_device *pdev,
+		u32 chipid, const struct adreno_gpu_core *gpucore)
+{
+	struct adreno_device *adreno_dev;
+	struct kgsl_device *device;
+	int ret;
+
+	adreno_dev = (struct adreno_device *)
+		of_device_get_match_data(&pdev->dev);
+
+	memset(adreno_dev, 0, sizeof(*adreno_dev));
+
+	adreno_dev->gpucore = gpucore;
+	adreno_dev->chipid = chipid;
+
+	adreno_reg_offset_init(gpucore->gpudev->reg_offsets);
+
+
+	device = KGSL_DEVICE(adreno_dev);
+
+	timer_setup(&device->idle_timer, kgsl_timer, 0);
+
+	INIT_WORK(&device->idle_check_ws, kgsl_idle_check);
+
+	ret = adreno_device_probe(pdev, adreno_dev);
+	if (ret)
+		return ret;
+
+	a3xx_coresight_init(adreno_dev);
+
+	return adreno_dispatcher_init(adreno_dev);
+}
+
+static int a3xx_send_me_init(struct adreno_device *adreno_dev,
+			 struct adreno_ringbuffer *rb)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int *cmds;
+	int ret;
+
+	cmds = adreno_ringbuffer_allocspace(rb, 18);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	*cmds++ = cp_type3_packet(CP_ME_INIT, 17);
+
+	*cmds++ = 0x000003f7;
+	*cmds++ = 0x00000000;
+	*cmds++ = 0x00000000;
+	*cmds++ = 0x00000000;
+	*cmds++ = 0x00000080;
+	*cmds++ = 0x00000100;
+	*cmds++ = 0x00000180;
+	*cmds++ = 0x00006600;
+	*cmds++ = 0x00000150;
+	*cmds++ = 0x0000014e;
+	*cmds++ = 0x00000154;
+	*cmds++ = 0x00000001;
+	*cmds++ = 0x00000000;
+	*cmds++ = 0x00000000;
+
+	/* Enable protected mode registers for A3XX */
+	*cmds++ = 0x20000000;
+
+	*cmds++ = 0x00000000;
+	*cmds++ = 0x00000000;
+
+	/* Submit the command to the ringbuffer */
+	kgsl_pwrscale_busy(device);
+	kgsl_regwrite(device, A3XX_CP_RB_WPTR, rb->_wptr);
+	rb->wptr = rb->_wptr;
+
+	ret = adreno_spin_idle(adreno_dev, 2000);
+	if (ret) {
+		struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+		dev_err(device->dev, "CP initialization failed to idle\n");
+		kgsl_device_snapshot(device, NULL, NULL, false);
+	}
+
+	return ret;
+}
+
+static void a3xx_microcode_load(struct adreno_device *adreno_dev);
+
+static int a3xx_rb_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb = ADRENO_CURRENT_RINGBUFFER(adreno_dev);
+
+	memset(rb->buffer_desc->hostptr, 0xaa, KGSL_RB_SIZE);
+	rb->wptr = 0;
+	rb->_wptr = 0;
+	rb->wptr_preempt_end = ~0;
+
+	/*
+	 * The size of the ringbuffer in the hardware is the log2
+	 * representation of the size in quadwords (sizedwords / 2).
+	 * Also disable the host RPTR shadow register as it might be unreliable
+	 * in certain circumstances.
+	 */
+
+	kgsl_regwrite(device, A3XX_CP_RB_CNTL,
+		(ilog2(KGSL_RB_DWORDS >> 1) & 0x3F) |
+		(1 << 27));
+
+	kgsl_regwrite(device, A3XX_CP_RB_BASE, rb->buffer_desc->gpuaddr);
+
+	a3xx_microcode_load(adreno_dev);
+
+	/* clear ME_HALT to start micro engine */
+	kgsl_regwrite(device, A3XX_CP_ME_CNTL, 0);
+
+	return a3xx_send_me_init(adreno_dev, rb);
+}
+
+/*
+ * a3xx soft fault detection
+ *
+ * a3xx targets do not have hardware fault detection so we need to do it the old
+ * fashioned way by periodically reading a set of registers and counters and
+ * checking that they are advancing. There are 6 registers and four 64 bit
+ * counters that we keep an eye on.
+ */
+
+#define A3XX_SOFT_FAULT_DETECT_REGS 6
+#define A3XX_SOFT_FAULT_DETECT_COUNTERS 4
+#define A3XX_SOFT_FAULT_DETECT_COUNT \
+	(A3XX_SOFT_FAULT_DETECT_REGS + (A3XX_SOFT_FAULT_DETECT_COUNTERS * 2))
+
+static bool a3xx_soft_fault_detect_isidle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 reg;
+
+	if (kgsl_state_is_awake(device)) {
+		if (!adreno_rb_empty(adreno_dev->cur_rb))
+			return false;
+
+		/* only check rbbm status to determine if GPU is idle */
+		kgsl_regread(device, A3XX_RBBM_STATUS, &reg);
+
+		if (reg & 0x7ffffffe)
+			return false;
+	}
+
+	memset(adreno_dev->soft_ft_vals, 0, A3XX_SOFT_FAULT_DETECT_COUNT << 2);
+	return true;
+}
+
+/* Read the fault detect registers and compare them to the stored version */
+static int a3xx_soft_fault_detect_read_compare(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb = ADRENO_CURRENT_RINGBUFFER(adreno_dev);
+	int i, ret = 0;
+	unsigned int ts;
+
+	if (!test_bit(ADRENO_DEVICE_SOFT_FAULT_DETECT, &adreno_dev->priv))
+		return 1;
+
+	/* Check to see if the device is idle - if so report no hang */
+	if (a3xx_soft_fault_detect_isidle(adreno_dev))
+		ret = 1;
+
+	for (i = 0; i < A3XX_SOFT_FAULT_DETECT_COUNT; i++) {
+		unsigned int val;
+
+		if (!adreno_dev->soft_ft_regs[i])
+			continue;
+
+		kgsl_regread(device, adreno_dev->soft_ft_regs[i], &val);
+		if (val != adreno_dev->soft_ft_vals[i])
+			ret = 1;
+		adreno_dev->soft_ft_vals[i] = val;
+	}
+
+	if (!adreno_rb_readtimestamp(adreno_dev, adreno_dev->cur_rb,
+				KGSL_TIMESTAMP_RETIRED, &ts)) {
+		if (ts != rb->fault_detect_ts)
+			ret = 1;
+
+		rb->fault_detect_ts = ts;
+	}
+
+	return ret;
+}
+
+/*
+ * This is called on a regular basis while cmdobjs are inflight. Fault
+ * detection registers are read and compared to the existing values - if they
+ * changed then the GPU is still running. If they are the same between
+ * subsequent calls then the GPU may have faulted
+ */
+static void a3xx_soft_fault_timer(struct timer_list *t)
+{
+	struct adreno_dispatcher *dispatcher = from_timer(dispatcher,
+							t, fault_timer);
+	struct adreno_device *adreno_dev = container_of(dispatcher,
+					struct adreno_device, dispatcher);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Leave if the user decided to turn off fast hang detection */
+	if (!adreno_soft_fault_detect(adreno_dev))
+		return;
+
+	if (adreno_gpu_fault(adreno_dev)) {
+		adreno_dispatcher_schedule(device);
+		return;
+	}
+
+	/*
+	 * Read the fault registers - if it returns 0 then they haven't changed
+	 * so mark the dispatcher as faulted and schedule the work loop.
+	 */
+
+	if (!a3xx_soft_fault_detect_read_compare(adreno_dev))
+		adreno_dispatcher_fault(adreno_dev, ADRENO_SOFT_FAULT);
+	else if (dispatcher->inflight > 0)
+		adreno_dispatcher_start_fault_timer(adreno_dev);
+}
+
+/*
+ * Start fault detection. The counters are only assigned while fault detection
+ * is running so that they can be used for other purposes if fault detection is
+ * disabled
+ */
+static void a3xx_soft_fault_detect_start(struct adreno_device *adreno_dev)
+{
+	u32 *regs = &adreno_dev->soft_ft_regs[A3XX_SOFT_FAULT_DETECT_COUNTERS];
+	int ret = 0;
+
+	if (!test_bit(ADRENO_DEVICE_SOFT_FAULT_DETECT, &adreno_dev->priv))
+		return;
+
+	if (adreno_dev->fast_hang_detect == 1)
+		return;
+
+	ret |= adreno_perfcounter_kernel_get(adreno_dev,
+		KGSL_PERFCOUNTER_GROUP_SP, SP_ALU_ACTIVE_CYCLES,
+		&regs[0], &regs[1]);
+
+	ret |= adreno_perfcounter_kernel_get(adreno_dev,
+		KGSL_PERFCOUNTER_GROUP_SP, SP0_ICL1_MISSES,
+		&regs[2], &regs[3]);
+
+	ret |= adreno_perfcounter_kernel_get(adreno_dev,
+		KGSL_PERFCOUNTER_GROUP_SP, SP_FS_CFLOW_INSTRUCTIONS,
+		&regs[4], &regs[5]);
+
+	ret |= adreno_perfcounter_kernel_get(adreno_dev,
+		KGSL_PERFCOUNTER_GROUP_TSE, TSE_INPUT_PRIM_NUM,
+		&regs[6], &regs[7]);
+
+	WARN(ret, "Unable to allocate one or more fault detect counters\n");
+	adreno_dev->fast_hang_detect = 1;
+}
+
+/* Helper function to put back a counter */
+static void put_counter(struct adreno_device *adreno_dev,
+		int group, int countable, u32 *lo, u32 *hi)
+{
+	adreno_perfcounter_put(adreno_dev, group, countable,
+		PERFCOUNTER_FLAG_KERNEL);
+
+	*lo = 0;
+	*hi = 0;
+}
+
+/* Stop fault detection and return the counters */
+static void a3xx_soft_fault_detect_stop(struct adreno_device *adreno_dev)
+{
+	u32 *regs = &adreno_dev->soft_ft_regs[A3XX_SOFT_FAULT_DETECT_COUNTERS];
+
+	if (!test_bit(ADRENO_DEVICE_SOFT_FAULT_DETECT, &adreno_dev->priv))
+		return;
+
+	if (!adreno_dev->fast_hang_detect)
+		return;
+
+	put_counter(adreno_dev, KGSL_PERFCOUNTER_GROUP_SP, SP_ALU_ACTIVE_CYCLES,
+			&regs[0], &regs[1]);
+
+	put_counter(adreno_dev, KGSL_PERFCOUNTER_GROUP_SP, SP0_ICL1_MISSES,
+			&regs[2], &regs[3]);
+
+	put_counter(adreno_dev, KGSL_PERFCOUNTER_GROUP_SP,
+			SP_FS_CFLOW_INSTRUCTIONS, &regs[4], &regs[5]);
+
+	put_counter(adreno_dev, KGSL_PERFCOUNTER_GROUP_TSE, TSE_INPUT_PRIM_NUM,
+			&regs[6], &regs[7]);
+
+	adreno_dev->fast_hang_detect = 0;
+}
+
+/* Initialize the registers and set up the data structures */
+static void a3xx_soft_fault_detect_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_SOFT_FAULT_DETECT))
+		return;
+
+	/* Disable the fast hang detect bit until we know its a go */
+	adreno_dev->fast_hang_detect = 0;
+
+	adreno_dev->soft_ft_regs = devm_kcalloc(&device->pdev->dev,
+		A3XX_SOFT_FAULT_DETECT_COUNT, sizeof(u32), GFP_KERNEL);
+
+	adreno_dev->soft_ft_vals = devm_kcalloc(&device->pdev->dev,
+		A3XX_SOFT_FAULT_DETECT_COUNT, sizeof(u32), GFP_KERNEL);
+
+	if (!adreno_dev->soft_ft_regs || !adreno_dev->soft_ft_vals)
+		return;
+
+	adreno_dev->soft_ft_count = A3XX_SOFT_FAULT_DETECT_COUNT;
+
+	adreno_dev->soft_ft_regs[0] = A3XX_RBBM_STATUS;
+	adreno_dev->soft_ft_regs[1] = A3XX_CP_RB_RPTR;
+	adreno_dev->soft_ft_regs[2] = A3XX_CP_IB1_BASE;
+	adreno_dev->soft_ft_regs[3] = A3XX_CP_IB1_BUFSZ;
+	adreno_dev->soft_ft_regs[4] = A3XX_CP_IB2_BASE;
+	adreno_dev->soft_ft_regs[5] = A3XX_CP_IB2_BUFSZ;
+
+	set_bit(ADRENO_DEVICE_SOFT_FAULT_DETECT, &adreno_dev->priv);
+
+	a3xx_soft_fault_detect_start(adreno_dev);
+}
+
+static void a3xx_remove(struct adreno_device *adreno_dev)
+{
+	a3xx_soft_fault_detect_stop(adreno_dev);
+}
+
+static int a3xx_microcode_read(struct adreno_device *adreno_dev);
+
+/*
+ * a3xx_init() - Initialize gpu specific data
+ * @adreno_dev: Pointer to adreno device
+ */
+static int a3xx_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	int ret;
+
+	/*
+	 * Set up the a3xx only soft fault timer before heading into the generic
+	 * dispatcher setup
+	 */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_SOFT_FAULT_DETECT))
+		timer_setup(&dispatcher->fault_timer, a3xx_soft_fault_timer, 0);
+
+	ret = a3xx_ringbuffer_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a3xx_microcode_read(adreno_dev);
+	if (ret)
+		return ret;
+
+	_a3xx_pwron_fixup(adreno_dev);
+
+	ret = adreno_allocate_global(device, &iommu->setstate, PAGE_SIZE,
+			0, KGSL_MEMFLAGS_GPUREADONLY, 0, "setstate");
+
+	if (!ret)
+		kgsl_sharedmem_writel(iommu->setstate,
+			KGSL_IOMMU_SETSTATE_NOP_OFFSET,
+			cp_type3_packet(CP_NOP, 1));
+
+	kgsl_mmu_set_feature(device, KGSL_MMU_NEED_GUARD_PAGE);
+
+	/* Put the hardware in a responsive state to set up fault detection*/
+	ret = kgsl_pwrctrl_change_state(device, KGSL_STATE_AWARE);
+	if (ret)
+		return ret;
+
+	a3xx_soft_fault_detect_init(adreno_dev);
+
+	kgsl_pwrctrl_change_state(device, KGSL_STATE_SLUMBER);
+	return 0;
+}
+
+/*
+ * a3xx_err_callback() - Call back for a3xx error interrupts
+ * @adreno_dev: Pointer to device
+ * @bit: Interrupt bit
+ */
+static void a3xx_err_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int reg;
+
+	switch (bit) {
+	case A3XX_INT_RBBM_AHB_ERROR: {
+		kgsl_regread(device, A3XX_RBBM_AHB_ERROR_STATUS, &reg);
+
+		/*
+		 * Return the word address of the erroring register so that it
+		 * matches the register specification
+		 */
+		dev_crit_ratelimited(device->dev,
+					"RBBM | AHB bus error | %s | addr=%x | ports=%x:%x\n",
+					reg & (1 << 28) ? "WRITE" : "READ",
+					(reg & 0xFFFFF) >> 2,
+					(reg >> 20) & 0x3,
+					(reg >> 24) & 0xF);
+
+		/* Clear the error */
+		kgsl_regwrite(device, A3XX_RBBM_AHB_CMD, (1 << 3));
+		break;
+	}
+	case A3XX_INT_RBBM_ATB_BUS_OVERFLOW:
+		dev_crit_ratelimited(device->dev,
+					"RBBM: ATB bus oveflow\n");
+		break;
+	case A3XX_INT_CP_T0_PACKET_IN_IB:
+		dev_crit_ratelimited(device->dev,
+					"ringbuffer TO packet in IB interrupt\n");
+		break;
+	case A3XX_INT_CP_OPCODE_ERROR:
+		dev_crit_ratelimited(device->dev,
+					"ringbuffer opcode error interrupt\n");
+		break;
+	case A3XX_INT_CP_RESERVED_BIT_ERROR:
+		dev_crit_ratelimited(device->dev,
+					"ringbuffer reserved bit error interrupt\n");
+		break;
+	case A3XX_INT_CP_HW_FAULT:
+		kgsl_regread(device, A3XX_CP_HW_FAULT, &reg);
+		dev_crit_ratelimited(device->dev,
+					"CP | Ringbuffer HW fault | status=%x\n",
+					reg);
+		break;
+	case A3XX_INT_CP_REG_PROTECT_FAULT:
+		kgsl_regread(device, A3XX_CP_PROTECT_STATUS, &reg);
+		dev_crit_ratelimited(device->dev,
+					"CP | Protected mode error| %s | addr=%x\n",
+					reg & (1 << 24) ? "WRITE" : "READ",
+					(reg & 0xFFFFF) >> 2);
+		break;
+	case A3XX_INT_CP_AHB_ERROR_HALT:
+		dev_crit_ratelimited(device->dev,
+					"ringbuffer AHB error interrupt\n");
+		break;
+	case A3XX_INT_UCHE_OOB_ACCESS:
+		dev_crit_ratelimited(device->dev,
+					"UCHE: Out of bounds access\n");
+		break;
+	default:
+		dev_crit_ratelimited(device->dev, "Unknown interrupt\n");
+	}
+}
+
+#define A3XX_INT_MASK \
+	((1 << A3XX_INT_RBBM_AHB_ERROR) |        \
+	 (1 << A3XX_INT_RBBM_ATB_BUS_OVERFLOW) | \
+	 (1 << A3XX_INT_CP_T0_PACKET_IN_IB) |    \
+	 (1 << A3XX_INT_CP_OPCODE_ERROR) |       \
+	 (1 << A3XX_INT_CP_RESERVED_BIT_ERROR) | \
+	 (1 << A3XX_INT_CP_HW_FAULT) |           \
+	 (1 << A3XX_INT_CP_IB1_INT) |            \
+	 (1 << A3XX_INT_CP_IB2_INT) |            \
+	 (1 << A3XX_INT_CP_RB_INT) |             \
+	 (1 << A3XX_INT_CACHE_FLUSH_TS) |	 \
+	 (1 << A3XX_INT_CP_REG_PROTECT_FAULT) |  \
+	 (1 << A3XX_INT_CP_AHB_ERROR_HALT) |     \
+	 (1 << A3XX_INT_UCHE_OOB_ACCESS))
+
+static const struct adreno_irq_funcs a3xx_irq_funcs[32] = {
+	ADRENO_IRQ_CALLBACK(NULL),                    /* 0 - RBBM_GPU_IDLE */
+	ADRENO_IRQ_CALLBACK(a3xx_err_callback),  /* 1 - RBBM_AHB_ERROR */
+	ADRENO_IRQ_CALLBACK(NULL),  /* 2 - RBBM_REG_TIMEOUT */
+	ADRENO_IRQ_CALLBACK(NULL),  /* 3 - RBBM_ME_MS_TIMEOUT */
+	ADRENO_IRQ_CALLBACK(NULL),  /* 4 - RBBM_PFP_MS_TIMEOUT */
+	ADRENO_IRQ_CALLBACK(a3xx_err_callback),  /* 5 - RBBM_ATB_BUS_OVERFLOW */
+	ADRENO_IRQ_CALLBACK(NULL),  /* 6 - RBBM_VFD_ERROR */
+	ADRENO_IRQ_CALLBACK(NULL),	/* 7 - CP_SW */
+	ADRENO_IRQ_CALLBACK(a3xx_err_callback),  /* 8 - CP_T0_PACKET_IN_IB */
+	ADRENO_IRQ_CALLBACK(a3xx_err_callback),  /* 9 - CP_OPCODE_ERROR */
+	/* 10 - CP_RESERVED_BIT_ERROR */
+	ADRENO_IRQ_CALLBACK(a3xx_err_callback),
+	ADRENO_IRQ_CALLBACK(a3xx_err_callback),  /* 11 - CP_HW_FAULT */
+	ADRENO_IRQ_CALLBACK(NULL),	             /* 12 - CP_DMA */
+	ADRENO_IRQ_CALLBACK(adreno_cp_callback),   /* 13 - CP_IB2_INT */
+	ADRENO_IRQ_CALLBACK(adreno_cp_callback),   /* 14 - CP_IB1_INT */
+	ADRENO_IRQ_CALLBACK(adreno_cp_callback),   /* 15 - CP_RB_INT */
+	/* 16 - CP_REG_PROTECT_FAULT */
+	ADRENO_IRQ_CALLBACK(a3xx_err_callback),
+	ADRENO_IRQ_CALLBACK(NULL),	       /* 17 - CP_RB_DONE_TS */
+	ADRENO_IRQ_CALLBACK(NULL),	       /* 18 - CP_VS_DONE_TS */
+	ADRENO_IRQ_CALLBACK(NULL),	       /* 19 - CP_PS_DONE_TS */
+	ADRENO_IRQ_CALLBACK(adreno_cp_callback), /* 20 - CP_CACHE_FLUSH_TS */
+	/* 21 - CP_AHB_ERROR_FAULT */
+	ADRENO_IRQ_CALLBACK(a3xx_err_callback),
+	ADRENO_IRQ_CALLBACK(NULL),	       /* 22 - Unused */
+	ADRENO_IRQ_CALLBACK(NULL),	       /* 23 - Unused */
+	/* 24 - MISC_HANG_DETECT */
+	ADRENO_IRQ_CALLBACK(adreno_hang_int_callback),
+	ADRENO_IRQ_CALLBACK(a3xx_err_callback),  /* 25 - UCHE_OOB_ACCESS */
+};
+
+static struct {
+	u32 reg;
+	u32 base;
+	u32 count;
+} a3xx_protected_blocks[] = {
+	/* RBBM */
+	{ A3XX_CP_PROTECT_REG_0,      0x0018, 0 },
+	{ A3XX_CP_PROTECT_REG_0 + 1,  0x0020, 2 },
+	{ A3XX_CP_PROTECT_REG_0 + 2,  0x0033, 0 },
+	{ A3XX_CP_PROTECT_REG_0 + 3,  0x0042, 0 },
+	{ A3XX_CP_PROTECT_REG_0 + 4,  0x0050, 4 },
+	{ A3XX_CP_PROTECT_REG_0 + 5,  0x0063, 0 },
+	{ A3XX_CP_PROTECT_REG_0 + 6,  0x0100, 4 },
+	/* CP */
+	{ A3XX_CP_PROTECT_REG_0 + 7,  0x01c0, 5 },
+	{ A3XX_CP_PROTECT_REG_0 + 8,  0x01ec, 1 },
+	{ A3XX_CP_PROTECT_REG_0 + 9,  0x01f6, 1 },
+	{ A3XX_CP_PROTECT_REG_0 + 10, 0x01f8, 2 },
+	{ A3XX_CP_PROTECT_REG_0 + 11, 0x045e, 2 },
+	{ A3XX_CP_PROTECT_REG_0 + 12, 0x0460, 4 },
+	/* RB */
+	{ A3XX_CP_PROTECT_REG_0 + 13, 0x0cc0, 0 },
+	/* VBIF */
+	{ A3XX_CP_PROTECT_REG_0 + 14, 0x3000, 6 },
+	/*
+	 * SMMU
+	 * For A3xx, base offset for smmu region is 0xa000 and length is
+	 * 0x1000 bytes. Offset must be in dword and length of the block
+	 * must be ilog2(dword length).
+	 * 0xa000 >> 2 = 0x2800, ilog2(0x1000 >> 2) = 10.
+	 */
+	{ A3XX_CP_PROTECT_REG_0 + 15, 0x2800, 10 },
+	/* There are no remaining protected mode registers for a3xx */
+};
+
+static void a3xx_protect_init(struct kgsl_device *device)
+{
+	int i;
+
+	kgsl_regwrite(device, A3XX_CP_PROTECT_CTRL, 0x00000007);
+
+	for (i = 0; i < ARRAY_SIZE(a3xx_protected_blocks); i++) {
+		u32 val = 0x60000000 |
+			(a3xx_protected_blocks[i].count << 24) |
+			(a3xx_protected_blocks[i].base << 2);
+
+		kgsl_regwrite(device, a3xx_protected_blocks[i].reg, val);
+	}
+}
+
+static int a3xx_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a3xx_core *a3xx_core = to_a3xx_core(adreno_dev);
+	int ret;
+
+	ret = kgsl_mmu_start(device);
+	if (ret)
+		return ret;
+
+	adreno_get_bus_counters(adreno_dev);
+	adreno_perfcounter_restore(adreno_dev);
+
+	if (adreno_dev->soft_ft_regs)
+		memset(adreno_dev->soft_ft_regs, 0,
+			adreno_dev->soft_ft_count << 2);
+
+	adreno_dev->irq_mask = A3XX_INT_MASK;
+
+	/* Set up VBIF registers from the GPU core definition */
+	kgsl_regmap_multi_write(&device->regmap, a3xx_core->vbif,
+		a3xx_core->vbif_count);
+
+	/* Make all blocks contribute to the GPU BUSY perf counter */
+	kgsl_regwrite(device, A3XX_RBBM_GPU_BUSY_MASKED, 0xFFFFFFFF);
+
+	/* Tune the hystersis counters for SP and CP idle detection */
+	kgsl_regwrite(device, A3XX_RBBM_SP_HYST_CNT, 0x10);
+	kgsl_regwrite(device, A3XX_RBBM_WAIT_IDLE_CLOCKS_CTL, 0x10);
+
+	/*
+	 * Enable the RBBM error reporting bits.  This lets us get
+	 * useful information on failure
+	 */
+
+	kgsl_regwrite(device, A3XX_RBBM_AHB_CTL0, 0x00000001);
+
+	/* Enable AHB error reporting */
+	kgsl_regwrite(device, A3XX_RBBM_AHB_CTL1, 0xA6FFFFFF);
+
+	/* Turn on the power counters */
+	kgsl_regwrite(device, A3XX_RBBM_RBBM_CTL, 0x00030000);
+
+	/*
+	 * Turn on hang detection - this spews a lot of useful information
+	 * into the RBBM registers on a hang
+	 */
+	kgsl_regwrite(device, A3XX_RBBM_INTERFACE_HANG_INT_CTL,
+		(1 << 16) | 0xFFF);
+
+	/* Enable 64-byte cacheline size. HW Default is 32-byte (0x000000E0). */
+	kgsl_regwrite(device, A3XX_UCHE_CACHE_MODE_CONTROL_REG, 0x00000001);
+
+	/* Enable VFD to access most of the UCHE (7 ways out of 8) */
+	kgsl_regwrite(device, A3XX_UCHE_CACHE_WAYS_VFD, 0x07);
+
+	/* Enable Clock gating */
+	kgsl_regwrite(device, A3XX_RBBM_CLOCK_CTL, A3XX_RBBM_CLOCK_CTL_DEFAULT);
+
+	/* Turn on protection */
+	a3xx_protect_init(device);
+
+	/* Turn on performance counters */
+	kgsl_regwrite(device, A3XX_RBBM_PERFCTR_CTL, 0x01);
+
+	kgsl_regwrite(device, A3XX_CP_DEBUG, A3XX_CP_DEBUG_DEFAULT);
+
+	/* CP ROQ queue sizes (bytes) - RB:16, ST:16, IB1:32, IB2:64 */
+	kgsl_regwrite(device, A3XX_CP_QUEUE_THRESHOLDS, 0x000E0602);
+	return 0;
+}
+
+/* Register offset defines for A3XX */
+static unsigned int a3xx_register_offsets[ADRENO_REG_REGISTER_MAX] = {
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_BASE, A3XX_CP_RB_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_BASE_HI, ADRENO_REG_SKIP),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_RPTR, A3XX_CP_RB_RPTR),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_WPTR, A3XX_CP_RB_WPTR),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_ME_CNTL, A3XX_CP_ME_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_CNTL, A3XX_CP_RB_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BASE, A3XX_CP_IB1_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BASE_HI, ADRENO_REG_SKIP),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BUFSZ, A3XX_CP_IB1_BUFSZ),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BASE, A3XX_CP_IB2_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BASE_HI, ADRENO_REG_SKIP),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BUFSZ, A3XX_CP_IB2_BUFSZ),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_TIMESTAMP, A3XX_CP_SCRATCH_REG0),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_SCRATCH_REG6, A3XX_CP_SCRATCH_REG6),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_SCRATCH_REG7, A3XX_CP_SCRATCH_REG7),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_PROTECT_REG_0, A3XX_CP_PROTECT_REG_0),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_STATUS, A3XX_RBBM_STATUS),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_PERFCTR_PWR_1_LO,
+					A3XX_RBBM_PERFCTR_PWR_1_LO),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_INT_0_MASK, A3XX_RBBM_INT_0_MASK),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_CLOCK_CTL, A3XX_RBBM_CLOCK_CTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_PA_SC_AA_CONFIG, A3XX_PA_SC_AA_CONFIG),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_PM_OVERRIDE2, A3XX_RBBM_PM_OVERRIDE2),
+	ADRENO_REG_DEFINE(ADRENO_REG_SQ_GPR_MANAGEMENT, A3XX_SQ_GPR_MANAGEMENT),
+	ADRENO_REG_DEFINE(ADRENO_REG_SQ_INST_STORE_MANAGEMENT,
+				A3XX_SQ_INST_STORE_MANAGEMENT),
+	ADRENO_REG_DEFINE(ADRENO_REG_TP0_CHICKEN, A3XX_TP0_CHICKEN),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_SW_RESET_CMD, A3XX_RBBM_SW_RESET_CMD),
+};
+
+static int _load_firmware(struct kgsl_device *device, const char *fwfile,
+			  void **buf, int *len)
+{
+	const struct firmware *fw = NULL;
+	int ret;
+
+	ret = request_firmware(&fw, fwfile, &device->pdev->dev);
+
+	if (ret) {
+		dev_err(&device->pdev->dev, "request_firmware(%s) failed: %d\n",
+			     fwfile, ret);
+		return ret;
+	}
+
+	if (!fw)
+		return -EINVAL;
+
+	*buf = devm_kmemdup(&device->pdev->dev, fw->data, fw->size, GFP_KERNEL);
+	*len = fw->size;
+
+	release_firmware(fw);
+	return (*buf) ? 0 : -ENOMEM;
+}
+
+static int a3xx_microcode_read(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_firmware *pm4_fw = ADRENO_FW(adreno_dev, ADRENO_FW_PM4);
+	struct adreno_firmware *pfp_fw = ADRENO_FW(adreno_dev, ADRENO_FW_PFP);
+	const struct adreno_a3xx_core *a3xx_core = to_a3xx_core(adreno_dev);
+
+	if (pm4_fw->fwvirt == NULL) {
+		int len;
+		void *ptr;
+
+		int ret = _load_firmware(device,
+			a3xx_core->pm4fw_name, &ptr, &len);
+
+		if (ret) {
+			dev_err(device->dev,  "Failed to read pm4 ucode %s\n",
+				a3xx_core->pm4fw_name);
+			return ret;
+		}
+
+		/* PM4 size is 3 dword aligned plus 1 dword of version */
+		if (len % ((sizeof(uint32_t) * 3)) != sizeof(uint32_t)) {
+			dev_err(device->dev,
+				     "Bad pm4 microcode size: %d\n",
+				     len);
+			kfree(ptr);
+			return -ENOMEM;
+		}
+
+		pm4_fw->size = len / sizeof(uint32_t);
+		pm4_fw->fwvirt = ptr;
+		pm4_fw->version = pm4_fw->fwvirt[1];
+	}
+
+	if (pfp_fw->fwvirt == NULL) {
+		int len;
+		void *ptr;
+
+		int ret = _load_firmware(device,
+			a3xx_core->pfpfw_name, &ptr, &len);
+		if (ret) {
+			dev_err(device->dev, "Failed to read pfp ucode %s\n",
+					   a3xx_core->pfpfw_name);
+			return ret;
+		}
+
+		/* PFP size shold be dword aligned */
+		if (len % sizeof(uint32_t) != 0) {
+			dev_err(device->dev,
+						"Bad PFP microcode size: %d\n",
+						len);
+			kfree(ptr);
+			return -ENOMEM;
+		}
+
+		pfp_fw->size = len / sizeof(uint32_t);
+		pfp_fw->fwvirt = ptr;
+		pfp_fw->version = pfp_fw->fwvirt[1];
+	}
+
+	return 0;
+}
+
+static void a3xx_microcode_load(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	size_t pm4_size = adreno_dev->fw[ADRENO_FW_PM4].size;
+	size_t pfp_size = adreno_dev->fw[ADRENO_FW_PFP].size;
+	int i;
+
+	/* load the CP ucode using AHB writes */
+	kgsl_regwrite(device, A3XX_CP_ME_RAM_WADDR, 0);
+
+	for (i = 1; i < pm4_size; i++)
+		kgsl_regwrite(device, A3XX_CP_ME_RAM_DATA,
+				adreno_dev->fw[ADRENO_FW_PM4].fwvirt[i]);
+
+	kgsl_regwrite(device, A3XX_CP_PFP_UCODE_ADDR, 0);
+
+	for (i = 1; i < pfp_size; i++)
+		kgsl_regwrite(device, A3XX_CP_PFP_UCODE_DATA,
+				adreno_dev->fw[ADRENO_FW_PFP].fwvirt[i]);
+}
+
+static u64 a3xx_read_alwayson(struct adreno_device *adreno_dev)
+{
+	/* A3XX does not have a always on timer */
+	return 0;
+}
+
+static irqreturn_t a3xx_irq_handler(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	irqreturn_t ret;
+	u32 status;
+
+	/* Get the current interrupt status */
+	kgsl_regread(device, A3XX_RBBM_INT_0_STATUS, &status);
+
+	/*
+	 * Clear all the interrupt bits except A3XX_INT_RBBM_AHB_ERROR.
+	 * The interrupt will stay asserted until it is cleared by the handler
+	 * so don't touch it yet to avoid a storm
+	 */
+
+	kgsl_regwrite(device, A3XX_RBBM_INT_CLEAR_CMD,
+		status & ~A3XX_INT_RBBM_AHB_ERROR);
+
+	/* Call the helper to execute the callbacks */
+	ret = adreno_irq_callbacks(adreno_dev, a3xx_irq_funcs, status);
+
+	trace_kgsl_a3xx_irq_status(adreno_dev, status);
+
+	/* Now clear AHB_ERROR if it was set */
+	if (status & A3XX_INT_RBBM_AHB_ERROR)
+		kgsl_regwrite(device, A3XX_RBBM_INT_CLEAR_CMD,
+			A3XX_INT_RBBM_AHB_ERROR);
+
+	return ret;
+}
+
+static bool a3xx_hw_isidle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 status;
+
+	kgsl_regread(device, A3XX_RBBM_STATUS, &status);
+
+	if (status & 0x7ffffffe)
+		return false;
+
+	kgsl_regread(device, A3XX_RBBM_INT_0_STATUS, &status);
+
+	/* Return busy if a interrupt is pending */
+	return !((status & adreno_dev->irq_mask) ||
+		atomic_read(&adreno_dev->pending_irq_refcnt));
+}
+
+static int a3xx_clear_pending_transactions(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 mask = A30X_VBIF_XIN_HALT_CTRL0_MASK;
+	int ret;
+
+	kgsl_regwrite(device, A3XX_VBIF_XIN_HALT_CTRL0, mask);
+	ret = adreno_wait_for_halt_ack(device, A3XX_VBIF_XIN_HALT_CTRL1, mask);
+	kgsl_regwrite(device, A3XX_VBIF_XIN_HALT_CTRL0, 0);
+
+	return ret;
+}
+
+static bool a3xx_is_hw_collapsible(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/*
+	 * Skip power collapse for A304, if power ctrl flag is set to
+	 * non zero. As A304 soft_reset will not work, power collapse
+	 * needs to disable to avoid soft_reset.
+	 */
+	if (adreno_is_a304(adreno_dev) && device->pwrctrl.ctrl_flags)
+		return false;
+
+	return adreno_isidle(adreno_dev);
+}
+
+static void a3xx_power_stats(struct adreno_device *adreno_dev,
+		struct kgsl_power_stats *stats)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_busy_data *busy = &adreno_dev->busy_data;
+	s64 freq = kgsl_pwrctrl_active_freq(&device->pwrctrl) / 1000000;
+	u64 gpu_busy;
+
+	/* Set the GPU busy counter for frequency scaling */
+	gpu_busy = counter_delta(device, A3XX_RBBM_PERFCTR_PWR_1_LO,
+		&busy->gpu_busy);
+
+	stats->busy_time = gpu_busy / freq;
+
+	if (!device->pwrctrl.bus_control)
+		return;
+
+	stats->ram_time = counter_delta(device, adreno_dev->ram_cycles_lo,
+		&busy->bif_ram_cycles);
+
+	stats->ram_wait = counter_delta(device, adreno_dev->starved_ram_lo,
+		&busy->bif_starved_ram);
+}
+
+static int a3xx_setproperty(struct kgsl_device_private *dev_priv,
+		u32 type, void __user *value, u32 sizebytes)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	u32 enable;
+
+	if (type != KGSL_PROP_PWRCTRL)
+		return -ENODEV;
+
+	if (sizebytes != sizeof(enable))
+		return -EINVAL;
+
+	if (copy_from_user(&enable, value, sizeof(enable)))
+		return -EFAULT;
+
+	mutex_lock(&device->mutex);
+	if (enable) {
+		device->pwrctrl.ctrl_flags = 0;
+
+		if (!adreno_active_count_get(adreno_dev)) {
+			a3xx_soft_fault_detect_start(adreno_dev);
+			adreno_active_count_put(adreno_dev);
+		}
+
+		kgsl_pwrscale_enable(device);
+	} else {
+		kgsl_pwrctrl_change_state(device, KGSL_STATE_ACTIVE);
+		device->pwrctrl.ctrl_flags = KGSL_PWR_ON;
+
+		a3xx_soft_fault_detect_stop(adreno_dev);
+		kgsl_pwrscale_disable(device, true);
+	}
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+const struct adreno_gpudev adreno_a3xx_gpudev = {
+	.reg_offsets = a3xx_register_offsets,
+	.irq_handler = a3xx_irq_handler,
+	.probe = a3xx_probe,
+	.rb_start = a3xx_rb_start,
+	.init = a3xx_init,
+	.start = a3xx_start,
+	.snapshot = a3xx_snapshot,
+	.read_alwayson = a3xx_read_alwayson,
+	.hw_isidle = a3xx_hw_isidle,
+	.power_ops = &adreno_power_operations,
+	.clear_pending_transactions = a3xx_clear_pending_transactions,
+	.ringbuffer_submitcmd = a3xx_ringbuffer_submitcmd,
+	.is_hw_collapsible = a3xx_is_hw_collapsible,
+	.power_stats = a3xx_power_stats,
+	.setproperty = a3xx_setproperty,
+	.remove = a3xx_remove,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a3xx.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a3xx.h
@@ -0,0 +1,76 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2013-2016, 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __A3XX_H
+#define __A3XX_H
+
+#include "a3xx_reg.h"
+/**
+ * struct adreno_a3xx_core - a3xx specific GPU core definitions
+ */
+struct adreno_a3xx_core {
+	/** @base: Container for the generic &struct adreno_gpu_core */
+	struct adreno_gpu_core base;
+	/** pm4fw_name: Name of the PM4 microcode file */
+	const char *pm4fw_name;
+	/** pfpfw_name: Name of the PFP microcode file */
+	const char *pfpfw_name;
+	/** @vbif: List of registers and values to write for VBIF */
+	const struct kgsl_regmap_list *vbif;
+	/** @vbif_count: Number of registers in @vbif */
+	u32 vbif_count;
+};
+
+struct adreno_device;
+
+/**
+ * to_a3xx_core - return the a3xx specific GPU core struct
+ * @adreno_dev: An Adreno GPU device handle
+ *
+ * Returns:
+ * A pointer to the a3xx specific GPU core struct
+ */
+static inline const struct adreno_a3xx_core *
+to_a3xx_core(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gpu_core *core = adreno_dev->gpucore;
+
+	return container_of(core, struct adreno_a3xx_core, base);
+}
+
+void a3xx_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot);
+
+extern const struct adreno_perfcounters adreno_a3xx_perfcounters;
+
+/**
+ * a3xx_ringbuffer_init - Initialize the ringbuffer
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * Initialize the ringbuffer for a3xx.
+ * Return: 0 on success or negative on failure
+ */
+int a3xx_ringbuffer_init(struct adreno_device *adreno_dev);
+
+/**
+ * a3xx_ringbuffer_submitcmd - Submit a user command to the ringbuffer
+ * @adreno_dev: An Adreno GPU handle
+ * @cmdobj: Pointer to a user command object
+ * @flags: Internal submit flags
+ * @time: Optional pointer to a adreno_submit_time container
+ *
+ * Return: 0 on success or negative on failure
+ */
+int a3xx_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj, u32 flags,
+		struct adreno_submit_time *time);
+
+#ifdef CONFIG_QCOM_KGSL_CORESIGHT
+void a3xx_coresight_init(struct adreno_device *device);
+#else
+static inline void a3xx_coresight_init(struct adreno_device *device) { }
+#endif
+
+#endif /*__A3XX_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a3xx_coresight.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a3xx_coresight.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+*/
+
+#include "adreno.h"
+#include "adreno_a3xx.h"
+#include "adreno_coresight.h"
+
+static struct adreno_coresight_register a3xx_coresight_registers[] = {
+	{ A3XX_RBBM_DEBUG_BUS_CTL, 0x0001093F },
+	{ A3XX_RBBM_EXT_TRACE_STOP_CNT, 0x00017fff },
+	{ A3XX_RBBM_EXT_TRACE_START_CNT, 0x0001000f },
+	{ A3XX_RBBM_EXT_TRACE_PERIOD_CNT, 0x0001ffff },
+	{ A3XX_RBBM_EXT_TRACE_CMD, 0x00000001 },
+	{ A3XX_RBBM_EXT_TRACE_BUS_CTL, 0x89100010 },
+	{ A3XX_RBBM_DEBUG_BUS_STB_CTL0, 0x00000000 },
+	{ A3XX_RBBM_DEBUG_BUS_STB_CTL1, 0xFFFFFFFE },
+	{ A3XX_RBBM_INT_TRACE_BUS_CTL, 0x00201111 },
+};
+
+static ADRENO_CORESIGHT_ATTR(config_debug_bus,
+	&a3xx_coresight_registers[0]);
+static ADRENO_CORESIGHT_ATTR(config_trace_stop_cnt,
+	&a3xx_coresight_registers[1]);
+static ADRENO_CORESIGHT_ATTR(config_trace_start_cnt,
+	&a3xx_coresight_registers[2]);
+static ADRENO_CORESIGHT_ATTR(config_trace_period_cnt,
+	&a3xx_coresight_registers[3]);
+static ADRENO_CORESIGHT_ATTR(config_trace_cmd,
+	&a3xx_coresight_registers[4]);
+static ADRENO_CORESIGHT_ATTR(config_trace_bus_ctl,
+	&a3xx_coresight_registers[5]);
+
+static struct attribute *a3xx_coresight_attrs[] = {
+	&coresight_attr_config_debug_bus.attr.attr,
+	&coresight_attr_config_trace_start_cnt.attr.attr,
+	&coresight_attr_config_trace_stop_cnt.attr.attr,
+	&coresight_attr_config_trace_period_cnt.attr.attr,
+	&coresight_attr_config_trace_cmd.attr.attr,
+	&coresight_attr_config_trace_bus_ctl.attr.attr,
+	NULL,
+};
+
+static const struct attribute_group a3xx_coresight_group = {
+	.attrs = a3xx_coresight_attrs,
+};
+
+static const struct attribute_group *a3xx_coresight_groups[] = {
+	&a3xx_coresight_group,
+	NULL,
+};
+
+static const struct adreno_coresight a3xx_coresight = {
+	.registers = a3xx_coresight_registers,
+	.count = ARRAY_SIZE(a3xx_coresight_registers),
+	.groups = a3xx_coresight_groups,
+};
+
+void a3xx_coresight_init(struct adreno_device *adreno_dev)
+{
+	adreno_coresight_add_device(adreno_dev, "coresight-gfx",
+		&a3xx_coresight, &adreno_dev->gx_coresight);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a3xx_perfcounter.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a3xx_perfcounter.c
@@ -0,0 +1,411 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a3xx.h"
+#include "adreno_perfcounter.h"
+#include "kgsl_device.h"
+
+/* Bit flag for RBMM_PERFCTR_CTL */
+#define RBBM_PERFCTR_CTL_ENABLE		0x00000001
+#define VBIF2_PERF_CNT_SEL_MASK 0x7F
+/* offset of clear register from select register */
+#define VBIF2_PERF_CLR_REG_SEL_OFF 8
+/* offset of enable register from select register */
+#define VBIF2_PERF_EN_REG_SEL_OFF 16
+/* offset of clear register from the enable register */
+#define VBIF2_PERF_PWR_CLR_REG_EN_OFF 8
+
+static void a3xx_counter_load(struct adreno_device *adreno_dev,
+		struct adreno_perfcount_register *reg)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int index = reg->load_bit / 32;
+	u32 enable = BIT(reg->load_bit & 31);
+
+	kgsl_regwrite(device, A3XX_RBBM_PERFCTR_LOAD_VALUE_LO,
+		lower_32_bits(reg->value));
+
+	kgsl_regwrite(device, A3XX_RBBM_PERFCTR_LOAD_VALUE_HI,
+		upper_32_bits(reg->value));
+
+	if (index == 0)
+		kgsl_regwrite(device, A3XX_RBBM_PERFCTR_LOAD_CMD0, enable);
+	else
+		kgsl_regwrite(device, A3XX_RBBM_PERFCTR_LOAD_CMD1, enable);
+}
+
+static int a3xx_counter_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	kgsl_regwrite(device, reg->select, countable);
+	reg->value = 0;
+
+	return 0;
+}
+
+static u64 a3xx_counter_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 val, hi, lo;
+
+	kgsl_regread(device, A3XX_RBBM_PERFCTR_CTL, &val);
+	kgsl_regwrite(device, A3XX_RBBM_PERFCTR_CTL,
+		val & ~RBBM_PERFCTR_CTL_ENABLE);
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	kgsl_regwrite(device, A3XX_RBBM_PERFCTR_CTL, val);
+
+	return (((u64) hi) << 32) | lo;
+}
+
+static int a3xx_counter_pwr_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	return 0;
+}
+
+static u64 a3xx_counter_pwr_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 val, hi, lo;
+
+	kgsl_regread(device, A3XX_RBBM_RBBM_CTL, &val);
+
+	/* Freeze the counter so we can read it */
+	if (!counter)
+		kgsl_regwrite(device, A3XX_RBBM_RBBM_CTL, val & ~0x10000);
+	else
+		kgsl_regwrite(device, A3XX_RBBM_RBBM_CTL, val & ~0x20000);
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	kgsl_regwrite(device, A3XX_RBBM_RBBM_CTL, val);
+
+	return ((((u64) hi) << 32) | lo) + reg->value;
+}
+
+static int a3xx_counter_vbif_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	if (countable > VBIF2_PERF_CNT_SEL_MASK)
+		return -EINVAL;
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regwrite(device,
+		reg->select - VBIF2_PERF_CLR_REG_SEL_OFF, 1);
+	kgsl_regwrite(device,
+		reg->select - VBIF2_PERF_CLR_REG_SEL_OFF, 0);
+	kgsl_regwrite(device,
+		reg->select, countable & VBIF2_PERF_CNT_SEL_MASK);
+	/* enable reg is 8 DWORDS before select reg */
+	kgsl_regwrite(device,
+		reg->select - VBIF2_PERF_EN_REG_SEL_OFF, 1);
+
+	kgsl_regwrite(device, reg->select, countable);
+
+	reg->value = 0;
+	return 0;
+}
+
+static u64 a3xx_counter_vbif_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 hi, lo;
+
+	/* freeze counter */
+	kgsl_regwrite(device, reg->select - VBIF2_PERF_EN_REG_SEL_OFF, 0);
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	/* un-freeze counter */
+	kgsl_regwrite(device, reg->select - VBIF2_PERF_EN_REG_SEL_OFF, 1);
+
+	return ((((u64) hi) << 32) | lo) + reg->value;
+}
+
+static int a3xx_counter_vbif_pwr_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regwrite(device, reg->select +
+		VBIF2_PERF_PWR_CLR_REG_EN_OFF, 1);
+	kgsl_regwrite(device, reg->select +
+		VBIF2_PERF_PWR_CLR_REG_EN_OFF, 0);
+	kgsl_regwrite(device, reg->select, 1);
+
+	reg->value = 0;
+	return 0;
+}
+
+static u64 a3xx_counter_vbif_pwr_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 hi, lo;
+
+	/* freeze counter */
+	kgsl_regwrite(device, reg->select, 0);
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	/* un-freeze counter */
+	kgsl_regwrite(device, reg->select, 1);
+
+	return ((((u64) hi) << 32) | lo) + reg->value;
+}
+
+/*
+ * Define the available perfcounter groups - these get used by
+ * adreno_perfcounter_get and adreno_perfcounter_put
+ */
+
+static struct adreno_perfcount_register a3xx_perfcounters_cp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_CP_0_LO,
+		A3XX_RBBM_PERFCTR_CP_0_HI, 0, A3XX_CP_PERFCOUNTER_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_rbbm[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_RBBM_0_LO,
+		A3XX_RBBM_PERFCTR_RBBM_0_HI, 1, A3XX_RBBM_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_RBBM_1_LO,
+		A3XX_RBBM_PERFCTR_RBBM_1_HI, 2, A3XX_RBBM_PERFCOUNTER1_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_pc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_PC_0_LO,
+		A3XX_RBBM_PERFCTR_PC_0_HI, 3, A3XX_PC_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_PC_1_LO,
+		A3XX_RBBM_PERFCTR_PC_1_HI, 4, A3XX_PC_PERFCOUNTER1_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_PC_2_LO,
+		A3XX_RBBM_PERFCTR_PC_2_HI, 5, A3XX_PC_PERFCOUNTER2_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_PC_3_LO,
+		A3XX_RBBM_PERFCTR_PC_3_HI, 6, A3XX_PC_PERFCOUNTER3_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_vfd[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_VFD_0_LO,
+		A3XX_RBBM_PERFCTR_VFD_0_HI, 7, A3XX_VFD_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_VFD_1_LO,
+		A3XX_RBBM_PERFCTR_VFD_1_HI, 8, A3XX_VFD_PERFCOUNTER1_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_hlsq[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_HLSQ_0_LO,
+		A3XX_RBBM_PERFCTR_HLSQ_0_HI, 9,
+		A3XX_HLSQ_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_HLSQ_1_LO,
+		A3XX_RBBM_PERFCTR_HLSQ_1_HI, 10,
+		A3XX_HLSQ_PERFCOUNTER1_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_HLSQ_2_LO,
+		A3XX_RBBM_PERFCTR_HLSQ_2_HI, 11,
+		A3XX_HLSQ_PERFCOUNTER2_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_HLSQ_3_LO,
+		A3XX_RBBM_PERFCTR_HLSQ_3_HI, 12,
+		A3XX_HLSQ_PERFCOUNTER3_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_HLSQ_4_LO,
+		A3XX_RBBM_PERFCTR_HLSQ_4_HI, 13,
+		A3XX_HLSQ_PERFCOUNTER4_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_HLSQ_5_LO,
+		A3XX_RBBM_PERFCTR_HLSQ_5_HI, 14,
+		A3XX_HLSQ_PERFCOUNTER5_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_vpc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_VPC_0_LO,
+		A3XX_RBBM_PERFCTR_VPC_0_HI, 15, A3XX_VPC_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_VPC_1_LO,
+		A3XX_RBBM_PERFCTR_VPC_1_HI, 16, A3XX_VPC_PERFCOUNTER1_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_tse[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_TSE_0_LO,
+		A3XX_RBBM_PERFCTR_TSE_0_HI, 17, A3XX_GRAS_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_TSE_1_LO,
+		A3XX_RBBM_PERFCTR_TSE_1_HI, 18, A3XX_GRAS_PERFCOUNTER1_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_ras[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_RAS_0_LO,
+		A3XX_RBBM_PERFCTR_RAS_0_HI, 19, A3XX_GRAS_PERFCOUNTER2_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_RAS_1_LO,
+		A3XX_RBBM_PERFCTR_RAS_1_HI, 20, A3XX_GRAS_PERFCOUNTER3_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_uche[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_UCHE_0_LO,
+		A3XX_RBBM_PERFCTR_UCHE_0_HI, 21,
+		A3XX_UCHE_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_UCHE_1_LO,
+		A3XX_RBBM_PERFCTR_UCHE_1_HI, 22,
+		A3XX_UCHE_PERFCOUNTER1_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_UCHE_2_LO,
+		A3XX_RBBM_PERFCTR_UCHE_2_HI, 23,
+		A3XX_UCHE_PERFCOUNTER2_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_UCHE_3_LO,
+		A3XX_RBBM_PERFCTR_UCHE_3_HI, 24,
+		A3XX_UCHE_PERFCOUNTER3_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_UCHE_4_LO,
+		A3XX_RBBM_PERFCTR_UCHE_4_HI, 25,
+		A3XX_UCHE_PERFCOUNTER4_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_UCHE_5_LO,
+		A3XX_RBBM_PERFCTR_UCHE_5_HI, 26,
+		A3XX_UCHE_PERFCOUNTER5_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_tp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_TP_0_LO,
+		A3XX_RBBM_PERFCTR_TP_0_HI, 27, A3XX_TP_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_TP_1_LO,
+		A3XX_RBBM_PERFCTR_TP_1_HI, 28, A3XX_TP_PERFCOUNTER1_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_TP_2_LO,
+		A3XX_RBBM_PERFCTR_TP_2_HI, 29, A3XX_TP_PERFCOUNTER2_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_TP_3_LO,
+		A3XX_RBBM_PERFCTR_TP_3_HI, 30, A3XX_TP_PERFCOUNTER3_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_TP_4_LO,
+		A3XX_RBBM_PERFCTR_TP_4_HI, 31, A3XX_TP_PERFCOUNTER4_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_TP_5_LO,
+		A3XX_RBBM_PERFCTR_TP_5_HI, 32, A3XX_TP_PERFCOUNTER5_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_sp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_SP_0_LO,
+		A3XX_RBBM_PERFCTR_SP_0_HI, 33, A3XX_SP_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_SP_1_LO,
+		A3XX_RBBM_PERFCTR_SP_1_HI, 34, A3XX_SP_PERFCOUNTER1_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_SP_2_LO,
+		A3XX_RBBM_PERFCTR_SP_2_HI, 35, A3XX_SP_PERFCOUNTER2_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_SP_3_LO,
+		A3XX_RBBM_PERFCTR_SP_3_HI, 36, A3XX_SP_PERFCOUNTER3_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_SP_4_LO,
+		A3XX_RBBM_PERFCTR_SP_4_HI, 37, A3XX_SP_PERFCOUNTER4_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_SP_5_LO,
+		A3XX_RBBM_PERFCTR_SP_5_HI, 38, A3XX_SP_PERFCOUNTER5_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_SP_6_LO,
+		A3XX_RBBM_PERFCTR_SP_6_HI, 39, A3XX_SP_PERFCOUNTER6_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_SP_7_LO,
+		A3XX_RBBM_PERFCTR_SP_7_HI, 40, A3XX_SP_PERFCOUNTER7_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_rb[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_RB_0_LO,
+		A3XX_RBBM_PERFCTR_RB_0_HI, 41, A3XX_RB_PERFCOUNTER0_SELECT },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_RB_1_LO,
+		A3XX_RBBM_PERFCTR_RB_1_HI, 42, A3XX_RB_PERFCOUNTER1_SELECT },
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_pwr[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_RBBM_PERFCTR_PWR_0_LO,
+		A3XX_RBBM_PERFCTR_PWR_0_HI, -1, 0 },
+	/*
+	 * A3XX_RBBM_PERFCTR_PWR_1_LO is used for frequency scaling and removed
+	 * from the pool of available counters
+	 */
+};
+
+static struct adreno_perfcount_register a3xx_perfcounters_vbif2[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_VBIF2_PERF_CNT_LOW0,
+		A3XX_VBIF2_PERF_CNT_HIGH0, -1, A3XX_VBIF2_PERF_CNT_SEL0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_VBIF2_PERF_CNT_LOW1,
+		A3XX_VBIF2_PERF_CNT_HIGH1, -1, A3XX_VBIF2_PERF_CNT_SEL1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_VBIF2_PERF_CNT_LOW2,
+		A3XX_VBIF2_PERF_CNT_HIGH2, -1, A3XX_VBIF2_PERF_CNT_SEL2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A3XX_VBIF2_PERF_CNT_LOW3,
+		A3XX_VBIF2_PERF_CNT_HIGH3, -1, A3XX_VBIF2_PERF_CNT_SEL3 },
+};
+/*
+ * Placing EN register in select field since vbif perf counters
+ * don't have select register to program
+ */
+static struct adreno_perfcount_register a3xx_perfcounters_vbif2_pwr[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0,
+		0, A3XX_VBIF2_PERF_PWR_CNT_LOW0,
+		A3XX_VBIF2_PERF_PWR_CNT_HIGH0, -1,
+		A3XX_VBIF2_PERF_PWR_CNT_EN0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0,
+		0, A3XX_VBIF2_PERF_PWR_CNT_LOW1,
+		A3XX_VBIF2_PERF_PWR_CNT_HIGH1, -1,
+		A3XX_VBIF2_PERF_PWR_CNT_EN1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0,
+		0, A3XX_VBIF2_PERF_PWR_CNT_LOW2,
+		A3XX_VBIF2_PERF_PWR_CNT_HIGH2, -1,
+		A3XX_VBIF2_PERF_PWR_CNT_EN2 },
+};
+
+#define A3XX_PERFCOUNTER_GROUP(offset, name, enable, read, load) \
+	ADRENO_PERFCOUNTER_GROUP(a3xx, offset, name, enable, read, load)
+
+#define A3XX_PERFCOUNTER_GROUP_FLAGS(offset, name, flags, enable, read, load) \
+	ADRENO_PERFCOUNTER_GROUP_FLAGS(a3xx, offset, name, flags, enable, read, load)
+
+#define A3XX_REGULAR_PERFCOUNTER_GROUP(offset, name) \
+	A3XX_PERFCOUNTER_GROUP(offset, name, a3xx_counter_enable,\
+		a3xx_counter_read, a3xx_counter_load)
+
+static const struct adreno_perfcount_group
+a3xx_perfcounter_groups[KGSL_PERFCOUNTER_GROUP_MAX] = {
+	A3XX_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(RBBM, rbbm),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(VFD, vfd),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(HLSQ, hlsq),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(TSE, tse),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(RAS, ras),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(UCHE, uche),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(TP, tp),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(SP, sp),
+	A3XX_REGULAR_PERFCOUNTER_GROUP(RB, rb),
+	A3XX_PERFCOUNTER_GROUP_FLAGS(PWR, pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		a3xx_counter_pwr_enable, a3xx_counter_pwr_read, NULL),
+	A3XX_PERFCOUNTER_GROUP(VBIF, vbif2,
+		a3xx_counter_vbif_enable, a3xx_counter_vbif_read, NULL),
+	A3XX_PERFCOUNTER_GROUP_FLAGS(VBIF_PWR, vbif2_pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		a3xx_counter_vbif_pwr_enable, a3xx_counter_vbif_pwr_read,
+		NULL),
+
+};
+
+const struct adreno_perfcounters adreno_a3xx_perfcounters = {
+	a3xx_perfcounter_groups,
+	ARRAY_SIZE(a3xx_perfcounter_groups),
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a3xx_ringbuffer.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a3xx_ringbuffer.c
@@ -0,0 +1,458 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a3xx.h"
+#include "adreno_pm4types.h"
+#include "adreno_ringbuffer.h"
+#include "adreno_trace.h"
+#include "kgsl_trace.h"
+
+static int a3xx_wait_reg(unsigned int *cmds, unsigned int addr,
+			unsigned int val, unsigned int mask,
+			unsigned int interval)
+{
+	cmds[0] = cp_type3_packet(CP_WAIT_REG_EQ, 4);
+	cmds[1] = addr;
+	cmds[2] = val;
+	cmds[3] = mask;
+	cmds[4] = interval;
+
+	return 5;
+}
+
+static int a3xx_vbif_lock(unsigned int *cmds)
+{
+	int count;
+
+	/*
+	 * glue commands together until next
+	 * WAIT_FOR_ME
+	 */
+	count = a3xx_wait_reg(cmds, A3XX_CP_WFI_PEND_CTR,
+			1, 0xFFFFFFFF, 0xF);
+
+	/* MMU-500 VBIF stall */
+	cmds[count++] = cp_type3_packet(CP_REG_RMW, 3);
+	cmds[count++] = A3XX_VBIF_DDR_OUTPUT_RECOVERABLE_HALT_CTRL0;
+	/* AND to unmask the HALT bit */
+	cmds[count++] = ~(VBIF_RECOVERABLE_HALT_CTRL);
+	/* OR to set the HALT bit */
+	cmds[count++] = 0x1;
+
+	/* Wait for acknowledgment */
+	count += a3xx_wait_reg(&cmds[count],
+			A3XX_VBIF_DDR_OUTPUT_RECOVERABLE_HALT_CTRL1,
+			1, 0xFFFFFFFF, 0xF);
+
+	return count;
+}
+
+static int a3xx_vbif_unlock(unsigned int *cmds)
+{
+	/* MMU-500 VBIF unstall */
+	cmds[0] = cp_type3_packet(CP_REG_RMW, 3);
+	cmds[1] = A3XX_VBIF_DDR_OUTPUT_RECOVERABLE_HALT_CTRL0;
+	/* AND to unmask the HALT bit */
+	cmds[2] = ~(VBIF_RECOVERABLE_HALT_CTRL);
+	/* OR to reset the HALT bit */
+	cmds[3] = 0;
+
+	/* release all commands since _vbif_lock() with wait_for_me */
+	cmds[4] = cp_type3_packet(CP_WAIT_FOR_ME, 1);
+	cmds[5] = 0;
+
+	return 6;
+}
+
+#define A3XX_GPU_OFFSET 0xa000
+
+static int a3xx_cp_smmu_reg(unsigned int *cmds,
+				u32 reg,
+				unsigned int num)
+{
+	cmds[0] = cp_type3_packet(CP_REG_WR_NO_CTXT, num + 1);
+	cmds[1] = (A3XX_GPU_OFFSET + reg) >> 2;
+
+	return 2;
+}
+
+/* This function is only needed for A3xx targets */
+static int a3xx_tlbiall(unsigned int *cmds)
+{
+	unsigned int tlbstatus = (A3XX_GPU_OFFSET +
+		KGSL_IOMMU_CTX_TLBSTATUS) >> 2;
+	int count;
+
+	count = a3xx_cp_smmu_reg(cmds, KGSL_IOMMU_CTX_TLBIALL, 1);
+	cmds[count++] = 1;
+
+	count += a3xx_cp_smmu_reg(&cmds[count], KGSL_IOMMU_CTX_TLBSYNC, 1);
+	cmds[count++] = 0;
+
+	count += a3xx_wait_reg(&cmds[count], tlbstatus, 0,
+			KGSL_IOMMU_CTX_TLBSTATUS_SACTIVE, 0xF);
+
+	return count;
+}
+
+/* offset at which a nop command is placed in setstate */
+#define KGSL_IOMMU_SETSTATE_NOP_OFFSET	1024
+
+static int a3xx_rb_pagetable_switch(struct adreno_device *adreno_dev,
+		struct kgsl_pagetable *pagetable, u32 *cmds)
+{
+	u64 ttbr0 = kgsl_mmu_pagetable_get_ttbr0(pagetable);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	int count = 0;
+
+	/* Skip pagetable switch if current context is using default PT. */
+	if (pagetable == device->mmu.defaultpagetable)
+		return 0;
+	/*
+	 * Adding an indirect buffer ensures that the prefetch stalls until
+	 * the commands in indirect buffer have completed. We need to stall
+	 * prefetch with a nop indirect buffer when updating pagetables
+	 * because it provides stabler synchronization.
+	 */
+	cmds[count++] = cp_type3_packet(CP_WAIT_FOR_ME, 1);
+	cmds[count++] = 0;
+
+	cmds[count++] = cp_type3_packet(CP_INDIRECT_BUFFER_PFE, 2);
+	cmds[count++] = lower_32_bits(iommu->setstate->gpuaddr);
+	cmds[count++] = 2;
+
+	cmds[count++] = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	cmds[count++] = 0;
+
+	cmds[count++] = cp_type3_packet(CP_WAIT_FOR_ME, 1);
+	cmds[count++] = 0;
+
+	count += a3xx_vbif_lock(&cmds[count]);
+
+	count += a3xx_cp_smmu_reg(&cmds[count], KGSL_IOMMU_CTX_TTBR0, 2);
+	cmds[count++] = lower_32_bits(ttbr0);
+	cmds[count++] = upper_32_bits(ttbr0);
+
+	count += a3xx_vbif_unlock(&cmds[count]);
+
+	count += a3xx_tlbiall(&cmds[count]);
+
+	/* wait for me to finish the TLBI */
+	cmds[count++] = cp_type3_packet(CP_WAIT_FOR_ME, 1);
+	cmds[count++] = 0;
+	cmds[count++] = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	cmds[count++] = 0;
+
+	/* Invalidate the state */
+	cmds[count++] = cp_type3_packet(CP_INVALIDATE_STATE, 1);
+	cmds[count++] = 0x7ffff;
+
+	return count;
+}
+
+#define RB_SOPTIMESTAMP(device, rb) \
+	       MEMSTORE_RB_GPU_ADDR(device, rb, soptimestamp)
+#define CTXT_SOPTIMESTAMP(device, drawctxt) \
+	       MEMSTORE_ID_GPU_ADDR(device, (drawctxt)->base.id, soptimestamp)
+
+#define RB_EOPTIMESTAMP(device, rb) \
+	       MEMSTORE_RB_GPU_ADDR(device, rb, eoptimestamp)
+#define CTXT_EOPTIMESTAMP(device, drawctxt) \
+	       MEMSTORE_ID_GPU_ADDR(device, (drawctxt)->base.id, eoptimestamp)
+
+int a3xx_ringbuffer_init(struct adreno_device *adreno_dev)
+{
+	adreno_dev->num_ringbuffers = 1;
+
+	adreno_dev->cur_rb = &(adreno_dev->ringbuffers[0]);
+
+	return adreno_ringbuffer_setup(adreno_dev,
+		&adreno_dev->ringbuffers[0], 0);
+}
+
+#define A3XX_SUBMIT_MAX 55
+
+static int a3xx_ringbuffer_addcmds(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 flags, u32 *in, u32 dwords, u32 timestamp,
+		struct adreno_submit_time *time)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 size = A3XX_SUBMIT_MAX + dwords;
+	u32 *cmds, index = 0;
+	u64 profile_gpuaddr;
+	u32 profile_dwords;
+
+	if (adreno_drawctxt_detached(drawctxt))
+		return -ENOENT;
+
+	if (adreno_gpu_fault(adreno_dev) != 0)
+		return -EPROTO;
+
+	rb->timestamp++;
+
+	if (drawctxt)
+		drawctxt->internal_timestamp = rb->timestamp;
+
+	cmds = adreno_ringbuffer_allocspace(rb, size);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	/* Identify the start of a command */
+	cmds[index++] = cp_type3_packet(CP_NOP, 1);
+	cmds[index++] = drawctxt ? CMD_IDENTIFIER : CMD_INTERNAL_IDENTIFIER;
+
+	if (IS_PWRON_FIXUP(flags)) {
+		cmds[index++] = cp_type3_packet(CP_SET_PROTECTED_MODE, 1);
+		cmds[index++] = 0;
+
+		cmds[index++] = cp_type3_packet(CP_NOP, 1);
+		cmds[index++] = PWRON_FIXUP_IDENTIFIER;
+
+		cmds[index++] = cp_type3_packet(CP_INDIRECT_BUFFER_PFE, 2);
+		cmds[index++] = lower_32_bits(adreno_dev->pwron_fixup->gpuaddr);
+		cmds[index++] = adreno_dev->pwron_fixup_dwords;
+
+		cmds[index++] = cp_type3_packet(CP_SET_PROTECTED_MODE, 1);
+		cmds[index++] = 0;
+	}
+
+	profile_gpuaddr = adreno_profile_preib_processing(adreno_dev,
+		drawctxt, &profile_dwords);
+
+	if (profile_gpuaddr) {
+		cmds[index++] = cp_type3_packet(CP_INDIRECT_BUFFER_PFE, 2);
+		cmds[index++] = lower_32_bits(profile_gpuaddr);
+		cmds[index++] = profile_dwords;
+	}
+
+	if (drawctxt) {
+		cmds[index++] = cp_type3_packet(CP_MEM_WRITE, 2);
+		cmds[index++] = lower_32_bits(CTXT_SOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = timestamp;
+	}
+
+	cmds[index++] = cp_type3_packet(CP_MEM_WRITE, 2);
+	cmds[index++] = lower_32_bits(RB_SOPTIMESTAMP(device, rb));
+	cmds[index++] = rb->timestamp;
+
+	if (IS_NOTPROTECTED(flags)) {
+		cmds[index++] = cp_type3_packet(CP_SET_PROTECTED_MODE, 1);
+		cmds[index++] = 0;
+	}
+
+	memcpy(&cmds[index], in, dwords << 2);
+	index += dwords;
+
+	if (IS_NOTPROTECTED(flags)) {
+		cmds[index++] = cp_type3_packet(CP_SET_PROTECTED_MODE, 1);
+		cmds[index++] = 1;
+	}
+
+	/*
+	 * Flush HLSQ lazy updates to make sure there are no resourses pending
+	 * for indirect loads after the timestamp
+	 */
+
+	cmds[index++] = cp_type3_packet(CP_EVENT_WRITE, 1);
+	cmds[index++] = 0x07; /* HLSQ FLUSH */
+	cmds[index++] = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+	cmds[index++] = 0;
+
+	profile_gpuaddr = adreno_profile_postib_processing(adreno_dev,
+		drawctxt, &profile_dwords);
+
+	if (profile_gpuaddr) {
+		cmds[index++] = cp_type3_packet(CP_INDIRECT_BUFFER_PFE, 2);
+		cmds[index++] = lower_32_bits(profile_gpuaddr);
+		cmds[index++] = profile_dwords;
+	}
+
+	/*
+	 * If this is an internal command, just write the ringbuffer timestamp,
+	 * otherwise, write both
+	 */
+	if (!drawctxt) {
+		cmds[index++] = cp_type3_packet(CP_EVENT_WRITE, 3);
+		cmds[index++] = CACHE_FLUSH_TS | (1 << 31);
+		cmds[index++] = lower_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = rb->timestamp;
+	} else {
+		cmds[index++] = cp_type3_packet(CP_EVENT_WRITE, 3);
+		cmds[index++] = CACHE_FLUSH_TS | (1 << 31);
+		cmds[index++] = lower_32_bits(CTXT_EOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = timestamp;
+
+		cmds[index++] = cp_type3_packet(CP_EVENT_WRITE, 3);
+		cmds[index++] = CACHE_FLUSH_TS;
+		cmds[index++] = lower_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = rb->timestamp;
+	}
+
+	/* Trigger a context rollover */
+	cmds[index++] = cp_type3_packet(CP_SET_CONSTANT, 2);
+	cmds[index++] = (4 << 16) | (A3XX_HLSQ_CL_KERNEL_GROUP_X_REG - 0x2000);
+	cmds[index++] = 0;
+
+	if (IS_WFI(flags)) {
+		cmds[index++] = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+		cmds[index++] = 0;
+	}
+
+	/* Adjust the thing for the number of bytes we actually wrote */
+	rb->_wptr -= (size - index);
+
+	kgsl_pwrscale_busy(device);
+	kgsl_regwrite(device, A3XX_CP_RB_WPTR, rb->_wptr);
+	rb->wptr = rb->_wptr;
+
+	return 0;
+}
+
+static int a3xx_rb_context_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_pagetable *pagetable =
+		adreno_drawctxt_get_pagetable(drawctxt);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int count = 0;
+	u32 cmds[64];
+
+	if (adreno_drawctxt_get_pagetable(rb->drawctxt_active) != pagetable)
+		count += a3xx_rb_pagetable_switch(adreno_dev, pagetable, cmds);
+
+	cmds[count++] = cp_type3_packet(CP_NOP, 1);
+	cmds[count++] = CONTEXT_TO_MEM_IDENTIFIER;
+
+	cmds[count++] = cp_type3_packet(CP_MEM_WRITE, 2);
+	cmds[count++] = lower_32_bits(MEMSTORE_RB_GPU_ADDR(device, rb,
+				current_context));
+	cmds[count++] = drawctxt->base.id;
+
+	cmds[count++] = cp_type3_packet(CP_MEM_WRITE, 2);
+	cmds[count++] = lower_32_bits(MEMSTORE_ID_GPU_ADDR(device,
+		KGSL_MEMSTORE_GLOBAL, current_context));
+	cmds[count++] = drawctxt->base.id;
+
+	cmds[count++] = cp_type0_packet(A3XX_UCHE_CACHE_INVALIDATE0_REG, 2);
+	cmds[count++] = 0;
+	cmds[count++] = 0x90000000;
+
+	return a3xx_ringbuffer_addcmds(adreno_dev, rb, NULL, F_NOTPROTECTED,
+			cmds, count, 0, NULL);
+}
+
+static int a3xx_drawctxt_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (rb->drawctxt_active == drawctxt)
+		return 0;
+
+	if (kgsl_context_detached(&drawctxt->base))
+		return -ENOENT;
+
+	if (!_kgsl_context_get(&drawctxt->base))
+		return -ENOENT;
+
+	trace_adreno_drawctxt_switch(rb, drawctxt);
+
+	a3xx_rb_context_switch(adreno_dev, rb, drawctxt);
+
+	/* Release the current drawctxt as soon as the new one is switched */
+	adreno_put_drawctxt_on_timestamp(device, rb->drawctxt_active,
+		rb, rb->timestamp);
+
+	rb->drawctxt_active = drawctxt;
+	return 0;
+}
+
+#define A3XX_COMMAND_DWORDS 4
+
+int a3xx_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj, u32 flags,
+		struct adreno_submit_time *time)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	struct adreno_ringbuffer *rb = drawctxt->rb;
+	int ret = 0, numibs = 0, index = 0;
+	u32 *cmds;
+
+	/* Count the number of IBs (if we are not skipping) */
+	if (!IS_SKIP(flags)) {
+		struct list_head *tmp;
+
+		list_for_each(tmp, &cmdobj->cmdlist)
+			numibs++;
+	}
+
+	cmds = kmalloc((A3XX_COMMAND_DWORDS + (numibs * 4)) << 2, GFP_KERNEL);
+	if (!cmds) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	cmds[index++] = cp_type3_packet(CP_NOP, 1);
+	cmds[index++] = START_IB_IDENTIFIER;
+
+	if (numibs) {
+		struct kgsl_memobj_node *ib;
+
+		list_for_each_entry(ib, &cmdobj->cmdlist, node) {
+			if (ib->priv & MEMOBJ_SKIP ||
+			    (ib->flags & KGSL_CMDLIST_CTXTSWITCH_PREAMBLE
+			     && !IS_PREAMBLE(flags)))
+				cmds[index++] = cp_type3_packet(CP_NOP, 3);
+
+			cmds[index++] =
+				cp_type3_packet(CP_INDIRECT_BUFFER_PFE, 2);
+			cmds[index++] = lower_32_bits(ib->gpuaddr);
+			cmds[index++] = ib->size >> 2;
+		}
+	}
+
+	cmds[index++] = cp_type3_packet(CP_NOP, 1);
+	cmds[index++] = END_IB_IDENTIFIER;
+
+	ret = a3xx_drawctxt_switch(adreno_dev, rb, drawctxt);
+
+	/*
+	 * In the unlikely event of an error in the drawctxt switch,
+	 * treat it like a hang
+	 */
+	if (ret) {
+		/*
+		 * It is "normal" to get a -ENOSPC or a -ENOENT. Don't log it,
+		 * the upper layers know how to handle it
+		 */
+		if (ret != -ENOSPC && ret != -ENOENT)
+			dev_err(device->dev,
+				     "Unable to switch draw context: %d\n",
+				     ret);
+		goto done;
+	}
+
+	adreno_drawobj_set_constraint(device, drawobj);
+
+	ret = a3xx_ringbuffer_addcmds(adreno_dev, drawctxt->rb, drawctxt,
+		flags, cmds, index, drawobj->timestamp, NULL);
+
+done:
+	trace_kgsl_issueibcmds(device, drawctxt->base.id, numibs,
+		drawobj->timestamp, drawobj->flags, ret, drawctxt->type);
+
+	kfree(cmds);
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a3xx_snapshot.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a3xx_snapshot.c
@@ -0,0 +1,449 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2017,2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+
+#include "adreno.h"
+#include "adreno_a3xx.h"
+#include "adreno_snapshot.h"
+#include "kgsl_device.h"
+
+/*
+ * Set of registers to dump for A3XX on snapshot.
+ * Registers in pairs - first value is the start offset, second
+ * is the stop offset (inclusive)
+ */
+
+static const unsigned int a3xx_registers[] = {
+	0x0000, 0x0002, 0x0010, 0x0012, 0x0018, 0x0018, 0x0020, 0x0027,
+	0x0029, 0x002b, 0x002e, 0x0033, 0x0040, 0x0042, 0x0050, 0x005c,
+	0x0060, 0x006c, 0x0080, 0x0082, 0x0084, 0x0088, 0x0090, 0x00e5,
+	0x00ea, 0x00ed, 0x0100, 0x0100, 0x0110, 0x0123, 0x01c0, 0x01c1,
+	0x01c3, 0x01c5, 0x01c7, 0x01c7, 0x01d5, 0x01d9, 0x01dc, 0x01dd,
+	0x01ea, 0x01ea, 0x01ee, 0x01f1, 0x01f5, 0x01f6, 0x01f8, 0x01f9,
+	0x01fc, 0x01ff,
+	0x0440, 0x0440, 0x0443, 0x0443, 0x0445, 0x0445, 0x044d, 0x044f,
+	0x0452, 0x0452, 0x0454, 0x046f, 0x047c, 0x047c, 0x047f, 0x047f,
+	0x0578, 0x057f, 0x0600, 0x0602, 0x0605, 0x0607, 0x060a, 0x060e,
+	0x0612, 0x0614, 0x0c01, 0x0c02, 0x0c06, 0x0c1d, 0x0c3d, 0x0c3f,
+	0x0c48, 0x0c4b, 0x0c80, 0x0c80, 0x0c88, 0x0c8b, 0x0ca0, 0x0cb7,
+	0x0cc0, 0x0cc1, 0x0cc6, 0x0cc7, 0x0ce4, 0x0ce5,
+	0x0e41, 0x0e45, 0x0e64, 0x0e65,
+	0x0e80, 0x0e82, 0x0e84, 0x0e89, 0x0ea0, 0x0ea1, 0x0ea4, 0x0ea7,
+	0x0ec4, 0x0ecb, 0x0ee0, 0x0ee0, 0x0f00, 0x0f01, 0x0f03, 0x0f09,
+	0x2040, 0x2040, 0x2044, 0x2044, 0x2048, 0x204d, 0x2068, 0x2069,
+	0x206c, 0x206d, 0x2070, 0x2070, 0x2072, 0x2072, 0x2074, 0x2075,
+	0x2079, 0x207a, 0x20c0, 0x20d3, 0x20e4, 0x20ef, 0x2100, 0x2109,
+	0x210c, 0x210c, 0x210e, 0x210e, 0x2110, 0x2111, 0x2114, 0x2115,
+	0x21e4, 0x21e4, 0x21ea, 0x21ea, 0x21ec, 0x21ed, 0x21f0, 0x21f0,
+	0x2240, 0x227e,
+	0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
+	0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
+	0x22ff, 0x22ff, 0x2340, 0x2343,
+	0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d,
+	0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472,
+	0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef,
+	0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511,
+	0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed,
+	0x25f0, 0x25f0,
+	0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce,
+	0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec,
+	0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
+	0x300C, 0x300E, 0x301C, 0x301D,
+	0x302A, 0x302A, 0x302C, 0x302D, 0x3030, 0x3031, 0x3034, 0x3036,
+	0x303C, 0x303C, 0x305E, 0x305F,
+};
+
+/* Removed the following HLSQ register ranges from being read during
+ * fault tolerance since reading the registers may cause the device to hang:
+ */
+static const unsigned int a3xx_hlsq_registers[] = {
+	0x0e00, 0x0e05, 0x0e0c, 0x0e0c, 0x0e22, 0x0e23,
+	0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a,
+	0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a,
+};
+
+/* Shader memory size in words */
+#define SHADER_MEMORY_SIZE 0x4000
+
+/**
+ * _rbbm_debug_bus_read - Helper function to read data from the RBBM
+ * debug bus.
+ * @device - GPU device to read/write registers
+ * @block_id - Debug bus block to read from
+ * @index - Index in the debug bus block to read
+ * @ret - Value of the register read
+ */
+static void _rbbm_debug_bus_read(struct kgsl_device *device,
+	unsigned int block_id, unsigned int index, unsigned int *val)
+{
+	unsigned int block = (block_id << 8) | 1 << 16;
+
+	kgsl_regwrite(device, A3XX_RBBM_DEBUG_BUS_CTL, block | index);
+	kgsl_regread(device, A3XX_RBBM_DEBUG_BUS_DATA_STATUS, val);
+}
+
+/**
+ * a3xx_snapshot_shader_memory - Helper function to dump the GPU shader
+ * memory to the snapshot buffer.
+ * @device: GPU device whose shader memory is to be dumped
+ * @buf: Pointer to binary snapshot data blob being made
+ * @remain: Number of remaining bytes in the snapshot blob
+ * @priv: Unused parameter
+ *
+ */
+static size_t a3xx_snapshot_shader_memory(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	void *data = buf + sizeof(*header);
+	unsigned int shader_read_len = SHADER_MEMORY_SIZE;
+
+	if (remain < DEBUG_SECTION_SZ(shader_read_len)) {
+		SNAPSHOT_ERR_NOMEM(device, "SHADER MEMORY");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_SHADER_MEMORY;
+	header->size = shader_read_len;
+
+	/* Map shader memory to kernel, for dumping */
+	if (IS_ERR_OR_NULL(device->shader_mem_virt)) {
+		struct resource *res;
+
+		res = platform_get_resource_byname(device->pdev,
+			IORESOURCE_MEM, "kgsl_3d0_shader_memory");
+
+		if (res)
+			device->shader_mem_virt =
+				devm_ioremap_resource(&device->pdev->dev, res);
+	}
+
+	if (IS_ERR_OR_NULL(device->shader_mem_virt)) {
+		dev_err(device->dev, "Unable to map the shader memory\n");
+		return 0;
+	}
+
+	memcpy_fromio(data, device->shader_mem_virt, shader_read_len << 2);
+
+	return DEBUG_SECTION_SZ(shader_read_len);
+}
+
+static size_t a3xx_snapshot_debugbus_block(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debugbus *header
+		= (struct kgsl_snapshot_debugbus *)buf;
+	struct adreno_debugbus_block *block = priv;
+	int i;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	size_t size;
+
+	size = (0x40 * sizeof(unsigned int)) + sizeof(*header);
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+
+	header->id = block->block_id;
+	header->count = 0x40;
+
+	for (i = 0; i < 0x40; i++)
+		_rbbm_debug_bus_read(device, block->block_id, i, &data[i]);
+
+	return size;
+}
+
+static struct adreno_debugbus_block debugbus_blocks[] = {
+	{ RBBM_BLOCK_ID_CP, 0x52, },
+	{ RBBM_BLOCK_ID_RBBM, 0x40, },
+	{ RBBM_BLOCK_ID_VBIF, 0x40, },
+	{ RBBM_BLOCK_ID_HLSQ, 0x40, },
+	{ RBBM_BLOCK_ID_UCHE, 0x40, },
+	{ RBBM_BLOCK_ID_PC, 0x40, },
+	{ RBBM_BLOCK_ID_VFD, 0x40, },
+	{ RBBM_BLOCK_ID_VPC, 0x40, },
+	{ RBBM_BLOCK_ID_TSE, 0x40, },
+	{ RBBM_BLOCK_ID_RAS, 0x40, },
+	{ RBBM_BLOCK_ID_VSC, 0x40, },
+	{ RBBM_BLOCK_ID_SP_0, 0x40, },
+	{ RBBM_BLOCK_ID_SP_1, 0x40, },
+	{ RBBM_BLOCK_ID_SP_2, 0x40, },
+	{ RBBM_BLOCK_ID_SP_3, 0x40, },
+	{ RBBM_BLOCK_ID_TPL1_0, 0x40, },
+	{ RBBM_BLOCK_ID_TPL1_1, 0x40, },
+	{ RBBM_BLOCK_ID_TPL1_2, 0x40, },
+	{ RBBM_BLOCK_ID_TPL1_3, 0x40, },
+	{ RBBM_BLOCK_ID_RB_0, 0x40, },
+	{ RBBM_BLOCK_ID_RB_1, 0x40, },
+	{ RBBM_BLOCK_ID_RB_2, 0x40, },
+	{ RBBM_BLOCK_ID_RB_3, 0x40, },
+	{ RBBM_BLOCK_ID_MARB_0, 0x40, },
+	{ RBBM_BLOCK_ID_MARB_1, 0x40, },
+	{ RBBM_BLOCK_ID_MARB_2, 0x40, },
+	{ RBBM_BLOCK_ID_MARB_3, 0x40, },
+};
+
+static void a3xx_snapshot_debugbus(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(debugbus_blocks); i++) {
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_DEBUGBUS, snapshot,
+			a3xx_snapshot_debugbus_block,
+			(void *) &debugbus_blocks[i]);
+	}
+}
+
+static void _snapshot_hlsq_regs(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot)
+{
+	unsigned int next_pif = 0;
+
+	/*
+	 * Trying to read HLSQ registers when the HLSQ block is busy
+	 * will cause the device to hang.  The RBBM_DEBUG_BUS has information
+	 * that will tell us if the HLSQ block is busy or not.  Read values
+	 * from the debug bus to ensure the HLSQ block is not busy (this
+	 * is hardware dependent).  If the HLSQ block is busy do not
+	 * dump the registers, otherwise dump the HLSQ registers.
+	 */
+
+	/*
+	 * tpif status bits: RBBM_BLOCK_ID_HLSQ index 4 [4:0]
+	 * spif status bits: RBBM_BLOCK_ID_HLSQ index 7 [5:0]
+	 *
+	 * if ((tpif == 0, 1, 28) && (spif == 0, 1, 10))
+	 * then dump HLSQ registers
+	 */
+
+	/* check tpif */
+	_rbbm_debug_bus_read(device, RBBM_BLOCK_ID_HLSQ, 4, &next_pif);
+	next_pif &= 0x1f;
+	if (next_pif != 0 && next_pif != 1 && next_pif != 28)
+		return;
+
+	/* check spif */
+	_rbbm_debug_bus_read(device, RBBM_BLOCK_ID_HLSQ, 7, &next_pif);
+	next_pif &= 0x3f;
+	if (next_pif != 0 && next_pif != 1 && next_pif != 10)
+		return;
+
+	SNAPSHOT_REGISTERS(device, snapshot, a3xx_hlsq_registers);
+}
+
+#define VPC_MEM_SIZE 512
+
+static size_t a3xx_snapshot_vpc_memory(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	size_t size = 4 * VPC_MEM_SIZE;
+	int bank, addr, i = 0;
+
+	if (remain < DEBUG_SECTION_SZ(size)) {
+		SNAPSHOT_ERR_NOMEM(device, "VPC MEMORY");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_VPC_MEMORY;
+	header->size = size;
+
+	for (bank = 0; bank < 4; bank++) {
+		for (addr = 0; addr < VPC_MEM_SIZE; addr++) {
+			unsigned int val = bank | (addr << 4);
+
+			kgsl_regwrite(device, A3XX_VPC_VPC_DEBUG_RAM_SEL, val);
+			kgsl_regread(device, A3XX_VPC_VPC_DEBUG_RAM_READ,
+				&data[i++]);
+		}
+	}
+
+	return DEBUG_SECTION_SZ(size);
+}
+
+static size_t a3xx_snapshot_cp_pm4_ram(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_PM4);
+	size_t size = fw->size - 1;
+
+	if (remain < DEBUG_SECTION_SZ(size)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP PM4 RAM DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_PM4_RAM;
+	header->size = size;
+
+	/*
+	 * Read the firmware from the GPU rather than use our cache in order to
+	 * try to catch mis-programming or corruption in the hardware.  We do
+	 * use the cached version of the size, however, instead of trying to
+	 * maintain always changing hardcoded constants
+	 */
+	kgsl_regmap_read_indexed(&device->regmap, A3XX_CP_ME_RAM_RADDR,
+		A3XX_CP_ME_RAM_DATA, data, size);
+
+	return DEBUG_SECTION_SZ(size);
+}
+
+static size_t a3xx_snapshot_cp_pfp_ram(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_PFP);
+	int size = fw->size - 1;
+
+	if (remain < DEBUG_SECTION_SZ(size)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP PFP RAM DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_PFP_RAM;
+	header->size = size;
+
+	/*
+	 * Read the firmware from the GPU rather than use our cache in order to
+	 * try to catch mis-programming or corruption in the hardware.  We do
+	 * use the cached version of the size, however, instead of trying to
+	 * maintain always changing hardcoded constants
+	 */
+	kgsl_regmap_read_indexed(&device->regmap, A3XX_CP_PFP_UCODE_ADDR,
+		A3XX_CP_PFP_UCODE_DATA, data, size);
+
+	return DEBUG_SECTION_SZ(size);
+}
+
+static size_t a3xx_snapshot_cp_roq(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *) buf;
+	u32 *data = (u32 *) (buf + sizeof(*header));
+
+	if (remain < DEBUG_SECTION_SZ(128)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP ROQ DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_ROQ;
+	header->size = 128;
+
+	kgsl_regmap_read_indexed(&device->regmap, A3XX_CP_ROQ_ADDR,
+		A3XX_CP_ROQ_DATA, data, 128);
+
+	return DEBUG_SECTION_SZ(128);
+}
+
+static size_t a3xx_snapshot_cp_meq(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *) buf;
+	u32 *data = (u32 *) (buf + sizeof(*header));
+
+	if (remain < DEBUG_SECTION_SZ(16)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP MEQ DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_MEQ;
+	header->size = 16;
+
+	kgsl_regmap_read_indexed(&device->regmap, A3XX_CP_MEQ_ADDR,
+		A3XX_CP_MEQ_DATA, data, 16);
+
+	return DEBUG_SECTION_SZ(16);
+}
+
+/*
+ * a3xx_snapshot() - A3XX GPU snapshot function
+ * @adreno_dev: Device being snapshotted
+ * @snapshot: Snapshot metadata
+ * @remain: Amount of space left in snapshot memory
+ *
+ * This is where all of the A3XX specific bits and pieces are grabbed
+ * into the snapshot memory
+ */
+void a3xx_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int reg;
+
+	/* Disable Clock gating temporarily for the debug bus to work */
+	kgsl_regwrite(device, A3XX_RBBM_CLOCK_CTL, 0x0);
+
+	/* Save some CP information that the generic snapshot uses */
+	kgsl_regread(device, A3XX_CP_IB1_BASE, &reg);
+	snapshot->ib1base = (u64) reg;
+
+	kgsl_regread(device, A3XX_CP_IB2_BASE, &reg);
+	snapshot->ib2base = (u64) reg;
+
+	kgsl_regread(device, A3XX_CP_IB1_BUFSZ, &snapshot->ib1size);
+	kgsl_regread(device, A3XX_CP_IB2_BUFSZ, &snapshot->ib2size);
+
+	SNAPSHOT_REGISTERS(device, snapshot, a3xx_registers);
+
+	_snapshot_hlsq_regs(device, snapshot);
+
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A3XX_CP_STATE_DEBUG_INDEX, A3XX_CP_STATE_DEBUG_DATA, 0, 0x14);
+
+	/* CP_ME indexed registers */
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A3XX_CP_ME_CNTL, A3XX_CP_ME_STATUS, 64, 44);
+
+	/* VPC memory */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a3xx_snapshot_vpc_memory, NULL);
+
+	/* CP MEQ */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG, snapshot,
+		a3xx_snapshot_cp_meq, NULL);
+
+	/* Shader working/shadow memory */
+	 kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a3xx_snapshot_shader_memory, NULL);
+
+
+	/* CP PFP and PM4 */
+
+	/*
+	 * Reading the microcode while the CP is running will
+	 * basically move the CP instruction pointer to
+	 * whatever address we read. Big badaboom ensues. Stop the CP
+	 * (if it isn't already stopped) to ensure that we are safe.
+	 * We do this here and not earlier to avoid corrupting the RBBM
+	 * status and CP registers - by the time we get here we don't
+	 * care about the contents of the CP anymore.
+	 */
+
+	kgsl_regread(device, A3XX_CP_ME_CNTL, &reg);
+	reg |= (1 << 27) | (1 << 28);
+	kgsl_regwrite(device, A3XX_CP_ME_CNTL, reg);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a3xx_snapshot_cp_pfp_ram, NULL);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a3xx_snapshot_cp_pm4_ram, NULL);
+
+	/* CP ROQ */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a3xx_snapshot_cp_roq, NULL);
+
+	a3xx_snapshot_debugbus(device, snapshot);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a5xx.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a5xx.c
@@ -0,0 +1,2508 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk/qcom.h>
+#include <linux/delay.h>
+#include <linux/firmware.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/version.h>
+#if (KERNEL_VERSION(6, 3, 0) <= LINUX_VERSION_CODE)
+#include <linux/firmware/qcom/qcom_scm.h>
+#else
+#include <linux/qcom_scm.h>
+#endif
+#ifdef CONFIG_QCOM_KGSL_UPSTREAM
+#include <linux/firmware/qcom/qcom_scm_addon.h>
+#endif
+#include <linux/slab.h>
+
+#include "adreno.h"
+#include "adreno_a5xx.h"
+#include "adreno_a5xx_packets.h"
+#include "adreno_pm4types.h"
+#include "adreno_trace.h"
+#include "kgsl_trace.h"
+
+static int critical_packet_constructed;
+static unsigned int crit_pkts_dwords;
+
+static void a5xx_irq_storm_worker(struct work_struct *work);
+static int _read_fw2_block_header(struct kgsl_device *device,
+		uint32_t *header, uint32_t remain,
+		uint32_t id, uint32_t major, uint32_t minor);
+static void a5xx_gpmu_reset(struct work_struct *work);
+static int a5xx_gpmu_init(struct adreno_device *adreno_dev);
+
+/**
+ * Number of times to check if the regulator enabled before
+ * giving up and returning failure.
+ */
+#define PWR_RETRY 100
+
+/**
+ * Number of times to check if the GPMU firmware is initialized before
+ * giving up and returning failure.
+ */
+#define GPMU_FW_INIT_RETRY 5000
+
+#define A530_QFPROM_RAW_PTE_ROW0_MSB 0x134
+#define A530_QFPROM_RAW_PTE_ROW2_MSB 0x144
+
+#define A5XX_INT_MASK \
+	((1 << A5XX_INT_RBBM_AHB_ERROR) |		\
+	 (1 << A5XX_INT_RBBM_TRANSFER_TIMEOUT) |		\
+	 (1 << A5XX_INT_RBBM_ME_MS_TIMEOUT) |		\
+	 (1 << A5XX_INT_RBBM_PFP_MS_TIMEOUT) |		\
+	 (1 << A5XX_INT_RBBM_ETS_MS_TIMEOUT) |		\
+	 (1 << A5XX_INT_RBBM_ATB_ASYNC_OVERFLOW) |		\
+	 (1 << A5XX_INT_RBBM_GPC_ERROR) |		\
+	 (1 << A5XX_INT_CP_HW_ERROR) |	\
+	 (1 << A5XX_INT_CP_CACHE_FLUSH_TS) |		\
+	 (1 << A5XX_INT_RBBM_ATB_BUS_OVERFLOW) |	\
+	 (1 << A5XX_INT_MISC_HANG_DETECT) |		\
+	 (1 << A5XX_INT_UCHE_OOB_ACCESS) |		\
+	 (1 << A5XX_INT_UCHE_TRAP_INTR) |		\
+	 (1 << A5XX_INT_CP_SW) |			\
+	 (1 << A5XX_INT_GPMU_FIRMWARE) |                \
+	 (1 << A5XX_INT_GPMU_VOLTAGE_DROOP))
+
+static int a5xx_probe(struct platform_device *pdev,
+	u32 chipid, const struct adreno_gpu_core *gpucore)
+{
+	struct adreno_device *adreno_dev;
+	struct kgsl_device *device;
+	int ret;
+
+	adreno_dev = (struct adreno_device *)
+		of_device_get_match_data(&pdev->dev);
+
+	memset(adreno_dev, 0, sizeof(*adreno_dev));
+
+	adreno_dev->gpucore = gpucore;
+	adreno_dev->chipid = chipid;
+
+	adreno_reg_offset_init(gpucore->gpudev->reg_offsets);
+
+	adreno_dev->sptp_pc_enabled =
+		ADRENO_FEATURE(adreno_dev, ADRENO_SPTP_PC);
+
+	if (adreno_is_a540(adreno_dev))
+		adreno_dev->throttling_enabled = true;
+
+	adreno_dev->hwcg_enabled = true;
+	adreno_dev->lm_enabled =
+		ADRENO_FEATURE(adreno_dev, ADRENO_LM);
+
+	/* Setup defaults that might get changed by the fuse bits */
+	adreno_dev->lm_leakage = 0x4e001a;
+
+	device = KGSL_DEVICE(adreno_dev);
+
+	timer_setup(&device->idle_timer, kgsl_timer, 0);
+
+	INIT_WORK(&device->idle_check_ws, kgsl_idle_check);
+
+	ret = adreno_device_probe(pdev, adreno_dev);
+	if (ret)
+		return ret;
+
+	a5xx_coresight_init(adreno_dev);
+
+	return adreno_dispatcher_init(adreno_dev);
+}
+
+static void _do_fixup(const struct adreno_critical_fixup *fixups, int count,
+		uint64_t *gpuaddrs, unsigned int *buffer)
+{
+	int i;
+
+	for (i = 0; i < count; i++) {
+		buffer[fixups[i].lo_offset] =
+			lower_32_bits(gpuaddrs[fixups[i].buffer]) |
+			fixups[i].mem_offset;
+
+		buffer[fixups[i].hi_offset] =
+			upper_32_bits(gpuaddrs[fixups[i].buffer]);
+	}
+}
+
+static int a5xx_critical_packet_construct(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int *cmds;
+	uint64_t gpuaddrs[4];
+
+	adreno_dev->critpkts = kgsl_allocate_global(device,
+		PAGE_SIZE * 4, 0, 0, 0, "crit_pkts");
+	if (IS_ERR(adreno_dev->critpkts))
+		return PTR_ERR(adreno_dev->critpkts);
+
+	adreno_dev->critpkts_secure = kgsl_allocate_global(device,
+		PAGE_SIZE, 0, KGSL_MEMFLAGS_SECURE, 0, "crit_pkts_secure");
+	if (IS_ERR(adreno_dev->critpkts_secure))
+		return PTR_ERR(adreno_dev->critpkts_secure);
+
+	cmds = adreno_dev->critpkts->hostptr;
+
+	gpuaddrs[0] = adreno_dev->critpkts_secure->gpuaddr;
+	gpuaddrs[1] = adreno_dev->critpkts->gpuaddr + PAGE_SIZE;
+	gpuaddrs[2] = adreno_dev->critpkts->gpuaddr + (PAGE_SIZE * 2);
+	gpuaddrs[3] = adreno_dev->critpkts->gpuaddr + (PAGE_SIZE * 3);
+
+	crit_pkts_dwords = ARRAY_SIZE(_a5xx_critical_pkts);
+
+	memcpy(cmds, _a5xx_critical_pkts, crit_pkts_dwords << 2);
+
+	_do_fixup(critical_pkt_fixups, ARRAY_SIZE(critical_pkt_fixups),
+		gpuaddrs, cmds);
+
+	cmds = adreno_dev->critpkts->hostptr + PAGE_SIZE;
+	memcpy(cmds, _a5xx_critical_pkts_mem01,
+			ARRAY_SIZE(_a5xx_critical_pkts_mem01) << 2);
+
+	cmds = adreno_dev->critpkts->hostptr + (PAGE_SIZE * 2);
+	memcpy(cmds, _a5xx_critical_pkts_mem02,
+			ARRAY_SIZE(_a5xx_critical_pkts_mem02) << 2);
+
+	cmds = adreno_dev->critpkts->hostptr + (PAGE_SIZE * 3);
+	memcpy(cmds, _a5xx_critical_pkts_mem03,
+			ARRAY_SIZE(_a5xx_critical_pkts_mem03) << 2);
+
+	_do_fixup(critical_pkt_mem03_fixups,
+		ARRAY_SIZE(critical_pkt_mem03_fixups), gpuaddrs, cmds);
+
+	critical_packet_constructed = 1;
+
+	return 0;
+}
+
+static int a5xx_microcode_read(struct adreno_device *adreno_dev);
+
+static int a5xx_init(struct adreno_device *adreno_dev)
+{
+	const struct adreno_a5xx_core *a5xx_core = to_a5xx_core(adreno_dev);
+	int ret;
+
+	ret = a5xx_ringbuffer_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a5xx_microcode_read(adreno_dev);
+	if (ret)
+		return ret;
+
+	if (a5xx_has_gpmu(adreno_dev))
+		INIT_WORK(&adreno_dev->gpmu_work, a5xx_gpmu_reset);
+
+	adreno_dev->highest_bank_bit = a5xx_core->highest_bank_bit;
+
+	INIT_WORK(&adreno_dev->irq_storm_work, a5xx_irq_storm_worker);
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_CRITICAL_PACKETS))
+		a5xx_critical_packet_construct(adreno_dev);
+
+	adreno_create_profile_buffer(adreno_dev);
+	a5xx_crashdump_init(adreno_dev);
+
+	return 0;
+}
+
+static const struct {
+	u32 reg;
+	u32 base;
+	u32 count;
+} a5xx_protected_blocks[] = {
+	/* RBBM */
+	{  A5XX_CP_PROTECT_REG_0,     0x004, 2 },
+	{  A5XX_CP_PROTECT_REG_0 + 1, 0x008, 3 },
+	{  A5XX_CP_PROTECT_REG_0 + 2, 0x010, 4 },
+	{  A5XX_CP_PROTECT_REG_0 + 3, 0x020, 5 },
+	{  A5XX_CP_PROTECT_REG_0 + 4, 0x040, 6 },
+	{  A5XX_CP_PROTECT_REG_0 + 5, 0x080, 6 },
+	/* Content protection */
+	{  A5XX_CP_PROTECT_REG_0 + 6, A5XX_RBBM_SECVID_TSB_TRUSTED_BASE_LO, 4 },
+	{  A5XX_CP_PROTECT_REG_0 + 7, A5XX_RBBM_SECVID_TRUST_CNTL, 1 },
+	/* CP */
+	{  A5XX_CP_PROTECT_REG_0 + 8, 0x800, 6 },
+	{  A5XX_CP_PROTECT_REG_0 + 9, 0x840, 3 },
+	{  A5XX_CP_PROTECT_REG_0 + 10, 0x880, 5 },
+	{  A5XX_CP_PROTECT_REG_0 + 11, 0xaa0, 0 },
+	/* RB */
+	{  A5XX_CP_PROTECT_REG_0 + 12, 0xcc0, 0 },
+	{  A5XX_CP_PROTECT_REG_0 + 13, 0xcf0, 1 },
+	/* VPC */
+	{  A5XX_CP_PROTECT_REG_0 + 14, 0xe68, 3 },
+	{  A5XX_CP_PROTECT_REG_0 + 15, 0xe70, 4 },
+	/* UCHE */
+	{  A5XX_CP_PROTECT_REG_0 + 16, 0xe80, 4 },
+	/* A5XX_CP_PROTECT_REG_17 will be used for SMMU */
+	/* A5XX_CP_PROTECT_REG_18 - A5XX_CP_PROTECT_REG_31 are available */
+};
+
+static void _setprotectreg(struct kgsl_device *device, u32 offset,
+		u32 base, u32 count)
+{
+	kgsl_regwrite(device, offset, 0x60000000 | (count << 24) | (base << 2));
+}
+
+static void a5xx_protect_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 reg;
+	int i;
+
+	/* enable access protection to privileged registers */
+	kgsl_regwrite(device, A5XX_CP_PROTECT_CNTL, 0x00000007);
+
+	for (i = 0; i < ARRAY_SIZE(a5xx_protected_blocks); i++) {
+		reg = a5xx_protected_blocks[i].reg;
+
+		_setprotectreg(device, reg, a5xx_protected_blocks[i].base,
+			a5xx_protected_blocks[i].count);
+	}
+
+	/*
+	 * For a530 and a540 the SMMU region is 0x20000 bytes long and 0x10000
+	 * bytes on all other targets. The base offset for both is 0x40000.
+	 * Write it to the next available slot
+	 */
+	if (adreno_is_a530(adreno_dev) || adreno_is_a540(adreno_dev))
+		_setprotectreg(device, reg + 1, 0x40000, ilog2(0x20000));
+	else
+		_setprotectreg(device, reg + 1, 0x40000, ilog2(0x10000));
+}
+
+/*
+ * _poll_gdsc_status() - Poll the GDSC status register
+ * @adreno_dev: The adreno device pointer
+ * @status_reg: Offset of the status register
+ * @status_value: The expected bit value
+ *
+ * Poll the status register till the power-on bit is equal to the
+ * expected value or the max retries are exceeded.
+ */
+static int _poll_gdsc_status(struct adreno_device *adreno_dev,
+				unsigned int status_reg,
+				unsigned int status_value)
+{
+	unsigned int reg, retry = PWR_RETRY;
+
+	/* Bit 20 is the power on bit of SPTP and RAC GDSC status register */
+	do {
+		udelay(1);
+		kgsl_regread(KGSL_DEVICE(adreno_dev), status_reg, &reg);
+	} while (((reg & BIT(20)) != (status_value << 20)) && retry--);
+	if ((reg & BIT(20)) != (status_value << 20))
+		return -ETIMEDOUT;
+	return 0;
+}
+
+static void a5xx_restore_isense_regs(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int reg, i, ramp = GPMU_ISENSE_SAVE;
+	static unsigned int isense_regs[6] = {0xFFFF}, isense_reg_addr[] = {
+		A5XX_GPU_CS_DECIMAL_ALIGN,
+		A5XX_GPU_CS_SENSOR_PARAM_CORE_1,
+		A5XX_GPU_CS_SENSOR_PARAM_CORE_2,
+		A5XX_GPU_CS_SW_OV_FUSE_EN,
+		A5XX_GPU_CS_ENDPOINT_CALIBRATION_DONE,
+		A5XX_GPMU_TEMP_SENSOR_CONFIG};
+
+	if (!adreno_is_a540(adreno_dev))
+		return;
+
+	/* read signature */
+	kgsl_regread(device, ramp++, &reg);
+
+	if (reg == 0xBABEFACE) {
+		/* store memory locations in buffer */
+		for (i = 0; i < ARRAY_SIZE(isense_regs); i++)
+			kgsl_regread(device, ramp + i, isense_regs + i);
+
+		/* clear signature */
+		kgsl_regwrite(device, GPMU_ISENSE_SAVE, 0x0);
+	}
+
+	/* if we never stored memory locations - do nothing */
+	if (isense_regs[0] == 0xFFFF)
+		return;
+
+	/* restore registers from memory */
+	for (i = 0; i < ARRAY_SIZE(isense_reg_addr); i++)
+		kgsl_regwrite(device, isense_reg_addr[i], isense_regs[i]);
+
+}
+
+/*
+ * a5xx_regulator_enable() - Enable any necessary HW regulators
+ * @adreno_dev: The adreno device pointer
+ *
+ * Some HW blocks may need their regulators explicitly enabled
+ * on a restart.  Clocks must be on during this call.
+ */
+static int a5xx_regulator_enable(struct adreno_device *adreno_dev)
+{
+	unsigned int ret;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (test_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED,
+			&adreno_dev->priv))
+		return 0;
+
+	if (!(adreno_is_a530(adreno_dev) || adreno_is_a540(adreno_dev))) {
+		/* Halt the sp_input_clk at HM level */
+		kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL, 0x00000055);
+		a5xx_hwcg_set(adreno_dev, true);
+		/* Turn on sp_input_clk at HM level */
+		kgsl_regrmw(device, A5XX_RBBM_CLOCK_CNTL, 0xFF, 0);
+
+		set_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED,
+			&adreno_dev->priv);
+		return 0;
+	}
+
+	/*
+	 * Turn on smaller power domain first to reduce voltage droop.
+	 * Set the default register values; set SW_COLLAPSE to 0.
+	 */
+	kgsl_regwrite(device, A5XX_GPMU_RBCCU_POWER_CNTL, 0x778000);
+	/* Insert a delay between RAC and SPTP GDSC to reduce voltage droop */
+	udelay(3);
+	ret = _poll_gdsc_status(adreno_dev, A5XX_GPMU_RBCCU_PWR_CLK_STATUS, 1);
+	if (ret) {
+		dev_err(device->dev, "RBCCU GDSC enable failed\n");
+		return ret;
+	}
+
+	kgsl_regwrite(device, A5XX_GPMU_SP_POWER_CNTL, 0x778000);
+	ret = _poll_gdsc_status(adreno_dev, A5XX_GPMU_SP_PWR_CLK_STATUS, 1);
+	if (ret) {
+		dev_err(device->dev, "SPTP GDSC enable failed\n");
+		return ret;
+	}
+
+	/* Disable SP clock */
+	kgsl_regrmw(device, A5XX_GPMU_GPMU_SP_CLOCK_CONTROL,
+		CNTL_IP_CLK_ENABLE, 0);
+	/* Enable hardware clockgating */
+	a5xx_hwcg_set(adreno_dev, true);
+	/* Enable SP clock */
+	kgsl_regrmw(device, A5XX_GPMU_GPMU_SP_CLOCK_CONTROL,
+		CNTL_IP_CLK_ENABLE, 1);
+
+	a5xx_restore_isense_regs(adreno_dev);
+
+	set_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED, &adreno_dev->priv);
+	return 0;
+}
+
+/*
+ * a5xx_regulator_disable() - Disable any necessary HW regulators
+ * @adreno_dev: The adreno device pointer
+ *
+ * Some HW blocks may need their regulators explicitly disabled
+ * on a power down to prevent current spikes.  Clocks must be on
+ * during this call.
+ */
+static void a5xx_regulator_disable(struct adreno_device *adreno_dev)
+{
+	unsigned int reg;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (adreno_is_a512(adreno_dev) || adreno_is_a508(adreno_dev))
+		return;
+
+	if (!test_and_clear_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED,
+		&adreno_dev->priv))
+		return;
+
+	/* If feature is not supported or not enabled */
+	if (!adreno_dev->sptp_pc_enabled) {
+		/* Set the default register values; set SW_COLLAPSE to 1 */
+		kgsl_regwrite(device, A5XX_GPMU_SP_POWER_CNTL, 0x778001);
+		/*
+		 * Insert a delay between SPTP and RAC GDSC to reduce voltage
+		 * droop.
+		 */
+		udelay(3);
+		if (_poll_gdsc_status(adreno_dev,
+					A5XX_GPMU_SP_PWR_CLK_STATUS, 0))
+			dev_warn(device->dev, "SPTP GDSC disable failed\n");
+
+		kgsl_regwrite(device, A5XX_GPMU_RBCCU_POWER_CNTL, 0x778001);
+		if (_poll_gdsc_status(adreno_dev,
+					A5XX_GPMU_RBCCU_PWR_CLK_STATUS, 0))
+			dev_warn(device->dev, "RBCCU GDSC disable failed\n");
+	} else if (test_bit(ADRENO_DEVICE_GPMU_INITIALIZED,
+			&adreno_dev->priv)) {
+		/* GPMU firmware is supposed to turn off SPTP & RAC GDSCs. */
+		kgsl_regread(device, A5XX_GPMU_SP_PWR_CLK_STATUS, &reg);
+		if (reg & BIT(20))
+			dev_warn(device->dev, "SPTP GDSC is not disabled\n");
+		kgsl_regread(device, A5XX_GPMU_RBCCU_PWR_CLK_STATUS, &reg);
+		if (reg & BIT(20))
+			dev_warn(device->dev, "RBCCU GDSC is not disabled\n");
+		/*
+		 * GPMU firmware is supposed to set GMEM to non-retention.
+		 * Bit 14 is the memory core force on bit.
+		 */
+		kgsl_regread(device, A5XX_GPMU_RBCCU_CLOCK_CNTL, &reg);
+		if (reg & BIT(14))
+			dev_warn(device->dev, "GMEM is forced on\n");
+	}
+
+	if (adreno_is_a530(adreno_dev)) {
+		/* Reset VBIF before PC to avoid popping bogus FIFO entries */
+		kgsl_regwrite(device, A5XX_RBBM_BLOCK_SW_RESET_CMD,
+			0x003C0000);
+		kgsl_regwrite(device, A5XX_RBBM_BLOCK_SW_RESET_CMD, 0);
+	}
+}
+
+/*
+ * a5xx_enable_pc() - Enable the GPMU based power collapse of the SPTP and RAC
+ * blocks
+ * @adreno_dev: The adreno device pointer
+ */
+static void a5xx_enable_pc(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!adreno_dev->sptp_pc_enabled)
+		return;
+
+	kgsl_regwrite(device, A5XX_GPMU_PWR_COL_INTER_FRAME_CTRL, 0x0000007F);
+	kgsl_regwrite(device, A5XX_GPMU_PWR_COL_BINNING_CTRL, 0);
+	kgsl_regwrite(device, A5XX_GPMU_PWR_COL_INTER_FRAME_HYST, 0x000A0080);
+	kgsl_regwrite(device, A5XX_GPMU_PWR_COL_STAGGER_DELAY, 0x00600040);
+
+	trace_adreno_sp_tp((unsigned long) __builtin_return_address(0));
+};
+
+/*
+ * The maximum payload of a type4 packet is the max size minus one for the
+ * opcode
+ */
+#define TYPE4_MAX_PAYLOAD (PM4_TYPE4_PKT_SIZE_MAX - 1)
+
+static int _gpmu_create_load_cmds(struct adreno_device *adreno_dev,
+	uint32_t *ucode, uint32_t size)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	uint32_t *start, *cmds;
+	uint32_t offset = 0;
+	uint32_t cmds_size = size;
+
+	/* Add a dword for each PM4 packet */
+	cmds_size += (size / TYPE4_MAX_PAYLOAD) + 1;
+
+	/* Add 4 dwords for the protected mode */
+	cmds_size += 4;
+
+	if (adreno_dev->gpmu_cmds != NULL)
+		return 0;
+
+	adreno_dev->gpmu_cmds = devm_kmalloc(&device->pdev->dev,
+		cmds_size << 2, GFP_KERNEL);
+	if (adreno_dev->gpmu_cmds == NULL)
+		return -ENOMEM;
+
+	cmds = adreno_dev->gpmu_cmds;
+	start = cmds;
+
+	/* Turn CP protection OFF */
+	cmds += cp_protected_mode(adreno_dev, cmds, 0);
+
+	/*
+	 * Prebuild the cmd stream to send to the GPU to load
+	 * the GPMU firmware
+	 */
+	while (size > 0) {
+		int tmp_size = size;
+
+		if (size >= TYPE4_MAX_PAYLOAD)
+			tmp_size = TYPE4_MAX_PAYLOAD;
+
+		*cmds++ = cp_type4_packet(
+				A5XX_GPMU_INST_RAM_BASE + offset,
+				tmp_size);
+
+		memcpy(cmds, &ucode[offset], tmp_size << 2);
+
+		cmds += tmp_size;
+		offset += tmp_size;
+		size -= tmp_size;
+	}
+
+	/* Turn CP protection ON */
+	cmds += cp_protected_mode(adreno_dev, cmds, 1);
+
+	adreno_dev->gpmu_cmds_size = (size_t) (cmds - start);
+
+	return 0;
+}
+
+
+/*
+ * _load_gpmu_firmware() - Load the ucode into the GPMU RAM
+ * @adreno_dev: Pointer to adreno device
+ */
+static int _load_gpmu_firmware(struct adreno_device *adreno_dev)
+{
+	uint32_t *data;
+	const struct firmware *fw = NULL;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a5xx_core *a5xx_core = to_a5xx_core(adreno_dev);
+	uint32_t *cmds, cmd_size;
+	int ret =  -EINVAL;
+	u32 gmu_major = 1;
+
+	if (!a5xx_has_gpmu(adreno_dev))
+		return 0;
+
+	/* a530 used GMU major 1 and A540 used GMU major 3 */
+	if (adreno_is_a540(adreno_dev))
+		gmu_major = 3;
+
+	/* gpmu fw already saved and verified so do nothing new */
+	if (adreno_dev->gpmu_cmds_size != 0)
+		return 0;
+
+	if (a5xx_core->gpmufw_name == NULL)
+		return 0;
+
+	ret = request_firmware(&fw, a5xx_core->gpmufw_name, &device->pdev->dev);
+	if (ret || fw == NULL) {
+		dev_err(&device->pdev->dev,
+			"request_firmware (%s) failed: %d\n",
+			a5xx_core->gpmufw_name, ret);
+		return ret;
+	}
+
+	data = (uint32_t *)fw->data;
+
+	if (data[0] >= (fw->size / sizeof(uint32_t)) || data[0] < 2)
+		goto err;
+
+	if (data[1] != GPMU_FIRMWARE_ID)
+		goto err;
+	ret = _read_fw2_block_header(device, &data[2],
+		data[0] - 2, GPMU_FIRMWARE_ID, gmu_major, 0);
+	if (ret)
+		goto err;
+
+	/* Integer overflow check for cmd_size */
+	if (data[2] > (data[0] - 2))
+		goto err;
+
+	cmds = data + data[2] + 3;
+	cmd_size = data[0] - data[2] - 2;
+
+	if (cmd_size > GPMU_INST_RAM_SIZE) {
+		dev_err(device->dev,
+			"GPMU firmware block size is larger than RAM size\n");
+		goto err;
+	}
+
+	/* Everything is cool, so create some commands */
+	ret = _gpmu_create_load_cmds(adreno_dev, cmds, cmd_size);
+err:
+	if (fw)
+		release_firmware(fw);
+
+	return ret;
+}
+
+static void a5xx_spin_idle_debug(struct adreno_device *adreno_dev,
+				const char *str)
+{
+	struct kgsl_device *device = &adreno_dev->dev;
+	unsigned int rptr, wptr;
+	unsigned int status, status3, intstatus;
+	unsigned int hwfault;
+
+	dev_err(device->dev, str);
+
+	kgsl_regread(device, A5XX_CP_RB_RPTR, &rptr);
+	kgsl_regread(device, A5XX_CP_RB_WPTR, &wptr);
+
+	kgsl_regread(device, A5XX_RBBM_STATUS, &status);
+	kgsl_regread(device, A5XX_RBBM_STATUS3, &status3);
+	kgsl_regread(device, A5XX_RBBM_INT_0_STATUS, &intstatus);
+	kgsl_regread(device, A5XX_CP_HW_FAULT, &hwfault);
+
+
+	dev_err(device->dev,
+		"rb=%d pos=%X/%X rbbm_status=%8.8X/%8.8X int_0_status=%8.8X\n",
+		adreno_dev->cur_rb->id, rptr, wptr, status, status3, intstatus);
+
+	dev_err(device->dev, " hwfault=%8.8X\n", hwfault);
+
+	kgsl_device_snapshot(device, NULL, NULL, false);
+}
+
+static int _gpmu_send_init_cmds(struct adreno_device *adreno_dev)
+{
+	struct adreno_ringbuffer *rb = adreno_dev->cur_rb;
+	uint32_t *cmds;
+	uint32_t size = adreno_dev->gpmu_cmds_size;
+	int ret;
+
+	if (size == 0 || adreno_dev->gpmu_cmds == NULL)
+		return -EINVAL;
+
+	cmds = adreno_ringbuffer_allocspace(rb, size);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+	if (cmds == NULL)
+		return -ENOSPC;
+
+	/* Copy to the RB the predefined fw sequence cmds */
+	memcpy(cmds, adreno_dev->gpmu_cmds, size << 2);
+
+	ret = a5xx_ringbuffer_submit(rb, NULL, true);
+	if (!ret) {
+		ret = adreno_spin_idle(adreno_dev, 2000);
+		if (ret)
+			a5xx_spin_idle_debug(adreno_dev,
+				"gpmu initialization failed to idle\n");
+	}
+	return ret;
+}
+
+/*
+ * a5xx_gpmu_start() - Initialize and start the GPMU
+ * @adreno_dev: Pointer to adreno device
+ *
+ * Load the GPMU microcode, set up any features such as hardware clock gating
+ * or IFPC, and take the GPMU out of reset.
+ */
+static int a5xx_gpmu_start(struct adreno_device *adreno_dev)
+{
+	int ret;
+	unsigned int reg, retry = GPMU_FW_INIT_RETRY;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!a5xx_has_gpmu(adreno_dev))
+		return 0;
+
+	ret = _gpmu_send_init_cmds(adreno_dev);
+	if (ret)
+		return ret;
+
+	if (adreno_is_a530(adreno_dev)) {
+		/* GPMU clock gating setup */
+		kgsl_regwrite(device, A5XX_GPMU_WFI_CONFIG, 0x00004014);
+	}
+	/* Kick off GPMU firmware */
+	kgsl_regwrite(device, A5XX_GPMU_CM3_SYSRESET, 0);
+	/*
+	 * The hardware team's estimation of GPMU firmware initialization
+	 * latency is about 3000 cycles, that's about 5 to 24 usec.
+	 */
+	do {
+		udelay(1);
+		kgsl_regread(device, A5XX_GPMU_GENERAL_0, &reg);
+	} while ((reg != 0xBABEFACE) && retry--);
+
+	if (reg != 0xBABEFACE) {
+		dev_err(device->dev,
+			"GPMU firmware initialization timed out\n");
+		return -ETIMEDOUT;
+	}
+
+	if (!adreno_is_a530(adreno_dev)) {
+		kgsl_regread(device, A5XX_GPMU_GENERAL_1, &reg);
+
+		if (reg) {
+			dev_err(device->dev,
+				"GPMU firmware initialization failed: %d\n",
+				reg);
+			return -EIO;
+		}
+	}
+	set_bit(ADRENO_DEVICE_GPMU_INITIALIZED, &adreno_dev->priv);
+	/*
+	 *  We are in AWARE state and IRQ line from GPU to host is
+	 *  disabled.
+	 *  Read pending GPMU interrupts and clear GPMU_RBBM_INTR_INFO.
+	 */
+	kgsl_regread(device, A5XX_GPMU_RBBM_INTR_INFO, &reg);
+	/*
+	 * Clear RBBM interrupt mask if any of GPMU interrupts
+	 * are pending.
+	 */
+	if (reg)
+		kgsl_regwrite(device,
+			A5XX_RBBM_INT_CLEAR_CMD,
+			1 << A5XX_INT_GPMU_FIRMWARE);
+	return ret;
+}
+
+void a5xx_hwcg_set(struct adreno_device *adreno_dev, bool on)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a5xx_core *a5xx_core = to_a5xx_core(adreno_dev);
+	int i;
+
+	if (!adreno_dev->hwcg_enabled)
+		return;
+
+	for (i = 0; i < a5xx_core->hwcg_count; i++)
+		kgsl_regwrite(device, a5xx_core->hwcg[i].offset,
+			on ? a5xx_core->hwcg[i].val : 0);
+
+	/* enable top level HWCG */
+	kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL, on ? 0xAAA8AA00 : 0);
+	kgsl_regwrite(device, A5XX_RBBM_ISDB_CNT, on ? 0x00000182 : 0x00000180);
+}
+
+static int _read_fw2_block_header(struct kgsl_device *device,
+		uint32_t *header, uint32_t remain,
+		uint32_t id, uint32_t major, uint32_t minor)
+{
+	uint32_t header_size;
+	int i = 1;
+
+	if (header == NULL)
+		return -ENOMEM;
+
+	header_size = header[0];
+	/* Headers have limited size and always occur as pairs of words */
+	if (header_size >  MAX_HEADER_SIZE || header_size >= remain ||
+				header_size % 2 || header_size == 0)
+		return -EINVAL;
+	/* Sequences must have an identifying id first thing in their header */
+	if (id == GPMU_SEQUENCE_ID) {
+		if (header[i] != HEADER_SEQUENCE ||
+			(header[i + 1] >= MAX_SEQUENCE_ID))
+			return -EINVAL;
+		i += 2;
+	}
+	for (; i < header_size; i += 2) {
+		switch (header[i]) {
+		/* Major Version */
+		case HEADER_MAJOR:
+			if ((major > header[i + 1]) &&
+				header[i + 1]) {
+				dev_err(device->dev,
+					"GPMU major version mis-match %d, %d\n",
+					major, header[i + 1]);
+				return -EINVAL;
+			}
+			break;
+		case HEADER_MINOR:
+			if (minor > header[i + 1])
+				dev_err(device->dev,
+					"GPMU minor version mis-match %d %d\n",
+					minor, header[i + 1]);
+			break;
+		case HEADER_DATE:
+		case HEADER_TIME:
+			break;
+		default:
+			dev_err(device->dev, "GPMU unknown header ID %d\n",
+					header[i]);
+		}
+	}
+	return 0;
+}
+
+/*
+ * Read in the register sequence file and save pointers to the
+ * necessary sequences.
+ *
+ * GPU sequence file format (one dword per field unless noted):
+ * Block 1 length (length dword field not inclusive)
+ * Block 1 type = Sequence = 3
+ * Block Header length (length dword field not inclusive)
+ * BH field ID = Sequence field ID
+ * BH field data = Sequence ID
+ * BH field ID
+ * BH field data
+ * ...
+ * Opcode 0 ID
+ * Opcode 0 data M words
+ * Opcode 1 ID
+ * Opcode 1 data N words
+ * ...
+ * Opcode X ID
+ * Opcode X data O words
+ * Block 2 length...
+ */
+static void _load_regfile(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a5xx_core *a5xx_core = to_a5xx_core(adreno_dev);
+	const struct firmware *fw;
+	uint64_t block_size = 0, block_total = 0;
+	uint32_t fw_size, *block;
+	int ret = -EINVAL;
+	u32 lm_major = 1;
+
+	if (!a5xx_core->regfw_name)
+		return;
+
+	ret = request_firmware(&fw, a5xx_core->regfw_name, &device->pdev->dev);
+	if (ret) {
+		dev_err(&device->pdev->dev, "request firmware failed %d, %s\n",
+				ret, a5xx_core->regfw_name);
+		return;
+	}
+
+	/* a530v2 lm_major was 3. a530v3 lm_major was 1 */
+	if (adreno_is_a530v2(adreno_dev))
+		lm_major = 3;
+
+	fw_size = fw->size / sizeof(uint32_t);
+	/* Min valid file of size 6, see file description */
+	if (fw_size < 6)
+		goto err;
+	block = (uint32_t *)fw->data;
+	/* All offset numbers calculated from file description */
+	while (block_total < fw_size) {
+		block_size = block[0];
+		if (((block_total + block_size) >= fw_size)
+				|| block_size < 5)
+			goto err;
+		if (block[1] != GPMU_SEQUENCE_ID)
+			goto err;
+
+		/* For now ignore blocks other than the LM sequence */
+		if (block[4] == LM_SEQUENCE_ID) {
+			ret = _read_fw2_block_header(device, &block[2],
+				block_size - 2, GPMU_SEQUENCE_ID,
+				lm_major, 0);
+			if (ret)
+				goto err;
+
+			if (block[2] > (block_size - 2))
+				goto err;
+			adreno_dev->lm_sequence = block + block[2] + 3;
+			adreno_dev->lm_size = block_size - block[2] - 2;
+		}
+		block_total += (block_size + 1);
+		block += (block_size + 1);
+	}
+	if (adreno_dev->lm_sequence)
+		return;
+
+err:
+	release_firmware(fw);
+	dev_err(device->dev,
+		     "Register file failed to load sz=%d bsz=%llu header=%d\n",
+		     fw_size, block_size, ret);
+}
+
+static int _execute_reg_sequence(struct adreno_device *adreno_dev,
+			uint32_t *opcode, uint32_t length)
+{
+	uint32_t *cur = opcode;
+	uint64_t reg, val;
+
+	/* todo double check the reg writes */
+	while ((cur - opcode) < length) {
+		if (cur[0] == 1 && (length - (cur - opcode) >= 4)) {
+			/* Write a 32 bit value to a 64 bit reg */
+			reg = cur[2];
+			reg = (reg << 32) | cur[1];
+			kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, cur[3]);
+			cur += 4;
+		} else if (cur[0] == 2 && (length - (cur - opcode) >= 5)) {
+			/* Write a 64 bit value to a 64 bit reg */
+			reg = cur[2];
+			reg = (reg << 32) | cur[1];
+			val = cur[4];
+			val = (val << 32) | cur[3];
+			kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, val);
+			cur += 5;
+		} else if (cur[0] == 3 && (length - (cur - opcode) >= 2)) {
+			/* Delay for X usec */
+			udelay(cur[1]);
+			cur += 2;
+		} else
+			return -EINVAL;
+	}
+	return 0;
+}
+
+static uint32_t _write_voltage_table(struct adreno_device *adreno_dev,
+			unsigned int addr)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	const struct adreno_a5xx_core *a5xx_core = to_a5xx_core(adreno_dev);
+	int i;
+	struct dev_pm_opp *opp;
+	unsigned int mvolt = 0;
+
+	kgsl_regwrite(device, addr++, a5xx_core->max_power);
+	kgsl_regwrite(device, addr++, pwr->num_pwrlevels);
+
+	/* Write voltage in mV and frequency in MHz */
+	for (i = 0; i < pwr->num_pwrlevels; i++) {
+		opp = dev_pm_opp_find_freq_exact(&device->pdev->dev,
+				pwr->pwrlevels[i].gpu_freq, true);
+		/* _opp_get returns uV, convert to mV */
+		if (!IS_ERR(opp)) {
+			mvolt = dev_pm_opp_get_voltage(opp) / 1000;
+			dev_pm_opp_put(opp);
+		}
+		kgsl_regwrite(device, addr++, mvolt);
+		kgsl_regwrite(device, addr++,
+				pwr->pwrlevels[i].gpu_freq / 1000000);
+	}
+	return (pwr->num_pwrlevels * 2 + 2);
+}
+
+static uint32_t lm_limit(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (adreno_dev->lm_limit)
+		return adreno_dev->lm_limit;
+
+	if (of_property_read_u32(device->pdev->dev.of_node, "qcom,lm-limit",
+		&adreno_dev->lm_limit))
+		adreno_dev->lm_limit = LM_DEFAULT_LIMIT;
+
+	return adreno_dev->lm_limit;
+}
+/*
+ * a5xx_lm_init() - Initialize LM/DPM on the GPMU
+ * @adreno_dev: The adreno device pointer
+ */
+static void a530_lm_init(struct adreno_device *adreno_dev)
+{
+	uint32_t length;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a5xx_core *a5xx_core = to_a5xx_core(adreno_dev);
+
+	if (!adreno_dev->lm_enabled)
+		return;
+
+	/* If something was wrong with the sequence file, return */
+	if (adreno_dev->lm_sequence == NULL)
+		return;
+
+	/* Write LM registers including DPM ucode, coefficients, and config */
+	if (_execute_reg_sequence(adreno_dev, adreno_dev->lm_sequence,
+				adreno_dev->lm_size)) {
+		/* If the sequence is invalid, it's not getting better */
+		adreno_dev->lm_sequence = NULL;
+		dev_warn(device->dev,
+				"Invalid LM sequence\n");
+		return;
+	}
+
+	kgsl_regwrite(device, A5XX_GPMU_TEMP_SENSOR_ID, a5xx_core->gpmu_tsens);
+	kgsl_regwrite(device, A5XX_GPMU_DELTA_TEMP_THRESHOLD, 0x1);
+	kgsl_regwrite(device, A5XX_GPMU_TEMP_SENSOR_CONFIG, 0x1);
+
+	kgsl_regwrite(device, A5XX_GPMU_GPMU_VOLTAGE,
+			(0x80000000 | device->pwrctrl.active_pwrlevel));
+	/* use the leakage to set this value at runtime */
+	kgsl_regwrite(device, A5XX_GPMU_BASE_LEAKAGE,
+		adreno_dev->lm_leakage);
+
+	/* Enable the power threshold and set it to 6000m */
+	kgsl_regwrite(device, A5XX_GPMU_GPMU_PWR_THRESHOLD,
+		0x80000000 | lm_limit(adreno_dev));
+
+	kgsl_regwrite(device, A5XX_GPMU_BEC_ENABLE, 0x10001FFF);
+	kgsl_regwrite(device, A5XX_GDPM_CONFIG1, 0x00201FF1);
+
+	/* Send an initial message to the GPMU with the LM voltage table */
+	kgsl_regwrite(device, AGC_MSG_STATE, 1);
+	kgsl_regwrite(device, AGC_MSG_COMMAND, AGC_POWER_CONFIG_PRODUCTION_ID);
+	length = _write_voltage_table(adreno_dev, AGC_MSG_PAYLOAD);
+	kgsl_regwrite(device, AGC_MSG_PAYLOAD_SIZE, length * sizeof(uint32_t));
+	kgsl_regwrite(device, AGC_INIT_MSG_MAGIC, AGC_INIT_MSG_VALUE);
+}
+
+/*
+ * a5xx_lm_enable() - Enable the LM/DPM feature on the GPMU
+ * @adreno_dev: The adreno device pointer
+ */
+static void a530_lm_enable(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!adreno_dev->lm_enabled)
+		return;
+
+	/* If no sequence properly initialized, return */
+	if (adreno_dev->lm_sequence == NULL)
+		return;
+
+	kgsl_regwrite(device, A5XX_GDPM_INT_MASK, 0x00000000);
+	kgsl_regwrite(device, A5XX_GDPM_INT_EN, 0x0000000A);
+	kgsl_regwrite(device, A5XX_GPMU_GPMU_VOLTAGE_INTR_EN_MASK, 0x00000001);
+	kgsl_regwrite(device, A5XX_GPMU_TEMP_THRESHOLD_INTR_EN_MASK,
+			0x00050000);
+	kgsl_regwrite(device, A5XX_GPMU_THROTTLE_UNMASK_FORCE_CTRL,
+			0x00030000);
+
+	if (adreno_is_a530(adreno_dev))
+		/* Program throttle control, do not enable idle DCS on v3+ */
+		kgsl_regwrite(device, A5XX_GPMU_CLOCK_THROTTLE_CTRL,
+			adreno_is_a530v2(adreno_dev) ? 0x00060011 : 0x00000011);
+}
+
+static void a540_lm_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	uint32_t agc_lm_config = AGC_BCL_DISABLED |
+		((ADRENO_CHIPID_PATCH(adreno_dev->chipid) & 0x3)
+		<< AGC_GPU_VERSION_SHIFT);
+	unsigned int r;
+
+	if (!adreno_dev->throttling_enabled)
+		agc_lm_config |= AGC_THROTTLE_DISABLE;
+
+	if (adreno_dev->lm_enabled) {
+		agc_lm_config |=
+			AGC_LM_CONFIG_ENABLE_GPMU_ADAPTIVE |
+			AGC_LM_CONFIG_ISENSE_ENABLE;
+
+		kgsl_regread(device, A5XX_GPMU_TEMP_SENSOR_CONFIG, &r);
+
+		if ((r & GPMU_ISENSE_STATUS) == GPMU_ISENSE_END_POINT_CAL_ERR) {
+			dev_err(device->dev,
+				"GPMU: ISENSE end point calibration failure\n");
+			agc_lm_config |= AGC_LM_CONFIG_ENABLE_ERROR;
+		}
+	}
+
+	kgsl_regwrite(device, AGC_MSG_STATE, 0x80000001);
+	kgsl_regwrite(device, AGC_MSG_COMMAND, AGC_POWER_CONFIG_PRODUCTION_ID);
+	(void) _write_voltage_table(adreno_dev, AGC_MSG_PAYLOAD);
+	kgsl_regwrite(device, AGC_MSG_PAYLOAD + AGC_LM_CONFIG, agc_lm_config);
+	kgsl_regwrite(device, AGC_MSG_PAYLOAD + AGC_LEVEL_CONFIG,
+		(unsigned int) ~(GENMASK(LM_DCVS_LIMIT, 0) |
+				GENMASK(16+LM_DCVS_LIMIT, 16)));
+
+	kgsl_regwrite(device, AGC_MSG_PAYLOAD_SIZE,
+		(AGC_LEVEL_CONFIG + 1) * sizeof(uint32_t));
+	kgsl_regwrite(device, AGC_INIT_MSG_MAGIC, AGC_INIT_MSG_VALUE);
+
+	kgsl_regwrite(device, A5XX_GPMU_GPMU_VOLTAGE,
+		(0x80000000 | device->pwrctrl.active_pwrlevel));
+
+	kgsl_regwrite(device, A5XX_GPMU_GPMU_PWR_THRESHOLD,
+		PWR_THRESHOLD_VALID | lm_limit(adreno_dev));
+
+	kgsl_regwrite(device, A5XX_GPMU_GPMU_VOLTAGE_INTR_EN_MASK,
+		VOLTAGE_INTR_EN);
+}
+
+
+static void a5xx_lm_enable(struct adreno_device *adreno_dev)
+{
+	if (adreno_is_a530(adreno_dev))
+		a530_lm_enable(adreno_dev);
+}
+
+static void a5xx_lm_init(struct adreno_device *adreno_dev)
+{
+	if (adreno_is_a530(adreno_dev))
+		a530_lm_init(adreno_dev);
+	else if (adreno_is_a540(adreno_dev))
+		a540_lm_init(adreno_dev);
+}
+
+static int gpmu_set_level(struct adreno_device *adreno_dev, unsigned int val)
+{
+	unsigned int reg;
+	int retry = 100;
+
+	kgsl_regwrite(KGSL_DEVICE(adreno_dev), A5XX_GPMU_GPMU_VOLTAGE, val);
+
+	do {
+		kgsl_regread(KGSL_DEVICE(adreno_dev), A5XX_GPMU_GPMU_VOLTAGE,
+			&reg);
+	} while ((reg & 0x80000000) && retry--);
+
+	return (reg & 0x80000000) ? -ETIMEDOUT : 0;
+}
+
+/*
+ * a5xx_pwrlevel_change_settings() - Program the hardware during power level
+ * transitions
+ * @adreno_dev: The adreno device pointer
+ * @prelevel: The previous power level
+ * @postlevel: The new power level
+ * @post: True if called after the clock change has taken effect
+ */
+static void a5xx_pwrlevel_change_settings(struct adreno_device *adreno_dev,
+				unsigned int prelevel, unsigned int postlevel,
+				bool post)
+{
+	/*
+	 * On pre A540 HW only call through if LMx is supported and enabled, and
+	 * always call through for a540
+	 */
+	if (!adreno_is_a540(adreno_dev) && !adreno_dev->lm_enabled)
+		return;
+
+	if (!post) {
+		if (gpmu_set_level(adreno_dev, (0x80000010 | postlevel)))
+			dev_err(KGSL_DEVICE(adreno_dev)->dev,
+				"GPMU pre powerlevel did not stabilize\n");
+	} else {
+		if (gpmu_set_level(adreno_dev, (0x80000000 | postlevel)))
+			dev_err(KGSL_DEVICE(adreno_dev)->dev,
+				"GPMU post powerlevel did not stabilize\n");
+	}
+}
+
+/* FW driven idle 10% throttle */
+#define IDLE_10PCT 0
+/* number of cycles when clock is throttled by 50% (CRC) */
+#define CRC_50PCT  1
+/* number of cycles when clock is throttled by more than 50% (CRC) */
+#define CRC_MORE50PCT 2
+/* number of cycles when clock is throttle by less than 50% (CRC) */
+#define CRC_LESS50PCT 3
+
+static int64_t a5xx_read_throttling_counters(struct adreno_device *adreno_dev)
+{
+	int i;
+	int64_t adj;
+	uint32_t th[ADRENO_GPMU_THROTTLE_COUNTERS];
+	struct adreno_busy_data *busy = &adreno_dev->busy_data;
+
+	if (!adreno_dev->throttling_enabled)
+		return 0;
+
+	for (i = 0; i < ADRENO_GPMU_THROTTLE_COUNTERS; i++) {
+		if (!adreno_dev->gpmu_throttle_counters[i])
+			return 0;
+
+		th[i] = counter_delta(KGSL_DEVICE(adreno_dev),
+				adreno_dev->gpmu_throttle_counters[i],
+				&busy->throttle_cycles[i]);
+	}
+	adj = th[CRC_MORE50PCT] - th[IDLE_10PCT];
+	adj = th[CRC_50PCT] + th[CRC_LESS50PCT] / 3 + (adj < 0 ? 0 : adj) * 3;
+
+	trace_kgsl_clock_throttling(
+		th[IDLE_10PCT], th[CRC_50PCT],
+		th[CRC_MORE50PCT], th[CRC_LESS50PCT],
+		adj);
+	return adj;
+}
+
+/*
+ * a5xx_gpmu_reset() - Re-enable GPMU based power features and restart GPMU
+ * @work: Pointer to the work struct for gpmu reset
+ *
+ * Load the GPMU microcode, set up any features such as hardware clock gating
+ * or IFPC, and take the GPMU out of reset.
+ */
+static void a5xx_gpmu_reset(struct work_struct *work)
+{
+	struct adreno_device *adreno_dev = container_of(work,
+			struct adreno_device, gpmu_work);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (test_bit(ADRENO_DEVICE_GPMU_INITIALIZED, &adreno_dev->priv))
+		return;
+
+	/*
+	 * If GPMU has already experienced a restart or is in the process of it
+	 * after the watchdog timeout, then there is no need to reset GPMU
+	 * again.
+	 */
+	if (device->state != KGSL_STATE_AWARE && device->state != KGSL_STATE_ACTIVE)
+		return;
+
+	mutex_lock(&device->mutex);
+
+	if (a5xx_regulator_enable(adreno_dev))
+		goto out;
+
+	/* Soft reset of the GPMU block */
+	kgsl_regwrite(device, A5XX_RBBM_BLOCK_SW_RESET_CMD, BIT(16));
+
+	/* GPU comes up in secured mode, make it unsecured by default */
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_CONTENT_PROTECTION))
+		kgsl_regwrite(device, A5XX_RBBM_SECVID_TRUST_CNTL, 0x0);
+
+
+	a5xx_gpmu_init(adreno_dev);
+
+out:
+	mutex_unlock(&device->mutex);
+}
+
+static void _setup_throttling_counters(struct adreno_device *adreno_dev)
+{
+	int i, ret = 0;
+
+	if (!adreno_is_a540(adreno_dev))
+		return;
+
+	for (i = 0; i < ADRENO_GPMU_THROTTLE_COUNTERS; i++) {
+		/* reset throttled cycles ivalue */
+		adreno_dev->busy_data.throttle_cycles[i] = 0;
+
+		/* Throttle countables start at off set 43 */
+		ret |= adreno_perfcounter_kernel_get(adreno_dev,
+			KGSL_PERFCOUNTER_GROUP_GPMU_PWR, 43 + i,
+			&adreno_dev->gpmu_throttle_counters[i], NULL);
+	}
+
+	WARN_ONCE(ret, "Unable to get one or more clock throttling registers\n");
+}
+
+/*
+ * a5xx_start() - Device start
+ * @adreno_dev: Pointer to adreno device
+ *
+ * a5xx device start
+ */
+static int a5xx_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a5xx_core *a5xx_core = to_a5xx_core(adreno_dev);
+	unsigned int bit;
+	int ret;
+
+	ret = kgsl_mmu_start(device);
+	if (ret)
+		return ret;
+
+	adreno_get_bus_counters(adreno_dev);
+	adreno_perfcounter_restore(adreno_dev);
+
+	adreno_dev->irq_mask = A5XX_INT_MASK;
+
+	if (adreno_is_a530(adreno_dev) &&
+			ADRENO_FEATURE(adreno_dev, ADRENO_LM))
+		adreno_perfcounter_kernel_get(adreno_dev,
+			KGSL_PERFCOUNTER_GROUP_GPMU_PWR, 27,
+			&adreno_dev->lm_threshold_count, NULL);
+
+	/* Enable 64 bit addressing */
+	kgsl_regwrite(device, A5XX_CP_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_VSC_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_GRAS_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_RB_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_PC_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_HLSQ_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_VFD_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_VPC_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_UCHE_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_SP_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_TPL1_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A5XX_RBBM_SECVID_TSB_ADDR_MODE_CNTL, 0x1);
+
+	_setup_throttling_counters(adreno_dev);
+
+	/* Set up VBIF registers from the GPU core definition */
+	kgsl_regmap_multi_write(&device->regmap, a5xx_core->vbif,
+		a5xx_core->vbif_count);
+
+	/* Make all blocks contribute to the GPU BUSY perf counter */
+	kgsl_regwrite(device, A5XX_RBBM_PERFCTR_GPU_BUSY_MASKED, 0xFFFFFFFF);
+
+	/* Program RBBM counter 0 to report GPU busy for frequency scaling */
+	kgsl_regwrite(device, A5XX_RBBM_PERFCTR_RBBM_SEL_0, 6);
+
+	/*
+	 * Enable the RBBM error reporting bits.  This lets us get
+	 * useful information on failure
+	 */
+	kgsl_regwrite(device, A5XX_RBBM_AHB_CNTL0, 0x00000001);
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_FAULT_DETECT_MASK)) {
+		/*
+		 * We have 4 RB units, and only RB0 activity signals are
+		 * working correctly. Mask out RB1-3 activity signals
+		 * from the HW hang detection logic as per
+		 * recommendation of hardware team.
+		 */
+		kgsl_regwrite(device, A5XX_RBBM_INTERFACE_HANG_MASK_CNTL11,
+				0xF0000000);
+		kgsl_regwrite(device, A5XX_RBBM_INTERFACE_HANG_MASK_CNTL12,
+				0xFFFFFFFF);
+		kgsl_regwrite(device, A5XX_RBBM_INTERFACE_HANG_MASK_CNTL13,
+				0xFFFFFFFF);
+		kgsl_regwrite(device, A5XX_RBBM_INTERFACE_HANG_MASK_CNTL14,
+				0xFFFFFFFF);
+		kgsl_regwrite(device, A5XX_RBBM_INTERFACE_HANG_MASK_CNTL15,
+				0xFFFFFFFF);
+		kgsl_regwrite(device, A5XX_RBBM_INTERFACE_HANG_MASK_CNTL16,
+				0xFFFFFFFF);
+		kgsl_regwrite(device, A5XX_RBBM_INTERFACE_HANG_MASK_CNTL17,
+				0xFFFFFFFF);
+		kgsl_regwrite(device, A5XX_RBBM_INTERFACE_HANG_MASK_CNTL18,
+				0xFFFFFFFF);
+	}
+
+	/*
+	 * Set hang detection threshold to 4 million cycles
+	 * (0x3FFFF*16)
+	 */
+	kgsl_regwrite(device, A5XX_RBBM_INTERFACE_HANG_INT_CNTL,
+				  (1 << 30) | 0x3FFFF);
+
+	/* Turn on performance counters */
+	kgsl_regwrite(device, A5XX_RBBM_PERFCTR_CNTL, 0x01);
+
+	/*
+	 * This is to increase performance by restricting VFD's cache access,
+	 * so that LRZ and other data get evicted less.
+	 */
+	kgsl_regwrite(device, A5XX_UCHE_CACHE_WAYS, 0x02);
+
+	/*
+	 * Set UCHE_WRITE_THRU_BASE to the UCHE_TRAP_BASE effectively
+	 * disabling L2 bypass
+	 */
+	kgsl_regwrite(device, A5XX_UCHE_TRAP_BASE_LO, 0xffff0000);
+	kgsl_regwrite(device, A5XX_UCHE_TRAP_BASE_HI, 0x0001ffff);
+	kgsl_regwrite(device, A5XX_UCHE_WRITE_THRU_BASE_LO, 0xffff0000);
+	kgsl_regwrite(device, A5XX_UCHE_WRITE_THRU_BASE_HI, 0x0001ffff);
+
+	/* Program the GMEM VA range for the UCHE path */
+	kgsl_regwrite(device, A5XX_UCHE_GMEM_RANGE_MIN_LO,
+			adreno_dev->uche_gmem_base);
+	kgsl_regwrite(device, A5XX_UCHE_GMEM_RANGE_MIN_HI, 0x0);
+	kgsl_regwrite(device, A5XX_UCHE_GMEM_RANGE_MAX_LO,
+			adreno_dev->uche_gmem_base +
+			adreno_dev->gpucore->gmem_size - 1);
+	kgsl_regwrite(device, A5XX_UCHE_GMEM_RANGE_MAX_HI, 0x0);
+
+	/*
+	 * Below CP registers are 0x0 by default, program init
+	 * values based on a5xx flavor.
+	 */
+	if (adreno_is_a505_or_a506(adreno_dev) || adreno_is_a508(adreno_dev)) {
+		kgsl_regwrite(device, A5XX_CP_MEQ_THRESHOLDS, 0x20);
+		kgsl_regwrite(device, A5XX_CP_MERCIU_SIZE, 0x400);
+		kgsl_regwrite(device, A5XX_CP_ROQ_THRESHOLDS_2, 0x40000030);
+		kgsl_regwrite(device, A5XX_CP_ROQ_THRESHOLDS_1, 0x20100D0A);
+	} else if (adreno_is_a510(adreno_dev)) {
+		kgsl_regwrite(device, A5XX_CP_MEQ_THRESHOLDS, 0x20);
+		kgsl_regwrite(device, A5XX_CP_MERCIU_SIZE, 0x20);
+		kgsl_regwrite(device, A5XX_CP_ROQ_THRESHOLDS_2, 0x40000030);
+		kgsl_regwrite(device, A5XX_CP_ROQ_THRESHOLDS_1, 0x20100D0A);
+	} else if (adreno_is_a540(adreno_dev) || adreno_is_a512(adreno_dev)) {
+		kgsl_regwrite(device, A5XX_CP_MEQ_THRESHOLDS, 0x40);
+		kgsl_regwrite(device, A5XX_CP_MERCIU_SIZE, 0x400);
+		kgsl_regwrite(device, A5XX_CP_ROQ_THRESHOLDS_2, 0x80000060);
+		kgsl_regwrite(device, A5XX_CP_ROQ_THRESHOLDS_1, 0x40201B16);
+	} else {
+		kgsl_regwrite(device, A5XX_CP_MEQ_THRESHOLDS, 0x40);
+		kgsl_regwrite(device, A5XX_CP_MERCIU_SIZE, 0x40);
+		kgsl_regwrite(device, A5XX_CP_ROQ_THRESHOLDS_2, 0x80000060);
+		kgsl_regwrite(device, A5XX_CP_ROQ_THRESHOLDS_1, 0x40201B16);
+	}
+
+	/*
+	 * vtxFifo and primFifo thresholds default values
+	 * are different.
+	 */
+	if (adreno_is_a505_or_a506(adreno_dev) || adreno_is_a508(adreno_dev))
+		kgsl_regwrite(device, A5XX_PC_DBG_ECO_CNTL,
+						(0x100 << 11 | 0x100 << 22));
+	else if (adreno_is_a510(adreno_dev) || adreno_is_a512(adreno_dev))
+		kgsl_regwrite(device, A5XX_PC_DBG_ECO_CNTL,
+						(0x200 << 11 | 0x200 << 22));
+	else
+		kgsl_regwrite(device, A5XX_PC_DBG_ECO_CNTL,
+						(0x400 << 11 | 0x300 << 22));
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_TWO_PASS_USE_WFI)) {
+		/*
+		 * Set TWOPASSUSEWFI in A5XX_PC_DBG_ECO_CNTL for
+		 * microcodes after v77
+		 */
+		if ((adreno_compare_pfp_version(adreno_dev, 0x5FF077) >= 0))
+			kgsl_regrmw(device, A5XX_PC_DBG_ECO_CNTL, 0, (1 << 8));
+	}
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_DISABLE_RB_DP2CLOCKGATING)) {
+		/*
+		 * Disable RB sampler datapath DP2 clock gating
+		 * optimization for 1-SP GPU's, by default it is enabled.
+		 */
+		kgsl_regrmw(device, A5XX_RB_DBG_ECO_CNT, 0, (1 << 9));
+	}
+	/*
+	 * Disable UCHE global filter as SP can invalidate/flush
+	 * independently
+	 */
+	kgsl_regwrite(device, A5XX_UCHE_MODE_CNTL, BIT(29));
+	/* Set the USE_RETENTION_FLOPS chicken bit */
+	kgsl_regwrite(device, A5XX_CP_CHICKEN_DBG, 0x02000000);
+
+	/* Enable ISDB mode if requested */
+	if (test_bit(ADRENO_DEVICE_ISDB_ENABLED, &adreno_dev->priv)) {
+		if (!adreno_active_count_get(adreno_dev)) {
+			/*
+			 * Disable ME/PFP split timeouts when the debugger is
+			 * enabled because the CP doesn't know when a shader is
+			 * in active debug
+			 */
+			kgsl_regwrite(device, A5XX_RBBM_AHB_CNTL1, 0x06FFFFFF);
+
+			/* Force the SP0/SP1 clocks on to enable ISDB */
+			kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL_SP0, 0x0);
+			kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL_SP1, 0x0);
+			kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL_SP2, 0x0);
+			kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL_SP3, 0x0);
+			kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL2_SP0, 0x0);
+			kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL2_SP1, 0x0);
+			kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL2_SP2, 0x0);
+			kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL2_SP3, 0x0);
+
+			/* disable HWCG */
+			kgsl_regwrite(device, A5XX_RBBM_CLOCK_CNTL, 0x0);
+			kgsl_regwrite(device, A5XX_RBBM_ISDB_CNT, 0x0);
+		} else
+			dev_err(device->dev,
+				"Active count failed while turning on ISDB\n");
+	} else {
+		/* if not in ISDB mode enable ME/PFP split notification */
+		kgsl_regwrite(device, A5XX_RBBM_AHB_CNTL1, 0xA6FFFFFF);
+	}
+
+	kgsl_regwrite(device, A5XX_RBBM_AHB_CNTL2, 0x0000003F);
+	bit = adreno_dev->highest_bank_bit ?
+		(adreno_dev->highest_bank_bit - 13) & 0x03 : 0;
+	/*
+	 * Program the highest DDR bank bit that was passed in
+	 * from the DT in a handful of registers. Some of these
+	 * registers will also be written by the UMD, but we
+	 * want to program them in case we happen to use the
+	 * UCHE before the UMD does
+	 */
+
+	kgsl_regwrite(device, A5XX_TPL1_MODE_CNTL, bit << 7);
+	kgsl_regwrite(device, A5XX_RB_MODE_CNTL, bit << 1);
+	if (adreno_is_a540(adreno_dev) || adreno_is_a512(adreno_dev))
+		kgsl_regwrite(device, A5XX_UCHE_DBG_ECO_CNTL_2, bit);
+
+	/* Disable All flat shading optimization */
+	kgsl_regrmw(device, A5XX_VPC_DBG_ECO_CNTL, 0, 0x1 << 10);
+
+	/*
+	 * VPC corner case with local memory load kill leads to corrupt
+	 * internal state. Normal Disable does not work for all a5x chips.
+	 * So do the following setting to disable it.
+	 */
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_DISABLE_LMLOADKILL)) {
+		kgsl_regrmw(device, A5XX_VPC_DBG_ECO_CNTL, 0, 0x1 << 23);
+		kgsl_regrmw(device, A5XX_HLSQ_DBG_ECO_CNTL, 0x1 << 18, 0);
+	}
+
+	if (device->mmu.secured) {
+		kgsl_regwrite(device, A5XX_RBBM_SECVID_TSB_CNTL, 0x0);
+		kgsl_regwrite(device, A5XX_RBBM_SECVID_TSB_TRUSTED_BASE_LO,
+			lower_32_bits(KGSL_IOMMU_SECURE_BASE32));
+		kgsl_regwrite(device, A5XX_RBBM_SECVID_TSB_TRUSTED_BASE_HI,
+			upper_32_bits(KGSL_IOMMU_SECURE_BASE32));
+		kgsl_regwrite(device, A5XX_RBBM_SECVID_TSB_TRUSTED_SIZE,
+			FIELD_PREP(GENMASK(31, 12),
+			(KGSL_IOMMU_SECURE_SIZE(&device->mmu) / SZ_4K)));
+	}
+
+	a5xx_preemption_start(adreno_dev);
+	a5xx_protect_init(adreno_dev);
+
+	return 0;
+}
+
+/*
+ * Follow the ME_INIT sequence with a preemption yield to allow the GPU to move
+ * to a different ringbuffer, if desired
+ */
+static int _preemption_init(
+			struct adreno_device *adreno_dev,
+			struct adreno_ringbuffer *rb, unsigned int *cmds,
+			struct kgsl_context *context)
+{
+	unsigned int *cmds_orig = cmds;
+	uint64_t gpuaddr = rb->preemption_desc->gpuaddr;
+
+	/* Turn CP protection OFF */
+	cmds += cp_protected_mode(adreno_dev, cmds, 0);
+	/*
+	 * CP during context switch will save context switch info to
+	 * a5xx_cp_preemption_record pointed by CONTEXT_SWITCH_SAVE_ADDR
+	 */
+	*cmds++ = cp_type4_packet(A5XX_CP_CONTEXT_SWITCH_SAVE_ADDR_LO, 1);
+	*cmds++ = lower_32_bits(gpuaddr);
+	*cmds++ = cp_type4_packet(A5XX_CP_CONTEXT_SWITCH_SAVE_ADDR_HI, 1);
+	*cmds++ = upper_32_bits(gpuaddr);
+
+	/* Turn CP protection ON */
+	cmds += cp_protected_mode(adreno_dev, cmds, 1);
+
+	*cmds++ = cp_type7_packet(CP_PREEMPT_ENABLE_GLOBAL, 1);
+	*cmds++ = 0;
+
+	*cmds++ = cp_type7_packet(CP_PREEMPT_ENABLE_LOCAL, 1);
+	*cmds++ = 1;
+
+	/* Enable yield in RB only */
+	*cmds++ = cp_type7_packet(CP_YIELD_ENABLE, 1);
+	*cmds++ = 1;
+
+	*cmds++ = cp_type7_packet(CP_CONTEXT_SWITCH_YIELD, 4);
+	cmds += cp_gpuaddr(adreno_dev, cmds, 0x0);
+	*cmds++ = 0;
+	/* generate interrupt on preemption completion */
+	*cmds++ = 1;
+
+	return cmds - cmds_orig;
+}
+
+static int a5xx_post_start(struct adreno_device *adreno_dev)
+{
+	int ret;
+	unsigned int *cmds, *start;
+	struct adreno_ringbuffer *rb = adreno_dev->cur_rb;
+
+	if (!adreno_is_a530(adreno_dev) &&
+		!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	cmds = adreno_ringbuffer_allocspace(rb, 42);
+	if (IS_ERR(cmds)) {
+		struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+		dev_err(device->dev,
+			     "error allocating preemtion init cmds\n");
+		return PTR_ERR(cmds);
+	}
+	start = cmds;
+
+	/*
+	 * Send a pipeline stat event whenever the GPU gets powered up
+	 * to cause misbehaving perf counters to start ticking
+	 */
+	if (adreno_is_a530(adreno_dev)) {
+		*cmds++ = cp_packet(adreno_dev, CP_EVENT_WRITE, 1);
+		*cmds++ = 0xF;
+	}
+
+	if (adreno_is_preemption_enabled(adreno_dev)) {
+		cmds += _preemption_init(adreno_dev, rb, cmds, NULL);
+		rb->_wptr = rb->_wptr - (42 - (cmds - start));
+		ret = a5xx_ringbuffer_submit(rb, NULL, false);
+	} else {
+		rb->_wptr = rb->_wptr - (42 - (cmds - start));
+		ret = a5xx_ringbuffer_submit(rb, NULL, true);
+	}
+
+	if (!ret) {
+		ret = adreno_spin_idle(adreno_dev, 2000);
+		if (ret)
+			a5xx_spin_idle_debug(adreno_dev,
+				"hw initialization failed to idle\n");
+	}
+
+	return ret;
+}
+
+static int a5xx_gpmu_init(struct adreno_device *adreno_dev)
+{
+	int ret;
+
+	/* Set up LM before initializing the GPMU */
+	a5xx_lm_init(adreno_dev);
+
+	/* Enable SPTP based power collapse before enabling GPMU */
+	a5xx_enable_pc(adreno_dev);
+
+	ret = a5xx_gpmu_start(adreno_dev);
+	if (ret)
+		return ret;
+
+	/* Enable limits management */
+	a5xx_lm_enable(adreno_dev);
+	return 0;
+}
+
+static int a5xx_zap_shader_resume(struct kgsl_device *device)
+{
+	int ret = qcom_scm_set_remote_state(0, 13);
+
+	if (ret)
+		dev_err(device->dev,
+			"SCM zap resume call failed: %d\n", ret);
+
+	return ret;
+}
+
+/*
+ * a5xx_microcode_load() - Load microcode
+ * @adreno_dev: Pointer to adreno device
+ */
+static int a5xx_microcode_load(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_firmware *pm4_fw = ADRENO_FW(adreno_dev, ADRENO_FW_PM4);
+	struct adreno_firmware *pfp_fw = ADRENO_FW(adreno_dev, ADRENO_FW_PFP);
+	const struct adreno_a5xx_core *a5xx_core = to_a5xx_core(adreno_dev);
+	uint64_t gpuaddr;
+
+	gpuaddr = pm4_fw->memdesc->gpuaddr;
+	kgsl_regwrite(device, A5XX_CP_PM4_INSTR_BASE_LO,
+				lower_32_bits(gpuaddr));
+	kgsl_regwrite(device, A5XX_CP_PM4_INSTR_BASE_HI,
+				upper_32_bits(gpuaddr));
+
+	gpuaddr = pfp_fw->memdesc->gpuaddr;
+	kgsl_regwrite(device, A5XX_CP_PFP_INSTR_BASE_LO,
+				lower_32_bits(gpuaddr));
+	kgsl_regwrite(device, A5XX_CP_PFP_INSTR_BASE_HI,
+				upper_32_bits(gpuaddr));
+
+	/*
+	 * Do not invoke to load zap shader if MMU does
+	 * not support secure mode.
+	 */
+	if (!device->mmu.secured)
+		return 0;
+
+	if (adreno_dev->zap_loaded && !(ADRENO_FEATURE(adreno_dev,
+		ADRENO_CPZ_RETENTION)))
+		return a5xx_zap_shader_resume(device);
+
+	return adreno_zap_shader_load(adreno_dev, a5xx_core->zap_name);
+}
+
+static int _me_init_ucode_workarounds(struct adreno_device *adreno_dev)
+{
+	switch (ADRENO_GPUREV(adreno_dev)) {
+	case ADRENO_REV_A510:
+		return 0x00000001; /* Ucode workaround for token end syncs */
+	case ADRENO_REV_A505:
+	case ADRENO_REV_A506:
+	case ADRENO_REV_A530:
+		/*
+		 * Ucode workarounds for token end syncs,
+		 * WFI after every direct-render 3D mode draw and
+		 * WFI after every 2D Mode 3 draw.
+		 */
+		return 0x0000000B;
+	default:
+		return 0x00000000; /* No ucode workarounds enabled */
+	}
+}
+
+/*
+ * CP_INIT_MAX_CONTEXT bit tells if the multiple hardware contexts can
+ * be used at once of if they should be serialized
+ */
+#define CP_INIT_MAX_CONTEXT BIT(0)
+
+/* Enables register protection mode */
+#define CP_INIT_ERROR_DETECTION_CONTROL BIT(1)
+
+/* Header dump information */
+#define CP_INIT_HEADER_DUMP BIT(2) /* Reserved */
+
+/* Default Reset states enabled for PFP and ME */
+#define CP_INIT_DEFAULT_RESET_STATE BIT(3)
+
+/* Drawcall filter range */
+#define CP_INIT_DRAWCALL_FILTER_RANGE BIT(4)
+
+/* Ucode workaround masks */
+#define CP_INIT_UCODE_WORKAROUND_MASK BIT(5)
+
+#define CP_INIT_MASK (CP_INIT_MAX_CONTEXT | \
+		CP_INIT_ERROR_DETECTION_CONTROL | \
+		CP_INIT_HEADER_DUMP | \
+		CP_INIT_DEFAULT_RESET_STATE | \
+		CP_INIT_UCODE_WORKAROUND_MASK)
+
+static int a5xx_critical_packet_submit(struct adreno_device *adreno_dev,
+					struct adreno_ringbuffer *rb)
+{
+	unsigned int *cmds;
+	int ret;
+
+	if (!critical_packet_constructed)
+		return 0;
+
+	cmds = adreno_ringbuffer_allocspace(rb, 4);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	*cmds++ = cp_mem_packet(adreno_dev, CP_INDIRECT_BUFFER_PFE, 2, 1);
+	cmds += cp_gpuaddr(adreno_dev, cmds, adreno_dev->critpkts->gpuaddr);
+	*cmds++ = crit_pkts_dwords;
+
+	ret = a5xx_ringbuffer_submit(rb, NULL, true);
+	if (!ret) {
+		ret = adreno_spin_idle(adreno_dev, 20);
+		if (ret)
+			a5xx_spin_idle_debug(adreno_dev,
+				"Critical packet submission failed to idle\n");
+	}
+
+	return ret;
+}
+
+/*
+ * a5xx_send_me_init() - Initialize ringbuffer
+ * @adreno_dev: Pointer to adreno device
+ * @rb: Pointer to the ringbuffer of device
+ *
+ * Submit commands for ME initialization,
+ */
+static int a5xx_send_me_init(struct adreno_device *adreno_dev,
+			 struct adreno_ringbuffer *rb)
+{
+	unsigned int *cmds;
+	int i = 0, ret;
+
+	cmds = adreno_ringbuffer_allocspace(rb, 9);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	cmds[i++] = cp_type7_packet(CP_ME_INIT, 8);
+
+	/* Enabled ordinal mask */
+	cmds[i++] = CP_INIT_MASK;
+
+	if (CP_INIT_MASK & CP_INIT_MAX_CONTEXT)
+		cmds[i++] = 0x00000003;
+
+	if (CP_INIT_MASK & CP_INIT_ERROR_DETECTION_CONTROL)
+		cmds[i++] = 0x20000000;
+
+	if (CP_INIT_MASK & CP_INIT_HEADER_DUMP) {
+		/* Header dump address */
+		cmds[i++] = 0x00000000;
+		/* Header dump enable and dump size */
+		cmds[i++] = 0x00000000;
+	}
+
+	if (CP_INIT_MASK & CP_INIT_DRAWCALL_FILTER_RANGE) {
+		/* Start range */
+		cmds[i++] = 0x00000000;
+		/* End range (inclusive) */
+		cmds[i++] = 0x00000000;
+	}
+
+	if (CP_INIT_MASK & CP_INIT_UCODE_WORKAROUND_MASK)
+		cmds[i++] = _me_init_ucode_workarounds(adreno_dev);
+
+	ret = a5xx_ringbuffer_submit(rb, NULL, true);
+	if (!ret) {
+		ret = adreno_spin_idle(adreno_dev, 2000);
+		if (ret)
+			a5xx_spin_idle_debug(adreno_dev,
+				"CP initialization failed to idle\n");
+	}
+
+	return ret;
+}
+
+/*
+ * a5xx_rb_start() - Start the ringbuffer
+ * @adreno_dev: Pointer to adreno device
+ */
+static int a5xx_rb_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb;
+	uint64_t addr;
+	unsigned int *cmds;
+	int ret, i;
+
+	/* Clear all the ringbuffers */
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		memset(rb->buffer_desc->hostptr, 0xaa, KGSL_RB_SIZE);
+		kgsl_sharedmem_writel(device->scratch,
+			SCRATCH_RB_OFFSET(rb->id, rptr), 0);
+
+		rb->wptr = 0;
+		rb->_wptr = 0;
+		rb->wptr_preempt_end = ~0;
+	}
+
+	/* Set up the current ringbuffer */
+	rb = ADRENO_CURRENT_RINGBUFFER(adreno_dev);
+	addr = SCRATCH_RB_GPU_ADDR(device, rb->id, rptr);
+
+	kgsl_regwrite(device, A5XX_CP_RB_RPTR_ADDR_LO, lower_32_bits(addr));
+	kgsl_regwrite(device, A5XX_CP_RB_RPTR_ADDR_HI, upper_32_bits(addr));
+
+	/*
+	 * The size of the ringbuffer in the hardware is the log2
+	 * representation of the size in quadwords (sizedwords / 2).
+	 * Also disable the host RPTR shadow register as it might be unreliable
+	 * in certain circumstances.
+	 */
+
+	kgsl_regwrite(device, A5XX_CP_RB_CNTL,
+		A5XX_CP_RB_CNTL_DEFAULT);
+
+	kgsl_regwrite(device, A5XX_CP_RB_BASE,
+		lower_32_bits(rb->buffer_desc->gpuaddr));
+	kgsl_regwrite(device, A5XX_CP_RB_BASE_HI,
+		upper_32_bits(rb->buffer_desc->gpuaddr));
+
+	ret = a5xx_microcode_load(adreno_dev);
+	if (ret)
+		return ret;
+
+	/* clear ME_HALT to start micro engine */
+
+	kgsl_regwrite(device, A5XX_CP_ME_CNTL, 0);
+
+	ret = a5xx_send_me_init(adreno_dev, rb);
+	if (ret)
+		return ret;
+
+	/* Run the critical packets if we need to */
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_CRITICAL_PACKETS)) {
+		ret = a5xx_critical_packet_submit(adreno_dev, rb);
+		if (ret)
+			return ret;
+	}
+
+	/*
+	 * Try to execute the zap shader if it exists, otherwise just try
+	 * directly writing to the control register
+	 */
+	if (!adreno_dev->zap_loaded)
+		kgsl_regwrite(device, A5XX_RBBM_SECVID_TRUST_CNTL, 0);
+	else {
+		cmds = adreno_ringbuffer_allocspace(rb, 2);
+		if (IS_ERR(cmds))
+			return  PTR_ERR(cmds);
+
+		*cmds++ = cp_packet(adreno_dev, CP_SET_SECURE_MODE, 1);
+		*cmds++ = 0;
+
+		ret = a5xx_ringbuffer_submit(rb, NULL, true);
+		if (!ret) {
+			ret = adreno_spin_idle(adreno_dev, 2000);
+			if (ret) {
+				a5xx_spin_idle_debug(adreno_dev,
+					"Switch to unsecure failed to idle\n");
+				return ret;
+			}
+		}
+	}
+
+	ret = a5xx_gpmu_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	a5xx_post_start(adreno_dev);
+
+	return 0;
+}
+
+/*
+ * a5xx_microcode_read() - Read microcode
+ * @adreno_dev: Pointer to adreno device
+ */
+static int a5xx_microcode_read(struct adreno_device *adreno_dev)
+{
+	int ret;
+	struct adreno_firmware *pm4_fw = ADRENO_FW(adreno_dev, ADRENO_FW_PM4);
+	struct adreno_firmware *pfp_fw = ADRENO_FW(adreno_dev, ADRENO_FW_PFP);
+	const struct adreno_a5xx_core *a5xx_core = to_a5xx_core(adreno_dev);
+
+	ret = adreno_get_firmware(adreno_dev, a5xx_core->pm4fw_name, pm4_fw);
+	if (ret)
+		return ret;
+
+	ret = adreno_get_firmware(adreno_dev, a5xx_core->pfpfw_name, pfp_fw);
+	if (ret)
+		return ret;
+
+	ret = _load_gpmu_firmware(adreno_dev);
+	if (ret)
+		return ret;
+
+	_load_regfile(adreno_dev);
+
+	return ret;
+}
+
+/* Register offset defines for A5XX, in order of enum adreno_regs */
+static unsigned int a5xx_register_offsets[ADRENO_REG_REGISTER_MAX] = {
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_BASE, A5XX_CP_RB_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_BASE_HI, A5XX_CP_RB_BASE_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_RPTR_ADDR_LO,
+			A5XX_CP_RB_RPTR_ADDR_LO),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_RPTR_ADDR_HI,
+			A5XX_CP_RB_RPTR_ADDR_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_RPTR, A5XX_CP_RB_RPTR),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_WPTR, A5XX_CP_RB_WPTR),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_ME_CNTL, A5XX_CP_ME_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_CNTL, A5XX_CP_RB_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BASE, A5XX_CP_IB1_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BASE_HI, A5XX_CP_IB1_BASE_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BUFSZ, A5XX_CP_IB1_BUFSZ),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BASE, A5XX_CP_IB2_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BASE_HI, A5XX_CP_IB2_BASE_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BUFSZ, A5XX_CP_IB2_BUFSZ),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_PROTECT_REG_0, A5XX_CP_PROTECT_REG_0),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_PREEMPT, A5XX_CP_CONTEXT_SWITCH_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_PREEMPT_DEBUG, ADRENO_REG_SKIP),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_PREEMPT_DISABLE, ADRENO_REG_SKIP),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_CONTEXT_SWITCH_SMMU_INFO_LO,
+				A5XX_CP_CONTEXT_SWITCH_SMMU_INFO_LO),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_CONTEXT_SWITCH_SMMU_INFO_HI,
+				A5XX_CP_CONTEXT_SWITCH_SMMU_INFO_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_STATUS, A5XX_RBBM_STATUS),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_STATUS3, A5XX_RBBM_STATUS3),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_INT_0_MASK, A5XX_RBBM_INT_0_MASK),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_CLOCK_CTL, A5XX_RBBM_CLOCK_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_SW_RESET_CMD, A5XX_RBBM_SW_RESET_CMD),
+	ADRENO_REG_DEFINE(ADRENO_REG_GPMU_POWER_COUNTER_ENABLE,
+				A5XX_GPMU_POWER_COUNTER_ENABLE),
+};
+
+static void a5xx_cp_hw_err_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status1, status2;
+
+	kgsl_regread(device, A5XX_CP_INTERRUPT_STATUS, &status1);
+
+	if (status1 & BIT(A5XX_CP_OPCODE_ERROR)) {
+		unsigned int val;
+
+		kgsl_regwrite(device, A5XX_CP_PFP_STAT_ADDR, 0);
+
+		/*
+		 * A5XX_CP_PFP_STAT_DATA is indexed, so read it twice to get the
+		 * value we want
+		 */
+		kgsl_regread(device, A5XX_CP_PFP_STAT_DATA, &val);
+		kgsl_regread(device, A5XX_CP_PFP_STAT_DATA, &val);
+
+		dev_crit_ratelimited(device->dev,
+					"ringbuffer opcode error | possible opcode=0x%8.8X\n",
+					val);
+	}
+	if (status1 & BIT(A5XX_CP_RESERVED_BIT_ERROR))
+		dev_crit_ratelimited(device->dev,
+					"ringbuffer reserved bit error interrupt\n");
+	if (status1 & BIT(A5XX_CP_HW_FAULT_ERROR)) {
+		kgsl_regread(device, A5XX_CP_HW_FAULT, &status2);
+		dev_crit_ratelimited(device->dev,
+					"CP | Ringbuffer HW fault | status=%x\n",
+					status2);
+	}
+	if (status1 & BIT(A5XX_CP_DMA_ERROR))
+		dev_crit_ratelimited(device->dev, "CP | DMA error\n");
+	if (status1 & BIT(A5XX_CP_REGISTER_PROTECTION_ERROR)) {
+		kgsl_regread(device, A5XX_CP_PROTECT_STATUS, &status2);
+		dev_crit_ratelimited(device->dev,
+					"CP | Protected mode error| %s | addr=%x | status=%x\n",
+					status2 & (1 << 24) ? "WRITE" : "READ",
+					(status2 & 0xFFFFF) >> 2, status2);
+	}
+	if (status1 & BIT(A5XX_CP_AHB_ERROR)) {
+		kgsl_regread(device, A5XX_CP_AHB_FAULT, &status2);
+		dev_crit_ratelimited(device->dev,
+					"ringbuffer AHB error interrupt | status=%x\n",
+					status2);
+	}
+}
+
+static void a5xx_err_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int reg;
+
+	switch (bit) {
+	case A5XX_INT_RBBM_AHB_ERROR: {
+		kgsl_regread(device, A5XX_RBBM_AHB_ERROR_STATUS, &reg);
+
+		/*
+		 * Return the word address of the erroring register so that it
+		 * matches the register specification
+		 */
+		dev_crit_ratelimited(device->dev,
+					"RBBM | AHB bus error | %s | addr=%x | ports=%x:%x\n",
+					reg & (1 << 28) ? "WRITE" : "READ",
+					(reg & 0xFFFFF) >> 2,
+					(reg >> 20) & 0x3,
+					(reg >> 24) & 0xF);
+
+		/* Clear the error */
+		kgsl_regwrite(device, A5XX_RBBM_AHB_CMD, (1 << 4));
+		break;
+	}
+	case A5XX_INT_RBBM_TRANSFER_TIMEOUT:
+		dev_crit_ratelimited(device->dev,
+					"RBBM: AHB transfer timeout\n");
+		break;
+	case A5XX_INT_RBBM_ME_MS_TIMEOUT:
+		kgsl_regread(device, A5XX_RBBM_AHB_ME_SPLIT_STATUS, &reg);
+		dev_crit_ratelimited(device->dev,
+					"RBBM | ME master split timeout | status=%x\n",
+					reg);
+		break;
+	case A5XX_INT_RBBM_PFP_MS_TIMEOUT:
+		kgsl_regread(device, A5XX_RBBM_AHB_PFP_SPLIT_STATUS, &reg);
+		dev_crit_ratelimited(device->dev,
+					"RBBM | PFP master split timeout | status=%x\n",
+					reg);
+		break;
+	case A5XX_INT_RBBM_ETS_MS_TIMEOUT:
+		dev_crit_ratelimited(device->dev,
+					"RBBM: ME master split timeout\n");
+		break;
+	case A5XX_INT_RBBM_ATB_ASYNC_OVERFLOW:
+		dev_crit_ratelimited(device->dev,
+					"RBBM: ATB ASYNC overflow\n");
+		break;
+	case A5XX_INT_RBBM_ATB_BUS_OVERFLOW:
+		dev_crit_ratelimited(device->dev,
+					"RBBM: ATB bus overflow\n");
+		break;
+	case A5XX_INT_UCHE_OOB_ACCESS:
+		dev_crit_ratelimited(device->dev,
+					"UCHE: Out of bounds access\n");
+		break;
+	case A5XX_INT_UCHE_TRAP_INTR:
+		dev_crit_ratelimited(device->dev, "UCHE: Trap interrupt\n");
+		break;
+	case A5XX_INT_GPMU_VOLTAGE_DROOP:
+		dev_crit_ratelimited(device->dev, "GPMU: Voltage droop\n");
+		break;
+	default:
+		dev_crit_ratelimited(device->dev, "Unknown interrupt %d\n",
+					bit);
+	}
+}
+
+static void a5xx_irq_storm_worker(struct work_struct *work)
+{
+	struct adreno_device *adreno_dev = container_of(work,
+			struct adreno_device, irq_storm_work);
+	struct kgsl_device *device = &adreno_dev->dev;
+	unsigned int status;
+
+	mutex_lock(&device->mutex);
+
+	/* Wait for the storm to clear up */
+	do {
+		kgsl_regwrite(device, A5XX_RBBM_INT_CLEAR_CMD,
+				BIT(A5XX_INT_CP_CACHE_FLUSH_TS));
+		kgsl_regread(device, A5XX_RBBM_INT_0_STATUS, &status);
+	} while (status & BIT(A5XX_INT_CP_CACHE_FLUSH_TS));
+
+	/* Re-enable the interrupt bit in the mask */
+	adreno_dev->irq_mask |= BIT(A5XX_INT_CP_CACHE_FLUSH_TS);
+	kgsl_regwrite(device, A5XX_RBBM_INT_0_MASK, adreno_dev->irq_mask);
+	clear_bit(ADRENO_DEVICE_CACHE_FLUSH_TS_SUSPENDED, &adreno_dev->priv);
+
+	dev_warn(device->dev, "Re-enabled A5XX_INT_CP_CACHE_FLUSH_TS\n");
+	mutex_unlock(&device->mutex);
+
+	/* Reschedule just to make sure everything retires */
+	adreno_dispatcher_schedule(device);
+}
+
+static void a5xx_cp_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = &adreno_dev->dev;
+	unsigned int cur;
+	static unsigned int count;
+	static unsigned int prev;
+
+	if (test_bit(ADRENO_DEVICE_CACHE_FLUSH_TS_SUSPENDED, &adreno_dev->priv))
+		return;
+
+	kgsl_sharedmem_readl(device->memstore, &cur,
+			KGSL_MEMSTORE_OFFSET(KGSL_MEMSTORE_GLOBAL,
+				ref_wait_ts));
+
+	/*
+	 * prev holds a previously read value
+	 * from memory.  It should be changed by the GPU with every
+	 * interrupt. If the value we know about and the value we just
+	 * read are the same, then we are likely in a storm.
+	 * If this happens twice, disable the interrupt in the mask
+	 * so the dispatcher can take care of the issue. It is then
+	 * up to the dispatcher to re-enable the mask once all work
+	 * is done and the storm has ended.
+	 */
+	if (prev == cur) {
+		count++;
+		if (count == 2) {
+			/* disable interrupt from the mask */
+			set_bit(ADRENO_DEVICE_CACHE_FLUSH_TS_SUSPENDED,
+					&adreno_dev->priv);
+
+			adreno_dev->irq_mask &=
+				~BIT(A5XX_INT_CP_CACHE_FLUSH_TS);
+
+			kgsl_regwrite(device, A5XX_RBBM_INT_0_MASK,
+				adreno_dev->irq_mask);
+
+			kgsl_schedule_work(&adreno_dev->irq_storm_work);
+
+			return;
+		}
+	} else {
+		count = 0;
+		prev = cur;
+	}
+
+	a5xx_preemption_trigger(adreno_dev);
+	adreno_dispatcher_schedule(device);
+}
+
+static const char *gpmu_int_msg[32] = {
+	[FW_INTR_INFO] = "FW_INTR_INFO",
+	[LLM_ACK_ERR_INTR] = "LLM_ACK_ERR_INTR",
+	[ISENS_TRIM_ERR_INTR] = "ISENS_TRIM_ERR_INTR",
+	[ISENS_ERR_INTR] = "ISENS_ERR_INTR",
+	[ISENS_IDLE_ERR_INTR] = "ISENS_IDLE_ERR_INTR",
+	[ISENS_PWR_ON_ERR_INTR] = "ISENS_PWR_ON_ERR_INTR",
+	[6 ... 30] = "",
+	[WDOG_EXPITED] = "WDOG_EXPITED"};
+
+static void a5xx_gpmu_int_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int reg, i;
+
+	kgsl_regread(device, A5XX_GPMU_RBBM_INTR_INFO, &reg);
+
+	if (reg & (~VALID_GPMU_IRQ)) {
+		dev_crit_ratelimited(device->dev,
+					"GPMU: Unknown IRQ mask 0x%08lx in 0x%08x\n",
+					reg & (~VALID_GPMU_IRQ), reg);
+	}
+
+	for (i = 0; i < 32; i++)
+		switch (reg & BIT(i)) {
+		case BIT(WDOG_EXPITED):
+			if (test_and_clear_bit(ADRENO_DEVICE_GPMU_INITIALIZED,
+				&adreno_dev->priv)) {
+				/* Stop GPMU */
+				kgsl_regwrite(device,
+					A5XX_GPMU_CM3_SYSRESET, 1);
+				kgsl_schedule_work(&adreno_dev->gpmu_work);
+			}
+			fallthrough;
+		case BIT(FW_INTR_INFO):
+			fallthrough;
+		case BIT(LLM_ACK_ERR_INTR):
+			fallthrough;
+		case BIT(ISENS_TRIM_ERR_INTR):
+			fallthrough;
+		case BIT(ISENS_ERR_INTR):
+			fallthrough;
+		case BIT(ISENS_IDLE_ERR_INTR):
+			fallthrough;
+		case BIT(ISENS_PWR_ON_ERR_INTR):
+			dev_crit_ratelimited(device->dev,
+						"GPMU: interrupt %s(%08lx)\n",
+						gpmu_int_msg[i],
+						BIT(i));
+			break;
+	}
+}
+
+/*
+ * a5x_gpc_err_int_callback() - Isr for GPC error interrupts
+ * @adreno_dev: Pointer to device
+ * @bit: Interrupt bit
+ */
+static void a5x_gpc_err_int_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/*
+	 * GPC error is typically the result of mistake SW programming.
+	 * Force GPU fault for this interrupt so that we can debug it
+	 * with help of register dump.
+	 */
+
+	dev_crit(device->dev, "RBBM: GPC error\n");
+	adreno_irqctrl(adreno_dev, 0);
+
+	/* Trigger a fault in the dispatcher - this will effect a restart */
+	adreno_dispatcher_fault(adreno_dev, ADRENO_SOFT_FAULT);
+	adreno_dispatcher_schedule(device);
+}
+
+u64 a5xx_read_alwayson(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 lo = 0, hi = 0;
+
+	kgsl_regread(device, A5XX_RBBM_ALWAYSON_COUNTER_LO, &lo);
+
+	/* The upper 32 bits are only reliable on A540 targets */
+	if (adreno_is_a540(adreno_dev))
+		kgsl_regread(device, A5XX_RBBM_ALWAYSON_COUNTER_HI, &hi);
+
+	return (((u64) hi) << 32) | lo;
+}
+
+
+static const struct adreno_irq_funcs a5xx_irq_funcs[32] = {
+	ADRENO_IRQ_CALLBACK(NULL),              /* 0 - RBBM_GPU_IDLE */
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback), /* 1 - RBBM_AHB_ERROR */
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback), /* 2 - RBBM_TRANSFER_TIMEOUT */
+	/* 3 - RBBM_ME_MASTER_SPLIT_TIMEOUT  */
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback),
+	/* 4 - RBBM_PFP_MASTER_SPLIT_TIMEOUT */
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback),
+	 /* 5 - RBBM_ETS_MASTER_SPLIT_TIMEOUT */
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback),
+	/* 6 - RBBM_ATB_ASYNC_OVERFLOW */
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback),
+	ADRENO_IRQ_CALLBACK(a5x_gpc_err_int_callback), /* 7 - GPC_ERR */
+	ADRENO_IRQ_CALLBACK(a5xx_preempt_callback),/* 8 - CP_SW */
+	ADRENO_IRQ_CALLBACK(a5xx_cp_hw_err_callback), /* 9 - CP_HW_ERROR */
+	/* 10 - CP_CCU_FLUSH_DEPTH_TS */
+	ADRENO_IRQ_CALLBACK(NULL),
+	 /* 11 - CP_CCU_FLUSH_COLOR_TS */
+	ADRENO_IRQ_CALLBACK(NULL),
+	 /* 12 - CP_CCU_RESOLVE_TS */
+	ADRENO_IRQ_CALLBACK(NULL),
+	ADRENO_IRQ_CALLBACK(NULL), /* 13 - CP_IB2_INT */
+	ADRENO_IRQ_CALLBACK(NULL), /* 14 - CP_IB1_INT */
+	ADRENO_IRQ_CALLBACK(NULL), /* 15 - CP_RB_INT */
+	/* 16 - CCP_UNUSED_1 */
+	ADRENO_IRQ_CALLBACK(NULL),
+	ADRENO_IRQ_CALLBACK(NULL), /* 17 - CP_RB_DONE_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 18 - CP_WT_DONE_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 19 - UNKNOWN_1 */
+	ADRENO_IRQ_CALLBACK(a5xx_cp_callback), /* 20 - CP_CACHE_FLUSH_TS */
+	/* 21 - UNUSED_2 */
+	ADRENO_IRQ_CALLBACK(NULL),
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback), /* 22 - RBBM_ATB_BUS_OVERFLOW */
+	/* 23 - MISC_HANG_DETECT */
+	ADRENO_IRQ_CALLBACK(adreno_hang_int_callback),
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback), /* 24 - UCHE_OOB_ACCESS */
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback), /* 25 - UCHE_TRAP_INTR */
+	ADRENO_IRQ_CALLBACK(NULL), /* 26 - DEBBUS_INTR_0 */
+	ADRENO_IRQ_CALLBACK(NULL), /* 27 - DEBBUS_INTR_1 */
+	ADRENO_IRQ_CALLBACK(a5xx_err_callback), /* 28 - GPMU_VOLTAGE_DROOP */
+	ADRENO_IRQ_CALLBACK(a5xx_gpmu_int_callback), /* 29 - GPMU_FIRMWARE */
+	ADRENO_IRQ_CALLBACK(NULL), /* 30 - ISDB_CPU_IRQ */
+	ADRENO_IRQ_CALLBACK(NULL), /* 31 - ISDB_UNDER_DEBUG */
+};
+
+static irqreturn_t a5xx_irq_handler(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	irqreturn_t ret;
+	u32 status;
+
+	kgsl_regread(device, A5XX_RBBM_INT_0_STATUS, &status);
+
+	/*
+	 * Clear all the interrupt bits except A5XX_INT_RBBM_AHB_ERROR.
+	 * The interrupt will stay asserted until it is cleared by the handler
+	 * so don't touch it yet to avoid a storm
+	 */
+	kgsl_regwrite(device, A5XX_RBBM_INT_CLEAR_CMD,
+		status & ~A5XX_INT_RBBM_AHB_ERROR);
+
+	/* Call the helper function for callbacks */
+	ret = adreno_irq_callbacks(adreno_dev, a5xx_irq_funcs, status);
+
+	trace_kgsl_a5xx_irq_status(adreno_dev, status);
+
+	/* Now chear AHB_ERROR if it was set */
+	if (status & A5XX_INT_RBBM_AHB_ERROR)
+		kgsl_regwrite(device, A5XX_RBBM_INT_CLEAR_CMD,
+			A5XX_INT_RBBM_AHB_ERROR);
+
+	return ret;
+}
+
+static bool a5xx_hw_isidle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 status;
+
+	/*
+	 * Due to CRC idle throttling the GPU idle hysteresis on a540 can take
+	 * up to 5uS to expire
+	 */
+	if (adreno_is_a540(adreno_dev))
+		udelay(5);
+
+	kgsl_regread(device, A5XX_RBBM_STATUS, &status);
+
+	if (status & 0xfffffffe)
+		return false;
+
+	kgsl_regread(device, A5XX_RBBM_INT_0_STATUS, &status);
+
+	/* Return busy if a interrupt is pending */
+	return !((status & adreno_dev->irq_mask) ||
+		atomic_read(&adreno_dev->pending_irq_refcnt));
+}
+
+static int a5xx_clear_pending_transactions(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 mask = A5XX_VBIF_XIN_HALT_CTRL0_MASK;
+	int ret;
+
+	kgsl_regwrite(device, A5XX_VBIF_XIN_HALT_CTRL0, mask);
+	ret = adreno_wait_for_halt_ack(device, A5XX_VBIF_XIN_HALT_CTRL1, mask);
+	kgsl_regwrite(device, A5XX_VBIF_XIN_HALT_CTRL0, 0);
+
+	return ret;
+}
+
+static bool a5xx_is_hw_collapsible(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int reg;
+
+	if (!adreno_isidle(adreno_dev))
+		return false;
+
+	/* If feature is not supported or enabled, no worry */
+	if (!adreno_dev->sptp_pc_enabled)
+		return true;
+	kgsl_regread(device, A5XX_GPMU_SP_PWR_CLK_STATUS, &reg);
+	if (reg & BIT(20))
+		return false;
+	kgsl_regread(device, A5XX_GPMU_RBCCU_PWR_CLK_STATUS, &reg);
+	return !(reg & BIT(20));
+}
+
+static void a5xx_remove(struct adreno_device *adreno_dev)
+{
+	if (adreno_preemption_feature_set(adreno_dev))
+		del_timer(&adreno_dev->preempt.timer);
+}
+
+static void a5xx_power_stats(struct adreno_device *adreno_dev,
+		struct kgsl_power_stats *stats)
+{
+	static u32 rbbm0_hi;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	s64 freq = kgsl_pwrctrl_active_freq(&device->pwrctrl) / 1000000;
+	struct adreno_busy_data *busy = &adreno_dev->busy_data;
+	s64 gpu_busy = 0;
+	u32 lo, hi;
+	s64 adj;
+
+	/* Sometimes this counter can go backwards, so try to detect that */
+	kgsl_regread(device, A5XX_RBBM_PERFCTR_RBBM_0_LO, &lo);
+	kgsl_regread(device, A5XX_RBBM_PERFCTR_RBBM_0_HI, &hi);
+
+	if (busy->gpu_busy) {
+		if (lo < busy->gpu_busy) {
+			if (hi == rbbm0_hi) {
+				dev_warn_once(device->dev,
+					"abmormal value from RBBM_0 perfcounter: %x %x\n",
+					lo, busy->gpu_busy);
+				gpu_busy = 0;
+			} else {
+				gpu_busy = (UINT_MAX - busy->gpu_busy) + lo;
+				rbbm0_hi = hi;
+			}
+		} else
+			gpu_busy = lo - busy->gpu_busy;
+	} else {
+		gpu_busy = 0;
+		rbbm0_hi = 0;
+	}
+
+	busy->gpu_busy = lo;
+
+	adj = a5xx_read_throttling_counters(adreno_dev);
+	if (-adj <= gpu_busy)
+		gpu_busy += adj;
+	else
+		gpu_busy = 0;
+
+	stats->busy_time = gpu_busy / freq;
+
+	if (adreno_is_a530(adreno_dev) && adreno_dev->lm_threshold_count)
+		kgsl_regread(device, adreno_dev->lm_threshold_count,
+			&adreno_dev->lm_threshold_cross);
+	else if (adreno_is_a540(adreno_dev))
+		adreno_dev->lm_threshold_cross = adj;
+
+	if (!device->pwrctrl.bus_control)
+		return;
+
+	stats->ram_time = counter_delta(device, adreno_dev->ram_cycles_lo,
+		&busy->bif_ram_cycles);
+
+	stats->ram_wait = counter_delta(device, adreno_dev->starved_ram_lo,
+		&busy->bif_starved_ram);
+}
+
+static int a5xx_setproperty(struct kgsl_device_private *dev_priv,
+		u32 type, void __user *value, u32 sizebytes)
+{
+	struct kgsl_device *device = dev_priv->device;
+	u32 enable;
+
+	if (type != KGSL_PROP_PWRCTRL)
+		return -ENODEV;
+
+	if (sizebytes != sizeof(enable))
+		return -EINVAL;
+
+	if (copy_from_user(&enable, value, sizeof(enable)))
+		return -EFAULT;
+
+	mutex_lock(&device->mutex);
+
+	if (enable) {
+		device->pwrctrl.ctrl_flags = 0;
+		kgsl_pwrscale_enable(device);
+	} else {
+		kgsl_pwrctrl_change_state(device, KGSL_STATE_ACTIVE);
+		device->pwrctrl.ctrl_flags = KGSL_PWR_ON;
+		kgsl_pwrscale_disable(device, true);
+	}
+
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+const struct adreno_gpudev adreno_a5xx_gpudev = {
+	.reg_offsets = a5xx_register_offsets,
+	.probe = a5xx_probe,
+	.start = a5xx_start,
+	.snapshot = a5xx_snapshot,
+	.init = a5xx_init,
+	.irq_handler = a5xx_irq_handler,
+	.rb_start = a5xx_rb_start,
+	.regulator_enable = a5xx_regulator_enable,
+	.regulator_disable = a5xx_regulator_disable,
+	.pwrlevel_change_settings = a5xx_pwrlevel_change_settings,
+	.preemption_schedule = a5xx_preemption_schedule,
+	.read_alwayson = a5xx_read_alwayson,
+	.hw_isidle = a5xx_hw_isidle,
+	.power_ops = &adreno_power_operations,
+	.clear_pending_transactions = a5xx_clear_pending_transactions,
+	.remove = a5xx_remove,
+	.ringbuffer_submitcmd = a5xx_ringbuffer_submitcmd,
+	.is_hw_collapsible = a5xx_is_hw_collapsible,
+	.power_stats = a5xx_power_stats,
+	.setproperty = a5xx_setproperty,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a5xx.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a5xx.h
@@ -0,0 +1,314 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015-2017,2019-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _ADRENO_A5XX_H_
+#define _ADRENO_A5XX_H_
+
+#include "a5xx_reg.h"
+
+/**
+ * struct adreno_a5xx_core - a5xx specific GPU core definitions
+ */
+struct adreno_a5xx_core {
+	/** @base: Container for the generic &struct adreno_gpu_core */
+	struct adreno_gpu_core base;
+	/** @gpmu_tsens: ID for the temperature sensor used by the GPMU */
+	unsigned int gpmu_tsens;
+	/** @max_power: Max possible power draw of a core */
+	unsigned int max_power;
+	/** pm4fw_name: Name of the PM4 microcode file */
+	const char *pm4fw_name;
+	/** pfpfw_name: Name of the PFP microcode file */
+	const char *pfpfw_name;
+	/** gpmufw_name: Name of the GPMU microcode file */
+	const char *gpmufw_name;
+	/** @regfw_name: Filename for the LM registers if applicable */
+	const char *regfw_name;
+	/** @zap_name: Name of the CPZ zap file */
+	const char *zap_name;
+	/** @hwcg: List of registers and values to write for HWCG */
+	const struct kgsl_regmap_list *hwcg;
+	/** @hwcg_count: Number of registers in @hwcg */
+	u32 hwcg_count;
+	/** @vbif: List of registers and values to write for VBIF */
+	const struct kgsl_regmap_list *vbif;
+	/** @vbif_count: Number of registers in @vbif */
+	u32 vbif_count;
+	/** @highest_bank_bit: The bit of the highest DDR bank */
+	u32 highest_bank_bit;
+};
+
+#define A5XX_CP_CTXRECORD_MAGIC_REF     0x27C4BAFCUL
+/* Size of each CP preemption record */
+#define A5XX_CP_CTXRECORD_SIZE_IN_BYTES     0x10000
+/* Size of the preemption counter block (in bytes) */
+#define A5XX_CP_CTXRECORD_PREEMPTION_COUNTER_SIZE   (16 * 4)
+
+/**
+ * struct a5xx_cp_preemption_record - CP context record for
+ * preemption.
+ * @magic: (00) Value at this offset must be equal to
+ * A5XX_CP_CTXRECORD_MAGIC_REF.
+ * @info: (04) Type of record. Written non-zero (usually) by CP.
+ * we must set to zero for all ringbuffers.
+ * @data: (08) DATA field in SET_RENDER_MODE or checkpoint packets.
+ * Written by CP when switching out. Not used on switch-in.
+ * we must initialize to zero.
+ * @cntl: (12) RB_CNTL, saved and restored by CP.
+ * @rptr: (16) RB_RPTR, saved and restored by CP.
+ * @wptr: (20) RB_WPTR, saved and restored by CP.
+ * @rptr_addr: (24) RB_RPTR_ADDR_LO|HI saved and restored.
+ * rbase: (32) RB_BASE_LO|HI saved and restored.
+ * counter: (40) Pointer to preemption counter
+ */
+struct a5xx_cp_preemption_record {
+	uint32_t  magic;
+	uint32_t  info;
+	uint32_t  data;
+	uint32_t  cntl;
+	uint32_t  rptr;
+	uint32_t  wptr;
+	uint64_t  rptr_addr;
+	uint64_t  rbase;
+	uint64_t  counter;
+};
+
+#define A5XX_CP_SMMU_INFO_MAGIC_REF     0x3618CDA3UL
+
+/**
+ * struct a5xx_cp_smmu_info - CP preemption SMMU info.
+ * @magic: (00) The value at this offset must be equal to
+ * A5XX_CP_SMMU_INFO_MAGIC_REF.
+ * @_pad4: (04) Reserved/padding
+ * @ttbr0: (08) Base address of the page table for the
+ * incoming context.
+ * @context_idr: (16) Context Identification Register value.
+ */
+struct a5xx_cp_smmu_info {
+	uint32_t  magic;
+	uint32_t  _pad4;
+	uint64_t  ttbr0;
+	uint32_t  asid;
+	uint32_t  context_idr;
+};
+
+void a5xx_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot);
+unsigned int a5xx_num_registers(void);
+
+void a5xx_crashdump_init(struct adreno_device *adreno_dev);
+
+void a5xx_hwcg_set(struct adreno_device *adreno_dev, bool on);
+
+#define A5XX_CP_RB_CNTL_DEFAULT ((1 << 27) | ((ilog2(4) << 8) & 0x1F00) | \
+		(ilog2(KGSL_RB_DWORDS >> 1) & 0x3F))
+/* GPMU interrupt multiplexor */
+#define FW_INTR_INFO			(0)
+#define LLM_ACK_ERR_INTR		(1)
+#define ISENS_TRIM_ERR_INTR		(2)
+#define ISENS_ERR_INTR			(3)
+#define ISENS_IDLE_ERR_INTR		(4)
+#define ISENS_PWR_ON_ERR_INTR		(5)
+#define WDOG_EXPITED			(31)
+
+#define VALID_GPMU_IRQ (\
+	BIT(FW_INTR_INFO) | \
+	BIT(LLM_ACK_ERR_INTR) | \
+	BIT(ISENS_TRIM_ERR_INTR) | \
+	BIT(ISENS_ERR_INTR) | \
+	BIT(ISENS_IDLE_ERR_INTR) | \
+	BIT(ISENS_PWR_ON_ERR_INTR) | \
+	BIT(WDOG_EXPITED))
+
+/* A5XX_GPMU_GPMU_LLM_GLM_SLEEP_CTRL */
+#define STATE_OF_CHILD			GENMASK(5, 4)
+#define STATE_OF_CHILD_01		BIT(4)
+#define STATE_OF_CHILD_11		(BIT(4) | BIT(5))
+#define IDLE_FULL_LM_SLEEP		BIT(0)
+
+/* A5XX_GPMU_GPMU_LLM_GLM_SLEEP_STATUS */
+#define WAKEUP_ACK			BIT(1)
+#define IDLE_FULL_ACK			BIT(0)
+
+/* A5XX_GPMU_GPMU_ISENSE_CTRL */
+#define	ISENSE_CGC_EN_DISABLE		BIT(0)
+
+/* A5XX_GPMU_TEMP_SENSOR_CONFIG */
+#define GPMU_BCL_ENABLED		BIT(4)
+#define GPMU_LLM_ENABLED		BIT(9)
+#define GPMU_ISENSE_STATUS		GENMASK(3, 0)
+#define GPMU_ISENSE_END_POINT_CAL_ERR	BIT(0)
+
+#define AMP_CALIBRATION_RETRY_CNT	3
+#define AMP_CALIBRATION_TIMEOUT		6
+
+/* A5XX_GPMU_GPMU_VOLTAGE_INTR_EN_MASK */
+#define VOLTAGE_INTR_EN			BIT(0)
+
+/* A5XX_GPMU_GPMU_PWR_THRESHOLD */
+#define PWR_THRESHOLD_VALID		0x80000000
+
+/* A5XX_GPMU_GPMU_SP_CLOCK_CONTROL */
+#define CNTL_IP_CLK_ENABLE		BIT(0)
+/* AGC */
+#define AGC_INIT_BASE			A5XX_GPMU_DATA_RAM_BASE
+#define AGC_INIT_MSG_MAGIC		(AGC_INIT_BASE + 5)
+#define AGC_MSG_BASE			(AGC_INIT_BASE + 7)
+
+#define AGC_MSG_STATE			(AGC_MSG_BASE + 0)
+#define AGC_MSG_COMMAND			(AGC_MSG_BASE + 1)
+#define AGC_MSG_PAYLOAD_SIZE		(AGC_MSG_BASE + 3)
+#define AGC_MSG_PAYLOAD			(AGC_MSG_BASE + 5)
+
+#define AGC_INIT_MSG_VALUE		0xBABEFACE
+#define AGC_POWER_CONFIG_PRODUCTION_ID	1
+
+#define AGC_LM_CONFIG			(136/4)
+#define AGC_LM_CONFIG_ENABLE_GPMU_ADAPTIVE (1)
+
+#define AGC_LM_CONFIG_ENABLE_ERROR	(3 << 4)
+#define AGC_LM_CONFIG_ISENSE_ENABLE     (1 << 4)
+
+#define AGC_THROTTLE_SEL_DCS		(1 << 8)
+#define AGC_THROTTLE_DISABLE            (2 << 8)
+
+
+#define AGC_LLM_ENABLED			(1 << 16)
+#define	AGC_GPU_VERSION_MASK		GENMASK(18, 17)
+#define AGC_GPU_VERSION_SHIFT		17
+#define AGC_BCL_DISABLED		(1 << 24)
+
+
+#define AGC_LEVEL_CONFIG		(140/4)
+
+#define LM_DCVS_LIMIT			1
+/* FW file tages */
+#define GPMU_FIRMWARE_ID		2
+#define GPMU_SEQUENCE_ID		3
+#define GPMU_INST_RAM_SIZE		0xFFF
+
+#define HEADER_MAJOR			1
+#define HEADER_MINOR			2
+#define HEADER_DATE			3
+#define HEADER_TIME			4
+#define HEADER_SEQUENCE			5
+
+#define MAX_HEADER_SIZE			10
+
+#define LM_SEQUENCE_ID			1
+#define MAX_SEQUENCE_ID			3
+
+#define GPMU_ISENSE_SAVE	(A5XX_GPMU_DATA_RAM_BASE + 200/4)
+/* LM defaults */
+#define LM_DEFAULT_LIMIT		6000
+#define A530_DEFAULT_LEAKAGE		0x004E001A
+
+/**
+ * to_a5xx_core - return the a5xx specific GPU core struct
+ * @adreno_dev: An Adreno GPU device handle
+ *
+ * Returns:
+ * A pointer to the a5xx specific GPU core struct
+ */
+static inline const struct adreno_a5xx_core *
+to_a5xx_core(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gpu_core *core = adreno_dev->gpucore;
+
+	return container_of(core, struct adreno_a5xx_core, base);
+}
+
+/* Preemption functions */
+void a5xx_preemption_trigger(struct adreno_device *adreno_dev);
+void a5xx_preemption_schedule(struct adreno_device *adreno_dev);
+void a5xx_preemption_start(struct adreno_device *adreno_dev);
+int a5xx_preemption_init(struct adreno_device *adreno_dev);
+
+/**
+ * a5xx_preemption_post_ibsubmit - Insert commands following a submission
+ * @adreno_dev: Adreno GPU handle
+ * @cmds: Pointer to the ringbuffer to insert opcodes
+ *
+ * Return: The number of opcodes written to @cmds
+ */
+u32 a5xx_preemption_post_ibsubmit(struct adreno_device *adreno_dev, u32 *cmds);
+
+/**
+ * a5xx_preemption_post_ibsubmit - Insert opcodes before a submission
+ * @adreno_dev: Adreno GPU handle
+ * @rb: The ringbuffer being written
+ * @drawctxt: The draw context being written
+ * @cmds: Pointer to the ringbuffer to insert opcodes
+ *
+ * Return: The number of opcodes written to @cmds
+ */
+u32 a5xx_preemption_pre_ibsubmit(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 *cmds);
+
+void a5xx_preempt_callback(struct adreno_device *adreno_dev, int bit);
+
+u64 a5xx_read_alwayson(struct adreno_device *adreno_dev);
+
+extern const struct adreno_perfcounters adreno_a5xx_perfcounters;
+
+/**
+ * a5xx_ringbuffer_init - Initialize the ringbuffers
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * Initialize the ringbuffer(s) for a5xx.
+ * Return: 0 on success or negative on failure
+ */
+int a5xx_ringbuffer_init(struct adreno_device *adreno_dev);
+
+/**
+* a5xx_ringbuffer_addcmds - Submit a command to the ringbuffer
+* @adreno_dev: An Adreno GPU handle
+* @rb: Pointer to the ringbuffer to submit on
+* @drawctxt: Pointer to the draw context for the submission, or NULL for
+* internal submissions
+* @flags: Flags for the submission
+* @in: Commands to write to the ringbuffer
+* @dwords: Size of @in (in dwords)
+* @timestamp: Timestamp for the submission
+* @time: Optional pointer to a submit time structure
+*
+* Submit a command to the ringbuffer.
+* Return: 0 on success or negative on failure
+*/
+int a5xx_ringbuffer_addcmds(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 flags, u32 *in, u32 dwords, u32 timestamp,
+		struct adreno_submit_time *time);
+
+/**
+ * a5xx_ringbuffer_submitcmd - Submit a user command to the ringbuffer
+ * @adreno_dev: An Adreno GPU handle
+ * @cmdobj: Pointer to a user command object
+ * @flags: Internal submit flags
+ * @time: Optional pointer to a adreno_submit_time container
+ *
+ * Return: 0 on success or negative on failure
+ */
+int a5xx_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj, u32 flags,
+		struct adreno_submit_time *time);
+
+int a5xx_ringbuffer_submit(struct adreno_ringbuffer *rb,
+		struct adreno_submit_time *time, bool sync);
+
+static inline bool a5xx_has_gpmu(struct adreno_device *adreno_dev)
+{
+	return (adreno_is_a530(adreno_dev) || adreno_is_a540(adreno_dev));
+}
+
+#ifdef CONFIG_QCOM_KGSL_CORESIGHT
+void a5xx_coresight_init(struct adreno_device *device);
+#else
+static inline void a5xx_coresight_init(struct adreno_device *device) { }
+#endif
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a5xx_coresight.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a5xx_coresight.c
@@ -0,0 +1,208 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a5xx.h"
+#include "adreno_coresight.h"
+
+static struct adreno_coresight_register a5xx_coresight_registers[] = {
+	{ A5XX_RBBM_CFG_DBGBUS_SEL_A },
+	{ A5XX_RBBM_CFG_DBGBUS_SEL_B },
+	{ A5XX_RBBM_CFG_DBGBUS_SEL_C },
+	{ A5XX_RBBM_CFG_DBGBUS_SEL_D },
+	{ A5XX_RBBM_CFG_DBGBUS_CNTLT },
+	{ A5XX_RBBM_CFG_DBGBUS_CNTLM },
+	{ A5XX_RBBM_CFG_DBGBUS_OPL },
+	{ A5XX_RBBM_CFG_DBGBUS_OPE },
+	{ A5XX_RBBM_CFG_DBGBUS_IVTL_0 },
+	{ A5XX_RBBM_CFG_DBGBUS_IVTL_1 },
+	{ A5XX_RBBM_CFG_DBGBUS_IVTL_2 },
+	{ A5XX_RBBM_CFG_DBGBUS_IVTL_3 },
+	{ A5XX_RBBM_CFG_DBGBUS_MASKL_0 },
+	{ A5XX_RBBM_CFG_DBGBUS_MASKL_1 },
+	{ A5XX_RBBM_CFG_DBGBUS_MASKL_2 },
+	{ A5XX_RBBM_CFG_DBGBUS_MASKL_3 },
+	{ A5XX_RBBM_CFG_DBGBUS_BYTEL_0 },
+	{ A5XX_RBBM_CFG_DBGBUS_BYTEL_1 },
+	{ A5XX_RBBM_CFG_DBGBUS_IVTE_0 },
+	{ A5XX_RBBM_CFG_DBGBUS_IVTE_1 },
+	{ A5XX_RBBM_CFG_DBGBUS_IVTE_2 },
+	{ A5XX_RBBM_CFG_DBGBUS_IVTE_3 },
+	{ A5XX_RBBM_CFG_DBGBUS_MASKE_0 },
+	{ A5XX_RBBM_CFG_DBGBUS_MASKE_1 },
+	{ A5XX_RBBM_CFG_DBGBUS_MASKE_2 },
+	{ A5XX_RBBM_CFG_DBGBUS_MASKE_3 },
+	{ A5XX_RBBM_CFG_DBGBUS_NIBBLEE },
+	{ A5XX_RBBM_CFG_DBGBUS_PTRC0 },
+	{ A5XX_RBBM_CFG_DBGBUS_PTRC1 },
+	{ A5XX_RBBM_CFG_DBGBUS_LOADREG },
+	{ A5XX_RBBM_CFG_DBGBUS_IDX },
+	{ A5XX_RBBM_CFG_DBGBUS_CLRC },
+	{ A5XX_RBBM_CFG_DBGBUS_LOADIVT },
+	{ A5XX_RBBM_CFG_DBGBUS_EVENT_LOGIC },
+	{ A5XX_RBBM_CFG_DBGBUS_OVER },
+	{ A5XX_RBBM_CFG_DBGBUS_COUNT0 },
+	{ A5XX_RBBM_CFG_DBGBUS_COUNT1 },
+	{ A5XX_RBBM_CFG_DBGBUS_COUNT2 },
+	{ A5XX_RBBM_CFG_DBGBUS_COUNT3 },
+	{ A5XX_RBBM_CFG_DBGBUS_COUNT4 },
+	{ A5XX_RBBM_CFG_DBGBUS_COUNT5 },
+	{ A5XX_RBBM_CFG_DBGBUS_TRACE_ADDR },
+	{ A5XX_RBBM_CFG_DBGBUS_TRACE_BUF0 },
+	{ A5XX_RBBM_CFG_DBGBUS_TRACE_BUF1 },
+	{ A5XX_RBBM_CFG_DBGBUS_TRACE_BUF2 },
+	{ A5XX_RBBM_CFG_DBGBUS_TRACE_BUF3 },
+	{ A5XX_RBBM_CFG_DBGBUS_TRACE_BUF4 },
+	{ A5XX_RBBM_CFG_DBGBUS_MISR0 },
+	{ A5XX_RBBM_CFG_DBGBUS_MISR1 },
+	{ A5XX_RBBM_AHB_DBG_CNTL },
+	{ A5XX_RBBM_READ_AHB_THROUGH_DBG },
+	{ A5XX_RBBM_DBG_LO_HI_GPIO },
+	{ A5XX_RBBM_EXT_TRACE_BUS_CNTL },
+	{ A5XX_RBBM_EXT_VBIF_DBG_CNTL },
+};
+
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_a, &a5xx_coresight_registers[0]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_b, &a5xx_coresight_registers[1]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_c, &a5xx_coresight_registers[2]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_d, &a5xx_coresight_registers[3]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_cntlt, &a5xx_coresight_registers[4]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_cntlm, &a5xx_coresight_registers[5]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_opl, &a5xx_coresight_registers[6]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ope, &a5xx_coresight_registers[7]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_0, &a5xx_coresight_registers[8]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_1, &a5xx_coresight_registers[9]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_2, &a5xx_coresight_registers[10]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_3, &a5xx_coresight_registers[11]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_0, &a5xx_coresight_registers[12]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_1, &a5xx_coresight_registers[13]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_2, &a5xx_coresight_registers[14]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_3, &a5xx_coresight_registers[15]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_bytel_0, &a5xx_coresight_registers[16]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_bytel_1, &a5xx_coresight_registers[17]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_0, &a5xx_coresight_registers[18]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_1, &a5xx_coresight_registers[19]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_2, &a5xx_coresight_registers[20]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_3, &a5xx_coresight_registers[21]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_0, &a5xx_coresight_registers[22]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_1, &a5xx_coresight_registers[23]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_2, &a5xx_coresight_registers[24]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_3, &a5xx_coresight_registers[25]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_nibblee, &a5xx_coresight_registers[26]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ptrc0, &a5xx_coresight_registers[27]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ptrc1, &a5xx_coresight_registers[28]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_loadreg, &a5xx_coresight_registers[29]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_idx, &a5xx_coresight_registers[30]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_clrc, &a5xx_coresight_registers[31]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_loadivt, &a5xx_coresight_registers[32]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_event_logic,
+				&a5xx_coresight_registers[33]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_over, &a5xx_coresight_registers[34]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_count0, &a5xx_coresight_registers[35]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_count1, &a5xx_coresight_registers[36]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_count2, &a5xx_coresight_registers[37]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_count3, &a5xx_coresight_registers[38]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_count4, &a5xx_coresight_registers[39]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_count5, &a5xx_coresight_registers[40]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_addr,
+				&a5xx_coresight_registers[41]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_buf0,
+				&a5xx_coresight_registers[42]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_buf1,
+				&a5xx_coresight_registers[43]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_buf2,
+				&a5xx_coresight_registers[44]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_buf3,
+				&a5xx_coresight_registers[45]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_buf4,
+				&a5xx_coresight_registers[46]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_misr0, &a5xx_coresight_registers[47]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_misr1, &a5xx_coresight_registers[48]);
+static ADRENO_CORESIGHT_ATTR(ahb_dbg_cntl, &a5xx_coresight_registers[49]);
+static ADRENO_CORESIGHT_ATTR(read_ahb_through_dbg,
+				&a5xx_coresight_registers[50]);
+static ADRENO_CORESIGHT_ATTR(dbg_lo_hi_gpio, &a5xx_coresight_registers[51]);
+static ADRENO_CORESIGHT_ATTR(ext_trace_bus_cntl, &a5xx_coresight_registers[52]);
+static ADRENO_CORESIGHT_ATTR(ext_vbif_dbg_cntl, &a5xx_coresight_registers[53]);
+
+static struct attribute *a5xx_coresight_attrs[] = {
+	&coresight_attr_cfg_dbgbus_sel_a.attr.attr,
+	&coresight_attr_cfg_dbgbus_sel_b.attr.attr,
+	&coresight_attr_cfg_dbgbus_sel_c.attr.attr,
+	&coresight_attr_cfg_dbgbus_sel_d.attr.attr,
+	&coresight_attr_cfg_dbgbus_cntlt.attr.attr,
+	&coresight_attr_cfg_dbgbus_cntlm.attr.attr,
+	&coresight_attr_cfg_dbgbus_opl.attr.attr,
+	&coresight_attr_cfg_dbgbus_ope.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_bytel_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_bytel_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_nibblee.attr.attr,
+	&coresight_attr_cfg_dbgbus_ptrc0.attr.attr,
+	&coresight_attr_cfg_dbgbus_ptrc1.attr.attr,
+	&coresight_attr_cfg_dbgbus_loadreg.attr.attr,
+	&coresight_attr_cfg_dbgbus_idx.attr.attr,
+	&coresight_attr_cfg_dbgbus_clrc.attr.attr,
+	&coresight_attr_cfg_dbgbus_loadivt.attr.attr,
+	&coresight_attr_cfg_dbgbus_event_logic.attr.attr,
+	&coresight_attr_cfg_dbgbus_over.attr.attr,
+	&coresight_attr_cfg_dbgbus_count0.attr.attr,
+	&coresight_attr_cfg_dbgbus_count1.attr.attr,
+	&coresight_attr_cfg_dbgbus_count2.attr.attr,
+	&coresight_attr_cfg_dbgbus_count3.attr.attr,
+	&coresight_attr_cfg_dbgbus_count4.attr.attr,
+	&coresight_attr_cfg_dbgbus_count5.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_addr.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_buf0.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_buf1.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_buf2.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_buf3.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_buf4.attr.attr,
+	&coresight_attr_cfg_dbgbus_misr0.attr.attr,
+	&coresight_attr_cfg_dbgbus_misr1.attr.attr,
+	&coresight_attr_ahb_dbg_cntl.attr.attr,
+	&coresight_attr_read_ahb_through_dbg.attr.attr,
+	&coresight_attr_dbg_lo_hi_gpio.attr.attr,
+	&coresight_attr_ext_trace_bus_cntl.attr.attr,
+	&coresight_attr_ext_vbif_dbg_cntl.attr.attr,
+	NULL,
+};
+
+static const struct attribute_group a5xx_coresight_group = {
+	.attrs = a5xx_coresight_attrs,
+};
+
+static const struct attribute_group *a5xx_coresight_groups[] = {
+	&a5xx_coresight_group,
+	NULL,
+};
+
+static const struct adreno_coresight a5xx_coresight = {
+	.registers = a5xx_coresight_registers,
+	.count = ARRAY_SIZE(a5xx_coresight_registers),
+	.groups = a5xx_coresight_groups,
+};
+
+void a5xx_coresight_init(struct adreno_device *adreno_dev)
+{
+	adreno_coresight_add_device(adreno_dev, "coresight-gfx",
+		&a5xx_coresight, &adreno_dev->gx_coresight);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a5xx_packets.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a5xx_packets.h
@@ -0,0 +1,1406 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016,2019, The Linux Foundation. All rights reserved.
+ */
+
+struct adreno_critical_fixup {
+	unsigned int lo_offset;
+	unsigned int hi_offset;
+	int buffer;
+	uint64_t mem_offset;
+};
+
+static unsigned int _a5xx_critical_pkts[] = {
+	0x400E0601, /* [0x0000] == TYPE4 == */
+	0x00000002, /* [0x0001] A5X_HLSQ_MODE_CNTL (0x0E06)*/
+	0x40E78A01, /* [0x0002] == TYPE4 == */
+	0x000FFFFF, /* [0x0003] A5X_HLSQ_UPDATE_CNTL_CTX_0 (0xE78A)*/
+	0x48E78401, /* [0x0004] == TYPE4 == */
+	0x00000005, /* [0x0005] A5X_HLSQ_CNTL_0_CTX_0 (0xE784)*/
+	0x40E78501, /* [0x0006] == TYPE4 == */
+	0x00000009, /* [0x0007] A5X_HLSQ_CNTL_1_CTX_0 (0xE785)*/
+	0x48E78B85, /* [0x0008] == TYPE4 == */
+	0x00000001, /* [0x0009] A5X_HLSQ_VS_CONFIG_CTX_0 (0xE78B)*/
+	0x00002085, /* [0x000A] A5X_HLSQ_PS_CONFIG_CTX_0 (0xE78C)*/
+	0x00002084, /* [0x000B] A5X_HLSQ_HS_CONFIG_CTX_0 (0xE78D)*/
+	0x00002084, /* [0x000C] A5X_HLSQ_DS_CONFIG_CTX_0 (0xE78E)*/
+	0x00002084, /* [0x000D] A5X_HLSQ_GS_CONFIG_CTX_0 (0xE78F)*/
+	0x40E58485, /* [0x000E] == TYPE4 == */
+	0x00000001, /* [0x000F] A5X_SP_VS_CONFIG_CTX_0 (0xE584)*/
+	0x00002085, /* [0x0010] A5X_SP_PS_CONFIG_CTX_0 (0xE585)*/
+	0x00002084, /* [0x0011] A5X_SP_HS_CONFIG_CTX_0 (0xE586)*/
+	0x00002084, /* [0x0012] A5X_SP_DS_CONFIG_CTX_0 (0xE587)*/
+	0x00002084, /* [0x0013] A5X_SP_GS_CONFIG_CTX_0 (0xE588)*/
+	0x40E79101, /* [0x0014] == TYPE4 == */
+	0x00000004, /* [0x0015] A5X_HLSQ_VS_CNTL_CTX_0 (0xE791)*/
+	0x40E79201, /* [0x0016] == TYPE4 == */
+	0x00000002, /* [0x0017] A5X_HLSQ_PS_CNTL_CTX_0 (0xE792)*/
+	0x48E58001, /* [0x0018] == TYPE4 == */
+	0x00000010, /* [0x0019] A5X_SP_SP_CNTL_CTX_0 (0xE580)*/
+	0x70B00043, /* [0x001A] == TYPE7: LOAD_STATE (30) == */
+	0x00A00000, /* [0x001B] */
+	0x00000000, /* [0x001C] */
+	0x00000000, /* [0x001D] */
+	0x20020003, /* [0x001E] */
+	0x56D81803, /* [0x001F] */
+	0x00000003, /* [0x0020] */
+	0x20150000, /* [0x0021] */
+	0x00000000, /* [0x0022] */
+	0x00000200, /* [0x0023] */
+	0x00000000, /* [0x0024] */
+	0x201100F4, /* [0x0025] */
+	0x00000000, /* [0x0026] */
+	0x00000500, /* [0x0027] */
+	0x00000C21, /* [0x0028] */
+	0x20154004, /* [0x0029] */
+	0x00000C20, /* [0x002A] */
+	0x20154003, /* [0x002B] */
+	0x00000C23, /* [0x002C] */
+	0x20154008, /* [0x002D] */
+	0x00000C22, /* [0x002E] */
+	0x20156007, /* [0x002F] */
+	0x00000000, /* [0x0030] */
+	0x20554005, /* [0x0031] */
+	0x3F800000, /* [0x0032] */
+	0x20554006, /* [0x0033] */
+	0x00000000, /* [0x0034] */
+	0x03000000, /* [0x0035] */
+	0x20050000, /* [0x0036] */
+	0x46F00009, /* [0x0037] */
+	0x201F0000, /* [0x0038] */
+	0x4398000A, /* [0x0039] */
+	0x201F0009, /* [0x003A] */
+	0x43980809, /* [0x003B] */
+	0x20180009, /* [0x003C] */
+	0x46100809, /* [0x003D] */
+	0x00091014, /* [0x003E] */
+	0x62050009, /* [0x003F] */
+	0x00000000, /* [0x0040] */
+	0x00000500, /* [0x0041] */
+	0x04800006, /* [0x0042] */
+	0xC2C61300, /* [0x0043] */
+	0x0280000E, /* [0x0044] */
+	0xC2C61310, /* [0x0045] */
+	0x00000000, /* [0x0046] */
+	0x04800000, /* [0x0047] */
+	0x00000000, /* [0x0048] */
+	0x05000000, /* [0x0049] */
+	0x00000000, /* [0x004A] */
+	0x00000000, /* [0x004B] */
+	0x00000000, /* [0x004C] */
+	0x00000000, /* [0x004D] */
+	0x00000000, /* [0x004E] */
+	0x00000000, /* [0x004F] */
+	0x00000000, /* [0x0050] */
+	0x00000000, /* [0x0051] */
+	0x00000000, /* [0x0052] */
+	0x00000000, /* [0x0053] */
+	0x00000000, /* [0x0054] */
+	0x00000000, /* [0x0055] */
+	0x00000000, /* [0x0056] */
+	0x00000000, /* [0x0057] */
+	0x00000000, /* [0x0058] */
+	0x00000000, /* [0x0059] */
+	0x00000000, /* [0x005A] */
+	0x00000000, /* [0x005B] */
+	0x00000000, /* [0x005C] */
+	0x00000000, /* [0x005D] */
+	0x70B00023, /* [0x005E] == TYPE7: LOAD_STATE (30) == */
+	0x00700000, /* [0x005F] */
+	0x00000000, /* [0x0060] */
+	0x00000000, /* [0x0061] */
+	0x00000000, /* [0x0062] */
+	0x03000000, /* [0x0063] */
+	0x00000000, /* [0x0064] */
+	0x00000000, /* [0x0065] */
+	0x00000000, /* [0x0066] */
+	0x00000000, /* [0x0067] */
+	0x00000000, /* [0x0068] */
+	0x00000000, /* [0x0069] */
+	0x00000000, /* [0x006A] */
+	0x00000000, /* [0x006B] */
+	0x00000000, /* [0x006C] */
+	0x00000000, /* [0x006D] */
+	0x00000000, /* [0x006E] */
+	0x00000000, /* [0x006F] */
+	0x00000000, /* [0x0070] */
+	0x00000000, /* [0x0071] */
+	0x00000000, /* [0x0072] */
+	0x00000000, /* [0x0073] */
+	0x00000000, /* [0x0074] */
+	0x00000000, /* [0x0075] */
+	0x00000000, /* [0x0076] */
+	0x00000000, /* [0x0077] */
+	0x00000000, /* [0x0078] */
+	0x00000000, /* [0x0079] */
+	0x00000000, /* [0x007A] */
+	0x00000000, /* [0x007B] */
+	0x00000000, /* [0x007C] */
+	0x00000000, /* [0x007D] */
+	0x00000000, /* [0x007E] */
+	0x00000000, /* [0x007F] */
+	0x00000000, /* [0x0080] */
+	0x00000000, /* [0x0081] */
+	0x70B08003, /* [0x0082] == TYPE7: LOAD_STATE (30) == */
+	0x00620000, /* [0x0083] */
+	0x00000000, /* [0x0084] */
+	0x00000000, /* [0x0085] */
+	0x70B08003, /* [0x0086] == TYPE7: LOAD_STATE (30) == */
+	0x01220008, /* [0x0087] */
+	0x00000000, /* [0x0088] */
+	0x00000000, /* [0x0089] */
+	0x70B0000B, /* [0x008A] == TYPE7: LOAD_STATE (30) == */
+	0x01180000, /* [0x008B] */
+	0x00000001, /* [0x008C] */
+	0x00000000, /* [0x008D] */
+	0x00000000, /* [0x008E] */
+	0x00000000, /* [0x008F] */
+	0x00000000, /* [0x0090] */
+	0x00000000, /* [0x0091] */
+	0x00000000, /* [0x0092] */
+	0x00000000, /* [0x0093] */
+	0x00000000, /* [0x0094] */
+	0x01400000, /* [0x0095] */
+	0x70460001, /* [0x0096] == TYPE7: EVENT_WRITE (46) == */
+	0x00000019, /* [0x0097] */
+	0x70460004, /* [0x0098] == TYPE7: EVENT_WRITE (46) == */
+	0x0000001D, /* [0x0099] */
+	0x00000000, /* [0x009A] */
+	0x00000000, /* [0x009B] */
+	0x00000001, /* [0x009C] */
+	0x70460004, /* [0x009D] == TYPE7: EVENT_WRITE (46) == */
+	0x0000001C, /* [0x009E] */
+	0x00000000, /* [0x009F] */
+	0x00000000, /* [0x00A0] */
+	0x00000001, /* [0x00A1] */
+	0x480E9185, /* [0x00A2] == TYPE4 == */
+	0x00000000, /* [0x00A3] A5X_UCHE_CACHE_INVALIDATE_MIN_LO (0x0E91)*/
+	0x00000000, /* [0x00A4] A5X_UCHE_CACHE_INVALIDATE_MIN_HI (0x0E92)*/
+	0x00000000, /* [0x00A5] A5X_UCHE_CACHE_INVALIDATE_MAX_LO (0x0E93)*/
+	0x00000000, /* [0x00A6] A5X_UCHE_CACHE_INVALIDATE_MAX_HI (0x0E94)*/
+	0x00000012, /* [0x00A7] A5X_UCHE_CACHE_INVALIDATE (0x0E95)*/
+	0x70268000, /* [0x00A8] == TYPE7: WAIT_FOR_IDLE (26) == */
+	0x40E78A01, /* [0x00A9] == TYPE4 == */
+	0x000FFFFF, /* [0x00AA] A5X_HLSQ_UPDATE_CNTL_CTX_0 (0xE78A)*/
+	0x70D08003, /* [0x00AB] == TYPE7: PERFCOUNTER_ACTION (50) == */
+	0x00000000, /* [0x00AC] */
+	0x00000000, /* [0x00AD] */
+	0x00000000, /* [0x00AE] */
+	0x70D08003, /* [0x00AF] == TYPE7: PERFCOUNTER_ACTION (50) == */
+	0x00000010, /* [0x00B0] */
+	0x00000000, /* [0x00B1] */
+	0x00000000, /* [0x00B2] */
+	0x70268000, /* [0x00B3] == TYPE7: WAIT_FOR_IDLE (26) == */
+	0x48E38C01, /* [0x00B4] == TYPE4 == */
+	0xFFFFFFFF, /* [0x00B5] A5X_PC_RESTART_INDEX_CTX_0 (0xE38C)*/
+	0x40E38801, /* [0x00B6] == TYPE4 == */
+	0x00000012, /* [0x00B7] A5X_PC_RASTER_CNTL_CTX_0 (0xE388)*/
+	0x48E09102, /* [0x00B8] == TYPE4 == */
+	0xFFC00010, /* [0x00B9] A5X_GRAS_SU_POINT_MINMAX_CTX_0 (0xE091)*/
+	0x00000008, /* [0x00BA] A5X_GRAS_SU_POINT_SIZE_CTX_0 (0xE092)*/
+	0x40E09901, /* [0x00BB] == TYPE4 == */
+	0x00000000, /* [0x00BC] A5X_GRAS_SU_CONSERVATIVE_RAS_CNTL_CTX_0
+		     * (0xE099)
+		     */
+	0x48E0A401, /* [0x00BD] == TYPE4 == */
+	0x00000000, /* [0x00BE] A5X_GRAS_SC_SCREEN_SCISSOR_CNTL_CTX_0 (0xE0A4)*/
+	0x48E58A01, /* [0x00BF] == TYPE4 == */
+	0x00000000, /* [0x00C0] A5X_SP_VS_CONFIG_MAX_CONST_CTX_0 (0xE58A)*/
+	0x40E58B01, /* [0x00C1] == TYPE4 == */
+	0x00000000, /* [0x00C2] A5X_SP_PS_CONFIG_MAX_CONST_CTX_0 (0xE58B)*/
+	0x480CC601, /* [0x00C3] == TYPE4 == */
+	0x00000044, /* [0x00C4] A5X_RB_MODE_CNTL (0x0CC6)*/
+	0x400CC401, /* [0x00C5] == TYPE4 == */
+	0x00100000, /* [0x00C6] A5X_RB_DBG_ECO_CNTL (0x0CC4)*/
+	0x400E4201, /* [0x00C7] == TYPE4 == */
+	0x00000000, /* [0x00C8] A5X_VFD_MODE_CNTL (0x0E42)*/
+	0x480D0201, /* [0x00C9] == TYPE4 == */
+	0x0000001F, /* [0x00CA] A5X_PC_MODE_CNTL (0x0D02)*/
+	0x480EC201, /* [0x00CB] == TYPE4 == */
+	0x0000001E, /* [0x00CC] A5X_SP_MODE_CNTL (0x0EC2)*/
+	0x400EC001, /* [0x00CD] == TYPE4 == */
+	0x40000800, /* [0x00CE] A5X_SP_DBG_ECO_CNTL (0x0EC0)*/
+	0x400F0201, /* [0x00CF] == TYPE4 == */
+	0x00000544, /* [0x00D0] A5X_TPL1_MODE_CNTL (0x0F02)*/
+	0x400E0002, /* [0x00D1] == TYPE4 == */
+	0x00000080, /* [0x00D2] A5X_HLSQ_TIMEOUT_THRESHOLD_0 (0x0E00)*/
+	0x00000000, /* [0x00D3] A5X_HLSQ_TIMEOUT_THRESHOLD_1 (0x0E01)*/
+	0x400E6001, /* [0x00D4] == TYPE4 == */
+	0x00000400, /* [0x00D5] A5X_VPC_DBG_ECO_CNTL (0x0E60)*/
+	0x400E0601, /* [0x00D6] == TYPE4 == */
+	0x00000001, /* [0x00D7] A5X_HLSQ_MODE_CNTL (0x0E06)*/
+	0x480E6201, /* [0x00D8] == TYPE4 == */
+	0x00000000, /* [0x00D9] A5X_VPC_MODE_CNTL (0x0E62)*/
+	0x70EC8005, /* [0x00DA] == TYPE7: SET_RENDER_MODE (6C) == */
+	0x00000002, /* [0x00DB] */
+	0x00000000, /* [0x00DC] */
+	0x00000000, /* [0x00DD] */
+	0x00000008, /* [0x00DE] */
+	0x00000001, /* [0x00DF] */
+	0x40E14001, /* [0x00E0] == TYPE4 == */
+	0x00000204, /* [0x00E1] A5X_RB_CNTL_CTX_0 (0xE140)*/
+	0x709D0001, /* [0x00E2] == TYPE7: SKIP_IB2_ENABLE_GLOBAL (1D) == */
+	0x00000000, /* [0x00E3] */
+	0x48E0EA02, /* [0x00E4] == TYPE4 == */
+	0x00000000, /* [0x00E5] A5X_GRAS_SC_WINDOW_SCISSOR_TL_CTX_0 (0xE0EA)*/
+	0x001F0073, /* [0x00E6] A5X_GRAS_SC_WINDOW_SCISSOR_BR_CTX_0 (0xE0EB)*/
+	0x48E21102, /* [0x00E7] == TYPE4 == */
+	0x00000000, /* [0x00E8] A5X_RB_RESOLVE_CNTL_1_CTX_0 (0xE211)*/
+	0x00000000, /* [0x00E9] A5X_RB_RESOLVE_CNTL_2_CTX_0 (0xE212)*/
+	0x480BC283, /* [0x00EA] == TYPE4 == */
+	0x00000204, /* [0x00EB] UNKNOWN (0x0BC2)*/
+	0x00000000, /* [0x00EC] UNKNOWN (0x0BC3)*/
+	0x00000000, /* [0x00ED] UNKNOWN (0x0BC4)*/
+	0x400BC502, /* [0x00EE] == TYPE4 == */
+	0x00000000, /* [0x00EF] UNKNOWN (0x0BC5)*/
+	0x00000000, /* [0x00F0] UNKNOWN (0x0BC6)*/
+	0x480BD001, /* [0x00F1] == TYPE4 == */
+	0x01100000, /* [0x00F2] UNKNOWN (0x0BD0)*/
+	0x480BE002, /* [0x00F3] == TYPE4 == */
+	0x00000000, /* [0x00F4] UNKNOWN (0x0BE0)*/
+	0x00000000, /* [0x00F5] UNKNOWN (0x0BE1)*/
+	0x480C0001, /* [0x00F6] == TYPE4 == */
+	0x00000020, /* [0x00F7] A5X_VSC_PIPE_DATA_LENGTH_0 (0x0C00)*/
+	0x48E3B001, /* [0x00F8] == TYPE4 == */
+	0x00000003, /* [0x00F9] A5X_PC_POWER_CNTL_CTX_0 (0xE3B0)*/
+	0x48E4F001, /* [0x00FA] == TYPE4 == */
+	0x00000003, /* [0x00FB] A5X_VFD_POWER_CNTL_CTX_0 (0xE4F0)*/
+	0x480E6201, /* [0x00FC] == TYPE4 == */
+	0x00000001, /* [0x00FD] A5X_VPC_MODE_CNTL (0x0E62)*/
+	0x70460001, /* [0x00FE] == TYPE7: EVENT_WRITE (46) == */
+	0x0000002C, /* [0x00FF] */
+	0x40E1D001, /* [0x0100] == TYPE4 == */
+	0x00000000, /* [0x0101] A5X_RB_WINDOW_OFFSET_CTX_0 (0xE1D0)*/
+	0x70BF8003, /* [0x0102] == TYPE7: INDIRECT_BUFFER_PFE (3F) == */
+	0x00000000, /* [0x0103] */
+	0x00000000, /* [0x0104] */
+	0x000000A0, /* [0x0105] */
+	0x70460001, /* [0x0106] == TYPE7: EVENT_WRITE (46) == */
+	0x0000002D, /* [0x0107] */
+	0x70460004, /* [0x0108] == TYPE7: EVENT_WRITE (46) == */
+	0x00000004, /* [0x0109] */
+	0x00000000, /* [0x010A] */
+	0x00000000, /* [0x010B] */
+	0x00000000, /* [0x010C] */
+	0x70268000, /* [0x010D] == TYPE7: WAIT_FOR_IDLE (26) == */
+	0x480E6201, /* [0x010E] == TYPE4 == */
+	0x00000000, /* [0x010F] A5X_VPC_MODE_CNTL (0x0E62)*/
+	0x48E3B001, /* [0x0110] == TYPE4 == */
+	0x00000003, /* [0x0111] A5X_PC_POWER_CNTL_CTX_0 (0xE3B0)*/
+	0x48E4F001, /* [0x0112] == TYPE4 == */
+	0x00000003, /* [0x0113] A5X_VFD_POWER_CNTL_CTX_0 (0xE4F0)*/
+	0x70268000, /* [0x0114] == TYPE7: WAIT_FOR_IDLE (26) == */
+	0x400CC701, /* [0x0115] == TYPE4 == */
+	0x7C13C080, /* [0x0116] A5X_RB_CCU_CNTL (0x0CC7)*/
+	0x70EC8005, /* [0x0117] == TYPE7: SET_RENDER_MODE (6C) == */
+	0x00000001, /* [0x0118] */
+	0x00000000, /* [0x0119] */
+	0x00000000, /* [0x011A] */
+	0x00000010, /* [0x011B] */
+	0x00000001, /* [0x011C] */
+	0x70EA0001, /* [0x011D] == TYPE7: PREEMPT_ENABLE_LOCAL (6A) == */
+	0x00000000, /* [0x011E] */
+	0x48E0EA02, /* [0x011F] == TYPE4 == */
+	0x00000000, /* [0x0120] A5X_GRAS_SC_WINDOW_SCISSOR_TL_CTX_0 (0xE0EA)*/
+	0x001F0073, /* [0x0121] A5X_GRAS_SC_WINDOW_SCISSOR_BR_CTX_0 (0xE0EB)*/
+	0x48E21102, /* [0x0122] == TYPE4 == */
+	0x00000000, /* [0x0123] A5X_RB_RESOLVE_CNTL_1_CTX_0 (0xE211)*/
+	0x00030007, /* [0x0124] A5X_RB_RESOLVE_CNTL_2_CTX_0 (0xE212)*/
+	0x70138000, /* [0x0125] == TYPE7: WAIT_FOR_ME (13) == */
+	0x70640001, /* [0x0126] == TYPE7: SET_VISIBILITY_OVERRIDE (64) == */
+	0x00000000, /* [0x0127] */
+	0x702F8005, /* [0x0128] == TYPE7: SET_BIN_DATA (2F) == */
+	0x00010000, /* [0x0129] */
+	0x00000000, /* [0x012A] */
+	0x00000000, /* [0x012B] */
+	0x00000000, /* [0x012C] */
+	0x00000000, /* [0x012D] */
+	0x40E1D001, /* [0x012E] == TYPE4 == */
+	0x00000000, /* [0x012F] A5X_RB_WINDOW_OFFSET_CTX_0 (0xE1D0)*/
+	0x40E2A201, /* [0x0130] == TYPE4 == */
+	0x00000001, /* [0x0131] A5X_VPC_SO_OVERRIDE_CTX_0 (0xE2A2)*/
+	0x70640001, /* [0x0132] == TYPE7: SET_VISIBILITY_OVERRIDE (64) == */
+	0x00000000, /* [0x0133] */
+	0x48E1B285, /* [0x0134] == TYPE4 == */
+	0x00000001, /* [0x0135] A5X_RB_DEPTH_BUFFER_INFO_CTX_0 (0xE1B2)*/
+	0x00004000, /* [0x0136] A5X_RB_DEPTH_BUFFER_BASE_LO_CTX_0 (0xE1B3)*/
+	0x00000000, /* [0x0137] A5X_RB_DEPTH_BUFFER_BASE_HI_CTX_0 (0xE1B4)*/
+	0x00000004, /* [0x0138] A5X_RB_DEPTH_BUFFER_PITCH_CTX_0 (0xE1B5)*/
+	0x000000C0, /* [0x0139] A5X_RB_DEPTH_BUFFER_ARRAY_PITCH_CTX_0 (0xE1B6)*/
+	0x48E09801, /* [0x013A] == TYPE4 == */
+	0x00000001, /* [0x013B] A5X_GRAS_SU_DEPTH_BUFFER_INFO_CTX_0 (0xE098)*/
+	0x40E24083, /* [0x013C] == TYPE4 == */
+	0x00000000, /* [0x013D] A5X_RB_DEPTH_FLAG_BUFFER_BASE_LO_CTX_0
+		     * (0xE240)
+		     */
+	0x00000000, /* [0x013E] A5X_RB_DEPTH_FLAG_BUFFER_BASE_HI_CTX_0
+		     * (0xE241)
+		     */
+	0x00000000, /* [0x013F] A5X_RB_DEPTH_FLAG_BUFFER_PITCH_CTX_0 (0xE242)*/
+	0x40E15285, /* [0x0140] == TYPE4 == */
+	0x00001230, /* [0x0141] A5X_RB_MRT_BUFFER_INFO_0_CTX_0 (0xE152)*/
+	0x00000008, /* [0x0142] A5X_RB_MRT_BUFFER_PITCH_0_CTX_0 (0xE153)*/
+	0x00000100, /* [0x0143] A5X_RB_MRT_BUFFER_ARRAY_PITCH_0_CTX_0 (0xE154)*/
+	0x00000000, /* [0x0144] A5X_RB_MRT_BUFFER_BASE_LO_0_CTX_0 (0xE155)*/
+	0x00000000, /* [0x0145] A5X_RB_MRT_BUFFER_BASE_HI_0_CTX_0 (0xE156)*/
+	0x40E40801, /* [0x0146] == TYPE4 == */
+	0x00000000, /* [0x0147] A5X_VFD_INDEX_OFFSET_CTX_0 (0xE408)*/
+	0x48E40901, /* [0x0148] == TYPE4 == */
+	0x00000000, /* [0x0149] A5X_VFD_INSTANCE_START_OFFSET_CTX_0 (0xE409)*/
+	0x70BF8003, /* [0x014A] == TYPE7: INDIRECT_BUFFER_PFE (3F) == */
+	0x00000000, /* [0x014B] */
+	0x00000000, /* [0x014C] */
+	0x00000112, /* [0x014D] */
+	0x70230001, /* [0x014E] == TYPE7: SKIP_IB2_ENABLE_LOCAL (23) == */
+	0x00000000, /* [0x014F] */
+	0x70BF8003, /* [0x0150] == TYPE7: INDIRECT_BUFFER_PFE (3F) == */
+	0x00000000, /* [0x0151] */
+	0x00000000, /* [0x0152] */
+	0x0000001B, /* [0x0153] */
+	0x70EC8005, /* [0x0154] == TYPE7: SET_RENDER_MODE (6C) == */
+	0x00000001, /* [0x0155] */
+	0x00000000, /* [0x0156] */
+	0x00000000, /* [0x0157] */
+	0x00000000, /* [0x0158] */
+	0x00000001, /* [0x0159] */
+	0x70438003, /* [0x015A] == TYPE7: SET_DRAW_STATE (43) == */
+	0x00080059, /* [0x015B] */
+	0x00000000, /* [0x015C] */
+	0x00000000, /* [0x015D] */
+	0x70388003, /* [0x015E] == TYPE7: DRAW_INDX_OFFSET (38) == */
+	0x00000888, /* [0x015F] */
+	0x00000000, /* [0x0160] */
+	0x00000002, /* [0x0161] */
+	0x70A88003, /* [0x0162] == TYPE7: DRAW_INDIRECT (28) == */
+	0x00200884, /* [0x0163] */
+	0x00000000, /* [0x0164] */
+	0x00000000, /* [0x0165] */
+	0x70298006, /* [0x0166] == TYPE7: DRAW_INDX_INDIRECT (29) == */
+	0x00200404, /* [0x0167] */
+	0x00000000, /* [0x0168] */
+	0x00000000, /* [0x0169] */
+	0x00000006, /* [0x016A] */
+	0x00000000, /* [0x016B] */
+	0x00000000, /* [0x016C] */
+	0x40E2A783, /* [0x016D] == TYPE4 == */
+	0x00000000, /* [0x016E] A5X_VPC_SO_BUFFER_BASE_LO_0_CTX_0 (0xE2A7)*/
+	0x00000000, /* [0x016F] A5X_VPC_SO_BUFFER_BASE_HI_0_CTX_0 (0xE2A8)*/
+	0x00000004, /* [0x0170] A5X_VPC_SO_BUFFER_SIZE_0_CTX_0 (0xE2A9)*/
+	0x48E2AC02, /* [0x0171] == TYPE4 == */
+	0x00000000, /* [0x0172] A5X_VPC_SO_FLUSH_BASE_LO_0_CTX_0 (0xE2AC)*/
+	0x00000000, /* [0x0173] A5X_VPC_SO_FLUSH_BASE_HI_0_CTX_0 (0xE2AD)*/
+	0x70460001, /* [0x0174] == TYPE7: EVENT_WRITE (46) == */
+	0x00000011, /* [0x0175] */
+	0x48E10001, /* [0x0176] == TYPE4 == */
+	0x00000009, /* [0x0177] A5X_GRAS_LRZ_CNTL_CTX_0 (0xE100)*/
+	0x70460001, /* [0x0178] == TYPE7: EVENT_WRITE (46) == */
+	0x00000026, /* [0x0179] */
+	0x48E10001, /* [0x017A] == TYPE4 == */
+	0x00000008, /* [0x017B] A5X_GRAS_LRZ_CNTL_CTX_0 (0xE100)*/
+	0x40E10185, /* [0x017C] == TYPE4 == */
+	0x00000000, /* [0x017D] A5X_GRAS_LRZ_BUFFER_BASE_LO_CTX_0 (0xE101)*/
+	0x00000000, /* [0x017E] A5X_GRAS_LRZ_BUFFER_BASE_HI_CTX_0 (0xE102)*/
+	0x00000001, /* [0x017F] A5X_GRAS_LRZ_BUFFER_PITCH_CTX_0 (0xE103)*/
+	0x00000000, /* [0x0180] A5X_GRAS_LRZ_FAST_CLEAR_BUFFER_BASE_LO_CTX_0
+		     * (0xE104)
+		     */
+	0x00000000, /* [0x0181] A5X_GRAS_LRZ_FAST_CLEAR_BUFFER_BASE_HI_CTX_0
+		     * (0xE105)
+		     */
+	0x70460001, /* [0x0182] == TYPE7: EVENT_WRITE (46) == */
+	0x00000025, /* [0x0183] */
+	0x70460001, /* [0x0184] == TYPE7: EVENT_WRITE (46) == */
+	0x00000019, /* [0x0185] */
+	0x70460001, /* [0x0186] == TYPE7: EVENT_WRITE (46) == */
+	0x00000018, /* [0x0187] */
+	0x70EA0001, /* [0x0188] == TYPE7: PREEMPT_ENABLE_LOCAL (6A) == */
+	0x00000000, /* [0x0189] */
+	0x70EC0001, /* [0x018A] == TYPE7: SET_RENDER_MODE (6C) == */
+	0x00000006, /* [0x018B] */
+	0x70438003, /* [0x018C] == TYPE7: SET_DRAW_STATE (43) == */
+	0x00080059, /* [0x018D] */
+	0x00000000, /* [0x018E] */
+	0x00000000, /* [0x018F] */
+	0x70DC0002, /* [0x0190] == TYPE7: CONTEXT_REG_BUNCH (5C) == */
+	0x0000E2A1, /* [0x0191] */
+	0x00008001, /* [0x0192] */
+	0x709D0001, /* [0x0193] == TYPE7: SKIP_IB2_ENABLE_GLOBAL (1D) == */
+	0x00000000, /* [0x0194] */
+	0x70138000, /* [0x0195] == TYPE7: WAIT_FOR_ME (13) == */
+	0x70640001, /* [0x0196] == TYPE7: SET_VISIBILITY_OVERRIDE (64) == */
+	0x00000001, /* [0x0197] */
+	0x70380007, /* [0x0198] == TYPE7: DRAW_INDX_OFFSET (38) == */
+	0x00200506, /* [0x0199] */
+	0x00000000, /* [0x019A] */
+	0x00000004, /* [0x019B] */
+	0x00000000, /* [0x019C] */
+	0x00000000, /* [0x019D] */
+	0x00000000, /* [0x019E] */
+	0x00000004, /* [0x019F] */
+	0x703D8005, /* [0x01A0] == TYPE7: MEM_WRITE (3D) == */
+	0x00000000, /* [0x01A1] */
+	0x00000000, /* [0x01A2] */
+	0x00000001, /* [0x01A3] */
+	0x00000001, /* [0x01A4] */
+	0x00000001, /* [0x01A5] */
+	0x70928000, /* [0x01A6] == TYPE7: WAIT_MEM_WRITES (12) == */
+	0x70BF8003, /* [0x01A7] == TYPE7: INDIRECT_BUFFER_PFE (3F) == */
+	0x00000000, /* [0x01A8] */
+	0x00000000, /* [0x01A9] */
+	0x00000028, /* [0x01AA] */
+	0x70C48006, /* [0x01AB] == TYPE7: COND_EXEC (44) == */
+	0x00000000, /* [0x01AC] */
+	0x00000000, /* [0x01AD] */
+	0x00000000, /* [0x01AE] */
+	0x00000000, /* [0x01AF] */
+	0x00000001, /* [0x01B0] */
+	0x00000002, /* [0x01B1] */
+	0x70100001, /* [0x01B2] == TYPE7: NOP (10) == */
+	0x00000000, /* [0x01B3] */
+	0x70C28003, /* [0x01B4] == TYPE7: MEM_TO_REG (42) == */
+	0xC000E2AB, /* [0x01B5] */
+	0x00000000, /* [0x01B6] */
+	0x00000000, /* [0x01B7] */
+	0x70230001, /* [0x01B8] == TYPE7: SKIP_IB2_ENABLE_LOCAL (23) == */
+	0x00000000, /* [0x01B9] */
+	0x70E90001, /* [0x01BA] == TYPE7: PREEMPT_ENABLE_GLOBAL (69) == */
+	0x00000000, /* [0x01BB] */
+	0x70BC8006, /* [0x01BC] == TYPE7: WAIT_REG_MEM (3C) == */
+	0x00000010, /* [0x01BD] */
+	0x00000000, /* [0x01BE] */
+	0x00000000, /* [0x01BF] */
+	0x00000001, /* [0x01C0] */
+	0xFFFFFFFF, /* [0x01C1] */
+	0x00000001, /* [0x01C2] */
+	0x70738009, /* [0x01C3] == TYPE7: MEM_TO_MEM (73) == */
+	0x20000004, /* [0x01C4] */
+	0x00000000, /* [0x01C5] */
+	0x00000000, /* [0x01C6] */
+	0x00000000, /* [0x01C7] */
+	0x00000000, /* [0x01C8] */
+	0x00000000, /* [0x01C9] */
+	0x00000000, /* [0x01CA] */
+	0x00000000, /* [0x01CB] */
+	0x00000000, /* [0x01CC] */
+	0x70738009, /* [0x01CD] == TYPE7: MEM_TO_MEM (73) == */
+	0xE0000004, /* [0x01CE] */
+	0x00000000, /* [0x01CF] */
+	0x00000000, /* [0x01D0] */
+	0x00000000, /* [0x01D1] */
+	0x00000000, /* [0x01D2] */
+	0x00000000, /* [0x01D3] */
+	0x00000000, /* [0x01D4] */
+	0x00000000, /* [0x01D5] */
+	0x00000000, /* [0x01D6] */
+	0x70B50001, /* [0x01D7] == TYPE7: SET_SUBDRAW_SIZE (35) == */
+	0x00000001, /* [0x01D8] */
+	0x40E78A01, /* [0x01D9] == TYPE4 == */
+	0x000FFFFF, /* [0x01DA] A5X_HLSQ_UPDATE_CNTL_CTX_0 (0xE78A)*/
+	0x70268000, /* [0x01DB] == TYPE7: WAIT_FOR_IDLE (26) == */
+	0x400E0601, /* [0x01DC] == TYPE4 == */
+	0x00000001, /* [0x01DD] A5X_HLSQ_MODE_CNTL (0x0E06)*/
+	0x706E0004, /* [0x01DE] == TYPE7: COMPUTE_CHECKPOINT (6E) == */
+	0x00000000, /* [0x01DF] */
+	0x00000000, /* [0x01E0] */
+	0x00000018, /* [0x01E1] */
+	0x00000001, /* [0x01E2] */
+	0x40E14001, /* [0x01E3] == TYPE4 == */
+	0x00020000, /* [0x01E4] A5X_RB_CNTL_CTX_0 (0xE140)*/
+	0x40E78A01, /* [0x01E5] == TYPE4 == */
+	0x01F00000, /* [0x01E6] A5X_HLSQ_UPDATE_CNTL_CTX_0 (0xE78A)*/
+	0x70268000, /* [0x01E7] == TYPE7: WAIT_FOR_IDLE (26) == */
+	0x48E38C01, /* [0x01E8] == TYPE4 == */
+	0xFFFFFFFF, /* [0x01E9] A5X_PC_RESTART_INDEX_CTX_0 (0xE38C)*/
+	0x480D0201, /* [0x01EA] == TYPE4 == */
+	0x0000001F, /* [0x01EB] A5X_PC_MODE_CNTL (0x0D02)*/
+	0x480EC201, /* [0x01EC] == TYPE4 == */
+	0x0000001E, /* [0x01ED] A5X_SP_MODE_CNTL (0x0EC2)*/
+	0x48E58001, /* [0x01EE] == TYPE4 == */
+	0x00000000, /* [0x01EF] A5X_SP_SP_CNTL_CTX_0 (0xE580)*/
+	0x40E2A201, /* [0x01F0] == TYPE4 == */
+	0x00000001, /* [0x01F1] A5X_VPC_SO_OVERRIDE_CTX_0 (0xE2A2)*/
+	0x70640001, /* [0x01F2] == TYPE7: SET_VISIBILITY_OVERRIDE (64) == */
+	0x00000001, /* [0x01F3] */
+	0x48E78401, /* [0x01F4] == TYPE4 == */
+	0x00000881, /* [0x01F5] A5X_HLSQ_CNTL_0_CTX_0 (0xE784)*/
+	0x40E5F001, /* [0x01F6] == TYPE4 == */
+	0x00000C06, /* [0x01F7] A5X_SP_CS_CNTL_0_CTX_0 (0xE5F0)*/
+	0x48E79001, /* [0x01F8] == TYPE4 == */
+	0x00000001, /* [0x01F9] A5X_HLSQ_CS_CONFIG_CTX_0 (0xE790)*/
+	0x48E79601, /* [0x01FA] == TYPE4 == */
+	0x00000005, /* [0x01FB] A5X_HLSQ_CS_CNTL_CTX_0 (0xE796)*/
+	0x48E58901, /* [0x01FC] == TYPE4 == */
+	0x00000001, /* [0x01FD] A5X_SP_CS_CONFIG_CTX_0 (0xE589)*/
+	0x40E7DC01, /* [0x01FE] == TYPE4 == */
+	0x00000030, /* [0x01FF] A5X_HLSQ_CONTEXT_SWITCH_CS_SW_3_CTX_0 (0xE7DC)*/
+	0x48E7DD01, /* [0x0200] == TYPE4 == */
+	0x00000002, /* [0x0201] A5X_HLSQ_CONTEXT_SWITCH_CS_SW_4_CTX_0 (0xE7DD)*/
+	0x40E7B001, /* [0x0202] == TYPE4 == */
+	0x00000003, /* [0x0203] A5X_HLSQ_CS_NDRANGE_0_CTX_0 (0xE7B0)*/
+	0x48E7B702, /* [0x0204] == TYPE4 == */
+	0x00FCC0CF, /* [0x0205] A5X_HLSQ_CS_CNTL_0_CTX_0 (0xE7B7)*/
+	0x00000000, /* [0x0206] A5X_HLSQ_CS_CNTL_1_CTX_0 (0xE7B8)*/
+	0x40E7B983, /* [0x0207] == TYPE4 == */
+	0x00000001, /* [0x0208] A5X_HLSQ_CS_KERNEL_GROUP_X_CTX_0 (0xE7B9)*/
+	0x00000001, /* [0x0209] A5X_HLSQ_CS_KERNEL_GROUP_Y_CTX_0 (0xE7BA)*/
+	0x00000001, /* [0x020A] A5X_HLSQ_CS_KERNEL_GROUP_Z_CTX_0 (0xE7BB)*/
+	0x70B08003, /* [0x020B] == TYPE7: LOAD_STATE (30) == */
+	0x00B60000, /* [0x020C] */
+	0x00000000, /* [0x020D] */
+	0x00000000, /* [0x020E] */
+	0x70B08003, /* [0x020F] == TYPE7: LOAD_STATE (30) == */
+	0x01360008, /* [0x0210] */
+	0x00000000, /* [0x0211] */
+	0x00000000, /* [0x0212] */
+	0x70B0000B, /* [0x0213] == TYPE7: LOAD_STATE (30) == */
+	0x00BC0000, /* [0x0214] */
+	0x00000000, /* [0x0215] */
+	0x00000000, /* [0x0216] */
+	0x00000000, /* [0x0217] */
+	0x00000000, /* [0x0218] */
+	0x00000000, /* [0x0219] */
+	0x00000000, /* [0x021A] */
+	0x00000000, /* [0x021B] */
+	0x00000000, /* [0x021C] */
+	0x00000000, /* [0x021D] */
+	0x00000000, /* [0x021E] */
+	0x70B00007, /* [0x021F] == TYPE7: LOAD_STATE (30) == */
+	0x00BC0000, /* [0x0220] */
+	0x00000001, /* [0x0221] */
+	0x00000000, /* [0x0222] */
+	0x00040000, /* [0x0223] */
+	0x00000000, /* [0x0224] */
+	0x00040000, /* [0x0225] */
+	0x00000000, /* [0x0226] */
+	0x70B00007, /* [0x0227] == TYPE7: LOAD_STATE (30) == */
+	0x00BC0000, /* [0x0228] */
+	0x00000002, /* [0x0229] */
+	0x00000000, /* [0x022A] */
+	0x00000000, /* [0x022B] */
+	0x00000000, /* [0x022C] */
+	0x00000000, /* [0x022D] */
+	0x00000000, /* [0x022E] */
+	0x48E7B186, /* [0x022F] == TYPE4 == */
+	0x00000001, /* [0x0230] A5X_HLSQ_CS_NDRANGE_1_CTX_0 (0xE7B1)*/
+	0x00000000, /* [0x0231] A5X_HLSQ_CS_NDRANGE_2_CTX_0 (0xE7B2)*/
+	0x00000001, /* [0x0232] A5X_HLSQ_CS_NDRANGE_3_CTX_0 (0xE7B3)*/
+	0x00000000, /* [0x0233] A5X_HLSQ_CS_NDRANGE_4_CTX_0 (0xE7B4)*/
+	0x00000001, /* [0x0234] A5X_HLSQ_CS_NDRANGE_5_CTX_0 (0xE7B5)*/
+	0x00000000, /* [0x0235] A5X_HLSQ_CS_NDRANGE_6_CTX_0 (0xE7B6)*/
+	0x70B30004, /* [0x0236] == TYPE7: EXEC_CS (33) == */
+	0x00000000, /* [0x0237] */
+	0x00000001, /* [0x0238] */
+	0x00000001, /* [0x0239] */
+	0x00000001, /* [0x023A] */
+	0x480E6201, /* [0x023B] == TYPE4 == */
+	0x00000001, /* [0x023C] A5X_VPC_MODE_CNTL (0x0E62)*/
+};
+
+/*
+ * These are fixups for the addresses _a5xx_critical_pkts[]. The first two
+ * numbers are the dword offsets into the buffer above.  The third enum is a
+ * clue as to which buffer is being patched in and the final number is an offset
+ * in said buffer.
+ */
+static const struct adreno_critical_fixup critical_pkt_fixups[] = {
+	{ 132, 133, 2, 0x0000 },
+	{ 136, 137, 2, 0x0001 },
+	{ 154, 155, 2, 0x0100 },
+	{ 159, 160, 2, 0x0104 },
+	{ 173, 174, 2, 0x0200 },
+	{ 177, 178, 2, 0x0300 },
+	{ 236, 237, 0, 0x0000 },
+	{ 244, 245, 0, 0x0040 },
+	{ 259, 260, 3, 0x0000 },
+	{ 266, 267, 2, 0x0108 },
+	{ 298, 299, 0, 0x0040 },
+	{ 300, 301, 2, 0x0080 },
+	{ 331, 332, 3, 0x02A0 },
+	{ 337, 338, 3, 0x0700 },
+	{ 348, 349, 3, 0x0920 },
+	{ 356, 357, 1, 0x008C },
+	{ 360, 361, 1, 0x0080 },
+	{ 363, 364, 1, 0x008C },
+	{ 366, 367, 0, 0x0100 },
+	{ 370, 371, 0, 0x0120 },
+	{ 381, 382, 1, 0x0480 },
+	{ 384, 385, 1, 0x0400 },
+	{ 398, 399, 3, 0x0920 },
+	{ 413, 414, 1, 0x0080 },
+	{ 417, 418, 1, 0x0300 },
+	{ 424, 425, 3, 0x0880 },
+	{ 428, 429, 1, 0x0300 },
+	{ 430, 431, 1, 0x0300 },
+	{ 438, 439, 1, 0x0300 },
+	{ 446, 447, 1, 0x0300 },
+	{ 453, 454, 1, 0x0320 },
+	{ 455, 456, 1, 0x0300 },
+	{ 457, 458, 1, 0x0304 },
+	{ 459, 460, 1, 0x0308 },
+	{ 463, 464, 1, 0x0320 },
+	{ 465, 466, 1, 0x0300 },
+	{ 467, 468, 1, 0x0304 },
+	{ 469, 470, 1, 0x0308 },
+	{ 525, 526, 1, 0x0160 },
+	{ 529, 530, 1, 0x0101 },
+	{ 535, 536, 1, 0x0140 },
+	{ 539, 540, 0, 0x0800 },
+	{ 555, 556, 1, 0x0140 },
+	{ 557, 558, 0, 0x0800 },
+};
+
+static unsigned int _a5xx_critical_pkts_mem01[] = {
+	0xBECCCCCD, 0x00000000, 0x3ECCCCCD, 0x00000000, 0x3ECCCCCD, 0x3ECCCCCD,
+	0xBECCCCCD, 0x00000000, 0xBECCCCCD, 0x3ECCCCCD, 0x3ECCCCCD, 0x00000000,
+	0xBECCCCCD, 0x00000000, 0x3ECCCCCD, 0x00000000, 0x3ECCCCCD, 0xBECCCCCD,
+	0xBECCCCCD, 0x00000000, 0xBECCCCCD, 0xBECCCCCD, 0x3ECCCCCD, 0x00000000,
+	0x3ECCCCCD, 0x00000000, 0x3ECCCCCD, 0x00000000, 0x3ECCCCCD, 0x00000000,
+	0x00000000, 0x00000000, 0x00040003, 0x00090005, 0x000B000A, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000003, 0x00000001,
+	0x00000006, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000003, 0x00000001, 0x00000003, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000001, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x3EF5C28F, 0x3ED1EB85, 0x3E6147AE, 0x3F800000,
+	0x3E947AE1, 0x3E6147AE, 0x3D4CCCCD, 0x3F800000, 0x00000000, 0x20554002,
+	0x3F800000, 0x20444003, 0x000000CF, 0x20044904, 0x00000000, 0x00000200,
+	0x00050001, 0x42300001, 0x00000002, 0x20154005, 0x00000020, 0x20244006,
+	0x00000000, 0x00000000, 0x10200001, 0x46500007, 0x20030004, 0x46D00004,
+	0x00000000, 0x20554008, 0x00070001, 0x61830806, 0x00061020, 0x61808001,
+	0x00040000, 0x42380800, 0x00010000, 0x42380800, 0x20040000, 0x46D80800,
+	0x00000000, 0x20154007, 0x20020000, 0x46F80000, 0x00000007, 0x20154001,
+	0x00000000, 0x00000200, 0x60030001, 0x43900004, 0x60030001, 0x43900001,
+	0x00000000, 0x00000400, 0x00013600, 0xC6E20004, 0x40040003, 0x50180104,
+	0x40060003, 0x40180803, 0x00000003, 0x20044006, 0x00000000, 0x00000500,
+	0x00003609, 0xC7260201, 0x00000000, 0x03000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000,
+};
+
+static unsigned int _a5xx_critical_pkts_mem02[] = {
+	0x00000000, 0x03000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x0000000C, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x8ACFE7F3, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+};
+
+static unsigned int _a5xx_critical_pkts_mem03[] = {
+	0x70438003, /* [0x0000] == TYPE7: SET_DRAW_STATE (43) == */
+	0x0008003A, /* [0x0001] */
+	0x00000000, /* [0x0002] */
+	0x00000000, /* [0x0003] */
+	0x70B08003, /* [0x0004] == TYPE7: LOAD_STATE (30) == */
+	0x00620000, /* [0x0005] */
+	0x00000000, /* [0x0006] */
+	0x00000000, /* [0x0007] */
+	0x40E29801, /* [0x0008] == TYPE4 == */
+	0x0000FFFF, /* [0x0009] A5X_VPC_GS_SIV_CNTL_CTX_0 (0xE298)*/
+	0x48E2A001, /* [0x000A] == TYPE4 == */
+	0x000000FF, /* [0x000B] A5X_VPC_PS_PRIMITIVEID_CNTL_CTX_0 (0xE2A0)*/
+	0x40E40185, /* [0x000C] == TYPE4 == */
+	0x00FCFCFC, /* [0x000D] A5X_VFD_CNTL_1_CTX_0 (0xE401)*/
+	0x0000FCFC, /* [0x000E] A5X_VFD_CNTL_2_CTX_0 (0xE402)*/
+	0x0000FCFC, /* [0x000F] A5X_VFD_CNTL_3_CTX_0 (0xE403)*/
+	0x000000FC, /* [0x0010] A5X_VFD_CNTL_4_CTX_0 (0xE404)*/
+	0x00000000, /* [0x0011] A5X_VFD_CNTL_5_CTX_0 (0xE405)*/
+	0x48E38F01, /* [0x0012] == TYPE4 == */
+	0x00000000, /* [0x0013] A5X_PC_HS_PARAM_CTX_0 (0xE38F)*/
+	0x48E58001, /* [0x0014] == TYPE4 == */
+	0x00000010, /* [0x0015] A5X_SP_SP_CNTL_CTX_0 (0xE580)*/
+	0x40E00001, /* [0x0016] == TYPE4 == */
+	0x00000080, /* [0x0017] A5X_GRAS_CL_CNTL_CTX_0 (0xE000)*/
+	0x40E09583, /* [0x0018] == TYPE4 == */
+	0x00000000, /* [0x0019] A5X_GRAS_SU_POLY_OFFSET_SCALE_CTX_0 (0xE095)*/
+	0x00000000, /* [0x001A] A5X_GRAS_SU_POLY_OFFSET_OFFSET_CTX_0 (0xE096)*/
+	0x00000000, /* [0x001B] A5X_GRAS_SU_POLY_OFFSET_OFFSET_CLAMP_CTX_0
+		     * (0xE097)
+		     */
+	0x40E09001, /* [0x001C] == TYPE4 == */
+	0x00000010, /* [0x001D] A5X_GRAS_SU_CNTL_CTX_0 (0xE090)*/
+	0x40E0AA02, /* [0x001E] == TYPE4 == */
+	0x00000000, /* [0x001F] A5X_GRAS_SC_SCREEN_SCISSOR_TL_0_CTX_0 (0xE0AA)*/
+	0x001F0073, /* [0x0020] A5X_GRAS_SC_SCREEN_SCISSOR_BR_0_CTX_0 (0xE0AB)*/
+	0x48E01086, /* [0x0021] == TYPE4 == */
+	0x42680000, /* [0x0022] A5X_GRAS_CL_VIEWPORT_XOFFSET_0_CTX_0 (0xE010)*/
+	0x42680000, /* [0x0023] A5X_GRAS_CL_VIEWPORT_XSCALE_0_CTX_0 (0xE011)*/
+	0x41800000, /* [0x0024] A5X_GRAS_CL_VIEWPORT_YOFFSET_0_CTX_0 (0xE012)*/
+	0xC1800000, /* [0x0025] A5X_GRAS_CL_VIEWPORT_YSCALE_0_CTX_0 (0xE013)*/
+	0x3EFFFEE0, /* [0x0026] A5X_GRAS_CL_VIEWPORT_ZOFFSET_0_CTX_0 (0xE014)*/
+	0x3EFFFEE0, /* [0x0027] A5X_GRAS_CL_VIEWPORT_ZSCALE_0_CTX_0 (0xE015)*/
+	0x40E0CA02, /* [0x0028] == TYPE4 == */
+	0x00000000, /* [0x0029] A5X_GRAS_SC_VIEWPORT_SCISSOR_TL_0_CTX_0
+		     * (0xE0CA)
+		     */
+	0x001F0073, /* [0x002A] A5X_GRAS_SC_VIEWPORT_SCISSOR_BR_0_CTX_0
+		     * (0xE0CB)
+		     */
+	0x40E00601, /* [0x002B] == TYPE4 == */
+	0x0007FDFF, /* [0x002C] A5X_GRAS_CL_GUARDBAND_CLIP_ADJ_CTX_0 (0xE006)*/
+	0x40E70401, /* [0x002D] == TYPE4 == */
+	0x00000000, /* [0x002E] A5X_TPL1_TP_RAS_MSAA_CNTL_CTX_0 (0xE704)*/
+	0x48E70501, /* [0x002F] == TYPE4 == */
+	0x00000004, /* [0x0030] A5X_TPL1_TP_DEST_MSAA_CNTL_CTX_0 (0xE705)*/
+	0x48E14201, /* [0x0031] == TYPE4 == */
+	0x00000000, /* [0x0032] A5X_RB_RAS_MSAA_CNTL_CTX_0 (0xE142)*/
+	0x40E14301, /* [0x0033] == TYPE4 == */
+	0x00000004, /* [0x0034] A5X_RB_DEST_MSAA_CNTL_CTX_0 (0xE143)*/
+	0x40E78683, /* [0x0035] == TYPE4 == */
+	0xFCFCFCFC, /* [0x0036] A5X_HLSQ_CNTL_2_CTX_0 (0xE786)*/
+	0xFCFCFCFC, /* [0x0037] A5X_HLSQ_CNTL_3_CTX_0 (0xE787)*/
+	0xFCFCFCFC, /* [0x0038] A5X_HLSQ_CNTL_4_CTX_0 (0xE788)*/
+	0x48E0A201, /* [0x0039] == TYPE4 == */
+	0x00000000, /* [0x003A] A5X_GRAS_SC_RAS_MSAA_CNTL_CTX_0 (0xE0A2)*/
+	0x40E0A301, /* [0x003B] == TYPE4 == */
+	0x00000004, /* [0x003C] A5X_GRAS_SC_DEST_MSAA_CNTL_CTX_0 (0xE0A3)*/
+	0x48E14101, /* [0x003D] == TYPE4 == */
+	0x0000C089, /* [0x003E] A5X_RB_RENDER_CNTL_CTX_0 (0xE141)*/
+	0x40E0A001, /* [0x003F] == TYPE4 == */
+	0x00000009, /* [0x0040] A5X_GRAS_SC_CNTL_CTX_0 (0xE0A0)*/
+	0x40E28001, /* [0x0041] == TYPE4 == */
+	0x00010004, /* [0x0042] A5X_VPC_CNTL_0_CTX_0 (0xE280)*/
+	0x40E38401, /* [0x0043] == TYPE4 == */
+	0x00000404, /* [0x0044] A5X_PC_PRIMITIVE_CNTL_CTX_0 (0xE384)*/
+	0x40E78501, /* [0x0045] == TYPE4 == */
+	0x0000003F, /* [0x0046] A5X_HLSQ_CNTL_1_CTX_0 (0xE785)*/
+	0x48E5D301, /* [0x0047] == TYPE4 == */
+	0x00000030, /* [0x0048] A5X_SP_PS_MRT_0_CTX_0 (0xE5D3)*/
+	0x48E5CB01, /* [0x0049] == TYPE4 == */
+	0x00000100, /* [0x004A] A5X_SP_PS_OUTPUT_0_CTX_0 (0xE5CB)*/
+	0x40E5CA01, /* [0x004B] == TYPE4 == */
+	0x001F9F81, /* [0x004C] A5X_SP_PS_OUTPUT_CNTL_CTX_0 (0xE5CA)*/
+	0x40E14601, /* [0x004D] == TYPE4 == */
+	0x00000001, /* [0x004E] A5X_RB_PS_OUTPUT_CNTL_CTX_0 (0xE146)*/
+	0x40E38E01, /* [0x004F] == TYPE4 == */
+	0x00000000, /* [0x0050] A5X_PC_GS_PARAM_CTX_0 (0xE38E)*/
+	0x40E28A01, /* [0x0051] == TYPE4 == */
+	0x00000000, /* [0x0052] A5X_VPC_VARYING_REPLACE_MODE_0_CTX_0 (0xE28A)*/
+	0x48E1A901, /* [0x0053] == TYPE4 == */
+	0xFFFF0100, /* [0x0054] A5X_RB_BLEND_CNTL_CTX_0 (0xE1A9)*/
+	0x40E5C901, /* [0x0055] == TYPE4 == */
+	0x00000100, /* [0x0056] A5X_SP_BLEND_CNTL_CTX_0 (0xE5C9)*/
+	0x40E76401, /* [0x0057] == TYPE4 == */
+	0x00000000, /* [0x0058] A5X_TPL1_TP_PS_ROTATION_CNTL_CTX_0 (0xE764)*/
+	0x48E09401, /* [0x0059] == TYPE4 == */
+	0x00000000, /* [0x005A] A5X_GRAS_SU_DEPTH_PLANE_CNTL_CTX_0 (0xE094)*/
+	0x40E1B001, /* [0x005B] == TYPE4 == */
+	0x00000000, /* [0x005C] A5X_RB_DEPTH_PLANE_CNTL_CTX_0 (0xE1B0)*/
+	0x48E1B101, /* [0x005D] == TYPE4 == */
+	0x00000000, /* [0x005E] A5X_RB_DEPTH_CNTL_CTX_0 (0xE1B1)*/
+	0x48E40001, /* [0x005F] == TYPE4 == */
+	0x00000001, /* [0x0060] A5X_VFD_CNTL_0_CTX_0 (0xE400)*/
+	0x48E40A04, /* [0x0061] == TYPE4 == */
+	0x00000000, /* [0x0062] A5X_VFD_VERTEX_BUFFER_BASE_LO_0_CTX_0 (0xE40A)*/
+	0x00000000, /* [0x0063] A5X_VFD_VERTEX_BUFFER_BASE_HI_0_CTX_0 (0xE40B)*/
+	0x00000078, /* [0x0064] A5X_VFD_VERTEX_BUFFER_SIZE_0_CTX_0 (0xE40C)*/
+	0x00000008, /* [0x0065] A5X_VFD_VERTEX_BUFFER_STRIDE_0_CTX_0 (0xE40D)*/
+	0x40E48A02, /* [0x0066] == TYPE4 == */
+	0xC6700000, /* [0x0067] A5X_VFD_FETCH_INSTR_0_CTX_0 (0xE48A)*/
+	0x00000001, /* [0x0068] A5X_VFD_FETCH_INSTR_STEP_RATE_0_CTX_0 (0xE48B)*/
+	0x48E4CA01, /* [0x0069] == TYPE4 == */
+	0x0000000F, /* [0x006A] A5X_VFD_DEST_CNTL_0_CTX_0 (0xE4CA)*/
+	0x48E10001, /* [0x006B] == TYPE4 == */
+	0x00000008, /* [0x006C] A5X_GRAS_LRZ_CNTL_CTX_0 (0xE100)*/
+	0x48E0A101, /* [0x006D] == TYPE4 == */
+	0x00000004, /* [0x006E] A5X_GRAS_SC_BIN_CNTL_CTX_0 (0xE0A1)*/
+	0x40E10185, /* [0x006F] == TYPE4 == */
+	0x00000000, /* [0x0070] A5X_GRAS_LRZ_BUFFER_BASE_LO_CTX_0 (0xE101)*/
+	0x00000000, /* [0x0071] A5X_GRAS_LRZ_BUFFER_BASE_HI_CTX_0 (0xE102)*/
+	0x00000001, /* [0x0072] A5X_GRAS_LRZ_BUFFER_PITCH_CTX_0 (0xE103)*/
+	0x00000000, /* [0x0073] A5X_GRAS_LRZ_FAST_CLEAR_BUFFER_BASE_LO_CTX_0
+		     * (0xE104)
+		     */
+	0x00000000, /* [0x0074] A5X_GRAS_LRZ_FAST_CLEAR_BUFFER_BASE_HI_CTX_0
+		     * (0xE105)
+		     */
+	0x70388003, /* [0x0075] == TYPE7: DRAW_INDX_OFFSET (38) == */
+	0x00200884, /* [0x0076] */
+	0x00000001, /* [0x0077] */
+	0x00000003, /* [0x0078] */
+	0x70380007, /* [0x0079] == TYPE7: DRAW_INDX_OFFSET (38) == */
+	0x00200404, /* [0x007A] */
+	0x00000001, /* [0x007B] */
+	0x00000003, /* [0x007C] */
+	0x00000000, /* [0x007D] */
+	0x00000000, /* [0x007E] */
+	0x00000000, /* [0x007F] */
+	0x00000006, /* [0x0080] */
+	0x70460004, /* [0x0081] == TYPE7: EVENT_WRITE (46) == */
+	0x00000004, /* [0x0082] */
+	0x00000000, /* [0x0083] */
+	0x00000000, /* [0x0084] */
+	0x00000001, /* [0x0085] */
+	0x70268000, /* [0x0086] == TYPE7: WAIT_FOR_IDLE (26) == */
+	0x70A88003, /* [0x0087] == TYPE7: DRAW_INDIRECT (28) == */
+	0x00200884, /* [0x0088] */
+	0x00000000, /* [0x0089] */
+	0x00000000, /* [0x008A] */
+	0x70460004, /* [0x008B] == TYPE7: EVENT_WRITE (46) == */
+	0x00000004, /* [0x008C] */
+	0x00000000, /* [0x008D] */
+	0x00000000, /* [0x008E] */
+	0x00000001, /* [0x008F] */
+	0x70268000, /* [0x0090] == TYPE7: WAIT_FOR_IDLE (26) == */
+	0x70298006, /* [0x0091] == TYPE7: DRAW_INDX_INDIRECT (29) == */
+	0x00200404, /* [0x0092] */
+	0x00000000, /* [0x0093] */
+	0x00000000, /* [0x0094] */
+	0x00000006, /* [0x0095] */
+	0x00000000, /* [0x0096] */
+	0x00000000, /* [0x0097] */
+	0x40E40801, /* [0x0098] == TYPE4 == */
+	0x0000000D, /* [0x0099] A5X_VFD_INDEX_OFFSET_CTX_0 (0xE408)*/
+	0x48E40901, /* [0x009A] == TYPE4 == */
+	0x00000000, /* [0x009B] A5X_VFD_INSTANCE_START_OFFSET_CTX_0 (0xE409)*/
+	0x70388003, /* [0x009C] == TYPE7: DRAW_INDX_OFFSET (38) == */
+	0x00200884, /* [0x009D] */
+	0x00000001, /* [0x009E] */
+	0x00000003, /* [0x009F] */
+	0x00000000, /* [0x00A0] */
+	0x00000000, /* [0x00A1] */
+	0x00000000, /* [0x00A2] */
+	0x00000000, /* [0x00A3] */
+	0x00000000, /* [0x00A4] */
+	0x00000000, /* [0x00A5] */
+	0x00000000, /* [0x00A6] */
+	0x00000000, /* [0x00A7] */
+	0x48E78401, /* [0x00A8] */
+	0x00000881, /* [0x00A9] */
+	0x40E5C001, /* [0x00AA] */
+	0x0004001E, /* [0x00AB] */
+	0x70438003, /* [0x00AC] */
+	0x0000003A, /* [0x00AD] */
+	0x00000000, /* [0x00AE] */
+	0x00000000, /* [0x00AF] */
+	0x70B00023, /* [0x00B0] */
+	0x00600000, /* [0x00B1] */
+	0x00000000, /* [0x00B2] */
+	0x00000000, /* [0x00B3] */
+	0x00000000, /* [0x00B4] */
+	0x03000000, /* [0x00B5] */
+	0x00000000, /* [0x00B6] */
+	0x00000000, /* [0x00B7] */
+	0x00000000, /* [0x00B8] */
+	0x00000000, /* [0x00B9] */
+	0x00000000, /* [0x00BA] */
+	0x00000000, /* [0x00BB] */
+	0x00000000, /* [0x00BC] */
+	0x00000000, /* [0x00BD] */
+	0x00000000, /* [0x00BE] */
+	0x00000000, /* [0x00BF] */
+	0x00000000, /* [0x00C0] */
+	0x00000000, /* [0x00C1] */
+	0x00000000, /* [0x00C2] */
+	0x00000000, /* [0x00C3] */
+	0x00000000, /* [0x00C4] */
+	0x00000000, /* [0x00C5] */
+	0x00000000, /* [0x00C6] */
+	0x00000000, /* [0x00C7] */
+	0x00000000, /* [0x00C8] */
+	0x00000000, /* [0x00C9] */
+	0x00000000, /* [0x00CA] */
+	0x00000000, /* [0x00CB] */
+	0x00000000, /* [0x00CC] */
+	0x00000000, /* [0x00CD] */
+	0x00000000, /* [0x00CE] */
+	0x00000000, /* [0x00CF] */
+	0x00000000, /* [0x00D0] */
+	0x00000000, /* [0x00D1] */
+	0x00000000, /* [0x00D2] */
+	0x00000000, /* [0x00D3] */
+	0x40E09301, /* [0x00D4] */
+	0x00000000, /* [0x00D5] */
+	0x40E38D01, /* [0x00D6] */
+	0x00000000, /* [0x00D7] */
+	0x40E29801, /* [0x00D8] */
+	0x0000FFFF, /* [0x00D9] */
+	0x48E28201, /* [0x00DA] */
+	0xEAEAEAEA, /* [0x00DB] */
+	0x40E29404, /* [0x00DC] */
+	0xFFFFFFFF, /* [0x00DD] */
+	0xFFFFFFFF, /* [0x00DE] */
+	0xFFFFFFFF, /* [0x00DF] */
+	0xFFFFFFFF, /* [0x00E0] */
+	0x40E5DB01, /* [0x00E1] */
+	0x00000000, /* [0x00E2] */
+	0x48E14701, /* [0x00E3] */
+	0x0000000F, /* [0x00E4] */
+	0x70B00023, /* [0x00E5] */
+	0x00700000, /* [0x00E6] */
+	0x00000000, /* [0x00E7] */
+	0x00000000, /* [0x00E8] */
+	0x00003C00, /* [0x00E9] */
+	0x20400000, /* [0x00EA] */
+	0x00000000, /* [0x00EB] */
+	0x20400001, /* [0x00EC] */
+	0x00000000, /* [0x00ED] */
+	0x20400002, /* [0x00EE] */
+	0x00003C00, /* [0x00EF] */
+	0x20400003, /* [0x00F0] */
+	0x00000000, /* [0x00F1] */
+	0x03000000, /* [0x00F2] */
+	0x00000000, /* [0x00F3] */
+	0x00000000, /* [0x00F4] */
+	0x00000000, /* [0x00F5] */
+	0x00000000, /* [0x00F6] */
+	0x00000000, /* [0x00F7] */
+	0x00000000, /* [0x00F8] */
+	0x00000000, /* [0x00F9] */
+	0x00000000, /* [0x00FA] */
+	0x00000000, /* [0x00FB] */
+	0x00000000, /* [0x00FC] */
+	0x00000000, /* [0x00FD] */
+	0x00000000, /* [0x00FE] */
+	0x00000000, /* [0x00FF] */
+	0x00000000, /* [0x0100] */
+	0x00000000, /* [0x0101] */
+	0x00000000, /* [0x0102] */
+	0x00000000, /* [0x0103] */
+	0x00000000, /* [0x0104] */
+	0x00000000, /* [0x0105] */
+	0x00000000, /* [0x0106] */
+	0x00000000, /* [0x0107] */
+	0x00000000, /* [0x0108] */
+	0x48E2A001, /* [0x0109] */
+	0x000000FF, /* [0x010A] */
+	0x40E40185, /* [0x010B] */
+	0x00FCFCFC, /* [0x010C] */
+	0x0000FCFC, /* [0x010D] */
+	0x0000FCFC, /* [0x010E] */
+	0x000000FC, /* [0x010F] */
+	0x00000000, /* [0x0110] */
+	0x48E38F01, /* [0x0111] */
+	0x00000000, /* [0x0112] */
+	0x48E58001, /* [0x0113] */
+	0x00000010, /* [0x0114] */
+	0x40E1A801, /* [0x0115] */
+	0x00000E00, /* [0x0116] */
+	0x48E15001, /* [0x0117] */
+	0x000007E0, /* [0x0118] */
+	0x40E15101, /* [0x0119] */
+	0x00000000, /* [0x011A] */
+	0x40E00001, /* [0x011B] */
+	0x00000080, /* [0x011C] */
+	0x40E09583, /* [0x011D] */
+	0x00000000, /* [0x011E] */
+	0x00000000, /* [0x011F] */
+	0x00000000, /* [0x0120] */
+	0x40E09001, /* [0x0121] */
+	0x00000010, /* [0x0122] */
+	0x40E0AA02, /* [0x0123] */
+	0x00000000, /* [0x0124] */
+	0x001F0073, /* [0x0125] */
+	0x48E01086, /* [0x0126] */
+	0x42680000, /* [0x0127] */
+	0x42680000, /* [0x0128] */
+	0x41800000, /* [0x0129] */
+	0xC1800000, /* [0x012A] */
+	0x3EFFFEE0, /* [0x012B] */
+	0x3EFFFEE0, /* [0x012C] */
+	0x40E0CA02, /* [0x012D] */
+	0x00000000, /* [0x012E] */
+	0x001F0073, /* [0x012F] */
+	0x40E00601, /* [0x0130] */
+	0x0007FDFF, /* [0x0131] */
+	0x40E70401, /* [0x0132] */
+	0x00000000, /* [0x0133] */
+	0x48E70501, /* [0x0134] */
+	0x00000004, /* [0x0135] */
+	0x48E14201, /* [0x0136] */
+	0x00000000, /* [0x0137] */
+	0x40E14301, /* [0x0138] */
+	0x00000004, /* [0x0139] */
+	0x40E78683, /* [0x013A] */
+	0xFCFCFCFC, /* [0x013B] */
+	0xFCFCFCFC, /* [0x013C] */
+	0xFCFCFCFC, /* [0x013D] */
+	0x48E0A201, /* [0x013E] */
+	0x00000000, /* [0x013F] */
+	0x40E0A301, /* [0x0140] */
+	0x00000004, /* [0x0141] */
+	0x48E1B285, /* [0x0142] */
+	0x00000001, /* [0x0143] */
+	0x00004000, /* [0x0144] */
+	0x00000000, /* [0x0145] */
+	0x00000004, /* [0x0146] */
+	0x000000C0, /* [0x0147] */
+	0x48E09801, /* [0x0148] */
+	0x00000001, /* [0x0149] */
+	0x48E00401, /* [0x014A] */
+	0x00000000, /* [0x014B] */
+	0x480CDD02, /* [0x014C] */
+	0x00200074, /* [0x014D] */
+	0x00000000, /* [0x014E] */
+	0x40E15285, /* [0x014F] */
+	0x00000A30, /* [0x0150] */
+	0x00000008, /* [0x0151] */
+	0x00000100, /* [0x0152] */
+	0x00000000, /* [0x0153] */
+	0x00000000, /* [0x0154] */
+	0x48E14101, /* [0x0155] */
+	0x0000C008, /* [0x0156] */
+	0x40E0A001, /* [0x0157] */
+	0x00000008, /* [0x0158] */
+	0x40E28001, /* [0x0159] */
+	0x00010004, /* [0x015A] */
+	0x40E38401, /* [0x015B] */
+	0x00000404, /* [0x015C] */
+	0x40E78501, /* [0x015D] */
+	0x0000003F, /* [0x015E] */
+	0x48E5D301, /* [0x015F] */
+	0x00000030, /* [0x0160] */
+	0x48E5CB01, /* [0x0161] */
+	0x00000100, /* [0x0162] */
+	0x40E5CA01, /* [0x0163] */
+	0x001F9F81, /* [0x0164] */
+	0x40E14601, /* [0x0165] */
+	0x00000001, /* [0x0166] */
+	0x40E38E01, /* [0x0167] */
+	0x00000000, /* [0x0168] */
+	0x40E28A01, /* [0x0169] */
+	0x00000000, /* [0x016A] */
+	0x48E1A901, /* [0x016B] */
+	0xFFFF0100, /* [0x016C] */
+	0x40E5C901, /* [0x016D] */
+	0x00000100, /* [0x016E] */
+	0x40E76401, /* [0x016F] */
+	0x00000000, /* [0x0170] */
+	0x48E09401, /* [0x0171] */
+	0x00000000, /* [0x0172] */
+	0x40E1B001, /* [0x0173] */
+	0x00000000, /* [0x0174] */
+	0x48E1B101, /* [0x0175] */
+	0x00000006, /* [0x0176] */
+	0x48E40001, /* [0x0177] */
+	0x00000001, /* [0x0178] */
+	0x48E40A04, /* [0x0179] */
+	0x00000000, /* [0x017A] */
+	0x00000000, /* [0x017B] */
+	0x00000078, /* [0x017C] */
+	0x00000008, /* [0x017D] */
+	0x40E48A02, /* [0x017E] */
+	0xC6700000, /* [0x017F] */
+	0x00000001, /* [0x0180] */
+	0x48E4CA01, /* [0x0181] */
+	0x0000000F, /* [0x0182] */
+	0x48E10001, /* [0x0183] */
+	0x00000008, /* [0x0184] */
+	0x48E0A101, /* [0x0185] */
+	0x00000000, /* [0x0186] */
+	0x40E10185, /* [0x0187] */
+	0x00000000, /* [0x0188] */
+	0x00000000, /* [0x0189] */
+	0x00000001, /* [0x018A] */
+	0x00000000, /* [0x018B] */
+	0x00000000, /* [0x018C] */
+	0x70230001, /* [0x018D] */
+	0x00000000, /* [0x018E] */
+	0x70388003, /* [0x018F] */
+	0x00200984, /* [0x0190] */
+	0x00000001, /* [0x0191] */
+	0x00000003, /* [0x0192] */
+	0x70380007, /* [0x0193] */
+	0x00200504, /* [0x0194] */
+	0x00000001, /* [0x0195] */
+	0x00000003, /* [0x0196] */
+	0x00000000, /* [0x0197] */
+	0x00000000, /* [0x0198] */
+	0x00000000, /* [0x0199] */
+	0x00000006, /* [0x019A] */
+	0x70460004, /* [0x019B] */
+	0x00000004, /* [0x019C] */
+	0x00000000, /* [0x019D] */
+	0x00000000, /* [0x019E] */
+	0x00000000, /* [0x019F] */
+	0x70268000, /* [0x01A0] */
+	0x70A88003, /* [0x01A1] */
+	0x00200984, /* [0x01A2] */
+	0x00000000, /* [0x01A3] */
+	0x00000000, /* [0x01A4] */
+	0x70460004, /* [0x01A5] */
+	0x00000004, /* [0x01A6] */
+	0x00000000, /* [0x01A7] */
+	0x00000000, /* [0x01A8] */
+	0x00000001, /* [0x01A9] */
+	0x70268000, /* [0x01AA] */
+	0x70298006, /* [0x01AB] */
+	0x00200504, /* [0x01AC] */
+	0x00000000, /* [0x01AD] */
+	0x00000000, /* [0x01AE] */
+	0x00000006, /* [0x01AF] */
+	0x00000000, /* [0x01B0] */
+	0x00000000, /* [0x01B1] */
+	0x40E40801, /* [0x01B2] */
+	0x0000000D, /* [0x01B3] */
+	0x48E40901, /* [0x01B4] */
+	0x00000000, /* [0x01B5] */
+	0x70388003, /* [0x01B6] */
+	0x00200984, /* [0x01B7] */
+	0x00000001, /* [0x01B8] */
+	0x00000003, /* [0x01B9] */
+	0x00000000, /* [0x01BA] */
+	0x00000000, /* [0x01BB] */
+	0x00000000, /* [0x01BC] */
+	0x00000000, /* [0x01BD] */
+	0x00000000, /* [0x01BE] */
+	0x00000000, /* [0x01BF] */
+	0x70EA0001, /* [0x01C0] */
+	0x00000000, /* [0x01C1] */
+	0x40E78A01, /* [0x01C2] */
+	0x000FFFFF, /* [0x01C3] */
+	0x40E09001, /* [0x01C4] */
+	0x00000000, /* [0x01C5] */
+	0x40E00501, /* [0x01C6] */
+	0x00000000, /* [0x01C7] */
+	0x40E00001, /* [0x01C8] */
+	0x00000181, /* [0x01C9] */
+	0x48E10001, /* [0x01CA] */
+	0x00000000, /* [0x01CB] */
+	0x40E21385, /* [0x01CC] */
+	0x00000004, /* [0x01CD] */
+	0x00000000, /* [0x01CE] */
+	0x00000000, /* [0x01CF] */
+	0x00000001, /* [0x01D0] */
+	0x00000001, /* [0x01D1] */
+	0x40E21C01, /* [0x01D2] */
+	0x00000000, /* [0x01D3] */
+	0x40E21001, /* [0x01D4] */
+	0x00000000, /* [0x01D5] */
+	0x70460004, /* [0x01D6] */
+	0x0000001E, /* [0x01D7] */
+	0x00000000, /* [0x01D8] */
+	0x00000000, /* [0x01D9] */
+	0x00000001, /* [0x01DA] */
+	0x00000000, /* [0x01DB] */
+	0x00000000, /* [0x01DC] */
+	0x00000000, /* [0x01DD] */
+	0x00000000, /* [0x01DE] */
+	0x00000000, /* [0x01DF] */
+	0x40E78A01, /* [0x01E0] */
+	0x020FFFFF, /* [0x01E1] */
+	0x48E78B85, /* [0x01E2] */
+	0x00000001, /* [0x01E3] */
+	0x00003F05, /* [0x01E4] */
+	0x00003F04, /* [0x01E5] */
+	0x00003F04, /* [0x01E6] */
+	0x00003F04, /* [0x01E7] */
+	0x48E79001, /* [0x01E8] */
+	0x00000000, /* [0x01E9] */
+	0x40E79101, /* [0x01EA] */
+	0x00000002, /* [0x01EB] */
+	0x40E79201, /* [0x01EC] */
+	0x00000002, /* [0x01ED] */
+	0x40E58485, /* [0x01EE] */
+	0x00000001, /* [0x01EF] */
+	0x00003F05, /* [0x01F0] */
+	0x00003F04, /* [0x01F1] */
+	0x00003F04, /* [0x01F2] */
+	0x00003F04, /* [0x01F3] */
+	0x48E58901, /* [0x01F4] */
+	0x00000000, /* [0x01F5] */
+	0x48E7C302, /* [0x01F6] */
+	0x00000002, /* [0x01F7] */
+	0x00000001, /* [0x01F8] */
+	0x48E7D702, /* [0x01F9] */
+	0x00000002, /* [0x01FA] */
+	0x00000001, /* [0x01FB] */
+	0x40E7C802, /* [0x01FC] */
+	0x00000000, /* [0x01FD] */
+	0x00000000, /* [0x01FE] */
+	0x40E7CD02, /* [0x01FF] */
+	0x00000000, /* [0x0200] */
+	0x00000000, /* [0x0201] */
+	0x48E7D202, /* [0x0202] */
+	0x00000000, /* [0x0203] */
+	0x00000000, /* [0x0204] */
+	0x40E7DC02, /* [0x0205] */
+	0x00000000, /* [0x0206] */
+	0x00000000, /* [0x0207] */
+	0x48E38901, /* [0x0208] */
+	0x00000000, /* [0x0209] */
+	0x48E29A01, /* [0x020A] */
+	0x00FFFF00, /* [0x020B] */
+	0x48E00101, /* [0x020C] */
+	0x00000000, /* [0x020D] */
+	0x40E29D01, /* [0x020E] */
+	0x0000FF00, /* [0x020F] */
+	0x40E59001, /* [0x0210] */
+	0x00000406, /* [0x0211] */
+	0x48E59201, /* [0x0212] */
+	0x00000001, /* [0x0213] */
+	0x40E59301, /* [0x0214] */
+	0x00000F00, /* [0x0215] */
+	0x40E5A301, /* [0x0216] */
+	0x00000000, /* [0x0217] */
+	0x48E38501, /* [0x0218] */
+	0x00000000, /* [0x0219] */
+	0x00000000, /* [0x021A] */
+	0x00000000, /* [0x021B] */
+	0x00000000, /* [0x021C] */
+	0x00000000, /* [0x021D] */
+	0x00000000, /* [0x021E] */
+	0x00000000, /* [0x021F] */
+	0x48210001, /* [0x0220] */
+	0x86000000, /* [0x0221] */
+	0x40218001, /* [0x0222] */
+	0x86000000, /* [0x0223] */
+	0x40211089, /* [0x0224] */
+	0x00001331, /* [0x0225] */
+	0x00000000, /* [0x0226] */
+	0x00000000, /* [0x0227] */
+	0x00020001, /* [0x0228] */
+	0x00000000, /* [0x0229] */
+	0x00000000, /* [0x022A] */
+	0x00000000, /* [0x022B] */
+	0x00000000, /* [0x022C] */
+	0x00000000, /* [0x022D] */
+	0x48218201, /* [0x022E] */
+	0x00001331, /* [0x022F] */
+	0x40214383, /* [0x0230] */
+	0x00000000, /* [0x0231] */
+	0x00000000, /* [0x0232] */
+	0x00000001, /* [0x0233] */
+	0x40210789, /* [0x0234] */
+	0x00000021, /* [0x0235] */
+	0x00000000, /* [0x0236] */
+	0x00000000, /* [0x0237] */
+	0x00020001, /* [0x0238] */
+	0x00000000, /* [0x0239] */
+	0x00000000, /* [0x023A] */
+	0x00000000, /* [0x023B] */
+	0x00000000, /* [0x023C] */
+	0x00000000, /* [0x023D] */
+	0x48218101, /* [0x023E] */
+	0x00000021, /* [0x023F] */
+	0x48218401, /* [0x0240] */
+	0x00000001, /* [0x0241] */
+	0x702C8005, /* [0x0242] */
+	0x00000002, /* [0x0243] */
+	0x00000000, /* [0x0244] */
+	0x00010001, /* [0x0245] */
+	0x00000000, /* [0x0246] */
+	0x00010001, /* [0x0247] */
+	0x70B00023, /* [0x0248] */
+	0x00600000, /* [0x0249] */
+	0x00000000, /* [0x024A] */
+	0x00000000, /* [0x024B] */
+	0x00000000, /* [0x024C] */
+	0x03000000, /* [0x024D] */
+	0x00000000, /* [0x024E] */
+	0x00000000, /* [0x024F] */
+	0x00000000, /* [0x0250] */
+	0x00000000, /* [0x0251] */
+	0x00000000, /* [0x0252] */
+	0x00000000, /* [0x0253] */
+	0x00000000, /* [0x0254] */
+	0x00000000, /* [0x0255] */
+	0x00000000, /* [0x0256] */
+	0x00000000, /* [0x0257] */
+	0x00000000, /* [0x0258] */
+	0x00000000, /* [0x0259] */
+	0x00000000, /* [0x025A] */
+	0x00000000, /* [0x025B] */
+	0x00000000, /* [0x025C] */
+	0x00000000, /* [0x025D] */
+	0x00000000, /* [0x025E] */
+	0x00000000, /* [0x025F] */
+	0x00000000, /* [0x0260] */
+	0x00000000, /* [0x0261] */
+	0x00000000, /* [0x0262] */
+	0x00000000, /* [0x0263] */
+	0x00000000, /* [0x0264] */
+	0x00000000, /* [0x0265] */
+	0x00000000, /* [0x0266] */
+	0x00000000, /* [0x0267] */
+	0x00000000, /* [0x0268] */
+	0x00000000, /* [0x0269] */
+	0x00000000, /* [0x026A] */
+	0x00000000, /* [0x026B] */
+	0x40E09301, /* [0x026C] */
+	0x00000000, /* [0x026D] */
+	0x40E38D01, /* [0x026E] */
+	0x00000000, /* [0x026F] */
+	0x40E29801, /* [0x0270] */
+	0x0000FFFF, /* [0x0271] */
+	0x48E28201, /* [0x0272] */
+	0xEAEAEAEA, /* [0x0273] */
+	0x40E29404, /* [0x0274] */
+	0xFFFFFFFF, /* [0x0275] */
+	0xFFFFFFFF, /* [0x0276] */
+	0xFFFFFFFF, /* [0x0277] */
+	0xFFFFFFFF, /* [0x0278] */
+	0x40E5DB01, /* [0x0279] */
+	0x00000000, /* [0x027A] */
+	0x48E14701, /* [0x027B] */
+	0x0000000F, /* [0x027C] */
+	0x70B00023, /* [0x027D] */
+	0x00700000, /* [0x027E] */
+	0x00000000, /* [0x027F] */
+	0x00000000, /* [0x0280] */
+	0x00003C00, /* [0x0281] */
+	0x20400000, /* [0x0282] */
+	0x00000000, /* [0x0283] */
+	0x20400001, /* [0x0284] */
+	0x00000000, /* [0x0285] */
+	0x20400002, /* [0x0286] */
+	0x00003C00, /* [0x0287] */
+	0x20400003, /* [0x0288] */
+	0x00000000, /* [0x0289] */
+	0x03000000, /* [0x028A] */
+	0x00000000, /* [0x028B] */
+	0x00000000, /* [0x028C] */
+	0x00000000, /* [0x028D] */
+	0x00000000, /* [0x028E] */
+	0x00000000, /* [0x028F] */
+	0x00000000, /* [0x0290] */
+	0x00000000, /* [0x0291] */
+	0x00000000, /* [0x0292] */
+	0x00000000, /* [0x0293] */
+	0x00000000, /* [0x0294] */
+	0x00000000, /* [0x0295] */
+	0x00000000, /* [0x0296] */
+	0x00000000, /* [0x0297] */
+	0x00000000, /* [0x0298] */
+	0x00000000, /* [0x0299] */
+	0x00000000, /* [0x029A] */
+	0x00000000, /* [0x029B] */
+	0x00000000, /* [0x029C] */
+	0x00000000, /* [0x029D] */
+	0x00000000, /* [0x029E] */
+	0x00000000, /* [0x029F] */
+	0x00000000, /* [0x02A0] */
+};
+
+/* Fixups for the IBs in _a5xx_critical_pkts_mem03 */
+static const struct adreno_critical_fixup critical_pkt_mem03_fixups[] = {
+	{ 2, 3, 3, 0x0780 },
+	{ 6, 7, 2, 0x0000 },
+	{ 98, 99, 1, 0x0000 },
+	{ 112, 113, 1, 0x0480 },
+	{ 115, 116, 1, 0x0400 },
+	{ 126, 127, 1, 0x0080 },
+	{ 131, 132, 2, 0x0108 },
+	{ 137, 138, 1, 0x00A0 },
+	{ 141, 142, 2, 0x0108 },
+	{ 147, 148, 1, 0x0080 },
+	{ 150, 151, 1, 0x00C0 },
+	{ 174, 175, 3, 0x0780 },
+	{ 378, 379, 1, 0x0000 },
+	{ 392, 393, 1, 0x0480 },
+	{ 395, 396, 1, 0x0400 },
+	{ 408, 409, 1, 0x0080 },
+	{ 413, 414, 2, 0x0108 },
+	{ 419, 420, 1, 0x00A0 },
+	{ 423, 424, 2, 0x0108 },
+	{ 429, 430, 1, 0x0080 },
+	{ 432, 433, 1, 0x00C0 },
+	{ 462, 463, 0, 0x0700 },
+	{ 472, 473, 2, 0x0110 },
+	{ 550, 551, 1, 0x0500 },
+	{ 561, 562, 1, 0x0600 },
+	{ 566, 567, 1, 0x0700 },
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a5xx_perfcounter.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a5xx_perfcounter.c
@@ -0,0 +1,695 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a5xx.h"
+#include "adreno_perfcounter.h"
+#include "adreno_pm4types.h"
+#include "kgsl_device.h"
+
+#define VBIF2_PERF_CNT_SEL_MASK 0x7F
+/* offset of clear register from select register */
+#define VBIF2_PERF_CLR_REG_SEL_OFF 8
+/* offset of enable register from select register */
+#define VBIF2_PERF_EN_REG_SEL_OFF 16
+/* offset of clear register from the enable register */
+#define VBIF2_PERF_PWR_CLR_REG_EN_OFF 8
+
+static void a5xx_counter_load(struct adreno_device *adreno_dev,
+		struct adreno_perfcount_register *reg)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int index = reg->load_bit / 32;
+	u32 enable = BIT(reg->load_bit & 31);
+
+	kgsl_regwrite(device, A5XX_RBBM_PERFCTR_LOAD_VALUE_LO,
+		lower_32_bits(reg->value));
+
+	kgsl_regwrite(device, A5XX_RBBM_PERFCTR_LOAD_VALUE_HI,
+		upper_32_bits(reg->value));
+
+	kgsl_regwrite(device, A5XX_RBBM_PERFCTR_LOAD_CMD0 + index, enable);
+}
+
+static u64 a5xx_counter_read_norestore(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 hi, lo;
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	return ((((u64) hi) << 32) | lo) + reg->value;
+}
+
+static int a5xx_counter_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	kgsl_regwrite(device, reg->select, countable);
+	reg->value = 0;
+
+	return 0;
+}
+
+static int a5xx_counter_inline_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	struct adreno_ringbuffer *rb = &adreno_dev->ringbuffers[0];
+	u32 cmds[3];
+	int ret;
+
+	if (!(device->state == KGSL_STATE_ACTIVE))
+		return a5xx_counter_enable(adreno_dev, group, counter,
+			countable);
+
+	cmds[0]  = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+	cmds[1] = cp_type4_packet(reg->select, 1);
+	cmds[2] = countable;
+
+	/* submit to highest priority RB always */
+	ret = a5xx_ringbuffer_addcmds(adreno_dev, rb, NULL,
+		F_NOTPROTECTED, cmds, 3, 0, NULL);
+
+	if (ret)
+		return ret;
+
+	/*
+	 * schedule dispatcher to make sure rb[0] is run, because
+	 * if the current RB is not rb[0] and gpu is idle then
+	 * rb[0] will not get scheduled to run
+	 */
+	if (adreno_dev->cur_rb != rb)
+		adreno_dispatcher_schedule(device);
+
+	/* wait for the above commands submitted to complete */
+	ret = adreno_ringbuffer_waittimestamp(rb, rb->timestamp,
+		ADRENO_IDLE_TIMEOUT);
+
+	if (ret) {
+		/*
+		 * If we were woken up because of cancelling rb events
+		 * either due to soft reset or adreno_stop, ignore the
+		 * error and return 0 here. The perfcounter is already
+		 * set up in software and it will be programmed in
+		 * hardware when we wake up or come up after soft reset,
+		 * by adreno_perfcounter_restore.
+		 */
+		if (ret == -EAGAIN)
+			ret = 0;
+		else
+			dev_err(device->dev,
+				     "Perfcounter %s/%u/%u start via commands failed %d\n",
+				     group->name, counter, countable, ret);
+	}
+
+	if (!ret)
+		reg->value = 0;
+
+	return ret;
+}
+
+static int a5xx_counter_rbbm_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	if (adreno_is_a540(adreno_dev) && countable == A5XX_RBBM_ALWAYS_COUNT)
+		return -EINVAL;
+
+	return a5xx_counter_inline_enable(adreno_dev, group, counter,
+			countable);
+}
+
+static u64 a5xx_counter_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32  hi, lo;
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	return (((u64) hi) << 32) | lo;
+}
+
+static int a5xx_counter_vbif_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	if (countable > VBIF2_PERF_CNT_SEL_MASK)
+		return -EINVAL;
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regwrite(device,
+		reg->select - VBIF2_PERF_CLR_REG_SEL_OFF, 1);
+	kgsl_regwrite(device,
+		reg->select - VBIF2_PERF_CLR_REG_SEL_OFF, 0);
+	kgsl_regwrite(device,
+		reg->select, countable & VBIF2_PERF_CNT_SEL_MASK);
+	/* enable reg is 8 DWORDS before select reg */
+	kgsl_regwrite(device,
+		reg->select - VBIF2_PERF_EN_REG_SEL_OFF, 1);
+
+	kgsl_regwrite(device, reg->select, countable);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int a5xx_counter_vbif_pwr_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regwrite(device, reg->select +
+		VBIF2_PERF_PWR_CLR_REG_EN_OFF, 1);
+	kgsl_regwrite(device, reg->select +
+		VBIF2_PERF_PWR_CLR_REG_EN_OFF, 0);
+	kgsl_regwrite(device, reg->select, 1);
+
+	reg->value = 0;
+
+	return 0;
+}
+
+static int a5xx_counter_alwayson_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	return 0;
+}
+
+static u64 a5xx_counter_alwayson_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	return a5xx_read_alwayson(adreno_dev) + reg->value;
+}
+
+static int a5xx_counter_pwr_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	kgsl_regwrite(device, reg->select, countable);
+	kgsl_regwrite(device, A5XX_GPMU_POWER_COUNTER_ENABLE, 1);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int a5xx_counter_pwr_gpmu_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	unsigned int shift = (counter << 3) % (sizeof(unsigned int) * 8);
+
+	if (adreno_is_a530(adreno_dev)) {
+		if (countable > 43)
+			return -EINVAL;
+	} else if (adreno_is_a540(adreno_dev)) {
+		if (countable > 47)
+			return -EINVAL;
+	}
+
+	kgsl_regrmw(device, reg->select, 0xff << shift, countable << shift);
+	kgsl_regwrite(device, A5XX_GPMU_POWER_COUNTER_ENABLE, 1);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int a5xx_counter_pwr_alwayson_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	kgsl_regwrite(device, A5XX_GPMU_ALWAYS_ON_COUNTER_RESET, 1);
+
+	reg->value = 0;
+	return 0;
+}
+
+static struct adreno_perfcount_register a5xx_perfcounters_cp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CP_0_LO,
+		A5XX_RBBM_PERFCTR_CP_0_HI, 0, A5XX_CP_PERFCTR_CP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CP_1_LO,
+		A5XX_RBBM_PERFCTR_CP_1_HI, 1, A5XX_CP_PERFCTR_CP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CP_2_LO,
+		A5XX_RBBM_PERFCTR_CP_2_HI, 2, A5XX_CP_PERFCTR_CP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CP_3_LO,
+		A5XX_RBBM_PERFCTR_CP_3_HI, 3, A5XX_CP_PERFCTR_CP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CP_4_LO,
+		A5XX_RBBM_PERFCTR_CP_4_HI, 4, A5XX_CP_PERFCTR_CP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CP_5_LO,
+		A5XX_RBBM_PERFCTR_CP_5_HI, 5, A5XX_CP_PERFCTR_CP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CP_6_LO,
+		A5XX_RBBM_PERFCTR_CP_6_HI, 6, A5XX_CP_PERFCTR_CP_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CP_7_LO,
+		A5XX_RBBM_PERFCTR_CP_7_HI, 7, A5XX_CP_PERFCTR_CP_SEL_7 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_rbbm[] = {
+	/*
+	 * A5XX_RBBM_PERFCTR_RBBM_0 is used for frequency scaling and omitted
+	 * from the poool of available counters
+	 */
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RBBM_1_LO,
+		A5XX_RBBM_PERFCTR_RBBM_1_HI, 9, A5XX_RBBM_PERFCTR_RBBM_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RBBM_2_LO,
+		A5XX_RBBM_PERFCTR_RBBM_2_HI, 10, A5XX_RBBM_PERFCTR_RBBM_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RBBM_3_LO,
+		A5XX_RBBM_PERFCTR_RBBM_3_HI, 11, A5XX_RBBM_PERFCTR_RBBM_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_pc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_PC_0_LO,
+		A5XX_RBBM_PERFCTR_PC_0_HI, 12, A5XX_PC_PERFCTR_PC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_PC_1_LO,
+		A5XX_RBBM_PERFCTR_PC_1_HI, 13, A5XX_PC_PERFCTR_PC_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_PC_2_LO,
+		A5XX_RBBM_PERFCTR_PC_2_HI, 14, A5XX_PC_PERFCTR_PC_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_PC_3_LO,
+		A5XX_RBBM_PERFCTR_PC_3_HI, 15, A5XX_PC_PERFCTR_PC_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_PC_4_LO,
+		A5XX_RBBM_PERFCTR_PC_4_HI, 16, A5XX_PC_PERFCTR_PC_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_PC_5_LO,
+		A5XX_RBBM_PERFCTR_PC_5_HI, 17, A5XX_PC_PERFCTR_PC_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_PC_6_LO,
+		A5XX_RBBM_PERFCTR_PC_6_HI, 18, A5XX_PC_PERFCTR_PC_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_PC_7_LO,
+		A5XX_RBBM_PERFCTR_PC_7_HI, 19, A5XX_PC_PERFCTR_PC_SEL_7 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_vfd[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VFD_0_LO,
+		A5XX_RBBM_PERFCTR_VFD_0_HI, 20, A5XX_VFD_PERFCTR_VFD_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VFD_1_LO,
+		A5XX_RBBM_PERFCTR_VFD_1_HI, 21, A5XX_VFD_PERFCTR_VFD_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VFD_2_LO,
+		A5XX_RBBM_PERFCTR_VFD_2_HI, 22, A5XX_VFD_PERFCTR_VFD_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VFD_3_LO,
+		A5XX_RBBM_PERFCTR_VFD_3_HI, 23, A5XX_VFD_PERFCTR_VFD_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VFD_4_LO,
+		A5XX_RBBM_PERFCTR_VFD_4_HI, 24, A5XX_VFD_PERFCTR_VFD_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VFD_5_LO,
+		A5XX_RBBM_PERFCTR_VFD_5_HI, 25, A5XX_VFD_PERFCTR_VFD_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VFD_6_LO,
+		A5XX_RBBM_PERFCTR_VFD_6_HI, 26, A5XX_VFD_PERFCTR_VFD_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VFD_7_LO,
+		A5XX_RBBM_PERFCTR_VFD_7_HI, 27, A5XX_VFD_PERFCTR_VFD_SEL_7 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_hlsq[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_HLSQ_0_LO,
+		A5XX_RBBM_PERFCTR_HLSQ_0_HI, 28, A5XX_HLSQ_PERFCTR_HLSQ_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_HLSQ_1_LO,
+		A5XX_RBBM_PERFCTR_HLSQ_1_HI, 29, A5XX_HLSQ_PERFCTR_HLSQ_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_HLSQ_2_LO,
+		A5XX_RBBM_PERFCTR_HLSQ_2_HI, 30, A5XX_HLSQ_PERFCTR_HLSQ_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_HLSQ_3_LO,
+		A5XX_RBBM_PERFCTR_HLSQ_3_HI, 31, A5XX_HLSQ_PERFCTR_HLSQ_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_HLSQ_4_LO,
+		A5XX_RBBM_PERFCTR_HLSQ_4_HI, 32, A5XX_HLSQ_PERFCTR_HLSQ_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_HLSQ_5_LO,
+		A5XX_RBBM_PERFCTR_HLSQ_5_HI, 33, A5XX_HLSQ_PERFCTR_HLSQ_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_HLSQ_6_LO,
+		A5XX_RBBM_PERFCTR_HLSQ_6_HI, 34, A5XX_HLSQ_PERFCTR_HLSQ_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_HLSQ_7_LO,
+		A5XX_RBBM_PERFCTR_HLSQ_7_HI, 35, A5XX_HLSQ_PERFCTR_HLSQ_SEL_7 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_vpc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VPC_0_LO,
+		A5XX_RBBM_PERFCTR_VPC_0_HI, 36, A5XX_VPC_PERFCTR_VPC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VPC_1_LO,
+		A5XX_RBBM_PERFCTR_VPC_1_HI, 37, A5XX_VPC_PERFCTR_VPC_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VPC_2_LO,
+		A5XX_RBBM_PERFCTR_VPC_2_HI, 38, A5XX_VPC_PERFCTR_VPC_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VPC_3_LO,
+		A5XX_RBBM_PERFCTR_VPC_3_HI, 39, A5XX_VPC_PERFCTR_VPC_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_ccu[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CCU_0_LO,
+		A5XX_RBBM_PERFCTR_CCU_0_HI, 40, A5XX_RB_PERFCTR_CCU_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CCU_1_LO,
+		A5XX_RBBM_PERFCTR_CCU_1_HI, 41, A5XX_RB_PERFCTR_CCU_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CCU_2_LO,
+		A5XX_RBBM_PERFCTR_CCU_2_HI, 42, A5XX_RB_PERFCTR_CCU_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CCU_3_LO,
+		A5XX_RBBM_PERFCTR_CCU_3_HI, 43, A5XX_RB_PERFCTR_CCU_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_tse[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TSE_0_LO,
+		A5XX_RBBM_PERFCTR_TSE_0_HI, 44, A5XX_GRAS_PERFCTR_TSE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TSE_1_LO,
+		A5XX_RBBM_PERFCTR_TSE_1_HI, 45, A5XX_GRAS_PERFCTR_TSE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TSE_2_LO,
+		A5XX_RBBM_PERFCTR_TSE_2_HI, 46, A5XX_GRAS_PERFCTR_TSE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TSE_3_LO,
+		A5XX_RBBM_PERFCTR_TSE_3_HI, 47, A5XX_GRAS_PERFCTR_TSE_SEL_3 },
+};
+
+
+static struct adreno_perfcount_register a5xx_perfcounters_ras[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RAS_0_LO,
+		A5XX_RBBM_PERFCTR_RAS_0_HI, 48, A5XX_GRAS_PERFCTR_RAS_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RAS_1_LO,
+		A5XX_RBBM_PERFCTR_RAS_1_HI, 49, A5XX_GRAS_PERFCTR_RAS_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RAS_2_LO,
+		A5XX_RBBM_PERFCTR_RAS_2_HI, 50, A5XX_GRAS_PERFCTR_RAS_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RAS_3_LO,
+		A5XX_RBBM_PERFCTR_RAS_3_HI, 51, A5XX_GRAS_PERFCTR_RAS_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_uche[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_UCHE_0_LO,
+		A5XX_RBBM_PERFCTR_UCHE_0_HI, 52, A5XX_UCHE_PERFCTR_UCHE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_UCHE_1_LO,
+		A5XX_RBBM_PERFCTR_UCHE_1_HI, 53, A5XX_UCHE_PERFCTR_UCHE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_UCHE_2_LO,
+		A5XX_RBBM_PERFCTR_UCHE_2_HI, 54, A5XX_UCHE_PERFCTR_UCHE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_UCHE_3_LO,
+		A5XX_RBBM_PERFCTR_UCHE_3_HI, 55, A5XX_UCHE_PERFCTR_UCHE_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_UCHE_4_LO,
+		A5XX_RBBM_PERFCTR_UCHE_4_HI, 56, A5XX_UCHE_PERFCTR_UCHE_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_UCHE_5_LO,
+		A5XX_RBBM_PERFCTR_UCHE_5_HI, 57, A5XX_UCHE_PERFCTR_UCHE_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_UCHE_6_LO,
+		A5XX_RBBM_PERFCTR_UCHE_6_HI, 58, A5XX_UCHE_PERFCTR_UCHE_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_UCHE_7_LO,
+		A5XX_RBBM_PERFCTR_UCHE_7_HI, 59, A5XX_UCHE_PERFCTR_UCHE_SEL_7 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_tp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TP_0_LO,
+		A5XX_RBBM_PERFCTR_TP_0_HI, 60, A5XX_TPL1_PERFCTR_TP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TP_1_LO,
+		A5XX_RBBM_PERFCTR_TP_1_HI, 61, A5XX_TPL1_PERFCTR_TP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TP_2_LO,
+		A5XX_RBBM_PERFCTR_TP_2_HI, 62, A5XX_TPL1_PERFCTR_TP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TP_3_LO,
+		A5XX_RBBM_PERFCTR_TP_3_HI, 63, A5XX_TPL1_PERFCTR_TP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TP_4_LO,
+		A5XX_RBBM_PERFCTR_TP_4_HI, 64, A5XX_TPL1_PERFCTR_TP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TP_5_LO,
+		A5XX_RBBM_PERFCTR_TP_5_HI, 65, A5XX_TPL1_PERFCTR_TP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TP_6_LO,
+		A5XX_RBBM_PERFCTR_TP_6_HI, 66, A5XX_TPL1_PERFCTR_TP_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_TP_7_LO,
+		A5XX_RBBM_PERFCTR_TP_7_HI, 67, A5XX_TPL1_PERFCTR_TP_SEL_7 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_sp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_0_LO,
+		A5XX_RBBM_PERFCTR_SP_0_HI, 68, A5XX_SP_PERFCTR_SP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_1_LO,
+		A5XX_RBBM_PERFCTR_SP_1_HI, 69, A5XX_SP_PERFCTR_SP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_2_LO,
+		A5XX_RBBM_PERFCTR_SP_2_HI, 70, A5XX_SP_PERFCTR_SP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_3_LO,
+		A5XX_RBBM_PERFCTR_SP_3_HI, 71, A5XX_SP_PERFCTR_SP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_4_LO,
+		A5XX_RBBM_PERFCTR_SP_4_HI, 72, A5XX_SP_PERFCTR_SP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_5_LO,
+		A5XX_RBBM_PERFCTR_SP_5_HI, 73, A5XX_SP_PERFCTR_SP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_6_LO,
+		A5XX_RBBM_PERFCTR_SP_6_HI, 74, A5XX_SP_PERFCTR_SP_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_7_LO,
+		A5XX_RBBM_PERFCTR_SP_7_HI, 75, A5XX_SP_PERFCTR_SP_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_8_LO,
+		A5XX_RBBM_PERFCTR_SP_8_HI, 76, A5XX_SP_PERFCTR_SP_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_9_LO,
+		A5XX_RBBM_PERFCTR_SP_9_HI, 77, A5XX_SP_PERFCTR_SP_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_10_LO,
+		A5XX_RBBM_PERFCTR_SP_10_HI, 78, A5XX_SP_PERFCTR_SP_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_SP_11_LO,
+		A5XX_RBBM_PERFCTR_SP_11_HI, 79, A5XX_SP_PERFCTR_SP_SEL_11 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_rb[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RB_0_LO,
+		A5XX_RBBM_PERFCTR_RB_0_HI, 80, A5XX_RB_PERFCTR_RB_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RB_1_LO,
+		A5XX_RBBM_PERFCTR_RB_1_HI, 81, A5XX_RB_PERFCTR_RB_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RB_2_LO,
+		A5XX_RBBM_PERFCTR_RB_2_HI, 82, A5XX_RB_PERFCTR_RB_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RB_3_LO,
+		A5XX_RBBM_PERFCTR_RB_3_HI, 83, A5XX_RB_PERFCTR_RB_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RB_4_LO,
+		A5XX_RBBM_PERFCTR_RB_4_HI, 84, A5XX_RB_PERFCTR_RB_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RB_5_LO,
+		A5XX_RBBM_PERFCTR_RB_5_HI, 85, A5XX_RB_PERFCTR_RB_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RB_6_LO,
+		A5XX_RBBM_PERFCTR_RB_6_HI, 86, A5XX_RB_PERFCTR_RB_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_RB_7_LO,
+		A5XX_RBBM_PERFCTR_RB_7_HI, 87, A5XX_RB_PERFCTR_RB_SEL_7 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_vsc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VSC_0_LO,
+		A5XX_RBBM_PERFCTR_VSC_0_HI, 88, A5XX_VSC_PERFCTR_VSC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_VSC_1_LO,
+		A5XX_RBBM_PERFCTR_VSC_1_HI, 89, A5XX_VSC_PERFCTR_VSC_SEL_1 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_lrz[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_LRZ_0_LO,
+		A5XX_RBBM_PERFCTR_LRZ_0_HI, 90, A5XX_GRAS_PERFCTR_LRZ_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_LRZ_1_LO,
+		A5XX_RBBM_PERFCTR_LRZ_1_HI, 91, A5XX_GRAS_PERFCTR_LRZ_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_LRZ_2_LO,
+		A5XX_RBBM_PERFCTR_LRZ_2_HI, 92, A5XX_GRAS_PERFCTR_LRZ_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_LRZ_3_LO,
+		A5XX_RBBM_PERFCTR_LRZ_3_HI, 93, A5XX_GRAS_PERFCTR_LRZ_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_cmp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CMP_0_LO,
+		A5XX_RBBM_PERFCTR_CMP_0_HI, 94, A5XX_RB_PERFCTR_CMP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CMP_1_LO,
+		A5XX_RBBM_PERFCTR_CMP_1_HI, 95, A5XX_RB_PERFCTR_CMP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CMP_2_LO,
+		A5XX_RBBM_PERFCTR_CMP_2_HI, 96, A5XX_RB_PERFCTR_CMP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_PERFCTR_CMP_3_LO,
+		A5XX_RBBM_PERFCTR_CMP_3_HI, 97, A5XX_RB_PERFCTR_CMP_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_vbif[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_VBIF_PERF_CNT_LOW0,
+		A5XX_VBIF_PERF_CNT_HIGH0, -1, A5XX_VBIF_PERF_CNT_SEL0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_VBIF_PERF_CNT_LOW1,
+		A5XX_VBIF_PERF_CNT_HIGH1, -1, A5XX_VBIF_PERF_CNT_SEL1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_VBIF_PERF_CNT_LOW2,
+		A5XX_VBIF_PERF_CNT_HIGH2, -1, A5XX_VBIF_PERF_CNT_SEL2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_VBIF_PERF_CNT_LOW3,
+		A5XX_VBIF_PERF_CNT_HIGH3, -1, A5XX_VBIF_PERF_CNT_SEL3 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_vbif_pwr[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_VBIF_PERF_PWR_CNT_LOW0,
+		A5XX_VBIF_PERF_PWR_CNT_HIGH0, -1, A5XX_VBIF_PERF_PWR_CNT_EN0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_VBIF_PERF_PWR_CNT_LOW1,
+		A5XX_VBIF_PERF_PWR_CNT_HIGH1, -1, A5XX_VBIF_PERF_PWR_CNT_EN1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_VBIF_PERF_PWR_CNT_LOW2,
+		A5XX_VBIF_PERF_PWR_CNT_HIGH2, -1, A5XX_VBIF_PERF_PWR_CNT_EN2 },
+};
+
+static struct adreno_perfcount_register a5xx_perfcounters_alwayson[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RBBM_ALWAYSON_COUNTER_LO,
+		A5XX_RBBM_ALWAYSON_COUNTER_HI, -1 },
+};
+
+static struct adreno_perfcount_register a5xx_pwrcounters_sp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_SP_POWER_COUNTER_0_LO,
+		A5XX_SP_POWER_COUNTER_0_HI, -1, A5XX_SP_POWERCTR_SP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_SP_POWER_COUNTER_1_LO,
+		A5XX_SP_POWER_COUNTER_1_HI, -1, A5XX_SP_POWERCTR_SP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_SP_POWER_COUNTER_2_LO,
+		A5XX_SP_POWER_COUNTER_2_HI, -1, A5XX_SP_POWERCTR_SP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_SP_POWER_COUNTER_3_LO,
+		A5XX_SP_POWER_COUNTER_3_HI, -1, A5XX_SP_POWERCTR_SP_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_pwrcounters_tp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_TP_POWER_COUNTER_0_LO,
+		A5XX_TP_POWER_COUNTER_0_HI, -1, A5XX_TPL1_POWERCTR_TP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_TP_POWER_COUNTER_1_LO,
+		A5XX_TP_POWER_COUNTER_1_HI, -1, A5XX_TPL1_POWERCTR_TP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_TP_POWER_COUNTER_2_LO,
+		A5XX_TP_POWER_COUNTER_2_HI, -1, A5XX_TPL1_POWERCTR_TP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_TP_POWER_COUNTER_3_LO,
+		A5XX_TP_POWER_COUNTER_3_HI, -1, A5XX_TPL1_POWERCTR_TP_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_pwrcounters_rb[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RB_POWER_COUNTER_0_LO,
+		A5XX_RB_POWER_COUNTER_0_HI, -1, A5XX_RB_POWERCTR_RB_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RB_POWER_COUNTER_1_LO,
+		A5XX_RB_POWER_COUNTER_1_HI, -1, A5XX_RB_POWERCTR_RB_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RB_POWER_COUNTER_2_LO,
+		A5XX_RB_POWER_COUNTER_2_HI, -1, A5XX_RB_POWERCTR_RB_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_RB_POWER_COUNTER_3_LO,
+		A5XX_RB_POWER_COUNTER_3_HI, -1, A5XX_RB_POWERCTR_RB_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_pwrcounters_ccu[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_CCU_POWER_COUNTER_0_LO,
+		A5XX_CCU_POWER_COUNTER_0_HI, -1, A5XX_RB_POWERCTR_CCU_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_CCU_POWER_COUNTER_1_LO,
+		A5XX_CCU_POWER_COUNTER_1_HI, -1, A5XX_RB_POWERCTR_CCU_SEL_1 },
+};
+
+static struct adreno_perfcount_register a5xx_pwrcounters_uche[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_UCHE_POWER_COUNTER_0_LO,
+		A5XX_UCHE_POWER_COUNTER_0_HI, -1,
+		A5XX_UCHE_POWERCTR_UCHE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_UCHE_POWER_COUNTER_1_LO,
+		A5XX_UCHE_POWER_COUNTER_1_HI, -1,
+		A5XX_UCHE_POWERCTR_UCHE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_UCHE_POWER_COUNTER_2_LO,
+		A5XX_UCHE_POWER_COUNTER_2_HI, -1,
+		A5XX_UCHE_POWERCTR_UCHE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_UCHE_POWER_COUNTER_3_LO,
+		A5XX_UCHE_POWER_COUNTER_3_HI, -1,
+		A5XX_UCHE_POWERCTR_UCHE_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_pwrcounters_cp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_CP_POWER_COUNTER_0_LO,
+		A5XX_CP_POWER_COUNTER_0_HI, -1, A5XX_CP_POWERCTR_CP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_CP_POWER_COUNTER_1_LO,
+		A5XX_CP_POWER_COUNTER_1_HI, -1, A5XX_CP_POWERCTR_CP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_CP_POWER_COUNTER_2_LO,
+		A5XX_CP_POWER_COUNTER_2_HI, -1, A5XX_CP_POWERCTR_CP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_CP_POWER_COUNTER_3_LO,
+		A5XX_CP_POWER_COUNTER_3_HI, -1, A5XX_CP_POWERCTR_CP_SEL_3 },
+};
+
+static struct adreno_perfcount_register a5xx_pwrcounters_gpmu[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_GPMU_POWER_COUNTER_0_LO,
+		A5XX_GPMU_POWER_COUNTER_0_HI, -1,
+		A5XX_GPMU_POWER_COUNTER_SELECT_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_GPMU_POWER_COUNTER_1_LO,
+		A5XX_GPMU_POWER_COUNTER_1_HI, -1,
+		A5XX_GPMU_POWER_COUNTER_SELECT_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_GPMU_POWER_COUNTER_2_LO,
+		A5XX_GPMU_POWER_COUNTER_2_HI, -1,
+		A5XX_GPMU_POWER_COUNTER_SELECT_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_GPMU_POWER_COUNTER_3_LO,
+		A5XX_GPMU_POWER_COUNTER_3_HI, -1,
+		A5XX_GPMU_POWER_COUNTER_SELECT_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_GPMU_POWER_COUNTER_4_LO,
+		A5XX_GPMU_POWER_COUNTER_4_HI, -1,
+		A5XX_GPMU_POWER_COUNTER_SELECT_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_GPMU_POWER_COUNTER_5_LO,
+		A5XX_GPMU_POWER_COUNTER_5_HI, -1,
+		A5XX_GPMU_POWER_COUNTER_SELECT_1 },
+};
+
+static struct adreno_perfcount_register a5xx_pwrcounters_alwayson[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A5XX_GPMU_ALWAYS_ON_COUNTER_LO,
+		A5XX_GPMU_ALWAYS_ON_COUNTER_HI, -1 },
+};
+
+#define A5XX_PERFCOUNTER_GROUP(offset, name, enable, read, load) \
+	ADRENO_PERFCOUNTER_GROUP(a5xx, offset, name, enable, read, load)
+
+#define A5XX_PERFCOUNTER_GROUP_FLAGS(offset, name, flags, enable, read, load) \
+	ADRENO_PERFCOUNTER_GROUP_FLAGS(a5xx, offset, name, flags, enable, \
+			read, load)
+
+#define A5XX_POWER_COUNTER_GROUP(offset, name, enable, read) \
+	[KGSL_PERFCOUNTER_GROUP_##offset##_PWR] = { a5xx_pwrcounters_##name, \
+	ARRAY_SIZE(a5xx_pwrcounters_##name), __stringify(name##_pwr), 0, \
+	enable, read, NULL }
+
+#define A5XX_REGULAR_PERFCOUNTER_GROUP(offset, name) \
+	A5XX_PERFCOUNTER_GROUP(offset, name, a5xx_counter_inline_enable, \
+			a5xx_counter_read, a5xx_counter_load)
+
+static struct adreno_perfcount_group a5xx_perfcounter_groups
+				[KGSL_PERFCOUNTER_GROUP_MAX] = {
+	A5XX_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	A5XX_PERFCOUNTER_GROUP(RBBM, rbbm,
+		a5xx_counter_rbbm_enable, a5xx_counter_read, a5xx_counter_load),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(VFD, vfd),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(HLSQ, hlsq),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(CCU, ccu),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(CMP, cmp),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(TSE, tse),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(RAS, ras),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(LRZ, lrz),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(UCHE, uche),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(TP, tp),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(SP, sp),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(RB, rb),
+	A5XX_REGULAR_PERFCOUNTER_GROUP(VSC, vsc),
+	A5XX_PERFCOUNTER_GROUP(VBIF, vbif,
+		a5xx_counter_vbif_enable, a5xx_counter_read_norestore, NULL),
+	A5XX_PERFCOUNTER_GROUP_FLAGS(VBIF_PWR, vbif_pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		a5xx_counter_vbif_pwr_enable,
+		a5xx_counter_read_norestore, NULL),
+	A5XX_PERFCOUNTER_GROUP_FLAGS(ALWAYSON, alwayson,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		a5xx_counter_alwayson_enable, a5xx_counter_alwayson_read, NULL),
+	A5XX_POWER_COUNTER_GROUP(SP, sp,
+		a5xx_counter_pwr_enable, a5xx_counter_read_norestore),
+	A5XX_POWER_COUNTER_GROUP(TP, tp,
+		a5xx_counter_pwr_enable, a5xx_counter_read_norestore),
+	A5XX_POWER_COUNTER_GROUP(RB, rb,
+		a5xx_counter_pwr_enable, a5xx_counter_read_norestore),
+	A5XX_POWER_COUNTER_GROUP(CCU, ccu,
+		a5xx_counter_pwr_enable, a5xx_counter_read_norestore),
+	A5XX_POWER_COUNTER_GROUP(UCHE, uche,
+		a5xx_counter_pwr_enable, a5xx_counter_read_norestore),
+	A5XX_POWER_COUNTER_GROUP(CP, cp,
+		a5xx_counter_pwr_enable, a5xx_counter_read_norestore),
+	A5XX_POWER_COUNTER_GROUP(GPMU, gpmu,
+		a5xx_counter_pwr_gpmu_enable, a5xx_counter_read_norestore),
+	A5XX_POWER_COUNTER_GROUP(ALWAYSON, alwayson,
+		a5xx_counter_pwr_alwayson_enable, a5xx_counter_read_norestore),
+};
+
+const struct adreno_perfcounters adreno_a5xx_perfcounters = {
+	a5xx_perfcounter_groups,
+	ARRAY_SIZE(a5xx_perfcounter_groups),
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a5xx_preempt.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a5xx_preempt.c
@@ -0,0 +1,548 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2017,2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a5xx.h"
+#include "adreno_pm4types.h"
+#include "adreno_trace.h"
+
+#define PREEMPT_RECORD(_field) \
+		offsetof(struct a5xx_cp_preemption_record, _field)
+
+#define PREEMPT_SMMU_RECORD(_field) \
+		offsetof(struct a5xx_cp_smmu_info, _field)
+
+static void _update_wptr(struct adreno_device *adreno_dev, bool reset_timer)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb = adreno_dev->cur_rb;
+	unsigned int wptr;
+	unsigned long flags;
+
+	spin_lock_irqsave(&rb->preempt_lock, flags);
+
+	kgsl_regread(device, A5XX_CP_RB_WPTR, &wptr);
+
+	if (wptr != rb->wptr) {
+		kgsl_regwrite(device, A5XX_CP_RB_WPTR, rb->wptr);
+		/*
+		 * In case something got submitted while preemption was on
+		 * going, reset the timer.
+		 */
+		reset_timer = true;
+	}
+
+	if (reset_timer)
+		rb->dispatch_q.expires = jiffies +
+			msecs_to_jiffies(adreno_drawobj_timeout);
+
+	spin_unlock_irqrestore(&rb->preempt_lock, flags);
+}
+
+static void _a5xx_preemption_done(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status;
+
+	/*
+	 * In the very unlikely case that the power is off, do nothing - the
+	 * state will be reset on power up and everybody will be happy
+	 */
+
+	if (!kgsl_state_is_awake(device))
+		return;
+
+	kgsl_regread(device, A5XX_CP_CONTEXT_SWITCH_CNTL, &status);
+
+	if (status != 0) {
+		dev_err(device->dev,
+			     "Preemption not complete: status=%X cur=%d R/W=%X/%X next=%d R/W=%X/%X\n",
+			     status, adreno_dev->cur_rb->id,
+			     adreno_get_rptr(adreno_dev->cur_rb),
+			     adreno_dev->cur_rb->wptr,
+			     adreno_dev->next_rb->id,
+			     adreno_get_rptr(adreno_dev->next_rb),
+			     adreno_dev->next_rb->wptr);
+
+		/* Set a fault and restart */
+		adreno_dispatcher_fault(adreno_dev, ADRENO_PREEMPT_FAULT);
+
+		return;
+	}
+
+	del_timer_sync(&adreno_dev->preempt.timer);
+
+	trace_adreno_preempt_done(adreno_dev->cur_rb->id, adreno_dev->next_rb->id, 0, 0);
+
+	/* Clean up all the bits */
+	adreno_dev->prev_rb = adreno_dev->cur_rb;
+	adreno_dev->cur_rb = adreno_dev->next_rb;
+	adreno_dev->next_rb = NULL;
+
+	/* Update the wptr for the new command queue */
+	_update_wptr(adreno_dev, true);
+
+	/* Update the dispatcher timer for the new command queue */
+	mod_timer(&adreno_dev->dispatcher.timer,
+		adreno_dev->cur_rb->dispatch_q.expires);
+
+	/* Clear the preempt state */
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+}
+
+static void _a5xx_preemption_fault(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status;
+
+	/*
+	 * If the power is on check the preemption status one more time - if it
+	 * was successful then just transition to the complete state
+	 */
+	if (kgsl_state_is_awake(device)) {
+		kgsl_regread(device, A5XX_CP_CONTEXT_SWITCH_CNTL, &status);
+
+		if (status == 0) {
+			adreno_set_preempt_state(adreno_dev,
+				ADRENO_PREEMPT_COMPLETE);
+
+			adreno_dispatcher_schedule(device);
+			return;
+		}
+	}
+
+	dev_err(device->dev,
+		     "Preemption timed out: cur=%d R/W=%X/%X, next=%d R/W=%X/%X\n",
+		     adreno_dev->cur_rb->id,
+		     adreno_get_rptr(adreno_dev->cur_rb),
+		     adreno_dev->cur_rb->wptr,
+		     adreno_dev->next_rb->id,
+		     adreno_get_rptr(adreno_dev->next_rb),
+		     adreno_dev->next_rb->wptr);
+
+	adreno_dispatcher_fault(adreno_dev, ADRENO_PREEMPT_FAULT);
+}
+
+static void _a5xx_preemption_worker(struct work_struct *work)
+{
+	struct adreno_preemption *preempt = container_of(work,
+		struct adreno_preemption, work);
+	struct adreno_device *adreno_dev = container_of(preempt,
+		struct adreno_device, preempt);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Need to take the mutex to make sure that the power stays on */
+	mutex_lock(&device->mutex);
+
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_FAULTED))
+		_a5xx_preemption_fault(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+}
+
+/* Find the highest priority active ringbuffer */
+static struct adreno_ringbuffer *a5xx_next_ringbuffer(
+		struct adreno_device *adreno_dev)
+{
+	struct adreno_ringbuffer *rb;
+	unsigned long flags;
+	unsigned int i;
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		bool empty;
+
+		spin_lock_irqsave(&rb->preempt_lock, flags);
+		empty = adreno_rb_empty(rb);
+		spin_unlock_irqrestore(&rb->preempt_lock, flags);
+
+		if (!empty)
+			return rb;
+	}
+
+	return NULL;
+}
+
+void a5xx_preemption_trigger(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_ringbuffer *next;
+	uint64_t ttbr0;
+	unsigned int contextidr;
+	unsigned long flags;
+
+	/* Put ourselves into a possible trigger state */
+	if (!adreno_move_preempt_state(adreno_dev,
+		ADRENO_PREEMPT_NONE, ADRENO_PREEMPT_START))
+		return;
+
+	/* Get the next ringbuffer to preempt in */
+	next = a5xx_next_ringbuffer(adreno_dev);
+
+	/*
+	 * Nothing to do if every ringbuffer is empty or if the current
+	 * ringbuffer is the only active one
+	 */
+	if (next == NULL || next == adreno_dev->cur_rb) {
+		/*
+		 * Update any critical things that might have been skipped while
+		 * we were looking for a new ringbuffer
+		 */
+
+		if (next != NULL) {
+			_update_wptr(adreno_dev, false);
+
+			mod_timer(&adreno_dev->dispatcher.timer,
+				adreno_dev->cur_rb->dispatch_q.expires);
+		}
+
+		adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+		return;
+	}
+
+	/* Turn off the dispatcher timer */
+	del_timer(&adreno_dev->dispatcher.timer);
+
+	/*
+	 * This is the most critical section - we need to take care not to race
+	 * until we have programmed the CP for the switch
+	 */
+
+	spin_lock_irqsave(&next->preempt_lock, flags);
+
+	/* Get the pagetable from the pagetable info. */
+	kgsl_sharedmem_readq(device->scratch, &ttbr0,
+		SCRATCH_RB_OFFSET(next->id, ttbr0));
+	kgsl_sharedmem_readl(device->scratch, &contextidr,
+		SCRATCH_RB_OFFSET(next->id, contextidr));
+
+	kgsl_sharedmem_writel(next->preemption_desc,
+		PREEMPT_RECORD(wptr), next->wptr);
+
+	spin_unlock_irqrestore(&next->preempt_lock, flags);
+
+	/* And write it to the smmu info */
+	if (kgsl_mmu_is_perprocess(&device->mmu)) {
+		kgsl_sharedmem_writeq(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(ttbr0), ttbr0);
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(context_idr), contextidr);
+	}
+
+	kgsl_regwrite(device, A5XX_CP_CONTEXT_SWITCH_RESTORE_ADDR_LO,
+		lower_32_bits(next->preemption_desc->gpuaddr));
+	kgsl_regwrite(device, A5XX_CP_CONTEXT_SWITCH_RESTORE_ADDR_HI,
+		upper_32_bits(next->preemption_desc->gpuaddr));
+
+	adreno_dev->next_rb = next;
+
+	/* Start the timer to detect a stuck preemption */
+	mod_timer(&adreno_dev->preempt.timer,
+		jiffies + msecs_to_jiffies(ADRENO_PREEMPT_TIMEOUT));
+
+	trace_adreno_preempt_trigger(adreno_dev->cur_rb->id, adreno_dev->next_rb->id,
+		1, 0);
+
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_TRIGGERED);
+
+	/* Trigger the preemption */
+	kgsl_regwrite(device, A5XX_CP_CONTEXT_SWITCH_CNTL, 1);
+}
+
+void a5xx_preempt_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status;
+
+	if (!adreno_move_preempt_state(adreno_dev,
+		ADRENO_PREEMPT_TRIGGERED, ADRENO_PREEMPT_PENDING))
+		return;
+
+	kgsl_regread(device, A5XX_CP_CONTEXT_SWITCH_CNTL, &status);
+
+	if (status != 0) {
+		dev_err(KGSL_DEVICE(adreno_dev)->dev,
+			     "preempt interrupt with non-zero status: %X\n",
+			     status);
+
+		/*
+		 * Under the assumption that this is a race between the
+		 * interrupt and the register, schedule the worker to clean up.
+		 * If the status still hasn't resolved itself by the time we get
+		 * there then we have to assume something bad happened
+		 */
+		adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_COMPLETE);
+		adreno_dispatcher_schedule(device);
+		return;
+	}
+
+	del_timer(&adreno_dev->preempt.timer);
+
+	trace_adreno_preempt_done(adreno_dev->cur_rb->id, adreno_dev->next_rb->id, 0, 0);
+
+	adreno_dev->prev_rb = adreno_dev->cur_rb;
+	adreno_dev->cur_rb = adreno_dev->next_rb;
+	adreno_dev->next_rb = NULL;
+
+	/* Update the wptr if it changed while preemption was ongoing */
+	_update_wptr(adreno_dev, true);
+
+	/* Update the dispatcher timer for the new command queue */
+	mod_timer(&adreno_dev->dispatcher.timer,
+		adreno_dev->cur_rb->dispatch_q.expires);
+
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+
+	a5xx_preemption_trigger(adreno_dev);
+}
+
+void a5xx_preemption_schedule(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return;
+
+	mutex_lock(&device->mutex);
+
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_COMPLETE))
+		_a5xx_preemption_done(adreno_dev);
+
+	a5xx_preemption_trigger(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+}
+
+u32 a5xx_preemption_pre_ibsubmit(struct adreno_device *adreno_dev,
+			struct adreno_ringbuffer *rb,
+			struct adreno_context *drawctxt, u32 *cmds)
+{
+	unsigned int *cmds_orig = cmds;
+	uint64_t gpuaddr = rb->preemption_desc->gpuaddr;
+	unsigned int preempt_style = 0;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	if (drawctxt) {
+		/*
+		 * Preemption from secure to unsecure needs Zap shader to be
+		 * run to clear all secure content. CP does not know during
+		 * preemption if it is switching between secure and unsecure
+		 * contexts so restrict Secure contexts to be preempted at
+		 * ringbuffer level.
+		 */
+		if (drawctxt->base.flags & KGSL_CONTEXT_SECURE)
+			preempt_style = KGSL_CONTEXT_PREEMPT_STYLE_RINGBUFFER;
+		else
+			preempt_style = FIELD_GET(KGSL_CONTEXT_PREEMPT_STYLE_MASK,
+				drawctxt->base.flags);
+	}
+
+	/*
+	 * CP_PREEMPT_ENABLE_GLOBAL(global preemption) can only be set by KMD
+	 * in ringbuffer.
+	 * 1) set global preemption to 0x0 to disable global preemption.
+	 *    Only RB level preemption is allowed in this mode
+	 * 2) Set global preemption to defer(0x2) for finegrain preemption.
+	 *    when global preemption is set to defer(0x2),
+	 *    CP_PREEMPT_ENABLE_LOCAL(local preemption) determines the
+	 *    preemption point. Local preemption
+	 *    can be enabled by both UMD(within IB) and KMD.
+	 */
+	*cmds++ = cp_type7_packet(CP_PREEMPT_ENABLE_GLOBAL, 1);
+	*cmds++ = ((preempt_style == KGSL_CONTEXT_PREEMPT_STYLE_FINEGRAIN)
+				? 2 : 0);
+
+	/* Turn CP protection OFF */
+	cmds += cp_protected_mode(adreno_dev, cmds, 0);
+
+	/*
+	 * CP during context switch will save context switch info to
+	 * a5xx_cp_preemption_record pointed by CONTEXT_SWITCH_SAVE_ADDR
+	 */
+	*cmds++ = cp_type4_packet(A5XX_CP_CONTEXT_SWITCH_SAVE_ADDR_LO, 1);
+	*cmds++ = lower_32_bits(gpuaddr);
+	*cmds++ = cp_type4_packet(A5XX_CP_CONTEXT_SWITCH_SAVE_ADDR_HI, 1);
+	*cmds++ = upper_32_bits(gpuaddr);
+
+	/* Turn CP protection ON */
+	cmds += cp_protected_mode(adreno_dev, cmds, 1);
+
+	/*
+	 * Enable local preemption for finegrain preemption in case of
+	 * a misbehaving IB
+	 */
+	if (preempt_style == KGSL_CONTEXT_PREEMPT_STYLE_FINEGRAIN) {
+		*cmds++ = cp_type7_packet(CP_PREEMPT_ENABLE_LOCAL, 1);
+		*cmds++ = 1;
+	} else {
+		*cmds++ = cp_type7_packet(CP_PREEMPT_ENABLE_LOCAL, 1);
+		*cmds++ = 0;
+	}
+
+	/* Enable CP_CONTEXT_SWITCH_YIELD packets in the IB2s */
+	*cmds++ = cp_type7_packet(CP_YIELD_ENABLE, 1);
+	*cmds++ = 2;
+
+	return (unsigned int) (cmds - cmds_orig);
+}
+
+unsigned int a5xx_preemption_post_ibsubmit(struct adreno_device *adreno_dev,
+	unsigned int *cmds)
+{
+	int dwords = 0;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	cmds[dwords++] = cp_type7_packet(CP_CONTEXT_SWITCH_YIELD, 4);
+	/* Write NULL to the address to skip the data write */
+	dwords += cp_gpuaddr(adreno_dev, &cmds[dwords], 0x0);
+	cmds[dwords++] = 1;
+	/* generate interrupt on preemption completion */
+	cmds[dwords++] = 1;
+
+	return dwords;
+}
+
+void a5xx_preemption_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_ringbuffer *rb;
+	unsigned int i;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return;
+
+	/* Force the state to be clear */
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+
+	/* Only set up smmu info when per-process pagetables are enabled */
+
+	if (kgsl_mmu_is_perprocess(&device->mmu)) {
+		/* smmu_info is allocated and mapped in a5xx_preemption_iommu_init */
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(magic), A5XX_CP_SMMU_INFO_MAGIC_REF);
+		kgsl_sharedmem_writeq(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(ttbr0), MMU_DEFAULT_TTBR0(device));
+
+		/* The CP doesn't use the asid record, so poison it */
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(asid), 0xDECAFBAD);
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(context_idr), 0);
+
+		kgsl_regwrite(device, A5XX_CP_CONTEXT_SWITCH_SMMU_INFO_LO,
+			lower_32_bits(iommu->smmu_info->gpuaddr));
+
+		kgsl_regwrite(device, A5XX_CP_CONTEXT_SWITCH_SMMU_INFO_HI,
+			upper_32_bits(iommu->smmu_info->gpuaddr));
+	}
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		/*
+		 * preemption_desc is allocated and mapped at init time,
+		 * so no need to check sharedmem_writel return value
+		 */
+		kgsl_sharedmem_writel(rb->preemption_desc,
+			PREEMPT_RECORD(rptr), 0);
+		kgsl_sharedmem_writel(rb->preemption_desc,
+			PREEMPT_RECORD(wptr), 0);
+
+		adreno_ringbuffer_set_pagetable(device, rb,
+			device->mmu.defaultpagetable);
+	}
+
+}
+
+static int a5xx_preemption_ringbuffer_init(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, uint64_t counteraddr)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (IS_ERR_OR_NULL(rb->preemption_desc))
+		rb->preemption_desc = kgsl_allocate_global(device,
+			A5XX_CP_CTXRECORD_SIZE_IN_BYTES, SZ_16K, 0,
+			KGSL_MEMDESC_PRIVILEGED, "preemption_desc");
+
+	if (IS_ERR(rb->preemption_desc))
+		return PTR_ERR(rb->preemption_desc);
+
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(magic), A5XX_CP_CTXRECORD_MAGIC_REF);
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(info), 0);
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(data), 0);
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(cntl), A5XX_CP_RB_CNTL_DEFAULT);
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(rptr), 0);
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(wptr), 0);
+	kgsl_sharedmem_writeq(rb->preemption_desc,
+		PREEMPT_RECORD(rptr_addr), SCRATCH_RB_GPU_ADDR(device,
+			rb->id, rptr));
+	kgsl_sharedmem_writeq(rb->preemption_desc,
+		PREEMPT_RECORD(rbase), rb->buffer_desc->gpuaddr);
+	kgsl_sharedmem_writeq(rb->preemption_desc,
+		PREEMPT_RECORD(counter), counteraddr);
+
+	return 0;
+}
+
+int a5xx_preemption_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_preemption *preempt = &adreno_dev->preempt;
+	struct adreno_ringbuffer *rb;
+	int ret;
+	unsigned int i;
+	uint64_t addr;
+
+	/* We are dependent on IOMMU to make preemption go on the CP side */
+	if (kgsl_mmu_get_mmutype(device) != KGSL_MMU_TYPE_IOMMU)
+		return -ENODEV;
+
+	INIT_WORK(&preempt->work, _a5xx_preemption_worker);
+
+	/* Allocate mem for storing preemption counters */
+	if (IS_ERR_OR_NULL(preempt->scratch))
+		preempt->scratch = kgsl_allocate_global(device,
+			adreno_dev->num_ringbuffers *
+			A5XX_CP_CTXRECORD_PREEMPTION_COUNTER_SIZE, 0, 0, 0,
+			"preemption_counters");
+
+	ret = PTR_ERR_OR_ZERO(preempt->scratch);
+	if (ret)
+		return ret;
+
+	addr = preempt->scratch->gpuaddr;
+
+	/* Allocate mem for storing preemption switch record */
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		ret = a5xx_preemption_ringbuffer_init(adreno_dev, rb, addr);
+		if (ret)
+			return ret;
+
+		addr += A5XX_CP_CTXRECORD_PREEMPTION_COUNTER_SIZE;
+	}
+
+	/* Allocate mem for storing preemption smmu record */
+	if (kgsl_mmu_is_perprocess(&device->mmu) && IS_ERR_OR_NULL(iommu->smmu_info))
+		iommu->smmu_info = kgsl_allocate_global(device, PAGE_SIZE, 0,
+			KGSL_MEMFLAGS_GPUREADONLY, KGSL_MEMDESC_PRIVILEGED,
+			"smmu_info");
+
+	if (IS_ERR(iommu->smmu_info))
+		return PTR_ERR(iommu->smmu_info);
+
+	set_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv);
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a5xx_ringbuffer.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a5xx_ringbuffer.c
@@ -0,0 +1,530 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a5xx.h"
+#include "adreno_pm4types.h"
+#include "adreno_ringbuffer.h"
+#include "adreno_trace.h"
+#include "kgsl_trace.h"
+
+static int a5xx_rb_pagetable_switch(struct kgsl_device *device,
+		struct adreno_context *drawctxt,
+		struct adreno_ringbuffer *rb,
+		struct kgsl_pagetable *pagetable, u32 *cmds)
+{
+	u64 ttbr0 = kgsl_mmu_pagetable_get_ttbr0(pagetable);
+	u32 id = drawctxt ? drawctxt->base.id : 0;
+
+	if (pagetable == device->mmu.defaultpagetable)
+		return 0;
+
+	cmds[0] = cp_type7_packet(CP_SMMU_TABLE_UPDATE, 3);
+	cmds[1] = lower_32_bits(ttbr0);
+	cmds[2] = upper_32_bits(ttbr0);
+	cmds[3] = id;
+
+	cmds[4] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+	cmds[5] = cp_type7_packet(CP_WAIT_FOR_ME, 0);
+	cmds[6] = cp_type4_packet(A5XX_CP_CNTL, 1);
+	cmds[7] = 1;
+
+	cmds[8] = cp_type7_packet(CP_MEM_WRITE, 5);
+	cmds[9] = lower_32_bits(SCRATCH_RB_GPU_ADDR(device,
+			rb->id, ttbr0));
+	cmds[10] = upper_32_bits(SCRATCH_RB_GPU_ADDR(device,
+			rb->id, ttbr0));
+	cmds[11] = lower_32_bits(ttbr0);
+	cmds[12] = upper_32_bits(ttbr0);
+	cmds[13] = id;
+
+	cmds[14] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+	cmds[15] = cp_type7_packet(CP_WAIT_FOR_ME, 0);
+	cmds[16] = cp_type4_packet(A5XX_CP_CNTL, 1);
+	cmds[17] = 0;
+
+	return 18;
+}
+
+#define RB_SOPTIMESTAMP(device, rb) \
+	       MEMSTORE_RB_GPU_ADDR(device, rb, soptimestamp)
+#define CTXT_SOPTIMESTAMP(device, drawctxt) \
+	       MEMSTORE_ID_GPU_ADDR(device, (drawctxt)->base.id, soptimestamp)
+
+#define RB_EOPTIMESTAMP(device, rb) \
+	       MEMSTORE_RB_GPU_ADDR(device, rb, eoptimestamp)
+#define CTXT_EOPTIMESTAMP(device, drawctxt) \
+	       MEMSTORE_ID_GPU_ADDR(device, (drawctxt)->base.id, eoptimestamp)
+
+int a5xx_ringbuffer_submit(struct adreno_ringbuffer *rb,
+		struct adreno_submit_time *time, bool sync)
+{
+	struct adreno_device *adreno_dev = ADRENO_RB_DEVICE(rb);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned long flags;
+
+	adreno_get_submit_time(adreno_dev, rb, time);
+	adreno_profile_submit_time(time);
+
+	if (sync) {
+		u32 *cmds = adreno_ringbuffer_allocspace(rb, 3);
+
+		if (IS_ERR(cmds))
+			return PTR_ERR(cmds);
+
+		cmds[0] = cp_type7_packet(CP_WHERE_AM_I, 2);
+		cmds[1] = lower_32_bits(SCRATCH_RB_GPU_ADDR(device, rb->id,
+				rptr));
+		cmds[2] = upper_32_bits(SCRATCH_RB_GPU_ADDR(device, rb->id,
+				rptr));
+	}
+
+	spin_lock_irqsave(&rb->preempt_lock, flags);
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE)) {
+		if (adreno_dev->cur_rb == rb) {
+			kgsl_pwrscale_busy(device);
+			kgsl_regwrite(device, A5XX_CP_RB_WPTR, rb->_wptr);
+		}
+	}
+
+	rb->wptr = rb->_wptr;
+	spin_unlock_irqrestore(&rb->preempt_lock, flags);
+
+	return 0;
+}
+
+int a5xx_ringbuffer_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int i;
+
+	if (IS_ERR_OR_NULL(device->scratch))
+		device->scratch = kgsl_allocate_global(device, PAGE_SIZE,
+			0, 0, KGSL_MEMDESC_RANDOM | KGSL_MEMDESC_PRIVILEGED,
+			"scratch");
+
+	if (IS_ERR(device->scratch))
+		return PTR_ERR(device->scratch);
+
+	adreno_dev->cur_rb = &(adreno_dev->ringbuffers[0]);
+
+	if (!adreno_preemption_feature_set(adreno_dev)) {
+		adreno_dev->num_ringbuffers = 1;
+		return adreno_ringbuffer_setup(adreno_dev,
+			&adreno_dev->ringbuffers[0], 0);
+	}
+
+	adreno_dev->num_ringbuffers = ARRAY_SIZE(adreno_dev->ringbuffers);
+
+	for (i = 0; i < adreno_dev->num_ringbuffers; i++) {
+		int ret;
+
+		ret = adreno_ringbuffer_setup(adreno_dev,
+			&adreno_dev->ringbuffers[i], i);
+		if (ret)
+			return ret;
+	}
+
+	timer_setup(&adreno_dev->preempt.timer, adreno_preemption_timer, 0);
+	a5xx_preemption_init(adreno_dev);
+	return 0;
+}
+
+#define A5XX_SUBMIT_MAX 64
+
+int a5xx_ringbuffer_addcmds(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 flags, u32 *in, u32 dwords, u32 timestamp,
+		struct adreno_submit_time *time)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	static u32 sequence;
+	u32 size = A5XX_SUBMIT_MAX + dwords;
+	u32 *cmds, index = 0;
+	u64 profile_gpuaddr;
+	u32 profile_dwords;
+
+	if (adreno_drawctxt_detached(drawctxt))
+		return -ENOENT;
+
+	if (adreno_gpu_fault(adreno_dev) != 0)
+		return -EPROTO;
+
+	rb->timestamp++;
+
+	if (drawctxt)
+		drawctxt->internal_timestamp = rb->timestamp;
+
+	cmds = adreno_ringbuffer_allocspace(rb, size);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	/* Identify the start of a command */
+	cmds[index++] = cp_type7_packet(CP_NOP, 1);
+	cmds[index++] = drawctxt ? CMD_IDENTIFIER : CMD_INTERNAL_IDENTIFIER;
+
+	/* 14 dwords */
+	index += a5xx_preemption_pre_ibsubmit(adreno_dev, rb, drawctxt,
+		&cmds[index]);
+
+	profile_gpuaddr = adreno_profile_preib_processing(adreno_dev,
+		drawctxt, &profile_dwords);
+
+	if (profile_gpuaddr) {
+		cmds[index++] = cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+		cmds[index++] = lower_32_bits(profile_gpuaddr);
+		cmds[index++] = upper_32_bits(profile_gpuaddr);
+		cmds[index++] = profile_dwords;
+	}
+
+	if (drawctxt) {
+		cmds[index++] = cp_type7_packet(CP_MEM_WRITE, 3);
+		cmds[index++] = lower_32_bits(CTXT_SOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = upper_32_bits(CTXT_SOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = timestamp;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[index++] = lower_32_bits(RB_SOPTIMESTAMP(device, rb));
+	cmds[index++] = upper_32_bits(RB_SOPTIMESTAMP(device, rb));
+	cmds[index++] = rb->timestamp;
+
+	if (IS_SECURE(flags)) {
+		cmds[index++] = cp_type7_packet(CP_SET_SECURE_MODE, 1);
+		cmds[index++] = 1;
+	}
+
+	if (IS_NOTPROTECTED(flags)) {
+		cmds[index++] = cp_type7_packet(CP_SET_PROTECTED_MODE, 1);
+		cmds[index++] = 0;
+	}
+
+	memcpy(&cmds[index], in, dwords << 2);
+	index += dwords;
+
+	if (IS_NOTPROTECTED(flags)) {
+		cmds[index++] = cp_type7_packet(CP_SET_PROTECTED_MODE, 1);
+		cmds[index++] = 1;
+	}
+
+	/* 4 dwords */
+	profile_gpuaddr = adreno_profile_postib_processing(adreno_dev,
+		drawctxt, &profile_dwords);
+
+	if (profile_gpuaddr) {
+		cmds[index++] = cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+		cmds[index++] = lower_32_bits(profile_gpuaddr);
+		cmds[index++] = upper_32_bits(profile_gpuaddr);
+		cmds[index++] = profile_dwords;
+	}
+
+	if (!adreno_is_a510(adreno_dev) &&
+		test_bit(KGSL_FT_PAGEFAULT_GPUHALT_ENABLE,
+			&device->mmu.pfpolicy))
+		cmds[index++] = cp_type7_packet(CP_WAIT_MEM_WRITES, 0);
+
+	/*
+	 * Do a unique memory write from the GPU to assist in early detection of
+	 * interrupt storms
+	 */
+
+	cmds[index++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[index++] = lower_32_bits(MEMSTORE_ID_GPU_ADDR(device,
+				KGSL_MEMSTORE_GLOBAL, ref_wait_ts));
+	cmds[index++] = upper_32_bits(MEMSTORE_ID_GPU_ADDR(device,
+				KGSL_MEMSTORE_GLOBAL, ref_wait_ts));
+	cmds[index++] = ++sequence;
+
+	/*
+	 * If this is an internal command, just write the ringbuffer timestamp,
+	 * otherwise, write both
+	 */
+	if (!drawctxt) {
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_FLUSH_TS | (1 << 31);
+		cmds[index++] = lower_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = upper_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = rb->timestamp;
+	} else {
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_FLUSH_TS | (1 << 31);
+		cmds[index++] = lower_32_bits(CTXT_EOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = upper_32_bits(CTXT_EOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = timestamp;
+
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_FLUSH_TS;
+		cmds[index++] = lower_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = upper_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = rb->timestamp;
+	}
+
+	if (IS_WFI(flags))
+		cmds[index++] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+
+	if (IS_SECURE(flags)) {
+		cmds[index++] = cp_type7_packet(CP_SET_SECURE_MODE, 1);
+		cmds[index++] = 0;
+	}
+
+	/* 5 dwords */
+	index += a5xx_preemption_post_ibsubmit(adreno_dev, &cmds[index]);
+
+	/* Adjust the thing for the number of bytes we actually wrote */
+	rb->_wptr -= (size - index);
+
+	a5xx_ringbuffer_submit(rb, time,
+		!adreno_is_preemption_enabled(adreno_dev));
+
+	return 0;
+}
+
+static u32 a5xx_get_alwayson_counter(struct adreno_device *adreno_dev,
+		u32 *cmds, u64 gpuaddr)
+{
+	cmds[0] = cp_type7_packet(CP_REG_TO_MEM, 3);
+	cmds[1] = A5XX_RBBM_ALWAYSON_COUNTER_LO;
+
+	/* On some targets the upper 32 bits are not reliable */
+	if (ADRENO_GPUREV(adreno_dev) > ADRENO_REV_A530)
+		cmds[1] |= (1 << 30) | (2 << 18);
+
+	cmds[2] = lower_32_bits(gpuaddr);
+	cmds[3] = upper_32_bits(gpuaddr);
+
+	return 4;
+}
+
+/* This is the maximum possible size for 64 bit targets */
+#define PROFILE_IB_DWORDS 4
+#define PROFILE_IB_SLOTS (PAGE_SIZE / (PROFILE_IB_DWORDS << 2))
+
+static u64 a5xx_get_user_profiling_ib(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct kgsl_drawobj_cmd *cmdobj,
+		u32 target_offset, u32 *cmds)
+{
+	u32 offset, *ib, dwords;
+	u64 gpuaddr;
+
+	if (IS_ERR(rb->profile_desc))
+		return 0;
+
+	offset = rb->profile_index * (PROFILE_IB_DWORDS << 2);
+	ib = rb->profile_desc->hostptr + offset;
+	gpuaddr = rb->profile_desc->gpuaddr + offset;
+	dwords = a5xx_get_alwayson_counter(adreno_dev, ib,
+		cmdobj->profiling_buffer_gpuaddr + target_offset);
+
+	cmds[0] = cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+	cmds[1] = lower_32_bits(gpuaddr);
+	cmds[2] = upper_32_bits(gpuaddr);
+	cmds[3] = dwords;
+
+	rb->profile_index = (rb->profile_index + 1) % PROFILE_IB_SLOTS;
+
+	return 4;
+}
+
+static int a5xx_rb_context_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_pagetable *pagetable =
+		adreno_drawctxt_get_pagetable(drawctxt);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int count = 0;
+	u32 cmds[32];
+
+	if (adreno_drawctxt_get_pagetable(rb->drawctxt_active) != pagetable)
+		count += a5xx_rb_pagetable_switch(device, drawctxt,
+				rb, pagetable, cmds);
+
+	cmds[count++] = cp_type7_packet(CP_NOP, 1);
+	cmds[count++] = CONTEXT_TO_MEM_IDENTIFIER;
+
+	cmds[count++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[count++] = lower_32_bits(MEMSTORE_RB_GPU_ADDR(device, rb,
+				current_context));
+	cmds[count++] = upper_32_bits(MEMSTORE_RB_GPU_ADDR(device, rb,
+				current_context));
+	cmds[count++] = drawctxt->base.id;
+
+	cmds[count++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[count++] = lower_32_bits(MEMSTORE_ID_GPU_ADDR(device,
+		KGSL_MEMSTORE_GLOBAL, current_context));
+	cmds[count++] = upper_32_bits(MEMSTORE_ID_GPU_ADDR(device,
+		KGSL_MEMSTORE_GLOBAL, current_context));
+	cmds[count++] = drawctxt->base.id;
+
+	cmds[count++] = cp_type4_packet(A5XX_UCHE_INVALIDATE0, 1);
+	cmds[count++] = 0x12;
+
+	return a5xx_ringbuffer_addcmds(adreno_dev, rb, NULL, F_NOTPROTECTED,
+			cmds, count, 0, NULL);
+}
+
+static int a5xx_drawctxt_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (rb->drawctxt_active == drawctxt)
+		return 0;
+
+	if (kgsl_context_detached(&drawctxt->base))
+		return -ENOENT;
+
+	if (!_kgsl_context_get(&drawctxt->base))
+		return -ENOENT;
+
+	trace_adreno_drawctxt_switch(rb, drawctxt);
+
+	a5xx_rb_context_switch(adreno_dev, rb, drawctxt);
+
+	/* Release the current drawctxt as soon as the new one is switched */
+	adreno_put_drawctxt_on_timestamp(device, rb->drawctxt_active,
+		rb, rb->timestamp);
+
+	rb->drawctxt_active = drawctxt;
+	return 0;
+}
+
+
+#define A5XX_USER_PROFILE_IB(dev, rb, cmdobj, cmds, field) \
+	a5xx_get_user_profiling_ib((dev), (rb), (cmdobj), \
+		offsetof(struct kgsl_drawobj_profiling_buffer, field), \
+		(cmds))
+
+#define A5XX_KERNEL_PROFILE(dev, cmdobj, cmds, field) \
+	a5xx_get_alwayson_counter((dev), (cmds), \
+		(dev)->profile_buffer->gpuaddr + \
+			ADRENO_DRAWOBJ_PROFILE_OFFSET((cmdobj)->profile_index, \
+				field))
+
+#define A5XX_COMMAND_DWORDS 32
+
+int a5xx_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj, u32 flags,
+		struct adreno_submit_time *time)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	struct adreno_ringbuffer *rb = drawctxt->rb;
+	int ret = 0, numibs = 0, index = 0;
+	u32 *cmds;
+
+	/* Count the number of IBs (if we are not skipping) */
+	if (!IS_SKIP(flags)) {
+		struct list_head *tmp;
+
+		list_for_each(tmp, &cmdobj->cmdlist)
+			numibs++;
+	}
+
+	cmds = kmalloc((A5XX_COMMAND_DWORDS + (numibs * 5)) << 2, GFP_KERNEL);
+	if (!cmds) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_NOP, 1);
+	cmds[index++] = START_IB_IDENTIFIER;
+
+	/* Kernel profiling: 4 dwords */
+	if (IS_KERNEL_PROFILE(flags))
+		index += A5XX_KERNEL_PROFILE(adreno_dev, cmdobj, &cmds[index],
+			started);
+
+	/* User profiling: 4 dwords */
+	if (IS_USER_PROFILE(flags))
+		index += A5XX_USER_PROFILE_IB(adreno_dev, rb, cmdobj,
+			&cmds[index], gpu_ticks_submitted);
+
+	if (numibs) {
+		struct kgsl_memobj_node *ib;
+
+		list_for_each_entry(ib, &cmdobj->cmdlist, node) {
+			if (ib->priv & MEMOBJ_SKIP ||
+			    (ib->flags & KGSL_CMDLIST_CTXTSWITCH_PREAMBLE
+			     && !IS_PREAMBLE(flags)))
+				cmds[index++] = cp_type7_packet(CP_NOP, 4);
+
+			cmds[index++] =
+				cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+			cmds[index++] = lower_32_bits(ib->gpuaddr);
+			cmds[index++] = upper_32_bits(ib->gpuaddr);
+
+			/* Double check that IB_PRIV is never set */
+			cmds[index++] = (ib->size >> 2) & 0xfffff;
+		}
+	}
+
+	/*
+	 * SRM -- set render mode (ex binning, direct render etc)
+	 * SRM is set by UMD usually at start of IB to tell CP the type of
+	 * preemption.
+	 * KMD needs to set SRM to NULL to indicate CP that rendering is
+	 * done by IB.
+	 */
+	cmds[index++] = cp_type7_packet(CP_SET_RENDER_MODE, 5);
+	cmds[index++] = 0;
+	cmds[index++] = 0;
+	cmds[index++] = 0;
+	cmds[index++] = 0;
+	cmds[index++] = 0;
+
+	cmds[index++] = cp_type7_packet(CP_YIELD_ENABLE, 1);
+	cmds[index++] = 1;
+
+	/* 4 dwords */
+	if (IS_KERNEL_PROFILE(flags))
+		index += A5XX_KERNEL_PROFILE(adreno_dev, cmdobj, &cmds[index],
+			retired);
+
+	/* 4 dwords */
+	if (IS_USER_PROFILE(flags))
+		index += A5XX_USER_PROFILE_IB(adreno_dev, rb, cmdobj,
+			&cmds[index], gpu_ticks_retired);
+
+	cmds[index++] = cp_type7_packet(CP_NOP, 1);
+	cmds[index++] = END_IB_IDENTIFIER;
+
+	ret = a5xx_drawctxt_switch(adreno_dev, rb, drawctxt);
+
+	/*
+	 * In the unlikely event of an error in the drawctxt switch,
+	 * treat it like a hang
+	 */
+	if (ret) {
+		/*
+		 * It is "normal" to get a -ENOSPC or a -ENOENT. Don't log it,
+		 * the upper layers know how to handle it
+		 */
+		if (ret != -ENOSPC && ret != -ENOENT)
+			dev_err(device->dev,
+				     "Unable to switch draw context: %d\n",
+				     ret);
+		goto done;
+	}
+
+	adreno_drawobj_set_constraint(device, drawobj);
+
+	ret = a5xx_ringbuffer_addcmds(adreno_dev, drawctxt->rb, drawctxt,
+		flags, cmds, index, drawobj->timestamp, time);
+
+done:
+	trace_kgsl_issueibcmds(device, drawctxt->base.id, numibs,
+		drawobj->timestamp, drawobj->flags, ret, drawctxt->type);
+
+	kfree(cmds);
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a5xx_snapshot.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a5xx_snapshot.c
@@ -0,0 +1,1221 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2015-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a5xx.h"
+#include "adreno_snapshot.h"
+
+enum a5xx_rbbm_debbus_id {
+	A5XX_RBBM_DBGBUS_CP          = 0x1,
+	A5XX_RBBM_DBGBUS_RBBM        = 0x2,
+	A5XX_RBBM_DBGBUS_VBIF        = 0x3,
+	A5XX_RBBM_DBGBUS_HLSQ        = 0x4,
+	A5XX_RBBM_DBGBUS_UCHE        = 0x5,
+	A5XX_RBBM_DBGBUS_DPM         = 0x6,
+	A5XX_RBBM_DBGBUS_TESS        = 0x7,
+	A5XX_RBBM_DBGBUS_PC          = 0x8,
+	A5XX_RBBM_DBGBUS_VFDP        = 0x9,
+	A5XX_RBBM_DBGBUS_VPC         = 0xa,
+	A5XX_RBBM_DBGBUS_TSE         = 0xb,
+	A5XX_RBBM_DBGBUS_RAS         = 0xc,
+	A5XX_RBBM_DBGBUS_VSC         = 0xd,
+	A5XX_RBBM_DBGBUS_COM         = 0xe,
+	A5XX_RBBM_DBGBUS_DCOM        = 0xf,
+	A5XX_RBBM_DBGBUS_LRZ         = 0x10,
+	A5XX_RBBM_DBGBUS_A2D_DSP     = 0x11,
+	A5XX_RBBM_DBGBUS_CCUFCHE     = 0x12,
+	A5XX_RBBM_DBGBUS_GPMU        = 0x13,
+	A5XX_RBBM_DBGBUS_RBP         = 0x14,
+	A5XX_RBBM_DBGBUS_HM          = 0x15,
+	A5XX_RBBM_DBGBUS_RBBM_CFG    = 0x16,
+	A5XX_RBBM_DBGBUS_VBIF_CX     = 0x17,
+	A5XX_RBBM_DBGBUS_GPC         = 0x1d,
+	A5XX_RBBM_DBGBUS_LARC        = 0x1e,
+	A5XX_RBBM_DBGBUS_HLSQ_SPTP   = 0x1f,
+	A5XX_RBBM_DBGBUS_RB_0        = 0x20,
+	A5XX_RBBM_DBGBUS_RB_1        = 0x21,
+	A5XX_RBBM_DBGBUS_RB_2        = 0x22,
+	A5XX_RBBM_DBGBUS_RB_3        = 0x23,
+	A5XX_RBBM_DBGBUS_CCU_0       = 0x28,
+	A5XX_RBBM_DBGBUS_CCU_1       = 0x29,
+	A5XX_RBBM_DBGBUS_CCU_2       = 0x2a,
+	A5XX_RBBM_DBGBUS_CCU_3       = 0x2b,
+	A5XX_RBBM_DBGBUS_A2D_RAS_0   = 0x30,
+	A5XX_RBBM_DBGBUS_A2D_RAS_1   = 0x31,
+	A5XX_RBBM_DBGBUS_A2D_RAS_2   = 0x32,
+	A5XX_RBBM_DBGBUS_A2D_RAS_3   = 0x33,
+	A5XX_RBBM_DBGBUS_VFD_0       = 0x38,
+	A5XX_RBBM_DBGBUS_VFD_1       = 0x39,
+	A5XX_RBBM_DBGBUS_VFD_2       = 0x3a,
+	A5XX_RBBM_DBGBUS_VFD_3       = 0x3b,
+	A5XX_RBBM_DBGBUS_SP_0        = 0x40,
+	A5XX_RBBM_DBGBUS_SP_1        = 0x41,
+	A5XX_RBBM_DBGBUS_SP_2        = 0x42,
+	A5XX_RBBM_DBGBUS_SP_3        = 0x43,
+	A5XX_RBBM_DBGBUS_TPL1_0      = 0x48,
+	A5XX_RBBM_DBGBUS_TPL1_1      = 0x49,
+	A5XX_RBBM_DBGBUS_TPL1_2      = 0x4a,
+	A5XX_RBBM_DBGBUS_TPL1_3      = 0x4b
+};
+
+static const struct adreno_debugbus_block a5xx_debugbus_blocks[] = {
+	{  A5XX_RBBM_DBGBUS_CP, 0x100, },
+	{  A5XX_RBBM_DBGBUS_RBBM, 0x100, },
+	{  A5XX_RBBM_DBGBUS_VBIF, 0x100, },
+	{  A5XX_RBBM_DBGBUS_HLSQ, 0x100, },
+	{  A5XX_RBBM_DBGBUS_UCHE, 0x100, },
+	{  A5XX_RBBM_DBGBUS_DPM, 0x100, },
+	{  A5XX_RBBM_DBGBUS_TESS, 0x100, },
+	{  A5XX_RBBM_DBGBUS_PC, 0x100, },
+	{  A5XX_RBBM_DBGBUS_VFDP, 0x100, },
+	{  A5XX_RBBM_DBGBUS_VPC, 0x100, },
+	{  A5XX_RBBM_DBGBUS_TSE, 0x100, },
+	{  A5XX_RBBM_DBGBUS_RAS, 0x100, },
+	{  A5XX_RBBM_DBGBUS_VSC, 0x100, },
+	{  A5XX_RBBM_DBGBUS_COM, 0x100, },
+	{  A5XX_RBBM_DBGBUS_DCOM, 0x100, },
+	{  A5XX_RBBM_DBGBUS_LRZ, 0x100, },
+	{  A5XX_RBBM_DBGBUS_A2D_DSP, 0x100, },
+	{  A5XX_RBBM_DBGBUS_CCUFCHE, 0x100, },
+	{  A5XX_RBBM_DBGBUS_GPMU, 0x100, },
+	{  A5XX_RBBM_DBGBUS_RBP, 0x100, },
+	{  A5XX_RBBM_DBGBUS_HM, 0x100, },
+	{  A5XX_RBBM_DBGBUS_RBBM_CFG, 0x100, },
+	{  A5XX_RBBM_DBGBUS_VBIF_CX, 0x100, },
+	{  A5XX_RBBM_DBGBUS_GPC, 0x100, },
+	{  A5XX_RBBM_DBGBUS_LARC, 0x100, },
+	{  A5XX_RBBM_DBGBUS_HLSQ_SPTP, 0x100, },
+	{  A5XX_RBBM_DBGBUS_RB_0, 0x100, },
+	{  A5XX_RBBM_DBGBUS_RB_1, 0x100, },
+	{  A5XX_RBBM_DBGBUS_RB_2, 0x100, },
+	{  A5XX_RBBM_DBGBUS_RB_3, 0x100, },
+	{  A5XX_RBBM_DBGBUS_CCU_0, 0x100, },
+	{  A5XX_RBBM_DBGBUS_CCU_1, 0x100, },
+	{  A5XX_RBBM_DBGBUS_CCU_2, 0x100, },
+	{  A5XX_RBBM_DBGBUS_CCU_3, 0x100, },
+	{  A5XX_RBBM_DBGBUS_A2D_RAS_0, 0x100, },
+	{  A5XX_RBBM_DBGBUS_A2D_RAS_1, 0x100, },
+	{  A5XX_RBBM_DBGBUS_A2D_RAS_2, 0x100, },
+	{  A5XX_RBBM_DBGBUS_A2D_RAS_3, 0x100, },
+	{  A5XX_RBBM_DBGBUS_VFD_0, 0x100, },
+	{  A5XX_RBBM_DBGBUS_VFD_1, 0x100, },
+	{  A5XX_RBBM_DBGBUS_VFD_2, 0x100, },
+	{  A5XX_RBBM_DBGBUS_VFD_3, 0x100, },
+	{  A5XX_RBBM_DBGBUS_SP_0, 0x100, },
+	{  A5XX_RBBM_DBGBUS_SP_1, 0x100, },
+	{  A5XX_RBBM_DBGBUS_SP_2, 0x100, },
+	{  A5XX_RBBM_DBGBUS_SP_3, 0x100, },
+	{  A5XX_RBBM_DBGBUS_TPL1_0, 0x100, },
+	{  A5XX_RBBM_DBGBUS_TPL1_1, 0x100, },
+	{  A5XX_RBBM_DBGBUS_TPL1_2, 0x100, },
+	{  A5XX_RBBM_DBGBUS_TPL1_3, 0x100, },
+};
+
+#define A5XX_NUM_AXI_ARB_BLOCKS	2
+#define A5XX_NUM_XIN_BLOCKS	4
+
+/* Width of A5XX_CP_DRAW_STATE_ADDR is 8 bits */
+#define A5XX_CP_DRAW_STATE_ADDR_WIDTH 8
+
+/* a5xx_snapshot_cp_pm4() - Dump PM4 data in snapshot */
+static size_t a5xx_snapshot_cp_pm4(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_PM4);
+	size_t size = fw->size;
+
+	if (remain < DEBUG_SECTION_SZ(size)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP PM4 RAM DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_PM4_RAM;
+	header->size = size;
+
+	memcpy(data, fw->memdesc->hostptr, size * sizeof(uint32_t));
+
+	return DEBUG_SECTION_SZ(size);
+}
+
+/* a5xx_snapshot_cp_pfp() - Dump the PFP data on snapshot */
+static size_t a5xx_snapshot_cp_pfp(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_PFP);
+	int size = fw->size;
+
+	if (remain < DEBUG_SECTION_SZ(size)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP PFP RAM DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_PFP_RAM;
+	header->size = size;
+
+	memcpy(data, fw->memdesc->hostptr, size * sizeof(uint32_t));
+
+	return DEBUG_SECTION_SZ(size);
+}
+
+/* a5xx_rbbm_debug_bus_read() - Read data from trace bus */
+static void a5xx_rbbm_debug_bus_read(struct kgsl_device *device,
+	unsigned int block_id, unsigned int index, unsigned int *val)
+{
+	unsigned int reg;
+
+	reg = (block_id << A5XX_RBBM_CFG_DBGBUS_SEL_PING_BLK_SEL_SHIFT) |
+			(index << A5XX_RBBM_CFG_DBGBUS_SEL_PING_INDEX_SHIFT);
+	kgsl_regwrite(device, A5XX_RBBM_CFG_DBGBUS_SEL_A, reg);
+	kgsl_regwrite(device, A5XX_RBBM_CFG_DBGBUS_SEL_B, reg);
+	kgsl_regwrite(device, A5XX_RBBM_CFG_DBGBUS_SEL_C, reg);
+	kgsl_regwrite(device, A5XX_RBBM_CFG_DBGBUS_SEL_D, reg);
+
+	kgsl_regread(device, A5XX_RBBM_CFG_DBGBUS_TRACE_BUF2, val);
+	val++;
+	kgsl_regread(device, A5XX_RBBM_CFG_DBGBUS_TRACE_BUF1, val);
+
+}
+
+/* a5xx_snapshot_vbif_debugbus() - Dump the VBIF debug data */
+static size_t a5xx_snapshot_vbif_debugbus(struct kgsl_device *device,
+			u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debugbus *header =
+		(struct kgsl_snapshot_debugbus *)buf;
+	struct adreno_debugbus_block *block = priv;
+	int i, j;
+	/*
+	 * Total number of VBIF data words considering 3 sections:
+	 * 2 arbiter blocks of 16 words
+	 * 4 AXI XIN blocks of 18 dwords each
+	 * 4 core clock side XIN blocks of 12 dwords each
+	 */
+	unsigned int dwords = (16 * A5XX_NUM_AXI_ARB_BLOCKS) +
+			(18 * A5XX_NUM_XIN_BLOCKS) + (12 * A5XX_NUM_XIN_BLOCKS);
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	size_t size;
+	unsigned int reg_clk;
+
+	size = (dwords * sizeof(unsigned int)) + sizeof(*header);
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+	header->id = block->block_id;
+	header->count = dwords;
+
+	kgsl_regread(device, A5XX_VBIF_CLKON, &reg_clk);
+	kgsl_regwrite(device, A5XX_VBIF_CLKON, reg_clk |
+			(A5XX_VBIF_CLKON_FORCE_ON_TESTBUS_MASK <<
+			A5XX_VBIF_CLKON_FORCE_ON_TESTBUS_SHIFT));
+	kgsl_regwrite(device, A5XX_VBIF_TEST_BUS1_CTRL0, 0);
+	kgsl_regwrite(device, A5XX_VBIF_TEST_BUS_OUT_CTRL,
+			(A5XX_VBIF_TEST_BUS_OUT_CTRL_EN_MASK <<
+			A5XX_VBIF_TEST_BUS_OUT_CTRL_EN_SHIFT));
+	for (i = 0; i < A5XX_NUM_AXI_ARB_BLOCKS; i++) {
+		kgsl_regwrite(device, A5XX_VBIF_TEST_BUS2_CTRL0,
+			(1 << (i + 16)));
+		for (j = 0; j < 16; j++) {
+			kgsl_regwrite(device, A5XX_VBIF_TEST_BUS2_CTRL1,
+				((j & A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_MASK)
+				<< A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_SHIFT));
+			kgsl_regread(device, A5XX_VBIF_TEST_BUS_OUT,
+					data);
+			data++;
+		}
+	}
+
+	/* XIN blocks AXI side */
+	for (i = 0; i < A5XX_NUM_XIN_BLOCKS; i++) {
+		kgsl_regwrite(device, A5XX_VBIF_TEST_BUS2_CTRL0, 1 << i);
+		for (j = 0; j < 18; j++) {
+			kgsl_regwrite(device, A5XX_VBIF_TEST_BUS2_CTRL1,
+				((j & A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_MASK)
+				<< A5XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_SHIFT));
+			kgsl_regread(device, A5XX_VBIF_TEST_BUS_OUT,
+				data);
+			data++;
+		}
+	}
+
+	/* XIN blocks core clock side */
+	for (i = 0; i < A5XX_NUM_XIN_BLOCKS; i++) {
+		kgsl_regwrite(device, A5XX_VBIF_TEST_BUS1_CTRL0, 1 << i);
+		for (j = 0; j < 12; j++) {
+			kgsl_regwrite(device, A5XX_VBIF_TEST_BUS1_CTRL1,
+				((j & A5XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_MASK)
+				<< A5XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_SHIFT));
+			kgsl_regread(device, A5XX_VBIF_TEST_BUS_OUT,
+				data);
+			data++;
+		}
+	}
+	/* restore the clock of VBIF */
+	kgsl_regwrite(device, A5XX_VBIF_CLKON, reg_clk);
+	return size;
+}
+
+/* a5xx_snapshot_debugbus_block() - Capture debug data for a gpu block */
+static size_t a5xx_snapshot_debugbus_block(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debugbus *header =
+		(struct kgsl_snapshot_debugbus *)buf;
+	struct adreno_debugbus_block *block = priv;
+	int i;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int dwords;
+	size_t size;
+
+	dwords = block->dwords;
+
+	/* For a5xx each debug bus data unit is 2 DWRODS */
+	size = (dwords * sizeof(unsigned int) * 2) + sizeof(*header);
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+
+	header->id = block->block_id;
+	header->count = dwords * 2;
+
+	for (i = 0; i < dwords; i++)
+		a5xx_rbbm_debug_bus_read(device, block->block_id, i,
+					&data[i*2]);
+
+	return size;
+}
+
+/* a5xx_snapshot_debugbus() - Capture debug bus data */
+static void a5xx_snapshot_debugbus(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot)
+{
+	int i;
+
+	kgsl_regwrite(device, A5XX_RBBM_CFG_DBGBUS_CNTLM,
+		0xf << A5XX_RBBM_CFG_DEBBUS_CTLTM_ENABLE_SHIFT);
+
+	for (i = 0; i < ARRAY_SIZE(a5xx_debugbus_blocks); i++) {
+		if (a5xx_debugbus_blocks[i].block_id == A5XX_RBBM_DBGBUS_VBIF)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+				snapshot, a5xx_snapshot_vbif_debugbus,
+				(void *) &a5xx_debugbus_blocks[i]);
+		else
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+				snapshot, a5xx_snapshot_debugbus_block,
+				(void *) &a5xx_debugbus_blocks[i]);
+	}
+}
+
+static const unsigned int a5xx_vbif_registers[] = {
+	0x3000, 0x3007, 0x300C, 0x3014, 0x3018, 0x302C, 0x3030, 0x3030,
+	0x3034, 0x3036, 0x3038, 0x3038, 0x303C, 0x303D, 0x3040, 0x3040,
+	0x3042, 0x3042, 0x3049, 0x3049, 0x3058, 0x3058, 0x305A, 0x3061,
+	0x3064, 0x3068, 0x306C, 0x306D, 0x3080, 0x3088, 0x308C, 0x308C,
+	0x3090, 0x3094, 0x3098, 0x3098, 0x309C, 0x309C, 0x30C0, 0x30C0,
+	0x30C8, 0x30C8, 0x30D0, 0x30D0, 0x30D8, 0x30D8, 0x30E0, 0x30E0,
+	0x3100, 0x3100, 0x3108, 0x3108, 0x3110, 0x3110, 0x3118, 0x3118,
+	0x3120, 0x3120, 0x3124, 0x3125, 0x3129, 0x3129, 0x3131, 0x3131,
+	0x340C, 0x340C, 0x3410, 0x3410, 0x3800, 0x3801,
+};
+
+/*
+ * Set of registers to dump for A5XX on snapshot.
+ * Registers in pairs - first value is the start offset, second
+ * is the stop offset (inclusive)
+ */
+
+static const unsigned int a5xx_registers[] = {
+	/* RBBM */
+	0x0000, 0x0002, 0x0004, 0x0020, 0x0022, 0x0026, 0x0029, 0x002B,
+	0x002E, 0x0035, 0x0038, 0x0042, 0x0044, 0x0044, 0x0047, 0x0095,
+	0x0097, 0x00BB, 0x03A0, 0x0464, 0x0469, 0x046F, 0x04D2, 0x04D3,
+	0x04E0, 0x04F4, 0X04F8, 0x0529, 0x0531, 0x0533, 0x0540, 0x0555,
+	0xF400, 0xF400, 0xF800, 0xF807,
+	/* CP */
+	0x0800, 0x0803, 0x0806, 0x081A, 0x081F, 0x0841, 0x0860, 0x0860,
+	0x0880, 0x08A0, 0x0B00, 0x0B12, 0x0B15, 0X0B1C, 0X0B1E, 0x0B28,
+	0x0B78, 0x0B7F, 0x0BB0, 0x0BBD,
+	/* VSC */
+	0x0BC0, 0x0BC6, 0x0BD0, 0x0C53, 0x0C60, 0x0C61,
+	/* GRAS */
+	0x0C80, 0x0C82, 0x0C84, 0x0C85, 0x0C90, 0x0C98, 0x0CA0, 0x0CA0,
+	0x0CB0, 0x0CB2, 0x2180, 0x2185, 0x2580, 0x2585,
+	/* RB */
+	0x0CC1, 0x0CC1, 0x0CC4, 0x0CC7, 0x0CCC, 0x0CCC, 0x0CD0, 0x0CD8,
+	0x0CE0, 0x0CE5, 0x0CE8, 0x0CE8, 0x0CEC, 0x0CF1, 0x0CFB, 0x0D0E,
+	0x2100, 0x211E, 0x2140, 0x2145, 0x2500, 0x251E, 0x2540, 0x2545,
+	/* PC */
+	0x0D10, 0x0D17, 0x0D20, 0x0D23, 0x0D30, 0x0D30, 0x20C0, 0x20C0,
+	0x24C0, 0x24C0,
+	/* VFD */
+	0x0E40, 0x0E43, 0x0E4A, 0x0E4A, 0x0E50, 0x0E57,
+	/* VPC */
+	0x0E60, 0x0E7C,
+	/* UCHE */
+	0x0E80, 0x0E8F, 0x0E90, 0x0E96, 0xEA0, 0xEA8, 0xEB0, 0xEB2,
+
+	/* RB CTX 0 */
+	0xE140, 0xE147, 0xE150, 0xE187, 0xE1A0, 0xE1A9, 0xE1B0, 0xE1B6,
+	0xE1C0, 0xE1C7, 0xE1D0, 0xE1D1, 0xE200, 0xE201, 0xE210, 0xE21C,
+	0xE240, 0xE268,
+	/* GRAS CTX 0 */
+	0xE000, 0xE006, 0xE010, 0xE09A, 0xE0A0, 0xE0A4, 0xE0AA, 0xE0EB,
+	0xE100, 0xE105,
+	/* PC CTX 0 */
+	0xE380, 0xE38F, 0xE3B0, 0xE3B0,
+	/* VFD CTX 0 */
+	0xE400, 0xE405, 0xE408, 0xE4E9, 0xE4F0, 0xE4F0,
+	/* VPC CTX 0 */
+	0xE280, 0xE280, 0xE282, 0xE2A3, 0xE2A5, 0xE2C2,
+
+	/* RB CTX 1 */
+	0xE940, 0xE947, 0xE950, 0xE987, 0xE9A0, 0xE9A9, 0xE9B0, 0xE9B6,
+	0xE9C0, 0xE9C7, 0xE9D0, 0xE9D1, 0xEA00, 0xEA01, 0xEA10, 0xEA1C,
+	0xEA40, 0xEA68,
+	/* GRAS CTX 1 */
+	0xE800, 0xE806, 0xE810, 0xE89A, 0xE8A0, 0xE8A4, 0xE8AA, 0xE8EB,
+	0xE900, 0xE905,
+	/* PC CTX 1 */
+	0xEB80, 0xEB8F, 0xEBB0, 0xEBB0,
+	/* VFD CTX 1 */
+	0xEC00, 0xEC05, 0xEC08, 0xECE9, 0xECF0, 0xECF0,
+	/* VPC CTX 1 */
+	0xEA80, 0xEA80, 0xEA82, 0xEAA3, 0xEAA5, 0xEAC2,
+};
+
+/*
+ * GPMU registers to dump for A5XX on snapshot.
+ * Registers in pairs - first value is the start offset, second
+ * is the stop offset (inclusive)
+ */
+
+static const unsigned int a5xx_gpmu_registers[] = {
+	/* GPMU */
+	0xA800, 0xA8FF, 0xAC60, 0xAC60,
+};
+
+/*
+ * Set of registers to dump for A5XX before actually triggering crash dumper.
+ * Registers in pairs - first value is the start offset, second
+ * is the stop offset (inclusive)
+ */
+static const unsigned int a5xx_pre_crashdumper_registers[] = {
+	/* RBBM: RBBM_STATUS - RBBM_STATUS3 */
+	0x04F5, 0x04F7, 0x0530, 0x0530,
+	/* CP: CP_STATUS_1 */
+	0x0B1D, 0x0B1D,
+};
+
+
+struct a5xx_hlsq_sp_tp_regs {
+	unsigned int statetype;
+	unsigned int ahbaddr;
+	unsigned int size;
+	uint64_t offset;
+};
+
+static struct a5xx_hlsq_sp_tp_regs a5xx_hlsq_sp_tp_registers[] = {
+	/* HSLQ non context. 0xe32 - 0xe3f are holes so don't include them */
+	{ 0x35, 0xE00, 0x32 },
+	/* HLSQ CTX 0 2D */
+	{ 0x31, 0x2080, 0x1 },
+	/* HLSQ CTX 1 2D */
+	{ 0x33, 0x2480, 0x1 },
+	/* HLSQ CTX 0 3D. 0xe7e2 - 0xe7ff are holes so don't include them */
+	{ 0x32, 0xE780, 0x62 },
+	/* HLSQ CTX 1 3D. 0xefe2 - 0xefff are holes so don't include them */
+	{ 0x34, 0xEF80, 0x62 },
+
+	/* SP non context */
+	{ 0x3f, 0x0EC0, 0x40 },
+	/* SP CTX 0 2D */
+	{ 0x3d, 0x2040, 0x1 },
+	/* SP CTX 1 2D */
+	{ 0x3b, 0x2440, 0x1 },
+	/* SP CTX 0 3D */
+	{ 0x3e, 0xE580, 0x180 },
+	/* SP CTX 1 3D */
+	{ 0x3c, 0xED80, 0x180 },
+
+	/* TP non context. 0x0f1c - 0x0f3f are holes so don't include them */
+	{ 0x3a, 0x0F00, 0x1c },
+	/* TP CTX 0 2D. 0x200a - 0x200f are holes so don't include them */
+	{ 0x38, 0x2000, 0xa },
+	/* TP CTX 1 2D.   0x240a - 0x240f are holes so don't include them */
+	{ 0x36, 0x2400, 0xa },
+	/* TP CTX 0 3D */
+	{ 0x39, 0xE700, 0x80 },
+	/* TP CTX 1 3D */
+	{ 0x37, 0xEF00, 0x80 },
+};
+
+
+#define A5XX_NUM_SHADER_BANKS 4
+#define A5XX_SHADER_STATETYPE_SHIFT 8
+
+enum a5xx_shader_obj {
+	A5XX_TP_W_MEMOBJ = 1,
+	A5XX_TP_W_SAMPLER = 2,
+	A5XX_TP_W_MIPMAP_BASE = 3,
+	A5XX_TP_W_MEMOBJ_TAG = 4,
+	A5XX_TP_W_SAMPLER_TAG = 5,
+	A5XX_TP_S_3D_MEMOBJ = 6,
+	A5XX_TP_S_3D_SAMPLER = 0x7,
+	A5XX_TP_S_3D_MEMOBJ_TAG = 0x8,
+	A5XX_TP_S_3D_SAMPLER_TAG = 0x9,
+	A5XX_TP_S_CS_MEMOBJ = 0xA,
+	A5XX_TP_S_CS_SAMPLER = 0xB,
+	A5XX_TP_S_CS_MEMOBJ_TAG = 0xC,
+	A5XX_TP_S_CS_SAMPLER_TAG = 0xD,
+	A5XX_SP_W_INSTR = 0xE,
+	A5XX_SP_W_CONST = 0xF,
+	A5XX_SP_W_UAV_SIZE = 0x10,
+	A5XX_SP_W_CB_SIZE = 0x11,
+	A5XX_SP_W_UAV_BASE = 0x12,
+	A5XX_SP_W_CB_BASE = 0x13,
+	A5XX_SP_W_INST_TAG = 0x14,
+	A5XX_SP_W_STATE = 0x15,
+	A5XX_SP_S_3D_INSTR = 0x16,
+	A5XX_SP_S_3D_CONST = 0x17,
+	A5XX_SP_S_3D_CB_BASE = 0x18,
+	A5XX_SP_S_3D_CB_SIZE = 0x19,
+	A5XX_SP_S_3D_UAV_BASE = 0x1A,
+	A5XX_SP_S_3D_UAV_SIZE = 0x1B,
+	A5XX_SP_S_CS_INSTR = 0x1C,
+	A5XX_SP_S_CS_CONST = 0x1D,
+	A5XX_SP_S_CS_CB_BASE = 0x1E,
+	A5XX_SP_S_CS_CB_SIZE = 0x1F,
+	A5XX_SP_S_CS_UAV_BASE = 0x20,
+	A5XX_SP_S_CS_UAV_SIZE = 0x21,
+	A5XX_SP_S_3D_INSTR_DIRTY = 0x22,
+	A5XX_SP_S_3D_CONST_DIRTY = 0x23,
+	A5XX_SP_S_3D_CB_BASE_DIRTY = 0x24,
+	A5XX_SP_S_3D_CB_SIZE_DIRTY = 0x25,
+	A5XX_SP_S_3D_UAV_BASE_DIRTY = 0x26,
+	A5XX_SP_S_3D_UAV_SIZE_DIRTY = 0x27,
+	A5XX_SP_S_CS_INSTR_DIRTY = 0x28,
+	A5XX_SP_S_CS_CONST_DIRTY = 0x29,
+	A5XX_SP_S_CS_CB_BASE_DIRTY = 0x2A,
+	A5XX_SP_S_CS_CB_SIZE_DIRTY = 0x2B,
+	A5XX_SP_S_CS_UAV_BASE_DIRTY = 0x2C,
+	A5XX_SP_S_CS_UAV_SIZE_DIRTY = 0x2D,
+	A5XX_HLSQ_ICB = 0x2E,
+	A5XX_HLSQ_ICB_DIRTY = 0x2F,
+	A5XX_HLSQ_ICB_CB_BASE_DIRTY = 0x30,
+	A5XX_SP_POWER_RESTORE_RAM = 0x40,
+	A5XX_SP_POWER_RESTORE_RAM_TAG = 0x41,
+	A5XX_TP_POWER_RESTORE_RAM = 0x42,
+	A5XX_TP_POWER_RESTORE_RAM_TAG = 0x43,
+
+};
+
+struct a5xx_shader_block {
+	unsigned int statetype;
+	unsigned int sz;
+	uint64_t offset;
+};
+
+struct a5xx_shader_block_info {
+	struct a5xx_shader_block *block;
+	unsigned int bank;
+	uint64_t offset;
+};
+
+static struct a5xx_shader_block a5xx_shader_blocks[] = {
+	{A5XX_TP_W_MEMOBJ,              0x200},
+	{A5XX_TP_W_MIPMAP_BASE,         0x3C0},
+	{A5XX_TP_W_SAMPLER_TAG,          0x40},
+	{A5XX_TP_S_3D_SAMPLER,           0x80},
+	{A5XX_TP_S_3D_SAMPLER_TAG,       0x20},
+	{A5XX_TP_S_CS_SAMPLER,           0x40},
+	{A5XX_TP_S_CS_SAMPLER_TAG,       0x10},
+	{A5XX_SP_W_CONST,               0x800},
+	{A5XX_SP_W_CB_SIZE,              0x30},
+	{A5XX_SP_W_CB_BASE,              0xF0},
+	{A5XX_SP_W_STATE,                 0x1},
+	{A5XX_SP_S_3D_CONST,            0x800},
+	{A5XX_SP_S_3D_CB_SIZE,           0x28},
+	{A5XX_SP_S_3D_UAV_SIZE,          0x80},
+	{A5XX_SP_S_CS_CONST,            0x400},
+	{A5XX_SP_S_CS_CB_SIZE,            0x8},
+	{A5XX_SP_S_CS_UAV_SIZE,          0x80},
+	{A5XX_SP_S_3D_CONST_DIRTY,       0x12},
+	{A5XX_SP_S_3D_CB_SIZE_DIRTY,      0x1},
+	{A5XX_SP_S_3D_UAV_SIZE_DIRTY,     0x2},
+	{A5XX_SP_S_CS_CONST_DIRTY,        0xA},
+	{A5XX_SP_S_CS_CB_SIZE_DIRTY,      0x1},
+	{A5XX_SP_S_CS_UAV_SIZE_DIRTY,     0x2},
+	{A5XX_HLSQ_ICB_DIRTY,             0xB},
+	{A5XX_SP_POWER_RESTORE_RAM_TAG,   0xA},
+	{A5XX_TP_POWER_RESTORE_RAM_TAG,   0xA},
+	{A5XX_TP_W_SAMPLER,              0x80},
+	{A5XX_TP_W_MEMOBJ_TAG,           0x40},
+	{A5XX_TP_S_3D_MEMOBJ,           0x200},
+	{A5XX_TP_S_3D_MEMOBJ_TAG,        0x20},
+	{A5XX_TP_S_CS_MEMOBJ,           0x100},
+	{A5XX_TP_S_CS_MEMOBJ_TAG,        0x10},
+	{A5XX_SP_W_INSTR,               0x800},
+	{A5XX_SP_W_UAV_SIZE,             0x80},
+	{A5XX_SP_W_UAV_BASE,             0x80},
+	{A5XX_SP_W_INST_TAG,             0x40},
+	{A5XX_SP_S_3D_INSTR,            0x800},
+	{A5XX_SP_S_3D_CB_BASE,           0xC8},
+	{A5XX_SP_S_3D_UAV_BASE,          0x80},
+	{A5XX_SP_S_CS_INSTR,            0x400},
+	{A5XX_SP_S_CS_CB_BASE,           0x28},
+	{A5XX_SP_S_CS_UAV_BASE,          0x80},
+	{A5XX_SP_S_3D_INSTR_DIRTY,        0x1},
+	{A5XX_SP_S_3D_CB_BASE_DIRTY,      0x5},
+	{A5XX_SP_S_3D_UAV_BASE_DIRTY,     0x2},
+	{A5XX_SP_S_CS_INSTR_DIRTY,        0x1},
+	{A5XX_SP_S_CS_CB_BASE_DIRTY,      0x1},
+	{A5XX_SP_S_CS_UAV_BASE_DIRTY,     0x2},
+	{A5XX_HLSQ_ICB,                 0x200},
+	{A5XX_HLSQ_ICB_CB_BASE_DIRTY,     0x4},
+	{A5XX_SP_POWER_RESTORE_RAM,     0x140},
+	{A5XX_TP_POWER_RESTORE_RAM,      0x40},
+};
+
+static struct kgsl_memdesc *capturescript;
+static struct kgsl_memdesc *registers;
+static bool crash_dump_valid;
+
+static size_t a5xx_snapshot_shader_memory(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_shader *header =
+		(struct kgsl_snapshot_shader *) buf;
+	struct a5xx_shader_block_info *info =
+		(struct a5xx_shader_block_info *) priv;
+	struct a5xx_shader_block *block = info->block;
+	unsigned int *data = (unsigned int *) (buf + sizeof(*header));
+
+	if (remain < SHADER_SECTION_SZ(block->sz)) {
+		SNAPSHOT_ERR_NOMEM(device, "SHADER MEMORY");
+		return 0;
+	}
+
+	header->type = block->statetype;
+	header->index = info->bank;
+	header->size = block->sz;
+
+	memcpy(data, registers->hostptr + info->offset,
+		block->sz * sizeof(unsigned int));
+
+	return SHADER_SECTION_SZ(block->sz);
+}
+
+static void a5xx_snapshot_shader(struct kgsl_device *device,
+			   struct kgsl_snapshot *snapshot)
+{
+	unsigned int i, j;
+	struct a5xx_shader_block_info info;
+
+	/* Shader blocks can only be read by the crash dumper */
+	if (!crash_dump_valid)
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(a5xx_shader_blocks); i++) {
+		for (j = 0; j < A5XX_NUM_SHADER_BANKS; j++) {
+			info.block = &a5xx_shader_blocks[i];
+			info.bank = j;
+			info.offset = a5xx_shader_blocks[i].offset +
+				(j * a5xx_shader_blocks[i].sz);
+
+			/* Shader working/shadow memory */
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_SHADER,
+				snapshot, a5xx_snapshot_shader_memory, &info);
+		}
+	}
+}
+
+/* Dump registers which get affected by crash dumper trigger */
+static size_t a5xx_snapshot_pre_crashdump_regs(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_registers pre_cdregs = {
+			.regs = a5xx_pre_crashdumper_registers,
+			.count = ARRAY_SIZE(a5xx_pre_crashdumper_registers)/2,
+	};
+
+	return kgsl_snapshot_dump_registers(device, buf, remain, &pre_cdregs);
+}
+
+struct registers {
+	const unsigned int *regs;
+	size_t size;
+};
+
+static size_t a5xx_legacy_snapshot_registers(struct kgsl_device *device,
+		u8 *buf, size_t remain, const unsigned int *regs, size_t size)
+{
+	struct kgsl_snapshot_registers snapshot_regs = {
+		.regs = regs,
+		.count = size / 2,
+	};
+
+	return kgsl_snapshot_dump_registers(device, buf, remain,
+			&snapshot_regs);
+}
+
+#define REG_PAIR_COUNT(_a, _i) \
+	(((_a)[(2 * (_i)) + 1] - (_a)[2 * (_i)]) + 1)
+
+static size_t a5xx_snapshot_registers(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct kgsl_snapshot_regs *header = (struct kgsl_snapshot_regs *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int *src = (unsigned int *) registers->hostptr;
+	struct registers *regs = (struct registers *)priv;
+	unsigned int j, k;
+	unsigned int count = 0;
+
+	if (!crash_dump_valid)
+		return a5xx_legacy_snapshot_registers(device, buf, remain,
+				regs->regs, regs->size);
+
+	if (remain < sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	remain -= sizeof(*header);
+
+	for (j = 0; j < regs->size / 2; j++) {
+		unsigned int start = regs->regs[2 * j];
+		unsigned int end = regs->regs[(2 * j) + 1];
+
+		if (remain < ((end - start) + 1) * 8) {
+			SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+			goto out;
+		}
+
+		remain -= ((end - start) + 1) * 8;
+
+		for (k = start; k <= end; k++, count++) {
+			*data++ = k;
+			*data++ = *src++;
+		}
+	}
+
+out:
+	header->count = count;
+
+	/* Return the size of the section */
+	return (count * 8) + sizeof(*header);
+}
+
+/* Snapshot a preemption record buffer */
+static size_t snapshot_preemption_record(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	struct kgsl_memdesc *memdesc = priv;
+
+	struct kgsl_snapshot_gpu_object_v2 *header =
+		(struct kgsl_snapshot_gpu_object_v2 *)buf;
+
+	u8 *ptr = buf + sizeof(*header);
+
+	if (remain < (SZ_64K + sizeof(*header))) {
+		SNAPSHOT_ERR_NOMEM(device, "PREEMPTION RECORD");
+		return 0;
+	}
+
+	header->size = SZ_64K >> 2;
+	header->gpuaddr = memdesc->gpuaddr;
+	header->ptbase =
+		kgsl_mmu_pagetable_get_ttbr0(device->mmu.defaultpagetable);
+	header->type = SNAPSHOT_GPU_OBJECT_GLOBAL;
+
+	memcpy(ptr, memdesc->hostptr, SZ_64K);
+
+	return SZ_64K + sizeof(*header);
+}
+
+
+static void _a5xx_do_crashdump(struct kgsl_device *device)
+{
+	unsigned long wait_time;
+	unsigned int reg = 0;
+	unsigned int val;
+
+	crash_dump_valid = false;
+
+	if (!device->snapshot_crashdumper)
+		return;
+
+	if (IS_ERR_OR_NULL(capturescript) || IS_ERR_OR_NULL(registers))
+		return;
+
+	/* IF the SMMU is stalled we cannot do a crash dump */
+	kgsl_regread(device, A5XX_RBBM_STATUS3, &val);
+	if (val & BIT(24))
+		return;
+
+	/* Turn on APRIV so we can access the buffers */
+	kgsl_regwrite(device, A5XX_CP_CNTL, 1);
+
+	kgsl_regwrite(device, A5XX_CP_CRASH_SCRIPT_BASE_LO,
+			lower_32_bits(capturescript->gpuaddr));
+	kgsl_regwrite(device, A5XX_CP_CRASH_SCRIPT_BASE_HI,
+			upper_32_bits(capturescript->gpuaddr));
+	kgsl_regwrite(device, A5XX_CP_CRASH_DUMP_CNTL, 1);
+
+	wait_time = jiffies + msecs_to_jiffies(CP_CRASH_DUMPER_TIMEOUT);
+	while (!time_after(jiffies, wait_time)) {
+		kgsl_regread(device, A5XX_CP_CRASH_DUMP_CNTL, &reg);
+		if (reg & 0x4)
+			break;
+		cpu_relax();
+	}
+
+	kgsl_regwrite(device, A5XX_CP_CNTL, 0);
+
+	if (!(reg & 0x4)) {
+		dev_err(device->dev, "Crash dump timed out: 0x%X\n", reg);
+		return;
+	}
+
+	crash_dump_valid = true;
+}
+
+static int get_hlsq_registers(struct kgsl_device *device,
+		const struct a5xx_hlsq_sp_tp_regs *regs, unsigned int *data)
+{
+	unsigned int i;
+	unsigned int *src = registers->hostptr + regs->offset;
+
+	for (i = 0; i < regs->size; i++) {
+		*data++ = regs->ahbaddr + i;
+		*data++ = *(src + i);
+	}
+
+	return (2 * regs->size);
+}
+
+static size_t a5xx_snapshot_dump_hlsq_sp_tp_regs(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_regs *header = (struct kgsl_snapshot_regs *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	int count = 0, i;
+
+	/* Figure out how many registers we are going to dump */
+	for (i = 0; i < ARRAY_SIZE(a5xx_hlsq_sp_tp_registers); i++)
+		count += a5xx_hlsq_sp_tp_registers[i].size;
+
+	if (remain < (count * 8) + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(a5xx_hlsq_sp_tp_registers); i++)
+		data += get_hlsq_registers(device,
+				&a5xx_hlsq_sp_tp_registers[i], data);
+
+	header->count = count;
+
+	/* Return the size of the section */
+	return (count * 8) + sizeof(*header);
+}
+
+static size_t a5xx_snapshot_cp_merciu(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	int i, size;
+
+	if (adreno_is_a505_or_a506(adreno_dev) || adreno_is_a508(adreno_dev) ||
+		adreno_is_a540(adreno_dev) || adreno_is_a512(adreno_dev))
+		size = 1024;
+	else if (adreno_is_a510(adreno_dev))
+		size = 32;
+	else
+		size = 64;
+
+	/* The MERCIU data is two dwords per entry */
+	size = size << 1;
+
+	if (remain < DEBUG_SECTION_SZ(size)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP MERCIU DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_MERCIU;
+	header->size = size;
+
+	kgsl_regwrite(device, A5XX_CP_MERCIU_DBG_ADDR, 0);
+
+	for (i = 0; i < size; i++) {
+		kgsl_regread(device, A5XX_CP_MERCIU_DBG_DATA_1,
+			&data[(i * 2)]);
+		kgsl_regread(device, A5XX_CP_MERCIU_DBG_DATA_2,
+			&data[(i * 2) + 1]);
+	}
+
+	return DEBUG_SECTION_SZ(size);
+}
+
+static size_t a5xx_snapshot_cp_roq(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *) buf;
+	u32 size, *data = (u32 *) (buf + sizeof(*header));
+
+	if (adreno_is_a505_or_a506(adreno_dev) || adreno_is_a508(adreno_dev) ||
+		adreno_is_a510(adreno_dev))
+		size = 256;
+	else
+		size = 512;
+
+	if (remain < DEBUG_SECTION_SZ(size)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP ROQ DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_ROQ;
+	header->size = size;
+
+	kgsl_regmap_read_indexed(&device->regmap, A5XX_CP_ROQ_DBG_ADDR,
+		A5XX_CP_ROQ_DBG_DATA, data, size);
+
+	return DEBUG_SECTION_SZ(size);
+}
+
+static size_t a5xx_snapshot_cp_meq(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *) buf;
+	u32 size, *data = (u32 *) (buf + sizeof(*header));
+
+	if (adreno_is_a505_or_a506(adreno_dev) || adreno_is_a508(adreno_dev) ||
+		adreno_is_a510(adreno_dev))
+		size = 32;
+	else
+		size = 64;
+
+	if (remain < DEBUG_SECTION_SZ(size)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP MEQ DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_MEQ;
+	header->size = size;
+
+	kgsl_regmap_read_indexed(&device->regmap, A5XX_CP_MEQ_DBG_ADDR,
+		A5XX_CP_MEQ_DBG_DATA, data, size);
+
+	return DEBUG_SECTION_SZ(size);
+}
+
+/*
+ * a5xx_snapshot() - A5XX GPU snapshot function
+ * @adreno_dev: Device being snapshotted
+ * @snapshot: Pointer to the snapshot instance
+ *
+ * This is where all of the A5XX specific bits and pieces are grabbed
+ * into the snapshot memory
+ */
+void a5xx_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int i;
+	u32 hi, lo;
+	struct adreno_ringbuffer *rb;
+	struct registers regs;
+
+	/* Disable Clock gating temporarily for the debug bus to work */
+	a5xx_hwcg_set(adreno_dev, false);
+
+	/* Save some CP information that the generic snapshot uses */
+	kgsl_regread(device, A5XX_CP_IB1_BASE, &lo);
+	kgsl_regread(device, A5XX_CP_IB1_BASE_HI, &hi);
+
+	snapshot->ib1base = (((u64) hi) << 32) | lo;
+
+	kgsl_regread(device, A5XX_CP_IB2_BASE, &lo);
+	kgsl_regread(device, A5XX_CP_IB2_BASE_HI, &hi);
+
+	snapshot->ib2base = (((u64) hi) << 32) | lo;
+
+	kgsl_regread(device, A5XX_CP_IB1_BUFSZ, &snapshot->ib1size);
+	kgsl_regread(device, A5XX_CP_IB2_BUFSZ, &snapshot->ib2size);
+
+	/* Dump the registers which get affected by crash dumper trigger */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS,
+		snapshot, a5xx_snapshot_pre_crashdump_regs, NULL);
+
+	/* Dump vbif registers as well which get affected by crash dumper */
+	SNAPSHOT_REGISTERS(device, snapshot, a5xx_vbif_registers);
+
+	/* Try to run the crash dumper */
+	_a5xx_do_crashdump(device);
+
+	regs.regs = a5xx_registers;
+	regs.size = ARRAY_SIZE(a5xx_registers);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS, snapshot,
+			a5xx_snapshot_registers, &regs);
+
+	if (a5xx_has_gpmu(adreno_dev)) {
+		regs.regs = a5xx_gpmu_registers;
+		regs.size = ARRAY_SIZE(a5xx_gpmu_registers);
+
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS,
+				snapshot, a5xx_snapshot_registers, &regs);
+	}
+
+
+	/* Dump SP TP HLSQ registers */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS, snapshot,
+		a5xx_snapshot_dump_hlsq_sp_tp_regs, NULL);
+
+	/* CP_PFP indexed registers */
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A5XX_CP_PFP_STAT_ADDR, A5XX_CP_PFP_STAT_DATA, 0, 36);
+
+	/* CP_ME indexed registers */
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A5XX_CP_ME_STAT_ADDR, A5XX_CP_ME_STAT_DATA, 0, 29);
+
+	/* CP_DRAW_STATE */
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A5XX_CP_DRAW_STATE_ADDR, A5XX_CP_DRAW_STATE_DATA,
+		0, 1 << A5XX_CP_DRAW_STATE_ADDR_WIDTH);
+
+	/* ME_UCODE Cache */
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A5XX_CP_ME_UCODE_DBG_ADDR, A5XX_CP_ME_UCODE_DBG_DATA,
+		0, 0x53F);
+
+	/* PFP_UCODE Cache */
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A5XX_CP_PFP_UCODE_DBG_ADDR, A5XX_CP_PFP_UCODE_DBG_DATA,
+		0, 0x53F);
+
+	/* CP MEQ */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a5xx_snapshot_cp_meq, NULL);
+
+	/* CP ROQ */
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a5xx_snapshot_cp_roq, NULL);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a5xx_snapshot_cp_merciu, NULL);
+
+	/* CP PFP and PM4 */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a5xx_snapshot_cp_pfp, NULL);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a5xx_snapshot_cp_pm4, NULL);
+
+	/* Debug bus */
+	a5xx_snapshot_debugbus(device, snapshot);
+
+	/* Shader memory */
+	a5xx_snapshot_shader(device, snapshot);
+
+	/* Preemption record */
+	if (adreno_is_preemption_enabled(adreno_dev)) {
+		FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, snapshot_preemption_record,
+				rb->preemption_desc);
+		}
+	}
+
+}
+
+static int _a5xx_crashdump_init_shader(struct a5xx_shader_block *block,
+		uint64_t *ptr, uint64_t *offset)
+{
+	int qwords = 0;
+	unsigned int j;
+
+	/* Capture each bank in the block */
+	for (j = 0; j < A5XX_NUM_SHADER_BANKS; j++) {
+		/* Program the aperture */
+		ptr[qwords++] =
+			(block->statetype << A5XX_SHADER_STATETYPE_SHIFT) | j;
+		ptr[qwords++] = (((uint64_t) A5XX_HLSQ_DBG_READ_SEL << 44)) |
+			(1 << 21) | 1;
+
+		/* Read all the data in one chunk */
+		ptr[qwords++] = registers->gpuaddr + *offset;
+		ptr[qwords++] =
+			(((uint64_t) A5XX_HLSQ_DBG_AHB_READ_APERTURE << 44)) |
+			block->sz;
+
+		/* Remember the offset of the first bank for easy access */
+		if (j == 0)
+			block->offset = *offset;
+
+		*offset += block->sz * sizeof(unsigned int);
+	}
+
+	return qwords;
+}
+
+static int _a5xx_crashdump_init_hlsq(struct a5xx_hlsq_sp_tp_regs *regs,
+		uint64_t *ptr, uint64_t *offset)
+{
+	int qwords = 0;
+
+	/* Program the aperture */
+	ptr[qwords++] =
+		(regs->statetype << A5XX_SHADER_STATETYPE_SHIFT);
+	ptr[qwords++] = (((uint64_t) A5XX_HLSQ_DBG_READ_SEL << 44)) |
+		(1 << 21) | 1;
+
+	/* Read all the data in one chunk */
+	ptr[qwords++] = registers->gpuaddr + *offset;
+	ptr[qwords++] =
+		(((uint64_t) A5XX_HLSQ_DBG_AHB_READ_APERTURE << 44)) |
+		regs->size;
+
+	/* Remember the offset of the first bank for easy access */
+	regs->offset = *offset;
+
+	*offset += regs->size * sizeof(unsigned int);
+
+	return qwords;
+}
+
+void a5xx_crashdump_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int script_size = 0;
+	unsigned int data_size = 0;
+	unsigned int i, j;
+	uint64_t *ptr;
+	uint64_t offset = 0;
+
+	if (!IS_ERR_OR_NULL(capturescript) && !IS_ERR_OR_NULL(registers))
+		return;
+
+	/*
+	 * We need to allocate two buffers:
+	 * 1 - the buffer to hold the draw script
+	 * 2 - the buffer to hold the data
+	 */
+
+	/*
+	 * To save the registers, we need 16 bytes per register pair for the
+	 * script and a dword for each register int the data
+	 */
+
+	/* Each pair needs 16 bytes (2 qwords) */
+	script_size += (ARRAY_SIZE(a5xx_registers) / 2) * 16;
+
+	/* Each register needs a dword in the data */
+	for (j = 0; j < ARRAY_SIZE(a5xx_registers) / 2; j++)
+		data_size += REG_PAIR_COUNT(a5xx_registers, j) *
+			sizeof(unsigned int);
+
+	if (a5xx_has_gpmu(adreno_dev)) {
+		/* Each pair needs 16 bytes (2 qwords) */
+		script_size += (ARRAY_SIZE(a5xx_gpmu_registers) / 2) * 16;
+
+		/* Each register needs a dword in the data */
+		for (j = 0; j < ARRAY_SIZE(a5xx_gpmu_registers) / 2; j++)
+			data_size += REG_PAIR_COUNT(a5xx_gpmu_registers, j) *
+				sizeof(unsigned int);
+	}
+
+	/*
+	 * To save the shader blocks for each block in each type we need 32
+	 * bytes for the script (16 bytes to program the aperture and 16 to
+	 * read the data) and then a block specific number of bytes to hold
+	 * the data
+	 */
+	for (i = 0; i < ARRAY_SIZE(a5xx_shader_blocks); i++) {
+		script_size += 32 * A5XX_NUM_SHADER_BANKS;
+		data_size += a5xx_shader_blocks[i].sz * sizeof(unsigned int) *
+			A5XX_NUM_SHADER_BANKS;
+	}
+	for (i = 0; i < ARRAY_SIZE(a5xx_hlsq_sp_tp_registers); i++) {
+		script_size += 32;
+		data_size +=
+		a5xx_hlsq_sp_tp_registers[i].size * sizeof(unsigned int);
+	}
+
+	/* Now allocate the script and data buffers */
+
+	/* The script buffers needs 2 extra qwords on the end */
+	if (!IS_ERR_OR_NULL(capturescript))
+		capturescript = kgsl_allocate_global(device,
+			script_size + 16, 0, KGSL_MEMFLAGS_GPUREADONLY,
+			KGSL_MEMDESC_PRIVILEGED, "capturescript");
+
+	if (IS_ERR(capturescript))
+		return;
+
+	if (!IS_ERR_OR_NULL(registers))
+		registers = kgsl_allocate_global(device, data_size, 0, 0,
+			KGSL_MEMDESC_PRIVILEGED, "capturescript_regs");
+
+	if (IS_ERR(registers))
+		return;
+
+	/* Build the crash script */
+
+	ptr = (uint64_t *) capturescript->hostptr;
+
+	/* For the registers, program a read command for each pair */
+
+	for (j = 0; j < ARRAY_SIZE(a5xx_registers) / 2; j++) {
+		unsigned int r = REG_PAIR_COUNT(a5xx_registers, j);
+		*ptr++ = registers->gpuaddr + offset;
+		*ptr++ = (((uint64_t) a5xx_registers[2 * j]) << 44)
+			| r;
+		offset += r * sizeof(unsigned int);
+	}
+
+	if (a5xx_has_gpmu(adreno_dev)) {
+		for (j = 0; j < ARRAY_SIZE(a5xx_gpmu_registers) / 2; j++) {
+			unsigned int r = REG_PAIR_COUNT(a5xx_gpmu_registers, j);
+			*ptr++ = registers->gpuaddr + offset;
+			*ptr++ = (((uint64_t) a5xx_gpmu_registers[2 * j]) << 44)
+				| r;
+			offset += r * sizeof(unsigned int);
+		}
+	}
+
+	/* Program each shader block */
+	for (i = 0; i < ARRAY_SIZE(a5xx_shader_blocks); i++) {
+		ptr += _a5xx_crashdump_init_shader(&a5xx_shader_blocks[i], ptr,
+			&offset);
+	}
+	/* Program the hlsq sp tp register sets */
+	for (i = 0; i < ARRAY_SIZE(a5xx_hlsq_sp_tp_registers); i++)
+		ptr += _a5xx_crashdump_init_hlsq(&a5xx_hlsq_sp_tp_registers[i],
+			ptr, &offset);
+
+	*ptr++ = 0;
+	*ptr++ = 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx.c
@@ -0,0 +1,2487 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk/qcom.h>
+#include <linux/clk-provider.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_fdt.h>
+#include <linux/of_device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+#include <soc/qcom/of_common.h>
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_a6xx_hwsched.h"
+#include "adreno_pm4types.h"
+#include "adreno_trace.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+/* IFPC & Preemption static powerup restore list */
+static u32 a6xx_pwrup_reglist[] = {
+	A6XX_VSC_ADDR_MODE_CNTL,
+	A6XX_GRAS_ADDR_MODE_CNTL,
+	A6XX_RB_ADDR_MODE_CNTL,
+	A6XX_PC_ADDR_MODE_CNTL,
+	A6XX_HLSQ_ADDR_MODE_CNTL,
+	A6XX_VFD_ADDR_MODE_CNTL,
+	A6XX_VPC_ADDR_MODE_CNTL,
+	A6XX_UCHE_ADDR_MODE_CNTL,
+	A6XX_SP_ADDR_MODE_CNTL,
+	A6XX_TPL1_ADDR_MODE_CNTL,
+	A6XX_UCHE_WRITE_RANGE_MAX_LO,
+	A6XX_UCHE_WRITE_RANGE_MAX_HI,
+	A6XX_UCHE_TRAP_BASE_LO,
+	A6XX_UCHE_TRAP_BASE_HI,
+	A6XX_UCHE_WRITE_THRU_BASE_LO,
+	A6XX_UCHE_WRITE_THRU_BASE_HI,
+	A6XX_UCHE_GMEM_RANGE_MIN_LO,
+	A6XX_UCHE_GMEM_RANGE_MIN_HI,
+	A6XX_UCHE_GMEM_RANGE_MAX_LO,
+	A6XX_UCHE_GMEM_RANGE_MAX_HI,
+	A6XX_UCHE_FILTER_CNTL,
+	A6XX_UCHE_CACHE_WAYS,
+	A6XX_UCHE_MODE_CNTL,
+	A6XX_RB_NC_MODE_CNTL,
+	A6XX_TPL1_NC_MODE_CNTL,
+	A6XX_SP_NC_MODE_CNTL,
+	A6XX_PC_DBG_ECO_CNTL,
+	A6XX_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE,
+	A6XX_UCHE_GBIF_GX_CONFIG,
+	A6XX_UCHE_CLIENT_PF,
+};
+
+/* IFPC only static powerup restore list */
+static u32 a6xx_ifpc_pwrup_reglist[] = {
+	A6XX_CP_CHICKEN_DBG,
+	A6XX_CP_DBG_ECO_CNTL,
+	A6XX_CP_PROTECT_CNTL,
+	A6XX_CP_PROTECT_REG,
+	A6XX_CP_PROTECT_REG+1,
+	A6XX_CP_PROTECT_REG+2,
+	A6XX_CP_PROTECT_REG+3,
+	A6XX_CP_PROTECT_REG+4,
+	A6XX_CP_PROTECT_REG+5,
+	A6XX_CP_PROTECT_REG+6,
+	A6XX_CP_PROTECT_REG+7,
+	A6XX_CP_PROTECT_REG+8,
+	A6XX_CP_PROTECT_REG+9,
+	A6XX_CP_PROTECT_REG+10,
+	A6XX_CP_PROTECT_REG+11,
+	A6XX_CP_PROTECT_REG+12,
+	A6XX_CP_PROTECT_REG+13,
+	A6XX_CP_PROTECT_REG+14,
+	A6XX_CP_PROTECT_REG+15,
+	A6XX_CP_PROTECT_REG+16,
+	A6XX_CP_PROTECT_REG+17,
+	A6XX_CP_PROTECT_REG+18,
+	A6XX_CP_PROTECT_REG+19,
+	A6XX_CP_PROTECT_REG+20,
+	A6XX_CP_PROTECT_REG+21,
+	A6XX_CP_PROTECT_REG+22,
+	A6XX_CP_PROTECT_REG+23,
+	A6XX_CP_PROTECT_REG+24,
+	A6XX_CP_PROTECT_REG+25,
+	A6XX_CP_PROTECT_REG+26,
+	A6XX_CP_PROTECT_REG+27,
+	A6XX_CP_PROTECT_REG+28,
+	A6XX_CP_PROTECT_REG+29,
+	A6XX_CP_PROTECT_REG+30,
+	A6XX_CP_PROTECT_REG+31,
+	A6XX_CP_AHB_CNTL,
+};
+
+/* Applicable to a620, a621, a642l, a643, a650 and a660 */
+static u32 a650_ifpc_pwrup_reglist[] = {
+	A6XX_CP_PROTECT_REG+32,
+	A6XX_CP_PROTECT_REG+33,
+	A6XX_CP_PROTECT_REG+34,
+	A6XX_CP_PROTECT_REG+35,
+	A6XX_CP_PROTECT_REG+36,
+	A6XX_CP_PROTECT_REG+37,
+	A6XX_CP_PROTECT_REG+38,
+	A6XX_CP_PROTECT_REG+39,
+	A6XX_CP_PROTECT_REG+40,
+	A6XX_CP_PROTECT_REG+41,
+	A6XX_CP_PROTECT_REG+42,
+	A6XX_CP_PROTECT_REG+43,
+	A6XX_CP_PROTECT_REG+44,
+	A6XX_CP_PROTECT_REG+45,
+	A6XX_CP_PROTECT_REG+46,
+	A6XX_CP_PROTECT_REG+47,
+};
+
+/* Applicable to a620, a621, a642l, a643, a650 and a660 */
+static u32 a650_pwrup_reglist[] = {
+	A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_0,
+	A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_1,
+	A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_2,
+	A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_3,
+	A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_4,
+	A6XX_UCHE_CMDQ_CONFIG,
+	A6XX_SP_DBG_ECO_CNTL,
+};
+
+static u32 a615_pwrup_reglist[] = {
+	A6XX_UCHE_GBIF_GX_CONFIG,
+};
+
+int a6xx_fenced_write(struct adreno_device *adreno_dev, u32 offset,
+		u32 value, u32 mask)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status, i;
+	u64 ts1, ts2;
+
+	kgsl_regwrite(device, offset, value);
+
+	if (!gmu_core_isenabled(device))
+		return 0;
+
+	ts1 = a6xx_read_alwayson(adreno_dev);
+	for (i = 0; i < GMU_CORE_LONG_WAKEUP_RETRY_LIMIT; i++) {
+		/*
+		 * Make sure the previous register write is posted before
+		 * checking the fence status
+		 */
+		mb();
+
+		kgsl_regread(device, A6XX_GMU_AHB_FENCE_STATUS, &status);
+
+		/*
+		 * If !writedropped0/1, then the write to fenced register
+		 * was successful
+		 */
+		if (!(status & mask))
+			break;
+
+		/* Wait a small amount of time before trying again */
+		udelay(GMU_CORE_WAKEUP_DELAY_US);
+
+		/* Try to write the fenced register again */
+		kgsl_regwrite(device, offset, value);
+	}
+
+	if (i < GMU_CORE_SHORT_WAKEUP_RETRY_LIMIT)
+		return 0;
+
+	if (i == GMU_CORE_LONG_WAKEUP_RETRY_LIMIT) {
+		ts2 = a6xx_read_alwayson(adreno_dev);
+		dev_err(adreno_dev->dev.dev,
+			"Timed out waiting %d usecs to write fenced register 0x%x, timestamps: %llx %llx\n",
+			i * GMU_CORE_WAKEUP_DELAY_US, offset, ts1, ts2);
+		return -ETIMEDOUT;
+	}
+
+	dev_err(adreno_dev->dev.dev,
+		"Waited %d usecs to write fenced register 0x%x\n",
+		i * GMU_CORE_WAKEUP_DELAY_US, offset);
+
+	return 0;
+}
+
+int a6xx_init(struct adreno_device *adreno_dev)
+{
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	u64 freq = a6xx_core->gmu_hub_clk_freq;
+
+	adreno_dev->highest_bank_bit = a6xx_core->highest_bank_bit;
+
+	adreno_dev->gmu_hub_clk_freq = freq ? freq : 150000000;
+
+	adreno_dev->cooperative_reset = ADRENO_FEATURE(adreno_dev,
+							ADRENO_COOP_RESET);
+
+	/* If the memory type is DDR 4, override the existing configuration */
+	if (get_ddrtype() == 0x7) {
+		if (adreno_is_a660_shima(adreno_dev) ||
+			adreno_is_a642l(adreno_dev) ||
+			adreno_is_a643(adreno_dev) ||
+			adreno_is_a662(adreno_dev))
+			adreno_dev->highest_bank_bit = 14;
+		else if ((adreno_is_a650(adreno_dev) ||
+				adreno_is_a660(adreno_dev)))
+			adreno_dev->highest_bank_bit = 15;
+	}
+	/*todo handle case when get_ddrtype() returns negative value ? */
+
+	a6xx_crashdump_init(adreno_dev);
+
+	return adreno_allocate_global(KGSL_DEVICE(adreno_dev),
+		&adreno_dev->pwrup_reglist,
+		PAGE_SIZE, 0, 0, KGSL_MEMDESC_PRIVILEGED,
+		"powerup_register_list");
+}
+
+static int a6xx_nogmu_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	ret = a6xx_ringbuffer_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_microcode_read(adreno_dev);
+	if (ret)
+		return ret;
+
+	/* Try to map the GMU wrapper region if applicable */
+	ret = kgsl_regmap_add_region(&device->regmap, device->pdev,
+		"gmu_wrapper", NULL, NULL);
+	if (ret && ret != -ENODEV)
+		dev_err(device->dev, "Couldn't map the GMU wrapper registers\n");
+
+	adreno_create_profile_buffer(adreno_dev);
+
+	return a6xx_init(adreno_dev);
+}
+
+static void a6xx_protect_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	const struct adreno_protected_regs *regs = a6xx_core->protected_regs;
+	int i;
+
+	/*
+	 * Enable access protection to privileged registers, fault on an access
+	 * protect violation and select the last span to protect from the start
+	 * address all the way to the end of the register address space
+	 */
+	kgsl_regwrite(device, A6XX_CP_PROTECT_CNTL,
+		(1 << 0) | (1 << 1) | (1 << 3));
+
+	/* Program each register defined by the core definition */
+	for (i = 0; regs[i].reg; i++) {
+		u32 count;
+
+		/*
+		 * This is the offset of the end register as counted from the
+		 * start, i.e. # of registers in the range - 1
+		 */
+		count = regs[i].end - regs[i].start;
+
+		kgsl_regwrite(device, regs[i].reg,
+			(regs[i].start & 0x3ffff) | ((count & 0x1fff) << 18) |
+			(regs[i].noaccess << 31));
+	}
+}
+
+static inline unsigned int
+__get_rbbm_clock_cntl_on(struct adreno_device *adreno_dev)
+{
+	if (adreno_is_a630(adreno_dev))
+		return 0x8AA8AA02;
+	else if (adreno_is_a612(adreno_dev) || adreno_is_a610(adreno_dev))
+		return 0xAAA8AA82;
+	else if (adreno_is_a702(adreno_dev))
+		return 0xAAAAAA82;
+	else
+		return 0x8AA8AA82;
+}
+
+static inline unsigned int
+__get_gmu_ao_cgc_mode_cntl(struct adreno_device *adreno_dev)
+{
+	if (adreno_is_a612(adreno_dev))
+		return 0x00000022;
+	else if (adreno_is_a615_family(adreno_dev))
+		return 0x00000222;
+	/* a662 should be checked before a660 */
+	else if (adreno_is_a662(adreno_dev) || adreno_is_a621(adreno_dev) ||
+	    adreno_is_a623(adreno_dev))
+		return 0x00020200;
+	else if (adreno_is_a660(adreno_dev))
+		return 0x00020000;
+	else
+		return 0x00020202;
+}
+
+static inline unsigned int
+__get_gmu_ao_cgc_delay_cntl(struct adreno_device *adreno_dev)
+{
+	if (adreno_is_a612(adreno_dev))
+		return 0x00000011;
+	else if (adreno_is_a615_family(adreno_dev))
+		return 0x00000111;
+	else
+		return 0x00010111;
+}
+
+static inline unsigned int
+__get_gmu_ao_cgc_hyst_cntl(struct adreno_device *adreno_dev)
+{
+	if (adreno_is_a612(adreno_dev))
+		return 0x00000055;
+	else if (adreno_is_a615_family(adreno_dev))
+		return 0x00000555;
+	else
+		return 0x00005555;
+}
+
+static unsigned int __get_gmu_wfi_config(struct adreno_device *adreno_dev)
+{
+	unsigned int rev = ADRENO_GPUREV(adreno_dev);
+
+	if ((rev == ADRENO_REV_A620) || adreno_is_a640(adreno_dev) ||
+		adreno_is_a650(adreno_dev))
+		return 0x00000002;
+
+	return 0x00000000;
+}
+
+static void set_holi_sptprac_clock(struct kgsl_device *device, bool enable)
+{
+	u32 val = 0;
+
+	kgsl_regread(device, A6XX_GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL, &val);
+	val &= ~1;
+	kgsl_regwrite(device, A6XX_GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL,
+			val | (enable ? 1 : 0));
+}
+
+static void a6xx_hwcg_set(struct adreno_device *adreno_dev, bool on)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	unsigned int value;
+	int i;
+
+	if (!adreno_dev->hwcg_enabled)
+		on = false;
+
+	if (gmu_core_isenabled(device)) {
+		gmu_core_regwrite(device, A6XX_GPU_GMU_AO_GMU_CGC_MODE_CNTL,
+			on ? __get_gmu_ao_cgc_mode_cntl(adreno_dev) : 0);
+		gmu_core_regwrite(device, A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL,
+			on ? __get_gmu_ao_cgc_delay_cntl(adreno_dev) : 0);
+		gmu_core_regwrite(device, A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL,
+			on ? __get_gmu_ao_cgc_hyst_cntl(adreno_dev) : 0);
+		gmu_core_regwrite(device, A6XX_GMU_CX_GMU_WFI_CONFIG,
+			on ? __get_gmu_wfi_config(adreno_dev) : 0);
+	}
+
+	kgsl_regread(device, A6XX_RBBM_CLOCK_CNTL, &value);
+
+	if (value == __get_rbbm_clock_cntl_on(adreno_dev) && on)
+		return;
+
+	if (value == 0 && !on)
+		return;
+
+	/*
+	 * Disable SP clock before programming HWCG registers.
+	 * A612 and A610 GPU is not having the GX power domain.
+	 * Hence skip GMU_GX registers for A12 and A610.
+	 */
+
+	if (gmu_core_isenabled(device) && !adreno_is_a612(adreno_dev) &&
+		!adreno_is_a610(adreno_dev) && !adreno_is_a702(adreno_dev))
+		gmu_core_regrmw(device,
+			A6XX_GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL, 1, 0);
+	else if (adreno_is_a619_holi(adreno_dev))
+		set_holi_sptprac_clock(device, false);
+
+	for (i = 0; i < a6xx_core->hwcg_count; i++)
+		kgsl_regwrite(device, a6xx_core->hwcg[i].offset,
+			on ? a6xx_core->hwcg[i].val : 0);
+
+	/* GBIF L2 CGC control is not part of the UCHE */
+	kgsl_regrmw(device, A6XX_UCHE_GBIF_GX_CONFIG, 0x70000,
+			FIELD_PREP(GENMASK(18, 16), on ? 2 : 0));
+
+	/*
+	 * Enable SP clock after programming HWCG registers.
+	 * A612 and A610 GPU is not having the GX power domain.
+	 * Hence skip GMU_GX registers for A612.
+	 */
+	if (gmu_core_isenabled(device) && !adreno_is_a612(adreno_dev) &&
+		!adreno_is_a610(adreno_dev) && !adreno_is_a702(adreno_dev))
+		gmu_core_regrmw(device,
+			A6XX_GPU_GMU_GX_SPTPRAC_CLOCK_CONTROL, 0, 1);
+	else if (adreno_is_a619_holi(adreno_dev))
+		set_holi_sptprac_clock(device, true);
+
+	/* enable top level HWCG */
+	kgsl_regwrite(device, A6XX_RBBM_CLOCK_CNTL,
+		on ? __get_rbbm_clock_cntl_on(adreno_dev) : 0);
+}
+
+struct a6xx_reglist_list {
+	u32 *regs;
+	u32 count;
+};
+
+#define REGLIST(_a) \
+	 (struct a6xx_reglist_list) { .regs = _a, .count = ARRAY_SIZE(_a), }
+
+static void a6xx_patch_pwrup_reglist(struct adreno_device *adreno_dev)
+{
+	struct a6xx_reglist_list reglist[4];
+	void *ptr = adreno_dev->pwrup_reglist->hostptr;
+	struct cpu_gpu_lock *lock = ptr;
+	int items = 0, i, j;
+	u32 *dest = ptr + sizeof(*lock);
+	u16 list_offset = 0;
+
+	/* Static IFPC-only registers */
+	reglist[items] = REGLIST(a6xx_ifpc_pwrup_reglist);
+	list_offset += reglist[items++].count * 2;
+
+	if (adreno_is_a650_family(adreno_dev)) {
+		reglist[items] = REGLIST(a650_ifpc_pwrup_reglist);
+		list_offset += reglist[items++].count * 2;
+	}
+
+	/* Static IFPC + preemption registers */
+	reglist[items++] = REGLIST(a6xx_pwrup_reglist);
+
+	/* Add target specific registers */
+	if (adreno_is_a615_family(adreno_dev))
+		reglist[items++] = REGLIST(a615_pwrup_reglist);
+	else if (adreno_is_a650_family(adreno_dev))
+		reglist[items++] = REGLIST(a650_pwrup_reglist);
+
+	/*
+	 * For each entry in each of the lists, write the offset and the current
+	 * register value into the GPU buffer
+	 */
+	for (i = 0; i < items; i++) {
+		u32 *r = reglist[i].regs;
+
+		for (j = 0; j < reglist[i].count; j++) {
+			*dest++ = r[j];
+			kgsl_regread(KGSL_DEVICE(adreno_dev), r[j], dest++);
+		}
+
+		lock->list_length += reglist[i].count * 2;
+	}
+
+	if (adreno_is_a630(adreno_dev)) {
+		*dest++ = A6XX_RBBM_VBIF_CLIENT_QOS_CNTL;
+		kgsl_regread(KGSL_DEVICE(adreno_dev),
+			A6XX_RBBM_VBIF_CLIENT_QOS_CNTL, dest++);
+	} else {
+		*dest++ = A6XX_RBBM_GBIF_CLIENT_QOS_CNTL;
+		kgsl_regread(KGSL_DEVICE(adreno_dev),
+			A6XX_RBBM_GBIF_CLIENT_QOS_CNTL, dest++);
+	}
+
+	lock->list_length += 2;
+
+	*dest++ = A6XX_RBBM_PERFCTR_CNTL;
+	*dest++ = 1;
+	lock->list_length += 2;
+
+	/*
+	 * The overall register list is composed of
+	 * 1. Static IFPC-only registers
+	 * 2. Static IFPC + preemption registers
+	 * 3. Dynamic IFPC + preemption registers (ex: perfcounter selects)
+	 *
+	 * The CP views the second and third entries as one dynamic list
+	 * starting from list_offset. list_length should be the total dwords in
+	 * all the lists and list_offset should be specified as the size in
+	 * dwords of the first entry in the list.
+	 */
+	lock->list_offset = list_offset;
+}
+
+
+static void a6xx_llc_configure_gpu_scid(struct adreno_device *adreno_dev);
+static void a6xx_llc_configure_gpuhtw_scid(struct adreno_device *adreno_dev);
+static void a6xx_llc_enable_overrides(struct adreno_device *adreno_dev);
+
+static void a6xx_set_secvid(struct kgsl_device *device)
+{
+	static bool set;
+
+	if (set || !device->mmu.secured)
+		return;
+
+	kgsl_regwrite(device, A6XX_RBBM_SECVID_TSB_CNTL, 0x0);
+	kgsl_regwrite(device, A6XX_RBBM_SECVID_TSB_TRUSTED_BASE_LO,
+		lower_32_bits(KGSL_IOMMU_SECURE_BASE32));
+	kgsl_regwrite(device, A6XX_RBBM_SECVID_TSB_TRUSTED_BASE_HI,
+		upper_32_bits(KGSL_IOMMU_SECURE_BASE32));
+	kgsl_regwrite(device, A6XX_RBBM_SECVID_TSB_TRUSTED_SIZE,
+		FIELD_PREP(GENMASK(31, 12),
+		(KGSL_IOMMU_SECURE_SIZE(&device->mmu) / SZ_4K)));
+
+	if (ADRENO_QUIRK(ADRENO_DEVICE(device), ADRENO_QUIRK_SECVID_SET_ONCE))
+		set = true;
+}
+
+static void a6xx_deassert_gbif_halt(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	kgsl_regwrite(device, A6XX_GBIF_HALT, 0x0);
+
+	if (adreno_is_a619_holi(adreno_dev))
+		kgsl_regwrite(device, A6XX_RBBM_GPR0_CNTL, 0x0);
+	else
+		kgsl_regwrite(device, A6XX_RBBM_GBIF_HALT, 0x0);
+}
+
+static bool a6xx_gx_is_on(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	bool gdsc_on, clk_on;
+
+	clk_on = __clk_is_enabled(pwr->grp_clks[0]);
+
+	if (pwr->gx_pd)
+		gdsc_on = kgsl_genpd_is_enabled(pwr->gx_pd);
+	else
+		gdsc_on = regulator_is_enabled(pwr->gx_regulator);
+
+	return (gdsc_on & clk_on);
+}
+
+/*
+ * Some targets support marking certain transactions as always privileged which
+ * allows us to mark more memory as privileged without having to explicitly set
+ * the APRIV bit.  For those targets, choose the following transactions to be
+ * privileged by default:
+ * CDWRITE     [6:6] - Crashdumper writes
+ * CDREAD      [5:5] - Crashdumper reads
+ * RBRPWB      [3:3] - RPTR shadow writes
+ * RBPRIVLEVEL [2:2] - Memory accesses from PM4 packets in the ringbuffer
+ * RBFETCH     [1:1] - Ringbuffer reads
+ */
+#define A6XX_APRIV_DEFAULT \
+	((1 << 6) | (1 << 5) | (1 << 3) | (1 << 2) | (1 << 1))
+
+void a6xx_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	unsigned int mal, mode, hbb_hi = 0, hbb_lo = 0;
+	unsigned int uavflagprd_inv;
+	unsigned int amsbc = 0;
+	unsigned int rgb565_predicator = 0;
+	unsigned int level2_swizzling_dis = 0;
+
+	/* Enable 64 bit addressing */
+	kgsl_regwrite(device, A6XX_CP_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_VSC_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_GRAS_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_RB_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_PC_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_HLSQ_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_VFD_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_VPC_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_UCHE_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_SP_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_TPL1_ADDR_MODE_CNTL, 0x1);
+	kgsl_regwrite(device, A6XX_RBBM_SECVID_TSB_ADDR_MODE_CNTL, 0x1);
+
+	/* Set up VBIF registers from the GPU core definition */
+	kgsl_regmap_multi_write(&device->regmap, a6xx_core->vbif,
+		a6xx_core->vbif_count);
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_LIMIT_UCHE_GBIF_RW))
+		kgsl_regwrite(device, A6XX_UCHE_GBIF_GX_CONFIG, 0x10200F9);
+
+	/* Make all blocks contribute to the GPU BUSY perf counter */
+	kgsl_regwrite(device, A6XX_RBBM_PERFCTR_GPU_BUSY_MASKED, 0xFFFFFFFF);
+
+	/*
+	 * Set UCHE_WRITE_THRU_BASE to the UCHE_TRAP_BASE effectively
+	 * disabling L2 bypass
+	 */
+	kgsl_regwrite(device, A6XX_UCHE_WRITE_RANGE_MAX_LO, 0xffffffc0);
+	kgsl_regwrite(device, A6XX_UCHE_WRITE_RANGE_MAX_HI, 0x0001ffff);
+	kgsl_regwrite(device, A6XX_UCHE_TRAP_BASE_LO, 0xfffff000);
+	kgsl_regwrite(device, A6XX_UCHE_TRAP_BASE_HI, 0x0001ffff);
+	kgsl_regwrite(device, A6XX_UCHE_WRITE_THRU_BASE_LO, 0xfffff000);
+	kgsl_regwrite(device, A6XX_UCHE_WRITE_THRU_BASE_HI, 0x0001ffff);
+
+	/*
+	 * Some A6xx targets no longer use a programmed UCHE GMEM base
+	 * address, so only write the registers if this address is
+	 * non-zero.
+	 */
+	if (adreno_dev->uche_gmem_base) {
+		kgsl_regwrite(device, A6XX_UCHE_GMEM_RANGE_MIN_LO,
+				adreno_dev->uche_gmem_base);
+		kgsl_regwrite(device, A6XX_UCHE_GMEM_RANGE_MIN_HI, 0x0);
+		kgsl_regwrite(device, A6XX_UCHE_GMEM_RANGE_MAX_LO,
+				adreno_dev->uche_gmem_base +
+				adreno_dev->gpucore->gmem_size - 1);
+		kgsl_regwrite(device, A6XX_UCHE_GMEM_RANGE_MAX_HI, 0x0);
+	}
+
+	kgsl_regwrite(device, A6XX_UCHE_FILTER_CNTL, 0x804);
+	kgsl_regwrite(device, A6XX_UCHE_CACHE_WAYS, 0x4);
+
+	/* ROQ sizes are twice as big on a640/a680 than on a630 */
+	if ((ADRENO_GPUREV(adreno_dev) >= ADRENO_REV_A640) &&
+		       !adreno_is_a702(adreno_dev)) {
+		kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_2, 0x02000140);
+		kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_1, 0x8040362C);
+	} else if (adreno_is_a612(adreno_dev) || adreno_is_a610(adreno_dev) ||
+			adreno_is_a702(adreno_dev)) {
+		kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_2, 0x00800060);
+		kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_1, 0x40201b16);
+	} else {
+		kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_2, 0x010000C0);
+		kgsl_regwrite(device, A6XX_CP_ROQ_THRESHOLDS_1, 0x8040362C);
+	}
+
+	if (adreno_is_a660(adreno_dev))
+		kgsl_regwrite(device, A6XX_CP_LPAC_PROG_FIFO_SIZE, 0x00000020);
+
+	if (adreno_is_a663(adreno_dev)) {
+		kgsl_regwrite(device, A6XX_RBBM_GBIF_CLIENT_QOS_CNTL, 0x0);
+		kgsl_regwrite(device, A6XX_RBBM_LPAC_GBIF_CLIENT_QOS_CNTL, 0x0);
+		kgsl_regwrite(device, A6XX_CP_LPAC_PROG_FIFO_SIZE, 0x00000020);
+	}
+
+	if (adreno_is_a612(adreno_dev) || adreno_is_a610(adreno_dev)) {
+		/* For A612 and A610 Mem pool size is reduced to 48 */
+		kgsl_regwrite(device, A6XX_CP_MEM_POOL_SIZE, 48);
+		kgsl_regwrite(device, A6XX_CP_MEM_POOL_DBG_ADDR, 47);
+	} else if (adreno_is_a702(adreno_dev)) {
+		kgsl_regwrite(device, A6XX_CP_MEM_POOL_SIZE, 64);
+		kgsl_regwrite(device, A6XX_CP_MEM_POOL_DBG_ADDR, 63);
+	} else {
+		kgsl_regwrite(device, A6XX_CP_MEM_POOL_SIZE, 128);
+	}
+
+	/* Setting the primFifo thresholds values */
+	kgsl_regwrite(device, A6XX_PC_DBG_ECO_CNTL,
+		a6xx_core->prim_fifo_threshold);
+
+	/* This enables ECO for an issue in SP instruction fetching */
+	if (adreno_is_a642l(adreno_dev) || adreno_is_a643(adreno_dev))
+		kgsl_regrmw(device, A6XX_SP_DBG_ECO_CNTL, 0x6,
+			FIELD_PREP(GENMASK(2, 1), 0x3));
+
+	/* Set the AHB default slave response to "ERROR" */
+	kgsl_regwrite(device, A6XX_CP_AHB_CNTL, 0x1);
+
+	/* Turn on performance counters */
+	kgsl_regwrite(device, A6XX_RBBM_PERFCTR_CNTL, 0x1);
+
+	/* Turn on the IFPC counter (countable 4 on XOCLK4) */
+	if (gmu_core_isenabled(device))
+		gmu_core_regrmw(device, A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_1,
+			0xff, 0x4);
+
+	/* Turn on GX_MEM retention */
+	if (gmu_core_isenabled(device) && adreno_is_a612(adreno_dev)) {
+		kgsl_regwrite(device, A6XX_RBBM_BLOCK_GX_RETENTION_CNTL, 0x7FB);
+		/* For CP IPC interrupt */
+		kgsl_regwrite(device, A6XX_RBBM_INT_2_MASK, 0x00000010);
+	}
+
+	if (of_property_read_u32(device->pdev->dev.of_node,
+		"qcom,min-access-length", &mal))
+		mal = 32;
+
+	if (of_property_read_u32(device->pdev->dev.of_node,
+		"qcom,ubwc-mode", &mode))
+		mode = 0;
+
+	switch (mode) {
+	case KGSL_UBWC_1_0:
+		mode = 1;
+		break;
+	case KGSL_UBWC_2_0:
+		mode = 0;
+		break;
+	case KGSL_UBWC_3_0:
+		mode = 0;
+		amsbc = 1; /* Only valid for A640 and A680 */
+		break;
+	case KGSL_UBWC_4_0:
+		mode = 0;
+		rgb565_predicator = 1;
+		amsbc = 1;
+		if (adreno_is_a663(adreno_dev))
+			level2_swizzling_dis = 1;
+		break;
+	default:
+		break;
+	}
+
+	/* macrotilingmode 0: 4 channels (default)
+	 * overwrite to 1: 8 channels for A680
+	 */
+	if (adreno_is_a680(adreno_dev) ||
+			adreno_is_a663(adreno_dev))
+		kgsl_regwrite(device, A6XX_RBBM_NC_MODE_CNTL, 1);
+
+	if (!WARN_ON(!adreno_dev->highest_bank_bit)) {
+		hbb_lo = (adreno_dev->highest_bank_bit - 13) & 3;
+		hbb_hi = ((adreno_dev->highest_bank_bit - 13) >> 2) & 1;
+	}
+
+	mal = (mal == 64) ? 1 : 0;
+
+	uavflagprd_inv = (adreno_is_a650_family(adreno_dev)) ? 2 : 0;
+
+	kgsl_regwrite(device, A6XX_RB_NC_MODE_CNTL,
+				(level2_swizzling_dis << 12) | (rgb565_predicator << 11)|
+				(hbb_hi << 10) | (amsbc << 4) | (mal << 3) |
+				(hbb_lo << 1) | mode);
+
+	kgsl_regwrite(device, A6XX_TPL1_NC_MODE_CNTL,
+				(level2_swizzling_dis << 6) | (hbb_hi << 4) |
+				(mal << 3) | (hbb_lo << 1) | mode);
+
+	kgsl_regwrite(device, A6XX_SP_NC_MODE_CNTL,
+				(level2_swizzling_dis << 12) | (hbb_hi << 10) |
+				(mal << 3) | (uavflagprd_inv << 4) |
+				(hbb_lo << 1) | mode);
+
+	kgsl_regwrite(device, A6XX_UCHE_MODE_CNTL, (mal << 23) |
+		(hbb_lo << 21));
+
+	kgsl_regwrite(device, A6XX_RBBM_INTERFACE_HANG_INT_CNTL,
+				(1 << 30) | a6xx_core->hang_detect_cycles);
+
+	kgsl_regwrite(device, A6XX_UCHE_CLIENT_PF, BIT(7) |
+			FIELD_PREP(GENMASK(3, 0), adreno_dev->uche_client_pf));
+
+	/* Set weights for bicubic filtering */
+	if (adreno_is_a650_family(adreno_dev)) {
+		kgsl_regwrite(device, A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_0, 0);
+		kgsl_regwrite(device, A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_1,
+			0x3FE05FF4);
+		kgsl_regwrite(device, A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_2,
+			0x3FA0EBEE);
+		kgsl_regwrite(device, A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_3,
+			0x3F5193ED);
+		kgsl_regwrite(device, A6XX_TPL1_BICUBIC_WEIGHTS_TABLE_4,
+			0x3F0243F0);
+	}
+
+	/* Set TWOPASSUSEWFI in A6XX_PC_DBG_ECO_CNTL if requested */
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_TWO_PASS_USE_WFI))
+		kgsl_regrmw(device, A6XX_PC_DBG_ECO_CNTL, 0, (1 << 8));
+
+	/* Set the bit vccCacheSkipDis=1 to get rid of TSEskip logic */
+	if (a6xx_core->disable_tseskip)
+		kgsl_regrmw(device, A6XX_PC_DBG_ECO_CNTL, 0, (1 << 9));
+
+	/* Set the bit in HLSQ Cluster for A702 */
+	if (adreno_is_a702(adreno_dev))
+		kgsl_regwrite(device, A6XX_CP_CHICKEN_DBG, (1 << 24));
+
+	/* Enable the GMEM save/restore feature for preemption */
+	if (adreno_is_preemption_enabled(adreno_dev))
+		kgsl_regwrite(device, A6XX_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE,
+			0x1);
+
+	/*
+	 * Enable GMU power counter 0 to count GPU busy. This is applicable to
+	 * all a6xx targets
+	 */
+	kgsl_regwrite(device, A6XX_GPU_GMU_AO_GPU_CX_BUSY_MASK, 0xff000000);
+	kgsl_regrmw(device, A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_0, 0xff, 0x20);
+	kgsl_regwrite(device, A6XX_GMU_CX_GMU_POWER_COUNTER_ENABLE, 0x1);
+
+	a6xx_protect_init(adreno_dev);
+	/*
+	 * We start LM here because we want all the following to be up
+	 * 1. GX HS
+	 * 2. SPTPRAC
+	 * 3. HFI
+	 * At this point, we are guaranteed all.
+	 */
+
+	/* Configure LLCC */
+	a6xx_llc_configure_gpu_scid(adreno_dev);
+	a6xx_llc_configure_gpuhtw_scid(adreno_dev);
+
+	a6xx_llc_enable_overrides(adreno_dev);
+
+	if (adreno_is_a662(adreno_dev))
+		kgsl_regrmw(device, A6XX_GBIF_CX_CONFIG, 0x3c0,
+			FIELD_PREP(GENMASK(7, 6), 0x1) |
+			FIELD_PREP(GENMASK(9, 8), 0x1));
+
+	if (adreno_is_a660(adreno_dev)) {
+		kgsl_regwrite(device, A6XX_CP_CHICKEN_DBG, 0x1);
+		kgsl_regwrite(device, A6XX_RBBM_GBIF_CLIENT_QOS_CNTL, 0x0);
+
+		/* Set dualQ + disable afull for A660 GPU but not for A642l and A643 */
+		if (!adreno_is_a642l(adreno_dev) &&
+				!adreno_is_a643(adreno_dev))
+			kgsl_regwrite(device, A6XX_UCHE_CMDQ_CONFIG, 0x66906);
+	}
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_APRIV))
+		kgsl_regwrite(device, A6XX_CP_APRIV_CNTL, A6XX_APRIV_DEFAULT);
+
+	a6xx_set_secvid(device);
+
+	/*
+	 * Enable hardware clock gating here to prevent any register access
+	 * issue due to internal clock gating.
+	 */
+	a6xx_hwcg_set(adreno_dev, true);
+
+	/*
+	 * All registers must be written before this point so that we don't
+	 * miss any register programming when we patch the power up register
+	 * list.
+	 */
+	if (!adreno_dev->patch_reglist &&
+		(adreno_dev->pwrup_reglist->gpuaddr != 0)) {
+		a6xx_patch_pwrup_reglist(adreno_dev);
+		adreno_dev->patch_reglist = true;
+	}
+
+	/*
+	 * During adreno_stop, GBIF halt is asserted to ensure
+	 * no further transaction can go through GPU before GPU
+	 * headswitch is turned off.
+	 *
+	 * This halt is deasserted once headswitch goes off but
+	 * incase headswitch doesn't goes off clear GBIF halt
+	 * here to ensure GPU wake-up doesn't fail because of
+	 * halted GPU transactions.
+	 */
+	a6xx_deassert_gbif_halt(adreno_dev);
+
+}
+
+/* Offsets into the MX/CX mapped register regions */
+#define RDPM_MX_OFFSET 0xf00
+#define RDPM_CX_OFFSET 0xf18
+
+void a6xx_rdpm_mx_freq_update(struct a6xx_gmu_device *gmu,
+		u32 freq)
+{
+	if (gmu->rdpm_mx_virt) {
+		writel_relaxed(freq/1000,
+			(gmu->rdpm_mx_virt + RDPM_MX_OFFSET));
+
+		/*
+		 * ensure previous writes post before this one,
+		 * i.e. act like normal writel()
+		 */
+		wmb();
+	}
+}
+
+void a6xx_rdpm_cx_freq_update(struct a6xx_gmu_device *gmu,
+		u32 freq)
+{
+	if (gmu->rdpm_cx_virt) {
+		writel_relaxed(freq/1000,
+			(gmu->rdpm_cx_virt + RDPM_CX_OFFSET));
+
+		/*
+		 * ensure previous writes post before this one,
+		 * i.e. act like normal writel()
+		 */
+		wmb();
+	}
+}
+
+/* This is the start point for non GMU/RGMU targets */
+static int a6xx_nogmu_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/*
+	 * During adreno_stop() GBIF halt is asserted to ensure that
+	 * no further transactions go through the GPU before the
+	 * GPU headswitch is turned off.
+	 *
+	 * The halt is supposed to be deasserted when the headswitch goes off
+	 * but clear it again during start to be sure
+	 */
+	kgsl_regwrite(device, A6XX_GBIF_HALT, 0x0);
+	kgsl_regwrite(device, A6XX_RBBM_GBIF_HALT, 0x0);
+
+	ret = kgsl_mmu_start(device);
+	if (ret)
+		return ret;
+
+	adreno_get_bus_counters(adreno_dev);
+	adreno_perfcounter_restore(adreno_dev);
+
+	a6xx_start(adreno_dev);
+	return 0;
+}
+
+/*
+ * CP_INIT_MAX_CONTEXT bit tells if the multiple hardware contexts can
+ * be used at once of if they should be serialized
+ */
+#define CP_INIT_MAX_CONTEXT BIT(0)
+
+/* Enables register protection mode */
+#define CP_INIT_ERROR_DETECTION_CONTROL BIT(1)
+
+/* Header dump information */
+#define CP_INIT_HEADER_DUMP BIT(2) /* Reserved */
+
+/* Default Reset states enabled for PFP and ME */
+#define CP_INIT_DEFAULT_RESET_STATE BIT(3)
+
+/* Drawcall filter range */
+#define CP_INIT_DRAWCALL_FILTER_RANGE BIT(4)
+
+/* Ucode workaround masks */
+#define CP_INIT_UCODE_WORKAROUND_MASK BIT(5)
+
+/*
+ * Operation mode mask
+ *
+ * This ordinal provides the option to disable the
+ * save/restore of performance counters across preemption.
+ */
+#define CP_INIT_OPERATION_MODE_MASK BIT(6)
+
+/* Register initialization list */
+#define CP_INIT_REGISTER_INIT_LIST BIT(7)
+
+/* Register initialization list with spinlock */
+#define CP_INIT_REGISTER_INIT_LIST_WITH_SPINLOCK BIT(8)
+
+#define CP_INIT_MASK (CP_INIT_MAX_CONTEXT | \
+		CP_INIT_ERROR_DETECTION_CONTROL | \
+		CP_INIT_HEADER_DUMP | \
+		CP_INIT_DEFAULT_RESET_STATE | \
+		CP_INIT_UCODE_WORKAROUND_MASK | \
+		CP_INIT_OPERATION_MODE_MASK | \
+		CP_INIT_REGISTER_INIT_LIST_WITH_SPINLOCK)
+
+void a6xx_cp_init_cmds(struct adreno_device *adreno_dev, u32 *cmds)
+{
+	int i = 0;
+
+	cmds[i++] = cp_type7_packet(CP_ME_INIT, A6XX_CP_INIT_DWORDS - 1);
+
+	/* Enabled ordinal mask */
+	cmds[i++] = CP_INIT_MASK;
+
+	if (CP_INIT_MASK & CP_INIT_MAX_CONTEXT)
+		cmds[i++] = 0x00000003;
+
+	if (CP_INIT_MASK & CP_INIT_ERROR_DETECTION_CONTROL)
+		cmds[i++] = 0x20000000;
+
+	if (CP_INIT_MASK & CP_INIT_HEADER_DUMP) {
+		/* Header dump address */
+		cmds[i++] = 0x00000000;
+		/* Header dump enable and dump size */
+		cmds[i++] = 0x00000000;
+	}
+
+	if (CP_INIT_MASK & CP_INIT_UCODE_WORKAROUND_MASK)
+		cmds[i++] = 0x00000000;
+
+	if (CP_INIT_MASK & CP_INIT_OPERATION_MODE_MASK)
+		cmds[i++] = 0x00000002;
+
+	if (CP_INIT_MASK & CP_INIT_REGISTER_INIT_LIST_WITH_SPINLOCK) {
+		uint64_t gpuaddr = adreno_dev->pwrup_reglist->gpuaddr;
+
+		cmds[i++] = lower_32_bits(gpuaddr);
+		cmds[i++] = upper_32_bits(gpuaddr);
+		cmds[i++] =  0;
+	}
+}
+
+void a6xx_spin_idle_debug(struct adreno_device *adreno_dev,
+				const char *str)
+{
+	struct kgsl_device *device = &adreno_dev->dev;
+	unsigned int rptr, wptr;
+	unsigned int status, status3, intstatus;
+	unsigned int hwfault;
+
+	dev_err(device->dev, str);
+
+	kgsl_regread(device, A6XX_CP_RB_RPTR, &rptr);
+	kgsl_regread(device, A6XX_CP_RB_WPTR, &wptr);
+
+	kgsl_regread(device, A6XX_RBBM_STATUS, &status);
+	kgsl_regread(device, A6XX_RBBM_STATUS3, &status3);
+	kgsl_regread(device, A6XX_RBBM_INT_0_STATUS, &intstatus);
+	kgsl_regread(device, A6XX_CP_HW_FAULT, &hwfault);
+
+
+	dev_err(device->dev,
+		"rb=%d pos=%X/%X rbbm_status=%8.8X/%8.8X int_0_status=%8.8X\n",
+		adreno_dev->cur_rb ? adreno_dev->cur_rb->id : -1, rptr, wptr,
+		status, status3, intstatus);
+
+	dev_err(device->dev, " hwfault=%8.8X\n", hwfault);
+
+	kgsl_device_snapshot(device, NULL, NULL, false);
+
+}
+
+/*
+ * a6xx_send_cp_init() - Initialize ringbuffer
+ * @adreno_dev: Pointer to adreno device
+ * @rb: Pointer to the ringbuffer of device
+ *
+ * Submit commands for ME initialization,
+ */
+static int a6xx_send_cp_init(struct adreno_device *adreno_dev,
+			 struct adreno_ringbuffer *rb)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int *cmds;
+	int ret;
+
+	cmds = adreno_ringbuffer_allocspace(rb, A6XX_CP_INIT_DWORDS);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	a6xx_cp_init_cmds(adreno_dev, cmds);
+
+	ret = a6xx_ringbuffer_submit(rb, NULL, true);
+	if (!ret) {
+		ret = adreno_spin_idle(adreno_dev, 2000);
+		if (ret) {
+			a6xx_spin_idle_debug(adreno_dev,
+				"CP initialization failed to idle\n");
+
+			kgsl_sharedmem_writel(device->scratch,
+				SCRATCH_RB_OFFSET(rb->id, rptr), 0);
+			rb->wptr = 0;
+			rb->_wptr = 0;
+		}
+	}
+
+	return ret;
+}
+
+/*
+ * Follow the ME_INIT sequence with a preemption yield to allow the GPU to move
+ * to a different ringbuffer, if desired
+ */
+static int _preemption_init(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, unsigned int *cmds,
+		struct kgsl_context *context)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int *cmds_orig = cmds;
+
+	/* Turn CP protection OFF on legacy targets */
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_APRIV))
+		cmds += cp_protected_mode(adreno_dev, cmds, 0);
+
+	*cmds++ = cp_type7_packet(CP_SET_PSEUDO_REGISTER,
+			kgsl_mmu_is_secured(&device->mmu) ? 6 : 3);
+	*cmds++ = SET_PSEUDO_PRIV_NON_SECURE_SAVE_ADDR;
+	cmds += cp_gpuaddr(adreno_dev, cmds,
+			rb->preemption_desc->gpuaddr);
+
+	if (kgsl_mmu_is_secured(&device->mmu)) {
+		*cmds++ = SET_PSEUDO_PRIV_SECURE_SAVE_ADDR;
+		cmds += cp_gpuaddr(adreno_dev, cmds,
+			rb->secure_preemption_desc->gpuaddr);
+	}
+
+	/* Turn CP protection back ON */
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_APRIV))
+		cmds += cp_protected_mode(adreno_dev, cmds, 1);
+
+	*cmds++ = cp_type7_packet(CP_CONTEXT_SWITCH_YIELD, 4);
+	cmds += cp_gpuaddr(adreno_dev, cmds, 0x0);
+	*cmds++ = 0;
+	/* generate interrupt on preemption completion */
+	*cmds++ = 0;
+
+	return cmds - cmds_orig;
+}
+
+static int a6xx_post_start(struct adreno_device *adreno_dev)
+{
+	int ret;
+	unsigned int *cmds, *start;
+	struct adreno_ringbuffer *rb = adreno_dev->cur_rb;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	cmds = adreno_ringbuffer_allocspace(rb, 42);
+	if (IS_ERR(cmds)) {
+		dev_err(device->dev,
+			     "error allocating preemption init cmds\n");
+		return PTR_ERR(cmds);
+	}
+	start = cmds;
+
+	cmds += _preemption_init(adreno_dev, rb, cmds, NULL);
+
+	rb->_wptr = rb->_wptr - (42 - (cmds - start));
+
+	ret = a6xx_ringbuffer_submit(rb, NULL, false);
+	if (!ret) {
+		ret = adreno_spin_idle(adreno_dev, 2000);
+		if (ret)
+			a6xx_spin_idle_debug(adreno_dev,
+				"hw preemption initialization failed to idle\n");
+	}
+
+	return ret;
+}
+
+int a6xx_rb_start(struct adreno_device *adreno_dev)
+{
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 cp_rb_cntl = A6XX_CP_RB_CNTL_DEFAULT |
+		(ADRENO_FEATURE(adreno_dev, ADRENO_APRIV) ? 0 : (1 << 27));
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_SQE);
+	struct adreno_ringbuffer *rb;
+	uint64_t addr;
+	int ret, i;
+	unsigned int *cmds;
+
+	/* Clear all the ringbuffers */
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		memset(rb->buffer_desc->hostptr, 0xaa, KGSL_RB_SIZE);
+		kgsl_sharedmem_writel(device->scratch,
+			SCRATCH_RB_OFFSET(rb->id, rptr), 0);
+
+		rb->wptr = 0;
+		rb->_wptr = 0;
+		rb->wptr_preempt_end = ~0;
+	}
+
+	a6xx_preemption_start(adreno_dev);
+
+	/* Set up the current ringbuffer */
+	rb = ADRENO_CURRENT_RINGBUFFER(adreno_dev);
+	addr = SCRATCH_RB_GPU_ADDR(device, rb->id, rptr);
+
+	kgsl_regwrite(device, A6XX_CP_RB_RPTR_ADDR_LO, lower_32_bits(addr));
+	kgsl_regwrite(device, A6XX_CP_RB_RPTR_ADDR_HI, upper_32_bits(addr));
+
+	/*
+	 * The size of the ringbuffer in the hardware is the log2
+	 * representation of the size in quadwords (sizedwords / 2).
+	 */
+	kgsl_regwrite(device, A6XX_CP_RB_CNTL, cp_rb_cntl);
+
+	kgsl_regwrite(device, A6XX_CP_RB_BASE,
+		lower_32_bits(rb->buffer_desc->gpuaddr));
+
+	kgsl_regwrite(device, A6XX_CP_RB_BASE_HI,
+		upper_32_bits(rb->buffer_desc->gpuaddr));
+
+	/* Program the ucode base for CP */
+	kgsl_regwrite(device, A6XX_CP_SQE_INSTR_BASE_LO,
+		lower_32_bits(fw->memdesc->gpuaddr));
+	kgsl_regwrite(device, A6XX_CP_SQE_INSTR_BASE_HI,
+		upper_32_bits(fw->memdesc->gpuaddr));
+
+	/* Clear the SQE_HALT to start the CP engine */
+	kgsl_regwrite(device, A6XX_CP_SQE_CNTL, 1);
+
+	ret = a6xx_send_cp_init(adreno_dev, rb);
+	if (ret)
+		return ret;
+
+	ret = adreno_zap_shader_load(adreno_dev, a6xx_core->zap_name);
+	if (ret)
+		return ret;
+
+	/*
+	 * Take the GPU out of secure mode. Try the zap shader if it is loaded,
+	 * otherwise just try to write directly to the secure control register
+	 */
+	if (!adreno_dev->zap_loaded)
+		kgsl_regwrite(device, A6XX_RBBM_SECVID_TRUST_CNTL, 0);
+	else {
+		cmds = adreno_ringbuffer_allocspace(rb, 2);
+		if (IS_ERR(cmds))
+			return PTR_ERR(cmds);
+
+		*cmds++ = cp_packet(adreno_dev, CP_SET_SECURE_MODE, 1);
+		*cmds++ = 0;
+
+		ret = a6xx_ringbuffer_submit(rb, NULL, true);
+		if (!ret) {
+			ret = adreno_spin_idle(adreno_dev, 2000);
+			if (ret) {
+				a6xx_spin_idle_debug(adreno_dev,
+					"Switch to unsecure failed to idle\n");
+				return ret;
+			}
+		}
+	}
+
+	return a6xx_post_start(adreno_dev);
+}
+
+/*
+ * a6xx_sptprac_enable() - Power on SPTPRAC
+ * @adreno_dev: Pointer to Adreno device
+ */
+static int a6xx_sptprac_enable(struct adreno_device *adreno_dev)
+{
+	return a6xx_gmu_sptprac_enable(adreno_dev);
+}
+
+/*
+ * a6xx_sptprac_disable() - Power off SPTPRAC
+ * @adreno_dev: Pointer to Adreno device
+ */
+static void a6xx_sptprac_disable(struct adreno_device *adreno_dev)
+{
+	a6xx_gmu_sptprac_disable(adreno_dev);
+}
+
+/*
+ * a6xx_gpu_keepalive() - GMU reg write to request GPU stays on
+ * @adreno_dev: Pointer to the adreno device that has the GMU
+ * @state: State to set: true is ON, false is OFF
+ */
+static void a6xx_gpu_keepalive(struct adreno_device *adreno_dev,
+		bool state)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!gmu_core_isenabled(device))
+		return;
+
+	gmu_core_regwrite(device, A6XX_GMU_GMU_PWR_COL_KEEPALIVE, state);
+}
+
+bool a6xx_irq_pending(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 status;
+
+	kgsl_regread(device, A6XX_RBBM_INT_0_STATUS, &status);
+
+	/* Return busy if a interrupt is pending */
+	return ((status & adreno_dev->irq_mask) ||
+		atomic_read(&adreno_dev->pending_irq_refcnt));
+}
+
+static bool a619_holi_hw_isidle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int reg;
+
+	kgsl_regread(device, A6XX_RBBM_STATUS, &reg);
+	if (reg & 0xfffffffe)
+		return false;
+
+	return a6xx_irq_pending(adreno_dev) ? false : true;
+}
+
+bool a6xx_hw_isidle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int reg;
+
+	/* Non GMU devices monitor the RBBM status */
+	if (!gmu_core_isenabled(device)) {
+		kgsl_regread(device, A6XX_RBBM_STATUS, &reg);
+		if (reg & 0xfffffffe)
+			return false;
+
+		return a6xx_irq_pending(adreno_dev) ? false : true;
+	}
+
+	gmu_core_regread(device, A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, &reg);
+
+	/* Bit 23 is GPUBUSYIGNAHB */
+	return (reg & BIT(23)) ? false : true;
+}
+
+int a6xx_microcode_read(struct adreno_device *adreno_dev)
+{
+	struct adreno_firmware *sqe_fw = ADRENO_FW(adreno_dev, ADRENO_FW_SQE);
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+
+	return adreno_get_firmware(adreno_dev, a6xx_core->sqefw_name, sqe_fw);
+}
+
+static int64_t a6xx_read_throttling_counters(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int64_t adj = -1;
+	u32 a, b, c;
+	struct adreno_busy_data *busy = &adreno_dev->busy_data;
+
+	if (!(adreno_dev->lm_enabled || adreno_dev->bcl_enabled))
+		return 0;
+
+	a = counter_delta(device, A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_L,
+		&busy->throttle_cycles[0]);
+
+	b = counter_delta(device, A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_L,
+		&busy->throttle_cycles[1]);
+
+	c = counter_delta(device, A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_L,
+		&busy->throttle_cycles[2]);
+
+	/*
+	 * Currently there are no a6xx targets with both LM and BCL enabled.
+	 * So if BCL is enabled, we can log bcl counters and return.
+	 */
+	if (adreno_dev->bcl_enabled) {
+		trace_kgsl_bcl_clock_throttling(a, b, c);
+		return 0;
+	}
+
+	/*
+	 * The adjustment is the number of cycles lost to throttling, which
+	 * is calculated as a weighted average of the cycles throttled
+	 * at different levels. The adjustment is negative because in A6XX,
+	 * the busy count includes the throttled cycles. Therefore, we want
+	 * to remove them to prevent appearing to be busier than
+	 * we actually are.
+	 */
+	if (adreno_is_a620(adreno_dev) || adreno_is_a650(adreno_dev))
+		/*
+		 * With the newer generations, CRC throttle from SIDs of 0x14
+		 * and above cannot be observed in power counters. Since 90%
+		 * throttle uses SID 0x16 the adjustment calculation needs
+		 * correction. The throttling is in increments of 4.2%, and the
+		 * 91.7% counter does a weighted count by the value of sid used
+		 * which are taken into consideration for the final formula.
+		 */
+		adj *= div_s64((a * 42) + (b * 500) +
+			(div_s64((int64_t)c - a - b * 12, 22) * 917), 1000);
+	else
+		adj *= ((a * 5) + (b * 50) + (c * 90)) / 100;
+
+	trace_kgsl_clock_throttling(0, b, c, a, adj);
+
+	return adj;
+}
+#define GPU_CPR_FSM_CTL_OFFSET	 0x4
+static void a6xx_gx_cpr_toggle(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	static void __iomem *gx_cpr_virt;
+	struct resource *res;
+	u32 val = 0;
+
+	if (!a6xx_core->gx_cpr_toggle)
+		return;
+
+	if (!gx_cpr_virt) {
+		res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM,
+				"gx_cpr");
+		if (res == NULL)
+			return;
+
+		gx_cpr_virt = devm_ioremap_resource(&device->pdev->dev, res);
+		if (!gx_cpr_virt) {
+			dev_err(device->dev, "Failed to map GX CPR\n");
+			return;
+		}
+	}
+
+	/*
+	 * Toggle(disable -> enable) closed loop functionality to recover
+	 * CPR measurements stall happened under certain conditions.
+	 */
+
+	val = readl_relaxed(gx_cpr_virt + GPU_CPR_FSM_CTL_OFFSET);
+	/* Make sure memory is updated before access */
+	rmb();
+
+	writel_relaxed(val & 0xfffffff0, gx_cpr_virt + GPU_CPR_FSM_CTL_OFFSET);
+	/* make sure register write committed */
+	wmb();
+
+	/* Wait for small time before we enable GX CPR */
+	udelay(5);
+
+	writel_relaxed(val | 0x00000001, gx_cpr_virt + GPU_CPR_FSM_CTL_OFFSET);
+	/* make sure register write committed */
+	wmb();
+}
+
+/* This is only defined for non-GMU and non-RGMU targets */
+static int a6xx_clear_pending_transactions(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (adreno_is_a619_holi(adreno_dev)) {
+		kgsl_regwrite(device, A6XX_RBBM_GPR0_CNTL, 0x1e0);
+		ret = adreno_wait_for_halt_ack(device,
+			A6XX_RBBM_VBIF_GX_RESET_STATUS, 0xf0);
+	} else {
+		kgsl_regwrite(device, A6XX_RBBM_GBIF_HALT,
+			A6XX_GBIF_GX_HALT_MASK);
+		ret = adreno_wait_for_halt_ack(device, A6XX_RBBM_GBIF_HALT_ACK,
+			A6XX_GBIF_GX_HALT_MASK);
+	}
+
+	if (ret)
+		return ret;
+
+	return a6xx_halt_gbif(adreno_dev);
+}
+
+/**
+ * a6xx_reset() - Helper function to reset the GPU
+ * @adreno_dev: Pointer to the adreno device structure for the GPU
+ *
+ * Try to reset the GPU to recover from a fault for targets without
+ * a GMU.
+ */
+static int a6xx_reset(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+	unsigned long flags = device->pwrctrl.ctrl_flags;
+
+	ret = a6xx_clear_pending_transactions(adreno_dev);
+	if (ret)
+		return ret;
+
+	/* Clear ctrl_flags to ensure clocks and regulators are turned off */
+	device->pwrctrl.ctrl_flags = 0;
+
+	kgsl_pwrctrl_change_state(device, KGSL_STATE_INIT);
+
+	/* since device is officially off now clear start bit */
+	clear_bit(ADRENO_DEVICE_STARTED, &adreno_dev->priv);
+
+	a6xx_reset_preempt_records(adreno_dev);
+
+	ret = adreno_start(device, 0);
+	if (ret)
+		return ret;
+
+	kgsl_pwrctrl_change_state(device, KGSL_STATE_ACTIVE);
+
+	device->pwrctrl.ctrl_flags = flags;
+
+	/* Toggle GX CPR on demand */
+	 a6xx_gx_cpr_toggle(device);
+
+	/*
+	 * If active_cnt is zero, there is no need to keep the GPU active. So,
+	 * we should transition to SLUMBER.
+	 */
+	if (!atomic_read(&device->active_cnt))
+		kgsl_pwrctrl_change_state(device, KGSL_STATE_SLUMBER);
+
+	return 0;
+}
+
+static void a6xx_cp_hw_err_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status1, status2;
+
+	kgsl_regread(device, A6XX_CP_INTERRUPT_STATUS, &status1);
+
+	if (status1 & BIT(A6XX_CP_OPCODE_ERROR)) {
+		unsigned int opcode;
+
+		kgsl_regwrite(device, A6XX_CP_SQE_STAT_ADDR, 1);
+		kgsl_regread(device, A6XX_CP_SQE_STAT_DATA, &opcode);
+		dev_crit_ratelimited(device->dev,
+			"CP opcode error interrupt | opcode=0x%8.8x\n", opcode);
+	}
+	if (status1 & BIT(A6XX_CP_UCODE_ERROR))
+		dev_crit_ratelimited(device->dev, "CP ucode error interrupt\n");
+	if (status1 & BIT(A6XX_CP_HW_FAULT_ERROR)) {
+		kgsl_regread(device, A6XX_CP_HW_FAULT, &status2);
+		dev_crit_ratelimited(device->dev,
+			"CP | Ringbuffer HW fault | status=%x\n", status2);
+	}
+	if (status1 & BIT(A6XX_CP_REGISTER_PROTECTION_ERROR)) {
+		kgsl_regread(device, A6XX_CP_PROTECT_STATUS, &status2);
+		dev_crit_ratelimited(device->dev,
+			"CP | Protected mode error | %s | addr=%x | status=%x\n",
+			status2 & (1 << 20) ? "READ" : "WRITE",
+			status2 & 0x3FFFF, status2);
+	}
+	if (status1 & BIT(A6XX_CP_AHB_ERROR))
+		dev_crit_ratelimited(device->dev,
+			"CP AHB error interrupt\n");
+	if (status1 & BIT(A6XX_CP_VSD_PARITY_ERROR))
+		dev_crit_ratelimited(device->dev,
+			"CP VSD decoder parity error\n");
+	if (status1 & BIT(A6XX_CP_ILLEGAL_INSTR_ERROR))
+		dev_crit_ratelimited(device->dev,
+			"CP Illegal instruction error\n");
+
+}
+
+static void a6xx_err_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	switch (bit) {
+	case A6XX_INT_CP_AHB_ERROR:
+		dev_crit_ratelimited(device->dev, "CP: AHB bus error\n");
+		break;
+	case A6XX_INT_ATB_ASYNCFIFO_OVERFLOW:
+		dev_crit_ratelimited(device->dev,
+					"RBBM: ATB ASYNC overflow\n");
+		break;
+	case A6XX_INT_RBBM_ATB_BUS_OVERFLOW:
+		dev_crit_ratelimited(device->dev,
+					"RBBM: ATB bus overflow\n");
+		break;
+	case A6XX_INT_UCHE_OOB_ACCESS:
+		dev_crit_ratelimited(device->dev,
+					"UCHE: Out of bounds access\n");
+		break;
+	case A6XX_INT_UCHE_TRAP_INTR:
+		dev_crit_ratelimited(device->dev, "UCHE: Trap interrupt\n");
+		break;
+	case A6XX_INT_TSB_WRITE_ERROR:
+		dev_crit_ratelimited(device->dev, "TSB: Write error interrupt\n");
+		break;
+	default:
+		dev_crit_ratelimited(device->dev, "Unknown interrupt %d\n",
+					bit);
+	}
+}
+
+/*
+ * a6xx_llc_configure_gpu_scid() - Program the sub-cache ID for all GPU blocks
+ * @adreno_dev: The adreno device pointer
+ */
+static void a6xx_llc_configure_gpu_scid(struct adreno_device *adreno_dev)
+{
+	uint32_t gpu_scid;
+	uint32_t gpu_cntl1_val = 0;
+	int i;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_mmu *mmu = &device->mmu;
+
+	if (IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice) ||
+		!adreno_dev->gpu_llc_slice_enable)
+		return;
+
+	if (llcc_slice_activate(adreno_dev->gpu_llc_slice))
+		return;
+
+	gpu_scid = llcc_get_slice_id(adreno_dev->gpu_llc_slice);
+	for (i = 0; i < A6XX_LLC_NUM_GPU_SCIDS; i++)
+		gpu_cntl1_val = (gpu_cntl1_val << A6XX_GPU_LLC_SCID_NUM_BITS)
+			| gpu_scid;
+
+	if (mmu->subtype == KGSL_IOMMU_SMMU_V500)
+		kgsl_regrmw(device, A6XX_GBIF_SCACHE_CNTL1,
+			A6XX_GPU_LLC_SCID_MASK, gpu_cntl1_val);
+	else
+		adreno_cx_misc_regrmw(adreno_dev,
+				A6XX_GPU_CX_MISC_SYSTEM_CACHE_CNTL_1,
+				A6XX_GPU_LLC_SCID_MASK, gpu_cntl1_val);
+
+	/*
+	 * On A660, the SCID programming for UCHE traffic is done in
+	 * A6XX_GBIF_SCACHE_CNTL0[14:10]
+	 * GFO ENABLE BIT(8) : LLC uses a 64 byte cache line size enabling
+	 * GFO allows it allocate partial cache lines
+	 */
+	if (adreno_is_a660(adreno_dev) ||
+			adreno_is_a663(adreno_dev))
+		kgsl_regrmw(device, A6XX_GBIF_SCACHE_CNTL0, (0x1f << 10) |
+				BIT(8), (gpu_scid << 10) | BIT(8));
+}
+
+/*
+ * a6xx_llc_configure_gpuhtw_scid() - Program the SCID for GPU pagetables
+ * @adreno_dev: The adreno device pointer
+ */
+static void a6xx_llc_configure_gpuhtw_scid(struct adreno_device *adreno_dev)
+{
+	uint32_t gpuhtw_scid;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_mmu *mmu = &device->mmu;
+
+	if (IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice) ||
+		!adreno_dev->gpuhtw_llc_slice_enable)
+		return;
+
+	if (llcc_slice_activate(adreno_dev->gpuhtw_llc_slice))
+		return;
+
+	/*
+	 * On SMMU-v500, the GPUHTW SCID is configured via a NoC override in
+	 * the XBL image.
+	 */
+	if (mmu->subtype == KGSL_IOMMU_SMMU_V500)
+		return;
+
+	gpuhtw_scid = llcc_get_slice_id(adreno_dev->gpuhtw_llc_slice);
+
+	adreno_cx_misc_regrmw(adreno_dev,
+			A6XX_GPU_CX_MISC_SYSTEM_CACHE_CNTL_1,
+			A6XX_GPUHTW_LLC_SCID_MASK,
+			gpuhtw_scid << A6XX_GPUHTW_LLC_SCID_SHIFT);
+}
+
+/*
+ * a6xx_llc_enable_overrides() - Override the page attributes
+ * @adreno_dev: The adreno device pointer
+ */
+static void a6xx_llc_enable_overrides(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_mmu *mmu = &device->mmu;
+
+	/*
+	 * Attributes override through GBIF is not supported with MMU-500.
+	 * Attributes are used as configured through SMMU pagetable entries.
+	 */
+	if (mmu->subtype == KGSL_IOMMU_SMMU_V500)
+		return;
+
+	/*
+	 * 0x3: readnoallocoverrideen=0
+	 *      read-no-alloc=0 - Allocate lines on read miss
+	 *      writenoallocoverrideen=1
+	 *      write-no-alloc=1 - Do not allocates lines on write miss
+	 */
+	adreno_cx_misc_regwrite(adreno_dev,
+			A6XX_GPU_CX_MISC_SYSTEM_CACHE_CNTL_0, 0x3);
+}
+
+static const char *uche_client[7][3] = {
+	{"SP | VSC | VPC | HLSQ | PC | LRZ", "TP", "VFD"},
+	{"VSC | VPC | HLSQ | PC | LRZ", "TP | VFD", "SP"},
+	{"SP | VPC | HLSQ | PC | LRZ", "TP | VFD", "VSC"},
+	{"SP | VSC | HLSQ | PC | LRZ", "TP | VFD", "VPC"},
+	{"SP | VSC | VPC | PC | LRZ", "TP | VFD", "HLSQ"},
+	{"SP | VSC | VPC | HLSQ | LRZ", "TP | VFD", "PC"},
+	{"SP | VSC | VPC | HLSQ | PC", "TP | VFD", "LRZ"},
+};
+
+static const char *const uche_client_a660[] = { "VFD", "SP", "VSC", "VPC",
+						"HLSQ", "PC", "LRZ", "TP" };
+
+#define SCOOBYDOO 0x5c00bd00
+
+static const char *a6xx_fault_block_uche(struct kgsl_device *device,
+		unsigned int mid)
+{
+	unsigned int uche_client_id = 0;
+	static char str[40];
+
+	/*
+	 * Smmu driver takes a vote on CX gdsc before calling the kgsl
+	 * pagefault handler. If there is contention for device mutex in this
+	 * path and the dispatcher fault handler is holding this lock, trying
+	 * to turn off CX gdsc will fail during the reset. So to avoid blocking
+	 * here, try to lock device mutex and return if it fails.
+	 */
+	if (!mutex_trylock(&device->mutex))
+		return "UCHE: unknown";
+
+	if (!kgsl_state_is_awake(device)) {
+		mutex_unlock(&device->mutex);
+		return "UCHE: unknown";
+	}
+
+	kgsl_regread(device, A6XX_UCHE_CLIENT_PF, &uche_client_id);
+	mutex_unlock(&device->mutex);
+
+	/* Ignore the value if the gpu is in IFPC */
+	if (uche_client_id == SCOOBYDOO)
+		return "UCHE: unknown";
+
+	if (adreno_is_a660(ADRENO_DEVICE(device))) {
+
+		/* Mask is 7 bits for A660 */
+		uche_client_id &= 0x7F;
+		if (uche_client_id >= ARRAY_SIZE(uche_client_a660) ||
+				(mid == 2))
+			return "UCHE: Unknown";
+
+		if (mid == 1)
+			snprintf(str, sizeof(str), "UCHE: Not %s",
+				uche_client_a660[uche_client_id]);
+		else if (mid == 3)
+			snprintf(str, sizeof(str), "UCHE: %s",
+				uche_client_a660[uche_client_id]);
+	} else {
+		uche_client_id &= A6XX_UCHE_CLIENT_PF_CLIENT_ID_MASK;
+		if (uche_client_id >= ARRAY_SIZE(uche_client))
+			return "UCHE: Unknown";
+
+		snprintf(str, sizeof(str), "UCHE: %s",
+			uche_client[uche_client_id][mid - 1]);
+	}
+
+	return str;
+}
+
+static const char *a6xx_iommu_fault_block(struct kgsl_device *device,
+		unsigned int fsynr1)
+{
+	unsigned int mid = fsynr1 & 0xff;
+
+	switch (mid) {
+	case 0:
+		return "CP";
+	case 1:
+	case 2:
+	case 3:
+		return a6xx_fault_block_uche(device, mid);
+	case 4:
+		return "CCU";
+	case 6:
+		return "CDP Prefetch";
+	case 7:
+		return "GPMU";
+	}
+
+	return "Unknown";
+}
+
+static void a6xx_cp_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (adreno_is_preemption_enabled(adreno_dev))
+		a6xx_preemption_trigger(adreno_dev, true);
+
+	adreno_dispatcher_schedule(device);
+}
+
+/*
+ * a6xx_gpc_err_int_callback() - Isr for GPC error interrupts
+ * @adreno_dev: Pointer to device
+ * @bit: Interrupt bit
+ */
+static void a6xx_gpc_err_int_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/*
+	 * GPC error is typically the result of mistake SW programming.
+	 * Force GPU fault for this interrupt so that we can debug it
+	 * with help of register dump.
+	 */
+
+	dev_crit(device->dev, "RBBM: GPC error\n");
+	adreno_irqctrl(adreno_dev, 0);
+
+	/* Trigger a fault in the dispatcher - this will effect a restart */
+	adreno_dispatcher_fault(adreno_dev, ADRENO_SOFT_FAULT);
+}
+
+static const struct adreno_irq_funcs a6xx_irq_funcs[32] = {
+	ADRENO_IRQ_CALLBACK(NULL),              /* 0 - RBBM_GPU_IDLE */
+	ADRENO_IRQ_CALLBACK(a6xx_err_callback), /* 1 - RBBM_AHB_ERROR */
+	ADRENO_IRQ_CALLBACK(NULL), /* 2 - UNUSED */
+	ADRENO_IRQ_CALLBACK(NULL), /* 3 - UNUSED */
+	ADRENO_IRQ_CALLBACK(NULL), /* 4 - UNUSED */
+	ADRENO_IRQ_CALLBACK(NULL), /* 5 - UNUSED */
+	/* 6 - RBBM_ATB_ASYNC_OVERFLOW */
+	ADRENO_IRQ_CALLBACK(a6xx_err_callback),
+	ADRENO_IRQ_CALLBACK(a6xx_gpc_err_int_callback), /* 7 - GPC_ERR */
+	ADRENO_IRQ_CALLBACK(a6xx_preemption_callback),/* 8 - CP_SW */
+	ADRENO_IRQ_CALLBACK(a6xx_cp_hw_err_callback), /* 9 - CP_HW_ERROR */
+	ADRENO_IRQ_CALLBACK(NULL),  /* 10 - CP_CCU_FLUSH_DEPTH_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 11 - CP_CCU_FLUSH_COLOR_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 12 - CP_CCU_RESOLVE_TS */
+	ADRENO_IRQ_CALLBACK(adreno_cp_callback), /* 13 - CP_IB2_INT */
+	ADRENO_IRQ_CALLBACK(adreno_cp_callback), /* 14 - CP_IB1_INT */
+	ADRENO_IRQ_CALLBACK(adreno_cp_callback), /* 15 - CP_RB_INT */
+	ADRENO_IRQ_CALLBACK(NULL), /* 16 - UNUSED */
+	ADRENO_IRQ_CALLBACK(NULL), /* 17 - CP_RB_DONE_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 18 - CP_WT_DONE_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 19 - UNUSED */
+	ADRENO_IRQ_CALLBACK(a6xx_cp_callback), /* 20 - CP_CACHE_FLUSH_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 21 - UNUSED */
+	ADRENO_IRQ_CALLBACK(a6xx_err_callback), /* 22 - RBBM_ATB_BUS_OVERFLOW */
+	/* 23 - MISC_HANG_DETECT */
+	ADRENO_IRQ_CALLBACK(adreno_hang_int_callback),
+	ADRENO_IRQ_CALLBACK(a6xx_err_callback), /* 24 - UCHE_OOB_ACCESS */
+	ADRENO_IRQ_CALLBACK(a6xx_err_callback), /* 25 - UCHE_TRAP_INTR */
+	ADRENO_IRQ_CALLBACK(NULL), /* 26 - DEBBUS_INTR_0 */
+	ADRENO_IRQ_CALLBACK(NULL), /* 27 - DEBBUS_INTR_1 */
+	ADRENO_IRQ_CALLBACK(a6xx_err_callback), /* 28 - TSBWRITEERROR */
+	ADRENO_IRQ_CALLBACK(NULL), /* 29 - UNUSED */
+	ADRENO_IRQ_CALLBACK(NULL), /* 30 - ISDB_CPU_IRQ */
+	ADRENO_IRQ_CALLBACK(NULL), /* 31 - ISDB_UNDER_DEBUG */
+};
+
+/*
+ * If the AHB fence is not in ALLOW mode when we receive an RBBM
+ * interrupt, something went wrong. This means that we cannot proceed
+ * since the IRQ status and clear registers are not accessible.
+ * This is usually harmless because the GMU will abort power collapse
+ * and change the fence back to ALLOW. Poll so that this can happen.
+ */
+static int a6xx_irq_poll_fence(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 status, fence, fence_retries = 0;
+	u64 a, b, c;
+
+	if (!gmu_core_isenabled(device))
+		return 0;
+
+	a = a6xx_read_alwayson(adreno_dev);
+
+	kgsl_regread(device, A6XX_GMU_AO_AHB_FENCE_CTRL, &fence);
+
+	while (fence != 0) {
+		b = a6xx_read_alwayson(adreno_dev);
+
+		/* Wait for small time before trying again */
+		udelay(1);
+		kgsl_regread(device, A6XX_GMU_AO_AHB_FENCE_CTRL, &fence);
+
+		if (fence_retries == 100 && fence != 0) {
+			c = a6xx_read_alwayson(adreno_dev);
+
+			kgsl_regread(device, A6XX_GMU_RBBM_INT_UNMASKED_STATUS,
+				&status);
+
+			dev_crit_ratelimited(device->dev,
+				"status=0x%x Unmasked status=0x%x Mask=0x%x timestamps: %llx %llx %llx\n",
+					status & adreno_dev->irq_mask, status,
+					adreno_dev->irq_mask, a, b, c);
+				return -ETIMEDOUT;
+		}
+
+		fence_retries++;
+	}
+
+	return 0;
+}
+
+static irqreturn_t a6xx_irq_handler(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	irqreturn_t ret = IRQ_NONE;
+	u32 status;
+
+	/*
+	 * On A6xx, the GPU can power down once the INT_0_STATUS is read
+	 * below. But there still might be some register reads required
+	 * so force the GMU/GPU into KEEPALIVE mode until done with the ISR.
+	 */
+	a6xx_gpu_keepalive(adreno_dev, true);
+
+	if (a6xx_irq_poll_fence(adreno_dev)) {
+		adreno_dispatcher_fault(adreno_dev, ADRENO_GMU_FAULT);
+		goto done;
+	}
+
+	kgsl_regread(device, A6XX_RBBM_INT_0_STATUS, &status);
+
+	kgsl_regwrite(device, A6XX_RBBM_INT_CLEAR_CMD, status);
+
+	ret = adreno_irq_callbacks(adreno_dev, a6xx_irq_funcs, status);
+
+	trace_kgsl_a5xx_irq_status(adreno_dev, status);
+
+done:
+	/* If hard fault, then let snapshot turn off the keepalive */
+	if (!(adreno_gpu_fault(adreno_dev) & ADRENO_HARD_FAULT))
+		a6xx_gpu_keepalive(adreno_dev, false);
+
+	return ret;
+}
+
+int a6xx_probe_common(struct platform_device *pdev,
+	struct	adreno_device *adreno_dev, u32 chipid,
+	const struct adreno_gpu_core *gpucore)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gpudev *gpudev = gpucore->gpudev;
+	int ret;
+
+	adreno_dev->gpucore = gpucore;
+	adreno_dev->chipid = chipid;
+
+	adreno_reg_offset_init(gpudev->reg_offsets);
+
+	if (gmu_core_isenabled(device) && (gpudev != &adreno_a6xx_rgmu_gpudev))
+		device->pwrctrl.cx_gdsc_offset = (adreno_is_a662(adreno_dev) ||
+			adreno_is_a621(adreno_dev) || adreno_is_a663(adreno_dev) ||
+			adreno_is_a623(adreno_dev)) ?
+			A662_GPU_CC_CX_GDSCR : A6XX_GPU_CC_CX_GDSCR;
+
+	adreno_dev->hwcg_enabled = true;
+	adreno_dev->uche_client_pf = 1;
+
+	adreno_dev->preempt.preempt_level = 1;
+	adreno_dev->preempt.skipsaverestore = true;
+	adreno_dev->preempt.usesgmem = true;
+
+	ret = adreno_device_probe(pdev, adreno_dev);
+
+	if (ret)
+		return ret;
+
+	a6xx_coresight_init(adreno_dev);
+	return 0;
+}
+
+static int a6xx_probe(struct platform_device *pdev,
+		u32 chipid, const struct adreno_gpu_core *gpucore)
+{
+	struct adreno_device *adreno_dev;
+	struct kgsl_device *device;
+	int ret;
+
+	adreno_dev = (struct adreno_device *)
+		of_device_get_match_data(&pdev->dev);
+
+	memset(adreno_dev, 0, sizeof(*adreno_dev));
+
+	ret = a6xx_probe_common(pdev, adreno_dev, chipid, gpucore);
+	if (ret)
+		return ret;
+
+	ret = adreno_dispatcher_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	device = KGSL_DEVICE(adreno_dev);
+
+	timer_setup(&device->idle_timer, kgsl_timer, 0);
+
+	INIT_WORK(&device->idle_check_ws, kgsl_idle_check);
+
+	adreno_dev->irq_mask = A6XX_INT_MASK;
+
+	return 0;
+}
+
+/* Register offset defines for A6XX, in order of enum adreno_regs */
+static unsigned int a6xx_register_offsets[ADRENO_REG_REGISTER_MAX] = {
+
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_BASE, A6XX_CP_RB_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_BASE_HI, A6XX_CP_RB_BASE_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_RPTR_ADDR_LO,
+				A6XX_CP_RB_RPTR_ADDR_LO),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_RPTR_ADDR_HI,
+				A6XX_CP_RB_RPTR_ADDR_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_RPTR, A6XX_CP_RB_RPTR),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_WPTR, A6XX_CP_RB_WPTR),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_CNTL, A6XX_CP_RB_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_ME_CNTL, A6XX_CP_SQE_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BASE, A6XX_CP_IB1_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BASE_HI, A6XX_CP_IB1_BASE_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BUFSZ, A6XX_CP_IB1_REM_SIZE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BASE, A6XX_CP_IB2_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BASE_HI, A6XX_CP_IB2_BASE_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BUFSZ, A6XX_CP_IB2_REM_SIZE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_PREEMPT, A6XX_CP_CONTEXT_SWITCH_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_CONTEXT_SWITCH_SMMU_INFO_LO,
+			A6XX_CP_CONTEXT_SWITCH_SMMU_INFO_LO),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_CONTEXT_SWITCH_SMMU_INFO_HI,
+			A6XX_CP_CONTEXT_SWITCH_SMMU_INFO_HI),
+	ADRENO_REG_DEFINE(
+		ADRENO_REG_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_LO,
+			A6XX_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_LO),
+	ADRENO_REG_DEFINE(
+		ADRENO_REG_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_HI,
+			A6XX_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_HI),
+	ADRENO_REG_DEFINE(
+		ADRENO_REG_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_LO,
+			A6XX_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_LO),
+	ADRENO_REG_DEFINE(
+		ADRENO_REG_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_HI,
+			A6XX_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_LO,
+			A6XX_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_LO),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_HI,
+			A6XX_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_PREEMPT_LEVEL_STATUS,
+			A6XX_CP_CONTEXT_SWITCH_LEVEL_STATUS),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_STATUS, A6XX_RBBM_STATUS),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_STATUS3, A6XX_RBBM_STATUS3),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_INT_0_MASK, A6XX_RBBM_INT_0_MASK),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_CLOCK_CTL, A6XX_RBBM_CLOCK_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_SW_RESET_CMD, A6XX_RBBM_SW_RESET_CMD),
+	ADRENO_REG_DEFINE(ADRENO_REG_GMU_AO_HOST_INTERRUPT_MASK,
+				A6XX_GMU_AO_HOST_INTERRUPT_MASK),
+	ADRENO_REG_DEFINE(ADRENO_REG_GMU_AHB_FENCE_STATUS,
+				A6XX_GMU_AHB_FENCE_STATUS),
+	ADRENO_REG_DEFINE(ADRENO_REG_GMU_GMU2HOST_INTR_MASK,
+				A6XX_GMU_GMU2HOST_INTR_MASK),
+};
+
+int a6xx_perfcounter_update(struct adreno_device *adreno_dev,
+	struct adreno_perfcount_register *reg, bool update_reg)
+{
+	void *ptr = adreno_dev->pwrup_reglist->hostptr;
+	struct cpu_gpu_lock *lock = ptr;
+	u32 *data = ptr + sizeof(*lock);
+	int i, offset = 0;
+	bool select_reg_present = false;
+
+	for (i = 0; i < lock->list_length >> 1; i++) {
+		if (data[offset] == reg->select) {
+			select_reg_present = true;
+			break;
+		}
+
+		if (data[offset] == A6XX_RBBM_PERFCTR_CNTL)
+			break;
+
+		offset += 2;
+	}
+
+	if (kgsl_hwlock(lock)) {
+		kgsl_hwunlock(lock);
+		return -EBUSY;
+	}
+
+	/*
+	 * If the perfcounter select register is already present in reglist
+	 * update it, otherwise append the <select register, value> pair to
+	 * the end of the list.
+	 */
+	if (select_reg_present) {
+		data[offset + 1] = reg->countable;
+		goto update;
+	}
+
+	/*
+	 * For all targets A6XX_RBBM_PERFCTR_CNTL needs to be the last entry,
+	 * so overwrite the existing A6XX_RBBM_PERFCNTL_CTRL and add it back to
+	 * the end.
+	 */
+	data[offset] = reg->select;
+	data[offset + 1] = reg->countable;
+	data[offset + 2] = A6XX_RBBM_PERFCTR_CNTL,
+	data[offset + 3] = 1;
+
+	lock->list_length += 2;
+
+update:
+	if (update_reg)
+		kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg->select,
+			reg->countable);
+
+	kgsl_hwunlock(lock);
+	return 0;
+}
+
+u64 a6xx_read_alwayson(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 lo = 0, hi = 0, tmp = 0;
+
+	if (!gmu_core_isenabled(device)) {
+		kgsl_regread(device, A6XX_CP_ALWAYS_ON_COUNTER_LO, &lo);
+		kgsl_regread(device, A6XX_CP_ALWAYS_ON_COUNTER_HI, &hi);
+	} else {
+		/* Always use the GMU AO counter when doing a AHB read */
+		gmu_core_regread(device, A6XX_GMU_ALWAYS_ON_COUNTER_H, &hi);
+		gmu_core_regread(device, A6XX_GMU_ALWAYS_ON_COUNTER_L, &lo);
+
+		/* Check for overflow */
+		gmu_core_regread(device, A6XX_GMU_ALWAYS_ON_COUNTER_H, &tmp);
+
+		if (hi != tmp) {
+			gmu_core_regread(device, A6XX_GMU_ALWAYS_ON_COUNTER_L,
+				&lo);
+			hi = tmp;
+		}
+	}
+
+	return (((u64) hi) << 32) | lo;
+}
+
+static void a6xx_remove(struct adreno_device *adreno_dev)
+{
+	if (adreno_preemption_feature_set(adreno_dev))
+		del_timer(&adreno_dev->preempt.timer);
+}
+
+static void a6xx_read_bus_stats(struct kgsl_device *device,
+		struct kgsl_power_stats *stats,
+		struct adreno_busy_data *busy)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	u64 ram_cycles, starved_ram;
+
+	ram_cycles = counter_delta(device, adreno_dev->ram_cycles_lo,
+		&busy->bif_ram_cycles);
+
+	starved_ram = counter_delta(device, adreno_dev->starved_ram_lo,
+		&busy->bif_starved_ram);
+
+	if (!adreno_is_a630(adreno_dev)) {
+		ram_cycles += counter_delta(device,
+			adreno_dev->ram_cycles_lo_ch1_read,
+			&busy->bif_ram_cycles_read_ch1);
+
+		ram_cycles += counter_delta(device,
+			adreno_dev->ram_cycles_lo_ch0_write,
+			&busy->bif_ram_cycles_write_ch0);
+
+		ram_cycles += counter_delta(device,
+			adreno_dev->ram_cycles_lo_ch1_write,
+			&busy->bif_ram_cycles_write_ch1);
+
+		starved_ram += counter_delta(device,
+			adreno_dev->starved_ram_lo_ch1,
+			&busy->bif_starved_ram_ch1);
+	}
+
+	stats->ram_time = ram_cycles;
+	stats->ram_wait = starved_ram;
+}
+
+static void a6xx_power_stats(struct adreno_device *adreno_dev,
+		struct kgsl_power_stats *stats)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_busy_data *busy = &adreno_dev->busy_data;
+	s64 gpu_busy;
+
+	/* Set the GPU busy counter for frequency scaling */
+	gpu_busy = counter_delta(device, A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L,
+		&busy->gpu_busy);
+
+	gpu_busy += a6xx_read_throttling_counters(adreno_dev);
+	/* If adjustment cycles are more than busy cycles make gpu_busy zero */
+	if (gpu_busy < 0)
+		gpu_busy = 0;
+
+	stats->busy_time = gpu_busy * 10;
+	do_div(stats->busy_time, 192);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_IFPC)) {
+		u32 ifpc = counter_delta(device,
+			A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_L,
+			&busy->num_ifpc);
+
+		adreno_dev->ifpc_count += ifpc;
+		if (ifpc > 0)
+			trace_adreno_ifpc_count(adreno_dev->ifpc_count);
+	}
+
+	if (device->pwrctrl.bus_control)
+		a6xx_read_bus_stats(device, stats, busy);
+}
+
+static int a6xx_setproperty(struct kgsl_device_private *dev_priv,
+		u32 type, void __user *value, u32 sizebytes)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	u32 enable;
+
+	if (type != KGSL_PROP_PWRCTRL)
+		return -ENODEV;
+
+	if (sizebytes != sizeof(enable))
+		return -EINVAL;
+
+	if (copy_from_user(&enable, value, sizeof(enable)))
+		return -EFAULT;
+
+	mutex_lock(&device->mutex);
+
+	if (enable) {
+		if (gmu_core_isenabled(device))
+			clear_bit(GMU_DISABLE_SLUMBER, &device->gmu_core.flags);
+		else
+			device->pwrctrl.ctrl_flags = 0;
+
+		kgsl_pwrscale_enable(device);
+	} else {
+		if (gmu_core_isenabled(device)) {
+			set_bit(GMU_DISABLE_SLUMBER, &device->gmu_core.flags);
+
+			if (!adreno_active_count_get(adreno_dev))
+				adreno_active_count_put(adreno_dev);
+		} else {
+			kgsl_pwrctrl_change_state(device, KGSL_STATE_ACTIVE);
+			device->pwrctrl.ctrl_flags = KGSL_PWR_ON;
+		}
+		kgsl_pwrscale_disable(device, true);
+	}
+
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+static int a6xx_dev_add_to_minidump(struct adreno_device *adreno_dev)
+{
+	return kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_ADRENO_DEVICE,
+				(void *)(adreno_dev), sizeof(struct adreno_device));
+}
+
+static void a6xx_set_isdb_breakpoint_registers(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct clk *clk;
+	int ret;
+
+	if (!device->set_isdb_breakpoint || device->ftbl->is_hwcg_on(device)
+			|| device->qdss_gfx_virt == NULL || !device->force_panic)
+		return;
+
+	clk = clk_get(&device->pdev->dev, "apb_pclk");
+
+	if (IS_ERR(clk)) {
+		dev_err(device->dev, "Unable to get QDSS clock\n");
+		goto err;
+	}
+
+	ret = clk_prepare_enable(clk);
+
+	if (ret) {
+		dev_err(device->dev, "QDSS Clock enable error: %d\n", ret);
+		clk_put(clk);
+		goto err;
+	}
+
+	/* Issue break command for all eight SPs */
+	isdb_write(device->qdss_gfx_virt, 0x0000);
+	isdb_write(device->qdss_gfx_virt, 0x1000);
+	isdb_write(device->qdss_gfx_virt, 0x2000);
+	isdb_write(device->qdss_gfx_virt, 0x3000);
+	isdb_write(device->qdss_gfx_virt, 0x4000);
+	isdb_write(device->qdss_gfx_virt, 0x5000);
+	isdb_write(device->qdss_gfx_virt, 0x6000);
+	isdb_write(device->qdss_gfx_virt, 0x7000);
+
+	clk_disable_unprepare(clk);
+	clk_put(clk);
+
+	return;
+
+err:
+	/* Do not force kernel panic if isdb writes did not go through */
+	device->force_panic = false;
+}
+
+static int a619_holi_sptprac_enable(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	void __iomem *addr = kgsl_regmap_virt(&device->regmap,
+		A6XX_GMU_SPTPRAC_PWR_CLK_STATUS);
+	u32 val;
+
+	if (test_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED, &adreno_dev->priv))
+		return 0;
+
+	kgsl_regwrite(device, A6XX_GMU_GX_SPTPRAC_POWER_CONTROL,
+		SPTPRAC_POWERON_CTRL_MASK);
+
+	if (readl_poll_timeout(addr, val,
+		(val & SPTPRAC_POWERON_STATUS_MASK) ==
+		SPTPRAC_POWERON_STATUS_MASK, 10, 10 * 1000)) {
+		dev_err(device->dev, "power on SPTPRAC fail\n");
+		return -EINVAL;
+	}
+
+	set_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED, &adreno_dev->priv);
+	return 0;
+}
+
+static void a619_holi_sptprac_disable(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	void __iomem *addr = kgsl_regmap_virt(&device->regmap,
+		A6XX_GMU_SPTPRAC_PWR_CLK_STATUS);
+	u32 val;
+
+	if (!test_and_clear_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED,
+		&adreno_dev->priv))
+		return;
+
+	/* Ensure that retention is on */
+	kgsl_regrmw(device, A6XX_GPU_CC_GX_GDSCR, 0,
+		A6XX_RETAIN_FF_ENABLE_ENABLE_MASK);
+
+	kgsl_regwrite(device, A6XX_GMU_GX_SPTPRAC_POWER_CONTROL,
+		SPTPRAC_POWEROFF_CTRL_MASK);
+	if (readl_poll_timeout(addr, val,
+		(val & SPTPRAC_POWEROFF_STATUS_MASK) ==
+		SPTPRAC_POWEROFF_STATUS_MASK, 10, 10 * 1000))
+		dev_err(device->dev, "power off SPTPRAC fail\n");
+}
+
+/* This is a non GMU/RGMU part */
+const struct adreno_gpudev adreno_a6xx_gpudev = {
+	.reg_offsets = a6xx_register_offsets,
+	.probe = a6xx_probe,
+	.start = a6xx_nogmu_start,
+	.snapshot = a6xx_snapshot,
+	.init = a6xx_nogmu_init,
+	.irq_handler = a6xx_irq_handler,
+	.rb_start = a6xx_rb_start,
+	.regulator_enable = a6xx_sptprac_enable,
+	.regulator_disable = a6xx_sptprac_disable,
+	.gpu_keepalive = a6xx_gpu_keepalive,
+	.hw_isidle = a6xx_hw_isidle,
+	.iommu_fault_block = a6xx_iommu_fault_block,
+	.reset = a6xx_reset,
+	.preemption_schedule = a6xx_preemption_schedule,
+	.preemption_context_init = a6xx_preemption_context_init,
+	.read_alwayson = a6xx_read_alwayson,
+	.power_ops = &adreno_power_operations,
+	.clear_pending_transactions = a6xx_clear_pending_transactions,
+	.deassert_gbif_halt = a6xx_deassert_gbif_halt,
+	.remove = a6xx_remove,
+	.ringbuffer_submitcmd = a6xx_ringbuffer_submitcmd,
+	.is_hw_collapsible = adreno_isidle,
+	.power_stats = a6xx_power_stats,
+	.setproperty = a6xx_setproperty,
+	.add_to_va_minidump = a6xx_dev_add_to_minidump,
+	.gx_is_on = a6xx_gx_is_on,
+};
+
+const struct a6xx_gpudev adreno_a6xx_hwsched_gpudev = {
+	.base = {
+		.reg_offsets = a6xx_register_offsets,
+		.probe = a6xx_hwsched_probe,
+		.snapshot = a6xx_hwsched_snapshot,
+		.irq_handler = a6xx_irq_handler,
+		.iommu_fault_block = a6xx_iommu_fault_block,
+		.preemption_context_init = a6xx_preemption_context_init,
+		.context_detach = a6xx_hwsched_context_detach,
+		.read_alwayson = a6xx_read_alwayson,
+		.reset = a6xx_hwsched_reset_replay,
+		.power_ops = &a6xx_hwsched_power_ops,
+		.power_stats = a6xx_power_stats,
+		.setproperty = a6xx_setproperty,
+		.hw_isidle = a6xx_hw_isidle,
+		.add_to_va_minidump = a6xx_hwsched_add_to_minidump,
+		.gx_is_on = a6xx_gmu_gx_is_on,
+		.send_recurring_cmdobj = a6xx_hwsched_send_recurring_cmdobj,
+		.set_isdb_breakpoint_registers = a6xx_set_isdb_breakpoint_registers,
+	},
+	.hfi_probe = a6xx_hwsched_hfi_probe,
+	.hfi_remove = a6xx_hwsched_hfi_remove,
+	.handle_watchdog = a6xx_hwsched_handle_watchdog,
+};
+
+const struct a6xx_gpudev adreno_a6xx_gmu_gpudev = {
+	.base = {
+		.reg_offsets = a6xx_register_offsets,
+		.probe = a6xx_gmu_device_probe,
+		.snapshot = a6xx_gmu_snapshot,
+		.irq_handler = a6xx_irq_handler,
+		.rb_start = a6xx_rb_start,
+		.regulator_enable = a6xx_sptprac_enable,
+		.regulator_disable = a6xx_sptprac_disable,
+		.gpu_keepalive = a6xx_gpu_keepalive,
+		.hw_isidle = a6xx_hw_isidle,
+		.iommu_fault_block = a6xx_iommu_fault_block,
+		.reset = a6xx_gmu_reset,
+		.preemption_schedule = a6xx_preemption_schedule,
+		.preemption_context_init = a6xx_preemption_context_init,
+		.read_alwayson = a6xx_read_alwayson,
+		.power_ops = &a6xx_gmu_power_ops,
+		.remove = a6xx_remove,
+		.ringbuffer_submitcmd = a6xx_ringbuffer_submitcmd,
+		.power_stats = a6xx_power_stats,
+		.setproperty = a6xx_setproperty,
+		.add_to_va_minidump = a6xx_gmu_add_to_minidump,
+		.gx_is_on = a6xx_gmu_gx_is_on,
+		.set_isdb_breakpoint_registers = a6xx_set_isdb_breakpoint_registers,
+	},
+	.hfi_probe = a6xx_gmu_hfi_probe,
+	.handle_watchdog = a6xx_gmu_handle_watchdog,
+};
+
+const struct adreno_gpudev adreno_a6xx_rgmu_gpudev = {
+	.reg_offsets = a6xx_register_offsets,
+	.probe = a6xx_rgmu_device_probe,
+	.snapshot = a6xx_rgmu_snapshot,
+	.irq_handler = a6xx_irq_handler,
+	.rb_start = a6xx_rb_start,
+	.regulator_enable = a6xx_sptprac_enable,
+	.regulator_disable = a6xx_sptprac_disable,
+	.gpu_keepalive = a6xx_gpu_keepalive,
+	.hw_isidle = a6xx_hw_isidle,
+	.iommu_fault_block = a6xx_iommu_fault_block,
+	.reset = a6xx_rgmu_reset,
+	.preemption_schedule = a6xx_preemption_schedule,
+	.preemption_context_init = a6xx_preemption_context_init,
+	.read_alwayson = a6xx_read_alwayson,
+	.power_ops = &a6xx_rgmu_power_ops,
+	.remove = a6xx_remove,
+	.ringbuffer_submitcmd = a6xx_ringbuffer_submitcmd,
+	.power_stats = a6xx_power_stats,
+	.setproperty = a6xx_setproperty,
+	.add_to_va_minidump = a6xx_rgmu_add_to_minidump,
+	.gx_is_on = a6xx_rgmu_gx_is_on,
+};
+
+/* This is a non GMU/RGMU part */
+const struct adreno_gpudev adreno_a619_holi_gpudev = {
+	.reg_offsets = a6xx_register_offsets,
+	.probe = a6xx_probe,
+	.start = a6xx_nogmu_start,
+	.snapshot = a6xx_snapshot,
+	.init = a6xx_nogmu_init,
+	.irq_handler = a6xx_irq_handler,
+	.rb_start = a6xx_rb_start,
+	.regulator_enable = a619_holi_sptprac_enable,
+	.regulator_disable = a619_holi_sptprac_disable,
+	.gpu_keepalive = a6xx_gpu_keepalive,
+	.hw_isidle = a619_holi_hw_isidle,
+	.iommu_fault_block = a6xx_iommu_fault_block,
+	.reset = a6xx_reset,
+	.preemption_schedule = a6xx_preemption_schedule,
+	.preemption_context_init = a6xx_preemption_context_init,
+	.read_alwayson = a6xx_read_alwayson,
+	.power_ops = &adreno_power_operations,
+	.clear_pending_transactions = a6xx_clear_pending_transactions,
+	.deassert_gbif_halt = a6xx_deassert_gbif_halt,
+	.remove = a6xx_remove,
+	.ringbuffer_submitcmd = a6xx_ringbuffer_submitcmd,
+	.is_hw_collapsible = adreno_isidle,
+	.power_stats = a6xx_power_stats,
+	.setproperty = a6xx_setproperty,
+	.add_to_va_minidump = a6xx_dev_add_to_minidump,
+	.gx_is_on = a619_holi_gx_is_on,
+};
+
+const struct a6xx_gpudev adreno_a630_gpudev = {
+	.base = {
+		.reg_offsets = a6xx_register_offsets,
+		.probe = a6xx_gmu_device_probe,
+		.snapshot = a6xx_gmu_snapshot,
+		.irq_handler = a6xx_irq_handler,
+		.rb_start = a6xx_rb_start,
+		.regulator_enable = a6xx_sptprac_enable,
+		.regulator_disable = a6xx_sptprac_disable,
+		.gpu_keepalive = a6xx_gpu_keepalive,
+		.hw_isidle = a6xx_hw_isidle,
+		.iommu_fault_block = a6xx_iommu_fault_block,
+		.reset = a6xx_gmu_reset,
+		.preemption_schedule = a6xx_preemption_schedule,
+		.preemption_context_init = a6xx_preemption_context_init,
+		.read_alwayson = a6xx_read_alwayson,
+		.power_ops = &a630_gmu_power_ops,
+		.remove = a6xx_remove,
+		.ringbuffer_submitcmd = a6xx_ringbuffer_submitcmd,
+		.power_stats = a6xx_power_stats,
+		.setproperty = a6xx_setproperty,
+		.add_to_va_minidump = a6xx_gmu_add_to_minidump,
+		.gx_is_on = a6xx_gmu_gx_is_on,
+	},
+	.hfi_probe = a6xx_gmu_hfi_probe,
+	.handle_watchdog = a6xx_gmu_handle_watchdog,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx.h
@@ -0,0 +1,468 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _ADRENO_A6XX_H_
+#define _ADRENO_A6XX_H_
+
+#include <linux/delay.h>
+
+#include "a6xx_reg.h"
+#include "adreno_a6xx_gmu.h"
+#include "adreno_a6xx_rgmu.h"
+
+extern const struct adreno_power_ops a6xx_gmu_power_ops;
+extern const struct adreno_power_ops a6xx_rgmu_power_ops;
+extern const struct adreno_power_ops a630_gmu_power_ops;
+extern const struct adreno_power_ops a6xx_hwsched_power_ops;
+
+struct a6xx_gpudev {
+	struct adreno_gpudev base;
+	int (*hfi_probe)(struct adreno_device *adreno_dev);
+	void (*hfi_remove)(struct adreno_device *adreno_dev);
+	void (*handle_watchdog)(struct adreno_device *adreno_dev);
+};
+
+extern const struct a6xx_gpudev adreno_a630_gpudev;
+extern const struct a6xx_gpudev adreno_a6xx_gmu_gpudev;
+extern const struct a6xx_gpudev adreno_a6xx_hwsched_gpudev;
+
+/**
+ * struct a6xx_device - Container for the a6xx_device
+ */
+struct a6xx_device {
+	/** @gmu: Container for the a6xx GMU device */
+	struct a6xx_gmu_device gmu;
+	/** @rgmu: Container for the a6xx rGMU device */
+	struct a6xx_rgmu_device rgmu;
+	/** @adreno_dev: Container for the generic adreno device */
+	struct adreno_device adreno_dev;
+};
+
+/**
+ * struct adreno_a6xx_core - a6xx specific GPU core definitions
+ */
+struct adreno_a6xx_core {
+	/** @base: Container for the generic GPU definitions */
+	struct adreno_gpu_core base;
+	/** @gmu_major: The maximum GMU version supported by the core */
+	u32 gmu_major;
+	/** @gmu_minor: The minimum GMU version supported by the core */
+	u32 gmu_minor;
+	/** @prim_fifo_threshold: target specific value for PC_DBG_ECO_CNTL */
+	unsigned int prim_fifo_threshold;
+	/** @sqefw_name: Name of the SQE microcode file */
+	const char *sqefw_name;
+	/** @gmufw_name: Name of the GMU firmware file */
+	const char *gmufw_name;
+	/** @zap_name: Name of the CPZ zap file */
+	const char *zap_name;
+	/** @hwcg: List of registers and values to write for HWCG */
+	const struct kgsl_regmap_list *hwcg;
+	/** @hwcg_count: Number of registers in @hwcg */
+	u32 hwcg_count;
+	/** @vbif: List of registers and values to write for VBIF */
+	const struct kgsl_regmap_list *vbif;
+	/** @vbif_count: Number of registers in @vbif */
+	u32 vbif_count;
+	/** @veto_fal10: veto status for fal10 feature */
+	bool veto_fal10;
+	/** @pdc_in_aop: True if PDC programmed in AOP */
+	bool pdc_in_aop;
+	/** @hang_detect_cycles: Hang detect counter timeout value */
+	u32 hang_detect_cycles;
+	/** @protected_regs: Array of protected registers for the target */
+	const struct adreno_protected_regs *protected_regs;
+	/** @disable_tseskip: True if TSESkip logic is disabled */
+	bool disable_tseskip;
+	/** @gx_cpr_toggle: True to toggle GX CPR FSM to avoid CPR stalls */
+	bool gx_cpr_toggle;
+	/** @highest_bank_bit: The bit of the highest DDR bank */
+	u32 highest_bank_bit;
+	/** @ctxt_record_size: Size of the preemption record in bytes */
+	u64 ctxt_record_size;
+	/** @gmu_hub_clk_freq: Gmu hub interface clock frequency */
+	u64 gmu_hub_clk_freq;
+};
+
+#define SPTPRAC_POWERON_CTRL_MASK	0x00778000
+#define SPTPRAC_POWEROFF_CTRL_MASK	0x00778001
+#define SPTPRAC_POWEROFF_STATUS_MASK	BIT(2)
+#define SPTPRAC_POWERON_STATUS_MASK	BIT(3)
+#define A6XX_RETAIN_FF_ENABLE_ENABLE_MASK BIT(11)
+
+#define CP_CLUSTER_FE		0x0
+#define CP_CLUSTER_SP_VS	0x1
+#define CP_CLUSTER_PC_VS	0x2
+#define CP_CLUSTER_GRAS		0x3
+#define CP_CLUSTER_SP_PS	0x4
+#define CP_CLUSTER_PS		0x5
+#define CP_CLUSTER_VPC_PS	0x6
+
+/**
+ * struct a6xx_cp_preemption_record - CP context record for
+ * preemption.
+ * @magic: (00) Value at this offset must be equal to
+ * A6XX_CP_CTXRECORD_MAGIC_REF.
+ * @info: (04) Type of record. Written non-zero (usually) by CP.
+ * we must set to zero for all ringbuffers.
+ * @errno: (08) Error code. Initialize this to A6XX_CP_CTXRECORD_ERROR_NONE.
+ * CP will update to another value if a preemption error occurs.
+ * @data: (12) DATA field in YIELD and SET_MARKER packets.
+ * Written by CP when switching out. Not used on switch-in. Initialized to 0.
+ * @cntl: (16) RB_CNTL, saved and restored by CP. We must initialize this.
+ * @rptr: (20) RB_RPTR, saved and restored by CP. We must initialize this.
+ * @wptr: (24) RB_WPTR, saved and restored by CP. We must initialize this.
+ * @_pad28: (28) Reserved/padding.
+ * @rptr_addr: (32) RB_RPTR_ADDR_LO|HI saved and restored. We must initialize.
+ * rbase: (40) RB_BASE_LO|HI saved and restored.
+ * counter: (48) Pointer to preemption counter.
+ */
+struct a6xx_cp_preemption_record {
+	uint32_t  magic;
+	uint32_t  info;
+	uint32_t  errno;
+	uint32_t  data;
+	uint32_t  cntl;
+	uint32_t  rptr;
+	uint32_t  wptr;
+	uint32_t  _pad28;
+	uint64_t  rptr_addr;
+	uint64_t  rbase;
+	uint64_t  counter;
+};
+
+/**
+ * struct a6xx_cp_smmu_info - CP preemption SMMU info.
+ * @magic: (00) The value at this offset must be equal to
+ * A6XX_CP_SMMU_INFO_MAGIC_REF.
+ * @_pad4: (04) Reserved/padding
+ * @ttbr0: (08) Base address of the page table for the
+ * incoming context.
+ * @context_idr: (16) Context Identification Register value.
+ */
+struct a6xx_cp_smmu_info {
+	uint32_t  magic;
+	uint32_t  _pad4;
+	uint64_t  ttbr0;
+	uint32_t  asid;
+	uint32_t  context_idr;
+};
+
+#define A6XX_CP_SMMU_INFO_MAGIC_REF     0x241350D5UL
+
+#define A6XX_CP_CTXRECORD_MAGIC_REF     0xAE399D6EUL
+/* Size of each CP preemption record */
+#define A6XX_CP_CTXRECORD_SIZE_IN_BYTES     (2112 * 1024)
+/* Size of the user context record block (in bytes) */
+#define A6XX_CP_CTXRECORD_USER_RESTORE_SIZE (192 * 1024)
+/* Size of the performance counter save/restore block (in bytes) */
+#define A6XX_CP_PERFCOUNTER_SAVE_RESTORE_SIZE   (4 * 1024)
+
+#define A6XX_CP_RB_CNTL_DEFAULT (((ilog2(4) << 8) & 0x1F00) | \
+		(ilog2(KGSL_RB_DWORDS >> 1) & 0x3F))
+
+/* Size of the CP_INIT pm4 stream in dwords */
+#define A6XX_CP_INIT_DWORDS 11
+
+/* Size of the perf counter enable pm4 stream in dwords */
+#define A6XX_PERF_COUNTER_ENABLE_DWORDS 3
+
+#define A6XX_INT_MASK \
+	((1 << A6XX_INT_CP_AHB_ERROR) |			\
+	 (1 << A6XX_INT_ATB_ASYNCFIFO_OVERFLOW) |	\
+	 (1 << A6XX_INT_RBBM_GPC_ERROR) |		\
+	 (1 << A6XX_INT_CP_SW) |			\
+	 (1 << A6XX_INT_CP_HW_ERROR) |			\
+	 (1 << A6XX_INT_CP_IB2) |			\
+	 (1 << A6XX_INT_CP_IB1) |			\
+	 (1 << A6XX_INT_CP_RB) |			\
+	 (1 << A6XX_INT_CP_CACHE_FLUSH_TS) |		\
+	 (1 << A6XX_INT_RBBM_ATB_BUS_OVERFLOW) |	\
+	 (1 << A6XX_INT_RBBM_HANG_DETECT) |		\
+	 (1 << A6XX_INT_UCHE_OOB_ACCESS) |		\
+	 (1 << A6XX_INT_UCHE_TRAP_INTR) |		\
+	 (1 << A6XX_INT_TSB_WRITE_ERROR))
+
+#define A6XX_HWSCHED_INT_MASK \
+	((1 << A6XX_INT_CP_AHB_ERROR) |			\
+	 (1 << A6XX_INT_ATB_ASYNCFIFO_OVERFLOW) |	\
+	 (1 << A6XX_INT_RBBM_ATB_BUS_OVERFLOW) |	\
+	 (1 << A6XX_INT_UCHE_OOB_ACCESS) |		\
+	 (1 << A6XX_INT_UCHE_TRAP_INTR) |		\
+	 (1 << A6XX_INT_TSB_WRITE_ERROR))
+
+/**
+ * to_a6xx_core - return the a6xx specific GPU core struct
+ * @adreno_dev: An Adreno GPU device handle
+ *
+ * Returns:
+ * A pointer to the a6xx specific GPU core struct
+ */
+static inline const struct adreno_a6xx_core *
+to_a6xx_core(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gpu_core *core = adreno_dev->gpucore;
+
+	return container_of(core, struct adreno_a6xx_core, base);
+}
+
+/**
+ * a6xx_is_smmu_stalled() - Check whether smmu is stalled or not
+ * @device: Pointer to KGSL device
+ *
+ * Return - True if smmu is stalled or false otherwise
+ */
+static inline bool a6xx_is_smmu_stalled(struct kgsl_device *device)
+{
+	u32 val;
+
+	kgsl_regread(device, A6XX_RBBM_STATUS3, &val);
+
+	return val & BIT(24);
+}
+
+/* Preemption functions */
+void a6xx_preemption_trigger(struct adreno_device *adreno_dev, bool atomic);
+void a6xx_preemption_schedule(struct adreno_device *adreno_dev);
+void a6xx_preemption_start(struct adreno_device *adreno_dev);
+int a6xx_preemption_init(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_preemption_post_ibsubmit - Insert commands following a submission
+ * @adreno_dev: Adreno GPU handle
+ * @cmds: Pointer to the ringbuffer to insert opcodes
+ *
+ * Return: The number of dwords written to @cmds
+ */
+u32 a6xx_preemption_post_ibsubmit(struct adreno_device *adreno_dev, u32 *cmds);
+
+/**
+ * a6xx_preemption_post_ibsubmit - Insert opcodes before a submission
+ * @adreno_dev: Adreno GPU handle
+ * @rb: The ringbuffer being written
+ * @drawctxt: The draw context being written
+ * @cmds: Pointer to the ringbuffer to insert opcodes
+ *
+ * Return: The number of dwords written to @cmds
+ */
+u32 a6xx_preemption_pre_ibsubmit(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 *cmds);
+
+unsigned int a6xx_set_marker(unsigned int *cmds,
+		enum adreno_cp_marker_type type);
+
+void a6xx_preemption_callback(struct adreno_device *adreno_dev, int bit);
+
+int a6xx_preemption_context_init(struct kgsl_context *context);
+
+void a6xx_preemption_context_destroy(struct kgsl_context *context);
+
+void a6xx_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot);
+void a6xx_crashdump_init(struct adreno_device *adreno_dev);
+int a6xx_gmu_sptprac_enable(struct adreno_device *adreno_dev);
+void a6xx_gmu_sptprac_disable(struct adreno_device *adreno_dev);
+bool a6xx_gmu_sptprac_is_on(struct adreno_device *adreno_dev);
+bool a619_holi_gx_is_on(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_read_alwayson - Read the current always on clock value
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * Return: The current value of the GMU always on counter
+ */
+u64 a6xx_read_alwayson(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_start - Program a6xx registers
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * This function does all a6xx register programming every
+ * time we boot the gpu
+ */
+void a6xx_start(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_init - Initialize a6xx resources
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * This function does a6xx specific one time initialization
+ * and is invoked when the very first client opens a
+ * kgsl instance
+ *
+ * Return: Zero on success and negative error on failure
+ */
+int a6xx_init(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_rb_start - A6xx specific ringbuffer setup
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * This function does a6xx specific ringbuffer setup and
+ * attempts to submit CP INIT and bring GPU out of secure mode
+ *
+ * Return: Zero on success and negative error on failure
+ */
+int a6xx_rb_start(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_microcode_read - Get the cp microcode from the filesystem
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * This function gets the firmware from filesystem and sets up
+ * the micorocode global buffer
+ *
+ * Return: Zero on success and negative error on failure
+ */
+int a6xx_microcode_read(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_probe_common - Probe common a6xx resources
+ * @pdev: Pointer to the platform device
+ * @adreno_dev: Pointer to the adreno device
+ * @chipid: Chipid of the target
+ * @gpucore: Pointer to the gpucore strucure
+ *
+ * This function sets up the a6xx resources common across all
+ * a6xx targets
+ */
+int a6xx_probe_common(struct platform_device *pdev,
+	struct  adreno_device *adreno_dev, u32 chipid,
+	const struct adreno_gpu_core *gpucore);
+
+/**
+ * a6xx_hw_isidle - Check whether a6xx gpu is idle or not
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * Return: True if gpu is idle, otherwise false
+ */
+bool a6xx_hw_isidle(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_spin_idle_debug - Debug logging used when gpu fails to idle
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * This function logs interesting registers and triggers a snapshot
+ */
+void a6xx_spin_idle_debug(struct adreno_device *adreno_dev,
+	const char *str);
+
+/**
+ * a6xx_perfcounter_update - Update the IFPC perfcounter list
+ * @adreno_dev: An Adreno GPU handle
+ * @reg: Perfcounter reg struct to add/remove to the list
+ * @update_reg: true if the perfcounter needs to be programmed by the CPU
+ *
+ * Return: 0 on success or -EBUSY if the lock couldn't be taken
+ */
+int a6xx_perfcounter_update(struct adreno_device *adreno_dev,
+	struct adreno_perfcount_register *reg, bool update_reg);
+
+/*
+ * a6xx_ringbuffer_init - Initialize the ringbuffers
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * Initialize the ringbuffer(s) for a6xx.
+ * Return: 0 on success or negative on failure
+ */
+int a6xx_ringbuffer_init(struct adreno_device *adreno_dev);
+
+extern const struct adreno_perfcounters adreno_a630_perfcounters;
+extern const struct adreno_perfcounters adreno_a6xx_perfcounters;
+extern const struct adreno_perfcounters adreno_a6xx_legacy_perfcounters;
+extern const struct adreno_perfcounters adreno_a6xx_hwsched_perfcounters;
+
+/**
+ * a6xx_rdpm_mx_freq_update - Update the mx frequency
+ * @gmu: An Adreno GMU handle
+ * @freq: Frequency in KHz
+ *
+ * This function communicates GPU mx frequency(in Mhz) changes to rdpm.
+ */
+void a6xx_rdpm_mx_freq_update(struct a6xx_gmu_device *gmu, u32 freq);
+
+/**
+ * a6xx_rdpm_cx_freq_update - Update the cx frequency
+ * @gmu: An Adreno GMU handle
+ * @freq: Frequency in KHz
+ *
+ * This function communicates GPU cx frequency(in Mhz) changes to rdpm.
+ */
+void a6xx_rdpm_cx_freq_update(struct a6xx_gmu_device *gmu, u32 freq);
+
+/**
+ * a6xx_ringbuffer_addcmds - Submit a command to the ringbuffer
+ * @adreno_dev: An Adreno GPU handle
+ * @rb: Pointer to the ringbuffer to submit on
+ * @drawctxt: Pointer to the draw context for the submission, or NULL for
+ * internal submissions
+ * @flags: Flags for the submission
+ * @in: Commands to write to the ringbuffer
+ * @dwords: Size of @in (in dwords)
+ * @timestamp: Timestamp for the submission
+ * @time: Optional pointer to a submit time structure
+ *
+ * Submit a command to the ringbuffer.
+ * Return: 0 on success or negative on failure
+ */
+int a6xx_ringbuffer_addcmds(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 flags, u32 *in, u32 dwords, u32 timestamp,
+		struct adreno_submit_time *time);
+/**
+ * a6xx_ringbuffer_submitcmd - Submit a user command to the ringbuffer
+ * @adreno_dev: An Adreno GPU handle
+ * @cmdobj: Pointer to a user command object
+ * @flags: Internal submit flags
+ * @time: Optional pointer to a adreno_submit_time container
+ *
+ * Return: 0 on success or negative on failure
+ */
+int a6xx_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj, u32 flags,
+		struct adreno_submit_time *time);
+
+
+int a6xx_fenced_write(struct adreno_device *adreno_dev, u32 offset,
+		u32 value, u32 mask);
+
+int a6xx_ringbuffer_submit(struct adreno_ringbuffer *rb,
+		struct adreno_submit_time *time, bool sync);
+
+void a6xx_cp_init_cmds(struct adreno_device *adreno_dev, u32 *cmds);
+
+int a6xx_gmu_hfi_probe(struct adreno_device *adreno_dev);
+
+static inline const struct a6xx_gpudev *
+to_a6xx_gpudev(const struct adreno_gpudev *gpudev)
+{
+	return container_of(gpudev, struct a6xx_gpudev, base);
+}
+
+/**
+ * a6xx_reset_preempt_records - Reset the preemption buffers
+ * @adreno_dev: Handle to the adreno device
+ *
+ * Reset the preemption records at the time of hard reset
+ */
+void a6xx_reset_preempt_records(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_irq_pending - Check if there is any gpu irq pending
+ * @adreno_dev: Handle to the adreno device
+ *
+ * Return true if there is any gpu irq pending
+ */
+bool a6xx_irq_pending(struct adreno_device *adreno_dev);
+
+#ifdef CONFIG_QCOM_KGSL_CORESIGHT
+void a6xx_coresight_init(struct adreno_device *device);
+#else
+static inline void a6xx_coresight_init(struct adreno_device *device) { }
+#endif
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_coresight.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_coresight.c
@@ -0,0 +1,432 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+* Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+*/
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_coresight.h"
+
+static struct adreno_coresight_register a6xx_coresight_regs[] = {
+	{ A6XX_DBGC_CFG_DBGBUS_SEL_A },
+	{ A6XX_DBGC_CFG_DBGBUS_SEL_B },
+	{ A6XX_DBGC_CFG_DBGBUS_SEL_C },
+	{ A6XX_DBGC_CFG_DBGBUS_SEL_D },
+	{ A6XX_DBGC_CFG_DBGBUS_CNTLT },
+	{ A6XX_DBGC_CFG_DBGBUS_CNTLM },
+	{ A6XX_DBGC_CFG_DBGBUS_OPL },
+	{ A6XX_DBGC_CFG_DBGBUS_OPE },
+	{ A6XX_DBGC_CFG_DBGBUS_IVTL_0 },
+	{ A6XX_DBGC_CFG_DBGBUS_IVTL_1 },
+	{ A6XX_DBGC_CFG_DBGBUS_IVTL_2 },
+	{ A6XX_DBGC_CFG_DBGBUS_IVTL_3 },
+	{ A6XX_DBGC_CFG_DBGBUS_MASKL_0 },
+	{ A6XX_DBGC_CFG_DBGBUS_MASKL_1 },
+	{ A6XX_DBGC_CFG_DBGBUS_MASKL_2 },
+	{ A6XX_DBGC_CFG_DBGBUS_MASKL_3 },
+	{ A6XX_DBGC_CFG_DBGBUS_BYTEL_0 },
+	{ A6XX_DBGC_CFG_DBGBUS_BYTEL_1 },
+	{ A6XX_DBGC_CFG_DBGBUS_IVTE_0 },
+	{ A6XX_DBGC_CFG_DBGBUS_IVTE_1 },
+	{ A6XX_DBGC_CFG_DBGBUS_IVTE_2 },
+	{ A6XX_DBGC_CFG_DBGBUS_IVTE_3 },
+	{ A6XX_DBGC_CFG_DBGBUS_MASKE_0 },
+	{ A6XX_DBGC_CFG_DBGBUS_MASKE_1 },
+	{ A6XX_DBGC_CFG_DBGBUS_MASKE_2 },
+	{ A6XX_DBGC_CFG_DBGBUS_MASKE_3 },
+	{ A6XX_DBGC_CFG_DBGBUS_NIBBLEE },
+	{ A6XX_DBGC_CFG_DBGBUS_PTRC0 },
+	{ A6XX_DBGC_CFG_DBGBUS_PTRC1 },
+	{ A6XX_DBGC_CFG_DBGBUS_LOADREG },
+	{ A6XX_DBGC_CFG_DBGBUS_IDX },
+	{ A6XX_DBGC_CFG_DBGBUS_CLRC },
+	{ A6XX_DBGC_CFG_DBGBUS_LOADIVT },
+	{ A6XX_DBGC_VBIF_DBG_CNTL },
+	{ A6XX_DBGC_DBG_LO_HI_GPIO },
+	{ A6XX_DBGC_EXT_TRACE_BUS_CNTL },
+	{ A6XX_DBGC_READ_AHB_THROUGH_DBG },
+	{ A6XX_DBGC_CFG_DBGBUS_TRACE_BUF1 },
+	{ A6XX_DBGC_CFG_DBGBUS_TRACE_BUF2 },
+	{ A6XX_DBGC_EVT_CFG },
+	{ A6XX_DBGC_EVT_INTF_SEL_0 },
+	{ A6XX_DBGC_EVT_INTF_SEL_1 },
+	{ A6XX_DBGC_PERF_ATB_CFG },
+	{ A6XX_DBGC_PERF_ATB_COUNTER_SEL_0 },
+	{ A6XX_DBGC_PERF_ATB_COUNTER_SEL_1 },
+	{ A6XX_DBGC_PERF_ATB_COUNTER_SEL_2 },
+	{ A6XX_DBGC_PERF_ATB_COUNTER_SEL_3 },
+	{ A6XX_DBGC_PERF_ATB_TRIG_INTF_SEL_0 },
+	{ A6XX_DBGC_PERF_ATB_TRIG_INTF_SEL_1 },
+	{ A6XX_DBGC_PERF_ATB_DRAIN_CMD },
+	{ A6XX_DBGC_ECO_CNTL },
+	{ A6XX_DBGC_AHB_DBG_CNTL },
+};
+
+static struct adreno_coresight_register a6xx_coresight_regs_cx[] = {
+	{ A6XX_CX_DBGC_CFG_DBGBUS_SEL_A },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_SEL_B },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_SEL_C },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_SEL_D },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_CNTLT },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_CNTLM },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_OPL },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_OPE },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_IVTL_0 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_IVTL_1 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_IVTL_2 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_IVTL_3 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_MASKL_0 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_MASKL_1 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_MASKL_2 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_MASKL_3 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_0 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_1 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_IVTE_0 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_IVTE_1 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_IVTE_2 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_IVTE_3 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_MASKE_0 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_MASKE_1 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_MASKE_2 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_MASKE_3 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_NIBBLEE },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_PTRC0 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_PTRC1 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_LOADREG },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_IDX },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_CLRC },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_LOADIVT },
+	{ A6XX_CX_DBGC_VBIF_DBG_CNTL },
+	{ A6XX_CX_DBGC_DBG_LO_HI_GPIO },
+	{ A6XX_CX_DBGC_EXT_TRACE_BUS_CNTL },
+	{ A6XX_CX_DBGC_READ_AHB_THROUGH_DBG },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_TRACE_BUF1 },
+	{ A6XX_CX_DBGC_CFG_DBGBUS_TRACE_BUF2 },
+	{ A6XX_CX_DBGC_EVT_CFG },
+	{ A6XX_CX_DBGC_EVT_INTF_SEL_0 },
+	{ A6XX_CX_DBGC_EVT_INTF_SEL_1 },
+	{ A6XX_CX_DBGC_PERF_ATB_CFG },
+	{ A6XX_CX_DBGC_PERF_ATB_COUNTER_SEL_0 },
+	{ A6XX_CX_DBGC_PERF_ATB_COUNTER_SEL_1 },
+	{ A6XX_CX_DBGC_PERF_ATB_COUNTER_SEL_2 },
+	{ A6XX_CX_DBGC_PERF_ATB_COUNTER_SEL_3 },
+	{ A6XX_CX_DBGC_PERF_ATB_TRIG_INTF_SEL_0 },
+	{ A6XX_CX_DBGC_PERF_ATB_TRIG_INTF_SEL_1 },
+	{ A6XX_CX_DBGC_PERF_ATB_DRAIN_CMD },
+	{ A6XX_CX_DBGC_ECO_CNTL },
+	{ A6XX_CX_DBGC_AHB_DBG_CNTL },
+};
+
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_a, &a6xx_coresight_regs[0]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_b, &a6xx_coresight_regs[1]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_c, &a6xx_coresight_regs[2]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_d, &a6xx_coresight_regs[3]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_cntlt, &a6xx_coresight_regs[4]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_cntlm, &a6xx_coresight_regs[5]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_opl, &a6xx_coresight_regs[6]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ope, &a6xx_coresight_regs[7]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_0, &a6xx_coresight_regs[8]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_1, &a6xx_coresight_regs[9]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_2, &a6xx_coresight_regs[10]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_3, &a6xx_coresight_regs[11]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_0, &a6xx_coresight_regs[12]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_1, &a6xx_coresight_regs[13]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_2, &a6xx_coresight_regs[14]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_3, &a6xx_coresight_regs[15]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_bytel_0, &a6xx_coresight_regs[16]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_bytel_1, &a6xx_coresight_regs[17]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_0, &a6xx_coresight_regs[18]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_1, &a6xx_coresight_regs[19]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_2, &a6xx_coresight_regs[20]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_3, &a6xx_coresight_regs[21]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_0, &a6xx_coresight_regs[22]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_1, &a6xx_coresight_regs[23]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_2, &a6xx_coresight_regs[24]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_3, &a6xx_coresight_regs[25]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_nibblee, &a6xx_coresight_regs[26]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ptrc0, &a6xx_coresight_regs[27]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ptrc1, &a6xx_coresight_regs[28]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_loadreg, &a6xx_coresight_regs[29]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_idx, &a6xx_coresight_regs[30]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_clrc, &a6xx_coresight_regs[31]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_loadivt, &a6xx_coresight_regs[32]);
+static ADRENO_CORESIGHT_ATTR(vbif_dbg_cntl, &a6xx_coresight_regs[33]);
+static ADRENO_CORESIGHT_ATTR(dbg_lo_hi_gpio, &a6xx_coresight_regs[34]);
+static ADRENO_CORESIGHT_ATTR(ext_trace_bus_cntl, &a6xx_coresight_regs[35]);
+static ADRENO_CORESIGHT_ATTR(read_ahb_through_dbg, &a6xx_coresight_regs[36]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_buf1, &a6xx_coresight_regs[37]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_buf2, &a6xx_coresight_regs[38]);
+static ADRENO_CORESIGHT_ATTR(evt_cfg, &a6xx_coresight_regs[39]);
+static ADRENO_CORESIGHT_ATTR(evt_intf_sel_0, &a6xx_coresight_regs[40]);
+static ADRENO_CORESIGHT_ATTR(evt_intf_sel_1, &a6xx_coresight_regs[41]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_cfg, &a6xx_coresight_regs[42]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_counter_sel_0, &a6xx_coresight_regs[43]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_counter_sel_1, &a6xx_coresight_regs[44]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_counter_sel_2, &a6xx_coresight_regs[45]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_counter_sel_3, &a6xx_coresight_regs[46]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_trig_intf_sel_0,
+				&a6xx_coresight_regs[47]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_trig_intf_sel_1,
+				&a6xx_coresight_regs[48]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_drain_cmd, &a6xx_coresight_regs[49]);
+static ADRENO_CORESIGHT_ATTR(eco_cntl, &a6xx_coresight_regs[50]);
+static ADRENO_CORESIGHT_ATTR(ahb_dbg_cntl, &a6xx_coresight_regs[51]);
+
+/*CX debug registers*/
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_sel_a,
+				&a6xx_coresight_regs_cx[0]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_sel_b,
+				&a6xx_coresight_regs_cx[1]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_sel_c,
+				&a6xx_coresight_regs_cx[2]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_sel_d,
+				&a6xx_coresight_regs_cx[3]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_cntlt,
+				&a6xx_coresight_regs_cx[4]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_cntlm,
+				&a6xx_coresight_regs_cx[5]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_opl,
+				&a6xx_coresight_regs_cx[6]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ope,
+				&a6xx_coresight_regs_cx[7]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivtl_0,
+				&a6xx_coresight_regs_cx[8]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivtl_1,
+				&a6xx_coresight_regs_cx[9]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivtl_2,
+				&a6xx_coresight_regs_cx[10]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivtl_3,
+				&a6xx_coresight_regs_cx[11]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maskl_0,
+				&a6xx_coresight_regs_cx[12]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maskl_1,
+				&a6xx_coresight_regs_cx[13]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maskl_2,
+				&a6xx_coresight_regs_cx[14]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maskl_3,
+				&a6xx_coresight_regs_cx[15]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_bytel_0,
+				&a6xx_coresight_regs_cx[16]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_bytel_1,
+				&a6xx_coresight_regs_cx[17]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivte_0,
+				&a6xx_coresight_regs_cx[18]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivte_1,
+				&a6xx_coresight_regs_cx[19]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivte_2,
+				&a6xx_coresight_regs_cx[20]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivte_3,
+				&a6xx_coresight_regs_cx[21]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maske_0,
+				&a6xx_coresight_regs_cx[22]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maske_1,
+				&a6xx_coresight_regs_cx[23]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maske_2,
+				&a6xx_coresight_regs_cx[24]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maske_3,
+				&a6xx_coresight_regs_cx[25]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_nibblee,
+				&a6xx_coresight_regs_cx[26]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ptrc0,
+				&a6xx_coresight_regs_cx[27]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ptrc1,
+				&a6xx_coresight_regs_cx[28]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_loadreg,
+				&a6xx_coresight_regs_cx[29]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_idx,
+				&a6xx_coresight_regs_cx[30]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_clrc,
+				&a6xx_coresight_regs_cx[31]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_loadivt,
+				&a6xx_coresight_regs_cx[32]);
+static ADRENO_CORESIGHT_ATTR(cx_vbif_dbg_cntl,
+				&a6xx_coresight_regs_cx[33]);
+static ADRENO_CORESIGHT_ATTR(cx_dbg_lo_hi_gpio,
+				&a6xx_coresight_regs_cx[34]);
+static ADRENO_CORESIGHT_ATTR(cx_ext_trace_bus_cntl,
+				&a6xx_coresight_regs_cx[35]);
+static ADRENO_CORESIGHT_ATTR(cx_read_ahb_through_dbg,
+				&a6xx_coresight_regs_cx[36]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_trace_buf1,
+				&a6xx_coresight_regs_cx[37]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_trace_buf2,
+				&a6xx_coresight_regs_cx[38]);
+static ADRENO_CORESIGHT_ATTR(cx_evt_cfg,
+				&a6xx_coresight_regs_cx[39]);
+static ADRENO_CORESIGHT_ATTR(cx_evt_intf_sel_0,
+				&a6xx_coresight_regs_cx[40]);
+static ADRENO_CORESIGHT_ATTR(cx_evt_intf_sel_1,
+				&a6xx_coresight_regs_cx[41]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_cfg,
+				&a6xx_coresight_regs_cx[42]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_counter_sel_0,
+				&a6xx_coresight_regs_cx[43]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_counter_sel_1,
+				&a6xx_coresight_regs_cx[44]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_counter_sel_2,
+				&a6xx_coresight_regs_cx[45]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_counter_sel_3,
+				&a6xx_coresight_regs_cx[46]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_trig_intf_sel_0,
+				&a6xx_coresight_regs_cx[47]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_trig_intf_sel_1,
+				&a6xx_coresight_regs_cx[48]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_drain_cmd,
+				&a6xx_coresight_regs_cx[49]);
+static ADRENO_CORESIGHT_ATTR(cx_eco_cntl,
+				&a6xx_coresight_regs_cx[50]);
+static ADRENO_CORESIGHT_ATTR(cx_ahb_dbg_cntl,
+				&a6xx_coresight_regs_cx[51]);
+
+static struct attribute *a6xx_coresight_attrs[] = {
+	&coresight_attr_cfg_dbgbus_sel_a.attr.attr,
+	&coresight_attr_cfg_dbgbus_sel_b.attr.attr,
+	&coresight_attr_cfg_dbgbus_sel_c.attr.attr,
+	&coresight_attr_cfg_dbgbus_sel_d.attr.attr,
+	&coresight_attr_cfg_dbgbus_cntlt.attr.attr,
+	&coresight_attr_cfg_dbgbus_cntlm.attr.attr,
+	&coresight_attr_cfg_dbgbus_opl.attr.attr,
+	&coresight_attr_cfg_dbgbus_ope.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_bytel_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_bytel_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_nibblee.attr.attr,
+	&coresight_attr_cfg_dbgbus_ptrc0.attr.attr,
+	&coresight_attr_cfg_dbgbus_ptrc1.attr.attr,
+	&coresight_attr_cfg_dbgbus_loadreg.attr.attr,
+	&coresight_attr_cfg_dbgbus_idx.attr.attr,
+	&coresight_attr_cfg_dbgbus_clrc.attr.attr,
+	&coresight_attr_cfg_dbgbus_loadivt.attr.attr,
+	&coresight_attr_vbif_dbg_cntl.attr.attr,
+	&coresight_attr_dbg_lo_hi_gpio.attr.attr,
+	&coresight_attr_ext_trace_bus_cntl.attr.attr,
+	&coresight_attr_read_ahb_through_dbg.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_buf1.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_buf2.attr.attr,
+	&coresight_attr_evt_cfg.attr.attr,
+	&coresight_attr_evt_intf_sel_0.attr.attr,
+	&coresight_attr_evt_intf_sel_1.attr.attr,
+	&coresight_attr_perf_atb_cfg.attr.attr,
+	&coresight_attr_perf_atb_counter_sel_0.attr.attr,
+	&coresight_attr_perf_atb_counter_sel_1.attr.attr,
+	&coresight_attr_perf_atb_counter_sel_2.attr.attr,
+	&coresight_attr_perf_atb_counter_sel_3.attr.attr,
+	&coresight_attr_perf_atb_trig_intf_sel_0.attr.attr,
+	&coresight_attr_perf_atb_trig_intf_sel_1.attr.attr,
+	&coresight_attr_perf_atb_drain_cmd.attr.attr,
+	&coresight_attr_eco_cntl.attr.attr,
+	&coresight_attr_ahb_dbg_cntl.attr.attr,
+	NULL,
+};
+
+/*cx*/
+static struct attribute *a6xx_coresight_attrs_cx[] = {
+	&coresight_attr_cx_cfg_dbgbus_sel_a.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_sel_b.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_sel_c.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_sel_d.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_cntlt.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_cntlm.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_opl.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ope.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivtl_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivtl_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivtl_2.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivtl_3.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maskl_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maskl_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maskl_2.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maskl_3.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_bytel_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_bytel_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivte_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivte_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivte_2.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivte_3.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maske_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maske_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maske_2.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maske_3.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_nibblee.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ptrc0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ptrc1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_loadreg.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_idx.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_clrc.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_loadivt.attr.attr,
+	&coresight_attr_cx_vbif_dbg_cntl.attr.attr,
+	&coresight_attr_cx_dbg_lo_hi_gpio.attr.attr,
+	&coresight_attr_cx_ext_trace_bus_cntl.attr.attr,
+	&coresight_attr_cx_read_ahb_through_dbg.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_trace_buf1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_trace_buf2.attr.attr,
+	&coresight_attr_cx_evt_cfg.attr.attr,
+	&coresight_attr_cx_evt_intf_sel_0.attr.attr,
+	&coresight_attr_cx_evt_intf_sel_1.attr.attr,
+	&coresight_attr_cx_perf_atb_cfg.attr.attr,
+	&coresight_attr_cx_perf_atb_counter_sel_0.attr.attr,
+	&coresight_attr_cx_perf_atb_counter_sel_1.attr.attr,
+	&coresight_attr_cx_perf_atb_counter_sel_2.attr.attr,
+	&coresight_attr_cx_perf_atb_counter_sel_3.attr.attr,
+	&coresight_attr_cx_perf_atb_trig_intf_sel_0.attr.attr,
+	&coresight_attr_cx_perf_atb_trig_intf_sel_1.attr.attr,
+	&coresight_attr_cx_perf_atb_drain_cmd.attr.attr,
+	&coresight_attr_cx_eco_cntl.attr.attr,
+	&coresight_attr_cx_ahb_dbg_cntl.attr.attr,
+	NULL,
+};
+
+static const struct attribute_group a6xx_coresight_group = {
+	.attrs = a6xx_coresight_attrs,
+};
+
+static const struct attribute_group *a6xx_coresight_groups[] = {
+	&a6xx_coresight_group,
+	NULL,
+};
+
+static const struct attribute_group a6xx_coresight_group_cx = {
+	.attrs = a6xx_coresight_attrs_cx,
+};
+
+static const struct attribute_group *a6xx_coresight_groups_cx[] = {
+	&a6xx_coresight_group_cx,
+	NULL,
+};
+
+static const struct adreno_coresight a6xx_coresight = {
+	.registers = a6xx_coresight_regs,
+	.count = ARRAY_SIZE(a6xx_coresight_regs),
+	.groups = a6xx_coresight_groups,
+};
+
+static const struct adreno_coresight a6xx_coresight_cx = {
+	.registers = a6xx_coresight_regs_cx,
+	.count = ARRAY_SIZE(a6xx_coresight_regs_cx),
+	.groups = a6xx_coresight_groups_cx,
+};
+
+void a6xx_coresight_init(struct adreno_device *adreno_dev)
+{
+	adreno_coresight_add_device(adreno_dev, "coresight-gfx",
+		&a6xx_coresight, &adreno_dev->gx_coresight);
+
+	adreno_coresight_add_device(adreno_dev, "coresight-gfx-cx",
+		&a6xx_coresight_cx, &adreno_dev->cx_coresight);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_gmu.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_gmu.c
@@ -0,0 +1,3847 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <linux/clk.h>
+#include <linux/component.h>
+#include <linux/delay.h>
+#include <linux/dma-map-ops.h>
+#include <linux/firmware.h>
+#include <linux/interconnect.h>
+#include <linux/io.h>
+#include <linux/kobject.h>
+#include <linux/of_platform.h>
+#include <linux/qcom-iommu-util.h>
+#include <linux/regulator/consumer.h>
+#include <linux/slab.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+#include <linux/sysfs.h>
+#include <linux/mailbox/qmp.h>
+#include <soc/qcom/cmd-db.h>
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_trace.h"
+#include "kgsl_bus.h"
+#include "kgsl_device.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+#define ARC_VOTE_GET_PRI(_v) ((_v) & 0xFF)
+#define ARC_VOTE_GET_SEC(_v) (((_v) >> 8) & 0xFF)
+#define ARC_VOTE_GET_VLVL(_v) (((_v) >> 16) & 0xFFFF)
+
+#define ARC_VOTE_SET(pri, sec, vlvl) \
+	((((vlvl) & 0xFFFF) << 16) | (((sec) & 0xFF) << 8) | ((pri) & 0xFF))
+
+static struct gmu_vma_entry a6xx_gmu_vma_legacy[] = {
+	[GMU_ITCM] = {
+			.start = 0x00000,
+			.size = SZ_16K
+		},
+	[GMU_ICACHE] = {
+			.start = 0x04000,
+			.size = (SZ_256K - SZ_16K),
+			.next_va = 0x4000
+		},
+	[GMU_DTCM] = {
+			.start = 0x40000,
+			.size = SZ_16K
+		},
+	[GMU_DCACHE] = {
+			.start = 0x44000,
+			.size = (SZ_256K - SZ_16K),
+			.next_va = 0x44000
+		},
+	[GMU_NONCACHED_KERNEL] = {
+			.start = 0x60000000,
+			.size = SZ_512M,
+			.next_va = 0x60000000
+		},
+};
+
+static struct gmu_vma_entry a6xx_gmu_vma[] = {
+	[GMU_ITCM] = {
+			.start = 0x00000000,
+			.size = SZ_16K
+		},
+	[GMU_CACHE] = {
+			.start = SZ_16K,
+			.size = (SZ_16M - SZ_16K),
+			.next_va = SZ_16K
+		},
+	[GMU_DTCM] = {
+			.start = SZ_256M + SZ_16K,
+			.size = SZ_16K
+		},
+	[GMU_DCACHE] = {
+			.start = 0x0,
+			.size = 0x0
+		},
+	[GMU_NONCACHED_KERNEL] = {
+			.start = 0x60000000,
+			.size = SZ_512M,
+			.next_va = 0x60000000
+		},
+};
+
+static void _regwrite(void __iomem *regbase, u32 offsetwords, u32 value)
+{
+	void __iomem *reg;
+
+	reg = regbase + (offsetwords << 2);
+	__raw_writel(value, reg);
+}
+
+static void _regrmw(void __iomem *regbase, u32 offsetwords, u32 mask, u32 or)
+{
+	void __iomem *reg;
+	u32 val;
+
+	reg = regbase + (offsetwords << 2);
+	val = __raw_readl(reg);
+	/* Make sure the read posted and all pending writes are done */
+	mb();
+	__raw_writel((val & ~mask) | or, reg);
+}
+
+static ssize_t log_stream_enable_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, log_kobj);
+	bool val;
+	int ret;
+
+	ret = kstrtobool(buf, &val);
+	if (ret)
+		return ret;
+
+	gmu->log_stream_enable = val;
+	return count;
+}
+
+static ssize_t log_stream_enable_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, log_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n", gmu->log_stream_enable);
+}
+
+static ssize_t log_group_mask_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, log_kobj);
+	u32 val;
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	gmu->log_group_mask = val;
+	return count;
+}
+
+static ssize_t log_group_mask_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, log_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%x\n", gmu->log_group_mask);
+}
+
+static struct kobj_attribute log_stream_enable_attr =
+	__ATTR(log_stream_enable, 0644, log_stream_enable_show, log_stream_enable_store);
+
+static struct kobj_attribute log_group_mask_attr =
+	__ATTR(log_group_mask, 0644, log_group_mask_show, log_group_mask_store);
+
+static struct attribute *log_attrs[] = {
+	&log_stream_enable_attr.attr,
+	&log_group_mask_attr.attr,
+	NULL,
+};
+ATTRIBUTE_GROUPS(log);
+
+static struct kobj_type log_kobj_type = {
+	.sysfs_ops = &kobj_sysfs_ops,
+	.default_groups = log_groups,
+};
+
+static ssize_t stats_enable_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, stats_kobj);
+	bool val;
+	int ret;
+
+	ret = kstrtobool(buf, &val);
+	if (ret)
+		return ret;
+
+	gmu->stats_enable = val;
+	return count;
+}
+
+static ssize_t stats_enable_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, stats_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n", gmu->stats_enable);
+}
+
+static ssize_t stats_mask_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, stats_kobj);
+	u32 val;
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	gmu->stats_mask = val;
+	return count;
+}
+
+static ssize_t stats_mask_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, stats_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%x\n", gmu->stats_mask);
+}
+
+static ssize_t stats_interval_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, stats_kobj);
+	u32 val;
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	gmu->stats_interval = val;
+	return count;
+}
+
+static ssize_t stats_interval_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct a6xx_gmu_device *gmu = container_of(kobj, struct a6xx_gmu_device, stats_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%x\n", gmu->stats_interval);
+}
+
+static struct kobj_attribute stats_enable_attr =
+	__ATTR(stats_enable, 0644, stats_enable_show, stats_enable_store);
+
+static struct kobj_attribute stats_mask_attr =
+	__ATTR(stats_mask, 0644, stats_mask_show, stats_mask_store);
+
+static struct kobj_attribute stats_interval_attr =
+	__ATTR(stats_interval, 0644, stats_interval_show, stats_interval_store);
+
+static struct attribute *stats_attrs[] = {
+	&stats_enable_attr.attr,
+	&stats_mask_attr.attr,
+	&stats_interval_attr.attr,
+	NULL,
+};
+ATTRIBUTE_GROUPS(stats);
+
+static struct kobj_type stats_kobj_type = {
+	.sysfs_ops = &kobj_sysfs_ops,
+	.default_groups = stats_groups,
+};
+
+static int timed_poll_check_rscc(struct kgsl_device *device,
+		unsigned int offset, unsigned int expected_ret,
+		unsigned int timeout, unsigned int mask)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 value;
+
+	if (!adreno_is_a650_family(adreno_dev))
+		return gmu_core_timed_poll_check(device,
+				offset + RSCC_OFFSET_LEGACY,
+				expected_ret, timeout, mask);
+
+	return readl_poll_timeout(gmu->rscc_virt + (offset << 2), value,
+		(value & mask) == expected_ret, 100, timeout * 1000);
+}
+
+struct a6xx_gmu_device *to_a6xx_gmu(struct adreno_device *adreno_dev)
+{
+	struct a6xx_device *a6xx_dev = container_of(adreno_dev,
+					struct a6xx_device, adreno_dev);
+
+	return &a6xx_dev->gmu;
+}
+
+struct adreno_device *a6xx_gmu_to_adreno(struct a6xx_gmu_device *gmu)
+{
+	struct a6xx_device *a6xx_dev =
+			container_of(gmu, struct a6xx_device, gmu);
+
+	return &a6xx_dev->adreno_dev;
+}
+
+#define RSC_CMD_OFFSET 2
+#define PDC_CMD_OFFSET 4
+#define PDC_ENABLE_REG_VALUE 0x80000001
+
+void a6xx_load_rsc_ucode(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	void __iomem *rscc;
+
+	if (adreno_is_a650_family(adreno_dev))
+		rscc = gmu->rscc_virt;
+	else
+		rscc = kgsl_regmap_virt(&device->regmap, RSCC_OFFSET_LEGACY);
+
+	/* Disable SDE clock gating */
+	_regwrite(rscc, A6XX_GPU_RSCC_RSC_STATUS0_DRV0, BIT(24));
+
+	/* Setup RSC PDC handshake for sleep and wakeup */
+	_regwrite(rscc, A6XX_RSCC_PDC_SLAVE_ID_DRV0, 1);
+	_regwrite(rscc, A6XX_RSCC_HIDDEN_TCS_CMD0_DATA, 0);
+	_regwrite(rscc, A6XX_RSCC_HIDDEN_TCS_CMD0_ADDR, 0);
+	_regwrite(rscc, A6XX_RSCC_HIDDEN_TCS_CMD0_DATA + RSC_CMD_OFFSET, 0);
+	_regwrite(rscc, A6XX_RSCC_HIDDEN_TCS_CMD0_ADDR + RSC_CMD_OFFSET, 0);
+	_regwrite(rscc, A6XX_RSCC_HIDDEN_TCS_CMD0_DATA + RSC_CMD_OFFSET * 2,
+			0x80000000);
+	_regwrite(rscc, A6XX_RSCC_HIDDEN_TCS_CMD0_ADDR + RSC_CMD_OFFSET * 2,
+			0);
+	_regwrite(rscc, A6XX_RSCC_OVERRIDE_START_ADDR, 0);
+	_regwrite(rscc, A6XX_RSCC_PDC_SEQ_START_ADDR, 0x4520);
+	_regwrite(rscc, A6XX_RSCC_PDC_MATCH_VALUE_LO, 0x4510);
+	_regwrite(rscc, A6XX_RSCC_PDC_MATCH_VALUE_HI, 0x4514);
+
+	/* Load RSC sequencer uCode for sleep and wakeup */
+	if (adreno_is_a650_family(adreno_dev)) {
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0, 0xEAAAE5A0);
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0 + 1, 0xE1A1EBAB);
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0 + 2, 0xA2E0A581);
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0 + 3, 0xECAC82E2);
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0 + 4, 0x0020EDAD);
+	} else {
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0, 0xA7A506A0);
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0 + 1, 0xA1E6A6E7);
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0 + 2, 0xA2E081E1);
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0 + 3, 0xE9A982E2);
+		_regwrite(rscc, A6XX_RSCC_SEQ_MEM_0_DRV0 + 4, 0x0020E8A8);
+	}
+}
+
+int a6xx_load_pdc_ucode(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct resource *res_pdc, *res_cfg, *res_seq;
+	unsigned int cfg_offset, seq_offset;
+	void __iomem *cfg = NULL, *seq = NULL;
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	u32 vrm_resource_addr = cmd_db_read_addr("vrm.soc");
+	u32 xo_resource_addr = cmd_db_read_addr("xo.lvl");
+	u32 cx_res_addr = cmd_db_read_addr("cx.lvl");
+	u32 mx_res_addr = cmd_db_read_addr("mx.lvl");
+
+	if (!xo_resource_addr) {
+		dev_err(&gmu->pdev->dev,
+				"Failed to get 'xo.lvl' addr from cmd_db\n");
+		return -ENOENT;
+	}
+
+	if (!cx_res_addr) {
+		dev_err(&gmu->pdev->dev,
+				"Failed to get 'cx.lvl' addr from cmd_db\n");
+		return -ENOENT;
+	}
+
+	if (!mx_res_addr) {
+		dev_err(&gmu->pdev->dev,
+				"Failed to get 'mx.lvl' addr from cmd_db\n");
+		return -ENOENT;
+	}
+	/*
+	 * Older A6x platforms specified PDC registers in the DT using a
+	 * single base pointer that encompassed the entire PDC range. Current
+	 * targets specify the individual GPU-owned PDC register blocks
+	 * (sequence and config).
+	 *
+	 * This code handles both possibilities and generates individual
+	 * pointers to the GPU PDC blocks, either as offsets from the single
+	 * base, or as directly specified ranges.
+	 *
+	 * PDC programming has moved to AOP for newer A6x platforms.
+	 * However registers to enable GPU PDC and set the sequence start
+	 * address still need to be programmed.
+	 */
+
+	/* Offsets from the base PDC (if no PDC subsections in the DTSI) */
+	if (adreno_is_a640v2(adreno_dev)) {
+		cfg_offset = 0x90000;
+		seq_offset = 0x290000;
+	} else {
+		cfg_offset = 0x80000;
+		seq_offset = 0x280000;
+	}
+
+	/* Get pointers to each of the possible PDC resources */
+	res_pdc = platform_get_resource_byname(gmu->pdev, IORESOURCE_MEM,
+			"kgsl_gmu_pdc_reg");
+	res_cfg = platform_get_resource_byname(gmu->pdev, IORESOURCE_MEM,
+			"kgsl_gmu_pdc_cfg");
+
+	/*
+	 * Map the starting address for pdc_cfg programming. If the pdc_cfg
+	 * resource is not available use an offset from the base PDC resource.
+	 */
+	if (gmu->pdc_cfg_base == NULL) {
+		if (res_cfg)
+			gmu->pdc_cfg_base = devm_ioremap(&gmu->pdev->dev,
+				res_cfg->start, resource_size(res_cfg));
+		else if (res_pdc)
+			gmu->pdc_cfg_base = devm_ioremap(&gmu->pdev->dev,
+				res_pdc->start + cfg_offset, 0x10000);
+
+		if (!gmu->pdc_cfg_base) {
+			dev_err(&gmu->pdev->dev, "Failed to map PDC CFG\n");
+			return -ENODEV;
+		}
+	}
+
+	cfg = gmu->pdc_cfg_base;
+
+	/* PDC is programmed in AOP for newer platforms */
+	if (a6xx_core->pdc_in_aop)
+		goto done;
+
+	/*
+	 * Map the starting address for pdc_seq programming. If the pdc_seq
+	 * resource is not available use an offset from the base PDC resource.
+	 */
+	if (gmu->pdc_seq_base == NULL) {
+		res_seq = platform_get_resource_byname(gmu->pdev, IORESOURCE_MEM,
+				"kgsl_gmu_pdc_seq");
+
+		if (res_seq)
+			gmu->pdc_seq_base = devm_ioremap(&gmu->pdev->dev,
+				res_seq->start, resource_size(res_seq));
+		else if (res_pdc)
+			gmu->pdc_seq_base = devm_ioremap(&gmu->pdev->dev,
+				res_pdc->start + seq_offset, 0x10000);
+
+		if (!gmu->pdc_seq_base) {
+			dev_err(&gmu->pdev->dev, "Failed to map PDC SEQ\n");
+			return -ENODEV;
+		}
+	}
+
+	seq = gmu->pdc_seq_base;
+
+	/* Load PDC sequencer uCode for power up and power down sequence */
+	_regwrite(seq, PDC_GPU_SEQ_MEM_0, 0xFEBEA1E1);
+	_regwrite(seq, PDC_GPU_SEQ_MEM_0 + 1, 0xA5A4A3A2);
+	_regwrite(seq, PDC_GPU_SEQ_MEM_0 + 2, 0x8382A6E0);
+	_regwrite(seq, PDC_GPU_SEQ_MEM_0 + 3, 0xBCE3E284);
+	_regwrite(seq, PDC_GPU_SEQ_MEM_0 + 4, 0x002081FC);
+
+	/* Set TCS commands used by PDC sequence for low power modes */
+	_regwrite(cfg, PDC_GPU_TCS1_CMD_ENABLE_BANK, 7);
+	_regwrite(cfg, PDC_GPU_TCS1_CMD_WAIT_FOR_CMPL_BANK, 0);
+	_regwrite(cfg, PDC_GPU_TCS1_CONTROL, 0);
+	_regwrite(cfg, PDC_GPU_TCS1_CMD0_MSGID, 0x10108);
+	_regwrite(cfg, PDC_GPU_TCS1_CMD0_ADDR, mx_res_addr);
+	_regwrite(cfg, PDC_GPU_TCS1_CMD0_DATA, 1);
+	_regwrite(cfg, PDC_GPU_TCS1_CMD0_MSGID + PDC_CMD_OFFSET, 0x10108);
+	_regwrite(cfg, PDC_GPU_TCS1_CMD0_ADDR + PDC_CMD_OFFSET, cx_res_addr);
+	_regwrite(cfg, PDC_GPU_TCS1_CMD0_DATA + PDC_CMD_OFFSET, 0x0);
+	_regwrite(cfg, PDC_GPU_TCS1_CMD0_MSGID + PDC_CMD_OFFSET * 2, 0x10108);
+
+	_regwrite(cfg, PDC_GPU_TCS1_CMD0_ADDR + PDC_CMD_OFFSET * 2,
+			xo_resource_addr);
+
+	_regwrite(cfg, PDC_GPU_TCS1_CMD0_DATA + PDC_CMD_OFFSET * 2, 0x0);
+
+	if (vrm_resource_addr && adreno_is_a620(adreno_dev)) {
+		_regwrite(cfg, PDC_GPU_TCS1_CMD0_MSGID + PDC_CMD_OFFSET * 3,
+				0x10108);
+		_regwrite(cfg, PDC_GPU_TCS1_CMD0_ADDR + PDC_CMD_OFFSET * 3,
+				vrm_resource_addr + 0x4);
+		_regwrite(cfg, PDC_GPU_TCS1_CMD0_DATA + PDC_CMD_OFFSET * 3,
+				0x0);
+	}
+
+	_regwrite(cfg, PDC_GPU_TCS3_CMD_ENABLE_BANK, 7);
+	_regwrite(cfg, PDC_GPU_TCS3_CMD_WAIT_FOR_CMPL_BANK, 0);
+	_regwrite(cfg, PDC_GPU_TCS3_CONTROL, 0);
+	_regwrite(cfg, PDC_GPU_TCS3_CMD0_MSGID, 0x10108);
+	_regwrite(cfg, PDC_GPU_TCS3_CMD0_ADDR, mx_res_addr);
+	_regwrite(cfg, PDC_GPU_TCS3_CMD0_DATA, 2);
+	_regwrite(cfg, PDC_GPU_TCS3_CMD0_MSGID + PDC_CMD_OFFSET, 0x10108);
+	_regwrite(cfg, PDC_GPU_TCS3_CMD0_ADDR + PDC_CMD_OFFSET, cx_res_addr);
+
+	if (adreno_is_a618(adreno_dev) || adreno_is_a619(adreno_dev) ||
+			adreno_is_a650_family(adreno_dev))
+		_regwrite(cfg, PDC_GPU_TCS3_CMD0_DATA + PDC_CMD_OFFSET, 0x2);
+	else
+		_regwrite(cfg, PDC_GPU_TCS3_CMD0_DATA + PDC_CMD_OFFSET, 0x3);
+
+	_regwrite(cfg, PDC_GPU_TCS3_CMD0_MSGID + PDC_CMD_OFFSET * 2, 0x10108);
+
+	_regwrite(cfg, PDC_GPU_TCS3_CMD0_ADDR + PDC_CMD_OFFSET * 2,
+			xo_resource_addr);
+
+	_regwrite(cfg, PDC_GPU_TCS3_CMD0_DATA + PDC_CMD_OFFSET * 2, 0x3);
+
+	if (vrm_resource_addr && adreno_is_a620(adreno_dev)) {
+		_regwrite(cfg, PDC_GPU_TCS3_CMD0_MSGID + PDC_CMD_OFFSET * 3,
+				0x10108);
+		_regwrite(cfg, PDC_GPU_TCS3_CMD0_ADDR + PDC_CMD_OFFSET * 3,
+				vrm_resource_addr + 0x4);
+		_regwrite(cfg, PDC_GPU_TCS3_CMD0_DATA + PDC_CMD_OFFSET * 3,
+				0x1);
+	}
+
+done:
+	/* Setup GPU PDC */
+	_regwrite(cfg, PDC_GPU_SEQ_START_ADDR, 0);
+	_regwrite(cfg, PDC_GPU_ENABLE_PDC, PDC_ENABLE_REG_VALUE);
+
+	/* ensure no writes happen before the uCode is fully written */
+	wmb();
+	return 0;
+}
+
+/* GMU timeouts */
+#define GMU_IDLE_TIMEOUT	100	/* ms */
+#define GMU_START_TIMEOUT	100	/* ms */
+#define GPU_START_TIMEOUT	100	/* ms */
+#define GPU_RESET_TIMEOUT	1	/* ms */
+#define GPU_RESET_TIMEOUT_US	10	/* us */
+
+/*
+ * The lowest 16 bits of this value are the number of XO clock cycles
+ * for main hysteresis. This is the first hysteresis. Here we set it
+ * to 0x1680 cycles, or 300 us. The highest 16 bits of this value are
+ * the number of XO clock cycles for short hysteresis. This happens
+ * after main hysteresis. Here we set it to 0xA cycles, or 0.5 us.
+ */
+#define A6X_GMU_LONG_IFPC_HYST	FIELD_PREP(GENMASK(15, 0), 0x1680)
+#define A6X_GMU_SHORT_IFPC_HYST	FIELD_PREP(GENMASK(31, 16), 0xA)
+
+/* Minimum IFPC timer (200usec) allowed to override default value */
+#define A6X_GMU_LONG_IFPC_HYST_FLOOR	FIELD_PREP(GENMASK(15, 0), 0x0F00)
+
+/*
+ * a6xx_gmu_power_config() - Configure and enable GMU's low power mode
+ * setting based on ADRENO feature flags.
+ * @adreno_dev: Pointer to adreno device
+ */
+static void a6xx_gmu_power_config(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	/* Configure registers for idle setting. The setting is cumulative */
+
+	/* Disable GMU WB/RB buffer and caches at boot */
+	gmu_core_regwrite(device, A6XX_GMU_SYS_BUS_CONFIG, 0x1);
+	gmu_core_regwrite(device, A6XX_GMU_ICACHE_CONFIG, 0x1);
+	gmu_core_regwrite(device, A6XX_GMU_DCACHE_CONFIG, 0x1);
+
+	gmu_core_regwrite(device,
+		A6XX_GMU_PWR_COL_INTER_FRAME_CTRL,  0x9C40400);
+
+	if (gmu->idle_level == GPU_HW_IFPC) {
+		gmu_core_regwrite(device, A6XX_GMU_PWR_COL_INTER_FRAME_HYST,
+				A6X_GMU_SHORT_IFPC_HYST | adreno_dev->ifpc_hyst);
+		gmu_core_regrmw(device, A6XX_GMU_PWR_COL_INTER_FRAME_CTRL,
+				IFPC_ENABLE_MASK, IFPC_ENABLE_MASK);
+
+		gmu_core_regwrite(device, A6XX_GMU_PWR_COL_SPTPRAC_HYST,
+				A6X_GMU_SHORT_IFPC_HYST | adreno_dev->ifpc_hyst);
+		gmu_core_regrmw(device, A6XX_GMU_PWR_COL_INTER_FRAME_CTRL,
+				SPTP_ENABLE_MASK, SPTP_ENABLE_MASK);
+	}
+
+	/* Enable RPMh GPU client */
+	gmu_core_regrmw(device, A6XX_GMU_RPMH_CTRL, RPMH_ENABLE_MASK,
+		RPMH_ENABLE_MASK);
+}
+
+static void gmu_ao_sync_event(struct adreno_device *adreno_dev)
+{
+	unsigned long flags;
+	u64 ticks;
+
+	local_irq_save(flags);
+
+	/* Read GMU always on register */
+	ticks = a6xx_read_alwayson(adreno_dev);
+
+	/* Trace the GMU time to create a mapping to ftrace time */
+	trace_gmu_ao_sync(ticks);
+
+	local_irq_restore(flags);
+}
+
+void a6xx_gmu_disable_gdsc(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	/* ADRENO_QUIRK_CX_GDSC quirk is not support for genpd */
+	WARN_ON_ONCE(pwr->cx_pd && ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_CX_GDSC));
+
+	if (pwr->cx_regulator && ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_CX_GDSC))
+		regulator_set_mode(pwr->cx_regulator, REGULATOR_MODE_IDLE);
+
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	if (pwr->cx_regulator && ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_CX_GDSC))
+		regulator_set_mode(pwr->cx_regulator, REGULATOR_MODE_NORMAL);
+}
+
+int a6xx_gmu_device_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 val = 0x00000100;
+	u32 mask = 0x000001FF;
+
+	gmu_core_reset_trace_header(&gmu->trace);
+	gmu_ao_sync_event(adreno_dev);
+
+	/* Check for 0xBABEFACE on legacy targets */
+	if (gmu->ver.core <= 0x20010004) {
+		val = 0xBABEFACE;
+		mask = 0xFFFFFFFF;
+	}
+
+	/* Bring GMU out of reset */
+	gmu_core_regwrite(device, A6XX_GMU_CM3_SYSRESET, 0);
+
+	/* Make sure the write is posted before moving ahead */
+	wmb();
+
+	if (gmu_core_timed_poll_check(device,
+			A6XX_GMU_CM3_FW_INIT_RESULT,
+			val, GMU_START_TIMEOUT, mask)) {
+
+		dev_err(&gmu->pdev->dev, "GMU doesn't boot\n");
+		gmu_core_fault_snapshot(device);
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+/*
+ * a6xx_gmu_hfi_start() - Write registers and start HFI.
+ * @device: Pointer to KGSL device
+ */
+int a6xx_gmu_hfi_start(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	gmu_core_regwrite(device, A6XX_GMU_HFI_CTRL_INIT, 1);
+
+	if (gmu_core_timed_poll_check(device,
+			A6XX_GMU_HFI_CTRL_STATUS,
+			BIT(0),
+			GMU_START_TIMEOUT,
+			BIT(0))) {
+		dev_err(&gmu->pdev->dev, "GMU HFI init failed\n");
+		gmu_core_fault_snapshot(device);
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+int a6xx_rscc_wakeup_sequence(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct device *dev = &gmu->pdev->dev;
+	int val;
+
+	/* Skip wakeup sequence if we didn't do the sleep sequence */
+	if (!test_bit(GMU_PRIV_RSCC_SLEEP_DONE, &gmu->flags))
+		return 0;
+	 /* A660 has a replacement register */
+	if (adreno_is_a662(adreno_dev) || adreno_is_a621(adreno_dev) ||
+			adreno_is_a663(adreno_dev) || adreno_is_a623(adreno_dev))
+		gmu_core_regread(device, A662_GPU_CC_GX_DOMAIN_MISC3, &val);
+	else if (adreno_is_a660(ADRENO_DEVICE(device)))
+		gmu_core_regread(device, A6XX_GPU_CC_GX_DOMAIN_MISC3, &val);
+	else
+		gmu_core_regread(device, A6XX_GPU_CC_GX_DOMAIN_MISC, &val);
+
+	if (!(val & 0x1))
+		dev_info_ratelimited(&gmu->pdev->dev,
+			"GMEM CLAMP IO not set while GFX rail off\n");
+
+	/* RSC wake sequence */
+	gmu_core_regwrite(device, A6XX_GMU_RSCC_CONTROL_REQ, BIT(1));
+
+	/* Write request before polling */
+	wmb();
+
+	if (gmu_core_timed_poll_check(device,
+			A6XX_GMU_RSCC_CONTROL_ACK,
+			BIT(1),
+			GPU_START_TIMEOUT,
+			BIT(1))) {
+		dev_err(dev, "Failed to do GPU RSC power on\n");
+		return -ETIMEDOUT;
+	}
+
+	if (timed_poll_check_rscc(device,
+			A6XX_RSCC_SEQ_BUSY_DRV0,
+			0,
+			GPU_START_TIMEOUT,
+			0xFFFFFFFF))
+		goto error_rsc;
+
+	gmu_core_regwrite(device, A6XX_GMU_RSCC_CONTROL_REQ, 0);
+
+	clear_bit(GMU_PRIV_RSCC_SLEEP_DONE, &gmu->flags);
+
+	return 0;
+
+error_rsc:
+	dev_err(dev, "GPU RSC sequence stuck in waking up GPU\n");
+	return -ETIMEDOUT;
+}
+
+int a6xx_rscc_sleep_sequence(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	if (!test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags))
+		return 0;
+
+	if (test_bit(GMU_PRIV_RSCC_SLEEP_DONE, &gmu->flags))
+		return 0;
+
+	gmu_core_regwrite(device, A6XX_GMU_CM3_SYSRESET, 1);
+	/* Make sure M3 is in reset before going on */
+	wmb();
+
+	gmu_core_regread(device, A6XX_GPU_GMU_CX_GMU_PWR_COL_CP_RESP,
+			&gmu->log_wptr_retention);
+
+	gmu_core_regwrite(device, A6XX_GMU_RSCC_CONTROL_REQ, 1);
+	/* Make sure the request completes before continuing */
+	wmb();
+
+	ret = timed_poll_check_rscc(device,
+			A6XX_GPU_RSCC_RSC_STATUS0_DRV0,
+			BIT(16),
+			GPU_START_TIMEOUT,
+			BIT(16));
+
+	if (ret) {
+		dev_err(&gmu->pdev->dev, "GPU RSC power off fail\n");
+		return -ETIMEDOUT;
+	}
+
+	gmu_core_regwrite(device, A6XX_GMU_RSCC_CONTROL_REQ, 0);
+
+	if (adreno_dev->lm_enabled)
+		gmu_core_regwrite(device, A6XX_GMU_AO_SPARE_CNTL, 0);
+
+	set_bit(GMU_PRIV_RSCC_SLEEP_DONE, &gmu->flags);
+
+	return 0;
+}
+
+static struct kgsl_memdesc *find_gmu_memdesc(struct a6xx_gmu_device *gmu,
+	u32 addr, u32 size)
+{
+	int i;
+
+	for (i = 0; i < gmu->global_entries; i++) {
+		struct kgsl_memdesc *md = &gmu->gmu_globals[i];
+
+		if ((addr >= md->gmuaddr) &&
+		(((addr + size) <= (md->gmuaddr + md->size))))
+			return md;
+	}
+
+	return NULL;
+}
+
+static int find_vma_block(struct a6xx_gmu_device *gmu, u32 addr, u32 size)
+{
+	int i;
+
+	for (i = 0; i < GMU_MEM_TYPE_MAX; i++) {
+		struct gmu_vma_entry *vma = &gmu->vma[i];
+
+		if ((addr >= vma->start) &&
+			((addr + size) <= (vma->start + vma->size)))
+			return i;
+	}
+
+	return -ENOENT;
+}
+
+#define MAX_GMUFW_SIZE	0x8000	/* in bytes */
+
+static int _load_legacy_gmu_fw(struct kgsl_device *device,
+	struct a6xx_gmu_device *gmu)
+{
+	const struct firmware *fw = gmu->fw_image;
+
+	if (fw->size > MAX_GMUFW_SIZE)
+		return -EINVAL;
+
+	gmu_core_blkwrite(device, A6XX_GMU_CM3_ITCM_START, fw->data,
+			fw->size);
+
+	/* Proceed only after the FW is written */
+	wmb();
+	return 0;
+}
+
+static void load_tcm(struct adreno_device *adreno_dev, const u8 *src,
+	u32 tcm_start, u32 base, const struct gmu_block_header *blk)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 tcm_offset = tcm_start + ((blk->addr - base)/sizeof(u32));
+	void __iomem *addr = kgsl_regmap_virt(&device->regmap, tcm_offset);
+
+	memcpy_toio(addr, src, blk->size);
+}
+
+int a6xx_gmu_load_fw(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	const u8 *fw = (const u8 *)gmu->fw_image->data;
+
+	if (adreno_is_a630(adreno_dev) || adreno_is_a615_family(adreno_dev))
+		return _load_legacy_gmu_fw(KGSL_DEVICE(adreno_dev), gmu);
+
+	while (fw < gmu->fw_image->data + gmu->fw_image->size) {
+		const struct gmu_block_header *blk  =
+					(const struct gmu_block_header *)fw;
+		int id;
+
+		fw += sizeof(*blk);
+
+		/* Don't deal with zero size blocks */
+		if (blk->size == 0)
+			continue;
+
+		id = find_vma_block(gmu, blk->addr, blk->size);
+
+		if (id < 0) {
+			dev_err(&gmu->pdev->dev,
+				"Unknown block in GMU FW addr:0x%x size:0x%x\n",
+				blk->addr, blk->size);
+			return -EINVAL;
+		}
+
+		if (id == GMU_ITCM) {
+			load_tcm(adreno_dev, fw,
+				A6XX_GMU_CM3_ITCM_START,
+				gmu->vma[GMU_ITCM].start, blk);
+		} else if (id == GMU_DTCM) {
+			load_tcm(adreno_dev, fw,
+				A6XX_GMU_CM3_DTCM_START,
+				gmu->vma[GMU_DTCM].start, blk);
+		} else {
+			struct kgsl_memdesc *md =
+				find_gmu_memdesc(gmu, blk->addr, blk->size);
+
+			if (!md) {
+				dev_err(&gmu->pdev->dev,
+					"No backing memory for GMU FW block addr:0x%x size:0x%x\n",
+					blk->addr, blk->size);
+				return -EINVAL;
+			}
+
+			memcpy(md->hostptr + (blk->addr - md->gmuaddr), fw,
+				blk->size);
+		}
+
+		fw += blk->size;
+	}
+
+	/* Proceed only after the FW is written */
+	wmb();
+	return 0;
+}
+
+static const char *oob_to_str(enum oob_request req)
+{
+	if (req == oob_gpu)
+		return "oob_gpu";
+	else if (req == oob_perfcntr)
+		return "oob_perfcntr";
+	else if (req == oob_boot_slumber)
+		return "oob_boot_slumber";
+	else if (req == oob_dcvs)
+		return "oob_dcvs";
+	return "unknown";
+}
+
+static void trigger_reset_recovery(struct adreno_device *adreno_dev,
+	enum oob_request req)
+{
+	/*
+	 * Trigger recovery for perfcounter oob only since only
+	 * perfcounter oob can happen alongside an actively rendering gpu.
+	 */
+	if (req != oob_perfcntr)
+		return;
+
+	if (adreno_dev->dispatch_ops && adreno_dev->dispatch_ops->fault)
+		adreno_dev->dispatch_ops->fault(adreno_dev,
+			ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+}
+
+int a6xx_gmu_oob_set(struct kgsl_device *device,
+		enum oob_request req)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret = 0;
+	int set, check;
+
+	if (req == oob_perfcntr && gmu->num_oob_perfcntr++)
+		return 0;
+
+	if (adreno_is_a630(adreno_dev) || adreno_is_a615_family(adreno_dev)) {
+		set = BIT(req + 16);
+		check = BIT(req + 24);
+	} else {
+		/*
+		 * The legacy targets have special bits that aren't supported on
+		 * newer implementations
+		 */
+		if (req >= oob_boot_slumber) {
+			dev_err(&gmu->pdev->dev,
+				"Unsupported OOB request %s\n",
+				oob_to_str(req));
+			return -EINVAL;
+		}
+
+		set = BIT(30 - req * 2);
+		check = BIT(31 - req);
+	}
+
+	gmu_core_regwrite(device, A6XX_GMU_HOST2GMU_INTR_SET, set);
+
+	if (gmu_core_timed_poll_check(device, A6XX_GMU_GMU2HOST_INTR_INFO,
+				check, GPU_START_TIMEOUT, check)) {
+		if (req == oob_perfcntr)
+			gmu->num_oob_perfcntr--;
+		gmu_core_fault_snapshot(device);
+		ret = -ETIMEDOUT;
+		WARN(1, "OOB request %s timed out\n", oob_to_str(req));
+		trigger_reset_recovery(adreno_dev, req);
+	}
+
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, check);
+
+	trace_kgsl_gmu_oob_set(set);
+	return ret;
+}
+
+void a6xx_gmu_oob_clear(struct kgsl_device *device,
+		enum oob_request req)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int clear;
+
+	if (req == oob_perfcntr && --gmu->num_oob_perfcntr)
+		return;
+
+	if (adreno_is_a630(adreno_dev) || adreno_is_a615_family(adreno_dev)) {
+		clear = BIT(req + 24);
+	} else {
+		clear = BIT(31 - req * 2);
+		if (req >= oob_boot_slumber) {
+			dev_err(&gmu->pdev->dev, "Unsupported OOB clear %s\n",
+				oob_to_str(req));
+			return;
+		}
+	}
+
+	gmu_core_regwrite(device, A6XX_GMU_HOST2GMU_INTR_SET, clear);
+	trace_kgsl_gmu_oob_clear(clear);
+}
+
+void a6xx_gmu_irq_enable(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hfi *hfi = &gmu->hfi;
+
+	/* Clear pending IRQs and Unmask needed IRQs */
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, 0xffffffff);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_CLR, 0xffffffff);
+
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_MASK,
+		(unsigned int)~HFI_IRQ_MASK);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_MASK,
+		(unsigned int)~GMU_AO_INT_MASK);
+
+
+	/* Enable all IRQs on host */
+	enable_irq(hfi->irq);
+	enable_irq(gmu->irq);
+}
+
+void a6xx_gmu_irq_disable(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hfi *hfi = &gmu->hfi;
+
+	/* Disable all IRQs on host */
+	disable_irq(gmu->irq);
+	disable_irq(hfi->irq);
+
+	/* Mask all IRQs and clear pending IRQs */
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_MASK, 0xffffffff);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_MASK, 0xffffffff);
+
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, 0xffffffff);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_CLR, 0xffffffff);
+
+}
+
+static int a6xx_gmu_hfi_start_msg(struct adreno_device *adreno_dev)
+{
+	struct hfi_start_cmd req;
+
+	/*
+	 * This HFI was not supported in legacy firmware and this quirk
+	 * serves as a better means to identify targets that depend on
+	 * legacy firmware.
+	 */
+	if (!ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_HFI_USE_REG)) {
+		int ret;
+
+		ret = CMD_MSG_HDR(req, H2F_MSG_START);
+		if (ret)
+			return ret;
+
+		return a6xx_hfi_send_generic_req(adreno_dev, &req, sizeof(req));
+	}
+
+	return 0;
+
+}
+
+#define FREQ_VOTE(idx, ack) (((idx) & 0xFF) | (((ack) & 0xF) << 28))
+#define BW_VOTE(idx) ((((idx) & 0xFFF) << 12) | ((idx) & 0xFFF))
+
+#define CLKSET_OPTION_ATLEAST 3
+
+/*
+ * a6xx_gmu_dcvs_nohfi() - request GMU to do DCVS without using HFI
+ * @device: Pointer to KGSL device
+ * @perf_idx: Index into GPU performance level table defined in
+ *	HFI DCVS table message
+ * @bw_idx: Index into GPU b/w table defined in HFI b/w table message
+ *
+ */
+static int a6xx_gmu_dcvs_nohfi(struct kgsl_device *device,
+		unsigned int perf_idx, unsigned int bw_idx)
+{
+	int ret;
+
+	gmu_core_regwrite(device, A6XX_GMU_DCVS_ACK_OPTION, DCVS_ACK_NONBLOCK);
+
+	gmu_core_regwrite(device, A6XX_GMU_DCVS_PERF_SETTING,
+			FREQ_VOTE(perf_idx, CLKSET_OPTION_ATLEAST));
+
+	gmu_core_regwrite(device, A6XX_GMU_DCVS_BW_SETTING, BW_VOTE(bw_idx));
+
+	ret = a6xx_gmu_oob_set(device, oob_dcvs);
+	if (ret == 0)
+		gmu_core_regread(device, A6XX_GMU_DCVS_RETURN, &ret);
+
+	a6xx_gmu_oob_clear(device, oob_dcvs);
+
+	return ret;
+}
+
+static u32 a6xx_rscc_tcsm_drv0_status_reglist[] = {
+	A6XX_RSCC_TCS0_DRV0_STATUS,
+	A6XX_RSCC_TCS1_DRV0_STATUS,
+	A6XX_RSCC_TCS2_DRV0_STATUS,
+	A6XX_RSCC_TCS3_DRV0_STATUS,
+	A6XX_RSCC_TCS4_DRV0_STATUS,
+	A6XX_RSCC_TCS5_DRV0_STATUS,
+	A6XX_RSCC_TCS6_DRV0_STATUS,
+	A6XX_RSCC_TCS7_DRV0_STATUS,
+	A6XX_RSCC_TCS8_DRV0_STATUS,
+	A6XX_RSCC_TCS9_DRV0_STATUS,
+};
+
+static int a6xx_complete_rpmh_votes(struct adreno_device *adreno_dev,
+		unsigned int timeout)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	/* Number of TCS commands are increased to 10 from A650 family onwards */
+	int count = adreno_is_a650_family(adreno_dev) ?
+				ARRAY_SIZE(a6xx_rscc_tcsm_drv0_status_reglist) : 4;
+	int i, ret = 0;
+
+	for (i = 0; i < count; i++)
+		ret |= timed_poll_check_rscc(device, a6xx_rscc_tcsm_drv0_status_reglist[i],
+				BIT(0), timeout, BIT(0));
+
+	if (ret)
+		dev_err(device->dev, "RPMH votes timedout: %d\n", ret);
+
+	return ret;
+}
+
+#define SPTPRAC_CTRL_TIMEOUT		10 /* ms */
+
+/*
+ * a6xx_gmu_sptprac_enable() - Power on SPTPRAC
+ * @adreno_dev: Pointer to Adreno device
+ */
+int a6xx_gmu_sptprac_enable(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	/* Only certain targets have sptprac */
+	if (!adreno_is_a630(adreno_dev) && !adreno_is_a615_family(adreno_dev))
+		return 0;
+
+	if (test_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED, &adreno_dev->priv))
+		return 0;
+
+	/* GMU enabled a630 and a615 targets */
+	gmu_core_regwrite(device, A6XX_GMU_GX_SPTPRAC_POWER_CONTROL,
+			SPTPRAC_POWERON_CTRL_MASK);
+
+	if (gmu_core_timed_poll_check(device,
+			A6XX_GMU_SPTPRAC_PWR_CLK_STATUS,
+			SPTPRAC_POWERON_STATUS_MASK,
+			SPTPRAC_CTRL_TIMEOUT,
+			SPTPRAC_POWERON_STATUS_MASK)) {
+		dev_err(&gmu->pdev->dev, "power on SPTPRAC fail\n");
+		gmu_core_fault_snapshot(device);
+		return -ETIMEDOUT;
+	}
+
+	set_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED, &adreno_dev->priv);
+	return 0;
+}
+
+/*
+ * a6xx_gmu_sptprac_disable() - Power of SPTPRAC
+ * @adreno_dev: Pointer to Adreno device
+ */
+void a6xx_gmu_sptprac_disable(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	/* Only certain targets have sptprac */
+	if (!adreno_is_a630(adreno_dev) && !adreno_is_a615_family(adreno_dev))
+		return;
+
+	if (!test_and_clear_bit(ADRENO_DEVICE_GPU_REGULATOR_ENABLED,
+		&adreno_dev->priv))
+		return;
+
+	/* GMU enabled a630 and a615 targets */
+
+	/* Ensure that retention is on */
+	gmu_core_regrmw(device, A6XX_GPU_CC_GX_GDSCR, 0,
+			A6XX_RETAIN_FF_ENABLE_ENABLE_MASK);
+
+	gmu_core_regwrite(device, A6XX_GMU_GX_SPTPRAC_POWER_CONTROL,
+			SPTPRAC_POWEROFF_CTRL_MASK);
+
+	if (gmu_core_timed_poll_check(device,
+			A6XX_GMU_SPTPRAC_PWR_CLK_STATUS,
+			SPTPRAC_POWEROFF_STATUS_MASK,
+			SPTPRAC_CTRL_TIMEOUT,
+			SPTPRAC_POWEROFF_STATUS_MASK))
+		dev_err(&gmu->pdev->dev, "power off SPTPRAC fail\n");
+}
+
+#define SPTPRAC_POWER_OFF	BIT(2)
+#define SP_CLK_OFF		BIT(4)
+#define GX_GDSC_POWER_OFF	BIT(6)
+#define GX_CLK_OFF		BIT(7)
+#define is_on(val)		(!(val & (GX_GDSC_POWER_OFF | GX_CLK_OFF)))
+
+bool a6xx_gmu_gx_is_on(struct adreno_device *adreno_dev)
+{
+	unsigned int val;
+
+	gmu_core_regread(KGSL_DEVICE(adreno_dev),
+			A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, &val);
+	return is_on(val);
+}
+
+bool a619_holi_gx_is_on(struct adreno_device *adreno_dev)
+{
+	unsigned int val;
+
+	gmu_core_regread(KGSL_DEVICE(adreno_dev),
+			A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, &val);
+	return is_on(val);
+}
+
+/*
+ * a6xx_gmu_sptprac_is_on() - Check if SPTP is on using pwr status register
+ * @adreno_dev - Pointer to adreno_device
+ * This check should only be performed if the keepalive bit is set or it
+ * can be guaranteed that the power state of the GPU will remain unchanged
+ */
+bool a6xx_gmu_sptprac_is_on(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int val;
+
+	if (!adreno_is_a630(adreno_dev) && !adreno_is_a615_family(adreno_dev))
+		return true;
+
+	if (adreno_is_a619_holi(adreno_dev))
+		kgsl_regread(device,
+			A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, &val);
+	else
+		gmu_core_regread(device, A6XX_GMU_SPTPRAC_PWR_CLK_STATUS,
+			&val);
+
+	return !(val & (SPTPRAC_POWER_OFF | SP_CLK_OFF));
+}
+
+/*
+ * a6xx_gmu_gfx_rail_on() - request GMU to power GPU at given OPP.
+ * @device: Pointer to KGSL device
+ *
+ */
+static int a6xx_gmu_gfx_rail_on(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 perf_idx = gmu->hfi.dcvs_table.gpu_level_num -
+		pwr->default_pwrlevel - 1;
+	u32 default_opp = gmu->hfi.dcvs_table.gx_votes[perf_idx].vote;
+
+	gmu_core_regwrite(device, A6XX_GMU_BOOT_SLUMBER_OPTION,
+			OOB_BOOT_OPTION);
+	gmu_core_regwrite(device, A6XX_GMU_GX_VOTE_IDX,
+			ARC_VOTE_GET_PRI(default_opp));
+	gmu_core_regwrite(device, A6XX_GMU_MX_VOTE_IDX,
+			ARC_VOTE_GET_SEC(default_opp));
+
+	a6xx_rdpm_mx_freq_update(gmu,
+			gmu->hfi.dcvs_table.gx_votes[perf_idx].freq);
+
+	return a6xx_gmu_oob_set(device, oob_boot_slumber);
+}
+
+static bool idle_trandition_complete(unsigned int idle_level,
+	unsigned int gmu_power_reg,
+	unsigned int sptprac_clk_reg)
+{
+	if (idle_level != gmu_power_reg)
+		return false;
+
+	if (idle_level == GPU_HW_IFPC && is_on(sptprac_clk_reg))
+		return false;
+
+	return true;
+}
+
+static const char *idle_level_name(int level)
+{
+	if (level == GPU_HW_ACTIVE)
+		return "GPU_HW_ACTIVE";
+	else if (level == GPU_HW_IFPC)
+		return "GPU_HW_IFPC";
+
+	return "";
+}
+
+int a6xx_gmu_wait_for_lowest_idle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	unsigned int reg, reg1, reg2, reg3, reg4, reg5, reg6, reg7, reg8;
+	unsigned long t;
+	uint64_t ts1, ts2, ts3;
+
+	ts1 = a6xx_read_alwayson(adreno_dev);
+
+	t = jiffies + msecs_to_jiffies(GMU_IDLE_TIMEOUT);
+	do {
+		gmu_core_regread(device,
+			A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE, &reg);
+		gmu_core_regread(device,
+			A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, &reg1);
+
+		if (idle_trandition_complete(gmu->idle_level, reg, reg1))
+			return 0;
+		/* Wait 100us to reduce unnecessary AHB bus traffic */
+		usleep_range(10, 100);
+	} while (!time_after(jiffies, t));
+
+	ts2 = a6xx_read_alwayson(adreno_dev);
+	/* Check one last time */
+
+	gmu_core_regread(device, A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE, &reg);
+	gmu_core_regread(device, A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, &reg1);
+
+	if (idle_trandition_complete(gmu->idle_level, reg, reg1))
+		return 0;
+
+	ts3 = a6xx_read_alwayson(adreno_dev);
+
+	/* Collect abort data to help with debugging */
+	gmu_core_regread(device, A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, &reg2);
+	gmu_core_regread(device, A6XX_GMU_RBBM_INT_UNMASKED_STATUS, &reg3);
+	gmu_core_regread(device, A6XX_GMU_GMU_PWR_COL_KEEPALIVE, &reg4);
+	gmu_core_regread(device, A6XX_GMU_AO_SPARE_CNTL, &reg5);
+
+	dev_err(&gmu->pdev->dev,
+		"----------------------[ GMU error ]----------------------\n");
+	dev_err(&gmu->pdev->dev,
+		"Timeout waiting for lowest idle level %s\n",
+		idle_level_name(gmu->idle_level));
+	dev_err(&gmu->pdev->dev, "Start: %llx (absolute ticks)\n", ts1);
+	dev_err(&gmu->pdev->dev, "Poll: %llx (ticks relative to start)\n",
+		ts2-ts1);
+	dev_err(&gmu->pdev->dev, "Retry: %llx (ticks relative to poll)\n",
+		ts3-ts2);
+	dev_err(&gmu->pdev->dev,
+		"RPMH_POWER_STATE=%x SPTPRAC_PWR_CLK_STATUS=%x\n", reg, reg1);
+	dev_err(&gmu->pdev->dev, "CX_BUSY_STATUS=%x\n", reg2);
+	dev_err(&gmu->pdev->dev,
+		"RBBM_INT_UNMASKED_STATUS=%x PWR_COL_KEEPALIVE=%x\n",
+		reg3, reg4);
+	dev_err(&gmu->pdev->dev, "A6XX_GMU_AO_SPARE_CNTL=%x\n", reg5);
+
+	if (adreno_is_a660(adreno_dev)) {
+		u32 val;
+
+		gmu_core_regread(device, A6XX_GMU_PWR_COL_PREEMPT_KEEPALIVE, &val);
+		dev_err(&gmu->pdev->dev, "PWR_COL_PREEMPT_KEEPALIVE=%x\n", val);
+	}
+
+	/* Access GX registers only when GX is ON */
+	if (is_on(reg1)) {
+		kgsl_regread(device, A6XX_CP_STATUS_1, &reg6);
+		kgsl_regread(device, A6XX_CP_CP2GMU_STATUS, &reg7);
+		kgsl_regread(device, A6XX_CP_CONTEXT_SWITCH_CNTL, &reg8);
+
+		dev_err(&gmu->pdev->dev, "A6XX_CP_STATUS_1=%x\n", reg6);
+		dev_err(&gmu->pdev->dev,
+			"CP2GMU_STATUS=%x CONTEXT_SWITCH_CNTL=%x\n",
+			reg7, reg8);
+	}
+
+	WARN_ON(1);
+	gmu_core_fault_snapshot(device);
+	return -ETIMEDOUT;
+}
+
+/* Bitmask for GPU idle status check */
+#define CXGXCPUBUSYIGNAHB	BIT(30)
+int a6xx_gmu_wait_for_idle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	unsigned int status2;
+	uint64_t ts1;
+
+	ts1 = a6xx_read_alwayson(adreno_dev);
+	if (gmu_core_timed_poll_check(device, A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS,
+			0, GMU_START_TIMEOUT, CXGXCPUBUSYIGNAHB)) {
+		gmu_core_regread(device,
+				A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS2, &status2);
+		dev_err(&gmu->pdev->dev,
+				"GMU not idling: status2=0x%x %llx %llx\n",
+				status2, ts1,
+				a6xx_read_alwayson(ADRENO_DEVICE(device)));
+		gmu_core_fault_snapshot(device);
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+/* A6xx GMU FENCE RANGE MASK */
+#define GMU_FENCE_RANGE_MASK	((0x1 << 31) | ((0xA << 2) << 18) | (0x8A0))
+
+void a6xx_gmu_version_info(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	/* GMU version info is at a fixed offset in the DTCM */
+	gmu_core_regread(device, A6XX_GMU_CM3_DTCM_START + 0xFF8,
+				&gmu->ver.core);
+	gmu_core_regread(device, A6XX_GMU_CM3_DTCM_START + 0xFF9,
+				&gmu->ver.core_dev);
+	gmu_core_regread(device, A6XX_GMU_CM3_DTCM_START + 0xFFA,
+				&gmu->ver.pwr);
+	gmu_core_regread(device, A6XX_GMU_CM3_DTCM_START + 0xFFB,
+				&gmu->ver.pwr_dev);
+	gmu_core_regread(device, A6XX_GMU_CM3_DTCM_START + 0xFFC,
+				&gmu->ver.hfi);
+}
+
+int a6xx_gmu_itcm_shadow(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 i, *dest;
+
+	if (gmu->itcm_shadow)
+		return 0;
+
+	gmu->itcm_shadow = vzalloc(gmu->vma[GMU_ITCM].size);
+	if (!gmu->itcm_shadow)
+		return -ENOMEM;
+
+	dest = (u32 *)gmu->itcm_shadow;
+
+	/* FIXME: use bulk read? */
+	for (i = 0; i < (gmu->vma[GMU_ITCM].size >> 2); i++)
+		gmu_core_regread(KGSL_DEVICE(adreno_dev),
+			A6XX_GMU_CM3_ITCM_START + i, dest++);
+
+	return 0;
+}
+
+static void a6xx_gmu_enable_throttle_counters(
+	struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 val;
+
+	if (!(adreno_dev->lm_enabled || adreno_dev->bcl_enabled))
+		return;
+
+	if (adreno_dev->lm_enabled) {
+		/*
+		 * For LM throttling -
+		 * XOCLK1: countable: 0x10
+		 * XOCLK2: countable: 0x16 for newer hardware / 0x15 for others
+		 * XOCLK3: countable: 0xf for newer hardware / 0x19 for others
+		 *
+		 * POWER_CONTROL_SELECT_0 controls counters 0 - 3, each selector
+		 * is 8 bits wide.
+		 */
+
+		if (adreno_is_a620(adreno_dev) || adreno_is_a650(adreno_dev))
+			val = (0x10 << 8) | (0x16 << 16) | (0x0f << 24);
+		else
+			val = (0x10 << 8) | (0x15 << 16) | (0x19 << 24);
+	} else {
+		/*
+		 * When LM is not enabled, we can enable BCL throttling -
+		 * XOCLK1: countable: 0x13 (25% throttle)
+		 * XOCLK2: countable: 0x17 (58% throttle)
+		 * XOCLK3: countable: 0x19 (75% throttle)
+		 *
+		 * POWER_CONTROL_SELECT_0 controls counters 0 - 3, each selector
+		 * is 8 bits wide.
+		 */
+		val = (0x13 << 8) | (0x17 << 16) | (0x19 << 24);
+	}
+	/* Make sure not to write over XOCLK0 */
+	gmu_core_regrmw(device, A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_0,
+		0xffffff00, val);
+
+	gmu_core_regwrite(device, A6XX_GMU_AO_SPARE_CNTL, 1);
+}
+
+void a6xx_gmu_register_config(struct adreno_device *adreno_dev)
+{
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 gmu_log_info, chipid = 0;
+
+	/* Clear any previously set cm3 fault */
+	atomic_set(&gmu->cm3_fault, 0);
+
+	/* Vote veto for FAL10 feature if supported*/
+	if (a6xx_core->veto_fal10) {
+		gmu_core_regwrite(device,
+			A6XX_GPU_GMU_CX_GMU_CX_FALNEXT_INTF, 0x1);
+		gmu_core_regwrite(device, A6XX_GPU_GMU_CX_GMU_CX_FAL_INTF, 0x1);
+	}
+
+	/* Turn on TCM retention */
+	gmu_core_regwrite(device, A6XX_GMU_GENERAL_7, 1);
+
+	/* Clear init result to make sure we are getting fresh value */
+	gmu_core_regwrite(device, A6XX_GMU_CM3_FW_INIT_RESULT, 0);
+	gmu_core_regwrite(device, A6XX_GMU_CM3_BOOT_CONFIG, 0x2);
+
+	gmu_core_regwrite(device, A6XX_GMU_HFI_QTBL_ADDR,
+			gmu->hfi.hfi_mem->gmuaddr);
+	gmu_core_regwrite(device, A6XX_GMU_HFI_QTBL_INFO, 1);
+
+	/*
+	 * For A6xx GMUAO interrupt line BIT[1] is combined for ipcc
+	 * and doorbell. Enable dbdWakeupEn interrupt for GMU to receive
+	 * IPC interrupt.
+	 */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_LSR))
+		gmu_core_regwrite(device, A6XX_GMU_AO_INTERRUPT_EN, BIT(1));
+
+	gmu_core_regwrite(device, A6XX_GMU_AHB_FENCE_RANGE_0,
+			GMU_FENCE_RANGE_MASK);
+
+	/*
+	 * Make sure that CM3 state is at reset value. Snapshot is changing
+	 * NMI bit and if we boot up GMU with NMI bit set GMU will boot
+	 * straight in to NMI handler without executing __main code
+	 */
+	gmu_core_regwrite(device, A6XX_GMU_CM3_CFG, 0x4052);
+
+	/**
+	 * We may have asserted gbif halt as part of reset sequence which may
+	 * not get cleared if the gdsc was not reset. So clear it before
+	 * attempting GMU boot.
+	 */
+	if (!adreno_is_a630(adreno_dev))
+		kgsl_regwrite(device, A6XX_GBIF_HALT, 0x0);
+
+	/* Set vrb address before starting GMU */
+	if (!IS_ERR_OR_NULL(gmu->vrb))
+		gmu_core_regwrite(device, A6XX_GMU_GENERAL_11, gmu->vrb->gmuaddr);
+
+	/* Set the log wptr index */
+	gmu_core_regwrite(device, A6XX_GPU_GMU_CX_GMU_PWR_COL_CP_RESP,
+			gmu->log_wptr_retention);
+
+	/* Pass chipid to GMU FW, must happen before starting GMU */
+	chipid = ADRENO_GMU_CHIPID(adreno_dev->chipid);
+
+	/*
+	 * For A660 GPU variant, GMU firmware expects chipid as per below
+	 * format to differentiate between A660 and A660 variant. In device
+	 * tree, target version is specified as high nibble of patch to align
+	 * with usermode driver expectation. Format the chipid according to
+	 * firmware requirement.
+	 *
+	 * Bit 11-8: patch version
+	 * Bit 15-12: minor version
+	 * Bit 23-16: major version
+	 * Bit 27-24: core version
+	 * Bit 31-28: target version
+	 */
+	if (adreno_is_a660_shima(adreno_dev))
+		chipid |= ((ADRENO_CHIPID_PATCH(adreno_dev->chipid) >> 4) << 28);
+
+	gmu_core_regwrite(device, A6XX_GMU_HFI_SFR_ADDR, chipid);
+
+	/* Log size is encoded in (number of 4K units - 1) */
+	gmu_log_info = (gmu->gmu_log->gmuaddr & 0xFFFFF000) |
+		((GMU_LOG_SIZE/SZ_4K - 1) & 0xFF);
+	gmu_core_regwrite(device, A6XX_GPU_GMU_CX_GMU_PWR_COL_CP_MSG,
+			gmu_log_info);
+
+	/* Configure power control and bring the GMU out of reset */
+	a6xx_gmu_power_config(adreno_dev);
+
+	a6xx_gmu_enable_throttle_counters(adreno_dev);
+}
+
+struct kgsl_memdesc *reserve_gmu_kernel_block(struct a6xx_gmu_device *gmu,
+	u32 addr, u32 size, u32 vma_id, u32 align)
+{
+	int ret;
+	struct kgsl_memdesc *md;
+	struct gmu_vma_entry *vma = &gmu->vma[vma_id];
+	struct kgsl_device *device = KGSL_DEVICE(a6xx_gmu_to_adreno(gmu));
+	u32 aligned_size = ALIGN(size, hfi_get_gmu_sz_alignment(align));
+
+	if (gmu->global_entries == ARRAY_SIZE(gmu->gmu_globals))
+		return ERR_PTR(-ENOMEM);
+
+	md = &gmu->gmu_globals[gmu->global_entries];
+
+	ret = kgsl_allocate_kernel(device, md, size, 0, KGSL_MEMDESC_SYSMEM);
+	if (ret) {
+		memset(md, 0x0, sizeof(*md));
+		return ERR_PTR(-ENOMEM);
+	}
+
+	if (!addr)
+		addr = ALIGN(vma->next_va, hfi_get_gmu_va_alignment(align));
+
+	ret = gmu_core_map_memdesc(gmu->domain, md, addr,
+		IOMMU_READ | IOMMU_WRITE | IOMMU_PRIV);
+	if (ret) {
+		dev_err(&gmu->pdev->dev,
+			"Unable to map GMU kernel block: addr:0x%08x size:0x%llx :%d\n",
+			addr, md->size, ret);
+		kgsl_sharedmem_free(md);
+		memset(md, 0, sizeof(*md));
+		return ERR_PTR(-ENOMEM);
+	}
+
+	md->gmuaddr = addr;
+
+	/* Take into account the size alignment when reserving the GMU VA */
+	vma->next_va = md->gmuaddr + aligned_size;
+
+	gmu->global_entries++;
+
+	return md;
+}
+
+struct kgsl_memdesc *reserve_gmu_kernel_block_fixed(struct a6xx_gmu_device *gmu,
+	u32 addr, u32 size, u32 vma_id, const char *resource, int attrs, u32 align)
+{
+	int ret;
+	struct kgsl_memdesc *md;
+	struct gmu_vma_entry *vma = &gmu->vma[vma_id];
+	struct kgsl_device *device = KGSL_DEVICE(a6xx_gmu_to_adreno(gmu));
+	u32 aligned_size = ALIGN(size, hfi_get_gmu_sz_alignment(align));
+
+	if (gmu->global_entries == ARRAY_SIZE(gmu->gmu_globals))
+		return ERR_PTR(-ENOMEM);
+
+	md = &gmu->gmu_globals[gmu->global_entries];
+
+	ret = kgsl_memdesc_init_fixed(device, gmu->pdev, resource, md);
+	if (ret)
+		return ERR_PTR(ret);
+
+	if (!addr)
+		addr = ALIGN(vma->next_va, hfi_get_gmu_va_alignment(align));
+
+	if ((vma->next_va + aligned_size) > (vma->start + vma->size)) {
+		dev_err(&gmu->pdev->dev,
+			"GMU mapping too big. available: %d required: %d\n",
+			vma->next_va - vma->start, aligned_size);
+			md =  ERR_PTR(-ENOMEM);
+			goto done;
+	}
+
+	ret = gmu_core_map_memdesc(gmu->domain, md, addr, attrs);
+	if (ret) {
+		dev_err(&gmu->pdev->dev,
+			"Unable to map GMU kernel block: addr:0x%08x size:0x%llx :%d\n",
+			addr, md->size, ret);
+		md =  ERR_PTR(-ENOMEM);
+		goto done;
+
+	}
+
+	md->gmuaddr = addr;
+	/* Take into account the size alignment when reserving the GMU VA */
+	vma->next_va = md->gmuaddr + aligned_size;
+	gmu->global_entries++;
+done:
+	sg_free_table(md->sgt);
+	kfree(md->sgt);
+	md->sgt = NULL;
+	return md;
+}
+
+static int reserve_entire_vma(struct a6xx_gmu_device *gmu, u32 vma_id)
+{
+	struct kgsl_memdesc *md;
+	u32 start = gmu->vma[vma_id].start, size = gmu->vma[vma_id].size;
+
+	md = find_gmu_memdesc(gmu, start, size);
+	if (md)
+		return 0;
+
+	md = reserve_gmu_kernel_block(gmu, start, size, vma_id, 0);
+
+	return PTR_ERR_OR_ZERO(md);
+}
+
+static int a6xx_gmu_cache_finalize(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_memdesc *md;
+	int ret;
+
+	/* Preallocations were made so no need to request all this memory */
+	if (gmu->preallocations)
+		return 0;
+
+	ret = reserve_entire_vma(gmu, GMU_ICACHE);
+	if (ret)
+		return ret;
+
+	if (!adreno_is_a650_family(adreno_dev)) {
+		ret = reserve_entire_vma(gmu, GMU_DCACHE);
+		if (ret)
+			return ret;
+	}
+
+	md = reserve_gmu_kernel_block(gmu, 0, SZ_4K, GMU_NONCACHED_KERNEL, 0);
+	if (IS_ERR(md))
+		return PTR_ERR(md);
+
+	gmu->preallocations = true;
+
+	return 0;
+}
+
+static int a6xx_gmu_process_prealloc(struct a6xx_gmu_device *gmu,
+	struct gmu_block_header *blk)
+{
+	struct kgsl_memdesc *md;
+
+	int id = find_vma_block(gmu, blk->addr, blk->value);
+
+	if (id < 0) {
+		dev_err(&gmu->pdev->dev,
+			"Invalid prealloc block addr: 0x%x value:%d\n",
+			blk->addr, blk->value);
+		return id;
+	}
+
+	/* Nothing to do for TCM blocks or user uncached */
+	if (id == GMU_ITCM || id == GMU_DTCM || id == GMU_NONCACHED_USER)
+		return 0;
+
+	/* Check if the block is already allocated */
+	md = find_gmu_memdesc(gmu, blk->addr, blk->value);
+	if (md != NULL)
+		return 0;
+
+	md = reserve_gmu_kernel_block(gmu, blk->addr, blk->value, id, 0);
+	if (IS_ERR(md))
+		return PTR_ERR(md);
+
+	gmu->preallocations = true;
+
+	return 0;
+}
+
+int a6xx_gmu_parse_fw(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	struct gmu_block_header *blk;
+	int ret, offset = 0;
+
+	/* GMU fw already saved and verified so do nothing new */
+	if (!gmu->fw_image) {
+
+		if (a6xx_core->gmufw_name == NULL)
+			return -EINVAL;
+
+		ret = request_firmware(&gmu->fw_image, a6xx_core->gmufw_name,
+				&gmu->pdev->dev);
+		if (ret) {
+			dev_err(&gmu->pdev->dev, "request_firmware (%s) failed: %d\n",
+					a6xx_core->gmufw_name, ret);
+			return ret;
+		}
+	}
+
+	/*
+	 * Zero payload fw blocks contain metadata and are
+	 * guaranteed to precede fw load data. Parse the
+	 * metadata blocks.
+	 */
+	while (offset < gmu->fw_image->size) {
+		blk = (struct gmu_block_header *)&gmu->fw_image->data[offset];
+
+		if (offset + sizeof(*blk) > gmu->fw_image->size) {
+			dev_err(&gmu->pdev->dev, "Invalid FW Block\n");
+			return -EINVAL;
+		}
+
+		/* Done with zero length blocks so return */
+		if (blk->size)
+			break;
+
+		offset += sizeof(*blk);
+
+		if (blk->type == GMU_BLK_TYPE_PREALLOC_REQ ||
+				blk->type == GMU_BLK_TYPE_PREALLOC_PERSIST_REQ) {
+			ret = a6xx_gmu_process_prealloc(gmu, blk);
+
+			if (ret)
+				return ret;
+		}
+	}
+
+	return 0;
+}
+
+int a6xx_gmu_memory_init(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	/* Allocates & maps GMU crash dump memory */
+	if (adreno_is_a630(adreno_dev) || adreno_is_a615_family(adreno_dev)) {
+		if (IS_ERR_OR_NULL(gmu->dump_mem))
+			gmu->dump_mem = reserve_gmu_kernel_block(gmu, 0, SZ_16K,
+					GMU_NONCACHED_KERNEL, 0);
+		if (IS_ERR(gmu->dump_mem))
+			return PTR_ERR(gmu->dump_mem);
+	}
+
+	/* GMU master log */
+	if (IS_ERR_OR_NULL(gmu->gmu_log))
+		gmu->gmu_log = reserve_gmu_kernel_block(gmu, 0, GMU_LOG_SIZE,
+				GMU_NONCACHED_KERNEL, 0);
+
+	return PTR_ERR_OR_ZERO(gmu->gmu_log);
+}
+
+static int a6xx_gmu_init(struct adreno_device *adreno_dev)
+{
+	int ret;
+
+	ret = a6xx_gmu_parse_fw(adreno_dev);
+	if (ret)
+		return ret;
+
+	 /* Request any other cache ranges that might be required */
+	ret = a6xx_gmu_cache_finalize(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gmu_memory_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	return a6xx_hfi_init(adreno_dev);
+}
+
+#define A6XX_VBIF_XIN_HALT_CTRL1_ACKS   (BIT(0) | BIT(1) | BIT(2) | BIT(3))
+
+static void a6xx_gmu_pwrctrl_suspend(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* If SPTP_RAC is on, turn off SPTP_RAC HS */
+	a6xx_gmu_sptprac_disable(adreno_dev);
+
+	/* Disconnect GPU from BUS is not needed if CX GDSC goes off later */
+
+	/* Check no outstanding RPMh voting */
+	a6xx_complete_rpmh_votes(adreno_dev, GPU_RESET_TIMEOUT);
+
+	/* Clear the WRITEDROPPED fields and set fence to allow mode */
+	gmu_core_regwrite(device, A6XX_GMU_AHB_FENCE_STATUS_CLR, 0x7);
+	gmu_core_regwrite(device, A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+
+	/* Make sure above writes are committed before we proceed to recovery */
+	wmb();
+
+	gmu_core_regwrite(device, A6XX_GMU_CM3_SYSRESET, 1);
+
+	if (!adreno_is_a630(adreno_dev)) {
+		/* Halt GX traffic */
+		if (a6xx_gmu_gx_is_on(adreno_dev)) {
+			kgsl_regwrite(device, A6XX_RBBM_GBIF_HALT,
+				A6XX_GBIF_GX_HALT_MASK);
+			adreno_wait_for_halt_ack(device,
+					A6XX_RBBM_GBIF_HALT_ACK,
+					A6XX_GBIF_GX_HALT_MASK);
+		}
+		/* Halt CX traffic */
+		a6xx_halt_gbif(adreno_dev);
+		/* De-assert the halts */
+		kgsl_regwrite(device, A6XX_GBIF_HALT, 0x0);
+	}
+
+	if (a6xx_gmu_gx_is_on(adreno_dev))
+		kgsl_regwrite(device, A6XX_RBBM_SW_RESET_CMD, 0x1);
+
+	/* Allow the software reset to complete */
+	udelay(100);
+
+	/*
+	 * This is based on the assumption that GMU is the only one controlling
+	 * the GX HS. This code path is the only client voting for GX from linux
+	 * kernel.
+	 */
+	if (!a6xx_gmu_gx_is_on(adreno_dev))
+		return;
+
+	/*
+	 * Switch gx gdsc control from GMU to CPU force non-zero reference
+	 * count in clk driver so next disable call will turn off the GDSC
+	 */
+	kgsl_pwrctrl_enable_gx_gdsc(device);
+
+	/*
+	 * Toggle the loop_en bit, across disabling the gx gdsc, with a delay
+	 * of 10 XO cycles before disabling gx gdsc. This is to prevent CPR
+	 * measurements from failing.
+	 */
+	if (adreno_is_a660(adreno_dev)) {
+		gmu_core_regrmw(device, A6XX_GPU_CPR_FSM_CTL, 1, 0);
+		ndelay(520);
+	}
+
+	kgsl_pwrctrl_disable_gx_gdsc(device);
+
+	if (adreno_is_a660(adreno_dev))
+		gmu_core_regrmw(device, A6XX_GPU_CPR_FSM_CTL, 1, 1);
+
+	if (a6xx_gmu_gx_is_on(adreno_dev))
+		dev_err(&gmu->pdev->dev, "gx is stuck on\n");
+}
+
+/*
+ * a6xx_gmu_notify_slumber() - initiate request to GMU to prepare to slumber
+ * @device: Pointer to KGSL device
+ */
+static int a6xx_gmu_notify_slumber(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int bus_level = pwr->pwrlevels[pwr->default_pwrlevel].bus_freq;
+	int perf_idx = gmu->hfi.dcvs_table.gpu_level_num -
+			pwr->default_pwrlevel - 1;
+	int ret, state;
+
+	/* Disable the power counter so that the GMU is not busy */
+	gmu_core_regwrite(device, A6XX_GMU_CX_GMU_POWER_COUNTER_ENABLE, 0);
+
+	/* Turn off SPTPRAC if we own it */
+	if (gmu->idle_level == GPU_HW_ACTIVE)
+		a6xx_gmu_sptprac_disable(adreno_dev);
+
+	if (!ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_HFI_USE_REG)) {
+		struct hfi_prep_slumber_cmd req = {
+			.freq = perf_idx,
+			.bw = bus_level,
+		};
+
+		ret = CMD_MSG_HDR(req, H2F_MSG_PREPARE_SLUMBER);
+		if (!ret)
+			ret = a6xx_hfi_send_generic_req(adreno_dev, &req, sizeof(req));
+
+		goto out;
+	}
+
+	gmu_core_regwrite(device, A6XX_GMU_BOOT_SLUMBER_OPTION,
+			OOB_SLUMBER_OPTION);
+	gmu_core_regwrite(device, A6XX_GMU_GX_VOTE_IDX, perf_idx);
+	gmu_core_regwrite(device, A6XX_GMU_MX_VOTE_IDX, bus_level);
+
+	ret = a6xx_gmu_oob_set(device, oob_boot_slumber);
+	a6xx_gmu_oob_clear(device, oob_boot_slumber);
+
+	if (!ret) {
+		gmu_core_regread(device,
+			A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE, &state);
+		if (state != GPU_HW_SLUMBER) {
+			dev_err(&gmu->pdev->dev,
+					"Failed to prepare for slumber: 0x%x\n",
+					state);
+			ret = -ETIMEDOUT;
+		}
+	}
+
+out:
+	/* Make sure the fence is in ALLOW mode */
+	gmu_core_regwrite(device, A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+	return ret;
+}
+
+void a6xx_gmu_suspend(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	a6xx_gmu_pwrctrl_suspend(adreno_dev);
+
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+	a6xx_gmu_disable_gdsc(adreno_dev);
+
+	a6xx_rdpm_cx_freq_update(gmu, 0);
+
+	dev_err(&gmu->pdev->dev, "Suspended GMU\n");
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_NONE);
+}
+
+static int a6xx_gmu_dcvs_set(struct adreno_device *adreno_dev,
+		int gpu_pwrlevel, int bus_level)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_dcvstable_cmd *table = &gmu->hfi.dcvs_table;
+	struct hfi_gx_bw_perf_vote_cmd req = {
+		.ack_type = DCVS_ACK_BLOCK,
+		.freq = INVALID_DCVS_IDX,
+		.bw = INVALID_DCVS_IDX,
+	};
+	int ret = 0;
+
+	if (!test_bit(GMU_PRIV_HFI_STARTED, &gmu->flags))
+		return 0;
+
+	/* Do not set to XO and lower GPU clock vote from GMU */
+	if ((gpu_pwrlevel != INVALID_DCVS_IDX) &&
+			(gpu_pwrlevel >= table->gpu_level_num - 1))
+		return -EINVAL;
+
+	if (gpu_pwrlevel < table->gpu_level_num - 1)
+		req.freq = table->gpu_level_num - gpu_pwrlevel - 1;
+
+	if (bus_level < pwr->ddr_table_count && bus_level > 0)
+		req.bw = bus_level;
+
+	/* GMU will vote for slumber levels through the sleep sequence */
+	if ((req.freq == INVALID_DCVS_IDX) &&
+		(req.bw == INVALID_DCVS_IDX)) {
+		return 0;
+	}
+
+	ret = CMD_MSG_HDR(req, H2F_MSG_GX_BW_PERF_VOTE);
+	if (ret)
+		return ret;
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_HFI_USE_REG))
+		ret = a6xx_gmu_dcvs_nohfi(device, req.freq, req.bw);
+	else
+		ret = a6xx_hfi_send_generic_req(adreno_dev, &req, sizeof(req));
+
+	if (ret) {
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"Failed to set GPU perf idx %d, bw idx %d\n",
+			req.freq, req.bw);
+
+		/*
+		 * If this was a dcvs request along side an active gpu, request
+		 * dispatcher based reset and recovery.
+		 */
+		if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+			adreno_dispatcher_fault(adreno_dev, ADRENO_GMU_FAULT |
+				ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+	}
+
+	if (req.freq != INVALID_DCVS_IDX)
+		a6xx_rdpm_mx_freq_update(gmu,
+			gmu->hfi.dcvs_table.gx_votes[req.freq].freq);
+
+	return ret;
+}
+
+static int a6xx_gmu_clock_set(struct adreno_device *adreno_dev, u32 pwrlevel)
+{
+	return a6xx_gmu_dcvs_set(adreno_dev, pwrlevel, INVALID_DCVS_IDX);
+}
+
+static int a6xx_gmu_ifpc_store(struct kgsl_device *device,
+		unsigned int val)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	unsigned int requested_idle_level;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_IFPC))
+		return -EINVAL;
+
+	if (val)
+		requested_idle_level = GPU_HW_IFPC;
+	else
+		requested_idle_level = GPU_HW_ACTIVE;
+
+	if (gmu->idle_level == requested_idle_level)
+		return 0;
+
+	/* Power down the GPU before changing the idle level */
+	return adreno_power_cycle_u32(adreno_dev, &gmu->idle_level,
+		requested_idle_level);
+}
+
+static unsigned int a6xx_gmu_ifpc_isenabled(struct kgsl_device *device)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(ADRENO_DEVICE(device));
+
+	return gmu->idle_level == GPU_HW_IFPC;
+}
+
+/* Send an NMI to the GMU */
+void a6xx_gmu_send_nmi(struct kgsl_device *device, bool force)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 val;
+
+	/*
+	 * Do not send NMI if the SMMU is stalled because GMU will not be able
+	 * to save cm3 state to DDR.
+	 */
+	if (a6xx_gmu_gx_is_on(adreno_dev) && a6xx_is_smmu_stalled(device)) {
+		dev_err(&gmu->pdev->dev,
+			"Skipping NMI because SMMU is stalled\n");
+		return;
+	}
+
+	if (force)
+		goto nmi;
+
+	/*
+	 * We should not send NMI if there was a CM3 fault reported because we
+	 * don't want to overwrite the critical CM3 state captured by gmu before
+	 * it sent the CM3 fault interrupt. Also don't send NMI if GMU reset is
+	 * already active. We could have hit a GMU assert and NMI might have
+	 * already been triggered.
+	 */
+
+	/* make sure we're reading the latest cm3_fault */
+	smp_rmb();
+
+	if (atomic_read(&gmu->cm3_fault))
+		return;
+
+	gmu_core_regread(device, A6XX_GMU_CM3_FW_INIT_RESULT, &val);
+
+	if (val & 0xE00)
+		return;
+
+nmi:
+	/* Mask so there's no interrupt caused by NMI */
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_MASK, 0xFFFFFFFF);
+
+	/* Make sure the interrupt is masked before causing it */
+	wmb();
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_HFI_USE_REG))
+		gmu_core_regwrite(device,
+			A6XX_GMU_NMI_CONTROL_STATUS, 0);
+
+	/* This will cause the GMU to save it's internal state to ddr */
+	gmu_core_regread(device, A6XX_GMU_CM3_CFG, &val);
+	val |=  BIT(9);
+	gmu_core_regwrite(device, A6XX_GMU_CM3_CFG, val);
+
+	/* Make sure the NMI is invoked before we proceed*/
+	wmb();
+
+	/* Wait for the NMI to be handled */
+	udelay(200);
+}
+
+static void a6xx_gmu_cooperative_reset(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	unsigned int result;
+
+	gmu_core_regwrite(device, A6XX_GMU_CX_GMU_WDOG_CTRL, 0);
+	gmu_core_regwrite(device, A6XX_GMU_HOST2GMU_INTR_SET, BIT(17));
+
+	/*
+	 * After triggering graceful death wait for snapshot ready
+	 * indication from GMU.
+	 */
+	if (!gmu_core_timed_poll_check(device, A6XX_GMU_CM3_FW_INIT_RESULT,
+				0x800, 2, 0x800))
+		return;
+
+	gmu_core_regread(device, A6XX_GMU_CM3_FW_INIT_RESULT, &result);
+	dev_err(&gmu->pdev->dev,
+		"GMU cooperative reset timed out 0x%x\n", result);
+	/*
+	 * If we dont get a snapshot ready from GMU, trigger NMI
+	 * and if we still timeout then we just continue with reset.
+	 */
+	a6xx_gmu_send_nmi(device, true);
+
+	gmu_core_regread(device, A6XX_GMU_CM3_FW_INIT_RESULT, &result);
+	if ((result & 0x800) != 0x800)
+		dev_err(&gmu->pdev->dev,
+			"GMU cooperative reset NMI timed out 0x%x\n", result);
+}
+
+static int a6xx_gmu_wait_for_active_transition(
+	struct kgsl_device *device)
+{
+	unsigned int reg;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(ADRENO_DEVICE(device));
+
+	if (!gmu_core_isenabled(device))
+		return 0;
+
+	if (gmu_core_timed_poll_check(device, A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE,
+			GPU_HW_ACTIVE, 100, GENMASK(3, 0))) {
+		gmu_core_regread(device, A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE, &reg);
+		dev_err(&gmu->pdev->dev,
+			"GMU failed to move to ACTIVE state, Current state: 0x%x\n",
+			reg);
+
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+static bool a6xx_gmu_scales_bandwidth(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	return (ADRENO_GPUREV(adreno_dev) >= ADRENO_REV_A640);
+}
+
+void a6xx_gmu_handle_watchdog(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 mask;
+
+	/* Temporarily mask the watchdog interrupt to prevent a storm */
+	gmu_core_regread(device, A6XX_GMU_AO_HOST_INTERRUPT_MASK,
+		&mask);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_MASK,
+			(mask | GMU_INT_WDOG_BITE));
+
+	a6xx_gmu_send_nmi(device, false);
+
+	dev_err_ratelimited(&gmu->pdev->dev,
+			"GMU watchdog expired interrupt received\n");
+}
+
+static irqreturn_t a6xx_gmu_irq_handler(int irq, void *data)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	const struct a6xx_gpudev *a6xx_gpudev =
+		to_a6xx_gpudev(ADRENO_GPU_DEVICE(adreno_dev));
+	unsigned int status = 0;
+
+	gmu_core_regread(device, A6XX_GMU_AO_HOST_INTERRUPT_STATUS, &status);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_CLR, status);
+
+	/* Ignore GMU_INT_RSCC_COMP and GMU_INT_DBD WAKEUP interrupts */
+	if (status & GMU_INT_WDOG_BITE)
+		a6xx_gpudev->handle_watchdog(adreno_dev);
+	if (status & GMU_INT_HOST_AHB_BUS_ERR)
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"AHB bus error interrupt received\n");
+	if (status & GMU_INT_FENCE_ERR) {
+		unsigned int fence_status;
+
+		gmu_core_regread(device, A6XX_GMU_AHB_FENCE_STATUS,
+			&fence_status);
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"FENCE error interrupt received %x\n", fence_status);
+	}
+
+	if (status & ~GMU_AO_INT_MASK)
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"Unhandled GMU interrupts 0x%lx\n",
+				status & ~GMU_AO_INT_MASK);
+
+	return IRQ_HANDLED;
+}
+
+void a6xx_gmu_snapshot(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	a6xx_gmu_device_snapshot(device, snapshot);
+
+	a6xx_snapshot(adreno_dev, snapshot);
+
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR,
+		0xffffffff);
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_MASK,
+		HFI_IRQ_MASK);
+
+}
+
+void a6xx_gmu_aop_send_acd_state(struct a6xx_gmu_device *gmu, bool flag)
+{
+	char msg_buf[36];
+	u32 size;
+	int ret;
+
+	if (!gmu->qmp && !gmu->mailbox.channel)
+		return;
+
+	size = scnprintf(msg_buf, sizeof(msg_buf),
+			"{class: gpu, res: acd, val: %d}", flag);
+
+	/* mailbox controller expects 4-byte aligned buffer */
+	size = ALIGN((size + 1), SZ_4);
+
+	if (gmu->qmp) {
+		ret = qmp_send(gmu->qmp, msg_buf, size);
+	} else {
+		struct qmp_pkt msg;
+
+		msg.size = size;
+		msg.data = msg_buf;
+
+		ret = mbox_send_message(gmu->mailbox.channel, &msg);
+	}
+
+	if (ret < 0)
+		dev_err(&gmu->pdev->dev,
+			"AOP send message failed: %d\n", ret);
+}
+
+int a6xx_gmu_enable_clks(struct adreno_device *adreno_dev, u32 level)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	a6xx_rdpm_cx_freq_update(gmu, gmu->freqs[level] / 1000);
+
+	ret = kgsl_clk_set_rate(gmu->clks, gmu->num_clks, "gmu_clk",
+			gmu->freqs[level]);
+	if (ret) {
+		dev_err(&gmu->pdev->dev, "GMU clock:%d set failed:%d\n",
+			gmu->freqs[level], ret);
+		return ret;
+	}
+
+	ret = kgsl_clk_set_rate(gmu->clks, gmu->num_clks, "hub_clk",
+			adreno_dev->gmu_hub_clk_freq);
+	if (ret && ret != -ENODEV) {
+		dev_err(&gmu->pdev->dev, "Unable to set the HUB clock\n");
+		return ret;
+	}
+
+	ret = clk_bulk_prepare_enable(gmu->num_clks, gmu->clks);
+	if (ret) {
+		dev_err(&gmu->pdev->dev, "Cannot enable GMU clocks\n");
+		return ret;
+	}
+
+	device->state = KGSL_STATE_AWARE;
+
+	return 0;
+}
+
+static void a6xx_gmu_force_first_boot(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 val = 0;
+
+	if (gmu->pdc_cfg_base) {
+		kgsl_pwrctrl_enable_cx_gdsc(device);
+		a6xx_gmu_enable_clks(adreno_dev, 0);
+
+		val = __raw_readl(gmu->pdc_cfg_base + (PDC_GPU_ENABLE_PDC << 2));
+
+		/* ensure this read operation is done before the next one */
+		rmb();
+
+		clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+		a6xx_gmu_disable_gdsc(adreno_dev);
+		a6xx_rdpm_cx_freq_update(gmu, 0);
+	}
+
+	if (val != PDC_ENABLE_REG_VALUE) {
+		clear_bit(GMU_PRIV_RSCC_SLEEP_DONE, &gmu->flags);
+		clear_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags);
+	}
+}
+
+static int a6xx_gmu_first_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int level, ret;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_AWARE);
+
+	a6xx_gmu_aop_send_acd_state(gmu, adreno_dev->acd_enabled);
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gmu_enable_clks(adreno_dev, 0);
+	if (ret)
+		goto gdsc_off;
+
+	ret = a6xx_gmu_load_fw(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = a6xx_gmu_itcm_shadow(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	a6xx_gmu_register_config(adreno_dev);
+
+	a6xx_gmu_version_info(adreno_dev);
+
+	a6xx_gmu_irq_enable(adreno_dev);
+
+	/* Vote for minimal DDR BW for GMU to init */
+	level = pwr->pwrlevels[pwr->default_pwrlevel].bus_min;
+	icc_set_bw(pwr->icc_path, 0, kBps_to_icc(pwr->ddr_table[level]));
+
+	ret = a6xx_gmu_device_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_HFI_USE_REG)) {
+		ret = a6xx_gmu_gfx_rail_on(adreno_dev);
+		if (ret) {
+			a6xx_gmu_oob_clear(device, oob_boot_slumber);
+			goto err;
+		}
+	}
+
+	if (gmu->idle_level == GPU_HW_ACTIVE) {
+		ret = a6xx_gmu_sptprac_enable(adreno_dev);
+		if (ret)
+			goto err;
+	}
+
+	if (!test_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags)) {
+		ret = a6xx_load_pdc_ucode(adreno_dev);
+		if (ret)
+			goto err;
+
+		a6xx_load_rsc_ucode(adreno_dev);
+		set_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags);
+	}
+
+	ret = a6xx_gmu_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = a6xx_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	icc_set_bw(pwr->icc_path, 0, 0);
+
+	device->gmu_fault = false;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return 0;
+
+err:
+	a6xx_gmu_irq_disable(adreno_dev);
+
+	if (device->gmu_fault) {
+		a6xx_gmu_suspend(adreno_dev);
+		return ret;
+	}
+
+clks_gdsc_off:
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+gdsc_off:
+	a6xx_gmu_disable_gdsc(adreno_dev);
+
+	a6xx_rdpm_cx_freq_update(gmu, 0);
+
+	return ret;
+}
+
+static int a6xx_gmu_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret = 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_AWARE);
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gmu_enable_clks(adreno_dev, 0);
+	if (ret)
+		goto gdsc_off;
+
+	ret = a6xx_rscc_wakeup_sequence(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = a6xx_gmu_load_fw(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	a6xx_gmu_register_config(adreno_dev);
+
+	a6xx_gmu_irq_enable(adreno_dev);
+
+	ret = a6xx_gmu_device_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_HFI_USE_REG)) {
+		ret = a6xx_gmu_gfx_rail_on(adreno_dev);
+		if (ret) {
+			a6xx_gmu_oob_clear(device, oob_boot_slumber);
+			goto err;
+		}
+	}
+
+	if (gmu->idle_level == GPU_HW_ACTIVE) {
+		ret = a6xx_gmu_sptprac_enable(adreno_dev);
+		if (ret)
+			goto err;
+	}
+
+	ret = a6xx_gmu_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = a6xx_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	device->gmu_fault = false;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return 0;
+
+err:
+	a6xx_gmu_irq_disable(adreno_dev);
+
+	if (device->gmu_fault) {
+		a6xx_gmu_suspend(adreno_dev);
+		return ret;
+	}
+
+clks_gdsc_off:
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+gdsc_off:
+	a6xx_gmu_disable_gdsc(adreno_dev);
+
+	a6xx_rdpm_cx_freq_update(gmu, 0);
+
+	return ret;
+}
+
+static void set_acd(struct adreno_device *adreno_dev, void *priv)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	adreno_dev->acd_enabled = *((bool *)priv);
+	a6xx_gmu_aop_send_acd_state(gmu, adreno_dev->acd_enabled);
+}
+
+static int a6xx_gmu_acd_set(struct kgsl_device *device, bool val)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	if (!gmu->qmp && !gmu->mailbox.channel)
+		return -EINVAL;
+
+	/* Don't do any unneeded work if ACD is already in the correct state */
+	if (adreno_dev->acd_enabled == val)
+		return 0;
+
+	/* Power cycle the GPU for changes to take effect */
+	return adreno_power_cycle(adreno_dev, set_acd, &val);
+}
+
+static const struct gmu_dev_ops a6xx_gmudev = {
+	.oob_set = a6xx_gmu_oob_set,
+	.oob_clear = a6xx_gmu_oob_clear,
+	.ifpc_store = a6xx_gmu_ifpc_store,
+	.ifpc_isenabled = a6xx_gmu_ifpc_isenabled,
+	.cooperative_reset = a6xx_gmu_cooperative_reset,
+	.wait_for_active_transition = a6xx_gmu_wait_for_active_transition,
+	.scales_bandwidth = a6xx_gmu_scales_bandwidth,
+	.acd_set = a6xx_gmu_acd_set,
+	.force_first_boot = a6xx_gmu_force_first_boot,
+	.send_nmi = a6xx_gmu_send_nmi,
+};
+
+static int a6xx_gmu_bus_set(struct adreno_device *adreno_dev, int buslevel,
+	u32 ab)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret = 0;
+
+	kgsl_icc_set_tag(pwr, buslevel);
+
+	if (buslevel != pwr->cur_buslevel) {
+		ret = a6xx_gmu_dcvs_set(adreno_dev, INVALID_DCVS_IDX, buslevel);
+		if (ret)
+			return ret;
+
+		pwr->cur_buslevel = buslevel;
+	}
+
+	if (ab != pwr->cur_ab) {
+		icc_set_bw(pwr->icc_path, MBps_to_icc(ab), 0);
+		pwr->cur_ab = ab;
+	}
+
+	trace_kgsl_buslevel(device, pwr->active_pwrlevel, buslevel, ab);
+	return ret;
+}
+
+static void a6xx_free_gmu_globals(struct a6xx_gmu_device *gmu)
+{
+	int i;
+
+	for (i = 0; i < gmu->global_entries && i < ARRAY_SIZE(gmu->gmu_globals); i++) {
+		struct kgsl_memdesc *md = &gmu->gmu_globals[i];
+
+		if (!md->gmuaddr)
+			continue;
+
+		iommu_unmap(gmu->domain, md->gmuaddr, md->size);
+
+		if (md->priv & KGSL_MEMDESC_SYSMEM)
+			kgsl_sharedmem_free(md);
+
+		memset(md, 0, sizeof(*md));
+	}
+
+	if (gmu->domain) {
+		iommu_detach_device(gmu->domain, &gmu->pdev->dev);
+		iommu_domain_free(gmu->domain);
+		gmu->domain = NULL;
+	}
+
+	gmu->global_entries = 0;
+}
+
+static int a6xx_gmu_aop_messaging_init(struct adreno_device *adreno_dev,
+		struct a6xx_gmu_device *gmu)
+{
+	struct kgsl_mailbox *mailbox = &gmu->mailbox;
+	int ret;
+
+	if (of_find_property(gmu->pdev->dev.of_node, "qcom,qmp", NULL)) {
+		gmu->qmp = qmp_get(&gmu->pdev->dev);
+		ret = PTR_ERR_OR_ZERO(gmu->qmp);
+		if (ret) {
+			gmu->qmp = NULL;
+			return ret;
+		}
+		goto done;
+	}
+
+	mailbox->client.dev = &gmu->pdev->dev;
+	mailbox->client.tx_block = true;
+	mailbox->client.tx_tout = 1000;
+	mailbox->client.knows_txdone = false;
+
+	mailbox->channel = mbox_request_channel(&mailbox->client, 0);
+	ret = PTR_ERR_OR_ZERO(mailbox->channel);
+	if (ret) {
+		mailbox->channel = NULL;
+		return ret;
+	}
+
+done:
+	adreno_dev->acd_enabled = true;
+
+	return 0;
+}
+
+static int a6xx_gmu_acd_probe(struct kgsl_device *device,
+		struct a6xx_gmu_device *gmu, struct device_node *node)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct kgsl_pwrlevel *pwrlevel =
+			&pwr->pwrlevels[pwr->num_pwrlevels - 1];
+	struct hfi_acd_table_cmd *cmd = &gmu->hfi.acd_table;
+	int ret, i, cmd_idx = 0;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_ACD))
+		return 0;
+
+	cmd->hdr = CREATE_MSG_HDR(H2F_MSG_ACD_TBL, HFI_MSG_CMD);
+
+	cmd->version = 1;
+	cmd->stride = 1;
+	cmd->enable_by_level = 0;
+
+	/*
+	 * Iterate through each gpu power level and generate a mask for GMU
+	 * firmware for ACD enabled levels and store the corresponding control
+	 * register configurations to the acd_table structure.
+	 */
+	for (i = 0; i < pwr->num_pwrlevels; i++) {
+		if (pwrlevel->acd_level) {
+			cmd->enable_by_level |= (1 << (i + 1));
+			cmd->data[cmd_idx++] = pwrlevel->acd_level;
+		}
+		pwrlevel--;
+	}
+
+	if (!cmd->enable_by_level)
+		return 0;
+
+	cmd->num_levels = cmd_idx;
+
+	ret = a6xx_gmu_aop_messaging_init(adreno_dev, gmu);
+
+	if (ret)
+		dev_err_probe(&gmu->pdev->dev, ret,
+				"AOP messaging init failed: %d\n");
+
+	return ret == -EPROBE_DEFER ? ret: 0;
+}
+
+static int a6xx_gmu_reg_probe(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	ret = kgsl_regmap_add_region(&device->regmap, gmu->pdev,
+		"kgsl_gmu_reg", NULL, NULL);
+	if (ret)
+		dev_err(&gmu->pdev->dev, "Unable to map the GMU registers\n");
+
+	return ret;
+}
+
+static int a6xx_gmu_clk_probe(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret, i;
+	int tbl_size;
+	int num_freqs;
+	int offset;
+
+	ret = devm_clk_bulk_get_all(&gmu->pdev->dev, &gmu->clks);
+	if (ret < 0)
+		return ret;
+
+	/*
+	 * Voting for apb_pclk will enable power and clocks required for
+	 * QDSS path to function. However, if QCOM_KGSL_QDSS_STM is not enabled,
+	 * QDSS is essentially unusable. Hence, if QDSS cannot be used,
+	 * don't vote for this clock.
+	 */
+	if (!IS_ENABLED(CONFIG_QCOM_KGSL_QDSS_STM)) {
+		for (i = 0; i < ret; i++) {
+			if (!strcmp(gmu->clks[i].id, "apb_pclk")) {
+				gmu->clks[i].clk = NULL;
+				break;
+			}
+		}
+	}
+
+	gmu->num_clks = ret;
+
+	/* Read the optional list of GMU frequencies */
+	if (of_get_property(gmu->pdev->dev.of_node,
+		"qcom,gmu-freq-table", &tbl_size) == NULL)
+		goto default_gmu_freq;
+
+	num_freqs = (tbl_size / sizeof(u32)) / 2;
+	if (num_freqs != ARRAY_SIZE(gmu->freqs))
+		goto default_gmu_freq;
+
+	for (i = 0; i < num_freqs; i++) {
+		offset = i * 2;
+		ret = of_property_read_u32_index(gmu->pdev->dev.of_node,
+			"qcom,gmu-freq-table", offset, &gmu->freqs[i]);
+		if (ret)
+			goto default_gmu_freq;
+		ret = of_property_read_u32_index(gmu->pdev->dev.of_node,
+			"qcom,gmu-freq-table", offset + 1, &gmu->vlvls[i]);
+		if (ret)
+			goto default_gmu_freq;
+	}
+	return 0;
+
+default_gmu_freq:
+	/* The GMU frequency table is missing or invalid. Go with a default */
+	gmu->freqs[0] = GMU_FREQ_MIN;
+	gmu->vlvls[0] = RPMH_REGULATOR_LEVEL_MIN_SVS;
+	gmu->freqs[1] = GMU_FREQ_MAX;
+	gmu->vlvls[1] = RPMH_REGULATOR_LEVEL_SVS;
+
+	if (adreno_is_a660(adreno_dev))
+		gmu->vlvls[0] = RPMH_REGULATOR_LEVEL_LOW_SVS;
+
+	return 0;
+}
+
+static void a6xx_gmu_rdpm_probe(struct a6xx_gmu_device *gmu,
+		struct kgsl_device *device)
+{
+	struct resource *res;
+
+	res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM,
+			"rdpm_cx");
+	if (res)
+		gmu->rdpm_cx_virt = devm_ioremap(&device->pdev->dev,
+				res->start, resource_size(res));
+
+	res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM,
+			"rdpm_mx");
+	if (res)
+		gmu->rdpm_mx_virt = devm_ioremap(&device->pdev->dev,
+				res->start, resource_size(res));
+}
+
+void a6xx_gmu_remove(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	if (gmu->qmp)
+		qmp_put(gmu->qmp);
+
+	if (gmu->mailbox.channel)
+		mbox_free_channel(gmu->mailbox.channel);
+
+	adreno_dev->acd_enabled = false;
+
+	if (gmu->fw_image)
+		release_firmware(gmu->fw_image);
+
+	a6xx_free_gmu_globals(gmu);
+
+	vfree(gmu->itcm_shadow);
+
+	kobject_put(&gmu->log_kobj);
+	kobject_put(&gmu->stats_kobj);
+}
+
+static int a6xx_gmu_iommu_fault_handler(struct iommu_domain *domain,
+		struct device *dev, unsigned long addr, int flags, void *token)
+{
+	char *fault_type = "unknown";
+
+	if (flags & IOMMU_FAULT_TRANSLATION)
+		fault_type = "translation";
+	else if (flags & IOMMU_FAULT_PERMISSION)
+		fault_type = "permission";
+	else if (flags & IOMMU_FAULT_EXTERNAL)
+		fault_type = "external";
+	else if (flags & IOMMU_FAULT_TRANSACTION_STALLED)
+		fault_type = "transaction stalled";
+
+	dev_err(dev, "GMU fault addr = %lX, context=kernel (%s %s fault)\n",
+			addr,
+			(flags & IOMMU_FAULT_WRITE) ? "write" : "read",
+			fault_type);
+
+	return 0;
+}
+
+static int a6xx_gmu_iommu_init(struct a6xx_gmu_device *gmu)
+{
+	int ret;
+
+	gmu->domain = iommu_domain_alloc(&platform_bus_type);
+	if (gmu->domain == NULL) {
+		dev_err(&gmu->pdev->dev, "Unable to allocate GMU IOMMU domain\n");
+		return -ENODEV;
+	}
+
+	/*
+	 * Disable stall on fault for the GMU context bank.
+	 * This sets SCTLR.CFCFG = 0.
+	 * Also note that, the smmu driver sets SCTLR.HUPCF = 0 by default.
+	 */
+	qcom_iommu_set_fault_model(gmu->domain, QCOM_IOMMU_FAULT_MODEL_NO_STALL);
+
+	ret = iommu_attach_device(gmu->domain, &gmu->pdev->dev);
+	if (!ret) {
+		iommu_set_fault_handler(gmu->domain,
+			a6xx_gmu_iommu_fault_handler, gmu);
+		return 0;
+	}
+
+	dev_err(&gmu->pdev->dev,
+		"Unable to attach GMU IOMMU domain: %d\n", ret);
+	iommu_domain_free(gmu->domain);
+	gmu->domain = NULL;
+
+	return ret;
+}
+
+int a6xx_gmu_probe(struct kgsl_device *device,
+		struct platform_device *pdev)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct device *dev = &pdev->dev;
+	struct resource *res;
+	int ret;
+
+	gmu->pdev = pdev;
+
+	dma_set_coherent_mask(&gmu->pdev->dev, DMA_BIT_MASK(64));
+	gmu->pdev->dev.dma_mask = &gmu->pdev->dev.coherent_dma_mask;
+	set_dma_ops(&gmu->pdev->dev, NULL);
+
+	res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM,
+						"rscc");
+	if (res) {
+		gmu->rscc_virt = devm_ioremap(&device->pdev->dev, res->start,
+						resource_size(res));
+		if (gmu->rscc_virt == NULL) {
+			dev_err(&gmu->pdev->dev, "rscc ioremap failed\n");
+			return -ENOMEM;
+		}
+	}
+
+	/* Setup any rdpm register ranges */
+	a6xx_gmu_rdpm_probe(gmu, device);
+
+	/* Set up GMU gdscs */
+	ret = kgsl_pwrctrl_probe_gdscs(device, pdev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gmu_clk_probe(adreno_dev);
+	if (ret < 0)
+		return ret;
+
+	/* Set up GMU IOMMU and shared memory with GMU */
+	ret = a6xx_gmu_iommu_init(gmu);
+	if (ret)
+		goto error;
+
+	if (adreno_is_a650_family(adreno_dev))
+		gmu->vma = a6xx_gmu_vma;
+	else
+		gmu->vma = a6xx_gmu_vma_legacy;
+
+	/* Map and reserve GMU CSRs registers */
+	ret = a6xx_gmu_reg_probe(adreno_dev);
+	if (ret)
+		goto error;
+
+	/* Populates RPMh configurations */
+	ret = a6xx_build_rpmh_tables(adreno_dev);
+	if (ret)
+		goto error;
+
+	/* Set up GMU idle state */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_IFPC)) {
+		gmu->idle_level = GPU_HW_IFPC;
+		adreno_dev->ifpc_hyst = A6X_GMU_LONG_IFPC_HYST;
+		adreno_dev->ifpc_hyst_floor = A6X_GMU_LONG_IFPC_HYST_FLOOR;
+	} else {
+		gmu->idle_level = GPU_HW_ACTIVE;
+	}
+
+	ret = a6xx_gmu_acd_probe(device, gmu, pdev->dev.of_node);
+	if (ret)
+		goto error;
+
+	set_bit(GMU_ENABLED, &device->gmu_core.flags);
+
+	/* Initialize to zero to detect trace packet loss */
+	gmu->trace.seq_num = 0;
+
+	device->gmu_core.dev_ops = &a6xx_gmudev;
+
+	/* Set default GMU attributes */
+	gmu->log_stream_enable = false;
+	gmu->log_group_mask = 0x3;
+
+	/* Disabled by default */
+	gmu->stats_enable = false;
+	/* Set default to CM3 busy cycles countable */
+	gmu->stats_mask = BIT(A6XX_GMU_CM3_BUSY_CYCLES);
+	/* Interval is in 50 us units. Set default sampling frequency to 4x50 us */
+	gmu->stats_interval = HFI_FEATURE_GMU_STATS_INTERVAL;
+
+	/* GMU sysfs nodes setup */
+	(void) kobject_init_and_add(&gmu->log_kobj, &log_kobj_type, &dev->kobj, "log");
+	(void) kobject_init_and_add(&gmu->stats_kobj, &stats_kobj_type, &dev->kobj, "stats");
+
+	of_property_read_u32(gmu->pdev->dev.of_node, "qcom,gmu-perf-ddr-bw",
+		&gmu->perf_ddr_bw);
+
+	gmu->irq = kgsl_request_irq(gmu->pdev, "kgsl_gmu_irq",
+		a6xx_gmu_irq_handler, device);
+
+	if (gmu->irq >= 0)
+		return 0;
+
+	ret = gmu->irq;
+
+error:
+	a6xx_gmu_remove(device);
+	return ret;
+}
+
+static void a6xx_gmu_active_count_put(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (WARN(atomic_read(&device->active_cnt) == 0,
+		"Unbalanced get/put calls to KGSL active count\n"))
+		return;
+
+	if (atomic_dec_and_test(&device->active_cnt)) {
+		kgsl_pwrscale_update_stats(device);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+	}
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	wake_up(&device->active_cnt_wq);
+}
+
+int a6xx_halt_gbif(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/* Halt new client requests */
+	kgsl_regwrite(device, A6XX_GBIF_HALT, A6XX_GBIF_CLIENT_HALT_MASK);
+	ret = adreno_wait_for_halt_ack(device,
+		A6XX_GBIF_HALT_ACK, A6XX_GBIF_CLIENT_HALT_MASK);
+
+	/* Halt all AXI requests */
+	kgsl_regwrite(device, A6XX_GBIF_HALT, A6XX_GBIF_ARB_HALT_MASK);
+	ret = adreno_wait_for_halt_ack(device,
+		A6XX_GBIF_HALT_ACK, A6XX_GBIF_ARB_HALT_MASK);
+
+	return ret;
+}
+
+#define RPMH_VOTE_TIMEOUT		2 /* ms */
+
+static int a6xx_gmu_power_off(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = 0;
+
+	if (device->gmu_fault)
+		goto error;
+
+	/* Wait for the lowest idle level we requested */
+	ret = a6xx_gmu_wait_for_lowest_idle(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = a6xx_complete_rpmh_votes(adreno_dev, RPMH_VOTE_TIMEOUT);
+	if (ret)
+		goto error;
+
+	ret = a6xx_gmu_notify_slumber(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = a6xx_gmu_wait_for_idle(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = a6xx_rscc_sleep_sequence(adreno_dev);
+
+	a6xx_rdpm_mx_freq_update(gmu, 0);
+
+	/* Now that we are done with GMU and GPU, Clear the GBIF */
+	if (!adreno_is_a630(adreno_dev)) {
+		ret = a6xx_halt_gbif(adreno_dev);
+		/* De-assert the halts */
+		kgsl_regwrite(device, A6XX_GBIF_HALT, 0x0);
+	}
+
+	a6xx_gmu_irq_disable(adreno_dev);
+
+	a6xx_hfi_stop(adreno_dev);
+
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+	a6xx_gmu_disable_gdsc(adreno_dev);
+
+	a6xx_rdpm_cx_freq_update(gmu, 0);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_NONE);
+
+	return ret;
+
+error:
+	a6xx_gmu_irq_disable(adreno_dev);
+	a6xx_hfi_stop(adreno_dev);
+	a6xx_gmu_suspend(adreno_dev);
+
+	return ret;
+}
+
+void a6xx_enable_gpu_irq(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	kgsl_pwrctrl_irq(device, true);
+
+	adreno_irqctrl(adreno_dev, 1);
+}
+
+void a6xx_disable_gpu_irq(struct adreno_device *adreno_dev)
+{
+	kgsl_pwrctrl_irq(KGSL_DEVICE(adreno_dev), false);
+
+	if (a6xx_gmu_gx_is_on(adreno_dev))
+		adreno_irqctrl(adreno_dev, 0);
+
+}
+
+static void a6xx_fusa_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	void __iomem *fusa_virt = NULL;
+	struct resource *res;
+
+	if (!(adreno_is_a663(adreno_dev) || adreno_is_a623(adreno_dev)))
+		return;
+
+	res = platform_get_resource_byname(device->pdev,
+			IORESOURCE_MEM, "fusa");
+	if (res)
+		fusa_virt = ioremap(res->start, resource_size(res));
+
+	if (!fusa_virt) {
+		dev_err(device->dev, "Failed to map fusa\n");
+		return;
+	}
+
+	/* Disable fusa mode in boot stage */
+	_regrmw(fusa_virt, A6XX_GPU_FUSA_REG_ECC_CTRL - A6XX_GPU_FUSA_REG_BASE,
+			A6XX_GPU_FUSA_DISABLE_MASK, A6XX_GPU_FUSA_DISABLE_BITS);
+	_regrmw(fusa_virt, A6XX_GPU_FUSA_REG_CSR_PRIY - A6XX_GPU_FUSA_REG_BASE,
+			A6XX_GPU_FUSA_DISABLE_MASK, A6XX_GPU_FUSA_DISABLE_BITS);
+
+	iounmap(fusa_virt);
+}
+
+static int a6xx_gpu_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/* Clear any GPU faults that might have been left over */
+	adreno_clear_gpu_fault(adreno_dev);
+
+	adreno_set_active_ctxs_null(adreno_dev);
+
+	ret = kgsl_mmu_start(device);
+	if (ret)
+		goto err;
+
+	ret = a6xx_gmu_oob_set(device, oob_gpu);
+	if (ret)
+		goto oob_clear;
+
+	ret = a6xx_gmu_hfi_start_msg(adreno_dev);
+	if (ret)
+		goto oob_clear;
+
+	/* Clear the busy_data stats - we're starting over from scratch */
+	memset(&adreno_dev->busy_data, 0, sizeof(adreno_dev->busy_data));
+
+	/* Restore performance counter registers with saved values */
+	adreno_perfcounter_restore(adreno_dev);
+
+	a6xx_start(adreno_dev);
+
+	/* Re-initialize the coresight registers if applicable */
+	adreno_coresight_start(adreno_dev);
+
+	adreno_perfcounter_start(adreno_dev);
+
+	/* Clear FSR here in case it is set from a previous pagefault */
+	kgsl_mmu_clear_fsr(&device->mmu);
+
+	a6xx_enable_gpu_irq(adreno_dev);
+
+	ret = a6xx_rb_start(adreno_dev);
+	if (ret) {
+		a6xx_disable_gpu_irq(adreno_dev);
+		goto oob_clear;
+	}
+
+	/*
+	 * At this point it is safe to assume that we recovered. Setting
+	 * this field allows us to take a new snapshot for the next failure
+	 * if we are prioritizing the first unrecoverable snapshot.
+	 */
+	if (device->snapshot)
+		device->snapshot->recovered = true;
+
+	/* Start the dispatcher */
+	adreno_dispatcher_start(device);
+
+	device->reset_counter++;
+
+	a6xx_gmu_oob_clear(device, oob_gpu);
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_HFI_USE_REG))
+		gmu_core_dev_oob_clear(device, oob_boot_slumber);
+
+	return 0;
+
+oob_clear:
+	a6xx_gmu_oob_clear(device, oob_gpu);
+
+	if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_HFI_USE_REG))
+		gmu_core_dev_oob_clear(device, oob_boot_slumber);
+
+err:
+	a6xx_gmu_power_off(adreno_dev);
+
+	return ret;
+}
+
+static void gmu_idle_timer(struct timer_list *t)
+{
+	struct kgsl_device *device = container_of(t, struct kgsl_device,
+					idle_timer);
+
+	kgsl_schedule_work(&device->idle_check_ws);
+}
+
+static int a6xx_boot(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (WARN_ON(test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags)))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	if (IS_ENABLED(CONFIG_QCOM_KGSL_HIBERNATION) &&
+		!test_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags))
+		ret = a6xx_gmu_first_boot(adreno_dev);
+	else
+		ret = a6xx_gmu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_start_idle_timer(device);
+
+	kgsl_pwrscale_wake(device);
+
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	return ret;
+}
+
+static int a6xx_first_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags)) {
+		if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+			return a6xx_boot(adreno_dev);
+
+		return 0;
+	}
+
+	KGSL_BOOT_MARKER("ADRENO Init");
+
+	ret = a6xx_ringbuffer_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_microcode_read(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gmu_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = a6xx_gmu_first_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	a6xx_fusa_init(adreno_dev);
+
+	ret = a6xx_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	adreno_get_bus_counters(adreno_dev);
+
+	adreno_dev->cooperative_reset = ADRENO_FEATURE(adreno_dev,
+						 ADRENO_COOP_RESET);
+
+	adreno_create_profile_buffer(adreno_dev);
+
+	set_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags);
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	/*
+	 * BCL needs respective Central Broadcast register to
+	 * be programed from TZ. This programing happens only
+	 * when zap shader firmware load is successful. Zap firmware
+	 * load can fail in boot up path hence enable BCL only after we
+	 * successfully complete first boot to ensure that Central
+	 * Broadcast register was programed before enabling BCL.
+	 */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_BCL))
+		adreno_dev->bcl_enabled = true;
+
+	/*
+	 * There is a possible deadlock scenario during kgsl firmware reading
+	 * (request_firmware) and devfreq update calls. During first boot, kgsl
+	 * device mutex is held and then request_firmware is called for reading
+	 * firmware. request_firmware internally takes dev_pm_qos_mtx lock.
+	 * Whereas in case of devfreq update calls triggered by thermal/bcl or
+	 * devfreq sysfs, it first takes the same dev_pm_qos_mtx lock and then
+	 * tries to take kgsl device mutex as part of get_dev_status/target
+	 * calls. This results in deadlock when both thread are unable to acquire
+	 * the mutex held by other thread. Enable devfreq updates now as we are
+	 * done reading all firmware files.
+	 */
+	device->pwrscale.devfreq_enabled = true;
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	KGSL_BOOT_MARKER("ADRENO Ready");
+
+	return 0;
+}
+
+static int a630_vbif_halt(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	kgsl_regwrite(device, A6XX_VBIF_XIN_HALT_CTRL0,
+		A6XX_VBIF_XIN_HALT_CTRL0_MASK);
+	ret = adreno_wait_for_halt_ack(device,
+			A6XX_VBIF_XIN_HALT_CTRL1,
+			A6XX_VBIF_XIN_HALT_CTRL0_MASK);
+	kgsl_regwrite(device, A6XX_VBIF_XIN_HALT_CTRL0, 0);
+
+	return ret;
+}
+
+static int a6xx_power_off(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	WARN_ON(!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags));
+
+	adreno_suspend_context(device);
+
+	/*
+	 * adreno_suspend_context() unlocks the device mutex, which
+	 * could allow a concurrent thread to attempt SLUMBER sequence.
+	 * Hence, check the flags again before proceeding with SLUMBER.
+	 */
+	if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SLUMBER);
+
+	ret = a6xx_gmu_oob_set(device, oob_gpu);
+	if (ret) {
+		a6xx_gmu_oob_clear(device, oob_gpu);
+		goto no_gx_power;
+	}
+
+	if (a6xx_irq_pending(adreno_dev)) {
+		a6xx_gmu_oob_clear(device, oob_gpu);
+		return -EBUSY;
+	}
+
+	kgsl_pwrscale_update_stats(device);
+
+	/* Save active coresight registers if applicable */
+	adreno_coresight_stop(adreno_dev);
+
+	/* Save physical performance counter values before GPU power down*/
+	adreno_perfcounter_save(adreno_dev);
+
+	/*
+	 * Clear GX halt on non-gbif targets. For targets with GBIF,
+	 * GX halt is handled by the GMU FW.
+	 */
+	if (adreno_is_a630(adreno_dev))
+		a630_vbif_halt(adreno_dev);
+
+	adreno_irqctrl(adreno_dev, 0);
+
+	a6xx_gmu_oob_clear(device, oob_gpu);
+
+no_gx_power:
+	kgsl_pwrctrl_irq(device, false);
+
+	a6xx_gmu_power_off(adreno_dev);
+
+	adreno_set_active_ctxs_null(adreno_dev);
+
+	adreno_dispatcher_stop(adreno_dev);
+
+	adreno_ringbuffer_stop(adreno_dev);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpu_llc_slice);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpuhtw_llc_slice);
+
+	clear_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	del_timer_sync(&device->idle_timer);
+
+	kgsl_pwrscale_sleep(device);
+
+	kgsl_pwrctrl_clear_l3_vote(device);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SLUMBER);
+
+	return ret;
+}
+
+static void gmu_idle_check(struct work_struct *work)
+{
+	struct kgsl_device *device = container_of(work,
+					struct kgsl_device, idle_check_ws);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	mutex_lock(&device->mutex);
+
+	if (test_bit(GMU_DISABLE_SLUMBER, &device->gmu_core.flags))
+		goto done;
+
+	if (atomic_read(&device->active_cnt) || time_is_after_jiffies(device->idle_jiffies)) {
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		goto done;
+
+	spin_lock(&device->submit_lock);
+
+	if (device->submit_now) {
+		spin_unlock(&device->submit_lock);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	device->skip_inline_submit = true;
+	spin_unlock(&device->submit_lock);
+
+	ret = a6xx_power_off(adreno_dev);
+	if (ret == -EBUSY) {
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+	}
+
+done:
+	mutex_unlock(&device->mutex);
+}
+
+static int a6xx_gmu_first_open(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/*
+	 * Do the one time settings that need to happen when we
+	 * attempt to boot the gpu the very first time
+	 */
+	ret = a6xx_first_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	/*
+	 * A client that does a first_open but never closes the device
+	 * may prevent us from going back to SLUMBER. So trigger the idle
+	 * check by incrementing the active count and immediately releasing it.
+	 */
+	atomic_inc(&device->active_cnt);
+	a6xx_gmu_active_count_put(adreno_dev);
+
+	return 0;
+}
+
+static int a6xx_gmu_last_close(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return a6xx_power_off(adreno_dev);
+
+	return 0;
+}
+
+static int a6xx_gmu_active_count_get(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret = 0;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EINVAL;
+
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags))
+		return -EINVAL;
+
+	if ((atomic_read(&device->active_cnt) == 0) &&
+		!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		ret = a6xx_boot(adreno_dev);
+
+	if (ret == 0)
+		atomic_inc(&device->active_cnt);
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	return ret;
+}
+
+static int a6xx_gmu_pm_suspend(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SUSPEND);
+
+	/* Halt any new submissions */
+	reinit_completion(&device->halt_gate);
+
+	/* wait for active count so device can be put in slumber */
+	ret = kgsl_active_count_wait(device, 0, HZ);
+	if (ret) {
+		dev_err(device->dev,
+			"Timed out waiting for the active count\n");
+		goto err;
+	}
+
+	ret = adreno_idle(device);
+	if (ret)
+		goto err;
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		a6xx_power_off(adreno_dev);
+
+	set_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags);
+
+	adreno_get_gpu_halt(adreno_dev);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SUSPEND);
+
+	return 0;
+err:
+	adreno_dispatcher_start(device);
+	return ret;
+}
+
+static void a6xx_gmu_pm_resume(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	if (WARN(!test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags),
+		"resume invoked without a suspend\n"))
+		return;
+
+	adreno_put_gpu_halt(adreno_dev);
+
+	adreno_dispatcher_start(device);
+
+	clear_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags);
+}
+
+static void a6xx_gmu_touch_wakeup(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	/*
+	 * Do not wake up a suspended device or until the first boot sequence
+	 * has been completed.
+	 */
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags) ||
+		!test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags))
+		return;
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		goto done;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = a6xx_gmu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	ret = a6xx_gpu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	kgsl_pwrscale_wake(device);
+
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+done:
+	/*
+	 * When waking up from a touch event we want to stay active long enough
+	 * for the user to send a draw command.  The default idle timer timeout
+	 * is shorter than we want so go ahead and push the idle timer out
+	 * further for this special case
+	 */
+	mod_timer(&device->idle_timer, jiffies +
+			msecs_to_jiffies(adreno_wake_timeout));
+
+}
+
+const struct adreno_power_ops a6xx_gmu_power_ops = {
+	.first_open = a6xx_gmu_first_open,
+	.last_close = a6xx_gmu_last_close,
+	.active_count_get = a6xx_gmu_active_count_get,
+	.active_count_put = a6xx_gmu_active_count_put,
+	.pm_suspend = a6xx_gmu_pm_suspend,
+	.pm_resume = a6xx_gmu_pm_resume,
+	.touch_wakeup = a6xx_gmu_touch_wakeup,
+	.gpu_clock_set = a6xx_gmu_clock_set,
+	.gpu_bus_set = a6xx_gmu_bus_set,
+};
+
+const struct adreno_power_ops a630_gmu_power_ops = {
+	.first_open = a6xx_gmu_first_open,
+	.last_close = a6xx_gmu_last_close,
+	.active_count_get = a6xx_gmu_active_count_get,
+	.active_count_put = a6xx_gmu_active_count_put,
+	.pm_suspend = a6xx_gmu_pm_suspend,
+	.pm_resume = a6xx_gmu_pm_resume,
+	.touch_wakeup = a6xx_gmu_touch_wakeup,
+	.gpu_clock_set = a6xx_gmu_clock_set,
+};
+
+int a6xx_gmu_device_probe(struct platform_device *pdev,
+	u32 chipid, const struct adreno_gpu_core *gpucore)
+{
+	struct adreno_device *adreno_dev;
+	struct kgsl_device *device;
+	struct a6xx_device *a6xx_dev;
+	int ret;
+
+	a6xx_dev = devm_kzalloc(&pdev->dev, sizeof(*a6xx_dev),
+			GFP_KERNEL);
+	if (!a6xx_dev)
+		return -ENOMEM;
+
+	adreno_dev = &a6xx_dev->adreno_dev;
+
+	ret = a6xx_probe_common(pdev, adreno_dev, chipid, gpucore);
+	if (ret)
+		return ret;
+
+	ret = adreno_dispatcher_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	device = KGSL_DEVICE(adreno_dev);
+
+	INIT_WORK(&device->idle_check_ws, gmu_idle_check);
+
+	timer_setup(&device->idle_timer, gmu_idle_timer, 0);
+
+	adreno_dev->irq_mask = A6XX_INT_MASK;
+
+	return 0;
+}
+
+int a6xx_gmu_reset(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	a6xx_disable_gpu_irq(adreno_dev);
+
+	a6xx_gmu_irq_disable(adreno_dev);
+
+	a6xx_hfi_stop(adreno_dev);
+
+	/* Hard reset the gmu and gpu */
+	a6xx_gmu_suspend(adreno_dev);
+
+	a6xx_reset_preempt_records(adreno_dev);
+
+	clear_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	/* Attempt to reboot the gmu and gpu */
+	return a6xx_boot(adreno_dev);
+}
+
+int a6xx_gmu_hfi_probe(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hfi *hfi = &gmu->hfi;
+
+	hfi->irq = kgsl_request_irq(gmu->pdev, "kgsl_hfi_irq",
+		a6xx_hfi_irq_handler, KGSL_DEVICE(adreno_dev));
+
+	return hfi->irq < 0 ? hfi->irq : 0;
+}
+
+int a6xx_gmu_add_to_minidump(struct adreno_device *adreno_dev)
+{
+	struct a6xx_device *a6xx_dev = container_of(adreno_dev,
+					struct a6xx_device, adreno_dev);
+	int ret;
+
+	ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_A6XX_DEVICE,
+			(void *)(a6xx_dev), sizeof(struct a6xx_device));
+	if (ret)
+		return ret;
+
+	ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_GMU_LOG_ENTRY,
+			a6xx_dev->gmu.gmu_log->hostptr, a6xx_dev->gmu.gmu_log->size);
+	if (ret)
+		return ret;
+
+	ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_HFIMEM_ENTRY,
+			a6xx_dev->gmu.hfi.hfi_mem->hostptr, a6xx_dev->gmu.hfi.hfi_mem->size);
+	if (ret)
+		return ret;
+
+	if (adreno_is_a630(adreno_dev) || adreno_is_a615_family(adreno_dev))
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_GMU_DUMPMEM_ENTRY,
+				a6xx_dev->gmu.dump_mem->hostptr, a6xx_dev->gmu.dump_mem->size);
+
+	return ret;
+}
+
+static int a6xx_gmu_bind(struct device *dev, struct device *master, void *data)
+{
+	struct kgsl_device *device = dev_get_drvdata(master);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	const struct a6xx_gpudev *a6xx_gpudev = to_a6xx_gpudev(gpudev);
+	int ret;
+
+	ret = a6xx_gmu_probe(device, to_platform_device(dev));
+	if (ret)
+		return ret;
+
+	if (a6xx_gpudev->hfi_probe) {
+		ret = a6xx_gpudev->hfi_probe(adreno_dev);
+
+		if (ret) {
+			a6xx_gmu_remove(device);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+static void a6xx_gmu_unbind(struct device *dev, struct device *master,
+		void *data)
+{
+	struct kgsl_device *device = dev_get_drvdata(master);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	const struct a6xx_gpudev *a6xx_gpudev = to_a6xx_gpudev(gpudev);
+
+	if (a6xx_gpudev->hfi_remove)
+		a6xx_gpudev->hfi_remove(adreno_dev);
+
+	a6xx_gmu_remove(device);
+}
+
+static const struct component_ops a6xx_gmu_component_ops = {
+	.bind = a6xx_gmu_bind,
+	.unbind = a6xx_gmu_unbind,
+};
+
+static int a6xx_gmu_probe_dev(struct platform_device *pdev)
+{
+	return component_add(&pdev->dev, &a6xx_gmu_component_ops);
+}
+
+static int a6xx_gmu_remove_dev(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &a6xx_gmu_component_ops);
+	return 0;
+}
+
+static const struct of_device_id a6xx_gmu_match_table[] = {
+	{ .compatible = "qcom,gpu-gmu" },
+	{ },
+};
+
+struct platform_driver a6xx_gmu_driver = {
+	.probe = a6xx_gmu_probe_dev,
+	.remove = a6xx_gmu_remove_dev,
+	.driver = {
+		.name = "adreno-a6xx-gmu",
+		.of_match_table = a6xx_gmu_match_table,
+	},
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_gmu.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_gmu.h
@@ -0,0 +1,454 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_A6XX_GMU_H
+#define __ADRENO_A6XX_GMU_H
+
+#include <linux/mailbox_client.h>
+#include <linux/soc/qcom/qcom_aoss.h>
+
+#include "adreno_a6xx_hfi.h"
+#include "kgsl_gmu_core.h"
+
+/**
+ * struct a6xx_gmu_device - GMU device structure
+ * @ver: GMU Version information
+ * @irq: GMU interrupt number
+ * @fw_image: GMU FW image
+ * @hfi_mem: pointer to HFI shared memory
+ * @dump_mem: pointer to GMU debug dump memory
+ * @gmu_log: gmu event log memory
+ * @hfi: HFI controller
+ * @num_gpupwrlevels: number GPU frequencies in GPU freq table
+ * @num_bwlevel: number of GPU BW levels
+ * @num_cnocbwlevel: number CNOC BW levels
+ * @rpmh_votes: RPMh TCS command set for GPU, GMU voltage and bw scaling
+ * @clks: GPU subsystem clocks required for GMU functionality
+ * @wakeup_pwrlevel: GPU wake up power/DCVS level in case different
+ *		than default power level
+ * @idle_level: Minimal GPU idle power level
+ * @fault_count: GMU fault count
+ * @mailbox: Messages to AOP for ACD enable/disable go through this
+ * @log_wptr_retention: Store the log wptr offset on slumber
+ */
+struct a6xx_gmu_device {
+	struct {
+		u32 core;
+		u32 core_dev;
+		u32 pwr;
+		u32 pwr_dev;
+		u32 hfi;
+	} ver;
+	struct platform_device *pdev;
+	int irq;
+	const struct firmware *fw_image;
+	struct kgsl_memdesc *dump_mem;
+	struct kgsl_memdesc *gmu_log;
+	/** @vrb: GMU virtual register bank memory */
+	struct kgsl_memdesc *vrb;
+	/** @trace: gmu trace container */
+	struct kgsl_gmu_trace trace;
+	struct a6xx_hfi hfi;
+	struct clk_bulk_data *clks;
+	/** @num_clks: Number of entries in the @clks array */
+	int num_clks;
+	unsigned int idle_level;
+	/** @freqs: Array of GMU frequencies */
+	u32 freqs[GMU_MAX_PWRLEVELS];
+	/** @vlvls: Array of GMU voltage levels */
+	u32 vlvls[GMU_MAX_PWRLEVELS];
+	/** @qmp: Pointer to qmp sturct used for AOP messages*/
+	struct qmp *qmp;
+	struct kgsl_mailbox mailbox;
+	bool preallocations;
+	/** @gmu_globals: Array to store gmu global buffers */
+	struct kgsl_memdesc gmu_globals[GMU_KERNEL_ENTRIES];
+	/** @global_entries: To keep track of number of gmu buffers */
+	u32 global_entries;
+	struct gmu_vma_entry *vma;
+	unsigned int log_wptr_retention;
+	/** @cm3_fault: whether gmu received a cm3 fault interrupt */
+	atomic_t cm3_fault;
+	/**
+	 * @itcm_shadow: Copy of the itcm block in firmware binary used for
+	 * snapshot
+	 */
+	void *itcm_shadow;
+	/** @flags: Internal gmu flags */
+	unsigned long flags;
+	/** @rscc_virt: Pointer where RSCC block is mapped */
+	void __iomem *rscc_virt;
+	/** @domain: IOMMU domain for the kernel context */
+	struct iommu_domain *domain;
+	/** @rdpm_cx_virt: Pointer where the RDPM CX block is mapped */
+	void __iomem *rdpm_cx_virt;
+	/** @rdpm_mx_virt: Pointer where the RDPM MX block is mapped */
+	void __iomem *rdpm_mx_virt;
+	/** @log_stream_enable: GMU log streaming enable. Disabled by default */
+	bool log_stream_enable;
+	/** @log_group_mask: Allows overriding default GMU log group mask */
+	u32 log_group_mask;
+	struct kobject log_kobj;
+	/*
+	 * @perf_ddr_bw: The lowest ddr bandwidth that puts CX at a corner at
+	 * which GMU can run at higher frequency.
+	 */
+	u32 perf_ddr_bw;
+	/** @num_oob_perfcntr: Number of active oob_perfcntr requests */
+	u32 num_oob_perfcntr;
+	/** @pdc_cfg_base: Base address of PDC cfg registers */
+	void __iomem *pdc_cfg_base;
+	/** @pdc_seq_base: Base address of PDC seq registers */
+	void __iomem *pdc_seq_base;
+	/** @stats_enable: GMU stats feature enable */
+	bool stats_enable;
+	/** @stats_mask: GMU performance countables to enable */
+	u32 stats_mask;
+	/** @stats_interval: GMU performance counters sampling interval */
+	u32 stats_interval;
+	/** @stats_kobj: kernel object for GMU stats directory in sysfs */
+	struct kobject stats_kobj;
+};
+
+/* Helper function to get to a6xx gmu device from adreno device */
+struct a6xx_gmu_device *to_a6xx_gmu(struct adreno_device *adreno_dev);
+
+/* Helper function to get to adreno device from a6xx gmu device */
+struct adreno_device *a6xx_gmu_to_adreno(struct a6xx_gmu_device *gmu);
+
+/**
+ * reserve_gmu_kernel_block() - Allocate a gmu buffer
+ * @gmu: Pointer to the a6xx gmu device
+ * @addr: Desired gmu virtual address
+ * @size: Size of the buffer in bytes
+ * @vma_id: Target gmu vma where this bufer should be mapped
+ * @va_align: Alignment as a power of two(2^n) bytes for the GMU VA
+ *
+ * This function allocates a buffer and maps it in
+ * the desired gmu vma
+ *
+ * Return: Pointer to the memory descriptor or error pointer on failure
+ */
+struct kgsl_memdesc *reserve_gmu_kernel_block(struct a6xx_gmu_device *gmu,
+	u32 addr, u32 size, u32 vma_id, u32 va_align);
+
+/**
+ * reserve_gmu_kernel_block_fixed() - Maps phyical resource address to gmu
+ * @gmu: Pointer to the a6xx gmu device
+ * @addr: Desired gmu virtual address
+ * @size: Size of the buffer in bytes
+ * @vma_id: Target gmu vma where this buffer should be mapped
+ * @resource: Name of the resource to get the size and address to allocate
+ * @attrs: Attributes for the mapping
+ * @va_align: Alignment as a power of two(2^n) bytes for the GMU VA
+ *
+ * This function maps the physcial resource address to desired gmu vma
+ *
+ * Return: Pointer to the memory descriptor or error pointer on failure
+ */
+struct kgsl_memdesc *reserve_gmu_kernel_block_fixed(struct a6xx_gmu_device *gmu,
+	u32 addr, u32 size, u32 vma_id, const char *resource, int attrs, u32 va_align);
+
+/**
+ * a6xx_build_rpmh_tables - Build the rpmh tables
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function creates the gpu dcvs and bw tables
+ *
+ * Return: 0 on success and negative error on failure
+ */
+int a6xx_build_rpmh_tables(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_gx_is_on - Check if GX is on
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function reads pwr status registers to check if GX
+ * is on or off
+ */
+bool a6xx_gmu_gx_is_on(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_device_snapshot - A6XX GMU snapshot function
+ * @device: Device being snapshotted
+ * @snapshot: Pointer to the snapshot instance
+ *
+ * This is where all of the A6XX GMU specific bits and pieces are grabbed
+ * into the snapshot memory
+ */
+void a6xx_gmu_device_snapshot(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot);
+
+/**
+ * a6xx_gmu_device_probe - A6XX GMU snapshot function
+ * @pdev: Pointer to the platform device
+ * @chipid: Chipid of the target
+ * @gpucore: Pointer to the gpucore
+ *
+ * The target specific probe function for gmu based a6xx targets.
+ */
+int a6xx_gmu_device_probe(struct platform_device *pdev,
+	u32 chipid, const struct adreno_gpu_core *gpucore);
+
+/**
+ * a6xx_gmu_reset - Reset and restart the gmu
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_reset(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_enable_gpu_irq - Enable gpu interrupt
+ * @adreno_dev: Pointer to the adreno device
+ */
+void a6xx_enable_gpu_irq(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_disable_gpu_irq - Disable gpu interrupt
+ * @adreno_dev: Pointer to the adreno device
+ */
+void a6xx_disable_gpu_irq(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_snapshot- Take snapshot for gmu targets
+ * @adreno_dev: Pointer to the adreno device
+ * @snapshot: Pointer to the snapshot structure
+ *
+ * Send an NMI to gmu if we hit a gmu fault. Then take gmu
+ * snapshot and carry on with rest of the a6xx snapshot
+ */
+void a6xx_gmu_snapshot(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot);
+
+/**
+ * a6xx_gmu_probe - Probe a6xx gmu resources
+ * @device: Pointer to the kgsl device
+ * @pdev: Pointer to the gmu platform device
+ *
+ * Probe the gmu and hfi resources
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_probe(struct kgsl_device *device,
+	struct platform_device *pdev);
+
+/**
+ * a6xx_gmu_parse_fw - Parse the gmu fw binary
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_parse_fw(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_memory_init - Allocate gmu memory
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Allocates the gmu log buffer and others if ndeeded.
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_memory_init(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_aop_send_acd_state - Enable or disable acd feature in aop
+ * @gmu: Pointer to the a6xx gmu device
+ * @flag: Boolean to enable or disable acd in aop
+ *
+ * This function enables or disables gpu acd feature using mailbox or qmp
+ */
+void a6xx_gmu_aop_send_acd_state(struct a6xx_gmu_device *gmu, bool flag);
+
+/**
+ * a6xx_gmu_disable_gdsc - Disable gmu gdsc
+ * @adreno_dev: Pointer to the adreno device
+ */
+void a6xx_gmu_disable_gdsc(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_load_fw - Load gmu firmware
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Loads the gmu firmware binary into TCMs and memory
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_load_fw(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_device_start - Bring gmu out of reset
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_device_start(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_hfi_start - Indicate hfi start to gmu
+ * @device: Pointer to the kgsl device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_hfi_start(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_itcm_shadow - Create itcm shadow copy for snapshot
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_itcm_shadow(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_register_config - gmu register configuration
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Program gmu regsiters based on features
+ */
+void a6xx_gmu_register_config(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_version_info - Get gmu firmware version
+ * @adreno_dev: Pointer to the adreno device
+ */
+void a6xx_gmu_version_info(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_irq_enable - Enable gmu interrupts
+ * @adreno_dev: Pointer to the adreno device
+ */
+void a6xx_gmu_irq_enable(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_irq_disable - Disaable gmu interrupts
+ * @adreno_dev: Pointer to the adreno device
+ */
+void a6xx_gmu_irq_disable(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_suspend - Hard reset the gpu and gmu
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * In case we hit a gmu fault, hard reset the gpu and gmu
+ * to recover from the fault
+ */
+void a6xx_gmu_suspend(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_oob_set - send gmu oob request
+ * @device: Pointer to the kgsl device
+ * @req: Type of oob request as defined in enum oob_request
+ *
+ * Request gmu to keep gpu powered up till the oob is cleared
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_oob_set(struct kgsl_device *device, enum oob_request oob);
+
+/**
+ * a6xx_gmu_oob_clear - clear an asserted oob request
+ * @device: Pointer to the kgsl device
+ * @req: Type of oob request as defined in enum oob_request
+ *
+ * Clear a previously requested oob so that gmu can power
+ * collapse the gpu
+ */
+void a6xx_gmu_oob_clear(struct kgsl_device *device, enum oob_request oob);
+
+/**
+ * a6xx_gmu_wait_for_lowest_idle - wait for gmu to complete ifpc
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * If ifpc is enabled, wait for gmu to put gpu into ifpc.
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_wait_for_lowest_idle(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_wait_for_idle - Wait for gmu to become idle
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_wait_for_idle(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_rscc_sleep_sequence - Trigger rscc sleep sequence
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_rscc_sleep_sequence(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_rscc_wakeup_sequence - Trigger rscc wakeup sequence
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_rscc_wakeup_sequence(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_halt_gbif - Halt CX and GX requests in GBIF
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Clear any pending GX or CX transactions in GBIF and
+ * deassert GBIF halt
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_halt_gbif(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_load_pdc_ucode - Load and enable pdc sequence
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_load_pdc_ucode(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_load_rsc_ucode - Load rscc sequence
+ * @adreno_dev: Pointer to the adreno device
+ */
+void a6xx_load_rsc_ucode(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_remove - Clean up gmu probed resources
+ * @device: Pointer to the kgsl device
+ */
+void a6xx_gmu_remove(struct kgsl_device *device);
+
+/**
+ * a6xx_gmu_enable_clks - Enable gmu clocks
+ * @adreno_dev: Pointer to the adreno device
+ * @level: GMU frequency level
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_gmu_enable_clks(struct adreno_device *adreno_dev, u32 level);
+
+/**
+ * a6xx_gmu_handle_watchdog - Handle watchdog interrupt
+ * @adreno_dev: Pointer to the adreno device
+ */
+void a6xx_gmu_handle_watchdog(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_gmu_send_nmi - Send NMI to GMU
+ * @device: Pointer to the kgsl device
+ * @force: Boolean to forcefully send NMI irrespective of GMU state
+ */
+void a6xx_gmu_send_nmi(struct kgsl_device *device, bool force);
+
+/**
+ * a6xx_gmu_add_to_minidump - Register a6xx_device with va minidump
+ * @adreno_dev: Pointer to the adreno device
+ */
+int a6xx_gmu_add_to_minidump(struct adreno_device *adreno_dev);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_gmu_snapshot.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_gmu_snapshot.c
@@ -0,0 +1,469 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "a6xx_reg.h"
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_a6xx_gmu.h"
+#include "adreno_snapshot.h"
+#include "kgsl_device.h"
+
+static const unsigned int a6xx_gmu_gx_registers[] = {
+	/* GMU GX */
+	0x1A800, 0x1A800, 0x1A810, 0x1A813, 0x1A816, 0x1A816, 0x1A818, 0x1A81B,
+	0x1A81E, 0x1A81E, 0x1A820, 0x1A823, 0x1A826, 0x1A826, 0x1A828, 0x1A82B,
+	0x1A82E, 0x1A82E, 0x1A830, 0x1A833, 0x1A836, 0x1A836, 0x1A838, 0x1A83B,
+	0x1A83E, 0x1A83E, 0x1A840, 0x1A843, 0x1A846, 0x1A846, 0x1A880, 0x1A884,
+	0x1A900, 0x1A92B, 0x1A940, 0x1A940,
+};
+
+static const unsigned int a6xx_gmu_tcm_registers[] = {
+	/* ITCM */
+	0x1B400, 0x1C3FF,
+	/* DTCM */
+	0x1C400, 0x1D3FF,
+};
+
+static const unsigned int a6xx_gmu_registers[] = {
+	/* GMU CX */
+	0x1F400, 0x1F407, 0x1F410, 0x1F412, 0x1F500, 0x1F500, 0x1F507, 0x1F50A,
+	0x1F800, 0x1F804, 0x1F807, 0x1F808, 0x1F80B, 0x1F80C, 0x1F80F, 0x1F81C,
+	0x1F824, 0x1F82A, 0x1F82D, 0x1F830, 0x1F840, 0x1F853, 0x1F887, 0x1F889,
+	0x1F8A0, 0x1F8A2, 0x1F8A4, 0x1F8AF, 0x1F8C0, 0x1F8C3, 0x1F8D0, 0x1F8D0,
+	0x1F8E4, 0x1F8E4, 0x1F8E8, 0x1F8EC, 0x1F900, 0x1F903, 0x1F940, 0x1F940,
+	0x1F942, 0x1F944, 0x1F94C, 0x1F94D, 0x1F94F, 0x1F951, 0x1F954, 0x1F954,
+	0x1F957, 0x1F958, 0x1F95D, 0x1F95D, 0x1F962, 0x1F962, 0x1F964, 0x1F965,
+	0x1F980, 0x1F986, 0x1F990, 0x1F99E, 0x1F9C0, 0x1F9C0, 0x1F9C5, 0x1F9CC,
+	0x1F9E0, 0x1F9E2, 0x1F9F0, 0x1F9F0, 0x1FA00, 0x1FA01,
+	/* GMU AO */
+	0x23B00, 0x23B16,
+};
+
+static const unsigned int a660_gmu_registers[] = {
+	/* GMU CX */
+	0x1F408, 0x1F40D, 0x1F40F, 0x1F40F, 0x1F50B, 0x1F50B, 0x1F860, 0x1F860,
+	0x1F870, 0x1F877, 0x1F8C4, 0x1F8C4, 0x1F8F0, 0x1F8F1, 0x1F948, 0x1F94A,
+	0x1F966, 0x1F96B, 0x1F970, 0x1F970, 0x1F972, 0x1F979, 0x1F9CD, 0x1F9D4,
+	0x1FA02, 0x1FA03, 0x20000, 0x20001, 0x20004, 0x20004, 0x20008, 0x20012,
+	0x20018, 0x20018,
+	/* GMU AO LPAC */
+	0x23B30, 0x23B30,
+};
+
+static const unsigned int a6xx_gmu_gpucc_registers[] = {
+	/* GPU CC */
+	0x24000, 0x24012, 0x24040, 0x24052, 0x24400, 0x24404, 0x24407, 0x2440B,
+	0x24415, 0x2441C, 0x2441E, 0x2442D, 0x2443C, 0x2443D, 0x2443F, 0x24440,
+	0x24442, 0x24449, 0x24458, 0x2445A, 0x24540, 0x2455E, 0x24800, 0x24802,
+	0x24C00, 0x24C02, 0x25400, 0x25402, 0x25800, 0x25802, 0x25C00, 0x25C02,
+	0x26000, 0x26002,
+	/* GPU CC ACD */
+	0x26400, 0x26416, 0x26420, 0x26427,
+};
+
+static const unsigned int a662_gmu_gpucc_registers[] = {
+	/* GPU CC */
+	0x24000, 0x2400e, 0x24400, 0x2440e, 0x24800, 0x24805, 0x24c00, 0x24cff,
+	0x25800, 0x25804, 0x25c00, 0x25c04, 0x26000, 0x26004, 0x26400, 0x26405,
+	0x26414, 0x2641d, 0x2642a, 0x26430, 0x26432, 0x26432, 0x26441, 0x26455,
+	0x26466, 0x26468, 0x26478, 0x2647a, 0x26489, 0x2648a, 0x2649c, 0x2649e,
+	0x264a0, 0x264a3, 0x264b3, 0x264b5, 0x264c5, 0x264c7, 0x264d6, 0x264d8,
+	0x264e8, 0x264e9, 0x264f9, 0x264fc, 0x2650b, 0x2650c, 0x2651c, 0x2651e,
+	0x26540, 0x26570, 0x26600, 0x26616, 0x26620, 0x2662d,
+};
+
+static const unsigned int a663_gmu_gpucc_registers[] = {
+	/* GPU CC */
+	0x24000, 0x2400e, 0x24400, 0x2440e, 0x25800, 0x25804, 0x25c00, 0x25c04,
+	0x26000, 0x26004, 0x26400, 0x26405, 0x26414, 0x2641d, 0x2642a, 0x26430,
+	0x26432, 0x26432, 0x26441, 0x26455, 0x26466, 0x26468, 0x26478, 0x2647a,
+	0x26489, 0x2648a, 0x2649c, 0x2649e, 0x264a0, 0x264a3, 0x264b3, 0x264b5,
+	0x264c5, 0x264c7, 0x264d6, 0x264d8, 0x264e8, 0x264e9, 0x264f9, 0x264fc,
+	0x2650b, 0x2650c, 0x2651c, 0x2651e, 0x26540, 0x26570, 0x26600, 0x26616,
+	0x26620, 0x2662d,
+};
+
+static const unsigned int a630_rscc_snapshot_registers[] = {
+	0x23400, 0x23434, 0x23436, 0x23436, 0x23480, 0x23484, 0x23489, 0x2348C,
+	0x23491, 0x23494, 0x23499, 0x2349C, 0x234A1, 0x234A4, 0x234A9, 0x234AC,
+	0x23500, 0x23502, 0x23504, 0x23507, 0x23514, 0x23519, 0x23524, 0x2352B,
+	0x23580, 0x23597, 0x23740, 0x23741, 0x23744, 0x23747, 0x2374C, 0x23787,
+	0x237EC, 0x237EF, 0x237F4, 0x2382F, 0x23894, 0x23897, 0x2389C, 0x238D7,
+	0x2393C, 0x2393F, 0x23944, 0x2397F,
+};
+
+static const unsigned int a6xx_rscc_snapshot_registers[] = {
+	0x23400, 0x23434, 0x23436, 0x23436, 0x23440, 0x23440, 0x23480, 0x23484,
+	0x23489, 0x2348C, 0x23491, 0x23494, 0x23499, 0x2349C, 0x234A1, 0x234A4,
+	0x234A9, 0x234AC, 0x23500, 0x23502, 0x23504, 0x23507, 0x23514, 0x23519,
+	0x23524, 0x2352B, 0x23580, 0x23597, 0x23740, 0x23741, 0x23744, 0x23747,
+	0x2374C, 0x23787, 0x237EC, 0x237EF, 0x237F4, 0x2382F, 0x23894, 0x23897,
+	0x2389C, 0x238D7, 0x2393C, 0x2393F, 0x23944, 0x2397F,
+};
+
+static const unsigned int a650_rscc_registers[] = {
+	0x38000, 0x38034, 0x38036, 0x38036, 0x38040, 0x38042, 0x38080, 0x38084,
+	0x38089, 0x3808C, 0x38091, 0x38094, 0x38099, 0x3809C, 0x380A1, 0x380A4,
+	0x380A9, 0x380AC, 0x38100, 0x38102, 0x38104, 0x38107, 0x38114, 0x38119,
+	0x38124, 0x3812E, 0x38180, 0x38197, 0x38340, 0x38341, 0x38344, 0x38347,
+	0x3834C, 0x3834F, 0x38351, 0x38354, 0x38356, 0x38359, 0x3835B, 0x3835E,
+	0x38360, 0x38363, 0x38365, 0x38368, 0x3836A, 0x3836D, 0x3836F, 0x38372,
+	0x383EC, 0x383EF, 0x383F4, 0x383F7, 0x383F9, 0x383FC, 0x383FE, 0x38401,
+	0x38403, 0x38406, 0x38408, 0x3840B, 0x3840D, 0x38410, 0x38412, 0x38415,
+	0x38417, 0x3841A, 0x38494, 0x38497, 0x3849C, 0x3849F, 0x384A1, 0x384A4,
+	0x384A6, 0x384A9, 0x384AB, 0x384AE, 0x384B0, 0x384B3, 0x384B5, 0x384B8,
+	0x384BA, 0x384BD, 0x384BF, 0x384C2, 0x3853C, 0x3853F, 0x38544, 0x38547,
+	0x38549, 0x3854C, 0x3854E, 0x38551, 0x38553, 0x38556, 0x38558, 0x3855B,
+	0x3855D, 0x38560, 0x38562, 0x38565, 0x38567, 0x3856A, 0x385E4, 0x385E7,
+	0x385EC, 0x385EF, 0x385F1, 0x385F4, 0x385F6, 0x385F9, 0x385FB, 0x385FE,
+	0x38600, 0x38603, 0x38605, 0x38608, 0x3860A, 0x3860D, 0x3860F, 0x38612,
+	0x3868C, 0x3868F, 0x38694, 0x38697, 0x38699, 0x3869C, 0x3869E, 0x386A1,
+	0x386A3, 0x386A6, 0x386A8, 0x386AB, 0x386AD, 0x386B0, 0x386B2, 0x386B5,
+	0x386B7, 0x386BA, 0x38734, 0x38737, 0x3873C, 0x3873F, 0x38741, 0x38744,
+	0x38746, 0x38749, 0x3874B, 0x3874E, 0x38750, 0x38753, 0x38755, 0x38758,
+	0x3875A, 0x3875D, 0x3875F, 0x38762, 0x387DC, 0x387DF, 0x387E4, 0x387E7,
+	0x387E9, 0x387EC, 0x387EE, 0x387F1, 0x387F3, 0x387F6, 0x387F8, 0x387FB,
+	0x387FD, 0x38800, 0x38802, 0x38805, 0x38807, 0x3880A, 0x38884, 0x38887,
+	0x3888C, 0x3888F, 0x38891, 0x38894, 0x38896, 0x38899, 0x3889B, 0x3889E,
+	0x388A0, 0x388A3, 0x388A5, 0x388A8, 0x388AA, 0x388AD, 0x388AF, 0x388B2,
+	0x3892C, 0x3892F, 0x38934, 0x38937, 0x38939, 0x3893C, 0x3893E, 0x38941,
+	0x38943, 0x38946, 0x38948, 0x3894B, 0x3894D, 0x38950, 0x38952, 0x38955,
+	0x38957, 0x3895A, 0x38B50, 0x38B51, 0x38B53, 0x38B55, 0x38B5A, 0x38B5A,
+	0x38B5F, 0x38B5F, 0x38B64, 0x38B64, 0x38B69, 0x38B69, 0x38B6E, 0x38B6E,
+	0x38B73, 0x38B73, 0x38BF8, 0x38BF8, 0x38BFD, 0x38BFD, 0x38C02, 0x38C02,
+	0x38C07, 0x38C07, 0x38C0C, 0x38C0C, 0x38C11, 0x38C11, 0x38C16, 0x38C16,
+	0x38C1B, 0x38C1B, 0x38CA0, 0x38CA0, 0x38CA5, 0x38CA5, 0x38CAA, 0x38CAA,
+	0x38CAF, 0x38CAF, 0x38CB4, 0x38CB4, 0x38CB9, 0x38CB9, 0x38CBE, 0x38CBE,
+	0x38CC3, 0x38CC3, 0x38D48, 0x38D48, 0x38D4D, 0x38D4D, 0x38D52, 0x38D52,
+	0x38D57, 0x38D57, 0x38D5C, 0x38D5C, 0x38D61, 0x38D61, 0x38D66, 0x38D66,
+	0x38D6B, 0x38D6B, 0x38DF0, 0x38DF0, 0x38DF5, 0x38DF5, 0x38DFA, 0x38DFA,
+	0x38DFF, 0x38DFF, 0x38E04, 0x38E04, 0x38E09, 0x38E09, 0x38E0E, 0x38E0E,
+	0x38E13, 0x38E13, 0x38E98, 0x38E98, 0x38E9D, 0x38E9D, 0x38EA2, 0x38EA2,
+	0x38EA7, 0x38EA7, 0x38EAC, 0x38EAC, 0x38EB1, 0x38EB1, 0x38EB6, 0x38EB6,
+	0x38EBB, 0x38EBB, 0x38F40, 0x38F40, 0x38F45, 0x38F45, 0x38F4A, 0x38F4A,
+	0x38F4F, 0x38F4F, 0x38F54, 0x38F54, 0x38F59, 0x38F59, 0x38F5E, 0x38F5E,
+	0x38F63, 0x38F63, 0x38FE8, 0x38FE8, 0x38FED, 0x38FED, 0x38FF2, 0x38FF2,
+	0x38FF7, 0x38FF7, 0x38FFC, 0x38FFC, 0x39001, 0x39001, 0x39006, 0x39006,
+	0x3900B, 0x3900B, 0x39090, 0x39090, 0x39095, 0x39095, 0x3909A, 0x3909A,
+	0x3909F, 0x3909F, 0x390A4, 0x390A4, 0x390A9, 0x390A9, 0x390AE, 0x390AE,
+	0x390B3, 0x390B3, 0x39138, 0x39138, 0x3913D, 0x3913D, 0x39142, 0x39142,
+	0x39147, 0x39147, 0x3914C, 0x3914C, 0x39151, 0x39151, 0x39156, 0x39156,
+	0x3915B, 0x3915B,
+};
+
+static size_t a6xx_snapshot_gmu_mem(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_gmu_mem *mem_hdr =
+		(struct kgsl_snapshot_gmu_mem *)buf;
+	unsigned int *data = (unsigned int *)
+		(buf + sizeof(*mem_hdr));
+	struct gmu_mem_type_desc *desc = priv;
+
+	if (priv == NULL || desc->memdesc->hostptr == NULL)
+		return 0;
+
+	if (remain < desc->memdesc->size + sizeof(*mem_hdr)) {
+		dev_err(device->dev,
+			"snapshot: Not enough memory for the gmu section %d\n",
+			desc->type);
+		return 0;
+	}
+
+	memset(mem_hdr, 0, sizeof(*mem_hdr));
+	mem_hdr->type = desc->type;
+	mem_hdr->hostaddr = (uintptr_t)desc->memdesc->hostptr;
+	mem_hdr->gmuaddr = desc->memdesc->gmuaddr;
+	mem_hdr->gpuaddr = 0;
+
+	/* Just copy the ringbuffer, there are no active IBs */
+	memcpy(data, desc->memdesc->hostptr, desc->memdesc->size);
+
+	return desc->memdesc->size + sizeof(*mem_hdr);
+}
+
+static size_t a6xx_gmu_snapshot_dtcm(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_gmu_mem *mem_hdr =
+		(struct kgsl_snapshot_gmu_mem *)buf;
+	struct a6xx_gmu_device *gmu = (struct a6xx_gmu_device *)priv;
+	u32 *data = (u32 *)(buf + sizeof(*mem_hdr));
+	u32 i;
+
+	if (remain < gmu->vma[GMU_DTCM].size + sizeof(*mem_hdr)) {
+		SNAPSHOT_ERR_NOMEM(device, "GMU DTCM Memory");
+		return 0;
+	}
+
+	mem_hdr->type = SNAPSHOT_GMU_MEM_BIN_BLOCK;
+	mem_hdr->hostaddr = 0;
+	mem_hdr->gmuaddr = gmu->vma[GMU_DTCM].start;
+	mem_hdr->gpuaddr = 0;
+
+	/* FIXME: use a bulk read? */
+	for (i = 0; i < (gmu->vma[GMU_DTCM].size >> 2); i++)
+		gmu_core_regread(device, A6XX_GMU_CM3_DTCM_START + i, data++);
+
+	return gmu->vma[GMU_DTCM].size + sizeof(*mem_hdr);
+}
+
+static size_t a6xx_gmu_snapshot_itcm(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_gmu_mem *mem_hdr =
+			(struct kgsl_snapshot_gmu_mem *)buf;
+	void *dest = buf + sizeof(*mem_hdr);
+	struct a6xx_gmu_device *gmu = (struct a6xx_gmu_device *)priv;
+
+	if (!gmu->itcm_shadow) {
+		dev_err(&gmu->pdev->dev, "ITCM not captured\n");
+		return 0;
+	}
+
+	if (remain < gmu->vma[GMU_ITCM].size + sizeof(*mem_hdr)) {
+		SNAPSHOT_ERR_NOMEM(device, "GMU ITCM Memory");
+		return 0;
+	}
+
+	mem_hdr->type = SNAPSHOT_GMU_MEM_BIN_BLOCK;
+	mem_hdr->hostaddr = 0;
+	mem_hdr->gmuaddr = gmu->vma[GMU_ITCM].start;
+	mem_hdr->gpuaddr = 0;
+
+	memcpy(dest, gmu->itcm_shadow, gmu->vma[GMU_ITCM].size);
+
+	return gmu->vma[GMU_ITCM].size + sizeof(*mem_hdr);
+}
+
+static void a6xx_gmu_snapshot_memories(struct kgsl_device *device,
+	struct a6xx_gmu_device *gmu, struct kgsl_snapshot *snapshot)
+{
+	struct gmu_mem_type_desc desc;
+	struct kgsl_memdesc *md;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(gmu->gmu_globals); i++) {
+
+		md = &gmu->gmu_globals[i];
+		if (!md->size)
+			continue;
+
+		desc.memdesc = md;
+		if (md == gmu->hfi.hfi_mem)
+			desc.type = SNAPSHOT_GMU_MEM_HFI;
+		else if (md == gmu->gmu_log)
+			desc.type = SNAPSHOT_GMU_MEM_LOG;
+		else if (md == gmu->dump_mem)
+			desc.type = SNAPSHOT_GMU_MEM_DEBUG;
+		else if (md == gmu->vrb)
+			desc.type = SNAPSHOT_GMU_MEM_VRB;
+		else if (md == gmu->trace.md)
+			desc.type = SNAPSHOT_GMU_MEM_TRACE;
+		else
+			desc.type = SNAPSHOT_GMU_MEM_BIN_BLOCK;
+
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_GMU_MEMORY,
+			snapshot, a6xx_snapshot_gmu_mem, &desc);
+	}
+}
+
+struct kgsl_snapshot_gmu_version {
+	uint32_t type;
+	uint32_t value;
+};
+
+static size_t a6xx_snapshot_gmu_version(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	uint32_t *data = (uint32_t *) (buf + sizeof(*header));
+	struct kgsl_snapshot_gmu_version *ver = priv;
+
+	if (remain < DEBUG_SECTION_SZ(1)) {
+		SNAPSHOT_ERR_NOMEM(device, "GMU Version");
+		return 0;
+	}
+
+	header->type = ver->type;
+	header->size = 1;
+
+	*data = ver->value;
+
+	return DEBUG_SECTION_SZ(1);
+}
+
+static void a6xx_gmu_snapshot_versions(struct kgsl_device *device,
+		struct a6xx_gmu_device *gmu,
+		struct kgsl_snapshot *snapshot)
+{
+	int i;
+
+	struct kgsl_snapshot_gmu_version gmu_vers[] = {
+		{ .type = SNAPSHOT_DEBUG_GMU_CORE_VERSION,
+			.value = gmu->ver.core, },
+		{ .type = SNAPSHOT_DEBUG_GMU_CORE_DEV_VERSION,
+			.value = gmu->ver.core_dev, },
+		{ .type = SNAPSHOT_DEBUG_GMU_PWR_VERSION,
+			.value = gmu->ver.pwr, },
+		{ .type = SNAPSHOT_DEBUG_GMU_PWR_DEV_VERSION,
+			.value = gmu->ver.pwr_dev, },
+		{ .type = SNAPSHOT_DEBUG_GMU_HFI_VERSION,
+			.value = gmu->ver.hfi, },
+	};
+
+	for (i = 0; i < ARRAY_SIZE(gmu_vers); i++)
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+				snapshot, a6xx_snapshot_gmu_version,
+				&gmu_vers[i]);
+}
+
+#define RSCC_OFFSET_DWORDS 0x38000
+
+static size_t a6xx_snapshot_rscc_registers(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	struct kgsl_snapshot_regs *header = (struct kgsl_snapshot_regs *)buf;
+	struct kgsl_snapshot_registers *regs = priv;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	int count = 0, j, k;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	/* Figure out how many registers we are going to dump */
+	for (j = 0; j < regs->count; j++) {
+		int start = regs->regs[j * 2];
+		int end = regs->regs[j * 2 + 1];
+
+		count += (end - start + 1);
+	}
+
+	if (remain < (count * 8) + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "RSCC REGISTERS");
+		return 0;
+	}
+
+	for (j = 0; j < regs->count; j++) {
+		unsigned int start = regs->regs[j * 2];
+		unsigned int end = regs->regs[j * 2 + 1];
+
+		for (k = start; k <= end; k++) {
+			unsigned int val;
+
+			val = __raw_readl(gmu->rscc_virt +
+				((k - RSCC_OFFSET_DWORDS) << 2));
+			*data++ = k;
+			*data++ = val;
+		}
+	}
+
+	header->count = count;
+
+	/* Return the size of the section */
+	return (count * 8) + sizeof(*header);
+}
+
+static void snapshot_rscc_registers(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* RSCC registers are on cx */
+	if (adreno_is_a650_family(adreno_dev)) {
+		struct kgsl_snapshot_registers r;
+
+		r.regs = a650_rscc_registers;
+		r.count = ARRAY_SIZE(a650_rscc_registers) / 2;
+
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS,
+			snapshot, a6xx_snapshot_rscc_registers, &r);
+	} else if (adreno_is_a615_family(adreno_dev) ||
+			adreno_is_a630(adreno_dev)) {
+		adreno_snapshot_registers(device, snapshot,
+			a630_rscc_snapshot_registers,
+			ARRAY_SIZE(a630_rscc_snapshot_registers) / 2);
+	} else if (adreno_is_a640(adreno_dev) || adreno_is_a680(adreno_dev)) {
+		adreno_snapshot_registers(device, snapshot,
+			a6xx_rscc_snapshot_registers,
+			ARRAY_SIZE(a6xx_rscc_snapshot_registers) / 2);
+	}
+}
+
+/*
+ * a6xx_gmu_device_snapshot() - A6XX GMU snapshot function
+ * @device: Device being snapshotted
+ * @snapshot: Pointer to the snapshot instance
+ *
+ * This is where all of the A6XX GMU specific bits and pieces are grabbed
+ * into the snapshot memory
+ */
+void a6xx_gmu_device_snapshot(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_GMU_MEMORY,
+		snapshot, a6xx_gmu_snapshot_itcm, gmu);
+
+	a6xx_gmu_snapshot_versions(device, gmu, snapshot);
+
+	a6xx_gmu_snapshot_memories(device, gmu, snapshot);
+
+	/* Snapshot tcms as registers for legacy targets */
+	if (adreno_is_a630(adreno_dev) ||
+			adreno_is_a615_family(adreno_dev))
+		adreno_snapshot_registers(device, snapshot,
+				a6xx_gmu_tcm_registers,
+				ARRAY_SIZE(a6xx_gmu_tcm_registers) / 2);
+
+	adreno_snapshot_registers(device, snapshot, a6xx_gmu_registers,
+					ARRAY_SIZE(a6xx_gmu_registers) / 2);
+
+	if (adreno_is_a662(adreno_dev) || adreno_is_a621(adreno_dev))
+		adreno_snapshot_registers(device, snapshot,
+			a662_gmu_gpucc_registers,
+			ARRAY_SIZE(a662_gmu_gpucc_registers) / 2);
+	else if (adreno_is_a663(adreno_dev) || adreno_is_a623(adreno_dev))
+		adreno_snapshot_registers(device, snapshot,
+			a663_gmu_gpucc_registers,
+			ARRAY_SIZE(a663_gmu_gpucc_registers) / 2);
+	else
+		adreno_snapshot_registers(device, snapshot,
+			a6xx_gmu_gpucc_registers,
+			ARRAY_SIZE(a6xx_gmu_gpucc_registers) / 2);
+
+	/* Snapshot A660 specific GMU registers */
+	if (adreno_is_a660(adreno_dev))
+		adreno_snapshot_registers(device, snapshot, a660_gmu_registers,
+					ARRAY_SIZE(a660_gmu_registers) / 2);
+
+	snapshot_rscc_registers(adreno_dev, snapshot);
+
+	if (!a6xx_gmu_gx_is_on(adreno_dev))
+		goto dtcm;
+
+	/* Set fence to ALLOW mode so registers can be read */
+	kgsl_regwrite(device, A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+	/* Make sure the previous write posted before reading */
+	wmb();
+
+	adreno_snapshot_registers(device, snapshot,
+			a6xx_gmu_gx_registers,
+			ARRAY_SIZE(a6xx_gmu_gx_registers) / 2);
+
+	/* A stalled SMMU can lead to NoC timeouts when host accesses DTCM */
+	if (a6xx_is_smmu_stalled(device)) {
+		dev_err(&gmu->pdev->dev,
+			"Not dumping dtcm because SMMU is stalled\n");
+		return;
+	}
+
+dtcm:
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_GMU_MEMORY,
+		snapshot, a6xx_gmu_snapshot_dtcm, gmu);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_hfi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_hfi.c
@@ -0,0 +1,852 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/nvmem-consumer.h>
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_a6xx_hfi.h"
+#include "kgsl_device.h"
+#include "kgsl_trace.h"
+
+/* Below section is for all structures related to HFI queues */
+#define HFI_QUEUE_MAX HFI_QUEUE_DEFAULT_CNT
+
+/* Total header sizes + queue sizes + 16 for alignment */
+#define HFIMEM_SIZE (sizeof(struct hfi_queue_table) + 16 + \
+		(HFI_QUEUE_SIZE * HFI_QUEUE_MAX))
+
+struct a6xx_hfi *to_a6xx_hfi(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	return &gmu->hfi;
+}
+
+/* Size in below functions are in unit of dwords */
+int a6xx_hfi_queue_read(struct a6xx_gmu_device *gmu, uint32_t queue_idx,
+		unsigned int *output, unsigned int max_size)
+{
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	struct hfi_queue_table *tbl = mem_addr->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+	uint32_t *queue;
+	uint32_t msg_hdr;
+	uint32_t i, read;
+	uint32_t size;
+	int result = 0;
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+		return -EINVAL;
+
+	if (hdr->read_index == hdr->write_index)
+		return -ENODATA;
+
+	/* Clear the output data before populating */
+	memset(output, 0, max_size);
+
+	queue = HOST_QUEUE_START_ADDR(mem_addr, queue_idx);
+	msg_hdr = queue[hdr->read_index];
+	size = MSG_HDR_GET_SIZE(msg_hdr);
+
+	if (size > (max_size >> 2)) {
+		dev_err(&gmu->pdev->dev,
+		"HFI message too big: hdr:0x%x rd idx=%d\n",
+			msg_hdr, hdr->read_index);
+		result = -EMSGSIZE;
+		goto done;
+	}
+
+	read = hdr->read_index;
+
+	if (read < hdr->queue_size) {
+		for (i = 0; i < size && i < (max_size >> 2); i++) {
+			output[i] = queue[read];
+			read = (read + 1)%hdr->queue_size;
+		}
+		result = size;
+	} else {
+		/* In case FW messed up */
+		dev_err(&gmu->pdev->dev,
+			"Read index %d greater than queue size %d\n",
+			hdr->read_index, hdr->queue_size);
+		result = -ENODATA;
+	}
+
+	if (GMU_VER_MAJOR(gmu->ver.hfi) >= 2)
+		read = ALIGN(read, SZ_4) % hdr->queue_size;
+
+	/* For acks, trace the packet for which this ack was sent */
+	if (MSG_HDR_GET_TYPE(msg_hdr) == HFI_MSG_ACK)
+		trace_kgsl_hfi_receive(MSG_HDR_GET_ID(output[1]),
+			MSG_HDR_GET_SIZE(output[1]),
+			MSG_HDR_GET_SEQNUM(output[1]));
+	else
+		trace_kgsl_hfi_receive(MSG_HDR_GET_ID(msg_hdr),
+			MSG_HDR_GET_SIZE(msg_hdr), MSG_HDR_GET_SEQNUM(msg_hdr));
+
+	hfi_update_read_idx(hdr, read);
+
+done:
+	return result;
+}
+
+/* Size in below functions are in unit of dwords */
+int a6xx_hfi_queue_write(struct adreno_device *adreno_dev, uint32_t queue_idx,
+		uint32_t *msg, u32 size_bytes)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_queue_table *tbl = gmu->hfi.hfi_mem->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+	uint32_t *queue;
+	uint32_t i, write_idx, read_idx, empty_space;
+	uint32_t size_dwords = size_bytes >> 2;
+	u32 align_size = ALIGN(size_dwords, SZ_4);
+	uint32_t id = MSG_HDR_GET_ID(*msg);
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED || !IS_ALIGNED(size_bytes, sizeof(u32)))
+		return -EINVAL;
+
+	queue = HOST_QUEUE_START_ADDR(gmu->hfi.hfi_mem, queue_idx);
+
+	write_idx = hdr->write_index;
+	read_idx = hdr->read_index;
+
+	empty_space = (write_idx >= read_idx) ?
+			(hdr->queue_size - (write_idx - read_idx))
+			: (read_idx - write_idx);
+
+	if (empty_space <= align_size)
+		return -ENOSPC;
+
+	for (i = 0; i < size_dwords; i++) {
+		queue[write_idx] = msg[i];
+		write_idx = (write_idx + 1) % hdr->queue_size;
+	}
+
+	/* Cookify any non used data at the end of the write buffer */
+	if (GMU_VER_MAJOR(gmu->ver.hfi) >= 2) {
+		for (; i < align_size; i++) {
+			queue[write_idx] = 0xFAFAFAFA;
+			write_idx = (write_idx + 1) % hdr->queue_size;
+		}
+	}
+
+	trace_kgsl_hfi_send(id, size_dwords, MSG_HDR_GET_SEQNUM(*msg));
+
+	hfi_update_write_idx(&hdr->write_index, write_idx);
+
+	return 0;
+}
+
+int a6xx_hfi_cmdq_write(struct adreno_device *adreno_dev, u32 *msg, u32 size_bytes)
+{
+	int ret;
+
+	ret = a6xx_hfi_queue_write(adreno_dev, HFI_CMD_ID, msg, size_bytes);
+
+	/*
+	 * Memory barrier to make sure packet and write index are written before
+	 * an interrupt is raised
+	 */
+	wmb();
+
+	/* Send interrupt to GMU to receive the message */
+	if (!ret)
+		gmu_core_regwrite(KGSL_DEVICE(adreno_dev),
+			A6XX_GMU_HOST2GMU_INTR_SET,
+			0x1);
+
+	return ret;
+}
+
+/* Sizes of the queue and message are in unit of dwords */
+static void init_queues(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	int i;
+	struct hfi_queue_table *tbl;
+	struct hfi_queue_header *hdr;
+	struct {
+		unsigned int idx;
+		unsigned int pri;
+		unsigned int status;
+	} queue[HFI_QUEUE_MAX] = {
+		{ HFI_CMD_IDX, HFI_CMD_PRI, HFI_QUEUE_STATUS_ENABLED },
+		{ HFI_MSG_IDX, HFI_MSG_PRI, HFI_QUEUE_STATUS_ENABLED },
+		{ HFI_DBG_IDX, HFI_DBG_PRI, HFI_QUEUE_STATUS_ENABLED },
+	};
+
+	/*
+	 * Overwrite the queue IDs for A630, A615 and A616 as they use
+	 * legacy firmware. Legacy firmware has different queue IDs for
+	 * message, debug and dispatch queues (dispatch queues aren't used
+	 * on these targets so the queue idx value update is not needed).
+	 */
+	if (adreno_is_a630(adreno_dev) || adreno_is_a615_family(adreno_dev)) {
+		queue[HFI_MSG_ID].idx = HFI_MSG_IDX_LEGACY;
+		queue[HFI_DBG_ID].idx = HFI_DBG_IDX_LEGACY;
+	}
+
+	/* Fill Table Header */
+	tbl = mem_addr->hostptr;
+	tbl->qtbl_hdr.version = 0;
+	tbl->qtbl_hdr.size = sizeof(struct hfi_queue_table) >> 2;
+	tbl->qtbl_hdr.qhdr0_offset = sizeof(struct hfi_queue_table_header) >> 2;
+	tbl->qtbl_hdr.qhdr_size = sizeof(struct hfi_queue_header) >> 2;
+	tbl->qtbl_hdr.num_q = HFI_QUEUE_MAX;
+	tbl->qtbl_hdr.num_active_q = HFI_QUEUE_MAX;
+
+	memset(&tbl->qhdr[0], 0, sizeof(tbl->qhdr));
+
+	/* Fill Individual Queue Headers */
+	for (i = 0; i < HFI_QUEUE_MAX; i++) {
+		hdr = &tbl->qhdr[i];
+		hdr->start_addr = GMU_QUEUE_START_ADDR(mem_addr->gmuaddr, i);
+		hdr->type = QUEUE_HDR_TYPE(queue[i].idx, queue[i].pri, 0,  0);
+		hdr->status = queue[i].status;
+		hdr->queue_size = HFI_QUEUE_SIZE >> 2; /* convert to dwords */
+	}
+}
+
+int a6xx_hfi_init(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hfi *hfi = &gmu->hfi;
+
+	/* Allocates & maps memory for HFI */
+	if (IS_ERR_OR_NULL(hfi->hfi_mem)) {
+		hfi->hfi_mem = reserve_gmu_kernel_block(gmu, 0, HFIMEM_SIZE,
+			GMU_NONCACHED_KERNEL, 0);
+		if (!IS_ERR(hfi->hfi_mem))
+			init_queues(adreno_dev);
+	}
+
+	return PTR_ERR_OR_ZERO(hfi->hfi_mem);
+}
+
+int a6xx_receive_ack_cmd(struct a6xx_gmu_device *gmu, void *rcvd,
+	struct pending_cmd *ret_cmd)
+{
+	struct adreno_device *adreno_dev = a6xx_gmu_to_adreno(gmu);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	uint32_t *ack = rcvd;
+	uint32_t hdr = ack[0];
+	uint32_t req_hdr = ack[1];
+
+	if (ret_cmd == NULL)
+		return -EINVAL;
+
+	if (CMP_HFI_ACK_HDR(ret_cmd->sent_hdr, req_hdr)) {
+		memcpy(&ret_cmd->results, ack, MSG_HDR_GET_SIZE(hdr) << 2);
+		return 0;
+	}
+
+	/* Didn't find the sender, list the waiter */
+	dev_err_ratelimited(&gmu->pdev->dev,
+		"HFI ACK: Cannot find sender for 0x%8.8x Waiter: 0x%8.8x\n",
+		req_hdr, ret_cmd->sent_hdr);
+
+	gmu_core_fault_snapshot(device);
+
+	return -ENODEV;
+}
+
+static int poll_gmu_reg(struct adreno_device *adreno_dev,
+	u32 offsetdwords, unsigned int expected_val,
+	unsigned int mask, unsigned int timeout_ms)
+{
+	unsigned int val;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned long timeout = jiffies + msecs_to_jiffies(timeout_ms);
+	u64 ao_pre_poll, ao_post_poll;
+	bool nmi = false;
+
+	ao_pre_poll = a6xx_read_alwayson(adreno_dev);
+
+	/* FIXME: readl_poll_timeout? */
+	while (time_is_after_jiffies(timeout)) {
+		gmu_core_regread(device, offsetdwords, &val);
+		if ((val & mask) == expected_val)
+			return 0;
+
+		/*
+		 * If GMU firmware fails any assertion, error message is sent
+		 * to KMD and NMI is triggered. So check if GMU is in NMI and
+		 * timeout early. Bits [11:9] of A6XX_GMU_CM3_FW_INIT_RESULT
+		 * contain GMU reset status. Non zero value here indicates that
+		 * GMU reset is active, NMI handler would eventually complete
+		 * and GMU would wait for recovery.
+		 */
+		gmu_core_regread(device, A6XX_GMU_CM3_FW_INIT_RESULT, &val);
+		if (val & 0xE00) {
+			nmi = true;
+			break;
+		}
+
+		usleep_range(10, 100);
+	}
+
+	ao_post_poll = a6xx_read_alwayson(adreno_dev);
+
+	/* Check one last time */
+	gmu_core_regread(device, offsetdwords, &val);
+	if ((val & mask) == expected_val)
+		return 0;
+
+	dev_err(&gmu->pdev->dev, "kgsl hfi poll %s: always on: %lld ms\n",
+		nmi ? "abort" : "timeout",
+		div_u64((ao_post_poll - ao_pre_poll) * 52, USEC_PER_SEC));
+
+	return -ETIMEDOUT;
+}
+
+static int a6xx_hfi_send_cmd_wait_inline(struct adreno_device *adreno_dev,
+	void *data, u32 size_bytes, struct pending_cmd *ret_cmd)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int rc;
+	uint32_t *cmd = data;
+	struct a6xx_hfi *hfi = &gmu->hfi;
+	unsigned int seqnum = atomic_inc_return(&hfi->seqnum);
+
+	*cmd = MSG_HDR_SET_SEQNUM_SIZE(*cmd, seqnum, size_bytes >> 2);
+	if (ret_cmd == NULL)
+		return a6xx_hfi_cmdq_write(adreno_dev, cmd, size_bytes);
+
+	ret_cmd->sent_hdr = cmd[0];
+
+	rc = a6xx_hfi_cmdq_write(adreno_dev, cmd, size_bytes);
+	if (rc)
+		return rc;
+
+	rc = poll_gmu_reg(adreno_dev, A6XX_GMU_GMU2HOST_INTR_INFO,
+		HFI_IRQ_MSGQ_MASK, HFI_IRQ_MSGQ_MASK, HFI_RSP_TIMEOUT);
+
+	if (rc) {
+		gmu_core_fault_snapshot(device);
+		dev_err(&gmu->pdev->dev,
+		"Timed out waiting on ack for 0x%8.8x (id %d, sequence %d)\n",
+		cmd[0], MSG_HDR_GET_ID(*cmd), MSG_HDR_GET_SEQNUM(*cmd));
+		return rc;
+	}
+
+	/* Clear the interrupt */
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR,
+		HFI_IRQ_MSGQ_MASK);
+
+	rc = a6xx_hfi_process_queue(gmu, HFI_MSG_ID, ret_cmd);
+
+	return rc;
+}
+
+int a6xx_hfi_send_generic_req(struct adreno_device *adreno_dev, void *cmd, u32 size_bytes)
+{
+	struct pending_cmd ret_cmd;
+	int rc;
+
+	memset(&ret_cmd, 0, sizeof(ret_cmd));
+
+	rc = a6xx_hfi_send_cmd_wait_inline(adreno_dev, cmd, size_bytes, &ret_cmd);
+	if (rc)
+		return rc;
+
+	if (ret_cmd.results[2]) {
+		struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+		struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+		gmu_core_fault_snapshot(device);
+		dev_err(&gmu->pdev->dev,
+				"HFI ACK failure: Req=0x%8.8X, Result=0x%8.8X\n",
+				ret_cmd.results[1],
+				ret_cmd.results[2]);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int a6xx_hfi_send_gmu_init(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_gmu_init_cmd cmd = {
+		.seg_id = 0,
+		.dbg_buffer_addr = (unsigned int) gmu->dump_mem->gmuaddr,
+		.dbg_buffer_size = (unsigned int) gmu->dump_mem->size,
+		.boot_state = 0x1,
+	};
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_INIT);
+	if (ret)
+		return ret;
+
+	return a6xx_hfi_send_generic_req(adreno_dev, &cmd, sizeof(cmd));
+}
+
+static int a6xx_hfi_get_fw_version(struct adreno_device *adreno_dev,
+		uint32_t expected_ver, uint32_t *ver)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_fw_version_cmd cmd = {
+		.supported_ver = expected_ver,
+	};
+	int rc;
+	struct pending_cmd ret_cmd;
+
+	rc = CMD_MSG_HDR(cmd, H2F_MSG_FW_VER);
+	if (rc)
+		return rc;
+
+	memset(&ret_cmd, 0, sizeof(ret_cmd));
+
+	rc = a6xx_hfi_send_cmd_wait_inline(adreno_dev, &cmd, sizeof(cmd), &ret_cmd);
+	if (rc)
+		return rc;
+
+	rc = ret_cmd.results[2];
+	if (!rc)
+		*ver = ret_cmd.results[3];
+	else
+		dev_err(&gmu->pdev->dev,
+			"gmu get fw ver failed with error=%d\n", rc);
+
+	return rc;
+}
+
+int a6xx_hfi_send_core_fw_start(struct adreno_device *adreno_dev)
+{
+	struct hfi_core_fw_start_cmd cmd = {
+		.handle = 0x0,
+	};
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_CORE_FW_START);
+	if (ret)
+		return ret;
+
+	return a6xx_hfi_send_generic_req(adreno_dev, &cmd, sizeof(cmd));
+}
+
+static const char *feature_to_string(uint32_t feature)
+{
+	if (feature == HFI_FEATURE_ACD)
+		return "ACD";
+	else if (feature == HFI_FEATURE_LM)
+		return "LM";
+
+	return "unknown";
+}
+
+int a6xx_hfi_send_feature_ctrl(struct adreno_device *adreno_dev,
+	uint32_t feature, uint32_t enable, uint32_t data)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_feature_ctrl_cmd cmd = {
+		.feature = feature,
+		.enable = enable,
+		.data = data,
+	};
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_FEATURE_CTRL);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hfi_send_generic_req(adreno_dev, &cmd, sizeof(cmd));
+	if (ret)
+		dev_err(&gmu->pdev->dev,
+				"Unable to %s feature %s (%d)\n",
+				enable ? "enable" : "disable",
+				feature_to_string(feature),
+				feature);
+	return ret;
+}
+
+int a6xx_hfi_send_set_value(struct adreno_device *adreno_dev,
+		u32 type, u32 subtype, u32 data)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_set_value_cmd cmd = {
+		.type = type,
+		.subtype = subtype,
+		.data = data,
+	};
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_SET_VALUE);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hfi_send_generic_req(adreno_dev, &cmd, sizeof(cmd));
+	if (ret)
+		dev_err(&gmu->pdev->dev,
+			"Unable to set HFI Value %d, %d to %d, error = %d\n",
+			type, subtype, data, ret);
+	return ret;
+}
+
+static int a6xx_hfi_send_dcvstbl_v1(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_dcvstable_cmd *table = &gmu->hfi.dcvs_table;
+	struct hfi_dcvstable_v1_cmd cmd = {
+		.gpu_level_num = table->gpu_level_num,
+		.gmu_level_num = table->gmu_level_num,
+	};
+	int i, ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_PERF_TBL);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < table->gpu_level_num; i++) {
+		cmd.gx_votes[i].vote = table->gx_votes[i].vote;
+		cmd.gx_votes[i].freq = table->gx_votes[i].freq;
+	}
+
+	cmd.cx_votes[0].vote = table->cx_votes[0].vote;
+	cmd.cx_votes[0].freq = table->cx_votes[0].freq;
+	cmd.cx_votes[1].vote = table->cx_votes[1].vote;
+	cmd.cx_votes[1].freq = table->cx_votes[1].freq;
+
+	return a6xx_hfi_send_generic_req(adreno_dev, &cmd, sizeof(cmd));
+}
+
+static int a6xx_hfi_send_test(struct adreno_device *adreno_dev)
+{
+	struct hfi_test_cmd cmd;
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_TEST);
+	if (ret)
+		return ret;
+
+	cmd.data = 0;
+
+	return a6xx_hfi_send_generic_req(adreno_dev, &cmd, sizeof(cmd));
+}
+
+void adreno_a6xx_receive_err_req(struct a6xx_gmu_device *gmu, void *rcvd)
+{
+	struct hfi_err_cmd *cmd = rcvd;
+
+	dev_err(&gmu->pdev->dev, "HFI Error Received: %d %d %.16s\n",
+			((cmd->error_code >> 16) & 0xFFFF),
+			(cmd->error_code & 0xFFFF),
+			(char *) cmd->data);
+}
+
+void adreno_a6xx_receive_debug_req(struct a6xx_gmu_device *gmu, void *rcvd)
+{
+	struct hfi_debug_cmd *cmd = rcvd;
+
+	dev_dbg(&gmu->pdev->dev, "HFI Debug Received: %d %d %d\n",
+			cmd->type, cmd->timestamp, cmd->data);
+}
+
+static void a6xx_hfi_v1_receiver(struct a6xx_gmu_device *gmu, uint32_t *rcvd,
+	struct pending_cmd *ret_cmd)
+{
+	/* V1 ACK Handler */
+	if (MSG_HDR_GET_TYPE(rcvd[0]) == HFI_V1_MSG_ACK) {
+		a6xx_receive_ack_cmd(gmu, rcvd, ret_cmd);
+		return;
+	}
+
+	/* V1 Request Handler */
+	switch (MSG_HDR_GET_ID(rcvd[0])) {
+	case F2H_MSG_ERR: /* No Reply */
+		adreno_a6xx_receive_err_req(gmu, rcvd);
+		break;
+	case F2H_MSG_DEBUG: /* No Reply */
+		adreno_a6xx_receive_debug_req(gmu, rcvd);
+		break;
+	default: /* No Reply */
+		dev_err(&gmu->pdev->dev,
+				"HFI V1 request %d not supported\n",
+				MSG_HDR_GET_ID(rcvd[0]));
+		break;
+	}
+}
+
+int a6xx_hfi_process_queue(struct a6xx_gmu_device *gmu,
+		uint32_t queue_idx, struct pending_cmd *ret_cmd)
+{
+	uint32_t rcvd[MAX_RCVD_SIZE];
+
+	while (a6xx_hfi_queue_read(gmu, queue_idx, rcvd, sizeof(rcvd)) > 0) {
+		/* Special case if we're v1 */
+		if (GMU_VER_MAJOR(gmu->ver.hfi) < 2) {
+			a6xx_hfi_v1_receiver(gmu, rcvd, ret_cmd);
+			continue;
+		}
+
+		/* V2 ACK Handler */
+		if (MSG_HDR_GET_TYPE(rcvd[0]) == HFI_MSG_ACK) {
+			int ret = a6xx_receive_ack_cmd(gmu, rcvd, ret_cmd);
+
+			if (ret)
+				return ret;
+			continue;
+		}
+
+		/* V2 Request Handler */
+		switch (MSG_HDR_GET_ID(rcvd[0])) {
+		case F2H_MSG_ERR: /* No Reply */
+			adreno_a6xx_receive_err_req(gmu, rcvd);
+			break;
+		case F2H_MSG_DEBUG: /* No Reply */
+			adreno_a6xx_receive_debug_req(gmu, rcvd);
+			break;
+		default: /* No Reply */
+			dev_err(&gmu->pdev->dev,
+				"HFI request %d not supported\n",
+				MSG_HDR_GET_ID(rcvd[0]));
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int a6xx_hfi_verify_fw_version(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	int result;
+	unsigned int ver, major, minor;
+
+	/* GMU version is already known, so don't waste time finding again */
+	if (gmu->ver.core != 0)
+		return 0;
+
+	major = a6xx_core->gmu_major;
+	minor = a6xx_core->gmu_minor;
+
+	result = a6xx_hfi_get_fw_version(adreno_dev, GMU_VERSION(major, minor, 0),
+			&ver);
+	if (result) {
+		dev_err_once(&gmu->pdev->dev,
+				"Failed to get FW version via HFI\n");
+		return result;
+	}
+
+	/* For now, warn once. Could return error later if needed */
+	if (major != GMU_VER_MAJOR(ver))
+		dev_err_once(&gmu->pdev->dev,
+				"FW Major Error: Wanted %d, got %d\n",
+				major, GMU_VER_MAJOR(ver));
+
+	if (minor > GMU_VER_MINOR(ver))
+		dev_err_once(&gmu->pdev->dev,
+				"FW Minor Error: Wanted < %d, got %d\n",
+				GMU_VER_MINOR(ver), minor);
+
+	/* Save the gmu version information */
+	gmu->ver.core = ver;
+
+	return 0;
+}
+
+int a6xx_hfi_send_bcl_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	int ret;
+
+	if (!adreno_dev->bcl_enabled)
+		return 0;
+
+	ret = a6xx_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_BCL, 1, 0);
+
+	return ret;
+}
+
+int a6xx_hfi_send_lm_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct hfi_set_value_cmd req;
+	u32 slope = 0;
+	int ret;
+
+	if (!adreno_dev->lm_enabled)
+		return 0;
+
+	memset(&req, 0, sizeof(req));
+
+	nvmem_cell_read_u32(&device->pdev->dev, "isense_slope", &slope);
+
+	ret = CMD_MSG_HDR(req, H2F_MSG_SET_VALUE);
+	if (ret)
+		return ret;
+
+	req.type = HFI_VALUE_LM_CS0;
+	req.subtype = 0;
+	req.data = slope;
+
+	ret = a6xx_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_LM, 1,
+			device->pwrctrl.throttle_mask);
+
+	if (!ret)
+		ret = a6xx_hfi_send_generic_req(adreno_dev, &req, sizeof(req));
+
+	return ret;
+}
+
+int a6xx_hfi_send_acd_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret = 0;
+
+	if (adreno_dev->acd_enabled) {
+		ret = a6xx_hfi_send_generic_req(adreno_dev,
+			&gmu->hfi.acd_table, sizeof(gmu->hfi.acd_table));
+		if (!ret)
+			ret = a6xx_hfi_send_feature_ctrl(adreno_dev,
+				HFI_FEATURE_ACD, 1, 0);
+	}
+
+	return ret;
+}
+
+static void reset_hfi_queues(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	struct hfi_queue_table *tbl = mem_addr->hostptr;
+	struct hfi_queue_header *hdr;
+	unsigned int i;
+
+	/* Flush HFI queues */
+	for (i = 0; i < HFI_QUEUE_MAX; i++) {
+		hdr = &tbl->qhdr[i];
+
+		if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+			continue;
+
+		hdr->read_index = hdr->write_index;
+	}
+}
+
+int a6xx_hfi_start(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int result;
+
+	reset_hfi_queues(adreno_dev);
+
+	/* This is legacy HFI message for A630 and A615 family firmware */
+	if (adreno_is_a630(adreno_dev) || adreno_is_a615_family(adreno_dev)) {
+		result = a6xx_hfi_send_gmu_init(adreno_dev);
+		if (result)
+			goto err;
+	}
+
+	result = a6xx_hfi_verify_fw_version(adreno_dev);
+	if (result)
+		goto err;
+
+	if (GMU_VER_MAJOR(gmu->ver.hfi) < 2)
+		result = a6xx_hfi_send_dcvstbl_v1(adreno_dev);
+	else
+		result = a6xx_hfi_send_generic_req(adreno_dev,
+			&gmu->hfi.dcvs_table, sizeof(gmu->hfi.dcvs_table));
+	if (result)
+		goto err;
+
+	result = a6xx_hfi_send_generic_req(adreno_dev, &gmu->hfi.bw_table,
+			sizeof(gmu->hfi.bw_table));
+	if (result)
+		goto err;
+
+	/*
+	 * If quirk is enabled send H2F_MSG_TEST and tell the GMU
+	 * we are sending no more HFIs until the next boot otherwise
+	 * send H2F_MSG_CORE_FW_START and features for A640 devices
+	 */
+	if (GMU_VER_MAJOR(gmu->ver.hfi) >= 2) {
+		result = a6xx_hfi_send_acd_feature_ctrl(adreno_dev);
+		if (result)
+			goto err;
+
+		result = a6xx_hfi_send_lm_feature_ctrl(adreno_dev);
+		if (result)
+			goto err;
+
+		result = a6xx_hfi_send_bcl_feature_ctrl(adreno_dev);
+		if (result)
+			goto err;
+
+		result = a6xx_hfi_send_core_fw_start(adreno_dev);
+		if (result)
+			goto err;
+	} else {
+		if (ADRENO_QUIRK(adreno_dev, ADRENO_QUIRK_HFI_USE_REG)) {
+			result = a6xx_hfi_send_test(adreno_dev);
+			if (result)
+				goto err;
+		}
+	}
+
+	set_bit(GMU_PRIV_HFI_STARTED, &gmu->flags);
+
+	/* Request default DCVS level */
+	result = kgsl_pwrctrl_set_default_gpu_pwrlevel(device);
+	if (result)
+		goto err;
+
+	/* Request default BW vote */
+	result = kgsl_pwrctrl_axi(device, true);
+
+err:
+	if (result)
+		a6xx_hfi_stop(adreno_dev);
+
+	return result;
+
+}
+
+void a6xx_hfi_stop(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	kgsl_pwrctrl_axi(device, false);
+
+	clear_bit(GMU_PRIV_HFI_STARTED, &gmu->flags);
+}
+
+/* HFI interrupt handler */
+irqreturn_t a6xx_hfi_irq_handler(int irq, void *data)
+{
+	struct kgsl_device *device = data;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(ADRENO_DEVICE(device));
+	unsigned int status = 0;
+
+	gmu_core_regread(device, A6XX_GMU_GMU2HOST_INTR_INFO, &status);
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, HFI_IRQ_MASK);
+
+	if (status & HFI_IRQ_DBGQ_MASK)
+		a6xx_hfi_process_queue(gmu, HFI_DBG_ID, NULL);
+	if (status & HFI_IRQ_CM3_FAULT_MASK) {
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"GMU CM3 fault interrupt received\n");
+		atomic_set(&gmu->cm3_fault, 1);
+
+		/* make sure other CPUs see the update */
+		smp_wmb();
+	}
+	if (status & ~HFI_IRQ_MASK)
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"Unhandled HFI interrupts 0x%lx\n",
+				status & ~HFI_IRQ_MASK);
+
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_hfi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_hfi.h
@@ -0,0 +1,188 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_A6XX_HFI_H
+#define __ADRENO_A6XX_HFI_H
+
+#include "adreno_hfi.h"
+
+/**
+ * struct a6xx_hfi - HFI control structure
+ * @seqnum: atomic counter that is incremented for each message sent. The
+ *	value of the counter is used as sequence number for HFI message
+ * @bw_table: HFI BW table buffer
+ * @acd_table: HFI table for ACD data
+ */
+struct a6xx_hfi {
+	/** @irq: HFI interrupt line */
+	int irq;
+	atomic_t seqnum;
+	/** @hfi_mem: Memory descriptor for the hfi memory */
+	struct kgsl_memdesc *hfi_mem;
+	struct hfi_bwtable_cmd bw_table;
+	struct hfi_acd_table_cmd acd_table;
+	/** @dcvs_table: HFI table for gpu dcvs levels */
+	struct hfi_dcvstable_cmd dcvs_table;
+};
+
+struct a6xx_gmu_device;
+
+/* a6xx_hfi_irq_handler - IRQ handler for HFI interripts */
+irqreturn_t a6xx_hfi_irq_handler(int irq, void *data);
+
+/**
+ * a6xx_hfi_start - Send the various HFIs during device boot up
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_start(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hfi_start - Send the various HFIs during device boot up
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+void a6xx_hfi_stop(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hfi_init - Initialize hfi resources
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function allocates and sets up hfi queues
+ * when a process creates the very first kgsl instance
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_init(struct adreno_device *adreno_dev);
+
+/* Helper function to get to a6xx hfi struct from adreno device */
+struct a6xx_hfi *to_a6xx_hfi(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hfi_queue_write - Write a command to hfi queue
+ * @adreno_dev: Pointer to the adreno device
+ * @queue_idx: destination queue id
+ * @msg: Data to be written to the queue
+ * @size_bytes: Size of the command in bytes
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_queue_write(struct adreno_device *adreno_dev, u32 queue_idx,
+	u32 *msg, u32 size_bytes);
+
+/**
+ * a6xx_hfi_queue_read - Read data from hfi queue
+ * @gmu: Pointer to the a6xx gmu device
+ * @queue_idx: queue id to read from
+ * @output: Pointer to read the data into
+ * @max_size: Number of bytes to read from the queue
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_queue_read(struct a6xx_gmu_device *gmu, u32 queue_idx,
+	u32 *output, u32 max_size);
+
+/**
+ * a6xx_receive_ack_cmd - Process ack type packets
+ * @gmu: Pointer to the a6xx gmu device
+ * @rcvd: Pointer to the data read from hfi queue
+ * @ret_cmd: Container for the hfi packet for which this ack is received
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_receive_ack_cmd(struct a6xx_gmu_device *gmu, void *rcvd,
+	struct pending_cmd *ret_cmd);
+
+/**
+ * a6xx_hfi_send_feature_ctrl - Enable gmu feature via hfi
+ * @adreno_dev: Pointer to the adreno device
+ * @feature: feature to be enabled or disabled
+ * enable: Set 1 to enable or 0 to disable a feature
+ * @data: payload for the send feature hfi packet
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_send_feature_ctrl(struct adreno_device *adreno_dev,
+	u32 feature, u32 enable, u32 data);
+
+/**
+ * a6xx_hfi_send_set_value - Send gmu set_values via hfi
+ * @adreno_dev: Pointer to the adreno device
+ * @type: GMU set_value type
+ * @subtype: GMU set_value subtype
+ * @data: Value to set
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_send_set_value(struct adreno_device *adreno_dev,
+		u32 type, u32 subtype, u32 data);
+
+/**
+ * a6xx_hfi_send_core_fw_start - Send the core fw start hfi
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_send_core_fw_start(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hfi_send_acd_feature_ctrl - Send the acd table and acd feature
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_send_acd_feature_ctrl(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hfi_send_lm_feature_ctrl -  Send the lm feature hfi packet
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_send_lm_feature_ctrl(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hfi_send_generic_req -  Send a generic hfi packet
+ * @adreno_dev: Pointer to the adreno device
+ * @cmd: Pointer to the hfi packet header and data
+ * @size_bytes: Size of the command in bytes
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_send_generic_req(struct adreno_device *adreno_dev, void *cmd, u32 size_bytes);
+
+/**
+ * a6xx_hfi_send_bcl_feature_ctrl -  Send the bcl feature hfi packet
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_send_bcl_feature_ctrl(struct adreno_device *adreno_dev);
+
+/*
+ * a6xx_hfi_process_queue - Check hfi queue for messages from gmu
+ * @gmu: Pointer to the a6xx gmu device
+ * @queue_idx: queue id to be processed
+ * @ret_cmd: Container for data needed for waiting for the ack
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_process_queue(struct a6xx_gmu_device *gmu,
+	u32 queue_idx, struct pending_cmd *ret_cmd);
+
+/**
+ * a6xx_hfi_cmdq_write - Write a command to command queue
+ * @adreno_dev: Pointer to the adreno device
+ * @msg: Data to be written to the queue
+ * @size_bytes: Size of the command in bytes
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hfi_cmdq_write(struct adreno_device *adreno_dev, u32 *msg, u32 size_bytes);
+void adreno_a6xx_receive_err_req(struct a6xx_gmu_device *gmu, void *rcvd);
+void adreno_a6xx_receive_debug_req(struct a6xx_gmu_device *gmu, void *rcvd);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_hwsched.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_hwsched.c
@@ -0,0 +1,1399 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk.h>
+#include <linux/component.h>
+#include <linux/interconnect.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_a6xx_hwsched.h"
+#include "adreno_hfi.h"
+#include "adreno_snapshot.h"
+#include "kgsl_bus.h"
+#include "kgsl_device.h"
+#include "kgsl_trace.h"
+
+static size_t adreno_hwsched_snapshot_rb(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	struct kgsl_snapshot_rb_v2 *header = (struct kgsl_snapshot_rb_v2 *)buf;
+	u32 *data = (u32 *)(buf + sizeof(*header));
+	struct kgsl_memdesc *rb = (struct kgsl_memdesc *)priv;
+
+	if (remain < rb->size + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "RB");
+		return 0;
+	}
+
+	header->start = 0;
+	header->end = rb->size >> 2;
+	header->rptr = 0;
+	header->rbsize = rb->size >> 2;
+	header->count = rb->size >> 2;
+	header->timestamp_queued = 0;
+	header->timestamp_retired = 0;
+	header->gpuaddr = rb->gpuaddr;
+	header->id = 0;
+
+	memcpy(data, rb->hostptr, rb->size);
+
+	return rb->size + sizeof(*header);
+}
+
+static void a6xx_hwsched_snapshot_preemption_record(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot, struct kgsl_memdesc *md, u64 offset)
+{
+	struct kgsl_snapshot_section_header *section_header =
+		(struct kgsl_snapshot_section_header *)snapshot->ptr;
+	u8 *dest = snapshot->ptr + sizeof(*section_header);
+	struct kgsl_snapshot_gpu_object_v2 *header =
+		(struct kgsl_snapshot_gpu_object_v2 *)dest;
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(ADRENO_DEVICE(device));
+	u64 ctxt_record_size = A6XX_CP_CTXRECORD_SIZE_IN_BYTES;
+	size_t section_size;
+
+	if (a6xx_core->ctxt_record_size)
+		ctxt_record_size = a6xx_core->ctxt_record_size;
+
+	ctxt_record_size = min_t(u64, ctxt_record_size, device->snapshot_ctxt_record_size);
+
+	section_size = sizeof(*section_header) + sizeof(*header) + ctxt_record_size;
+
+	if (snapshot->remain < section_size) {
+		SNAPSHOT_ERR_NOMEM(device, "PREEMPTION RECORD");
+		return;
+	}
+
+	section_header->magic = SNAPSHOT_SECTION_MAGIC;
+	section_header->id = KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2;
+	section_header->size = section_size;
+
+	header->size = ctxt_record_size >> 2;
+	header->gpuaddr = md->gpuaddr + offset;
+	header->ptbase =
+		kgsl_mmu_pagetable_get_ttbr0(device->mmu.defaultpagetable);
+	header->type = SNAPSHOT_GPU_OBJECT_GLOBAL;
+
+	dest += sizeof(*header);
+
+	memcpy(dest, md->hostptr + offset, ctxt_record_size);
+
+	snapshot->ptr += section_header->size;
+	snapshot->remain -= section_header->size;
+	snapshot->size += section_header->size;
+}
+
+static void snapshot_preemption_records(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot, struct kgsl_memdesc *md)
+{
+	const struct adreno_a6xx_core *a6xx_core =
+		to_a6xx_core(ADRENO_DEVICE(device));
+	u64 ctxt_record_size = A6XX_CP_CTXRECORD_SIZE_IN_BYTES;
+	u64 offset;
+
+	if (a6xx_core->ctxt_record_size)
+		ctxt_record_size = a6xx_core->ctxt_record_size;
+
+	/* All preemption records exist as a single mem alloc entry */
+	for (offset = 0; offset < md->size; offset += ctxt_record_size)
+		a6xx_hwsched_snapshot_preemption_record(device, snapshot, md,
+			offset);
+}
+
+static void *get_rb_hostptr(struct adreno_device *adreno_dev,
+	u64 gpuaddr, u32 size)
+{
+	struct a6xx_hwsched_hfi *hw_hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	u64 offset;
+	u32 i;
+
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct kgsl_memdesc *md = hw_hfi->mem_alloc_table[i].md;
+
+		if (md && (gpuaddr >= md->gpuaddr) &&
+			((gpuaddr + size) <= (md->gpuaddr + md->size))) {
+			offset = gpuaddr - md->gpuaddr;
+			return md->hostptr + offset;
+		}
+	}
+	return NULL;
+}
+
+static u32 a6xx_copy_gpu_global(void *out, void *in, u32 size)
+{
+	if (out && in) {
+		memcpy(out, in, size);
+		return size;
+	}
+
+	return 0;
+}
+
+
+static void adreno_hwsched_snapshot_rb_payload(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot, struct payload_section *payload)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_snapshot_section_header *section_header =
+		(struct kgsl_snapshot_section_header *)snapshot->ptr;
+	u8 *buf = snapshot->ptr + sizeof(*section_header);
+	struct kgsl_snapshot_rb_v2 *header = (struct kgsl_snapshot_rb_v2 *)buf;
+	u32 *data = (u32 *)(buf + sizeof(*header));
+	u32 size = adreno_hwsched_parse_payload(payload, KEY_RB_SIZEDWORDS) << 2;
+	u64 lo, hi, gpuaddr;
+	void *rb_hostptr;
+	char str[16];
+
+	lo = adreno_hwsched_parse_payload(payload, KEY_RB_GPUADDR_LO);
+	hi = adreno_hwsched_parse_payload(payload, KEY_RB_GPUADDR_HI);
+	gpuaddr = hi << 32 | lo;
+
+	/* Sanity check to make sure there is enough for the header */
+	if (snapshot->remain < sizeof(*section_header))
+		goto err;
+
+	rb_hostptr = get_rb_hostptr(adreno_dev, gpuaddr, size);
+
+	/* If the gpuaddress and size don't match any allocation, then abort */
+	if (((snapshot->remain - sizeof(*section_header)) <
+	    (size + sizeof(*header))) ||
+	    !a6xx_copy_gpu_global(data, rb_hostptr, size))
+		goto err;
+
+	if (device->dump_all_ibs) {
+		u64 rbaddr;
+
+		kgsl_regread64(device, A6XX_CP_RB_BASE,
+			       A6XX_CP_RB_BASE_HI, &rbaddr);
+
+		/* Parse all IBs from current RB */
+		if (rbaddr == gpuaddr)
+			adreno_snapshot_dump_all_ibs(device, rb_hostptr, snapshot);
+	}
+
+	header->start = 0;
+	header->end = size >> 2;
+	header->rptr = adreno_hwsched_parse_payload(payload, KEY_RB_RPTR);
+	header->wptr = adreno_hwsched_parse_payload(payload, KEY_RB_WPTR);
+	header->rbsize = size >> 2;
+	header->count = size >> 2;
+	header->timestamp_queued = adreno_hwsched_parse_payload(payload,
+			KEY_RB_QUEUED_TS);
+	header->timestamp_retired = adreno_hwsched_parse_payload(payload,
+			KEY_RB_RETIRED_TS);
+	header->gpuaddr = gpuaddr;
+	header->id = adreno_hwsched_parse_payload(payload, KEY_RB_ID);
+
+	section_header->magic = SNAPSHOT_SECTION_MAGIC;
+	section_header->id = KGSL_SNAPSHOT_SECTION_RB_V2;
+	section_header->size = size + sizeof(*header) + sizeof(*section_header);
+
+	snapshot->ptr += section_header->size;
+	snapshot->remain -= section_header->size;
+	snapshot->size += section_header->size;
+
+	return;
+err:
+	snprintf(str, sizeof(str), "RB addr:0x%llx", gpuaddr);
+	SNAPSHOT_ERR_NOMEM(device, str);
+	return;
+}
+
+static bool parse_payload_rb_legacy(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct hfi_context_bad_cmd_legacy *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+	bool ret = false;
+
+	/* Skip if we didn't receive a context bad HFI */
+	if (!cmd->hdr)
+		return false;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd_legacy, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == PAYLOAD_RB) {
+			adreno_hwsched_snapshot_rb_payload(adreno_dev, snapshot, payload);
+			ret = true;
+		}
+
+		i += sizeof(*payload) + (payload->dwords << 2);
+	}
+
+	return ret;
+}
+
+static bool parse_payload_rb(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct hfi_context_bad_cmd *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+	bool ret = false;
+
+	/* Skip if we didn't receive a context bad HFI */
+	if (!cmd->hdr)
+		return false;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == PAYLOAD_RB) {
+			adreno_hwsched_snapshot_rb_payload(adreno_dev,
+							   snapshot, payload);
+			ret = true;
+		}
+
+		i += sizeof(*payload) + (payload->dwords << 2);
+	}
+
+	return ret;
+}
+
+void a6xx_hwsched_snapshot(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_hwsched_hfi *hw_hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	u32 i;
+	bool skip_memkind_rb = false;
+	bool parse_payload;
+
+	a6xx_gmu_snapshot(adreno_dev, snapshot);
+
+	adreno_hwsched_parse_fault_cmdobj(adreno_dev, snapshot);
+
+	/*
+	 * First try to dump ringbuffers using context bad HFI payloads
+	 * because they have all the ringbuffer parameters. If ringbuffer
+	 * payloads are not present, fall back to dumping ringbuffers
+	 * based on MEMKIND_RB
+	 */
+	if (GMU_VER_MINOR(gmu->ver.hfi) < 2)
+		parse_payload = parse_payload_rb_legacy(adreno_dev, snapshot);
+	else
+		parse_payload = parse_payload_rb(adreno_dev, snapshot);
+
+	if (parse_payload)
+		skip_memkind_rb = true;
+
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct hfi_mem_alloc_entry *entry = &hw_hfi->mem_alloc_table[i];
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_RB && !skip_memkind_rb)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_RB_V2,
+				snapshot, adreno_hwsched_snapshot_rb,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_SCRATCH)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, adreno_snapshot_global,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_PROFILE)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, adreno_snapshot_global,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_CSW_SMMU_INFO)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, adreno_snapshot_global,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_CSW_PRIV_NON_SECURE)
+			snapshot_preemption_records(device, snapshot,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_PREEMPT_SCRATCH)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, adreno_snapshot_global,
+				entry->md);
+	}
+}
+
+static int a6xx_hwsched_gmu_first_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int level, ret = 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_AWARE);
+
+	a6xx_gmu_aop_send_acd_state(gmu, adreno_dev->acd_enabled);
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gmu_enable_clks(adreno_dev, GMU_MAX_PWRLEVELS - 1);
+	if (ret)
+		goto gdsc_off;
+
+	ret = a6xx_gmu_load_fw(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = a6xx_gmu_itcm_shadow(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	if (!test_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags)) {
+		ret = a6xx_load_pdc_ucode(adreno_dev);
+		if (ret)
+			goto clks_gdsc_off;
+
+		a6xx_load_rsc_ucode(adreno_dev);
+		set_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags);
+	}
+
+	a6xx_gmu_register_config(adreno_dev);
+
+	a6xx_gmu_version_info(adreno_dev);
+
+	if (GMU_VER_MINOR(gmu->ver.hfi) < 2)
+		set_bit(ADRENO_HWSCHED_CTX_BAD_LEGACY, &adreno_dev->hwsched.flags);
+
+	a6xx_gmu_irq_enable(adreno_dev);
+
+	/* Vote for minimal DDR BW for GMU to init */
+	level = pwr->pwrlevels[pwr->default_pwrlevel].bus_min;
+
+	icc_set_bw(pwr->icc_path, 0, kBps_to_icc(pwr->ddr_table[level]));
+
+	ret = a6xx_gmu_device_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = a6xx_hwsched_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	icc_set_bw(pwr->icc_path, 0, 0);
+
+	device->gmu_fault = false;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return 0;
+
+err:
+	a6xx_gmu_irq_disable(adreno_dev);
+
+	if (device->gmu_fault) {
+		a6xx_gmu_suspend(adreno_dev);
+
+		return ret;
+	}
+
+clks_gdsc_off:
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+gdsc_off:
+	a6xx_gmu_disable_gdsc(adreno_dev);
+
+	a6xx_rdpm_cx_freq_update(gmu, 0);
+
+	return ret;
+}
+
+static int a6xx_hwsched_gmu_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret = 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_AWARE);
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gmu_enable_clks(adreno_dev, GMU_MAX_PWRLEVELS - 1);
+	if (ret)
+		goto gdsc_off;
+
+	ret = a6xx_rscc_wakeup_sequence(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = a6xx_gmu_load_fw(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	a6xx_gmu_register_config(adreno_dev);
+
+	a6xx_gmu_irq_enable(adreno_dev);
+
+	ret = a6xx_gmu_device_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = a6xx_hwsched_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	device->gmu_fault = false;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return 0;
+err:
+	a6xx_gmu_irq_disable(adreno_dev);
+
+	if (device->gmu_fault) {
+		a6xx_gmu_suspend(adreno_dev);
+
+		return ret;
+	}
+
+clks_gdsc_off:
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+gdsc_off:
+	a6xx_gmu_disable_gdsc(adreno_dev);
+
+	a6xx_rdpm_cx_freq_update(gmu, 0);
+
+	return ret;
+}
+
+void a6xx_hwsched_active_count_put(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (WARN(atomic_read(&device->active_cnt) == 0,
+		"Unbalanced get/put calls to KGSL active count\n"))
+		return;
+
+	if (atomic_dec_and_test(&device->active_cnt)) {
+		kgsl_pwrscale_update_stats(device);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+	}
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	wake_up(&device->active_cnt_wq);
+}
+
+static int a6xx_hwsched_notify_slumber(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_prep_slumber_cmd req;
+	int ret;
+
+	ret = CMD_MSG_HDR(req, H2F_MSG_PREPARE_SLUMBER);
+	if (ret)
+		return ret;
+
+	req.freq = gmu->hfi.dcvs_table.gpu_level_num -
+			pwr->default_pwrlevel - 1;
+	req.bw = pwr->pwrlevels[pwr->default_pwrlevel].bus_freq;
+
+	/* Disable the power counter so that the GMU is not busy */
+	gmu_core_regwrite(device, A6XX_GMU_CX_GMU_POWER_COUNTER_ENABLE, 0);
+
+	return a6xx_hfi_send_cmd_async(adreno_dev, &req, sizeof(req));
+
+}
+static int a6xx_hwsched_gmu_power_off(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret = 0;
+
+	if (device->gmu_fault)
+		goto error;
+
+	/* Wait for the lowest idle level we requested */
+	ret = a6xx_gmu_wait_for_lowest_idle(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = a6xx_hwsched_notify_slumber(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = a6xx_gmu_wait_for_idle(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = a6xx_rscc_sleep_sequence(adreno_dev);
+
+	a6xx_rdpm_mx_freq_update(gmu, 0);
+
+	/* Now that we are done with GMU and GPU, Clear the GBIF */
+	ret = a6xx_halt_gbif(adreno_dev);
+	/* De-assert the halts */
+	kgsl_regwrite(device, A6XX_GBIF_HALT, 0x0);
+
+	a6xx_gmu_irq_disable(adreno_dev);
+
+	a6xx_hwsched_hfi_stop(adreno_dev);
+
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+	a6xx_gmu_disable_gdsc(adreno_dev);
+
+	a6xx_rdpm_cx_freq_update(gmu, 0);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_NONE);
+
+	return ret;
+
+error:
+	a6xx_gmu_irq_disable(adreno_dev);
+	a6xx_hwsched_hfi_stop(adreno_dev);
+	a6xx_gmu_suspend(adreno_dev);
+
+	return ret;
+}
+
+static int a6xx_hwsched_gpu_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/* Clear any GPU faults that might have been left over */
+	adreno_clear_gpu_fault(adreno_dev);
+
+	ret = kgsl_mmu_start(device);
+	if (ret)
+		goto err;
+
+	ret = a6xx_gmu_oob_set(device, oob_gpu);
+	if (ret)
+		goto err;
+
+	/* Clear the busy_data stats - we're starting over from scratch */
+	memset(&adreno_dev->busy_data, 0, sizeof(adreno_dev->busy_data));
+
+	/* Restore performance counter registers with saved values */
+	adreno_perfcounter_restore(adreno_dev);
+
+	a6xx_start(adreno_dev);
+
+	/* Re-initialize the coresight registers if applicable */
+	adreno_coresight_start(adreno_dev);
+
+	adreno_perfcounter_start(adreno_dev);
+
+	/* Clear FSR here in case it is set from a previous pagefault */
+	kgsl_mmu_clear_fsr(&device->mmu);
+
+	a6xx_enable_gpu_irq(adreno_dev);
+
+	ret = a6xx_hwsched_cp_init(adreno_dev);
+	if (ret) {
+		a6xx_disable_gpu_irq(adreno_dev);
+		goto err;
+	}
+
+	/*
+	 * At this point it is safe to assume that we recovered. Setting
+	 * this field allows us to take a new snapshot for the next failure
+	 * if we are prioritizing the first unrecoverable snapshot.
+	 */
+	if (device->snapshot)
+		device->snapshot->recovered = true;
+
+	device->reset_counter++;
+err:
+	a6xx_gmu_oob_clear(device, oob_gpu);
+
+	if (ret)
+		a6xx_hwsched_gmu_power_off(adreno_dev);
+
+	return ret;
+}
+
+static void hwsched_idle_timer(struct timer_list *t)
+{
+	struct kgsl_device *device = container_of(t, struct kgsl_device,
+					idle_timer);
+
+	kgsl_schedule_work(&device->idle_check_ws);
+}
+
+static int a6xx_hwsched_gmu_memory_init(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	/* GMU Virtual register bank */
+	if (IS_ERR_OR_NULL(gmu->vrb)) {
+		gmu->vrb = reserve_gmu_kernel_block(gmu, 0, GMU_VRB_SIZE,
+				GMU_NONCACHED_KERNEL, 0);
+
+		if (IS_ERR(gmu->vrb))
+			return PTR_ERR(gmu->vrb);
+
+		/* Populate size of the virtual register bank */
+		gmu_core_set_vrb_register(gmu->vrb->hostptr, VRB_SIZE_IDX,
+					gmu->vrb->size >> 2);
+	}
+
+	/* GMU trace log */
+	if (IS_ERR_OR_NULL(gmu->trace.md)) {
+		gmu->trace.md = reserve_gmu_kernel_block(gmu, 0,
+					GMU_TRACE_SIZE, GMU_NONCACHED_KERNEL, 0);
+
+		if (IS_ERR(gmu->trace.md))
+			return PTR_ERR(gmu->trace.md);
+
+		/* Pass trace buffer address to GMU through the VRB */
+		gmu_core_set_vrb_register(gmu->vrb->hostptr,
+					VRB_TRACE_BUFFER_ADDR_IDX,
+					gmu->trace.md->gmuaddr);
+
+		/* Initialize the GMU trace buffer header */
+		gmu_core_trace_header_init(&gmu->trace);
+	}
+
+	return 0;
+}
+
+static int a6xx_hwsched_gmu_init(struct adreno_device *adreno_dev)
+{
+	int ret;
+
+	ret = a6xx_gmu_parse_fw(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gmu_memory_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hwsched_gmu_memory_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	return a6xx_hwsched_hfi_init(adreno_dev);
+}
+
+static void a6xx_hwsched_touch_wakeup(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	/*
+	 * Do not wake up a suspended device or until the first boot sequence
+	 * has been completed.
+	 */
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags) ||
+		!test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags))
+		return;
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		goto done;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = a6xx_hwsched_gmu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	ret = a6xx_hwsched_gpu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	kgsl_pwrscale_wake(device);
+
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+done:
+	/*
+	 * When waking up from a touch event we want to stay active long enough
+	 * for the user to send a draw command.  The default idle timer timeout
+	 * is shorter than we want so go ahead and push the idle timer out
+	 * further for this special case
+	 */
+	mod_timer(&device->idle_timer, jiffies +
+		msecs_to_jiffies(adreno_wake_timeout));
+}
+
+static int a6xx_hwsched_boot(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	adreno_hwsched_start(adreno_dev);
+
+	if (IS_ENABLED(CONFIG_QCOM_KGSL_HIBERNATION) &&
+		!test_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags))
+		ret = a6xx_hwsched_gmu_first_boot(adreno_dev);
+	else
+		ret = a6xx_hwsched_gmu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hwsched_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_start_idle_timer(device);
+
+	kgsl_pwrscale_wake(device);
+
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	return ret;
+}
+
+static int a6xx_hwsched_first_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags))
+		return a6xx_hwsched_boot(adreno_dev);
+
+	if (adreno_preemption_feature_set(adreno_dev))
+		set_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv);
+
+	adreno_hwsched_start(adreno_dev);
+
+	ret = a6xx_microcode_read(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hwsched_gmu_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = a6xx_hwsched_gmu_first_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hwsched_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	adreno_get_bus_counters(adreno_dev);
+
+	adreno_dev->cooperative_reset = ADRENO_FEATURE(adreno_dev,
+						 ADRENO_COOP_RESET);
+
+	set_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags);
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	/*
+	 * There is a possible deadlock scenario during kgsl firmware reading
+	 * (request_firmware) and devfreq update calls. During first boot, kgsl
+	 * device mutex is held and then request_firmware is called for reading
+	 * firmware. request_firmware internally takes dev_pm_qos_mtx lock.
+	 * Whereas in case of devfreq update calls triggered by thermal/bcl or
+	 * devfreq sysfs, it first takes the same dev_pm_qos_mtx lock and then
+	 * tries to take kgsl device mutex as part of get_dev_status/target
+	 * calls. This results in deadlock when both thread are unable to acquire
+	 * the mutex held by other thread. Enable devfreq updates now as we are
+	 * done reading all firmware files.
+	 */
+	device->pwrscale.devfreq_enabled = true;
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	return 0;
+}
+
+static int a6xx_hwsched_power_off(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SLUMBER);
+
+	ret = a6xx_gmu_oob_set(device, oob_gpu);
+	if (ret) {
+		a6xx_gmu_oob_clear(device, oob_gpu);
+		goto no_gx_power;
+	}
+
+	kgsl_pwrscale_update_stats(device);
+
+	/* Save active coresight registers if applicable */
+	adreno_coresight_stop(adreno_dev);
+
+	/* Save physical performance counter values before GPU power down*/
+	adreno_perfcounter_save(adreno_dev);
+
+	adreno_irqctrl(adreno_dev, 0);
+
+	a6xx_gmu_oob_clear(device, oob_gpu);
+
+no_gx_power:
+	kgsl_pwrctrl_irq(device, false);
+
+	a6xx_hwsched_gmu_power_off(adreno_dev);
+
+	adreno_hwsched_unregister_contexts(adreno_dev);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpu_llc_slice);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpuhtw_llc_slice);
+
+	clear_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	del_timer_sync(&device->idle_timer);
+
+	kgsl_pwrscale_sleep(device);
+
+	kgsl_pwrctrl_clear_l3_vote(device);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SLUMBER);
+
+	return ret;
+}
+
+static void hwsched_idle_check(struct work_struct *work)
+{
+	struct kgsl_device *device = container_of(work,
+					struct kgsl_device, idle_check_ws);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	mutex_lock(&device->mutex);
+
+	if (test_bit(GMU_DISABLE_SLUMBER, &device->gmu_core.flags))
+		goto done;
+
+	if (atomic_read(&device->active_cnt) || time_is_after_jiffies(device->idle_jiffies)) {
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	spin_lock(&device->submit_lock);
+	if (device->submit_now) {
+		spin_unlock(&device->submit_lock);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	device->skip_inline_submit = true;
+	spin_unlock(&device->submit_lock);
+
+	if (!a6xx_hw_isidle(adreno_dev)) {
+		dev_err(device->dev, "GPU isn't idle before SLUMBER\n");
+		gmu_core_fault_snapshot(device);
+	}
+
+	a6xx_hwsched_power_off(adreno_dev);
+
+done:
+	mutex_unlock(&device->mutex);
+}
+
+static int a6xx_hwsched_first_open(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/*
+	 * Do the one time settings that need to happen when we
+	 * attempt to boot the gpu the very first time
+	 */
+	ret = a6xx_hwsched_first_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	/*
+	 * A client that does a first_open but never closes the device
+	 * may prevent us from going back to SLUMBER. So trigger the idle
+	 * check by incrementing the active count and immediately releasing it.
+	 */
+	atomic_inc(&device->active_cnt);
+	a6xx_hwsched_active_count_put(adreno_dev);
+
+	return 0;
+}
+
+int a6xx_hwsched_active_count_get(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret = 0;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EINVAL;
+
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags))
+		return -EINVAL;
+
+	if ((atomic_read(&device->active_cnt) == 0))
+		ret = a6xx_hwsched_boot(adreno_dev);
+
+	if (ret == 0)
+		atomic_inc(&device->active_cnt);
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	return ret;
+}
+
+static int a6xx_hwsched_dcvs_set(struct adreno_device *adreno_dev,
+		int gpu_pwrlevel, int bus_level)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_dcvstable_cmd *table = &gmu->hfi.dcvs_table;
+	struct hfi_gx_bw_perf_vote_cmd req = {
+		.ack_type = DCVS_ACK_BLOCK,
+		.freq = INVALID_DCVS_IDX,
+		.bw = INVALID_DCVS_IDX,
+	};
+	int ret;
+
+	if (!test_bit(GMU_PRIV_HFI_STARTED, &gmu->flags))
+		return 0;
+
+	/* Do not set to XO and lower GPU clock vote from GMU */
+	if ((gpu_pwrlevel != INVALID_DCVS_IDX) &&
+			(gpu_pwrlevel >= table->gpu_level_num - 1)) {
+		dev_err(&gmu->pdev->dev, "Invalid gpu dcvs request: %d\n",
+			gpu_pwrlevel);
+		return -EINVAL;
+	}
+
+	if (gpu_pwrlevel < table->gpu_level_num - 1)
+		req.freq = table->gpu_level_num - gpu_pwrlevel - 1;
+
+	if (bus_level < pwr->ddr_table_count && bus_level > 0)
+		req.bw = bus_level;
+
+	/* GMU will vote for slumber levels through the sleep sequence */
+	if ((req.freq == INVALID_DCVS_IDX) && (req.bw == INVALID_DCVS_IDX))
+		return 0;
+
+	ret = CMD_MSG_HDR(req, H2F_MSG_GX_BW_PERF_VOTE);
+	if (ret)
+		return ret;
+
+	ret = a6xx_hfi_send_cmd_async(adreno_dev, &req, sizeof(req));
+
+	if (ret) {
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"Failed to set GPU perf idx %d, bw idx %d\n",
+			req.freq, req.bw);
+
+		/*
+		 * If this was a dcvs request along side an active gpu, request
+		 * dispatcher based reset and recovery.
+		 */
+		if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+			adreno_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+	}
+
+	if (req.freq != INVALID_DCVS_IDX)
+		a6xx_rdpm_mx_freq_update(gmu,
+			gmu->hfi.dcvs_table.gx_votes[req.freq].freq);
+
+	return ret;
+}
+
+static int a6xx_hwsched_clock_set(struct adreno_device *adreno_dev,
+	u32 pwrlevel)
+{
+	return a6xx_hwsched_dcvs_set(adreno_dev, pwrlevel, INVALID_DCVS_IDX);
+}
+
+static void scale_gmu_frequency(struct adreno_device *adreno_dev, int buslevel)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	static unsigned long prev_freq;
+	unsigned long freq = gmu->freqs[0];
+
+	if (!gmu->perf_ddr_bw)
+		return;
+
+	/*
+	 * Scale the GMU if DDR is at a CX corner at which GMU can run at
+	 * a higher frequency
+	 */
+	if (pwr->ddr_table[buslevel] >= gmu->perf_ddr_bw)
+		freq = gmu->freqs[GMU_MAX_PWRLEVELS - 1];
+
+	if (prev_freq == freq)
+		return;
+
+	if (kgsl_clk_set_rate(gmu->clks, gmu->num_clks, "gmu_clk", freq)) {
+		dev_err(&gmu->pdev->dev, "Unable to set the GMU clock to %ld\n",
+			freq);
+		return;
+	}
+
+	a6xx_rdpm_cx_freq_update(gmu, freq / 1000);
+
+	trace_kgsl_gmu_pwrlevel(freq, prev_freq);
+
+	prev_freq = freq;
+}
+
+static int a6xx_hwsched_bus_set(struct adreno_device *adreno_dev, int buslevel,
+	u32 ab)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret = 0;
+
+	kgsl_icc_set_tag(pwr, buslevel);
+
+	if (buslevel != pwr->cur_buslevel) {
+		ret = a6xx_hwsched_dcvs_set(adreno_dev, INVALID_DCVS_IDX,
+				buslevel);
+		if (ret)
+			return ret;
+
+		scale_gmu_frequency(adreno_dev, buslevel);
+
+		pwr->cur_buslevel = buslevel;
+	}
+
+	if (ab != pwr->cur_ab) {
+		icc_set_bw(pwr->icc_path, MBps_to_icc(ab), 0);
+		pwr->cur_ab = ab;
+	}
+
+	trace_kgsl_buslevel(device, pwr->active_pwrlevel, buslevel, ab);
+	return ret;
+}
+
+static int a6xx_hwsched_pm_suspend(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SUSPEND);
+
+	/* Halt any new submissions */
+	reinit_completion(&device->halt_gate);
+
+	/**
+	 * Wait for the dispatcher to retire everything by waiting
+	 * for the active count to go to zero.
+	 */
+	ret = kgsl_active_count_wait(device, 0, msecs_to_jiffies(100));
+	if (ret) {
+		dev_err(device->dev, "Timed out waiting for the active count\n");
+		goto err;
+	}
+
+	ret = adreno_hwsched_idle(adreno_dev);
+	if (ret)
+		goto err;
+
+	a6xx_hwsched_power_off(adreno_dev);
+
+	adreno_get_gpu_halt(adreno_dev);
+
+	set_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SUSPEND);
+
+	return 0;
+
+err:
+	adreno_hwsched_start(adreno_dev);
+
+	return ret;
+}
+
+void a6xx_hwsched_handle_watchdog(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 mask;
+
+	/* Temporarily mask the watchdog interrupt to prevent a storm */
+	gmu_core_regread(device, A6XX_GMU_AO_HOST_INTERRUPT_MASK,
+		&mask);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_MASK,
+			(mask | GMU_INT_WDOG_BITE));
+
+	a6xx_gmu_send_nmi(device, false);
+
+	dev_err_ratelimited(&gmu->pdev->dev,
+			"GMU watchdog expired interrupt received\n");
+
+	adreno_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+}
+
+static void a6xx_hwsched_pm_resume(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	if (WARN(!test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags),
+		"resume invoked without a suspend\n"))
+		return;
+
+	adreno_put_gpu_halt(adreno_dev);
+
+	adreno_hwsched_start(adreno_dev);
+
+	clear_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags);
+}
+
+static void a6xx_hwsched_drain_ctxt_unregister(struct adreno_device *adreno_dev)
+{
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	struct pending_cmd *cmd = NULL;
+
+	read_lock(&hfi->msglock);
+
+	list_for_each_entry(cmd, &hfi->msglist, node) {
+		if (MSG_HDR_GET_ID(cmd->sent_hdr) == H2F_MSG_UNREGISTER_CONTEXT)
+			complete(&cmd->complete);
+	}
+
+	read_unlock(&hfi->msglock);
+}
+
+int a6xx_hwsched_reset_replay(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	int ret;
+
+	/*
+	 * Any pending context unregister packets will be lost
+	 * since we hard reset the GMU. This means any threads waiting
+	 * for context unregister hfi ack will timeout. Wake them
+	 * to avoid false positive ack timeout messages later.
+	 */
+	a6xx_hwsched_drain_ctxt_unregister(adreno_dev);
+
+	adreno_hwsched_unregister_contexts(adreno_dev);
+
+	if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return 0;
+
+	a6xx_disable_gpu_irq(adreno_dev);
+
+	a6xx_gmu_irq_disable(adreno_dev);
+
+	a6xx_hwsched_hfi_stop(adreno_dev);
+
+	a6xx_gmu_suspend(adreno_dev);
+
+	clear_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	ret = a6xx_hwsched_boot(adreno_dev);
+
+	if (!ret)
+		adreno_hwsched_replay(adreno_dev);
+
+	BUG_ON(ret);
+
+	return ret;
+}
+
+const struct adreno_power_ops a6xx_hwsched_power_ops = {
+	.first_open = a6xx_hwsched_first_open,
+	.last_close = a6xx_hwsched_power_off,
+	.active_count_get = a6xx_hwsched_active_count_get,
+	.active_count_put = a6xx_hwsched_active_count_put,
+	.touch_wakeup = a6xx_hwsched_touch_wakeup,
+	.pm_suspend = a6xx_hwsched_pm_suspend,
+	.pm_resume = a6xx_hwsched_pm_resume,
+	.gpu_clock_set = a6xx_hwsched_clock_set,
+	.gpu_bus_set = a6xx_hwsched_bus_set,
+};
+
+const struct adreno_hwsched_ops a6xx_hwsched_ops = {
+	.submit_drawobj = a6xx_hwsched_submit_drawobj,
+	.preempt_count = a6xx_hwsched_preempt_count_get,
+};
+
+int a6xx_hwsched_probe(struct platform_device *pdev,
+	u32 chipid, const struct adreno_gpu_core *gpucore)
+{
+	struct adreno_device *adreno_dev;
+	struct kgsl_device *device;
+	struct a6xx_hwsched_device *a6xx_hwsched_dev;
+	int ret;
+
+	a6xx_hwsched_dev = devm_kzalloc(&pdev->dev, sizeof(*a6xx_hwsched_dev),
+				GFP_KERNEL);
+	if (!a6xx_hwsched_dev)
+		return -ENOMEM;
+
+	adreno_dev = &a6xx_hwsched_dev->a6xx_dev.adreno_dev;
+
+	adreno_dev->hwsched_enabled = true;
+
+	ret = a6xx_probe_common(pdev, adreno_dev, chipid, gpucore);
+	if (ret)
+		return ret;
+
+	device = KGSL_DEVICE(adreno_dev);
+
+	INIT_WORK(&device->idle_check_ws, hwsched_idle_check);
+
+	timer_setup(&device->idle_timer, hwsched_idle_timer, 0);
+
+	adreno_dev->irq_mask = A6XX_HWSCHED_INT_MASK;
+
+	return adreno_hwsched_init(adreno_dev, &a6xx_hwsched_ops);
+}
+
+int a6xx_hwsched_add_to_minidump(struct adreno_device *adreno_dev)
+{
+	struct a6xx_device *a6xx_dev = container_of(adreno_dev,
+					struct a6xx_device, adreno_dev);
+	struct a6xx_hwsched_device *a6xx_hwsched = container_of(a6xx_dev,
+					struct a6xx_hwsched_device, a6xx_dev);
+	struct a6xx_hwsched_hfi *hw_hfi = &a6xx_hwsched->hwsched_hfi;
+	int ret, i;
+
+	ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_HWSCHED_DEVICE,
+			(void *)(a6xx_hwsched), sizeof(struct a6xx_hwsched_device));
+	if (ret)
+		return ret;
+
+	if (!IS_ERR_OR_NULL(a6xx_dev->gmu.gmu_log)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					KGSL_GMU_LOG_ENTRY,
+					a6xx_dev->gmu.gmu_log->hostptr,
+					a6xx_dev->gmu.gmu_log->size);
+		if (ret)
+			return ret;
+	}
+
+	if (!IS_ERR_OR_NULL(a6xx_dev->gmu.hfi.hfi_mem)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					KGSL_HFIMEM_ENTRY,
+					a6xx_dev->gmu.hfi.hfi_mem->hostptr,
+					a6xx_dev->gmu.hfi.hfi_mem->size);
+		if (ret)
+			return ret;
+	}
+
+	if (!IS_ERR_OR_NULL(a6xx_dev->gmu.vrb)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					KGSL_GMU_VRB_ENTRY,
+					a6xx_dev->gmu.vrb->hostptr,
+					a6xx_dev->gmu.vrb->size);
+		if (ret)
+			return ret;
+	}
+
+	if (!IS_ERR_OR_NULL(a6xx_dev->gmu.dump_mem)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					KGSL_GMU_DUMPMEM_ENTRY,
+					a6xx_dev->gmu.dump_mem->hostptr,
+					a6xx_dev->gmu.dump_mem->size);
+		if (ret)
+			return ret;
+	}
+
+	if (!IS_ERR_OR_NULL(a6xx_dev->gmu.trace.md)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					KGSL_GMU_TRACE_ENTRY,
+					a6xx_dev->gmu.trace.md->hostptr,
+					a6xx_dev->gmu.trace.md->size);
+		if (ret)
+			return ret;
+	}
+
+	/* Dump HFI hwsched global mem alloc entries */
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct hfi_mem_alloc_entry *entry = &hw_hfi->mem_alloc_table[i];
+		char hfi_minidump_str[MAX_VA_MINIDUMP_STR_LEN] = {0};
+		u32 rb_id = 0;
+
+		if (!hfi_get_minidump_string(entry->desc.mem_kind,
+					     &hfi_minidump_str[0],
+					     sizeof(hfi_minidump_str), &rb_id)) {
+			ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+						      hfi_minidump_str,
+						      entry->md->hostptr,
+						      entry->md->size);
+			if (ret)
+				return ret;
+		}
+	}
+
+	if (!IS_ERR_OR_NULL(hw_hfi->big_ib)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					      KGSL_HFI_BIG_IB_ENTRY,
+					      hw_hfi->big_ib->hostptr,
+					      hw_hfi->big_ib->size);
+		if (ret)
+			return ret;
+	}
+
+	if (!IS_ERR_OR_NULL(hw_hfi->big_ib_recurring))
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					      KGSL_HFI_BIG_IB_REC_ENTRY,
+					      hw_hfi->big_ib_recurring->hostptr,
+					      hw_hfi->big_ib_recurring->size);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_hwsched.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_hwsched.h
@@ -0,0 +1,100 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _ADRENO_A6XX_HWSCHED_H_
+#define _ADRENO_A6XX_HWSCHED_H_
+
+#include "adreno_a6xx_hwsched_hfi.h"
+
+/**
+ * struct a6xx_hwsched_device - Container for the a6xx hwscheduling device
+ */
+struct a6xx_hwsched_device {
+	/** @a6xx_dev: Container for the a6xx device */
+	struct a6xx_device a6xx_dev;
+	/** @hwsched_hfi: Container for hwscheduling specific hfi resources */
+	struct a6xx_hwsched_hfi hwsched_hfi;
+};
+
+/**
+ * a6xx_hwsched_probe - Target specific probe for hwsched
+ * @pdev: Pointer to the platform device
+ * @chipid: Chipid of the target
+ * @gpucore: Pointer to the gpucore
+ *
+ * The target specific probe function for hwsched enabled gmu targets.
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hwsched_probe(struct platform_device *pdev,
+	u32 chipid, const struct adreno_gpu_core *gpucore);
+
+/**
+ * a6xx_hwsched_reset_replay - Restart the gmu and gpu
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Restart the GMU and GPU and replay the inflight commands
+
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hwsched_reset_replay(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_snapshot - take a6xx hwsched snapshot
+ * @adreno_dev: Pointer to the adreno device
+ * @snapshot: Pointer to the snapshot instance
+ *
+ * Snapshot the faulty ib and then snapshot rest of a6xx gmu things
+ */
+void a6xx_hwsched_snapshot(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot);
+
+/**
+ * a6xx_hwsched_handle_watchdog - Handle watchdog interrupt
+ * @adreno_dev: Pointer to the adreno device
+ */
+void a6xx_hwsched_handle_watchdog(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_active_count_get - Increment the active count
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function increments the active count. If active count
+ * is 0, this function also powers up the device.
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_hwsched_active_count_get(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_active_count_put - Put back the active count
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function decrements the active count sets the idle
+ * timer if active count is zero.
+ */
+void a6xx_hwsched_active_count_put(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_add_to_minidump - Register hwsched_device with va minidump
+ * @adreno_dev: Pointer to the adreno device
+ */
+int a6xx_hwsched_add_to_minidump(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_send_recurring_cmdobj - Dispatch IBs to GMU
+ * @adreno_dev: Pointer to adreno device structure
+ * @cmdobj: The command object which needs to be submitted
+ *
+ * This function is used to register the context if needed and submit
+ * recurring IBs to the GMU. Upon receiving ipc interrupt GMU will submit
+ * recurring IBs to GPU.
+
+ * Return: 0 on success and negative error on failure
+ */
+int a6xx_hwsched_send_recurring_cmdobj(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_hwsched_hfi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_hwsched_hfi.c
@@ -0,0 +1,2085 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iommu.h>
+#include <linux/sched/clock.h>
+#include <soc/qcom/msm_performance.h>
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_a6xx_hwsched.h"
+#include "adreno_hfi.h"
+#include "adreno_perfcounter.h"
+#include "adreno_pm4types.h"
+#include "adreno_trace.h"
+#include "kgsl_device.h"
+#include "kgsl_eventlog.h"
+#include "kgsl_pwrctrl.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+#define HFI_QUEUE_MAX (HFI_QUEUE_DEFAULT_CNT + HFI_QUEUE_DISPATCH_MAX_CNT)
+
+#define DEFINE_QHDR(gmuaddr, id, prio) \
+	{\
+		.status = 1, \
+		.start_addr = GMU_QUEUE_START_ADDR(gmuaddr, id), \
+		.type = QUEUE_HDR_TYPE(id, prio, 0, 0), \
+		.queue_size = SZ_4K >> 2, \
+		.msg_size = 0, \
+		.unused0 = 0, \
+		.unused1 = 0, \
+		.unused2 = 0, \
+		.unused3 = 0, \
+		.unused4 = 0, \
+		.read_index = 0, \
+		.write_index = 0, \
+}
+
+static struct dq_info {
+	/** @max_dq: Maximum number of dispatch queues per RB level */
+	u32 max_dq;
+	/** @base_dq_id: Base dqid for level */
+	u32 base_dq_id;
+	/** @offset: Next dqid to use for roundrobin context assignment */
+	u32 offset;
+} a6xx_hfi_dqs[KGSL_PRIORITY_MAX_RB_LEVELS] = {
+	{ 4, 0, }, /* RB0 */
+	{ 4, 4, }, /* RB1 */
+	{ 3, 8, }, /* RB2 */
+	{ 3, 11, }, /* RB3 */
+};
+
+struct a6xx_hwsched_hfi *to_a6xx_hwsched_hfi(
+	struct adreno_device *adreno_dev)
+{
+	struct a6xx_device *a6xx_dev = container_of(adreno_dev,
+					struct a6xx_device, adreno_dev);
+	struct a6xx_hwsched_device *a6xx_hwsched = container_of(a6xx_dev,
+					struct a6xx_hwsched_device, a6xx_dev);
+
+	return &a6xx_hwsched->hwsched_hfi;
+}
+
+static void add_waiter(struct a6xx_hwsched_hfi *hfi, u32 hdr,
+	struct pending_cmd *ack)
+{
+	memset(ack, 0x0, sizeof(*ack));
+
+	init_completion(&ack->complete);
+	write_lock_irq(&hfi->msglock);
+	list_add_tail(&ack->node, &hfi->msglist);
+	write_unlock_irq(&hfi->msglock);
+
+	ack->sent_hdr = hdr;
+}
+
+static void del_waiter(struct a6xx_hwsched_hfi *hfi, struct pending_cmd *ack)
+{
+	write_lock_irq(&hfi->msglock);
+	list_del(&ack->node);
+	write_unlock_irq(&hfi->msglock);
+}
+
+static void a6xx_receive_ack_async(struct adreno_device *adreno_dev, void *rcvd)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	struct pending_cmd *cmd = NULL;
+	u32 waiters[64], num_waiters = 0, i;
+	u32 *ack = rcvd;
+	u32 hdr = ack[0];
+	u32 req_hdr = ack[1];
+	u32 size_bytes = MSG_HDR_GET_SIZE(hdr) << 2;
+
+	if (size_bytes > sizeof(cmd->results))
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"Ack result too big: %d Truncating to: %ld\n",
+			size_bytes, sizeof(cmd->results));
+
+	read_lock(&hfi->msglock);
+
+	list_for_each_entry(cmd, &hfi->msglist, node) {
+		if (CMP_HFI_ACK_HDR(cmd->sent_hdr, req_hdr)) {
+			memcpy(cmd->results, ack,
+				min_t(u32, size_bytes,
+					sizeof(cmd->results)));
+			complete(&cmd->complete);
+			read_unlock(&hfi->msglock);
+			return;
+		}
+
+		if (num_waiters < ARRAY_SIZE(waiters))
+			waiters[num_waiters++] = cmd->sent_hdr;
+	}
+
+	read_unlock(&hfi->msglock);
+
+	/* Didn't find the sender, list the waiter */
+	dev_err_ratelimited(&gmu->pdev->dev,
+		"Unexpectedly got id %d seqnum %d. Total waiters: %d Top %d Waiters:\n",
+		MSG_HDR_GET_ID(req_hdr), MSG_HDR_GET_SEQNUM(req_hdr),
+		num_waiters, min_t(u32, num_waiters, 5));
+
+	for (i = 0; i < num_waiters && i < 5; i++)
+		dev_err_ratelimited(&gmu->pdev->dev,
+			" id %d seqnum %d\n",
+			MSG_HDR_GET_ID(waiters[i]),
+			MSG_HDR_GET_SEQNUM(waiters[i]));
+}
+
+static void log_profiling_info(struct adreno_device *adreno_dev, u32 *rcvd)
+{
+	struct hfi_ts_retire_cmd *cmd = (struct hfi_ts_retire_cmd *)rcvd;
+	struct kgsl_context *context;
+	struct retire_info info = {0};
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	context = kgsl_context_get(device, cmd->ctxt_id);
+	if (context == NULL)
+		return;
+
+	/* protected GPU work must not be reported */
+	if  (!(context->flags & KGSL_CONTEXT_SECURE))
+		kgsl_work_period_update(device, context->proc_priv->period,
+					     cmd->active);
+
+	info.timestamp = cmd->ts;
+	info.rb_id = adreno_get_level(context);
+	info.gmu_dispatch_queue = context->gmu_dispatch_queue;
+	info.submitted_to_rb = cmd->submitted_to_rb;
+	info.sop = cmd->sop;
+	info.eop = cmd->eop;
+	if (GMU_VER_MINOR(gmu->ver.hfi) < 4)
+		info.active = cmd->eop - cmd->sop;
+	else
+		info.active = cmd->active;
+	info.retired_on_gmu = cmd->retired_on_gmu;
+
+	trace_adreno_cmdbatch_retired(context, &info, 0, 0, 0);
+
+	log_kgsl_cmdbatch_retired_event(context->id, cmd->ts, context->priority,
+		0, cmd->sop, cmd->eop);
+
+	kgsl_context_put(context);
+}
+
+/* Look up a particular key's value for a given type of payload */
+static u32 a6xx_hwsched_lookup_key_value_legacy(struct adreno_device *adreno_dev,
+	u32 type, u32 key)
+{
+	struct hfi_context_bad_cmd_legacy *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+
+	if (!cmd->hdr)
+		return 0;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd_legacy, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == type)
+			return adreno_hwsched_parse_payload(payload, key);
+
+		i += struct_size(payload, data, payload->dwords);
+	}
+
+	return 0;
+}
+
+static u32 get_payload_rb_key_legacy(struct adreno_device *adreno_dev,
+	u32 rb_id, u32 key)
+{
+	struct hfi_context_bad_cmd_legacy *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+
+	if (!cmd->hdr)
+		return 0;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd_legacy, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == PAYLOAD_RB) {
+			u32 id = adreno_hwsched_parse_payload(payload, KEY_RB_ID);
+
+			if (id == rb_id)
+				return adreno_hwsched_parse_payload(payload, key);
+		}
+
+		i += struct_size(payload, data, payload->dwords);
+	}
+
+	return 0;
+}
+
+static void log_gpu_fault_legacy(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct device *dev = &gmu->pdev->dev;
+	struct hfi_context_bad_cmd_legacy *cmd = adreno_dev->hwsched.ctxt_bad;
+
+	switch (cmd->error) {
+	case GMU_GPU_HW_HANG:
+		dev_crit_ratelimited(dev, "MISC: GPU hang detected\n");
+		break;
+	case GMU_GPU_SW_HANG:
+		dev_crit_ratelimited(dev, "gpu timeout ctx %d ts %u\n",
+			cmd->ctxt_id, cmd->ts);
+		break;
+	case GMU_CP_OPCODE_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP opcode error interrupt | opcode=0x%8.8x\n",
+			a6xx_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+			KEY_CP_OPCODE_ERROR));
+		break;
+	case GMU_CP_PROTECTED_ERROR: {
+		u32 status = a6xx_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_PROTECTED_ERROR);
+
+		dev_crit_ratelimited(dev,
+			"CP | Protected mode error | %s | addr=0x%5.5x | status=0x%8.8x\n",
+			status & (1 << 20) ? "READ" : "WRITE",
+			status & 0x3FFFF, status);
+		}
+		break;
+	case GMU_CP_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "CP Illegal instruction error\n");
+		break;
+	case GMU_CP_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "CP ucode error interrupt\n");
+		break;
+	case GMU_CP_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP | Ringbuffer HW fault | status=0x%8.8x\n",
+			a6xx_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_HW_FAULT));
+		break;
+	case GMU_GPU_PREEMPT_TIMEOUT: {
+		u32 cur, next, cur_rptr, cur_wptr, next_rptr, next_wptr;
+
+		cur = a6xx_hwsched_lookup_key_value_legacy(adreno_dev,
+			PAYLOAD_PREEMPT_TIMEOUT, KEY_PREEMPT_TIMEOUT_CUR_RB_ID);
+		next = a6xx_hwsched_lookup_key_value_legacy(adreno_dev,
+			PAYLOAD_PREEMPT_TIMEOUT,
+			KEY_PREEMPT_TIMEOUT_NEXT_RB_ID);
+		cur_rptr = get_payload_rb_key_legacy(adreno_dev, cur, KEY_RB_RPTR);
+		cur_wptr = get_payload_rb_key_legacy(adreno_dev, cur, KEY_RB_WPTR);
+		next_rptr = get_payload_rb_key_legacy(adreno_dev, next, KEY_RB_RPTR);
+		next_wptr = get_payload_rb_key_legacy(adreno_dev, next, KEY_RB_WPTR);
+
+		dev_crit_ratelimited(dev,
+			"Preemption Fault: cur=%d R/W=0x%x/0x%x, next=%d R/W=0x%x/0x%x\n",
+			cur, cur_rptr, cur_wptr, next, next_rptr, next_wptr);
+		}
+		break;
+	case GMU_CP_GPC_ERROR:
+		dev_crit_ratelimited(dev, "RBBM: GPC error\n");
+		break;
+	default:
+		dev_crit_ratelimited(dev, "Unknown GPU fault: %u\n",
+			cmd->error);
+		break;
+	}
+}
+
+/* Look up a particular key's value for a given type of payload */
+static u32 a6xx_hwsched_lookup_key_value(struct adreno_device *adreno_dev,
+	u32 type, u32 key)
+{
+	struct hfi_context_bad_cmd *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+
+	if (!cmd->hdr)
+		return 0;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == type)
+			return adreno_hwsched_parse_payload(payload, key);
+
+		i += struct_size(payload, data, payload->dwords);
+	}
+
+	return 0;
+}
+
+static u32 get_payload_rb_key(struct adreno_device *adreno_dev,
+	u32 rb_id, u32 key)
+{
+	struct hfi_context_bad_cmd *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+
+	if (!cmd->hdr)
+		return 0;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == PAYLOAD_RB) {
+			u32 id = adreno_hwsched_parse_payload(payload, KEY_RB_ID);
+
+			if (id == rb_id)
+				return adreno_hwsched_parse_payload(payload, key);
+		}
+
+		i += struct_size(payload, data, payload->dwords);
+	}
+
+	return 0;
+}
+
+static void log_gpu_fault(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct device *dev = &gmu->pdev->dev;
+	struct hfi_context_bad_cmd *cmd = adreno_dev->hwsched.ctxt_bad;
+
+	switch (cmd->error) {
+	case GMU_GPU_HW_HANG:
+		dev_crit_ratelimited(dev, "MISC: GPU hang detected\n");
+		break;
+	case GMU_GPU_SW_HANG:
+		dev_crit_ratelimited(dev, "gpu timeout ctx %d ts %d\n",
+			cmd->gc.ctxt_id, cmd->gc.ts);
+		break;
+	case GMU_CP_OPCODE_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP opcode error interrupt | opcode=0x%8.8x\n",
+			a6xx_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+			KEY_CP_OPCODE_ERROR));
+		break;
+	case GMU_CP_PROTECTED_ERROR: {
+		u32 status = a6xx_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_PROTECTED_ERROR);
+
+		dev_crit_ratelimited(dev,
+			"CP | Protected mode error | %s | addr=0x%5.5x | status=0x%8.8x\n",
+			status & (1 << 20) ? "READ" : "WRITE",
+			status & 0x3FFFF, status);
+		}
+		break;
+	case GMU_CP_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "CP Illegal instruction error\n");
+		break;
+	case GMU_CP_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "CP ucode error interrupt\n");
+		break;
+	case GMU_CP_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP | Ringbuffer HW fault | status=0x%8.8x\n",
+			a6xx_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_HW_FAULT));
+		break;
+	case GMU_GPU_PREEMPT_TIMEOUT: {
+		u32 cur, next, cur_rptr, cur_wptr, next_rptr, next_wptr;
+
+		cur = a6xx_hwsched_lookup_key_value(adreno_dev,
+			PAYLOAD_PREEMPT_TIMEOUT, KEY_PREEMPT_TIMEOUT_CUR_RB_ID);
+		next = a6xx_hwsched_lookup_key_value(adreno_dev,
+			PAYLOAD_PREEMPT_TIMEOUT,
+			KEY_PREEMPT_TIMEOUT_NEXT_RB_ID);
+		cur_rptr = get_payload_rb_key(adreno_dev, cur, KEY_RB_RPTR);
+		cur_wptr = get_payload_rb_key(adreno_dev, cur, KEY_RB_WPTR);
+		next_rptr = get_payload_rb_key(adreno_dev, next, KEY_RB_RPTR);
+		next_wptr = get_payload_rb_key(adreno_dev, next, KEY_RB_WPTR);
+
+		dev_crit_ratelimited(dev,
+			"Preemption Fault: cur=%d R/W=0x%x/0x%x, next=%d R/W=0x%x/0x%x\n",
+			cur, cur_rptr, cur_wptr, next, next_rptr, next_wptr);
+		}
+		break;
+	case GMU_CP_GPC_ERROR:
+		dev_crit_ratelimited(dev, "RBBM: GPC error\n");
+		break;
+	default:
+		dev_crit_ratelimited(dev, "Unknown GPU fault: %u\n",
+			cmd->error);
+		break;
+	}
+}
+
+static void process_ctx_bad(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	if (GMU_VER_MINOR(gmu->ver.hfi) < 2)
+		log_gpu_fault_legacy(adreno_dev);
+	else
+		log_gpu_fault(adreno_dev);
+
+	adreno_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+}
+
+static u32 peek_next_header(struct a6xx_gmu_device *gmu, uint32_t queue_idx)
+{
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	struct hfi_queue_table *tbl = mem_addr->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+	u32 *queue;
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+		return 0;
+
+	if (hdr->read_index == hdr->write_index)
+		return 0;
+
+	queue = HOST_QUEUE_START_ADDR(mem_addr, queue_idx);
+
+	return queue[hdr->read_index];
+}
+
+static void a6xx_hwsched_process_msgq(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hwsched_hfi *hw_hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	u32 rcvd[MAX_RCVD_SIZE], next_hdr;
+
+	mutex_lock(&hw_hfi->msgq_mutex);
+
+	for (;;) {
+		next_hdr = peek_next_header(gmu, HFI_MSG_ID);
+
+		if (!next_hdr)
+			break;
+
+		if (MSG_HDR_GET_ID(next_hdr) == F2H_MSG_CONTEXT_BAD) {
+			a6xx_hfi_queue_read(gmu, HFI_MSG_ID,
+				(u32 *)adreno_dev->hwsched.ctxt_bad,
+				HFI_MAX_MSG_SIZE);
+			process_ctx_bad(adreno_dev);
+			continue;
+		}
+
+		a6xx_hfi_queue_read(gmu, HFI_MSG_ID, rcvd, sizeof(rcvd));
+
+		/*
+		 * We are assuming that there is only one outstanding ack
+		 * because hfi sending thread waits for completion while
+		 * holding the device mutex
+		 */
+		if (MSG_HDR_GET_TYPE(rcvd[0]) == HFI_MSG_ACK) {
+			a6xx_receive_ack_async(adreno_dev, rcvd);
+		} else if (MSG_HDR_GET_ID(rcvd[0]) == F2H_MSG_TS_RETIRE) {
+			adreno_hwsched_trigger(adreno_dev);
+			log_profiling_info(adreno_dev, rcvd);
+		} else if (MSG_HDR_GET_ID(rcvd[0]) == F2H_MSG_GMU_CNTR_RELEASE) {
+			struct hfi_gmu_cntr_release_cmd *cmd =
+				(struct hfi_gmu_cntr_release_cmd *) rcvd;
+
+			adreno_perfcounter_put(adreno_dev,
+				cmd->group_id, cmd->countable, PERFCOUNTER_FLAG_KERNEL);
+		}
+	}
+	mutex_unlock(&hw_hfi->msgq_mutex);
+}
+
+static void process_log_block(struct adreno_device *adreno_dev, void *data)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_log_block *cmd = data;
+	u32 *log_event = gmu->gmu_log->hostptr;
+	u32 start, end;
+
+	start = cmd->start_index;
+	end = cmd->stop_index;
+
+	log_event += start * 4;
+	while (start != end) {
+		trace_gmu_event(log_event);
+		log_event += 4;
+		start++;
+	}
+}
+
+static void a6xx_hwsched_process_dbgq(struct adreno_device *adreno_dev, bool limited)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 rcvd[MAX_RCVD_SIZE];
+	bool recovery = false;
+
+	while (a6xx_hfi_queue_read(gmu, HFI_DBG_ID, rcvd, sizeof(rcvd)) > 0) {
+
+		if (MSG_HDR_GET_ID(rcvd[0]) == F2H_MSG_ERR) {
+			adreno_a6xx_receive_err_req(gmu, rcvd);
+			recovery = true;
+			break;
+		}
+
+		if (MSG_HDR_GET_ID(rcvd[0]) == F2H_MSG_DEBUG)
+			adreno_a6xx_receive_debug_req(gmu, rcvd);
+
+		if (MSG_HDR_GET_ID(rcvd[0]) == F2H_MSG_LOG_BLOCK)
+			process_log_block(adreno_dev, rcvd);
+
+		/* Process one debug queue message and return to not delay msgq processing */
+		if (limited)
+			break;
+	}
+
+	if (!recovery)
+		return;
+
+	adreno_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+}
+
+/* HFI interrupt handler */
+static irqreturn_t a6xx_hwsched_hfi_handler(int irq, void *data)
+{
+	struct adreno_device *adreno_dev = data;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 status = 0;
+
+	/*
+	 * A6XX_GMU_GMU2HOST_INTR_INFO may have bits set not specified in hfi->irq_mask.
+	 * Read and clear only those irq bits that we are processing here.
+	 */
+	gmu_core_regread(device, A6XX_GMU_GMU2HOST_INTR_INFO, &status);
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, status & hfi->irq_mask);
+
+	/*
+	 * If interrupts are not enabled on the HFI message queue,
+	 * the inline message processing loop will process it,
+	 * else, process it here.
+	 */
+	if (!(hfi->irq_mask & HFI_IRQ_MSGQ_MASK))
+		status &= ~HFI_IRQ_MSGQ_MASK;
+
+	if (status & (HFI_IRQ_MSGQ_MASK | HFI_IRQ_DBGQ_MASK)) {
+		wake_up_interruptible(&hfi->f2h_wq);
+		adreno_hwsched_trigger(adreno_dev);
+	}
+	if (status & HFI_IRQ_CM3_FAULT_MASK) {
+		atomic_set(&gmu->cm3_fault, 1);
+
+		/* make sure other CPUs see the update */
+		smp_wmb();
+
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"GMU CM3 fault interrupt received\n");
+
+		adreno_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+	}
+
+	/* Ignore OOB bits */
+	status &= GENMASK(31 - (oob_max - 1), 0);
+
+	if (status & ~hfi->irq_mask)
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"Unhandled HFI interrupts 0x%x\n",
+			status & ~hfi->irq_mask);
+
+	return IRQ_HANDLED;
+}
+
+#define HFI_IRQ_MSGQ_MASK BIT(0)
+
+static int check_ack_failure(struct adreno_device *adreno_dev,
+	struct pending_cmd *ack)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	if (ack->results[2] != 0xffffffff)
+		return 0;
+
+	dev_err(&gmu->pdev->dev,
+		"ACK error: sender id %d seqnum %d\n",
+		MSG_HDR_GET_ID(ack->sent_hdr),
+		MSG_HDR_GET_SEQNUM(ack->sent_hdr));
+
+	return -EINVAL;
+}
+
+int a6xx_hfi_send_cmd_async(struct adreno_device *adreno_dev, void *data, u32 size_bytes)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	u32 *cmd = data;
+	u32 seqnum;
+	int rc;
+	struct pending_cmd pending_ack;
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	*cmd = MSG_HDR_SET_SEQNUM_SIZE(*cmd, seqnum, size_bytes >> 2);
+
+	add_waiter(hfi, *cmd, &pending_ack);
+
+	rc = a6xx_hfi_cmdq_write(adreno_dev, cmd, size_bytes);
+	if (rc)
+		goto done;
+
+	rc = adreno_hwsched_wait_ack_completion(adreno_dev, &gmu->pdev->dev, &pending_ack,
+		a6xx_hwsched_process_msgq);
+	if (rc)
+		goto done;
+
+	rc = check_ack_failure(adreno_dev, &pending_ack);
+
+done:
+	del_waiter(hfi, &pending_ack);
+
+	return rc;
+}
+
+static void init_queues(struct a6xx_hfi *hfi)
+{
+	u32 gmuaddr = hfi->hfi_mem->gmuaddr;
+	struct hfi_queue_table hfi_table = {
+		.qtbl_hdr = {
+			.version = 0,
+			.size = sizeof(struct hfi_queue_table) >> 2,
+			.qhdr0_offset =
+				sizeof(struct hfi_queue_table_header) >> 2,
+			.qhdr_size = sizeof(struct hfi_queue_header) >> 2,
+			.num_q = HFI_QUEUE_MAX,
+			.num_active_q = HFI_QUEUE_MAX,
+		},
+		.qhdr = {
+			DEFINE_QHDR(gmuaddr, HFI_CMD_ID, 0),
+			DEFINE_QHDR(gmuaddr, HFI_MSG_ID, 0),
+			DEFINE_QHDR(gmuaddr, HFI_DBG_ID, 0),
+			/* 4 DQs for RB priority 0 */
+			DEFINE_QHDR(gmuaddr, 3, 0),
+			DEFINE_QHDR(gmuaddr, 4, 0),
+			DEFINE_QHDR(gmuaddr, 5, 0),
+			DEFINE_QHDR(gmuaddr, 6, 0),
+			/* 4 DQs for RB priority 1 */
+			DEFINE_QHDR(gmuaddr, 7, 1),
+			DEFINE_QHDR(gmuaddr, 8, 1),
+			DEFINE_QHDR(gmuaddr, 9, 1),
+			DEFINE_QHDR(gmuaddr, 10, 1),
+			/* 3 DQs for RB priority 2 */
+			DEFINE_QHDR(gmuaddr, 11, 2),
+			DEFINE_QHDR(gmuaddr, 12, 2),
+			DEFINE_QHDR(gmuaddr, 13, 2),
+			/* 3 DQs for RB priority 3 */
+			DEFINE_QHDR(gmuaddr, 14, 3),
+			DEFINE_QHDR(gmuaddr, 15, 3),
+			DEFINE_QHDR(gmuaddr, 16, 3),
+		},
+	};
+
+	memcpy(hfi->hfi_mem->hostptr, &hfi_table, sizeof(hfi_table));
+}
+
+/* Total header sizes + queue sizes + 16 for alignment */
+#define HFIMEM_SIZE (sizeof(struct hfi_queue_table) + 16 + \
+	(SZ_4K * HFI_QUEUE_MAX))
+
+static int hfi_f2h_main(void *arg);
+
+int a6xx_hwsched_hfi_init(struct adreno_device *adreno_dev)
+{
+	struct a6xx_hwsched_hfi *hw_hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	struct a6xx_hfi *hfi = to_a6xx_hfi(adreno_dev);
+
+	if (IS_ERR_OR_NULL(hw_hfi->big_ib)) {
+		hw_hfi->big_ib = reserve_gmu_kernel_block(to_a6xx_gmu(adreno_dev),
+				0,
+				HWSCHED_MAX_IBS * sizeof(struct hfi_issue_ib),
+				GMU_NONCACHED_KERNEL, 0);
+		if (IS_ERR(hw_hfi->big_ib))
+			return PTR_ERR(hw_hfi->big_ib);
+	}
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_LSR) &&
+			IS_ERR_OR_NULL(hw_hfi->big_ib_recurring)) {
+		hw_hfi->big_ib_recurring = reserve_gmu_kernel_block(
+				to_a6xx_gmu(adreno_dev), 0,
+				HWSCHED_MAX_IBS * sizeof(struct hfi_issue_ib),
+				GMU_NONCACHED_KERNEL, 0);
+		if (IS_ERR(hw_hfi->big_ib_recurring))
+			return PTR_ERR(hw_hfi->big_ib_recurring);
+	}
+
+	if (IS_ERR_OR_NULL(hfi->hfi_mem)) {
+		hfi->hfi_mem = reserve_gmu_kernel_block(to_a6xx_gmu(adreno_dev),
+				0, HFIMEM_SIZE, GMU_NONCACHED_KERNEL, 0);
+		if (IS_ERR(hfi->hfi_mem))
+			return PTR_ERR(hfi->hfi_mem);
+		init_queues(hfi);
+	}
+
+	if (IS_ERR_OR_NULL(hw_hfi->f2h_task))
+		hw_hfi->f2h_task = kthread_run(hfi_f2h_main, adreno_dev, "gmu_f2h");
+
+	return PTR_ERR_OR_ZERO(hw_hfi->f2h_task);
+}
+
+static int get_attrs(u32 flags)
+{
+	int attrs = IOMMU_READ;
+
+	if (flags & HFI_MEMFLAG_GMU_PRIV)
+		attrs |= IOMMU_PRIV;
+
+	if (flags & HFI_MEMFLAG_GMU_WRITEABLE)
+		attrs |= IOMMU_WRITE;
+
+	return attrs;
+}
+
+static int gmu_import_buffer(struct adreno_device *adreno_dev,
+	struct hfi_mem_alloc_entry *entry)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_mem_alloc_desc *desc = &entry->desc;
+	int attrs = get_attrs(desc->flags);
+	struct gmu_vma_entry *vma = &gmu->vma[GMU_NONCACHED_KERNEL];
+	int ret;
+
+	if (desc->flags & HFI_MEMFLAG_GMU_CACHEABLE)
+		vma = &gmu->vma[GMU_CACHE];
+
+	if ((vma->next_va + desc->size) > (vma->start + vma->size)) {
+		dev_err(&gmu->pdev->dev,
+			"GMU mapping too big. available: %d required: %d\n",
+			vma->next_va - vma->start, desc->size);
+		return -ENOMEM;
+	}
+
+
+	ret = gmu_core_map_memdesc(gmu->domain, entry->md, vma->next_va, attrs);
+	if (ret) {
+		dev_err(&gmu->pdev->dev, "gmu map err: 0x%08x, %x\n",
+			vma->next_va, attrs);
+		return ret;
+	}
+
+	entry->md->gmuaddr = vma->next_va;
+	vma->next_va += desc->size;
+	return 0;
+}
+
+static struct hfi_mem_alloc_entry *lookup_mem_alloc_table(
+	struct adreno_device *adreno_dev, struct hfi_mem_alloc_desc *desc)
+{
+	struct a6xx_hwsched_hfi *hw_hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	int i;
+
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct hfi_mem_alloc_entry *entry = &hw_hfi->mem_alloc_table[i];
+
+		if ((entry->desc.mem_kind == desc->mem_kind) &&
+			(entry->desc.gmu_mem_handle == desc->gmu_mem_handle))
+			return entry;
+	}
+
+	return NULL;
+}
+
+static struct hfi_mem_alloc_entry *get_mem_alloc_entry(
+	struct adreno_device *adreno_dev, struct hfi_mem_alloc_desc *desc)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	struct hfi_mem_alloc_entry *entry =
+		lookup_mem_alloc_table(adreno_dev, desc);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u64 flags = 0;
+	u32 priv = 0;
+	int ret;
+	const char *memkind_string = desc->mem_kind < HFI_MEMKIND_MAX ?
+			hfi_memkind_strings[desc->mem_kind] : "UNKNOWN";
+
+	if (entry)
+		return entry;
+
+	if (desc->mem_kind >= HFI_MEMKIND_MAX) {
+		dev_err(&gmu->pdev->dev, "Invalid mem kind: %d\n",
+			desc->mem_kind);
+		return ERR_PTR(-EINVAL);
+	}
+
+	if (hfi->mem_alloc_entries == ARRAY_SIZE(hfi->mem_alloc_table)) {
+		dev_err(&gmu->pdev->dev,
+			"Reached max mem alloc entries\n");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	entry = &hfi->mem_alloc_table[hfi->mem_alloc_entries];
+
+	memcpy(&entry->desc, desc, sizeof(*desc));
+
+	entry->desc.host_mem_handle = desc->gmu_mem_handle;
+
+	if (desc->flags & HFI_MEMFLAG_GFX_PRIV)
+		priv |= KGSL_MEMDESC_PRIVILEGED;
+
+	if (!(desc->flags & HFI_MEMFLAG_GFX_WRITEABLE))
+		flags |= KGSL_MEMFLAGS_GPUREADONLY;
+
+	if (desc->flags & HFI_MEMFLAG_GFX_SECURE)
+		flags |= KGSL_MEMFLAGS_SECURE;
+
+	if (!(desc->flags & HFI_MEMFLAG_GFX_ACC)) {
+		if (desc->mem_kind == HFI_MEMKIND_MMIO_IPC_CORE)
+			entry->md = reserve_gmu_kernel_block_fixed(gmu, 0, desc->size,
+					(desc->flags & HFI_MEMFLAG_GMU_CACHEABLE) ?
+					GMU_CACHE : GMU_NONCACHED_KERNEL,
+					"qcom,ipc-core", get_attrs(desc->flags), desc->align);
+		else
+			entry->md = reserve_gmu_kernel_block(gmu, 0, desc->size,
+					(desc->flags & HFI_MEMFLAG_GMU_CACHEABLE) ?
+					GMU_CACHE : GMU_NONCACHED_KERNEL, desc->align);
+
+		if (IS_ERR(entry->md)) {
+			int ret = PTR_ERR(entry->md);
+
+			memset(entry, 0, sizeof(*entry));
+			return ERR_PTR(ret);
+		}
+		entry->desc.size = entry->md->size;
+		entry->desc.gmu_addr = entry->md->gmuaddr;
+
+		goto done;
+	}
+
+	entry->md = kgsl_allocate_global(device, desc->size, 0, flags, priv,
+		memkind_string);
+	if (IS_ERR(entry->md)) {
+		int ret = PTR_ERR(entry->md);
+
+		memset(entry, 0, sizeof(*entry));
+		return ERR_PTR(ret);
+	}
+
+	entry->desc.size = entry->md->size;
+	entry->desc.gpu_addr = entry->md->gpuaddr;
+
+	if (!(desc->flags & HFI_MEMFLAG_GMU_ACC))
+		goto done;
+
+	 /*
+	  * If gmu mapping fails, then we have to live with
+	  * leaking the gpu global buffer allocated above.
+	  */
+	ret = gmu_import_buffer(adreno_dev, entry);
+	if (ret) {
+		dev_err(&gmu->pdev->dev,
+			"gpuaddr: 0x%llx size: %lld bytes lost\n",
+			entry->md->gpuaddr, entry->md->size);
+		memset(entry, 0, sizeof(*entry));
+		return ERR_PTR(ret);
+	}
+
+	entry->desc.gmu_addr = entry->md->gmuaddr;
+done:
+	hfi->mem_alloc_entries++;
+
+	return entry;
+}
+
+static int process_mem_alloc(struct adreno_device *adreno_dev,
+	struct hfi_mem_alloc_desc *mad)
+{
+	struct hfi_mem_alloc_entry *entry;
+
+	entry = get_mem_alloc_entry(adreno_dev, mad);
+	if (IS_ERR(entry))
+		return PTR_ERR(entry);
+
+	if (entry->md) {
+		mad->gpu_addr = entry->md->gpuaddr;
+		mad->gmu_addr = entry->md->gmuaddr;
+	}
+
+	/*
+	 * GMU uses the host_mem_handle to check if this memalloc was
+	 * successful
+	 */
+	mad->host_mem_handle = mad->gmu_mem_handle;
+
+	return 0;
+}
+
+static int mem_alloc_reply(struct adreno_device *adreno_dev, void *rcvd)
+{
+	struct hfi_mem_alloc_desc desc = {0};
+	struct hfi_mem_alloc_reply_cmd out = {0};
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 seqnum;
+	int ret;
+
+	hfi_get_mem_alloc_desc(rcvd, &desc);
+
+	ret = process_mem_alloc(adreno_dev, &desc);
+	if (ret)
+		return ret;
+
+	memcpy(&out.desc, &desc, sizeof(out.desc));
+
+	out.hdr = ACK_MSG_HDR(F2H_MSG_MEM_ALLOC);
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	out.hdr = MSG_HDR_SET_SEQNUM_SIZE(out.hdr, seqnum, sizeof(out) >> 2);
+	out.req_hdr = *(u32 *)rcvd;
+
+	return a6xx_hfi_cmdq_write(adreno_dev, (u32 *)&out, sizeof(out));
+}
+
+static int gmu_cntr_register_reply(struct adreno_device *adreno_dev, void *rcvd)
+{
+	struct hfi_gmu_cntr_register_cmd *in = (struct hfi_gmu_cntr_register_cmd *)rcvd;
+	struct hfi_gmu_cntr_register_reply_cmd out = {0};
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 lo = 0, hi = 0, seqnum;
+
+	/*
+	 * Failure to allocate counter is not fatal. Sending lo = 0, hi = 0
+	 * indicates to GMU that counter allocation failed.
+	 */
+	adreno_perfcounter_get(adreno_dev,
+		in->group_id, in->countable, &lo, &hi, PERFCOUNTER_FLAG_KERNEL);
+
+	out.hdr = ACK_MSG_HDR(F2H_MSG_GMU_CNTR_REGISTER);
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	out.hdr = MSG_HDR_SET_SEQNUM_SIZE(out.hdr, seqnum, sizeof(out) >> 2);
+	out.req_hdr = in->hdr;
+	out.group_id = in->group_id;
+	out.countable = in->countable;
+	/* Fill in byte offset of counter */
+	out.cntr_lo = lo << 2;
+	out.cntr_hi = hi << 2;
+
+	return a6xx_hfi_cmdq_write(adreno_dev, (u32 *)&out, sizeof(out));
+}
+
+static int send_start_msg(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 seqnum;
+	int rc, read_size;
+	struct hfi_start_cmd cmd;
+	u32 rcvd[MAX_RCVD_SIZE];
+	struct pending_cmd pending_ack = {0};
+
+	rc = CMD_MSG_HDR(cmd, H2F_MSG_START);
+	if (rc)
+		return rc;
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	cmd.hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd.hdr, seqnum, sizeof(cmd) >> 2);
+
+	pending_ack.sent_hdr = cmd.hdr;
+
+	rc = a6xx_hfi_cmdq_write(adreno_dev, (u32 *)&cmd, sizeof(cmd));
+	if (rc)
+		return rc;
+
+	/*
+	 * This will never be an infinite loop. We break out either when we receive the
+	 * HFI_MSG_ACK or when we timeout waiting for the ack.
+	 */
+	while (true) {
+		rc = gmu_core_timed_poll_check(device, A6XX_GMU_GMU2HOST_INTR_INFO,
+			HFI_IRQ_MSGQ_MASK, HFI_RSP_TIMEOUT, HFI_IRQ_MSGQ_MASK);
+
+		if (rc) {
+			dev_err(&gmu->pdev->dev,
+				"Timed out processing MSG_START seqnum: %d\n",
+				seqnum);
+			gmu_core_fault_snapshot(device);
+			return rc;
+		}
+
+		/* Clear the interrupt */
+		gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, HFI_IRQ_MSGQ_MASK);
+
+		read_size = a6xx_hfi_queue_read(gmu, HFI_MSG_ID, rcvd, sizeof(rcvd));
+
+		if (read_size <= 0) {
+			dev_err(&gmu->pdev->dev, "MSG_START: no payload\n");
+			gmu_core_fault_snapshot(device);
+			return -EINVAL;
+		}
+		/* Loop through the msg queue to read all messages */
+		while (read_size > 0) {
+			switch (MSG_HDR_GET_ID(rcvd[0])) {
+			case F2H_MSG_MEM_ALLOC:
+				rc = mem_alloc_reply(adreno_dev, rcvd);
+				break;
+			case F2H_MSG_GMU_CNTR_REGISTER:
+				rc = gmu_cntr_register_reply(adreno_dev, rcvd);
+				break;
+			default:
+				if (MSG_HDR_GET_TYPE(rcvd[0]) == HFI_MSG_ACK) {
+					rc = a6xx_receive_ack_cmd(gmu, rcvd, &pending_ack);
+					if (rc)
+						return rc;
+
+					return check_ack_failure(adreno_dev, &pending_ack);
+				}
+
+				dev_err(&gmu->pdev->dev,
+					"MSG_START: unexpected response id:%d, type:%d\n",
+					MSG_HDR_GET_ID(rcvd[0]),
+					MSG_HDR_GET_TYPE(rcvd[0]));
+				gmu_core_fault_snapshot(device);
+				return -EINVAL;
+			}
+
+			if (rc)
+				return rc;
+
+			/* Clear the interrupt before checking the queue again */
+			gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, HFI_IRQ_MSGQ_MASK);
+			read_size = a6xx_hfi_queue_read(gmu, HFI_MSG_ID, rcvd, sizeof(rcvd));
+		}
+	}
+}
+
+static void reset_hfi_mem_records(struct adreno_device *adreno_dev)
+{
+	struct a6xx_hwsched_hfi *hw_hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	struct kgsl_memdesc *md = NULL;
+	u32 i;
+
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct hfi_mem_alloc_desc *desc = &hw_hfi->mem_alloc_table[i].desc;
+
+		if (desc->flags & HFI_MEMFLAG_HOST_INIT) {
+			md = hw_hfi->mem_alloc_table[i].md;
+			memset(md->hostptr, 0x0, md->size);
+		}
+	}
+}
+
+static void reset_hfi_queues(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_queue_table *tbl = gmu->hfi.hfi_mem->hostptr;
+	u32 i;
+
+	/* Flush HFI queues */
+	for (i = 0; i < HFI_QUEUE_MAX; i++) {
+		struct hfi_queue_header *hdr = &tbl->qhdr[i];
+
+		if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+			continue;
+
+		hdr->read_index = hdr->write_index;
+	}
+}
+
+void a6xx_hwsched_hfi_stop(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+
+	hfi->irq_mask &= ~HFI_IRQ_MSGQ_MASK;
+
+	/*
+	 * In some corner cases, it is possible that GMU put TS_RETIRE
+	 * on the msgq after we have turned off gmu interrupts. Hence,
+	 * drain the queue one last time before we reset HFI queues.
+	 */
+	a6xx_hwsched_process_msgq(adreno_dev);
+
+	/* Drain the debug queue before we reset HFI queues */
+	a6xx_hwsched_process_dbgq(adreno_dev, false);
+
+	kgsl_pwrctrl_axi(KGSL_DEVICE(adreno_dev), false);
+
+	clear_bit(GMU_PRIV_HFI_STARTED, &gmu->flags);
+
+	/*
+	 * Reset the hfi host access memory records, As GMU expects hfi memory
+	 * records to be clear in bootup.
+	 */
+	reset_hfi_mem_records(adreno_dev);
+}
+
+static void enable_async_hfi(struct adreno_device *adreno_dev)
+{
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+
+	hfi->irq_mask |= HFI_IRQ_MSGQ_MASK;
+
+	gmu_core_regwrite(KGSL_DEVICE(adreno_dev), A6XX_GMU_GMU2HOST_INTR_MASK,
+		(u32)~hfi->irq_mask);
+}
+
+static int enable_preemption(struct adreno_device *adreno_dev)
+{
+	u32 data;
+	int ret;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	/*
+	 * Bits [0:1] contains the preemption level
+	 * Bit 2 is to enable/disable gmem save/restore
+	 * Bit 3 is to enable/disable skipsaverestore
+	 */
+	data = FIELD_PREP(GENMASK(1, 0), adreno_dev->preempt.preempt_level) |
+			FIELD_PREP(BIT(2), adreno_dev->preempt.usesgmem) |
+			FIELD_PREP(BIT(3), adreno_dev->preempt.skipsaverestore);
+
+	ret = a6xx_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_PREEMPTION, 1,
+			data);
+	if (ret)
+		return ret;
+
+	/*
+	 * Bits[3:0] contain the preemption timeout enable bit per ringbuffer
+	 * Bits[31:4] contain the timeout in ms
+	 */
+	return a6xx_hfi_send_set_value(adreno_dev, HFI_VALUE_BIN_TIME, 1,
+			FIELD_PREP(GENMASK(31, 4), ADRENO_PREEMPT_TIMEOUT) |
+			FIELD_PREP(GENMASK(3, 0), 0xf));
+}
+
+static int enable_gmu_stats(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	u32 data;
+
+	if (!gmu->stats_enable)
+		return 0;
+
+	/*
+	 * Bits [23:0] contains the countables mask
+	 * Bits [31:24] is the sampling interval
+	 */
+	data = FIELD_PREP(GENMASK(23, 0), gmu->stats_mask) |
+		FIELD_PREP(GENMASK(31, 24), gmu->stats_interval);
+
+	return a6xx_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_GMU_STATS, 1, data);
+}
+
+static int a6xx_hfi_send_perfcounter_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	/*
+	 * Perfcounter retention is disabled by default in GMU firmware.
+	 * In case perfcounter retention behaviour is overwritten by sysfs
+	 * setting dynmaically, send this HFI feature with 'enable = 0' to
+	 * disable this feature in GMU firmware.
+	 */
+	if (adreno_dev->perfcounter)
+		return a6xx_hfi_send_feature_ctrl(adreno_dev,
+				HFI_FEATURE_PERF_NORETAIN, 0, 0);
+
+	return 0;
+}
+
+int a6xx_hwsched_hfi_start(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	reset_hfi_queues(adreno_dev);
+
+	ret = a6xx_gmu_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = a6xx_hfi_send_generic_req(adreno_dev, &gmu->hfi.dcvs_table,
+		sizeof(gmu->hfi.dcvs_table));
+	if (ret)
+		goto err;
+
+	ret = a6xx_hfi_send_generic_req(adreno_dev, &gmu->hfi.bw_table, sizeof(gmu->hfi.bw_table));
+	if (ret)
+		goto err;
+
+	ret = a6xx_hfi_send_acd_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = a6xx_hfi_send_lm_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = a6xx_hfi_send_bcl_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = a6xx_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_HWSCHED, 1, 0);
+	if (ret)
+		goto err;
+
+	ret = a6xx_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_A6XX_KPROF,
+			1, 0);
+	if (ret)
+		goto err;
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_LSR)) {
+		ret = a6xx_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_LSR,
+				1, 0);
+		if (ret)
+			goto err;
+	}
+
+	ret = a6xx_hfi_send_perfcounter_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	/* Enable the long ib timeout detection */
+	if (adreno_long_ib_detect(adreno_dev)) {
+		ret = a6xx_hfi_send_feature_ctrl(adreno_dev,
+			HFI_FEATURE_BAIL_OUT_TIMER, 1, 0);
+		if (ret)
+			goto err;
+	}
+
+	enable_gmu_stats(adreno_dev);
+
+	if (gmu->log_stream_enable)
+		a6xx_hfi_send_set_value(adreno_dev,
+			HFI_VALUE_LOG_STREAM_ENABLE, 0, 1);
+
+	if (gmu->log_group_mask)
+		a6xx_hfi_send_set_value(adreno_dev, HFI_VALUE_LOG_GROUP, 0, gmu->log_group_mask);
+
+	ret = a6xx_hfi_send_core_fw_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = enable_preemption(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = send_start_msg(adreno_dev);
+	if (ret)
+		goto err;
+
+	enable_async_hfi(adreno_dev);
+
+	set_bit(GMU_PRIV_HFI_STARTED, &gmu->flags);
+
+	/* Request default DCVS level */
+	ret = kgsl_pwrctrl_set_default_gpu_pwrlevel(device);
+	if (ret)
+		goto err;
+
+	/* Request default BW vote */
+	ret = kgsl_pwrctrl_axi(device, true);
+	if (ret)
+		goto err;
+
+	/* Switch to min GMU clock */
+	a6xx_rdpm_cx_freq_update(gmu, gmu->freqs[0] / 1000);
+
+	ret = kgsl_clk_set_rate(gmu->clks, gmu->num_clks, "gmu_clk",
+			gmu->freqs[0]);
+	if (ret)
+		dev_err(&gmu->pdev->dev, "GMU clock:%d set failed:%d\n",
+			gmu->freqs[0], ret);
+
+err:
+	if (ret)
+		a6xx_hwsched_hfi_stop(adreno_dev);
+
+	return ret;
+}
+
+static int submit_raw_cmds(struct adreno_device *adreno_dev, void *cmds, u32 size_bytes,
+	const char *str)
+{
+	int ret;
+
+	ret = a6xx_hfi_send_cmd_async(adreno_dev, cmds, size_bytes);
+	if (ret)
+		return ret;
+
+	ret = gmu_core_timed_poll_check(KGSL_DEVICE(adreno_dev),
+			A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, 0, 200, BIT(23));
+	if (ret)
+		a6xx_spin_idle_debug(adreno_dev, str);
+
+	return ret;
+}
+
+static int cp_init(struct adreno_device *adreno_dev)
+{
+	u32 cmds[A6XX_CP_INIT_DWORDS + 1];
+
+	cmds[0] = CREATE_MSG_HDR(H2F_MSG_ISSUE_CMD_RAW, HFI_MSG_CMD);
+
+	a6xx_cp_init_cmds(adreno_dev, &cmds[1]);
+
+	return submit_raw_cmds(adreno_dev, cmds, sizeof(cmds),
+			"CP initialization failed to idle\n");
+}
+
+static int send_switch_to_unsecure(struct adreno_device *adreno_dev)
+{
+	u32 cmds[3];
+
+	cmds[0] = CREATE_MSG_HDR(H2F_MSG_ISSUE_CMD_RAW, HFI_MSG_CMD);
+
+	cmds[1] = cp_type7_packet(CP_SET_SECURE_MODE, 1);
+	cmds[2] = 0;
+
+	return  submit_raw_cmds(adreno_dev, cmds, sizeof(cmds),
+			"Switch to unsecure failed to idle\n");
+}
+
+int a6xx_hwsched_cp_init(struct adreno_device *adreno_dev)
+{
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_SQE);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/* Program the ucode base for CP */
+	kgsl_regwrite(device, A6XX_CP_SQE_INSTR_BASE_LO,
+		lower_32_bits(fw->memdesc->gpuaddr));
+	kgsl_regwrite(device, A6XX_CP_SQE_INSTR_BASE_HI,
+		upper_32_bits(fw->memdesc->gpuaddr));
+
+	ret = cp_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = adreno_zap_shader_load(adreno_dev, a6xx_core->zap_name);
+	if (ret)
+		return ret;
+
+	if (!adreno_dev->zap_loaded)
+		kgsl_regwrite(KGSL_DEVICE(adreno_dev),
+			A6XX_RBBM_SECVID_TRUST_CNTL, 0x0);
+	else
+		ret = send_switch_to_unsecure(adreno_dev);
+
+	return ret;
+}
+
+int a6xx_hwsched_counter_inline_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		u32 counter, u32 countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 val, cmds[A6XX_PERF_COUNTER_ENABLE_DWORDS + 1];
+	int ret;
+
+	if (group->flags & ADRENO_PERFCOUNTER_GROUP_RESTORE)
+		a6xx_perfcounter_update(adreno_dev, reg, false);
+
+	cmds[0] = CREATE_MSG_HDR(H2F_MSG_ISSUE_CMD_RAW, HFI_MSG_CMD);
+
+	cmds[1] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+	cmds[2] = cp_type4_packet(reg->select, 1);
+	cmds[3] = countable;
+
+	ret = a6xx_hfi_send_cmd_async(adreno_dev, cmds, sizeof(cmds));
+	if (ret)
+		goto err;
+
+	/* Wait till the register is programmed with the countable */
+	ret = kgsl_regmap_read_poll_timeout(&device->regmap, reg->select, val,
+				val == countable, 100, ADRENO_IDLE_TIMEOUT);
+	if (!ret) {
+		reg->value = 0;
+		return ret;
+	}
+
+err:
+	dev_err(device->dev, "Perfcounter %s/%u/%u start via commands failed\n",
+			group->name, counter, countable);
+	return ret;
+}
+
+static bool is_queue_empty(struct adreno_device *adreno_dev, u32 queue_idx)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	struct hfi_queue_table *tbl = mem_addr->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+		return true;
+
+	if (hdr->read_index == hdr->write_index)
+		return true;
+
+	return false;
+}
+
+static int hfi_f2h_main(void *arg)
+{
+	struct adreno_device *adreno_dev = arg;
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+
+	while (!kthread_should_stop()) {
+		wait_event_interruptible(hfi->f2h_wq, kthread_should_stop() ||
+			/* If msgq irq is enabled and msgq has messages to process */
+			(((hfi->irq_mask & HFI_IRQ_MSGQ_MASK) &&
+			!is_queue_empty(adreno_dev, HFI_MSG_ID)) ||
+			/* Trace buffer has messages to process */
+			!gmu_core_is_trace_empty(gmu->trace.md->hostptr) ||
+			/* Dbgq has messages to process */
+			!is_queue_empty(adreno_dev, HFI_DBG_ID)));
+
+		if (kthread_should_stop())
+			break;
+
+		a6xx_hwsched_process_msgq(adreno_dev);
+		gmu_core_process_trace_data(KGSL_DEVICE(adreno_dev),
+					&gmu->pdev->dev, &gmu->trace);
+		a6xx_hwsched_process_dbgq(adreno_dev, true);
+	}
+
+	return 0;
+}
+
+int a6xx_hwsched_hfi_probe(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hwsched_hfi *hw_hfi = to_a6xx_hwsched_hfi(adreno_dev);
+
+	gmu->hfi.irq = kgsl_request_irq(gmu->pdev, "kgsl_hfi_irq",
+		a6xx_hwsched_hfi_handler, adreno_dev);
+
+	if (gmu->hfi.irq < 0)
+		return gmu->hfi.irq;
+
+	hw_hfi->irq_mask = HFI_IRQ_MASK;
+
+	rwlock_init(&hw_hfi->msglock);
+
+	INIT_LIST_HEAD(&hw_hfi->msglist);
+
+	init_waitqueue_head(&hw_hfi->f2h_wq);
+
+	mutex_init(&hw_hfi->msgq_mutex);
+
+	return 0;
+}
+
+void a6xx_hwsched_hfi_remove(struct adreno_device *adreno_dev)
+{
+	struct a6xx_hwsched_hfi *hw_hfi = to_a6xx_hwsched_hfi(adreno_dev);
+
+	if (hw_hfi->f2h_task)
+		kthread_stop(hw_hfi->f2h_task);
+}
+
+static void a6xx_add_profile_events(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj_cmd *cmdobj, struct adreno_submit_time *time)
+{
+	unsigned long flags;
+	u64 time_in_s;
+	unsigned long time_in_ns;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct kgsl_context *context = drawobj->context;
+	struct submission_info info = {0};
+
+	if (!time)
+		return;
+
+	/*
+	 * Here we are attempting to create a mapping between the
+	 * GPU time domain (alwayson counter) and the CPU time domain
+	 * (local_clock) by sampling both values as close together as
+	 * possible. This is useful for many types of debugging and
+	 * profiling. In order to make this mapping as accurate as
+	 * possible, we must turn off interrupts to avoid running
+	 * interrupt handlers between the two samples.
+	 */
+
+	local_irq_save(flags);
+
+	/* Read always on registers */
+	time->ticks = a6xx_read_alwayson(adreno_dev);
+
+	/* Trace the GPU time to create a mapping to ftrace time */
+	trace_adreno_cmdbatch_sync(context->id, context->priority,
+		drawobj->timestamp, time->ticks);
+
+	/* Get the kernel clock for time since boot */
+	time->ktime = local_clock();
+
+	/* Get the timeofday for the wall time (for the user) */
+	ktime_get_real_ts64(&time->utime);
+
+	local_irq_restore(flags);
+
+	/* Return kernel clock time to the client if requested */
+	time_in_s = time->ktime;
+	time_in_ns = do_div(time_in_s, 1000000000);
+
+	info.inflight = -1;
+	info.rb_id = adreno_get_level(context);
+	info.gmu_dispatch_queue = context->gmu_dispatch_queue;
+
+	cmdobj->submit_ticks = time->ticks;
+
+	msm_perf_events_update(MSM_PERF_GFX, MSM_PERF_SUBMIT,
+		pid_nr(context->proc_priv->pid),
+		context->id, drawobj->timestamp,
+		!!(drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME));
+	trace_adreno_cmdbatch_submitted(drawobj, &info, time->ticks,
+		(unsigned long) time_in_s, time_in_ns / 1000, 0);
+
+	log_kgsl_cmdbatch_submitted_event(context->id, drawobj->timestamp,
+		context->priority, drawobj->flags);
+}
+
+static u32 get_next_dq(u32 priority)
+{
+	struct dq_info *info = &a6xx_hfi_dqs[priority];
+	u32 next = info->base_dq_id + info->offset;
+
+	info->offset = (info->offset + 1) % info->max_dq;
+
+	return next;
+}
+
+static u32 get_dq_id(struct kgsl_context *context)
+{
+	u32 level = adreno_get_level(context);
+
+	return get_next_dq(level);
+}
+
+static int send_context_register(struct adreno_device *adreno_dev,
+	struct kgsl_context *context)
+{
+	struct hfi_register_ctxt_cmd cmd;
+	struct kgsl_pagetable *pt = context->proc_priv->pagetable;
+	int ret, asid = kgsl_mmu_pagetable_get_asid(pt, context);
+
+	if (asid < 0)
+		return asid;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_REGISTER_CONTEXT);
+	if (ret)
+		return ret;
+
+	cmd.ctxt_id = context->id;
+	cmd.flags = HFI_CTXT_FLAG_NOTIFY | context->flags;
+
+	/*
+	 * HLOS SMMU driver programs context bank to look up ASID from TTBR0 during a page
+	 * table walk. So the TLB entries are tagged with the ASID from TTBR0. TLBIASID
+	 * invalidates TLB entries whose ASID matches the value that was written to the
+	 * CBn_TLBIASID register. Set ASID along with PT address.
+	 */
+	cmd.pt_addr = kgsl_mmu_pagetable_get_ttbr0(pt) |
+		FIELD_PREP(GENMASK_ULL(63, KGSL_IOMMU_ASID_START_BIT), asid);
+	cmd.ctxt_idr = pid_nr(context->proc_priv->pid);
+	cmd.ctxt_bank = kgsl_mmu_pagetable_get_context_bank(pt, context);
+
+	return a6xx_hfi_send_cmd_async(adreno_dev, &cmd, sizeof(cmd));
+}
+
+static int send_context_pointers(struct adreno_device *adreno_dev,
+	struct kgsl_context *context)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct hfi_context_pointers_cmd cmd = {0};
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_CONTEXT_POINTERS);
+	if (ret)
+		return ret;
+
+	cmd.ctxt_id = context->id;
+	cmd.sop_addr = MEMSTORE_ID_GPU_ADDR(device, context->id, soptimestamp);
+	cmd.eop_addr = MEMSTORE_ID_GPU_ADDR(device, context->id, eoptimestamp);
+	if (context->user_ctxt_record)
+		cmd.user_ctxt_record_addr =
+			context->user_ctxt_record->memdesc.gpuaddr;
+
+	return a6xx_hfi_send_cmd_async(adreno_dev, &cmd, sizeof(cmd));
+}
+
+static int hfi_context_register(struct adreno_device *adreno_dev,
+	struct kgsl_context *context)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (context->gmu_registered)
+		return 0;
+
+	ret = send_context_register(adreno_dev, context);
+	if (ret) {
+		dev_err(&gmu->pdev->dev,
+			"Unable to register context %u: %d\n",
+			context->id, ret);
+
+		if (device->gmu_fault)
+			adreno_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+
+		return ret;
+	}
+
+	ret = send_context_pointers(adreno_dev, context);
+	if (ret) {
+		dev_err(&gmu->pdev->dev,
+			"Unable to register context %u pointers: %d\n",
+			context->id, ret);
+
+		if (device->gmu_fault)
+			adreno_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+
+		return ret;
+	}
+
+	context->gmu_registered = true;
+	context->gmu_dispatch_queue = get_dq_id(context);
+
+	return 0;
+}
+
+static void populate_ibs(struct adreno_device *adreno_dev,
+	struct hfi_submit_cmd *cmd, struct kgsl_drawobj_cmd *cmdobj)
+{
+	struct hfi_issue_ib *issue_ib;
+	struct kgsl_memobj_node *ib;
+
+	if (cmdobj->numibs > HWSCHED_MAX_DISPATCH_NUMIBS) {
+		struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+		struct kgsl_memdesc *big_ib;
+
+		if (test_bit(CMDOBJ_RECURRING_START, &cmdobj->priv))
+			big_ib = hfi->big_ib_recurring;
+		else
+			big_ib = hfi->big_ib;
+		/*
+		 * The dispatcher ensures that there is only one big IB inflight
+		 */
+		cmd->big_ib_gmu_va = big_ib->gmuaddr;
+		cmd->flags |= CMDBATCH_INDIRECT;
+		issue_ib = big_ib->hostptr;
+	} else {
+		issue_ib = (struct hfi_issue_ib *)&cmd[1];
+	}
+
+	list_for_each_entry(ib, &cmdobj->cmdlist, node) {
+		issue_ib->addr = ib->gpuaddr;
+		issue_ib->size = ib->size;
+		issue_ib++;
+	}
+
+	cmd->numibs = cmdobj->numibs;
+}
+
+/* Size in below functions are in unit of dwords */
+static int a6xx_hfi_dispatch_queue_write(struct adreno_device *adreno_dev, uint32_t queue_idx,
+	uint32_t *msg, u32 size_bytes, struct kgsl_drawobj_cmd *cmdobj,
+	struct adreno_submit_time *time)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct hfi_queue_table *tbl = gmu->hfi.hfi_mem->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+	uint32_t *queue;
+	uint32_t i, write, empty_space;
+	uint32_t size_dwords = size_bytes >> 2;
+	u32 align_size = ALIGN(size_dwords, SZ_4);
+	uint32_t id = MSG_HDR_GET_ID(*msg);
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED || !IS_ALIGNED(size_bytes, sizeof(u32)))
+		return -EINVAL;
+
+	queue = HOST_QUEUE_START_ADDR(gmu->hfi.hfi_mem, queue_idx);
+
+	empty_space = (hdr->write_index >= hdr->read_index) ?
+			(hdr->queue_size - (hdr->write_index - hdr->read_index))
+			: (hdr->read_index - hdr->write_index);
+
+	if (empty_space <= align_size)
+		return -ENOSPC;
+
+	write = hdr->write_index;
+
+	for (i = 0; i < size_dwords; i++) {
+		queue[write] = msg[i];
+		write = (write + 1) % hdr->queue_size;
+	}
+
+	/* Cookify any non used data at the end of the write buffer */
+	if (GMU_VER_MAJOR(gmu->ver.hfi) >= 2) {
+		for (; i < align_size; i++) {
+			queue[write] = 0xFAFAFAFA;
+			write = (write + 1) % hdr->queue_size;
+		}
+	}
+
+	/* Ensure packet is written out before proceeding */
+	wmb();
+
+	a6xx_add_profile_events(adreno_dev, cmdobj, time);
+
+	/*
+	 * Put the profiling information in the user profiling buffer.
+	 * The hfi_update_write_idx below has a wmb() before the actual
+	 * write index update to ensure that the GMU does not see the
+	 * packet before the profile data is written out.
+	 */
+	adreno_profile_submit_time(time);
+
+	trace_kgsl_hfi_send(id, size_dwords, MSG_HDR_GET_SEQNUM(*msg));
+
+	hfi_update_write_idx(&hdr->write_index, write);
+
+	return 0;
+}
+
+#define HFI_DSP_IRQ_BASE 2
+
+#define DISPQ_IRQ_BIT(_idx) BIT((_idx) + HFI_DSP_IRQ_BASE)
+
+int a6xx_hwsched_submit_drawobj(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj *drawobj)
+{
+	int ret = 0;
+	u32 cmd_sizebytes, seqnum;
+	struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj);
+	struct hfi_submit_cmd *cmd;
+	struct adreno_submit_time time = {0};
+	static void *cmdbuf;
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+
+	if (cmdbuf == NULL) {
+		struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+		cmdbuf = devm_kzalloc(&device->pdev->dev, HFI_MAX_MSG_SIZE,
+			GFP_KERNEL);
+		if (!cmdbuf)
+			return -ENOMEM;
+	}
+
+	ret = hfi_context_register(adreno_dev, drawobj->context);
+	if (ret)
+		return ret;
+
+	/* Add a *issue_ib struct for each IB */
+	if (cmdobj->numibs > HWSCHED_MAX_DISPATCH_NUMIBS ||
+		test_bit(CMDOBJ_SKIP, &cmdobj->priv))
+		cmd_sizebytes = sizeof(*cmd);
+	else
+		cmd_sizebytes = sizeof(*cmd) +
+			(sizeof(struct hfi_issue_ib) * cmdobj->numibs);
+
+	if (WARN_ON(cmd_sizebytes > HFI_MAX_MSG_SIZE))
+		return -EMSGSIZE;
+
+	memset(cmdbuf, 0x0, cmd_sizebytes);
+
+	cmd = cmdbuf;
+
+	cmd->ctxt_id = drawobj->context->id;
+	cmd->flags = HFI_CTXT_FLAG_NOTIFY;
+	if (drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME)
+		cmd->flags |= CMDBATCH_EOF;
+
+	cmd->ts = drawobj->timestamp;
+
+	if (test_bit(CMDOBJ_SKIP, &cmdobj->priv))
+		goto skipib;
+
+	populate_ibs(adreno_dev, cmd, cmdobj);
+
+	if ((drawobj->flags & KGSL_DRAWOBJ_PROFILING) &&
+		cmdobj->profiling_buf_entry) {
+
+		time.drawobj = drawobj;
+
+		cmd->profile_gpuaddr_lo =
+			lower_32_bits(cmdobj->profiling_buffer_gpuaddr);
+		cmd->profile_gpuaddr_hi =
+			upper_32_bits(cmdobj->profiling_buffer_gpuaddr);
+
+		/* Indicate to GMU to do user profiling for this submission */
+		cmd->flags |= CMDBATCH_PROFILING;
+	}
+
+skipib:
+	adreno_drawobj_set_constraint(KGSL_DEVICE(adreno_dev), drawobj);
+
+	seqnum = atomic_inc_return(&adreno_dev->hwsched.submission_seqnum);
+	cmd->hdr = CREATE_MSG_HDR(H2F_MSG_ISSUE_CMD, HFI_MSG_CMD);
+	cmd->hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd->hdr, seqnum, cmd_sizebytes >> 2);
+
+	ret = a6xx_hfi_dispatch_queue_write(adreno_dev,
+		HFI_DSP_ID_0 + drawobj->context->gmu_dispatch_queue,
+		(u32 *)cmd, cmd_sizebytes, cmdobj, &time);
+	if (ret)
+		return ret;
+
+	/* Send interrupt to GMU to receive the message */
+	gmu_core_regwrite(KGSL_DEVICE(adreno_dev), A6XX_GMU_HOST2GMU_INTR_SET,
+		DISPQ_IRQ_BIT(drawobj->context->gmu_dispatch_queue));
+
+	/*
+	 * We don't need the drawctxt spinlock here because hardware fences are not enabled for a6x
+	 */
+	drawctxt->internal_timestamp = drawobj->timestamp;
+
+	return ret;
+}
+
+int a6xx_hwsched_send_recurring_cmdobj(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj_cmd *cmdobj)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct hfi_submit_cmd *cmd;
+	struct kgsl_memobj_node *ib;
+	u32 cmd_sizebytes;
+	int ret;
+	static bool active;
+
+	if (adreno_gpu_halt(adreno_dev) || hwsched_in_fault(hwsched))
+		return -EBUSY;
+
+	if (test_bit(CMDOBJ_RECURRING_STOP, &cmdobj->priv)) {
+		cmdobj->numibs = 0;
+	} else {
+		list_for_each_entry(ib, &cmdobj->cmdlist, node)
+			cmdobj->numibs++;
+	}
+
+	if (cmdobj->numibs > HWSCHED_MAX_IBS)
+		return -EINVAL;
+
+	if (cmdobj->numibs > HWSCHED_MAX_DISPATCH_NUMIBS)
+		cmd_sizebytes = sizeof(*cmd);
+	else
+		cmd_sizebytes = sizeof(*cmd) +
+			(sizeof(struct hfi_issue_ib) * cmdobj->numibs);
+
+	if (WARN_ON(cmd_sizebytes > HFI_MAX_MSG_SIZE))
+		return -EMSGSIZE;
+
+	cmd = kzalloc(cmd_sizebytes, GFP_KERNEL);
+	if (cmd == NULL)
+		return -ENOMEM;
+
+	if (test_bit(CMDOBJ_RECURRING_START, &cmdobj->priv)) {
+		if (!active) {
+			ret = adreno_active_count_get(adreno_dev);
+			if (ret) {
+				kfree(cmd);
+				return ret;
+			}
+			active = true;
+		}
+		cmd->flags |= CMDBATCH_RECURRING_START;
+		populate_ibs(adreno_dev, cmd, cmdobj);
+	} else
+		cmd->flags |= CMDBATCH_RECURRING_STOP;
+
+	cmd->ctxt_id = drawobj->context->id;
+
+	ret = hfi_context_register(adreno_dev, drawobj->context);
+	if (ret) {
+		adreno_active_count_put(adreno_dev);
+		active = false;
+		kfree(cmd);
+		return ret;
+	}
+
+	cmd->hdr = CREATE_MSG_HDR(H2F_MSG_ISSUE_RECURRING_CMD, HFI_MSG_CMD);
+
+	ret = a6xx_hfi_send_cmd_async(adreno_dev, cmd, cmd_sizebytes);
+
+	kfree(cmd);
+
+	if (ret) {
+		adreno_active_count_put(adreno_dev);
+		active = false;
+		return ret;
+	}
+
+	if (test_bit(CMDOBJ_RECURRING_STOP, &cmdobj->priv)) {
+		adreno_hwsched_retire_cmdobj(hwsched, hwsched->recurring_cmdobj);
+		hwsched->recurring_cmdobj = NULL;
+		del_timer_sync(&hwsched->lsr_timer);
+		if (active)
+			adreno_active_count_put(adreno_dev);
+		active = false;
+		return ret;
+	}
+
+	hwsched->recurring_cmdobj = cmdobj;
+	/* Star LSR timer for power stats collection */
+	mod_timer(&hwsched->lsr_timer, jiffies + msecs_to_jiffies(10));
+	return ret;
+}
+
+static int send_context_unregister_hfi(struct adreno_device *adreno_dev,
+	struct kgsl_context *context, u32 ts)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	struct pending_cmd pending_ack;
+	struct hfi_unregister_ctxt_cmd cmd;
+	u32 seqnum;
+	int rc;
+
+	/* Only send HFI if device is not in SLUMBER */
+	if (!context->gmu_registered ||
+		!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return 0;
+
+	rc = CMD_MSG_HDR(cmd, H2F_MSG_UNREGISTER_CONTEXT);
+	if (rc)
+		return rc;
+
+	cmd.ctxt_id = context->id,
+	cmd.ts = ts,
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	cmd.hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd.hdr, seqnum, sizeof(cmd) >> 2);
+
+	add_waiter(hfi, cmd.hdr, &pending_ack);
+
+	/*
+	 * Although we know device is powered on, we can still enter SLUMBER
+	 * because the wait for ack below is done without holding the mutex. So
+	 * take an active count before releasing the mutex so as to avoid a
+	 * concurrent SLUMBER sequence while GMU is un-registering this context.
+	 */
+	a6xx_hwsched_active_count_get(adreno_dev);
+
+	rc = a6xx_hfi_cmdq_write(adreno_dev, (u32 *)&cmd, sizeof(cmd));
+	if (rc)
+		goto done;
+
+	mutex_unlock(&device->mutex);
+
+	rc = wait_for_completion_timeout(&pending_ack.complete,
+			msecs_to_jiffies(30 * 1000));
+	if (!rc) {
+		dev_err(&gmu->pdev->dev,
+			"Ack timeout for context unregister seq: %d ctx: %u ts: %u\n",
+			MSG_HDR_GET_SEQNUM(pending_ack.sent_hdr),
+			context->id, ts);
+		rc = -ETIMEDOUT;
+
+		mutex_lock(&device->mutex);
+
+		gmu_core_fault_snapshot(device);
+
+		/*
+		 * Trigger dispatcher based reset and recovery. Invalidate the
+		 * context so that any un-finished inflight submissions are not
+		 * replayed after recovery.
+		 */
+		adreno_drawctxt_set_guilty(device, context);
+
+		adreno_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+
+		goto done;
+	}
+
+	mutex_lock(&device->mutex);
+
+	rc = check_ack_failure(adreno_dev, &pending_ack);
+done:
+	a6xx_hwsched_active_count_put(adreno_dev);
+
+	del_waiter(hfi, &pending_ack);
+
+	return rc;
+}
+
+void a6xx_hwsched_context_detach(struct adreno_context *drawctxt)
+{
+	struct kgsl_context *context = &drawctxt->base;
+	struct kgsl_device *device = context->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	int ret = 0;
+
+	mutex_lock(&device->mutex);
+
+	ret = send_context_unregister_hfi(adreno_dev, context,
+		drawctxt->internal_timestamp);
+
+	if (!ret) {
+		kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, soptimestamp),
+			drawctxt->timestamp);
+
+		kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, eoptimestamp),
+			drawctxt->timestamp);
+
+		adreno_profile_process_results(adreno_dev);
+	}
+
+	context->gmu_registered = false;
+
+	mutex_unlock(&device->mutex);
+}
+
+u32 a6xx_hwsched_preempt_count_get(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct hfi_get_value_cmd cmd;
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hwsched_hfi *hfi = to_a6xx_hwsched_hfi(adreno_dev);
+	struct pending_cmd pending_ack;
+	int rc;
+	u32 seqnum;
+
+	if (device->state != KGSL_STATE_ACTIVE)
+		return 0;
+
+	rc = CMD_MSG_HDR(cmd, H2F_MSG_GET_VALUE);
+	if (rc)
+		return 0;
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	cmd.hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd.hdr, seqnum, sizeof(cmd) >> 2);
+	cmd.type = HFI_VALUE_PREEMPT_COUNT;
+	cmd.subtype = 0;
+
+	add_waiter(hfi, cmd.hdr, &pending_ack);
+
+	rc = a6xx_hfi_cmdq_write(adreno_dev, (u32 *)&cmd, sizeof(cmd));
+	if (rc)
+		goto done;
+
+	rc = adreno_hwsched_wait_ack_completion(adreno_dev, &gmu->pdev->dev, &pending_ack,
+		a6xx_hwsched_process_msgq);
+	if (rc)
+		goto done;
+
+	rc = check_ack_failure(adreno_dev, &pending_ack);
+
+done:
+	del_waiter(hfi, &pending_ack);
+
+	return rc ? 0 : pending_ack.results[2];
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_hwsched_hfi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_hwsched_hfi.h
@@ -0,0 +1,150 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _ADRENO_A6XX_HWSCHED_HFI_H_
+#define _ADRENO_A6XX_HWSCHED_HFI_H_
+
+struct a6xx_hwsched_hfi {
+	struct hfi_mem_alloc_entry mem_alloc_table[32];
+	u32 mem_alloc_entries;
+	/** @irq_mask: Store the hfi interrupt mask */
+	u32 irq_mask;
+	/** @msglock: To protect the list of un-ACKed hfi packets */
+	rwlock_t msglock;
+	/** @msglist: List of un-ACKed hfi packets */
+	struct list_head msglist;
+	/** @f2h_task: Task for processing gmu fw to host packets */
+	struct task_struct *f2h_task;
+	/** @f2h_wq: Waitqueue for the f2h_task */
+	wait_queue_head_t f2h_wq;
+	/** @big_ib: GMU buffer to hold big IBs */
+	struct kgsl_memdesc *big_ib;
+	/** @big_ib_recurring: GMU buffer to hold big recurring IBs */
+	struct kgsl_memdesc *big_ib_recurring;
+	/** @msg_mutex: Mutex for accessing the msgq */
+	struct mutex msgq_mutex;
+};
+
+struct kgsl_drawobj_cmd;
+
+/**
+ * a6xx_hwsched_hfi_probe - Probe hwsched hfi resources
+ * @adreno_dev: Pointer to adreno device structure
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int a6xx_hwsched_hfi_probe(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_hfi_remove - Release hwsched hfi resources
+ * @adreno_dev: Pointer to adreno device structure
+ */
+void a6xx_hwsched_hfi_remove(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_hfi_init - Initialize hfi resources
+ * @adreno_dev: Pointer to adreno device structure
+ *
+ * This function is used to initialize hfi resources
+ * once before the very first gmu boot
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int a6xx_hwsched_hfi_init(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_hfi_start - Start hfi resources
+ * @adreno_dev: Pointer to adreno device structure
+ *
+ * Send the various hfi packets before booting the gpu
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int a6xx_hwsched_hfi_start(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_hfi_stop - Stop the hfi resources
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function does the hfi cleanup when powering down the gmu
+ */
+void a6xx_hwsched_hfi_stop(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwched_cp_init - Send CP_INIT via HFI
+ * @adreno_dev: Pointer to adreno device structure
+ *
+ * This function is used to send CP INIT packet and bring
+ * GPU out of secure mode using hfi raw packets.
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int a6xx_hwsched_cp_init(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_counter_inline_enable - Configure a performance counter for a countable
+ * @adreno_dev -  Adreno device to configure
+ * @group - Desired performance counter group
+ * @counter - Desired performance counter in the group
+ * @countable - Desired countable
+ *
+ * Physically set up a counter within a group with the desired countable
+ * Return 0 on success or negative error on failure.
+ */
+int a6xx_hwsched_counter_inline_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		u32 counter, u32 countable);
+
+/**
+ * a6xx_hfi_send_cmd_async - Send an hfi packet
+ * @adreno_dev: Pointer to adreno device structure
+ * @data: Data to be sent in the hfi packet
+ * @size_bytes: Size of the packet in bytes
+ *
+ * Send data in the form of an HFI packet to gmu and wait for
+ * it's ack asynchronously
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int a6xx_hfi_send_cmd_async(struct adreno_device *adreno_dev, void *data, u32 size_bytes);
+
+/**
+ * a6xx_hwsched_submit_drawobj - Dispatch IBs to dispatch queues
+ * @adreno_dev: Pointer to adreno device structure
+ * @drawobj: The command draw object which needs to be submitted
+ *
+ * This function is used to register the context if needed and submit
+ * IBs to the hfi dispatch queues.
+
+ * Return: 0 on success and negative error on failure
+ */
+int a6xx_hwsched_submit_drawobj(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj *drawobj);
+
+/**
+ * a6xx_hwsched_context_detach - Unregister a context with GMU
+ * @drawctxt: Pointer to the adreno context
+ *
+ * This function sends context unregister HFI and waits for the ack
+ * to ensure all submissions from this context have retired
+ */
+void a6xx_hwsched_context_detach(struct adreno_context *drawctxt);
+
+/* Helper function to get to a6xx hwsched hfi device from adreno device */
+struct a6xx_hwsched_hfi *to_a6xx_hwsched_hfi(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_hwsched_preempt_count_get - Get preemption count from GMU
+ * @adreno_dev: Pointer to adreno device
+ *
+ * This function sends a GET_VALUE HFI packet to get the number of
+ * preemptions completed since last SLUMBER exit.
+ *
+ * Return: Preemption count
+ */
+u32 a6xx_hwsched_preempt_count_get(struct adreno_device *adreno_dev);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_perfcounter.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_perfcounter.c
@@ -0,0 +1,1010 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_a6xx_hwsched_hfi.h"
+#include "adreno_perfcounter.h"
+#include "adreno_pm4types.h"
+#include "kgsl_device.h"
+
+#define VBIF2_PERF_CNT_SEL_MASK 0x7F
+/* offset of clear register from select register */
+#define VBIF2_PERF_CLR_REG_SEL_OFF 8
+/* offset of enable register from select register */
+#define VBIF2_PERF_EN_REG_SEL_OFF 16
+/* offset of clear register from the enable register */
+#define VBIF2_PERF_PWR_CLR_REG_EN_OFF 8
+
+/* offset of clear register from select register for GBIF */
+#define GBIF_PERF_CLR_REG_SEL_OFF 1
+/* offset of enable register from select register for GBIF*/
+#define GBIF_PERF_EN_REG_SEL_OFF  2
+/* offset of clear register from the power enable register for GBIF*/
+#define GBIF_PWR_CLR_REG_EN_OFF    1
+#define GBIF_PWR_SEL_REG_EN_OFF  3
+
+#define GBIF_PERF_SEL_RMW_MASK   0xFF
+#define GBIF_PWR_SEL_RMW_MASK    0xFF
+#define GBIF_PWR_EN_CLR_RMW_MASK 0x10000
+
+static void a6xx_counter_load(struct adreno_device *adreno_dev,
+		struct adreno_perfcount_register *reg)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int index = reg->load_bit / 32;
+	u32 enable = BIT(reg->load_bit & 31);
+
+	/*
+	 * a650 and a660 currently have the perfcounter values saved via
+	 * retention in the GMU.
+	 */
+	if (adreno_is_a650(adreno_dev) || adreno_is_a660(adreno_dev))
+		return;
+
+	kgsl_regwrite(device, A6XX_RBBM_PERFCTR_LOAD_VALUE_LO,
+		lower_32_bits(reg->value));
+
+	kgsl_regwrite(device, A6XX_RBBM_PERFCTR_LOAD_VALUE_HI,
+		upper_32_bits(reg->value));
+
+	kgsl_regwrite(device, A6XX_RBBM_PERFCTR_LOAD_CMD0 + index, enable);
+}
+
+/*
+ * For registers that do not get restored on power cycle, read the value and add
+ * the stored shadow value
+ */
+static u64 a6xx_counter_read_norestore(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 hi, lo;
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	return ((((u64) hi) << 32) | lo) + reg->value;
+}
+
+static int a6xx_counter_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		u32 counter, u32 countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	int ret = 0;
+
+	if (group->flags & ADRENO_PERFCOUNTER_GROUP_RESTORE)
+		ret = a6xx_perfcounter_update(adreno_dev, reg, true);
+	else
+		kgsl_regwrite(device, reg->select, countable);
+
+	if (!ret)
+		reg->value = 0;
+
+	return ret;
+}
+
+static int a6xx_hwsched_counter_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		u32 counter, u32 countable)
+{
+	if (!(KGSL_DEVICE(adreno_dev)->state == KGSL_STATE_ACTIVE))
+		return a6xx_counter_enable(adreno_dev, group, counter, countable);
+
+	return a6xx_hwsched_counter_inline_enable(adreno_dev, group, counter, countable);
+}
+
+static int a6xx_counter_inline_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	struct adreno_ringbuffer *rb = &adreno_dev->ringbuffers[0];
+	u32 cmds[3];
+	int ret;
+
+
+	if (!(device->state == KGSL_STATE_ACTIVE))
+		return a6xx_counter_enable(adreno_dev, group, counter,
+			countable);
+
+	if (group->flags & ADRENO_PERFCOUNTER_GROUP_RESTORE)
+		a6xx_perfcounter_update(adreno_dev, reg, false);
+
+	cmds[0]  = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+	cmds[1] = cp_type4_packet(reg->select, 1);
+	cmds[2] = countable;
+
+	/* submit to highest priority RB always */
+	ret = a6xx_ringbuffer_addcmds(adreno_dev, rb, NULL,
+		F_NOTPROTECTED, cmds, 3, 0, NULL);
+	if (ret)
+		return ret;
+
+	/*
+	 * schedule dispatcher to make sure rb[0] is run, because
+	 * if the current RB is not rb[0] and gpu is idle then
+	 * rb[0] will not get scheduled to run
+	 */
+	if (adreno_dev->cur_rb != rb)
+		adreno_dispatcher_schedule(device);
+
+	/* wait for the above commands submitted to complete */
+	ret = adreno_ringbuffer_waittimestamp(rb, rb->timestamp,
+		ADRENO_IDLE_TIMEOUT);
+
+	if (ret) {
+		/*
+		 * If we were woken up because of cancelling rb events
+		 * either due to soft reset or adreno_stop, ignore the
+		 * error and return 0 here. The perfcounter is already
+		 * set up in software and it will be programmed in
+		 * hardware when we wake up or come up after soft reset,
+		 * by adreno_perfcounter_restore.
+		 */
+		if (ret == -EAGAIN)
+			ret = 0;
+		else
+			dev_err(device->dev,
+				     "Perfcounter %s/%u/%u start via commands failed %d\n",
+				     group->name, counter, countable, ret);
+	}
+
+	if (!ret)
+		reg->value = 0;
+
+	return ret;
+}
+
+static u64 a6xx_counter_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32  hi, lo;
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	/* These registers are restored on power resume */
+	return (((u64) hi) << 32) | lo;
+}
+
+static int a6xx_counter_gbif_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	unsigned int shift = counter << 3;
+	unsigned int perfctr_mask = 1 << counter;
+
+	if (countable > VBIF2_PERF_CNT_SEL_MASK)
+		return -EINVAL;
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regrmw(device, reg->select - GBIF_PERF_CLR_REG_SEL_OFF,
+		perfctr_mask, perfctr_mask);
+	kgsl_regrmw(device, reg->select - GBIF_PERF_CLR_REG_SEL_OFF,
+		perfctr_mask, 0);
+		/* select the desired countable */
+	kgsl_regrmw(device, reg->select,
+		GBIF_PERF_SEL_RMW_MASK << shift, countable << shift);
+	/* enable counter */
+	kgsl_regrmw(device, reg->select - GBIF_PERF_EN_REG_SEL_OFF,
+		perfctr_mask, perfctr_mask);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int a630_counter_vbif_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	if (countable > VBIF2_PERF_CNT_SEL_MASK)
+		return -EINVAL;
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regwrite(device,
+		reg->select - VBIF2_PERF_CLR_REG_SEL_OFF, 1);
+	kgsl_regwrite(device,
+		reg->select - VBIF2_PERF_CLR_REG_SEL_OFF, 0);
+	kgsl_regwrite(device,
+		reg->select, countable & VBIF2_PERF_CNT_SEL_MASK);
+	/* enable reg is 8 DWORDS before select reg */
+	kgsl_regwrite(device,
+		reg->select - VBIF2_PERF_EN_REG_SEL_OFF, 1);
+
+	kgsl_regwrite(device, reg->select, countable);
+	reg->value = 0;
+
+	return 0;
+}
+
+static int a630_counter_vbif_pwr_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regwrite(device, reg->select +
+		VBIF2_PERF_PWR_CLR_REG_EN_OFF, 1);
+	kgsl_regwrite(device, reg->select +
+		VBIF2_PERF_PWR_CLR_REG_EN_OFF, 0);
+	kgsl_regwrite(device, reg->select, 1);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int a6xx_counter_gbif_pwr_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	unsigned int shift = counter << 3;
+	unsigned int perfctr_mask = GBIF_PWR_EN_CLR_RMW_MASK << counter;
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regrmw(device, reg->select + GBIF_PWR_CLR_REG_EN_OFF,
+		perfctr_mask, perfctr_mask);
+	kgsl_regrmw(device, reg->select + GBIF_PWR_CLR_REG_EN_OFF,
+		perfctr_mask, 0);
+	/* select the desired countable */
+	kgsl_regrmw(device, reg->select + GBIF_PWR_SEL_REG_EN_OFF,
+		GBIF_PWR_SEL_RMW_MASK << shift, countable << shift);
+	/* Enable the counter */
+	kgsl_regrmw(device, reg->select, perfctr_mask, perfctr_mask);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int a6xx_counter_alwayson_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	return 0;
+}
+
+static u64 a6xx_counter_alwayson_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	return a6xx_read_alwayson(adreno_dev) + reg->value;
+}
+
+static void a6xx_write_gmu_counter_enable(struct kgsl_device *device,
+		struct adreno_perfcount_register *reg, u32 bit, u32 countable)
+{
+	u32 val;
+
+	kgsl_regread(device, reg->select, &val);
+	val &= ~(0xff << bit);
+	val |= countable << bit;
+	kgsl_regwrite(device, reg->select, val);
+
+}
+
+static int a6xx_counter_gmu_xoclk_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	if (countable > 0xff)
+		return -EINVAL;
+
+	if (counter >= 6 && !adreno_is_a660(adreno_dev))
+		return -EINVAL;
+
+	/*
+	 * Counters [0:3] are in select 1 bit offsets 0, 8, 16 and 24
+	 * Counters [4:5] are in select 2 bit offset 0, 8
+	 * Counters [6:9] are in select 3 bit offset 0, 8, 16 and 24
+	 */
+
+	if (counter == 4 || counter == 5)
+		counter -= 4;
+	else if (counter >= 6)
+		counter -= 6;
+
+	a6xx_write_gmu_counter_enable(device, reg, counter * 8, countable);
+
+	reg->value = 0;
+
+	kgsl_regwrite(device, A6XX_GMU_CX_GMU_POWER_COUNTER_ENABLE, 1);
+
+	return 0;
+}
+
+static int a6xx_counter_gmu_gmuclk_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	if (countable > 0xff)
+		return -EINVAL;
+
+	/*
+	 * The two counters are stuck into GMU_CX_GMU_POWER_COUNTER_SELECT_1
+	 * at bit offset 16 and 24
+	 */
+	a6xx_write_gmu_counter_enable(device, reg,
+		16 + (counter * 8), countable);
+
+	kgsl_regwrite(device, A6XX_GMU_CX_GMU_POWER_COUNTER_ENABLE, 1);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int a6xx_counter_gmu_perf_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	if (countable > 0xff)
+		return -EINVAL;
+
+	/*
+	 * Counters [0:3] are in select 1 bit offsets 0, 8, 16 and 24
+	 * Counters [4:5] are in select 2 bit offset 0, 8
+	 */
+
+	if (counter >= 4)
+		counter -= 4;
+
+	a6xx_write_gmu_counter_enable(device, reg, counter * 8, countable);
+
+	kgsl_regwrite(device, A6XX_GMU_CX_GMU_PERF_COUNTER_ENABLE, 1);
+
+	reg->value = 0;
+	return 0;
+}
+
+static struct adreno_perfcount_register a6xx_perfcounters_cp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_0_LO,
+		A6XX_RBBM_PERFCTR_CP_0_HI, 0, A6XX_CP_PERFCTR_CP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_1_LO,
+		A6XX_RBBM_PERFCTR_CP_1_HI, 1, A6XX_CP_PERFCTR_CP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_2_LO,
+		A6XX_RBBM_PERFCTR_CP_2_HI, 2, A6XX_CP_PERFCTR_CP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_3_LO,
+		A6XX_RBBM_PERFCTR_CP_3_HI, 3, A6XX_CP_PERFCTR_CP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_4_LO,
+		A6XX_RBBM_PERFCTR_CP_4_HI, 4, A6XX_CP_PERFCTR_CP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_5_LO,
+		A6XX_RBBM_PERFCTR_CP_5_HI, 5, A6XX_CP_PERFCTR_CP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_6_LO,
+		A6XX_RBBM_PERFCTR_CP_6_HI, 6, A6XX_CP_PERFCTR_CP_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_7_LO,
+		A6XX_RBBM_PERFCTR_CP_7_HI, 7, A6XX_CP_PERFCTR_CP_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_8_LO,
+		A6XX_RBBM_PERFCTR_CP_8_HI, 8, A6XX_CP_PERFCTR_CP_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_9_LO,
+		A6XX_RBBM_PERFCTR_CP_9_HI, 9, A6XX_CP_PERFCTR_CP_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_10_LO,
+		A6XX_RBBM_PERFCTR_CP_10_HI, 10, A6XX_CP_PERFCTR_CP_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_11_LO,
+		A6XX_RBBM_PERFCTR_CP_11_HI, 11, A6XX_CP_PERFCTR_CP_SEL_11 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_12_LO,
+		A6XX_RBBM_PERFCTR_CP_12_HI, 12, A6XX_CP_PERFCTR_CP_SEL_12 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CP_13_LO,
+		A6XX_RBBM_PERFCTR_CP_13_HI, 13, A6XX_CP_PERFCTR_CP_SEL_13 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_rbbm[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RBBM_0_LO,
+		A6XX_RBBM_PERFCTR_RBBM_0_HI, 14, A6XX_RBBM_PERFCTR_RBBM_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RBBM_1_LO,
+		A6XX_RBBM_PERFCTR_RBBM_1_HI, 15, A6XX_RBBM_PERFCTR_RBBM_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RBBM_2_LO,
+		A6XX_RBBM_PERFCTR_RBBM_2_HI, 16, A6XX_RBBM_PERFCTR_RBBM_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RBBM_3_LO,
+		A6XX_RBBM_PERFCTR_RBBM_3_HI, 17, A6XX_RBBM_PERFCTR_RBBM_SEL_3 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_pc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_PC_0_LO,
+		A6XX_RBBM_PERFCTR_PC_0_HI, 18, A6XX_PC_PERFCTR_PC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_PC_1_LO,
+		A6XX_RBBM_PERFCTR_PC_1_HI, 19, A6XX_PC_PERFCTR_PC_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_PC_2_LO,
+		A6XX_RBBM_PERFCTR_PC_2_HI, 20, A6XX_PC_PERFCTR_PC_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_PC_3_LO,
+		A6XX_RBBM_PERFCTR_PC_3_HI, 21, A6XX_PC_PERFCTR_PC_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_PC_4_LO,
+		A6XX_RBBM_PERFCTR_PC_4_HI, 22, A6XX_PC_PERFCTR_PC_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_PC_5_LO,
+		A6XX_RBBM_PERFCTR_PC_5_HI, 23, A6XX_PC_PERFCTR_PC_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_PC_6_LO,
+		A6XX_RBBM_PERFCTR_PC_6_HI, 24, A6XX_PC_PERFCTR_PC_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_PC_7_LO,
+		A6XX_RBBM_PERFCTR_PC_7_HI, 25, A6XX_PC_PERFCTR_PC_SEL_7 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_vfd[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VFD_0_LO,
+		A6XX_RBBM_PERFCTR_VFD_0_HI, 26, A6XX_VFD_PERFCTR_VFD_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VFD_1_LO,
+		A6XX_RBBM_PERFCTR_VFD_1_HI, 27, A6XX_VFD_PERFCTR_VFD_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VFD_2_LO,
+		A6XX_RBBM_PERFCTR_VFD_2_HI, 28, A6XX_VFD_PERFCTR_VFD_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VFD_3_LO,
+		A6XX_RBBM_PERFCTR_VFD_3_HI, 29, A6XX_VFD_PERFCTR_VFD_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VFD_4_LO,
+		A6XX_RBBM_PERFCTR_VFD_4_HI, 30, A6XX_VFD_PERFCTR_VFD_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VFD_5_LO,
+		A6XX_RBBM_PERFCTR_VFD_5_HI, 31, A6XX_VFD_PERFCTR_VFD_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VFD_6_LO,
+		A6XX_RBBM_PERFCTR_VFD_6_HI, 32, A6XX_VFD_PERFCTR_VFD_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VFD_7_LO,
+		A6XX_RBBM_PERFCTR_VFD_7_HI, 33, A6XX_VFD_PERFCTR_VFD_SEL_7 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_hlsq[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_HLSQ_0_LO,
+		A6XX_RBBM_PERFCTR_HLSQ_0_HI, 34, A6XX_HLSQ_PERFCTR_HLSQ_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_HLSQ_1_LO,
+		A6XX_RBBM_PERFCTR_HLSQ_1_HI, 35, A6XX_HLSQ_PERFCTR_HLSQ_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_HLSQ_2_LO,
+		A6XX_RBBM_PERFCTR_HLSQ_2_HI, 36, A6XX_HLSQ_PERFCTR_HLSQ_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_HLSQ_3_LO,
+		A6XX_RBBM_PERFCTR_HLSQ_3_HI, 37, A6XX_HLSQ_PERFCTR_HLSQ_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_HLSQ_4_LO,
+		A6XX_RBBM_PERFCTR_HLSQ_4_HI, 38, A6XX_HLSQ_PERFCTR_HLSQ_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_HLSQ_5_LO,
+		A6XX_RBBM_PERFCTR_HLSQ_5_HI, 39, A6XX_HLSQ_PERFCTR_HLSQ_SEL_5 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_vpc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VPC_0_LO,
+		A6XX_RBBM_PERFCTR_VPC_0_HI, 40, A6XX_VPC_PERFCTR_VPC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VPC_1_LO,
+		A6XX_RBBM_PERFCTR_VPC_1_HI, 41, A6XX_VPC_PERFCTR_VPC_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VPC_2_LO,
+		A6XX_RBBM_PERFCTR_VPC_2_HI, 42, A6XX_VPC_PERFCTR_VPC_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VPC_3_LO,
+		A6XX_RBBM_PERFCTR_VPC_3_HI, 43, A6XX_VPC_PERFCTR_VPC_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VPC_4_LO,
+		A6XX_RBBM_PERFCTR_VPC_4_HI, 44, A6XX_VPC_PERFCTR_VPC_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VPC_5_LO,
+		A6XX_RBBM_PERFCTR_VPC_5_HI, 45, A6XX_VPC_PERFCTR_VPC_SEL_5 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_ccu[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CCU_0_LO,
+		A6XX_RBBM_PERFCTR_CCU_0_HI, 46, A6XX_RB_PERFCTR_CCU_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CCU_1_LO,
+		A6XX_RBBM_PERFCTR_CCU_1_HI, 47, A6XX_RB_PERFCTR_CCU_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CCU_2_LO,
+		A6XX_RBBM_PERFCTR_CCU_2_HI, 48, A6XX_RB_PERFCTR_CCU_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CCU_3_LO,
+		A6XX_RBBM_PERFCTR_CCU_3_HI, 49, A6XX_RB_PERFCTR_CCU_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CCU_4_LO,
+		A6XX_RBBM_PERFCTR_CCU_4_HI, 50, A6XX_RB_PERFCTR_CCU_SEL_4 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_tse[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TSE_0_LO,
+		A6XX_RBBM_PERFCTR_TSE_0_HI, 51, A6XX_GRAS_PERFCTR_TSE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TSE_1_LO,
+		A6XX_RBBM_PERFCTR_TSE_1_HI, 52, A6XX_GRAS_PERFCTR_TSE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TSE_2_LO,
+		A6XX_RBBM_PERFCTR_TSE_2_HI, 53, A6XX_GRAS_PERFCTR_TSE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TSE_3_LO,
+		A6XX_RBBM_PERFCTR_TSE_3_HI, 54, A6XX_GRAS_PERFCTR_TSE_SEL_3 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_ras[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RAS_0_LO,
+		A6XX_RBBM_PERFCTR_RAS_0_HI, 55, A6XX_GRAS_PERFCTR_RAS_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RAS_1_LO,
+		A6XX_RBBM_PERFCTR_RAS_1_HI, 56, A6XX_GRAS_PERFCTR_RAS_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RAS_2_LO,
+		A6XX_RBBM_PERFCTR_RAS_2_HI, 57, A6XX_GRAS_PERFCTR_RAS_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RAS_3_LO,
+		A6XX_RBBM_PERFCTR_RAS_3_HI, 58, A6XX_GRAS_PERFCTR_RAS_SEL_3 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_uche[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_0_LO,
+		A6XX_RBBM_PERFCTR_UCHE_0_HI, 59, A6XX_UCHE_PERFCTR_UCHE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_1_LO,
+		A6XX_RBBM_PERFCTR_UCHE_1_HI, 60, A6XX_UCHE_PERFCTR_UCHE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_2_LO,
+		A6XX_RBBM_PERFCTR_UCHE_2_HI, 61, A6XX_UCHE_PERFCTR_UCHE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_3_LO,
+		A6XX_RBBM_PERFCTR_UCHE_3_HI, 62, A6XX_UCHE_PERFCTR_UCHE_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_4_LO,
+		A6XX_RBBM_PERFCTR_UCHE_4_HI, 63, A6XX_UCHE_PERFCTR_UCHE_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_5_LO,
+		A6XX_RBBM_PERFCTR_UCHE_5_HI, 64, A6XX_UCHE_PERFCTR_UCHE_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_6_LO,
+		A6XX_RBBM_PERFCTR_UCHE_6_HI, 65, A6XX_UCHE_PERFCTR_UCHE_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_7_LO,
+		A6XX_RBBM_PERFCTR_UCHE_7_HI, 66, A6XX_UCHE_PERFCTR_UCHE_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_8_LO,
+		A6XX_RBBM_PERFCTR_UCHE_8_HI, 67, A6XX_UCHE_PERFCTR_UCHE_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_9_LO,
+		A6XX_RBBM_PERFCTR_UCHE_9_HI, 68, A6XX_UCHE_PERFCTR_UCHE_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_10_LO,
+		A6XX_RBBM_PERFCTR_UCHE_10_HI, 69,
+					A6XX_UCHE_PERFCTR_UCHE_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_UCHE_11_LO,
+		A6XX_RBBM_PERFCTR_UCHE_11_HI, 70,
+					A6XX_UCHE_PERFCTR_UCHE_SEL_11 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_tp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_0_LO,
+		A6XX_RBBM_PERFCTR_TP_0_HI, 71, A6XX_TPL1_PERFCTR_TP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_1_LO,
+		A6XX_RBBM_PERFCTR_TP_1_HI, 72, A6XX_TPL1_PERFCTR_TP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_2_LO,
+		A6XX_RBBM_PERFCTR_TP_2_HI, 73, A6XX_TPL1_PERFCTR_TP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_3_LO,
+		A6XX_RBBM_PERFCTR_TP_3_HI, 74, A6XX_TPL1_PERFCTR_TP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_4_LO,
+		A6XX_RBBM_PERFCTR_TP_4_HI, 75, A6XX_TPL1_PERFCTR_TP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_5_LO,
+		A6XX_RBBM_PERFCTR_TP_5_HI, 76, A6XX_TPL1_PERFCTR_TP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_6_LO,
+		A6XX_RBBM_PERFCTR_TP_6_HI, 77, A6XX_TPL1_PERFCTR_TP_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_7_LO,
+		A6XX_RBBM_PERFCTR_TP_7_HI, 78, A6XX_TPL1_PERFCTR_TP_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_8_LO,
+		A6XX_RBBM_PERFCTR_TP_8_HI, 79, A6XX_TPL1_PERFCTR_TP_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_9_LO,
+		A6XX_RBBM_PERFCTR_TP_9_HI, 80, A6XX_TPL1_PERFCTR_TP_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_10_LO,
+		A6XX_RBBM_PERFCTR_TP_10_HI, 81, A6XX_TPL1_PERFCTR_TP_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_TP_11_LO,
+		A6XX_RBBM_PERFCTR_TP_11_HI, 82, A6XX_TPL1_PERFCTR_TP_SEL_11 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_sp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_0_LO,
+		A6XX_RBBM_PERFCTR_SP_0_HI, 83, A6XX_SP_PERFCTR_SP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_1_LO,
+		A6XX_RBBM_PERFCTR_SP_1_HI, 84, A6XX_SP_PERFCTR_SP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_2_LO,
+		A6XX_RBBM_PERFCTR_SP_2_HI, 85, A6XX_SP_PERFCTR_SP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_3_LO,
+		A6XX_RBBM_PERFCTR_SP_3_HI, 86, A6XX_SP_PERFCTR_SP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_4_LO,
+		A6XX_RBBM_PERFCTR_SP_4_HI, 87, A6XX_SP_PERFCTR_SP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_5_LO,
+		A6XX_RBBM_PERFCTR_SP_5_HI, 88, A6XX_SP_PERFCTR_SP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_6_LO,
+		A6XX_RBBM_PERFCTR_SP_6_HI, 89, A6XX_SP_PERFCTR_SP_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_7_LO,
+		A6XX_RBBM_PERFCTR_SP_7_HI, 90, A6XX_SP_PERFCTR_SP_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_8_LO,
+		A6XX_RBBM_PERFCTR_SP_8_HI, 91, A6XX_SP_PERFCTR_SP_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_9_LO,
+		A6XX_RBBM_PERFCTR_SP_9_HI, 92, A6XX_SP_PERFCTR_SP_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_10_LO,
+		A6XX_RBBM_PERFCTR_SP_10_HI, 93, A6XX_SP_PERFCTR_SP_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_11_LO,
+		A6XX_RBBM_PERFCTR_SP_11_HI, 94, A6XX_SP_PERFCTR_SP_SEL_11 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_12_LO,
+		A6XX_RBBM_PERFCTR_SP_12_HI, 95, A6XX_SP_PERFCTR_SP_SEL_12 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_13_LO,
+		A6XX_RBBM_PERFCTR_SP_13_HI, 96, A6XX_SP_PERFCTR_SP_SEL_13 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_14_LO,
+		A6XX_RBBM_PERFCTR_SP_14_HI, 97, A6XX_SP_PERFCTR_SP_SEL_14 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_15_LO,
+		A6XX_RBBM_PERFCTR_SP_15_HI, 98, A6XX_SP_PERFCTR_SP_SEL_15 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_16_LO,
+		A6XX_RBBM_PERFCTR_SP_16_HI, 99, A6XX_SP_PERFCTR_SP_SEL_16 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_17_LO,
+		A6XX_RBBM_PERFCTR_SP_17_HI, 100, A6XX_SP_PERFCTR_SP_SEL_17 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_18_LO,
+		A6XX_RBBM_PERFCTR_SP_18_HI, 101, A6XX_SP_PERFCTR_SP_SEL_18 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_19_LO,
+		A6XX_RBBM_PERFCTR_SP_19_HI, 102, A6XX_SP_PERFCTR_SP_SEL_19 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_20_LO,
+		A6XX_RBBM_PERFCTR_SP_20_HI, 103, A6XX_SP_PERFCTR_SP_SEL_20 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_21_LO,
+		A6XX_RBBM_PERFCTR_SP_21_HI, 104, A6XX_SP_PERFCTR_SP_SEL_21 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_22_LO,
+		A6XX_RBBM_PERFCTR_SP_22_HI, 105, A6XX_SP_PERFCTR_SP_SEL_22 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_SP_23_LO,
+		A6XX_RBBM_PERFCTR_SP_23_HI, 106, A6XX_SP_PERFCTR_SP_SEL_23 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_rb[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RB_0_LO,
+		A6XX_RBBM_PERFCTR_RB_0_HI, 107, A6XX_RB_PERFCTR_RB_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RB_1_LO,
+		A6XX_RBBM_PERFCTR_RB_1_HI, 108, A6XX_RB_PERFCTR_RB_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RB_2_LO,
+		A6XX_RBBM_PERFCTR_RB_2_HI, 109, A6XX_RB_PERFCTR_RB_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RB_3_LO,
+		A6XX_RBBM_PERFCTR_RB_3_HI, 110, A6XX_RB_PERFCTR_RB_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RB_4_LO,
+		A6XX_RBBM_PERFCTR_RB_4_HI, 111, A6XX_RB_PERFCTR_RB_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RB_5_LO,
+		A6XX_RBBM_PERFCTR_RB_5_HI, 112, A6XX_RB_PERFCTR_RB_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RB_6_LO,
+		A6XX_RBBM_PERFCTR_RB_6_HI, 113, A6XX_RB_PERFCTR_RB_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_RB_7_LO,
+		A6XX_RBBM_PERFCTR_RB_7_HI, 114, A6XX_RB_PERFCTR_RB_SEL_7 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_vsc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VSC_0_LO,
+		A6XX_RBBM_PERFCTR_VSC_0_HI, 115, A6XX_VSC_PERFCTR_VSC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_VSC_1_LO,
+		A6XX_RBBM_PERFCTR_VSC_1_HI, 116, A6XX_VSC_PERFCTR_VSC_SEL_1 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_lrz[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_LRZ_0_LO,
+		A6XX_RBBM_PERFCTR_LRZ_0_HI, 117, A6XX_GRAS_PERFCTR_LRZ_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_LRZ_1_LO,
+		A6XX_RBBM_PERFCTR_LRZ_1_HI, 118, A6XX_GRAS_PERFCTR_LRZ_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_LRZ_2_LO,
+		A6XX_RBBM_PERFCTR_LRZ_2_HI, 119, A6XX_GRAS_PERFCTR_LRZ_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_LRZ_3_LO,
+		A6XX_RBBM_PERFCTR_LRZ_3_HI, 120, A6XX_GRAS_PERFCTR_LRZ_SEL_3 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_cmp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CMP_0_LO,
+		A6XX_RBBM_PERFCTR_CMP_0_HI, 121, A6XX_RB_PERFCTR_CMP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CMP_1_LO,
+		A6XX_RBBM_PERFCTR_CMP_1_HI, 122, A6XX_RB_PERFCTR_CMP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CMP_2_LO,
+		A6XX_RBBM_PERFCTR_CMP_2_HI, 123, A6XX_RB_PERFCTR_CMP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_RBBM_PERFCTR_CMP_3_LO,
+		A6XX_RBBM_PERFCTR_CMP_3_HI, 124, A6XX_RB_PERFCTR_CMP_SEL_3 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_vbif[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_VBIF_PERF_CNT_LOW0,
+		A6XX_VBIF_PERF_CNT_HIGH0, -1, A6XX_VBIF_PERF_CNT_SEL0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_VBIF_PERF_CNT_LOW1,
+		A6XX_VBIF_PERF_CNT_HIGH1, -1, A6XX_VBIF_PERF_CNT_SEL1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_VBIF_PERF_CNT_LOW2,
+		A6XX_VBIF_PERF_CNT_HIGH2, -1, A6XX_VBIF_PERF_CNT_SEL2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_VBIF_PERF_CNT_LOW3,
+		A6XX_VBIF_PERF_CNT_HIGH3, -1, A6XX_VBIF_PERF_CNT_SEL3 },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_vbif_pwr[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_VBIF_PERF_PWR_CNT_LOW0,
+		A6XX_VBIF_PERF_PWR_CNT_HIGH0, -1, A6XX_VBIF_PERF_PWR_CNT_EN0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_VBIF_PERF_PWR_CNT_LOW1,
+		A6XX_VBIF_PERF_PWR_CNT_HIGH1, -1, A6XX_VBIF_PERF_PWR_CNT_EN1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_VBIF_PERF_PWR_CNT_LOW2,
+		A6XX_VBIF_PERF_PWR_CNT_HIGH2, -1, A6XX_VBIF_PERF_PWR_CNT_EN2 },
+};
+
+
+static struct adreno_perfcount_register a6xx_perfcounters_gbif[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_GBIF_PERF_CNT_LOW0,
+		A6XX_GBIF_PERF_CNT_HIGH0, -1, A6XX_GBIF_PERF_CNT_SEL },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_GBIF_PERF_CNT_LOW1,
+		A6XX_GBIF_PERF_CNT_HIGH1, -1, A6XX_GBIF_PERF_CNT_SEL },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_GBIF_PERF_CNT_LOW2,
+		A6XX_GBIF_PERF_CNT_HIGH2, -1, A6XX_GBIF_PERF_CNT_SEL },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_GBIF_PERF_CNT_LOW3,
+		A6XX_GBIF_PERF_CNT_HIGH3, -1, A6XX_GBIF_PERF_CNT_SEL },
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_gbif_pwr[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_GBIF_PWR_CNT_LOW0,
+		A6XX_GBIF_PWR_CNT_HIGH0, -1, A6XX_GBIF_PERF_PWR_CNT_EN },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_GBIF_PWR_CNT_LOW1,
+		A6XX_GBIF_PWR_CNT_HIGH1, -1, A6XX_GBIF_PERF_PWR_CNT_EN },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_GBIF_PWR_CNT_LOW2,
+		A6XX_GBIF_PWR_CNT_HIGH2, -1, A6XX_GBIF_PERF_PWR_CNT_EN },
+};
+
+#define GMU_COUNTER(lo, hi, sel) \
+	{ .countable = KGSL_PERFCOUNTER_NOT_USED, \
+	  .offset = lo, .offset_hi = hi, .select = sel }
+
+#define GMU_COUNTER_RESERVED(lo, hi, sel) \
+	{ .countable = KGSL_PERFCOUNTER_BROKEN, \
+	  .offset = lo, .offset_hi = hi, .select = sel }
+
+static struct adreno_perfcount_register a6xx_perfcounters_gmu_xoclk[] = {
+	/*
+	 * COUNTER_XOCLK_0 and COUNTER_XOCLK_4 are used for the GPU
+	 * busy and ifpc count. Mark them as reserved to ensure they
+	 * are not re-used.
+	 */
+	GMU_COUNTER_RESERVED(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_0),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_0),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_0),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_0),
+	GMU_COUNTER_RESERVED(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_1),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_5_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_5_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_1),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_6_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_6_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_2),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_7_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_7_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_2),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_8_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_8_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_2),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_9_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_9_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_2),
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_gmu_gmuclk[] = {
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_GMUCLK_0_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_GMUCLK_0_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_1),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_POWER_COUNTER_GMUCLK_1_L,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_GMUCLK_1_H,
+		A6XX_GMU_CX_GMU_POWER_COUNTER_SELECT_1),
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_gmu_perf[] = {
+	GMU_COUNTER(A6XX_GMU_CX_GMU_PERF_COUNTER_0_L,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_0_H,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_SELECT_0),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_PERF_COUNTER_1_L,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_1_H,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_SELECT_0),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_PERF_COUNTER_2_L,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_2_H,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_SELECT_0),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_PERF_COUNTER_3_L,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_3_H,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_SELECT_0),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_PERF_COUNTER_4_L,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_4_H,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_SELECT_1),
+	GMU_COUNTER(A6XX_GMU_CX_GMU_PERF_COUNTER_5_L,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_5_H,
+		A6XX_GMU_CX_GMU_PERF_COUNTER_SELECT_1),
+};
+
+static struct adreno_perfcount_register a6xx_perfcounters_alwayson[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, A6XX_CP_ALWAYS_ON_COUNTER_LO,
+		A6XX_CP_ALWAYS_ON_COUNTER_HI, -1 },
+};
+
+/*
+ * ADRENO_PERFCOUNTER_GROUP_RESTORE flag is enabled by default
+ * because most of the perfcounter groups need to be restored
+ * as part of preemption and IFPC. Perfcounter groups that are
+ * not restored as part of preemption and IFPC should be defined
+ * using A6XX_PERFCOUNTER_GROUP_FLAGS macro
+ */
+#define A6XX_PERFCOUNTER_GROUP(offset, name, enable, read, load) \
+	ADRENO_PERFCOUNTER_GROUP_FLAGS(a6xx, offset, name, \
+	ADRENO_PERFCOUNTER_GROUP_RESTORE, enable, read, load)
+
+#define A6XX_PERFCOUNTER_GROUP_FLAGS(offset, name, flags, enable, read, load) \
+	ADRENO_PERFCOUNTER_GROUP_FLAGS(a6xx, offset, name, flags, enable, \
+			read, load)
+
+#define A6XX_REGULAR_PERFCOUNTER_GROUP(offset, name) \
+	A6XX_PERFCOUNTER_GROUP(offset, name, \
+		a6xx_counter_enable, a6xx_counter_read, a6xx_counter_load)
+
+static const struct adreno_perfcount_group a630_perfcounter_groups
+				[KGSL_PERFCOUNTER_GROUP_MAX] = {
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(RBBM, rbbm, 0,
+		a6xx_counter_enable, a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VFD, vfd),
+	A6XX_PERFCOUNTER_GROUP(HLSQ, hlsq, a6xx_counter_inline_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CCU, ccu),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CMP, cmp),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(TSE, tse),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(RAS, ras),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(LRZ, lrz),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(UCHE, uche),
+	A6XX_PERFCOUNTER_GROUP(TP, tp, a6xx_counter_inline_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_PERFCOUNTER_GROUP(SP, sp, a6xx_counter_inline_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(RB, rb),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VSC, vsc),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(VBIF, vbif, 0,
+		a630_counter_vbif_enable, a6xx_counter_read_norestore, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(VBIF_PWR, vbif_pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED, a630_counter_vbif_pwr_enable,
+		a6xx_counter_read_norestore, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(ALWAYSON, alwayson,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		a6xx_counter_alwayson_enable, a6xx_counter_alwayson_read, NULL),
+};
+
+static const struct adreno_perfcount_group
+a6xx_legacy_perfcounter_groups [KGSL_PERFCOUNTER_GROUP_MAX] = {
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(RBBM, rbbm, 0,
+		a6xx_counter_enable, a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VFD, vfd),
+	A6XX_PERFCOUNTER_GROUP(HLSQ, hlsq, a6xx_counter_inline_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CCU, ccu),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CMP, cmp),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(TSE, tse),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(RAS, ras),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(LRZ, lrz),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(UCHE, uche),
+	A6XX_PERFCOUNTER_GROUP(TP, tp, a6xx_counter_inline_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_PERFCOUNTER_GROUP(SP, sp, a6xx_counter_inline_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(RB, rb),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VSC, vsc),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(VBIF, gbif, 0,
+		a6xx_counter_gbif_enable, a6xx_counter_read_norestore, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(VBIF_PWR, gbif_pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED, a6xx_counter_gbif_pwr_enable,
+		a6xx_counter_read_norestore, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(ALWAYSON, alwayson,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		a6xx_counter_alwayson_enable, a6xx_counter_alwayson_read, NULL),
+};
+
+static const struct adreno_perfcount_group a6xx_perfcounter_groups
+				[KGSL_PERFCOUNTER_GROUP_MAX] = {
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(RBBM, rbbm, 0,
+		a6xx_counter_enable, a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VFD, vfd),
+	A6XX_PERFCOUNTER_GROUP(HLSQ, hlsq, a6xx_counter_inline_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CCU, ccu),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CMP, cmp),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(TSE, tse),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(RAS, ras),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(LRZ, lrz),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(UCHE, uche),
+	A6XX_PERFCOUNTER_GROUP(TP, tp, a6xx_counter_inline_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_PERFCOUNTER_GROUP(SP, sp, a6xx_counter_inline_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(RB, rb),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VSC, vsc),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(VBIF, gbif, 0,
+		a6xx_counter_gbif_enable, a6xx_counter_read_norestore, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(VBIF_PWR, gbif_pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED, a6xx_counter_gbif_pwr_enable,
+		a6xx_counter_read_norestore, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(ALWAYSON, alwayson,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		a6xx_counter_alwayson_enable, a6xx_counter_alwayson_read, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(GMU_XOCLK, gmu_xoclk, 0,
+		a6xx_counter_gmu_xoclk_enable, a6xx_counter_read_norestore,
+		NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(GMU_GMUCLK, gmu_gmuclk, 0,
+		a6xx_counter_gmu_gmuclk_enable, a6xx_counter_read_norestore,
+		NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(GMU_PERF, gmu_perf, 0,
+		a6xx_counter_gmu_perf_enable, a6xx_counter_read_norestore,
+		NULL),
+};
+
+static const struct adreno_perfcount_group a6xx_hwsched_perfcounter_groups
+				[KGSL_PERFCOUNTER_GROUP_MAX] = {
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(RBBM, rbbm, 0,
+		a6xx_counter_enable, a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VFD, vfd),
+	A6XX_PERFCOUNTER_GROUP(HLSQ, hlsq, a6xx_hwsched_counter_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CCU, ccu),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(CMP, cmp),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(TSE, tse),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(RAS, ras),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(LRZ, lrz),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(UCHE, uche),
+	A6XX_PERFCOUNTER_GROUP(TP, tp, a6xx_hwsched_counter_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_PERFCOUNTER_GROUP(SP, sp, a6xx_hwsched_counter_enable,
+			a6xx_counter_read, a6xx_counter_load),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(RB, rb),
+	A6XX_REGULAR_PERFCOUNTER_GROUP(VSC, vsc),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(VBIF, gbif, 0,
+		a6xx_counter_gbif_enable, a6xx_counter_read_norestore, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(VBIF_PWR, gbif_pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED, a6xx_counter_gbif_pwr_enable,
+		a6xx_counter_read_norestore, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(ALWAYSON, alwayson,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		a6xx_counter_alwayson_enable, a6xx_counter_alwayson_read, NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(GMU_XOCLK, gmu_xoclk, 0,
+		a6xx_counter_gmu_xoclk_enable, a6xx_counter_read_norestore,
+		NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(GMU_GMUCLK, gmu_gmuclk, 0,
+		a6xx_counter_gmu_gmuclk_enable, a6xx_counter_read_norestore,
+		NULL),
+	A6XX_PERFCOUNTER_GROUP_FLAGS(GMU_PERF, gmu_perf, 0,
+		a6xx_counter_gmu_perf_enable, a6xx_counter_read_norestore,
+		NULL),
+};
+
+/* a610, a612, a616, a618 and a619 do not have the GMU registers.
+ * a605, a608, a615, a630, a640 and a680 don't have enough room in the
+ * CP_PROTECT registers so the GMU counters are not accessible
+ */
+const struct adreno_perfcounters adreno_a6xx_legacy_perfcounters = {
+	a6xx_legacy_perfcounter_groups,
+	ARRAY_SIZE(a6xx_legacy_perfcounter_groups),
+};
+
+const struct adreno_perfcounters adreno_a630_perfcounters = {
+	a630_perfcounter_groups,
+	ARRAY_SIZE(a630_perfcounter_groups),
+};
+
+const struct adreno_perfcounters adreno_a6xx_perfcounters = {
+	a6xx_perfcounter_groups,
+	ARRAY_SIZE(a6xx_perfcounter_groups),
+};
+
+const struct adreno_perfcounters adreno_a6xx_hwsched_perfcounters = {
+	a6xx_hwsched_perfcounter_groups,
+	ARRAY_SIZE(a6xx_hwsched_perfcounter_groups),
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_preempt.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_preempt.c
@@ -0,0 +1,800 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_pm4types.h"
+#include "adreno_trace.h"
+
+#define PREEMPT_RECORD(_field) \
+		offsetof(struct a6xx_cp_preemption_record, _field)
+
+#define PREEMPT_SMMU_RECORD(_field) \
+		offsetof(struct a6xx_cp_smmu_info, _field)
+
+static void _update_wptr(struct adreno_device *adreno_dev, bool reset_timer,
+	bool atomic)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb = adreno_dev->cur_rb;
+	unsigned long flags;
+	int ret = 0;
+
+	spin_lock_irqsave(&rb->preempt_lock, flags);
+
+	if (!atomic) {
+		/*
+		 * We might have skipped updating the wptr in case we are in
+		 * dispatcher context. Do it now.
+		 */
+		if (rb->skip_inline_wptr) {
+
+			ret = a6xx_fenced_write(adreno_dev,
+				A6XX_CP_RB_WPTR, rb->wptr,
+				FENCE_STATUS_WRITEDROPPED0_MASK);
+
+			reset_timer = true;
+			rb->skip_inline_wptr = false;
+		}
+	} else {
+		unsigned int wptr;
+
+		kgsl_regread(device, A6XX_CP_RB_WPTR, &wptr);
+		if (wptr != rb->wptr) {
+			kgsl_regwrite(device, A6XX_CP_RB_WPTR, rb->wptr);
+			reset_timer = true;
+		}
+	}
+
+	if (reset_timer)
+		rb->dispatch_q.expires = jiffies +
+			msecs_to_jiffies(adreno_drawobj_timeout);
+
+	spin_unlock_irqrestore(&rb->preempt_lock, flags);
+
+	if (!atomic) {
+		/* If WPTR update fails, set the fault and trigger recovery */
+		if (ret) {
+			gmu_core_fault_snapshot(device);
+			adreno_dispatcher_fault(adreno_dev,
+				ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+		}
+	}
+}
+
+static void _power_collapse_set(struct adreno_device *adreno_dev, bool val)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!gmu_core_isenabled(device))
+		return;
+
+	if (val) {
+		if (adreno_is_a660(adreno_dev) ||
+				adreno_is_a663(adreno_dev))
+			gmu_core_regwrite(device,
+				 A6XX_GMU_PWR_COL_PREEMPT_KEEPALIVE, 0x1);
+		else
+			gmu_core_regrmw(device,
+				 A6XX_GMU_AO_SPARE_CNTL, 0x0, 0x2);
+	} else {
+		if (adreno_is_a660(adreno_dev) ||
+				adreno_is_a663(adreno_dev))
+			gmu_core_regwrite(device,
+				 A6XX_GMU_PWR_COL_PREEMPT_KEEPALIVE, 0x0);
+		else
+			gmu_core_regrmw(device,
+				 A6XX_GMU_AO_SPARE_CNTL, 0x2, 0x0);
+	}
+}
+
+static void _a6xx_preemption_done(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status;
+
+	/*
+	 * In the very unlikely case that the power is off, do nothing - the
+	 * state will be reset on power up and everybody will be happy
+	 */
+
+	if (!kgsl_state_is_awake(device))
+		return;
+
+	kgsl_regread(device, A6XX_CP_CONTEXT_SWITCH_CNTL, &status);
+
+	if (status & 0x1) {
+		dev_err(device->dev,
+			     "Preemption not complete: status=%X cur=%d R/W=%X/%X next=%d R/W=%X/%X\n",
+			     status, adreno_dev->cur_rb->id,
+			     adreno_get_rptr(adreno_dev->cur_rb),
+			     adreno_dev->cur_rb->wptr,
+			     adreno_dev->next_rb->id,
+			     adreno_get_rptr(adreno_dev->next_rb),
+			     adreno_dev->next_rb->wptr);
+
+		/* Set a fault and restart */
+		adreno_dispatcher_fault(adreno_dev, ADRENO_PREEMPT_FAULT);
+
+		return;
+	}
+
+	adreno_dev->preempt.count++;
+
+	/*
+	 * In normal scenarios, preemption keep alive bit is cleared during
+	 * CP interrupt callback. However, if preemption is successful
+	 * immediately after preemption timer expires or there is a preemption
+	 * interrupt with non-zero status, the state is transitioned to complete
+	 * state. Once dispatcher is scheduled, it calls this function.
+	 * We can now safely clear the preemption keepalive bit, allowing
+	 * power collapse to resume its regular activity.
+	 */
+	_power_collapse_set(adreno_dev, false);
+
+	del_timer_sync(&adreno_dev->preempt.timer);
+
+	kgsl_regread(device,  A6XX_CP_CONTEXT_SWITCH_LEVEL_STATUS, &status);
+
+	trace_adreno_preempt_done(adreno_dev->cur_rb->id, adreno_dev->next_rb->id,
+		status, 0);
+
+	/* Clean up all the bits */
+	adreno_dev->prev_rb = adreno_dev->cur_rb;
+	adreno_dev->cur_rb = adreno_dev->next_rb;
+	adreno_dev->next_rb = NULL;
+
+	/* Update the wptr for the new command queue */
+	_update_wptr(adreno_dev, true, false);
+
+	/* Update the dispatcher timer for the new command queue */
+	mod_timer(&adreno_dev->dispatcher.timer,
+		adreno_dev->cur_rb->dispatch_q.expires);
+
+	/* Clear the preempt state */
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+}
+
+static void _a6xx_preemption_fault(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status;
+
+	/*
+	 * If the power is on check the preemption status one more time - if it
+	 * was successful then just transition to the complete state
+	 */
+	if (kgsl_state_is_awake(device)) {
+		kgsl_regread(device, A6XX_CP_CONTEXT_SWITCH_CNTL, &status);
+
+		if (!(status & 0x1)) {
+			adreno_set_preempt_state(adreno_dev,
+				ADRENO_PREEMPT_COMPLETE);
+
+			adreno_dispatcher_schedule(device);
+			return;
+		}
+	}
+
+	dev_err(device->dev,
+		     "Preemption Fault: cur=%d R/W=0x%x/0x%x, next=%d R/W=0x%x/0x%x\n",
+		     adreno_dev->cur_rb->id,
+		     adreno_get_rptr(adreno_dev->cur_rb),
+		     adreno_dev->cur_rb->wptr,
+		     adreno_dev->next_rb->id,
+		     adreno_get_rptr(adreno_dev->next_rb),
+		     adreno_dev->next_rb->wptr);
+
+	adreno_dispatcher_fault(adreno_dev, ADRENO_PREEMPT_FAULT);
+}
+
+static void _a6xx_preemption_worker(struct work_struct *work)
+{
+	struct adreno_preemption *preempt = container_of(work,
+		struct adreno_preemption, work);
+	struct adreno_device *adreno_dev = container_of(preempt,
+		struct adreno_device, preempt);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Need to take the mutex to make sure that the power stays on */
+	mutex_lock(&device->mutex);
+
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_FAULTED))
+		_a6xx_preemption_fault(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+}
+
+/* Find the highest priority active ringbuffer */
+static struct adreno_ringbuffer *a6xx_next_ringbuffer(
+		struct adreno_device *adreno_dev)
+{
+	struct adreno_ringbuffer *rb;
+	unsigned long flags;
+	unsigned int i;
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		bool empty;
+
+		spin_lock_irqsave(&rb->preempt_lock, flags);
+		empty = adreno_rb_empty(rb);
+		spin_unlock_irqrestore(&rb->preempt_lock, flags);
+
+		if (!empty)
+			return rb;
+	}
+
+	return NULL;
+}
+
+void a6xx_preemption_trigger(struct adreno_device *adreno_dev, bool atomic)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_ringbuffer *next;
+	uint64_t ttbr0, gpuaddr;
+	unsigned int contextidr, cntl;
+	unsigned long flags;
+	struct adreno_preemption *preempt = &adreno_dev->preempt;
+
+	/* Put ourselves into a possible trigger state */
+	if (!adreno_move_preempt_state(adreno_dev,
+		ADRENO_PREEMPT_NONE, ADRENO_PREEMPT_START))
+		return;
+
+	/* Get the next ringbuffer to preempt in */
+	next = a6xx_next_ringbuffer(adreno_dev);
+
+	/*
+	 * Nothing to do if every ringbuffer is empty or if the current
+	 * ringbuffer is the only active one
+	 */
+	if (next == NULL || next == adreno_dev->cur_rb) {
+		/*
+		 * Update any critical things that might have been skipped while
+		 * we were looking for a new ringbuffer
+		 */
+
+		if (next != NULL) {
+			_update_wptr(adreno_dev, false, atomic);
+
+			mod_timer(&adreno_dev->dispatcher.timer,
+				adreno_dev->cur_rb->dispatch_q.expires);
+		}
+
+		adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+		return;
+	}
+
+	/* Turn off the dispatcher timer */
+	del_timer(&adreno_dev->dispatcher.timer);
+
+	/*
+	 * This is the most critical section - we need to take care not to race
+	 * until we have programmed the CP for the switch
+	 */
+
+	spin_lock_irqsave(&next->preempt_lock, flags);
+
+	/* Get the pagetable from the pagetable info. */
+	kgsl_sharedmem_readq(device->scratch, &ttbr0,
+		SCRATCH_RB_OFFSET(next->id, ttbr0));
+	kgsl_sharedmem_readl(device->scratch, &contextidr,
+		SCRATCH_RB_OFFSET(next->id, contextidr));
+
+	kgsl_sharedmem_writel(next->preemption_desc,
+		PREEMPT_RECORD(wptr), next->wptr);
+
+	spin_unlock_irqrestore(&next->preempt_lock, flags);
+
+	/* And write it to the smmu info */
+
+	if (kgsl_mmu_is_perprocess(&device->mmu)) {
+		kgsl_sharedmem_writeq(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(ttbr0), ttbr0);
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(context_idr), contextidr);
+	}
+
+	kgsl_sharedmem_readq(preempt->scratch, &gpuaddr,
+		next->id * sizeof(u64));
+
+	/*
+	 * Set a keepalive bit before the first preemption register write.
+	 * This is required since while each individual write to the context
+	 * switch registers will wake the GPU from collapse, it will not in
+	 * itself cause GPU activity. Thus, the GPU could technically be
+	 * re-collapsed between subsequent register writes leading to a
+	 * prolonged preemption sequence. The keepalive bit prevents any
+	 * further power collapse while it is set.
+	 * It is more efficient to use a keepalive+wake-on-fence approach here
+	 * rather than an OOB. Both keepalive and the fence are effectively
+	 * free when the GPU is already powered on, whereas an OOB requires an
+	 * unconditional handshake with the GMU.
+	 */
+	_power_collapse_set(adreno_dev, true);
+
+	/*
+	 * Fenced writes on this path will make sure the GPU is woken up
+	 * in case it was power collapsed by the GMU.
+	 */
+	if (a6xx_fenced_write(adreno_dev,
+		A6XX_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_LO,
+		lower_32_bits(next->preemption_desc->gpuaddr),
+		FENCE_STATUS_WRITEDROPPED1_MASK))
+		goto err;
+
+	/*
+	 * Above fence writes will make sure GMU comes out of
+	 * IFPC state if its was in IFPC state but it doesn't
+	 * guarantee that GMU FW actually moved to ACTIVE state
+	 * i.e. wake-up from IFPC is complete.
+	 * Wait for GMU to move to ACTIVE state before triggering
+	 * preemption. This is require to make sure CP doesn't
+	 * interrupt GMU during wake-up from IFPC.
+	 */
+	if (!atomic && gmu_core_dev_wait_for_active_transition(device))
+		goto err;
+
+	if (a6xx_fenced_write(adreno_dev,
+		A6XX_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_HI,
+		upper_32_bits(next->preemption_desc->gpuaddr),
+		FENCE_STATUS_WRITEDROPPED1_MASK))
+		goto err;
+
+	if (kgsl_mmu_is_secured(&device->mmu)) {
+		if (a6xx_fenced_write(adreno_dev,
+			A6XX_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_LO,
+			lower_32_bits(next->secure_preemption_desc->gpuaddr),
+			FENCE_STATUS_WRITEDROPPED1_MASK))
+			goto err;
+
+		if (a6xx_fenced_write(adreno_dev,
+			A6XX_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_HI,
+			upper_32_bits(next->secure_preemption_desc->gpuaddr),
+			FENCE_STATUS_WRITEDROPPED1_MASK))
+			goto err;
+	}
+
+	if (a6xx_fenced_write(adreno_dev,
+		A6XX_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_LO,
+		lower_32_bits(gpuaddr),
+		FENCE_STATUS_WRITEDROPPED1_MASK))
+		goto err;
+
+	if (a6xx_fenced_write(adreno_dev,
+		A6XX_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_HI,
+		upper_32_bits(gpuaddr),
+		FENCE_STATUS_WRITEDROPPED1_MASK))
+		goto err;
+
+	adreno_dev->next_rb = next;
+
+	/* Start the timer to detect a stuck preemption */
+	mod_timer(&adreno_dev->preempt.timer,
+		jiffies + msecs_to_jiffies(ADRENO_PREEMPT_TIMEOUT));
+
+	cntl = (preempt->preempt_level << 6) | 0x01;
+
+	/* Skip save/restore during L1 preemption */
+	if (preempt->skipsaverestore)
+		cntl |= (1 << 9);
+
+	/* Enable GMEM save/restore across preemption */
+	if (preempt->usesgmem)
+		cntl |= (1 << 8);
+
+	trace_adreno_preempt_trigger(adreno_dev->cur_rb->id, adreno_dev->next_rb->id,
+		cntl, 0);
+
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_TRIGGERED);
+
+	/* Trigger the preemption */
+	if (a6xx_fenced_write(adreno_dev, A6XX_CP_CONTEXT_SWITCH_CNTL, cntl,
+					FENCE_STATUS_WRITEDROPPED1_MASK)) {
+		adreno_dev->next_rb = NULL;
+		del_timer(&adreno_dev->preempt.timer);
+		goto err;
+	}
+
+	return;
+err:
+	/* If fenced write fails, take inline snapshot and trigger recovery */
+	if (!atomic) {
+		gmu_core_fault_snapshot(device);
+		adreno_dispatcher_fault(adreno_dev,
+			ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+	} else {
+		adreno_dispatcher_fault(adreno_dev, ADRENO_GMU_FAULT);
+	}
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+	/* Clear the keep alive */
+	_power_collapse_set(adreno_dev, false);
+
+}
+
+void a6xx_preemption_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status;
+
+	if (!adreno_move_preempt_state(adreno_dev,
+		ADRENO_PREEMPT_TRIGGERED, ADRENO_PREEMPT_PENDING))
+		return;
+
+	kgsl_regread(device, A6XX_CP_CONTEXT_SWITCH_CNTL, &status);
+
+	if (status & 0x1) {
+		dev_err(KGSL_DEVICE(adreno_dev)->dev,
+			     "preempt interrupt with non-zero status: %X\n",
+			     status);
+
+		/*
+		 * Under the assumption that this is a race between the
+		 * interrupt and the register, schedule the worker to clean up.
+		 * If the status still hasn't resolved itself by the time we get
+		 * there then we have to assume something bad happened
+		 */
+		adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_COMPLETE);
+		adreno_dispatcher_schedule(KGSL_DEVICE(adreno_dev));
+		return;
+	}
+
+	adreno_dev->preempt.count++;
+
+	/*
+	 * We can now safely clear the preemption keepalive bit, allowing
+	 * power collapse to resume its regular activity.
+	 */
+	_power_collapse_set(adreno_dev, false);
+
+	del_timer(&adreno_dev->preempt.timer);
+
+	kgsl_regread(device, A6XX_CP_CONTEXT_SWITCH_LEVEL_STATUS, &status);
+
+	trace_adreno_preempt_done(adreno_dev->cur_rb->id, adreno_dev->next_rb->id,
+		status, 0);
+
+	adreno_dev->prev_rb = adreno_dev->cur_rb;
+	adreno_dev->cur_rb = adreno_dev->next_rb;
+	adreno_dev->next_rb = NULL;
+
+	/* Update the wptr if it changed while preemption was ongoing */
+	_update_wptr(adreno_dev, true, true);
+
+	/* Update the dispatcher timer for the new command queue */
+	mod_timer(&adreno_dev->dispatcher.timer,
+		adreno_dev->cur_rb->dispatch_q.expires);
+
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+
+	a6xx_preemption_trigger(adreno_dev, true);
+}
+
+void a6xx_preemption_schedule(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return;
+
+	mutex_lock(&device->mutex);
+
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_COMPLETE))
+		_a6xx_preemption_done(adreno_dev);
+
+	a6xx_preemption_trigger(adreno_dev, false);
+
+	mutex_unlock(&device->mutex);
+}
+
+u32 a6xx_preemption_pre_ibsubmit(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 *cmds)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 count = kgsl_mmu_is_secured(&device->mmu) ? 12 : 9;
+	unsigned int *cmds_orig = cmds;
+	uint64_t gpuaddr = 0;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	if (drawctxt) {
+		gpuaddr = drawctxt->base.user_ctxt_record->memdesc.gpuaddr;
+		count += 3;
+	}
+
+	*cmds++ = cp_type7_packet(CP_SET_PSEUDO_REGISTER, count);
+	/* NULL SMMU_INFO buffer - we track in KMD */
+	*cmds++ = SET_PSEUDO_SMMU_INFO;
+	cmds += cp_gpuaddr(adreno_dev, cmds, 0x0);
+
+	*cmds++ = SET_PSEUDO_PRIV_NON_SECURE_SAVE_ADDR;
+	cmds += cp_gpuaddr(adreno_dev, cmds, rb->preemption_desc->gpuaddr);
+
+	if (kgsl_mmu_is_secured(&device->mmu)) {
+		*cmds++ = SET_PSEUDO_PRIV_SECURE_SAVE_ADDR;
+		cmds += cp_gpuaddr(adreno_dev, cmds,
+				rb->secure_preemption_desc->gpuaddr);
+	}
+
+	if (drawctxt) {
+		*cmds++ = SET_PSEUDO_NON_PRIV_SAVE_ADDR;
+		cmds += cp_gpuaddr(adreno_dev, cmds, gpuaddr);
+	}
+
+	/*
+	 * There is no need to specify this address when we are about to
+	 * trigger preemption. This is because CP internally stores this
+	 * address specified here in the CP_SET_PSEUDO_REGISTER payload to
+	 * the context record and thus knows from where to restore
+	 * the saved perfcounters for the new ringbuffer.
+	 */
+	*cmds++ = SET_PSEUDO_COUNTER;
+	cmds += cp_gpuaddr(adreno_dev, cmds,
+			rb->perfcounter_save_restore_desc->gpuaddr);
+
+	if (drawctxt) {
+		struct adreno_ringbuffer *rb = drawctxt->rb;
+		uint64_t dest = PREEMPT_SCRATCH_ADDR(adreno_dev, rb->id);
+
+		*cmds++ = cp_mem_packet(adreno_dev, CP_MEM_WRITE, 2, 2);
+		cmds += cp_gpuaddr(adreno_dev, cmds, dest);
+		*cmds++ = lower_32_bits(gpuaddr);
+		*cmds++ = upper_32_bits(gpuaddr);
+
+		/* Add a KMD post amble to clear the perf counters during preemption */
+		if (!adreno_dev->perfcounter) {
+			u64 kmd_postamble_addr = SCRATCH_POSTAMBLE_ADDR(KGSL_DEVICE(adreno_dev));
+			*cmds++ = cp_type7_packet(CP_SET_AMBLE, 3);
+			*cmds++ = lower_32_bits(kmd_postamble_addr);
+			*cmds++ = upper_32_bits(kmd_postamble_addr);
+			*cmds++ = FIELD_PREP(GENMASK(22, 20), CP_KMD_AMBLE_TYPE)
+				| (FIELD_PREP(GENMASK(19, 0), adreno_dev->preempt.postamble_len));
+		}
+	}
+
+	return (unsigned int) (cmds - cmds_orig);
+}
+
+u32 a6xx_preemption_post_ibsubmit(struct adreno_device *adreno_dev,
+		u32 *cmds)
+{
+	u32 index = 0;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	if (adreno_dev->cur_rb) {
+		u64 dest = PREEMPT_SCRATCH_ADDR(adreno_dev, adreno_dev->cur_rb->id);
+
+		cmds[index++] = cp_type7_packet(CP_MEM_WRITE, 4);
+		cmds[index++] = lower_32_bits(dest);
+		cmds[index++] = upper_32_bits(dest);
+		cmds[index++] = 0;
+		cmds[index++] = 0;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_CONTEXT_SWITCH_YIELD, 4);
+	cmds[index++] = 0;
+	cmds[index++] = 0;
+	cmds[index++] = 1;
+	cmds[index++] = 0;
+
+	return index;
+}
+
+void a6xx_preemption_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_ringbuffer *rb;
+	unsigned int i;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return;
+
+	/* Force the state to be clear */
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+
+	if (kgsl_mmu_is_perprocess(&device->mmu)) {
+		/* smmu_info is allocated and mapped in a6xx_preemption_iommu_init */
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(magic), A6XX_CP_SMMU_INFO_MAGIC_REF);
+		kgsl_sharedmem_writeq(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(ttbr0), MMU_DEFAULT_TTBR0(device));
+
+		/* The CP doesn't use the asid record, so poison it */
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(asid), 0xDECAFBAD);
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(context_idr), 0);
+
+		kgsl_regwrite(device, A6XX_CP_CONTEXT_SWITCH_SMMU_INFO_LO,
+			lower_32_bits(iommu->smmu_info->gpuaddr));
+
+		kgsl_regwrite(device, A6XX_CP_CONTEXT_SWITCH_SMMU_INFO_HI,
+			upper_32_bits(iommu->smmu_info->gpuaddr));
+	}
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		kgsl_sharedmem_writel(rb->preemption_desc,
+			PREEMPT_RECORD(rptr), 0);
+		kgsl_sharedmem_writel(rb->preemption_desc,
+			PREEMPT_RECORD(wptr), 0);
+
+		adreno_ringbuffer_set_pagetable(device, rb,
+			device->mmu.defaultpagetable);
+	}
+}
+
+static void reset_rb_preempt_record(struct adreno_device *adreno_dev,
+	struct adreno_ringbuffer *rb)
+{
+	u32 cp_rb_cntl = A6XX_CP_RB_CNTL_DEFAULT |
+		(ADRENO_FEATURE(adreno_dev, ADRENO_APRIV) ? 0 : (1 << 27));
+
+	memset(rb->preemption_desc->hostptr, 0x0, rb->preemption_desc->size);
+
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(magic), A6XX_CP_CTXRECORD_MAGIC_REF);
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(cntl), cp_rb_cntl);
+	kgsl_sharedmem_writeq(rb->preemption_desc,
+		PREEMPT_RECORD(rptr_addr), SCRATCH_RB_GPU_ADDR(
+		KGSL_DEVICE(adreno_dev), rb->id, rptr));
+	kgsl_sharedmem_writeq(rb->preemption_desc,
+		PREEMPT_RECORD(rbase), rb->buffer_desc->gpuaddr);
+}
+
+void a6xx_reset_preempt_records(struct adreno_device *adreno_dev)
+{
+	int i;
+	struct adreno_ringbuffer *rb;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return;
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		reset_rb_preempt_record(adreno_dev, rb);
+	}
+}
+
+static int a6xx_preemption_ringbuffer_init(struct adreno_device *adreno_dev,
+	struct adreno_ringbuffer *rb)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	u64 ctxt_record_size = A6XX_CP_CTXRECORD_SIZE_IN_BYTES;
+	int ret;
+
+	if (a6xx_core->ctxt_record_size)
+		ctxt_record_size = a6xx_core->ctxt_record_size;
+
+	ret = adreno_allocate_global(device, &rb->preemption_desc,
+		ctxt_record_size, SZ_16K, 0, KGSL_MEMDESC_PRIVILEGED,
+		"preemption_desc");
+	if (ret)
+		return ret;
+
+	if (kgsl_mmu_is_secured(&device->mmu)) {
+		ret = adreno_allocate_global(device, &rb->secure_preemption_desc,
+			ctxt_record_size, 0, KGSL_MEMFLAGS_SECURE,
+			KGSL_MEMDESC_PRIVILEGED, "preemption_desc");
+		if (ret)
+			return ret;
+	}
+
+	ret = adreno_allocate_global(device, &rb->perfcounter_save_restore_desc,
+			A6XX_CP_PERFCOUNTER_SAVE_RESTORE_SIZE, 0, 0,
+			KGSL_MEMDESC_PRIVILEGED,
+			"perfcounter_save_restore_desc");
+	if (ret)
+		return ret;
+
+	reset_rb_preempt_record(adreno_dev, rb);
+
+	return 0;
+}
+
+int a6xx_preemption_init(struct adreno_device *adreno_dev)
+{
+	u32 flags = ADRENO_FEATURE(adreno_dev, ADRENO_APRIV) ? KGSL_MEMDESC_PRIVILEGED : 0;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_preemption *preempt = &adreno_dev->preempt;
+	struct adreno_ringbuffer *rb;
+	int ret;
+	unsigned int i;
+
+	/* We are dependent on IOMMU to make preemption go on the CP side */
+	if (kgsl_mmu_get_mmutype(device) != KGSL_MMU_TYPE_IOMMU)
+		return -ENODEV;
+
+	INIT_WORK(&preempt->work, _a6xx_preemption_worker);
+
+	/* Allocate mem for storing preemption switch record */
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		ret = a6xx_preemption_ringbuffer_init(adreno_dev, rb);
+		if (ret)
+			return ret;
+	}
+
+	ret = adreno_allocate_global(device, &preempt->scratch,
+		PAGE_SIZE, 0, 0, flags, "preempt_scratch");
+	if (ret)
+		return ret;
+
+	/* Allocate mem for storing preemption smmu record */
+	if (kgsl_mmu_is_perprocess(&device->mmu)) {
+		ret = adreno_allocate_global(device, &iommu->smmu_info, PAGE_SIZE, 0,
+			KGSL_MEMFLAGS_GPUREADONLY, KGSL_MEMDESC_PRIVILEGED,
+			"smmu_info");
+		if (ret)
+			return ret;
+	}
+
+	/*
+	 * First 28 dwords of the device scratch buffer are used to store shadow rb data.
+	 * Reserve 11 dwords in the device scratch buffer from SCRATCH_POSTAMBLE_OFFSET for
+	 * KMD postamble pm4 packets. This should be in *device->scratch* so that userspace
+	 * cannot access it.
+	 */
+	if (!adreno_dev->perfcounter) {
+		u32 *postamble = device->scratch->hostptr + SCRATCH_POSTAMBLE_OFFSET;
+		u32 count = 0;
+
+		postamble[count++] = cp_type7_packet(CP_REG_RMW, 3);
+		postamble[count++] = A6XX_RBBM_PERFCTR_SRAM_INIT_CMD;
+		postamble[count++] = 0x0;
+		postamble[count++] = 0x1;
+
+		postamble[count++] = cp_type7_packet(CP_WAIT_REG_MEM, 6);
+		postamble[count++] = 0x3;
+		postamble[count++] = A6XX_RBBM_PERFCTR_SRAM_INIT_STATUS;
+		postamble[count++] = 0x0;
+		postamble[count++] = 0x1;
+		postamble[count++] = 0x1;
+		postamble[count++] = 0x0;
+
+		preempt->postamble_len = count;
+	}
+
+	set_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv);
+	return 0;
+}
+
+int a6xx_preemption_context_init(struct kgsl_context *context)
+{
+	struct kgsl_device *device = context->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	uint64_t flags = 0;
+
+	if (!adreno_preemption_feature_set(adreno_dev))
+		return 0;
+
+	if (context->flags & KGSL_CONTEXT_SECURE)
+		flags |= KGSL_MEMFLAGS_SECURE;
+
+	if (is_compat_task())
+		flags |= KGSL_MEMFLAGS_FORCE_32BIT;
+
+	/*
+	 * gpumem_alloc_entry takes an extra refcount. Put it only when
+	 * destroying the context to keep the context record valid
+	 */
+	context->user_ctxt_record = gpumem_alloc_entry(context->dev_priv,
+			A6XX_CP_CTXRECORD_USER_RESTORE_SIZE, flags);
+	if (IS_ERR(context->user_ctxt_record)) {
+		int ret = PTR_ERR(context->user_ctxt_record);
+
+		context->user_ctxt_record = NULL;
+		return ret;
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_rgmu.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_rgmu.c
@@ -0,0 +1,1420 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/component.h>
+#include <linux/delay.h>
+#include <linux/firmware.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/regulator/consumer.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_a6xx_rgmu.h"
+#include "adreno_snapshot.h"
+#include "kgsl_bus.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+#define RGMU_CLK_FREQ 200000000
+
+/* RGMU timeouts */
+#define RGMU_IDLE_TIMEOUT		100	/* ms */
+#define RGMU_START_TIMEOUT		100	/* ms */
+#define GPU_START_TIMEOUT		100	/* ms */
+#define GLM_SLEEP_TIMEOUT		10	/* ms */
+
+static const unsigned int a6xx_rgmu_registers[] = {
+	/* GMU CX */
+	0x1F80F, 0x1F83D, 0x1F840, 0x1F8D8, 0x1F990, 0x1F99E, 0x1F9C0, 0x1F9CC,
+	/* GMU AO */
+	0x23B03, 0x23B16, 0x23B80, 0x23B82,
+	/* GPU CC */
+	0x24000, 0x24012, 0x24040, 0x24052, 0x24400, 0x24404, 0x24407, 0x2440B,
+	0x24415, 0x2441C, 0x2441E, 0x2442D, 0x2443C, 0x2443D, 0x2443F, 0x24440,
+	0x24442, 0x24449, 0x24458, 0x2445A, 0x24540, 0x2455E, 0x24800, 0x24802,
+	0x24C00, 0x24C02, 0x25400, 0x25402, 0x25800, 0x25802, 0x25C00, 0x25C02,
+	0x26000, 0x26002,
+};
+
+static struct a6xx_rgmu_device *to_a6xx_rgmu(struct adreno_device *adreno_dev)
+{
+	struct a6xx_device *a6xx_dev = container_of(adreno_dev,
+					struct a6xx_device, adreno_dev);
+
+	return &a6xx_dev->rgmu;
+}
+
+static void a6xx_rgmu_active_count_put(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (WARN(atomic_read(&device->active_cnt) == 0,
+		"Unbalanced get/put calls to KGSL active count\n"))
+		return;
+
+	if (atomic_dec_and_test(&device->active_cnt)) {
+		kgsl_pwrscale_update_stats(device);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+	}
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	wake_up(&device->active_cnt_wq);
+}
+
+static irqreturn_t a6xx_rgmu_irq_handler(int irq, void *data)
+{
+	struct kgsl_device *device = data;
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(ADRENO_DEVICE(device));
+	unsigned int status = 0;
+
+	gmu_core_regread(device, A6XX_GMU_AO_HOST_INTERRUPT_STATUS, &status);
+
+	if (status & RGMU_AO_IRQ_FENCE_ERR) {
+		unsigned int fence_status;
+
+		gmu_core_regread(device, A6XX_GMU_AHB_FENCE_STATUS,
+			&fence_status);
+		gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_CLR,
+			status);
+
+		dev_err_ratelimited(&rgmu->pdev->dev,
+			"FENCE error interrupt received %x\n", fence_status);
+	}
+
+	if (status & ~RGMU_AO_IRQ_MASK)
+		dev_err_ratelimited(&rgmu->pdev->dev,
+				"Unhandled RGMU interrupts 0x%lx\n",
+				status & ~RGMU_AO_IRQ_MASK);
+
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t a6xx_oob_irq_handler(int irq, void *data)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	unsigned int status = 0;
+
+	gmu_core_regread(device, A6XX_GMU_GMU2HOST_INTR_INFO, &status);
+
+	if (status & RGMU_OOB_IRQ_ERR_MSG) {
+		gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, status);
+
+		dev_err_ratelimited(&rgmu->pdev->dev,
+				"RGMU oob irq error\n");
+		adreno_dispatcher_fault(adreno_dev, ADRENO_GMU_FAULT);
+	}
+	if (status & ~RGMU_OOB_IRQ_MASK)
+		dev_err_ratelimited(&rgmu->pdev->dev,
+				"Unhandled OOB interrupts 0x%lx\n",
+				status & ~RGMU_OOB_IRQ_MASK);
+
+	return IRQ_HANDLED;
+}
+
+static const char *oob_to_str(enum oob_request req)
+{
+	if (req == oob_gpu)
+		return "oob_gpu";
+	else if (req == oob_perfcntr)
+		return "oob_perfcntr";
+	return "unknown";
+}
+
+/*
+ * a6xx_rgmu_oob_set() - Set OOB interrupt to RGMU
+ * @adreno_dev: Pointer to adreno device
+ * @req: Which of the OOB bits to request
+ */
+static int a6xx_rgmu_oob_set(struct kgsl_device *device,
+		enum oob_request req)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(ADRENO_DEVICE(device));
+	int ret, set, check;
+
+	if (req == oob_perfcntr && rgmu->num_oob_perfcntr++)
+		return 0;
+
+	set = BIT(req + 16);
+	check = BIT(req + 16);
+
+	gmu_core_regwrite(device, A6XX_GMU_HOST2GMU_INTR_SET, set);
+
+	ret = gmu_core_timed_poll_check(device,
+			A6XX_GMU_GMU2HOST_INTR_INFO,
+			check,
+			GPU_START_TIMEOUT,
+			check);
+
+	if (ret) {
+		unsigned int status;
+
+		if (req == oob_perfcntr)
+			rgmu->num_oob_perfcntr--;
+		gmu_core_regread(device, A6XX_RGMU_CX_PCC_DEBUG, &status);
+		dev_err(&rgmu->pdev->dev,
+				"Timed out while setting OOB req:%s status:0x%x\n",
+				oob_to_str(req), status);
+		gmu_core_fault_snapshot(device);
+		return ret;
+	}
+
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, check);
+	trace_kgsl_gmu_oob_set(set);
+	return 0;
+}
+
+/*
+ * a6xx_rgmu_oob_clear() - Clear a previously set OOB request.
+ * @adreno_dev: Pointer to the adreno device that has the RGMU
+ * @req: Which of the OOB bits to clear
+ */
+static void a6xx_rgmu_oob_clear(struct kgsl_device *device,
+		enum oob_request req)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(ADRENO_DEVICE(device));
+
+	if (req == oob_perfcntr && --rgmu->num_oob_perfcntr)
+		return;
+
+	gmu_core_regwrite(device, A6XX_GMU_HOST2GMU_INTR_SET, BIT(req + 24));
+	trace_kgsl_gmu_oob_clear(BIT(req + 24));
+}
+
+static void a6xx_rgmu_bcl_config(struct kgsl_device *device, bool on)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(ADRENO_DEVICE(device));
+
+	if (on) {
+		/* Enable BCL CRC HW i/f */
+		gmu_core_regwrite(device,
+				A6XX_GMU_AO_RGMU_GLM_HW_CRC_DISABLE, 0);
+	} else {
+		/* Disable CRC HW i/f */
+		gmu_core_regwrite(device,
+				A6XX_GMU_AO_RGMU_GLM_HW_CRC_DISABLE, 1);
+
+		/* Wait for HW CRC disable ACK */
+		if (gmu_core_timed_poll_check(device,
+				A6XX_GMU_AO_RGMU_GLM_SLEEP_STATUS,
+				BIT(1), GLM_SLEEP_TIMEOUT, BIT(1)))
+			dev_err_ratelimited(&rgmu->pdev->dev,
+				"Timed out waiting for HW CRC disable acknowledgment\n");
+
+		/* Pull down the valid RGMU_GLM_SLEEP_CTRL[7] to 0 */
+		gmu_core_regrmw(device, A6XX_GMU_AO_RGMU_GLM_SLEEP_CTRL,
+				BIT(7), 0);
+
+	}
+}
+
+static void a6xx_rgmu_irq_enable(struct adreno_device *adreno_dev)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Clear pending IRQs and Unmask needed IRQs */
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, 0xffffffff);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_CLR, 0xffffffff);
+
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_MASK,
+		~((unsigned int)RGMU_OOB_IRQ_MASK));
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_MASK,
+		(unsigned int)~RGMU_AO_IRQ_MASK);
+
+	/* Enable all IRQs on host */
+	enable_irq(rgmu->oob_interrupt_num);
+	enable_irq(rgmu->rgmu_interrupt_num);
+}
+
+static void a6xx_rgmu_irq_disable(struct adreno_device *adreno_dev)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Disable all IRQs on host */
+	disable_irq(rgmu->rgmu_interrupt_num);
+	disable_irq(rgmu->oob_interrupt_num);
+
+	/* Mask all IRQs and clear pending IRQs */
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_MASK, 0xffffffff);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_MASK, 0xffffffff);
+
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, 0xffffffff);
+	gmu_core_regwrite(device, A6XX_GMU_AO_HOST_INTERRUPT_CLR, 0xffffffff);
+}
+
+static int a6xx_rgmu_ifpc_store(struct kgsl_device *device,
+		unsigned int val)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	unsigned int requested_idle_level;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_IFPC))
+		return -EINVAL;
+
+	if (val)
+		requested_idle_level = GPU_HW_IFPC;
+	else
+		requested_idle_level = GPU_HW_ACTIVE;
+
+	if (requested_idle_level == rgmu->idle_level)
+		return 0;
+
+	/* Power cycle the GPU for changes to take effect */
+	return adreno_power_cycle_u32(adreno_dev, &rgmu->idle_level,
+		requested_idle_level);
+}
+
+static unsigned int a6xx_rgmu_ifpc_isenabled(struct kgsl_device *device)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(ADRENO_DEVICE(device));
+
+	return rgmu->idle_level == GPU_HW_IFPC;
+}
+
+
+static void a6xx_rgmu_prepare_stop(struct kgsl_device *device)
+{
+	/* Turn off GX_MEM retention */
+	kgsl_regwrite(device, A6XX_RBBM_BLOCK_GX_RETENTION_CNTL, 0);
+}
+
+#define GX_GDSC_POWER_OFF	BIT(6)
+bool a6xx_rgmu_gx_is_on(struct adreno_device *adreno_dev)
+{
+	unsigned int val;
+
+	gmu_core_regread(KGSL_DEVICE(adreno_dev),
+			A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, &val);
+	return !(val & GX_GDSC_POWER_OFF);
+}
+
+static int a6xx_rgmu_wait_for_lowest_idle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	unsigned int reg[10] = {0};
+	unsigned long t;
+	uint64_t ts1, ts2, ts3;
+
+	if (rgmu->idle_level != GPU_HW_IFPC)
+		return 0;
+
+	ts1 = a6xx_read_alwayson(adreno_dev);
+
+	/* FIXME: readl_poll_timeout? */
+	t = jiffies + msecs_to_jiffies(RGMU_IDLE_TIMEOUT);
+	do {
+		gmu_core_regread(device,
+			A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, &reg[0]);
+
+		if (reg[0] & GX_GDSC_POWER_OFF)
+			return 0;
+
+		/* Wait 10us to reduce unnecessary AHB bus traffic */
+		usleep_range(10, 100);
+	} while (!time_after(jiffies, t));
+
+	ts2 = a6xx_read_alwayson(adreno_dev);
+
+	/* Do one last read incase it succeeds */
+	gmu_core_regread(device,
+		A6XX_GMU_SPTPRAC_PWR_CLK_STATUS, &reg[0]);
+
+	if (reg[0] & GX_GDSC_POWER_OFF)
+		return 0;
+
+	ts3 = a6xx_read_alwayson(adreno_dev);
+
+	/* Collect abort data to help with debugging */
+	gmu_core_regread(device, A6XX_RGMU_CX_PCC_DEBUG, &reg[1]);
+	gmu_core_regread(device, A6XX_RGMU_CX_PCC_STATUS, &reg[2]);
+	gmu_core_regread(device, A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, &reg[3]);
+	kgsl_regread(device, A6XX_CP_STATUS_1, &reg[4]);
+	gmu_core_regread(device, A6XX_GMU_RBBM_INT_UNMASKED_STATUS, &reg[5]);
+	gmu_core_regread(device, A6XX_GMU_GMU_PWR_COL_KEEPALIVE, &reg[6]);
+	kgsl_regread(device, A6XX_CP_CP2GMU_STATUS, &reg[7]);
+	kgsl_regread(device, A6XX_CP_CONTEXT_SWITCH_CNTL, &reg[8]);
+	gmu_core_regread(device, A6XX_GMU_AO_SPARE_CNTL, &reg[9]);
+
+	dev_err(&rgmu->pdev->dev,
+		"----------------------[ RGMU error ]----------------------\n");
+	dev_err(&rgmu->pdev->dev, "Timeout waiting for lowest idle level\n");
+	dev_err(&rgmu->pdev->dev,
+			"Timestamps: %llx %llx %llx\n", ts1, ts2, ts3);
+	dev_err(&rgmu->pdev->dev,
+			"SPTPRAC_PWR_CLK_STATUS=%x PCC_DEBUG=%x PCC_STATUS=%x\n",
+			reg[0], reg[1], reg[2]);
+	dev_err(&rgmu->pdev->dev,
+			"CX_BUSY_STATUS=%x CP_STATUS_1=%x\n", reg[3], reg[4]);
+	dev_err(&rgmu->pdev->dev,
+			"RBBM_INT_UNMASKED_STATUS=%x PWR_COL_KEEPALIVE=%x\n",
+			reg[5], reg[6]);
+	dev_err(&rgmu->pdev->dev,
+			"CP2GMU_STATUS=%x CONTEXT_SWITCH_CNTL=%x AO_SPARE_CNTL=%x\n",
+			reg[7], reg[8], reg[9]);
+
+	WARN_ON(1);
+	gmu_core_fault_snapshot(device);
+	return -ETIMEDOUT;
+}
+
+/*
+ * The lowest 16 bits of this value are the number of XO clock cycles
+ * for main hysteresis. This is the first hysteresis. Here we set it
+ * to 0x1680 cycles, or 300 us. The highest 16 bits of this value are
+ * the number of XO clock cycles for short hysteresis. This happens
+ * after main hysteresis. Here we set it to 0xA cycles, or 0.5 us.
+ */
+#define A6X_RGMU_LONG_IFPC_HYST	FIELD_PREP(GENMASK(15, 0), 0x1680)
+#define A6X_RGMU_SHORT_IFPC_HYST	FIELD_PREP(GENMASK(31, 16), 0xA)
+
+/* Minimum IFPC timer (200usec) allowed to override default value */
+#define A6X_RGMU_LONG_IFPC_HYST_FLOOR	FIELD_PREP(GENMASK(15, 0), 0x0F00)
+
+/* HOSTTOGMU and TIMER0/1 interrupt mask: 0x20060 */
+#define RGMU_INTR_EN_MASK  (BIT(5) | BIT(6) | BIT(17))
+
+/* RGMU FENCE RANGE MASK */
+#define RGMU_FENCE_RANGE_MASK	((0x1 << 31) | ((0xA << 2) << 18) | (0x8A0))
+
+static int a6xx_rgmu_fw_start(struct adreno_device *adreno_dev,
+		unsigned int boot_state)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	unsigned int status;
+	int i;
+
+	switch (boot_state) {
+	case GMU_COLD_BOOT:
+	case GMU_WARM_BOOT:
+		/* Turn on TCM retention */
+		gmu_core_regwrite(device, A6XX_GMU_GENERAL_7, 1);
+
+		/* Load RGMU FW image via AHB bus */
+		for (i = 0; i < rgmu->fw_size; i++)
+			gmu_core_regwrite(device, A6XX_GMU_CM3_ITCM_START + i,
+					rgmu->fw_hostptr[i]);
+		break;
+	}
+
+	/* IFPC Feature Enable */
+	if (rgmu->idle_level == GPU_HW_IFPC) {
+		gmu_core_regwrite(device, A6XX_GMU_PWR_COL_INTER_FRAME_HYST,
+				A6X_RGMU_SHORT_IFPC_HYST | adreno_dev->ifpc_hyst);
+		gmu_core_regwrite(device, A6XX_GMU_PWR_COL_INTER_FRAME_CTRL,
+				BIT(0));
+	}
+
+	/* For RGMU CX interrupt */
+	gmu_core_regwrite(device, A6XX_RGMU_CX_INTR_GEN_EN, RGMU_INTR_EN_MASK);
+
+	/* Enable GMU AO to host interrupt */
+	gmu_core_regwrite(device, A6XX_GMU_AO_INTERRUPT_EN, RGMU_AO_IRQ_MASK);
+
+	/* For OOB */
+	gmu_core_regwrite(device, A6XX_GMU_HOST2GMU_INTR_EN_2, 0x00FF0000);
+	gmu_core_regwrite(device, A6XX_GMU_HOST2GMU_INTR_EN_3, 0xFF000000);
+
+	/* Fence Address range configuration */
+	gmu_core_regwrite(device, A6XX_GMU_AHB_FENCE_RANGE_0,
+			RGMU_FENCE_RANGE_MASK);
+
+	/* During IFPC RGMU will put fence in drop mode so we would
+	 * need to put fence allow mode during slumber out sequence.
+	 */
+	gmu_core_regwrite(device, A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+
+	/* BCL ON Sequence */
+	a6xx_rgmu_bcl_config(device, true);
+
+	/* Write 0 first to make sure that rgmu is reset */
+	gmu_core_regwrite(device, A6XX_RGMU_CX_PCC_CTRL, 0);
+
+	/* Make sure putting in reset doesn't happen after writing 1 */
+	wmb();
+
+	/* Bring rgmu out of reset */
+	gmu_core_regwrite(device, A6XX_RGMU_CX_PCC_CTRL, 1);
+
+	if (gmu_core_timed_poll_check(device, A6XX_RGMU_CX_PCC_INIT_RESULT,
+			BIT(0), RGMU_START_TIMEOUT, BIT(0))) {
+		gmu_core_regread(device, A6XX_RGMU_CX_PCC_DEBUG, &status);
+		dev_err(&rgmu->pdev->dev,
+				"rgmu boot Failed. status:%08x\n", status);
+		gmu_core_fault_snapshot(device);
+		return -ETIMEDOUT;
+	}
+
+	/* Read the RGMU firmware version from registers */
+	gmu_core_regread(device, A6XX_GMU_GENERAL_0, &rgmu->ver);
+
+	return 0;
+}
+
+static void a6xx_rgmu_notify_slumber(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Disable the power counter so that the RGMU is not busy */
+	gmu_core_regwrite(device, A6XX_GMU_CX_GMU_POWER_COUNTER_ENABLE, 0);
+
+	/* BCL OFF Sequence */
+	a6xx_rgmu_bcl_config(device, false);
+}
+
+static void a6xx_rgmu_disable_clks(struct adreno_device *adreno_dev)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/*
+	 * This is based on the assumption that GMU is the only one controlling
+	 * the GX HS. This code path is the only client voting for GX from linux
+	 * kernel.
+	 */
+	if (!a6xx_rgmu_gx_is_on(adreno_dev))
+		goto done;
+
+	/*
+	 * Switch gx gdsc control from GMU to CPU force non-zero reference
+	 * count in clk driver so next disable call will turn off the GDSC
+	 */
+	kgsl_pwrctrl_enable_gx_gdsc(device);
+	kgsl_pwrctrl_disable_gx_gdsc(device);
+
+	if (a6xx_rgmu_gx_is_on(adreno_dev))
+		dev_err(&rgmu->pdev->dev, "gx is stuck on\n");
+
+done:
+	clk_bulk_disable_unprepare(rgmu->num_clks, rgmu->clks);
+}
+
+void a6xx_rgmu_snapshot(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+
+	adreno_snapshot_registers(device, snapshot, a6xx_rgmu_registers,
+			ARRAY_SIZE(a6xx_rgmu_registers) / 2);
+
+	a6xx_snapshot(adreno_dev, snapshot);
+
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_CLR, 0xffffffff);
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_MASK,
+		RGMU_OOB_IRQ_MASK);
+
+	if (device->gmu_fault)
+		rgmu->fault_count++;
+}
+
+static void a6xx_rgmu_suspend(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	a6xx_rgmu_irq_disable(adreno_dev);
+	a6xx_rgmu_disable_clks(adreno_dev);
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	kgsl_pwrctrl_set_state(KGSL_DEVICE(adreno_dev), KGSL_STATE_NONE);
+}
+
+static int a6xx_rgmu_enable_clks(struct adreno_device *adreno_dev)
+{
+	int ret;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	ret = clk_set_rate(rgmu->rgmu_clk, RGMU_CLK_FREQ);
+	if (ret) {
+		dev_err(&rgmu->pdev->dev, "Couldn't set the RGMU clock\n");
+		return ret;
+	}
+
+	ret = clk_set_rate(rgmu->gpu_clk,
+		pwr->pwrlevels[pwr->default_pwrlevel].gpu_freq);
+	if (ret) {
+		dev_err(&rgmu->pdev->dev, "Couldn't set the GPU clock\n");
+		return ret;
+	}
+
+	ret = clk_bulk_prepare_enable(rgmu->num_clks, rgmu->clks);
+	if (ret) {
+		dev_err(&rgmu->pdev->dev, "Failed to enable RGMU clocks\n");
+		return ret;
+	}
+
+	device->state = KGSL_STATE_AWARE;
+
+	return 0;
+}
+
+/*
+ * a6xx_rgmu_load_firmware() - Load the ucode into the RGMU TCM
+ * @adreno_dev: Pointer to adreno device
+ */
+static int a6xx_rgmu_load_firmware(struct adreno_device *adreno_dev)
+{
+	const struct firmware *fw = NULL;
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	const struct adreno_a6xx_core *a6xx_core = to_a6xx_core(adreno_dev);
+	int ret;
+
+	/* RGMU fw already saved and verified so do nothing new */
+	if (rgmu->fw_hostptr)
+		return 0;
+
+	ret = request_firmware(&fw, a6xx_core->gmufw_name, &rgmu->pdev->dev);
+	if (ret < 0) {
+		dev_err(&rgmu->pdev->dev, "request_firmware (%s) failed: %d\n",
+				a6xx_core->gmufw_name, ret);
+		return ret;
+	}
+
+	rgmu->fw_hostptr = devm_kmemdup(&rgmu->pdev->dev, fw->data,
+					fw->size, GFP_KERNEL);
+
+	if (rgmu->fw_hostptr)
+		rgmu->fw_size = (fw->size / sizeof(u32));
+
+	release_firmware(fw);
+	return rgmu->fw_hostptr ? 0 : -ENOMEM;
+}
+
+/* Halt RGMU execution */
+static void a6xx_rgmu_halt_execution(struct kgsl_device *device, bool force)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(ADRENO_DEVICE(device));
+	unsigned int index, status, fence;
+
+	if (!device->gmu_fault)
+		return;
+
+	/* Mask so there's no interrupt caused by NMI */
+	gmu_core_regwrite(device, A6XX_GMU_GMU2HOST_INTR_MASK, 0xFFFFFFFF);
+
+	/* Make sure the interrupt is masked */
+	wmb();
+
+	gmu_core_regread(device, A6XX_RGMU_CX_PCC_DEBUG, &index);
+	gmu_core_regread(device, A6XX_RGMU_CX_PCC_STATUS, &status);
+	gmu_core_regread(device, A6XX_GMU_AO_AHB_FENCE_CTRL, &fence);
+
+	dev_err(&rgmu->pdev->dev,
+			"RGMU Fault PCC_DEBUG:0x%x PCC_STATUS:0x%x FENCE_CTRL:0x%x\n",
+			index, status, fence);
+
+	/*
+	 * Write 0 to halt RGMU execution. We halt it in GMU/GPU fault and
+	 * re start PCC execution in recovery path.
+	 */
+	gmu_core_regwrite(device, A6XX_RGMU_CX_PCC_CTRL, 0);
+
+	/*
+	 * Ensure that fence is in allow mode after halting RGMU.
+	 * After halting RGMU we dump snapshot.
+	 */
+	gmu_core_regwrite(device, A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+
+}
+
+static void halt_gbif_arb(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Halt all AXI requests */
+	kgsl_regwrite(device, A6XX_GBIF_HALT, A6XX_GBIF_ARB_HALT_MASK);
+	adreno_wait_for_halt_ack(device, A6XX_GBIF_HALT_ACK,
+		A6XX_GBIF_ARB_HALT_MASK);
+
+	/* De-assert the halts */
+	kgsl_regwrite(device, A6XX_GBIF_HALT, 0x0);
+}
+
+
+/* Caller shall ensure GPU is ready for SLUMBER */
+static void a6xx_rgmu_power_off(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	kgsl_pwrctrl_axi(device, false);
+
+	if (device->gmu_fault)
+		return a6xx_rgmu_suspend(adreno_dev);
+
+	/* Wait for the lowest idle level we requested */
+	ret = a6xx_rgmu_wait_for_lowest_idle(adreno_dev);
+	if (ret)
+		return a6xx_rgmu_suspend(adreno_dev);
+
+	a6xx_rgmu_notify_slumber(adreno_dev);
+
+	/* Halt CX traffic and de-assert halt */
+	halt_gbif_arb(adreno_dev);
+
+	a6xx_rgmu_irq_disable(adreno_dev);
+	a6xx_rgmu_disable_clks(adreno_dev);
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	kgsl_pwrctrl_clear_l3_vote(device);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_NONE);
+}
+
+static int a6xx_rgmu_clock_set(struct adreno_device *adreno_dev,
+		u32 pwrlevel)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	int ret;
+	unsigned long rate;
+
+	if (pwrlevel == INVALID_DCVS_IDX)
+		return -EINVAL;
+
+	rate = device->pwrctrl.pwrlevels[pwrlevel].gpu_freq;
+
+	ret = clk_set_rate(rgmu->gpu_clk, rate);
+	if (ret)
+		dev_err(&rgmu->pdev->dev, "Couldn't set the GPU clock\n");
+
+	return ret;
+}
+
+static int a6xx_gpu_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/* Clear any GPU faults that might have been left over */
+	adreno_clear_gpu_fault(adreno_dev);
+
+	adreno_set_active_ctxs_null(adreno_dev);
+
+	ret = kgsl_mmu_start(device);
+	if (ret)
+		goto err;
+
+	ret = a6xx_rgmu_oob_set(device, oob_gpu);
+	if (ret)
+		goto err_oob_clear;
+
+	/* Clear the busy_data stats - we're starting over from scratch */
+	memset(&adreno_dev->busy_data, 0, sizeof(adreno_dev->busy_data));
+
+	/* Restore performance counter registers with saved values */
+	adreno_perfcounter_restore(adreno_dev);
+
+	a6xx_start(adreno_dev);
+
+	/* Re-initialize the coresight registers if applicable */
+	adreno_coresight_start(adreno_dev);
+
+	adreno_perfcounter_start(adreno_dev);
+
+	/* Clear FSR here in case it is set from a previous pagefault */
+	kgsl_mmu_clear_fsr(&device->mmu);
+
+	a6xx_enable_gpu_irq(adreno_dev);
+
+	ret = a6xx_rb_start(adreno_dev);
+	if (ret) {
+		a6xx_disable_gpu_irq(adreno_dev);
+		goto err_oob_clear;
+	}
+
+	/*
+	 * At this point it is safe to assume that we recovered. Setting
+	 * this field allows us to take a new snapshot for the next failure
+	 * if we are prioritizing the first unrecoverable snapshot.
+	 */
+	if (device->snapshot)
+		device->snapshot->recovered = true;
+
+	/* Start the dispatcher */
+	adreno_dispatcher_start(device);
+
+	device->reset_counter++;
+
+	a6xx_rgmu_oob_clear(device, oob_gpu);
+
+	return 0;
+
+err_oob_clear:
+	a6xx_rgmu_oob_clear(device, oob_gpu);
+
+err:
+	a6xx_rgmu_power_off(adreno_dev);
+
+	return ret;
+}
+
+static int a6xx_rgmu_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_AWARE);
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (ret)
+		return ret;
+
+	ret = a6xx_rgmu_enable_clks(adreno_dev);
+	if (ret) {
+		kgsl_pwrctrl_disable_cx_gdsc(device);
+		return ret;
+	}
+
+	a6xx_rgmu_irq_enable(adreno_dev);
+
+	ret = a6xx_rgmu_fw_start(adreno_dev, GMU_COLD_BOOT);
+	if (ret)
+		goto err;
+
+	/* Request default DCVS level */
+	ret = kgsl_pwrctrl_set_default_gpu_pwrlevel(device);
+	if (ret)
+		goto err;
+
+	ret = kgsl_pwrctrl_axi(device, true);
+	if (ret)
+		goto err;
+
+	device->gmu_fault = false;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return 0;
+
+err:
+	a6xx_rgmu_power_off(adreno_dev);
+
+	return ret;
+}
+
+static int a6xx_power_off(struct adreno_device *adreno_dev);
+
+static void rgmu_idle_check(struct work_struct *work)
+{
+	struct kgsl_device *device = container_of(work,
+					struct kgsl_device, idle_check_ws);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	int ret;
+
+	mutex_lock(&device->mutex);
+
+	if (test_bit(GMU_DISABLE_SLUMBER, &device->gmu_core.flags))
+		goto done;
+
+	if (atomic_read(&device->active_cnt) || time_is_after_jiffies(device->idle_jiffies)) {
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	spin_lock(&device->submit_lock);
+
+	if (device->submit_now) {
+		spin_unlock(&device->submit_lock);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	device->skip_inline_submit = true;
+	spin_unlock(&device->submit_lock);
+
+	ret = a6xx_power_off(adreno_dev);
+	if (ret == -EBUSY) {
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+	}
+
+done:
+	mutex_unlock(&device->mutex);
+}
+
+static void rgmu_idle_timer(struct timer_list *t)
+{
+	struct kgsl_device *device = container_of(t, struct kgsl_device,
+					idle_timer);
+
+	kgsl_schedule_work(&device->idle_check_ws);
+}
+
+static int a6xx_boot(struct adreno_device *adreno_dev)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (test_bit(RGMU_PRIV_GPU_STARTED, &rgmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = a6xx_rgmu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_start_idle_timer(device);
+
+	kgsl_pwrscale_wake(device);
+
+	set_bit(RGMU_PRIV_GPU_STARTED, &rgmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	return 0;
+}
+
+static void a6xx_rgmu_touch_wakeup(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	int ret;
+
+	/*
+	 * Do not wake up a suspended device or until the first boot sequence
+	 * has been completed.
+	 */
+	if (test_bit(RGMU_PRIV_PM_SUSPEND, &rgmu->flags) ||
+		!test_bit(RGMU_PRIV_FIRST_BOOT_DONE, &rgmu->flags))
+		return;
+
+	if (test_bit(RGMU_PRIV_GPU_STARTED, &rgmu->flags))
+		goto done;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = a6xx_rgmu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	ret = a6xx_gpu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	kgsl_pwrscale_wake(device);
+
+	set_bit(RGMU_PRIV_GPU_STARTED, &rgmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+done:
+	/*
+	 * When waking up from a touch event we want to stay active long enough
+	 * for the user to send a draw command.  The default idle timer timeout
+	 * is shorter than we want so go ahead and push the idle timer out
+	 * further for this special case
+	 */
+	mod_timer(&device->idle_timer, jiffies +
+			msecs_to_jiffies(adreno_wake_timeout));
+
+}
+
+static int a6xx_first_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	int ret;
+
+	if (test_bit(RGMU_PRIV_FIRST_BOOT_DONE, &rgmu->flags))
+		return a6xx_boot(adreno_dev);
+
+	ret = a6xx_ringbuffer_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_microcode_read(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_rgmu_load_firmware(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = a6xx_rgmu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = a6xx_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	adreno_get_bus_counters(adreno_dev);
+
+	adreno_create_profile_buffer(adreno_dev);
+
+	set_bit(RGMU_PRIV_FIRST_BOOT_DONE, &rgmu->flags);
+	set_bit(RGMU_PRIV_GPU_STARTED, &rgmu->flags);
+
+	/*
+	 * There is a possible deadlock scenario during kgsl firmware reading
+	 * (request_firmware) and devfreq update calls. During first boot, kgsl
+	 * device mutex is held and then request_firmware is called for reading
+	 * firmware. request_firmware internally takes dev_pm_qos_mtx lock.
+	 * Whereas in case of devfreq update calls triggered by thermal/bcl or
+	 * devfreq sysfs, it first takes the same dev_pm_qos_mtx lock and then
+	 * tries to take kgsl device mutex as part of get_dev_status/target
+	 * calls. This results in deadlock when both thread are unable to acquire
+	 * the mutex held by other thread. Enable devfreq updates now as we are
+	 * done reading all firmware files.
+	 */
+	device->pwrscale.devfreq_enabled = true;
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	return 0;
+}
+
+static int a6xx_rgmu_first_open(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	ret = a6xx_first_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	/*
+	 * A client that does a first_open but never closes the device
+	 * may prevent us from going back to SLUMBER. So trigger the idle
+	 * check by incrementing the active count and immediately releasing it.
+	 */
+	atomic_inc(&device->active_cnt);
+	a6xx_rgmu_active_count_put(adreno_dev);
+
+	return 0;
+}
+
+static int a6xx_power_off(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	int ret;
+
+	adreno_suspend_context(device);
+
+	/*
+	 * adreno_suspend_context() unlocks the device mutex, which
+	 * could allow a concurrent thread to attempt SLUMBER sequence.
+	 * Hence, check the flags before proceeding with SLUMBER.
+	 */
+	if (!test_bit(RGMU_PRIV_GPU_STARTED, &rgmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SLUMBER);
+
+	ret = a6xx_rgmu_oob_set(device, oob_gpu);
+	if (ret) {
+		a6xx_rgmu_oob_clear(device, oob_gpu);
+		goto no_gx_power;
+	}
+
+	if (a6xx_irq_pending(adreno_dev)) {
+		a6xx_gmu_oob_clear(device, oob_gpu);
+		return -EBUSY;
+	}
+
+	kgsl_pwrscale_update_stats(device);
+
+	/* Save active coresight registers if applicable */
+	adreno_coresight_stop(adreno_dev);
+
+	/* Save physical performance counter values before GPU power down*/
+	adreno_perfcounter_save(adreno_dev);
+
+	adreno_irqctrl(adreno_dev, 0);
+
+	a6xx_rgmu_prepare_stop(device);
+
+	a6xx_rgmu_oob_clear(device, oob_gpu);
+
+no_gx_power:
+	/* Halt all gx traffic */
+	kgsl_regwrite(device, A6XX_GBIF_HALT, A6XX_GBIF_CLIENT_HALT_MASK);
+
+	adreno_wait_for_halt_ack(device, A6XX_GBIF_HALT_ACK,
+		A6XX_GBIF_CLIENT_HALT_MASK);
+
+	kgsl_pwrctrl_irq(device, false);
+
+	a6xx_rgmu_power_off(adreno_dev);
+
+	adreno_set_active_ctxs_null(adreno_dev);
+
+	adreno_dispatcher_stop(adreno_dev);
+
+	adreno_ringbuffer_stop(adreno_dev);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpu_llc_slice);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpuhtw_llc_slice);
+
+	clear_bit(RGMU_PRIV_GPU_STARTED, &rgmu->flags);
+
+	del_timer_sync(&device->idle_timer);
+
+	kgsl_pwrscale_sleep(device);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SLUMBER);
+
+	return ret;
+}
+
+int a6xx_rgmu_reset(struct adreno_device *adreno_dev)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+
+	a6xx_disable_gpu_irq(adreno_dev);
+
+	/* Hard reset the rgmu and gpu */
+	a6xx_rgmu_suspend(adreno_dev);
+
+	a6xx_reset_preempt_records(adreno_dev);
+
+	clear_bit(RGMU_PRIV_GPU_STARTED, &rgmu->flags);
+
+	/* Attempt rebooting the rgmu and gpu */
+	return a6xx_boot(adreno_dev);
+}
+
+static int a6xx_rgmu_active_count_get(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	int ret = 0;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EINVAL;
+
+	if (test_bit(RGMU_PRIV_PM_SUSPEND, &rgmu->flags))
+		return -EINVAL;
+
+	if (atomic_read(&device->active_cnt) == 0)
+		ret = a6xx_boot(adreno_dev);
+
+	if (ret == 0) {
+		atomic_inc(&device->active_cnt);
+		trace_kgsl_active_count(device,
+			(unsigned long) __builtin_return_address(0));
+	}
+
+	return ret;
+}
+
+static int a6xx_rgmu_pm_suspend(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	int ret;
+
+	if (test_bit(RGMU_PRIV_PM_SUSPEND, &rgmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SUSPEND);
+
+	/* Halt any new submissions */
+	reinit_completion(&device->halt_gate);
+
+	/* wait for active count so device can be put in slumber */
+	ret = kgsl_active_count_wait(device, 0, HZ);
+	if (ret) {
+		dev_err(device->dev,
+			"Timed out waiting for the active count\n");
+		goto err;
+	}
+
+	ret = adreno_idle(device);
+	if (ret)
+		goto err;
+
+	a6xx_power_off(adreno_dev);
+
+	set_bit(RGMU_PRIV_PM_SUSPEND, &rgmu->flags);
+
+	adreno_get_gpu_halt(adreno_dev);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SUSPEND);
+
+	return 0;
+err:
+	adreno_dispatcher_start(device);
+	return ret;
+}
+
+static void a6xx_rgmu_pm_resume(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+
+	if (WARN(!test_bit(GMU_PRIV_PM_SUSPEND, &rgmu->flags),
+		"resume invoked without a suspend\n"))
+		return;
+
+	adreno_put_gpu_halt(adreno_dev);
+
+	clear_bit(RGMU_PRIV_PM_SUSPEND, &rgmu->flags);
+
+	adreno_dispatcher_start(device);
+}
+
+static const struct gmu_dev_ops a6xx_rgmudev = {
+	.oob_set = a6xx_rgmu_oob_set,
+	.oob_clear = a6xx_rgmu_oob_clear,
+	.ifpc_store = a6xx_rgmu_ifpc_store,
+	.ifpc_isenabled = a6xx_rgmu_ifpc_isenabled,
+	.send_nmi = a6xx_rgmu_halt_execution,
+};
+
+static int a6xx_rgmu_irq_probe(struct kgsl_device *device)
+{
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(ADRENO_DEVICE(device));
+	int ret;
+
+	ret = kgsl_request_irq(rgmu->pdev, "kgsl_oob",
+			a6xx_oob_irq_handler, device);
+	if (ret < 0)
+		return ret;
+
+	rgmu->oob_interrupt_num  = ret;
+
+	ret = kgsl_request_irq(rgmu->pdev,
+		"kgsl_rgmu", a6xx_rgmu_irq_handler, device);
+	if (ret < 0)
+		return ret;
+
+	rgmu->rgmu_interrupt_num = ret;
+	return 0;
+}
+
+static int a6xx_rgmu_clocks_probe(struct a6xx_rgmu_device *rgmu,
+		struct device_node *node)
+{
+	int ret, i;
+
+	ret = devm_clk_bulk_get_all(&rgmu->pdev->dev, &rgmu->clks);
+	if (ret < 0)
+		return ret;
+	/*
+	 * Voting for apb_pclk will enable power and clocks required for
+	 * QDSS path to function. However, if QCOM_KGSL_QDSS_STM is not enabled,
+	 * QDSS is essentially unusable. Hence, if QDSS cannot be used,
+	 * don't vote for this clock.
+	 */
+	if (!IS_ENABLED(CONFIG_QCOM_KGSL_QDSS_STM)) {
+		for (i = 0; i < ret; i++) {
+			if (!strcmp(rgmu->clks[i].id, "apb_pclk")) {
+				rgmu->clks[i].clk = NULL;
+				break;
+			}
+		}
+	}
+	rgmu->num_clks = ret;
+
+	rgmu->gpu_clk = kgsl_of_clk_by_name(rgmu->clks, ret, "core");
+	if (!rgmu->gpu_clk) {
+		dev_err(&rgmu->pdev->dev, "The GPU clock isn't defined\n");
+		return -ENODEV;
+	}
+
+	rgmu->rgmu_clk = kgsl_of_clk_by_name(rgmu->clks, ret, "gmu");
+	if (!rgmu->rgmu_clk) {
+		dev_err(&rgmu->pdev->dev, "The RGMU clock isn't defined\n");
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+const struct adreno_power_ops a6xx_rgmu_power_ops = {
+	.first_open = a6xx_rgmu_first_open,
+	.last_close = a6xx_power_off,
+	.active_count_get = a6xx_rgmu_active_count_get,
+	.active_count_put = a6xx_rgmu_active_count_put,
+	.pm_suspend = a6xx_rgmu_pm_suspend,
+	.pm_resume = a6xx_rgmu_pm_resume,
+	.touch_wakeup = a6xx_rgmu_touch_wakeup,
+	.gpu_clock_set = a6xx_rgmu_clock_set,
+};
+
+int a6xx_rgmu_device_probe(struct platform_device *pdev,
+	u32 chipid, const struct adreno_gpu_core *gpucore)
+{
+	struct adreno_device *adreno_dev;
+	struct kgsl_device *device;
+	struct a6xx_device *a6xx_dev;
+	int ret;
+
+	a6xx_dev = devm_kzalloc(&pdev->dev, sizeof(*a6xx_dev),
+			GFP_KERNEL);
+	if (!a6xx_dev)
+		return -ENOMEM;
+
+	adreno_dev = &a6xx_dev->adreno_dev;
+
+	ret = a6xx_probe_common(pdev, adreno_dev, chipid, gpucore);
+	if (ret)
+		return ret;
+
+	ret = adreno_dispatcher_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	device = KGSL_DEVICE(adreno_dev);
+
+	INIT_WORK(&device->idle_check_ws, rgmu_idle_check);
+
+	timer_setup(&device->idle_timer, rgmu_idle_timer, 0);
+
+	adreno_dev->irq_mask = A6XX_INT_MASK;
+
+	return 0;
+}
+
+int a6xx_rgmu_add_to_minidump(struct adreno_device *adreno_dev)
+{
+	struct a6xx_device *a6xx_dev = container_of(adreno_dev,
+					struct a6xx_device, adreno_dev);
+
+	return kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_A6XX_DEVICE,
+				(void *)(a6xx_dev), sizeof(struct a6xx_device));
+}
+
+/* Do not access any RGMU registers in RGMU probe function */
+static int a6xx_rgmu_probe(struct kgsl_device *device,
+		struct platform_device *pdev)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct a6xx_rgmu_device *rgmu = to_a6xx_rgmu(adreno_dev);
+	int ret;
+
+	rgmu->pdev = pdev;
+
+	/* Set up RGMU gdscs */
+	ret = kgsl_pwrctrl_probe_gdscs(device, pdev);
+	if (ret)
+		return ret;
+
+	/* Set up RGMU clocks */
+	ret = a6xx_rgmu_clocks_probe(rgmu, pdev->dev.of_node);
+	if (ret)
+		return ret;
+
+	ret = kgsl_regmap_add_region(&device->regmap, pdev,
+		"kgsl_rgmu", NULL, NULL);
+	if (ret) {
+		dev_err(&pdev->dev, "Unable to map the RGMU registers\n");
+		return ret;
+	}
+
+	/* Initialize OOB and RGMU interrupts */
+	ret = a6xx_rgmu_irq_probe(device);
+	if (ret)
+		return ret;
+
+	/* Set up RGMU idle states */
+	if (ADRENO_FEATURE(ADRENO_DEVICE(device), ADRENO_IFPC)) {
+		rgmu->idle_level = GPU_HW_IFPC;
+		adreno_dev->ifpc_hyst = A6X_RGMU_LONG_IFPC_HYST;
+		adreno_dev->ifpc_hyst_floor = A6X_RGMU_LONG_IFPC_HYST_FLOOR;
+	} else {
+		rgmu->idle_level = GPU_HW_ACTIVE;
+	}
+
+	set_bit(GMU_ENABLED, &device->gmu_core.flags);
+	device->gmu_core.dev_ops = &a6xx_rgmudev;
+
+	return 0;
+}
+
+static void a6xx_rgmu_remove(struct kgsl_device *device)
+{
+
+	memset(&device->gmu_core, 0, sizeof(device->gmu_core));
+}
+
+static int a6xx_rgmu_bind(struct device *dev, struct device *master, void *data)
+{
+	struct kgsl_device *device = dev_get_drvdata(master);
+
+	return a6xx_rgmu_probe(device, to_platform_device(dev));
+}
+
+static void a6xx_rgmu_unbind(struct device *dev, struct device *master,
+		void *data)
+{
+	struct kgsl_device *device = dev_get_drvdata(master);
+
+	a6xx_rgmu_remove(device);
+}
+
+static const struct component_ops a6xx_rgmu_component_ops = {
+	.bind = a6xx_rgmu_bind,
+	.unbind = a6xx_rgmu_unbind,
+};
+
+static int a6xx_rgmu_probe_dev(struct platform_device *pdev)
+{
+	return component_add(&pdev->dev, &a6xx_rgmu_component_ops);
+}
+
+static int a6xx_rgmu_remove_dev(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &a6xx_rgmu_component_ops);
+	return 0;
+}
+
+static const struct of_device_id a6xx_rgmu_match_table[] = {
+	{ .compatible = "qcom,gpu-rgmu" },
+	{ },
+};
+
+struct platform_driver a6xx_rgmu_driver = {
+	.probe = a6xx_rgmu_probe_dev,
+	.remove = a6xx_rgmu_remove_dev,
+	.driver = {
+		.name = "kgsl-rgmu",
+		.of_match_table = a6xx_rgmu_match_table,
+	},
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_rgmu.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_rgmu.h
@@ -0,0 +1,106 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_A6XX_RGMU_H
+#define __ADRENO_A6XX_RGMU_H
+
+#define RGMU_AO_IRQ_FENCE_ERR		BIT(3)
+#define RGMU_AO_IRQ_MASK			RGMU_AO_IRQ_FENCE_ERR
+
+#define RGMU_OOB_IRQ_ERR_MSG		BIT(24)
+#define RGMU_OOB_IRQ_ACK_MASK		GENMASK(23, 16)
+#define RGMU_OOB_IRQ_ERR_MSG_MASK	GENMASK(31, 24)
+#define RGMU_OOB_IRQ_MASK		RGMU_OOB_IRQ_ERR_MSG_MASK
+
+#define MAX_RGMU_CLKS  8
+
+enum {
+	/* @RGMU_PRIV_FIRST_BOOT_DONE: The very first ggpu boot is done */
+	RGMU_PRIV_FIRST_BOOT_DONE,
+	/* @RGMU_PRIV_GPU_STARTED: GPU has been started */
+	RGMU_PRIV_GPU_STARTED,
+	/* @RGMU_PRIV_PM_SUSPEND: The rgmu driver is suspended */
+	RGMU_PRIV_PM_SUSPEND,
+};
+
+/**
+ * struct a6xx_rgmu_device - rGMU device structure
+ * @ver: RGMU firmware version
+ * @rgmu_interrupt_num: RGMU interrupt number
+ * @oob_interrupt_num: number of RGMU asserted OOB interrupt
+ * @fw_hostptr: Buffer which holds the RGMU firmware
+ * @fw_size: Size of RGMU firmware buffer
+ * @clks: RGMU clocks including the GPU
+ * @gpu_clk: Pointer to GPU core clock
+ * @rgmu_clk: Pointer to rgmu clock
+ * @flags: RGMU flags
+ * @idle_level: Minimal GPU idle power level
+ * @fault_count: RGMU fault count
+ */
+struct a6xx_rgmu_device {
+	u32 ver;
+	struct platform_device *pdev;
+	unsigned int rgmu_interrupt_num;
+	unsigned int oob_interrupt_num;
+	unsigned int *fw_hostptr;
+	uint32_t fw_size;
+	struct clk_bulk_data *clks;
+	/** @num_clks: Number of clocks in @clks */
+	int num_clks;
+	struct clk *gpu_clk;
+	struct clk *rgmu_clk;
+	unsigned int idle_level;
+	unsigned int fault_count;
+	/** @flags: rgmu internal flags */
+	unsigned long flags;
+	/** @num_oob_perfcntr: Number of active oob_perfcntr requests */
+	u32 num_oob_perfcntr;
+};
+
+/**
+ * a6xx_rgmu_device_probe - Probe a6xx rgmu resources
+ * @pdev: Pointer to the platform device
+ * @chipid: Chipid of the target
+ * @gpucore: Pointer to the gpucore
+ *
+ * The target specific probe function for rgmu based a6xx targets.
+ */
+int a6xx_rgmu_device_probe(struct platform_device *pdev,
+	u32 chipid, const struct adreno_gpu_core *gpucore);
+
+/**
+ * a6xx_rgmu_reset - Reset and restart the rgmu
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int a6xx_rgmu_reset(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_rgmu_snapshot - Take snapshot for rgmu based targets
+ * @adreno_dev: Pointer to the adreno device
+ * @snapshot: Pointer to the snapshot
+ *
+ * This function halts rgmu execution if we hit a rgmu
+ * fault. And then, it takes rgmu and gpu snapshot.
+ */
+void a6xx_rgmu_snapshot(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot);
+
+/**
+ * a6xx_rgmu_add_to_minidump - Register a6xx_device with va minidump
+ * @adreno_dev: Pointer to the adreno device
+ */
+int a6xx_rgmu_add_to_minidump(struct adreno_device *adreno_dev);
+
+/**
+ * a6xx_rgmu_gx_is_on() - Check if GX is on using pwr status register
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This check should only be performed if the keepalive bit is set or it
+ * can be guaranteed that the power state of the GPU will remain unchanged
+ */
+bool a6xx_rgmu_gx_is_on(struct adreno_device *adreno_dev);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_ringbuffer.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_ringbuffer.c
@@ -0,0 +1,578 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_pm4types.h"
+#include "adreno_ringbuffer.h"
+#include "adreno_trace.h"
+#include "kgsl_trace.h"
+
+static int a6xx_rb_pagetable_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		struct kgsl_pagetable *pagetable, u32 *cmds)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u64 ttbr0 = kgsl_mmu_pagetable_get_ttbr0(pagetable);
+	int count = 0;
+	u32 id = drawctxt ? drawctxt->base.id : 0;
+
+	if (pagetable == device->mmu.defaultpagetable)
+		return 0;
+
+	cmds[count++] = cp_type7_packet(CP_SMMU_TABLE_UPDATE, 3);
+	cmds[count++] = lower_32_bits(ttbr0);
+	cmds[count++] = upper_32_bits(ttbr0);
+	cmds[count++] = id;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_APRIV)) {
+		cmds[count++] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+		cmds[count++] = cp_type7_packet(CP_WAIT_FOR_ME, 0);
+		cmds[count++] = cp_type4_packet(A6XX_CP_MISC_CNTL, 1);
+		cmds[count++] = 1;
+	}
+
+	cmds[count++] = cp_type7_packet(CP_MEM_WRITE, 5);
+	cmds[count++] = lower_32_bits(SCRATCH_RB_GPU_ADDR(device,
+				rb->id, ttbr0));
+	cmds[count++] = upper_32_bits(SCRATCH_RB_GPU_ADDR(device,
+				rb->id, ttbr0));
+	cmds[count++] = lower_32_bits(ttbr0);
+	cmds[count++] = upper_32_bits(ttbr0);
+	cmds[count++] = id;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_APRIV)) {
+		cmds[count++] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+		cmds[count++] = cp_type7_packet(CP_WAIT_FOR_ME, 0);
+		cmds[count++] = cp_type4_packet(A6XX_CP_MISC_CNTL, 1);
+		cmds[count++] = 0;
+	}
+
+	return count;
+}
+
+static int a6xx_rb_context_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_pagetable *pagetable =
+		adreno_drawctxt_get_pagetable(drawctxt);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int count = 0;
+	u32 cmds[41];
+
+	if (adreno_drawctxt_get_pagetable(rb->drawctxt_active) != pagetable) {
+
+		/* Clear performance counters during context switches */
+		if (!adreno_dev->perfcounter) {
+			cmds[count++] = cp_type4_packet(A6XX_RBBM_PERFCTR_SRAM_INIT_CMD, 1);
+			cmds[count++] = 0x1;
+		}
+
+		count += a6xx_rb_pagetable_switch(adreno_dev, rb, drawctxt,
+			pagetable, &cmds[count]);
+
+		/* Wait for performance counter clear to finish */
+		if (!adreno_dev->perfcounter) {
+			cmds[count++] = cp_type7_packet(CP_WAIT_REG_MEM, 6);
+			cmds[count++] = 0x3;
+			cmds[count++] = A6XX_RBBM_PERFCTR_SRAM_INIT_STATUS;
+			cmds[count++] = 0x0;
+			cmds[count++] = 0x1;
+			cmds[count++] = 0x1;
+			cmds[count++] = 0x0;
+		}
+	}
+
+	cmds[count++] = cp_type7_packet(CP_NOP, 1);
+	cmds[count++] = CONTEXT_TO_MEM_IDENTIFIER;
+
+	cmds[count++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[count++] = lower_32_bits(MEMSTORE_RB_GPU_ADDR(device, rb,
+				current_context));
+	cmds[count++] = upper_32_bits(MEMSTORE_RB_GPU_ADDR(device, rb,
+				current_context));
+	cmds[count++] = drawctxt->base.id;
+
+	cmds[count++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[count++] = lower_32_bits(MEMSTORE_ID_GPU_ADDR(device,
+		KGSL_MEMSTORE_GLOBAL, current_context));
+	cmds[count++] = upper_32_bits(MEMSTORE_ID_GPU_ADDR(device,
+		KGSL_MEMSTORE_GLOBAL, current_context));
+	cmds[count++] = drawctxt->base.id;
+
+	cmds[count++] = cp_type7_packet(CP_EVENT_WRITE, 1);
+	cmds[count++] = 0x31;
+
+	return a6xx_ringbuffer_addcmds(adreno_dev, rb, NULL, F_NOTPROTECTED,
+			cmds, count, 0, NULL);
+}
+
+#define RB_SOPTIMESTAMP(device, rb) \
+	       MEMSTORE_RB_GPU_ADDR(device, rb, soptimestamp)
+#define CTXT_SOPTIMESTAMP(device, drawctxt) \
+	       MEMSTORE_ID_GPU_ADDR(device, (drawctxt)->base.id, soptimestamp)
+
+#define RB_EOPTIMESTAMP(device, rb) \
+	       MEMSTORE_RB_GPU_ADDR(device, rb, eoptimestamp)
+#define CTXT_EOPTIMESTAMP(device, drawctxt) \
+	       MEMSTORE_ID_GPU_ADDR(device, (drawctxt)->base.id, eoptimestamp)
+
+int a6xx_ringbuffer_submit(struct adreno_ringbuffer *rb,
+		struct adreno_submit_time *time, bool sync)
+{
+	struct adreno_device *adreno_dev = ADRENO_RB_DEVICE(rb);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = 0;
+	unsigned long flags;
+
+	adreno_get_submit_time(adreno_dev, rb, time);
+	adreno_profile_submit_time(time);
+
+	if (sync && !ADRENO_FEATURE(adreno_dev, ADRENO_APRIV)) {
+		u32 *cmds = adreno_ringbuffer_allocspace(rb, 3);
+
+		if (IS_ERR(cmds))
+			return PTR_ERR(cmds);
+
+		cmds[0] = cp_type7_packet(CP_WHERE_AM_I, 2);
+		cmds[1] = lower_32_bits(SCRATCH_RB_GPU_ADDR(device, rb->id,
+				rptr));
+		cmds[2] = upper_32_bits(SCRATCH_RB_GPU_ADDR(device, rb->id,
+				rptr));
+	}
+
+	spin_lock_irqsave(&rb->preempt_lock, flags);
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE)) {
+		if (adreno_dev->cur_rb == rb) {
+			kgsl_pwrscale_busy(device);
+			ret = a6xx_fenced_write(adreno_dev,
+				A6XX_CP_RB_WPTR, rb->_wptr,
+				FENCE_STATUS_WRITEDROPPED0_MASK);
+			rb->skip_inline_wptr = false;
+		}
+	} else {
+		if (adreno_dev->cur_rb == rb)
+			rb->skip_inline_wptr = true;
+	}
+
+	rb->wptr = rb->_wptr;
+	spin_unlock_irqrestore(&rb->preempt_lock, flags);
+
+	if (ret) {
+		/*
+		 * If WPTR update fails, take inline snapshot and trigger
+		 * recovery.
+		 */
+		gmu_core_fault_snapshot(device);
+		adreno_dispatcher_fault(adreno_dev,
+			ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+	}
+
+	return ret;
+}
+
+int a6xx_ringbuffer_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int i, ret;
+
+	ret = adreno_allocate_global(device, &device->scratch, PAGE_SIZE,
+		0, 0, KGSL_MEMDESC_RANDOM | KGSL_MEMDESC_PRIVILEGED,
+		"scratch");
+	if (ret)
+		return ret;
+
+	adreno_dev->cur_rb = &(adreno_dev->ringbuffers[0]);
+
+	if (!adreno_preemption_feature_set(adreno_dev)) {
+		adreno_dev->num_ringbuffers = 1;
+		return adreno_ringbuffer_setup(adreno_dev,
+			&adreno_dev->ringbuffers[0], 0);
+	}
+
+	adreno_dev->num_ringbuffers = ARRAY_SIZE(adreno_dev->ringbuffers);
+
+	for (i = 0; i < adreno_dev->num_ringbuffers; i++) {
+		int ret;
+
+		ret = adreno_ringbuffer_setup(adreno_dev,
+			&adreno_dev->ringbuffers[i], i);
+		if (ret)
+			return ret;
+	}
+
+	timer_setup(&adreno_dev->preempt.timer, adreno_preemption_timer, 0);
+	a6xx_preemption_init(adreno_dev);
+	return 0;
+}
+
+#define A6XX_SUBMIT_MAX 79
+
+int a6xx_ringbuffer_addcmds(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 flags, u32 *in, u32 dwords, u32 timestamp,
+		struct adreno_submit_time *time)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 size = A6XX_SUBMIT_MAX + dwords;
+	u32 *cmds, index = 0;
+	u64 profile_gpuaddr;
+	u32 profile_dwords;
+
+	if (adreno_drawctxt_detached(drawctxt))
+		return -ENOENT;
+
+	if (adreno_gpu_fault(adreno_dev) != 0)
+		return -EPROTO;
+
+	rb->timestamp++;
+
+	if (drawctxt)
+		drawctxt->internal_timestamp = rb->timestamp;
+
+	/*
+	 * if APRIV is enabled we assume all submissions are run with protected
+	 * mode off
+	 */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_APRIV))
+		flags &= ~F_NOTPROTECTED;
+
+	cmds = adreno_ringbuffer_allocspace(rb, size);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	/* Identify the start of a command */
+	cmds[index++] = cp_type7_packet(CP_NOP, 1);
+	cmds[index++] = drawctxt ? CMD_IDENTIFIER : CMD_INTERNAL_IDENTIFIER;
+
+	/* This is 25 dwords when drawctxt is not NULL and perfcounter needs to be zapped */
+	index += a6xx_preemption_pre_ibsubmit(adreno_dev, rb, drawctxt,
+		&cmds[index]);
+
+	cmds[index++] = cp_type7_packet(CP_SET_MARKER, 1);
+	cmds[index++] = 0x101; /* IFPC disable */
+
+	profile_gpuaddr = adreno_profile_preib_processing(adreno_dev,
+		drawctxt, &profile_dwords);
+
+	if (profile_gpuaddr) {
+		cmds[index++] = cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+		cmds[index++] = lower_32_bits(profile_gpuaddr);
+		cmds[index++] = upper_32_bits(profile_gpuaddr);
+		cmds[index++] = profile_dwords;
+	}
+
+	if (drawctxt) {
+		cmds[index++] = cp_type7_packet(CP_MEM_WRITE, 3);
+		cmds[index++] = lower_32_bits(CTXT_SOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = upper_32_bits(CTXT_SOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = timestamp;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[index++] = lower_32_bits(RB_SOPTIMESTAMP(device, rb));
+	cmds[index++] = upper_32_bits(RB_SOPTIMESTAMP(device, rb));
+	cmds[index++] = rb->timestamp;
+
+	if (IS_SECURE(flags)) {
+		cmds[index++] = cp_type7_packet(CP_SET_SECURE_MODE, 1);
+		cmds[index++] = 1;
+	}
+
+	if (IS_NOTPROTECTED(flags)) {
+		cmds[index++] = cp_type7_packet(CP_SET_PROTECTED_MODE, 1);
+		cmds[index++] = 0;
+	}
+
+	memcpy(&cmds[index], in, dwords << 2);
+	index += dwords;
+
+	if (IS_NOTPROTECTED(flags)) {
+		cmds[index++] = cp_type7_packet(CP_SET_PROTECTED_MODE, 1);
+		cmds[index++] = 1;
+	}
+
+	profile_gpuaddr = adreno_profile_postib_processing(adreno_dev,
+		drawctxt, &dwords);
+
+	if (profile_gpuaddr) {
+		cmds[index++] = cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+		cmds[index++] = lower_32_bits(profile_gpuaddr);
+		cmds[index++] = upper_32_bits(profile_gpuaddr);
+		cmds[index++] = profile_dwords;
+	}
+
+	if (test_bit(KGSL_FT_PAGEFAULT_GPUHALT_ENABLE, &device->mmu.pfpolicy))
+		cmds[index++] = cp_type7_packet(CP_WAIT_MEM_WRITES, 0);
+
+	/*
+	 * If this is an internal command, just write the ringbuffer timestamp,
+	 * otherwise, write both
+	 */
+	if (!drawctxt) {
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_FLUSH_TS | (1 << 31);
+		cmds[index++] = lower_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = upper_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = rb->timestamp;
+	} else {
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_FLUSH_TS | (1 << 31);
+		cmds[index++] = lower_32_bits(CTXT_EOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = upper_32_bits(CTXT_EOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = timestamp;
+
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_FLUSH_TS;
+		cmds[index++] = lower_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = upper_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = rb->timestamp;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_SET_MARKER, 1);
+	cmds[index++] = 0x100; /* IFPC enable */
+
+	if (IS_WFI(flags))
+		cmds[index++] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+
+	if (IS_SECURE(flags)) {
+		cmds[index++] = cp_type7_packet(CP_SET_SECURE_MODE, 1);
+		cmds[index++] = 0;
+	}
+
+	/* 10 dwords */
+	index += a6xx_preemption_post_ibsubmit(adreno_dev, &cmds[index]);
+
+	/* Adjust the thing for the number of dwords we actually wrote */
+	rb->_wptr -= (size - index);
+
+	return a6xx_ringbuffer_submit(rb, time,
+			!adreno_is_preemption_enabled(adreno_dev));
+}
+
+static u32 a6xx_get_alwayson_counter(u32 *cmds, u64 gpuaddr)
+{
+	cmds[0] = cp_type7_packet(CP_REG_TO_MEM, 3);
+	cmds[1] = A6XX_CP_ALWAYS_ON_COUNTER_LO | (1 << 30) | (2 << 18);
+	cmds[2] = lower_32_bits(gpuaddr);
+	cmds[3] = upper_32_bits(gpuaddr);
+
+	return 4;
+}
+
+static u32 a6xx_get_alwayson_context(u32 *cmds, u64 gpuaddr)
+{
+	cmds[0] = cp_type7_packet(CP_REG_TO_MEM, 3);
+	cmds[1] = A6XX_CP_ALWAYS_ON_CONTEXT_LO | (1 << 30) | (2 << 18);
+	cmds[2] = lower_32_bits(gpuaddr);
+	cmds[3] = upper_32_bits(gpuaddr);
+
+	return 4;
+}
+
+#define PROFILE_IB_DWORDS 4
+#define PROFILE_IB_SLOTS (PAGE_SIZE / (PROFILE_IB_DWORDS << 2))
+
+static u64 a6xx_get_user_profiling_ib(struct adreno_ringbuffer *rb,
+		struct kgsl_drawobj_cmd *cmdobj, u32 target_offset, u32 *cmds)
+{
+	u32 offset, *ib, dwords;
+	u64 gpuaddr;
+
+	if (IS_ERR(rb->profile_desc))
+		return 0;
+
+	offset = rb->profile_index * (PROFILE_IB_DWORDS << 2);
+	ib = rb->profile_desc->hostptr + offset;
+	gpuaddr = rb->profile_desc->gpuaddr + offset;
+	dwords = a6xx_get_alwayson_counter(ib,
+		cmdobj->profiling_buffer_gpuaddr + target_offset);
+
+	cmds[0] = cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+	cmds[1] = lower_32_bits(gpuaddr);
+	cmds[2] = upper_32_bits(gpuaddr);
+	cmds[3] = dwords;
+
+	rb->profile_index = (rb->profile_index + 1) % PROFILE_IB_SLOTS;
+
+	return 4;
+}
+
+static int a6xx_drawctxt_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (rb->drawctxt_active == drawctxt)
+		return 0;
+
+	if (kgsl_context_detached(&drawctxt->base))
+		return -ENOENT;
+
+	if (!_kgsl_context_get(&drawctxt->base))
+		return -ENOENT;
+
+	ret = a6xx_rb_context_switch(adreno_dev, rb, drawctxt);
+	if (ret) {
+		kgsl_context_put(&drawctxt->base);
+		return ret;
+	}
+
+	trace_adreno_drawctxt_switch(rb, drawctxt);
+
+	/* Release the current drawctxt as soon as the new one is switched */
+	adreno_put_drawctxt_on_timestamp(device, rb->drawctxt_active,
+		rb, rb->timestamp);
+
+	rb->drawctxt_active = drawctxt;
+	return 0;
+}
+
+#define A6XX_USER_PROFILE_IB(rb, cmdobj, cmds, field) \
+	a6xx_get_user_profiling_ib((rb), (cmdobj), \
+		offsetof(struct kgsl_drawobj_profiling_buffer, field), \
+		(cmds))
+
+#define A6XX_KERNEL_PROFILE(dev, cmdobj, cmds, field) \
+	a6xx_get_alwayson_counter((cmds), \
+		(dev)->profile_buffer->gpuaddr + \
+			ADRENO_DRAWOBJ_PROFILE_OFFSET((cmdobj)->profile_index, \
+				field))
+
+#define A6XX_KERNEL_PROFILE_CONTEXT(dev, cmdobj, cmds, field) \
+	a6xx_get_alwayson_context((cmds), \
+		(dev)->profile_buffer->gpuaddr + \
+			ADRENO_DRAWOBJ_PROFILE_OFFSET((cmdobj)->profile_index, \
+				field))
+
+#define A6XX_COMMAND_DWORDS 40
+
+int a6xx_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj, u32 flags,
+		struct adreno_submit_time *time)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	struct adreno_ringbuffer *rb = drawctxt->rb;
+	int ret = 0, numibs = 0, index = 0;
+	u32 *cmds;
+
+	/* Count the number of IBs (if we are not skipping) */
+	if (!IS_SKIP(flags)) {
+		struct list_head *tmp;
+
+		list_for_each(tmp, &cmdobj->cmdlist)
+			numibs++;
+	}
+
+	cmds = kvmalloc((A6XX_COMMAND_DWORDS + (numibs * 5)) << 2, GFP_KERNEL);
+	if (!cmds) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_NOP, 1);
+	cmds[index++] = START_IB_IDENTIFIER;
+
+	/* Kernel profiling: 8 dwords */
+	if (IS_KERNEL_PROFILE(flags)) {
+		index += A6XX_KERNEL_PROFILE(adreno_dev, cmdobj, &cmds[index],
+			started);
+		index += A6XX_KERNEL_PROFILE_CONTEXT(adreno_dev, cmdobj, &cmds[index],
+			ctx_start);
+	}
+
+	/* User profiling: 4 dwords */
+	if (IS_USER_PROFILE(flags))
+		index += A6XX_USER_PROFILE_IB(rb, cmdobj, &cmds[index],
+			gpu_ticks_submitted);
+
+	if (numibs) {
+		struct kgsl_memobj_node *ib;
+
+		cmds[index++] = cp_type7_packet(CP_SET_MARKER, 1);
+		cmds[index++] = 0x00d; /* IB1LIST start */
+
+		list_for_each_entry(ib, &cmdobj->cmdlist, node) {
+			if (ib->priv & MEMOBJ_SKIP ||
+			    (ib->flags & KGSL_CMDLIST_CTXTSWITCH_PREAMBLE
+			     && !IS_PREAMBLE(flags)))
+				cmds[index++] = cp_type7_packet(CP_NOP, 4);
+
+			cmds[index++] =
+				cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+			cmds[index++] = lower_32_bits(ib->gpuaddr);
+			cmds[index++] = upper_32_bits(ib->gpuaddr);
+
+			/* Double check that IB_PRIV is never set */
+			cmds[index++] = (ib->size >> 2) & 0xfffff;
+		}
+
+		cmds[index++] = cp_type7_packet(CP_SET_MARKER, 1);
+		cmds[index++] = 0x00e; /* IB1LIST end */
+	}
+
+	/* CCU invalidate */
+	cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 1);
+	cmds[index++] = 24;
+
+	cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 1);
+	cmds[index++] = 25;
+
+	/* 8 dwords */
+	if (IS_KERNEL_PROFILE(flags)) {
+		index += A6XX_KERNEL_PROFILE(adreno_dev, cmdobj, &cmds[index],
+			retired);
+		index += A6XX_KERNEL_PROFILE_CONTEXT(adreno_dev, cmdobj, &cmds[index],
+			ctx_end);
+	}
+
+	/* 4 dwords */
+	if (IS_USER_PROFILE(flags))
+		index += A6XX_USER_PROFILE_IB(rb, cmdobj, &cmds[index],
+			gpu_ticks_retired);
+
+	cmds[index++] = cp_type7_packet(CP_NOP, 1);
+	cmds[index++] = END_IB_IDENTIFIER;
+
+	ret = a6xx_drawctxt_switch(adreno_dev, rb, drawctxt);
+
+	/*
+	 * In the unlikely event of an error in the drawctxt switch,
+	 * treat it like a hang
+	 */
+	if (ret) {
+		/*
+		 * It is "normal" to get a -ENOSPC or a -ENOENT. Don't log it,
+		 * the upper layers know how to handle it
+		 */
+		if (ret != -ENOSPC && ret != -ENOENT)
+			dev_err(device->dev,
+				     "Unable to switch draw context: %d\n",
+				     ret);
+		goto done;
+	}
+
+	adreno_drawobj_set_constraint(device, drawobj);
+
+	ret = a6xx_ringbuffer_addcmds(adreno_dev, drawctxt->rb, drawctxt,
+		flags, cmds, index, drawobj->timestamp, time);
+
+done:
+	trace_kgsl_issueibcmds(device, drawctxt->base.id, numibs,
+		drawobj->timestamp, drawobj->flags, ret, drawctxt->type);
+
+	kvfree(cmds);
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_rpmh.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_rpmh.c
@@ -0,0 +1,515 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/types.h>
+#include <soc/qcom/cmd-db.h>
+#include <soc/qcom/tcs.h>
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_hfi.h"
+#include "kgsl_bus.h"
+#include "kgsl_device.h"
+
+struct rpmh_arc_vals {
+	u32 num;
+	const u16 *val;
+};
+
+struct bcm {
+	const char *name;
+	u32 buswidth;
+	u32 channels;
+	u32 unit;
+	u16 width;
+	u8 vcd;
+	bool fixed;
+};
+
+struct bcm_data {
+	__le32 unit;
+	__le16 width;
+	u8 vcd;
+	u8 reserved;
+};
+
+struct rpmh_bw_votes {
+	u32 wait_bitmask;
+	u32 num_cmds;
+	u32 *addrs;
+	u32 num_levels;
+	u32 **cmds;
+};
+
+#define ARC_VOTE_SET(pri, sec, vlvl) \
+	((((vlvl) & 0xFFFF) << 16) | (((sec) & 0xFF) << 8) | ((pri) & 0xFF))
+
+static int rpmh_arc_cmds(struct rpmh_arc_vals *arc, const char *res_id)
+{
+	size_t len = 0;
+
+	arc->val = cmd_db_read_aux_data(res_id, &len);
+
+	/*
+	 * cmd_db_read_aux_data() gives us a zero-padded table of
+	 * size len that contains the arc values. To determine the
+	 * number of arc values, we loop through the table and count
+	 * them until we get to the end of the buffer or hit the
+	 * zero padding.
+	 */
+	for (arc->num = 1; arc->num < (len >> 1); arc->num++) {
+		if (arc->val[arc->num - 1] != 0 &&  arc->val[arc->num] == 0)
+			break;
+	}
+
+	return 0;
+}
+
+static int setup_volt_dependency_tbl(uint32_t *votes,
+		struct rpmh_arc_vals *pri_rail, struct rpmh_arc_vals *sec_rail,
+		u16 *vlvl, unsigned int num_entries)
+{
+	int i, j, k;
+	uint16_t cur_vlvl;
+	bool found_match;
+
+	/* i tracks current KGSL GPU frequency table entry
+	 * j tracks secondary rail voltage table entry
+	 * k tracks primary rail voltage table entry
+	 */
+	for (i = 0; i < num_entries; i++) {
+		found_match = false;
+
+		/* Look for a primary rail voltage that matches a VLVL level */
+		for (k = 0; k < pri_rail->num; k++) {
+			if (pri_rail->val[k] >= vlvl[i]) {
+				cur_vlvl = pri_rail->val[k];
+				found_match = true;
+				break;
+			}
+		}
+
+		/* If we did not find a matching VLVL level then abort */
+		if (!found_match)
+			return -EINVAL;
+
+		/*
+		 * Look for a secondary rail index whose VLVL value
+		 * is greater than or equal to the VLVL value of the
+		 * corresponding index of the primary rail
+		 */
+		for (j = 0; j < sec_rail->num; j++) {
+			if (sec_rail->val[j] >= cur_vlvl ||
+					j + 1 == sec_rail->num)
+				break;
+		}
+
+		if (j == sec_rail->num)
+			j = 0;
+
+		votes[i] = ARC_VOTE_SET(k, j, cur_vlvl);
+	}
+
+	return 0;
+}
+
+/* Generate a set of bandwidth votes for the list of BCMs */
+static void tcs_cmd_data(struct bcm *bcms, int count, u32 ab, u32 ib,
+		u32 *data)
+{
+	int i;
+
+	for (i = 0; i < count; i++) {
+		bool valid = true;
+		bool commit = false;
+		u64 avg, peak, x, y;
+
+		if (i == count - 1 || bcms[i].vcd != bcms[i + 1].vcd)
+			commit = true;
+
+		/*
+		 * On a660, the "ACV" y vote should be 0x08 if there is a valid
+		 * vote and 0x00 if not. This is kind of hacky and a660 specific
+		 * but we can clean it up when we add a new target
+		 */
+		if (bcms[i].fixed) {
+			if (!ab && !ib)
+				data[i] = BCM_TCS_CMD(commit, false, 0x0, 0x0);
+			else
+				data[i] = BCM_TCS_CMD(commit, true, 0x0, 0x8);
+			continue;
+		}
+
+		/* Multiple the bandwidth by the width of the connection */
+		avg = ((u64) ab) * bcms[i].width;
+
+		/* And then divide by the total width across channels */
+		do_div(avg, bcms[i].buswidth * bcms[i].channels);
+
+		peak = ((u64) ib) * bcms[i].width;
+		do_div(peak, bcms[i].buswidth);
+
+		/* Input bandwidth value is in KBps */
+		x = avg * 1000ULL;
+		do_div(x, bcms[i].unit);
+
+		/* Input bandwidth value is in KBps */
+		y = peak * 1000ULL;
+		do_div(y, bcms[i].unit);
+
+		/*
+		 * If a bandwidth value was specified but the calculation ends
+		 * rounding down to zero, set a minimum level
+		 */
+		if (ab && x == 0)
+			x = 1;
+
+		if (ib && y == 0)
+			y = 1;
+
+		x = min_t(u64, x, BCM_TCS_CMD_VOTE_MASK);
+		y = min_t(u64, y, BCM_TCS_CMD_VOTE_MASK);
+
+		if (!x && !y)
+			valid = false;
+
+		data[i] = BCM_TCS_CMD(commit, valid, x, y);
+	}
+}
+
+static void free_rpmh_bw_votes(struct rpmh_bw_votes *votes)
+{
+	int i;
+
+	if (!votes)
+		return;
+
+	for (i = 0; votes->cmds && i < votes->num_levels; i++)
+		kfree(votes->cmds[i]);
+
+	kfree(votes->cmds);
+	kfree(votes->addrs);
+	kfree(votes);
+}
+
+/* Build the votes table from the specified bandwidth levels */
+static struct rpmh_bw_votes *build_rpmh_bw_votes(struct bcm *bcms,
+		int bcm_count, u32 *levels, int levels_count)
+{
+	struct rpmh_bw_votes *votes;
+	int i;
+
+	votes = kzalloc(sizeof(*votes), GFP_KERNEL);
+	if (!votes)
+		return ERR_PTR(-ENOMEM);
+
+	votes->addrs = kcalloc(bcm_count, sizeof(*votes->cmds), GFP_KERNEL);
+	if (!votes->addrs) {
+		free_rpmh_bw_votes(votes);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	votes->cmds = kcalloc(levels_count, sizeof(*votes->cmds), GFP_KERNEL);
+	if (!votes->cmds) {
+		free_rpmh_bw_votes(votes);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	votes->num_cmds = bcm_count;
+	votes->num_levels = levels_count;
+
+	/* Get the cmd-db information for each BCM */
+	for (i = 0; i < bcm_count; i++) {
+		size_t l;
+		const struct bcm_data *data;
+
+		data = cmd_db_read_aux_data(bcms[i].name, &l);
+
+		votes->addrs[i] = cmd_db_read_addr(bcms[i].name);
+
+		bcms[i].unit = le32_to_cpu(data->unit);
+		bcms[i].width = le16_to_cpu(data->width);
+		bcms[i].vcd = data->vcd;
+	}
+
+	for (i = 0; i < bcm_count; i++) {
+		if (i == (bcm_count - 1) || bcms[i].vcd != bcms[i + 1].vcd)
+			votes->wait_bitmask |= (1 << i);
+	}
+
+	for (i = 0; i < levels_count; i++) {
+		votes->cmds[i] = kcalloc(bcm_count, sizeof(u32), GFP_KERNEL);
+		if (!votes->cmds[i]) {
+			free_rpmh_bw_votes(votes);
+			return ERR_PTR(-ENOMEM);
+		}
+
+		tcs_cmd_data(bcms, bcm_count, 0, levels[i], votes->cmds[i]);
+	}
+
+	return votes;
+}
+
+/*
+ * setup_gmu_arc_votes - Build the gmu voting table
+ * @adreno_dev: Pointer to adreno device
+ * @pri_rail: Pointer to primary power rail vlvl table
+ * @sec_rail: Pointer to second/dependent power rail vlvl table
+ * @freqs: List of GMU frequencies
+ * @vlvls: List of GMU voltage levels
+ *
+ * This function initializes the cx votes for all gmu frequencies
+ * for gmu dcvs
+ */
+static int setup_cx_arc_votes(struct adreno_device *adreno_dev,
+	struct rpmh_arc_vals *pri_rail, struct rpmh_arc_vals *sec_rail,
+	u32 *freqs, u32 *vlvls)
+{
+	/* Hardcoded values of GMU CX voltage levels */
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hfi *hfi = &gmu->hfi;
+	u16 gmu_cx_vlvl[MAX_CX_LEVELS];
+	u32 cx_votes[MAX_CX_LEVELS];
+	struct hfi_dcvstable_cmd *table = &hfi->dcvs_table;
+	int ret, i;
+
+	gmu_cx_vlvl[0] = 0;
+	gmu_cx_vlvl[1] = vlvls[0];
+	gmu_cx_vlvl[2] = vlvls[1];
+
+	table->gmu_level_num = 3;
+
+	table->cx_votes[0].freq = 0;
+	table->cx_votes[1].freq = freqs[0] / 1000;
+	table->cx_votes[2].freq = freqs[1] / 1000;
+
+	ret = setup_volt_dependency_tbl(cx_votes, pri_rail,
+			sec_rail, gmu_cx_vlvl, table->gmu_level_num);
+	if (!ret) {
+		for (i = 0; i < table->gmu_level_num; i++)
+			table->cx_votes[i].vote = cx_votes[i];
+	}
+
+	return ret;
+}
+
+static int to_cx_hlvl(struct rpmh_arc_vals *cx_rail, u32 vlvl, u32 *hlvl)
+{
+	u32 i;
+
+	/*
+	 * This means that the Gx level doesn't have a dependency on Cx level.
+	 * Return the same value to disable cx voting at GMU.
+	 */
+	if (vlvl == 0xffffffff) {
+		*hlvl = vlvl;
+		return 0;
+	}
+
+	for (i = 0; i < cx_rail->num; i++) {
+		if (cx_rail->val[i] >= vlvl) {
+			*hlvl = i;
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+/*
+ * setup_gx_arc_votes - Build the gpu dcvs voting table
+ * @hfi: Pointer to hfi device
+ * @pri_rail: Pointer to primary power rail vlvl table
+ * @sec_rail: Pointer to second/dependent power rail vlvl table
+ *
+ * This function initializes the gx votes for all gpu frequencies
+ * for gpu dcvs
+ */
+static int setup_gx_arc_votes(struct adreno_device *adreno_dev,
+	struct rpmh_arc_vals *pri_rail, struct rpmh_arc_vals *sec_rail,
+	struct rpmh_arc_vals *cx_rail)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct hfi_dcvstable_cmd *table = &gmu->hfi.dcvs_table;
+	u32 index;
+	u16 vlvl_tbl[MAX_GX_LEVELS];
+	u32 gx_votes[MAX_GX_LEVELS];
+	int ret, i;
+
+	/* Add the zero powerlevel for the perf table */
+	table->gpu_level_num = device->pwrctrl.num_pwrlevels + 1;
+
+	if (table->gpu_level_num > pri_rail->num ||
+		table->gpu_level_num > ARRAY_SIZE(vlvl_tbl)) {
+		dev_err(&gmu->pdev->dev,
+			"Defined more GPU DCVS levels than RPMh can support\n");
+		return -ERANGE;
+	}
+
+	memset(vlvl_tbl, 0, sizeof(vlvl_tbl));
+
+	table->gx_votes[0].freq = 0;
+	table->gx_votes[0].cx_vote = 0;
+	/* Disable cx vote in gmu dcvs table if it is not supported in DT */
+	if (pwr->pwrlevels[0].cx_level == 0xffffffff)
+		table->gx_votes[0].cx_vote = 0xffffffff;
+
+	/* GMU power levels are in ascending order */
+	for (index = 1, i = pwr->num_pwrlevels - 1; i >= 0; i--, index++) {
+		u32 cx_vlvl = pwr->pwrlevels[i].cx_level;
+
+		vlvl_tbl[index] = pwr->pwrlevels[i].voltage_level;
+		table->gx_votes[index].freq = pwr->pwrlevels[i].gpu_freq / 1000;
+
+		ret = to_cx_hlvl(cx_rail, cx_vlvl,
+				&table->gx_votes[index].cx_vote);
+		if (ret) {
+			dev_err(&gmu->pdev->dev, "Unsupported cx corner: %u\n",
+					cx_vlvl);
+			return ret;
+		}
+	}
+
+	ret = setup_volt_dependency_tbl(gx_votes, pri_rail,
+			sec_rail, vlvl_tbl, table->gpu_level_num);
+	if (!ret) {
+		for (i = 0; i < table->gpu_level_num; i++)
+			table->gx_votes[i].vote = gx_votes[i];
+	}
+
+	return ret;
+
+}
+
+static int build_dcvs_table(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct a6xx_hfi *hfi = &gmu->hfi;
+	struct rpmh_arc_vals gx_arc, cx_arc, mx_arc;
+	int ret;
+
+	ret = CMD_MSG_HDR(hfi->dcvs_table, H2F_MSG_PERF_TBL);
+	if (ret)
+		return ret;
+
+	ret = rpmh_arc_cmds(&gx_arc, "gfx.lvl");
+	if (ret)
+		return ret;
+
+	ret = rpmh_arc_cmds(&cx_arc, "cx.lvl");
+	if (ret)
+		return ret;
+
+	ret = rpmh_arc_cmds(&mx_arc, "mx.lvl");
+	if (ret)
+		return ret;
+
+	ret = setup_cx_arc_votes(adreno_dev, &cx_arc, &mx_arc,
+					gmu->freqs, gmu->vlvls);
+	if (ret)
+		return ret;
+
+	return setup_gx_arc_votes(adreno_dev, &gx_arc, &mx_arc, &cx_arc);
+}
+
+/*
+ * List of Bus Control Modules (BCMs) that need to be configured for the GPU
+ * to access DDR. For each bus level we will generate a vote each BC
+ */
+static struct bcm a660_ddr_bcms[] = {
+	{ .name = "SH0", .buswidth = 16 },
+	{ .name = "MC0", .buswidth = 4 },
+	{ .name = "ACV", .fixed = true },
+};
+
+/* Same as above, but for the CNOC BCMs */
+static struct bcm a660_cnoc_bcms[] = {
+	{ .name = "CN0", .buswidth = 4 },
+};
+
+static void build_bw_table_cmd(struct hfi_bwtable_cmd *cmd,
+		struct rpmh_bw_votes *ddr, struct rpmh_bw_votes *cnoc)
+{
+	u32 i, j;
+
+	cmd->bw_level_num = ddr->num_levels;
+	cmd->ddr_cmds_num = ddr->num_cmds;
+	cmd->ddr_wait_bitmask = ddr->wait_bitmask;
+
+	for (i = 0; i < ddr->num_cmds; i++)
+		cmd->ddr_cmd_addrs[i] = ddr->addrs[i];
+
+	for (i = 0; i < ddr->num_levels; i++)
+		for (j = 0; j < ddr->num_cmds; j++)
+			cmd->ddr_cmd_data[i][j] = (u32) ddr->cmds[i][j];
+
+	if (!cnoc)
+		return;
+
+	cmd->cnoc_cmds_num = cnoc->num_cmds;
+		cmd->cnoc_wait_bitmask = cnoc->wait_bitmask;
+
+	for (i = 0; i < cnoc->num_cmds; i++)
+		cmd->cnoc_cmd_addrs[i] = cnoc->addrs[i];
+
+	for (i = 0; i < cnoc->num_levels; i++)
+		for (j = 0; j < cnoc->num_cmds; j++)
+			cmd->cnoc_cmd_data[i][j] = (u32) cnoc->cmds[i][j];
+}
+
+static int build_bw_table(struct adreno_device *adreno_dev)
+{
+	struct a6xx_gmu_device *gmu = to_a6xx_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct rpmh_bw_votes *ddr, *cnoc = NULL;
+	u32 *cnoc_table;
+	u32 count;
+	int ret;
+
+	ddr = build_rpmh_bw_votes(a660_ddr_bcms, ARRAY_SIZE(a660_ddr_bcms),
+		pwr->ddr_table, pwr->ddr_table_count);
+	if (IS_ERR(ddr))
+		return PTR_ERR(ddr);
+
+	cnoc_table = kgsl_bus_get_table(device->pdev, "qcom,bus-table-cnoc",
+		&count);
+
+	if (count > 0)
+		cnoc = build_rpmh_bw_votes(a660_cnoc_bcms,
+			ARRAY_SIZE(a660_cnoc_bcms), cnoc_table, count);
+
+	kfree(cnoc_table);
+
+	if (IS_ERR(cnoc)) {
+		free_rpmh_bw_votes(ddr);
+		return PTR_ERR(cnoc);
+	}
+
+	ret = CMD_MSG_HDR(gmu->hfi.bw_table, H2F_MSG_BW_VOTE_TBL);
+	if (ret)
+		return ret;
+
+	build_bw_table_cmd(&gmu->hfi.bw_table, ddr, cnoc);
+
+	free_rpmh_bw_votes(ddr);
+	free_rpmh_bw_votes(cnoc);
+
+	return 0;
+}
+
+int a6xx_build_rpmh_tables(struct adreno_device *adreno_dev)
+{
+	int ret;
+
+	ret = build_dcvs_table(adreno_dev);
+	if (ret)
+		return ret;
+
+	return build_bw_table(adreno_dev);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_a6xx_snapshot.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_a6xx_snapshot.c
@@ -0,0 +1,2306 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_a6xx.h"
+#include "adreno_snapshot.h"
+
+#define A6XX_NUM_CTXTS 2
+#define A6XX_NUM_AXI_ARB_BLOCKS 2
+#define A6XX_NUM_XIN_AXI_BLOCKS 5
+#define A6XX_NUM_XIN_CORE_BLOCKS 4
+
+static const unsigned int a6xx_gras_cluster[] = {
+	0x8000, 0x8006, 0x8010, 0x8092, 0x8094, 0x809D, 0x80A0, 0x80A6,
+	0x80AF, 0x80F1, 0x8100, 0x8107, 0x8109, 0x8109, 0x8110, 0x8110,
+	0x8400, 0x840B,
+};
+
+static const unsigned int a6xx_ps_cluster_rac[] = {
+	0x8800, 0x8806, 0x8809, 0x8811, 0x8818, 0x881E, 0x8820, 0x8865,
+	0x8870, 0x8879, 0x8880, 0x8889, 0x8890, 0x8891, 0x8898, 0x8898,
+	0x88C0, 0x88C1, 0x88D0, 0x88E3, 0x8900, 0x890C, 0x890F, 0x891A,
+	0x8C00, 0x8C01, 0x8C08, 0x8C10, 0x8C17, 0x8C1F, 0x8C26, 0x8C33,
+};
+
+static const unsigned int a6xx_ps_cluster_rbp[] = {
+	0x88F0, 0x88F3, 0x890D, 0x890E, 0x8927, 0x8928, 0x8BF0, 0x8BF1,
+	0x8C02, 0x8C07, 0x8C11, 0x8C16, 0x8C20, 0x8C25,
+};
+
+static const unsigned int a6xx_vpc_ps_cluster[] = {
+	0x9200, 0x9216, 0x9218, 0x9236, 0x9300, 0x9306,
+};
+
+static const unsigned int a6xx_fe_cluster[] = {
+	0x9300, 0x9306, 0x9800, 0x9806, 0x9B00, 0x9B07, 0xA000, 0xA009,
+	0xA00E, 0xA0EF, 0xA0F8, 0xA0F8,
+};
+
+static const unsigned int a660_fe_cluster[] = {
+	0x9807, 0x9807,
+};
+
+static const unsigned int a6xx_pc_vs_cluster[] = {
+	0x9100, 0x9108, 0x9300, 0x9306, 0x9980, 0x9981, 0x9B00, 0x9B07,
+};
+
+static const unsigned int a650_isense_registers[] = {
+	0x22C00, 0x22C19, 0x22C26, 0x22C2D, 0x22C2F, 0x22C36, 0x22C40, 0x22C44,
+	0x22C50, 0x22C57, 0x22C60, 0x22C67, 0x22C80, 0x22C87, 0x22D25, 0x22D2A,
+	0x22D2C, 0x22D32, 0x22D3E, 0x22D3F, 0x22D4E, 0x22D55, 0x22D58, 0x22D60,
+	0x22D64, 0x22D64, 0x22D66, 0x22D66, 0x22D68, 0x22D6B, 0x22D6E, 0x22D76,
+	0x22D78, 0x22D78, 0x22D80, 0x22D87, 0x22D90, 0x22D97, 0x22DA0, 0x22DA0,
+	0x22DB0, 0x22DB7, 0x22DC0, 0x22DC2, 0x22DC4, 0x22DE3, 0x2301A, 0x2301A,
+	0x2301D, 0x2302A, 0x23120, 0x23121, 0x23133, 0x23133, 0x23156, 0x23157,
+	0x23165, 0x23165, 0x2316D, 0x2316D, 0x23180, 0x23191,
+};
+
+static const struct sel_reg {
+	unsigned int host_reg;
+	unsigned int cd_reg;
+	unsigned int val;
+} _a6xx_rb_rac_aperture = {
+	.host_reg = A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_HOST,
+	.cd_reg = A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_CD,
+	.val = 0x0,
+},
+_a6xx_rb_rbp_aperture = {
+	.host_reg = A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_HOST,
+	.cd_reg = A6XX_RB_RB_SUB_BLOCK_SEL_CNTL_CD,
+	.val = 0x9,
+};
+
+static struct a6xx_cluster_registers {
+	unsigned int id;
+	const unsigned int *regs;
+	unsigned int num_sets;
+	const struct sel_reg *sel;
+	unsigned int offset0;
+	unsigned int offset1;
+} a6xx_clusters[] = {
+	{ CP_CLUSTER_GRAS, a6xx_gras_cluster, ARRAY_SIZE(a6xx_gras_cluster)/2,
+		NULL },
+	{ CP_CLUSTER_PS, a6xx_ps_cluster_rac, ARRAY_SIZE(a6xx_ps_cluster_rac)/2,
+		&_a6xx_rb_rac_aperture },
+	{ CP_CLUSTER_PS, a6xx_ps_cluster_rbp, ARRAY_SIZE(a6xx_ps_cluster_rbp)/2,
+		&_a6xx_rb_rbp_aperture },
+	{ CP_CLUSTER_PS, a6xx_vpc_ps_cluster, ARRAY_SIZE(a6xx_vpc_ps_cluster)/2,
+		NULL },
+	{ CP_CLUSTER_FE, a6xx_fe_cluster, ARRAY_SIZE(a6xx_fe_cluster)/2,
+		NULL },
+	{ CP_CLUSTER_PC_VS, a6xx_pc_vs_cluster,
+		ARRAY_SIZE(a6xx_pc_vs_cluster)/2, NULL },
+	{ CP_CLUSTER_FE, a660_fe_cluster, ARRAY_SIZE(a660_fe_cluster)/2,
+		NULL },
+};
+
+struct a6xx_cluster_regs_info {
+	struct a6xx_cluster_registers *cluster;
+	unsigned int ctxt_id;
+};
+
+static const unsigned int a6xx_sp_vs_hlsq_cluster[] = {
+	0xB800, 0xB803, 0xB820, 0xB822,
+};
+
+static const unsigned int a6xx_sp_vs_sp_cluster[] = {
+	0xA800, 0xA824, 0xA830, 0xA83C, 0xA840, 0xA864, 0xA870, 0xA895,
+	0xA8A0, 0xA8AF, 0xA8C0, 0xA8C3,
+};
+
+static const unsigned int a6xx_hlsq_duplicate_cluster[] = {
+	0xBB10, 0xBB11, 0xBB20, 0xBB29,
+};
+
+static const unsigned int a6xx_sp_duplicate_cluster[] = {
+	0xAB00, 0xAB00, 0xAB04, 0xAB05, 0xAB10, 0xAB1B, 0xAB20, 0xAB20,
+};
+
+static const unsigned int a6xx_tp_duplicate_cluster[] = {
+	0xB300, 0xB307, 0xB309, 0xB309, 0xB380, 0xB382,
+};
+
+static const unsigned int a6xx_sp_ps_hlsq_cluster[] = {
+	0xB980, 0xB980, 0xB982, 0xB987, 0xB990, 0xB99B, 0xB9A0, 0xB9A2,
+	0xB9C0, 0xB9C9,
+};
+
+static const unsigned int a6xx_sp_ps_sp_cluster[] = {
+	0xA980, 0xA9A8, 0xA9B0, 0xA9BC, 0xA9D0, 0xA9D3, 0xA9E0, 0xA9F3,
+	0xAA00, 0xAA00, 0xAA30, 0xAA31, 0xAAF2, 0xAAF2,
+};
+
+static const unsigned int a6xx_sp_ps_sp_2d_cluster[] = {
+	0xACC0, 0xACC0,
+};
+
+static const unsigned int a6xx_sp_ps_tp_cluster[] = {
+	0xB180, 0xB183, 0xB190, 0xB191,
+};
+
+static const unsigned int a6xx_sp_ps_tp_2d_cluster[] = {
+	0xB4C0, 0xB4D1,
+};
+
+static struct a6xx_cluster_dbgahb_registers {
+	unsigned int id;
+	unsigned int regbase;
+	unsigned int statetype;
+	const unsigned int *regs;
+	unsigned int num_sets;
+	unsigned int offset0;
+	unsigned int offset1;
+} a6xx_dbgahb_ctx_clusters[] = {
+	{ CP_CLUSTER_SP_VS, 0x0002E000, 0x41, a6xx_sp_vs_hlsq_cluster,
+		ARRAY_SIZE(a6xx_sp_vs_hlsq_cluster) / 2 },
+	{ CP_CLUSTER_SP_VS, 0x0002A000, 0x21, a6xx_sp_vs_sp_cluster,
+		ARRAY_SIZE(a6xx_sp_vs_sp_cluster) / 2 },
+	{ CP_CLUSTER_SP_VS, 0x0002E000, 0x41, a6xx_hlsq_duplicate_cluster,
+		ARRAY_SIZE(a6xx_hlsq_duplicate_cluster) / 2 },
+	{ CP_CLUSTER_SP_VS, 0x0002A000, 0x21, a6xx_sp_duplicate_cluster,
+		ARRAY_SIZE(a6xx_sp_duplicate_cluster) / 2 },
+	{ CP_CLUSTER_SP_VS, 0x0002C000, 0x1, a6xx_tp_duplicate_cluster,
+		ARRAY_SIZE(a6xx_tp_duplicate_cluster) / 2 },
+	{ CP_CLUSTER_SP_PS, 0x0002E000, 0x42, a6xx_sp_ps_hlsq_cluster,
+		ARRAY_SIZE(a6xx_sp_ps_hlsq_cluster) / 2 },
+	{ CP_CLUSTER_SP_PS, 0x0002A000, 0x22, a6xx_sp_ps_sp_cluster,
+		ARRAY_SIZE(a6xx_sp_ps_sp_cluster) / 2 },
+	{ CP_CLUSTER_SP_PS, 0x0002B000, 0x26, a6xx_sp_ps_sp_2d_cluster,
+		ARRAY_SIZE(a6xx_sp_ps_sp_2d_cluster) / 2 },
+	{ CP_CLUSTER_SP_PS, 0x0002C000, 0x2, a6xx_sp_ps_tp_cluster,
+		ARRAY_SIZE(a6xx_sp_ps_tp_cluster) / 2 },
+	{ CP_CLUSTER_SP_PS, 0x0002D000, 0x6, a6xx_sp_ps_tp_2d_cluster,
+		ARRAY_SIZE(a6xx_sp_ps_tp_2d_cluster) / 2 },
+	{ CP_CLUSTER_SP_PS, 0x0002E000, 0x42, a6xx_hlsq_duplicate_cluster,
+		ARRAY_SIZE(a6xx_hlsq_duplicate_cluster) / 2 },
+	{ CP_CLUSTER_SP_PS, 0x0002A000, 0x22, a6xx_sp_duplicate_cluster,
+		ARRAY_SIZE(a6xx_sp_duplicate_cluster) / 2 },
+	{ CP_CLUSTER_SP_PS, 0x0002C000, 0x2, a6xx_tp_duplicate_cluster,
+		ARRAY_SIZE(a6xx_tp_duplicate_cluster) / 2 },
+};
+
+struct a6xx_cluster_dbgahb_regs_info {
+	struct a6xx_cluster_dbgahb_registers *cluster;
+	unsigned int ctxt_id;
+};
+
+static const unsigned int a6xx_hlsq_non_ctx_registers[] = {
+	0xBE00, 0xBE01, 0xBE04, 0xBE05, 0xBE08, 0xBE09, 0xBE10, 0xBE15,
+	0xBE20, 0xBE23,
+};
+
+static const unsigned int a6xx_sp_non_ctx_registers[] = {
+	0xAE00, 0xAE04, 0xAE0C, 0xAE0C, 0xAE0F, 0xAE2B, 0xAE30, 0xAE32,
+	0xAE35, 0xAE35, 0xAE3A, 0xAE3F, 0xAE50, 0xAE52,
+};
+
+static const unsigned int a6xx_tp_non_ctx_registers[] = {
+	0xB600, 0xB601, 0xB604, 0xB605, 0xB610, 0xB61B, 0xB620, 0xB623,
+};
+
+static struct a6xx_non_ctx_dbgahb_registers {
+	unsigned int regbase;
+	unsigned int statetype;
+	const unsigned int *regs;
+	unsigned int num_sets;
+	unsigned int offset;
+} a6xx_non_ctx_dbgahb[] = {
+	{ 0x0002F800, 0x40, a6xx_hlsq_non_ctx_registers,
+		ARRAY_SIZE(a6xx_hlsq_non_ctx_registers) / 2 },
+	{ 0x0002B800, 0x20, a6xx_sp_non_ctx_registers,
+		ARRAY_SIZE(a6xx_sp_non_ctx_registers) / 2 },
+	{ 0x0002D800, 0x0, a6xx_tp_non_ctx_registers,
+		ARRAY_SIZE(a6xx_tp_non_ctx_registers) / 2 },
+};
+
+static const unsigned int a6xx_vbif_registers[] = {
+	/* VBIF */
+	0x3000, 0x3007, 0x300C, 0x3014, 0x3018, 0x302D, 0x3030, 0x3031,
+	0x3034, 0x3036, 0x303C, 0x303D, 0x3040, 0x3040, 0x3042, 0x3042,
+	0x3049, 0x3049, 0x3058, 0x3058, 0x305A, 0x3061, 0x3064, 0x3068,
+	0x306C, 0x306D, 0x3080, 0x3088, 0x308B, 0x308C, 0x3090, 0x3094,
+	0x3098, 0x3098, 0x309C, 0x309C, 0x30C0, 0x30C0, 0x30C8, 0x30C8,
+	0x30D0, 0x30D0, 0x30D8, 0x30D8, 0x30E0, 0x30E0, 0x3100, 0x3100,
+	0x3108, 0x3108, 0x3110, 0x3110, 0x3118, 0x3118, 0x3120, 0x3120,
+	0x3124, 0x3125, 0x3129, 0x3129, 0x3131, 0x3131, 0x3154, 0x3154,
+	0x3156, 0x3156, 0x3158, 0x3158, 0x315A, 0x315A, 0x315C, 0x315C,
+	0x315E, 0x315E, 0x3160, 0x3160, 0x3162, 0x3162, 0x340C, 0x340C,
+	0x3410, 0x3410, 0x3800, 0x3801,
+};
+
+static const unsigned int a6xx_gbif_registers[] = {
+	/* GBIF */
+	0x3C00, 0X3C0B, 0X3C40, 0X3C47, 0X3CC0, 0X3CD1, 0xE3A, 0xE3A,
+};
+
+static const unsigned int a6xx_gbif_reinit_registers[] = {
+	/* GBIF with REINIT */
+	0x3C00, 0X3C0B, 0X3C40, 0X3C47, 0X3C49, 0X3C4A, 0X3CC0, 0X3CD1,
+	0xE3A, 0xE3A, 0x0016, 0x0017,
+};
+
+static const unsigned int a6xx_rb_rac_registers[] = {
+	0x8E04, 0x8E05, 0x8E07, 0x8E08, 0x8E10, 0x8E1C, 0x8E20, 0x8E25,
+	0x8E28, 0x8E28, 0x8E2C, 0x8E2F, 0x8E50, 0x8E52,
+};
+
+static const unsigned int a6xx_rb_rbp_registers[] = {
+	0x8E01, 0x8E01, 0x8E0C, 0x8E0C, 0x8E3B, 0x8E3E, 0x8E40, 0x8E43,
+	0x8E53, 0x8E5F, 0x8E70, 0x8E77,
+};
+
+/*
+ * Set of registers to dump for A6XX on snapshot.
+ * Registers in pairs - first value is the start offset, second
+ * is the stop offset (inclusive)
+ */
+
+static const unsigned int a6xx_registers[] = {
+	/* RBBM */
+	0x0000, 0x0002, 0x0010, 0x0010, 0x0012, 0x0012, 0x0018, 0x001B,
+	0x001e, 0x0032, 0x0038, 0x003C, 0x0042, 0x0042, 0x0044, 0x0044,
+	0x0047, 0x0047, 0x0056, 0x0056, 0x00AD, 0x00AE, 0x00B0, 0x00FB,
+	0x0100, 0x011D, 0x0200, 0x020D, 0x0218, 0x023D, 0x0400, 0x04F9,
+	0x0500, 0x0500, 0x0505, 0x050B, 0x050E, 0x0511, 0x0533, 0x0533,
+	0x0540, 0x0555,
+	/* CP */
+	0x0800, 0x0803, 0x0806, 0x0808, 0x0810, 0x0813, 0x0820, 0x0821,
+	0x0823, 0x0824, 0x0826, 0x0827, 0x0830, 0x0833, 0x0840, 0x0845,
+	0x084F, 0x086F, 0x0880, 0x088A, 0x08A0, 0x08AB, 0x08C0, 0x08C4,
+	0x08D0, 0x08DD, 0x08F0, 0x08F3, 0x0900, 0x0903, 0x0908, 0x0911,
+	0x0928, 0x093E, 0x0942, 0x094D, 0x0980, 0x0984, 0x098D, 0x0996,
+	0x0998, 0x099E, 0x09A0, 0x09A6, 0x09A8, 0x09AE, 0x09B0, 0x09B1,
+	0x09C2, 0x09C8, 0x0A00, 0x0A03,
+	/* VSC */
+	0x0C00, 0x0C04, 0x0C06, 0x0C06, 0x0C10, 0x0CD9, 0x0E00, 0x0E0E,
+	/* UCHE */
+	0x0E10, 0x0E13, 0x0E17, 0x0E19, 0x0E1C, 0x0E2B, 0x0E30, 0x0E32,
+	0x0E38, 0x0E39,
+	/* GRAS */
+	0x8600, 0x8601, 0x8610, 0x861B, 0x8620, 0x8620, 0x8628, 0x862B,
+	0x8630, 0x8637,
+	/* VPC */
+	0x9600, 0x9604, 0x9624, 0x9637,
+	/* PC */
+	0x9E00, 0x9E01, 0x9E03, 0x9E0E, 0x9E11, 0x9E16, 0x9E19, 0x9E19,
+	0x9E1C, 0x9E1C, 0x9E20, 0x9E23, 0x9E30, 0x9E31, 0x9E34, 0x9E34,
+	0x9E70, 0x9E72, 0x9E78, 0x9E79, 0x9E80, 0x9FFF,
+	/* VFD */
+	0xA600, 0xA601, 0xA603, 0xA603, 0xA60A, 0xA60A, 0xA610, 0xA617,
+	0xA630, 0xA630,
+	/* HLSQ */
+	0xD002, 0xD003,
+};
+
+static const unsigned int a660_registers[] = {
+	/* UCHE */
+	0x0E3C, 0x0E3C,
+	/* LPAC RBBM */
+	0x05FC, 0x05FF,
+	/* LPAC CP */
+	0x0B00, 0x0B40, 0x0B80, 0x0B83,
+};
+
+/*
+ * Set of registers to dump for A6XX before actually triggering crash dumper.
+ * Registers in pairs - first value is the start offset, second
+ * is the stop offset (inclusive)
+ */
+static const unsigned int a6xx_pre_crashdumper_registers[] = {
+	/* RBBM: RBBM_STATUS - RBBM_STATUS3 */
+	0x210, 0x213,
+	/* CP: CP_STATUS_1 */
+	0x825, 0x825,
+};
+
+static const unsigned int a6xx_gmu_wrapper_registers[] = {
+	/* GMU CX */
+	0x1f840, 0x1f840, 0x1f844, 0x1f845, 0x1f887, 0x1f889, 0x1f8d0, 0x1f8d0,
+	/* GMU AO*/
+	0x23b0C, 0x23b0E, 0x23b15, 0x23b15,
+};
+
+static const unsigned int a6xx_holi_gmu_wrapper_registers[] = {
+	/* GMU SPTPRAC */
+	0x1a880, 0x1a881,
+	/* GMU CX */
+	0x1f840, 0x1f840, 0x1f844, 0x1f845, 0x1f887, 0x1f889, 0x1f8d0, 0x1f8d0,
+	/* GMU AO*/
+	0x23b0c, 0x23b0e, 0x23b15, 0x23b15,
+};
+
+enum a6xx_debugbus_id {
+	A6XX_DBGBUS_CP           = 0x1,
+	A6XX_DBGBUS_RBBM         = 0x2,
+	A6XX_DBGBUS_VBIF         = 0x3,
+	A6XX_DBGBUS_HLSQ         = 0x4,
+	A6XX_DBGBUS_UCHE         = 0x5,
+	A6XX_DBGBUS_DPM          = 0x6,
+	A6XX_DBGBUS_TESS         = 0x7,
+	A6XX_DBGBUS_PC           = 0x8,
+	A6XX_DBGBUS_VFDP         = 0x9,
+	A6XX_DBGBUS_VPC          = 0xa,
+	A6XX_DBGBUS_TSE          = 0xb,
+	A6XX_DBGBUS_RAS          = 0xc,
+	A6XX_DBGBUS_VSC          = 0xd,
+	A6XX_DBGBUS_COM          = 0xe,
+	A6XX_DBGBUS_LRZ          = 0x10,
+	A6XX_DBGBUS_A2D          = 0x11,
+	A6XX_DBGBUS_CCUFCHE      = 0x12,
+	A6XX_DBGBUS_GMU_CX       = 0x13,
+	A6XX_DBGBUS_RBP          = 0x14,
+	A6XX_DBGBUS_DCS          = 0x15,
+	A6XX_DBGBUS_RBBM_CFG     = 0x16,
+	A6XX_DBGBUS_CX           = 0x17,
+	A6XX_DBGBUS_GMU_GX       = 0x18,
+	A6XX_DBGBUS_TPFCHE       = 0x19,
+	A6XX_DBGBUS_GBIF_GX      = 0x1a,
+	A6XX_DBGBUS_GPC          = 0x1d,
+	A6XX_DBGBUS_LARC         = 0x1e,
+	A6XX_DBGBUS_HLSQ_SPTP    = 0x1f,
+	A6XX_DBGBUS_RB_0         = 0x20,
+	A6XX_DBGBUS_RB_1         = 0x21,
+	A6XX_DBGBUS_RB_2         = 0x22,
+	A6XX_DBGBUS_UCHE_WRAPPER = 0x24,
+	A6XX_DBGBUS_CCU_0        = 0x28,
+	A6XX_DBGBUS_CCU_1        = 0x29,
+	A6XX_DBGBUS_CCU_2        = 0x2a,
+	A6XX_DBGBUS_VFD_0        = 0x38,
+	A6XX_DBGBUS_VFD_1        = 0x39,
+	A6XX_DBGBUS_VFD_2        = 0x3a,
+	A6XX_DBGBUS_VFD_3        = 0x3b,
+	A6XX_DBGBUS_VFD_4        = 0x3c,
+	A6XX_DBGBUS_VFD_5        = 0x3d,
+	A6XX_DBGBUS_SP_0         = 0x40,
+	A6XX_DBGBUS_SP_1         = 0x41,
+	A6XX_DBGBUS_SP_2         = 0x42,
+	A6XX_DBGBUS_TPL1_0       = 0x48,
+	A6XX_DBGBUS_TPL1_1       = 0x49,
+	A6XX_DBGBUS_TPL1_2       = 0x4a,
+	A6XX_DBGBUS_TPL1_3       = 0x4b,
+	A6XX_DBGBUS_TPL1_4       = 0x4c,
+	A6XX_DBGBUS_TPL1_5       = 0x4d,
+	A6XX_DBGBUS_SPTP_0       = 0x58,
+	A6XX_DBGBUS_SPTP_1       = 0x59,
+	A6XX_DBGBUS_SPTP_2       = 0x5a,
+	A6XX_DBGBUS_SPTP_3       = 0x5b,
+	A6XX_DBGBUS_SPTP_4       = 0x5c,
+	A6XX_DBGBUS_SPTP_5       = 0x5d,
+};
+
+static const struct adreno_debugbus_block a6xx_dbgc_debugbus_blocks[] = {
+	{ A6XX_DBGBUS_CP, 0x100, },
+	{ A6XX_DBGBUS_RBBM, 0x100, },
+	{ A6XX_DBGBUS_HLSQ, 0x100, },
+	{ A6XX_DBGBUS_UCHE, 0x100, },
+	{ A6XX_DBGBUS_DPM, 0x100, },
+	{ A6XX_DBGBUS_TESS, 0x100, },
+	{ A6XX_DBGBUS_PC, 0x100, },
+	{ A6XX_DBGBUS_VFDP, 0x100, },
+	{ A6XX_DBGBUS_VPC, 0x100, },
+	{ A6XX_DBGBUS_TSE, 0x100, },
+	{ A6XX_DBGBUS_RAS, 0x100, },
+	{ A6XX_DBGBUS_VSC, 0x100, },
+	{ A6XX_DBGBUS_COM, 0x100, },
+	{ A6XX_DBGBUS_LRZ, 0x100, },
+	{ A6XX_DBGBUS_A2D, 0x100, },
+	{ A6XX_DBGBUS_CCUFCHE, 0x100, },
+	{ A6XX_DBGBUS_RBP, 0x100, },
+	{ A6XX_DBGBUS_DCS, 0x100, },
+	{ A6XX_DBGBUS_RBBM_CFG, 0x100, },
+	{ A6XX_DBGBUS_GMU_GX, 0x100, },
+	{ A6XX_DBGBUS_TPFCHE, 0x100, },
+	{ A6XX_DBGBUS_GPC, 0x100, },
+	{ A6XX_DBGBUS_LARC, 0x100, },
+	{ A6XX_DBGBUS_HLSQ_SPTP, 0x100, },
+	{ A6XX_DBGBUS_RB_0, 0x100, },
+	{ A6XX_DBGBUS_RB_1, 0x100, },
+	{ A6XX_DBGBUS_UCHE_WRAPPER, 0x100, },
+	{ A6XX_DBGBUS_CCU_0, 0x100, },
+	{ A6XX_DBGBUS_CCU_1, 0x100, },
+	{ A6XX_DBGBUS_VFD_0, 0x100, },
+	{ A6XX_DBGBUS_VFD_1, 0x100, },
+	{ A6XX_DBGBUS_VFD_2, 0x100, },
+	{ A6XX_DBGBUS_VFD_3, 0x100, },
+	{ A6XX_DBGBUS_SP_0, 0x100, },
+	{ A6XX_DBGBUS_SP_1, 0x100, },
+	{ A6XX_DBGBUS_TPL1_0, 0x100, },
+	{ A6XX_DBGBUS_TPL1_1, 0x100, },
+	{ A6XX_DBGBUS_TPL1_2, 0x100, },
+	{ A6XX_DBGBUS_TPL1_3, 0x100, },
+};
+
+static const struct adreno_debugbus_block a6xx_vbif_debugbus_blocks = {
+	A6XX_DBGBUS_VBIF, 0x100,
+};
+
+static const struct adreno_debugbus_block a6xx_cx_dbgc_debugbus_blocks[] = {
+	{ A6XX_DBGBUS_GMU_CX, 0x100, },
+	{ A6XX_DBGBUS_CX, 0x100, },
+};
+
+static const struct adreno_debugbus_block a650_dbgc_debugbus_blocks[] = {
+	{ A6XX_DBGBUS_RB_2, 0x100, },
+	{ A6XX_DBGBUS_CCU_2, 0x100, },
+	{ A6XX_DBGBUS_VFD_4, 0x100, },
+	{ A6XX_DBGBUS_VFD_5, 0x100, },
+	{ A6XX_DBGBUS_SP_2, 0x100, },
+	{ A6XX_DBGBUS_TPL1_4, 0x100, },
+	{ A6XX_DBGBUS_TPL1_5, 0x100, },
+	{ A6XX_DBGBUS_SPTP_0, 0x100, },
+	{ A6XX_DBGBUS_SPTP_1, 0x100, },
+	{ A6XX_DBGBUS_SPTP_2, 0x100, },
+	{ A6XX_DBGBUS_SPTP_3, 0x100, },
+	{ A6XX_DBGBUS_SPTP_4, 0x100, },
+	{ A6XX_DBGBUS_SPTP_5, 0x100, },
+};
+
+#define A6XX_NUM_SHADER_BANKS 3
+#define A6XX_SHADER_STATETYPE_SHIFT 8
+
+enum a6xx_shader_obj {
+	A6XX_TP0_TMO_DATA               = 0x9,
+	A6XX_TP0_SMO_DATA               = 0xa,
+	A6XX_TP0_MIPMAP_BASE_DATA       = 0xb,
+	A6XX_TP1_TMO_DATA               = 0x19,
+	A6XX_TP1_SMO_DATA               = 0x1a,
+	A6XX_TP1_MIPMAP_BASE_DATA       = 0x1b,
+	A6XX_SP_INST_DATA               = 0x29,
+	A6XX_SP_LB_0_DATA               = 0x2a,
+	A6XX_SP_LB_1_DATA               = 0x2b,
+	A6XX_SP_LB_2_DATA               = 0x2c,
+	A6XX_SP_LB_3_DATA               = 0x2d,
+	A6XX_SP_LB_4_DATA               = 0x2e,
+	A6XX_SP_LB_5_DATA               = 0x2f,
+	A6XX_SP_CB_BINDLESS_DATA        = 0x30,
+	A6XX_SP_CB_LEGACY_DATA          = 0x31,
+	A6XX_SP_UAV_DATA                = 0x32,
+	A6XX_SP_INST_TAG                = 0x33,
+	A6XX_SP_CB_BINDLESS_TAG         = 0x34,
+	A6XX_SP_TMO_UMO_TAG             = 0x35,
+	A6XX_SP_SMO_TAG                 = 0x36,
+	A6XX_SP_STATE_DATA              = 0x37,
+	A6XX_HLSQ_CHUNK_CVS_RAM         = 0x49,
+	A6XX_HLSQ_CHUNK_CPS_RAM         = 0x4a,
+	A6XX_HLSQ_CHUNK_CVS_RAM_TAG     = 0x4b,
+	A6XX_HLSQ_CHUNK_CPS_RAM_TAG     = 0x4c,
+	A6XX_HLSQ_ICB_CVS_CB_BASE_TAG   = 0x4d,
+	A6XX_HLSQ_ICB_CPS_CB_BASE_TAG   = 0x4e,
+	A6XX_HLSQ_CVS_MISC_RAM          = 0x50,
+	A6XX_HLSQ_CPS_MISC_RAM          = 0x51,
+	A6XX_HLSQ_INST_RAM              = 0x52,
+	A6XX_HLSQ_GFX_CVS_CONST_RAM     = 0x53,
+	A6XX_HLSQ_GFX_CPS_CONST_RAM     = 0x54,
+	A6XX_HLSQ_CVS_MISC_RAM_TAG      = 0x55,
+	A6XX_HLSQ_CPS_MISC_RAM_TAG      = 0x56,
+	A6XX_HLSQ_INST_RAM_TAG          = 0x57,
+	A6XX_HLSQ_GFX_CVS_CONST_RAM_TAG = 0x58,
+	A6XX_HLSQ_GFX_CPS_CONST_RAM_TAG = 0x59,
+	A6XX_HLSQ_PWR_REST_RAM          = 0x5a,
+	A6XX_HLSQ_PWR_REST_TAG          = 0x5b,
+	A6XX_HLSQ_DATAPATH_META         = 0x60,
+	A6XX_HLSQ_FRONTEND_META         = 0x61,
+	A6XX_HLSQ_INDIRECT_META         = 0x62,
+	A6XX_HLSQ_BACKEND_META          = 0x63,
+	A6XX_SP_LB_6_DATA               = 0x70,
+	A6XX_SP_LB_7_DATA               = 0x71,
+	A6XX_HLSQ_INST_RAM_1            = 0x73,
+};
+
+struct a6xx_shader_block {
+	unsigned int statetype;
+	unsigned int sz;
+	uint64_t offset;
+};
+
+struct a6xx_shader_block_info {
+	struct a6xx_shader_block *block;
+	unsigned int bank;
+	uint64_t offset;
+};
+
+static struct a6xx_shader_block a6xx_shader_blocks[] = {
+	{A6XX_TP0_TMO_DATA,               0x200},
+	{A6XX_TP0_SMO_DATA,               0x80,},
+	{A6XX_TP0_MIPMAP_BASE_DATA,       0x3C0},
+	{A6XX_TP1_TMO_DATA,               0x200},
+	{A6XX_TP1_SMO_DATA,               0x80,},
+	{A6XX_TP1_MIPMAP_BASE_DATA,       0x3C0},
+	{A6XX_SP_INST_DATA,               0x800},
+	{A6XX_SP_LB_0_DATA,               0x800},
+	{A6XX_SP_LB_1_DATA,               0x800},
+	{A6XX_SP_LB_2_DATA,               0x800},
+	{A6XX_SP_LB_3_DATA,               0x800},
+	{A6XX_SP_LB_4_DATA,               0x800},
+	{A6XX_SP_LB_5_DATA,               0x200},
+	{A6XX_SP_CB_BINDLESS_DATA,        0x800},
+	{A6XX_SP_CB_LEGACY_DATA,          0x280,},
+	{A6XX_SP_UAV_DATA,                0x80,},
+	{A6XX_SP_INST_TAG,                0x80,},
+	{A6XX_SP_CB_BINDLESS_TAG,         0x80,},
+	{A6XX_SP_TMO_UMO_TAG,             0x80,},
+	{A6XX_SP_SMO_TAG,                 0x80},
+	{A6XX_SP_STATE_DATA,              0x3F},
+	{A6XX_HLSQ_CHUNK_CVS_RAM,         0x1C0},
+	{A6XX_HLSQ_CHUNK_CPS_RAM,         0x280},
+	{A6XX_HLSQ_CHUNK_CVS_RAM_TAG,     0x40,},
+	{A6XX_HLSQ_CHUNK_CPS_RAM_TAG,     0x40,},
+	{A6XX_HLSQ_ICB_CVS_CB_BASE_TAG,   0x4,},
+	{A6XX_HLSQ_ICB_CPS_CB_BASE_TAG,   0x4,},
+	{A6XX_HLSQ_CVS_MISC_RAM,          0x1C0},
+	{A6XX_HLSQ_CPS_MISC_RAM,          0x580},
+	{A6XX_HLSQ_INST_RAM,              0x800},
+	{A6XX_HLSQ_GFX_CVS_CONST_RAM,     0x800},
+	{A6XX_HLSQ_GFX_CPS_CONST_RAM,     0x800},
+	{A6XX_HLSQ_CVS_MISC_RAM_TAG,      0x8,},
+	{A6XX_HLSQ_CPS_MISC_RAM_TAG,      0x4,},
+	{A6XX_HLSQ_INST_RAM_TAG,          0x80,},
+	{A6XX_HLSQ_GFX_CVS_CONST_RAM_TAG, 0xC,},
+	{A6XX_HLSQ_GFX_CPS_CONST_RAM_TAG, 0x10},
+	{A6XX_HLSQ_PWR_REST_RAM,          0x28},
+	{A6XX_HLSQ_PWR_REST_TAG,          0x14},
+	{A6XX_HLSQ_DATAPATH_META,         0x40,},
+	{A6XX_HLSQ_FRONTEND_META,         0x40},
+	{A6XX_HLSQ_INDIRECT_META,         0x40,},
+	{A6XX_SP_LB_6_DATA,               0x200},
+	{A6XX_SP_LB_7_DATA,               0x200},
+	{A6XX_HLSQ_INST_RAM_1,            0x200},
+};
+
+static struct kgsl_memdesc *a6xx_capturescript;
+static struct kgsl_memdesc *a6xx_crashdump_registers;
+static bool crash_dump_valid;
+static u32 *a6xx_cd_reg_end;
+
+static struct reg_list {
+	const unsigned int *regs;
+	unsigned int count;
+	const struct sel_reg *sel;
+	uint64_t offset;
+} a6xx_reg_list[] = {
+	{ a6xx_registers, ARRAY_SIZE(a6xx_registers) / 2, NULL },
+	{ a660_registers, ARRAY_SIZE(a660_registers) / 2, NULL },
+	{ a6xx_rb_rac_registers, ARRAY_SIZE(a6xx_rb_rac_registers) / 2,
+		&_a6xx_rb_rac_aperture },
+	{ a6xx_rb_rbp_registers, ARRAY_SIZE(a6xx_rb_rbp_registers) / 2,
+		&_a6xx_rb_rbp_aperture },
+};
+
+#define REG_PAIR_COUNT(_a, _i) \
+	(((_a)[(2 * (_i)) + 1] - (_a)[2 * (_i)]) + 1)
+
+static size_t a6xx_legacy_snapshot_registers(struct kgsl_device *device,
+		u8 *buf, size_t remain, struct reg_list *regs)
+{
+	struct kgsl_snapshot_registers snapshot_regs = {
+		.regs = regs->regs,
+		.count = regs->count,
+	};
+
+	if (regs->sel)
+		kgsl_regwrite(device, regs->sel->host_reg, regs->sel->val);
+
+	return kgsl_snapshot_dump_registers(device, buf, remain,
+		&snapshot_regs);
+}
+
+static size_t a6xx_snapshot_registers(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct kgsl_snapshot_regs *header = (struct kgsl_snapshot_regs *)buf;
+	struct reg_list *regs = (struct reg_list *)priv;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int *src;
+	unsigned int j, k;
+	unsigned int count = 0;
+
+	if (!crash_dump_valid)
+		return a6xx_legacy_snapshot_registers(device, buf, remain,
+			regs);
+
+	if (remain < sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	src = a6xx_crashdump_registers->hostptr + regs->offset;
+	remain -= sizeof(*header);
+
+	for (j = 0; j < regs->count; j++) {
+		unsigned int start = regs->regs[2 * j];
+		unsigned int end = regs->regs[(2 * j) + 1];
+
+		if (remain < ((end - start) + 1) * 8) {
+			SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+			goto out;
+		}
+
+		remain -= ((end - start) + 1) * 8;
+
+		for (k = start; k <= end; k++, count++) {
+			*data++ = k;
+			*data++ = *src++;
+		}
+	}
+
+out:
+	header->count = count;
+
+	/* Return the size of the section */
+	return (count * 8) + sizeof(*header);
+}
+
+static size_t a6xx_snapshot_pre_crashdump_regs(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_registers pre_cdregs = {
+			.regs = a6xx_pre_crashdumper_registers,
+			.count = ARRAY_SIZE(a6xx_pre_crashdumper_registers)/2,
+	};
+
+	return kgsl_snapshot_dump_registers(device, buf, remain, &pre_cdregs);
+}
+
+static size_t a6xx_legacy_snapshot_shader(struct kgsl_device *device,
+				u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_shader *header =
+		(struct kgsl_snapshot_shader *) buf;
+	struct a6xx_shader_block_info *info =
+		(struct a6xx_shader_block_info *) priv;
+	struct a6xx_shader_block *block = info->block;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int read_sel, val;
+	int i;
+
+	if (!device->snapshot_legacy)
+		return 0;
+
+	if (remain < SHADER_SECTION_SZ(block->sz)) {
+		SNAPSHOT_ERR_NOMEM(device, "SHADER MEMORY");
+		return 0;
+	}
+
+	/*
+	 * If crashdumper times out, accessing some readback states from
+	 * AHB path might fail. Hence, skip SP_INST_TAG and SP_INST_DATA
+	 * state types during snapshot dump in legacy flow.
+	 */
+	if (adreno_is_a660(ADRENO_DEVICE(device)) &&
+		(block->statetype == A6XX_SP_INST_TAG ||
+		 block->statetype == A6XX_SP_INST_DATA))
+		return 0;
+
+	header->type = block->statetype;
+	header->index = info->bank;
+	header->size = block->sz;
+
+	read_sel = (block->statetype << A6XX_SHADER_STATETYPE_SHIFT) |
+		info->bank;
+	kgsl_regwrite(device, A6XX_HLSQ_DBG_READ_SEL, read_sel);
+
+	/*
+	 * An explicit barrier is needed so that reads do not happen before
+	 * the register write.
+	 */
+	mb();
+
+	for (i = 0; i < block->sz; i++) {
+		kgsl_regread(device, (A6XX_HLSQ_DBG_AHB_READ_APERTURE + i),
+			&val);
+		*data++ = val;
+	}
+
+	return SHADER_SECTION_SZ(block->sz);
+}
+
+static size_t a6xx_snapshot_shader_memory(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_shader *header =
+		(struct kgsl_snapshot_shader *) buf;
+	struct a6xx_shader_block_info *info =
+		(struct a6xx_shader_block_info *) priv;
+	struct a6xx_shader_block *block = info->block;
+	unsigned int *data = (unsigned int *) (buf + sizeof(*header));
+
+	if (!crash_dump_valid)
+		return a6xx_legacy_snapshot_shader(device, buf, remain, priv);
+
+	if (remain < SHADER_SECTION_SZ(block->sz)) {
+		SNAPSHOT_ERR_NOMEM(device, "SHADER MEMORY");
+		return 0;
+	}
+
+	header->type = block->statetype;
+	header->index = info->bank;
+	header->size = block->sz;
+
+	memcpy(data, a6xx_crashdump_registers->hostptr + info->offset,
+		block->sz * sizeof(unsigned int));
+
+	return SHADER_SECTION_SZ(block->sz);
+}
+
+static void a6xx_snapshot_shader(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	unsigned int i, j;
+	struct a6xx_shader_block_info info;
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_shader_blocks); i++) {
+		for (j = 0; j < A6XX_NUM_SHADER_BANKS; j++) {
+			info.block = &a6xx_shader_blocks[i];
+			info.bank = j;
+			info.offset = a6xx_shader_blocks[i].offset +
+				(j * a6xx_shader_blocks[i].sz);
+
+			/* Shader working/shadow memory */
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_SHADER,
+				snapshot, a6xx_snapshot_shader_memory, &info);
+		}
+	}
+}
+
+static void a650_snapshot_mempool(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	u32 val;
+
+	/* set CP_CHICKEN_DBG[StabilizeMVC] to stabilize it while dumping */
+	kgsl_regread(device, A6XX_CP_CHICKEN_DBG, &val);
+	kgsl_regwrite(device, A6XX_CP_CHICKEN_DBG, val | BIT(2));
+
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A6XX_CP_MEM_POOL_DBG_ADDR, A6XX_CP_MEM_POOL_DBG_DATA,
+		0, 0x2100);
+
+	kgsl_regwrite(device, A6XX_CP_CHICKEN_DBG, val);
+}
+
+static void a6xx_snapshot_mempool(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	unsigned int pool_size;
+	u8 *buf = snapshot->ptr;
+
+	/* Set the mempool size to 0 to stabilize it while dumping */
+	kgsl_regread(device, A6XX_CP_MEM_POOL_SIZE, &pool_size);
+	kgsl_regwrite(device, A6XX_CP_MEM_POOL_SIZE, 0);
+
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A6XX_CP_MEM_POOL_DBG_ADDR, A6XX_CP_MEM_POOL_DBG_DATA,
+		0, 0x2100);
+
+	/*
+	 * Data at offset 0x2000 in the mempool section is the mempool size.
+	 * Since we set it to 0, patch in the original size so that the data
+	 * is consistent.
+	 */
+	if (buf < snapshot->ptr) {
+		unsigned int *data;
+
+		/* Skip over the headers */
+		buf += sizeof(struct kgsl_snapshot_section_header) +
+				sizeof(struct kgsl_snapshot_indexed_regs);
+
+		data = (unsigned int *)buf + 0x2000;
+		*data = pool_size;
+	}
+
+	/* Restore the saved mempool size */
+	kgsl_regwrite(device, A6XX_CP_MEM_POOL_SIZE, pool_size);
+}
+
+static inline unsigned int a6xx_read_dbgahb(struct kgsl_device *device,
+				unsigned int regbase, unsigned int reg)
+{
+	unsigned int read_reg = A6XX_HLSQ_DBG_AHB_READ_APERTURE +
+				reg - regbase / 4;
+	unsigned int val;
+
+	kgsl_regread(device, read_reg, &val);
+	return val;
+}
+
+static size_t a6xx_legacy_snapshot_cluster_dbgahb(struct kgsl_device *device,
+				u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_mvc_regs *header =
+				(struct kgsl_snapshot_mvc_regs *)buf;
+	struct a6xx_cluster_dbgahb_regs_info *info =
+				(struct a6xx_cluster_dbgahb_regs_info *)priv;
+	struct a6xx_cluster_dbgahb_registers *cur_cluster = info->cluster;
+	unsigned int read_sel;
+	unsigned int data_size = 0;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	int i, j;
+
+	if (!device->snapshot_legacy)
+		return 0;
+
+	if (remain < sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	remain -= sizeof(*header);
+
+	header->ctxt_id = info->ctxt_id;
+	header->cluster_id = cur_cluster->id;
+
+	read_sel = ((cur_cluster->statetype + info->ctxt_id * 2) & 0xff) << 8;
+	kgsl_regwrite(device, A6XX_HLSQ_DBG_READ_SEL, read_sel);
+
+	/*
+	 * An explicit barrier is needed so that reads do not happen before
+	 * the register write.
+	 */
+	mb();
+
+	for (i = 0; i < cur_cluster->num_sets; i++) {
+		unsigned int start = cur_cluster->regs[2 * i];
+		unsigned int end = cur_cluster->regs[2 * i + 1];
+
+		if (remain < (end - start + 3) * 4) {
+			SNAPSHOT_ERR_NOMEM(device, "MVC REGISTERS");
+			goto out;
+		}
+
+		remain -= (end - start + 3) * 4;
+		data_size += (end - start + 3) * 4;
+
+		*data++ = start | (1 << 31);
+		*data++ = end;
+
+		for (j = start; j <= end; j++) {
+			unsigned int val;
+
+			val = a6xx_read_dbgahb(device, cur_cluster->regbase, j);
+			*data++ = val;
+
+		}
+	}
+
+out:
+	return data_size + sizeof(*header);
+}
+
+static size_t a6xx_snapshot_cluster_dbgahb(struct kgsl_device *device, u8 *buf,
+				size_t remain, void *priv)
+{
+	struct kgsl_snapshot_mvc_regs *header =
+				(struct kgsl_snapshot_mvc_regs *)buf;
+	struct a6xx_cluster_dbgahb_regs_info *info =
+				(struct a6xx_cluster_dbgahb_regs_info *)priv;
+	struct a6xx_cluster_dbgahb_registers *cluster = info->cluster;
+	unsigned int data_size = 0;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	int i, j;
+	unsigned int *src;
+
+
+	if (!crash_dump_valid)
+		return a6xx_legacy_snapshot_cluster_dbgahb(device, buf, remain,
+				info);
+
+	if (remain < sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	remain -= sizeof(*header);
+
+	header->ctxt_id = info->ctxt_id;
+	header->cluster_id = cluster->id;
+
+	src = a6xx_crashdump_registers->hostptr +
+		(header->ctxt_id ? cluster->offset1 : cluster->offset0);
+
+	for (i = 0; i < cluster->num_sets; i++) {
+		unsigned int start;
+		unsigned int end;
+
+		start = cluster->regs[2 * i];
+		end = cluster->regs[2 * i + 1];
+
+		if (remain < (end - start + 3) * 4) {
+			SNAPSHOT_ERR_NOMEM(device, "MVC REGISTERS");
+			goto out;
+		}
+
+		remain -= (end - start + 3) * 4;
+		data_size += (end - start + 3) * 4;
+
+		*data++ = start | (1 << 31);
+		*data++ = end;
+		for (j = start; j <= end; j++)
+			*data++ = *src++;
+	}
+out:
+	return data_size + sizeof(*header);
+}
+
+static size_t a6xx_legacy_snapshot_non_ctx_dbgahb(struct kgsl_device *device,
+				u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_regs *header =
+				(struct kgsl_snapshot_regs *)buf;
+	struct a6xx_non_ctx_dbgahb_registers *regs =
+				(struct a6xx_non_ctx_dbgahb_registers *)priv;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	int count = 0;
+	unsigned int read_sel;
+	int i, j;
+
+	if (!device->snapshot_legacy)
+		return 0;
+
+	/* Figure out how many registers we are going to dump */
+	for (i = 0; i < regs->num_sets; i++) {
+		int start = regs->regs[i * 2];
+		int end = regs->regs[i * 2 + 1];
+
+		count += (end - start + 1);
+	}
+
+	if (remain < (count * 8) + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	header->count = count;
+
+	read_sel = (regs->statetype & 0xff) << 8;
+	kgsl_regwrite(device, A6XX_HLSQ_DBG_READ_SEL, read_sel);
+
+	for (i = 0; i < regs->num_sets; i++) {
+		unsigned int start = regs->regs[2 * i];
+		unsigned int end = regs->regs[2 * i + 1];
+
+		for (j = start; j <= end; j++) {
+			unsigned int val;
+
+			val = a6xx_read_dbgahb(device, regs->regbase, j);
+			*data++ = j;
+			*data++ = val;
+
+		}
+	}
+	return (count * 8) + sizeof(*header);
+}
+
+static size_t a6xx_snapshot_non_ctx_dbgahb(struct kgsl_device *device, u8 *buf,
+				size_t remain, void *priv)
+{
+	struct kgsl_snapshot_regs *header =
+				(struct kgsl_snapshot_regs *)buf;
+	struct a6xx_non_ctx_dbgahb_registers *regs =
+				(struct a6xx_non_ctx_dbgahb_registers *)priv;
+	unsigned int count = 0;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int i, k;
+	unsigned int *src;
+
+	if (!crash_dump_valid)
+		return a6xx_legacy_snapshot_non_ctx_dbgahb(device, buf, remain,
+				regs);
+
+	if (remain < sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	remain -= sizeof(*header);
+
+	src = a6xx_crashdump_registers->hostptr + regs->offset;
+
+	for (i = 0; i < regs->num_sets; i++) {
+		unsigned int start;
+		unsigned int end;
+
+		start = regs->regs[2 * i];
+		end = regs->regs[(2 * i) + 1];
+
+		if (remain < (end - start + 1) * 8) {
+			SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+			goto out;
+		}
+
+		remain -= ((end - start) + 1) * 8;
+
+		for (k = start; k <= end; k++, count++) {
+			*data++ = k;
+			*data++ = *src++;
+		}
+	}
+out:
+	header->count = count;
+
+	/* Return the size of the section */
+	return (count * 8) + sizeof(*header);
+}
+
+static void a6xx_snapshot_dbgahb_regs(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	int i, j;
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_dbgahb_ctx_clusters); i++) {
+		struct a6xx_cluster_dbgahb_registers *cluster =
+				&a6xx_dbgahb_ctx_clusters[i];
+		struct a6xx_cluster_dbgahb_regs_info info;
+
+		info.cluster = cluster;
+		for (j = 0; j < A6XX_NUM_CTXTS; j++) {
+			info.ctxt_id = j;
+
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_MVC, snapshot,
+				a6xx_snapshot_cluster_dbgahb, &info);
+		}
+	}
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_non_ctx_dbgahb); i++) {
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_REGS, snapshot,
+			a6xx_snapshot_non_ctx_dbgahb, &a6xx_non_ctx_dbgahb[i]);
+	}
+}
+
+static size_t a6xx_legacy_snapshot_mvc(struct kgsl_device *device, u8 *buf,
+				size_t remain, void *priv)
+{
+	struct kgsl_snapshot_mvc_regs *header =
+					(struct kgsl_snapshot_mvc_regs *)buf;
+	struct a6xx_cluster_regs_info *info =
+					(struct a6xx_cluster_regs_info *)priv;
+	struct a6xx_cluster_registers *cur_cluster = info->cluster;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int ctxt = info->ctxt_id;
+	unsigned int start, end, i, j, aperture_cntl = 0;
+	unsigned int data_size = 0;
+
+	if (remain < sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "MVC REGISTERS");
+		return 0;
+	}
+
+	remain -= sizeof(*header);
+
+	header->ctxt_id = info->ctxt_id;
+	header->cluster_id = cur_cluster->id;
+
+	/*
+	 * Set the AHB control for the Host to read from the
+	 * cluster/context for this iteration.
+	 */
+	aperture_cntl = ((cur_cluster->id & 0x7) << 8) | (ctxt << 4) | ctxt;
+	kgsl_regwrite(device, A6XX_CP_APERTURE_CNTL_HOST, aperture_cntl);
+
+	if (cur_cluster->sel)
+		kgsl_regwrite(device, cur_cluster->sel->host_reg,
+			cur_cluster->sel->val);
+
+	for (i = 0; i < cur_cluster->num_sets; i++) {
+		start = cur_cluster->regs[2 * i];
+		end = cur_cluster->regs[2 * i + 1];
+
+		if (remain < (end - start + 3) * 4) {
+			SNAPSHOT_ERR_NOMEM(device, "MVC REGISTERS");
+			goto out;
+		}
+
+		remain -= (end - start + 3) * 4;
+		data_size += (end - start + 3) * 4;
+
+		*data++ = start | (1 << 31);
+		*data++ = end;
+		for (j = start; j <= end; j++) {
+			unsigned int val;
+
+			kgsl_regread(device, j, &val);
+			*data++ = val;
+		}
+	}
+out:
+	return data_size + sizeof(*header);
+}
+
+static size_t a6xx_snapshot_mvc(struct kgsl_device *device, u8 *buf,
+				size_t remain, void *priv)
+{
+	struct kgsl_snapshot_mvc_regs *header =
+				(struct kgsl_snapshot_mvc_regs *)buf;
+	struct a6xx_cluster_regs_info *info =
+				(struct a6xx_cluster_regs_info *)priv;
+	struct a6xx_cluster_registers *cluster = info->cluster;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int *src;
+	int i, j;
+	unsigned int start, end;
+	size_t data_size = 0;
+
+	if (!crash_dump_valid)
+		return a6xx_legacy_snapshot_mvc(device, buf, remain, info);
+
+	if (remain < sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "MVC REGISTERS");
+		return 0;
+	}
+
+	remain -= sizeof(*header);
+
+	header->ctxt_id = info->ctxt_id;
+	header->cluster_id = cluster->id;
+
+	src = a6xx_crashdump_registers->hostptr +
+		(header->ctxt_id ? cluster->offset1 : cluster->offset0);
+
+	for (i = 0; i < cluster->num_sets; i++) {
+		start = cluster->regs[2 * i];
+		end = cluster->regs[2 * i + 1];
+
+		if (remain < (end - start + 3) * 4) {
+			SNAPSHOT_ERR_NOMEM(device, "MVC REGISTERS");
+			goto out;
+		}
+
+		remain -= (end - start + 3) * 4;
+		data_size += (end - start + 3) * 4;
+
+		*data++ = start | (1 << 31);
+		*data++ = end;
+		for (j = start; j <= end; j++)
+			*data++ = *src++;
+	}
+
+out:
+	return data_size + sizeof(*header);
+
+}
+
+static void a6xx_snapshot_mvc_regs(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	int i, j;
+	struct a6xx_cluster_regs_info info;
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_clusters); i++) {
+		struct a6xx_cluster_registers *cluster = &a6xx_clusters[i];
+
+		/* Skip registers that dont exists on targets other than A660 */
+		if (!adreno_is_a660(ADRENO_DEVICE(device)) &&
+				(cluster->regs == a660_fe_cluster))
+			continue;
+
+		info.cluster = cluster;
+		for (j = 0; j < A6XX_NUM_CTXTS; j++) {
+			info.ctxt_id = j;
+
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_MVC, snapshot,
+				a6xx_snapshot_mvc, &info);
+		}
+	}
+}
+
+/* a6xx_dbgc_debug_bus_read() - Read data from trace bus */
+static void a6xx_dbgc_debug_bus_read(struct kgsl_device *device,
+	unsigned int block_id, unsigned int index, unsigned int *val)
+{
+	unsigned int reg;
+
+	reg = (block_id << A6XX_DBGC_CFG_DBGBUS_SEL_PING_BLK_SEL_SHIFT) |
+			(index << A6XX_DBGC_CFG_DBGBUS_SEL_PING_INDEX_SHIFT);
+
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_SEL_A, reg);
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_SEL_B, reg);
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_SEL_C, reg);
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_SEL_D, reg);
+
+	/*
+	 * There needs to be a delay of 1 us to ensure enough time for correct
+	 * data is funneled into the trace buffer
+	 */
+	udelay(1);
+
+	kgsl_regread(device, A6XX_DBGC_CFG_DBGBUS_TRACE_BUF2, val);
+	val++;
+	kgsl_regread(device, A6XX_DBGC_CFG_DBGBUS_TRACE_BUF1, val);
+}
+
+/* a6xx_snapshot_dbgc_debugbus_block() - Capture debug data for a gpu block */
+static size_t a6xx_snapshot_dbgc_debugbus_block(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debugbus *header =
+		(struct kgsl_snapshot_debugbus *)buf;
+	struct adreno_debugbus_block *block = priv;
+	int i;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int dwords;
+	unsigned int block_id;
+	size_t size;
+
+	dwords = block->dwords;
+
+	/* For a6xx each debug bus data unit is 2 DWORDS */
+	size = (dwords * sizeof(unsigned int) * 2) + sizeof(*header);
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+
+	header->id = block->block_id;
+	if ((block->block_id == A6XX_DBGBUS_VBIF) && !adreno_is_a630(adreno_dev))
+		header->id = A6XX_DBGBUS_GBIF_GX;
+	header->count = dwords * 2;
+
+	block_id = block->block_id;
+	/* GMU_GX data is read using the GMU_CX block id on A630 */
+	if ((adreno_is_a630(adreno_dev) || adreno_is_a615_family(adreno_dev)) &&
+		(block_id == A6XX_DBGBUS_GMU_GX))
+		block_id = A6XX_DBGBUS_GMU_CX;
+
+	for (i = 0; i < dwords; i++)
+		a6xx_dbgc_debug_bus_read(device, block_id, i, &data[i*2]);
+
+	return size;
+}
+
+/* a6xx_snapshot_vbif_debugbus_block() - Capture debug data for VBIF block */
+static size_t a6xx_snapshot_vbif_debugbus_block(struct kgsl_device *device,
+			u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debugbus *header =
+		(struct kgsl_snapshot_debugbus *)buf;
+	struct adreno_debugbus_block *block = priv;
+	int i, j;
+	/*
+	 * Total number of VBIF data words considering 3 sections:
+	 * 2 arbiter blocks of 16 words
+	 * 5 AXI XIN blocks of 18 dwords each
+	 * 4 core clock side XIN blocks of 12 dwords each
+	 */
+	unsigned int dwords = (16 * A6XX_NUM_AXI_ARB_BLOCKS) +
+			(18 * A6XX_NUM_XIN_AXI_BLOCKS) +
+			(12 * A6XX_NUM_XIN_CORE_BLOCKS);
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	size_t size;
+	unsigned int reg_clk;
+
+	size = (dwords * sizeof(unsigned int)) + sizeof(*header);
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+	header->id = block->block_id;
+	header->count = dwords;
+
+	kgsl_regread(device, A6XX_VBIF_CLKON, &reg_clk);
+	kgsl_regwrite(device, A6XX_VBIF_CLKON, reg_clk |
+			(A6XX_VBIF_CLKON_FORCE_ON_TESTBUS_MASK <<
+			A6XX_VBIF_CLKON_FORCE_ON_TESTBUS_SHIFT));
+	kgsl_regwrite(device, A6XX_VBIF_TEST_BUS1_CTRL0, 0);
+	kgsl_regwrite(device, A6XX_VBIF_TEST_BUS_OUT_CTRL,
+			(A6XX_VBIF_TEST_BUS_OUT_CTRL_EN_MASK <<
+			A6XX_VBIF_TEST_BUS_OUT_CTRL_EN_SHIFT));
+
+	for (i = 0; i < A6XX_NUM_AXI_ARB_BLOCKS; i++) {
+		kgsl_regwrite(device, A6XX_VBIF_TEST_BUS2_CTRL0,
+			(1 << (i + 16)));
+		for (j = 0; j < 16; j++) {
+			kgsl_regwrite(device, A6XX_VBIF_TEST_BUS2_CTRL1,
+				((j & A6XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_MASK)
+				<< A6XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_SHIFT));
+			kgsl_regread(device, A6XX_VBIF_TEST_BUS_OUT,
+					data);
+			data++;
+		}
+	}
+
+	/* XIN blocks AXI side */
+	for (i = 0; i < A6XX_NUM_XIN_AXI_BLOCKS; i++) {
+		kgsl_regwrite(device, A6XX_VBIF_TEST_BUS2_CTRL0, 1 << i);
+		for (j = 0; j < 18; j++) {
+			kgsl_regwrite(device, A6XX_VBIF_TEST_BUS2_CTRL1,
+				((j & A6XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_MASK)
+				<< A6XX_VBIF_TEST_BUS2_CTRL1_DATA_SEL_SHIFT));
+			kgsl_regread(device, A6XX_VBIF_TEST_BUS_OUT,
+				data);
+			data++;
+		}
+	}
+	kgsl_regwrite(device, A6XX_VBIF_TEST_BUS2_CTRL0, 0);
+
+	/* XIN blocks core clock side */
+	for (i = 0; i < A6XX_NUM_XIN_CORE_BLOCKS; i++) {
+		kgsl_regwrite(device, A6XX_VBIF_TEST_BUS1_CTRL0, 1 << i);
+		for (j = 0; j < 12; j++) {
+			kgsl_regwrite(device, A6XX_VBIF_TEST_BUS1_CTRL1,
+				((j & A6XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_MASK)
+				<< A6XX_VBIF_TEST_BUS1_CTRL1_DATA_SEL_SHIFT));
+			kgsl_regread(device, A6XX_VBIF_TEST_BUS_OUT,
+				data);
+			data++;
+		}
+	}
+	/* restore the clock of VBIF */
+	kgsl_regwrite(device, A6XX_VBIF_CLKON, reg_clk);
+	return size;
+}
+
+/* a6xx_cx_dbgc_debug_bus_read() - Read data from trace bus */
+static void a6xx_cx_debug_bus_read(struct kgsl_device *device,
+	unsigned int block_id, unsigned int index, unsigned int *val)
+{
+	unsigned int reg;
+
+	reg = (block_id << A6XX_CX_DBGC_CFG_DBGBUS_SEL_PING_BLK_SEL_SHIFT) |
+			(index << A6XX_CX_DBGC_CFG_DBGBUS_SEL_PING_INDEX_SHIFT);
+
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_SEL_A, reg);
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_SEL_B, reg);
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_SEL_C, reg);
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_SEL_D, reg);
+
+	/*
+	 * There needs to be a delay of 1 us to ensure enough time for correct
+	 * data is funneled into the trace buffer
+	 */
+	udelay(1);
+
+	kgsl_regread(device, A6XX_CX_DBGC_CFG_DBGBUS_TRACE_BUF2, val);
+	val++;
+	kgsl_regread(device, A6XX_CX_DBGC_CFG_DBGBUS_TRACE_BUF1, val);
+}
+
+/*
+ * a6xx_snapshot_cx_dbgc_debugbus_block() - Capture debug data for a gpu
+ * block from the CX DBGC block
+ */
+static size_t a6xx_snapshot_cx_dbgc_debugbus_block(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debugbus *header =
+		(struct kgsl_snapshot_debugbus *)buf;
+	struct adreno_debugbus_block *block = priv;
+	int i;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int dwords;
+	size_t size;
+
+	dwords = block->dwords;
+
+	/* For a6xx each debug bus data unit is 2 DWRODS */
+	size = (dwords * sizeof(unsigned int) * 2) + sizeof(*header);
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+
+	header->id = block->block_id;
+	header->count = dwords * 2;
+
+	for (i = 0; i < dwords; i++)
+		a6xx_cx_debug_bus_read(device, block->block_id, i,
+					&data[i*2]);
+
+	return size;
+}
+
+/* a6xx_snapshot_debugbus() - Capture debug bus data */
+static void a6xx_snapshot_debugbus(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot)
+{
+	int i;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_CNTLT,
+		(0xf << A6XX_DBGC_CFG_DBGBUS_CNTLT_SEGT_SHIFT) |
+		(0x0 << A6XX_DBGC_CFG_DBGBUS_CNTLT_GRANU_SHIFT) |
+		(0x0 << A6XX_DBGC_CFG_DBGBUS_CNTLT_TRACEEN_SHIFT));
+
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_CNTLM,
+		0xf << A6XX_DBGC_CFG_DBGBUS_CTLTM_ENABLE_SHIFT);
+
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_IVTL_0, 0);
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_IVTL_1, 0);
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_IVTL_2, 0);
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_IVTL_3, 0);
+
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_BYTEL_0,
+		(0 << A6XX_DBGC_CFG_DBGBUS_BYTEL0_SHIFT) |
+		(1 << A6XX_DBGC_CFG_DBGBUS_BYTEL1_SHIFT) |
+		(2 << A6XX_DBGC_CFG_DBGBUS_BYTEL2_SHIFT) |
+		(3 << A6XX_DBGC_CFG_DBGBUS_BYTEL3_SHIFT) |
+		(4 << A6XX_DBGC_CFG_DBGBUS_BYTEL4_SHIFT) |
+		(5 << A6XX_DBGC_CFG_DBGBUS_BYTEL5_SHIFT) |
+		(6 << A6XX_DBGC_CFG_DBGBUS_BYTEL6_SHIFT) |
+		(7 << A6XX_DBGC_CFG_DBGBUS_BYTEL7_SHIFT));
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_BYTEL_1,
+		(8 << A6XX_DBGC_CFG_DBGBUS_BYTEL8_SHIFT) |
+		(9 << A6XX_DBGC_CFG_DBGBUS_BYTEL9_SHIFT) |
+		(10 << A6XX_DBGC_CFG_DBGBUS_BYTEL10_SHIFT) |
+		(11 << A6XX_DBGC_CFG_DBGBUS_BYTEL11_SHIFT) |
+		(12 << A6XX_DBGC_CFG_DBGBUS_BYTEL12_SHIFT) |
+		(13 << A6XX_DBGC_CFG_DBGBUS_BYTEL13_SHIFT) |
+		(14 << A6XX_DBGC_CFG_DBGBUS_BYTEL14_SHIFT) |
+		(15 << A6XX_DBGC_CFG_DBGBUS_BYTEL15_SHIFT));
+
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_MASKL_0, 0);
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_MASKL_1, 0);
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_MASKL_2, 0);
+	kgsl_regwrite(device, A6XX_DBGC_CFG_DBGBUS_MASKL_3, 0);
+
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_CNTLT,
+		(0xf << A6XX_DBGC_CFG_DBGBUS_CNTLT_SEGT_SHIFT) |
+		(0x0 << A6XX_DBGC_CFG_DBGBUS_CNTLT_GRANU_SHIFT) |
+		(0x0 << A6XX_DBGC_CFG_DBGBUS_CNTLT_TRACEEN_SHIFT));
+
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_CNTLM,
+		0xf << A6XX_CX_DBGC_CFG_DBGBUS_CNTLM_ENABLE_SHIFT);
+
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_IVTL_0, 0);
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_IVTL_1, 0);
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_IVTL_2, 0);
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_IVTL_3, 0);
+
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_0,
+		(0 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL0_SHIFT) |
+		(1 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL1_SHIFT) |
+		(2 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL2_SHIFT) |
+		(3 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL3_SHIFT) |
+		(4 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL4_SHIFT) |
+		(5 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL5_SHIFT) |
+		(6 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL6_SHIFT) |
+		(7 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL7_SHIFT));
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_1,
+		(8 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL8_SHIFT) |
+		(9 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL9_SHIFT) |
+		(10 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL10_SHIFT) |
+		(11 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL11_SHIFT) |
+		(12 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL12_SHIFT) |
+		(13 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL13_SHIFT) |
+		(14 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL14_SHIFT) |
+		(15 << A6XX_CX_DBGC_CFG_DBGBUS_BYTEL15_SHIFT));
+
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_MASKL_0, 0);
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_MASKL_1, 0);
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_MASKL_2, 0);
+	kgsl_regwrite(device, A6XX_CX_DBGC_CFG_DBGBUS_MASKL_3, 0);
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_dbgc_debugbus_blocks); i++) {
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+			snapshot, a6xx_snapshot_dbgc_debugbus_block,
+			(void *) &a6xx_dbgc_debugbus_blocks[i]);
+	}
+
+	if (adreno_is_a650_family(adreno_dev)) {
+		for (i = 0; i < ARRAY_SIZE(a650_dbgc_debugbus_blocks); i++) {
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+				snapshot, a6xx_snapshot_dbgc_debugbus_block,
+				(void *) &a650_dbgc_debugbus_blocks[i]);
+		}
+	}
+
+	/*
+	 * GBIF has same debugbus as of other GPU blocks hence fall back to
+	 * default path if GPU uses GBIF.
+	 * GBIF uses exactly same ID as of VBIF so use it as it is.
+	 */
+	if (!adreno_is_a630(adreno_dev))
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+			snapshot, a6xx_snapshot_dbgc_debugbus_block,
+			(void *) &a6xx_vbif_debugbus_blocks);
+	else
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+			snapshot, a6xx_snapshot_vbif_debugbus_block,
+			(void *) &a6xx_vbif_debugbus_blocks);
+
+	/* Dump the CX debugbus data if the block exists */
+	if (kgsl_regmap_valid_offset(&device->regmap, A6XX_CX_DBGC_CFG_DBGBUS_SEL_A)) {
+		for (i = 0; i < ARRAY_SIZE(a6xx_cx_dbgc_debugbus_blocks); i++) {
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+				snapshot, a6xx_snapshot_cx_dbgc_debugbus_block,
+				(void *) &a6xx_cx_dbgc_debugbus_blocks[i]);
+		}
+		/*
+		 * Get debugbus for GBIF CX part if GPU has GBIF block
+		 * GBIF uses exactly same ID as of VBIF so use
+		 * it as it is.
+		 */
+		if (!adreno_is_a630(adreno_dev))
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+				snapshot,
+				a6xx_snapshot_cx_dbgc_debugbus_block,
+				(void *) &a6xx_vbif_debugbus_blocks);
+	}
+}
+
+
+
+/* a6xx_snapshot_sqe() - Dump SQE data in snapshot */
+static size_t a6xx_snapshot_sqe(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_SQE);
+
+	if (remain < DEBUG_SECTION_SZ(1)) {
+		SNAPSHOT_ERR_NOMEM(device, "SQE VERSION DEBUG");
+		return 0;
+	}
+
+	/* Dump the SQE firmware version */
+	header->type = SNAPSHOT_DEBUG_SQE_VERSION;
+	header->size = 1;
+	*data = fw->version;
+
+	return DEBUG_SECTION_SZ(1);
+}
+
+static void _a6xx_do_crashdump(struct kgsl_device *device)
+{
+	u32 val = 0;
+	ktime_t timeout;
+
+	crash_dump_valid = false;
+
+	if (!device->snapshot_crashdumper)
+		return;
+
+	if (IS_ERR_OR_NULL(a6xx_capturescript) ||
+		IS_ERR_OR_NULL(a6xx_crashdump_registers))
+		return;
+
+	/* IF the SMMU is stalled we cannot do a crash dump */
+	if (a6xx_is_smmu_stalled(device))
+		return;
+
+	/* Turn on APRIV for legacy targets so we can access the buffers */
+	if (!ADRENO_FEATURE(ADRENO_DEVICE(device), ADRENO_APRIV))
+		kgsl_regwrite(device, A6XX_CP_MISC_CNTL, 1);
+
+	kgsl_regwrite(device, A6XX_CP_CRASH_SCRIPT_BASE_LO,
+			lower_32_bits(a6xx_capturescript->gpuaddr));
+	kgsl_regwrite(device, A6XX_CP_CRASH_SCRIPT_BASE_HI,
+			upper_32_bits(a6xx_capturescript->gpuaddr));
+	kgsl_regwrite(device, A6XX_CP_CRASH_DUMP_CNTL, 1);
+
+	timeout = ktime_add_ms(ktime_get(), CP_CRASH_DUMPER_TIMEOUT);
+
+	if (!device->snapshot_atomic)
+		might_sleep();
+
+	for (;;) {
+		/* make sure we're reading the latest value */
+		rmb();
+		if ((*a6xx_cd_reg_end) != 0xaaaaaaaa)
+			break;
+
+		if (ktime_compare(ktime_get(), timeout) > 0)
+			break;
+
+		/* Wait 1msec to avoid unnecessary looping */
+		if (!device->snapshot_atomic)
+			usleep_range(100, 1000);
+	}
+
+	kgsl_regread(device, A6XX_CP_CRASH_DUMP_STATUS, &val);
+
+	if (!ADRENO_FEATURE(ADRENO_DEVICE(device), ADRENO_APRIV))
+		kgsl_regwrite(device, A6XX_CP_MISC_CNTL, 0);
+
+	if (!(val & 0x2)) {
+		dev_err(device->dev, "Crash dump timed out: 0x%X\n", val);
+		return;
+	}
+
+	crash_dump_valid = true;
+}
+
+static size_t a6xx_snapshot_isense_registers(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_regs *header = (struct kgsl_snapshot_regs *)buf;
+	struct kgsl_snapshot_registers *regs = priv;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	int count = 0, j, k;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	/* Figure out how many registers we are going to dump */
+
+	for (j = 0; j < regs->count; j++) {
+		int start = regs->regs[j * 2];
+		int end = regs->regs[j * 2 + 1];
+
+		count += (end - start + 1);
+	}
+
+	if (remain < (count * 8) + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "ISENSE REGISTERS");
+		return 0;
+	}
+
+	for (j = 0; j < regs->count; j++) {
+		unsigned int start = regs->regs[j * 2];
+		unsigned int end = regs->regs[j * 2 + 1];
+
+		for (k = start; k <= end; k++) {
+			unsigned int val;
+
+			adreno_isense_regread(adreno_dev,
+				k - (adreno_dev->isense_base >> 2), &val);
+			*data++ = k;
+			*data++ = val;
+		}
+	}
+
+	header->count = count;
+
+	/* Return the size of the section */
+	return (count * 8) + sizeof(*header);
+}
+
+/* Snapshot the preemption related buffers */
+static size_t snapshot_preemption_record(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_memdesc *memdesc = priv;
+	struct kgsl_snapshot_gpu_object_v2 *header =
+		(struct kgsl_snapshot_gpu_object_v2 *)buf;
+	u8 *ptr = buf + sizeof(*header);
+	const struct adreno_a6xx_core *gpucore = to_a6xx_core(ADRENO_DEVICE(device));
+	u64 ctxt_record_size = A6XX_CP_CTXRECORD_SIZE_IN_BYTES;
+
+	if (gpucore->ctxt_record_size)
+		ctxt_record_size = gpucore->ctxt_record_size;
+
+	ctxt_record_size = min_t(u64, ctxt_record_size, device->snapshot_ctxt_record_size);
+
+	if (remain < (ctxt_record_size + sizeof(*header))) {
+		SNAPSHOT_ERR_NOMEM(device, "PREEMPTION RECORD");
+		return 0;
+	}
+
+	header->size = ctxt_record_size >> 2;
+	header->gpuaddr = memdesc->gpuaddr;
+	header->ptbase =
+		kgsl_mmu_pagetable_get_ttbr0(device->mmu.defaultpagetable);
+	header->type = SNAPSHOT_GPU_OBJECT_GLOBAL;
+
+	memcpy(ptr, memdesc->hostptr, ctxt_record_size);
+
+	return ctxt_record_size + sizeof(*header);
+}
+
+static size_t a6xx_snapshot_cp_roq(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *) buf;
+	u32 size, *data = (u32 *) (buf + sizeof(*header));
+	int i;
+
+	kgsl_regread(device, A6XX_CP_ROQ_THRESHOLDS_2, &size);
+	size >>= 14;
+
+	if (remain < DEBUG_SECTION_SZ(size)) {
+		SNAPSHOT_ERR_NOMEM(device, "CP ROQ DEBUG");
+		return 0;
+	}
+
+	header->type = SNAPSHOT_DEBUG_CP_ROQ;
+	header->size = size;
+
+	kgsl_regwrite(device, A6XX_CP_ROQ_DBG_ADDR, 0x0);
+	for (i = 0; i < size; i++)
+		kgsl_regread(device, A6XX_CP_ROQ_DBG_DATA, &data[i]);
+
+	return DEBUG_SECTION_SZ(size);
+}
+
+static inline bool a6xx_has_gbif_reinit(struct adreno_device *adreno_dev)
+{
+	/*
+	 * Some targets in a6xx do not have reinit support in hardware.
+	 * This check is only for hardware capability and not for finding
+	 * whether gbif reinit sequence in software is enabled or not.
+	 */
+	return !(adreno_is_a630(adreno_dev) || adreno_is_a615_family(adreno_dev) ||
+		 adreno_is_a640_family(adreno_dev));
+}
+
+/*
+ * a6xx_snapshot() - A6XX GPU snapshot function
+ * @adreno_dev: Device being snapshotted
+ * @snapshot: Pointer to the snapshot instance
+ *
+ * This is where all of the A6XX specific bits and pieces are grabbed
+ * into the snapshot memory
+ */
+void a6xx_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb;
+	bool sptprac_on;
+	unsigned int i;
+	u32 hi, lo;
+
+	/*
+	 * Dump debugbus data here to capture it for both
+	 * GMU and GPU snapshot. Debugbus data can be accessed
+	 * even if the gx headswitch or sptprac is off. If gx
+	 * headswitch is off, data for gx blocks will show as
+	 * 0x5c00bd00.
+	 */
+	a6xx_snapshot_debugbus(adreno_dev, snapshot);
+
+	/* RSCC registers are on cx */
+	if (adreno_is_a650_family(adreno_dev)) {
+		struct kgsl_snapshot_registers r;
+
+		r.regs = a650_isense_registers;
+		r.count = ARRAY_SIZE(a650_isense_registers) / 2;
+
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS,
+			snapshot, a6xx_snapshot_isense_registers, &r);
+	}
+
+	if (!gmu_core_isenabled(device)) {
+		if (adreno_is_a619_holi(adreno_dev))
+			adreno_snapshot_registers(device, snapshot,
+					a6xx_holi_gmu_wrapper_registers,
+					ARRAY_SIZE(a6xx_holi_gmu_wrapper_registers) / 2);
+		else
+			adreno_snapshot_registers(device, snapshot,
+					a6xx_gmu_wrapper_registers,
+					ARRAY_SIZE(a6xx_gmu_wrapper_registers) / 2);
+	}
+
+	sptprac_on = a6xx_gmu_sptprac_is_on(adreno_dev);
+
+	if (!adreno_gx_is_on(adreno_dev))
+		return;
+
+	kgsl_regread(device, A6XX_CP_IB1_BASE, &lo);
+	kgsl_regread(device, A6XX_CP_IB1_BASE_HI, &hi);
+
+	snapshot->ib1base = (((u64) hi) << 32) | lo;
+
+	kgsl_regread(device, A6XX_CP_IB2_BASE, &lo);
+	kgsl_regread(device, A6XX_CP_IB2_BASE_HI, &hi);
+
+	snapshot->ib2base = (((u64) hi) << 32) | lo;
+
+	kgsl_regread(device, A6XX_CP_IB1_REM_SIZE, &snapshot->ib1size);
+	kgsl_regread(device, A6XX_CP_IB2_REM_SIZE, &snapshot->ib2size);
+
+	/* Assert the isStatic bit before triggering snapshot */
+	if (adreno_is_a660(adreno_dev))
+		kgsl_regwrite(device, A6XX_RBBM_SNAPSHOT_STATUS, 0x1);
+
+	/* Dump the registers which get affected by crash dumper trigger */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS,
+		snapshot, a6xx_snapshot_pre_crashdump_regs, NULL);
+
+	/* Dump vbif registers as well which get affected by crash dumper */
+	if (adreno_is_a630(adreno_dev))
+		SNAPSHOT_REGISTERS(device, snapshot, a6xx_vbif_registers);
+	else if (a6xx_has_gbif_reinit(adreno_dev))
+		adreno_snapshot_registers(device, snapshot,
+					  a6xx_gbif_reinit_registers,
+					  ARRAY_SIZE(a6xx_gbif_reinit_registers) / 2);
+	else
+		adreno_snapshot_registers(device, snapshot,
+			a6xx_gbif_registers,
+			ARRAY_SIZE(a6xx_gbif_registers) / 2);
+
+	/* Try to run the crash dumper */
+	if (sptprac_on)
+		_a6xx_do_crashdump(device);
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_reg_list); i++) {
+		/* Skip registers that dont exists on targets other than A660 */
+		if (!adreno_is_a660(adreno_dev) &&
+				(a6xx_reg_list[i].regs == a660_registers))
+			continue;
+
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS,
+			snapshot, a6xx_snapshot_registers, &a6xx_reg_list[i]);
+	}
+
+	/* CP_SQE indexed registers */
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A6XX_CP_SQE_STAT_ADDR, A6XX_CP_SQE_STAT_DATA, 0, 0x33);
+
+	/* CP_DRAW_STATE */
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A6XX_CP_DRAW_STATE_ADDR, A6XX_CP_DRAW_STATE_DATA,
+		0, 0x100);
+
+	 /* SQE_UCODE Cache */
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		A6XX_CP_SQE_UCODE_DBG_ADDR, A6XX_CP_SQE_UCODE_DBG_DATA,
+		0, 0x8000);
+
+	/* CP LPAC indexed registers */
+	if (adreno_is_a660(adreno_dev)) {
+		u32 roq_size;
+
+		kgsl_snapshot_indexed_registers(device, snapshot,
+			 A6XX_CP_SQE_AC_STAT_ADDR, A6XX_CP_SQE_AC_STAT_DATA,
+				0, 0x33);
+		kgsl_snapshot_indexed_registers(device, snapshot,
+			A6XX_CP_LPAC_DRAW_STATE_ADDR,
+				A6XX_CP_LPAC_DRAW_STATE_DATA, 0, 0x100);
+		kgsl_snapshot_indexed_registers(device, snapshot,
+			A6XX_CP_SQE_AC_UCODE_DBG_ADDR,
+				A6XX_CP_SQE_AC_UCODE_DBG_DATA, 0, 0x8000);
+
+		kgsl_regread(device, A6XX_CP_LPAC_ROQ_THRESHOLDS_2, &roq_size);
+		roq_size = roq_size >> 14;
+		kgsl_snapshot_indexed_registers(device, snapshot,
+			A6XX_CP_LPAC_ROQ_DBG_ADDR,
+				A6XX_CP_LPAC_ROQ_DBG_DATA, 0, roq_size);
+
+		kgsl_snapshot_indexed_registers(device, snapshot,
+			A6XX_CP_LPAC_FIFO_DBG_ADDR, A6XX_CP_LPAC_FIFO_DBG_DATA,
+			0, 0x40);
+	}
+	/*
+	 * CP ROQ dump units is 4dwords. The number of units is stored
+	 * in CP_ROQ_THRESHOLDS_2[31:16]. Read the value and convert to
+	 * dword units.
+	 */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a6xx_snapshot_cp_roq, NULL);
+
+	/* SQE Firmware */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, a6xx_snapshot_sqe, NULL);
+
+	/* Mempool debug data */
+	if (adreno_is_a650_family(adreno_dev))
+		a650_snapshot_mempool(device, snapshot);
+	else
+		a6xx_snapshot_mempool(device, snapshot);
+
+	if (sptprac_on) {
+		/* MVC register section */
+		a6xx_snapshot_mvc_regs(device, snapshot);
+
+		/* registers dumped through DBG AHB */
+		a6xx_snapshot_dbgahb_regs(device, snapshot);
+
+		/* Shader memory */
+		a6xx_snapshot_shader(device, snapshot);
+
+		if (!a6xx_is_smmu_stalled(device))
+			memset(a6xx_crashdump_registers->hostptr, 0xaa,
+					a6xx_crashdump_registers->size);
+	}
+
+	if (adreno_is_a660(adreno_dev)) {
+		u32 val;
+
+		kgsl_regread(device, A6XX_RBBM_SNAPSHOT_STATUS, &val);
+
+		if (!val)
+			dev_err(device->dev,
+				"Interface signals may have changed during snapshot\n");
+
+		kgsl_regwrite(device, A6XX_RBBM_SNAPSHOT_STATUS, 0x0);
+	}
+
+	/* Preemption record */
+	if (adreno_is_preemption_enabled(adreno_dev)) {
+		FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, snapshot_preemption_record,
+				rb->preemption_desc);
+		}
+	}
+}
+
+static int _a6xx_crashdump_init_mvc(struct adreno_device *adreno_dev,
+	uint64_t *ptr, uint64_t *offset)
+{
+	int qwords = 0;
+	unsigned int i, j, k;
+	unsigned int count;
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_clusters); i++) {
+		struct a6xx_cluster_registers *cluster = &a6xx_clusters[i];
+
+		/* Skip registers that dont exists on targets other than A660 */
+		if (!adreno_is_a660(adreno_dev) &&
+				(cluster->regs == a660_fe_cluster))
+			continue;
+
+		/* The VPC registers are driven by VPC_PS cluster on a650 */
+		if (adreno_is_a650_family(adreno_dev) &&
+				(cluster->regs == a6xx_vpc_ps_cluster))
+			cluster->id = CP_CLUSTER_VPC_PS;
+
+		if (cluster->sel) {
+			ptr[qwords++] = cluster->sel->val;
+			ptr[qwords++] = ((uint64_t)cluster->sel->cd_reg << 44) |
+				(1 << 21) | 1;
+		}
+
+		cluster->offset0 = *offset;
+		for (j = 0; j < A6XX_NUM_CTXTS; j++) {
+
+			if (j == 1)
+				cluster->offset1 = *offset;
+
+			ptr[qwords++] = (cluster->id << 8) | (j << 4) | j;
+			ptr[qwords++] =
+				((uint64_t)A6XX_CP_APERTURE_CNTL_CD << 44) |
+				(1 << 21) | 1;
+
+			for (k = 0; k < cluster->num_sets; k++) {
+				count = REG_PAIR_COUNT(cluster->regs, k);
+				ptr[qwords++] =
+				a6xx_crashdump_registers->gpuaddr + *offset;
+				ptr[qwords++] =
+				(((uint64_t)cluster->regs[2 * k]) << 44) |
+						count;
+
+				*offset += count * sizeof(unsigned int);
+			}
+		}
+	}
+
+	return qwords;
+}
+
+static int _a6xx_crashdump_init_shader(struct a6xx_shader_block *block,
+		uint64_t *ptr, uint64_t *offset)
+{
+	int qwords = 0;
+	unsigned int j;
+
+	/* Capture each bank in the block */
+	for (j = 0; j < A6XX_NUM_SHADER_BANKS; j++) {
+		/* Program the aperture */
+		ptr[qwords++] =
+			(block->statetype << A6XX_SHADER_STATETYPE_SHIFT) | j;
+		ptr[qwords++] = (((uint64_t) A6XX_HLSQ_DBG_READ_SEL << 44)) |
+			(1 << 21) | 1;
+
+		/* Read all the data in one chunk */
+		ptr[qwords++] = a6xx_crashdump_registers->gpuaddr + *offset;
+		ptr[qwords++] =
+			(((uint64_t) A6XX_HLSQ_DBG_AHB_READ_APERTURE << 44)) |
+			block->sz;
+
+		/* Remember the offset of the first bank for easy access */
+		if (j == 0)
+			block->offset = *offset;
+
+		*offset += block->sz * sizeof(unsigned int);
+	}
+
+	return qwords;
+}
+
+static int _a6xx_crashdump_init_ctx_dbgahb(uint64_t *ptr, uint64_t *offset)
+{
+	int qwords = 0;
+	unsigned int i, j, k;
+	unsigned int count;
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_dbgahb_ctx_clusters); i++) {
+		struct a6xx_cluster_dbgahb_registers *cluster =
+				&a6xx_dbgahb_ctx_clusters[i];
+
+		cluster->offset0 = *offset;
+
+		for (j = 0; j < A6XX_NUM_CTXTS; j++) {
+			if (j == 1)
+				cluster->offset1 = *offset;
+
+			/* Program the aperture */
+			ptr[qwords++] =
+				((cluster->statetype + j * 2) & 0xff) << 8;
+			ptr[qwords++] =
+				(((uint64_t)A6XX_HLSQ_DBG_READ_SEL << 44)) |
+					(1 << 21) | 1;
+
+			for (k = 0; k < cluster->num_sets; k++) {
+				unsigned int start = cluster->regs[2 * k];
+
+				count = REG_PAIR_COUNT(cluster->regs, k);
+				ptr[qwords++] =
+				a6xx_crashdump_registers->gpuaddr + *offset;
+				ptr[qwords++] =
+				(((uint64_t)(A6XX_HLSQ_DBG_AHB_READ_APERTURE +
+					start - cluster->regbase / 4) << 44)) |
+							count;
+
+				*offset += count * sizeof(unsigned int);
+			}
+		}
+	}
+	return qwords;
+}
+
+static int _a6xx_crashdump_init_non_ctx_dbgahb(uint64_t *ptr, uint64_t *offset)
+{
+	int qwords = 0;
+	unsigned int i, k;
+	unsigned int count;
+
+	for (i = 0; i < ARRAY_SIZE(a6xx_non_ctx_dbgahb); i++) {
+		struct a6xx_non_ctx_dbgahb_registers *regs =
+				&a6xx_non_ctx_dbgahb[i];
+
+		regs->offset = *offset;
+
+		/* Program the aperture */
+		ptr[qwords++] = (regs->statetype & 0xff) << 8;
+		ptr[qwords++] =	(((uint64_t)A6XX_HLSQ_DBG_READ_SEL << 44)) |
+					(1 << 21) | 1;
+
+		for (k = 0; k < regs->num_sets; k++) {
+			unsigned int start = regs->regs[2 * k];
+
+			count = REG_PAIR_COUNT(regs->regs, k);
+			ptr[qwords++] =
+				a6xx_crashdump_registers->gpuaddr + *offset;
+			ptr[qwords++] =
+				(((uint64_t)(A6XX_HLSQ_DBG_AHB_READ_APERTURE +
+					start - regs->regbase / 4) << 44)) |
+							count;
+
+			*offset += count * sizeof(unsigned int);
+		}
+	}
+	return qwords;
+}
+
+void a6xx_crashdump_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int script_size = 0;
+	unsigned int data_size = 0;
+	unsigned int i, j, k, ret;
+	uint64_t *ptr;
+	uint64_t offset = 0;
+
+	if (!IS_ERR_OR_NULL(a6xx_capturescript) &&
+		!IS_ERR_OR_NULL(a6xx_crashdump_registers))
+		return;
+
+	/*
+	 * We need to allocate two buffers:
+	 * 1 - the buffer to hold the draw script
+	 * 2 - the buffer to hold the data
+	 */
+
+	/*
+	 * To save the registers, we need 16 bytes per register pair for the
+	 * script and a dword for each register in the data
+	 */
+	for (i = 0; i < ARRAY_SIZE(a6xx_reg_list); i++) {
+		struct reg_list *regs = &a6xx_reg_list[i];
+
+		/* Skip registers that dont exists on targets other than A660 */
+		if (!adreno_is_a660(adreno_dev) &&
+			(regs->regs == a660_registers))
+			continue;
+
+		/* 16 bytes for programming the aperture */
+		if (regs->sel)
+			script_size += 16;
+
+		/* Each pair needs 16 bytes (2 qwords) */
+		script_size += regs->count * 16;
+
+		/* Each register needs a dword in the data */
+		for (j = 0; j < regs->count; j++)
+			data_size += REG_PAIR_COUNT(regs->regs, j) *
+				sizeof(unsigned int);
+
+	}
+
+	/*
+	 * To save the shader blocks for each block in each type we need 32
+	 * bytes for the script (16 bytes to program the aperture and 16 to
+	 * read the data) and then a block specific number of bytes to hold
+	 * the data
+	 */
+	for (i = 0; i < ARRAY_SIZE(a6xx_shader_blocks); i++) {
+		script_size += 32 * A6XX_NUM_SHADER_BANKS;
+		data_size += a6xx_shader_blocks[i].sz * sizeof(unsigned int) *
+			A6XX_NUM_SHADER_BANKS;
+	}
+
+	/* Calculate the script and data size for MVC registers */
+	for (i = 0; i < ARRAY_SIZE(a6xx_clusters); i++) {
+		struct a6xx_cluster_registers *cluster = &a6xx_clusters[i];
+
+		/* Skip registers that dont exists on targets other than A660 */
+		if (!adreno_is_a660(adreno_dev) &&
+				(cluster->regs == a660_fe_cluster))
+			continue;
+
+		/* 16 bytes if cluster sel exists */
+		if (cluster->sel)
+			script_size += 16;
+
+		for (j = 0; j < A6XX_NUM_CTXTS; j++) {
+
+			/* 16 bytes for programming the aperture */
+			script_size += 16;
+
+			/* Reading each pair of registers takes 16 bytes */
+			script_size += 16 * cluster->num_sets;
+
+			/* A dword per register read from the cluster list */
+			for (k = 0; k < cluster->num_sets; k++)
+				data_size += REG_PAIR_COUNT(cluster->regs, k) *
+						sizeof(unsigned int);
+		}
+	}
+
+	/* Calculate the script and data size for debug AHB registers */
+	for (i = 0; i < ARRAY_SIZE(a6xx_dbgahb_ctx_clusters); i++) {
+		struct a6xx_cluster_dbgahb_registers *cluster =
+				&a6xx_dbgahb_ctx_clusters[i];
+
+		for (j = 0; j < A6XX_NUM_CTXTS; j++) {
+
+			/* 16 bytes for programming the aperture */
+			script_size += 16;
+
+			/* Reading each pair of registers takes 16 bytes */
+			script_size += 16 * cluster->num_sets;
+
+			/* A dword per register read from the cluster list */
+			for (k = 0; k < cluster->num_sets; k++)
+				data_size += REG_PAIR_COUNT(cluster->regs, k) *
+						sizeof(unsigned int);
+		}
+	}
+
+	/*
+	 * Calculate the script and data size for non context debug
+	 * AHB registers
+	 */
+	for (i = 0; i < ARRAY_SIZE(a6xx_non_ctx_dbgahb); i++) {
+		struct a6xx_non_ctx_dbgahb_registers *regs =
+				&a6xx_non_ctx_dbgahb[i];
+
+		/* 16 bytes for programming the aperture */
+		script_size += 16;
+
+		/* Reading each pair of registers takes 16 bytes */
+		script_size += 16 * regs->num_sets;
+
+		/* A dword per register read from the cluster list */
+		for (k = 0; k < regs->num_sets; k++)
+			data_size += REG_PAIR_COUNT(regs->regs, k) *
+				sizeof(unsigned int);
+	}
+
+	/* 16 bytes (2 qwords) for last entry in CD script */
+	script_size += 16;
+	/* Increment data size to store last entry in CD */
+	data_size += sizeof(unsigned int);
+
+	/* Now allocate the script and data buffers */
+
+	/* The script buffers needs 2 extra qwords on the end */
+	ret = adreno_allocate_global(device, &a6xx_capturescript,
+		script_size + 16, 0, KGSL_MEMFLAGS_GPUREADONLY,
+		KGSL_MEMDESC_PRIVILEGED, "capturescript");
+	if (ret)
+		return;
+
+	ret = adreno_allocate_global(device, &a6xx_crashdump_registers,
+		data_size, 0, 0, KGSL_MEMDESC_PRIVILEGED,
+		"capturescript_regs");
+	if (ret)
+		return;
+
+	/* Build the crash script */
+
+	ptr = (uint64_t *)a6xx_capturescript->hostptr;
+
+	/* For the registers, program a read command for each pair */
+	for (i = 0; i < ARRAY_SIZE(a6xx_reg_list); i++) {
+		struct reg_list *regs = &a6xx_reg_list[i];
+
+		/* Skip registers that dont exists on targets other than A660 */
+		if (!adreno_is_a660(adreno_dev) &&
+			(regs->regs == a660_registers))
+			continue;
+
+		regs->offset = offset;
+
+		/* Program the SEL_CNTL_CD register appropriately */
+		if (regs->sel) {
+			*ptr++ = regs->sel->val;
+			*ptr++ = (((uint64_t)regs->sel->cd_reg << 44)) |
+					(1 << 21) | 1;
+		}
+
+		for (j = 0; j < regs->count; j++) {
+			unsigned int r = REG_PAIR_COUNT(regs->regs, j);
+			*ptr++ = a6xx_crashdump_registers->gpuaddr + offset;
+			*ptr++ = (((uint64_t) regs->regs[2 * j]) << 44) | r;
+			offset += r * sizeof(unsigned int);
+		}
+	}
+
+	/* Program each shader block */
+	for (i = 0; i < ARRAY_SIZE(a6xx_shader_blocks); i++) {
+		ptr += _a6xx_crashdump_init_shader(&a6xx_shader_blocks[i], ptr,
+							&offset);
+	}
+
+	/* Program the capturescript for the MVC regsiters */
+	ptr += _a6xx_crashdump_init_mvc(adreno_dev, ptr, &offset);
+
+	if (!adreno_is_a663(adreno_dev)) {
+		ptr += _a6xx_crashdump_init_ctx_dbgahb(ptr, &offset);
+
+		ptr += _a6xx_crashdump_init_non_ctx_dbgahb(ptr, &offset);
+	}
+
+	/* Save CD register end pointer to check CD status completion */
+	a6xx_cd_reg_end = a6xx_crashdump_registers->hostptr + offset;
+
+	memset(a6xx_crashdump_registers->hostptr, 0xaa,
+			a6xx_crashdump_registers->size);
+
+	/* Program the capturescript to read the last register entry */
+	*ptr++ = a6xx_crashdump_registers->gpuaddr + offset;
+	*ptr++ = (((uint64_t) A6XX_CP_CRASH_DUMP_STATUS) << 44) | (uint64_t) 1;
+
+	*ptr++ = 0;
+	*ptr++ = 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_compat.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_compat.c
@@ -0,0 +1,193 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_compat.h"
+#include "kgsl_compat.h"
+
+int adreno_getproperty_compat(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	int status = -EINVAL;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	switch (param->type) {
+	case KGSL_PROP_DEVICE_INFO:
+		{
+			struct kgsl_devinfo_compat devinfo;
+
+			if (param->sizebytes != sizeof(devinfo)) {
+				status = -EINVAL;
+				break;
+			}
+
+			memset(&devinfo, 0, sizeof(devinfo));
+			devinfo.device_id = device->id + 1;
+			devinfo.chip_id = adreno_dev->chipid;
+			devinfo.mmu_enabled =
+				kgsl_mmu_has_feature(device, KGSL_MMU_PAGED);
+			devinfo.gmem_gpubaseaddr = 0;
+			devinfo.gmem_sizebytes =
+					adreno_dev->gpucore->gmem_size;
+
+			if (copy_to_user(param->value, &devinfo,
+				sizeof(devinfo))) {
+				status = -EFAULT;
+				break;
+			}
+			status = 0;
+		}
+		break;
+	case KGSL_PROP_DEVICE_SHADOW:
+		{
+			struct kgsl_shadowprop_compat shadowprop;
+
+			if (param->sizebytes != sizeof(shadowprop)) {
+				status = -EINVAL;
+				break;
+			}
+			memset(&shadowprop, 0, sizeof(shadowprop));
+			if (device->memstore->hostptr) {
+				/* Give a token address to identify memstore */
+				shadowprop.gpuaddr = (unsigned int)
+					KGSL_MEMSTORE_TOKEN_ADDRESS;
+				shadowprop.size =
+					(unsigned int) device->memstore->size;
+				/*
+				 * GSL needs this to be set, even if it
+				 * appears to be meaningless
+				 */
+				shadowprop.flags = KGSL_FLAGS_INITIALIZED |
+					KGSL_FLAGS_PER_CONTEXT_TIMESTAMPS;
+			}
+			if (copy_to_user(param->value, &shadowprop,
+				sizeof(shadowprop))) {
+				status = -EFAULT;
+				break;
+			}
+			status = 0;
+		}
+		break;
+	default:
+		status = device->ftbl->getproperty(device, param);
+	}
+
+	return status;
+}
+
+int adreno_setproperty_compat(struct kgsl_device_private *dev_priv,
+				unsigned int type,
+				void __user *value,
+				unsigned int sizebytes)
+{
+	int status = -EINVAL;
+	struct kgsl_device *device = dev_priv->device;
+
+	switch (type) {
+	case KGSL_PROP_PWR_CONSTRAINT:
+	case KGSL_PROP_L3_PWR_CONSTRAINT: {
+			struct kgsl_device_constraint_compat constraint32;
+			struct kgsl_device_constraint constraint;
+			struct kgsl_context *context;
+
+			if (sizebytes != sizeof(constraint32))
+				break;
+
+			if (copy_from_user(&constraint32, value,
+				sizeof(constraint32))) {
+				status = -EFAULT;
+				break;
+			}
+
+			/* Populate the real constraint type from the compat */
+			constraint.type = constraint32.type;
+			constraint.context_id = constraint32.context_id;
+			constraint.data = compat_ptr(constraint32.data);
+			constraint.size = (size_t)constraint32.size;
+
+			context = kgsl_context_get_owner(dev_priv,
+							constraint.context_id);
+			if (context == NULL)
+				break;
+			status = adreno_set_constraint(device, context,
+								&constraint);
+			kgsl_context_put(context);
+		}
+		break;
+	default:
+		/*
+		 * Call adreno_setproperty in case the property type was
+		 * KGSL_PROP_PWRCTRL
+		 */
+		status = device->ftbl->setproperty(dev_priv, type, value,
+						sizebytes);
+	}
+
+	return status;
+}
+
+static long adreno_ioctl_perfcounter_query_compat(
+		struct kgsl_device_private *dev_priv, unsigned int cmd,
+		void *data)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_priv->device);
+	struct kgsl_perfcounter_query_compat *query32 = data;
+	struct kgsl_perfcounter_query query;
+	long result;
+
+	query.groupid = query32->groupid;
+	query.countables = compat_ptr(query32->countables);
+	query.count = query32->count;
+	query.max_counters = query32->max_counters;
+
+	result = adreno_perfcounter_query_group(adreno_dev,
+		query.groupid, query.countables,
+		query.count, &query.max_counters);
+	query32->max_counters = query.max_counters;
+
+	return result;
+}
+
+static long adreno_ioctl_perfcounter_read_compat(
+		struct kgsl_device_private *dev_priv, unsigned int cmd,
+		void *data)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_priv->device);
+	struct kgsl_perfcounter_read_compat *read32 = data;
+	struct kgsl_perfcounter_read read;
+
+	/*
+	 * When performance counter zapping is enabled, the counters are cleared
+	 * across context switches. Reading the counters when they are zapped is
+	 * not permitted.
+	 */
+	if (!adreno_dev->perfcounter)
+		return -EPERM;
+
+	read.reads = (struct kgsl_perfcounter_read_group __user *)
+		(uintptr_t)read32->reads;
+	read.count = read32->count;
+
+	return adreno_perfcounter_read_group(adreno_dev, read.reads,
+		read.count);
+}
+
+static struct kgsl_ioctl adreno_compat_ioctl_funcs[] = {
+	{ IOCTL_KGSL_PERFCOUNTER_GET, adreno_ioctl_perfcounter_get },
+	{ IOCTL_KGSL_PERFCOUNTER_PUT, adreno_ioctl_perfcounter_put },
+	{ IOCTL_KGSL_PERFCOUNTER_QUERY_COMPAT,
+		adreno_ioctl_perfcounter_query_compat },
+	{ IOCTL_KGSL_PERFCOUNTER_READ_COMPAT,
+		adreno_ioctl_perfcounter_read_compat },
+};
+
+long adreno_compat_ioctl(struct kgsl_device_private *dev_priv,
+			      unsigned int cmd, unsigned long arg)
+{
+	return adreno_ioctl_helper(dev_priv, cmd, arg,
+		adreno_compat_ioctl_funcs,
+		ARRAY_SIZE(adreno_compat_ioctl_funcs));
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_compat.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_compat.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2013-2015, 2017, 2019 The Linux Foundation. All rights reserved.
+ */
+#ifndef __ADRENO_COMPAT_H
+#define __ADRENO_COMPAT_H
+
+#ifdef CONFIG_COMPAT
+
+struct kgsl_device;
+struct kgsl_device_private;
+
+int adreno_getproperty_compat(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param);
+
+int adreno_setproperty_compat(struct kgsl_device_private *dev_priv,
+				unsigned int type,
+				void __user *value,
+				unsigned int sizebytes);
+
+long adreno_compat_ioctl(struct kgsl_device_private *dev_priv,
+			unsigned int cmd, unsigned long arg);
+
+#else
+
+static inline int adreno_getproperty_compat(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param)
+{
+	return -EINVAL;
+}
+
+static inline int adreno_setproperty_compat(struct kgsl_device_private
+				*dev_priv, unsigned int type,
+				void __user *value, unsigned int sizebytes)
+{
+	return -EINVAL;
+}
+
+static inline long adreno_compat_ioctl(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, unsigned long arg)
+{
+	return -EINVAL;
+}
+
+#endif /* CONFIG_COMPAT */
+#endif /* __ADRENO_COMPAT_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_coresight.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_coresight.c
@@ -0,0 +1,338 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/of_platform.h>
+
+#include "adreno.h"
+
+#define TO_ADRENO_CORESIGHT_ATTR(_attr) \
+	container_of(_attr, struct adreno_coresight_attr, attr)
+
+ssize_t adreno_coresight_show_register(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct adreno_coresight_device *adreno_csdev = dev_get_drvdata(dev);
+	struct adreno_coresight_attr *cattr = TO_ADRENO_CORESIGHT_ATTR(attr);
+	struct kgsl_device *device = adreno_csdev->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	unsigned int val = 0;
+
+	mutex_lock(&device->mutex);
+	/*
+	 * Return the current value of the register if coresight is enabled,
+	 * otherwise report 0
+	 */
+
+	if (!adreno_csdev->enabled)
+		goto out;
+
+	if (!adreno_active_count_get(adreno_dev)) {
+		kgsl_regread(device, cattr->reg->offset, &cattr->reg->value);
+		adreno_active_count_put(adreno_dev);
+	}
+	val = cattr->reg->value;
+
+out:
+	mutex_unlock(&device->mutex);
+	return scnprintf(buf, PAGE_SIZE, "0x%X\n", val);
+}
+
+ssize_t adreno_coresight_store_register(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size)
+{
+
+	struct adreno_coresight_attr *cattr = TO_ADRENO_CORESIGHT_ATTR(attr);
+	struct adreno_coresight_device *adreno_csdev = dev_get_drvdata(dev);
+	struct kgsl_device *device = adreno_csdev->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	unsigned long val;
+	int ret;
+
+	ret = kstrtoul(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	mutex_lock(&device->mutex);
+
+	/* Ignore writes while coresight is off */
+	if (!adreno_csdev->enabled)
+		goto out;
+
+	cattr->reg->value = val;
+	if (!adreno_active_count_get(adreno_dev)) {
+		kgsl_regwrite(device, cattr->reg->offset, cattr->reg->value);
+		adreno_active_count_put(adreno_dev);
+	}
+
+out:
+	mutex_unlock(&device->mutex);
+	return size;
+}
+
+/*
+ * This is a generic function to disable coresight debug bus on Adreno
+ * devices. This function in turn calls the device specific function
+ * through the gpudev hook.
+ */
+static void adreno_coresight_disable(struct coresight_device *csdev,
+					struct perf_event *event)
+{
+	struct adreno_coresight_device *adreno_csdev = dev_get_drvdata(&csdev->dev);
+	struct kgsl_device *device = adreno_csdev->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_coresight *coresight = adreno_csdev->coresight;
+	int i;
+
+	mutex_lock(&device->mutex);
+
+	if (!adreno_csdev->enabled) {
+		mutex_unlock(&device->mutex);
+		return;
+	}
+
+	if (!adreno_active_count_get(adreno_dev)) {
+		for (i = 0; i < coresight->count; i++)
+			kgsl_regwrite(device,
+				coresight->registers[i].offset, 0);
+		adreno_active_count_put(adreno_dev);
+	}
+
+	adreno_csdev->enabled = false;
+
+	mutex_unlock(&device->mutex);
+}
+
+static void _adreno_coresight_get_and_clear(struct adreno_device *adreno_dev,
+		struct adreno_coresight_device *adreno_csdev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_coresight *coresight = adreno_csdev->coresight;
+	int i;
+
+	if (IS_ERR_OR_NULL(adreno_csdev->dev) || !adreno_csdev->enabled)
+		return;
+
+	kgsl_pre_hwaccess(device);
+	/*
+	 * Save the current value of each coresight register
+	 * and then clear each register
+	 */
+	for (i = 0; i < coresight->count; i++) {
+		kgsl_regread(device, coresight->registers[i].offset,
+			&coresight->registers[i].value);
+		kgsl_regwrite(device, coresight->registers[i].offset, 0);
+	}
+}
+
+static void _adreno_coresight_set(struct adreno_device *adreno_dev,
+		struct adreno_coresight_device *adreno_csdev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_coresight *coresight = adreno_csdev->coresight;
+	int i;
+
+	if (IS_ERR_OR_NULL(adreno_csdev->dev) || !adreno_csdev->enabled)
+		return;
+
+	for (i = 0; i < coresight->count; i++)
+		kgsl_regwrite(device, coresight->registers[i].offset,
+			coresight->registers[i].value);
+}
+
+/* Generic function to enable coresight debug bus on adreno devices */
+static int adreno_coresight_enable(struct coresight_device *csdev,
+				struct perf_event *event, u32 mode)
+{
+	struct adreno_coresight_device *adreno_csdev = dev_get_drvdata(&csdev->dev);
+	const struct adreno_coresight *coresight = adreno_csdev->coresight;
+	struct kgsl_device *device = adreno_csdev->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	int ret = 0;
+
+	mutex_lock(&device->mutex);
+	if (!adreno_csdev->enabled) {
+		int i;
+
+		adreno_csdev->enabled = true;
+
+		/* Reset all the debug registers to their default values */
+		for (i = 0; i < coresight->count; i++)
+			coresight->registers[i].value =
+				coresight->registers[i].initial;
+
+		ret = adreno_active_count_get(adreno_dev);
+		if (!ret) {
+			_adreno_coresight_set(adreno_dev, adreno_csdev);
+			adreno_active_count_put(adreno_dev);
+		}
+
+	}
+	mutex_unlock(&device->mutex);
+	return ret;
+}
+
+void adreno_coresight_stop(struct adreno_device *adreno_dev)
+{
+	_adreno_coresight_get_and_clear(adreno_dev, &adreno_dev->gx_coresight);
+	_adreno_coresight_get_and_clear(adreno_dev, &adreno_dev->cx_coresight);
+}
+
+void adreno_coresight_start(struct adreno_device *adreno_dev)
+{
+	_adreno_coresight_set(adreno_dev, &adreno_dev->gx_coresight);
+	_adreno_coresight_set(adreno_dev, &adreno_dev->cx_coresight);
+}
+
+#if (KERNEL_VERSION(6, 3, 0) > LINUX_VERSION_CODE)
+static int adreno_coresight_trace_id(struct coresight_device *csdev)
+{
+	struct adreno_coresight_device *adreno_csdev = dev_get_drvdata(&csdev->dev);
+
+	return adreno_csdev->atid;
+}
+#endif
+
+static const struct coresight_ops_source adreno_coresight_source_ops = {
+#if (KERNEL_VERSION(6, 3, 0) > LINUX_VERSION_CODE)
+	.trace_id = adreno_coresight_trace_id,
+#endif
+	.enable = adreno_coresight_enable,
+	.disable = adreno_coresight_disable,
+};
+
+static const struct coresight_ops adreno_coresight_ops = {
+	.source_ops = &adreno_coresight_source_ops,
+};
+
+void adreno_coresight_remove(struct adreno_device *adreno_dev)
+{
+	if (!IS_ERR_OR_NULL(adreno_dev->gx_coresight.dev))
+		coresight_unregister(adreno_dev->gx_coresight.dev);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->cx_coresight.dev))
+		coresight_unregister(adreno_dev->cx_coresight.dev);
+}
+
+static int funnel_gfx_enable(struct coresight_device *csdev, int inport,
+			 int outport)
+{
+	struct kgsl_device *device = kgsl_get_device(0);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	int ret;
+
+	if (!device)
+		return -ENODEV;
+
+	mutex_lock(&device->mutex);
+
+	ret = adreno_active_count_get(adreno_dev);
+	if (ret)
+		goto err;
+
+	/* Now that GPU is up, Call into coresight driver to enable funnel */
+	ret = adreno_dev->funnel_gfx.funnel_ops->link_ops->enable(csdev, inport, outport);
+
+	adreno_active_count_put(adreno_dev);
+err:
+	mutex_unlock(&device->mutex);
+	return ret;
+}
+
+static void funnel_gfx_disable(struct coresight_device *csdev, int inport,
+			   int outport)
+{
+	struct kgsl_device *device = kgsl_get_device(0);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	int ret;
+
+	if (!device)
+		return;
+
+	mutex_lock(&device->mutex);
+
+	ret = adreno_active_count_get(adreno_dev);
+	if (ret)
+		goto err;
+
+	/* Now that GPU is up, Call into coresight driver to disable funnel */
+	adreno_dev->funnel_gfx.funnel_ops->link_ops->disable(csdev, inport, outport);
+
+	adreno_active_count_put(adreno_dev);
+err:
+	mutex_unlock(&device->mutex);
+	return;
+}
+
+struct coresight_ops_link funnel_link_gfx_ops = {
+	.enable = funnel_gfx_enable,
+	.disable = funnel_gfx_disable,
+};
+
+struct coresight_ops funnel_gfx_ops = {
+	.link_ops = &funnel_link_gfx_ops,
+};
+
+static void adreno_coresight_dev_probe(struct kgsl_device *device,
+		const struct adreno_coresight *coresight,
+		struct adreno_coresight_device *adreno_csdev,
+		struct device_node *node)
+{
+	struct platform_device *pdev = of_find_device_by_node(node);
+	struct coresight_desc desc;
+	u32 atid;
+
+	if (!pdev)
+		return;
+
+	if (of_property_read_u32(node, "coresight-atid", &atid))
+		return;
+
+	if (of_property_read_string(node, "coresight-name", &desc.name))
+		return;
+
+	desc.pdata = coresight_get_platform_data(&pdev->dev);
+	platform_device_put(pdev);
+
+	if (IS_ERR(desc.pdata))
+		return;
+
+	desc.type = CORESIGHT_DEV_TYPE_SOURCE;
+	desc.subtype.source_subtype = CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE;
+	desc.ops = &adreno_coresight_ops;
+	desc.dev = &device->pdev->dev;
+	desc.groups = coresight->groups;
+
+	adreno_csdev->atid = atid;
+	adreno_csdev->device = device;
+	adreno_csdev->dev = coresight_register(&desc);
+
+	adreno_csdev->coresight = coresight;
+
+	if (!IS_ERR_OR_NULL(adreno_csdev->dev))
+		dev_set_drvdata(&adreno_csdev->dev->dev, adreno_csdev);
+}
+
+void adreno_coresight_add_device(struct adreno_device *adreno_dev, const char *name,
+		const struct adreno_coresight *coresight,
+		struct adreno_coresight_device *adreno_csdev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct device_node *node = of_find_compatible_node(device->pdev->dev.of_node, NULL, name);
+	struct adreno_funnel_device *funnel_gfx = &adreno_dev->funnel_gfx;
+
+	if (!node)
+		return;
+
+	/* Set the funnel ops as graphics ops to bring GPU up before enabling funnel */
+	if (funnel_gfx !=NULL && funnel_gfx->funnel_csdev != NULL
+						&& funnel_gfx->funnel_csdev->ops == NULL)
+		funnel_gfx->funnel_csdev->ops = &funnel_gfx_ops;
+
+	adreno_coresight_dev_probe(device, coresight, adreno_csdev, node);
+
+	of_node_put(node);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_coresight.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_coresight.h
@@ -0,0 +1,164 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _ADRENO_CORESIGHT_H_
+#define _ADRENO_CORESIGHT_H_
+
+#include <linux/device.h>
+#include <linux/coresight.h>
+
+struct adreno_device;
+
+/**
+ * struct adreno_coresight_register - Definition for a coresight (tracebus)
+ * debug register
+ */
+struct adreno_coresight_register {
+	/** @offset: Offset of the debug register in the KGSL register space */
+	unsigned int offset;
+	/** @initial: Default value to write when coresight is enabled */
+	unsigned int initial;
+	/**
+	 * @value: Current shadow value of the register (to be reprogrammed
+	 * after power collapse)
+	 */
+	unsigned int value;
+};
+
+/**
+ * struct adreno_coresight_attr - Local attribute struct for coresight sysfs
+ *
+ * files
+ */
+struct adreno_coresight_attr {
+	/** @attr: Base device attribute */
+	struct device_attribute attr;
+	/**
+	 * @reg: Pointer to the &struct adreno_coresight_register definition
+	 * for this register
+	 */
+	struct adreno_coresight_register *reg;
+};
+
+/**
+ * adreno_coresight_show_register - Callback function for sysfs show
+ * @device: Pointer to a device handle
+ * @attr: Pointer to the device attribute
+ * @buf: Contains the output buffer for sysfs
+ *
+ * Callback function to write the value of the register into the sysfs node.
+ * Return: The size of the data written to the buffer or negative on error.
+ */
+ssize_t adreno_coresight_show_register(struct device *device,
+		struct device_attribute *attr, char *buf);
+
+/**
+ * adreno_coresight_show_register - Callback function for sysfs store
+ * @device: Pointer to a device handle
+ * @attr: Pointer to the device attribute
+ * @buf: Contains the input buffer for sysfs
+ * @size: Size of the data stored in buf
+ *
+ * Callback function to read the value of a register from a sysfs node.
+ * Return: The size of the data consumed or negative on error.
+ */
+ssize_t adreno_coresight_store_register(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size);
+
+#define ADRENO_CORESIGHT_ATTR(_attrname, _reg) \
+	struct adreno_coresight_attr coresight_attr_##_attrname  = { \
+		__ATTR(_attrname, 0644, \
+		adreno_coresight_show_register, \
+		adreno_coresight_store_register), \
+		(_reg), }
+
+/**
+ * struct adreno_coresight - GPU specific coresight definition
+ */
+struct adreno_coresight {
+	/**
+	 * @registers: Array of GPU specific registers to configure trace
+	 * bus output
+	 */
+	struct adreno_coresight_register *registers;
+	/** @count: Number of registers in the array */
+	unsigned int count;
+	/** @groups: Pointer to an attribute list of control files */
+	const struct attribute_group **groups;
+};
+
+/**
+ * struct adreno_coresight_device - Container for a coresight instance
+ */
+struct adreno_coresight_device {
+	/** @dev: Pointer to the corsight device */
+	struct coresight_device *dev;
+	/** @coresight: Point to the GPU specific coresight definition */
+	const struct adreno_coresight *coresight;
+	/** @device: Pointer to a GPU device handle */
+	struct kgsl_device *device;
+	/** @enabled: True if the coresight instance is enabled */
+	bool enabled;
+	/** @atid: The unique ATID value of the coresight device */
+	unsigned int atid;
+};
+
+/**
+ * struct adreno_funnel_device - Container for a coresight gfx funnel
+ */
+struct adreno_funnel_device {
+	/** @funnel_dev: Pointer to the gfx funnel device */
+	struct device *funnel_dev;
+	/** @funnel_csdev: Point to the gfx funnel coresight definition */
+	struct coresight_device *funnel_csdev;
+	/** @funnel_ops: Function pointers to enable/disable the coresight funnel */
+	const struct coresight_ops *funnel_ops;
+};
+
+#ifdef CONFIG_QCOM_KGSL_CORESIGHT
+
+void adreno_coresight_add_device(struct adreno_device *adreno_dev,
+		const char *name,
+		const struct adreno_coresight *coresight,
+		struct adreno_coresight_device *adreno_csdev);
+
+/**
+ * adreno_coresight_start - Reprogram coresight registers after power collapse
+ * @adreno_dev: An Adreno GPU device handle
+ *
+ * Reprogram the cached values to the coresight registers on power up.
+ */
+void adreno_coresight_start(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_coresight_stop - Reprogram coresight registers after power collapse
+ * @adreno_dev: An Adreno GPU device handle
+ *
+ * Cache the current coresight register values so they can be restored after
+ * power collapse.
+ */
+void adreno_coresight_stop(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_coresight_remove - Destroy active coresight devices
+ * @adreno_dev: An Adreno GPU device handle
+ *
+ * Destroy any active coresight devices.
+ */
+void adreno_coresight_remove(struct adreno_device *adreno_dev);
+#else
+static inline void adreno_coresight_add_device(struct kgsl_device *device,
+		const char *name,
+		const struct adreno_coresight *coresight,
+		struct adreno_coresight_device *adreno_csdev)
+{
+}
+
+static inline void adreno_coresight_start(struct adreno_device *adreno_dev) { }
+static inline void adreno_coresight_stop(struct adreno_device *adreno_dev) { }
+static inline void adreno_coresight_remove(struct adreno_device *adreno_dev) { }
+#endif
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_cp_parser.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_cp_parser.c
@@ -0,0 +1,1047 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2013-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/slab.h>
+
+#include "adreno.h"
+#include "adreno_cp_parser.h"
+#include "adreno_pm4types.h"
+#include "adreno_snapshot.h"
+
+#define MAX_IB_OBJS 1000
+#define NUM_SET_DRAW_GROUPS 32
+
+struct set_draw_state {
+	uint64_t cmd_stream_addr;
+	uint64_t cmd_stream_dwords;
+};
+
+/* List of variables used when parsing an IB */
+struct ib_parser_variables {
+	/* List of registers containing addresses and their sizes */
+	unsigned int cp_addr_regs[ADRENO_CP_ADDR_MAX];
+	/* 32 groups of command streams in set draw state packets */
+	struct set_draw_state set_draw_groups[NUM_SET_DRAW_GROUPS];
+};
+
+/*
+ * Used for locating shader objects. This array holds the unit size of shader
+ * objects based on type and block of shader. The type can be 0 or 1 hence there
+ * are 2 columns and block can be 0-7 hence 7 rows.
+ */
+static int load_state_unit_sizes[7][2] = {
+	{ 2, 4 },
+	{ 0, 1 },
+	{ 2, 4 },
+	{ 0, 1 },
+	{ 8, 2 },
+	{ 8, 2 },
+	{ 8, 2 },
+};
+
+static int adreno_ib_find_objs(struct kgsl_device *device,
+				struct kgsl_process_private *process,
+				uint64_t gpuaddr, uint64_t dwords,
+				uint64_t ib2base, int obj_type,
+				struct adreno_ib_object_list *ib_obj_list,
+				int ib_level);
+
+static int ib_parse_set_draw_state(struct kgsl_device *device,
+	unsigned int *ptr,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars);
+
+static int ib_parse_type7_set_draw_state(struct kgsl_device *device,
+	unsigned int *ptr,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list);
+
+/*
+ * adreno_ib_merge_range() - Increases the address range tracked by an ib
+ * object
+ * @ib_obj: The ib object
+ * @gpuaddr: The start address which is to be merged
+ * @size: Size of the merging address
+ */
+static void adreno_ib_merge_range(struct adreno_ib_object *ib_obj,
+		uint64_t gpuaddr, uint64_t size)
+{
+	uint64_t addr_end1 = ib_obj->gpuaddr + ib_obj->size;
+	uint64_t addr_end2 = gpuaddr + size;
+
+	if (gpuaddr < ib_obj->gpuaddr)
+		ib_obj->gpuaddr = gpuaddr;
+	if (addr_end2 > addr_end1)
+		ib_obj->size = addr_end2 - ib_obj->gpuaddr;
+	else
+		ib_obj->size = addr_end1 - ib_obj->gpuaddr;
+}
+
+/*
+ * adreno_ib_check_overlap() - Checks if an address range overlap
+ * @gpuaddr: The start address range to check for overlap
+ * @size: Size of the address range
+ * @type: The type of address range
+ * @ib_obj_list: The list of address ranges to check for overlap
+ *
+ * Checks if an address range overlaps with a list of address ranges
+ * Returns the entry from list which overlaps else NULL
+ */
+static struct adreno_ib_object *adreno_ib_check_overlap(uint64_t gpuaddr,
+		uint64_t size, int type,
+		struct adreno_ib_object_list *ib_obj_list)
+{
+	struct adreno_ib_object *ib_obj;
+	int i;
+
+	for (i = 0; i < ib_obj_list->num_objs; i++) {
+		ib_obj = &(ib_obj_list->obj_list[i]);
+		if ((type == ib_obj->snapshot_obj_type) &&
+			kgsl_addr_range_overlap(ib_obj->gpuaddr, ib_obj->size,
+			gpuaddr, size))
+			/* regions overlap */
+			return ib_obj;
+	}
+	return NULL;
+}
+
+/*
+ * adreno_ib_add() - Add a gpuaddress range to list
+ * @process: Process in which the gpuaddress is mapped
+ * @type: The type of address range
+ * @ib_obj_list: List of the address ranges in which the given range is to be
+ * added
+ *
+ * Add a gpuaddress range as an ib object to a given list after checking if it
+ * overlaps with another entry on the list. If it conflicts then change the
+ * existing entry to incorporate this range
+ *
+ * Returns 0 on success else error code
+ */
+static int adreno_ib_add(struct kgsl_process_private *process,
+				uint64_t gpuaddr, int type,
+				struct adreno_ib_object_list *ib_obj_list)
+{
+	uint64_t size;
+	struct adreno_ib_object *ib_obj;
+	struct kgsl_mem_entry *entry;
+
+	if (ib_obj_list->num_objs >= MAX_IB_OBJS)
+		return -E2BIG;
+
+	entry = kgsl_sharedmem_find(process, gpuaddr);
+	if (!entry)
+		/*
+		 * Do not fail if gpuaddr not found, we can continue
+		 * to search for other objects even if few objects are
+		 * not found
+		 */
+		return 0;
+
+	size = entry->memdesc.size;
+	gpuaddr = entry->memdesc.gpuaddr;
+
+	ib_obj = adreno_ib_check_overlap(gpuaddr, size, type, ib_obj_list);
+	if (ib_obj) {
+		adreno_ib_merge_range(ib_obj, gpuaddr, size);
+		kgsl_mem_entry_put(entry);
+	} else {
+		adreno_ib_init_ib_obj(gpuaddr, size, type, entry,
+			&(ib_obj_list->obj_list[ib_obj_list->num_objs]));
+		ib_obj_list->num_objs++;
+		/* Skip reclaim for the memdesc until it is dumped */
+		entry->memdesc.priv |= KGSL_MEMDESC_SKIP_RECLAIM;
+	}
+	return 0;
+}
+
+/*
+ * ib_save_mip_addresses() - Find mip addresses
+ * @pkt: Pointer to the packet in IB
+ * @process: The process in which IB is mapped
+ * @ib_obj_list: List in which any objects found are added
+ *
+ * Returns 0 on success else error code
+ */
+static int ib_save_mip_addresses(unsigned int *pkt,
+		struct kgsl_process_private *process,
+		struct adreno_ib_object_list *ib_obj_list)
+{
+	int ret = 0;
+	int num_levels = (pkt[1] >> 22) & 0x03FF;
+	int i;
+	unsigned int *hostptr;
+	struct kgsl_mem_entry *ent;
+	unsigned int block, type;
+	int unitsize = 0;
+
+	block = (pkt[1] >> 19) & 0x07;
+	type = pkt[2] & 0x03;
+
+	if (type == 0)
+		unitsize = load_state_unit_sizes[block][0];
+	else
+		unitsize = load_state_unit_sizes[block][1];
+
+	if (3 == block && 1 == type) {
+		uint64_t gpuaddr = pkt[2] & 0xFFFFFFFC;
+		uint64_t size = (num_levels * unitsize) << 2;
+
+		ent = kgsl_sharedmem_find(process, gpuaddr);
+		if (ent == NULL)
+			return 0;
+
+		if (!kgsl_gpuaddr_in_memdesc(&ent->memdesc,
+			gpuaddr, size)) {
+			kgsl_mem_entry_put(ent);
+			return 0;
+		}
+
+		hostptr = kgsl_gpuaddr_to_vaddr(&ent->memdesc, gpuaddr);
+		if (hostptr != NULL) {
+			for (i = 0; i < num_levels; i++) {
+				ret = adreno_ib_add(process, hostptr[i],
+					SNAPSHOT_GPU_OBJECT_GENERIC,
+					ib_obj_list);
+				if (ret)
+					break;
+			}
+		}
+
+		kgsl_memdesc_unmap(&ent->memdesc);
+		kgsl_mem_entry_put(ent);
+	}
+	return ret;
+}
+
+/*
+ * ib_parse_load_state() - Parse load state packet
+ * @pkt: Pointer to the packet in IB
+ * @process: The pagetable in which the IB is mapped
+ * @ib_obj_list: List in which any objects found are added
+ * @ib_parse_vars: VAriable list that store temporary addressses
+ *
+ * Parse load state packet found in an IB and add any memory object found to
+ * a list
+ * Returns 0 on success else error code
+ */
+static int ib_parse_load_state(unsigned int *pkt,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars)
+{
+	int ret = 0;
+	int i;
+
+	/*
+	 * The object here is to find indirect shaders i.e - shaders loaded from
+	 * GPU memory instead of directly in the command.  These should be added
+	 * to the list of memory objects to dump. So look at the load state
+	 * if the block is indirect (source = 4). If so then add the memory
+	 * address to the list.  The size of the object differs depending on the
+	 * type per the load_state_unit_sizes array above.
+	 */
+
+	if (type3_pkt_size(pkt[0]) < 2)
+		return 0;
+
+	/*
+	 * Anything from 3rd ordinal onwards of packet can be a memory object,
+	 * no need to be fancy about parsing it, just save it if it looks
+	 * like memory
+	 */
+	for (i = 0; i <= (type3_pkt_size(pkt[0]) - 2); i++) {
+		ret |= adreno_ib_add(process, pkt[2 + i] & 0xFFFFFFFC,
+				SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+		if (ret)
+			break;
+	}
+	/* get the mip addresses */
+	if (!ret)
+		ret = ib_save_mip_addresses(pkt, process, ib_obj_list);
+	return ret;
+}
+
+/*
+ * This opcode sets the base addresses for the visibilty stream buffer and the
+ * visiblity stream size buffer.
+ */
+
+static int ib_parse_set_bin_data(unsigned int *pkt,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars)
+{
+	int ret = 0;
+
+	if (type3_pkt_size(pkt[0]) < 2)
+		return 0;
+
+	/* Visiblity stream buffer */
+	ret = adreno_ib_add(process, pkt[1],
+		SNAPSHOT_GPU_OBJECT_GENERIC, ib_obj_list);
+	if (ret)
+		return ret;
+
+	/* visiblity stream size buffer (fixed size 8 dwords) */
+	ret = adreno_ib_add(process, pkt[2],
+		SNAPSHOT_GPU_OBJECT_GENERIC, ib_obj_list);
+
+	return ret;
+}
+
+/*
+ * This opcode writes to GPU memory - if the buffer is written to, there is a
+ * good chance that it would be valuable to capture in the snapshot, so mark all
+ * buffers that are written to as frozen
+ */
+
+static int ib_parse_mem_write(unsigned int *pkt,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars)
+{
+	if (type3_pkt_size(pkt[0]) < 1)
+		return 0;
+
+	/*
+	 * The address is where the data in the rest of this packet is written
+	 * to, but since that might be an offset into the larger buffer we need
+	 * to get the whole thing. Pass a size of 0 tocapture the entire buffer.
+	 */
+
+	return adreno_ib_add(process, pkt[1] & 0xFFFFFFFC,
+		SNAPSHOT_GPU_OBJECT_GENERIC, ib_obj_list);
+}
+
+/*
+ * ib_add_type0_entries() - Add memory objects to list
+ * @device: The device on which the IB will execute
+ * @process: The process in which IB is mapped
+ * @ib_obj_list: The list of gpu objects
+ * @ib_parse_vars: addresses ranges found in type0 packets
+ *
+ * Add memory objects to given list that are found in type0 packets
+ * Returns 0 on success else 0
+ */
+static int ib_add_type0_entries(struct kgsl_device *device,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars)
+{
+	int ret = 0;
+	int i;
+	int vfd_end;
+	unsigned int mask;
+	/* First up the visiblity stream buffer */
+	mask = 0xFFFFFFFF;
+	for (i = ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_0;
+		i < ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_7; i++) {
+		if (ib_parse_vars->cp_addr_regs[i]) {
+			ret = adreno_ib_add(process,
+				ib_parse_vars->cp_addr_regs[i] & mask,
+				SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+			if (ret)
+				return ret;
+			ib_parse_vars->cp_addr_regs[i] = 0;
+			ib_parse_vars->cp_addr_regs[i + 1] = 0;
+			i++;
+		}
+	}
+
+	vfd_end = ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_15;
+	for (i = ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_0;
+		i <= vfd_end; i++) {
+		if (ib_parse_vars->cp_addr_regs[i]) {
+			ret = adreno_ib_add(process,
+				ib_parse_vars->cp_addr_regs[i],
+				SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+			if (ret)
+				return ret;
+			ib_parse_vars->cp_addr_regs[i] = 0;
+		}
+	}
+
+	if (ib_parse_vars->cp_addr_regs[ADRENO_CP_ADDR_VSC_SIZE_ADDRESS]) {
+		ret = adreno_ib_add(process,
+			ib_parse_vars->cp_addr_regs[
+				ADRENO_CP_ADDR_VSC_SIZE_ADDRESS] & mask,
+			SNAPSHOT_GPU_OBJECT_GENERIC, ib_obj_list);
+		if (ret)
+			return ret;
+		ib_parse_vars->cp_addr_regs[
+			ADRENO_CP_ADDR_VSC_SIZE_ADDRESS] = 0;
+	}
+	mask = 0xFFFFFFE0;
+	for (i = ADRENO_CP_ADDR_SP_VS_PVT_MEM_ADDR;
+		i <= ADRENO_CP_ADDR_SP_FS_OBJ_START_REG; i++) {
+		ret = adreno_ib_add(process,
+			ib_parse_vars->cp_addr_regs[i] & mask,
+			SNAPSHOT_GPU_OBJECT_GENERIC, ib_obj_list);
+		if (ret)
+			return ret;
+		ib_parse_vars->cp_addr_regs[i] = 0;
+	}
+	return ret;
+}
+/*
+ * The DRAW_INDX opcode sends a draw initator which starts a draw operation in
+ * the GPU, so this is the point where all the registers and buffers become
+ * "valid".  The DRAW_INDX may also have an index buffer pointer that should be
+ * frozen with the others
+ */
+
+static int ib_parse_draw_indx(struct kgsl_device *device, unsigned int *pkt,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars)
+{
+	int ret = 0;
+	int i;
+	int opcode = cp_type3_opcode(pkt[0]);
+
+	switch (opcode) {
+	case CP_DRAW_INDX:
+		if (type3_pkt_size(pkt[0]) > 3) {
+			ret = adreno_ib_add(process,
+				pkt[4], SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+		}
+		break;
+	case CP_DRAW_INDX_OFFSET:
+		if (type3_pkt_size(pkt[0]) == 6) {
+			ret = adreno_ib_add(process,
+				pkt[5], SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+		}
+		break;
+	case CP_DRAW_INDIRECT:
+		if (type3_pkt_size(pkt[0]) == 2) {
+			ret = adreno_ib_add(process,
+				pkt[2], SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+		}
+		break;
+	case CP_DRAW_INDX_INDIRECT:
+		if (type3_pkt_size(pkt[0]) == 4) {
+			ret = adreno_ib_add(process,
+				pkt[2], SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+			if (ret)
+				break;
+			ret = adreno_ib_add(process,
+				pkt[4], SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+		}
+		break;
+	case CP_DRAW_AUTO:
+		if (type3_pkt_size(pkt[0]) == 6) {
+			ret = adreno_ib_add(process,
+				 pkt[3], SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+			if (ret)
+				break;
+			ret = adreno_ib_add(process,
+				pkt[4], SNAPSHOT_GPU_OBJECT_GENERIC,
+				ib_obj_list);
+		}
+		break;
+	}
+
+	if (ret)
+		return ret;
+	/*
+	 * All of the type0 writes are valid at a draw initiator, so freeze
+	 * the various buffers that we are tracking
+	 */
+	ret = ib_add_type0_entries(device, process, ib_obj_list,
+				ib_parse_vars);
+	if (ret)
+		return ret;
+	/* Process set draw state command streams if any */
+	for (i = 0; i < NUM_SET_DRAW_GROUPS; i++) {
+		if (!ib_parse_vars->set_draw_groups[i].cmd_stream_dwords)
+			continue;
+		ret = adreno_ib_find_objs(device, process,
+			ib_parse_vars->set_draw_groups[i].cmd_stream_addr,
+			ib_parse_vars->set_draw_groups[i].cmd_stream_dwords,
+			0, SNAPSHOT_GPU_OBJECT_DRAW,
+			ib_obj_list, 2);
+		if (ret)
+			break;
+	}
+	return ret;
+}
+
+/*
+ * Parse all the type7 opcode packets that may contain important information,
+ * such as additional GPU buffers to grab or a draw initator
+ */
+
+static int ib_parse_type7(struct kgsl_device *device, unsigned int *ptr,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars)
+{
+	int opcode = cp_type7_opcode(*ptr);
+
+	switch (opcode) {
+	case CP_SET_DRAW_STATE:
+		return ib_parse_type7_set_draw_state(device, ptr, process,
+					ib_obj_list);
+	}
+
+	return 0;
+}
+
+/*
+ * Parse all the type3 opcode packets that may contain important information,
+ * such as additional GPU buffers to grab or a draw initator
+ */
+
+static int ib_parse_type3(struct kgsl_device *device, unsigned int *ptr,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars)
+{
+	int opcode = cp_type3_opcode(*ptr);
+
+	switch (opcode) {
+	case  CP_LOAD_STATE:
+		return ib_parse_load_state(ptr, process, ib_obj_list,
+					ib_parse_vars);
+	case CP_SET_BIN_DATA:
+		return ib_parse_set_bin_data(ptr, process, ib_obj_list,
+					ib_parse_vars);
+	case CP_MEM_WRITE:
+		return ib_parse_mem_write(ptr, process, ib_obj_list,
+					ib_parse_vars);
+	case CP_DRAW_INDX:
+	case CP_DRAW_INDX_OFFSET:
+	case CP_DRAW_INDIRECT:
+	case CP_DRAW_INDX_INDIRECT:
+		return ib_parse_draw_indx(device, ptr, process, ib_obj_list,
+					ib_parse_vars);
+	case CP_SET_DRAW_STATE:
+		return ib_parse_set_draw_state(device, ptr, process,
+					ib_obj_list, ib_parse_vars);
+	}
+
+	return 0;
+}
+
+/*
+ * Parse type0 packets found in the stream.  Some of the registers that are
+ * written are clues for GPU buffers that we need to freeze.  Register writes
+ * are considred valid when a draw initator is called, so just cache the values
+ * here and freeze them when a CP_DRAW_INDX is seen.  This protects against
+ * needlessly caching buffers that won't be used during a draw call
+ */
+
+static int ib_parse_type0(struct kgsl_device *device, unsigned int *ptr,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	int size = type0_pkt_size(*ptr);
+	int offset = type0_pkt_offset(*ptr);
+	int i;
+	int reg_index;
+	int ret = 0;
+
+	for (i = 0; i < size; i++, offset++) {
+		/* Visiblity stream buffer */
+		if (offset >= adreno_cp_parser_getreg(adreno_dev,
+				ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_0) &&
+			offset <= adreno_cp_parser_getreg(adreno_dev,
+				ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_7)) {
+			reg_index = adreno_cp_parser_regindex(
+					adreno_dev, offset,
+					ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_0,
+					ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_7);
+			if (reg_index >= 0)
+				ib_parse_vars->cp_addr_regs[reg_index] =
+								ptr[i + 1];
+			continue;
+		} else if ((offset >= adreno_cp_parser_getreg(adreno_dev,
+					ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_0)) &&
+			(offset <= adreno_cp_parser_getreg(adreno_dev,
+				ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_15))) {
+			reg_index = adreno_cp_parser_regindex(adreno_dev,
+					offset,
+					ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_0,
+					ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_15);
+			if (reg_index >= 0)
+				ib_parse_vars->cp_addr_regs[reg_index] =
+								ptr[i + 1];
+			continue;
+		} else if ((offset >= adreno_cp_parser_getreg(adreno_dev,
+					ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_16)) &&
+			(offset <= adreno_cp_parser_getreg(adreno_dev,
+				ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_31))) {
+			reg_index = adreno_cp_parser_regindex(adreno_dev,
+					offset,
+					ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_16,
+					ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_31);
+			if (reg_index >= 0)
+				ib_parse_vars->cp_addr_regs[reg_index] =
+								ptr[i + 1];
+			continue;
+		} else {
+			if (offset ==
+				adreno_cp_parser_getreg(adreno_dev,
+					ADRENO_CP_ADDR_VSC_SIZE_ADDRESS))
+				ib_parse_vars->cp_addr_regs[
+					ADRENO_CP_ADDR_VSC_SIZE_ADDRESS] =
+						ptr[i + 1];
+			else if (offset == adreno_cp_parser_getreg(adreno_dev,
+					ADRENO_CP_ADDR_SP_VS_PVT_MEM_ADDR))
+				ib_parse_vars->cp_addr_regs[
+					ADRENO_CP_ADDR_SP_VS_PVT_MEM_ADDR] =
+						ptr[i + 1];
+			else if (offset == adreno_cp_parser_getreg(adreno_dev,
+					ADRENO_CP_ADDR_SP_FS_PVT_MEM_ADDR))
+				ib_parse_vars->cp_addr_regs[
+					ADRENO_CP_ADDR_SP_FS_PVT_MEM_ADDR] =
+						ptr[i + 1];
+			else if (offset == adreno_cp_parser_getreg(adreno_dev,
+					ADRENO_CP_ADDR_SP_VS_OBJ_START_REG))
+				ib_parse_vars->cp_addr_regs[
+					ADRENO_CP_ADDR_SP_VS_OBJ_START_REG] =
+						ptr[i + 1];
+			else if (offset == adreno_cp_parser_getreg(adreno_dev,
+					ADRENO_CP_ADDR_SP_FS_OBJ_START_REG))
+				ib_parse_vars->cp_addr_regs[
+					ADRENO_CP_ADDR_SP_FS_OBJ_START_REG] =
+						ptr[i + 1];
+			else if ((offset == adreno_cp_parser_getreg(adreno_dev,
+					ADRENO_CP_UCHE_INVALIDATE0)) ||
+				(offset == adreno_cp_parser_getreg(adreno_dev,
+					ADRENO_CP_UCHE_INVALIDATE1))) {
+				ret = adreno_ib_add(process,
+					ptr[i + 1] & 0xFFFFFFC0,
+					SNAPSHOT_GPU_OBJECT_GENERIC,
+					ib_obj_list);
+				if (ret)
+					break;
+			}
+		}
+	}
+	return ret;
+}
+
+static int ib_parse_type7_set_draw_state(struct kgsl_device *device,
+	unsigned int *ptr,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list)
+{
+	int size = type7_pkt_size(*ptr);
+	int i;
+	int ret = 0;
+	int flags;
+	uint64_t cmd_stream_dwords;
+	uint64_t cmd_stream_addr;
+
+	/*
+	 * size is the size of the packet that does not include the DWORD
+	 * for the packet header, we only want to loop here through the
+	 * packet parameters from ptr[1] till ptr[size] where ptr[0] is the
+	 * packet header. In each loop we look at 3 DWORDS hence increment
+	 * loop counter by 3 always
+	 */
+	for (i = 1; i <= size; i += 3) {
+		/* take action based on flags */
+		flags = (ptr[i] & 0x000F0000) >> 16;
+
+		/*
+		 * dirty flag or no flags both mean we need to load it for
+		 * next draw. No flags is used when the group is activated
+		 * or initialized for the first time in the IB
+		 */
+		if (flags & 0x1 || !flags) {
+			cmd_stream_dwords = ptr[i] & 0x0000FFFF;
+			cmd_stream_addr = ptr[i + 2];
+			cmd_stream_addr = cmd_stream_addr << 32 | ptr[i + 1];
+			if (cmd_stream_dwords)
+				ret = adreno_ib_find_objs(device, process,
+					cmd_stream_addr, cmd_stream_dwords,
+					0, SNAPSHOT_GPU_OBJECT_DRAW,
+					ib_obj_list, 2);
+			if (ret)
+				break;
+			continue;
+		}
+		/* load immediate */
+		if (flags & 0x8) {
+			uint64_t gpuaddr = ptr[i + 2];
+
+			gpuaddr = gpuaddr << 32 | ptr[i + 1];
+			ret = adreno_ib_find_objs(device, process,
+				gpuaddr, (ptr[i] & 0x0000FFFF),
+				0, SNAPSHOT_GPU_OBJECT_IB,
+				ib_obj_list, 2);
+			if (ret)
+				break;
+		}
+	}
+	return ret;
+}
+
+static int ib_parse_set_draw_state(struct kgsl_device *device,
+	unsigned int *ptr,
+	struct kgsl_process_private *process,
+	struct adreno_ib_object_list *ib_obj_list,
+	struct ib_parser_variables *ib_parse_vars)
+{
+	int size = type0_pkt_size(*ptr);
+	int i;
+	int grp_id;
+	int ret = 0;
+	int flags;
+	struct set_draw_state *group;
+
+	/*
+	 * size is the size of the packet that does not include the DWORD
+	 * for the packet header, we only want to loop here through the
+	 * packet parameters from ptr[1] till ptr[size] where ptr[0] is the
+	 * packet header. In each loop we look at 2 DWORDS hence increment
+	 * loop counter by 2 always
+	 */
+	for (i = 1; i <= size; i += 2) {
+		grp_id = (ptr[i] & 0x1F000000) >> 24;
+		/* take action based on flags */
+		flags = (ptr[i] & 0x000F0000) >> 16;
+		/* Disable all groups */
+		if (flags & 0x4) {
+			int j;
+
+			for (j = 0; j < NUM_SET_DRAW_GROUPS; j++) {
+				group = &(ib_parse_vars->set_draw_groups[j]);
+				group->cmd_stream_dwords = 0;
+			}
+			continue;
+		}
+		/* disable flag */
+		if (flags & 0x2) {
+			group = &(ib_parse_vars->set_draw_groups[grp_id]);
+			group->cmd_stream_dwords = 0;
+			continue;
+		}
+		/*
+		 * dirty flag or no flags both mean we need to load it for
+		 * next draw. No flags is used when the group is activated
+		 * or initialized for the first time in the IB
+		 */
+		if (flags & 0x1 || !flags) {
+			group = &(ib_parse_vars->set_draw_groups[grp_id]);
+			group->cmd_stream_dwords = ptr[i] & 0x0000FFFF;
+			group->cmd_stream_addr =  ptr[i + 1];
+			continue;
+		}
+		/* load immediate */
+		if (flags & 0x8) {
+			ret = adreno_ib_find_objs(device, process,
+				ptr[i + 1], (ptr[i] & 0x0000FFFF),
+				0, SNAPSHOT_GPU_OBJECT_IB,
+				ib_obj_list, 2);
+			if (ret)
+				break;
+		}
+	}
+	return ret;
+}
+
+/*
+ * adreno_cp_parse_ib2() - Wrapper function around IB2 parsing
+ * @device: Device pointer
+ * @process: Process in which the IB is allocated
+ * @gpuaddr: IB2 gpuaddr
+ * @dwords: IB2 size in dwords
+ * @ib2base: Base address of active IB2
+ * @ib_obj_list: List of objects found in IB
+ * @ib_level: The level from which function is called, either from IB1 or IB2
+ *
+ * Function does some checks to ensure that IB2 parsing is called from IB1
+ * and then calls the function to find objects in IB2.
+ */
+static int adreno_cp_parse_ib2(struct kgsl_device *device,
+			struct kgsl_process_private *process,
+			uint64_t gpuaddr, uint64_t dwords, uint64_t ib2base,
+			struct adreno_ib_object_list *ib_obj_list,
+			int ib_level)
+{
+	int i;
+
+	/*
+	 * We can only expect an IB2 in IB1, if we are
+	 * already processing an IB2 then return error
+	 */
+	if (ib_level == 2)
+		return -EINVAL;
+
+	/* Save current IB2 statically */
+	if (ib2base == gpuaddr)
+		kgsl_snapshot_push_object(device, process, gpuaddr, dwords);
+	/*
+	 * only try to find sub objects iff this IB has
+	 * not been processed already
+	 */
+	for (i = 0; i < ib_obj_list->num_objs; i++) {
+		struct adreno_ib_object *ib_obj = &(ib_obj_list->obj_list[i]);
+
+		if ((ib_obj->snapshot_obj_type == SNAPSHOT_GPU_OBJECT_IB) &&
+			(gpuaddr >= ib_obj->gpuaddr) &&
+			(gpuaddr + dwords * sizeof(unsigned int) <=
+			ib_obj->gpuaddr + ib_obj->size))
+			return 0;
+	}
+
+	return adreno_ib_find_objs(device, process, gpuaddr, dwords, ib2base,
+		SNAPSHOT_GPU_OBJECT_IB, ib_obj_list, 2);
+}
+
+/*
+ * adreno_ib_find_objs() - Find all IB objects in a given IB
+ * @device: The device pointer on which the IB executes
+ * @process: The process in which the IB and all contained objects are mapped.
+ * @gpuaddr: The gpu address of the IB
+ * @ib2base: IB2 base address
+ * @dwords: Size of ib in dwords
+ * @obj_type: The object type can be either an IB or a draw state sequence
+ * @ib_obj_list: The list in which the IB and the objects in it are added.
+ * @ib_level: Indicates if IB1 or IB2 is being processed
+ *
+ * Finds all IB objects in a given IB and puts then in a list. Can be called
+ * recursively for the IB2's in the IB1's
+ * Returns 0 on success else error code
+ */
+static int adreno_ib_find_objs(struct kgsl_device *device,
+				struct kgsl_process_private *process,
+				uint64_t gpuaddr, uint64_t dwords,
+				uint64_t ib2base, int obj_type,
+				struct adreno_ib_object_list *ib_obj_list,
+				int ib_level)
+{
+	int ret = 0;
+	uint64_t rem = dwords;
+	int i;
+	struct ib_parser_variables ib_parse_vars;
+	unsigned int *src;
+	struct adreno_ib_object *ib_obj;
+	struct kgsl_mem_entry *entry;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	/* check that this IB is not already on list */
+	for (i = 0; i < ib_obj_list->num_objs; i++) {
+		ib_obj = &(ib_obj_list->obj_list[i]);
+		if ((obj_type == ib_obj->snapshot_obj_type) &&
+			(ib_obj->gpuaddr <= gpuaddr) &&
+			((ib_obj->gpuaddr + ib_obj->size) >=
+			(gpuaddr + (dwords << 2))))
+			return 0;
+	}
+
+	entry = kgsl_sharedmem_find(process, gpuaddr);
+	if (!entry)
+		return -EINVAL;
+
+	if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, (dwords << 2))) {
+		kgsl_mem_entry_put(entry);
+		return -EINVAL;
+	}
+
+	src = kgsl_gpuaddr_to_vaddr(&entry->memdesc, gpuaddr);
+	if (!src) {
+		kgsl_mem_entry_put(entry);
+		return -EINVAL;
+	}
+
+	memset(&ib_parse_vars, 0, sizeof(struct ib_parser_variables));
+
+	ret = adreno_ib_add(process, gpuaddr, obj_type, ib_obj_list);
+	if (ret)
+		goto done;
+
+	for (i = 0; rem > 0; rem--, i++) {
+		int pktsize;
+
+		if (pkt_is_type0(src[i]))
+			pktsize = type0_pkt_size(src[i]);
+
+		else if (pkt_is_type3(src[i]))
+			pktsize = type3_pkt_size(src[i]);
+
+		else if (pkt_is_type4(src[i]))
+			pktsize = type4_pkt_size(src[i]);
+
+		else if (pkt_is_type7(src[i]))
+			pktsize = type7_pkt_size(src[i]);
+
+		/*
+		 * If the packet isn't a type 1, type 3, type 4 or type 7 then
+		 * don't bother parsing it - it is likely corrupted
+		 */
+		else
+			break;
+
+		if (((pkt_is_type0(src[i]) || pkt_is_type3(src[i])) && !pktsize)
+			|| ((pktsize + 1) > rem))
+			break;
+
+		if (pkt_is_type3(src[i])) {
+			if (adreno_cmd_is_ib(adreno_dev, src[i])) {
+				uint64_t gpuaddrib2 = src[i + 1];
+				uint64_t size = src[i + 2];
+
+				ret = adreno_cp_parse_ib2(device, process,
+						gpuaddrib2, size, ib2base,
+						ib_obj_list, ib_level);
+				if (ret)
+					goto done;
+			} else {
+				ret = ib_parse_type3(device, &src[i], process,
+						ib_obj_list,
+						&ib_parse_vars);
+				/*
+				 * If the parse function failed (probably
+				 * because of a bad decode) then bail out and
+				 * just capture the binary IB data
+				 */
+
+				if (ret)
+					goto done;
+			}
+		}
+
+		else if (pkt_is_type7(src[i])) {
+			if (adreno_cmd_is_ib(adreno_dev, src[i])) {
+				uint64_t size = src[i + 3];
+				uint64_t gpuaddrib2 = src[i + 2];
+
+				gpuaddrib2 = gpuaddrib2 << 32 | src[i + 1];
+
+				ret = adreno_cp_parse_ib2(device, process,
+						gpuaddrib2, size, ib2base,
+						ib_obj_list, ib_level);
+				if (ret)
+					goto done;
+			} else {
+				ret = ib_parse_type7(device, &src[i], process,
+						ib_obj_list,
+						&ib_parse_vars);
+				/*
+				 * If the parse function failed (probably
+				 * because of a bad decode) then bail out and
+				 * just capture the binary IB data
+				 */
+
+				if (ret)
+					goto done;
+			}
+		}
+
+		else if (pkt_is_type0(src[i])) {
+			ret = ib_parse_type0(device, &src[i], process,
+					ib_obj_list, &ib_parse_vars);
+			if (ret)
+				goto done;
+		}
+
+		i += pktsize;
+		rem -= pktsize;
+	}
+
+done:
+	/*
+	 * For set draw objects there may not be a draw_indx packet at its end
+	 * to signal that we need to save the found objects in it, so just save
+	 * it here.
+	 */
+	if (!ret && SNAPSHOT_GPU_OBJECT_DRAW == obj_type)
+		ret = ib_add_type0_entries(device, process, ib_obj_list,
+			&ib_parse_vars);
+
+	kgsl_memdesc_unmap(&entry->memdesc);
+	kgsl_mem_entry_put(entry);
+	return ret;
+}
+
+
+/*
+ * adreno_ib_create_object_list() - Find all the memory objects in IB
+ * @device: The device pointer on which the IB executes
+ * @process: The process in which the IB and all contained objects are mapped
+ * @gpuaddr: The gpu address of the IB
+ * @dwords: Size of ib in dwords
+ * @ib2base: Base address of active IB2
+ * @ib_obj_list: The list in which the IB and the objects in it are added.
+ *
+ * Find all the memory objects that an IB needs for execution and place
+ * them in a list including the IB.
+ * Returns the ib object list. On success 0 is returned, on failure error
+ * code is returned along with number of objects that was saved before
+ * error occurred. If no objects found then the list pointer is set to
+ * NULL.
+ */
+int adreno_ib_create_object_list(struct kgsl_device *device,
+		struct kgsl_process_private *process,
+		uint64_t gpuaddr, uint64_t dwords, uint64_t ib2base,
+		struct adreno_ib_object_list **out_ib_obj_list)
+{
+	int ret = 0;
+	struct adreno_ib_object_list *ib_obj_list;
+
+	if (!out_ib_obj_list)
+		return -EINVAL;
+
+	*out_ib_obj_list = NULL;
+
+	ib_obj_list = kzalloc(sizeof(*ib_obj_list), GFP_KERNEL);
+	if (!ib_obj_list)
+		return -ENOMEM;
+
+	ib_obj_list->obj_list = vmalloc(MAX_IB_OBJS *
+					sizeof(struct adreno_ib_object));
+
+	if (!ib_obj_list->obj_list) {
+		kfree(ib_obj_list);
+		return -ENOMEM;
+	}
+
+	ret = adreno_ib_find_objs(device, process, gpuaddr, dwords, ib2base,
+		SNAPSHOT_GPU_OBJECT_IB, ib_obj_list, 1);
+
+	/* Even if there was an error return the remaining objects found */
+	if (ib_obj_list->num_objs)
+		*out_ib_obj_list = ib_obj_list;
+
+	return ret;
+}
+
+/*
+ * adreno_ib_destroy_obj_list() - Destroy an ib object list
+ * @ib_obj_list: List to destroy
+ *
+ * Free up all resources used by an ib_obj_list
+ */
+void adreno_ib_destroy_obj_list(struct adreno_ib_object_list *ib_obj_list)
+{
+	int i;
+
+	if (!ib_obj_list)
+		return;
+
+	for (i = 0; i < ib_obj_list->num_objs; i++) {
+		if (ib_obj_list->obj_list[i].entry)
+			kgsl_mem_entry_put(ib_obj_list->obj_list[i].entry);
+	}
+	vfree(ib_obj_list->obj_list);
+	kfree(ib_obj_list);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_cp_parser.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_cp_parser.h
@@ -0,0 +1,175 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2013-2014, 2017, 2019, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef __ADRENO_IB_PARSER__
+#define __ADRENO_IB_PARSER__
+
+#include "adreno.h"
+
+extern const unsigned int a3xx_cp_addr_regs[];
+extern const unsigned int a4xx_cp_addr_regs[];
+
+/*
+ * struct adreno_ib_object - Structure containing information about an
+ * address range found in an IB
+ * @gpuaddr: The starting gpuaddress of the range
+ * @size: Size of the range
+ * @snapshot_obj_type - Type of range used in snapshot
+ * @entry: The memory entry in which this range is found
+ */
+struct adreno_ib_object {
+	uint64_t gpuaddr;
+	uint64_t size;
+	int snapshot_obj_type;
+	struct kgsl_mem_entry *entry;
+};
+
+/*
+ * struct adreno_ib_object_list - List of address ranges found in IB
+ * @obj_list: The address range list
+ * @num_objs: Number of objects in list
+ */
+struct adreno_ib_object_list {
+	struct adreno_ib_object *obj_list;
+	int num_objs;
+};
+
+/*
+ * adreno registers used during IB parsing, there contain addresses
+ * and sizes of the addresses that present in an IB
+ */
+enum adreno_cp_addr_regs {
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_0 = 0,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_0,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_1,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_1,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_2,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_2,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_3,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_3,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_4,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_4,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_5,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_5,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_6,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_6,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_ADDRESS_7,
+	ADRENO_CP_ADDR_VSC_PIPE_DATA_LENGTH_7,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_0,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_1,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_2,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_3,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_4,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_5,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_6,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_7,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_8,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_9,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_10,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_11,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_12,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_13,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_14,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_15,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_16,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_17,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_18,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_19,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_20,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_21,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_22,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_23,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_24,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_25,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_26,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_27,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_28,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_29,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_30,
+	ADRENO_CP_ADDR_VFD_FETCH_INSTR_1_31,
+	ADRENO_CP_ADDR_VSC_SIZE_ADDRESS,
+	ADRENO_CP_ADDR_SP_VS_PVT_MEM_ADDR,
+	ADRENO_CP_ADDR_SP_FS_PVT_MEM_ADDR,
+	ADRENO_CP_ADDR_SP_VS_OBJ_START_REG,
+	ADRENO_CP_ADDR_SP_FS_OBJ_START_REG,
+	ADRENO_CP_UCHE_INVALIDATE0,
+	ADRENO_CP_UCHE_INVALIDATE1,
+	ADRENO_CP_ADDR_MAX,
+};
+
+/*
+ * adreno_ib_init_ib_obj() - Create an ib object structure and initialize it
+ * with gpuaddress and size
+ * @gpuaddr: gpuaddr with which to initialize the object with
+ * @size: Size in bytes with which the object is initialized
+ * @ib_type: The IB type used by snapshot
+ *
+ * Returns the object pointer on success else error code in the pointer
+ */
+static inline void adreno_ib_init_ib_obj(uint64_t gpuaddr,
+			uint64_t size, int obj_type,
+			struct kgsl_mem_entry *entry,
+			struct adreno_ib_object *ib_obj)
+{
+	ib_obj->gpuaddr = gpuaddr;
+	ib_obj->size = size;
+	ib_obj->snapshot_obj_type = obj_type;
+	ib_obj->entry = entry;
+}
+
+/*
+ * adreno_cp_parser_getreg() - Returns the value of register offset
+ * @adreno_dev: The adreno device being operated upon
+ * @reg_enum: Enum index of the register whose offset is returned
+ */
+static inline int adreno_cp_parser_getreg(struct adreno_device *adreno_dev,
+					enum adreno_cp_addr_regs reg_enum)
+{
+	if (reg_enum == ADRENO_CP_ADDR_MAX)
+		return -EEXIST;
+
+	if (!adreno_is_a3xx(adreno_dev))
+		return -EEXIST;
+	return a3xx_cp_addr_regs[reg_enum];
+}
+
+/*
+ * adreno_cp_parser_regindex() - Returns enum index for a given register offset
+ * @adreno_dev: The adreno device being operated upon
+ * @offset: Register offset
+ * @start: The start index to search from
+ * @end: The last index to search
+ *
+ * Checks the list of registers defined for the device and returns the index
+ * whose offset value matches offset parameter.
+ */
+static inline int adreno_cp_parser_regindex(struct adreno_device *adreno_dev,
+				unsigned int offset,
+				enum adreno_cp_addr_regs start,
+				enum adreno_cp_addr_regs end)
+{
+	int i;
+	const unsigned int *regs;
+
+	if (!adreno_is_a3xx(adreno_dev))
+		return -EEXIST;
+
+	regs = a3xx_cp_addr_regs;
+
+	for (i = start; i <= end && i < ADRENO_CP_ADDR_MAX; i++)
+		if (regs[i] == offset)
+			return i;
+	return -EEXIST;
+}
+
+int adreno_ib_create_object_list(
+		struct kgsl_device *device,
+		struct kgsl_process_private *process,
+		uint64_t gpuaddr, uint64_t dwords, uint64_t ib2base,
+		struct adreno_ib_object_list **out_ib_obj_list);
+
+void adreno_ib_destroy_obj_list(struct adreno_ib_object_list *ib_obj_list);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_debugfs.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_debugfs.c
@@ -0,0 +1,680 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2002,2008-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+
+#include "adreno.h"
+extern struct dentry *kgsl_debugfs_dir;
+
+static void set_isdb(struct adreno_device *adreno_dev, void *priv)
+{
+	set_bit(ADRENO_DEVICE_ISDB_ENABLED, &adreno_dev->priv);
+}
+
+static int _isdb_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	/* Once ISDB goes enabled it stays enabled */
+	if (test_bit(ADRENO_DEVICE_ISDB_ENABLED, &adreno_dev->priv))
+		return 0;
+
+	/*
+	 * Bring down the GPU so we can bring it back up with the correct power
+	 * and clock settings
+	 */
+	return  adreno_power_cycle(adreno_dev, set_isdb, NULL);
+}
+
+static int _isdb_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	*val = (u64) test_bit(ADRENO_DEVICE_ISDB_ENABLED, &adreno_dev->priv);
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(_isdb_fops, _isdb_get, _isdb_set, "%llu\n");
+
+static int _ctxt_record_size_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+
+	device->snapshot_ctxt_record_size = val;
+
+	return 0;
+}
+
+static int _ctxt_record_size_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+
+	*val = device->snapshot_ctxt_record_size;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(_ctxt_record_size_fops, _ctxt_record_size_get,
+		_ctxt_record_size_set, "%llu\n");
+
+static int _lm_limit_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_LM))
+		return 0;
+
+	/* assure value is between 3A and 10A */
+	if (val > 10000)
+		val = 10000;
+	else if (val < 3000)
+		val = 3000;
+
+	if (adreno_dev->lm_enabled)
+		return adreno_power_cycle_u32(adreno_dev,
+			&adreno_dev->lm_limit, val);
+
+	return 0;
+}
+
+static int _lm_limit_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_LM))
+		*val = 0;
+
+	*val = (u64) adreno_dev->lm_limit;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(_lm_limit_fops, _lm_limit_get,
+		_lm_limit_set, "%llu\n");
+
+static int _lm_threshold_count_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_LM))
+		*val = 0;
+	else
+		*val = (u64) adreno_dev->lm_threshold_cross;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(_lm_threshold_fops, _lm_threshold_count_get,
+	NULL, "%llu\n");
+
+static int _active_count_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	unsigned int i = atomic_read(&device->active_cnt);
+
+	*val = (u64) i;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(_active_count_fops, _active_count_get, NULL, "%llu\n");
+
+static int _coop_reset_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_COOP_RESET))
+		adreno_dev->cooperative_reset = val ? true : false;
+	return 0;
+}
+
+static int _coop_reset_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	*val = (u64) adreno_dev->cooperative_reset;
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(_coop_reset_fops, _coop_reset_get,
+				_coop_reset_set, "%llu\n");
+
+static void set_gpu_client_pf(struct adreno_device *adreno_dev, void *priv)
+{
+	adreno_dev->uche_client_pf = *((u32 *)priv);
+	adreno_dev->patch_reglist = false;
+}
+
+static int _gpu_client_pf_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+
+	return adreno_power_cycle(ADRENO_DEVICE(device), set_gpu_client_pf, &val);
+}
+
+static int _gpu_client_pf_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	*val = (u64) adreno_dev->uche_client_pf;
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(_gpu_client_pf_fops, _gpu_client_pf_get,
+				_gpu_client_pf_set, "%llu\n");
+
+typedef void (*reg_read_init_t)(struct kgsl_device *device);
+typedef void (*reg_read_fill_t)(struct kgsl_device *device, int i,
+	unsigned int *vals, int linec);
+
+
+static void sync_event_print(struct seq_file *s,
+		struct kgsl_drawobj_sync_event *sync_event)
+{
+	switch (sync_event->type) {
+	case KGSL_CMD_SYNCPOINT_TYPE_TIMESTAMP: {
+		seq_printf(s, "sync: ctx: %u ts: %u",
+				sync_event->context->id, sync_event->timestamp);
+		break;
+	}
+	case KGSL_CMD_SYNCPOINT_TYPE_FENCE: {
+		int i;
+		struct event_fence_info *info = sync_event->priv;
+
+		for (i = 0; info && i < info->num_fences; i++)
+			seq_printf(s, "sync: %s",
+				info->fences[i].name);
+		break;
+	}
+	case KGSL_CMD_SYNCPOINT_TYPE_TIMELINE: {
+		int j;
+		struct event_timeline_info *info = sync_event->priv;
+
+		for (j = 0; info && info[j].timeline; j++)
+			seq_printf(s, "timeline: %d seqno: %lld",
+				info[j].timeline, info[j].seqno);
+		break;
+	}
+	default:
+		seq_printf(s, "sync: type: %d", sync_event->type);
+		break;
+	}
+}
+
+struct flag_entry {
+	unsigned long mask;
+	const char *str;
+};
+
+static void _print_flags(struct seq_file *s, const struct flag_entry *table,
+			unsigned long flags)
+{
+	int i;
+	int first = 1;
+
+	for (i = 0; table[i].str; i++) {
+		if (flags & table[i].mask) {
+			seq_printf(s, "%c%s", first ? '\0' : '|', table[i].str);
+			flags &= ~(table[i].mask);
+			first = 0;
+		}
+	}
+	if (flags) {
+		seq_printf(s, "%c0x%lx", first ? '\0' : '|', flags);
+		first = 0;
+	}
+	if (first)
+		seq_puts(s, "None");
+}
+
+#define print_flags(_s, _flag, _array...)		\
+	({						\
+		const struct flag_entry symbols[] =   \
+			{ _array, { -1, NULL } };	\
+		_print_flags(_s, symbols, _flag);	\
+	 })
+
+static void syncobj_print(struct seq_file *s,
+			struct kgsl_drawobj_sync *syncobj)
+{
+	struct kgsl_drawobj_sync_event *event;
+	unsigned int i;
+
+	seq_puts(s, " syncobj ");
+
+	for (i = 0; i < syncobj->numsyncs; i++) {
+		event = &syncobj->synclist[i];
+
+		if (!kgsl_drawobj_event_pending(syncobj, i))
+			continue;
+
+		sync_event_print(s, event);
+		seq_puts(s, "\n");
+	}
+}
+
+static void cmdobj_print(struct seq_file *s,
+			struct kgsl_drawobj_cmd *cmdobj)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+
+	if (drawobj->type == CMDOBJ_TYPE)
+		seq_puts(s, " cmdobj ");
+	else
+		seq_puts(s, " markerobj ");
+
+	seq_printf(s, "\t %u ", drawobj->timestamp);
+
+	seq_puts(s, " priv: ");
+	print_flags(s, cmdobj->priv,
+		{ BIT(CMDOBJ_SKIP), "skip"},
+		{ BIT(CMDOBJ_FORCE_PREAMBLE), "force_preamble"},
+		{ BIT(CMDOBJ_WFI), "wait_for_idle" });
+}
+
+static void drawobj_print(struct seq_file *s,
+			struct kgsl_drawobj *drawobj)
+{
+	if (!kref_get_unless_zero(&drawobj->refcount))
+		return;
+
+	if (drawobj->type == SYNCOBJ_TYPE)
+		syncobj_print(s, SYNCOBJ(drawobj));
+	else if ((drawobj->type == CMDOBJ_TYPE) ||
+			(drawobj->type == MARKEROBJ_TYPE))
+		cmdobj_print(s, CMDOBJ(drawobj));
+
+	seq_puts(s, " flags: ");
+	print_flags(s, drawobj->flags, KGSL_DRAWOBJ_FLAGS),
+	kgsl_drawobj_put(drawobj);
+	seq_puts(s, "\n");
+}
+
+static int ctx_print(struct seq_file *s, void *unused)
+{
+	struct adreno_context *drawctxt = s->private;
+	unsigned int i;
+	struct kgsl_event *event;
+	unsigned int queued = 0, consumed = 0, retired = 0;
+
+	seq_printf(s, "id: %u type: %s priority: %d process: %s (%d) tid: %d\n",
+		   drawctxt->base.id,
+		   kgsl_context_type(drawctxt->type),
+		   drawctxt->base.priority,
+		   drawctxt->base.proc_priv->comm,
+		   pid_nr(drawctxt->base.proc_priv->pid),
+		   drawctxt->base.tid);
+
+	seq_puts(s, "flags: ");
+	print_flags(s, drawctxt->base.flags & ~(KGSL_CONTEXT_PRIORITY_MASK
+		| KGSL_CONTEXT_TYPE_MASK), KGSL_CONTEXT_FLAGS);
+	seq_puts(s, " priv: ");
+	print_flags(s, drawctxt->base.priv,
+		{ BIT(KGSL_CONTEXT_PRIV_SUBMITTED), "submitted"},
+		{ BIT(KGSL_CONTEXT_PRIV_DETACHED), "detached"},
+		{ BIT(KGSL_CONTEXT_PRIV_INVALID), "invalid"},
+		{ BIT(KGSL_CONTEXT_PRIV_PAGEFAULT), "pagefault"},
+		{ BIT(ADRENO_CONTEXT_FAULT), "fault"},
+		{ BIT(ADRENO_CONTEXT_GPU_HANG), "gpu_hang"},
+		{ BIT(ADRENO_CONTEXT_GPU_HANG_FT), "gpu_hang_ft"},
+		{ BIT(ADRENO_CONTEXT_SKIP_EOF), "skip_end_of_frame" },
+		{ BIT(ADRENO_CONTEXT_FORCE_PREAMBLE), "force_preamble"});
+	seq_puts(s, "\n");
+
+	seq_puts(s, "timestamps: ");
+	kgsl_readtimestamp(drawctxt->base.device, &drawctxt->base,
+				KGSL_TIMESTAMP_QUEUED, &queued);
+	kgsl_readtimestamp(drawctxt->base.device, &drawctxt->base,
+				KGSL_TIMESTAMP_CONSUMED, &consumed);
+	kgsl_readtimestamp(drawctxt->base.device, &drawctxt->base,
+				KGSL_TIMESTAMP_RETIRED, &retired);
+	seq_printf(s, "queued: %u consumed: %u retired: %u global:%u\n",
+		   queued, consumed, retired,
+		   drawctxt->internal_timestamp);
+
+	seq_puts(s, "drawqueue:\n");
+
+	spin_lock(&drawctxt->lock);
+	for (i = drawctxt->drawqueue_head;
+		i != drawctxt->drawqueue_tail;
+		i = DRAWQUEUE_NEXT(i, ADRENO_CONTEXT_DRAWQUEUE_SIZE))
+		drawobj_print(s, drawctxt->drawqueue[i]);
+	spin_unlock(&drawctxt->lock);
+
+	seq_puts(s, "events:\n");
+	spin_lock(&drawctxt->base.events.lock);
+	list_for_each_entry(event, &drawctxt->base.events.events, node)
+		seq_printf(s, "\t%d: %pS created: %u\n", event->timestamp,
+				event->func, event->created);
+	spin_unlock(&drawctxt->base.events.lock);
+
+	return 0;
+}
+
+static int ctx_open(struct inode *inode, struct file *file)
+{
+	int ret;
+	struct adreno_context *ctx = inode->i_private;
+
+	if (!_kgsl_context_get(&ctx->base))
+		return -ENODEV;
+
+	ret = single_open(file, ctx_print, &ctx->base);
+	if (ret)
+		kgsl_context_put(&ctx->base);
+	return ret;
+}
+
+static int ctx_release(struct inode *inode, struct file *file)
+{
+	struct kgsl_context *context;
+
+	context = ((struct seq_file *)file->private_data)->private;
+
+	kgsl_context_put(context);
+
+	return single_release(inode, file);
+}
+
+static const struct file_operations ctx_fops = {
+	.open = ctx_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = ctx_release,
+};
+
+
+void
+adreno_context_debugfs_init(struct adreno_device *adreno_dev,
+			    struct adreno_context *ctx)
+{
+	unsigned char name[16];
+
+	/*
+	 * Get the context here to make sure it still exists for the life of the
+	 * file
+	 */
+	_kgsl_context_get(&ctx->base);
+
+	snprintf(name, sizeof(name), "%d", ctx->base.id);
+
+	ctx->debug_root = debugfs_create_file(name, 0444,
+				adreno_dev->ctx_d_debugfs, ctx, &ctx_fops);
+}
+
+static int _bcl_sid0_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->bcl_sid_set)
+		return ops->bcl_sid_set(device, 0, val);
+
+	return 0;
+}
+
+static int _bcl_sid0_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->bcl_sid_get)
+		*val = ops->bcl_sid_get(device, 0);
+
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(_sid0_fops, _bcl_sid0_get, _bcl_sid0_set, "%llu\n");
+
+static int _bcl_sid1_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->bcl_sid_set)
+		return ops->bcl_sid_set(device, 1, val);
+
+	return 0;
+}
+
+static int _bcl_sid1_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->bcl_sid_get)
+		*val = ops->bcl_sid_get(device, 1);
+
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(_sid1_fops, _bcl_sid1_get, _bcl_sid1_set, "%llu\n");
+
+static int _bcl_sid2_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->bcl_sid_set)
+		return ops->bcl_sid_set(device, 2, val);
+
+	return 0;
+}
+
+static int _bcl_sid2_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->bcl_sid_get)
+		*val = ops->bcl_sid_get(device, 2);
+
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(_sid2_fops, _bcl_sid2_get, _bcl_sid2_set, "%llu\n");
+
+static int _bcl_throttle_time_us_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_BCL))
+		*val = 0;
+	else
+		*val = (u64) adreno_dev->bcl_throttle_time_us;
+
+	return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(_bcl_throttle_fops, _bcl_throttle_time_us_get, NULL, "%llu\n");
+
+static int _skipsaverestore_store(void *data, u64 val)
+{
+	struct adreno_device *adreno_dev = data;
+
+	if (adreno_dev->hwsched_enabled)
+		return adreno_power_cycle_bool(adreno_dev,
+			&adreno_dev->preempt.skipsaverestore, val);
+
+	adreno_dev->preempt.skipsaverestore = val ? true : false;
+	return 0;
+
+}
+
+static int _skipsaverestore_show(void *data, u64 *val)
+{
+	struct adreno_device *adreno_dev = data;
+
+	*val = (u64) adreno_dev->preempt.skipsaverestore;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(skipsaverestore_fops, _skipsaverestore_show, _skipsaverestore_store,
+	"%llu\n");
+
+static int _usesgmem_store(void *data, u64 val)
+{
+	struct adreno_device *adreno_dev = data;
+
+	if (adreno_dev->hwsched_enabled)
+		return adreno_power_cycle_bool(adreno_dev,
+			&adreno_dev->preempt.usesgmem, val);
+
+	adreno_dev->preempt.usesgmem = val ? true : false;
+	return 0;
+
+}
+
+static int _usesgmem_show(void *data, u64 *val)
+{
+	struct adreno_device *adreno_dev = data;
+
+	*val = (u64) adreno_dev->preempt.usesgmem;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(usesgmem_fops, _usesgmem_show, _usesgmem_store, "%llu\n");
+
+static int _preempt_level_store(void *data, u64 val)
+{
+	struct adreno_device *adreno_dev = data;
+
+	if (adreno_dev->hwsched_enabled)
+		return adreno_power_cycle_u32(adreno_dev,
+			&adreno_dev->preempt.preempt_level,
+			min_t(u64, val, 2));
+
+	adreno_dev->preempt.preempt_level = min_t(u64, val, 2);
+	return 0;
+
+}
+
+static int _preempt_level_show(void *data, u64 *val)
+{
+	struct adreno_device *adreno_dev = data;
+
+	*val = (u64) adreno_dev->preempt.preempt_level;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(preempt_level_fops, _preempt_level_show, _preempt_level_store, "%llu\n");
+
+static int _warmboot_show(void *data, u64 *val)
+{
+	struct adreno_device *adreno_dev = data;
+
+	*val = (u64)adreno_dev->warmboot_enabled;
+	return 0;
+}
+
+/*
+ * When warmboot feature is enabled from debugfs, the first slumber exit will be a cold boot
+ * and all hfi messages will be recorded, so that warmboot can happen on subsequent slumber
+ * exit. When warmboot feature is disabled from debugfs, every slumber exit will be a coldboot.
+ */
+static int _warmboot_store(void *data, u64 val)
+{
+	struct adreno_device *adreno_dev = data;
+
+	if (adreno_dev->warmboot_enabled == val)
+		return 0;
+
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->warmboot_enabled, val);
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(warmboot_fops, _warmboot_show, _warmboot_store, "%llu\n");
+
+static int _ifpc_hyst_store(void *data, u64 val)
+{
+	struct adreno_device *adreno_dev = data;
+	u32 hyst;
+
+	if (!gmu_core_dev_ifpc_isenabled(KGSL_DEVICE(adreno_dev)))
+		return -EINVAL;
+
+	/* IFPC hysteresis timer is 16 bits */
+	hyst = max_t(u32, (u32) (FIELD_GET(GENMASK(15, 0), val)),
+		     adreno_dev->ifpc_hyst_floor);
+
+	if (hyst == adreno_dev->ifpc_hyst)
+		return 0;
+
+	return adreno_power_cycle_u32(adreno_dev,
+			&adreno_dev->ifpc_hyst, hyst);
+}
+
+static int _ifpc_hyst_show(void *data, u64 *val)
+{
+	struct adreno_device *adreno_dev = data;
+
+	*val = (u64) adreno_dev->ifpc_hyst;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(ifpc_hyst_fops, _ifpc_hyst_show, _ifpc_hyst_store, "%llu\n");
+
+void adreno_debugfs_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct dentry *snapshot_dir;
+
+	if (IS_ERR_OR_NULL(device->d_debugfs))
+		return;
+
+	debugfs_create_file("active_cnt", 0444, device->d_debugfs, device,
+			    &_active_count_fops);
+	adreno_dev->ctx_d_debugfs = debugfs_create_dir("ctx",
+							device->d_debugfs);
+	snapshot_dir = debugfs_lookup("snapshot", kgsl_debugfs_dir);
+
+	if (!IS_ERR_OR_NULL(snapshot_dir))
+		debugfs_create_file("coop_reset", 0644, snapshot_dir, device,
+					&_coop_reset_fops);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_LM)) {
+		debugfs_create_file("lm_limit", 0644, device->d_debugfs, device,
+			&_lm_limit_fops);
+		debugfs_create_file("lm_threshold_count", 0444,
+			device->d_debugfs, device, &_lm_threshold_fops);
+	}
+
+	if (adreno_is_a5xx(adreno_dev))
+		debugfs_create_file("isdb", 0644, device->d_debugfs,
+			device, &_isdb_fops);
+
+	if (gmu_core_isenabled(device))
+		debugfs_create_file("ifpc_hyst", 0644, device->d_debugfs,
+			device, &ifpc_hyst_fops);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_GMU_WARMBOOT))
+		debugfs_create_file("warmboot", 0644, device->d_debugfs,
+			device, &warmboot_fops);
+
+	debugfs_create_file("ctxt_record_size", 0644, snapshot_dir,
+		device, &_ctxt_record_size_fops);
+	debugfs_create_file("gpu_client_pf", 0644, snapshot_dir,
+		device, &_gpu_client_pf_fops);
+	debugfs_create_bool("dump_all_ibs", 0644, snapshot_dir,
+		&device->dump_all_ibs);
+
+	adreno_dev->bcl_debugfs_dir = debugfs_create_dir("bcl", device->d_debugfs);
+	if (!IS_ERR_OR_NULL(adreno_dev->bcl_debugfs_dir)) {
+		debugfs_create_file("sid0", 0644, adreno_dev->bcl_debugfs_dir, device, &_sid0_fops);
+		debugfs_create_file("sid1", 0644, adreno_dev->bcl_debugfs_dir, device, &_sid1_fops);
+		debugfs_create_file("sid2", 0644, adreno_dev->bcl_debugfs_dir, device, &_sid2_fops);
+		debugfs_create_file("bcl_throttle_time_us", 0444, adreno_dev->bcl_debugfs_dir,
+						device, &_bcl_throttle_fops);
+	}
+
+	adreno_dev->preemption_debugfs_dir = debugfs_create_dir("preemption", device->d_debugfs);
+	if (!IS_ERR_OR_NULL(adreno_dev->preemption_debugfs_dir)) {
+		debugfs_create_file("preempt_level", 0644, adreno_dev->preemption_debugfs_dir,
+			device, &preempt_level_fops);
+		debugfs_create_file("usesgmem", 0644, adreno_dev->preemption_debugfs_dir, device,
+			&usesgmem_fops);
+		debugfs_create_file("skipsaverestore", 0644, adreno_dev->preemption_debugfs_dir,
+			device, &skipsaverestore_fops);
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_dispatch.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_dispatch.c
@@ -0,0 +1,2882 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2013-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+#include <linux/sysfs.h>
+#include <soc/qcom/msm_performance.h>
+#include "adreno.h"
+#include "adreno_sysfs.h"
+#include "adreno_trace.h"
+#include "kgsl_bus.h"
+#include "kgsl_eventlog.h"
+#include "kgsl_gmu_core.h"
+#include "kgsl_timeline.h"
+
+#define DRAWQUEUE_NEXT(_i, _s) (((_i) + 1) % (_s))
+
+/* Number of commands that can be queued in a context before it sleeps */
+static unsigned int _context_drawqueue_size = 50;
+
+/* Number of milliseconds to wait for the context queue to clear */
+static unsigned int _context_queue_wait = 10000;
+
+/* Number of drawobjs sent at a time from a single context */
+static unsigned int _context_drawobj_burst = 5;
+
+/*
+ * GFT throttle parameters. If GFT recovered more than
+ * X times in Y ms invalidate the context and do not attempt recovery.
+ * X -> _fault_throttle_burst
+ * Y -> _fault_throttle_time
+ */
+static unsigned int _fault_throttle_time = 3000;
+static unsigned int _fault_throttle_burst = 3;
+
+/*
+ * Maximum ringbuffer inflight for the single submitting context case - this
+ * should be sufficiently high to keep the GPU loaded
+ */
+static unsigned int _dispatcher_q_inflight_hi = 15;
+
+/*
+ * Minimum inflight for the multiple context case - this should sufficiently low
+ * to allow for lower latency context switching
+ */
+static unsigned int _dispatcher_q_inflight_lo = 4;
+
+/* Command batch timeout (in milliseconds) */
+unsigned int adreno_drawobj_timeout = 2000;
+
+/* Interval for reading and comparing fault detection registers */
+static unsigned int _fault_timer_interval = 200;
+
+/* Use a kmem cache to speed up allocations for dispatcher jobs */
+static struct kmem_cache *jobs_cache;
+
+#define DRAWQUEUE_RB(_drawqueue) \
+	((struct adreno_ringbuffer *) \
+		container_of((_drawqueue),\
+		struct adreno_ringbuffer, dispatch_q))
+
+#define DRAWQUEUE(_ringbuffer) (&(_ringbuffer)->dispatch_q)
+
+static bool adreno_drawqueue_is_empty(struct adreno_dispatcher_drawqueue *drawqueue)
+{
+	return (drawqueue && drawqueue->head == drawqueue->tail);
+}
+
+static int adreno_dispatch_retire_drawqueue(struct adreno_device *adreno_dev,
+		struct adreno_dispatcher_drawqueue *drawqueue);
+
+static inline bool drawqueue_is_current(
+		struct adreno_dispatcher_drawqueue *drawqueue)
+{
+	struct adreno_ringbuffer *rb = DRAWQUEUE_RB(drawqueue);
+	struct adreno_device *adreno_dev = ADRENO_RB_DEVICE(rb);
+
+	return (adreno_dev->cur_rb == rb);
+}
+
+/*
+ *  If only one context has queued in the last 100 milliseconds increase
+ *  inflight to a high number to load up the GPU. If multiple contexts
+ *  have queued drop the inflight for better context switch latency.
+ *  If no contexts have queued what are you even doing here?
+ */
+
+static inline int
+_drawqueue_inflight(struct adreno_dispatcher_drawqueue *drawqueue)
+{
+	return (drawqueue->active_context_count > 1)
+		? _dispatcher_q_inflight_lo : _dispatcher_q_inflight_hi;
+}
+
+static void fault_detect_read(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int i;
+
+	if (!test_bit(ADRENO_DEVICE_SOFT_FAULT_DETECT, &adreno_dev->priv))
+		return;
+
+	for (i = 0; i < adreno_dev->num_ringbuffers; i++) {
+		struct adreno_ringbuffer *rb = &(adreno_dev->ringbuffers[i]);
+
+		adreno_rb_readtimestamp(adreno_dev, rb,
+			KGSL_TIMESTAMP_RETIRED, &(rb->fault_detect_ts));
+	}
+
+	for (i = 0; i < adreno_dev->soft_ft_count; i++) {
+		if (adreno_dev->soft_ft_regs[i])
+			kgsl_regread(device, adreno_dev->soft_ft_regs[i],
+				&adreno_dev->soft_ft_vals[i]);
+	}
+}
+
+void adreno_dispatcher_start_fault_timer(struct adreno_device *adreno_dev)
+{
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+
+	if (adreno_soft_fault_detect(adreno_dev))
+		mod_timer(&dispatcher->fault_timer,
+			jiffies + msecs_to_jiffies(_fault_timer_interval));
+}
+
+/*
+ * This takes a kgsl_device pointer so that it can be used for the function
+ * hook in adreno.c too
+ */
+void adreno_dispatcher_stop_fault_timer(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_SOFT_FAULT_DETECT))
+		del_timer_sync(&dispatcher->fault_timer);
+}
+
+/**
+ * _retire_timestamp() - Retire object without sending it
+ * to the hardware
+ * @drawobj: Pointer to the object to retire
+ *
+ * In some cases ibs can be retired by the software
+ * without going to the GPU.  In those cases, update the
+ * memstore from the CPU, kick off the event engine to handle
+ * expired events and destroy the ib.
+ */
+static void _retire_timestamp(struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_context *context = drawobj->context;
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	struct kgsl_device *device = context->device;
+	struct adreno_ringbuffer *rb = drawctxt->rb;
+	struct retire_info info = {0};
+
+	/*
+	 * Write the start and end timestamp to the memstore to keep the
+	 * accounting sane
+	 */
+	kgsl_sharedmem_writel(device->memstore,
+		KGSL_MEMSTORE_OFFSET(context->id, soptimestamp),
+		drawobj->timestamp);
+
+	kgsl_sharedmem_writel(device->memstore,
+		KGSL_MEMSTORE_OFFSET(context->id, eoptimestamp),
+		drawobj->timestamp);
+
+	drawctxt->submitted_timestamp = drawobj->timestamp;
+
+	/* Retire pending GPU events for the object */
+	kgsl_process_event_group(device, &context->events);
+
+	info.inflight = -1;
+	info.rb_id = rb->id;
+	info.wptr = rb->wptr;
+	info.timestamp = drawobj->timestamp;
+
+	msm_perf_events_update(MSM_PERF_GFX, MSM_PERF_RETIRED,
+				pid_nr(context->proc_priv->pid),
+				context->id, drawobj->timestamp,
+				!!(drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME));
+
+	if (drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME) {
+		atomic64_inc(&context->proc_priv->frame_count);
+		atomic_inc(&context->proc_priv->period->frames);
+	}
+
+	/*
+	 * For A3xx we still get the rptr from the CP_RB_RPTR instead of
+	 * rptr scratch out address. At this point GPU clocks turned off.
+	 * So avoid reading GPU register directly for A3xx.
+	 */
+	if (adreno_is_a3xx(ADRENO_DEVICE(device))) {
+		trace_adreno_cmdbatch_retired(context, &info,
+			drawobj->flags, rb->dispatch_q.inflight, 0);
+	} else {
+		info.rptr = adreno_get_rptr(rb);
+
+		trace_adreno_cmdbatch_retired(context, &info,
+			drawobj->flags, rb->dispatch_q.inflight, 0);
+	}
+
+	log_kgsl_cmdbatch_retired_event(context->id, drawobj->timestamp,
+		context->priority, drawobj->flags, 0, 0);
+
+	kgsl_drawobj_destroy(drawobj);
+}
+
+static int _check_context_queue(struct adreno_context *drawctxt, u32 count)
+{
+	int ret;
+
+	spin_lock(&drawctxt->lock);
+
+	/*
+	 * Wake up if there is room in the context or if the whole thing got
+	 * invalidated while we were asleep
+	 */
+
+	if (kgsl_context_invalid(&drawctxt->base))
+		ret = 1;
+	else
+		ret = ((drawctxt->queued + count) < _context_drawqueue_size) ? 1 : 0;
+
+	spin_unlock(&drawctxt->lock);
+
+	return ret;
+}
+
+/*
+ * return true if this is a marker command and the dependent timestamp has
+ * retired
+ */
+static bool _marker_expired(struct kgsl_drawobj_cmd *markerobj)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(markerobj);
+
+	return (drawobj->flags & KGSL_DRAWOBJ_MARKER) &&
+		kgsl_check_timestamp(drawobj->device, drawobj->context,
+			markerobj->marker_timestamp);
+}
+
+static inline void _pop_drawobj(struct adreno_context *drawctxt)
+{
+	drawctxt->drawqueue_head = DRAWQUEUE_NEXT(drawctxt->drawqueue_head,
+		ADRENO_CONTEXT_DRAWQUEUE_SIZE);
+	drawctxt->queued--;
+}
+
+static int dispatch_retire_markerobj(struct kgsl_drawobj *drawobj,
+				struct adreno_context *drawctxt)
+{
+	struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj);
+
+	if (_marker_expired(cmdobj)) {
+		_pop_drawobj(drawctxt);
+		_retire_timestamp(drawobj);
+		return 0;
+	}
+
+	/*
+	 * If the marker isn't expired but the SKIP bit
+	 * is set then there are real commands following
+	 * this one in the queue. This means that we
+	 * need to dispatch the command so that we can
+	 * keep the timestamp accounting correct. If
+	 * skip isn't set then we block this queue
+	 * until the dependent timestamp expires
+	 */
+	return test_bit(CMDOBJ_SKIP, &cmdobj->priv) ? 1 : -EAGAIN;
+}
+
+static int dispatch_retire_syncobj(struct kgsl_drawobj *drawobj,
+				struct adreno_context *drawctxt)
+{
+	struct kgsl_drawobj_sync *syncobj = SYNCOBJ(drawobj);
+
+	if (!kgsl_drawobj_events_pending(syncobj)) {
+		_pop_drawobj(drawctxt);
+		kgsl_drawobj_destroy(drawobj);
+		return 0;
+	}
+
+	/*
+	 * If we got here, there are pending events for sync object.
+	 * Start the canary timer if it hasnt been started already.
+	 */
+	if (!syncobj->timeout_jiffies) {
+		syncobj->timeout_jiffies = jiffies + msecs_to_jiffies(5000);
+			mod_timer(&syncobj->timer, syncobj->timeout_jiffies);
+	}
+
+	return -EAGAIN;
+}
+
+static int drawqueue_retire_timelineobj(struct kgsl_drawobj *drawobj,
+		struct adreno_context *drawctxt)
+{
+	_pop_drawobj(drawctxt);
+	kgsl_drawobj_destroy(drawobj);
+	return 0;
+}
+
+static int drawqueue_retire_bindobj(struct kgsl_drawobj *drawobj,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_drawobj_bind *bindobj = BINDOBJ(drawobj);
+
+	if (test_bit(KGSL_BINDOBJ_STATE_DONE, &bindobj->state)) {
+		_pop_drawobj(drawctxt);
+		_retire_timestamp(drawobj);
+		return 0;
+	}
+
+	if (!test_and_set_bit(KGSL_BINDOBJ_STATE_START, &bindobj->state)) {
+		/*
+		 * Take a referencre to the drawobj and the context because both
+		 * get referenced in the bind callback
+		 */
+		_kgsl_context_get(&drawctxt->base);
+		kref_get(&drawobj->refcount);
+
+		kgsl_sharedmem_bind_ranges(bindobj->bind);
+	}
+
+	return -EAGAIN;
+}
+
+/*
+ * Retires all expired marker and sync objs from the context
+ * queue and returns one of the below
+ * a) next drawobj that needs to be sent to ringbuffer
+ * b) -EAGAIN for syncobj with syncpoints pending.
+ * c) -EAGAIN for markerobj whose marker timestamp has not expired yet.
+ * c) NULL for no commands remaining in drawqueue.
+ */
+static struct kgsl_drawobj *_process_drawqueue_get_next_drawobj(
+				struct adreno_context *drawctxt)
+{
+	struct kgsl_drawobj *drawobj;
+	unsigned int i = drawctxt->drawqueue_head;
+
+	if (drawctxt->drawqueue_head == drawctxt->drawqueue_tail)
+		return NULL;
+
+	for (i = drawctxt->drawqueue_head; i != drawctxt->drawqueue_tail;
+			i = DRAWQUEUE_NEXT(i, ADRENO_CONTEXT_DRAWQUEUE_SIZE)) {
+		int ret = 0;
+
+		drawobj = drawctxt->drawqueue[i];
+		if (!drawobj)
+			return NULL;
+
+		switch (drawobj->type) {
+		case CMDOBJ_TYPE:
+			return drawobj;
+		case MARKEROBJ_TYPE:
+			ret = dispatch_retire_markerobj(drawobj, drawctxt);
+			/* Special case where marker needs to be sent to GPU */
+			if (ret == 1)
+				return drawobj;
+			break;
+		case SYNCOBJ_TYPE:
+			ret = dispatch_retire_syncobj(drawobj, drawctxt);
+			break;
+		case BINDOBJ_TYPE:
+			ret = drawqueue_retire_bindobj(drawobj, drawctxt);
+			break;
+		case TIMELINEOBJ_TYPE:
+			ret = drawqueue_retire_timelineobj(drawobj, drawctxt);
+			break;
+		default:
+			ret = -EINVAL;
+			break;
+		}
+
+		if (ret)
+			return ERR_PTR(ret);
+	}
+
+	return NULL;
+}
+
+/**
+ * adreno_dispatcher_requeue_cmdobj() - Put a command back on the context
+ * queue
+ * @drawctxt: Pointer to the adreno draw context
+ * @cmdobj: Pointer to the KGSL command object to requeue
+ *
+ * Failure to submit a command to the ringbuffer isn't the fault of the command
+ * being submitted so if a failure happens, push it back on the head of the the
+ * context queue to be reconsidered again unless the context got detached.
+ */
+static inline int adreno_dispatcher_requeue_cmdobj(
+		struct adreno_context *drawctxt,
+		struct kgsl_drawobj_cmd *cmdobj)
+{
+	unsigned int prev;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+
+	spin_lock(&drawctxt->lock);
+
+	if (kgsl_context_is_bad(&drawctxt->base)) {
+		spin_unlock(&drawctxt->lock);
+		/* get rid of this drawobj since the context is bad */
+		kgsl_drawobj_destroy(drawobj);
+		return -ENOENT;
+	}
+
+	prev = drawctxt->drawqueue_head == 0 ?
+		(ADRENO_CONTEXT_DRAWQUEUE_SIZE - 1) :
+		(drawctxt->drawqueue_head - 1);
+
+	/*
+	 * The maximum queue size always needs to be one less then the size of
+	 * the ringbuffer queue so there is "room" to put the drawobj back in
+	 */
+
+	WARN_ON(prev == drawctxt->drawqueue_tail);
+
+	drawctxt->drawqueue[prev] = drawobj;
+	drawctxt->queued++;
+
+	/* Reset the command queue head to reflect the newly requeued change */
+	drawctxt->drawqueue_head = prev;
+	cmdobj->requeue_cnt++;
+	spin_unlock(&drawctxt->lock);
+	return 0;
+}
+
+/**
+ * dispatcher_queue_context() - Queue a context in the dispatcher pending list
+ * @dispatcher: Pointer to the adreno dispatcher struct
+ * @drawctxt: Pointer to the adreno draw context
+ *
+ * Add a context to the dispatcher pending list.
+ */
+static int dispatcher_queue_context(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt)
+{
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	struct adreno_dispatch_job *job;
+
+	/* Refuse to queue a detached context */
+	if (kgsl_context_detached(&drawctxt->base))
+		return 0;
+
+	if (!_kgsl_context_get(&drawctxt->base))
+		return 0;
+
+	/* This function can be called in an atomic context */
+	job = kmem_cache_alloc(jobs_cache, GFP_ATOMIC);
+	if (!job) {
+		kgsl_context_put(&drawctxt->base);
+		return -ENOMEM;
+	}
+
+	job->drawctxt = drawctxt;
+
+	trace_dispatch_queue_context(drawctxt);
+	llist_add(&job->node, &dispatcher->jobs[drawctxt->base.priority]);
+
+	return 0;
+}
+
+/*
+ * Real time clients may demand high BW and have strict latency requirement.
+ * GPU bus DCVS is not fast enough to account for sudden BW requirements.
+ * Bus hint helps to bump up the bus vote (IB) upfront for known time-critical
+ * workloads.
+ */
+static void process_rt_bus_hint(struct kgsl_device *device, bool on)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_dispatcher_drawqueue *drawqueue =
+			DRAWQUEUE(&adreno_dev->ringbuffers[0]);
+
+	if (!adreno_is_preemption_enabled(adreno_dev) ||
+		!device->pwrctrl.rt_bus_hint)
+		return;
+
+	if (device->pwrctrl.rt_bus_hint_active == on)
+		return;
+
+	if (on && drawqueue->inflight == 1)
+		kgsl_bus_update(device, KGSL_BUS_VOTE_RT_HINT_ON);
+
+	if (!on && drawqueue->inflight == 0)
+		kgsl_bus_update(device, KGSL_BUS_VOTE_RT_HINT_OFF);
+}
+
+#define ADRENO_DRAWOBJ_PROFILE_COUNT \
+	(PAGE_SIZE / sizeof(struct adreno_drawobj_profile_entry))
+
+/**
+ * sendcmd() - Send a drawobj to the GPU hardware
+ * @dispatcher: Pointer to the adreno dispatcher struct
+ * @drawobj: Pointer to the KGSL drawobj being sent
+ *
+ * Send a KGSL drawobj to the GPU hardware
+ */
+static int sendcmd(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj_cmd *cmdobj)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	struct kgsl_context *context = drawobj->context;
+	struct adreno_dispatcher_drawqueue *dispatch_q = &drawctxt->rb->dispatch_q;
+	struct adreno_submit_time time;
+	uint64_t secs = 0;
+	unsigned long nsecs = 0;
+	int ret;
+	struct submission_info info = {0};
+
+	mutex_lock(&device->mutex);
+	if (adreno_gpu_halt(adreno_dev) != 0) {
+		mutex_unlock(&device->mutex);
+		return -EBUSY;
+	}
+
+	memset(&time, 0x0, sizeof(time));
+
+	dispatcher->inflight++;
+	dispatch_q->inflight++;
+
+	if (dispatcher->inflight == 1 &&
+			!test_bit(ADRENO_DISPATCHER_POWER, &dispatcher->priv)) {
+		/* Time to make the donuts.  Turn on the GPU */
+		ret = adreno_active_count_get(adreno_dev);
+		if (ret) {
+			dispatcher->inflight--;
+			dispatch_q->inflight--;
+			mutex_unlock(&device->mutex);
+			return ret;
+		}
+
+		set_bit(ADRENO_DISPATCHER_POWER, &dispatcher->priv);
+	}
+
+	if (test_bit(ADRENO_DEVICE_DRAWOBJ_PROFILE, &adreno_dev->priv)) {
+		set_bit(CMDOBJ_PROFILE, &cmdobj->priv);
+		cmdobj->profile_index = adreno_dev->profile_index;
+		adreno_dev->profile_index =
+			(adreno_dev->profile_index + 1) %
+			ADRENO_DRAWOBJ_PROFILE_COUNT;
+	}
+
+	process_rt_bus_hint(device, true);
+
+	ret = adreno_ringbuffer_submitcmd(adreno_dev, cmdobj, &time);
+
+	/*
+	 * On the first command, if the submission was successful, then read the
+	 * fault registers.  If it failed then turn off the GPU. Sad face.
+	 */
+
+	if (dispatcher->inflight == 1) {
+		if (ret == 0) {
+
+			/* Stop fault timer before reading fault registers */
+			adreno_dispatcher_stop_fault_timer(device);
+
+			fault_detect_read(adreno_dev);
+
+			/* Start the fault timer on first submission */
+			adreno_dispatcher_start_fault_timer(adreno_dev);
+
+			if (!test_and_set_bit(ADRENO_DISPATCHER_ACTIVE,
+				&dispatcher->priv))
+				reinit_completion(&dispatcher->idle_gate);
+		} else {
+			adreno_active_count_put(adreno_dev);
+			clear_bit(ADRENO_DISPATCHER_POWER, &dispatcher->priv);
+		}
+	}
+
+
+	if (ret) {
+		dispatcher->inflight--;
+		dispatch_q->inflight--;
+
+		process_rt_bus_hint(device, false);
+
+		mutex_unlock(&device->mutex);
+
+		/*
+		 * Don't log a message in case of:
+		 * -ENOENT means that the context was detached before the
+		 * command was submitted
+		 * -ENOSPC means that there temporarily isn't any room in the
+		 *  ringbuffer
+		 *  -PROTO means that a fault is currently being worked
+		 */
+
+		if (ret != -ENOENT && ret != -ENOSPC && ret != -EPROTO)
+			dev_err(device->dev,
+				     "Unable to submit command to the ringbuffer %d\n",
+				     ret);
+		return ret;
+	}
+
+	secs = time.ktime;
+	nsecs = do_div(secs, 1000000000);
+
+	/*
+	 * For the first submission in any given command queue update the
+	 * expected expire time - this won't actually be used / updated until
+	 * the command queue in question goes current, but universally setting
+	 * it here avoids the possibilty of some race conditions with preempt
+	 */
+
+	if (dispatch_q->inflight == 1)
+		dispatch_q->expires = jiffies +
+			msecs_to_jiffies(adreno_drawobj_timeout);
+
+	info.inflight = (int) dispatcher->inflight;
+	info.rb_id = drawctxt->rb->id;
+	info.rptr = adreno_get_rptr(drawctxt->rb);
+	info.wptr = drawctxt->rb->wptr;
+	info.gmu_dispatch_queue = -1;
+
+	msm_perf_events_update(MSM_PERF_GFX, MSM_PERF_SUBMIT,
+			       pid_nr(context->proc_priv->pid),
+			       context->id, drawobj->timestamp,
+			       !!(drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME));
+
+	trace_adreno_cmdbatch_submitted(drawobj, &info,
+			time.ticks, (unsigned long) secs, nsecs / 1000,
+			dispatch_q->inflight);
+
+	log_kgsl_cmdbatch_submitted_event(context->id, drawobj->timestamp,
+		context->priority, drawobj->flags);
+
+	mutex_unlock(&device->mutex);
+
+	cmdobj->submit_ticks = time.ticks;
+
+	dispatch_q->cmd_q[dispatch_q->tail] = cmdobj;
+	dispatch_q->tail = (dispatch_q->tail + 1) %
+		ADRENO_DISPATCH_DRAWQUEUE_SIZE;
+
+	/*
+	 * If we believe ourselves to be current and preemption isn't a thing,
+	 * then set up the timer.  If this misses, then preemption is indeed a
+	 * thing and the timer will be set up in due time
+	 */
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE)) {
+		if (drawqueue_is_current(dispatch_q))
+			mod_timer(&dispatcher->timer, dispatch_q->expires);
+	}
+
+
+	/*
+	 * we just submitted something, readjust ringbuffer
+	 * execution level
+	 */
+	if (gpudev->preemption_schedule)
+		gpudev->preemption_schedule(adreno_dev);
+	return 0;
+}
+
+/**
+ * dispatcher_context_sendcmds() - Send commands from a context to the GPU
+ * @adreno_dev: Pointer to the adreno device struct
+ * @drawctxt: Pointer to the adreno context to dispatch commands from
+ *
+ * Dequeue and send a burst of commands from the specified context to the GPU
+ * Returns postive if the context needs to be put back on the pending queue
+ * 0 if the context is empty or detached and negative on error
+ */
+static int dispatcher_context_sendcmds(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt)
+{
+	struct adreno_dispatcher_drawqueue *dispatch_q =
+					&(drawctxt->rb->dispatch_q);
+	int count = 0;
+	int ret = 0;
+	int inflight = _drawqueue_inflight(dispatch_q);
+	unsigned int timestamp;
+
+	if (dispatch_q->inflight >= inflight) {
+		spin_lock(&drawctxt->lock);
+		_process_drawqueue_get_next_drawobj(drawctxt);
+		spin_unlock(&drawctxt->lock);
+		return -EBUSY;
+	}
+
+	/*
+	 * Each context can send a specific number of drawobjs per cycle
+	 */
+	while ((count < _context_drawobj_burst) &&
+		(dispatch_q->inflight < inflight)) {
+		struct kgsl_drawobj *drawobj;
+		struct kgsl_drawobj_cmd *cmdobj;
+		struct kgsl_context *context;
+
+		if (adreno_gpu_fault(adreno_dev) != 0)
+			break;
+
+		spin_lock(&drawctxt->lock);
+		drawobj = _process_drawqueue_get_next_drawobj(drawctxt);
+
+		/*
+		 * adreno_context_get_drawobj returns -EAGAIN if the current
+		 * drawobj has pending sync points so no more to do here.
+		 * When the sync points are satisfied then the context will get
+		 * reqeueued
+		 */
+
+		if (IS_ERR_OR_NULL(drawobj)) {
+			if (IS_ERR(drawobj))
+				ret = PTR_ERR(drawobj);
+			spin_unlock(&drawctxt->lock);
+			break;
+		}
+		_pop_drawobj(drawctxt);
+		spin_unlock(&drawctxt->lock);
+
+		timestamp = drawobj->timestamp;
+		cmdobj = CMDOBJ(drawobj);
+		context = drawobj->context;
+		trace_adreno_cmdbatch_ready(context->id, context->priority,
+			drawobj->timestamp, cmdobj->requeue_cnt);
+		ret = sendcmd(adreno_dev, cmdobj);
+
+		/*
+		 * On error from sendcmd() try to requeue the cmdobj
+		 * unless we got back -ENOENT which means that the context has
+		 * been detached and there will be no more deliveries from here
+		 */
+		if (ret != 0) {
+			/* Destroy the cmdobj on -ENOENT */
+			if (ret == -ENOENT)
+				kgsl_drawobj_destroy(drawobj);
+			else {
+				/*
+				 * If the requeue returns an error, return that
+				 * instead of whatever sendcmd() sent us
+				 */
+				int r = adreno_dispatcher_requeue_cmdobj(
+					drawctxt, cmdobj);
+				if (r)
+					ret = r;
+			}
+
+			break;
+		}
+
+		drawctxt->submitted_timestamp = timestamp;
+
+		count++;
+	}
+
+	/*
+	 * Wake up any snoozing threads if we have consumed any real commands
+	 * or marker commands and we have room in the context queue.
+	 */
+
+	if (_check_context_queue(drawctxt, 0))
+		wake_up_all(&drawctxt->wq);
+
+	if (!ret)
+		ret = count;
+
+	/* Return error or the number of commands queued */
+	return ret;
+}
+
+static bool adreno_gpu_stopped(struct adreno_device *adreno_dev)
+{
+	return (adreno_gpu_fault(adreno_dev) || adreno_gpu_halt(adreno_dev));
+}
+
+static void dispatcher_handle_jobs_list(struct adreno_device *adreno_dev,
+		int id, unsigned long *map, struct llist_node *list)
+{
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	struct adreno_dispatch_job *job, *next;
+
+	if (!list)
+		return;
+
+	/* Reverse the order so the oldest context is considered first */
+	list = llist_reverse_order(list);
+
+	llist_for_each_entry_safe(job, next, list, node) {
+		int ret;
+
+		if (kgsl_context_is_bad(&job->drawctxt->base)) {
+			kgsl_context_put(&job->drawctxt->base);
+			kmem_cache_free(jobs_cache, job);
+			continue;
+		}
+
+		/*
+		 * Due to the nature of the lockless queue the same context
+		 * might have multiple jobs on the list. We allow this so we
+		 * don't have to query the list on the producer side but on the
+		 * consumer side we only want each context to be considered
+		 * once. Use a bitmap to remember which contexts we've already
+		 * seen and quietly discard duplicate jobs
+		 */
+		if (test_and_set_bit(job->drawctxt->base.id, map)) {
+			kgsl_context_put(&job->drawctxt->base);
+			kmem_cache_free(jobs_cache, job);
+			continue;
+		}
+
+		/*
+		 * If gpu is in fault or dispatcher is halted, add back the jobs
+		 * so that they are processed after recovery or when dispatcher
+		 * is resumed.
+		 */
+		if (adreno_gpu_stopped(adreno_dev)) {
+			llist_add(&job->node, &dispatcher->jobs[id]);
+			continue;
+		}
+
+		ret = dispatcher_context_sendcmds(adreno_dev, job->drawctxt);
+
+		/*
+		 * If the context had nothing queued or the context has been
+		 * destroyed then drop the job
+		 */
+		if (!ret || ret == -ENOENT) {
+			kgsl_context_put(&job->drawctxt->base);
+			kmem_cache_free(jobs_cache, job);
+			continue;
+		}
+
+		/*
+		 * If the ringbuffer is full then requeue the job to be
+		 * considered first next time. Otherwise the context
+		 * either successfully submmitted to the GPU or another error
+		 * happened and it should go back on the regular queue
+		 */
+		if (ret == -EBUSY)
+			llist_add(&job->node, &dispatcher->requeue[id]);
+		else
+			llist_add(&job->node, &dispatcher->jobs[id]);
+	}
+}
+
+static void dispatcher_handle_jobs(struct adreno_device *adreno_dev, int id)
+{
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	unsigned long map[BITS_TO_LONGS(KGSL_MEMSTORE_MAX)];
+	struct llist_node *requeue, *jobs;
+
+	memset(map, 0, sizeof(map));
+
+	requeue = llist_del_all(&dispatcher->requeue[id]);
+	jobs = llist_del_all(&dispatcher->jobs[id]);
+
+	dispatcher_handle_jobs_list(adreno_dev, id, map, requeue);
+	dispatcher_handle_jobs_list(adreno_dev, id, map, jobs);
+}
+
+/**
+ * _adreno_dispatcher_issuecmds() - Issue commmands from pending contexts
+ * @adreno_dev: Pointer to the adreno device struct
+ *
+ * Issue as many commands as possible (up to inflight) from the pending contexts
+ * This function assumes the dispatcher mutex has been locked.
+ */
+static void _adreno_dispatcher_issuecmds(struct adreno_device *adreno_dev)
+{
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	int i;
+
+	/* Leave early if the dispatcher isn't in a happy state */
+	if (adreno_gpu_fault(adreno_dev) != 0)
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(dispatcher->jobs); i++)
+		dispatcher_handle_jobs(adreno_dev, i);
+}
+
+/* Update the dispatcher timers */
+static void _dispatcher_update_timers(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+
+	/* Kick the idle timer */
+	mutex_lock(&device->mutex);
+	kgsl_pwrscale_update(device);
+	process_rt_bus_hint(device, false);
+	kgsl_start_idle_timer(device);
+	mutex_unlock(&device->mutex);
+
+	/* Check to see if we need to update the command timer */
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE)) {
+		struct adreno_dispatcher_drawqueue *drawqueue =
+			DRAWQUEUE(adreno_dev->cur_rb);
+
+		if (!adreno_drawqueue_is_empty(drawqueue))
+			mod_timer(&dispatcher->timer, drawqueue->expires);
+	}
+}
+
+static inline void _decrement_submit_now(struct kgsl_device *device)
+{
+	spin_lock(&device->submit_lock);
+	device->submit_now--;
+	spin_unlock(&device->submit_lock);
+}
+
+/**
+ * adreno_dispatcher_issuecmds() - Issue commmands from pending contexts
+ * @adreno_dev: Pointer to the adreno device struct
+ *
+ * Lock the dispatcher and call _adreno_dispatcher_issueibcmds
+ */
+static void adreno_dispatcher_issuecmds(struct adreno_device *adreno_dev)
+{
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	spin_lock(&device->submit_lock);
+	/* If state is not ACTIVE, schedule the work for later */
+	if (device->skip_inline_submit) {
+		spin_unlock(&device->submit_lock);
+		goto done;
+	}
+	device->submit_now++;
+	spin_unlock(&device->submit_lock);
+
+	/* If the dispatcher is busy then schedule the work for later */
+	if (!mutex_trylock(&dispatcher->mutex)) {
+		_decrement_submit_now(device);
+		goto done;
+	}
+
+	_adreno_dispatcher_issuecmds(adreno_dev);
+
+	if (dispatcher->inflight)
+		_dispatcher_update_timers(adreno_dev);
+
+	mutex_unlock(&dispatcher->mutex);
+	_decrement_submit_now(device);
+	return;
+done:
+	adreno_dispatcher_schedule(device);
+}
+
+/**
+ * get_timestamp() - Return the next timestamp for the context
+ * @drawctxt - Pointer to an adreno draw context struct
+ * @drawobj - Pointer to a drawobj
+ * @timestamp - Pointer to a timestamp value possibly passed from the user
+ * @user_ts - user generated timestamp
+ *
+ * Assign a timestamp based on the settings of the draw context and the command
+ * batch.
+ */
+static int get_timestamp(struct adreno_context *drawctxt,
+		struct kgsl_drawobj *drawobj, unsigned int *timestamp,
+		unsigned int user_ts)
+{
+
+	if (drawctxt->base.flags & KGSL_CONTEXT_USER_GENERATED_TS) {
+		/*
+		 * User specified timestamps need to be greater than the last
+		 * issued timestamp in the context
+		 */
+		if (timestamp_cmp(drawctxt->timestamp, user_ts) >= 0)
+			return -ERANGE;
+
+		drawctxt->timestamp = user_ts;
+	} else
+		drawctxt->timestamp++;
+
+	*timestamp = drawctxt->timestamp;
+	drawobj->timestamp = *timestamp;
+	return 0;
+}
+
+static void _set_ft_policy(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt,
+		struct kgsl_drawobj_cmd *cmdobj)
+{
+	/*
+	 * Set the fault tolerance policy for the command batch - assuming the
+	 * context hasn't disabled FT use the current device policy
+	 */
+	if (drawctxt->base.flags & KGSL_CONTEXT_NO_FAULT_TOLERANCE)
+		set_bit(KGSL_FT_DISABLE, &cmdobj->fault_policy);
+	/*
+	 *  Set the fault tolerance policy to FT_REPLAY - As context wants
+	 *  to invalidate it after a replay attempt fails. This doesn't
+	 *  require to execute the default FT policy.
+	 */
+	else if (drawctxt->base.flags & KGSL_CONTEXT_INVALIDATE_ON_FAULT)
+		set_bit(KGSL_FT_REPLAY, &cmdobj->fault_policy);
+	else
+		cmdobj->fault_policy = adreno_dev->ft_policy;
+}
+
+static void _cmdobj_set_flags(struct adreno_context *drawctxt,
+			struct kgsl_drawobj_cmd *cmdobj)
+{
+	/*
+	 * Force the preamble for this submission only - this is usually
+	 * requested by the dispatcher as part of fault recovery
+	 */
+	if (test_and_clear_bit(ADRENO_CONTEXT_FORCE_PREAMBLE,
+				&drawctxt->base.priv))
+		set_bit(CMDOBJ_FORCE_PREAMBLE, &cmdobj->priv);
+
+	/*
+	 * Force the premable if set from userspace in the context or
+	 * command obj flags
+	 */
+	if ((drawctxt->base.flags & KGSL_CONTEXT_CTX_SWITCH) ||
+		(cmdobj->base.flags & KGSL_DRAWOBJ_CTX_SWITCH))
+		set_bit(CMDOBJ_FORCE_PREAMBLE, &cmdobj->priv);
+
+	/* Skip this ib if IFH_NOP is enabled */
+	if (drawctxt->base.flags & KGSL_CONTEXT_IFH_NOP)
+		set_bit(CMDOBJ_SKIP, &cmdobj->priv);
+
+	/*
+	 * If we are waiting for the end of frame and it hasn't appeared yet,
+	 * then mark the command obj as skipped.  It will still progress
+	 * through the pipeline but it won't actually send any commands
+	 */
+
+	if (test_bit(ADRENO_CONTEXT_SKIP_EOF, &drawctxt->base.priv)) {
+		set_bit(CMDOBJ_SKIP, &cmdobj->priv);
+
+		/*
+		 * If this command obj represents the EOF then clear the way
+		 * for the dispatcher to continue submitting
+		 */
+
+		if (cmdobj->base.flags & KGSL_DRAWOBJ_END_OF_FRAME) {
+			clear_bit(ADRENO_CONTEXT_SKIP_EOF,
+				  &drawctxt->base.priv);
+
+			/*
+			 * Force the preamble on the next command to ensure that
+			 * the state is correct
+			 */
+			set_bit(ADRENO_CONTEXT_FORCE_PREAMBLE,
+				&drawctxt->base.priv);
+		}
+	}
+}
+
+static inline int _wait_for_room_in_context_queue(
+	struct adreno_context *drawctxt, u32 count) __must_hold(&drawctxt->lock)
+{
+	int ret = 0;
+
+	/*
+	 * There is always a possibility that dispatcher may end up pushing
+	 * the last popped draw object back to the context drawqueue. Hence,
+	 * we can only queue up to _context_drawqueue_size - 1 here to make
+	 * sure we never let drawqueue->queued exceed _context_drawqueue_size.
+	 */
+	if ((drawctxt->queued + count) > (_context_drawqueue_size - 1)) {
+		trace_adreno_drawctxt_sleep(drawctxt);
+		spin_unlock(&drawctxt->lock);
+
+		ret = wait_event_interruptible_timeout(drawctxt->wq,
+			_check_context_queue(drawctxt, count),
+			msecs_to_jiffies(_context_queue_wait));
+
+		spin_lock(&drawctxt->lock);
+		trace_adreno_drawctxt_wake(drawctxt);
+
+		/*
+		 * Account for the possibility that the context got invalidated
+		 * while we were sleeping
+		 */
+		if (ret > 0)
+			ret = kgsl_check_context_state(&drawctxt->base);
+		else if (ret == 0)
+			ret = -ETIMEDOUT;
+	}
+
+	return ret;
+}
+
+static unsigned int _check_context_state_to_queue_cmds(
+	struct adreno_context *drawctxt, u32 count)
+{
+	int ret = kgsl_check_context_state(&drawctxt->base);
+
+	if (ret)
+		return ret;
+
+	return _wait_for_room_in_context_queue(drawctxt, count);
+}
+
+static void _queue_drawobj(struct adreno_context *drawctxt,
+	struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_context *context = drawobj->context;
+
+	/* Put the command into the queue */
+	drawctxt->drawqueue[drawctxt->drawqueue_tail] = drawobj;
+	drawctxt->drawqueue_tail = (drawctxt->drawqueue_tail + 1) %
+			ADRENO_CONTEXT_DRAWQUEUE_SIZE;
+	drawctxt->queued++;
+	msm_perf_events_update(MSM_PERF_GFX, MSM_PERF_QUEUE,
+				pid_nr(context->proc_priv->pid),
+				context->id, drawobj->timestamp,
+				!!(drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME));
+	trace_adreno_cmdbatch_queued(drawobj, drawctxt->queued);
+}
+
+static int drawctxt_queue_bindobj(struct adreno_context *drawctxt,
+	struct kgsl_drawobj *drawobj, u32 *timestamp, u32 user_ts)
+{
+	int ret;
+
+	ret = get_timestamp(drawctxt, drawobj, timestamp, user_ts);
+	if (ret)
+		return ret;
+
+	drawctxt->queued_timestamp = *timestamp;
+	_queue_drawobj(drawctxt, drawobj);
+
+	return 0;
+}
+
+static void drawctxt_queue_timelineobj(struct adreno_context *drawctxt,
+	struct kgsl_drawobj *drawobj)
+{
+	/*
+	 * This drawobj is not submitted to the GPU so use a timestamp of 0.
+	 * Update the timestamp through a subsequent marker to keep userspace
+	 * happy.
+	 */
+	drawobj->timestamp = 0;
+
+	_queue_drawobj(drawctxt, drawobj);
+}
+
+static int drawctxt_queue_markerobj(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, struct kgsl_drawobj *drawobj,
+	uint32_t *timestamp, unsigned int user_ts)
+{
+	struct kgsl_drawobj_cmd *markerobj = CMDOBJ(drawobj);
+	int ret;
+
+	ret = get_timestamp(drawctxt, drawobj, timestamp, user_ts);
+	if (ret)
+		return ret;
+
+	/*
+	 * See if we can fastpath this thing - if nothing is queued
+	 * and nothing is inflight retire without bothering the GPU
+	 */
+	if (!drawctxt->queued && kgsl_check_timestamp(drawobj->device,
+			drawobj->context, drawctxt->queued_timestamp)) {
+		_retire_timestamp(drawobj);
+		return 1;
+	}
+
+	/*
+	 * Remember the last queued timestamp - the marker will block
+	 * until that timestamp is expired (unless another command
+	 * comes along and forces the marker to execute)
+	 */
+
+	markerobj->marker_timestamp = drawctxt->queued_timestamp;
+	drawctxt->queued_timestamp = *timestamp;
+	_set_ft_policy(adreno_dev, drawctxt, markerobj);
+	_cmdobj_set_flags(drawctxt, markerobj);
+
+	_queue_drawobj(drawctxt, drawobj);
+
+	return 0;
+}
+
+static int drawctxt_queue_cmdobj(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, struct kgsl_drawobj *drawobj,
+	uint32_t *timestamp, unsigned int user_ts)
+{
+	struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj);
+	unsigned int j;
+	int ret;
+
+	ret = get_timestamp(drawctxt, drawobj, timestamp, user_ts);
+	if (ret)
+		return ret;
+
+	/*
+	 * If this is a real command then we need to force any markers
+	 * queued before it to dispatch to keep time linear - set the
+	 * skip bit so the commands get NOPed.
+	 */
+	j = drawctxt->drawqueue_head;
+
+	while (j != drawctxt->drawqueue_tail) {
+		if (drawctxt->drawqueue[j]->type == MARKEROBJ_TYPE) {
+			struct kgsl_drawobj_cmd *markerobj =
+				CMDOBJ(drawctxt->drawqueue[j]);
+				set_bit(CMDOBJ_SKIP, &markerobj->priv);
+		}
+
+		j = DRAWQUEUE_NEXT(j, ADRENO_CONTEXT_DRAWQUEUE_SIZE);
+	}
+
+	drawctxt->queued_timestamp = *timestamp;
+	_set_ft_policy(adreno_dev, drawctxt, cmdobj);
+	_cmdobj_set_flags(drawctxt, cmdobj);
+
+	_queue_drawobj(drawctxt, drawobj);
+
+	return 0;
+}
+
+static void drawctxt_queue_syncobj(struct adreno_context *drawctxt,
+	struct kgsl_drawobj *drawobj, uint32_t *timestamp)
+{
+	*timestamp = 0;
+	drawobj->timestamp = 0;
+
+	_queue_drawobj(drawctxt, drawobj);
+}
+
+/*
+ * Queue a command in the context - if there isn't any room in the queue, then
+ * block until there is
+ */
+static int adreno_dispatcher_queue_cmds(struct kgsl_device_private *dev_priv,
+		struct kgsl_context *context, struct kgsl_drawobj *drawobj[],
+		uint32_t count, uint32_t *timestamp)
+
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	struct adreno_dispatcher_drawqueue *dispatch_q;
+	struct adreno_dispatch_job *job;
+	int ret;
+	unsigned int i, user_ts;
+
+	/*
+	 * There is always a possibility that dispatcher may end up pushing
+	 * the last popped draw object back to the context drawqueue. Hence,
+	 * we can only queue up to _context_drawqueue_size - 1 here to make
+	 * sure we never let drawqueue->queued exceed _context_drawqueue_size.
+	 */
+	if (!count || count > _context_drawqueue_size - 1)
+		return -EINVAL;
+
+	ret = kgsl_check_context_state(&drawctxt->base);
+	if (ret)
+		return ret;
+
+	ret = adreno_verify_cmdobj(dev_priv, context, drawobj, count);
+	if (ret)
+		return ret;
+
+	/* wait for the suspend gate */
+	wait_for_completion(&device->halt_gate);
+
+	job = kmem_cache_alloc(jobs_cache, GFP_KERNEL);
+	if (!job)
+		return -ENOMEM;
+
+	job->drawctxt = drawctxt;
+
+	spin_lock(&drawctxt->lock);
+
+	ret = _check_context_state_to_queue_cmds(drawctxt, count);
+	if (ret) {
+		spin_unlock(&drawctxt->lock);
+		kmem_cache_free(jobs_cache, job);
+		return ret;
+	}
+
+	user_ts = *timestamp;
+
+	/*
+	 * If there is only one drawobj in the array and it is of
+	 * type SYNCOBJ_TYPE, skip comparing user_ts as it can be 0
+	 */
+	if (!(count == 1 && drawobj[0]->type == SYNCOBJ_TYPE) &&
+		(drawctxt->base.flags & KGSL_CONTEXT_USER_GENERATED_TS)) {
+		/*
+		 * User specified timestamps need to be greater than the last
+		 * issued timestamp in the context
+		 */
+		if (timestamp_cmp(drawctxt->timestamp, user_ts) >= 0) {
+			spin_unlock(&drawctxt->lock);
+			kmem_cache_free(jobs_cache, job);
+			return -ERANGE;
+		}
+	}
+
+	for (i = 0; i < count; i++) {
+
+		switch (drawobj[i]->type) {
+		case MARKEROBJ_TYPE:
+			ret = drawctxt_queue_markerobj(adreno_dev, drawctxt,
+				drawobj[i], timestamp, user_ts);
+			if (ret) {
+				spin_unlock(&drawctxt->lock);
+				kmem_cache_free(jobs_cache, job);
+			}
+
+			if (ret == 1)
+				goto done;
+			else if (ret)
+				return ret;
+			break;
+		case CMDOBJ_TYPE:
+			ret = drawctxt_queue_cmdobj(adreno_dev, drawctxt,
+				drawobj[i], timestamp, user_ts);
+			if (ret) {
+				spin_unlock(&drawctxt->lock);
+				kmem_cache_free(jobs_cache, job);
+				return ret;
+			}
+			break;
+		case SYNCOBJ_TYPE:
+			drawctxt_queue_syncobj(drawctxt, drawobj[i], timestamp);
+			break;
+		case BINDOBJ_TYPE:
+			ret = drawctxt_queue_bindobj(drawctxt, drawobj[i],
+				timestamp, user_ts);
+			if (ret) {
+				spin_unlock(&drawctxt->lock);
+				kmem_cache_free(jobs_cache, job);
+				return ret;
+			}
+			break;
+		case TIMELINEOBJ_TYPE:
+			drawctxt_queue_timelineobj(drawctxt, drawobj[i]);
+			break;
+		default:
+			spin_unlock(&drawctxt->lock);
+			kmem_cache_free(jobs_cache, job);
+			return -EINVAL;
+		}
+
+	}
+
+	dispatch_q = &(ADRENO_CONTEXT(drawobj[0]->context)->rb->dispatch_q);
+
+	adreno_track_context(adreno_dev, dispatch_q, drawctxt);
+
+	spin_unlock(&drawctxt->lock);
+
+	/* Add the context to the dispatcher pending list */
+	if (_kgsl_context_get(&drawctxt->base)) {
+		trace_dispatch_queue_context(drawctxt);
+		llist_add(&job->node,
+			&adreno_dev->dispatcher.jobs[drawctxt->base.priority]);
+	} else {
+		kmem_cache_free(jobs_cache, job);
+		goto done;
+	}
+
+	/*
+	 * Only issue commands if inflight is less than burst -this prevents us
+	 * from sitting around waiting for the mutex on a busy system - the work
+	 * loop will schedule it for us. Inflight is mutex protected but the
+	 * worse that can happen is that it will go to 0 after we check and if
+	 * it goes to 0 it is because the work loop decremented it and the work
+	 * queue will try to schedule new commands anyway.
+	 */
+
+	if (dispatch_q->inflight < _context_drawobj_burst)
+		adreno_dispatcher_issuecmds(adreno_dev);
+done:
+	if (test_and_clear_bit(ADRENO_CONTEXT_FAULT, &context->priv))
+		return -EPROTO;
+
+	return 0;
+}
+
+/*
+ * If an IB inside of the drawobj has a gpuaddr that matches the base
+ * passed in then zero the size which effectively skips it when it is submitted
+ * in the ringbuffer.
+ */
+static void _skip_ib(struct kgsl_drawobj_cmd *cmdobj, uint64_t base)
+{
+	struct kgsl_memobj_node *ib;
+
+	list_for_each_entry(ib, &cmdobj->cmdlist, node) {
+		if (ib->gpuaddr == base) {
+			ib->priv |= MEMOBJ_SKIP;
+			if (base)
+				return;
+		}
+	}
+}
+
+static void _skip_cmd(struct kgsl_drawobj_cmd *cmdobj,
+	struct kgsl_drawobj_cmd **replay, int count)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	int i;
+
+	/*
+	 * SKIPCMD policy: next IB issued for this context is tentative
+	 * if it fails we assume that GFT failed and if it succeeds
+	 * we mark GFT as a success.
+	 *
+	 * Find next commandbatch for the faulting context
+	 * If commandbatch is found
+	 * a) store the current commandbatch fault_policy in context's next
+	 *    commandbatch fault_policy
+	 * b) force preamble for next commandbatch
+	 */
+	for (i = 1; i < count; i++) {
+		if (DRAWOBJ(replay[i])->context->id == drawobj->context->id) {
+			replay[i]->fault_policy = replay[0]->fault_policy;
+			set_bit(CMDOBJ_FORCE_PREAMBLE, &replay[i]->priv);
+			set_bit(KGSL_FT_SKIPCMD, &replay[i]->fault_recovery);
+			break;
+		}
+	}
+
+	/*
+	 * If we did not find the next cmd then
+	 * a) set a flag for next command issued in this context
+	 * b) store the fault_policy, this fault_policy becomes the policy of
+	 *    next command issued in this context
+	 */
+	if ((i == count) && drawctxt) {
+		set_bit(ADRENO_CONTEXT_SKIP_CMD, &drawctxt->base.priv);
+		drawctxt->fault_policy = replay[0]->fault_policy;
+	}
+
+	/* set the flags to skip this cmdobj */
+	set_bit(CMDOBJ_SKIP, &cmdobj->priv);
+	cmdobj->fault_recovery = 0;
+}
+
+static void _skip_frame(struct kgsl_drawobj_cmd *cmdobj,
+	struct kgsl_drawobj_cmd **replay, int count)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	int skip = 1;
+	int i;
+
+	for (i = 0; i < count; i++) {
+
+		struct kgsl_drawobj *replay_obj = DRAWOBJ(replay[i]);
+
+		/*
+		 * Only operate on drawobj's that belong to the
+		 * faulting context
+		 */
+
+		if (replay_obj->context->id != drawobj->context->id)
+			continue;
+
+		/*
+		 * Skip all the drawobjs in this context until
+		 * the EOF flag is seen.  If the EOF flag is seen then
+		 * force the preamble for the next command.
+		 */
+
+		if (skip) {
+			set_bit(CMDOBJ_SKIP, &replay[i]->priv);
+
+			if (replay_obj->flags & KGSL_DRAWOBJ_END_OF_FRAME)
+				skip = 0;
+		} else {
+			set_bit(CMDOBJ_FORCE_PREAMBLE, &replay[i]->priv);
+			return;
+		}
+	}
+
+	/*
+	 * If the EOF flag hasn't been seen yet then set the flag in the
+	 * drawctxt to keep looking for it
+	 */
+
+	if (skip && drawctxt)
+		set_bit(ADRENO_CONTEXT_SKIP_EOF, &drawctxt->base.priv);
+
+	/*
+	 * If we did see the EOF flag then force the preamble on for the
+	 * next command issued on this context
+	 */
+
+	if (!skip && drawctxt)
+		set_bit(ADRENO_CONTEXT_FORCE_PREAMBLE, &drawctxt->base.priv);
+}
+
+static void remove_invalidated_cmdobjs(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd **replay, int count)
+{
+	int i;
+
+	for (i = 0; i < count; i++) {
+		struct kgsl_drawobj_cmd *cmdobj = replay[i];
+		struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+
+		if (cmdobj == NULL)
+			continue;
+
+		if (kgsl_context_is_bad(drawobj->context)) {
+			replay[i] = NULL;
+
+			mutex_lock(&device->mutex);
+			kgsl_cancel_events_timestamp(device,
+				&drawobj->context->events, drawobj->timestamp);
+			mutex_unlock(&device->mutex);
+
+			kgsl_drawobj_destroy(drawobj);
+		}
+	}
+}
+
+#define pr_fault(_d, _c, fmt, args...) \
+		pr_context(_d, (_c)->context, fmt, ##args)
+
+static void adreno_fault_header(struct kgsl_device *device,
+		struct adreno_ringbuffer *rb, struct kgsl_drawobj_cmd *cmdobj,
+		int fault)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct adreno_context *drawctxt =
+			drawobj ? ADRENO_CONTEXT(drawobj->context) : NULL;
+	unsigned int status, rptr, wptr, ib1sz, ib2sz;
+	uint64_t ib1base, ib2base;
+	bool gx_on = adreno_gx_is_on(adreno_dev);
+	int id = (rb != NULL) ? rb->id : -1;
+	const char *type = fault & ADRENO_GMU_FAULT ? "gmu" : "gpu";
+
+	if (!gx_on) {
+		if (drawobj != NULL) {
+			pr_fault(device, drawobj,
+				"%s fault ctx %u ctx_type %s ts %u and GX is OFF\n",
+				type, drawobj->context->id,
+				kgsl_context_type(drawctxt->type),
+				drawobj->timestamp);
+			pr_fault(device, drawobj, "cmdline: %s\n",
+					drawctxt->base.proc_priv->cmdline);
+		} else
+			dev_err(device->dev, "RB[%d] : %s fault and GX is OFF\n",
+				id, type);
+
+		return;
+	}
+
+	adreno_readreg(adreno_dev, ADRENO_REG_RBBM_STATUS, &status);
+	adreno_readreg(adreno_dev, ADRENO_REG_CP_RB_RPTR, &rptr);
+	adreno_readreg(adreno_dev, ADRENO_REG_CP_RB_WPTR, &wptr);
+	adreno_readreg64(adreno_dev, ADRENO_REG_CP_IB1_BASE,
+					  ADRENO_REG_CP_IB1_BASE_HI, &ib1base);
+	adreno_readreg(adreno_dev, ADRENO_REG_CP_IB1_BUFSZ, &ib1sz);
+	adreno_readreg64(adreno_dev, ADRENO_REG_CP_IB2_BASE,
+					   ADRENO_REG_CP_IB2_BASE_HI, &ib2base);
+	adreno_readreg(adreno_dev, ADRENO_REG_CP_IB2_BUFSZ, &ib2sz);
+
+	if (drawobj != NULL) {
+		drawctxt->base.total_fault_count++;
+		drawctxt->base.last_faulted_cmd_ts = drawobj->timestamp;
+
+		trace_adreno_gpu_fault(drawobj->context->id,
+			drawobj->timestamp,
+			status, rptr, wptr, ib1base, ib1sz,
+			ib2base, ib2sz, drawctxt->rb->id);
+
+		pr_fault(device, drawobj,
+			"%s fault ctx %u ctx_type %s ts %u status %8.8X rb %4.4x/%4.4x ib1 %16.16llX/%4.4x ib2 %16.16llX/%4.4x\n",
+			type, drawobj->context->id,
+			kgsl_context_type(drawctxt->type),
+			drawobj->timestamp, status,
+			rptr, wptr, ib1base, ib1sz, ib2base, ib2sz);
+
+		pr_fault(device, drawobj, "cmdline: %s\n",
+				drawctxt->base.proc_priv->cmdline);
+
+		if (rb != NULL)
+			pr_fault(device, drawobj,
+				"%s fault rb %d rb sw r/w %4.4x/%4.4x\n",
+				type, rb->id, rptr, rb->wptr);
+	} else {
+		dev_err(device->dev,
+			"RB[%d] : %s fault status %8.8X rb %4.4x/%4.4x ib1 %16.16llX/%4.4x ib2 %16.16llX/%4.4x\n",
+			id, type, status, rptr, wptr, ib1base, ib1sz, ib2base,
+			ib2sz);
+		if (rb != NULL)
+			dev_err(device->dev,
+				"RB[%d] : %s fault rb sw r/w %4.4x/%4.4x\n",
+				rb->id, type, rptr, rb->wptr);
+	}
+}
+
+void adreno_fault_skipcmd_detached(struct adreno_device *adreno_dev,
+				 struct adreno_context *drawctxt,
+				 struct kgsl_drawobj *drawobj)
+{
+	if (test_bit(ADRENO_CONTEXT_SKIP_CMD, &drawctxt->base.priv) &&
+			kgsl_context_detached(&drawctxt->base)) {
+		pr_context(KGSL_DEVICE(adreno_dev), drawobj->context,
+			"gpu detached context %d\n", drawobj->context->id);
+		clear_bit(ADRENO_CONTEXT_SKIP_CMD, &drawctxt->base.priv);
+	}
+}
+
+/**
+ * process_cmdobj_fault() - Process a cmdobj for fault policies
+ * @device: Device on which the cmdobj caused a fault
+ * @replay: List of cmdobj's that are to be replayed on the device. The
+ * first command in the replay list is the faulting command and the remaining
+ * cmdobj's in the list are commands that were submitted to the same queue
+ * as the faulting one.
+ * @count: Number of cmdobj's in replay
+ * @base: The IB1 base at the time of fault
+ * @fault: The fault type
+ */
+static void process_cmdobj_fault(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd **replay, int count,
+		unsigned int base,
+		int fault)
+{
+	struct kgsl_drawobj_cmd *cmdobj = replay[0];
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	int i;
+	char *state = "failed";
+
+	/*
+	 * If GFT recovered more than X times in Y ms invalidate the context
+	 * and do not attempt recovery.
+	 * Example: X==3 and Y==3000 ms, GPU hung at 500ms, 1700ms, 25000ms and
+	 * 3000ms for the same context, we will not try FT and invalidate the
+	 * context @3000ms because context triggered GFT more than 3 times in
+	 * last 3 seconds. If a context caused recoverable GPU hangs
+	 * where 1st and 4th gpu hang are more than 3 seconds apart we
+	 * won't disable GFT and invalidate the context.
+	 */
+	if (test_bit(KGSL_FT_THROTTLE, &cmdobj->fault_policy)) {
+		if (ktime_ms_delta(ktime_get(), drawobj->context->fault_time) >
+				_fault_throttle_time) {
+			drawobj->context->fault_time = ktime_get();
+			drawobj->context->fault_count = 1;
+		} else {
+			drawobj->context->fault_count++;
+			if (drawobj->context->fault_count >
+					_fault_throttle_burst) {
+				set_bit(KGSL_FT_DISABLE,
+						&cmdobj->fault_policy);
+				pr_context(device, drawobj->context,
+					 "gpu fault threshold exceeded %d faults in %d msecs\n",
+					 _fault_throttle_burst,
+					 _fault_throttle_time);
+			}
+		}
+	}
+
+	/*
+	 * If FT is disabled for this cmdobj invalidate immediately
+	 */
+
+	if (test_bit(KGSL_FT_DISABLE, &cmdobj->fault_policy) ||
+		test_bit(KGSL_FT_TEMP_DISABLE, &cmdobj->fault_policy)) {
+		state = "skipped";
+		bitmap_zero(&cmdobj->fault_policy, BITS_PER_LONG);
+	}
+
+	/* If the context is detached do not run FT on context */
+	if (kgsl_context_detached(drawobj->context)) {
+		state = "detached";
+		bitmap_zero(&cmdobj->fault_policy, BITS_PER_LONG);
+	}
+
+	/*
+	 * Set a flag so we don't print another PM dump if the cmdobj fails
+	 * again on replay
+	 */
+
+	set_bit(KGSL_FT_SKIP_PMDUMP, &cmdobj->fault_policy);
+
+	/*
+	 * A hardware fault generally means something was deterministically
+	 * wrong with the cmdobj - no point in trying to replay it
+	 * Clear the replay bit and move on to the next policy level
+	 */
+
+	if (fault & ADRENO_HARD_FAULT)
+		clear_bit(KGSL_FT_REPLAY, &(cmdobj->fault_policy));
+
+	/*
+	 * A timeout fault means the IB timed out - clear the policy and
+	 * invalidate - this will clear the FT_SKIP_PMDUMP bit but that is okay
+	 * because we won't see this cmdobj again
+	 */
+
+	if ((fault & ADRENO_TIMEOUT_FAULT) ||
+				(fault & ADRENO_CTX_DETATCH_TIMEOUT_FAULT))
+		bitmap_zero(&cmdobj->fault_policy, BITS_PER_LONG);
+
+	/*
+	 * If the context had a GPU page fault then it is likely it would fault
+	 * again if replayed
+	 */
+
+	if (test_bit(KGSL_CONTEXT_PRIV_PAGEFAULT,
+		     &drawobj->context->priv)) {
+		/* we'll need to resume the mmu later... */
+		clear_bit(KGSL_FT_REPLAY, &cmdobj->fault_policy);
+		clear_bit(KGSL_CONTEXT_PRIV_PAGEFAULT,
+			  &drawobj->context->priv);
+	}
+
+	/*
+	 * Execute the fault tolerance policy. Each cmdobj stores the
+	 * current fault policy that was set when it was queued.
+	 * As the options are tried in descending priority
+	 * (REPLAY -> SKIPIBS -> SKIPFRAME -> NOTHING) the bits are cleared
+	 * from the cmdobj policy so the next thing can be tried if the
+	 * change comes around again
+	 */
+
+	/* Replay the hanging cmdobj again */
+	if (test_and_clear_bit(KGSL_FT_REPLAY, &cmdobj->fault_policy)) {
+		trace_adreno_cmdbatch_recovery(cmdobj, BIT(KGSL_FT_REPLAY));
+		set_bit(KGSL_FT_REPLAY, &cmdobj->fault_recovery);
+		return;
+	}
+
+	/*
+	 * Skip the last IB1 that was played but replay everything else.
+	 * Note that the last IB1 might not be in the "hung" cmdobj
+	 * because the CP may have caused a page-fault while it was prefetching
+	 * the next IB1/IB2. walk all outstanding commands and zap the
+	 * supposedly bad IB1 where ever it lurks.
+	 */
+
+	if (test_and_clear_bit(KGSL_FT_SKIPIB, &cmdobj->fault_policy)) {
+		trace_adreno_cmdbatch_recovery(cmdobj, BIT(KGSL_FT_SKIPIB));
+		set_bit(KGSL_FT_SKIPIB, &cmdobj->fault_recovery);
+
+		for (i = 0; i < count; i++) {
+			if (replay[i] != NULL &&
+				DRAWOBJ(replay[i])->context->id ==
+					drawobj->context->id)
+				_skip_ib(replay[i], base);
+		}
+
+		return;
+	}
+
+	/* Skip the faulted cmdobj submission */
+	if (test_and_clear_bit(KGSL_FT_SKIPCMD, &cmdobj->fault_policy)) {
+		trace_adreno_cmdbatch_recovery(cmdobj, BIT(KGSL_FT_SKIPCMD));
+
+		/* Skip faulting cmdobj */
+		_skip_cmd(cmdobj, replay, count);
+
+		return;
+	}
+
+	if (test_and_clear_bit(KGSL_FT_SKIPFRAME, &cmdobj->fault_policy)) {
+		trace_adreno_cmdbatch_recovery(cmdobj,
+			BIT(KGSL_FT_SKIPFRAME));
+		set_bit(KGSL_FT_SKIPFRAME, &cmdobj->fault_recovery);
+
+		/*
+		 * Skip all the pending cmdobj's for this context until
+		 * the EOF frame is seen
+		 */
+		_skip_frame(cmdobj, replay, count);
+		return;
+	}
+
+	/* If we get here then all the policies failed */
+
+	pr_context(device, drawobj->context, "gpu %s ctx %d ts %u\n",
+		state, drawobj->context->id, drawobj->timestamp);
+
+	/* Mark the context as failed and invalidate it */
+	adreno_drawctxt_set_guilty(device, drawobj->context);
+}
+
+/**
+ * recover_dispatch_q() - Recover all commands in a dispatch queue by
+ * resubmitting the commands
+ * @device: Device on which recovery is performed
+ * @dispatch_q: The command queue to recover
+ * @fault: Faults caused by the command in the dispatch q
+ * @base: The IB1 base during the fault
+ */
+static void recover_dispatch_q(struct kgsl_device *device,
+		struct adreno_dispatcher_drawqueue *dispatch_q,
+		int fault,
+		unsigned int base)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_drawobj_cmd **replay;
+	unsigned int ptr;
+	int first = 0;
+	int count = 0;
+	int i;
+
+	/* Allocate memory to store the inflight commands */
+	replay = kcalloc(dispatch_q->inflight, sizeof(*replay), GFP_KERNEL);
+
+	if (replay == NULL) {
+		unsigned int ptr = dispatch_q->head;
+
+		/* Recovery failed - mark everybody on this q guilty */
+		while (ptr != dispatch_q->tail) {
+			struct kgsl_drawobj_cmd *cmdobj =
+						dispatch_q->cmd_q[ptr];
+			struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+
+			adreno_drawctxt_set_guilty(device, drawobj->context);
+			kgsl_drawobj_destroy(drawobj);
+
+			ptr = DRAWQUEUE_NEXT(ptr,
+				ADRENO_DISPATCH_DRAWQUEUE_SIZE);
+		}
+
+		/*
+		 * Set the replay count to zero - this will ensure that the
+		 * hardware gets reset but nothing else gets played
+		 */
+
+		count = 0;
+		goto replay;
+	}
+
+	/* Copy the inflight cmdobj's into the temporary storage */
+	ptr = dispatch_q->head;
+
+	while (ptr != dispatch_q->tail) {
+		replay[count++] = dispatch_q->cmd_q[ptr];
+		ptr = DRAWQUEUE_NEXT(ptr, ADRENO_DISPATCH_DRAWQUEUE_SIZE);
+	}
+
+	if (fault && count)
+		process_cmdobj_fault(device, replay,
+					count, base, fault);
+replay:
+	dispatch_q->inflight = 0;
+	dispatch_q->head = dispatch_q->tail = 0;
+	/* Remove any pending cmdobj's that have been invalidated */
+	remove_invalidated_cmdobjs(device, replay, count);
+
+	/* Replay the pending command buffers */
+	for (i = 0; i < count; i++) {
+
+		int ret;
+
+		if (replay[i] == NULL)
+			continue;
+
+		/*
+		 * Force the preamble on the first command (if applicable) to
+		 * avoid any strange stage issues
+		 */
+
+		if (first == 0) {
+			set_bit(CMDOBJ_FORCE_PREAMBLE, &replay[i]->priv);
+			first = 1;
+		}
+
+		/*
+		 * Force each cmdobj to wait for idle - this avoids weird
+		 * CP parse issues
+		 */
+
+		set_bit(CMDOBJ_WFI, &replay[i]->priv);
+
+		ret = sendcmd(adreno_dev, replay[i]);
+
+		/*
+		 * If sending the command fails, then try to recover by
+		 * invalidating the context
+		 */
+
+		if (ret) {
+			pr_context(device, replay[i]->base.context,
+				"gpu reset failed ctx %u ts %u\n",
+				replay[i]->base.context->id,
+				replay[i]->base.timestamp);
+
+			/* Mark this context as guilty (failed recovery) */
+			adreno_drawctxt_set_guilty(device, replay[i]->base.context);
+			remove_invalidated_cmdobjs(device, &replay[i],
+				count - i);
+		}
+	}
+
+	/* Clear the fault bit */
+	clear_bit(ADRENO_DEVICE_FAULT, &adreno_dev->priv);
+
+	kfree(replay);
+}
+
+static void do_header_and_snapshot(struct kgsl_device *device, int fault,
+		struct adreno_ringbuffer *rb, struct kgsl_drawobj_cmd *cmdobj)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+
+	/* Always dump the snapshot on a non-drawobj failure */
+	if (cmdobj == NULL) {
+		adreno_fault_header(device, rb, NULL, fault);
+
+		/* GMU snapshot will also pull a full device snapshot */
+		if (fault & ADRENO_GMU_FAULT)
+			gmu_core_fault_snapshot(device);
+		else
+			kgsl_device_snapshot(device, NULL, NULL, false);
+		return;
+	}
+
+	/* Skip everything if the PMDUMP flag is set */
+	if (test_bit(KGSL_FT_SKIP_PMDUMP, &cmdobj->fault_policy))
+		return;
+
+	/* Print the fault header */
+	adreno_fault_header(device, rb, cmdobj, fault);
+
+	if (!(drawobj->context->flags & KGSL_CONTEXT_NO_SNAPSHOT))
+		kgsl_device_snapshot(device, drawobj->context, NULL,
+					fault & ADRENO_GMU_FAULT);
+}
+
+static int dispatcher_do_fault(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	struct adreno_dispatcher_drawqueue *dispatch_q = NULL, *dispatch_q_temp;
+	struct adreno_ringbuffer *rb;
+	struct adreno_ringbuffer *hung_rb = NULL;
+	unsigned int reg;
+	uint64_t base = 0;
+	struct kgsl_drawobj_cmd *cmdobj = NULL;
+	int ret, i;
+	int fault;
+	int halt;
+	bool gx_on;
+
+	fault = atomic_xchg(&dispatcher->fault, 0);
+	if (fault == 0)
+		return 0;
+
+	mutex_lock(&device->mutex);
+
+	/*
+	 * In the very unlikely case that the power is off, do nothing - the
+	 * state will be reset on power up and everybody will be happy
+	 */
+	if (!kgsl_state_is_awake(device)) {
+		mutex_unlock(&device->mutex);
+		return 0;
+	}
+
+	/* Mask all GMU interrupts */
+	if (gmu_core_isenabled(device)) {
+		adreno_write_gmureg(adreno_dev,
+			ADRENO_REG_GMU_AO_HOST_INTERRUPT_MASK,
+			0xFFFFFFFF);
+		adreno_write_gmureg(adreno_dev,
+			ADRENO_REG_GMU_GMU2HOST_INTR_MASK,
+			0xFFFFFFFF);
+	}
+
+	gx_on = adreno_gx_is_on(adreno_dev);
+
+	/*
+	 * On non-A3xx, read RBBM_STATUS3:SMMU_STALLED_ON_FAULT (BIT 24)
+	 * to tell if this function was entered after a pagefault. If so, only
+	 * proceed if the fault handler has already run in the IRQ thread,
+	 * else return early to give the fault handler a chance to run.
+	 */
+	if (!(fault & ADRENO_IOMMU_PAGE_FAULT) &&
+		!adreno_is_a3xx(adreno_dev) && gx_on) {
+		unsigned int val;
+
+		adreno_readreg(adreno_dev, ADRENO_REG_RBBM_STATUS3, &val);
+		if (val & BIT(24)) {
+			mutex_unlock(&device->mutex);
+			dev_err(device->dev,
+				"SMMU is stalled without a pagefault\n");
+			return -EBUSY;
+		}
+	}
+
+	/* Turn off all the timers */
+	del_timer_sync(&dispatcher->timer);
+
+	adreno_dispatcher_stop_fault_timer(device);
+
+	/*
+	 * Deleting uninitialized timer will block for ever on kernel debug
+	 * disable build. Hence skip del timer if it is not initialized.
+	 */
+	if (adreno_is_preemption_enabled(adreno_dev))
+		del_timer_sync(&adreno_dev->preempt.timer);
+
+	if (gx_on)
+		adreno_readreg64(adreno_dev, ADRENO_REG_CP_RB_BASE,
+			ADRENO_REG_CP_RB_BASE_HI, &base);
+
+	/*
+	 * Force the CP off for anything but a hard fault to make sure it is
+	 * good and stopped
+	 */
+	if (!(fault & ADRENO_HARD_FAULT) && gx_on) {
+		adreno_readreg(adreno_dev, ADRENO_REG_CP_ME_CNTL, &reg);
+		if (adreno_is_a3xx(adreno_dev))
+			reg |= (1 << 27) | (1 << 28);
+		else if (adreno_is_a5xx(adreno_dev) || adreno_is_a6xx(adreno_dev))
+			reg |= 1 | (1 << 1);
+		else
+			reg = 0x0;
+		adreno_writereg(adreno_dev, ADRENO_REG_CP_ME_CNTL, reg);
+	}
+	/*
+	 * retire cmdobj's from all the dispatch_q's before starting recovery
+	 */
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		adreno_dispatch_retire_drawqueue(adreno_dev,
+			&(rb->dispatch_q));
+		/* Select the active dispatch_q */
+		if (base == rb->buffer_desc->gpuaddr) {
+			dispatch_q = &(rb->dispatch_q);
+			hung_rb = rb;
+			if (adreno_dev->cur_rb != hung_rb) {
+				adreno_dev->prev_rb = adreno_dev->cur_rb;
+				adreno_dev->cur_rb = hung_rb;
+			}
+		}
+	}
+
+	if (dispatch_q && !adreno_drawqueue_is_empty(dispatch_q)) {
+		cmdobj = dispatch_q->cmd_q[dispatch_q->head];
+		trace_adreno_cmdbatch_fault(cmdobj, fault);
+	}
+
+	if (gx_on)
+		adreno_readreg64(adreno_dev, ADRENO_REG_CP_IB1_BASE,
+			ADRENO_REG_CP_IB1_BASE_HI, &base);
+
+	if (!test_bit(KGSL_FT_PAGEFAULT_GPUHALT_ENABLE, &device->mmu.pfpolicy)
+		&& adreno_dev->cooperative_reset)
+		gmu_core_dev_cooperative_reset(device);
+
+	if (!(fault & ADRENO_GMU_FAULT_SKIP_SNAPSHOT))
+		do_header_and_snapshot(device, fault, hung_rb, cmdobj);
+
+	/* Turn off the KEEPALIVE vote from the ISR for hard fault */
+	if (gpudev->gpu_keepalive && fault & ADRENO_HARD_FAULT)
+		gpudev->gpu_keepalive(adreno_dev, false);
+
+	/* Terminate the stalled transaction and resume the IOMMU */
+	if (fault & ADRENO_IOMMU_PAGE_FAULT)
+		kgsl_mmu_pagefault_resume(&device->mmu, true);
+
+	/* Reset the dispatcher queue */
+	dispatcher->inflight = 0;
+
+	/* Remove the bus hint */
+	device->pwrctrl.rt_bus_hint_active = false;
+
+	/* Reset the GPU and make sure halt is not set during recovery */
+	halt = adreno_gpu_halt(adreno_dev);
+	adreno_clear_gpu_halt(adreno_dev);
+
+	/*
+	 * If there is a stall in the ringbuffer after all commands have been
+	 * retired then we could hit problems if contexts are waiting for
+	 * internal timestamps that will never retire
+	 */
+
+	if (hung_rb != NULL) {
+		kgsl_sharedmem_writel(device->memstore,
+			MEMSTORE_RB_OFFSET(hung_rb, soptimestamp),
+			hung_rb->timestamp);
+
+		kgsl_sharedmem_writel(device->memstore,
+				MEMSTORE_RB_OFFSET(hung_rb, eoptimestamp),
+				hung_rb->timestamp);
+
+		/* Schedule any pending events to be run */
+		kgsl_process_event_group(device, &hung_rb->events);
+	}
+
+	ret = adreno_reset(device, fault);
+
+	mutex_unlock(&device->mutex);
+
+	/* If adreno_reset() fails then what hope do we have for the future? */
+	BUG_ON(ret);
+
+	/* if any other fault got in until reset then ignore */
+	atomic_set(&dispatcher->fault, 0);
+
+	/* recover all the dispatch_q's starting with the one that hung */
+	if (dispatch_q)
+		recover_dispatch_q(device, dispatch_q, fault, base);
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		dispatch_q_temp = &(rb->dispatch_q);
+		if (dispatch_q_temp != dispatch_q)
+			recover_dispatch_q(device, dispatch_q_temp, 0, base);
+	}
+
+	atomic_add(halt, &adreno_dev->halt);
+
+	return 1;
+}
+
+static inline int drawobj_consumed(struct kgsl_drawobj *drawobj,
+		unsigned int consumed, unsigned int retired)
+{
+	return ((timestamp_cmp(drawobj->timestamp, consumed) >= 0) &&
+		(timestamp_cmp(retired, drawobj->timestamp) < 0));
+}
+
+static const char *_ft_type(enum kgsl_ft_policy_bits nr)
+{
+	if (nr == KGSL_FT_OFF)
+		return "off";
+	else if (nr == KGSL_FT_REPLAY)
+		return "replay";
+	else if (nr == KGSL_FT_SKIPIB)
+		return "skipib";
+	else if (nr == KGSL_FT_SKIPFRAME)
+		return "skipfame";
+	else if (nr == KGSL_FT_DISABLE)
+		return "disable";
+	else if (nr == KGSL_FT_TEMP_DISABLE)
+		return "temp";
+	else if (nr == KGSL_FT_THROTTLE)
+		return "throttle";
+	else if (nr == KGSL_FT_SKIPCMD)
+		return "skipcmd";
+
+	return "";
+}
+
+static void _print_recovery(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj)
+{
+	int nr = find_first_bit(&cmdobj->fault_recovery, BITS_PER_LONG);
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+
+	pr_context(device, drawobj->context,
+		"gpu %s ctx %u ts %u policy %lX\n",
+		_ft_type(nr), drawobj->context->id, drawobj->timestamp,
+		cmdobj->fault_recovery);
+}
+
+static void cmdobj_profile_ticks(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj_cmd *cmdobj, uint64_t *start, uint64_t *retire,
+	uint64_t *active)
+{
+	void *ptr = adreno_dev->profile_buffer->hostptr;
+	struct adreno_drawobj_profile_entry *entry;
+
+	entry = (struct adreno_drawobj_profile_entry *)
+		(ptr + (cmdobj->profile_index * sizeof(*entry)));
+
+	/* get updated values of started and retired */
+	rmb();
+	*start = entry->started;
+	*retire = entry->retired;
+	if (ADRENO_GPUREV(adreno_dev) < 600)
+		*active = entry->retired - entry->started;
+	else
+		*active = entry->ctx_end - entry->ctx_start;
+}
+
+static void retire_cmdobj(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj)
+{
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	struct adreno_ringbuffer *rb = drawctxt->rb;
+	struct kgsl_context *context = drawobj->context;
+	uint64_t start = 0, end = 0, active = 0;
+	struct retire_info info = {0};
+
+	if (cmdobj->fault_recovery != 0) {
+		set_bit(ADRENO_CONTEXT_FAULT, &drawobj->context->priv);
+		_print_recovery(KGSL_DEVICE(adreno_dev), cmdobj);
+	}
+
+	if (test_bit(CMDOBJ_PROFILE, &cmdobj->priv))
+		cmdobj_profile_ticks(adreno_dev, cmdobj, &start, &end, &active);
+
+	info.inflight = (int)dispatcher->inflight;
+	info.rb_id = rb->id;
+	info.wptr = rb->wptr;
+	info.timestamp = drawobj->timestamp;
+	info.sop = start;
+	info.eop = end;
+	info.active = active;
+
+	/* protected GPU work must not be reported */
+	if  (!(context->flags & KGSL_CONTEXT_SECURE))
+		kgsl_work_period_update(KGSL_DEVICE(adreno_dev),
+					     context->proc_priv->period, active);
+
+	msm_perf_events_update(MSM_PERF_GFX, MSM_PERF_RETIRED,
+			       pid_nr(context->proc_priv->pid),
+			       context->id, drawobj->timestamp,
+			       !!(drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME));
+
+	if (drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME) {
+		atomic64_inc(&context->proc_priv->frame_count);
+		atomic_inc(&context->proc_priv->period->frames);
+	}
+
+	/*
+	 * For A3xx we still get the rptr from the CP_RB_RPTR instead of
+	 * rptr scratch out address. At this point GPU clocks turned off.
+	 * So avoid reading GPU register directly for A3xx.
+	 */
+	if (adreno_is_a3xx(adreno_dev)) {
+		trace_adreno_cmdbatch_retired(drawobj->context, &info,
+			drawobj->flags, rb->dispatch_q.inflight,
+			cmdobj->fault_recovery);
+	} else {
+		info.rptr = adreno_get_rptr(rb);
+		trace_adreno_cmdbatch_retired(drawobj->context, &info,
+			drawobj->flags, rb->dispatch_q.inflight,
+			cmdobj->fault_recovery);
+	}
+
+	log_kgsl_cmdbatch_retired_event(context->id, drawobj->timestamp,
+		context->priority, drawobj->flags, start, end);
+
+	drawctxt->submit_retire_ticks[drawctxt->ticks_index] =
+		end - cmdobj->submit_ticks;
+
+	drawctxt->ticks_index = (drawctxt->ticks_index + 1) %
+		SUBMIT_RETIRE_TICKS_SIZE;
+
+	trace_adreno_cmdbatch_done(drawobj->context->id,
+		drawobj->context->priority, drawobj->timestamp);
+	kgsl_drawobj_destroy(drawobj);
+}
+
+static int adreno_dispatch_retire_drawqueue(struct adreno_device *adreno_dev,
+		struct adreno_dispatcher_drawqueue *drawqueue)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	int count = 0;
+
+	while (!adreno_drawqueue_is_empty(drawqueue)) {
+		struct kgsl_drawobj_cmd *cmdobj =
+			drawqueue->cmd_q[drawqueue->head];
+		struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+
+		if (!kgsl_check_timestamp(device, drawobj->context,
+			drawobj->timestamp))
+			break;
+
+		retire_cmdobj(adreno_dev, cmdobj);
+
+		dispatcher->inflight--;
+		drawqueue->inflight--;
+
+		drawqueue->cmd_q[drawqueue->head] = NULL;
+
+		drawqueue->head = DRAWQUEUE_NEXT(drawqueue->head,
+			ADRENO_DISPATCH_DRAWQUEUE_SIZE);
+
+		count++;
+	}
+
+	return count;
+}
+
+static void _adreno_dispatch_check_timeout(struct adreno_device *adreno_dev,
+		struct adreno_dispatcher_drawqueue *drawqueue)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_drawobj *drawobj =
+			DRAWOBJ(drawqueue->cmd_q[drawqueue->head]);
+
+	/* Don't timeout if the timer hasn't expired yet (duh) */
+	if (time_is_after_jiffies(drawqueue->expires))
+		return;
+
+	/* Don't timeout if the IB timeout is disabled globally */
+	if (!adreno_long_ib_detect(adreno_dev))
+		return;
+
+	/* Don't time out if the context has disabled it */
+	if (drawobj->context->flags & KGSL_CONTEXT_NO_FAULT_TOLERANCE)
+		return;
+
+	pr_context(device, drawobj->context, "gpu timeout ctx %u ts %u\n",
+		drawobj->context->id, drawobj->timestamp);
+
+	adreno_set_gpu_fault(adreno_dev, ADRENO_TIMEOUT_FAULT);
+
+	/*
+	 * This makes sure dispatcher doesn't run endlessly in cases where
+	 * we couldn't run recovery
+	 */
+	drawqueue->expires = jiffies + msecs_to_jiffies(adreno_drawobj_timeout);
+}
+
+static int adreno_dispatch_process_drawqueue(struct adreno_device *adreno_dev,
+		struct adreno_dispatcher_drawqueue *drawqueue)
+{
+	int count = adreno_dispatch_retire_drawqueue(adreno_dev, drawqueue);
+
+	/* Nothing to do if there are no pending commands */
+	if (adreno_drawqueue_is_empty(drawqueue))
+		return count;
+
+	/* Don't update the drawqueue timeout if it isn't active */
+	if (!drawqueue_is_current(drawqueue))
+		return count;
+
+	/*
+	 * If the current ringbuffer retired any commands then universally
+	 * reset the timeout
+	 */
+
+	if (count) {
+		drawqueue->expires = jiffies +
+			msecs_to_jiffies(adreno_drawobj_timeout);
+		return count;
+	}
+
+	/*
+	 * If we get here then 1) the ringbuffer is current and 2) we haven't
+	 * retired anything.  Check to see if the timeout if valid for the
+	 * current drawobj and fault if it has expired
+	 */
+	_adreno_dispatch_check_timeout(adreno_dev, drawqueue);
+	return 0;
+}
+
+/* Take down the dispatcher and release any power states */
+static void _dispatcher_power_down(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+
+	mutex_lock(&device->mutex);
+
+	if (test_and_clear_bit(ADRENO_DISPATCHER_ACTIVE, &dispatcher->priv))
+		complete_all(&dispatcher->idle_gate);
+
+	adreno_dispatcher_stop_fault_timer(device);
+	process_rt_bus_hint(device, false);
+
+	if (test_bit(ADRENO_DISPATCHER_POWER, &dispatcher->priv)) {
+		adreno_active_count_put(adreno_dev);
+		clear_bit(ADRENO_DISPATCHER_POWER, &dispatcher->priv);
+	}
+
+	mutex_unlock(&device->mutex);
+}
+
+static void adreno_dispatcher_work(struct kthread_work *work)
+{
+	struct adreno_dispatcher *dispatcher =
+		container_of(work, struct adreno_dispatcher, work);
+	struct adreno_device *adreno_dev =
+		container_of(dispatcher, struct adreno_device, dispatcher);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	int count = 0;
+	unsigned int i = 0;
+
+	mutex_lock(&dispatcher->mutex);
+
+	/*
+	 * As long as there are inflight commands, process retired comamnds from
+	 * all drawqueues
+	 */
+	for (i = 0; i < adreno_dev->num_ringbuffers; i++) {
+		struct adreno_dispatcher_drawqueue *drawqueue =
+			DRAWQUEUE(&adreno_dev->ringbuffers[i]);
+
+		count += adreno_dispatch_process_drawqueue(adreno_dev,
+			drawqueue);
+		if (dispatcher->inflight == 0)
+			break;
+	}
+
+	kgsl_process_event_groups(device);
+
+	/*
+	 * dispatcher_do_fault() returns 0 if no faults occurred. If that is the
+	 * case, then clean up preemption and try to schedule more work
+	 */
+	if (dispatcher_do_fault(adreno_dev) == 0) {
+
+		/* Clean up after preemption */
+		if (gpudev->preemption_schedule)
+			gpudev->preemption_schedule(adreno_dev);
+
+		/* Run the scheduler for to dispatch new commands */
+		_adreno_dispatcher_issuecmds(adreno_dev);
+	}
+
+	/*
+	 * If there are commands pending, update the timers, otherwise release
+	 * the power state to prepare for power down
+	 */
+	if (dispatcher->inflight > 0)
+		_dispatcher_update_timers(adreno_dev);
+	else
+		_dispatcher_power_down(adreno_dev);
+
+	mutex_unlock(&dispatcher->mutex);
+}
+
+void adreno_dispatcher_schedule(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+
+	kthread_queue_work(dispatcher->worker, &dispatcher->work);
+}
+
+/*
+ * Put a draw context on the dispatcher pending queue and schedule the
+ * dispatcher. This is used to reschedule changes that might have been blocked
+ * for sync points or other concerns
+ */
+static void adreno_dispatcher_queue_context(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	dispatcher_queue_context(adreno_dev, drawctxt);
+	adreno_dispatcher_schedule(KGSL_DEVICE(adreno_dev));
+}
+
+void adreno_dispatcher_fault(struct adreno_device *adreno_dev,
+		u32 fault)
+{
+	adreno_set_gpu_fault(adreno_dev, fault);
+	adreno_dispatcher_schedule(KGSL_DEVICE(adreno_dev));
+}
+
+/*
+ * This is called when the timer expires - it either means the GPU is hung or
+ * the IB is taking too long to execute
+ */
+static void adreno_dispatcher_timer(struct timer_list *t)
+{
+	struct adreno_dispatcher *dispatcher = from_timer(dispatcher, t, timer);
+	struct adreno_device *adreno_dev = container_of(dispatcher,
+					struct adreno_device, dispatcher);
+
+	adreno_dispatcher_schedule(KGSL_DEVICE(adreno_dev));
+}
+
+/**
+ * adreno_dispatcher_start() - activate the dispatcher
+ * @adreno_dev: pointer to the adreno device structure
+ *
+ */
+void adreno_dispatcher_start(struct kgsl_device *device)
+{
+	complete_all(&device->halt_gate);
+
+	/* Schedule the work loop to get things going */
+	adreno_dispatcher_schedule(device);
+}
+
+/**
+ * adreno_dispatcher_stop() - stop the dispatcher
+ * @adreno_dev: pointer to the adreno device structure
+ *
+ * Stop the dispatcher and close all the timers
+ */
+void adreno_dispatcher_stop(struct adreno_device *adreno_dev)
+{
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+
+	del_timer_sync(&dispatcher->timer);
+
+	adreno_dispatcher_stop_fault_timer(KGSL_DEVICE(adreno_dev));
+}
+
+/* Return the ringbuffer that matches the draw context priority */
+static struct adreno_ringbuffer *dispatch_get_rb(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt)
+{
+	int level;
+
+	/* If preemption is disabled everybody goes on the same ringbuffer */
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return &adreno_dev->ringbuffers[0];
+
+	/*
+	 * Math to convert the priority field in context structure to an RB ID.
+	 * Divide up the context priority based on number of ringbuffer levels.
+	 */
+	level = min_t(int, drawctxt->base.priority / adreno_dev->num_ringbuffers,
+		adreno_dev->num_ringbuffers - 1);
+
+	return &adreno_dev->ringbuffers[level];
+}
+
+static void adreno_dispatcher_setup_context(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt)
+{
+	drawctxt->rb = dispatch_get_rb(adreno_dev, drawctxt);
+}
+
+static void change_preemption(struct adreno_device *adreno_dev, void *priv)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_context *context;
+	struct adreno_context *drawctxt;
+	struct adreno_ringbuffer *rb;
+	int id, i, ret;
+
+	/* Make sure all ringbuffers are finished */
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		ret = adreno_ringbuffer_waittimestamp(rb, rb->timestamp,
+			2 * 1000);
+		if (ret) {
+			dev_err(device->dev,
+				"Cannot disable preemption because couldn't idle ringbuffer[%d] ret: %d\n",
+				rb->id, ret);
+			return;
+		}
+	}
+
+	change_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv);
+	adreno_dev->cur_rb = &adreno_dev->ringbuffers[0];
+	adreno_dev->next_rb = NULL;
+	adreno_dev->prev_rb = NULL;
+
+	/* Update the ringbuffer for each draw context */
+	write_lock(&device->context_lock);
+	idr_for_each_entry(&device->context_idr, context, id) {
+		drawctxt = ADRENO_CONTEXT(context);
+		drawctxt->rb = dispatch_get_rb(adreno_dev, drawctxt);
+
+		/*
+		 * Make sure context destroy checks against the correct
+		 * ringbuffer's timestamp.
+		 */
+		adreno_rb_readtimestamp(adreno_dev, drawctxt->rb,
+			KGSL_TIMESTAMP_RETIRED, &drawctxt->internal_timestamp);
+	}
+	write_unlock(&device->context_lock);
+}
+
+static int _preemption_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (!adreno_preemption_feature_set(adreno_dev) ||
+		(test_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv) == val))
+		return 0;
+
+	return adreno_power_cycle(adreno_dev, change_preemption, NULL);
+}
+
+static bool _preemption_show(struct adreno_device *adreno_dev)
+{
+	return adreno_is_preemption_enabled(adreno_dev);
+}
+
+static unsigned int _preempt_count_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->preempt.count;
+}
+
+static int _ft_long_ib_detect_store(struct adreno_device *adreno_dev, bool val)
+{
+	adreno_dev->long_ib_detect = val ? true : false;
+	return 0;
+}
+
+static bool _ft_long_ib_detect_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->long_ib_detect;
+}
+
+static ADRENO_SYSFS_BOOL(preemption);
+static ADRENO_SYSFS_RO_U32(preempt_count);
+static ADRENO_SYSFS_BOOL(ft_long_ib_detect);
+
+static const struct attribute *_dispatch_attr_list[] = {
+	&adreno_attr_preemption.attr.attr,
+	&adreno_attr_preempt_count.attr.attr,
+	&adreno_attr_ft_long_ib_detect.attr.attr,
+	NULL,
+};
+
+static void adreno_dispatcher_close(struct adreno_device *adreno_dev)
+{
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	int i;
+	struct adreno_ringbuffer *rb;
+
+	mutex_lock(&dispatcher->mutex);
+	del_timer_sync(&dispatcher->timer);
+
+	adreno_dispatcher_stop_fault_timer(KGSL_DEVICE(adreno_dev));
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		struct adreno_dispatcher_drawqueue *dispatch_q =
+			&(rb->dispatch_q);
+		while (!adreno_drawqueue_is_empty(dispatch_q)) {
+			kgsl_drawobj_destroy(
+				DRAWOBJ(dispatch_q->cmd_q[dispatch_q->head]));
+			dispatch_q->head = (dispatch_q->head + 1)
+				% ADRENO_DISPATCH_DRAWQUEUE_SIZE;
+		}
+	}
+
+	mutex_unlock(&dispatcher->mutex);
+
+	kthread_destroy_worker(dispatcher->worker);
+
+	adreno_set_dispatch_ops(adreno_dev, NULL);
+
+	kobject_put(&dispatcher->kobj);
+
+	kmem_cache_destroy(jobs_cache);
+
+	clear_bit(ADRENO_DISPATCHER_INIT, &dispatcher->priv);
+}
+
+struct dispatcher_attribute {
+	struct attribute attr;
+	ssize_t (*show)(struct adreno_dispatcher *dispatcher,
+			struct dispatcher_attribute *attr, char *buf);
+	ssize_t (*store)(struct adreno_dispatcher *dispatcher,
+			struct dispatcher_attribute *attr, const char *buf,
+			size_t count);
+	unsigned int max;
+	unsigned int *value;
+};
+
+#define DISPATCHER_UINT_ATTR(_name, _mode, _max, _value) \
+	struct dispatcher_attribute dispatcher_attr_##_name =  { \
+		.attr = { .name = __stringify(_name), .mode = _mode }, \
+		.show = _show_uint, \
+		.store = _store_uint, \
+		.max = _max, \
+		.value = &(_value), \
+	}
+
+#define to_dispatcher_attr(_a) \
+	container_of((_a), struct dispatcher_attribute, attr)
+#define to_dispatcher(k) container_of(k, struct adreno_dispatcher, kobj)
+
+static ssize_t _store_uint(struct adreno_dispatcher *dispatcher,
+		struct dispatcher_attribute *attr,
+		const char *buf, size_t size)
+{
+	unsigned int val = 0;
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	if (!val || (attr->max && (val > attr->max)))
+		return -EINVAL;
+
+	*((unsigned int *) attr->value) = val;
+	return size;
+}
+
+static ssize_t _show_uint(struct adreno_dispatcher *dispatcher,
+		struct dispatcher_attribute *attr,
+		char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%u\n",
+		*((unsigned int *) attr->value));
+}
+
+static DISPATCHER_UINT_ATTR(inflight, 0644, ADRENO_DISPATCH_DRAWQUEUE_SIZE,
+	_dispatcher_q_inflight_hi);
+
+static DISPATCHER_UINT_ATTR(inflight_low_latency, 0644,
+	ADRENO_DISPATCH_DRAWQUEUE_SIZE, _dispatcher_q_inflight_lo);
+/*
+ * Our code that "puts back" a command from the context is much cleaner
+ * if we are sure that there will always be enough room in the
+ * ringbuffer so restrict the maximum size of the context queue to
+ * ADRENO_CONTEXT_DRAWQUEUE_SIZE - 1
+ */
+static DISPATCHER_UINT_ATTR(context_drawqueue_size, 0644,
+	ADRENO_CONTEXT_DRAWQUEUE_SIZE - 1, _context_drawqueue_size);
+static DISPATCHER_UINT_ATTR(context_burst_count, 0644, 0,
+	_context_drawobj_burst);
+static DISPATCHER_UINT_ATTR(drawobj_timeout, 0644, 0,
+	adreno_drawobj_timeout);
+static DISPATCHER_UINT_ATTR(context_queue_wait, 0644, 0, _context_queue_wait);
+static DISPATCHER_UINT_ATTR(fault_detect_interval, 0644, 0,
+	_fault_timer_interval);
+static DISPATCHER_UINT_ATTR(fault_throttle_time, 0644, 0,
+	_fault_throttle_time);
+static DISPATCHER_UINT_ATTR(fault_throttle_burst, 0644, 0,
+	_fault_throttle_burst);
+
+static struct attribute *dispatcher_attrs[] = {
+	&dispatcher_attr_inflight.attr,
+	&dispatcher_attr_inflight_low_latency.attr,
+	&dispatcher_attr_context_drawqueue_size.attr,
+	&dispatcher_attr_context_burst_count.attr,
+	&dispatcher_attr_drawobj_timeout.attr,
+	&dispatcher_attr_context_queue_wait.attr,
+	&dispatcher_attr_fault_detect_interval.attr,
+	&dispatcher_attr_fault_throttle_time.attr,
+	&dispatcher_attr_fault_throttle_burst.attr,
+	NULL,
+};
+
+ATTRIBUTE_GROUPS(dispatcher);
+
+static ssize_t dispatcher_sysfs_show(struct kobject *kobj,
+				   struct attribute *attr, char *buf)
+{
+	struct adreno_dispatcher *dispatcher = to_dispatcher(kobj);
+	struct dispatcher_attribute *pattr = to_dispatcher_attr(attr);
+	ssize_t ret = -EIO;
+
+	if (pattr->show)
+		ret = pattr->show(dispatcher, pattr, buf);
+
+	return ret;
+}
+
+static ssize_t dispatcher_sysfs_store(struct kobject *kobj,
+				    struct attribute *attr,
+				    const char *buf, size_t count)
+{
+	struct adreno_dispatcher *dispatcher = to_dispatcher(kobj);
+	struct dispatcher_attribute *pattr = to_dispatcher_attr(attr);
+	ssize_t ret = -EIO;
+
+	if (pattr->store)
+		ret = pattr->store(dispatcher, pattr, buf, count);
+
+	return ret;
+}
+
+static const struct sysfs_ops dispatcher_sysfs_ops = {
+	.show = dispatcher_sysfs_show,
+	.store = dispatcher_sysfs_store
+};
+
+static struct kobj_type ktype_dispatcher = {
+	.sysfs_ops = &dispatcher_sysfs_ops,
+	.default_groups = dispatcher_groups,
+};
+
+static const struct adreno_dispatch_ops swsched_ops = {
+	.close = adreno_dispatcher_close,
+	.queue_cmds = adreno_dispatcher_queue_cmds,
+	.setup_context = adreno_dispatcher_setup_context,
+	.queue_context = adreno_dispatcher_queue_context,
+	.fault = adreno_dispatcher_fault,
+};
+
+/**
+ * adreno_dispatcher_init() - Initialize the dispatcher
+ * @adreno_dev: pointer to the adreno device structure
+ *
+ * Initialize the dispatcher
+ */
+int adreno_dispatcher_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	int ret, i;
+
+	if (test_bit(ADRENO_DISPATCHER_INIT, &dispatcher->priv))
+		return 0;
+
+	ret = kobject_init_and_add(&dispatcher->kobj, &ktype_dispatcher,
+		&device->dev->kobj, "dispatch");
+	if (ret)
+		return ret;
+
+	dispatcher->worker = kthread_create_worker(0, "kgsl_dispatcher");
+	if (IS_ERR(dispatcher->worker)) {
+		kobject_put(&dispatcher->kobj);
+		return PTR_ERR(dispatcher->worker);
+	}
+
+	WARN_ON(sysfs_create_files(&device->dev->kobj, _dispatch_attr_list));
+
+	mutex_init(&dispatcher->mutex);
+
+	timer_setup(&dispatcher->timer, adreno_dispatcher_timer, 0);
+
+	kthread_init_work(&dispatcher->work, adreno_dispatcher_work);
+
+	init_completion(&dispatcher->idle_gate);
+	complete_all(&dispatcher->idle_gate);
+
+	jobs_cache = KMEM_CACHE(adreno_dispatch_job, 0);
+
+	for (i = 0; i < ARRAY_SIZE(dispatcher->jobs); i++) {
+		init_llist_head(&dispatcher->jobs[i]);
+		init_llist_head(&dispatcher->requeue[i]);
+	}
+
+	adreno_set_dispatch_ops(adreno_dev, &swsched_ops);
+
+	sched_set_fifo(dispatcher->worker->task);
+
+	set_bit(ADRENO_DISPATCHER_INIT, &dispatcher->priv);
+
+	return 0;
+}
+
+/*
+ * adreno_dispatcher_idle() - Wait for dispatcher to idle
+ * @adreno_dev: Adreno device whose dispatcher needs to idle
+ *
+ * Signal dispatcher to stop sending more commands and complete
+ * the commands that have already been submitted. This function
+ * should not be called when dispatcher mutex is held.
+ * The caller must hold the device mutex.
+ */
+int adreno_dispatcher_idle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_dispatcher *dispatcher = &adreno_dev->dispatcher;
+	int ret;
+
+	if (device->state != KGSL_STATE_ACTIVE)
+		return 0;
+
+	/*
+	 * Ensure that this function is not called when dispatcher
+	 * mutex is held and device is started
+	 */
+
+	if (WARN_ON(mutex_is_locked(&dispatcher->mutex)))
+		return -EDEADLK;
+
+	adreno_get_gpu_halt(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+
+	/*
+	 * Flush the worker to make sure all executing
+	 * or pending dispatcher works on worker are
+	 * finished
+	 */
+	kthread_flush_worker(dispatcher->worker);
+
+	ret = wait_for_completion_timeout(&dispatcher->idle_gate,
+			msecs_to_jiffies(ADRENO_IDLE_TIMEOUT));
+	if (ret == 0) {
+		ret = -ETIMEDOUT;
+		WARN(1, "Dispatcher halt timeout\n");
+	} else if (ret < 0) {
+		dev_err(device->dev, "Dispatcher halt failed %d\n", ret);
+	} else {
+		ret = 0;
+	}
+
+	mutex_lock(&device->mutex);
+	adreno_put_gpu_halt(adreno_dev);
+	/*
+	 * requeue dispatcher work to resubmit pending commands
+	 * that may have been blocked due to this idling request
+	 */
+	adreno_dispatcher_schedule(device);
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_dispatch.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_dispatch.h
@@ -0,0 +1,112 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2008-2021, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef ____ADRENO_DISPATCHER_H
+#define ____ADRENO_DISPATCHER_H
+
+#include <linux/kobject.h>
+#include <linux/kthread.h>
+#include <linux/llist.h>
+
+extern unsigned int adreno_drawobj_timeout;
+
+/*
+ * Maximum size of the dispatcher ringbuffer - the actual inflight size will be
+ * smaller then this but this size will allow for a larger range of inflight
+ * sizes that can be chosen at runtime
+ */
+
+#define ADRENO_DISPATCH_DRAWQUEUE_SIZE 128
+
+#define DRAWQUEUE_NEXT(_i, _s) (((_i) + 1) % (_s))
+
+/**
+ * struct adreno_dispatcher_drawqueue - List of commands for a RB level
+ * @cmd_q: List of command obj's submitted to dispatcher
+ * @inflight: Number of commands inflight in this q
+ * @head: Head pointer to the q
+ * @tail: Queues tail pointer
+ * @active_context_count: Number of active contexts seen in this rb drawqueue
+ * @expires: The jiffies value at which this drawqueue has run too long
+ */
+struct adreno_dispatcher_drawqueue {
+	struct kgsl_drawobj_cmd *cmd_q[ADRENO_DISPATCH_DRAWQUEUE_SIZE];
+	unsigned int inflight;
+	unsigned int head;
+	unsigned int tail;
+	int active_context_count;
+	unsigned long expires;
+};
+
+/**
+ * struct adreno_dispatch_job - An instance of work for the dispatcher
+ * @node: llist node for the list of jobs
+ * @drawctxt: A pointer to an adreno draw context
+ *
+ * This struct defines work for the dispatcher. When a drawctxt is ready to send
+ * commands it will attach itself to the appropriate list for it's priority.
+ * The dispatcher will process all jobs on each priority every time it goes
+ * through a dispatch cycle
+ */
+struct adreno_dispatch_job {
+	struct llist_node node;
+	struct adreno_context *drawctxt;
+};
+
+/**
+ * struct adreno_dispatcher - container for the adreno GPU dispatcher
+ * @mutex: Mutex to protect the structure
+ * @state: Current state of the dispatcher (active or paused)
+ * @timer: Timer to monitor the progress of the drawobjs
+ * @inflight: Number of drawobj operations pending in the ringbuffer
+ * @fault: Non-zero if a fault was detected.
+ * @pending: Priority list of contexts waiting to submit drawobjs
+ * @work: work_struct to put the dispatcher in a work queue
+ * @kobj: kobject for the dispatcher directory in the device sysfs node
+ * @idle_gate: Gate to wait on for dispatcher to idle
+ */
+struct adreno_dispatcher {
+	struct mutex mutex;
+	unsigned long priv;
+	struct timer_list timer;
+	struct timer_list fault_timer;
+	unsigned int inflight;
+	atomic_t fault;
+	/** @jobs - Array of dispatch job lists for each priority level */
+	struct llist_head jobs[16];
+	/** @requeue - Array of lists for dispatch jobs that got requeued */
+	struct llist_head requeue[16];
+	struct kthread_work work;
+	struct kobject kobj;
+	struct completion idle_gate;
+	struct kthread_worker *worker;
+};
+
+enum adreno_dispatcher_flags {
+	ADRENO_DISPATCHER_POWER = 0,
+	ADRENO_DISPATCHER_ACTIVE,
+	ADRENO_DISPATCHER_INIT,
+};
+
+struct adreno_device;
+struct kgsl_device;
+
+void adreno_dispatcher_start(struct kgsl_device *device);
+int adreno_dispatcher_init(struct adreno_device *adreno_dev);
+int adreno_dispatcher_idle(struct adreno_device *adreno_dev);
+void adreno_dispatcher_stop(struct adreno_device *adreno_dev);
+
+void adreno_dispatcher_start_fault_timer(struct adreno_device *adreno_dev);
+void adreno_dispatcher_stop_fault_timer(struct kgsl_device *device);
+
+void adreno_dispatcher_schedule(struct kgsl_device *device);
+
+/**
+ * adreno_dispatcher_fault - Set dispatcher fault to request recovery
+ * @adreno_dev: A handle to adreno device
+ * @fault: The type of fault
+ */
+void adreno_dispatcher_fault(struct adreno_device *adreno_dev, u32 fault);
+#endif /* __ADRENO_DISPATCHER_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_drawctxt.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_drawctxt.c
@@ -0,0 +1,678 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+
+#include "adreno.h"
+#include "adreno_trace.h"
+
+static void wait_callback(struct kgsl_device *device,
+		struct kgsl_event_group *group, void *priv, int result)
+{
+	struct adreno_context *drawctxt = priv;
+
+	wake_up_all(&drawctxt->waiting);
+}
+
+static int _check_context_timestamp(struct kgsl_device *device,
+		struct kgsl_context *context, unsigned int timestamp)
+{
+	/* Bail if the drawctxt has been invalidated or destroyed */
+	if (kgsl_context_is_bad(context))
+		return 1;
+
+	return kgsl_check_timestamp(device, context, timestamp);
+}
+
+/**
+ * adreno_drawctxt_dump() - dump information about a draw context
+ * @device: KGSL device that owns the context
+ * @context: KGSL context to dump information about
+ *
+ * Dump specific information about the context to the kernel log.  Used for
+ * fence timeout callbacks
+ */
+void adreno_drawctxt_dump(struct kgsl_device *device,
+		struct kgsl_context *context)
+{
+	unsigned int queue, start, retire;
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	int index, pos;
+	char buf[120];
+
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_QUEUED, &queue);
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_CONSUMED, &start);
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_RETIRED, &retire);
+
+	/*
+	 * We may have kgsl sync obj timer running, which also uses same
+	 * lock, take a lock with software interrupt disabled (bh)
+	 * to avoid spin lock recursion.
+	 *
+	 * Use Spin trylock because dispatcher can acquire drawctxt->lock
+	 * if context is pending and the fence it is waiting on just got
+	 * signalled. Dispatcher acquires drawctxt->lock and tries to
+	 * delete the sync obj timer using del_timer_sync().
+	 * del_timer_sync() waits till timer and its pending handlers
+	 * are deleted. But if the timer expires at the same time,
+	 * timer handler could be waiting on drawctxt->lock leading to a
+	 * deadlock. To prevent this use spin_trylock_bh.
+	 */
+	if (!spin_trylock_bh(&drawctxt->lock)) {
+		dev_err(device->dev, "  context[%u]: could not get lock\n",
+			context->id);
+		return;
+	}
+
+	dev_err(device->dev,
+		"  context[%u]: queue=%u, submit=%u, start=%u, retire=%u\n",
+		context->id, queue, drawctxt->submitted_timestamp,
+		start, retire);
+
+	if (drawctxt->drawqueue_head != drawctxt->drawqueue_tail) {
+		struct kgsl_drawobj *drawobj =
+			drawctxt->drawqueue[drawctxt->drawqueue_head];
+
+		if (test_bit(ADRENO_CONTEXT_FENCE_LOG, &context->priv)) {
+			dev_err(device->dev,
+				"  possible deadlock. Context %u might be blocked for itself\n",
+				context->id);
+			goto stats;
+		}
+
+		if (!kref_get_unless_zero(&drawobj->refcount))
+			goto stats;
+
+		if (drawobj->type == SYNCOBJ_TYPE) {
+			struct kgsl_drawobj_sync *syncobj = SYNCOBJ(drawobj);
+
+			if (kgsl_drawobj_events_pending(syncobj)) {
+				dev_err(device->dev,
+					"  context[%u] (ts=%u) Active sync points:\n",
+					context->id, drawobj->timestamp);
+
+				kgsl_dump_syncpoints(device, syncobj);
+			}
+		}
+
+		kgsl_drawobj_put(drawobj);
+	}
+
+stats:
+	memset(buf, 0, sizeof(buf));
+
+	pos = 0;
+
+	for (index = 0; index < SUBMIT_RETIRE_TICKS_SIZE; index++) {
+		uint64_t msecs;
+		unsigned int usecs;
+
+		if (!drawctxt->submit_retire_ticks[index])
+			continue;
+		msecs = drawctxt->submit_retire_ticks[index] * 10;
+		usecs = do_div(msecs, 192);
+		usecs = do_div(msecs, 1000);
+		pos += scnprintf(buf + pos, sizeof(buf) - pos, "%u.%0u ",
+			(unsigned int)msecs, usecs);
+	}
+	dev_err(device->dev, "  context[%u]: submit times: %s\n",
+		context->id, buf);
+
+	spin_unlock_bh(&drawctxt->lock);
+}
+
+/**
+ * adreno_drawctxt_wait() - sleep until a timestamp expires
+ * @adreno_dev: pointer to the adreno_device struct
+ * @drawctxt: Pointer to the draw context to sleep for
+ * @timetamp: Timestamp to wait on
+ * @timeout: Number of jiffies to wait (0 for infinite)
+ *
+ * Register an event to wait for a timestamp on a context and sleep until it
+ * has past.  Returns < 0 on error, -ETIMEDOUT if the timeout expires or 0
+ * on success
+ */
+int adreno_drawctxt_wait(struct adreno_device *adreno_dev,
+		struct kgsl_context *context,
+		uint32_t timestamp, unsigned int timeout)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	int ret;
+	long ret_temp;
+
+	if (kgsl_context_detached(context))
+		return -ENOENT;
+
+	if (kgsl_context_invalid(context))
+		return -EDEADLK;
+
+	trace_adreno_drawctxt_wait_start(-1, context->id, timestamp);
+
+	ret = kgsl_add_event(device, &context->events, timestamp,
+		wait_callback, (void *) drawctxt);
+	if (ret)
+		goto done;
+
+	/*
+	 * If timeout is 0, wait forever. msecs_to_jiffies will force
+	 * values larger than INT_MAX to an infinite timeout.
+	 */
+	if (timeout == 0)
+		timeout = UINT_MAX;
+
+	ret_temp = wait_event_interruptible_timeout(drawctxt->waiting,
+			_check_context_timestamp(device, context, timestamp),
+			msecs_to_jiffies(timeout));
+
+	if (ret_temp == 0) {
+		ret = -ETIMEDOUT;
+		goto done;
+	} else if (ret_temp < 0) {
+		ret = (int) ret_temp;
+		goto done;
+	}
+	ret = 0;
+
+	/* -EDEADLK if the context was invalidated while we were waiting */
+	if (kgsl_context_invalid(context))
+		ret = -EDEADLK;
+
+
+	/* Return -EINVAL if the context was detached while we were waiting */
+	if (kgsl_context_detached(context))
+		ret = -ENOENT;
+
+done:
+	trace_adreno_drawctxt_wait_done(-1, context->id, timestamp, ret);
+	return ret;
+}
+
+/**
+ * adreno_drawctxt_wait_rb() - Wait for the last RB timestamp at which this
+ * context submitted a command to the corresponding RB
+ * @adreno_dev: The device on which the timestamp is active
+ * @context: The context which subbmitted command to RB
+ * @timestamp: The RB timestamp of last command submitted to RB by context
+ * @timeout: Timeout value for the wait
+ * Caller must hold the device mutex
+ */
+static int adreno_drawctxt_wait_rb(struct adreno_device *adreno_dev,
+		struct kgsl_context *context,
+		uint32_t timestamp, unsigned int timeout)
+{
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	int ret = 0;
+
+	/*
+	 * If the context is invalid (OR) not submitted commands to GPU
+	 * then return immediately - we may end up waiting for a timestamp
+	 * that will never come
+	 */
+	if (kgsl_context_invalid(context) ||
+			!test_bit(KGSL_CONTEXT_PRIV_SUBMITTED, &context->priv))
+		goto done;
+
+	trace_adreno_drawctxt_wait_start(drawctxt->rb->id, context->id,
+					timestamp);
+
+	ret = adreno_ringbuffer_waittimestamp(drawctxt->rb, timestamp, timeout);
+done:
+	trace_adreno_drawctxt_wait_done(drawctxt->rb->id, context->id,
+					timestamp, ret);
+	return ret;
+}
+
+static int drawctxt_detach_drawobjs(struct adreno_context *drawctxt,
+		struct kgsl_drawobj **list)
+{
+	int count = 0;
+
+	while (drawctxt->drawqueue_head != drawctxt->drawqueue_tail) {
+		struct kgsl_drawobj *drawobj =
+			drawctxt->drawqueue[drawctxt->drawqueue_head];
+
+		drawctxt->drawqueue_head = (drawctxt->drawqueue_head + 1) %
+			ADRENO_CONTEXT_DRAWQUEUE_SIZE;
+
+		list[count++] = drawobj;
+	}
+
+	return count;
+}
+
+/**
+ * adreno_drawctxt_invalidate() - Invalidate an adreno draw context
+ * @device: Pointer to the KGSL device structure for the GPU
+ * @context: Pointer to the KGSL context structure
+ *
+ * Invalidate the context and remove all queued commands and cancel any pending
+ * waiters
+ */
+void adreno_drawctxt_invalidate(struct kgsl_device *device,
+		struct kgsl_context *context)
+{
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	struct kgsl_drawobj *list[ADRENO_CONTEXT_DRAWQUEUE_SIZE];
+	int i, count;
+
+	trace_adreno_drawctxt_invalidate(drawctxt);
+
+	spin_lock(&drawctxt->lock);
+	set_bit(KGSL_CONTEXT_PRIV_INVALID, &context->priv);
+
+	/*
+	 * set the timestamp to the last value since the context is invalidated
+	 * and we want the pending events for this context to go away
+	 */
+	kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, soptimestamp),
+			drawctxt->timestamp);
+
+	kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, eoptimestamp),
+			drawctxt->timestamp);
+
+	/* Get rid of commands still waiting in the queue */
+	count = drawctxt_detach_drawobjs(drawctxt, list);
+	spin_unlock(&drawctxt->lock);
+
+	for (i = 0; i < count; i++) {
+		kgsl_cancel_events_timestamp(device, &context->events,
+			list[i]->timestamp);
+		kgsl_drawobj_destroy(list[i]);
+	}
+
+	/* Make sure all pending events are processed or cancelled */
+	kgsl_flush_event_group(device, &context->events);
+
+	/* Give the bad news to everybody waiting around */
+	wake_up_all(&drawctxt->waiting);
+	wake_up_all(&drawctxt->wq);
+	wake_up_all(&drawctxt->timeout);
+}
+
+void adreno_drawctxt_set_guilty(struct kgsl_device *device,
+		struct kgsl_context *context)
+{
+	if (!context)
+		return;
+
+	context->reset_status = KGSL_CTX_STAT_GUILTY_CONTEXT_RESET_EXT;
+
+	adreno_drawctxt_invalidate(device, context);
+}
+
+#define KGSL_CONTEXT_PRIORITY_MED	0x8
+
+/**
+ * adreno_drawctxt_create - create a new adreno draw context
+ * @dev_priv: the owner of the context
+ * @flags: flags for the context (passed from user space)
+ *
+ * Create and return a new draw context for the 3D core.
+ */
+struct kgsl_context *
+adreno_drawctxt_create(struct kgsl_device_private *dev_priv,
+			uint32_t *flags)
+{
+	struct adreno_context *drawctxt;
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	int ret;
+	unsigned int local;
+
+	local = *flags & (KGSL_CONTEXT_PREAMBLE |
+		KGSL_CONTEXT_NO_GMEM_ALLOC |
+		KGSL_CONTEXT_PER_CONTEXT_TS |
+		KGSL_CONTEXT_USER_GENERATED_TS |
+		KGSL_CONTEXT_NO_FAULT_TOLERANCE |
+		KGSL_CONTEXT_INVALIDATE_ON_FAULT |
+		KGSL_CONTEXT_CTX_SWITCH |
+		KGSL_CONTEXT_PRIORITY_MASK |
+		KGSL_CONTEXT_TYPE_MASK |
+		KGSL_CONTEXT_PWR_CONSTRAINT |
+		KGSL_CONTEXT_IFH_NOP |
+		KGSL_CONTEXT_SECURE |
+		KGSL_CONTEXT_PREEMPT_STYLE_MASK |
+		KGSL_CONTEXT_LPAC |
+		KGSL_CONTEXT_NO_SNAPSHOT |
+		KGSL_CONTEXT_FAULT_INFO);
+
+	/* Check for errors before trying to initialize */
+
+	/* If preemption is not supported, ignore preemption request */
+	if (!adreno_preemption_feature_set(adreno_dev))
+		local &= ~KGSL_CONTEXT_PREEMPT_STYLE_MASK;
+
+	/* We no longer support legacy context switching */
+	if ((local & KGSL_CONTEXT_PREAMBLE) == 0 ||
+		(local & KGSL_CONTEXT_NO_GMEM_ALLOC) == 0) {
+		dev_err_once(device->dev,
+			"legacy context switch not supported\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	/* Make sure that our target can support secure contexts if requested */
+	if (!kgsl_mmu_is_secured(&dev_priv->device->mmu) &&
+			(local & KGSL_CONTEXT_SECURE)) {
+		dev_err_once(device->dev, "Secure context not supported\n");
+		return ERR_PTR(-EOPNOTSUPP);
+	}
+
+	if ((local & KGSL_CONTEXT_LPAC) &&
+			(!(adreno_dev->lpac_enabled))) {
+		dev_err_once(device->dev, "LPAC context not supported\n");
+		return ERR_PTR(-EOPNOTSUPP);
+	}
+
+	if ((local & KGSL_CONTEXT_LPAC) && (local & KGSL_CONTEXT_SECURE)) {
+		dev_err_once(device->dev, "LPAC secure context not supported\n");
+		return ERR_PTR(-EOPNOTSUPP);
+	}
+
+	drawctxt = kzalloc(sizeof(struct adreno_context), GFP_KERNEL);
+
+	if (drawctxt == NULL)
+		return ERR_PTR(-ENOMEM);
+
+	drawctxt->timestamp = 0;
+
+	drawctxt->base.flags = local;
+
+	/* Always enable per-context timestamps */
+	drawctxt->base.flags |= KGSL_CONTEXT_PER_CONTEXT_TS;
+	drawctxt->type = (drawctxt->base.flags & KGSL_CONTEXT_TYPE_MASK)
+		>> KGSL_CONTEXT_TYPE_SHIFT;
+	spin_lock_init(&drawctxt->lock);
+	init_waitqueue_head(&drawctxt->wq);
+	init_waitqueue_head(&drawctxt->waiting);
+	init_waitqueue_head(&drawctxt->timeout);
+
+	/* If the priority is not set by user, set it for them */
+	if ((drawctxt->base.flags & KGSL_CONTEXT_PRIORITY_MASK) ==
+			KGSL_CONTEXT_PRIORITY_UNDEF)
+		drawctxt->base.flags |= (KGSL_CONTEXT_PRIORITY_MED <<
+				KGSL_CONTEXT_PRIORITY_SHIFT);
+
+	/* Store the context priority */
+	drawctxt->base.priority =
+		(drawctxt->base.flags & KGSL_CONTEXT_PRIORITY_MASK) >>
+		KGSL_CONTEXT_PRIORITY_SHIFT;
+
+	/*
+	 * Now initialize the common part of the context. This allocates the
+	 * context id, and then possibly another thread could look it up.
+	 * So we want all of our initializtion that doesn't require the context
+	 * id to be done before this call.
+	 */
+	ret = kgsl_context_init(dev_priv, &drawctxt->base);
+	if (ret != 0) {
+		kfree(drawctxt);
+		return ERR_PTR(ret);
+	}
+
+	kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(drawctxt->base.id, soptimestamp),
+			0);
+	kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(drawctxt->base.id, eoptimestamp),
+			0);
+
+	adreno_context_debugfs_init(ADRENO_DEVICE(device), drawctxt);
+
+	INIT_LIST_HEAD(&drawctxt->active_node);
+	INIT_LIST_HEAD(&drawctxt->hw_fence_list);
+	INIT_LIST_HEAD(&drawctxt->hw_fence_inflight_list);
+
+	if (adreno_dev->dispatch_ops && adreno_dev->dispatch_ops->setup_context)
+		adreno_dev->dispatch_ops->setup_context(adreno_dev, drawctxt);
+
+	if (gpudev->preemption_context_init) {
+		ret = gpudev->preemption_context_init(&drawctxt->base);
+		if (ret != 0) {
+			kgsl_context_detach(&drawctxt->base);
+			return ERR_PTR(ret);
+		}
+	}
+
+	/* copy back whatever flags we dediced were valid */
+	*flags = drawctxt->base.flags;
+
+	return &drawctxt->base;
+}
+
+static void wait_for_timestamp_rb(struct kgsl_device *device,
+	struct adreno_context *drawctxt)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_context *context = &drawctxt->base;
+	int ret;
+
+	/*
+	 * internal_timestamp is set in adreno_ringbuffer_addcmds,
+	 * which holds the device mutex.
+	 */
+	mutex_lock(&device->mutex);
+
+	/*
+	 * Wait for the last global timestamp to pass before continuing.
+	 * The maxumum wait time is 30s, some large IB's can take longer
+	 * than 10s and if hang happens then the time for the context's
+	 * commands to retire will be greater than 10s. 30s should be sufficient
+	 * time to wait for the commands even if a hang happens.
+	 */
+	ret = adreno_drawctxt_wait_rb(adreno_dev, &drawctxt->base,
+		drawctxt->internal_timestamp, 30 * 1000);
+
+	/*
+	 * If the wait for global fails due to timeout then mark it as
+	 * context detach timeout fault and schedule dispatcher to kick
+	 * in GPU recovery. For a ADRENO_CTX_DETATCH_TIMEOUT_FAULT we clear
+	 * the policy and invalidate the context. If EAGAIN error is returned
+	 * then recovery will kick in and there will be no more commands in the
+	 * RB pipe from this context which is what we are waiting for, so ignore
+	 * -EAGAIN error.
+	 */
+	if (ret && ret != -EAGAIN) {
+		dev_err(device->dev,
+				"Wait for global ctx=%u ts=%u type=%d error=%d\n",
+				drawctxt->base.id, drawctxt->internal_timestamp,
+				drawctxt->type, ret);
+
+		adreno_set_gpu_fault(adreno_dev,
+				ADRENO_CTX_DETATCH_TIMEOUT_FAULT);
+		mutex_unlock(&device->mutex);
+
+		/* Schedule dispatcher to kick in recovery */
+		adreno_dispatcher_schedule(device);
+
+		/* Wait for context to be invalidated and release context */
+		wait_event_interruptible_timeout(drawctxt->timeout,
+					kgsl_context_invalid(&drawctxt->base),
+					msecs_to_jiffies(5000));
+		return;
+	}
+
+	kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, soptimestamp),
+			drawctxt->timestamp);
+
+	kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, eoptimestamp),
+			drawctxt->timestamp);
+
+	adreno_profile_process_results(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+}
+
+void adreno_drawctxt_detach(struct kgsl_context *context)
+{
+	struct kgsl_device *device;
+	struct adreno_device *adreno_dev;
+	const struct adreno_gpudev *gpudev;
+	struct adreno_context *drawctxt;
+	int count, i;
+	struct kgsl_drawobj *list[ADRENO_CONTEXT_DRAWQUEUE_SIZE];
+
+	if (context == NULL)
+		return;
+
+	device = context->device;
+	adreno_dev = ADRENO_DEVICE(device);
+	gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	drawctxt = ADRENO_CONTEXT(context);
+
+	spin_lock(&drawctxt->lock);
+
+	spin_lock(&adreno_dev->active_list_lock);
+	list_del_init(&drawctxt->active_node);
+	spin_unlock(&adreno_dev->active_list_lock);
+
+	count = drawctxt_detach_drawobjs(drawctxt, list);
+	spin_unlock(&drawctxt->lock);
+
+	for (i = 0; i < count; i++) {
+		/*
+		 * If the context is detached while we are waiting for
+		 * the next command in GFT SKIP CMD, print the context
+		 * detached status here.
+		 */
+		adreno_fault_skipcmd_detached(adreno_dev, drawctxt, list[i]);
+		kgsl_drawobj_destroy(list[i]);
+	}
+
+	debugfs_remove_recursive(drawctxt->debug_root);
+	/* The debugfs file has a reference, release it */
+	if (drawctxt->debug_root)
+		kgsl_context_put(context);
+
+	if (gpudev->context_detach)
+		gpudev->context_detach(drawctxt);
+	else
+		wait_for_timestamp_rb(device, drawctxt);
+
+	if (context->user_ctxt_record) {
+		gpumem_free_entry(context->user_ctxt_record);
+
+		/* Put the extra ref from gpumem_alloc_entry() */
+		kgsl_mem_entry_put(context->user_ctxt_record);
+	}
+
+	/* wake threads waiting to submit commands from this context */
+	wake_up_all(&drawctxt->waiting);
+	wake_up_all(&drawctxt->wq);
+}
+
+void adreno_drawctxt_destroy(struct kgsl_context *context)
+{
+	struct adreno_context *drawctxt;
+	struct adreno_device *adreno_dev;
+	const struct adreno_gpudev *gpudev;
+
+	if (context == NULL)
+		return;
+
+	drawctxt = ADRENO_CONTEXT(context);
+
+	adreno_dev = ADRENO_DEVICE(context->device);
+	gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (gpudev->context_destroy)
+		gpudev->context_destroy(adreno_dev, drawctxt);
+	kfree(drawctxt);
+}
+
+static void _drawctxt_switch_wait_callback(struct kgsl_device *device,
+		struct kgsl_event_group *group,
+		void *priv, int result)
+{
+	struct adreno_context *drawctxt = (struct adreno_context *) priv;
+
+	kgsl_context_put(&drawctxt->base);
+}
+
+void adreno_put_drawctxt_on_timestamp(struct kgsl_device *device,
+		struct adreno_context *drawctxt,
+		struct adreno_ringbuffer *rb, u32 timestamp)
+{
+	if (!drawctxt)
+		return;
+
+	if (kgsl_add_event(device, &rb->events, timestamp,
+		_drawctxt_switch_wait_callback, drawctxt))
+		kgsl_context_put(&drawctxt->base);
+}
+
+static void _add_context(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt)
+{
+	/* Remove it from the list */
+	list_del_init(&drawctxt->active_node);
+
+	/* And push it to the front */
+	drawctxt->active_time = jiffies;
+	list_add(&drawctxt->active_node, &adreno_dev->active_list);
+}
+
+static int __count_context(struct adreno_context *drawctxt, void *data)
+{
+	unsigned long expires = drawctxt->active_time + msecs_to_jiffies(100);
+
+	return time_after(jiffies, expires) ? 0 : 1;
+}
+
+static int __count_drawqueue_context(struct adreno_context *drawctxt,
+				void *data)
+{
+	unsigned long expires = drawctxt->active_time + msecs_to_jiffies(100);
+
+	if (time_after(jiffies, expires))
+		return 0;
+
+	return (&drawctxt->rb->dispatch_q ==
+			(struct adreno_dispatcher_drawqueue *) data) ? 1 : 0;
+}
+
+static int _adreno_count_active_contexts(struct adreno_device *adreno_dev,
+		int (*func)(struct adreno_context *, void *), void *data)
+{
+	struct adreno_context *ctxt;
+	int count = 0;
+
+	list_for_each_entry(ctxt, &adreno_dev->active_list, active_node) {
+		if (func(ctxt, data) == 0)
+			return count;
+
+		count++;
+	}
+
+	return count;
+}
+
+void adreno_track_context(struct adreno_device *adreno_dev,
+		struct adreno_dispatcher_drawqueue *drawqueue,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	spin_lock(&adreno_dev->active_list_lock);
+
+	_add_context(adreno_dev, drawctxt);
+
+	device->active_context_count =
+			_adreno_count_active_contexts(adreno_dev,
+					__count_context, NULL);
+
+	if (drawqueue)
+		drawqueue->active_context_count =
+				_adreno_count_active_contexts(adreno_dev,
+					__count_drawqueue_context, drawqueue);
+
+	spin_unlock(&adreno_dev->active_list_lock);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_drawctxt.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_drawctxt.h
@@ -0,0 +1,206 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2002,2007-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_DRAWCTXT_H
+#define __ADRENO_DRAWCTXT_H
+
+#include <linux/types.h>
+
+#include "kgsl_device.h"
+
+struct adreno_context_type {
+	unsigned int type;
+	const char *str;
+};
+
+#define ADRENO_CONTEXT_DRAWQUEUE_SIZE 128
+#define SUBMIT_RETIRE_TICKS_SIZE 7
+
+struct kgsl_device;
+struct adreno_device;
+struct kgsl_device_private;
+
+/**
+ * struct adreno_context - Adreno GPU draw context
+ * @timestamp: Last issued context-specific timestamp
+ * @internal_timestamp: Global timestamp of the last issued command
+ *			NOTE: guarded by device->mutex, not drawctxt->mutex!
+ * @type: Context type (GL, CL, RS)
+ * @mutex: Mutex to protect the drawqueue
+ * @drawqueue: Queue of drawobjs waiting to be dispatched for this
+ *			context
+ * @drawqueue_head: Head of the drawqueue queue
+ * @drawqueue_tail: Tail of the drawqueue queue
+ * @wq: Workqueue structure for contexts to sleep pending room in the queue
+ * @waiting: Workqueue structure for contexts waiting for a timestamp or event
+ * @timeout: Workqueue structure for contexts waiting to invalidate
+ * @queued: Number of commands queued in the drawqueue
+ * @fault_policy: GFT fault policy set in _skip_cmd();
+ * @debug_root: debugfs entry for this context.
+ * @queued_timestamp: The last timestamp that was queued on this context
+ * @rb: The ringbuffer in which this context submits commands.
+ * @submitted_timestamp: The last timestamp that was submitted for this context
+ * @submit_retire_ticks: Array to hold command obj execution times from submit
+ *                       to retire
+ * @ticks_index: The index into submit_retire_ticks[] where the new delta will
+ *		 be written.
+ * @active_node: Linkage for nodes in active_list
+ * @active_time: Time when this context last seen
+ */
+struct adreno_context {
+	struct kgsl_context base;
+	unsigned int timestamp;
+	unsigned int internal_timestamp;
+	unsigned int type;
+	spinlock_t lock;
+
+	/* Dispatcher */
+	struct kgsl_drawobj *drawqueue[ADRENO_CONTEXT_DRAWQUEUE_SIZE];
+	unsigned int drawqueue_head;
+	unsigned int drawqueue_tail;
+
+	wait_queue_head_t wq;
+	wait_queue_head_t waiting;
+	wait_queue_head_t timeout;
+
+	int queued;
+	unsigned int fault_policy;
+	struct dentry *debug_root;
+	unsigned int queued_timestamp;
+	struct adreno_ringbuffer *rb;
+	unsigned int submitted_timestamp;
+	uint64_t submit_retire_ticks[SUBMIT_RETIRE_TICKS_SIZE];
+	int ticks_index;
+
+	struct list_head active_node;
+	unsigned long active_time;
+	/** @gmu_context_queue: Queue to dispatch submissions to GMU */
+	struct kgsl_memdesc gmu_context_queue;
+	/** @gmu_hw_fence_queue: Queue for GMU to store hardware fences for this context */
+	struct kgsl_memdesc gmu_hw_fence_queue;
+	/** @hw_fence_list: List of hardware fences(sorted by timestamp) not yet submitted to GMU */
+	struct list_head hw_fence_list;
+	/** @hw_fence_inflight_list: List of hardware fences submitted to GMU */
+	struct list_head hw_fence_inflight_list;
+	/** @hw_fence_count: Number of hardware fences not yet sent to Tx Queue */
+	u32 hw_fence_count;
+	/** @syncobj_timestamp: Timestamp to check whether GMU has consumed a syncobj */
+	u32 syncobj_timestamp;
+};
+
+/* Flag definitions for flag field in adreno_context */
+
+/**
+ * enum adreno_context_priv - Private flags for an adreno draw context
+ * @ADRENO_CONTEXT_FAULT - set if the context has faulted (and recovered)
+ * @ADRENO_CONTEXT_GPU_HANG - Context has caused a GPU hang
+ * @ADRENO_CONTEXT_GPU_HANG_FT - Context has caused a GPU hang
+ *      and fault tolerance was successful
+ * @ADRENO_CONTEXT_SKIP_EOF - Context skip IBs until the next end of frame
+ *      marker.
+ * @ADRENO_CONTEXT_FORCE_PREAMBLE - Force the preamble for the next submission.
+ * @ADRENO_CONTEXT_SKIP_CMD - Context's drawobj's skipped during
+	fault tolerance.
+ * @ADRENO_CONTEXT_FENCE_LOG - Dump fences on this context.
+ */
+enum adreno_context_priv {
+	ADRENO_CONTEXT_FAULT = KGSL_CONTEXT_PRIV_DEVICE_SPECIFIC,
+	ADRENO_CONTEXT_GPU_HANG,
+	ADRENO_CONTEXT_GPU_HANG_FT,
+	ADRENO_CONTEXT_SKIP_EOF,
+	ADRENO_CONTEXT_FORCE_PREAMBLE,
+	ADRENO_CONTEXT_SKIP_CMD,
+	ADRENO_CONTEXT_FENCE_LOG,
+};
+
+struct kgsl_context *adreno_drawctxt_create(
+			struct kgsl_device_private *dev_priv,
+			uint32_t *flags);
+
+void adreno_drawctxt_detach(struct kgsl_context *context);
+
+void adreno_drawctxt_destroy(struct kgsl_context *context);
+
+struct adreno_ringbuffer;
+struct adreno_dispatcher_drawqueue;
+
+int adreno_drawctxt_wait(struct adreno_device *adreno_dev,
+		struct kgsl_context *context,
+		uint32_t timestamp, unsigned int timeout);
+
+void adreno_drawctxt_invalidate(struct kgsl_device *device,
+		struct kgsl_context *context);
+
+void adreno_drawctxt_dump(struct kgsl_device *device,
+		struct kgsl_context *context);
+
+/**
+ * adreno_drawctxt_detached - Helper function to check if a context is detached
+ * @drawctxt: Adreno drawctxt to check
+ *
+ * Return: True if the context isn't null and it has been detached
+ */
+static inline bool adreno_drawctxt_detached(struct adreno_context *drawctxt)
+{
+	return (drawctxt && kgsl_context_detached(&drawctxt->base));
+}
+
+/**
+ * adreno_put_drawctxt_on_timestamp - Put the refcount on the drawctxt when the
+ * timestamp expires
+ * @device: A KGSL device handle
+ * @drawctxt: The draw context to put away
+ * @rb: The ringbuffer that will trigger the timestamp event
+ * @timestamp: The timestamp on @rb that will trigger the event
+ *
+ * Add an event to put the refcount on @drawctxt after @timestamp expires on
+ * @rb. This is used by the context switch to safely put away the context after
+ * a new context is switched in.
+ */
+void adreno_put_drawctxt_on_timestamp(struct kgsl_device *device,
+		struct adreno_context *drawctxt,
+		struct adreno_ringbuffer *rb, u32 timestamp);
+
+/**
+ * adreno_drawctxt_get_pagetable - Helper function to return the pagetable for a
+ * context
+ * @drawctxt: The adreno draw context to query
+ *
+ * Return: A pointer to the pagetable for the process that owns the context or
+ * NULL
+ */
+static inline struct kgsl_pagetable *
+adreno_drawctxt_get_pagetable(struct adreno_context *drawctxt)
+{
+	if (drawctxt)
+		return drawctxt->base.proc_priv->pagetable;
+
+	return NULL;
+}
+
+/**
+ * adreno_drawctxt_set_guilty - Mark a context as guilty and invalidate it
+ * @device: Pointer to a GPU device handle
+ * @context: Poniter to the context to invalidate
+ *
+ * Mark the specified context as guilty and invalidate it
+ */
+void adreno_drawctxt_set_guilty(struct kgsl_device *device,
+		struct kgsl_context *context);
+
+/**
+ * adreno_track_context - Add a context to active list and keep track of active contexts
+ * @adreno_dev: Pointer to adreno device
+ * @drawqueue: Pointer to the dispatch queue to which context send commands
+ * @drawctxt: Draw context which is to be tracked
+ *
+ * Add the given draw context to the active list and update number of contexts which
+ * are active overall as well as which are active on the dispatch queue to which
+ * the given context sends commands.
+ */
+void adreno_track_context(struct adreno_device *adreno_dev,
+		struct adreno_dispatcher_drawqueue *drawqueue,
+		struct adreno_context *drawctxt);
+#endif  /* __ADRENO_DRAWCTXT_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7.c
@@ -0,0 +1,2174 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_fdt.h>
+#include <linux/of_device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+#include <soc/qcom/of_common.h>
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_gen7_hwsched.h"
+#include "adreno_pm4types.h"
+#include "adreno_trace.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+/* IFPC & Preemption static powerup restore list */
+static const u32 gen7_pwrup_reglist[] = {
+	GEN7_UCHE_TRAP_BASE_LO,
+	GEN7_UCHE_TRAP_BASE_HI,
+	GEN7_UCHE_WRITE_THRU_BASE_LO,
+	GEN7_UCHE_WRITE_THRU_BASE_HI,
+	GEN7_UCHE_GMEM_RANGE_MIN_LO,
+	GEN7_UCHE_GMEM_RANGE_MIN_HI,
+	GEN7_UCHE_GMEM_RANGE_MAX_LO,
+	GEN7_UCHE_GMEM_RANGE_MAX_HI,
+	GEN7_UCHE_CACHE_WAYS,
+	GEN7_UCHE_MODE_CNTL,
+	GEN7_RB_NC_MODE_CNTL,
+	GEN7_RB_CMP_DBG_ECO_CNTL,
+	GEN7_GRAS_NC_MODE_CNTL,
+	GEN7_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE,
+	GEN7_UCHE_GBIF_GX_CONFIG,
+	GEN7_UCHE_CLIENT_PF,
+	GEN7_TPL1_DBG_ECO_CNTL1,
+};
+
+static const u32 gen7_0_0_pwrup_reglist[] = {
+	GEN7_UCHE_TRAP_BASE_LO,
+	GEN7_UCHE_TRAP_BASE_HI,
+	GEN7_UCHE_WRITE_THRU_BASE_LO,
+	GEN7_UCHE_WRITE_THRU_BASE_HI,
+	GEN7_UCHE_GMEM_RANGE_MIN_LO,
+	GEN7_UCHE_GMEM_RANGE_MIN_HI,
+	GEN7_UCHE_GMEM_RANGE_MAX_LO,
+	GEN7_UCHE_GMEM_RANGE_MAX_HI,
+	GEN7_UCHE_CACHE_WAYS,
+	GEN7_UCHE_MODE_CNTL,
+	GEN7_RB_NC_MODE_CNTL,
+	GEN7_RB_CMP_DBG_ECO_CNTL,
+	GEN7_SP_NC_MODE_CNTL,
+	GEN7_GRAS_NC_MODE_CNTL,
+	GEN7_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE,
+	GEN7_UCHE_GBIF_GX_CONFIG,
+	GEN7_UCHE_CLIENT_PF,
+};
+
+/* IFPC only static powerup restore list */
+static const u32 gen7_ifpc_pwrup_reglist[] = {
+	GEN7_TPL1_NC_MODE_CNTL,
+	GEN7_SP_NC_MODE_CNTL,
+	GEN7_CP_DBG_ECO_CNTL,
+	GEN7_CP_PROTECT_CNTL,
+	GEN7_CP_LPAC_PROTECT_CNTL,
+	GEN7_CP_PROTECT_REG,
+	GEN7_CP_PROTECT_REG+1,
+	GEN7_CP_PROTECT_REG+2,
+	GEN7_CP_PROTECT_REG+3,
+	GEN7_CP_PROTECT_REG+4,
+	GEN7_CP_PROTECT_REG+5,
+	GEN7_CP_PROTECT_REG+6,
+	GEN7_CP_PROTECT_REG+7,
+	GEN7_CP_PROTECT_REG+8,
+	GEN7_CP_PROTECT_REG+9,
+	GEN7_CP_PROTECT_REG+10,
+	GEN7_CP_PROTECT_REG+11,
+	GEN7_CP_PROTECT_REG+12,
+	GEN7_CP_PROTECT_REG+13,
+	GEN7_CP_PROTECT_REG+14,
+	GEN7_CP_PROTECT_REG+15,
+	GEN7_CP_PROTECT_REG+16,
+	GEN7_CP_PROTECT_REG+17,
+	GEN7_CP_PROTECT_REG+18,
+	GEN7_CP_PROTECT_REG+19,
+	GEN7_CP_PROTECT_REG+20,
+	GEN7_CP_PROTECT_REG+21,
+	GEN7_CP_PROTECT_REG+22,
+	GEN7_CP_PROTECT_REG+23,
+	GEN7_CP_PROTECT_REG+24,
+	GEN7_CP_PROTECT_REG+25,
+	GEN7_CP_PROTECT_REG+26,
+	GEN7_CP_PROTECT_REG+27,
+	GEN7_CP_PROTECT_REG+28,
+	GEN7_CP_PROTECT_REG+29,
+	GEN7_CP_PROTECT_REG+30,
+	GEN7_CP_PROTECT_REG+31,
+	GEN7_CP_PROTECT_REG+32,
+	GEN7_CP_PROTECT_REG+33,
+	GEN7_CP_PROTECT_REG+34,
+	GEN7_CP_PROTECT_REG+35,
+	GEN7_CP_PROTECT_REG+36,
+	GEN7_CP_PROTECT_REG+37,
+	GEN7_CP_PROTECT_REG+38,
+	GEN7_CP_PROTECT_REG+39,
+	GEN7_CP_PROTECT_REG+40,
+	GEN7_CP_PROTECT_REG+41,
+	GEN7_CP_PROTECT_REG+42,
+	GEN7_CP_PROTECT_REG+43,
+	GEN7_CP_PROTECT_REG+44,
+	GEN7_CP_PROTECT_REG+45,
+	GEN7_CP_PROTECT_REG+46,
+	GEN7_CP_PROTECT_REG+47,
+	GEN7_CP_AHB_CNTL,
+};
+
+static const u32 gen7_0_0_ifpc_pwrup_reglist[] = {
+	GEN7_TPL1_NC_MODE_CNTL,
+	GEN7_CP_DBG_ECO_CNTL,
+	GEN7_CP_PROTECT_CNTL,
+	GEN7_CP_LPAC_PROTECT_CNTL,
+	GEN7_CP_PROTECT_REG,
+	GEN7_CP_PROTECT_REG+1,
+	GEN7_CP_PROTECT_REG+2,
+	GEN7_CP_PROTECT_REG+3,
+	GEN7_CP_PROTECT_REG+4,
+	GEN7_CP_PROTECT_REG+5,
+	GEN7_CP_PROTECT_REG+6,
+	GEN7_CP_PROTECT_REG+7,
+	GEN7_CP_PROTECT_REG+8,
+	GEN7_CP_PROTECT_REG+9,
+	GEN7_CP_PROTECT_REG+10,
+	GEN7_CP_PROTECT_REG+11,
+	GEN7_CP_PROTECT_REG+12,
+	GEN7_CP_PROTECT_REG+13,
+	GEN7_CP_PROTECT_REG+14,
+	GEN7_CP_PROTECT_REG+15,
+	GEN7_CP_PROTECT_REG+16,
+	GEN7_CP_PROTECT_REG+17,
+	GEN7_CP_PROTECT_REG+18,
+	GEN7_CP_PROTECT_REG+19,
+	GEN7_CP_PROTECT_REG+20,
+	GEN7_CP_PROTECT_REG+21,
+	GEN7_CP_PROTECT_REG+22,
+	GEN7_CP_PROTECT_REG+23,
+	GEN7_CP_PROTECT_REG+24,
+	GEN7_CP_PROTECT_REG+25,
+	GEN7_CP_PROTECT_REG+26,
+	GEN7_CP_PROTECT_REG+27,
+	GEN7_CP_PROTECT_REG+28,
+	GEN7_CP_PROTECT_REG+29,
+	GEN7_CP_PROTECT_REG+30,
+	GEN7_CP_PROTECT_REG+31,
+	GEN7_CP_PROTECT_REG+32,
+	GEN7_CP_PROTECT_REG+33,
+	GEN7_CP_PROTECT_REG+34,
+	GEN7_CP_PROTECT_REG+35,
+	GEN7_CP_PROTECT_REG+36,
+	GEN7_CP_PROTECT_REG+37,
+	GEN7_CP_PROTECT_REG+38,
+	GEN7_CP_PROTECT_REG+39,
+	GEN7_CP_PROTECT_REG+40,
+	GEN7_CP_PROTECT_REG+41,
+	GEN7_CP_PROTECT_REG+42,
+	GEN7_CP_PROTECT_REG+43,
+	GEN7_CP_PROTECT_REG+44,
+	GEN7_CP_PROTECT_REG+45,
+	GEN7_CP_PROTECT_REG+46,
+	GEN7_CP_PROTECT_REG+47,
+	GEN7_CP_AHB_CNTL,
+};
+
+/* Gen7_9_x IFPC only static powerup restore list */
+static const u32 gen7_9_x_ifpc_pwrup_reglist[] = {
+	GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_1,
+	GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_2,
+	GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_3,
+	GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_4,
+};
+
+#define F_PWR_ACD_CALIBRATE 78
+
+static int acd_calibrate_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 debug_val = (u32) val;
+	int ret;
+
+	mutex_lock(&device->mutex);
+	ret = adreno_active_count_get(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_set_value(adreno_dev, HFI_VALUE_DBG, F_PWR_ACD_CALIBRATE, debug_val);
+	if (!ret)
+		gmu->acd_debug_val = debug_val;
+
+	adreno_active_count_put(adreno_dev);
+err:
+	mutex_unlock(&device->mutex);
+	return ret;
+}
+
+static int acd_calibrate_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	*val = (u64) gmu->acd_debug_val;
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(acd_cal_fops, acd_calibrate_get, acd_calibrate_set, "%llu\n");
+
+void gen7_cp_init_cmds(struct adreno_device *adreno_dev, u32 *cmds)
+{
+	u32 i = 0, mask = 0;
+
+	/* Disable concurrent binning before sending CP init */
+	cmds[i++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	cmds[i++] = BIT(27);
+
+	/* Use multiple HW contexts */
+	mask |= BIT(0);
+
+	/* Enable error detection */
+	mask |= BIT(1);
+
+	/* Set default reset state */
+	mask |= BIT(3);
+
+	/* Disable save/restore of performance counters across preemption */
+	mask |= BIT(6);
+
+	/* Enable the register init list with the spinlock */
+	mask |= BIT(8);
+
+	/* By default DMS is enabled from CP side, disable it if not supported */
+	if (!adreno_dev->dms_enabled)
+		mask |= BIT(11);
+
+	cmds[i++] = cp_type7_packet(CP_ME_INIT, 7);
+
+	/* Enabled ordinal mask */
+	cmds[i++] = mask;
+	cmds[i++] = 0x00000003; /* Set number of HW contexts */
+	cmds[i++] = 0x20000000; /* Enable error detection */
+	cmds[i++] = 0x00000002; /* Operation mode mask */
+
+	/* Register initialization list with spinlock */
+	cmds[i++] = lower_32_bits(adreno_dev->pwrup_reglist->gpuaddr);
+	cmds[i++] = upper_32_bits(adreno_dev->pwrup_reglist->gpuaddr);
+	/*
+	 * Gen7 targets with concurrent binning are expected to have a dynamic
+	 * power up list with triplets which contains the pipe id in it.
+	 * Bit 31 of POWER_UP_REGISTER_LIST_LENGTH is reused here to let CP
+	 * know if the power up contains the triplets. If
+	 * REGISTER_INIT_LIST_WITH_SPINLOCK is set and bit 31 below is set,
+	 * CP expects a dynamic list with triplets.
+	 */
+	cmds[i++] = BIT(31);
+}
+
+int gen7_fenced_write(struct adreno_device *adreno_dev, u32 offset,
+		u32 value, u32 mask)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	unsigned int status, i;
+	u64 ts1, ts2;
+
+	kgsl_regwrite(device, offset, value);
+	ts1 = gpudev->read_alwayson(adreno_dev);
+	for (i = 0; i < GMU_CORE_LONG_WAKEUP_RETRY_LIMIT; i++) {
+		/*
+		 * Make sure the previous register write is posted before
+		 * checking the fence status
+		 */
+		mb();
+
+		gmu_core_regread(device, GEN7_GMU_AHB_FENCE_STATUS, &status);
+
+		/*
+		 * If !writedropped0/1, then the write to fenced register
+		 * was successful
+		 */
+		if (!(status & mask))
+			break;
+
+		/* Wait a small amount of time before trying again */
+		udelay(GMU_CORE_WAKEUP_DELAY_US);
+
+		/* Try to write the fenced register again */
+		kgsl_regwrite(device, offset, value);
+	}
+
+	if (i < GMU_CORE_SHORT_WAKEUP_RETRY_LIMIT)
+		return 0;
+
+	if (i == GMU_CORE_LONG_WAKEUP_RETRY_LIMIT) {
+		ts2 = gpudev->read_alwayson(adreno_dev);
+		dev_err(device->dev,
+				"Timed out waiting %d usecs to write fenced register 0x%x, timestamps: %llx %llx\n",
+				i * GMU_CORE_WAKEUP_DELAY_US, offset, ts1, ts2);
+		return -ETIMEDOUT;
+	}
+
+	dev_info(device->dev,
+		"Waited %d usecs to write fenced register 0x%x\n",
+		i * GMU_CORE_WAKEUP_DELAY_US, offset);
+
+	return 0;
+}
+
+int gen7_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	u64 freq = gen7_core->gmu_hub_clk_freq;
+
+	adreno_dev->highest_bank_bit = gen7_core->highest_bank_bit;
+	adreno_dev->gmu_hub_clk_freq = freq ? freq : 150000000;
+	adreno_dev->bcl_data = gen7_core->bcl_data;
+
+	adreno_dev->cooperative_reset = ADRENO_FEATURE(adreno_dev,
+			ADRENO_COOP_RESET);
+
+	/* If the memory type is DDR 4, override the existing configuration */
+	if (get_ddrtype() == 0x7)
+		adreno_dev->highest_bank_bit = 14;
+	/*todo handle case when get_ddrtype() returns negative value ? */
+
+	gen7_crashdump_init(adreno_dev);
+
+	return adreno_allocate_global(device, &adreno_dev->pwrup_reglist,
+		PAGE_SIZE, 0, 0, KGSL_MEMDESC_PRIVILEGED,
+		"powerup_register_list");
+}
+
+#define CX_TIMER_INIT_SAMPLES 16
+void gen7_cx_timer_init(struct adreno_device *adreno_dev)
+{
+	u64 seed_val, tmr, skew = 0;
+	int i;
+	unsigned long flags;
+
+	/* Only gen7_9_x has the CX timer. Set it up just once */
+	if (!adreno_is_gen7_9_x(adreno_dev) ||
+		test_bit(ADRENO_DEVICE_CX_TIMER_INITIALIZED, &adreno_dev->priv))
+		return;
+
+	/* Disable irqs to get accurate timings */
+	local_irq_save(flags);
+
+	/* Calculate the overhead of timer reads and register writes */
+	for (i = 0; i < CX_TIMER_INIT_SAMPLES; i++) {
+		u64 tmr1, tmr2, tmr3;
+
+		/* Measure time for two reads of the CPU timer */
+		tmr1 = arch_timer_read_counter();
+		tmr2 = arch_timer_read_counter();
+
+		/* Write to the register and time it */
+		adreno_cx_misc_regwrite(adreno_dev,
+					GEN7_GPU_CX_MISC_AO_COUNTER_LO,
+					lower_32_bits(tmr2));
+		adreno_cx_misc_regwrite(adreno_dev,
+					GEN7_GPU_CX_MISC_AO_COUNTER_HI,
+					upper_32_bits(tmr2));
+
+		/* Barrier to make sure the write completes before timing it */
+		mb();
+		tmr3 = arch_timer_read_counter();
+
+		/* Calculate difference between register write and CPU timer */
+		skew += (tmr3 - tmr2) - (tmr2 - tmr1);
+	}
+
+	local_irq_restore(flags);
+
+	/* Get the average over all our readings, to the closest integer */
+	skew = (skew + CX_TIMER_INIT_SAMPLES / 2) / CX_TIMER_INIT_SAMPLES;
+
+	local_irq_save(flags);
+	tmr = arch_timer_read_counter();
+
+	seed_val = tmr + skew;
+
+	/* Seed the GPU CX counter with the adjusted timer */
+	adreno_cx_misc_regwrite(adreno_dev,
+			GEN7_GPU_CX_MISC_AO_COUNTER_LO, lower_32_bits(seed_val));
+	adreno_cx_misc_regwrite(adreno_dev,
+			GEN7_GPU_CX_MISC_AO_COUNTER_HI, upper_32_bits(seed_val));
+
+	local_irq_restore(flags);
+
+	set_bit(ADRENO_DEVICE_CX_TIMER_INITIALIZED, &adreno_dev->priv);
+}
+
+void gen7_get_gpu_feature_info(struct adreno_device *adreno_dev)
+{
+	u32 feature_fuse = 0;
+
+	/* Only Gen7_9_x has the HW feature information */
+	if (!adreno_is_gen7_9_x(adreno_dev))
+		return;
+
+	/* Get HW feature soft fuse value */
+	adreno_cx_misc_regread(adreno_dev, GEN7_GPU_CX_MISC_SW_FUSE_VALUE,
+			       &feature_fuse);
+
+	adreno_dev->fastblend_enabled = feature_fuse & BIT(GEN7_FASTBLEND_SW_FUSE);
+	adreno_dev->raytracing_enabled = feature_fuse & BIT(GEN7_RAYTRACING_SW_FUSE);
+
+	/* If software enables LPAC without HW support, disable it */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_LPAC))
+		adreno_dev->lpac_enabled = feature_fuse & BIT(GEN7_LPAC_SW_FUSE);
+
+	adreno_dev->feature_fuse = feature_fuse;
+}
+
+#define GEN7_PROTECT_DEFAULT (BIT(0) | BIT(1) | BIT(3))
+static void gen7_protect_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	const struct gen7_protected_regs *regs = gen7_core->protected_regs;
+	int i;
+
+	/*
+	 * Enable access protection to privileged registers, fault on an access
+	 * protect violation and select the last span to protect from the start
+	 * address all the way to the end of the register address space
+	 */
+	kgsl_regwrite(device, GEN7_CP_PROTECT_CNTL, GEN7_PROTECT_DEFAULT);
+
+	if (adreno_dev->lpac_enabled)
+		kgsl_regwrite(device, GEN7_CP_LPAC_PROTECT_CNTL, GEN7_PROTECT_DEFAULT);
+
+	/* Program each register defined by the core definition */
+	for (i = 0; regs[i].reg; i++) {
+		u32 count;
+
+		/*
+		 * This is the offset of the end register as counted from the
+		 * start, i.e. # of registers in the range - 1
+		 */
+		count = regs[i].end - regs[i].start;
+
+		kgsl_regwrite(device, regs[i].reg,
+				FIELD_PREP(GENMASK(17, 0), regs[i].start) |
+				FIELD_PREP(GENMASK(30, 18), count) |
+				FIELD_PREP(BIT(31), regs[i].noaccess));
+	}
+}
+
+#define RBBM_CLOCK_CNTL_ON 0x8aa8aa82
+
+static void gen7_hwcg_set(struct adreno_device *adreno_dev, bool on)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	unsigned int value;
+	int i;
+
+	if (!adreno_dev->hwcg_enabled)
+		on = false;
+
+	for (i = 0; i < gen7_core->ao_hwcg_count; i++)
+		gmu_core_regwrite(device, gen7_core->ao_hwcg[i].offset,
+			on ? gen7_core->ao_hwcg[i].val : 0);
+
+	if (!gen7_core->hwcg) {
+		kgsl_regwrite(device, GEN7_RBBM_CLOCK_CNTL_GLOBAL, 1);
+		kgsl_regwrite(device, GEN7_RBBM_CGC_GLOBAL_LOAD_CMD, on ? 1 : 0);
+
+		if (on) {
+			u32 retry = 3;
+
+			kgsl_regwrite(device, GEN7_RBBM_CGC_P2S_TRIG_CMD, 1);
+			/* Poll for the TXDONE:BIT(0) status */
+			do {
+				/* Wait for small amount of time for TXDONE status*/
+				udelay(1);
+				kgsl_regread(device, GEN7_RBBM_CGC_P2S_STATUS, &value);
+			} while (!(value & BIT(0)) && --retry);
+
+			if (!(value & BIT(0))) {
+				dev_err(device->dev, "RBBM_CGC_P2S_STATUS:TXDONE Poll failed\n");
+				kgsl_device_snapshot(device, NULL, NULL, false);
+				return;
+			}
+			kgsl_regwrite(device, GEN7_RBBM_CLOCK_CNTL_GLOBAL, 0);
+		}
+		return;
+	}
+
+	kgsl_regread(device, GEN7_RBBM_CLOCK_CNTL, &value);
+
+	if (value == RBBM_CLOCK_CNTL_ON && on)
+		return;
+
+	if (value == 0 && !on)
+		return;
+
+	for (i = 0; i < gen7_core->hwcg_count; i++)
+		kgsl_regwrite(device, gen7_core->hwcg[i].offset,
+			on ? gen7_core->hwcg[i].val : 0);
+
+	/* enable top level HWCG */
+	kgsl_regwrite(device, GEN7_RBBM_CLOCK_CNTL,
+		on ? RBBM_CLOCK_CNTL_ON : 0);
+}
+
+static void gen7_patch_pwrup_reglist(struct adreno_device *adreno_dev)
+{
+	struct adreno_reglist_list reglist[3];
+	void *ptr = adreno_dev->pwrup_reglist->hostptr;
+	struct cpu_gpu_lock *lock = ptr;
+	u32 items = 0, i, j;
+	u32 *dest = ptr + sizeof(*lock);
+
+	/* Static IFPC-only registers */
+	if (adreno_is_gen7_0_x_family(adreno_dev)) {
+		reglist[items].regs = gen7_0_0_ifpc_pwrup_reglist;
+		reglist[items].count = ARRAY_SIZE(gen7_0_0_ifpc_pwrup_reglist);
+	} else {
+		reglist[items].regs = gen7_ifpc_pwrup_reglist;
+		reglist[items].count = ARRAY_SIZE(gen7_ifpc_pwrup_reglist);
+	}
+	lock->ifpc_list_len = reglist[items].count;
+	items++;
+
+	if (adreno_is_gen7_9_x(adreno_dev)) {
+		reglist[items].regs = gen7_9_x_ifpc_pwrup_reglist;
+		reglist[items].count = ARRAY_SIZE(gen7_9_x_ifpc_pwrup_reglist);
+		lock->ifpc_list_len += reglist[items].count;
+		items++;
+	}
+
+	/* Static IFPC + preemption registers */
+	if (adreno_is_gen7_0_x_family(adreno_dev)) {
+		reglist[items].regs = gen7_0_0_pwrup_reglist;
+		reglist[items].count = ARRAY_SIZE(gen7_0_0_pwrup_reglist);
+	} else {
+		reglist[items].regs = gen7_pwrup_reglist;
+		reglist[items].count = ARRAY_SIZE(gen7_pwrup_reglist);
+	}
+	lock->preemption_list_len = reglist[items].count;
+	items++;
+
+	/*
+	 * For each entry in each of the lists, write the offset and the current
+	 * register value into the GPU buffer
+	 */
+	for (i = 0; i < items; i++) {
+		const u32 *r = reglist[i].regs;
+
+		for (j = 0; j < reglist[i].count; j++) {
+			*dest++ = r[j];
+			kgsl_regread(KGSL_DEVICE(adreno_dev), r[j], dest++);
+		}
+	}
+
+	/*
+	 * The overall register list is composed of
+	 * 1. Static IFPC-only registers
+	 * 2. Static IFPC + preemption registers
+	 * 3. Dynamic IFPC + preemption registers (ex: perfcounter selects)
+	 *
+	 * The first two lists are static. Size of these lists are stored as
+	 * number of pairs in ifpc_list_len and preemption_list_len
+	 * respectively. With concurrent binning, Some of the perfcounter
+	 * registers being virtualized, CP needs to know the pipe id to program
+	 * the aperture inorder to restore the same. Thus, third list is a
+	 * dynamic list with triplets as
+	 * (<aperture, shifted 12 bits> <address> <data>), and the length is
+	 * stored as number for triplets in dynamic_list_len.
+	 */
+	lock->dynamic_list_len = 0;
+}
+
+/* _llc_configure_gpu_scid() - Program the sub-cache ID for all GPU blocks */
+static void _llc_configure_gpu_scid(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 gpu_scid;
+
+	if (IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice) ||
+		!adreno_dev->gpu_llc_slice_enable)
+		return;
+
+	if (llcc_slice_activate(adreno_dev->gpu_llc_slice))
+		return;
+
+	gpu_scid = llcc_get_slice_id(adreno_dev->gpu_llc_slice);
+
+	/* 6 blocks at 5 bits per block */
+	kgsl_regwrite(device, GEN7_GBIF_SCACHE_CNTL1,
+			FIELD_PREP(GENMASK(29, 25), gpu_scid) |
+			FIELD_PREP(GENMASK(24, 20), gpu_scid) |
+			FIELD_PREP(GENMASK(19, 15), gpu_scid) |
+			FIELD_PREP(GENMASK(14, 10), gpu_scid) |
+			FIELD_PREP(GENMASK(9, 5), gpu_scid) |
+			FIELD_PREP(GENMASK(4, 0), gpu_scid));
+
+	kgsl_regwrite(device, GEN7_GBIF_SCACHE_CNTL0,
+			FIELD_PREP(GENMASK(14, 10), gpu_scid) | BIT(8));
+}
+
+static void _llc_gpuhtw_slice_activate(struct adreno_device *adreno_dev)
+{
+	if (IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice) ||
+		!adreno_dev->gpuhtw_llc_slice_enable)
+		return;
+
+	llcc_slice_activate(adreno_dev->gpuhtw_llc_slice);
+}
+
+static void _set_secvid(struct kgsl_device *device)
+{
+	kgsl_regwrite(device, GEN7_RBBM_SECVID_TSB_CNTL, 0x0);
+	kgsl_regwrite(device, GEN7_RBBM_SECVID_TSB_TRUSTED_BASE_LO,
+		lower_32_bits(KGSL_IOMMU_SECURE_BASE32));
+	kgsl_regwrite(device, GEN7_RBBM_SECVID_TSB_TRUSTED_BASE_HI,
+		upper_32_bits(KGSL_IOMMU_SECURE_BASE32));
+	kgsl_regwrite(device, GEN7_RBBM_SECVID_TSB_TRUSTED_SIZE,
+		FIELD_PREP(GENMASK(31, 12),
+		(KGSL_IOMMU_SECURE_SIZE(&device->mmu) / SZ_4K)));
+}
+
+/* Set UCHE_TRAP_BASE to a page below the top of the memory space */
+#define GEN7_UCHE_TRAP_BASE 0x1FFFFFFFFF000ULL
+
+static u64 gen7_get_uche_trap_base(void)
+{
+	return GEN7_UCHE_TRAP_BASE;
+}
+
+/*
+ * All Gen7 targets support marking certain transactions as always privileged
+ * which allows us to mark more memory as privileged without having to
+ * explicitly set the APRIV bit. Choose the following transactions to be
+ * privileged by default:
+ * CDWRITE     [6:6] - Crashdumper writes
+ * CDREAD      [5:5] - Crashdumper reads
+ * RBRPWB      [3:3] - RPTR shadow writes
+ * RBPRIVLEVEL [2:2] - Memory accesses from PM4 packets in the ringbuffer
+ * RBFETCH     [1:1] - Ringbuffer reads
+ * ICACHE      [0:0] - Instruction cache fetches
+ */
+
+#define GEN7_APRIV_DEFAULT (BIT(3) | BIT(2) | BIT(1) | BIT(0))
+/* Add crashdumper permissions for the BR APRIV */
+#define GEN7_BR_APRIV_DEFAULT (GEN7_APRIV_DEFAULT | BIT(6) | BIT(5))
+
+int gen7_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	u32 mal, mode = 0, rgb565_predicator = 0;
+	/*
+	 * HBB values 13 to 16 can represented LSB of HBB from 0 to 3.
+	 * Any HBB value beyond 16 needs programming MSB of HBB.
+	 * By default highest bank bit is 14, Hence set default HBB LSB
+	 * to "1" and MSB to "0".
+	 */
+	u32 hbb_lo = 1, hbb_hi = 0;
+	struct cpu_gpu_lock *pwrup_lock = adreno_dev->pwrup_reglist->hostptr;
+	u64 uche_trap_base = gen7_get_uche_trap_base();
+
+	/* Set up GBIF registers from the GPU core definition */
+	kgsl_regmap_multi_write(&device->regmap, gen7_core->gbif,
+		gen7_core->gbif_count);
+
+	kgsl_regwrite(device, GEN7_UCHE_GBIF_GX_CONFIG, 0x10240e0);
+
+	/* Make all blocks contribute to the GPU BUSY perf counter */
+	kgsl_regwrite(device, GEN7_RBBM_PERFCTR_GPU_BUSY_MASKED, 0xffffffff);
+
+	/*
+	 * Set UCHE_WRITE_THRU_BASE to the UCHE_TRAP_BASE effectively
+	 * disabling L2 bypass
+	 */
+	kgsl_regwrite(device, GEN7_UCHE_TRAP_BASE_LO, lower_32_bits(uche_trap_base));
+	kgsl_regwrite(device, GEN7_UCHE_TRAP_BASE_HI, upper_32_bits(uche_trap_base));
+	kgsl_regwrite(device, GEN7_UCHE_WRITE_THRU_BASE_LO, lower_32_bits(uche_trap_base));
+	kgsl_regwrite(device, GEN7_UCHE_WRITE_THRU_BASE_HI, upper_32_bits(uche_trap_base));
+
+	/*
+	 * Some gen7 targets don't use a programmed UCHE GMEM base address,
+	 * so skip programming the register for such targets.
+	 */
+	if (adreno_dev->uche_gmem_base) {
+		kgsl_regwrite(device, GEN7_UCHE_GMEM_RANGE_MIN_LO,
+				adreno_dev->uche_gmem_base);
+		kgsl_regwrite(device, GEN7_UCHE_GMEM_RANGE_MIN_HI, 0x0);
+		kgsl_regwrite(device, GEN7_UCHE_GMEM_RANGE_MAX_LO,
+				adreno_dev->uche_gmem_base +
+				adreno_dev->gpucore->gmem_size - 1);
+		kgsl_regwrite(device, GEN7_UCHE_GMEM_RANGE_MAX_HI, 0x0);
+	}
+
+	kgsl_regwrite(device, GEN7_UCHE_CACHE_WAYS, 0x800000);
+
+	/*
+	 * Disable LPAC hard sync event to fix lock up issue when BR/BV event
+	 * fifo is full.
+	 */
+	if (adreno_dev->lpac_enabled)
+		kgsl_regrmw(device, GEN7_UCHE_DBG_CNTL_1, BIT(30), BIT(30));
+
+	kgsl_regwrite(device, GEN7_UCHE_CMDQ_CONFIG,
+			FIELD_PREP(GENMASK(19, 16), 6) |
+			FIELD_PREP(GENMASK(15, 12), 6) |
+			FIELD_PREP(GENMASK(11, 8), 9) |
+			BIT(3) | BIT(2) |
+			FIELD_PREP(GENMASK(1, 0), 2));
+
+	/*
+	 * CP takes care of the restore during IFPC exit. We need to restore at slumber
+	 * boundary as well
+	 */
+	if (pwrup_lock->dynamic_list_len > 0)
+		kgsl_regwrite(device, GEN7_RBBM_PERFCTR_CNTL, 0x1);
+
+	/* Turn on the IFPC counter (countable 4 on XOCLK4) */
+	kgsl_regwrite(device, GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_1,
+			FIELD_PREP(GENMASK(7, 0), 0x4));
+
+	/* Turn on counter to count total time spent in BCL throttle */
+	if (adreno_dev->bcl_enabled && adreno_is_gen7_2_x_family(adreno_dev))
+		kgsl_regrmw(device, GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_1, GENMASK(15, 8),
+				FIELD_PREP(GENMASK(15, 8), 0x26));
+
+	if (of_property_read_u32(device->pdev->dev.of_node,
+		"qcom,min-access-length", &mal))
+		mal = 32;
+
+	of_property_read_u32(device->pdev->dev.of_node,
+			"qcom,ubwc-mode", &mode);
+
+	if (!WARN_ON(!adreno_dev->highest_bank_bit)) {
+		hbb_lo = (adreno_dev->highest_bank_bit - 13) & 3;
+		hbb_hi = ((adreno_dev->highest_bank_bit - 13) >> 2) & 1;
+	}
+
+	if (mode == KGSL_UBWC_4_0)
+		rgb565_predicator = 1;
+
+	kgsl_regwrite(device, GEN7_RB_NC_MODE_CNTL,
+			((rgb565_predicator == 1) ? BIT(11) : 0) |
+			((hbb_hi == 1) ? BIT(10) : 0) |
+			BIT(4) | /*AMSBC is enabled on UBWC 3.0 and 4.0 */
+			((mal == 64) ? BIT(3) : 0) |
+			FIELD_PREP(GENMASK(2, 1), hbb_lo));
+
+	kgsl_regwrite(device, GEN7_TPL1_NC_MODE_CNTL,
+			((hbb_hi == 1) ? BIT(4) : 0) |
+			((mal == 64) ? BIT(3) : 0) |
+			FIELD_PREP(GENMASK(2, 1), hbb_lo));
+
+	/* Configure TP bicubic registers */
+	if (adreno_is_gen7_9_x(adreno_dev)) {
+		kgsl_regwrite(device, GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_1, 0x3fe05ff4);
+		kgsl_regwrite(device, GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_2, 0x3fa0ebee);
+		kgsl_regwrite(device, GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_3, 0x3f5193ed);
+		kgsl_regwrite(device, GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_4, 0x3f0243f0);
+	}
+
+	kgsl_regwrite(device, GEN7_SP_NC_MODE_CNTL,
+			FIELD_PREP(GENMASK(11, 10), hbb_hi) |
+			FIELD_PREP(GENMASK(5, 4), 2) |
+			((mal == 64) ? BIT(3) : 0) |
+			FIELD_PREP(GENMASK(2, 1), hbb_lo));
+
+	kgsl_regwrite(device, GEN7_GRAS_NC_MODE_CNTL,
+			FIELD_PREP(GENMASK(8, 5),
+				(adreno_dev->highest_bank_bit - 13)));
+
+	kgsl_regwrite(device, GEN7_UCHE_MODE_CNTL,
+			((mal == 64) ? BIT(23) : 0) |
+			FIELD_PREP(GENMASK(22, 21), hbb_lo));
+
+	kgsl_regwrite(device, GEN7_RBBM_INTERFACE_HANG_INT_CNTL, BIT(30) |
+			FIELD_PREP(GENMASK(27, 0),
+				gen7_core->hang_detect_cycles));
+	kgsl_regwrite(device, GEN7_UCHE_CLIENT_PF, BIT(7) |
+			FIELD_PREP(GENMASK(3, 0), adreno_dev->uche_client_pf));
+
+	/* Enable the GMEM save/restore feature for preemption */
+	if (adreno_is_preemption_enabled(adreno_dev))
+		kgsl_regwrite(device, GEN7_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE,
+			0x1);
+
+	if (adreno_is_gen7_9_x(adreno_dev)) {
+		/* Disable ubwc merged UFC request feature */
+		kgsl_regrmw(device, GEN7_RB_CMP_DBG_ECO_CNTL, BIT(19), BIT(19));
+
+		/* Enable TP flaghint and other performance settings */
+		kgsl_regwrite(device, GEN7_TPL1_DBG_ECO_CNTL1, 0xc0700);
+	} else {
+		/* Disable non-ubwc read reqs from passing write reqs */
+		kgsl_regrmw(device, GEN7_RB_CMP_DBG_ECO_CNTL, BIT(11), BIT(11));
+	}
+
+	/* Enable GMU power counter 0 to count GPU busy */
+	kgsl_regwrite(device, GEN7_GPU_GMU_AO_GPU_CX_BUSY_MASK, 0xff000000);
+	kgsl_regrmw(device, GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_0,
+			0xFF, 0x20);
+	kgsl_regwrite(device, GEN7_GMU_CX_GMU_POWER_COUNTER_ENABLE, 0x1);
+
+	gen7_protect_init(adreno_dev);
+
+	/* Configure LLCC */
+	_llc_configure_gpu_scid(adreno_dev);
+	_llc_gpuhtw_slice_activate(adreno_dev);
+
+	kgsl_regwrite(device, GEN7_CP_APRIV_CNTL, GEN7_BR_APRIV_DEFAULT);
+	kgsl_regwrite(device, GEN7_CP_BV_APRIV_CNTL, GEN7_APRIV_DEFAULT);
+	kgsl_regwrite(device, GEN7_CP_LPAC_APRIV_CNTL, GEN7_APRIV_DEFAULT);
+
+	/* Marking AQE Instruction cache fetches as privileged */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_AQE))
+		kgsl_regwrite(device, GEN7_CP_AQE_APRIV_CNTL, BIT(0));
+
+	/*
+	 * CP Icache prefetch brings no benefit on few gen7 variants because of
+	 * the prefetch granularity size.
+	 */
+	if (adreno_is_gen7_0_0(adreno_dev) || adreno_is_gen7_0_1(adreno_dev) ||
+		adreno_is_gen7_4_0(adreno_dev) || adreno_is_gen7_2_0(adreno_dev)
+		|| adreno_is_gen7_2_1(adreno_dev)) {
+		kgsl_regwrite(device, GEN7_CP_CHICKEN_DBG, 0x1);
+		kgsl_regwrite(device, GEN7_CP_BV_CHICKEN_DBG, 0x1);
+		kgsl_regwrite(device, GEN7_CP_LPAC_CHICKEN_DBG, 0x1);
+	}
+
+	_set_secvid(device);
+
+	/*
+	 * Enable hardware clock gating here to prevent any register access
+	 * issue due to internal clock gating.
+	 */
+	gen7_hwcg_set(adreno_dev, true);
+
+	/*
+	 * All registers must be written before this point so that we don't
+	 * miss any register programming when we patch the power up register
+	 * list.
+	 */
+	if (!adreno_dev->patch_reglist &&
+		(adreno_dev->pwrup_reglist->gpuaddr != 0)) {
+		gen7_patch_pwrup_reglist(adreno_dev);
+		adreno_dev->patch_reglist = true;
+	}
+
+	return 0;
+}
+
+/* Offsets into the MX/CX mapped register regions */
+#define GEN7_RDPM_MX_OFFSET 0xf00
+#define GEN7_RDPM_CX_OFFSET 0xf14
+
+void gen7_rdpm_mx_freq_update(struct gen7_gmu_device *gmu, u32 freq)
+{
+	if (gmu->rdpm_mx_virt) {
+		writel_relaxed(freq/1000, (gmu->rdpm_mx_virt + GEN7_RDPM_MX_OFFSET));
+
+		/*
+		 * ensure previous writes post before this one,
+		 * i.e. act like normal writel()
+		 */
+		wmb();
+	}
+}
+
+void gen7_rdpm_cx_freq_update(struct gen7_gmu_device *gmu, u32 freq)
+{
+	if (gmu->rdpm_cx_virt) {
+		writel_relaxed(freq/1000, (gmu->rdpm_cx_virt + GEN7_RDPM_CX_OFFSET));
+
+		/*
+		 * ensure previous writes post before this one,
+		 * i.e. act like normal writel()
+		 */
+		wmb();
+	}
+}
+
+int gen7_scm_gpu_init_cx_regs(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 gpu_req = GPU_ALWAYS_EN_REQ;
+	int ret;
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_BCL))
+		gpu_req |= GPU_BCL_EN_REQ;
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_CLX))
+		gpu_req |= GPU_CLX_EN_REQ;
+
+	if (adreno_is_gen7_9_x(adreno_dev))
+		gpu_req |= GPU_TSENSE_EN_REQ;
+
+	ret = kgsl_scm_gpu_init_regs(&device->pdev->dev, gpu_req);
+
+	/*
+	 * For targets that support this scm call to program BCL id , enable BCL.
+	 * For other targets, BCL is enabled after first GMU boot.
+	 */
+	if (!ret && ADRENO_FEATURE(adreno_dev, ADRENO_BCL))
+		adreno_dev->bcl_enabled = true;
+
+	/* If programming TZ CLX was successful, then program KMD owned CLX regs */
+	if (!ret && ADRENO_FEATURE(adreno_dev, ADRENO_CLX))
+		adreno_dev->clx_enabled = true;
+
+	/*
+	 * If scm call returned EOPNOTSUPP, either we are on a kernel version
+	 * lesser than 6.1 where scm call is not supported or we are sending an
+	 * empty request. Ignore the error in such cases.
+	 */
+	return (ret == -EOPNOTSUPP) ? 0 : ret;
+}
+
+void gen7_spin_idle_debug(struct adreno_device *adreno_dev,
+				const char *str)
+{
+	struct kgsl_device *device = &adreno_dev->dev;
+	unsigned int rptr, wptr;
+	unsigned int status, status3, intstatus;
+	unsigned int hwfault;
+
+	dev_err(device->dev, str);
+
+	kgsl_regread(device, GEN7_CP_RB_RPTR, &rptr);
+	kgsl_regread(device, GEN7_CP_RB_WPTR, &wptr);
+
+	kgsl_regread(device, GEN7_RBBM_STATUS, &status);
+	kgsl_regread(device, GEN7_RBBM_STATUS3, &status3);
+	kgsl_regread(device, GEN7_RBBM_INT_0_STATUS, &intstatus);
+	kgsl_regread(device, GEN7_CP_HW_FAULT, &hwfault);
+
+	dev_err(device->dev,
+		"rb=%d pos=%X/%X rbbm_status=%8.8X/%8.8X int_0_status=%8.8X\n",
+		adreno_dev->cur_rb ? adreno_dev->cur_rb->id : -1, rptr, wptr,
+		status, status3, intstatus);
+
+	dev_err(device->dev, " hwfault=%8.8X\n", hwfault);
+
+	kgsl_device_snapshot(device, NULL, NULL, false);
+}
+
+/*
+ * gen7_send_cp_init() - Initialize ringbuffer
+ * @adreno_dev: Pointer to adreno device
+ * @rb: Pointer to the ringbuffer of device
+ *
+ * Submit commands for ME initialization,
+ */
+static int gen7_send_cp_init(struct adreno_device *adreno_dev,
+			 struct adreno_ringbuffer *rb)
+{
+	unsigned int *cmds;
+	int ret;
+
+	cmds = adreno_ringbuffer_allocspace(rb, GEN7_CP_INIT_DWORDS);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	gen7_cp_init_cmds(adreno_dev, cmds);
+
+	ret = gen7_ringbuffer_submit(rb, NULL);
+	if (!ret) {
+		ret = adreno_spin_idle(adreno_dev, 2000);
+		if (ret) {
+			gen7_spin_idle_debug(adreno_dev,
+				"CP initialization failed to idle\n");
+			rb->wptr = 0;
+			rb->_wptr = 0;
+		}
+	}
+
+	return ret;
+}
+
+static int gen7_post_start(struct adreno_device *adreno_dev)
+{
+	int ret;
+	unsigned int *cmds;
+	struct adreno_ringbuffer *rb = adreno_dev->cur_rb;
+	struct adreno_preemption *preempt = &adreno_dev->preempt;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u64 kmd_postamble_addr;
+	u32 count = 9;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	kmd_postamble_addr = SCRATCH_POSTAMBLE_ADDR(KGSL_DEVICE(adreno_dev));
+	gen7_preemption_prepare_postamble(adreno_dev);
+
+	if (kgsl_mmu_is_secured(&device->mmu))
+		count += 3;
+
+	if (preempt->postamble_bootup_len)
+		count += 4;
+
+	cmds = adreno_ringbuffer_allocspace(rb, count);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	*cmds++ = cp_type7_packet(CP_SET_PSEUDO_REGISTER,
+			kgsl_mmu_is_secured(&device->mmu) ? 6 : 3);
+	*cmds++ = SET_PSEUDO_PRIV_NON_SECURE_SAVE_ADDR;
+	*cmds++ = lower_32_bits(rb->preemption_desc->gpuaddr);
+	*cmds++ = upper_32_bits(rb->preemption_desc->gpuaddr);
+
+	if (kgsl_mmu_is_secured(&device->mmu)) {
+		*cmds++ = SET_PSEUDO_PRIV_SECURE_SAVE_ADDR;
+		*cmds++ = lower_32_bits(rb->secure_preemption_desc->gpuaddr);
+		*cmds++ = upper_32_bits(rb->secure_preemption_desc->gpuaddr);
+	}
+
+	if (preempt->postamble_bootup_len) {
+		*cmds++ = cp_type7_packet(CP_SET_AMBLE, 3);
+		*cmds++ = lower_32_bits(kmd_postamble_addr);
+		*cmds++ = upper_32_bits(kmd_postamble_addr);
+		*cmds++ = FIELD_PREP(GENMASK(22, 20), CP_KMD_AMBLE_TYPE)
+			| (FIELD_PREP(GENMASK(19, 0), adreno_dev->preempt.postamble_bootup_len));
+	}
+
+	*cmds++ = cp_type7_packet(CP_CONTEXT_SWITCH_YIELD, 4);
+	*cmds++ = 0;
+	*cmds++ = 0;
+	*cmds++ = 0;
+	/* generate interrupt on preemption completion */
+	*cmds++ = 0;
+
+	ret = gen7_ringbuffer_submit(rb, NULL);
+	if (!ret) {
+		ret = adreno_spin_idle(adreno_dev, 2000);
+		if (ret)
+			gen7_spin_idle_debug(adreno_dev,
+				"hw preemption initialization failed to idle\n");
+	}
+
+	return ret;
+}
+
+int gen7_rb_start(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_SQE);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb;
+	u64 addr;
+	int ret, i;
+	unsigned int *cmds;
+
+	/* Clear all the ringbuffers */
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		memset(rb->buffer_desc->hostptr, 0xaa, KGSL_RB_SIZE);
+		kgsl_sharedmem_writel(device->scratch,
+			SCRATCH_RB_OFFSET(rb->id, rptr), 0);
+		kgsl_sharedmem_writel(device->scratch,
+			SCRATCH_RB_OFFSET(rb->id, bv_rptr), 0);
+
+		rb->wptr = 0;
+		rb->_wptr = 0;
+		rb->wptr_preempt_end = UINT_MAX;
+	}
+
+	gen7_preemption_start(adreno_dev);
+
+	/* Set up the current ringbuffer */
+	rb = ADRENO_CURRENT_RINGBUFFER(adreno_dev);
+
+	addr = SCRATCH_RB_GPU_ADDR(device, rb->id, rptr);
+	kgsl_regwrite(device, GEN7_CP_RB_RPTR_ADDR_LO, lower_32_bits(addr));
+	kgsl_regwrite(device, GEN7_CP_RB_RPTR_ADDR_HI, upper_32_bits(addr));
+
+	addr = SCRATCH_RB_GPU_ADDR(device, rb->id, bv_rptr);
+	kgsl_regwrite(device, GEN7_CP_BV_RB_RPTR_ADDR_LO, lower_32_bits(addr));
+	kgsl_regwrite(device, GEN7_CP_BV_RB_RPTR_ADDR_HI, upper_32_bits(addr));
+
+	kgsl_regwrite(device, GEN7_CP_RB_CNTL, GEN7_CP_RB_CNTL_DEFAULT);
+
+	kgsl_regwrite(device, GEN7_CP_RB_BASE,
+		lower_32_bits(rb->buffer_desc->gpuaddr));
+	kgsl_regwrite(device, GEN7_CP_RB_BASE_HI,
+		upper_32_bits(rb->buffer_desc->gpuaddr));
+
+	/* Program the ucode base for CP */
+	kgsl_regwrite(device, GEN7_CP_SQE_INSTR_BASE_LO,
+		lower_32_bits(fw->memdesc->gpuaddr));
+	kgsl_regwrite(device, GEN7_CP_SQE_INSTR_BASE_HI,
+		upper_32_bits(fw->memdesc->gpuaddr));
+
+	/* Clear the SQE_HALT to start the CP engine */
+	kgsl_regwrite(device, GEN7_CP_SQE_CNTL, 1);
+
+	ret = gen7_send_cp_init(adreno_dev, rb);
+	if (ret)
+		return ret;
+
+	ret = adreno_zap_shader_load(adreno_dev, gen7_core->zap_name);
+	if (ret)
+		return ret;
+
+	/*
+	 * Take the GPU out of secure mode. Try the zap shader if it is loaded,
+	 * otherwise just try to write directly to the secure control register
+	 */
+	if (!adreno_dev->zap_loaded)
+		kgsl_regwrite(device, GEN7_RBBM_SECVID_TRUST_CNTL, 0);
+	else {
+		cmds = adreno_ringbuffer_allocspace(rb, 2);
+		if (IS_ERR(cmds))
+			return PTR_ERR(cmds);
+
+		*cmds++ = cp_type7_packet(CP_SET_SECURE_MODE, 1);
+		*cmds++ = 0;
+
+		ret = gen7_ringbuffer_submit(rb, NULL);
+		if (!ret) {
+			ret = adreno_spin_idle(adreno_dev, 2000);
+			if (ret) {
+				gen7_spin_idle_debug(adreno_dev,
+					"Switch to unsecure failed to idle\n");
+				return ret;
+			}
+		}
+	}
+
+	return gen7_post_start(adreno_dev);
+}
+
+/*
+ * gen7_gpu_keepalive() - GMU reg write to request GPU stays on
+ * @adreno_dev: Pointer to the adreno device that has the GMU
+ * @state: State to set: true is ON, false is OFF
+ */
+static void gen7_gpu_keepalive(struct adreno_device *adreno_dev,
+		bool state)
+{
+	gmu_core_regwrite(KGSL_DEVICE(adreno_dev),
+			GEN7_GMU_GMU_PWR_COL_KEEPALIVE, state);
+}
+
+bool gen7_hw_isidle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int reg;
+
+	gmu_core_regread(device, GEN7_GPU_GMU_AO_GPU_CX_BUSY_STATUS, &reg);
+
+	/* Bit 23 is GPUBUSYIGNAHB */
+	return (reg & BIT(23)) ? false : true;
+}
+
+int gen7_microcode_read(struct adreno_device *adreno_dev)
+{
+	struct adreno_firmware *sqe_fw = ADRENO_FW(adreno_dev, ADRENO_FW_SQE);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+
+	return adreno_get_firmware(adreno_dev, gen7_core->sqefw_name, sqe_fw);
+}
+
+/* CP Interrupt bits */
+#define CP_INT_OPCODEERROR 0
+#define CP_INT_UCODEERROR 1
+#define CP_INT_CPHWFAULT 2
+#define CP_INT_REGISTERPROTECTION 4
+#define CP_INT_VSDPARITYERROR 6
+#define CP_INT_ILLEGALINSTRUCTION 7
+#define CP_INT_OPCODEERRORLPAC 8
+#define CP_INT_UCODEERRORLPAC 9
+#define CP_INT_CPHWFAULTLPAC 10
+#define CP_INT_REGISTERPROTECTIONLPAC 11
+#define CP_INT_ILLEGALINSTRUCTIONLPAC 12
+#define CP_INT_OPCODEERRORBV 13
+#define CP_INT_UCODEERRORBV 14
+#define CP_INT_CPHWFAULTBV 15
+#define CP_INT_REGISTERPROTECTIONBV 16
+#define CP_INT_ILLEGALINSTRUCTIONBV 17
+
+static void gen7_cp_hw_err_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status1, status2;
+	struct device *dev = device->dev;
+	unsigned int opcode;
+
+	kgsl_regread(device, GEN7_CP_INTERRUPT_STATUS, &status1);
+
+	if (status1 & BIT(CP_INT_OPCODEERROR)) {
+		kgsl_regwrite(device, GEN7_CP_SQE_STAT_ADDR, 1);
+		kgsl_regread(device, GEN7_CP_SQE_STAT_DATA, &opcode);
+		dev_crit_ratelimited(dev,
+			"CP opcode error interrupt | opcode=0x%8.8x\n", opcode);
+	}
+
+	if (status1 & BIT(CP_INT_UCODEERROR))
+		dev_crit_ratelimited(dev, "CP ucode error interrupt\n");
+
+	if (status1 & BIT(CP_INT_CPHWFAULT)) {
+		kgsl_regread(device, GEN7_CP_HW_FAULT, &status2);
+		dev_crit_ratelimited(dev,
+			"CP | Ringbuffer HW fault | status=%x\n", status2);
+	}
+
+	if (status1 & BIT(CP_INT_REGISTERPROTECTION)) {
+		kgsl_regread(device, GEN7_CP_PROTECT_STATUS, &status2);
+		dev_crit_ratelimited(dev,
+			"CP | Protected mode error | %s | addr=%x | status=%x\n",
+			status2 & BIT(20) ? "READ" : "WRITE",
+			status2 & 0x3ffff, status2);
+	}
+
+	if (status1 & BIT(CP_INT_VSDPARITYERROR))
+		dev_crit_ratelimited(dev, "CP VSD decoder parity error\n");
+
+	if (status1 & BIT(CP_INT_ILLEGALINSTRUCTION))
+		dev_crit_ratelimited(dev, "CP Illegal instruction error\n");
+
+	if (status1 & BIT(CP_INT_OPCODEERRORLPAC))
+		dev_crit_ratelimited(dev, "CP Opcode error LPAC\n");
+
+	if (status1 & BIT(CP_INT_UCODEERRORLPAC))
+		dev_crit_ratelimited(dev, "CP ucode error LPAC\n");
+
+	if (status1 & BIT(CP_INT_CPHWFAULTLPAC))
+		dev_crit_ratelimited(dev, "CP hw fault LPAC\n");
+
+	if (status1 & BIT(CP_INT_REGISTERPROTECTIONLPAC))
+		dev_crit_ratelimited(dev, "CP register protection LPAC\n");
+
+	if (status1 & BIT(CP_INT_ILLEGALINSTRUCTIONLPAC))
+		dev_crit_ratelimited(dev, "CP illegal instruction LPAC\n");
+
+	if (status1 & BIT(CP_INT_OPCODEERRORBV)) {
+		kgsl_regwrite(device, GEN7_CP_BV_SQE_STAT_ADDR, 1);
+		kgsl_regread(device, GEN7_CP_BV_SQE_STAT_DATA, &opcode);
+		dev_crit_ratelimited(dev, "CP opcode error BV | opcode=0x%8.8x\n", opcode);
+	}
+
+	if (status1 & BIT(CP_INT_UCODEERRORBV))
+		dev_crit_ratelimited(dev, "CP ucode error BV\n");
+
+	if (status1 & BIT(CP_INT_CPHWFAULTBV)) {
+		kgsl_regread(device, GEN7_CP_BV_HW_FAULT, &status2);
+		dev_crit_ratelimited(dev,
+			"CP BV | Ringbuffer HW fault | status=%x\n", status2);
+	}
+
+	if (status1 & BIT(CP_INT_REGISTERPROTECTIONBV)) {
+		kgsl_regread(device, GEN7_CP_BV_PROTECT_STATUS, &status2);
+		dev_crit_ratelimited(dev,
+			"CP BV | Protected mode error | %s | addr=%x | status=%x\n",
+			status2 & BIT(20) ? "READ" : "WRITE",
+			status2 & 0x3ffff, status2);
+	}
+
+	if (status1 & BIT(CP_INT_ILLEGALINSTRUCTIONBV))
+		dev_crit_ratelimited(dev, "CP illegal instruction BV\n");
+}
+
+static void gen7_err_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct device *dev = device->dev;
+
+	switch (bit) {
+	case GEN7_INT_AHBERROR:
+		{
+		u32 err_details_0, err_details_1;
+
+		kgsl_regread(device, GEN7_CP_RL_ERROR_DETAILS_0, &err_details_0);
+		kgsl_regread(device, GEN7_CP_RL_ERROR_DETAILS_1, &err_details_1);
+		dev_crit_ratelimited(dev,
+			"CP: AHB bus error, CP_RL_ERROR_DETAILS_0:0x%x CP_RL_ERROR_DETAILS_1:0x%x\n",
+			err_details_0, err_details_1);
+		break;
+		}
+	case GEN7_INT_ATBASYNCFIFOOVERFLOW:
+		dev_crit_ratelimited(dev, "RBBM: ATB ASYNC overflow\n");
+		break;
+	case GEN7_INT_ATBBUSOVERFLOW:
+		dev_crit_ratelimited(dev, "RBBM: ATB bus overflow\n");
+		break;
+	case GEN7_INT_OUTOFBOUNDACCESS:
+		dev_crit_ratelimited(dev, "UCHE: Out of bounds access\n");
+		break;
+	case GEN7_INT_UCHETRAPINTERRUPT:
+		dev_crit_ratelimited(dev, "UCHE: Trap interrupt\n");
+		break;
+	case GEN7_INT_TSBWRITEERROR:
+		{
+		u32 lo, hi;
+
+		kgsl_regread(device, GEN7_RBBM_SECVID_TSB_STATUS_LO, &lo);
+		kgsl_regread(device, GEN7_RBBM_SECVID_TSB_STATUS_HI, &hi);
+
+		dev_crit_ratelimited(dev, "TSB: Write error interrupt: Address: 0x%lx MID: %lu\n",
+			FIELD_GET(GENMASK(16, 0), hi) << 32 | lo,
+			FIELD_GET(GENMASK(31, 23), hi));
+		break;
+		}
+	default:
+		dev_crit_ratelimited(dev, "Unknown interrupt %d\n", bit);
+	}
+}
+
+static const char *const uche_client[] = {
+	"BR_VFD", "BR_SP", "BR_VSC", "BR_VPC",
+	"BR_HLSQ", "BR_PC", "BR_LRZ", "BR_TP",
+	"BV_VFD", "BV_SP", "BV_VSC", "BV_VPC",
+	"BV_HLSQ", "BV_PC", "BV_LRZ", "BV_TP"
+};
+
+static const char *const uche_lpac_client[] = {
+	"-", "SP_LPAC", "-", "-", "HLSQ_LPAC", "-", "-", "TP_LPAC"
+};
+
+#define SCOOBYDOO 0x5c00bd00
+
+static const char *gen7_fault_block_uche(struct kgsl_device *device,
+		char *str, int size, bool lpac)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	unsigned int uche_client_id = adreno_dev->uche_client_pf;
+	const char *uche_client_str, *fault_block;
+
+	/*
+	 * Smmu driver takes a vote on CX gdsc before calling the kgsl
+	 * pagefault handler. If there is contention for device mutex in this
+	 * path and the dispatcher fault handler is holding this lock, trying
+	 * to turn off CX gdsc will fail during the reset. So to avoid blocking
+	 * here, try to lock device mutex and return if it fails.
+	 */
+	if (!mutex_trylock(&device->mutex))
+		goto regread_fail;
+
+	if (!kgsl_state_is_awake(device)) {
+		mutex_unlock(&device->mutex);
+		goto regread_fail;
+	}
+
+	kgsl_regread(device, GEN7_UCHE_CLIENT_PF, &uche_client_id);
+	mutex_unlock(&device->mutex);
+
+	/* Ignore the value if the gpu is in IFPC */
+	if (uche_client_id == SCOOBYDOO) {
+		uche_client_id = adreno_dev->uche_client_pf;
+		goto regread_fail;
+	}
+
+	/* UCHE client id mask is bits [6:0] */
+	uche_client_id &= GENMASK(6, 0);
+
+regread_fail:
+	if (lpac) {
+		fault_block = "UCHE_LPAC";
+		if (uche_client_id >= ARRAY_SIZE(uche_lpac_client))
+			goto fail;
+		uche_client_str = uche_lpac_client[uche_client_id];
+	} else {
+		fault_block = "UCHE";
+		if (uche_client_id >= ARRAY_SIZE(uche_client))
+			goto fail;
+		uche_client_str = uche_client[uche_client_id];
+	}
+
+	snprintf(str, size, "%s: %s", fault_block, uche_client_str);
+	return str;
+
+fail:
+	snprintf(str, size, "%s: Unknown (client_id: %u)",
+			fault_block, uche_client_id);
+	return str;
+}
+
+static const char *gen7_iommu_fault_block(struct kgsl_device *device,
+		unsigned int fsynr1)
+{
+	unsigned int mid = fsynr1 & 0xff;
+	static char str[36];
+
+	switch (mid) {
+	case 0x0:
+		return "CP";
+	case 0x1:
+		return "UCHE: Unknown";
+	case 0x2:
+		return "UCHE_LPAC: Unknown";
+	case 0x3:
+		return gen7_fault_block_uche(device, str, sizeof(str), false);
+	case 0x4:
+		return "CCU";
+	case 0x5:
+		return "Flag cache";
+	case 0x6:
+		return "PREFETCH";
+	case 0x7:
+		return "GMU";
+	case 0x8:
+		return gen7_fault_block_uche(device, str, sizeof(str), true);
+	}
+
+	snprintf(str, sizeof(str), "Unknown (mid: %u)", mid);
+	return str;
+}
+
+static void gen7_cp_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (adreno_is_preemption_enabled(adreno_dev))
+		gen7_preemption_trigger(adreno_dev, true);
+
+	adreno_dispatcher_schedule(device);
+}
+
+/*
+ * gen7_gpc_err_int_callback() - Isr for GPC error interrupts
+ * @adreno_dev: Pointer to device
+ * @bit: Interrupt bit
+ */
+static void gen7_gpc_err_int_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/*
+	 * GPC error is typically the result of mistake SW programming.
+	 * Force GPU fault for this interrupt so that we can debug it
+	 * with help of register dump.
+	 */
+
+	dev_crit(device->dev, "RBBM: GPC error\n");
+	adreno_irqctrl(adreno_dev, 0);
+
+	/* Trigger a fault in the dispatcher - this will effect a restart */
+	adreno_dispatcher_fault(adreno_dev, ADRENO_SOFT_FAULT);
+}
+
+/*
+ * gen7_swfuse_violation_callback() - ISR for software fuse violation interrupt
+ * @adreno_dev: Pointer to device
+ * @bit: Interrupt bit
+ */
+static void gen7_swfuse_violation_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 status;
+
+	/*
+	 * SWFUSEVIOLATION error is typically the result of enabling software
+	 * feature which is not supported by the hardware. Following are the
+	 * Feature violation will be reported
+	 * 1) FASTBLEND (BIT:0): NO Fault, RB will send the workload to legacy
+	 * blender HW pipeline.
+	 * 2) LPAC (BIT:1): Fault
+	 * 3) RAYTRACING (BIT:2): Fault
+	 */
+	kgsl_regread(device, GEN7_RBBM_SW_FUSE_INT_STATUS, &status);
+
+	/*
+	 * RBBM_INT_CLEAR_CMD will not clear SWFUSEVIOLATION interrupt. Hence
+	 * do explicit swfuse irq clear.
+	 */
+	kgsl_regwrite(device, GEN7_RBBM_SW_FUSE_INT_MASK, 0);
+
+	dev_crit_ratelimited(device->dev,
+		"RBBM: SW Feature Fuse violation status=0x%8.8x\n", status);
+
+	/* Trigger a fault in the dispatcher for LPAC and RAYTRACING violation */
+	if (status & GENMASK(GEN7_RAYTRACING_SW_FUSE, GEN7_LPAC_SW_FUSE)) {
+		adreno_irqctrl(adreno_dev, 0);
+		adreno_dispatcher_fault(adreno_dev, ADRENO_HARD_FAULT);
+	}
+}
+
+static const struct adreno_irq_funcs gen7_irq_funcs[32] = {
+	ADRENO_IRQ_CALLBACK(NULL), /* 0 - RBBM_GPU_IDLE */
+	ADRENO_IRQ_CALLBACK(gen7_err_callback), /* 1 - RBBM_AHB_ERROR */
+	ADRENO_IRQ_CALLBACK(NULL), /* 2 - UNUSED */
+	ADRENO_IRQ_CALLBACK(NULL), /* 3 - UNUSED */
+	ADRENO_IRQ_CALLBACK(NULL), /* 4 - CPIPCINT0 */
+	ADRENO_IRQ_CALLBACK(NULL), /* 5 - CPIPCINT1 */
+	ADRENO_IRQ_CALLBACK(gen7_err_callback), /* 6 - ATBASYNCOVERFLOW */
+	ADRENO_IRQ_CALLBACK(gen7_gpc_err_int_callback), /* 7 - GPC_ERR */
+	ADRENO_IRQ_CALLBACK(gen7_preemption_callback),/* 8 - CP_SW */
+	ADRENO_IRQ_CALLBACK(gen7_cp_hw_err_callback), /* 9 - CP_HW_ERROR */
+	ADRENO_IRQ_CALLBACK(NULL), /* 10 - CP_CCU_FLUSH_DEPTH_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 11 - CP_CCU_FLUSH_COLOR_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 12 - CP_CCU_RESOLVE_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 13 - UNUSED */
+	ADRENO_IRQ_CALLBACK(NULL), /* 14 - UNUSED */
+	ADRENO_IRQ_CALLBACK(adreno_cp_callback), /* 15 - CP_RB_INT */
+	ADRENO_IRQ_CALLBACK(NULL), /* 16 - CP_RB_INT_LPAC*/
+	ADRENO_IRQ_CALLBACK(NULL), /* 17 - CP_RB_DONE_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 18 - UNUSED */
+	ADRENO_IRQ_CALLBACK(NULL), /* 19 - UNUSED */
+	ADRENO_IRQ_CALLBACK(gen7_cp_callback), /* 20 - CP_CACHE_FLUSH_TS */
+	ADRENO_IRQ_CALLBACK(NULL), /* 21 - CP_CACHE_TS_LPAC */
+	ADRENO_IRQ_CALLBACK(gen7_err_callback), /* 22 - RBBM_ATB_BUS_OVERFLOW */
+	ADRENO_IRQ_CALLBACK(adreno_hang_int_callback), /* 23 - MISHANGDETECT */
+	ADRENO_IRQ_CALLBACK(gen7_err_callback), /* 24 - UCHE_OOB_ACCESS */
+	ADRENO_IRQ_CALLBACK(gen7_err_callback), /* 25 - UCHE_TRAP_INTR */
+	ADRENO_IRQ_CALLBACK(NULL), /* 26 - DEBBUS_INTR_0 */
+	ADRENO_IRQ_CALLBACK(NULL), /* 27 - DEBBUS_INTR_1 */
+	ADRENO_IRQ_CALLBACK(gen7_err_callback), /* 28 - TSBWRITEERROR */
+	ADRENO_IRQ_CALLBACK(gen7_swfuse_violation_callback), /* 29 - SWFUSEVIOLATION */
+	ADRENO_IRQ_CALLBACK(NULL), /* 30 - ISDB_CPU_IRQ */
+	ADRENO_IRQ_CALLBACK(NULL), /* 31 - ISDB_UNDER_DEBUG */
+};
+
+/*
+ * If the AHB fence is not in ALLOW mode when we receive an RBBM
+ * interrupt, something went wrong. This means that we cannot proceed
+ * since the IRQ status and clear registers are not accessible.
+ * This is usually harmless because the GMU will abort power collapse
+ * and change the fence back to ALLOW. Poll so that this can happen.
+ */
+static int gen7_irq_poll_fence(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	u32 status, fence, fence_retries = 0;
+	u64 a, b, c;
+
+	a = gpudev->read_alwayson(adreno_dev);
+
+	kgsl_regread(device, GEN7_GMU_AO_AHB_FENCE_CTRL, &fence);
+
+	while (fence != 0) {
+		b = gpudev->read_alwayson(adreno_dev);
+
+		/* Wait for small time before trying again */
+		udelay(1);
+		kgsl_regread(device, GEN7_GMU_AO_AHB_FENCE_CTRL, &fence);
+
+		if (fence_retries == 100 && fence != 0) {
+			c = gpudev->read_alwayson(adreno_dev);
+
+			kgsl_regread(device, GEN7_GMU_RBBM_INT_UNMASKED_STATUS,
+				&status);
+
+			dev_crit_ratelimited(device->dev,
+				"status=0x%x Unmasked status=0x%x Mask=0x%x timestamps: %llx %llx %llx\n",
+					status & adreno_dev->irq_mask, status,
+					adreno_dev->irq_mask, a, b, c);
+				return -ETIMEDOUT;
+		}
+
+		fence_retries++;
+	}
+
+	return 0;
+}
+
+static irqreturn_t gen7_irq_handler(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	irqreturn_t ret = IRQ_NONE;
+	u32 status;
+
+	/*
+	 * GPU can power down once the INT_0_STATUS is read below.
+	 * But there still might be some register reads required so
+	 * force the GMU/GPU into KEEPALIVE mode until done with the ISR.
+	 */
+	gen7_gpu_keepalive(adreno_dev, true);
+
+	if (gen7_irq_poll_fence(adreno_dev)) {
+		adreno_dispatcher_fault(adreno_dev, ADRENO_GMU_FAULT);
+		goto done;
+	}
+
+	kgsl_regread(device, GEN7_RBBM_INT_0_STATUS, &status);
+
+	kgsl_regwrite(device, GEN7_RBBM_INT_CLEAR_CMD, status);
+
+	ret = adreno_irq_callbacks(adreno_dev, gen7_irq_funcs, status);
+
+	trace_kgsl_gen7_irq_status(adreno_dev, status);
+
+done:
+	/* If hard fault, then let snapshot turn off the keepalive */
+	if (!(adreno_gpu_fault(adreno_dev) & ADRENO_HARD_FAULT))
+		gen7_gpu_keepalive(adreno_dev, false);
+
+	return ret;
+}
+
+int gen7_probe_common(struct platform_device *pdev,
+	struct adreno_device *adreno_dev, u32 chipid,
+	const struct adreno_gpu_core *gpucore)
+{
+	const struct adreno_gpudev *gpudev = gpucore->gpudev;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = container_of(gpucore,
+			struct adreno_gen7_core, base);
+	int ret;
+
+	adreno_dev->gpucore = gpucore;
+	adreno_dev->chipid = chipid;
+	adreno_dev->cx_misc_base = GEN7_CX_MISC_BASE;
+
+	adreno_reg_offset_init(gpudev->reg_offsets);
+
+	adreno_dev->hwcg_enabled = true;
+	adreno_dev->uche_client_pf = 1;
+
+	device->pwrscale.avoid_ddr_stall = true;
+
+	device->pwrctrl.rt_bus_hint = gen7_core->rt_bus_hint;
+	device->pwrctrl.cx_gdsc_offset = GEN7_GPU_CC_CX_GDSCR;
+
+	ret = adreno_device_probe(pdev, adreno_dev);
+	if (ret)
+		return ret;
+
+	if (adreno_preemption_feature_set(adreno_dev)) {
+		const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+
+		adreno_dev->preempt.preempt_level = gen7_core->preempt_level;
+		adreno_dev->preempt.skipsaverestore = true;
+		adreno_dev->preempt.usesgmem = true;
+		set_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv);
+	}
+
+	/* debugfs node for ACD calibration */
+	debugfs_create_file("acd_calibrate", 0644, device->d_debugfs, device, &acd_cal_fops);
+
+	gen7_coresight_init(adreno_dev);
+
+	/* Dump additional AQE 16KB data on top of default 96KB(48(BR)+48(BV)) */
+	device->snapshot_ctxt_record_size = ADRENO_FEATURE(adreno_dev, ADRENO_AQE) ?
+					112 * SZ_1K : 96 * SZ_1K;
+
+	return 0;
+}
+
+/* Register offset defines for Gen7, in order of enum adreno_regs */
+static unsigned int gen7_register_offsets[ADRENO_REG_REGISTER_MAX] = {
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_BASE, GEN7_CP_RB_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_BASE_HI, GEN7_CP_RB_BASE_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_RPTR, GEN7_CP_RB_RPTR),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_RB_WPTR, GEN7_CP_RB_WPTR),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_ME_CNTL, GEN7_CP_SQE_CNTL),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BASE, GEN7_CP_IB1_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BASE_HI, GEN7_CP_IB1_BASE_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB1_BUFSZ, GEN7_CP_IB1_REM_SIZE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BASE, GEN7_CP_IB2_BASE),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BASE_HI, GEN7_CP_IB2_BASE_HI),
+	ADRENO_REG_DEFINE(ADRENO_REG_CP_IB2_BUFSZ, GEN7_CP_IB2_REM_SIZE),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_STATUS, GEN7_RBBM_STATUS),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_STATUS3, GEN7_RBBM_STATUS3),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_INT_0_MASK, GEN7_RBBM_INT_0_MASK),
+	ADRENO_REG_DEFINE(ADRENO_REG_RBBM_SW_RESET_CMD, GEN7_RBBM_SW_RESET_CMD),
+	ADRENO_REG_DEFINE(ADRENO_REG_GMU_AO_HOST_INTERRUPT_MASK,
+			GEN7_GMU_AO_HOST_INTERRUPT_MASK),
+	ADRENO_REG_DEFINE(ADRENO_REG_GMU_GMU2HOST_INTR_MASK,
+			GEN7_GMU_GMU2HOST_INTR_MASK),
+};
+
+
+static u32 _get_pipeid(u32 groupid)
+{
+	if (groupid == KGSL_PERFCOUNTER_GROUP_BV_TSE || groupid == KGSL_PERFCOUNTER_GROUP_BV_RAS
+						|| groupid == KGSL_PERFCOUNTER_GROUP_BV_LRZ
+						|| groupid == KGSL_PERFCOUNTER_GROUP_BV_HLSQ)
+		return PIPE_BV;
+	else if (groupid == KGSL_PERFCOUNTER_GROUP_HLSQ || groupid == KGSL_PERFCOUNTER_GROUP_TSE
+						|| groupid == KGSL_PERFCOUNTER_GROUP_RAS
+						|| groupid == KGSL_PERFCOUNTER_GROUP_LRZ)
+		return PIPE_BR;
+	else
+		return PIPE_NONE;
+}
+
+static int gen7_perfcounter_remove(struct adreno_device *adreno_dev,
+	struct adreno_perfcount_register *reg, u32 groupid)
+{
+	void *ptr = adreno_dev->pwrup_reglist->hostptr;
+	struct cpu_gpu_lock *lock = ptr;
+	u32 *data = ptr + sizeof(*lock);
+	int offset = (lock->ifpc_list_len + lock->preemption_list_len) * 2;
+	int i, second_last_offset, last_offset;
+	bool remove_counter = false;
+	u32 pipe = FIELD_PREP(GENMASK(13, 12), _get_pipeid(groupid));
+
+	if (lock->dynamic_list_len < 2)
+		return -EINVAL;
+
+	second_last_offset = offset + (lock->dynamic_list_len - 2) * 3;
+	last_offset = second_last_offset + 3;
+
+	/* Look for the perfcounter to remove in the list */
+	for (i = 0; i < lock->dynamic_list_len - 1; i++) {
+		if ((data[offset + 1] == reg->select) && (data[offset] == pipe) ) {
+			remove_counter = true;
+			break;
+		}
+		offset += 3;
+	}
+
+	if (!remove_counter)
+		return -ENOENT;
+
+	if (kgsl_hwlock(lock)) {
+		kgsl_hwunlock(lock);
+		return -EBUSY;
+	}
+
+	/*
+	 * If the entry is found, remove it from the list by overwriting with second last
+	 * entry. Skip this if data at offset is already second last entry
+	 */
+	if (offset != second_last_offset)
+		memcpy(&data[offset], &data[second_last_offset], 3 * sizeof(u32));
+
+	/*
+	 * Overwrite the second last entry with last entry as last entry always has to be
+	 * GEN7_RBBM_PERFCTR_CNTL.
+	 */
+	memcpy(&data[second_last_offset], &data[last_offset], 3 * sizeof(u32));
+
+	/* Clear the last entry */
+	memset(&data[last_offset], 0, 3 * sizeof(u32));
+
+	lock->dynamic_list_len--;
+
+	/*
+	 * If dynamic list length is 1, the only entry in the list is the GEN7_RBBM_PERFCTR_CNTL.
+	 * Remove the same.
+	 */
+	if (lock->dynamic_list_len == 1) {
+		memset(&data[offset], 0, 3 * sizeof(u32));
+		lock->dynamic_list_len = 0;
+	}
+
+	kgsl_hwunlock(lock);
+	return 0;
+}
+
+int gen7_perfcounter_update(struct adreno_device *adreno_dev,
+	struct adreno_perfcount_register *reg, bool update_reg, u32 pipe)
+{
+	void *ptr = adreno_dev->pwrup_reglist->hostptr;
+	struct cpu_gpu_lock *lock = ptr;
+	u32 *data = ptr + sizeof(*lock);
+	int i, offset = (lock->ifpc_list_len + lock->preemption_list_len) * 2;
+	bool select_reg_present = false;
+
+	for (i = 0; i < lock->dynamic_list_len; i++) {
+		if ((data[offset + 1] == reg->select) && (data[offset] == pipe)) {
+			select_reg_present = true;
+			break;
+		}
+
+		if (data[offset + 1] == GEN7_RBBM_PERFCTR_CNTL)
+			break;
+
+		offset += 3;
+	}
+
+	if (kgsl_hwlock(lock)) {
+		kgsl_hwunlock(lock);
+		return -EBUSY;
+	}
+
+	/*
+	 * If the perfcounter select register is already present in reglist
+	 * update it, otherwise append the <aperture, select register, value>
+	 * triplet to the end of the list.
+	 */
+	if (select_reg_present) {
+		data[offset + 2] = reg->countable;
+		goto update;
+	}
+
+	/*
+	 * For all targets GEN7_RBBM_PERFCTR_CNTL needs to be the last entry,
+	 * so overwrite the existing GEN7_RBBM_PERFCNTL_CTRL and add it back to
+	 * the end.
+	 */
+	data[offset++] = pipe;
+	data[offset++] = reg->select;
+	data[offset++] = reg->countable;
+
+	data[offset++] = FIELD_PREP(GENMASK(13, 12), PIPE_NONE);
+	data[offset++] = GEN7_RBBM_PERFCTR_CNTL;
+	data[offset++] = 1;
+
+	lock->dynamic_list_len++;
+
+	/* If this is the first entry, enable perfcounters */
+	if (lock->dynamic_list_len == 1) {
+		lock->dynamic_list_len++;
+		kgsl_regwrite(KGSL_DEVICE(adreno_dev), GEN7_RBBM_PERFCTR_CNTL, 0x1);
+	}
+
+update:
+	if (update_reg)
+		kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg->select,
+			reg->countable);
+
+	kgsl_hwunlock(lock);
+	return 0;
+}
+
+static u64 gen7_9_0_read_alwayson(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 lo = 0, hi = 0, tmp = 0;
+
+	/* Always use the GMU AO counter when doing a AHB read */
+	gmu_core_regread(device, GEN7_GMU_CX_AO_COUNTER_HI, &hi);
+	gmu_core_regread(device, GEN7_GMU_CX_AO_COUNTER_LO, &lo);
+
+	/* Check for overflow */
+	gmu_core_regread(device, GEN7_GMU_CX_AO_COUNTER_HI, &tmp);
+
+	if (hi != tmp) {
+		gmu_core_regread(device, GEN7_GMU_CX_AO_COUNTER_LO,
+				&lo);
+		hi = tmp;
+	}
+
+	return (((u64) hi) << 32) | lo;
+}
+
+static u64 gen7_read_alwayson(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 lo = 0, hi = 0, tmp = 0;
+
+	/* Always use the GMU AO counter when doing a AHB read */
+	gmu_core_regread(device, GEN7_GMU_ALWAYS_ON_COUNTER_H, &hi);
+	gmu_core_regread(device, GEN7_GMU_ALWAYS_ON_COUNTER_L, &lo);
+
+	/* Check for overflow */
+	gmu_core_regread(device, GEN7_GMU_ALWAYS_ON_COUNTER_H, &tmp);
+
+	if (hi != tmp) {
+		gmu_core_regread(device, GEN7_GMU_ALWAYS_ON_COUNTER_L,
+				&lo);
+		hi = tmp;
+	}
+
+	return (((u64) hi) << 32) | lo;
+}
+
+static int gen7_9_0_lpac_store(struct adreno_device *adreno_dev, bool enable)
+{
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_LPAC))
+		return -EINVAL;
+
+	if (!(adreno_dev->feature_fuse & BIT(GEN7_LPAC_SW_FUSE)) ||
+		(adreno_dev->lpac_enabled == enable))
+		return 0;
+
+	/* Power down the GPU before changing the lpac setting */
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->lpac_enabled,
+				       enable);
+}
+
+static int gen7_lpac_store(struct adreno_device *adreno_dev, bool enable)
+{
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_LPAC))
+		return -EINVAL;
+
+	if (adreno_dev->lpac_enabled == enable)
+		return 0;
+
+	/* Power down the GPU before changing the lpac setting */
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->lpac_enabled,
+				       enable);
+}
+
+static void gen7_remove(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	/* Make sure timer is initialized, otherwise WARN_ON is generated */
+	if (adreno_preemption_feature_set(adreno_dev) &&
+	    (test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags)))
+		del_timer(&adreno_dev->preempt.timer);
+}
+
+static void gen7_read_bus_stats(struct kgsl_device *device,
+		struct kgsl_power_stats *stats,
+		struct adreno_busy_data *busy)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	u64 ram_cycles, starved_ram;
+
+	ram_cycles = counter_delta(device, adreno_dev->ram_cycles_lo,
+		&busy->bif_ram_cycles);
+
+	starved_ram = counter_delta(device, adreno_dev->starved_ram_lo,
+		&busy->bif_starved_ram);
+
+	ram_cycles += counter_delta(device,
+		adreno_dev->ram_cycles_lo_ch1_read,
+		&busy->bif_ram_cycles_read_ch1);
+
+	ram_cycles += counter_delta(device,
+		adreno_dev->ram_cycles_lo_ch0_write,
+		&busy->bif_ram_cycles_write_ch0);
+
+	ram_cycles += counter_delta(device,
+		adreno_dev->ram_cycles_lo_ch1_write,
+		&busy->bif_ram_cycles_write_ch1);
+
+	starved_ram += counter_delta(device,
+		adreno_dev->starved_ram_lo_ch1,
+		&busy->bif_starved_ram_ch1);
+
+	stats->ram_time = ram_cycles;
+	stats->ram_wait = starved_ram;
+}
+
+static void gen7_power_stats(struct adreno_device *adreno_dev,
+		struct kgsl_power_stats *stats)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_busy_data *busy = &adreno_dev->busy_data;
+	u64 gpu_busy;
+
+	/* Set the GPU busy counter for frequency scaling */
+	gpu_busy = counter_delta(device, GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L,
+		&busy->gpu_busy);
+
+	stats->busy_time = gpu_busy * 10;
+	do_div(stats->busy_time, 192);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_IFPC)) {
+		u32 ifpc = counter_delta(device,
+			GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_L,
+			&busy->num_ifpc);
+
+		adreno_dev->ifpc_count += ifpc;
+		if (ifpc > 0)
+			trace_adreno_ifpc_count(adreno_dev->ifpc_count);
+	}
+
+	if (device->pwrctrl.bus_control)
+		gen7_read_bus_stats(device, stats, busy);
+
+	if (adreno_dev->bcl_enabled) {
+		u32 a, b, c;
+
+		a = counter_delta(device, GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_L,
+			&busy->throttle_cycles[0]);
+
+		b = counter_delta(device, GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_L,
+			&busy->throttle_cycles[1]);
+
+		c = counter_delta(device, GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_L,
+			&busy->throttle_cycles[2]);
+
+		if (a || b || c)
+			trace_kgsl_bcl_clock_throttling(a, b, c);
+
+		if (adreno_is_gen7_2_x_family(adreno_dev)) {
+			u32 bcl_throttle = counter_delta(device,
+				GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_5_L, &busy->bcl_throttle);
+			/*
+			 * This counts number of cycles throttled in XO cycles. Convert it to
+			 * micro seconds by dividing by XO freq which is 19.2MHz.
+			 */
+			adreno_dev->bcl_throttle_time_us += ((bcl_throttle * 10) / 192);
+		}
+	}
+}
+
+static int gen7_setproperty(struct kgsl_device_private *dev_priv,
+		u32 type, void __user *value, u32 sizebytes)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	u32 enable;
+
+	if (type != KGSL_PROP_PWRCTRL)
+		return -ENODEV;
+
+	if (sizebytes != sizeof(enable))
+		return -EINVAL;
+
+	if (copy_from_user(&enable, value, sizeof(enable)))
+		return -EFAULT;
+
+	mutex_lock(&device->mutex);
+
+	if (enable) {
+		clear_bit(GMU_DISABLE_SLUMBER, &device->gmu_core.flags);
+
+		kgsl_pwrscale_enable(device);
+	} else {
+		set_bit(GMU_DISABLE_SLUMBER, &device->gmu_core.flags);
+
+		if (!adreno_active_count_get(adreno_dev))
+			adreno_active_count_put(adreno_dev);
+
+		kgsl_pwrscale_disable(device, true);
+	}
+
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+static void gen7_set_isdb_breakpoint_registers(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct clk *clk;
+	int ret;
+
+	if (!device->set_isdb_breakpoint || device->ftbl->is_hwcg_on(device)
+			|| device->qdss_gfx_virt == NULL || !device->force_panic)
+		return;
+
+	clk = clk_get(&device->pdev->dev, "apb_pclk");
+
+	if (IS_ERR(clk)) {
+		dev_err(device->dev, "Unable to get QDSS clock\n");
+		goto err;
+	}
+
+	ret = clk_prepare_enable(clk);
+
+	if (ret) {
+		dev_err(device->dev, "QDSS Clock enable error: %d\n", ret);
+		clk_put(clk);
+		goto err;
+	}
+
+	/* Issue break command for eight SPs */
+	isdb_write(device->qdss_gfx_virt, 0x0000);
+	isdb_write(device->qdss_gfx_virt, 0x1000);
+	isdb_write(device->qdss_gfx_virt, 0x2000);
+	isdb_write(device->qdss_gfx_virt, 0x3000);
+	isdb_write(device->qdss_gfx_virt, 0x4000);
+	isdb_write(device->qdss_gfx_virt, 0x5000);
+	isdb_write(device->qdss_gfx_virt, 0x6000);
+	isdb_write(device->qdss_gfx_virt, 0x7000);
+
+	/* gen7_2_x has additional SPs */
+	if (adreno_is_gen7_2_x_family(adreno_dev)) {
+		isdb_write(device->qdss_gfx_virt, 0x8000);
+		isdb_write(device->qdss_gfx_virt, 0x9000);
+		isdb_write(device->qdss_gfx_virt, 0xa000);
+		isdb_write(device->qdss_gfx_virt, 0xb000);
+	}
+
+	clk_disable_unprepare(clk);
+	clk_put(clk);
+
+	return;
+
+err:
+	/* Do not force kernel panic if isdb writes did not go through */
+	device->force_panic = false;
+}
+
+static void gen7_swfuse_irqctrl(struct adreno_device *adreno_dev, bool state)
+{
+	if (adreno_is_gen7_9_x(adreno_dev))
+		kgsl_regwrite(KGSL_DEVICE(adreno_dev), GEN7_RBBM_SW_FUSE_INT_MASK,
+			state ? GEN7_SW_FUSE_INT_MASK : 0);
+}
+
+const struct gen7_gpudev adreno_gen7_9_0_hwsched_gpudev = {
+	.base = {
+		.reg_offsets = gen7_register_offsets,
+		.probe = gen7_hwsched_probe,
+		.snapshot = gen7_hwsched_snapshot,
+		.irq_handler = gen7_irq_handler,
+		.iommu_fault_block = gen7_iommu_fault_block,
+		.preemption_context_init = gen7_preemption_context_init,
+		.context_detach = gen7_hwsched_context_detach,
+		.read_alwayson = gen7_9_0_read_alwayson,
+		.reset = gen7_hwsched_reset_replay,
+		.power_ops = &gen7_hwsched_power_ops,
+		.power_stats = gen7_power_stats,
+		.setproperty = gen7_setproperty,
+		.hw_isidle = gen7_hw_isidle,
+		.add_to_va_minidump = gen7_hwsched_add_to_minidump,
+		.gx_is_on = gen7_gmu_gx_is_on,
+		.send_recurring_cmdobj = gen7_hwsched_send_recurring_cmdobj,
+		.perfcounter_remove = gen7_perfcounter_remove,
+		.set_isdb_breakpoint_registers = gen7_set_isdb_breakpoint_registers,
+		.context_destroy = gen7_hwsched_context_destroy,
+		.lpac_store = gen7_9_0_lpac_store,
+		.get_uche_trap_base = gen7_get_uche_trap_base,
+	},
+	.hfi_probe = gen7_hwsched_hfi_probe,
+	.hfi_remove = gen7_hwsched_hfi_remove,
+	.handle_watchdog = gen7_hwsched_handle_watchdog,
+};
+
+const struct gen7_gpudev adreno_gen7_hwsched_gpudev = {
+	.base = {
+		.reg_offsets = gen7_register_offsets,
+		.probe = gen7_hwsched_probe,
+		.snapshot = gen7_hwsched_snapshot,
+		.irq_handler = gen7_irq_handler,
+		.iommu_fault_block = gen7_iommu_fault_block,
+		.preemption_context_init = gen7_preemption_context_init,
+		.context_detach = gen7_hwsched_context_detach,
+		.read_alwayson = gen7_read_alwayson,
+		.reset = gen7_hwsched_reset_replay,
+		.power_ops = &gen7_hwsched_power_ops,
+		.power_stats = gen7_power_stats,
+		.setproperty = gen7_setproperty,
+		.hw_isidle = gen7_hw_isidle,
+		.add_to_va_minidump = gen7_hwsched_add_to_minidump,
+		.gx_is_on = gen7_gmu_gx_is_on,
+		.send_recurring_cmdobj = gen7_hwsched_send_recurring_cmdobj,
+		.perfcounter_remove = gen7_perfcounter_remove,
+		.set_isdb_breakpoint_registers = gen7_set_isdb_breakpoint_registers,
+		.context_destroy = gen7_hwsched_context_destroy,
+		.lpac_store = gen7_lpac_store,
+		.get_uche_trap_base = gen7_get_uche_trap_base,
+	},
+	.hfi_probe = gen7_hwsched_hfi_probe,
+	.hfi_remove = gen7_hwsched_hfi_remove,
+	.handle_watchdog = gen7_hwsched_handle_watchdog,
+};
+
+const struct gen7_gpudev adreno_gen7_gmu_gpudev = {
+	.base = {
+		.reg_offsets = gen7_register_offsets,
+		.probe = gen7_gmu_device_probe,
+		.snapshot = gen7_gmu_snapshot,
+		.irq_handler = gen7_irq_handler,
+		.rb_start = gen7_rb_start,
+		.gpu_keepalive = gen7_gpu_keepalive,
+		.hw_isidle = gen7_hw_isidle,
+		.iommu_fault_block = gen7_iommu_fault_block,
+		.reset = gen7_gmu_reset,
+		.preemption_schedule = gen7_preemption_schedule,
+		.preemption_context_init = gen7_preemption_context_init,
+		.read_alwayson = gen7_read_alwayson,
+		.power_ops = &gen7_gmu_power_ops,
+		.remove = gen7_remove,
+		.ringbuffer_submitcmd = gen7_ringbuffer_submitcmd,
+		.power_stats = gen7_power_stats,
+		.setproperty = gen7_setproperty,
+		.add_to_va_minidump = gen7_gmu_add_to_minidump,
+		.gx_is_on = gen7_gmu_gx_is_on,
+		.perfcounter_remove = gen7_perfcounter_remove,
+		.set_isdb_breakpoint_registers = gen7_set_isdb_breakpoint_registers,
+		.swfuse_irqctrl = gen7_swfuse_irqctrl,
+		.get_uche_trap_base = gen7_get_uche_trap_base,
+	},
+	.hfi_probe = gen7_gmu_hfi_probe,
+	.handle_watchdog = gen7_gmu_handle_watchdog,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7.h
@@ -0,0 +1,523 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _ADRENO_GEN7_H_
+#define _ADRENO_GEN7_H_
+
+#include <linux/delay.h>
+
+#include "gen7_reg.h"
+#include "adreno_gen7_gmu.h"
+
+#define PIPE_NONE 0
+#define PIPE_BR 1
+#define PIPE_BV 2
+#define PIPE_LPAC 3
+
+/* Forward struct declaration */
+struct gen7_snapshot_block_list;
+
+extern const struct adreno_power_ops gen7_gmu_power_ops;
+extern const struct adreno_power_ops gen7_hwsched_power_ops;
+extern const struct adreno_perfcounters adreno_gen7_perfcounters;
+extern const struct adreno_perfcounters adreno_gen7_hwsched_perfcounters;
+extern const struct adreno_perfcounters adreno_gen7_9_0_hwsched_perfcounters;
+
+struct gen7_gpudev {
+	struct adreno_gpudev base;
+	int (*hfi_probe)(struct adreno_device *adreno_dev);
+	void (*hfi_remove)(struct adreno_device *adreno_dev);
+	void (*handle_watchdog)(struct adreno_device *adreno_dev);
+};
+
+extern const struct gen7_gpudev adreno_gen7_gmu_gpudev;
+extern const struct gen7_gpudev adreno_gen7_hwsched_gpudev;
+extern const struct gen7_gpudev adreno_gen7_9_0_hwsched_gpudev;
+
+/**
+ * struct gen7_device - Container for the gen7_device
+ */
+struct gen7_device {
+	/** @gmu: Container for the gen7 GMU device */
+	struct gen7_gmu_device gmu;
+	/** @adreno_dev: Container for the generic adreno device */
+	struct adreno_device adreno_dev;
+};
+
+/**
+ * struct gen7_protected_regs - container for a protect register span
+ */
+struct gen7_protected_regs {
+	/** @reg: Physical protected mode register to write to */
+	u32 reg;
+	/** @start: Dword offset of the starting register in the range */
+	u32 start;
+	/**
+	 * @end: Dword offset of the ending register in the range
+	 * (inclusive)
+	 */
+	u32 end;
+	/**
+	 * @noaccess: 1 if the register should not be accessible from
+	 * userspace, 0 if it can be read (but not written)
+	 */
+	u32 noaccess;
+};
+
+/**
+ * struct adreno_gen7_core - gen7 specific GPU core definitions
+ */
+struct adreno_gen7_core {
+	/** @base: Container for the generic GPU definitions */
+	struct adreno_gpu_core base;
+	/** @gmu_fw_version: Minimum firmware version required to support this core */
+	u32 gmu_fw_version;
+	/** @sqefw_name: Name of the SQE microcode file */
+	const char *sqefw_name;
+	/** @aqefw_name: Name of the AQE microcode file */
+	const char *aqefw_name;
+	/** @gmufw_name: Name of the GMU firmware file */
+	const char *gmufw_name;
+	/** @gmufw_name: Name of the backup GMU firmware file */
+	const char *gmufw_bak_name;
+	/** @zap_name: Name of the CPZ zap file */
+	const char *zap_name;
+	/** @hwcg: List of registers and values to write for HWCG */
+	const struct kgsl_regmap_list *hwcg;
+	/** @hwcg_count: Number of registers in @hwcg */
+	u32 hwcg_count;
+	/** @ao_hwcg: List of registers and values to write for HWCG in AO block */
+	const struct kgsl_regmap_list *ao_hwcg;
+	/** @ao_hwcg_count: Number of registers in @ao_hwcg */
+	u32 ao_hwcg_count;
+	/** @gbif: List of registers and values to write for GBIF */
+	const struct kgsl_regmap_list *gbif;
+	/** @gbif_count: Number of registers in @gbif */
+	u32 gbif_count;
+	/** @hang_detect_cycles: Hang detect counter timeout value */
+	u32 hang_detect_cycles;
+	/** @protected_regs: Array of protected registers for the target */
+	const struct gen7_protected_regs *protected_regs;
+	/** @ctxt_record_size: Size of the preemption record in bytes */
+	u64 ctxt_record_size;
+	/** @highest_bank_bit: Highest bank bit value */
+	u32 highest_bank_bit;
+	/** @gen7_snapshot_block_list: Device-specific blocks dumped in the snapshot */
+	const struct gen7_snapshot_block_list *gen7_snapshot_block_list;
+	/** @gmu_hub_clk_freq: Gmu hub interface clock frequency */
+	u64 gmu_hub_clk_freq;
+	/**
+	 * @bcl_data: bit 0 contains response type for bcl alarms and bits 1:21 controls sid vals
+	 * to configure throttle levels for bcl alarm levels 0-2. If sid vals are not set,
+	 * gmu fw sets default throttle levels.
+	 */
+	u32 bcl_data;
+	/** @preempt_level: Preemption level valid ranges [0 to 2] */
+	u32 preempt_level;
+	/** @qos_value: GPU qos value to set for each RB. */
+	const u32 *qos_value;
+	/** @acv_perfmode_vote: ACV vote for GPU perfmode */
+	u32 acv_perfmode_vote;
+	/** @rt_bus_hint: IB level hint for real time clients i.e. RB-0 */
+	const u32 rt_bus_hint;
+};
+
+/**
+ * struct gen7_cp_preemption_record - CP context record for
+ * preemption.
+ * @magic: (00) Value at this offset must be equal to
+ * GEN7_CP_CTXRECORD_MAGIC_REF.
+ * @info: (04) Type of record. Written non-zero (usually) by CP.
+ * we must set to zero for all ringbuffers.
+ * @errno: (08) Error code. Initialize this to GEN7_CP_CTXRECORD_ERROR_NONE.
+ * CP will update to another value if a preemption error occurs.
+ * @data: (12) DATA field in YIELD and SET_MARKER packets.
+ * Written by CP when switching out. Not used on switch-in. Initialized to 0.
+ * @cntl: (16) RB_CNTL, saved and restored by CP. We must initialize this.
+ * @rptr: (20) RB_RPTR, saved and restored by CP. We must initialize this.
+ * @wptr: (24) RB_WPTR, saved and restored by CP. We must initialize this.
+ * @_pad28: (28) Reserved/padding.
+ * @rptr_addr: (32) RB_RPTR_ADDR_LO|HI saved and restored. We must initialize.
+ * rbase: (40) RB_BASE_LO|HI saved and restored.
+ * counter: (48) Pointer to preemption counter.
+ * @bv_rptr_addr: (56) BV_RB_RPTR_ADDR_LO|HI save and restored. We must initialize.
+ */
+struct gen7_cp_preemption_record {
+	u32 magic;
+	u32 info;
+	u32 errno;
+	u32 data;
+	u32 cntl;
+	u32 rptr;
+	u32 wptr;
+	u32 _pad28;
+	u64 rptr_addr;
+	u64 rbase;
+	u64 counter;
+	u64 bv_rptr_addr;
+};
+
+/**
+ * struct gen7_cp_smmu_info - CP preemption SMMU info.
+ * @magic: (00) The value at this offset must be equal to
+ * GEN7_CP_SMMU_INFO_MAGIC_REF
+ * @_pad4: (04) Reserved/padding
+ * @ttbr0: (08) Base address of the page table for the * incoming context
+ * @asid: (16) Address Space IDentifier (ASID) of the incoming context
+ * @context_idr: (20) Context Identification Register value
+ * @context_bank: (24) Which Context Bank in SMMU to update
+ */
+struct gen7_cp_smmu_info {
+	u32 magic;
+	u32 _pad4;
+	u64 ttbr0;
+	u32 asid;
+	u32 context_idr;
+	u32 context_bank;
+};
+
+#define GEN7_CP_SMMU_INFO_MAGIC_REF		0x241350d5UL
+
+#define GEN7_CP_CTXRECORD_MAGIC_REF		0xae399d6eUL
+/* Size of each CP preemption record */
+#define GEN7_CP_CTXRECORD_SIZE_IN_BYTES		(4192 * 1024)
+/* Size of the user context record block (in bytes) */
+#define GEN7_CP_CTXRECORD_USER_RESTORE_SIZE	(192 * 1024)
+/* Size of the performance counter save/restore block (in bytes) */
+#define GEN7_CP_PERFCOUNTER_SAVE_RESTORE_SIZE	(4 * 1024)
+
+#define GEN7_CP_RB_CNTL_DEFAULT \
+	(FIELD_PREP(GENMASK(7, 0), ilog2(KGSL_RB_DWORDS >> 1)) | \
+	 FIELD_PREP(GENMASK(12, 8), ilog2(4)))
+
+/* Size of the CP_INIT pm4 stream in dwords */
+#define GEN7_CP_INIT_DWORDS 10
+
+/* Size of the perf counter enable pm4 stream in dwords */
+#define GEN7_PERF_COUNTER_ENABLE_DWORDS 3
+
+#define GEN7_INT_MASK \
+	((1 << GEN7_INT_AHBERROR) |			\
+	 (1 << GEN7_INT_ATBASYNCFIFOOVERFLOW) |		\
+	 (1 << GEN7_INT_GPCERROR) |			\
+	 (1 << GEN7_INT_SWINTERRUPT) |			\
+	 (1 << GEN7_INT_HWERROR) |			\
+	 (1 << GEN7_INT_PM4CPINTERRUPT) |		\
+	 (1 << GEN7_INT_RB_DONE_TS) |			\
+	 (1 << GEN7_INT_CACHE_CLEAN_TS) |		\
+	 (1 << GEN7_INT_ATBBUSOVERFLOW) |		\
+	 (1 << GEN7_INT_HANGDETECTINTERRUPT) |		\
+	 (1 << GEN7_INT_OUTOFBOUNDACCESS) |		\
+	 (1 << GEN7_INT_UCHETRAPINTERRUPT) |		\
+	 (1 << GEN7_INT_TSBWRITEERROR) |		\
+	 (1 << GEN7_INT_SWFUSEVIOLATION))
+
+#define GEN7_HWSCHED_INT_MASK \
+	((1 << GEN7_INT_AHBERROR) |			\
+	 (1 << GEN7_INT_ATBASYNCFIFOOVERFLOW) |		\
+	 (1 << GEN7_INT_ATBBUSOVERFLOW) |		\
+	 (1 << GEN7_INT_OUTOFBOUNDACCESS) |		\
+	 (1 << GEN7_INT_UCHETRAPINTERRUPT))
+
+/**
+ * to_gen7_core - return the gen7 specific GPU core struct
+ * @adreno_dev: An Adreno GPU device handle
+ *
+ * Returns:
+ * A pointer to the gen7 specific GPU core struct
+ */
+static inline const struct adreno_gen7_core *
+to_gen7_core(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gpu_core *core = adreno_dev->gpucore;
+
+	return container_of(core, struct adreno_gen7_core, base);
+}
+
+/**
+ * gen7_is_smmu_stalled() - Check whether smmu is stalled or not
+ * @device: Pointer to KGSL device
+ *
+ * Return - True if smmu is stalled or false otherwise
+ */
+static inline bool gen7_is_smmu_stalled(struct kgsl_device *device)
+{
+	u32 val;
+
+	kgsl_regread(device, GEN7_RBBM_STATUS3, &val);
+
+	return val & BIT(24);
+}
+
+/* Preemption functions */
+void gen7_preemption_trigger(struct adreno_device *adreno_dev, bool atomic);
+void gen7_preemption_schedule(struct adreno_device *adreno_dev);
+void gen7_preemption_start(struct adreno_device *adreno_dev);
+int gen7_preemption_init(struct adreno_device *adreno_dev);
+
+u32 gen7_preemption_post_ibsubmit(struct adreno_device *adreno_dev,
+		unsigned int *cmds);
+u32 gen7_preemption_pre_ibsubmit(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 *cmds);
+
+unsigned int gen7_set_marker(unsigned int *cmds,
+		enum adreno_cp_marker_type type);
+
+void gen7_preemption_callback(struct adreno_device *adreno_dev, int bit);
+
+int gen7_preemption_context_init(struct kgsl_context *context);
+
+void gen7_preemption_context_destroy(struct kgsl_context *context);
+
+void gen7_preemption_prepare_postamble(struct adreno_device *adreno_dev);
+
+void gen7_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot);
+void gen7_crashdump_init(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_snapshot_external_core_regs - Dump external registers into snapshot
+ * @device: Pointer to KGSL device
+ * @snapshot: Pointer to the snapshot
+ *
+ * Dump external core registers like GPUCC, CPR into GPU snapshot.
+ */
+void gen7_snapshot_external_core_regs(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot);
+
+/**
+ * gen7_start - Program gen7 registers
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * This function does all gen7 register programming every
+ * time we boot the gpu
+ *
+ * Return: 0 on success or negative on failure
+ */
+int gen7_start(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_init - Initialize gen7 resources
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * This function does gen7 specific one time initialization
+ * and is invoked when the very first client opens a
+ * kgsl instance
+ *
+ * Return: Zero on success and negative error on failure
+ */
+int gen7_init(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_cx_timer_init - Initialize the CX timer on Gen7 devices
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Synchronize the GPU CX timer (if we have one) with the CPU timer
+ */
+void gen7_cx_timer_init(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_get_gpu_feature_info - Get hardware supported feature info
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Get HW supported feature info and update sofware feature configuration
+ */
+void gen7_get_gpu_feature_info(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_rb_start - Gen7 specific ringbuffer setup
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * This function does gen7 specific ringbuffer setup and
+ * attempts to submit CP INIT and bring GPU out of secure mode
+ *
+ * Return: Zero on success and negative error on failure
+ */
+int gen7_rb_start(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_microcode_read - Get the cp microcode from the filesystem
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * This function gets the firmware from filesystem and sets up
+ * the micorocode global buffer
+ *
+ * Return: Zero on success and negative error on failure
+ */
+int gen7_microcode_read(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_probe_common - Probe common gen7 resources
+ * @pdev: Pointer to the platform device
+ * @adreno_dev: Pointer to the adreno device
+ * @chipid: Chipid of the target
+ * @gpucore: Pointer to the gpucore strucure
+ *
+ * This function sets up the gen7 resources common across all
+ * gen7 targets
+ */
+int gen7_probe_common(struct platform_device *pdev,
+	struct adreno_device *adreno_dev, u32 chipid,
+	const struct adreno_gpu_core *gpucore);
+
+/**
+ * gen7_hw_isidle - Check whether gen7 gpu is idle or not
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * Return: True if gpu is idle, otherwise false
+ */
+bool gen7_hw_isidle(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_spin_idle_debug - Debug logging used when gpu fails to idle
+ * @adreno_dev: An Adreno GPU handle
+ * @str: String describing the failure
+ *
+ * This function logs interesting registers and triggers a snapshot
+ */
+void gen7_spin_idle_debug(struct adreno_device *adreno_dev,
+	const char *str);
+
+/**
+ * gen7_perfcounter_update - Update the IFPC perfcounter list
+ * @adreno_dev: An Adreno GPU handle
+ * @reg: Perfcounter reg struct to add/remove to the list
+ * @update_reg: true if the perfcounter needs to be programmed by the CPU
+ * @pipe: pipe id for CP aperture control
+ *
+ * Return: 0 on success or -EBUSY if the lock couldn't be taken
+ */
+int gen7_perfcounter_update(struct adreno_device *adreno_dev,
+	struct adreno_perfcount_register *reg, bool update_reg, u32 pipe);
+
+/*
+ * gen7_ringbuffer_init - Initialize the ringbuffers
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * Initialize the ringbuffer(s) for a5xx.
+ * Return: 0 on success or negative on failure
+ */
+int gen7_ringbuffer_init(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_ringbuffer_submitcmd - Submit a user command to the ringbuffer
+ * @adreno_dev: An Adreno GPU handle
+ * @cmdobj: Pointer to a user command object
+ * @flags: Internal submit flags
+ * @time: Optional pointer to a adreno_submit_time container
+ *
+ * Return: 0 on success or negative on failure
+ */
+int gen7_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj, u32 flags,
+		struct adreno_submit_time *time);
+
+/**
+ * gen7_ringbuffer_submit - Submit a command to the ringbuffer
+ * @rb: Ringbuffer pointer
+ * @time: Optional pointer to a adreno_submit_time container
+ *
+ * Return: 0 on success or negative on failure
+ */
+int gen7_ringbuffer_submit(struct adreno_ringbuffer *rb,
+		struct adreno_submit_time *time);
+
+/**
+ * gen7_fenced_write - Write to a fenced register
+ * @adreno_dev: An Adreno GPU handle
+ * @offset: Register offset
+ * @value: Value to write
+ * @mask: Expected FENCE_STATUS for successful write
+ *
+ * Return: 0 on success or negative on failure
+ */
+int gen7_fenced_write(struct adreno_device *adreno_dev, u32 offset,
+		u32 value, u32 mask);
+
+/**
+ * gen77ringbuffer_addcmds - Wrap and submit commands to the ringbuffer
+ * @adreno_dev: An Adreno GPU handle
+ * @rb: Ringbuffer pointer
+ * @drawctxt: Draw context submitting the commands
+ * @flags: Submission flags
+ * @in: Input buffer to write to ringbuffer
+ * @dwords: Dword length of @in
+ * @timestamp: Draw context timestamp for the submission
+ * @time: Optional pointer to a adreno_submit_time container
+ *
+ * Return: 0 on success or negative on failure
+ */
+int gen7_ringbuffer_addcmds(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 flags, u32 *in, u32 dwords, u32 timestamp,
+		struct adreno_submit_time *time);
+
+/**
+ * gen7_cp_init_cmds - Create the CP_INIT commands
+ * @adreno_dev: An Adreno GPU handle
+ * @cmd: Buffer to write the CP_INIT commands into
+ */
+void gen7_cp_init_cmds(struct adreno_device *adreno_dev, u32 *cmds);
+
+/**
+ * gen7_gmu_hfi_probe - Probe Gen7 HFI specific data
+ * @adreno_dev: An Adreno GPU handle
+ *
+ * Return: 0 on success or negative on failure
+ */
+int gen7_gmu_hfi_probe(struct adreno_device *adreno_dev);
+
+static inline const struct gen7_gpudev *
+to_gen7_gpudev(const struct adreno_gpudev *gpudev)
+{
+	return container_of(gpudev, struct gen7_gpudev, base);
+}
+
+/**
+ * gen7_reset_preempt_records - Reset the preemption buffers
+ * @adreno_dev: Handle to the adreno device
+ *
+ * Reset the preemption records at the time of hard reset
+ */
+void gen7_reset_preempt_records(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_rdpm_mx_freq_update - Update the mx frequency
+ * @gmu: An Adreno GMU handle
+ * @freq: Frequency in KHz
+ *
+ * This function communicates GPU mx frequency(in Mhz) changes to rdpm.
+ */
+void gen7_rdpm_mx_freq_update(struct gen7_gmu_device *gmu, u32 freq);
+
+/**
+ * gen7_rdpm_cx_freq_update - Update the cx frequency
+ * @gmu: An Adreno GMU handle
+ * @freq: Frequency in KHz
+ *
+ * This function communicates GPU cx frequency(in Mhz) changes to rdpm.
+ */
+void gen7_rdpm_cx_freq_update(struct gen7_gmu_device *gmu, u32 freq);
+
+/**
+ * gen7_scm_gpu_init_cx_regs - Program gpu regs for feature support
+ * @adreno_dev: Handle to the adreno device
+ *
+ * Program gpu regs for feature support. Scm call for the same
+ * is added from kernel version 6.0 onwards.
+ *
+ * Return: 0 on success or negative on failure
+ */
+int gen7_scm_gpu_init_cx_regs(struct adreno_device *adreno_dev);
+
+#ifdef CONFIG_QCOM_KGSL_CORESIGHT
+void gen7_coresight_init(struct adreno_device *device);
+#else
+static inline void gen7_coresight_init(struct adreno_device *device) { }
+#endif
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_0_0_snapshot.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_0_0_snapshot.h
@@ -0,0 +1,927 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_GEN7_0_0_SNAPSHOT_H
+#define __ADRENO_GEN7_0_0_SNAPSHOT_H
+
+#include "adreno_gen7_snapshot.h"
+
+static const u32 gen7_0_0_debugbus_blocks[] = {
+	DEBUGBUS_CP_0_0,
+	DEBUGBUS_CP_0_1,
+	DEBUGBUS_RBBM,
+	DEBUGBUS_HLSQ,
+	DEBUGBUS_UCHE_0,
+	DEBUGBUS_TESS_BR,
+	DEBUGBUS_TESS_BV,
+	DEBUGBUS_PC_BR,
+	DEBUGBUS_PC_BV,
+	DEBUGBUS_VFDP_BR,
+	DEBUGBUS_VFDP_BV,
+	DEBUGBUS_VPC_BR,
+	DEBUGBUS_VPC_BV,
+	DEBUGBUS_TSE_BR,
+	DEBUGBUS_TSE_BV,
+	DEBUGBUS_RAS_BR,
+	DEBUGBUS_RAS_BV,
+	DEBUGBUS_VSC,
+	DEBUGBUS_COM_0,
+	DEBUGBUS_LRZ_BR,
+	DEBUGBUS_LRZ_BV,
+	DEBUGBUS_UFC_0,
+	DEBUGBUS_UFC_1,
+	DEBUGBUS_GMU_GX,
+	DEBUGBUS_DBGC,
+	DEBUGBUS_GPC_BR,
+	DEBUGBUS_GPC_BV,
+	DEBUGBUS_LARC,
+	DEBUGBUS_HLSQ_SPTP,
+	DEBUGBUS_RB_0,
+	DEBUGBUS_RB_1,
+	DEBUGBUS_RB_2,
+	DEBUGBUS_RB_3,
+	DEBUGBUS_UCHE_WRAPPER,
+	DEBUGBUS_CCU_0,
+	DEBUGBUS_CCU_1,
+	DEBUGBUS_CCU_2,
+	DEBUGBUS_CCU_3,
+	DEBUGBUS_VFD_BR_0,
+	DEBUGBUS_VFD_BR_1,
+	DEBUGBUS_VFD_BR_2,
+	DEBUGBUS_VFD_BR_3,
+	DEBUGBUS_VFD_BR_4,
+	DEBUGBUS_VFD_BR_5,
+	DEBUGBUS_VFD_BR_6,
+	DEBUGBUS_VFD_BR_7,
+	DEBUGBUS_VFD_BV_0,
+	DEBUGBUS_VFD_BV_1,
+	DEBUGBUS_VFD_BV_2,
+	DEBUGBUS_VFD_BV_3,
+	DEBUGBUS_USP_0,
+	DEBUGBUS_USP_1,
+	DEBUGBUS_USP_2,
+	DEBUGBUS_USP_3,
+	DEBUGBUS_TP_0,
+	DEBUGBUS_TP_1,
+	DEBUGBUS_TP_2,
+	DEBUGBUS_TP_3,
+	DEBUGBUS_TP_4,
+	DEBUGBUS_TP_5,
+	DEBUGBUS_TP_6,
+	DEBUGBUS_TP_7,
+	DEBUGBUS_USPTP_0,
+	DEBUGBUS_USPTP_1,
+	DEBUGBUS_USPTP_2,
+	DEBUGBUS_USPTP_3,
+	DEBUGBUS_USPTP_4,
+	DEBUGBUS_USPTP_5,
+	DEBUGBUS_USPTP_6,
+	DEBUGBUS_USPTP_7,
+};
+
+static struct gen7_shader_block gen7_0_0_shader_blocks[] = {
+	{TP0_TMO_DATA,                 0x200, 4, 2, PIPE_BR, USPTP},
+	{TP0_SMO_DATA,                  0x80, 4, 2, PIPE_BR, USPTP},
+	{TP0_MIPMAP_BASE_DATA,         0x3c0, 4, 2, PIPE_BR, USPTP},
+	{SP_INST_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_INST_DATA_1,               0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_0_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_1_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_2_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_3_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_4_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_5_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_6_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_7_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_CB_RAM,                    0x390, 4, 2, PIPE_BR, USPTP,},
+	{SP_INST_TAG,                   0x90, 4, 2, PIPE_BR, USPTP},
+	{SP_INST_DATA_2,               0x200, 4, 2, PIPE_BR, USPTP},
+	{SP_TMO_TAG,                    0x80, 4, 2, PIPE_BR, USPTP},
+	{SP_SMO_TAG,                    0x80, 4, 2, PIPE_BR, USPTP},
+	{SP_STATE_DATA,                 0x40, 4, 2, PIPE_BR, USPTP},
+	{SP_HWAVE_RAM,                 0x100, 4, 2, PIPE_BR, USPTP},
+	{SP_L0_INST_BUF,                0x50, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_8_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_9_DATA,                 0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_10_DATA,                0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_11_DATA,                0x800, 4, 2, PIPE_BR, USPTP},
+	{SP_LB_12_DATA,                0x200, 4, 2, PIPE_BR, USPTP},
+	{HLSQ_CVS_BE_CTXT_BUF_RAM_TAG,  0x10, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CVS_BE_CTXT_BUF_RAM_TAG,  0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CPS_BE_CTXT_BUF_RAM_TAG,  0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CVS_BE_CTXT_BUF_RAM, 0x300, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CVS_BE_CTXT_BUF_RAM, 0x300, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_GFX_CPS_BE_CTXT_BUF_RAM, 0x300, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CVS_RAM,           0x1c0, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CHUNK_CVS_RAM,           0x1c0, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CPS_RAM,           0x300, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CPS_RAM,           0x300, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_CHUNK_CVS_RAM_TAG,        0x40, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CVS_RAM_TAG,        0x40, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CHUNK_CPS_RAM_TAG,        0x40, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CPS_RAM_TAG,        0x40, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_ICB_CVS_CB_BASE_TAG,      0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_ICB_CVS_CB_BASE_TAG,      0x10, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_ICB_CPS_CB_BASE_TAG,      0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_ICB_CPS_CB_BASE_TAG,      0x10, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_CVS_MISC_RAM,            0x280, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CVS_MISC_RAM,            0x280, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM,            0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM,            0x800, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM_1,          0x200, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_INST_RAM,                0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_INST_RAM,                0x800, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_INST_RAM,                0x800, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_GFX_CVS_CONST_RAM,       0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CVS_CONST_RAM,       0x800, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_GFX_CPS_CONST_RAM,       0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CPS_CONST_RAM,       0x800, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_CVS_MISC_RAM_TAG,         0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CVS_MISC_RAM_TAG,         0x10, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM_TAG,         0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM_TAG,         0x10, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_INST_RAM_TAG,             0x80, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_INST_RAM_TAG,             0x80, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_INST_RAM_TAG,             0x80, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_GFX_CVS_CONST_RAM_TAG,    0x64, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CVS_CONST_RAM_TAG,    0x64, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_GFX_CPS_CONST_RAM_TAG,    0x64, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CPS_CONST_RAM_TAG,    0x64, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_INST_RAM_1,              0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_STPROC_META,              0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_BV_BE_META,               0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_BV_BE_META,               0x10, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_DATAPATH_META,            0x20, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_FRONTEND_META,            0x40, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_FRONTEND_META,            0x40, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_FRONTEND_META,            0x40, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_INDIRECT_META,            0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_BACKEND_META,             0x40, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_BACKEND_META,             0x40, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_BACKEND_META,             0x40, 1, 1, PIPE_LPAC, HLSQ_STATE},
+};
+
+static const u32 gen7_0_0_pre_crashdumper_gpu_registers[] = {
+	0x00210, 0x00210, 0x00212, 0x00213, 0x03c00, 0x03c0b, 0x03c40, 0x03c42,
+	0x03c45, 0x03c47, 0x03c49, 0x03c4a, 0x03cc0, 0x03cd1,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_pre_crashdumper_gpu_registers), 8));
+
+static const u32 gen7_0_0_post_crashdumper_registers[] = {
+	0x00535, 0x00535, 0x0f400, 0x0f400, 0x0f800, 0x0f803, 0x0fc00, 0x0fc01,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_post_crashdumper_registers), 8));
+
+static const u32 gen7_0_0_gpu_registers[] = {
+	0x00000, 0x00000, 0x00002, 0x00002, 0x00011, 0x00012, 0x00016, 0x0001b,
+	0x0001f, 0x00032, 0x00038, 0x0003c, 0x00042, 0x00042, 0x00044, 0x00044,
+	0x00047, 0x00047, 0x00049, 0x0004a, 0x0004c, 0x0004c, 0x00050, 0x00050,
+	0x00056, 0x00056, 0x00073, 0x00075, 0x000ad, 0x000ae, 0x000b0, 0x000b0,
+	0x000b4, 0x000b4, 0x000b8, 0x000b8, 0x000bc, 0x000bc, 0x000c0, 0x000c0,
+	0x000c4, 0x000c4, 0x000c8, 0x000c8, 0x000cc, 0x000cc, 0x000d0, 0x000d0,
+	0x000d4, 0x000d4, 0x000d8, 0x000d8, 0x000dc, 0x000dc, 0x000e0, 0x000e0,
+	0x000e4, 0x000e4, 0x000e8, 0x000e8, 0x000ec, 0x000ec, 0x000f0, 0x000f0,
+	0x000f4, 0x000f4, 0x000f8, 0x000f8, 0x00100, 0x00100, 0x00104, 0x0010b,
+	0x0010f, 0x0011d, 0x0012f, 0x0012f, 0x00200, 0x0020d, 0x00211, 0x00211,
+	0x00215, 0x00243, 0x00260, 0x00268, 0x00272, 0x00274, 0x00281, 0x0028d,
+	0x00300, 0x00401, 0x00410, 0x00451, 0x00460, 0x004a3, 0x004c0, 0x004d1,
+	0x00500, 0x00500, 0x00507, 0x0050b, 0x0050f, 0x0050f, 0x00511, 0x00511,
+	0x00533, 0x00534, 0x00536, 0x00536, 0x00540, 0x00555, 0x00564, 0x00567,
+	0x00574, 0x00577, 0x005fb, 0x005ff, 0x00800, 0x00808, 0x00810, 0x00813,
+	0x00820, 0x00821, 0x00823, 0x00827, 0x00830, 0x00834, 0x0083f, 0x00841,
+	0x00843, 0x00847, 0x0084f, 0x00886, 0x008a0, 0x008ab, 0x008c0, 0x008c0,
+	0x008c4, 0x008c5, 0x008d0, 0x008dd, 0x008e0, 0x008e6, 0x008f0, 0x008f3,
+	0x00900, 0x00903, 0x00908, 0x00911, 0x00928, 0x0093e, 0x00942, 0x0094d,
+	0x00980, 0x00984, 0x0098d, 0x0098f, 0x009b0, 0x009b4, 0x009c2, 0x009c9,
+	0x009ce, 0x009d7, 0x009e0, 0x009e7, 0x00a00, 0x00a00, 0x00a02, 0x00a03,
+	0x00a10, 0x00a4f, 0x00a61, 0x00a9f, 0x00ad0, 0x00adb, 0x00b00, 0x00b31,
+	0x00b35, 0x00b3c, 0x00b40, 0x00b40, 0x00c00, 0x00c00, 0x00c02, 0x00c04,
+	0x00c06, 0x00c06, 0x00c10, 0x00cd9, 0x00ce0, 0x00d0c, 0x00df0, 0x00df4,
+	0x00e01, 0x00e02, 0x00e07, 0x00e0e, 0x00e10, 0x00e13, 0x00e17, 0x00e19,
+	0x00e1b, 0x00e2b, 0x00e30, 0x00e32, 0x00e38, 0x00e3c,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_gpu_registers), 8));
+
+static const u32 gen7_0_0_gmu_registers[] = {
+	0x10001, 0x10001, 0x10003, 0x10003, 0x10401, 0x10401, 0x10403, 0x10403,
+	0x10801, 0x10801, 0x10803, 0x10803, 0x10c01, 0x10c01, 0x10c03, 0x10c03,
+	0x11001, 0x11001, 0x11003, 0x11003, 0x11401, 0x11401, 0x11403, 0x11403,
+	0x11801, 0x11801, 0x11803, 0x11803, 0x11c01, 0x11c01, 0x11c03, 0x11c03,
+	0x1f400, 0x1f40d, 0x1f40f, 0x1f411, 0x1f500, 0x1f500, 0x1f507, 0x1f507,
+	0x1f509, 0x1f50b, 0x1f800, 0x1f804, 0x1f807, 0x1f808, 0x1f80b, 0x1f80c,
+	0x1f80f, 0x1f80f, 0x1f811, 0x1f811, 0x1f813, 0x1f817, 0x1f819, 0x1f81c,
+	0x1f824, 0x1f82a, 0x1f82d, 0x1f830, 0x1f840, 0x1f853, 0x1f860, 0x1f860,
+	0x1f870, 0x1f879, 0x1f87f, 0x1f87f, 0x1f888, 0x1f889, 0x1f8a0, 0x1f8a2,
+	0x1f8a4, 0x1f8af, 0x1f8c0, 0x1f8c1, 0x1f8c3, 0x1f8c4, 0x1f8d0, 0x1f8d0,
+	0x1f8ec, 0x1f8ec, 0x1f8f0, 0x1f8f1, 0x1f910, 0x1f914, 0x1f920, 0x1f921,
+	0x1f924, 0x1f925, 0x1f928, 0x1f929, 0x1f92c, 0x1f92d, 0x1f940, 0x1f940,
+	0x1f942, 0x1f944, 0x1f948, 0x1f94a, 0x1f94f, 0x1f951, 0x1f958, 0x1f95a,
+	0x1f95d, 0x1f95d, 0x1f962, 0x1f962, 0x1f964, 0x1f96b, 0x1f970, 0x1f979,
+	0x1f980, 0x1f981, 0x1f984, 0x1f986, 0x1f992, 0x1f993, 0x1f996, 0x1f99e,
+	0x1f9c0, 0x1f9c0, 0x1f9c5, 0x1f9d4, 0x1f9f0, 0x1f9f1, 0x1f9f8, 0x1f9fa,
+	0x1fa00, 0x1fa03, 0x20000, 0x20005, 0x20008, 0x2000c, 0x20010, 0x20012,
+	0x20018, 0x20018, 0x20020, 0x20023, 0x20030, 0x20031, 0x23801, 0x23801,
+	0x23803, 0x23803, 0x23805, 0x23805, 0x23807, 0x23807, 0x23809, 0x23809,
+	0x2380b, 0x2380b, 0x2380d, 0x2380d, 0x2380f, 0x2380f, 0x23811, 0x23811,
+	0x23813, 0x23813, 0x23815, 0x23815, 0x23817, 0x23817, 0x23819, 0x23819,
+	0x2381b, 0x2381b, 0x2381d, 0x2381d, 0x2381f, 0x23820, 0x23822, 0x23822,
+	0x23824, 0x23824, 0x23826, 0x23826, 0x23828, 0x23828, 0x2382a, 0x2382a,
+	0x2382c, 0x2382c, 0x2382e, 0x2382e, 0x23830, 0x23830, 0x23832, 0x23832,
+	0x23834, 0x23834, 0x23836, 0x23836, 0x23838, 0x23838, 0x2383a, 0x2383a,
+	0x2383c, 0x2383c, 0x2383e, 0x2383e, 0x23840, 0x23847, 0x23b00, 0x23b01,
+	0x23b03, 0x23b03, 0x23b05, 0x23b0e, 0x23b10, 0x23b13, 0x23b15, 0x23b16,
+	0x23b20, 0x23b20, 0x23b28, 0x23b28, 0x23b30, 0x23b30,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_gmu_registers), 8));
+
+static const u32 gen7_0_0_gmugx_registers[] = {
+	0x1a400, 0x1a41f, 0x1a440, 0x1a45f, 0x1a480, 0x1a49f, 0x1a4c0, 0x1a4df,
+	0x1a500, 0x1a51f, 0x1a540, 0x1a55f, 0x1a580, 0x1a59f, 0x1a5c0, 0x1a5df,
+	0x1a780, 0x1a781, 0x1a783, 0x1a785, 0x1a787, 0x1a789, 0x1a78b, 0x1a78d,
+	0x1a78f, 0x1a791, 0x1a793, 0x1a795, 0x1a797, 0x1a799, 0x1a79b, 0x1a79b,
+	0x1a7c0, 0x1a7c1, 0x1a7c4, 0x1a7c5, 0x1a7c8, 0x1a7c9, 0x1a7cc, 0x1a7cd,
+	0x1a7d0, 0x1a7d1, 0x1a7d4, 0x1a7d5, 0x1a7d8, 0x1a7d9, 0x1a7fc, 0x1a7fd,
+	0x1a800, 0x1a802, 0x1a804, 0x1a804, 0x1a816, 0x1a816, 0x1a81e, 0x1a81e,
+	0x1a826, 0x1a826, 0x1a82e, 0x1a82e, 0x1a836, 0x1a836, 0x1a83e, 0x1a83e,
+	0x1a846, 0x1a846, 0x1a860, 0x1a862, 0x1a864, 0x1a867, 0x1a870, 0x1a870,
+	0x1a883, 0x1a884, 0x1a8c0, 0x1a8c2, 0x1a8c4, 0x1a8c7, 0x1a8d0, 0x1a8d3,
+	0x1a900, 0x1a92b, 0x1a940, 0x1a940,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_gmugx_registers), 8));
+
+static const u32 gen7_0_0_noncontext_pipe_br_registers[] = {
+	0x00887, 0x0088c, 0x08600, 0x08600, 0x08602, 0x08602, 0x08610, 0x0861b,
+	0x08620, 0x08620, 0x08630, 0x08630, 0x08637, 0x08639, 0x08640, 0x08640,
+	0x09600, 0x09600, 0x09602, 0x09603, 0x0960a, 0x09616, 0x09624, 0x0963a,
+	0x09640, 0x09640, 0x09e00, 0x09e00, 0x09e02, 0x09e07, 0x09e0a, 0x09e16,
+	0x09e19, 0x09e19, 0x09e1c, 0x09e1c, 0x09e20, 0x09e25, 0x09e30, 0x09e31,
+	0x09e40, 0x09e51, 0x09e64, 0x09e64, 0x09e70, 0x09e72, 0x09e78, 0x09e79,
+	0x09e80, 0x09fff, 0x0a600, 0x0a600, 0x0a603, 0x0a603, 0x0a610, 0x0a61f,
+	0x0a630, 0x0a631, 0x0a638, 0x0a638,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_noncontext_pipe_br_registers), 8));
+
+static const u32 gen7_0_0_noncontext_pipe_bv_registers[] = {
+	0x00887, 0x0088c, 0x08600, 0x08600, 0x08602, 0x08602, 0x08610, 0x0861b,
+	0x08620, 0x08620, 0x08630, 0x08630, 0x08637, 0x08639, 0x08640, 0x08640,
+	0x09600, 0x09600, 0x09602, 0x09603, 0x0960a, 0x09616, 0x09624, 0x0963a,
+	0x09640, 0x09640, 0x09e00, 0x09e00, 0x09e02, 0x09e07, 0x09e0a, 0x09e16,
+	0x09e19, 0x09e19, 0x09e1c, 0x09e1c, 0x09e20, 0x09e25, 0x09e30, 0x09e31,
+	0x09e40, 0x09e51, 0x09e64, 0x09e64, 0x09e70, 0x09e72, 0x09e78, 0x09e79,
+	0x09e80, 0x09fff, 0x0a600, 0x0a600, 0x0a603, 0x0a603, 0x0a610, 0x0a61f,
+	0x0a630, 0x0a631, 0x0a638, 0x0a638,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_noncontext_pipe_bv_registers), 8));
+
+static const u32 gen7_0_0_noncontext_pipe_lpac_registers[] = {
+	0x00887, 0x0088c, 0x00f80, 0x00f80,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_noncontext_pipe_lpac_registers), 8));
+
+static const u32 gen7_0_0_noncontext_rb_rac_pipe_br_registers[] = {
+	0x08e10, 0x08e1c, 0x08e20, 0x08e25, 0x08e51, 0x08e5a,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_noncontext_rb_rac_pipe_br_registers), 8));
+
+static const u32 gen7_0_0_noncontext_rb_rbp_pipe_br_registers[] = {
+	0x08e01, 0x08e01, 0x08e04, 0x08e04, 0x08e06, 0x08e09, 0x08e0c, 0x08e0c,
+	0x08e28, 0x08e28, 0x08e2c, 0x08e35, 0x08e3b, 0x08e3f, 0x08e50, 0x08e50,
+	0x08e5b, 0x08e5d, 0x08e5f, 0x08e5f, 0x08e61, 0x08e61, 0x08e63, 0x08e65,
+	0x08e68, 0x08e68, 0x08e70, 0x08e79, 0x08e80, 0x08e8f,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_noncontext_rb_rbp_pipe_br_registers), 8));
+
+/* Block: GRAS Cluster: CLUSTER_GRAS Pipeline: PIPE_BR */
+static const u32 gen7_0_0_gras_cluster_gras_pipe_br_registers[] = {
+	0x08000, 0x08008, 0x08010, 0x08092, 0x08094, 0x08099, 0x0809b, 0x0809d,
+	0x080a0, 0x080a7, 0x080af, 0x080f1, 0x080f4, 0x080f6, 0x080f8, 0x080fa,
+	0x08100, 0x08107, 0x08109, 0x0810b, 0x08110, 0x08110, 0x08120, 0x0813f,
+	0x08400, 0x08406, 0x0840a, 0x0840b,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_gras_cluster_gras_pipe_br_registers), 8));
+
+/* Block: GRAS Cluster: CLUSTER_GRAS Pipeline: PIPE_BV */
+static const u32 gen7_0_0_gras_cluster_gras_pipe_bv_registers[] = {
+	0x08000, 0x08008, 0x08010, 0x08092, 0x08094, 0x08099, 0x0809b, 0x0809d,
+	0x080a0, 0x080a7, 0x080af, 0x080f1, 0x080f4, 0x080f6, 0x080f8, 0x080fa,
+	0x08100, 0x08107, 0x08109, 0x0810b, 0x08110, 0x08110, 0x08120, 0x0813f,
+	0x08400, 0x08406, 0x0840a, 0x0840b,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_gras_cluster_gras_pipe_bv_registers), 8));
+
+/* Block: PC Cluster: CLUSTER_FE Pipeline: PIPE_BR */
+static const u32 gen7_0_0_pc_cluster_fe_pipe_br_registers[] = {
+	0x09800, 0x09804, 0x09806, 0x0980a, 0x09810, 0x09811, 0x09884, 0x09886,
+	0x09b00, 0x09b08,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_pc_cluster_fe_pipe_br_registers), 8));
+
+/* Block: PC Cluster: CLUSTER_FE Pipeline: PIPE_BV */
+static const u32 gen7_0_0_pc_cluster_fe_pipe_bv_registers[] = {
+	0x09800, 0x09804, 0x09806, 0x0980a, 0x09810, 0x09811, 0x09884, 0x09886,
+	0x09b00, 0x09b08,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_pc_cluster_fe_pipe_bv_registers), 8));
+
+/* Block: RB_RAC Cluster: CLUSTER_PS Pipeline: PIPE_BR */
+static const u32 gen7_0_0_rb_rac_cluster_ps_pipe_br_registers[] = {
+	0x08802, 0x08802, 0x08804, 0x08806, 0x08809, 0x0880a, 0x0880e, 0x08811,
+	0x08818, 0x0881e, 0x08821, 0x08821, 0x08823, 0x08826, 0x08829, 0x08829,
+	0x0882b, 0x0882e, 0x08831, 0x08831, 0x08833, 0x08836, 0x08839, 0x08839,
+	0x0883b, 0x0883e, 0x08841, 0x08841, 0x08843, 0x08846, 0x08849, 0x08849,
+	0x0884b, 0x0884e, 0x08851, 0x08851, 0x08853, 0x08856, 0x08859, 0x08859,
+	0x0885b, 0x0885e, 0x08860, 0x08864, 0x08870, 0x08870, 0x08873, 0x08876,
+	0x08878, 0x08879, 0x08882, 0x08885, 0x08887, 0x08889, 0x08891, 0x08891,
+	0x08898, 0x08898, 0x088c0, 0x088c1, 0x088e5, 0x088e5, 0x088f4, 0x088f5,
+	0x08a00, 0x08a05, 0x08a10, 0x08a15, 0x08a20, 0x08a25, 0x08a30, 0x08a35,
+	0x08c00, 0x08c01, 0x08c18, 0x08c1f, 0x08c26, 0x08c34,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_rb_rac_cluster_ps_pipe_br_registers), 8));
+
+/* Block: RB_RBP Cluster: CLUSTER_PS Pipeline: PIPE_BR */
+static const u32 gen7_0_0_rb_rbp_cluster_ps_pipe_br_registers[] = {
+	0x08800, 0x08801, 0x08803, 0x08803, 0x0880b, 0x0880d, 0x08812, 0x08812,
+	0x08820, 0x08820, 0x08822, 0x08822, 0x08827, 0x08828, 0x0882a, 0x0882a,
+	0x0882f, 0x08830, 0x08832, 0x08832, 0x08837, 0x08838, 0x0883a, 0x0883a,
+	0x0883f, 0x08840, 0x08842, 0x08842, 0x08847, 0x08848, 0x0884a, 0x0884a,
+	0x0884f, 0x08850, 0x08852, 0x08852, 0x08857, 0x08858, 0x0885a, 0x0885a,
+	0x0885f, 0x0885f, 0x08865, 0x08865, 0x08871, 0x08872, 0x08877, 0x08877,
+	0x08880, 0x08881, 0x08886, 0x08886, 0x08890, 0x08890, 0x088d0, 0x088e4,
+	0x088e8, 0x088ea, 0x088f0, 0x088f0, 0x08900, 0x0891a, 0x08927, 0x08928,
+	0x08c17, 0x08c17, 0x08c20, 0x08c25,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_rb_rbp_cluster_ps_pipe_br_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_BR Location: HLSQ_STATE */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers[] = {
+	0x0a980, 0x0a980, 0x0a982, 0x0a984, 0x0a99e, 0x0a99e, 0x0a9a7, 0x0a9a7,
+	0x0a9aa, 0x0a9aa, 0x0a9ae, 0x0a9b0, 0x0a9b3, 0x0a9b5, 0x0a9ba, 0x0a9ba,
+	0x0a9bc, 0x0a9bc, 0x0a9c4, 0x0a9c4, 0x0a9cd, 0x0a9cd, 0x0a9e0, 0x0a9fc,
+	0x0aa00, 0x0aa00, 0x0aa30, 0x0aa31, 0x0aa40, 0x0aabf, 0x0ab00, 0x0ab03,
+	0x0ab05, 0x0ab05, 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_LPAC Location: HLSQ_STATE */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_lpac_hlsq_state_registers[] = {
+	0x0a9b0, 0x0a9b0, 0x0a9b3, 0x0a9b5, 0x0a9ba, 0x0a9ba, 0x0a9bc, 0x0a9bc,
+	0x0a9c4, 0x0a9c4, 0x0a9cd, 0x0a9cd, 0x0a9e2, 0x0a9e3, 0x0a9e6, 0x0a9fc,
+	0x0aa00, 0x0aa00, 0x0aa31, 0x0aa31, 0x0ab00, 0x0ab01,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_lpac_hlsq_state_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_BR Location: HLSQ_DP */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers[] = {
+	0x0a9b1, 0x0a9b1, 0x0a9c6, 0x0a9cb, 0x0a9d4, 0x0a9df,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_LPAC Location: HLSQ_DP */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_lpac_hlsq_dp_registers[] = {
+	0x0a9b1, 0x0a9b1, 0x0a9d4, 0x0a9df,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_lpac_hlsq_dp_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_BR Location: SP_TOP */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_br_sp_top_registers[] = {
+	0x0a980, 0x0a980, 0x0a982, 0x0a984, 0x0a99e, 0x0a9a2, 0x0a9a7, 0x0a9a8,
+	0x0a9aa, 0x0a9aa, 0x0a9ae, 0x0a9ae, 0x0a9b0, 0x0a9b1, 0x0a9b3, 0x0a9b5,
+	0x0a9ba, 0x0a9bc, 0x0a9e0, 0x0a9f9, 0x0aa00, 0x0aa00, 0x0ab00, 0x0ab00,
+	0x0ab02, 0x0ab02, 0x0ab04, 0x0ab05, 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_br_sp_top_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_LPAC Location: SP_TOP */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_lpac_sp_top_registers[] = {
+	0x0a9b0, 0x0a9b1, 0x0a9b3, 0x0a9b5, 0x0a9ba, 0x0a9bc, 0x0a9e2, 0x0a9e3,
+	0x0a9e6, 0x0a9f9, 0x0aa00, 0x0aa00, 0x0ab00, 0x0ab00,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_lpac_sp_top_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_BR Location: uSPTP */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_br_usptp_registers[] = {
+	0x0a980, 0x0a982, 0x0a985, 0x0a9a6, 0x0a9a8, 0x0a9a9, 0x0a9ab, 0x0a9ae,
+	0x0a9b0, 0x0a9b3, 0x0a9b6, 0x0a9b9, 0x0a9bb, 0x0a9bf, 0x0a9c2, 0x0a9c3,
+	0x0a9cd, 0x0a9cd, 0x0a9d0, 0x0a9d3, 0x0aa30, 0x0aa31, 0x0aa40, 0x0aabf,
+	0x0ab00, 0x0ab05, 0x0ab21, 0x0ab22, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_br_usptp_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_LPAC Location: uSPTP */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_lpac_usptp_registers[] = {
+	0x0a9b0, 0x0a9b3, 0x0a9b6, 0x0a9b9, 0x0a9bb, 0x0a9be, 0x0a9c2, 0x0a9c3,
+	0x0a9cd, 0x0a9cd, 0x0a9d0, 0x0a9d3, 0x0aa31, 0x0aa31, 0x0ab00, 0x0ab01,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_lpac_usptp_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_VS Pipeline: PIPE_BR Location: HLSQ_STATE */
+static const u32 gen7_0_0_sp_cluster_sp_vs_pipe_br_hlsq_state_registers[] = {
+	0x0a800, 0x0a800, 0x0a81b, 0x0a81d, 0x0a822, 0x0a822, 0x0a824, 0x0a824,
+	0x0a827, 0x0a82a, 0x0a830, 0x0a830, 0x0a833, 0x0a835, 0x0a83a, 0x0a83a,
+	0x0a83c, 0x0a83c, 0x0a83f, 0x0a840, 0x0a85b, 0x0a85d, 0x0a862, 0x0a862,
+	0x0a864, 0x0a864, 0x0a867, 0x0a867, 0x0a870, 0x0a870, 0x0a88c, 0x0a88e,
+	0x0a893, 0x0a893, 0x0a895, 0x0a895, 0x0a898, 0x0a898, 0x0a89a, 0x0a89d,
+	0x0a8a0, 0x0a8af, 0x0a8c0, 0x0a8c3, 0x0ab00, 0x0ab03, 0x0ab05, 0x0ab05,
+	0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_vs_pipe_br_hlsq_state_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_VS Pipeline: PIPE_BV Location: HLSQ_STATE */
+static const u32 gen7_0_0_sp_cluster_sp_vs_pipe_bv_hlsq_state_registers[] = {
+	0x0a800, 0x0a800, 0x0a81b, 0x0a81d, 0x0a822, 0x0a822, 0x0a824, 0x0a824,
+	0x0a827, 0x0a82a, 0x0a830, 0x0a830, 0x0a833, 0x0a835, 0x0a83a, 0x0a83a,
+	0x0a83c, 0x0a83c, 0x0a83f, 0x0a840, 0x0a85b, 0x0a85d, 0x0a862, 0x0a862,
+	0x0a864, 0x0a864, 0x0a867, 0x0a867, 0x0a870, 0x0a870, 0x0a88c, 0x0a88e,
+	0x0a893, 0x0a893, 0x0a895, 0x0a895, 0x0a898, 0x0a898, 0x0a89a, 0x0a89d,
+	0x0a8a0, 0x0a8af, 0x0a8c0, 0x0a8c3, 0x0ab00, 0x0ab02, 0x0ab0a, 0x0ab1b,
+	0x0ab20, 0x0ab20, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_vs_pipe_bv_hlsq_state_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_VS Pipeline: PIPE_BR Location: SP_TOP */
+static const u32 gen7_0_0_sp_cluster_sp_vs_pipe_br_sp_top_registers[] = {
+	0x0a800, 0x0a800, 0x0a81c, 0x0a81d, 0x0a822, 0x0a824, 0x0a830, 0x0a831,
+	0x0a834, 0x0a835, 0x0a83a, 0x0a83c, 0x0a840, 0x0a840, 0x0a85c, 0x0a85d,
+	0x0a862, 0x0a864, 0x0a870, 0x0a871, 0x0a88d, 0x0a88e, 0x0a893, 0x0a895,
+	0x0a8a0, 0x0a8af, 0x0ab00, 0x0ab00, 0x0ab02, 0x0ab02, 0x0ab04, 0x0ab05,
+	0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_vs_pipe_br_sp_top_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_VS Pipeline: PIPE_BV Location: SP_TOP */
+static const u32 gen7_0_0_sp_cluster_sp_vs_pipe_bv_sp_top_registers[] = {
+	0x0a800, 0x0a800, 0x0a81c, 0x0a81d, 0x0a822, 0x0a824, 0x0a830, 0x0a831,
+	0x0a834, 0x0a835, 0x0a83a, 0x0a83c, 0x0a840, 0x0a840, 0x0a85c, 0x0a85d,
+	0x0a862, 0x0a864, 0x0a870, 0x0a871, 0x0a88d, 0x0a88e, 0x0a893, 0x0a895,
+	0x0a8a0, 0x0a8af, 0x0ab00, 0x0ab00, 0x0ab02, 0x0ab02, 0x0ab0a, 0x0ab1b,
+	0x0ab20, 0x0ab20,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_vs_pipe_bv_sp_top_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_VS Pipeline: PIPE_BR Location: uSPTP */
+static const u32 gen7_0_0_sp_cluster_sp_vs_pipe_br_usptp_registers[] = {
+	0x0a800, 0x0a81b, 0x0a81e, 0x0a821, 0x0a823, 0x0a827, 0x0a830, 0x0a833,
+	0x0a836, 0x0a839, 0x0a83b, 0x0a85b, 0x0a85e, 0x0a861, 0x0a863, 0x0a867,
+	0x0a870, 0x0a88c, 0x0a88f, 0x0a892, 0x0a894, 0x0a898, 0x0a8c0, 0x0a8c3,
+	0x0ab00, 0x0ab05, 0x0ab21, 0x0ab22, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_vs_pipe_br_usptp_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_VS Pipeline: PIPE_BV Location: uSPTP */
+static const u32 gen7_0_0_sp_cluster_sp_vs_pipe_bv_usptp_registers[] = {
+	0x0a800, 0x0a81b, 0x0a81e, 0x0a821, 0x0a823, 0x0a827, 0x0a830, 0x0a833,
+	0x0a836, 0x0a839, 0x0a83b, 0x0a85b, 0x0a85e, 0x0a861, 0x0a863, 0x0a867,
+	0x0a870, 0x0a88c, 0x0a88f, 0x0a892, 0x0a894, 0x0a898, 0x0a8c0, 0x0a8c3,
+	0x0ab00, 0x0ab02, 0x0ab21, 0x0ab22, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_vs_pipe_bv_usptp_registers), 8));
+
+/* Block: TPL1 Cluster: CLUSTER_SP_PS Pipeline: PIPE_BR */
+static const u32 gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers[] = {
+	0x0b180, 0x0b183, 0x0b190, 0x0b195, 0x0b2c0, 0x0b2d5, 0x0b300, 0x0b307,
+	0x0b309, 0x0b309, 0x0b310, 0x0b310,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_BV Location: HLSQ_STATE */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_bv_hlsq_state_registers[] = {
+	0x0ab00, 0x0ab02, 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_bv_hlsq_state_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_BV Location: SP_TOP */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_bv_sp_top_registers[] = {
+	0x0ab00, 0x0ab00, 0x0ab02, 0x0ab02, 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_bv_sp_top_registers), 8));
+
+/* Block: SP Cluster: CLUSTER_SP_PS Pipeline: PIPE_BV Location: uSPTP */
+static const u32 gen7_0_0_sp_cluster_sp_ps_pipe_bv_usptp_registers[] = {
+	0x0ab00, 0x0ab02, 0x0ab21, 0x0ab22, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_cluster_sp_ps_pipe_bv_usptp_registers), 8));
+
+/* Block: TPL1 Cluster: CLUSTER_SP_PS Pipeline: PIPE_BV */
+static const u32 gen7_0_0_tpl1_cluster_sp_ps_pipe_bv_registers[] = {
+	0x0b300, 0x0b307, 0x0b309, 0x0b309, 0x0b310, 0x0b310,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_tpl1_cluster_sp_ps_pipe_bv_registers), 8));
+
+/* Block: TPL1 Cluster: CLUSTER_SP_PS Pipeline: PIPE_LPAC */
+static const u32 gen7_0_0_tpl1_cluster_sp_ps_pipe_lpac_registers[] = {
+	0x0b180, 0x0b181, 0x0b300, 0x0b301, 0x0b307, 0x0b307, 0x0b309, 0x0b309,
+	0x0b310, 0x0b310,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_tpl1_cluster_sp_ps_pipe_lpac_registers), 8));
+
+/* Block: TPL1 Cluster: CLUSTER_SP_VS Pipeline: PIPE_BR */
+static const u32 gen7_0_0_tpl1_cluster_sp_vs_pipe_br_registers[] = {
+	0x0b300, 0x0b307, 0x0b309, 0x0b309, 0x0b310, 0x0b310,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_tpl1_cluster_sp_vs_pipe_br_registers), 8));
+
+/* Block: TPL1 Cluster: CLUSTER_SP_VS Pipeline: PIPE_BV */
+static const u32 gen7_0_0_tpl1_cluster_sp_vs_pipe_bv_registers[] = {
+	0x0b300, 0x0b307, 0x0b309, 0x0b309, 0x0b310, 0x0b310,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_tpl1_cluster_sp_vs_pipe_bv_registers), 8));
+
+/* Block: VFD Cluster: CLUSTER_FE Pipeline: PIPE_BR */
+static const u32 gen7_0_0_vfd_cluster_fe_pipe_br_registers[] = {
+	0x0a000, 0x0a009, 0x0a00e, 0x0a0ef,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_vfd_cluster_fe_pipe_br_registers), 8));
+
+/* Block: VFD Cluster: CLUSTER_FE Pipeline: PIPE_BV */
+static const u32 gen7_0_0_vfd_cluster_fe_pipe_bv_registers[] = {
+	0x0a000, 0x0a009, 0x0a00e, 0x0a0ef,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_vfd_cluster_fe_pipe_bv_registers), 8));
+
+/* Block: VPC Cluster: CLUSTER_FE Pipeline: PIPE_BR */
+static const u32 gen7_0_0_vpc_cluster_fe_pipe_br_registers[] = {
+	0x09300, 0x09307,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_vpc_cluster_fe_pipe_br_registers), 8));
+
+/* Block: VPC Cluster: CLUSTER_FE Pipeline: PIPE_BV */
+static const u32 gen7_0_0_vpc_cluster_fe_pipe_bv_registers[] = {
+	0x09300, 0x09307,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_vpc_cluster_fe_pipe_bv_registers), 8));
+
+/* Block: VPC Cluster: CLUSTER_PC_VS Pipeline: PIPE_BR */
+static const u32 gen7_0_0_vpc_cluster_pc_vs_pipe_br_registers[] = {
+	0x09101, 0x0910c, 0x09300, 0x09307,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_vpc_cluster_pc_vs_pipe_br_registers), 8));
+
+/* Block: VPC Cluster: CLUSTER_PC_VS Pipeline: PIPE_BV */
+static const u32 gen7_0_0_vpc_cluster_pc_vs_pipe_bv_registers[] = {
+	0x09101, 0x0910c, 0x09300, 0x09307,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_vpc_cluster_pc_vs_pipe_bv_registers), 8));
+
+/* Block: VPC Cluster: CLUSTER_VPC_PS Pipeline: PIPE_BR */
+static const u32 gen7_0_0_vpc_cluster_vpc_ps_pipe_br_registers[] = {
+	0x09200, 0x0920f, 0x09212, 0x09216, 0x09218, 0x09236, 0x09300, 0x09307,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_vpc_cluster_vpc_ps_pipe_br_registers), 8));
+
+/* Block: VPC Cluster: CLUSTER_VPC_PS Pipeline: PIPE_BV */
+static const u32 gen7_0_0_vpc_cluster_vpc_ps_pipe_bv_registers[] = {
+	0x09200, 0x0920f, 0x09212, 0x09216, 0x09218, 0x09236, 0x09300, 0x09307,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_vpc_cluster_vpc_ps_pipe_bv_registers), 8));
+
+/* Block: SP Cluster: noncontext Pipeline: PIPE_BR Location: HLSQ_STATE */
+static const u32 gen7_0_0_sp_noncontext_pipe_br_hlsq_state_registers[] = {
+	0x0ae52, 0x0ae52, 0x0ae60, 0x0ae67, 0x0ae69, 0x0ae73,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_noncontext_pipe_br_hlsq_state_registers), 8));
+
+/* Block: SP Cluster: noncontext Pipeline: PIPE_BR Location: SP_TOP */
+static const u32 gen7_0_0_sp_noncontext_pipe_br_sp_top_registers[] = {
+	0x0ae00, 0x0ae00, 0x0ae02, 0x0ae04, 0x0ae06, 0x0ae09, 0x0ae0c, 0x0ae0c,
+	0x0ae0f, 0x0ae0f, 0x0ae28, 0x0ae2b, 0x0ae35, 0x0ae35, 0x0ae3a, 0x0ae3f,
+	0x0ae50, 0x0ae52, 0x0ae80, 0x0aea3,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_noncontext_pipe_br_sp_top_registers), 8));
+
+/* Block: SP Cluster: noncontext Pipeline: PIPE_BR Location: uSPTP */
+static const u32 gen7_0_0_sp_noncontext_pipe_br_usptp_registers[] = {
+	0x0ae00, 0x0ae00, 0x0ae02, 0x0ae04, 0x0ae06, 0x0ae09, 0x0ae0c, 0x0ae0c,
+	0x0ae0f, 0x0ae0f, 0x0ae30, 0x0ae32, 0x0ae35, 0x0ae35, 0x0ae3a, 0x0ae3b,
+	0x0ae3e, 0x0ae3f, 0x0ae50, 0x0ae52,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_noncontext_pipe_br_usptp_registers), 8));
+
+/* Block: SP Cluster: noncontext Pipeline: PIPE_LPAC Location: HLSQ_STATE */
+static const u32 gen7_0_0_sp_noncontext_pipe_lpac_hlsq_state_registers[] = {
+	0x0af88, 0x0af8a,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_noncontext_pipe_lpac_hlsq_state_registers), 8));
+
+/* Block: SP Cluster: noncontext Pipeline: PIPE_LPAC Location: SP_TOP */
+static const u32 gen7_0_0_sp_noncontext_pipe_lpac_sp_top_registers[] = {
+	0x0af80, 0x0af84,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_noncontext_pipe_lpac_sp_top_registers), 8));
+
+/* Block: SP Cluster: noncontext Pipeline: PIPE_LPAC Location: uSPTP */
+static const u32 gen7_0_0_sp_noncontext_pipe_lpac_usptp_registers[] = {
+	0x0af80, 0x0af84, 0x0af90, 0x0af92,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_sp_noncontext_pipe_lpac_usptp_registers), 8));
+
+/* Block: TPl1 Cluster: noncontext Pipeline: PIPE_BR */
+static const u32 gen7_0_0_tpl1_noncontext_pipe_br_registers[] = {
+	0x0b600, 0x0b600, 0x0b602, 0x0b602, 0x0b604, 0x0b604, 0x0b608, 0x0b60c,
+	0x0b60f, 0x0b621, 0x0b630, 0x0b633,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_tpl1_noncontext_pipe_br_registers), 8));
+
+/* Block: TPl1 Cluster: noncontext Pipeline: PIPE_LPAC */
+static const u32 gen7_0_0_tpl1_noncontext_pipe_lpac_registers[] = {
+	0x0b780, 0x0b780,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_tpl1_noncontext_pipe_lpac_registers), 8));
+
+static const struct gen7_sel_reg  gen7_0_0_rb_rac_sel = {
+	.host_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_HOST,
+	.cd_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_CD,
+	.val = 0x0,
+};
+
+static const struct gen7_sel_reg gen7_0_0_rb_rbp_sel = {
+	.host_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_HOST,
+	.cd_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_CD,
+	.val = 0x9,
+};
+
+static struct gen7_cluster_registers gen7_0_0_clusters[] = {
+	{ CLUSTER_NONE, PIPE_BR, STATE_NON_CONTEXT,
+		gen7_0_0_noncontext_pipe_br_registers, },
+	{ CLUSTER_NONE, PIPE_BV, STATE_NON_CONTEXT,
+		gen7_0_0_noncontext_pipe_bv_registers, },
+	{ CLUSTER_NONE, PIPE_LPAC, STATE_NON_CONTEXT,
+		gen7_0_0_noncontext_pipe_lpac_registers, },
+	{ CLUSTER_NONE, PIPE_BR, STATE_NON_CONTEXT,
+		gen7_0_0_noncontext_rb_rac_pipe_br_registers, &gen7_0_0_rb_rac_sel, },
+	{ CLUSTER_NONE, PIPE_BR, STATE_NON_CONTEXT,
+		gen7_0_0_noncontext_rb_rbp_pipe_br_registers, &gen7_0_0_rb_rbp_sel, },
+	{ CLUSTER_GRAS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_gras_cluster_gras_pipe_br_registers, },
+	{ CLUSTER_GRAS, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_gras_cluster_gras_pipe_bv_registers, },
+	{ CLUSTER_GRAS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_gras_cluster_gras_pipe_br_registers, },
+	{ CLUSTER_GRAS, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_gras_cluster_gras_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_pc_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_pc_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_pc_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_pc_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_rb_rac_cluster_ps_pipe_br_registers, &gen7_0_0_rb_rac_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_rb_rac_cluster_ps_pipe_br_registers, &gen7_0_0_rb_rac_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_rb_rbp_cluster_ps_pipe_br_registers, &gen7_0_0_rb_rbp_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_rb_rbp_cluster_ps_pipe_br_registers, &gen7_0_0_rb_rbp_sel, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_vfd_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_vfd_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_vfd_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_vfd_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_PC_VS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_pc_vs_pipe_br_registers, },
+	{ CLUSTER_PC_VS, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_pc_vs_pipe_bv_registers, },
+	{ CLUSTER_PC_VS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_pc_vs_pipe_br_registers, },
+	{ CLUSTER_PC_VS, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_pc_vs_pipe_bv_registers, },
+	{ CLUSTER_VPC_PS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_vpc_ps_pipe_br_registers, },
+	{ CLUSTER_VPC_PS, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_vpc_ps_pipe_bv_registers, },
+	{ CLUSTER_VPC_PS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_vpc_ps_pipe_br_registers, },
+	{ CLUSTER_VPC_PS, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_vpc_ps_pipe_bv_registers, },
+};
+
+static struct gen7_sptp_cluster_registers gen7_0_0_sptp_clusters[] = {
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, HLSQ_STATE,
+		gen7_0_0_sp_noncontext_pipe_br_hlsq_state_registers, 0xae00 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, SP_TOP,
+		gen7_0_0_sp_noncontext_pipe_br_sp_top_registers, 0xae00 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_sp_noncontext_pipe_br_usptp_registers, 0xae00 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_LPAC, 0, HLSQ_STATE,
+		gen7_0_0_sp_noncontext_pipe_lpac_hlsq_state_registers, 0xaf80 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_LPAC, 0, SP_TOP,
+		gen7_0_0_sp_noncontext_pipe_lpac_sp_top_registers, 0xaf80 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_LPAC, 0, USPTP,
+		gen7_0_0_sp_noncontext_pipe_lpac_usptp_registers, 0xaf80 },
+	{ CLUSTER_NONE, TP0_NCTX_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_tpl1_noncontext_pipe_br_registers, 0xb600 },
+	{ CLUSTER_NONE, TP0_NCTX_REG, PIPE_LPAC, 0, USPTP,
+		gen7_0_0_tpl1_noncontext_pipe_lpac_registers, 0xb780 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, HLSQ_STATE,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, SP_TOP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, HLSQ_STATE,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, SP_TOP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, USPTP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, HLSQ_STATE,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, SP_TOP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, USPTP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, HLSQ_STATE,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, SP_TOP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, USPTP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, HLSQ_STATE,
+		gen7_0_0_sp_cluster_sp_ps_pipe_lpac_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_lpac_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, SP_TOP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_lpac_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, USPTP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_lpac_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BR, 0, HLSQ_STATE,
+		gen7_0_0_sp_cluster_sp_vs_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BV, 0, HLSQ_STATE,
+		gen7_0_0_sp_cluster_sp_vs_pipe_bv_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BR, 0, SP_TOP,
+		gen7_0_0_sp_cluster_sp_vs_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BV, 0, SP_TOP,
+		gen7_0_0_sp_cluster_sp_vs_pipe_bv_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_sp_cluster_sp_vs_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BV, 0, USPTP,
+		gen7_0_0_sp_cluster_sp_vs_pipe_bv_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BR, 1, HLSQ_STATE,
+		gen7_0_0_sp_cluster_sp_vs_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BV, 1, HLSQ_STATE,
+		gen7_0_0_sp_cluster_sp_vs_pipe_bv_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BR, 1, SP_TOP,
+		gen7_0_0_sp_cluster_sp_vs_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BV, 1, SP_TOP,
+		gen7_0_0_sp_cluster_sp_vs_pipe_bv_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BR, 1, USPTP,
+		gen7_0_0_sp_cluster_sp_vs_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BV, 1, USPTP,
+		gen7_0_0_sp_cluster_sp_vs_pipe_bv_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, TP0_CTX0_3D_CPS_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_PS, TP0_CTX1_3D_CPS_REG, PIPE_BR, 1, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_PS, TP0_CTX2_3D_CPS_REG, PIPE_BR, 2, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_PS, TP0_CTX3_3D_CPS_REG, PIPE_BR, 3, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_PS, TP0_CTX0_3D_CPS_REG, PIPE_LPAC, 0, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_lpac_registers, 0xb000 },
+	{ CLUSTER_SP_VS, TP0_CTX0_3D_CVS_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_tpl1_cluster_sp_vs_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_VS, TP0_CTX0_3D_CVS_REG, PIPE_BV, 0, USPTP,
+		gen7_0_0_tpl1_cluster_sp_vs_pipe_bv_registers, 0xb000 },
+	{ CLUSTER_SP_VS, TP0_CTX1_3D_CVS_REG, PIPE_BR, 1, USPTP,
+		gen7_0_0_tpl1_cluster_sp_vs_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_VS, TP0_CTX1_3D_CVS_REG, PIPE_BV, 1, USPTP,
+		gen7_0_0_tpl1_cluster_sp_vs_pipe_bv_registers, 0xb000 },
+};
+
+static const u32 gen7_0_0_rscc_registers[] = {
+	0x14000, 0x14036, 0x14040, 0x14042, 0x14080, 0x14084, 0x14089, 0x1408c,
+	0x14091, 0x14094, 0x14099, 0x1409c, 0x140a1, 0x140a4, 0x140a9, 0x140ac,
+	0x14100, 0x14102, 0x14114, 0x14119, 0x14124, 0x1412e, 0x14140, 0x14143,
+	0x14180, 0x14197, 0x14340, 0x14342, 0x14344, 0x14347, 0x1434c, 0x14373,
+	0x143ec, 0x143ef, 0x143f4, 0x1441b, 0x14494, 0x14497, 0x1449c, 0x144c3,
+	0x1453c, 0x1453f, 0x14544, 0x1456b, 0x145e4, 0x145e7, 0x145ec, 0x14613,
+	0x1468c, 0x1468f, 0x14694, 0x146bb, 0x14734, 0x14737, 0x1473c, 0x14763,
+	0x147dc, 0x147df, 0x147e4, 0x1480b, 0x14884, 0x14887, 0x1488c, 0x148b3,
+	0x1492c, 0x1492f, 0x14934, 0x1495b, 0x14f51, 0x14f54,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_rscc_registers), 8));
+
+static const u32 gen7_0_0_cpr_registers[] = {
+	0x26800, 0x26805, 0x26808, 0x2680c, 0x26814, 0x26814, 0x2681c, 0x2681c,
+	0x26820, 0x26838, 0x26840, 0x26840, 0x26848, 0x26848, 0x26850, 0x26850,
+	0x26880, 0x26898, 0x26980, 0x269b0, 0x269c0, 0x269c8, 0x269e0, 0x269ee,
+	0x269fb, 0x269ff, 0x26a02, 0x26a07, 0x26a09, 0x26a0b, 0x26a10, 0x26b0f,
+	0x27440, 0x27441, 0x27444, 0x27444, 0x27480, 0x274a2, 0x274ac, 0x274ac,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_cpr_registers), 8));
+
+static const u32 gen7_0_0_gpucc_registers[] = {
+	0x24000, 0x2400e, 0x24400, 0x2440e, 0x24800, 0x24805, 0x24c00, 0x24cff,
+	0x25800, 0x25804, 0x25c00, 0x25c04, 0x26000, 0x26004, 0x26400, 0x26405,
+	0x26414, 0x2641d, 0x2642a, 0x26430, 0x26432, 0x26432, 0x26441, 0x26455,
+	0x26466, 0x26468, 0x26478, 0x2647a, 0x26489, 0x2648a, 0x2649c, 0x2649e,
+	0x264a0, 0x264a3, 0x264b3, 0x264b5, 0x264c5, 0x264c7, 0x264d6, 0x264d8,
+	0x264e8, 0x264e9, 0x264f9, 0x264fc, 0x2650b, 0x2650c, 0x2651c, 0x2651e,
+	0x26540, 0x26570, 0x26600, 0x26616, 0x26620, 0x2662d,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_gpucc_registers), 8));
+
+static const u32 gen7_0_0_cx_misc_registers[] = {
+	0x27800, 0x27800, 0x27810, 0x27814, 0x27820, 0x27824, 0x27832, 0x27857,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_cx_misc_registers), 8));
+
+static const u32 gen7_0_0_dpm_registers[] = {
+	0x1aa00, 0x1aa06, 0x1aa09, 0x1aa0a, 0x1aa0c, 0x1aa0d, 0x1aa0f, 0x1aa12,
+	0x1aa14, 0x1aa47, 0x1aa50, 0x1aa51,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_0_0_dpm_registers), 8));
+
+static struct gen7_reg_list gen7_0_0_reg_list[] = {
+	{ gen7_0_0_gpu_registers, NULL },
+	{ gen7_0_0_dpm_registers, NULL },
+	{ NULL, NULL },
+};
+
+static const u32 *gen7_0_0_external_core_regs[] = {
+	gen7_0_0_gpucc_registers,
+	gen7_0_0_cpr_registers,
+};
+#endif /*_ADRENO_GEN7_0_0_SNAPSHOT_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_2_0_snapshot.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_2_0_snapshot.h
@@ -0,0 +1,752 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_GEN7_2_0_SNAPSHOT_H
+#define __ADRENO_GEN7_2_0_SNAPSHOT_H
+
+#include "adreno_gen7_snapshot.h"
+
+static const u32 gen7_2_0_debugbus_blocks[] = {
+	DEBUGBUS_CP_0_0,
+	DEBUGBUS_CP_0_1,
+	DEBUGBUS_RBBM,
+	DEBUGBUS_HLSQ,
+	DEBUGBUS_UCHE_0,
+	DEBUGBUS_UCHE_1,
+	DEBUGBUS_TESS_BR,
+	DEBUGBUS_TESS_BV,
+	DEBUGBUS_PC_BR,
+	DEBUGBUS_PC_BV,
+	DEBUGBUS_VFDP_BR,
+	DEBUGBUS_VFDP_BV,
+	DEBUGBUS_VPC_BR,
+	DEBUGBUS_VPC_BV,
+	DEBUGBUS_TSE_BR,
+	DEBUGBUS_TSE_BV,
+	DEBUGBUS_RAS_BR,
+	DEBUGBUS_RAS_BV,
+	DEBUGBUS_VSC,
+	DEBUGBUS_COM_0,
+	DEBUGBUS_LRZ_BR,
+	DEBUGBUS_LRZ_BV,
+	DEBUGBUS_UFC_0,
+	DEBUGBUS_UFC_1,
+	DEBUGBUS_GMU_GX,
+	DEBUGBUS_DBGC,
+	DEBUGBUS_GPC_BR,
+	DEBUGBUS_GPC_BV,
+	DEBUGBUS_LARC,
+	DEBUGBUS_HLSQ_SPTP,
+	DEBUGBUS_RB_0,
+	DEBUGBUS_RB_1,
+	DEBUGBUS_RB_2,
+	DEBUGBUS_RB_3,
+	DEBUGBUS_RB_4,
+	DEBUGBUS_RB_5,
+	DEBUGBUS_UCHE_WRAPPER,
+	DEBUGBUS_CCU_0,
+	DEBUGBUS_CCU_1,
+	DEBUGBUS_CCU_2,
+	DEBUGBUS_CCU_3,
+	DEBUGBUS_CCU_4,
+	DEBUGBUS_CCU_5,
+	DEBUGBUS_VFD_BR_0,
+	DEBUGBUS_VFD_BR_1,
+	DEBUGBUS_VFD_BR_2,
+	DEBUGBUS_VFD_BR_3,
+	DEBUGBUS_VFD_BR_4,
+	DEBUGBUS_VFD_BR_5,
+	DEBUGBUS_VFD_BV_0,
+	DEBUGBUS_VFD_BV_1,
+	DEBUGBUS_USP_0,
+	DEBUGBUS_USP_1,
+	DEBUGBUS_USP_2,
+	DEBUGBUS_USP_3,
+	DEBUGBUS_USP_4,
+	DEBUGBUS_USP_5,
+	DEBUGBUS_TP_0,
+	DEBUGBUS_TP_1,
+	DEBUGBUS_TP_2,
+	DEBUGBUS_TP_3,
+	DEBUGBUS_TP_4,
+	DEBUGBUS_TP_5,
+	DEBUGBUS_TP_6,
+	DEBUGBUS_TP_7,
+	DEBUGBUS_TP_8,
+	DEBUGBUS_TP_9,
+	DEBUGBUS_TP_10,
+	DEBUGBUS_TP_11,
+	DEBUGBUS_USPTP_0,
+	DEBUGBUS_USPTP_1,
+	DEBUGBUS_USPTP_2,
+	DEBUGBUS_USPTP_3,
+	DEBUGBUS_USPTP_4,
+	DEBUGBUS_USPTP_5,
+	DEBUGBUS_USPTP_6,
+	DEBUGBUS_USPTP_7,
+	DEBUGBUS_USPTP_8,
+	DEBUGBUS_USPTP_9,
+	DEBUGBUS_USPTP_10,
+	DEBUGBUS_USPTP_11,
+	DEBUGBUS_CCHE_0,
+	DEBUGBUS_CCHE_1,
+	DEBUGBUS_CCHE_2,
+};
+
+static struct gen7_shader_block gen7_2_0_shader_blocks[] = {
+	{TP0_TMO_DATA,                 0x200, 6, 2, PIPE_BR, USPTP},
+	{TP0_SMO_DATA,                  0x80, 6, 2, PIPE_BR, USPTP},
+	{TP0_MIPMAP_BASE_DATA,         0x3c0, 6, 2, PIPE_BR, USPTP},
+	{SP_INST_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_INST_DATA_1,               0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_0_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_1_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_2_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_3_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_4_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_5_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_6_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_7_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_CB_RAM,                    0x390, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_13_DATA,                0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_14_DATA,                0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_INST_TAG,                   0xc0, 6, 2, PIPE_BR, USPTP},
+	{SP_INST_DATA_2,               0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_TMO_TAG,                    0x80, 6, 2, PIPE_BR, USPTP},
+	{SP_SMO_TAG,                    0x80, 6, 2, PIPE_BR, USPTP},
+	{SP_STATE_DATA,                 0x40, 6, 2, PIPE_BR, USPTP},
+	{SP_HWAVE_RAM,                 0x100, 6, 2, PIPE_BR, USPTP},
+	{SP_L0_INST_BUF,                0x50, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_8_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_9_DATA,                 0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_10_DATA,                0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_11_DATA,                0x800, 6, 2, PIPE_BR, USPTP},
+	{SP_LB_12_DATA,                0x800, 6, 2, PIPE_BR, USPTP},
+	{HLSQ_CVS_BE_CTXT_BUF_RAM_TAG,  0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CVS_BE_CTXT_BUF_RAM_TAG,  0x10, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CPS_BE_CTXT_BUF_RAM_TAG,  0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CVS_BE_CTXT_BUF_RAM, 0x300, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CVS_BE_CTXT_BUF_RAM, 0x300, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_GFX_CPS_BE_CTXT_BUF_RAM, 0x300, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CVS_RAM,           0x1c0, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CVS_RAM,           0x1c0, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CHUNK_CPS_RAM,           0x300, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CPS_RAM,           0x180, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_CHUNK_CVS_RAM_TAG,        0x40, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CVS_RAM_TAG,        0x40, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CHUNK_CPS_RAM_TAG,        0x40, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CHUNK_CPS_RAM_TAG,        0x40, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_ICB_CVS_CB_BASE_TAG,      0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_ICB_CVS_CB_BASE_TAG,      0x10, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_ICB_CPS_CB_BASE_TAG,      0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_ICB_CPS_CB_BASE_TAG,      0x10, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_CVS_MISC_RAM,            0x280, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CVS_MISC_RAM,            0x280, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM,            0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM,            0x200, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM_1,          0x1c0, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_INST_RAM,                0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_INST_RAM,                0x800, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_INST_RAM,                0x200, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_CVS_MISC_RAM_TAG,         0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CVS_MISC_RAM_TAG,         0x10, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM_TAG,         0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_CPS_MISC_RAM_TAG,         0x10, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_INST_RAM_TAG,             0x80, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_INST_RAM_TAG,             0x80, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_INST_RAM_TAG,             0x80, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_GFX_CVS_CONST_RAM_TAG,    0x64, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CVS_CONST_RAM_TAG,    0x38, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_GFX_CPS_CONST_RAM_TAG,    0x64, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CPS_CONST_RAM_TAG,    0x10, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_GFX_CVS_CONST_RAM,       0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CVS_CONST_RAM,       0x800, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_GFX_CPS_CONST_RAM,       0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_GFX_CPS_CONST_RAM,       0x800, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_INST_RAM_1,              0x800, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_STPROC_META,              0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_BV_BE_META,               0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_BV_BE_META,               0x10, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_DATAPATH_META,            0x20, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_FRONTEND_META,            0x80, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_FRONTEND_META,            0x80, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_FRONTEND_META,            0x80, 1, 1, PIPE_LPAC, HLSQ_STATE},
+	{HLSQ_INDIRECT_META,            0x10, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_BACKEND_META,             0x40, 1, 1, PIPE_BR, HLSQ_STATE},
+	{HLSQ_BACKEND_META,             0x40, 1, 1, PIPE_BV, HLSQ_STATE},
+	{HLSQ_BACKEND_META,             0x40, 1, 1, PIPE_LPAC, HLSQ_STATE},
+};
+
+static const u32 gen7_2_0_gpu_registers[] = {
+	0x00000, 0x00000, 0x00002, 0x00002, 0x00011, 0x00012, 0x00016, 0x0001b,
+	0x0001f, 0x00032, 0x00038, 0x0003c, 0x00042, 0x00042, 0x00044, 0x00044,
+	0x00047, 0x00047, 0x00049, 0x0004a, 0x0004c, 0x0004c, 0x00050, 0x00050,
+	0x00056, 0x00056, 0x00073, 0x0007d, 0x000ad, 0x000ae, 0x000b0, 0x000b0,
+	0x000b4, 0x000b4, 0x000b8, 0x000b8, 0x000bc, 0x000bc, 0x000c0, 0x000c0,
+	0x000c4, 0x000c4, 0x000c8, 0x000c8, 0x000cc, 0x000cc, 0x000d0, 0x000d0,
+	0x000d4, 0x000d4, 0x000d8, 0x000d8, 0x000dc, 0x000dc, 0x000e0, 0x000e0,
+	0x000e4, 0x000e4, 0x000e8, 0x000e8, 0x000ec, 0x000ec, 0x000f0, 0x000f0,
+	0x000f4, 0x000f4, 0x000f8, 0x000f8, 0x00100, 0x00100, 0x00104, 0x0010c,
+	0x0010f, 0x0011d, 0x0012f, 0x0012f, 0x00200, 0x0020d, 0x00211, 0x00211,
+	0x00215, 0x00253, 0x00260, 0x00270, 0x00272, 0x00274, 0x00281, 0x0028d,
+	0x00300, 0x00401, 0x00410, 0x00451, 0x00460, 0x004a3, 0x004c0, 0x004d1,
+	0x00500, 0x00500, 0x00507, 0x0050b, 0x0050f, 0x0050f, 0x00511, 0x00511,
+	0x00533, 0x00536, 0x00540, 0x00555, 0x00564, 0x00567, 0x00574, 0x00577,
+	0x00584, 0x0059b, 0x005fb, 0x005ff, 0x00800, 0x00808, 0x00810, 0x00813,
+	0x00820, 0x00821, 0x00823, 0x00827, 0x00830, 0x00834, 0x0083f, 0x00841,
+	0x00843, 0x00847, 0x0084f, 0x00886, 0x008a0, 0x008ab, 0x008c0, 0x008c0,
+	0x008c4, 0x008c6, 0x008d0, 0x008dd, 0x008e0, 0x008e6, 0x008f0, 0x008f3,
+	0x00900, 0x00903, 0x00908, 0x00911, 0x00928, 0x0093e, 0x00942, 0x0094d,
+	0x00980, 0x00984, 0x0098d, 0x0098f, 0x009b0, 0x009b4, 0x009c2, 0x009c9,
+	0x009ce, 0x009d7, 0x009e0, 0x009e7, 0x00a00, 0x00a00, 0x00a02, 0x00a03,
+	0x00a10, 0x00a4f, 0x00a61, 0x00a9f, 0x00ad0, 0x00adb, 0x00b00, 0x00b31,
+	0x00b35, 0x00b3c, 0x00b40, 0x00b40, 0x00c00, 0x00c00, 0x00c02, 0x00c04,
+	0x00c06, 0x00c06, 0x00c10, 0x00cd9, 0x00ce0, 0x00d0c, 0x00df0, 0x00df4,
+	0x00e01, 0x00e02, 0x00e07, 0x00e0e, 0x00e10, 0x00e13, 0x00e17, 0x00e19,
+	0x00e1b, 0x00e2b, 0x00e30, 0x00e32, 0x00e38, 0x00e3c, 0x00e40, 0x00e4b,
+	0x0ec00, 0x0ec01, 0x0ec05, 0x0ec05, 0x0ec07, 0x0ec07, 0x0ec0a, 0x0ec0a,
+	0x0ec12, 0x0ec12, 0x0ec26, 0x0ec28, 0x0ec2b, 0x0ec2d, 0x0ec2f, 0x0ec2f,
+	0x0ec40, 0x0ec41, 0x0ec45, 0x0ec45, 0x0ec47, 0x0ec47, 0x0ec4a, 0x0ec4a,
+	0x0ec52, 0x0ec52, 0x0ec66, 0x0ec68, 0x0ec6b, 0x0ec6d, 0x0ec6f, 0x0ec6f,
+	0x0ec80, 0x0ec81, 0x0ec85, 0x0ec85, 0x0ec87, 0x0ec87, 0x0ec8a, 0x0ec8a,
+	0x0ec92, 0x0ec92, 0x0eca6, 0x0eca8, 0x0ecab, 0x0ecad, 0x0ecaf, 0x0ecaf,
+	0x0ecc0, 0x0ecc1, 0x0ecc5, 0x0ecc5, 0x0ecc7, 0x0ecc7, 0x0ecca, 0x0ecca,
+	0x0ecd2, 0x0ecd2, 0x0ece6, 0x0ece8, 0x0eceb, 0x0eced, 0x0ecef, 0x0ecef,
+	0x0ed00, 0x0ed01, 0x0ed05, 0x0ed05, 0x0ed07, 0x0ed07, 0x0ed0a, 0x0ed0a,
+	0x0ed12, 0x0ed12, 0x0ed26, 0x0ed28, 0x0ed2b, 0x0ed2d, 0x0ed2f, 0x0ed2f,
+	0x0ed40, 0x0ed41, 0x0ed45, 0x0ed45, 0x0ed47, 0x0ed47, 0x0ed4a, 0x0ed4a,
+	0x0ed52, 0x0ed52, 0x0ed66, 0x0ed68, 0x0ed6b, 0x0ed6d, 0x0ed6f, 0x0ed6f,
+	0x0ed80, 0x0ed81, 0x0ed85, 0x0ed85, 0x0ed87, 0x0ed87, 0x0ed8a, 0x0ed8a,
+	0x0ed92, 0x0ed92, 0x0eda6, 0x0eda8, 0x0edab, 0x0edad, 0x0edaf, 0x0edaf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_gpu_registers), 8));
+
+static const u32 gen7_2_0_gmu_registers[] = {
+	0x10001, 0x10001, 0x10003, 0x10003, 0x10401, 0x10401, 0x10403, 0x10403,
+	0x10801, 0x10801, 0x10803, 0x10803, 0x10c01, 0x10c01, 0x10c03, 0x10c03,
+	0x11001, 0x11001, 0x11003, 0x11003, 0x11401, 0x11401, 0x11403, 0x11403,
+	0x11801, 0x11801, 0x11803, 0x11803, 0x11c01, 0x11c01, 0x11c03, 0x11c03,
+	0x1a79b, 0x1a79b, 0x1a7ac, 0x1a7b9, 0x1a7dc, 0x1a7dd, 0x1a7e0, 0x1a7e1,
+	0x1a803, 0x1a803, 0x1a805, 0x1a806, 0x1a84e, 0x1a84e, 0x1a856, 0x1a856,
+	0x1f400, 0x1f40d, 0x1f40f, 0x1f411, 0x1f500, 0x1f500, 0x1f507, 0x1f507,
+	0x1f509, 0x1f50b, 0x1f700, 0x1f701, 0x1f704, 0x1f706, 0x1f708, 0x1f709,
+	0x1f70c, 0x1f70d, 0x1f710, 0x1f711, 0x1f713, 0x1f716, 0x1f720, 0x1f724,
+	0x1f729, 0x1f729, 0x1f730, 0x1f747, 0x1f760, 0x1f761, 0x1f764, 0x1f76b,
+	0x1f800, 0x1f804, 0x1f807, 0x1f808, 0x1f80b, 0x1f80c, 0x1f80f, 0x1f80f,
+	0x1f811, 0x1f811, 0x1f813, 0x1f817, 0x1f819, 0x1f81c, 0x1f824, 0x1f82a,
+	0x1f82d, 0x1f830, 0x1f840, 0x1f853, 0x1f860, 0x1f860, 0x1f862, 0x1f864,
+	0x1f868, 0x1f868, 0x1f870, 0x1f879, 0x1f87f, 0x1f87f, 0x1f888, 0x1f889,
+	0x1f8a0, 0x1f8a2, 0x1f890, 0x1f892, 0x1f894, 0x1f896, 0x1f8a4, 0x1f8af,
+	0x1f8b8, 0x1f8b9, 0x1f8c0, 0x1f8c1, 0x1f8c3, 0x1f8c4, 0x1f8d0, 0x1f8d0,
+	0x1f8ec, 0x1f8ec, 0x1f8f0, 0x1f8f1, 0x1f910, 0x1f917, 0x1f920, 0x1f921,
+	0x1f924, 0x1f925, 0x1f928, 0x1f929, 0x1f92c, 0x1f92d, 0x1f940, 0x1f940,
+	0x1f942, 0x1f944, 0x1f948, 0x1f94a, 0x1f94f, 0x1f951, 0x1f954, 0x1f955,
+	0x1f958, 0x1f95a, 0x1f95d, 0x1f95d, 0x1f962, 0x1f96b, 0x1f970, 0x1f979,
+	0x1f97c, 0x1f97c, 0x1f980, 0x1f981, 0x1f984, 0x1f986, 0x1f992, 0x1f993,
+	0x1f996, 0x1f99e, 0x1f9c0, 0x1f9c0, 0x1f9c5, 0x1f9d4, 0x1f9f0, 0x1f9f1,
+	0x1f9f8, 0x1f9fa, 0x1f9fc, 0x1f9fc, 0x1fa00, 0x1fa03, 0x20000, 0x20012,
+	0x20018, 0x20018, 0x2001a, 0x2001a, 0x20020, 0x20024, 0x20030, 0x20031,
+	0x20034, 0x20036, 0x23801, 0x23801, 0x23803, 0x23803, 0x23805, 0x23805,
+	0x23807, 0x23807, 0x23809, 0x23809, 0x2380b, 0x2380b, 0x2380d, 0x2380d,
+	0x2380f, 0x2380f, 0x23811, 0x23811, 0x23813, 0x23813, 0x23815, 0x23815,
+	0x23817, 0x23817, 0x23819, 0x23819, 0x2381b, 0x2381b, 0x2381d, 0x2381d,
+	0x2381f, 0x23820, 0x23822, 0x23822, 0x23824, 0x23824, 0x23826, 0x23826,
+	0x23828, 0x23828, 0x2382a, 0x2382a, 0x2382c, 0x2382c, 0x2382e, 0x2382e,
+	0x23830, 0x23830, 0x23832, 0x23832, 0x23834, 0x23834, 0x23836, 0x23836,
+	0x23838, 0x23838, 0x2383a, 0x2383a, 0x2383c, 0x2383c, 0x2383e, 0x2383e,
+	0x23840, 0x23847, 0x23b00, 0x23b01, 0x23b03, 0x23b03, 0x23b05, 0x23b0e,
+	0x23b10, 0x23b13, 0x23b15, 0x23b16, 0x23b20, 0x23b20, 0x23b28, 0x23b28,
+	0x23b30, 0x23b30,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_gmu_registers), 8));
+
+static const u32 gen7_2_0_gmugx_registers[] = {
+	0x1a400, 0x1a41f, 0x1a440, 0x1a45f, 0x1a480, 0x1a49f, 0x1a4c0, 0x1a4df,
+	0x1a500, 0x1a51f, 0x1a540, 0x1a55f, 0x1a580, 0x1a59f, 0x1a5c0, 0x1a5df,
+	0x1a600, 0x1a61f, 0x1a640, 0x1a65f, 0x1a780, 0x1a781, 0x1a783, 0x1a785,
+	0x1a787, 0x1a789, 0x1a78b, 0x1a78d, 0x1a78f, 0x1a791, 0x1a793, 0x1a795,
+	0x1a797, 0x1a799, 0x1a79c, 0x1a79d, 0x1a79f, 0x1a79f, 0x1a7a0, 0x1a7a1,
+	0x1a7a3, 0x1a7a3, 0x1a7a8, 0x1a7ab, 0x1a7c0, 0x1a7c1, 0x1a7c4, 0x1a7c5,
+	0x1a7c8, 0x1a7c9, 0x1a7cc, 0x1a7cd, 0x1a7d0, 0x1a7d1, 0x1a7d4, 0x1a7d5,
+	0x1a7d8, 0x1a7d9, 0x1a7fc, 0x1a7fd, 0x1a800, 0x1a802, 0x1a804, 0x1a804,
+	0x1a816, 0x1a816, 0x1a81e, 0x1a81e, 0x1a826, 0x1a826, 0x1a82e, 0x1a82e,
+	0x1a836, 0x1a836, 0x1a83e, 0x1a83e, 0x1a846, 0x1a846, 0x1a860, 0x1a862,
+	0x1a864, 0x1a867, 0x1a870, 0x1a870, 0x1a883, 0x1a884, 0x1a8c0, 0x1a8c2,
+	0x1a8c4, 0x1a8c7, 0x1a8d0, 0x1a8d3, 0x1a900, 0x1a92b, 0x1a940, 0x1a940,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_gmugx_registers), 8));
+
+static const u32 gen7_2_0_noncontext_pipe_br_registers[] = {
+	0x00887, 0x0088c, 0x08600, 0x08600, 0x08602, 0x08602, 0x08610, 0x0861b,
+	0x08620, 0x08620, 0x08630, 0x08630, 0x08637, 0x08639, 0x08640, 0x08640,
+	0x09600, 0x09600, 0x09602, 0x09603, 0x0960a, 0x09616, 0x09624, 0x0963a,
+	0x09640, 0x09640, 0x09e00, 0x09e00, 0x09e02, 0x09e07, 0x09e0a, 0x09e16,
+	0x09e19, 0x09e19, 0x09e1c, 0x09e1c, 0x09e20, 0x09e25, 0x09e30, 0x09e31,
+	0x09e40, 0x09e51, 0x09e64, 0x09e64, 0x09e70, 0x09e72, 0x09e78, 0x09e79,
+	0x09e80, 0x09fff, 0x0a600, 0x0a600, 0x0a603, 0x0a603, 0x0a610, 0x0a61f,
+	0x0a630, 0x0a631, 0x0a638, 0x0a63c,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_noncontext_pipe_br_registers), 8));
+
+static const u32 gen7_2_0_noncontext_pipe_bv_registers[] = {
+	0x00887, 0x0088c, 0x08600, 0x08600, 0x08602, 0x08602, 0x08610, 0x0861b,
+	0x08620, 0x08620, 0x08630, 0x08630, 0x08637, 0x08639, 0x08640, 0x08640,
+	0x09600, 0x09600, 0x09602, 0x09603, 0x0960a, 0x09616, 0x09624, 0x0963a,
+	0x09640, 0x09640, 0x09e00, 0x09e00, 0x09e02, 0x09e07, 0x09e0a, 0x09e16,
+	0x09e19, 0x09e19, 0x09e1c, 0x09e1c, 0x09e20, 0x09e25, 0x09e30, 0x09e31,
+	0x09e40, 0x09e51, 0x09e64, 0x09e64, 0x09e70, 0x09e72, 0x09e78, 0x09e79,
+	0x09e80, 0x09fff, 0x0a600, 0x0a600, 0x0a603, 0x0a603, 0x0a610, 0x0a61f,
+	0x0a630, 0x0a631, 0x0a638, 0x0a63c,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_noncontext_pipe_bv_registers), 8));
+
+static const u32 gen7_2_0_noncontext_rb_rac_pipe_br_registers[] = {
+	0x08e10, 0x08e1c, 0x08e20, 0x08e25, 0x08e51, 0x08e5a, 0x08ea0, 0x08ea3,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_noncontext_rb_rac_pipe_br_registers), 8));
+
+static const u32 gen7_2_0_noncontext_rb_rbp_pipe_br_registers[] = {
+	0x08e01, 0x08e01, 0x08e04, 0x08e04, 0x08e06, 0x08e09, 0x08e0c, 0x08e0c,
+	0x08e28, 0x08e28, 0x08e2c, 0x08e35, 0x08e3b, 0x08e40, 0x08e50, 0x08e50,
+	0x08e5b, 0x08e5d, 0x08e5f, 0x08e5f, 0x08e61, 0x08e61, 0x08e63, 0x08e66,
+	0x08e68, 0x08e69, 0x08e70, 0x08e79, 0x08e80, 0x08e8f,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_noncontext_rb_rbp_pipe_br_registers), 8));
+
+static const u32 gen7_2_0_gras_cluster_gras_pipe_br_registers[] = {
+	0x08000, 0x0800c, 0x08010, 0x08092, 0x08094, 0x08099, 0x0809b, 0x0809d,
+	0x080a0, 0x080a7, 0x080af, 0x080f1, 0x080f4, 0x080f6, 0x080f8, 0x080fa,
+	0x08100, 0x08107, 0x08109, 0x0810b, 0x08110, 0x08113, 0x08120, 0x0813f,
+	0x08400, 0x08406, 0x0840a, 0x0840b,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_gras_cluster_gras_pipe_br_registers), 8));
+
+static const u32 gen7_2_0_gras_cluster_gras_pipe_bv_registers[] = {
+	0x08000, 0x0800c, 0x08010, 0x08092, 0x08094, 0x08099, 0x0809b, 0x0809d,
+	0x080a0, 0x080a7, 0x080af, 0x080f1, 0x080f4, 0x080f6, 0x080f8, 0x080fa,
+	0x08100, 0x08107, 0x08109, 0x0810b, 0x08110, 0x08113, 0x08120, 0x0813f,
+	0x08400, 0x08406, 0x0840a, 0x0840b,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_gras_cluster_gras_pipe_bv_registers), 8));
+
+static const u32 gen7_2_0_rb_rac_cluster_ps_pipe_br_registers[] = {
+	0x08802, 0x08802, 0x08804, 0x08806, 0x08809, 0x0880a, 0x0880e, 0x08811,
+	0x08818, 0x0881e, 0x08821, 0x08821, 0x08823, 0x08826, 0x08829, 0x08829,
+	0x0882b, 0x0882e, 0x08831, 0x08831, 0x08833, 0x08836, 0x08839, 0x08839,
+	0x0883b, 0x0883e, 0x08841, 0x08841, 0x08843, 0x08846, 0x08849, 0x08849,
+	0x0884b, 0x0884e, 0x08851, 0x08851, 0x08853, 0x08856, 0x08859, 0x08859,
+	0x0885b, 0x0885e, 0x08860, 0x08864, 0x08870, 0x08870, 0x08873, 0x08876,
+	0x08878, 0x08879, 0x08882, 0x08885, 0x08887, 0x08889, 0x08891, 0x08891,
+	0x08898, 0x08899, 0x088c0, 0x088c1, 0x088e5, 0x088e5, 0x088f4, 0x088f5,
+	0x08a00, 0x08a05, 0x08a10, 0x08a15, 0x08a20, 0x08a25, 0x08a30, 0x08a35,
+	0x08c00, 0x08c01, 0x08c18, 0x08c1f, 0x08c26, 0x08c34,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_rb_rac_cluster_ps_pipe_br_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers[] = {
+	0x0a980, 0x0a984, 0x0a99e, 0x0a99e, 0x0a9a7, 0x0a9a7, 0x0a9aa, 0x0a9aa,
+	0x0a9ae, 0x0a9b0, 0x0a9b2, 0x0a9b5, 0x0a9ba, 0x0a9ba, 0x0a9bc, 0x0a9bc,
+	0x0a9c4, 0x0a9c4, 0x0a9cd, 0x0a9cd, 0x0a9e0, 0x0a9fc, 0x0aa00, 0x0aa00,
+	0x0aa30, 0x0aa31, 0x0aa40, 0x0aabf, 0x0ab00, 0x0ab03, 0x0ab05, 0x0ab05,
+	0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_ps_pipe_br_sp_top_registers[] = {
+	0x0a980, 0x0a980, 0x0a982, 0x0a984, 0x0a99e, 0x0a9a2, 0x0a9a7, 0x0a9a8,
+	0x0a9aa, 0x0a9aa, 0x0a9ae, 0x0a9ae, 0x0a9b0, 0x0a9b1, 0x0a9b3, 0x0a9b5,
+	0x0a9ba, 0x0a9bc, 0x0a9c5, 0x0a9c5, 0x0a9e0, 0x0a9f9, 0x0aa00, 0x0aa01,
+	0x0ab00, 0x0ab00, 0x0ab02, 0x0ab02, 0x0ab04, 0x0ab05, 0x0ab0a, 0x0ab1b,
+	0x0ab20, 0x0ab20,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_ps_pipe_br_sp_top_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_ps_pipe_br_usptp_registers[] = {
+	0x0a980, 0x0a982, 0x0a985, 0x0a9a6, 0x0a9a8, 0x0a9a9, 0x0a9ab, 0x0a9ae,
+	0x0a9b0, 0x0a9b3, 0x0a9b6, 0x0a9b9, 0x0a9bb, 0x0a9bf, 0x0a9c2, 0x0a9c3,
+	0x0a9c5, 0x0a9c5, 0x0a9cd, 0x0a9cd, 0x0a9d0, 0x0a9d3, 0x0aa01, 0x0aa01,
+	0x0aa30, 0x0aa31, 0x0aa40, 0x0aabf, 0x0ab00, 0x0ab05, 0x0ab21, 0x0ab22,
+	0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_ps_pipe_br_usptp_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_ps_pipe_lpac_hlsq_state_registers[] = {
+	0x0a9b0, 0x0a9b0, 0x0a9b2, 0x0a9b5, 0x0a9ba, 0x0a9ba, 0x0a9bc, 0x0a9bc,
+	0x0a9c4, 0x0a9c4, 0x0a9cd, 0x0a9cd, 0x0a9e2, 0x0a9e3, 0x0a9e6, 0x0a9fc,
+	0x0aa00, 0x0aa00, 0x0aa31, 0x0aa31, 0x0ab00, 0x0ab01,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_ps_pipe_lpac_hlsq_state_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_ps_pipe_lpac_sp_top_registers[] = {
+	0x0a9b0, 0x0a9b1, 0x0a9b3, 0x0a9b5, 0x0a9ba, 0x0a9bc, 0x0a9c5, 0x0a9c5,
+	0x0a9e2, 0x0a9e3, 0x0a9e6, 0x0a9f9, 0x0aa00, 0x0aa00, 0x0ab00, 0x0ab00,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_ps_pipe_lpac_sp_top_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_ps_pipe_lpac_usptp_registers[] = {
+	0x0a9b0, 0x0a9b3, 0x0a9b6, 0x0a9b9, 0x0a9bb, 0x0a9be, 0x0a9c2, 0x0a9c3,
+	0x0a9c5, 0x0a9c5, 0x0a9cd, 0x0a9cd, 0x0a9d0, 0x0a9d3, 0x0aa31, 0x0aa31,
+	0x0ab00, 0x0ab01,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_ps_pipe_lpac_usptp_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_vs_pipe_br_hlsq_state_registers[] = {
+	0x0a800, 0x0a801, 0x0a81b, 0x0a81d, 0x0a822, 0x0a822, 0x0a824, 0x0a824,
+	0x0a827, 0x0a82a, 0x0a830, 0x0a830, 0x0a832, 0x0a835, 0x0a83a, 0x0a83a,
+	0x0a83c, 0x0a83c, 0x0a83f, 0x0a841, 0x0a85b, 0x0a85d, 0x0a862, 0x0a862,
+	0x0a864, 0x0a864, 0x0a867, 0x0a867, 0x0a870, 0x0a870, 0x0a872, 0x0a872,
+	0x0a88c, 0x0a88e, 0x0a893, 0x0a893, 0x0a895, 0x0a895, 0x0a898, 0x0a898,
+	0x0a89a, 0x0a89d, 0x0a8a0, 0x0a8af, 0x0a8c0, 0x0a8c3, 0x0ab00, 0x0ab03,
+	0x0ab05, 0x0ab05, 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_vs_pipe_br_hlsq_state_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_vs_pipe_br_sp_top_registers[] = {
+	0x0a800, 0x0a800, 0x0a81c, 0x0a81d, 0x0a822, 0x0a824, 0x0a82d, 0x0a82d,
+	0x0a82f, 0x0a831, 0x0a834, 0x0a835, 0x0a83a, 0x0a83c, 0x0a840, 0x0a840,
+	0x0a85c, 0x0a85d, 0x0a862, 0x0a864, 0x0a868, 0x0a868, 0x0a870, 0x0a871,
+	0x0a88d, 0x0a88e, 0x0a893, 0x0a895, 0x0a899, 0x0a899, 0x0a8a0, 0x0a8af,
+	0x0ab00, 0x0ab00, 0x0ab02, 0x0ab02, 0x0ab04, 0x0ab05, 0x0ab0a, 0x0ab1b,
+	0x0ab20, 0x0ab20,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_vs_pipe_br_sp_top_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_vs_pipe_br_usptp_registers[] = {
+	0x0a800, 0x0a81b, 0x0a81e, 0x0a821, 0x0a823, 0x0a827, 0x0a82d, 0x0a82d,
+	0x0a82f, 0x0a833, 0x0a836, 0x0a839, 0x0a83b, 0x0a85b, 0x0a85e, 0x0a861,
+	0x0a863, 0x0a868, 0x0a870, 0x0a88c, 0x0a88f, 0x0a892, 0x0a894, 0x0a899,
+	0x0a8c0, 0x0a8c3, 0x0ab00, 0x0ab05, 0x0ab21, 0x0ab22, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_vs_pipe_br_usptp_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_vs_pipe_bv_hlsq_state_registers[] = {
+	0x0a800, 0x0a801, 0x0a81b, 0x0a81d, 0x0a822, 0x0a822, 0x0a824, 0x0a824,
+	0x0a827, 0x0a82a, 0x0a830, 0x0a830, 0x0a832, 0x0a835, 0x0a83a, 0x0a83a,
+	0x0a83c, 0x0a83c, 0x0a83f, 0x0a841, 0x0a85b, 0x0a85d, 0x0a862, 0x0a862,
+	0x0a864, 0x0a864, 0x0a867, 0x0a867, 0x0a870, 0x0a870, 0x0a872, 0x0a872,
+	0x0a88c, 0x0a88e, 0x0a893, 0x0a893, 0x0a895, 0x0a895, 0x0a898, 0x0a898,
+	0x0a89a, 0x0a89d, 0x0a8a0, 0x0a8af, 0x0a8c0, 0x0a8c3, 0x0ab00, 0x0ab02,
+	0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_vs_pipe_bv_hlsq_state_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_vs_pipe_bv_sp_top_registers[] = {
+	0x0a800, 0x0a800, 0x0a81c, 0x0a81d, 0x0a822, 0x0a824, 0x0a82d, 0x0a82d,
+	0x0a82f, 0x0a831, 0x0a834, 0x0a835, 0x0a83a, 0x0a83c, 0x0a840, 0x0a840,
+	0x0a85c, 0x0a85d, 0x0a862, 0x0a864, 0x0a868, 0x0a868, 0x0a870, 0x0a871,
+	0x0a88d, 0x0a88e, 0x0a893, 0x0a895, 0x0a899, 0x0a899, 0x0a8a0, 0x0a8af,
+	0x0ab00, 0x0ab00, 0x0ab02, 0x0ab02, 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_vs_pipe_bv_sp_top_registers), 8));
+
+static const u32 gen7_2_0_sp_cluster_sp_vs_pipe_bv_usptp_registers[] = {
+	0x0a800, 0x0a81b, 0x0a81e, 0x0a821, 0x0a823, 0x0a827, 0x0a82d, 0x0a82d,
+	0x0a82f, 0x0a833, 0x0a836, 0x0a839, 0x0a83b, 0x0a85b, 0x0a85e, 0x0a861,
+	0x0a863, 0x0a868, 0x0a870, 0x0a88c, 0x0a88f, 0x0a892, 0x0a894, 0x0a899,
+	0x0a8c0, 0x0a8c3, 0x0ab00, 0x0ab02, 0x0ab21, 0x0ab22, 0x0ab40, 0x0abbf,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_cluster_sp_vs_pipe_bv_usptp_registers), 8));
+
+static const u32 gen7_2_0_sp_noncontext_pipe_lpac_hlsq_state_registers[] = {
+	0x0af88, 0x0af8b,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_sp_noncontext_pipe_lpac_hlsq_state_registers), 8));
+
+static const struct gen7_sel_reg  gen7_2_0_rb_rac_sel = {
+	.host_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_HOST,
+	.cd_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_CD,
+	.val = 0x0,
+};
+
+static const struct gen7_sel_reg gen7_2_0_rb_rbp_sel = {
+	.host_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_HOST,
+	.cd_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_CD,
+	.val = 0x9,
+};
+
+static struct gen7_cluster_registers gen7_2_0_clusters[] = {
+	{ CLUSTER_NONE, PIPE_BR, STATE_NON_CONTEXT,
+		gen7_2_0_noncontext_pipe_br_registers, },
+	{ CLUSTER_NONE, PIPE_BV, STATE_NON_CONTEXT,
+		gen7_2_0_noncontext_pipe_bv_registers, },
+	{ CLUSTER_NONE, PIPE_LPAC, STATE_NON_CONTEXT,
+		gen7_0_0_noncontext_pipe_lpac_registers, },
+	{ CLUSTER_NONE, PIPE_BR, STATE_NON_CONTEXT,
+		gen7_2_0_noncontext_rb_rac_pipe_br_registers, &gen7_2_0_rb_rac_sel, },
+	{ CLUSTER_NONE, PIPE_BR, STATE_NON_CONTEXT,
+		gen7_2_0_noncontext_rb_rbp_pipe_br_registers, &gen7_2_0_rb_rbp_sel, },
+	{ CLUSTER_GRAS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_2_0_gras_cluster_gras_pipe_br_registers, },
+	{ CLUSTER_GRAS, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_2_0_gras_cluster_gras_pipe_bv_registers, },
+	{ CLUSTER_GRAS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_2_0_gras_cluster_gras_pipe_br_registers, },
+	{ CLUSTER_GRAS, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_2_0_gras_cluster_gras_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_pc_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_pc_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_pc_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_pc_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_2_0_rb_rac_cluster_ps_pipe_br_registers, &gen7_2_0_rb_rac_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_2_0_rb_rac_cluster_ps_pipe_br_registers, &gen7_2_0_rb_rac_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_rb_rbp_cluster_ps_pipe_br_registers, &gen7_2_0_rb_rbp_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_rb_rbp_cluster_ps_pipe_br_registers, &gen7_2_0_rb_rbp_sel, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_vfd_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_vfd_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_vfd_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_vfd_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_fe_pipe_br_registers, },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_fe_pipe_bv_registers, },
+	{ CLUSTER_PC_VS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_pc_vs_pipe_br_registers, },
+	{ CLUSTER_PC_VS, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_pc_vs_pipe_bv_registers, },
+	{ CLUSTER_PC_VS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_pc_vs_pipe_br_registers, },
+	{ CLUSTER_PC_VS, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_pc_vs_pipe_bv_registers, },
+	{ CLUSTER_VPC_PS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_vpc_ps_pipe_br_registers, },
+	{ CLUSTER_VPC_PS, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_0_0_vpc_cluster_vpc_ps_pipe_bv_registers, },
+	{ CLUSTER_VPC_PS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_vpc_ps_pipe_br_registers, },
+	{ CLUSTER_VPC_PS, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_0_0_vpc_cluster_vpc_ps_pipe_bv_registers, },
+};
+
+static struct gen7_sptp_cluster_registers gen7_2_0_sptp_clusters[] = {
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, HLSQ_STATE,
+		gen7_0_0_sp_noncontext_pipe_br_hlsq_state_registers, 0xae00 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, SP_TOP,
+		gen7_0_0_sp_noncontext_pipe_br_sp_top_registers, 0xae00 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_sp_noncontext_pipe_br_usptp_registers, 0xae00 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_LPAC, 0, HLSQ_STATE,
+		gen7_2_0_sp_noncontext_pipe_lpac_hlsq_state_registers, 0xaf80 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_LPAC, 0, SP_TOP,
+		gen7_0_0_sp_noncontext_pipe_lpac_sp_top_registers, 0xaf80 },
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_LPAC, 0, USPTP,
+		gen7_0_0_sp_noncontext_pipe_lpac_usptp_registers, 0xaf80 },
+	{ CLUSTER_NONE, TP0_NCTX_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_tpl1_noncontext_pipe_br_registers, 0xb600 },
+	{ CLUSTER_NONE, TP0_NCTX_REG, PIPE_LPAC, 0, USPTP,
+		gen7_0_0_tpl1_noncontext_pipe_lpac_registers, 0xb780 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, HLSQ_STATE,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, SP_TOP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, USPTP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, HLSQ_STATE,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, SP_TOP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, USPTP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_br_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, SP_TOP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, USPTP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, SP_TOP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, USPTP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, HLSQ_STATE,
+		gen7_2_0_sp_cluster_sp_ps_pipe_lpac_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, HLSQ_DP,
+		gen7_0_0_sp_cluster_sp_ps_pipe_lpac_hlsq_dp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, SP_TOP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_lpac_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, USPTP,
+		gen7_2_0_sp_cluster_sp_ps_pipe_lpac_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BR, 0, HLSQ_STATE,
+		gen7_2_0_sp_cluster_sp_vs_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BV, 0, HLSQ_STATE,
+		gen7_2_0_sp_cluster_sp_vs_pipe_bv_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BR, 0, SP_TOP,
+		gen7_2_0_sp_cluster_sp_vs_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BV, 0, SP_TOP,
+		gen7_2_0_sp_cluster_sp_vs_pipe_bv_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BR, 0, USPTP,
+		gen7_2_0_sp_cluster_sp_vs_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BV, 0, USPTP,
+		gen7_2_0_sp_cluster_sp_vs_pipe_bv_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BR, 1, HLSQ_STATE,
+		gen7_2_0_sp_cluster_sp_vs_pipe_br_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BV, 1, HLSQ_STATE,
+		gen7_2_0_sp_cluster_sp_vs_pipe_bv_hlsq_state_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BR, 1, SP_TOP,
+		gen7_2_0_sp_cluster_sp_vs_pipe_br_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BV, 1, SP_TOP,
+		gen7_2_0_sp_cluster_sp_vs_pipe_bv_sp_top_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BR, 1, USPTP,
+		gen7_2_0_sp_cluster_sp_vs_pipe_br_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BV, 1, USPTP,
+		gen7_2_0_sp_cluster_sp_vs_pipe_bv_usptp_registers, 0xa800 },
+	{ CLUSTER_SP_PS, TP0_CTX0_3D_CPS_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_PS, TP0_CTX1_3D_CPS_REG, PIPE_BR, 1, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_PS, TP0_CTX2_3D_CPS_REG, PIPE_BR, 2, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_PS, TP0_CTX3_3D_CPS_REG, PIPE_BR, 3, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_PS, TP0_CTX0_3D_CPS_REG, PIPE_LPAC, 0, USPTP,
+		gen7_0_0_tpl1_cluster_sp_ps_pipe_lpac_registers, 0xb000 },
+	{ CLUSTER_SP_VS, TP0_CTX0_3D_CVS_REG, PIPE_BR, 0, USPTP,
+		gen7_0_0_tpl1_cluster_sp_vs_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_VS, TP0_CTX0_3D_CVS_REG, PIPE_BV, 0, USPTP,
+		gen7_0_0_tpl1_cluster_sp_vs_pipe_bv_registers, 0xb000 },
+	{ CLUSTER_SP_VS, TP0_CTX1_3D_CVS_REG, PIPE_BR, 1, USPTP,
+		gen7_0_0_tpl1_cluster_sp_vs_pipe_br_registers, 0xb000 },
+	{ CLUSTER_SP_VS, TP0_CTX1_3D_CVS_REG, PIPE_BV, 1, USPTP,
+		gen7_0_0_tpl1_cluster_sp_vs_pipe_bv_registers, 0xb000 },
+};
+
+static const u32 gen7_2_0_dbgc_registers[] = {
+	0x005ff, 0x0061c, 0x0061e, 0x00634, 0x00640, 0x0065e, 0x00679, 0x0067e,
+	0x00699, 0x00699, 0x0069b, 0x0069e, 0x006a0, 0x006a3, 0x006c0, 0x006c1,
+	0x18400, 0x1841c, 0x1841e, 0x18434, 0x18440, 0x1845c, 0x18479, 0x1847c,
+	0x18580, 0x18581,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_dbgc_registers), 8));
+
+static const u32 gen7_2_0_rscc_registers[] = {
+	0x14000, 0x14036, 0x14040, 0x14047, 0x14080, 0x14084, 0x14089, 0x1408c,
+	0x14091, 0x14094, 0x14099, 0x1409c, 0x140a1, 0x140a4, 0x140a9, 0x140ac,
+	0x14100, 0x14104, 0x14114, 0x14119, 0x14124, 0x14132, 0x14154, 0x1416b,
+	0x14340, 0x14342, 0x14344, 0x1437c, 0x143f0, 0x143f8, 0x143fa, 0x143fe,
+	0x14400, 0x14404, 0x14406, 0x1440a, 0x1440c, 0x14410, 0x14412, 0x14416,
+	0x14418, 0x1441c, 0x1441e, 0x14422, 0x14424, 0x14424, 0x14498, 0x144a0,
+	0x144a2, 0x144a6, 0x144a8, 0x144ac, 0x144ae, 0x144b2, 0x144b4, 0x144b8,
+	0x144ba, 0x144be, 0x144c0, 0x144c4, 0x144c6, 0x144ca, 0x144cc, 0x144cc,
+	0x14540, 0x14548, 0x1454a, 0x1454e, 0x14550, 0x14554, 0x14556, 0x1455a,
+	0x1455c, 0x14560, 0x14562, 0x14566, 0x14568, 0x1456c, 0x1456e, 0x14572,
+	0x14574, 0x14574, 0x145e8, 0x145f0, 0x145f2, 0x145f6, 0x145f8, 0x145fc,
+	0x145fe, 0x14602, 0x14604, 0x14608, 0x1460a, 0x1460e, 0x14610, 0x14614,
+	0x14616, 0x1461a, 0x1461c, 0x1461c, 0x14690, 0x14698, 0x1469a, 0x1469e,
+	0x146a0, 0x146a4, 0x146a6, 0x146aa, 0x146ac, 0x146b0, 0x146b2, 0x146b6,
+	0x146b8, 0x146bc, 0x146be, 0x146c2, 0x146c4, 0x146c4, 0x14738, 0x14740,
+	0x14742, 0x14746, 0x14748, 0x1474c, 0x1474e, 0x14752, 0x14754, 0x14758,
+	0x1475a, 0x1475e, 0x14760, 0x14764, 0x14766, 0x1476a, 0x1476c, 0x1476c,
+	0x147e0, 0x147e8, 0x147ea, 0x147ee, 0x147f0, 0x147f4, 0x147f6, 0x147fa,
+	0x147fc, 0x14800, 0x14802, 0x14806, 0x14808, 0x1480c, 0x1480e, 0x14812,
+	0x14814, 0x14814, 0x14888, 0x14890, 0x14892, 0x14896, 0x14898, 0x1489c,
+	0x1489e, 0x148a2, 0x148a4, 0x148a8, 0x148aa, 0x148ae, 0x148b0, 0x148b4,
+	0x148b6, 0x148ba, 0x148bc, 0x148bc, 0x14930, 0x14938, 0x1493a, 0x1493e,
+	0x14940, 0x14944, 0x14946, 0x1494a, 0x1494c, 0x14950, 0x14952, 0x14956,
+	0x14958, 0x1495c, 0x1495e, 0x14962, 0x14964, 0x14964,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_rscc_registers), 8));
+
+static const u32 gen7_2_0_cpr_registers[] = {
+	0x26800, 0x26805, 0x26808, 0x2680c, 0x26814, 0x26814, 0x2681c, 0x2681c,
+	0x26820, 0x26838, 0x26840, 0x26840, 0x26848, 0x26848, 0x26850, 0x26850,
+	0x26880, 0x2689e, 0x26980, 0x269b0, 0x269c0, 0x269c8, 0x269e0, 0x269ee,
+	0x269fb, 0x269ff, 0x26a02, 0x26a07, 0x26a09, 0x26a0b, 0x26a10, 0x26b0f,
+	0x27440, 0x27441, 0x27444, 0x27444, 0x27480, 0x274a2, 0x274ac, 0x274ad,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_cpr_registers), 8));
+
+static const u32 gen7_2_0_dpm_lkg_registers[] = {
+	0x21c00, 0x21c00, 0x21c08, 0x21c09, 0x21c0e, 0x21c0f, 0x21c4f, 0x21c50,
+	0x21c52, 0x21c52, 0x21c54, 0x21c56, 0x21c58, 0x21c5a, 0x21c5c, 0x21c60,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_dpm_lkg_registers), 8));
+
+static const u32 gen7_2_0_gpucc_registers[] = {
+	0x24000, 0x2400f, 0x24400, 0x2440f, 0x24800, 0x24805, 0x24c00, 0x24cff,
+	0x25400, 0x25404, 0x25800, 0x25804, 0x25c00, 0x25c04, 0x26000, 0x26004,
+	0x26400, 0x26405, 0x26414, 0x2641d, 0x2642a, 0x26430, 0x26432, 0x26433,
+	0x26441, 0x2644b, 0x2644d, 0x26457, 0x26466, 0x26468, 0x26478, 0x2647a,
+	0x26489, 0x2648a, 0x2649c, 0x2649e, 0x264a0, 0x264a4, 0x264c5, 0x264c7,
+	0x264d6, 0x264d8, 0x264e8, 0x264e9, 0x264f9, 0x264fc, 0x2651c, 0x2651e,
+	0x26540, 0x26576, 0x26600, 0x26616, 0x26620, 0x2662d, 0x26630, 0x26631,
+	0x26635, 0x26635, 0x26637, 0x26637, 0x2663a, 0x2663a, 0x26642, 0x26642,
+	0x26656, 0x26658, 0x2665b, 0x2665d, 0x2665f, 0x26662,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_gpucc_registers), 8));
+
+static const u32 gen7_2_0_cx_misc_registers[] = {
+	0x27800, 0x27800, 0x27810, 0x27814, 0x27820, 0x27824, 0x27832, 0x27857,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_cx_misc_registers), 8));
+
+static const u32 gen7_2_0_dpm_registers[] = {
+	0x1aa00, 0x1aa06, 0x1aa09, 0x1aa0a, 0x1aa0c, 0x1aa0d, 0x1aa0f, 0x1aa12,
+	0x1aa14, 0x1aa47, 0x1aa50, 0x1aa51,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_2_0_dpm_registers), 8));
+
+static struct gen7_reg_list gen7_2_0_reg_list[] = {
+	{ gen7_2_0_gpu_registers, NULL },
+	{ gen7_2_0_dpm_registers, NULL },
+	{ gen7_2_0_dbgc_registers, NULL },
+	{ NULL, NULL },
+};
+
+static const u32 *gen7_2_0_external_core_regs[] = {
+	gen7_2_0_gpucc_registers,
+	gen7_2_0_cpr_registers,
+	gen7_2_0_dpm_lkg_registers,
+};
+#endif /*_ADRENO_GEN7_2_0_SNAPSHOT_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_9_0_snapshot.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_9_0_snapshot.h
@@ -0,0 +1,1425 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_GEN7_9_0_SNAPSHOT_H
+#define __ADRENO_GEN7_9_0_SNAPSHOT_H
+
+#include "adreno_gen7_snapshot.h"
+
+static const u32 gen7_9_0_debugbus_blocks[] = {
+	DEBUGBUS_CP_0_0,
+	DEBUGBUS_CP_0_1,
+	DEBUGBUS_RBBM,
+	DEBUGBUS_HLSQ,
+	DEBUGBUS_UCHE_0,
+	DEBUGBUS_UCHE_1,
+	DEBUGBUS_TESS_BR,
+	DEBUGBUS_TESS_BV,
+	DEBUGBUS_PC_BR,
+	DEBUGBUS_PC_BV,
+	DEBUGBUS_VFDP_BR,
+	DEBUGBUS_VFDP_BV,
+	DEBUGBUS_VPC_BR,
+	DEBUGBUS_VPC_BV,
+	DEBUGBUS_TSE_BR,
+	DEBUGBUS_TSE_BV,
+	DEBUGBUS_RAS_BR,
+	DEBUGBUS_RAS_BV,
+	DEBUGBUS_VSC,
+	DEBUGBUS_COM_0,
+	DEBUGBUS_LRZ_BR,
+	DEBUGBUS_LRZ_BV,
+	DEBUGBUS_UFC_0,
+	DEBUGBUS_UFC_1,
+	DEBUGBUS_GMU_GX,
+	DEBUGBUS_DBGC,
+	DEBUGBUS_GPC_BR,
+	DEBUGBUS_GPC_BV,
+	DEBUGBUS_LARC,
+	DEBUGBUS_HLSQ_SPTP,
+	DEBUGBUS_RB_0,
+	DEBUGBUS_RB_1,
+	DEBUGBUS_RB_2,
+	DEBUGBUS_RB_3,
+	DEBUGBUS_RB_4,
+	DEBUGBUS_RB_5,
+	DEBUGBUS_UCHE_WRAPPER,
+	DEBUGBUS_CCU_0,
+	DEBUGBUS_CCU_1,
+	DEBUGBUS_CCU_2,
+	DEBUGBUS_CCU_3,
+	DEBUGBUS_CCU_4,
+	DEBUGBUS_CCU_5,
+	DEBUGBUS_VFD_BR_0,
+	DEBUGBUS_VFD_BR_1,
+	DEBUGBUS_VFD_BR_2,
+	DEBUGBUS_VFD_BV_0,
+	DEBUGBUS_VFD_BV_1,
+	DEBUGBUS_VFD_BV_2,
+	DEBUGBUS_USP_0,
+	DEBUGBUS_USP_1,
+	DEBUGBUS_USP_2,
+	DEBUGBUS_USP_3,
+	DEBUGBUS_USP_4,
+	DEBUGBUS_USP_5,
+	DEBUGBUS_TP_0,
+	DEBUGBUS_TP_1,
+	DEBUGBUS_TP_2,
+	DEBUGBUS_TP_3,
+	DEBUGBUS_TP_4,
+	DEBUGBUS_TP_5,
+	DEBUGBUS_TP_6,
+	DEBUGBUS_TP_7,
+	DEBUGBUS_TP_8,
+	DEBUGBUS_TP_9,
+	DEBUGBUS_TP_10,
+	DEBUGBUS_TP_11,
+	DEBUGBUS_USPTP_0,
+	DEBUGBUS_USPTP_1,
+	DEBUGBUS_USPTP_2,
+	DEBUGBUS_USPTP_3,
+	DEBUGBUS_USPTP_4,
+	DEBUGBUS_USPTP_5,
+	DEBUGBUS_USPTP_6,
+	DEBUGBUS_USPTP_7,
+	DEBUGBUS_USPTP_8,
+	DEBUGBUS_USPTP_9,
+	DEBUGBUS_USPTP_10,
+	DEBUGBUS_USPTP_11,
+	DEBUGBUS_CCHE_0,
+	DEBUGBUS_CCHE_1,
+	DEBUGBUS_CCHE_2,
+	DEBUGBUS_VPC_DSTR_0,
+	DEBUGBUS_VPC_DSTR_1,
+	DEBUGBUS_VPC_DSTR_2,
+	DEBUGBUS_HLSQ_DP_STR_0,
+	DEBUGBUS_HLSQ_DP_STR_1,
+	DEBUGBUS_HLSQ_DP_STR_2,
+	DEBUGBUS_HLSQ_DP_STR_3,
+	DEBUGBUS_HLSQ_DP_STR_4,
+	DEBUGBUS_HLSQ_DP_STR_5,
+	DEBUGBUS_UFC_DSTR_0,
+	DEBUGBUS_UFC_DSTR_1,
+	DEBUGBUS_UFC_DSTR_2,
+	DEBUGBUS_CGC_SUBCORE,
+	DEBUGBUS_CGC_CORE,
+};
+
+static const u32 gen7_9_0_gbif_debugbus_blocks[] = {
+	DEBUGBUS_GBIF_GX,
+};
+
+static const u32 gen7_9_0_cx_debugbus_blocks[] = {
+	DEBUGBUS_CX,
+	DEBUGBUS_GMU_CX,
+	DEBUGBUS_GBIF_CX,
+};
+
+static struct gen7_shader_block gen7_9_0_shader_blocks[] = {
+	{ TP0_TMO_DATA, 0x0200, 6, 2, PIPE_BR, USPTP },
+	{ TP0_SMO_DATA, 0x0080, 6, 2, PIPE_BR, USPTP },
+	{ TP0_MIPMAP_BASE_DATA, 0x03C0, 6, 2, PIPE_BR, USPTP },
+	{ SP_INST_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_INST_DATA_1, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_0_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_1_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_2_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_3_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_4_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_5_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_6_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_7_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_CB_RAM, 0x0390, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_13_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_14_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_INST_TAG, 0x00C0, 6, 2, PIPE_BR, USPTP },
+	{ SP_INST_DATA_2, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_TMO_TAG, 0x0080, 6, 2, PIPE_BR, USPTP },
+	{ SP_SMO_TAG, 0x0080, 6, 2, PIPE_BR, USPTP },
+	{ SP_STATE_DATA, 0x0040, 6, 2, PIPE_BR, USPTP },
+	{ SP_HWAVE_RAM, 0x0100, 6, 2, PIPE_BR, USPTP },
+	{ SP_L0_INST_BUF, 0x0050, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_8_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_9_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_10_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_11_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ SP_LB_12_DATA, 0x0800, 6, 2, PIPE_BR, USPTP },
+	{ HLSQ_DATAPATH_DSTR_META, 0x0010, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_DATAPATH_DSTR_META, 0x0010, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_L2STC_TAG_RAM, 0x0200, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_L2STC_INFO_CMD, 0x0474, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CVS_BE_CTXT_BUF_RAM_TAG, 0x0080, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CVS_BE_CTXT_BUF_RAM_TAG, 0x0080, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_CPS_BE_CTXT_BUF_RAM_TAG, 0x0080, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_GFX_CVS_BE_CTXT_BUF_RAM, 0x0400, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_GFX_CVS_BE_CTXT_BUF_RAM, 0x0400, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_GFX_CPS_BE_CTXT_BUF_RAM, 0x0400, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CHUNK_CVS_RAM, 0x01C0, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CHUNK_CVS_RAM, 0x01C0, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_CHUNK_CPS_RAM, 0x0300, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CHUNK_CPS_RAM, 0x0180, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_CHUNK_CVS_RAM_TAG, 0x0040, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CHUNK_CVS_RAM_TAG, 0x0040, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_CHUNK_CPS_RAM_TAG, 0x0040, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CHUNK_CPS_RAM_TAG, 0x0040, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_ICB_CVS_CB_BASE_TAG, 0x0010, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_ICB_CVS_CB_BASE_TAG, 0x0010, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_ICB_CPS_CB_BASE_TAG, 0x0010, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_ICB_CPS_CB_BASE_TAG, 0x0010, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_CVS_MISC_RAM, 0x0540, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CVS_MISC_RAM, 0x0540, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_CPS_MISC_RAM, 0x0640, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CPS_MISC_RAM, 0x00B0, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_CPS_MISC_RAM_1, 0x0800, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_INST_RAM, 0x0800, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_INST_RAM, 0x0800, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_INST_RAM, 0x0200, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_GFX_CVS_CONST_RAM, 0x0800, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_GFX_CVS_CONST_RAM, 0x0800, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_GFX_CPS_CONST_RAM, 0x0800, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_GFX_CPS_CONST_RAM, 0x0800, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_CVS_MISC_RAM_TAG, 0x0050, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CVS_MISC_RAM_TAG, 0x0050, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_CPS_MISC_RAM_TAG, 0x0050, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_CPS_MISC_RAM_TAG, 0x0008, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_INST_RAM_TAG, 0x0014, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_INST_RAM_TAG, 0x0010, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_INST_RAM_TAG, 0x0004, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_GFX_CVS_CONST_RAM_TAG, 0x0040, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_GFX_CVS_CONST_RAM_TAG, 0x0040, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_GFX_CPS_CONST_RAM_TAG, 0x0040, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_GFX_CPS_CONST_RAM_TAG, 0x0020, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_GFX_LOCAL_MISC_RAM, 0x03C0, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_GFX_LOCAL_MISC_RAM, 0x0280, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_GFX_LOCAL_MISC_RAM, 0x0050, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_GFX_LOCAL_MISC_RAM_TAG, 0x0010, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_GFX_LOCAL_MISC_RAM_TAG, 0x0008, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_INST_RAM_1, 0x0800, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_STPROC_META, 0x0010, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_BV_BE_META, 0x0018, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_BV_BE_META, 0x0018, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_INST_RAM_2, 0x0800, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_DATAPATH_META, 0x0020, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_FRONTEND_META, 0x0080, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_FRONTEND_META, 0x0080, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_FRONTEND_META, 0x0080, 1, 1, PIPE_LPAC, HLSQ_STATE },
+	{ HLSQ_INDIRECT_META, 0x0010, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_BACKEND_META, 0x0040, 1, 1, PIPE_BR, HLSQ_STATE },
+	{ HLSQ_BACKEND_META, 0x0040, 1, 1, PIPE_BV, HLSQ_STATE },
+	{ HLSQ_BACKEND_META, 0x0040, 1, 1, PIPE_LPAC, HLSQ_STATE },
+};
+
+/*
+ * Block   : ['PRE_CRASHDUMPER', 'GBIF']
+ * pairs   : 2 (Regs:5), 5 (Regs:38)
+ */
+static const u32 gen7_9_0_pre_crashdumper_gpu_registers[] = {
+	 0x00210, 0x00213, 0x00536, 0x00536, 0x03c00, 0x03c0b, 0x03c40, 0x03c42,
+	 0x03c45, 0x03c47, 0x03c49, 0x03c4a, 0x03cc0, 0x03cd1,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_pre_crashdumper_gpu_registers), 8));
+
+/*
+ * Block   : ['BROADCAST', 'CP', 'GRAS', 'GXCLKCTL']
+ * Block   : ['PC', 'RBBM', 'RDVM', 'UCHE']
+ * Block   : ['VFD', 'VPC', 'VSC']
+ * Pipeline: PIPE_NONE
+ * pairs   : 196 (Regs:1778)
+ */
+static const u32 gen7_9_0_gpu_registers[] = {
+	 0x00000, 0x00000, 0x00002, 0x00002, 0x00011, 0x00012, 0x00016, 0x0001b,
+	 0x0001f, 0x00032, 0x00038, 0x0003c, 0x00044, 0x00044, 0x00047, 0x00047,
+	 0x00049, 0x0004a, 0x0004c, 0x0004c, 0x00056, 0x00056, 0x00073, 0x0007d,
+	 0x00090, 0x000a8, 0x000ad, 0x000ad, 0x00117, 0x00117, 0x00120, 0x00122,
+	 0x00130, 0x0013f, 0x00142, 0x0015f, 0x00162, 0x00164, 0x00166, 0x00171,
+	 0x00173, 0x00174, 0x00176, 0x0017b, 0x0017e, 0x00180, 0x00183, 0x00192,
+	 0x00195, 0x00196, 0x00199, 0x0019a, 0x0019d, 0x001a2, 0x001aa, 0x001ae,
+	 0x001b9, 0x001b9, 0x001bb, 0x001bb, 0x001be, 0x001be, 0x001c1, 0x001c2,
+	 0x001c5, 0x001c5, 0x001c7, 0x001c7, 0x001c9, 0x001c9, 0x001cb, 0x001ce,
+	 0x001d1, 0x001df, 0x001e1, 0x001e3, 0x001e5, 0x001e5, 0x001e7, 0x001e9,
+	 0x00200, 0x0020d, 0x00215, 0x00253, 0x00260, 0x00260, 0x00264, 0x00270,
+	 0x00272, 0x00274, 0x00281, 0x00281, 0x00283, 0x00283, 0x00289, 0x0028d,
+	 0x00290, 0x002a2, 0x002c0, 0x002c1, 0x00300, 0x00401, 0x00410, 0x00451,
+	 0x00460, 0x004a3, 0x004c0, 0x004d1, 0x00500, 0x00500, 0x00507, 0x0050b,
+	 0x0050f, 0x0050f, 0x00511, 0x00511, 0x00533, 0x00535, 0x00540, 0x0055b,
+	 0x00564, 0x00567, 0x00574, 0x00577, 0x00584, 0x0059b, 0x005fb, 0x005ff,
+	 0x00800, 0x00808, 0x00810, 0x00813, 0x00820, 0x00821, 0x00823, 0x00827,
+	 0x00830, 0x00834, 0x0083f, 0x00841, 0x00843, 0x00847, 0x0084f, 0x00886,
+	 0x008a0, 0x008ab, 0x008c0, 0x008c0, 0x008c4, 0x008c4, 0x008c6, 0x008c6,
+	 0x008d0, 0x008dd, 0x008e0, 0x008e6, 0x008f0, 0x008f3, 0x00900, 0x00903,
+	 0x00908, 0x00911, 0x00928, 0x0093e, 0x00942, 0x0094d, 0x00980, 0x00984,
+	 0x0098d, 0x0098f, 0x009b0, 0x009b4, 0x009c2, 0x009c9, 0x009ce, 0x009d7,
+	 0x009e0, 0x009e7, 0x00a00, 0x00a00, 0x00a02, 0x00a03, 0x00a10, 0x00a4f,
+	 0x00a61, 0x00a9f, 0x00ad0, 0x00adb, 0x00b00, 0x00b31, 0x00b35, 0x00b3c,
+	 0x00b40, 0x00b40, 0x00b70, 0x00b73, 0x00b78, 0x00b79, 0x00b7c, 0x00b7d,
+	 0x00b80, 0x00b81, 0x00b84, 0x00b85, 0x00b88, 0x00b89, 0x00b8c, 0x00b8d,
+	 0x00b90, 0x00b93, 0x00b98, 0x00b99, 0x00b9c, 0x00b9d, 0x00ba0, 0x00ba1,
+	 0x00ba4, 0x00ba5, 0x00ba8, 0x00ba9, 0x00bac, 0x00bad, 0x00bb0, 0x00bb1,
+	 0x00bb4, 0x00bb5, 0x00bb8, 0x00bb9, 0x00bbc, 0x00bbd, 0x00bc0, 0x00bc1,
+	 0x00c00, 0x00c00, 0x00c02, 0x00c04, 0x00c06, 0x00c06, 0x00c10, 0x00cd9,
+	 0x00ce0, 0x00d0c, 0x00df0, 0x00df4, 0x00e01, 0x00e02, 0x00e07, 0x00e0e,
+	 0x00e10, 0x00e13, 0x00e17, 0x00e19, 0x00e1c, 0x00e2b, 0x00e30, 0x00e32,
+	 0x00e3a, 0x00e3d, 0x00e50, 0x00e5b, 0x02840, 0x0287f, 0x0ec00, 0x0ec01,
+	 0x0ec05, 0x0ec05, 0x0ec07, 0x0ec07, 0x0ec0a, 0x0ec0a, 0x0ec12, 0x0ec12,
+	 0x0ec26, 0x0ec28, 0x0ec2b, 0x0ec2d, 0x0ec2f, 0x0ec2f, 0x0ec40, 0x0ec41,
+	 0x0ec45, 0x0ec45, 0x0ec47, 0x0ec47, 0x0ec4a, 0x0ec4a, 0x0ec52, 0x0ec52,
+	 0x0ec66, 0x0ec68, 0x0ec6b, 0x0ec6d, 0x0ec6f, 0x0ec6f, 0x0ec80, 0x0ec81,
+	 0x0ec85, 0x0ec85, 0x0ec87, 0x0ec87, 0x0ec8a, 0x0ec8a, 0x0ec92, 0x0ec92,
+	 0x0eca6, 0x0eca8, 0x0ecab, 0x0ecad, 0x0ecaf, 0x0ecaf, 0x0ecc0, 0x0ecc1,
+	 0x0ecc5, 0x0ecc5, 0x0ecc7, 0x0ecc7, 0x0ecca, 0x0ecca, 0x0ecd2, 0x0ecd2,
+	 0x0ece6, 0x0ece8, 0x0eceb, 0x0eced, 0x0ecef, 0x0ecef, 0x0ed00, 0x0ed01,
+	 0x0ed05, 0x0ed05, 0x0ed07, 0x0ed07, 0x0ed0a, 0x0ed0a, 0x0ed12, 0x0ed12,
+	 0x0ed26, 0x0ed28, 0x0ed2b, 0x0ed2d, 0x0ed2f, 0x0ed2f, 0x0ed40, 0x0ed41,
+	 0x0ed45, 0x0ed45, 0x0ed47, 0x0ed47, 0x0ed4a, 0x0ed4a, 0x0ed52, 0x0ed52,
+	 0x0ed66, 0x0ed68, 0x0ed6b, 0x0ed6d, 0x0ed6f, 0x0ed6f, 0x0ed80, 0x0ed81,
+	 0x0ed85, 0x0ed85, 0x0ed87, 0x0ed87, 0x0ed8a, 0x0ed8a, 0x0ed92, 0x0ed92,
+	 0x0eda6, 0x0eda8, 0x0edab, 0x0edad, 0x0edaf, 0x0edaf,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_gpu_registers), 8));
+
+static const u32 gen7_9_0_gxclkctl_registers[] = {
+	 0x18800, 0x18800, 0x18808, 0x1880b, 0x18820, 0x18822, 0x18830, 0x18830,
+	 0x18834, 0x1883b,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_gxclkctl_registers), 8));
+
+/*
+ * Block   : ['GMUAO', 'GMUCX', 'GMUCX_RAM']
+ * Pipeline: PIPE_NONE
+ * pairs   : 134 (Regs:429)
+ */
+static const u32 gen7_9_0_gmu_registers[] = {
+	 0x10001, 0x10001, 0x10003, 0x10003, 0x10401, 0x10401, 0x10403, 0x10403,
+	 0x10801, 0x10801, 0x10803, 0x10803, 0x10c01, 0x10c01, 0x10c03, 0x10c03,
+	 0x11001, 0x11001, 0x11003, 0x11003, 0x11401, 0x11401, 0x11403, 0x11403,
+	 0x11801, 0x11801, 0x11803, 0x11803, 0x11c01, 0x11c01, 0x11c03, 0x11c03,
+	 0x1f400, 0x1f40b, 0x1f40f, 0x1f411, 0x1f500, 0x1f500, 0x1f507, 0x1f507,
+	 0x1f509, 0x1f50b, 0x1f700, 0x1f701, 0x1f704, 0x1f706, 0x1f708, 0x1f709,
+	 0x1f70c, 0x1f70d, 0x1f710, 0x1f711, 0x1f713, 0x1f716, 0x1f718, 0x1f71d,
+	 0x1f720, 0x1f724, 0x1f729, 0x1f729, 0x1f730, 0x1f747, 0x1f750, 0x1f756,
+	 0x1f758, 0x1f759, 0x1f75c, 0x1f75c, 0x1f760, 0x1f761, 0x1f764, 0x1f76b,
+	 0x1f770, 0x1f775, 0x1f780, 0x1f785, 0x1f790, 0x1f798, 0x1f7a0, 0x1f7a8,
+	 0x1f7b0, 0x1f7b3, 0x1f800, 0x1f804, 0x1f807, 0x1f808, 0x1f80b, 0x1f80c,
+	 0x1f80f, 0x1f80f, 0x1f811, 0x1f811, 0x1f813, 0x1f817, 0x1f819, 0x1f81c,
+	 0x1f824, 0x1f82a, 0x1f82d, 0x1f830, 0x1f840, 0x1f853, 0x1f860, 0x1f860,
+	 0x1f862, 0x1f866, 0x1f868, 0x1f869, 0x1f870, 0x1f879, 0x1f87f, 0x1f881,
+	 0x1f890, 0x1f896, 0x1f8a0, 0x1f8a2, 0x1f8a4, 0x1f8af, 0x1f8b8, 0x1f8b9,
+	 0x1f8c0, 0x1f8c1, 0x1f8c3, 0x1f8c4, 0x1f8d0, 0x1f8d0, 0x1f8ec, 0x1f8ec,
+	 0x1f8f0, 0x1f8f1, 0x1f910, 0x1f917, 0x1f920, 0x1f921, 0x1f924, 0x1f925,
+	 0x1f928, 0x1f929, 0x1f92c, 0x1f92d, 0x1f942, 0x1f944, 0x1f948, 0x1f94a,
+	 0x1f94f, 0x1f951, 0x1f954, 0x1f955, 0x1f95d, 0x1f95d, 0x1f962, 0x1f96b,
+	 0x1f970, 0x1f971, 0x1f973, 0x1f977, 0x1f97c, 0x1f97c, 0x1f980, 0x1f981,
+	 0x1f984, 0x1f986, 0x1f992, 0x1f993, 0x1f996, 0x1f99e, 0x1f9c5, 0x1f9d4,
+	 0x1f9f0, 0x1f9f1, 0x1f9f8, 0x1f9fa, 0x1f9fc, 0x1f9fc, 0x1fa00, 0x1fa03,
+	 0x20000, 0x20013, 0x20018, 0x2001a, 0x20020, 0x20021, 0x20024, 0x20025,
+	 0x2002a, 0x2002c, 0x20030, 0x20031, 0x20034, 0x20036, 0x23801, 0x23801,
+	 0x23803, 0x23803, 0x23805, 0x23805, 0x23807, 0x23807, 0x23809, 0x23809,
+	 0x2380b, 0x2380b, 0x2380d, 0x2380d, 0x2380f, 0x2380f, 0x23811, 0x23811,
+	 0x23813, 0x23813, 0x23815, 0x23815, 0x23817, 0x23817, 0x23819, 0x23819,
+	 0x2381b, 0x2381b, 0x2381d, 0x2381d, 0x2381f, 0x23820, 0x23822, 0x23822,
+	 0x23824, 0x23824, 0x23826, 0x23826, 0x23828, 0x23828, 0x2382a, 0x2382a,
+	 0x2382c, 0x2382c, 0x2382e, 0x2382e, 0x23830, 0x23830, 0x23832, 0x23832,
+	 0x23834, 0x23834, 0x23836, 0x23836, 0x23838, 0x23838, 0x2383a, 0x2383a,
+	 0x2383c, 0x2383c, 0x2383e, 0x2383e, 0x23840, 0x23847, 0x23b00, 0x23b01,
+	 0x23b03, 0x23b03, 0x23b05, 0x23b0e, 0x23b10, 0x23b13, 0x23b15, 0x23b16,
+	 0x23b28, 0x23b28, 0x23b30, 0x23b30,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_gmu_registers), 8));
+
+/*
+ * Block   : ['GMUGX']
+ * Pipeline: PIPE_NONE
+ * pairs   : 44 (Regs:454)
+ */
+static const u32 gen7_9_0_gmugx_registers[] = {
+	 0x1a400, 0x1a41f, 0x1a440, 0x1a45f, 0x1a480, 0x1a49f, 0x1a4c0, 0x1a4df,
+	 0x1a500, 0x1a51f, 0x1a540, 0x1a55f, 0x1a580, 0x1a59f, 0x1a600, 0x1a61f,
+	 0x1a640, 0x1a65f, 0x1a780, 0x1a781, 0x1a783, 0x1a785, 0x1a787, 0x1a789,
+	 0x1a78b, 0x1a78d, 0x1a78f, 0x1a791, 0x1a793, 0x1a795, 0x1a797, 0x1a799,
+	 0x1a79b, 0x1a79d, 0x1a79f, 0x1a7a1, 0x1a7a3, 0x1a7a3, 0x1a7a8, 0x1a7b9,
+	 0x1a7c0, 0x1a7c1, 0x1a7c4, 0x1a7c5, 0x1a7c8, 0x1a7c9, 0x1a7cc, 0x1a7cd,
+	 0x1a7d0, 0x1a7d1, 0x1a7d4, 0x1a7d5, 0x1a7d8, 0x1a7d9, 0x1a7dc, 0x1a7dd,
+	 0x1a7e0, 0x1a7e1, 0x1a7fc, 0x1a7fd, 0x1a800, 0x1a808, 0x1a816, 0x1a816,
+	 0x1a81e, 0x1a81e, 0x1a826, 0x1a826, 0x1a82e, 0x1a82e, 0x1a836, 0x1a836,
+	 0x1a83e, 0x1a83e, 0x1a846, 0x1a846, 0x1a84e, 0x1a84e, 0x1a856, 0x1a856,
+	 0x1a883, 0x1a884, 0x1a890, 0x1a8b3, 0x1a900, 0x1a92b, 0x1a940, 0x1a940,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_gmugx_registers), 8));
+
+/*
+ * Block   : ['CX_MISC']
+ * Pipeline: PIPE_NONE
+ * pairs   : 7 (Regs:56)
+ */
+static const u32 gen7_9_0_cx_misc_registers[] = {
+	 0x27800, 0x27800, 0x27810, 0x27814, 0x27820, 0x27824, 0x27828, 0x2782a,
+	 0x27832, 0x27857, 0x27880, 0x27881, 0x27c00, 0x27c01,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_cx_misc_registers), 8));
+
+/*
+ * Block   : ['DBGC']
+ * Pipeline: PIPE_NONE
+ * pairs   : 19 (Regs:155)
+ */
+static const u32 gen7_9_0_dbgc_registers[] = {
+	 0x00600, 0x0061c, 0x0061e, 0x00634, 0x00640, 0x00643, 0x0064e, 0x00652,
+	 0x00654, 0x0065e, 0x00699, 0x00699, 0x0069b, 0x0069e, 0x006c2, 0x006e4,
+	 0x006e6, 0x006e6, 0x006e9, 0x006e9, 0x006eb, 0x006eb, 0x006f1, 0x006f4,
+	 0x00700, 0x00707, 0x00718, 0x00718, 0x00720, 0x00729, 0x00740, 0x0074a,
+	 0x00758, 0x00758, 0x00760, 0x00762,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_dbgc_registers), 8));
+
+/*
+ * Block   : ['CX_DBGC']
+ * Pipeline: PIPE_NONE
+ * pairs   : 7 (Regs:75)
+ */
+static const u32 gen7_9_0_cx_dbgc_registers[] = {
+	 0x18400, 0x1841c, 0x1841e, 0x18434, 0x18440, 0x18443, 0x1844e, 0x18452,
+	 0x18454, 0x1845e, 0x18520, 0x18520, 0x18580, 0x18581,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_cx_dbgc_registers), 8));
+
+/*
+ * Block   : ['BROADCAST', 'CP', 'CX_DBGC', 'CX_MISC', 'DBGC', 'GBIF']
+ * Block   : ['GMUAO', 'GMUCX', 'GMUGX', 'GRAS', 'GXCLKCTL', 'PC']
+ * Block   : ['RBBM', 'RDVM', 'UCHE', 'VFD', 'VPC', 'VSC']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_NONE
+ * pairs   : 29 (Regs:573)
+ */
+static const u32 gen7_9_0_non_context_pipe_br_registers[] = {
+	 0x00887, 0x0088c, 0x08600, 0x08602, 0x08610, 0x0861b, 0x08620, 0x08620,
+	 0x08630, 0x08630, 0x08637, 0x08639, 0x08640, 0x08640, 0x09600, 0x09603,
+	 0x0960a, 0x09616, 0x09624, 0x0963a, 0x09640, 0x09640, 0x09e00, 0x09e00,
+	 0x09e02, 0x09e07, 0x09e0a, 0x09e16, 0x09e18, 0x09e1a, 0x09e1c, 0x09e1c,
+	 0x09e20, 0x09e25, 0x09e30, 0x09e31, 0x09e40, 0x09e51, 0x09e64, 0x09e6c,
+	 0x09e70, 0x09e72, 0x09e78, 0x09e79, 0x09e80, 0x09fff, 0x0a600, 0x0a600,
+	 0x0a603, 0x0a603, 0x0a610, 0x0a61f, 0x0a630, 0x0a631, 0x0a638, 0x0a63c,
+	 0x0a640, 0x0a65f,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_pipe_br_registers), 8));
+
+/*
+ * Block   : ['BROADCAST', 'CP', 'CX_DBGC', 'CX_MISC', 'DBGC', 'GBIF']
+ * Block   : ['GMUAO', 'GMUCX', 'GMUGX', 'GRAS', 'GXCLKCTL', 'PC']
+ * Block   : ['RBBM', 'RDVM', 'UCHE', 'VFD', 'VPC', 'VSC']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_NONE
+ * pairs   : 29 (Regs:573)
+ */
+static const u32 gen7_9_0_non_context_pipe_bv_registers[] = {
+	 0x00887, 0x0088c, 0x08600, 0x08602, 0x08610, 0x0861b, 0x08620, 0x08620,
+	 0x08630, 0x08630, 0x08637, 0x08639, 0x08640, 0x08640, 0x09600, 0x09603,
+	 0x0960a, 0x09616, 0x09624, 0x0963a, 0x09640, 0x09640, 0x09e00, 0x09e00,
+	 0x09e02, 0x09e07, 0x09e0a, 0x09e16, 0x09e18, 0x09e1a, 0x09e1c, 0x09e1c,
+	 0x09e20, 0x09e25, 0x09e30, 0x09e31, 0x09e40, 0x09e51, 0x09e64, 0x09e6c,
+	 0x09e70, 0x09e72, 0x09e78, 0x09e79, 0x09e80, 0x09fff, 0x0a600, 0x0a600,
+	 0x0a603, 0x0a603, 0x0a610, 0x0a61f, 0x0a630, 0x0a631, 0x0a638, 0x0a63c,
+	 0x0a640, 0x0a65f,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_pipe_bv_registers), 8));
+
+/*
+ * Block   : ['BROADCAST', 'CP', 'CX_DBGC', 'CX_MISC', 'DBGC', 'GBIF']
+ * Block   : ['GMUAO', 'GMUCX', 'GMUGX', 'GRAS', 'GXCLKCTL', 'PC']
+ * Block   : ['RBBM', 'RDVM', 'UCHE', 'VFD', 'VPC', 'VSC']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_NONE
+ * pairs   : 2 (Regs:7)
+ */
+static const u32 gen7_9_0_non_context_pipe_lpac_registers[] = {
+	 0x00887, 0x0088c, 0x00f80, 0x00f80,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_pipe_lpac_registers), 8));
+
+/*
+ * Block   : ['RB']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_NONE
+ * pairs   : 5 (Regs:37)
+ */
+static const u32 gen7_9_0_non_context_rb_pipe_br_rac_registers[] = {
+	 0x08e10, 0x08e1c, 0x08e20, 0x08e25, 0x08e51, 0x08e5a, 0x08e6a, 0x08e6d,
+	 0x08ea0, 0x08ea3,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_rb_pipe_br_rac_registers), 8));
+
+/*
+ * Block   : ['RB']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_NONE
+ * pairs   : 15 (Regs:66)
+ */
+static const u32 gen7_9_0_non_context_rb_pipe_br_rbp_registers[] = {
+	 0x08e01, 0x08e01, 0x08e04, 0x08e04, 0x08e06, 0x08e09, 0x08e0c, 0x08e0c,
+	 0x08e28, 0x08e28, 0x08e2c, 0x08e35, 0x08e3b, 0x08e40, 0x08e50, 0x08e50,
+	 0x08e5b, 0x08e5d, 0x08e5f, 0x08e5f, 0x08e61, 0x08e61, 0x08e63, 0x08e66,
+	 0x08e68, 0x08e69, 0x08e70, 0x08e7d, 0x08e80, 0x08e8f,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_rb_pipe_br_rbp_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_NONE
+ * Location: HLSQ_STATE
+ * pairs   : 4 (Regs:28)
+ */
+static const u32 gen7_9_0_non_context_sp_pipe_br_hlsq_state_registers[] = {
+	 0x0ae52, 0x0ae52, 0x0ae60, 0x0ae67, 0x0ae69, 0x0ae75, 0x0aec0, 0x0aec5,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_sp_pipe_br_hlsq_state_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_NONE
+ * Location: SP_TOP
+ * pairs   : 10 (Regs:61)
+ */
+static const u32 gen7_9_0_non_context_sp_pipe_br_sp_top_registers[] = {
+	 0x0ae00, 0x0ae00, 0x0ae02, 0x0ae04, 0x0ae06, 0x0ae0a, 0x0ae0c, 0x0ae0c,
+	 0x0ae0f, 0x0ae0f, 0x0ae28, 0x0ae2b, 0x0ae35, 0x0ae35, 0x0ae3a, 0x0ae3f,
+	 0x0ae50, 0x0ae52, 0x0ae80, 0x0aea3,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_sp_pipe_br_sp_top_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_NONE
+ * Location: USPTP
+ * pairs   : 12 (Regs:62)
+ */
+static const u32 gen7_9_0_non_context_sp_pipe_br_usptp_registers[] = {
+	 0x0ae00, 0x0ae00, 0x0ae02, 0x0ae04, 0x0ae06, 0x0ae0a, 0x0ae0c, 0x0ae0c,
+	 0x0ae0f, 0x0ae0f, 0x0ae28, 0x0ae2b, 0x0ae30, 0x0ae32, 0x0ae35, 0x0ae35,
+	 0x0ae3a, 0x0ae3b, 0x0ae3e, 0x0ae3f, 0x0ae50, 0x0ae52, 0x0ae80, 0x0aea3,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_sp_pipe_br_usptp_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_NONE
+ * Location: HLSQ_DP_STR
+ * pairs   : 2 (Regs:5)
+ */
+static const u32 gen7_9_0_non_context_sp_pipe_br_hlsq_dp_str_registers[] = {
+	 0x0ae6b, 0x0ae6c, 0x0ae73, 0x0ae75,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_sp_pipe_br_hlsq_dp_str_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_NONE
+ * Location: HLSQ_STATE
+ * pairs   : 1 (Regs:5)
+ */
+static const u32 gen7_9_0_non_context_sp_pipe_lpac_hlsq_state_registers[] = {
+	 0x0af88, 0x0af8c,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_sp_pipe_lpac_hlsq_state_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_NONE
+ * Location: SP_TOP
+ * pairs   : 1 (Regs:6)
+ */
+static const u32 gen7_9_0_non_context_sp_pipe_lpac_sp_top_registers[] = {
+	 0x0af80, 0x0af85,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_sp_pipe_lpac_sp_top_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_NONE
+ * Location: USPTP
+ * pairs   : 2 (Regs:9)
+ */
+static const u32 gen7_9_0_non_context_sp_pipe_lpac_usptp_registers[] = {
+	 0x0af80, 0x0af85, 0x0af90, 0x0af92,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_sp_pipe_lpac_usptp_registers), 8));
+
+/*
+ * Block   : ['TPL1']
+ * Pipeline: PIPE_NONE
+ * Cluster : CLUSTER_NONE
+ * Location: USPTP
+ * pairs   : 5 (Regs:29)
+ */
+static const u32 gen7_9_0_non_context_tpl1_pipe_none_usptp_registers[] = {
+	 0x0b602, 0x0b602, 0x0b604, 0x0b604, 0x0b608, 0x0b60c, 0x0b610, 0x0b621,
+	 0x0b630, 0x0b633,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_tpl1_pipe_none_usptp_registers), 8));
+
+/*
+ * Block   : ['TPL1']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_NONE
+ * Location: USPTP
+ * pairs   : 1 (Regs:1)
+ */
+static const u32 gen7_9_0_non_context_tpl1_pipe_br_usptp_registers[] = {
+	 0x0b600, 0x0b600,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_tpl1_pipe_br_usptp_registers), 8));
+
+/*
+ * Block   : ['TPL1']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_NONE
+ * Location: USPTP
+ * pairs   : 1 (Regs:1)
+ */
+static const u32 gen7_9_0_non_context_tpl1_pipe_lpac_usptp_registers[] = {
+	 0x0b780, 0x0b780,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_non_context_tpl1_pipe_lpac_usptp_registers), 8));
+
+/*
+ * Block   : ['GRAS']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_GRAS
+ * pairs   : 14 (Regs:293)
+ */
+static const u32 gen7_9_0_gras_pipe_br_cluster_gras_registers[] = {
+	 0x08000, 0x0800c, 0x08010, 0x08092, 0x08094, 0x08099, 0x0809b, 0x0809d,
+	 0x080a0, 0x080a7, 0x080af, 0x080f1, 0x080f4, 0x080f6, 0x080f8, 0x080fa,
+	 0x08100, 0x08107, 0x08109, 0x0810b, 0x08110, 0x08116, 0x08120, 0x0813f,
+	 0x08400, 0x08406, 0x0840a, 0x0840b,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_gras_pipe_br_cluster_gras_registers), 8));
+
+/*
+ * Block   : ['GRAS']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_GRAS
+ * pairs   : 14 (Regs:293)
+ */
+static const u32 gen7_9_0_gras_pipe_bv_cluster_gras_registers[] = {
+	 0x08000, 0x0800c, 0x08010, 0x08092, 0x08094, 0x08099, 0x0809b, 0x0809d,
+	 0x080a0, 0x080a7, 0x080af, 0x080f1, 0x080f4, 0x080f6, 0x080f8, 0x080fa,
+	 0x08100, 0x08107, 0x08109, 0x0810b, 0x08110, 0x08116, 0x08120, 0x0813f,
+	 0x08400, 0x08406, 0x0840a, 0x0840b,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_gras_pipe_bv_cluster_gras_registers), 8));
+
+/*
+ * Block   : ['PC']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_FE
+ * pairs   : 6 (Regs:31)
+ */
+static const u32 gen7_9_0_pc_pipe_br_cluster_fe_registers[] = {
+	 0x09800, 0x09804, 0x09806, 0x0980a, 0x09810, 0x09811, 0x09884, 0x09886,
+	 0x09970, 0x09972, 0x09b00, 0x09b0c,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_pc_pipe_br_cluster_fe_registers), 8));
+
+/*
+ * Block   : ['PC']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_FE
+ * pairs   : 6 (Regs:31)
+ */
+static const u32 gen7_9_0_pc_pipe_bv_cluster_fe_registers[] = {
+	 0x09800, 0x09804, 0x09806, 0x0980a, 0x09810, 0x09811, 0x09884, 0x09886,
+	 0x09970, 0x09972, 0x09b00, 0x09b0c,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_pc_pipe_bv_cluster_fe_registers), 8));
+
+/*
+ * Block   : ['VFD']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_FE
+ * pairs   : 2 (Regs:236)
+ */
+static const u32 gen7_9_0_vfd_pipe_br_cluster_fe_registers[] = {
+	 0x0a000, 0x0a009, 0x0a00e, 0x0a0ef,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_vfd_pipe_br_cluster_fe_registers), 8));
+
+/*
+ * Block   : ['VFD']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_FE
+ * pairs   : 2 (Regs:236)
+ */
+static const u32 gen7_9_0_vfd_pipe_bv_cluster_fe_registers[] = {
+	 0x0a000, 0x0a009, 0x0a00e, 0x0a0ef,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_vfd_pipe_bv_cluster_fe_registers), 8));
+
+/*
+ * Block   : ['VPC']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_FE
+ * pairs   : 2 (Regs:18)
+ */
+static const u32 gen7_9_0_vpc_pipe_br_cluster_fe_registers[] = {
+	 0x09300, 0x0930a, 0x09311, 0x09317,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_vpc_pipe_br_cluster_fe_registers), 8));
+
+/*
+ * Block   : ['VPC']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_PC_VS
+ * pairs   : 3 (Regs:30)
+ */
+static const u32 gen7_9_0_vpc_pipe_br_cluster_pc_vs_registers[] = {
+	 0x09101, 0x0910c, 0x09300, 0x0930a, 0x09311, 0x09317,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_vpc_pipe_br_cluster_pc_vs_registers), 8));
+
+/*
+ * Block   : ['VPC']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_VPC_PS
+ * pairs   : 5 (Regs:76)
+ */
+static const u32 gen7_9_0_vpc_pipe_br_cluster_vpc_ps_registers[] = {
+	 0x09200, 0x0920f, 0x09212, 0x09216, 0x09218, 0x0923c, 0x09300, 0x0930a,
+	 0x09311, 0x09317,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_vpc_pipe_br_cluster_vpc_ps_registers), 8));
+
+/*
+ * Block   : ['VPC']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_FE
+ * pairs   : 2 (Regs:18)
+ */
+static const u32 gen7_9_0_vpc_pipe_bv_cluster_fe_registers[] = {
+	 0x09300, 0x0930a, 0x09311, 0x09317,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_vpc_pipe_bv_cluster_fe_registers), 8));
+
+/*
+ * Block   : ['VPC']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_PC_VS
+ * pairs   : 3 (Regs:30)
+ */
+static const u32 gen7_9_0_vpc_pipe_bv_cluster_pc_vs_registers[] = {
+	 0x09101, 0x0910c, 0x09300, 0x0930a, 0x09311, 0x09317,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_vpc_pipe_bv_cluster_pc_vs_registers), 8));
+
+/*
+ * Block   : ['VPC']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_VPC_PS
+ * pairs   : 5 (Regs:76)
+ */
+static const u32 gen7_9_0_vpc_pipe_bv_cluster_vpc_ps_registers[] = {
+	 0x09200, 0x0920f, 0x09212, 0x09216, 0x09218, 0x0923c, 0x09300, 0x0930a,
+	 0x09311, 0x09317,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_vpc_pipe_bv_cluster_vpc_ps_registers), 8));
+
+/*
+ * Block   : ['RB']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_PS
+ * pairs   : 39 (Regs:133)
+ */
+static const u32 gen7_9_0_rb_pipe_br_cluster_ps_rac_registers[] = {
+	 0x08802, 0x08802, 0x08804, 0x08806, 0x08809, 0x0880a, 0x0880e, 0x08811,
+	 0x08818, 0x0881e, 0x08821, 0x08821, 0x08823, 0x08826, 0x08829, 0x08829,
+	 0x0882b, 0x0882e, 0x08831, 0x08831, 0x08833, 0x08836, 0x08839, 0x08839,
+	 0x0883b, 0x0883e, 0x08841, 0x08841, 0x08843, 0x08846, 0x08849, 0x08849,
+	 0x0884b, 0x0884e, 0x08851, 0x08851, 0x08853, 0x08856, 0x08859, 0x08859,
+	 0x0885b, 0x0885e, 0x08860, 0x08864, 0x08870, 0x08870, 0x08873, 0x08876,
+	 0x08878, 0x08879, 0x08882, 0x08885, 0x08887, 0x08889, 0x08891, 0x08891,
+	 0x08898, 0x08899, 0x088c0, 0x088c1, 0x088e5, 0x088e5, 0x088f4, 0x088f5,
+	 0x08a00, 0x08a05, 0x08a10, 0x08a15, 0x08a20, 0x08a25, 0x08a30, 0x08a35,
+	 0x08c00, 0x08c01, 0x08c18, 0x08c1f, 0x08c26, 0x08c34,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_rb_pipe_br_cluster_ps_rac_registers), 8));
+
+/*
+ * Block   : ['RB']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_PS
+ * pairs   : 34 (Regs:100)
+ */
+static const u32 gen7_9_0_rb_pipe_br_cluster_ps_rbp_registers[] = {
+	 0x08800, 0x08801, 0x08803, 0x08803, 0x0880b, 0x0880d, 0x08812, 0x08812,
+	 0x08820, 0x08820, 0x08822, 0x08822, 0x08827, 0x08828, 0x0882a, 0x0882a,
+	 0x0882f, 0x08830, 0x08832, 0x08832, 0x08837, 0x08838, 0x0883a, 0x0883a,
+	 0x0883f, 0x08840, 0x08842, 0x08842, 0x08847, 0x08848, 0x0884a, 0x0884a,
+	 0x0884f, 0x08850, 0x08852, 0x08852, 0x08857, 0x08858, 0x0885a, 0x0885a,
+	 0x0885f, 0x0885f, 0x08865, 0x08865, 0x08871, 0x08872, 0x08877, 0x08877,
+	 0x08880, 0x08881, 0x08886, 0x08886, 0x08890, 0x08890, 0x088d0, 0x088e4,
+	 0x088e8, 0x088ea, 0x088f0, 0x088f0, 0x08900, 0x0891a, 0x08927, 0x08928,
+	 0x08c17, 0x08c17, 0x08c20, 0x08c25,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_rb_pipe_br_cluster_ps_rbp_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_VS
+ * Location: HLSQ_STATE
+ * pairs   : 29 (Regs:215)
+ */
+static const u32 gen7_9_0_sp_pipe_br_cluster_sp_vs_hlsq_state_registers[] = {
+	 0x0a800, 0x0a801, 0x0a81b, 0x0a81d, 0x0a822, 0x0a822, 0x0a824, 0x0a824,
+	 0x0a827, 0x0a82a, 0x0a830, 0x0a830, 0x0a832, 0x0a835, 0x0a83a, 0x0a83a,
+	 0x0a83c, 0x0a83c, 0x0a83f, 0x0a841, 0x0a85b, 0x0a85d, 0x0a862, 0x0a862,
+	 0x0a864, 0x0a864, 0x0a867, 0x0a867, 0x0a870, 0x0a870, 0x0a872, 0x0a872,
+	 0x0a88c, 0x0a88e, 0x0a893, 0x0a893, 0x0a895, 0x0a895, 0x0a898, 0x0a898,
+	 0x0a89a, 0x0a89d, 0x0a8a0, 0x0a8af, 0x0a8c0, 0x0a8c3, 0x0a974, 0x0a977,
+	 0x0ab00, 0x0ab03, 0x0ab05, 0x0ab05, 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20,
+	 0x0ab40, 0x0abbf,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_br_cluster_sp_vs_hlsq_state_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_VS
+ * Location: SP_TOP
+ * pairs   : 22 (Regs:73)
+ */
+static const u32 gen7_9_0_sp_pipe_br_cluster_sp_vs_sp_top_registers[] = {
+	 0x0a800, 0x0a800, 0x0a81c, 0x0a81d, 0x0a822, 0x0a824, 0x0a82d, 0x0a82d,
+	 0x0a82f, 0x0a831, 0x0a834, 0x0a835, 0x0a83a, 0x0a83c, 0x0a840, 0x0a840,
+	 0x0a85c, 0x0a85d, 0x0a862, 0x0a864, 0x0a868, 0x0a868, 0x0a870, 0x0a871,
+	 0x0a88d, 0x0a88e, 0x0a893, 0x0a895, 0x0a899, 0x0a899, 0x0a8a0, 0x0a8af,
+	 0x0a974, 0x0a977, 0x0ab00, 0x0ab00, 0x0ab02, 0x0ab02, 0x0ab04, 0x0ab05,
+	 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_br_cluster_sp_vs_sp_top_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_VS
+ * Location: USPTP
+ * pairs   : 16 (Regs:269)
+ */
+static const u32 gen7_9_0_sp_pipe_br_cluster_sp_vs_usptp_registers[] = {
+	 0x0a800, 0x0a81b, 0x0a81e, 0x0a821, 0x0a823, 0x0a827, 0x0a82d, 0x0a82d,
+	 0x0a82f, 0x0a833, 0x0a836, 0x0a839, 0x0a83b, 0x0a85b, 0x0a85e, 0x0a861,
+	 0x0a863, 0x0a868, 0x0a870, 0x0a88c, 0x0a88f, 0x0a892, 0x0a894, 0x0a899,
+	 0x0a8c0, 0x0a8c3, 0x0ab00, 0x0ab05, 0x0ab21, 0x0ab22, 0x0ab40, 0x0abbf,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_br_cluster_sp_vs_usptp_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_PS
+ * Location: HLSQ_STATE
+ * pairs   : 21 (Regs:334)
+ */
+static const u32 gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_state_registers[] = {
+	 0x0a980, 0x0a984, 0x0a99e, 0x0a99e, 0x0a9a7, 0x0a9a7, 0x0a9aa, 0x0a9aa,
+	 0x0a9ae, 0x0a9b0, 0x0a9b2, 0x0a9b5, 0x0a9ba, 0x0a9ba, 0x0a9bc, 0x0a9bc,
+	 0x0a9c4, 0x0a9c4, 0x0a9c6, 0x0a9c6, 0x0a9cd, 0x0a9cd, 0x0a9e0, 0x0a9fc,
+	 0x0aa00, 0x0aa00, 0x0aa30, 0x0aa31, 0x0aa40, 0x0aabf, 0x0aaf2, 0x0aaf3,
+	 0x0ab00, 0x0ab03, 0x0ab05, 0x0ab05, 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20,
+	 0x0ab40, 0x0abbf,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_state_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_PS
+ * Location: HLSQ_DP
+ * pairs   : 3 (Regs:19)
+ */
+static const u32 gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_registers[] = {
+	 0x0a9b1, 0x0a9b1, 0x0a9c6, 0x0a9cb, 0x0a9d4, 0x0a9df,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_PS
+ * Location: SP_TOP
+ * pairs   : 18 (Regs:77)
+ */
+static const u32 gen7_9_0_sp_pipe_br_cluster_sp_ps_sp_top_registers[] = {
+	 0x0a980, 0x0a980, 0x0a982, 0x0a984, 0x0a99e, 0x0a9a2, 0x0a9a7, 0x0a9a8,
+	 0x0a9aa, 0x0a9aa, 0x0a9ae, 0x0a9ae, 0x0a9b0, 0x0a9b1, 0x0a9b3, 0x0a9b5,
+	 0x0a9ba, 0x0a9bc, 0x0a9c5, 0x0a9c5, 0x0a9e0, 0x0a9f9, 0x0aa00, 0x0aa03,
+	 0x0aaf2, 0x0aaf3, 0x0ab00, 0x0ab00, 0x0ab02, 0x0ab02, 0x0ab04, 0x0ab05,
+	 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_br_cluster_sp_ps_sp_top_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_PS
+ * Location: USPTP
+ * pairs   : 17 (Regs:333)
+ */
+static const u32 gen7_9_0_sp_pipe_br_cluster_sp_ps_usptp_registers[] = {
+	 0x0a980, 0x0a982, 0x0a985, 0x0a9a6, 0x0a9a8, 0x0a9a9, 0x0a9ab, 0x0a9ae,
+	 0x0a9b0, 0x0a9b3, 0x0a9b6, 0x0a9b9, 0x0a9bb, 0x0a9bf, 0x0a9c2, 0x0a9c3,
+	 0x0a9c5, 0x0a9c5, 0x0a9cd, 0x0a9cd, 0x0a9d0, 0x0a9d3, 0x0aa01, 0x0aa03,
+	 0x0aa30, 0x0aa31, 0x0aa40, 0x0aabf, 0x0ab00, 0x0ab05, 0x0ab21, 0x0ab22,
+	 0x0ab40, 0x0abbf,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_br_cluster_sp_ps_usptp_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_PS
+ * Location: HLSQ_DP_STR
+ * pairs   : 1 (Regs:6)
+ */
+static const u32 gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_str_registers[] = {
+	 0x0a9c6, 0x0a9cb,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_str_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_SP_VS
+ * Location: HLSQ_STATE
+ * pairs   : 28 (Regs:213)
+ */
+static const u32 gen7_9_0_sp_pipe_bv_cluster_sp_vs_hlsq_state_registers[] = {
+	 0x0a800, 0x0a801, 0x0a81b, 0x0a81d, 0x0a822, 0x0a822, 0x0a824, 0x0a824,
+	 0x0a827, 0x0a82a, 0x0a830, 0x0a830, 0x0a832, 0x0a835, 0x0a83a, 0x0a83a,
+	 0x0a83c, 0x0a83c, 0x0a83f, 0x0a841, 0x0a85b, 0x0a85d, 0x0a862, 0x0a862,
+	 0x0a864, 0x0a864, 0x0a867, 0x0a867, 0x0a870, 0x0a870, 0x0a872, 0x0a872,
+	 0x0a88c, 0x0a88e, 0x0a893, 0x0a893, 0x0a895, 0x0a895, 0x0a898, 0x0a898,
+	 0x0a89a, 0x0a89d, 0x0a8a0, 0x0a8af, 0x0a8c0, 0x0a8c3, 0x0a974, 0x0a977,
+	 0x0ab00, 0x0ab02, 0x0ab0a, 0x0ab1b, 0x0ab20, 0x0ab20, 0x0ab40, 0x0abbf,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_bv_cluster_sp_vs_hlsq_state_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_SP_VS
+ * Location: SP_TOP
+ * pairs   : 21 (Regs:71)
+ */
+static const u32 gen7_9_0_sp_pipe_bv_cluster_sp_vs_sp_top_registers[] = {
+	 0x0a800, 0x0a800, 0x0a81c, 0x0a81d, 0x0a822, 0x0a824, 0x0a82d, 0x0a82d,
+	 0x0a82f, 0x0a831, 0x0a834, 0x0a835, 0x0a83a, 0x0a83c, 0x0a840, 0x0a840,
+	 0x0a85c, 0x0a85d, 0x0a862, 0x0a864, 0x0a868, 0x0a868, 0x0a870, 0x0a871,
+	 0x0a88d, 0x0a88e, 0x0a893, 0x0a895, 0x0a899, 0x0a899, 0x0a8a0, 0x0a8af,
+	 0x0a974, 0x0a977, 0x0ab00, 0x0ab00, 0x0ab02, 0x0ab02, 0x0ab0a, 0x0ab1b,
+	 0x0ab20, 0x0ab20,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_bv_cluster_sp_vs_sp_top_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_SP_VS
+ * Location: USPTP
+ * pairs   : 16 (Regs:266)
+ */
+static const u32 gen7_9_0_sp_pipe_bv_cluster_sp_vs_usptp_registers[] = {
+	 0x0a800, 0x0a81b, 0x0a81e, 0x0a821, 0x0a823, 0x0a827, 0x0a82d, 0x0a82d,
+	 0x0a82f, 0x0a833, 0x0a836, 0x0a839, 0x0a83b, 0x0a85b, 0x0a85e, 0x0a861,
+	 0x0a863, 0x0a868, 0x0a870, 0x0a88c, 0x0a88f, 0x0a892, 0x0a894, 0x0a899,
+	 0x0a8c0, 0x0a8c3, 0x0ab00, 0x0ab02, 0x0ab21, 0x0ab22, 0x0ab40, 0x0abbf,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_bv_cluster_sp_vs_usptp_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_SP_PS
+ * Location: HLSQ_STATE
+ * pairs   : 14 (Regs:299)
+ */
+static const u32 gen7_9_0_sp_pipe_lpac_cluster_sp_ps_hlsq_state_registers[] = {
+	 0x0a9b0, 0x0a9b0, 0x0a9b2, 0x0a9b5, 0x0a9ba, 0x0a9ba, 0x0a9bc, 0x0a9bc,
+	 0x0a9c4, 0x0a9c4, 0x0a9cd, 0x0a9cd, 0x0a9e2, 0x0a9e3, 0x0a9e6, 0x0a9fc,
+	 0x0aa00, 0x0aa00, 0x0aa31, 0x0aa35, 0x0aa40, 0x0aabf, 0x0aaf3, 0x0aaf3,
+	 0x0ab00, 0x0ab01, 0x0ab40, 0x0abbf,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_lpac_cluster_sp_ps_hlsq_state_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_SP_PS
+ * Location: HLSQ_DP
+ * pairs   : 2 (Regs:13)
+ */
+static const u32 gen7_9_0_sp_pipe_lpac_cluster_sp_ps_hlsq_dp_registers[] = {
+	 0x0a9b1, 0x0a9b1, 0x0a9d4, 0x0a9df,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_lpac_cluster_sp_ps_hlsq_dp_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_SP_PS
+ * Location: SP_TOP
+ * pairs   : 9 (Regs:34)
+ */
+static const u32 gen7_9_0_sp_pipe_lpac_cluster_sp_ps_sp_top_registers[] = {
+	 0x0a9b0, 0x0a9b1, 0x0a9b3, 0x0a9b5, 0x0a9ba, 0x0a9bc, 0x0a9c5, 0x0a9c5,
+	 0x0a9e2, 0x0a9e3, 0x0a9e6, 0x0a9f9, 0x0aa00, 0x0aa00, 0x0aaf3, 0x0aaf3,
+	 0x0ab00, 0x0ab00,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_lpac_cluster_sp_ps_sp_top_registers), 8));
+
+/*
+ * Block   : ['SP']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_SP_PS
+ * Location: USPTP
+ * pairs   : 11 (Regs:279)
+ */
+static const u32 gen7_9_0_sp_pipe_lpac_cluster_sp_ps_usptp_registers[] = {
+	 0x0a9b0, 0x0a9b3, 0x0a9b6, 0x0a9b9, 0x0a9bb, 0x0a9be, 0x0a9c2, 0x0a9c3,
+	 0x0a9c5, 0x0a9c5, 0x0a9cd, 0x0a9cd, 0x0a9d0, 0x0a9d3, 0x0aa31, 0x0aa31,
+	 0x0aa40, 0x0aabf, 0x0ab00, 0x0ab01, 0x0ab40, 0x0abbf,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_sp_pipe_lpac_cluster_sp_ps_usptp_registers), 8));
+
+/*
+ * Block   : ['TPL1']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_VS
+ * Location: USPTP
+ * pairs   : 3 (Regs:10)
+ */
+static const u32 gen7_9_0_tpl1_pipe_br_cluster_sp_vs_usptp_registers[] = {
+	 0x0b300, 0x0b307, 0x0b309, 0x0b309, 0x0b310, 0x0b310,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_tpl1_pipe_br_cluster_sp_vs_usptp_registers), 8));
+
+/*
+ * Block   : ['TPL1']
+ * Pipeline: PIPE_BR
+ * Cluster : CLUSTER_SP_PS
+ * Location: USPTP
+ * pairs   : 6 (Regs:42)
+ */
+static const u32 gen7_9_0_tpl1_pipe_br_cluster_sp_ps_usptp_registers[] = {
+	 0x0b180, 0x0b183, 0x0b190, 0x0b195, 0x0b2c0, 0x0b2d5, 0x0b300, 0x0b307,
+	 0x0b309, 0x0b309, 0x0b310, 0x0b310,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_tpl1_pipe_br_cluster_sp_ps_usptp_registers), 8));
+
+/*
+ * Block   : ['TPL1']
+ * Pipeline: PIPE_BV
+ * Cluster : CLUSTER_SP_VS
+ * Location: USPTP
+ * pairs   : 3 (Regs:10)
+ */
+static const u32 gen7_9_0_tpl1_pipe_bv_cluster_sp_vs_usptp_registers[] = {
+	 0x0b300, 0x0b307, 0x0b309, 0x0b309, 0x0b310, 0x0b310,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_tpl1_pipe_bv_cluster_sp_vs_usptp_registers), 8));
+
+/*
+ * Block   : ['TPL1']
+ * Pipeline: PIPE_LPAC
+ * Cluster : CLUSTER_SP_PS
+ * Location: USPTP
+ * pairs   : 5 (Regs:7)
+ */
+static const u32 gen7_9_0_tpl1_pipe_lpac_cluster_sp_ps_usptp_registers[] = {
+	 0x0b180, 0x0b181, 0x0b300, 0x0b301, 0x0b307, 0x0b307, 0x0b309, 0x0b309,
+	 0x0b310, 0x0b310,
+	 UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_tpl1_pipe_lpac_cluster_sp_ps_usptp_registers), 8));
+
+static const struct gen7_sel_reg gen7_9_0_rb_rac_sel = {
+	.host_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_HOST,
+	.cd_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_CD,
+	.val = 0,
+};
+
+static const struct gen7_sel_reg gen7_9_0_rb_rbp_sel = {
+	.host_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_HOST,
+	.cd_reg = GEN7_RB_SUB_BLOCK_SEL_CNTL_CD,
+	.val = 0x9,
+};
+
+static struct gen7_cluster_registers gen7_9_0_clusters[] = {
+	{ CLUSTER_NONE, PIPE_BR, STATE_NON_CONTEXT,
+		gen7_9_0_non_context_pipe_br_registers,  },
+	{ CLUSTER_NONE, PIPE_BV, STATE_NON_CONTEXT,
+		gen7_9_0_non_context_pipe_bv_registers,  },
+	{ CLUSTER_NONE, PIPE_LPAC, STATE_NON_CONTEXT,
+		gen7_9_0_non_context_pipe_lpac_registers,  },
+	{ CLUSTER_NONE, PIPE_BR, STATE_NON_CONTEXT,
+		gen7_9_0_non_context_rb_pipe_br_rac_registers, &gen7_9_0_rb_rac_sel, },
+	{ CLUSTER_NONE, PIPE_BR, STATE_NON_CONTEXT,
+		gen7_9_0_non_context_rb_pipe_br_rbp_registers, &gen7_9_0_rb_rbp_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_9_0_rb_pipe_br_cluster_ps_rac_registers, &gen7_9_0_rb_rac_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_9_0_rb_pipe_br_cluster_ps_rac_registers, &gen7_9_0_rb_rac_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_9_0_rb_pipe_br_cluster_ps_rbp_registers, &gen7_9_0_rb_rbp_sel, },
+	{ CLUSTER_PS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_9_0_rb_pipe_br_cluster_ps_rbp_registers, &gen7_9_0_rb_rbp_sel, },
+	{ CLUSTER_GRAS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_9_0_gras_pipe_br_cluster_gras_registers,  },
+	{ CLUSTER_GRAS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_9_0_gras_pipe_br_cluster_gras_registers,  },
+	{ CLUSTER_GRAS, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_9_0_gras_pipe_bv_cluster_gras_registers,  },
+	{ CLUSTER_GRAS, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_9_0_gras_pipe_bv_cluster_gras_registers,  },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_9_0_pc_pipe_br_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_9_0_pc_pipe_br_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_9_0_pc_pipe_bv_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_9_0_pc_pipe_bv_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_9_0_vfd_pipe_br_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_9_0_vfd_pipe_br_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_9_0_vfd_pipe_bv_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_9_0_vfd_pipe_bv_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_9_0_vpc_pipe_br_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_9_0_vpc_pipe_br_cluster_fe_registers,  },
+	{ CLUSTER_PC_VS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_9_0_vpc_pipe_br_cluster_pc_vs_registers,  },
+	{ CLUSTER_PC_VS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_9_0_vpc_pipe_br_cluster_pc_vs_registers,  },
+	{ CLUSTER_VPC_PS, PIPE_BR, STATE_FORCE_CTXT_0,
+		gen7_9_0_vpc_pipe_br_cluster_vpc_ps_registers,  },
+	{ CLUSTER_VPC_PS, PIPE_BR, STATE_FORCE_CTXT_1,
+		gen7_9_0_vpc_pipe_br_cluster_vpc_ps_registers,  },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_9_0_vpc_pipe_bv_cluster_fe_registers,  },
+	{ CLUSTER_FE, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_9_0_vpc_pipe_bv_cluster_fe_registers,  },
+	{ CLUSTER_PC_VS, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_9_0_vpc_pipe_bv_cluster_pc_vs_registers,  },
+	{ CLUSTER_PC_VS, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_9_0_vpc_pipe_bv_cluster_pc_vs_registers,  },
+	{ CLUSTER_VPC_PS, PIPE_BV, STATE_FORCE_CTXT_0,
+		gen7_9_0_vpc_pipe_bv_cluster_vpc_ps_registers,  },
+	{ CLUSTER_VPC_PS, PIPE_BV, STATE_FORCE_CTXT_1,
+		gen7_9_0_vpc_pipe_bv_cluster_vpc_ps_registers,  },
+};
+
+static struct gen7_sptp_cluster_registers gen7_9_0_sptp_clusters[] = {
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, HLSQ_STATE,
+		gen7_9_0_non_context_sp_pipe_br_hlsq_state_registers, 0xae00},
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, SP_TOP,
+		gen7_9_0_non_context_sp_pipe_br_sp_top_registers, 0xae00},
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, USPTP,
+		gen7_9_0_non_context_sp_pipe_br_usptp_registers, 0xae00},
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_BR, 0, HLSQ_DP_STR,
+		gen7_9_0_non_context_sp_pipe_br_hlsq_dp_str_registers, 0xae00},
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_LPAC, 0, HLSQ_STATE,
+		gen7_9_0_non_context_sp_pipe_lpac_hlsq_state_registers, 0xaf80},
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_LPAC, 0, SP_TOP,
+		gen7_9_0_non_context_sp_pipe_lpac_sp_top_registers, 0xaf80},
+	{ CLUSTER_NONE, SP_NCTX_REG, PIPE_LPAC, 0, USPTP,
+		gen7_9_0_non_context_sp_pipe_lpac_usptp_registers, 0xaf80},
+	{ CLUSTER_NONE, TP0_NCTX_REG, PIPE_NONE, 0, USPTP,
+		gen7_9_0_non_context_tpl1_pipe_none_usptp_registers, 0xb600},
+	{ CLUSTER_NONE, TP0_NCTX_REG, PIPE_BR, 0, USPTP,
+		gen7_9_0_non_context_tpl1_pipe_br_usptp_registers, 0xb600},
+	{ CLUSTER_NONE, TP0_NCTX_REG, PIPE_LPAC, 0, USPTP,
+		gen7_9_0_non_context_tpl1_pipe_lpac_usptp_registers, 0xb780},
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BR, 0, HLSQ_STATE,
+		gen7_9_0_sp_pipe_br_cluster_sp_vs_hlsq_state_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BR, 0, SP_TOP,
+		gen7_9_0_sp_pipe_br_cluster_sp_vs_sp_top_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BR, 0, USPTP,
+		gen7_9_0_sp_pipe_br_cluster_sp_vs_usptp_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BV, 0, HLSQ_STATE,
+		gen7_9_0_sp_pipe_bv_cluster_sp_vs_hlsq_state_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BV, 0, SP_TOP,
+		gen7_9_0_sp_pipe_bv_cluster_sp_vs_sp_top_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX0_3D_CVS_REG, PIPE_BV, 0, USPTP,
+		gen7_9_0_sp_pipe_bv_cluster_sp_vs_usptp_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BR, 1, HLSQ_STATE,
+		gen7_9_0_sp_pipe_br_cluster_sp_vs_hlsq_state_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BR, 1, SP_TOP,
+		gen7_9_0_sp_pipe_br_cluster_sp_vs_sp_top_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BR, 1, USPTP,
+		gen7_9_0_sp_pipe_br_cluster_sp_vs_usptp_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BV, 1, HLSQ_STATE,
+		gen7_9_0_sp_pipe_bv_cluster_sp_vs_hlsq_state_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BV, 1, SP_TOP,
+		gen7_9_0_sp_pipe_bv_cluster_sp_vs_sp_top_registers, 0xa800},
+	{ CLUSTER_SP_VS, SP_CTX1_3D_CVS_REG, PIPE_BV, 1, USPTP,
+		gen7_9_0_sp_pipe_bv_cluster_sp_vs_usptp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, HLSQ_STATE,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_state_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, HLSQ_DP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, SP_TOP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_sp_top_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, USPTP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_usptp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_BR, 0, HLSQ_DP_STR,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_str_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, HLSQ_STATE,
+		gen7_9_0_sp_pipe_lpac_cluster_sp_ps_hlsq_state_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, HLSQ_DP,
+		gen7_9_0_sp_pipe_lpac_cluster_sp_ps_hlsq_dp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, SP_TOP,
+		gen7_9_0_sp_pipe_lpac_cluster_sp_ps_sp_top_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX0_3D_CPS_REG, PIPE_LPAC, 0, USPTP,
+		gen7_9_0_sp_pipe_lpac_cluster_sp_ps_usptp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, HLSQ_STATE,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_state_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, HLSQ_DP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, SP_TOP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_sp_top_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, USPTP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_usptp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX1_3D_CPS_REG, PIPE_BR, 1, HLSQ_DP_STR,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_str_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, HLSQ_DP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, SP_TOP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_sp_top_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, USPTP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_usptp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX2_3D_CPS_REG, PIPE_BR, 2, HLSQ_DP_STR,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_str_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, HLSQ_DP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, SP_TOP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_sp_top_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, USPTP,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_usptp_registers, 0xa800},
+	{ CLUSTER_SP_PS, SP_CTX3_3D_CPS_REG, PIPE_BR, 3, HLSQ_DP_STR,
+		gen7_9_0_sp_pipe_br_cluster_sp_ps_hlsq_dp_str_registers, 0xa800},
+	{ CLUSTER_SP_VS, TP0_CTX0_3D_CVS_REG, PIPE_BR, 0, USPTP,
+		gen7_9_0_tpl1_pipe_br_cluster_sp_vs_usptp_registers, 0xb000},
+	{ CLUSTER_SP_VS, TP0_CTX0_3D_CVS_REG, PIPE_BV, 0, USPTP,
+		gen7_9_0_tpl1_pipe_bv_cluster_sp_vs_usptp_registers, 0xb000},
+	{ CLUSTER_SP_VS, TP0_CTX1_3D_CVS_REG, PIPE_BR, 1, USPTP,
+		gen7_9_0_tpl1_pipe_br_cluster_sp_vs_usptp_registers, 0xb000},
+	{ CLUSTER_SP_VS, TP0_CTX1_3D_CVS_REG, PIPE_BV, 1, USPTP,
+		gen7_9_0_tpl1_pipe_bv_cluster_sp_vs_usptp_registers, 0xb000},
+	{ CLUSTER_SP_PS, TP0_CTX0_3D_CPS_REG, PIPE_BR, 0, USPTP,
+		gen7_9_0_tpl1_pipe_br_cluster_sp_ps_usptp_registers, 0xb000},
+	{ CLUSTER_SP_PS, TP0_CTX0_3D_CPS_REG, PIPE_LPAC, 0, USPTP,
+		gen7_9_0_tpl1_pipe_lpac_cluster_sp_ps_usptp_registers, 0xb000},
+	{ CLUSTER_SP_PS, TP0_CTX1_3D_CPS_REG, PIPE_BR, 1, USPTP,
+		gen7_9_0_tpl1_pipe_br_cluster_sp_ps_usptp_registers, 0xb000},
+	{ CLUSTER_SP_PS, TP0_CTX2_3D_CPS_REG, PIPE_BR, 2, USPTP,
+		gen7_9_0_tpl1_pipe_br_cluster_sp_ps_usptp_registers, 0xb000},
+	{ CLUSTER_SP_PS, TP0_CTX3_3D_CPS_REG, PIPE_BR, 3, USPTP,
+		gen7_9_0_tpl1_pipe_br_cluster_sp_ps_usptp_registers, 0xb000},
+};
+
+static struct gen7_cp_indexed_reg gen7_9_0_cp_indexed_reg_list[] = {
+	{ GEN7_CP_SQE_STAT_ADDR, GEN7_CP_SQE_STAT_DATA, 0x00040},
+	{ GEN7_CP_DRAW_STATE_ADDR, GEN7_CP_DRAW_STATE_DATA, 0x00200},
+	{ GEN7_CP_ROQ_DBG_ADDR, GEN7_CP_ROQ_DBG_DATA, 0x00800},
+	{ GEN7_CP_SQE_UCODE_DBG_ADDR, GEN7_CP_SQE_UCODE_DBG_DATA, 0x08000},
+	{ GEN7_CP_BV_DRAW_STATE_ADDR, GEN7_CP_BV_DRAW_STATE_DATA, 0x00200},
+	{ GEN7_CP_BV_ROQ_DBG_ADDR, GEN7_CP_BV_ROQ_DBG_DATA, 0x00800},
+	{ GEN7_CP_BV_SQE_UCODE_DBG_ADDR, GEN7_CP_BV_SQE_UCODE_DBG_DATA, 0x08000},
+	{ GEN7_CP_BV_SQE_STAT_ADDR, GEN7_CP_BV_SQE_STAT_DATA, 0x00040},
+	{ GEN7_CP_RESOURCE_TABLE_DBG_ADDR, GEN7_CP_RESOURCE_TABLE_DBG_DATA, 0x04100},
+	{ GEN7_CP_LPAC_DRAW_STATE_ADDR, GEN7_CP_LPAC_DRAW_STATE_DATA, 0x00200},
+	{ GEN7_CP_LPAC_ROQ_DBG_ADDR, GEN7_CP_LPAC_ROQ_DBG_DATA, 0x00200},
+	{ GEN7_CP_SQE_AC_UCODE_DBG_ADDR, GEN7_CP_SQE_AC_UCODE_DBG_DATA, 0x08000},
+	{ GEN7_CP_SQE_AC_STAT_ADDR, GEN7_CP_SQE_AC_STAT_DATA, 0x00040},
+	{ GEN7_CP_LPAC_FIFO_DBG_ADDR, GEN7_CP_LPAC_FIFO_DBG_DATA, 0x00040},
+	{ GEN7_CP_AQE_ROQ_DBG_ADDR_0, GEN7_CP_AQE_ROQ_DBG_DATA_0, 0x00100},
+	{ GEN7_CP_AQE_ROQ_DBG_ADDR_1, GEN7_CP_AQE_ROQ_DBG_DATA_1, 0x00100},
+	{ GEN7_CP_AQE_UCODE_DBG_ADDR_0, GEN7_CP_AQE_UCODE_DBG_DATA_0, 0x08000},
+	{ GEN7_CP_AQE_UCODE_DBG_ADDR_1, GEN7_CP_AQE_UCODE_DBG_DATA_1, 0x08000},
+	{ GEN7_CP_AQE_STAT_ADDR_0, GEN7_CP_AQE_STAT_DATA_0, 0x00040},
+	{ GEN7_CP_AQE_STAT_ADDR_1, GEN7_CP_AQE_STAT_DATA_1, 0x00040},
+};
+
+static struct gen7_reg_list gen7_9_0_reg_list[] = {
+	{ gen7_9_0_gpu_registers, NULL},
+	{ gen7_9_0_cx_dbgc_registers, NULL},
+	{ gen7_9_0_dbgc_registers, NULL},
+	{ NULL, NULL},
+};
+
+static const u32 gen7_9_0_cpr_registers[] = {
+	0x26800, 0x26805, 0x26808, 0x2680d, 0x26814, 0x26815, 0x2681c, 0x2681c,
+	0x26820, 0x26839, 0x26840, 0x26841, 0x26848, 0x26849, 0x26850, 0x26851,
+	0x26880, 0x268a1, 0x26980, 0x269b0, 0x269c0, 0x269c8, 0x269e0, 0x269ee,
+	0x269fb, 0x269ff, 0x26a02, 0x26a07, 0x26a09, 0x26a0b, 0x26a10, 0x26b0f,
+	0x27440, 0x27441, 0x27444, 0x27444, 0x27480, 0x274a2, 0x274ac, 0x274c4,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_cpr_registers), 8));
+
+static const u32 gen7_9_0_dpm_registers[] = {
+	0x1aa00, 0x1aa06, 0x1aa09, 0x1aa0a, 0x1aa0c, 0x1aa0d, 0x1aa0f, 0x1aa12,
+	0x1aa14, 0x1aa47, 0x1aa50, 0x1aa51,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_dpm_registers), 8));
+
+static const u32 gen7_9_0_dpm_leakage_registers[] = {
+	0x21c00, 0x21c00, 0x21c08, 0x21c09, 0x21c0e, 0x21c0f, 0x21c4f, 0x21c50,
+	0x21c52, 0x21c52, 0x21c54, 0x21c56, 0x21c58, 0x21c5a, 0x21c5c, 0x21c60,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_dpm_leakage_registers), 8));
+
+static const u32 gen7_9_0_gfx_gpu_acd_registers[] = {
+	0x18c00, 0x18c16, 0x18c20, 0x18c2d, 0x18c30, 0x18c31, 0x18c35, 0x18c35,
+	0x18c37, 0x18c37, 0x18c3a, 0x18c3a, 0x18c42, 0x18c42, 0x18c56, 0x18c58,
+	0x18c5b, 0x18c5d, 0x18c5f, 0x18c62,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_gfx_gpu_acd_registers), 8));
+
+static const u32 gen7_9_0_gpucc_registers[] = {
+	0x24000, 0x2400f, 0x24400, 0x2440f, 0x24800, 0x24805, 0x24c00, 0x24cff,
+	0x25400, 0x25404, 0x25800, 0x25804, 0x25c00, 0x25c04, 0x26000, 0x26004,
+	0x26400, 0x26405, 0x26414, 0x2641d, 0x2642a, 0x26430, 0x26432, 0x26434,
+	0x26441, 0x2644b, 0x2644d, 0x26463, 0x26466, 0x26468, 0x26478, 0x2647a,
+	0x26489, 0x2648a, 0x2649c, 0x2649e, 0x264a0, 0x264a6, 0x264c5, 0x264c7,
+	0x264d6, 0x264d8, 0x264e8, 0x264e9, 0x264f9, 0x264fc, 0x2650b, 0x2650b,
+	0x2651c, 0x2651e, 0x26540, 0x2654e, 0x26554, 0x26573, 0x26576, 0x2657a,
+	UINT_MAX, UINT_MAX,
+
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_gpucc_registers), 8));
+
+static const u32 gen7_9_0_isense_registers[] = {
+	0x22c3a, 0x22c3c, 0x22c41, 0x22c41, 0x22c46, 0x22c47, 0x22c4c, 0x22c4c,
+	0x22c51, 0x22c51, 0x22c56, 0x22c56, 0x22c5b, 0x22c5b, 0x22c60, 0x22c60,
+	0x22c65, 0x22c65, 0x22c6a, 0x22c70, 0x22c75, 0x22c75, 0x22c7a, 0x22c7a,
+	0x22c7f, 0x22c7f, 0x22c84, 0x22c85, 0x22c8a, 0x22c8a, 0x22c8f, 0x22c8f,
+	0x23000, 0x23009, 0x2300e, 0x2300e, 0x23013, 0x23013, 0x23018, 0x23018,
+	0x2301d, 0x2301d, 0x23022, 0x23022, 0x23027, 0x23032, 0x23037, 0x23037,
+	0x2303c, 0x2303c, 0x23041, 0x23041, 0x23046, 0x23046, 0x2304b, 0x2304b,
+	0x23050, 0x23050, 0x23055, 0x23055, 0x2305a, 0x2305a, 0x2305f, 0x2305f,
+	0x23064, 0x23064, 0x23069, 0x2306a, 0x2306f, 0x2306f, 0x23074, 0x23075,
+	0x2307a, 0x2307e, 0x23083, 0x23083, 0x23088, 0x23088, 0x2308d, 0x2308d,
+	0x23092, 0x23092, 0x230e2, 0x230e2,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_isense_registers), 8));
+
+static const u32 gen7_9_0_rscc_registers[] = {
+	0x14000, 0x14036, 0x14040, 0x14047, 0x14080, 0x14084, 0x14089, 0x1408c,
+	0x14091, 0x14094, 0x14099, 0x1409c, 0x140a1, 0x140a4, 0x140a9, 0x140ac,
+	0x14100, 0x14104, 0x14114, 0x14119, 0x14124, 0x14132, 0x14154, 0x1416b,
+	0x14340, 0x14342, 0x14344, 0x1437c, 0x143f0, 0x143f8, 0x143fa, 0x143fe,
+	0x14400, 0x14404, 0x14406, 0x1440a, 0x1440c, 0x14410, 0x14412, 0x14416,
+	0x14418, 0x1441c, 0x1441e, 0x14422, 0x14424, 0x14424, 0x14498, 0x144a0,
+	0x144a2, 0x144a6, 0x144a8, 0x144ac, 0x144ae, 0x144b2, 0x144b4, 0x144b8,
+	0x144ba, 0x144be, 0x144c0, 0x144c4, 0x144c6, 0x144ca, 0x144cc, 0x144cc,
+	0x14540, 0x14548, 0x1454a, 0x1454e, 0x14550, 0x14554, 0x14556, 0x1455a,
+	0x1455c, 0x14560, 0x14562, 0x14566, 0x14568, 0x1456c, 0x1456e, 0x14572,
+	0x14574, 0x14574, 0x145e8, 0x145f0, 0x145f2, 0x145f6, 0x145f8, 0x145fc,
+	0x145fe, 0x14602, 0x14604, 0x14608, 0x1460a, 0x1460e, 0x14610, 0x14614,
+	0x14616, 0x1461a, 0x1461c, 0x1461c, 0x14690, 0x14698, 0x1469a, 0x1469e,
+	0x146a0, 0x146a4, 0x146a6, 0x146aa, 0x146ac, 0x146b0, 0x146b2, 0x146b6,
+	0x146b8, 0x146bc, 0x146be, 0x146c2, 0x146c4, 0x146c4, 0x14738, 0x14740,
+	0x14742, 0x14746, 0x14748, 0x1474c, 0x1474e, 0x14752, 0x14754, 0x14758,
+	0x1475a, 0x1475e, 0x14760, 0x14764, 0x14766, 0x1476a, 0x1476c, 0x1476c,
+	0x147e0, 0x147e8, 0x147ea, 0x147ee, 0x147f0, 0x147f4, 0x147f6, 0x147fa,
+	0x147fc, 0x14800, 0x14802, 0x14806, 0x14808, 0x1480c, 0x1480e, 0x14812,
+	0x14814, 0x14814, 0x14888, 0x14890, 0x14892, 0x14896, 0x14898, 0x1489c,
+	0x1489e, 0x148a2, 0x148a4, 0x148a8, 0x148aa, 0x148ae, 0x148b0, 0x148b4,
+	0x148b6, 0x148ba, 0x148bc, 0x148bc, 0x14930, 0x14938, 0x1493a, 0x1493e,
+	0x14940, 0x14944, 0x14946, 0x1494a, 0x1494c, 0x14950, 0x14952, 0x14956,
+	0x14958, 0x1495c, 0x1495e, 0x14962, 0x14964, 0x14964,
+	UINT_MAX, UINT_MAX,
+};
+static_assert(IS_ALIGNED(sizeof(gen7_9_0_rscc_registers), 8));
+
+static const u32 *gen7_9_0_external_core_regs[] = {
+	gen7_9_0_gpucc_registers,
+	gen7_9_0_gxclkctl_registers,
+	gen7_9_0_cpr_registers,
+	gen7_9_0_dpm_registers,
+	gen7_9_0_dpm_leakage_registers,
+	gen7_9_0_gfx_gpu_acd_registers,
+};
+#endif /*_ADRENO_GEN7_9_0_SNAPSHOT_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_coresight.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_coresight.c
@@ -0,0 +1,473 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/amba/bus.h>
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_coresight.h"
+
+static struct adreno_coresight_register gen7_coresight_regs[] = {
+	{ GEN7_DBGC_CFG_DBGBUS_SEL_A },
+	{ GEN7_DBGC_CFG_DBGBUS_SEL_B },
+	{ GEN7_DBGC_CFG_DBGBUS_SEL_C },
+	{ GEN7_DBGC_CFG_DBGBUS_SEL_D },
+	{ GEN7_DBGC_CFG_DBGBUS_CNTLT },
+	{ GEN7_DBGC_CFG_DBGBUS_CNTLM },
+	{ GEN7_DBGC_CFG_DBGBUS_OPL },
+	{ GEN7_DBGC_CFG_DBGBUS_OPE },
+	{ GEN7_DBGC_CFG_DBGBUS_IVTL_0 },
+	{ GEN7_DBGC_CFG_DBGBUS_IVTL_1 },
+	{ GEN7_DBGC_CFG_DBGBUS_IVTL_2 },
+	{ GEN7_DBGC_CFG_DBGBUS_IVTL_3 },
+	{ GEN7_DBGC_CFG_DBGBUS_MASKL_0 },
+	{ GEN7_DBGC_CFG_DBGBUS_MASKL_1 },
+	{ GEN7_DBGC_CFG_DBGBUS_MASKL_2 },
+	{ GEN7_DBGC_CFG_DBGBUS_MASKL_3 },
+	{ GEN7_DBGC_CFG_DBGBUS_BYTEL_0 },
+	{ GEN7_DBGC_CFG_DBGBUS_BYTEL_1 },
+	{ GEN7_DBGC_CFG_DBGBUS_IVTE_0 },
+	{ GEN7_DBGC_CFG_DBGBUS_IVTE_1 },
+	{ GEN7_DBGC_CFG_DBGBUS_IVTE_2 },
+	{ GEN7_DBGC_CFG_DBGBUS_IVTE_3 },
+	{ GEN7_DBGC_CFG_DBGBUS_MASKE_0 },
+	{ GEN7_DBGC_CFG_DBGBUS_MASKE_1 },
+	{ GEN7_DBGC_CFG_DBGBUS_MASKE_2 },
+	{ GEN7_DBGC_CFG_DBGBUS_MASKE_3 },
+	{ GEN7_DBGC_CFG_DBGBUS_NIBBLEE },
+	{ GEN7_DBGC_CFG_DBGBUS_PTRC0 },
+	{ GEN7_DBGC_CFG_DBGBUS_PTRC1 },
+	{ GEN7_DBGC_CFG_DBGBUS_LOADREG },
+	{ GEN7_DBGC_CFG_DBGBUS_IDX },
+	{ GEN7_DBGC_CFG_DBGBUS_CLRC },
+	{ GEN7_DBGC_CFG_DBGBUS_LOADIVT },
+	{ GEN7_DBGC_VBIF_DBG_CNTL },
+	{ GEN7_DBGC_DBG_LO_HI_GPIO },
+	{ GEN7_DBGC_EXT_TRACE_BUS_CNTL },
+	{ GEN7_DBGC_READ_AHB_THROUGH_DBG },
+	{ GEN7_DBGC_CFG_DBGBUS_TRACE_BUF1 },
+	{ GEN7_DBGC_CFG_DBGBUS_TRACE_BUF2 },
+	{ GEN7_DBGC_EVT_CFG },
+	{ GEN7_DBGC_EVT_INTF_SEL_0 },
+	{ GEN7_DBGC_EVT_INTF_SEL_1 },
+	{ GEN7_DBGC_PERF_ATB_CFG },
+	{ GEN7_DBGC_PERF_ATB_COUNTER_SEL_0 },
+	{ GEN7_DBGC_PERF_ATB_COUNTER_SEL_1 },
+	{ GEN7_DBGC_PERF_ATB_COUNTER_SEL_2 },
+	{ GEN7_DBGC_PERF_ATB_COUNTER_SEL_3 },
+	{ GEN7_DBGC_PERF_ATB_TRIG_INTF_SEL_0 },
+	{ GEN7_DBGC_PERF_ATB_TRIG_INTF_SEL_1 },
+	{ GEN7_DBGC_PERF_ATB_DRAIN_CMD },
+	{ GEN7_DBGC_ECO_CNTL },
+	{ GEN7_DBGC_AHB_DBG_CNTL },
+};
+
+static struct adreno_coresight_register gen7_coresight_regs_cx[] = {
+	{ GEN7_CX_DBGC_CFG_DBGBUS_SEL_A },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_SEL_B },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_SEL_C },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_SEL_D },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_CNTLT },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_CNTLM },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_OPL },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_OPE },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_IVTL_0 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_IVTL_1 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_IVTL_2 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_IVTL_3 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_MASKL_0 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_MASKL_1 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_MASKL_2 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_MASKL_3 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_BYTEL_0 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_BYTEL_1 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_IVTE_0 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_IVTE_1 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_IVTE_2 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_IVTE_3 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_MASKE_0 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_MASKE_1 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_MASKE_2 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_MASKE_3 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_NIBBLEE },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_PTRC0 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_PTRC1 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_LOADREG },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_IDX },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_CLRC },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_LOADIVT },
+	{ GEN7_CX_DBGC_VBIF_DBG_CNTL },
+	{ GEN7_CX_DBGC_DBG_LO_HI_GPIO },
+	{ GEN7_CX_DBGC_EXT_TRACE_BUS_CNTL },
+	{ GEN7_CX_DBGC_READ_AHB_THROUGH_DBG },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_TRACE_BUF1 },
+	{ GEN7_CX_DBGC_CFG_DBGBUS_TRACE_BUF2 },
+	{ GEN7_CX_DBGC_EVT_CFG },
+	{ GEN7_CX_DBGC_EVT_INTF_SEL_0 },
+	{ GEN7_CX_DBGC_EVT_INTF_SEL_1 },
+	{ GEN7_CX_DBGC_PERF_ATB_CFG },
+	{ GEN7_CX_DBGC_PERF_ATB_COUNTER_SEL_0 },
+	{ GEN7_CX_DBGC_PERF_ATB_COUNTER_SEL_1 },
+	{ GEN7_CX_DBGC_PERF_ATB_COUNTER_SEL_2 },
+	{ GEN7_CX_DBGC_PERF_ATB_COUNTER_SEL_3 },
+	{ GEN7_CX_DBGC_PERF_ATB_TRIG_INTF_SEL_0 },
+	{ GEN7_CX_DBGC_PERF_ATB_TRIG_INTF_SEL_1 },
+	{ GEN7_CX_DBGC_PERF_ATB_DRAIN_CMD },
+	{ GEN7_CX_DBGC_ECO_CNTL },
+	{ GEN7_CX_DBGC_AHB_DBG_CNTL },
+};
+
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_a, &gen7_coresight_regs[0]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_b, &gen7_coresight_regs[1]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_c, &gen7_coresight_regs[2]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_sel_d, &gen7_coresight_regs[3]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_cntlt, &gen7_coresight_regs[4]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_cntlm, &gen7_coresight_regs[5]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_opl, &gen7_coresight_regs[6]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ope, &gen7_coresight_regs[7]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_0, &gen7_coresight_regs[8]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_1, &gen7_coresight_regs[9]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_2, &gen7_coresight_regs[10]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivtl_3, &gen7_coresight_regs[11]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_0, &gen7_coresight_regs[12]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_1, &gen7_coresight_regs[13]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_2, &gen7_coresight_regs[14]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maskl_3, &gen7_coresight_regs[15]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_bytel_0, &gen7_coresight_regs[16]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_bytel_1, &gen7_coresight_regs[17]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_0, &gen7_coresight_regs[18]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_1, &gen7_coresight_regs[19]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_2, &gen7_coresight_regs[20]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ivte_3, &gen7_coresight_regs[21]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_0, &gen7_coresight_regs[22]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_1, &gen7_coresight_regs[23]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_2, &gen7_coresight_regs[24]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_maske_3, &gen7_coresight_regs[25]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_nibblee, &gen7_coresight_regs[26]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ptrc0, &gen7_coresight_regs[27]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_ptrc1, &gen7_coresight_regs[28]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_loadreg, &gen7_coresight_regs[29]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_idx, &gen7_coresight_regs[30]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_clrc, &gen7_coresight_regs[31]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_loadivt, &gen7_coresight_regs[32]);
+static ADRENO_CORESIGHT_ATTR(vbif_dbg_cntl, &gen7_coresight_regs[33]);
+static ADRENO_CORESIGHT_ATTR(dbg_lo_hi_gpio, &gen7_coresight_regs[34]);
+static ADRENO_CORESIGHT_ATTR(ext_trace_bus_cntl, &gen7_coresight_regs[35]);
+static ADRENO_CORESIGHT_ATTR(read_ahb_through_dbg, &gen7_coresight_regs[36]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_buf1, &gen7_coresight_regs[37]);
+static ADRENO_CORESIGHT_ATTR(cfg_dbgbus_trace_buf2, &gen7_coresight_regs[38]);
+static ADRENO_CORESIGHT_ATTR(evt_cfg, &gen7_coresight_regs[39]);
+static ADRENO_CORESIGHT_ATTR(evt_intf_sel_0, &gen7_coresight_regs[40]);
+static ADRENO_CORESIGHT_ATTR(evt_intf_sel_1, &gen7_coresight_regs[41]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_cfg, &gen7_coresight_regs[42]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_counter_sel_0, &gen7_coresight_regs[43]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_counter_sel_1, &gen7_coresight_regs[44]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_counter_sel_2, &gen7_coresight_regs[45]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_counter_sel_3, &gen7_coresight_regs[46]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_trig_intf_sel_0,
+				&gen7_coresight_regs[47]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_trig_intf_sel_1,
+				&gen7_coresight_regs[48]);
+static ADRENO_CORESIGHT_ATTR(perf_atb_drain_cmd, &gen7_coresight_regs[49]);
+static ADRENO_CORESIGHT_ATTR(eco_cntl, &gen7_coresight_regs[50]);
+static ADRENO_CORESIGHT_ATTR(ahb_dbg_cntl, &gen7_coresight_regs[51]);
+
+/*CX debug registers*/
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_sel_a,
+				&gen7_coresight_regs_cx[0]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_sel_b,
+				&gen7_coresight_regs_cx[1]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_sel_c,
+				&gen7_coresight_regs_cx[2]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_sel_d,
+				&gen7_coresight_regs_cx[3]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_cntlt,
+				&gen7_coresight_regs_cx[4]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_cntlm,
+				&gen7_coresight_regs_cx[5]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_opl,
+				&gen7_coresight_regs_cx[6]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ope,
+				&gen7_coresight_regs_cx[7]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivtl_0,
+				&gen7_coresight_regs_cx[8]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivtl_1,
+				&gen7_coresight_regs_cx[9]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivtl_2,
+				&gen7_coresight_regs_cx[10]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivtl_3,
+				&gen7_coresight_regs_cx[11]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maskl_0,
+				&gen7_coresight_regs_cx[12]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maskl_1,
+				&gen7_coresight_regs_cx[13]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maskl_2,
+				&gen7_coresight_regs_cx[14]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maskl_3,
+				&gen7_coresight_regs_cx[15]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_bytel_0,
+				&gen7_coresight_regs_cx[16]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_bytel_1,
+				&gen7_coresight_regs_cx[17]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivte_0,
+				&gen7_coresight_regs_cx[18]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivte_1,
+				&gen7_coresight_regs_cx[19]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivte_2,
+				&gen7_coresight_regs_cx[20]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ivte_3,
+				&gen7_coresight_regs_cx[21]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maske_0,
+				&gen7_coresight_regs_cx[22]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maske_1,
+				&gen7_coresight_regs_cx[23]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maske_2,
+				&gen7_coresight_regs_cx[24]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_maske_3,
+				&gen7_coresight_regs_cx[25]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_nibblee,
+				&gen7_coresight_regs_cx[26]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ptrc0,
+				&gen7_coresight_regs_cx[27]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_ptrc1,
+				&gen7_coresight_regs_cx[28]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_loadreg,
+				&gen7_coresight_regs_cx[29]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_idx,
+				&gen7_coresight_regs_cx[30]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_clrc,
+				&gen7_coresight_regs_cx[31]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_loadivt,
+				&gen7_coresight_regs_cx[32]);
+static ADRENO_CORESIGHT_ATTR(cx_vbif_dbg_cntl,
+				&gen7_coresight_regs_cx[33]);
+static ADRENO_CORESIGHT_ATTR(cx_dbg_lo_hi_gpio,
+				&gen7_coresight_regs_cx[34]);
+static ADRENO_CORESIGHT_ATTR(cx_ext_trace_bus_cntl,
+				&gen7_coresight_regs_cx[35]);
+static ADRENO_CORESIGHT_ATTR(cx_read_ahb_through_dbg,
+				&gen7_coresight_regs_cx[36]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_trace_buf1,
+				&gen7_coresight_regs_cx[37]);
+static ADRENO_CORESIGHT_ATTR(cx_cfg_dbgbus_trace_buf2,
+				&gen7_coresight_regs_cx[38]);
+static ADRENO_CORESIGHT_ATTR(cx_evt_cfg,
+				&gen7_coresight_regs_cx[39]);
+static ADRENO_CORESIGHT_ATTR(cx_evt_intf_sel_0,
+				&gen7_coresight_regs_cx[40]);
+static ADRENO_CORESIGHT_ATTR(cx_evt_intf_sel_1,
+				&gen7_coresight_regs_cx[41]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_cfg,
+				&gen7_coresight_regs_cx[42]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_counter_sel_0,
+				&gen7_coresight_regs_cx[43]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_counter_sel_1,
+				&gen7_coresight_regs_cx[44]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_counter_sel_2,
+				&gen7_coresight_regs_cx[45]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_counter_sel_3,
+				&gen7_coresight_regs_cx[46]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_trig_intf_sel_0,
+				&gen7_coresight_regs_cx[47]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_trig_intf_sel_1,
+				&gen7_coresight_regs_cx[48]);
+static ADRENO_CORESIGHT_ATTR(cx_perf_atb_drain_cmd,
+				&gen7_coresight_regs_cx[49]);
+static ADRENO_CORESIGHT_ATTR(cx_eco_cntl,
+				&gen7_coresight_regs_cx[50]);
+static ADRENO_CORESIGHT_ATTR(cx_ahb_dbg_cntl,
+				&gen7_coresight_regs_cx[51]);
+
+static struct attribute *gen7_coresight_attrs[] = {
+	&coresight_attr_cfg_dbgbus_sel_a.attr.attr,
+	&coresight_attr_cfg_dbgbus_sel_b.attr.attr,
+	&coresight_attr_cfg_dbgbus_sel_c.attr.attr,
+	&coresight_attr_cfg_dbgbus_sel_d.attr.attr,
+	&coresight_attr_cfg_dbgbus_cntlt.attr.attr,
+	&coresight_attr_cfg_dbgbus_cntlm.attr.attr,
+	&coresight_attr_cfg_dbgbus_opl.attr.attr,
+	&coresight_attr_cfg_dbgbus_ope.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivtl_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_maskl_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_bytel_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_bytel_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_ivte_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_0.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_1.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_2.attr.attr,
+	&coresight_attr_cfg_dbgbus_maske_3.attr.attr,
+	&coresight_attr_cfg_dbgbus_nibblee.attr.attr,
+	&coresight_attr_cfg_dbgbus_ptrc0.attr.attr,
+	&coresight_attr_cfg_dbgbus_ptrc1.attr.attr,
+	&coresight_attr_cfg_dbgbus_loadreg.attr.attr,
+	&coresight_attr_cfg_dbgbus_idx.attr.attr,
+	&coresight_attr_cfg_dbgbus_clrc.attr.attr,
+	&coresight_attr_cfg_dbgbus_loadivt.attr.attr,
+	&coresight_attr_vbif_dbg_cntl.attr.attr,
+	&coresight_attr_dbg_lo_hi_gpio.attr.attr,
+	&coresight_attr_ext_trace_bus_cntl.attr.attr,
+	&coresight_attr_read_ahb_through_dbg.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_buf1.attr.attr,
+	&coresight_attr_cfg_dbgbus_trace_buf2.attr.attr,
+	&coresight_attr_evt_cfg.attr.attr,
+	&coresight_attr_evt_intf_sel_0.attr.attr,
+	&coresight_attr_evt_intf_sel_1.attr.attr,
+	&coresight_attr_perf_atb_cfg.attr.attr,
+	&coresight_attr_perf_atb_counter_sel_0.attr.attr,
+	&coresight_attr_perf_atb_counter_sel_1.attr.attr,
+	&coresight_attr_perf_atb_counter_sel_2.attr.attr,
+	&coresight_attr_perf_atb_counter_sel_3.attr.attr,
+	&coresight_attr_perf_atb_trig_intf_sel_0.attr.attr,
+	&coresight_attr_perf_atb_trig_intf_sel_1.attr.attr,
+	&coresight_attr_perf_atb_drain_cmd.attr.attr,
+	&coresight_attr_eco_cntl.attr.attr,
+	&coresight_attr_ahb_dbg_cntl.attr.attr,
+	NULL,
+};
+
+/*cx*/
+static struct attribute *gen7_coresight_attrs_cx[] = {
+	&coresight_attr_cx_cfg_dbgbus_sel_a.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_sel_b.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_sel_c.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_sel_d.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_cntlt.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_cntlm.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_opl.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ope.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivtl_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivtl_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivtl_2.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivtl_3.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maskl_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maskl_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maskl_2.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maskl_3.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_bytel_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_bytel_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivte_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivte_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivte_2.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ivte_3.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maske_0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maske_1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maske_2.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_maske_3.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_nibblee.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ptrc0.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_ptrc1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_loadreg.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_idx.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_clrc.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_loadivt.attr.attr,
+	&coresight_attr_cx_vbif_dbg_cntl.attr.attr,
+	&coresight_attr_cx_dbg_lo_hi_gpio.attr.attr,
+	&coresight_attr_cx_ext_trace_bus_cntl.attr.attr,
+	&coresight_attr_cx_read_ahb_through_dbg.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_trace_buf1.attr.attr,
+	&coresight_attr_cx_cfg_dbgbus_trace_buf2.attr.attr,
+	&coresight_attr_cx_evt_cfg.attr.attr,
+	&coresight_attr_cx_evt_intf_sel_0.attr.attr,
+	&coresight_attr_cx_evt_intf_sel_1.attr.attr,
+	&coresight_attr_cx_perf_atb_cfg.attr.attr,
+	&coresight_attr_cx_perf_atb_counter_sel_0.attr.attr,
+	&coresight_attr_cx_perf_atb_counter_sel_1.attr.attr,
+	&coresight_attr_cx_perf_atb_counter_sel_2.attr.attr,
+	&coresight_attr_cx_perf_atb_counter_sel_3.attr.attr,
+	&coresight_attr_cx_perf_atb_trig_intf_sel_0.attr.attr,
+	&coresight_attr_cx_perf_atb_trig_intf_sel_1.attr.attr,
+	&coresight_attr_cx_perf_atb_drain_cmd.attr.attr,
+	&coresight_attr_cx_eco_cntl.attr.attr,
+	&coresight_attr_cx_ahb_dbg_cntl.attr.attr,
+	NULL,
+};
+
+static const struct attribute_group gen7_coresight_group = {
+	.attrs = gen7_coresight_attrs,
+};
+
+static const struct attribute_group *gen7_coresight_groups[] = {
+	&gen7_coresight_group,
+	NULL,
+};
+
+static const struct attribute_group gen7_coresight_group_cx = {
+	.attrs = gen7_coresight_attrs_cx,
+};
+
+static const struct attribute_group *gen7_coresight_groups_cx[] = {
+	&gen7_coresight_group_cx,
+	NULL,
+};
+
+static const struct adreno_coresight gen7_coresight = {
+	.registers = gen7_coresight_regs,
+	.count = ARRAY_SIZE(gen7_coresight_regs),
+	.groups = gen7_coresight_groups,
+};
+
+static const struct adreno_coresight gen7_coresight_cx = {
+	.registers = gen7_coresight_regs_cx,
+	.count = ARRAY_SIZE(gen7_coresight_regs_cx),
+	.groups = gen7_coresight_groups_cx,
+};
+
+static int name_match(struct device *dev, void *data)
+{
+	char *child_name = data;
+
+	return strcmp(child_name, dev_name(dev)) == 0;
+}
+
+void gen7_coresight_init(struct adreno_device *adreno_dev)
+{
+	struct adreno_funnel_device *funnel_gfx = &adreno_dev->funnel_gfx;
+	struct device *amba_dev;
+
+	/* Find the amba funnel device associated with gfx coresight funnel */
+	amba_dev = bus_find_device_by_name(&amba_bustype, NULL, "10963000.funnel");
+	if (!amba_dev)
+		return;
+
+	funnel_gfx->funnel_dev = device_find_child(amba_dev, "coresight-funnel-gfx", name_match);
+	if (funnel_gfx->funnel_dev == NULL)
+		return;
+
+	funnel_gfx->funnel_csdev = to_coresight_device(funnel_gfx->funnel_dev);
+	if (funnel_gfx->funnel_csdev == NULL)
+		return;
+
+	/*
+	 * Since coresight_funnel_gfx component is in graphics block, GPU has to be powered up
+	 * before enabling the funnel. Currently the generic coresight driver doesnt handle that.
+	 * Override the funnel ops set by coresight driver with graphics funnel ops, so that the
+	 * GPU can be brought up before enabling the funnel.
+	 */
+	funnel_gfx->funnel_ops = funnel_gfx->funnel_csdev->ops;
+	funnel_gfx->funnel_csdev->ops = NULL;
+
+	/*
+	 * The read-only sysfs node (funnel_ctrl) associated with gfx funnel reads the control
+	 * register and could cause a NOC error when gpu is in slumber. Since we do not require
+	 * such node, remove the attribute groups for the funnel.
+	 */
+	sysfs_remove_groups(&funnel_gfx->funnel_dev->kobj, funnel_gfx->funnel_csdev->dev.groups);
+
+	adreno_coresight_add_device(adreno_dev, "qcom,gpu-coresight-gx",
+		&gen7_coresight, &adreno_dev->gx_coresight);
+
+	adreno_coresight_add_device(adreno_dev, "qcom,gpu-coresight-cx",
+		&gen7_coresight_cx, &adreno_dev->cx_coresight);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_gmu.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_gmu.c
@@ -0,0 +1,3411 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/power/qcom-rpmpd.h>
+#include <linux/clk.h>
+#include <linux/component.h>
+#include <linux/delay.h>
+#include <linux/dma-map-ops.h>
+#include <linux/firmware.h>
+#include <linux/interconnect.h>
+#include <linux/io.h>
+#include <linux/kobject.h>
+#include <linux/of_platform.h>
+#include <linux/qcom-iommu-util.h>
+#include <linux/regulator/consumer.h>
+#include <linux/slab.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+#include <linux/sysfs.h>
+#include <linux/mailbox/qmp.h>
+#include <soc/qcom/cmd-db.h>
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_trace.h"
+#include "kgsl_bus.h"
+#include "kgsl_device.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+static struct gmu_vma_entry gen7_gmu_vma[] = {
+	[GMU_ITCM] = {
+			.start = 0x00000000,
+			.size = SZ_16K,
+		},
+	[GMU_CACHE] = {
+			.start = SZ_16K,
+			.size = (SZ_16M - SZ_16K),
+			.next_va = SZ_16K,
+		},
+	[GMU_DTCM] = {
+			.start = SZ_256M + SZ_16K,
+			.size = SZ_16K,
+		},
+	[GMU_DCACHE] = {
+			.start = 0x0,
+			.size = 0x0,
+		},
+	[GMU_NONCACHED_KERNEL] = {
+			.start = 0x60000000,
+			.size = SZ_512M,
+			.next_va = 0x60000000,
+		},
+	[GMU_NONCACHED_KERNEL_EXTENDED] = {
+			.start = 0xc0000000,
+			.size = SZ_512M,
+			.next_va = 0xc0000000,
+		},
+};
+
+static ssize_t log_stream_enable_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, log_kobj);
+	bool val;
+	int ret;
+
+	ret = kstrtobool(buf, &val);
+	if (ret)
+		return ret;
+
+	gmu->log_stream_enable = val;
+	adreno_mark_for_coldboot(gen7_gmu_to_adreno(gmu));
+	return count;
+}
+
+static ssize_t log_stream_enable_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, log_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n", gmu->log_stream_enable);
+}
+
+static ssize_t log_group_mask_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, log_kobj);
+	u32 val;
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	gmu->log_group_mask = val;
+	adreno_mark_for_coldboot(gen7_gmu_to_adreno(gmu));
+	return count;
+}
+
+static ssize_t log_group_mask_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, log_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%x\n", gmu->log_group_mask);
+}
+
+static struct kobj_attribute log_stream_enable_attr =
+	__ATTR(log_stream_enable, 0644, log_stream_enable_show, log_stream_enable_store);
+
+static struct kobj_attribute log_group_mask_attr =
+	__ATTR(log_group_mask, 0644, log_group_mask_show, log_group_mask_store);
+
+static struct attribute *log_attrs[] = {
+	&log_stream_enable_attr.attr,
+	&log_group_mask_attr.attr,
+	NULL,
+};
+ATTRIBUTE_GROUPS(log);
+
+static struct kobj_type log_kobj_type = {
+	.sysfs_ops = &kobj_sysfs_ops,
+	.default_groups = log_groups,
+};
+
+static ssize_t stats_enable_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, stats_kobj);
+	bool val;
+	int ret;
+
+	ret = kstrtobool(buf, &val);
+	if (ret)
+		return ret;
+
+	gmu->stats_enable = val;
+	adreno_mark_for_coldboot(gen7_gmu_to_adreno(gmu));
+	return count;
+}
+
+static ssize_t stats_enable_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, stats_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n", gmu->stats_enable);
+}
+
+static ssize_t stats_mask_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, stats_kobj);
+	u32 val;
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	gmu->stats_mask = val;
+	adreno_mark_for_coldboot(gen7_gmu_to_adreno(gmu));
+	return count;
+}
+
+static ssize_t stats_mask_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, stats_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%x\n", gmu->stats_mask);
+}
+
+static ssize_t stats_interval_store(struct kobject *kobj,
+	struct kobj_attribute *attr, const char *buf, size_t count)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, stats_kobj);
+	u32 val;
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	gmu->stats_interval = val;
+	adreno_mark_for_coldboot(gen7_gmu_to_adreno(gmu));
+	return count;
+}
+
+static ssize_t stats_interval_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+{
+	struct gen7_gmu_device *gmu = container_of(kobj, struct gen7_gmu_device, stats_kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%x\n", gmu->stats_interval);
+}
+
+static struct kobj_attribute stats_enable_attr =
+	__ATTR(stats_enable, 0644, stats_enable_show, stats_enable_store);
+
+static struct kobj_attribute stats_mask_attr =
+	__ATTR(stats_mask, 0644, stats_mask_show, stats_mask_store);
+
+static struct kobj_attribute stats_interval_attr =
+	__ATTR(stats_interval, 0644, stats_interval_show, stats_interval_store);
+
+static struct attribute *stats_attrs[] = {
+	&stats_enable_attr.attr,
+	&stats_mask_attr.attr,
+	&stats_interval_attr.attr,
+	NULL,
+};
+ATTRIBUTE_GROUPS(stats);
+
+static struct kobj_type stats_kobj_type = {
+	.sysfs_ops = &kobj_sysfs_ops,
+	.default_groups = stats_groups,
+};
+
+static int gen7_timed_poll_check_rscc(struct gen7_gmu_device *gmu,
+		unsigned int offset, unsigned int expected_ret,
+		unsigned int timeout, unsigned int mask)
+{
+	u32 value;
+
+	return readl_poll_timeout(gmu->rscc_virt + (offset << 2), value,
+		(value & mask) == expected_ret, 100, timeout * 1000);
+}
+
+struct gen7_gmu_device *to_gen7_gmu(struct adreno_device *adreno_dev)
+{
+	struct gen7_device *gen7_dev = container_of(adreno_dev,
+					struct gen7_device, adreno_dev);
+
+	return &gen7_dev->gmu;
+}
+
+struct adreno_device *gen7_gmu_to_adreno(struct gen7_gmu_device *gmu)
+{
+	struct gen7_device *gen7_dev =
+			container_of(gmu, struct gen7_device, gmu);
+
+	return &gen7_dev->adreno_dev;
+}
+
+#define RSC_CMD_OFFSET 2
+
+static void _regwrite(void __iomem *regbase,
+		unsigned int offsetwords, unsigned int value)
+{
+	void __iomem *reg;
+
+	reg = regbase + (offsetwords << 2);
+	__raw_writel(value, reg);
+}
+
+void gen7_load_rsc_ucode(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	void __iomem *rscc = gmu->rscc_virt;
+	unsigned int seq_offset = GEN7_RSCC_SEQ_MEM_0_DRV0;
+
+	/* Disable SDE clock gating */
+	_regwrite(rscc, GEN7_GPU_RSCC_RSC_STATUS0_DRV0, BIT(24));
+
+	/* Setup RSC PDC handshake for sleep and wakeup */
+	_regwrite(rscc, GEN7_RSCC_PDC_SLAVE_ID_DRV0, 1);
+	_regwrite(rscc, GEN7_RSCC_HIDDEN_TCS_CMD0_DATA, 0);
+	_regwrite(rscc, GEN7_RSCC_HIDDEN_TCS_CMD0_ADDR, 0);
+	_regwrite(rscc, GEN7_RSCC_HIDDEN_TCS_CMD0_DATA + RSC_CMD_OFFSET, 0);
+	_regwrite(rscc, GEN7_RSCC_HIDDEN_TCS_CMD0_ADDR + RSC_CMD_OFFSET, 0);
+	_regwrite(rscc, GEN7_RSCC_HIDDEN_TCS_CMD0_DATA + RSC_CMD_OFFSET * 2,
+		adreno_is_gen7_2_x_family(adreno_dev) ?  0x80000021 : 0x80000000);
+	_regwrite(rscc, GEN7_RSCC_HIDDEN_TCS_CMD0_ADDR + RSC_CMD_OFFSET * 2, 0);
+	_regwrite(rscc, GEN7_RSCC_OVERRIDE_START_ADDR, 0);
+	_regwrite(rscc, GEN7_RSCC_PDC_SEQ_START_ADDR, 0x4520);
+	_regwrite(rscc, GEN7_RSCC_PDC_MATCH_VALUE_LO, 0x4510);
+	_regwrite(rscc, GEN7_RSCC_PDC_MATCH_VALUE_HI, 0x4514);
+
+	if (adreno_is_gen7_2_x_family(adreno_dev))
+		seq_offset = GEN7_2_0_RSCC_SEQ_MEM_0_DRV0;
+
+	/* Load RSC sequencer uCode for sleep and wakeup */
+	_regwrite(rscc, seq_offset, 0xeaaae5a0);
+	_regwrite(rscc, seq_offset + 1, 0xe1a1ebab);
+	_regwrite(rscc, seq_offset + 2, 0xa2e0a581);
+	_regwrite(rscc, seq_offset + 3, 0xecac82e2);
+	_regwrite(rscc, seq_offset + 4, 0x0020edad);
+}
+
+int gen7_load_pdc_ucode(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct resource *res_cfg;
+	void __iomem *cfg = NULL;
+
+	res_cfg = platform_get_resource_byname(gmu->pdev, IORESOURCE_MEM,
+			"gmu_pdc");
+	if (res_cfg)
+		cfg = ioremap(res_cfg->start, resource_size(res_cfg));
+
+	if (!cfg) {
+		dev_err(&gmu->pdev->dev, "Failed to map PDC CFG\n");
+		return -ENODEV;
+	}
+
+	/* Setup GPU PDC */
+	_regwrite(cfg, GEN7_PDC_GPU_SEQ_START_ADDR, 0);
+	_regwrite(cfg, GEN7_PDC_GPU_ENABLE_PDC, 0x80000001);
+
+	iounmap(cfg);
+
+	return 0;
+}
+
+/* Configure and enable GMU low power mode */
+static void gen7_gmu_power_config(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Disable GMU WB/RB buffer and caches at boot */
+	gmu_core_regwrite(device, GEN7_GMU_SYS_BUS_CONFIG, 0x1);
+	gmu_core_regwrite(device, GEN7_GMU_ICACHE_CONFIG, 0x1);
+	gmu_core_regwrite(device, GEN7_GMU_DCACHE_CONFIG, 0x1);
+}
+
+static void gmu_ao_sync_event(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	unsigned long flags;
+	u64 ticks;
+
+	/*
+	 * Get the GMU always on ticks and log it in a trace message. This
+	 * will be used to map GMU ticks to ftrace time. Do this in atomic
+	 * context to ensure nothing happens between reading the always
+	 * on ticks and doing the trace.
+	 */
+
+	local_irq_save(flags);
+
+	ticks = gpudev->read_alwayson(adreno_dev);
+
+	trace_gmu_ao_sync(ticks);
+
+	local_irq_restore(flags);
+}
+
+int gen7_gmu_device_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	gmu_core_reset_trace_header(&gmu->trace);
+
+	gmu_ao_sync_event(adreno_dev);
+
+	/* Bring GMU out of reset */
+	gmu_core_regwrite(device, GEN7_GMU_CM3_SYSRESET, 0);
+
+	/* Make sure the write is posted before moving ahead */
+	wmb();
+
+	if (gmu_core_timed_poll_check(device, GEN7_GMU_CM3_FW_INIT_RESULT,
+			BIT(8), 100, GENMASK(8, 0))) {
+		dev_err(&gmu->pdev->dev, "GMU failed to come out of reset\n");
+		gmu_core_fault_snapshot(device);
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+/*
+ * gen7_gmu_hfi_start() - Write registers and start HFI.
+ * @device: Pointer to KGSL device
+ */
+int gen7_gmu_hfi_start(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	gmu_core_regwrite(device, GEN7_GMU_HFI_CTRL_INIT, 1);
+
+	if (gmu_core_timed_poll_check(device, GEN7_GMU_HFI_CTRL_STATUS,
+			BIT(0), 100, BIT(0))) {
+		dev_err(&gmu->pdev->dev, "GMU HFI init failed\n");
+		gmu_core_fault_snapshot(device);
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+int gen7_rscc_wakeup_sequence(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct device *dev = &gmu->pdev->dev;
+
+	/* Skip wakeup sequence if we didn't do the sleep sequence */
+	if (!test_bit(GMU_PRIV_RSCC_SLEEP_DONE, &gmu->flags))
+		return 0;
+
+	/* RSC wake sequence */
+	gmu_core_regwrite(device, GEN7_GMU_RSCC_CONTROL_REQ, BIT(1));
+
+	/* Write request before polling */
+	wmb();
+
+	if (gmu_core_timed_poll_check(device, GEN7_GMU_RSCC_CONTROL_ACK,
+				BIT(1), 100, BIT(1))) {
+		dev_err(dev, "Failed to do GPU RSC power on\n");
+		return -ETIMEDOUT;
+	}
+
+	if (gen7_timed_poll_check_rscc(gmu, GEN7_RSCC_SEQ_BUSY_DRV0,
+				0x0, 100, UINT_MAX)) {
+		dev_err(dev, "GPU RSC sequence stuck in waking up GPU\n");
+		return -ETIMEDOUT;
+	}
+
+	gmu_core_regwrite(device, GEN7_GMU_RSCC_CONTROL_REQ, 0);
+
+	clear_bit(GMU_PRIV_RSCC_SLEEP_DONE, &gmu->flags);
+
+	return 0;
+}
+
+int gen7_rscc_sleep_sequence(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	if (!test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags))
+		return 0;
+
+	if (test_bit(GMU_PRIV_RSCC_SLEEP_DONE, &gmu->flags))
+		return 0;
+
+	gmu_core_regwrite(device, GEN7_GMU_CM3_SYSRESET, 1);
+	/* Make sure M3 is in reset before going on */
+	wmb();
+
+	gmu_core_regread(device, GEN7_GMU_GENERAL_9, &gmu->log_wptr_retention);
+
+	gmu_core_regwrite(device, GEN7_GMU_RSCC_CONTROL_REQ, BIT(0));
+	/* Make sure the request completes before continuing */
+	wmb();
+
+	ret = gen7_timed_poll_check_rscc(gmu, GEN7_GPU_RSCC_RSC_STATUS0_DRV0,
+			BIT(16), 100, BIT(16));
+	if (ret) {
+		dev_err(&gmu->pdev->dev, "GPU RSC power off fail\n");
+		return -ETIMEDOUT;
+	}
+
+	gmu_core_regwrite(device, GEN7_GMU_RSCC_CONTROL_REQ, 0);
+
+	if (adreno_dev->lm_enabled)
+		gmu_core_regwrite(device, GEN7_GMU_AO_SPARE_CNTL, 0);
+
+	set_bit(GMU_PRIV_RSCC_SLEEP_DONE, &gmu->flags);
+
+	return 0;
+}
+
+static struct kgsl_memdesc *find_gmu_memdesc(struct gen7_gmu_device *gmu,
+	u32 addr, u32 size)
+{
+	int i;
+
+	for (i = 0; i < gmu->global_entries; i++) {
+		struct kgsl_memdesc *md = &gmu->gmu_globals[i];
+
+		if ((addr >= md->gmuaddr) &&
+				(((addr + size) <= (md->gmuaddr + md->size))))
+			return md;
+	}
+
+	return NULL;
+}
+
+static int find_vma_block(struct gen7_gmu_device *gmu, u32 addr, u32 size)
+{
+	int i;
+
+	for (i = 0; i < GMU_MEM_TYPE_MAX; i++) {
+		struct gmu_vma_entry *vma = &gmu->vma[i];
+
+		if ((addr >= vma->start) &&
+			((addr + size) <= (vma->start + vma->size)))
+			return i;
+	}
+
+	return -ENOENT;
+}
+
+static void load_tcm(struct adreno_device *adreno_dev, const u8 *src,
+	u32 tcm_start, u32 base, const struct gmu_block_header *blk)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 tcm_offset = tcm_start + ((blk->addr - base)/sizeof(u32));
+
+	kgsl_regmap_bulk_write(&device->regmap, tcm_offset, src,
+		blk->size >> 2);
+}
+
+int gen7_gmu_load_fw(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	const u8 *fw = (const u8 *)gmu->fw_image->data;
+
+	while (fw < gmu->fw_image->data + gmu->fw_image->size) {
+		const struct gmu_block_header *blk =
+					(const struct gmu_block_header *)fw;
+		int id;
+
+		fw += sizeof(*blk);
+
+		/* Don't deal with zero size blocks */
+		if (blk->size == 0)
+			continue;
+
+		id = find_vma_block(gmu, blk->addr, blk->size);
+
+		if (id < 0) {
+			dev_err(&gmu->pdev->dev,
+				"Unknown block in GMU FW addr:0x%x size:0x%x\n",
+				blk->addr, blk->size);
+			return -EINVAL;
+		}
+
+		if (id == GMU_ITCM) {
+			load_tcm(adreno_dev, fw,
+				GEN7_GMU_CM3_ITCM_START,
+				gmu->vma[GMU_ITCM].start, blk);
+		} else if (id == GMU_DTCM) {
+			load_tcm(adreno_dev, fw,
+				GEN7_GMU_CM3_DTCM_START,
+				gmu->vma[GMU_DTCM].start, blk);
+		} else {
+			/* The firmware block for memory needs to be copied on first boot only */
+			if (!test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags)) {
+				struct kgsl_memdesc *md =
+					find_gmu_memdesc(gmu, blk->addr, blk->size);
+
+				if (!md) {
+					dev_err(&gmu->pdev->dev,
+						"No backing memory for GMU FW block addr:0x%x size:0x%x\n",
+						blk->addr, blk->size);
+					return -EINVAL;
+				}
+
+				memcpy(md->hostptr + (blk->addr - md->gmuaddr), fw,
+					blk->size);
+			}
+		}
+
+		fw += blk->size;
+	}
+
+	/* Proceed only after the FW is written */
+	wmb();
+	return 0;
+}
+
+static const char *oob_to_str(enum oob_request req)
+{
+	switch (req) {
+	case oob_gpu:
+		return "oob_gpu";
+	case oob_perfcntr:
+		return "oob_perfcntr";
+	case oob_boot_slumber:
+		return "oob_boot_slumber";
+	case oob_dcvs:
+		return "oob_dcvs";
+	default:
+		return "unknown";
+	}
+}
+
+static void trigger_reset_recovery(struct adreno_device *adreno_dev,
+	enum oob_request req)
+{
+	/*
+	 * Trigger recovery for perfcounter oob only since only
+	 * perfcounter oob can happen alongside an actively rendering gpu.
+	 */
+	if (req != oob_perfcntr)
+		return;
+
+	if (adreno_dev->dispatch_ops && adreno_dev->dispatch_ops->fault)
+		adreno_dev->dispatch_ops->fault(adreno_dev,
+			ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+}
+
+int gen7_gmu_oob_set(struct kgsl_device *device,
+		enum oob_request req)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+	int set, check;
+
+	if (req == oob_perfcntr && gmu->num_oob_perfcntr++)
+		return 0;
+
+	if (req >= oob_boot_slumber) {
+		dev_err(&gmu->pdev->dev,
+			"Unsupported OOB request %s\n",
+			oob_to_str(req));
+		return -EINVAL;
+	}
+
+	set = BIT(30 - req * 2);
+	check = BIT(31 - req);
+
+	gmu_core_regwrite(device, GEN7_GMU_HOST2GMU_INTR_SET, set);
+
+	if (gmu_core_timed_poll_check(device, GEN7_GMU_GMU2HOST_INTR_INFO, check,
+				100, check)) {
+		if (req == oob_perfcntr)
+			gmu->num_oob_perfcntr--;
+		gmu_core_fault_snapshot(device);
+		ret = -ETIMEDOUT;
+		WARN(1, "OOB request %s timed out\n", oob_to_str(req));
+		trigger_reset_recovery(adreno_dev, req);
+	}
+
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_CLR, check);
+
+	trace_kgsl_gmu_oob_set(set);
+	return ret;
+}
+
+void gen7_gmu_oob_clear(struct kgsl_device *device,
+		enum oob_request req)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int clear = BIT(31 - req * 2);
+
+	if (req == oob_perfcntr && --gmu->num_oob_perfcntr)
+		return;
+
+	if (req >= oob_boot_slumber) {
+		dev_err(&gmu->pdev->dev, "Unsupported OOB clear %s\n",
+				oob_to_str(req));
+		return;
+	}
+
+	gmu_core_regwrite(device, GEN7_GMU_HOST2GMU_INTR_SET, clear);
+	trace_kgsl_gmu_oob_clear(clear);
+}
+
+void gen7_gmu_irq_enable(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hfi *hfi = &gmu->hfi;
+
+	/* Clear pending IRQs and Unmask needed IRQs */
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_CLR, UINT_MAX);
+	gmu_core_regwrite(device, GEN7_GMU_AO_HOST_INTERRUPT_CLR, UINT_MAX);
+
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_MASK,
+			(unsigned int)~HFI_IRQ_MASK);
+	gmu_core_regwrite(device, GEN7_GMU_AO_HOST_INTERRUPT_MASK,
+			(unsigned int)~GMU_AO_INT_MASK);
+
+	/* Enable all IRQs on host */
+	enable_irq(hfi->irq);
+	enable_irq(gmu->irq);
+}
+
+void gen7_gmu_irq_disable(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hfi *hfi = &gmu->hfi;
+
+	/* Disable all IRQs on host */
+	disable_irq(gmu->irq);
+	disable_irq(hfi->irq);
+
+	/* Mask all IRQs and clear pending IRQs */
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_MASK, UINT_MAX);
+	gmu_core_regwrite(device, GEN7_GMU_AO_HOST_INTERRUPT_MASK, UINT_MAX);
+
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_CLR, UINT_MAX);
+	gmu_core_regwrite(device, GEN7_GMU_AO_HOST_INTERRUPT_CLR, UINT_MAX);
+}
+
+static int gen7_gmu_hfi_start_msg(struct adreno_device *adreno_dev)
+{
+	struct hfi_start_cmd req;
+	int ret;
+
+	ret = CMD_MSG_HDR(req, H2F_MSG_START);
+	if (ret)
+		return ret;
+
+	return gen7_hfi_send_generic_req(adreno_dev, &req, sizeof(req));
+}
+
+static u32 gen7_rscc_tcsm_drv0_status_reglist[] = {
+	GEN7_RSCC_TCS0_DRV0_STATUS,
+	GEN7_RSCC_TCS1_DRV0_STATUS,
+	GEN7_RSCC_TCS2_DRV0_STATUS,
+	GEN7_RSCC_TCS3_DRV0_STATUS,
+	GEN7_RSCC_TCS4_DRV0_STATUS,
+	GEN7_RSCC_TCS5_DRV0_STATUS,
+	GEN7_RSCC_TCS6_DRV0_STATUS,
+	GEN7_RSCC_TCS7_DRV0_STATUS,
+	GEN7_RSCC_TCS8_DRV0_STATUS,
+	GEN7_RSCC_TCS9_DRV0_STATUS,
+};
+
+static u32 gen7_2_0_rscc_tcsm_drv0_status_reglist[] = {
+	GEN7_2_0_RSCC_TCS0_DRV0_STATUS,
+	GEN7_2_0_RSCC_TCS1_DRV0_STATUS,
+	GEN7_2_0_RSCC_TCS2_DRV0_STATUS,
+	GEN7_2_0_RSCC_TCS3_DRV0_STATUS,
+	GEN7_2_0_RSCC_TCS4_DRV0_STATUS,
+	GEN7_2_0_RSCC_TCS5_DRV0_STATUS,
+	GEN7_2_0_RSCC_TCS6_DRV0_STATUS,
+	GEN7_2_0_RSCC_TCS7_DRV0_STATUS,
+	GEN7_2_0_RSCC_TCS8_DRV0_STATUS,
+	GEN7_2_0_RSCC_TCS9_DRV0_STATUS,
+};
+
+static int gen7_complete_rpmh_votes(struct gen7_gmu_device *gmu,
+		u32 timeout)
+{
+	struct adreno_device *adreno_dev = gen7_gmu_to_adreno(gmu);
+	int i, ret = 0;
+
+	if (adreno_is_gen7_2_x_family(adreno_dev)) {
+		for (i = 0; i < ARRAY_SIZE(gen7_2_0_rscc_tcsm_drv0_status_reglist); i++)
+			ret |= gen7_timed_poll_check_rscc(gmu,
+				gen7_2_0_rscc_tcsm_drv0_status_reglist[i], BIT(0), timeout,
+				BIT(0));
+	} else {
+		for (i = 0; i < ARRAY_SIZE(gen7_rscc_tcsm_drv0_status_reglist); i++)
+			ret |= gen7_timed_poll_check_rscc(gmu,
+				gen7_rscc_tcsm_drv0_status_reglist[i], BIT(0), timeout,
+				BIT(0));
+	}
+
+	if (ret)
+		dev_err(&gmu->pdev->dev, "RPMH votes timedout: %d\n", ret);
+
+	return ret;
+}
+
+#define GX_GDSC_POWER_OFF	BIT(0)
+#define GX_CLK_OFF		BIT(1)
+#define is_on(val)		(!(val & (GX_GDSC_POWER_OFF | GX_CLK_OFF)))
+
+bool gen7_gmu_gx_is_on(struct adreno_device *adreno_dev)
+{
+	unsigned int val;
+
+	gmu_core_regread(KGSL_DEVICE(adreno_dev),
+			GEN7_GMU_GFX_PWR_CLK_STATUS, &val);
+	return is_on(val);
+}
+
+static const char *idle_level_name(int level)
+{
+	if (level == GPU_HW_ACTIVE)
+		return "GPU_HW_ACTIVE";
+	else if (level == GPU_HW_IFPC)
+		return "GPU_HW_IFPC";
+
+	return "(Unknown)";
+}
+
+int gen7_gmu_wait_for_lowest_idle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	unsigned int reg, reg1, reg2, reg3, reg4, reg5, reg6, reg7, reg8;
+	unsigned long t;
+	u64 ts1, ts2;
+
+	ts1 = gpudev->read_alwayson(adreno_dev);
+
+	t = jiffies + msecs_to_jiffies(100);
+	do {
+		gmu_core_regread(device,
+			GEN7_GPU_GMU_CX_GMU_RPMH_POWER_STATE, &reg);
+		gmu_core_regread(device, GEN7_GMU_GFX_PWR_CLK_STATUS, &reg1);
+
+		/*
+		 * Check that we are at lowest level. If lowest level is IFPC
+		 * double check that GFX clock is off.
+		 */
+		if (gmu->idle_level == reg)
+			if (!(gmu->idle_level == GPU_HW_IFPC && is_on(reg1)))
+				return 0;
+
+		/* Wait 100us to reduce unnecessary AHB bus traffic */
+		usleep_range(10, 100);
+	} while (!time_after(jiffies, t));
+
+	/* Check one last time */
+	gmu_core_regread(device, GEN7_GPU_GMU_CX_GMU_RPMH_POWER_STATE, &reg);
+	gmu_core_regread(device, GEN7_GMU_GFX_PWR_CLK_STATUS, &reg1);
+
+	/*
+	 * Check that we are at lowest level. If lowest level is IFPC
+	 * double check that GFX clock is off.
+	 */
+	if (gmu->idle_level == reg)
+		if (!(gmu->idle_level == GPU_HW_IFPC && is_on(reg1)))
+			return 0;
+
+	ts2 = gpudev->read_alwayson(adreno_dev);
+
+	/* Collect abort data to help with debugging */
+	gmu_core_regread(device, GEN7_GPU_GMU_AO_GPU_CX_BUSY_STATUS, &reg2);
+	gmu_core_regread(device, GEN7_GMU_RBBM_INT_UNMASKED_STATUS, &reg3);
+	gmu_core_regread(device, GEN7_GMU_GMU_PWR_COL_KEEPALIVE, &reg4);
+	gmu_core_regread(device, GEN7_GMU_AO_SPARE_CNTL, &reg5);
+
+	dev_err(&gmu->pdev->dev,
+		"----------------------[ GMU error ]----------------------\n");
+	dev_err(&gmu->pdev->dev,
+		"Timeout waiting for lowest idle level %s\n",
+		idle_level_name(gmu->idle_level));
+	dev_err(&gmu->pdev->dev, "Start: %llx (absolute ticks)\n", ts1);
+	dev_err(&gmu->pdev->dev, "Poll: %llx (ticks relative to start)\n",
+		ts2-ts1);
+	dev_err(&gmu->pdev->dev,
+		"RPMH_POWER_STATE=%x GFX_PWR_CLK_STATUS=%x\n", reg, reg1);
+	dev_err(&gmu->pdev->dev, "CX_BUSY_STATUS=%x\n", reg2);
+	dev_err(&gmu->pdev->dev,
+		"RBBM_INT_UNMASKED_STATUS=%x PWR_COL_KEEPALIVE=%x\n",
+		reg3, reg4);
+	dev_err(&gmu->pdev->dev, "GEN7_GMU_AO_SPARE_CNTL=%x\n", reg5);
+
+	/* Access GX registers only when GX is ON */
+	if (is_on(reg1)) {
+		kgsl_regread(device, GEN7_CP_STATUS_1, &reg6);
+		kgsl_regread(device, GEN7_CP_CP2GMU_STATUS, &reg7);
+		kgsl_regread(device, GEN7_CP_CONTEXT_SWITCH_CNTL, &reg8);
+
+		dev_err(&gmu->pdev->dev, "GEN7_CP_STATUS_1=%x\n", reg6);
+		dev_err(&gmu->pdev->dev,
+			"CP2GMU_STATUS=%x CONTEXT_SWITCH_CNTL=%x\n",
+			reg7, reg8);
+	}
+
+	WARN_ON(1);
+	gmu_core_fault_snapshot(device);
+	return -ETIMEDOUT;
+}
+
+/* Bitmask for GPU idle status check */
+#define CXGXCPUBUSYIGNAHB	BIT(30)
+int gen7_gmu_wait_for_idle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	u32 status2;
+	u64 ts1;
+
+	ts1 = gpudev->read_alwayson(adreno_dev);
+	if (gmu_core_timed_poll_check(device, GEN7_GPU_GMU_AO_GPU_CX_BUSY_STATUS,
+			0, 100, CXGXCPUBUSYIGNAHB)) {
+		gmu_core_regread(device,
+				GEN7_GPU_GMU_AO_GPU_CX_BUSY_STATUS2, &status2);
+		dev_err(&gmu->pdev->dev,
+				"GMU not idling: status2=0x%x %llx %llx\n",
+				status2, ts1,
+				gpudev->read_alwayson(adreno_dev));
+		gmu_core_fault_snapshot(device);
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+int gen7_gmu_version_info(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+
+	/* GMU version info is at a fixed offset in the DTCM */
+	gmu_core_regread(device, GEN7_GMU_CM3_DTCM_START + 0xff8,
+			&gmu->ver.core);
+	gmu_core_regread(device, GEN7_GMU_CM3_DTCM_START + 0xff9,
+			&gmu->ver.core_dev);
+	gmu_core_regread(device, GEN7_GMU_CM3_DTCM_START + 0xffa,
+			&gmu->ver.pwr);
+	gmu_core_regread(device, GEN7_GMU_CM3_DTCM_START + 0xffb,
+			&gmu->ver.pwr_dev);
+	gmu_core_regread(device, GEN7_GMU_CM3_DTCM_START + 0xffc,
+			&gmu->ver.hfi);
+
+	/* Check if gmu fw version on device is compatible with kgsl driver */
+	if (gmu->ver.core < gen7_core->gmu_fw_version) {
+		dev_err_once(&gmu->pdev->dev,
+			     "GMU FW version 0x%x error (expected 0x%x)\n",
+			     gmu->ver.core, gen7_core->gmu_fw_version);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int gen7_gmu_itcm_shadow(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 i, *dest;
+
+	if (gmu->itcm_shadow)
+		return 0;
+
+	gmu->itcm_shadow = vzalloc(gmu->vma[GMU_ITCM].size);
+	if (!gmu->itcm_shadow)
+		return -ENOMEM;
+
+	dest = (u32 *)gmu->itcm_shadow;
+
+	for (i = 0; i < (gmu->vma[GMU_ITCM].size >> 2); i++)
+		gmu_core_regread(KGSL_DEVICE(adreno_dev),
+			GEN7_GMU_CM3_ITCM_START + i, dest++);
+
+	return 0;
+}
+
+void gen7_gmu_register_config(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 val;
+
+	/* Clear any previously set cm3 fault */
+	atomic_set(&gmu->cm3_fault, 0);
+
+	/* Vote veto for FAL10 */
+	gmu_core_regwrite(device, GEN7_GPU_GMU_CX_GMU_CX_FALNEXT_INTF, 0x1);
+	gmu_core_regwrite(device, GEN7_GPU_GMU_CX_GMU_CX_FAL_INTF, 0x1);
+
+	/* Clear init result to make sure we are getting fresh value */
+	gmu_core_regwrite(device, GEN7_GMU_CM3_FW_INIT_RESULT, 0);
+	gmu_core_regwrite(device, GEN7_GMU_CM3_BOOT_CONFIG, 0x2);
+
+	gmu_core_regwrite(device, GEN7_GMU_HFI_QTBL_ADDR,
+			gmu->hfi.hfi_mem->gmuaddr);
+	gmu_core_regwrite(device, GEN7_GMU_HFI_QTBL_INFO, 1);
+
+	gmu_core_regwrite(device, GEN7_GMU_AHB_FENCE_RANGE_0, BIT(31) |
+			FIELD_PREP(GENMASK(30, 18), 0x32) |
+			FIELD_PREP(GENMASK(17, 0), 0x8a0));
+
+	/*
+	 * Make sure that CM3 state is at reset value. Snapshot is changing
+	 * NMI bit and if we boot up GMU with NMI bit set GMU will boot
+	 * straight in to NMI handler without executing __main code
+	 */
+	gmu_core_regwrite(device, GEN7_GMU_CM3_CFG, 0x4052);
+
+	/**
+	 * We may have asserted gbif halt as part of reset sequence which may
+	 * not get cleared if the gdsc was not reset. So clear it before
+	 * attempting GMU boot.
+	 */
+	kgsl_regwrite(device, GEN7_GBIF_HALT, 0x0);
+
+	/* Set vrb address before starting GMU */
+	if (!IS_ERR_OR_NULL(gmu->vrb))
+		gmu_core_regwrite(device, GEN7_GMU_GENERAL_11, gmu->vrb->gmuaddr);
+
+	/* Set the log wptr index */
+	gmu_core_regwrite(device, GEN7_GMU_GENERAL_9,
+			gmu->log_wptr_retention);
+
+	/* Pass chipid to GMU FW, must happen before starting GMU */
+	gmu_core_regwrite(device, GEN7_GMU_GENERAL_10,
+			ADRENO_GMU_REV(ADRENO_GPUREV(adreno_dev)));
+
+	/* Log size is encoded in (number of 4K units - 1) */
+	val = (gmu->gmu_log->gmuaddr & GENMASK(31, 12)) |
+		((GMU_LOG_SIZE/SZ_4K - 1) & GENMASK(7, 0));
+	gmu_core_regwrite(device, GEN7_GMU_GENERAL_8, val);
+
+	/* Configure power control and bring the GMU out of reset */
+	gen7_gmu_power_config(adreno_dev);
+
+	/*
+	 * Enable BCL throttling -
+	 * XOCLK1: countable: 0x13 (25% throttle)
+	 * XOCLK2: countable: 0x17 (58% throttle)
+	 * XOCLK3: countable: 0x19 (75% throttle)
+	 * POWER_CONTROL_SELECT_0 controls counters 0 - 3, each selector
+	 * is 8 bits wide.
+	 */
+	if (adreno_dev->bcl_enabled)
+		gmu_core_regrmw(device, GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_0,
+			0xffffff00, FIELD_PREP(GENMASK(31, 24), 0x19) |
+			FIELD_PREP(GENMASK(23, 16), 0x17) |
+			FIELD_PREP(GENMASK(15, 8), 0x13));
+}
+
+static struct gmu_vma_node *find_va(struct gmu_vma_entry *vma, u32 addr, u32 size)
+{
+	struct rb_node *node = vma->vma_root.rb_node;
+
+	while (node != NULL) {
+		struct gmu_vma_node *data = rb_entry(node, struct gmu_vma_node, node);
+
+		if (addr + size <= data->va)
+			node = node->rb_left;
+		else if (addr >= data->va + data->size)
+			node = node->rb_right;
+		else
+			return data;
+	}
+	return NULL;
+}
+
+/* Return true if VMA supports dynamic allocations */
+static bool vma_is_dynamic(int vma_id)
+{
+	/* Dynamic allocations are done in the GMU_NONCACHED_KERNEL space */
+	return vma_id == GMU_NONCACHED_KERNEL;
+}
+
+static int insert_va(struct gmu_vma_entry *vma, u32 addr, u32 size)
+{
+	struct rb_node **node, *parent = NULL;
+	struct gmu_vma_node *new = kzalloc(sizeof(*new), GFP_NOWAIT);
+
+	if (new == NULL)
+		return -ENOMEM;
+
+	new->va = addr;
+	new->size = size;
+
+	node = &vma->vma_root.rb_node;
+	while (*node != NULL) {
+		struct gmu_vma_node *this;
+
+		parent = *node;
+		this = rb_entry(parent, struct gmu_vma_node, node);
+
+		if (addr + size <= this->va)
+			node = &parent->rb_left;
+		else if (addr >= this->va + this->size)
+			node = &parent->rb_right;
+		else {
+			kfree(new);
+			return -EEXIST;
+		}
+	}
+
+	/* Add new node and rebalance tree */
+	rb_link_node(&new->node, parent, node);
+	rb_insert_color(&new->node, &vma->vma_root);
+
+	return 0;
+}
+
+static u32 find_unmapped_va(struct gmu_vma_entry *vma, u32 size, u32 va_align)
+{
+	struct rb_node *node = rb_first(&vma->vma_root);
+	u32 cur = vma->start;
+	bool found = false;
+
+	cur = ALIGN(cur, va_align);
+
+	while (node) {
+		struct gmu_vma_node *data = rb_entry(node, struct gmu_vma_node, node);
+
+		if (cur + size <= data->va) {
+			found = true;
+			break;
+		}
+
+		cur = ALIGN(data->va + data->size, va_align);
+		node = rb_next(node);
+	}
+
+	/* Do we have space after the last node? */
+	if (!found && (cur + size <= vma->start + vma->size))
+		found = true;
+	return found ? cur : 0;
+}
+
+static int _map_gmu_dynamic(struct gen7_gmu_device *gmu,
+	struct kgsl_memdesc *md,
+	u32 addr, u32 vma_id, int attrs, u32 align)
+{
+	int ret;
+	struct gmu_vma_entry *vma = &gmu->vma[vma_id];
+	struct gmu_vma_node *vma_node = NULL;
+	u32 size = ALIGN(md->size, hfi_get_gmu_sz_alignment(align));
+
+	spin_lock(&vma->lock);
+	if (!addr) {
+		/*
+		 * We will end up with a hole (GMU VA range not backed by physical mapping) if
+		 * the aligned size is greater than the size of the physical mapping
+		 */
+		addr = find_unmapped_va(vma, size, hfi_get_gmu_va_alignment(align));
+		if (addr == 0) {
+			spin_unlock(&vma->lock);
+			dev_err(&gmu->pdev->dev,
+				"Insufficient VA space size: %x\n", size);
+			return -ENOMEM;
+		}
+	}
+
+	ret = insert_va(vma, addr, size);
+	spin_unlock(&vma->lock);
+	if (ret < 0) {
+		dev_err(&gmu->pdev->dev,
+			"Could not insert va: %x size %x\n", addr, size);
+		return ret;
+	}
+
+	ret = gmu_core_map_memdesc(gmu->domain, md, addr, attrs);
+	if (!ret) {
+		md->gmuaddr = addr;
+		return 0;
+	}
+
+	/* Failed to map to GMU */
+	dev_err(&gmu->pdev->dev,
+		"Unable to map GMU kernel block: addr:0x%08x size:0x%llx :%d\n",
+		addr, md->size, ret);
+
+	spin_lock(&vma->lock);
+	vma_node = find_va(vma, md->gmuaddr, size);
+	if (vma_node)
+		rb_erase(&vma_node->node, &vma->vma_root);
+	spin_unlock(&vma->lock);
+	kfree(vma_node);
+
+	return ret;
+}
+
+static int _map_gmu_static(struct gen7_gmu_device *gmu,
+	struct kgsl_memdesc *md,
+	u32 addr, u32 vma_id, int attrs, u32 align)
+{
+	int ret;
+	struct gmu_vma_entry *vma = &gmu->vma[vma_id];
+	u32 size = ALIGN(md->size, hfi_get_gmu_sz_alignment(align));
+
+	if (!addr)
+		addr = ALIGN(vma->next_va, hfi_get_gmu_va_alignment(align));
+
+	ret = gmu_core_map_memdesc(gmu->domain, md, addr, attrs);
+	if (ret) {
+		dev_err(&gmu->pdev->dev,
+			"Unable to map GMU kernel block: addr:0x%08x size:0x%llx :%d\n",
+			addr, md->size, ret);
+		return ret;
+	}
+	md->gmuaddr = addr;
+	/*
+	 * We will end up with a hole (GMU VA range not backed by physical mapping) if the aligned
+	 * size is greater than the size of the physical mapping
+	 */
+	vma->next_va = md->gmuaddr + size;
+	return 0;
+}
+
+static int _map_gmu(struct gen7_gmu_device *gmu,
+	struct kgsl_memdesc *md,
+	u32 addr, u32 vma_id, int attrs, u32 align)
+{
+	return vma_is_dynamic(vma_id) ?
+			_map_gmu_dynamic(gmu, md, addr, vma_id, attrs, align) :
+			_map_gmu_static(gmu, md, addr, vma_id, attrs, align);
+}
+
+int gen7_gmu_import_buffer(struct gen7_gmu_device *gmu, u32 vma_id,
+				struct kgsl_memdesc *md, u32 attrs, u32 align)
+{
+	return _map_gmu(gmu, md, 0, vma_id, attrs, align);
+}
+
+struct kgsl_memdesc *gen7_reserve_gmu_kernel_block(struct gen7_gmu_device *gmu,
+	u32 addr, u32 size, u32 vma_id, u32 align)
+{
+	int ret;
+	struct kgsl_memdesc *md;
+	struct kgsl_device *device = KGSL_DEVICE(gen7_gmu_to_adreno(gmu));
+	int attrs = IOMMU_READ | IOMMU_WRITE | IOMMU_PRIV;
+
+	if (gmu->global_entries == ARRAY_SIZE(gmu->gmu_globals))
+		return ERR_PTR(-ENOMEM);
+
+	md = &gmu->gmu_globals[gmu->global_entries];
+
+	ret = kgsl_allocate_kernel(device, md, size, 0, KGSL_MEMDESC_SYSMEM);
+	if (ret) {
+		memset(md, 0x0, sizeof(*md));
+		return ERR_PTR(-ENOMEM);
+	}
+
+	ret = _map_gmu(gmu, md, addr, vma_id, attrs, align);
+	if (ret) {
+		kgsl_sharedmem_free(md);
+		memset(md, 0x0, sizeof(*md));
+		return ERR_PTR(ret);
+	}
+
+	gmu->global_entries++;
+
+	return md;
+}
+
+struct kgsl_memdesc *gen7_reserve_gmu_kernel_block_fixed(struct gen7_gmu_device *gmu,
+	u32 addr, u32 size, u32 vma_id, const char *resource, int attrs, u32 align)
+{
+	int ret;
+	struct kgsl_memdesc *md;
+	struct kgsl_device *device = KGSL_DEVICE(gen7_gmu_to_adreno(gmu));
+
+	if (gmu->global_entries == ARRAY_SIZE(gmu->gmu_globals))
+		return ERR_PTR(-ENOMEM);
+
+	md = &gmu->gmu_globals[gmu->global_entries];
+
+	ret = kgsl_memdesc_init_fixed(device, gmu->pdev, resource, md);
+	if (ret)
+		return ERR_PTR(ret);
+
+	ret = _map_gmu(gmu, md, addr, vma_id, attrs, align);
+
+	sg_free_table(md->sgt);
+	kfree(md->sgt);
+	md->sgt = NULL;
+
+	if (!ret)
+		gmu->global_entries++;
+	else {
+		dev_err(&gmu->pdev->dev,
+			"Unable to map GMU kernel block: addr:0x%08x size:0x%llx :%d\n",
+			addr, md->size, ret);
+		memset(md, 0x0, sizeof(*md));
+		md = ERR_PTR(ret);
+	}
+	return md;
+}
+
+int gen7_alloc_gmu_kernel_block(struct gen7_gmu_device *gmu,
+	struct kgsl_memdesc *md, u32 size, u32 vma_id, int attrs)
+{
+	int ret;
+	struct kgsl_device *device = KGSL_DEVICE(gen7_gmu_to_adreno(gmu));
+
+	ret = kgsl_allocate_kernel(device, md, size, 0, KGSL_MEMDESC_SYSMEM);
+	if (ret)
+		return ret;
+
+	ret = _map_gmu(gmu, md, 0, vma_id, attrs, 0);
+	if (ret)
+		kgsl_sharedmem_free(md);
+
+	return ret;
+}
+
+void gen7_free_gmu_block(struct gen7_gmu_device *gmu, struct kgsl_memdesc *md)
+{
+	int vma_id = find_vma_block(gmu, md->gmuaddr, md->size);
+	struct gmu_vma_entry *vma;
+	struct gmu_vma_node *vma_node;
+
+	if ((vma_id < 0) || !vma_is_dynamic(vma_id))
+		return;
+
+	vma = &gmu->vma[vma_id];
+
+	/*
+	 * Do not remove the vma node if we failed to unmap the entire buffer. This is because the
+	 * iommu driver considers remapping an already mapped iova as fatal.
+	 */
+        if (md->size != iommu_unmap(gmu->domain, md->gmuaddr, md->size))
+		goto free;
+
+	spin_lock(&vma->lock);
+	vma_node = find_va(vma, md->gmuaddr, md->size);
+	if (vma_node)
+		rb_erase(&vma_node->node, &vma->vma_root);
+	spin_unlock(&vma->lock);
+	kfree(vma_node);
+free:
+	kgsl_sharedmem_free(md);
+}
+
+static int gen7_gmu_process_prealloc(struct gen7_gmu_device *gmu,
+	struct gmu_block_header *blk)
+{
+	struct kgsl_memdesc *md;
+
+	int id = find_vma_block(gmu, blk->addr, blk->value);
+
+	if (id < 0) {
+		dev_err(&gmu->pdev->dev,
+			"Invalid prealloc block addr: 0x%x value:%d\n",
+			blk->addr, blk->value);
+		return id;
+	}
+
+	/* Nothing to do for TCM blocks or user uncached */
+	if (id == GMU_ITCM || id == GMU_DTCM || id == GMU_NONCACHED_USER)
+		return 0;
+
+	/* Check if the block is already allocated */
+	md = find_gmu_memdesc(gmu, blk->addr, blk->value);
+	if (md != NULL)
+		return 0;
+
+	md = gen7_reserve_gmu_kernel_block(gmu, blk->addr, blk->value, id, 0);
+
+	return PTR_ERR_OR_ZERO(md);
+}
+
+int gen7_gmu_parse_fw(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	struct gmu_block_header *blk;
+	int ret, offset = 0;
+	const char *gmufw_name = gen7_core->gmufw_name;
+
+	/*
+	 * If GMU fw already saved and verified, do nothing new.
+	 * Skip only request_firmware and allow preallocation to
+	 * ensure in scenario where GMU request firmware succeeded
+	 * but preallocation fails, we don't return early without
+	 * successful preallocations on next open call.
+	 */
+	if (!gmu->fw_image) {
+
+		if (gen7_core->gmufw_name == NULL)
+			return -EINVAL;
+
+		ret = request_firmware(&gmu->fw_image, gmufw_name,
+				&gmu->pdev->dev);
+		if (ret) {
+			if (gen7_core->gmufw_bak_name) {
+				gmufw_name = gen7_core->gmufw_bak_name;
+				ret = request_firmware(&gmu->fw_image, gmufw_name,
+					&gmu->pdev->dev);
+			}
+
+			if (ret) {
+				dev_err(&gmu->pdev->dev,
+					"request_firmware (%s) failed: %d\n",
+					gmufw_name, ret);
+
+				return ret;
+			}
+		}
+	}
+
+	/*
+	 * Zero payload fw blocks contain metadata and are
+	 * guaranteed to precede fw load data. Parse the
+	 * metadata blocks.
+	 */
+	while (offset < gmu->fw_image->size) {
+		blk = (struct gmu_block_header *)&gmu->fw_image->data[offset];
+
+		if (offset + sizeof(*blk) > gmu->fw_image->size) {
+			dev_err(&gmu->pdev->dev, "Invalid FW Block\n");
+			return -EINVAL;
+		}
+
+		/* Done with zero length blocks so return */
+		if (blk->size)
+			break;
+
+		offset += sizeof(*blk);
+
+		if (blk->type == GMU_BLK_TYPE_PREALLOC_REQ ||
+			blk->type == GMU_BLK_TYPE_PREALLOC_PERSIST_REQ) {
+			ret = gen7_gmu_process_prealloc(gmu, blk);
+
+			if (ret)
+				return ret;
+		}
+	}
+
+	return 0;
+}
+
+int gen7_gmu_memory_init(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	/* GMU master log */
+	if (IS_ERR_OR_NULL(gmu->gmu_log))
+		gmu->gmu_log = gen7_reserve_gmu_kernel_block(gmu, 0,
+				GMU_LOG_SIZE, GMU_NONCACHED_KERNEL, 0);
+
+	return PTR_ERR_OR_ZERO(gmu->gmu_log);
+}
+
+static int gen7_gmu_init(struct adreno_device *adreno_dev)
+{
+	int ret;
+
+	ret = gen7_gmu_parse_fw(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_gmu_memory_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	return gen7_hfi_init(adreno_dev);
+}
+
+static void _do_gbif_halt(struct kgsl_device *device, u32 reg, u32 ack_reg,
+	u32 mask, const char *client)
+{
+	u32 ack;
+	unsigned long t;
+
+	kgsl_regwrite(device, reg, mask);
+
+	t = jiffies + msecs_to_jiffies(100);
+	do {
+		kgsl_regread(device, ack_reg, &ack);
+		if ((ack & mask) == mask)
+			return;
+
+		/*
+		 * If we are attempting recovery in case of stall-on-fault
+		 * then the halt sequence will not complete as long as SMMU
+		 * is stalled.
+		 */
+		kgsl_mmu_pagefault_resume(&device->mmu, false);
+
+		usleep_range(10, 100);
+	} while (!time_after(jiffies, t));
+
+	/* Check one last time */
+	kgsl_mmu_pagefault_resume(&device->mmu, false);
+
+	kgsl_regread(device, ack_reg, &ack);
+	if ((ack & mask) == mask)
+		return;
+
+	dev_err(device->dev, "%s GBIF halt timed out\n", client);
+}
+
+static void gen7_gmu_pwrctrl_suspend(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Disconnect GPU from BUS is not needed if CX GDSC goes off later */
+
+	/* Check no outstanding RPMh voting */
+	gen7_complete_rpmh_votes(gmu, 1);
+
+	/* Clear the WRITEDROPPED fields and set fence to allow mode */
+	gmu_core_regwrite(device, GEN7_GMU_AHB_FENCE_STATUS_CLR, 0x7);
+	gmu_core_regwrite(device, GEN7_GMU_AO_AHB_FENCE_CTRL, 0);
+
+	/* Make sure above writes are committed before we proceed to recovery */
+	wmb();
+
+	gmu_core_regwrite(device, GEN7_GMU_CM3_SYSRESET, 1);
+
+	/* Halt GX traffic */
+	if (gen7_gmu_gx_is_on(adreno_dev))
+		_do_gbif_halt(device, GEN7_RBBM_GBIF_HALT,
+				GEN7_RBBM_GBIF_HALT_ACK,
+				GEN7_GBIF_GX_HALT_MASK,
+				"GX");
+
+	/* Halt CX traffic */
+	_do_gbif_halt(device, GEN7_GBIF_HALT, GEN7_GBIF_HALT_ACK,
+			GEN7_GBIF_ARB_HALT_MASK, "CX");
+
+	if (gen7_gmu_gx_is_on(adreno_dev))
+		kgsl_regwrite(device, GEN7_RBBM_SW_RESET_CMD, 0x1);
+
+	/* Allow the software reset to complete */
+	udelay(100);
+
+	/*
+	 * This is based on the assumption that GMU is the only one controlling
+	 * the GX HS. This code path is the only client voting for GX from linux
+	 * kernel.
+	 */
+	if (!gen7_gmu_gx_is_on(adreno_dev))
+		return;
+
+	/*
+	 * Switch gx gdsc control from GMU to CPU force non-zero reference
+	 * count in clk driver so next disable call will turn off the GDSC
+	 */
+	kgsl_pwrctrl_enable_gx_gdsc(device);
+	kgsl_pwrctrl_disable_gx_gdsc(device);
+
+	if (gen7_gmu_gx_is_on(adreno_dev))
+		dev_err(&gmu->pdev->dev, "gx is stuck on\n");
+}
+
+/*
+ * gen7_gmu_notify_slumber() - initiate request to GMU to prepare to slumber
+ * @device: Pointer to KGSL device
+ */
+static int gen7_gmu_notify_slumber(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int bus_level = pwr->pwrlevels[pwr->default_pwrlevel].bus_freq;
+	int perf_idx = gmu->dcvs_table.gpu_level_num -
+			pwr->default_pwrlevel - 1;
+	struct hfi_prep_slumber_cmd req = {
+		.freq = perf_idx,
+		.bw = bus_level,
+	};
+	int ret;
+
+	req.bw |= gen7_bus_ab_quantize(adreno_dev, 0);
+
+	/* Disable the power counter so that the GMU is not busy */
+	gmu_core_regwrite(device, GEN7_GMU_CX_GMU_POWER_COUNTER_ENABLE, 0);
+
+	ret = CMD_MSG_HDR(req, H2F_MSG_PREPARE_SLUMBER);
+	if (ret)
+		return ret;
+
+	ret = gen7_hfi_send_generic_req(adreno_dev, &req, sizeof(req));
+
+	/* Make sure the fence is in ALLOW mode */
+	gmu_core_regwrite(device, GEN7_GMU_AO_AHB_FENCE_CTRL, 0);
+	return ret;
+}
+
+void gen7_gmu_suspend(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	gen7_gmu_pwrctrl_suspend(adreno_dev);
+
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	gen7_rdpm_cx_freq_update(gmu, 0);
+
+	dev_err(&gmu->pdev->dev, "Suspended GMU\n");
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_NONE);
+}
+
+static int gen7_gmu_dcvs_set(struct adreno_device *adreno_dev,
+		int gpu_pwrlevel, int bus_level, u32 ab)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_dcvs_table *table = &gmu->dcvs_table;
+	struct hfi_gx_bw_perf_vote_cmd req = {
+		.ack_type = DCVS_ACK_BLOCK,
+		.freq = INVALID_DCVS_IDX,
+		.bw = INVALID_DCVS_IDX,
+	};
+	int ret = 0;
+
+	if (!test_bit(GMU_PRIV_HFI_STARTED, &gmu->flags))
+		return 0;
+
+	/* Do not set to XO and lower GPU clock vote from GMU */
+	if ((gpu_pwrlevel != INVALID_DCVS_IDX) &&
+			(gpu_pwrlevel >= table->gpu_level_num - 1))
+		return -EINVAL;
+
+	if (gpu_pwrlevel < table->gpu_level_num - 1)
+		req.freq = table->gpu_level_num - gpu_pwrlevel - 1;
+
+	if (bus_level < pwr->ddr_table_count && bus_level > 0)
+		req.bw = bus_level;
+
+	req.bw |=  gen7_bus_ab_quantize(adreno_dev, ab);
+
+	/* GMU will vote for slumber levels through the sleep sequence */
+	if ((req.freq == INVALID_DCVS_IDX) && (req.bw == INVALID_BW_VOTE))
+		return 0;
+
+	ret = CMD_MSG_HDR(req, H2F_MSG_GX_BW_PERF_VOTE);
+	if (ret)
+		return ret;
+
+	ret = gen7_hfi_send_generic_req(adreno_dev, &req, sizeof(req));
+	if (ret) {
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"Failed to set GPU perf idx %d, bw idx %d\n",
+			req.freq, req.bw);
+
+		/*
+		 * If this was a dcvs request along side an active gpu, request
+		 * dispatcher based reset and recovery.
+		 */
+		if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+			adreno_dispatcher_fault(adreno_dev, ADRENO_GMU_FAULT |
+				ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+	}
+
+	if (req.freq != INVALID_DCVS_IDX)
+		gen7_rdpm_mx_freq_update(gmu,
+			gmu->dcvs_table.gx_votes[req.freq].freq);
+
+	return ret;
+}
+
+static int gen7_gmu_clock_set(struct adreno_device *adreno_dev, u32 pwrlevel)
+{
+	return gen7_gmu_dcvs_set(adreno_dev, pwrlevel, INVALID_DCVS_IDX, INVALID_AB_VALUE);
+}
+
+static int gen7_gmu_ifpc_store(struct kgsl_device *device,
+		unsigned int val)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	unsigned int requested_idle_level;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_IFPC))
+		return -EINVAL;
+
+	if (val)
+		requested_idle_level = GPU_HW_IFPC;
+	else
+		requested_idle_level = GPU_HW_ACTIVE;
+
+	if (gmu->idle_level == requested_idle_level)
+		return 0;
+
+	/* Power down the GPU before changing the idle level */
+	return adreno_power_cycle_u32(adreno_dev, &gmu->idle_level,
+		requested_idle_level);
+}
+
+static unsigned int gen7_gmu_ifpc_isenabled(struct kgsl_device *device)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(ADRENO_DEVICE(device));
+
+	return gmu->idle_level == GPU_HW_IFPC;
+}
+
+/* Send an NMI to the GMU */
+void gen7_gmu_send_nmi(struct kgsl_device *device, bool force)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 result;
+
+	/*
+	 * Do not send NMI if the SMMU is stalled because GMU will not be able
+	 * to save cm3 state to DDR.
+	 */
+	if (gen7_gmu_gx_is_on(adreno_dev) && gen7_is_smmu_stalled(device)) {
+		dev_err(&gmu->pdev->dev,
+			"Skipping NMI because SMMU is stalled\n");
+		return;
+	}
+
+	if (force)
+		goto nmi;
+
+	/*
+	 * We should not send NMI if there was a CM3 fault reported because we
+	 * don't want to overwrite the critical CM3 state captured by gmu before
+	 * it sent the CM3 fault interrupt. Also don't send NMI if GMU reset is
+	 * already active. We could have hit a GMU assert and NMI might have
+	 * already been triggered.
+	 */
+
+	/* make sure we're reading the latest cm3_fault */
+	smp_rmb();
+
+	if (atomic_read(&gmu->cm3_fault))
+		return;
+
+	gmu_core_regread(device, GEN7_GMU_CM3_FW_INIT_RESULT, &result);
+
+	if (result & 0xE00)
+		return;
+
+nmi:
+	/* Mask so there's no interrupt caused by NMI */
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_MASK, UINT_MAX);
+
+	/* Make sure the interrupt is masked before causing it */
+	wmb();
+
+	/* This will cause the GMU to save it's internal state to ddr */
+	gmu_core_regrmw(device, GEN7_GMU_CM3_CFG, BIT(9), BIT(9));
+
+	/* Make sure the NMI is invoked before we proceed*/
+	wmb();
+
+	/* Wait for the NMI to be handled */
+	udelay(200);
+}
+
+static void gen7_gmu_cooperative_reset(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	unsigned int result;
+
+	gmu_core_regwrite(device, GEN7_GMU_CX_GMU_WDOG_CTRL, 0);
+	gmu_core_regwrite(device, GEN7_GMU_HOST2GMU_INTR_SET, BIT(17));
+
+	/*
+	 * After triggering graceful death wait for snapshot ready
+	 * indication from GMU.
+	 */
+	if (!gmu_core_timed_poll_check(device, GEN7_GMU_CM3_FW_INIT_RESULT,
+				0x800, 2, 0x800))
+		return;
+
+	gmu_core_regread(device, GEN7_GMU_CM3_FW_INIT_RESULT, &result);
+	dev_err(&gmu->pdev->dev,
+		"GMU cooperative reset timed out 0x%x\n", result);
+	/*
+	 * If we dont get a snapshot ready from GMU, trigger NMI
+	 * and if we still timeout then we just continue with reset.
+	 */
+	gen7_gmu_send_nmi(device, true);
+
+	gmu_core_regread(device, GEN7_GMU_CM3_FW_INIT_RESULT, &result);
+	if ((result & 0x800) != 0x800)
+		dev_err(&gmu->pdev->dev,
+			"GMU cooperative reset NMI timed out 0x%x\n", result);
+}
+
+static int gen7_gmu_wait_for_active_transition(struct kgsl_device *device)
+{
+	unsigned int reg;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(ADRENO_DEVICE(device));
+
+	if (gmu_core_timed_poll_check(device, GEN7_GPU_GMU_CX_GMU_RPMH_POWER_STATE,
+			GPU_HW_ACTIVE, 100, GENMASK(3, 0))) {
+		gmu_core_regread(device, GEN7_GPU_GMU_CX_GMU_RPMH_POWER_STATE, &reg);
+		dev_err(&gmu->pdev->dev,
+			"GMU failed to move to ACTIVE state, Current state: 0x%x\n",
+			reg);
+
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+static bool gen7_gmu_scales_bandwidth(struct kgsl_device *device)
+{
+	return true;
+}
+
+void gen7_gmu_handle_watchdog(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 mask;
+
+	/* Temporarily mask the watchdog interrupt to prevent a storm */
+	gmu_core_regread(device, GEN7_GMU_AO_HOST_INTERRUPT_MASK, &mask);
+	gmu_core_regwrite(device, GEN7_GMU_AO_HOST_INTERRUPT_MASK,
+			(mask | GMU_INT_WDOG_BITE));
+
+	gen7_gmu_send_nmi(device, false);
+
+	dev_err_ratelimited(&gmu->pdev->dev,
+			"GMU watchdog expired interrupt received\n");
+}
+
+static irqreturn_t gen7_gmu_irq_handler(int irq, void *data)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	const struct gen7_gpudev *gen7_gpudev =
+		to_gen7_gpudev(ADRENO_GPU_DEVICE(adreno_dev));
+	unsigned int status = 0;
+
+	gmu_core_regread(device, GEN7_GMU_AO_HOST_INTERRUPT_STATUS, &status);
+	gmu_core_regwrite(device, GEN7_GMU_AO_HOST_INTERRUPT_CLR, status);
+
+	if (status & GMU_INT_HOST_AHB_BUS_ERR)
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"AHB bus error interrupt received\n");
+
+	if (status & GMU_INT_WDOG_BITE)
+		gen7_gpudev->handle_watchdog(adreno_dev);
+
+	if (status & GMU_INT_FENCE_ERR) {
+		unsigned int fence_status;
+
+		gmu_core_regread(device, GEN7_GMU_AHB_FENCE_STATUS,
+			&fence_status);
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"FENCE error interrupt received %x\n", fence_status);
+	}
+
+	if (status & ~GMU_AO_INT_MASK)
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"Unhandled GMU interrupts 0x%lx\n",
+				status & ~GMU_AO_INT_MASK);
+
+	return IRQ_HANDLED;
+}
+
+void gen7_gmu_aop_send_acd_state(struct gen7_gmu_device *gmu, bool flag)
+{
+	char msg_buf[36];
+	u32 size;
+	int ret;
+
+	if (!gmu->qmp && !gmu->mailbox.channel)
+		return;
+
+	size = scnprintf(msg_buf, sizeof(msg_buf),
+			"{class: gpu, res: acd, val: %d}", flag);
+
+	/* mailbox controller expects 4-byte aligned buffer */
+	size = ALIGN((size + 1), SZ_4);
+
+	if (gmu->qmp) {
+		ret = qmp_send(gmu->qmp, msg_buf, size);
+	} else {
+		struct qmp_pkt msg;
+
+		msg.size = size;
+		msg.data = msg_buf;
+
+		ret = mbox_send_message(gmu->mailbox.channel, &msg);
+	}
+
+	if (ret < 0)
+		dev_err(&gmu->pdev->dev,
+			"AOP send message failed: %d\n", ret);
+}
+
+int gen7_gmu_enable_clks(struct adreno_device *adreno_dev, u32 level)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	gen7_rdpm_cx_freq_update(gmu, gmu->freqs[level] / 1000);
+
+	ret = kgsl_clk_set_rate(gmu->clks, gmu->num_clks, "gmu_clk",
+			gmu->freqs[level]);
+	if (ret) {
+		dev_err(&gmu->pdev->dev, "GMU clock:%d set failed:%d\n",
+			gmu->freqs[level], ret);
+		return ret;
+	}
+
+	ret = kgsl_clk_set_rate(gmu->clks, gmu->num_clks, "hub_clk",
+			adreno_dev->gmu_hub_clk_freq);
+	if (ret && ret != -ENODEV) {
+		dev_err(&gmu->pdev->dev, "Unable to set the HUB clock\n");
+		return ret;
+	}
+
+	ret = clk_bulk_prepare_enable(gmu->num_clks, gmu->clks);
+	if (ret) {
+		dev_err(&gmu->pdev->dev, "Cannot enable GMU clocks\n");
+		return ret;
+	}
+
+	device->state = KGSL_STATE_AWARE;
+
+	return 0;
+}
+
+static int gen7_gmu_first_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int level, ret;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_AWARE);
+
+	gen7_gmu_aop_send_acd_state(gmu, adreno_dev->acd_enabled);
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (ret)
+		return ret;
+
+	ret = gen7_gmu_enable_clks(adreno_dev, 0);
+	if (ret)
+		goto gdsc_off;
+
+	/* Initialize the CX timer */
+	gen7_cx_timer_init(adreno_dev);
+
+	ret = gen7_gmu_load_fw(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = gen7_gmu_version_info(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = gen7_gmu_itcm_shadow(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = gen7_scm_gpu_init_cx_regs(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	gen7_gmu_register_config(adreno_dev);
+
+	gen7_gmu_irq_enable(adreno_dev);
+
+	/* Vote for minimal DDR BW for GMU to init */
+	level = pwr->pwrlevels[pwr->default_pwrlevel].bus_min;
+	icc_set_bw(pwr->icc_path, 0, kBps_to_icc(pwr->ddr_table[level]));
+
+	ret = gen7_gmu_device_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	if (!test_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags)) {
+		ret = gen7_load_pdc_ucode(adreno_dev);
+		if (ret)
+			goto err;
+
+		gen7_load_rsc_ucode(adreno_dev);
+		set_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags);
+	}
+
+	ret = gen7_gmu_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	gen7_get_gpu_feature_info(adreno_dev);
+
+	ret = gen7_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	if (gen7_hfi_send_get_value(adreno_dev, HFI_VALUE_GMU_AB_VOTE, 0) == 1) {
+		adreno_dev->gmu_ab = true;
+		set_bit(ADRENO_DEVICE_GMU_AB, &adreno_dev->priv);
+	}
+
+	icc_set_bw(pwr->icc_path, 0, 0);
+
+	device->gmu_fault = false;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return 0;
+
+err:
+	gen7_gmu_irq_disable(adreno_dev);
+
+	if (device->gmu_fault) {
+		gen7_gmu_suspend(adreno_dev);
+		return ret;
+	}
+
+clks_gdsc_off:
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+gdsc_off:
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	gen7_rdpm_cx_freq_update(gmu, 0);
+
+	return ret;
+}
+
+static int gen7_gmu_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_AWARE);
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (ret)
+		return ret;
+
+	ret = gen7_gmu_enable_clks(adreno_dev, 0);
+	if (ret)
+		goto gdsc_off;
+
+	ret = gen7_rscc_wakeup_sequence(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = gen7_gmu_load_fw(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	gen7_gmu_register_config(adreno_dev);
+
+	gen7_gmu_irq_enable(adreno_dev);
+
+	ret = gen7_gmu_device_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_gmu_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	device->gmu_fault = false;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return 0;
+
+err:
+	gen7_gmu_irq_disable(adreno_dev);
+
+	if (device->gmu_fault) {
+		gen7_gmu_suspend(adreno_dev);
+		return ret;
+	}
+
+clks_gdsc_off:
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+gdsc_off:
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	gen7_rdpm_cx_freq_update(gmu, 0);
+
+	return ret;
+}
+
+static void set_acd(struct adreno_device *adreno_dev, void *priv)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	adreno_dev->acd_enabled = *((bool *)priv);
+	gen7_gmu_aop_send_acd_state(gmu, adreno_dev->acd_enabled);
+}
+
+static int gen7_gmu_acd_set(struct kgsl_device *device, bool val)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (!gmu->qmp && !gmu->mailbox.channel)
+		return -EINVAL;
+
+	/* Don't do any unneeded work if ACD is already in the correct state */
+	if (adreno_dev->acd_enabled == val)
+		return 0;
+
+	/* Power cycle the GPU for changes to take effect */
+	return adreno_power_cycle(adreno_dev, set_acd, &val);
+}
+
+#define BCL_RESP_TYPE_MASK   BIT(0)
+#define BCL_SID0_MASK        GENMASK(7, 1)
+#define BCL_SID1_MASK        GENMASK(14, 8)
+#define BCL_SID2_MASK        GENMASK(21, 15)
+
+static int gen7_bcl_sid_set(struct kgsl_device *device, u32 sid_id, u64 sid_val)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	u32 bcl_data, val = (u32) sid_val;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_BCL) ||
+		!FIELD_GET(BCL_RESP_TYPE_MASK, adreno_dev->bcl_data))
+		return -EINVAL;
+
+	switch (sid_id) {
+		case 0:
+			adreno_dev->bcl_data &= ~BCL_SID0_MASK;
+			bcl_data = adreno_dev->bcl_data | FIELD_PREP(BCL_SID0_MASK, val);
+			break;
+		case 1:
+			adreno_dev->bcl_data &= ~BCL_SID1_MASK;
+			bcl_data = adreno_dev->bcl_data | FIELD_PREP(BCL_SID1_MASK, val);
+			break;
+		case 2:
+			adreno_dev->bcl_data &= ~BCL_SID2_MASK;
+			bcl_data = adreno_dev->bcl_data | FIELD_PREP(BCL_SID2_MASK, val);
+			break;
+		default:
+			return -EINVAL;
+	}
+
+	return adreno_power_cycle_u32(adreno_dev, &adreno_dev->bcl_data, bcl_data);
+}
+
+static u64 gen7_bcl_sid_get(struct kgsl_device *device, u32 sid_id)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_BCL) ||
+		!FIELD_GET(BCL_RESP_TYPE_MASK, adreno_dev->bcl_data))
+		return 0;
+
+	switch (sid_id) {
+		case 0:
+			return ((u64) FIELD_GET(BCL_SID0_MASK, adreno_dev->bcl_data));
+		case 1:
+			return ((u64) FIELD_GET(BCL_SID1_MASK, adreno_dev->bcl_data));
+		case 2:
+			return ((u64) FIELD_GET(BCL_SID2_MASK, adreno_dev->bcl_data));
+		default:
+			return 0;
+	}
+}
+
+static const struct gmu_dev_ops gen7_gmudev = {
+	.oob_set = gen7_gmu_oob_set,
+	.oob_clear = gen7_gmu_oob_clear,
+	.ifpc_store = gen7_gmu_ifpc_store,
+	.ifpc_isenabled = gen7_gmu_ifpc_isenabled,
+	.cooperative_reset = gen7_gmu_cooperative_reset,
+	.wait_for_active_transition = gen7_gmu_wait_for_active_transition,
+	.scales_bandwidth = gen7_gmu_scales_bandwidth,
+	.acd_set = gen7_gmu_acd_set,
+	.bcl_sid_set = gen7_bcl_sid_set,
+	.bcl_sid_get = gen7_bcl_sid_get,
+	.send_nmi = gen7_gmu_send_nmi,
+};
+
+static int gen7_gmu_bus_set(struct adreno_device *adreno_dev, int buslevel,
+	u32 ab)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret = 0;
+
+	/* Target gen7_9_x votes for perfmode through ACV. Skip icc path for same */
+	if (!adreno_is_gen7_9_x(adreno_dev))
+		kgsl_icc_set_tag(pwr, buslevel);
+
+	if (buslevel == pwr->cur_buslevel)
+		buslevel = INVALID_DCVS_IDX;
+
+	if ((ab == pwr->cur_ab) || (ab == 0))
+		ab = INVALID_AB_VALUE;
+
+	if ((ab == INVALID_AB_VALUE) && (buslevel == INVALID_DCVS_IDX))
+		return 0;
+
+	ret = gen7_gmu_dcvs_set(adreno_dev, INVALID_DCVS_IDX,
+			buslevel, ab);
+	if (ret)
+		return ret;
+
+	if (buslevel != INVALID_DCVS_IDX)
+		pwr->cur_buslevel = buslevel;
+
+	if (ab != INVALID_AB_VALUE) {
+		if (!adreno_dev->gmu_ab)
+			icc_set_bw(pwr->icc_path, MBps_to_icc(ab), 0);
+		pwr->cur_ab = ab;
+	}
+
+	trace_kgsl_buslevel(device, pwr->active_pwrlevel, buslevel, ab);
+	return ret;
+}
+
+#define NUM_CHANNELS 4
+
+u32 gen7_bus_ab_quantize(struct adreno_device *adreno_dev, u32 ab)
+{
+	u16 vote = 0;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	if (!adreno_dev->gmu_ab || (ab == INVALID_AB_VALUE))
+		return (FIELD_PREP(GENMASK(31, 16), INVALID_AB_VALUE));
+
+	if (pwr->ddr_table[pwr->ddr_table_count - 1]) {
+		/*
+		 * if ab is calculated as higher than theoretical max bandwidth, set ab as
+		 * theoretical max to prevent truncation during quantization.
+		 *
+		 * max ddr bandwidth (kbps) = (Max bw in kbps per channel * number of channel)
+		 * max ab (Mbps) = max ddr bandwidth (kbps) / 1000
+		 */
+		u32 max_bw = pwr->ddr_table[pwr->ddr_table_count - 1] * NUM_CHANNELS;
+		u32 max_ab = max_bw / 1000;
+
+		ab = min_t(u32, ab, max_ab);
+
+		/*
+		 * Power FW supports a 16 bit AB BW level. We can quantize the entire vote-able BW
+		 * range to a 16 bit space and the quantized value can be used to vote for AB though
+		 * GMU. Quantization can be performed as below.
+		 *
+		 * quantized_vote = (ab vote (kbps) * 2^16) / max ddr bandwidth (kbps)
+		 */
+		vote = (u16)(((u64)ab * 1000 * (1 << 16)) / max_bw);
+	}
+
+	/*
+	 * Set ab enable mask and valid AB vote. req.bw is 32 bit value 0xABABENIB
+	 * and with this return we want to set the upper 16 bits and EN field specifies
+	 * if the AB vote is valid or not.
+	 */
+	return (FIELD_PREP(GENMASK(31, 16), vote) | FIELD_PREP(GENMASK(15, 8), 1));
+}
+
+static void gen7_free_gmu_globals(struct gen7_gmu_device *gmu)
+{
+	int i;
+
+	for (i = 0; i < gmu->global_entries && i < ARRAY_SIZE(gmu->gmu_globals); i++) {
+		struct kgsl_memdesc *md = &gmu->gmu_globals[i];
+
+		if (!md->gmuaddr)
+			continue;
+
+		iommu_unmap(gmu->domain, md->gmuaddr, md->size);
+
+		if (md->priv & KGSL_MEMDESC_SYSMEM)
+			kgsl_sharedmem_free(md);
+
+		memset(md, 0, sizeof(*md));
+	}
+
+	if (gmu->domain) {
+		iommu_detach_device(gmu->domain, &gmu->pdev->dev);
+		iommu_domain_free(gmu->domain);
+		gmu->domain = NULL;
+	}
+
+	gmu->global_entries = 0;
+}
+
+static int gen7_gmu_aop_messaging_init(struct adreno_device *adreno_dev,
+		struct gen7_gmu_device *gmu)
+{
+	struct kgsl_mailbox *mailbox = &gmu->mailbox;
+	int ret;
+
+	if (of_find_property(gmu->pdev->dev.of_node, "qcom,qmp", NULL)) {
+		gmu->qmp = qmp_get(&gmu->pdev->dev);
+		ret = PTR_ERR_OR_ZERO(gmu->qmp);
+		if (ret) {
+			gmu->qmp = NULL;
+			return ret;
+		}
+		goto done;
+	}
+
+	mailbox->client.dev = &gmu->pdev->dev;
+	mailbox->client.tx_block = true;
+	mailbox->client.tx_tout = 1000;
+	mailbox->client.knows_txdone = false;
+
+	mailbox->channel = mbox_request_channel(&mailbox->client, 0);
+	ret = PTR_ERR_OR_ZERO(mailbox->channel);
+	if (ret) {
+		mailbox->channel = NULL;
+		return ret;
+	}
+
+done:
+	adreno_dev->acd_enabled = true;
+
+	return 0;
+}
+
+static int gen7_gmu_acd_probe(struct kgsl_device *device,
+		struct gen7_gmu_device *gmu, struct device_node *node)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct kgsl_pwrlevel *pwrlevel =
+			&pwr->pwrlevels[pwr->num_pwrlevels - 1];
+	struct hfi_acd_table_cmd *cmd = &gmu->hfi.acd_table;
+	int ret, i, cmd_idx = 0;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_ACD))
+		return 0;
+
+	cmd->hdr = CREATE_MSG_HDR(H2F_MSG_ACD_TBL, HFI_MSG_CMD);
+
+	cmd->version = 1;
+	cmd->stride = 1;
+	cmd->enable_by_level = 0;
+
+	/*
+	 * Iterate through each gpu power level and generate a mask for GMU
+	 * firmware for ACD enabled levels and store the corresponding control
+	 * register configurations to the acd_table structure.
+	 */
+	for (i = 0; i < pwr->num_pwrlevels; i++) {
+		if (pwrlevel->acd_level) {
+			cmd->enable_by_level |= (1 << (i + 1));
+			cmd->data[cmd_idx++] = pwrlevel->acd_level;
+		}
+		pwrlevel--;
+	}
+
+	if (!cmd->enable_by_level)
+		return 0;
+
+	cmd->num_levels = cmd_idx;
+
+	ret = gen7_gmu_aop_messaging_init(adreno_dev, gmu);
+
+	if (ret)
+		dev_err_probe(&gmu->pdev->dev, ret,
+				"AOP messaging init failed: %d\n");
+
+	return ret == -EPROBE_DEFER ? ret: 0;
+}
+
+static int gen7_gmu_reg_probe(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	ret = kgsl_regmap_add_region(&device->regmap, gmu->pdev, "gmu", NULL, NULL);
+
+	if (ret)
+		dev_err(&gmu->pdev->dev, "Unable to map the GMU registers\n");
+	/*
+	 * gmu_ao_blk_dec1 and gmu_ao_blk_dec2 are contiguous and contained within the gmu region
+	 * mapped above. gmu_ao_blk_dec0 is not within the gmu region and is mapped separately.
+	 */
+	kgsl_regmap_add_region(&device->regmap, gmu->pdev, "gmu_ao_blk_dec0", NULL, NULL);
+
+	return ret;
+}
+
+static int gen7_gmu_clk_probe(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret, i;
+	int tbl_size;
+	int num_freqs;
+	int offset;
+
+	ret = devm_clk_bulk_get_all(&gmu->pdev->dev, &gmu->clks);
+	if (ret < 0)
+		return ret;
+
+	/*
+	 * Voting for apb_pclk will enable power and clocks required for
+	 * QDSS path to function. However, if QCOM_KGSL_QDSS_STM is not enabled,
+	 * QDSS is essentially unusable. Hence, if QDSS cannot be used,
+	 * don't vote for this clock.
+	 */
+	if (!IS_ENABLED(CONFIG_QCOM_KGSL_QDSS_STM)) {
+		for (i = 0; i < ret; i++) {
+			if (!strcmp(gmu->clks[i].id, "apb_pclk")) {
+				gmu->clks[i].clk = NULL;
+				break;
+			}
+		}
+	}
+
+	gmu->num_clks = ret;
+
+	/* Read the optional list of GMU frequencies */
+	if (of_get_property(gmu->pdev->dev.of_node,
+		"qcom,gmu-freq-table", &tbl_size) == NULL)
+		goto default_gmu_freq;
+
+	num_freqs = (tbl_size / sizeof(u32)) / 2;
+	if (num_freqs != ARRAY_SIZE(gmu->freqs))
+		goto default_gmu_freq;
+
+	for (i = 0; i < num_freqs; i++) {
+		offset = i * 2;
+		ret = of_property_read_u32_index(gmu->pdev->dev.of_node,
+			"qcom,gmu-freq-table", offset, &gmu->freqs[i]);
+		if (ret)
+			goto default_gmu_freq;
+		ret = of_property_read_u32_index(gmu->pdev->dev.of_node,
+			"qcom,gmu-freq-table", offset + 1, &gmu->vlvls[i]);
+		if (ret)
+			goto default_gmu_freq;
+	}
+	return 0;
+
+default_gmu_freq:
+	/* The GMU frequency table is missing or invalid. Go with a default */
+	gmu->freqs[0] = GMU_FREQ_MIN;
+	gmu->vlvls[0] = RPMH_REGULATOR_LEVEL_LOW_SVS;
+	gmu->freqs[1] = GMU_FREQ_MAX;
+	gmu->vlvls[1] = RPMH_REGULATOR_LEVEL_SVS;
+
+	return 0;
+}
+
+static void gen7_gmu_rdpm_probe(struct gen7_gmu_device *gmu,
+		struct kgsl_device *device)
+{
+	struct resource *res;
+
+	res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM, "rdpm_cx");
+	if (res)
+		gmu->rdpm_cx_virt = devm_ioremap(&device->pdev->dev,
+				res->start, resource_size(res));
+
+	res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM, "rdpm_mx");
+	if (res)
+		gmu->rdpm_mx_virt = devm_ioremap(&device->pdev->dev,
+				res->start, resource_size(res));
+}
+
+void gen7_gmu_remove(struct kgsl_device *device)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (gmu->qmp)
+		qmp_put(gmu->qmp);
+
+	if (gmu->mailbox.channel)
+		mbox_free_channel(gmu->mailbox.channel);
+
+	adreno_dev->acd_enabled = false;
+
+	if (gmu->fw_image)
+		release_firmware(gmu->fw_image);
+
+	gen7_free_gmu_globals(gmu);
+
+	vfree(gmu->itcm_shadow);
+	if (gmu->log_kobj.state_initialized)
+		kobject_put(&gmu->log_kobj);
+	if (gmu->stats_kobj.state_initialized)
+		kobject_put(&gmu->stats_kobj);
+}
+
+static int gen7_gmu_iommu_fault_handler(struct iommu_domain *domain,
+		struct device *dev, unsigned long addr, int flags, void *token)
+{
+	char *fault_type = "unknown";
+
+	if (flags & IOMMU_FAULT_TRANSLATION)
+		fault_type = "translation";
+	else if (flags & IOMMU_FAULT_PERMISSION)
+		fault_type = "permission";
+	else if (flags & IOMMU_FAULT_EXTERNAL)
+		fault_type = "external";
+	else if (flags & IOMMU_FAULT_TRANSACTION_STALLED)
+		fault_type = "transaction stalled";
+
+	dev_err(dev, "GMU fault addr = %lX, context=kernel (%s %s fault)\n",
+			addr,
+			(flags & IOMMU_FAULT_WRITE) ? "write" : "read",
+			fault_type);
+
+	return 0;
+}
+
+static int gen7_gmu_iommu_init(struct gen7_gmu_device *gmu)
+{
+	int ret;
+
+	gmu->domain = iommu_domain_alloc(&platform_bus_type);
+	if (gmu->domain == NULL) {
+		dev_err(&gmu->pdev->dev, "Unable to allocate GMU IOMMU domain\n");
+		return -ENODEV;
+	}
+
+	/*
+	 * Disable stall on fault for the GMU context bank.
+	 * This sets SCTLR.CFCFG = 0.
+	 * Also note that, the smmu driver sets SCTLR.HUPCF = 0 by default.
+	 */
+	qcom_iommu_set_fault_model(gmu->domain, QCOM_IOMMU_FAULT_MODEL_NO_STALL);
+
+	ret = iommu_attach_device(gmu->domain, &gmu->pdev->dev);
+	if (!ret) {
+		iommu_set_fault_handler(gmu->domain,
+			gen7_gmu_iommu_fault_handler, gmu);
+		return 0;
+	}
+
+	dev_err(&gmu->pdev->dev,
+		"Unable to attach GMU IOMMU domain: %d\n", ret);
+	iommu_domain_free(gmu->domain);
+	gmu->domain = NULL;
+
+	return ret;
+}
+
+/* Default IFPC timer (300usec) value */
+#define GEN7_GMU_LONG_IFPC_HYST	FIELD_PREP(GENMASK(15, 0), 0x1680)
+
+/* Minimum IFPC timer (200usec) allowed to override default value */
+#define GEN7_GMU_LONG_IFPC_HYST_FLOOR	FIELD_PREP(GENMASK(15, 0), 0x0F00)
+
+int gen7_gmu_probe(struct kgsl_device *device,
+		struct platform_device *pdev)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct device *dev = &pdev->dev;
+	struct resource *res;
+	int ret, i;
+
+	gmu->pdev = pdev;
+
+	dma_set_coherent_mask(&gmu->pdev->dev, DMA_BIT_MASK(64));
+	gmu->pdev->dev.dma_mask = &gmu->pdev->dev.coherent_dma_mask;
+	set_dma_ops(&gmu->pdev->dev, NULL);
+
+	res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM,
+						"rscc");
+	if (res) {
+		gmu->rscc_virt = devm_ioremap(&device->pdev->dev, res->start,
+						resource_size(res));
+		if (!gmu->rscc_virt) {
+			dev_err(&gmu->pdev->dev, "rscc ioremap failed\n");
+			return -ENOMEM;
+		}
+	}
+
+	/* Setup any rdpm register ranges */
+	gen7_gmu_rdpm_probe(gmu, device);
+
+	/* Set up GMU gdscs */
+	ret = kgsl_pwrctrl_probe_gdscs(device, pdev);
+	if (ret)
+		return ret;
+
+	ret = gen7_gmu_clk_probe(adreno_dev);
+	if (ret)
+		return ret;
+
+	/* Set up GMU IOMMU and shared memory with GMU */
+	ret = gen7_gmu_iommu_init(gmu);
+	if (ret)
+		goto error;
+
+	gmu->vma = gen7_gmu_vma;
+	for (i = 0; i < ARRAY_SIZE(gen7_gmu_vma); i++) {
+		struct gmu_vma_entry *vma = &gen7_gmu_vma[i];
+
+		vma->vma_root = RB_ROOT;
+		spin_lock_init(&vma->lock);
+	}
+
+	/* Map and reserve GMU CSRs registers */
+	ret = gen7_gmu_reg_probe(adreno_dev);
+	if (ret)
+		goto error;
+
+	/* Populates RPMh configurations */
+	ret = gen7_build_rpmh_tables(adreno_dev);
+	if (ret)
+		goto error;
+
+	/* Set up GMU idle state */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_IFPC)) {
+		gmu->idle_level = GPU_HW_IFPC;
+		adreno_dev->ifpc_hyst = GEN7_GMU_LONG_IFPC_HYST;
+		adreno_dev->ifpc_hyst_floor = GEN7_GMU_LONG_IFPC_HYST_FLOOR;
+	} else {
+		gmu->idle_level = GPU_HW_ACTIVE;
+	}
+
+	ret = gen7_gmu_acd_probe(device, gmu, pdev->dev.of_node);
+	if (ret)
+		goto error;
+
+	set_bit(GMU_ENABLED, &device->gmu_core.flags);
+
+	device->gmu_core.dev_ops = &gen7_gmudev;
+
+	/* Set default GMU attributes */
+	gmu->log_stream_enable = false;
+	gmu->log_group_mask = 0x3;
+
+	/* Initialize to zero to detect trace packet loss */
+	gmu->trace.seq_num = 0;
+
+	/* Disabled by default */
+	gmu->stats_enable = false;
+	/* Set default to CM3 busy cycles countable */
+	gmu->stats_mask = BIT(GEN7_GMU_CM3_BUSY_CYCLES);
+	/* Interval is in 50 us units. Set default sampling frequency to 4x50 us */
+	gmu->stats_interval = HFI_FEATURE_GMU_STATS_INTERVAL;
+
+	/* GMU sysfs nodes setup */
+	(void) kobject_init_and_add(&gmu->log_kobj, &log_kobj_type, &dev->kobj, "log");
+	(void) kobject_init_and_add(&gmu->stats_kobj, &stats_kobj_type, &dev->kobj, "stats");
+
+	of_property_read_u32(gmu->pdev->dev.of_node, "qcom,gmu-perf-ddr-bw",
+		&gmu->perf_ddr_bw);
+
+	spin_lock_init(&gmu->hfi.cmdq_lock);
+
+	gmu->irq = kgsl_request_irq(gmu->pdev, "gmu",
+		gen7_gmu_irq_handler, device);
+
+	if (gmu->irq >= 0)
+		return 0;
+
+	ret = gmu->irq;
+
+error:
+	gen7_gmu_remove(device);
+	return ret;
+}
+
+static void gen7_gmu_active_count_put(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (WARN(atomic_read(&device->active_cnt) == 0,
+		"Unbalanced get/put calls to KGSL active count\n"))
+		return;
+
+	if (atomic_dec_and_test(&device->active_cnt)) {
+		kgsl_pwrscale_update_stats(device);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+	}
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	wake_up(&device->active_cnt_wq);
+}
+
+int gen7_halt_gbif(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/* Halt new client requests */
+	kgsl_regwrite(device, GEN7_GBIF_HALT, GEN7_GBIF_CLIENT_HALT_MASK);
+	ret = adreno_wait_for_halt_ack(device,
+		GEN7_GBIF_HALT_ACK, GEN7_GBIF_CLIENT_HALT_MASK);
+
+	/* Halt all AXI requests */
+	kgsl_regwrite(device, GEN7_GBIF_HALT, GEN7_GBIF_ARB_HALT_MASK);
+	ret = adreno_wait_for_halt_ack(device,
+		GEN7_GBIF_HALT_ACK, GEN7_GBIF_ARB_HALT_MASK);
+
+	/* De-assert the halts */
+	kgsl_regwrite(device, GEN7_GBIF_HALT, 0x0);
+
+	return ret;
+}
+
+static int gen7_gmu_power_off(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = 0;
+
+	if (device->gmu_fault)
+		goto error;
+
+	/* Wait for the lowest idle level we requested */
+	ret = gen7_gmu_wait_for_lowest_idle(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = gen7_complete_rpmh_votes(gmu, 2);
+	if (ret)
+		goto error;
+
+	ret = gen7_gmu_notify_slumber(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = gen7_gmu_wait_for_idle(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = gen7_rscc_sleep_sequence(adreno_dev);
+	if (ret)
+		goto error;
+
+	gen7_rdpm_mx_freq_update(gmu, 0);
+
+	/* Now that we are done with GMU and GPU, Clear the GBIF */
+	ret = gen7_halt_gbif(adreno_dev);
+	if (ret)
+		goto error;
+
+	gen7_gmu_irq_disable(adreno_dev);
+
+	gen7_hfi_stop(adreno_dev);
+
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	gen7_rdpm_cx_freq_update(gmu, 0);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_NONE);
+
+	return 0;
+
+error:
+	gen7_gmu_irq_disable(adreno_dev);
+	gen7_hfi_stop(adreno_dev);
+	gen7_gmu_suspend(adreno_dev);
+
+	return ret;
+}
+
+void gen7_enable_gpu_irq(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	kgsl_pwrctrl_irq(device, true);
+
+	adreno_irqctrl(adreno_dev, 1);
+}
+
+void gen7_disable_gpu_irq(struct adreno_device *adreno_dev)
+{
+	kgsl_pwrctrl_irq(KGSL_DEVICE(adreno_dev), false);
+
+	if (gen7_gmu_gx_is_on(adreno_dev))
+		adreno_irqctrl(adreno_dev, 0);
+}
+
+static int gen7_gpu_boot(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/* Clear any GPU faults that might have been left over */
+	adreno_clear_gpu_fault(adreno_dev);
+
+	adreno_set_active_ctxs_null(adreno_dev);
+
+	ret = kgsl_mmu_start(device);
+	if (ret)
+		goto err;
+
+	ret = gen7_gmu_oob_set(device, oob_gpu);
+	if (ret)
+		goto oob_clear;
+
+	ret = gen7_gmu_hfi_start_msg(adreno_dev);
+	if (ret)
+		goto oob_clear;
+
+	/* Clear the busy_data stats - we're starting over from scratch */
+	memset(&adreno_dev->busy_data, 0, sizeof(adreno_dev->busy_data));
+
+	gen7_start(adreno_dev);
+
+	if (gen7_core->qos_value && adreno_is_preemption_enabled(adreno_dev))
+		kgsl_regwrite(device, GEN7_RBBM_GBIF_CLIENT_QOS_CNTL,
+			gen7_core->qos_value[adreno_dev->cur_rb->id]);
+
+	/* Re-initialize the coresight registers if applicable */
+	adreno_coresight_start(adreno_dev);
+
+	adreno_perfcounter_start(adreno_dev);
+
+	/* Clear FSR here in case it is set from a previous pagefault */
+	kgsl_mmu_clear_fsr(&device->mmu);
+
+	gen7_enable_gpu_irq(adreno_dev);
+
+	ret = gen7_rb_start(adreno_dev);
+	if (ret) {
+		gen7_disable_gpu_irq(adreno_dev);
+		goto oob_clear;
+	}
+
+	/*
+	 * At this point it is safe to assume that we recovered. Setting
+	 * this field allows us to take a new snapshot for the next failure
+	 * if we are prioritizing the first unrecoverable snapshot.
+	 */
+	if (device->snapshot)
+		device->snapshot->recovered = true;
+
+	/* Start the dispatcher */
+	adreno_dispatcher_start(device);
+
+	device->reset_counter++;
+
+	gen7_gmu_oob_clear(device, oob_gpu);
+
+	return 0;
+
+oob_clear:
+	gen7_gmu_oob_clear(device, oob_gpu);
+
+err:
+	gen7_gmu_power_off(adreno_dev);
+
+	return ret;
+}
+
+static void gmu_idle_timer(struct timer_list *t)
+{
+	struct kgsl_device *device = container_of(t, struct kgsl_device,
+					idle_timer);
+
+	kgsl_schedule_work(&device->idle_check_ws);
+}
+
+static int gen7_boot(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (WARN_ON(test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags)))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = gen7_gmu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_start_idle_timer(device);
+	kgsl_pwrscale_wake(device);
+
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	return ret;
+}
+
+static int gen7_first_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags)) {
+		if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+			return gen7_boot(adreno_dev);
+
+		return 0;
+	}
+
+	ret = gen7_ringbuffer_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_microcode_read(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_gmu_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = gen7_gmu_first_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	adreno_get_bus_counters(adreno_dev);
+
+	adreno_dev->cooperative_reset = ADRENO_FEATURE(adreno_dev,
+						 ADRENO_COOP_RESET);
+
+	adreno_create_profile_buffer(adreno_dev);
+
+	set_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags);
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	/*
+	 * BCL needs respective Central Broadcast register to
+	 * be programed from TZ. For kernel version prior to 6.1, this
+	 * programing happens only when zap shader firmware load is successful.
+	 * Zap firmware load can fail in boot up path hence enable BCL only
+	 * after we successfully complete first boot to ensure that Central
+	 * Broadcast register was programed before enabling BCL.
+	 */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_BCL))
+		adreno_dev->bcl_enabled = true;
+
+	/*
+	 * There is a possible deadlock scenario during kgsl firmware reading
+	 * (request_firmware) and devfreq update calls. During first boot, kgsl
+	 * device mutex is held and then request_firmware is called for reading
+	 * firmware. request_firmware internally takes dev_pm_qos_mtx lock.
+	 * Whereas in case of devfreq update calls triggered by thermal/bcl or
+	 * devfreq sysfs, it first takes the same dev_pm_qos_mtx lock and then
+	 * tries to take kgsl device mutex as part of get_dev_status/target
+	 * calls. This results in deadlock when both thread are unable to acquire
+	 * the mutex held by other thread. Enable devfreq updates now as we are
+	 * done reading all firmware files.
+	 */
+	device->pwrscale.devfreq_enabled = true;
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	return 0;
+}
+
+static bool gen7_irq_pending(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 status;
+
+	kgsl_regread(device, GEN7_RBBM_INT_0_STATUS, &status);
+
+	/* Return busy if a interrupt is pending */
+	return ((status & adreno_dev->irq_mask) ||
+		atomic_read(&adreno_dev->pending_irq_refcnt));
+}
+
+static int gen7_power_off(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	WARN_ON(!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags));
+
+	adreno_suspend_context(device);
+
+	/*
+	 * adreno_suspend_context() unlocks the device mutex, which
+	 * could allow a concurrent thread to attempt SLUMBER sequence.
+	 * Hence, check the flags again before proceeding with SLUMBER.
+	 */
+	if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SLUMBER);
+
+	ret = gen7_gmu_oob_set(device, oob_gpu);
+	if (ret)
+		goto no_gx_power;
+
+	if (gen7_irq_pending(adreno_dev)) {
+		gen7_gmu_oob_clear(device, oob_gpu);
+		return -EBUSY;
+	}
+
+	kgsl_pwrscale_update_stats(device);
+
+	/* Save active coresight registers if applicable */
+	adreno_coresight_stop(adreno_dev);
+
+	adreno_irqctrl(adreno_dev, 0);
+
+no_gx_power:
+	gen7_gmu_oob_clear(device, oob_gpu);
+
+	kgsl_pwrctrl_irq(device, false);
+
+	gen7_gmu_power_off(adreno_dev);
+
+	adreno_set_active_ctxs_null(adreno_dev);
+
+	adreno_dispatcher_stop(adreno_dev);
+
+	adreno_ringbuffer_stop(adreno_dev);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpu_llc_slice);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpuhtw_llc_slice);
+
+	clear_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	del_timer_sync(&device->idle_timer);
+
+	kgsl_pwrscale_sleep(device);
+
+	kgsl_pwrctrl_clear_l3_vote(device);
+
+	/*
+	 * Reset the context records so that CP can start
+	 * at the correct read pointer for BV thread after
+	 * coming out of slumber.
+	 */
+	gen7_reset_preempt_records(adreno_dev);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SLUMBER);
+
+	return ret;
+}
+
+static void gmu_idle_check(struct work_struct *work)
+{
+	struct kgsl_device *device = container_of(work,
+					struct kgsl_device, idle_check_ws);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	mutex_lock(&device->mutex);
+
+	if (test_bit(GMU_DISABLE_SLUMBER, &device->gmu_core.flags))
+		goto done;
+
+	if (atomic_read(&device->active_cnt) || time_is_after_jiffies(device->idle_jiffies)) {
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		goto done;
+
+	spin_lock(&device->submit_lock);
+
+	if (device->submit_now) {
+		spin_unlock(&device->submit_lock);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	device->skip_inline_submit = true;
+	spin_unlock(&device->submit_lock);
+
+	ret = gen7_power_off(adreno_dev);
+	if (ret == -EBUSY) {
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+	}
+
+done:
+	mutex_unlock(&device->mutex);
+}
+
+static int gen7_gmu_first_open(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/*
+	 * Do the one time settings that need to happen when we
+	 * attempt to boot the gpu the very first time
+	 */
+	ret = gen7_first_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	/*
+	 * A client that does a first_open but never closes the device
+	 * may prevent us from going back to SLUMBER. So trigger the idle
+	 * check by incrementing the active count and immediately releasing it.
+	 */
+	atomic_inc(&device->active_cnt);
+	gen7_gmu_active_count_put(adreno_dev);
+
+	return 0;
+}
+
+static int gen7_gmu_last_close(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return gen7_power_off(adreno_dev);
+
+	return 0;
+}
+
+static int gen7_gmu_active_count_get(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EINVAL;
+
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags))
+		return -EINVAL;
+
+	if ((atomic_read(&device->active_cnt) == 0) &&
+		!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		ret = gen7_boot(adreno_dev);
+
+	if (ret == 0)
+		atomic_inc(&device->active_cnt);
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	return ret;
+}
+
+static int gen7_gmu_pm_suspend(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SUSPEND);
+
+	/* Halt any new submissions */
+	reinit_completion(&device->halt_gate);
+
+	/* wait for active count so device can be put in slumber */
+	ret = kgsl_active_count_wait(device, 0, HZ);
+	if (ret) {
+		dev_err(device->dev,
+			"Timed out waiting for the active count\n");
+		goto err;
+	}
+
+	ret = adreno_idle(device);
+	if (ret)
+		goto err;
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		gen7_power_off(adreno_dev);
+
+	set_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags);
+
+	adreno_get_gpu_halt(adreno_dev);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SUSPEND);
+
+	return 0;
+err:
+	adreno_dispatcher_start(device);
+	return ret;
+}
+
+static void gen7_gmu_pm_resume(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (WARN(!test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags),
+		"resume invoked without a suspend\n"))
+		return;
+
+	adreno_put_gpu_halt(adreno_dev);
+
+	adreno_dispatcher_start(device);
+
+	clear_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags);
+}
+
+static void gen7_gmu_touch_wakeup(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	/*
+	 * Do not wake up a suspended device or until the first boot sequence
+	 * has been completed.
+	 */
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags) ||
+		!test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags))
+		return;
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		goto done;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = gen7_gmu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	ret = gen7_gpu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	kgsl_pwrscale_wake(device);
+
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+done:
+	/*
+	 * When waking up from a touch event we want to stay active long enough
+	 * for the user to send a draw command. The default idle timer timeout
+	 * is shorter than we want so go ahead and push the idle timer out
+	 * further for this special case
+	 */
+	mod_timer(&device->idle_timer, jiffies +
+			msecs_to_jiffies(adreno_wake_timeout));
+}
+
+const struct adreno_power_ops gen7_gmu_power_ops = {
+	.first_open = gen7_gmu_first_open,
+	.last_close = gen7_gmu_last_close,
+	.active_count_get = gen7_gmu_active_count_get,
+	.active_count_put = gen7_gmu_active_count_put,
+	.pm_suspend = gen7_gmu_pm_suspend,
+	.pm_resume = gen7_gmu_pm_resume,
+	.touch_wakeup = gen7_gmu_touch_wakeup,
+	.gpu_clock_set = gen7_gmu_clock_set,
+	.gpu_bus_set = gen7_gmu_bus_set,
+};
+
+int gen7_gmu_device_probe(struct platform_device *pdev,
+	u32 chipid, const struct adreno_gpu_core *gpucore)
+{
+	struct adreno_device *adreno_dev;
+	struct kgsl_device *device;
+	struct gen7_device *gen7_dev;
+	int ret;
+
+	gen7_dev = devm_kzalloc(&pdev->dev, sizeof(*gen7_dev),
+			GFP_KERNEL);
+	if (!gen7_dev)
+		return -ENOMEM;
+
+	adreno_dev = &gen7_dev->adreno_dev;
+
+	ret = gen7_probe_common(pdev, adreno_dev, chipid, gpucore);
+	if (ret)
+		return ret;
+
+	ret = adreno_dispatcher_init(adreno_dev);
+	if (ret) {
+		dev_err(&pdev->dev, "adreno dispatcher init failed ret %d\n", ret);
+		return ret;
+	}
+
+	device = KGSL_DEVICE(adreno_dev);
+
+	INIT_WORK(&device->idle_check_ws, gmu_idle_check);
+
+	timer_setup(&device->idle_timer, gmu_idle_timer, 0);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_DMS)) {
+		set_bit(ADRENO_DEVICE_DMS, &adreno_dev->priv);
+		adreno_dev->dms_enabled = true;
+	}
+
+	adreno_dev->irq_mask = GEN7_INT_MASK;
+
+	return 0;
+}
+
+int gen7_gmu_reset(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	gen7_disable_gpu_irq(adreno_dev);
+
+	gen7_gmu_irq_disable(adreno_dev);
+
+	gen7_hfi_stop(adreno_dev);
+
+	/* Hard reset the gmu and gpu */
+	gen7_gmu_suspend(adreno_dev);
+
+	gen7_reset_preempt_records(adreno_dev);
+
+	clear_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	/* Attempt to reboot the gmu and gpu */
+	return gen7_boot(adreno_dev);
+}
+
+int gen7_gmu_hfi_probe(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hfi *hfi = &gmu->hfi;
+
+	hfi->irq = kgsl_request_irq(gmu->pdev, "hfi",
+		gen7_hfi_irq_handler, KGSL_DEVICE(adreno_dev));
+
+	return hfi->irq < 0 ? hfi->irq : 0;
+}
+
+int gen7_gmu_add_to_minidump(struct adreno_device *adreno_dev)
+{
+	struct gen7_device *gen7_dev = container_of(adreno_dev,
+					struct gen7_device, adreno_dev);
+	int ret;
+
+	ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_GEN7_DEVICE,
+			(void *)(gen7_dev), sizeof(struct gen7_device));
+	if (ret)
+		return ret;
+
+	ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_GMU_LOG_ENTRY,
+			gen7_dev->gmu.gmu_log->hostptr, gen7_dev->gmu.gmu_log->size);
+	if (ret)
+		return ret;
+
+	ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_HFIMEM_ENTRY,
+			gen7_dev->gmu.hfi.hfi_mem->hostptr, gen7_dev->gmu.hfi.hfi_mem->size);
+
+	return ret;
+}
+
+static int gen7_gmu_bind(struct device *dev, struct device *master, void *data)
+{
+	struct kgsl_device *device = dev_get_drvdata(master);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	const struct gen7_gpudev *gen7_gpudev = to_gen7_gpudev(gpudev);
+	int ret;
+
+	ret = gen7_gmu_probe(device, to_platform_device(dev));
+	if (ret)
+		return ret;
+
+	if (gen7_gpudev->hfi_probe) {
+		ret = gen7_gpudev->hfi_probe(adreno_dev);
+
+		if (ret) {
+			gen7_gmu_remove(device);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+static void gen7_gmu_unbind(struct device *dev, struct device *master,
+		void *data)
+{
+	struct kgsl_device *device = dev_get_drvdata(master);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	const struct gen7_gpudev *gen7_gpudev = to_gen7_gpudev(gpudev);
+
+	if (gen7_gpudev->hfi_remove)
+		gen7_gpudev->hfi_remove(adreno_dev);
+
+	gen7_gmu_remove(device);
+}
+
+static const struct component_ops gen7_gmu_component_ops = {
+	.bind = gen7_gmu_bind,
+	.unbind = gen7_gmu_unbind,
+};
+
+static int gen7_gmu_probe_dev(struct platform_device *pdev)
+{
+	return component_add(&pdev->dev, &gen7_gmu_component_ops);
+}
+
+static int gen7_gmu_remove_dev(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &gen7_gmu_component_ops);
+	return 0;
+}
+
+static const struct of_device_id gen7_gmu_match_table[] = {
+	{ .compatible = "qcom,gen7-gmu" },
+	{ },
+};
+
+struct platform_driver gen7_gmu_driver = {
+	.probe = gen7_gmu_probe_dev,
+	.remove = gen7_gmu_remove_dev,
+	.driver = {
+		.name = "adreno-gen7-gmu",
+		.of_match_table = gen7_gmu_match_table,
+	},
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_gmu.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_gmu.h
@@ -0,0 +1,513 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_GEN7_GMU_H
+#define __ADRENO_GEN7_GMU_H
+
+#include <linux/mailbox_client.h>
+#include <linux/soc/qcom/qcom_aoss.h>
+
+#include "adreno_gen7_hfi.h"
+#include "kgsl_gmu_core.h"
+
+struct gen7_dcvs_table {
+	u32 gpu_level_num;
+	u32 gmu_level_num;
+	struct opp_gx_desc gx_votes[MAX_GX_LEVELS];
+	struct opp_desc cx_votes[MAX_CX_LEVELS];
+};
+
+/**
+ * struct gen7_gmu_device - GMU device structure
+ * @ver: GMU Version information
+ * @irq: GMU interrupt number
+ * @fw_image: GMU FW image
+ * @hfi_mem: pointer to HFI shared memory
+ * @dump_mem: pointer to GMU debug dump memory
+ * @gmu_log: gmu event log memory
+ * @hfi: HFI controller
+ * @num_gpupwrlevels: number GPU frequencies in GPU freq table
+ * @num_bwlevel: number of GPU BW levels
+ * @num_cnocbwlevel: number CNOC BW levels
+ * @rpmh_votes: RPMh TCS command set for GPU, GMU voltage and bw scaling
+ * @clks: GPU subsystem clocks required for GMU functionality
+ * @wakeup_pwrlevel: GPU wake up power/DCVS level in case different
+ *  than default power level
+ * @idle_level: Minimal GPU idle power level
+ * @fault_count: GMU fault count
+ * @mailbox: Messages to AOP for ACD enable/disable go through this
+ * @log_wptr_retention: Store the log wptr offset on slumber
+ */
+struct gen7_gmu_device {
+	struct {
+		u32 core;
+		u32 core_dev;
+		u32 pwr;
+		u32 pwr_dev;
+		u32 hfi;
+	} ver;
+	struct platform_device *pdev;
+	int irq;
+	const struct firmware *fw_image;
+	struct kgsl_memdesc *dump_mem;
+	struct kgsl_memdesc *gmu_log;
+	/** @gmu_init_scratch: Memory to store the initial HFI messages */
+	struct kgsl_memdesc *gmu_init_scratch;
+	/** @gpu_boot_scratch: Memory to store the bootup HFI messages */
+	struct kgsl_memdesc *gpu_boot_scratch;
+	/** @vrb: GMU virtual register bank memory */
+	struct kgsl_memdesc *vrb;
+	/** @trace: gmu trace container */
+	struct kgsl_gmu_trace trace;
+	struct gen7_hfi hfi;
+	struct clk_bulk_data *clks;
+	/** @num_clks: Number of entries in the @clks array */
+	int num_clks;
+	unsigned int idle_level;
+	/** @freqs: Array of GMU frequencies */
+	u32 freqs[GMU_MAX_PWRLEVELS];
+	/** @vlvls: Array of GMU voltage levels */
+	u32 vlvls[GMU_MAX_PWRLEVELS];
+	/** @qmp: Pointer to qmp sturct used for AOP messages*/
+	struct qmp *qmp;
+	struct kgsl_mailbox mailbox;
+	/** @gmu_globals: Array to store gmu global buffers */
+	struct kgsl_memdesc gmu_globals[GMU_KERNEL_ENTRIES];
+	/** @global_entries: To keep track of number of gmu buffers */
+	u32 global_entries;
+	struct gmu_vma_entry *vma;
+	unsigned int log_wptr_retention;
+	/** @cm3_fault: whether gmu received a cm3 fault interrupt */
+	atomic_t cm3_fault;
+	/**
+	 * @itcm_shadow: Copy of the itcm block in firmware binary used for
+	 * snapshot
+	 */
+	void *itcm_shadow;
+	/** @flags: Internal gmu flags */
+	unsigned long flags;
+	/** @rscc_virt: Pointer where RSCC block is mapped */
+	void __iomem *rscc_virt;
+	/** @domain: IOMMU domain for the kernel context */
+	struct iommu_domain *domain;
+	/** @log_stream_enable: GMU log streaming enable. Disabled by default */
+	bool log_stream_enable;
+	/** @log_group_mask: Allows overriding default GMU log group mask */
+	u32 log_group_mask;
+	struct kobject log_kobj;
+	/*
+	 * @perf_ddr_bw: The lowest ddr bandwidth that puts CX at a corner at
+	 * which GMU can run at higher frequency.
+	 */
+	u32 perf_ddr_bw;
+	/** @rdpm_cx_virt: Pointer where the RDPM CX block is mapped */
+	void __iomem *rdpm_cx_virt;
+	/** @rdpm_mx_virt: Pointer where the RDPM MX block is mapped */
+	void __iomem *rdpm_mx_virt;
+	/** @num_oob_perfcntr: Number of active oob_perfcntr requests */
+	u32 num_oob_perfcntr;
+	/** @acd_debug_val: DVM value to calibrate ACD for a level */
+	u32 acd_debug_val;
+	/** @stats_enable: GMU stats feature enable */
+	bool stats_enable;
+	/** @stats_mask: GMU performance countables to enable */
+	u32 stats_mask;
+	/** @stats_interval: GMU performance counters sampling interval */
+	u32 stats_interval;
+	/** @stats_kobj: kernel object for GMU stats directory in sysfs */
+	struct kobject stats_kobj;
+	/** @cp_init_hdr: raw command header for cp_init */
+	u32 cp_init_hdr;
+	/** @switch_to_unsec_hdr: raw command header for switch to unsecure packet */
+	u32 switch_to_unsec_hdr;
+	/** @dcvs_table: Table for gpu dcvs levels */
+	struct gen7_dcvs_table dcvs_table;
+};
+
+/* Helper function to get to gen7 gmu device from adreno device */
+struct gen7_gmu_device *to_gen7_gmu(struct adreno_device *adreno_dev);
+
+/* Helper function to get to adreno device from gen7 gmu device */
+struct adreno_device *gen7_gmu_to_adreno(struct gen7_gmu_device *gmu);
+
+/**
+ * gen7_reserve_gmu_kernel_block() - Allocate a global gmu buffer
+ * @gmu: Pointer to the gen7 gmu device
+ * @addr: Desired gmu virtual address
+ * @size: Size of the buffer in bytes
+ * @vma_id: Target gmu vma where this buffer should be mapped
+ * @align: Alignment for the GMU VA and GMU mapping size
+ *
+ * This function allocates a global gmu buffer and maps it in
+ * the desired gmu vma
+ *
+ * Return: Pointer to the memory descriptor or error pointer on failure
+ */
+struct kgsl_memdesc *gen7_reserve_gmu_kernel_block(struct gen7_gmu_device *gmu,
+		u32 addr, u32 size, u32 vma_id, u32 align);
+
+/**
+ * gen7_reserve_gmu_kernel_block_fixed() - Maps phyical resource address to gmu
+ * @gmu: Pointer to the gen7 gmu device
+ * @addr: Desired gmu virtual address
+ * @size: Size of the buffer in bytes
+ * @vma_id: Target gmu vma where this buffer should be mapped
+ * @resource: Name of the resource to get the size and address to allocate
+ * @attrs: Attributes for the mapping
+ * @align: Alignment for the GMU VA and GMU mapping size
+ *
+ * This function maps the physcial resource address to desired gmu vma
+ *
+ * Return: Pointer to the memory descriptor or error pointer on failure
+ */
+struct kgsl_memdesc *gen7_reserve_gmu_kernel_block_fixed(struct gen7_gmu_device *gmu,
+	u32 addr, u32 size, u32 vma_id, const char *resource, int attrs, u32 align);
+
+/**
+ * gen7_alloc_gmu_kernel_block() - Allocate a gmu buffer
+ * @gmu: Pointer to the gen7 gmu device
+ * @md: Pointer to the memdesc
+ * @size: Size of the buffer in bytes
+ * @vma_id: Target gmu vma where this buffer should be mapped
+ * @attrs: Attributes for the mapping
+ *
+ * This function allocates a buffer and maps it in the desired gmu vma
+ *
+ * Return: 0 on success or error code on failure
+ */
+int gen7_alloc_gmu_kernel_block(struct gen7_gmu_device *gmu,
+	struct kgsl_memdesc *md, u32 size, u32 vma_id, int attrs);
+
+/**
+ * gen7_gmu_import_buffer() - Import a gmu buffer
+ * @gmu: Pointer to the gen7 gmu device
+ * @vma_id: Target gmu vma where this buffer should be mapped
+ * @md: Pointer to the memdesc to be mapped
+ * @attrs: Attributes for the mapping
+ * @align: Alignment for the GMU VA and GMU mapping size
+ *
+ * This function imports and maps a buffer to a gmu vma
+ *
+ * Return: 0 on success or error code on failure
+ */
+int gen7_gmu_import_buffer(struct gen7_gmu_device *gmu, u32 vma_id,
+			struct kgsl_memdesc *md, u32 attrs, u32 align);
+
+/**
+ * gen7_free_gmu_block() - Free a gmu buffer
+ * @gmu: Pointer to the gen7 gmu device
+ * @md: Pointer to the memdesc that is to be freed
+ *
+ * This function frees a gmu block allocated by gen7_reserve_gmu_kernel_block()
+ */
+void gen7_free_gmu_block(struct gen7_gmu_device *gmu, struct kgsl_memdesc *md);
+
+/**
+ * gen7_build_rpmh_tables - Build the rpmh tables
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function creates the gpu dcvs and bw tables
+ *
+ * Return: 0 on success and negative error on failure
+ */
+int gen7_build_rpmh_tables(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_gx_is_on - Check if GX is on
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function reads pwr status registers to check if GX
+ * is on or off
+ */
+bool gen7_gmu_gx_is_on(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_device_probe - GEN7 GMU snapshot function
+ * @pdev: Pointer to the platform device
+ * @chipid: Chipid of the target
+ * @gpucore: Pointer to the gpucore
+ *
+ * The target specific probe function for gmu based gen7 targets.
+ */
+int gen7_gmu_device_probe(struct platform_device *pdev,
+		u32 chipid, const struct adreno_gpu_core *gpucore);
+
+/**
+ * gen7_gmu_reset - Reset and restart the gmu
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_reset(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_enable_gpu_irq - Enable gpu interrupt
+ * @adreno_dev: Pointer to the adreno device
+ */
+void gen7_enable_gpu_irq(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_disable_gpu_irq - Disable gpu interrupt
+ * @adreno_dev: Pointer to the adreno device
+ */
+void gen7_disable_gpu_irq(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_snapshot- Take snapshot for gmu targets
+ * @adreno_dev: Pointer to the adreno device
+ * @snapshot: Pointer to the snapshot structure
+ *
+ * Send an NMI to gmu if we hit a gmu fault. Then take gmu
+ * snapshot and carry on with rest of the gen7 snapshot
+ */
+void gen7_gmu_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot);
+
+/**
+ * gen7_gmu_probe - Probe gen7 gmu resources
+ * @device: Pointer to the kgsl device
+ * @pdev: Pointer to the gmu platform device
+ *
+ * Probe the gmu and hfi resources
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_probe(struct kgsl_device *device,
+		struct platform_device *pdev);
+
+/**
+ * gen7_gmu_parse_fw - Parse the gmu fw binary
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_parse_fw(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_memory_init - Allocate gmu memory
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Allocates the gmu log buffer and others if ndeeded.
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_memory_init(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_aop_send_acd_state - Enable or disable acd feature in aop
+ * @gmu: Pointer to the gen7 gmu device
+ * @flag: Boolean to enable or disable acd in aop
+ *
+ * This function enables or disables gpu acd feature using mailbox or qmp
+ */
+void gen7_gmu_aop_send_acd_state(struct gen7_gmu_device *gmu, bool flag);
+
+/**
+ * gen7_gmu_load_fw - Load gmu firmware
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Loads the gmu firmware binary into TCMs and memory
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_load_fw(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_device_start - Bring gmu out of reset
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_device_start(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_hfi_start - Indicate hfi start to gmu
+ * @device: Pointer to the kgsl device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_hfi_start(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_itcm_shadow - Create itcm shadow copy for snapshot
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_itcm_shadow(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_register_config - gmu register configuration
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Program gmu regsiters based on features
+ */
+void gen7_gmu_register_config(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_version_info - Get gmu firmware version
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_version_info(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_irq_enable - Enable gmu interrupts
+ * @adreno_dev: Pointer to the adreno device
+ */
+void gen7_gmu_irq_enable(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_irq_disable - Disaable gmu interrupts
+ * @adreno_dev: Pointer to the adreno device
+ */
+void gen7_gmu_irq_disable(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_suspend - Hard reset the gpu and gmu
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * In case we hit a gmu fault, hard reset the gpu and gmu
+ * to recover from the fault
+ */
+void gen7_gmu_suspend(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_oob_set - send gmu oob request
+ * @device: Pointer to the kgsl device
+ * @req: Type of oob request as defined in enum oob_request
+ *
+ * Request gmu to keep gpu powered up till the oob is cleared
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_oob_set(struct kgsl_device *device, enum oob_request oob);
+
+/**
+ * gen7_gmu_oob_clear - clear an asserted oob request
+ * @device: Pointer to the kgsl device
+ * @req: Type of oob request as defined in enum oob_request
+ *
+ * Clear a previously requested oob so that gmu can power
+ * collapse the gpu
+ */
+void gen7_gmu_oob_clear(struct kgsl_device *device, enum oob_request oob);
+
+/**
+ * gen7_gmu_wait_for_lowest_idle - wait for gmu to complete ifpc
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * If ifpc is enabled, wait for gmu to put gpu into ifpc.
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_wait_for_lowest_idle(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_wait_for_idle - Wait for gmu to become idle
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_wait_for_idle(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_rscc_sleep_sequence - Trigger rscc sleep sequence
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_rscc_sleep_sequence(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_rscc_wakeup_sequence - Trigger rscc wakeup sequence
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_rscc_wakeup_sequence(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_halt_gbif - Halt CX and GX requests in GBIF
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Clear any pending GX or CX transactions in GBIF and
+ * deassert GBIF halt
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_halt_gbif(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_load_pdc_ucode - Load and enable pdc sequence
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_load_pdc_ucode(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_load_rsc_ucode - Load rscc sequence
+ * @adreno_dev: Pointer to the adreno device
+ */
+void gen7_load_rsc_ucode(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_remove - Clean up gmu probed resources
+ * @device: Pointer to the kgsl device
+ */
+void gen7_gmu_remove(struct kgsl_device *device);
+
+/**
+ * gen7_gmu_enable_clks - Enable gmu clocks
+ * @adreno_dev: Pointer to the adreno device
+ * @level: GMU frequency level
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_gmu_enable_clks(struct adreno_device *adreno_dev, u32 level);
+
+/**
+ * gen7_gmu_handle_watchdog - Handle watchdog interrupt
+ * @adreno_dev: Pointer to the adreno device
+ */
+void gen7_gmu_handle_watchdog(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_gmu_send_nmi - Send NMI to GMU
+ * @device: Pointer to the kgsl device
+ * @force: Boolean to forcefully send NMI irrespective of GMU state
+ */
+void gen7_gmu_send_nmi(struct kgsl_device *device, bool force);
+
+/**
+ * gen7_gmu_add_to_minidump - Register gen7_device with va minidump
+ * @adreno_dev: Pointer to the adreno device
+ */
+int gen7_gmu_add_to_minidump(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_snapshot_gmu_mem - Snapshot a GMU memory descriptor
+ * @device: Pointer to the kgsl device
+ * @buf: Destination snapshot buffer
+ * @remain: Remaining size of the snapshot buffer
+ * @priv: Opaque handle
+ *
+ * Return: Number of bytes written to snapshot buffer
+ */
+size_t gen7_snapshot_gmu_mem(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv);
+
+/**
+ * gen7_bus_ab_quantize - Calculate the AB vote that needs to be sent to GMU
+ * @adreno_dev: Handle to the adreno device
+ * @ab: ab request that needs to be scaled in MBps
+ *
+ * Returns the AB value that needs to be prefixed to bandwidth vote in kbps
+ */
+u32 gen7_bus_ab_quantize(struct adreno_device *adreno_dev, u32 ab);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_gmu_snapshot.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_gmu_snapshot.c
@@ -0,0 +1,317 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "gen7_reg.h"
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_gen7_gmu.h"
+#include "adreno_snapshot.h"
+#include "adreno_gen7_0_0_snapshot.h"
+#include "adreno_gen7_2_0_snapshot.h"
+#include "kgsl_device.h"
+
+size_t gen7_snapshot_gmu_mem(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_gmu_mem *mem_hdr =
+		(struct kgsl_snapshot_gmu_mem *)buf;
+	unsigned int *data = (unsigned int *)
+		(buf + sizeof(*mem_hdr));
+	struct gmu_mem_type_desc *desc = priv;
+
+	if (priv == NULL || desc->memdesc->hostptr == NULL)
+		return 0;
+
+	if (remain < desc->memdesc->size + sizeof(*mem_hdr)) {
+		dev_err(device->dev,
+			"snapshot: Not enough memory for the gmu section %d\n",
+			desc->type);
+		return 0;
+	}
+
+	mem_hdr->type = desc->type;
+	mem_hdr->hostaddr = (u64)(uintptr_t)desc->memdesc->hostptr;
+	mem_hdr->gmuaddr = desc->memdesc->gmuaddr;
+	mem_hdr->gpuaddr = 0;
+
+	/* The hw fence queues are mapped as iomem in the kernel */
+	if (desc->type == SNAPSHOT_GMU_MEM_HW_FENCE)
+		memcpy_fromio(data, desc->memdesc->hostptr, desc->memdesc->size);
+	else
+		memcpy(data, desc->memdesc->hostptr, desc->memdesc->size);
+
+	return desc->memdesc->size + sizeof(*mem_hdr);
+}
+
+static size_t gen7_gmu_snapshot_dtcm(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_gmu_mem *mem_hdr =
+		(struct kgsl_snapshot_gmu_mem *)buf;
+	struct gen7_gmu_device *gmu = (struct gen7_gmu_device *)priv;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	u32 *data = (u32 *)(buf + sizeof(*mem_hdr));
+	u32 i;
+
+	if (remain < gmu->vma[GMU_DTCM].size + sizeof(*mem_hdr)) {
+		SNAPSHOT_ERR_NOMEM(device, "GMU DTCM Memory");
+		return 0;
+	}
+
+	mem_hdr->type = SNAPSHOT_GMU_MEM_BIN_BLOCK;
+	mem_hdr->hostaddr = 0;
+	mem_hdr->gmuaddr = gmu->vma[GMU_DTCM].start;
+	mem_hdr->gpuaddr = 0;
+
+	/*
+	 * Read of GMU TCMs over side-band debug controller interface is
+	 * supported on gen7_2_x family
+	 */
+	if (adreno_is_gen7_2_x_family(adreno_dev)) {
+		/*
+		 * region [20]: Dump ITCM/DTCM. Select 1 for DTCM.
+		 * autoInc [31]: Autoincrement the address field after each
+		 * access to TCM_DBG_DATA
+		 */
+		kgsl_regwrite(device, GEN7_CX_DBGC_TCM_DBG_ADDR, BIT(20) | BIT(31));
+
+		for (i = 0; i < (gmu->vma[GMU_DTCM].size >> 2); i++)
+			kgsl_regread(device, GEN7_CX_DBGC_TCM_DBG_DATA, data++);
+	} else {
+		for (i = 0; i < (gmu->vma[GMU_DTCM].size >> 2); i++)
+			gmu_core_regread(device, GEN7_GMU_CM3_DTCM_START + i, data++);
+	}
+
+	return gmu->vma[GMU_DTCM].size + sizeof(*mem_hdr);
+}
+
+static size_t gen7_gmu_snapshot_itcm(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_gmu_mem *mem_hdr =
+			(struct kgsl_snapshot_gmu_mem *)buf;
+	void *dest = buf + sizeof(*mem_hdr);
+	struct gen7_gmu_device *gmu = (struct gen7_gmu_device *)priv;
+
+	if (!gmu->itcm_shadow) {
+		dev_err(&gmu->pdev->dev, "No memory allocated for ITCM shadow capture\n");
+		return 0;
+	}
+
+	if (remain < gmu->vma[GMU_ITCM].size + sizeof(*mem_hdr)) {
+		SNAPSHOT_ERR_NOMEM(device, "GMU ITCM Memory");
+		return 0;
+	}
+
+	mem_hdr->type = SNAPSHOT_GMU_MEM_BIN_BLOCK;
+	mem_hdr->hostaddr = 0;
+	mem_hdr->gmuaddr = gmu->vma[GMU_ITCM].start;
+	mem_hdr->gpuaddr = 0;
+
+	memcpy(dest, gmu->itcm_shadow, gmu->vma[GMU_ITCM].size);
+
+	return gmu->vma[GMU_ITCM].size + sizeof(*mem_hdr);
+}
+
+static void gen7_gmu_snapshot_memories(struct kgsl_device *device,
+	struct gen7_gmu_device *gmu, struct kgsl_snapshot *snapshot)
+{
+	struct gmu_mem_type_desc desc;
+	struct kgsl_memdesc *md;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(gmu->gmu_globals); i++) {
+
+		md = &gmu->gmu_globals[i];
+		if (!md->size)
+			continue;
+
+		desc.memdesc = md;
+		if (md == gmu->hfi.hfi_mem)
+			desc.type = SNAPSHOT_GMU_MEM_HFI;
+		else if (md == gmu->gmu_log)
+			desc.type = SNAPSHOT_GMU_MEM_LOG;
+		else if (md == gmu->dump_mem)
+			desc.type = SNAPSHOT_GMU_MEM_DEBUG;
+		else if ((md == gmu->gmu_init_scratch) || (md == gmu->gpu_boot_scratch))
+			desc.type = SNAPSHOT_GMU_MEM_WARMBOOT;
+		else if (md == gmu->vrb)
+			desc.type = SNAPSHOT_GMU_MEM_VRB;
+		else if (md == gmu->trace.md)
+			desc.type = SNAPSHOT_GMU_MEM_TRACE;
+		else
+			desc.type = SNAPSHOT_GMU_MEM_BIN_BLOCK;
+
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_GMU_MEMORY,
+			snapshot, gen7_snapshot_gmu_mem, &desc);
+	}
+}
+
+struct kgsl_snapshot_gmu_version {
+	u32 type;
+	u32 value;
+};
+
+static size_t gen7_snapshot_gmu_version(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	u32 *data = (u32 *) (buf + sizeof(*header));
+	struct kgsl_snapshot_gmu_version *ver = priv;
+
+	if (remain < DEBUG_SECTION_SZ(1)) {
+		SNAPSHOT_ERR_NOMEM(device, "GMU Version");
+		return 0;
+	}
+
+	header->type = ver->type;
+	header->size = 1;
+
+	*data = ver->value;
+
+	return DEBUG_SECTION_SZ(1);
+}
+
+static void gen7_gmu_snapshot_versions(struct kgsl_device *device,
+		struct gen7_gmu_device *gmu,
+		struct kgsl_snapshot *snapshot)
+{
+	int i;
+
+	struct kgsl_snapshot_gmu_version gmu_vers[] = {
+		{ .type = SNAPSHOT_DEBUG_GMU_CORE_VERSION,
+			.value = gmu->ver.core, },
+		{ .type = SNAPSHOT_DEBUG_GMU_CORE_DEV_VERSION,
+			.value = gmu->ver.core_dev, },
+		{ .type = SNAPSHOT_DEBUG_GMU_PWR_VERSION,
+			.value = gmu->ver.pwr, },
+		{ .type = SNAPSHOT_DEBUG_GMU_PWR_DEV_VERSION,
+			.value = gmu->ver.pwr_dev, },
+		{ .type = SNAPSHOT_DEBUG_GMU_HFI_VERSION,
+			.value = gmu->ver.hfi, },
+	};
+
+	for (i = 0; i < ARRAY_SIZE(gmu_vers); i++)
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+				snapshot, gen7_snapshot_gmu_version,
+				&gmu_vers[i]);
+}
+
+#define RSCC_OFFSET_DWORDS 0x14000
+
+static size_t gen7_snapshot_rscc_registers(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	const u32 *regs = priv;
+	unsigned int *data = (unsigned int *)buf;
+	int count = 0, k;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	/* Figure out how many registers we are going to dump */
+	count = adreno_snapshot_regs_count(regs);
+
+	if (remain < (count * 4)) {
+		SNAPSHOT_ERR_NOMEM(device, "RSCC REGISTERS");
+		return 0;
+	}
+
+	for (regs = priv; regs[0] != UINT_MAX; regs += 2) {
+		unsigned int cnt = REG_COUNT(regs);
+
+		if (cnt == 1) {
+			*data++ = BIT(31) |  regs[0];
+			*data++ =  __raw_readl(gmu->rscc_virt +
+				((regs[0] - RSCC_OFFSET_DWORDS) << 2));
+			continue;
+		}
+		*data++ = regs[0];
+		*data++ = cnt;
+		for (k = regs[0]; k <= regs[1]; k++)
+			*data++ =  __raw_readl(gmu->rscc_virt +
+				((k - RSCC_OFFSET_DWORDS) << 2));
+	}
+
+	/* Return the size of the section */
+	return (count * 4);
+}
+
+/*
+ * gen7_gmu_device_snapshot() - GEN7 GMU snapshot function
+ * @device: Device being snapshotted
+ * @snapshot: Pointer to the snapshot instance
+ *
+ * This is where all of the GEN7 GMU specific bits and pieces are grabbed
+ * into the snapshot memory
+ */
+static void gen7_gmu_device_snapshot(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	const struct adreno_gen7_core *gpucore = to_gen7_core(ADRENO_DEVICE(device));
+	const struct gen7_snapshot_block_list *gen7_snapshot_block_list =
+						gpucore->gen7_snapshot_block_list;
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_GMU_MEMORY,
+		snapshot, gen7_gmu_snapshot_itcm, gmu);
+
+	gen7_gmu_snapshot_versions(device, gmu, snapshot);
+
+	gen7_gmu_snapshot_memories(device, gmu, snapshot);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2, snapshot,
+		adreno_snapshot_registers_v2, (void *) gen7_snapshot_block_list->gmu_regs);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2, snapshot,
+		gen7_snapshot_rscc_registers, (void *) gen7_snapshot_block_list->rscc_regs);
+
+	if (!gen7_gmu_gx_is_on(adreno_dev))
+		goto dtcm;
+
+	/* Set fence to ALLOW mode so registers can be read */
+	kgsl_regwrite(device, GEN7_GMU_AO_AHB_FENCE_CTRL, 0);
+	/* Make sure the previous write posted before reading */
+	wmb();
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2, snapshot,
+		adreno_snapshot_registers_v2, (void *) gen7_snapshot_block_list->gmu_gx_regs);
+
+	/*
+	 * A stalled SMMU can lead to NoC timeouts when host accesses DTCM.
+	 * DTCM can be read through side-band DBGC interface on gen7_2_x family.
+	 */
+	if (gen7_is_smmu_stalled(device) && !adreno_is_gen7_2_x_family(adreno_dev)) {
+		dev_err(&gmu->pdev->dev,
+			"Not dumping dtcm because SMMU is stalled\n");
+		return;
+	}
+
+dtcm:
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_GMU_MEMORY,
+		snapshot, gen7_gmu_snapshot_dtcm, gmu);
+}
+
+void gen7_gmu_snapshot(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/*
+	 * Dump external register first to have GPUCC and other external
+	 * register in snapshot to analyze the system state even in partial
+	 * snapshot dump
+	 */
+	gen7_snapshot_external_core_regs(device, snapshot);
+
+	gen7_gmu_device_snapshot(device, snapshot);
+
+	gen7_snapshot(adreno_dev, snapshot);
+
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_CLR, UINT_MAX);
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_MASK, HFI_IRQ_MASK);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_hfi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_hfi.c
@@ -0,0 +1,834 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/delay.h>
+#include <linux/nvmem-consumer.h>
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_gen7_gmu.h"
+#include "adreno_gen7_hfi.h"
+#include "kgsl_device.h"
+#include "kgsl_trace.h"
+
+/* Below section is for all structures related to HFI queues */
+#define HFI_QUEUE_MAX HFI_QUEUE_DEFAULT_CNT
+
+/* Total header sizes + queue sizes + 16 for alignment */
+#define HFIMEM_SIZE (sizeof(struct hfi_queue_table) + 16 + \
+		(HFI_QUEUE_SIZE * HFI_QUEUE_MAX))
+
+#define HOST_QUEUE_START_ADDR(hfi_mem, i) \
+	((hfi_mem)->hostptr + HFI_QUEUE_OFFSET(i))
+
+struct gen7_hfi *to_gen7_hfi(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	return &gmu->hfi;
+}
+
+/* Size in below functions are in unit of dwords */
+int gen7_hfi_queue_read(struct gen7_gmu_device *gmu, u32 queue_idx,
+		unsigned int *output, unsigned int max_size)
+{
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	struct hfi_queue_table *tbl = mem_addr->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+	u32 *queue;
+	u32 msg_hdr;
+	u32 i, read;
+	u32 size;
+	int result = 0;
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+		return -EINVAL;
+
+	if (hdr->read_index == hdr->write_index)
+		return -ENODATA;
+
+	/* Clear the output data before populating */
+	memset(output, 0, max_size);
+
+	queue = HOST_QUEUE_START_ADDR(mem_addr, queue_idx);
+	msg_hdr = queue[hdr->read_index];
+	size = MSG_HDR_GET_SIZE(msg_hdr);
+
+	if (size > (max_size >> 2)) {
+		dev_err(&gmu->pdev->dev,
+		"HFI message too big: hdr:0x%x rd idx=%d\n",
+			msg_hdr, hdr->read_index);
+		result = -EMSGSIZE;
+		goto done;
+	}
+
+	read = hdr->read_index;
+
+	if (read < hdr->queue_size) {
+		for (i = 0; i < size && i < (max_size >> 2); i++) {
+			output[i] = queue[read];
+			read = (read + 1)%hdr->queue_size;
+		}
+		result = size;
+	} else {
+		/* In case FW messed up */
+		dev_err(&gmu->pdev->dev,
+			"Read index %d greater than queue size %d\n",
+			hdr->read_index, hdr->queue_size);
+		result = -ENODATA;
+	}
+
+	read = ALIGN(read, SZ_4) % hdr->queue_size;
+
+	hfi_update_read_idx(hdr, read);
+
+	/* For acks, trace the packet for which this ack was sent */
+	if (MSG_HDR_GET_TYPE(msg_hdr) == HFI_MSG_ACK)
+		trace_kgsl_hfi_receive(MSG_HDR_GET_ID(output[1]),
+			MSG_HDR_GET_SIZE(output[1]),
+			MSG_HDR_GET_SEQNUM(output[1]));
+	else
+		trace_kgsl_hfi_receive(MSG_HDR_GET_ID(msg_hdr),
+			MSG_HDR_GET_SIZE(msg_hdr), MSG_HDR_GET_SEQNUM(msg_hdr));
+
+done:
+	return result;
+}
+
+int gen7_hfi_queue_write(struct adreno_device *adreno_dev, u32 queue_idx,
+		u32 *msg, u32 size_bytes)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct hfi_queue_table *tbl = gmu->hfi.hfi_mem->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+	u32 *queue;
+	u32 i, write_idx, read_idx, empty_space;
+	u32 size_dwords = size_bytes >> 2;
+	u32 align_size = ALIGN(size_dwords, SZ_4);
+	u32 id = MSG_HDR_GET_ID(*msg);
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED || !IS_ALIGNED(size_bytes, sizeof(u32)))
+		return -EINVAL;
+
+	queue = HOST_QUEUE_START_ADDR(gmu->hfi.hfi_mem, queue_idx);
+
+	write_idx = hdr->write_index;
+	read_idx = hdr->read_index;
+
+	empty_space = (write_idx >= read_idx) ?
+			(hdr->queue_size - (write_idx - read_idx))
+			: (read_idx - write_idx);
+
+	if (empty_space <= align_size)
+		return -ENOSPC;
+
+	for (i = 0; i < size_dwords; i++) {
+		queue[write_idx] = msg[i];
+		write_idx = (write_idx + 1) % hdr->queue_size;
+	}
+
+	/* Cookify any non used data at the end of the write buffer */
+	for (; i < align_size; i++) {
+		queue[write_idx] = 0xfafafafa;
+		write_idx = (write_idx + 1) % hdr->queue_size;
+	}
+
+	trace_kgsl_hfi_send(id, size_dwords, MSG_HDR_GET_SEQNUM(*msg));
+
+	hfi_update_write_idx(&hdr->write_index, write_idx);
+
+	return 0;
+}
+
+int gen7_hfi_cmdq_write(struct adreno_device *adreno_dev, u32 *msg, u32 size_bytes)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hfi *hfi = &gmu->hfi;
+	int ret;
+
+	spin_lock(&hfi->cmdq_lock);
+
+	if (test_bit(MSG_HDR_GET_ID(msg[0]), hfi->wb_set_record_bitmask))
+		*msg = RECORD_MSG_HDR(*msg);
+
+	ret = gen7_hfi_queue_write(adreno_dev, HFI_CMD_ID, msg, size_bytes);
+
+	/*
+	 * Some messages like ACD table and perf table are saved in memory, so we need
+	 * to reset the header to make sure we do not send a record enabled bit incase
+	 * we change the warmboot setting from debugfs
+	 */
+	*msg = CLEAR_RECORD_MSG_HDR(*msg);
+	/*
+	 * Memory barrier to make sure packet and write index are written before
+	 * an interrupt is raised
+	 */
+	wmb();
+
+	/* Send interrupt to GMU to receive the message */
+	if (!ret)
+		gmu_core_regwrite(KGSL_DEVICE(adreno_dev),
+			GEN7_GMU_HOST2GMU_INTR_SET, 0x1);
+
+	spin_unlock(&hfi->cmdq_lock);
+
+	return ret;
+}
+
+/* Sizes of the queue and message are in unit of dwords */
+static void init_queues(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	int i;
+	struct hfi_queue_table *tbl;
+	struct hfi_queue_header *hdr;
+	struct {
+		unsigned int idx;
+		unsigned int pri;
+		unsigned int status;
+	} queue[HFI_QUEUE_MAX] = {
+		{ HFI_CMD_ID, HFI_CMD_PRI, HFI_QUEUE_STATUS_ENABLED },
+		{ HFI_MSG_ID, HFI_MSG_PRI, HFI_QUEUE_STATUS_ENABLED },
+		{ HFI_DBG_ID, HFI_DBG_PRI, HFI_QUEUE_STATUS_ENABLED },
+	};
+
+	/* Fill Table Header */
+	tbl = mem_addr->hostptr;
+	tbl->qtbl_hdr.version = 0;
+	tbl->qtbl_hdr.size = sizeof(struct hfi_queue_table) >> 2;
+	tbl->qtbl_hdr.qhdr0_offset = sizeof(struct hfi_queue_table_header) >> 2;
+	tbl->qtbl_hdr.qhdr_size = sizeof(struct hfi_queue_header) >> 2;
+	tbl->qtbl_hdr.num_q = HFI_QUEUE_MAX;
+	tbl->qtbl_hdr.num_active_q = HFI_QUEUE_MAX;
+
+	memset(&tbl->qhdr[0], 0, sizeof(tbl->qhdr));
+
+	/* Fill Individual Queue Headers */
+	for (i = 0; i < HFI_QUEUE_MAX; i++) {
+		hdr = &tbl->qhdr[i];
+		hdr->start_addr = GMU_QUEUE_START_ADDR(mem_addr->gmuaddr, i);
+		hdr->type = QUEUE_HDR_TYPE(queue[i].idx, queue[i].pri, 0, 0);
+		hdr->status = queue[i].status;
+		hdr->queue_size = HFI_QUEUE_SIZE >> 2; /* convert to dwords */
+	}
+}
+
+int gen7_hfi_init(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hfi *hfi = &gmu->hfi;
+
+	/* Allocates & maps memory for HFI */
+	if (IS_ERR_OR_NULL(hfi->hfi_mem)) {
+		hfi->hfi_mem = gen7_reserve_gmu_kernel_block(gmu, 0,
+				HFIMEM_SIZE, GMU_NONCACHED_KERNEL, 0);
+		if (!IS_ERR(hfi->hfi_mem))
+			init_queues(adreno_dev);
+	}
+
+	return PTR_ERR_OR_ZERO(hfi->hfi_mem);
+}
+
+int gen7_receive_ack_cmd(struct gen7_gmu_device *gmu, void *rcvd,
+	struct pending_cmd *ret_cmd)
+{
+	struct adreno_device *adreno_dev = gen7_gmu_to_adreno(gmu);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 *ack = rcvd;
+	u32 hdr = ack[0];
+	u32 req_hdr = ack[1];
+
+	if (ret_cmd == NULL)
+		return -EINVAL;
+
+	if (CMP_HFI_ACK_HDR(ret_cmd->sent_hdr, req_hdr)) {
+		memcpy(&ret_cmd->results, ack, MSG_HDR_GET_SIZE(hdr) << 2);
+		return 0;
+	}
+
+	/* Didn't find the sender, list the waiter */
+	dev_err_ratelimited(&gmu->pdev->dev,
+		"HFI ACK: Cannot find sender for 0x%8.8x Waiter: 0x%8.8x\n",
+		req_hdr, ret_cmd->sent_hdr);
+
+	gmu_core_fault_snapshot(device);
+
+	return -ENODEV;
+}
+
+static int poll_gmu_reg(struct adreno_device *adreno_dev,
+	u32 offsetdwords, unsigned int expected_val,
+	unsigned int mask, unsigned int timeout_ms)
+{
+	unsigned int val;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned long timeout = jiffies + msecs_to_jiffies(timeout_ms);
+	bool nmi = false;
+
+	while (time_is_after_jiffies(timeout)) {
+		gmu_core_regread(device, offsetdwords, &val);
+		if ((val & mask) == expected_val)
+			return 0;
+
+		/*
+		 * If GMU firmware fails any assertion, error message is sent
+		 * to KMD and NMI is triggered. So check if GMU is in NMI and
+		 * timeout early. Bits [11:9] of A6XX_GMU_CM3_FW_INIT_RESULT
+		 * contain GMU reset status. Non zero value here indicates that
+		 * GMU reset is active, NMI handler would eventually complete
+		 * and GMU would wait for recovery.
+		 */
+		gmu_core_regread(device, GEN7_GMU_CM3_FW_INIT_RESULT, &val);
+		if (val & 0xE00) {
+			nmi = true;
+			break;
+		}
+
+		usleep_range(10, 100);
+	}
+
+	/* Check one last time */
+	gmu_core_regread(device, offsetdwords, &val);
+	if ((val & mask) == expected_val)
+		return 0;
+
+	dev_err(&gmu->pdev->dev,
+		"Reg poll %s: offset 0x%x, want 0x%x, got 0x%x\n",
+		nmi ? "abort" : "timeout", offsetdwords, expected_val,
+		val & mask);
+
+	return -ETIMEDOUT;
+}
+
+static int gen7_hfi_send_cmd_wait_inline(struct adreno_device *adreno_dev,
+	void *data, u32 size_bytes, struct pending_cmd *ret_cmd)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int rc;
+	u32 *cmd = data;
+	struct gen7_hfi *hfi = &gmu->hfi;
+	unsigned int seqnum = atomic_inc_return(&hfi->seqnum);
+
+	*cmd = MSG_HDR_SET_SEQNUM_SIZE(*cmd, seqnum, size_bytes >> 2);
+
+	if (ret_cmd == NULL)
+		return gen7_hfi_cmdq_write(adreno_dev, cmd, size_bytes);
+
+	ret_cmd->sent_hdr = cmd[0];
+
+	rc = gen7_hfi_cmdq_write(adreno_dev, cmd, size_bytes);
+	if (rc)
+		return rc;
+
+	rc = poll_gmu_reg(adreno_dev, GEN7_GMU_GMU2HOST_INTR_INFO,
+		HFI_IRQ_MSGQ_MASK, HFI_IRQ_MSGQ_MASK, HFI_RSP_TIMEOUT);
+
+	if (rc) {
+		gmu_core_fault_snapshot(device);
+		dev_err(&gmu->pdev->dev,
+		"Timed out waiting on ack for 0x%8.8x (id %d, sequence %d)\n",
+		cmd[0], MSG_HDR_GET_ID(*cmd), MSG_HDR_GET_SEQNUM(*cmd));
+		return rc;
+	}
+
+	/* Clear the interrupt */
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_CLR,
+		HFI_IRQ_MSGQ_MASK);
+
+	rc = gen7_hfi_process_queue(gmu, HFI_MSG_ID, ret_cmd);
+
+	return rc;
+}
+
+int gen7_hfi_send_generic_req(struct adreno_device *adreno_dev, void *cmd, u32 size_bytes)
+{
+	struct pending_cmd ret_cmd;
+	int rc;
+
+	memset(&ret_cmd, 0, sizeof(ret_cmd));
+
+	rc = gen7_hfi_send_cmd_wait_inline(adreno_dev, cmd, size_bytes, &ret_cmd);
+	if (rc)
+		return rc;
+
+	if (ret_cmd.results[2]) {
+		struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+		struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+		gmu_core_fault_snapshot(device);
+		dev_err(&gmu->pdev->dev,
+				"HFI ACK failure: Req=0x%8.8X, Result=0x%8.8X\n",
+				ret_cmd.results[1],
+				ret_cmd.results[2]);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int gen7_hfi_send_core_fw_start(struct adreno_device *adreno_dev)
+{
+	struct hfi_core_fw_start_cmd cmd = {
+		.handle = 0x0,
+	};
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_CORE_FW_START);
+	if (ret)
+		return ret;
+
+	return gen7_hfi_send_generic_req(adreno_dev, &cmd, sizeof(cmd));
+}
+
+static const char *feature_to_string(u32 feature)
+{
+	if (feature == HFI_FEATURE_ACD)
+		return "ACD";
+	else if (feature == HFI_FEATURE_LM)
+		return "LM";
+
+	return "unknown";
+}
+
+/* For sending hfi message inline to handle GMU return type error */
+int gen7_hfi_send_generic_req_v5(struct adreno_device *adreno_dev, void *cmd,
+		struct pending_cmd *ret_cmd, u32 size_bytes)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int rc;
+
+	if (GMU_VER_MINOR(gmu->ver.hfi) <= 4)
+		return gen7_hfi_send_generic_req(adreno_dev, cmd, size_bytes);
+
+	rc = gen7_hfi_send_cmd_wait_inline(adreno_dev, cmd, size_bytes, ret_cmd);
+	if (rc)
+		return rc;
+
+	switch (ret_cmd->results[3]) {
+	case GMU_SUCCESS:
+		rc = ret_cmd->results[2];
+		break;
+	case GMU_ERROR_NO_ENTRY:
+		/* Unique error to handle undefined HFI msgs by caller */
+		rc = -ENOENT;
+		break;
+	case GMU_ERROR_TIMEOUT:
+		rc = -EINVAL;
+		break;
+	default:
+		gmu_core_fault_snapshot(KGSL_DEVICE(adreno_dev));
+		dev_err(&gmu->pdev->dev,
+			"HFI ACK: Req=0x%8.8X, Result=0x%8.8X Error:0x%8.8X\n",
+			ret_cmd->results[1], ret_cmd->results[2], ret_cmd->results[3]);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int gen7_hfi_send_feature_ctrl(struct adreno_device *adreno_dev,
+	u32 feature, u32 enable, u32 data)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct pending_cmd ret_cmd = {0};
+	struct hfi_feature_ctrl_cmd cmd = {
+		.feature = feature,
+		.enable = enable,
+		.data = data,
+	};
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_FEATURE_CTRL);
+	if (ret)
+		return ret;
+
+	ret = gen7_hfi_send_generic_req_v5(adreno_dev, &cmd, &ret_cmd, sizeof(cmd));
+	if (ret < 0)
+		dev_err(&gmu->pdev->dev,
+				"Unable to %s feature %s (%d)\n",
+				enable ? "enable" : "disable",
+				feature_to_string(feature),
+				feature);
+	return ret;
+}
+
+int gen7_hfi_send_get_value(struct adreno_device *adreno_dev, u32 type, u32 subtype)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct pending_cmd ret_cmd = {0};
+	struct hfi_get_value_cmd cmd = {
+		.type = type,
+		.subtype = subtype,
+	};
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_GET_VALUE);
+	if (ret)
+		return ret;
+
+	ret = gen7_hfi_send_generic_req_v5(adreno_dev, &cmd, &ret_cmd, sizeof(cmd));
+	if (ret < 0)
+		dev_err(&gmu->pdev->dev,
+			"Unable to get HFI Value type: %d, subtype: %d, error = %d\n",
+			type, subtype, ret);
+
+	return ret;
+}
+
+int gen7_hfi_send_set_value(struct adreno_device *adreno_dev,
+		u32 type, u32 subtype, u32 data)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct pending_cmd ret_cmd = {0};
+	struct hfi_set_value_cmd cmd = {
+		.type = type,
+		.subtype = subtype,
+		.data = data,
+	};
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_SET_VALUE);
+	if (ret)
+		return ret;
+
+	ret = gen7_hfi_send_generic_req_v5(adreno_dev, &cmd, &ret_cmd, sizeof(cmd));
+	if (ret < 0)
+		dev_err(&gmu->pdev->dev,
+			"Unable to set HFI Value %d, %d to %d, error = %d\n",
+			type, subtype, data, ret);
+	return ret;
+}
+
+void adreno_gen7_receive_err_req(struct gen7_gmu_device *gmu, void *rcvd)
+{
+	struct hfi_err_cmd *cmd = rcvd;
+
+	dev_err(&gmu->pdev->dev, "HFI Error Received: %d %d %.16s\n",
+			((cmd->error_code >> 16) & 0xffff),
+			(cmd->error_code & 0xffff),
+			(char *) cmd->data);
+}
+
+void adreno_gen7_receive_debug_req(struct gen7_gmu_device *gmu, void *rcvd)
+{
+	struct hfi_debug_cmd *cmd = rcvd;
+
+	dev_dbg(&gmu->pdev->dev, "HFI Debug Received: %d %d %d\n",
+			cmd->type, cmd->timestamp, cmd->data);
+}
+
+int gen7_hfi_process_queue(struct gen7_gmu_device *gmu,
+		u32 queue_idx, struct pending_cmd *ret_cmd)
+{
+	u32 rcvd[MAX_RCVD_SIZE];
+
+	while (gen7_hfi_queue_read(gmu, queue_idx, rcvd, sizeof(rcvd)) > 0) {
+		/* ACK Handler */
+		if (MSG_HDR_GET_TYPE(rcvd[0]) == HFI_MSG_ACK) {
+			int ret = gen7_receive_ack_cmd(gmu, rcvd, ret_cmd);
+
+			if (ret)
+				return ret;
+			continue;
+		}
+
+		/* Request Handler */
+		switch (MSG_HDR_GET_ID(rcvd[0])) {
+		case F2H_MSG_ERR: /* No Reply */
+			adreno_gen7_receive_err_req(gmu, rcvd);
+			break;
+		case F2H_MSG_DEBUG: /* No Reply */
+			adreno_gen7_receive_debug_req(gmu, rcvd);
+			break;
+		default: /* No Reply */
+			dev_err(&gmu->pdev->dev,
+				"HFI request %d not supported\n",
+				MSG_HDR_GET_ID(rcvd[0]));
+			break;
+		}
+	}
+
+	return 0;
+}
+
+int gen7_hfi_send_bcl_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	if (!adreno_dev->bcl_enabled)
+		return 0;
+
+	/*
+	 * BCL data is expected by gmu in below format
+	 * BIT[0] - response type
+	 * BIT[1:7] - Throttle level 1 (optional)
+	 * BIT[8:14] - Throttle level 2 (optional)
+	 * BIT[15:21] - Throttle level 3 (optional)
+	 */
+	return gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_BCL, 1, adreno_dev->bcl_data);
+}
+
+int gen7_hfi_send_clx_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	int ret = 0;
+	struct hfi_clx_table_v2_cmd cmd = {0};
+
+	if (!adreno_dev->clx_enabled)
+		return 0;
+
+	/* Make sure the table is valid before enabling feature */
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_CLX_TBL);
+	if (ret)
+		return ret;
+
+	ret = gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_CLX, 1, 0);
+	if (ret)
+		return ret;
+
+	cmd.version = FIELD_PREP(GENMASK(31, 16), 0x2) | FIELD_PREP(GENMASK(15, 0), 0x1);
+	/* cmd.domain[0] is never used but needed per hfi spec */
+	cmd.domain[1].data0 = FIELD_PREP(GENMASK(31, 29), 1) |
+				FIELD_PREP(GENMASK(28, 28), 1) |
+				FIELD_PREP(GENMASK(27, 22), 1) |
+				FIELD_PREP(GENMASK(21, 16), 40) |
+				FIELD_PREP(GENMASK(15, 0), 0);
+	cmd.domain[1].clxt = 0;
+	cmd.domain[1].clxh = 0;
+	cmd.domain[1].urgmode = 1;
+	cmd.domain[1].lkgen = 0;
+	cmd.domain[1].currbudget = 50;
+
+	return gen7_hfi_send_generic_req(adreno_dev, &cmd, sizeof(cmd));
+}
+
+#define EVENT_PWR_ACD_THROTTLE_PROF 44
+
+int gen7_hfi_send_acd_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	if (adreno_dev->acd_enabled) {
+		ret = gen7_hfi_send_feature_ctrl(adreno_dev,
+			HFI_FEATURE_ACD, 1, 0);
+		if (ret)
+			return ret;
+
+		ret = gen7_hfi_send_generic_req(adreno_dev,
+				&gmu->hfi.acd_table, sizeof(gmu->hfi.acd_table));
+		if (ret)
+			return ret;
+
+		gen7_hfi_send_set_value(adreno_dev, HFI_VALUE_LOG_EVENT_ON,
+				EVENT_PWR_ACD_THROTTLE_PROF, 0);
+	}
+
+	return 0;
+}
+
+int gen7_hfi_send_ifpc_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (gmu->idle_level == GPU_HW_IFPC)
+		return gen7_hfi_send_feature_ctrl(adreno_dev,
+				HFI_FEATURE_IFPC, 1, adreno_dev->ifpc_hyst);
+	return 0;
+}
+
+static void reset_hfi_queues(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	struct hfi_queue_table *tbl = mem_addr->hostptr;
+	struct hfi_queue_header *hdr;
+	unsigned int i;
+
+	/* Flush HFI queues */
+	for (i = 0; i < HFI_QUEUE_MAX; i++) {
+		hdr = &tbl->qhdr[i];
+		if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+			continue;
+
+		hdr->read_index = hdr->write_index;
+	}
+}
+
+/* Fill the entry and return the dword count written */
+static u32 _fill_table_entry(struct hfi_table_entry *entry, u32 count,
+		u32 stride_bytes, u32 *data)
+{
+	entry->count = count;
+	entry->stride = stride_bytes >> 2; /* entry->stride is in dwords */
+	memcpy(entry->data, data, stride_bytes * count);
+
+	/* Return total dword count of entry + data */
+	return (sizeof(*entry) >> 2) + (entry->count * entry->stride);
+}
+
+int gen7_hfi_send_gpu_perf_table(struct adreno_device *adreno_dev)
+{
+	/*
+	 * Buffer to store either hfi_table_cmd or hfi_dcvstable_cmd.
+	 * Current max size for either is 165 dwords.
+	 */
+	static u32 cmd_buf[200];
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_dcvs_table *tbl = &gmu->dcvs_table;
+	int ret = 0;
+
+	/* Starting with GMU HFI Version 2.6.1, use H2F_MSG_TABLE */
+	if (gmu->ver.hfi >= HFI_VERSION(2, 6, 1)) {
+		struct hfi_table_cmd *cmd = (struct hfi_table_cmd *)&cmd_buf[0];
+		u32 dword_off;
+
+		/* Already setup, so just send cmd */
+		if (cmd->hdr)
+			return gen7_hfi_send_generic_req(adreno_dev, cmd,
+					MSG_HDR_GET_SIZE(cmd->hdr) << 2);
+
+		if (tbl->gpu_level_num > MAX_GX_LEVELS || tbl->gmu_level_num > MAX_CX_LEVELS)
+			return -EINVAL;
+
+		/* CMD starts with struct hfi_table_cmd data */
+		cmd->type = HFI_TABLE_GPU_PERF;
+		dword_off = sizeof(*cmd) >> 2;
+
+		/* Fill in the table entry and data starting at dword_off */
+		dword_off += _fill_table_entry((struct hfi_table_entry *)&cmd_buf[dword_off],
+				tbl->gpu_level_num, sizeof(struct opp_gx_desc),
+				(u32 *)tbl->gx_votes);
+
+		/* Fill in the table entry and data starting at dword_off */
+		dword_off += _fill_table_entry((struct hfi_table_entry *)&cmd_buf[dword_off],
+				tbl->gmu_level_num, sizeof(struct opp_desc),
+				(u32 *)tbl->cx_votes);
+
+		cmd->hdr = CREATE_MSG_HDR(H2F_MSG_TABLE, HFI_MSG_CMD);
+		cmd->hdr = MSG_HDR_SET_SIZE(cmd->hdr, dword_off);
+
+		ret = gen7_hfi_send_generic_req(adreno_dev, cmd, dword_off << 2);
+	} else {
+		struct hfi_dcvstable_cmd *cmd = (struct hfi_dcvstable_cmd *)&cmd_buf[0];
+
+		/* Already setup, so just send cmd */
+		if (cmd->hdr)
+			return gen7_hfi_send_generic_req(adreno_dev, cmd, sizeof(*cmd));
+
+		if (tbl->gpu_level_num > MAX_GX_LEVELS_LEGACY || tbl->gmu_level_num > MAX_CX_LEVELS)
+			return -EINVAL;
+
+		ret = CMD_MSG_HDR(*cmd, H2F_MSG_PERF_TBL);
+		if (ret)
+			return ret;
+
+		cmd->gpu_level_num = tbl->gpu_level_num;
+		cmd->gmu_level_num = tbl->gmu_level_num;
+		memcpy(&cmd->gx_votes, tbl->gx_votes,
+				sizeof(struct opp_gx_desc) * cmd->gpu_level_num);
+		memcpy(&cmd->cx_votes, tbl->cx_votes,
+				sizeof(struct opp_desc) * cmd->gmu_level_num);
+
+		ret = gen7_hfi_send_generic_req(adreno_dev, cmd, sizeof(*cmd));
+	}
+
+	return ret;
+}
+
+int gen7_hfi_start(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int result;
+
+	reset_hfi_queues(adreno_dev);
+
+	result = gen7_hfi_send_gpu_perf_table(adreno_dev);
+	if (result)
+		goto err;
+
+	result = gen7_hfi_send_generic_req(adreno_dev, &gmu->hfi.bw_table,
+			sizeof(gmu->hfi.bw_table));
+	if (result)
+		goto err;
+
+	result = gen7_hfi_send_acd_feature_ctrl(adreno_dev);
+	if (result)
+		goto err;
+
+	result = gen7_hfi_send_bcl_feature_ctrl(adreno_dev);
+	if (result)
+		goto err;
+
+	result = gen7_hfi_send_clx_feature_ctrl(adreno_dev);
+	if (result)
+		goto err;
+
+	result = gen7_hfi_send_ifpc_feature_ctrl(adreno_dev);
+	if (result)
+		goto err;
+
+	result = gen7_hfi_send_core_fw_start(adreno_dev);
+	if (result)
+		goto err;
+
+	set_bit(GMU_PRIV_HFI_STARTED, &gmu->flags);
+
+	/* Request default DCVS level */
+	result = kgsl_pwrctrl_set_default_gpu_pwrlevel(device);
+	if (result)
+		goto err;
+
+	/* Request default BW vote */
+	result = kgsl_pwrctrl_axi(device, true);
+
+err:
+	if (result)
+		gen7_hfi_stop(adreno_dev);
+
+	return result;
+
+}
+
+void gen7_hfi_stop(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	kgsl_pwrctrl_axi(device, false);
+
+	clear_bit(GMU_PRIV_HFI_STARTED, &gmu->flags);
+}
+
+/* HFI interrupt handler */
+irqreturn_t gen7_hfi_irq_handler(int irq, void *data)
+{
+	struct kgsl_device *device = data;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(ADRENO_DEVICE(device));
+	unsigned int status = 0;
+
+	gmu_core_regread(device, GEN7_GMU_GMU2HOST_INTR_INFO, &status);
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_CLR, HFI_IRQ_MASK);
+
+	if (status & HFI_IRQ_DBGQ_MASK)
+		gen7_hfi_process_queue(gmu, HFI_DBG_ID, NULL);
+	if (status & HFI_IRQ_CM3_FAULT_MASK) {
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"GMU CM3 fault interrupt received\n");
+		atomic_set(&gmu->cm3_fault, 1);
+
+		/* make sure other CPUs see the update */
+		smp_wmb();
+	}
+	if (status & ~HFI_IRQ_MASK)
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"Unhandled HFI interrupts 0x%lx\n",
+				status & ~HFI_IRQ_MASK);
+
+	return IRQ_HANDLED;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_hfi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_hfi.h
@@ -0,0 +1,234 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_GEN7_HFI_H
+#define __ADRENO_GEN7_HFI_H
+
+#include "adreno_hfi.h"
+
+/**
+ * struct gen7_hfi - HFI control structure
+ */
+struct gen7_hfi {
+	/** @irq: HFI interrupt line */
+	int irq;
+	/** @seqnum: atomic counter that is incremented for each message sent.
+	 *   The value of the counter is used as sequence number for HFI message.
+	 */
+	atomic_t seqnum;
+	/** @hfi_mem: Memory descriptor for the hfi memory */
+	struct kgsl_memdesc *hfi_mem;
+	/** @bw_table: HFI BW table buffer */
+	struct hfi_bwtable_cmd bw_table;
+	/** @acd_table: HFI table for ACD data */
+	struct hfi_acd_table_cmd acd_table;
+	/** @cmdq_lock: Spinlock for accessing the cmdq */
+	spinlock_t cmdq_lock;
+	/**
+	 * @wb_set_record_bitmask: Bitmask to enable or disable the recording
+	 * of messages in the GMU scratch.
+	 */
+	unsigned long wb_set_record_bitmask[BITS_TO_LONGS(HFI_MAX_ID)];
+};
+
+struct gen7_gmu_device;
+
+/* gen7_hfi_irq_handler - IRQ handler for HFI interripts */
+irqreturn_t gen7_hfi_irq_handler(int irq, void *data);
+
+/**
+ * gen7_hfi_start - Send the various HFIs during device boot up
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_start(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hfi_start - Send the various HFIs during device boot up
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+void gen7_hfi_stop(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hfi_init - Initialize hfi resources
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function allocates and sets up hfi queues
+ * when a process creates the very first kgsl instance
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_init(struct adreno_device *adreno_dev);
+
+/* Helper function to get to gen7 hfi struct from adreno device */
+struct gen7_hfi *to_gen7_hfi(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hfi_queue_write - Write a command to hfi queue
+ * @adreno_dev: Pointer to the adreno device
+ * @queue_idx: destination queue id
+ * @msg: Data to be written to the queue
+ * @size_bytes: Size of the command in bytes
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_queue_write(struct adreno_device *adreno_dev, u32 queue_idx,
+		u32 *msg, u32 size_bytes);
+
+/**
+ * gen7_hfi_queue_read - Read data from hfi queue
+ * @gmu: Pointer to the gen7 gmu device
+ * @queue_idx: queue id to read from
+ * @output: Pointer to read the data into
+ * @max_size: Number of bytes to read from the queue
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_queue_read(struct gen7_gmu_device *gmu, u32 queue_idx,
+		u32 *output, u32 max_size);
+
+/**
+ * gen7_receive_ack_cmd - Process ack type packets
+ * @gmu: Pointer to the gen7 gmu device
+ * @rcvd: Pointer to the data read from hfi queue
+ * @ret_cmd: Container for the hfi packet for which this ack is received
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_receive_ack_cmd(struct gen7_gmu_device *gmu, void *rcvd,
+		struct pending_cmd *ret_cmd);
+
+/**
+ * gen7_hfi_send_feature_ctrl - Enable gmu feature via hfi
+ * @adreno_dev: Pointer to the adreno device
+ * @feature: feature to be enabled or disabled
+ * enable: Set 1 to enable or 0 to disable a feature
+ * @data: payload for the send feature hfi packet
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_feature_ctrl(struct adreno_device *adreno_dev,
+		u32 feature, u32 enable, u32 data);
+
+/**
+ * gen7_hfi_send_get_value - Send gmu get_values via hfi
+ * @adreno_dev: Pointer to the adreno device
+ * @type: GMU get_value type
+ * @subtype: GMU get_value subtype
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_get_value(struct adreno_device *adreno_dev, u32 type, u32 subtype);
+
+/**
+ * gen7_hfi_send_set_value - Send gmu set_values via hfi
+ * @adreno_dev: Pointer to the adreno device
+ * @type: GMU set_value type
+ * @subtype: GMU set_value subtype
+ * @data: Value to set
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_set_value(struct adreno_device *adreno_dev,
+		u32 type, u32 subtype, u32 data);
+
+/**
+ * gen7_hfi_send_core_fw_start - Send the core fw start hfi
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_core_fw_start(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hfi_send_acd_feature_ctrl - Send the acd table and acd feature
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_acd_feature_ctrl(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hfi_send_generic_req - Send a generic hfi packet
+ * @adreno_dev: Pointer to the adreno device
+ * @cmd: Pointer to the hfi packet header and data
+ * @size_bytes: Size of the packet in bytes
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_generic_req(struct adreno_device *adreno_dev, void *cmd, u32 size_bytes);
+
+/**
+ * gen7_hfi_send_generic_req_v5 - Send a generic hfi packet with additional error handling
+ * @adreno_dev: Pointer to the adreno device
+ * @cmd: Pointer to the hfi packet header and data
+ * @ret_cmd: Ack for the command we just sent
+ * @size_bytes: Size of the packet in bytes
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_generic_req_v5(struct adreno_device *adreno_dev, void *cmd,
+		struct pending_cmd *ret_cmd, u32 size_bytes);
+
+/**
+ * gen7_hfi_send_bcl_feature_ctrl - Send the bcl feature hfi packet
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_bcl_feature_ctrl(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hfi_send_clx_feature_ctrl - Send the clx feature hfi packet
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_clx_feature_ctrl(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hfi_send_ifpc_feature_ctrl - Send the ipfc feature hfi packet
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_ifpc_feature_ctrl(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hfi_send_gpu_perf_table - Send the gpu perf table hfi packet
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_gpu_perf_table(struct adreno_device *adreno_dev);
+
+/*
+ * gen7_hfi_process_queue - Check hfi queue for messages from gmu
+ * @gmu: Pointer to the gen7 gmu device
+ * @queue_idx: queue id to be processed
+ * @ret_cmd: Container for data needed for waiting for the ack
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_process_queue(struct gen7_gmu_device *gmu,
+		u32 queue_idx, struct pending_cmd *ret_cmd);
+
+/**
+ * gen7_hfi_cmdq_write - Write a command to command queue
+ * @adreno_dev: Pointer to the adreno device
+ * @msg: Data to be written to the queue
+ * @size_bytes: Size of the command in bytes
+ *
+ * This function takes the cmdq lock before writing data to the queue
+
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_cmdq_write(struct adreno_device *adreno_dev, u32 *msg, u32 size_bytes);
+void adreno_gen7_receive_err_req(struct gen7_gmu_device *gmu, void *rcvd);
+void adreno_gen7_receive_debug_req(struct gen7_gmu_device *gmu, void *rcvd);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_hwsched.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_hwsched.c
@@ -0,0 +1,1943 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk.h>
+#include <linux/component.h>
+#include <linux/interconnect.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_gen7_hwsched.h"
+#include "adreno_snapshot.h"
+#include "kgsl_bus.h"
+#include "kgsl_device.h"
+#include "kgsl_trace.h"
+
+static void _wakeup_hw_fence_waiters(struct adreno_device *adreno_dev, u32 fault)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	bool lock = !in_interrupt();
+
+	if (!test_bit(ADRENO_HWSCHED_HW_FENCE, &adreno_dev->hwsched.flags))
+		return;
+
+	/*
+	 * We could be in interrupt context here, which means we need to use spin_lock_irqsave
+	 * (which disables interrupts) everywhere we take this lock. Instead of that, simply
+	 * avoid taking this lock if we are recording a fault from an interrupt handler.
+	 */
+	if (lock)
+		spin_lock(&hfi->hw_fence.lock);
+
+	clear_bit(GEN7_HWSCHED_HW_FENCE_SLEEP_BIT, &hfi->hw_fence.flags);
+
+	/* Avoid creating new hardware fences until recovery is complete */
+	set_bit(GEN7_HWSCHED_HW_FENCE_ABORT_BIT, &hfi->hw_fence.flags);
+
+	if (!lock)
+		/*
+		 * This barrier ensures that the above bitops complete before we wake up the waiters
+		 */
+		smp_wmb();
+	else
+		spin_unlock(&hfi->hw_fence.lock);
+
+	wake_up_all(&hfi->hw_fence.unack_wq);
+
+	del_timer_sync(&hfi->hw_fence_timer);
+}
+
+void gen7_hwsched_fault(struct adreno_device *adreno_dev, u32 fault)
+{
+	/*
+	 * Wake up any threads that may be sleeping waiting for the hardware fence unack count to
+	 * drop to a desired threshold.
+	 */
+	_wakeup_hw_fence_waiters(adreno_dev, fault);
+
+	adreno_hwsched_fault(adreno_dev, fault);
+}
+
+static size_t adreno_hwsched_snapshot_rb(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	struct kgsl_snapshot_rb_v2 *header = (struct kgsl_snapshot_rb_v2 *)buf;
+	u32 *data = (u32 *)(buf + sizeof(*header));
+	struct kgsl_memdesc *rb = (struct kgsl_memdesc *)priv;
+
+	if (remain < rb->size + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "RB");
+		return 0;
+	}
+
+	header->start = 0;
+	header->end = rb->size >> 2;
+	header->rptr = 0;
+	header->rbsize = rb->size >> 2;
+	header->count = rb->size >> 2;
+	header->timestamp_queued = 0;
+	header->timestamp_retired = 0;
+	header->gpuaddr = rb->gpuaddr;
+	header->id = 0;
+
+	memcpy(data, rb->hostptr, rb->size);
+
+	return rb->size + sizeof(*header);
+}
+
+static void gen7_hwsched_snapshot_preemption_record(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot, struct kgsl_memdesc *md, u64 offset)
+{
+	struct kgsl_snapshot_section_header *section_header =
+		(struct kgsl_snapshot_section_header *)snapshot->ptr;
+	u8 *dest = snapshot->ptr + sizeof(*section_header);
+	struct kgsl_snapshot_gpu_object_v2 *header =
+		(struct kgsl_snapshot_gpu_object_v2 *)dest;
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(ADRENO_DEVICE(device));
+	u64 ctxt_record_size = GEN7_CP_CTXRECORD_SIZE_IN_BYTES;
+	size_t section_size;
+
+	if (gen7_core->ctxt_record_size)
+		ctxt_record_size = gen7_core->ctxt_record_size;
+
+	ctxt_record_size = min_t(u64, ctxt_record_size, device->snapshot_ctxt_record_size);
+
+	section_size = sizeof(*section_header) + sizeof(*header) + ctxt_record_size;
+	if (snapshot->remain < section_size) {
+		SNAPSHOT_ERR_NOMEM(device, "PREEMPTION RECORD");
+		return;
+	}
+
+	section_header->magic = SNAPSHOT_SECTION_MAGIC;
+	section_header->id = KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2;
+	section_header->size = section_size;
+
+	header->size = ctxt_record_size >> 2;
+	header->gpuaddr = md->gpuaddr + offset;
+	header->ptbase =
+		kgsl_mmu_pagetable_get_ttbr0(device->mmu.defaultpagetable);
+	header->type = SNAPSHOT_GPU_OBJECT_GLOBAL;
+
+	dest += sizeof(*header);
+
+	memcpy(dest, md->hostptr + offset, ctxt_record_size);
+
+	snapshot->ptr += section_header->size;
+	snapshot->remain -= section_header->size;
+	snapshot->size += section_header->size;
+}
+
+static void snapshot_preemption_records(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot, struct kgsl_memdesc *md)
+{
+	const struct adreno_gen7_core *gen7_core =
+		to_gen7_core(ADRENO_DEVICE(device));
+	u64 ctxt_record_size = GEN7_CP_CTXRECORD_SIZE_IN_BYTES;
+	u64 offset;
+
+	if (gen7_core->ctxt_record_size)
+		ctxt_record_size = gen7_core->ctxt_record_size;
+
+	/* All preemption records exist as a single mem alloc entry */
+	for (offset = 0; offset < md->size; offset += ctxt_record_size)
+		gen7_hwsched_snapshot_preemption_record(device, snapshot, md,
+			offset);
+}
+
+static void *get_rb_hostptr(struct adreno_device *adreno_dev,
+	u64 gpuaddr, u32 size)
+{
+	struct gen7_hwsched_hfi *hw_hfi = to_gen7_hwsched_hfi(adreno_dev);
+	u64 offset;
+	u32 i;
+
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct kgsl_memdesc *md = hw_hfi->mem_alloc_table[i].md;
+
+		if (md && (gpuaddr >= md->gpuaddr) &&
+			((gpuaddr + size) <= (md->gpuaddr + md->size))) {
+			offset = gpuaddr - md->gpuaddr;
+			return md->hostptr + offset;
+		}
+	}
+
+	return NULL;
+}
+
+static u32 gen7_copy_gpu_global(void *out, void *in, u32 size)
+{
+	if (out && in) {
+		memcpy(out, in, size);
+		return size;
+	}
+
+	return 0;
+}
+
+static void adreno_hwsched_snapshot_rb_payload(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot, struct payload_section *payload)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_snapshot_section_header *section_header =
+		(struct kgsl_snapshot_section_header *)snapshot->ptr;
+	u8 *buf = snapshot->ptr + sizeof(*section_header);
+	struct kgsl_snapshot_rb_v2 *header = (struct kgsl_snapshot_rb_v2 *)buf;
+	u32 *data = (u32 *)(buf + sizeof(*header));
+	u32 size = adreno_hwsched_parse_payload(payload, KEY_RB_SIZEDWORDS) << 2;
+	u64 lo, hi, gpuaddr;
+	void *rb_hostptr;
+	char str[16];
+
+	lo = adreno_hwsched_parse_payload(payload, KEY_RB_GPUADDR_LO);
+	hi = adreno_hwsched_parse_payload(payload, KEY_RB_GPUADDR_HI);
+	gpuaddr = hi << 32 | lo;
+
+	/* Sanity check to make sure there is enough for the header */
+	if (snapshot->remain < sizeof(*section_header))
+		goto err;
+
+	rb_hostptr = get_rb_hostptr(adreno_dev, gpuaddr, size);
+
+	/* If the gpuaddress and size don't match any allocation, then abort */
+	if (((snapshot->remain - sizeof(*section_header)) <
+	    (size + sizeof(*header))) ||
+	    !gen7_copy_gpu_global(data, rb_hostptr, size))
+		goto err;
+
+	if (device->dump_all_ibs) {
+		u64 rbaddr, lpac_rbaddr;
+
+		kgsl_regread64(device, GEN7_CP_RB_BASE,
+			       GEN7_CP_RB_BASE_HI, &rbaddr);
+		kgsl_regread64(device, GEN7_CP_LPAC_RB_BASE,
+			       GEN7_CP_LPAC_RB_BASE_HI, &lpac_rbaddr);
+
+		/* Parse all IBs from current RB */
+		if ((rbaddr == gpuaddr) || (lpac_rbaddr == gpuaddr))
+			adreno_snapshot_dump_all_ibs(device, rb_hostptr, snapshot);
+	}
+
+	header->start = 0;
+	header->end = size >> 2;
+	header->rptr = adreno_hwsched_parse_payload(payload, KEY_RB_RPTR);
+	header->wptr = adreno_hwsched_parse_payload(payload, KEY_RB_WPTR);
+	header->rbsize = size >> 2;
+	header->count = size >> 2;
+	header->timestamp_queued = adreno_hwsched_parse_payload(payload,
+			KEY_RB_QUEUED_TS);
+	header->timestamp_retired = adreno_hwsched_parse_payload(payload,
+			KEY_RB_RETIRED_TS);
+	header->gpuaddr = gpuaddr;
+	header->id = adreno_hwsched_parse_payload(payload, KEY_RB_ID);
+
+	section_header->magic = SNAPSHOT_SECTION_MAGIC;
+	section_header->id = KGSL_SNAPSHOT_SECTION_RB_V2;
+	section_header->size = size + sizeof(*header) + sizeof(*section_header);
+
+	snapshot->ptr += section_header->size;
+	snapshot->remain -= section_header->size;
+	snapshot->size += section_header->size;
+
+	return;
+err:
+	snprintf(str, sizeof(str), "RB addr:0x%llx", gpuaddr);
+	SNAPSHOT_ERR_NOMEM(device, str);
+	return;
+}
+
+static bool parse_payload_rb_legacy(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct hfi_context_bad_cmd_legacy *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+	bool ret = false;
+
+	/* Skip if we didn't receive a context bad HFI */
+	if (!cmd->hdr)
+		return false;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd_legacy, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == PAYLOAD_RB) {
+			adreno_hwsched_snapshot_rb_payload(adreno_dev,
+							   snapshot, payload);
+			ret = true;
+		}
+
+		i += sizeof(*payload) + (payload->dwords << 2);
+	}
+
+	return ret;
+}
+
+static bool parse_payload_rb(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct hfi_context_bad_cmd *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+	bool ret = false;
+
+	/* Skip if we didn't receive a context bad HFI */
+	if (!cmd->hdr)
+		return false;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == PAYLOAD_RB) {
+			adreno_hwsched_snapshot_rb_payload(adreno_dev,
+							   snapshot, payload);
+			ret = true;
+		}
+
+		i += sizeof(*payload) + (payload->dwords << 2);
+	}
+
+	return ret;
+}
+
+static int snapshot_context_queue(int id, void *ptr, void *data)
+{
+	struct kgsl_snapshot *snapshot = data;
+	struct kgsl_context *context = ptr;
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	struct gmu_mem_type_desc desc;
+
+	if (!context->gmu_registered)
+		return 0;
+
+	desc.memdesc = &drawctxt->gmu_context_queue;
+	desc.type = SNAPSHOT_GMU_MEM_CONTEXT_QUEUE;
+
+	kgsl_snapshot_add_section(context->device,
+		KGSL_SNAPSHOT_SECTION_GMU_MEMORY,
+		snapshot, gen7_snapshot_gmu_mem, &desc);
+
+	return 0;
+}
+
+/* Snapshot AQE buffer */
+static size_t snapshot_aqe_buffer(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	struct kgsl_memdesc *memdesc = priv;
+
+	struct kgsl_snapshot_gpu_object_v2 *header =
+		(struct kgsl_snapshot_gpu_object_v2 *)buf;
+
+	u8 *ptr = buf + sizeof(*header);
+
+	if (IS_ERR_OR_NULL(memdesc) || memdesc->size == 0)
+		return 0;
+
+	if (remain < (memdesc->size + sizeof(*header))) {
+		SNAPSHOT_ERR_NOMEM(device, "AQE BUFFER");
+		return 0;
+	}
+
+	header->size = memdesc->size >> 2;
+	header->gpuaddr = memdesc->gpuaddr;
+	header->ptbase = MMU_DEFAULT_TTBR0(device);
+	header->type = SNAPSHOT_GPU_OBJECT_GLOBAL;
+
+	memcpy(ptr, memdesc->hostptr, memdesc->size);
+
+	return memdesc->size + sizeof(*header);
+}
+
+void gen7_hwsched_snapshot(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_hwsched_hfi *hw_hfi = to_gen7_hwsched_hfi(adreno_dev);
+	bool skip_memkind_rb = false;
+	u32 i;
+	bool parse_payload;
+
+	gen7_gmu_snapshot(adreno_dev, snapshot);
+
+	adreno_hwsched_parse_fault_cmdobj(adreno_dev, snapshot);
+
+	/*
+	 * First try to dump ringbuffers using context bad HFI payloads
+	 * because they have all the ringbuffer parameters. If ringbuffer
+	 * payloads are not present, fall back to dumping ringbuffers
+	 * based on MEMKIND_RB
+	 */
+	if (GMU_VER_MINOR(gmu->ver.hfi) < 2)
+		parse_payload = parse_payload_rb_legacy(adreno_dev, snapshot);
+	else
+		parse_payload = parse_payload_rb(adreno_dev, snapshot);
+
+	if (parse_payload)
+		skip_memkind_rb = true;
+
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct hfi_mem_alloc_entry *entry = &hw_hfi->mem_alloc_table[i];
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_RB && !skip_memkind_rb)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_RB_V2,
+				snapshot, adreno_hwsched_snapshot_rb,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_SCRATCH)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, adreno_snapshot_global,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_PROFILE)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, adreno_snapshot_global,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_CSW_SMMU_INFO)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, adreno_snapshot_global,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_CSW_PRIV_NON_SECURE)
+			snapshot_preemption_records(device, snapshot,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_PREEMPT_SCRATCH)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, adreno_snapshot_global,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_AQE_BUFFER)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, snapshot_aqe_buffer,
+				entry->md);
+
+		if (entry->desc.mem_kind == HFI_MEMKIND_HW_FENCE) {
+			struct gmu_mem_type_desc desc;
+
+			desc.memdesc = entry->md;
+			desc.type = SNAPSHOT_GMU_MEM_HW_FENCE;
+
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GMU_MEMORY,
+				snapshot, gen7_snapshot_gmu_mem, &desc);
+		}
+
+	}
+
+	if (!adreno_hwsched_context_queue_enabled(adreno_dev))
+		return;
+
+	read_lock(&device->context_lock);
+	idr_for_each(&device->context_idr, snapshot_context_queue, snapshot);
+	read_unlock(&device->context_lock);
+}
+
+static int gmu_clock_set_rate(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	/* Switch to min GMU clock */
+	gen7_rdpm_cx_freq_update(gmu, gmu->freqs[0] / 1000);
+
+	ret = kgsl_clk_set_rate(gmu->clks, gmu->num_clks, "gmu_clk",
+			gmu->freqs[0]);
+	if (ret)
+		dev_err(&gmu->pdev->dev, "GMU clock:%d set failed:%d\n",
+			gmu->freqs[0], ret);
+
+	trace_kgsl_gmu_pwrlevel(gmu->freqs[0], gmu->freqs[GMU_MAX_PWRLEVELS - 1]);
+
+	return ret;
+}
+
+static int gen7_hwsched_gmu_first_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int level, ret = 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_AWARE);
+
+	gen7_gmu_aop_send_acd_state(gmu, adreno_dev->acd_enabled);
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (ret)
+		return ret;
+
+	ret = gen7_gmu_enable_clks(adreno_dev, GMU_MAX_PWRLEVELS - 1);
+	if (ret)
+		goto gdsc_off;
+
+	/* Initialize the CX timer */
+	gen7_cx_timer_init(adreno_dev);
+
+	ret = gen7_gmu_load_fw(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = gen7_gmu_itcm_shadow(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	if (!test_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags)) {
+		ret = gen7_load_pdc_ucode(adreno_dev);
+		if (ret)
+			goto clks_gdsc_off;
+
+		gen7_load_rsc_ucode(adreno_dev);
+		set_bit(GMU_PRIV_PDC_RSC_LOADED, &gmu->flags);
+	}
+
+	ret = gen7_scm_gpu_init_cx_regs(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	gen7_gmu_register_config(adreno_dev);
+
+	ret = gen7_gmu_version_info(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	if (GMU_VER_MINOR(gmu->ver.hfi) < 2)
+		set_bit(ADRENO_HWSCHED_CTX_BAD_LEGACY, &adreno_dev->hwsched.flags);
+
+	gen7_gmu_irq_enable(adreno_dev);
+
+	/* Vote for minimal DDR BW for GMU to init */
+	level = pwr->pwrlevels[pwr->default_pwrlevel].bus_min;
+
+	icc_set_bw(pwr->icc_path, 0, kBps_to_icc(pwr->ddr_table[level]));
+
+	ret = gen7_gmu_device_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	gen7_get_gpu_feature_info(adreno_dev);
+
+	ret = gen7_hwsched_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gmu_clock_set_rate(adreno_dev);
+	if (ret) {
+		gen7_hwsched_hfi_stop(adreno_dev);
+		goto err;
+	}
+
+	if (gen7_hwsched_hfi_get_value(adreno_dev, HFI_VALUE_GMU_AB_VOTE) == 1) {
+		adreno_dev->gmu_ab = true;
+		set_bit(ADRENO_DEVICE_GMU_AB, &adreno_dev->priv);
+	}
+
+	icc_set_bw(pwr->icc_path, 0, 0);
+
+	device->gmu_fault = false;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return 0;
+
+err:
+	gen7_gmu_irq_disable(adreno_dev);
+
+	if (device->gmu_fault) {
+		gen7_gmu_suspend(adreno_dev);
+
+		return ret;
+	}
+
+clks_gdsc_off:
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+gdsc_off:
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	gen7_rdpm_cx_freq_update(gmu, 0);
+
+	return ret;
+}
+
+static int gen7_hwsched_gmu_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_AWARE);
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (ret)
+		return ret;
+
+	ret = gen7_gmu_enable_clks(adreno_dev, GMU_MAX_PWRLEVELS - 1);
+	if (ret)
+		goto gdsc_off;
+
+	ret = gen7_rscc_wakeup_sequence(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	ret = gen7_gmu_load_fw(adreno_dev);
+	if (ret)
+		goto clks_gdsc_off;
+
+	gen7_gmu_register_config(adreno_dev);
+
+	gen7_gmu_irq_enable(adreno_dev);
+
+	ret = gen7_gmu_device_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hwsched_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gmu_clock_set_rate(adreno_dev);
+	if (ret) {
+		gen7_hwsched_hfi_stop(adreno_dev);
+		goto err;
+	}
+
+	device->gmu_fault = false;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return 0;
+err:
+	gen7_gmu_irq_disable(adreno_dev);
+
+	if (device->gmu_fault) {
+		gen7_gmu_suspend(adreno_dev);
+
+		return ret;
+	}
+
+clks_gdsc_off:
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+gdsc_off:
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	gen7_rdpm_cx_freq_update(gmu, 0);
+
+	return ret;
+}
+
+void gen7_hwsched_active_count_put(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (WARN(atomic_read(&device->active_cnt) == 0,
+		"Unbalanced get/put calls to KGSL active count\n"))
+		return;
+
+	if (atomic_dec_and_test(&device->active_cnt)) {
+		kgsl_pwrscale_update_stats(device);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+	}
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	wake_up(&device->active_cnt_wq);
+}
+
+static int gen7_hwsched_notify_slumber(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct hfi_prep_slumber_cmd req;
+	int ret;
+
+	ret = CMD_MSG_HDR(req, H2F_MSG_PREPARE_SLUMBER);
+	if (ret)
+		return ret;
+
+	req.freq = gmu->dcvs_table.gpu_level_num - pwr->default_pwrlevel - 1;
+	req.bw = pwr->pwrlevels[pwr->default_pwrlevel].bus_freq;
+
+	req.bw |= gen7_bus_ab_quantize(adreno_dev, 0);
+	/* Disable the power counter so that the GMU is not busy */
+	gmu_core_regwrite(device, GEN7_GMU_CX_GMU_POWER_COUNTER_ENABLE, 0);
+
+	return gen7_hfi_send_cmd_async(adreno_dev, &req, sizeof(req));
+
+}
+static int gen7_hwsched_gmu_power_off(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	if (device->gmu_fault)
+		goto error;
+
+	/* Wait for the lowest idle level we requested */
+	ret = gen7_gmu_wait_for_lowest_idle(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = gen7_hwsched_notify_slumber(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = gen7_gmu_wait_for_idle(adreno_dev);
+	if (ret)
+		goto error;
+
+	ret = gen7_rscc_sleep_sequence(adreno_dev);
+
+	gen7_rdpm_mx_freq_update(gmu, 0);
+
+	/* Now that we are done with GMU and GPU, Clear the GBIF */
+	ret = gen7_halt_gbif(adreno_dev);
+
+	gen7_gmu_irq_disable(adreno_dev);
+
+	gen7_hwsched_hfi_stop(adreno_dev);
+
+	clk_bulk_disable_unprepare(gmu->num_clks, gmu->clks);
+
+	kgsl_pwrctrl_disable_cx_gdsc(device);
+
+	gen7_rdpm_cx_freq_update(gmu, 0);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_NONE);
+
+	return ret;
+
+error:
+	gen7_gmu_irq_disable(adreno_dev);
+	gen7_hwsched_hfi_stop(adreno_dev);
+	gen7_gmu_suspend(adreno_dev);
+
+	return ret;
+}
+
+static void gen7_hwsched_init_ucode_regs(struct adreno_device *adreno_dev)
+{
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_SQE);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Program the ucode base for CP */
+	kgsl_regwrite(device, GEN7_CP_SQE_INSTR_BASE_LO,
+		lower_32_bits(fw->memdesc->gpuaddr));
+	kgsl_regwrite(device, GEN7_CP_SQE_INSTR_BASE_HI,
+		upper_32_bits(fw->memdesc->gpuaddr));
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_AQE)) {
+		fw = ADRENO_FW(adreno_dev, ADRENO_FW_AQE);
+
+		/* Program the ucode base for AQE0 (BV coprocessor) */
+		kgsl_regwrite(device, GEN7_CP_AQE_INSTR_BASE_LO_0,
+			lower_32_bits(fw->memdesc->gpuaddr));
+		kgsl_regwrite(device, GEN7_CP_AQE_INSTR_BASE_HI_0,
+			upper_32_bits(fw->memdesc->gpuaddr));
+
+		/* Program the ucode base for AQE1 (LPAC coprocessor) */
+		if (adreno_dev->lpac_enabled) {
+			kgsl_regwrite(device, GEN7_CP_AQE_INSTR_BASE_LO_1,
+				      lower_32_bits(fw->memdesc->gpuaddr));
+			kgsl_regwrite(device, GEN7_CP_AQE_INSTR_BASE_HI_1,
+				      upper_32_bits(fw->memdesc->gpuaddr));
+		}
+	}
+}
+
+static int gen7_hwsched_gpu_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/* Clear any GPU faults that might have been left over */
+	adreno_clear_gpu_fault(adreno_dev);
+
+	ret = kgsl_mmu_start(device);
+	if (ret)
+		goto err;
+
+	ret = gen7_gmu_oob_set(device, oob_gpu);
+	if (ret)
+		goto err;
+
+	/* Clear the busy_data stats - we're starting over from scratch */
+	memset(&adreno_dev->busy_data, 0, sizeof(adreno_dev->busy_data));
+
+	gen7_start(adreno_dev);
+
+	/* Re-initialize the coresight registers if applicable */
+	adreno_coresight_start(adreno_dev);
+
+	adreno_perfcounter_start(adreno_dev);
+
+	/* Clear FSR here in case it is set from a previous pagefault */
+	kgsl_mmu_clear_fsr(&device->mmu);
+
+	gen7_enable_gpu_irq(adreno_dev);
+
+	gen7_hwsched_init_ucode_regs(adreno_dev);
+
+	ret = gen7_hwsched_boot_gpu(adreno_dev);
+	if (ret)
+		goto err;
+
+	/*
+	 * At this point it is safe to assume that we recovered. Setting
+	 * this field allows us to take a new snapshot for the next failure
+	 * if we are prioritizing the first unrecoverable snapshot.
+	 */
+	if (device->snapshot)
+		device->snapshot->recovered = true;
+
+	device->reset_counter++;
+
+	/*
+	 * If warmboot is enabled and we switched a sysfs node, we will do a coldboot
+	 * in the subseqent slumber exit. Once that is done we need to mark this bool
+	 * as false so that in the next run we can do warmboot
+	 */
+	clear_bit(ADRENO_DEVICE_FORCE_COLDBOOT, &adreno_dev->priv);
+err:
+	gen7_gmu_oob_clear(device, oob_gpu);
+
+	if (ret)
+		gen7_hwsched_gmu_power_off(adreno_dev);
+
+	return ret;
+}
+
+static void hwsched_idle_timer(struct timer_list *t)
+{
+	struct kgsl_device *device = container_of(t, struct kgsl_device,
+					idle_timer);
+
+	kgsl_schedule_work(&device->idle_check_ws);
+}
+
+static int gen7_gmu_warmboot_init(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_GMU_WARMBOOT))
+		return ret;
+
+	if (IS_ERR_OR_NULL(gmu->gmu_init_scratch)) {
+		gmu->gmu_init_scratch = gen7_reserve_gmu_kernel_block(gmu, 0,
+				SZ_4K, GMU_CACHE, 0);
+		ret = PTR_ERR_OR_ZERO(gmu->gmu_init_scratch);
+		if (ret)
+			return ret;
+	}
+
+	if (IS_ERR_OR_NULL(gmu->gpu_boot_scratch)) {
+		gmu->gpu_boot_scratch = gen7_reserve_gmu_kernel_block(gmu, 0,
+				SZ_4K, GMU_CACHE, 0);
+		ret = PTR_ERR_OR_ZERO(gmu->gpu_boot_scratch);
+	}
+
+	return ret;
+}
+
+static int gen7_hwsched_gmu_memory_init(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	/* GMU Virtual register bank */
+	if (IS_ERR_OR_NULL(gmu->vrb)) {
+		gmu->vrb = gen7_reserve_gmu_kernel_block(gmu, 0, GMU_VRB_SIZE,
+						GMU_NONCACHED_KERNEL, 0);
+
+		if (IS_ERR(gmu->vrb))
+			return PTR_ERR(gmu->vrb);
+
+		/* Populate size of the virtual register bank */
+		gmu_core_set_vrb_register(gmu->vrb->hostptr, VRB_SIZE_IDX,
+					gmu->vrb->size >> 2);
+	}
+
+	/* GMU trace log */
+	if (IS_ERR_OR_NULL(gmu->trace.md)) {
+		gmu->trace.md = gen7_reserve_gmu_kernel_block(gmu, 0,
+					GMU_TRACE_SIZE, GMU_NONCACHED_KERNEL, 0);
+
+		if (IS_ERR(gmu->trace.md))
+			return PTR_ERR(gmu->trace.md);
+
+		/* Pass trace buffer address to GMU through the VRB */
+		gmu_core_set_vrb_register(gmu->vrb->hostptr,
+					VRB_TRACE_BUFFER_ADDR_IDX,
+					gmu->trace.md->gmuaddr);
+
+		/* Initialize the GMU trace buffer header */
+		gmu_core_trace_header_init(&gmu->trace);
+	}
+
+	return 0;
+}
+
+static int gen7_hwsched_gmu_init(struct adreno_device *adreno_dev)
+{
+	int ret;
+
+	ret = gen7_gmu_parse_fw(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_gmu_memory_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_gmu_warmboot_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_hwsched_gmu_memory_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	return gen7_hwsched_hfi_init(adreno_dev);
+}
+
+static void gen7_hwsched_touch_wakeup(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	/*
+	 * Do not wake up a suspended device or until the first boot sequence
+	 * has been completed.
+	 */
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags) ||
+		!test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags))
+		return;
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		goto done;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = gen7_hwsched_gmu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	ret = gen7_hwsched_gpu_boot(adreno_dev);
+	if (ret)
+		return;
+
+	kgsl_pwrscale_wake(device);
+
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+done:
+	/*
+	 * When waking up from a touch event we want to stay active long enough
+	 * for the user to send a draw command. The default idle timer timeout
+	 * is shorter than we want so go ahead and push the idle timer out
+	 * further for this special case
+	 */
+	mod_timer(&device->idle_timer, jiffies +
+		msecs_to_jiffies(adreno_wake_timeout));
+}
+
+static int gen7_hwsched_boot(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	adreno_hwsched_start(adreno_dev);
+
+	ret = gen7_hwsched_gmu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_hwsched_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_start_idle_timer(device);
+	kgsl_pwrscale_wake(device);
+
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	return ret;
+}
+
+static int gen7_aqe_microcode_read(struct adreno_device *adreno_dev)
+{
+	struct adreno_firmware *aqe_fw = ADRENO_FW(adreno_dev, ADRENO_FW_AQE);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_AQE))
+		return 0;
+
+	return adreno_get_firmware(adreno_dev, gen7_core->aqefw_name, aqe_fw);
+}
+
+static int gen7_hwsched_first_boot(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags))
+		return gen7_hwsched_boot(adreno_dev);
+
+	adreno_hwsched_start(adreno_dev);
+
+	ret = gen7_microcode_read(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_aqe_microcode_read(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_hwsched_gmu_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_ACTIVE);
+
+	ret = gen7_hwsched_gmu_first_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = gen7_hwsched_gpu_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	adreno_get_bus_counters(adreno_dev);
+
+	adreno_dev->cooperative_reset = ADRENO_FEATURE(adreno_dev,
+						 ADRENO_COOP_RESET);
+
+	set_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags);
+	set_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	/*
+	 * BCL needs respective Central Broadcast register to
+	 * be programed from TZ. This programing happens only
+	 * when zap shader firmware load is successful. Zap firmware
+	 * load can fail in boot up path hence enable BCL only after we
+	 * successfully complete first boot to ensure that Central
+	 * Broadcast register was programed before enabling BCL.
+	 */
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_BCL))
+		adreno_dev->bcl_enabled = true;
+
+	/*
+	 * There is a possible deadlock scenario during kgsl firmware reading
+	 * (request_firmware) and devfreq update calls. During first boot, kgsl
+	 * device mutex is held and then request_firmware is called for reading
+	 * firmware. request_firmware internally takes dev_pm_qos_mtx lock.
+	 * Whereas in case of devfreq update calls triggered by thermal/bcl or
+	 * devfreq sysfs, it first takes the same dev_pm_qos_mtx lock and then
+	 * tries to take kgsl device mutex as part of get_dev_status/target
+	 * calls. This results in deadlock when both thread are unable to acquire
+	 * the mutex held by other thread. Enable devfreq updates now as we are
+	 * done reading all firmware files.
+	 */
+	device->pwrscale.devfreq_enabled = true;
+
+	device->pwrctrl.last_stat_updated = ktime_get();
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+	return 0;
+}
+
+/**
+ * drain_ctx_hw_fences_cpu - Force trigger the hardware fences that
+ * were not sent to TxQueue by the GMU
+ */
+static void drain_ctx_hw_fences_cpu(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	struct adreno_hw_fence_entry *entry, *tmp;
+
+	spin_lock(&drawctxt->lock);
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_inflight_list, node) {
+		gen7_trigger_hw_fence_cpu(adreno_dev, entry);
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+	}
+	spin_unlock(&drawctxt->lock);
+}
+
+static void drain_hw_fences_cpu(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_context *context;
+	int id;
+
+	read_lock(&device->context_lock);
+	idr_for_each_entry(&device->context_idr, context, id) {
+		if (context->gmu_registered)
+			drain_ctx_hw_fences_cpu(adreno_dev, ADRENO_CONTEXT(context));
+	}
+	read_unlock(&device->context_lock);
+}
+
+/**
+ * check_inflight_hw_fences - During SLUMBER entry, we must make sure all hardware fences across
+ * all registered contexts have been sent to TxQueue. If not, take a snapshot
+ */
+static int check_inflight_hw_fences(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_context *context;
+	int id, ret = 0;
+
+	if (!test_bit(ADRENO_HWSCHED_HW_FENCE, &hwsched->flags))
+		return 0;
+
+	read_lock(&device->context_lock);
+	idr_for_each_entry(&device->context_idr, context, id) {
+
+		if (context->gmu_registered) {
+			ret = gen7_hwsched_check_context_inflight_hw_fences(adreno_dev,
+				ADRENO_CONTEXT(context));
+			if (ret)
+				break;
+		}
+	}
+	read_unlock(&device->context_lock);
+
+	if (ret)
+		gmu_core_fault_snapshot(device);
+
+	return ret;
+}
+
+static int gen7_hwsched_power_off(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+	bool drain_cpu = false;
+
+	if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SLUMBER);
+
+	ret = gen7_gmu_oob_set(device, oob_gpu);
+	if (ret) {
+		gen7_gmu_oob_clear(device, oob_gpu);
+		goto no_gx_power;
+	}
+
+	kgsl_pwrscale_update_stats(device);
+
+	/* Save active coresight registers if applicable */
+	adreno_coresight_stop(adreno_dev);
+
+	adreno_irqctrl(adreno_dev, 0);
+
+	gen7_gmu_oob_clear(device, oob_gpu);
+
+no_gx_power:
+	kgsl_pwrctrl_irq(device, false);
+
+	/* Make sure GMU has sent all hardware fences to TxQueue */
+	if (check_inflight_hw_fences(adreno_dev))
+		drain_cpu = true;
+
+	gen7_hwsched_gmu_power_off(adreno_dev);
+
+	/* Now that we are sure that GMU is powered off, drain pending fences */
+	if (drain_cpu)
+		drain_hw_fences_cpu(adreno_dev);
+
+	adreno_hwsched_unregister_contexts(adreno_dev);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpu_llc_slice);
+
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		llcc_slice_deactivate(adreno_dev->gpuhtw_llc_slice);
+
+	clear_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	del_timer_sync(&device->idle_timer);
+
+	kgsl_pwrscale_sleep(device);
+
+	kgsl_pwrctrl_clear_l3_vote(device);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SLUMBER);
+
+	return ret;
+}
+
+static void check_hw_fence_unack_count(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 unack_count;
+
+	if (!test_bit(ADRENO_HWSCHED_HW_FENCE, &adreno_dev->hwsched.flags))
+		return;
+
+	gen7_hwsched_process_msgq(adreno_dev);
+
+	spin_lock(&hfi->hw_fence.lock);
+	unack_count = hfi->hw_fence.unack_count;
+	spin_unlock(&hfi->hw_fence.lock);
+
+	if (!unack_count)
+		return;
+
+	dev_err(&gmu->pdev->dev, "hardware fence unack_count(%d) isn't zero before SLUMBER\n",
+		unack_count);
+	gmu_core_fault_snapshot(device);
+}
+
+static void hwsched_idle_check(struct work_struct *work)
+{
+	struct kgsl_device *device = container_of(work,
+					struct kgsl_device, idle_check_ws);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	mutex_lock(&device->mutex);
+
+	if (test_bit(GMU_DISABLE_SLUMBER, &device->gmu_core.flags))
+		goto done;
+
+	if (atomic_read(&device->active_cnt) || time_is_after_jiffies(device->idle_jiffies)) {
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	spin_lock(&device->submit_lock);
+	if (device->submit_now) {
+		spin_unlock(&device->submit_lock);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		goto done;
+	}
+
+	device->skip_inline_submit = true;
+	spin_unlock(&device->submit_lock);
+
+	if (!gen7_hw_isidle(adreno_dev)) {
+		dev_err(device->dev, "GPU isn't idle before SLUMBER\n");
+		gmu_core_fault_snapshot(device);
+	}
+
+	check_hw_fence_unack_count(adreno_dev);
+
+	gen7_hwsched_power_off(adreno_dev);
+
+done:
+	mutex_unlock(&device->mutex);
+}
+
+static int gen7_hwsched_first_open(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	/*
+	 * Do the one time settings that need to happen when we
+	 * attempt to boot the gpu the very first time
+	 */
+	ret = gen7_hwsched_first_boot(adreno_dev);
+	if (ret)
+		return ret;
+
+	/*
+	 * A client that does a first_open but never closes the device
+	 * may prevent us from going back to SLUMBER. So trigger the idle
+	 * check by incrementing the active count and immediately releasing it.
+	 */
+	atomic_inc(&device->active_cnt);
+	gen7_hwsched_active_count_put(adreno_dev);
+
+	return 0;
+}
+
+int gen7_hwsched_active_count_get(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EINVAL;
+
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags))
+		return -EINVAL;
+
+	if ((atomic_read(&device->active_cnt) == 0))
+		ret = gen7_hwsched_boot(adreno_dev);
+
+	if (ret == 0)
+		atomic_inc(&device->active_cnt);
+
+	trace_kgsl_active_count(device,
+		(unsigned long) __builtin_return_address(0));
+
+	return ret;
+}
+
+static int gen7_hwsched_dcvs_set(struct adreno_device *adreno_dev,
+		int gpu_pwrlevel, int bus_level, u32 ab)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_dcvs_table *table = &gmu->dcvs_table;
+	struct hfi_gx_bw_perf_vote_cmd req = {
+		.ack_type = DCVS_ACK_BLOCK,
+		.freq = INVALID_DCVS_IDX,
+		.bw = INVALID_DCVS_IDX,
+	};
+	int ret;
+
+	if (!test_bit(GMU_PRIV_HFI_STARTED, &gmu->flags))
+		return 0;
+
+	/* Do not set to XO and lower GPU clock vote from GMU */
+	if ((gpu_pwrlevel != INVALID_DCVS_IDX) &&
+			(gpu_pwrlevel >= table->gpu_level_num - 1)) {
+		dev_err(&gmu->pdev->dev, "Invalid gpu dcvs request: %d\n",
+			gpu_pwrlevel);
+		return -EINVAL;
+	}
+
+	if (gpu_pwrlevel < table->gpu_level_num - 1)
+		req.freq = table->gpu_level_num - gpu_pwrlevel - 1;
+
+	if (bus_level < pwr->ddr_table_count && bus_level > 0)
+		req.bw = bus_level;
+
+	req.bw |=  gen7_bus_ab_quantize(adreno_dev, ab);
+
+	/* GMU will vote for slumber levels through the sleep sequence */
+	if ((req.freq == INVALID_DCVS_IDX) && (req.bw == INVALID_BW_VOTE))
+		return 0;
+
+	ret = CMD_MSG_HDR(req, H2F_MSG_GX_BW_PERF_VOTE);
+	if (ret)
+		return ret;
+
+	ret = gen7_hfi_send_cmd_async(adreno_dev, &req, sizeof(req));
+
+	if (ret) {
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"Failed to set GPU perf idx %d, bw idx %d\n",
+			req.freq, req.bw);
+
+		/*
+		 * If this was a dcvs request along side an active gpu, request
+		 * dispatcher based reset and recovery.
+		 */
+		if (test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+			gen7_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+	}
+
+	if (req.freq != INVALID_DCVS_IDX)
+		gen7_rdpm_mx_freq_update(gmu, gmu->dcvs_table.gx_votes[req.freq].freq);
+
+	return ret;
+}
+
+static int gen7_hwsched_clock_set(struct adreno_device *adreno_dev,
+	u32 pwrlevel)
+{
+	return gen7_hwsched_dcvs_set(adreno_dev, pwrlevel, INVALID_DCVS_IDX, INVALID_AB_VALUE);
+}
+
+static void scale_gmu_frequency(struct adreno_device *adreno_dev, int buslevel)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	static unsigned long prev_freq;
+	unsigned long freq = gmu->freqs[0];
+
+	if (!gmu->perf_ddr_bw)
+		return;
+
+	/*
+	 * Scale the GMU if DDR is at a CX corner at which GMU can run at
+	 * a higher frequency
+	 */
+	if (pwr->ddr_table[buslevel] >= gmu->perf_ddr_bw)
+		freq = gmu->freqs[GMU_MAX_PWRLEVELS - 1];
+
+	if (prev_freq == freq)
+		return;
+
+	if (kgsl_clk_set_rate(gmu->clks, gmu->num_clks, "gmu_clk", freq)) {
+		dev_err(&gmu->pdev->dev, "Unable to set the GMU clock to %ld\n",
+			freq);
+		return;
+	}
+
+	gen7_rdpm_cx_freq_update(gmu, freq / 1000);
+
+	trace_kgsl_gmu_pwrlevel(freq, prev_freq);
+
+	prev_freq = freq;
+}
+
+static int gen7_hwsched_bus_set(struct adreno_device *adreno_dev, int buslevel,
+	u32 ab)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret = 0;
+
+	/* Target gen7_9_x votes for perfmode through ACV. Skip icc path for same */
+	if (!adreno_is_gen7_9_x(adreno_dev))
+		kgsl_icc_set_tag(pwr, buslevel);
+
+	if (buslevel == pwr->cur_buslevel)
+		buslevel = INVALID_DCVS_IDX;
+
+	if ((ab == pwr->cur_ab) || (ab == 0))
+		ab = INVALID_AB_VALUE;
+
+	if ((ab == INVALID_AB_VALUE) && (buslevel == INVALID_DCVS_IDX))
+		return 0;
+
+	ret = gen7_hwsched_dcvs_set(adreno_dev, INVALID_DCVS_IDX,
+			buslevel, ab);
+	if (ret)
+		return ret;
+
+	if (buslevel != INVALID_DCVS_IDX) {
+		scale_gmu_frequency(adreno_dev, buslevel);
+
+		pwr->cur_buslevel = buslevel;
+	}
+
+	if (ab != INVALID_AB_VALUE) {
+		if (!adreno_dev->gmu_ab)
+			icc_set_bw(pwr->icc_path, MBps_to_icc(ab), 0);
+		pwr->cur_ab = ab;
+	}
+
+	trace_kgsl_buslevel(device, pwr->active_pwrlevel, buslevel, ab);
+	return ret;
+}
+
+static int gen7_hwsched_pm_suspend(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	if (test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags))
+		return 0;
+
+	kgsl_pwrctrl_request_state(device, KGSL_STATE_SUSPEND);
+
+	/* Halt any new submissions */
+	reinit_completion(&device->halt_gate);
+
+	/**
+	 * Wait for the dispatcher to retire everything by waiting
+	 * for the active count to go to zero.
+	 */
+	ret = kgsl_active_count_wait(device, 0, msecs_to_jiffies(100));
+	if (ret) {
+		dev_err(device->dev, "Timed out waiting for the active count\n");
+		goto err;
+	}
+
+	ret = adreno_hwsched_idle(adreno_dev);
+	if (ret)
+		goto err;
+
+	gen7_hwsched_power_off(adreno_dev);
+
+	adreno_get_gpu_halt(adreno_dev);
+
+	set_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags);
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SUSPEND);
+
+	return 0;
+
+err:
+	adreno_hwsched_start(adreno_dev);
+
+	return ret;
+}
+
+static void gen7_hwsched_pm_resume(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (WARN(!test_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags),
+		"resume invoked without a suspend\n"))
+		return;
+
+	adreno_put_gpu_halt(adreno_dev);
+
+	adreno_hwsched_start(adreno_dev);
+
+	clear_bit(GMU_PRIV_PM_SUSPEND, &gmu->flags);
+}
+
+void gen7_hwsched_handle_watchdog(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 mask;
+
+	/* Temporarily mask the watchdog interrupt to prevent a storm */
+	gmu_core_regread(device, GEN7_GMU_AO_HOST_INTERRUPT_MASK,
+		&mask);
+	gmu_core_regwrite(device, GEN7_GMU_AO_HOST_INTERRUPT_MASK,
+			(mask | GMU_INT_WDOG_BITE));
+
+	gen7_gmu_send_nmi(device, false);
+
+	dev_err_ratelimited(&gmu->pdev->dev,
+			"GMU watchdog expired interrupt received\n");
+
+	gen7_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+}
+
+static void gen7_hwsched_drain_ctxt_unregister(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct pending_cmd *cmd = NULL;
+
+	read_lock(&hfi->msglock);
+
+	list_for_each_entry(cmd, &hfi->msglist, node) {
+		if (MSG_HDR_GET_ID(cmd->sent_hdr) == H2F_MSG_UNREGISTER_CONTEXT)
+			complete(&cmd->complete);
+	}
+
+	read_unlock(&hfi->msglock);
+}
+
+/**
+ * process_context_hw_fences_after_reset - This function processes all hardware fences that were
+ * sent to GMU prior to recovery. If a fence is not retired by the GPU, and the context is still
+ * good, then move them to the reset list.
+ */
+static void process_context_hw_fences_after_reset(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, struct list_head *reset_list)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_hw_fence_entry *entry, *tmp;
+
+	spin_lock(&drawctxt->lock);
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_inflight_list, node) {
+		struct adreno_context *drawctxt = entry->drawctxt;
+		struct gmu_context_queue_header *hdr = drawctxt->gmu_context_queue.hostptr;
+		bool retired = kgsl_check_timestamp(device, &drawctxt->base, (u32)entry->cmd.ts);
+
+		/* Delete the fences that GMU has sent to the TxQueue */
+		if (timestamp_cmp(hdr->out_fence_ts, (u32)entry->cmd.ts) >= 0) {
+			gen7_remove_hw_fence_entry(adreno_dev, entry);
+			continue;
+		}
+
+		/*
+		 * Force retire the fences if the corresponding submission is retired by GPU
+		 * or if the context has gone bad
+		 */
+		if (retired || kgsl_context_is_bad(&drawctxt->base))
+			entry->cmd.flags |= HW_FENCE_FLAG_SKIP_MEMSTORE;
+
+		list_add_tail(&entry->reset_node, reset_list);
+	}
+	spin_unlock(&drawctxt->lock);
+}
+
+/**
+ * process_inflight_hw_fences_after_reset - Send hardware fences from all contexts back to the GMU
+ * after fault recovery. We must wait for ack when sending each of these fences to GMU so as to
+ * avoid sending a large number of hardware fences in a short span of time.
+ */
+static int process_inflight_hw_fences_after_reset(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_context *context = NULL;
+	int id, ret = 0;
+	struct list_head hw_fence_list;
+	struct adreno_hw_fence_entry *entry, *tmp;
+
+	/**
+	 * Since we need to wait for ack from GMU when sending each inflight fence back to GMU, we
+	 * cannot send them from within atomic context. Hence, walk list of such hardware fences
+	 * for each context and add it to this local list and then walk this list to send all these
+	 * fences to GMU.
+	 */
+	INIT_LIST_HEAD(&hw_fence_list);
+
+	read_lock(&device->context_lock);
+	idr_for_each_entry(&device->context_idr, context, id) {
+		process_context_hw_fences_after_reset(adreno_dev, ADRENO_CONTEXT(context),
+			&hw_fence_list);
+	}
+	read_unlock(&device->context_lock);
+
+	list_for_each_entry_safe(entry, tmp, &hw_fence_list, reset_node) {
+
+		/*
+		 * This is part of the reset sequence and any error in this path will be handled by
+		 * the caller.
+		 */
+		ret = gen7_send_hw_fence_hfi_wait_ack(adreno_dev, entry, 0);
+		if (ret)
+			break;
+
+		list_del_init(&entry->reset_node);
+	}
+
+	return ret;
+}
+
+/**
+ * process_detached_hw_fences_after_reset - Send fences that couldn't be sent to GMU when a context
+ * got detached. We must wait for ack when sending each of these fences to GMU so as to avoid
+ * sending a large number of hardware fences in a short span of time.
+ */
+static int process_detached_hw_fences_after_reset(struct adreno_device *adreno_dev)
+{
+	struct adreno_hw_fence_entry *entry, *tmp;
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct kgsl_context *context = NULL;
+	int ret = 0;
+
+	list_for_each_entry_safe(entry, tmp, &hfi->detached_hw_fence_list, node) {
+
+		/*
+		 * This is part of the reset sequence and any error in this path will be handled by
+		 * the caller.
+		 */
+		ret = gen7_send_hw_fence_hfi_wait_ack(adreno_dev, entry,
+			HW_FENCE_FLAG_SKIP_MEMSTORE);
+		if (ret)
+			return ret;
+
+		context = &entry->drawctxt->base;
+
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+
+		kgsl_context_put(context);
+	}
+
+	return ret;
+}
+
+static int drain_guilty_context_hw_fences(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_context *context = NULL;
+	struct adreno_context *guilty = NULL;
+	int id, ret = 0;
+
+	read_lock(&device->context_lock);
+	idr_for_each_entry(&device->context_idr, context, id) {
+		if (test_bit(KGSL_CONTEXT_PRIV_INVALID, &context->priv) &&
+			_kgsl_context_get(context)) {
+			guilty = ADRENO_CONTEXT(context);
+			break;
+		}
+	}
+	read_unlock(&device->context_lock);
+
+	if (!guilty)
+		return 0;
+
+	/*
+	 * We don't need drawctxt spinlock to signal these fences since the only other place
+	 * which can access these fences is the context detach path and device mutex
+	 * ensures mutual exclusion between recovery thread and detach thread.
+	 */
+	ret = gen7_hwsched_drain_context_hw_fences(adreno_dev, guilty);
+
+	kgsl_context_put(&guilty->base);
+
+	return ret;
+}
+
+static int handle_hw_fences_after_reset(struct adreno_device *adreno_dev)
+{
+	int ret;
+
+	ret = drain_guilty_context_hw_fences(adreno_dev);
+	if (ret)
+		return ret;
+
+	/*
+	 * We must do this after adreno_hwsched_replay() so that context registration
+	 * is done before we re-send the un-retired hardware fences to the GMU
+	 */
+	ret = process_inflight_hw_fences_after_reset(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = process_detached_hw_fences_after_reset(adreno_dev);
+	if (ret)
+		return ret;
+
+	return gen7_hwsched_disable_hw_fence_throttle(adreno_dev);
+}
+
+int gen7_hwsched_reset_replay(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	int ret;
+
+	/*
+	 * Any pending context unregister packets will be lost
+	 * since we hard reset the GMU. This means any threads waiting
+	 * for context unregister hfi ack will timeout. Wake them
+	 * to avoid false positive ack timeout messages later.
+	 */
+	gen7_hwsched_drain_ctxt_unregister(adreno_dev);
+
+	if (!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags))
+		return 0;
+
+	gen7_disable_gpu_irq(adreno_dev);
+
+	gen7_gmu_irq_disable(adreno_dev);
+
+	gen7_hwsched_hfi_stop(adreno_dev);
+
+	gen7_gmu_suspend(adreno_dev);
+
+	adreno_hwsched_unregister_contexts(adreno_dev);
+
+	clear_bit(GMU_PRIV_GPU_STARTED, &gmu->flags);
+
+	spin_lock(&hfi->hw_fence.lock);
+
+	/* Reset the unack count back to zero as we start afresh */
+	hfi->hw_fence.unack_count = 0;
+
+	spin_unlock(&hfi->hw_fence.lock);
+
+	/*
+	 * When we reset, we want to coldboot incase any scratch corruption
+	 * has occurred before we faulted.
+	 */
+	adreno_mark_for_coldboot(adreno_dev);
+
+	ret = gen7_hwsched_boot(adreno_dev);
+	if (ret)
+		goto done;
+
+	adreno_hwsched_replay(adreno_dev);
+
+	ret = handle_hw_fences_after_reset(adreno_dev);
+done:
+	BUG_ON(ret);
+
+	return ret;
+}
+
+const struct adreno_power_ops gen7_hwsched_power_ops = {
+	.first_open = gen7_hwsched_first_open,
+	.last_close = gen7_hwsched_power_off,
+	.active_count_get = gen7_hwsched_active_count_get,
+	.active_count_put = gen7_hwsched_active_count_put,
+	.touch_wakeup = gen7_hwsched_touch_wakeup,
+	.pm_suspend = gen7_hwsched_pm_suspend,
+	.pm_resume = gen7_hwsched_pm_resume,
+	.gpu_clock_set = gen7_hwsched_clock_set,
+	.gpu_bus_set = gen7_hwsched_bus_set,
+};
+
+const struct adreno_hwsched_ops gen7_hwsched_ops = {
+	.submit_drawobj = gen7_hwsched_submit_drawobj,
+	.preempt_count = gen7_hwsched_preempt_count_get,
+	.create_hw_fence = gen7_hwsched_create_hw_fence,
+};
+
+int gen7_hwsched_probe(struct platform_device *pdev,
+		u32 chipid, const struct adreno_gpu_core *gpucore)
+{
+	struct adreno_device *adreno_dev;
+	struct kgsl_device *device;
+	struct gen7_hwsched_device *gen7_hwsched_dev;
+	int ret;
+
+	gen7_hwsched_dev = devm_kzalloc(&pdev->dev, sizeof(*gen7_hwsched_dev),
+				GFP_KERNEL);
+	if (!gen7_hwsched_dev)
+		return -ENOMEM;
+
+	adreno_dev = &gen7_hwsched_dev->gen7_dev.adreno_dev;
+
+	adreno_dev->hwsched_enabled = true;
+
+	ret = gen7_probe_common(pdev, adreno_dev, chipid, gpucore);
+	if (ret)
+		return ret;
+
+	device = KGSL_DEVICE(adreno_dev);
+
+	INIT_WORK(&device->idle_check_ws, hwsched_idle_check);
+
+	timer_setup(&device->idle_timer, hwsched_idle_timer, 0);
+
+	adreno_dev->irq_mask = GEN7_HWSCHED_INT_MASK;
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_LPAC))
+		adreno_dev->lpac_enabled = true;
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_DMS)) {
+		set_bit(ADRENO_DEVICE_DMS, &adreno_dev->priv);
+		adreno_dev->dms_enabled = true;
+	}
+
+	kgsl_mmu_set_feature(device, KGSL_MMU_PAGEFAULT_TERMINATE);
+
+	ret = adreno_hwsched_init(adreno_dev, &gen7_hwsched_ops);
+	if (ret)
+		dev_err(&pdev->dev, "adreno hardware scheduler init failed ret %d\n", ret);
+
+	return ret;
+}
+
+int gen7_hwsched_add_to_minidump(struct adreno_device *adreno_dev)
+{
+	struct gen7_device *gen7_dev = container_of(adreno_dev,
+					struct gen7_device, adreno_dev);
+	struct gen7_hwsched_device *gen7_hwsched = container_of(gen7_dev,
+					struct gen7_hwsched_device, gen7_dev);
+	struct gen7_hwsched_hfi *hw_hfi = &gen7_hwsched->hwsched_hfi;
+	int ret, i;
+
+	ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev, KGSL_HWSCHED_DEVICE,
+			(void *)(gen7_hwsched), sizeof(struct gen7_hwsched_device));
+	if (ret)
+		return ret;
+
+	if (!IS_ERR_OR_NULL(gen7_dev->gmu.gmu_log)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					KGSL_GMU_LOG_ENTRY,
+					gen7_dev->gmu.gmu_log->hostptr,
+					gen7_dev->gmu.gmu_log->size);
+		if (ret)
+			return ret;
+	}
+
+	if (!IS_ERR_OR_NULL(gen7_dev->gmu.hfi.hfi_mem)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					KGSL_HFIMEM_ENTRY,
+					gen7_dev->gmu.hfi.hfi_mem->hostptr,
+					gen7_dev->gmu.hfi.hfi_mem->size);
+		if (ret)
+			return ret;
+	}
+
+	if (!IS_ERR_OR_NULL(gen7_dev->gmu.vrb)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					KGSL_GMU_VRB_ENTRY,
+					gen7_dev->gmu.vrb->hostptr,
+					gen7_dev->gmu.vrb->size);
+		if (ret)
+			return ret;
+	}
+
+	if (!IS_ERR_OR_NULL(gen7_dev->gmu.trace.md)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					KGSL_GMU_TRACE_ENTRY,
+					gen7_dev->gmu.trace.md->hostptr,
+					gen7_dev->gmu.trace.md->size);
+		if (ret)
+			return ret;
+	}
+
+	/* Dump HFI hwsched global mem alloc entries */
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct hfi_mem_alloc_entry *entry = &hw_hfi->mem_alloc_table[i];
+		char hfi_minidump_str[MAX_VA_MINIDUMP_STR_LEN] = {0};
+		u32 rb_id = 0;
+
+		if (!hfi_get_minidump_string(entry->desc.mem_kind,
+					     &hfi_minidump_str[0],
+					     sizeof(hfi_minidump_str), &rb_id)) {
+			ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+						      hfi_minidump_str,
+						      entry->md->hostptr,
+						      entry->md->size);
+			if (ret)
+				return ret;
+		}
+	}
+
+	if (!IS_ERR_OR_NULL(hw_hfi->big_ib)) {
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					      KGSL_HFI_BIG_IB_ENTRY,
+					      hw_hfi->big_ib->hostptr,
+					      hw_hfi->big_ib->size);
+		if (ret)
+			return ret;
+	}
+
+	if (!IS_ERR_OR_NULL(hw_hfi->big_ib_recurring))
+		ret = kgsl_add_va_to_minidump(adreno_dev->dev.dev,
+					      KGSL_HFI_BIG_IB_REC_ENTRY,
+					      hw_hfi->big_ib_recurring->hostptr,
+					      hw_hfi->big_ib_recurring->size);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_hwsched.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_hwsched.h
@@ -0,0 +1,106 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _ADRENO_GEN7_HWSCHED_H_
+#define _ADRENO_GEN7_HWSCHED_H_
+
+#include "adreno_gen7_hwsched_hfi.h"
+
+/**
+ * struct gen7_hwsched_device - Container for the gen7 hwscheduling device
+ */
+struct gen7_hwsched_device {
+	/** @gen7_dev: Container for the gen7 device */
+	struct gen7_device gen7_dev;
+	/** @hwsched_hfi: Container for hwscheduling specific hfi resources */
+	struct gen7_hwsched_hfi hwsched_hfi;
+};
+
+/**
+ * gen7_hwsched_probe - Target specific probe for hwsched
+ * @pdev: Pointer to the platform device
+ * @chipid: Chipid of the target
+ * @gpucore: Pointer to the gpucore
+ *
+ * The target specific probe function for hwsched enabled gmu targets.
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hwsched_probe(struct platform_device *pdev,
+		u32 chipid, const struct adreno_gpu_core *gpucore);
+
+/**
+ * gen7_hwsched_reset_replay - Restart the gmu and gpu and replay inflight cmdbatches
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hwsched_reset_replay(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_snapshot - take gen7 hwsched snapshot
+ * @adreno_dev: Pointer to the adreno device
+ * @snapshot: Pointer to the snapshot instance
+ *
+ * Snapshot the faulty ib and then snapshot rest of gen7 gmu things
+ */
+void gen7_hwsched_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot);
+
+/**
+ * gen7_hwsched_handle_watchdog - Handle watchdog interrupt
+ * @adreno_dev: Pointer to the adreno device
+ */
+void gen7_hwsched_handle_watchdog(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_active_count_get - Increment the active count
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function increments the active count. If active count
+ * is 0, this function also powers up the device.
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hwsched_active_count_get(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_active_count_put - Put back the active count
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function decrements the active count sets the idle
+ * timer if active count is zero.
+ */
+void gen7_hwsched_active_count_put(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_add_to_minidump - Register hwsched_device with va minidump
+ * @adreno_dev: Pointer to the adreno device
+ */
+int gen7_hwsched_add_to_minidump(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_send_recurring_cmdobj - Dispatch IBs to GMU
+ * @adreno_dev: Pointer to adreno device structure
+ * @cmdobj: The command object which needs to be submitted
+ *
+ * This function is used to register the context if needed and submit
+ * recurring IBs to the GMU. Upon receiving ipc interrupt GMU will submit
+ * recurring IBs to GPU.
+
+ * Return: 0 on success and negative error on failure
+ */
+int gen7_hwsched_send_recurring_cmdobj(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj);
+
+/**
+ * gen7_hwsched_fault - Set hwsched fault to request recovery
+ * @adreno_dev: A handle to adreno device
+ * @fault: The type of fault
+ */
+void gen7_hwsched_fault(struct adreno_device *adreno_dev, u32 fault);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_hwsched_hfi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_hwsched_hfi.c
@@ -0,0 +1,4201 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/soc/qcom,ipcc.h>
+#include <linux/dma-fence-array.h>
+#include <linux/iommu.h>
+#include <linux/sched/clock.h>
+#include <soc/qcom/msm_performance.h>
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_gen7_hwsched.h"
+#include "adreno_hfi.h"
+#include "adreno_pm4types.h"
+#include "adreno_trace.h"
+#include "kgsl_device.h"
+#include "kgsl_eventlog.h"
+#include "kgsl_pwrctrl.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+#if (KERNEL_VERSION(6, 3, 0) <= LINUX_VERSION_CODE)
+#include <msm_hw_fence.h>
+#else
+#include <linux/soc/qcom/msm_hw_fence.h>
+#endif
+
+#define HFI_QUEUE_MAX (HFI_QUEUE_DEFAULT_CNT + HFI_QUEUE_DISPATCH_MAX_CNT)
+
+#define DEFINE_QHDR(gmuaddr, id, prio) \
+	{\
+		.status = 1, \
+		.start_addr = GMU_QUEUE_START_ADDR(gmuaddr, id), \
+		.type = QUEUE_HDR_TYPE(id, prio, 0, 0), \
+		.queue_size = SZ_4K >> 2, \
+		.msg_size = 0, \
+		.unused0 = 0, \
+		.unused1 = 0, \
+		.unused2 = 0, \
+		.unused3 = 0, \
+		.unused4 = 0, \
+		.read_index = 0, \
+		.write_index = 0, \
+}
+
+static struct dq_info {
+	/** @max_dq: Maximum number of dispatch queues per RB level */
+	u32 max_dq;
+	/** @base_dq_id: Base dqid for level */
+	u32 base_dq_id;
+	/** @offset: Next dqid to use for roundrobin context assignment */
+	u32 offset;
+} gen7_hfi_dqs[KGSL_PRIORITY_MAX_RB_LEVELS] = {
+	{ 4, 0, }, /* RB0 */
+	{ 4, 4, }, /* RB1 */
+	{ 3, 8, }, /* RB2 */
+	{ 3, 11, }, /* RB3 */
+}, gen7_hfi_dqs_lpac[KGSL_PRIORITY_MAX_RB_LEVELS + 1] = {
+	{ 4, 0, }, /* RB0 */
+	{ 4, 4, }, /* RB1 */
+	{ 3, 8, }, /* RB2 */
+	{ 2, 11, }, /* RB3 */
+	{ 1, 13, }, /* RB LPAC */
+};
+
+struct pending_cmd hw_fence_ack;
+
+struct gen7_hwsched_hfi *to_gen7_hwsched_hfi(
+	struct adreno_device *adreno_dev)
+{
+	struct gen7_device *gen7_dev = container_of(adreno_dev,
+					struct gen7_device, adreno_dev);
+	struct gen7_hwsched_device *gen7_hwsched = container_of(gen7_dev,
+					struct gen7_hwsched_device, gen7_dev);
+
+	return &gen7_hwsched->hwsched_hfi;
+}
+
+int gen7_hfi_send_lpac_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	if (!adreno_dev->lpac_enabled)
+		return 0;
+
+	return gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_LPAC, 1, 0);
+}
+
+static void add_waiter(struct gen7_hwsched_hfi *hfi, u32 hdr,
+	struct pending_cmd *ack)
+{
+	memset(ack, 0x0, sizeof(*ack));
+
+	init_completion(&ack->complete);
+	write_lock_irq(&hfi->msglock);
+	list_add_tail(&ack->node, &hfi->msglist);
+	write_unlock_irq(&hfi->msglock);
+
+	ack->sent_hdr = hdr;
+}
+
+static void del_waiter(struct gen7_hwsched_hfi *hfi, struct pending_cmd *ack)
+{
+	write_lock_irq(&hfi->msglock);
+	list_del(&ack->node);
+	write_unlock_irq(&hfi->msglock);
+}
+
+static void gen7_receive_ack_async(struct adreno_device *adreno_dev, void *rcvd)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct pending_cmd *cmd = NULL;
+	u32 waiters[64], num_waiters = 0, i;
+	u32 *ack = rcvd;
+	u32 hdr = ack[0];
+	u32 req_hdr = ack[1];
+	u32 size_bytes = MSG_HDR_GET_SIZE(hdr) << 2;
+
+	if (size_bytes > sizeof(cmd->results))
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"Ack result too big: %d Truncating to: %ld\n",
+			size_bytes, sizeof(cmd->results));
+
+	read_lock(&hfi->msglock);
+
+	list_for_each_entry(cmd, &hfi->msglist, node) {
+		if (CMP_HFI_ACK_HDR(cmd->sent_hdr, req_hdr)) {
+			memcpy(cmd->results, ack,
+				min_t(u32, size_bytes,
+					sizeof(cmd->results)));
+			complete(&cmd->complete);
+			read_unlock(&hfi->msglock);
+			return;
+		}
+
+		if (num_waiters < ARRAY_SIZE(waiters))
+			waiters[num_waiters++] = cmd->sent_hdr;
+	}
+
+	read_unlock(&hfi->msglock);
+
+	/* Didn't find the sender, list the waiter */
+	dev_err_ratelimited(&gmu->pdev->dev,
+		"Unexpectedly got id %d seqnum %d. Total waiters: %d Top %d Waiters:\n",
+		MSG_HDR_GET_ID(req_hdr), MSG_HDR_GET_SEQNUM(req_hdr),
+		num_waiters, min_t(u32, num_waiters, 5));
+
+	for (i = 0; i < num_waiters && i < 5; i++)
+		dev_err_ratelimited(&gmu->pdev->dev,
+			" id %d seqnum %d\n",
+			MSG_HDR_GET_ID(waiters[i]),
+			MSG_HDR_GET_SEQNUM(waiters[i]));
+}
+
+/* This function is called while holding the drawctxt spinlock */
+void gen7_remove_hw_fence_entry(struct adreno_device *adreno_dev,
+	struct adreno_hw_fence_entry *entry)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct adreno_context *drawctxt = entry->drawctxt;
+
+	atomic_dec(&hwsched->hw_fence_count);
+	drawctxt->hw_fence_count--;
+
+	dma_fence_put(&entry->kfence->fence);
+	list_del_init(&entry->node);
+	kmem_cache_free(hwsched->hw_fence_cache, entry);
+}
+
+static void _retire_inflight_hw_fences(struct adreno_device *adreno_dev,
+	struct kgsl_context *context)
+{
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	struct adreno_hw_fence_entry *entry, *tmp;
+
+	if (!test_bit(ADRENO_HWSCHED_HW_FENCE, &adreno_dev->hwsched.flags))
+		return;
+
+	spin_lock(&drawctxt->lock);
+
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_inflight_list, node) {
+		struct gmu_context_queue_header *hdr = drawctxt->gmu_context_queue.hostptr;
+
+		/*
+		 * Since this list is sorted by timestamp, abort on the first fence that hasn't
+		 * yet been sent to TxQueue
+		 */
+		if (timestamp_cmp((u32)entry->cmd.ts, hdr->out_fence_ts) > 0)
+			break;
+
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+	}
+	spin_unlock(&drawctxt->lock);
+}
+
+static void log_profiling_info(struct adreno_device *adreno_dev, u32 *rcvd)
+{
+	struct hfi_ts_retire_cmd *cmd = (struct hfi_ts_retire_cmd *)rcvd;
+	struct kgsl_context *context;
+	struct retire_info info = {0};
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	context = kgsl_context_get(device, cmd->ctxt_id);
+	if (context == NULL)
+		return;
+
+	info.timestamp = cmd->ts;
+	info.rb_id = adreno_get_level(context);
+	info.gmu_dispatch_queue = context->gmu_dispatch_queue;
+	info.submitted_to_rb = cmd->submitted_to_rb;
+	info.sop = cmd->sop;
+	info.eop = cmd->eop;
+	if (GMU_VER_MINOR(gmu->ver.hfi) < 4)
+		info.active = cmd->eop - cmd->sop;
+	else
+		info.active = cmd->active;
+	info.retired_on_gmu = cmd->retired_on_gmu;
+
+	/* protected GPU work must not be reported */
+	if  (!(context->flags & KGSL_CONTEXT_SECURE))
+		kgsl_work_period_update(device, context->proc_priv->period,
+					     info.active);
+
+	trace_adreno_cmdbatch_retired(context, &info, 0, 0, 0);
+
+	log_kgsl_cmdbatch_retired_event(context->id, cmd->ts,
+		context->priority, 0, cmd->sop, cmd->eop);
+
+	_retire_inflight_hw_fences(adreno_dev, context);
+
+	kgsl_context_put(context);
+}
+
+/* Look up a particular key's value for a given type of payload */
+static u32 gen7_hwsched_lookup_key_value_legacy(struct adreno_device *adreno_dev,
+	u32 type, u32 key)
+{
+	struct hfi_context_bad_cmd_legacy *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+
+	if (!cmd->hdr)
+		return 0;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd_legacy, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == type)
+			return adreno_hwsched_parse_payload(payload, key);
+
+		i += struct_size(payload, data, payload->dwords);
+	}
+
+	return 0;
+}
+
+static u32 get_payload_rb_key_legacy(struct adreno_device *adreno_dev,
+	u32 rb_id, u32 key)
+{
+	struct hfi_context_bad_cmd_legacy *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+
+	if (!cmd->hdr)
+		return 0;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd_legacy, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == PAYLOAD_RB) {
+			u32 id = adreno_hwsched_parse_payload(payload, KEY_RB_ID);
+
+			if (id == rb_id)
+				return adreno_hwsched_parse_payload(payload, key);
+		}
+
+		i += struct_size(payload, data, payload->dwords);
+	}
+
+	return 0;
+}
+
+struct syncobj_flags {
+	unsigned long mask;
+	const char *name;
+};
+
+static void _get_syncobj_string(char *str, u32 max_size, struct hfi_syncobj *syncobj, u32 index)
+{
+	u32 count = scnprintf(str, max_size, "syncobj[%d] ctxt_id:%llu seqno:%llu flags:", index,
+			syncobj->ctxt_id, syncobj->seq_no);
+	u32 i;
+	bool first = true;
+	static const struct syncobj_flags _flags[] = {
+		GMU_SYNCOBJ_FLAGS, { -1, NULL }};
+
+	for (i = 0; _flags[i].name; i++) {
+		if (!(syncobj->flags & _flags[i].mask))
+			continue;
+
+		if (first) {
+			count += scnprintf(str + count, max_size - count, "%s", _flags[i].name);
+			first = false;
+		} else {
+			count += scnprintf(str + count, max_size - count, "|%s", _flags[i].name);
+		}
+	}
+}
+
+static void log_syncobj(struct gen7_gmu_device *gmu, struct hfi_submit_syncobj *cmd)
+{
+	struct hfi_syncobj *syncobj = (struct hfi_syncobj *)&cmd[1];
+	char str[128];
+	u32 i = 0;
+
+	for (i = 0; i < cmd->num_syncobj; i++) {
+		_get_syncobj_string(str, sizeof(str), syncobj, i);
+		dev_err(&gmu->pdev->dev, "%s\n", str);
+		syncobj++;
+	}
+}
+
+static void find_timeout_syncobj(struct adreno_device *adreno_dev, u32 ctxt_id, u32 ts)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_context *context = NULL;
+	struct adreno_context *drawctxt;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gmu_context_queue_header *hdr;
+	struct hfi_submit_syncobj *cmd;
+	u32 *queue, i;
+	int ret;
+
+	/* We want to get the context even if it is detached */
+	read_lock(&device->context_lock);
+	context = idr_find(&device->context_idr, ctxt_id);
+	ret = _kgsl_context_get(context);
+	read_unlock(&device->context_lock);
+
+	if (!ret)
+		return;
+
+	drawctxt = ADRENO_CONTEXT(context);
+
+	hdr = drawctxt->gmu_context_queue.hostptr;
+	queue = (u32 *)(drawctxt->gmu_context_queue.hostptr + sizeof(*hdr));
+
+	for (i = hdr->read_index; i != hdr->write_index;) {
+		if (MSG_HDR_GET_ID(queue[i]) != H2F_MSG_ISSUE_SYNCOBJ) {
+			i = (i + MSG_HDR_GET_SIZE(queue[i])) % hdr->queue_size;
+			continue;
+		}
+
+		cmd = (struct hfi_submit_syncobj *)&queue[i];
+
+		if (cmd->timestamp == ts) {
+			log_syncobj(gmu, cmd);
+			break;
+		}
+		i = (i + MSG_HDR_GET_SIZE(queue[i])) % hdr->queue_size;
+	}
+
+	if (i == hdr->write_index)
+		dev_err(&gmu->pdev->dev, "Couldn't find unsignaled syncobj ctx:%d ts:%d\n",
+			ctxt_id, ts);
+
+	kgsl_context_put(context);
+}
+
+static void log_gpu_fault_legacy(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct device *dev = &gmu->pdev->dev;
+	struct hfi_context_bad_cmd_legacy *cmd = adreno_dev->hwsched.ctxt_bad;
+
+	switch (cmd->error) {
+	case GMU_GPU_HW_HANG:
+		dev_crit_ratelimited(dev, "MISC: GPU hang detected\n");
+		break;
+	case GMU_GPU_SW_HANG:
+		dev_crit_ratelimited(dev, "gpu timeout ctx %d ts %u\n",
+			cmd->ctxt_id, cmd->ts);
+		break;
+	case GMU_CP_OPCODE_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP opcode error interrupt | opcode=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+			KEY_CP_OPCODE_ERROR));
+		break;
+	case GMU_CP_PROTECTED_ERROR: {
+		u32 status = gen7_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_PROTECTED_ERROR);
+
+		dev_crit_ratelimited(dev,
+			"CP | Protected mode error | %s | addr=0x%5.5x | status=0x%8.8x\n",
+			status & (1 << 20) ? "READ" : "WRITE",
+			status & 0x3FFFF, status);
+		}
+		break;
+	case GMU_CP_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "CP Illegal instruction error\n");
+		break;
+	case GMU_CP_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "CP ucode error interrupt\n");
+		break;
+	case GMU_CP_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP | Ringbuffer HW fault | status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_HW_FAULT));
+		break;
+	case GMU_GPU_PREEMPT_TIMEOUT: {
+		u32 cur, next, cur_rptr, cur_wptr, next_rptr, next_wptr;
+
+		cur = gen7_hwsched_lookup_key_value_legacy(adreno_dev,
+			PAYLOAD_PREEMPT_TIMEOUT, KEY_PREEMPT_TIMEOUT_CUR_RB_ID);
+		next = gen7_hwsched_lookup_key_value_legacy(adreno_dev,
+			PAYLOAD_PREEMPT_TIMEOUT,
+			KEY_PREEMPT_TIMEOUT_NEXT_RB_ID);
+		cur_rptr = get_payload_rb_key_legacy(adreno_dev, cur, KEY_RB_RPTR);
+		cur_wptr = get_payload_rb_key_legacy(adreno_dev, cur, KEY_RB_WPTR);
+		next_rptr = get_payload_rb_key_legacy(adreno_dev, next, KEY_RB_RPTR);
+		next_wptr = get_payload_rb_key_legacy(adreno_dev, next, KEY_RB_WPTR);
+
+		dev_crit_ratelimited(dev,
+			"Preemption Fault: cur=%d R/W=0x%x/0x%x, next=%d R/W=0x%x/0x%x\n",
+			cur, cur_rptr, cur_wptr, next, next_rptr, next_wptr);
+		}
+		break;
+	case GMU_CP_GPC_ERROR:
+		dev_crit_ratelimited(dev, "RBBM: GPC error\n");
+		break;
+	case GMU_CP_BV_OPCODE_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP BV opcode error | opcode=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+			KEY_CP_BV_OPCODE_ERROR));
+		break;
+	case GMU_CP_BV_PROTECTED_ERROR: {
+		u32 status = gen7_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_BV_PROTECTED_ERROR);
+
+		dev_crit_ratelimited(dev,
+			"CP BV | Protected mode error | %s | addr=0x%5.5x | status=0x%8.8x\n",
+			status & (1 << 20) ? "READ" : "WRITE",
+			status & 0x3FFFF, status);
+		}
+		break;
+	case GMU_CP_BV_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP BV | Ringbuffer HW fault | status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_HW_FAULT));
+		break;
+	case GMU_CP_BV_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "CP BV Illegal instruction error\n");
+		break;
+	case GMU_CP_BV_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "CP BV ucode error interrupt\n");
+		break;
+	case GMU_GPU_SW_FUSE_VIOLATION:
+		dev_crit_ratelimited(dev, "RBBM: SW Feature Fuse violation status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value_legacy(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_SWFUSE_VIOLATION_FAULT));
+		break;
+	case GMU_GPU_AQE0_OPCODE_ERRROR:
+		dev_crit_ratelimited(dev, "AQE0 opcode error | opcode=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value_legacy(adreno_dev,
+				PAYLOAD_FAULT_REGS, KEY_AQE0_OPCODE_ERROR));
+		break;
+	case GMU_GPU_AQE0_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "AQE0 ucode error interrupt\n");
+		break;
+	case GMU_GPU_AQE0_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev, "AQE0 HW fault | status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value_legacy(adreno_dev,
+				PAYLOAD_FAULT_REGS, KEY_AQE0_HW_FAULT));
+		break;
+	case GMU_GPU_AQE0_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "AQE0 Illegal instruction error\n");
+		break;
+	case GMU_GPU_AQE1_OPCODE_ERRROR:
+		dev_crit_ratelimited(dev, "AQE1 opcode error | opcode=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value_legacy(adreno_dev,
+				PAYLOAD_FAULT_REGS, KEY_AQE1_OPCODE_ERROR));
+		break;
+	case GMU_GPU_AQE1_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "AQE1 ucode error interrupt\n");
+		break;
+	case GMU_GPU_AQE1_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev, "AQE1 HW fault | status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value_legacy(adreno_dev,
+				PAYLOAD_FAULT_REGS, KEY_AQE1_HW_FAULT));
+		break;
+	case GMU_GPU_AQE1_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "AQE1 Illegal instruction error\n");
+		break;
+	case GMU_SYNCOBJ_TIMEOUT_ERROR:
+		dev_crit_ratelimited(dev, "syncobj timeout ctx %d ts %u\n",
+			cmd->ctxt_id, cmd->ts);
+		find_timeout_syncobj(adreno_dev, cmd->ctxt_id, cmd->ts);
+		break;
+	case GMU_CP_UNKNOWN_ERROR:
+		fallthrough;
+	default:
+		dev_crit_ratelimited(dev, "Unknown GPU fault: %u\n",
+			cmd->error);
+		break;
+	}
+}
+
+/* Look up a particular key's value for a given type of payload */
+static u32 gen7_hwsched_lookup_key_value(struct adreno_device *adreno_dev,
+	u32 type, u32 key)
+{
+	struct hfi_context_bad_cmd *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+
+	if (!cmd->hdr)
+		return 0;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == type)
+			return adreno_hwsched_parse_payload(payload, key);
+
+		i += struct_size(payload, data, payload->dwords);
+	}
+
+	return 0;
+}
+
+static u32 get_payload_rb_key(struct adreno_device *adreno_dev,
+	u32 rb_id, u32 key)
+{
+	struct hfi_context_bad_cmd *cmd = adreno_dev->hwsched.ctxt_bad;
+	u32 i = 0, payload_bytes;
+	void *start;
+
+	if (!cmd->hdr)
+		return 0;
+
+	payload_bytes = (MSG_HDR_GET_SIZE(cmd->hdr) << 2) -
+			offsetof(struct hfi_context_bad_cmd, payload);
+
+	start = &cmd->payload[0];
+
+	while (i < payload_bytes) {
+		struct payload_section *payload = start + i;
+
+		if (payload->type == PAYLOAD_RB) {
+			u32 id = adreno_hwsched_parse_payload(payload, KEY_RB_ID);
+
+			if (id == rb_id)
+				return adreno_hwsched_parse_payload(payload, key);
+		}
+
+		i += struct_size(payload, data, payload->dwords);
+	}
+
+	return 0;
+}
+
+static void log_gpu_fault(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct device *dev = &gmu->pdev->dev;
+	struct hfi_context_bad_cmd *cmd = adreno_dev->hwsched.ctxt_bad;
+
+	switch (cmd->error) {
+	case GMU_GPU_HW_HANG:
+		dev_crit_ratelimited(dev, "MISC: GPU hang detected\n");
+		break;
+	case GMU_GPU_SW_HANG:
+		dev_crit_ratelimited(dev, "gpu timeout ctx %d ts %d\n",
+			cmd->gc.ctxt_id, cmd->gc.ts);
+		break;
+	case GMU_CP_OPCODE_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP opcode error interrupt | opcode=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+			KEY_CP_OPCODE_ERROR));
+		break;
+	case GMU_CP_PROTECTED_ERROR: {
+		u32 status = gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_PROTECTED_ERROR);
+
+		dev_crit_ratelimited(dev,
+			"CP | Protected mode error | %s | addr=0x%5.5x | status=0x%8.8x\n",
+			status & (1 << 20) ? "READ" : "WRITE",
+			status & 0x3FFFF, status);
+		}
+		break;
+	case GMU_CP_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "CP Illegal instruction error\n");
+		break;
+	case GMU_CP_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "CP ucode error interrupt\n");
+		break;
+	case GMU_CP_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP | Ringbuffer HW fault | status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_HW_FAULT));
+		break;
+	case GMU_GPU_PREEMPT_TIMEOUT: {
+		u32 cur, next, cur_rptr, cur_wptr, next_rptr, next_wptr;
+
+		cur = gen7_hwsched_lookup_key_value(adreno_dev,
+			PAYLOAD_PREEMPT_TIMEOUT, KEY_PREEMPT_TIMEOUT_CUR_RB_ID);
+		next = gen7_hwsched_lookup_key_value(adreno_dev,
+			PAYLOAD_PREEMPT_TIMEOUT,
+			KEY_PREEMPT_TIMEOUT_NEXT_RB_ID);
+		cur_rptr = get_payload_rb_key(adreno_dev, cur, KEY_RB_RPTR);
+		cur_wptr = get_payload_rb_key(adreno_dev, cur, KEY_RB_WPTR);
+		next_rptr = get_payload_rb_key(adreno_dev, next, KEY_RB_RPTR);
+		next_wptr = get_payload_rb_key(adreno_dev, next, KEY_RB_WPTR);
+
+		dev_crit_ratelimited(dev,
+			"Preemption Fault: cur=%d R/W=0x%x/0x%x, next=%d R/W=0x%x/0x%x\n",
+			cur, cur_rptr, cur_wptr, next, next_rptr, next_wptr);
+		}
+		break;
+	case GMU_CP_GPC_ERROR:
+		dev_crit_ratelimited(dev, "RBBM: GPC error\n");
+		break;
+	case GMU_CP_BV_OPCODE_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP BV opcode error | opcode=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+			KEY_CP_BV_OPCODE_ERROR));
+		break;
+	case GMU_CP_BV_PROTECTED_ERROR: {
+		u32 status = gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_BV_PROTECTED_ERROR);
+
+		dev_crit_ratelimited(dev,
+			"CP BV | Protected mode error | %s | addr=0x%5.5x | status=0x%8.8x\n",
+			status & (1 << 20) ? "READ" : "WRITE",
+			status & 0x3FFFF, status);
+		}
+		break;
+	case GMU_CP_BV_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP BV | Ringbuffer HW fault | status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_HW_FAULT));
+		break;
+	case GMU_CP_BV_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "CP BV Illegal instruction error\n");
+		break;
+	case GMU_CP_BV_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "CP BV ucode error interrupt\n");
+		break;
+	case GMU_CP_LPAC_OPCODE_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP LPAC opcode error | opcode=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+			KEY_CP_LPAC_OPCODE_ERROR));
+		break;
+	case GMU_CP_LPAC_PROTECTED_ERROR: {
+		u32 status = gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_LPAC_PROTECTED_ERROR);
+
+		dev_crit_ratelimited(dev,
+			"CP LPAC | Protected mode error | %s | addr=0x%5.5x | status=0x%8.8x\n",
+			status & (1 << 20) ? "READ" : "WRITE",
+			status & 0x3FFFF, status);
+		}
+		break;
+	case GMU_CP_LPAC_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev,
+			"CP LPAC | Ringbuffer HW fault | status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_CP_LPAC_HW_FAULT));
+		break;
+	case GMU_CP_LPAC_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "CP LPAC Illegal instruction error\n");
+		break;
+	case GMU_CP_LPAC_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "CP LPAC ucode error interrupt\n");
+		break;
+	case GMU_GPU_LPAC_SW_HANG:
+		dev_crit_ratelimited(dev, "LPAC: gpu timeout ctx %d ts %d\n",
+			cmd->lpac.ctxt_id, cmd->lpac.ts);
+		break;
+	case GMU_GPU_SW_FUSE_VIOLATION:
+		dev_crit_ratelimited(dev, "RBBM: SW Feature Fuse violation status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev, PAYLOAD_FAULT_REGS,
+				KEY_SWFUSE_VIOLATION_FAULT));
+		break;
+	case GMU_GPU_AQE0_OPCODE_ERRROR:
+		dev_crit_ratelimited(dev, "AQE0 opcode error | opcode=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev,
+				PAYLOAD_FAULT_REGS, KEY_AQE0_OPCODE_ERROR));
+		break;
+	case GMU_GPU_AQE0_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "AQE0 ucode error interrupt\n");
+		break;
+	case GMU_GPU_AQE0_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev, "AQE0 HW fault | status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev,
+				PAYLOAD_FAULT_REGS, KEY_AQE0_HW_FAULT));
+		break;
+	case GMU_GPU_AQE0_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "AQE0 Illegal instruction error\n");
+		break;
+	case GMU_GPU_AQE1_OPCODE_ERRROR:
+		dev_crit_ratelimited(dev, "AQE1 opcode error | opcode=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev,
+				PAYLOAD_FAULT_REGS, KEY_AQE1_OPCODE_ERROR));
+		break;
+	case GMU_GPU_AQE1_UCODE_ERROR:
+		dev_crit_ratelimited(dev, "AQE1 ucode error interrupt\n");
+		break;
+	case GMU_GPU_AQE1_HW_FAULT_ERROR:
+		dev_crit_ratelimited(dev, "AQE1 HW fault | status=0x%8.8x\n",
+			gen7_hwsched_lookup_key_value(adreno_dev,
+				PAYLOAD_FAULT_REGS, KEY_AQE1_HW_FAULT));
+		break;
+	case GMU_GPU_AQE1_ILLEGAL_INST_ERROR:
+		dev_crit_ratelimited(dev, "AQE1 Illegal instruction error\n");
+		break;
+	case GMU_SYNCOBJ_TIMEOUT_ERROR:
+		dev_crit_ratelimited(dev, "syncobj timeout ctx %d ts %u\n",
+			cmd->gc.ctxt_id, cmd->gc.ts);
+		find_timeout_syncobj(adreno_dev, cmd->gc.ctxt_id, cmd->gc.ts);
+		break;
+	case GMU_CP_UNKNOWN_ERROR:
+		fallthrough;
+	default:
+		dev_crit_ratelimited(dev, "Unknown GPU fault: %u\n",
+			cmd->error);
+		break;
+	}
+}
+
+static u32 peek_next_header(struct gen7_gmu_device *gmu, uint32_t queue_idx)
+{
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	struct hfi_queue_table *tbl = mem_addr->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+	u32 *queue;
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+		return 0;
+
+	if (hdr->read_index == hdr->write_index)
+		return 0;
+
+	queue = HOST_QUEUE_START_ADDR(mem_addr, queue_idx);
+
+	return queue[hdr->read_index];
+}
+
+static void process_ctx_bad(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (GMU_VER_MINOR(gmu->ver.hfi) < 2)
+		log_gpu_fault_legacy(adreno_dev);
+	else
+		log_gpu_fault(adreno_dev);
+
+	gen7_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+}
+
+#define GET_QUERIED_FENCE_INDEX(x) (x / BITS_PER_SYNCOBJ_QUERY)
+#define GET_QUERIED_FENCE_BIT(x) (x % BITS_PER_SYNCOBJ_QUERY)
+
+static bool fence_is_queried(struct hfi_syncobj_query_cmd *cmd, u32 fence_index)
+{
+	u32 index = GET_QUERIED_FENCE_INDEX(fence_index);
+	u32 bit = GET_QUERIED_FENCE_BIT(fence_index);
+
+	return (cmd->queries[index].query_bitmask & BIT(bit));
+}
+
+static void set_fence_signal_bit(struct adreno_device *adreno_dev,
+	struct hfi_syncobj_query_cmd *reply, struct dma_fence *fence, u32 fence_index,
+	char *name)
+{
+	u32 index = GET_QUERIED_FENCE_INDEX(fence_index);
+	u32 bit = GET_QUERIED_FENCE_BIT(fence_index);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u64 flags = ADRENO_HW_FENCE_SW_STATUS_PENDING;
+	char value[32] = "unknown";
+
+	if (fence->ops->timeline_value_str)
+		fence->ops->timeline_value_str(fence, value, sizeof(value));
+
+	if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) {
+		dev_err(&gmu->pdev->dev,
+			"GMU is waiting for signaled fence(ctx:%llu seqno:%llu value:%s)\n",
+			fence->context, fence->seqno, value);
+		reply->queries[index].query_bitmask |= BIT(bit);
+		flags = ADRENO_HW_FENCE_SW_STATUS_SIGNALED;
+	}
+	trace_adreno_hw_fence_query(fence->context, fence->seqno, flags, name, value);
+}
+
+static void gen7_syncobj_query_reply(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj *drawobj, struct hfi_syncobj_query_cmd *cmd)
+{
+	struct hfi_syncobj_query_cmd reply = {0};
+	int i, j, fence_index = 0;
+	struct kgsl_drawobj_sync *syncobj = SYNCOBJ(drawobj);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	for (i = 0; i < syncobj->numsyncs; i++) {
+		struct kgsl_drawobj_sync_event *event = &syncobj->synclist[i];
+		struct kgsl_sync_fence_cb *kcb = event->handle;
+		struct dma_fence **fences;
+		struct dma_fence_array *array;
+		struct event_fence_info *info = event->priv;
+		u32 num_fences;
+
+		array = to_dma_fence_array(kcb->fence);
+		if (array != NULL) {
+			num_fences = array->num_fences;
+			fences = array->fences;
+		} else {
+			num_fences = 1;
+			fences = &kcb->fence;
+		}
+
+		for (j = 0; j < num_fences; j++, fence_index++) {
+			if (!fence_is_queried(cmd, fence_index))
+				continue;
+
+			set_fence_signal_bit(adreno_dev, &reply, fences[j], fence_index,
+				info ? info->fences[j].name : "unknown");
+		}
+	}
+
+	reply.hdr = CREATE_MSG_HDR(F2H_MSG_SYNCOBJ_QUERY, HFI_MSG_CMD);
+	reply.gmu_ctxt_id = cmd->gmu_ctxt_id;
+	reply.sync_obj_ts = cmd->sync_obj_ts;
+
+	trace_adreno_syncobj_query_reply(reply.gmu_ctxt_id, reply.sync_obj_ts,
+		gpudev->read_alwayson(adreno_dev));
+
+	gen7_hfi_send_cmd_async(adreno_dev, &reply, sizeof(reply));
+}
+
+struct syncobj_query_work {
+	/** @cmd: The query command to be processed */
+	struct hfi_syncobj_query_cmd cmd;
+	/** @context: kgsl context that is waiting for this sync object */
+	struct kgsl_context *context;
+	/** @work: The work structure to execute syncobj query reply */
+	struct kthread_work work;
+};
+
+static void gen7_process_syncobj_query_work(struct kthread_work *work)
+{
+	struct syncobj_query_work *query_work = container_of(work,
+						struct syncobj_query_work, work);
+	struct hfi_syncobj_query_cmd *cmd = (struct hfi_syncobj_query_cmd *)&query_work->cmd;
+	struct kgsl_context *context = query_work->context;
+	struct kgsl_device *device = context->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct cmd_list_obj *obj;
+	bool missing = true;
+
+	mutex_lock(&hwsched->mutex);
+	mutex_lock(&device->mutex);
+
+	list_for_each_entry(obj, &hwsched->cmd_list, node) {
+		struct kgsl_drawobj *drawobj = obj->drawobj;
+
+		if ((drawobj->type & SYNCOBJ_TYPE) == 0)
+			continue;
+
+		if ((drawobj->context->id == cmd->gmu_ctxt_id) &&
+			(drawobj->timestamp == cmd->sync_obj_ts)) {
+			gen7_syncobj_query_reply(adreno_dev, drawobj, cmd);
+			missing = false;
+			break;
+		}
+	}
+
+	if (missing) {
+		struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+		struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+		struct gmu_context_queue_header *hdr = drawctxt->gmu_context_queue.hostptr;
+
+		/*
+		 * If the sync object is not found, it can only mean that the sync object was
+		 * retired by the GMU in the meanwhile. However, if that is not the case, then
+		 * we have a problem.
+		 */
+		if (timestamp_cmp(cmd->sync_obj_ts, hdr->sync_obj_ts) > 0) {
+			dev_err(&gmu->pdev->dev, "Missing sync object ctx:%d ts:%d retired:%d\n",
+				context->id, cmd->sync_obj_ts, hdr->sync_obj_ts);
+			gmu_core_fault_snapshot(device);
+			gen7_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+		}
+	}
+
+	mutex_unlock(&device->mutex);
+	mutex_unlock(&hwsched->mutex);
+
+	kgsl_context_put(context);
+	kfree(query_work);
+}
+
+static void gen7_trigger_syncobj_query(struct adreno_device *adreno_dev,
+	u32 *rcvd)
+{
+	struct syncobj_query_work *query_work;
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct hfi_syncobj_query_cmd *cmd = (struct hfi_syncobj_query_cmd *)rcvd;
+	struct kgsl_context *context = NULL;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	int ret;
+
+	trace_adreno_syncobj_query(cmd->gmu_ctxt_id, cmd->sync_obj_ts,
+		gpudev->read_alwayson(adreno_dev));
+
+	/*
+	 * We need the context even if it is detached. Hence, we can't use kgsl_context_get here.
+	 * We must make sure that this context id doesn't get destroyed (to avoid re-use) until GMU
+	 * has ack'd the query reply.
+	 */
+	read_lock(&device->context_lock);
+	context = idr_find(&device->context_idr, cmd->gmu_ctxt_id);
+	ret = _kgsl_context_get(context);
+	read_unlock(&device->context_lock);
+
+	if (!ret)
+		return;
+
+	query_work = kzalloc(sizeof(*query_work), GFP_KERNEL);
+	if (!query_work) {
+		kgsl_context_put(context);
+		return;
+	}
+
+	kthread_init_work(&query_work->work, gen7_process_syncobj_query_work);
+	memcpy(&query_work->cmd, cmd, sizeof(*cmd));
+	query_work->context = context;
+
+	kthread_queue_work(hwsched->worker, &query_work->work);
+}
+
+/*
+ * This defines the maximum unack'd hardware fences that we allow. When this limit is reached, we
+ * will put all threads (that want to create a hardware fence) to sleep until the maximum unack'd
+ * hardware fence count drops to MIN_HW_FENCE_UNACK_COUNT
+ */
+#define MAX_HW_FENCE_UNACK_COUNT 20
+
+/*
+ * Once the maximum unack'd hardware fences drops to this value, wake up all the threads (that want
+ * to create hardware fences)
+ */
+#define MIN_HW_FENCE_UNACK_COUNT 10
+
+/*
+ * This is the maximum duration (in milliseconds) a thread (that wants to create a hardware fence)
+ * is put to sleep while we wait for the maximum number of unack'd hardware fences to drop from
+ * MAX_HW_FENCE_UNACK_COUNT to MIN_HW_FENCE_UNACK_COUNT. If the count doesn't drop to the desired
+ * value, then log an error and trigger snapshot and recovery.
+ */
+#define HW_FENCE_SLEEP_MS 200
+
+static void _enable_hw_fence_throttle(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+
+	set_bit(GEN7_HWSCHED_HW_FENCE_SLEEP_BIT, &hfi->hw_fence.flags);
+	set_bit(GEN7_HWSCHED_HW_FENCE_MAX_BIT, &hfi->hw_fence.flags);
+
+	/* Avoid submitting new work to gpu until the unack count drops to a desired threshold */
+	adreno_get_gpu_halt(adreno_dev);
+
+	mod_timer(&hfi->hw_fence_timer, jiffies + msecs_to_jiffies(HW_FENCE_SLEEP_MS));
+}
+
+static void _increment_hw_fence_unack_count(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+
+	if ((++hfi->hw_fence.unack_count) == MAX_HW_FENCE_UNACK_COUNT)
+		_enable_hw_fence_throttle(adreno_dev);
+}
+
+/**
+ * _send_hw_fence_no_ack - Send a hardware fence hfi packet to GMU without waiting for its ack.
+ * Increment the unack count on success
+ *
+ * Return: 0 on success or negative error on failure
+ */
+static int _send_hw_fence_no_ack(struct adreno_device *adreno_dev,
+	struct adreno_hw_fence_entry *entry)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	u32 seqnum;
+	int ret;
+
+
+	seqnum = atomic_inc_return(&hfi->hw_fence.seqnum);
+	entry->cmd.hdr = MSG_HDR_SET_SEQNUM_SIZE(entry->cmd.hdr, seqnum, sizeof(entry->cmd) >> 2);
+
+	ret = gen7_hfi_cmdq_write(adreno_dev, (u32 *)&entry->cmd, sizeof(entry->cmd));
+	if (!ret)
+		_increment_hw_fence_unack_count(adreno_dev);
+
+	return ret;
+}
+
+static struct adreno_hw_fence_entry *_get_deferred_hw_fence(struct adreno_context *drawctxt, u32 ts)
+{
+	struct adreno_hw_fence_entry *entry = NULL, *next, *deferred_hw_fence_entry = NULL;
+
+	spin_lock(&drawctxt->lock);
+	list_for_each_entry_safe(entry, next, &drawctxt->hw_fence_list, node) {
+
+		if (timestamp_cmp((u32)entry->cmd.ts, ts) > 0)
+			break;
+
+		/* We found a deferred hardware fence */
+		deferred_hw_fence_entry = entry;
+		break;
+	}
+	spin_unlock(&drawctxt->lock);
+
+	/*
+	 * This path executes in isolation from any paths that may release this entry. So, it is
+	 * safe to handle this entry outside of the drawctxt spinlock
+	 */
+	return deferred_hw_fence_entry;
+}
+
+static int _send_deferred_hw_fence(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, struct adreno_hw_fence_entry *entry, u32 ts)
+{
+	bool retired = kgsl_check_timestamp(KGSL_DEVICE(adreno_dev), &drawctxt->base, ts) ||
+				kgsl_context_is_bad(&drawctxt->base);
+	int ret = 0;
+	u32 flags = 0;
+
+	if (retired)
+		flags |= HW_FENCE_FLAG_SKIP_MEMSTORE;
+
+	ret = gen7_send_hw_fence_hfi_wait_ack(adreno_dev, entry, flags);
+	if (ret)
+		return ret;
+
+	spin_lock(&drawctxt->lock);
+	if (!retired)
+		list_move_tail(&entry->node, &drawctxt->hw_fence_inflight_list);
+	else
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+	spin_unlock(&drawctxt->lock);
+
+	return 0;
+}
+
+/**
+ * process_hw_fence_deferred_ctxt - This function sends hardware fences to GMU (from the
+ * deferred drawctxt) which couldn't be sent earlier
+ */
+static int process_hw_fence_deferred_ctxt(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, u32 ts)
+{
+	struct adreno_hw_fence_entry *deferred_hw_fence_entry = NULL;
+	int ret = 0;
+
+	do {
+		deferred_hw_fence_entry = _get_deferred_hw_fence(drawctxt, ts);
+
+		if (!deferred_hw_fence_entry)
+			break;
+
+		ret = _send_deferred_hw_fence(adreno_dev, drawctxt, deferred_hw_fence_entry, ts);
+		if (ret)
+			break;
+
+	} while (deferred_hw_fence_entry != NULL);
+
+	return ret;
+}
+
+static void _disable_hw_fence_throttle(struct adreno_device *adreno_dev, bool clear_abort_bit)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	bool max;
+
+	spin_lock(&hfi->hw_fence.lock);
+
+	hfi->hw_fence.defer_drawctxt = NULL;
+	hfi->hw_fence.defer_ts = 0;
+	max = test_bit(GEN7_HWSCHED_HW_FENCE_MAX_BIT, &hfi->hw_fence.flags);
+	if (max) {
+		clear_bit(GEN7_HWSCHED_HW_FENCE_SLEEP_BIT, &hfi->hw_fence.flags);
+		clear_bit(GEN7_HWSCHED_HW_FENCE_MAX_BIT, &hfi->hw_fence.flags);
+	}
+
+	if (clear_abort_bit)
+		clear_bit(GEN7_HWSCHED_HW_FENCE_ABORT_BIT, &hfi->hw_fence.flags);
+	spin_unlock(&hfi->hw_fence.lock);
+
+	/* Wake up dispatcher and any sleeping threads that want to create hardware fences */
+	if (max) {
+		adreno_put_gpu_halt(adreno_dev);
+		adreno_hwsched_trigger(adreno_dev);
+		wake_up_all(&hfi->hw_fence.unack_wq);
+	}
+}
+
+static void gen7_defer_hw_fence_work(struct kthread_work *work)
+{
+	struct gen7_hwsched_hfi *hfi = container_of(work,
+						struct gen7_hwsched_hfi, defer_hw_fence_work);
+	struct adreno_context *drawctxt = NULL;
+	struct kgsl_device *device;
+	struct adreno_device *adreno_dev;
+	u32 ts;
+	int ret;
+
+	spin_lock(&hfi->hw_fence.lock);
+	drawctxt = hfi->hw_fence.defer_drawctxt;
+	ts = hfi->hw_fence.defer_ts;
+	spin_unlock(&hfi->hw_fence.lock);
+
+	device = drawctxt->base.device;
+	adreno_dev = ADRENO_DEVICE(device);
+
+	/*
+	 * Grab the dispatcher and device mutex as we don't want to race with concurrent fault
+	 * recovery
+	 */
+	mutex_lock(&adreno_dev->hwsched.mutex);
+	mutex_lock(&device->mutex);
+
+	ret = process_hw_fence_deferred_ctxt(adreno_dev, drawctxt, ts);
+	if (ret) {
+		/* the deferred drawctxt will be handled post fault recovery */
+		gen7_hwsched_fault(adreno_dev, ADRENO_GMU_FAULT);
+		goto unlock;
+	}
+
+	/*
+	 * Put back the context reference which was incremented when hw_fence.defer_drawctxt was set
+	 */
+	kgsl_context_put(&drawctxt->base);
+
+	gen7_hwsched_active_count_put(adreno_dev);
+
+	_disable_hw_fence_throttle(adreno_dev, false);
+
+unlock:
+	mutex_unlock(&device->mutex);
+	mutex_unlock(&adreno_dev->hwsched.mutex);
+}
+
+static void process_hw_fence_ack(struct adreno_device *adreno_dev, u32 received_hdr)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct adreno_context *drawctxt = NULL;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	spin_lock(&hfi->hw_fence.lock);
+
+	/* If this ack is being waited on, we don't need to touch the unack count */
+	if (hw_fence_ack.sent_hdr && CMP_HFI_ACK_HDR(hw_fence_ack.sent_hdr, received_hdr)) {
+		spin_unlock(&hfi->hw_fence.lock);
+		complete(&hw_fence_ack.complete);
+		return;
+	}
+
+	hfi->hw_fence.unack_count--;
+
+	/* The unack count should never be greater than MAX_HW_FENCE_UNACK_COUNT */
+	if (hfi->hw_fence.unack_count > MAX_HW_FENCE_UNACK_COUNT)
+		dev_err(&gmu->pdev->dev, "unexpected hardware fence unack count:%d\n",
+			hfi->hw_fence.unack_count);
+
+	if (!test_bit(GEN7_HWSCHED_HW_FENCE_MAX_BIT, &hfi->hw_fence.flags) ||
+		(hfi->hw_fence.unack_count != MIN_HW_FENCE_UNACK_COUNT)) {
+		spin_unlock(&hfi->hw_fence.lock);
+		return;
+	}
+
+	drawctxt = hfi->hw_fence.defer_drawctxt;
+
+	spin_unlock(&hfi->hw_fence.lock);
+
+	del_timer_sync(&hfi->hw_fence_timer);
+
+	/*
+	 * We need to handle the deferred context in another thread so that we can unblock the f2h
+	 * daemon here as it will need to process the acks for the hardware fences belonging to the
+	 * deferred context
+	 */
+	if (drawctxt) {
+		kthread_init_work(&hfi->defer_hw_fence_work, gen7_defer_hw_fence_work);
+		kthread_queue_work(adreno_dev->hwsched.worker, &hfi->defer_hw_fence_work);
+		return;
+	}
+
+	_disable_hw_fence_throttle(adreno_dev, false);
+}
+
+void gen7_hwsched_process_msgq(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hw_hfi = to_gen7_hwsched_hfi(adreno_dev);
+	u32 rcvd[MAX_RCVD_SIZE], next_hdr, type;
+
+	mutex_lock(&hw_hfi->msgq_mutex);
+
+	for (;;) {
+		next_hdr = peek_next_header(gmu, HFI_MSG_ID);
+
+		if (!next_hdr)
+			break;
+
+		if (MSG_HDR_GET_TYPE(next_hdr) == HFI_MSG_ACK)
+			type = HFI_MSG_ACK;
+		else
+			type = MSG_HDR_GET_ID(next_hdr);
+
+		if (type != F2H_MSG_CONTEXT_BAD)
+			gen7_hfi_queue_read(gmu, HFI_MSG_ID, rcvd, sizeof(rcvd));
+
+		switch (type) {
+		case HFI_MSG_ACK:
+			/*
+			 * We are assuming that there is only one outstanding ack because hfi
+			 * sending thread waits for completion while holding the device mutex
+			 * (except when we send H2F_MSG_HW_FENCE_INFO packets)
+			 */
+			if (MSG_HDR_GET_ID(rcvd[1]) == H2F_MSG_HW_FENCE_INFO)
+				process_hw_fence_ack(adreno_dev, rcvd[1]);
+			else
+				gen7_receive_ack_async(adreno_dev, rcvd);
+			break;
+		case F2H_MSG_CONTEXT_BAD:
+			gen7_hfi_queue_read(gmu, HFI_MSG_ID, (u32 *)adreno_dev->hwsched.ctxt_bad,
+						HFI_MAX_MSG_SIZE);
+			process_ctx_bad(adreno_dev);
+			break;
+		case F2H_MSG_TS_RETIRE:
+			log_profiling_info(adreno_dev, rcvd);
+			adreno_hwsched_trigger(adreno_dev);
+			break;
+		case F2H_MSG_SYNCOBJ_QUERY:
+			gen7_trigger_syncobj_query(adreno_dev, rcvd);
+			break;
+		case F2H_MSG_GMU_CNTR_RELEASE: {
+			struct hfi_gmu_cntr_release_cmd *cmd =
+				(struct hfi_gmu_cntr_release_cmd *) rcvd;
+
+			adreno_perfcounter_put(adreno_dev,
+				cmd->group_id, cmd->countable, PERFCOUNTER_FLAG_KERNEL);
+			}
+			break;
+		}
+	}
+	mutex_unlock(&hw_hfi->msgq_mutex);
+}
+
+static void process_log_block(struct adreno_device *adreno_dev, void *data)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct hfi_log_block *cmd = data;
+	u32 *log_event = gmu->gmu_log->hostptr;
+	u32 start, end;
+
+	start = cmd->start_index;
+	end = cmd->stop_index;
+
+	log_event += start * 4;
+	while (start != end) {
+		trace_gmu_event(log_event);
+		log_event += 4;
+		start++;
+	}
+}
+
+static void gen7_hwsched_process_dbgq(struct adreno_device *adreno_dev, bool limited)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 rcvd[MAX_RCVD_SIZE];
+	bool recovery = false;
+
+	while (gen7_hfi_queue_read(gmu, HFI_DBG_ID, rcvd, sizeof(rcvd)) > 0) {
+
+		if (MSG_HDR_GET_ID(rcvd[0]) == F2H_MSG_ERR) {
+			adreno_gen7_receive_err_req(gmu, rcvd);
+			recovery = true;
+			break;
+		}
+
+		if (MSG_HDR_GET_ID(rcvd[0]) == F2H_MSG_DEBUG)
+			adreno_gen7_receive_debug_req(gmu, rcvd);
+
+		if (MSG_HDR_GET_ID(rcvd[0]) == F2H_MSG_LOG_BLOCK)
+			process_log_block(adreno_dev, rcvd);
+
+		/* Process one debug queue message and return to not delay msgq processing */
+		if (limited)
+			break;
+	}
+
+	if (!recovery)
+		return;
+
+	gen7_hwsched_fault(adreno_dev, ADRENO_GMU_FAULT);
+}
+
+/* HFI interrupt handler */
+static irqreturn_t gen7_hwsched_hfi_handler(int irq, void *data)
+{
+	struct adreno_device *adreno_dev = data;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 status = 0;
+
+	/*
+	 * GEN7_GMU_GMU2HOST_INTR_INFO may have bits set not specified in hfi->irq_mask.
+	 * Read and clear only those irq bits that we are processing here.
+	 */
+	gmu_core_regread(device, GEN7_GMU_GMU2HOST_INTR_INFO, &status);
+	gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_CLR, status & hfi->irq_mask);
+
+	/*
+	 * If interrupts are not enabled on the HFI message queue,
+	 * the inline message processing loop will process it,
+	 * else, process it here.
+	 */
+	if (!(hfi->irq_mask & HFI_IRQ_MSGQ_MASK))
+		status &= ~HFI_IRQ_MSGQ_MASK;
+
+	if (status & (HFI_IRQ_MSGQ_MASK | HFI_IRQ_DBGQ_MASK)) {
+		wake_up_interruptible(&hfi->f2h_wq);
+		adreno_hwsched_trigger(adreno_dev);
+	}
+	if (status & HFI_IRQ_CM3_FAULT_MASK) {
+		atomic_set(&gmu->cm3_fault, 1);
+
+		/* make sure other CPUs see the update */
+		smp_wmb();
+
+		dev_err_ratelimited(&gmu->pdev->dev,
+				"GMU CM3 fault interrupt received\n");
+
+		gen7_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+	}
+
+	/* Ignore OOB bits */
+	status &= GENMASK(31 - (oob_max - 1), 0);
+
+	if (status & ~hfi->irq_mask)
+		dev_err_ratelimited(&gmu->pdev->dev,
+			"Unhandled HFI interrupts 0x%x\n",
+			status & ~hfi->irq_mask);
+
+	return IRQ_HANDLED;
+}
+
+#define HFI_IRQ_MSGQ_MASK BIT(0)
+
+static int check_ack_failure(struct adreno_device *adreno_dev,
+	struct pending_cmd *ack)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (ack->results[2] != 0xffffffff)
+		return 0;
+
+	dev_err(&gmu->pdev->dev,
+		"ACK error: sender id %d seqnum %d\n",
+		MSG_HDR_GET_ID(ack->sent_hdr),
+		MSG_HDR_GET_SEQNUM(ack->sent_hdr));
+
+	return -EINVAL;
+}
+
+int gen7_hfi_send_cmd_async(struct adreno_device *adreno_dev, void *data, u32 size_bytes)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	u32 *cmd = data;
+	u32 seqnum;
+	int rc;
+	struct pending_cmd pending_ack;
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	*cmd = MSG_HDR_SET_SEQNUM_SIZE(*cmd, seqnum, size_bytes >> 2);
+
+	add_waiter(hfi, *cmd, &pending_ack);
+
+	rc = gen7_hfi_cmdq_write(adreno_dev, cmd, size_bytes);
+	if (rc)
+		goto done;
+
+	rc = adreno_hwsched_wait_ack_completion(adreno_dev, &gmu->pdev->dev, &pending_ack,
+		gen7_hwsched_process_msgq);
+	if (rc)
+		goto done;
+
+	rc = check_ack_failure(adreno_dev, &pending_ack);
+
+done:
+	del_waiter(hfi, &pending_ack);
+
+	return rc;
+}
+
+static void init_queues(struct gen7_hfi *hfi)
+{
+	u32 gmuaddr = hfi->hfi_mem->gmuaddr;
+	struct hfi_queue_table hfi_table = {
+		.qtbl_hdr = {
+			.version = 0,
+			.size = sizeof(struct hfi_queue_table) >> 2,
+			.qhdr0_offset =
+				sizeof(struct hfi_queue_table_header) >> 2,
+			.qhdr_size = sizeof(struct hfi_queue_header) >> 2,
+			.num_q = HFI_QUEUE_MAX,
+			.num_active_q = HFI_QUEUE_MAX,
+		},
+		.qhdr = {
+			DEFINE_QHDR(gmuaddr, HFI_CMD_ID, 0),
+			DEFINE_QHDR(gmuaddr, HFI_MSG_ID, 0),
+			DEFINE_QHDR(gmuaddr, HFI_DBG_ID, 0),
+			/* 4 DQs for RB priority 0 */
+			DEFINE_QHDR(gmuaddr, 3, 0),
+			DEFINE_QHDR(gmuaddr, 4, 0),
+			DEFINE_QHDR(gmuaddr, 5, 0),
+			DEFINE_QHDR(gmuaddr, 6, 0),
+			/* 4 DQs for RB priority 1 */
+			DEFINE_QHDR(gmuaddr, 7, 1),
+			DEFINE_QHDR(gmuaddr, 8, 1),
+			DEFINE_QHDR(gmuaddr, 9, 1),
+			DEFINE_QHDR(gmuaddr, 10, 1),
+			/* 3 DQs for RB priority 2 */
+			DEFINE_QHDR(gmuaddr, 11, 2),
+			DEFINE_QHDR(gmuaddr, 12, 2),
+			DEFINE_QHDR(gmuaddr, 13, 2),
+			/* 2 DQs for RB priority 3 */
+			DEFINE_QHDR(gmuaddr, 14, 3),
+			DEFINE_QHDR(gmuaddr, 15, 3),
+			/* 1 DQ for LPAC RB priority 4 */
+			DEFINE_QHDR(gmuaddr, 16, 4),
+		},
+	};
+
+	memcpy(hfi->hfi_mem->hostptr, &hfi_table, sizeof(hfi_table));
+}
+
+/* Total header sizes + queue sizes + 16 for alignment */
+#define HFIMEM_SIZE (sizeof(struct hfi_queue_table) + 16 + \
+	(SZ_4K * HFI_QUEUE_MAX))
+
+static int hfi_f2h_main(void *arg);
+
+int gen7_hwsched_hfi_init(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hw_hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct gen7_hfi *hfi = to_gen7_hfi(adreno_dev);
+
+	if (IS_ERR_OR_NULL(hw_hfi->big_ib)) {
+		hw_hfi->big_ib = gen7_reserve_gmu_kernel_block(
+				to_gen7_gmu(adreno_dev), 0,
+				HWSCHED_MAX_IBS * sizeof(struct hfi_issue_ib),
+				GMU_NONCACHED_KERNEL, 0);
+		if (IS_ERR(hw_hfi->big_ib))
+			return PTR_ERR(hw_hfi->big_ib);
+	}
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_LSR) &&
+			IS_ERR_OR_NULL(hw_hfi->big_ib_recurring)) {
+		hw_hfi->big_ib_recurring = gen7_reserve_gmu_kernel_block(
+				to_gen7_gmu(adreno_dev), 0,
+				HWSCHED_MAX_IBS * sizeof(struct hfi_issue_ib),
+				GMU_NONCACHED_KERNEL, 0);
+		if (IS_ERR(hw_hfi->big_ib_recurring))
+			return PTR_ERR(hw_hfi->big_ib_recurring);
+	}
+
+	if (IS_ERR_OR_NULL(hfi->hfi_mem)) {
+		hfi->hfi_mem = gen7_reserve_gmu_kernel_block(
+				to_gen7_gmu(adreno_dev),
+				0, HFIMEM_SIZE, GMU_NONCACHED_KERNEL, 0);
+		if (IS_ERR(hfi->hfi_mem))
+			return PTR_ERR(hfi->hfi_mem);
+		init_queues(hfi);
+	}
+
+	if (IS_ERR_OR_NULL(hw_hfi->f2h_task)) {
+		hw_hfi->f2h_task = kthread_run(hfi_f2h_main, adreno_dev, "gmu_f2h");
+		if(!IS_ERR(hw_hfi->f2h_task))
+			sched_set_fifo(hw_hfi->f2h_task);
+	}
+
+	return PTR_ERR_OR_ZERO(hw_hfi->f2h_task);
+}
+
+static int get_attrs(u32 flags)
+{
+	int attrs = IOMMU_READ;
+
+	if (flags & HFI_MEMFLAG_GMU_PRIV)
+		attrs |= IOMMU_PRIV;
+
+	if (flags & HFI_MEMFLAG_GMU_WRITEABLE)
+		attrs |= IOMMU_WRITE;
+
+	return attrs;
+}
+
+static int gmu_import_buffer(struct adreno_device *adreno_dev,
+	struct hfi_mem_alloc_entry *entry)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct hfi_mem_alloc_desc *desc = &entry->desc;
+	u32 vma_id = (desc->flags & HFI_MEMFLAG_GMU_CACHEABLE) ? GMU_CACHE : GMU_NONCACHED_KERNEL;
+
+	return gen7_gmu_import_buffer(gmu, vma_id, entry->md, get_attrs(desc->flags), desc->align);
+}
+
+static struct hfi_mem_alloc_entry *lookup_mem_alloc_table(
+	struct adreno_device *adreno_dev, struct hfi_mem_alloc_desc *desc)
+{
+	struct gen7_hwsched_hfi *hw_hfi = to_gen7_hwsched_hfi(adreno_dev);
+	int i;
+
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct hfi_mem_alloc_entry *entry = &hw_hfi->mem_alloc_table[i];
+
+		if ((entry->desc.mem_kind == desc->mem_kind) &&
+			(entry->desc.gmu_mem_handle == desc->gmu_mem_handle))
+			return entry;
+	}
+
+	return NULL;
+}
+
+static struct hfi_mem_alloc_entry *get_mem_alloc_entry(
+	struct adreno_device *adreno_dev, struct hfi_mem_alloc_desc *desc)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct hfi_mem_alloc_entry *entry =
+		lookup_mem_alloc_table(adreno_dev, desc);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u64 flags = 0;
+	u32 priv = 0;
+	int ret;
+	const char *memkind_string = desc->mem_kind < HFI_MEMKIND_MAX ?
+			hfi_memkind_strings[desc->mem_kind] : "UNKNOWN";
+
+	if (entry)
+		return entry;
+
+	if (desc->mem_kind >= HFI_MEMKIND_MAX) {
+		dev_err(&gmu->pdev->dev, "Invalid mem kind: %d\n",
+			desc->mem_kind);
+		return ERR_PTR(-EINVAL);
+	}
+
+	if (hfi->mem_alloc_entries == ARRAY_SIZE(hfi->mem_alloc_table)) {
+		dev_err(&gmu->pdev->dev,
+			"Reached max mem alloc entries\n");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	entry = &hfi->mem_alloc_table[hfi->mem_alloc_entries];
+
+	memcpy(&entry->desc, desc, sizeof(*desc));
+
+	entry->desc.host_mem_handle = desc->gmu_mem_handle;
+
+	if (desc->flags & HFI_MEMFLAG_GFX_PRIV)
+		priv |= KGSL_MEMDESC_PRIVILEGED;
+
+	if (!(desc->flags & HFI_MEMFLAG_GFX_WRITEABLE))
+		flags |= KGSL_MEMFLAGS_GPUREADONLY;
+
+	if (desc->flags & HFI_MEMFLAG_GFX_SECURE)
+		flags |= KGSL_MEMFLAGS_SECURE;
+
+	if (!(desc->flags & HFI_MEMFLAG_GFX_ACC) &&
+		(desc->mem_kind != HFI_MEMKIND_HW_FENCE)) {
+		if (desc->mem_kind == HFI_MEMKIND_MMIO_IPC_CORE)
+			entry->md = gen7_reserve_gmu_kernel_block_fixed(gmu, 0,
+					desc->size,
+					(desc->flags & HFI_MEMFLAG_GMU_CACHEABLE) ?
+					GMU_CACHE : GMU_NONCACHED_KERNEL,
+					"qcom,ipc-core", get_attrs(desc->flags),
+					desc->align);
+		else
+			entry->md = gen7_reserve_gmu_kernel_block(gmu, 0,
+					desc->size,
+					(desc->flags & HFI_MEMFLAG_GMU_CACHEABLE) ?
+					GMU_CACHE : GMU_NONCACHED_KERNEL,
+					desc->align);
+
+		if (IS_ERR(entry->md)) {
+			int ret = PTR_ERR(entry->md);
+
+			memset(entry, 0, sizeof(*entry));
+			return ERR_PTR(ret);
+		}
+		entry->desc.size = entry->md->size;
+		entry->desc.gmu_addr = entry->md->gmuaddr;
+
+		goto done;
+	}
+
+	/*
+	 * Use pre-allocated memory descriptors to map the HFI_MEMKIND_HW_FENCE and
+	 * HFI_MEMKIND_MEMSTORE
+	 */
+	switch (desc->mem_kind) {
+	case HFI_MEMKIND_HW_FENCE:
+		entry->md = &adreno_dev->hwsched.hw_fence.memdesc;
+		break;
+	case HFI_MEMKIND_MEMSTORE:
+		entry->md = device->memstore;
+		break;
+	default:
+		entry->md = kgsl_allocate_global(device, desc->size, 0, flags,
+			priv, memkind_string);
+		break;
+	}
+	if (IS_ERR(entry->md)) {
+		int ret = PTR_ERR(entry->md);
+
+		memset(entry, 0, sizeof(*entry));
+		return ERR_PTR(ret);
+	}
+
+	entry->desc.size = entry->md->size;
+	entry->desc.gpu_addr = entry->md->gpuaddr;
+
+	if (!(desc->flags & HFI_MEMFLAG_GMU_ACC))
+		goto done;
+
+	 /*
+	  * If gmu mapping fails, then we have to live with
+	  * leaking the gpu global buffer allocated above.
+	  */
+	ret = gmu_import_buffer(adreno_dev, entry);
+	if (ret) {
+		dev_err(&gmu->pdev->dev,
+			"gpuaddr: 0x%llx size: %lld bytes lost\n",
+			entry->md->gpuaddr, entry->md->size);
+		memset(entry, 0, sizeof(*entry));
+		return ERR_PTR(ret);
+	}
+
+	entry->desc.gmu_addr = entry->md->gmuaddr;
+done:
+	hfi->mem_alloc_entries++;
+
+	return entry;
+}
+
+static int process_mem_alloc(struct adreno_device *adreno_dev,
+	struct hfi_mem_alloc_desc *mad)
+{
+	struct hfi_mem_alloc_entry *entry;
+
+	entry = get_mem_alloc_entry(adreno_dev, mad);
+	if (IS_ERR(entry))
+		return PTR_ERR(entry);
+
+	if (entry->md) {
+		mad->gpu_addr = entry->md->gpuaddr;
+		mad->gmu_addr = entry->md->gmuaddr;
+	}
+
+	/*
+	 * GMU uses the host_mem_handle to check if this memalloc was
+	 * successful
+	 */
+	mad->host_mem_handle = mad->gmu_mem_handle;
+
+	return 0;
+}
+
+static int mem_alloc_reply(struct adreno_device *adreno_dev, void *rcvd)
+{
+	struct hfi_mem_alloc_desc desc = {0};
+	struct hfi_mem_alloc_reply_cmd out = {0};
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 seqnum;
+	int ret;
+
+	hfi_get_mem_alloc_desc(rcvd, &desc);
+
+	ret = process_mem_alloc(adreno_dev, &desc);
+	if (ret)
+		return ret;
+
+	memcpy(&out.desc, &desc, sizeof(out.desc));
+
+	out.hdr = ACK_MSG_HDR(F2H_MSG_MEM_ALLOC);
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	out.hdr = MSG_HDR_SET_SEQNUM_SIZE(out.hdr, seqnum, sizeof(out) >> 2);
+
+	out.req_hdr = *(u32 *)rcvd;
+
+	return gen7_hfi_cmdq_write(adreno_dev, (u32 *)&out, sizeof(out));
+}
+
+static int gmu_cntr_register_reply(struct adreno_device *adreno_dev, void *rcvd)
+{
+	struct hfi_gmu_cntr_register_cmd *in = (struct hfi_gmu_cntr_register_cmd *)rcvd;
+	struct hfi_gmu_cntr_register_reply_cmd out = {0};
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 lo = 0, hi = 0, seqnum;
+
+	/*
+	 * Failure to allocate counter is not fatal. Sending lo = 0, hi = 0
+	 * indicates to GMU that counter allocation failed.
+	 */
+	adreno_perfcounter_get(adreno_dev,
+		in->group_id, in->countable, &lo, &hi, PERFCOUNTER_FLAG_KERNEL);
+
+	out.hdr = ACK_MSG_HDR(F2H_MSG_GMU_CNTR_REGISTER);
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	out.hdr = MSG_HDR_SET_SEQNUM_SIZE(out.hdr, seqnum, sizeof(out) >> 2);
+	out.req_hdr = in->hdr;
+	out.group_id = in->group_id;
+	out.countable = in->countable;
+	/* Fill in byte offset of counter */
+	out.cntr_lo = lo << 2;
+	out.cntr_hi = hi << 2;
+
+	return gen7_hfi_cmdq_write(adreno_dev, (u32 *)&out, sizeof(out));
+}
+
+static int send_warmboot_start_msg(struct adreno_device *adreno_dev)
+{
+	int ret = 0;
+	struct hfi_start_cmd cmd;
+
+	if (!adreno_dev->warmboot_enabled)
+		return ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_START);
+	if (ret)
+		return ret;
+
+	cmd.hdr = RECORD_NOP_MSG_HDR(cmd.hdr);
+
+	return gen7_hfi_send_generic_req(adreno_dev, &cmd, sizeof(cmd));
+}
+
+static int send_start_msg(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 seqnum;
+	int read_size, rc = 0;
+	struct hfi_start_cmd cmd;
+	u32 rcvd[MAX_RCVD_SIZE];
+	struct pending_cmd pending_ack = {0};
+
+	rc = CMD_MSG_HDR(cmd, H2F_MSG_START);
+	if (rc)
+		return rc;
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	cmd.hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd.hdr, seqnum, sizeof(cmd) >> 2);
+
+	pending_ack.sent_hdr = cmd.hdr;
+
+	rc = gen7_hfi_cmdq_write(adreno_dev, (u32 *)&cmd, sizeof(cmd));
+	if (rc)
+		return rc;
+
+	/*
+	 * This will never be an infinite loop. We break out either when we receive the
+	 * HFI_MSG_ACK or when we timeout waiting for the ack.
+	 */
+	while (true) {
+		rc = gmu_core_timed_poll_check(device, GEN7_GMU_GMU2HOST_INTR_INFO,
+			HFI_IRQ_MSGQ_MASK, HFI_RSP_TIMEOUT, HFI_IRQ_MSGQ_MASK);
+
+		if (rc) {
+			dev_err(&gmu->pdev->dev,
+				"Timed out processing MSG_START seqnum: %d\n",
+				seqnum);
+			gmu_core_fault_snapshot(device);
+			return rc;
+		}
+
+		/* Clear the interrupt */
+		gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_CLR, HFI_IRQ_MSGQ_MASK);
+
+		read_size = gen7_hfi_queue_read(gmu, HFI_MSG_ID, rcvd, sizeof(rcvd));
+
+		if (read_size <= 0) {
+			dev_err(&gmu->pdev->dev, "MSG_START: no payload\n");
+			gmu_core_fault_snapshot(device);
+			return -EINVAL;
+		}
+
+		/* Loop through the msg queue to read all messages */
+		while (read_size > 0) {
+			switch (MSG_HDR_GET_ID(rcvd[0])) {
+			case F2H_MSG_MEM_ALLOC:
+				rc = mem_alloc_reply(adreno_dev, rcvd);
+				break;
+			case F2H_MSG_GMU_CNTR_REGISTER:
+				rc = gmu_cntr_register_reply(adreno_dev, rcvd);
+				break;
+			default:
+				if (MSG_HDR_GET_TYPE(rcvd[0]) == HFI_MSG_ACK) {
+					rc = gen7_receive_ack_cmd(gmu, rcvd, &pending_ack);
+					if (rc)
+						return rc;
+					return check_ack_failure(adreno_dev, &pending_ack);
+				}
+
+				dev_err(&gmu->pdev->dev,
+					"MSG_START: unexpected response id:%d, type:%d\n",
+					MSG_HDR_GET_ID(rcvd[0]),
+					MSG_HDR_GET_TYPE(rcvd[0]));
+
+				gmu_core_fault_snapshot(device);
+				return -EINVAL;
+			}
+
+			if (rc)
+				return rc;
+
+			/* Clear the interrupt before checking the queue again */
+			gmu_core_regwrite(device, GEN7_GMU_GMU2HOST_INTR_CLR, HFI_IRQ_MSGQ_MASK);
+			read_size = gen7_hfi_queue_read(gmu, HFI_MSG_ID, rcvd, sizeof(rcvd));
+		}
+	}
+}
+
+static void reset_hfi_mem_records(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hw_hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct kgsl_memdesc *md = NULL;
+	u32 i;
+
+	for (i = 0; i < hw_hfi->mem_alloc_entries; i++) {
+		struct hfi_mem_alloc_desc *desc = &hw_hfi->mem_alloc_table[i].desc;
+
+		if (desc->flags & HFI_MEMFLAG_HOST_INIT) {
+			md = hw_hfi->mem_alloc_table[i].md;
+			memset(md->hostptr, 0x0, md->size);
+		}
+	}
+}
+
+static void reset_hfi_queues(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct hfi_queue_table *tbl = gmu->hfi.hfi_mem->hostptr;
+	u32 i;
+
+	/* Flush HFI queues */
+	for (i = 0; i < HFI_QUEUE_MAX; i++) {
+		struct hfi_queue_header *hdr = &tbl->qhdr[i];
+
+		if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+			continue;
+
+		hdr->read_index = hdr->write_index;
+	}
+}
+
+void gen7_hwsched_hfi_stop(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+
+	hfi->irq_mask &= ~HFI_IRQ_MSGQ_MASK;
+
+	/*
+	 * In some corner cases, it is possible that GMU put TS_RETIRE
+	 * on the msgq after we have turned off gmu interrupts. Hence,
+	 * drain the queue one last time before we reset HFI queues.
+	 */
+	gen7_hwsched_process_msgq(adreno_dev);
+
+	/* Drain the debug queue before we reset HFI queues */
+	gen7_hwsched_process_dbgq(adreno_dev, false);
+
+	kgsl_pwrctrl_axi(KGSL_DEVICE(adreno_dev), false);
+
+	clear_bit(GMU_PRIV_HFI_STARTED, &gmu->flags);
+
+	/*
+	 * Reset the hfi host access memory records, As GMU expects hfi memory
+	 * records to be clear in bootup.
+	 */
+	reset_hfi_mem_records(adreno_dev);
+}
+
+static void gen7_hwsched_enable_async_hfi(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+
+	hfi->irq_mask |= HFI_IRQ_MSGQ_MASK;
+
+	gmu_core_regwrite(KGSL_DEVICE(adreno_dev), GEN7_GMU_GMU2HOST_INTR_MASK,
+		(u32)~hfi->irq_mask);
+}
+
+static int enable_preemption(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 data;
+	int ret;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	/*
+	 * Bits [0:1] contains the preemption level
+	 * Bit 2 is to enable/disable gmem save/restore
+	 * Bit 3 is to enable/disable skipsaverestore
+	 */
+	data = FIELD_PREP(GENMASK(1, 0), adreno_dev->preempt.preempt_level) |
+			FIELD_PREP(BIT(2), adreno_dev->preempt.usesgmem) |
+			FIELD_PREP(BIT(3), adreno_dev->preempt.skipsaverestore);
+
+	ret = gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_PREEMPTION, 1,
+			data);
+	if (ret)
+		return ret;
+
+	if (gen7_core->qos_value) {
+		int i;
+
+		for (i = 0; i < KGSL_PRIORITY_MAX_RB_LEVELS; i++) {
+			if (!gen7_core->qos_value[i])
+				continue;
+
+			gen7_hfi_send_set_value(adreno_dev,
+				HFI_VALUE_RB_GPU_QOS, i,
+				gen7_core->qos_value[i]);
+		}
+	}
+
+	if (device->pwrctrl.rt_bus_hint) {
+		ret = gen7_hfi_send_set_value(adreno_dev, HFI_VALUE_RB_IB_RULE, 0,
+			device->pwrctrl.rt_bus_hint);
+		if (ret)
+			device->pwrctrl.rt_bus_hint = 0;
+	}
+
+	/*
+	 * Bits[3:0] contain the preemption timeout enable bit per ringbuffer
+	 * Bits[31:4] contain the timeout in ms
+	 */
+	return gen7_hfi_send_set_value(adreno_dev, HFI_VALUE_BIN_TIME, 1,
+		FIELD_PREP(GENMASK(31, 4), ADRENO_PREEMPT_TIMEOUT) |
+		FIELD_PREP(GENMASK(3, 0), 0xf));
+
+}
+
+static int enable_gmu_stats(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 data;
+
+	if (!gmu->stats_enable)
+		return 0;
+
+	/*
+	 * Bits [23:0] contains the countables mask
+	 * Bits [31:24] is the sampling interval
+	 */
+	data = FIELD_PREP(GENMASK(23, 0), gmu->stats_mask) |
+		FIELD_PREP(GENMASK(31, 24), gmu->stats_interval);
+
+	return gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_GMU_STATS, 1, data);
+}
+
+static int gen7_hfi_send_perfcounter_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	/*
+	 * Perfcounter retention is disabled by default in GMU firmware.
+	 * In case perfcounter retention behaviour is overwritten by sysfs
+	 * setting dynmaically, send this HFI feature with 'enable = 0' to
+	 * disable this feature in GMU firmware.
+	 */
+	if (adreno_dev->perfcounter)
+		return gen7_hfi_send_feature_ctrl(adreno_dev,
+				HFI_FEATURE_PERF_NORETAIN, 0, 0);
+
+	return 0;
+}
+
+u32 gen7_hwsched_hfi_get_value(struct adreno_device *adreno_dev, u32 prop)
+{
+	struct hfi_get_value_cmd cmd;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct pending_cmd pending_ack;
+	int rc;
+	u32 seqnum;
+
+	rc = CMD_MSG_HDR(cmd, H2F_MSG_GET_VALUE);
+	if (rc)
+		return 0;
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	cmd.hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd.hdr, seqnum, sizeof(cmd) >> 2);
+	cmd.type = prop;
+	cmd.subtype = 0;
+
+	add_waiter(hfi, cmd.hdr, &pending_ack);
+
+	rc = gen7_hfi_cmdq_write(adreno_dev, (u32 *)&cmd, sizeof(cmd));
+	if (rc)
+		goto done;
+
+	rc = adreno_hwsched_wait_ack_completion(adreno_dev, &gmu->pdev->dev, &pending_ack,
+		gen7_hwsched_process_msgq);
+
+done:
+	del_waiter(hfi, &pending_ack);
+
+	if (rc || (pending_ack.results[2] == UINT_MAX))
+		return 0;
+
+	return pending_ack.results[2];
+}
+
+static void _context_queue_enable(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (GMU_VER_MINOR(gmu->ver.hfi) >= 3) {
+		if (gen7_hfi_send_get_value(adreno_dev, HFI_VALUE_CONTEXT_QUEUE, 0) == 1) {
+			set_bit(ADRENO_HWSCHED_CONTEXT_QUEUE, &adreno_dev->hwsched.flags);
+		}
+	}
+}
+
+static int gen7_hfi_send_hw_fence_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	int ret;
+
+	if (!test_bit(ADRENO_HWSCHED_HW_FENCE, &hwsched->flags))
+		return 0;
+
+	ret = gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_HW_FENCE, 1, 0);
+	if (ret && (ret == -ENOENT)) {
+		dev_err(&gmu->pdev->dev, "GMU doesn't support HW_FENCE feature\n");
+		adreno_hwsched_deregister_hw_fence(hwsched->hw_fence.handle);
+		return 0;
+	}
+
+	return ret;
+}
+
+static int gen7_hfi_send_dms_feature_ctrl(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret;
+
+	if (!test_bit(ADRENO_DEVICE_DMS, &adreno_dev->priv))
+		return 0;
+
+	ret = gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_DMS, 1, 0);
+	if (ret == -ENOENT) {
+		dev_err(&gmu->pdev->dev, "GMU doesn't support DMS feature\n");
+		clear_bit(ADRENO_DEVICE_DMS, &adreno_dev->priv);
+		adreno_dev->dms_enabled = false;
+		return 0;
+	}
+
+	return ret;
+}
+
+static void gen7_spin_idle_debug_lpac(struct adreno_device *adreno_dev,
+				const char *str)
+{
+	struct kgsl_device *device = &adreno_dev->dev;
+	u32 rptr, wptr, status, status3, intstatus, hwfault;
+	bool val = adreno_is_preemption_enabled(adreno_dev);
+
+	dev_err(device->dev, str);
+
+	kgsl_regread(device, GEN7_CP_LPAC_RB_RPTR, &rptr);
+	kgsl_regread(device, GEN7_CP_LPAC_RB_WPTR, &wptr);
+
+	kgsl_regread(device, GEN7_RBBM_STATUS, &status);
+	kgsl_regread(device, GEN7_RBBM_STATUS3, &status3);
+	kgsl_regread(device, GEN7_RBBM_INT_0_STATUS, &intstatus);
+	kgsl_regread(device, GEN7_CP_HW_FAULT, &hwfault);
+
+	dev_err(device->dev,
+		"LPAC rb=%d pos=%X/%X rbbm_status=%8.8X/%8.8X int_0_status=%8.8X\n",
+		val ? KGSL_LPAC_RB_ID : 1, rptr, wptr,
+		status, status3, intstatus);
+
+	dev_err(device->dev, " hwfault=%8.8X\n", hwfault);
+
+	kgsl_device_snapshot(device, NULL, NULL, false);
+}
+
+static bool gen7_hwsched_warmboot_possible(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	if (adreno_dev->warmboot_enabled && test_bit(GMU_PRIV_WARMBOOT_GMU_INIT_DONE, &gmu->flags)
+		&& test_bit(GMU_PRIV_WARMBOOT_GPU_BOOT_DONE, &gmu->flags) &&
+		!test_bit(ADRENO_DEVICE_FORCE_COLDBOOT, &adreno_dev->priv))
+		return true;
+
+	return false;
+}
+
+static int gen7_hwsched_hfi_send_warmboot_cmd(struct adreno_device *adreno_dev,
+		struct kgsl_memdesc *desc, u32 flag, bool async, struct pending_cmd *ack)
+{
+	struct hfi_warmboot_scratch_cmd cmd = {0};
+	int ret;
+
+	if (!adreno_dev->warmboot_enabled)
+		return 0;
+
+	cmd.scratch_addr = desc->gmuaddr;
+	cmd.scratch_size =  desc->size;
+	cmd.flags = flag;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_WARMBOOT_CMD);
+	if (ret)
+		return ret;
+
+	if (async)
+		return gen7_hfi_send_cmd_async(adreno_dev, &cmd, sizeof(cmd));
+
+	return gen7_hfi_send_generic_req_v5(adreno_dev, &cmd, ack, sizeof(cmd));
+}
+
+static int gen7_hwsched_hfi_warmboot_gpu_cmd(struct adreno_device *adreno_dev,
+		struct pending_cmd *ret_cmd)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct hfi_warmboot_scratch_cmd cmd = {
+		.scratch_addr = gmu->gpu_boot_scratch->gmuaddr,
+		.scratch_size = gmu->gpu_boot_scratch->size,
+		.flags = HFI_WARMBOOT_EXEC_SCRATCH,
+	};
+	int ret = 0;
+	u32 seqnum;
+
+	if (!adreno_dev->warmboot_enabled)
+		return 0;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_WARMBOOT_CMD);
+	if (ret)
+		return ret;
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	cmd.hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd.hdr, seqnum, sizeof(cmd) >> 2);
+
+	add_waiter(hfi, cmd.hdr, ret_cmd);
+
+	ret = gen7_hfi_cmdq_write(adreno_dev, (u32 *)&cmd, sizeof(cmd));
+	if (ret)
+		goto err;
+
+	ret = adreno_hwsched_wait_ack_completion(adreno_dev, &gmu->pdev->dev, ret_cmd,
+		gen7_hwsched_process_msgq);
+err:
+	del_waiter(hfi, ret_cmd);
+
+	return ret;
+}
+
+static int gen7_hwsched_warmboot_gpu(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct pending_cmd ret_cmd = {0};
+	int ret = 0;
+
+	ret = gen7_hwsched_hfi_warmboot_gpu_cmd(adreno_dev, &ret_cmd);
+	if (!ret)
+		return ret;
+
+	if (MSG_HDR_GET_TYPE(ret_cmd.results[1]) != H2F_MSG_WARMBOOT_CMD)
+		goto err;
+
+	switch (MSG_HDR_GET_TYPE(ret_cmd.results[2])) {
+	case H2F_MSG_ISSUE_CMD_RAW: {
+		if (ret_cmd.results[2] == gmu->cp_init_hdr)
+			gen7_spin_idle_debug(adreno_dev,
+				"CP initialization failed to idle\n");
+		else if (ret_cmd.results[2] == gmu->switch_to_unsec_hdr)
+			gen7_spin_idle_debug(adreno_dev,
+				"Switch to unsecure failed to idle\n");
+		}
+		break;
+	case H2F_MSG_ISSUE_LPAC_CMD_RAW:
+		gen7_spin_idle_debug_lpac(adreno_dev,
+			"LPAC CP initialization failed to idle\n");
+		break;
+	}
+err:
+	/* Clear the bit on error so that in the next slumber exit we coldboot */
+	clear_bit(GMU_PRIV_WARMBOOT_GPU_BOOT_DONE, &gmu->flags);
+	gen7_disable_gpu_irq(adreno_dev);
+	return ret;
+}
+
+static int gen7_hwsched_coldboot_gpu(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hfi *hfi = to_gen7_hfi(adreno_dev);
+	struct pending_cmd ack = {0};
+	int ret = 0;
+
+	/* Clear the bit so we can set it when GPU bootup message recording is successful */
+	clear_bit(GMU_PRIV_WARMBOOT_GPU_BOOT_DONE, &gmu->flags);
+
+	ret = gen7_hwsched_hfi_send_warmboot_cmd(adreno_dev, gmu->gpu_boot_scratch,
+		 HFI_WARMBOOT_SET_SCRATCH, true, &ack);
+	if (ret)
+		goto done;
+
+	ret = gen7_hwsched_cp_init(adreno_dev);
+	if (ret)
+		goto done;
+
+	ret = gen7_hwsched_lpac_cp_init(adreno_dev);
+	if (ret)
+		goto done;
+
+	ret = gen7_hwsched_hfi_send_warmboot_cmd(adreno_dev, gmu->gpu_boot_scratch,
+		HFI_WARMBOOT_QUERY_SCRATCH, true, &ack);
+	if (ret)
+		goto done;
+
+	if (adreno_dev->warmboot_enabled)
+		set_bit(GMU_PRIV_WARMBOOT_GPU_BOOT_DONE, &gmu->flags);
+
+done:
+	/* Clear the bitmask so that we don't send record bit with future HFI messages */
+	memset(hfi->wb_set_record_bitmask, 0x0, sizeof(hfi->wb_set_record_bitmask));
+
+	if (ret)
+		gen7_disable_gpu_irq(adreno_dev);
+
+	return ret;
+}
+
+int gen7_hwsched_boot_gpu(struct adreno_device *adreno_dev)
+{
+	/* If warmboot is possible just send the warmboot command else coldboot */
+	if (gen7_hwsched_warmboot_possible(adreno_dev))
+		return gen7_hwsched_warmboot_gpu(adreno_dev);
+	else
+		return gen7_hwsched_coldboot_gpu(adreno_dev);
+}
+
+static int gen7_hwsched_setup_default_votes(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = 0;
+
+	/* Request default DCVS level */
+	ret = kgsl_pwrctrl_set_default_gpu_pwrlevel(device);
+	if (ret)
+		return ret;
+
+	/* Request default BW vote */
+	return kgsl_pwrctrl_axi(device, true);
+}
+
+static int gen7_hwsched_warmboot_init_gmu(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct pending_cmd ack = {0};
+	int ret = 0;
+
+	ret = gen7_hwsched_hfi_send_warmboot_cmd(adreno_dev, gmu->gmu_init_scratch,
+		 HFI_WARMBOOT_EXEC_SCRATCH, false, &ack);
+	if (ret)
+		goto err;
+
+	gen7_hwsched_enable_async_hfi(adreno_dev);
+
+	set_bit(GMU_PRIV_HFI_STARTED, &gmu->flags);
+
+	ret = gen7_hwsched_setup_default_votes(adreno_dev);
+
+err:
+	if (ret) {
+		/* Clear the bit in case of an error so next boot will be coldboot */
+		clear_bit(GMU_PRIV_WARMBOOT_GMU_INIT_DONE, &gmu->flags);
+		gen7_hwsched_hfi_stop(adreno_dev);
+	}
+
+	return ret;
+}
+
+static void warmboot_init_message_record_bitmask(struct adreno_device *adreno_dev)
+{
+	struct gen7_hfi *hfi = to_gen7_hfi(adreno_dev);
+
+	if (!adreno_dev->warmboot_enabled)
+		return;
+
+	/* Set the record bit for all the messages */
+	memset(hfi->wb_set_record_bitmask, 0xFF, sizeof(hfi->wb_set_record_bitmask));
+
+	/* These messages should not be recorded */
+	clear_bit(H2F_MSG_WARMBOOT_CMD, hfi->wb_set_record_bitmask);
+	clear_bit(H2F_MSG_START, hfi->wb_set_record_bitmask);
+	clear_bit(H2F_MSG_GET_VALUE, hfi->wb_set_record_bitmask);
+	clear_bit(H2F_MSG_GX_BW_PERF_VOTE, hfi->wb_set_record_bitmask);
+}
+
+int gen7_hwsched_hfi_start(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct pending_cmd ack = {0};
+	int ret;
+
+	reset_hfi_queues(adreno_dev);
+
+	ret = gen7_gmu_hfi_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	if (gen7_hwsched_warmboot_possible(adreno_dev))
+		return gen7_hwsched_warmboot_init_gmu(adreno_dev);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_GMU_WARMBOOT) &&
+		(!test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags))) {
+		if (gen7_hfi_send_get_value(adreno_dev, HFI_VALUE_GMU_WARMBOOT, 0) == 1)
+			adreno_dev->warmboot_enabled = true;
+	}
+
+	warmboot_init_message_record_bitmask(adreno_dev);
+
+	/* Reset the variable here and set it when we successfully record the scratch */
+	clear_bit(GMU_PRIV_WARMBOOT_GMU_INIT_DONE, &gmu->flags);
+
+	ret = gen7_hwsched_hfi_send_warmboot_cmd(adreno_dev, gmu->gmu_init_scratch,
+		HFI_WARMBOOT_SET_SCRATCH, false, &ack);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_gpu_perf_table(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_generic_req(adreno_dev, &gmu->hfi.bw_table, sizeof(gmu->hfi.bw_table));
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_acd_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_bcl_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_clx_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_ifpc_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_HWSCHED, 1, 0);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_KPROF, 1, 0);
+	if (ret)
+		goto err;
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_LSR)) {
+		ret = gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_LSR,
+				1, 0);
+		if (ret)
+			goto err;
+	}
+
+	ret = gen7_hfi_send_perfcounter_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_dms_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	/* Enable the long ib timeout detection */
+	if (adreno_long_ib_detect(adreno_dev)) {
+		ret = gen7_hfi_send_feature_ctrl(adreno_dev,
+			HFI_FEATURE_BAIL_OUT_TIMER, 1, 0);
+		if (ret)
+			goto err;
+	}
+
+	enable_gmu_stats(adreno_dev);
+
+	if (gmu->log_stream_enable)
+		gen7_hfi_send_set_value(adreno_dev,
+			HFI_VALUE_LOG_STREAM_ENABLE, 0, 1);
+
+	if (gmu->log_group_mask)
+		gen7_hfi_send_set_value(adreno_dev,
+			HFI_VALUE_LOG_GROUP, 0, gmu->log_group_mask);
+
+	ret = gen7_hfi_send_core_fw_start(adreno_dev);
+	if (ret)
+		goto err;
+
+	/*
+	 * HFI_VALUE_CONTEXT_QUEUE can only be queried after GMU has initialized some of the
+	 * required resources as part of handling gen7_hfi_send_core_fw_start()
+	 */
+	if (!test_bit(GMU_PRIV_FIRST_BOOT_DONE, &gmu->flags)) {
+		_context_queue_enable(adreno_dev);
+		adreno_hwsched_register_hw_fence(adreno_dev);
+	}
+
+	ret = gen7_hfi_send_hw_fence_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = enable_preemption(adreno_dev);
+	if (ret)
+		goto err;
+
+	ret = gen7_hfi_send_lpac_feature_ctrl(adreno_dev);
+	if (ret)
+		goto err;
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_AQE)) {
+		ret = gen7_hfi_send_feature_ctrl(adreno_dev, HFI_FEATURE_AQE, 1, 0);
+		if (ret)
+			goto err;
+	}
+
+	ret = send_start_msg(adreno_dev);
+	if (ret)
+		goto err;
+
+	/*
+	 * Send this additional start message on cold boot if warmboot is enabled.
+	 * This message will be recorded and on a warmboot this will trigger the
+	 * sequence to replay memory allocation requests and ECP task setup
+	 */
+	ret = send_warmboot_start_msg(adreno_dev);
+	if (ret)
+		goto err;
+
+	gen7_hwsched_enable_async_hfi(adreno_dev);
+
+	set_bit(GMU_PRIV_HFI_STARTED, &gmu->flags);
+
+	/* Send this message only on cold boot */
+	ret = gen7_hwsched_hfi_send_warmboot_cmd(adreno_dev, gmu->gmu_init_scratch,
+		HFI_WARMBOOT_QUERY_SCRATCH, true, &ack);
+	if (ret)
+		goto err;
+
+	if (adreno_dev->warmboot_enabled)
+		set_bit(GMU_PRIV_WARMBOOT_GMU_INIT_DONE, &gmu->flags);
+
+	ret = gen7_hwsched_setup_default_votes(adreno_dev);
+
+err:
+	if (ret)
+		gen7_hwsched_hfi_stop(adreno_dev);
+
+	return ret;
+}
+
+static int submit_raw_cmds(struct adreno_device *adreno_dev, void *cmds, u32 size_bytes,
+	const char *str)
+{
+	int ret;
+
+	ret = gen7_hfi_send_cmd_async(adreno_dev, cmds, size_bytes);
+	if (ret)
+		return ret;
+
+	ret = gmu_core_timed_poll_check(KGSL_DEVICE(adreno_dev),
+			GEN7_GPU_GMU_AO_GPU_CX_BUSY_STATUS, 0, 200, BIT(23));
+	if (ret)
+		gen7_spin_idle_debug(adreno_dev, str);
+
+	return ret;
+}
+
+static int submit_lpac_raw_cmds(struct adreno_device *adreno_dev, void *cmds, u32 size_bytes,
+	const char *str)
+{
+	int ret;
+
+	ret = gen7_hfi_send_cmd_async(adreno_dev, cmds, size_bytes);
+	if (ret)
+		return ret;
+
+	ret = gmu_core_timed_poll_check(KGSL_DEVICE(adreno_dev),
+			GEN7_GPU_GMU_AO_GPU_LPAC_BUSY_STATUS, 0, 200, BIT(23));
+	if (ret)
+		gen7_spin_idle_debug_lpac(adreno_dev, str);
+
+	return ret;
+}
+
+static int cp_init(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 cmds[GEN7_CP_INIT_DWORDS + 1];
+	int ret = 0;
+
+	cmds[0] = CREATE_MSG_HDR(H2F_MSG_ISSUE_CMD_RAW, HFI_MSG_CMD);
+
+	gen7_cp_init_cmds(adreno_dev, &cmds[1]);
+
+	ret = submit_raw_cmds(adreno_dev, cmds, sizeof(cmds),
+			"CP initialization failed to idle\n");
+
+	/* Save the header incase we need a warmboot debug */
+	gmu->cp_init_hdr = cmds[0];
+
+	return ret;
+}
+
+static int send_switch_to_unsecure(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 cmds[3];
+	int ret = 0;
+
+	cmds[0] = CREATE_MSG_HDR(H2F_MSG_ISSUE_CMD_RAW, HFI_MSG_CMD);
+
+	cmds[1] = cp_type7_packet(CP_SET_SECURE_MODE, 1);
+	cmds[2] = 0;
+
+	ret = submit_raw_cmds(adreno_dev, cmds, sizeof(cmds),
+			"Switch to unsecure failed to idle\n");
+
+	/* Save the header incase we need a warmboot debug */
+	gmu->switch_to_unsec_hdr = cmds[0];
+
+	return ret;
+}
+
+int gen7_hwsched_cp_init(struct adreno_device *adreno_dev)
+{
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	int ret;
+
+	ret = cp_init(adreno_dev);
+	if (ret)
+		return ret;
+
+	ret = adreno_zap_shader_load(adreno_dev, gen7_core->zap_name);
+	if (ret)
+		return ret;
+
+	if (!adreno_dev->zap_loaded)
+		kgsl_regwrite(KGSL_DEVICE(adreno_dev),
+			GEN7_RBBM_SECVID_TRUST_CNTL, 0x0);
+	else
+		ret = send_switch_to_unsecure(adreno_dev);
+
+	return ret;
+}
+
+int gen7_hwsched_lpac_cp_init(struct adreno_device *adreno_dev)
+{
+	u32 cmds[GEN7_CP_INIT_DWORDS + 1];
+
+	if (!adreno_dev->lpac_enabled)
+		return 0;
+
+	cmds[0] = CREATE_MSG_HDR(H2F_MSG_ISSUE_LPAC_CMD_RAW, HFI_MSG_CMD);
+
+	gen7_cp_init_cmds(adreno_dev, &cmds[1]);
+
+	return submit_lpac_raw_cmds(adreno_dev, cmds, sizeof(cmds),
+			"LPAC CP initialization failed to idle\n");
+}
+
+static bool is_queue_empty(struct adreno_device *adreno_dev, u32 queue_idx)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_memdesc *mem_addr = gmu->hfi.hfi_mem;
+	struct hfi_queue_table *tbl = mem_addr->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED)
+		return true;
+
+	if (hdr->read_index == hdr->write_index)
+		return true;
+
+	return false;
+}
+
+static int hfi_f2h_main(void *arg)
+{
+	struct adreno_device *adreno_dev = arg;
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+
+	while (!kthread_should_stop()) {
+		wait_event_interruptible(hfi->f2h_wq, kthread_should_stop() ||
+			/* If msgq irq is enabled and msgq has messages to process */
+			(((hfi->irq_mask & HFI_IRQ_MSGQ_MASK) &&
+			!is_queue_empty(adreno_dev, HFI_MSG_ID)) ||
+			/* Trace buffer has messages to process */
+			!gmu_core_is_trace_empty(gmu->trace.md->hostptr) ||
+			/* Dbgq has messages to process */
+			!is_queue_empty(adreno_dev, HFI_DBG_ID)));
+
+		if (kthread_should_stop())
+			break;
+
+		gen7_hwsched_process_msgq(adreno_dev);
+		gmu_core_process_trace_data(KGSL_DEVICE(adreno_dev),
+					&gmu->pdev->dev, &gmu->trace);
+		gen7_hwsched_process_dbgq(adreno_dev, true);
+	}
+
+	return 0;
+}
+
+static void gen7_hwsched_hw_fence_timeout(struct work_struct *work)
+{
+	struct gen7_hwsched_hfi *hfi = container_of(work, struct gen7_hwsched_hfi, hw_fence_ws);
+	struct gen7_hwsched_device *gen7_hw_dev = container_of(hfi, struct gen7_hwsched_device,
+						hwsched_hfi);
+	struct adreno_device *adreno_dev = &gen7_hw_dev->gen7_dev.adreno_dev;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 unack_count, ts;
+	struct adreno_context *drawctxt = NULL;
+	bool fault;
+
+	/* Check msgq one last time before recording a fault */
+	gen7_hwsched_process_msgq(adreno_dev);
+
+	spin_lock(&hfi->hw_fence.lock);
+
+	unack_count = hfi->hw_fence.unack_count;
+
+	fault = test_bit(GEN7_HWSCHED_HW_FENCE_SLEEP_BIT, &hfi->hw_fence.flags) &&
+		test_bit(GEN7_HWSCHED_HW_FENCE_MAX_BIT, &hfi->hw_fence.flags) &&
+		(unack_count > MIN_HW_FENCE_UNACK_COUNT);
+
+	drawctxt = hfi->hw_fence.defer_drawctxt;
+	ts = hfi->hw_fence.defer_ts;
+
+	spin_unlock(&hfi->hw_fence.lock);
+
+	if (!fault)
+		return;
+
+	dev_err(&gmu->pdev->dev, "Hardware fence unack(%d) timeout\n", unack_count);
+
+	if (drawctxt) {
+		struct kgsl_process_private *proc_priv = drawctxt->base.proc_priv;
+
+		dev_err(&gmu->pdev->dev,
+			"Hardware fence got deferred for ctx:%d ts:%d pid:%d proc:%s\n",
+			drawctxt->base.id, ts, pid_nr(proc_priv->pid), proc_priv->comm);
+	}
+	gen7_hwsched_fault(adreno_dev, ADRENO_GMU_FAULT);
+}
+
+static void gen7_hwsched_hw_fence_timer(struct timer_list *t)
+{
+	struct gen7_hwsched_hfi *hfi = from_timer(hfi, t, hw_fence_timer);
+
+	kgsl_schedule_work(&hfi->hw_fence_ws);
+}
+
+int gen7_hwsched_hfi_probe(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hw_hfi = to_gen7_hwsched_hfi(adreno_dev);
+
+	gmu->hfi.irq = kgsl_request_irq(gmu->pdev, "hfi",
+		gen7_hwsched_hfi_handler, adreno_dev);
+
+	if (gmu->hfi.irq < 0)
+		return gmu->hfi.irq;
+
+	hw_hfi->irq_mask = HFI_IRQ_MASK;
+
+	rwlock_init(&hw_hfi->msglock);
+
+	INIT_LIST_HEAD(&hw_hfi->msglist);
+	INIT_LIST_HEAD(&hw_hfi->detached_hw_fence_list);
+
+	init_waitqueue_head(&hw_hfi->f2h_wq);
+	init_waitqueue_head(&hw_hfi->hw_fence.unack_wq);
+
+	spin_lock_init(&hw_hfi->hw_fence.lock);
+
+	mutex_init(&hw_hfi->msgq_mutex);
+
+	INIT_WORK(&hw_hfi->hw_fence_ws, gen7_hwsched_hw_fence_timeout);
+
+	timer_setup(&hw_hfi->hw_fence_timer, gen7_hwsched_hw_fence_timer, 0);
+
+	return 0;
+}
+
+void gen7_hwsched_hfi_remove(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hw_hfi = to_gen7_hwsched_hfi(adreno_dev);
+
+	if (hw_hfi->f2h_task)
+		kthread_stop(hw_hfi->f2h_task);
+}
+
+static void gen7_add_profile_events(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj_cmd *cmdobj, struct adreno_submit_time *time)
+{
+	unsigned long flags;
+	u64 time_in_s;
+	unsigned long time_in_ns;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct kgsl_context *context = drawobj->context;
+	struct submission_info info = {0};
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (!time)
+		return;
+
+	/*
+	 * Here we are attempting to create a mapping between the
+	 * GPU time domain (alwayson counter) and the CPU time domain
+	 * (local_clock) by sampling both values as close together as
+	 * possible. This is useful for many types of debugging and
+	 * profiling. In order to make this mapping as accurate as
+	 * possible, we must turn off interrupts to avoid running
+	 * interrupt handlers between the two samples.
+	 */
+
+	local_irq_save(flags);
+
+	/* Read always on registers */
+	time->ticks = gpudev->read_alwayson(adreno_dev);
+
+	/* Trace the GPU time to create a mapping to ftrace time */
+	trace_adreno_cmdbatch_sync(context->id, context->priority,
+		drawobj->timestamp, time->ticks);
+
+	/* Get the kernel clock for time since boot */
+	time->ktime = local_clock();
+
+	/* Get the timeofday for the wall time (for the user) */
+	ktime_get_real_ts64(&time->utime);
+
+	local_irq_restore(flags);
+
+	/* Return kernel clock time to the client if requested */
+	time_in_s = time->ktime;
+	time_in_ns = do_div(time_in_s, 1000000000);
+
+	info.inflight = hwsched->inflight;
+	info.rb_id = adreno_get_level(context);
+	info.gmu_dispatch_queue = context->gmu_dispatch_queue;
+
+	cmdobj->submit_ticks = time->ticks;
+
+	msm_perf_events_update(MSM_PERF_GFX, MSM_PERF_SUBMIT,
+		pid_nr(context->proc_priv->pid),
+		context->id, drawobj->timestamp,
+		!!(drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME));
+	trace_adreno_cmdbatch_submitted(drawobj, &info, time->ticks,
+		(unsigned long) time_in_s, time_in_ns / 1000, 0);
+
+	log_kgsl_cmdbatch_submitted_event(context->id, drawobj->timestamp,
+			context->priority, drawobj->flags);
+}
+
+static void init_gmu_context_queue(struct adreno_context *drawctxt)
+{
+	struct kgsl_memdesc *md = &drawctxt->gmu_context_queue;
+	struct gmu_context_queue_header *hdr = md->hostptr;
+
+	hdr->start_addr = md->gmuaddr + sizeof(*hdr);
+	hdr->queue_size = (md->size - sizeof(*hdr)) >> 2;
+	hdr->hw_fence_buffer_va = drawctxt->gmu_hw_fence_queue.gmuaddr;
+	hdr->hw_fence_buffer_size = drawctxt->gmu_hw_fence_queue.size;
+}
+
+static u32 get_dq_id(struct adreno_device *adreno_dev, struct kgsl_context *context)
+{
+	struct dq_info *info;
+	u32 next;
+	u32 priority = adreno_get_level(context);
+
+	if (adreno_dev->lpac_enabled)
+		info = &gen7_hfi_dqs_lpac[priority];
+	else
+		info = &gen7_hfi_dqs[priority];
+
+	next = info->base_dq_id + info->offset;
+
+	info->offset = (info->offset + 1) % info->max_dq;
+
+	return next;
+}
+
+static int allocate_context_queues(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	int ret = 0;
+
+	if (!adreno_hwsched_context_queue_enabled(adreno_dev))
+		return 0;
+
+	if (test_bit(ADRENO_HWSCHED_HW_FENCE, &adreno_dev->hwsched.flags) &&
+		!drawctxt->gmu_hw_fence_queue.gmuaddr) {
+		ret = gen7_alloc_gmu_kernel_block(
+			to_gen7_gmu(adreno_dev), &drawctxt->gmu_hw_fence_queue,
+			HW_FENCE_QUEUE_SIZE, GMU_NONCACHED_KERNEL,
+			IOMMU_READ | IOMMU_WRITE | IOMMU_PRIV);
+		if (ret) {
+			memset(&drawctxt->gmu_hw_fence_queue, 0x0,
+				sizeof(drawctxt->gmu_hw_fence_queue));
+			return ret;
+		}
+	}
+
+	if (!drawctxt->gmu_context_queue.gmuaddr) {
+		ret = gen7_alloc_gmu_kernel_block(
+			to_gen7_gmu(adreno_dev), &drawctxt->gmu_context_queue,
+			SZ_4K, GMU_NONCACHED_KERNEL,
+			IOMMU_READ | IOMMU_WRITE | IOMMU_PRIV);
+		if (ret) {
+			memset(&drawctxt->gmu_context_queue, 0x0,
+				sizeof(drawctxt->gmu_context_queue));
+			return ret;
+		}
+		init_gmu_context_queue(drawctxt);
+	}
+
+	return 0;
+}
+
+static int send_context_register(struct adreno_device *adreno_dev,
+	struct kgsl_context *context)
+{
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	struct hfi_register_ctxt_cmd cmd;
+	struct kgsl_pagetable *pt = context->proc_priv->pagetable;
+	int ret, asid = kgsl_mmu_pagetable_get_asid(pt, context);
+
+	if (asid < 0)
+		return asid;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_REGISTER_CONTEXT);
+	if (ret)
+		return ret;
+
+	ret = allocate_context_queues(adreno_dev, drawctxt);
+	if (ret)
+		return ret;
+
+	cmd.ctxt_id = context->id;
+	cmd.flags = HFI_CTXT_FLAG_NOTIFY | context->flags;
+	/*
+	 * HLOS SMMU driver programs context bank to look up ASID from TTBR0 during a page
+	 * table walk. So the TLB entries are tagged with the ASID from TTBR0. TLBIASID
+	 * invalidates TLB entries whose ASID matches the value that was written to the
+	 * CBn_TLBIASID register. Set ASID along with PT address.
+	 */
+	cmd.pt_addr = kgsl_mmu_pagetable_get_ttbr0(pt) |
+		FIELD_PREP(GENMASK_ULL(63, KGSL_IOMMU_ASID_START_BIT), asid);
+	cmd.ctxt_idr = context->id;
+	cmd.ctxt_bank = kgsl_mmu_pagetable_get_context_bank(pt, context);
+
+	return gen7_hfi_send_cmd_async(adreno_dev, &cmd, sizeof(cmd));
+}
+
+static int send_context_pointers(struct adreno_device *adreno_dev,
+	struct kgsl_context *context)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct hfi_context_pointers_cmd cmd = {0};
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	int ret;
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_CONTEXT_POINTERS);
+	if (ret)
+		return ret;
+
+	cmd.ctxt_id = context->id;
+	cmd.sop_addr = MEMSTORE_ID_GPU_ADDR(device, context->id, soptimestamp);
+	cmd.eop_addr = MEMSTORE_ID_GPU_ADDR(device, context->id, eoptimestamp);
+	if (context->user_ctxt_record)
+		cmd.user_ctxt_record_addr =
+			context->user_ctxt_record->memdesc.gpuaddr;
+
+	if (adreno_hwsched_context_queue_enabled(adreno_dev))
+		cmd.gmu_context_queue_addr = drawctxt->gmu_context_queue.gmuaddr;
+
+	return gen7_hfi_send_cmd_async(adreno_dev, &cmd, sizeof(cmd));
+}
+
+static int hfi_context_register(struct adreno_device *adreno_dev,
+	struct kgsl_context *context)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (context->gmu_registered)
+		return 0;
+
+	ret = send_context_register(adreno_dev, context);
+	if (ret) {
+		dev_err(&gmu->pdev->dev,
+			"Unable to register context %u: %d\n",
+			context->id, ret);
+
+		if (device->gmu_fault)
+			gen7_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+
+		return ret;
+	}
+
+	ret = send_context_pointers(adreno_dev, context);
+	if (ret) {
+		dev_err(&gmu->pdev->dev,
+			"Unable to register context %u pointers: %d\n",
+			context->id, ret);
+
+		if (device->gmu_fault)
+			gen7_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+
+		return ret;
+	}
+
+	context->gmu_registered = true;
+	if (adreno_hwsched_context_queue_enabled(adreno_dev))
+		context->gmu_dispatch_queue = UINT_MAX;
+	else
+		context->gmu_dispatch_queue = get_dq_id(adreno_dev, context);
+
+	return 0;
+}
+
+static void populate_ibs(struct adreno_device *adreno_dev,
+	struct hfi_submit_cmd *cmd, struct kgsl_drawobj_cmd *cmdobj)
+{
+	struct hfi_issue_ib *issue_ib;
+	struct kgsl_memobj_node *ib;
+
+	if (cmdobj->numibs > HWSCHED_MAX_DISPATCH_NUMIBS) {
+		struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+		struct kgsl_memdesc *big_ib;
+
+		if (test_bit(CMDOBJ_RECURRING_START, &cmdobj->priv))
+			big_ib = hfi->big_ib_recurring;
+		else
+			big_ib = hfi->big_ib;
+		/*
+		 * The dispatcher ensures that there is only one big IB inflight
+		 */
+		cmd->big_ib_gmu_va = big_ib->gmuaddr;
+		cmd->flags |= CMDBATCH_INDIRECT;
+		issue_ib = big_ib->hostptr;
+	} else {
+		issue_ib = (struct hfi_issue_ib *)&cmd[1];
+	}
+
+	list_for_each_entry(ib, &cmdobj->cmdlist, node) {
+		issue_ib->addr = ib->gpuaddr;
+		issue_ib->size = ib->size;
+		issue_ib++;
+	}
+
+	cmd->numibs = cmdobj->numibs;
+}
+
+#define HFI_DSP_IRQ_BASE 2
+
+#define DISPQ_IRQ_BIT(_idx) BIT((_idx) + HFI_DSP_IRQ_BASE)
+
+static int gen7_gmu_context_queue_write(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, u32 *msg, u32 size_bytes,
+	struct kgsl_drawobj *drawobj, struct adreno_submit_time *time)
+{
+	struct gmu_context_queue_header *hdr = drawctxt->gmu_context_queue.hostptr;
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	u32 *queue = drawctxt->gmu_context_queue.hostptr + sizeof(*hdr);
+	u32 i, empty_space, write_idx = hdr->write_index, read_idx = hdr->read_index;
+	u32 size_dwords = size_bytes >> 2;
+	u32 align_size = ALIGN(size_dwords, SZ_4);
+	u32 id = MSG_HDR_GET_ID(*msg);
+	struct kgsl_drawobj_cmd *cmdobj = NULL;
+
+	empty_space = (write_idx >= read_idx) ?
+			(hdr->queue_size - (write_idx - read_idx))
+			: (read_idx - write_idx);
+
+	if (empty_space <= align_size)
+		return -ENOSPC;
+
+	if (!IS_ALIGNED(size_bytes, sizeof(u32)))
+		return -EINVAL;
+
+	for (i = 0; i < size_dwords; i++) {
+		queue[write_idx] = msg[i];
+		write_idx = (write_idx + 1) % hdr->queue_size;
+	}
+
+	/* Cookify any non used data at the end of the write buffer */
+	for (; i < align_size; i++) {
+		queue[write_idx] = 0xfafafafa;
+		write_idx = (write_idx + 1) % hdr->queue_size;
+	}
+
+	/* Ensure packet is written out before proceeding */
+	wmb();
+
+	if (drawobj->type & SYNCOBJ_TYPE) {
+		struct kgsl_drawobj_sync *syncobj = SYNCOBJ(drawobj);
+
+		trace_adreno_syncobj_submitted(drawobj->context->id, drawobj->timestamp,
+			syncobj->numsyncs, gpudev->read_alwayson(adreno_dev));
+		goto done;
+	}
+
+	cmdobj = CMDOBJ(drawobj);
+
+	gen7_add_profile_events(adreno_dev, cmdobj, time);
+
+	/*
+	 * Put the profiling information in the user profiling buffer.
+	 * The hfi_update_write_idx below has a wmb() before the actual
+	 * write index update to ensure that the GMU does not see the
+	 * packet before the profile data is written out.
+	 */
+	adreno_profile_submit_time(time);
+
+done:
+	trace_kgsl_hfi_send(id, size_dwords, MSG_HDR_GET_SEQNUM(*msg));
+
+	hfi_update_write_idx(&hdr->write_index, write_idx);
+
+	return 0;
+}
+
+static u32 get_irq_bit(struct adreno_device *adreno_dev, struct kgsl_drawobj *drawobj)
+{
+	if (!adreno_hwsched_context_queue_enabled(adreno_dev))
+		return drawobj->context->gmu_dispatch_queue;
+
+	if (adreno_is_preemption_enabled(adreno_dev))
+		return adreno_get_level(drawobj->context);
+
+	if (kgsl_context_is_lpac(drawobj->context))
+		return 1;
+
+	return 0;
+}
+
+static int add_gmu_waiter(struct adreno_device *adreno_dev,
+	struct dma_fence *fence)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = msm_hw_fence_wait_update(adreno_dev->hwsched.hw_fence.handle,
+			&fence, 1, true);
+
+	if (ret)
+		dev_err_ratelimited(device->dev,
+			"Failed to add GMU as waiter ret:%d fence ctx:%llu ts:%llu\n",
+			ret, fence->context, fence->seqno);
+
+	return ret;
+}
+
+static void populate_kgsl_fence(struct hfi_syncobj *obj,
+	struct dma_fence *fence)
+{
+	struct kgsl_sync_fence *kfence = (struct kgsl_sync_fence *)fence;
+	struct kgsl_sync_timeline *ktimeline = kfence->parent;
+	unsigned long flags;
+
+	obj->flags |= BIT(GMU_SYNCOBJ_FLAG_KGSL_FENCE_BIT);
+
+	spin_lock_irqsave(&ktimeline->lock, flags);
+	/* If the context is going away or the dma fence is signaled, mark the fence as triggered */
+	if (!ktimeline->context || dma_fence_is_signaled_locked(fence)) {
+		obj->flags |= BIT(GMU_SYNCOBJ_FLAG_SIGNALED_BIT);
+		spin_unlock_irqrestore(&ktimeline->lock, flags);
+		return;
+	}
+	obj->ctxt_id = ktimeline->context->id;
+	spin_unlock_irqrestore(&ktimeline->lock, flags);
+
+	obj->seq_no =  kfence->timestamp;
+}
+
+static int _submit_hw_fence(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj *drawobj, void *cmdbuf)
+{
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	int i, j;
+	u32 cmd_sizebytes;
+	struct kgsl_drawobj_sync *syncobj = SYNCOBJ(drawobj);
+	struct hfi_submit_syncobj *cmd;
+	struct hfi_syncobj *obj = NULL;
+	u32 seqnum;
+
+	/* Add hfi_syncobj struct for sync object */
+	cmd_sizebytes = sizeof(*cmd) +
+			(sizeof(struct hfi_syncobj) *
+			syncobj->num_hw_fence);
+
+	if (WARN_ON(cmd_sizebytes > HFI_MAX_MSG_SIZE))
+		return -EMSGSIZE;
+
+	memset(cmdbuf, 0x0, cmd_sizebytes);
+	cmd = cmdbuf;
+	cmd->num_syncobj = syncobj->num_hw_fence;
+	obj = (struct hfi_syncobj *)&cmd[1];
+
+	for (i = 0; i < syncobj->numsyncs; i++) {
+		struct kgsl_drawobj_sync_event *event = &syncobj->synclist[i];
+		struct kgsl_sync_fence_cb *kcb = event->handle;
+		struct dma_fence **fences;
+		struct dma_fence_array *array;
+		u32 num_fences;
+
+		if (!kcb)
+			return -EINVAL;
+
+		array = to_dma_fence_array(kcb->fence);
+		if (array != NULL) {
+			num_fences = array->num_fences;
+			fences = array->fences;
+		} else {
+			num_fences = 1;
+			fences = &kcb->fence;
+		}
+
+		for (j = 0; j < num_fences; j++) {
+
+			/*
+			 * If this sync object has a software only fence, make sure that it is
+			 * already signaled so that we can skip sending this fence to the GMU.
+			 */
+			if (!test_bit(MSM_HW_FENCE_FLAG_ENABLED_BIT, &fences[j]->flags)) {
+				if (WARN(!dma_fence_is_signaled(fences[j]),
+					"sync object has unsignaled software fence"))
+					return -EINVAL;
+				continue;
+			}
+
+			if (is_kgsl_fence(fences[j])) {
+				populate_kgsl_fence(obj, fences[j]);
+			} else {
+				int ret = add_gmu_waiter(adreno_dev, fences[j]);
+
+				if (ret) {
+					syncobj->flags &= ~KGSL_SYNCOBJ_HW;
+					return ret;
+				}
+
+				if (test_bit(MSM_HW_FENCE_FLAG_SIGNALED_BIT, &fences[j]->flags) ||
+					test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fences[j]->flags))
+					obj->flags |= BIT(GMU_SYNCOBJ_FLAG_SIGNALED_BIT);
+
+				obj->ctxt_id = fences[j]->context;
+				obj->seq_no =  fences[j]->seqno;
+			}
+			trace_adreno_input_hw_fence(drawobj->context->id, obj->ctxt_id,
+				obj->seq_no, obj->flags, fences[j]->ops->get_timeline_name ?
+				fences[j]->ops->get_timeline_name(fences[j]) : "unknown");
+
+			obj++;
+		}
+	}
+
+	/*
+	 * Attach a timestamp to this SYNCOBJ to keep track whether GMU has deemed it signaled
+	 * or not.
+	 */
+	drawobj->timestamp = ++drawctxt->syncobj_timestamp;
+	cmd->timestamp = drawobj->timestamp;
+
+	seqnum = atomic_inc_return(&adreno_dev->hwsched.submission_seqnum);
+	cmd->hdr = CREATE_MSG_HDR(H2F_MSG_ISSUE_SYNCOBJ, HFI_MSG_CMD);
+	cmd->hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd->hdr, seqnum, cmd_sizebytes >> 2);
+
+	return gen7_gmu_context_queue_write(adreno_dev, drawctxt, (u32 *)cmd, cmd_sizebytes,
+			drawobj, NULL);
+}
+
+int gen7_hwsched_check_context_inflight_hw_fences(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	struct adreno_hw_fence_entry *entry, *tmp;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	spin_lock(&drawctxt->lock);
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_inflight_list, node) {
+		struct gmu_context_queue_header *hdr =  drawctxt->gmu_context_queue.hostptr;
+
+		if (timestamp_cmp((u32)entry->cmd.ts, hdr->out_fence_ts) > 0) {
+			dev_err(&gmu->pdev->dev,
+				"detached ctx:%d has unsignaled fence ts:%d retired:%d\n",
+				drawctxt->base.id, (u32)entry->cmd.ts, hdr->out_fence_ts);
+			ret = -EINVAL;
+			break;
+		}
+
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+	}
+	spin_unlock(&drawctxt->lock);
+
+	return ret;
+}
+
+/**
+ * move_detached_context_hardware_fences - Move all pending hardware fences belonging to this
+ * context to the detached hardware fence list so as to send them to TxQueue after fault recovery.
+ * This is needed because this context may get destroyed before fault recovery gets executed.
+ */
+static void move_detached_context_hardware_fences(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	struct adreno_hw_fence_entry *entry, *tmp;
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+
+	/* We don't need the drawctxt lock here because this context has already been detached */
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_inflight_list, node) {
+		struct gmu_context_queue_header *hdr =  drawctxt->gmu_context_queue.hostptr;
+
+		if ((timestamp_cmp((u32)entry->cmd.ts, hdr->out_fence_ts) > 0)) {
+			_kgsl_context_get(&drawctxt->base);
+			list_move_tail(&entry->node, &hfi->detached_hw_fence_list);
+			continue;
+		}
+
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+	}
+
+	/* Also grab all the hardware fences which were never sent to GMU */
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_list, node) {
+		_kgsl_context_get(&drawctxt->base);
+		list_move_tail(&entry->node, &hfi->detached_hw_fence_list);
+	}
+}
+
+/**
+ * check_detached_context_hardware_fences - When this context has been un-registered with the GMU,
+ * make sure all the hardware fences(that were sent to GMU) for this context have been sent to
+ * TxQueue. Also, send any hardware fences (to GMU) that were not yet dispatched to the GMU. In case
+ * of an error, move the pending hardware fences to detached hardware fence list, log the error,
+ * take a snapshot and trigger recovery.
+ */
+static int check_detached_context_hardware_fences(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_hw_fence_entry *entry, *tmp;
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	int ret = 0;
+
+	/* We don't need the drawctxt lock because this context has been detached */
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_inflight_list, node) {
+		struct gmu_context_queue_header *hdr =  drawctxt->gmu_context_queue.hostptr;
+
+		if ((timestamp_cmp((u32)entry->cmd.ts, hdr->out_fence_ts) > 0)) {
+			dev_err(&gmu->pdev->dev,
+				"detached ctx:%d has unsignaled fence ts:%d retired:%d\n",
+				drawctxt->base.id, (u32)entry->cmd.ts, hdr->out_fence_ts);
+			ret = -EINVAL;
+			goto fault;
+		}
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+	}
+
+	/* Send hardware fences (to TxQueue) that were not dispatched to GMU */
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_list, node) {
+
+		ret = gen7_send_hw_fence_hfi_wait_ack(adreno_dev, entry,
+			HW_FENCE_FLAG_SKIP_MEMSTORE);
+		if (ret)
+			goto fault;
+
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+	}
+
+	return 0;
+
+fault:
+	move_detached_context_hardware_fences(adreno_dev, drawctxt);
+	gmu_core_fault_snapshot(device);
+	gen7_hwsched_fault(adreno_dev, ADRENO_GMU_FAULT);
+
+	return ret;
+}
+
+static inline int setup_hw_fence_info_cmd(struct adreno_device *adreno_dev,
+	struct adreno_hw_fence_entry *entry)
+{
+	struct kgsl_sync_fence *kfence = entry->kfence;
+	int ret;
+
+	ret = CMD_MSG_HDR(entry->cmd, H2F_MSG_HW_FENCE_INFO);
+	if (ret)
+		return ret;
+
+	entry->cmd.gmu_ctxt_id = entry->drawctxt->base.id;
+	entry->cmd.ctxt_id = kfence->fence.context;
+	entry->cmd.ts = kfence->fence.seqno;
+
+	entry->cmd.hash_index = kfence->hw_fence_index;
+
+	return 0;
+}
+
+/*
+ * gen7_send_hw_fence_hfi_wait_ack - This function is used in cases where multiple hardware fences
+ * are to be sent to GMU. Hence, we must send them one by one to avoid overwhelming the GMU with
+ * mutliple fences in a short span of time.
+ */
+int gen7_send_hw_fence_hfi_wait_ack(struct adreno_device *adreno_dev,
+	struct adreno_hw_fence_entry *entry, u64 flags)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 seqnum;
+	int ret = 0;
+
+	/* Device mutex is necessary to ensure only one hardware fence ack is being waited for */
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EINVAL;
+
+	spin_lock(&hfi->hw_fence.lock);
+
+	init_completion(&hw_fence_ack.complete);
+
+	entry->cmd.flags |= flags;
+	seqnum = atomic_inc_return(&hfi->hw_fence.seqnum);
+	entry->cmd.hdr = MSG_HDR_SET_SEQNUM_SIZE(entry->cmd.hdr, seqnum, sizeof(entry->cmd) >> 2);
+
+	hw_fence_ack.sent_hdr = entry->cmd.hdr;
+
+	/*
+	 * We don't need to increment the unack count here as we are waiting for the ack for
+	 * this fence before sending another hardware fence.
+	 */
+	ret = gen7_hfi_cmdq_write(adreno_dev, (u32 *)&entry->cmd, sizeof(entry->cmd));
+
+	spin_unlock(&hfi->hw_fence.lock);
+
+	if (!ret)
+		ret = adreno_hwsched_wait_ack_completion(adreno_dev, &gmu->pdev->dev, &hw_fence_ack,
+			gen7_hwsched_process_msgq);
+
+	memset(&hw_fence_ack, 0x0, sizeof(hw_fence_ack));
+	return ret;
+}
+
+/**
+ * drawctxt_queue_hw_fence - Add a hardware fence to draw context's hardware fence list and make
+ * sure the list remains sorted (with the fence with the largest timestamp at the end)
+ */
+static void drawctxt_queue_hw_fence(struct adreno_context *drawctxt,
+	struct adreno_hw_fence_entry *new)
+{
+	struct adreno_hw_fence_entry *entry = NULL;
+	u32 ts = (u32)new->cmd.ts;
+
+	/* Walk the list backwards to find the right spot for this fence */
+	list_for_each_entry_reverse(entry, &drawctxt->hw_fence_list, node) {
+		if (timestamp_cmp(ts, (u32)entry->cmd.ts) > 0)
+			break;
+	}
+
+	list_add(&new->node, &entry->node);
+}
+
+#define DRAWCTXT_SLOT_AVAILABLE(count)  \
+	((count + 1) < (HW_FENCE_QUEUE_SIZE / sizeof(struct hfi_hw_fence_info)))
+
+/**
+ * allocate_hw_fence_entry - Allocate an entry to keep track of a hardware fence. This is free'd
+ * when we know GMU has sent this fence to the TxQueue
+ */
+static struct adreno_hw_fence_entry *allocate_hw_fence_entry(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, struct kgsl_sync_fence *kfence)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct adreno_hw_fence_entry *entry;
+
+	if (!DRAWCTXT_SLOT_AVAILABLE(drawctxt->hw_fence_count))
+		return NULL;
+
+	entry = kmem_cache_zalloc(hwsched->hw_fence_cache, GFP_ATOMIC);
+	if (!entry)
+		return NULL;
+
+	entry->kfence = kfence;
+	entry->drawctxt = drawctxt;
+
+	if (setup_hw_fence_info_cmd(adreno_dev, entry)) {
+		kmem_cache_free(hwsched->hw_fence_cache, entry);
+		return NULL;
+	}
+
+	dma_fence_get(&kfence->fence);
+
+	drawctxt->hw_fence_count++;
+	atomic_inc(&hwsched->hw_fence_count);
+
+	INIT_LIST_HEAD(&entry->node);
+	INIT_LIST_HEAD(&entry->reset_node);
+	return entry;
+}
+
+static bool _hw_fence_end_sleep(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	bool ret;
+
+	spin_lock(&hfi->hw_fence.lock);
+	ret = !test_bit(GEN7_HWSCHED_HW_FENCE_SLEEP_BIT, &hfi->hw_fence.flags);
+	spin_unlock(&hfi->hw_fence.lock);
+
+	return ret;
+}
+
+/**
+ * _hw_fence_sleep() - Check if the thread needs to sleep until the hardware fence unack count
+ * drops to a desired threshold.
+ *
+ * Return: negative error code if the thread was woken up by a signal, or the context became bad in
+ * the meanwhile, or the hardware fence unack count hasn't yet dropped to a desired threshold, or
+ * if fault recovery is imminent.
+ * Otherwise, return 0.
+ */
+static int _hw_fence_sleep(struct adreno_device *adreno_dev, struct adreno_context *drawctxt)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	int ret = 0;
+
+	if (!test_bit(GEN7_HWSCHED_HW_FENCE_SLEEP_BIT, &hfi->hw_fence.flags))
+		return 0;
+
+	spin_unlock(&hfi->hw_fence.lock);
+	spin_unlock(&drawctxt->lock);
+
+	ret = wait_event_interruptible(hfi->hw_fence.unack_wq,
+		_hw_fence_end_sleep(adreno_dev));
+
+	spin_lock(&drawctxt->lock);
+	spin_lock(&hfi->hw_fence.lock);
+
+	/*
+	 * If the thread received a signal, or the context became bad in the meanwhile or the limit
+	 * is still not settled, then return error to avoid creating this hardware fence
+	 */
+	if ((ret == -ERESTARTSYS) || kgsl_context_is_bad(&drawctxt->base) ||
+		test_bit(GEN7_HWSCHED_HW_FENCE_MAX_BIT, &hfi->hw_fence.flags))
+		return -EINVAL;
+
+	/*
+	 * If fault recovery is imminent then return error code to avoid creating new hardware
+	 * fences until recovery is complete
+	 */
+	if (test_bit(GEN7_HWSCHED_HW_FENCE_ABORT_BIT, &hfi->hw_fence.flags))
+		return -EBUSY;
+
+	return ret;
+}
+
+void gen7_hwsched_create_hw_fence(struct adreno_device *adreno_dev,
+	struct kgsl_sync_fence *kfence)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_sync_timeline *ktimeline = kfence->parent;
+	struct kgsl_context *context = ktimeline->context;
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	struct adreno_hw_fence_entry *entry = NULL;
+	struct msm_hw_fence_create_params params = {0};
+	/* Only allow a single log in a second */
+	static DEFINE_RATELIMIT_STATE(_rs, HZ, 1);
+	struct gen7_hwsched_hfi *hw_hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	u32 retired = 0;
+	int ret = 0;
+	bool destroy_hw_fence = true;
+
+	params.fence = &kfence->fence;
+	params.handle = &kfence->hw_fence_index;
+	kfence->hw_fence_handle = adreno_dev->hwsched.hw_fence.handle;
+
+	ret = msm_hw_fence_create(kfence->hw_fence_handle, &params);
+	if ((ret || IS_ERR_OR_NULL(params.handle))) {
+		if (__ratelimit(&_rs))
+			dev_err(device->dev, "Failed to create ctx:%d ts:%d hardware fence:%d\n",
+				kfence->context_id, kfence->timestamp, ret);
+		return;
+	}
+
+	spin_lock(&drawctxt->lock);
+	spin_lock(&hw_hfi->hw_fence.lock);
+
+	/*
+	 * If we create a hardware fence and this context is going away, we may never dispatch
+	 * this fence to the GMU. Hence, avoid creating a hardware fence if context is going away.
+	 */
+	if (kgsl_context_is_bad(context))
+		goto done;
+
+	entry = allocate_hw_fence_entry(adreno_dev, drawctxt, kfence);
+	if (!entry)
+		goto done;
+
+	/* If recovery is imminent, then do not create a hardware fence */
+	if (test_bit(GEN7_HWSCHED_HW_FENCE_ABORT_BIT, &hw_hfi->hw_fence.flags)) {
+		destroy_hw_fence = true;
+		goto done;
+	}
+
+	ret = _hw_fence_sleep(adreno_dev, drawctxt);
+	if (ret)
+		goto done;
+
+	/*
+	 * If this ts hasn't been submitted yet, then store it in the drawctxt hardware fence
+	 * list and return. This fence will be sent to GMU when this ts is dispatched to GMU.
+	 */
+	if (timestamp_cmp(kfence->timestamp, drawctxt->internal_timestamp) > 0) {
+		drawctxt_queue_hw_fence(drawctxt, entry);
+		destroy_hw_fence = false;
+		goto done;
+	}
+
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_RETIRED, &retired);
+
+	/*
+	 * Check if timestamp is retired. If we are in SLUMBER at this point, the timestamp is
+	 * guaranteed to be retired. This way, we don't need the device mutex to check the device
+	 * state explicitly.
+	 */
+	if (timestamp_cmp(retired, kfence->timestamp) >= 0) {
+		kgsl_sync_timeline_signal(ktimeline, kfence->timestamp);
+		goto done;
+	}
+
+	/*
+	 * If timestamp is not retired then GMU must already be powered up. This is because SLUMBER
+	 * thread has to wait for hardware fence spinlock to make sure the hardware fence unack
+	 * count is zero.
+	 */
+	ret = _send_hw_fence_no_ack(adreno_dev, entry);
+	if (ret) {
+		if (__ratelimit(&_rs))
+			dev_err(&gmu->pdev->dev, "Aborting hw fence for ctx:%d ts:%d ret:%d\n",
+				kfence->context_id, kfence->timestamp, ret);
+		goto done;
+	}
+
+	list_add_tail(&entry->node, &drawctxt->hw_fence_inflight_list);
+
+	destroy_hw_fence = false;
+
+done:
+	if (destroy_hw_fence) {
+		msm_hw_fence_destroy(kfence->hw_fence_handle, &kfence->fence);
+		if (entry)
+			gen7_remove_hw_fence_entry(adreno_dev, entry);
+	}
+
+	spin_unlock(&hw_hfi->hw_fence.lock);
+	spin_unlock(&drawctxt->lock);
+}
+
+/**
+ * setup_hw_fence_deferred_ctxt - The hardware fence(s) from this context couldn't be sent to the
+ * GMU because the hardware fence unack count reached a threshold. Hence, setup this context such
+ * that these hardware fences are sent to the GMU when the unack count drops to a desired threshold.
+ */
+static void setup_hw_fence_deferred_ctxt(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, u32 ts)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+
+	if (!_kgsl_context_get(&drawctxt->base))
+		return;
+
+	hfi->hw_fence.defer_drawctxt = drawctxt;
+	hfi->hw_fence.defer_ts = ts;
+	/*
+	 * Increment the active count so that device doesn't get powered off until this fence has
+	 * been sent to GMU
+	 */
+	gen7_hwsched_active_count_get(adreno_dev);
+}
+
+/**
+ * process_hw_fence_queue - This function walks the draw context's list of hardware fences
+ * and sends the ones which have a timestamp less than or equal to the timestamp that just
+ * got submitted to the GMU.
+ */
+static void process_hw_fence_queue(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, u32 ts)
+{
+	struct adreno_hw_fence_entry *entry = NULL, *next;
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	int ret = 0;
+
+	/* This list is sorted with smallest timestamp at head and highest timestamp at tail */
+	list_for_each_entry_safe(entry, next, &drawctxt->hw_fence_list, node) {
+
+		if (timestamp_cmp((u32)entry->cmd.ts, ts) > 0)
+			return;
+
+		spin_lock(&hfi->hw_fence.lock);
+
+		if (test_bit(GEN7_HWSCHED_HW_FENCE_MAX_BIT, &hfi->hw_fence.flags)) {
+			setup_hw_fence_deferred_ctxt(adreno_dev, drawctxt, ts);
+			spin_unlock(&hfi->hw_fence.lock);
+			return;
+		}
+
+		ret = _send_hw_fence_no_ack(adreno_dev, entry);
+
+		spin_unlock(&hfi->hw_fence.lock);
+
+		if (ret)
+			return;
+
+		/*
+		 * A fence that is sent to GMU must be added to the drawctxt->hw_fence_inflight_list
+		 * so that we can keep track of when GMU sends it to the TxQueue
+		 */
+		list_del_init(&entry->node);
+		list_add_tail(&entry->node, &drawctxt->hw_fence_inflight_list);
+	}
+}
+
+/* Size in below functions are in unit of dwords */
+static int gen7_hfi_dispatch_queue_write(struct adreno_device *adreno_dev, u32 queue_idx,
+	u32 *msg, u32 size_bytes, struct kgsl_drawobj_cmd *cmdobj, struct adreno_submit_time *time)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct hfi_queue_table *tbl = gmu->hfi.hfi_mem->hostptr;
+	struct hfi_queue_header *hdr = &tbl->qhdr[queue_idx];
+	u32 *queue;
+	u32 i, write, empty_space;
+	u32 size_dwords = size_bytes >> 2;
+	u32 align_size = ALIGN(size_dwords, SZ_4);
+	u32 id = MSG_HDR_GET_ID(*msg);
+
+	if (hdr->status == HFI_QUEUE_STATUS_DISABLED || !IS_ALIGNED(size_bytes, sizeof(u32)))
+		return -EINVAL;
+
+	queue = HOST_QUEUE_START_ADDR(gmu->hfi.hfi_mem, queue_idx);
+
+	empty_space = (hdr->write_index >= hdr->read_index) ?
+			(hdr->queue_size - (hdr->write_index - hdr->read_index))
+			: (hdr->read_index - hdr->write_index);
+
+	if (empty_space <= align_size)
+		return -ENOSPC;
+
+	write = hdr->write_index;
+
+	for (i = 0; i < size_dwords; i++) {
+		queue[write] = msg[i];
+		write = (write + 1) % hdr->queue_size;
+	}
+
+	/* Cookify any non used data at the end of the write buffer */
+	for (; i < align_size; i++) {
+		queue[write] = 0xfafafafa;
+		write = (write + 1) % hdr->queue_size;
+	}
+
+	/* Ensure packet is written out before proceeding */
+	wmb();
+
+	gen7_add_profile_events(adreno_dev, cmdobj, time);
+
+	/*
+	 * Put the profiling information in the user profiling buffer.
+	 * The hfi_update_write_idx below has a wmb() before the actual
+	 * write index update to ensure that the GMU does not see the
+	 * packet before the profile data is written out.
+	 */
+	adreno_profile_submit_time(time);
+
+	trace_kgsl_hfi_send(id, size_dwords, MSG_HDR_GET_SEQNUM(*msg));
+
+	hfi_update_write_idx(&hdr->write_index, write);
+
+	return 0;
+}
+
+int gen7_hwsched_submit_drawobj(struct adreno_device *adreno_dev, struct kgsl_drawobj *drawobj)
+{
+	int ret = 0;
+	u32 cmd_sizebytes, seqnum;
+	struct kgsl_drawobj_cmd *cmdobj = NULL;
+	struct hfi_submit_cmd *cmd;
+	struct adreno_submit_time time = {0};
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	static void *cmdbuf;
+
+	if (cmdbuf == NULL) {
+		struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+		cmdbuf = devm_kzalloc(&device->pdev->dev, HFI_MAX_MSG_SIZE,
+				GFP_KERNEL);
+		if (!cmdbuf)
+			return -ENOMEM;
+	}
+
+	ret = hfi_context_register(adreno_dev, drawobj->context);
+	if (ret)
+		return ret;
+
+	if ((drawobj->type & SYNCOBJ_TYPE) != 0)
+		return _submit_hw_fence(adreno_dev, drawobj, cmdbuf);
+
+	cmdobj = CMDOBJ(drawobj);
+
+	/*
+	 * If the MARKER object is retired, it doesn't need to be dispatched to GMU. Simply trigger
+	 * any pending fences that are less than/equal to this object's timestamp.
+	 */
+	if (test_bit(CMDOBJ_MARKER_EXPIRED, &cmdobj->priv)) {
+		spin_lock(&drawctxt->lock);
+		process_hw_fence_queue(adreno_dev, drawctxt, drawobj->timestamp);
+		spin_unlock(&drawctxt->lock);
+		return 0;
+	}
+
+	/* Add a *issue_ib struct for each IB */
+	if (cmdobj->numibs > HWSCHED_MAX_DISPATCH_NUMIBS ||
+		test_bit(CMDOBJ_SKIP, &cmdobj->priv))
+		cmd_sizebytes = sizeof(*cmd);
+	else
+		cmd_sizebytes = sizeof(*cmd) +
+			(sizeof(struct hfi_issue_ib) * cmdobj->numibs);
+
+	if (WARN_ON(cmd_sizebytes > HFI_MAX_MSG_SIZE))
+		return -EMSGSIZE;
+
+	memset(cmdbuf, 0x0, cmd_sizebytes);
+
+	cmd = cmdbuf;
+
+	cmd->ctxt_id = drawobj->context->id;
+	cmd->flags = HFI_CTXT_FLAG_NOTIFY;
+	if (drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME)
+		cmd->flags |= CMDBATCH_EOF;
+
+	cmd->ts = drawobj->timestamp;
+
+	if (test_bit(CMDOBJ_SKIP, &cmdobj->priv))
+		goto skipib;
+
+	populate_ibs(adreno_dev, cmd, cmdobj);
+
+	if ((drawobj->flags & KGSL_DRAWOBJ_PROFILING) &&
+		cmdobj->profiling_buf_entry) {
+
+		time.drawobj = drawobj;
+
+		cmd->profile_gpuaddr_lo =
+			lower_32_bits(cmdobj->profiling_buffer_gpuaddr);
+		cmd->profile_gpuaddr_hi =
+			upper_32_bits(cmdobj->profiling_buffer_gpuaddr);
+
+		/* Indicate to GMU to do user profiling for this submission */
+		cmd->flags |= CMDBATCH_PROFILING;
+	}
+
+skipib:
+	adreno_drawobj_set_constraint(KGSL_DEVICE(adreno_dev), drawobj);
+
+	seqnum = atomic_inc_return(&adreno_dev->hwsched.submission_seqnum);
+	cmd->hdr = CREATE_MSG_HDR(H2F_MSG_ISSUE_CMD, HFI_MSG_CMD);
+	cmd->hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd->hdr, seqnum, cmd_sizebytes >> 2);
+
+	if (adreno_hwsched_context_queue_enabled(adreno_dev))
+		ret = gen7_gmu_context_queue_write(adreno_dev,
+			drawctxt, (u32 *)cmd, cmd_sizebytes, drawobj, &time);
+	else
+		ret = gen7_hfi_dispatch_queue_write(adreno_dev,
+			HFI_DSP_ID_0 + drawobj->context->gmu_dispatch_queue,
+			(u32 *)cmd, cmd_sizebytes, cmdobj, &time);
+	if (ret)
+		return ret;
+
+	/* Send interrupt to GMU to receive the message */
+	gmu_core_regwrite(KGSL_DEVICE(adreno_dev), GEN7_GMU_HOST2GMU_INTR_SET,
+		DISPQ_IRQ_BIT(get_irq_bit(adreno_dev, drawobj)));
+
+	spin_lock(&drawctxt->lock);
+	process_hw_fence_queue(adreno_dev, drawctxt, drawobj->timestamp);
+	/*
+	 * We need to update the internal timestamp while holding the drawctxt lock since we have to
+	 * check it in the hardware fence creation path, where we are not taking the device mutex.
+	 */
+	drawctxt->internal_timestamp = drawobj->timestamp;
+	spin_unlock(&drawctxt->lock);
+
+	return 0;
+}
+
+int gen7_hwsched_send_recurring_cmdobj(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj_cmd *cmdobj)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct hfi_submit_cmd *cmd;
+	struct kgsl_memobj_node *ib;
+	u32 cmd_sizebytes;
+	int ret;
+	static bool active;
+
+	if (adreno_gpu_halt(adreno_dev) || hwsched_in_fault(hwsched))
+		return -EBUSY;
+
+	if (test_bit(CMDOBJ_RECURRING_STOP, &cmdobj->priv)) {
+		cmdobj->numibs = 0;
+	} else {
+		list_for_each_entry(ib, &cmdobj->cmdlist, node)
+			cmdobj->numibs++;
+	}
+
+	if (cmdobj->numibs > HWSCHED_MAX_IBS)
+		return -EINVAL;
+
+	if (cmdobj->numibs > HWSCHED_MAX_DISPATCH_NUMIBS)
+		cmd_sizebytes = sizeof(*cmd);
+	else
+		cmd_sizebytes = sizeof(*cmd) +
+			(sizeof(struct hfi_issue_ib) * cmdobj->numibs);
+
+	if (WARN_ON(cmd_sizebytes > HFI_MAX_MSG_SIZE))
+		return -EMSGSIZE;
+
+	cmd = kzalloc(cmd_sizebytes, GFP_KERNEL);
+	if (cmd == NULL)
+		return -ENOMEM;
+
+	if (test_bit(CMDOBJ_RECURRING_START, &cmdobj->priv)) {
+		if (!active) {
+			ret = adreno_active_count_get(adreno_dev);
+			if (ret) {
+				kfree(cmd);
+				return ret;
+			}
+			active = true;
+		}
+		cmd->flags |= CMDBATCH_RECURRING_START;
+		populate_ibs(adreno_dev, cmd, cmdobj);
+	} else
+		cmd->flags |= CMDBATCH_RECURRING_STOP;
+
+	cmd->ctxt_id = drawobj->context->id;
+
+	ret = hfi_context_register(adreno_dev, drawobj->context);
+	if (ret) {
+		adreno_active_count_put(adreno_dev);
+		active = false;
+		kfree(cmd);
+		return ret;
+	}
+
+	cmd->hdr = CREATE_MSG_HDR(H2F_MSG_ISSUE_RECURRING_CMD, HFI_MSG_CMD);
+
+	ret = gen7_hfi_send_cmd_async(adreno_dev, cmd, sizeof(*cmd));
+
+	kfree(cmd);
+
+	if (ret) {
+		adreno_active_count_put(adreno_dev);
+		active = false;
+		return ret;
+	}
+
+	if (test_bit(CMDOBJ_RECURRING_STOP, &cmdobj->priv)) {
+		adreno_hwsched_retire_cmdobj(hwsched, hwsched->recurring_cmdobj);
+		del_timer_sync(&hwsched->lsr_timer);
+		hwsched->recurring_cmdobj = NULL;
+		if (active)
+			adreno_active_count_put(adreno_dev);
+		active = false;
+		return ret;
+	}
+
+	hwsched->recurring_cmdobj = cmdobj;
+	/* Star LSR timer for power stats collection */
+	mod_timer(&hwsched->lsr_timer, jiffies + msecs_to_jiffies(10));
+	return ret;
+}
+
+void gen7_trigger_hw_fence_cpu(struct adreno_device *adreno_dev,
+	struct adreno_hw_fence_entry *entry)
+{
+	int ret = msm_hw_fence_update_txq(adreno_dev->hwsched.hw_fence.handle,
+			entry->cmd.hash_index, 0, 0);
+
+	if (ret) {
+		dev_err_ratelimited(adreno_dev->dev.dev,
+			"Failed to trigger hw fence via cpu: ctx:%d ts:%d ret:%d\n",
+			entry->drawctxt->base.id, (u32)entry->cmd.ts, ret);
+		return;
+	}
+
+	msm_hw_fence_trigger_signal(adreno_dev->hwsched.hw_fence.handle, IPCC_CLIENT_GPU,
+		IPCC_CLIENT_APSS, 0);
+}
+
+/* We don't want to unnecessarily wake the GMU to trigger hardware fences */
+static void drain_context_hw_fence_cpu(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	struct adreno_hw_fence_entry *entry, *tmp;
+
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_list, node) {
+
+		gen7_trigger_hw_fence_cpu(adreno_dev, entry);
+
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+	}
+}
+
+int gen7_hwsched_drain_context_hw_fences(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	struct adreno_hw_fence_entry *entry, *tmp;
+	int ret = 0;
+
+	/* We don't need the drawctxt lock here as this context has already been invalidated */
+	list_for_each_entry_safe(entry, tmp, &drawctxt->hw_fence_list, node) {
+
+		/* Any error here is fatal */
+		ret = gen7_send_hw_fence_hfi_wait_ack(adreno_dev, entry,
+			HW_FENCE_FLAG_SKIP_MEMSTORE);
+		if (ret)
+			break;
+
+		gen7_remove_hw_fence_entry(adreno_dev, entry);
+	}
+
+	return ret;
+}
+
+static int send_context_unregister_hfi(struct adreno_device *adreno_dev,
+	struct kgsl_context *context, u32 ts)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	struct pending_cmd pending_ack;
+	struct hfi_unregister_ctxt_cmd cmd;
+	u32 seqnum;
+	int rc, ret;
+
+	/* Only send HFI if device is not in SLUMBER */
+	if (!context->gmu_registered ||
+		!test_bit(GMU_PRIV_GPU_STARTED, &gmu->flags)) {
+		drain_context_hw_fence_cpu(adreno_dev, drawctxt);
+		return 0;
+	}
+
+	ret = CMD_MSG_HDR(cmd, H2F_MSG_UNREGISTER_CONTEXT);
+	if (ret)
+		return ret;
+
+	cmd.ctxt_id = context->id,
+	cmd.ts = ts,
+
+	seqnum = atomic_inc_return(&gmu->hfi.seqnum);
+	cmd.hdr = MSG_HDR_SET_SEQNUM_SIZE(cmd.hdr, seqnum, sizeof(cmd) >> 2);
+
+	add_waiter(hfi, cmd.hdr, &pending_ack);
+
+	/*
+	 * Although we know device is powered on, we can still enter SLUMBER
+	 * because the wait for ack below is done without holding the mutex. So
+	 * take an active count before releasing the mutex so as to avoid a
+	 * concurrent SLUMBER sequence while GMU is un-registering this context.
+	 */
+	gen7_hwsched_active_count_get(adreno_dev);
+
+	rc = gen7_hfi_cmdq_write(adreno_dev, (u32 *)&cmd, sizeof(cmd));
+	if (rc)
+		goto done;
+
+	mutex_unlock(&device->mutex);
+
+	rc = wait_for_completion_timeout(&pending_ack.complete,
+			msecs_to_jiffies(30 * 1000));
+	if (!rc) {
+		dev_err(&gmu->pdev->dev,
+			"Ack timeout for context unregister seq: %d ctx: %u ts: %u\n",
+			MSG_HDR_GET_SEQNUM(pending_ack.sent_hdr),
+			context->id, ts);
+		rc = -ETIMEDOUT;
+
+		mutex_lock(&device->mutex);
+
+		gmu_core_fault_snapshot(device);
+
+		/*
+		 * Make sure we send all fences from this context to the TxQueue after recovery
+		 */
+		move_detached_context_hardware_fences(adreno_dev, drawctxt);
+		gen7_hwsched_fault(adreno_dev, ADRENO_HARD_FAULT);
+
+		goto done;
+	}
+
+	mutex_lock(&device->mutex);
+
+	rc = check_detached_context_hardware_fences(adreno_dev, drawctxt);
+	if (rc)
+		goto done;
+
+	rc = check_ack_failure(adreno_dev, &pending_ack);
+done:
+	gen7_hwsched_active_count_put(adreno_dev);
+
+	del_waiter(hfi, &pending_ack);
+
+	return rc;
+}
+
+void gen7_hwsched_context_detach(struct adreno_context *drawctxt)
+{
+	struct kgsl_context *context = &drawctxt->base;
+	struct kgsl_device *device = context->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	int ret = 0;
+
+	mutex_lock(&device->mutex);
+
+	ret = send_context_unregister_hfi(adreno_dev, context,
+		drawctxt->internal_timestamp);
+
+	if (!ret) {
+		kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, soptimestamp),
+			drawctxt->timestamp);
+
+		kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, eoptimestamp),
+			drawctxt->timestamp);
+
+		adreno_profile_process_results(adreno_dev);
+	}
+
+	context->gmu_registered = false;
+
+	mutex_unlock(&device->mutex);
+}
+
+u32 gen7_hwsched_preempt_count_get(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (device->state != KGSL_STATE_ACTIVE)
+		return 0;
+
+	return gen7_hwsched_hfi_get_value(adreno_dev, HFI_VALUE_PREEMPT_COUNT);
+}
+
+void gen7_hwsched_context_destroy(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	if (!adreno_hwsched_context_queue_enabled(adreno_dev))
+		return;
+
+	if (drawctxt->gmu_context_queue.gmuaddr)
+		gen7_free_gmu_block(to_gen7_gmu(adreno_dev), &drawctxt->gmu_context_queue);
+
+	if (drawctxt->gmu_hw_fence_queue.gmuaddr)
+		gen7_free_gmu_block(to_gen7_gmu(adreno_dev), &drawctxt->gmu_hw_fence_queue);
+}
+
+int gen7_hwsched_counter_inline_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		u32 counter, u32 countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 val, cmds[GEN7_PERF_COUNTER_ENABLE_DWORDS + 1];
+	int ret;
+
+	if (group->flags & ADRENO_PERFCOUNTER_GROUP_RESTORE)
+		gen7_perfcounter_update(adreno_dev, reg, false,
+				FIELD_PREP(GENMASK(13, 12), PIPE_NONE));
+
+	cmds[0] = CREATE_MSG_HDR(H2F_MSG_ISSUE_CMD_RAW, HFI_MSG_CMD);
+
+	cmds[1] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+	cmds[2] = cp_type4_packet(reg->select, 1);
+	cmds[3] = countable;
+
+	ret = gen7_hfi_send_cmd_async(adreno_dev, cmds, sizeof(cmds));
+	if (ret)
+		goto err;
+
+	/* Wait till the register is programmed with the countable */
+	ret = kgsl_regmap_read_poll_timeout(&device->regmap, reg->select, val,
+				val == countable, 100, ADRENO_IDLE_TIMEOUT);
+	if (!ret) {
+		reg->value = 0;
+		return ret;
+	}
+
+err:
+	dev_err(device->dev, "Perfcounter %s/%u/%u start via commands failed\n",
+			group->name, counter, countable);
+
+	return ret;
+}
+
+int gen7_hwsched_disable_hw_fence_throttle(struct adreno_device *adreno_dev)
+{
+	struct gen7_hwsched_hfi *hfi = to_gen7_hwsched_hfi(adreno_dev);
+	struct adreno_context *drawctxt = NULL;
+	u32 ts = 0;
+	int ret = 0;
+
+	if (!test_bit(ADRENO_HWSCHED_HW_FENCE, &adreno_dev->hwsched.flags))
+		return 0;
+
+	spin_lock(&hfi->hw_fence.lock);
+
+	drawctxt = hfi->hw_fence.defer_drawctxt;
+	ts = hfi->hw_fence.defer_ts;
+
+	spin_unlock(&hfi->hw_fence.lock);
+
+	if (!drawctxt)
+		goto done;
+
+	ret = process_hw_fence_deferred_ctxt(adreno_dev, drawctxt, ts);
+
+	kgsl_context_put(&drawctxt->base);
+	gen7_hwsched_active_count_put(adreno_dev);
+
+done:
+	_disable_hw_fence_throttle(adreno_dev, true);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_hwsched_hfi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_hwsched_hfi.h
@@ -0,0 +1,361 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _ADRENO_GEN7_HWSCHED_HFI_H_
+#define _ADRENO_GEN7_HWSCHED_HFI_H_
+
+/* Maximum number of IBs in a submission */
+#define HWSCHED_MAX_NUMIBS \
+	((HFI_MAX_MSG_SIZE - offsetof(struct hfi_issue_cmd_cmd, ibs)) \
+		/ sizeof(struct hfi_issue_ib))
+
+/*
+ * This is used to put userspace threads to sleep when hardware fence unack count reaches a
+ * threshold. This bit is cleared in two scenarios:
+ * 1. If the hardware fence unack count drops to a desired threshold.
+ * 2. If there is a GMU/GPU fault. Because we don't want the threads to keep sleeping through fault
+ *    recovery, which can easily take 100s of milliseconds to complete.
+ */
+#define GEN7_HWSCHED_HW_FENCE_SLEEP_BIT	0x0
+
+/*
+ * This is used to avoid creating any more hardware fences until the hardware fence unack count
+ * drops to a desired threshold. This bit is required in cases where GEN7_HWSCHED_HW_FENCE_SLEEP_BIT
+ * will be cleared, but we still want to avoid creating any more hardware fences. For example, if
+ * hardware fence unack count reaches a maximum threshold, both GEN7_HWSCHED_HW_FENCE_SLEEP_BIT and
+ * GEN7_HWSCHED_HW_FENCE_MAX_BIT will be set. Say, a GMU/GPU fault happens and
+ * GEN7_HWSCHED_HW_FENCE_SLEEP_BIT will be cleared to wake up any sleeping threads. But,
+ * GEN7_HWSCHED_HW_FENCE_MAX_BIT will remain set to avoid creating any new hardware fences until
+ * recovery is complete and deferred drawctxt (if any) is handled.
+ */
+#define GEN7_HWSCHED_HW_FENCE_MAX_BIT	0x1
+
+/*
+ * This is used to avoid creating any more hardware fences until concurrent reset/recovery completes
+ */
+#define GEN7_HWSCHED_HW_FENCE_ABORT_BIT 0x2
+
+struct gen7_hwsched_hfi {
+	struct hfi_mem_alloc_entry mem_alloc_table[32];
+	u32 mem_alloc_entries;
+	/** @irq_mask: Store the hfi interrupt mask */
+	u32 irq_mask;
+	/** @msglock: To protect the list of un-ACKed hfi packets */
+	rwlock_t msglock;
+	/** @msglist: List of un-ACKed hfi packets */
+	struct list_head msglist;
+	/** @f2h_task: Task for processing gmu fw to host packets */
+	struct task_struct *f2h_task;
+	/** @f2h_wq: Waitqueue for the f2h_task */
+	wait_queue_head_t f2h_wq;
+	/** @big_ib: GMU buffer to hold big IBs */
+	struct kgsl_memdesc *big_ib;
+	/** @big_ib_recurring: GMU buffer to hold big recurring IBs */
+	struct kgsl_memdesc *big_ib_recurring;
+	/** @msg_mutex: Mutex for accessing the msgq */
+	struct mutex msgq_mutex;
+	struct {
+		/** @lock: Spinlock for managing hardware fences */
+		spinlock_t lock;
+		/**
+		 * @unack_count: Number of hardware fences sent to GMU but haven't yet been ack'd
+		 * by GMU
+		 */
+		u32 unack_count;
+		/**
+		 * @unack_wq: Waitqueue to wait on till number of unacked hardware fences drops to
+		 * a desired threshold
+		 */
+		wait_queue_head_t unack_wq;
+		/**
+		 * @defer_drawctxt: Drawctxt to send hardware fences from as soon as unacked
+		 * hardware fences drops to a desired threshold
+		 */
+		struct adreno_context *defer_drawctxt;
+		/**
+		 * @defer_ts: The timestamp of the hardware fence which got deferred
+		 */
+		u32 defer_ts;
+		/**
+		 * @flags: Flags to control the creation of new hardware fences
+		 */
+		unsigned long flags;
+		/** @seqnum: Sequence number for hardware fence packet header */
+		atomic_t seqnum;
+	} hw_fence;
+	/**
+	 * @hw_fence_timer: Timer to trigger fault if unack'd hardware fence count does'nt drop
+	 * to a desired threshold in given amount of time
+	 */
+	struct timer_list hw_fence_timer;
+	/**
+	 * @hw_fence_ws: Work struct that gets scheduled when hw_fence_timer expires
+	 */
+	struct work_struct hw_fence_ws;
+	/** @detached_hw_fences_list: List of hardware fences belonging to detached contexts */
+	struct list_head detached_hw_fence_list;
+	/** @defer_hw_fence_work: The work structure to send deferred hardware fences to GMU */
+	struct kthread_work defer_hw_fence_work;
+};
+
+struct kgsl_drawobj_cmd;
+
+/**
+ * gen7_hwsched_hfi_probe - Probe hwsched hfi resources
+ * @adreno_dev: Pointer to adreno device structure
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int gen7_hwsched_hfi_probe(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_hfi_remove - Release hwsched hfi resources
+ * @adreno_dev: Pointer to adreno device structure
+ */
+void gen7_hwsched_hfi_remove(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_hfi_init - Initialize hfi resources
+ * @adreno_dev: Pointer to adreno device structure
+ *
+ * This function is used to initialize hfi resources
+ * once before the very first gmu boot
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int gen7_hwsched_hfi_init(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_hfi_start - Start hfi resources
+ * @adreno_dev: Pointer to adreno device structure
+ *
+ * Send the various hfi packets before booting the gpu
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int gen7_hwsched_hfi_start(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_hfi_stop - Stop the hfi resources
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * This function does the hfi cleanup when powering down the gmu
+ */
+void gen7_hwsched_hfi_stop(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwched_cp_init - Send CP_INIT via HFI
+ * @adreno_dev: Pointer to adreno device structure
+ *
+ * This function is used to send CP INIT packet and bring
+ * GPU out of secure mode using hfi raw packets.
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int gen7_hwsched_cp_init(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_counter_inline_enable - Configure a performance counter for a countable
+ * @adreno_dev -  Adreno device to configure
+ * @group - Desired performance counter group
+ * @counter - Desired performance counter in the group
+ * @countable - Desired countable
+ *
+ * Physically set up a counter within a group with the desired countable
+ * Return 0 on success or negative error on failure.
+ */
+int gen7_hwsched_counter_inline_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		u32 counter, u32 countable);
+
+/**
+ * gen7_hfi_send_cmd_async - Send an hfi packet
+ * @adreno_dev: Pointer to adreno device structure
+ * @data: Data to be sent in the hfi packet
+ * @size_bytes: Size of the packet in bytes
+ *
+ * Send data in the form of an HFI packet to gmu and wait for
+ * it's ack asynchronously
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int gen7_hfi_send_cmd_async(struct adreno_device *adreno_dev, void *data, u32 size_bytes);
+
+/**
+ * gen7_hwsched_submit_drawobj - Dispatch IBs to dispatch queues
+ * @adreno_dev: Pointer to adreno device structure
+ * @drawobj: The command draw object which needs to be submitted
+ *
+ * This function is used to register the context if needed and submit
+ * IBs to the hfi dispatch queues.
+
+ * Return: 0 on success and negative error on failure
+ */
+int gen7_hwsched_submit_drawobj(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj *drawobj);
+
+/**
+ * gen7_hwsched_context_detach - Unregister a context with GMU
+ * @drawctxt: Pointer to the adreno context
+ *
+ * This function sends context unregister HFI and waits for the ack
+ * to ensure all submissions from this context have retired
+ */
+void gen7_hwsched_context_detach(struct adreno_context *drawctxt);
+
+/* Helper function to get to gen7 hwsched hfi device from adreno device */
+struct gen7_hwsched_hfi *to_gen7_hwsched_hfi(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_preempt_count_get - Get preemption count from GMU
+ * @adreno_dev: Pointer to adreno device
+ *
+ * This function sends a GET_VALUE HFI packet to get the number of
+ * preemptions completed since last SLUMBER exit.
+ *
+ * Return: Preemption count
+ */
+u32 gen7_hwsched_preempt_count_get(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_lpac_cp_init - Send CP_INIT to LPAC via HFI
+ * @adreno_dev: Pointer to adreno device structure
+ *
+ * This function is used to send CP INIT packet to LPAC and
+ * enable submission to LPAC queue.
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int gen7_hwsched_lpac_cp_init(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hfi_send_lpac_feature_ctrl - Send the lpac feature hfi packet
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_hfi_send_lpac_feature_ctrl(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_context_destroy - Destroy any hwsched related resources during context destruction
+ * @adreno_dev: Pointer to adreno device
+ * @drawctxt: Pointer to the adreno context
+ *
+ * This functions destroys any hwsched related resources when this context is destroyed
+ */
+void gen7_hwsched_context_destroy(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt);
+
+/**
+ * gen7_hwsched_hfi_get_value - Send GET_VALUE packet to GMU to get the value of a property
+ * @adreno_dev: Pointer to adreno device
+ * @prop: property to get from GMU
+ *
+ * This functions sends GET_VALUE HFI packet to query value of a property
+ *
+ * Return: On success, return the value in the GMU response. On failure, return 0
+ */
+u32 gen7_hwsched_hfi_get_value(struct adreno_device *adreno_dev, u32 prop);
+
+/**
+ * gen7_send_hw_fence_hfi_wait_ack - Send hardware fence info to GMU
+ * @adreno_dev: Pointer to adreno device
+ * @entry: Pointer to the adreno hardware fence entry
+ * @flags: Flags for this hardware fence
+ *
+ * Send the hardware fence info to the GMU and wait for the ack
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int gen7_send_hw_fence_hfi_wait_ack(struct adreno_device *adreno_dev,
+	struct adreno_hw_fence_entry *entry, u64 flags);
+
+/**
+ * gen7_hwsched_create_hw_fence - Create a hardware fence
+ * @adreno_dev: Pointer to adreno device
+ * @kfence: Pointer to the kgsl fence
+ *
+ * Create a hardware fence, set up hardware fence info and send it to GMU if required
+ */
+void gen7_hwsched_create_hw_fence(struct adreno_device *adreno_dev,
+	struct kgsl_sync_fence *kfence);
+
+/**
+ * gen7_hwsched_drain_context_hw_fences - Drain context's hardware fences via GMU
+ * @adreno_dev: Pointer to adreno device
+ * @drawctxt: Pointer to the adreno context which is to be flushed
+ *
+ * Trigger hardware fences that were never dispatched to GMU
+ *
+ * Return: Zero on success or negative error on failure
+ */
+int gen7_hwsched_drain_context_hw_fences(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt);
+
+/**
+ * gen7_hwsched_check_context_inflight_hw_fences - Check whether all hardware fences
+ * from a context have been sent to the TxQueue or not
+ * @adreno_dev: Pointer to adreno device
+ * @drawctxt: Pointer to the adreno context which is to be flushed
+ *
+ * Check if all hardware fences from this context have been sent to the
+ * TxQueue. If not, log an error and return error code.
+ *
+ * Return: Zero on success or negative error on failure
+ */
+int gen7_hwsched_check_context_inflight_hw_fences(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt);
+
+/**
+ * gen7_remove_hw_fence_entry - Remove hardware fence entry
+ * @adreno_dev: pointer to the adreno device
+ * @entry: Pointer to the hardware fence entry
+ */
+void gen7_remove_hw_fence_entry(struct adreno_device *adreno_dev,
+	struct adreno_hw_fence_entry *entry);
+
+/**
+ * gen7_trigger_hw_fence_cpu - Trigger hardware fence from cpu
+ * @adreno_dev: pointer to the adreno device
+ * @fence: hardware fence entry to be triggered
+ *
+ * Trigger the hardware fence by sending it to GMU's TxQueue and raise the
+ * interrupt from GMU to APPS
+ */
+void gen7_trigger_hw_fence_cpu(struct adreno_device *adreno_dev,
+	struct adreno_hw_fence_entry *fence);
+
+/**
+ * gen7_hwsched_disable_hw_fence_throttle - Disable hardware fence throttling after reset
+ * @adreno_dev: pointer to the adreno device
+ *
+ * After device reset, clear hardware fence related data structures and send any hardware fences
+ * that got deferred (prior to reset) and re-open the gates for hardware fence creation
+ *
+ * Return: Zero on success or negative error on failure
+ */
+int gen7_hwsched_disable_hw_fence_throttle(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_process_msgq - Process msgq
+ * @adreno_dev: pointer to the adreno device
+ *
+ * This function grabs the msgq mutex and processes msgq for any outstanding hfi packets
+ */
+void gen7_hwsched_process_msgq(struct adreno_device *adreno_dev);
+
+/**
+ * gen7_hwsched_boot_gpu - Send the command to boot GPU
+ * @adreno_dev: Pointer to adreno device
+ *
+ * Send the hfi to boot GPU, and check the ack, incase of a failure
+ * get a snapshot and capture registers of interest.
+ *
+ * Return: Zero on success or negative error on failure
+ */
+int gen7_hwsched_boot_gpu(struct adreno_device *adreno_dev);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_perfcounter.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_perfcounter.c
@@ -0,0 +1,1223 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_gen7_hwsched_hfi.h"
+#include "adreno_perfcounter.h"
+#include "adreno_pm4types.h"
+#include "kgsl_device.h"
+
+/*
+ * For registers that do not get restored on power cycle, read the value and add
+ * the stored shadow value
+ */
+static u64 gen7_counter_read_norestore(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 hi, lo;
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	return ((((u64) hi) << 32) | lo) + reg->value;
+}
+
+static int gen7_counter_br_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	int ret = 0;
+	u32 val = 0;
+
+	kgsl_regread(device, GEN7_CP_APERTURE_CNTL_HOST, &val);
+	kgsl_regwrite(device, GEN7_CP_APERTURE_CNTL_HOST, FIELD_PREP(GENMASK(13, 12), PIPE_BR));
+
+	if (group->flags & ADRENO_PERFCOUNTER_GROUP_RESTORE)
+		ret = gen7_perfcounter_update(adreno_dev, reg, true,
+						FIELD_PREP(GENMASK(13, 12), PIPE_BR));
+	else
+		kgsl_regwrite(device, reg->select, countable);
+
+	kgsl_regwrite(device, GEN7_CP_APERTURE_CNTL_HOST, val);
+
+	if (!ret)
+		reg->value = 0;
+
+	return ret;
+}
+
+static int gen7_counter_bv_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	int ret = 0;
+	u32 val = 0;
+
+	kgsl_regread(device, GEN7_CP_APERTURE_CNTL_HOST, &val);
+	kgsl_regwrite(device, GEN7_CP_APERTURE_CNTL_HOST, FIELD_PREP(GENMASK(13, 12), PIPE_BV));
+
+	if (group->flags & ADRENO_PERFCOUNTER_GROUP_RESTORE)
+		ret = gen7_perfcounter_update(adreno_dev, reg, true,
+						FIELD_PREP(GENMASK(13, 12), PIPE_BV));
+	else
+		kgsl_regwrite(device, reg->select, countable);
+
+	kgsl_regwrite(device, GEN7_CP_APERTURE_CNTL_HOST, val);
+
+	if (!ret)
+		reg->value = 0;
+
+	return ret;
+}
+
+static int gen7_counter_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	int ret = 0;
+
+	if (group->flags & ADRENO_PERFCOUNTER_GROUP_RESTORE)
+		ret = gen7_perfcounter_update(adreno_dev, reg, true,
+						FIELD_PREP(GENMASK(13, 12), PIPE_NONE));
+	else
+		kgsl_regwrite(device, reg->select, countable);
+
+	if (!ret)
+		reg->value = 0;
+
+	return ret;
+}
+
+static int gen7_hwsched_counter_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		u32 counter, u32 countable)
+{
+	if (!(KGSL_DEVICE(adreno_dev)->state == KGSL_STATE_ACTIVE))
+		return gen7_counter_enable(adreno_dev, group, counter, countable);
+
+	return gen7_hwsched_counter_inline_enable(adreno_dev, group, counter, countable);
+}
+
+/* This function is specific to sw-scheduler and not applicable for hw-scheduler */
+static int gen7_counter_inline_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	struct adreno_ringbuffer *rb = &adreno_dev->ringbuffers[0];
+	u32 cmds[3];
+	int ret;
+
+	/* Fallback when we reach here from GPU initialization sequence */
+	if (!(device->state == KGSL_STATE_ACTIVE))
+		return gen7_counter_enable(adreno_dev, group, counter,
+			countable);
+
+	if (group->flags & ADRENO_PERFCOUNTER_GROUP_RESTORE)
+		gen7_perfcounter_update(adreno_dev, reg, false,
+						FIELD_PREP(GENMASK(13, 12), PIPE_NONE));
+
+	cmds[0] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+	cmds[1] = cp_type4_packet(reg->select, 1);
+	cmds[2] = countable;
+
+	/* submit to highest priority RB always */
+	ret = gen7_ringbuffer_addcmds(adreno_dev, rb, NULL,
+		F_NOTPROTECTED, cmds, 3, 0, NULL);
+	if (ret)
+		return ret;
+
+	/*
+	 * schedule dispatcher to make sure rb[0] is run, because
+	 * if the current RB is not rb[0] and gpu is idle then
+	 * rb[0] will not get scheduled to run
+	 */
+	if (adreno_dev->cur_rb != rb)
+		adreno_dispatcher_schedule(device);
+
+	/* wait for the above commands submitted to complete */
+	ret = adreno_ringbuffer_waittimestamp(rb, rb->timestamp,
+		ADRENO_IDLE_TIMEOUT);
+
+	if (ret) {
+		/*
+		 * If we were woken up because of cancelling rb events
+		 * either due to soft reset or adreno_stop, ignore the
+		 * error and return 0 here. The perfcounter is already
+		 * set up in software and it will be programmed in
+		 * hardware when we wake up or come up after soft reset,
+		 * by adreno_perfcounter_restore.
+		 */
+		if (ret == -EAGAIN)
+			ret = 0;
+		else
+			dev_err_ratelimited(device->dev,
+				     "Perfcounter %s/%u/%u start via commands failed %d\n",
+				     group->name, counter, countable, ret);
+	}
+
+	if (!ret)
+		reg->value = 0;
+
+	return ret;
+}
+
+static u64 gen7_counter_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	u32 hi, lo;
+
+	kgsl_regread(device, reg->offset, &lo);
+	kgsl_regread(device, reg->offset_hi, &hi);
+
+	/* These registers are restored on power resume */
+	return (((u64) hi) << 32) | lo;
+}
+
+static int gen7_counter_gbif_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	unsigned int shift = counter << 3;
+	unsigned int select = BIT(counter);
+
+	if (countable > 0xff)
+		return -EINVAL;
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regrmw(device, GEN7_GBIF_PERF_PWR_CNT_CLR, select, select);
+	kgsl_regrmw(device, GEN7_GBIF_PERF_PWR_CNT_CLR, select, 0);
+
+	/* select the desired countable */
+	kgsl_regrmw(device, reg->select, 0xff << shift, countable << shift);
+
+	/* enable counter */
+	kgsl_regrmw(device, GEN7_GBIF_PERF_PWR_CNT_EN, select, select);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int gen7_counter_gbif_pwr_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	unsigned int shift = counter << 3;
+	unsigned int select = BIT(16 + counter);
+
+	if (countable > 0xff)
+		return -EINVAL;
+
+	/*
+	 * Write 1, followed by 0 to CLR register for
+	 * clearing the counter
+	 */
+	kgsl_regrmw(device, GEN7_GBIF_PERF_PWR_CNT_CLR, select, select);
+	kgsl_regrmw(device, GEN7_GBIF_PERF_PWR_CNT_CLR, select, 0);
+
+	/* select the desired countable */
+	kgsl_regrmw(device, reg->select, 0xff << shift, countable << shift);
+
+	/* Enable the counter */
+	kgsl_regrmw(device, GEN7_GBIF_PERF_PWR_CNT_EN, select, select);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int gen7_counter_alwayson_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	return 0;
+}
+
+static u64 gen7_counter_alwayson_read(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter)
+{
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	return gpudev->read_alwayson(adreno_dev) + reg->value;
+}
+
+static void gen7_write_gmu_counter_enable(struct kgsl_device *device,
+		struct adreno_perfcount_register *reg, u32 bit, u32 countable)
+{
+	kgsl_regrmw(device, reg->select, 0xff << bit, countable << bit);
+}
+
+static int gen7_counter_gmu_xoclk_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	if (countable > 0xff)
+		return -EINVAL;
+
+	/*
+	 * Counters [0:3] are in select 0 bit offsets 0, 8, 16 and 24
+	 * Counters [4:5] are in select 1 bit offset 0, 8
+	 * Counters [6:9] are in select 2 bit offset 0, 8, 16 and 24
+	 * Counters [10] is in select 3 bit offset 0
+	 */
+
+	if (counter == 4 || counter == 5)
+		counter -= 4;
+	else if (counter >= 6 && counter <= 9)
+		counter -= 6;
+	else if (counter == 10)
+		counter = 0;
+
+	gen7_write_gmu_counter_enable(device, reg, counter * 8, countable);
+
+	reg->value = 0;
+
+	kgsl_regwrite(device, GEN7_GMU_CX_GMU_POWER_COUNTER_ENABLE, 1);
+
+	return 0;
+}
+
+static int gen7_counter_gmu_gmuclk_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	if (countable > 0xff)
+		return -EINVAL;
+
+	/*
+	 * The two counters are stuck into GMU_CX_GMU_POWER_COUNTER_SELECT_1
+	 * at bit offset 16 and 24
+	 */
+	gen7_write_gmu_counter_enable(device, reg,
+		16 + (counter * 8), countable);
+
+	kgsl_regwrite(device, GEN7_GMU_CX_GMU_POWER_COUNTER_ENABLE, 1);
+
+	reg->value = 0;
+	return 0;
+}
+
+static int gen7_counter_gmu_perf_enable(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_perfcount_register *reg = &group->regs[counter];
+
+	if (countable > 0xff)
+		return -EINVAL;
+
+	/*
+	 * Counters [0:3] are in select 1 bit offsets 0, 8, 16 and 24
+	 * Counters [4:5] are in select 2 bit offset 0, 8
+	 */
+
+	if (counter >= 4)
+		counter -= 4;
+
+	gen7_write_gmu_counter_enable(device, reg, counter * 8, countable);
+
+	kgsl_regwrite(device, GEN7_GMU_CX_GMU_PERF_COUNTER_ENABLE, 1);
+
+	reg->value = 0;
+	return 0;
+}
+
+static struct adreno_perfcount_register gen7_perfcounters_cp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_0_LO,
+		GEN7_RBBM_PERFCTR_CP_0_HI, -1, GEN7_CP_PERFCTR_CP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_1_LO,
+		GEN7_RBBM_PERFCTR_CP_1_HI, -1, GEN7_CP_PERFCTR_CP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_2_LO,
+		GEN7_RBBM_PERFCTR_CP_2_HI, -1, GEN7_CP_PERFCTR_CP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_3_LO,
+		GEN7_RBBM_PERFCTR_CP_3_HI, -1, GEN7_CP_PERFCTR_CP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_4_LO,
+		GEN7_RBBM_PERFCTR_CP_4_HI, -1, GEN7_CP_PERFCTR_CP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_5_LO,
+		GEN7_RBBM_PERFCTR_CP_5_HI, -1, GEN7_CP_PERFCTR_CP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_6_LO,
+		GEN7_RBBM_PERFCTR_CP_6_HI, -1, GEN7_CP_PERFCTR_CP_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_7_LO,
+		GEN7_RBBM_PERFCTR_CP_7_HI, -1, GEN7_CP_PERFCTR_CP_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_8_LO,
+		GEN7_RBBM_PERFCTR_CP_8_HI, -1, GEN7_CP_PERFCTR_CP_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_9_LO,
+		GEN7_RBBM_PERFCTR_CP_9_HI, -1, GEN7_CP_PERFCTR_CP_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_10_LO,
+		GEN7_RBBM_PERFCTR_CP_10_HI, -1, GEN7_CP_PERFCTR_CP_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_11_LO,
+		GEN7_RBBM_PERFCTR_CP_11_HI, -1, GEN7_CP_PERFCTR_CP_SEL_11 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_12_LO,
+		GEN7_RBBM_PERFCTR_CP_12_HI, -1, GEN7_CP_PERFCTR_CP_SEL_12 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CP_13_LO,
+		GEN7_RBBM_PERFCTR_CP_13_HI, -1, GEN7_CP_PERFCTR_CP_SEL_13 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_cp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_CP_0_LO,
+		GEN7_RBBM_PERFCTR2_CP_0_HI, -1, GEN7_CP_BV_PERFCTR_CP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_CP_1_LO,
+		GEN7_RBBM_PERFCTR2_CP_1_HI, -1, GEN7_CP_BV_PERFCTR_CP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_CP_2_LO,
+		GEN7_RBBM_PERFCTR2_CP_2_HI, -1, GEN7_CP_BV_PERFCTR_CP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_CP_3_LO,
+		GEN7_RBBM_PERFCTR2_CP_3_HI, -1, GEN7_CP_BV_PERFCTR_CP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_CP_4_LO,
+		GEN7_RBBM_PERFCTR2_CP_4_HI, -1, GEN7_CP_BV_PERFCTR_CP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_CP_5_LO,
+		GEN7_RBBM_PERFCTR2_CP_5_HI, -1, GEN7_CP_BV_PERFCTR_CP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_CP_6_LO,
+		GEN7_RBBM_PERFCTR2_CP_6_HI, -1, GEN7_CP_BV_PERFCTR_CP_SEL_6 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_rbbm[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RBBM_0_LO,
+		GEN7_RBBM_PERFCTR_RBBM_0_HI, -1, GEN7_RBBM_PERFCTR_RBBM_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RBBM_1_LO,
+		GEN7_RBBM_PERFCTR_RBBM_1_HI, -1, GEN7_RBBM_PERFCTR_RBBM_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RBBM_2_LO,
+		GEN7_RBBM_PERFCTR_RBBM_2_HI, -1, GEN7_RBBM_PERFCTR_RBBM_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RBBM_3_LO,
+		GEN7_RBBM_PERFCTR_RBBM_3_HI, -1, GEN7_RBBM_PERFCTR_RBBM_SEL_3 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_pc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_PC_0_LO,
+		GEN7_RBBM_PERFCTR_PC_0_HI, -1, GEN7_PC_PERFCTR_PC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_PC_1_LO,
+		GEN7_RBBM_PERFCTR_PC_1_HI, -1, GEN7_PC_PERFCTR_PC_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_PC_2_LO,
+		GEN7_RBBM_PERFCTR_PC_2_HI, -1, GEN7_PC_PERFCTR_PC_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_PC_3_LO,
+		GEN7_RBBM_PERFCTR_PC_3_HI, -1, GEN7_PC_PERFCTR_PC_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_PC_4_LO,
+		GEN7_RBBM_PERFCTR_PC_4_HI, -1, GEN7_PC_PERFCTR_PC_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_PC_5_LO,
+		GEN7_RBBM_PERFCTR_PC_5_HI, -1, GEN7_PC_PERFCTR_PC_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_PC_6_LO,
+		GEN7_RBBM_PERFCTR_PC_6_HI, -1, GEN7_PC_PERFCTR_PC_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_PC_7_LO,
+		GEN7_RBBM_PERFCTR_PC_7_HI, -1, GEN7_PC_PERFCTR_PC_SEL_7 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_pc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_PC_0_LO,
+		GEN7_RBBM_PERFCTR_BV_PC_0_HI, -1, GEN7_PC_PERFCTR_PC_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_PC_1_LO,
+		GEN7_RBBM_PERFCTR_BV_PC_1_HI, -1, GEN7_PC_PERFCTR_PC_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_PC_2_LO,
+		GEN7_RBBM_PERFCTR_BV_PC_2_HI, -1, GEN7_PC_PERFCTR_PC_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_PC_3_LO,
+		GEN7_RBBM_PERFCTR_BV_PC_3_HI, -1, GEN7_PC_PERFCTR_PC_SEL_11 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_PC_4_LO,
+		GEN7_RBBM_PERFCTR_BV_PC_4_HI, -1, GEN7_PC_PERFCTR_PC_SEL_12 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_PC_5_LO,
+		GEN7_RBBM_PERFCTR_BV_PC_5_HI, -1, GEN7_PC_PERFCTR_PC_SEL_13 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_PC_6_LO,
+		GEN7_RBBM_PERFCTR_BV_PC_6_HI, -1, GEN7_PC_PERFCTR_PC_SEL_14 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_PC_7_LO,
+		GEN7_RBBM_PERFCTR_BV_PC_7_HI, -1, GEN7_PC_PERFCTR_PC_SEL_15 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_vfd[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VFD_0_LO,
+		GEN7_RBBM_PERFCTR_VFD_0_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VFD_1_LO,
+		GEN7_RBBM_PERFCTR_VFD_1_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VFD_2_LO,
+		GEN7_RBBM_PERFCTR_VFD_2_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VFD_3_LO,
+		GEN7_RBBM_PERFCTR_VFD_3_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VFD_4_LO,
+		GEN7_RBBM_PERFCTR_VFD_4_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VFD_5_LO,
+		GEN7_RBBM_PERFCTR_VFD_5_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VFD_6_LO,
+		GEN7_RBBM_PERFCTR_VFD_6_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VFD_7_LO,
+		GEN7_RBBM_PERFCTR_VFD_7_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_7 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_vfd[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VFD_0_LO,
+		GEN7_RBBM_PERFCTR_BV_VFD_0_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VFD_1_LO,
+		GEN7_RBBM_PERFCTR_BV_VFD_1_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VFD_2_LO,
+		GEN7_RBBM_PERFCTR_BV_VFD_2_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VFD_3_LO,
+		GEN7_RBBM_PERFCTR_BV_VFD_3_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_11 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VFD_4_LO,
+		GEN7_RBBM_PERFCTR_BV_VFD_4_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_12 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VFD_5_LO,
+		GEN7_RBBM_PERFCTR_BV_VFD_5_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_13 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VFD_6_LO,
+		GEN7_RBBM_PERFCTR_BV_VFD_6_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_14 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VFD_7_LO,
+		GEN7_RBBM_PERFCTR_BV_VFD_7_HI, -1, GEN7_VFD_PERFCTR_VFD_SEL_15 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_hlsq[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_HLSQ_0_LO,
+		GEN7_RBBM_PERFCTR_HLSQ_0_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_HLSQ_1_LO,
+		GEN7_RBBM_PERFCTR_HLSQ_1_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_HLSQ_2_LO,
+		GEN7_RBBM_PERFCTR_HLSQ_2_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_HLSQ_3_LO,
+		GEN7_RBBM_PERFCTR_HLSQ_3_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_HLSQ_4_LO,
+		GEN7_RBBM_PERFCTR_HLSQ_4_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_HLSQ_5_LO,
+		GEN7_RBBM_PERFCTR_HLSQ_5_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_5 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_hlsq[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_HLSQ_0_LO,
+		GEN7_RBBM_PERFCTR2_HLSQ_0_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_HLSQ_1_LO,
+		GEN7_RBBM_PERFCTR2_HLSQ_1_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_HLSQ_2_LO,
+		GEN7_RBBM_PERFCTR2_HLSQ_2_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_HLSQ_3_LO,
+		GEN7_RBBM_PERFCTR2_HLSQ_3_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_HLSQ_4_LO,
+		GEN7_RBBM_PERFCTR2_HLSQ_4_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_HLSQ_5_LO,
+		GEN7_RBBM_PERFCTR2_HLSQ_5_HI, -1, GEN7_SP_PERFCTR_HLSQ_SEL_5 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_vpc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VPC_0_LO,
+		GEN7_RBBM_PERFCTR_VPC_0_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VPC_1_LO,
+		GEN7_RBBM_PERFCTR_VPC_1_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VPC_2_LO,
+		GEN7_RBBM_PERFCTR_VPC_2_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VPC_3_LO,
+		GEN7_RBBM_PERFCTR_VPC_3_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VPC_4_LO,
+		GEN7_RBBM_PERFCTR_VPC_4_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VPC_5_LO,
+		GEN7_RBBM_PERFCTR_VPC_5_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_5 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_vpc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VPC_0_LO,
+		GEN7_RBBM_PERFCTR_BV_VPC_0_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VPC_1_LO,
+		GEN7_RBBM_PERFCTR_BV_VPC_1_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VPC_2_LO,
+		GEN7_RBBM_PERFCTR_BV_VPC_2_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VPC_3_LO,
+		GEN7_RBBM_PERFCTR_BV_VPC_3_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VPC_4_LO,
+		GEN7_RBBM_PERFCTR_BV_VPC_4_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_VPC_5_LO,
+		GEN7_RBBM_PERFCTR_BV_VPC_5_HI, -1, GEN7_VPC_PERFCTR_VPC_SEL_11 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_ccu[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CCU_0_LO,
+		GEN7_RBBM_PERFCTR_CCU_0_HI, -1, GEN7_RB_PERFCTR_CCU_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CCU_1_LO,
+		GEN7_RBBM_PERFCTR_CCU_1_HI, -1, GEN7_RB_PERFCTR_CCU_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CCU_2_LO,
+		GEN7_RBBM_PERFCTR_CCU_2_HI, -1, GEN7_RB_PERFCTR_CCU_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CCU_3_LO,
+		GEN7_RBBM_PERFCTR_CCU_3_HI, -1, GEN7_RB_PERFCTR_CCU_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CCU_4_LO,
+		GEN7_RBBM_PERFCTR_CCU_4_HI, -1, GEN7_RB_PERFCTR_CCU_SEL_4 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_tse[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TSE_0_LO,
+		GEN7_RBBM_PERFCTR_TSE_0_HI, -1, GEN7_GRAS_PERFCTR_TSE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TSE_1_LO,
+		GEN7_RBBM_PERFCTR_TSE_1_HI, -1, GEN7_GRAS_PERFCTR_TSE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TSE_2_LO,
+		GEN7_RBBM_PERFCTR_TSE_2_HI, -1, GEN7_GRAS_PERFCTR_TSE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TSE_3_LO,
+		GEN7_RBBM_PERFCTR_TSE_3_HI, -1, GEN7_GRAS_PERFCTR_TSE_SEL_3 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_tse[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_TSE_0_LO,
+		GEN7_RBBM_PERFCTR_BV_TSE_0_HI, -1, GEN7_GRAS_PERFCTR_TSE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_TSE_1_LO,
+		GEN7_RBBM_PERFCTR_BV_TSE_1_HI, -1, GEN7_GRAS_PERFCTR_TSE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_TSE_2_LO,
+		GEN7_RBBM_PERFCTR_BV_TSE_2_HI, -1, GEN7_GRAS_PERFCTR_TSE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_TSE_3_LO,
+		GEN7_RBBM_PERFCTR_BV_TSE_3_HI, -1, GEN7_GRAS_PERFCTR_TSE_SEL_3 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_ras[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RAS_0_LO,
+		GEN7_RBBM_PERFCTR_RAS_0_HI, -1, GEN7_GRAS_PERFCTR_RAS_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RAS_1_LO,
+		GEN7_RBBM_PERFCTR_RAS_1_HI, -1, GEN7_GRAS_PERFCTR_RAS_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RAS_2_LO,
+		GEN7_RBBM_PERFCTR_RAS_2_HI, -1, GEN7_GRAS_PERFCTR_RAS_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RAS_3_LO,
+		GEN7_RBBM_PERFCTR_RAS_3_HI, -1, GEN7_GRAS_PERFCTR_RAS_SEL_3 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_ras[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_RAS_0_LO,
+		GEN7_RBBM_PERFCTR_BV_RAS_0_HI, -1, GEN7_GRAS_PERFCTR_RAS_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_RAS_1_LO,
+		GEN7_RBBM_PERFCTR_BV_RAS_1_HI, -1, GEN7_GRAS_PERFCTR_RAS_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_RAS_2_LO,
+		GEN7_RBBM_PERFCTR_BV_RAS_2_HI, -1, GEN7_GRAS_PERFCTR_RAS_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_RAS_3_LO,
+		GEN7_RBBM_PERFCTR_BV_RAS_3_HI, -1, GEN7_GRAS_PERFCTR_RAS_SEL_3 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_uche[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_0_LO,
+		GEN7_RBBM_PERFCTR_UCHE_0_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_1_LO,
+		GEN7_RBBM_PERFCTR_UCHE_1_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_2_LO,
+		GEN7_RBBM_PERFCTR_UCHE_2_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_3_LO,
+		GEN7_RBBM_PERFCTR_UCHE_3_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_4_LO,
+		GEN7_RBBM_PERFCTR_UCHE_4_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_5_LO,
+		GEN7_RBBM_PERFCTR_UCHE_5_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_6_LO,
+		GEN7_RBBM_PERFCTR_UCHE_6_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_7_LO,
+		GEN7_RBBM_PERFCTR_UCHE_7_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_8_LO,
+		GEN7_RBBM_PERFCTR_UCHE_8_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_9_LO,
+		GEN7_RBBM_PERFCTR_UCHE_9_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_10_LO,
+		GEN7_RBBM_PERFCTR_UCHE_10_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_11_LO,
+		GEN7_RBBM_PERFCTR_UCHE_11_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_11 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_gen7_2_0_uche[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_0_LO,
+		GEN7_RBBM_PERFCTR_UCHE_0_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_1_LO,
+		GEN7_RBBM_PERFCTR_UCHE_1_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_2_LO,
+		GEN7_RBBM_PERFCTR_UCHE_2_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_3_LO,
+		GEN7_RBBM_PERFCTR_UCHE_3_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_4_LO,
+		GEN7_RBBM_PERFCTR_UCHE_4_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_5_LO,
+		GEN7_RBBM_PERFCTR_UCHE_5_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_6_LO,
+		GEN7_RBBM_PERFCTR_UCHE_6_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_7_LO,
+		GEN7_RBBM_PERFCTR_UCHE_7_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_8_LO,
+		GEN7_RBBM_PERFCTR_UCHE_8_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_9_LO,
+		GEN7_RBBM_PERFCTR_UCHE_9_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_10_LO,
+		GEN7_RBBM_PERFCTR_UCHE_10_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_11_LO,
+		GEN7_RBBM_PERFCTR_UCHE_11_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_11 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_12_LO,
+		GEN7_RBBM_PERFCTR_UCHE_12_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_12 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_13_LO,
+		GEN7_RBBM_PERFCTR_UCHE_13_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_13 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_14_LO,
+		GEN7_RBBM_PERFCTR_UCHE_14_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_14 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_15_LO,
+		GEN7_RBBM_PERFCTR_UCHE_15_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_15 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_16_LO,
+		GEN7_RBBM_PERFCTR_UCHE_16_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_16 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_17_LO,
+		GEN7_RBBM_PERFCTR_UCHE_17_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_17 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_18_LO,
+		GEN7_RBBM_PERFCTR_UCHE_18_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_18 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_19_LO,
+		GEN7_RBBM_PERFCTR_UCHE_19_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_19 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_20_LO,
+		GEN7_RBBM_PERFCTR_UCHE_20_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_20 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_21_LO,
+		GEN7_RBBM_PERFCTR_UCHE_21_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_21 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_22_LO,
+		GEN7_RBBM_PERFCTR_UCHE_22_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_22 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_23_LO,
+		GEN7_RBBM_PERFCTR_UCHE_23_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_23 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_gen7_9_0_uche[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_0_LO,
+		GEN7_RBBM_PERFCTR_UCHE_0_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_1_LO,
+		GEN7_RBBM_PERFCTR_UCHE_1_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_2_LO,
+		GEN7_RBBM_PERFCTR_UCHE_2_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_3_LO,
+		GEN7_RBBM_PERFCTR_UCHE_3_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_4_LO,
+		GEN7_RBBM_PERFCTR_UCHE_4_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_5_LO,
+		GEN7_RBBM_PERFCTR_UCHE_5_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_6_LO,
+		GEN7_RBBM_PERFCTR_UCHE_6_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_7_LO,
+		GEN7_RBBM_PERFCTR_UCHE_7_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_8_LO,
+		GEN7_RBBM_PERFCTR_UCHE_8_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_9_LO,
+		GEN7_RBBM_PERFCTR_UCHE_9_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_10_LO,
+		GEN7_RBBM_PERFCTR_UCHE_10_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_11_LO,
+		GEN7_RBBM_PERFCTR_UCHE_11_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_11 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_12_LO,
+		GEN7_RBBM_PERFCTR_UCHE_12_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_13_LO,
+		GEN7_RBBM_PERFCTR_UCHE_13_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_14_LO,
+		GEN7_RBBM_PERFCTR_UCHE_14_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_15_LO,
+		GEN7_RBBM_PERFCTR_UCHE_15_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_16_LO,
+		GEN7_RBBM_PERFCTR_UCHE_16_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_17_LO,
+		GEN7_RBBM_PERFCTR_UCHE_17_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_18_LO,
+		GEN7_RBBM_PERFCTR_UCHE_18_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_19_LO,
+		GEN7_RBBM_PERFCTR_UCHE_19_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_20_LO,
+		GEN7_RBBM_PERFCTR_UCHE_20_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_21_LO,
+		GEN7_RBBM_PERFCTR_UCHE_21_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_22_LO,
+		GEN7_RBBM_PERFCTR_UCHE_22_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UCHE_23_LO,
+		GEN7_RBBM_PERFCTR_UCHE_23_HI, -1, GEN7_UCHE_PERFCTR_UCHE_SEL_2_11 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_tp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_0_LO,
+		GEN7_RBBM_PERFCTR_TP_0_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_1_LO,
+		GEN7_RBBM_PERFCTR_TP_1_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_2_LO,
+		GEN7_RBBM_PERFCTR_TP_2_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_3_LO,
+		GEN7_RBBM_PERFCTR_TP_3_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_4_LO,
+		GEN7_RBBM_PERFCTR_TP_4_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_5_LO,
+		GEN7_RBBM_PERFCTR_TP_5_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_6_LO,
+		GEN7_RBBM_PERFCTR_TP_6_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_7_LO,
+		GEN7_RBBM_PERFCTR_TP_7_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_8_LO,
+		GEN7_RBBM_PERFCTR_TP_8_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_9_LO,
+		GEN7_RBBM_PERFCTR_TP_9_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_10_LO,
+		GEN7_RBBM_PERFCTR_TP_10_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_TP_11_LO,
+		GEN7_RBBM_PERFCTR_TP_11_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_11 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_tp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_TP_0_LO,
+		GEN7_RBBM_PERFCTR2_TP_0_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_12 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_TP_1_LO,
+		GEN7_RBBM_PERFCTR2_TP_1_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_13 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_TP_2_LO,
+		GEN7_RBBM_PERFCTR2_TP_2_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_14 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_TP_3_LO,
+		GEN7_RBBM_PERFCTR2_TP_3_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_15 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_TP_4_LO,
+		GEN7_RBBM_PERFCTR2_TP_4_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_16 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_TP_5_LO,
+		GEN7_RBBM_PERFCTR2_TP_5_HI, -1, GEN7_TPL1_PERFCTR_TP_SEL_17 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_sp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_0_LO,
+		GEN7_RBBM_PERFCTR_SP_0_HI, -1, GEN7_SP_PERFCTR_SP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_1_LO,
+		GEN7_RBBM_PERFCTR_SP_1_HI, -1, GEN7_SP_PERFCTR_SP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_2_LO,
+		GEN7_RBBM_PERFCTR_SP_2_HI, -1, GEN7_SP_PERFCTR_SP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_3_LO,
+		GEN7_RBBM_PERFCTR_SP_3_HI, -1, GEN7_SP_PERFCTR_SP_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_4_LO,
+		GEN7_RBBM_PERFCTR_SP_4_HI, -1, GEN7_SP_PERFCTR_SP_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_5_LO,
+		GEN7_RBBM_PERFCTR_SP_5_HI, -1, GEN7_SP_PERFCTR_SP_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_6_LO,
+		GEN7_RBBM_PERFCTR_SP_6_HI, -1, GEN7_SP_PERFCTR_SP_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_7_LO,
+		GEN7_RBBM_PERFCTR_SP_7_HI, -1, GEN7_SP_PERFCTR_SP_SEL_7 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_8_LO,
+		GEN7_RBBM_PERFCTR_SP_8_HI, -1, GEN7_SP_PERFCTR_SP_SEL_8 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_9_LO,
+		GEN7_RBBM_PERFCTR_SP_9_HI, -1, GEN7_SP_PERFCTR_SP_SEL_9 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_10_LO,
+		GEN7_RBBM_PERFCTR_SP_10_HI, -1, GEN7_SP_PERFCTR_SP_SEL_10 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_11_LO,
+		GEN7_RBBM_PERFCTR_SP_11_HI, -1, GEN7_SP_PERFCTR_SP_SEL_11 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_12_LO,
+		GEN7_RBBM_PERFCTR_SP_12_HI, -1, GEN7_SP_PERFCTR_SP_SEL_12 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_13_LO,
+		GEN7_RBBM_PERFCTR_SP_13_HI, -1, GEN7_SP_PERFCTR_SP_SEL_13 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_14_LO,
+		GEN7_RBBM_PERFCTR_SP_14_HI, -1, GEN7_SP_PERFCTR_SP_SEL_14 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_15_LO,
+		GEN7_RBBM_PERFCTR_SP_15_HI, -1, GEN7_SP_PERFCTR_SP_SEL_15 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_16_LO,
+		GEN7_RBBM_PERFCTR_SP_16_HI, -1, GEN7_SP_PERFCTR_SP_SEL_16 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_17_LO,
+		GEN7_RBBM_PERFCTR_SP_17_HI, -1, GEN7_SP_PERFCTR_SP_SEL_17 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_18_LO,
+		GEN7_RBBM_PERFCTR_SP_18_HI, -1, GEN7_SP_PERFCTR_SP_SEL_18 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_19_LO,
+		GEN7_RBBM_PERFCTR_SP_19_HI, -1, GEN7_SP_PERFCTR_SP_SEL_19 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_20_LO,
+		GEN7_RBBM_PERFCTR_SP_20_HI, -1, GEN7_SP_PERFCTR_SP_SEL_20 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_21_LO,
+		GEN7_RBBM_PERFCTR_SP_21_HI, -1, GEN7_SP_PERFCTR_SP_SEL_21 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_22_LO,
+		GEN7_RBBM_PERFCTR_SP_22_HI, -1, GEN7_SP_PERFCTR_SP_SEL_22 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_SP_23_LO,
+		GEN7_RBBM_PERFCTR_SP_23_HI, -1, GEN7_SP_PERFCTR_SP_SEL_23 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_sp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_0_LO,
+		GEN7_RBBM_PERFCTR2_SP_0_HI, -1, GEN7_SP_PERFCTR_SP_SEL_24 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_1_LO,
+		GEN7_RBBM_PERFCTR2_SP_1_HI, -1, GEN7_SP_PERFCTR_SP_SEL_25 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_2_LO,
+		GEN7_RBBM_PERFCTR2_SP_2_HI, -1, GEN7_SP_PERFCTR_SP_SEL_26 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_3_LO,
+		GEN7_RBBM_PERFCTR2_SP_3_HI, -1, GEN7_SP_PERFCTR_SP_SEL_27 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_4_LO,
+		GEN7_RBBM_PERFCTR2_SP_4_HI, -1, GEN7_SP_PERFCTR_SP_SEL_28 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_5_LO,
+		GEN7_RBBM_PERFCTR2_SP_5_HI, -1, GEN7_SP_PERFCTR_SP_SEL_29 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_6_LO,
+		GEN7_RBBM_PERFCTR2_SP_6_HI, -1, GEN7_SP_PERFCTR_SP_SEL_30 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_7_LO,
+		GEN7_RBBM_PERFCTR2_SP_7_HI, -1, GEN7_SP_PERFCTR_SP_SEL_31 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_8_LO,
+		GEN7_RBBM_PERFCTR2_SP_8_HI, -1, GEN7_SP_PERFCTR_SP_SEL_32 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_9_LO,
+		GEN7_RBBM_PERFCTR2_SP_9_HI, -1, GEN7_SP_PERFCTR_SP_SEL_33 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_10_LO,
+		GEN7_RBBM_PERFCTR2_SP_10_HI, -1, GEN7_SP_PERFCTR_SP_SEL_34 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_SP_11_LO,
+		GEN7_RBBM_PERFCTR2_SP_11_HI, -1, GEN7_SP_PERFCTR_SP_SEL_35 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_rb[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RB_0_LO,
+		GEN7_RBBM_PERFCTR_RB_0_HI, -1, GEN7_RB_PERFCTR_RB_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RB_1_LO,
+		GEN7_RBBM_PERFCTR_RB_1_HI, -1, GEN7_RB_PERFCTR_RB_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RB_2_LO,
+		GEN7_RBBM_PERFCTR_RB_2_HI, -1, GEN7_RB_PERFCTR_RB_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RB_3_LO,
+		GEN7_RBBM_PERFCTR_RB_3_HI, -1, GEN7_RB_PERFCTR_RB_SEL_3 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RB_4_LO,
+		GEN7_RBBM_PERFCTR_RB_4_HI, -1, GEN7_RB_PERFCTR_RB_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RB_5_LO,
+		GEN7_RBBM_PERFCTR_RB_5_HI, -1, GEN7_RB_PERFCTR_RB_SEL_5 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RB_6_LO,
+		GEN7_RBBM_PERFCTR_RB_6_HI, -1, GEN7_RB_PERFCTR_RB_SEL_6 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_RB_7_LO,
+		GEN7_RBBM_PERFCTR_RB_7_HI, -1, GEN7_RB_PERFCTR_RB_SEL_7 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_vsc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VSC_0_LO,
+		GEN7_RBBM_PERFCTR_VSC_0_HI, -1, GEN7_VSC_PERFCTR_VSC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_VSC_1_LO,
+		GEN7_RBBM_PERFCTR_VSC_1_HI, -1, GEN7_VSC_PERFCTR_VSC_SEL_1 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_lrz[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_LRZ_0_LO,
+		GEN7_RBBM_PERFCTR_LRZ_0_HI, -1, GEN7_GRAS_PERFCTR_LRZ_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_LRZ_1_LO,
+		GEN7_RBBM_PERFCTR_LRZ_1_HI, -1, GEN7_GRAS_PERFCTR_LRZ_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_LRZ_2_LO,
+		GEN7_RBBM_PERFCTR_LRZ_2_HI, -1, GEN7_GRAS_PERFCTR_LRZ_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_LRZ_3_LO,
+		GEN7_RBBM_PERFCTR_LRZ_3_HI, -1, GEN7_GRAS_PERFCTR_LRZ_SEL_3 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_lrz[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_LRZ_0_LO,
+		GEN7_RBBM_PERFCTR_BV_LRZ_0_HI, -1, GEN7_GRAS_PERFCTR_LRZ_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_LRZ_1_LO,
+		GEN7_RBBM_PERFCTR_BV_LRZ_1_HI, -1, GEN7_GRAS_PERFCTR_LRZ_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_LRZ_2_LO,
+		GEN7_RBBM_PERFCTR_BV_LRZ_2_HI, -1, GEN7_GRAS_PERFCTR_LRZ_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_BV_LRZ_3_LO,
+		GEN7_RBBM_PERFCTR_BV_LRZ_3_HI, -1, GEN7_GRAS_PERFCTR_LRZ_SEL_3 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_cmp[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CMP_0_LO,
+		GEN7_RBBM_PERFCTR_CMP_0_HI, -1, GEN7_RB_PERFCTR_CMP_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CMP_1_LO,
+		GEN7_RBBM_PERFCTR_CMP_1_HI, -1, GEN7_RB_PERFCTR_CMP_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CMP_2_LO,
+		GEN7_RBBM_PERFCTR_CMP_2_HI, -1, GEN7_RB_PERFCTR_CMP_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_CMP_3_LO,
+		GEN7_RBBM_PERFCTR_CMP_3_HI, -1, GEN7_RB_PERFCTR_CMP_SEL_3 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_ufc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UFC_0_LO,
+		GEN7_RBBM_PERFCTR_UFC_0_HI, -1, GEN7_RB_PERFCTR_UFC_SEL_0 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UFC_1_LO,
+		GEN7_RBBM_PERFCTR_UFC_1_HI, -1, GEN7_RB_PERFCTR_UFC_SEL_1 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UFC_2_LO,
+		GEN7_RBBM_PERFCTR_UFC_2_HI, -1, GEN7_RB_PERFCTR_UFC_SEL_2 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR_UFC_3_LO,
+		GEN7_RBBM_PERFCTR_UFC_3_HI, -1, GEN7_RB_PERFCTR_UFC_SEL_3 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_bv_ufc[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_UFC_0_LO,
+		GEN7_RBBM_PERFCTR2_UFC_0_HI, -1, GEN7_RB_PERFCTR_UFC_SEL_4 },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_RBBM_PERFCTR2_UFC_1_LO,
+		GEN7_RBBM_PERFCTR2_UFC_1_HI, -1, GEN7_RB_PERFCTR_UFC_SEL_5 },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_gbif[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_GBIF_PERF_CNT_LOW0,
+		GEN7_GBIF_PERF_CNT_HIGH0, -1, GEN7_GBIF_PERF_CNT_SEL },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_GBIF_PERF_CNT_LOW1,
+		GEN7_GBIF_PERF_CNT_HIGH1, -1, GEN7_GBIF_PERF_CNT_SEL },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_GBIF_PERF_CNT_LOW2,
+		GEN7_GBIF_PERF_CNT_HIGH2, -1, GEN7_GBIF_PERF_CNT_SEL },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_GBIF_PERF_CNT_LOW3,
+		GEN7_GBIF_PERF_CNT_HIGH3, -1, GEN7_GBIF_PERF_CNT_SEL },
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_gbif_pwr[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_GBIF_PWR_CNT_LOW0,
+		GEN7_GBIF_PWR_CNT_HIGH0, -1, GEN7_GBIF_PERF_PWR_CNT_SEL },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_GBIF_PWR_CNT_LOW1,
+		GEN7_GBIF_PWR_CNT_HIGH1, -1, GEN7_GBIF_PERF_PWR_CNT_SEL },
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_GBIF_PWR_CNT_LOW2,
+		GEN7_GBIF_PWR_CNT_HIGH2, -1, GEN7_GBIF_PERF_PWR_CNT_SEL },
+};
+
+#define GMU_COUNTER(lo, hi, sel) \
+	{ .countable = KGSL_PERFCOUNTER_NOT_USED, \
+	  .offset = lo, .offset_hi = hi, .select = sel }
+
+#define GMU_COUNTER_RESERVED(lo, hi, sel) \
+	{ .countable = KGSL_PERFCOUNTER_BROKEN, \
+	  .offset = lo, .offset_hi = hi, .select = sel }
+
+static struct adreno_perfcount_register gen7_perfcounters_gmu_xoclk[] = {
+	/*
+	 * COUNTER_XOCLK_0 and COUNTER_XOCLK_4 are used for the GPU
+	 * busy and ifpc count. Mark them as reserved to ensure they
+	 * are not re-used.
+	 */
+	GMU_COUNTER_RESERVED(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_0),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_0),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_0),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_0),
+	GMU_COUNTER_RESERVED(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_1),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_5_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_5_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_1),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_6_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_6_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_2),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_7_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_7_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_2),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_8_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_8_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_2),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_9_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_9_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_2),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_10_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_10_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_3),
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_gmu_gmuclk[] = {
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_GMUCLK_0_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_GMUCLK_0_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_1),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_POWER_COUNTER_GMUCLK_1_L,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_GMUCLK_1_H,
+		GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_1),
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_gmu_perf[] = {
+	GMU_COUNTER(GEN7_GMU_CX_GMU_PERF_COUNTER_0_L,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_0_H,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_SELECT_0),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_PERF_COUNTER_1_L,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_1_H,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_SELECT_0),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_PERF_COUNTER_2_L,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_2_H,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_SELECT_0),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_PERF_COUNTER_3_L,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_3_H,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_SELECT_0),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_PERF_COUNTER_4_L,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_4_H,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_SELECT_1),
+	GMU_COUNTER(GEN7_GMU_CX_GMU_PERF_COUNTER_5_L,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_5_H,
+		GEN7_GMU_CX_GMU_PERF_COUNTER_SELECT_1),
+};
+
+static struct adreno_perfcount_register gen7_perfcounters_alwayson[] = {
+	{ KGSL_PERFCOUNTER_NOT_USED, 0, 0, GEN7_CP_ALWAYS_ON_COUNTER_LO,
+		GEN7_CP_ALWAYS_ON_COUNTER_HI, -1 },
+};
+
+/*
+ * ADRENO_PERFCOUNTER_GROUP_RESTORE flag is enabled by default
+ * because most of the perfcounter groups need to be restored
+ * as part of preemption and IFPC. Perfcounter groups that are
+ * not restored as part of preemption and IFPC should be defined
+ * using GEN7_PERFCOUNTER_GROUP_FLAGS macro
+ */
+
+#define GEN7_PERFCOUNTER_GROUP_FLAGS(core, offset, name, flags, \
+		enable, read) \
+	[KGSL_PERFCOUNTER_GROUP_##offset] = { core##_perfcounters_##name, \
+	ARRAY_SIZE(core##_perfcounters_##name), __stringify(name), flags, \
+	enable, read }
+
+#define GEN7_PERFCOUNTER_GROUP(offset, name, enable, read) \
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, offset, name, \
+	ADRENO_PERFCOUNTER_GROUP_RESTORE, enable, read)
+
+#define GEN7_REGULAR_PERFCOUNTER_GROUP(offset, name) \
+	GEN7_PERFCOUNTER_GROUP(offset, name, \
+		gen7_counter_enable, gen7_counter_read)
+
+#define GEN7_BV_PERFCOUNTER_GROUP(offset, name, enable, read) \
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, BV_##offset, bv_##name, \
+	ADRENO_PERFCOUNTER_GROUP_RESTORE, enable, read)
+
+#define GEN7_BV_REGULAR_PERFCOUNTER_GROUP(offset, name) \
+	GEN7_BV_PERFCOUNTER_GROUP(offset, name, \
+		gen7_counter_enable, gen7_counter_read)
+
+static const struct adreno_perfcount_group gen7_hwsched_perfcounter_groups
+				[KGSL_PERFCOUNTER_GROUP_MAX] = {
+	GEN7_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, RBBM, rbbm, 0,
+		gen7_counter_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	GEN7_PERFCOUNTER_GROUP(VFD, vfd, gen7_hwsched_counter_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(HLSQ, hlsq, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(CCU, ccu),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(CMP, cmp),
+	GEN7_PERFCOUNTER_GROUP(TSE, tse, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(RAS, ras, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(LRZ, lrz, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(UCHE, gen7_2_0_uche),
+	GEN7_PERFCOUNTER_GROUP(TP, tp, gen7_hwsched_counter_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(SP, sp, gen7_hwsched_counter_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(RB, rb),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(VSC, vsc),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, VBIF, gbif, 0,
+		gen7_counter_gbif_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, VBIF_PWR, gbif_pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		gen7_counter_gbif_pwr_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, ALWAYSON, alwayson,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		gen7_counter_alwayson_enable, gen7_counter_alwayson_read),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, GMU_XOCLK, gmu_xoclk, 0,
+		gen7_counter_gmu_xoclk_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, GMU_GMUCLK, gmu_gmuclk, 0,
+		gen7_counter_gmu_gmuclk_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, GMU_PERF, gmu_perf, 0,
+		gen7_counter_gmu_perf_enable, gen7_counter_read_norestore),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(UFC, ufc),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(VFD, vfd),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(TP, tp),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(SP, sp),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(UFC, ufc),
+	GEN7_BV_PERFCOUNTER_GROUP(TSE, tse, gen7_counter_bv_enable, gen7_counter_read),
+	GEN7_BV_PERFCOUNTER_GROUP(RAS, ras, gen7_counter_bv_enable, gen7_counter_read),
+	GEN7_BV_PERFCOUNTER_GROUP(LRZ, lrz, gen7_counter_bv_enable, gen7_counter_read),
+	GEN7_BV_PERFCOUNTER_GROUP(HLSQ, hlsq, gen7_counter_bv_enable, gen7_counter_read),
+};
+
+static const struct adreno_perfcount_group gen7_9_0_hwsched_perfcounter_groups
+				[KGSL_PERFCOUNTER_GROUP_MAX] = {
+	GEN7_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, RBBM, rbbm, 0,
+		gen7_counter_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	GEN7_PERFCOUNTER_GROUP(VFD, vfd, gen7_hwsched_counter_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(HLSQ, hlsq, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(CCU, ccu),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(CMP, cmp),
+	GEN7_PERFCOUNTER_GROUP(TSE, tse, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(RAS, ras, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(LRZ, lrz, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(UCHE, gen7_9_0_uche),
+	GEN7_PERFCOUNTER_GROUP(TP, tp, gen7_hwsched_counter_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(SP, sp, gen7_hwsched_counter_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(RB, rb),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(VSC, vsc),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, VBIF, gbif, 0,
+		gen7_counter_gbif_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, VBIF_PWR, gbif_pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		gen7_counter_gbif_pwr_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, ALWAYSON, alwayson,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		gen7_counter_alwayson_enable, gen7_counter_alwayson_read),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, GMU_XOCLK, gmu_xoclk, 0,
+		gen7_counter_gmu_xoclk_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, GMU_GMUCLK, gmu_gmuclk, 0,
+		gen7_counter_gmu_gmuclk_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, GMU_PERF, gmu_perf, 0,
+		gen7_counter_gmu_perf_enable, gen7_counter_read_norestore),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(UFC, ufc),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(VFD, vfd),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(TP, tp),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(SP, sp),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(UFC, ufc),
+	GEN7_BV_PERFCOUNTER_GROUP(TSE, tse, gen7_counter_bv_enable, gen7_counter_read),
+	GEN7_BV_PERFCOUNTER_GROUP(RAS, ras, gen7_counter_bv_enable, gen7_counter_read),
+	GEN7_BV_PERFCOUNTER_GROUP(LRZ, lrz, gen7_counter_bv_enable, gen7_counter_read),
+	GEN7_BV_PERFCOUNTER_GROUP(HLSQ, hlsq, gen7_counter_bv_enable, gen7_counter_read),
+};
+
+static const struct adreno_perfcount_group gen7_perfcounter_groups
+				[KGSL_PERFCOUNTER_GROUP_MAX] = {
+	GEN7_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, RBBM, rbbm, 0,
+		gen7_counter_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	GEN7_PERFCOUNTER_GROUP(VFD, vfd, gen7_counter_inline_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(HLSQ, hlsq, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(CCU, ccu),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(CMP, cmp),
+	GEN7_PERFCOUNTER_GROUP(TSE, tse, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(RAS, ras, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(LRZ, lrz, gen7_counter_br_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(UCHE, uche),
+	GEN7_PERFCOUNTER_GROUP(TP, tp, gen7_counter_inline_enable, gen7_counter_read),
+	GEN7_PERFCOUNTER_GROUP(SP, sp, gen7_counter_inline_enable, gen7_counter_read),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(RB, rb),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(VSC, vsc),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, VBIF, gbif, 0,
+		gen7_counter_gbif_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, VBIF_PWR, gbif_pwr,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		gen7_counter_gbif_pwr_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, ALWAYSON, alwayson,
+		ADRENO_PERFCOUNTER_GROUP_FIXED,
+		gen7_counter_alwayson_enable, gen7_counter_alwayson_read),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, GMU_XOCLK, gmu_xoclk, 0,
+		gen7_counter_gmu_xoclk_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, GMU_GMUCLK, gmu_gmuclk, 0,
+		gen7_counter_gmu_gmuclk_enable, gen7_counter_read_norestore),
+	GEN7_PERFCOUNTER_GROUP_FLAGS(gen7, GMU_PERF, gmu_perf, 0,
+		gen7_counter_gmu_perf_enable, gen7_counter_read_norestore),
+	GEN7_REGULAR_PERFCOUNTER_GROUP(UFC, ufc),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(CP, cp),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(PC, pc),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(VFD, vfd),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(VPC, vpc),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(TP, tp),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(SP, sp),
+	GEN7_BV_REGULAR_PERFCOUNTER_GROUP(UFC, ufc),
+	GEN7_BV_PERFCOUNTER_GROUP(TSE, tse, gen7_counter_bv_enable, gen7_counter_read),
+	GEN7_BV_PERFCOUNTER_GROUP(RAS, ras, gen7_counter_bv_enable, gen7_counter_read),
+	GEN7_BV_PERFCOUNTER_GROUP(LRZ, lrz, gen7_counter_bv_enable, gen7_counter_read),
+	GEN7_BV_PERFCOUNTER_GROUP(HLSQ, hlsq, gen7_counter_bv_enable, gen7_counter_read),
+};
+
+const struct adreno_perfcounters adreno_gen7_perfcounters = {
+	gen7_perfcounter_groups,
+	ARRAY_SIZE(gen7_perfcounter_groups),
+};
+
+const struct adreno_perfcounters adreno_gen7_hwsched_perfcounters = {
+	gen7_hwsched_perfcounter_groups,
+	ARRAY_SIZE(gen7_hwsched_perfcounter_groups),
+};
+
+const struct adreno_perfcounters adreno_gen7_9_0_hwsched_perfcounters = {
+	gen7_9_0_hwsched_perfcounter_groups,
+	ARRAY_SIZE(gen7_9_0_hwsched_perfcounter_groups),
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_preempt.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_preempt.c
@@ -0,0 +1,810 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_pm4types.h"
+#include "adreno_trace.h"
+
+#define PREEMPT_RECORD(_field) \
+		offsetof(struct gen7_cp_preemption_record, _field)
+
+#define PREEMPT_SMMU_RECORD(_field) \
+		offsetof(struct gen7_cp_smmu_info, _field)
+
+static void _update_wptr(struct adreno_device *adreno_dev, bool reset_timer,
+	bool atomic)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb = adreno_dev->cur_rb;
+	unsigned long flags;
+	int ret = 0;
+
+	spin_lock_irqsave(&rb->preempt_lock, flags);
+
+	if (!atomic) {
+		/*
+		 * We might have skipped updating the wptr in case we are in
+		 * dispatcher context. Do it now.
+		 */
+		if (rb->skip_inline_wptr) {
+
+			ret = gen7_fenced_write(adreno_dev,
+				GEN7_CP_RB_WPTR, rb->wptr,
+				FENCE_STATUS_WRITEDROPPED0_MASK);
+
+			reset_timer = true;
+			rb->skip_inline_wptr = false;
+		}
+	} else {
+		unsigned int wptr;
+
+		kgsl_regread(device, GEN7_CP_RB_WPTR, &wptr);
+		if (wptr != rb->wptr) {
+			kgsl_regwrite(device, GEN7_CP_RB_WPTR, rb->wptr);
+			reset_timer = true;
+		}
+	}
+
+	if (reset_timer)
+		rb->dispatch_q.expires = jiffies +
+			msecs_to_jiffies(adreno_drawobj_timeout);
+
+	spin_unlock_irqrestore(&rb->preempt_lock, flags);
+
+	if (!atomic) {
+		/* If WPTR update fails, set the fault and trigger recovery */
+		if (ret) {
+			gmu_core_fault_snapshot(device);
+			adreno_dispatcher_fault(adreno_dev,
+				ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+		}
+	}
+}
+
+static void _power_collapse_set(struct adreno_device *adreno_dev, bool val)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	gmu_core_regwrite(device,
+			 GEN7_GMU_PWR_COL_PREEMPT_KEEPALIVE, (val ? 1 : 0));
+}
+
+static void _gen7_preemption_done(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status;
+
+	/*
+	 * In the very unlikely case that the power is off, do nothing - the
+	 * state will be reset on power up and everybody will be happy
+	 */
+
+	if (!kgsl_state_is_awake(device))
+		return;
+
+	kgsl_regread(device, GEN7_CP_CONTEXT_SWITCH_CNTL, &status);
+
+	if (status & 0x1) {
+		dev_err(device->dev,
+			"Preemption not complete: status=%X cur=%d R/W=%X/%X next=%d R/W=%X/%X\n",
+			status, adreno_dev->cur_rb->id,
+			adreno_get_rptr(adreno_dev->cur_rb),
+			adreno_dev->cur_rb->wptr,
+			adreno_dev->next_rb->id,
+			adreno_get_rptr(adreno_dev->next_rb),
+			adreno_dev->next_rb->wptr);
+
+		/* Set a fault and restart */
+		adreno_dispatcher_fault(adreno_dev, ADRENO_PREEMPT_FAULT);
+
+		return;
+	}
+
+	adreno_dev->preempt.count++;
+
+	del_timer_sync(&adreno_dev->preempt.timer);
+
+	kgsl_regread(device, GEN7_CP_CONTEXT_SWITCH_LEVEL_STATUS, &status);
+
+	trace_adreno_preempt_done(adreno_dev->cur_rb->id, adreno_dev->next_rb->id,
+		status, 0);
+
+	/* Clean up all the bits */
+	adreno_dev->prev_rb = adreno_dev->cur_rb;
+	adreno_dev->cur_rb = adreno_dev->next_rb;
+	adreno_dev->next_rb = NULL;
+
+	/* Update the wptr for the new command queue */
+	_update_wptr(adreno_dev, true, false);
+
+	/* Update the dispatcher timer for the new command queue */
+	mod_timer(&adreno_dev->dispatcher.timer,
+		adreno_dev->cur_rb->dispatch_q.expires);
+
+	/* Clear the preempt state */
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+}
+
+static void _gen7_preemption_fault(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status;
+
+	/*
+	 * If the power is on check the preemption status one more time - if it
+	 * was successful then just transition to the complete state
+	 */
+	if (kgsl_state_is_awake(device)) {
+		kgsl_regread(device, GEN7_CP_CONTEXT_SWITCH_CNTL, &status);
+
+		if (!(status & 0x1)) {
+			adreno_set_preempt_state(adreno_dev,
+				ADRENO_PREEMPT_COMPLETE);
+
+			adreno_dispatcher_schedule(device);
+			return;
+		}
+	}
+
+	dev_err(device->dev,
+		"Preemption Fault: cur=%d R/W=0x%x/0x%x, next=%d R/W=0x%x/0x%x\n",
+		adreno_dev->cur_rb->id,
+		adreno_get_rptr(adreno_dev->cur_rb),
+		adreno_dev->cur_rb->wptr,
+		adreno_dev->next_rb->id,
+		adreno_get_rptr(adreno_dev->next_rb),
+		adreno_dev->next_rb->wptr);
+
+	adreno_dispatcher_fault(adreno_dev, ADRENO_PREEMPT_FAULT);
+}
+
+static void _gen7_preemption_worker(struct work_struct *work)
+{
+	struct adreno_preemption *preempt = container_of(work,
+		struct adreno_preemption, work);
+	struct adreno_device *adreno_dev = container_of(preempt,
+		struct adreno_device, preempt);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	/* Need to take the mutex to make sure that the power stays on */
+	mutex_lock(&device->mutex);
+
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_FAULTED))
+		_gen7_preemption_fault(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+}
+
+/* Find the highest priority active ringbuffer */
+static struct adreno_ringbuffer *gen7_next_ringbuffer(
+		struct adreno_device *adreno_dev)
+{
+	struct adreno_ringbuffer *rb;
+	unsigned long flags;
+	unsigned int i;
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		bool empty;
+
+		spin_lock_irqsave(&rb->preempt_lock, flags);
+		empty = adreno_rb_empty(rb);
+		spin_unlock_irqrestore(&rb->preempt_lock, flags);
+
+		if (!empty)
+			return rb;
+	}
+
+	return NULL;
+}
+
+void gen7_preemption_trigger(struct adreno_device *adreno_dev, bool atomic)
+{
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_ringbuffer *next;
+	u64 ttbr0, gpuaddr;
+	u32 contextidr, cntl;
+	unsigned long flags;
+	struct adreno_preemption *preempt = &adreno_dev->preempt;
+
+	/* Put ourselves into a possible trigger state */
+	if (!adreno_move_preempt_state(adreno_dev,
+		ADRENO_PREEMPT_NONE, ADRENO_PREEMPT_START))
+		return;
+
+	/* Get the next ringbuffer to preempt in */
+	next = gen7_next_ringbuffer(adreno_dev);
+
+	/*
+	 * Nothing to do if every ringbuffer is empty or if the current
+	 * ringbuffer is the only active one
+	 */
+	if (next == NULL || next == adreno_dev->cur_rb) {
+		/*
+		 * Update any critical things that might have been skipped while
+		 * we were looking for a new ringbuffer
+		 */
+
+		if (next != NULL) {
+			_update_wptr(adreno_dev, false, atomic);
+
+			mod_timer(&adreno_dev->dispatcher.timer,
+				adreno_dev->cur_rb->dispatch_q.expires);
+		}
+
+		adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+		return;
+	}
+
+	/* Turn off the dispatcher timer */
+	del_timer(&adreno_dev->dispatcher.timer);
+
+	/*
+	 * This is the most critical section - we need to take care not to race
+	 * until we have programmed the CP for the switch
+	 */
+
+	spin_lock_irqsave(&next->preempt_lock, flags);
+
+	/* Get the pagetable from the pagetable info. */
+	kgsl_sharedmem_readq(device->scratch, &ttbr0,
+		SCRATCH_RB_OFFSET(next->id, ttbr0));
+	kgsl_sharedmem_readl(device->scratch, &contextidr,
+		SCRATCH_RB_OFFSET(next->id, contextidr));
+
+	kgsl_sharedmem_writel(next->preemption_desc,
+		PREEMPT_RECORD(wptr), next->wptr);
+
+	spin_unlock_irqrestore(&next->preempt_lock, flags);
+
+	/* And write it to the smmu info */
+	if (kgsl_mmu_is_perprocess(&device->mmu)) {
+		kgsl_sharedmem_writeq(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(ttbr0), ttbr0);
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(context_idr), contextidr);
+	}
+
+	kgsl_sharedmem_readq(preempt->scratch, &gpuaddr,
+		next->id * sizeof(u64));
+
+	/*
+	 * Set a keepalive bit before the first preemption register write.
+	 * This is required since while each individual write to the context
+	 * switch registers will wake the GPU from collapse, it will not in
+	 * itself cause GPU activity. Thus, the GPU could technically be
+	 * re-collapsed between subsequent register writes leading to a
+	 * prolonged preemption sequence. The keepalive bit prevents any
+	 * further power collapse while it is set.
+	 * It is more efficient to use a keepalive+wake-on-fence approach here
+	 * rather than an OOB. Both keepalive and the fence are effectively
+	 * free when the GPU is already powered on, whereas an OOB requires an
+	 * unconditional handshake with the GMU.
+	 */
+	_power_collapse_set(adreno_dev, true);
+
+	/*
+	 * Fenced writes on this path will make sure the GPU is woken up
+	 * in case it was power collapsed by the GMU.
+	 */
+	if (gen7_fenced_write(adreno_dev,
+		GEN7_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_LO,
+		lower_32_bits(next->preemption_desc->gpuaddr),
+		FENCE_STATUS_WRITEDROPPED1_MASK))
+		goto err;
+
+	/*
+	 * Above fence writes will make sure GMU comes out of
+	 * IFPC state if its was in IFPC state but it doesn't
+	 * guarantee that GMU FW actually moved to ACTIVE state
+	 * i.e. wake-up from IFPC is complete.
+	 * Wait for GMU to move to ACTIVE state before triggering
+	 * preemption. This is require to make sure CP doesn't
+	 * interrupt GMU during wake-up from IFPC.
+	 */
+	if (!atomic && gmu_core_dev_wait_for_active_transition(device))
+		goto err;
+
+	if (gen7_fenced_write(adreno_dev,
+		GEN7_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_HI,
+		upper_32_bits(next->preemption_desc->gpuaddr),
+		FENCE_STATUS_WRITEDROPPED1_MASK))
+		goto err;
+
+	if (kgsl_mmu_is_secured(&device->mmu)) {
+		if (gen7_fenced_write(adreno_dev,
+			GEN7_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_LO,
+			lower_32_bits(next->secure_preemption_desc->gpuaddr),
+			FENCE_STATUS_WRITEDROPPED1_MASK))
+			goto err;
+
+		if (gen7_fenced_write(adreno_dev,
+			GEN7_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_HI,
+			upper_32_bits(next->secure_preemption_desc->gpuaddr),
+			FENCE_STATUS_WRITEDROPPED1_MASK))
+			goto err;
+	}
+
+	if (gen7_fenced_write(adreno_dev,
+		GEN7_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_LO,
+		lower_32_bits(gpuaddr),
+		FENCE_STATUS_WRITEDROPPED1_MASK))
+		goto err;
+
+	if (gen7_fenced_write(adreno_dev,
+		GEN7_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_HI,
+		upper_32_bits(gpuaddr),
+		FENCE_STATUS_WRITEDROPPED1_MASK))
+		goto err;
+
+	adreno_dev->next_rb = next;
+
+	/* Start the timer to detect a stuck preemption */
+	mod_timer(&adreno_dev->preempt.timer,
+		jiffies + msecs_to_jiffies(ADRENO_PREEMPT_TIMEOUT));
+
+	cntl = (preempt->preempt_level << 6) | 0x01;
+
+	/* Skip save/restore during L1 preemption */
+	if (preempt->skipsaverestore)
+		cntl |= (1 << 9);
+
+	/* Enable GMEM save/restore across preemption */
+	if (preempt->usesgmem)
+		cntl |= (1 << 8);
+
+	trace_adreno_preempt_trigger(adreno_dev->cur_rb->id, adreno_dev->next_rb->id,
+		cntl, 0);
+
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_TRIGGERED);
+
+	if (gen7_core->qos_value)
+		kgsl_sharedmem_writel(preempt->scratch,
+			PREEMPT_SCRATCH_OFFSET(QOS_VALUE_IDX),
+			gen7_core->qos_value[next->id]);
+
+	/* Trigger the preemption */
+	if (gen7_fenced_write(adreno_dev, GEN7_CP_CONTEXT_SWITCH_CNTL, cntl,
+					FENCE_STATUS_WRITEDROPPED1_MASK)) {
+		adreno_dev->next_rb = NULL;
+		del_timer(&adreno_dev->preempt.timer);
+		goto err;
+	}
+
+	return;
+err:
+	/* If fenced write fails, take inline snapshot and trigger recovery */
+	if (!in_interrupt()) {
+		gmu_core_fault_snapshot(device);
+		adreno_dispatcher_fault(adreno_dev,
+			ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+	} else {
+		adreno_dispatcher_fault(adreno_dev, ADRENO_GMU_FAULT);
+	}
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+	/* Clear the keep alive */
+	_power_collapse_set(adreno_dev, false);
+
+}
+
+void gen7_preemption_callback(struct adreno_device *adreno_dev, int bit)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int status;
+
+	if (!adreno_move_preempt_state(adreno_dev,
+		ADRENO_PREEMPT_TRIGGERED, ADRENO_PREEMPT_PENDING))
+		return;
+
+	kgsl_regread(device, GEN7_CP_CONTEXT_SWITCH_CNTL, &status);
+
+	if (status & 0x1) {
+		dev_err(KGSL_DEVICE(adreno_dev)->dev,
+			"preempt interrupt with non-zero status: %X\n",
+			status);
+
+		/*
+		 * Under the assumption that this is a race between the
+		 * interrupt and the register, schedule the worker to clean up.
+		 * If the status still hasn't resolved itself by the time we get
+		 * there then we have to assume something bad happened
+		 */
+		adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_COMPLETE);
+		adreno_dispatcher_schedule(KGSL_DEVICE(adreno_dev));
+		return;
+	}
+
+	adreno_dev->preempt.count++;
+
+	/*
+	 * We can now safely clear the preemption keepalive bit, allowing
+	 * power collapse to resume its regular activity.
+	 */
+	_power_collapse_set(adreno_dev, false);
+
+	del_timer(&adreno_dev->preempt.timer);
+
+	kgsl_regread(device, GEN7_CP_CONTEXT_SWITCH_LEVEL_STATUS, &status);
+
+	trace_adreno_preempt_done(adreno_dev->cur_rb->id, adreno_dev->next_rb->id,
+		status, 0);
+
+	adreno_dev->prev_rb = adreno_dev->cur_rb;
+	adreno_dev->cur_rb = adreno_dev->next_rb;
+	adreno_dev->next_rb = NULL;
+
+	/* Update the wptr if it changed while preemption was ongoing */
+	_update_wptr(adreno_dev, true, true);
+
+	/* Update the dispatcher timer for the new command queue */
+	mod_timer(&adreno_dev->dispatcher.timer,
+		adreno_dev->cur_rb->dispatch_q.expires);
+
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+
+	gen7_preemption_trigger(adreno_dev, true);
+}
+
+void gen7_preemption_prepare_postamble(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	struct adreno_preemption *preempt = &adreno_dev->preempt;
+	u32 *postamble, count = 0;
+
+	/*
+	 * First 28 dwords of the device scratch buffer are used to store shadow rb data.
+	 * Reserve 15 dwords in the device scratch buffer from SCRATCH_POSTAMBLE_OFFSET for
+	 * KMD postamble pm4 packets. This should be in *device->scratch* so that userspace
+	 * cannot access it.
+	 */
+	postamble = device->scratch->hostptr + SCRATCH_POSTAMBLE_OFFSET;
+
+	/*
+	 * Reserve 4 dwords in the scratch buffer for dynamic QOS control feature. To ensure QOS
+	 * value is updated for first preemption, send it during bootup
+	 */
+	if (gen7_core->qos_value) {
+		postamble[count++] = cp_type7_packet(CP_MEM_TO_REG, 3);
+		postamble[count++] = GEN7_RBBM_GBIF_CLIENT_QOS_CNTL;
+		postamble[count++] = lower_32_bits(PREEMPT_SCRATCH_ADDR(adreno_dev, QOS_VALUE_IDX));
+		postamble[count++] = upper_32_bits(PREEMPT_SCRATCH_ADDR(adreno_dev, QOS_VALUE_IDX));
+	}
+
+	/*
+	 * Since postambles are not preserved across slumber, necessary packets
+	 * must be sent to GPU before first submission.
+	 *
+	 * If a packet needs to be sent before first submission, add it above this.
+	 */
+	preempt->postamble_bootup_len = count;
+
+	/* Reserve 11 dwords in the device scratch buffer to clear perfcounters */
+	if (!adreno_dev->perfcounter) {
+		postamble[count++] = cp_type7_packet(CP_REG_RMW, 3);
+		postamble[count++] = GEN7_RBBM_PERFCTR_SRAM_INIT_CMD;
+		postamble[count++] = 0x0;
+		postamble[count++] = 0x1;
+
+		postamble[count++] = cp_type7_packet(CP_WAIT_REG_MEM, 6);
+		postamble[count++] = 0x3;
+		postamble[count++] = GEN7_RBBM_PERFCTR_SRAM_INIT_STATUS;
+		postamble[count++] = 0x0;
+		postamble[count++] = 0x1;
+		postamble[count++] = 0x1;
+		postamble[count++] = 0x0;
+	}
+
+	preempt->postamble_len = count;
+}
+
+void gen7_preemption_schedule(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return;
+
+	mutex_lock(&device->mutex);
+
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_COMPLETE))
+		_gen7_preemption_done(adreno_dev);
+
+	gen7_preemption_trigger(adreno_dev, false);
+
+	mutex_unlock(&device->mutex);
+}
+
+u32 gen7_preemption_pre_ibsubmit(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 *cmds)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 count = kgsl_mmu_is_secured(&device->mmu) ? 12 : 9;
+	u32 *cmds_orig = cmds;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	if (test_and_set_bit(ADRENO_RB_SET_PSEUDO_DONE, &rb->flags))
+		goto done;
+
+	*cmds++ = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	*cmds++ = CP_SET_THREAD_BR;
+
+	*cmds++ = cp_type7_packet(CP_SET_PSEUDO_REGISTER, count);
+
+	/* NULL SMMU_INFO buffer - we track in KMD */
+	*cmds++ = SET_PSEUDO_SMMU_INFO;
+	cmds += cp_gpuaddr(adreno_dev, cmds, 0x0);
+
+	*cmds++ = SET_PSEUDO_PRIV_NON_SECURE_SAVE_ADDR;
+	cmds += cp_gpuaddr(adreno_dev, cmds, rb->preemption_desc->gpuaddr);
+
+	if (kgsl_mmu_is_secured(&device->mmu)) {
+		*cmds++ = SET_PSEUDO_PRIV_SECURE_SAVE_ADDR;
+		cmds += cp_gpuaddr(adreno_dev, cmds,
+				rb->secure_preemption_desc->gpuaddr);
+	}
+
+	/*
+	 * There is no need to specify this address when we are about to
+	 * trigger preemption. This is because CP internally stores this
+	 * address specified here in the CP_SET_PSEUDO_REGISTER payload to
+	 * the context record and thus knows from where to restore
+	 * the saved perfcounters for the new ringbuffer.
+	 */
+	*cmds++ = SET_PSEUDO_COUNTER;
+	cmds += cp_gpuaddr(adreno_dev, cmds,
+			rb->perfcounter_save_restore_desc->gpuaddr);
+
+done:
+	if (drawctxt) {
+		struct adreno_ringbuffer *rb = drawctxt->rb;
+		u64 dest = PREEMPT_SCRATCH_ADDR(adreno_dev, rb->id);
+		u64 gpuaddr = drawctxt->base.user_ctxt_record->memdesc.gpuaddr;
+
+		*cmds++ = cp_mem_packet(adreno_dev, CP_MEM_WRITE, 2, 2);
+		cmds += cp_gpuaddr(adreno_dev, cmds, dest);
+		*cmds++ = lower_32_bits(gpuaddr);
+		*cmds++ = upper_32_bits(gpuaddr);
+
+		if (adreno_dev->preempt.postamble_len) {
+			u64 kmd_postamble_addr = SCRATCH_POSTAMBLE_ADDR(KGSL_DEVICE(adreno_dev));
+
+			*cmds++ = cp_type7_packet(CP_SET_AMBLE, 3);
+			*cmds++ = lower_32_bits(kmd_postamble_addr);
+			*cmds++ = upper_32_bits(kmd_postamble_addr);
+			*cmds++ = FIELD_PREP(GENMASK(22, 20), CP_KMD_AMBLE_TYPE)
+				| (FIELD_PREP(GENMASK(19, 0), adreno_dev->preempt.postamble_len));
+		}
+	}
+
+	return (unsigned int) (cmds - cmds_orig);
+}
+
+u32 gen7_preemption_post_ibsubmit(struct adreno_device *adreno_dev,
+		u32 *cmds)
+{
+	u32 index = 0;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return 0;
+
+	if (adreno_dev->cur_rb) {
+		u64 dest = PREEMPT_SCRATCH_ADDR(adreno_dev, adreno_dev->cur_rb->id);
+
+		cmds[index++] = cp_type7_packet(CP_MEM_WRITE, 4);
+		cmds[index++] = lower_32_bits(dest);
+		cmds[index++] = upper_32_bits(dest);
+		cmds[index++] = 0;
+		cmds[index++] = 0;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	cmds[index++] = CP_SET_THREAD_BOTH;
+	cmds[index++] = cp_type7_packet(CP_CONTEXT_SWITCH_YIELD, 4);
+	cmds[index++] = 0;
+	cmds[index++] = 0;
+	cmds[index++] = 1;
+	cmds[index++] = 0;
+
+	return index;
+}
+
+void gen7_preemption_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_ringbuffer *rb;
+	unsigned int i;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return;
+
+	/* Force the state to be clear */
+	adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+
+	if (kgsl_mmu_is_perprocess(&device->mmu)) {
+		/* smmu_info is allocated and mapped in gen7_preemption_iommu_init */
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(magic), GEN7_CP_SMMU_INFO_MAGIC_REF);
+		kgsl_sharedmem_writeq(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(ttbr0), MMU_DEFAULT_TTBR0(device));
+
+		/* The CP doesn't use the asid record, so poison it */
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(asid), 0xdecafbad);
+		kgsl_sharedmem_writel(iommu->smmu_info,
+			PREEMPT_SMMU_RECORD(context_idr), 0);
+
+		kgsl_regwrite(device, GEN7_CP_CONTEXT_SWITCH_SMMU_INFO_LO,
+			lower_32_bits(iommu->smmu_info->gpuaddr));
+
+		kgsl_regwrite(device, GEN7_CP_CONTEXT_SWITCH_SMMU_INFO_HI,
+			upper_32_bits(iommu->smmu_info->gpuaddr));
+	}
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		kgsl_sharedmem_writel(rb->preemption_desc,
+			PREEMPT_RECORD(rptr), 0);
+		kgsl_sharedmem_writel(rb->preemption_desc,
+			PREEMPT_RECORD(wptr), 0);
+
+		adreno_ringbuffer_set_pagetable(device, rb,
+			device->mmu.defaultpagetable);
+
+		clear_bit(ADRENO_RB_SET_PSEUDO_DONE, &rb->flags);
+	}
+}
+
+static void reset_rb_preempt_record(struct adreno_device *adreno_dev,
+	struct adreno_ringbuffer *rb)
+{
+	memset(rb->preemption_desc->hostptr, 0x0, rb->preemption_desc->size);
+
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(magic), GEN7_CP_CTXRECORD_MAGIC_REF);
+	kgsl_sharedmem_writel(rb->preemption_desc,
+		PREEMPT_RECORD(cntl), GEN7_CP_RB_CNTL_DEFAULT);
+	kgsl_sharedmem_writeq(rb->preemption_desc,
+		PREEMPT_RECORD(rptr_addr), SCRATCH_RB_GPU_ADDR(
+		KGSL_DEVICE(adreno_dev), rb->id, rptr));
+	kgsl_sharedmem_writeq(rb->preemption_desc,
+		PREEMPT_RECORD(rbase), rb->buffer_desc->gpuaddr);
+	kgsl_sharedmem_writeq(rb->preemption_desc,
+		PREEMPT_RECORD(bv_rptr_addr), SCRATCH_RB_GPU_ADDR(
+		KGSL_DEVICE(adreno_dev), rb->id, bv_rptr));
+}
+
+void gen7_reset_preempt_records(struct adreno_device *adreno_dev)
+{
+	int i;
+	struct adreno_ringbuffer *rb;
+
+	if (!adreno_is_preemption_enabled(adreno_dev))
+		return;
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		reset_rb_preempt_record(adreno_dev, rb);
+	}
+}
+
+static int gen7_preemption_ringbuffer_init(struct adreno_device *adreno_dev,
+	struct adreno_ringbuffer *rb)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	u64 ctxt_record_size = GEN7_CP_CTXRECORD_SIZE_IN_BYTES;
+	int ret;
+
+	if (gen7_core->ctxt_record_size)
+		ctxt_record_size = gen7_core->ctxt_record_size;
+
+	ret = adreno_allocate_global(device, &rb->preemption_desc,
+		ctxt_record_size, SZ_16K, 0,
+		KGSL_MEMDESC_PRIVILEGED, "preemption_desc");
+	if (ret)
+		return ret;
+
+	if (kgsl_mmu_is_secured(&device->mmu)) {
+		ret = adreno_allocate_global(device, &rb->secure_preemption_desc,
+			ctxt_record_size, 0,
+			KGSL_MEMFLAGS_SECURE, KGSL_MEMDESC_PRIVILEGED,
+			"secure_preemption_desc");
+		if (ret)
+			return ret;
+	}
+
+	ret = adreno_allocate_global(device, &rb->perfcounter_save_restore_desc,
+		GEN7_CP_PERFCOUNTER_SAVE_RESTORE_SIZE, 0, 0,
+		KGSL_MEMDESC_PRIVILEGED,
+		"perfcounter_save_restore_desc");
+	if (ret)
+		return ret;
+
+	reset_rb_preempt_record(adreno_dev, rb);
+
+	return 0;
+}
+
+int gen7_preemption_init(struct adreno_device *adreno_dev)
+{
+	u32 flags = ADRENO_FEATURE(adreno_dev, ADRENO_APRIV) ? KGSL_MEMDESC_PRIVILEGED : 0;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_preemption *preempt = &adreno_dev->preempt;
+	struct adreno_ringbuffer *rb;
+	int ret;
+	unsigned int i;
+
+	/* We are dependent on IOMMU to make preemption go on the CP side */
+	if (kgsl_mmu_get_mmutype(device) != KGSL_MMU_TYPE_IOMMU) {
+		ret = -ENODEV;
+		goto done;
+	}
+
+	INIT_WORK(&preempt->work, _gen7_preemption_worker);
+
+	/* Allocate mem for storing preemption switch record */
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+		ret = gen7_preemption_ringbuffer_init(adreno_dev, rb);
+		if (ret)
+			goto done;
+	}
+
+	ret = adreno_allocate_global(device, &preempt->scratch, PAGE_SIZE,
+			0, 0, flags, "preempt_scratch");
+	if (ret)
+		goto done;
+
+	/* Allocate mem for storing preemption smmu record */
+	if (kgsl_mmu_is_perprocess(&device->mmu)) {
+		ret = adreno_allocate_global(device, &iommu->smmu_info, PAGE_SIZE, 0,
+			KGSL_MEMFLAGS_GPUREADONLY, KGSL_MEMDESC_PRIVILEGED,
+			"smmu_info");
+		if (ret)
+			goto done;
+	}
+
+	return 0;
+done:
+	clear_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv);
+	return ret;
+}
+
+int gen7_preemption_context_init(struct kgsl_context *context)
+{
+	struct kgsl_device *device = context->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	u64 flags = 0;
+
+	if (!adreno_preemption_feature_set(adreno_dev))
+		return 0;
+
+	if (context->flags & KGSL_CONTEXT_SECURE)
+		flags |= KGSL_MEMFLAGS_SECURE;
+
+	if (is_compat_task())
+		flags |= KGSL_MEMFLAGS_FORCE_32BIT;
+
+	/*
+	 * gpumem_alloc_entry takes an extra refcount. Put it only when
+	 * destroying the context to keep the context record valid
+	 */
+	context->user_ctxt_record = gpumem_alloc_entry(context->dev_priv,
+			GEN7_CP_CTXRECORD_USER_RESTORE_SIZE, flags);
+	if (IS_ERR(context->user_ctxt_record)) {
+		int ret = PTR_ERR(context->user_ctxt_record);
+
+		context->user_ctxt_record = NULL;
+		return ret;
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_ringbuffer.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_ringbuffer.c
@@ -0,0 +1,647 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "adreno_pm4types.h"
+#include "adreno_ringbuffer.h"
+#include "adreno_trace.h"
+#include "kgsl_trace.h"
+
+static bool is_concurrent_binning(struct adreno_context *drawctxt)
+{
+	if (!drawctxt)
+		return false;
+
+	return !(drawctxt->base.flags & KGSL_CONTEXT_SECURE);
+}
+
+static int gen7_rb_pagetable_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		struct kgsl_pagetable *pagetable, u32 *cmds)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u64 ttbr0 = kgsl_mmu_pagetable_get_ttbr0(pagetable);
+	int count = 0;
+	u32 id = drawctxt ? drawctxt->base.id : 0;
+
+	if (pagetable == device->mmu.defaultpagetable)
+		return 0;
+
+	/* CP switches the pagetable and flushes the Caches */
+	cmds[count++] = cp_type7_packet(CP_SMMU_TABLE_UPDATE, 3);
+	cmds[count++] = lower_32_bits(ttbr0);
+	cmds[count++] = upper_32_bits(ttbr0);
+	cmds[count++] = id;
+
+	cmds[count++] = cp_type7_packet(CP_MEM_WRITE, 5);
+	cmds[count++] = lower_32_bits(SCRATCH_RB_GPU_ADDR(device,
+				rb->id, ttbr0));
+	cmds[count++] = upper_32_bits(SCRATCH_RB_GPU_ADDR(device,
+				rb->id, ttbr0));
+	cmds[count++] = lower_32_bits(ttbr0);
+	cmds[count++] = upper_32_bits(ttbr0);
+	cmds[count++] = id;
+
+	/*
+	 * Sync both threads after switching pagetables and enable BR only
+	 * to make sure BV doesn't race ahead while BR is still switching
+	 * pagetables.
+	 */
+	cmds[count++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	cmds[count++] = CP_SYNC_THREADS | CP_SET_THREAD_BR;
+
+	return count;
+}
+
+static int gen7_rb_context_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_pagetable *pagetable =
+		adreno_drawctxt_get_pagetable(drawctxt);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int count = 0;
+	u32 cmds[55];
+
+	/* Sync both threads */
+	cmds[count++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	cmds[count++] = CP_SYNC_THREADS | CP_SET_THREAD_BOTH;
+	/* Reset context state */
+	cmds[count++] = cp_type7_packet(CP_RESET_CONTEXT_STATE, 1);
+	cmds[count++] = CP_RESET_GLOBAL_LOCAL_TS | CP_CLEAR_BV_BR_COUNTER |
+			CP_CLEAR_RESOURCE_TABLE | CP_CLEAR_ON_CHIP_TS;
+	/*
+	 * Enable/disable concurrent binning for pagetable switch and
+	 * set the thread to BR since only BR can execute the pagetable
+	 * switch packets.
+	 */
+	/* Sync both threads and enable BR only */
+	cmds[count++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	cmds[count++] = CP_SYNC_THREADS | CP_SET_THREAD_BR;
+
+	if (adreno_drawctxt_get_pagetable(rb->drawctxt_active) != pagetable) {
+
+		/* Clear performance counters during context switches */
+		if (!adreno_dev->perfcounter) {
+			cmds[count++] = cp_type4_packet(GEN7_RBBM_PERFCTR_SRAM_INIT_CMD, 1);
+			cmds[count++] = 0x1;
+		}
+
+		count += gen7_rb_pagetable_switch(adreno_dev, rb,
+			drawctxt, pagetable, &cmds[count]);
+
+		/* Wait for performance counter clear to finish */
+		if (!adreno_dev->perfcounter) {
+			cmds[count++] = cp_type7_packet(CP_WAIT_REG_MEM, 6);
+			cmds[count++] = 0x3;
+			cmds[count++] = GEN7_RBBM_PERFCTR_SRAM_INIT_STATUS;
+			cmds[count++] = 0x0;
+			cmds[count++] = 0x1;
+			cmds[count++] = 0x1;
+			cmds[count++] = 0x0;
+		}
+	} else {
+		struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+
+		u32 offset = GEN7_SMMU_BASE + (iommu->cb0_offset >> 2) + 0x0d;
+
+		/*
+		 * Set the CONTEXTIDR register to the current context id so we
+		 * can use it in pagefault debugging. Unlike TTBR0 we don't
+		 * need any special sequence or locking to change it
+		 */
+		cmds[count++] = cp_type4_packet(offset, 1);
+		cmds[count++] = drawctxt->base.id;
+	}
+
+	cmds[count++] = cp_type7_packet(CP_NOP, 1);
+	cmds[count++] = CONTEXT_TO_MEM_IDENTIFIER;
+
+	cmds[count++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[count++] = lower_32_bits(MEMSTORE_RB_GPU_ADDR(device, rb,
+				current_context));
+	cmds[count++] = upper_32_bits(MEMSTORE_RB_GPU_ADDR(device, rb,
+				current_context));
+	cmds[count++] = drawctxt->base.id;
+
+	cmds[count++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[count++] = lower_32_bits(MEMSTORE_ID_GPU_ADDR(device,
+		KGSL_MEMSTORE_GLOBAL, current_context));
+	cmds[count++] = upper_32_bits(MEMSTORE_ID_GPU_ADDR(device,
+		KGSL_MEMSTORE_GLOBAL, current_context));
+	cmds[count++] = drawctxt->base.id;
+
+	cmds[count++] = cp_type7_packet(CP_EVENT_WRITE, 1);
+	cmds[count++] = 0x31;
+
+	if (adreno_is_preemption_enabled(adreno_dev)) {
+		u64 gpuaddr = drawctxt->base.user_ctxt_record->memdesc.gpuaddr;
+
+		cmds[count++] = cp_type7_packet(CP_SET_PSEUDO_REGISTER, 3);
+		cmds[count++] = SET_PSEUDO_NON_PRIV_SAVE_ADDR;
+		cmds[count++] = lower_32_bits(gpuaddr);
+		cmds[count++] = upper_32_bits(gpuaddr);
+	}
+
+	return gen7_ringbuffer_addcmds(adreno_dev, rb, NULL, F_NOTPROTECTED,
+			cmds, count, 0, NULL);
+}
+
+#define RB_SOPTIMESTAMP(device, rb) \
+	MEMSTORE_RB_GPU_ADDR(device, rb, soptimestamp)
+#define CTXT_SOPTIMESTAMP(device, drawctxt) \
+	MEMSTORE_ID_GPU_ADDR(device, (drawctxt)->base.id, soptimestamp)
+
+#define RB_EOPTIMESTAMP(device, rb) \
+	MEMSTORE_RB_GPU_ADDR(device, rb, eoptimestamp)
+#define CTXT_EOPTIMESTAMP(device, drawctxt) \
+	MEMSTORE_ID_GPU_ADDR(device, (drawctxt)->base.id, eoptimestamp)
+
+int gen7_ringbuffer_submit(struct adreno_ringbuffer *rb,
+		struct adreno_submit_time *time)
+{
+	struct adreno_device *adreno_dev = ADRENO_RB_DEVICE(rb);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = 0;
+	unsigned long flags;
+
+	adreno_get_submit_time(adreno_dev, rb, time);
+	adreno_profile_submit_time(time);
+
+	spin_lock_irqsave(&rb->preempt_lock, flags);
+	if (adreno_in_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE)) {
+		if (adreno_dev->cur_rb == rb) {
+			kgsl_pwrscale_busy(device);
+			ret = gen7_fenced_write(adreno_dev,
+				GEN7_CP_RB_WPTR, rb->_wptr,
+				FENCE_STATUS_WRITEDROPPED0_MASK);
+			rb->skip_inline_wptr = false;
+		}
+	} else {
+		if (adreno_dev->cur_rb == rb)
+			rb->skip_inline_wptr = true;
+	}
+
+	rb->wptr = rb->_wptr;
+	spin_unlock_irqrestore(&rb->preempt_lock, flags);
+
+	if (ret) {
+		/*
+		 * If WPTR update fails, take inline snapshot and trigger
+		 * recovery.
+		 */
+		gmu_core_fault_snapshot(device);
+		adreno_dispatcher_fault(adreno_dev,
+			ADRENO_GMU_FAULT_SKIP_SNAPSHOT);
+	}
+
+	return ret;
+}
+
+int gen7_ringbuffer_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int i, ret;
+
+	ret = adreno_allocate_global(device, &device->scratch, PAGE_SIZE,
+			0, 0, KGSL_MEMDESC_RANDOM | KGSL_MEMDESC_PRIVILEGED,
+			"scratch");
+	if (ret)
+		return ret;
+
+	adreno_dev->cur_rb = &(adreno_dev->ringbuffers[0]);
+
+	if (!adreno_preemption_feature_set(adreno_dev)) {
+		adreno_dev->num_ringbuffers = 1;
+		return adreno_ringbuffer_setup(adreno_dev,
+				&adreno_dev->ringbuffers[0], 0);
+	}
+
+	adreno_dev->num_ringbuffers = ARRAY_SIZE(adreno_dev->ringbuffers);
+
+	for (i = 0; i < adreno_dev->num_ringbuffers; i++) {
+		int ret;
+
+		ret = adreno_ringbuffer_setup(adreno_dev,
+				&adreno_dev->ringbuffers[i], i);
+		if (ret)
+			return ret;
+	}
+
+	timer_setup(&adreno_dev->preempt.timer, adreno_preemption_timer, 0);
+	gen7_preemption_init(adreno_dev);
+	return 0;
+}
+
+#define GEN7_SUBMIT_MAX 104
+
+int gen7_ringbuffer_addcmds(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, struct adreno_context *drawctxt,
+		u32 flags, u32 *in, u32 dwords, u32 timestamp,
+		struct adreno_submit_time *time)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 size = GEN7_SUBMIT_MAX + dwords;
+	u32 *cmds, index = 0;
+	u64 profile_gpuaddr;
+	u32 profile_dwords;
+
+	if (adreno_drawctxt_detached(drawctxt))
+		return -ENOENT;
+
+	if (adreno_gpu_fault(adreno_dev) != 0)
+		return -EPROTO;
+
+	rb->timestamp++;
+
+	if (drawctxt)
+		drawctxt->internal_timestamp = rb->timestamp;
+
+	/* All submissions are run with protected mode off due to APRIV */
+	flags &= ~F_NOTPROTECTED;
+
+	cmds = adreno_ringbuffer_allocspace(rb, size);
+	if (IS_ERR(cmds))
+		return PTR_ERR(cmds);
+
+	/* Identify the start of a command */
+	cmds[index++] = cp_type7_packet(CP_NOP, 1);
+	cmds[index++] = drawctxt ? CMD_IDENTIFIER : CMD_INTERNAL_IDENTIFIER;
+
+	/* This is 25 dwords when drawctxt is not NULL and perfcounter needs to be zapped*/
+	index += gen7_preemption_pre_ibsubmit(adreno_dev, rb, drawctxt,
+		&cmds[index]);
+
+	cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	cmds[index++] = CP_SET_THREAD_BOTH;
+
+	cmds[index++] = cp_type7_packet(CP_SET_MARKER, 1);
+	cmds[index++] = 0x101; /* IFPC disable */
+
+	cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	cmds[index++] = CP_SET_THREAD_BR;
+
+	profile_gpuaddr = adreno_profile_preib_processing(adreno_dev,
+		drawctxt, &profile_dwords);
+
+	if (profile_gpuaddr) {
+		cmds[index++] = cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+		cmds[index++] = lower_32_bits(profile_gpuaddr);
+		cmds[index++] = upper_32_bits(profile_gpuaddr);
+		cmds[index++] = profile_dwords;
+	}
+
+	if (drawctxt) {
+		cmds[index++] = cp_type7_packet(CP_MEM_WRITE, 3);
+		cmds[index++] = lower_32_bits(CTXT_SOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = upper_32_bits(CTXT_SOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = timestamp;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_MEM_WRITE, 3);
+	cmds[index++] = lower_32_bits(RB_SOPTIMESTAMP(device, rb));
+	cmds[index++] = upper_32_bits(RB_SOPTIMESTAMP(device, rb));
+	cmds[index++] = rb->timestamp;
+
+	if (IS_SECURE(flags)) {
+		/* Sync BV and BR if entering secure mode */
+		cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+		cmds[index++] = CP_SYNC_THREADS | CP_CONCURRENT_BIN_DISABLE;
+		cmds[index++] = cp_type7_packet(CP_SET_SECURE_MODE, 1);
+		cmds[index++] = 1;
+	}
+
+	memcpy(&cmds[index], in, dwords << 2);
+	index += dwords;
+
+	profile_gpuaddr = adreno_profile_postib_processing(adreno_dev,
+		drawctxt, &dwords);
+
+	if (profile_gpuaddr) {
+		cmds[index++] = cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+		cmds[index++] = lower_32_bits(profile_gpuaddr);
+		cmds[index++] = upper_32_bits(profile_gpuaddr);
+		cmds[index++] = profile_dwords;
+	}
+
+	if (test_bit(KGSL_FT_PAGEFAULT_GPUHALT_ENABLE, &device->mmu.pfpolicy))
+		cmds[index++] = cp_type7_packet(CP_WAIT_MEM_WRITES, 0);
+
+	if (is_concurrent_binning(drawctxt)) {
+		u64 addr = SCRATCH_RB_GPU_ADDR(device, rb->id, bv_ts);
+
+		cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+		cmds[index++] = CP_SET_THREAD_BV;
+
+		/*
+		 * Make sure the timestamp is committed once BV pipe is
+		 * completely done with this submission.
+		 */
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_CLEAN | BIT(27);
+		cmds[index++] = lower_32_bits(addr);
+		cmds[index++] = upper_32_bits(addr);
+		cmds[index++] = rb->timestamp;
+
+		cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+		cmds[index++] = CP_SET_THREAD_BR;
+
+		/*
+		 * This makes sure that BR doesn't race ahead and commit
+		 * timestamp to memstore while BV is still processing
+		 * this submission.
+		 */
+		cmds[index++] = cp_type7_packet(CP_WAIT_TIMESTAMP, 4);
+		cmds[index++] = 0;
+		cmds[index++] = lower_32_bits(addr);
+		cmds[index++] = upper_32_bits(addr);
+		cmds[index++] = rb->timestamp;
+	}
+
+	/*
+	 * If this is an internal command, just write the ringbuffer timestamp,
+	 * otherwise, write both
+	 */
+	if (!drawctxt) {
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_CLEAN | BIT(31) | BIT(27);
+		cmds[index++] = lower_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = upper_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = rb->timestamp;
+	} else {
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_CLEAN | BIT(31) | BIT(27);
+		cmds[index++] = lower_32_bits(CTXT_EOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = upper_32_bits(CTXT_EOPTIMESTAMP(device,
+					drawctxt));
+		cmds[index++] = timestamp;
+
+		cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 4);
+		cmds[index++] = CACHE_CLEAN | BIT(27);
+		cmds[index++] = lower_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = upper_32_bits(RB_EOPTIMESTAMP(device, rb));
+		cmds[index++] = rb->timestamp;
+	}
+
+	if (IS_WFI(flags))
+		cmds[index++] = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+
+	if (IS_SECURE(flags)) {
+		cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+		cmds[index++] = CP_CONCURRENT_BIN_DISABLE;
+		cmds[index++] = cp_type7_packet(CP_SET_SECURE_MODE, 1);
+		cmds[index++] = 0;
+		cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+		cmds[index++] = CP_SYNC_THREADS;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	cmds[index++] = CP_SET_THREAD_BOTH;
+
+	cmds[index++] = cp_type7_packet(CP_SET_MARKER, 1);
+	cmds[index++] = 0x100; /* IFPC enable */
+
+	cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+	cmds[index++] = CP_SET_THREAD_BR;
+
+	/* 10 dwords */
+	index += gen7_preemption_post_ibsubmit(adreno_dev, &cmds[index]);
+
+	/* Adjust the thing for the number of bytes we actually wrote */
+	rb->_wptr -= (size - index);
+
+	return gen7_ringbuffer_submit(rb, time);
+}
+
+static u32 gen7_get_alwayson_counter(u32 *cmds, u64 gpuaddr)
+{
+	cmds[0] = cp_type7_packet(CP_REG_TO_MEM, 3);
+	cmds[1] = GEN7_CP_ALWAYS_ON_COUNTER_LO | (1 << 30) | (2 << 18);
+	cmds[2] = lower_32_bits(gpuaddr);
+	cmds[3] = upper_32_bits(gpuaddr);
+
+	return 4;
+}
+
+static u32 gen7_get_alwayson_context(u32 *cmds, u64 gpuaddr)
+{
+	cmds[0] = cp_type7_packet(CP_REG_TO_MEM, 3);
+	cmds[1] = GEN7_CP_ALWAYS_ON_CONTEXT_LO | (1 << 30) | (2 << 18);
+	cmds[2] = lower_32_bits(gpuaddr);
+	cmds[3] = upper_32_bits(gpuaddr);
+
+	return 4;
+}
+
+#define PROFILE_IB_DWORDS 4
+#define PROFILE_IB_SLOTS (PAGE_SIZE / (PROFILE_IB_DWORDS << 2))
+
+static u64 gen7_get_user_profiling_ib(struct adreno_ringbuffer *rb,
+		struct kgsl_drawobj_cmd *cmdobj, u32 target_offset, u32 *cmds)
+{
+	u32 offset, *ib, dwords;
+
+	if (IS_ERR(rb->profile_desc))
+		return 0;
+
+	offset = rb->profile_index * (PROFILE_IB_DWORDS << 2);
+	ib = rb->profile_desc->hostptr + offset;
+	dwords = gen7_get_alwayson_counter(ib,
+		cmdobj->profiling_buffer_gpuaddr + target_offset);
+
+	cmds[0] = cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+	cmds[1] = lower_32_bits(rb->profile_desc->gpuaddr + offset);
+	cmds[2] = upper_32_bits(rb->profile_desc->gpuaddr + offset);
+	cmds[3] = dwords;
+
+	rb->profile_index = (rb->profile_index + 1) % PROFILE_IB_SLOTS;
+
+	return 4;
+}
+
+static int gen7_drawctxt_switch(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (rb->drawctxt_active == drawctxt)
+		return 0;
+
+	if (kgsl_context_detached(&drawctxt->base))
+		return -ENOENT;
+
+	if (!_kgsl_context_get(&drawctxt->base))
+		return -ENOENT;
+
+	ret = gen7_rb_context_switch(adreno_dev, rb, drawctxt);
+	if (ret) {
+		kgsl_context_put(&drawctxt->base);
+		return ret;
+	}
+
+	trace_adreno_drawctxt_switch(rb, drawctxt);
+
+	/* Release the current drawctxt as soon as the new one is switched */
+	adreno_put_drawctxt_on_timestamp(device, rb->drawctxt_active,
+		rb, rb->timestamp);
+
+	rb->drawctxt_active = drawctxt;
+	return 0;
+}
+
+
+#define GEN7_USER_PROFILE_IB(rb, cmdobj, cmds, field) \
+	gen7_get_user_profiling_ib((rb), (cmdobj), \
+		offsetof(struct kgsl_drawobj_profiling_buffer, field), \
+		(cmds))
+
+#define GEN7_KERNEL_PROFILE(dev, cmdobj, cmds, field) \
+	gen7_get_alwayson_counter((cmds), \
+		(dev)->profile_buffer->gpuaddr + \
+			ADRENO_DRAWOBJ_PROFILE_OFFSET((cmdobj)->profile_index, \
+				field))
+
+#define GEN7_KERNEL_PROFILE_CONTEXT(dev, cmdobj, cmds, field) \
+	gen7_get_alwayson_context((cmds), \
+		(dev)->profile_buffer->gpuaddr + \
+			ADRENO_DRAWOBJ_PROFILE_OFFSET((cmdobj)->profile_index, \
+				field))
+
+#define GEN7_COMMAND_DWORDS 60
+
+int gen7_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj, u32 flags,
+		struct adreno_submit_time *time)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	struct adreno_ringbuffer *rb = drawctxt->rb;
+	int ret = 0, numibs = 0, index = 0;
+	u32 *cmds;
+
+	/* Count the number of IBs (if we are not skipping) */
+	if (!IS_SKIP(flags)) {
+		struct list_head *tmp;
+
+		list_for_each(tmp, &cmdobj->cmdlist)
+			numibs++;
+	}
+
+	cmds = kvmalloc((GEN7_COMMAND_DWORDS + (numibs * 5)) << 2, GFP_KERNEL);
+	if (!cmds) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	cmds[index++] = cp_type7_packet(CP_NOP, 1);
+	cmds[index++] = START_IB_IDENTIFIER;
+
+	/* Kernel profiling: 8 dwords */
+	if (IS_KERNEL_PROFILE(flags)) {
+		index += GEN7_KERNEL_PROFILE(adreno_dev, cmdobj, &cmds[index],
+			started);
+		index += GEN7_KERNEL_PROFILE_CONTEXT(adreno_dev, cmdobj, &cmds[index],
+			ctx_start);
+	}
+
+	/* User profiling: 4 dwords */
+	if (IS_USER_PROFILE(flags))
+		index += GEN7_USER_PROFILE_IB(rb, cmdobj, &cmds[index],
+			gpu_ticks_submitted);
+
+	if (is_concurrent_binning(drawctxt)) {
+		cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+		cmds[index++] = CP_SET_THREAD_BOTH;
+	}
+	if (numibs) {
+		struct kgsl_memobj_node *ib;
+
+		cmds[index++] = cp_type7_packet(CP_SET_MARKER, 1);
+		cmds[index++] = 0x00d; /* IB1LIST start */
+
+		list_for_each_entry(ib, &cmdobj->cmdlist, node) {
+			if (ib->priv & MEMOBJ_SKIP ||
+				(ib->flags & KGSL_CMDLIST_CTXTSWITCH_PREAMBLE &&
+				 !IS_PREAMBLE(flags)))
+				cmds[index++] = cp_type7_packet(CP_NOP, 4);
+
+			cmds[index++] =
+				cp_type7_packet(CP_INDIRECT_BUFFER_PFE, 3);
+			cmds[index++] = lower_32_bits(ib->gpuaddr);
+			cmds[index++] = upper_32_bits(ib->gpuaddr);
+
+			/* Double check that IB_PRIV is never set */
+			cmds[index++] = (ib->size >> 2) & 0xfffff;
+		}
+
+		cmds[index++] = cp_type7_packet(CP_SET_MARKER, 1);
+		cmds[index++] = 0x00e; /* IB1LIST end */
+	}
+
+	if (is_concurrent_binning(drawctxt)) {
+		cmds[index++] = cp_type7_packet(CP_THREAD_CONTROL, 1);
+		cmds[index++] = CP_SET_THREAD_BR;
+	}
+	/* CCU invalidate depth */
+	cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 1);
+	cmds[index++] = 24;
+
+	/* CCU invalidate color */
+	cmds[index++] = cp_type7_packet(CP_EVENT_WRITE, 1);
+	cmds[index++] = 25;
+
+	/* 8 dwords */
+	if (IS_KERNEL_PROFILE(flags)) {
+		index += GEN7_KERNEL_PROFILE(adreno_dev, cmdobj, &cmds[index],
+			retired);
+		index += GEN7_KERNEL_PROFILE_CONTEXT(adreno_dev, cmdobj, &cmds[index],
+			ctx_end);
+	}
+
+	/* 4 dwords */
+	if (IS_USER_PROFILE(flags))
+		index += GEN7_USER_PROFILE_IB(rb, cmdobj, &cmds[index],
+			gpu_ticks_retired);
+
+	cmds[index++] = cp_type7_packet(CP_NOP, 1);
+	cmds[index++] = END_IB_IDENTIFIER;
+
+	ret = gen7_drawctxt_switch(adreno_dev, rb, drawctxt);
+
+	/*
+	 * In the unlikely event of an error in the drawctxt switch,
+	 * treat it like a hang
+	 */
+	if (ret) {
+		/*
+		 * It is "normal" to get a -ENOSPC or a -ENOENT. Don't log it,
+		 * the upper layers know how to handle it
+		 */
+		if (ret != -ENOSPC && ret != -ENOENT)
+			dev_err(device->dev,
+				"Unable to switch draw context: %d\n", ret);
+		goto done;
+	}
+
+	adreno_drawobj_set_constraint(device, drawobj);
+
+	ret = gen7_ringbuffer_addcmds(adreno_dev, drawctxt->rb, drawctxt,
+		flags, cmds, index, drawobj->timestamp, time);
+
+done:
+	trace_kgsl_issueibcmds(device, drawctxt->base.id, numibs,
+		drawobj->timestamp, drawobj->flags, ret, drawctxt->type);
+
+	kvfree(cmds);
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_rpmh.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_rpmh.c
@@ -0,0 +1,520 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/types.h>
+#include <soc/qcom/cmd-db.h>
+#include <soc/qcom/tcs.h>
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "kgsl_bus.h"
+#include "kgsl_device.h"
+
+struct rpmh_arc_vals {
+	u32 num;
+	const u16 *val;
+};
+
+struct bcm {
+	const char *name;
+	u32 buswidth;
+	u32 channels;
+	u32 unit;
+	u16 width;
+	u8 vcd;
+	bool fixed;
+};
+
+struct bcm_data {
+	__le32 unit;
+	__le16 width;
+	u8 vcd;
+	u8 reserved;
+};
+
+struct rpmh_bw_votes {
+	u32 wait_bitmask;
+	u32 num_cmds;
+	u32 *addrs;
+	u32 num_levels;
+	u32 **cmds;
+};
+
+#define ARC_VOTE_SET(pri, sec, vlvl) \
+	(FIELD_PREP(GENMASK(31, 16), vlvl) | \
+	 FIELD_PREP(GENMASK(15, 8), sec) | \
+	 FIELD_PREP(GENMASK(7, 0), pri))
+
+static int rpmh_arc_cmds(struct rpmh_arc_vals *arc, const char *res_id)
+{
+	size_t len = 0;
+
+	arc->val = cmd_db_read_aux_data(res_id, &len);
+
+	/*
+	 * cmd_db_read_aux_data() gives us a zero-padded table of
+	 * size len that contains the arc values. To determine the
+	 * number of arc values, we loop through the table and count
+	 * them until we get to the end of the buffer or hit the
+	 * zero padding.
+	 */
+	for (arc->num = 1; arc->num < (len >> 1); arc->num++) {
+		if (arc->val[arc->num - 1] != 0 && arc->val[arc->num] == 0)
+			break;
+	}
+
+	return 0;
+}
+
+static int setup_volt_dependency_tbl(u32 *votes,
+		struct rpmh_arc_vals *pri_rail, struct rpmh_arc_vals *sec_rail,
+		u16 *vlvl, unsigned int num_entries)
+{
+	int i, j, k;
+	uint16_t cur_vlvl;
+	bool found_match;
+
+	/* i tracks current KGSL GPU frequency table entry
+	 * j tracks secondary rail voltage table entry
+	 * k tracks primary rail voltage table entry
+	 */
+	for (i = 0; i < num_entries; i++) {
+		found_match = false;
+
+		/* Look for a primary rail voltage that matches a VLVL level */
+		for (k = 0; k < pri_rail->num; k++) {
+			if (pri_rail->val[k] >= vlvl[i]) {
+				cur_vlvl = pri_rail->val[k];
+				found_match = true;
+				break;
+			}
+		}
+
+		/* If we did not find a matching VLVL level then abort */
+		if (!found_match)
+			return -EINVAL;
+
+		/*
+		 * Look for a secondary rail index whose VLVL value
+		 * is greater than or equal to the VLVL value of the
+		 * corresponding index of the primary rail
+		 */
+		for (j = 0; j < sec_rail->num; j++) {
+			if (sec_rail->val[j] >= cur_vlvl ||
+					j + 1 == sec_rail->num)
+				break;
+		}
+
+		if (j == sec_rail->num)
+			j = 0;
+
+		votes[i] = ARC_VOTE_SET(k, j, cur_vlvl);
+	}
+
+	return 0;
+}
+
+/* Generate a set of bandwidth votes for the list of BCMs */
+static void tcs_cmd_data(struct bcm *bcms, int count,
+		u32 ab, u32 ib, u32 *data, u32 perfmode_vote, bool set_perfmode)
+{
+	int i;
+
+	for (i = 0; i < count; i++) {
+		bool valid = true;
+		bool commit = false;
+		u64 avg, peak, x, y;
+
+		if (i == count - 1 || bcms[i].vcd != bcms[i + 1].vcd)
+			commit = true;
+
+		if (bcms[i].fixed) {
+			if (!ab && !ib)
+				data[i] = BCM_TCS_CMD(commit, false, 0x0, 0x0);
+			else
+				data[i] = BCM_TCS_CMD(commit, true, 0x0,
+							set_perfmode ? perfmode_vote : 0x0);
+			continue;
+		}
+
+		/* Multiple the bandwidth by the width of the connection */
+		avg = ((u64) ab) * bcms[i].width;
+
+		/* And then divide by the total width */
+		do_div(avg, bcms[i].buswidth);
+
+		peak = ((u64) ib) * bcms[i].width;
+		do_div(peak, bcms[i].buswidth);
+
+		/* Input bandwidth value is in KBps */
+		x = avg * 1000ULL;
+		do_div(x, bcms[i].unit);
+
+		/* Input bandwidth value is in KBps */
+		y = peak * 1000ULL;
+		do_div(y, bcms[i].unit);
+
+		/*
+		 * If a bandwidth value was specified but the calculation ends
+		 * rounding down to zero, set a minimum level
+		 */
+		if (ab && x == 0)
+			x = 1;
+
+		if (ib && y == 0)
+			y = 1;
+
+		x = min_t(u64, x, BCM_TCS_CMD_VOTE_MASK);
+		y = min_t(u64, y, BCM_TCS_CMD_VOTE_MASK);
+
+		if (!x && !y)
+			valid = false;
+
+		data[i] = BCM_TCS_CMD(commit, valid, x, y);
+	}
+}
+
+static void free_rpmh_bw_votes(struct rpmh_bw_votes *votes)
+{
+	int i;
+
+	if (!votes)
+		return;
+
+	for (i = 0; votes->cmds && i < votes->num_levels; i++)
+		kfree(votes->cmds[i]);
+
+	kfree(votes->cmds);
+	kfree(votes->addrs);
+	kfree(votes);
+}
+
+/* Build the votes table from the specified bandwidth levels */
+static struct rpmh_bw_votes *build_rpmh_bw_votes(struct bcm *bcms,
+		int bcm_count, u32 *levels, int levels_count, u32 perfmode_vote, u32 perfmode_lvl)
+{
+	struct rpmh_bw_votes *votes;
+	bool set_perfmode;
+	int i;
+
+	votes = kzalloc(sizeof(*votes), GFP_KERNEL);
+	if (!votes)
+		return ERR_PTR(-ENOMEM);
+
+	votes->addrs = kcalloc(bcm_count, sizeof(*votes->cmds), GFP_KERNEL);
+	if (!votes->addrs) {
+		free_rpmh_bw_votes(votes);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	votes->cmds = kcalloc(levels_count, sizeof(*votes->cmds), GFP_KERNEL);
+	if (!votes->cmds) {
+		free_rpmh_bw_votes(votes);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	votes->num_cmds = bcm_count;
+	votes->num_levels = levels_count;
+
+	/* Get the cmd-db information for each BCM */
+	for (i = 0; i < bcm_count; i++) {
+		size_t l;
+		const struct bcm_data *data;
+
+		data = cmd_db_read_aux_data(bcms[i].name, &l);
+
+		votes->addrs[i] = cmd_db_read_addr(bcms[i].name);
+
+		bcms[i].unit = le32_to_cpu(data->unit);
+		bcms[i].width = le16_to_cpu(data->width);
+		bcms[i].vcd = data->vcd;
+	}
+
+	for (i = 0; i < bcm_count; i++) {
+		if (i == (bcm_count - 1) || bcms[i].vcd != bcms[i + 1].vcd)
+			votes->wait_bitmask |= (1 << i);
+	}
+
+	for (i = 0; i < levels_count; i++) {
+		votes->cmds[i] = kcalloc(bcm_count, sizeof(u32), GFP_KERNEL);
+		if (!votes->cmds[i]) {
+			free_rpmh_bw_votes(votes);
+			return ERR_PTR(-ENOMEM);
+		}
+
+		set_perfmode = (i >= perfmode_lvl) ? true : false;
+		tcs_cmd_data(bcms, bcm_count, levels[i], levels[i], votes->cmds[i],
+								perfmode_vote, set_perfmode);
+	}
+
+	return votes;
+}
+
+/*
+ * setup_gmu_arc_votes - Build the gmu voting table
+ * @gmu: Pointer to gmu device
+ * @pri_rail: Pointer to primary power rail vlvl table
+ * @sec_rail: Pointer to second/dependent power rail vlvl table
+ *
+ * This function initializes the cx votes for all gmu frequencies
+ * for gmu dcvs
+ */
+static int setup_cx_arc_votes(struct gen7_gmu_device *gmu,
+	struct rpmh_arc_vals *pri_rail, struct rpmh_arc_vals *sec_rail)
+{
+	/* Hardcoded values of GMU CX voltage levels */
+	u16 gmu_cx_vlvl[MAX_CX_LEVELS];
+	u32 cx_votes[MAX_CX_LEVELS];
+	struct gen7_dcvs_table *table = &gmu->dcvs_table;
+	u32 *freqs = gmu->freqs;
+	u32 *vlvls = gmu->vlvls;
+	int ret, i;
+
+	gmu_cx_vlvl[0] = 0;
+	gmu_cx_vlvl[1] = vlvls[0];
+	gmu_cx_vlvl[2] = vlvls[1];
+
+	table->gmu_level_num = 3;
+
+	table->cx_votes[0].freq = 0;
+	table->cx_votes[1].freq = freqs[0] / 1000;
+	table->cx_votes[2].freq = freqs[1] / 1000;
+
+	ret = setup_volt_dependency_tbl(cx_votes, pri_rail,
+			sec_rail, gmu_cx_vlvl, table->gmu_level_num);
+	if (!ret) {
+		for (i = 0; i < table->gmu_level_num; i++)
+			table->cx_votes[i].vote = cx_votes[i];
+	}
+
+	return ret;
+}
+
+static int to_cx_hlvl(struct rpmh_arc_vals *cx_rail, u32 vlvl, u32 *hlvl)
+{
+	u32 i;
+
+	/*
+	 * This means that the Gx level doesn't have a dependency on Cx level.
+	 * Return the same value to disable cx voting at GMU.
+	 */
+	if (vlvl == 0xffffffff) {
+		*hlvl = vlvl;
+		return 0;
+	}
+
+	for (i = 0; i < cx_rail->num; i++) {
+		if (cx_rail->val[i] >= vlvl) {
+			*hlvl = i;
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+/*
+ * setup_gx_arc_votes - Build the gpu dcvs voting table
+ * @hfi: Pointer to hfi device
+ * @pri_rail: Pointer to primary power rail vlvl table
+ * @sec_rail: Pointer to second/dependent power rail vlvl table
+ *
+ * This function initializes the gx votes for all gpu frequencies
+ * for gpu dcvs
+ */
+static int setup_gx_arc_votes(struct adreno_device *adreno_dev,
+	struct rpmh_arc_vals *pri_rail, struct rpmh_arc_vals *sec_rail,
+	struct rpmh_arc_vals *cx_rail)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct gen7_dcvs_table *table = &gmu->dcvs_table;
+	u32 index;
+	u16 vlvl_tbl[MAX_GX_LEVELS];
+	u32 gx_votes[MAX_GX_LEVELS];
+	int ret, i;
+
+	if (pwr->num_pwrlevels + 1 > ARRAY_SIZE(vlvl_tbl)) {
+		dev_err(device->dev,
+			"Defined more GPU DCVS levels than RPMh can support\n");
+		return -ERANGE;
+	}
+
+	/* Add the zero powerlevel for the perf table */
+	table->gpu_level_num = pwr->num_pwrlevels + 1;
+
+	memset(vlvl_tbl, 0, sizeof(vlvl_tbl));
+
+	table->gx_votes[0].freq = 0;
+	table->gx_votes[0].cx_vote = 0;
+	/* Disable cx vote in gmu dcvs table if it is not supported in DT */
+	if (pwr->pwrlevels[0].cx_level == 0xffffffff)
+		table->gx_votes[0].cx_vote = 0xffffffff;
+
+	/* GMU power levels are in ascending order */
+	for (index = 1, i = pwr->num_pwrlevels - 1; i >= 0; i--, index++) {
+		u32 cx_vlvl = pwr->pwrlevels[i].cx_level;
+
+		vlvl_tbl[index] = pwr->pwrlevels[i].voltage_level;
+		table->gx_votes[index].freq = pwr->pwrlevels[i].gpu_freq / 1000;
+
+		ret = to_cx_hlvl(cx_rail, cx_vlvl,
+				&table->gx_votes[index].cx_vote);
+		if (ret) {
+			dev_err(device->dev, "Unsupported cx corner: %u\n",
+					cx_vlvl);
+			return ret;
+		}
+	}
+
+	ret = setup_volt_dependency_tbl(gx_votes, pri_rail,
+			sec_rail, vlvl_tbl, table->gpu_level_num);
+	if (!ret) {
+		for (i = 0; i < table->gpu_level_num; i++)
+			table->gx_votes[i].vote = gx_votes[i];
+	}
+
+	return ret;
+
+}
+
+static int build_dcvs_table(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	struct rpmh_arc_vals gx_arc, cx_arc, mx_arc;
+	int ret;
+
+	ret = rpmh_arc_cmds(&gx_arc, "gfx.lvl");
+	if (ret)
+		return ret;
+
+	ret = rpmh_arc_cmds(&cx_arc, "cx.lvl");
+	if (ret)
+		return ret;
+
+	ret = rpmh_arc_cmds(&mx_arc, "mx.lvl");
+	if (ret)
+		return ret;
+
+	ret = setup_cx_arc_votes(gmu, &cx_arc, &mx_arc);
+	if (ret)
+		return ret;
+
+	return setup_gx_arc_votes(adreno_dev, &gx_arc, &mx_arc, &cx_arc);
+}
+
+/*
+ * List of Bus Control Modules (BCMs) that need to be configured for the GPU
+ * to access DDR. For each bus level we will generate a vote each BC
+ */
+static struct bcm gen7_ddr_bcms[] = {
+	{ .name = "SH0", .buswidth = 16 },
+	{ .name = "MC0", .buswidth = 4 },
+	{ .name = "ACV", .fixed = true },
+};
+
+/* Same as above, but for the CNOC BCMs */
+static struct bcm gen7_cnoc_bcms[] = {
+	{ .name = "CN0", .buswidth = 4 },
+};
+
+static void build_bw_table_cmd(struct hfi_bwtable_cmd *cmd,
+		struct rpmh_bw_votes *ddr, struct rpmh_bw_votes *cnoc)
+{
+	u32 i, j;
+
+	cmd->bw_level_num = ddr->num_levels;
+	cmd->ddr_cmds_num = ddr->num_cmds;
+	cmd->ddr_wait_bitmask = ddr->wait_bitmask;
+
+	for (i = 0; i < ddr->num_cmds; i++)
+		cmd->ddr_cmd_addrs[i] = ddr->addrs[i];
+
+	for (i = 0; i < ddr->num_levels; i++)
+		for (j = 0; j < ddr->num_cmds; j++)
+			cmd->ddr_cmd_data[i][j] = (u32) ddr->cmds[i][j];
+
+	if (!cnoc)
+		return;
+
+	cmd->cnoc_cmds_num = cnoc->num_cmds;
+		cmd->cnoc_wait_bitmask = cnoc->wait_bitmask;
+
+	for (i = 0; i < cnoc->num_cmds; i++)
+		cmd->cnoc_cmd_addrs[i] = cnoc->addrs[i];
+
+	for (i = 0; i < cnoc->num_levels; i++)
+		for (j = 0; j < cnoc->num_cmds; j++)
+			cmd->cnoc_cmd_data[i][j] = (u32) cnoc->cmds[i][j];
+}
+
+#define GEN7_9_0_DDR_NOM_IDX 6
+
+static int build_bw_table(struct adreno_device *adreno_dev)
+{
+	struct gen7_gmu_device *gmu = to_gen7_gmu(adreno_dev);
+	const struct adreno_gen7_core *gen7_core = to_gen7_core(adreno_dev);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct rpmh_bw_votes *ddr, *cnoc = NULL;
+	u32 perfmode_vote = gen7_core->acv_perfmode_vote;
+	u32 perfmode_lvl = adreno_is_gen7_9_x(adreno_dev) ? GEN7_9_0_DDR_NOM_IDX : 1;
+	u32 *cnoc_table;
+	u32 count;
+	int ret;
+
+	/* If perfmode vote is not defined, use default value as 0x8 */
+	if (!perfmode_vote)
+		perfmode_vote = BIT(3);
+
+	ddr = build_rpmh_bw_votes(gen7_ddr_bcms, ARRAY_SIZE(gen7_ddr_bcms),
+		pwr->ddr_table, pwr->ddr_table_count, perfmode_vote, perfmode_lvl);
+	if (IS_ERR(ddr))
+		return PTR_ERR(ddr);
+
+	cnoc_table = kgsl_bus_get_table(device->pdev, "qcom,bus-table-cnoc",
+		&count);
+
+	if (count > 0)
+		cnoc = build_rpmh_bw_votes(gen7_cnoc_bcms,
+			ARRAY_SIZE(gen7_cnoc_bcms), cnoc_table, count, 0, 0);
+
+	kfree(cnoc_table);
+
+	if (IS_ERR(cnoc)) {
+		free_rpmh_bw_votes(ddr);
+		return PTR_ERR(cnoc);
+	}
+
+	ret = CMD_MSG_HDR(gmu->hfi.bw_table, H2F_MSG_BW_VOTE_TBL);
+	if (ret)
+		return ret;
+
+	build_bw_table_cmd(&gmu->hfi.bw_table, ddr, cnoc);
+
+	free_rpmh_bw_votes(ddr);
+	free_rpmh_bw_votes(cnoc);
+
+	return 0;
+}
+
+int gen7_build_rpmh_tables(struct adreno_device *adreno_dev)
+{
+	int ret;
+
+	ret = build_dcvs_table(adreno_dev);
+	if (ret) {
+		dev_err(adreno_dev->dev.dev, "Failed to build dcvs table\n");
+		return ret;
+	}
+
+	ret = build_bw_table(adreno_dev);
+	if (ret)
+		dev_err(adreno_dev->dev.dev, "Failed to build bw table\n");
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_snapshot.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_snapshot.c
@@ -0,0 +1,1781 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "adreno.h"
+#include "adreno_snapshot.h"
+#include "adreno_gen7_0_0_snapshot.h"
+#include "adreno_gen7_2_0_snapshot.h"
+#include "adreno_gen7_9_0_snapshot.h"
+
+static struct kgsl_memdesc *gen7_capturescript;
+static struct kgsl_memdesc *gen7_crashdump_registers;
+static u32 *gen7_cd_reg_end;
+static const struct gen7_snapshot_block_list *gen7_snapshot_block_list;
+static bool gen7_crashdump_timedout;
+
+/* Starting kernel virtual address for QDSS TMC register block */
+static void __iomem *tmc_virt;
+
+const struct gen7_snapshot_block_list gen7_0_0_snapshot_block_list = {
+	.pre_crashdumper_regs = gen7_0_0_pre_crashdumper_gpu_registers,
+	.debugbus_blocks = gen7_0_0_debugbus_blocks,
+	.debugbus_blocks_len = ARRAY_SIZE(gen7_0_0_debugbus_blocks),
+	.gbif_debugbus_blocks = gen7_gbif_debugbus_blocks,
+	.gbif_debugbus_blocks_len = ARRAY_SIZE(gen7_gbif_debugbus_blocks),
+	.cx_debugbus_blocks = gen7_cx_dbgc_debugbus_blocks,
+	.cx_debugbus_blocks_len = ARRAY_SIZE(gen7_cx_dbgc_debugbus_blocks),
+	.external_core_regs = gen7_0_0_external_core_regs,
+	.num_external_core_regs = ARRAY_SIZE(gen7_0_0_external_core_regs),
+	.gmu_regs = gen7_0_0_gmu_registers,
+	.gmu_gx_regs = gen7_0_0_gmugx_registers,
+	.rscc_regs = gen7_0_0_rscc_registers,
+	.reg_list = gen7_0_0_reg_list,
+	.cx_misc_regs = gen7_0_0_cx_misc_registers,
+	.shader_blocks = gen7_0_0_shader_blocks,
+	.num_shader_blocks = ARRAY_SIZE(gen7_0_0_shader_blocks),
+	.clusters = gen7_0_0_clusters,
+	.num_clusters = ARRAY_SIZE(gen7_0_0_clusters),
+	.sptp_clusters = gen7_0_0_sptp_clusters,
+	.num_sptp_clusters = ARRAY_SIZE(gen7_0_0_sptp_clusters),
+	.post_crashdumper_regs = gen7_0_0_post_crashdumper_registers,
+	.index_registers = gen7_cp_indexed_reg_list,
+	.index_registers_len = ARRAY_SIZE(gen7_cp_indexed_reg_list),
+};
+
+const struct gen7_snapshot_block_list gen7_2_0_snapshot_block_list = {
+	.pre_crashdumper_regs = gen7_0_0_pre_crashdumper_gpu_registers,
+	.debugbus_blocks = gen7_2_0_debugbus_blocks,
+	.debugbus_blocks_len = ARRAY_SIZE(gen7_2_0_debugbus_blocks),
+	.gbif_debugbus_blocks = gen7_gbif_debugbus_blocks,
+	.gbif_debugbus_blocks_len = ARRAY_SIZE(gen7_gbif_debugbus_blocks),
+	.cx_debugbus_blocks = gen7_cx_dbgc_debugbus_blocks,
+	.cx_debugbus_blocks_len = ARRAY_SIZE(gen7_cx_dbgc_debugbus_blocks),
+	.external_core_regs = gen7_2_0_external_core_regs,
+	.num_external_core_regs = ARRAY_SIZE(gen7_2_0_external_core_regs),
+	.gmu_regs = gen7_2_0_gmu_registers,
+	.gmu_gx_regs = gen7_2_0_gmugx_registers,
+	.rscc_regs = gen7_2_0_rscc_registers,
+	.reg_list = gen7_2_0_reg_list,
+	.cx_misc_regs = gen7_0_0_cx_misc_registers,
+	.shader_blocks = gen7_2_0_shader_blocks,
+	.num_shader_blocks = ARRAY_SIZE(gen7_2_0_shader_blocks),
+	.clusters = gen7_2_0_clusters,
+	.num_clusters = ARRAY_SIZE(gen7_2_0_clusters),
+	.sptp_clusters = gen7_2_0_sptp_clusters,
+	.num_sptp_clusters = ARRAY_SIZE(gen7_2_0_sptp_clusters),
+	.post_crashdumper_regs = gen7_0_0_post_crashdumper_registers,
+	.index_registers = gen7_cp_indexed_reg_list,
+	.index_registers_len = ARRAY_SIZE(gen7_cp_indexed_reg_list),
+};
+
+const struct gen7_snapshot_block_list gen7_9_0_snapshot_block_list = {
+	.pre_crashdumper_regs = gen7_9_0_pre_crashdumper_gpu_registers,
+	.debugbus_blocks = gen7_9_0_debugbus_blocks,
+	.debugbus_blocks_len = ARRAY_SIZE(gen7_9_0_debugbus_blocks),
+	.gbif_debugbus_blocks = gen7_9_0_gbif_debugbus_blocks,
+	.gbif_debugbus_blocks_len = ARRAY_SIZE(gen7_9_0_gbif_debugbus_blocks),
+	.cx_debugbus_blocks = gen7_9_0_cx_debugbus_blocks,
+	.cx_debugbus_blocks_len = ARRAY_SIZE(gen7_9_0_cx_debugbus_blocks),
+	.external_core_regs = gen7_9_0_external_core_regs,
+	.num_external_core_regs = ARRAY_SIZE(gen7_9_0_external_core_regs),
+	.gmu_regs = gen7_9_0_gmu_registers,
+	.gmu_gx_regs = gen7_9_0_gmugx_registers,
+	.rscc_regs = gen7_9_0_rscc_registers,
+	.reg_list = gen7_9_0_reg_list,
+	.cx_misc_regs = gen7_9_0_cx_misc_registers,
+	.shader_blocks = gen7_9_0_shader_blocks,
+	.num_shader_blocks = ARRAY_SIZE(gen7_9_0_shader_blocks),
+	.clusters = gen7_9_0_clusters,
+	.num_clusters = ARRAY_SIZE(gen7_9_0_clusters),
+	.sptp_clusters = gen7_9_0_sptp_clusters,
+	.num_sptp_clusters = ARRAY_SIZE(gen7_9_0_sptp_clusters),
+	.post_crashdumper_regs = gen7_0_0_post_crashdumper_registers,
+	.index_registers = gen7_9_0_cp_indexed_reg_list,
+	.index_registers_len = ARRAY_SIZE(gen7_9_0_cp_indexed_reg_list),
+};
+
+#define GEN7_SP_READ_SEL_VAL(_location, _pipe, _statetype, _usptp, _sptp) \
+				(FIELD_PREP(GENMASK(19, 18), _location) | \
+				 FIELD_PREP(GENMASK(17, 16), _pipe) | \
+				 FIELD_PREP(GENMASK(15, 8), _statetype) | \
+				 FIELD_PREP(GENMASK(7, 4), _usptp) | \
+				 FIELD_PREP(GENMASK(3, 0), _sptp))
+
+#define GEN7_CP_APERTURE_REG_VAL(_pipe, _cluster, _context) \
+			(FIELD_PREP(GENMASK(13, 12), _pipe) | \
+			 FIELD_PREP(GENMASK(10, 8), _cluster) | \
+			 FIELD_PREP(GENMASK(5, 4), _context))
+
+#define GEN7_DEBUGBUS_SECTION_SIZE (sizeof(struct kgsl_snapshot_debugbus) \
+			+ (GEN7_DEBUGBUS_BLOCK_SIZE << 3))
+
+#define CD_REG_END 0xaaaaaaaa
+
+static int CD_WRITE(u64 *ptr, u32 offset, u64 val)
+{
+	ptr[0] = val;
+	ptr[1] = FIELD_PREP(GENMASK(63, 44), offset) | BIT(21) | BIT(0);
+
+	return 2;
+}
+
+static int CD_READ(u64 *ptr, u32 offset, u32 size, u64 target)
+{
+	ptr[0] = target;
+	ptr[1] = FIELD_PREP(GENMASK(63, 44), offset) | size;
+
+	return 2;
+}
+
+static void CD_FINISH(u64 *ptr, u32 offset)
+{
+	gen7_cd_reg_end = gen7_crashdump_registers->hostptr + offset;
+	*gen7_cd_reg_end = CD_REG_END;
+	ptr[0] = gen7_crashdump_registers->gpuaddr + offset;
+	ptr[1] = FIELD_PREP(GENMASK(63, 44), GEN7_CP_CRASH_DUMP_STATUS) | BIT(0);
+	ptr[2] = 0;
+	ptr[3] = 0;
+}
+
+static bool CD_SCRIPT_CHECK(struct kgsl_device *device)
+{
+	return (gen7_is_smmu_stalled(device) || (!device->snapshot_crashdumper) ||
+		IS_ERR_OR_NULL(gen7_capturescript) ||
+		IS_ERR_OR_NULL(gen7_crashdump_registers) ||
+		gen7_crashdump_timedout);
+}
+
+static bool _gen7_do_crashdump(struct kgsl_device *device)
+{
+	unsigned int reg = 0;
+	ktime_t timeout;
+
+	kgsl_regwrite(device, GEN7_CP_CRASH_SCRIPT_BASE_LO,
+			lower_32_bits(gen7_capturescript->gpuaddr));
+	kgsl_regwrite(device, GEN7_CP_CRASH_SCRIPT_BASE_HI,
+			upper_32_bits(gen7_capturescript->gpuaddr));
+	kgsl_regwrite(device, GEN7_CP_CRASH_DUMP_CNTL, 1);
+
+	timeout = ktime_add_ms(ktime_get(), CP_CRASH_DUMPER_TIMEOUT);
+
+	if (!device->snapshot_atomic)
+		might_sleep();
+	for (;;) {
+		/* make sure we're reading the latest value */
+		rmb();
+		if ((*gen7_cd_reg_end) != CD_REG_END)
+			break;
+		if (ktime_compare(ktime_get(), timeout) > 0)
+			break;
+		/* Wait 1msec to avoid unnecessary looping */
+		if (!device->snapshot_atomic)
+			usleep_range(100, 1000);
+	}
+
+	kgsl_regread(device, GEN7_CP_CRASH_DUMP_STATUS, &reg);
+
+	/*
+	 * Writing to the GEN7_CP_CRASH_DUMP_CNTL also resets the
+	 * GEN7_CP_CRASH_DUMP_STATUS. Make sure the read above is
+	 * complete before we change the value
+	 */
+	rmb();
+
+	kgsl_regwrite(device, GEN7_CP_CRASH_DUMP_CNTL, 0);
+
+	if (WARN(!(reg & 0x2), "Crashdumper timed out\n")) {
+		/*
+		 * Gen7 crash dumper script is broken down into multiple chunks
+		 * and script will be invoked multiple times to capture snapshot
+		 * of different sections of GPU. If crashdumper fails once, it is
+		 * highly likely it will fail subsequently as well. Hence update
+		 * gen7_crashdump_timedout variable to avoid running crashdumper
+		 * after it fails once.
+		 */
+		gen7_crashdump_timedout = true;
+		return false;
+	}
+
+	return true;
+}
+
+static size_t gen7_legacy_snapshot_registers(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct gen7_reg_list *regs = priv;
+
+	if (regs->sel)
+		kgsl_regwrite(device, regs->sel->host_reg, regs->sel->val);
+
+	return adreno_snapshot_registers_v2(device, buf, remain, (void *)regs->regs);
+}
+
+static size_t gen7_snapshot_registers(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct gen7_reg_list *regs = (struct gen7_reg_list *)priv;
+	const u32 *ptr = regs->regs;
+	unsigned int *data = (unsigned int *)buf;
+	unsigned int *src;
+	unsigned int size = adreno_snapshot_regs_count(ptr) * 4;
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	src = gen7_crashdump_registers->hostptr + regs->offset;
+
+	for (ptr = regs->regs; ptr[0] != UINT_MAX; ptr += 2) {
+		unsigned int cnt = REG_COUNT(ptr);
+
+		if (cnt == 1)
+			*data++ = BIT(31) | ptr[0];
+		else {
+			*data++ = ptr[0];
+			*data++ = cnt;
+		}
+		memcpy(data, src, cnt << 2);
+		data += cnt;
+		src += cnt;
+	}
+
+	/* Return the size of the section */
+	return size;
+}
+
+static size_t gen7_legacy_snapshot_shader(struct kgsl_device *device,
+				u8 *buf, size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_shader_v2 *header =
+		(struct kgsl_snapshot_shader_v2 *) buf;
+	struct gen7_shader_block_info *info = (struct gen7_shader_block_info *) priv;
+	struct gen7_shader_block *block = info->block;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int read_sel;
+	int i;
+
+	if (remain < (sizeof(*header) + (block->size << 2))) {
+		SNAPSHOT_ERR_NOMEM(device, "SHADER MEMORY");
+		return 0;
+	}
+
+	/*
+	 * If crashdumper times out, accessing some readback states from
+	 * AHB path might fail. Hence, skip SP_INST_TAG and SP_INST_DATA*
+	 * state types during snapshot dump in legacy flow.
+	 */
+	if (adreno_is_gen7_0_0(adreno_dev) || adreno_is_gen7_0_1(adreno_dev) ||
+		adreno_is_gen7_4_0(adreno_dev)) {
+		if (block->statetype == SP_INST_TAG ||
+			block->statetype == SP_INST_DATA ||
+			block->statetype == SP_INST_DATA_1 ||
+			block->statetype == SP_INST_DATA_2)
+			return 0;
+	}
+
+	header->type = block->statetype;
+	header->index = info->sp_id;
+	header->size = block->size;
+	header->usptp = info->usptp;
+	header->location = block->location;
+	header->pipe_id = block->pipeid;
+
+	read_sel = GEN7_SP_READ_SEL_VAL(block->location, block->pipeid,
+				block->statetype, info->usptp, info->sp_id);
+
+	kgsl_regwrite(device, GEN7_SP_READ_SEL, read_sel);
+
+	/*
+	 * An explicit barrier is needed so that reads do not happen before
+	 * the register write.
+	 */
+	mb();
+
+	for (i = 0; i < block->size; i++)
+		data[i] = kgsl_regmap_read(&device->regmap, GEN7_SP_AHB_READ_APERTURE + i);
+
+	return (sizeof(*header) + (block->size << 2));
+}
+
+static size_t gen7_snapshot_shader_memory(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_shader_v2 *header =
+		(struct kgsl_snapshot_shader_v2 *) buf;
+	struct gen7_shader_block_info *info = (struct gen7_shader_block_info *) priv;
+	struct gen7_shader_block *block = info->block;
+	unsigned int *data = (unsigned int *) (buf + sizeof(*header));
+
+	if (remain < (sizeof(*header) + (block->size << 2))) {
+		SNAPSHOT_ERR_NOMEM(device, "SHADER MEMORY");
+		return 0;
+	}
+
+	header->type = block->statetype;
+	header->index = info->sp_id;
+	header->size = block->size;
+	header->usptp = info->usptp;
+	header->location = block->location;
+	header->pipe_id = block->pipeid;
+
+	memcpy(data, gen7_crashdump_registers->hostptr + info->offset,
+			(block->size << 2));
+
+	return (sizeof(*header) + (block->size << 2));
+}
+
+static void qdss_regwrite(void __iomem *regbase, u32 offsetbytes, u32 value)
+{
+	void __iomem *reg;
+
+	reg = regbase + offsetbytes;
+
+	 /* Ensure previous write is committed */
+	wmb();
+	__raw_writel(value, reg);
+}
+
+static u32 qdss_regread(void __iomem *regbase, u32 offsetbytes)
+{
+	void __iomem *reg;
+	u32 val;
+
+	reg = regbase + offsetbytes;
+	val = __raw_readl(reg);
+
+	/* Make sure memory is updated before next access */
+	rmb();
+	return val;
+}
+
+static size_t gen7_snapshot_trace_buffer_gfx_trace(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	u32 start_idx = 0, status = 0, count = 0, wrap_count = 0, write_ptr = 0;
+	struct kgsl_snapshot_trace_buffer *header =
+			(struct kgsl_snapshot_trace_buffer *) buf;
+	u32 *data = (u32 *)(buf + sizeof(*header));
+	struct gen7_trace_buffer_info* info =
+				(struct gen7_trace_buffer_info *) priv;
+
+	if (remain < SZ_2K + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "TRACE 2K BUFFER");
+		return 0;
+	}
+
+	memcpy(header->ping_blk, info->ping_blk, sizeof(header->ping_blk));
+	memcpy(header->ping_idx, info->ping_idx, sizeof(header->ping_idx));
+	header->granularity = info->granularity;
+	header->segment = info->segment;
+	header->dbgc_ctrl = info->dbgc_ctrl;
+
+	/* Read the status of trace buffer to determine if it's full or empty */
+	kgsl_regread(device, GEN7_DBGC_TRACE_BUFFER_STATUS, &status);
+
+	/*
+	 * wrap_count and write ptr are part of status.
+	 * if status is 0 => wrap_count = 0 and write ptr = 0 buffer is empty.
+	 * if status is non zero and wrap count is 0 read partial buffer.
+	 * if wrap count in non zero read entier 2k buffer.
+	 * Always read the oldest data available.
+	 */
+
+	/* if status is 0 then buffer is empty */
+	if (!status) {
+		header->size = 0;
+		return sizeof(*header);
+	}
+
+	/* Number of times the circular buffer has wrapped around */
+	wrap_count = FIELD_GET(GENMASK(31,12), status);
+	write_ptr = FIELD_GET(GENMASK(8,0), status);
+
+	/* Read partial buffer starting from 0 */
+	if (!wrap_count) {
+		/* No of dwords to read : (write ptr - 0) of indexed register */
+		count = write_ptr;
+		header->size = count << 2;
+		start_idx = 0;
+	} else {
+		/* Read entire 2k buffer starting from write ptr */
+		start_idx = write_ptr + 1;
+		count = SZ_512;
+		header->size = SZ_2K;
+	}
+
+	kgsl_regmap_read_indexed_interleaved(&device->regmap,
+		GEN7_DBGC_DBG_TRACE_BUFFER_RD_ADDR, GEN7_DBGC_DBG_TRACE_BUFFER_RD_DATA, data,
+			start_idx, count);
+
+	return (sizeof(*header) + header->size);
+}
+
+static size_t gen7_snapshot_trace_buffer_etb(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	u32 read_ptr, count, write_ptr, val, idx = 0;
+	struct kgsl_snapshot_trace_buffer *header = (struct kgsl_snapshot_trace_buffer *) buf;
+	u32 *data = (u32 *)(buf + sizeof(*header));
+	struct gen7_trace_buffer_info* info = (struct gen7_trace_buffer_info *) priv;
+
+	/* Unlock ETB buffer */
+	qdss_regwrite(tmc_virt, QDSS_AOSS_APB_TMC_LAR, 0xC5ACCE55);
+
+	/* Make sure unlock goes through before proceeding further */
+	mb();
+
+	/* Flush the QDSS pipeline to ensure completion of pending write to buffer */
+	val = qdss_regread(tmc_virt, QDSS_AOSS_APB_TMC_FFCR);
+	qdss_regwrite(tmc_virt, QDSS_AOSS_APB_TMC_FFCR, val | 0x40);
+
+	/* Make sure pipeline is flushed before we get read and write pointers */
+	mb();
+
+	/* Disable ETB */
+	qdss_regwrite(tmc_virt, QDSS_AOSS_APB_TMC_CTRL, 0);
+
+	/* Set to circular mode */
+	qdss_regwrite(tmc_virt, QDSS_AOSS_APB_TMC_MODE, 0);
+
+	/* Ensure buffer is set to circular mode before accessing it */
+	mb();
+
+	/* Size of buffer is specified in register TMC_RSZ */
+	count = qdss_regread(tmc_virt, QDSS_AOSS_APB_TMC_RSZ) << 2;
+	read_ptr = qdss_regread(tmc_virt, QDSS_AOSS_APB_TMC_RRP);
+	write_ptr = qdss_regread(tmc_virt, QDSS_AOSS_APB_TMC_RWP);
+
+	/* ETB buffer if full read_ptr will be equal to write_ptr else write_ptr leads read_ptr */
+	count = (read_ptr == write_ptr) ? count : (write_ptr - read_ptr);
+
+	if (remain < count + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "ETB BUFFER");
+		return 0;
+	}
+
+	/*
+	 * Read pointer is 4 byte aligned and write pointer is 2 byte aligned
+	 * We read 4 bytes of data in one iteration below so aligin it down
+	 * to 4 bytes.
+	 */
+	count = ALIGN_DOWN(count, 4);
+
+	header->size = count;
+	header->dbgc_ctrl = info->dbgc_ctrl;
+	memcpy(header->ping_blk, info->ping_blk, sizeof(header->ping_blk));
+	memcpy(header->ping_idx, info->ping_idx, sizeof(header->ping_idx));
+	header->granularity = info->granularity;
+	header->segment = info->segment;
+
+	while (count != 0) {
+		/* This indexed register auto increments index as we read */
+		data[idx++] = qdss_regread(tmc_virt, QDSS_AOSS_APB_TMC_RRD);
+		count = count - 4;
+	}
+
+	return (sizeof(*header) + header->size);
+}
+
+static void gen7_snapshot_trace_buffer(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	u32 val_tmc_ctrl = 0, val_etr_ctrl = 0, val_etr1_ctrl = 0;
+	u32 i = 0, sel_gx = 0, sel_cx = 0, val_gx = 0, val_cx = 0, val = 0;
+	struct gen7_trace_buffer_info info;
+	struct resource *res1, *res2;
+	struct clk *clk;
+	int ret;
+	void __iomem *etr_virt;
+
+	/*
+	 * Data can be collected from CX_DBGC or DBGC and it's mutually exclusive.
+	 * Read the necessary select registers and determine the source of data.
+	 * This loop reads SEL_A to SEL_D of both CX_DBGC and DBGC and accordingly
+	 * updates the header information of trace buffer section.
+	 */
+	for (i = 0; i < TRACE_BUF_NUM_SIG; i++) {
+		kgsl_regread(device, GEN7_DBGC_CFG_DBGBUS_SEL_A + i, &sel_gx);
+		kgsl_regread(device, GEN7_CX_DBGC_CFG_DBGBUS_SEL_A + i, &sel_cx);
+		val_gx |= sel_gx;
+		val_cx |= sel_cx;
+		info.ping_idx[i] = FIELD_GET(GENMASK(7, 0), (sel_gx | sel_cx));
+		info.ping_blk[i] = FIELD_GET(GENMASK(24, 16), (sel_gx | sel_cx));
+	}
+
+	/* Zero the header if not programmed to export any buffer */
+	if (!val_gx && !val_cx) {
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_TRACE_BUFFER,
+			snapshot, NULL, &info);
+		return;
+	}
+
+	/* Enable APB clock to read data from trace buffer */
+	clk = clk_get(&device->pdev->dev, "apb_pclk");
+
+	if (IS_ERR(clk)) {
+		dev_err(device->dev, "Unable to get QDSS clock\n");
+		return;
+	}
+
+	ret = clk_prepare_enable(clk);
+
+	if (ret) {
+		dev_err(device->dev, "QDSS Clock enable error: %d\n", ret);
+		clk_put(clk);
+		return;
+	}
+
+	res1 = platform_get_resource_byname(device->pdev, IORESOURCE_MEM, "qdss_etr");
+	res2 = platform_get_resource_byname(device->pdev, IORESOURCE_MEM, "qdss_tmc");
+
+	if (!res1 || !res2)
+		goto err_clk_put;
+
+	etr_virt = ioremap(res1->start, resource_size(res1));
+	tmc_virt = ioremap(res2->start, resource_size(res2));
+
+	if (!etr_virt || !tmc_virt)
+		goto err_unmap;
+
+	/*
+	 * Update header information based on source of data, read necessary CNTLT registers
+	 * for granularity and segment information.
+	 */
+	if (val_gx) {
+		info.dbgc_ctrl = GX_DBGC;
+		kgsl_regread(device, GEN7_DBGC_CFG_DBGBUS_CNTLT, &val);
+	} else {
+		info.dbgc_ctrl = CX_DBGC;
+		kgsl_regread(device, GEN7_CX_DBGC_CFG_DBGBUS_CNTLT, &val);
+	}
+
+	info.granularity = FIELD_GET(GENMASK(14,12), val);
+	info.segment = FIELD_GET(GENMASK(31,28), val);
+
+	val_tmc_ctrl = qdss_regread(tmc_virt, QDSS_AOSS_APB_TMC_CTRL);
+
+	/*
+	 * Incase TMC CTRL is 0 and val_cx is non zero dump empty buffer.
+	 * Incase TMC CTRL is 0 and val_gx is non zero dump 2k gfx buffer.
+	 * 2k buffer is not present for CX blocks.
+	 * Incase both ETR's CTRL is 0 Dump ETB QDSS buffer and disable QDSS.
+	 * Incase either ETR's CTRL is 1 Disable QDSS dumping ETB buffer to DDR.
+	 */
+	if (!val_tmc_ctrl) {
+		if (val_gx)
+			kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_TRACE_BUFFER,
+				snapshot, gen7_snapshot_trace_buffer_gfx_trace, &info);
+		else
+			kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_TRACE_BUFFER,
+					snapshot, NULL, &info);
+	} else {
+		val_etr_ctrl = qdss_regread(etr_virt, QDSS_AOSS_APB_ETR_CTRL);
+		val_etr1_ctrl = qdss_regread(etr_virt, QDSS_AOSS_APB_ETR1_CTRL);
+		if (!val_etr_ctrl && !val_etr1_ctrl)
+			kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_TRACE_BUFFER,
+				snapshot, gen7_snapshot_trace_buffer_etb, &info);
+		qdss_regwrite(tmc_virt, QDSS_AOSS_APB_TMC_CTRL, 0);
+	}
+
+err_unmap:
+	iounmap(tmc_virt);
+	iounmap(etr_virt);
+
+err_clk_put:
+	clk_disable_unprepare(clk);
+	clk_put(clk);
+}
+
+static void gen7_snapshot_shader(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	unsigned int i;
+	struct gen7_shader_block_info info;
+	u64 *ptr;
+	u32 offset = 0;
+	struct gen7_shader_block *shader_blocks = gen7_snapshot_block_list->shader_blocks;
+	size_t num_shader_blocks = gen7_snapshot_block_list->num_shader_blocks;
+	unsigned int sp;
+	unsigned int usptp;
+	size_t (*func)(struct kgsl_device *device, u8 *buf, size_t remain,
+		void *priv) = gen7_legacy_snapshot_shader;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	if (adreno_is_gen7_0_x_family(adreno_dev))
+		kgsl_regrmw(device, GEN7_SP_DBG_CNTL, GENMASK(1, 0), 3);
+
+	if (CD_SCRIPT_CHECK(device)) {
+		for (i = 0; i < num_shader_blocks; i++) {
+			struct gen7_shader_block *block = &shader_blocks[i];
+
+			for (sp = 0; sp < block->num_sps; sp++) {
+				for (usptp = 0; usptp < block->num_usptps; usptp++) {
+					info.block = block;
+					info.sp_id = sp;
+					info.usptp = usptp;
+					info.offset = offset;
+					offset += block->size << 2;
+
+					/* Shader working/shadow memory */
+					kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_SHADER_V2,
+						snapshot, func, &info);
+				}
+			}
+		}
+
+		goto done;
+	}
+
+	for (i = 0; i < num_shader_blocks; i++) {
+		struct gen7_shader_block *block = &shader_blocks[i];
+
+		/* Build the crash script */
+		ptr = gen7_capturescript->hostptr;
+		offset = 0;
+
+		for (sp = 0; sp < block->num_sps; sp++) {
+			for (usptp = 0; usptp < block->num_usptps; usptp++) {
+				/* Program the aperture */
+				ptr += CD_WRITE(ptr, GEN7_SP_READ_SEL,
+					GEN7_SP_READ_SEL_VAL(block->location, block->pipeid,
+						block->statetype, usptp, sp));
+
+				/* Read all the data in one chunk */
+				ptr += CD_READ(ptr, GEN7_SP_AHB_READ_APERTURE, block->size,
+					gen7_crashdump_registers->gpuaddr + offset);
+				offset += block->size << 2;
+			}
+		}
+		/* Marker for end of script */
+		CD_FINISH(ptr, offset);
+
+		/* Try to run the crash dumper */
+		func = gen7_legacy_snapshot_shader;
+		if (_gen7_do_crashdump(device))
+			func = gen7_snapshot_shader_memory;
+
+		offset = 0;
+		for (sp = 0; sp < block->num_sps; sp++) {
+			for (usptp = 0; usptp < block->num_usptps; usptp++) {
+				info.block = block;
+				info.sp_id = sp;
+				info.usptp = usptp;
+				info.offset = offset;
+				offset += block->size << 2;
+
+				/* Shader working/shadow memory */
+				kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_SHADER_V2,
+					snapshot, func, &info);
+			}
+		}
+	}
+
+done:
+	if (adreno_is_gen7_0_x_family(adreno_dev))
+		kgsl_regrmw(device, GEN7_SP_DBG_CNTL, GENMASK(1, 0), 0x0);
+}
+
+static void gen7_snapshot_mempool(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	/* set CP_CHICKEN_DBG[StabilizeMVC] to stabilize it while dumping */
+	kgsl_regrmw(device, GEN7_CP_CHICKEN_DBG, 0x4, 0x4);
+	kgsl_regrmw(device, GEN7_CP_BV_CHICKEN_DBG, 0x4, 0x4);
+
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		GEN7_CP_MEM_POOL_DBG_ADDR, GEN7_CP_MEM_POOL_DBG_DATA,
+		0, 0x2200);
+
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		GEN7_CP_BV_MEM_POOL_DBG_ADDR, GEN7_CP_BV_MEM_POOL_DBG_DATA,
+		0, 0x2200);
+
+	kgsl_regrmw(device, GEN7_CP_CHICKEN_DBG, 0x4, 0x0);
+	kgsl_regrmw(device, GEN7_CP_BV_CHICKEN_DBG, 0x4, 0x0);
+}
+
+static unsigned int gen7_read_dbgahb(struct kgsl_device *device,
+				unsigned int regbase, unsigned int reg)
+{
+	unsigned int val;
+
+	kgsl_regread(device, (GEN7_SP_AHB_READ_APERTURE + reg - regbase), &val);
+	return val;
+}
+
+static size_t gen7_legacy_snapshot_cluster_dbgahb(struct kgsl_device *device,
+				u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_mvc_regs_v2 *header =
+				(struct kgsl_snapshot_mvc_regs_v2 *)buf;
+	struct gen7_sptp_cluster_registers *cluster =
+			(struct gen7_sptp_cluster_registers *)priv;
+	const u32 *ptr = cluster->regs;
+	unsigned int read_sel;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	int j;
+	unsigned int size = adreno_snapshot_regs_count(ptr) * 4;
+
+	if (remain < (sizeof(*header) + size)) {
+		SNAPSHOT_ERR_NOMEM(device, "MVC REGISTERS");
+		return 0;
+	}
+
+	header->ctxt_id = cluster->context_id;
+	header->cluster_id = cluster->cluster_id;
+	header->pipe_id = cluster->pipe_id;
+	header->location_id = cluster->location_id;
+
+	read_sel = GEN7_SP_READ_SEL_VAL(cluster->location_id, cluster->pipe_id,
+			cluster->statetype, 0, 0);
+
+	kgsl_regwrite(device, GEN7_SP_READ_SEL, read_sel);
+
+	/*
+	 * An explicit barrier is needed so that reads do not happen before
+	 * the register write.
+	 */
+	mb();
+
+	for (ptr = cluster->regs; ptr[0] != UINT_MAX; ptr += 2) {
+		unsigned int count = REG_COUNT(ptr);
+
+		if (count == 1)
+			*data++ = ptr[0];
+		else {
+			*data++ = ptr[0] | (1 << 31);
+			*data++ = ptr[1];
+		}
+		for (j = ptr[0]; j <= ptr[1]; j++)
+			*data++ = gen7_read_dbgahb(device, cluster->regbase, j);
+	}
+
+	return (size + sizeof(*header));
+}
+
+static size_t gen7_snapshot_cluster_dbgahb(struct kgsl_device *device, u8 *buf,
+				size_t remain, void *priv)
+{
+	struct kgsl_snapshot_mvc_regs_v2 *header =
+				(struct kgsl_snapshot_mvc_regs_v2 *)buf;
+	struct gen7_sptp_cluster_registers *cluster =
+				(struct gen7_sptp_cluster_registers *)priv;
+	const u32 *ptr = cluster->regs;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int *src;
+	unsigned int size = adreno_snapshot_regs_count(ptr) * 4;
+
+	if (remain < (sizeof(*header) + size)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	header->ctxt_id = cluster->context_id;
+	header->cluster_id = cluster->cluster_id;
+	header->pipe_id = cluster->pipe_id;
+	header->location_id = cluster->location_id;
+
+	src = gen7_crashdump_registers->hostptr + cluster->offset;
+
+	for (ptr = cluster->regs; ptr[0] != UINT_MAX; ptr += 2) {
+		unsigned int cnt = REG_COUNT(ptr);
+
+		if (cnt == 1)
+			*data++ = ptr[0];
+		else {
+			*data++ = ptr[0] | (1 << 31);
+			*data++ = ptr[1];
+		}
+		memcpy(data, src, cnt << 2);
+		data += cnt;
+		src += cnt;
+	}
+
+	return (size + sizeof(*header));
+}
+
+static void gen7_snapshot_dbgahb_regs(struct kgsl_device *device,
+			struct kgsl_snapshot *snapshot)
+{
+	int i;
+	u64 *ptr, offset = 0;
+	unsigned int count;
+	struct gen7_sptp_cluster_registers *sptp_clusters = gen7_snapshot_block_list->sptp_clusters;
+	size_t num_sptp_clusters = gen7_snapshot_block_list->num_sptp_clusters;
+	size_t (*func)(struct kgsl_device *device, u8 *buf, size_t remain,
+		void *priv) = gen7_legacy_snapshot_cluster_dbgahb;
+
+	if (CD_SCRIPT_CHECK(device)) {
+		for (i = 0; i < num_sptp_clusters; i++)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_MVC_V2, snapshot, func,
+				&sptp_clusters[i]);
+		return;
+	}
+
+	/* Build the crash script */
+	ptr = gen7_capturescript->hostptr;
+
+	for (i = 0; i < num_sptp_clusters; i++) {
+		struct gen7_sptp_cluster_registers *cluster = &sptp_clusters[i];
+		const u32 *regs = cluster->regs;
+
+		cluster->offset = offset;
+
+		/* Program the aperture */
+		ptr += CD_WRITE(ptr, GEN7_SP_READ_SEL, GEN7_SP_READ_SEL_VAL
+			(cluster->location_id, cluster->pipe_id, cluster->statetype, 0, 0));
+
+		for (; regs[0] != UINT_MAX; regs += 2) {
+			count = REG_COUNT(regs);
+			ptr += CD_READ(ptr, (GEN7_SP_AHB_READ_APERTURE +
+				regs[0] - cluster->regbase), count,
+				(gen7_crashdump_registers->gpuaddr + offset));
+
+			offset += count * sizeof(unsigned int);
+		}
+	}
+	/* Marker for end of script */
+	CD_FINISH(ptr, offset);
+
+	/* Try to run the crash dumper */
+	if (_gen7_do_crashdump(device))
+		func = gen7_snapshot_cluster_dbgahb;
+
+	/* Capture the registers in snapshot */
+	for (i = 0; i < num_sptp_clusters; i++)
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_MVC_V2, snapshot, func, &sptp_clusters[i]);
+}
+
+static size_t gen7_legacy_snapshot_mvc(struct kgsl_device *device, u8 *buf,
+				size_t remain, void *priv)
+{
+	struct kgsl_snapshot_mvc_regs_v2 *header =
+					(struct kgsl_snapshot_mvc_regs_v2 *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	struct gen7_cluster_registers *cluster =
+			(struct gen7_cluster_registers *)priv;
+	const u32 *ptr = cluster->regs;
+	unsigned int j;
+	unsigned int size = adreno_snapshot_regs_count(ptr) * 4;
+
+	if (remain < (sizeof(*header) + size)) {
+		SNAPSHOT_ERR_NOMEM(device, "MVC REGISTERS");
+		return 0;
+	}
+
+	header->ctxt_id = (cluster->context_id == STATE_FORCE_CTXT_1) ? 1 : 0;
+	header->cluster_id = cluster->cluster_id;
+	header->pipe_id = cluster->pipe_id;
+	header->location_id = UINT_MAX;
+
+	/*
+	 * Set the AHB control for the Host to read from the
+	 * cluster/context for this iteration.
+	 */
+	kgsl_regwrite(device, GEN7_CP_APERTURE_CNTL_HOST, GEN7_CP_APERTURE_REG_VAL
+			(cluster->pipe_id, cluster->cluster_id, cluster->context_id));
+
+	if (cluster->sel)
+		kgsl_regwrite(device, cluster->sel->host_reg, cluster->sel->val);
+
+	for (ptr = cluster->regs; ptr[0] != UINT_MAX; ptr += 2) {
+		unsigned int count = REG_COUNT(ptr);
+
+		if (count == 1)
+			*data++ = ptr[0];
+		else {
+			*data++ = ptr[0] | (1 << 31);
+			*data++ = ptr[1];
+		}
+		for (j = ptr[0]; j <= ptr[1]; j++) {
+			kgsl_regread(device, j, data);
+			data++;
+		}
+	}
+
+	return (size + sizeof(*header));
+}
+
+static size_t gen7_snapshot_mvc(struct kgsl_device *device, u8 *buf,
+				size_t remain, void *priv)
+{
+	struct kgsl_snapshot_mvc_regs_v2 *header =
+				(struct kgsl_snapshot_mvc_regs_v2 *)buf;
+	struct gen7_cluster_registers *cluster =
+			(struct gen7_cluster_registers *)priv;
+	const u32 *ptr = cluster->regs;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	unsigned int *src;
+	unsigned int cnt;
+	unsigned int size = adreno_snapshot_regs_count(ptr) * 4;
+
+	if (remain < (sizeof(*header) + size)) {
+		SNAPSHOT_ERR_NOMEM(device, "MVC REGISTERS");
+		return 0;
+	}
+
+	header->ctxt_id = (cluster->context_id == STATE_FORCE_CTXT_1) ? 1 : 0;
+	header->cluster_id = cluster->cluster_id;
+	header->pipe_id = cluster->pipe_id;
+	header->location_id = UINT_MAX;
+
+	src = gen7_crashdump_registers->hostptr + cluster->offset;
+
+	for (ptr = cluster->regs; ptr[0] != UINT_MAX; ptr += 2) {
+		cnt = REG_COUNT(ptr);
+
+		if (cnt == 1)
+			*data++ = ptr[0];
+		else {
+			*data++ = ptr[0] | (1 << 31);
+			*data++ = ptr[1];
+		}
+		memcpy(data, src, cnt << 2);
+		src += cnt;
+		data += cnt;
+	}
+
+	return (size + sizeof(*header));
+
+}
+
+static void gen7_snapshot_mvc_regs(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	int i;
+	u64 *ptr, offset = 0;
+	unsigned int count;
+	struct gen7_cluster_registers *clusters = gen7_snapshot_block_list->clusters;
+	size_t num_clusters = gen7_snapshot_block_list->num_clusters;
+	size_t (*func)(struct kgsl_device *device, u8 *buf,
+				size_t remain, void *priv) = gen7_legacy_snapshot_mvc;
+
+	if (CD_SCRIPT_CHECK(device)) {
+		for (i = 0; i < num_clusters; i++)
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_MVC_V2, snapshot, func, &clusters[i]);
+		return;
+	}
+
+	/* Build the crash script */
+	ptr = gen7_capturescript->hostptr;
+
+	for (i = 0; i < num_clusters; i++) {
+		struct gen7_cluster_registers *cluster = &clusters[i];
+		const u32 *regs = cluster->regs;
+
+		cluster->offset = offset;
+		ptr += CD_WRITE(ptr, GEN7_CP_APERTURE_CNTL_CD, GEN7_CP_APERTURE_REG_VAL
+			(cluster->pipe_id, cluster->cluster_id, cluster->context_id));
+
+		if (cluster->sel)
+			ptr += CD_WRITE(ptr, cluster->sel->cd_reg, cluster->sel->val);
+
+		for (; regs[0] != UINT_MAX; regs += 2) {
+			count = REG_COUNT(regs);
+
+			ptr += CD_READ(ptr, regs[0],
+				count, (gen7_crashdump_registers->gpuaddr + offset));
+
+			offset += count * sizeof(unsigned int);
+		}
+	}
+
+	/* Marker for end of script */
+	CD_FINISH(ptr, offset);
+
+	/* Try to run the crash dumper */
+	if (_gen7_do_crashdump(device))
+		func = gen7_snapshot_mvc;
+
+	for (i = 0; i < num_clusters; i++)
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_MVC_V2, snapshot, func, &clusters[i]);
+}
+
+/* gen7_dbgc_debug_bus_read() - Read data from trace bus */
+static void gen7_dbgc_debug_bus_read(struct kgsl_device *device,
+	unsigned int block_id, unsigned int index, unsigned int *val)
+{
+	unsigned int reg;
+
+	reg = FIELD_PREP(GENMASK(7, 0), index) |
+		FIELD_PREP(GENMASK(24, 16), block_id);
+
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_SEL_A, reg);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_SEL_B, reg);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_SEL_C, reg);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_SEL_D, reg);
+
+	/*
+	 * There needs to be a delay of 1 us to ensure enough time for correct
+	 * data is funneled into the trace buffer
+	 */
+	udelay(1);
+
+	kgsl_regread(device, GEN7_DBGC_CFG_DBGBUS_TRACE_BUF2, val);
+	val++;
+	kgsl_regread(device, GEN7_DBGC_CFG_DBGBUS_TRACE_BUF1, val);
+}
+
+/* gen7_snapshot_dbgc_debugbus_block() - Capture debug data for a gpu block */
+static size_t gen7_snapshot_dbgc_debugbus_block(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debugbus *header =
+		(struct kgsl_snapshot_debugbus *)buf;
+	const u32 *block = priv;
+	int i;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+
+	if (remain < GEN7_DEBUGBUS_SECTION_SIZE) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+
+	header->id = *block;
+	header->count = GEN7_DEBUGBUS_BLOCK_SIZE * 2;
+
+	for (i = 0; i < GEN7_DEBUGBUS_BLOCK_SIZE; i++)
+		gen7_dbgc_debug_bus_read(device, *block, i, &data[i*2]);
+
+	return GEN7_DEBUGBUS_SECTION_SIZE;
+}
+
+static u32 gen7_dbgc_side_debug_bus_read(struct kgsl_device *device,
+	unsigned int block_id, unsigned int index)
+{
+	u32 val;
+	unsigned int reg = FIELD_PREP(GENMASK(7, 0), index) |
+			FIELD_PREP(GENMASK(24, 16), block_id);
+
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_SEL_A, reg);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_SEL_B, reg);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_SEL_C, reg);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_SEL_D, reg);
+
+	/*
+	 * There needs to be a delay of 1 us to ensure enough time for correct
+	 * data is funneled into the trace buffer
+	 */
+	udelay(1);
+
+	val = kgsl_regmap_read(&device->regmap, GEN7_DBGC_CFG_DBGBUS_OVER);
+
+	return FIELD_GET(GENMASK(27, 24), val);
+}
+
+static size_t gen7_snapshot_dbgc_side_debugbus_block(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_side_debugbus *header =
+		(struct kgsl_snapshot_side_debugbus *)buf;
+	const u32 *block = priv;
+	int i;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	size_t size = (GEN7_DEBUGBUS_BLOCK_SIZE * sizeof(unsigned int)) + sizeof(*header);
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+
+	header->id = *block;
+	header->size = GEN7_DEBUGBUS_BLOCK_SIZE;
+	header->valid_data = 0x4;
+
+	for (i = 0; i < GEN7_DEBUGBUS_BLOCK_SIZE; i++)
+		data[i] = gen7_dbgc_side_debug_bus_read(device, *block, i);
+
+	return size;
+}
+
+/* gen7_cx_dbgc_debug_bus_read() - Read data from trace bus */
+static void gen7_cx_debug_bus_read(struct kgsl_device *device,
+	unsigned int block_id, unsigned int index, unsigned int *val)
+{
+	unsigned int reg;
+
+	reg = FIELD_PREP(GENMASK(7, 0), index) |
+		FIELD_PREP(GENMASK(24, 16), block_id);
+
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_SEL_A, reg);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_SEL_B, reg);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_SEL_C, reg);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_SEL_D, reg);
+
+	/*
+	 * There needs to be a delay of 1 us to ensure enough time for correct
+	 * data is funneled into the trace buffer
+	 */
+	udelay(1);
+
+	kgsl_regread(device, GEN7_CX_DBGC_CFG_DBGBUS_TRACE_BUF2, val);
+	val++;
+	kgsl_regread(device, GEN7_CX_DBGC_CFG_DBGBUS_TRACE_BUF1, val);
+}
+
+/*
+ * gen7_snapshot_cx_dbgc_debugbus_block() - Capture debug data for a gpu
+ * block from the CX DBGC block
+ */
+static size_t gen7_snapshot_cx_dbgc_debugbus_block(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_debugbus *header =
+		(struct kgsl_snapshot_debugbus *)buf;
+	const u32 *block = priv;
+	int i;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+
+	if (remain < GEN7_DEBUGBUS_SECTION_SIZE) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+
+	header->id = *block;
+	header->count = GEN7_DEBUGBUS_BLOCK_SIZE * 2;
+
+	for (i = 0; i < GEN7_DEBUGBUS_BLOCK_SIZE; i++)
+		gen7_cx_debug_bus_read(device, *block, i, &data[i*2]);
+
+	return GEN7_DEBUGBUS_SECTION_SIZE;
+}
+
+/* gen7_cx_side_dbgc_debug_bus_read() - Read data from trace bus */
+static void gen7_cx_side_debug_bus_read(struct kgsl_device *device,
+	unsigned int block_id, unsigned int index, unsigned int *val)
+{
+	unsigned int reg = FIELD_PREP(GENMASK(7, 0), index) |
+			FIELD_PREP(GENMASK(24, 16), block_id);
+
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_SEL_A, reg);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_SEL_B, reg);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_SEL_C, reg);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_SEL_D, reg);
+
+	/*
+	 * There needs to be a delay of 1 us to ensure enough time for correct
+	 * data is funneled into the trace buffer
+	 */
+	udelay(1);
+
+	kgsl_regread(device, GEN7_CX_DBGC_CFG_DBGBUS_OVER, &reg);
+	*val = FIELD_GET(GENMASK(27, 24), reg);
+}
+
+/*
+ * gen7_snapshot_cx_dbgc_debugbus_block() - Capture debug data for a gpu
+ * block from the CX DBGC block
+ */
+static size_t gen7_snapshot_cx_side_dbgc_debugbus_block(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_side_debugbus *header =
+		(struct kgsl_snapshot_side_debugbus *)buf;
+	const u32 *block = priv;
+	int i;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	size_t size = (GEN7_DEBUGBUS_BLOCK_SIZE * sizeof(unsigned int)) + sizeof(*header);
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "DEBUGBUS");
+		return 0;
+	}
+
+	header->id = *block;
+	header->size = GEN7_DEBUGBUS_BLOCK_SIZE;
+	header->valid_data = 0x4;
+
+	for (i = 0; i < GEN7_DEBUGBUS_BLOCK_SIZE; i++)
+		gen7_cx_side_debug_bus_read(device, *block, i, &data[i]);
+
+	return size;
+}
+
+/* gen7_snapshot_debugbus() - Capture debug bus data */
+static void gen7_snapshot_debugbus(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot)
+{
+	int i;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_CNTLT,
+			FIELD_PREP(GENMASK(31, 28), 0xf));
+
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_CNTLM,
+			FIELD_PREP(GENMASK(27, 24), 0xf));
+
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_IVTL_0, 0);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_IVTL_1, 0);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_IVTL_2, 0);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_IVTL_3, 0);
+
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_BYTEL_0,
+			FIELD_PREP(GENMASK(3, 0), 0x0) |
+			FIELD_PREP(GENMASK(7, 4), 0x1) |
+			FIELD_PREP(GENMASK(11, 8), 0x2) |
+			FIELD_PREP(GENMASK(15, 12), 0x3) |
+			FIELD_PREP(GENMASK(19, 16), 0x4) |
+			FIELD_PREP(GENMASK(23, 20), 0x5) |
+			FIELD_PREP(GENMASK(27, 24), 0x6) |
+			FIELD_PREP(GENMASK(31, 28), 0x7));
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_BYTEL_1,
+			FIELD_PREP(GENMASK(3, 0), 0x8) |
+			FIELD_PREP(GENMASK(7, 4), 0x9) |
+			FIELD_PREP(GENMASK(11, 8), 0xa) |
+			FIELD_PREP(GENMASK(15, 12), 0xb) |
+			FIELD_PREP(GENMASK(19, 16), 0xc) |
+			FIELD_PREP(GENMASK(23, 20), 0xd) |
+			FIELD_PREP(GENMASK(27, 24), 0xe) |
+			FIELD_PREP(GENMASK(31, 28), 0xf));
+
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_MASKL_0, 0);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_MASKL_1, 0);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_MASKL_2, 0);
+	kgsl_regwrite(device, GEN7_DBGC_CFG_DBGBUS_MASKL_3, 0);
+
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_CNTLT,
+			FIELD_PREP(GENMASK(31, 28), 0xf));
+
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_CNTLM,
+			FIELD_PREP(GENMASK(27, 24), 0xf));
+
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_IVTL_0, 0);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_IVTL_1, 0);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_IVTL_2, 0);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_IVTL_3, 0);
+
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_BYTEL_0,
+			FIELD_PREP(GENMASK(3, 0), 0x0) |
+			FIELD_PREP(GENMASK(7, 4), 0x1) |
+			FIELD_PREP(GENMASK(11, 8), 0x2) |
+			FIELD_PREP(GENMASK(15, 12), 0x3) |
+			FIELD_PREP(GENMASK(19, 16), 0x4) |
+			FIELD_PREP(GENMASK(23, 20), 0x5) |
+			FIELD_PREP(GENMASK(27, 24), 0x6) |
+			FIELD_PREP(GENMASK(31, 28), 0x7));
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_BYTEL_1,
+			FIELD_PREP(GENMASK(3, 0), 0x8) |
+			FIELD_PREP(GENMASK(7, 4), 0x9) |
+			FIELD_PREP(GENMASK(11, 8), 0xa) |
+			FIELD_PREP(GENMASK(15, 12), 0xb) |
+			FIELD_PREP(GENMASK(19, 16), 0xc) |
+			FIELD_PREP(GENMASK(23, 20), 0xd) |
+			FIELD_PREP(GENMASK(27, 24), 0xe) |
+			FIELD_PREP(GENMASK(31, 28), 0xf));
+
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_MASKL_0, 0);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_MASKL_1, 0);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_MASKL_2, 0);
+	kgsl_regwrite(device, GEN7_CX_DBGC_CFG_DBGBUS_MASKL_3, 0);
+
+	for (i = 0; i < gen7_snapshot_block_list->debugbus_blocks_len; i++) {
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+			snapshot, gen7_snapshot_dbgc_debugbus_block,
+			(void *) &gen7_snapshot_block_list->debugbus_blocks[i]);
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_SIDE_DEBUGBUS,
+			snapshot, gen7_snapshot_dbgc_side_debugbus_block,
+			(void *) &gen7_snapshot_block_list->debugbus_blocks[i]);
+	}
+
+	for (i = 0; i < gen7_snapshot_block_list->gbif_debugbus_blocks_len; i++) {
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+			snapshot, gen7_snapshot_dbgc_debugbus_block,
+			(void *) &gen7_snapshot_block_list->gbif_debugbus_blocks[i]);
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_SIDE_DEBUGBUS,
+			snapshot, gen7_snapshot_dbgc_side_debugbus_block,
+			(void *) &gen7_snapshot_block_list->gbif_debugbus_blocks[i]);
+	}
+
+	/* Dump the CX debugbus data if the block exists */
+	if (kgsl_regmap_valid_offset(&device->regmap, GEN7_CX_DBGC_CFG_DBGBUS_SEL_A)) {
+		for (i = 0; i < gen7_snapshot_block_list->cx_debugbus_blocks_len; i++) {
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_DEBUGBUS,
+				snapshot, gen7_snapshot_cx_dbgc_debugbus_block,
+				(void *) &gen7_snapshot_block_list->cx_debugbus_blocks[i]);
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_SIDE_DEBUGBUS,
+				snapshot, gen7_snapshot_cx_side_dbgc_debugbus_block,
+				(void *) &gen7_snapshot_block_list->cx_debugbus_blocks[i]);
+		}
+	}
+}
+
+/* gen7_snapshot_sqe() - Dump SQE data in snapshot */
+static size_t gen7_snapshot_sqe(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_SQE);
+
+	if (remain < DEBUG_SECTION_SZ(GEN7_SQE_FW_SNAPSHOT_DWORDS)) {
+		SNAPSHOT_ERR_NOMEM(device, "SQE VERSION DEBUG");
+		return 0;
+	}
+
+	/* Dump the SQE firmware version */
+	header->type = SNAPSHOT_DEBUG_SQE_VERSION;
+	header->size = GEN7_SQE_FW_SNAPSHOT_DWORDS;
+	memcpy(data, fw->memdesc->hostptr, (GEN7_SQE_FW_SNAPSHOT_DWORDS * sizeof(u32)));
+
+	return DEBUG_SECTION_SZ(GEN7_SQE_FW_SNAPSHOT_DWORDS);
+}
+
+/* gen7_snapshot_aqe() - Dump AQE data in snapshot */
+static size_t gen7_snapshot_aqe(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_snapshot_debug *header = (struct kgsl_snapshot_debug *)buf;
+	u32 *data = (unsigned int *)(buf + sizeof(*header));
+	struct adreno_firmware *fw = ADRENO_FW(adreno_dev, ADRENO_FW_AQE);
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_AQE))
+		return 0;
+
+	if (remain < DEBUG_SECTION_SZ(1)) {
+		SNAPSHOT_ERR_NOMEM(device, "AQE VERSION DEBUG");
+		return 0;
+	}
+
+	/* Dump the AQE firmware version */
+	header->type = SNAPSHOT_DEBUG_AQE_VERSION;
+	header->size = 1;
+	*data = fw->version;
+
+	return DEBUG_SECTION_SZ(1);
+}
+
+/* Snapshot the preemption related buffers */
+static size_t snapshot_preemption_record(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_memdesc *memdesc = priv;
+	struct kgsl_snapshot_gpu_object_v2 *header =
+		(struct kgsl_snapshot_gpu_object_v2 *)buf;
+	u8 *ptr = buf + sizeof(*header);
+	const struct adreno_gen7_core *gpucore = to_gen7_core(ADRENO_DEVICE(device));
+	u64 ctxt_record_size = GEN7_CP_CTXRECORD_SIZE_IN_BYTES;
+
+	if (gpucore->ctxt_record_size)
+		ctxt_record_size = gpucore->ctxt_record_size;
+
+	ctxt_record_size = min_t(u64, ctxt_record_size, device->snapshot_ctxt_record_size);
+
+	if (remain < (ctxt_record_size + sizeof(*header))) {
+		SNAPSHOT_ERR_NOMEM(device, "PREEMPTION RECORD");
+		return 0;
+	}
+
+	header->size = ctxt_record_size >> 2;
+	header->gpuaddr = memdesc->gpuaddr;
+	header->ptbase =
+		kgsl_mmu_pagetable_get_ttbr0(device->mmu.defaultpagetable);
+	header->type = SNAPSHOT_GPU_OBJECT_GLOBAL;
+
+	memcpy(ptr, memdesc->hostptr, ctxt_record_size);
+
+	return ctxt_record_size + sizeof(*header);
+}
+
+static void gen7_reglist_snapshot(struct kgsl_device *device,
+					struct kgsl_snapshot *snapshot)
+{
+	u64 *ptr, offset = 0;
+	int i;
+	u32 r;
+	struct gen7_reg_list *reg_list = gen7_snapshot_block_list->reg_list;
+	size_t (*func)(struct kgsl_device *device, u8 *buf, size_t remain,
+		void *priv) = gen7_legacy_snapshot_registers;
+
+	if (CD_SCRIPT_CHECK(device)) {
+		for (i = 0; reg_list[i].regs; i++)
+			kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2,
+				snapshot, func, &reg_list[i]);
+		return;
+	}
+
+	/* Build the crash script */
+	ptr = (u64 *)gen7_capturescript->hostptr;
+
+	for (i = 0; reg_list[i].regs; i++) {
+		struct gen7_reg_list *regs = &reg_list[i];
+		const u32 *regs_ptr = regs->regs;
+
+		regs->offset = offset;
+
+		/* Program the SEL_CNTL_CD register appropriately */
+		if (regs->sel)
+			ptr += CD_WRITE(ptr, regs->sel->cd_reg, regs->sel->val);
+
+		for (; regs_ptr[0] != UINT_MAX; regs_ptr += 2) {
+			r = REG_COUNT(regs_ptr);
+			ptr += CD_READ(ptr, regs_ptr[0], r,
+				(gen7_crashdump_registers->gpuaddr + offset));
+			offset += r * sizeof(u32);
+		}
+	}
+
+	/* Marker for end of script */
+	CD_FINISH(ptr, offset);
+
+	/* Try to run the crash dumper */
+	if (_gen7_do_crashdump(device))
+		func = gen7_snapshot_registers;
+
+	for (i = 0; reg_list[i].regs; i++)
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2,
+			snapshot, func, &reg_list[i]);
+}
+
+static size_t gen7_snapshot_cx_misc_registers(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv)
+{
+	const u32 *ptr = (u32 *)priv;
+	u32 *src, *data = (unsigned int *)buf;
+	size_t size = adreno_snapshot_regs_count(ptr) * sizeof(u32);
+
+	if (remain < size) {
+		SNAPSHOT_ERR_NOMEM(device, "CX_MISC REGISTERS");
+		return 0;
+	}
+
+	src = gen7_crashdump_registers->hostptr;
+
+	for (; ptr[0] != UINT_MAX; ptr += 2) {
+		u32 cnt = REG_COUNT(ptr);
+
+		if (cnt == 1)
+			*data++ = BIT(31) | ptr[0];
+		else {
+			*data++ = ptr[0];
+			*data++ = cnt;
+		}
+		memcpy(data, src, cnt << 2);
+		data += cnt;
+		src += cnt;
+	}
+
+	/* Return the size of the section */
+	return size;
+}
+
+static void gen7_cx_misc_regs_snapshot(struct kgsl_device *device,
+					struct kgsl_snapshot *snapshot)
+{
+	u64 *ptr, offset = 0;
+	const u32 *regs_ptr = (const u32 *)gen7_snapshot_block_list->cx_misc_regs;
+
+	if (CD_SCRIPT_CHECK(device))
+		goto done;
+
+	/* Build the crash script */
+	ptr = (u64 *)gen7_capturescript->hostptr;
+
+	for (; regs_ptr[0] != UINT_MAX; regs_ptr += 2) {
+		u32 r = REG_COUNT(regs_ptr);
+
+		ptr += CD_READ(ptr, regs_ptr[0], r,
+			(gen7_crashdump_registers->gpuaddr + offset));
+		offset += r * sizeof(u32);
+	}
+
+	/* Marker for end of script */
+	CD_FINISH(ptr, offset);
+
+	/* Try to run the crash dumper */
+	if (_gen7_do_crashdump(device)) {
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2,
+			snapshot, gen7_snapshot_cx_misc_registers,
+			(void *)gen7_snapshot_block_list->cx_misc_regs);
+		return;
+	}
+
+done:
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2,
+		snapshot, adreno_snapshot_cx_misc_registers,
+		(void *)gen7_snapshot_block_list->cx_misc_regs);
+}
+
+static void gen7_snapshot_br_roq(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot)
+{
+	unsigned int roq_size;
+
+	/*
+	 * CP ROQ dump units is 4 dwords. The number of units is stored
+	 * in CP_ROQ_THRESHOLDS_2[31:20], but it is not accessible to
+	 * host. Program the GEN7_CP_SQE_UCODE_DBG_ADDR with 0x70d3 offset
+	 * and read the value CP_ROQ_THRESHOLDS_2 from
+	 * GEN7_CP_SQE_UCODE_DBG_DATA
+	 */
+	kgsl_regwrite(device, GEN7_CP_SQE_UCODE_DBG_ADDR, 0x70d3);
+	kgsl_regread(device, GEN7_CP_SQE_UCODE_DBG_DATA, &roq_size);
+	roq_size = roq_size >> 20;
+	kgsl_snapshot_indexed_registers(device, snapshot,
+			GEN7_CP_ROQ_DBG_ADDR, GEN7_CP_ROQ_DBG_DATA, 0, (roq_size << 2));
+}
+
+static void gen7_snapshot_bv_roq(struct kgsl_device *device,
+			struct kgsl_snapshot *snapshot)
+{
+	unsigned int roq_size;
+
+	/*
+	 * CP ROQ dump units is 4 dwords. The number of units is stored
+	 * in CP_BV_ROQ_THRESHOLDS_2[31:20], but it is not accessible to
+	 * host. Program the GEN7_CP_BV_SQE_UCODE_DBG_ADDR with 0x70d3 offset
+	 * (at which CP stores the roq values) and read the value of
+	 * CP_BV_ROQ_THRESHOLDS_2 from GEN7_CP_BV_SQE_UCODE_DBG_DATA
+	 */
+	kgsl_regwrite(device, GEN7_CP_BV_SQE_UCODE_DBG_ADDR, 0x70d3);
+	kgsl_regread(device, GEN7_CP_BV_SQE_UCODE_DBG_DATA, &roq_size);
+	roq_size = roq_size >> 20;
+	kgsl_snapshot_indexed_registers(device, snapshot,
+			GEN7_CP_BV_ROQ_DBG_ADDR, GEN7_CP_BV_ROQ_DBG_DATA, 0, (roq_size << 2));
+}
+
+static void gen7_snapshot_lpac_roq(struct kgsl_device *device,
+			struct kgsl_snapshot *snapshot)
+{
+	unsigned int roq_size;
+
+	/*
+	 * CP ROQ dump units is 4 dwords. The number of units is stored
+	 * in CP_LPAC_ROQ_THRESHOLDS_2[31:20], but it is not accessible to
+	 * host. Program the GEN7_CP_SQE_AC_UCODE_DBG_ADDR with 0x70d3 offset
+	 * (at which CP stores the roq values) and read the value of
+	 * CP_LPAC_ROQ_THRESHOLDS_2 from GEN7_CP_SQE_AC_UCODE_DBG_DATA
+	 */
+	kgsl_regwrite(device, GEN7_CP_SQE_AC_UCODE_DBG_ADDR, 0x70d3);
+	kgsl_regread(device, GEN7_CP_SQE_AC_UCODE_DBG_DATA, &roq_size);
+	roq_size = roq_size >> 20;
+	kgsl_snapshot_indexed_registers(device, snapshot,
+			GEN7_CP_LPAC_ROQ_DBG_ADDR, GEN7_CP_LPAC_ROQ_DBG_DATA, 0, (roq_size << 2));
+}
+
+void gen7_snapshot_external_core_regs(struct kgsl_device *device,
+			struct kgsl_snapshot *snapshot)
+{
+	size_t i;
+	const u32 **external_core_regs;
+	unsigned int num_external_core_regs;
+	const struct adreno_gen7_core *gpucore = to_gen7_core(ADRENO_DEVICE(device));
+
+	gen7_snapshot_block_list = gpucore->gen7_snapshot_block_list;
+	external_core_regs = gen7_snapshot_block_list->external_core_regs;
+	num_external_core_regs = gen7_snapshot_block_list->num_external_core_regs;
+
+	for (i = 0; i < num_external_core_regs; i++) {
+		const u32 *regs = external_core_regs[i];
+
+		kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2,
+			snapshot, adreno_snapshot_registers_v2,
+			(void *) regs);
+	}
+}
+
+/*
+ * gen7_snapshot() - GEN7 GPU snapshot function
+ * @adreno_dev: Device being snapshotted
+ * @snapshot: Pointer to the snapshot instance
+ *
+ * This is where all of the GEN7 specific bits and pieces are grabbed
+ * into the snapshot memory
+ */
+void gen7_snapshot(struct adreno_device *adreno_dev,
+		struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_ringbuffer *rb;
+	unsigned int i;
+	u32 hi, lo, cgc = 0, cgc1 = 0, cgc2 = 0;
+	const struct adreno_gen7_core *gpucore = to_gen7_core(ADRENO_DEVICE(device));
+	int is_current_rt;
+
+	gen7_crashdump_timedout = false;
+	gen7_snapshot_block_list = gpucore->gen7_snapshot_block_list;
+
+	/* External registers are dumped in the beginning of gmu snapshot */
+	if (!gmu_core_isenabled(device))
+		gen7_snapshot_external_core_regs(device, snapshot);
+
+	gen7_snapshot_trace_buffer(device, snapshot);
+
+	/*
+	 * Dump debugbus data here to capture it for both
+	 * GMU and GPU snapshot. Debugbus data can be accessed
+	 * even if the gx headswitch is off. If gx
+	 * headswitch is off, data for gx blocks will show as
+	 * 0x5c00bd00. Disable clock gating for SP and TP to capture
+	 * debugbus data.
+	 */
+	if (!adreno_is_gen7_9_x(adreno_dev) && device->ftbl->is_hwcg_on(device)) {
+		kgsl_regread(device, GEN7_RBBM_CLOCK_CNTL2_SP0, &cgc);
+		kgsl_regread(device, GEN7_RBBM_CLOCK_CNTL_TP0, &cgc1);
+		kgsl_regread(device, GEN7_RBBM_CLOCK_CNTL3_TP0, &cgc2);
+		kgsl_regrmw(device, GEN7_RBBM_CLOCK_CNTL2_SP0, GENMASK(22, 20), 0);
+		kgsl_regrmw(device, GEN7_RBBM_CLOCK_CNTL_TP0, GENMASK(2, 0), 0);
+		kgsl_regrmw(device, GEN7_RBBM_CLOCK_CNTL3_TP0, GENMASK(14, 12), 0);
+	}
+
+	gen7_snapshot_debugbus(adreno_dev, snapshot);
+
+	/* Restore the value of the clockgating registers */
+	if (!adreno_is_gen7_9_x(adreno_dev) && device->ftbl->is_hwcg_on(device)) {
+		kgsl_regwrite(device, GEN7_RBBM_CLOCK_CNTL2_SP0, cgc);
+		kgsl_regwrite(device, GEN7_RBBM_CLOCK_CNTL_TP0, cgc1);
+		kgsl_regwrite(device, GEN7_RBBM_CLOCK_CNTL3_TP0, cgc2);
+	}
+
+	if (!adreno_gx_is_on(adreno_dev))
+		return;
+
+	is_current_rt = rt_task(current);
+
+	if (is_current_rt)
+		sched_set_normal(current, 0);
+
+	kgsl_regread(device, GEN7_CP_IB1_BASE, &lo);
+	kgsl_regread(device, GEN7_CP_IB1_BASE_HI, &hi);
+
+	snapshot->ib1base = (((u64) hi) << 32) | lo;
+
+	kgsl_regread(device, GEN7_CP_IB2_BASE, &lo);
+	kgsl_regread(device, GEN7_CP_IB2_BASE_HI, &hi);
+
+	snapshot->ib2base = (((u64) hi) << 32) | lo;
+
+	kgsl_regread(device, GEN7_CP_IB1_REM_SIZE, &snapshot->ib1size);
+	kgsl_regread(device, GEN7_CP_IB2_REM_SIZE, &snapshot->ib2size);
+
+	kgsl_regread(device, GEN7_CP_LPAC_IB1_BASE, &lo);
+	kgsl_regread(device, GEN7_CP_LPAC_IB1_BASE_HI, &hi);
+
+	snapshot->ib1base_lpac = (((u64) hi) << 32) | lo;
+
+	kgsl_regread(device, GEN7_CP_LPAC_IB2_BASE, &lo);
+	kgsl_regread(device, GEN7_CP_LPAC_IB2_BASE_HI, &hi);
+
+	snapshot->ib2base_lpac = (((u64) hi) << 32) | lo;
+
+	kgsl_regread(device, GEN7_CP_LPAC_IB1_REM_SIZE, &snapshot->ib1size_lpac);
+	kgsl_regread(device, GEN7_CP_LPAC_IB2_REM_SIZE, &snapshot->ib2size_lpac);
+
+	/* Assert the isStatic bit before triggering snapshot */
+	kgsl_regwrite(device, GEN7_RBBM_SNAPSHOT_STATUS, 0x1);
+
+	/* Dump the registers which get affected by crash dumper trigger */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2,
+		snapshot, adreno_snapshot_registers_v2,
+		(void *) gen7_snapshot_block_list->pre_crashdumper_regs);
+
+	gen7_reglist_snapshot(device, snapshot);
+
+	gen7_cx_misc_regs_snapshot(device, snapshot);
+
+	/*
+	 * Need to program and save this register before capturing resource table
+	 * to workaround a CGC issue
+	 */
+	if (device->ftbl->is_hwcg_on(device)) {
+		kgsl_regread(device, GEN7_RBBM_CLOCK_MODE_CP, &cgc);
+		kgsl_regrmw(device, GEN7_RBBM_CLOCK_MODE_CP, 0x7, 0);
+	}
+	kgsl_snapshot_indexed_registers(device, snapshot,
+		GEN7_CP_RESOURCE_TABLE_DBG_ADDR, GEN7_CP_RESOURCE_TABLE_DBG_DATA,
+		0, 0x4100);
+
+	/* Reprogram the register back to the original stored value */
+	if (device->ftbl->is_hwcg_on(device))
+		kgsl_regwrite(device, GEN7_RBBM_CLOCK_MODE_CP, cgc);
+
+
+	for (i = 0; i < gen7_snapshot_block_list->index_registers_len; i++)
+		kgsl_snapshot_indexed_registers(device, snapshot,
+			gen7_snapshot_block_list->index_registers[i].addr,
+			gen7_snapshot_block_list->index_registers[i].data, 0,
+			gen7_snapshot_block_list->index_registers[i].size);
+
+	if (!adreno_is_gen7_9_x(adreno_dev)) {
+		gen7_snapshot_br_roq(device, snapshot);
+
+		gen7_snapshot_bv_roq(device, snapshot);
+
+		gen7_snapshot_lpac_roq(device, snapshot);
+	}
+
+	/* SQE Firmware */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, gen7_snapshot_sqe, NULL);
+
+	/* AQE Firmware */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_DEBUG,
+		snapshot, gen7_snapshot_aqe, NULL);
+
+	/* Mempool debug data */
+	gen7_snapshot_mempool(device, snapshot);
+
+	/* MVC register section */
+	gen7_snapshot_mvc_regs(device, snapshot);
+
+	/* registers dumped through DBG AHB */
+	gen7_snapshot_dbgahb_regs(device, snapshot);
+
+	/* Shader memory */
+	gen7_snapshot_shader(device, snapshot);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS_V2,
+		snapshot, adreno_snapshot_registers_v2,
+		(void *) gen7_snapshot_block_list->post_crashdumper_regs);
+
+	kgsl_regwrite(device, GEN7_RBBM_SNAPSHOT_STATUS, 0x0);
+
+	/* Preemption record */
+	if (adreno_is_preemption_enabled(adreno_dev)) {
+		FOR_EACH_RINGBUFFER(adreno_dev, rb, i) {
+			kgsl_snapshot_add_section(device,
+				KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+				snapshot, snapshot_preemption_record,
+				rb->preemption_desc);
+		}
+	}
+	if (is_current_rt)
+		sched_set_fifo(current);
+}
+
+void gen7_crashdump_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (IS_ERR_OR_NULL(gen7_capturescript))
+		gen7_capturescript = kgsl_allocate_global(device,
+			3 * PAGE_SIZE, 0, KGSL_MEMFLAGS_GPUREADONLY,
+			KGSL_MEMDESC_PRIVILEGED, "capturescript");
+
+	if (IS_ERR(gen7_capturescript))
+		return;
+
+	if (IS_ERR_OR_NULL(gen7_crashdump_registers))
+		gen7_crashdump_registers = kgsl_allocate_global(device,
+			25 * PAGE_SIZE, 0, 0, KGSL_MEMDESC_PRIVILEGED,
+			"capturescript_regs");
+
+	if (IS_ERR(gen7_crashdump_registers))
+		return;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_gen7_snapshot.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_gen7_snapshot.h
@@ -0,0 +1,383 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_GEN7_SNAPSHOT_H
+#define __ADRENO_GEN7_SNAPSHOT_H
+
+#include "adreno.h"
+#include "adreno_gen7.h"
+#include "kgsl_regmap.h"
+
+#define CLUSTER_NONE 0
+#define CLUSTER_FE 1
+#define CLUSTER_SP_VS 2
+#define CLUSTER_PC_VS 3
+#define CLUSTER_GRAS 4
+#define CLUSTER_SP_PS 5
+#define CLUSTER_VPC_PS 6
+#define CLUSTER_PS 7
+
+#define HLSQ_STATE 0
+#define HLSQ_DP 1
+#define SP_TOP 2
+#define USPTP 3
+#define HLSQ_DP_STR 4
+
+#define STATE_NON_CONTEXT 0
+#define STATE_TOGGLE_CTXT 1
+#define STATE_FORCE_CTXT_0 2
+#define STATE_FORCE_CTXT_1 3
+
+#define GEN7_DEBUGBUS_BLOCK_SIZE 0x100
+
+/* Number of dword to dump in snapshot for CP SQE */
+#define GEN7_SQE_FW_SNAPSHOT_DWORDS 5
+
+struct gen7_sel_reg {
+	unsigned int host_reg;
+	unsigned int cd_reg;
+	unsigned int val;
+};
+
+struct gen7_sptp_cluster_registers {
+	/* cluster_id: Cluster identifier */
+	int cluster_id;
+	/* statetype: SP block state type for the cluster */
+	int statetype;
+	/* pipe_id: Pipe identifier */
+	int pipe_id;
+	/* context_id: Context identifier */
+	int context_id;
+	/* location_id: Location identifier */
+	int location_id;
+	/* regs: Pointer to the list of register pairs to read */
+	const u32 *regs;
+	/* regbase: Dword offset of the register block in the GPu register space */
+	unsigned int regbase;
+	/* offset: Internal variable used to track the crashdump state */
+	unsigned int offset;
+};
+
+struct gen7_shader_block {
+	/* statetype: Type identifer for the block */
+	u32 statetype;
+	/* size: Size of the block (in dwords) */
+	u32 size;
+	/* num_sps: The SP id to dump */
+	u32 num_sps;
+	/* num_usptps: The number of USPTPs to dump */;
+	u32 num_usptps;
+	/* pipe_id: Pipe identifier for the block data  */
+	u32 pipeid;
+	/* location: Location identifer for the block data */
+	u32 location;
+	/* offset: The offset in the snasphot dump */
+	u64 offset;
+};
+
+struct gen7_shader_block_info {
+	struct gen7_shader_block *block;
+	unsigned int sp_id;
+	unsigned int usptp;
+	u32 bank;
+	u64 offset;
+};
+
+struct gen7_reg_list {
+	const u32 *regs;
+	const struct gen7_sel_reg *sel;
+	u64 offset;
+};
+
+struct gen7_cp_indexed_reg {
+	u32 addr;
+	u32 data;
+	u32 size;
+};
+
+struct gen7_cluster_registers {
+	/* cluster_id: Cluster identifier */
+	int cluster_id;
+	/* pipe_id: Pipe Identifier */
+	int pipe_id;
+	/* context_id: one of STATE_ that identifies the context to dump */
+	int context_id;
+	/* regs: Pointer to an array of register pairs */
+	const u32 *regs;
+	/* sel: Pointer to a selector register to write before reading */
+	const struct gen7_sel_reg *sel;
+	/* offset: Internal variable to track the state of the crashdump */
+	unsigned int offset;
+};
+
+struct gen7_snapshot_block_list {
+	/* pre_crashdumper_regs : Registers which need to be dumped before CD runs */
+	const u32 *pre_crashdumper_regs;
+	/* debugbus_blocks : List of debugbus blocks */
+	const u32 *debugbus_blocks;
+	/* debugbus_blocks_len : Length of the debugbus list */
+	size_t debugbus_blocks_len;
+	/* gbif_debugbus_blocks : List of GBIF debugbus blocks */
+	const u32 *gbif_debugbus_blocks;
+	/* gbif_debugbus_blocks_len : Length of GBIF debugbus list */
+	size_t gbif_debugbus_blocks_len;
+	/* cx_debugbus_blocks : List of CX debugbus blocks */
+	const u32 *cx_debugbus_blocks;
+	/* cx_debugbus_blocks_len : Length of the CX debugbus list */
+	size_t cx_debugbus_blocks_len;
+	/* external_core_regs : List of external core registers */
+	const u32 **external_core_regs;
+	/* num_external_core_regs : length of external core registers list */
+	size_t num_external_core_regs;
+	/* gmu_regs : List of GMU registers */
+	const u32 *gmu_regs;
+	/* gmu_gx_regs : List of GMU GX registers */
+	const u32 *gmu_gx_regs;
+	/* rscc_regs : List of RSCC registers */
+	const u32 *rscc_regs;
+	/* reg_list : List of GPU internal registers */
+	struct gen7_reg_list *reg_list;
+	/* reg_list : List of cx_misc registers */
+	const u32 *cx_misc_regs;
+	/* shader_blocks : List of GPU shader memory */
+	struct gen7_shader_block *shader_blocks;
+	/* num_shader_blocks : Length of the shader memory list */
+	size_t num_shader_blocks;
+	/* cluster_registers : List of GPU cluster registers */
+	struct gen7_cluster_registers *clusters;
+	/* num_clusters : Length of GPU cluster registers list */
+	size_t num_clusters;
+	/* spstp_cluster_registers : List of GPU SPTP cluster registers */
+	struct gen7_sptp_cluster_registers *sptp_clusters;
+	/* num_sptp_clusters : Length of GPU SPTP cluster registers list */
+	size_t num_sptp_clusters;
+	/* post_crashdumper_regs : Registers which need to be dumped after CD runs */
+	const u32 *post_crashdumper_regs;
+	/* index_registers : List of index_registers */
+	struct gen7_cp_indexed_reg *index_registers;
+	/* index_registers_len : Length of the index registers */
+	size_t index_registers_len;
+};
+
+struct gen7_trace_buffer_info {
+	u16 dbgc_ctrl;
+	u16 segment;
+	u16 granularity;
+	u16 ping_blk[TRACE_BUF_NUM_SIG];
+	u16 ping_idx[TRACE_BUF_NUM_SIG];
+};
+
+enum gen7_debugbus_ids {
+	DEBUGBUS_CP_0_0           = 1,
+	DEBUGBUS_CP_0_1           = 2,
+	DEBUGBUS_RBBM             = 3,
+	DEBUGBUS_GBIF_GX          = 5,
+	DEBUGBUS_GBIF_CX          = 6,
+	DEBUGBUS_HLSQ             = 7,
+	DEBUGBUS_UCHE_0           = 9,
+	DEBUGBUS_UCHE_1           = 10,
+	DEBUGBUS_TESS_BR          = 13,
+	DEBUGBUS_TESS_BV          = 14,
+	DEBUGBUS_PC_BR            = 17,
+	DEBUGBUS_PC_BV            = 18,
+	DEBUGBUS_VFDP_BR          = 21,
+	DEBUGBUS_VFDP_BV          = 22,
+	DEBUGBUS_VPC_BR           = 25,
+	DEBUGBUS_VPC_BV           = 26,
+	DEBUGBUS_TSE_BR           = 29,
+	DEBUGBUS_TSE_BV           = 30,
+	DEBUGBUS_RAS_BR           = 33,
+	DEBUGBUS_RAS_BV           = 34,
+	DEBUGBUS_VSC              = 37,
+	DEBUGBUS_COM_0            = 39,
+	DEBUGBUS_LRZ_BR           = 43,
+	DEBUGBUS_LRZ_BV           = 44,
+	DEBUGBUS_UFC_0            = 47,
+	DEBUGBUS_UFC_1            = 48,
+	DEBUGBUS_GMU_GX           = 55,
+	DEBUGBUS_DBGC             = 59,
+	DEBUGBUS_CX               = 60,
+	DEBUGBUS_GMU_CX           = 61,
+	DEBUGBUS_GPC_BR           = 62,
+	DEBUGBUS_GPC_BV           = 63,
+	DEBUGBUS_LARC             = 66,
+	DEBUGBUS_HLSQ_SPTP        = 68,
+	DEBUGBUS_RB_0             = 70,
+	DEBUGBUS_RB_1             = 71,
+	DEBUGBUS_RB_2             = 72,
+	DEBUGBUS_RB_3             = 73,
+	DEBUGBUS_RB_4             = 74,
+	DEBUGBUS_RB_5             = 75,
+	DEBUGBUS_UCHE_WRAPPER     = 102,
+	DEBUGBUS_CCU_0            = 106,
+	DEBUGBUS_CCU_1            = 107,
+	DEBUGBUS_CCU_2            = 108,
+	DEBUGBUS_CCU_3            = 109,
+	DEBUGBUS_CCU_4            = 110,
+	DEBUGBUS_CCU_5            = 111,
+	DEBUGBUS_VFD_BR_0         = 138,
+	DEBUGBUS_VFD_BR_1         = 139,
+	DEBUGBUS_VFD_BR_2         = 140,
+	DEBUGBUS_VFD_BR_3         = 141,
+	DEBUGBUS_VFD_BR_4         = 142,
+	DEBUGBUS_VFD_BR_5         = 143,
+	DEBUGBUS_VFD_BR_6         = 144,
+	DEBUGBUS_VFD_BR_7         = 145,
+	DEBUGBUS_VFD_BV_0         = 202,
+	DEBUGBUS_VFD_BV_1         = 203,
+	DEBUGBUS_VFD_BV_2         = 204,
+	DEBUGBUS_VFD_BV_3         = 205,
+	DEBUGBUS_USP_0            = 234,
+	DEBUGBUS_USP_1            = 235,
+	DEBUGBUS_USP_2            = 236,
+	DEBUGBUS_USP_3            = 237,
+	DEBUGBUS_USP_4            = 238,
+	DEBUGBUS_USP_5            = 239,
+	DEBUGBUS_TP_0             = 266,
+	DEBUGBUS_TP_1             = 267,
+	DEBUGBUS_TP_2             = 268,
+	DEBUGBUS_TP_3             = 269,
+	DEBUGBUS_TP_4             = 270,
+	DEBUGBUS_TP_5             = 271,
+	DEBUGBUS_TP_6             = 272,
+	DEBUGBUS_TP_7             = 273,
+	DEBUGBUS_TP_8             = 274,
+	DEBUGBUS_TP_9             = 275,
+	DEBUGBUS_TP_10            = 276,
+	DEBUGBUS_TP_11            = 277,
+	DEBUGBUS_USPTP_0          = 330,
+	DEBUGBUS_USPTP_1          = 331,
+	DEBUGBUS_USPTP_2          = 332,
+	DEBUGBUS_USPTP_3          = 333,
+	DEBUGBUS_USPTP_4          = 334,
+	DEBUGBUS_USPTP_5          = 335,
+	DEBUGBUS_USPTP_6          = 336,
+	DEBUGBUS_USPTP_7          = 337,
+	DEBUGBUS_USPTP_8          = 338,
+	DEBUGBUS_USPTP_9          = 339,
+	DEBUGBUS_USPTP_10         = 340,
+	DEBUGBUS_USPTP_11         = 341,
+	DEBUGBUS_CCHE_0           = 396,
+	DEBUGBUS_CCHE_1           = 397,
+	DEBUGBUS_CCHE_2           = 398,
+	DEBUGBUS_VPC_DSTR_0       = 408,
+	DEBUGBUS_VPC_DSTR_1       = 409,
+	DEBUGBUS_VPC_DSTR_2       = 410,
+	DEBUGBUS_HLSQ_DP_STR_0    = 411,
+	DEBUGBUS_HLSQ_DP_STR_1    = 412,
+	DEBUGBUS_HLSQ_DP_STR_2    = 413,
+	DEBUGBUS_HLSQ_DP_STR_3    = 414,
+	DEBUGBUS_HLSQ_DP_STR_4    = 415,
+	DEBUGBUS_HLSQ_DP_STR_5    = 416,
+	DEBUGBUS_UFC_DSTR_0       = 443,
+	DEBUGBUS_UFC_DSTR_1       = 444,
+	DEBUGBUS_UFC_DSTR_2       = 445,
+	DEBUGBUS_CGC_SUBCORE      = 446,
+	DEBUGBUS_CGC_CORE         = 447,
+};
+
+static const u32 gen7_gbif_debugbus_blocks[] = {
+	DEBUGBUS_GBIF_CX,
+	DEBUGBUS_GBIF_GX,
+};
+
+static const u32 gen7_cx_dbgc_debugbus_blocks[] = {
+	DEBUGBUS_GMU_CX,
+	DEBUGBUS_CX,
+	DEBUGBUS_GBIF_CX,
+};
+
+enum gen7_statetype_ids {
+	TP0_NCTX_REG                   = 0,
+	TP0_CTX0_3D_CVS_REG            = 1,
+	TP0_CTX0_3D_CPS_REG            = 2,
+	TP0_CTX1_3D_CVS_REG            = 3,
+	TP0_CTX1_3D_CPS_REG            = 4,
+	TP0_CTX2_3D_CPS_REG            = 5,
+	TP0_CTX3_3D_CPS_REG            = 6,
+	TP0_TMO_DATA                   = 9,
+	TP0_SMO_DATA                   = 10,
+	TP0_MIPMAP_BASE_DATA           = 11,
+	SP_NCTX_REG                    = 32,
+	SP_CTX0_3D_CVS_REG             = 33,
+	SP_CTX0_3D_CPS_REG             = 34,
+	SP_CTX1_3D_CVS_REG             = 35,
+	SP_CTX1_3D_CPS_REG             = 36,
+	SP_CTX2_3D_CPS_REG             = 37,
+	SP_CTX3_3D_CPS_REG             = 38,
+	SP_INST_DATA                   = 39,
+	SP_INST_DATA_1                 = 40,
+	SP_LB_0_DATA                   = 41,
+	SP_LB_1_DATA                   = 42,
+	SP_LB_2_DATA                   = 43,
+	SP_LB_3_DATA                   = 44,
+	SP_LB_4_DATA                   = 45,
+	SP_LB_5_DATA                   = 46,
+	SP_LB_6_DATA                   = 47,
+	SP_LB_7_DATA                   = 48,
+	SP_CB_RAM                      = 49,
+	SP_LB_13_DATA                  = 50,
+	SP_LB_14_DATA                  = 51,
+	SP_INST_TAG                    = 52,
+	SP_INST_DATA_2                 = 53,
+	SP_TMO_TAG                     = 54,
+	SP_SMO_TAG                     = 55,
+	SP_STATE_DATA                  = 56,
+	SP_HWAVE_RAM                   = 57,
+	SP_L0_INST_BUF                 = 58,
+	SP_LB_8_DATA                   = 59,
+	SP_LB_9_DATA                   = 60,
+	SP_LB_10_DATA                  = 61,
+	SP_LB_11_DATA                  = 62,
+	SP_LB_12_DATA                  = 63,
+	HLSQ_DATAPATH_DSTR_META        = 64,
+	HLSQ_L2STC_TAG_RAM             = 67,
+	HLSQ_L2STC_INFO_CMD            = 68,
+	HLSQ_CVS_BE_CTXT_BUF_RAM_TAG   = 69,
+	HLSQ_CPS_BE_CTXT_BUF_RAM_TAG   = 70,
+	HLSQ_GFX_CVS_BE_CTXT_BUF_RAM   = 71,
+	HLSQ_GFX_CPS_BE_CTXT_BUF_RAM   = 72,
+	HLSQ_CHUNK_CVS_RAM             = 73,
+	HLSQ_CHUNK_CPS_RAM             = 74,
+	HLSQ_CHUNK_CVS_RAM_TAG         = 75,
+	HLSQ_CHUNK_CPS_RAM_TAG         = 76,
+	HLSQ_ICB_CVS_CB_BASE_TAG       = 77,
+	HLSQ_ICB_CPS_CB_BASE_TAG       = 78,
+	HLSQ_CVS_MISC_RAM              = 79,
+	HLSQ_CPS_MISC_RAM              = 80,
+	HLSQ_CPS_MISC_RAM_1            = 81,
+	HLSQ_INST_RAM                  = 82,
+	HLSQ_GFX_CVS_CONST_RAM         = 83,
+	HLSQ_GFX_CPS_CONST_RAM         = 84,
+	HLSQ_CVS_MISC_RAM_TAG          = 85,
+	HLSQ_CPS_MISC_RAM_TAG          = 86,
+	HLSQ_INST_RAM_TAG              = 87,
+	HLSQ_GFX_CVS_CONST_RAM_TAG     = 88,
+	HLSQ_GFX_CPS_CONST_RAM_TAG     = 89,
+	HLSQ_GFX_LOCAL_MISC_RAM        = 90,
+	HLSQ_GFX_LOCAL_MISC_RAM_TAG    = 91,
+	HLSQ_INST_RAM_1                = 92,
+	HLSQ_STPROC_META               = 93,
+	HLSQ_BV_BE_META                = 94,
+	HLSQ_INST_RAM_2                = 95,
+	HLSQ_DATAPATH_META             = 96,
+	HLSQ_FRONTEND_META             = 97,
+	HLSQ_INDIRECT_META             = 98,
+	HLSQ_BACKEND_META              = 99,
+};
+
+static struct gen7_cp_indexed_reg gen7_cp_indexed_reg_list[] = {
+	{ GEN7_CP_SQE_STAT_ADDR, GEN7_CP_SQE_STAT_DATA, 0x40},
+	{ GEN7_CP_DRAW_STATE_ADDR, GEN7_CP_DRAW_STATE_DATA, 0x100},
+	{ GEN7_CP_SQE_UCODE_DBG_ADDR, GEN7_CP_SQE_UCODE_DBG_DATA, 0x8000},
+	{ GEN7_CP_BV_SQE_STAT_ADDR, GEN7_CP_BV_SQE_STAT_DATA, 0x40},
+	{ GEN7_CP_BV_DRAW_STATE_ADDR, GEN7_CP_BV_DRAW_STATE_DATA, 0x100},
+	{ GEN7_CP_BV_SQE_UCODE_DBG_ADDR, GEN7_CP_BV_SQE_UCODE_DBG_DATA, 0x8000},
+	{ GEN7_CP_SQE_AC_STAT_ADDR, GEN7_CP_SQE_AC_STAT_DATA, 0x40},
+	{ GEN7_CP_LPAC_DRAW_STATE_ADDR, GEN7_CP_LPAC_DRAW_STATE_DATA, 0x100},
+	{ GEN7_CP_SQE_AC_UCODE_DBG_ADDR, GEN7_CP_SQE_AC_UCODE_DBG_DATA, 0x8000},
+	{ GEN7_CP_LPAC_FIFO_DBG_ADDR, GEN7_CP_LPAC_FIFO_DBG_DATA, 0x40},
+};
+#endif /*_ADRENO_GEN7_SNAPSHOT_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_hfi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_hfi.h
@@ -0,0 +1,1354 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_HFI_H
+#define __ADRENO_HFI_H
+
+#include "kgsl_util.h"
+
+#define HW_FENCE_QUEUE_SIZE		SZ_4K
+#define HFI_QUEUE_SIZE			SZ_4K /* bytes, must be base 4dw */
+#define MAX_RCVD_PAYLOAD_SIZE		16 /* dwords */
+#define MAX_RCVD_SIZE			(MAX_RCVD_PAYLOAD_SIZE + 3) /* dwords */
+#define HFI_MAX_MSG_SIZE		(SZ_1K)
+
+#define HFI_CMD_ID 0
+#define HFI_MSG_ID 1
+#define HFI_DBG_ID 2
+#define HFI_DSP_ID_0 3
+
+#define HFI_CMD_IDX 0
+#define HFI_MSG_IDX 1
+#define HFI_DBG_IDX 2
+#define HFI_DSP_IDX_BASE 3
+#define HFI_DSP_IDX_0 3
+
+#define HFI_CMD_IDX_LEGACY 0
+#define HFI_DSP_IDX_0_LEGACY 1
+#define HFI_MSG_IDX_LEGACY 4
+#define HFI_DBG_IDX_LEGACY 5
+
+#define HFI_QUEUE_STATUS_DISABLED 0
+#define HFI_QUEUE_STATUS_ENABLED 1
+
+/* HTOF queue priority, 1 is highest priority */
+#define HFI_CMD_PRI 10
+#define HFI_MSG_PRI 10
+#define HFI_DBG_PRI 40
+#define HFI_DSP_PRI_0 20
+
+#define HFI_IRQ_SIDEMSGQ_MASK		BIT(1)
+#define HFI_IRQ_DBGQ_MASK		BIT(2)
+#define HFI_IRQ_CM3_FAULT_MASK		BIT(15)
+#define HFI_IRQ_OOB_MASK		GENMASK(31, 16)
+#define HFI_IRQ_MASK			(HFI_IRQ_SIDEMSGQ_MASK |\
+					HFI_IRQ_DBGQ_MASK |\
+					HFI_IRQ_CM3_FAULT_MASK)
+
+#define DCVS_ACK_NONBLOCK 0
+#define DCVS_ACK_BLOCK 1
+
+#define HFI_FEATURE_DCVS	0
+#define HFI_FEATURE_HWSCHED	1
+#define HFI_FEATURE_PREEMPTION	2
+#define HFI_FEATURE_CLOCKS_ON	3
+#define HFI_FEATURE_BUS_ON	4
+#define HFI_FEATURE_RAIL_ON	5
+#define HFI_FEATURE_HWCG	6
+#define HFI_FEATURE_LM		7
+#define HFI_FEATURE_THROTTLE	8
+#define HFI_FEATURE_IFPC	9
+#define HFI_FEATURE_NAP		10
+#define HFI_FEATURE_BCL		11
+#define HFI_FEATURE_ACD		12
+#define HFI_FEATURE_DIDT	13
+#define HFI_FEATURE_DEPRECATED	14
+#define HFI_FEATURE_CB		15
+#define HFI_FEATURE_KPROF	16
+#define HFI_FEATURE_BAIL_OUT_TIMER	17
+#define HFI_FEATURE_GMU_STATS	18
+#define HFI_FEATURE_DBQ		19
+#define HFI_FEATURE_MINBW	20
+#define HFI_FEATURE_CLX		21
+#define HFI_FEATURE_LSR		23
+#define HFI_FEATURE_LPAC	24
+#define HFI_FEATURE_HW_FENCE	25
+#define HFI_FEATURE_PERF_NORETAIN	26
+#define HFI_FEATURE_DMS		27
+#define HFI_FEATURE_AQE		29
+
+/* Types to be used with H2F_MSG_TABLE */
+enum hfi_table_type {
+	HFI_TABLE_BW_VOTE	= 0,
+	HFI_TABLE_GPU_PERF	= 1,
+	HFI_TABLE_DIDT		= 2,
+	HFI_TABLE_ACD		= 3,
+	HFI_TABLE_CLX_V1	= 4,
+	HFI_TABLE_CLX_V2	= 5,
+	HFI_TABLE_THERM		= 6,
+	HFI_TABLE_DCVS_DATA	= 7,
+	HFI_TABLE_MAX,
+};
+
+/* A6xx uses a different value for KPROF */
+#define HFI_FEATURE_A6XX_KPROF	14
+
+#define HFI_VALUE_FT_POLICY		100
+#define HFI_VALUE_RB_MAX_CMDS		101
+#define HFI_VALUE_CTX_MAX_CMDS		102
+#define HFI_VALUE_ADDRESS		103
+#define HFI_VALUE_MAX_GPU_PERF_INDEX	104
+#define HFI_VALUE_MIN_GPU_PERF_INDEX	105
+#define HFI_VALUE_MAX_BW_PERF_INDEX	106
+#define HFI_VALUE_MIN_BW_PERF_INDEX	107
+#define HFI_VALUE_MAX_GPU_THERMAL_INDEX	108
+#define HFI_VALUE_GPUCLK		109
+#define HFI_VALUE_CLK_TIME		110
+#define HFI_VALUE_LOG_GROUP		111
+#define HFI_VALUE_LOG_EVENT_ON		112
+#define HFI_VALUE_LOG_EVENT_OFF		113
+#define HFI_VALUE_DCVS_OBJ		114
+#define HFI_VALUE_LM_CS0		115
+#define HFI_VALUE_DBG			116
+#define HFI_VALUE_BIN_TIME		117
+#define HFI_VALUE_LOG_STREAM_ENABLE	119
+#define HFI_VALUE_PREEMPT_COUNT		120
+#define HFI_VALUE_CONTEXT_QUEUE		121
+#define HFI_VALUE_GMU_AB_VOTE		122
+#define HFI_VALUE_RB_GPU_QOS		123
+#define HFI_VALUE_RB_IB_RULE		124
+#define HFI_VALUE_GMU_WARMBOOT		125
+#define HFI_VALUE_GLOBAL_TOKEN		0xFFFFFFFF
+
+#define HFI_CTXT_FLAG_PMODE			BIT(0)
+#define HFI_CTXT_FLAG_SWITCH_INTERNAL		BIT(1)
+#define HFI_CTXT_FLAG_SWITCH			BIT(3)
+#define HFI_CTXT_FLAG_NOTIFY			BIT(5)
+#define HFI_CTXT_FLAG_NO_FAULT_TOLERANCE	BIT(9)
+#define HFI_CTXT_FLAG_PWR_RULE			BIT(11)
+#define HFI_CTXT_FLAG_PRIORITY_MASK		GENMASK(15, 12)
+#define HFI_CTXT_FLAG_IFH_NOP			BIT(16)
+#define HFI_CTXT_FLAG_SECURE			BIT(17)
+#define HFI_CTXT_FLAG_TYPE_MASK			GENMASK(24, 20)
+#define HFI_CTXT_FLAG_TYPE_ANY			0
+#define HFI_CTXT_FLAG_TYPE_GL			1
+#define HFI_CTXT_FLAG_TYPE_CL			2
+#define HFI_CTXT_FLAG_TYPE_C2D			3
+#define HFI_CTXT_FLAG_TYPE_RS			4
+#define HFI_CTXT_FLAG_TYPE_VK			5
+#define HFI_CTXT_FLAG_TYPE_UNKNOWN		0x1e
+#define HFI_CTXT_FLAG_PREEMPT_STYLE_MASK	GENMASK(27, 25)
+#define HFI_CTXT_FLAG_PREEMPT_STYLE_ANY		0
+#define HFI_CTXT_FLAG_PREEMPT_STYLE_RB		1
+#define HFI_CTXT_FLAG_PREEMPT_STYLE_FG		2
+
+/* Default sampling interval in units of 50 us */
+#define HFI_FEATURE_GMU_STATS_INTERVAL		4
+
+enum hfi_mem_kind {
+	/** @HFI_MEMKIND_GENERIC: Used for requesting generic memory */
+	HFI_MEMKIND_GENERIC = 0,
+	/** @HFI_MEMKIND_RB: Used for requesting ringbuffer memory */
+	HFI_MEMKIND_RB,
+	/** @HFI_MEMKIND_SCRATCH: Used for requesting scratch memory */
+	HFI_MEMKIND_SCRATCH,
+	/**
+	 * @HFI_MEMKIND_CSW_SMMU_INFO: Used for requesting SMMU record for
+	 * preemption context switching
+	 */
+	HFI_MEMKIND_CSW_SMMU_INFO,
+	/**
+	 * @HFI_MEMKIND_CSW_PRIV_NON_SECURE: Used for requesting privileged non
+	 * secure preemption records
+	 */
+	HFI_MEMKIND_CSW_PRIV_NON_SECURE,
+	/**
+	 * @HFI_MEMKIND_CSW_PRIV_SECURE: Used for requesting privileged secure
+	 * preemption records
+	 */
+	HFI_MEMKIND_CSW_PRIV_SECURE,
+	/**
+	 * @HFI_MEMKIND_CSW_NON_PRIV: Used for requesting non privileged per
+	 * context preemption buffer
+	 */
+	HFI_MEMKIND_CSW_NON_PRIV,
+	/**
+	 * @HFI_MEMKIND_CSW_COUNTER: Used for requesting preemption performance
+	 * counter save/restore buffer
+	 */
+	HFI_MEMKIND_CSW_COUNTER,
+	/**
+	 * @HFI_MEMKIND_CTXTREC_PREEMPT_CNTR: Used for requesting preemption
+	 * counter buffer
+	 */
+	HFI_MEMKIND_CTXTREC_PREEMPT_CNTR,
+	/** @HFI_MEMKIND_SYSLOG: Used for requesting system log memory */
+	HFI_MEMKIND_SYS_LOG,
+	/** @HFI_MEMKIND_CRASH_DUMP: Used for requesting carsh dumper memory */
+	HFI_MEMKIND_CRASH_DUMP,
+	/**
+	 * @HFI_MEMKIND_MMIO_DPU: Used for requesting Display processing unit's
+	 * register space
+	 */
+	HFI_MEMKIND_MMIO_DPU,
+	/**
+	 * @HFI_MEMKIND_MMIO_TCSR: Used for requesting Top CSR(contains SoC
+	 * doorbells) register space
+	 */
+	HFI_MEMKIND_MMIO_TCSR,
+	/**
+	 * @HFI_MEMKIND_MMIO_QDSS_STM: Used for requesting QDSS STM register
+	 * space
+	 */
+	HFI_MEMKIND_MMIO_QDSS_STM,
+	/** @HFI_MEMKIND_PROFILE: Used for kernel profiling */
+	HFI_MEMKIND_PROFILE,
+	/** @HFI_MEMKIND_USER_PROFILING_IBS: Used for user profiling */
+	HFI_MEMKIND_USER_PROFILE_IBS,
+	/** @MEMKIND_CMD_BUFFER: Used for composing ringbuffer content */
+	HFI_MEMKIND_CMD_BUFFER,
+	/**
+	 * @HFI_MEMKIND_GPU_BUSY_DATA_BUFFER: Used for GPU busy buffer for
+	 * all the contexts
+	 */
+	HFI_MEMKIND_GPU_BUSY_DATA_BUFFER,
+	/** @HFI_MEMKIND_GPU_BUSY_CMD_BUFFER: Used for GPU busy cmd buffer
+	 * (Only readable to GPU)
+	 */
+	HFI_MEMKIND_GPU_BUSY_CMD_BUFFER,
+	/**
+	 *@MEMKIND_MMIO_IPC_CORE: Used for IPC_core region mapping to GMU space
+	 * for EVA to GPU communication.
+	 */
+	HFI_MEMKIND_MMIO_IPC_CORE,
+	/** @HFIMEMKIND_MMIO_IPCC_AOSS: Used for IPCC AOSS, second memory region */
+	HFI_MEMKIND_MMIO_IPCC_AOSS,
+	/**
+	 * @MEMKIND_CSW_LPAC_PRIV_NON_SECURE: Used for privileged nonsecure
+	 * memory for LPAC context record
+	 */
+	HFI_MEMKIND_CSW_LPAC_PRIV_NON_SECURE,
+	/** @HFI_MEMKIND_MEMSTORE: Buffer used to query a context's GPU sop/eop timestamps */
+	HFI_MEMKIND_MEMSTORE,
+	/** @HFI_MEMKIND_HW_FENCE:  Hardware fence Tx/Rx headers and queues */
+	HFI_MEMKIND_HW_FENCE,
+	/** @HFI_MEMKIND_PREEMPT_SCRATCH: Used for Preemption scratch memory */
+	HFI_MEMKIND_PREEMPT_SCRATCH,
+	/**
+	 * @HFI_MEMKIND_AQE_BUFFER: Sandbox memory used by AQE to switch
+	 * between LPAC and GC
+	 */
+	HFI_MEMKIND_AQE_BUFFER,
+	HFI_MEMKIND_MAX,
+};
+
+static const char * const hfi_memkind_strings[] = {
+	[HFI_MEMKIND_GENERIC] = "GMU GENERIC",
+	[HFI_MEMKIND_RB] = "GMU RB",
+	[HFI_MEMKIND_SCRATCH] = "GMU SCRATCH",
+	[HFI_MEMKIND_CSW_SMMU_INFO] = "GMU SMMU INFO",
+	[HFI_MEMKIND_CSW_PRIV_NON_SECURE] = "GMU CSW PRIV NON SECURE",
+	[HFI_MEMKIND_CSW_PRIV_SECURE] = "GMU CSW PRIV SECURE",
+	[HFI_MEMKIND_CSW_NON_PRIV] = "GMU CSW NON PRIV",
+	[HFI_MEMKIND_CSW_COUNTER] = "GMU CSW COUNTER",
+	[HFI_MEMKIND_CTXTREC_PREEMPT_CNTR] = "GMU PREEMPT CNTR",
+	[HFI_MEMKIND_SYS_LOG] = "GMU SYS LOG",
+	[HFI_MEMKIND_CRASH_DUMP] = "GMU CRASHDUMP",
+	[HFI_MEMKIND_MMIO_DPU] = "GMU MMIO DPU",
+	[HFI_MEMKIND_MMIO_TCSR] = "GMU MMIO TCSR",
+	[HFI_MEMKIND_MMIO_QDSS_STM] = "GMU MMIO QDSS STM",
+	[HFI_MEMKIND_PROFILE] = "GMU KERNEL PROFILING",
+	[HFI_MEMKIND_USER_PROFILE_IBS] = "GMU USER PROFILING",
+	[HFI_MEMKIND_CMD_BUFFER] = "GMU CMD BUFFER",
+	[HFI_MEMKIND_GPU_BUSY_DATA_BUFFER] = "GMU BUSY DATA BUFFER",
+	[HFI_MEMKIND_GPU_BUSY_CMD_BUFFER] = "GMU BUSY CMD BUFFER",
+	[HFI_MEMKIND_MMIO_IPC_CORE] = "GMU MMIO IPC",
+	[HFI_MEMKIND_MMIO_IPCC_AOSS] = "GMU MMIO IPCC AOSS",
+	[HFI_MEMKIND_CSW_LPAC_PRIV_NON_SECURE] = "GMU CSW LPAC PRIV NON SECURE",
+	[HFI_MEMKIND_MEMSTORE] = "GMU MEMSTORE",
+	[HFI_MEMKIND_HW_FENCE] = "GMU HW FENCE",
+	[HFI_MEMKIND_PREEMPT_SCRATCH] = "GMU PREEMPTION",
+	[HFI_MEMKIND_AQE_BUFFER] = "GMU AQE BUFFER",
+	[HFI_MEMKIND_MAX] = "GMU UNKNOWN",
+};
+
+/* CP/GFX pipeline can access */
+#define HFI_MEMFLAG_GFX_ACC		BIT(0)
+
+/* Buffer has APRIV protection in GFX PTEs */
+#define HFI_MEMFLAG_GFX_PRIV		BIT(1)
+
+/* Buffer is read-write for GFX PTEs. A 0 indicates read-only */
+#define HFI_MEMFLAG_GFX_WRITEABLE	BIT(2)
+
+/* GMU can access */
+#define HFI_MEMFLAG_GMU_ACC		BIT(3)
+
+/* Buffer has APRIV protection in GMU PTEs */
+#define HFI_MEMFLAG_GMU_PRIV		BIT(4)
+
+/* Buffer is read-write for GMU PTEs. A 0 indicates read-only */
+#define HFI_MEMFLAG_GMU_WRITEABLE	BIT(5)
+
+/* Buffer is located in GMU's non-cached bufferable VA range */
+#define HFI_MEMFLAG_GMU_BUFFERABLE	BIT(6)
+
+/* Buffer is located in GMU's cacheable VA range */
+#define HFI_MEMFLAG_GMU_CACHEABLE	BIT(7)
+
+/* Host can access */
+#define HFI_MEMFLAG_HOST_ACC		BIT(8)
+
+/* Host initializes(zero-init) the buffer */
+#define HFI_MEMFLAG_HOST_INIT		BIT(9)
+
+/* Gfx buffer needs to be secure */
+#define HFI_MEMFLAG_GFX_SECURE		BIT(12)
+
+/**
+ * struct hfi_queue_table_header - HFI queue table structure
+ * @version: HFI protocol version
+ * @size: queue table size in dwords
+ * @qhdr0_offset: first queue header offset (dwords) in this table
+ * @qhdr_size: queue header size
+ * @num_q: number of queues defined in this table
+ * @num_active_q: number of active queues
+ */
+struct hfi_queue_table_header {
+	u32 version;
+	u32 size;
+	u32 qhdr0_offset;
+	u32 qhdr_size;
+	u32 num_q;
+	u32 num_active_q;
+} __packed;
+
+/**
+ * struct gmu_context_queue_header - GMU context queue header structure
+ */
+struct gmu_context_queue_header {
+	/** @version: Version of the header */
+	u32 version;
+	/** @start_addr: GMU VA of start of the queue */
+	u32 start_addr;
+	/** @queue_size: queue size in dwords */
+	u32 queue_size;
+	/** @out_fence_ts: Timestamp of last hardware fence sent to Tx Queue */
+	volatile u32 out_fence_ts;
+	/** @sync_obj_ts: Timestamp of last sync object that GMU has digested */
+	volatile u32 sync_obj_ts;
+	/** @read_index: Read index of the queue */
+	volatile u32 read_index;
+	/** @write_index: Write index of the queue */
+	volatile u32 write_index;
+	/**
+	 * @hw_fence_buffer_va: GMU VA of the buffer to store output hardware fences for this
+	 * context
+	 */
+	u32 hw_fence_buffer_va;
+	/**
+	 * @hw_fence_buffer_size: Size of the buffer to store output hardware fences for this
+	 * context
+	 */
+	u32 hw_fence_buffer_size;
+	u32 unused1;
+	u32 unused2;
+	u32 unused3;
+} __packed;
+
+/**
+ * struct hfi_queue_header - HFI queue header structure
+ * @status: active: 1; inactive: 0
+ * @start_addr: starting address of the queue in GMU VA space
+ * @type: queue type encoded the priority, ID and send/recevie types
+ * @queue_size: size of the queue
+ * @msg_size: size of the message if each message has fixed size.
+ *	Otherwise, 0 means variable size of message in the queue.
+ * @read_index: read index of the queue
+ * @write_index: write index of the queue
+ */
+struct hfi_queue_header {
+	u32 status;
+	u32 start_addr;
+	u32 type;
+	u32 queue_size;
+	u32 msg_size;
+	u32 unused0;
+	u32 unused1;
+	u32 unused2;
+	u32 unused3;
+	u32 unused4;
+	volatile u32 read_index;
+	volatile u32 write_index;
+} __packed;
+
+#define HFI_MSG_CMD 0 /* V1 and V2 */
+#define HFI_MSG_ACK 1 /* V2 only */
+
+ /* Used to NOP a command when executing warmboot sequence */
+#define HFI_MSG_NOP BIT(18)
+ /* Used to record a command when executing coldboot sequence */
+#define HFI_MSG_RECORD BIT(19)
+
+#define HFI_V1_MSG_POST 1 /* V1 only */
+#define HFI_V1_MSG_ACK 2/* V1 only */
+
+#define MSG_HDR_SET_SIZE(hdr, size) \
+	(((size & 0xFF) << 8) | hdr)
+
+#define CREATE_MSG_HDR(id, type) \
+	(((type) << 16) | ((id) & 0xFF))
+
+#define ACK_MSG_HDR(id) CREATE_MSG_HDR(id, HFI_MSG_ACK)
+
+#define HFI_QUEUE_DEFAULT_CNT 3
+#define HFI_QUEUE_DISPATCH_MAX_CNT 14
+#define HFI_QUEUE_HDR_MAX (HFI_QUEUE_DEFAULT_CNT + HFI_QUEUE_DISPATCH_MAX_CNT)
+
+struct hfi_queue_table {
+	struct hfi_queue_table_header qtbl_hdr;
+	struct hfi_queue_header qhdr[HFI_QUEUE_HDR_MAX];
+} __packed;
+
+#define HFI_QUEUE_OFFSET(i) \
+		(ALIGN(sizeof(struct hfi_queue_table), SZ_16) + \
+		((i) * HFI_QUEUE_SIZE))
+
+#define GMU_QUEUE_START_ADDR(gmuaddr, i) \
+	(gmuaddr + HFI_QUEUE_OFFSET(i))
+
+#define HOST_QUEUE_START_ADDR(hfi_mem, i) \
+	((hfi_mem)->hostptr + HFI_QUEUE_OFFSET(i))
+
+#define MSG_HDR_GET_ID(hdr) ((hdr) & 0xFF)
+#define MSG_HDR_GET_SIZE(hdr) (((hdr) >> 8) & 0xFF)
+#define MSG_HDR_GET_TYPE(hdr) (((hdr) >> 16) & 0xF)
+#define MSG_HDR_GET_SEQNUM(hdr) (((hdr) >> 20) & 0xFFF)
+
+/* Clear the HFI_MSG_RECORD bit from both headers since some acks may have it set, and some not. */
+#define CMP_HFI_ACK_HDR(sent, rcvd) ((sent &= ~HFI_MSG_RECORD) == (rcvd &= ~HFI_MSG_RECORD))
+
+#define MSG_HDR_SET_SEQNUM(hdr, num) \
+	(((hdr) & 0xFFFFF) | ((num) << 20))
+
+#define MSG_HDR_SET_SEQNUM_SIZE(hdr, seqnum, sizedwords) \
+	(FIELD_PREP(GENMASK(31, 20), seqnum) | FIELD_PREP(GENMASK(15, 8), sizedwords) | hdr)
+
+#define MSG_HDR_SET_TYPE(hdr, type) \
+	(((hdr) & 0xFFFFF) | ((type) << 16))
+
+#define QUEUE_HDR_TYPE(id, prio, rtype, stype) \
+	(((id) & 0xFF) | (((prio) & 0xFF) << 8) | \
+	(((rtype) & 0xFF) << 16) | (((stype) & 0xFF) << 24))
+
+#define HFI_RSP_TIMEOUT 1000 /* msec */
+
+#define HFI_IRQ_MSGQ_MASK BIT(0)
+
+enum hfi_msg_type {
+	H2F_MSG_INIT			= 0,
+	H2F_MSG_FW_VER			= 1,
+	H2F_MSG_LM_CFG			= 2,
+	H2F_MSG_BW_VOTE_TBL		= 3,
+	H2F_MSG_PERF_TBL		= 4,
+	H2F_MSG_TEST			= 5,
+	H2F_MSG_ACD_TBL			= 7,
+	H2F_MSG_CLX_TBL			= 8,
+	H2F_MSG_START			= 10,
+	H2F_MSG_FEATURE_CTRL		= 11,
+	H2F_MSG_GET_VALUE		= 12,
+	H2F_MSG_SET_VALUE		= 13,
+	H2F_MSG_CORE_FW_START		= 14,
+	H2F_MSG_TABLE			= 15,
+	F2H_MSG_MEM_ALLOC		= 20,
+	H2F_MSG_GX_BW_PERF_VOTE		= 30,
+	H2F_MSG_FW_HALT			= 32,
+	H2F_MSG_PREPARE_SLUMBER		= 33,
+	F2H_MSG_ERR			= 100,
+	F2H_MSG_DEBUG			= 101,
+	F2H_MSG_LOG_BLOCK		= 102,
+	F2H_MSG_GMU_CNTR_REGISTER	= 110,
+	F2H_MSG_GMU_CNTR_RELEASE	= 111,
+	F2H_MSG_ACK			= 126, /* Deprecated for v2.0*/
+	H2F_MSG_ACK			= 127, /* Deprecated for v2.0*/
+	H2F_MSG_REGISTER_CONTEXT	= 128,
+	H2F_MSG_UNREGISTER_CONTEXT	= 129,
+	H2F_MSG_ISSUE_CMD		= 130,
+	H2F_MSG_ISSUE_CMD_RAW		= 131,
+	H2F_MSG_TS_NOTIFY		= 132,
+	F2H_MSG_TS_RETIRE		= 133,
+	H2F_MSG_CONTEXT_POINTERS	= 134,
+	H2F_MSG_ISSUE_LPAC_CMD_RAW	= 135,
+	H2F_MSG_CONTEXT_RULE		= 140, /* AKA constraint */
+	H2F_MSG_ISSUE_RECURRING_CMD	= 141,
+	F2H_MSG_CONTEXT_BAD		= 150,
+	H2F_MSG_HW_FENCE_INFO		= 151,
+	H2F_MSG_ISSUE_SYNCOBJ		= 152,
+	F2H_MSG_SYNCOBJ_QUERY		= 153,
+	H2F_MSG_WARMBOOT_CMD		= 154,
+	F2H_MSG_PROCESS_TRACE		= 155,
+	HFI_MAX_ID,
+};
+
+enum gmu_ret_type {
+	GMU_SUCCESS = 0,
+	GMU_ERROR_FATAL,
+	GMU_ERROR_MEM_FAIL,
+	GMU_ERROR_INVAL_PARAM,
+	GMU_ERROR_NULL_PTR,
+	GMU_ERROR_OUT_OF_BOUNDS,
+	GMU_ERROR_TIMEOUT,
+	GMU_ERROR_NOT_SUPPORTED,
+	GMU_ERROR_NO_ENTRY,
+};
+
+/* H2F */
+struct hfi_gmu_init_cmd {
+	u32 hdr;
+	u32 seg_id;
+	u32 dbg_buffer_addr;
+	u32 dbg_buffer_size;
+	u32 boot_state;
+} __packed;
+
+/* H2F */
+struct hfi_fw_version_cmd {
+	u32 hdr;
+	u32 supported_ver;
+} __packed;
+
+/* H2F */
+struct hfi_bwtable_cmd {
+	u32 hdr;
+	u32 bw_level_num;
+	u32 cnoc_cmds_num;
+	u32 ddr_cmds_num;
+	u32 cnoc_wait_bitmask;
+	u32 ddr_wait_bitmask;
+	u32 cnoc_cmd_addrs[MAX_CNOC_CMDS];
+	u32 cnoc_cmd_data[MAX_CNOC_LEVELS][MAX_CNOC_CMDS];
+	u32 ddr_cmd_addrs[MAX_BW_CMDS];
+	u32 ddr_cmd_data[MAX_BW_LEVELS][MAX_BW_CMDS];
+} __packed;
+
+struct opp_gx_desc {
+	u32 vote;
+	/* This is 'acdLvl' in gmu fw which is now repurposed for cx vote */
+	u32 cx_vote;
+	u32 freq;
+} __packed;
+
+struct opp_desc {
+	u32 vote;
+	u32 freq;
+} __packed;
+
+/* H2F */
+struct hfi_dcvstable_v1_cmd {
+	u32 hdr;
+	u32 gpu_level_num;
+	u32 gmu_level_num;
+	struct opp_desc gx_votes[MAX_GX_LEVELS_LEGACY];
+	struct opp_desc cx_votes[MAX_CX_LEVELS];
+} __packed;
+
+/* H2F */
+struct hfi_dcvstable_cmd {
+	u32 hdr;
+	u32 gpu_level_num;
+	u32 gmu_level_num;
+	struct opp_gx_desc gx_votes[MAX_GX_LEVELS_LEGACY];
+	struct opp_desc cx_votes[MAX_CX_LEVELS];
+} __packed;
+
+/* H2F */
+struct hfi_table_entry {
+	u32 count;
+	u32 stride;
+	u32 data[];
+} __packed;
+
+struct hfi_table_cmd {
+	u32 hdr;
+	u32 version;
+	u32 type;
+	struct hfi_table_entry entry[];
+} __packed;
+
+#define MAX_ACD_STRIDE 2
+#define MAX_ACD_NUM_LEVELS KGSL_MAX_PWRLEVELS
+
+/* H2F */
+struct hfi_acd_table_cmd {
+	u32 hdr;
+	u32 version;
+	u32 enable_by_level;
+	u32 stride;
+	u32 num_levels;
+	u32 data[MAX_ACD_NUM_LEVELS * MAX_ACD_STRIDE];
+} __packed;
+
+#define CLX_DOMAINS_V2 2
+struct clx_domain_v2 {
+	/**
+	 * @data0: bits[0:15]  Migration time
+	 *         bits[16:21] Current rating
+	 *         bits[22:27] Phases for domain
+	 *         bits[28:28] Path notifications
+	 *         bits[29:31] Extra feature bits
+	 */
+	u32 data0;
+	/** @clxt: CLX time in microseconds */
+	u32 clxt;
+	/** @clxh: CLH time in microseconds */
+	u32 clxh;
+	/** @urgmode: Urgent HW throttle mode of operation */
+	u32 urgmode;
+	/** @lkgen: Enable leakage current estimate */
+	u32 lkgen;
+	/** @currbudget: Current Budget */
+	u32 currbudget;
+} __packed;
+
+/* H2F */
+struct hfi_clx_table_v2_cmd {
+	/** @hdr: HFI header message */
+	u32 hdr;
+	/** @version: Version identifier for the format used for domains */
+	u32 version;
+	/** @domain: GFX and MXC Domain information */
+	struct clx_domain_v2 domain[CLX_DOMAINS_V2];
+} __packed;
+
+/* H2F */
+struct hfi_test_cmd {
+	u32 hdr;
+	u32 data;
+} __packed;
+
+/* H2F */
+struct hfi_start_cmd {
+	u32 hdr;
+} __packed;
+
+/* H2F */
+struct hfi_feature_ctrl_cmd {
+	u32 hdr;
+	u32 feature;
+	u32 enable;
+	u32 data;
+} __packed;
+
+/* H2F */
+struct hfi_get_value_cmd {
+	u32 hdr;
+	u32 type;
+	u32 subtype;
+} __packed;
+
+/* Internal */
+struct hfi_get_value_req {
+	struct hfi_get_value_cmd cmd;
+	u32 data[16];
+} __packed;
+
+/* F2H */
+struct hfi_get_value_reply_cmd {
+	u32 hdr;
+	u32 req_hdr;
+	u32 data[16];
+} __packed;
+
+/* H2F */
+struct hfi_set_value_cmd {
+	u32 hdr;
+	u32 type;
+	u32 subtype;
+	u32 data;
+} __packed;
+
+/* H2F */
+struct hfi_core_fw_start_cmd {
+	u32 hdr;
+	u32 handle;
+} __packed;
+
+struct hfi_mem_alloc_desc_legacy {
+	u64 gpu_addr;
+	u32 flags;
+	u32 mem_kind;
+	u32 host_mem_handle;
+	u32 gmu_mem_handle;
+	u32 gmu_addr;
+	u32 size; /* Bytes */
+} __packed;
+
+struct hfi_mem_alloc_desc {
+	u64 gpu_addr;
+	u32 flags;
+	u32 mem_kind;
+	u32 host_mem_handle;
+	u32 gmu_mem_handle;
+	u32 gmu_addr;
+	u32 size; /* Bytes */
+	/**
+	 * @align: bits[0:7] specify alignment requirement of the GMU VA specified as a power of
+	 * two. bits[8:15] specify alignment requirement for the size of the GMU mapping. For
+	 * example, a decimal value of 20 = (1 << 20) = 1 MB alignment
+	 */
+	u32 align;
+} __packed;
+
+struct hfi_mem_alloc_entry {
+	struct hfi_mem_alloc_desc desc;
+	struct kgsl_memdesc *md;
+};
+
+/* F2H */
+struct hfi_mem_alloc_cmd_legacy {
+	u32 hdr;
+	u32 reserved; /* Padding to ensure alignment of 'desc' below */
+	struct hfi_mem_alloc_desc_legacy desc;
+} __packed;
+
+struct hfi_mem_alloc_cmd {
+	u32 hdr;
+	u32 version;
+	struct hfi_mem_alloc_desc desc;
+} __packed;
+
+/* H2F */
+struct hfi_mem_alloc_reply_cmd {
+	u32 hdr;
+	u32 req_hdr;
+	struct hfi_mem_alloc_desc desc;
+} __packed;
+
+/* H2F */
+struct hfi_gx_bw_perf_vote_cmd {
+	u32 hdr;
+	u32 ack_type;
+	u32 freq;
+	u32 bw;
+} __packed;
+
+/* H2F */
+struct hfi_fw_halt_cmd {
+	u32 hdr;
+	u32 en_halt;
+} __packed;
+
+/* H2F */
+struct hfi_prep_slumber_cmd {
+	u32 hdr;
+	u32 bw;
+	u32 freq;
+} __packed;
+
+/* F2H */
+struct hfi_err_cmd {
+	u32 hdr;
+	u32 error_code;
+	u32 data[16];
+} __packed;
+
+/* F2H */
+struct hfi_debug_cmd {
+	u32 hdr;
+	u32 type;
+	u32 timestamp;
+	u32 data;
+} __packed;
+
+/* F2H */
+struct hfi_trace_cmd {
+	u32 hdr;
+	u32 version;
+	u64 identifier;
+} __packed;
+
+/* Trace packet definition */
+struct gmu_trace_packet {
+	u32 hdr;
+	u32 trace_id;
+	u64 ticks;
+	u32 payload[];
+} __packed;
+
+/* F2H */
+struct hfi_gmu_cntr_register_cmd {
+	u32 hdr;
+	u32 group_id;
+	u32 countable;
+} __packed;
+
+/* H2F */
+struct hfi_gmu_cntr_register_reply_cmd {
+	u32 hdr;
+	u32 req_hdr;
+	u32 group_id;
+	u32 countable;
+	u32 cntr_lo;
+	u32 cntr_hi;
+} __packed;
+
+/* F2H */
+struct hfi_gmu_cntr_release_cmd {
+	u32 hdr;
+	u32 group_id;
+	u32 countable;
+} __packed;
+
+/* H2F */
+struct hfi_register_ctxt_cmd {
+	u32 hdr;
+	u32 ctxt_id;
+	u32 flags;
+	u64 pt_addr;
+	u32 ctxt_idr;
+	u32 ctxt_bank;
+} __packed;
+
+/* H2F */
+struct hfi_unregister_ctxt_cmd {
+	u32 hdr;
+	u32 ctxt_id;
+	u32 ts;
+} __packed;
+
+struct hfi_issue_ib {
+	u64 addr;
+	u32 size;
+} __packed;
+
+/* H2F */
+/* The length of *buf will be embedded in the hdr */
+struct hfi_issue_cmd_raw_cmd {
+	u32 hdr;
+	u32 *buf;
+} __packed;
+
+/* Internal */
+struct hfi_issue_cmd_raw_req {
+	u32 queue;
+	u32 ctxt_id;
+	u32 len;
+	u32 *buf;
+} __packed;
+
+/* H2F */
+struct hfi_ts_notify_cmd {
+	u32 hdr;
+	u32 ctxt_id;
+	u32 ts;
+} __packed;
+
+#define CMDBATCH_SUCCESS	0
+#define CMDBATCH_RETIRED	1
+#define CMDBATCH_ERROR		2
+#define CMDBATCH_SKIP		3
+
+#define CMDBATCH_PROFILING		BIT(4)
+#define CMDBATCH_EOF			BIT(8)
+#define CMDBATCH_INDIRECT		BIT(9)
+#define CMDBATCH_RECURRING_START   BIT(18)
+#define CMDBATCH_RECURRING_STOP   BIT(19)
+
+
+/* This indicates that the SYNCOBJ is kgsl output fence */
+#define GMU_SYNCOBJ_FLAG_KGSL_FENCE_BIT		0
+/* This indicates that the SYNCOBJ is signaled */
+#define GMU_SYNCOBJ_FLAG_SIGNALED_BIT		1
+/* This indicates that the SYNCOBJ's software status is queried */
+#define GMU_SYNCOBJ_FLAG_QUERY_SW_STATUS_BIT	2
+/* This indicates that the SYNCOBJ's software status is signaled */
+#define GMU_SYNCOBJ_FLAG_SW_STATUS_SIGNALED_BIT	3
+/* This indicates that the SYNCOBJ's software status is pending */
+#define GMU_SYNCOBJ_FLAG_SW_STATUS_PENDING_BIT	4
+
+#define GMU_SYNCOBJ_FLAGS  \
+	{ BIT(GMU_SYNCOBJ_FLAG_KGSL_FENCE_BIT), "KGSL"}, \
+	{ BIT(GMU_SYNCOBJ_FLAG_SIGNALED_BIT), "SIGNALED"}, \
+	{ BIT(GMU_SYNCOBJ_FLAG_QUERY_SW_STATUS_BIT), "QUERIED"}, \
+	{ BIT(GMU_SYNCOBJ_FLAG_SW_STATUS_SIGNALED_BIT), "SW_SIGNALED"}, \
+	{ BIT(GMU_SYNCOBJ_FLAG_SW_STATUS_PENDING_BIT), "SW_PENDING"}
+
+/* F2H */
+struct hfi_ts_retire_cmd {
+	u32 hdr;
+	u32 ctxt_id;
+	u32 ts;
+	u32 type;
+	u64 submitted_to_rb;
+	u64 sop;
+	u64 eop;
+	u64 retired_on_gmu;
+	u64 active;
+	u32 version;
+} __packed;
+
+/* H2F */
+struct hfi_context_pointers_cmd {
+	u32 hdr;
+	u32 ctxt_id;
+	u64 sop_addr;
+	u64 eop_addr;
+	u64 user_ctxt_record_addr;
+	u32 version;
+	u32 gmu_context_queue_addr;
+} __packed;
+
+/* H2F */
+struct hfi_context_rule_cmd {
+	u32 hdr;
+	u32 ctxt_id;
+	u32 type;
+	u32 status;
+} __packed;
+
+struct fault_info {
+	u32 ctxt_id;
+	u32 policy;
+	u32 ts;
+} __packed;
+
+/* F2H */
+struct hfi_context_bad_cmd {
+	u32 hdr;
+	u32 version;
+	struct fault_info gc;
+	struct fault_info lpac;
+	u32 error;
+	u32 payload[];
+} __packed;
+
+/* F2H */
+struct hfi_context_bad_cmd_legacy {
+	u32 hdr;
+	u32 ctxt_id;
+	u32 policy;
+	u32 ts;
+	u32 error;
+	u32 payload[];
+} __packed;
+
+/* H2F */
+struct hfi_context_bad_reply_cmd {
+	u32 hdr;
+	u32 req_hdr;
+} __packed;
+
+/* H2F */
+struct hfi_submit_cmd {
+	u32 hdr;
+	u32 ctxt_id;
+	u32 flags;
+	u32 ts;
+	u32 profile_gpuaddr_lo;
+	u32 profile_gpuaddr_hi;
+	u32 numibs;
+	u32 big_ib_gmu_va;
+} __packed;
+
+struct hfi_syncobj {
+	u64 ctxt_id;
+	u64 seq_no;
+	u64 flags;
+} __packed;
+
+struct hfi_submit_syncobj {
+	u32 hdr;
+	u32 version;
+	u32 flags;
+	u32 timestamp;
+	u32 num_syncobj;
+} __packed;
+
+struct hfi_log_block {
+	u32 hdr;
+	u32 version;
+	u32 start_index;
+	u32 stop_index;
+} __packed;
+
+enum hfi_warmboot_cmd_type {
+	HFI_WARMBOOT_SET_SCRATCH = 0,
+	HFI_WARMBOOT_EXEC_SCRATCH,
+	HFI_WARMBOOT_QUERY_SCRATCH,
+};
+
+struct hfi_warmboot_scratch_cmd {
+	/** @hdr: Header for the scratch command packet */
+	u32 hdr;
+	/** @version: Version of the scratch command packet */
+	u32 version;
+	/** @flags: Set, Execute or Query scratch flag */
+	u32 flags;
+	/** @scratch_addr: Address of the scratch */
+	u32 scratch_addr;
+	/** @scratch_size: Size of the scratch in bytes*/
+	u32 scratch_size;
+} __packed;
+
+/* Request GMU to add this fence to TxQueue without checking whether this is retired or not */
+#define HW_FENCE_FLAG_SKIP_MEMSTORE 0x1
+
+struct hfi_hw_fence_info {
+	/** @hdr: Header for the fence info packet */
+	u32 hdr;
+	/** @version: Version of the fence info packet */
+	u32 version;
+	/** @gmu_ctxt_id: GMU Context id to which this fence belongs */
+	u32 gmu_ctxt_id;
+	/** @error: Any error code associated with this fence */
+	u32 error;
+	/** @ctxt_id: Context id for which hw fence is to be triggered */
+	u64 ctxt_id;
+	/** @ts: Timestamp for which hw fence is to be triggered */
+	u64 ts;
+	/** @flags: Flags on how to handle this hfi packet */
+	u64 flags;
+	/** @hash_index: Index of the hw fence in hw fence table */
+	u64 hash_index;
+} __packed;
+
+/* The software fence corresponding to the queried hardware fence has not signaled */
+#define ADRENO_HW_FENCE_SW_STATUS_PENDING  BIT(0)
+/* The software fence corresponding to the queried hardware fence has signaled */
+#define ADRENO_HW_FENCE_SW_STATUS_SIGNALED BIT(1)
+
+struct hfi_syncobj_query {
+	/**
+	 * @query_bitmask: Bitmask representing the sync object descriptors to be queried. For
+	 * example, to query the second sync object descriptor(index=1) in a sync object,
+	 * bit(1) should be set in this bitmask.
+	 */
+	u32 query_bitmask;
+} __packed;
+
+#define MAX_SYNCOBJ_QUERY_BITS	128
+#define BITS_PER_SYNCOBJ_QUERY	32
+#define MAX_SYNCOBJ_QUERY_DWORDS (MAX_SYNCOBJ_QUERY_BITS / BITS_PER_SYNCOBJ_QUERY)
+
+struct hfi_syncobj_query_cmd {
+	/** @hdr: Header for the fence info packet */
+	u32 hdr;
+	/** @version: Version of the fence info packet */
+	u32 version;
+	/** @gmu_ctxt_id: GMU Context id to which this SYNC object belongs */
+	u32 gmu_ctxt_id;
+	/** @sync_obj_ts: Timestamp of this SYNC object */
+	u32 sync_obj_ts;
+	/** @queries: Array of query bitmasks */
+	struct hfi_syncobj_query queries[MAX_SYNCOBJ_QUERY_DWORDS];
+} __packed;
+
+/**
+ * struct pending_cmd - data structure to track outstanding HFI
+ *	command messages
+ */
+struct pending_cmd {
+	/** @sent_hdr: Header of the un-ack'd hfi packet */
+	u32 sent_hdr;
+	/** @results: Array to store the ack packet */
+	u32 results[MAX_RCVD_SIZE];
+	/** @complete: Completion to signal hfi ack has been received */
+	struct completion complete;
+	/** @node: to add it to the list of hfi packets waiting for ack */
+	struct list_head node;
+};
+
+static inline int _CMD_MSG_HDR(u32 *hdr, int id, size_t size)
+{
+	if (WARN_ON(size > HFI_MAX_MSG_SIZE))
+		return -EMSGSIZE;
+
+	*hdr = CREATE_MSG_HDR(id, HFI_MSG_CMD);
+	return 0;
+}
+
+#define CMD_MSG_HDR(cmd, id) \
+	_CMD_MSG_HDR(&(cmd).hdr, id, sizeof(cmd))
+
+#define RECORD_MSG_HDR(hdr) \
+	((hdr) | HFI_MSG_RECORD)
+
+#define CLEAR_RECORD_MSG_HDR(hdr) \
+	((hdr) & (~(HFI_MSG_RECORD | HFI_MSG_NOP)))
+
+#define RECORD_NOP_MSG_HDR(hdr) \
+	((hdr) | (HFI_MSG_RECORD | HFI_MSG_NOP))
+
+/* Maximum number of IBs in a submission */
+#define HWSCHED_MAX_DISPATCH_NUMIBS \
+	((HFI_MAX_MSG_SIZE - sizeof(struct hfi_submit_cmd)) \
+		/ sizeof(struct hfi_issue_ib))
+
+/**
+ * struct payload_section - Container of keys values
+ *
+ * There may be a variable number of payload sections appended
+ * to the context bad HFI message. Each payload section contains
+ * a variable number of key-value pairs, both key and value being
+ * single dword each.
+ */
+struct payload_section {
+	/** @type: Type of the payload */
+	u16 type;
+	/** @dwords: Number of dwords in the data array. */
+	u16 dwords;
+	/** @data: A sequence of key-value pairs. Each pair is 2 dwords. */
+	u32 data[];
+} __packed;
+
+/* IDs for context bad hfi payloads */
+#define PAYLOAD_FAULT_REGS 1
+#define PAYLOAD_RB 2
+#define PAYLOAD_PREEMPT_TIMEOUT 3
+
+/* Keys for PAYLOAD_FAULT_REGS type payload */
+#define KEY_CP_OPCODE_ERROR 1
+#define KEY_CP_PROTECTED_ERROR 2
+#define KEY_CP_HW_FAULT 3
+#define KEY_CP_BV_OPCODE_ERROR 4
+#define KEY_CP_BV_PROTECTED_ERROR 5
+#define KEY_CP_BV_HW_FAULT 6
+#define KEY_CP_LPAC_OPCODE_ERROR 7
+#define KEY_CP_LPAC_PROTECTED_ERROR 8
+#define KEY_CP_LPAC_HW_FAULT 9
+#define KEY_SWFUSE_VIOLATION_FAULT 10
+#define KEY_AQE0_OPCODE_ERROR 11
+#define KEY_AQE0_HW_FAULT 12
+#define KEY_AQE1_OPCODE_ERROR 13
+#define KEY_AQE1_HW_FAULT 14
+
+/* Keys for PAYLOAD_RB type payload */
+#define KEY_RB_ID 1
+#define KEY_RB_RPTR 2
+#define KEY_RB_WPTR 3
+#define KEY_RB_SIZEDWORDS 4
+#define KEY_RB_QUEUED_TS 5
+#define KEY_RB_RETIRED_TS 6
+#define KEY_RB_GPUADDR_LO 7
+#define KEY_RB_GPUADDR_HI 8
+
+/* Keys for PAYLOAD_PREEMPT_TIMEOUT type payload */
+#define KEY_PREEMPT_TIMEOUT_CUR_RB_ID 1
+#define KEY_PREEMPT_TIMEOUT_NEXT_RB_ID 2
+
+/* Types of errors that trigger context bad HFI */
+
+/* GPU encountered a CP HW error */
+#define GMU_CP_HW_ERROR 600
+/* GPU encountered a GPU Hang interrupt */
+#define GMU_GPU_HW_HANG 601
+/* Preemption didn't complete in given time */
+#define GMU_GPU_PREEMPT_TIMEOUT 602
+/* Fault due to Long IB timeout */
+#define GMU_GPU_SW_HANG 603
+/* GPU encountered a bad opcode */
+#define GMU_CP_OPCODE_ERROR 604
+/* GPU encountered protected mode error */
+#define GMU_CP_PROTECTED_ERROR 605
+/* GPU encountered an illegal instruction */
+#define GMU_CP_ILLEGAL_INST_ERROR 606
+/* GPU encountered a CP ucode error */
+#define GMU_CP_UCODE_ERROR 607
+/* GPU encountered a CP hw fault error */
+#define GMU_CP_HW_FAULT_ERROR 608
+/* GPU encountered a GPC error */
+#define GMU_CP_GPC_ERROR 609
+/* GPU BV encountered a bad opcode */
+#define GMU_CP_BV_OPCODE_ERROR 610
+/* GPU BV encountered protected mode error */
+#define GMU_CP_BV_PROTECTED_ERROR 611
+/* GPU BV encountered a CP hw fault error */
+#define GMU_CP_BV_HW_FAULT_ERROR 612
+/* GPU BV encountered a CP ucode error */
+#define GMU_CP_BV_UCODE_ERROR 613
+/* GPU BV encountered an illegal instruction */
+#define GMU_CP_BV_ILLEGAL_INST_ERROR 614
+/* GPU encountered a bad LPAC opcode */
+#define GMU_CP_LPAC_OPCODE_ERROR 615
+/* GPU LPAC encountered a CP ucode error */
+#define GMU_CP_LPAC_UCODE_ERROR 616
+/* GPU LPAC encountered a CP hw fault error */
+#define GMU_CP_LPAC_HW_FAULT_ERROR 617
+/* GPU LPAC encountered protected mode error */
+#define GMU_CP_LPAC_PROTECTED_ERROR 618
+/* GPU LPAC encountered an illegal instruction */
+#define GMU_CP_LPAC_ILLEGAL_INST_ERROR 619
+/* Fault due to LPAC Long IB timeout */
+#define GMU_GPU_LPAC_SW_HANG 620
+/* Fault due to software fuse violation interrupt */
+#define GMU_GPU_SW_FUSE_VIOLATION 621
+/* AQE related error codes */
+#define GMU_GPU_AQE0_OPCODE_ERRROR 622
+#define GMU_GPU_AQE0_UCODE_ERROR 623
+#define GMU_GPU_AQE0_HW_FAULT_ERROR 624
+#define GMU_GPU_AQE0_ILLEGAL_INST_ERROR 625
+#define GMU_GPU_AQE1_OPCODE_ERRROR 626
+#define GMU_GPU_AQE1_UCODE_ERROR 627
+#define GMU_GPU_AQE1_HW_FAULT_ERROR 628
+#define GMU_GPU_AQE1_ILLEGAL_INST_ERROR 629
+/* GMU encountered a sync object which is signaled via software but not via hardware */
+#define GMU_SYNCOBJ_TIMEOUT_ERROR 630
+/* GPU encountered an unknown CP error */
+#define GMU_CP_UNKNOWN_ERROR 700
+
+/**
+ * hfi_update_read_idx - Update the read index of an hfi queue
+ * hdr: Pointer to the hfi queue header
+ * index: New read index
+ *
+ * This function makes sure that kgsl has consumed f2h packets
+ * before GMU sees the updated read index. This avoids a corner
+ * case where GMU might over-write f2h packets that have not yet
+ * been consumed by kgsl.
+ */
+static inline void hfi_update_read_idx(struct hfi_queue_header *hdr, u32 index)
+{
+	/*
+	 * This is to make sure packets are consumed before gmu sees the updated
+	 * read index
+	 */
+	mb();
+
+	hdr->read_index = index;
+}
+
+/**
+ * hfi_update_write_idx - Update the write index of a GMU queue
+ * write_idx: Pointer to the write index
+ * index: New write index
+ *
+ * This function makes sure that the h2f packets are written out
+ * to memory before GMU sees the updated write index. This avoids
+ * corner cases where GMU might fetch stale entries that can happen
+ * if write index is updated before new packets have been written
+ * out to memory.
+ */
+static inline void hfi_update_write_idx(volatile u32 *write_idx, u32 index)
+{
+	/*
+	 * This is to make sure packets are written out before gmu sees the
+	 * updated write index
+	 */
+	wmb();
+
+	*write_idx = index;
+
+	/*
+	 * Memory barrier to make sure write index is written before an
+	 * interrupt is raised
+	 */
+	wmb();
+}
+
+/**
+ * hfi_get_mem_alloc_desc - Get the descriptor from F2H_MSG_MEM_ALLOC packet
+ * rcvd: Pointer to the F2H_MSG_MEM_ALLOC packet
+ * out: Pointer to copy the descriptor data to
+ *
+ * This function checks for the F2H_MSG_MEM_ALLOC packet version and based on that gets the
+ * descriptor data from the packet.
+ */
+static inline void hfi_get_mem_alloc_desc(void *rcvd, struct hfi_mem_alloc_desc *out)
+{
+	struct hfi_mem_alloc_cmd_legacy *in_legacy = (struct hfi_mem_alloc_cmd_legacy *)rcvd;
+	struct hfi_mem_alloc_cmd *in = (struct hfi_mem_alloc_cmd *)rcvd;
+
+	if (in->version > 0)
+		memcpy(out, &in->desc, sizeof(in->desc));
+	else
+		memcpy(out, &in_legacy->desc, sizeof(in_legacy->desc));
+}
+
+/**
+ * hfi_get_gmu_va_alignment - Get the alignment (in bytes) for a GMU VA
+ * align: Alignment specified as a power of two (2^n) in bits[0:7]
+ *
+ * This function derives the GMU VA alignment in bytes from bits[0:7] in the passed in value, which
+ * is specified in terms of power of two (2^n). For example, va_align = 20 means (1 << 20) = 1MB
+ * alignment. The minimum alignment (in bytes) is SZ_4K i.e. anything less than (or equal to) a
+ * va_align value of ilog2(SZ_4K) will default to SZ_4K alignment.
+ */
+static inline u32 hfi_get_gmu_va_alignment(u32 align)
+{
+	u32 va_align = FIELD_GET(GENMASK(7, 0), align);
+
+	return (va_align > ilog2(SZ_4K)) ? (1 << va_align) : SZ_4K;
+}
+
+/**
+ * hfi_get_gmu_sz_alignment - Get the alignment (in bytes) for GMU mapping size
+ * align: Alignment specified as a power of two (2^n) in bits[8:15]
+ *
+ * This function derives the GMU VA size alignment in bytes from bits[8:15] in the passed in value,
+ * which is specified in terms of power of two (2^n). For example, sz_align = 20 means
+ * (1 << 20) = 1MB alignment. The minimum alignment (in bytes) is SZ_4K i.e. anything less
+ * than (or equal to) a sz_align value of ilog2(SZ_4K) will default to SZ_4K alignment.
+ */
+static inline u32 hfi_get_gmu_sz_alignment(u32 align)
+{
+	u32 sz_align = FIELD_GET(GENMASK(15, 8), align);
+
+	return (sz_align > ilog2(SZ_4K)) ? (1 << sz_align) : SZ_4K;
+}
+
+/**
+ * adreno_hwsched_wait_ack_completion - Wait for HFI ack asynchronously
+ * adreno_dev: Pointer to the adreno device
+ * dev: Pointer to the device structure
+ * ack: Pointer to the pending ack
+ * process_msgq: Function pointer to the msgq processing function
+ *
+ * This function waits for the completion structure, which gets signaled asynchronously. In case
+ * there is a timeout, process the msgq one last time. If the ack is present, log an error and move
+ * on. If the ack isn't present, log an error, take a snapshot and return -ETIMEDOUT.
+ *
+ * Return: 0 on success and -ETIMEDOUT on failure
+ */
+int adreno_hwsched_wait_ack_completion(struct adreno_device *adreno_dev,
+	struct device *dev, struct pending_cmd *ack,
+	void (*process_msgq)(struct adreno_device *adreno_dev));
+
+/**
+ * hfi_get_minidump_string - Get the va-minidump string from entry
+ * mem_kind: mem_kind type
+ * hfi_minidump_str: Pointer to the output string
+ * size: Max size of the hfi_minidump_str
+ * rb_id: Pointer to the rb_id count
+ *
+ * This function return 0 on valid mem_kind and copies the VA-MINIDUMP string to
+ * hfi_minidump_str else return error
+ */
+static inline int hfi_get_minidump_string(u32 mem_kind, char *hfi_minidump_str,
+					   size_t size, u32 *rb_id)
+{
+	/* Extend this if the VA mindump need more hfi alloc entries */
+	switch (mem_kind) {
+	case HFI_MEMKIND_RB:
+		snprintf(hfi_minidump_str, size, KGSL_GMU_RB_ENTRY"_%d", (*rb_id)++);
+		break;
+	case HFI_MEMKIND_SCRATCH:
+		snprintf(hfi_minidump_str, size, KGSL_SCRATCH_ENTRY);
+		break;
+	case HFI_MEMKIND_PROFILE:
+		snprintf(hfi_minidump_str, size, KGSL_GMU_KERNEL_PROF_ENTRY);
+		break;
+	case HFI_MEMKIND_USER_PROFILE_IBS:
+		snprintf(hfi_minidump_str, size, KGSL_GMU_USER_PROF_ENTRY);
+		break;
+	case HFI_MEMKIND_CMD_BUFFER:
+		snprintf(hfi_minidump_str, size, KGSL_GMU_CMD_BUFFER_ENTRY);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_hwsched.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_hwsched.c
@@ -0,0 +1,2376 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/dma-fence-array.h>
+#include <soc/qcom/msm_performance.h>
+
+#include "adreno.h"
+#include "adreno_hfi.h"
+#include "adreno_snapshot.h"
+#include "adreno_sysfs.h"
+#include "adreno_trace.h"
+#include "kgsl_timeline.h"
+#include <linux/msm_kgsl.h>
+
+/*
+ * Number of commands that can be queued in a context before it sleeps
+ *
+ * Our code that "puts back" a command from the context is much cleaner
+ * if we are sure that there will always be enough room in the ringbuffer
+ * so restrict the size of the context queue to ADRENO_CONTEXT_DRAWQUEUE_SIZE - 1
+ */
+static u32 _context_drawqueue_size = ADRENO_CONTEXT_DRAWQUEUE_SIZE - 1;
+
+/* Number of milliseconds to wait for the context queue to clear */
+static unsigned int _context_queue_wait = 10000;
+
+/*
+ * GFT throttle parameters. If GFT recovered more than
+ * X times in Y ms invalidate the context and do not attempt recovery.
+ * X -> _fault_throttle_burst
+ * Y -> _fault_throttle_time
+ */
+static unsigned int _fault_throttle_time = 2000;
+static unsigned int _fault_throttle_burst = 3;
+
+/* Use a kmem cache to speed up allocations for dispatcher jobs */
+static struct kmem_cache *jobs_cache;
+/* Use a kmem cache to speed up allocations for inflight command objects */
+static struct kmem_cache *obj_cache;
+
+inline bool adreno_hwsched_context_queue_enabled(struct adreno_device *adreno_dev)
+{
+	return test_bit(ADRENO_HWSCHED_CONTEXT_QUEUE, &adreno_dev->hwsched.flags);
+}
+
+static bool is_cmdobj(struct kgsl_drawobj *drawobj)
+{
+	return (drawobj->type & CMDOBJ_TYPE);
+}
+
+static bool _check_context_queue(struct adreno_context *drawctxt, u32 count)
+{
+	bool ret;
+
+	spin_lock(&drawctxt->lock);
+
+	/*
+	 * Wake up if there is room in the context or if the whole thing got
+	 * invalidated while we were asleep
+	 */
+
+	if (kgsl_context_invalid(&drawctxt->base))
+		ret = false;
+	else
+		ret = ((drawctxt->queued + count) < _context_drawqueue_size) ? 1 : 0;
+
+	spin_unlock(&drawctxt->lock);
+
+	return ret;
+}
+
+static void _pop_drawobj(struct adreno_context *drawctxt)
+{
+	drawctxt->drawqueue_head = DRAWQUEUE_NEXT(drawctxt->drawqueue_head,
+		ADRENO_CONTEXT_DRAWQUEUE_SIZE);
+	drawctxt->queued--;
+}
+
+static int _retire_syncobj(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj_sync *syncobj, struct adreno_context *drawctxt)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+
+	if (!kgsl_drawobj_events_pending(syncobj)) {
+		_pop_drawobj(drawctxt);
+		kgsl_drawobj_destroy(DRAWOBJ(syncobj));
+		return 0;
+	}
+
+	/*
+	 * If hardware fences are enabled, and this SYNCOBJ is backed by hardware fences,
+	 * send it to the GMU
+	 */
+	if (test_bit(ADRENO_HWSCHED_HW_FENCE, &hwsched->flags) &&
+		((syncobj->flags & KGSL_SYNCOBJ_HW)))
+		return 1;
+
+	/*
+	 * If we got here, there are pending events for sync object.
+	 * Start the canary timer if it hasnt been started already.
+	 */
+	if (!syncobj->timeout_jiffies) {
+		syncobj->timeout_jiffies = jiffies + msecs_to_jiffies(5000);
+			mod_timer(&syncobj->timer, syncobj->timeout_jiffies);
+	}
+
+	return -EAGAIN;
+}
+
+static bool _marker_expired(struct kgsl_drawobj_cmd *markerobj)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(markerobj);
+
+	return (drawobj->flags & KGSL_DRAWOBJ_MARKER) &&
+		kgsl_check_timestamp(drawobj->device, drawobj->context,
+		markerobj->marker_timestamp);
+}
+
+/* Only retire the timestamp. The drawobj will be destroyed later */
+static void _retire_timestamp_only(struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_context *context = drawobj->context;
+	struct kgsl_device *device = context->device;
+
+	/*
+	 * Write the start and end timestamp to the memstore to keep the
+	 * accounting sane
+	 */
+	kgsl_sharedmem_writel(device->memstore,
+		KGSL_MEMSTORE_OFFSET(context->id, soptimestamp),
+		drawobj->timestamp);
+
+	kgsl_sharedmem_writel(device->memstore,
+		KGSL_MEMSTORE_OFFSET(context->id, eoptimestamp),
+		drawobj->timestamp);
+
+	msm_perf_events_update(MSM_PERF_GFX, MSM_PERF_RETIRED,
+		pid_nr(context->proc_priv->pid),
+		context->id, drawobj->timestamp,
+		!!(drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME));
+
+	if (drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME) {
+		atomic64_inc(&drawobj->context->proc_priv->frame_count);
+		atomic_inc(&drawobj->context->proc_priv->period->frames);
+	}
+
+	/* Retire pending GPU events for the object */
+	kgsl_process_event_group(device, &context->events);
+}
+
+static void _retire_timestamp(struct kgsl_drawobj *drawobj)
+{
+	_retire_timestamp_only(drawobj);
+
+	kgsl_drawobj_destroy(drawobj);
+}
+
+static int _retire_markerobj(struct adreno_device *adreno_dev, struct kgsl_drawobj_cmd *cmdobj,
+	struct adreno_context *drawctxt)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+
+	if (_marker_expired(cmdobj)) {
+		set_bit(CMDOBJ_MARKER_EXPIRED, &cmdobj->priv);
+		/*
+		 * There may be pending hardware fences that need to be signaled upon retiring
+		 * this MARKER object. Hence, send it to the target specific layers to trigger
+		 * the hardware fences.
+		 */
+		if (test_bit(ADRENO_HWSCHED_HW_FENCE, &hwsched->flags)) {
+			_retire_timestamp_only(DRAWOBJ(cmdobj));
+			return 1;
+		}
+		_pop_drawobj(drawctxt);
+		_retire_timestamp(DRAWOBJ(cmdobj));
+		return 0;
+	}
+
+	/*
+	 * If the marker isn't expired but the SKIP bit
+	 * is set then there are real commands following
+	 * this one in the queue. This means that we
+	 * need to dispatch the command so that we can
+	 * keep the timestamp accounting correct. If
+	 * skip isn't set then we block this queue
+	 * until the dependent timestamp expires
+	 */
+
+	return test_bit(CMDOBJ_SKIP, &cmdobj->priv) ? 1 : -EAGAIN;
+}
+
+static int _retire_timelineobj(struct kgsl_drawobj *drawobj,
+		struct adreno_context *drawctxt)
+{
+	_pop_drawobj(drawctxt);
+	kgsl_drawobj_destroy(drawobj);
+	return 0;
+}
+
+static int drawqueue_retire_bindobj(struct kgsl_drawobj *drawobj,
+		struct adreno_context *drawctxt)
+{
+	struct kgsl_drawobj_bind *bindobj = BINDOBJ(drawobj);
+
+	if (test_bit(KGSL_BINDOBJ_STATE_DONE, &bindobj->state)) {
+		_pop_drawobj(drawctxt);
+		_retire_timestamp(drawobj);
+		return 0;
+	}
+
+	if (!test_and_set_bit(KGSL_BINDOBJ_STATE_START, &bindobj->state)) {
+		/*
+		 * Take a reference to the drawobj and the context because both
+		 * get referenced in the bind callback
+		 */
+		_kgsl_context_get(&drawctxt->base);
+		kref_get(&drawobj->refcount);
+
+		kgsl_sharedmem_bind_ranges(bindobj->bind);
+	}
+
+	return -EAGAIN;
+}
+
+/*
+ * Retires all expired marker and sync objs from the context
+ * queue and returns one of the below
+ * a) next drawobj that needs to be sent to ringbuffer
+ * b) -EAGAIN for syncobj with syncpoints pending.
+ * c) -EAGAIN for markerobj whose marker timestamp has not expired yet.
+ * c) NULL for no commands remaining in drawqueue.
+ */
+static struct kgsl_drawobj *_process_drawqueue_get_next_drawobj(
+	struct adreno_device *adreno_dev, struct adreno_context *drawctxt)
+{
+	struct kgsl_drawobj *drawobj;
+	unsigned int i = drawctxt->drawqueue_head;
+	struct kgsl_drawobj_cmd *cmdobj;
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	int ret = 0;
+
+	if (drawctxt->drawqueue_head == drawctxt->drawqueue_tail)
+		return NULL;
+
+	for (i = drawctxt->drawqueue_head; i != drawctxt->drawqueue_tail;
+			i = DRAWQUEUE_NEXT(i, ADRENO_CONTEXT_DRAWQUEUE_SIZE)) {
+
+		drawobj = drawctxt->drawqueue[i];
+
+		if (!drawobj)
+			return NULL;
+
+		switch (drawobj->type) {
+		case CMDOBJ_TYPE:
+			cmdobj = CMDOBJ(drawobj);
+
+			/* We only support one big IB inflight */
+			if ((cmdobj->numibs > HWSCHED_MAX_DISPATCH_NUMIBS) &&
+				hwsched->big_cmdobj)
+				return ERR_PTR(-ENOSPC);
+
+			return drawobj;
+		case SYNCOBJ_TYPE:
+			ret = _retire_syncobj(adreno_dev, SYNCOBJ(drawobj), drawctxt);
+			if (ret == 1)
+				return drawobj;
+			break;
+		case MARKEROBJ_TYPE:
+			ret = _retire_markerobj(adreno_dev, CMDOBJ(drawobj), drawctxt);
+			/* Special case where marker needs to be sent to GPU */
+			if (ret == 1)
+				return drawobj;
+			break;
+		case BINDOBJ_TYPE:
+			ret = drawqueue_retire_bindobj(drawobj, drawctxt);
+			break;
+		case TIMELINEOBJ_TYPE:
+			ret = _retire_timelineobj(drawobj, drawctxt);
+			break;
+		default:
+			ret = -EINVAL;
+			break;
+		}
+
+		if (ret)
+			return ERR_PTR(ret);
+	}
+
+	return NULL;
+}
+
+/**
+ * hwsched_dispatcher_requeue_drawobj() - Put a draw objet back on the context
+ * queue
+ * @drawctxt: Pointer to the adreno draw context
+ * @drawobj: Pointer to the KGSL draw object to requeue
+ *
+ * Failure to submit a drawobj to the ringbuffer isn't the fault of the drawobj
+ * being submitted so if a failure happens, push it back on the head of the
+ * context queue to be reconsidered again unless the context got detached.
+ */
+static inline int hwsched_dispatcher_requeue_drawobj(
+		struct adreno_context *drawctxt,
+		struct kgsl_drawobj *drawobj)
+{
+	unsigned int prev;
+
+	spin_lock(&drawctxt->lock);
+
+	if (kgsl_context_is_bad(&drawctxt->base)) {
+		spin_unlock(&drawctxt->lock);
+		/* get rid of this drawobj since the context is bad */
+		kgsl_drawobj_destroy(drawobj);
+		return -ENOENT;
+	}
+
+	prev = drawctxt->drawqueue_head == 0 ?
+		(ADRENO_CONTEXT_DRAWQUEUE_SIZE - 1) :
+		(drawctxt->drawqueue_head - 1);
+
+	/*
+	 * The maximum queue size always needs to be one less then the size of
+	 * the ringbuffer queue so there is "room" to put the drawobj back in
+	 */
+
+	WARN_ON(prev == drawctxt->drawqueue_tail);
+
+	drawctxt->drawqueue[prev] = drawobj;
+	drawctxt->queued++;
+
+	/* Reset the command queue head to reflect the newly requeued change */
+	drawctxt->drawqueue_head = prev;
+	if (is_cmdobj(drawobj)) {
+		struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj);
+
+		cmdobj->requeue_cnt++;
+	}
+	spin_unlock(&drawctxt->lock);
+	return 0;
+}
+
+/**
+ * hwsched_queue_context() - Queue a context in the dispatcher list of jobs
+ * @adreno_dev: Pointer to the adreno device structure
+ * @drawctxt: Pointer to the adreno draw context
+ *
+ * Add a context to the dispatcher list of jobs.
+ */
+static int hwsched_queue_context(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct adreno_dispatch_job *job;
+
+	/* Refuse to queue a detached context */
+	if (kgsl_context_detached(&drawctxt->base))
+		return 0;
+
+	if (!_kgsl_context_get(&drawctxt->base))
+		return 0;
+
+	job = kmem_cache_alloc(jobs_cache, GFP_ATOMIC);
+	if (!job) {
+		kgsl_context_put(&drawctxt->base);
+		return -ENOMEM;
+	}
+
+	job->drawctxt = drawctxt;
+
+	trace_dispatch_queue_context(drawctxt);
+	llist_add(&job->node, &hwsched->jobs[drawctxt->base.priority]);
+
+	return 0;
+}
+
+void adreno_hwsched_flush(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+
+	kthread_flush_worker(hwsched->worker);
+}
+
+/**
+ * is_marker_skip() - Check if the draw object is a MARKEROBJ_TYPE and CMDOBJ_SKIP bit is set
+ */
+static bool is_marker_skip(struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_drawobj_cmd *cmdobj = NULL;
+
+	if (drawobj->type != MARKEROBJ_TYPE)
+		return false;
+
+	cmdobj = CMDOBJ(drawobj);
+
+	if (test_bit(CMDOBJ_SKIP, &cmdobj->priv))
+		return true;
+
+	return false;
+}
+
+static bool _abort_submission(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+
+	/* We only need a single barrier before reading all the atomic variables below */
+	smp_rmb();
+
+	if (atomic_read(&adreno_dev->halt) || atomic_read(&hwsched->fault))
+		return true;
+
+	return false;
+}
+
+/**
+ * sendcmd() - Send a drawobj to the GPU hardware
+ * @dispatcher: Pointer to the adreno dispatcher struct
+ * @drawobj: Pointer to the KGSL drawobj being sent
+ *
+ * Send a KGSL drawobj to the GPU hardware
+ */
+static int hwsched_sendcmd(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct kgsl_context *context = drawobj->context;
+	int ret;
+	struct cmd_list_obj *obj;
+
+	obj = kmem_cache_alloc(obj_cache, GFP_KERNEL);
+	if (!obj)
+		return -ENOMEM;
+
+	mutex_lock(&device->mutex);
+
+	if (_abort_submission(adreno_dev)) {
+		mutex_unlock(&device->mutex);
+		kmem_cache_free(obj_cache, obj);
+		return -EBUSY;
+	}
+
+
+	if (kgsl_context_detached(context)) {
+		mutex_unlock(&device->mutex);
+		kmem_cache_free(obj_cache, obj);
+		return -ENOENT;
+	}
+
+	hwsched->inflight++;
+
+	if (hwsched->inflight == 1 &&
+		!test_bit(ADRENO_HWSCHED_POWER, &hwsched->flags)) {
+		ret = adreno_active_count_get(adreno_dev);
+		if (ret) {
+			hwsched->inflight--;
+			mutex_unlock(&device->mutex);
+			kmem_cache_free(obj_cache, obj);
+			return ret;
+		}
+		set_bit(ADRENO_HWSCHED_POWER, &hwsched->flags);
+	}
+
+	ret = hwsched->hwsched_ops->submit_drawobj(adreno_dev, drawobj);
+	if (ret) {
+		/*
+		 * If the first submission failed, then put back the active
+		 * count to relinquish active vote
+		 */
+		if (hwsched->inflight == 1) {
+			adreno_active_count_put(adreno_dev);
+			clear_bit(ADRENO_HWSCHED_POWER, &hwsched->flags);
+		}
+
+		hwsched->inflight--;
+		kmem_cache_free(obj_cache, obj);
+		mutex_unlock(&device->mutex);
+		return ret;
+	}
+
+	if ((hwsched->inflight == 1) &&
+		!test_and_set_bit(ADRENO_HWSCHED_ACTIVE, &hwsched->flags))
+		reinit_completion(&hwsched->idle_gate);
+
+	if (is_cmdobj(drawobj)) {
+		struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj);
+
+		/* If this MARKER object is already retired, we can destroy it here */
+		if ((test_bit(CMDOBJ_MARKER_EXPIRED, &cmdobj->priv))) {
+			kmem_cache_free(obj_cache, obj);
+			kgsl_drawobj_destroy(drawobj);
+			goto done;
+		}
+
+		if (cmdobj->numibs > HWSCHED_MAX_DISPATCH_NUMIBS) {
+			hwsched->big_cmdobj = cmdobj;
+			kref_get(&drawobj->refcount);
+		}
+	}
+
+	obj->drawobj = drawobj;
+	list_add_tail(&obj->node, &hwsched->cmd_list);
+
+done:
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+/**
+ * hwsched_sendcmds() - Send commands from a context to the GPU
+ * @adreno_dev: Pointer to the adreno device struct
+ * @drawctxt: Pointer to the adreno context to dispatch commands from
+ *
+ * Dequeue and send a burst of commands from the specified context to the GPU
+ * Returns postive if the context needs to be put back on the pending queue
+ * 0 if the context is empty or detached and negative on error
+ */
+static int hwsched_sendcmds(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt)
+{
+	int count = 0;
+	int ret = 0;
+
+	while (1) {
+		struct kgsl_drawobj *drawobj;
+		struct kgsl_drawobj_cmd *cmdobj = NULL;
+		struct kgsl_context *context;
+
+		spin_lock(&drawctxt->lock);
+		drawobj = _process_drawqueue_get_next_drawobj(adreno_dev,
+				drawctxt);
+
+		/*
+		 * adreno_context_get_drawobj returns -EAGAIN if the current
+		 * drawobj has pending sync points so no more to do here.
+		 * When the sync points are satisfied then the context will get
+		 * reqeueued
+		 */
+
+		if (IS_ERR_OR_NULL(drawobj)) {
+			if (IS_ERR(drawobj))
+				ret = PTR_ERR(drawobj);
+			spin_unlock(&drawctxt->lock);
+			break;
+		}
+		_pop_drawobj(drawctxt);
+		spin_unlock(&drawctxt->lock);
+
+		if (is_cmdobj(drawobj) || is_marker_skip(drawobj)) {
+			cmdobj = CMDOBJ(drawobj);
+			context = drawobj->context;
+			trace_adreno_cmdbatch_ready(context->id,
+				context->priority, drawobj->timestamp,
+				cmdobj->requeue_cnt);
+		}
+		ret = hwsched_sendcmd(adreno_dev, drawobj);
+
+		/*
+		 * On error from hwsched_sendcmd() try to requeue the cmdobj
+		 * unless we got back -ENOENT which means that the context has
+		 * been detached and there will be no more deliveries from here
+		 */
+		if (ret != 0) {
+			/* Destroy the cmdobj on -ENOENT */
+			if (ret == -ENOENT)
+				kgsl_drawobj_destroy(drawobj);
+			else {
+				/*
+				 * If we couldn't put it on dispatch queue
+				 * then return it to the context queue
+				 */
+				int r = hwsched_dispatcher_requeue_drawobj(
+					drawctxt, drawobj);
+				if (r)
+					ret = r;
+			}
+
+			break;
+		}
+
+		if (cmdobj)
+			drawctxt->submitted_timestamp = drawobj->timestamp;
+
+		count++;
+	}
+
+	/*
+	 * Wake up any snoozing threads if we have consumed any real commands
+	 * or marker commands and we have room in the context queue.
+	 */
+
+	if (_check_context_queue(drawctxt, 0))
+		wake_up_all(&drawctxt->wq);
+
+	if (!ret)
+		ret = count;
+
+	/* Return error or the number of commands queued */
+	return ret;
+}
+
+static void hwsched_handle_jobs_list(struct adreno_device *adreno_dev,
+	int id, unsigned long *map, struct llist_node *list)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct adreno_dispatch_job *job, *next;
+
+	if (!list)
+		return;
+
+	/* Reverse the list so we deal with oldest submitted contexts first */
+	list = llist_reverse_order(list);
+
+	llist_for_each_entry_safe(job, next, list, node) {
+		int ret;
+
+		if (kgsl_context_is_bad(&job->drawctxt->base)) {
+			kgsl_context_put(&job->drawctxt->base);
+			kmem_cache_free(jobs_cache, job);
+			continue;
+		}
+
+		/*
+		 * Due to the nature of the lockless queue the same context
+		 * might have multiple jobs on the list. We allow this so we
+		 * don't have to query the list on the producer side but on the
+		 * consumer side we only want each context to be considered
+		 * once. Use a bitmap to remember which contexts we've already
+		 * seen and quietly discard duplicate jobs
+		 */
+		if (test_and_set_bit(job->drawctxt->base.id, map)) {
+			kgsl_context_put(&job->drawctxt->base);
+			kmem_cache_free(jobs_cache, job);
+			continue;
+		}
+
+		ret = hwsched_sendcmds(adreno_dev, job->drawctxt);
+
+		/*
+		 * If the context had nothing queued or the context has been
+		 * destroyed then drop the job
+		 */
+		if (!ret || ret == -ENOENT) {
+			kgsl_context_put(&job->drawctxt->base);
+			kmem_cache_free(jobs_cache, job);
+			continue;
+		}
+
+		/*
+		 * If the dispatch queue is full then requeue the job to be
+		 * considered first next time. Otherwise the context
+		 * either successfully submmitted to the GPU or another error
+		 * happened and it should go back on the regular queue
+		 */
+		if (ret == -ENOSPC)
+			llist_add(&job->node, &hwsched->requeue[id]);
+		else
+			llist_add(&job->node, &hwsched->jobs[id]);
+	}
+}
+
+static void hwsched_handle_jobs(struct adreno_device *adreno_dev, int id)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	unsigned long map[BITS_TO_LONGS(KGSL_MEMSTORE_MAX)];
+	struct llist_node *requeue, *jobs;
+
+	memset(map, 0, sizeof(map));
+
+	requeue = llist_del_all(&hwsched->requeue[id]);
+	jobs = llist_del_all(&hwsched->jobs[id]);
+
+	hwsched_handle_jobs_list(adreno_dev, id, map, requeue);
+	hwsched_handle_jobs_list(adreno_dev, id, map, jobs);
+}
+
+/**
+ * hwsched_issuecmds() - Issue commmands from pending contexts
+ * @adreno_dev: Pointer to the adreno device struct
+ *
+ * Issue as many commands as possible (up to inflight) from the pending contexts
+ * This function assumes the dispatcher mutex has been locked.
+ */
+static void hwsched_issuecmds(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(hwsched->jobs); i++)
+		hwsched_handle_jobs(adreno_dev, i);
+}
+
+void adreno_hwsched_trigger(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+
+	kthread_queue_work(hwsched->worker, &hwsched->work);
+}
+
+static inline void _decrement_submit_now(struct kgsl_device *device)
+{
+	spin_lock(&device->submit_lock);
+	device->submit_now--;
+	spin_unlock(&device->submit_lock);
+}
+
+/**
+ * adreno_hwsched_issuecmds() - Issue commmands from pending contexts
+ * @adreno_dev: Pointer to the adreno device struct
+ *
+ * Lock the dispatcher and call hwsched_issuecmds
+ */
+static void adreno_hwsched_issuecmds(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	spin_lock(&device->submit_lock);
+	/* If GPU state is not ACTIVE, schedule the work for later */
+	if (device->skip_inline_submit) {
+		spin_unlock(&device->submit_lock);
+		goto done;
+	}
+	device->submit_now++;
+	spin_unlock(&device->submit_lock);
+
+	/* If the dispatcher is busy then schedule the work for later */
+	if (!mutex_trylock(&hwsched->mutex)) {
+		_decrement_submit_now(device);
+		goto done;
+	}
+
+	if (!hwsched_in_fault(hwsched))
+		hwsched_issuecmds(adreno_dev);
+
+	if (hwsched->inflight > 0) {
+		mutex_lock(&device->mutex);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		mutex_unlock(&device->mutex);
+	}
+
+	mutex_unlock(&hwsched->mutex);
+	_decrement_submit_now(device);
+	return;
+
+done:
+	adreno_hwsched_trigger(adreno_dev);
+}
+
+/**
+ * get_timestamp() - Return the next timestamp for the context
+ * @drawctxt - Pointer to an adreno draw context struct
+ * @drawobj - Pointer to a drawobj
+ * @timestamp - Pointer to a timestamp value possibly passed from the user
+ * @user_ts - user generated timestamp
+ *
+ * Assign a timestamp based on the settings of the draw context and the command
+ * batch.
+ */
+static int get_timestamp(struct adreno_context *drawctxt,
+		struct kgsl_drawobj *drawobj, unsigned int *timestamp,
+		unsigned int user_ts)
+{
+
+	if (drawctxt->base.flags & KGSL_CONTEXT_USER_GENERATED_TS) {
+		/*
+		 * User specified timestamps need to be greater than the last
+		 * issued timestamp in the context
+		 */
+		if (timestamp_cmp(drawctxt->timestamp, user_ts) >= 0)
+			return -ERANGE;
+
+		drawctxt->timestamp = user_ts;
+	} else
+		drawctxt->timestamp++;
+
+	*timestamp = drawctxt->timestamp;
+	drawobj->timestamp = *timestamp;
+	return 0;
+}
+
+static inline int _wait_for_room_in_context_queue(
+	struct adreno_context *drawctxt, u32 count)
+{
+	int ret = 0;
+
+	/*
+	 * There is always a possibility that dispatcher may end up pushing
+	 * the last popped draw object back to the context drawqueue. Hence,
+	 * we can only queue up to _context_drawqueue_size - 1 here to make
+	 * sure we never let drawqueue->queued exceed _context_drawqueue_size.
+	 */
+	if ((drawctxt->queued + count) > (_context_drawqueue_size - 1)) {
+		trace_adreno_drawctxt_sleep(drawctxt);
+		spin_unlock(&drawctxt->lock);
+
+		ret = wait_event_interruptible_timeout(drawctxt->wq,
+			_check_context_queue(drawctxt, count),
+			msecs_to_jiffies(_context_queue_wait));
+
+		spin_lock(&drawctxt->lock);
+		trace_adreno_drawctxt_wake(drawctxt);
+
+		/*
+		 * Account for the possibility that the context got invalidated
+		 * while we were sleeping
+		 */
+		if (ret > 0)
+			ret = kgsl_check_context_state(&drawctxt->base);
+		else if (ret == 0)
+			ret = -ETIMEDOUT;
+	}
+
+	return ret;
+}
+
+static unsigned int _check_context_state_to_queue_cmds(
+	struct adreno_context *drawctxt, u32 count)
+{
+	int ret = kgsl_check_context_state(&drawctxt->base);
+
+	if (ret)
+		return ret;
+
+	return _wait_for_room_in_context_queue(drawctxt, count);
+}
+
+static void _queue_drawobj(struct adreno_context *drawctxt,
+	struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_context *context = drawobj->context;
+
+	/* Put the command into the queue */
+	drawctxt->drawqueue[drawctxt->drawqueue_tail] = drawobj;
+	drawctxt->drawqueue_tail = (drawctxt->drawqueue_tail + 1) %
+			ADRENO_CONTEXT_DRAWQUEUE_SIZE;
+	drawctxt->queued++;
+	msm_perf_events_update(MSM_PERF_GFX, MSM_PERF_QUEUE,
+		pid_nr(context->proc_priv->pid),
+		context->id, drawobj->timestamp,
+		!!(drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME));
+	trace_adreno_cmdbatch_queued(drawobj, drawctxt->queued);
+}
+
+static int _queue_cmdobj(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, struct kgsl_drawobj_cmd *cmdobj,
+	uint32_t *timestamp, unsigned int user_ts)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	u32 j;
+	int ret;
+
+	ret = get_timestamp(drawctxt, drawobj, timestamp, user_ts);
+	if (ret)
+		return ret;
+
+	/*
+	 * If this is a real command then we need to force any markers
+	 * queued before it to dispatch to keep time linear - set the
+	 * skip bit so the commands get NOPed.
+	 */
+	j = drawctxt->drawqueue_head;
+
+	while (j != drawctxt->drawqueue_tail) {
+		if (drawctxt->drawqueue[j]->type == MARKEROBJ_TYPE) {
+			struct kgsl_drawobj_cmd *markerobj =
+				CMDOBJ(drawctxt->drawqueue[j]);
+
+			set_bit(CMDOBJ_SKIP, &markerobj->priv);
+		}
+
+		j = DRAWQUEUE_NEXT(j, ADRENO_CONTEXT_DRAWQUEUE_SIZE);
+	}
+
+	drawctxt->queued_timestamp = *timestamp;
+
+	_queue_drawobj(drawctxt, drawobj);
+
+	return 0;
+}
+
+static void _queue_syncobj(struct adreno_context *drawctxt,
+	struct kgsl_drawobj_sync *syncobj, uint32_t *timestamp)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(syncobj);
+
+	*timestamp = 0;
+	drawobj->timestamp = 0;
+
+	_queue_drawobj(drawctxt, drawobj);
+}
+
+static int _queue_markerobj(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt, struct kgsl_drawobj_cmd *markerobj,
+	u32 *timestamp, u32 user_ts)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(markerobj);
+	int ret;
+
+	ret = get_timestamp(drawctxt, drawobj, timestamp, user_ts);
+	if (ret)
+		return ret;
+
+	/*
+	 * See if we can fastpath this thing - if nothing is queued
+	 * and nothing is inflight retire without bothering the GPU
+	 */
+	if (!drawctxt->queued && kgsl_check_timestamp(drawobj->device,
+		drawobj->context, drawctxt->queued_timestamp)) {
+		_retire_timestamp(drawobj);
+		return 1;
+	}
+
+	/*
+	 * Remember the last queued timestamp - the marker will block
+	 * until that timestamp is expired (unless another command
+	 * comes along and forces the marker to execute)
+	 */
+	 markerobj->marker_timestamp = drawctxt->queued_timestamp;
+	 drawctxt->queued_timestamp = *timestamp;
+
+	_queue_drawobj(drawctxt, drawobj);
+
+	return 0;
+}
+
+static int _queue_bindobj(struct adreno_context *drawctxt,
+		struct kgsl_drawobj *drawobj, u32 *timestamp, u32 user_ts)
+{
+	int ret;
+
+	ret = get_timestamp(drawctxt, drawobj, timestamp, user_ts);
+	if (ret)
+		return ret;
+
+	drawctxt->queued_timestamp = *timestamp;
+	_queue_drawobj(drawctxt, drawobj);
+
+	return 0;
+}
+
+static void _queue_timelineobj(struct adreno_context *drawctxt,
+		struct kgsl_drawobj *drawobj)
+{
+	/*
+	 * This drawobj is not submitted to the GPU so use a timestamp of 0.
+	 * Update the timestamp through a subsequent marker to keep userspace
+	 * happy.
+	 */
+	drawobj->timestamp = 0;
+
+	_queue_drawobj(drawctxt, drawobj);
+}
+
+static int adreno_hwsched_queue_cmds(struct kgsl_device_private *dev_priv,
+	struct kgsl_context *context, struct kgsl_drawobj *drawobj[],
+	u32 count, u32 *timestamp)
+
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct adreno_dispatch_job *job;
+	int ret;
+	unsigned int i, user_ts;
+
+	/*
+	 * There is always a possibility that dispatcher may end up pushing
+	 * the last popped draw object back to the context drawqueue. Hence,
+	 * we can only queue up to _context_drawqueue_size - 1 here to make
+	 * sure we never let drawqueue->queued exceed _context_drawqueue_size.
+	 */
+	if (!count || count > _context_drawqueue_size - 1)
+		return -EINVAL;
+
+	for (i = 0; i < count; i++) {
+		struct kgsl_drawobj_cmd *cmdobj;
+		struct kgsl_memobj_node *ib;
+
+		if (!is_cmdobj(drawobj[i]))
+			continue;
+
+		cmdobj = CMDOBJ(drawobj[i]);
+
+		list_for_each_entry(ib, &cmdobj->cmdlist, node)
+			cmdobj->numibs++;
+
+		if (cmdobj->numibs > HWSCHED_MAX_IBS)
+			return -EINVAL;
+	}
+
+	ret = kgsl_check_context_state(&drawctxt->base);
+	if (ret)
+		return ret;
+
+	ret = adreno_verify_cmdobj(dev_priv, context, drawobj, count);
+	if (ret)
+		return ret;
+
+	/* wait for the suspend gate */
+	wait_for_completion(&device->halt_gate);
+
+	job = kmem_cache_alloc(jobs_cache, GFP_KERNEL);
+	if (!job)
+		return -ENOMEM;
+
+	job->drawctxt = drawctxt;
+
+	spin_lock(&drawctxt->lock);
+
+	ret = _check_context_state_to_queue_cmds(drawctxt, count);
+	if (ret) {
+		spin_unlock(&drawctxt->lock);
+		kmem_cache_free(jobs_cache, job);
+		return ret;
+	}
+
+	user_ts = *timestamp;
+
+	/*
+	 * If there is only one drawobj in the array and it is of
+	 * type SYNCOBJ_TYPE, skip comparing user_ts as it can be 0
+	 */
+	if (!(count == 1 && drawobj[0]->type == SYNCOBJ_TYPE) &&
+		(drawctxt->base.flags & KGSL_CONTEXT_USER_GENERATED_TS)) {
+		/*
+		 * User specified timestamps need to be greater than the last
+		 * issued timestamp in the context
+		 */
+		if (timestamp_cmp(drawctxt->timestamp, user_ts) >= 0) {
+			spin_unlock(&drawctxt->lock);
+			kmem_cache_free(jobs_cache, job);
+			return -ERANGE;
+		}
+	}
+
+	for (i = 0; i < count; i++) {
+
+		switch (drawobj[i]->type) {
+		case MARKEROBJ_TYPE:
+			ret = _queue_markerobj(adreno_dev, drawctxt,
+					CMDOBJ(drawobj[i]),
+					timestamp, user_ts);
+			if (ret == 1) {
+				spin_unlock(&drawctxt->lock);
+				kmem_cache_free(jobs_cache, job);
+				return 0;
+			} else if (ret) {
+				spin_unlock(&drawctxt->lock);
+				kmem_cache_free(jobs_cache, job);
+				return ret;
+			}
+			break;
+		case CMDOBJ_TYPE:
+			ret = _queue_cmdobj(adreno_dev, drawctxt,
+						CMDOBJ(drawobj[i]),
+						timestamp, user_ts);
+			if (ret) {
+				spin_unlock(&drawctxt->lock);
+				kmem_cache_free(jobs_cache, job);
+				return ret;
+			}
+			break;
+		case SYNCOBJ_TYPE:
+			_queue_syncobj(drawctxt, SYNCOBJ(drawobj[i]),
+						timestamp);
+			break;
+		case BINDOBJ_TYPE:
+			ret = _queue_bindobj(drawctxt, drawobj[i], timestamp,
+						user_ts);
+			if (ret) {
+				spin_unlock(&drawctxt->lock);
+				kmem_cache_free(jobs_cache, job);
+				return ret;
+			}
+			break;
+		case TIMELINEOBJ_TYPE:
+			_queue_timelineobj(drawctxt, drawobj[i]);
+			break;
+		default:
+			spin_unlock(&drawctxt->lock);
+			kmem_cache_free(jobs_cache, job);
+			return -EINVAL;
+		}
+
+	}
+
+	adreno_track_context(adreno_dev, NULL, drawctxt);
+
+	spin_unlock(&drawctxt->lock);
+
+	/* Add the context to the dispatcher pending list */
+	if (_kgsl_context_get(&drawctxt->base)) {
+		trace_dispatch_queue_context(drawctxt);
+		llist_add(&job->node, &hwsched->jobs[drawctxt->base.priority]);
+		adreno_hwsched_issuecmds(adreno_dev);
+
+	} else
+		kmem_cache_free(jobs_cache, job);
+
+	return 0;
+}
+
+void adreno_hwsched_retire_cmdobj(struct adreno_hwsched *hwsched,
+	struct kgsl_drawobj_cmd *cmdobj)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct kgsl_mem_entry *entry;
+	struct kgsl_drawobj_profiling_buffer *profile_buffer;
+	struct kgsl_context *context = drawobj->context;
+
+	msm_perf_events_update(MSM_PERF_GFX, MSM_PERF_RETIRED,
+		pid_nr(context->proc_priv->pid),
+		context->id, drawobj->timestamp,
+		!!(drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME));
+
+	if (drawobj->flags & KGSL_DRAWOBJ_END_OF_FRAME) {
+		atomic64_inc(&drawobj->context->proc_priv->frame_count);
+		atomic_inc(&drawobj->context->proc_priv->period->frames);
+	}
+
+	entry = cmdobj->profiling_buf_entry;
+	if (entry) {
+		profile_buffer = kgsl_gpuaddr_to_vaddr(&entry->memdesc,
+			cmdobj->profiling_buffer_gpuaddr);
+
+		if (profile_buffer == NULL)
+			return;
+
+		kgsl_memdesc_unmap(&entry->memdesc);
+	}
+
+	trace_adreno_cmdbatch_done(drawobj->context->id,
+		drawobj->context->priority, drawobj->timestamp);
+
+	if (hwsched->big_cmdobj == cmdobj) {
+		hwsched->big_cmdobj = NULL;
+		kgsl_drawobj_put(drawobj);
+	}
+
+	kgsl_drawobj_destroy(drawobj);
+}
+
+static bool drawobj_retired(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj *drawobj)
+{
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_drawobj_cmd *cmdobj;
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+
+	if ((drawobj->type & SYNCOBJ_TYPE) != 0) {
+		struct gmu_context_queue_header *hdr =
+			drawctxt->gmu_context_queue.hostptr;
+
+		if (timestamp_cmp(drawobj->timestamp, hdr->sync_obj_ts) > 0)
+			return false;
+
+		trace_adreno_syncobj_retired(drawobj->context->id, drawobj->timestamp);
+		kgsl_drawobj_destroy(drawobj);
+		return true;
+	}
+
+	cmdobj = CMDOBJ(drawobj);
+
+	if (!kgsl_check_timestamp(device, drawobj->context,
+		drawobj->timestamp))
+		return false;
+
+	adreno_hwsched_retire_cmdobj(hwsched, cmdobj);
+	return true;
+}
+
+static void retire_drawobj_list(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct cmd_list_obj *obj, *tmp;
+
+	list_for_each_entry_safe(obj, tmp, &hwsched->cmd_list, node) {
+		struct kgsl_drawobj *drawobj = obj->drawobj;
+
+		if (!drawobj_retired(adreno_dev, drawobj))
+			continue;
+
+		list_del_init(&obj->node);
+
+		kmem_cache_free(obj_cache, obj);
+
+		hwsched->inflight--;
+	}
+}
+
+/* Take down the dispatcher and release any power states */
+static void hwsched_power_down(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+
+	mutex_lock(&device->mutex);
+
+	if (test_and_clear_bit(ADRENO_HWSCHED_ACTIVE, &hwsched->flags))
+		complete_all(&hwsched->idle_gate);
+
+	if (test_bit(ADRENO_HWSCHED_POWER, &hwsched->flags)) {
+		adreno_active_count_put(adreno_dev);
+		clear_bit(ADRENO_HWSCHED_POWER, &hwsched->flags);
+	}
+
+	mutex_unlock(&device->mutex);
+}
+
+static void adreno_hwsched_queue_context(struct adreno_device *adreno_dev,
+	struct adreno_context *drawctxt)
+{
+	hwsched_queue_context(adreno_dev, drawctxt);
+	adreno_hwsched_trigger(adreno_dev);
+}
+
+void adreno_hwsched_start(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	complete_all(&device->halt_gate);
+
+	adreno_hwsched_trigger(adreno_dev);
+}
+
+static void change_preemption(struct adreno_device *adreno_dev, void *priv)
+{
+	change_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv);
+}
+
+static int _preemption_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (!adreno_preemption_feature_set(adreno_dev) ||
+		(test_bit(ADRENO_DEVICE_PREEMPTION, &adreno_dev->priv) == val))
+		return 0;
+
+	return adreno_power_cycle(adreno_dev, change_preemption, NULL);
+}
+
+static bool _preemption_show(struct adreno_device *adreno_dev)
+{
+	return adreno_is_preemption_enabled(adreno_dev);
+}
+
+static unsigned int _preempt_count_show(struct adreno_device *adreno_dev)
+{
+	const struct adreno_hwsched_ops *hwsched_ops =
+		adreno_dev->hwsched.hwsched_ops;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 count;
+
+	mutex_lock(&device->mutex);
+
+	count = hwsched_ops->preempt_count(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+
+	return count;
+}
+
+static int _ft_long_ib_detect_store(struct adreno_device *adreno_dev, bool val)
+{
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->long_ib_detect,
+			val);
+}
+
+static bool _ft_long_ib_detect_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->long_ib_detect;
+}
+
+static ADRENO_SYSFS_BOOL(preemption);
+static ADRENO_SYSFS_RO_U32(preempt_count);
+static ADRENO_SYSFS_BOOL(ft_long_ib_detect);
+
+static const struct attribute *_hwsched_attr_list[] = {
+	&adreno_attr_preemption.attr.attr,
+	&adreno_attr_preempt_count.attr.attr,
+	&adreno_attr_ft_long_ib_detect.attr.attr,
+	NULL,
+};
+
+void adreno_hwsched_deregister_hw_fence(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct adreno_hw_fence *hw_fence = &hwsched->hw_fence;
+
+	if (!test_bit(ADRENO_HWSCHED_HW_FENCE, &hwsched->flags))
+		return;
+
+	msm_hw_fence_deregister(hwsched->hw_fence.handle);
+
+	if (hw_fence->memdesc.sgt)
+		sg_free_table(hw_fence->memdesc.sgt);
+
+	memset(&hw_fence->memdesc, 0x0, sizeof(hw_fence->memdesc));
+
+	kmem_cache_destroy(hwsched->hw_fence_cache);
+
+	clear_bit(ADRENO_HWSCHED_HW_FENCE, &hwsched->flags);
+}
+
+static void adreno_hwsched_dispatcher_close(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!IS_ERR_OR_NULL(hwsched->worker))
+		kthread_destroy_worker(hwsched->worker);
+
+	adreno_set_dispatch_ops(adreno_dev, NULL);
+
+	kmem_cache_destroy(jobs_cache);
+	kmem_cache_destroy(obj_cache);
+
+	sysfs_remove_files(&device->dev->kobj, _hwsched_attr_list);
+
+	kfree(hwsched->ctxt_bad);
+
+	adreno_hwsched_deregister_hw_fence(adreno_dev);
+}
+
+static void force_retire_timestamp(struct kgsl_device *device,
+	struct kgsl_drawobj *drawobj)
+{
+	kgsl_sharedmem_writel(device->memstore,
+		KGSL_MEMSTORE_OFFSET(drawobj->context->id, soptimestamp),
+		drawobj->timestamp);
+
+	kgsl_sharedmem_writel(device->memstore,
+		KGSL_MEMSTORE_OFFSET(drawobj->context->id, eoptimestamp),
+		drawobj->timestamp);
+}
+
+/* Return true if drawobj needs to replayed, false otherwise */
+static bool drawobj_replay(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_drawobj_cmd *cmdobj;
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+
+	if ((drawobj->type & SYNCOBJ_TYPE) != 0) {
+
+		if (kgsl_drawobj_events_pending(SYNCOBJ(drawobj)))
+			return true;
+
+		trace_adreno_syncobj_retired(drawobj->context->id, drawobj->timestamp);
+		kgsl_drawobj_destroy(drawobj);
+		return false;
+	}
+
+	cmdobj = CMDOBJ(drawobj);
+
+	if (kgsl_check_timestamp(device, drawobj->context,
+		drawobj->timestamp) || kgsl_context_is_bad(drawobj->context)) {
+		adreno_hwsched_retire_cmdobj(hwsched, cmdobj);
+		return false;
+	}
+
+	return true;
+}
+
+void adreno_hwsched_replay(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_gpudev *gpudev  = ADRENO_GPU_DEVICE(adreno_dev);
+	struct cmd_list_obj *obj, *tmp;
+	u32 retired = 0;
+
+	list_for_each_entry_safe(obj, tmp, &hwsched->cmd_list, node) {
+		struct kgsl_drawobj *drawobj = obj->drawobj;
+
+		/*
+		 * Get rid of retired objects or objects that belong to detached
+		 * or invalidated contexts
+		 */
+		if (drawobj_replay(adreno_dev, drawobj)) {
+			hwsched->hwsched_ops->submit_drawobj(adreno_dev, drawobj);
+			continue;
+		}
+
+		retired++;
+
+		list_del_init(&obj->node);
+		kmem_cache_free(obj_cache, obj);
+		hwsched->inflight--;
+	}
+
+	if (hwsched->recurring_cmdobj) {
+		u32 event;
+
+		if (kgsl_context_invalid(
+			hwsched->recurring_cmdobj->base.context)) {
+			clear_bit(CMDOBJ_RECURRING_START,
+					&hwsched->recurring_cmdobj->priv);
+			set_bit(CMDOBJ_RECURRING_STOP,
+					&hwsched->recurring_cmdobj->priv);
+			event = GPU_SSR_FATAL;
+		} else {
+			event = GPU_SSR_END;
+		}
+		gpudev->send_recurring_cmdobj(adreno_dev,
+			hwsched->recurring_cmdobj);
+		srcu_notifier_call_chain(&device->nh, event, NULL);
+	}
+
+	/* Signal fences */
+	if (retired)
+		kgsl_process_event_groups(device);
+}
+
+static void do_fault_header_lpac(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj *drawobj_lpac)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_context *drawctxt_lpac;
+	u32 status;
+	u32 lpac_rptr, lpac_wptr, lpac_ib1sz, lpac_ib2sz;
+	u64 hi, lo, lpac_ib1base, lpac_ib2base;
+
+	adreno_readreg(adreno_dev, ADRENO_REG_RBBM_STATUS, &status);
+	lpac_rptr = kgsl_regmap_read(&device->regmap, GEN7_CP_LPAC_RB_RPTR);
+	lpac_wptr = kgsl_regmap_read(&device->regmap, GEN7_CP_LPAC_RB_WPTR);
+	hi = kgsl_regmap_read(&device->regmap, GEN7_CP_LPAC_IB1_BASE_HI);
+	lo = kgsl_regmap_read(&device->regmap, GEN7_CP_LPAC_IB1_BASE);
+	lpac_ib1base = lo | (hi << 32);
+	lpac_ib1sz = kgsl_regmap_read(&device->regmap, GEN7_CP_LPAC_IB1_REM_SIZE);
+	hi = kgsl_regmap_read(&device->regmap, GEN7_CP_LPAC_IB2_BASE_HI);
+	lo = kgsl_regmap_read(&device->regmap, GEN7_CP_LPAC_IB2_BASE);
+	lpac_ib2base = lo | (hi << 32);
+	lpac_ib2sz = kgsl_regmap_read(&device->regmap, GEN7_CP_LPAC_IB2_REM_SIZE);
+
+	drawctxt_lpac = ADRENO_CONTEXT(drawobj_lpac->context);
+	drawobj_lpac->context->last_faulted_cmd_ts = drawobj_lpac->timestamp;
+	drawobj_lpac->context->total_fault_count++;
+
+	pr_context(device, drawobj_lpac->context,
+		"LPAC ctx %d ctx_type %s ts %d status %8.8X dispatch_queue=%d rb %4.4x/%4.4x ib1 %16.16llX/%4.4x ib2 %16.16llX/%4.4x\n",
+		drawobj_lpac->context->id, kgsl_context_type(drawctxt_lpac->type),
+		drawobj_lpac->timestamp, status,
+		drawobj_lpac->context->gmu_dispatch_queue, lpac_rptr, lpac_wptr,
+		lpac_ib1base, lpac_ib1sz, lpac_ib2base, lpac_ib2sz);
+
+	pr_context(device, drawobj_lpac->context, "lpac cmdline: %s\n",
+			drawctxt_lpac->base.proc_priv->cmdline);
+
+	trace_adreno_gpu_fault(drawobj_lpac->context->id, drawobj_lpac->timestamp, status,
+		lpac_rptr, lpac_wptr, lpac_ib1base, lpac_ib1sz, lpac_ib2base, lpac_ib2sz,
+		adreno_get_level(drawobj_lpac->context));
+
+}
+
+static void do_fault_header(struct adreno_device *adreno_dev,
+	struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_context *drawctxt;
+	u32 status, rptr, wptr, ib1sz, ib2sz;
+	u64 ib1base, ib2base;
+
+	adreno_readreg(adreno_dev, ADRENO_REG_RBBM_STATUS, &status);
+	adreno_readreg(adreno_dev, ADRENO_REG_CP_RB_RPTR, &rptr);
+	adreno_readreg(adreno_dev, ADRENO_REG_CP_RB_WPTR, &wptr);
+	adreno_readreg64(adreno_dev, ADRENO_REG_CP_IB1_BASE,
+			ADRENO_REG_CP_IB1_BASE_HI, &ib1base);
+	adreno_readreg(adreno_dev, ADRENO_REG_CP_IB1_BUFSZ, &ib1sz);
+	adreno_readreg64(adreno_dev, ADRENO_REG_CP_IB2_BASE,
+			ADRENO_REG_CP_IB2_BASE_HI, &ib2base);
+	adreno_readreg(adreno_dev, ADRENO_REG_CP_IB2_BUFSZ, &ib2sz);
+
+	drawctxt = ADRENO_CONTEXT(drawobj->context);
+	drawobj->context->last_faulted_cmd_ts = drawobj->timestamp;
+	drawobj->context->total_fault_count++;
+
+	pr_context(device, drawobj->context,
+		"ctx %u ctx_type %s ts %u status %8.8X dispatch_queue=%d rb %4.4x/%4.4x ib1 %16.16llX/%4.4x ib2 %16.16llX/%4.4x\n",
+		drawobj->context->id, kgsl_context_type(drawctxt->type),
+		drawobj->timestamp, status,
+		drawobj->context->gmu_dispatch_queue, rptr, wptr,
+		ib1base, ib1sz, ib2base, ib2sz);
+
+	pr_context(device, drawobj->context, "cmdline: %s\n",
+			drawctxt->base.proc_priv->cmdline);
+
+	trace_adreno_gpu_fault(drawobj->context->id, drawobj->timestamp, status,
+		rptr, wptr, ib1base, ib1sz, ib2base, ib2sz,
+		adreno_get_level(drawobj->context));
+
+}
+
+static struct cmd_list_obj *get_active_cmdobj_lpac(
+	struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct cmd_list_obj *obj, *tmp, *active_obj = NULL;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 consumed = 0, retired = 0;
+	struct kgsl_drawobj *drawobj = NULL;
+
+	list_for_each_entry_safe(obj, tmp, &hwsched->cmd_list, node) {
+		drawobj = obj->drawobj;
+
+		if (!(kgsl_context_is_lpac(drawobj->context)))
+			continue;
+
+		kgsl_readtimestamp(device, drawobj->context,
+			KGSL_TIMESTAMP_CONSUMED, &consumed);
+		kgsl_readtimestamp(device, drawobj->context,
+			KGSL_TIMESTAMP_RETIRED, &retired);
+
+		if (!consumed)
+			continue;
+
+		if (consumed == retired)
+			continue;
+
+		/*
+		 * Find the first submission that started but didn't finish
+		 * We only care about one ringbuffer for LPAC so just look for the
+		 * first unfinished submission
+		 */
+		if (!active_obj)
+			active_obj = obj;
+	}
+
+	if (active_obj) {
+		drawobj = active_obj->drawobj;
+
+		if (kref_get_unless_zero(&drawobj->refcount)) {
+			struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj);
+
+			set_bit(CMDOBJ_FAULT, &cmdobj->priv);
+			return active_obj;
+		}
+	}
+
+	return NULL;
+}
+
+static struct cmd_list_obj *get_active_cmdobj(
+	struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct cmd_list_obj *obj, *tmp, *active_obj = NULL;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	u32 consumed = 0, retired = 0, prio = UINT_MAX;
+	struct kgsl_drawobj *drawobj = NULL;
+
+	list_for_each_entry_safe(obj, tmp, &hwsched->cmd_list, node) {
+		drawobj = obj->drawobj;
+
+		/* We track LPAC separately */
+		if (!is_cmdobj(drawobj) || kgsl_context_is_lpac(drawobj->context))
+			continue;
+
+		kgsl_readtimestamp(device, drawobj->context,
+			KGSL_TIMESTAMP_CONSUMED, &consumed);
+		kgsl_readtimestamp(device, drawobj->context,
+			KGSL_TIMESTAMP_RETIRED, &retired);
+
+		if (!consumed)
+			continue;
+
+		if (consumed == retired)
+			continue;
+
+		/* Find the first submission that started but didn't finish */
+		if (!active_obj) {
+			active_obj = obj;
+			prio = adreno_get_level(drawobj->context);
+			continue;
+		}
+
+		/* Find the highest priority active submission */
+		if (adreno_get_level(drawobj->context) < prio) {
+			active_obj = obj;
+			prio = adreno_get_level(drawobj->context);
+		}
+	}
+
+	if (active_obj) {
+		struct kgsl_drawobj_cmd *cmdobj;
+
+		drawobj = active_obj->drawobj;
+		cmdobj = CMDOBJ(drawobj);
+
+		if (kref_get_unless_zero(&drawobj->refcount)) {
+			set_bit(CMDOBJ_FAULT, &cmdobj->priv);
+			return active_obj;
+		}
+	}
+
+	return NULL;
+}
+
+static struct cmd_list_obj *get_fault_cmdobj(struct adreno_device *adreno_dev,
+				u32 ctxt_id, u32 ts)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct cmd_list_obj *obj, *tmp;
+
+	list_for_each_entry_safe(obj, tmp, &hwsched->cmd_list, node) {
+		struct kgsl_drawobj *drawobj = obj->drawobj;
+
+		if (!is_cmdobj(drawobj))
+			continue;
+
+		if ((ctxt_id == drawobj->context->id) &&
+			(ts == drawobj->timestamp)) {
+			if (kref_get_unless_zero(&drawobj->refcount)) {
+				struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj);
+
+				set_bit(CMDOBJ_FAULT, &cmdobj->priv);
+				return obj;
+			}
+		}
+	}
+
+	return NULL;
+}
+
+static bool context_is_throttled(struct kgsl_device *device,
+	struct kgsl_context *context)
+{
+	if (ktime_ms_delta(ktime_get(), context->fault_time) >
+		_fault_throttle_time) {
+		context->fault_time = ktime_get();
+		context->fault_count = 1;
+		return false;
+	}
+
+	context->fault_count++;
+
+	if (context->fault_count > _fault_throttle_burst) {
+		pr_context(device, context,
+			"gpu fault threshold exceeded %d faults in %d msecs\n",
+			_fault_throttle_burst, _fault_throttle_time);
+		return true;
+	}
+
+	return false;
+}
+
+static void _print_syncobj(struct adreno_device *adreno_dev, struct kgsl_drawobj *drawobj)
+{
+	int i, j, fence_index = 0;
+	struct kgsl_drawobj_sync *syncobj = SYNCOBJ(drawobj);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	for (i = 0; i < syncobj->numsyncs; i++) {
+		struct kgsl_drawobj_sync_event *event = &syncobj->synclist[i];
+		struct kgsl_sync_fence_cb *kcb = event->handle;
+		struct dma_fence **fences;
+		struct dma_fence_array *array;
+		u32 num_fences;
+
+		array = to_dma_fence_array(kcb->fence);
+		if (array != NULL) {
+			num_fences = array->num_fences;
+			fences = array->fences;
+		} else {
+			num_fences = 1;
+			fences = &kcb->fence;
+		}
+
+		for (j = 0; j < num_fences; j++, fence_index++) {
+			bool kgsl = is_kgsl_fence(fences[j]);
+			bool signaled = test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fences[j]->flags);
+			char value[32] = "unknown";
+
+			if (fences[j]->ops->timeline_value_str)
+				fences[j]->ops->timeline_value_str(fences[j], value, sizeof(value));
+
+			dev_err(device->dev,
+				"dma fence[%d] signaled:%d kgsl:%d ctx:%llu seqno:%llu value:%s\n",
+				fence_index, signaled, kgsl, fences[j]->context, fences[j]->seqno,
+				value);
+		}
+	}
+
+}
+
+static void print_fault_syncobj(struct adreno_device *adreno_dev,
+				u32 ctxt_id, u32 ts)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct cmd_list_obj *obj;
+
+	list_for_each_entry(obj, &hwsched->cmd_list, node) {
+		struct kgsl_drawobj *drawobj = obj->drawobj;
+
+		if (drawobj->type == SYNCOBJ_TYPE) {
+			if ((ctxt_id == drawobj->context->id) &&
+			(ts == drawobj->timestamp))
+				_print_syncobj(adreno_dev, drawobj);
+		}
+	}
+}
+
+static void adreno_hwsched_reset_and_snapshot_legacy(struct adreno_device *adreno_dev, int fault)
+{
+	struct kgsl_drawobj *drawobj = NULL;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_context *context = NULL;
+	struct cmd_list_obj *obj;
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct hfi_context_bad_cmd_legacy *cmd = hwsched->ctxt_bad;
+
+	if (device->state != KGSL_STATE_ACTIVE)
+		return;
+
+	if (hwsched->recurring_cmdobj)
+		srcu_notifier_call_chain(&device->nh, GPU_SSR_BEGIN, NULL);
+
+	if (cmd->error == GMU_SYNCOBJ_TIMEOUT_ERROR) {
+		print_fault_syncobj(adreno_dev, cmd->ctxt_id, cmd->ts);
+		gmu_core_fault_snapshot(device);
+		goto done;
+	}
+
+	/*
+	 * First, try to see if the faulted command object is marked
+	 * in case there was a context bad hfi. But, with stall-on-fault,
+	 * we know that GMU cannot send context bad hfi. Hence, attempt
+	 * to walk the list of active submissions to find the one that
+	 * faulted.
+	 */
+	obj = get_fault_cmdobj(adreno_dev, cmd->ctxt_id, cmd->ts);
+	if (!obj && (fault & ADRENO_IOMMU_PAGE_FAULT))
+		obj = get_active_cmdobj(adreno_dev);
+
+	if (obj) {
+		drawobj = obj->drawobj;
+		trace_adreno_cmdbatch_fault(CMDOBJ(drawobj), fault);
+	} else if (hwsched->recurring_cmdobj &&
+		hwsched->recurring_cmdobj->base.context->id == cmd->ctxt_id) {
+		drawobj = DRAWOBJ(hwsched->recurring_cmdobj);
+		trace_adreno_cmdbatch_fault(hwsched->recurring_cmdobj, fault);
+		if (!kref_get_unless_zero(&drawobj->refcount))
+			drawobj = NULL;
+	}
+
+	if (!drawobj) {
+		if (fault & ADRENO_GMU_FAULT)
+			gmu_core_fault_snapshot(device);
+		else
+			kgsl_device_snapshot(device, NULL, NULL, false);
+		goto done;
+	}
+
+	context = drawobj->context;
+
+	do_fault_header(adreno_dev, drawobj);
+
+	kgsl_device_snapshot(device, context, NULL, false);
+
+	force_retire_timestamp(device, drawobj);
+
+	if ((context->flags & KGSL_CONTEXT_INVALIDATE_ON_FAULT) ||
+		(context->flags & KGSL_CONTEXT_NO_FAULT_TOLERANCE) ||
+		(cmd->error == GMU_GPU_SW_HANG) ||
+		(cmd->error == GMU_GPU_SW_FUSE_VIOLATION) ||
+		context_is_throttled(device, context)) {
+		adreno_drawctxt_set_guilty(device, context);
+	}
+
+	/*
+	 * Put back the reference which we incremented while trying to find
+	 * faulted command object
+	 */
+	kgsl_drawobj_put(drawobj);
+done:
+	memset(hwsched->ctxt_bad, 0x0, HFI_MAX_MSG_SIZE);
+	gpudev->reset(adreno_dev);
+}
+
+static void adreno_hwsched_reset_and_snapshot(struct adreno_device *adreno_dev, int fault)
+{
+	struct kgsl_drawobj *drawobj = NULL;
+	struct kgsl_drawobj *drawobj_lpac = NULL;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_context *context = NULL;
+	struct kgsl_context *context_lpac = NULL;
+	struct cmd_list_obj *obj;
+	struct cmd_list_obj *obj_lpac;
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct hfi_context_bad_cmd *cmd = hwsched->ctxt_bad;
+
+	if (device->state != KGSL_STATE_ACTIVE)
+		return;
+
+	if (hwsched->recurring_cmdobj)
+		srcu_notifier_call_chain(&device->nh, GPU_SSR_BEGIN, NULL);
+
+	if (cmd->error == GMU_SYNCOBJ_TIMEOUT_ERROR) {
+		print_fault_syncobj(adreno_dev, cmd->gc.ctxt_id, cmd->gc.ts);
+		gmu_core_fault_snapshot(device);
+		goto done;
+	}
+
+	/*
+	 * First, try to see if the faulted command object is marked
+	 * in case there was a context bad hfi. But, with stall-on-fault,
+	 * we know that GMU cannot send context bad hfi. Hence, attempt
+	 * to walk the list of active submissions to find the one that
+	 * faulted.
+	 */
+	obj = get_fault_cmdobj(adreno_dev, cmd->gc.ctxt_id, cmd->gc.ts);
+	obj_lpac = get_fault_cmdobj(adreno_dev, cmd->lpac.ctxt_id, cmd->lpac.ts);
+
+	if (!obj && (fault & ADRENO_IOMMU_PAGE_FAULT))
+		obj = get_active_cmdobj(adreno_dev);
+
+	if (obj)
+		drawobj = obj->drawobj;
+	else if (hwsched->recurring_cmdobj &&
+		hwsched->recurring_cmdobj->base.context->id == cmd->gc.ctxt_id) {
+		drawobj = DRAWOBJ(hwsched->recurring_cmdobj);
+		if (!kref_get_unless_zero(&drawobj->refcount))
+			drawobj = NULL;
+	}
+
+	if (!obj_lpac && (fault & ADRENO_IOMMU_PAGE_FAULT))
+		obj_lpac = get_active_cmdobj_lpac(adreno_dev);
+
+	if (!obj && !obj_lpac) {
+		if (fault & ADRENO_GMU_FAULT)
+			gmu_core_fault_snapshot(device);
+		else
+			kgsl_device_snapshot(device, NULL, NULL, false);
+		goto done;
+	}
+
+	if (obj) {
+		context = drawobj->context;
+		do_fault_header(adreno_dev, drawobj);
+	}
+
+	if (obj_lpac) {
+		drawobj_lpac = obj_lpac->drawobj;
+		context_lpac  = drawobj_lpac->context;
+		do_fault_header_lpac(adreno_dev, drawobj_lpac);
+	}
+
+	kgsl_device_snapshot(device, context, context_lpac, false);
+
+	if (drawobj) {
+		force_retire_timestamp(device, drawobj);
+		if (context && ((context->flags & KGSL_CONTEXT_INVALIDATE_ON_FAULT) ||
+			(context->flags & KGSL_CONTEXT_NO_FAULT_TOLERANCE) ||
+			(cmd->error == GMU_GPU_SW_HANG) ||
+			(cmd->error == GMU_GPU_SW_FUSE_VIOLATION) ||
+			context_is_throttled(device, context)))
+			adreno_drawctxt_set_guilty(device, context);
+		/*
+		 * Put back the reference which we incremented while trying to find
+		 * faulted command object
+		 */
+		kgsl_drawobj_put(drawobj);
+	}
+
+	if (drawobj_lpac) {
+		force_retire_timestamp(device, drawobj_lpac);
+		if (context_lpac && ((context_lpac->flags & KGSL_CONTEXT_INVALIDATE_ON_FAULT) ||
+			(context_lpac->flags & KGSL_CONTEXT_NO_FAULT_TOLERANCE) ||
+			(cmd->error == GMU_GPU_SW_HANG) ||
+			(cmd->error == GMU_GPU_SW_FUSE_VIOLATION) ||
+			context_is_throttled(device, context_lpac)))
+			adreno_drawctxt_set_guilty(device, context_lpac);
+		/*
+		 * Put back the reference which we incremented while trying to find
+		 * faulted command object
+		 */
+		kgsl_drawobj_put(drawobj_lpac);
+	}
+done:
+	memset(hwsched->ctxt_bad, 0x0, HFI_MAX_MSG_SIZE);
+	gpudev->reset(adreno_dev);
+}
+
+static bool adreno_hwsched_do_fault(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	int fault;
+
+	fault = atomic_xchg(&hwsched->fault, 0);
+	if (fault == 0)
+		return false;
+
+	mutex_lock(&device->mutex);
+
+	if (test_bit(ADRENO_HWSCHED_CTX_BAD_LEGACY, &hwsched->flags))
+		adreno_hwsched_reset_and_snapshot_legacy(adreno_dev, fault);
+	else
+		adreno_hwsched_reset_and_snapshot(adreno_dev, fault);
+
+	adreno_hwsched_trigger(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+
+	return true;
+}
+
+static void adreno_hwsched_work(struct kthread_work *work)
+{
+	struct adreno_hwsched *hwsched = container_of(work,
+			struct adreno_hwsched, work);
+	struct adreno_device *adreno_dev = container_of(hwsched,
+			struct adreno_device, hwsched);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	mutex_lock(&hwsched->mutex);
+
+	if (adreno_hwsched_do_fault(adreno_dev)) {
+		mutex_unlock(&hwsched->mutex);
+		return;
+	}
+
+	/*
+	 * As long as there are inflight commands, process retired comamnds from
+	 * all drawqueues
+	 */
+	retire_drawobj_list(adreno_dev);
+
+	/* Signal fences */
+	kgsl_process_event_groups(device);
+
+	/* Run the scheduler for to dispatch new commands */
+	hwsched_issuecmds(adreno_dev);
+
+	if (hwsched->inflight == 0) {
+		hwsched_power_down(adreno_dev);
+	} else {
+		mutex_lock(&device->mutex);
+		kgsl_pwrscale_update(device);
+		kgsl_start_idle_timer(device);
+		mutex_unlock(&device->mutex);
+	}
+
+	mutex_unlock(&hwsched->mutex);
+}
+
+void adreno_hwsched_fault(struct adreno_device *adreno_dev,
+		u32 fault)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	u32 curr = atomic_read(&hwsched->fault);
+
+	atomic_set(&hwsched->fault, curr | fault);
+
+	/* make sure fault is written before triggering dispatcher */
+	smp_wmb();
+
+	adreno_hwsched_trigger(adreno_dev);
+}
+
+static bool is_tx_slot_available(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	void *ptr = hwsched->hw_fence.mem_descriptor.virtual_addr;
+	struct msm_hw_fence_hfi_queue_header *hdr = (struct msm_hw_fence_hfi_queue_header *)
+		(ptr + sizeof(struct msm_hw_fence_hfi_queue_table_header));
+	u32 queue_size_dwords = hdr->queue_size / sizeof(u32);
+	u32 payload_size_dwords = hdr->pkt_size / sizeof(u32);
+	u32 free_dwords, write_idx = hdr->write_index, read_idx = hdr->read_index;
+	u32 reserved_dwords = atomic_read(&hwsched->hw_fence_count) * payload_size_dwords;
+
+	free_dwords = read_idx <= write_idx ?
+		queue_size_dwords - (write_idx - read_idx) :
+		read_idx - write_idx;
+
+	if (free_dwords - reserved_dwords <= payload_size_dwords)
+		return false;
+
+	return true;
+}
+
+static void adreno_hwsched_create_hw_fence(struct adreno_device *adreno_dev,
+	struct kgsl_sync_fence *kfence)
+{
+	struct kgsl_sync_timeline *ktimeline = kfence->parent;
+	struct kgsl_context *context = ktimeline->context;
+	const struct adreno_hwsched_ops *hwsched_ops =
+				adreno_dev->hwsched.hwsched_ops;
+
+	if (!test_bit(ADRENO_HWSCHED_HW_FENCE, &adreno_dev->hwsched.flags))
+		return;
+
+	/* Do not create a hardware backed fence, if this context is bad or going away */
+	if (kgsl_context_is_bad(context))
+		return;
+
+	if (!is_tx_slot_available(adreno_dev))
+		return;
+
+	hwsched_ops->create_hw_fence(adreno_dev, kfence);
+}
+
+static const struct adreno_dispatch_ops hwsched_ops = {
+	.close = adreno_hwsched_dispatcher_close,
+	.queue_cmds = adreno_hwsched_queue_cmds,
+	.queue_context = adreno_hwsched_queue_context,
+	.fault = adreno_hwsched_fault,
+	.create_hw_fence = adreno_hwsched_create_hw_fence,
+};
+
+static void hwsched_lsr_check(struct work_struct *work)
+{
+	struct adreno_hwsched *hwsched = container_of(work,
+		struct adreno_hwsched, lsr_check_ws);
+	struct adreno_device *adreno_dev = container_of(hwsched,
+		struct adreno_device, hwsched);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	mutex_lock(&device->mutex);
+	kgsl_pwrscale_update_stats(device);
+	kgsl_pwrscale_update(device);
+	mutex_unlock(&device->mutex);
+
+	mod_timer(&hwsched->lsr_timer, jiffies + msecs_to_jiffies(10));
+}
+
+static void hwsched_lsr_timer(struct timer_list *t)
+{
+	struct adreno_hwsched *hwsched = container_of(t, struct adreno_hwsched,
+					lsr_timer);
+
+	kgsl_schedule_work(&hwsched->lsr_check_ws);
+}
+
+int adreno_hwsched_init(struct adreno_device *adreno_dev,
+	const struct adreno_hwsched_ops *target_hwsched_ops)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	int i;
+
+	memset(hwsched, 0, sizeof(*hwsched));
+
+	hwsched->ctxt_bad = kzalloc(HFI_MAX_MSG_SIZE, GFP_KERNEL);
+	if (!hwsched->ctxt_bad)
+		return -ENOMEM;
+
+	hwsched->worker = kthread_create_worker(0, "kgsl_hwsched");
+	if (IS_ERR(hwsched->worker)) {
+		kfree(hwsched->ctxt_bad);
+		return PTR_ERR(hwsched->worker);
+	}
+
+	mutex_init(&hwsched->mutex);
+
+	kthread_init_work(&hwsched->work, adreno_hwsched_work);
+
+	jobs_cache = KMEM_CACHE(adreno_dispatch_job, 0);
+	obj_cache = KMEM_CACHE(cmd_list_obj, 0);
+
+	INIT_LIST_HEAD(&hwsched->cmd_list);
+
+	for (i = 0; i < ARRAY_SIZE(hwsched->jobs); i++) {
+		init_llist_head(&hwsched->jobs[i]);
+		init_llist_head(&hwsched->requeue[i]);
+	}
+
+	sched_set_fifo(hwsched->worker->task);
+
+	WARN_ON(sysfs_create_files(&device->dev->kobj, _hwsched_attr_list));
+	adreno_set_dispatch_ops(adreno_dev, &hwsched_ops);
+	hwsched->hwsched_ops = target_hwsched_ops;
+	init_completion(&hwsched->idle_gate);
+	complete_all(&hwsched->idle_gate);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_LSR)) {
+		INIT_WORK(&hwsched->lsr_check_ws, hwsched_lsr_check);
+		timer_setup(&hwsched->lsr_timer, hwsched_lsr_timer, 0);
+	}
+
+	return 0;
+}
+
+void adreno_hwsched_parse_fault_cmdobj(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct cmd_list_obj *obj, *tmp;
+
+	/*
+	 * During IB parse, vmalloc is called which can sleep and
+	 * should not be called from atomic context. Since IBs are not
+	 * dumped during atomic snapshot, there is no need to parse it.
+	 */
+	if (adreno_dev->dev.snapshot_atomic)
+		return;
+
+	list_for_each_entry_safe(obj, tmp, &hwsched->cmd_list, node) {
+		struct kgsl_drawobj *drawobj = obj->drawobj;
+		struct kgsl_drawobj_cmd *cmdobj;
+
+		if (!is_cmdobj(drawobj))
+			continue;
+
+		cmdobj = CMDOBJ(drawobj);
+
+		if (test_bit(CMDOBJ_FAULT, &cmdobj->priv)) {
+			struct kgsl_memobj_node *ib;
+
+			list_for_each_entry(ib, &cmdobj->cmdlist, node) {
+				if (drawobj->context->flags & KGSL_CONTEXT_LPAC)
+					adreno_parse_ib_lpac(KGSL_DEVICE(adreno_dev),
+						snapshot, snapshot->process_lpac,
+						ib->gpuaddr, ib->size >> 2);
+				else
+					adreno_parse_ib(KGSL_DEVICE(adreno_dev),
+						snapshot, snapshot->process,
+						ib->gpuaddr, ib->size >> 2);
+			}
+			clear_bit(CMDOBJ_FAULT, &cmdobj->priv);
+		}
+	}
+}
+
+static int unregister_context(int id, void *ptr, void *data)
+{
+	struct kgsl_context *context = ptr;
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(context);
+
+	if (drawctxt->gmu_context_queue.gmuaddr != 0) {
+		struct gmu_context_queue_header *header =  drawctxt->gmu_context_queue.hostptr;
+
+		header->read_index = header->write_index;
+		/* This is to make sure GMU sees the correct indices after recovery */
+		mb();
+	}
+
+	/*
+	 * We don't need to send the unregister hfi packet because
+	 * we are anyway going to lose the gmu state of registered
+	 * contexts. So just reset the flag so that the context
+	 * registers with gmu on its first submission post slumber.
+	 */
+	context->gmu_registered = false;
+
+	/*
+	 * Consider the scenario where non-recurring submissions were made
+	 * by a context. Here internal_timestamp of context would be non
+	 * zero. After slumber, last retired timestamp is not held by GMU.
+	 * If this context submits a recurring workload, the context is
+	 * registered again, but the internal timestamp is not updated. When
+	 * the context is unregistered in send_context_unregister_hfi(),
+	 * we could be waiting on old internal_timestamp which is not held by
+	 * GMU. This can result in GMU errors. Hence set internal_timestamp
+	 * to zero when entering slumber.
+	 */
+	drawctxt->internal_timestamp = 0;
+
+	return 0;
+}
+
+void adreno_hwsched_unregister_contexts(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	read_lock(&device->context_lock);
+	idr_for_each(&device->context_idr, unregister_context, NULL);
+	read_unlock(&device->context_lock);
+}
+
+static int hwsched_idle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	int ret;
+
+	/* Block any new submissions from being submitted */
+	adreno_get_gpu_halt(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+
+	/*
+	 * Flush the worker to make sure all executing
+	 * or pending dispatcher works on worker are
+	 * finished
+	 */
+	adreno_hwsched_flush(adreno_dev);
+
+	ret = wait_for_completion_timeout(&hwsched->idle_gate,
+			msecs_to_jiffies(ADRENO_IDLE_TIMEOUT));
+	if (ret == 0) {
+		ret = -ETIMEDOUT;
+		WARN(1, "hwsched halt timeout\n");
+	} else if (ret < 0) {
+		dev_err(device->dev, "hwsched halt failed %d\n", ret);
+	} else {
+		ret = 0;
+	}
+
+	mutex_lock(&device->mutex);
+
+	/*
+	 * This will allow the dispatcher to start submitting to
+	 * hardware once device mutex is released
+	 */
+	adreno_put_gpu_halt(adreno_dev);
+
+	/*
+	 * Requeue dispatcher work to resubmit pending commands
+	 * that may have been blocked due to this idling request
+	 */
+	adreno_hwsched_trigger(adreno_dev);
+	return ret;
+}
+
+int adreno_hwsched_idle(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	unsigned long wait = jiffies + msecs_to_jiffies(ADRENO_IDLE_TIMEOUT);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	int ret;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EDEADLK;
+
+	if (!kgsl_state_is_awake(device))
+		return 0;
+
+	ret = hwsched_idle(adreno_dev);
+	if (ret)
+		return ret;
+
+	do {
+		if (hwsched_in_fault(hwsched))
+			return -EDEADLK;
+
+		if (gpudev->hw_isidle(adreno_dev))
+			return 0;
+	} while (time_before(jiffies, wait));
+
+	/*
+	 * Under rare conditions, preemption can cause the while loop to exit
+	 * without checking if the gpu is idle. check one last time before we
+	 * return failure.
+	 */
+	if (hwsched_in_fault(hwsched))
+		return -EDEADLK;
+
+	if (gpudev->hw_isidle(adreno_dev))
+		return 0;
+
+	return -ETIMEDOUT;
+}
+
+void adreno_hwsched_register_hw_fence(struct adreno_device *adreno_dev)
+{
+	struct adreno_hwsched *hwsched = &adreno_dev->hwsched;
+	struct adreno_hw_fence *hw_fence = &hwsched->hw_fence;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_HW_FENCE))
+		return;
+
+	/* Enable hardware fences only if context queues are enabled */
+	if (!adreno_hwsched_context_queue_enabled(adreno_dev))
+		return;
+
+	if (test_bit(ADRENO_HWSCHED_HW_FENCE, &hwsched->flags))
+		return;
+
+	hw_fence->handle = msm_hw_fence_register(HW_FENCE_CLIENT_ID_CTX0,
+				&hw_fence->mem_descriptor);
+	if (IS_ERR_OR_NULL(hw_fence->handle)) {
+		dev_err(device->dev, "HW fences not supported: %d\n",
+			PTR_ERR_OR_ZERO(hw_fence->handle));
+		hw_fence->handle = NULL;
+		return;
+	}
+
+	/*
+	 * We need to set up the memory descriptor with the physical address of the Tx/Rx Queues so
+	 * that these buffers can be imported in to GMU VA space
+	 */
+	kgsl_memdesc_init(device, &hw_fence->memdesc, 0);
+	hw_fence->memdesc.physaddr = hw_fence->mem_descriptor.device_addr;
+	hw_fence->memdesc.size = hw_fence->mem_descriptor.size;
+	hw_fence->memdesc.hostptr = hw_fence->mem_descriptor.virtual_addr;
+
+	ret = kgsl_memdesc_sg_dma(&hw_fence->memdesc, hw_fence->memdesc.physaddr,
+		hw_fence->memdesc.size);
+	if (ret) {
+		dev_err(device->dev, "Failed to setup HW fences memdesc: %d\n",
+			ret);
+		msm_hw_fence_deregister(hw_fence->handle);
+		hw_fence->handle = NULL;
+		memset(&hw_fence->memdesc, 0x0, sizeof(hw_fence->memdesc));
+		return;
+	}
+
+	hwsched->hw_fence_cache = KMEM_CACHE(adreno_hw_fence_entry, 0);
+
+	set_bit(ADRENO_HWSCHED_HW_FENCE, &hwsched->flags);
+}
+
+int adreno_hwsched_wait_ack_completion(struct adreno_device *adreno_dev,
+	struct device *dev, struct pending_cmd *ack,
+	void (*process_msgq)(struct adreno_device *adreno_dev))
+{
+	int rc;
+	/* Only allow a single log in a second */
+	static DEFINE_RATELIMIT_STATE(_rs, HZ, 1);
+	static u32 unprocessed, processed;
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	u64 start, end;
+
+	start = gpudev->read_alwayson(adreno_dev);
+	rc = wait_for_completion_timeout(&ack->complete,
+		msecs_to_jiffies(HFI_RSP_TIMEOUT));
+	/*
+	 * A non-zero return value means the completion is complete, whereas zero indicates
+	 * timeout
+	 */
+	if (rc) {
+		/*
+		 * If an ack goes unprocessed, keep track of processed and unprocessed acks
+		 * because we may not log each unprocessed ack due to ratelimiting
+		 */
+		if (unprocessed)
+			processed++;
+		return 0;
+	}
+
+	/*
+	 * It is possible the ack came, but due to HLOS latencies in processing hfi interrupt
+	 * and/or the f2h daemon, the ack isn't processed yet. Hence, process the msgq one last
+	 * time.
+	 */
+	process_msgq(adreno_dev);
+	end = gpudev->read_alwayson(adreno_dev);
+	if (completion_done(&ack->complete)) {
+		unprocessed++;
+		if (__ratelimit(&_rs))
+			dev_err(dev, "Ack unprocessed for id:%d sequence=%d count=%d/%d ticks=%llu/%llu\n",
+				MSG_HDR_GET_ID(ack->sent_hdr), MSG_HDR_GET_SEQNUM(ack->sent_hdr),
+				unprocessed, processed, start, end);
+		return 0;
+	}
+
+	dev_err(dev, "Ack timeout for id:%d sequence=%d ticks=%llu/%llu\n",
+		MSG_HDR_GET_ID(ack->sent_hdr), MSG_HDR_GET_SEQNUM(ack->sent_hdr), start, end);
+	gmu_core_fault_snapshot(KGSL_DEVICE(adreno_dev));
+	return -ETIMEDOUT;
+}
+
+u32 adreno_hwsched_parse_payload(struct payload_section *payload, u32 key)
+{
+	u32 i;
+
+	/* Each key-value pair is 2 dwords */
+	for (i = 0; i < payload->dwords; i += 2) {
+		if (payload->data[i] == key)
+			return payload->data[i + 1];
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_hwsched.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_hwsched.h
@@ -0,0 +1,252 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _ADRENO_HWSCHED_H_
+#define _ADRENO_HWSCHED_H_
+
+#if (KERNEL_VERSION(6, 3, 0) <= LINUX_VERSION_CODE)
+#include <msm_hw_fence.h>
+#else
+#include <linux/soc/qcom/msm_hw_fence.h>
+#endif
+
+#include "kgsl_sync.h"
+
+/* This structure represents inflight command object */
+struct cmd_list_obj {
+	/** @drawobj: Handle to the draw object */
+	struct kgsl_drawobj *drawobj;
+	/** @node: List node to put it in the list of inflight commands */
+	struct list_head node;
+};
+
+/**
+ * struct adreno_hw_fence_entry - A structure to store hardware fence and the context
+ */
+struct adreno_hw_fence_entry {
+	/** @cmd: H2F_MSG_HW_FENCE_INFO packet for this hardware fence */
+	struct hfi_hw_fence_info cmd;
+	/** @kfence: Pointer to the kgsl fence */
+	struct kgsl_sync_fence *kfence;
+	/** @drawctxt: Pointer to the context */
+	struct adreno_context *drawctxt;
+	/** @node: list node to add it to a list */
+	struct list_head node;
+	/** @reset_node: list node to add it to post reset list of hardware fences */
+	struct list_head reset_node;
+};
+
+/**
+ * struct adreno_hwsched_ops - Function table to hook hwscheduler things
+ * to target specific routines
+ */
+struct adreno_hwsched_ops {
+	/**
+	 * @submit_drawobj - Target specific function to submit IBs to hardware
+	 */
+	int (*submit_drawobj)(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj *drawobj);
+	/**
+	 * @preempt_count - Target specific function to get preemption count
+	 */
+	u32 (*preempt_count)(struct adreno_device *adreno_dev);
+	/**
+	 * @create_hw_fence - Target specific function to create a hardware fence
+	 */
+	void (*create_hw_fence)(struct adreno_device *adreno_dev,
+		struct kgsl_sync_fence *kfence);
+
+};
+
+/**
+ * struct adreno_hw_fence - Container for hardware fences instance
+ */
+struct adreno_hw_fence {
+	/** @handle: Handle for hardware fences */
+	void *handle;
+	/** @descriptor: Memory descriptor for hardware fences */
+	struct msm_hw_fence_mem_addr mem_descriptor;
+	/** @memdesc: Kgsl memory descriptor for hardware fences queue */
+	struct kgsl_memdesc memdesc;
+};
+
+/**
+ * struct adreno_hwsched - Container for the hardware scheduler
+ */
+struct adreno_hwsched {
+	 /** @mutex: Mutex needed to run dispatcher function */
+	struct mutex mutex;
+	/** @flags: Container for the dispatcher internal flags */
+	unsigned long flags;
+	/** @inflight: Number of active submissions to the dispatch queues */
+	u32 inflight;
+	/** @jobs - Array of dispatch job lists for each priority level */
+	struct llist_head jobs[16];
+	/** @requeue - Array of lists for dispatch jobs that got requeued */
+	struct llist_head requeue[16];
+	/** @work: The work structure to execute dispatcher function */
+	struct kthread_work work;
+	/** @cmd_list: List of objects submitted to dispatch queues */
+	struct list_head cmd_list;
+	/** @fault: Atomic to record a fault */
+	atomic_t fault;
+	struct kthread_worker *worker;
+	/** @hwsched_ops: Container for target specific hwscheduler ops */
+	const struct adreno_hwsched_ops *hwsched_ops;
+	/** @ctxt_bad: Container for the context bad hfi packet */
+	void *ctxt_bad;
+	/** @idle_gate: Gate to wait on for hwscheduler to idle */
+	struct completion idle_gate;
+	/** @big_cmdobj = Points to the big IB that is inflight */
+	struct kgsl_drawobj_cmd *big_cmdobj;
+	/** @recurring_cmdobj: Recurring commmand object sent to GMU */
+	struct kgsl_drawobj_cmd *recurring_cmdobj;
+	/** @lsr_timer: Timer struct to schedule lsr work */
+	struct timer_list lsr_timer;
+	/** @lsr_check_ws: Lsr work to update power stats */
+	struct work_struct lsr_check_ws;
+	/** @hw_fence: Container for the hw fences instance */
+	struct adreno_hw_fence hw_fence;
+	/** @hw_fence_cache: kmem cache for storing hardware output fences */
+	struct kmem_cache *hw_fence_cache;
+	/** @hw_fence_count: Number of hardware fences that haven't yet been sent to Tx Queue */
+	atomic_t hw_fence_count;
+	/**
+	 * @submission_seqnum: Sequence number for sending submissions to GMU context queues or
+	 * dispatch queues
+	 */
+	atomic_t submission_seqnum;
+
+};
+
+/*
+ * This value is based on maximum number of IBs that can fit
+ * in the ringbuffer.
+ */
+#define HWSCHED_MAX_IBS 2000
+
+enum adreno_hwsched_flags {
+	ADRENO_HWSCHED_POWER = 0,
+	ADRENO_HWSCHED_ACTIVE,
+	ADRENO_HWSCHED_CTX_BAD_LEGACY,
+	ADRENO_HWSCHED_CONTEXT_QUEUE,
+	ADRENO_HWSCHED_HW_FENCE,
+};
+
+/**
+ * adreno_hwsched_trigger - Function to schedule the hwsched thread
+ * @adreno_dev: A handle to adreno device
+ *
+ * Schedule the hw dispatcher for retiring and submitting command objects
+ */
+void adreno_hwsched_trigger(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_hwsched_start() - activate the hwsched dispatcher
+ * @adreno_dev: pointer to the adreno device
+ *
+ * Enable dispatcher thread to execute
+ */
+void adreno_hwsched_start(struct adreno_device *adreno_dev);
+/**
+ * adreno_hwsched_dispatcher_init() - Initialize the hwsched dispatcher
+ * @adreno_dev: pointer to the adreno device
+ * @hwsched_ops: Pointer to target specific hwsched ops
+ *
+ * Set up the dispatcher resources.
+ * Return: 0 on success or negative on failure.
+ */
+int adreno_hwsched_init(struct adreno_device *adreno_dev,
+	const struct adreno_hwsched_ops *hwsched_ops);
+
+/**
+ * adreno_hwsched_fault - Set hwsched fault to request recovery
+ * @adreno_dev: A handle to adreno device
+ * @fault: The type of fault
+ */
+void adreno_hwsched_fault(struct adreno_device *adreno_dev, u32 fault);
+
+/**
+ * adreno_hwsched_parse_fault_ib - Parse the faulty submission
+ * @adreno_dev: pointer to the adreno device
+ * @snapshot: Pointer to the snapshot structure
+ *
+ * Walk the list of active submissions to find the one that faulted and
+ * parse it so that relevant command buffers can be added to the snapshot
+ */
+void adreno_hwsched_parse_fault_cmdobj(struct adreno_device *adreno_dev,
+	struct kgsl_snapshot *snapshot);
+
+void adreno_hwsched_flush(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_hwsched_unregister_contexts - Reset context gmu_registered bit
+ * @adreno_dev: pointer to the adreno device
+ *
+ * Walk the list of contexts and reset the gmu_registered for all
+ * contexts
+ */
+void adreno_hwsched_unregister_contexts(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_hwsched_idle - Wait for dispatcher and hardware to become idle
+ * @adreno_dev: A handle to adreno device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int adreno_hwsched_idle(struct adreno_device *adreno_dev);
+
+static inline bool hwsched_in_fault(struct adreno_hwsched *hwsched)
+{
+	/* make sure we're reading the latest value */
+	smp_rmb();
+	return atomic_read(&hwsched->fault) != 0;
+}
+
+void adreno_hwsched_retire_cmdobj(struct adreno_hwsched *hwsched,
+	struct kgsl_drawobj_cmd *cmdobj);
+
+bool adreno_hwsched_context_queue_enabled(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_hwsched_register_hw_fence - Register GPU as a hardware fence client
+ * @adreno_dev: pointer to the adreno device
+ *
+ * Register with the hardware fence driver to be able to trigger and wait
+ * for hardware fences. Also, set up the memory descriptor for mapping the
+ * client queue to the GMU.
+ */
+void adreno_hwsched_register_hw_fence(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_hwsched_deregister_hw_fence - Deregister GPU as a hardware fence client
+ * @adreno_dev: pointer to the adreno device
+ *
+ * Deregister with the hardware fence driver and free up any resources allocated
+ * as part of registering with the hardware fence driver
+ */
+void adreno_hwsched_deregister_hw_fence(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_hwsched_replay - Resubmit inflight cmdbatches after gpu reset
+ * @adreno_dev: pointer to the adreno device
+ *
+ * Resubmit all cmdbatches to GMU after device reset
+ */
+void adreno_hwsched_replay(struct adreno_device *adreno_dev);
+
+/**
+ * adreno_hwsched_parse_payload - Parse payload to look up a key
+ * @payload: Pointer to a payload section
+ * @key: The key who's value is to be looked up
+ *
+ * This function parses the payload data which is a sequence
+ * of key-value pairs.
+ *
+ * Return: The value of the key or 0 if key is not found
+ */
+u32 adreno_hwsched_parse_payload(struct payload_section *payload, u32 key);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_ioctl.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_ioctl.c
@@ -0,0 +1,313 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+
+#include "adreno.h"
+#include "adreno_a5xx.h"
+
+/*
+ * Add a perfcounter to the per-fd list.
+ * Call with the device mutex held
+ */
+static int adreno_process_perfcounter_add(struct kgsl_device_private *dev_priv,
+	unsigned int groupid, unsigned int countable)
+{
+	struct adreno_device_private *adreno_priv = container_of(dev_priv,
+		struct adreno_device_private, dev_priv);
+	struct adreno_perfcounter_list_node *perfctr;
+
+	perfctr = kmalloc(sizeof(*perfctr), GFP_KERNEL);
+	if (!perfctr)
+		return -ENOMEM;
+
+	perfctr->groupid = groupid;
+	perfctr->countable = countable;
+
+	/* add the pair to process perfcounter list */
+	list_add(&perfctr->node, &adreno_priv->perfcounter_list);
+	return 0;
+}
+
+/*
+ * Remove a perfcounter from the per-fd list.
+ * Call with the device mutex held
+ */
+static int adreno_process_perfcounter_del(struct kgsl_device_private *dev_priv,
+	unsigned int groupid, unsigned int countable)
+{
+	struct adreno_device_private *adreno_priv = container_of(dev_priv,
+		struct adreno_device_private, dev_priv);
+	struct adreno_perfcounter_list_node *p;
+
+	list_for_each_entry(p, &adreno_priv->perfcounter_list, node) {
+		if (p->groupid == groupid && p->countable == countable) {
+			list_del(&p->node);
+			kfree(p);
+			return 0;
+		}
+	}
+	return -ENODEV;
+}
+
+long adreno_ioctl_perfcounter_get(struct kgsl_device_private *dev_priv,
+	unsigned int cmd, void *data)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_perfcounter_get *get = data;
+	int result;
+
+	mutex_lock(&device->mutex);
+
+	/*
+	 * adreno_perfcounter_get() is called by kernel clients
+	 * during start(), so it is not safe to take an
+	 * active count inside that function.
+	 */
+
+	result = adreno_perfcntr_active_oob_get(adreno_dev);
+	if (result) {
+		mutex_unlock(&device->mutex);
+		return (long)result;
+	}
+
+	result = adreno_perfcounter_get(adreno_dev,
+			get->groupid, get->countable, &get->offset,
+			&get->offset_hi, PERFCOUNTER_FLAG_NONE);
+
+	/* Add the perfcounter into the list */
+	if (!result) {
+		result = adreno_process_perfcounter_add(dev_priv, get->groupid,
+				get->countable);
+		if (result)
+			adreno_perfcounter_put(adreno_dev, get->groupid,
+				get->countable, PERFCOUNTER_FLAG_NONE);
+	}
+
+	adreno_perfcntr_active_oob_put(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+
+	return (long) result;
+}
+
+long adreno_ioctl_perfcounter_put(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_perfcounter_put *put = data;
+	int result;
+
+	mutex_lock(&device->mutex);
+
+	/* Delete the perfcounter from the process list */
+	result = adreno_process_perfcounter_del(dev_priv, put->groupid,
+		put->countable);
+
+	/* Put the perfcounter refcount */
+	if (!result)
+		adreno_perfcounter_put(adreno_dev, put->groupid,
+			put->countable, PERFCOUNTER_FLAG_NONE);
+	mutex_unlock(&device->mutex);
+
+	return (long) result;
+}
+
+static long adreno_ioctl_perfcounter_query(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_priv->device);
+	struct kgsl_perfcounter_query *query = data;
+
+	return (long) adreno_perfcounter_query_group(adreno_dev, query->groupid,
+			query->countables, query->count, &query->max_counters);
+}
+
+static long adreno_ioctl_perfcounter_read(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_priv->device);
+	struct kgsl_perfcounter_read *read = data;
+
+	/*
+	 * When performance counter zapping is enabled, the counters are cleared
+	 * across context switches. Reading the counters when they are zapped is
+	 * not permitted.
+	 */
+	if (!adreno_dev->perfcounter)
+		return -EPERM;
+
+	return (long) adreno_perfcounter_read_group(adreno_dev, read->reads,
+		read->count);
+}
+
+static long adreno_ioctl_preemption_counters_query(
+		struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_priv->device);
+	struct kgsl_preemption_counters_query *read = data;
+	int size_level = A5XX_CP_CTXRECORD_PREEMPTION_COUNTER_SIZE;
+	int levels_to_copy;
+
+	if (!adreno_is_a5xx(adreno_dev) ||
+		!adreno_is_preemption_enabled(adreno_dev))
+		return -EOPNOTSUPP;
+
+	if (read->size_user < size_level)
+		return -EINVAL;
+
+	/* Calculate number of preemption counter levels to copy to userspace */
+	levels_to_copy = (read->size_user / size_level);
+
+	levels_to_copy = min_t(int, levels_to_copy,
+		ARRAY_SIZE(adreno_dev->ringbuffers));
+
+	if (copy_to_user(u64_to_user_ptr(read->counters),
+			adreno_dev->preempt.scratch->hostptr,
+			levels_to_copy * size_level))
+		return -EFAULT;
+
+	read->max_priority_level = levels_to_copy;
+	read->size_priority_level = size_level;
+
+	return 0;
+}
+
+static long adreno_ioctl_read_calibrated_ts(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_priv->device);
+	struct kgsl_read_calibrated_timestamps *reads = data;
+	unsigned long flags;
+	u32 *sources = NULL;
+	u64 *ts = NULL;
+	u64 start;
+	u64 samples[KGSL_CALIBRATED_TIME_DOMAIN_MAX] = {0};
+	u32 i;
+	int ret = 0;
+
+	/* Reading calibrated timestamps requires the CX timer be initialized */
+	if (!test_bit(ADRENO_DEVICE_CX_TIMER_INITIALIZED, &adreno_dev->priv))
+		return -EOPNOTSUPP;
+
+	/* Check that the number of timestamps is reasonable */
+	if (!reads->count ||
+		(reads->count > (2 * KGSL_CALIBRATED_TIME_DOMAIN_MAX)))
+		return -EINVAL;
+
+	sources = kvcalloc(reads->count, sizeof(*sources), GFP_KERNEL);
+	if (!sources)
+		return -ENOMEM;
+
+	if (copy_from_user(sources, u64_to_user_ptr(reads->sources),
+			reads->count * sizeof(*sources))) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	for (i = 0; i < reads->count; i++) {
+		if (sources[i] >= KGSL_CALIBRATED_TIME_DOMAIN_MAX) {
+			ret = -EINVAL;
+			goto done;
+		}
+	}
+
+	ts = kvcalloc(reads->count, sizeof(*ts), GFP_KERNEL);
+	if (!ts) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Disable local irqs to prevent context switch delays */
+	local_irq_save(flags);
+
+	/* Sample the MONOTONIC_RAW domain for use in calculating deviation */
+	start = (u64)ktime_to_ns(ktime_get_raw());
+
+	samples[KGSL_CALIBRATED_TIME_DOMAIN_DEVICE] =
+				adreno_read_cx_timer(adreno_dev);
+	samples[KGSL_CALIBRATED_TIME_DOMAIN_MONOTONIC] =
+				(u64)ktime_to_ns(ktime_get());
+	samples[KGSL_CALIBRATED_TIME_DOMAIN_MONOTONIC_RAW] =
+				(u64)ktime_to_ns(ktime_get_raw());
+
+	/* Done collecting timestamps. Re-enable irqs */
+	local_irq_restore(flags);
+
+	/* Calculate deviation in reads based on the MONOTONIC_RAW samples */
+	reads->deviation = samples[KGSL_CALIBRATED_TIME_DOMAIN_MONOTONIC_RAW] - start;
+
+	for (i = 0; i < reads->count; i++)
+		ts[i] = samples[sources[i]];
+
+	if (copy_to_user(u64_to_user_ptr(reads->ts), ts, reads->count * sizeof(*ts)))
+		ret = -EFAULT;
+
+done:
+	kvfree(ts);
+	kvfree(sources);
+	return ret;
+}
+
+long adreno_ioctl_helper(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, unsigned long arg,
+		const struct kgsl_ioctl *cmds, int len)
+{
+	unsigned char data[128] = { 0 };
+	long ret;
+	int i;
+
+	for (i = 0; i < len; i++) {
+		if (_IOC_NR(cmd) == _IOC_NR(cmds[i].cmd))
+			break;
+	}
+
+	if (i == len)
+		return -ENOIOCTLCMD;
+
+	if (_IOC_SIZE(cmds[i].cmd > sizeof(data))) {
+		dev_err_ratelimited(dev_priv->device->dev,
+			"data too big for ioctl 0x%08x: %d/%zu\n",
+			cmd, _IOC_SIZE(cmds[i].cmd), sizeof(data));
+		return -EINVAL;
+	}
+
+	if (_IOC_SIZE(cmds[i].cmd)) {
+		ret = kgsl_ioctl_copy_in(cmds[i].cmd, cmd, arg, data);
+
+		if (ret)
+			return ret;
+	} else {
+		memset(data, 0, sizeof(data));
+	}
+
+	ret = cmds[i].func(dev_priv, cmd, data);
+
+	if (ret == 0 && _IOC_SIZE(cmds[i].cmd))
+		ret = kgsl_ioctl_copy_out(cmds[i].cmd, cmd, arg, data);
+
+	return ret;
+}
+
+static struct kgsl_ioctl adreno_ioctl_funcs[] = {
+	{ IOCTL_KGSL_PERFCOUNTER_GET, adreno_ioctl_perfcounter_get },
+	{ IOCTL_KGSL_PERFCOUNTER_PUT, adreno_ioctl_perfcounter_put },
+	{ IOCTL_KGSL_PERFCOUNTER_QUERY, adreno_ioctl_perfcounter_query },
+	{ IOCTL_KGSL_PERFCOUNTER_READ, adreno_ioctl_perfcounter_read },
+	{ IOCTL_KGSL_PREEMPTIONCOUNTER_QUERY,
+		adreno_ioctl_preemption_counters_query },
+	{ IOCTL_KGSL_READ_CALIBRATED_TIMESTAMPS, adreno_ioctl_read_calibrated_ts },
+};
+
+long adreno_ioctl(struct kgsl_device_private *dev_priv,
+			      unsigned int cmd, unsigned long arg)
+{
+	return adreno_ioctl_helper(dev_priv, cmd, arg,
+		adreno_ioctl_funcs, ARRAY_SIZE(adreno_ioctl_funcs));
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_perfcounter.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_perfcounter.c
@@ -0,0 +1,596 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2002,2007-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/slab.h>
+
+#include "adreno.h"
+#include "adreno_perfcounter.h"
+
+static inline int active_countable(unsigned int countable)
+{
+	return ((countable != KGSL_PERFCOUNTER_NOT_USED) &&
+		(countable != KGSL_PERFCOUNTER_BROKEN));
+}
+
+/**
+ * adreno_perfcounter_restore() - Restore performance counters
+ * @adreno_dev: adreno device to configure
+ *
+ * Load the physical performance counters with 64 bit value which are
+ * saved on GPU power collapse.
+ */
+void adreno_perfcounter_restore(struct adreno_device *adreno_dev)
+{
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+	unsigned int counter, groupid;
+
+	/* Do not save/restore if not requested */
+	if (counters == NULL || !adreno_dev->perfcounter)
+		return;
+
+	for (groupid = 0; groupid < counters->group_count; groupid++) {
+		group = &(counters->groups[groupid]);
+
+		if (!group->load)
+			continue;
+
+		/* Restore the counters for the group */
+		for (counter = 0; counter < group->reg_count; counter++) {
+			/* If not active or broken, skip this counter */
+			if (!active_countable(group->regs[counter].countable))
+				continue;
+
+			group->load(adreno_dev, &group->regs[counter]);
+		}
+	}
+}
+
+/**
+ * adreno_perfcounter_save() - Save performance counters
+ * @adreno_dev: adreno device to configure
+ *
+ * Save the performance counter values before GPU power collapse.
+ * The saved values are restored on restart.
+ * This ensures physical counters are coherent across power-collapse.
+ * This function must be called with the oob_gpu set request.
+ */
+inline void adreno_perfcounter_save(struct adreno_device *adreno_dev)
+{
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+	unsigned int counter, groupid;
+
+	/* Do not save/restore if not requested */
+	if (counters == NULL || !adreno_dev->perfcounter)
+		return;
+
+	for (groupid = 0; groupid < counters->group_count; groupid++) {
+		group = &(counters->groups[groupid]);
+
+		/* Save the counter values for the group */
+		for (counter = 0; counter < group->reg_count; counter++) {
+			/* If not active or broken, skip this counter */
+			if (!active_countable(group->regs[counter].countable))
+				continue;
+
+			/* accumulate values for non-loadable counters */
+			if (group->regs[counter].load_bit >= 0)
+				group->regs[counter].value = 0;
+
+			group->regs[counter].value =
+				group->regs[counter].value +
+				adreno_perfcounter_read(adreno_dev, groupid,
+								counter);
+		}
+	}
+}
+
+static int adreno_perfcounter_enable(struct adreno_device *adreno_dev,
+	unsigned int group, unsigned int counter, unsigned int countable);
+
+/**
+ * adreno_perfcounter_start: Enable performance counters
+ * @adreno_dev: Adreno device to configure
+ *
+ * Ensure all performance counters are enabled that are allocated.  Since
+ * the device was most likely stopped, we can't trust that the counters
+ * are still valid so make it so.
+ */
+
+void adreno_perfcounter_start(struct adreno_device *adreno_dev)
+{
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+	unsigned int i, j;
+
+	if (counters == NULL)
+		return;
+	/* group id iter */
+	for (i = 0; i < counters->group_count; i++) {
+		group = &(counters->groups[i]);
+
+		/* countable iter */
+		for (j = 0; j < group->reg_count; j++) {
+			if (!active_countable(group->regs[j].countable))
+				continue;
+
+			/*
+			 * The GPU has to be idle before calling the perfcounter
+			 * enable function, but since this function is called
+			 * during start we already know the GPU is idle.
+			 * Since the countable/counter pairs have already been
+			 * validated, there is no way for _enable() to fail so
+			 * no need to check the return code.
+			 */
+			adreno_perfcounter_enable(adreno_dev, i, j,
+					  group->regs[j].countable);
+		}
+	}
+}
+
+/**
+ * adreno_perfcounter_read_group() - Determine which countables are in counters
+ * @adreno_dev: Adreno device to configure
+ * @reads: List of kgsl_perfcounter_read_groups
+ * @count: Length of list
+ *
+ * Read the performance counters for the groupid/countable pairs and return
+ * the 64 bit result for each pair
+ */
+
+int adreno_perfcounter_read_group(struct adreno_device *adreno_dev,
+	struct kgsl_perfcounter_read_group __user *reads, unsigned int count)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+	struct kgsl_perfcounter_read_group *list = NULL;
+	unsigned int i, j;
+	int ret = 0;
+
+	if (counters == NULL)
+		return -EINVAL;
+
+	/* sanity check params passed in */
+	if (reads == NULL || count == 0 || count > 100)
+		return -EINVAL;
+
+	list = kmalloc_array(count, sizeof(struct kgsl_perfcounter_read_group),
+			GFP_KERNEL);
+	if (!list)
+		return -ENOMEM;
+
+	if (copy_from_user(list, reads,
+			sizeof(struct kgsl_perfcounter_read_group) * count)) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	mutex_lock(&device->mutex);
+
+	ret = adreno_perfcntr_active_oob_get(adreno_dev);
+	if (ret) {
+		mutex_unlock(&device->mutex);
+		goto done;
+	}
+
+	/* list iterator */
+	for (j = 0; j < count; j++) {
+
+		list[j].value = 0;
+
+		/* Verify that the group ID is within range */
+		if (list[j].groupid >= counters->group_count) {
+			ret = -EINVAL;
+			break;
+		}
+
+		group = &(counters->groups[list[j].groupid]);
+
+		/* group/counter iterator */
+		for (i = 0; i < group->reg_count; i++) {
+			if (group->regs[i].countable == list[j].countable) {
+				list[j].value = adreno_perfcounter_read(
+					adreno_dev, list[j].groupid, i);
+				break;
+			}
+		}
+	}
+
+	adreno_perfcntr_active_oob_put(adreno_dev);
+
+	mutex_unlock(&device->mutex);
+
+	/* write the data */
+	if (ret == 0)
+		if (copy_to_user(reads, list,
+			sizeof(struct kgsl_perfcounter_read_group) * count))
+			ret = -EFAULT;
+
+done:
+	kfree(list);
+	return ret;
+}
+
+/**
+ * adreno_perfcounter_get_groupid() - Get the performance counter ID
+ * @adreno_dev: Adreno device
+ * @name: Performance counter group name string
+ *
+ * Get the groupid based on the name and return this ID
+ */
+
+int adreno_perfcounter_get_groupid(struct adreno_device *adreno_dev,
+					const char *name)
+{
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+	int i;
+
+	if (name == NULL || counters == NULL)
+		return -EINVAL;
+
+	for (i = 0; i < counters->group_count; ++i) {
+		group = &(counters->groups[i]);
+
+		/* make sure there is a name for this group */
+		if (group->name == NULL)
+			continue;
+
+		/* verify name and length */
+		if (strlen(name) == strlen(group->name) &&
+			strcmp(group->name, name) == 0)
+			return i;
+	}
+
+	return -EINVAL;
+}
+
+/**
+ * adreno_perfcounter_get_name() - Get the group name
+ * @adreno_dev: Adreno device
+ * @groupid: Desired performance counter groupid
+ *
+ * Get the name based on the groupid and return it
+ */
+
+const char *adreno_perfcounter_get_name(struct adreno_device *adreno_dev,
+		unsigned int groupid)
+{
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+
+	if (counters != NULL && groupid < counters->group_count)
+		return counters->groups[groupid].name;
+
+	return NULL;
+}
+
+/**
+ * adreno_perfcounter_query_group: Determine which countables are in counters
+ * @adreno_dev: Adreno device to configure
+ * @groupid: Desired performance counter group
+ * @countables: Return list of all countables in the groups counters
+ * @count: Max length of the array
+ * @max_counters: max counters for the groupid
+ *
+ * Query the current state of counters for the group.
+ */
+
+int adreno_perfcounter_query_group(struct adreno_device *adreno_dev,
+	unsigned int groupid, unsigned int __user *countables,
+	unsigned int count, unsigned int *max_counters)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+	unsigned int i, t;
+	int ret = 0;
+	unsigned int *buf;
+
+	*max_counters = 0;
+
+	if (counters == NULL || groupid >= counters->group_count)
+		return -EINVAL;
+
+	mutex_lock(&device->mutex);
+
+	group = &(counters->groups[groupid]);
+	*max_counters = group->reg_count;
+
+	/*
+	 * if NULL countable or *count of zero, return max reg_count in
+	 * *max_counters and return success
+	 */
+	if (countables == NULL || count == 0) {
+		mutex_unlock(&device->mutex);
+		return 0;
+	}
+
+	t = min_t(unsigned int, group->reg_count, count);
+
+	buf = kmalloc_array(t, sizeof(unsigned int), GFP_KERNEL);
+	if (buf == NULL) {
+		mutex_unlock(&device->mutex);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < t; i++)
+		buf[i] = group->regs[i].countable;
+
+	mutex_unlock(&device->mutex);
+
+	if (copy_to_user(countables, buf, sizeof(unsigned int) * t))
+		ret = -EFAULT;
+
+	kfree(buf);
+
+	return ret;
+}
+
+static inline void refcount_group(const struct adreno_perfcount_group *group,
+	unsigned int reg, unsigned int flags,
+	unsigned int *lo, unsigned int *hi)
+{
+	if (flags & PERFCOUNTER_FLAG_KERNEL)
+		group->regs[reg].kernelcount++;
+	else
+		group->regs[reg].usercount++;
+
+	if (lo)
+		*lo = group->regs[reg].offset;
+
+	if (hi)
+		*hi = group->regs[reg].offset_hi;
+}
+
+/**
+ * adreno_perfcounter_get: Try to put a countable in an available counter
+ * @adreno_dev: Adreno device to configure
+ * @groupid: Desired performance counter group
+ * @countable: Countable desired to be in a counter
+ * @offset: Return offset of the LO counter assigned
+ * @offset_hi: Return offset of the HI counter assigned
+ * @flags: Used to setup kernel perf counters
+ *
+ * Try to place a countable in an available counter.  If the countable is
+ * already in a counter, reference count the counter/countable pair resource
+ * and return success
+ */
+
+int adreno_perfcounter_get(struct adreno_device *adreno_dev,
+	unsigned int groupid, unsigned int countable, unsigned int *offset,
+	unsigned int *offset_hi, unsigned int flags)
+{
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+	unsigned int empty = -1;
+	int ret = 0;
+
+	/* always clear return variables */
+	if (offset)
+		*offset = 0;
+	if (offset_hi)
+		*offset_hi = 0;
+
+	if (counters == NULL)
+		return -EINVAL;
+
+	if (groupid >= counters->group_count)
+		return -EINVAL;
+
+	group = &(counters->groups[groupid]);
+
+	if (group->flags & ADRENO_PERFCOUNTER_GROUP_FIXED) {
+		/*
+		 * In fixed groups the countable equals the fixed register the
+		 * user wants. First make sure it is in range
+		 */
+
+		if (countable >= group->reg_count)
+			return -EINVAL;
+
+		/* If it is already reserved, just increase the refcounts */
+		if ((group->regs[countable].kernelcount != 0) ||
+			(group->regs[countable].usercount != 0)) {
+			refcount_group(group, countable, flags,
+				offset, offset_hi);
+			return 0;
+		}
+
+		empty = countable;
+	} else {
+		unsigned int i;
+
+		/*
+		 * Check if the countable is already associated with a counter.
+		 * Refcount and return the offset, otherwise, try and find an
+		 * empty counter and assign the countable to it.
+		 */
+
+		for (i = 0; i < group->reg_count; i++) {
+			if (group->regs[i].countable == countable) {
+				refcount_group(group, i, flags,
+					offset, offset_hi);
+				return 0;
+			} else if (group->regs[i].countable ==
+			KGSL_PERFCOUNTER_NOT_USED) {
+				/* keep track of unused counter */
+				empty = i;
+			}
+		}
+	}
+
+	/* no available counters, so do nothing else */
+	if (empty == -1)
+		return -EBUSY;
+
+	/* initialize the new counter */
+	group->regs[empty].countable = countable;
+
+	/* enable the new counter */
+	ret = adreno_perfcounter_enable(adreno_dev, groupid, empty, countable);
+	if (ret) {
+		/* Put back the perfcounter */
+		if (!(group->flags & ADRENO_PERFCOUNTER_GROUP_FIXED))
+			group->regs[empty].countable =
+				KGSL_PERFCOUNTER_NOT_USED;
+		return ret;
+	}
+
+	/* set initial kernel and user count */
+	if (flags & PERFCOUNTER_FLAG_KERNEL) {
+		group->regs[empty].kernelcount = 1;
+		group->regs[empty].usercount = 0;
+	} else {
+		group->regs[empty].kernelcount = 0;
+		group->regs[empty].usercount = 1;
+	}
+
+	if (offset)
+		*offset = group->regs[empty].offset;
+	if (offset_hi)
+		*offset_hi = group->regs[empty].offset_hi;
+
+	return ret;
+}
+
+
+/**
+ * adreno_perfcounter_put: Release a countable from counter resource
+ * @adreno_dev: Adreno device to configure
+ * @groupid: Desired performance counter group
+ * @countable: Countable desired to be freed from a  counter
+ * @flags: Flag to determine if kernel or user space request
+ *
+ * Put a performance counter/countable pair that was previously received.  If
+ * noone else is using the countable, free up the counter for others.
+ */
+int adreno_perfcounter_put(struct adreno_device *adreno_dev,
+	unsigned int groupid, unsigned int countable, unsigned int flags)
+{
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	unsigned int i;
+	int ret = 0;
+
+	if (counters == NULL || groupid >= counters->group_count)
+		return -EINVAL;
+
+	group = &(counters->groups[groupid]);
+
+	/*
+	 * Find if the counter/countable pair is used currently.
+	 * Start cycling through registers in the bank.
+	 */
+	for (i = 0; i < group->reg_count; i++) {
+		/* check if countable assigned is what we are looking for */
+		if (group->regs[i].countable == countable) {
+			/* found pair, book keep count based on request type */
+			if (flags & PERFCOUNTER_FLAG_KERNEL &&
+					group->regs[i].kernelcount > 0)
+				group->regs[i].kernelcount--;
+			else if (group->regs[i].usercount > 0)
+				group->regs[i].usercount--;
+			else
+				break;
+
+			/* mark available if not used anymore */
+			if (group->regs[i].kernelcount == 0 &&
+					group->regs[i].usercount == 0) {
+				/*
+				 * Perfcounter register is added to the power
+				 * up reglist only if group_restore flag is set.
+				 * Hence check the flag before removing the entry
+				 * from the reglist.
+				 */
+				if ((group->flags & ADRENO_PERFCOUNTER_GROUP_RESTORE) &&
+						gpudev->perfcounter_remove)
+					ret = gpudev->perfcounter_remove(adreno_dev,
+							&group->regs[i], groupid);
+				if (!ret)
+					group->regs[i].countable = KGSL_PERFCOUNTER_NOT_USED;
+			}
+
+			return ret;
+		}
+	}
+
+	return -EINVAL;
+}
+
+/**
+ * adreno_perfcounter_enable - Configure a performance counter for a countable
+ * @adreno_dev -  Adreno device to configure
+ * @group - Desired performance counter group
+ * @counter - Desired performance counter in the group
+ * @countable - Desired countable
+ *
+ * Function is used for adreno cores
+ * Physically set up a counter within a group with the desired countable
+ * Return 0 on success else error code
+ */
+static int adreno_perfcounter_enable(struct adreno_device *adreno_dev,
+	unsigned int groupid, unsigned int counter, unsigned int countable)
+{
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+
+	if (counters == NULL)
+		return -EINVAL;
+
+	if (groupid >= counters->group_count)
+		return -EINVAL;
+
+	group = &counters->groups[groupid];
+
+	if (counter >= group->reg_count)
+		return -EINVAL;
+
+	return group->enable(adreno_dev, group, counter, countable);
+}
+
+/**
+ * adreno_perfcounter_read() - Reads a performance counter
+ * @adreno_dev: The device on which the counter is running
+ * @group: The group of the counter
+ * @counter: The counter within the group
+ *
+ * Function is used to read the counter of adreno devices
+ * Returns the 64 bit counter value on success else 0.
+ */
+uint64_t adreno_perfcounter_read(struct adreno_device *adreno_dev,
+	unsigned int groupid, unsigned int counter)
+{
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+
+	/* Lets hope this doesn't fail. Now subfunctions don't need to check */
+	if (counters == NULL)
+		return 0;
+
+	if (groupid >= counters->group_count)
+		return 0;
+
+	group = &counters->groups[groupid];
+
+	if (counter >= group->reg_count)
+		return 0;
+
+	return group->read(adreno_dev, group, counter);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_perfcounter.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_perfcounter.h
@@ -0,0 +1,137 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2008-2015,2017,2019-2021 The Linux Foundation. All rights reserved.
+ */
+#ifndef __ADRENO_PERFCOUNTER_H
+#define __ADRENO_PERFCOUNTER_H
+
+struct adreno_device;
+
+/* ADRENO_PERFCOUNTERS - Given an adreno device, return the perfcounters list */
+#define ADRENO_PERFCOUNTERS(_a) ((_a)->gpucore->perfcounters)
+
+#define PERFCOUNTER_FLAG_NONE 0x0
+#define PERFCOUNTER_FLAG_KERNEL 0x1
+
+/* Structs to maintain the list of active performance counters */
+
+/**
+ * struct adreno_perfcount_register: register state
+ * @countable: countable the register holds
+ * @kernelcount: number of user space users of the register
+ * @usercount: number of kernel users of the register
+ * @offset: register hardware offset
+ * @load_bit: The bit number in LOAD register which corresponds to this counter
+ * @select: The countable register offset
+ * @value: The 64 bit countable register value
+ */
+struct adreno_perfcount_register {
+	unsigned int countable;
+	unsigned int kernelcount;
+	unsigned int usercount;
+	unsigned int offset;
+	unsigned int offset_hi;
+	int load_bit;
+	unsigned int select;
+	uint64_t value;
+};
+
+/**
+ * struct adreno_perfcount_group: registers for a hardware group
+ * @regs: available registers for this group
+ * @reg_count: total registers for this group
+ * @name: group name for this group
+ */
+struct adreno_perfcount_group {
+	struct adreno_perfcount_register *regs;
+	unsigned int reg_count;
+	const char *name;
+	unsigned long flags;
+	int (*enable)(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter, unsigned int countable);
+	u64 (*read)(struct adreno_device *adreno_dev,
+		const struct adreno_perfcount_group *group,
+		unsigned int counter);
+	void (*load)(struct adreno_device *adreno_dev,
+		struct adreno_perfcount_register *reg);
+};
+
+/*
+ * ADRENO_PERFCOUNTER_GROUP_FIXED indicates that a perfcounter group is fixed -
+ * instead of having configurable countables like the other groups, registers in
+ * fixed groups have a hardwired countable.  So when the user requests a
+ * countable in one of these groups, that countable should be used as the
+ * register offset to return
+ */
+
+#define ADRENO_PERFCOUNTER_GROUP_FIXED BIT(0)
+
+/*
+ * ADRENO_PERFCOUNTER_GROUP_RESTORE indicates CP needs to restore the select
+ * registers of this perfcounter group as part of preemption and IFPC
+ */
+#define ADRENO_PERFCOUNTER_GROUP_RESTORE BIT(1)
+
+
+/**
+ * adreno_perfcounts: all available perfcounter groups
+ * @groups: available groups for this device
+ * @group_count: total groups for this device
+ */
+struct adreno_perfcounters {
+	const struct adreno_perfcount_group *groups;
+	unsigned int group_count;
+};
+
+#define ADRENO_PERFCOUNTER_GROUP_FLAGS(core, offset, name, flags, \
+		enable, read, load) \
+	[KGSL_PERFCOUNTER_GROUP_##offset] = { core##_perfcounters_##name, \
+	ARRAY_SIZE(core##_perfcounters_##name), __stringify(name), flags, \
+	enable, read, load }
+
+#define ADRENO_PERFCOUNTER_GROUP(core, offset, name, enable, read, load) \
+	ADRENO_PERFCOUNTER_GROUP_FLAGS(core, offset, name, 0, enable, read, \
+			load)
+
+int adreno_perfcounter_query_group(struct adreno_device *adreno_dev,
+	unsigned int groupid, unsigned int __user *countables,
+	unsigned int count, unsigned int *max_counters);
+
+int adreno_perfcounter_read_group(struct adreno_device *adreno_dev,
+	struct kgsl_perfcounter_read_group __user *reads, unsigned int count);
+
+void adreno_perfcounter_restore(struct adreno_device *adreno_dev);
+
+void adreno_perfcounter_save(struct adreno_device *adreno_dev);
+
+void adreno_perfcounter_start(struct adreno_device *adreno_dev);
+
+int adreno_perfcounter_get_groupid(struct adreno_device *adreno_dev,
+					const char *name);
+
+uint64_t adreno_perfcounter_read(struct adreno_device *adreno_dev,
+	unsigned int group, unsigned int counter);
+
+const char *adreno_perfcounter_get_name(struct adreno_device
+					*adreno_dev, unsigned int groupid);
+
+int adreno_perfcounter_get(struct adreno_device *adreno_dev,
+	unsigned int groupid, unsigned int countable, unsigned int *offset,
+	unsigned int *offset_hi, unsigned int flags);
+
+int adreno_perfcounter_put(struct adreno_device *adreno_dev,
+	unsigned int groupid, unsigned int countable, unsigned int flags);
+
+static inline int adreno_perfcounter_kernel_get(
+		struct adreno_device *adreno_dev,
+		int group, int countable, u32 *lo, u32 *hi)
+{
+	if (*lo)
+		return 0;
+
+	return adreno_perfcounter_get(adreno_dev, group, countable, lo, hi,
+		PERFCOUNTER_FLAG_KERNEL);
+}
+
+#endif /* __ADRENO_PERFCOUNTER_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_pm4types.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_pm4types.h
@@ -0,0 +1,418 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_PM4TYPES_H
+#define __ADRENO_PM4TYPES_H
+
+#include "adreno.h"
+
+#define CP_TYPE0_PKT	(0 << 30)
+#define CP_TYPE3_PKT	(3 << 30)
+#define CP_TYPE4_PKT	(4 << 28)
+#define CP_TYPE7_PKT	(7 << 28)
+
+#define PM4_TYPE4_PKT_SIZE_MAX  128
+
+/* type3 packets */
+
+/* Enable preemption flag */
+#define CP_PREEMPT_ENABLE 0x1C
+/* Preemption token command on which preemption occurs */
+#define CP_PREEMPT_TOKEN 0x1E
+/* Bit to set in CP_PREEMPT_TOKEN ordinal for interrupt on preemption */
+#define CP_PREEMPT_ORDINAL_INTERRUPT 24
+
+/* Wait for memory writes to complete */
+#define CP_WAIT_MEM_WRITES     0x12
+
+/* initialize CP's micro-engine */
+#define CP_ME_INIT		0x48
+
+/* skip N 32-bit words to get to the next packet */
+#define CP_NOP			0x10
+
+/* indirect buffer dispatch.  same as IB, but init is pipelined */
+#define CP_INDIRECT_BUFFER_PFD	0x37
+
+/* wait for the IDLE state of the engine */
+#define CP_WAIT_FOR_IDLE	0x26
+
+/* wait until a register or memory location is a specific value */
+#define CP_WAIT_REG_MEM	0x3c
+
+/* wait until a register location is equal to a specific value */
+#define CP_WAIT_REG_EQ		0x52
+
+/* switches SMMU pagetable, used on a5xx only */
+#define CP_SMMU_TABLE_UPDATE 0x53
+
+/* Designate command streams to be executed before/after CP does state restore during preemption */
+#define CP_SET_AMBLE		0x55
+
+/*  Set internal CP registers, used to indicate context save data addresses */
+#define CP_SET_PSEUDO_REGISTER      0x56
+
+/* Tell CP the current operation mode, indicates save and restore procedure */
+#define CP_SET_MARKER  0x65
+
+/* register read/modify/write */
+#define CP_REG_RMW		0x21
+
+/* Set binning configuration registers */
+#define CP_SET_BIN_DATA             0x2f
+
+/* reads register in chip and writes to memory */
+#define CP_REG_TO_MEM		0x3e
+
+/* reads memory and writes to register in chip */
+#define CP_MEM_TO_REG		0x42
+
+/* write N 32-bit words to memory */
+#define CP_MEM_WRITE		0x3d
+
+/* conditional execution of a sequence of packets */
+#define CP_COND_EXEC		0x44
+
+/* conditional write to memory or register */
+#define CP_COND_WRITE		0x45
+
+/* generate an event that creates a write to memory when completed */
+#define CP_EVENT_WRITE		0x46
+
+/* initiate fetch of index buffer and draw */
+#define CP_DRAW_INDX		0x22
+
+/* New draw packets defined for A4XX */
+#define CP_DRAW_INDX_OFFSET	0x38
+#define CP_DRAW_INDIRECT	0x28
+#define CP_DRAW_INDX_INDIRECT	0x29
+#define CP_DRAW_AUTO		0x24
+
+/* load constant into chip and to memory */
+#define CP_SET_CONSTANT	0x2d
+
+/* selective invalidation of state pointers */
+#define CP_INVALIDATE_STATE	0x3b
+
+/* generate interrupt from the command stream */
+#define CP_INTERRUPT		0x40
+
+/* A5XX Enable yield in RB only */
+#define CP_YIELD_ENABLE 0x1C
+
+#define CP_WHERE_AM_I 0x62
+
+/* Enable/Disable/Defer A5x global preemption model */
+#define CP_PREEMPT_ENABLE_GLOBAL    0x69
+
+/* Enable/Disable A5x local preemption model */
+#define CP_PREEMPT_ENABLE_LOCAL     0x6A
+
+/* Yeild token on a5xx similar to CP_PREEMPT on a4xx */
+#define CP_CONTEXT_SWITCH_YIELD     0x6B
+
+/* Inform CP about current render mode (needed for a5xx preemption) */
+#define CP_SET_RENDER_MODE          0x6C
+
+/* Write register, ignoring context state for context sensitive registers */
+#define CP_REG_WR_NO_CTXT  0x78
+
+/*
+ * for A4xx
+ * Write to register with address that does not fit into type-0 pkt
+ */
+#define CP_WIDE_REG_WRITE           0x74
+
+
+/* PFP waits until the FIFO between the PFP and the ME is empty */
+#define CP_WAIT_FOR_ME		0x13
+
+/* Stall the SQE until the CP processing pipeline is empty */
+#define CP_WAIT_FOR_CP_FLUSH 0x13
+
+#define CP_SET_PROTECTED_MODE  0x5f /* sets the register protection mode */
+
+/* Used to switch GPU between secure and non-secure modes */
+#define CP_SET_SECURE_MODE 0x66
+
+#define CP_BOOTSTRAP_UCODE  0x6f /* bootstraps microcode */
+
+/*
+ * for a3xx
+ */
+
+#define CP_LOAD_STATE 0x30 /* load high level sequencer command */
+
+/* Conditionally load a IB based on a flag */
+#define CP_COND_INDIRECT_BUFFER_PFE 0x3A /* prefetch enabled */
+#define CP_COND_INDIRECT_BUFFER_PFD 0x32 /* prefetch disabled */
+
+/* Load a buffer with pre-fetch enabled */
+#define CP_INDIRECT_BUFFER_PFE 0x3F
+
+#define CP_EXEC_CL 0x31
+
+/* (A4x) save PM4 stream pointers to execute upon a visible draw */
+#define CP_SET_DRAW_STATE 0x43
+
+#define CP_LOADSTATE_DSTOFFSET_SHIFT 0x00000000
+#define CP_LOADSTATE_STATESRC_SHIFT 0x00000010
+#define CP_LOADSTATE_STATEBLOCKID_SHIFT 0x00000013
+#define CP_LOADSTATE_NUMOFUNITS_SHIFT 0x00000016
+#define CP_LOADSTATE_STATETYPE_SHIFT 0x00000000
+#define CP_LOADSTATE_EXTSRCADDR_SHIFT 0x00000002
+
+/* This is a commonly used CP_EVENT_WRITE */
+#define CACHE_FLUSH_TS 4
+#define CACHE_CLEAN 0x31
+
+/* Controls which threads execute the PM4 commands the follow this packet */
+#define CP_THREAD_CONTROL 0x17
+
+#define CP_WAIT_TIMESTAMP 0x14
+
+#define CP_SET_THREAD_BR FIELD_PREP(GENMASK(1, 0), 1)
+#define CP_SET_THREAD_BV FIELD_PREP(GENMASK(1, 0), 2)
+#define CP_SET_THREAD_BOTH FIELD_PREP(GENMASK(1, 0), 3)
+#define CP_SYNC_THREADS BIT(31)
+#define CP_CONCURRENT_BIN_DISABLE BIT(27)
+
+#define CP_RESET_CONTEXT_STATE 0x1F
+
+#define CP_RESET_GLOBAL_LOCAL_TS BIT(3)
+#define CP_CLEAR_BV_BR_COUNTER BIT(2)
+#define CP_CLEAR_RESOURCE_TABLE BIT(1)
+#define CP_CLEAR_ON_CHIP_TS BIT(0)
+
+/* Used to define amble type in SET_AMBLE packet to execute during preemption */
+#define CP_KMD_AMBLE_TYPE 3
+
+static inline uint pm4_calc_odd_parity_bit(uint val)
+{
+	return (0x9669 >> (0xf & ((val) ^
+	((val) >> 4) ^ ((val) >> 8) ^ ((val) >> 12) ^
+	((val) >> 16) ^ ((val) >> 20) ^ ((val) >> 24) ^
+	((val) >> 28)))) & 1;
+}
+
+/*
+ * PM4 packet header functions
+ * For all the packet functions the passed in count should be the size of the
+ * payload excluding the header
+ */
+static inline uint cp_type0_packet(uint regindx, uint cnt)
+{
+	return CP_TYPE0_PKT | ((cnt-1) << 16) | ((regindx) & 0x7FFF);
+}
+
+static inline uint cp_type3_packet(uint opcode, uint cnt)
+{
+	return CP_TYPE3_PKT | ((cnt-1) << 16) | (((opcode) & 0xFF) << 8);
+}
+
+static inline uint cp_type4_packet(uint opcode, uint cnt)
+{
+	return CP_TYPE4_PKT | ((cnt) << 0) |
+	(pm4_calc_odd_parity_bit(cnt) << 7) |
+	(((opcode) & 0x3FFFF) << 8) |
+	((pm4_calc_odd_parity_bit(opcode) << 27));
+}
+
+static inline uint cp_type7_packet(uint opcode, uint cnt)
+{
+	return CP_TYPE7_PKT | ((cnt) << 0) |
+	(pm4_calc_odd_parity_bit(cnt) << 15) |
+	(((opcode) & 0x7F) << 16) |
+	((pm4_calc_odd_parity_bit(opcode) << 23));
+
+}
+
+#define pkt_is_type0(pkt) (((pkt) & 0XC0000000) == CP_TYPE0_PKT)
+
+#define type0_pkt_size(pkt) ((((pkt) >> 16) & 0x3FFF) + 1)
+#define type0_pkt_offset(pkt) ((pkt) & 0x7FFF)
+
+/*
+ * Check both for the type3 opcode and make sure that the reserved bits [1:7]
+ * and 15 are 0
+ */
+
+#define pkt_is_type3(pkt) \
+	((((pkt) & 0xC0000000) == CP_TYPE3_PKT) && \
+	 (((pkt) & 0x80FE) == 0))
+
+#define cp_type3_opcode(pkt) (((pkt) >> 8) & 0xFF)
+#define type3_pkt_size(pkt) ((((pkt) >> 16) & 0x3FFF) + 1)
+
+#define pkt_is_type4(pkt) \
+	((((pkt) & 0xF0000000) == CP_TYPE4_PKT) && \
+	 ((((pkt) >> 27) & 0x1) == \
+	 pm4_calc_odd_parity_bit(cp_type4_base_index_one_reg_wr(pkt))) \
+	 && ((((pkt) >> 7) & 0x1) == \
+	 pm4_calc_odd_parity_bit(type4_pkt_size(pkt))))
+
+#define cp_type4_base_index_one_reg_wr(pkt) (((pkt) >> 8) & 0x7FFFF)
+#define type4_pkt_size(pkt) ((pkt) & 0x7F)
+
+#define pkt_is_type7(pkt) \
+	((((pkt) & 0xF0000000) == CP_TYPE7_PKT) && \
+	 (((pkt) & 0x0F000000) == 0) && \
+	 ((((pkt) >> 23) & 0x1) == \
+	 pm4_calc_odd_parity_bit(cp_type7_opcode(pkt))) \
+	 && ((((pkt) >> 15) & 0x1) == \
+	 pm4_calc_odd_parity_bit(type7_pkt_size(pkt))))
+
+#define cp_type7_opcode(pkt) (((pkt) >> 16) & 0x7F)
+#define type7_pkt_size(pkt) ((pkt) & 0x3FFF)
+
+/* dword base address of the GFX decode space */
+#define SUBBLOCK_OFFSET(reg) ((unsigned int)((reg) - (0x2000)))
+
+/* gmem command buffer length */
+#define CP_REG(reg) ((0x4 << 16) | (SUBBLOCK_OFFSET(reg)))
+
+/* Return true if the hardware uses the legacy (A4XX and older) PM4 format */
+#define ADRENO_LEGACY_PM4(_d) (ADRENO_GPUREV(_d) < 500)
+
+/**
+ * cp_packet - Generic CP packet to support different opcodes on
+ * different GPU cores.
+ * @adreno_dev: The adreno device
+ * @opcode: Operation for cp packet
+ * @size: size for cp packet
+ */
+static inline uint cp_packet(struct adreno_device *adreno_dev,
+				int opcode, uint size)
+{
+	if (ADRENO_LEGACY_PM4(adreno_dev))
+		return cp_type3_packet(opcode, size);
+
+	return cp_type7_packet(opcode, size);
+}
+
+/**
+ * cp_mem_packet - Generic CP memory packet to support different
+ * opcodes on different GPU cores.
+ * @adreno_dev: The adreno device
+ * @opcode: mem operation for cp packet
+ * @size: size for cp packet
+ * @num_mem: num of mem access
+ */
+static inline uint cp_mem_packet(struct adreno_device *adreno_dev,
+				int opcode, uint size, uint num_mem)
+{
+	if (ADRENO_LEGACY_PM4(adreno_dev))
+		return cp_type3_packet(opcode, size);
+
+	return cp_type7_packet(opcode, size + num_mem);
+}
+
+/* Return 1 if the command is an indirect buffer of any kind */
+static inline int adreno_cmd_is_ib(struct adreno_device *adreno_dev,
+					unsigned int cmd)
+{
+	return cmd == cp_mem_packet(adreno_dev,
+			CP_INDIRECT_BUFFER_PFE, 2, 1) ||
+		cmd == cp_mem_packet(adreno_dev,
+			CP_INDIRECT_BUFFER_PFD, 2, 1) ||
+		cmd == cp_mem_packet(adreno_dev,
+			CP_COND_INDIRECT_BUFFER_PFE, 2, 1) ||
+		cmd == cp_mem_packet(adreno_dev,
+			CP_COND_INDIRECT_BUFFER_PFD, 2, 1);
+}
+
+/**
+ * cp_gpuaddr - Generic function to add 64bit and 32bit gpuaddr
+ * to pm4 commands
+ * @adreno_dev: The adreno device
+ * @cmds: command pointer to add gpuaddr
+ * @gpuaddr: gpuaddr to add
+ */
+static inline uint cp_gpuaddr(struct adreno_device *adreno_dev,
+		   uint *cmds, uint64_t gpuaddr)
+{
+	uint *start = cmds;
+
+	if (ADRENO_LEGACY_PM4(adreno_dev))
+		*cmds++ = (uint)gpuaddr;
+	else {
+		*cmds++ = lower_32_bits(gpuaddr);
+		*cmds++ = upper_32_bits(gpuaddr);
+	}
+	return cmds - start;
+}
+
+/**
+ * cp_register - Generic function for gpu register operation
+ * @adreno_dev: The adreno device
+ * @reg: GPU register
+ * @size: count for PM4 operation
+ */
+static inline uint cp_register(struct adreno_device *adreno_dev,
+			unsigned int reg, unsigned int size)
+{
+	if (ADRENO_LEGACY_PM4(adreno_dev))
+		return cp_type0_packet(reg, size);
+
+	return cp_type4_packet(reg, size);
+}
+
+/**
+ * cp_wait_for_me - common function for WAIT_FOR_ME
+ * @adreno_dev: The adreno device
+ * @cmds: command pointer to add gpuaddr
+ */
+static inline uint cp_wait_for_me(struct adreno_device *adreno_dev,
+				uint *cmds)
+{
+	uint *start = cmds;
+
+	if (ADRENO_LEGACY_PM4(adreno_dev)) {
+		*cmds++ = cp_type3_packet(CP_WAIT_FOR_ME, 1);
+		*cmds++ = 0;
+	} else
+		*cmds++ = cp_type7_packet(CP_WAIT_FOR_ME, 0);
+
+	return cmds - start;
+}
+
+/**
+ * cp_wait_for_idle - common function for WAIT_FOR_IDLE
+ * @adreno_dev: The adreno device
+ * @cmds: command pointer to add gpuaddr
+ */
+static inline uint cp_wait_for_idle(struct adreno_device *adreno_dev,
+				uint *cmds)
+{
+	uint *start = cmds;
+
+	if (ADRENO_LEGACY_PM4(adreno_dev)) {
+		*cmds++ = cp_type3_packet(CP_WAIT_FOR_IDLE, 1);
+		*cmds++ = 0;
+	} else
+		*cmds++ = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+
+	return cmds - start;
+}
+
+static inline u32 cp_protected_mode(struct adreno_device *adreno_dev,
+		u32 *cmds, int on)
+{
+	cmds[0] = cp_packet(adreno_dev, CP_SET_PROTECTED_MODE, 1);
+	cmds[1] = on;
+
+	return 2;
+}
+
+static inline u32 cp_identifier(struct adreno_device *adreno_dev,
+		u32 *cmds, u32 id)
+{
+	cmds[0] = cp_packet(adreno_dev, CP_NOP, 1);
+	cmds[1] = id;
+
+	return 2;
+}
+
+#endif	/* __ADRENO_PM4TYPES_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_profile.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_profile.c
@@ -0,0 +1,1150 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2013-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/ctype.h>
+#include <linux/debugfs.h>
+#include <linux/sched/signal.h>
+
+#include "adreno.h"
+#include "adreno_hwsched.h"
+#include "adreno_profile.h"
+#include "adreno_pm4types.h"
+#include "adreno_ringbuffer.h"
+
+#define ASSIGNS_STR_FORMAT "%.8s:%u "
+
+/*
+ * Raw Data for processing later:
+ *        : 3 - timestamp, count, context id
+ * [per counter] - data for each counter
+ *        : 1 - Register offset
+ *        : 2 - Pre IB register hi/lo value
+ *        : 2 - Post IB register hi/lo value
+ * [per counter end]
+ */
+#define SIZE_DATA(cnt) (6 + (cnt) * 5)
+
+/*
+ * Pre-IB command size (in dwords):
+ *        : 2 - NOP start identifier
+ *        : 4 - timestamp
+ *        : 4 - count
+ *        : 4 - context id
+ *        : 4 - pid
+ *        : 4 - tid
+ *        : 4 - type
+ * [loop count start] - for each counter to watch
+ *        : 4 - Register offset
+ *        : 4 - Register read lo
+ *        : 4 - Register read high
+ * [loop end]
+ *        : 2 - NOP end identifier
+ */
+#define SIZE_PREIB(cnt) (28 + (cnt) * 12)
+
+/*
+ * Post-IB command size (in dwords):
+ *        : 2 - NOP start identifier
+ * [loop count start] - for each counter to watch
+ *        : 4 - Register read lo
+ *        : 4 - Register read high
+ * [loop end]
+ *        : 2 - NOP end identifier
+ */
+#define SIZE_POSTIB(cnt) (4 + (cnt) * 8)
+
+/* Counter data + Pre size + post size = total size */
+#define SIZE_SHARED_ENTRY(cnt) (SIZE_DATA(cnt) + SIZE_PREIB(cnt) \
+		+ SIZE_POSTIB(cnt))
+
+/*
+ * Space for following string :"%u %u %u %.5s %u "
+ * [count iterations]: "%.8s:%u %llu %llu%c"
+ */
+#define SIZE_PIPE_ENTRY(cnt) (50 + (cnt) * 62)
+#define SIZE_LOG_ENTRY(cnt) (6 + (cnt) * 5)
+
+static inline uint _ib_cmd_mem_write(struct adreno_device *adreno_dev,
+			uint *cmds, uint64_t gpuaddr, uint val, uint *off)
+{
+	unsigned int *start = cmds;
+
+	*cmds++ = cp_mem_packet(adreno_dev, CP_MEM_WRITE, 2, 1);
+	cmds += cp_gpuaddr(adreno_dev, cmds, gpuaddr);
+	*cmds++ = val;
+
+	*off += sizeof(unsigned int);
+	return cmds - start;
+}
+
+static inline uint _ib_cmd_reg_to_mem(struct adreno_device *adreno_dev,
+			uint *cmds, uint64_t gpuaddr, uint val, uint *off)
+{
+	unsigned int *start = cmds;
+
+	*cmds++ = cp_mem_packet(adreno_dev, CP_REG_TO_MEM, 2, 1);
+	*cmds++ = val;
+	cmds += cp_gpuaddr(adreno_dev, cmds, gpuaddr);
+
+	*off += sizeof(unsigned int);
+	return cmds - start;
+}
+
+static u64 _build_pre_ib_cmds(struct adreno_device *adreno_dev,
+		struct adreno_profile *profile,
+		unsigned int head, unsigned int timestamp,
+		struct adreno_context *drawctxt,
+		u32 *dwords)
+{
+	struct adreno_profile_assigns_list *entry;
+	unsigned int *start, *ibcmds;
+	unsigned int count = profile->assignment_count;
+	uint64_t gpuaddr = profile->shared_buffer->gpuaddr;
+	unsigned int ib_offset = head + SIZE_DATA(count);
+	unsigned int data_offset = head * sizeof(unsigned int);
+
+	ibcmds = ib_offset + ((unsigned int *) profile->shared_buffer->hostptr);
+	start = ibcmds;
+
+	ibcmds += cp_identifier(adreno_dev, ibcmds, START_PROFILE_IDENTIFIER);
+
+	/*
+	 * Write ringbuffer commands to save the following to memory:
+	 * timestamp, count, context_id, pid, tid, context type
+	 */
+	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,
+			timestamp, &data_offset);
+	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,
+			profile->assignment_count, &data_offset);
+	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,
+			drawctxt->base.id, &data_offset);
+	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,
+			pid_nr(drawctxt->base.proc_priv->pid), &data_offset);
+	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,
+			drawctxt->base.tid, &data_offset);
+	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,
+			drawctxt->type, &data_offset);
+
+	/* loop for each countable assigned */
+	list_for_each_entry(entry, &profile->assignments_list, list) {
+		ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds,
+				gpuaddr + data_offset, entry->offset,
+				&data_offset);
+		ibcmds += _ib_cmd_reg_to_mem(adreno_dev, ibcmds,
+				gpuaddr + data_offset, entry->offset,
+				&data_offset);
+		ibcmds += _ib_cmd_reg_to_mem(adreno_dev, ibcmds,
+				gpuaddr + data_offset, entry->offset_hi,
+				&data_offset);
+
+		/* skip over post_ib counter data */
+		data_offset += sizeof(unsigned int) * 2;
+	}
+
+
+	ibcmds += cp_identifier(adreno_dev, ibcmds, END_PROFILE_IDENTIFIER);
+
+	*dwords = (ibcmds - start);
+	return profile->shared_buffer->gpuaddr + (ib_offset * sizeof(u32));
+}
+
+static u64 _build_post_ib_cmds(struct adreno_device *adreno_dev,
+		struct adreno_profile *profile, unsigned int head,
+		u32 *dwords)
+{
+	struct adreno_profile_assigns_list *entry;
+	unsigned int *start, *ibcmds;
+	unsigned int count = profile->assignment_count;
+	uint64_t gpuaddr =  profile->shared_buffer->gpuaddr;
+	unsigned int ib_offset = head + SIZE_DATA(count) + SIZE_PREIB(count);
+	unsigned int data_offset = head * sizeof(unsigned int);
+
+	ibcmds = ib_offset + ((unsigned int *) profile->shared_buffer->hostptr);
+	start = ibcmds;
+
+	/* start of profile identifier */
+	ibcmds += cp_identifier(adreno_dev, ibcmds, START_PROFILE_IDENTIFIER);
+
+	/* skip over pre_ib preamble */
+	data_offset += sizeof(unsigned int) * 6;
+
+	/* loop for each countable assigned */
+	list_for_each_entry(entry, &profile->assignments_list, list) {
+		/* skip over pre_ib counter data */
+		data_offset += sizeof(unsigned int) * 3;
+		ibcmds += _ib_cmd_reg_to_mem(adreno_dev, ibcmds,
+				gpuaddr + data_offset, entry->offset,
+				&data_offset);
+		ibcmds += _ib_cmd_reg_to_mem(adreno_dev, ibcmds,
+				gpuaddr + data_offset, entry->offset_hi,
+				&data_offset);
+	}
+
+	/* end of profile identifier */
+	ibcmds += cp_identifier(adreno_dev, ibcmds, END_PROFILE_IDENTIFIER);
+
+	*dwords = (ibcmds - start);
+	return profile->shared_buffer->gpuaddr + (ib_offset * sizeof(u32));
+}
+
+static bool shared_buf_empty(struct adreno_profile *profile)
+{
+	if (profile->shared_buffer->hostptr == NULL ||
+			profile->shared_buffer->size == 0)
+		return true;
+
+	if (profile->shared_head == profile->shared_tail)
+		return true;
+
+	return false;
+}
+
+static inline void shared_buf_inc(unsigned int max_size,
+		unsigned int *offset, size_t inc)
+{
+	*offset = (*offset + inc) % max_size;
+}
+
+static inline void log_buf_wrapcnt(unsigned int cnt, uintptr_t *off)
+{
+	*off = (*off + cnt) % ADRENO_PROFILE_LOG_BUF_SIZE_DWORDS;
+}
+
+static inline void log_buf_wrapinc_len(unsigned int *profile_log_buffer,
+		unsigned int **ptr, unsigned int len)
+{
+	*ptr += len;
+	if (*ptr >= (profile_log_buffer +
+				ADRENO_PROFILE_LOG_BUF_SIZE_DWORDS))
+		*ptr -= ADRENO_PROFILE_LOG_BUF_SIZE_DWORDS;
+}
+
+static inline void log_buf_wrapinc(unsigned int *profile_log_buffer,
+		unsigned int **ptr)
+{
+	log_buf_wrapinc_len(profile_log_buffer, ptr, 1);
+}
+
+static inline unsigned int log_buf_available(struct adreno_profile *profile,
+		unsigned int *head_ptr)
+{
+	uintptr_t tail, head;
+
+	tail = (uintptr_t) profile->log_tail -
+		(uintptr_t) profile->log_buffer;
+	head = (uintptr_t)head_ptr - (uintptr_t) profile->log_buffer;
+	if (tail > head)
+		return (tail - head) / sizeof(uintptr_t);
+	else
+		return ADRENO_PROFILE_LOG_BUF_SIZE_DWORDS - ((head - tail) /
+				sizeof(uintptr_t));
+}
+
+static inline unsigned int shared_buf_available(struct adreno_profile *profile)
+{
+	if (profile->shared_tail > profile->shared_head)
+		return profile->shared_tail - profile->shared_head;
+	else
+		return profile->shared_size -
+			(profile->shared_head - profile->shared_tail);
+}
+
+static struct adreno_profile_assigns_list *_find_assignment_by_offset(
+		struct adreno_profile *profile, unsigned int offset)
+{
+	struct adreno_profile_assigns_list *entry;
+
+	list_for_each_entry(entry, &profile->assignments_list, list) {
+		if (entry->offset == offset)
+			return entry;
+	}
+
+	return NULL;
+}
+
+static bool _in_assignments_list(struct adreno_profile *profile,
+		unsigned int groupid, unsigned int countable)
+{
+	struct adreno_profile_assigns_list *entry;
+
+	list_for_each_entry(entry, &profile->assignments_list, list) {
+		if (entry->groupid == groupid && entry->countable ==
+				countable)
+			return true;
+	}
+
+	return false;
+}
+
+static bool _add_to_assignments_list(struct adreno_profile *profile,
+		const char *str, unsigned int groupid, unsigned int countable,
+		unsigned int offset, unsigned int offset_hi)
+{
+	struct adreno_profile_assigns_list *entry;
+
+	/* first make sure we can alloc memory */
+	entry = kmalloc(sizeof(struct adreno_profile_assigns_list), GFP_KERNEL);
+	if (!entry)
+		return false;
+
+	list_add_tail(&entry->list, &profile->assignments_list);
+
+	entry->countable = countable;
+	entry->groupid = groupid;
+	entry->offset = offset;
+	entry->offset_hi = offset_hi;
+
+	strscpy(entry->name, str, sizeof(entry->name));
+
+	profile->assignment_count++;
+
+	return true;
+}
+
+static bool results_available(struct adreno_device *adreno_dev,
+		struct adreno_profile *profile, unsigned int *shared_buf_tail)
+{
+	unsigned int global_eop;
+	unsigned int off = profile->shared_tail;
+	unsigned int *shared_ptr;
+	unsigned int ts, cnt;
+	int ts_cmp;
+
+	if (IS_ERR(profile->shared_buffer))
+		return false;
+
+	/*
+	 * If shared_buffer empty or Memstore EOP timestamp is less than
+	 * outstanding counter buffer timestamps then no results available
+	 */
+	if (shared_buf_empty(profile))
+		return false;
+
+	shared_ptr = (unsigned int *)profile->shared_buffer->hostptr;
+	if (adreno_rb_readtimestamp(adreno_dev,
+			adreno_dev->cur_rb,
+			KGSL_TIMESTAMP_RETIRED, &global_eop))
+		return false;
+	do {
+		cnt = *(shared_ptr + off + 1);
+		if (cnt == 0)
+			return false;
+
+		ts = *(shared_ptr + off);
+		ts_cmp = timestamp_cmp(ts, global_eop);
+		if (ts_cmp >= 0) {
+			*shared_buf_tail = off;
+			if (off == profile->shared_tail)
+				return false;
+			else
+				return true;
+		}
+		shared_buf_inc(profile->shared_size, &off,
+				SIZE_SHARED_ENTRY(cnt));
+	} while (off != profile->shared_head);
+
+	*shared_buf_tail = profile->shared_head;
+
+	return true;
+}
+
+static void transfer_results(struct adreno_profile *profile,
+		unsigned int shared_buf_tail)
+{
+	unsigned int buf_off;
+	unsigned int ts, cnt, ctxt_id, pid, tid, client_type;
+	unsigned int *ptr = (unsigned int *) profile->shared_buffer->hostptr;
+	unsigned int *log_ptr, *log_base;
+	struct adreno_profile_assigns_list *assigns_list;
+	int i, tmp_tail;
+
+	log_ptr = profile->log_head;
+	log_base = profile->log_buffer;
+	if (log_ptr == NULL)
+		return;
+
+	/*
+	 * go through counter buffers and format for write into log_buffer
+	 * if log buffer doesn't have space just overwrite it circularly
+	 * shared_buf is guaranteed to not wrap within an entry so can use
+	 * ptr increment
+	 */
+	while (profile->shared_tail != shared_buf_tail) {
+		buf_off = profile->shared_tail;
+		/*
+		 * format: timestamp, count, context_id
+		 * count entries: pc_off, pc_start, pc_end
+		 */
+		ts = *(ptr + buf_off++);
+		cnt = *(ptr + buf_off++);
+		ctxt_id = *(ptr + buf_off++);
+		pid = *(ptr + buf_off++);
+		tid = *(ptr + buf_off++);
+		client_type = *(ptr + buf_off++);
+
+		/*
+		 * if entry overwrites the tail of log_buffer then adjust tail
+		 * ptr to make room for the new entry, discarding old entry
+		 */
+		while (log_buf_available(profile, log_ptr) <=
+				SIZE_LOG_ENTRY(cnt)) {
+			unsigned int size_tail;
+			uintptr_t boff;
+
+			size_tail = SIZE_LOG_ENTRY(0xffff &
+					*(profile->log_tail));
+			boff = ((uintptr_t) profile->log_tail -
+				(uintptr_t) log_base) / sizeof(uintptr_t);
+			log_buf_wrapcnt(size_tail, &boff);
+			profile->log_tail = log_base + boff;
+		}
+
+		*log_ptr = cnt;
+		log_buf_wrapinc(log_base, &log_ptr);
+		*log_ptr = client_type;
+		log_buf_wrapinc(log_base, &log_ptr);
+		*log_ptr = pid;
+		log_buf_wrapinc(log_base, &log_ptr);
+		*log_ptr = tid;
+		log_buf_wrapinc(log_base, &log_ptr);
+		*log_ptr = ctxt_id;
+		log_buf_wrapinc(log_base, &log_ptr);
+		*log_ptr = ts;
+		log_buf_wrapinc(log_base, &log_ptr);
+
+		for (i = 0; i < cnt; i++) {
+			assigns_list = _find_assignment_by_offset(
+					profile, *(ptr + buf_off++));
+			if (assigns_list == NULL) {
+				*log_ptr = (unsigned int) -1;
+
+				shared_buf_inc(profile->shared_size,
+					&profile->shared_tail,
+					SIZE_SHARED_ENTRY(cnt));
+				goto err;
+			} else {
+				*log_ptr = assigns_list->groupid << 16 |
+					(assigns_list->countable & 0xffff);
+			}
+			log_buf_wrapinc(log_base, &log_ptr);
+			*log_ptr  = *(ptr + buf_off++); /* perf cntr start hi */
+			log_buf_wrapinc(log_base, &log_ptr);
+			*log_ptr = *(ptr + buf_off++);  /* perf cntr start lo */
+			log_buf_wrapinc(log_base, &log_ptr);
+			*log_ptr = *(ptr + buf_off++);  /* perf cntr end hi */
+			log_buf_wrapinc(log_base, &log_ptr);
+			*log_ptr = *(ptr + buf_off++);  /* perf cntr end lo */
+			log_buf_wrapinc(log_base, &log_ptr);
+
+		}
+
+		tmp_tail = profile->shared_tail;
+		shared_buf_inc(profile->shared_size,
+				&profile->shared_tail,
+				SIZE_SHARED_ENTRY(cnt));
+		/*
+		 * Possibly lost some room as we cycled around, so it's safe to
+		 * reset the max size
+		 */
+		if (profile->shared_tail < tmp_tail)
+			profile->shared_size =
+				ADRENO_PROFILE_SHARED_BUF_SIZE_DWORDS;
+
+	}
+	profile->log_head = log_ptr;
+	return;
+err:
+	/* reset head/tail to same on error in hopes we work correctly later */
+	profile->log_head = profile->log_tail;
+}
+
+static int profile_enable_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	mutex_lock(&device->mutex);
+	*val = adreno_profile_enabled(&adreno_dev->profile);
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+static int profile_enable_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_profile *profile = &adreno_dev->profile;
+
+	mutex_lock(&device->mutex);
+
+	if (val && profile->log_buffer == NULL) {
+		/* allocate profile_log_buffer the first time enabled */
+		profile->log_buffer = vmalloc(ADRENO_PROFILE_LOG_BUF_SIZE);
+		if (profile->log_buffer == NULL) {
+			mutex_unlock(&device->mutex);
+			return -ENOMEM;
+		}
+		profile->log_tail = profile->log_buffer;
+		profile->log_head = profile->log_buffer;
+	}
+
+	profile->enabled = val;
+
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+static ssize_t profile_assignments_read(struct file *filep,
+		char __user *ubuf, size_t max, loff_t *ppos)
+{
+	struct kgsl_device *device = (struct kgsl_device *) filep->private_data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_profile *profile = &adreno_dev->profile;
+	struct adreno_profile_assigns_list *entry;
+	int len = 0, max_size = PAGE_SIZE;
+	char *buf, *pos;
+	ssize_t size = 0;
+
+	mutex_lock(&device->mutex);
+
+	if (profile->assignment_count == 0) {
+		mutex_unlock(&device->mutex);
+		return 0;
+	}
+
+	buf = kzalloc(max_size, GFP_KERNEL);
+	if (!buf) {
+		mutex_unlock(&device->mutex);
+		return -ENOMEM;
+	}
+
+	pos = buf;
+
+	/* copy all assingments from list to str */
+	list_for_each_entry(entry, &profile->assignments_list, list) {
+		len = scnprintf(pos, max_size, ASSIGNS_STR_FORMAT,
+				entry->name, entry->countable);
+
+		max_size -= len;
+		pos += len;
+	}
+
+	size = simple_read_from_buffer(ubuf, max, ppos, buf,
+			pos - buf);
+
+	kfree(buf);
+
+	mutex_unlock(&device->mutex);
+	return size;
+}
+
+static void _remove_assignment(struct adreno_device *adreno_dev,
+		unsigned int groupid, unsigned int countable)
+{
+	struct adreno_profile *profile = &adreno_dev->profile;
+	struct adreno_profile_assigns_list *entry, *tmp;
+
+	list_for_each_entry_safe(entry, tmp, &profile->assignments_list, list) {
+		if (entry->groupid == groupid &&
+				entry->countable == countable) {
+			list_del(&entry->list);
+
+			profile->assignment_count--;
+
+			kfree(entry);
+
+			/* remove from perf counter allocation */
+			adreno_perfcounter_put(adreno_dev, groupid, countable,
+					PERFCOUNTER_FLAG_KERNEL);
+		}
+	}
+}
+
+static void _add_assignment(struct adreno_device *adreno_dev,
+		unsigned int groupid, unsigned int countable)
+{
+	struct adreno_profile *profile = &adreno_dev->profile;
+	unsigned int offset, offset_hi;
+	const char *name = NULL;
+
+	name = adreno_perfcounter_get_name(adreno_dev, groupid);
+	if (!name)
+		return;
+
+	/* if already in assigned list skip it */
+	if (_in_assignments_list(profile, groupid, countable))
+		return;
+
+	/* add to perf counter allocation, if fail skip it */
+	if (adreno_perfcounter_get(adreno_dev, groupid, countable,
+				&offset, &offset_hi, PERFCOUNTER_FLAG_NONE))
+		return;
+
+	/* add to assignments list, put counter back if error */
+	if (!_add_to_assignments_list(profile, name, groupid,
+				countable, offset, offset_hi))
+		adreno_perfcounter_put(adreno_dev, groupid,
+				countable, PERFCOUNTER_FLAG_KERNEL);
+}
+
+static char *_parse_next_assignment(struct adreno_device *adreno_dev,
+		char *str, int *groupid, int *countable, bool *remove)
+{
+	char *groupid_str, *countable_str, *next_str = NULL;
+	int ret;
+
+	*groupid = -EINVAL;
+	*countable = -EINVAL;
+	*remove = false;
+
+	/* remove spaces */
+	while (*str == ' ')
+		str++;
+
+	/* check if it's a remove assignment */
+	if (*str == '-') {
+		*remove = true;
+		str++;
+	}
+
+	/* get the groupid string */
+	groupid_str = str;
+	while (*str != ':') {
+		if (*str == '\0')
+			return NULL;
+		*str = tolower(*str);
+		str++;
+	}
+	if (groupid_str == str)
+		return NULL;
+
+	*str = '\0';
+	str++;
+
+	/* get the countable string */
+	countable_str = str;
+	while (*str != ' ' && *str != '\0')
+		str++;
+	if (countable_str == str)
+		return NULL;
+
+	/*
+	 * If we have reached the end of the original string then make sure we
+	 * return NULL from this function or we could accidently overrun
+	 */
+
+	if (*str != '\0') {
+		*str = '\0';
+		next_str = str + 1;
+	}
+
+	/* set results */
+	*groupid = adreno_perfcounter_get_groupid(adreno_dev,
+			groupid_str);
+	if (*groupid < 0)
+		return NULL;
+	ret = kstrtou32(countable_str, 10, countable);
+	if (ret)
+		return NULL;
+
+	return next_str;
+}
+
+static ssize_t profile_assignments_write(struct file *filep,
+		const char __user *user_buf, size_t len, loff_t *off)
+{
+	struct kgsl_device *device = (struct kgsl_device *) filep->private_data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_profile *profile = &adreno_dev->profile;
+	size_t size = 0;
+	char *buf, *pbuf;
+	bool remove_assignment = false;
+	int groupid, countable, ret;
+
+	if (len >= PAGE_SIZE || len == 0)
+		return -EINVAL;
+
+	buf = kmalloc(len + 1, GFP_KERNEL);
+	if (buf == NULL)
+		return -ENOMEM;
+
+	if (copy_from_user(buf, user_buf, len)) {
+		size = -EFAULT;
+		goto error_free;
+	}
+
+	mutex_lock(&device->mutex);
+
+	if (adreno_profile_enabled(profile)) {
+		size = -EINVAL;
+		goto error_unlock;
+	}
+
+	ret = adreno_perfcntr_active_oob_get(adreno_dev);
+	if (ret) {
+		size = ret;
+		goto error_unlock;
+	}
+
+	/*
+	 * When adding/removing assignments, ensure that the GPU is done with
+	 * all it's work.  This helps to synchronize the work flow to the
+	 * GPU and avoid racey conditions.
+	 */
+	ret = adreno_idle(device);
+	if (ret) {
+		size = -ETIMEDOUT;
+		goto error_put;
+	}
+
+	/* clear all shared buffer results */
+	adreno_profile_process_results(adreno_dev);
+
+	pbuf = buf;
+
+	/* clear the log buffer */
+	if (profile->log_buffer != NULL) {
+		profile->log_head = profile->log_buffer;
+		profile->log_tail = profile->log_buffer;
+	}
+
+
+	/* for sanity and parsing, ensure it is null terminated */
+	buf[len] = '\0';
+
+	/* parse file buf and add(remove) to(from) appropriate lists */
+	while (pbuf) {
+		pbuf = _parse_next_assignment(adreno_dev, pbuf, &groupid,
+				&countable, &remove_assignment);
+		if (groupid < 0 || countable < 0)
+			break;
+
+		if (remove_assignment)
+			_remove_assignment(adreno_dev, groupid, countable);
+		else
+			_add_assignment(adreno_dev, groupid, countable);
+	}
+
+	size = len;
+
+error_put:
+	adreno_perfcntr_active_oob_put(adreno_dev);
+error_unlock:
+	mutex_unlock(&device->mutex);
+error_free:
+	kfree(buf);
+	return size;
+}
+
+static int _pipe_print_pending(char __user *ubuf, size_t max)
+{
+	loff_t unused = 0;
+	char str[] = "Operation Would Block!";
+
+	return simple_read_from_buffer(ubuf, max,
+			&unused, str, strlen(str));
+}
+
+static int _pipe_print_results(struct adreno_device *adreno_dev,
+		char __user *ubuf, size_t max)
+{
+	struct adreno_profile *profile = &adreno_dev->profile;
+	const char *grp_name;
+	char __user *usr_buf = ubuf;
+	unsigned int *log_ptr = NULL, *tmp_log_ptr = NULL;
+	int len, i;
+	int status = 0;
+	ssize_t size, total_size = 0;
+	unsigned int cnt, api_type, ctxt_id, pid, tid, ts, cnt_reg;
+	unsigned long long pc_start, pc_end;
+	const char *api_str;
+	char format_space;
+	loff_t unused = 0;
+	char pipe_hdr_buf[51];   /* 4 uint32 + 5 space + 5 API type + '\0' */
+	char pipe_cntr_buf[63];  /* 2 uint64 + 1 uint32 + 4 spaces + 8 group */
+
+	/* convert unread entries to ASCII, copy to user-space */
+	log_ptr = profile->log_tail;
+
+	do {
+		/* store the tmp var for error cases so we can skip */
+		tmp_log_ptr = log_ptr;
+
+		/* Too many to output to pipe, so skip this data */
+		cnt = *log_ptr;
+		log_buf_wrapinc(profile->log_buffer, &log_ptr);
+
+		if (SIZE_PIPE_ENTRY(cnt) > max) {
+			log_buf_wrapinc_len(profile->log_buffer,
+				&tmp_log_ptr, SIZE_PIPE_ENTRY(cnt));
+			log_ptr = tmp_log_ptr;
+			goto done;
+		}
+
+		/*
+		 * Not enough space left in pipe, return without doing
+		 * anything
+		 */
+		if ((max - (usr_buf - ubuf)) < SIZE_PIPE_ENTRY(cnt)) {
+			log_ptr = tmp_log_ptr;
+			goto done;
+		}
+
+		api_type = *log_ptr;
+		api_str = kgsl_context_type(api_type);
+		log_buf_wrapinc(profile->log_buffer, &log_ptr);
+		pid = *log_ptr;
+		log_buf_wrapinc(profile->log_buffer, &log_ptr);
+		tid = *log_ptr;
+		log_buf_wrapinc(profile->log_buffer, &log_ptr);
+		ctxt_id =  *log_ptr;
+		log_buf_wrapinc(profile->log_buffer, &log_ptr);
+		ts = *log_ptr;
+		log_buf_wrapinc(profile->log_buffer, &log_ptr);
+		len = scnprintf(pipe_hdr_buf, sizeof(pipe_hdr_buf) - 1,
+				"%u %u %u %.5s %u ",
+				pid, tid, ctxt_id, api_str, ts);
+		size = simple_read_from_buffer(usr_buf,
+				max - (usr_buf - ubuf),
+				&unused, pipe_hdr_buf, len);
+
+		/* non-fatal error, so skip rest of entry and return */
+		if (size < 0) {
+			log_buf_wrapinc_len(profile->log_buffer,
+				&tmp_log_ptr, SIZE_PIPE_ENTRY(cnt));
+			log_ptr = tmp_log_ptr;
+			goto done;
+		}
+
+		unused = 0;
+		usr_buf += size;
+		total_size += size;
+
+		for (i = 0; i < cnt; i++) {
+			unsigned int start_lo, start_hi;
+			unsigned int end_lo, end_hi;
+
+			grp_name = adreno_perfcounter_get_name(
+					adreno_dev, (*log_ptr >> 16) & 0xffff);
+
+			/* non-fatal error, so skip rest of entry and return */
+			if (grp_name == NULL) {
+				log_buf_wrapinc_len(profile->log_buffer,
+					&tmp_log_ptr, SIZE_PIPE_ENTRY(cnt));
+				log_ptr = tmp_log_ptr;
+				goto done;
+			}
+
+			if (i == cnt - 1)
+				format_space = '\n';
+			else
+				format_space = ' ';
+
+			cnt_reg = *log_ptr & 0xffff;
+			log_buf_wrapinc(profile->log_buffer, &log_ptr);
+			start_lo = *log_ptr;
+			log_buf_wrapinc(profile->log_buffer, &log_ptr);
+			start_hi = *log_ptr;
+			log_buf_wrapinc(profile->log_buffer, &log_ptr);
+			end_lo = *log_ptr;
+			log_buf_wrapinc(profile->log_buffer, &log_ptr);
+			end_hi = *log_ptr;
+			log_buf_wrapinc(profile->log_buffer, &log_ptr);
+
+			pc_start = (((uint64_t) start_hi) << 32) | start_lo;
+			pc_end = (((uint64_t) end_hi) << 32) | end_lo;
+
+			len = scnprintf(pipe_cntr_buf,
+					sizeof(pipe_cntr_buf) - 1,
+					"%.8s:%u %llu %llu%c",
+					grp_name, cnt_reg, pc_start,
+					pc_end, format_space);
+
+			size = simple_read_from_buffer(usr_buf,
+					max - (usr_buf - ubuf),
+					&unused, pipe_cntr_buf, len);
+
+			/* non-fatal error, so skip rest of entry and return */
+			if (size < 0) {
+				log_buf_wrapinc_len(profile->log_buffer,
+					&tmp_log_ptr, SIZE_PIPE_ENTRY(cnt));
+				log_ptr = tmp_log_ptr;
+				goto done;
+			}
+			unused = 0;
+			usr_buf += size;
+			total_size += size;
+		}
+	} while (log_ptr != profile->log_head);
+
+done:
+	status = total_size;
+	profile->log_tail = log_ptr;
+
+	return status;
+}
+
+static ssize_t profile_pipe_print(struct file *filep, char __user *ubuf,
+		size_t max, loff_t *ppos)
+{
+	struct kgsl_device *device = (struct kgsl_device *) filep->private_data;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct adreno_profile *profile = &adreno_dev->profile;
+	char __user *usr_buf = ubuf;
+	int status = 0;
+
+	/*
+	 * this file not seekable since it only supports streaming, ignore
+	 * ppos <> 0
+	 */
+	/*
+	 * format <pid>  <tid> <context id> <cnt<<16 | client type> <timestamp>
+	 * for each perf counter <cntr_reg_off> <start hi & lo> <end hi & low>
+	 */
+
+	mutex_lock(&device->mutex);
+
+	while (1) {
+		/* process any results that are available into the log_buffer */
+		status = adreno_profile_process_results(adreno_dev);
+		if (status > 0) {
+			/* if we have results, print them and exit */
+			status = _pipe_print_results(adreno_dev, usr_buf, max);
+			break;
+		}
+
+		/* there are no unread results, act accordingly */
+		if (filep->f_flags & O_NONBLOCK) {
+			if (profile->shared_tail != profile->shared_head) {
+				status = _pipe_print_pending(usr_buf, max);
+				break;
+			}
+
+			status = 0;
+			break;
+		}
+
+		mutex_unlock(&device->mutex);
+		set_current_state(TASK_INTERRUPTIBLE);
+		schedule_timeout(msecs_to_jiffies(100));
+		mutex_lock(&device->mutex);
+
+		if (signal_pending(current)) {
+			status = 0;
+			break;
+		}
+	}
+
+	mutex_unlock(&device->mutex);
+
+	return status;
+}
+
+static int profile_groups_show(struct seq_file *s, void *unused)
+{
+	struct kgsl_device *device = (struct kgsl_device *) s->private;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_perfcounters *counters =
+		ADRENO_PERFCOUNTERS(adreno_dev);
+	const struct adreno_perfcount_group *group;
+	int i, j, used;
+
+	mutex_lock(&device->mutex);
+
+	for (i = 0; i < counters->group_count; ++i) {
+		group = &(counters->groups[i]);
+		/* get number of counters used for this group */
+		used = 0;
+		for (j = 0; j < group->reg_count; j++) {
+			if (group->regs[j].countable !=
+					KGSL_PERFCOUNTER_NOT_USED)
+				used++;
+		}
+
+		seq_printf(s, "%s %d %d\n", group->name,
+			group->reg_count, used);
+	}
+
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+DEFINE_SHOW_ATTRIBUTE(profile_groups);
+
+static const struct file_operations profile_pipe_fops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.read = profile_pipe_print,
+	.llseek = noop_llseek,
+};
+
+static const struct file_operations profile_assignments_fops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.read = profile_assignments_read,
+	.write = profile_assignments_write,
+	.llseek = noop_llseek,
+};
+
+DEFINE_DEBUGFS_ATTRIBUTE(profile_enable_fops,
+			profile_enable_get,
+			profile_enable_set, "%llu\n");
+
+void adreno_profile_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct adreno_profile *profile = &adreno_dev->profile;
+	struct dentry *profile_dir;
+
+	profile->enabled = false;
+
+	if (adreno_dev->hwsched_enabled)
+		return;
+
+	/* allocate shared_buffer, which includes pre_ib and post_ib */
+	profile->shared_size = ADRENO_PROFILE_SHARED_BUF_SIZE_DWORDS;
+	profile->shared_buffer =  kgsl_allocate_global(device,
+			profile->shared_size * sizeof(unsigned int),
+			0, 0, 0, "profile");
+	if (IS_ERR(profile->shared_buffer)) {
+		profile->shared_size = 0;
+		return;
+	}
+
+	INIT_LIST_HEAD(&profile->assignments_list);
+
+	/* Create perf counter debugfs */
+	profile_dir = debugfs_create_dir("profiling", device->d_debugfs);
+	if (IS_ERR(profile_dir))
+		return;
+
+	debugfs_create_file("enable",  0644, profile_dir, device,
+			&profile_enable_fops);
+	debugfs_create_file("blocks", 0444, profile_dir, device,
+			&profile_groups_fops);
+	debugfs_create_file("pipe", 0444, profile_dir, device,
+			&profile_pipe_fops);
+	debugfs_create_file("assignments", 0644, profile_dir, device,
+			&profile_assignments_fops);
+}
+
+void adreno_profile_close(struct adreno_device *adreno_dev)
+{
+	struct adreno_profile *profile = &adreno_dev->profile;
+	struct adreno_profile_assigns_list *entry, *tmp;
+
+	if (adreno_dev->hwsched_enabled)
+		return;
+
+	profile->enabled = false;
+	vfree(profile->log_buffer);
+	profile->log_buffer = NULL;
+	profile->log_head = NULL;
+	profile->log_tail = NULL;
+	profile->shared_head = 0;
+	profile->shared_tail = 0;
+	profile->shared_size = 0;
+
+	profile->assignment_count = 0;
+
+	/* Return if list is not initialized */
+	if (!profile->assignments_list.next)
+		return;
+
+	list_for_each_entry_safe(entry, tmp, &profile->assignments_list, list) {
+		list_del(&entry->list);
+		kfree(entry);
+	}
+}
+
+int adreno_profile_process_results(struct adreno_device *adreno_dev)
+{
+	struct adreno_profile *profile = &adreno_dev->profile;
+	unsigned int shared_buf_tail = profile->shared_tail;
+
+	if (adreno_dev->hwsched_enabled)
+		return 0;
+
+	if (!results_available(adreno_dev, profile, &shared_buf_tail))
+		return 0;
+
+	/*
+	 * transfer retired results to log_buffer
+	 * update shared_buffer tail ptr
+	 */
+	transfer_results(profile, shared_buf_tail);
+
+	return 1;
+}
+
+u64 adreno_profile_preib_processing(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt, u32 *dwords)
+{
+	struct adreno_profile *profile = &adreno_dev->profile;
+	int count = profile->assignment_count;
+	unsigned int entry_head = profile->shared_head;
+	unsigned int *shared_ptr;
+	struct adreno_ringbuffer *rb = ADRENO_CURRENT_RINGBUFFER(adreno_dev);
+
+	if (adreno_dev->hwsched_enabled)
+		return 0;
+
+	if (!drawctxt || !adreno_profile_assignments_ready(profile))
+		return 0;
+
+	/*
+	 * check if space available, include the post_ib in space available
+	 * check so don't have to handle trying to undo the pre_ib insertion in
+	 * ringbuffer in the case where only the post_ib fails enough space
+	 */
+	if (SIZE_SHARED_ENTRY(count) >= shared_buf_available(profile))
+		return 0;
+
+	if (entry_head + SIZE_SHARED_ENTRY(count) >= profile->shared_size) {
+		/* entry_head would wrap, start entry_head at 0 in buffer */
+		entry_head = 0;
+		profile->shared_size = profile->shared_head;
+		profile->shared_head = 0;
+
+		/* recheck space available */
+		if (SIZE_SHARED_ENTRY(count) >= shared_buf_available(profile))
+			return 0;
+	}
+
+	/* zero out the counter area of shared_buffer entry_head */
+	shared_ptr = entry_head + ((unsigned int *)
+			profile->shared_buffer->hostptr);
+	memset(shared_ptr, 0, SIZE_SHARED_ENTRY(count) * sizeof(unsigned int));
+
+	/* reserve space for the pre ib shared buffer */
+	shared_buf_inc(profile->shared_size, &profile->shared_head,
+			SIZE_SHARED_ENTRY(count));
+
+	/* create the shared ibdesc */
+	return _build_pre_ib_cmds(adreno_dev, profile, entry_head,
+			rb->timestamp + 1, drawctxt, dwords);
+}
+
+u64 adreno_profile_postib_processing(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt, u32 *dwords)
+{
+	struct adreno_profile *profile = &adreno_dev->profile;
+	int count = profile->assignment_count;
+	unsigned int entry_head = profile->shared_head -
+		SIZE_SHARED_ENTRY(count);
+
+	if (adreno_dev->hwsched_enabled)
+		return 0;
+
+	if (!drawctxt || !adreno_profile_assignments_ready(profile))
+		return 0;
+
+	/* create the shared ibdesc */
+	return _build_post_ib_cmds(adreno_dev, profile, entry_head, dwords);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_profile.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_profile.h
@@ -0,0 +1,107 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2013-2014,2019-2021 The Linux Foundation. All rights reserved.
+ */
+#ifndef __ADRENO_PROFILE_H
+#define __ADRENO_PROFILE_H
+
+/**
+ * struct adreno_profile_assigns_list: linked list for assigned perf counters
+ * @list: linkage  for nodes in list
+ * @name: group name  or GPU name name
+ * @groupid: group id
+ * @countable: countable assigned to perfcounter
+ * @offset: perfcounter register address offset
+ */
+struct adreno_profile_assigns_list {
+	struct list_head list;
+	char name[25];
+	unsigned int groupid;
+	unsigned int countable;
+	unsigned int offset;    /* LO offset */
+	unsigned int offset_hi; /* HI offset */
+};
+
+struct adreno_profile {
+	struct list_head assignments_list; /* list of all assignments */
+	unsigned int assignment_count;  /* Number of assigned counters */
+	unsigned int *log_buffer;
+	unsigned int *log_head;
+	unsigned int *log_tail;
+	bool enabled;
+	/* counter, pre_ib, and post_ib held in one large circular buffer
+	 * shared between kgsl and GPU
+	 * counter entry 0
+	 * pre_ib entry 0
+	 * post_ib entry 0
+	 * ...
+	 * counter entry N
+	 * pre_ib entry N
+	 * post_ib entry N
+	 */
+	struct kgsl_memdesc *shared_buffer;
+	unsigned int shared_head;
+	unsigned int shared_tail;
+	unsigned int shared_size;
+};
+
+#define ADRENO_PROFILE_SHARED_BUF_SIZE_DWORDS (48 * 4096 / sizeof(uint))
+/* sized @ 48 pages should allow for over 50 outstanding IBs minimum, 1755 max*/
+
+#define ADRENO_PROFILE_LOG_BUF_SIZE  (1024 * 920)
+/* sized for 1024 entries of fully assigned 45 cnters in log buffer, 230 pages*/
+#define ADRENO_PROFILE_LOG_BUF_SIZE_DWORDS  (ADRENO_PROFILE_LOG_BUF_SIZE / \
+						sizeof(unsigned int))
+
+#ifdef CONFIG_DEBUG_FS
+void adreno_profile_init(struct adreno_device *adreno_dev);
+void adreno_profile_close(struct adreno_device *adreno_dev);
+int adreno_profile_process_results(struct  adreno_device *adreno_dev);
+u64 adreno_profile_preib_processing(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt, u32 *dwords);
+u64 adreno_profile_postib_processing(struct  adreno_device *adreno_dev,
+		struct adreno_context *drawctxt, u32 *dwords);
+#else
+static inline void adreno_profile_init(struct adreno_device *adreno_dev) { }
+static inline void adreno_profile_close(struct adreno_device *adreno_dev) { }
+static inline int adreno_profile_process_results(
+		struct adreno_device *adreno_dev)
+{
+	return 0;
+}
+
+static inline u64
+adreno_profile_preib_processing(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt, u32 *dwords)
+{
+	return 0;
+}
+
+static inline u64
+adreno_profile_postib_processing(struct adreno_device *adreno_dev,
+		struct adreno_context *drawctxt, u32 *dwords)
+{
+	return 0;
+}
+
+#endif
+
+static inline bool adreno_profile_enabled(struct adreno_profile *profile)
+{
+	return profile->enabled;
+}
+
+static inline bool adreno_profile_has_assignments(
+	struct adreno_profile *profile)
+{
+	return list_empty(&profile->assignments_list) ? false : true;
+}
+
+static inline bool adreno_profile_assignments_ready(
+	struct adreno_profile *profile)
+{
+	return adreno_profile_enabled(profile) &&
+		adreno_profile_has_assignments(profile);
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_ringbuffer.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_ringbuffer.c
@@ -0,0 +1,426 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/interconnect.h>
+#include <linux/sched/clock.h>
+#include <linux/slab.h>
+#include <soc/qcom/dcvs.h>
+
+#include "a3xx_reg.h"
+#include "a5xx_reg.h"
+#include "a6xx_reg.h"
+#include "adreno.h"
+#include "adreno_pm4types.h"
+#include "adreno_ringbuffer.h"
+#include "adreno_trace.h"
+#include "kgsl_trace.h"
+
+
+#define RB_HOSTPTR(_rb, _pos) \
+	((unsigned int *) ((_rb)->buffer_desc->hostptr + \
+		((_pos) * sizeof(unsigned int))))
+
+#define RB_GPUADDR(_rb, _pos) \
+	((_rb)->buffer_desc->gpuaddr + ((_pos) * sizeof(unsigned int)))
+
+void adreno_get_submit_time(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_submit_time *time)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	unsigned long flags;
+	struct adreno_context *drawctxt = rb->drawctxt_active;
+	struct kgsl_context *context = &drawctxt->base;
+
+	if (!time)
+		return;
+
+	/*
+	 * Here we are attempting to create a mapping between the
+	 * GPU time domain (alwayson counter) and the CPU time domain
+	 * (local_clock) by sampling both values as close together as
+	 * possible. This is useful for many types of debugging and
+	 * profiling. In order to make this mapping as accurate as
+	 * possible, we must turn off interrupts to avoid running
+	 * interrupt handlers between the two samples.
+	 */
+
+	local_irq_save(flags);
+
+	time->ticks = gpudev->read_alwayson(adreno_dev);
+
+	/* Trace the GPU time to create a mapping to ftrace time */
+	trace_adreno_cmdbatch_sync(context->id, context->priority,
+		drawctxt->timestamp, time->ticks);
+
+	/* Get the kernel clock for time since boot */
+	time->ktime = local_clock();
+
+	/* Get the timeofday for the wall time (for the user) */
+	ktime_get_real_ts64(&time->utime);
+
+	local_irq_restore(flags);
+}
+
+unsigned int *adreno_ringbuffer_allocspace(struct adreno_ringbuffer *rb,
+		unsigned int dwords)
+{
+	struct adreno_device *adreno_dev = ADRENO_RB_DEVICE(rb);
+	unsigned int rptr = adreno_get_rptr(rb);
+	unsigned int ret;
+
+	if (rptr <= rb->_wptr) {
+		unsigned int *cmds;
+
+		if (rb->_wptr + dwords <= (KGSL_RB_DWORDS - 2)) {
+			ret = rb->_wptr;
+			rb->_wptr = (rb->_wptr + dwords) % KGSL_RB_DWORDS;
+			return RB_HOSTPTR(rb, ret);
+		}
+
+		/*
+		 * There isn't enough space toward the end of ringbuffer. So
+		 * look for space from the beginning of ringbuffer upto the
+		 * read pointer.
+		 */
+		if (dwords < rptr) {
+			cmds = RB_HOSTPTR(rb, rb->_wptr);
+			*cmds = cp_packet(adreno_dev, CP_NOP,
+				KGSL_RB_DWORDS - rb->_wptr - 1);
+			rb->_wptr = dwords;
+			return RB_HOSTPTR(rb, 0);
+		}
+	}
+
+	if (rb->_wptr + dwords < rptr) {
+		ret = rb->_wptr;
+		rb->_wptr = (rb->_wptr + dwords) % KGSL_RB_DWORDS;
+		return RB_HOSTPTR(rb, ret);
+	}
+
+	return ERR_PTR(-ENOSPC);
+}
+
+void adreno_ringbuffer_stop(struct adreno_device *adreno_dev)
+{
+	struct adreno_ringbuffer *rb;
+	int i;
+
+	FOR_EACH_RINGBUFFER(adreno_dev, rb, i)
+		kgsl_cancel_events(KGSL_DEVICE(adreno_dev), &(rb->events));
+}
+
+static int _rb_readtimestamp(struct kgsl_device *device,
+		void *priv, enum kgsl_timestamp_type type,
+		unsigned int *timestamp)
+{
+	return adreno_rb_readtimestamp(ADRENO_DEVICE(device), priv, type,
+		timestamp);
+}
+
+int adreno_ringbuffer_setup(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, int id)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	unsigned int priv = 0;
+	int ret;
+
+	/* allocate a chunk of memory to create user profiling IB1s */
+	adreno_allocate_global(device, &rb->profile_desc, PAGE_SIZE,
+		0, KGSL_MEMFLAGS_GPUREADONLY, 0, "profile_desc");
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_APRIV))
+		priv |= KGSL_MEMDESC_PRIVILEGED;
+
+	ret = adreno_allocate_global(device, &rb->buffer_desc, KGSL_RB_SIZE,
+		SZ_4K, KGSL_MEMFLAGS_GPUREADONLY, priv, "ringbuffer");
+	if (ret)
+		return ret;
+
+	if (!list_empty(&rb->events.group))
+		return 0;
+
+	rb->id = id;
+	kgsl_add_event_group(device, &rb->events, NULL, _rb_readtimestamp, rb,
+		"rb_events-%d", id);
+
+	rb->timestamp = 0;
+	init_waitqueue_head(&rb->ts_expire_waitq);
+
+	spin_lock_init(&rb->preempt_lock);
+
+	return 0;
+}
+
+void adreno_preemption_timer(struct timer_list *t)
+{
+	struct adreno_preemption *preempt = from_timer(preempt, t, timer);
+	struct adreno_device *adreno_dev = container_of(preempt,
+						struct adreno_device, preempt);
+
+	/* We should only be here from a triggered state */
+	if (!adreno_move_preempt_state(adreno_dev,
+		ADRENO_PREEMPT_TRIGGERED, ADRENO_PREEMPT_FAULTED))
+		return;
+
+	/* Schedule the worker to take care of the details */
+	queue_work(system_unbound_wq, &adreno_dev->preempt.work);
+}
+
+void adreno_drawobj_set_constraint(struct kgsl_device *device,
+			struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_context *context = drawobj->context;
+	unsigned long flags = drawobj->flags;
+
+	/*
+	 * Check if the context has a constraint and constraint flags are
+	 * set.
+	 */
+	if (context->pwr_constraint.type &&
+		((context->flags & KGSL_CONTEXT_PWR_CONSTRAINT) ||
+			(drawobj->flags & KGSL_CONTEXT_PWR_CONSTRAINT)))
+		kgsl_pwrctrl_set_constraint(device, &context->pwr_constraint,
+					context->id, drawobj->timestamp);
+
+	if (context->l3_pwr_constraint.type &&
+		((context->flags & KGSL_CONTEXT_PWR_CONSTRAINT) ||
+			(flags & KGSL_CONTEXT_PWR_CONSTRAINT))) {
+
+		if (!device->num_l3_pwrlevels) {
+			dev_err_once(device->dev,
+				"l3 voting not available\n");
+			return;
+		}
+
+		switch (context->l3_pwr_constraint.type) {
+		case KGSL_CONSTRAINT_L3_PWRLEVEL: {
+			unsigned int sub_type;
+			unsigned int new_l3;
+			int ret = 0;
+			struct dcvs_freq freq = {0};
+
+			if (!device->l3_vote)
+				return;
+
+			sub_type = context->l3_pwr_constraint.sub_type;
+
+			/*
+			 * If an L3 constraint is already set, set the new
+			 * one only if it is higher.
+			 */
+			new_l3 = max_t(unsigned int, sub_type + 1,
+					device->cur_l3_pwrlevel);
+			new_l3 = min_t(unsigned int, new_l3,
+					device->num_l3_pwrlevels - 1);
+
+			if (device->cur_l3_pwrlevel == new_l3)
+				return;
+
+			freq.ib = device->l3_freq[new_l3];
+			freq.hw_type = DCVS_L3;
+			ret = qcom_dcvs_update_votes(KGSL_L3_DEVICE, &freq, 1,
+				DCVS_SLOW_PATH);
+			if (!ret) {
+				trace_kgsl_constraint(device,
+					KGSL_CONSTRAINT_L3_PWRLEVEL, new_l3, 1);
+				device->cur_l3_pwrlevel = new_l3;
+			} else {
+				dev_err_ratelimited(device->dev,
+						       "Could not set l3_vote: %d\n",
+						       ret);
+			}
+			break;
+			}
+		}
+	}
+}
+
+int adreno_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj,
+		struct adreno_submit_time *time)
+{
+	struct adreno_submit_time local = { 0 };
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	struct adreno_context *drawctxt = ADRENO_CONTEXT(drawobj->context);
+	struct adreno_ringbuffer *rb = drawctxt->rb;
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	u32 flags = 0;
+	int ret;
+
+	/*
+	 * If SKIP CMD flag is set for current context
+	 * a) set SKIPCMD as fault_recovery for current commandbatch
+	 * b) store context's commandbatch fault_policy in current
+	 *    commandbatch fault_policy and clear context's commandbatch
+	 *    fault_policy
+	 * c) force preamble for commandbatch
+	 */
+	if (test_bit(ADRENO_CONTEXT_SKIP_CMD, &drawctxt->base.priv) &&
+		(!test_bit(CMDOBJ_SKIP, &cmdobj->priv))) {
+
+		set_bit(KGSL_FT_SKIPCMD, &cmdobj->fault_recovery);
+		cmdobj->fault_policy = drawctxt->fault_policy;
+		set_bit(CMDOBJ_FORCE_PREAMBLE, &cmdobj->priv);
+
+		/* if context is detached print fault recovery */
+		adreno_fault_skipcmd_detached(adreno_dev, drawctxt, drawobj);
+
+		/* clear the drawctxt flags */
+		clear_bit(ADRENO_CONTEXT_SKIP_CMD, &drawctxt->base.priv);
+		drawctxt->fault_policy = 0;
+	}
+
+	/* Check if user profiling should be enabled */
+
+	if ((drawobj->flags & KGSL_DRAWOBJ_PROFILING) &&
+		cmdobj->profiling_buf_entry) {
+		flags |= F_USER_PROFILE;
+
+		/*
+		 * we want to use an adreno_submit_time struct to get the
+		 * precise moment when the command is submitted to the
+		 * ringbuffer.  If an upstream caller already passed down a
+		 * pointer piggyback on that otherwise use a local struct
+		 */
+		if (!time)
+			time = &local;
+
+		time->drawobj = drawobj;
+	}
+
+	flags |= F_PREAMBLE;
+
+	/*
+	 * When preamble is enabled, the preamble buffer with state restoration
+	 * commands are stored in the first node of the IB chain.
+	 * We can skip that if a context switch hasn't occurred.
+	 */
+	if ((drawctxt->base.flags & KGSL_CONTEXT_PREAMBLE) &&
+		!test_bit(CMDOBJ_FORCE_PREAMBLE, &cmdobj->priv) &&
+		(rb->drawctxt_active == drawctxt))
+		flags &= ~F_PREAMBLE;
+
+	/*
+	 * In skip mode don't issue the draw IBs but keep all the other
+	 * accoutrements of a submision (including the interrupt) to keep
+	 * the accounting sane. Set start_index and numibs to 0 to just
+	 * generate the start and end markers and skip everything else
+	 */
+	if (test_bit(CMDOBJ_SKIP, &cmdobj->priv)) {
+		flags &= ~F_PREAMBLE;
+		flags |= F_SKIP;
+	}
+
+	/* Enable kernel profiling */
+	if (test_bit(CMDOBJ_PROFILE, &cmdobj->priv))
+		flags |= F_KERNEL_PROFILE;
+
+	/* Add a WFI to the end of the submission */
+	if (test_bit(CMDOBJ_WFI, &cmdobj->priv))
+		flags |= F_WFI;
+
+	/*
+	 * For some targets, we need to execute a dummy shader operation after a
+	 * power collapse
+	 */
+	if (test_and_clear_bit(ADRENO_DEVICE_PWRON, &adreno_dev->priv) &&
+		test_bit(ADRENO_DEVICE_PWRON_FIXUP, &adreno_dev->priv))
+		flags |= F_PWRON_FIXUP;
+
+	/* Check to see the submission should be secure */
+	if (drawobj->context->flags & KGSL_CONTEXT_SECURE)
+		flags |= F_SECURE;
+
+	/* process any profiling results that are available into the log_buf */
+	adreno_profile_process_results(adreno_dev);
+
+	ret = gpudev->ringbuffer_submitcmd(adreno_dev, cmdobj,
+		flags, time);
+
+	if (!ret) {
+		set_bit(KGSL_CONTEXT_PRIV_SUBMITTED, &drawobj->context->priv);
+		cmdobj->global_ts = drawctxt->internal_timestamp;
+	}
+
+	return ret;
+}
+
+/**
+ * adreno_ringbuffer_wait_callback() - Callback function for event registered
+ * on a ringbuffer timestamp
+ * @device: Device for which the the callback is valid
+ * @context: The context of the event
+ * @priv: The private parameter of the event
+ * @result: Result of the event trigger
+ */
+static void adreno_ringbuffer_wait_callback(struct kgsl_device *device,
+		struct kgsl_event_group *group,
+		void *priv, int result)
+{
+	struct adreno_ringbuffer *rb = group->priv;
+
+	wake_up_all(&rb->ts_expire_waitq);
+}
+
+/* check if timestamp is greater than the current rb timestamp */
+static inline int adreno_ringbuffer_check_timestamp(
+			struct adreno_ringbuffer *rb,
+			unsigned int timestamp, int type)
+{
+	struct adreno_device *adreno_dev = ADRENO_RB_DEVICE(rb);
+	unsigned int ts;
+
+	adreno_rb_readtimestamp(adreno_dev, rb, type, &ts);
+	return (timestamp_cmp(ts, timestamp) >= 0);
+}
+
+
+/**
+ * adreno_ringbuffer_waittimestamp() - Wait for a RB timestamp
+ * @rb: The ringbuffer to wait on
+ * @timestamp: The timestamp to wait for
+ * @msecs: The wait timeout period
+ */
+int adreno_ringbuffer_waittimestamp(struct adreno_ringbuffer *rb,
+					unsigned int timestamp,
+					unsigned int msecs)
+{
+	struct adreno_device *adreno_dev = ADRENO_RB_DEVICE(rb);
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+	unsigned long wait_time;
+
+	/* check immediately if timeout is 0 */
+	if (msecs == 0)
+		return adreno_ringbuffer_check_timestamp(rb,
+			timestamp, KGSL_TIMESTAMP_RETIRED) ? 0 : -EBUSY;
+
+	ret = kgsl_add_event(device, &rb->events, timestamp,
+		adreno_ringbuffer_wait_callback, NULL);
+	if (ret)
+		return ret;
+
+	mutex_unlock(&device->mutex);
+
+	wait_time = msecs_to_jiffies(msecs);
+	if (wait_event_timeout(rb->ts_expire_waitq,
+		!kgsl_event_pending(device, &rb->events, timestamp,
+				adreno_ringbuffer_wait_callback, NULL),
+		wait_time) == 0)
+		ret  = -ETIMEDOUT;
+
+	mutex_lock(&device->mutex);
+	/*
+	 * after wake up make sure that expected timestamp has retired
+	 * because the wakeup could have happened due to a cancel event
+	 */
+	if (!ret && !adreno_ringbuffer_check_timestamp(rb,
+		timestamp, KGSL_TIMESTAMP_RETIRED)) {
+		ret = -EAGAIN;
+	}
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_ringbuffer.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_ringbuffer.h
@@ -0,0 +1,202 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_RINGBUFFER_H
+#define __ADRENO_RINGBUFFER_H
+
+/* Given a ringbuffer, return the adreno device that owns it */
+
+#define _RB_OFFSET(_id) (offsetof(struct adreno_device, ringbuffers) + \
+		((_id) * sizeof(struct adreno_ringbuffer)))
+
+#define ADRENO_RB_DEVICE(_rb) \
+	((struct adreno_device *) (((void *) (_rb)) - _RB_OFFSET((_rb)->id)))
+
+/* Adreno ringbuffer size in bytes */
+#define KGSL_RB_SIZE (32 * 1024)
+
+/*
+ * A handy macro to convert the RB size to dwords since most ringbuffer
+ * operations happen in dword increments
+ */
+#define KGSL_RB_DWORDS (KGSL_RB_SIZE >> 2)
+
+/* Specifies that the command should be run in protected mode */
+#define F_NOTPROTECTED		BIT(0)
+/* Indicates that the CP should wait for idle after executing the command */
+#define F_WFI			BIT(1)
+/* Indicates that the poweron fixup should be executed before the command */
+#define F_PWRON_FIXUP		BIT(2)
+/* Indicates that the submission should be secure */
+#define F_SECURE		BIT(3)
+/* Indicates that the IBs in the submission should be skipped */
+#define F_SKIP			BIT(4)
+/* Indicates that user always on timer profiling is enabled */
+#define F_USER_PROFILE		BIT(5)
+/* Indicates that kernel always on timer profiling is enabled */
+#define F_KERNEL_PROFILE	BIT(6)
+/* Indicates that the submission has a preamble */
+#define F_PREAMBLE		BIT(7)
+
+#define IS_NOTPROTECTED(flags) ((flags) & F_NOTPROTECTED)
+#define IS_WFI(flags) ((flags) & F_WFI)
+#define IS_PWRON_FIXUP(flags) ((flags) & F_PWRON_FIXUP)
+#define IS_SECURE(flags) ((flags) & F_SECURE)
+#define IS_SKIP(flags) ((flags) & F_SKIP)
+#define IS_USER_PROFILE(flags) ((flags) & F_USER_PROFILE)
+#define IS_KERNEL_PROFILE(flags) ((flags) & F_KERNEL_PROFILE)
+#define IS_PREAMBLE(flags) ((flags) & F_PREAMBLE)
+
+struct kgsl_device;
+struct kgsl_device_private;
+
+/**
+ * struct adreno_submit_time - utility structure to store the wall clock / GPU
+ * ticks at command submit time
+ * @ticks: GPU ticks at submit time (from the 19.2Mhz timer)
+ * @ktime: local clock time (in nanoseconds)
+ * @utime: Wall clock time
+ * @drawobj: the object that we want to profile
+ */
+struct adreno_submit_time {
+	uint64_t ticks;
+	u64 ktime;
+	struct timespec64 utime;
+	struct kgsl_drawobj *drawobj;
+};
+
+/**
+ * This is to keep track whether the SET_PSEUDO_REGISTER packet needs to be submitted
+ * or not
+ */
+#define ADRENO_RB_SET_PSEUDO_DONE 0
+
+/**
+ * struct adreno_ringbuffer - Definition for an adreno ringbuffer object
+ * @flags: Internal control flags for the ringbuffer
+ * @buffer_desc: Pointer to the ringbuffer memory descriptor
+ * @_wptr: The next value of wptr to be written to the hardware on submit
+ * @wptr: Local copy of the wptr offset last written to hardware
+ * @last_wptr: offset of the last wptr that was written to CFF
+ * @rb_ctx: The context that represents a ringbuffer
+ * @id: Priority level of the ringbuffer, also used as an ID
+ * @fault_detect_ts: The last retired global timestamp read during fault detect
+ * @timestamp: The RB's global timestamp
+ * @events: A kgsl_event_group for this context - contains the list of GPU
+ * events
+ * @drawctxt_active: The last pagetable that this ringbuffer is set to
+ * @preemption_desc: The memory descriptor containing
+ * preemption info written/read by CP
+ * @secure_preemption_desc: The memory descriptor containing
+ * preemption info written/read by CP for secure contexts
+ * @perfcounter_save_restore_desc: Used by CP to save/restore the perfcounter
+ * values across preemption
+ * and the commands to switch pagetable on the RB
+ * @dispatch_q: The dispatcher side queue for this ringbuffer
+ * @ts_expire_waitq: Wait queue to wait for rb timestamp to expire
+ * @ts_expire_waitq: Wait q to wait for rb timestamp to expire
+ * @wptr_preempt_end: Used during preemption to check that preemption occurred
+ * at the right rptr
+ * @gpr11: The gpr11 value of this RB
+ * @preempted_midway: Indicates that the RB was preempted before rptr = wptr
+ * @preempt_lock: Lock to protect the wptr pointer while it is being updated
+ * @skip_inline_wptr: Used during preemption to make sure wptr is updated in
+ * hardware
+ */
+struct adreno_ringbuffer {
+	unsigned long flags;
+	struct kgsl_memdesc *buffer_desc;
+	unsigned int _wptr;
+	unsigned int wptr;
+	unsigned int last_wptr;
+	int id;
+	unsigned int fault_detect_ts;
+	unsigned int timestamp;
+	struct kgsl_event_group events;
+	struct adreno_context *drawctxt_active;
+	struct kgsl_memdesc *preemption_desc;
+	struct kgsl_memdesc *secure_preemption_desc;
+	struct kgsl_memdesc *perfcounter_save_restore_desc;
+	struct adreno_dispatcher_drawqueue dispatch_q;
+	wait_queue_head_t ts_expire_waitq;
+	unsigned int wptr_preempt_end;
+	unsigned int gpr11;
+	int preempted_midway;
+	spinlock_t preempt_lock;
+	bool skip_inline_wptr;
+	/**
+	 * @profile_desc: global memory to construct IB1s to do user side
+	 * profiling
+	 */
+	struct kgsl_memdesc *profile_desc;
+	/**
+	 * @profile_index: Pointer to the next "slot" in profile_desc for a user
+	 * profiling IB1.  This allows for PAGE_SIZE / 16 = 256 simultaneous
+	 * commands per ringbuffer with user profiling enabled
+	 * enough.
+	 */
+	u32 profile_index;
+};
+
+/* Returns the current ringbuffer */
+#define ADRENO_CURRENT_RINGBUFFER(a)	((a)->cur_rb)
+
+/**
+ * adreno_ringbuffer_setup - Do generic set up on a ringbuffer
+ * @adreno_dev: Pointer to an Adreno GPU handle
+ * @rb: Pointer to the ringbuffer struct to set up
+ * @id: Index of the ringbuffer
+ *
+ * Set up generic memory and other bits of a ringbuffer.
+ * Return: 0 on success or negative on error.
+ */
+int adreno_ringbuffer_setup(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb, int id);
+
+int adreno_ringbuffer_submitcmd(struct adreno_device *adreno_dev,
+		struct kgsl_drawobj_cmd *cmdobj,
+		struct adreno_submit_time *time);
+
+
+void adreno_ringbuffer_stop(struct adreno_device *adreno_dev);
+
+unsigned int *adreno_ringbuffer_allocspace(struct adreno_ringbuffer *rb,
+						unsigned int numcmds);
+
+int adreno_ringbuffer_waittimestamp(struct adreno_ringbuffer *rb,
+					unsigned int timestamp,
+					unsigned int msecs);
+
+int adreno_rb_readtimestamp(struct adreno_device *adreno_dev,
+	void *priv, enum kgsl_timestamp_type type,
+	unsigned int *timestamp);
+
+static inline int adreno_ringbuffer_count(struct adreno_ringbuffer *rb,
+	unsigned int rptr)
+{
+	if (rb->wptr >= rptr)
+		return rb->wptr - rptr;
+	return rb->wptr + KGSL_RB_DWORDS - rptr;
+}
+
+/* Increment a value by 4 bytes with wrap-around based on size */
+static inline unsigned int adreno_ringbuffer_inc_wrapped(unsigned int val,
+							unsigned int size)
+{
+	return (val + sizeof(unsigned int)) % size;
+}
+
+/* Decrement a value by 4 bytes with wrap-around based on size */
+static inline unsigned int adreno_ringbuffer_dec_wrapped(unsigned int val,
+							unsigned int size)
+{
+	return (val + size - sizeof(unsigned int)) % size;
+}
+
+void adreno_get_submit_time(struct adreno_device *adreno_dev,
+		struct adreno_ringbuffer *rb,
+		struct adreno_submit_time *time);
+
+#endif  /* __ADRENO_RINGBUFFER_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_snapshot.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_snapshot.c
@@ -0,0 +1,1337 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/utsname.h>
+
+#include "adreno.h"
+#include "adreno_cp_parser.h"
+#include "adreno_pm4types.h"
+#include "adreno_snapshot.h"
+
+/* Maintain a list of the objects we see during parsing */
+
+#define SNAPSHOT_OBJ_BUFSIZE 64
+
+/* Used to print error message if an IB has too many objects in it */
+static int ib_max_objs;
+
+struct snapshot_rb_params {
+	struct kgsl_snapshot *snapshot;
+	struct adreno_ringbuffer *rb;
+};
+
+/* Keep track of how many bytes are frozen after a snapshot and tell the user */
+static size_t snapshot_frozen_objsize;
+
+static struct kgsl_snapshot_object objbuf[SNAPSHOT_OBJ_BUFSIZE];
+
+/* Pointer to the next open entry in the object list */
+static unsigned int objbufptr;
+
+static inline int adreno_rb_ctxtswitch(struct adreno_device *adreno_dev,
+				   unsigned int *cmd)
+{
+	return cmd[0] == cp_packet(adreno_dev, CP_NOP, 1) &&
+		cmd[1] == CONTEXT_TO_MEM_IDENTIFIER;
+}
+
+/* Push a new buffer object onto the list */
+void kgsl_snapshot_push_object(struct kgsl_device *device,
+		struct kgsl_process_private *process,
+		uint64_t gpuaddr, uint64_t dwords)
+{
+	int index;
+	struct kgsl_mem_entry *entry;
+
+	if (process == NULL || gpuaddr == 0)
+		return;
+
+	/*
+	 * Sometimes IBs can be reused in the same dump.  Because we parse from
+	 * oldest to newest, if we come across an IB that has already been used,
+	 * assume that it has been reused and update the list with the newest
+	 * size.
+	 */
+
+	for (index = 0; index < objbufptr; index++) {
+		if (objbuf[index].gpuaddr == gpuaddr &&
+			objbuf[index].entry->priv == process) {
+			/*
+			 * Check if newly requested size is within the
+			 * allocated range or not, otherwise continue
+			 * with previous size.
+			 */
+			if (!kgsl_gpuaddr_in_memdesc(
+				&objbuf[index].entry->memdesc,
+				gpuaddr, dwords << 2)) {
+				dev_err(device->dev,
+					"snapshot: gpuaddr 0x%016llX size is less than requested\n",
+					gpuaddr);
+				return;
+			}
+
+			objbuf[index].size = max_t(uint64_t,
+						objbuf[index].size,
+						dwords << 2);
+			return;
+		}
+	}
+
+	if (objbufptr == SNAPSHOT_OBJ_BUFSIZE) {
+		dev_err(device->dev, "snapshot: too many snapshot objects\n");
+		return;
+	}
+
+	entry = kgsl_sharedmem_find(process, gpuaddr);
+	if (entry == NULL) {
+		dev_err(device->dev,
+			"snapshot: Can't find entry for 0x%016llX\n", gpuaddr);
+		return;
+	}
+
+	/*
+	 * In some gpu fault scenarios incorrect dword size resulting to return
+	 * without putting IB addrs into the list. Hence update IB dword size
+	 * within memdesc size to have IB dump in snapshot.
+	 */
+	if ((gpuaddr + (dwords << 2)) > (entry->memdesc.gpuaddr + entry->memdesc.size))
+		dwords = (entry->memdesc.size - (gpuaddr - entry->memdesc.gpuaddr)) >> 2;
+
+	if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, dwords << 2)) {
+		dev_err(device->dev,
+			"snapshot: Mem entry 0x%016llX is too small\n",
+			gpuaddr);
+		kgsl_mem_entry_put(entry);
+		return;
+	}
+
+	/* Put it on the list of things to parse */
+	objbuf[objbufptr].gpuaddr = gpuaddr;
+	objbuf[objbufptr].size = dwords << 2;
+	objbuf[objbufptr++].entry = entry;
+}
+
+/*
+ * Returns index of the specified object is already on the list of buffers
+ * to be dumped
+ */
+
+static int find_object(uint64_t gpuaddr, struct kgsl_process_private *process)
+{
+	int index;
+
+	for (index = 0; index < objbufptr; index++) {
+		if (objbuf[index].gpuaddr == gpuaddr &&
+			objbuf[index].entry->priv == process)
+			return index;
+	}
+	return -ENOENT;
+}
+
+/*
+ * snapshot_freeze_obj_list() - Take a list of ib objects and freeze their
+ * memory for snapshot
+ * @snapshot: The snapshot data.
+ * @process: The process to which the IB belongs
+ * @ib_obj_list: List of the IB objects
+ *
+ * Returns 0 on success else error code
+ */
+static int snapshot_freeze_obj_list(struct kgsl_snapshot *snapshot,
+		struct kgsl_process_private *process,
+		struct adreno_ib_object_list *ib_obj_list)
+{
+	int ret = 0;
+	struct adreno_ib_object *ib_objs;
+	int i;
+
+	for (i = 0; i < ib_obj_list->num_objs; i++) {
+		int temp_ret;
+		int index;
+		int freeze = 1;
+
+		ib_objs = &(ib_obj_list->obj_list[i]);
+		/* Make sure this object is not going to be saved statically */
+		for (index = 0; index < objbufptr; index++) {
+			if ((objbuf[index].gpuaddr <= ib_objs->gpuaddr) &&
+				((objbuf[index].gpuaddr +
+				(objbuf[index].size)) >=
+				(ib_objs->gpuaddr + ib_objs->size)) &&
+				(objbuf[index].entry->priv == process)) {
+				freeze = 0;
+				objbuf[index].entry->memdesc.priv &=
+					~KGSL_MEMDESC_SKIP_RECLAIM;
+				break;
+			}
+		}
+
+		if (freeze) {
+			temp_ret = kgsl_snapshot_get_object(snapshot,
+					    process, ib_objs->gpuaddr,
+					    ib_objs->size,
+					    ib_objs->snapshot_obj_type);
+			if (temp_ret < 0) {
+				if (ret >= 0)
+					ret = temp_ret;
+			} else {
+				snapshot_frozen_objsize += temp_ret;
+			}
+		}
+	}
+	return ret;
+}
+
+static inline bool adreno_ib_addr_overlap(u64 ibaddr, u64 gpuaddr, u64 dwords)
+{
+	u64 size = dwords << 2;
+
+	if (size > (U64_MAX - gpuaddr))
+		return false;
+
+	return (ibaddr >= gpuaddr && ibaddr < (gpuaddr + size));
+}
+
+void adreno_parse_ib(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot,
+		struct kgsl_process_private *process,
+		uint64_t gpuaddr, uint64_t dwords)
+{
+	struct adreno_ib_object_list *ib_obj_list;
+
+	/*
+	 * Check the IB address - if it is either the last executed IB1
+	 * then push it into the static blob otherwise put it in the dynamic
+	 * list
+	 */
+	if (adreno_ib_addr_overlap(snapshot->ib1base, gpuaddr, dwords)) {
+		/*
+		 * During restore after preemption, ib1base in the register
+		 * can be updated by CP. In such scenarios, to dump complete
+		 * IB1 in snapshot, we should consider ib1base from ringbuffer.
+		 */
+		snapshot->ib1base = gpuaddr;
+		snapshot->ib1size = dwords;
+		kgsl_snapshot_push_object(device, process, gpuaddr, dwords);
+		return;
+	}
+
+	if (kgsl_snapshot_have_object(snapshot, process,
+					gpuaddr, dwords << 2))
+		return;
+
+	if (-E2BIG == adreno_ib_create_object_list(device, process,
+				gpuaddr, dwords, snapshot->ib2base,
+				&ib_obj_list))
+		ib_max_objs = 1;
+
+	if (ib_obj_list)
+		kgsl_snapshot_add_ib_obj_list(snapshot, ib_obj_list);
+
+}
+
+void adreno_parse_ib_lpac(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot,
+		struct kgsl_process_private *process,
+		u64 gpuaddr, u64 dwords)
+{
+	struct adreno_ib_object_list *ib_obj_list;
+
+	/*
+	 * Check the IB address - if it is either the last executed IB1
+	 * then push it into the static blob otherwise put it in the dynamic
+	 * list
+	 */
+	if (adreno_ib_addr_overlap(snapshot->ib1base_lpac, gpuaddr, dwords)) {
+		/*
+		 * During restore after preemption, ib1base in the register
+		 * can be updated by CP. In such scenarios, to dump complete
+		 * IB1 in snapshot, we should consider ib1base from ringbuffer.
+		 */
+		snapshot->ib1base_lpac = gpuaddr;
+		snapshot->ib1size_lpac = dwords;
+		kgsl_snapshot_push_object(device, process, gpuaddr, dwords);
+		return;
+	}
+
+	if (kgsl_snapshot_have_object(snapshot, process,
+					gpuaddr, dwords << 2))
+		return;
+
+	if (-E2BIG == adreno_ib_create_object_list(device, process,
+				gpuaddr, dwords, snapshot->ib2base_lpac,
+				&ib_obj_list))
+		ib_max_objs = 1;
+
+	if (ib_obj_list)
+		kgsl_snapshot_add_ib_obj_list(snapshot, ib_obj_list);
+
+}
+
+void adreno_snapshot_dump_all_ibs(struct kgsl_device *device,
+			unsigned int *rbptr, struct kgsl_snapshot *snapshot)
+{
+	int index = 0;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+
+	for (index = 0; index < KGSL_RB_DWORDS;) {
+
+		if (adreno_cmd_is_ib(adreno_dev, rbptr[index])) {
+			uint64_t ibaddr;
+			uint64_t ibsize;
+
+			if (ADRENO_LEGACY_PM4(adreno_dev)) {
+				ibaddr = rbptr[index + 1];
+				ibsize = rbptr[index + 2];
+				index += 3;
+			} else {
+				ibaddr = rbptr[index + 2];
+				ibaddr = ibaddr << 32 | rbptr[index + 1];
+				ibsize = rbptr[index + 3];
+				index += 4;
+			}
+
+			/* Don't parse known global IBs */
+			if (kgsl_gpuaddr_in_memdesc(iommu->setstate,
+				ibaddr, ibsize))
+				continue;
+
+			if (kgsl_gpuaddr_in_memdesc(adreno_dev->pwron_fixup,
+				ibaddr, ibsize))
+				continue;
+
+			adreno_parse_ib(device, snapshot, snapshot->process,
+				ibaddr, ibsize);
+		} else
+			index = index + 1;
+	}
+}
+
+/**
+ * snapshot_rb_ibs() - Dump rb data and capture the IB's in the RB as well
+ * @device: Pointer to a KGSL device
+ * @rb: The RB to dump
+ * @data: Pointer to memory where the RB data is to be dumped
+ * @snapshot: Pointer to information about the current snapshot being taken
+ */
+static void snapshot_rb_ibs(struct kgsl_device *device,
+		struct adreno_ringbuffer *rb,
+		struct kgsl_snapshot *snapshot)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	unsigned int *rbptr, rptr = adreno_get_rptr(rb);
+	int index, i;
+	int parse_ibs = 0, ib_parse_start;
+
+	/*
+	 * During IB parse, vmalloc is called which can sleep and
+	 * should not be called from atomic context. Since IBs are not
+	 * dumped during atomic snapshot, there is no need to parse it.
+	 */
+	if (device->snapshot_atomic)
+		return;
+
+	rbptr = rb->buffer_desc->hostptr;
+	/*
+	 * KGSL tries to dump the active IB first. If it is not present, then
+	 * only it dumps all the IBs. In few cases, non-active IBs may help to
+	 * establish the flow and understand the hardware state better.
+	 */
+	if (device->dump_all_ibs) {
+		adreno_snapshot_dump_all_ibs(device, rbptr, snapshot);
+		return;
+	}
+
+	/*
+	 * Figure out the window of ringbuffer data to dump.  First we need to
+	 * find where the last processed IB ws submitted.  Start walking back
+	 * from the rptr
+	 */
+	index = rptr;
+
+	do {
+		index--;
+
+		if (index < 0) {
+			if (ADRENO_LEGACY_PM4(adreno_dev))
+				index = KGSL_RB_DWORDS - 3;
+			else
+				index = KGSL_RB_DWORDS - 4;
+
+			/* We wrapped without finding what we wanted */
+			if (index < rb->wptr) {
+				index = rb->wptr;
+				break;
+			}
+		}
+
+		if (adreno_cmd_is_ib(adreno_dev, rbptr[index])) {
+			uint64_t ibaddr;
+			uint64_t ibsize;
+
+			if (ADRENO_LEGACY_PM4(adreno_dev)) {
+				ibaddr = rbptr[index + 1];
+				ibsize = rbptr[index + 2];
+			} else {
+				ibaddr = rbptr[index + 2];
+				ibaddr = ibaddr << 32 | rbptr[index + 1];
+				ibsize = rbptr[index + 3];
+			}
+
+			if (adreno_ib_addr_overlap(snapshot->ib1base,
+					ibaddr, ibsize)) {
+				/*
+				 * During restore after preemption, ib1base in
+				 * the register can be updated by CP. In such
+				 * scenario, to dump complete IB1 in snapshot,
+				 * we should consider ib1base from ringbuffer.
+				 */
+				snapshot->ib1base = ibaddr;
+				snapshot->ib1size = ibsize;
+				break;
+			}
+		}
+	} while (index != rb->wptr);
+
+	/*
+	 * If the ib1 was not found, for example, if ib1base was restored
+	 * incorrectly after preemption, then simply dump the entire
+	 * ringbuffer along with all the IBs in the ringbuffer.
+	 */
+
+	if (index == rb->wptr) {
+		adreno_snapshot_dump_all_ibs(device, rb->buffer_desc->hostptr, snapshot);
+		return;
+	}
+
+	/*
+	 * index points at the last submitted IB. We can only trust that the
+	 * memory between the context switch and the hanging IB is valid, so
+	 * the next step is to find the context switch before the submission
+	 */
+
+	while (index != rb->wptr) {
+		index--;
+
+		if (index < 0) {
+			index = KGSL_RB_DWORDS - 2;
+
+			/*
+			 * Wrapped without finding the context switch. This is
+			 * harmless - we should still have enough data to dump a
+			 * valid state
+			 */
+
+			if (index < rb->wptr) {
+				index = rb->wptr;
+				break;
+			}
+		}
+
+		/* Break if the current packet is a context switch identifier */
+		if ((rbptr[index] == cp_packet(adreno_dev, CP_NOP, 1)) &&
+			(rbptr[index + 1] == CONTEXT_TO_MEM_IDENTIFIER))
+			break;
+	}
+
+	/*
+	 * Index represents the start of the window of interest.  We will try
+	 * to dump all buffers between here and the rptr
+	 */
+
+	ib_parse_start = index;
+
+	/*
+	 * Loop through the RB, looking for indirect buffers and MMU pagetable
+	 * changes
+	 */
+
+	index = rb->wptr;
+	for (i = 0; i < KGSL_RB_DWORDS; i++) {
+		/*
+		 * Only parse IBs between the start and the rptr or the next
+		 * context switch, whichever comes first
+		 */
+
+		if (parse_ibs == 0 && index == ib_parse_start)
+			parse_ibs = 1;
+		else if (index == rptr || adreno_rb_ctxtswitch(adreno_dev,
+							&rbptr[index]))
+			parse_ibs = 0;
+
+		if (parse_ibs && adreno_cmd_is_ib(adreno_dev, rbptr[index])) {
+			struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+			uint64_t ibaddr;
+			uint64_t ibsize;
+
+			if (ADRENO_LEGACY_PM4(adreno_dev)) {
+				ibaddr = rbptr[index + 1];
+				ibsize = rbptr[index + 2];
+			} else {
+				ibaddr = rbptr[index + 2];
+				ibaddr = ibaddr << 32 | rbptr[index + 1];
+				ibsize = rbptr[index + 3];
+			}
+
+			index = (index + 1) % KGSL_RB_DWORDS;
+
+			/* Don't parse known global IBs */
+			if (kgsl_gpuaddr_in_memdesc(iommu->setstate,
+				ibaddr, ibsize))
+				continue;
+
+			if (kgsl_gpuaddr_in_memdesc(adreno_dev->pwron_fixup,
+				ibaddr, ibsize))
+				continue;
+
+			adreno_parse_ib(device, snapshot, snapshot->process,
+				ibaddr, ibsize);
+		} else
+			index = (index + 1) % KGSL_RB_DWORDS;
+	}
+
+}
+
+/* Snapshot the ringbuffer memory */
+static size_t snapshot_rb(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	struct kgsl_snapshot_rb_v2 *header = (struct kgsl_snapshot_rb_v2 *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct snapshot_rb_params *snap_rb_params = priv;
+	struct kgsl_snapshot *snapshot = snap_rb_params->snapshot;
+	struct adreno_ringbuffer *rb = snap_rb_params->rb;
+
+	/*
+	 * Dump the entire ringbuffer - the parser can choose how much of it to
+	 * process
+	 */
+
+	if (remain < KGSL_RB_SIZE + sizeof(*header)) {
+		dev_err(device->dev,
+			"snapshot: Not enough memory for the rb section\n");
+		return 0;
+	}
+
+	/* Write the sub-header for the section */
+	header->start = 0;
+	header->end = KGSL_RB_DWORDS;
+	header->wptr = rb->wptr;
+	header->rptr = adreno_get_rptr(rb);
+	header->rbsize = KGSL_RB_DWORDS;
+	header->count = KGSL_RB_DWORDS;
+	adreno_rb_readtimestamp(adreno_dev, rb, KGSL_TIMESTAMP_QUEUED,
+					&header->timestamp_queued);
+	adreno_rb_readtimestamp(adreno_dev, rb, KGSL_TIMESTAMP_RETIRED,
+					&header->timestamp_retired);
+	header->gpuaddr = rb->buffer_desc->gpuaddr;
+	header->id = rb->id;
+
+	if (rb == adreno_dev->cur_rb)
+		snapshot_rb_ibs(device, rb, snapshot);
+
+	/* Just copy the ringbuffer, there are no active IBs */
+	memcpy(data, rb->buffer_desc->hostptr, KGSL_RB_SIZE);
+
+	/* Return the size of the section */
+	return KGSL_RB_SIZE + sizeof(*header);
+}
+
+static int _count_mem_entries(int id, void *ptr, void *data)
+{
+	int *count = data;
+	*count = *count + 1;
+	return 0;
+}
+
+struct mem_entry {
+	uint64_t gpuaddr;
+	uint64_t size;
+	unsigned int type;
+} __packed;
+
+static size_t snapshot_capture_mem_list(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_mem_list_v2 *header =
+		(struct kgsl_snapshot_mem_list_v2 *)buf;
+	int id, index = 0, ret = 0, num_mem = 0;
+	struct kgsl_process_private *process = priv;
+	struct mem_entry *m = (struct mem_entry *)(buf + sizeof(*header));
+	struct kgsl_mem_entry *entry;
+
+	/* we need a process to search! */
+	if (process == NULL)
+		return 0;
+
+	spin_lock(&process->mem_lock);
+
+	/* We need to know the number of memory objects that the process has */
+	idr_for_each(&process->mem_idr, _count_mem_entries, &num_mem);
+
+	if (num_mem == 0)
+		goto out;
+
+	if (remain < ((num_mem * sizeof(struct mem_entry)) + sizeof(*header))) {
+		dev_err(device->dev,
+			"snapshot: Not enough memory for the mem list\n");
+		goto out;
+	}
+
+	header->num_entries = num_mem;
+	header->ptbase = kgsl_mmu_pagetable_get_ttbr0(process->pagetable);
+
+	/*
+	 * Walk through the memory list and store the
+	 * tuples(gpuaddr, size, memtype) in snapshot
+	 */
+	idr_for_each_entry(&process->mem_idr, entry, id) {
+		m[index].gpuaddr = entry->memdesc.gpuaddr;
+		m[index].size = entry->memdesc.size;
+		m[index].type = kgsl_memdesc_get_memtype(&entry->memdesc);
+		index++;
+	}
+
+	ret = sizeof(*header) + (num_mem * sizeof(struct mem_entry));
+out:
+	spin_unlock(&process->mem_lock);
+	return ret;
+}
+
+struct snapshot_ib_meta {
+	struct kgsl_snapshot *snapshot;
+	struct kgsl_snapshot_object *obj;
+	uint64_t ib1base;
+	uint64_t ib1size;
+	uint64_t ib2base;
+	uint64_t ib2size;
+	u64 ib1base_lpac;
+	u64 ib1size_lpac;
+	u64 ib2base_lpac;
+	u64 ib2size_lpac;
+};
+
+static void kgsl_snapshot_add_active_ib_obj_list(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot)
+{
+	struct adreno_ib_object_list *ib_obj_list;
+	int index = -ENOENT;
+
+	if (!snapshot->ib1dumped)
+		index = find_object(snapshot->ib1base, snapshot->process);
+
+	/* only do this for IB1 because the IB2's are part of IB1 objects */
+	if ((index != -ENOENT) &&
+			(snapshot->ib1base == objbuf[index].gpuaddr)) {
+		if (-E2BIG == adreno_ib_create_object_list(device,
+					objbuf[index].entry->priv,
+					objbuf[index].gpuaddr,
+					objbuf[index].size >> 2,
+					snapshot->ib2base,
+					&ib_obj_list))
+			ib_max_objs = 1;
+		if (ib_obj_list) {
+			/* freeze the IB objects in the IB */
+			snapshot_freeze_obj_list(snapshot,
+					objbuf[index].entry->priv,
+					ib_obj_list);
+			adreno_ib_destroy_obj_list(ib_obj_list);
+		}
+	} else {
+		/* Get the IB2 index from parsed object */
+		index = find_object(snapshot->ib2base, snapshot->process);
+
+		if (index != -ENOENT)
+			adreno_parse_ib(device, snapshot, snapshot->process,
+				snapshot->ib2base, objbuf[index].size >> 2);
+	}
+}
+
+static void kgsl_snapshot_add_active_lpac_ib_obj_list(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot)
+{
+	struct adreno_ib_object_list *ib_obj_list;
+	int index = -ENOENT;
+
+	if (!snapshot->ib1dumped_lpac)
+		index = find_object(snapshot->ib1base_lpac, snapshot->process_lpac);
+
+	/* only do this for IB1 because the IB2's are part of IB1 objects */
+	if ((index != -ENOENT) &&
+			(snapshot->ib1base_lpac == objbuf[index].gpuaddr)) {
+		if (-E2BIG == adreno_ib_create_object_list(device,
+					objbuf[index].entry->priv,
+					objbuf[index].gpuaddr,
+					objbuf[index].size >> 2,
+					snapshot->ib2base_lpac,
+					&ib_obj_list))
+			ib_max_objs = 1;
+		if (ib_obj_list) {
+			/* freeze the IB objects in the IB */
+			snapshot_freeze_obj_list(snapshot,
+					objbuf[index].entry->priv,
+					ib_obj_list);
+			adreno_ib_destroy_obj_list(ib_obj_list);
+		}
+	} else {
+		/* Get the IB2 index from parsed object */
+		index = find_object(snapshot->ib2base_lpac, snapshot->process_lpac);
+
+		if (index != -ENOENT)
+			adreno_parse_ib_lpac(device, snapshot, snapshot->process_lpac,
+				snapshot->ib2base_lpac, objbuf[index].size >> 2);
+	}
+}
+
+/*
+ * active_ib_is_parsed() - Checks if active ib is already parsed
+ * @gpuaddr: Active IB base address at the time of fault
+ * @size: Active IB size
+ * @process: The process to which the IB belongs
+ *
+ * Function returns true if the active is already is parsed
+ * else false
+ */
+static bool active_ib_is_parsed(uint64_t gpuaddr, uint64_t size,
+		struct kgsl_process_private *process)
+{
+	int  index;
+	/* go through the static list for gpuaddr is in list or not */
+	for (index = 0; index < objbufptr; index++) {
+		if ((objbuf[index].gpuaddr <= gpuaddr) &&
+				((objbuf[index].gpuaddr +
+				  (objbuf[index].size)) >=
+				 (gpuaddr + size)) &&
+				(objbuf[index].entry->priv == process))
+			return true;
+	}
+	return false;
+}
+/* Snapshot the memory for an indirect buffer */
+static size_t snapshot_ib(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	struct kgsl_snapshot_ib_v2 *header = (struct kgsl_snapshot_ib_v2 *)buf;
+	struct snapshot_ib_meta *metadata = priv;
+	unsigned int *src;
+	unsigned int *dst = (unsigned int *)(buf + sizeof(*header));
+	struct adreno_ib_object_list *ib_obj_list;
+	struct kgsl_snapshot *snapshot;
+	struct kgsl_snapshot_object *obj;
+	struct kgsl_memdesc *memdesc;
+
+	if (metadata == NULL || metadata->snapshot == NULL || metadata->obj == NULL) {
+		dev_err(device->dev, "snapshot: bad metadata\n");
+		return 0;
+	}
+	snapshot = metadata->snapshot;
+	obj = metadata->obj;
+	memdesc = &obj->entry->memdesc;
+
+	/* If size is zero get it from the medesc size */
+	if (!obj->size)
+		obj->size = (memdesc->size - (obj->gpuaddr - memdesc->gpuaddr));
+
+	if (remain < (obj->size + sizeof(*header))) {
+		dev_err(device->dev, "snapshot: Not enough memory for the ib\n");
+		return 0;
+	}
+
+	src = kgsl_gpuaddr_to_vaddr(memdesc, obj->gpuaddr);
+	if (src == NULL) {
+		dev_err(device->dev,
+			     "snapshot: Unable to map GPU memory object 0x%016llX into the kernel\n",
+			     obj->gpuaddr);
+		return 0;
+	}
+
+	/* only do this for IB1 because the IB2's are part of IB1 objects */
+	if (metadata->ib1base == obj->gpuaddr) {
+
+		snapshot->ib1dumped = active_ib_is_parsed(obj->gpuaddr,
+					obj->size, obj->entry->priv);
+		if (-E2BIG == adreno_ib_create_object_list(device,
+				obj->entry->priv,
+				obj->gpuaddr, obj->size >> 2,
+				snapshot->ib2base,
+				&ib_obj_list))
+			ib_max_objs = 1;
+		if (ib_obj_list) {
+			/* freeze the IB objects in the IB */
+			snapshot_freeze_obj_list(snapshot,
+						obj->entry->priv,
+						ib_obj_list);
+			adreno_ib_destroy_obj_list(ib_obj_list);
+		}
+	}
+
+
+	if (metadata->ib2base == obj->gpuaddr)
+		snapshot->ib2dumped = active_ib_is_parsed(obj->gpuaddr,
+					obj->size, obj->entry->priv);
+
+	if (metadata->ib1base_lpac == obj->gpuaddr) {
+
+		snapshot->ib1dumped_lpac = active_ib_is_parsed(obj->gpuaddr,
+					obj->size, obj->entry->priv);
+		if (-E2BIG == adreno_ib_create_object_list(device,
+				obj->entry->priv,
+				obj->gpuaddr, obj->size >> 2,
+				snapshot->ib2base_lpac,
+				&ib_obj_list))
+			ib_max_objs = 1;
+		if (ib_obj_list) {
+			/* freeze the IB objects in the IB */
+			snapshot_freeze_obj_list(snapshot,
+						obj->entry->priv,
+						ib_obj_list);
+			adreno_ib_destroy_obj_list(ib_obj_list);
+		}
+	}
+
+	if (metadata->ib2base_lpac == obj->gpuaddr)
+		snapshot->ib2dumped_lpac = active_ib_is_parsed(obj->gpuaddr,
+					obj->size, obj->entry->priv);
+
+	/* Write the sub-header for the section */
+	header->gpuaddr = obj->gpuaddr;
+	header->ptbase =
+		kgsl_mmu_pagetable_get_ttbr0(obj->entry->priv->pagetable);
+	header->size = obj->size >> 2;
+
+	/* Write the contents of the ib */
+	memcpy((void *)dst, (void *)src, (size_t) obj->size);
+	/* Write the contents of the ib */
+
+	return obj->size + sizeof(*header);
+}
+
+/* Dump another item on the current pending list */
+static void dump_object(struct kgsl_device *device, int obj,
+		struct kgsl_snapshot *snapshot)
+{
+	struct snapshot_ib_meta metadata;
+
+	metadata.snapshot = snapshot;
+	metadata.obj = &objbuf[obj];
+	metadata.ib1base = snapshot->ib1base;
+	metadata.ib1size = snapshot->ib1size;
+	metadata.ib2base = snapshot->ib2base;
+	metadata.ib2size = snapshot->ib2size;
+	metadata.ib1base_lpac = snapshot->ib1base_lpac;
+	metadata.ib1size_lpac = snapshot->ib1size_lpac;
+	metadata.ib2base_lpac = snapshot->ib2base_lpac;
+	metadata.ib2size_lpac = snapshot->ib2size_lpac;
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_IB_V2,
+			snapshot, snapshot_ib, &metadata);
+	if (objbuf[obj].entry) {
+		kgsl_memdesc_unmap(&(objbuf[obj].entry->memdesc));
+		kgsl_mem_entry_put(objbuf[obj].entry);
+	}
+}
+
+/* setup_fault process - Find kgsl_process_private struct that caused the fault
+ *
+ * Find the faulting process based what the dispatcher thinks happened and
+ * what the hardware is using for the current pagetable. The process struct
+ * will be used to look up GPU addresses that are encountered while parsing
+ * the GPU state.
+ */
+static struct kgsl_process_private *setup_fault_process(struct kgsl_device *device,
+				struct kgsl_snapshot *snapshot,
+				struct kgsl_context *context)
+{
+	u64 hw_ptbase, proc_ptbase;
+	struct kgsl_process_private *process = context ? context->proc_priv : NULL;
+
+	if (process != NULL && !kgsl_process_private_get(process))
+		process = NULL;
+
+	/* Get the physical address of the MMU pagetable */
+	hw_ptbase = kgsl_mmu_get_current_ttbr0(&device->mmu, context);
+
+	/* if we have an input process, make sure the ptbases match */
+	if (process) {
+		int asid = kgsl_mmu_pagetable_get_asid(process->pagetable, context);
+
+		proc_ptbase = kgsl_mmu_pagetable_get_ttbr0(process->pagetable);
+		if (asid >= 0)
+			proc_ptbase |= FIELD_PREP(GENMASK_ULL(63, KGSL_IOMMU_ASID_START_BIT), asid);
+
+		/* agreement! No need to check further */
+		if (hw_ptbase == proc_ptbase)
+			goto done;
+
+		kgsl_process_private_put(process);
+		process = NULL;
+		dev_err(device->dev,
+			"snapshot: ptbase mismatch hw %llx sw %llx\n",
+			hw_ptbase, proc_ptbase);
+	}
+
+	/* try to find the right pagetable by walking the process list */
+	if (kgsl_mmu_is_perprocess(&device->mmu)) {
+		struct kgsl_process_private *tmp;
+
+		read_lock(&kgsl_driver.proclist_lock);
+		list_for_each_entry(tmp, &kgsl_driver.process_list, list) {
+			u64 pt_ttbr0;
+
+			pt_ttbr0 = kgsl_mmu_pagetable_get_ttbr0(tmp->pagetable);
+			if ((pt_ttbr0 == MMU_SW_PT_BASE(hw_ptbase))
+			    && kgsl_process_private_get(tmp)) {
+				process = tmp;
+				break;
+			}
+		}
+		read_unlock(&kgsl_driver.proclist_lock);
+	}
+done:
+	return process;
+}
+
+/* Snapshot a global memory buffer */
+size_t adreno_snapshot_global(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	struct kgsl_memdesc *memdesc = priv;
+
+	struct kgsl_snapshot_gpu_object_v2 *header =
+		(struct kgsl_snapshot_gpu_object_v2 *)buf;
+
+	u8 *ptr = buf + sizeof(*header);
+
+	if (IS_ERR_OR_NULL(memdesc) || memdesc->size == 0)
+		return 0;
+
+	if (remain < (memdesc->size + sizeof(*header))) {
+		dev_err(device->dev,
+			"snapshot: Not enough memory for the memdesc\n");
+		return 0;
+	}
+
+	if (memdesc->hostptr == NULL) {
+		dev_err(device->dev,
+		"snapshot: no kernel mapping for global object 0x%016llX\n",
+		memdesc->gpuaddr);
+		return 0;
+	}
+
+	header->size = memdesc->size >> 2;
+	header->gpuaddr = memdesc->gpuaddr;
+	header->ptbase = MMU_DEFAULT_TTBR0(device);
+	header->type = SNAPSHOT_GPU_OBJECT_GLOBAL;
+
+	memcpy(ptr, memdesc->hostptr, memdesc->size);
+
+	return memdesc->size + sizeof(*header);
+}
+
+/* Snapshot IOMMU specific buffers */
+static void adreno_snapshot_iommu(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+		snapshot, adreno_snapshot_global, iommu->setstate);
+
+	if (adreno_is_preemption_enabled(adreno_dev))
+		kgsl_snapshot_add_section(device,
+			KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+			snapshot, adreno_snapshot_global, iommu->smmu_info);
+}
+
+static void adreno_snapshot_ringbuffer(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot, struct adreno_ringbuffer *rb)
+{
+	struct snapshot_rb_params params = {
+		.snapshot = snapshot,
+		.rb = rb,
+	};
+
+	if (rb == NULL)
+		return;
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_RB_V2, snapshot,
+		snapshot_rb, &params);
+}
+
+static void adreno_snapshot_os(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot, struct kgsl_context *guilty,
+		struct kgsl_context *guilty_lpac)
+{
+	struct kgsl_snapshot_section_header *sect =
+		(struct kgsl_snapshot_section_header *) snapshot->ptr;
+	struct kgsl_snapshot_linux_v4 *header = (struct kgsl_snapshot_linux_v4 *)
+		(snapshot->ptr + sizeof(*sect));
+	struct kgsl_context *context;
+	u32 remain;
+	void *mem;
+	int id;
+
+	if (snapshot->remain < (sizeof(*sect) + sizeof(*header))) {
+		SNAPSHOT_ERR_NOMEM(device, "OS");
+		return;
+	}
+
+	header->osid = KGSL_SNAPSHOT_OS_LINUX_V4;
+
+	strscpy(header->release, init_utsname()->release,
+		sizeof(header->release));
+	strscpy(header->version, init_utsname()->version,
+		sizeof(header->version));
+
+	header->seconds = ktime_get_real_seconds();
+	header->power_flags = device->pwrctrl.power_flags;
+	header->power_level = device->pwrctrl.active_pwrlevel;
+	header->power_interval_timeout = device->pwrctrl.interval_timeout;
+	header->grpclk = clk_get_rate(device->pwrctrl.grp_clks[0]);
+
+	/* Get the current PT base */
+	header->ptbase = kgsl_mmu_get_current_ttbr0(&device->mmu, guilty);
+	header->ptbase_lpac = kgsl_mmu_get_current_ttbr0(&device->mmu, guilty_lpac);
+	header->ctxtcount = 0;
+
+	/* If we know the guilty context then dump it */
+	if (guilty) {
+		header->current_context = guilty->id;
+		header->pid = guilty->tid;
+		strscpy(header->comm, guilty->proc_priv->comm,
+			sizeof(header->comm));
+	}
+
+	if (guilty_lpac) {
+		header->current_context_lpac = guilty_lpac->id;
+		header->pid_lpac = guilty_lpac->tid;
+		strscpy(header->comm_lpac, guilty_lpac->proc_priv->comm,
+			sizeof(header->comm_lpac));
+	}
+
+	remain = snapshot->remain - sizeof(*sect) + sizeof(*header);
+	mem = snapshot->ptr + sizeof(*sect) + sizeof(*header);
+
+	read_lock(&device->context_lock);
+	idr_for_each_entry(&device->context_idr, context, id) {
+		struct kgsl_snapshot_linux_context_v2 *c = mem;
+
+		if (remain < sizeof(*c))
+			break;
+
+		kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_QUEUED,
+			&c->timestamp_queued);
+
+		kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_CONSUMED,
+			&c->timestamp_consumed);
+
+		kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_RETIRED,
+			&c->timestamp_retired);
+
+		header->ctxtcount++;
+
+		mem += sizeof(*c);
+		remain -= sizeof(*c);
+	}
+	read_unlock(&device->context_lock);
+
+	sect->magic = SNAPSHOT_SECTION_MAGIC;
+	sect->id = KGSL_SNAPSHOT_SECTION_OS;
+	sect->size = sizeof(*sect) + sizeof(*header) +
+		header->ctxtcount * sizeof(struct kgsl_snapshot_linux_context_v2);
+
+	snapshot->ptr += sect->size;
+	snapshot->remain -= sect->size;
+	snapshot->size += sect->size;
+}
+
+static void adreno_static_ib_dump(struct kgsl_device *device,
+				struct kgsl_process_private *process, u64 ib1base,
+				u32 ib1size, u64 ib2base, u32 ib2size)
+{
+	if (process == NULL)
+		return;
+
+	 /* Make sure that the last IB1 that was being executed is dumped.
+	 * Since this was the last IB1 that was processed, we should have
+	 * already added it to the list during the ringbuffer parse but we
+	 * want to be double plus sure.
+	 * The problem is that IB size from the register is the unprocessed size
+	 * of the buffer not the original size, so if we didn't catch this
+	 * buffer being directly used in the RB, then we might not be able to
+	 * dump the whole thing. Try to dump the maximum possible size from the
+	 * IB1 base address till the end of memdesc size so that we dont miss
+	 * what we are interested in. Print a warning message so we can try to
+	 * figure how often this really happens.
+	 */
+
+	if (ib1base && (-ENOENT == find_object(ib1base, process))) {
+		struct kgsl_mem_entry *entry;
+		u64 ibsize;
+
+		entry = kgsl_sharedmem_find(process, ib1base);
+		if (entry == NULL) {
+			dev_err(device->dev,
+				"Can't find a memory entry containing IB1BASE %16llx\n",
+				ib1base);
+		} else {
+			ibsize = entry->memdesc.size -
+				(ib1base - entry->memdesc.gpuaddr);
+			kgsl_mem_entry_put(entry);
+
+			kgsl_snapshot_push_object(device, process,
+				ib1base, ibsize >> 2);
+			dev_err(device->dev,
+				"CP_IB1_BASE %16llx is not found in the ringbuffer. Dumping %llx dwords of the buffer\n",
+				ib1base, ibsize >> 2);
+		}
+	}
+
+	/*
+	 * Add the last parsed IB2 to the list. The IB2 should be found as we
+	 * parse the objects below, but we try to add it to the list first, so
+	 * it too can be parsed.  Don't print an error message in this case - if
+	 * the IB2 is found during parsing, the list will be updated with the
+	 * correct size.
+	 */
+
+	if (ib2base && (-ENOENT == find_object(ib2base, process)))
+		kgsl_snapshot_push_object(device, process, ib2base, ib2size);
+
+}
+
+/* adreno_snapshot - Snapshot the Adreno GPU state
+ * @device - KGSL device to snapshot
+ * @snapshot - Pointer to the snapshot instance
+ * @context - context that caused the fault, if known by the driver
+ * This is a hook function called by kgsl_snapshot to snapshot the
+ * Adreno specific information for the GPU snapshot.  In turn, this function
+ * calls the GPU specific snapshot function to get core specific information.
+ */
+void adreno_snapshot(struct kgsl_device *device, struct kgsl_snapshot *snapshot,
+			struct kgsl_context *context, struct kgsl_context *context_lpac)
+{
+	unsigned int i;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	struct kgsl_snapshot_header *header = (struct kgsl_snapshot_header *)
+		snapshot->ptr;
+
+	/* Set up the master header */
+	header->magic = SNAPSHOT_MAGIC;
+	/* gpuid is deprecated so initialize it to an obviously wrong value */
+	header->gpuid = UINT_MAX;
+	header->chipid = adreno_dev->chipid;
+
+	snapshot->ptr += sizeof(*header);
+	snapshot->remain -= sizeof(*header);
+	snapshot->size += sizeof(*header);
+
+	/* Write the OS section */
+	adreno_snapshot_os(device, snapshot, context, context_lpac);
+
+	ib_max_objs = 0;
+	/* Reset the list of objects */
+	objbufptr = 0;
+
+	snapshot_frozen_objsize = 0;
+
+	snapshot->process = setup_fault_process(device, snapshot, context);
+	snapshot->process_lpac = setup_fault_process(device, snapshot, context_lpac);
+
+	/* Add GPU specific sections - registers mainly, but other stuff too */
+	if (gpudev->snapshot)
+		gpudev->snapshot(adreno_dev, snapshot);
+
+	snapshot->ib1dumped = false;
+	snapshot->ib2dumped = false;
+	snapshot->ib1dumped_lpac = false;
+	snapshot->ib2dumped_lpac = false;
+
+	adreno_snapshot_ringbuffer(device, snapshot, adreno_dev->cur_rb);
+
+	/* Dump the prev ringbuffer */
+	if (adreno_dev->prev_rb != adreno_dev->cur_rb)
+		adreno_snapshot_ringbuffer(device, snapshot,
+			adreno_dev->prev_rb);
+
+	if ((adreno_dev->next_rb != adreno_dev->prev_rb) &&
+		 (adreno_dev->next_rb != adreno_dev->cur_rb))
+		adreno_snapshot_ringbuffer(device, snapshot,
+			adreno_dev->next_rb);
+
+	if (device->snapshot_atomic)
+		return;
+
+	/* Dump selected global buffers */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+			snapshot, adreno_snapshot_global, device->memstore);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+			snapshot, adreno_snapshot_global, device->scratch);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+			snapshot, adreno_snapshot_global,
+			adreno_dev->pwron_fixup);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2,
+			snapshot, adreno_snapshot_global,
+			adreno_dev->profile_buffer);
+
+	if (kgsl_mmu_get_mmutype(device) == KGSL_MMU_TYPE_IOMMU)
+		adreno_snapshot_iommu(device, snapshot);
+
+	/*
+	 * Add a section that lists (gpuaddr, size, memtype) tuples of the
+	 * hanging process
+	 */
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_MEMLIST_V2,
+			snapshot, snapshot_capture_mem_list, snapshot->process);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_MEMLIST_V2,
+			snapshot, snapshot_capture_mem_list, snapshot->process_lpac);
+
+	adreno_static_ib_dump(device, snapshot->process,
+		snapshot->ib1base, snapshot->ib1size, snapshot->ib2base, snapshot->ib2size);
+
+	adreno_static_ib_dump(device, snapshot->process_lpac,
+		snapshot->ib1base_lpac, snapshot->ib1size_lpac,
+		snapshot->ib2base_lpac, snapshot->ib2size_lpac);
+	/*
+	 * Go through the list of found objects and dump each one.  As the IBs
+	 * are parsed, more objects might be found, and objbufptr will increase
+	 */
+	for (i = 0; i < objbufptr; i++)
+		dump_object(device, i, snapshot);
+
+	/*
+	 * Incase snapshot static blob is running out of memory, Add Active IB1
+	 * and IB2 entries to obj_list so that active ib's can be dumped to
+	 * snapshot dynamic blob.
+	 */
+	if (!snapshot->ib1dumped || !snapshot->ib2dumped)
+		kgsl_snapshot_add_active_ib_obj_list(device, snapshot);
+
+	if (ib_max_objs)
+		dev_err(device->dev, "Max objects found in GC IB\n");
+
+	if (!snapshot->ib1dumped_lpac || !snapshot->ib2dumped_lpac)
+		kgsl_snapshot_add_active_lpac_ib_obj_list(device, snapshot);
+
+	if (ib_max_objs)
+		dev_err(device->dev, "Max objects found in LPAC IB\n");
+
+	if (snapshot_frozen_objsize)
+		dev_err(device->dev,
+			"GPU snapshot froze %zdKb of GPU buffers\n",
+			snapshot_frozen_objsize / 1024);
+
+}
+
+void adreno_snapshot_registers(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot,
+		const unsigned int *regs, unsigned int count)
+{
+	struct kgsl_snapshot_registers r;
+
+	r.regs = regs;
+	r.count = count;
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_REGS, snapshot,
+		kgsl_snapshot_dump_registers, &r);
+}
+
+int adreno_snapshot_regs_count(const u32 *ptr)
+{
+	unsigned int count = 0;
+	unsigned int group_count;
+
+	for ( ; ptr[0] != UINT_MAX; ptr += 2) {
+		group_count = REG_COUNT(ptr);
+		if (group_count == 1)
+			count += group_count + 1;
+		else
+			count += group_count + 2;
+	}
+	return count;
+}
+
+/*
+ * This is a new format for dumping the registers, where we dump just the first
+ * address of the register along with the count of the contiguous registers
+ * which we going to dump. This helps us save memory by not dumping the
+ * address for each register
+ */
+size_t adreno_snapshot_registers_v2(struct kgsl_device *device, u8 *buf,
+				size_t remain, void *priv)
+{
+	const u32 *ptr = (const u32 *)priv;
+	unsigned int *data = (unsigned int *)buf;
+	int count = 0, k;
+
+	/* Figure out how many registers we are going to dump */
+	count = adreno_snapshot_regs_count(ptr);
+
+	if (remain < (count * 4)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	for (ptr = (const u32 *)priv; ptr[0] != UINT_MAX; ptr += 2) {
+		int cnt = REG_COUNT(ptr);
+
+		if (cnt == 1)
+			*data++ = BIT(31) | ptr[0];
+		else {
+			*data++ = ptr[0];
+			*data++ = cnt;
+		}
+		for (k = ptr[0]; k <= ptr[1]; k++) {
+			kgsl_regread(device, k, data);
+			data++;
+		}
+	}
+
+	/* Return the size of the section */
+	return (count * 4);
+}
+
+size_t adreno_snapshot_cx_misc_registers(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const u32 *ptr = (const u32 *)priv;
+	u32 *data = (unsigned int *)buf;
+	int count = 0, k;
+
+	/* Figure out how many registers we are going to dump */
+	count = adreno_snapshot_regs_count(ptr);
+
+	if (remain < (count * sizeof(u32))) {
+		SNAPSHOT_ERR_NOMEM(device, "CX_MISC REGISTERS");
+		return 0;
+	}
+
+	for (; ptr[0] != UINT_MAX; ptr += 2) {
+		int cnt = REG_COUNT(ptr);
+
+		if (cnt == 1)
+			*data++ = BIT(31) | ptr[0];
+		else {
+			*data++ = ptr[0];
+			*data++ = cnt;
+		}
+
+		for (k = ptr[0]; k <= ptr[1]; k++)
+			adreno_cx_misc_regread(adreno_dev,
+					k - adreno_dev->cx_misc_base, data++);
+	}
+
+	/* Return the size of the section */
+	return (count * sizeof(u32));
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_snapshot.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_snapshot.h
@@ -0,0 +1,134 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2013-2015,2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __ADRENO_SNAPSHOT_H
+#define __ADRENO_SNAPSHOT_H
+
+#include "kgsl_snapshot.h"
+
+#define CP_CRASH_DUMPER_TIMEOUT 500
+
+#define DEBUG_SECTION_SZ(_dwords) (((_dwords) * sizeof(unsigned int)) \
+		+ sizeof(struct kgsl_snapshot_debug))
+
+#define SHADER_SECTION_SZ(_dwords) (((_dwords) * sizeof(unsigned int)) \
+		+ sizeof(struct kgsl_snapshot_shader))
+
+/* Macro to make it super easy to dump registers */
+#define SNAPSHOT_REGISTERS(_d, _s, _r) \
+	adreno_snapshot_registers((_d), (_s), \
+		(unsigned int *) _r, ARRAY_SIZE(_r) /  2)
+
+#define REG_COUNT(_ptr) ((_ptr[1] - _ptr[0]) + 1)
+
+void adreno_snapshot_registers(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot,
+		const unsigned int *regs, unsigned int count);
+
+/**
+ * adreno_snapshot_regs_count - Helper function to calculate register and
+ * header size
+ * @ptr: Pointer to the register array
+ *
+ * Return: Number of registers in the array
+ *
+ * Helper function to count the total number of regsiters
+ * in a given array plus the header space needed for each group.
+ */
+int adreno_snapshot_regs_count(const u32 *ptr);
+
+/**
+ * adreno_snapshot_registers_v2 - Dump a series of registers
+ * @device: Pointer to the kgsl device
+ * @buf: The snapshot buffer
+ * @remain: The size remaining in the snapshot buffer
+ * @priv: Pointer to the register array to be dumped
+ *
+ * Return: Number of bytes written to the snapshot
+ *
+ * This function dumps the registers in a way that we need to
+ * only dump the start address and count for each pair of register
+ * in the array. This helps us save some memory in snapshot.
+ */
+size_t adreno_snapshot_registers_v2(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv);
+
+/**
+ * adreno_snapshot_registers_v2 - Dump a series of CX_MISC registers
+ * @device: Pointer to the kgsl device
+ * @buf: The snapshot buffer
+ * @remain: The size remaining in the snapshot buffer
+ * @priv: Pointer to the CX_MISC register array to be dumped
+ *
+ * Return: Number of bytes written to the snapshot
+ *
+ * This function dumps the CX_MISC registers in a way that we need to
+ * only dump the start address and count for each pair of register
+ * in the array. This helps us save some memory in snapshot.
+ */
+size_t adreno_snapshot_cx_misc_registers(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv);
+
+/**
+ * adreno_parse_ib - Parse the given IB
+ * @device: Pointer to the kgsl device
+ * @snapshot: Pointer to the snapshot structure
+ * @process: Process to which this IB belongs
+ * @gpuaddr: Gpu address of the IB
+ * @dwords: Size in dwords of the IB
+ *
+ * We want to store the last executed IB1 and IB2 in the static region to ensure
+ * that we get at least some information out of the snapshot even if we can't
+ * access the dynamic data from the sysfs file.  Push all other IBs on the
+ * dynamic list
+ */
+void adreno_parse_ib(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot,
+	struct kgsl_process_private *process,
+	u64 gpuaddr, u64 dwords);
+
+/**
+ * adreno_parse_ib_lpac - Parse the given LPAC IB
+ * @device: Pointer to the kgsl device
+ * @snapshot: Pointer to the snapshot structure
+ * @process: Process to which this LPAC IB belongs
+ * @gpuaddr: Gpu address of the LPAC IB
+ * @dwords: Size in dwords of the LPAC IB
+ *
+ * We want to store the last executed LPAC IB1 and IB2 in the static region to ensure
+ * that we get at least some information out of the snapshot even if we can't
+ * access the dynamic data from the sysfs file.  Push all other IBs on the
+ * dynamic list
+ */
+void adreno_parse_ib_lpac(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot,
+	struct kgsl_process_private *process,
+	u64 gpuaddr, u64 dwords);
+
+/**
+ * adreno_snapshot_global - Add global buffer to snapshot
+ * @device: Pointer to the kgsl device
+ * @buf: Where the global buffer section is to be written
+ * @remain: Remaining bytes in snapshot buffer
+ * @priv: Opaque data
+ *
+ * Return: Number of bytes written to the snapshot buffer
+ */
+size_t adreno_snapshot_global(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv);
+
+/**
+ * adreno_snapshot_dump_all_ibs - To dump all ibs from ringbuffer
+ * @device: Pointer to the kgsl device
+ * @rbptr: Ringbuffer host pointer
+ * @snapshot: Pointer to the snapshot structure
+ *
+ * Parse all IBs from the ringbuffer and add to IB dump list.
+ */
+void adreno_snapshot_dump_all_ibs(struct kgsl_device *device,
+			unsigned int *rbptr,
+			struct kgsl_snapshot *snapshot);
+
+#endif /*__ADRENO_SNAPSHOT_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_sysfs.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_sysfs.c
@@ -0,0 +1,457 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/sysfs.h>
+
+#include "adreno.h"
+#include "adreno_sysfs.h"
+#include "kgsl_sysfs.h"
+
+static ssize_t _gpu_model_show(struct kgsl_device *device, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, adreno_get_gpu_model(device));
+}
+
+static ssize_t gpu_model_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return _gpu_model_show(device, buf);
+}
+
+static int _l3_vote_store(struct adreno_device *adreno_dev, bool val)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (ADRENO_FEATURE(adreno_dev, ADRENO_L3_VOTE))
+		device->l3_vote = val;
+
+	return 0;
+}
+
+static bool _l3_vote_show(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	return device->l3_vote;
+}
+
+static int _ft_policy_store(struct adreno_device *adreno_dev,
+		unsigned int val)
+{
+	adreno_dev->ft_policy = val & KGSL_FT_POLICY_MASK;
+	return 0;
+}
+
+static unsigned int _ft_policy_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->ft_policy;
+}
+
+static int _ft_pagefault_policy_store(struct adreno_device *adreno_dev,
+		unsigned int val)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret = 0;
+
+	mutex_lock(&device->mutex);
+	val &= KGSL_FT_PAGEFAULT_MASK;
+
+	if (device->state == KGSL_STATE_ACTIVE)
+		ret = kgsl_mmu_set_pagefault_policy(&device->mmu,
+			(unsigned long) val);
+
+	if (ret == 0)
+		device->mmu.pfpolicy = val;
+
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+static unsigned int _ft_pagefault_policy_show(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	return device->mmu.pfpolicy;
+}
+
+static int _rt_bus_hint_store(struct adreno_device *adreno_dev, u32 val)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	struct kgsl_pwrctrl *pwrctrl = &device->pwrctrl;
+
+	if (val > pwrctrl->pwrlevels[0].bus_max)
+		return -EINVAL;
+
+	adreno_power_cycle_u32(adreno_dev, &pwrctrl->rt_bus_hint, val);
+	return 0;
+}
+
+static u32 _rt_bus_hint_show(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	return device->pwrctrl.rt_bus_hint;
+}
+
+static int _gpu_llc_slice_enable_store(struct adreno_device *adreno_dev,
+		bool val)
+{
+	if (!IS_ERR_OR_NULL(adreno_dev->gpu_llc_slice))
+		adreno_dev->gpu_llc_slice_enable = val;
+	return 0;
+}
+
+static bool _gpu_llc_slice_enable_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->gpu_llc_slice_enable;
+}
+
+static int _gpuhtw_llc_slice_enable_store(struct adreno_device *adreno_dev,
+		bool val)
+{
+	if (!IS_ERR_OR_NULL(adreno_dev->gpuhtw_llc_slice))
+		adreno_dev->gpuhtw_llc_slice_enable = val;
+	return 0;
+}
+
+static bool _gpuhtw_llc_slice_enable_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->gpuhtw_llc_slice_enable;
+}
+
+static bool _ft_hang_intr_status_show(struct adreno_device *adreno_dev)
+{
+	/* Hang interrupt is always on on all targets */
+	return true;
+}
+
+static int _hwcg_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (adreno_dev->hwcg_enabled == val)
+		return 0;
+
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->hwcg_enabled,
+		val);
+}
+
+static bool _hwcg_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->hwcg_enabled;
+}
+
+static int _throttling_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (!adreno_is_a540(adreno_dev) ||
+		adreno_dev->throttling_enabled == val)
+		return 0;
+
+	return adreno_power_cycle_bool(adreno_dev,
+		&adreno_dev->throttling_enabled, val);
+}
+
+static bool _throttling_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->throttling_enabled;
+}
+
+static int _sptp_pc_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_SPTP_PC) ||
+		adreno_dev->sptp_pc_enabled == val)
+		return 0;
+
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->sptp_pc_enabled,
+		val);
+}
+
+static bool _sptp_pc_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->sptp_pc_enabled;
+}
+
+static int _lm_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_LM) ||
+		adreno_dev->lm_enabled == val)
+		return 0;
+
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->lm_enabled,
+		val);
+}
+
+static bool _lm_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->lm_enabled;
+}
+
+static int _ifpc_store(struct adreno_device *adreno_dev, bool val)
+{
+	return gmu_core_dev_ifpc_store(KGSL_DEVICE(adreno_dev), val);
+}
+
+static bool _ifpc_show(struct adreno_device *adreno_dev)
+{
+	return gmu_core_dev_ifpc_isenabled(KGSL_DEVICE(adreno_dev));
+}
+
+static int _touch_wake_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (val)
+		adreno_touch_wake(KGSL_DEVICE(adreno_dev));
+	return 0;
+}
+
+static bool _touch_wake_show(struct adreno_device *adreno_dev)
+{
+	return false;
+}
+
+static unsigned int _ifpc_count_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->ifpc_count;
+}
+
+static bool _acd_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->acd_enabled;
+}
+
+static int _acd_store(struct adreno_device *adreno_dev, bool val)
+{
+	return gmu_core_dev_acd_set(KGSL_DEVICE(adreno_dev), val);
+}
+
+static bool _gmu_ab_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->gmu_ab;
+}
+
+static int _gmu_ab_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (!test_bit(ADRENO_DEVICE_GMU_AB, &adreno_dev->priv) ||
+		(adreno_dev->gmu_ab == val))
+		return 0;
+
+	/* Power cycle the GPU for changes to take effect */
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->gmu_ab, val);
+}
+
+static bool _bcl_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->bcl_enabled;
+}
+
+static int _bcl_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_BCL) ||
+				adreno_dev->bcl_enabled == val)
+		return 0;
+
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->bcl_enabled,
+					val);
+}
+
+static bool _clx_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->clx_enabled;
+}
+
+static int _clx_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (!ADRENO_FEATURE(adreno_dev, ADRENO_CLX) || adreno_dev->clx_enabled == val)
+		return 0;
+
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->clx_enabled, val);
+}
+
+static bool _dms_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->dms_enabled;
+}
+
+static int _dms_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (!test_bit(ADRENO_DEVICE_DMS, &adreno_dev->priv) ||
+		adreno_dev->dms_enabled == val)
+		return 0;
+
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->dms_enabled, val);
+}
+
+static bool _perfcounter_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->perfcounter;
+}
+
+static int _perfcounter_store(struct adreno_device *adreno_dev, bool val)
+{
+	if (adreno_dev->perfcounter == val)
+		return 0;
+
+	return adreno_power_cycle_bool(adreno_dev, &adreno_dev->perfcounter, val);
+}
+
+static bool _lpac_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->lpac_enabled;
+}
+
+static int _lpac_store(struct adreno_device *adreno_dev, bool val)
+{
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (gpudev->lpac_store)
+		return gpudev->lpac_store(adreno_dev, val);
+	else
+		return -EINVAL;
+}
+
+ssize_t adreno_sysfs_store_u32(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_get_drvdata(dev));
+	const struct adreno_sysfs_attribute_u32 *_attr =
+		container_of(attr, struct adreno_sysfs_attribute_u32, attr);
+	u32 val;
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	ret = _attr->store(adreno_dev, val);
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+ssize_t adreno_sysfs_show_u32(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_get_drvdata(dev));
+	const struct adreno_sysfs_attribute_u32 *_attr =
+		container_of(attr, struct adreno_sysfs_attribute_u32, attr);
+
+	return scnprintf(buf, PAGE_SIZE, "0x%X\n", _attr->show(adreno_dev));
+}
+
+ssize_t adreno_sysfs_store_bool(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_get_drvdata(dev));
+	const struct adreno_sysfs_attribute_bool *_attr =
+		container_of(attr, struct adreno_sysfs_attribute_bool, attr);
+	bool val;
+	int ret;
+
+	ret = kstrtobool(buf, &val);
+	if (ret)
+		return ret;
+
+	ret = _attr->store(adreno_dev, val);
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+ssize_t adreno_sysfs_show_bool(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(dev_get_drvdata(dev));
+	const struct adreno_sysfs_attribute_bool *_attr =
+		container_of(attr, struct adreno_sysfs_attribute_bool, attr);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n", _attr->show(adreno_dev));
+}
+
+static ADRENO_SYSFS_U32(ft_policy);
+static ADRENO_SYSFS_U32(ft_pagefault_policy);
+static ADRENO_SYSFS_U32(rt_bus_hint);
+static ADRENO_SYSFS_RO_BOOL(ft_hang_intr_status);
+static ADRENO_SYSFS_BOOL(gpu_llc_slice_enable);
+static ADRENO_SYSFS_BOOL(gpuhtw_llc_slice_enable);
+
+static DEVICE_INT_ATTR(wake_nice, 0644, adreno_wake_nice);
+static DEVICE_INT_ATTR(wake_timeout, 0644, adreno_wake_timeout);
+
+static ADRENO_SYSFS_BOOL(sptp_pc);
+static ADRENO_SYSFS_BOOL(lm);
+static ADRENO_SYSFS_BOOL(hwcg);
+static ADRENO_SYSFS_BOOL(throttling);
+static ADRENO_SYSFS_BOOL(ifpc);
+static ADRENO_SYSFS_RO_U32(ifpc_count);
+static ADRENO_SYSFS_BOOL(acd);
+static ADRENO_SYSFS_BOOL(bcl);
+static ADRENO_SYSFS_BOOL(clx);
+static ADRENO_SYSFS_BOOL(l3_vote);
+static ADRENO_SYSFS_BOOL(perfcounter);
+static ADRENO_SYSFS_BOOL(lpac);
+static ADRENO_SYSFS_BOOL(dms);
+static ADRENO_SYSFS_BOOL(touch_wake);
+static ADRENO_SYSFS_BOOL(gmu_ab);
+
+static DEVICE_ATTR_RO(gpu_model);
+
+static const struct attribute *_attr_list[] = {
+	&adreno_attr_ft_policy.attr.attr,
+	&adreno_attr_ft_pagefault_policy.attr.attr,
+	&adreno_attr_rt_bus_hint.attr.attr,
+	&adreno_attr_ft_hang_intr_status.attr.attr,
+	&dev_attr_wake_nice.attr.attr,
+	&dev_attr_wake_timeout.attr.attr,
+	&adreno_attr_sptp_pc.attr.attr,
+	&adreno_attr_lm.attr.attr,
+	&adreno_attr_hwcg.attr.attr,
+	&adreno_attr_throttling.attr.attr,
+	&adreno_attr_gpu_llc_slice_enable.attr.attr,
+	&adreno_attr_gpuhtw_llc_slice_enable.attr.attr,
+	&adreno_attr_ifpc.attr.attr,
+	&adreno_attr_ifpc_count.attr.attr,
+	&adreno_attr_acd.attr.attr,
+	&adreno_attr_bcl.attr.attr,
+	&dev_attr_gpu_model.attr,
+	&adreno_attr_l3_vote.attr.attr,
+	&adreno_attr_perfcounter.attr.attr,
+	&adreno_attr_lpac.attr.attr,
+	&adreno_attr_dms.attr.attr,
+	&adreno_attr_touch_wake.attr.attr,
+	&adreno_attr_gmu_ab.attr.attr,
+	&adreno_attr_clx.attr.attr,
+	NULL,
+};
+
+static GPU_SYSFS_ATTR(gpu_model, 0444, _gpu_model_show, NULL);
+
+/**
+ * adreno_sysfs_init() - Initialize adreno sysfs files
+ * @adreno_dev: Pointer to the adreno device
+ *
+ * Initialize many of the adreno specific sysfs files especially for fault
+ * tolerance and power control
+ */
+int adreno_sysfs_init(struct adreno_device *adreno_dev)
+{
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+	int ret;
+
+	ret = sysfs_create_files(&device->dev->kobj, _attr_list);
+
+	if (!ret) {
+		/* Notify userspace */
+		kobject_uevent(&device->dev->kobj, KOBJ_ADD);
+
+		ret = sysfs_create_file(&device->gpu_sysfs_kobj,
+			&gpu_sysfs_attr_gpu_model.attr);
+	}
+
+	return ret;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_sysfs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_sysfs.h
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+
+#ifndef _ADRENO_SYSFS_H_
+#define _ADRENO_SYSFS_H_
+
+/*
+ * struct adreno_sysfs_attribute_u32 - Container for accessing and modifying
+ * integers in kgsl via sysfs
+ */
+struct adreno_sysfs_attribute_u32 {
+	/** #attr: The device attribute corresponding to the sysfs node */
+	struct device_attribute attr;
+	/**  @show: Function to show the value of the integer */
+	u32 (*show)(struct adreno_device *adreno_dev);
+	/**  @store: Function to store the value of the integer */
+	int (*store)(struct adreno_device *adreno_dev, u32 val);
+};
+
+/*
+ * struct adreno_sysfs_attribute_bool - Container for accessing and modifying
+ * booleans in kgsl via sysfs
+ */
+struct adreno_sysfs_attribute_bool {
+	/** #attr: The device attribute corresponding to the sysfs node */
+	struct device_attribute attr;
+	/**  @show: Function to show the value of the boolean */
+	bool (*show)(struct adreno_device *adreno_dev);
+	/**  @store: Function to store the value of the boolean */
+	int (*store)(struct adreno_device *adreno_dev, bool val);
+};
+
+/* Helper function to modify an integer in kgsl */
+ssize_t adreno_sysfs_store_u32(struct device *dev,
+	struct device_attribute *attr, const char *buf, size_t count);
+
+/* Helper function to read an integer in kgsl */
+ssize_t adreno_sysfs_show_u32(struct device *dev,
+	struct device_attribute *attr, char *buf);
+
+/* Helper function to modify a boolean in kgsl */
+ssize_t adreno_sysfs_store_bool(struct device *dev,
+	struct device_attribute *attr, const char *buf, size_t count);
+
+/* Helper function to read a boolean in kgsl */
+ssize_t adreno_sysfs_show_bool(struct device *dev,
+	struct device_attribute *attr, char *buf);
+
+#define ADRENO_SYSFS_BOOL(_name) \
+const struct adreno_sysfs_attribute_bool adreno_attr_##_name = { \
+	.attr = __ATTR(_name, 0644, adreno_sysfs_show_bool, \
+			adreno_sysfs_store_bool), \
+	.show = _ ## _name ## _show, \
+	.store = _ ## _name ## _store, \
+}
+
+#define ADRENO_SYSFS_RO_BOOL(_name) \
+const struct adreno_sysfs_attribute_bool adreno_attr_##_name = { \
+	.attr = __ATTR(_name, 0444, adreno_sysfs_show_bool, NULL), \
+	.show = _ ## _name ## _show, \
+}
+
+#define ADRENO_SYSFS_U32(_name) \
+const struct adreno_sysfs_attribute_u32 adreno_attr_##_name = { \
+	.attr = __ATTR(_name, 0644, adreno_sysfs_show_u32, \
+			adreno_sysfs_store_u32), \
+	.show = _ ## _name ## _show, \
+	.store = _ ## _name ## _store, \
+}
+
+#define ADRENO_SYSFS_RO_U32(_name) \
+const struct adreno_sysfs_attribute_u32 adreno_attr_##_name = { \
+	.attr = __ATTR(_name, 0444, adreno_sysfs_show_u32, NULL), \
+	.show = _ ## _name ## _show, \
+}
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_trace.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_trace.c
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/errno.h>
+#include <linux/stddef.h>
+#include <linux/trace.h>
+#include "adreno.h"
+
+/* Instantiate tracepoints */
+#define CREATE_TRACE_POINTS
+#include "adreno_trace.h"
+
+#ifdef CONFIG_QCOM_KGSL_FENCE_TRACE
+static const char * const kgsl_fence_trace_events[] = {
+	"adreno_cmdbatch_submitted",
+	"adreno_cmdbatch_retired",
+	"syncpoint_fence",
+	"syncpoint_fence_expire",
+	"kgsl_fire_event",
+	"kgsl_timeline_fence_alloc",
+	"kgsl_timeline_fence_release",
+};
+
+void adreno_fence_trace_array_init(struct kgsl_device *device)
+{
+	int i;
+
+	device->fence_trace_array = trace_array_get_by_name("kgsl-fence");
+
+	if (!device->fence_trace_array)
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(kgsl_fence_trace_events); i++)
+		trace_array_set_clr_event(device->fence_trace_array,
+			"kgsl", kgsl_fence_trace_events[i], true);
+
+}
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/adreno_trace.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/adreno_trace.h
@@ -0,0 +1,963 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2013-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#if !defined(_ADRENO_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _ADRENO_TRACE_H
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM kgsl
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE adreno_trace
+
+#include <linux/tracepoint.h>
+#include "adreno_a3xx.h"
+#include "adreno_a5xx.h"
+#include "adreno_gen7.h"
+#include "adreno_hfi.h"
+
+#define ADRENO_FT_TYPES \
+	{ BIT(KGSL_FT_OFF), "off" }, \
+	{ BIT(KGSL_FT_REPLAY), "replay" }, \
+	{ BIT(KGSL_FT_SKIPIB), "skipib" }, \
+	{ BIT(KGSL_FT_SKIPFRAME), "skipframe" }, \
+	{ BIT(KGSL_FT_DISABLE), "disable" }, \
+	{ BIT(KGSL_FT_TEMP_DISABLE), "temp" }, \
+	{ BIT(KGSL_FT_THROTTLE), "throttle"}, \
+	{ BIT(KGSL_FT_SKIPCMD), "skipcmd" }
+
+TRACE_EVENT(adreno_cmdbatch_queued,
+	TP_PROTO(struct kgsl_drawobj *drawobj, unsigned int queued),
+	TP_ARGS(drawobj, queued),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned int, timestamp)
+		__field(unsigned int, queued)
+		__field(unsigned int, flags)
+		__field(unsigned int, prio)
+	),
+	TP_fast_assign(
+		__entry->id = drawobj->context->id;
+		__entry->timestamp = drawobj->timestamp;
+		__entry->queued = queued;
+		__entry->flags = drawobj->flags;
+		__entry->prio = drawobj->context->priority;
+	),
+	TP_printk(
+		"ctx=%u ctx_prio=%u ts=%u queued=%u flags=%s",
+			__entry->id, __entry->prio,
+			__entry->timestamp, __entry->queued,
+			__entry->flags ? __print_flags(__entry->flags, "|",
+						KGSL_DRAWOBJ_FLAGS) : "none"
+	)
+);
+
+TRACE_EVENT(adreno_hw_fence_query,
+	TP_PROTO(u64 context, u64 seqno, u32 flags, const char *name, const char *val),
+	TP_ARGS(context, seqno, flags, name, val),
+	TP_STRUCT__entry(
+		__field(u64, context)
+		__field(u64, seqno)
+		__field(u32, flags)
+		__string(fence_name, name)
+		__string(val, val)
+	),
+	TP_fast_assign(
+		__entry->context = context;
+		__entry->seqno = seqno;
+		__entry->flags = flags;
+		__assign_str(fence_name, name);
+		__assign_str(val, val);
+	),
+	TP_printk(
+		"id=%lld seqno=%lld sw_status=%s name=%s val=%s",
+			__entry->context, __entry->seqno,
+			__entry->flags ? __print_flags(__entry->flags, "|",
+				{ ADRENO_HW_FENCE_SW_STATUS_PENDING, "PENDING" },
+				{ ADRENO_HW_FENCE_SW_STATUS_SIGNALED, "SIGNALED" }) : "none",
+			__get_str(fence_name),
+			__get_str(val))
+);
+
+TRACE_EVENT(adreno_input_hw_fence,
+	TP_PROTO(u32 id, u64 context, u64 seqno, u64 flags, const char *name),
+	TP_ARGS(id, context, seqno, flags, name),
+	TP_STRUCT__entry(
+		__field(u32, id)
+		__field(u64, context)
+		__field(u64, seqno)
+		__field(u64, flags)
+		__string(fence_name, name)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->context = context;
+		__entry->seqno = seqno;
+		__entry->flags = flags;
+		__assign_str(fence_name, name);
+	),
+	TP_printk(
+		"ctx=%u id=%lld seqno=%lld flags=%s name=%s",
+			__entry->id,  __entry->context, __entry->seqno,
+			__entry->flags ? __print_flags(__entry->flags, "|",
+				GMU_SYNCOBJ_FLAGS) : "none",
+			__get_str(fence_name))
+);
+
+TRACE_EVENT(adreno_syncobj_query_reply,
+	TP_PROTO(u32 id, u32 timestamp, uint64_t ticks),
+	TP_ARGS(id, timestamp, ticks),
+	TP_STRUCT__entry(
+		__field(u32, id)
+		__field(u32, timestamp)
+		__field(uint64_t, ticks)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->timestamp = timestamp;
+		__entry->ticks = ticks;
+	),
+	TP_printk(
+		"ctx=%u ts=%u ticks=%lld",
+			__entry->id, __entry->timestamp, __entry->ticks)
+);
+
+TRACE_EVENT(adreno_syncobj_query,
+	TP_PROTO(u32 id, u32 timestamp, uint64_t ticks),
+	TP_ARGS(id, timestamp, ticks),
+	TP_STRUCT__entry(
+		__field(u32, id)
+		__field(u32, timestamp)
+		__field(uint64_t, ticks)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->timestamp = timestamp;
+		__entry->ticks = ticks;
+	),
+	TP_printk(
+		"ctx=%u ts=%u ticks=%lld",
+			__entry->id, __entry->timestamp, __entry->ticks)
+);
+
+TRACE_EVENT(adreno_syncobj_submitted,
+	TP_PROTO(u32 id, u32 timestamp, u32 num_syncobj,
+		uint64_t ticks),
+	TP_ARGS(id, timestamp, num_syncobj, ticks),
+	TP_STRUCT__entry(
+		__field(u32, id)
+		__field(u32, timestamp)
+		__field(u32, num_syncobj)
+		__field(uint64_t, ticks)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->timestamp = timestamp;
+		__entry->num_syncobj = num_syncobj;
+		__entry->ticks = ticks;
+	),
+	TP_printk(
+		"ctx=%u ts=%u num_sync=%u ticks=%lld",
+			__entry->id, __entry->timestamp, __entry->num_syncobj, __entry->ticks)
+);
+
+TRACE_EVENT(adreno_syncobj_retired,
+	TP_PROTO(u32 id, u32 timestamp),
+	TP_ARGS(id, timestamp),
+	TP_STRUCT__entry(
+		__field(u32, id)
+		__field(u32, timestamp)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->timestamp = timestamp;
+	),
+	TP_printk(
+		"ctx=%u ts=%u", __entry->id, __entry->timestamp)
+);
+
+TRACE_EVENT(adreno_cmdbatch_submitted,
+	TP_PROTO(struct kgsl_drawobj *drawobj, struct submission_info *info,
+		uint64_t ticks, unsigned long secs, unsigned long usecs,
+		int q_inflight),
+	TP_ARGS(drawobj, info, ticks, secs, usecs, q_inflight),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned int, timestamp)
+		__field(int, inflight)
+		__field(unsigned int, flags)
+		__field(uint64_t, ticks)
+		__field(unsigned long, secs)
+		__field(unsigned long, usecs)
+		__field(int, prio)
+		__field(int, rb_id)
+		__field(unsigned int, rptr)
+		__field(unsigned int, wptr)
+		__field(int, q_inflight)
+		__field(int, dispatch_queue)
+	),
+	TP_fast_assign(
+		__entry->id = drawobj->context->id;
+		__entry->timestamp = drawobj->timestamp;
+		__entry->inflight = info->inflight;
+		__entry->flags = drawobj->flags;
+		__entry->ticks = ticks;
+		__entry->secs = secs;
+		__entry->usecs = usecs;
+		__entry->prio = drawobj->context->priority;
+		__entry->rb_id = info->rb_id;
+		__entry->rptr = info->rptr;
+		__entry->wptr = info->wptr;
+		__entry->q_inflight = q_inflight;
+		__entry->dispatch_queue = info->gmu_dispatch_queue;
+	),
+	TP_printk(
+		"ctx=%u ctx_prio=%d ts=%u inflight=%d flags=%s ticks=%lld time=%lu.%0lu rb_id=%d r/w=%x/%x, q_inflight=%d dq_id=%d",
+			__entry->id, __entry->prio, __entry->timestamp,
+			__entry->inflight,
+			__entry->flags ? __print_flags(__entry->flags, "|",
+				KGSL_DRAWOBJ_FLAGS) : "none",
+			__entry->ticks, __entry->secs, __entry->usecs,
+			__entry->rb_id, __entry->rptr, __entry->wptr,
+			__entry->q_inflight, __entry->dispatch_queue
+	)
+);
+
+TRACE_EVENT(adreno_cmdbatch_retired,
+		TP_PROTO(struct kgsl_context *context, struct retire_info *info,
+			unsigned int flags, int q_inflight,
+			unsigned long fault_recovery),
+	TP_ARGS(context, info, flags, q_inflight, fault_recovery),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned int, timestamp)
+		__field(int, inflight)
+		__field(unsigned int, recovery)
+		__field(unsigned int, flags)
+		__field(uint64_t, start)
+		__field(uint64_t, retire)
+		__field(int, prio)
+		__field(int, rb_id)
+		__field(unsigned int, rptr)
+		__field(unsigned int, wptr)
+		__field(int, q_inflight)
+		__field(unsigned long, fault_recovery)
+		__field(unsigned int, dispatch_queue)
+		__field(uint64_t, submitted_to_rb)
+		__field(uint64_t, retired_on_gmu)
+		__field(uint64_t, active)
+		),
+	TP_fast_assign(
+		__entry->id = context->id;
+		__entry->timestamp = info->timestamp;
+		__entry->inflight = info->inflight;
+		__entry->recovery = fault_recovery;
+		__entry->flags = flags;
+		__entry->start = info->sop;
+		__entry->retire = info->eop;
+		__entry->prio = context->priority;
+		__entry->rb_id = info->rb_id;
+		__entry->rptr = info->rptr;
+		__entry->wptr = info->wptr;
+		__entry->q_inflight = q_inflight;
+		__entry->dispatch_queue = info->gmu_dispatch_queue;
+		__entry->submitted_to_rb = info->submitted_to_rb;
+		__entry->retired_on_gmu = info->retired_on_gmu;
+		__entry->active = info->active;
+		),
+
+	TP_printk(
+		"ctx=%u ctx_prio=%d ts=%u inflight=%d recovery=%s flags=%s start=%llu retire=%llu rb_id=%d, r/w=%x/%x, q_inflight=%d, dq_id=%u, submitted_to_rb=%llu retired_on_gmu=%llu active=%llu",
+			__entry->id, __entry->prio, __entry->timestamp,
+			__entry->inflight,
+			__entry->recovery ?
+				__print_flags(__entry->fault_recovery, "|",
+				ADRENO_FT_TYPES) : "none",
+			__entry->flags ? __print_flags(__entry->flags, "|",
+				KGSL_DRAWOBJ_FLAGS) : "none",
+			__entry->start,
+			__entry->retire,
+			__entry->rb_id, __entry->rptr, __entry->wptr,
+			__entry->q_inflight,
+			__entry->dispatch_queue,
+			__entry->submitted_to_rb, __entry->retired_on_gmu,
+			__entry->active
+	 )
+);
+
+TRACE_EVENT(gmu_ao_sync,
+	TP_PROTO(u64 ticks),
+	TP_ARGS(ticks),
+	TP_STRUCT__entry(
+		__field(u64, ticks)
+	),
+	TP_fast_assign(
+		__entry->ticks = ticks;
+	),
+	TP_printk(
+		"ticks=%llu", __entry->ticks
+	)
+);
+
+TRACE_EVENT(gmu_event,
+	TP_PROTO(u32 *event_info),
+	TP_ARGS(event_info),
+	TP_STRUCT__entry(
+		__field(u32, event)
+		__field(u32, ticks)
+		__field(u32, data1)
+		__field(u32, data2)
+	),
+	TP_fast_assign(
+		__entry->event = event_info[0];
+		__entry->ticks = event_info[1];
+		__entry->data1 = event_info[2];
+		__entry->data2 = event_info[3];
+	),
+	TP_printk(
+		"event=%08u ticks=%08u data1=0x%08x data2=0x%08x",
+		__entry->event, __entry->ticks, __entry->data1, __entry->data2
+	)
+);
+
+TRACE_EVENT(adreno_cmdbatch_sync,
+	TP_PROTO(unsigned int ctx_id, unsigned int ctx_prio,
+		unsigned int timestamp,	uint64_t ticks),
+	TP_ARGS(ctx_id, ctx_prio, timestamp, ticks),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned int, timestamp)
+		__field(uint64_t, ticks)
+		__field(int, prio)
+	),
+	TP_fast_assign(
+		__entry->id = ctx_id;
+		__entry->timestamp = timestamp;
+		__entry->ticks = ticks;
+		__entry->prio = ctx_prio;
+	),
+	TP_printk(
+		"ctx=%u ctx_prio=%d ts=%u ticks=%lld",
+			__entry->id, __entry->prio, __entry->timestamp,
+			__entry->ticks
+	)
+);
+
+TRACE_EVENT(adreno_cmdbatch_ready,
+	TP_PROTO(unsigned int ctx_id, unsigned int ctx_prio,
+		unsigned int timestamp, unsigned int requeue_cnt),
+	TP_ARGS(ctx_id, ctx_prio, timestamp, requeue_cnt),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(int, prio)
+		__field(unsigned int, timestamp)
+		__field(unsigned int, requeue_cnt)
+	),
+	TP_fast_assign(
+		__entry->id = ctx_id;
+		__entry->prio = ctx_prio;
+		__entry->timestamp = timestamp;
+		__entry->requeue_cnt = requeue_cnt;
+	),
+	TP_printk(
+		"ctx=%u ctx_prio=%d ts=%u requeue_cnt=%u",
+			__entry->id, __entry->prio, __entry->timestamp,
+			__entry->requeue_cnt
+	)
+);
+
+TRACE_EVENT(adreno_cmdbatch_done,
+	TP_PROTO(unsigned int ctx_id, unsigned int ctx_prio,
+		unsigned int timestamp),
+	TP_ARGS(ctx_id, ctx_prio, timestamp),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned int, prio)
+		__field(unsigned int, timestamp)
+	),
+	TP_fast_assign(
+		__entry->id = ctx_id;
+		__entry->prio = ctx_prio;
+		__entry->timestamp = timestamp;
+	),
+	TP_printk(
+		"ctx=%u ctx_prio=%u ts=%u",
+			__entry->id, __entry->prio, __entry->timestamp
+	)
+);
+
+TRACE_EVENT(adreno_cmdbatch_fault,
+	TP_PROTO(struct kgsl_drawobj_cmd *cmdobj, unsigned int fault),
+	TP_ARGS(cmdobj, fault),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned int, timestamp)
+		__field(unsigned int, fault)
+	),
+	TP_fast_assign(
+		__entry->id = cmdobj->base.context->id;
+		__entry->timestamp = cmdobj->base.timestamp;
+		__entry->fault = fault;
+	),
+	TP_printk(
+		"ctx=%u ts=%u type=%s",
+			__entry->id, __entry->timestamp,
+			__print_symbolic(__entry->fault,
+				{ 0, "none" },
+				{ ADRENO_SOFT_FAULT, "soft" },
+				{ ADRENO_HARD_FAULT, "hard" },
+				{ ADRENO_TIMEOUT_FAULT, "timeout" })
+	)
+);
+
+TRACE_EVENT(adreno_cmdbatch_recovery,
+	TP_PROTO(struct kgsl_drawobj_cmd *cmdobj, unsigned int action),
+	TP_ARGS(cmdobj, action),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned int, timestamp)
+		__field(unsigned int, action)
+	),
+	TP_fast_assign(
+		__entry->id = cmdobj->base.context->id;
+		__entry->timestamp = cmdobj->base.timestamp;
+		__entry->action = action;
+	),
+	TP_printk(
+		"ctx=%u ts=%u action=%s",
+			__entry->id, __entry->timestamp,
+			__print_symbolic(__entry->action, ADRENO_FT_TYPES)
+	)
+);
+
+DECLARE_EVENT_CLASS(adreno_drawctxt_template,
+	TP_PROTO(struct adreno_context *drawctxt),
+	TP_ARGS(drawctxt),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned int, priority)
+	),
+	TP_fast_assign(
+		__entry->id = drawctxt->base.id;
+		__entry->priority = drawctxt->base.priority;
+	),
+	TP_printk("ctx=%u priority=%u", __entry->id, __entry->priority)
+);
+
+DEFINE_EVENT(adreno_drawctxt_template, adreno_drawctxt_sleep,
+	TP_PROTO(struct adreno_context *drawctxt),
+	TP_ARGS(drawctxt)
+);
+
+DEFINE_EVENT(adreno_drawctxt_template, adreno_drawctxt_wake,
+	TP_PROTO(struct adreno_context *drawctxt),
+	TP_ARGS(drawctxt)
+);
+
+DEFINE_EVENT(adreno_drawctxt_template, dispatch_queue_context,
+	TP_PROTO(struct adreno_context *drawctxt),
+	TP_ARGS(drawctxt)
+);
+
+DEFINE_EVENT(adreno_drawctxt_template, adreno_drawctxt_invalidate,
+	TP_PROTO(struct adreno_context *drawctxt),
+	TP_ARGS(drawctxt)
+);
+
+TRACE_EVENT(adreno_drawctxt_wait_start,
+	TP_PROTO(unsigned int rb_id, unsigned int ctx_id, unsigned int ts),
+	TP_ARGS(rb_id, ctx_id, ts),
+	TP_STRUCT__entry(
+		__field(unsigned int, rb_id)
+		__field(unsigned int, ctx_id)
+		__field(unsigned int, ts)
+	),
+	TP_fast_assign(
+		__entry->rb_id = rb_id;
+		__entry->ctx_id = ctx_id;
+		__entry->ts = ts;
+	),
+	TP_printk(
+		"rb=%u ctx=%u ts=%u",
+			__entry->rb_id, __entry->ctx_id, __entry->ts
+	)
+);
+
+TRACE_EVENT(adreno_drawctxt_wait_done,
+	TP_PROTO(unsigned int rb_id, unsigned int ctx_id,
+			unsigned int ts, int status),
+	TP_ARGS(rb_id, ctx_id, ts, status),
+	TP_STRUCT__entry(
+		__field(unsigned int, rb_id)
+		__field(unsigned int, ctx_id)
+		__field(unsigned int, ts)
+		__field(int, status)
+	),
+	TP_fast_assign(
+		__entry->rb_id = rb_id;
+		__entry->ctx_id = ctx_id;
+		__entry->ts = ts;
+		__entry->status = status;
+	),
+	TP_printk(
+		"rb=%u ctx=%u ts=%u status=%d",
+		__entry->rb_id, __entry->ctx_id, __entry->ts, __entry->status
+	)
+);
+
+TRACE_EVENT(adreno_drawctxt_switch,
+	TP_PROTO(struct adreno_ringbuffer *rb,
+		struct adreno_context *newctx),
+	TP_ARGS(rb, newctx),
+	TP_STRUCT__entry(
+		__field(int, rb_level)
+		__field(unsigned int, oldctx)
+		__field(unsigned int, newctx)
+		__field(unsigned int, flags)
+	),
+	TP_fast_assign(
+		__entry->rb_level = rb->id;
+		__entry->oldctx = rb->drawctxt_active ?
+			rb->drawctxt_active->base.id : 0;
+		__entry->newctx = newctx ? newctx->base.id : 0;
+	),
+	TP_printk(
+		"rb level=%d oldctx=%u newctx=%u",
+		__entry->rb_level, __entry->oldctx, __entry->newctx
+	)
+);
+
+TRACE_EVENT(adreno_gpu_fault,
+	TP_PROTO(unsigned int ctx, unsigned int ts,
+		unsigned int status, unsigned int rptr, unsigned int wptr,
+		u64 ib1base, unsigned int ib1size,
+		u64 ib2base, unsigned int ib2size, int rb_id),
+	TP_ARGS(ctx, ts, status, rptr, wptr, ib1base, ib1size, ib2base,
+		ib2size, rb_id),
+	TP_STRUCT__entry(
+		__field(unsigned int, ctx)
+		__field(unsigned int, ts)
+		__field(unsigned int, status)
+		__field(unsigned int, rptr)
+		__field(unsigned int, wptr)
+		__field(u64, ib1base)
+		__field(unsigned int, ib1size)
+		__field(u64, ib2base)
+		__field(unsigned int, ib2size)
+		__field(int, rb_id)
+	),
+	TP_fast_assign(
+		__entry->ctx = ctx;
+		__entry->ts = ts;
+		__entry->status = status;
+		__entry->rptr = rptr;
+		__entry->wptr = wptr;
+		__entry->ib1base = ib1base;
+		__entry->ib1size = ib1size;
+		__entry->ib2base = ib2base;
+		__entry->ib2size = ib2size;
+		__entry->rb_id = rb_id;
+	),
+	TP_printk(
+		"ctx=%d ts=%d rb_id=%d status=%X RB=%X/%X IB1=%llX/%X IB2=%llX/%X",
+		__entry->ctx, __entry->ts, __entry->rb_id, __entry->status,
+		__entry->wptr, __entry->rptr, __entry->ib1base,
+		__entry->ib1size, __entry->ib2base, __entry->ib2size)
+);
+
+TRACE_EVENT(adreno_sp_tp,
+
+	TP_PROTO(unsigned long ip),
+
+	TP_ARGS(ip),
+
+	TP_STRUCT__entry(
+		__field(unsigned long, ip)
+	),
+
+	TP_fast_assign(
+		__entry->ip = ip;
+	),
+
+	TP_printk(
+		"func=%pS", (void *) __entry->ip
+	)
+);
+
+/*
+ * Tracepoint for a3xx irq. Includes status info
+ */
+TRACE_EVENT(kgsl_a3xx_irq_status,
+
+	TP_PROTO(struct adreno_device *adreno_dev, unsigned int status),
+
+	TP_ARGS(adreno_dev, status),
+
+	TP_STRUCT__entry(
+		__string(device_name, adreno_dev->dev.name)
+		__field(unsigned int, status)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, adreno_dev->dev.name);
+		__entry->status = status;
+	),
+
+	TP_printk(
+		"d_name=%s status=%s",
+		__get_str(device_name),
+		__entry->status ? __print_flags(__entry->status, "|",
+			{ BIT(A3XX_INT_RBBM_GPU_IDLE), "RBBM_GPU_IDLE" },
+			{ BIT(A3XX_INT_RBBM_AHB_ERROR), "RBBM_AHB_ERR" },
+			{ BIT(A3XX_INT_RBBM_REG_TIMEOUT), "RBBM_REG_TIMEOUT" },
+			{ BIT(A3XX_INT_RBBM_ME_MS_TIMEOUT),
+				"RBBM_ME_MS_TIMEOUT" },
+			{ BIT(A3XX_INT_RBBM_PFP_MS_TIMEOUT),
+				"RBBM_PFP_MS_TIMEOUT" },
+			{ BIT(A3XX_INT_RBBM_ATB_BUS_OVERFLOW),
+				"RBBM_ATB_BUS_OVERFLOW" },
+			{ BIT(A3XX_INT_VFD_ERROR), "RBBM_VFD_ERROR" },
+			{ BIT(A3XX_INT_CP_SW_INT), "CP_SW" },
+			{ BIT(A3XX_INT_CP_T0_PACKET_IN_IB),
+				"CP_T0_PACKET_IN_IB" },
+			{ BIT(A3XX_INT_CP_OPCODE_ERROR), "CP_OPCODE_ERROR" },
+			{ BIT(A3XX_INT_CP_RESERVED_BIT_ERROR),
+				"CP_RESERVED_BIT_ERROR" },
+			{ BIT(A3XX_INT_CP_HW_FAULT), "CP_HW_FAULT" },
+			{ BIT(A3XX_INT_CP_DMA), "CP_DMA" },
+			{ BIT(A3XX_INT_CP_IB2_INT), "CP_IB2_INT" },
+			{ BIT(A3XX_INT_CP_IB1_INT), "CP_IB1_INT" },
+			{ BIT(A3XX_INT_CP_RB_INT), "CP_RB_INT" },
+			{ BIT(A3XX_INT_CP_REG_PROTECT_FAULT),
+				"CP_REG_PROTECT_FAULT" },
+			{ BIT(A3XX_INT_CP_RB_DONE_TS), "CP_RB_DONE_TS" },
+			{ BIT(A3XX_INT_CP_VS_DONE_TS), "CP_VS_DONE_TS" },
+			{ BIT(A3XX_INT_CP_PS_DONE_TS), "CP_PS_DONE_TS" },
+			{ BIT(A3XX_INT_CACHE_FLUSH_TS), "CACHE_FLUSH_TS" },
+			{ BIT(A3XX_INT_CP_AHB_ERROR_HALT),
+				"CP_AHB_ERROR_HALT" },
+			{ BIT(A3XX_INT_MISC_HANG_DETECT), "MISC_HANG_DETECT" },
+			{ BIT(A3XX_INT_UCHE_OOB_ACCESS), "UCHE_OOB_ACCESS" })
+			: "None"
+	)
+);
+
+/*
+ * Tracepoint for a5xx irq. Includes status info
+ */
+TRACE_EVENT(kgsl_a5xx_irq_status,
+
+	TP_PROTO(struct adreno_device *adreno_dev, unsigned int status),
+
+	TP_ARGS(adreno_dev, status),
+
+	TP_STRUCT__entry(
+		__string(device_name, adreno_dev->dev.name)
+		__field(unsigned int, status)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, adreno_dev->dev.name);
+		__entry->status = status;
+	),
+
+	TP_printk(
+		"d_name=%s status=%s",
+		__get_str(device_name),
+		__entry->status ? __print_flags(__entry->status, "|",
+			{ BIT(A5XX_INT_RBBM_GPU_IDLE), "RBBM_GPU_IDLE" },
+			{ BIT(A5XX_INT_RBBM_AHB_ERROR), "RBBM_AHB_ERR" },
+			{ BIT(A5XX_INT_RBBM_TRANSFER_TIMEOUT),
+				"RBBM_TRANSFER_TIMEOUT" },
+			{ BIT(A5XX_INT_RBBM_ME_MS_TIMEOUT),
+				"RBBM_ME_MS_TIMEOUT" },
+			{ BIT(A5XX_INT_RBBM_PFP_MS_TIMEOUT),
+				"RBBM_PFP_MS_TIMEOUT" },
+			{ BIT(A5XX_INT_RBBM_ETS_MS_TIMEOUT),
+				"RBBM_ETS_MS_TIMEOUT" },
+			{ BIT(A5XX_INT_RBBM_ATB_ASYNC_OVERFLOW),
+				"RBBM_ATB_ASYNC_OVERFLOW" },
+			{ BIT(A5XX_INT_RBBM_GPC_ERROR), "RBBM_GPC_ERR" },
+			{ BIT(A5XX_INT_CP_SW), "CP_SW" },
+			{ BIT(A5XX_INT_CP_HW_ERROR), "CP_OPCODE_ERROR" },
+			{ BIT(A5XX_INT_CP_CCU_FLUSH_DEPTH_TS),
+				"CP_CCU_FLUSH_DEPTH_TS" },
+			{ BIT(A5XX_INT_CP_CCU_FLUSH_COLOR_TS),
+				"CP_CCU_FLUSH_COLOR_TS" },
+			{ BIT(A5XX_INT_CP_CCU_RESOLVE_TS),
+				"CP_CCU_RESOLVE_TS" },
+			{ BIT(A5XX_INT_CP_IB2), "CP_IB2_INT" },
+			{ BIT(A5XX_INT_CP_IB1), "CP_IB1_INT" },
+			{ BIT(A5XX_INT_CP_RB), "CP_RB_INT" },
+			{ BIT(A5XX_INT_CP_UNUSED_1), "CP_UNUSED_1" },
+			{ BIT(A5XX_INT_CP_RB_DONE_TS), "CP_RB_DONE_TS" },
+			{ BIT(A5XX_INT_CP_WT_DONE_TS), "CP_WT_DONE_TS" },
+			{ BIT(A5XX_INT_UNKNOWN_1), "UNKNOWN_1" },
+			{ BIT(A5XX_INT_CP_CACHE_FLUSH_TS),
+				"CP_CACHE_FLUSH_TS" },
+			{ BIT(A5XX_INT_UNUSED_2), "UNUSED_2" },
+			{ BIT(A5XX_INT_RBBM_ATB_BUS_OVERFLOW),
+				"RBBM_ATB_BUS_OVERFLOW" },
+			{ BIT(A5XX_INT_MISC_HANG_DETECT), "MISC_HANG_DETECT" },
+			{ BIT(A5XX_INT_UCHE_OOB_ACCESS), "UCHE_OOB_ACCESS" },
+			{ BIT(A5XX_INT_UCHE_TRAP_INTR), "UCHE_TRAP_INTR" },
+			{ BIT(A5XX_INT_DEBBUS_INTR_0), "DEBBUS_INTR_0" },
+			{ BIT(A5XX_INT_DEBBUS_INTR_1), "DEBBUS_INTR_1" },
+			{ BIT(A5XX_INT_GPMU_VOLTAGE_DROOP),
+				"GPMU_VOLTAGE_DROOP" },
+			{ BIT(A5XX_INT_GPMU_FIRMWARE), "GPMU_FIRMWARE" },
+			{ BIT(A5XX_INT_ISDB_CPU_IRQ), "ISDB_CPU_IRQ" },
+			{ BIT(A5XX_INT_ISDB_UNDER_DEBUG), "ISDB_UNDER_DEBUG" })
+			: "None"
+	)
+);
+
+/*
+ * Tracepoint for gen7 irq. Includes status info
+ */
+TRACE_EVENT(kgsl_gen7_irq_status,
+
+	TP_PROTO(struct adreno_device *adreno_dev, unsigned int status),
+
+	TP_ARGS(adreno_dev, status),
+
+	TP_STRUCT__entry(
+		__string(device_name, adreno_dev->dev.name)
+		__field(unsigned int, status)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, adreno_dev->dev.name);
+		__entry->status = status;
+	),
+
+	TP_printk(
+		"d_name=%s status=%s",
+		__get_str(device_name),
+		__entry->status ? __print_flags(__entry->status, "|",
+			{ BIT(GEN7_INT_GPUIDLE), "GPUIDLE" },
+			{ BIT(GEN7_INT_AHBERROR), "AHBERROR" },
+			{ BIT(GEN7_INT_CPIPCINT0), "CPIPCINT0" },
+			{ BIT(GEN7_INT_CPIPCINT1), "CPIPCINT1" },
+			{ BIT(GEN7_INT_ATBASYNCFIFOOVERFLOW),
+				"ATBASYNCFIFOOVERFLOW" },
+			{ BIT(GEN7_INT_GPCERROR), "GPCERROR" },
+			{ BIT(GEN7_INT_SWINTERRUPT), "SWINTERRUPT" },
+			{ BIT(GEN7_INT_HWERROR), "HWERROR" },
+			{ BIT(GEN7_INT_CCU_CLEAN_DEPTH_TS),
+				"CCU_CLEAN_DEPTH_TS" },
+			{ BIT(GEN7_INT_CCU_CLEAN_COLOR_TS),
+				"CCU_CLEAN_COLOR_TS" },
+			{ BIT(GEN7_INT_CCU_RESOLVE_CLEAN_TS),
+				"CCU_RESOLVE_CLEAN_TS" },
+			{ BIT(GEN7_INT_PM4CPINTERRUPT), "PM4CPINTERRUPT" },
+			{ BIT(GEN7_INT_PM4CPINTERRUPTLPAC),
+				"PM4CPINTERRUPTLPAC" },
+			{ BIT(GEN7_INT_RB_DONE_TS), "RB_DONE_TS" },
+			{ BIT(GEN7_INT_CACHE_CLEAN_TS), "CACHE_CLEAN_TS" },
+			{ BIT(GEN7_INT_CACHE_CLEAN_TS_LPAC),
+				"CACHE_CLEAN_TS_LPAC" },
+			{ BIT(GEN7_INT_ATBBUSOVERFLOW), "ATBBUSOVERFLOW" },
+			{ BIT(GEN7_INT_HANGDETECTINTERRUPT),
+				"HANGDETECTINTERRUPT" },
+			{ BIT(GEN7_INT_OUTOFBOUNDACCESS),
+				"OUTOFBOUNDACCESS" },
+			{ BIT(GEN7_INT_UCHETRAPINTERRUPT),
+				"UCHETRAPINTERRUPT" },
+			{ BIT(GEN7_INT_DEBUGBUSINTERRUPT0),
+				"DEBUGBUSINTERRUPT0" },
+			{ BIT(GEN7_INT_DEBUGBUSINTERRUPT1),
+				"DEBUGBUSINTERRUPT1" },
+			{ BIT(GEN7_INT_TSBWRITEERROR), "TSBWRITEERROR" },
+			{ BIT(GEN7_INT_SWFUSEVIOLATION), "SWFUSEVIOLATION" },
+			{ BIT(GEN7_INT_ISDBCPUIRQ), "ISDBCPUIRQ" },
+			{ BIT(GEN7_INT_ISDBUNDERDEBUG), "ISDBUNDERDEBUG" },
+			{ BIT(GEN7_INT_ISDBUNDERDEBUG), "ISDBUNDERDEBUG" })
+			: "None"
+	)
+);
+
+DECLARE_EVENT_CLASS(adreno_hw_preempt_template,
+	TP_PROTO(struct adreno_ringbuffer *cur_rb,
+		struct adreno_ringbuffer *new_rb,
+		unsigned int cur_rptr, unsigned int new_rptr),
+	TP_ARGS(cur_rb, new_rb, cur_rptr, new_rptr),
+	TP_STRUCT__entry(__field(int, cur_level)
+			__field(int, new_level)
+			__field(unsigned int, cur_rptr)
+			__field(unsigned int, new_rptr)
+			__field(unsigned int, cur_wptr)
+			__field(unsigned int, new_wptr)
+			__field(unsigned int, cur_rbbase)
+			__field(unsigned int, new_rbbase)
+	),
+	TP_fast_assign(__entry->cur_level = cur_rb->id;
+			__entry->new_level = new_rb->id;
+			__entry->cur_rptr = cur_rptr;
+			__entry->new_rptr = new_rptr;
+			__entry->cur_wptr = cur_rb->wptr;
+			__entry->new_wptr = new_rb->wptr;
+			__entry->cur_rbbase = cur_rb->buffer_desc->gpuaddr;
+			__entry->new_rbbase = new_rb->buffer_desc->gpuaddr;
+	),
+	TP_printk(
+	"cur_rb_lvl=%d rptr=%x wptr=%x rbbase=%x new_rb_lvl=%d rptr=%x wptr=%x rbbase=%x",
+		__entry->cur_level, __entry->cur_rptr,
+		__entry->cur_wptr, __entry->cur_rbbase,
+		__entry->new_level, __entry->new_rptr,
+		__entry->new_wptr, __entry->new_rbbase
+	)
+);
+
+DEFINE_EVENT(adreno_hw_preempt_template, adreno_hw_preempt_clear_to_trig,
+	TP_PROTO(struct adreno_ringbuffer *cur_rb,
+		struct adreno_ringbuffer *new_rb,
+		unsigned int cur_rptr, unsigned int new_rptr),
+	TP_ARGS(cur_rb, new_rb, cur_rptr, new_rptr)
+);
+
+DEFINE_EVENT(adreno_hw_preempt_template, adreno_hw_preempt_trig_to_comp,
+	TP_PROTO(struct adreno_ringbuffer *cur_rb,
+		struct adreno_ringbuffer *new_rb,
+		unsigned int cur_rptr, unsigned int new_rptr),
+	TP_ARGS(cur_rb, new_rb, cur_rptr, new_rptr)
+);
+
+DEFINE_EVENT(adreno_hw_preempt_template, adreno_hw_preempt_trig_to_comp_int,
+	TP_PROTO(struct adreno_ringbuffer *cur_rb,
+		struct adreno_ringbuffer *new_rb,
+		unsigned int cur_rptr, unsigned int new_rptr),
+	TP_ARGS(cur_rb, new_rb, cur_rptr, new_rptr)
+);
+
+TRACE_EVENT(adreno_hw_preempt_comp_to_clear,
+	TP_PROTO(struct adreno_ringbuffer *cur_rb,
+		struct adreno_ringbuffer *new_rb,
+		unsigned int cur_rptr, unsigned int new_rptr),
+	TP_ARGS(cur_rb, new_rb, cur_rptr, new_rptr),
+	TP_STRUCT__entry(__field(int, cur_level)
+			__field(int, new_level)
+			__field(unsigned int, cur_rptr)
+			__field(unsigned int, new_rptr)
+			__field(unsigned int, cur_wptr)
+			__field(unsigned int, new_wptr_end)
+			__field(unsigned int, new_wptr)
+			__field(unsigned int, cur_rbbase)
+			__field(unsigned int, new_rbbase)
+	),
+	TP_fast_assign(__entry->cur_level = cur_rb->id;
+			__entry->new_level = new_rb->id;
+			__entry->cur_rptr = cur_rptr;
+			__entry->new_rptr = new_rptr;
+			__entry->cur_wptr = cur_rb->wptr;
+			__entry->new_wptr_end = new_rb->wptr_preempt_end;
+			__entry->new_wptr = new_rb->wptr;
+			__entry->cur_rbbase = cur_rb->buffer_desc->gpuaddr;
+			__entry->new_rbbase = new_rb->buffer_desc->gpuaddr;
+	),
+	TP_printk(
+	"cur_rb_lvl=%d rptr=%x wptr=%x rbbase=%x prev_rb_lvl=%d rptr=%x wptr_preempt_end=%x wptr=%x rbbase=%x",
+		__entry->cur_level, __entry->cur_rptr,
+		__entry->cur_wptr, __entry->cur_rbbase,
+		__entry->new_level, __entry->new_rptr,
+		__entry->new_wptr_end, __entry->new_wptr, __entry->new_rbbase
+	)
+);
+
+TRACE_EVENT(adreno_hw_preempt_token_submit,
+	TP_PROTO(struct adreno_ringbuffer *cur_rb,
+		struct adreno_ringbuffer *new_rb,
+		unsigned int cur_rptr, unsigned int new_rptr),
+	TP_ARGS(cur_rb, new_rb, cur_rptr, new_rptr),
+	TP_STRUCT__entry(__field(int, cur_level)
+		__field(int, new_level)
+		__field(unsigned int, cur_rptr)
+		__field(unsigned int, new_rptr)
+		__field(unsigned int, cur_wptr)
+		__field(unsigned int, cur_wptr_end)
+		__field(unsigned int, new_wptr)
+		__field(unsigned int, cur_rbbase)
+		__field(unsigned int, new_rbbase)
+	),
+	TP_fast_assign(__entry->cur_level = cur_rb->id;
+			__entry->new_level = new_rb->id;
+			__entry->cur_rptr = cur_rptr;
+			__entry->new_rptr = new_rptr;
+			__entry->cur_wptr = cur_rb->wptr;
+			__entry->cur_wptr_end = cur_rb->wptr_preempt_end;
+			__entry->new_wptr = new_rb->wptr;
+			__entry->cur_rbbase = cur_rb->buffer_desc->gpuaddr;
+			__entry->new_rbbase = new_rb->buffer_desc->gpuaddr;
+	),
+	TP_printk(
+		"cur_rb_lvl=%d rptr=%x wptr_preempt_end=%x wptr=%x rbbase=%x new_rb_lvl=%d rptr=%x wptr=%x rbbase=%x",
+		__entry->cur_level, __entry->cur_rptr,
+		__entry->cur_wptr_end, __entry->cur_wptr,
+		__entry->cur_rbbase,
+		__entry->new_level, __entry->new_rptr,
+		__entry->new_wptr, __entry->new_rbbase
+	)
+);
+
+TRACE_EVENT(adreno_preempt_trigger,
+	TP_PROTO(u32 cur_rb_id, u32 next_rb_id,
+		u32 cntl, u64 gmu_ticks),
+	TP_ARGS(cur_rb_id, next_rb_id, cntl, gmu_ticks),
+	TP_STRUCT__entry(
+		__field(u32, cur)
+		__field(u32, next)
+		__field(u32, cntl)
+		__field(u64, ticks)
+	),
+	TP_fast_assign(
+		__entry->cur = cur_rb_id;
+		__entry->next = next_rb_id;
+		__entry->cntl = cntl;
+		__entry->ticks = gmu_ticks;
+	),
+	TP_printk("trigger from id=%d to id=%d cntl=%x ticks=%llu",
+		__entry->cur, __entry->next, __entry->cntl, __entry->ticks
+	)
+);
+
+TRACE_EVENT(adreno_preempt_done,
+	TP_PROTO(u32 cur_rb_id, u32 next_rb_id,
+		u32 level, u64 gmu_ticks),
+	TP_ARGS(cur_rb_id, next_rb_id, level, gmu_ticks),
+	TP_STRUCT__entry(
+		__field(u32, cur)
+		__field(u32, next)
+		__field(u32, level)
+		__field(u64, ticks)
+	),
+	TP_fast_assign(
+		__entry->cur = cur_rb_id;
+		__entry->next = next_rb_id;
+		__entry->level = level;
+		__entry->ticks = gmu_ticks;
+	),
+	TP_printk("done switch to id=%d from id=%d level=%x ticks=%llu",
+		__entry->next, __entry->cur, __entry->level, __entry->ticks
+	)
+);
+
+TRACE_EVENT(adreno_ifpc_count,
+	TP_PROTO(unsigned int ifpc_count),
+	TP_ARGS(ifpc_count),
+	TP_STRUCT__entry(
+		__field(unsigned int, ifpc_count)
+	),
+	TP_fast_assign(
+		__entry->ifpc_count = ifpc_count;
+	),
+	TP_printk("total times GMU entered IFPC = %d", __entry->ifpc_count)
+);
+
+#endif /* _ADRENO_TRACE_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/build.config.msm_kgsl
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/build.config.msm_kgsl
@@ -0,0 +1 @@
+EXT_MODULES+=msm_kgsl
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/build/kgsl_defs.bzl
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/build/kgsl_defs.bzl
@@ -0,0 +1,149 @@
+load("//build/kernel/kleaf:kernel.bzl", "ddk_module")
+load("//build/bazel_common_rules/dist:dist.bzl", "copy_to_dist_dir")
+
+msm_kgsl_includes = [
+    "include/linux/msm_kgsl.h",
+    "include/uapi/linux/msm_kgsl.h",
+]
+
+def kgsl_get_srcs():
+    srcs = [
+        "adreno.c",
+        "adreno_a3xx.c",
+        "adreno_a3xx_perfcounter.c",
+        "adreno_a3xx_ringbuffer.c",
+        "adreno_a3xx_snapshot.c",
+        "adreno_a5xx.c",
+        "adreno_a5xx_perfcounter.c",
+        "adreno_a5xx_preempt.c",
+        "adreno_a5xx_ringbuffer.c",
+        "adreno_a5xx_snapshot.c",
+        "adreno_a6xx.c",
+        "adreno_a6xx_gmu.c",
+        "adreno_a6xx_gmu_snapshot.c",
+        "adreno_a6xx_hfi.c",
+        "adreno_a6xx_hwsched.c",
+        "adreno_a6xx_hwsched_hfi.c",
+        "adreno_a6xx_perfcounter.c",
+        "adreno_a6xx_preempt.c",
+        "adreno_a6xx_rgmu.c",
+        "adreno_a6xx_ringbuffer.c",
+        "adreno_a6xx_rpmh.c",
+        "adreno_a6xx_snapshot.c",
+        "adreno_cp_parser.c",
+        "adreno_dispatch.c",
+        "adreno_drawctxt.c",
+        "adreno_gen7.c",
+        "adreno_gen7_gmu.c",
+        "adreno_gen7_gmu_snapshot.c",
+        "adreno_gen7_hfi.c",
+        "adreno_gen7_hwsched.c",
+        "adreno_gen7_hwsched_hfi.c",
+        "adreno_gen7_perfcounter.c",
+        "adreno_gen7_preempt.c",
+        "adreno_gen7_ringbuffer.c",
+        "adreno_gen7_rpmh.c",
+        "adreno_gen7_snapshot.c",
+        "adreno_hwsched.c",
+        "adreno_ioctl.c",
+        "adreno_perfcounter.c",
+        "adreno_ringbuffer.c",
+        "adreno_snapshot.c",
+        "adreno_sysfs.c",
+        "adreno_trace.c",
+        "governor_msm_adreno_tz.c",
+        "governor_gpubw_mon.c",
+        "kgsl.c",
+        "kgsl_bus.c",
+        "kgsl_drawobj.c",
+        "kgsl_events.c",
+        "kgsl_eventlog.c",
+        "kgsl_gmu_core.c",
+        "kgsl_ioctl.c",
+        "kgsl_mmu.c",
+        "kgsl_pwrctrl.c",
+        "kgsl_pwrscale.c",
+        "kgsl_regmap.c",
+        "kgsl_sharedmem.c",
+        "kgsl_snapshot.c",
+        "kgsl_timeline.c",
+        "kgsl_trace.c",
+        "kgsl_util.c",
+        "kgsl_vbo.c",
+    ]
+
+    srcs = srcs + native.glob(["*.h"]) + msm_kgsl_includes
+
+    return srcs
+
+def external_deps(target, variant):
+    tv = "{}_{}".format(target, variant)
+    deplist = []
+    defconfigs = []
+
+    # Add msm_hw_fence in the dependency and defconfig lists for targets that use it
+    if target in [ "pineapple" ]:
+        deplist = deplist + [
+            "//vendor/qcom/opensource/mm-drivers/hw_fence:{}_msm_hw_fence".format(tv),
+            "//vendor/qcom/opensource/mm-drivers/hw_fence:hw_fence_headers".format(tv)
+            ]
+        defconfigs = defconfigs + [
+            "//vendor/qcom/opensource/mm-drivers/hw_fence:defconfig"
+            ]
+
+    native.genrule(
+       name = "{}_defconfig".format(tv),
+       srcs = defconfigs + [ "config/{}_gpuconf".format(tv) ],
+       outs = [ "{}_defconfig.generated".format(tv) ],
+       cmd = "cat $(SRCS) > $@"
+    )
+
+    return deplist
+
+def define_target_variant_module(target, variant):
+    tv = "{}_{}".format(target, variant)
+    rule_name = "{}_msm_kgsl".format(tv)
+    kernel_build = "//msm-kernel:{}".format(tv)
+
+    ext_deps = external_deps(target, variant)
+
+    ddk_module(
+        name = rule_name,
+        out = "msm_kgsl.ko",
+        srcs = kgsl_get_srcs(),
+        defconfig = "{}_defconfig".format(tv),
+        kconfig = "Kconfig",
+        conditional_srcs = {
+            "CONFIG_ARM_SMMU": { True: [ "kgsl_iommu.c" ] },
+            "CONFIG_COMPAT": { True: [ "kgsl_compat.c", "adreno_compat.c" ] },
+            "CONFIG_DEBUG_FS": { True: [ "kgsl_debugfs.c", "adreno_debugfs.c", "adreno_profile.c" ] },
+            "CONFIG_QCOM_KGSL_CORESIGHT": { True: [
+                "adreno_coresight.c",
+                "adreno_a3xx_coresight.c",
+                "adreno_a5xx_coresight.c",
+                "adreno_a6xx_coresight.c",
+                "adreno_gen7_coresight.c"] },
+            "CONFIG_QCOM_KGSL_PROCESS_RECLAIM": { True: [ "kgsl_reclaim.c" ] },
+            "CONFIG_QCOM_KGSL_USE_SHMEM": { False: [ "kgsl_pool.c" ] },
+            "CONFIG_SYNC_FILE": { True: [ "kgsl_sync.c" ] },
+        },
+        deps = [ "//msm-kernel:all_headers" ] + ext_deps,
+        includes = ["include", "."],
+        kernel_build = kernel_build,
+        visibility = ["//visibility:private"]
+    )
+
+    copy_to_dist_dir(
+        name = "{}_dist".format(rule_name),
+        data = [rule_name],
+        dist_dir = "out/graphics-kernel",
+        flat = True,
+        wipe_dist_dir = False,
+        allow_duplicate_filenames = False,
+        mode_overrides = {"**/*": "644"},
+        log = "info",
+    )
+
+def define_target_module(target):
+    define_target_variant_module(target, "gki")
+    define_target_variant_module(target, "consolidate")
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/autoload_lemans.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/autoload_lemans.conf
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-only
+# Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#Conf file to load graphics-driver modules at boot-up time
+#Install under /etc/modules-load.d/ path
+msm-kgsl
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/autoload_sa81x5.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/autoload_sa81x5.conf
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-only
+# Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#Conf file to load graphics-driver modules at boot-up time
+#Install under /etc/modules-load.d/ path
+msm-kgsl
\ No newline at end of file
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/blair_consolidate_gpuconf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/blair_consolidate_gpuconf
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0-only
+# Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+CONFIG_QCOM_KGSL=m
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT=80
+CONFIG_QCOM_KGSL_SORT_POOL=y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG=y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR="msm-adreno-tz"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/blair_gki_gpuconf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/blair_gki_gpuconf
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0-only
+# Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+CONFIG_QCOM_KGSL=m
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT=80
+CONFIG_QCOM_KGSL_SORT_POOL=y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG=y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR="msm-adreno-tz"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_blair.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_blair.conf
@@ -0,0 +1,23 @@
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+
+ifneq ($(CONFIG_CORESIGHT),)
+        CONFIG_QCOM_KGSL_CORESIGHT = y
+endif
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+                -DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+                -DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+                -DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
+
+ifneq ($(CONFIG_CORESIGHT),)
+        ccflags-y += -DCONFIG_QCOM_KGSL_CORESIGHT=1
+endif
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_k2c.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_k2c.conf
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: GPL-2.0-only
+# Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT = y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+CONFIG_QCOM_KGSL_UPSTREAM = y
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=1 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\" \
+		-DCONFIG_QCOM_KGSL_UPSTREAM=1 \
+
+ccflags-y += -I$(KGSL_PATH)/downstream_dependencies
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_kalama.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_kalama.conf
@@ -0,0 +1,23 @@
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT = y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+ifneq ($(CONFIG_CORESIGHT),)
+	CONFIG_QCOM_KGSL_CORESIGHT = y
+endif
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=1 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
+
+ifneq ($(CONFIG_CORESIGHT),)
+	ccflags-y += -DCONFIG_QCOM_KGSL_CORESIGHT=1
+endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_khajedisp.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_khajedisp.conf
@@ -0,0 +1,21 @@
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+ifneq ($(CONFIG_SHMEM),)
+	CONFIG_QCOM_KGSL_USE_SHMEM = y
+	CONFIG_QCOM_KGSL_PROCESS_RECLAIM = y
+endif
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
+
+ifneq ($(CONFIG_SHMEM),)
+	ccflags-y += -DCONFIG_QCOM_KGSL_USE_SHMEM=1 \
+			-DCONFIG_QCOM_KGSL_PROCESS_RECLAIM=1
+endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_kona.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_kona.conf
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+# CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT is not set
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=0 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_lemans.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_lemans.conf
@@ -0,0 +1,15 @@
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT = y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=1 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_monaco.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_monaco.conf
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+# CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT is not set
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=0 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_pineapple.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_pineapple.conf
@@ -0,0 +1,35 @@
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT = y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+CONFIG_QTI_HW_FENCE=y
+
+ifneq ($(CONFIG_CORESIGHT),)
+	CONFIG_QCOM_KGSL_CORESIGHT = y
+endif
+
+ifneq ($(CONFIG_SHMEM),)
+	CONFIG_QCOM_KGSL_USE_SHMEM = y
+	CONFIG_QCOM_KGSL_PROCESS_RECLAIM = y
+endif
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=1 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\" \
+		-DCONFIG_QTI_HW_FENCE=1 # This is needed to enable the hw-fence driver APIs in kernel headers
+
+ifneq ($(CONFIG_CORESIGHT),)
+	ccflags-y += -DCONFIG_QCOM_KGSL_CORESIGHT=1
+endif
+
+ifneq ($(CONFIG_SHMEM),)
+	ccflags-y += -DCONFIG_QCOM_KGSL_USE_SHMEM=1 \
+			-DCONFIG_QCOM_KGSL_PROCESS_RECLAIM=1
+endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_qcs405.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_qcs405.conf
@@ -0,0 +1,15 @@
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+# CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT is not set
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=0 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_sa8155.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_sa8155.conf
@@ -0,0 +1,17 @@
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT = y
+CONFIG_QCOM_KGSL_HIBERNATION = y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=1 \
+		-DCONFIG_QCOM_KGSL_HIBERNATION=1 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_trinket.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_trinket.conf
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+# CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT is not set
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=0 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/gki_waipiodisp.conf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/gki_waipiodisp.conf
@@ -0,0 +1,15 @@
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ = y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON = y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT = 80
+CONFIG_QCOM_KGSL_SORT_POOL = y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG = y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT = y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR = \"msm-adreno-tz\"
+
+ccflags-y += -DCONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=1 \
+		-DCONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=1 \
+		-DCONFIG_QCOM_KGSL_IDLE_TIMEOUT=80 \
+		-DCONFIG_QCOM_KGSL_SORT_POOL=1 \
+		-DCONFIG_QCOM_KGSL_CONTEXT_DEBUG=1 \
+		-DCONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=1 \
+		-DCONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR=\"msm-adreno-tz\"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/pineapple_consolidate_gpuconf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/pineapple_consolidate_gpuconf
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-2.0-only
+# Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+CONFIG_QCOM_KGSL=m
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT=80
+CONFIG_QCOM_KGSL_SORT_POOL=y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG=y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR="msm-adreno-tz"
+CONFIG_QCOM_KGSL_USE_SHMEM=y
+CONFIG_QCOM_KGSL_PROCESS_RECLAIM=y
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/pineapple_gki_gpuconf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/pineapple_gki_gpuconf
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-2.0-only
+# Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+CONFIG_QCOM_KGSL=m
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT=80
+CONFIG_QCOM_KGSL_SORT_POOL=y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG=y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR="msm-adreno-tz"
+CONFIG_QCOM_KGSL_USE_SHMEM=y
+CONFIG_QCOM_KGSL_PROCESS_RECLAIM=y
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/sun_consolidate_gpuconf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/sun_consolidate_gpuconf
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: GPL-2.0-only
+# Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+CONFIG_QCOM_KGSL=m
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT=80
+CONFIG_QCOM_KGSL_SORT_POOL=y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG=y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR="msm-adreno-tz"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/config/sun_gki_gpuconf
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/config/sun_gki_gpuconf
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: GPL-2.0-only
+# Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+
+CONFIG_QCOM_KGSL=m
+CONFIG_DEVFREQ_GOV_QCOM_ADRENO_TZ=y
+CONFIG_DEVFREQ_GOV_QCOM_GPUBW_MON=y
+CONFIG_QCOM_KGSL_IDLE_TIMEOUT=80
+CONFIG_QCOM_KGSL_SORT_POOL=y
+CONFIG_QCOM_KGSL_CONTEXT_DEBUG=y
+CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT=y
+CONFIG_QCOM_ADRENO_DEFAULT_GOVERNOR="msm-adreno-tz"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/dt-bindings/soc/qcom,ipcc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/dt-bindings/soc/qcom,ipcc.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __DT_BINDINGS_QCOM_IPCC_H
+#define __DT_BINDINGS_QCOM_IPCC_H
+
+#define IPCC_CLIENT_APSS		8
+#define IPCC_CLIENT_GPU			9
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/linux/clk/qcom.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/linux/clk/qcom.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __LINUX_CLK_QCOM_H_
+#define __LINUX_CLK_QCOM_H_
+
+#include <linux/clk.h>
+#include <linux/regulator/consumer.h>
+
+static inline void qcom_clk_dump(struct clk *clk, struct regulator *regulator,
+				 bool calltrace)
+{
+}
+
+#endif  /* __LINUX_CLK_QCOM_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/linux/mailbox/qmp.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/linux/mailbox/qmp.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QMP_H_
+#define _QMP_H_
+
+#include <linux/types.h>
+
+/**
+ * struct qmp_pkt - Packet structure to be used for TX and RX with QMP
+ * @size	size of data
+ * @data	Buffer holding data of this packet
+ */
+struct qmp_pkt {
+	u32 size;
+	void *data;
+};
+
+#endif /* _QMP_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/linux/mem-buf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/linux/mem-buf.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ *  Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ *  Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MEM_BUF_H
+#define _MEM_BUF_H
+
+#include <linux/dma-buf.h>
+#include <linux/err.h>
+#include <linux/errno.h>
+#include <linux/types.h>
+
+static inline bool mem_buf_dma_buf_exclusive_owner(struct dma_buf *dmabuf)
+{
+	return false;
+}
+
+static inline int mem_buf_dma_buf_copy_vmperm(struct dma_buf *dmabuf, int **vmids, int **perms,
+		int *nr_acl_entries)
+{
+	return -EINVAL;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/linux/msm_sysstats.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/linux/msm_sysstats.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_SYSSTATS_H_
+#define _MSM_SYSSTATS_H_
+
+static inline void sysstats_register_kgsl_stats_cb(u64 (*cb)(pid_t pid))
+{
+}
+
+static inline void sysstats_unregister_kgsl_stats_cb(void)
+{
+}
+#endif /* _MSM_SYSSTATS_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/linux/qcom-io-pgtable.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/linux/qcom-io-pgtable.h
@@ -0,0 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __QCOM_QCOM_IO_PGTABLE_H
+#define __QCOM_QCOM_IO_PGTABLE_H
+
+#define IO_PGTABLE_QUIRK_QCOM_USE_LLC_NWA       BIT(31)
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/linux/qcom-iommu-util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/linux/qcom-iommu-util.h
@@ -0,0 +1,60 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __QCOM_IOMMU_UTIL_H
+#define __QCOM_IOMMU_UTIL_H
+
+#include <linux/iommu.h>
+
+#include <soc/qcom/secure_buffer.h>
+
+/* IOMMU fault behaviors */
+#define QCOM_IOMMU_FAULT_MODEL_NO_STALL	BIT(2)
+
+#ifndef IOMMU_SYS_CACHE
+/* Attributes are not supported, so render them ineffective. */
+#define IOMMU_SYS_CACHE		(0)
+#define IOMMU_SYS_CACHE_NWA	(0)
+#endif
+
+/* Use upstream device's bus attribute */
+#define IOMMU_USE_UPSTREAM_HINT	(IOMMU_SYS_CACHE)
+
+/* Use upstream device's bus attribute with no write-allocate cache policy */
+#define IOMMU_USE_LLC_NWA	(IOMMU_SYS_CACHE_NWA)
+
+/* vendor iommu fault flags */
+#define IOMMU_FAULT_TRANSLATION         (1 << 2)
+#define IOMMU_FAULT_PERMISSION          (1 << 3)
+#define IOMMU_FAULT_EXTERNAL            (1 << 4)
+#define IOMMU_FAULT_TRANSACTION_STALLED (1 << 5)
+
+static inline int qcom_iommu_set_fault_model(struct iommu_domain *domain, int fault_model)
+{
+	return -EINVAL;
+}
+
+static inline int qcom_iommu_get_context_bank_nr(struct iommu_domain *domain)
+{
+	return 0;
+}
+
+static inline int qcom_iommu_get_asid_nr(struct iommu_domain *domain)
+{
+	return -EINVAL;
+}
+
+static inline int qcom_iommu_set_secure_vmid(struct iommu_domain *domain, enum vmid vmid)
+{
+	return -EINVAL;
+}
+
+static inline int qcom_skip_tlb_management(struct device *dev, bool skip)
+{
+	return -EINVAL;
+}
+
+#endif /* __QCOM_IOMMU_UTIL_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/msm_hw_fence.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/msm_hw_fence.h
@@ -0,0 +1,219 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __MSM_HW_FENCE_H
+#define __MSM_HW_FENCE_H
+
+#include <linux/types.h>
+#include <linux/dma-fence.h>
+
+/**
+ * MSM_HW_FENCE_FLAG_ENABLED_BIT - Hw-fence is enabled for the dma_fence.
+ *
+ * Drivers set this flag in the dma_fence 'flags' to fences that
+ * are backed up by a hw-fence.
+ */
+#define MSM_HW_FENCE_FLAG_ENABLED_BIT    31
+
+/**
+ * MSM_HW_FENCE_FLAG_SIGNALED_BIT - Hw-fence is signaled for the dma_fence.
+ *
+ * This flag is set by hw-fence driver when a client wants to add itself as
+ * a waiter for this hw-fence. The client uses this flag to avoid adding itself
+ * as a waiter for a fence that is already retired.
+ */
+#define MSM_HW_FENCE_FLAG_SIGNALED_BIT    30
+
+/**
+ * MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT - Maximum number of signals per client
+ */
+#define MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT 64
+
+/**
+ * struct msm_hw_fence_create_params - Creation parameters.
+ *
+ * @name : Optional parameter associating a name with the object for debug purposes.
+ *         Only first 64 bytes are accepted, rest will be ignored.
+ * @handle : Pointer to fence hash (filled by function).
+ * @fence : Pointer to fence.
+ * @flags : flags for customization.
+ */
+struct msm_hw_fence_create_params {
+	const char *name;
+	u64 *handle;
+	void *fence;
+	u32 flags;
+};
+
+/**
+ * struct msm_hw_fence_hfi_queue_table_header - HFI queue table structure.
+ * @version: HFI protocol version.
+ * @size: Queue table size in dwords.
+ * @qhdr0_offset: First queue header offset (dwords) in this table.
+ * @qhdr_size: Queue header size.
+ * @num_q: Number of queues defined in this table.
+ * @num_active_q: Number of active queues.
+ */
+struct msm_hw_fence_hfi_queue_table_header {
+	u32 version;
+	u32 size;
+	u32 qhdr0_offset;
+	u32 qhdr_size;
+	u32 num_q;
+	u32 num_active_q;
+};
+
+/**
+ * struct msm_hw_fence_hfi_queue_header - HFI queue header structure.
+ * @status: Active = 1, Inactive = 0.
+ * @start_addr: Starting address of the queue.
+ * @type: Queue type (rx/tx).
+ * @queue_size: Size of the queue.
+ * @pkt_size: Size of the queue packet entries,
+ *            0 - means variable size of message in the queue,
+ *            non-zero - size of the packet, fixed.
+ * @pkt_drop_cnt: Number of packets drop by sender.
+ * @rx_wm: Receiver watermark, applicable in event driven mode.
+ * @tx_wm: Sender watermark, applicable in event driven mode.
+ * @rx_req: Receiver sets this bit if queue is empty.
+ * @tx_req: Sender sets this bit if queue is full.
+ * @rx_irq_status: Receiver sets this bit and triggers an interrupt to the
+ *                 sender after packets are dequeued. Sender clears this bit.
+ * @tx_irq_status: Sender sets this bit and triggers an interrupt to the
+ *                 receiver after packets are queued. Receiver clears this bit.
+ * @read_index: read index of the queue.
+ * @write_index: write index of the queue.
+ */
+struct msm_hw_fence_hfi_queue_header {
+	u32 status;
+	u32 start_addr;
+	u32 type;
+	u32 queue_size;
+	u32 pkt_size;
+	u32 pkt_drop_cnt;
+	u32 rx_wm;
+	u32 tx_wm;
+	u32 rx_req;
+	u32 tx_req;
+	u32 rx_irq_status;
+	u32 tx_irq_status;
+	u32 read_index;
+	u32 write_index;
+};
+
+/**
+ * struct msm_hw_fence_mem_addr - Memory descriptor of the queue allocated by
+ *                           the fence driver for each client during
+ *                           register.
+ * @virtual_addr: Kernel virtual address of the queue.
+ * @device_addr: Physical address of the memory object.
+ * @size: Size of the memory.
+ * @mem_data: Internal pointer with the attributes of the allocation.
+ */
+struct msm_hw_fence_mem_addr {
+	void *virtual_addr;
+	phys_addr_t device_addr;
+	u64 size;
+	void *mem_data;
+};
+
+/**
+ * enum hw_fence_client_id - Unique identifier of the supported clients.
+ * @HW_FENCE_CLIENT_ID_CTX0: GFX Client.
+ * @HW_FENCE_CLIENT_ID_CTL0: DPU Client 0.
+ * @HW_FENCE_CLIENT_ID_CTL1: DPU Client 1.
+ * @HW_FENCE_CLIENT_ID_CTL2: DPU Client 2.
+ * @HW_FENCE_CLIENT_ID_CTL3: DPU Client 3.
+ * @HW_FENCE_CLIENT_ID_CTL4: DPU Client 4.
+ * @HW_FENCE_CLIENT_ID_CTL5: DPU Client 5.
+ * @HW_FENCE_CLIENT_ID_VAL0: debug Validation client 0.
+ * @HW_FENCE_CLIENT_ID_VAL1: debug Validation client 1.
+ * @HW_FENCE_CLIENT_ID_VAL2: debug Validation client 2.
+ * @HW_FENCE_CLIENT_ID_VAL3: debug Validation client 3.
+ * @HW_FENCE_CLIENT_ID_VAL4: debug Validation client 4.
+ * @HW_FENCE_CLIENT_ID_VAL5: debug Validation client 5.
+ * @HW_FENCE_CLIENT_ID_VAL6: debug Validation client 6.
+ * @HW_FENCE_CLIENT_ID_IPE: IPE Client.
+ * @HW_FENCE_CLIENT_ID_VPU: VPU Client.
+ * @HW_FENCE_CLIENT_ID_IFE0: IFE0 Client 0.
+ * @HW_FENCE_CLIENT_ID_IFE1: IFE1 Client 0.
+ * @HW_FENCE_CLIENT_ID_IFE2: IFE2 Client 0.
+ * @HW_FENCE_CLIENT_ID_IFE3: IFE3 Client 0.
+ * @HW_FENCE_CLIENT_ID_IFE4: IFE4 Client 0.
+ * @HW_FENCE_CLIENT_ID_IFE5: IFE5 Client 0.
+ * @HW_FENCE_CLIENT_ID_IFE6: IFE6 Client 0.
+ * @HW_FENCE_CLIENT_ID_IFE7: IFE7 Client 0.
+ * @HW_FENCE_CLIENT_MAX: Max number of clients, any client must be added
+ *                       before this enum.
+ */
+enum hw_fence_client_id {
+	HW_FENCE_CLIENT_ID_CTX0 = 0x1,
+	HW_FENCE_CLIENT_ID_CTL0,
+	HW_FENCE_CLIENT_ID_CTL1,
+	HW_FENCE_CLIENT_ID_CTL2,
+	HW_FENCE_CLIENT_ID_CTL3,
+	HW_FENCE_CLIENT_ID_CTL4,
+	HW_FENCE_CLIENT_ID_CTL5,
+	HW_FENCE_CLIENT_ID_VAL0,
+	HW_FENCE_CLIENT_ID_VAL1,
+	HW_FENCE_CLIENT_ID_VAL2,
+	HW_FENCE_CLIENT_ID_VAL3,
+	HW_FENCE_CLIENT_ID_VAL4,
+	HW_FENCE_CLIENT_ID_VAL5,
+	HW_FENCE_CLIENT_ID_VAL6,
+	HW_FENCE_CLIENT_ID_IPE,
+	HW_FENCE_CLIENT_ID_VPU,
+	HW_FENCE_CLIENT_ID_IFE0,
+	HW_FENCE_CLIENT_ID_IFE1 = HW_FENCE_CLIENT_ID_IFE0 + MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT,
+	HW_FENCE_CLIENT_ID_IFE2 = HW_FENCE_CLIENT_ID_IFE1 + MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT,
+	HW_FENCE_CLIENT_ID_IFE3 = HW_FENCE_CLIENT_ID_IFE2 + MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT,
+	HW_FENCE_CLIENT_ID_IFE4 = HW_FENCE_CLIENT_ID_IFE3 + MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT,
+	HW_FENCE_CLIENT_ID_IFE5 = HW_FENCE_CLIENT_ID_IFE4 + MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT,
+	HW_FENCE_CLIENT_ID_IFE6 = HW_FENCE_CLIENT_ID_IFE5 + MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT,
+	HW_FENCE_CLIENT_ID_IFE7 = HW_FENCE_CLIENT_ID_IFE6 + MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT,
+	HW_FENCE_CLIENT_MAX = HW_FENCE_CLIENT_ID_IFE7 + MSM_HW_FENCE_MAX_SIGNAL_PER_CLIENT
+};
+
+static inline void *msm_hw_fence_register(enum hw_fence_client_id client_id,
+	struct msm_hw_fence_mem_addr *mem_descriptor)
+{
+	return NULL;
+}
+
+static inline int msm_hw_fence_deregister(void *client_handle)
+{
+	return -EINVAL;
+}
+
+static inline int msm_hw_fence_create(void *client_handle,
+	struct msm_hw_fence_create_params *params)
+{
+	return -EINVAL;
+}
+
+static inline int msm_hw_fence_destroy(void *client_handle, struct dma_fence *fence)
+{
+	return -EINVAL;
+}
+
+static inline int msm_hw_fence_wait_update(void *client_handle,
+	struct dma_fence **fences, u32 num_fences, bool reg)
+{
+	return -EINVAL;
+}
+
+static inline int msm_hw_fence_update_txq(void *client_handle, u64 handle, u64 flags, u32 error)
+{
+	return -EINVAL;
+}
+
+static inline int msm_hw_fence_trigger_signal(void *client_handle, u32 tx_client_id,
+	u32 rx_client_id, u32 signal_id)
+{
+	return -EINVAL;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/dcvs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/dcvs.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _QCOM_DCVS_H
+#define _QCOM_DCVS_H
+
+enum dcvs_hw_type {
+	DCVS_DDR,
+	DCVS_LLCC,
+	DCVS_L3,
+	DCVS_DDRQOS,
+	NUM_DCVS_HW_TYPES
+};
+
+enum dcvs_path_type {
+	DCVS_SLOW_PATH,
+	DCVS_FAST_PATH,
+	DCVS_PERCPU_PATH,
+	NUM_DCVS_PATHS
+};
+
+struct dcvs_freq {
+	u32			ib;
+	u32			ab;
+	enum dcvs_hw_type	hw_type;
+};
+
+static inline int qcom_dcvs_register_voter(const char *name,
+		enum dcvs_hw_type hw_type, enum dcvs_path_type path_type)
+{
+	return -ENODEV;
+}
+static inline int qcom_dcvs_unregister_voter(const char *name,
+		enum dcvs_hw_type hw_type, enum dcvs_path_type path_type)
+{
+	return -ENODEV;
+}
+static inline int qcom_dcvs_update_votes(const char *name,
+		struct dcvs_freq *votes, u32 update_mask,
+		enum dcvs_path_type path)
+{
+	return -ENODEV;
+}
+static inline int qcom_dcvs_hw_minmax_get(enum dcvs_hw_type hw_type, u32 *min,
+		u32 *max)
+{
+	return -ENODEV;
+}
+
+#endif /* _QCOM_DCVS_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/msm_performance.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/msm_performance.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __MSM_PERFORMANCE_H
+#define __MSM_PERFORMANCE_H
+
+enum gfx_evt_t {
+	MSM_PERF_INVAL,
+	MSM_PERF_QUEUE,
+	MSM_PERF_SUBMIT,
+	MSM_PERF_RETIRED
+};
+
+enum evt_update_t {
+	MSM_PERF_GFX,
+};
+
+static inline void msm_perf_events_update(enum evt_update_t update_typ,
+			enum gfx_evt_t evt_typ, pid_t pid,
+			uint32_t ctx_id, uint32_t timestamp, bool end_of_frame)
+{
+}
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/of_common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/of_common.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __QCOM_OF_H
+#define __QCOM_OF_H
+
+#include <linux/of.h>
+
+static inline int of_fdt_get_ddrtype(void)
+{
+	return -EINVAL;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/secure_buffer.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/secure_buffer.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __QCOM_SECURE_BUFFER_H__
+#define __QCOM_SECURE_BUFFER_H__
+
+/*
+ * if you add a secure VMID here make sure you update
+ * msm_secure_vmid_to_string.
+ * Make sure to keep the VMID_LAST as the last entry in the enum.
+ * This is needed in ion to create a list and it's sized using VMID_LAST.
+ */
+enum vmid {
+	VMID_TZ = 0x1,
+	VMID_HLOS = 0x3,
+	VMID_CP_TOUCH = 0x8,
+	VMID_CP_BITSTREAM = 0x9,
+	VMID_CP_PIXEL = 0xA,
+	VMID_CP_NON_PIXEL = 0xB,
+	VMID_CP_CAMERA = 0xD,
+	VMID_HLOS_FREE = 0xE,
+	VMID_MSS_MSA = 0xF,
+	VMID_MSS_NONMSA = 0x10,
+	VMID_CP_SEC_DISPLAY = 0x11,
+	VMID_CP_APP = 0x12,
+	VMID_LPASS = 0x16,
+	VMID_WLAN = 0x18,
+	VMID_WLAN_CE = 0x19,
+	VMID_CP_SPSS_SP = 0x1A,
+	VMID_CP_CAMERA_PREVIEW = 0x1D,
+	VMID_CP_SPSS_SP_SHARED = 0x22,
+	VMID_CP_SPSS_HLOS_SHARED = 0x24,
+	VMID_ADSP_HEAP = 0x25,
+	VMID_CP_CDSP = 0x2A,
+	VMID_NAV = 0x2B,
+	VMID_TVM = 0x2D,
+	VMID_OEMVM = 0x31,
+	VMID_LAST,
+	VMID_INVAL = -1
+};
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/socinfo.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/downstream_dependencies/soc/qcom/socinfo.h
@@ -0,0 +1,102 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __SOC_QCOM_SOCINFO_H__
+#define __SOC_QCOM_SOCINFO_H__
+
+#include <linux/types.h>
+
+enum feature_code {
+	/* External feature code */
+	SOCINFO_FC_UNKNOWN = 0x0,
+	SOCINFO_FC_AA,
+	SOCINFO_FC_AB,
+	SOCINFO_FC_AC,
+	SOCINFO_FC_AD,
+	SOCINFO_FC_AE,
+	SOCINFO_FC_AF,
+	SOCINFO_FC_AG,
+	SOCINFO_FC_AH,
+	SOCINFO_FC_EXT_RESERVE,
+
+	/* Internal feature code */
+	SOCINFO_FC_Y0 = 0xf1,
+	SOCINFO_FC_Y1,
+	SOCINFO_FC_Y2,
+	SOCINFO_FC_Y3,
+	SOCINFO_FC_Y4,
+	SOCINFO_FC_Y5,
+	SOCINFO_FC_Y6,
+	SOCINFO_FC_Y7,
+	SOCINFO_FC_Y8,
+	SOCINFO_FC_Y9,
+	SOCINFO_FC_YA,
+	SOCINFO_FC_YB,
+	SOCINFO_FC_YC,
+	SOCINFO_FC_YD,
+	SOCINFO_FC_YE,
+	SOCINFO_FC_YF,
+	SOCINFO_FC_INT_RESERVE
+};
+
+enum pcode {
+	SOCINFO_PCODE_UNKNOWN = 0,
+	SOCINFO_PCODE_0,
+	SOCINFO_PCODE_1,
+	SOCINFO_PCODE_2,
+	SOCINFO_PCODE_3,
+	SOCINFO_PCODE_4,
+	SOCINFO_PCODE_5,
+	SOCINFO_PCODE_6,
+	SOCINFO_PCODE_7,
+	SOCINFO_PCODE_8,
+	SOCINFO_PCODE_RESERVE = 0x7fffffff
+};
+
+enum socinfo_parttype {
+	SOCINFO_PART_GPU = 1,
+	SOCINFO_PART_VIDEO,
+	SOCINFO_PART_CAMERA,
+	SOCINFO_PART_DISPLAY,
+	SOCINFO_PART_AUDIO,
+	SOCINFO_PART_MODEM,
+	SOCINFO_PART_WLAN,
+	SOCINFO_PART_COMP,
+	SOCINFO_PART_SENSORS,
+	SOCINFO_PART_NPU,
+	SOCINFO_PART_SPSS,
+	SOCINFO_PART_NAV,
+	SOCINFO_PART_COMPUTE_1,
+	SOCINFO_PART_DISPLAY_1,
+	SOCINFO_PART_MAX_PARTTYPE
+};
+
+static inline uint32_t socinfo_get_partinfo_chip_id(unsigned int part_id)
+{
+	return 0;
+}
+
+static inline int socinfo_get_feature_code(void)
+{
+	return -EINVAL;
+}
+
+static inline int socinfo_get_pcode(void)
+{
+	return -EINVAL;
+}
+
+static inline const char *socinfo_get_partinfo_part_name(unsigned int part_id)
+{
+	return NULL;
+}
+
+static inline uint32_t socinfo_get_partinfo_vulkan_id(unsigned int part_id)
+{
+	return 0;
+}
+
+#endif /* __SOC_QCOM_SOCINFO_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/gen7_reg.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/gen7_reg.h
@@ -0,0 +1,1332 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _GEN7_REG_H
+#define _GEN7_REG_H
+
+/* GEN7 interrupt bits */
+#define GEN7_INT_GPUIDLE                0
+#define GEN7_INT_AHBERROR               1
+#define GEN7_INT_CPIPCINT0              4
+#define GEN7_INT_CPIPCINT1              5
+#define GEN7_INT_ATBASYNCFIFOOVERFLOW   6
+#define GEN7_INT_GPCERROR               7
+#define GEN7_INT_SWINTERRUPT            8
+#define GEN7_INT_HWERROR                9
+#define GEN7_INT_CCU_CLEAN_DEPTH_TS     10
+#define GEN7_INT_CCU_CLEAN_COLOR_TS     11
+#define GEN7_INT_CCU_RESOLVE_CLEAN_TS   12
+#define GEN7_INT_PM4CPINTERRUPT         15
+#define GEN7_INT_PM4CPINTERRUPTLPAC     16
+#define GEN7_INT_RB_DONE_TS             17
+#define GEN7_INT_CACHE_CLEAN_TS         20
+#define GEN7_INT_CACHE_CLEAN_TS_LPAC    21
+#define GEN7_INT_ATBBUSOVERFLOW         22
+#define GEN7_INT_HANGDETECTINTERRUPT    23
+#define GEN7_INT_OUTOFBOUNDACCESS       24
+#define GEN7_INT_UCHETRAPINTERRUPT      25
+#define GEN7_INT_DEBUGBUSINTERRUPT0     26
+#define GEN7_INT_DEBUGBUSINTERRUPT1     27
+#define GEN7_INT_TSBWRITEERROR          28
+#define GEN7_INT_SWFUSEVIOLATION        29
+#define GEN7_INT_ISDBCPUIRQ             30
+#define GEN7_INT_ISDBUNDERDEBUG         31
+
+/* CP registers */
+#define GEN7_CP_RB_BASE                  0x800
+#define GEN7_CP_RB_BASE_HI               0x801
+#define GEN7_CP_RB_CNTL                  0x802
+#define GEN7_CP_RB_RPTR_ADDR_LO          0x804
+#define GEN7_CP_RB_RPTR_ADDR_HI          0x805
+#define GEN7_CP_RB_RPTR                  0x806
+#define GEN7_CP_RB_WPTR                  0x807
+#define GEN7_CP_SQE_CNTL                 0x808
+#define GEN7_CP_CP2GMU_STATUS            0x812
+#define GEN7_CP_HW_FAULT                 0x821
+#define GEN7_CP_INTERRUPT_STATUS         0x823
+#define GEN7_CP_PROTECT_STATUS           0x824
+#define GEN7_CP_STATUS_1                 0x825
+#define GEN7_CP_SQE_INSTR_BASE_LO        0x830
+#define GEN7_CP_SQE_INSTR_BASE_HI        0x831
+#define GEN7_CP_MISC_CNTL                0x840
+#define GEN7_CP_CHICKEN_DBG              0x841
+#define GEN7_CP_DBG_ECO_CNTL             0x843
+#define GEN7_CP_APRIV_CNTL               0x844
+#define GEN7_CP_PROTECT_CNTL             0x84f
+#define GEN7_CP_PROTECT_REG              0x850
+#define GEN7_CP_CONTEXT_SWITCH_CNTL      0x8a0
+#define GEN7_CP_CONTEXT_SWITCH_SMMU_INFO_LO 0x8a1
+#define GEN7_CP_CONTEXT_SWITCH_SMMU_INFO_HI 0x8a2
+#define GEN7_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_LO 0x8a3
+#define GEN7_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR_HI 0x8a4
+#define GEN7_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_LO     0x8a5
+#define GEN7_CP_CONTEXT_SWITCH_PRIV_SECURE_RESTORE_ADDR_HI     0x8a6
+#define GEN7_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_LO        0x8a7
+#define GEN7_CP_CONTEXT_SWITCH_NON_PRIV_RESTORE_ADDR_HI        0x8a8
+#define GEN7_CP_CONTEXT_SWITCH_LEVEL_STATUS                    0x8ab
+#define GEN7_CP_PERFCTR_CP_SEL_0         0x8d0
+#define GEN7_CP_PERFCTR_CP_SEL_1         0x8d1
+#define GEN7_CP_PERFCTR_CP_SEL_2         0x8d2
+#define GEN7_CP_PERFCTR_CP_SEL_3         0x8d3
+#define GEN7_CP_PERFCTR_CP_SEL_4         0x8d4
+#define GEN7_CP_PERFCTR_CP_SEL_5         0x8d5
+#define GEN7_CP_PERFCTR_CP_SEL_6         0x8d6
+#define GEN7_CP_PERFCTR_CP_SEL_7         0x8d7
+#define GEN7_CP_PERFCTR_CP_SEL_8         0x8d8
+#define GEN7_CP_PERFCTR_CP_SEL_9         0x8d9
+#define GEN7_CP_PERFCTR_CP_SEL_10        0x8da
+#define GEN7_CP_PERFCTR_CP_SEL_11        0x8db
+#define GEN7_CP_PERFCTR_CP_SEL_12        0x8dc
+#define GEN7_CP_PERFCTR_CP_SEL_13        0x8dd
+#define GEN7_CP_BV_PERFCTR_CP_SEL_0      0x8e0
+#define GEN7_CP_BV_PERFCTR_CP_SEL_1      0x8e1
+#define GEN7_CP_BV_PERFCTR_CP_SEL_2      0x8e2
+#define GEN7_CP_BV_PERFCTR_CP_SEL_3      0x8e3
+#define GEN7_CP_BV_PERFCTR_CP_SEL_4      0x8e4
+#define GEN7_CP_BV_PERFCTR_CP_SEL_5      0x8e5
+#define GEN7_CP_BV_PERFCTR_CP_SEL_6      0x8e6
+#define GEN7_CP_CRASH_SCRIPT_BASE_LO     0x900
+#define GEN7_CP_CRASH_SCRIPT_BASE_HI     0x901
+#define GEN7_CP_CRASH_DUMP_CNTL          0x902
+#define GEN7_CP_CRASH_DUMP_STATUS        0x903
+#define GEN7_CP_SQE_STAT_ADDR            0x908
+#define GEN7_CP_SQE_STAT_DATA            0x909
+#define GEN7_CP_DRAW_STATE_ADDR          0x90a
+#define GEN7_CP_DRAW_STATE_DATA          0x90b
+#define GEN7_CP_ROQ_DBG_ADDR             0x90c
+#define GEN7_CP_ROQ_DBG_DATA             0x90d
+#define GEN7_CP_MEM_POOL_DBG_ADDR        0x90e
+#define GEN7_CP_MEM_POOL_DBG_DATA        0x90f
+#define GEN7_CP_SQE_UCODE_DBG_ADDR       0x910
+#define GEN7_CP_SQE_UCODE_DBG_DATA       0x911
+#define GEN7_CP_IB1_BASE                 0x928
+#define GEN7_CP_IB1_BASE_HI              0x929
+#define GEN7_CP_IB1_REM_SIZE             0x92a
+#define GEN7_CP_IB2_BASE                 0x92b
+#define GEN7_CP_IB2_BASE_HI              0x92c
+#define GEN7_CP_IB2_REM_SIZE             0x92d
+#define GEN7_CP_ALWAYS_ON_COUNTER_LO     0x980
+#define GEN7_CP_ALWAYS_ON_COUNTER_HI     0x981
+#define GEN7_CP_ALWAYS_ON_CONTEXT_LO     0x982
+#define GEN7_CP_ALWAYS_ON_CONTEXT_HI     0x983
+#define GEN7_CP_AHB_CNTL                 0x98d
+#define GEN7_CP_RL_ERROR_DETAILS_0       0x9b4
+#define GEN7_CP_RL_ERROR_DETAILS_1       0x9cf
+#define GEN7_CP_APERTURE_CNTL_HOST       0xa00
+#define GEN7_CP_APERTURE_CNTL_CD         0xa03
+#define GEN7_CP_BV_PROTECT_STATUS        0xa61
+#define GEN7_CP_BV_HW_FAULT              0xa64
+#define GEN7_CP_BV_DRAW_STATE_ADDR       0xa81
+#define GEN7_CP_BV_DRAW_STATE_DATA       0xa82
+#define GEN7_CP_BV_ROQ_DBG_ADDR          0xa83
+#define GEN7_CP_BV_ROQ_DBG_DATA          0xa84
+#define GEN7_CP_BV_SQE_UCODE_DBG_ADDR    0xa85
+#define GEN7_CP_BV_SQE_UCODE_DBG_DATA    0xa86
+#define GEN7_CP_BV_SQE_STAT_ADDR         0xa87
+#define GEN7_CP_BV_SQE_STAT_DATA         0xa88
+#define GEN7_CP_BV_RB_RPTR_ADDR_LO       0xa98
+#define GEN7_CP_BV_RB_RPTR_ADDR_HI       0xa99
+#define GEN7_CP_RESOURCE_TABLE_DBG_ADDR  0xa9a
+#define GEN7_CP_RESOURCE_TABLE_DBG_DATA  0xa9b
+#define GEN7_CP_BV_MEM_POOL_DBG_ADDR     0xa96
+#define GEN7_CP_BV_MEM_POOL_DBG_DATA     0xa97
+#define GEN7_CP_BV_APRIV_CNTL            0xad0
+#define GEN7_CP_BV_CHICKEN_DBG           0xada
+
+/* LPAC registers */
+#define GEN7_CP_LPAC_RB_BASE             0xb00
+#define GEN7_CP_LPAC_RB_BASE_HI          0xb01
+#define GEN7_CP_LPAC_RB_RPTR             0xb06
+#define GEN7_CP_LPAC_RB_WPTR             0xb07
+#define GEN7_CP_LPAC_PROTECT_CNTL        0xb09
+#define GEN7_CP_LPAC_DRAW_STATE_ADDR     0xb0a
+#define GEN7_CP_LPAC_DRAW_STATE_DATA     0xb0b
+#define GEN7_CP_LPAC_ROQ_DBG_ADDR        0xb0c
+#define GEN7_CP_LPAC_IB1_BASE            0xb0d
+#define GEN7_CP_LPAC_IB1_BASE_HI         0xb0e
+#define GEN7_CP_LPAC_IB1_REM_SIZE        0xb0f
+#define GEN7_CP_LPAC_IB2_BASE            0xb10
+#define GEN7_CP_LPAC_IB2_BASE_HI         0xb11
+#define GEN7_CP_LPAC_IB2_REM_SIZE        0xb12
+#define GEN7_CP_SQE_AC_UCODE_DBG_ADDR    0xb27
+#define GEN7_CP_SQE_AC_UCODE_DBG_DATA    0xb28
+#define GEN7_CP_SQE_AC_STAT_ADDR         0xb29
+#define GEN7_CP_SQE_AC_STAT_DATA         0xb2a
+#define GEN7_CP_LPAC_CHICKEN_DBG         0xb30
+#define GEN7_CP_LPAC_APRIV_CNTL          0xb31
+#define GEN7_CP_LPAC_ROQ_DBG_DATA        0xb35
+#define GEN7_CP_LPAC_FIFO_DBG_DATA       0xb36
+#define GEN7_CP_LPAC_FIFO_DBG_ADDR       0xb40
+#define GEN7_CP_AQE_INSTR_BASE_LO_0      0xb70
+#define GEN7_CP_AQE_INSTR_BASE_HI_0      0xb71
+#define GEN7_CP_AQE_INSTR_BASE_LO_1      0xb72
+#define GEN7_CP_AQE_INSTR_BASE_HI_1      0xb73
+#define GEN7_CP_AQE_APRIV_CNTL           0xb78
+
+#define GEN7_CP_AQE_ROQ_DBG_ADDR_0       0xba8
+#define GEN7_CP_AQE_ROQ_DBG_ADDR_1       0xba9
+#define GEN7_CP_AQE_ROQ_DBG_DATA_0       0xbac
+#define GEN7_CP_AQE_ROQ_DBG_DATA_1       0xbad
+#define GEN7_CP_AQE_UCODE_DBG_ADDR_0     0xbb0
+#define GEN7_CP_AQE_UCODE_DBG_ADDR_1     0xbb1
+#define GEN7_CP_AQE_UCODE_DBG_DATA_0     0xbb4
+#define GEN7_CP_AQE_UCODE_DBG_DATA_1     0xbb5
+#define GEN7_CP_AQE_STAT_ADDR_0          0xbb8
+#define GEN7_CP_AQE_STAT_ADDR_1          0xbb9
+#define GEN7_CP_AQE_STAT_DATA_0          0xbbc
+#define GEN7_CP_AQE_STAT_DATA_1          0xbbd
+#define GEN7_LPAC_RBBM_STATUS            0x5fe
+
+/* RBBM registers */
+#define GEN7_RBBM_INT_0_STATUS                   0x201
+#define GEN7_RBBM_STATUS                         0x210
+#define GEN7_RBBM_STATUS3                        0x213
+#define GEN7_RBBM_PERFCTR_CP_0_LO                0x300
+#define GEN7_RBBM_PERFCTR_CP_0_HI                0x301
+#define GEN7_RBBM_PERFCTR_CP_1_LO                0x302
+#define GEN7_RBBM_PERFCTR_CP_1_HI                0x303
+#define GEN7_RBBM_PERFCTR_CP_2_LO                0x304
+#define GEN7_RBBM_PERFCTR_CP_2_HI                0x305
+#define GEN7_RBBM_PERFCTR_CP_3_LO                0x306
+#define GEN7_RBBM_PERFCTR_CP_3_HI                0x307
+#define GEN7_RBBM_PERFCTR_CP_4_LO                0x308
+#define GEN7_RBBM_PERFCTR_CP_4_HI                0x309
+#define GEN7_RBBM_PERFCTR_CP_5_LO                0x30a
+#define GEN7_RBBM_PERFCTR_CP_5_HI                0x30b
+#define GEN7_RBBM_PERFCTR_CP_6_LO                0x30c
+#define GEN7_RBBM_PERFCTR_CP_6_HI                0x30d
+#define GEN7_RBBM_PERFCTR_CP_7_LO                0x30e
+#define GEN7_RBBM_PERFCTR_CP_7_HI                0x30f
+#define GEN7_RBBM_PERFCTR_CP_8_LO                0x310
+#define GEN7_RBBM_PERFCTR_CP_8_HI                0x311
+#define GEN7_RBBM_PERFCTR_CP_9_LO                0x312
+#define GEN7_RBBM_PERFCTR_CP_9_HI                0x313
+#define GEN7_RBBM_PERFCTR_CP_10_LO               0x314
+#define GEN7_RBBM_PERFCTR_CP_10_HI               0x315
+#define GEN7_RBBM_PERFCTR_CP_11_LO               0x316
+#define GEN7_RBBM_PERFCTR_CP_11_HI               0x317
+#define GEN7_RBBM_PERFCTR_CP_12_LO               0x318
+#define GEN7_RBBM_PERFCTR_CP_12_HI               0x319
+#define GEN7_RBBM_PERFCTR_CP_13_LO               0x31a
+#define GEN7_RBBM_PERFCTR_CP_13_HI               0x31b
+#define GEN7_RBBM_PERFCTR_RBBM_0_LO              0x31c
+#define GEN7_RBBM_PERFCTR_RBBM_0_HI              0x31d
+#define GEN7_RBBM_PERFCTR_RBBM_1_LO              0x31e
+#define GEN7_RBBM_PERFCTR_RBBM_1_HI              0x31f
+#define GEN7_RBBM_PERFCTR_RBBM_2_LO              0x320
+#define GEN7_RBBM_PERFCTR_RBBM_2_HI              0x321
+#define GEN7_RBBM_PERFCTR_RBBM_3_LO              0x322
+#define GEN7_RBBM_PERFCTR_RBBM_3_HI              0x323
+#define GEN7_RBBM_PERFCTR_PC_0_LO                0x324
+#define GEN7_RBBM_PERFCTR_PC_0_HI                0x325
+#define GEN7_RBBM_PERFCTR_PC_1_LO                0x326
+#define GEN7_RBBM_PERFCTR_PC_1_HI                0x327
+#define GEN7_RBBM_PERFCTR_PC_2_LO                0x328
+#define GEN7_RBBM_PERFCTR_PC_2_HI                0x329
+#define GEN7_RBBM_PERFCTR_PC_3_LO                0x32a
+#define GEN7_RBBM_PERFCTR_PC_3_HI                0x32b
+#define GEN7_RBBM_PERFCTR_PC_4_LO                0x32c
+#define GEN7_RBBM_PERFCTR_PC_4_HI                0x32d
+#define GEN7_RBBM_PERFCTR_PC_5_LO                0x32e
+#define GEN7_RBBM_PERFCTR_PC_5_HI                0x32f
+#define GEN7_RBBM_PERFCTR_PC_6_LO                0x330
+#define GEN7_RBBM_PERFCTR_PC_6_HI                0x331
+#define GEN7_RBBM_PERFCTR_PC_7_LO                0x332
+#define GEN7_RBBM_PERFCTR_PC_7_HI                0x333
+#define GEN7_RBBM_PERFCTR_VFD_0_LO               0x334
+#define GEN7_RBBM_PERFCTR_VFD_0_HI               0x335
+#define GEN7_RBBM_PERFCTR_VFD_1_LO               0x336
+#define GEN7_RBBM_PERFCTR_VFD_1_HI               0x337
+#define GEN7_RBBM_PERFCTR_VFD_2_LO               0x338
+#define GEN7_RBBM_PERFCTR_VFD_2_HI               0x339
+#define GEN7_RBBM_PERFCTR_VFD_3_LO               0x33a
+#define GEN7_RBBM_PERFCTR_VFD_3_HI               0x33b
+#define GEN7_RBBM_PERFCTR_VFD_4_LO               0x33c
+#define GEN7_RBBM_PERFCTR_VFD_4_HI               0x33d
+#define GEN7_RBBM_PERFCTR_VFD_5_LO               0x33e
+#define GEN7_RBBM_PERFCTR_VFD_5_HI               0x33f
+#define GEN7_RBBM_PERFCTR_VFD_6_LO               0x340
+#define GEN7_RBBM_PERFCTR_VFD_6_HI               0x341
+#define GEN7_RBBM_PERFCTR_VFD_7_LO               0x342
+#define GEN7_RBBM_PERFCTR_VFD_7_HI               0x343
+#define GEN7_RBBM_PERFCTR_HLSQ_0_LO              0x344
+#define GEN7_RBBM_PERFCTR_HLSQ_0_HI              0x345
+#define GEN7_RBBM_PERFCTR_HLSQ_1_LO              0x346
+#define GEN7_RBBM_PERFCTR_HLSQ_1_HI              0x347
+#define GEN7_RBBM_PERFCTR_HLSQ_2_LO              0x348
+#define GEN7_RBBM_PERFCTR_HLSQ_2_HI              0x349
+#define GEN7_RBBM_PERFCTR_HLSQ_3_LO              0x34a
+#define GEN7_RBBM_PERFCTR_HLSQ_3_HI              0x34b
+#define GEN7_RBBM_PERFCTR_HLSQ_4_LO              0x34c
+#define GEN7_RBBM_PERFCTR_HLSQ_4_HI              0x34d
+#define GEN7_RBBM_PERFCTR_HLSQ_5_LO              0x34e
+#define GEN7_RBBM_PERFCTR_HLSQ_5_HI              0x34f
+#define GEN7_RBBM_PERFCTR_VPC_0_LO               0x350
+#define GEN7_RBBM_PERFCTR_VPC_0_HI               0x351
+#define GEN7_RBBM_PERFCTR_VPC_1_LO               0x352
+#define GEN7_RBBM_PERFCTR_VPC_1_HI               0x353
+#define GEN7_RBBM_PERFCTR_VPC_2_LO               0x354
+#define GEN7_RBBM_PERFCTR_VPC_2_HI               0x355
+#define GEN7_RBBM_PERFCTR_VPC_3_LO               0x356
+#define GEN7_RBBM_PERFCTR_VPC_3_HI               0x357
+#define GEN7_RBBM_PERFCTR_VPC_4_LO               0x358
+#define GEN7_RBBM_PERFCTR_VPC_4_HI               0x359
+#define GEN7_RBBM_PERFCTR_VPC_5_LO               0x35a
+#define GEN7_RBBM_PERFCTR_VPC_5_HI               0x35b
+#define GEN7_RBBM_PERFCTR_CCU_0_LO               0x35c
+#define GEN7_RBBM_PERFCTR_CCU_0_HI               0x35d
+#define GEN7_RBBM_PERFCTR_CCU_1_LO               0x35e
+#define GEN7_RBBM_PERFCTR_CCU_1_HI               0x35f
+#define GEN7_RBBM_PERFCTR_CCU_2_LO               0x360
+#define GEN7_RBBM_PERFCTR_CCU_2_HI               0x361
+#define GEN7_RBBM_PERFCTR_CCU_3_LO               0x362
+#define GEN7_RBBM_PERFCTR_CCU_3_HI               0x363
+#define GEN7_RBBM_PERFCTR_CCU_4_LO               0x364
+#define GEN7_RBBM_PERFCTR_CCU_4_HI               0x365
+#define GEN7_RBBM_PERFCTR_TSE_0_LO               0x366
+#define GEN7_RBBM_PERFCTR_TSE_0_HI               0x367
+#define GEN7_RBBM_PERFCTR_TSE_1_LO               0x368
+#define GEN7_RBBM_PERFCTR_TSE_1_HI               0x369
+#define GEN7_RBBM_PERFCTR_TSE_2_LO               0x36a
+#define GEN7_RBBM_PERFCTR_TSE_2_HI               0x36b
+#define GEN7_RBBM_PERFCTR_TSE_3_LO               0x36c
+#define GEN7_RBBM_PERFCTR_TSE_3_HI               0x36d
+#define GEN7_RBBM_PERFCTR_RAS_0_LO               0x36e
+#define GEN7_RBBM_PERFCTR_RAS_0_HI               0x36f
+#define GEN7_RBBM_PERFCTR_RAS_1_LO               0x370
+#define GEN7_RBBM_PERFCTR_RAS_1_HI               0x371
+#define GEN7_RBBM_PERFCTR_RAS_2_LO               0x372
+#define GEN7_RBBM_PERFCTR_RAS_2_HI               0x373
+#define GEN7_RBBM_PERFCTR_RAS_3_LO               0x374
+#define GEN7_RBBM_PERFCTR_RAS_3_HI               0x375
+#define GEN7_RBBM_PERFCTR_UCHE_0_LO              0x376
+#define GEN7_RBBM_PERFCTR_UCHE_0_HI              0x377
+#define GEN7_RBBM_PERFCTR_UCHE_1_LO              0x378
+#define GEN7_RBBM_PERFCTR_UCHE_1_HI              0x379
+#define GEN7_RBBM_PERFCTR_UCHE_2_LO              0x37a
+#define GEN7_RBBM_PERFCTR_UCHE_2_HI              0x37b
+#define GEN7_RBBM_PERFCTR_UCHE_3_LO              0x37c
+#define GEN7_RBBM_PERFCTR_UCHE_3_HI              0x37d
+#define GEN7_RBBM_PERFCTR_UCHE_4_LO              0x37e
+#define GEN7_RBBM_PERFCTR_UCHE_4_HI              0x37f
+#define GEN7_RBBM_PERFCTR_UCHE_5_LO              0x380
+#define GEN7_RBBM_PERFCTR_UCHE_5_HI              0x381
+#define GEN7_RBBM_PERFCTR_UCHE_6_LO              0x382
+#define GEN7_RBBM_PERFCTR_UCHE_6_HI              0x383
+#define GEN7_RBBM_PERFCTR_UCHE_7_LO              0x384
+#define GEN7_RBBM_PERFCTR_UCHE_7_HI              0x385
+#define GEN7_RBBM_PERFCTR_UCHE_8_LO              0x386
+#define GEN7_RBBM_PERFCTR_UCHE_8_HI              0x387
+#define GEN7_RBBM_PERFCTR_UCHE_9_LO              0x388
+#define GEN7_RBBM_PERFCTR_UCHE_9_HI              0x389
+#define GEN7_RBBM_PERFCTR_UCHE_10_LO             0x38a
+#define GEN7_RBBM_PERFCTR_UCHE_10_HI             0x38b
+#define GEN7_RBBM_PERFCTR_UCHE_11_LO             0x38c
+#define GEN7_RBBM_PERFCTR_UCHE_11_HI             0x38d
+#define GEN7_RBBM_PERFCTR_TP_0_LO                0x38e
+#define GEN7_RBBM_PERFCTR_TP_0_HI                0x38f
+#define GEN7_RBBM_PERFCTR_TP_1_LO                0x390
+#define GEN7_RBBM_PERFCTR_TP_1_HI                0x391
+#define GEN7_RBBM_PERFCTR_TP_2_LO                0x392
+#define GEN7_RBBM_PERFCTR_TP_2_HI                0x393
+#define GEN7_RBBM_PERFCTR_TP_3_LO                0x394
+#define GEN7_RBBM_PERFCTR_TP_3_HI                0x395
+#define GEN7_RBBM_PERFCTR_TP_4_LO                0x396
+#define GEN7_RBBM_PERFCTR_TP_4_HI                0x397
+#define GEN7_RBBM_PERFCTR_TP_5_LO                0x398
+#define GEN7_RBBM_PERFCTR_TP_5_HI                0x399
+#define GEN7_RBBM_PERFCTR_TP_6_LO                0x39a
+#define GEN7_RBBM_PERFCTR_TP_6_HI                0x39b
+#define GEN7_RBBM_PERFCTR_TP_7_LO                0x39c
+#define GEN7_RBBM_PERFCTR_TP_7_HI                0x39d
+#define GEN7_RBBM_PERFCTR_TP_8_LO                0x39e
+#define GEN7_RBBM_PERFCTR_TP_8_HI                0x39f
+#define GEN7_RBBM_PERFCTR_TP_9_LO                0x3a0
+#define GEN7_RBBM_PERFCTR_TP_9_HI                0x3a1
+#define GEN7_RBBM_PERFCTR_TP_10_LO               0x3a2
+#define GEN7_RBBM_PERFCTR_TP_10_HI               0x3a3
+#define GEN7_RBBM_PERFCTR_TP_11_LO               0x3a4
+#define GEN7_RBBM_PERFCTR_TP_11_HI               0x3a5
+#define GEN7_RBBM_PERFCTR_SP_0_LO                0x3a6
+#define GEN7_RBBM_PERFCTR_SP_0_HI                0x3a7
+#define GEN7_RBBM_PERFCTR_SP_1_LO                0x3a8
+#define GEN7_RBBM_PERFCTR_SP_1_HI                0x3a9
+#define GEN7_RBBM_PERFCTR_SP_2_LO                0x3aa
+#define GEN7_RBBM_PERFCTR_SP_2_HI                0x3ab
+#define GEN7_RBBM_PERFCTR_SP_3_LO                0x3ac
+#define GEN7_RBBM_PERFCTR_SP_3_HI                0x3ad
+#define GEN7_RBBM_PERFCTR_SP_4_LO                0x3ae
+#define GEN7_RBBM_PERFCTR_SP_4_HI                0x3af
+#define GEN7_RBBM_PERFCTR_SP_5_LO                0x3b0
+#define GEN7_RBBM_PERFCTR_SP_5_HI                0x3b1
+#define GEN7_RBBM_PERFCTR_SP_6_LO                0x3b2
+#define GEN7_RBBM_PERFCTR_SP_6_HI                0x3b3
+#define GEN7_RBBM_PERFCTR_SP_7_LO                0x3b4
+#define GEN7_RBBM_PERFCTR_SP_7_HI                0x3b5
+#define GEN7_RBBM_PERFCTR_SP_8_LO                0x3b6
+#define GEN7_RBBM_PERFCTR_SP_8_HI                0x3b7
+#define GEN7_RBBM_PERFCTR_SP_9_LO                0x3b8
+#define GEN7_RBBM_PERFCTR_SP_9_HI                0x3b9
+#define GEN7_RBBM_PERFCTR_SP_10_LO               0x3ba
+#define GEN7_RBBM_PERFCTR_SP_10_HI               0x3bb
+#define GEN7_RBBM_PERFCTR_SP_11_LO               0x3bc
+#define GEN7_RBBM_PERFCTR_SP_11_HI               0x3bd
+#define GEN7_RBBM_PERFCTR_SP_12_LO               0x3be
+#define GEN7_RBBM_PERFCTR_SP_12_HI               0x3bf
+#define GEN7_RBBM_PERFCTR_SP_13_LO               0x3c0
+#define GEN7_RBBM_PERFCTR_SP_13_HI               0x3c1
+#define GEN7_RBBM_PERFCTR_SP_14_LO               0x3c2
+#define GEN7_RBBM_PERFCTR_SP_14_HI               0x3c3
+#define GEN7_RBBM_PERFCTR_SP_15_LO               0x3c4
+#define GEN7_RBBM_PERFCTR_SP_15_HI               0x3c5
+#define GEN7_RBBM_PERFCTR_SP_16_LO               0x3c6
+#define GEN7_RBBM_PERFCTR_SP_16_HI               0x3c7
+#define GEN7_RBBM_PERFCTR_SP_17_LO               0x3c8
+#define GEN7_RBBM_PERFCTR_SP_17_HI               0x3c9
+#define GEN7_RBBM_PERFCTR_SP_18_LO               0x3ca
+#define GEN7_RBBM_PERFCTR_SP_18_HI               0x3cb
+#define GEN7_RBBM_PERFCTR_SP_19_LO               0x3cc
+#define GEN7_RBBM_PERFCTR_SP_19_HI               0x3cd
+#define GEN7_RBBM_PERFCTR_SP_20_LO               0x3ce
+#define GEN7_RBBM_PERFCTR_SP_20_HI               0x3cf
+#define GEN7_RBBM_PERFCTR_SP_21_LO               0x3d0
+#define GEN7_RBBM_PERFCTR_SP_21_HI               0x3d1
+#define GEN7_RBBM_PERFCTR_SP_22_LO               0x3d2
+#define GEN7_RBBM_PERFCTR_SP_22_HI               0x3d3
+#define GEN7_RBBM_PERFCTR_SP_23_LO               0x3d4
+#define GEN7_RBBM_PERFCTR_SP_23_HI               0x3d5
+#define GEN7_RBBM_PERFCTR_RB_0_LO                0x3d6
+#define GEN7_RBBM_PERFCTR_RB_0_HI                0x3d7
+#define GEN7_RBBM_PERFCTR_RB_1_LO                0x3d8
+#define GEN7_RBBM_PERFCTR_RB_1_HI                0x3d9
+#define GEN7_RBBM_PERFCTR_RB_2_LO                0x3da
+#define GEN7_RBBM_PERFCTR_RB_2_HI                0x3db
+#define GEN7_RBBM_PERFCTR_RB_3_LO                0x3dc
+#define GEN7_RBBM_PERFCTR_RB_3_HI                0x3dd
+#define GEN7_RBBM_PERFCTR_RB_4_LO                0x3de
+#define GEN7_RBBM_PERFCTR_RB_4_HI                0x3df
+#define GEN7_RBBM_PERFCTR_RB_5_LO                0x3e0
+#define GEN7_RBBM_PERFCTR_RB_5_HI                0x3e1
+#define GEN7_RBBM_PERFCTR_RB_6_LO                0x3e2
+#define GEN7_RBBM_PERFCTR_RB_6_HI                0x3e3
+#define GEN7_RBBM_PERFCTR_RB_7_LO                0x3e4
+#define GEN7_RBBM_PERFCTR_RB_7_HI                0x3e5
+#define GEN7_RBBM_PERFCTR_VSC_0_LO               0x3e6
+#define GEN7_RBBM_PERFCTR_VSC_0_HI               0x3e7
+#define GEN7_RBBM_PERFCTR_VSC_1_LO               0x3e8
+#define GEN7_RBBM_PERFCTR_VSC_1_HI               0x3e9
+#define GEN7_RBBM_PERFCTR_LRZ_0_LO               0x3ea
+#define GEN7_RBBM_PERFCTR_LRZ_0_HI               0x3eb
+#define GEN7_RBBM_PERFCTR_LRZ_1_LO               0x3ec
+#define GEN7_RBBM_PERFCTR_LRZ_1_HI               0x3ed
+#define GEN7_RBBM_PERFCTR_LRZ_2_LO               0x3ee
+#define GEN7_RBBM_PERFCTR_LRZ_2_HI               0x3ef
+#define GEN7_RBBM_PERFCTR_LRZ_3_LO               0x3f0
+#define GEN7_RBBM_PERFCTR_LRZ_3_HI               0x3f1
+#define GEN7_RBBM_PERFCTR_CMP_0_LO               0x3f2
+#define GEN7_RBBM_PERFCTR_CMP_0_HI               0x3f3
+#define GEN7_RBBM_PERFCTR_CMP_1_LO               0x3f4
+#define GEN7_RBBM_PERFCTR_CMP_1_HI               0x3f5
+#define GEN7_RBBM_PERFCTR_CMP_2_LO               0x3f6
+#define GEN7_RBBM_PERFCTR_CMP_2_HI               0x3f7
+#define GEN7_RBBM_PERFCTR_CMP_3_LO               0x3f8
+#define GEN7_RBBM_PERFCTR_CMP_3_HI               0x3f9
+#define GEN7_RBBM_PERFCTR_UFC_0_LO               0x3fa
+#define GEN7_RBBM_PERFCTR_UFC_0_HI               0x3fb
+#define GEN7_RBBM_PERFCTR_UFC_1_LO               0x3fc
+#define GEN7_RBBM_PERFCTR_UFC_1_HI               0x3fd
+#define GEN7_RBBM_PERFCTR_UFC_2_LO               0x3fe
+#define GEN7_RBBM_PERFCTR_UFC_2_HI               0x3ff
+#define GEN7_RBBM_PERFCTR_UFC_3_LO               0x400
+#define GEN7_RBBM_PERFCTR_UFC_3_HI               0x401
+#define GEN7_RBBM_PERFCTR2_HLSQ_0_LO             0x410
+#define GEN7_RBBM_PERFCTR2_HLSQ_0_HI             0x411
+#define GEN7_RBBM_PERFCTR2_HLSQ_1_LO             0x412
+#define GEN7_RBBM_PERFCTR2_HLSQ_1_HI             0x413
+#define GEN7_RBBM_PERFCTR2_HLSQ_2_LO             0x414
+#define GEN7_RBBM_PERFCTR2_HLSQ_2_HI             0x415
+#define GEN7_RBBM_PERFCTR2_HLSQ_3_LO             0x416
+#define GEN7_RBBM_PERFCTR2_HLSQ_3_HI             0x417
+#define GEN7_RBBM_PERFCTR2_HLSQ_4_LO             0x418
+#define GEN7_RBBM_PERFCTR2_HLSQ_4_HI             0x419
+#define GEN7_RBBM_PERFCTR2_HLSQ_5_LO             0x41a
+#define GEN7_RBBM_PERFCTR2_HLSQ_5_HI             0x41b
+#define GEN7_RBBM_PERFCTR2_CP_0_LO               0x41c
+#define GEN7_RBBM_PERFCTR2_CP_0_HI               0x41d
+#define GEN7_RBBM_PERFCTR2_CP_1_LO               0x41e
+#define GEN7_RBBM_PERFCTR2_CP_1_HI               0x41f
+#define GEN7_RBBM_PERFCTR2_CP_2_LO               0x420
+#define GEN7_RBBM_PERFCTR2_CP_2_HI               0x421
+#define GEN7_RBBM_PERFCTR2_CP_3_LO               0x422
+#define GEN7_RBBM_PERFCTR2_CP_3_HI               0x423
+#define GEN7_RBBM_PERFCTR2_CP_4_LO               0x424
+#define GEN7_RBBM_PERFCTR2_CP_4_HI               0x425
+#define GEN7_RBBM_PERFCTR2_CP_5_LO               0x426
+#define GEN7_RBBM_PERFCTR2_CP_5_HI               0x427
+#define GEN7_RBBM_PERFCTR2_CP_6_LO               0x428
+#define GEN7_RBBM_PERFCTR2_CP_6_HI               0x429
+#define GEN7_RBBM_PERFCTR2_SP_0_LO               0x42a
+#define GEN7_RBBM_PERFCTR2_SP_0_HI               0x42b
+#define GEN7_RBBM_PERFCTR2_SP_1_LO               0x42c
+#define GEN7_RBBM_PERFCTR2_SP_1_HI               0x42d
+#define GEN7_RBBM_PERFCTR2_SP_2_LO               0x42e
+#define GEN7_RBBM_PERFCTR2_SP_2_HI               0x42f
+#define GEN7_RBBM_PERFCTR2_SP_3_LO               0x430
+#define GEN7_RBBM_PERFCTR2_SP_3_HI               0x431
+#define GEN7_RBBM_PERFCTR2_SP_4_LO               0x432
+#define GEN7_RBBM_PERFCTR2_SP_4_HI               0x433
+#define GEN7_RBBM_PERFCTR2_SP_5_LO               0x434
+#define GEN7_RBBM_PERFCTR2_SP_5_HI               0x435
+#define GEN7_RBBM_PERFCTR2_SP_6_LO               0x436
+#define GEN7_RBBM_PERFCTR2_SP_6_HI               0x437
+#define GEN7_RBBM_PERFCTR2_SP_7_LO               0x438
+#define GEN7_RBBM_PERFCTR2_SP_7_HI               0x439
+#define GEN7_RBBM_PERFCTR2_SP_8_LO               0x43a
+#define GEN7_RBBM_PERFCTR2_SP_8_HI               0x43b
+#define GEN7_RBBM_PERFCTR2_SP_9_LO               0x43c
+#define GEN7_RBBM_PERFCTR2_SP_9_HI               0x43d
+#define GEN7_RBBM_PERFCTR2_SP_10_LO              0x43e
+#define GEN7_RBBM_PERFCTR2_SP_10_HI              0x43f
+#define GEN7_RBBM_PERFCTR2_SP_11_LO              0x440
+#define GEN7_RBBM_PERFCTR2_SP_11_HI              0x441
+#define GEN7_RBBM_PERFCTR2_TP_0_LO               0x442
+#define GEN7_RBBM_PERFCTR2_TP_0_HI               0x443
+#define GEN7_RBBM_PERFCTR2_TP_1_LO               0x444
+#define GEN7_RBBM_PERFCTR2_TP_1_HI               0x445
+#define GEN7_RBBM_PERFCTR2_TP_2_LO               0x446
+#define GEN7_RBBM_PERFCTR2_TP_2_HI               0x447
+#define GEN7_RBBM_PERFCTR2_TP_3_LO               0x448
+#define GEN7_RBBM_PERFCTR2_TP_3_HI               0x449
+#define GEN7_RBBM_PERFCTR2_TP_4_LO               0x44a
+#define GEN7_RBBM_PERFCTR2_TP_4_HI               0x44b
+#define GEN7_RBBM_PERFCTR2_TP_5_LO               0x44c
+#define GEN7_RBBM_PERFCTR2_TP_5_HI               0x44d
+#define GEN7_RBBM_PERFCTR2_UFC_0_LO              0x44e
+#define GEN7_RBBM_PERFCTR2_UFC_0_HI              0x44f
+#define GEN7_RBBM_PERFCTR2_UFC_1_LO              0x450
+#define GEN7_RBBM_PERFCTR2_UFC_1_HI              0x451
+#define GEN7_RBBM_PERFCTR_BV_PC_0_LO             0x460
+#define GEN7_RBBM_PERFCTR_BV_PC_0_HI             0x461
+#define GEN7_RBBM_PERFCTR_BV_PC_1_LO             0x462
+#define GEN7_RBBM_PERFCTR_BV_PC_1_HI             0x463
+#define GEN7_RBBM_PERFCTR_BV_PC_2_LO             0x464
+#define GEN7_RBBM_PERFCTR_BV_PC_2_HI             0x465
+#define GEN7_RBBM_PERFCTR_BV_PC_3_LO             0x466
+#define GEN7_RBBM_PERFCTR_BV_PC_3_HI             0x467
+#define GEN7_RBBM_PERFCTR_BV_PC_4_LO             0x468
+#define GEN7_RBBM_PERFCTR_BV_PC_4_HI             0x469
+#define GEN7_RBBM_PERFCTR_BV_PC_5_LO             0x46a
+#define GEN7_RBBM_PERFCTR_BV_PC_5_HI             0x46b
+#define GEN7_RBBM_PERFCTR_BV_PC_6_LO             0x46c
+#define GEN7_RBBM_PERFCTR_BV_PC_6_HI             0x46d
+#define GEN7_RBBM_PERFCTR_BV_PC_7_LO             0x46e
+#define GEN7_RBBM_PERFCTR_BV_PC_7_HI             0x46f
+#define GEN7_RBBM_PERFCTR_BV_VFD_0_LO            0x470
+#define GEN7_RBBM_PERFCTR_BV_VFD_0_HI            0x471
+#define GEN7_RBBM_PERFCTR_BV_VFD_1_LO            0x472
+#define GEN7_RBBM_PERFCTR_BV_VFD_1_HI            0x473
+#define GEN7_RBBM_PERFCTR_BV_VFD_2_LO            0x474
+#define GEN7_RBBM_PERFCTR_BV_VFD_2_HI            0x475
+#define GEN7_RBBM_PERFCTR_BV_VFD_3_LO            0x476
+#define GEN7_RBBM_PERFCTR_BV_VFD_3_HI            0x477
+#define GEN7_RBBM_PERFCTR_BV_VFD_4_LO            0x478
+#define GEN7_RBBM_PERFCTR_BV_VFD_4_HI            0x479
+#define GEN7_RBBM_PERFCTR_BV_VFD_5_LO            0x47a
+#define GEN7_RBBM_PERFCTR_BV_VFD_5_HI            0x47b
+#define GEN7_RBBM_PERFCTR_BV_VFD_6_LO            0x47c
+#define GEN7_RBBM_PERFCTR_BV_VFD_6_HI            0x47d
+#define GEN7_RBBM_PERFCTR_BV_VFD_7_LO            0x47e
+#define GEN7_RBBM_PERFCTR_BV_VFD_7_HI            0x47f
+#define GEN7_RBBM_PERFCTR_BV_VPC_0_LO            0x480
+#define GEN7_RBBM_PERFCTR_BV_VPC_0_HI            0x481
+#define GEN7_RBBM_PERFCTR_BV_VPC_1_LO            0x482
+#define GEN7_RBBM_PERFCTR_BV_VPC_1_HI            0x483
+#define GEN7_RBBM_PERFCTR_BV_VPC_2_LO            0x484
+#define GEN7_RBBM_PERFCTR_BV_VPC_2_HI            0x485
+#define GEN7_RBBM_PERFCTR_BV_VPC_3_LO            0x486
+#define GEN7_RBBM_PERFCTR_BV_VPC_3_HI            0x487
+#define GEN7_RBBM_PERFCTR_BV_VPC_4_LO            0x488
+#define GEN7_RBBM_PERFCTR_BV_VPC_4_HI            0x489
+#define GEN7_RBBM_PERFCTR_BV_VPC_5_LO            0x48a
+#define GEN7_RBBM_PERFCTR_BV_VPC_5_HI            0x48b
+#define GEN7_RBBM_PERFCTR_BV_TSE_0_LO            0x48c
+#define GEN7_RBBM_PERFCTR_BV_TSE_0_HI            0x48d
+#define GEN7_RBBM_PERFCTR_BV_TSE_1_LO            0x48e
+#define GEN7_RBBM_PERFCTR_BV_TSE_1_HI            0x48f
+#define GEN7_RBBM_PERFCTR_BV_TSE_2_LO            0x490
+#define GEN7_RBBM_PERFCTR_BV_TSE_2_HI            0x491
+#define GEN7_RBBM_PERFCTR_BV_TSE_3_LO            0x492
+#define GEN7_RBBM_PERFCTR_BV_TSE_3_HI            0x493
+#define GEN7_RBBM_PERFCTR_BV_RAS_0_LO            0x494
+#define GEN7_RBBM_PERFCTR_BV_RAS_0_HI            0x495
+#define GEN7_RBBM_PERFCTR_BV_RAS_1_LO            0x496
+#define GEN7_RBBM_PERFCTR_BV_RAS_1_HI            0x497
+#define GEN7_RBBM_PERFCTR_BV_RAS_2_LO            0x498
+#define GEN7_RBBM_PERFCTR_BV_RAS_2_HI            0x499
+#define GEN7_RBBM_PERFCTR_BV_RAS_3_LO            0x49a
+#define GEN7_RBBM_PERFCTR_BV_RAS_3_HI            0x49b
+#define GEN7_RBBM_PERFCTR_BV_LRZ_0_LO            0x49c
+#define GEN7_RBBM_PERFCTR_BV_LRZ_0_HI            0x49d
+#define GEN7_RBBM_PERFCTR_BV_LRZ_1_LO            0x49e
+#define GEN7_RBBM_PERFCTR_BV_LRZ_1_HI            0x49f
+#define GEN7_RBBM_PERFCTR_BV_LRZ_2_LO            0x4a0
+#define GEN7_RBBM_PERFCTR_BV_LRZ_2_HI            0x4a1
+#define GEN7_RBBM_PERFCTR_BV_LRZ_3_LO            0x4a2
+#define GEN7_RBBM_PERFCTR_BV_LRZ_3_HI            0x4a3
+
+#define GEN7_RBBM_PERFCTR_CNTL                   0x500
+#define GEN7_RBBM_PERFCTR_RBBM_SEL_0             0x507
+#define GEN7_RBBM_PERFCTR_RBBM_SEL_1             0x508
+#define GEN7_RBBM_PERFCTR_RBBM_SEL_2             0x509
+#define GEN7_RBBM_PERFCTR_RBBM_SEL_3             0x50a
+#define GEN7_RBBM_PERFCTR_GPU_BUSY_MASKED        0x50b
+#define GEN7_RBBM_PERFCTR_SRAM_INIT_CMD          0x50e
+#define GEN7_RBBM_PERFCTR_SRAM_INIT_STATUS       0x50f
+
+#define GEN7_RBBM_ISDB_CNT                       0x533
+#define GEN7_RBBM_NC_MODE_CNTL                   0x534
+#define GEN7_RBBM_SNAPSHOT_STATUS                0x535
+
+#define GEN7_RBBM_PERFCTR_UCHE_12_LO             0x584
+#define GEN7_RBBM_PERFCTR_UCHE_12_HI             0x585
+#define GEN7_RBBM_PERFCTR_UCHE_13_LO             0x586
+#define GEN7_RBBM_PERFCTR_UCHE_13_HI             0x587
+#define GEN7_RBBM_PERFCTR_UCHE_14_LO             0x588
+#define GEN7_RBBM_PERFCTR_UCHE_14_HI             0x589
+#define GEN7_RBBM_PERFCTR_UCHE_15_LO             0x58a
+#define GEN7_RBBM_PERFCTR_UCHE_15_HI             0x58b
+#define GEN7_RBBM_PERFCTR_UCHE_16_LO             0x58c
+#define GEN7_RBBM_PERFCTR_UCHE_16_HI             0x58d
+#define GEN7_RBBM_PERFCTR_UCHE_17_LO             0x58e
+#define GEN7_RBBM_PERFCTR_UCHE_17_HI             0x58f
+#define GEN7_RBBM_PERFCTR_UCHE_18_LO             0x590
+#define GEN7_RBBM_PERFCTR_UCHE_18_HI             0x591
+#define GEN7_RBBM_PERFCTR_UCHE_19_LO             0x592
+#define GEN7_RBBM_PERFCTR_UCHE_19_HI             0x593
+#define GEN7_RBBM_PERFCTR_UCHE_20_LO             0x594
+#define GEN7_RBBM_PERFCTR_UCHE_20_HI             0x595
+#define GEN7_RBBM_PERFCTR_UCHE_21_LO             0x596
+#define GEN7_RBBM_PERFCTR_UCHE_21_HI             0x597
+#define GEN7_RBBM_PERFCTR_UCHE_22_LO             0x598
+#define GEN7_RBBM_PERFCTR_UCHE_22_HI             0x599
+#define GEN7_RBBM_PERFCTR_UCHE_23_LO             0x59a
+#define GEN7_RBBM_PERFCTR_UCHE_23_HI             0x59b
+
+#define GEN7_RBBM_SECVID_TRUST_CNTL              0xf400
+#define GEN7_RBBM_SECVID_TSB_TRUSTED_BASE_LO     0xf800
+#define GEN7_RBBM_SECVID_TSB_TRUSTED_BASE_HI     0xf801
+#define GEN7_RBBM_SECVID_TSB_TRUSTED_SIZE        0xf802
+#define GEN7_RBBM_SECVID_TSB_CNTL                0xf803
+#define GEN7_RBBM_SECVID_TSB_STATUS_LO           0xfc00
+#define GEN7_RBBM_SECVID_TSB_STATUS_HI           0xfc01
+
+#define GEN7_RBBM_GBIF_CLIENT_QOS_CNTL   0x00011
+#define GEN7_RBBM_GBIF_HALT              0x00016
+#define GEN7_RBBM_GBIF_HALT_ACK          0x00017
+#define GEN7_RBBM_INTERFACE_HANG_INT_CNTL 0x0001f
+#define GEN7_RBBM_INT_CLEAR_CMD          0x00037
+#define GEN7_RBBM_INT_0_MASK             0x00038
+#define GEN7_RBBM_INT_2_MASK             0x0003a
+#define GEN7_RBBM_SP_HYST_CNT            0x00042
+#define GEN7_RBBM_SW_RESET_CMD           0x00043
+#define GEN7_RBBM_RAC_THRESHOLD_CNT      0x00044
+#define GEN7_RBBM_CLOCK_CNTL_GLOBAL      0x000ad
+#define GEN7_RBBM_CLOCK_CNTL             0x000ae
+#define GEN7_RBBM_CLOCK_CNTL_SP0         0x000b0
+#define GEN7_RBBM_CLOCK_CNTL2_SP0        0x000b4
+#define GEN7_RBBM_CLOCK_DELAY_SP0        0x000b8
+#define GEN7_RBBM_CLOCK_HYST_SP0         0x000bc
+#define GEN7_RBBM_CLOCK_CNTL_TP0         0x000c0
+#define GEN7_RBBM_CLOCK_CNTL2_TP0        0x000c4
+#define GEN7_RBBM_CLOCK_CNTL3_TP0        0x000c8
+#define GEN7_RBBM_CLOCK_CNTL4_TP0        0x000cc
+#define GEN7_RBBM_CLOCK_DELAY_TP0        0x000d0
+#define GEN7_RBBM_CLOCK_DELAY2_TP0       0x000d4
+#define GEN7_RBBM_CLOCK_DELAY3_TP0       0x000d8
+#define GEN7_RBBM_CLOCK_DELAY4_TP0       0x000dc
+#define GEN7_RBBM_CLOCK_HYST_TP0         0x000e0
+#define GEN7_RBBM_CLOCK_HYST2_TP0        0x000e4
+#define GEN7_RBBM_CLOCK_HYST3_TP0        0x000e8
+#define GEN7_RBBM_CLOCK_HYST4_TP0        0x000ec
+#define GEN7_RBBM_CLOCK_CNTL_RB0         0x000f0
+#define GEN7_RBBM_CLOCK_CNTL2_RB0        0x000f4
+#define GEN7_RBBM_CLOCK_CNTL_CCU0        0x000f8
+#define GEN7_RBBM_CLOCK_HYST_RB_CCU0     0x00100
+#define GEN7_RBBM_CLOCK_CNTL_RAC         0x00104
+#define GEN7_RBBM_CLOCK_CNTL2_RAC        0x00105
+#define GEN7_RBBM_CLOCK_DELAY_RAC        0x00106
+#define GEN7_RBBM_CLOCK_HYST_RAC         0x00107
+#define GEN7_RBBM_CLOCK_CNTL_TSE_RAS_RBBM 0x00108
+#define GEN7_RBBM_CLOCK_DELAY_TSE_RAS_RBBM 0x00109
+#define GEN7_RBBM_CLOCK_HYST_TSE_RAS_RBBM 0x0010a
+#define GEN7_RBBM_CLOCK_CNTL_UCHE        0x0010b
+#define GEN7_RBBM_CLOCK_CNTL2_UCHE       0x0010c
+#define GEN7_RBBM_CLOCK_DELAY_UCHE       0x0010f
+#define GEN7_RBBM_CLOCK_HYST_UCHE        0x00110
+#define GEN7_RBBM_CLOCK_MODE_VFD         0x00111
+#define GEN7_RBBM_CLOCK_DELAY_VFD        0x00112
+#define GEN7_RBBM_CLOCK_HYST_VFD         0x00113
+#define GEN7_RBBM_CLOCK_MODE_GPC         0x00114
+#define GEN7_RBBM_CLOCK_DELAY_GPC        0x00115
+#define GEN7_RBBM_CLOCK_HYST_GPC         0x00116
+#define GEN7_RBBM_CLOCK_DELAY_HLSQ_2     0x00117
+#define GEN7_RBBM_CLOCK_CNTL_GMU_GX      0x00118
+#define GEN7_RBBM_CLOCK_DELAY_GMU_GX     0x00119
+#define GEN7_RBBM_CLOCK_HYST_GMU_GX      0x0011a
+#define GEN7_RBBM_CLOCK_MODE_HLSQ        0x0011b
+#define GEN7_RBBM_CLOCK_DELAY_HLSQ       0x0011c
+#define GEN7_RBBM_CLOCK_HYST_HLSQ        0x0011d
+#define GEN7_RBBM_CGC_GLOBAL_LOAD_CMD    0x0011e
+#define GEN7_RBBM_CGC_P2S_TRIG_CMD       0x0011f
+#define GEN7_RBBM_CGC_P2S_STATUS         0x00122
+#define GEN7_RBBM_CLOCK_HYST2_VFD        0x0012f
+#define GEN7_RBBM_CLOCK_MODE_CP          0x00260
+#define GEN7_RBBM_CLOCK_MODE_BV_LRZ      0x00284
+#define GEN7_RBBM_CLOCK_MODE_BV_GRAS     0x00285
+#define GEN7_RBBM_CLOCK_MODE2_GRAS       0x00286
+#define GEN7_RBBM_CLOCK_MODE_BV_VFD      0x00287
+#define GEN7_RBBM_CLOCK_MODE_BV_GPC      0x00288
+#define GEN7_RBBM_SW_FUSE_INT_STATUS     0x002c0
+#define GEN7_RBBM_SW_FUSE_INT_MASK       0x002c1
+
+/* DBGC_CFG registers */
+#define GEN7_DBGC_CFG_DBGBUS_SEL_A                  0x600
+#define GEN7_DBGC_CFG_DBGBUS_SEL_B                  0x601
+#define GEN7_DBGC_CFG_DBGBUS_SEL_C                  0x602
+#define GEN7_DBGC_CFG_DBGBUS_SEL_D                  0x603
+#define GEN7_DBGC_CFG_DBGBUS_CNTLT                  0x604
+#define GEN7_DBGC_CFG_DBGBUS_CNTLM                  0x605
+#define GEN7_DBGC_CFG_DBGBUS_OPL                    0x606
+#define GEN7_DBGC_CFG_DBGBUS_OPE                    0x607
+#define GEN7_DBGC_CFG_DBGBUS_IVTL_0                 0x608
+#define GEN7_DBGC_CFG_DBGBUS_IVTL_1                 0x609
+#define GEN7_DBGC_CFG_DBGBUS_IVTL_2                 0x60a
+#define GEN7_DBGC_CFG_DBGBUS_IVTL_3                 0x60b
+#define GEN7_DBGC_CFG_DBGBUS_MASKL_0                0x60c
+#define GEN7_DBGC_CFG_DBGBUS_MASKL_1                0x60d
+#define GEN7_DBGC_CFG_DBGBUS_MASKL_2                0x60e
+#define GEN7_DBGC_CFG_DBGBUS_MASKL_3                0x60f
+#define GEN7_DBGC_CFG_DBGBUS_BYTEL_0                0x610
+#define GEN7_DBGC_CFG_DBGBUS_BYTEL_1                0x611
+#define GEN7_DBGC_CFG_DBGBUS_IVTE_0                 0x612
+#define GEN7_DBGC_CFG_DBGBUS_IVTE_1                 0x613
+#define GEN7_DBGC_CFG_DBGBUS_IVTE_2                 0x614
+#define GEN7_DBGC_CFG_DBGBUS_IVTE_3                 0x615
+#define GEN7_DBGC_CFG_DBGBUS_MASKE_0                0x616
+#define GEN7_DBGC_CFG_DBGBUS_MASKE_1                0x617
+#define GEN7_DBGC_CFG_DBGBUS_MASKE_2                0x618
+#define GEN7_DBGC_CFG_DBGBUS_MASKE_3                0x619
+#define GEN7_DBGC_CFG_DBGBUS_NIBBLEE                0x61a
+#define GEN7_DBGC_CFG_DBGBUS_PTRC0                  0x61b
+#define GEN7_DBGC_CFG_DBGBUS_PTRC1                  0x61c
+#define GEN7_DBGC_CFG_DBGBUS_LOADREG                0x61d
+#define GEN7_DBGC_CFG_DBGBUS_IDX                    0x61e
+#define GEN7_DBGC_CFG_DBGBUS_CLRC                   0x61f
+#define GEN7_DBGC_CFG_DBGBUS_LOADIVT                0x620
+#define GEN7_DBGC_VBIF_DBG_CNTL                     0x621
+#define GEN7_DBGC_DBG_LO_HI_GPIO                    0x622
+#define GEN7_DBGC_EXT_TRACE_BUS_CNTL                0x623
+#define GEN7_DBGC_READ_AHB_THROUGH_DBG              0x624
+#define GEN7_DBGC_CFG_DBGBUS_OVER                   0x626
+#define GEN7_DBGC_CFG_DBGBUS_TRACE_BUF1             0x62f
+#define GEN7_DBGC_CFG_DBGBUS_TRACE_BUF2             0x630
+#define GEN7_DBGC_EVT_CFG                           0x640
+#define GEN7_DBGC_EVT_INTF_SEL_0                    0x641
+#define GEN7_DBGC_EVT_INTF_SEL_1                    0x642
+#define GEN7_DBGC_PERF_ATB_CFG                      0x643
+#define GEN7_DBGC_PERF_ATB_COUNTER_SEL_0            0x644
+#define GEN7_DBGC_PERF_ATB_COUNTER_SEL_1            0x645
+#define GEN7_DBGC_PERF_ATB_COUNTER_SEL_2            0x646
+#define GEN7_DBGC_PERF_ATB_COUNTER_SEL_3            0x647
+#define GEN7_DBGC_PERF_ATB_TRIG_INTF_SEL_0          0x648
+#define GEN7_DBGC_PERF_ATB_TRIG_INTF_SEL_1          0x649
+#define GEN7_DBGC_PERF_ATB_DRAIN_CMD                0x64a
+#define GEN7_DBGC_ECO_CNTL                          0x650
+#define GEN7_DBGC_AHB_DBG_CNTL                      0x651
+#define GEN7_DBGC_TRACE_BUFFER_STATUS               0x699
+#define GEN7_DBGC_DBG_TRACE_BUFFER_RD_ADDR          0x69b
+#define GEN7_DBGC_DBG_TRACE_BUFFER_RD_DATA          0x69c
+
+/* VSC registers */
+#define GEN7_VSC_PERFCTR_VSC_SEL_0          0xcd8
+#define GEN7_VSC_PERFCTR_VSC_SEL_1          0xcd9
+
+/* GRAS registers */
+#define GEN7_GRAS_NC_MODE_CNTL              0x8602
+#define GEN7_GRAS_PERFCTR_TSE_SEL_0         0x8610
+#define GEN7_GRAS_PERFCTR_TSE_SEL_1         0x8611
+#define GEN7_GRAS_PERFCTR_TSE_SEL_2         0x8612
+#define GEN7_GRAS_PERFCTR_TSE_SEL_3         0x8613
+#define GEN7_GRAS_PERFCTR_RAS_SEL_0         0x8614
+#define GEN7_GRAS_PERFCTR_RAS_SEL_1         0x8615
+#define GEN7_GRAS_PERFCTR_RAS_SEL_2         0x8616
+#define GEN7_GRAS_PERFCTR_RAS_SEL_3         0x8617
+#define GEN7_GRAS_PERFCTR_LRZ_SEL_0         0x8618
+#define GEN7_GRAS_PERFCTR_LRZ_SEL_1         0x8619
+#define GEN7_GRAS_PERFCTR_LRZ_SEL_2         0x861a
+#define GEN7_GRAS_PERFCTR_LRZ_SEL_3         0x861b
+
+/* RB registers */
+#define GEN7_RB_NC_MODE_CNTL                0x8e08
+#define GEN7_RB_PERFCTR_RB_SEL_0            0x8e10
+#define GEN7_RB_PERFCTR_RB_SEL_1            0x8e11
+#define GEN7_RB_PERFCTR_RB_SEL_2            0x8e12
+#define GEN7_RB_PERFCTR_RB_SEL_3            0x8e13
+#define GEN7_RB_PERFCTR_RB_SEL_4            0x8e14
+#define GEN7_RB_PERFCTR_RB_SEL_5            0x8e15
+#define GEN7_RB_PERFCTR_RB_SEL_6            0x8e16
+#define GEN7_RB_PERFCTR_RB_SEL_7            0x8e17
+#define GEN7_RB_PERFCTR_CCU_SEL_0           0x8e18
+#define GEN7_RB_PERFCTR_CCU_SEL_1           0x8e19
+#define GEN7_RB_PERFCTR_CCU_SEL_2           0x8e1a
+#define GEN7_RB_PERFCTR_CCU_SEL_3           0x8e1b
+#define GEN7_RB_PERFCTR_CCU_SEL_4           0x8e1c
+#define GEN7_RB_CMP_DBG_ECO_CNTL            0x8e28
+#define GEN7_RB_PERFCTR_CMP_SEL_0           0x8e2c
+#define GEN7_RB_PERFCTR_CMP_SEL_1           0x8e2d
+#define GEN7_RB_PERFCTR_CMP_SEL_2           0x8e2e
+#define GEN7_RB_PERFCTR_CMP_SEL_3           0x8e2f
+#define GEN7_RB_PERFCTR_UFC_SEL_0           0x8e30
+#define GEN7_RB_PERFCTR_UFC_SEL_1           0x8e31
+#define GEN7_RB_PERFCTR_UFC_SEL_2           0x8e32
+#define GEN7_RB_PERFCTR_UFC_SEL_3           0x8e33
+#define GEN7_RB_PERFCTR_UFC_SEL_4           0x8e34
+#define GEN7_RB_PERFCTR_UFC_SEL_5           0x8e35
+#define GEN7_RB_SUB_BLOCK_SEL_CNTL_HOST     0x8e3b
+#define GEN7_RB_SUB_BLOCK_SEL_CNTL_CD       0x8e3d
+#define GEN7_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE 0x8e50
+
+/* PC registers */
+#define GEN7_PC_PERFCTR_PC_SEL_0            0x9e42
+#define GEN7_PC_PERFCTR_PC_SEL_1            0x9e43
+#define GEN7_PC_PERFCTR_PC_SEL_2            0x9e44
+#define GEN7_PC_PERFCTR_PC_SEL_3            0x9e45
+#define GEN7_PC_PERFCTR_PC_SEL_4            0x9e46
+#define GEN7_PC_PERFCTR_PC_SEL_5            0x9e47
+#define GEN7_PC_PERFCTR_PC_SEL_6            0x9e48
+#define GEN7_PC_PERFCTR_PC_SEL_7            0x9e49
+#define GEN7_PC_PERFCTR_PC_SEL_8            0x9e4a
+#define GEN7_PC_PERFCTR_PC_SEL_9            0x9e4b
+#define GEN7_PC_PERFCTR_PC_SEL_10           0x9e4c
+#define GEN7_PC_PERFCTR_PC_SEL_11           0x9e4d
+#define GEN7_PC_PERFCTR_PC_SEL_12           0x9e4e
+#define GEN7_PC_PERFCTR_PC_SEL_13           0x9e4f
+#define GEN7_PC_PERFCTR_PC_SEL_14           0x9e50
+#define GEN7_PC_PERFCTR_PC_SEL_15           0x9e51
+
+/* VFD registers */
+#define GEN7_VFD_PERFCTR_VFD_SEL_0          0xa610
+#define GEN7_VFD_PERFCTR_VFD_SEL_1          0xa611
+#define GEN7_VFD_PERFCTR_VFD_SEL_2          0xa612
+#define GEN7_VFD_PERFCTR_VFD_SEL_3          0xa613
+#define GEN7_VFD_PERFCTR_VFD_SEL_4          0xa614
+#define GEN7_VFD_PERFCTR_VFD_SEL_5          0xa615
+#define GEN7_VFD_PERFCTR_VFD_SEL_6          0xa616
+#define GEN7_VFD_PERFCTR_VFD_SEL_7          0xa617
+#define GEN7_VFD_PERFCTR_VFD_SEL_8          0xa618
+#define GEN7_VFD_PERFCTR_VFD_SEL_9          0xa619
+#define GEN7_VFD_PERFCTR_VFD_SEL_10         0xa61a
+#define GEN7_VFD_PERFCTR_VFD_SEL_11         0xa61b
+#define GEN7_VFD_PERFCTR_VFD_SEL_12         0xa61c
+#define GEN7_VFD_PERFCTR_VFD_SEL_13         0xa61d
+#define GEN7_VFD_PERFCTR_VFD_SEL_14         0xa61e
+#define GEN7_VFD_PERFCTR_VFD_SEL_15         0xa61f
+
+/* SP registers */
+#define GEN7_SP_READ_SEL                    0xae6d
+#define GEN7_SP_DBG_CNTL                    0xae71
+#define GEN7_SP_AHB_READ_APERTURE           0xc000
+
+/* VPC registers */
+#define GEN7_VPC_PERFCTR_VPC_SEL_0          0x960b
+#define GEN7_VPC_PERFCTR_VPC_SEL_1          0x960c
+#define GEN7_VPC_PERFCTR_VPC_SEL_2          0x960c
+#define GEN7_VPC_PERFCTR_VPC_SEL_3          0x960e
+#define GEN7_VPC_PERFCTR_VPC_SEL_4          0x960f
+#define GEN7_VPC_PERFCTR_VPC_SEL_5          0x9610
+#define GEN7_VPC_PERFCTR_VPC_SEL_6          0x9611
+#define GEN7_VPC_PERFCTR_VPC_SEL_7          0x9612
+#define GEN7_VPC_PERFCTR_VPC_SEL_8          0x9613
+#define GEN7_VPC_PERFCTR_VPC_SEL_9          0x9614
+#define GEN7_VPC_PERFCTR_VPC_SEL_10         0x9615
+#define GEN7_VPC_PERFCTR_VPC_SEL_11         0x9616
+
+/* UCHE registers */
+#define GEN7_UCHE_MODE_CNTL                 0xe01
+#define GEN7_UCHE_WRITE_THRU_BASE_LO        0xe07
+#define GEN7_UCHE_WRITE_THRU_BASE_HI        0xe08
+#define GEN7_UCHE_TRAP_BASE_LO              0xe09
+#define GEN7_UCHE_TRAP_BASE_HI              0xe0a
+#define GEN7_UCHE_GMEM_RANGE_MIN_LO         0xe0b
+#define GEN7_UCHE_GMEM_RANGE_MIN_HI         0xe0c
+#define GEN7_UCHE_GMEM_RANGE_MAX_LO         0xe0d
+#define GEN7_UCHE_GMEM_RANGE_MAX_HI         0xe0e
+#define GEN7_UCHE_DBG_CNTL_1                0xe12
+#define GEN7_UCHE_CACHE_WAYS                0xe17
+#define GEN7_UCHE_CLIENT_PF                 0xe19
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_0        0xe1c
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_1        0xe1d
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2        0xe1e
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_3        0xe1f
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_4        0xe20
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_5        0xe21
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_6        0xe22
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_7        0xe23
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_8        0xe24
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_9        0xe25
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_10       0xe26
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_11       0xe27
+#define GEN7_UCHE_GBIF_GX_CONFIG            0xe3a
+#define GEN7_UCHE_CMDQ_CONFIG               0xe3c
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_12       0xe40
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_13       0xe41
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_14       0xe42
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_15       0xe43
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_16       0xe44
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_17       0xe45
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_18       0xe46
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_19       0xe47
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_20       0xe48
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_21       0xe49
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_22       0xe4a
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_23       0xe4b
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_0      0xe50
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_1      0xe51
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_2      0xe52
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_3      0xe53
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_4      0xe54
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_5      0xe55
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_6      0xe56
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_7      0xe57
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_8      0xe58
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_9      0xe59
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_10     0xe5a
+#define GEN7_UCHE_PERFCTR_UCHE_SEL_2_11     0xe5b
+
+/* SP registers */
+#define GEN7_SP_NC_MODE_CNTL                0xae02
+#define GEN7_SP_PERFCTR_HLSQ_SEL_0          0xae60
+#define GEN7_SP_PERFCTR_HLSQ_SEL_1          0xae61
+#define GEN7_SP_PERFCTR_HLSQ_SEL_2          0xae62
+#define GEN7_SP_PERFCTR_HLSQ_SEL_3          0xae63
+#define GEN7_SP_PERFCTR_HLSQ_SEL_4          0xae64
+#define GEN7_SP_PERFCTR_HLSQ_SEL_5          0xae65
+#define GEN7_SP_PERFCTR_SP_SEL_0            0xae80
+#define GEN7_SP_PERFCTR_SP_SEL_1            0xae81
+#define GEN7_SP_PERFCTR_SP_SEL_2            0xae82
+#define GEN7_SP_PERFCTR_SP_SEL_3            0xae83
+#define GEN7_SP_PERFCTR_SP_SEL_4            0xae84
+#define GEN7_SP_PERFCTR_SP_SEL_5            0xae85
+#define GEN7_SP_PERFCTR_SP_SEL_6            0xae86
+#define GEN7_SP_PERFCTR_SP_SEL_7            0xae87
+#define GEN7_SP_PERFCTR_SP_SEL_8            0xae88
+#define GEN7_SP_PERFCTR_SP_SEL_9            0xae89
+#define GEN7_SP_PERFCTR_SP_SEL_10           0xae8a
+#define GEN7_SP_PERFCTR_SP_SEL_11           0xae8b
+#define GEN7_SP_PERFCTR_SP_SEL_12           0xae8c
+#define GEN7_SP_PERFCTR_SP_SEL_13           0xae8d
+#define GEN7_SP_PERFCTR_SP_SEL_14           0xae8e
+#define GEN7_SP_PERFCTR_SP_SEL_15           0xae8f
+#define GEN7_SP_PERFCTR_SP_SEL_16           0xae90
+#define GEN7_SP_PERFCTR_SP_SEL_17           0xae91
+#define GEN7_SP_PERFCTR_SP_SEL_18           0xae92
+#define GEN7_SP_PERFCTR_SP_SEL_19           0xae93
+#define GEN7_SP_PERFCTR_SP_SEL_20           0xae94
+#define GEN7_SP_PERFCTR_SP_SEL_21           0xae95
+#define GEN7_SP_PERFCTR_SP_SEL_22           0xae96
+#define GEN7_SP_PERFCTR_SP_SEL_23           0xae97
+#define GEN7_SP_PERFCTR_SP_SEL_24           0xae98
+#define GEN7_SP_PERFCTR_SP_SEL_25           0xae99
+#define GEN7_SP_PERFCTR_SP_SEL_26           0xae9a
+#define GEN7_SP_PERFCTR_SP_SEL_27           0xae9b
+#define GEN7_SP_PERFCTR_SP_SEL_28           0xae9c
+#define GEN7_SP_PERFCTR_SP_SEL_29           0xae9d
+#define GEN7_SP_PERFCTR_SP_SEL_30           0xae9e
+#define GEN7_SP_PERFCTR_SP_SEL_31           0xae9f
+#define GEN7_SP_PERFCTR_SP_SEL_32           0xaea0
+#define GEN7_SP_PERFCTR_SP_SEL_33           0xaea1
+#define GEN7_SP_PERFCTR_SP_SEL_34           0xaea2
+#define GEN7_SP_PERFCTR_SP_SEL_35           0xaea3
+
+/* TP registers */
+#define GEN7_TPL1_DBG_ECO_CNTL1             0xb602
+#define GEN7_TPL1_NC_MODE_CNTL              0xb604
+#define GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_1   0xb609
+#define GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_2   0xb60a
+#define GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_3   0xb60b
+#define GEN7_TPL1_BICUBIC_WEIGHTS_TABLE_4   0xb60c
+#define GEN7_TPL1_PERFCTR_TP_SEL_0          0xb610
+#define GEN7_TPL1_PERFCTR_TP_SEL_1          0xb611
+#define GEN7_TPL1_PERFCTR_TP_SEL_2          0xb612
+#define GEN7_TPL1_PERFCTR_TP_SEL_3          0xb613
+#define GEN7_TPL1_PERFCTR_TP_SEL_4          0xb614
+#define GEN7_TPL1_PERFCTR_TP_SEL_5          0xb615
+#define GEN7_TPL1_PERFCTR_TP_SEL_6          0xb616
+#define GEN7_TPL1_PERFCTR_TP_SEL_7          0xb617
+#define GEN7_TPL1_PERFCTR_TP_SEL_8          0xb618
+#define GEN7_TPL1_PERFCTR_TP_SEL_9          0xb619
+#define GEN7_TPL1_PERFCTR_TP_SEL_10         0xb61a
+#define GEN7_TPL1_PERFCTR_TP_SEL_11         0xb61b
+#define GEN7_TPL1_PERFCTR_TP_SEL_12         0xb61c
+#define GEN7_TPL1_PERFCTR_TP_SEL_13         0xb61d
+#define GEN7_TPL1_PERFCTR_TP_SEL_14         0xb61e
+#define GEN7_TPL1_PERFCTR_TP_SEL_15         0xb61f
+#define GEN7_TPL1_PERFCTR_TP_SEL_16         0xb620
+#define GEN7_TPL1_PERFCTR_TP_SEL_17         0xb621
+
+/* VBIF registers */
+#define GEN7_VBIF_XIN_HALT_CTRL1                0x3081
+#define GEN7_VBIF_TEST_BUS_OUT_CTRL             0x3084
+#define GEN7_VBIF_TEST_BUS1_CTRL0               0x3085
+#define GEN7_VBIF_TEST_BUS1_CTRL1               0x3086
+#define GEN7_VBIF_TEST_BUS2_CTRL0               0x3087
+#define GEN7_VBIF_TEST_BUS2_CTRL1               0x3088
+#define GEN7_VBIF_TEST_BUS_OUT                  0x308c
+#define GEN7_VBIF_PERF_CNT_SEL0                 0x30d0
+#define GEN7_VBIF_PERF_CNT_SEL1                 0x30d1
+#define GEN7_VBIF_PERF_CNT_SEL2                 0x30d2
+#define GEN7_VBIF_PERF_CNT_SEL3                 0x30d3
+#define GEN7_VBIF_PERF_CNT_LOW0                 0x30d8
+#define GEN7_VBIF_PERF_CNT_LOW1                 0x30d9
+#define GEN7_VBIF_PERF_CNT_LOW2                 0x30da
+#define GEN7_VBIF_PERF_CNT_LOW3                 0x30db
+#define GEN7_VBIF_PERF_CNT_HIGH0                0x30e0
+#define GEN7_VBIF_PERF_CNT_HIGH1                0x30e1
+#define GEN7_VBIF_PERF_CNT_HIGH2                0x30e2
+#define GEN7_VBIF_PERF_CNT_HIGH3                0x30e3
+#define GEN7_VBIF_PERF_PWR_CNT_EN0              0x3100
+#define GEN7_VBIF_PERF_PWR_CNT_EN1              0x3101
+#define GEN7_VBIF_PERF_PWR_CNT_EN2              0x3102
+#define GEN7_VBIF_PERF_PWR_CNT_LOW0             0x3110
+#define GEN7_VBIF_PERF_PWR_CNT_LOW1             0x3111
+#define GEN7_VBIF_PERF_PWR_CNT_LOW2             0x3112
+#define GEN7_VBIF_PERF_PWR_CNT_HIGH0            0x3118
+#define GEN7_VBIF_PERF_PWR_CNT_HIGH1            0x3119
+#define GEN7_VBIF_PERF_PWR_CNT_HIGH2            0x311a
+
+/* GBIF countables */
+#define GBIF_AXI0_READ_DATA_TOTAL_BEATS    34
+#define GBIF_AXI1_READ_DATA_TOTAL_BEATS    35
+#define GBIF_AXI0_WRITE_DATA_TOTAL_BEATS   46
+#define GBIF_AXI1_WRITE_DATA_TOTAL_BEATS   47
+
+/* GBIF registers */
+#define GEN7_GBIF_SCACHE_CNTL0            0x3c01
+#define GEN7_GBIF_SCACHE_CNTL1            0x3c02
+#define GEN7_GBIF_QSB_SIDE0               0x3c03
+#define GEN7_GBIF_QSB_SIDE1               0x3c04
+#define GEN7_GBIF_QSB_SIDE2               0x3c05
+#define GEN7_GBIF_QSB_SIDE3               0x3c06
+#define GEN7_GBIF_HALT                    0x3c45
+#define GEN7_GBIF_HALT_ACK                0x3c46
+
+#define GEN7_GBIF_CLIENT_HALT_MASK        BIT(0)
+#define GEN7_GBIF_ARB_HALT_MASK           BIT(1)
+#define GEN7_GBIF_GX_HALT_MASK            BIT(0)
+
+#define GEN7_GBIF_PERF_PWR_CNT_EN         0x3cc0
+#define GEN7_GBIF_PERF_PWR_CNT_CLR        0x3cc1
+#define GEN7_GBIF_PERF_CNT_SEL            0x3cc2
+#define GEN7_GBIF_PERF_PWR_CNT_SEL        0x3cc3
+#define GEN7_GBIF_PERF_CNT_LOW0           0x3cc4
+#define GEN7_GBIF_PERF_CNT_LOW1           0x3cc5
+#define GEN7_GBIF_PERF_CNT_LOW2           0x3cc6
+#define GEN7_GBIF_PERF_CNT_LOW3           0x3cc7
+#define GEN7_GBIF_PERF_CNT_HIGH0          0x3cc8
+#define GEN7_GBIF_PERF_CNT_HIGH1          0x3cc9
+#define GEN7_GBIF_PERF_CNT_HIGH2          0x3cca
+#define GEN7_GBIF_PERF_CNT_HIGH3          0x3ccb
+#define GEN7_GBIF_PWR_CNT_LOW0            0x3ccc
+#define GEN7_GBIF_PWR_CNT_LOW1            0x3ccd
+#define GEN7_GBIF_PWR_CNT_LOW2            0x3cce
+#define GEN7_GBIF_PWR_CNT_HIGH0           0x3ccf
+#define GEN7_GBIF_PWR_CNT_HIGH1           0x3cd0
+#define GEN7_GBIF_PWR_CNT_HIGH2           0x3cd1
+
+
+/* CX_DBGC_CFG registers */
+#define GEN7_CX_DBGC_CFG_DBGBUS_SEL_A                   0x18400
+#define GEN7_CX_DBGC_CFG_DBGBUS_SEL_B                   0x18401
+#define GEN7_CX_DBGC_CFG_DBGBUS_SEL_C                   0x18402
+#define GEN7_CX_DBGC_CFG_DBGBUS_SEL_D                   0x18403
+#define GEN7_CX_DBGC_CFG_DBGBUS_CNTLT                   0x18404
+#define GEN7_CX_DBGC_CFG_DBGBUS_CNTLM                   0x18405
+#define GEN7_CX_DBGC_CFG_DBGBUS_OPL                     0x18406
+#define GEN7_CX_DBGC_CFG_DBGBUS_OPE                     0x18407
+#define GEN7_CX_DBGC_CFG_DBGBUS_IVTL_0                  0x18408
+#define GEN7_CX_DBGC_CFG_DBGBUS_IVTL_1                  0x18409
+#define GEN7_CX_DBGC_CFG_DBGBUS_IVTL_2                  0x1840a
+#define GEN7_CX_DBGC_CFG_DBGBUS_IVTL_3                  0x1840b
+#define GEN7_CX_DBGC_CFG_DBGBUS_MASKL_0                 0x1840c
+#define GEN7_CX_DBGC_CFG_DBGBUS_MASKL_1                 0x1840d
+#define GEN7_CX_DBGC_CFG_DBGBUS_MASKL_2                 0x1840e
+#define GEN7_CX_DBGC_CFG_DBGBUS_MASKL_3                 0x1840f
+#define GEN7_CX_DBGC_CFG_DBGBUS_BYTEL_0                 0x18410
+#define GEN7_CX_DBGC_CFG_DBGBUS_BYTEL_1                 0x18411
+#define GEN7_CX_DBGC_CFG_DBGBUS_IVTE_0                  0x18412
+#define GEN7_CX_DBGC_CFG_DBGBUS_IVTE_1                  0x18413
+#define GEN7_CX_DBGC_CFG_DBGBUS_IVTE_2                  0x18414
+#define GEN7_CX_DBGC_CFG_DBGBUS_IVTE_3                  0x18415
+#define GEN7_CX_DBGC_CFG_DBGBUS_MASKE_0                 0x18416
+#define GEN7_CX_DBGC_CFG_DBGBUS_MASKE_1                 0x18417
+#define GEN7_CX_DBGC_CFG_DBGBUS_MASKE_2                 0x18418
+#define GEN7_CX_DBGC_CFG_DBGBUS_MASKE_3                 0x18419
+#define GEN7_CX_DBGC_CFG_DBGBUS_NIBBLEE                 0x1841a
+#define GEN7_CX_DBGC_CFG_DBGBUS_PTRC0                   0x1841b
+#define GEN7_CX_DBGC_CFG_DBGBUS_PTRC1                   0x1841c
+#define GEN7_CX_DBGC_CFG_DBGBUS_LOADREG                 0x1841d
+#define GEN7_CX_DBGC_CFG_DBGBUS_IDX                     0x1841e
+#define GEN7_CX_DBGC_CFG_DBGBUS_CLRC                    0x1841f
+#define GEN7_CX_DBGC_CFG_DBGBUS_LOADIVT                 0x18420
+#define GEN7_CX_DBGC_VBIF_DBG_CNTL                      0x18421
+#define GEN7_CX_DBGC_DBG_LO_HI_GPIO                     0x18422
+#define GEN7_CX_DBGC_EXT_TRACE_BUS_CNTL                 0x18423
+#define GEN7_CX_DBGC_READ_AHB_THROUGH_DBG               0x18424
+#define GEN7_CX_DBGC_CFG_DBGBUS_OVER                    0x18426
+#define GEN7_CX_DBGC_CFG_DBGBUS_TRACE_BUF1              0x1842f
+#define GEN7_CX_DBGC_CFG_DBGBUS_TRACE_BUF2              0x18430
+#define GEN7_CX_DBGC_EVT_CFG                            0x18440
+#define GEN7_CX_DBGC_EVT_INTF_SEL_0                     0x18441
+#define GEN7_CX_DBGC_EVT_INTF_SEL_1                     0x18442
+#define GEN7_CX_DBGC_PERF_ATB_CFG                       0x18443
+#define GEN7_CX_DBGC_PERF_ATB_COUNTER_SEL_0             0x18444
+#define GEN7_CX_DBGC_PERF_ATB_COUNTER_SEL_1             0x18445
+#define GEN7_CX_DBGC_PERF_ATB_COUNTER_SEL_2             0x18446
+#define GEN7_CX_DBGC_PERF_ATB_COUNTER_SEL_3             0x18447
+#define GEN7_CX_DBGC_PERF_ATB_TRIG_INTF_SEL_0           0x18448
+#define GEN7_CX_DBGC_PERF_ATB_TRIG_INTF_SEL_1           0x18449
+#define GEN7_CX_DBGC_PERF_ATB_DRAIN_CMD                 0x1844a
+#define GEN7_CX_DBGC_ECO_CNTL                           0x18450
+#define GEN7_CX_DBGC_AHB_DBG_CNTL                       0x18451
+#define GEN7_CX_DBGC_TCM_DBG_ADDR                       0x18580
+#define GEN7_CX_DBGC_TCM_DBG_DATA                       0x18581
+
+/* GMU control registers */
+#define GEN7_GMU_CM3_ITCM_START			0x1b400
+#define GEN7_GMU_CM3_DTCM_START			0x1c400
+#define GEN7_GMU_NMI_CONTROL_STATUS		0x1cbf0
+#define GEN7_GMU_BOOT_SLUMBER_OPTION		0x1cbf8
+#define GEN7_GMU_GX_VOTE_IDX			0x1cbf9
+#define GEN7_GMU_MX_VOTE_IDX			0x1cbfa
+#define GEN7_GMU_DCVS_ACK_OPTION		0x1cbfc
+#define GEN7_GMU_DCVS_PERF_SETTING		0x1cbfd
+#define GEN7_GMU_DCVS_BW_SETTING		0x1cbfe
+#define GEN7_GMU_DCVS_RETURN			0x1cbff
+#define GEN7_GMU_ICACHE_CONFIG			0x1f400
+#define GEN7_GMU_DCACHE_CONFIG			0x1f401
+#define GEN7_GMU_SYS_BUS_CONFIG			0x1f40f
+#define GEN7_GMU_CX_MRC_GBIF_QOS_CTRL		0x1f50b
+#define GEN7_GMU_CM3_SYSRESET			0x1f800
+#define GEN7_GMU_CM3_BOOT_CONFIG		0x1f801
+#define GEN7_GMU_CX_GMU_WFI_CONFIG		0x1f802
+#define GEN7_GMU_CX_GMU_WDOG_CTRL		0x1f813
+#define GEN7_GMU_CM3_FW_BUSY			0x1f81a
+#define GEN7_GMU_CM3_FW_INIT_RESULT		0x1f81c
+#define GEN7_GMU_CM3_CFG			0x1f82d
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_ENABLE	0x1f840
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_0	0x1f841
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_1	0x1f842
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L	0x1f844
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_H	0x1f845
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_L	0x1f846
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_1_H	0x1f847
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_L	0x1f848
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_2_H	0x1f849
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_L	0x1f84a
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_3_H	0x1f84b
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_L	0x1f84c
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_4_H	0x1f84d
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_5_L	0x1f84e
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_5_H	0x1f84f
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_GMUCLK_0_L	0x1f850
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_GMUCLK_0_H	0x1f851
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_GMUCLK_1_L	0x1f852
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_GMUCLK_1_H	0x1f853
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_2	0x1f860
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_6_L	0x1f870
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_6_H	0x1f871
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_7_L	0x1f872
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_7_H	0x1f873
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_8_L	0x1f874
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_8_H	0x1f875
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_9_L	0x1f876
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_9_H	0x1f877
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_10_L	0x1f878
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_XOCLK_10_H	0x1f879
+#define GEN7_GMU_CX_GMU_POWER_COUNTER_SELECT_3	0x1f87f
+#define GEN7_GMU_CX_AO_COUNTER_LO		0x1f880
+#define GEN7_GMU_CX_AO_COUNTER_HI		0x1f881
+#define GEN7_GMU_CX_GMU_ALWAYS_ON_COUNTER_L	0x1f888
+#define GEN7_GMU_CX_GMU_ALWAYS_ON_COUNTER_H	0x1f889
+#define GEN7_GMU_PWR_COL_INTER_FRAME_CTRL	0x1f8c0
+#define GEN7_GMU_PWR_COL_INTER_FRAME_HYST	0x1f8c1
+#define GEN7_GMU_GFX_PWR_CLK_STATUS		0x1f8d0
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_ENABLE	0x1f8a0
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_SELECT_0	0x1f8a1
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_SELECT_1	0x1f8a2
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_0_L	0x1f8a4
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_0_H	0x1f8a5
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_1_L	0x1f8a6
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_1_H	0x1f8a7
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_2_L	0x1f8a8
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_2_H	0x1f8a9
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_3_L	0x1f8aa
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_3_H	0x1f8ab
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_4_L	0x1f8ac
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_4_H	0x1f8ad
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_5_L	0x1f8ae
+#define GEN7_GMU_CX_GMU_PERF_COUNTER_5_H	0x1f8af
+#define GEN7_GPU_GMU_CX_GMU_RPMH_POWER_STATE	0x1f8ec
+#define GEN7_GMU_BOOT_KMD_LM_HANDSHAKE		0x1f9f0
+
+/* HFI registers*/
+#define GEN7_GMU_ALWAYS_ON_COUNTER_L		0x1f888
+#define GEN7_GMU_ALWAYS_ON_COUNTER_H		0x1f889
+#define GEN7_GMU_GMU_PWR_COL_KEEPALIVE		0x1f8c3
+#define GEN7_GMU_PWR_COL_PREEMPT_KEEPALIVE	0x1f8c4
+#define GEN7_GMU_HFI_CTRL_STATUS		0x1f980
+#define GEN7_GMU_HFI_QTBL_INFO			0x1f984
+#define GEN7_GMU_HFI_QTBL_ADDR			0x1f985
+#define GEN7_GMU_HFI_CTRL_INIT			0x1f986
+#define GEN7_GMU_GMU2HOST_INTR_SET		0x1f990
+#define GEN7_GMU_GMU2HOST_INTR_CLR		0x1f991
+#define GEN7_GMU_GMU2HOST_INTR_INFO		0x1f992
+#define GEN7_GMU_GMU2HOST_INTR_MASK		0x1f993
+#define GEN7_GMU_HOST2GMU_INTR_SET		0x1f994
+#define GEN7_GMU_HOST2GMU_INTR_CLR		0x1f995
+#define GEN7_GMU_HOST2GMU_INTR_RAW_INFO		0x1f996
+#define GEN7_GMU_HOST2GMU_INTR_EN_0		0x1f997
+#define GEN7_GMU_HOST2GMU_INTR_EN_1		0x1f998
+#define GEN7_GMU_HOST2GMU_INTR_EN_2		0x1f999
+#define GEN7_GMU_HOST2GMU_INTR_EN_3		0x1f99a
+#define GEN7_GMU_HOST2GMU_INTR_INFO_0		0x1f99b
+#define GEN7_GMU_HOST2GMU_INTR_INFO_1		0x1f99c
+#define GEN7_GMU_HOST2GMU_INTR_INFO_2		0x1f99d
+#define GEN7_GMU_HOST2GMU_INTR_INFO_3		0x1f99e
+#define GEN7_GMU_GENERAL_0			0x1f9c5
+#define GEN7_GMU_GENERAL_1			0x1f9c6
+#define GEN7_GMU_GENERAL_6			0x1f9cb
+#define GEN7_GMU_GENERAL_7			0x1f9cc
+#define GEN7_GMU_GENERAL_8			0x1f9cd
+#define GEN7_GMU_GENERAL_9			0x1f9ce
+#define GEN7_GMU_GENERAL_10			0x1f9cf
+#define GEN7_GMU_GENERAL_11			0x1f9d0
+
+/* FAL10 veto register */
+#define GEN7_GPU_GMU_CX_GMU_CX_FAL_INTF		0x1f8f0
+#define GEN7_GPU_GMU_CX_GMU_CX_FALNEXT_INTF	0x1f8f1
+
+/* CLX registers */
+#define GEN7_GPU_GMU_CX_CBCAST_GENERIC_ID       0x20001
+#define GEN7_GPU_GMU_CX_PMIC_PAYLOAD            0x20003
+#define GEN7_GPU_GMU_CX_PMIC_PAYLOAD_1          0x20005
+
+#define GEN7_GMU_AO_INTERRUPT_EN		0x23b03
+#define GEN7_GMU_AO_HOST_INTERRUPT_CLR		0x23b04
+#define GEN7_GMU_AO_HOST_INTERRUPT_STATUS	0x23b05
+#define GEN7_GMU_AO_HOST_INTERRUPT_MASK		0x23b06
+#define GEN7_GPU_GMU_AO_GMU_CGC_MODE_CNTL	0x23b09
+#define GEN7_GPU_GMU_AO_GMU_CGC_DELAY_CNTL	0x23b0a
+#define GEN7_GPU_GMU_AO_GMU_CGC_HYST_CNTL	0x23b0b
+#define GEN7_GPU_GMU_AO_GPU_CX_BUSY_STATUS	0x23b0c
+#define GEN7_GPU_GMU_AO_GPU_CX_BUSY_STATUS2	0x23b0d
+#define GEN7_GPU_GMU_AO_GPU_CX_BUSY_MASK	0x23b0e
+#define GEN7_GMU_AO_AHB_FENCE_CTRL		0x23b10
+#define GEN7_GMU_AHB_FENCE_STATUS		0x23b13
+#define GEN7_GMU_AHB_FENCE_STATUS_CLR		0x23b14
+#define GEN7_GMU_RBBM_INT_UNMASKED_STATUS	0x23b15
+#define GEN7_GMU_AO_SPARE_CNTL			0x23b16
+#define GEN7_GPU_GMU_AO_GPU_LPAC_BUSY_STATUS	0x23b30
+
+/* GMU RSC control registers */
+#define GEN7_GMU_RSCC_CONTROL_REQ		0x23b07
+#define GEN7_GMU_RSCC_CONTROL_ACK		0x23b08
+
+/* FENCE control registers */
+#define GEN7_GMU_AHB_FENCE_RANGE_0		0x23b11
+
+/* GMU countables */
+#define GEN7_GMU_CM3_BUSY_CYCLES		0
+
+/* GPUCC registers */
+#define GEN7_GPU_CC_GX_DOMAIN_MISC3		0x26541
+#define GEN7_GPU_CC_CX_GDSCR			0x26442
+
+/* GPU RSC sequencer registers */
+#define GEN7_GPU_RSCC_RSC_STATUS0_DRV0			0x00004
+#define GEN7_RSCC_PDC_SEQ_START_ADDR			0x00008
+#define GEN7_RSCC_PDC_MATCH_VALUE_LO			0x00009
+#define GEN7_RSCC_PDC_MATCH_VALUE_HI			0x0000a
+#define GEN7_RSCC_PDC_SLAVE_ID_DRV0			0x0000b
+#define GEN7_RSCC_HIDDEN_TCS_CMD0_ADDR			0x0000d
+#define GEN7_RSCC_HIDDEN_TCS_CMD0_DATA			0x0000e
+#define GEN7_RSCC_TIMESTAMP_UNIT0_TIMESTAMP_L_DRV0	0x00082
+#define GEN7_RSCC_TIMESTAMP_UNIT0_TIMESTAMP_H_DRV0	0x00083
+#define GEN7_RSCC_TIMESTAMP_UNIT1_EN_DRV0		0x00089
+#define GEN7_RSCC_TIMESTAMP_UNIT1_OUTPUT_DRV0		0x0008c
+#define GEN7_RSCC_OVERRIDE_START_ADDR			0x00100
+#define GEN7_RSCC_SEQ_BUSY_DRV0				0x00101
+#define GEN7_RSCC_SEQ_MEM_0_DRV0			0x00180
+#define GEN7_RSCC_TCS0_DRV0_STATUS			0x00346
+#define GEN7_RSCC_TCS1_DRV0_STATUS			0x003ee
+#define GEN7_RSCC_TCS2_DRV0_STATUS			0x00496
+#define GEN7_RSCC_TCS3_DRV0_STATUS			0x0053e
+#define GEN7_RSCC_TCS4_DRV0_STATUS			0x005e6
+#define GEN7_RSCC_TCS5_DRV0_STATUS			0x0068e
+#define GEN7_RSCC_TCS6_DRV0_STATUS			0x00736
+#define GEN7_RSCC_TCS7_DRV0_STATUS			0x007de
+#define GEN7_RSCC_TCS8_DRV0_STATUS			0x00886
+#define GEN7_RSCC_TCS9_DRV0_STATUS			0x0092e
+
+/* Device-specific RSCC registers */
+#define GEN7_2_0_RSCC_SEQ_MEM_0_DRV0			0x00154
+#define GEN7_2_0_RSCC_TCS0_DRV0_STATUS			0x0034a
+#define GEN7_2_0_RSCC_TCS1_DRV0_STATUS			0x003f2
+#define GEN7_2_0_RSCC_TCS2_DRV0_STATUS			0x0049a
+#define GEN7_2_0_RSCC_TCS3_DRV0_STATUS			0x00542
+#define GEN7_2_0_RSCC_TCS4_DRV0_STATUS			0x005ea
+#define GEN7_2_0_RSCC_TCS5_DRV0_STATUS			0x00692
+#define GEN7_2_0_RSCC_TCS6_DRV0_STATUS			0x0073a
+#define GEN7_2_0_RSCC_TCS7_DRV0_STATUS			0x007e2
+#define GEN7_2_0_RSCC_TCS8_DRV0_STATUS			0x0088a
+#define GEN7_2_0_RSCC_TCS9_DRV0_STATUS			0x00932
+
+/* GPU PDC sequencer registers in AOSS.RPMh domain */
+#define GEN7_PDC_GPU_ENABLE_PDC				0x1140
+#define GEN7_PDC_GPU_SEQ_START_ADDR			0x1148
+
+#define GEN7_SMMU_BASE				0x28000
+
+/* GPU CX_MISC registers */
+#define GEN7_CX_MISC_BASE			0x27800
+#define GEN7_GPU_CX_MISC_TCM_RET_CNTL		0x39
+#define GEN7_GPU_CX_MISC_AO_COUNTER_LO		0x80
+#define GEN7_GPU_CX_MISC_AO_COUNTER_HI		0x81
+#define GEN7_GPU_CX_MISC_SW_FUSE_VALUE		0x400
+
+/* GPU SW Fuse Feature bit fields */
+#define GEN7_FASTBLEND_SW_FUSE		0
+#define GEN7_LPAC_SW_FUSE		1
+#define GEN7_RAYTRACING_SW_FUSE		2
+
+#define GEN7_SW_FUSE_INT_MASK \
+	((1 << GEN7_FASTBLEND_SW_FUSE) |	\
+	(1 << GEN7_LPAC_SW_FUSE) |	\
+	(1 << GEN7_RAYTRACING_SW_FUSE))
+
+/* QDSS register offsets */
+#define QDSS_AOSS_APB_TMC_RSZ 0x04
+#define QDSS_AOSS_APB_TMC_RRD 0x10
+#define QDSS_AOSS_APB_TMC_RRP 0x14
+#define QDSS_AOSS_APB_TMC_RWP 0x18
+#define QDSS_AOSS_APB_TMC_CTRL 0x20
+#define QDSS_AOSS_APB_TMC_MODE 0x28
+#define QDSS_AOSS_APB_TMC_FFCR 0x304
+#define QDSS_AOSS_APB_TMC_LAR 0xfb0
+#define QDSS_AOSS_APB_ETR_CTRL 0x20
+#define QDSS_AOSS_APB_ETR1_CTRL 0x7020
+
+#endif /* _GEN7_REG_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/gfx_driver_product.mk
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/gfx_driver_product.mk
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+PRODUCT_PACKAGES += msm_kgsl.ko
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/gfx_kernel_board.mk
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/gfx_kernel_board.mk
@@ -0,0 +1,9 @@
+#SPDX-License-Identifier: GPL-2.0-only
+
+ifneq ($(TARGET_USES_QMAA),true)
+	ifeq ($(call is-board-platform-in-list,$(TARGET_BOARD_PLATFORM)),true)
+		BOARD_VENDOR_KERNEL_MODULES += $(KERNEL_MODULES_OUT)/msm_kgsl.ko
+		BOARD_VENDOR_RAMDISK_KERNEL_MODULES += $(KERNEL_MODULES_OUT)/msm_kgsl.ko
+		BOARD_VENDOR_RAMDISK_RECOVERY_KERNEL_MODULES_LOAD += $(KERNEL_MODULES_OUT)/msm_kgsl.ko
+	endif
+endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/gfx_kernel_headers.py
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/gfx_kernel_headers.py
@@ -0,0 +1,95 @@
+# Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 as published by
+# the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+# more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import argparse
+import filecmp
+import os
+import re
+import subprocess
+import sys
+
+def run_headers_install(verbose, gen_dir, headers_install, unifdef, prefix, h):
+    if not h.startswith(prefix):
+        print('error: expected prefix [%s] on header [%s]' % (prefix, h))
+        return False
+
+    out_h = os.path.join(gen_dir, h[len(prefix):])
+    (out_h_dirname, out_h_basename) = os.path.split(out_h)
+    env = os.environ.copy()
+    env["LOC_UNIFDEF"] = unifdef
+    cmd = ["sh", headers_install, h, out_h]
+
+    if verbose:
+        print('run_headers_install: cmd is %s' % cmd)
+
+    result = subprocess.call(cmd, env=env)
+
+    if result != 0:
+        print('error: run_headers_install: cmd %s failed %d' % (cmd, result))
+        return False
+    return True
+
+def gen_gfx_headers(verbose, gen_dir, headers_install, unifdef, gfx_include_uapi):
+    error_count = 0
+    for h in gfx_include_uapi:
+        gfx_uapi_include_prefix = os.path.join(h.split('/include/uapi/')[0],
+                                                 'include',
+                                                 'uapi') + os.sep
+
+        if not run_headers_install(
+                verbose, gen_dir, headers_install, unifdef,
+                gfx_uapi_include_prefix, h): error_count += 1
+    return error_count
+
+def main():
+    """Parse command line arguments and perform top level control."""
+    parser = argparse.ArgumentParser(
+            description=__doc__,
+            formatter_class=argparse.RawDescriptionHelpFormatter)
+
+    # Arguments that apply to every invocation of this script.
+    parser.add_argument(
+            '--verbose', action='store_true',
+            help='Print output that describes the workings of this script.')
+    parser.add_argument(
+            '--header_arch', required=True,
+            help='The arch for which to generate headers.')
+    parser.add_argument(
+            '--gen_dir', required=True,
+            help='Where to place the generated files.')
+    parser.add_argument(
+            '--gfx_include_uapi', required=True, nargs='*',
+            help='The list of techpack/*/include/uapi header files.')
+    parser.add_argument(
+            '--headers_install', required=True,
+            help='The headers_install tool to process input headers.')
+    parser.add_argument(
+            '--unifdef',
+            required=True,
+            help='The unifdef tool used by headers_install.')
+
+    args = parser.parse_args()
+
+    if args.verbose:
+        print('header_arch [%s]' % args.header_arch)
+        print('gen_dir [%s]' % args.gen_dir)
+        print('gfx_include_uapi [%s]' % args.gfx_include_uapi)
+        print('headers_install [%s]' % args.headers_install)
+        print('unifdef [%s]' % args.unifdef)
+
+    return gen_gfx_headers(args.verbose, args.gen_dir,
+            args.headers_install, args.unifdef, args.gfx_include_uapi)
+
+if __name__ == '__main__':
+    sys.exit(main())
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/governor_gpubw_mon.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/governor_gpubw_mon.c
@@ -0,0 +1,341 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/devfreq.h>
+#include <linux/slab.h>
+
+#include "governor.h"
+#include "msm_adreno_devfreq.h"
+
+#define MIN_BUSY                1000
+#define LONG_FLOOR              50000
+#define HIST                    5
+#define TARGET                  80
+#define CAP                     75
+#define WAIT_THRESHOLD          10
+/* AB vote is in multiple of BW_STEP Mega bytes */
+#define BW_STEP                 50
+
+static void _update_cutoff(struct devfreq_msm_adreno_tz_data *priv,
+					unsigned int norm_max)
+{
+	int i;
+
+	priv->bus.max = norm_max;
+	for (i = 0; i < priv->bus.num; i++) {
+		priv->bus.up[i] = priv->bus.p_up[i] * norm_max / 100;
+		priv->bus.down[i] = priv->bus.p_down[i] * norm_max / 100;
+	}
+}
+
+static ssize_t cur_ab_show(struct device *dev,
+	struct device_attribute *attr,
+	char *buf)
+{
+	struct devfreq *df = to_devfreq(dev);
+	struct msm_busmon_extended_profile *bus_profile = container_of(
+					(df->profile),
+					struct msm_busmon_extended_profile,
+					profile);
+
+	return scnprintf(buf, PAGE_SIZE, "%lu\n", bus_profile->ab_mbytes);
+}
+
+static ssize_t sampling_interval_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct devfreq *df = to_devfreq(dev);
+	struct msm_busmon_extended_profile *bus_profile = container_of(
+					(df->profile),
+					struct msm_busmon_extended_profile,
+					profile);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n", bus_profile->sampling_ms);
+}
+
+static ssize_t sampling_interval_store(struct device *dev,
+		struct device_attribute *attr,
+		const char *buf, size_t count)
+{
+	struct devfreq *df = to_devfreq(dev);
+	struct msm_busmon_extended_profile *bus_profile = container_of(
+					(df->profile),
+					struct msm_busmon_extended_profile,
+					profile);
+	u32 value;
+	int ret;
+
+	ret = kstrtou32(buf, 0, &value);
+	if (ret)
+		return ret;
+
+	bus_profile->sampling_ms = value;
+
+	return count;
+}
+
+static DEVICE_ATTR_RW(sampling_interval);
+static DEVICE_ATTR_RO(cur_ab);
+
+static const struct device_attribute *gpubw_attr_list[] = {
+	&dev_attr_sampling_interval,
+	&dev_attr_cur_ab,
+	NULL
+};
+
+static u32 generate_hint(struct devfreq_msm_adreno_tz_data *priv, int buslevel,
+		unsigned long freq, unsigned long minfreq)
+{
+	int act_level;
+	int norm_max_cycles;
+	int norm_cycles;
+	int wait_active_percent;
+	int gpu_percent;
+
+	norm_max_cycles = (unsigned int)(priv->bus.ram_time) /
+			(unsigned int) priv->bus.total_time;
+	norm_cycles = (unsigned int)(priv->bus.ram_time + priv->bus.ram_wait) /
+			(unsigned int) priv->bus.total_time;
+	wait_active_percent = (100 * (unsigned int)priv->bus.ram_wait) /
+			(unsigned int) priv->bus.ram_time;
+	gpu_percent = (100 * (unsigned int)priv->bus.gpu_time) /
+			(unsigned int) priv->bus.total_time;
+
+	/*
+	 * If there's a new high watermark, update the cutoffs and send the
+	 * FAST hint, provided that we are using a floating watermark.
+	 * Otherwise check the current value against the current
+	 * cutoffs.
+	 */
+	if (norm_max_cycles > priv->bus.max && priv->bus.floating) {
+		_update_cutoff(priv, norm_max_cycles);
+		return BUSMON_FLAG_FAST_HINT;
+	}
+
+	/* Increase BW vote to avoid starving GPU for BW if required */
+	if (priv->avoid_ddr_stall && minfreq == freq) {
+		if (wait_active_percent > 95)
+			return BUSMON_FLAG_SUPER_FAST_HINT;
+
+		if (wait_active_percent > 80)
+			return BUSMON_FLAG_FAST_HINT;
+	}
+
+	/* GPU votes for IB not AB so don't under vote the system */
+	norm_cycles = (100 * norm_cycles) / TARGET;
+	act_level = max_t(int, buslevel, 0);
+	act_level = min_t(int, act_level, priv->bus.num - 1);
+
+	if ((norm_cycles > priv->bus.up[act_level] ||
+			wait_active_percent > WAIT_THRESHOLD) &&
+			gpu_percent > CAP)
+		return BUSMON_FLAG_FAST_HINT;
+
+	if (norm_cycles < priv->bus.down[act_level] && buslevel)
+		return BUSMON_FLAG_SLOW_HINT;
+
+	return 0;
+}
+
+static int devfreq_gpubw_get_target(struct devfreq *df,
+				unsigned long *freq)
+{
+
+	struct devfreq_msm_adreno_tz_data *priv = df->data;
+	struct msm_busmon_extended_profile *bus_profile = container_of(
+					(df->profile),
+					struct msm_busmon_extended_profile,
+					profile);
+	struct devfreq_dev_status *stats = &df->last_status;
+	struct xstats b = {0};
+	int result;
+	int norm_ab;
+	unsigned long ab_mbytes = 0;
+	/*
+	 * Normalized AB should at max usage be the gpu_bimc frequency in MHz.
+	 * Start with a reasonable value and let the system push it up to max.
+	 */
+	static int norm_ab_max = 300;
+
+	if (priv == NULL)
+		return 0;
+
+	stats->private_data = &b;
+
+	result = devfreq_update_stats(df);
+	/* Return if devfreq is not enabled */
+	if (result)
+		return result;
+
+	*freq = stats->current_frequency;
+
+	priv->bus.total_time += stats->total_time;
+	priv->bus.gpu_time += stats->busy_time;
+	priv->bus.ram_time += b.ram_time;
+	priv->bus.ram_wait += b.ram_wait;
+
+	if (priv->bus.total_time < bus_profile->sampling_ms)
+		return result;
+
+	bus_profile->flag = generate_hint(priv, b.buslevel, *freq,
+			b.gpu_minfreq);
+
+	/* Calculate the AB vote based on bus width if defined */
+	if (priv->bus.width) {
+		norm_ab =  (unsigned int)priv->bus.ram_time /
+			(unsigned int) priv->bus.total_time;
+		/* Calculate AB in Mega Bytes and roundup in BW_STEP */
+		ab_mbytes = (norm_ab * priv->bus.width * 1000000ULL) >> 20;
+		bus_profile->ab_mbytes = roundup(ab_mbytes, BW_STEP);
+	} else if (bus_profile->flag) {
+		/* Re-calculate the AB percentage for a new IB vote */
+		norm_ab =  (unsigned int)priv->bus.ram_time /
+			(unsigned int) priv->bus.total_time;
+		if (norm_ab > norm_ab_max)
+			norm_ab_max = norm_ab;
+		bus_profile->percent_ab = (100 * norm_ab) / norm_ab_max;
+	}
+
+	priv->bus.total_time = 0;
+	priv->bus.gpu_time = 0;
+	priv->bus.ram_time = 0;
+	priv->bus.ram_wait = 0;
+
+	return result;
+}
+
+static int gpubw_start(struct devfreq *devfreq)
+{
+	struct devfreq_msm_adreno_tz_data *priv;
+
+	struct msm_busmon_extended_profile *bus_profile = container_of(
+					(devfreq->profile),
+					struct msm_busmon_extended_profile,
+					profile);
+	unsigned int t1, t2 = 2 * HIST;
+	int i, bus_size;
+
+
+	devfreq->data = bus_profile->private_data;
+	priv = devfreq->data;
+
+	bus_size = sizeof(u32) * priv->bus.num;
+	priv->bus.up = kzalloc(bus_size, GFP_KERNEL);
+	priv->bus.down = kzalloc(bus_size, GFP_KERNEL);
+	priv->bus.p_up = kzalloc(bus_size, GFP_KERNEL);
+	priv->bus.p_down = kzalloc(bus_size, GFP_KERNEL);
+	if (priv->bus.up == NULL || priv->bus.down == NULL ||
+		priv->bus.p_up == NULL || priv->bus.p_down == NULL)
+		return -ENOMEM;
+
+	/* Set up the cut-over percentages for the bus calculation. */
+	for (i = 0; i < priv->bus.num; i++) {
+		t1 = (u32)(100 * priv->bus.ib_kbps[i]) /
+				(u32)priv->bus.ib_kbps[priv->bus.num - 1];
+		priv->bus.p_up[i] = t1 - HIST;
+		priv->bus.p_down[i] = t2 - 2 * HIST;
+		t2 = t1;
+	}
+	/* Set the upper-most and lower-most bounds correctly. */
+	priv->bus.p_down[0] = 0;
+
+	for (i = 0; i < priv->bus.num; i++) {
+		if (priv->bus.p_down[i] < 2 * HIST)
+			priv->bus.p_down[i] = 2 * HIST;
+	}
+
+	if (priv->bus.num >= 1)
+		priv->bus.p_up[priv->bus.num - 1] = 100;
+	_update_cutoff(priv, priv->bus.max);
+
+	bus_profile->sampling_ms = LONG_FLOOR;
+
+	for (i = 0; gpubw_attr_list[i] != NULL; i++)
+		device_create_file(&devfreq->dev, gpubw_attr_list[i]);
+
+	return 0;
+}
+
+static int gpubw_stop(struct devfreq *devfreq)
+{
+	struct devfreq_msm_adreno_tz_data *priv = devfreq->data;
+	int i;
+
+	for (i = 0; gpubw_attr_list[i] != NULL; i++)
+		device_remove_file(&devfreq->dev, gpubw_attr_list[i]);
+
+	if (priv) {
+		kfree(priv->bus.up);
+		kfree(priv->bus.down);
+		kfree(priv->bus.p_up);
+		kfree(priv->bus.p_down);
+	}
+	devfreq->data = NULL;
+	return 0;
+}
+
+static int devfreq_gpubw_event_handler(struct devfreq *devfreq,
+				unsigned int event, void *data)
+{
+	int result = 0;
+	unsigned long freq;
+
+	if (strcmp(dev_name(devfreq->dev.parent), "kgsl-busmon"))
+		return -EINVAL;
+
+	mutex_lock(&devfreq->lock);
+	freq = devfreq->previous_freq;
+	switch (event) {
+	case DEVFREQ_GOV_START:
+		result = gpubw_start(devfreq);
+		break;
+	case DEVFREQ_GOV_STOP:
+		result = gpubw_stop(devfreq);
+		break;
+	case DEVFREQ_GOV_RESUME:
+		/* TODO ..... */
+		/* ret = update_devfreq(devfreq); */
+		break;
+	case DEVFREQ_GOV_SUSPEND:
+		{
+			struct devfreq_msm_adreno_tz_data *priv = devfreq->data;
+
+			if (priv) {
+				priv->bus.total_time = 0;
+				priv->bus.gpu_time = 0;
+				priv->bus.ram_time = 0;
+			}
+		}
+		break;
+	default:
+		result = 0;
+		break;
+	}
+	mutex_unlock(&devfreq->lock);
+	return result;
+}
+
+static struct devfreq_governor devfreq_gpubw = {
+	.name = "gpubw_mon",
+	.get_target_freq = devfreq_gpubw_get_target,
+	.event_handler = devfreq_gpubw_event_handler,
+	.flags = DEVFREQ_GOV_FLAG_IMMUTABLE,
+};
+
+int devfreq_gpubw_init(void)
+{
+	return devfreq_add_governor(&devfreq_gpubw);
+}
+
+void devfreq_gpubw_exit(void)
+{
+	int ret;
+
+	ret = devfreq_remove_governor(&devfreq_gpubw);
+	if (ret)
+		pr_err("%s: failed remove governor %d\n", __func__, ret);
+
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/governor_msm_adreno_tz.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/governor_msm_adreno_tz.c
@@ -0,0 +1,673 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2010-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/errno.h>
+#include <linux/devfreq.h>
+#include <linux/dma-mapping.h>
+#include <linux/math64.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/spinlock.h>
+#include <linux/slab.h>
+#include <linux/io.h>
+#include <linux/ftrace.h>
+#include <linux/mm.h>
+#include <linux/version.h>
+#if (KERNEL_VERSION(6, 3, 0) <= LINUX_VERSION_CODE)
+#include <linux/firmware/qcom/qcom_scm.h>
+#else
+#include <linux/qcom_scm.h>
+#endif
+#ifdef CONFIG_QCOM_KGSL_UPSTREAM
+#include <linux/firmware/qcom/qcom_scm_addon.h>
+#endif
+#include <asm/cacheflush.h>
+
+#include "governor.h"
+#include "msm_adreno_devfreq.h"
+
+static DEFINE_SPINLOCK(tz_lock);
+static DEFINE_SPINLOCK(sample_lock);
+static DEFINE_SPINLOCK(suspend_lock);
+/*
+ * FLOOR is 5msec to capture up to 3 re-draws
+ * per frame for 60fps content.
+ */
+#define FLOOR		        5000
+/*
+ * MIN_BUSY is 1 msec for the sample to be sent
+ */
+#define MIN_BUSY		1000
+#define MAX_TZ_VERSION		0
+
+/*
+ * CEILING is 50msec, larger than any standard
+ * frame length, but less than the idle timer.
+ */
+#define CEILING			50000
+#define TZ_RESET_ID		0x3
+#define TZ_UPDATE_ID		0x4
+#define TZ_INIT_ID		0x6
+
+#define TZ_RESET_ID_64          0x7
+#define TZ_UPDATE_ID_64         0x8
+#define TZ_INIT_ID_64           0x9
+
+#define TZ_V2_UPDATE_ID_64         0xA
+#define TZ_V2_INIT_ID_64           0xB
+#define TZ_V2_INIT_CA_ID_64        0xC
+#define TZ_V2_UPDATE_WITH_CA_ID_64 0xD
+
+#define TAG "msm_adreno_tz: "
+
+static u64 suspend_time;
+static u64 suspend_start;
+static unsigned long acc_total, acc_relative_busy;
+
+/*
+ * Returns GPU suspend time in millisecond.
+ */
+static u64 suspend_time_ms(void)
+{
+	u64 suspend_sampling_time;
+	u64 time_diff = 0;
+
+	if (suspend_start == 0)
+		return 0;
+
+	suspend_sampling_time = (u64)ktime_to_ms(ktime_get());
+	time_diff = suspend_sampling_time - suspend_start;
+	/* Update the suspend_start sample again */
+	suspend_start = suspend_sampling_time;
+	return time_diff;
+}
+
+static ssize_t gpu_load_show(struct device *dev,
+		struct device_attribute *attr,
+		char *buf)
+{
+	unsigned long sysfs_busy_perc = 0;
+	/*
+	 * Average out the samples taken since last read
+	 * This will keep the average value in sync with
+	 * with the client sampling duration.
+	 */
+	spin_lock(&sample_lock);
+	if (acc_total)
+		sysfs_busy_perc = (acc_relative_busy * 100) / acc_total;
+
+	/* Reset the parameters */
+	acc_total = 0;
+	acc_relative_busy = 0;
+	spin_unlock(&sample_lock);
+	return snprintf(buf, PAGE_SIZE, "%lu\n", sysfs_busy_perc);
+}
+
+/*
+ * Returns the time in ms for which gpu was in suspend state
+ * since last time the entry is read.
+ */
+static ssize_t suspend_time_show(struct device *dev,
+	struct device_attribute *attr,
+	char *buf)
+{
+	u64 time_diff = 0;
+
+	spin_lock(&suspend_lock);
+	time_diff = suspend_time_ms();
+	/*
+	 * Adding the previous suspend time also as the gpu
+	 * can go and come out of suspend states in between
+	 * reads also and we should have the total suspend
+	 * since last read.
+	 */
+	time_diff += suspend_time;
+	suspend_time = 0;
+	spin_unlock(&suspend_lock);
+
+	return snprintf(buf, PAGE_SIZE, "%llu\n", time_diff);
+}
+
+static ssize_t mod_percent_store(struct device *dev,
+			struct device_attribute *attr,
+			const char *buf, size_t count)
+{
+	int ret;
+	unsigned int val;
+	struct devfreq *devfreq = to_devfreq(dev);
+	struct devfreq_msm_adreno_tz_data *priv = devfreq->data;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	priv->mod_percent = clamp_t(u32, val, 10, 1000);
+
+	return count;
+}
+
+static ssize_t mod_percent_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	struct devfreq *devfreq = to_devfreq(dev);
+	struct devfreq_msm_adreno_tz_data *priv = devfreq->data;
+
+	return scnprintf(buf, PAGE_SIZE, "%u\n", priv->mod_percent);
+}
+
+static DEVICE_ATTR_RO(gpu_load);
+
+static DEVICE_ATTR_RO(suspend_time);
+static DEVICE_ATTR_RW(mod_percent);
+
+static const struct device_attribute *adreno_tz_attr_list[] = {
+		&dev_attr_gpu_load,
+		&dev_attr_suspend_time,
+		&dev_attr_mod_percent,
+		NULL
+};
+
+static void compute_work_load(struct devfreq_dev_status *stats,
+		struct devfreq_msm_adreno_tz_data *priv,
+		struct devfreq *devfreq)
+{
+	u64 busy;
+
+	spin_lock(&sample_lock);
+	/*
+	 * Keep collecting the stats till the client
+	 * reads it. Average of all samples and reset
+	 * is done when the entry is read
+	 */
+	acc_total += stats->total_time;
+	busy = (u64)stats->busy_time * stats->current_frequency;
+	do_div(busy, devfreq->profile->freq_table[0]);
+	acc_relative_busy += busy;
+
+	spin_unlock(&sample_lock);
+}
+
+/* Trap into the TrustZone, and call funcs there. */
+static int __secure_tz_reset_entry2(unsigned int *scm_data, u32 size_scm_data,
+					bool is_64)
+{
+	int ret;
+	/* sync memory before sending the commands to tz */
+	__iowmb();
+
+	if (!is_64) {
+		spin_lock(&tz_lock);
+		ret = qcom_scm_io_reset();
+		spin_unlock(&tz_lock);
+	} else {
+		ret = qcom_scm_dcvs_reset();
+	}
+
+	return ret;
+}
+
+static int __secure_tz_update_entry3(int level, s64 total_time, s64 busy_time,
+		int context_count, struct devfreq_msm_adreno_tz_data *priv)
+{
+	int ret;
+	/* sync memory before sending the commands to tz */
+	__iowmb();
+
+	if (!priv->is_64) {
+		spin_lock(&tz_lock);
+		ret = qcom_scm_dcvs_update(level, total_time, busy_time);
+		spin_unlock(&tz_lock);
+	} else if (!priv->ctxt_aware_enable) {
+		ret = qcom_scm_dcvs_update_v2(level, total_time, busy_time);
+	} else {
+		ret = qcom_scm_dcvs_update_ca_v2(level, total_time, busy_time,
+			context_count);
+	}
+
+	return ret;
+}
+
+#if IS_ENABLED(CONFIG_QCOM_TZMEM)
+#include <linux/firmware/qcom/qcom_tzmem.h>
+
+static int tz_init(struct device *dev, struct devfreq_msm_adreno_tz_data *priv,
+			unsigned int *tz_pwrlevels, u32 size_pwrlevels,
+			unsigned int *version, u32 size_version)
+{
+	int ret;
+	phys_addr_t paddr;
+	struct qcom_tzmem_pool_config pool_config;
+	static struct qcom_tzmem_pool *tzmem_pool;
+
+	if (!qcom_scm_dcvs_core_available())
+		return -EINVAL;
+
+	memset(&pool_config, 0, sizeof(pool_config));
+	pool_config.initial_size = PAGE_ALIGN(size_pwrlevels);
+	pool_config.policy = QCOM_TZMEM_POLICY_STATIC;
+	pool_config.max_size = PAGE_ALIGN(size_pwrlevels);
+
+	tzmem_pool = qcom_tzmem_pool_new(&pool_config);
+	if (IS_ERR(tzmem_pool)) {
+		pr_err(TAG "tz: Failed to create qcom_tzmem_pool %d\n", PTR_ERR(tzmem_pool));
+		return PTR_ERR(tzmem_pool);
+	}
+
+	void *tzmem = qcom_tzmem_alloc(tzmem_pool,
+				PAGE_ALIGN(size_pwrlevels), GFP_KERNEL);
+	if (!tzmem) {
+		ret = -ENOMEM;
+		goto free_tzmem;
+	}
+
+	paddr = qcom_tzmem_to_phys(tzmem);
+
+	memcpy(tzmem, tz_pwrlevels, size_pwrlevels);
+	/* Ensure memcpy completes execution */
+	mb();
+
+	ret = qcom_scm_dcvs_init_v2(paddr, size_pwrlevels, version);
+
+	if (ret)
+		goto free_tzmem;
+
+	priv->is_64 = true;
+
+	 /*
+	  * Initialize context aware feature, if enabled. If context
+	  * aware initialization fails, just print an error message
+	  * and return success as normal DCVS will still work.
+	  */
+	if (!priv->ctxt_aware_enable)
+		goto free_tzmem;
+
+	if (!qcom_scm_dcvs_ca_available()) {
+		pr_warn(TAG "tz: context aware DCVS not supported\n");
+		priv->ctxt_aware_enable = false;
+		goto free_tzmem;
+	}
+
+	((unsigned int*)tzmem)[0] = priv->bin.ctxt_aware_target_pwrlevel;
+	((unsigned int*)tzmem)[1] = priv->bin.ctxt_aware_busy_penalty;
+	/* Ensure writes are completed */
+	mb();
+
+	ret = qcom_scm_dcvs_init_ca_v2(paddr, 2 * sizeof(unsigned int));
+
+	if (ret) {
+		pr_err(TAG "tz: context aware DCVS init failed %d\n", ret);
+		priv->ctxt_aware_enable = false;
+		ret = 0;
+	}
+
+free_tzmem:
+	if (tzmem)
+		qcom_tzmem_free(tzmem);
+	qcom_tzmem_pool_free(tzmem_pool);
+
+	return ret;
+}
+
+#else
+static int tz_init_ca(struct device *dev,
+	struct devfreq_msm_adreno_tz_data *priv)
+{
+	unsigned int tz_ca_data[2];
+	phys_addr_t paddr;
+	u8 *tz_buf;
+	int ret;
+	struct qtee_shm shm;
+
+	/* Set data for TZ */
+	tz_ca_data[0] = priv->bin.ctxt_aware_target_pwrlevel;
+	tz_ca_data[1] = priv->bin.ctxt_aware_busy_penalty;
+
+	if (!qtee_shmbridge_is_enabled()) {
+		tz_buf = kzalloc(PAGE_ALIGN(sizeof(tz_ca_data)), GFP_KERNEL);
+		if (!tz_buf)
+			return -ENOMEM;
+		paddr = virt_to_phys(tz_buf);
+	} else {
+		ret = qtee_shmbridge_allocate_shm(
+				PAGE_ALIGN(sizeof(tz_ca_data)), &shm);
+		if (ret)
+			return -ENOMEM;
+		tz_buf = shm.vaddr;
+		paddr = shm.paddr;
+	}
+
+	memcpy(tz_buf, tz_ca_data, sizeof(tz_ca_data));
+	/* Ensure memcpy completes execution */
+	mb();
+	dma_sync_single_for_device(dev, paddr,
+		PAGE_ALIGN(sizeof(tz_ca_data)), DMA_BIDIRECTIONAL);
+
+	ret = qcom_scm_dcvs_init_ca_v2(paddr, sizeof(tz_ca_data));
+
+	if (!qtee_shmbridge_is_enabled())
+		kfree_sensitive(tz_buf);
+	else
+		qtee_shmbridge_free_shm(&shm);
+
+	return ret;
+}
+
+static int tz_init(struct device *dev, struct devfreq_msm_adreno_tz_data *priv,
+			unsigned int *tz_pwrlevels, u32 size_pwrlevels,
+			unsigned int *version, u32 size_version)
+{
+	int ret;
+	phys_addr_t paddr;
+
+	if (qcom_scm_dcvs_core_available()) {
+		u8 *tz_buf;
+		struct qtee_shm shm;
+
+		if (!qtee_shmbridge_is_enabled()) {
+			tz_buf = kzalloc(PAGE_ALIGN(size_pwrlevels),
+						GFP_KERNEL);
+			if (!tz_buf)
+				return -ENOMEM;
+			paddr = virt_to_phys(tz_buf);
+		} else {
+			ret = qtee_shmbridge_allocate_shm(
+					PAGE_ALIGN(size_pwrlevels), &shm);
+			if (ret)
+				return -ENOMEM;
+			tz_buf = shm.vaddr;
+			paddr = shm.paddr;
+		}
+
+		memcpy(tz_buf, tz_pwrlevels, size_pwrlevels);
+		/* Ensure memcpy completes execution */
+		mb();
+		dma_sync_single_for_device(dev, paddr,
+			PAGE_ALIGN(size_pwrlevels), DMA_BIDIRECTIONAL);
+
+		ret = qcom_scm_dcvs_init_v2(paddr, size_pwrlevels, version);
+		if (!ret)
+			priv->is_64 = true;
+		if (!qtee_shmbridge_is_enabled())
+			kfree_sensitive(tz_buf);
+		else
+			qtee_shmbridge_free_shm(&shm);
+	} else
+		ret = -EINVAL;
+
+	 /* Initialize context aware feature, if enabled. */
+	if (!ret && priv->ctxt_aware_enable) {
+		if (priv->is_64 && qcom_scm_dcvs_ca_available()) {
+			ret = tz_init_ca(dev, priv);
+			/*
+			 * If context aware feature initialization fails,
+			 * just print an error message and return
+			 * success as normal DCVS will still work.
+			 */
+			if (ret) {
+				pr_err(TAG "tz: context aware DCVS init failed\n");
+				priv->ctxt_aware_enable = false;
+				return 0;
+			}
+		} else {
+			pr_warn(TAG "tz: context aware DCVS not supported\n");
+			priv->ctxt_aware_enable = false;
+		}
+	}
+
+	return ret;
+}
+#endif
+
+static inline int devfreq_get_freq_level(struct devfreq *devfreq,
+	unsigned long freq)
+{
+	int lev;
+
+	for (lev = 0; lev < devfreq->profile->max_state; lev++)
+		if (freq == devfreq->profile->freq_table[lev])
+			return lev;
+
+	return -EINVAL;
+}
+
+static int tz_get_target_freq(struct devfreq *devfreq, unsigned long *freq)
+{
+	int result = 0;
+	struct devfreq_msm_adreno_tz_data *priv = devfreq->data;
+	struct devfreq_dev_status *stats = &devfreq->last_status;
+	int val, level = 0;
+	int context_count = 0;
+	u64 busy_time;
+
+	if (!priv)
+		return 0;
+
+	/* keeps stats.private_data == NULL   */
+	result = devfreq_update_stats(devfreq);
+	if (result) {
+		pr_err(TAG "get_status failed %d\n", result);
+		return result;
+	}
+
+	*freq = stats->current_frequency;
+	priv->bin.total_time += stats->total_time;
+
+	/* Update gpu busy time as per mod_percent */
+	busy_time = stats->busy_time * priv->mod_percent;
+	do_div(busy_time, 100);
+
+	/* busy_time should not go over total_time */
+	stats->busy_time = min_t(u64, busy_time, stats->total_time);
+
+	priv->bin.busy_time += stats->busy_time;
+
+	if (stats->private_data)
+		context_count =  *((int *)stats->private_data);
+
+	/* Update the GPU load statistics */
+	compute_work_load(stats, priv, devfreq);
+	/*
+	 * Do not waste CPU cycles running this algorithm if
+	 * the GPU just started, or if less than FLOOR time
+	 * has passed since the last run or the gpu hasn't been
+	 * busier than MIN_BUSY.
+	 */
+	if ((stats->total_time == 0) ||
+		(priv->bin.total_time < FLOOR) ||
+		(unsigned int) priv->bin.busy_time < MIN_BUSY) {
+		return 0;
+	}
+
+	level = devfreq_get_freq_level(devfreq, stats->current_frequency);
+	if (level < 0) {
+		pr_err(TAG "bad freq %ld\n", stats->current_frequency);
+		return level;
+	}
+
+	/*
+	 * If there is an extended block of busy processing,
+	 * increase frequency.  Otherwise run the normal algorithm.
+	 */
+	if (!priv->disable_busy_time_burst &&
+			priv->bin.busy_time > CEILING) {
+		val = -1 * level;
+	} else {
+		val = __secure_tz_update_entry3(level, priv->bin.total_time,
+			priv->bin.busy_time, context_count, priv);
+	}
+
+	priv->bin.total_time = 0;
+	priv->bin.busy_time = 0;
+
+	/*
+	 * If the decision is to move to a different level, make sure the GPU
+	 * frequency changes.
+	 */
+	if (val) {
+		level += val;
+		level = max(level, 0);
+		level = min_t(int, level, devfreq->profile->max_state - 1);
+	}
+
+	*freq = devfreq->profile->freq_table[level];
+	return 0;
+}
+
+static int __tz_init(struct devfreq *devfreq)
+{
+	struct devfreq_msm_adreno_tz_data *priv;
+	unsigned int tz_pwrlevels[MSM_ADRENO_MAX_PWRLEVELS + 1];
+	int i, out, ret;
+	unsigned int version;
+
+	struct msm_adreno_extended_profile *gpu_profile = container_of(
+					(devfreq->profile),
+					struct msm_adreno_extended_profile,
+					profile);
+
+	/*
+	 * Assuming that we have only one instance of the adreno device
+	 * connected to this governor,
+	 * can safely restore the pointer to the governor private data
+	 * from the container of the device profile
+	 */
+	devfreq->data = gpu_profile->private_data;
+
+	priv = devfreq->data;
+
+	out = 1;
+	if (devfreq->profile->max_state < ARRAY_SIZE(tz_pwrlevels)) {
+		for (i = 0; i < devfreq->profile->max_state; i++)
+			tz_pwrlevels[out++] = devfreq->profile->freq_table[i];
+		tz_pwrlevels[0] = i;
+	} else {
+		pr_err(TAG "tz_pwrlevels[] is too short\n");
+		return -EINVAL;
+	}
+
+	ret = tz_init(&devfreq->dev, priv, tz_pwrlevels, sizeof(tz_pwrlevels),
+			&version, sizeof(version));
+	if (ret != 0 || version > MAX_TZ_VERSION) {
+		pr_err(TAG "tz_init failed\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+static int tz_start(struct devfreq *devfreq)
+{
+	int i, ret;
+
+	ret = __tz_init(devfreq);
+	if (ret)
+		return ret;
+
+	for (i = 0; adreno_tz_attr_list[i] != NULL; i++)
+		device_create_file(&devfreq->dev, adreno_tz_attr_list[i]);
+
+	return 0;
+}
+
+static int tz_stop(struct devfreq *devfreq)
+{
+	int i;
+
+	for (i = 0; adreno_tz_attr_list[i] != NULL; i++)
+		device_remove_file(&devfreq->dev, adreno_tz_attr_list[i]);
+
+	/* leaving the governor and cleaning the pointer to private data */
+	devfreq->data = NULL;
+	return 0;
+}
+
+static int tz_suspend(struct devfreq *devfreq)
+{
+	struct devfreq_msm_adreno_tz_data *priv = devfreq->data;
+	unsigned int scm_data[2] = {0, 0};
+
+	if (!priv)
+		return 0;
+
+	__secure_tz_reset_entry2(scm_data, sizeof(scm_data), priv->is_64);
+
+	priv->bin.total_time = 0;
+	priv->bin.busy_time = 0;
+	return 0;
+}
+
+static int tz_handler(struct devfreq *devfreq, unsigned int event, void *data)
+{
+	int result;
+	struct device_node *node = devfreq->dev.parent->of_node;
+
+	if (!(of_device_is_compatible(node, "qcom,kgsl-3d0") ||
+		of_device_is_compatible(node, "qcom,kgsl")))
+		return -EINVAL;
+
+	switch (event) {
+	case DEVFREQ_GOV_START:
+		result = tz_start(devfreq);
+		break;
+
+	case DEVFREQ_GOV_STOP:
+		spin_lock(&suspend_lock);
+		suspend_start = 0;
+		spin_unlock(&suspend_lock);
+		result = tz_stop(devfreq);
+		break;
+
+	case DEVFREQ_GOV_SUSPEND:
+		result = tz_suspend(devfreq);
+		if (!result) {
+			spin_lock(&suspend_lock);
+			/* Collect the start sample for suspend time */
+			suspend_start = (u64)ktime_to_ms(ktime_get());
+			spin_unlock(&suspend_lock);
+		}
+		break;
+
+	case DEVFREQ_GOV_RESUME:
+		spin_lock(&suspend_lock);
+		suspend_time += suspend_time_ms();
+		/* Reset the suspend_start when gpu resumes */
+		suspend_start = 0;
+		spin_unlock(&suspend_lock);
+		fallthrough;
+	case DEVFREQ_GOV_UPDATE_INTERVAL:
+		/* This governor doesn't use polling */
+		fallthrough;
+	default:
+		result = 0;
+		break;
+	}
+
+	return result;
+}
+
+static struct devfreq_governor msm_adreno_tz = {
+	.name = "msm-adreno-tz",
+	.get_target_freq = tz_get_target_freq,
+	.event_handler = tz_handler,
+	.flags = DEVFREQ_GOV_FLAG_IMMUTABLE,
+};
+
+int msm_adreno_tz_reinit(struct devfreq *devfreq)
+{
+	return __tz_init(devfreq);
+}
+
+int msm_adreno_tz_init(void)
+{
+	return devfreq_add_governor(&msm_adreno_tz);
+}
+
+void msm_adreno_tz_exit(void)
+{
+	int ret = devfreq_remove_governor(&msm_adreno_tz);
+
+	if (ret)
+		pr_err(TAG "failed to remove governor %d\n", ret);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/include/linux/msm_kgsl.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/include/linux/msm_kgsl.h
@@ -0,0 +1,85 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _MSM_KGSL_H
+#define _MSM_KGSL_H
+
+/**
+ * struct kgsl_gpu_freq_stat - Per GPU freq stat struct
+ * @freq: GPU frequency in Hz
+ * @active_time: GPU busy time in usecs
+ * @idle_time: GPU idle time in usec
+ */
+struct kgsl_gpu_freq_stat {
+	u32 freq;
+	u64 active_time;
+	u64 idle_time;
+};
+
+/**
+ * kgsl_gpu_num_freqs - Get number of available GPU frequencies
+ *
+ * Return: number of available frequencies on success or negative error
+ * on failure
+ */
+int kgsl_gpu_num_freqs(void);
+
+/**
+ * kgsl_gpu_stat - Get per GPU freq stats
+ * @stats: Array of struct kgsl_gpu_freq_stat to hold stats
+ * @numfreq: Number of entries in @stats
+ *
+ * This function will populate @stats with per freq stats.
+ * Number of entries in @stats array  must be greater or
+ * equal to value returned by function kgsl_gpu_num_freqs
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int kgsl_gpu_stat(struct kgsl_gpu_freq_stat *stats, u32 numfreq);
+
+/**
+ * kgsl_gpu_frame_count - Get number of frames already processed by GPU
+ * @pid: pid of the process for which frame count is required
+ * @frame_count: pointer to a u64 to store frame count
+ *
+ * Return: zero on success and number of frames processed corresponding
+ * to @pid in @frame_count or negative error on failure
+ */
+int kgsl_gpu_frame_count(pid_t pid, u64 *frame_count);
+
+/**
+ * enum kgsl_srcu_events - kgsl srcu notify events for listeners
+ * @GPU_GMU_READY - GMU initialized to handle other requests
+ * @GPU_GMU_STOP - GMU is not ready to handle other requests
+ * @GPU_SSR_BEGIN - GPU/GMU fault detected to start recovery
+ * @GPU_SSR_END - GPU/GMU fault recovery end
+ * @GPU_SSR_FATAL - LSR context invalidated
+ */
+enum kgsl_srcu_events {
+	GPU_GMU_READY,
+	GPU_GMU_STOP,
+	GPU_SSR_BEGIN,
+	GPU_SSR_END,
+	GPU_SSR_FATAL,
+};
+
+/**
+ * kgsl_add_rcu_notifier - Adds a notifier to an SRCU notifier chain.
+ * @nb: Notifier block new entry to add in notifier chain
+ *
+ * Returns zero on success or error on failure.
+ */
+int kgsl_add_rcu_notifier(struct notifier_block *nb);
+
+/**
+ * kgsl_del_rcu_notifier - Remove notifier from an SRCU notifier chain.
+ * @nb: Entry to remove from notifier chain
+ *
+ * Returns zero on success or -ENOENT on failure.
+ */
+int kgsl_del_rcu_notifier(struct notifier_block *nb);
+
+#endif /* _MSM_KGSL_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/include/uapi/linux/msm_kgsl.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/include/uapi/linux/msm_kgsl.h
@@ -0,0 +1,2159 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _UAPI_MSM_KGSL_H
+#define _UAPI_MSM_KGSL_H
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+/*
+ * The KGSL version has proven not to be very useful in userspace if features
+ * are cherry picked into other trees out of order so it is frozen as of 3.14.
+ * It is left here for backward compatibility and as a reminder that
+ * software releases are never linear. Also, I like pie.
+ */
+
+#define KGSL_VERSION_MAJOR        3
+#define KGSL_VERSION_MINOR        14
+
+/*
+ * We have traditionally mixed context and issueibcmds / command batch flags
+ * together into a big flag stew. This worked fine until we started adding a
+ * lot more command batch flags and we started running out of bits. Turns out
+ * we have a bit of room in the context type / priority mask that we could use
+ * for command batches, but that means we need to split out the flags into two
+ * coherent sets.
+ *
+ * If any future definitions are for both context and cmdbatch add both defines
+ * and link the cmdbatch to the context define as we do below. Otherwise feel
+ * free to add exclusive bits to either set.
+ */
+
+/* --- context flags --- */
+#define KGSL_CONTEXT_SAVE_GMEM		0x00000001
+#define KGSL_CONTEXT_NO_GMEM_ALLOC	0x00000002
+/* This is a cmdbatch exclusive flag - use the CMDBATCH equivalent instead */
+#define KGSL_CONTEXT_SUBMIT_IB_LIST	0x00000004
+#define KGSL_CONTEXT_CTX_SWITCH		0x00000008
+#define KGSL_CONTEXT_PREAMBLE		0x00000010
+#define KGSL_CONTEXT_TRASH_STATE	0x00000020
+#define KGSL_CONTEXT_PER_CONTEXT_TS	0x00000040
+#define KGSL_CONTEXT_USER_GENERATED_TS	0x00000080
+/* This is a cmdbatch exclusive flag - use the CMDBATCH equivalent instead */
+#define KGSL_CONTEXT_END_OF_FRAME	0x00000100
+#define KGSL_CONTEXT_NO_FAULT_TOLERANCE 0x00000200
+/* This is a cmdbatch exclusive flag - use the CMDBATCH equivalent instead */
+#define KGSL_CONTEXT_SYNC               0x00000400
+#define KGSL_CONTEXT_PWR_CONSTRAINT     0x00000800
+#define KGSL_CONTEXT_PRIORITY_MASK      0x0000F000
+#define KGSL_CONTEXT_PRIORITY_SHIFT     12
+#define KGSL_CONTEXT_PRIORITY_UNDEF     0
+
+#define KGSL_CONTEXT_IFH_NOP            0x00010000
+#define KGSL_CONTEXT_SECURE             0x00020000
+#define KGSL_CONTEXT_NO_SNAPSHOT        0x00040000
+#define KGSL_CONTEXT_SPARSE             0x00080000
+
+#define KGSL_CONTEXT_PREEMPT_STYLE_MASK       0x0E000000
+#define KGSL_CONTEXT_PREEMPT_STYLE_SHIFT      25
+#define KGSL_CONTEXT_PREEMPT_STYLE_DEFAULT    0x0
+#define KGSL_CONTEXT_PREEMPT_STYLE_RINGBUFFER 0x1
+#define KGSL_CONTEXT_PREEMPT_STYLE_FINEGRAIN  0x2
+
+#define KGSL_CONTEXT_TYPE_MASK          0x01F00000
+#define KGSL_CONTEXT_TYPE_SHIFT         20
+#define KGSL_CONTEXT_TYPE_ANY		0
+#define KGSL_CONTEXT_TYPE_GL		1
+#define KGSL_CONTEXT_TYPE_CL		2
+#define KGSL_CONTEXT_TYPE_C2D		3
+#define KGSL_CONTEXT_TYPE_RS		4
+#define KGSL_CONTEXT_TYPE_VK		5
+#define KGSL_CONTEXT_TYPE_UNKNOWN	0x1E
+
+#define KGSL_CONTEXT_INVALIDATE_ON_FAULT 0x10000000
+#define KGSL_CONTEXT_LPAC 0x20000000
+#define KGSL_CONTEXT_FAULT_INFO	  0x40000000
+
+#define KGSL_CONTEXT_INVALID 0xffffffff
+
+/*
+ * --- command batch flags ---
+ * The bits that are linked to a KGSL_CONTEXT equivalent are either legacy
+ * definitions or bits that are valid for both contexts and cmdbatches.  To be
+ * safe the other 8 bits that are still available in the context field should be
+ * omitted here in case we need to share - the other bits are available for
+ * cmdbatch only flags as needed
+ */
+#define KGSL_CMDBATCH_MEMLIST		0x00000001
+#define KGSL_CMDBATCH_MARKER		0x00000002
+#define KGSL_CMDBATCH_SUBMIT_IB_LIST	KGSL_CONTEXT_SUBMIT_IB_LIST /* 0x004 */
+#define KGSL_CMDBATCH_CTX_SWITCH	KGSL_CONTEXT_CTX_SWITCH     /* 0x008 */
+#define KGSL_CMDBATCH_PROFILING		0x00000010
+/*
+ * KGSL_CMDBATCH_PROFILING must also be set for KGSL_CMDBATCH_PROFILING_KTIME
+ * to take effect, as the latter only affects the time data returned.
+ */
+#define KGSL_CMDBATCH_PROFILING_KTIME	0x00000020
+#define KGSL_CMDBATCH_END_OF_FRAME	KGSL_CONTEXT_END_OF_FRAME   /* 0x100 */
+#define KGSL_CMDBATCH_SYNC		KGSL_CONTEXT_SYNC           /* 0x400 */
+#define KGSL_CMDBATCH_PWR_CONSTRAINT	KGSL_CONTEXT_PWR_CONSTRAINT /* 0x800 */
+#define KGSL_CMDBATCH_SPARSE	    0x1000 /* 0x1000 */
+/* RECURRING bits must be set for LSR workload with IOCTL_KGSL_RECURRING_COMMAND. */
+#define KGSL_CMDBATCH_START_RECURRING	0x00100000
+#define KGSL_CMDBATCH_STOP_RECURRING	0x00200000
+
+/*
+ * Reserve bits [16:19] and bits [28:31] for possible bits shared between
+ * contexts and command batches.  Update this comment as new flags are added.
+ */
+
+/*
+ * gpu_command_object flags - these flags communicate the type of command or
+ * memory object being submitted for a GPU command
+ */
+
+/* Flags for GPU command objects */
+#define KGSL_CMDLIST_IB                  0x00000001U
+#define KGSL_CMDLIST_CTXTSWITCH_PREAMBLE 0x00000002U
+#define KGSL_CMDLIST_IB_PREAMBLE         0x00000004U
+
+/* Flags for GPU command memory objects */
+#define KGSL_OBJLIST_MEMOBJ  0x00000008U
+#define KGSL_OBJLIST_PROFILE 0x00000010U
+
+/* Flags for GPU command sync points */
+#define KGSL_CMD_SYNCPOINT_TYPE_TIMESTAMP 0
+#define KGSL_CMD_SYNCPOINT_TYPE_FENCE 1
+#define KGSL_CMD_SYNCPOINT_TYPE_TIMELINE 2
+
+/* --- Memory allocation flags --- */
+
+/* General allocation hints */
+#define KGSL_MEMFLAGS_SECURE       (1ULL << 3)
+#define KGSL_MEMFLAGS_GPUREADONLY  (1ULL << 24)
+#define KGSL_MEMFLAGS_GPUWRITEONLY (1ULL << 25)
+#define KGSL_MEMFLAGS_FORCE_32BIT  (1ULL << 32)
+
+/* Flag for binding all the virt range to single phys data */
+#define KGSL_SPARSE_BIND_MULTIPLE_TO_PHYS 0x400000000ULL
+#define KGSL_SPARSE_BIND 0x1ULL
+#define KGSL_SPARSE_UNBIND 0x2ULL
+
+/* Memory caching hints */
+#define KGSL_CACHEMODE_MASK       0x0C000000U
+#define KGSL_CACHEMODE_SHIFT 26
+
+#define KGSL_CACHEMODE_WRITECOMBINE 0
+#define KGSL_CACHEMODE_UNCACHED 1
+#define KGSL_CACHEMODE_WRITETHROUGH 2
+#define KGSL_CACHEMODE_WRITEBACK 3
+
+#define KGSL_MEMFLAGS_USE_CPU_MAP     (1ULL << 28)
+#define KGSL_MEMFLAGS_SPARSE_PHYS     (1ULL << 29)
+#define KGSL_MEMFLAGS_SPARSE_VIRT     (1ULL << 30)
+#define KGSL_MEMFLAGS_IOCOHERENT      (1ULL << 31)
+#define KGSL_MEMFLAGS_GUARD_PAGE      (1ULL << 33)
+#define KGSL_MEMFLAGS_VBO             (1ULL << 34)
+#define KGSL_MEMFLAGS_VBO_NO_MAP_ZERO (1ULL << 35)
+
+/* Memory types for which allocations are made */
+#define KGSL_MEMTYPE_MASK		0x0000FF00
+#define KGSL_MEMTYPE_SHIFT		8
+
+#define KGSL_MEMTYPE_OBJECTANY			0
+#define KGSL_MEMTYPE_FRAMEBUFFER		1
+#define KGSL_MEMTYPE_RENDERBUFFER		2
+#define KGSL_MEMTYPE_ARRAYBUFFER		3
+#define KGSL_MEMTYPE_ELEMENTARRAYBUFFER		4
+#define KGSL_MEMTYPE_VERTEXARRAYBUFFER		5
+#define KGSL_MEMTYPE_TEXTURE			6
+#define KGSL_MEMTYPE_SURFACE			7
+#define KGSL_MEMTYPE_EGL_SURFACE		8
+#define KGSL_MEMTYPE_GL				9
+#define KGSL_MEMTYPE_CL				10
+#define KGSL_MEMTYPE_CL_BUFFER_MAP		11
+#define KGSL_MEMTYPE_CL_BUFFER_NOMAP		12
+#define KGSL_MEMTYPE_CL_IMAGE_MAP		13
+#define KGSL_MEMTYPE_CL_IMAGE_NOMAP		14
+#define KGSL_MEMTYPE_CL_KERNEL_STACK		15
+#define KGSL_MEMTYPE_COMMAND			16
+#define KGSL_MEMTYPE_2D				17
+#define KGSL_MEMTYPE_EGL_IMAGE			18
+#define KGSL_MEMTYPE_EGL_SHADOW			19
+#define KGSL_MEMTYPE_MULTISAMPLE		20
+#define KGSL_MEMTYPE_KERNEL			255
+
+/*
+ * Alignment hint, passed as the power of 2 exponent.
+ * i.e 4k (2^12) would be 12, 64k (2^16)would be 16.
+ */
+#define KGSL_MEMALIGN_MASK		0x00FF0000
+#define KGSL_MEMALIGN_SHIFT		16
+
+enum kgsl_user_mem_type {
+	KGSL_USER_MEM_TYPE_PMEM		= 0x00000000,
+	KGSL_USER_MEM_TYPE_ASHMEM	= 0x00000001,
+	KGSL_USER_MEM_TYPE_ADDR		= 0x00000002,
+	KGSL_USER_MEM_TYPE_ION		= 0x00000003,
+	/*
+	 * ION type is retained for backward compatibility but ION buffers are
+	 * dma-bufs so try to use that naming if we can
+	 */
+	KGSL_USER_MEM_TYPE_DMABUF       = 0x00000003,
+	KGSL_USER_MEM_TYPE_MAX		= 0x00000007,
+};
+#define KGSL_MEMFLAGS_USERMEM_MASK 0x000000e0
+#define KGSL_MEMFLAGS_USERMEM_SHIFT 5
+
+/*
+ * Unfortunately, enum kgsl_user_mem_type starts at 0 which does not
+ * leave a good value for allocated memory. In the flags we use
+ * 0 to indicate allocated memory and thus need to add 1 to the enum
+ * values.
+ */
+#define KGSL_USERMEM_FLAG(x) (((x) + 1) << KGSL_MEMFLAGS_USERMEM_SHIFT)
+
+#define KGSL_MEMFLAGS_NOT_USERMEM 0
+#define KGSL_MEMFLAGS_USERMEM_PMEM KGSL_USERMEM_FLAG(KGSL_USER_MEM_TYPE_PMEM)
+#define KGSL_MEMFLAGS_USERMEM_ASHMEM \
+		KGSL_USERMEM_FLAG(KGSL_USER_MEM_TYPE_ASHMEM)
+#define KGSL_MEMFLAGS_USERMEM_ADDR KGSL_USERMEM_FLAG(KGSL_USER_MEM_TYPE_ADDR)
+#define KGSL_MEMFLAGS_USERMEM_ION KGSL_USERMEM_FLAG(KGSL_USER_MEM_TYPE_ION)
+
+/* --- generic KGSL flag values --- */
+
+#define KGSL_FLAGS_NORMALMODE  0x00000000
+#define KGSL_FLAGS_SAFEMODE    0x00000001
+#define KGSL_FLAGS_INITIALIZED0 0x00000002
+#define KGSL_FLAGS_INITIALIZED 0x00000004
+#define KGSL_FLAGS_STARTED     0x00000008
+#define KGSL_FLAGS_ACTIVE      0x00000010
+#define KGSL_FLAGS_RESERVED0   0x00000020
+#define KGSL_FLAGS_RESERVED1   0x00000040
+#define KGSL_FLAGS_RESERVED2   0x00000080
+#define KGSL_FLAGS_SOFT_RESET  0x00000100
+#define KGSL_FLAGS_PER_CONTEXT_TIMESTAMPS 0x00000200
+
+/* Server Side Sync Timeout in milliseconds */
+#define KGSL_SYNCOBJ_SERVER_TIMEOUT 2000
+
+/* UBWC Modes */
+#define KGSL_UBWC_NONE	0
+#define KGSL_UBWC_1_0	1
+#define KGSL_UBWC_2_0	2
+#define KGSL_UBWC_3_0	3
+#define KGSL_UBWC_4_0	4
+
+/*
+ * Reset status values for context
+ */
+enum kgsl_ctx_reset_stat {
+	KGSL_CTX_STAT_NO_ERROR				= 0x00000000,
+	KGSL_CTX_STAT_GUILTY_CONTEXT_RESET_EXT		= 0x00000001,
+	KGSL_CTX_STAT_INNOCENT_CONTEXT_RESET_EXT	= 0x00000002,
+	KGSL_CTX_STAT_UNKNOWN_CONTEXT_RESET_EXT		= 0x00000003
+};
+
+#define KGSL_CONVERT_TO_MBPS(val) \
+	(val*1000*1000U)
+
+struct kgsl_devinfo {
+
+	unsigned int device_id;
+	/*
+	 * chip revision id
+	 * coreid:8 majorrev:8 minorrev:8 patch:8
+	 */
+	unsigned int chip_id;
+	unsigned int mmu_enabled;
+	unsigned long gmem_gpubaseaddr;
+	/*
+	 * This field contains the adreno revision
+	 * number 200, 205, 220, etc...
+	 */
+	unsigned int gpu_id;
+	__kernel_size_t gmem_sizebytes;
+};
+
+/*
+ * struct kgsl_devmemstore - this structure defines the region of memory
+ * that can be mmap()ed from this driver. The timestamp fields are volatile
+ * because they are written by the GPU
+ * @soptimestamp: Start of pipeline timestamp written by GPU before the
+ * commands in concern are processed
+ * @sbz: Unused, kept for 8 byte alignment
+ * @eoptimestamp: End of pipeline timestamp written by GPU after the
+ * commands in concern are processed
+ * @sbz2: Unused, kept for 8 byte alignment
+ * @preempted: Indicates if the context was preempted
+ * @sbz3: Unused, kept for 8 byte alignment
+ * @ref_wait_ts: Timestamp on which to generate interrupt, unused now.
+ * @sbz4: Unused, kept for 8 byte alignment
+ * @current_context: The current context the GPU is working on
+ * @sbz5: Unused, kept for 8 byte alignment
+ */
+struct kgsl_devmemstore {
+	volatile unsigned int soptimestamp;
+	unsigned int sbz;
+	volatile unsigned int eoptimestamp;
+	unsigned int sbz2;
+	volatile unsigned int preempted;
+	unsigned int sbz3;
+	volatile unsigned int ref_wait_ts;
+	unsigned int sbz4;
+	unsigned int current_context;
+	unsigned int sbz5;
+};
+
+#define KGSL_MEMSTORE_OFFSET(ctxt_id, field) \
+	((ctxt_id)*sizeof(struct kgsl_devmemstore) + \
+	 offsetof(struct kgsl_devmemstore, field))
+
+/* timestamp id*/
+enum kgsl_timestamp_type {
+	KGSL_TIMESTAMP_CONSUMED = 0x00000001, /* start-of-pipeline timestamp */
+	KGSL_TIMESTAMP_RETIRED  = 0x00000002, /* end-of-pipeline timestamp*/
+	KGSL_TIMESTAMP_QUEUED   = 0x00000003,
+};
+
+/* property types - used with kgsl_device_getproperty */
+#define KGSL_PROP_DEVICE_INFO		0x1
+#define KGSL_PROP_DEVICE_SHADOW		0x2
+#define KGSL_PROP_DEVICE_POWER		0x3
+#define KGSL_PROP_SHMEM			0x4
+#define KGSL_PROP_SHMEM_APERTURES	0x5
+#define KGSL_PROP_MMU_ENABLE		0x6
+#define KGSL_PROP_INTERRUPT_WAITS	0x7
+#define KGSL_PROP_VERSION		0x8
+#define KGSL_PROP_GPU_RESET_STAT	0x9
+#define KGSL_PROP_PWRCTRL		0xE
+#define KGSL_PROP_PWR_CONSTRAINT	0x12
+#define KGSL_PROP_UCHE_GMEM_VADDR	0x13
+#define KGSL_PROP_SP_GENERIC_MEM	0x14
+#define KGSL_PROP_UCODE_VERSION		0x15
+#define KGSL_PROP_GPMU_VERSION		0x16
+#define KGSL_PROP_HIGHEST_BANK_BIT	0x17
+#define KGSL_PROP_DEVICE_BITNESS	0x18
+#define KGSL_PROP_DEVICE_QDSS_STM	0x19
+#define KGSL_PROP_MIN_ACCESS_LENGTH	0x1A
+#define KGSL_PROP_UBWC_MODE		0x1B
+#define KGSL_PROP_DEVICE_QTIMER		0x20
+#define KGSL_PROP_L3_PWR_CONSTRAINT     0x22
+#define KGSL_PROP_SECURE_BUFFER_ALIGNMENT 0x23
+#define KGSL_PROP_SECURE_CTXT_SUPPORT 0x24
+#define KGSL_PROP_SPEED_BIN		0x25
+#define KGSL_PROP_GAMING_BIN		0x26
+#define KGSL_PROP_QUERY_CAPABILITIES	0x27
+#define KGSL_PROP_CONTEXT_PROPERTY	0x28
+#define KGSL_PROP_GPU_MODEL		0x29
+#define KGSL_PROP_VK_DEVICE_ID		0x2A
+#define KGSL_PROP_IS_LPAC_ENABLED	0x2B
+#define KGSL_PROP_GPU_VA64_SIZE		0x2C
+#define KGSL_PROP_IS_RAYTRACING_ENABLED	0x2D
+#define KGSL_PROP_IS_FASTBLEND_ENABLED		0x2E
+#define KGSL_PROP_UCHE_TRAP_BASE	0x2F
+#define KGSL_PROP_IS_AQE_ENABLED	0x30
+#define KGSL_PROP_GPU_SECURE_VA_SIZE	0x31
+#define KGSL_PROP_GPU_SECURE_VA_INUSE	0x32
+
+/*
+ * kgsl_capabilities_properties returns a list of supported properties.
+ * If the user passes 0 for 'count' the kernel will set it to the number of
+ * supported properties. The list is expected to be 'count * sizeof(__u32)'
+ * bytes long. The kernel will return the actual number of entries copied into
+ * list via 'count'.
+ */
+struct kgsl_capabilities_properties {
+	__u64 list;
+	__u32 count;
+};
+
+/*
+ * KGSL_QUERY_CAPS_PROPERTIES returns a list of the valid properties in the
+ * kernel.  The subtype data should be struct kgsl_capabilities_properties
+ */
+#define KGSL_QUERY_CAPS_PROPERTIES 1
+
+/*
+ * kgsl_capabilities allows the user to query kernel capabilities. The 'data'
+ * type should be set appropriately for the querytype (see above). Pass 0 to
+ * 'size' and the kernel will set it to the expected size of 'data' that is
+ * appropriate for querytype (in bytes).
+ */
+struct kgsl_capabilities {
+	__u64 data;
+	__u64 size;
+	__u32 querytype;
+};
+
+struct kgsl_shadowprop {
+	unsigned long gpuaddr;
+	__kernel_size_t size;
+	unsigned int flags; /* contains KGSL_FLAGS_ values */
+};
+
+struct kgsl_qdss_stm_prop {
+	__u64 gpuaddr;
+	__u64 size;
+};
+
+struct kgsl_qtimer_prop {
+	__u64 gpuaddr;
+	__u64 size;
+};
+
+struct kgsl_version {
+	unsigned int drv_major;
+	unsigned int drv_minor;
+	unsigned int dev_major;
+	unsigned int dev_minor;
+};
+
+struct kgsl_sp_generic_mem {
+	__u64 local;
+	__u64 pvt;
+};
+
+struct kgsl_ucode_version {
+	unsigned int pfp;
+	unsigned int pm4;
+};
+
+struct kgsl_gpmu_version {
+	unsigned int major;
+	unsigned int minor;
+	unsigned int features;
+};
+
+struct kgsl_context_property {
+	__u64 data;
+	__u32 size;
+	__u32 type;
+	__u32 contextid;
+};
+
+struct kgsl_context_property_fault {
+	__s32 faults;
+	__u32 timestamp;
+};
+
+struct kgsl_gpu_model {
+	char gpu_model[32];
+};
+
+/* Context property sub types */
+#define KGSL_CONTEXT_PROP_FAULTS 1
+
+/* Performance counter groups */
+
+#define KGSL_PERFCOUNTER_GROUP_CP 0x0
+#define KGSL_PERFCOUNTER_GROUP_RBBM 0x1
+#define KGSL_PERFCOUNTER_GROUP_PC 0x2
+#define KGSL_PERFCOUNTER_GROUP_VFD 0x3
+#define KGSL_PERFCOUNTER_GROUP_HLSQ 0x4
+#define KGSL_PERFCOUNTER_GROUP_VPC 0x5
+#define KGSL_PERFCOUNTER_GROUP_TSE 0x6
+#define KGSL_PERFCOUNTER_GROUP_RAS 0x7
+#define KGSL_PERFCOUNTER_GROUP_UCHE 0x8
+#define KGSL_PERFCOUNTER_GROUP_TP 0x9
+#define KGSL_PERFCOUNTER_GROUP_SP 0xA
+#define KGSL_PERFCOUNTER_GROUP_RB 0xB
+#define KGSL_PERFCOUNTER_GROUP_PWR 0xC
+#define KGSL_PERFCOUNTER_GROUP_VBIF 0xD
+#define KGSL_PERFCOUNTER_GROUP_VBIF_PWR 0xE
+#define KGSL_PERFCOUNTER_GROUP_MH 0xF
+#define KGSL_PERFCOUNTER_GROUP_PA_SU 0x10
+#define KGSL_PERFCOUNTER_GROUP_SQ 0x11
+#define KGSL_PERFCOUNTER_GROUP_SX 0x12
+#define KGSL_PERFCOUNTER_GROUP_TCF 0x13
+#define KGSL_PERFCOUNTER_GROUP_TCM 0x14
+#define KGSL_PERFCOUNTER_GROUP_TCR 0x15
+#define KGSL_PERFCOUNTER_GROUP_L2 0x16
+#define KGSL_PERFCOUNTER_GROUP_VSC 0x17
+#define KGSL_PERFCOUNTER_GROUP_CCU 0x18
+#define KGSL_PERFCOUNTER_GROUP_LRZ 0x19
+#define KGSL_PERFCOUNTER_GROUP_CMP 0x1A
+#define KGSL_PERFCOUNTER_GROUP_ALWAYSON 0x1B
+#define KGSL_PERFCOUNTER_GROUP_SP_PWR 0x1C
+#define KGSL_PERFCOUNTER_GROUP_TP_PWR 0x1D
+#define KGSL_PERFCOUNTER_GROUP_RB_PWR 0x1E
+#define KGSL_PERFCOUNTER_GROUP_CCU_PWR 0x1F
+#define KGSL_PERFCOUNTER_GROUP_UCHE_PWR 0x20
+#define KGSL_PERFCOUNTER_GROUP_CP_PWR 0x21
+#define KGSL_PERFCOUNTER_GROUP_GPMU_PWR 0x22
+#define KGSL_PERFCOUNTER_GROUP_ALWAYSON_PWR 0x23
+#define KGSL_PERFCOUNTER_GROUP_GLC 0x24
+#define KGSL_PERFCOUNTER_GROUP_FCHE 0x25
+#define KGSL_PERFCOUNTER_GROUP_MHUB 0x26
+#define KGSL_PERFCOUNTER_GROUP_GMU_XOCLK 0x27
+#define KGSL_PERFCOUNTER_GROUP_GMU_GMUCLK  0x28
+#define KGSL_PERFCOUNTER_GROUP_GMU_PERF  0x29
+#define KGSL_PERFCOUNTER_GROUP_SW 0x2a
+#define KGSL_PERFCOUNTER_GROUP_UFC 0x2b
+#define KGSL_PERFCOUNTER_GROUP_BV_CP 0x2c
+#define KGSL_PERFCOUNTER_GROUP_BV_PC 0x2d
+#define KGSL_PERFCOUNTER_GROUP_BV_VFD 0x2e
+#define KGSL_PERFCOUNTER_GROUP_BV_VPC 0x2f
+#define KGSL_PERFCOUNTER_GROUP_BV_TP 0x30
+#define KGSL_PERFCOUNTER_GROUP_BV_SP 0x31
+#define KGSL_PERFCOUNTER_GROUP_BV_UFC 0x32
+#define KGSL_PERFCOUNTER_GROUP_BV_TSE 0x33
+#define KGSL_PERFCOUNTER_GROUP_BV_RAS 0x34
+#define KGSL_PERFCOUNTER_GROUP_BV_LRZ 0x35
+#define KGSL_PERFCOUNTER_GROUP_BV_HLSQ 0x36
+#define KGSL_PERFCOUNTER_GROUP_MAX 0x37
+
+#define KGSL_PERFCOUNTER_NOT_USED 0xFFFFFFFF
+#define KGSL_PERFCOUNTER_BROKEN 0xFFFFFFFE
+
+/* structure holds list of ibs */
+struct kgsl_ibdesc {
+	unsigned long gpuaddr;
+	unsigned long __pad;
+	__kernel_size_t sizedwords;
+	unsigned int ctrl;
+};
+
+/**
+ * struct kgsl_cmdbatch_profiling_buffer
+ * @wall_clock_s: Ringbuffer submission time (seconds).
+ *                If KGSL_CMDBATCH_PROFILING_KTIME is set, time is provided
+ *                in kernel clocks, otherwise wall clock time is used.
+ * @wall_clock_ns: Ringbuffer submission time (nanoseconds).
+ *                 If KGSL_CMDBATCH_PROFILING_KTIME is set time is provided
+ *                 in kernel clocks, otherwise wall clock time is used.
+ * @gpu_ticks_queued: GPU ticks at ringbuffer submission
+ * @gpu_ticks_submitted: GPU ticks when starting cmdbatch execution
+ * @gpu_ticks_retired: GPU ticks when finishing cmdbatch execution
+ *
+ * This structure defines the profiling buffer used to measure cmdbatch
+ * execution time
+ */
+struct kgsl_cmdbatch_profiling_buffer {
+	__u64 wall_clock_s;
+	__u64 wall_clock_ns;
+	__u64 gpu_ticks_queued;
+	__u64 gpu_ticks_submitted;
+	__u64 gpu_ticks_retired;
+};
+
+/* ioctls */
+#define KGSL_IOC_TYPE 0x09
+
+/*
+ * get misc info about the GPU
+ * type should be a value from enum kgsl_property_type
+ * value points to a structure that varies based on type
+ * sizebytes is sizeof() that structure
+ * for KGSL_PROP_DEVICE_INFO, use struct kgsl_devinfo
+ * this structure contaings hardware versioning info.
+ * for KGSL_PROP_DEVICE_SHADOW, use struct kgsl_shadowprop
+ * this is used to find mmap() offset and sizes for mapping
+ * struct kgsl_memstore into userspace.
+ */
+struct kgsl_device_getproperty {
+	unsigned int type;
+	void __user *value;
+	__kernel_size_t sizebytes;
+};
+
+#define IOCTL_KGSL_DEVICE_GETPROPERTY \
+	_IOWR(KGSL_IOC_TYPE, 0x2, struct kgsl_device_getproperty)
+
+/* IOCTL_KGSL_DEVICE_READ (0x3) - removed 03/2012
+ */
+
+/* block until the GPU has executed past a given timestamp
+ * timeout is in milliseconds.
+ */
+struct kgsl_device_waittimestamp {
+	unsigned int timestamp;
+	unsigned int timeout;
+};
+
+#define IOCTL_KGSL_DEVICE_WAITTIMESTAMP \
+	_IOW(KGSL_IOC_TYPE, 0x6, struct kgsl_device_waittimestamp)
+
+struct kgsl_device_waittimestamp_ctxtid {
+	unsigned int context_id;
+	unsigned int timestamp;
+	unsigned int timeout;
+};
+
+#define IOCTL_KGSL_DEVICE_WAITTIMESTAMP_CTXTID \
+	_IOW(KGSL_IOC_TYPE, 0x7, struct kgsl_device_waittimestamp_ctxtid)
+
+/* DEPRECATED: issue indirect commands to the GPU.
+ * drawctxt_id must have been created with IOCTL_KGSL_DRAWCTXT_CREATE
+ * ibaddr and sizedwords must specify a subset of a buffer created
+ * with IOCTL_KGSL_SHAREDMEM_FROM_PMEM
+ * flags may be a mask of KGSL_CONTEXT_ values
+ * timestamp is a returned counter value which can be passed to
+ * other ioctls to determine when the commands have been executed by
+ * the GPU.
+ *
+ * This function is deprecated - consider using IOCTL_KGSL_SUBMIT_COMMANDS
+ * instead
+ */
+struct kgsl_ringbuffer_issueibcmds {
+	unsigned int drawctxt_id;
+	unsigned long ibdesc_addr;
+	unsigned int numibs;
+	unsigned int timestamp; /*output param */
+	unsigned int flags;
+};
+
+#define IOCTL_KGSL_RINGBUFFER_ISSUEIBCMDS \
+	_IOWR(KGSL_IOC_TYPE, 0x10, struct kgsl_ringbuffer_issueibcmds)
+
+/* read the most recently executed timestamp value
+ * type should be a value from enum kgsl_timestamp_type
+ */
+struct kgsl_cmdstream_readtimestamp {
+	unsigned int type;
+	unsigned int timestamp; /*output param */
+};
+
+#define IOCTL_KGSL_CMDSTREAM_READTIMESTAMP_OLD \
+	_IOR(KGSL_IOC_TYPE, 0x11, struct kgsl_cmdstream_readtimestamp)
+
+#define IOCTL_KGSL_CMDSTREAM_READTIMESTAMP \
+	_IOWR(KGSL_IOC_TYPE, 0x11, struct kgsl_cmdstream_readtimestamp)
+
+/* free memory when the GPU reaches a given timestamp.
+ * gpuaddr specify a memory region created by a
+ * IOCTL_KGSL_SHAREDMEM_FROM_PMEM call
+ * type should be a value from enum kgsl_timestamp_type
+ */
+struct kgsl_cmdstream_freememontimestamp {
+	unsigned long gpuaddr;
+	unsigned int type;
+	unsigned int timestamp;
+};
+
+#define IOCTL_KGSL_CMDSTREAM_FREEMEMONTIMESTAMP \
+	_IOW(KGSL_IOC_TYPE, 0x12, struct kgsl_cmdstream_freememontimestamp)
+
+/*
+ * Previous versions of this header had incorrectly defined
+ * IOCTL_KGSL_CMDSTREAM_FREEMEMONTIMESTAMP as a read-only ioctl instead
+ * of a write only ioctl.  To ensure binary compatibility, the following
+ * #define will be used to intercept the incorrect ioctl
+ */
+
+#define IOCTL_KGSL_CMDSTREAM_FREEMEMONTIMESTAMP_OLD \
+	_IOR(KGSL_IOC_TYPE, 0x12, struct kgsl_cmdstream_freememontimestamp)
+
+/* create a draw context, which is used to preserve GPU state.
+ * The flags field may contain a mask KGSL_CONTEXT_*  values
+ */
+struct kgsl_drawctxt_create {
+	unsigned int flags;
+	unsigned int drawctxt_id; /*output param */
+};
+
+#define IOCTL_KGSL_DRAWCTXT_CREATE \
+	_IOWR(KGSL_IOC_TYPE, 0x13, struct kgsl_drawctxt_create)
+
+/* destroy a draw context */
+struct kgsl_drawctxt_destroy {
+	unsigned int drawctxt_id;
+};
+
+#define IOCTL_KGSL_DRAWCTXT_DESTROY \
+	_IOW(KGSL_IOC_TYPE, 0x14, struct kgsl_drawctxt_destroy)
+
+/*
+ * add a block of pmem, fb, ashmem or user allocated address
+ * into the GPU address space
+ */
+struct kgsl_map_user_mem {
+	int fd;
+	unsigned long gpuaddr;   /*output param */
+	__kernel_size_t len;
+	__kernel_size_t offset;
+	unsigned long hostptr;   /*input param */
+	enum kgsl_user_mem_type memtype;
+	unsigned int flags;
+};
+
+#define IOCTL_KGSL_MAP_USER_MEM \
+	_IOWR(KGSL_IOC_TYPE, 0x15, struct kgsl_map_user_mem)
+
+struct kgsl_cmdstream_readtimestamp_ctxtid {
+	unsigned int context_id;
+	unsigned int type;
+	unsigned int timestamp; /*output param */
+};
+
+#define IOCTL_KGSL_CMDSTREAM_READTIMESTAMP_CTXTID \
+	_IOWR(KGSL_IOC_TYPE, 0x16, struct kgsl_cmdstream_readtimestamp_ctxtid)
+
+struct kgsl_cmdstream_freememontimestamp_ctxtid {
+	unsigned int context_id;
+	unsigned long gpuaddr;
+	unsigned int type;
+	unsigned int timestamp;
+};
+
+#define IOCTL_KGSL_CMDSTREAM_FREEMEMONTIMESTAMP_CTXTID \
+	_IOW(KGSL_IOC_TYPE, 0x17, \
+	struct kgsl_cmdstream_freememontimestamp_ctxtid)
+
+/* add a block of pmem or fb into the GPU address space */
+struct kgsl_sharedmem_from_pmem {
+	int pmem_fd;
+	unsigned long gpuaddr;  /*output param */
+	unsigned int len;
+	unsigned int offset;
+};
+
+#define IOCTL_KGSL_SHAREDMEM_FROM_PMEM \
+	_IOWR(KGSL_IOC_TYPE, 0x20, struct kgsl_sharedmem_from_pmem)
+
+/* remove memory from the GPU's address space */
+struct kgsl_sharedmem_free {
+	unsigned long gpuaddr;
+};
+
+#define IOCTL_KGSL_SHAREDMEM_FREE \
+	_IOW(KGSL_IOC_TYPE, 0x21, struct kgsl_sharedmem_free)
+
+struct kgsl_cff_user_event {
+	unsigned char cff_opcode;
+	unsigned int op1;
+	unsigned int op2;
+	unsigned int op3;
+	unsigned int op4;
+	unsigned int op5;
+	unsigned int __pad[2];
+};
+
+#define IOCTL_KGSL_CFF_USER_EVENT \
+	_IOW(KGSL_IOC_TYPE, 0x31, struct kgsl_cff_user_event)
+
+struct kgsl_gmem_desc {
+	unsigned int x;
+	unsigned int y;
+	unsigned int width;
+	unsigned int height;
+	unsigned int pitch;
+};
+
+struct kgsl_buffer_desc {
+	void		*hostptr;
+	unsigned long	gpuaddr;
+	int		size;
+	unsigned int	format;
+	unsigned int	pitch;
+	unsigned int	enabled;
+};
+
+struct kgsl_bind_gmem_shadow {
+	unsigned int drawctxt_id;
+	struct kgsl_gmem_desc gmem_desc;
+	unsigned int shadow_x;
+	unsigned int shadow_y;
+	struct kgsl_buffer_desc shadow_buffer;
+	unsigned int buffer_id;
+};
+
+#define IOCTL_KGSL_DRAWCTXT_BIND_GMEM_SHADOW \
+	_IOW(KGSL_IOC_TYPE, 0x22, struct kgsl_bind_gmem_shadow)
+
+/* add a block of memory into the GPU address space */
+
+/*
+ * IOCTL_KGSL_SHAREDMEM_FROM_VMALLOC deprecated 09/2012
+ * use IOCTL_KGSL_GPUMEM_ALLOC instead
+ */
+
+struct kgsl_sharedmem_from_vmalloc {
+	unsigned long gpuaddr;	/*output param */
+	unsigned int hostptr;
+	unsigned int flags;
+};
+
+#define IOCTL_KGSL_SHAREDMEM_FROM_VMALLOC \
+	_IOWR(KGSL_IOC_TYPE, 0x23, struct kgsl_sharedmem_from_vmalloc)
+
+/*
+ * This is being deprecated in favor of IOCTL_KGSL_GPUMEM_CACHE_SYNC which
+ * supports both directions (flush and invalidate). This code will still
+ * work, but by definition it will do a flush of the cache which might not be
+ * what you want to have happen on a buffer following a GPU operation.  It is
+ * safer to go with IOCTL_KGSL_GPUMEM_CACHE_SYNC
+ */
+
+#define IOCTL_KGSL_SHAREDMEM_FLUSH_CACHE \
+	_IOW(KGSL_IOC_TYPE, 0x24, struct kgsl_sharedmem_free)
+
+struct kgsl_drawctxt_set_bin_base_offset {
+	unsigned int drawctxt_id;
+	unsigned int offset;
+};
+
+#define IOCTL_KGSL_DRAWCTXT_SET_BIN_BASE_OFFSET \
+	_IOW(KGSL_IOC_TYPE, 0x25, struct kgsl_drawctxt_set_bin_base_offset)
+
+enum kgsl_cmdwindow_type {
+	KGSL_CMDWINDOW_MIN     = 0x00000000,
+	KGSL_CMDWINDOW_2D      = 0x00000000,
+	KGSL_CMDWINDOW_3D      = 0x00000001, /* legacy */
+	KGSL_CMDWINDOW_MMU     = 0x00000002,
+	KGSL_CMDWINDOW_ARBITER = 0x000000FF,
+	KGSL_CMDWINDOW_MAX     = 0x000000FF,
+};
+
+/* write to the command window */
+struct kgsl_cmdwindow_write {
+	enum kgsl_cmdwindow_type target;
+	unsigned int addr;
+	unsigned int data;
+};
+
+#define IOCTL_KGSL_CMDWINDOW_WRITE \
+	_IOW(KGSL_IOC_TYPE, 0x2e, struct kgsl_cmdwindow_write)
+
+struct kgsl_gpumem_alloc {
+	unsigned long gpuaddr; /* output param */
+	__kernel_size_t size;
+	unsigned int flags;
+};
+
+#define IOCTL_KGSL_GPUMEM_ALLOC \
+	_IOWR(KGSL_IOC_TYPE, 0x2f, struct kgsl_gpumem_alloc)
+
+struct kgsl_cff_syncmem {
+	unsigned long gpuaddr;
+	__kernel_size_t len;
+	unsigned int __pad[2]; /* For future binary compatibility */
+};
+
+#define IOCTL_KGSL_CFF_SYNCMEM \
+	_IOW(KGSL_IOC_TYPE, 0x30, struct kgsl_cff_syncmem)
+
+/*
+ * A timestamp event allows the user space to register an action following an
+ * expired timestamp. Note IOCTL_KGSL_TIMESTAMP_EVENT has been redefined to
+ * _IOWR to support fences which need to return a fd for the priv parameter.
+ */
+
+struct kgsl_timestamp_event {
+	int type;                /* Type of event (see list below) */
+	unsigned int timestamp;  /* Timestamp to trigger event on */
+	unsigned int context_id; /* Context for the timestamp */
+	void __user *priv;	 /* Pointer to the event specific blob */
+	__kernel_size_t len;              /* Size of the event specific blob */
+};
+
+#define IOCTL_KGSL_TIMESTAMP_EVENT_OLD \
+	_IOW(KGSL_IOC_TYPE, 0x31, struct kgsl_timestamp_event)
+
+/* A genlock timestamp event releases an existing lock on timestamp expire */
+
+#define KGSL_TIMESTAMP_EVENT_GENLOCK 1
+
+struct kgsl_timestamp_event_genlock {
+	int handle; /* Handle of the genlock lock to release */
+};
+
+/* A fence timestamp event releases an existing lock on timestamp expire */
+
+#define KGSL_TIMESTAMP_EVENT_FENCE 2
+
+struct kgsl_timestamp_event_fence {
+	int fence_fd; /* Fence to signal */
+};
+
+/*
+ * Set a property within the kernel.  Uses the same structure as
+ * IOCTL_KGSL_GETPROPERTY
+ */
+
+#define IOCTL_KGSL_SETPROPERTY \
+	_IOW(KGSL_IOC_TYPE, 0x32, struct kgsl_device_getproperty)
+
+#define IOCTL_KGSL_TIMESTAMP_EVENT \
+	_IOWR(KGSL_IOC_TYPE, 0x33, struct kgsl_timestamp_event)
+
+/**
+ * struct kgsl_gpumem_alloc_id - argument to IOCTL_KGSL_GPUMEM_ALLOC_ID
+ * @id: returned id value for this allocation.
+ * @flags: mask of KGSL_MEM* values requested and actual flags on return.
+ * @size: requested size of the allocation and actual size on return.
+ * @mmapsize: returned size to pass to mmap() which may be larger than 'size'
+ * @gpuaddr: returned GPU address for the allocation
+ *
+ * Allocate memory for access by the GPU. The flags and size fields are echoed
+ * back by the kernel, so that the caller can know if the request was
+ * adjusted.
+ *
+ * Supported flags:
+ * KGSL_MEMFLAGS_GPUREADONLY: the GPU will be unable to write to the buffer
+ * KGSL_MEMTYPE*: usage hint for debugging aid
+ * KGSL_MEMALIGN*: alignment hint, may be ignored or adjusted by the kernel.
+ * KGSL_MEMFLAGS_USE_CPU_MAP: If set on call and return, the returned GPU
+ * address will be 0. Calling mmap() will set the GPU address.
+ */
+struct kgsl_gpumem_alloc_id {
+	unsigned int id;
+	unsigned int flags;
+	__kernel_size_t size;
+	__kernel_size_t mmapsize;
+	unsigned long gpuaddr;
+/* private: reserved for future use*/
+	unsigned long __pad[2];
+};
+
+#define IOCTL_KGSL_GPUMEM_ALLOC_ID \
+	_IOWR(KGSL_IOC_TYPE, 0x34, struct kgsl_gpumem_alloc_id)
+
+/**
+ * struct kgsl_gpumem_free_id - argument to IOCTL_KGSL_GPUMEM_FREE_ID
+ * @id: GPU allocation id to free
+ *
+ * Free an allocation by id, in case a GPU address has not been assigned or
+ * is unknown. Freeing an allocation by id with this ioctl or by GPU address
+ * with IOCTL_KGSL_SHAREDMEM_FREE are equivalent.
+ */
+struct kgsl_gpumem_free_id {
+	unsigned int id;
+/* private: reserved for future use*/
+	unsigned int __pad;
+};
+
+#define IOCTL_KGSL_GPUMEM_FREE_ID \
+	_IOWR(KGSL_IOC_TYPE, 0x35, struct kgsl_gpumem_free_id)
+
+/**
+ * struct kgsl_gpumem_get_info - argument to IOCTL_KGSL_GPUMEM_GET_INFO
+ * @gpuaddr: GPU address to query. Also set on return.
+ * @id: GPU allocation id to query. Also set on return.
+ * @flags: returned mask of KGSL_MEM* values.
+ * @size: returned size of the allocation.
+ * @mmapsize: returned size to pass mmap(), which may be larger than 'size'
+ * @useraddr: returned address of the userspace mapping for this buffer
+ *
+ * This ioctl allows querying of all user visible attributes of an existing
+ * allocation, by either the GPU address or the id returned by a previous
+ * call to IOCTL_KGSL_GPUMEM_ALLOC_ID. Legacy allocation ioctls may not
+ * return all attributes so this ioctl can be used to look them up if needed.
+ *
+ */
+struct kgsl_gpumem_get_info {
+	unsigned long gpuaddr;
+	unsigned int id;
+	unsigned int flags;
+	__kernel_size_t size;
+	__kernel_size_t mmapsize;
+	unsigned long useraddr;
+/* private: reserved for future use*/
+	unsigned long __pad[4];
+};
+
+#define IOCTL_KGSL_GPUMEM_GET_INFO\
+	_IOWR(KGSL_IOC_TYPE, 0x36, struct kgsl_gpumem_get_info)
+
+/**
+ * struct kgsl_gpumem_sync_cache - argument to IOCTL_KGSL_GPUMEM_SYNC_CACHE
+ * @gpuaddr: GPU address of the buffer to sync.
+ * @id: id of the buffer to sync. Either gpuaddr or id is sufficient.
+ * @op: a mask of KGSL_GPUMEM_CACHE_* values
+ * @offset: offset into the buffer
+ * @length: number of bytes starting from offset to perform
+ * the cache operation on
+ *
+ * Sync the L2 cache for memory headed to and from the GPU - this replaces
+ * KGSL_SHAREDMEM_FLUSH_CACHE since it can handle cache management for both
+ * directions
+ *
+ */
+struct kgsl_gpumem_sync_cache {
+	unsigned long gpuaddr;
+	unsigned int id;
+	unsigned int op;
+	__kernel_size_t offset;
+	__kernel_size_t length;
+};
+
+#define KGSL_GPUMEM_CACHE_CLEAN (1 << 0)
+#define KGSL_GPUMEM_CACHE_TO_GPU KGSL_GPUMEM_CACHE_CLEAN
+
+#define KGSL_GPUMEM_CACHE_INV (1 << 1)
+#define KGSL_GPUMEM_CACHE_FROM_GPU KGSL_GPUMEM_CACHE_INV
+
+#define KGSL_GPUMEM_CACHE_FLUSH \
+	(KGSL_GPUMEM_CACHE_CLEAN | KGSL_GPUMEM_CACHE_INV)
+
+/* Flag to ensure backward compatibility of kgsl_gpumem_sync_cache struct */
+#define KGSL_GPUMEM_CACHE_RANGE (1 << 31U)
+
+#define IOCTL_KGSL_GPUMEM_SYNC_CACHE \
+	_IOW(KGSL_IOC_TYPE, 0x37, struct kgsl_gpumem_sync_cache)
+
+/**
+ * struct kgsl_perfcounter_get - argument to IOCTL_KGSL_PERFCOUNTER_GET
+ * @groupid: Performance counter group ID
+ * @countable: Countable to select within the group
+ * @offset: Return offset of the reserved LO counter
+ * @offset_hi: Return offset of the reserved HI counter
+ *
+ * Get an available performance counter from a specified groupid.  The offset
+ * of the performance counter will be returned after successfully assigning
+ * the countable to the counter for the specified group.  An error will be
+ * returned and an offset of 0 if the groupid is invalid or there are no
+ * more counters left.  After successfully getting a perfcounter, the user
+ * must call kgsl_perfcounter_put(groupid, contable) when finished with
+ * the perfcounter to clear up perfcounter resources.
+ *
+ */
+struct kgsl_perfcounter_get {
+	unsigned int groupid;
+	unsigned int countable;
+	unsigned int offset;
+	unsigned int offset_hi;
+/* private: reserved for future use */
+	unsigned int __pad; /* For future binary compatibility */
+};
+
+#define IOCTL_KGSL_PERFCOUNTER_GET \
+	_IOWR(KGSL_IOC_TYPE, 0x38, struct kgsl_perfcounter_get)
+
+/**
+ * struct kgsl_perfcounter_put - argument to IOCTL_KGSL_PERFCOUNTER_PUT
+ * @groupid: Performance counter group ID
+ * @countable: Countable to release within the group
+ *
+ * Put an allocated performance counter to allow others to have access to the
+ * resource that was previously taken.  This is only to be called after
+ * successfully getting a performance counter from kgsl_perfcounter_get().
+ *
+ */
+struct kgsl_perfcounter_put {
+	unsigned int groupid;
+	unsigned int countable;
+/* private: reserved for future use */
+	unsigned int __pad[2]; /* For future binary compatibility */
+};
+
+#define IOCTL_KGSL_PERFCOUNTER_PUT \
+	_IOW(KGSL_IOC_TYPE, 0x39, struct kgsl_perfcounter_put)
+
+/**
+ * struct kgsl_perfcounter_query - argument to IOCTL_KGSL_PERFCOUNTER_QUERY
+ * @groupid: Performance counter group ID
+ * @countables: Return active countables array
+ * @count: Number of entries in @countables
+ * @max_counters: Return total number counters for the group ID
+ *
+ * Query the available performance counters given a groupid.  The array
+ * *countables is used to return the current active countables in counters.
+ * The size of the array is passed in so the kernel will only write at most
+ * size or counter->size for the group id.  The total number of available
+ * counters for the group ID is returned in max_counters.
+ * If the array or size passed in are invalid, then only the maximum number
+ * of counters will be returned, no data will be written to *countables.
+ * If the groupid is invalid an error code will be returned.
+ *
+ */
+struct kgsl_perfcounter_query {
+	unsigned int groupid;
+	/* Array to return the current countable for up to size counters */
+	unsigned int __user *countables;
+	unsigned int count;
+	unsigned int max_counters;
+/* private: reserved for future use */
+	unsigned int __pad[2]; /* For future binary compatibility */
+};
+
+#define IOCTL_KGSL_PERFCOUNTER_QUERY \
+	_IOWR(KGSL_IOC_TYPE, 0x3A, struct kgsl_perfcounter_query)
+
+/**
+ * struct kgsl_perfcounter_read_group - argument to IOCTL_KGSL_PERFCOUNTER_QUERY
+ * @groupid: Performance counter group IDs
+ * @countable: Performance counter countable IDs
+ * @value: Return performance counter reads
+ *
+ * Read in the current value of a performance counter given by the groupid
+ * and countable.
+ *
+ */
+
+struct kgsl_perfcounter_read_group {
+	unsigned int groupid;
+	unsigned int countable;
+	unsigned long long value;
+};
+
+struct kgsl_perfcounter_read {
+	struct kgsl_perfcounter_read_group __user *reads;
+	unsigned int count;
+/* private: reserved for future use */
+	unsigned int __pad[2]; /* For future binary compatibility */
+};
+
+#define IOCTL_KGSL_PERFCOUNTER_READ \
+	_IOWR(KGSL_IOC_TYPE, 0x3B, struct kgsl_perfcounter_read)
+/*
+ * struct kgsl_gpumem_sync_cache_bulk - argument to
+ * IOCTL_KGSL_GPUMEM_SYNC_CACHE_BULK
+ * @id_list: list of GPU buffer ids of the buffers to sync
+ * @count: number of GPU buffer ids in id_list
+ * @op: a mask of KGSL_GPUMEM_CACHE_* values
+ *
+ * Sync the cache for memory headed to and from the GPU. Certain
+ * optimizations can be made on the cache operation based on the total
+ * size of the working set of memory to be managed.
+ */
+struct kgsl_gpumem_sync_cache_bulk {
+	unsigned int __user *id_list;
+	unsigned int count;
+	unsigned int op;
+/* private: reserved for future use */
+	unsigned int __pad[2]; /* For future binary compatibility */
+};
+
+#define IOCTL_KGSL_GPUMEM_SYNC_CACHE_BULK \
+	_IOWR(KGSL_IOC_TYPE, 0x3C, struct kgsl_gpumem_sync_cache_bulk)
+
+/*
+ * struct kgsl_cmd_syncpoint_timestamp
+ * @context_id: ID of a KGSL context
+ * @timestamp: GPU timestamp
+ *
+ * This structure defines a syncpoint comprising a context/timestamp pair. A
+ * list of these may be passed by IOCTL_KGSL_SUBMIT_COMMANDS to define
+ * dependencies that must be met before the command can be submitted to the
+ * hardware
+ */
+struct kgsl_cmd_syncpoint_timestamp {
+	unsigned int context_id;
+	unsigned int timestamp;
+};
+
+struct kgsl_cmd_syncpoint_fence {
+	int fd;
+};
+
+/*
+ * struct kgsl_cmd_syncpoint_timeline
+ * @timelines: Address of an array of &struct kgsl_timeline_val
+ * @count: Number of entries in @timelines
+ * @timelines_size: Size of each entry in @timelines
+ *
+ * Define a syncpoint for a number of timelines.  This syncpoint will
+ * be satisfied when all of the specified timelines are signaled.
+ */
+struct kgsl_cmd_syncpoint_timeline {
+	__u64 timelines;
+	__u32 count;
+	__u32 timelines_size;
+};
+
+/**
+ * struct kgsl_cmd_syncpoint - Define a sync point for a command batch
+ * @type: type of sync point defined here
+ * @priv: Pointer to the type specific buffer
+ * @size: Size of the type specific buffer
+ *
+ * This structure contains pointers defining a specific command sync point.
+ * The pointer and size should point to a type appropriate structure.
+ */
+struct kgsl_cmd_syncpoint {
+	int type;
+	void __user *priv;
+	__kernel_size_t size;
+};
+
+/* Flag to indicate that the cmdlist may contain memlists */
+#define KGSL_IBDESC_MEMLIST 0x1
+
+/* Flag to point out the cmdbatch profiling buffer in the memlist */
+#define KGSL_IBDESC_PROFILING_BUFFER 0x2
+
+/**
+ * struct kgsl_submit_commands - Argument to IOCTL_KGSL_SUBMIT_COMMANDS
+ * @context_id: KGSL context ID that owns the commands
+ * @flags:
+ * @cmdlist: User pointer to a list of kgsl_ibdesc structures
+ * @numcmds: Number of commands listed in cmdlist
+ * @synclist: User pointer to a list of kgsl_cmd_syncpoint structures
+ * @numsyncs: Number of sync points listed in synclist
+ * @timestamp: On entry the a user defined timestamp, on exist the timestamp
+ * assigned to the command batch
+ *
+ * This structure specifies a command to send to the GPU hardware.  This is
+ * similar to kgsl_issueibcmds expect that it doesn't support the legacy way to
+ * submit IB lists and it adds sync points to block the IB until the
+ * dependencies are satisified.  This entry point is the new and preferred way
+ * to submit commands to the GPU. The memory list can be used to specify all
+ * memory that is referrenced in the current set of commands.
+ */
+
+struct kgsl_submit_commands {
+	unsigned int context_id;
+	unsigned int flags;
+	struct kgsl_ibdesc __user *cmdlist;
+	unsigned int numcmds;
+	struct kgsl_cmd_syncpoint __user *synclist;
+	unsigned int numsyncs;
+	unsigned int timestamp;
+/* private: reserved for future use */
+	unsigned int __pad[4];
+};
+
+#define IOCTL_KGSL_SUBMIT_COMMANDS \
+	_IOWR(KGSL_IOC_TYPE, 0x3D, struct kgsl_submit_commands)
+
+/**
+ * struct kgsl_device_constraint - device constraint argument
+ * @context_id: KGSL context ID
+ * @type: type of constraint i.e pwrlevel/none
+ * @data: constraint data
+ * @size: size of the constraint data
+ */
+struct kgsl_device_constraint {
+	unsigned int type;
+	unsigned int context_id;
+	void __user *data;
+	__kernel_size_t size;
+};
+
+/* Constraint Type*/
+#define KGSL_CONSTRAINT_NONE 0
+#define KGSL_CONSTRAINT_PWRLEVEL 1
+
+/* L3 constraint Type */
+#define KGSL_CONSTRAINT_L3_NONE	2
+#define KGSL_CONSTRAINT_L3_PWRLEVEL	3
+
+/* PWRLEVEL constraint level*/
+/* set to min frequency */
+#define KGSL_CONSTRAINT_PWR_MIN    0
+/* set to max frequency */
+#define KGSL_CONSTRAINT_PWR_MAX    1
+
+struct kgsl_device_constraint_pwrlevel {
+	unsigned int level;
+};
+
+/**
+ * struct kgsl_syncsource_create - Argument to IOCTL_KGSL_SYNCSOURCE_CREATE
+ * @id: returned id for the syncsource that was created.
+ *
+ * This ioctl creates a userspace sync timeline.
+ */
+
+struct kgsl_syncsource_create {
+	unsigned int id;
+/* private: reserved for future use */
+	unsigned int __pad[3];
+};
+
+#define IOCTL_KGSL_SYNCSOURCE_CREATE \
+	_IOWR(KGSL_IOC_TYPE, 0x40, struct kgsl_syncsource_create)
+
+/**
+ * struct kgsl_syncsource_destroy - Argument to IOCTL_KGSL_SYNCSOURCE_DESTROY
+ * @id: syncsource id to destroy
+ *
+ * This ioctl creates a userspace sync timeline.
+ */
+
+struct kgsl_syncsource_destroy {
+	unsigned int id;
+/* private: reserved for future use */
+	unsigned int __pad[3];
+};
+
+#define IOCTL_KGSL_SYNCSOURCE_DESTROY \
+	_IOWR(KGSL_IOC_TYPE, 0x41, struct kgsl_syncsource_destroy)
+
+/**
+ * struct kgsl_syncsource_create_fence - Argument to
+ *     IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE
+ * @id: syncsource id
+ * @fence_fd: returned sync_fence fd
+ *
+ * Create a fence that may be signaled by userspace by calling
+ * IOCTL_KGSL_SYNCSOURCE_SIGNAL_FENCE. There are no order dependencies between
+ * these fences.
+ */
+struct kgsl_syncsource_create_fence {
+	unsigned int id;
+	int fence_fd;
+/* private: reserved for future use */
+	unsigned int __pad[4];
+};
+
+/**
+ * struct kgsl_syncsource_signal_fence - Argument to
+ *     IOCTL_KGSL_SYNCSOURCE_SIGNAL_FENCE
+ * @id: syncsource id
+ * @fence_fd: sync_fence fd to signal
+ *
+ * Signal a fence that was created by a IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE
+ * call using the same syncsource id. This allows a fence to be shared
+ * to other processes but only signaled by the process owning the fd
+ * used to create the fence.
+ */
+#define IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE \
+	_IOWR(KGSL_IOC_TYPE, 0x42, struct kgsl_syncsource_create_fence)
+
+struct kgsl_syncsource_signal_fence {
+	unsigned int id;
+	int fence_fd;
+/* private: reserved for future use */
+	unsigned int __pad[4];
+};
+
+#define IOCTL_KGSL_SYNCSOURCE_SIGNAL_FENCE \
+	_IOWR(KGSL_IOC_TYPE, 0x43, struct kgsl_syncsource_signal_fence)
+
+/**
+ * struct kgsl_cff_sync_gpuobj - Argument to IOCTL_KGSL_CFF_SYNC_GPUOBJ
+ * @offset: Offset into the GPU object to sync
+ * @length: Number of bytes to sync
+ * @id: ID of the GPU object to sync
+ */
+struct kgsl_cff_sync_gpuobj {
+	__u64 offset;
+	__u64 length;
+	unsigned int id;
+};
+
+#define IOCTL_KGSL_CFF_SYNC_GPUOBJ \
+	_IOW(KGSL_IOC_TYPE, 0x44, struct kgsl_cff_sync_gpuobj)
+
+/**
+ * struct kgsl_gpuobj_alloc - Argument to IOCTL_KGSL_GPUOBJ_ALLOC
+ * @size: Size in bytes of the object to allocate
+ * @flags: mask of KGSL_MEMFLAG_* bits
+ * @va_len: Size in bytes of the virtual region to allocate
+ * @mmapsize: Returns the mmap() size of the object
+ * @id: Returns the GPU object ID of the new object
+ * @metadata_len: Length of the metdata to copy from the user
+ * @metadata: Pointer to the user specified metadata to store for the object
+ */
+struct kgsl_gpuobj_alloc {
+	__u64 size;
+	__u64 flags;
+	__u64 va_len;
+	__u64 mmapsize;
+	unsigned int id;
+	unsigned int metadata_len;
+	__u64 metadata;
+};
+
+/* Let the user know that this header supports the gpuobj metadata */
+#define KGSL_GPUOBJ_ALLOC_METADATA_MAX 64
+
+#define IOCTL_KGSL_GPUOBJ_ALLOC \
+	_IOWR(KGSL_IOC_TYPE, 0x45, struct kgsl_gpuobj_alloc)
+
+/**
+ * struct kgsl_gpuobj_free - Argument to IOCTL_KGLS_GPUOBJ_FREE
+ * @flags: Mask of: KGSL_GUPOBJ_FREE_ON_EVENT
+ * @priv: Pointer to the private object if KGSL_GPUOBJ_FREE_ON_EVENT is
+ * specified
+ * @id: ID of the GPU object to free
+ * @type: If KGSL_GPUOBJ_FREE_ON_EVENT is specified, the type of asynchronous
+ * event to free on
+ * @len: Length of the data passed in priv
+ */
+struct kgsl_gpuobj_free {
+	__u64 flags;
+	__u64 __user priv;
+	unsigned int id;
+	unsigned int type;
+	unsigned int len;
+};
+
+#define KGSL_GPUOBJ_FREE_ON_EVENT 1
+
+#define KGSL_GPU_EVENT_TIMESTAMP 1
+#define KGSL_GPU_EVENT_FENCE     2
+
+/**
+ * struct kgsl_gpu_event_timestamp - Specifies a timestamp event to free a GPU
+ * object on
+ * @context_id: ID of the timestamp event to wait for
+ * @timestamp: Timestamp of the timestamp event to wait for
+ */
+struct kgsl_gpu_event_timestamp {
+	unsigned int context_id;
+	unsigned int timestamp;
+};
+
+/**
+ * struct kgsl_gpu_event_fence - Specifies a fence ID to to free a GPU object on
+ * @fd: File descriptor for the fence
+ */
+struct kgsl_gpu_event_fence {
+	int fd;
+};
+
+#define IOCTL_KGSL_GPUOBJ_FREE \
+	_IOW(KGSL_IOC_TYPE, 0x46, struct kgsl_gpuobj_free)
+
+/**
+ * struct kgsl_gpuobj_info - argument to IOCTL_KGSL_GPUOBJ_INFO
+ * @gpuaddr: GPU address of the object
+ * @flags: Current flags for the object
+ * @size: Size of the object
+ * @va_len: VA size of the object
+ * @va_addr: Virtual address of the object (if it is mapped)
+ * id - GPU object ID of the object to query
+ */
+struct kgsl_gpuobj_info {
+	__u64 gpuaddr;
+	__u64 flags;
+	__u64 size;
+	__u64 va_len;
+	__u64 va_addr;
+	unsigned int id;
+};
+
+#define IOCTL_KGSL_GPUOBJ_INFO \
+	_IOWR(KGSL_IOC_TYPE, 0x47, struct kgsl_gpuobj_info)
+
+/**
+ * struct kgsl_gpuobj_import - argument to IOCTL_KGSL_GPUOBJ_IMPORT
+ * @priv: Pointer to the private data for the import type
+ * @priv_len: Length of the private data
+ * @flags: Mask of KGSL_MEMFLAG_ flags
+ * @type: Type of the import (KGSL_USER_MEM_TYPE_*)
+ * @id: Returns the ID of the new GPU object
+ */
+struct kgsl_gpuobj_import {
+	__u64 __user priv;
+	__u64 priv_len;
+	__u64 flags;
+	unsigned int type;
+	unsigned int id;
+};
+
+/**
+ * struct kgsl_gpuobj_import_dma_buf - import a dmabuf object
+ * @fd: File descriptor for the dma-buf object
+ */
+struct kgsl_gpuobj_import_dma_buf {
+	int fd;
+};
+
+/**
+ * struct kgsl_gpuobj_import_useraddr - import an object based on a useraddr
+ * @virtaddr: Virtual address of the object to import
+ */
+struct kgsl_gpuobj_import_useraddr {
+	__u64 virtaddr;
+};
+
+#define IOCTL_KGSL_GPUOBJ_IMPORT \
+	_IOWR(KGSL_IOC_TYPE, 0x48, struct kgsl_gpuobj_import)
+
+/**
+ * struct kgsl_gpuobj_sync_obj - Individual GPU object to sync
+ * @offset: Offset within the GPU object to sync
+ * @length: Number of bytes to sync
+ * @id: ID of the GPU object to sync
+ * @op: Cache operation to execute
+ */
+
+struct kgsl_gpuobj_sync_obj {
+	__u64 offset;
+	__u64 length;
+	unsigned int id;
+	unsigned int op;
+};
+
+/**
+ * struct kgsl_gpuobj_sync - Argument for IOCTL_KGSL_GPUOBJ_SYNC
+ * @objs: Pointer to an array of kgsl_gpuobj_sync_obj structs
+ * @obj_len: Size of each item in the array
+ * @count: Number of items in the array
+ */
+
+struct kgsl_gpuobj_sync {
+	__u64 __user objs;
+	unsigned int obj_len;
+	unsigned int count;
+};
+
+#define IOCTL_KGSL_GPUOBJ_SYNC \
+	_IOW(KGSL_IOC_TYPE, 0x49, struct kgsl_gpuobj_sync)
+
+/**
+ * struct kgsl_command_object - GPU command object
+ * @offset: GPU address offset of the object
+ * @gpuaddr: GPU address of the object
+ * @size: Size of the object
+ * @flags: Current flags for the object
+ * @id - GPU command object ID
+ */
+struct kgsl_command_object {
+	__u64 offset;
+	__u64 gpuaddr;
+	__u64 size;
+	unsigned int flags;
+	unsigned int id;
+};
+
+/**
+ * struct kgsl_command_syncpoint - GPU syncpoint object
+ * @priv: Pointer to the type specific buffer
+ * @size: Size of the type specific buffer
+ * @type: type of sync point defined here
+ */
+struct kgsl_command_syncpoint {
+	__u64 __user priv;
+	__u64 size;
+	unsigned int type;
+};
+
+/**
+ * struct kgsl_gpu_command - Argument for IOCTL_KGSL_GPU_COMMAND
+ * @flags: Current flags for the object
+ * @cmdlist: List of kgsl_command_objects for submission
+ * @cmdsize: Size of kgsl_command_objects structure
+ * @numcmds: Number of kgsl_command_objects in command list
+ * @objlist: List of kgsl_command_objects for tracking
+ * @objsize: Size of kgsl_command_objects structure
+ * @numobjs: Number of kgsl_command_objects in object list
+ * @synclist: List of kgsl_command_syncpoints
+ * @syncsize: Size of kgsl_command_syncpoint structure
+ * @numsyncs: Number of kgsl_command_syncpoints in syncpoint list
+ * @context_id: Context ID submitting the kgsl_gpu_command
+ * @timestamp: Timestamp for the submitted commands
+ */
+struct kgsl_gpu_command {
+	__u64 flags;
+	__u64 __user cmdlist;
+	unsigned int cmdsize;
+	unsigned int numcmds;
+	__u64 __user objlist;
+	unsigned int objsize;
+	unsigned int numobjs;
+	__u64 __user synclist;
+	unsigned int syncsize;
+	unsigned int numsyncs;
+	unsigned int context_id;
+	unsigned int timestamp;
+};
+
+#define IOCTL_KGSL_GPU_COMMAND \
+	_IOWR(KGSL_IOC_TYPE, 0x4A, struct kgsl_gpu_command)
+
+/**
+ * struct kgsl_preemption_counters_query - argument to
+ * IOCTL_KGSL_PREEMPTIONCOUNTER_QUERY
+ * @counters: Return preemption counters array
+ * @size_user: Size allocated by userspace
+ * @size_priority_level: Size of preemption counters for each
+ * priority level
+ * @max_priority_level: Return max number of priority levels
+ *
+ * Query the available preemption counters. The array counters
+ * is used to return preemption counters. The size of the array
+ * is passed in so the kernel will only write at most size_user
+ * or max available preemption counters.  The total number of
+ * preemption counters is returned in max_priority_level. If the
+ * array or size passed in are invalid, then an error is
+ * returned back.
+ */
+struct kgsl_preemption_counters_query {
+	__u64 __user counters;
+	unsigned int size_user;
+	unsigned int size_priority_level;
+	unsigned int max_priority_level;
+};
+
+#define IOCTL_KGSL_PREEMPTIONCOUNTER_QUERY \
+	_IOWR(KGSL_IOC_TYPE, 0x4B, struct kgsl_preemption_counters_query)
+
+/**
+ * struct kgsl_gpuobj_set_info - argument for IOCTL_KGSL_GPUOBJ_SET_INFO
+ * @flags: Flags to indicate which parameters to change
+ * @metadata:  If KGSL_GPUOBJ_SET_INFO_METADATA is set, a pointer to the new
+ * metadata
+ * @id: GPU memory object ID to change
+ * @metadata_len:  If KGSL_GPUOBJ_SET_INFO_METADATA is set, the length of the
+ * new metadata string
+ * @type: If KGSL_GPUOBJ_SET_INFO_TYPE is set, the new type of the memory object
+ */
+
+#define KGSL_GPUOBJ_SET_INFO_METADATA (1 << 0)
+#define KGSL_GPUOBJ_SET_INFO_TYPE (1 << 1)
+
+struct kgsl_gpuobj_set_info {
+	__u64 flags;
+	__u64 metadata;
+	unsigned int id;
+	unsigned int metadata_len;
+	unsigned int type;
+};
+
+#define IOCTL_KGSL_GPUOBJ_SET_INFO \
+	_IOW(KGSL_IOC_TYPE, 0x4C, struct kgsl_gpuobj_set_info)
+
+/**
+ * struct kgsl_sparse_phys_alloc - Argument for IOCTL_KGSL_SPARSE_PHYS_ALLOC
+ * @size: Size in bytes to back
+ * @pagesize: Pagesize alignment required
+ * @flags: Flags for this allocation
+ * @id: Returned ID for this allocation
+ */
+struct kgsl_sparse_phys_alloc {
+	__u64 size;
+	__u64 pagesize;
+	__u64 flags;
+	unsigned int id;
+};
+
+#define IOCTL_KGSL_SPARSE_PHYS_ALLOC \
+	_IOWR(KGSL_IOC_TYPE, 0x50, struct kgsl_sparse_phys_alloc)
+
+/**
+ * struct kgsl_sparse_phys_free - Argument for IOCTL_KGSL_SPARSE_PHYS_FREE
+ * @id: ID to free
+ */
+struct kgsl_sparse_phys_free {
+	unsigned int id;
+};
+
+#define IOCTL_KGSL_SPARSE_PHYS_FREE \
+	_IOW(KGSL_IOC_TYPE, 0x51, struct kgsl_sparse_phys_free)
+
+/**
+ * struct kgsl_sparse_virt_alloc - Argument for IOCTL_KGSL_SPARSE_VIRT_ALLOC
+ * @size: Size in bytes to reserve
+ * @pagesize: Pagesize alignment required
+ * @flags: Flags for this allocation
+ * @id: Returned ID for this allocation
+ * @gpuaddr: Returned GPU address for this allocation
+ */
+struct kgsl_sparse_virt_alloc {
+	__u64 size;
+	__u64 pagesize;
+	__u64 flags;
+	__u64 gpuaddr;
+	unsigned int id;
+};
+
+#define IOCTL_KGSL_SPARSE_VIRT_ALLOC \
+	_IOWR(KGSL_IOC_TYPE, 0x52, struct kgsl_sparse_virt_alloc)
+
+/**
+ * struct kgsl_sparse_virt_free - Argument for IOCTL_KGSL_SPARSE_VIRT_FREE
+ * @id: ID to free
+ */
+struct kgsl_sparse_virt_free {
+	unsigned int id;
+};
+
+#define IOCTL_KGSL_SPARSE_VIRT_FREE \
+	_IOW(KGSL_IOC_TYPE, 0x53, struct kgsl_sparse_virt_free)
+
+/**
+ * struct kgsl_sparse_binding_object - Argument for kgsl_sparse_bind
+ * @virtoffset: Offset into the virtual ID
+ * @physoffset: Offset into the physical ID (bind only)
+ * @size: Size in bytes to reserve
+ * @flags: Flags for this kgsl_sparse_binding_object
+ * @id: Physical ID to bind (bind only)
+ */
+struct kgsl_sparse_binding_object {
+	__u64 virtoffset;
+	__u64 physoffset;
+	__u64 size;
+	__u64 flags;
+	unsigned int id;
+};
+
+/**
+ * struct kgsl_sparse_bind - Argument for IOCTL_KGSL_SPARSE_BIND
+ * @list: List of kgsl_sparse_bind_objects to bind/unbind
+ * @id: Virtual ID to bind/unbind
+ * @size: Size of kgsl_sparse_bind_object
+ * @count: Number of elements in list
+ *
+ */
+struct kgsl_sparse_bind {
+	__u64 __user list;
+	unsigned int id;
+	unsigned int size;
+	unsigned int count;
+};
+
+#define IOCTL_KGSL_SPARSE_BIND \
+	_IOW(KGSL_IOC_TYPE, 0x54, struct kgsl_sparse_bind)
+
+/**
+ * struct kgsl_gpu_sparse_command - Argument for
+ * IOCTL_KGSL_GPU_SPARSE_COMMAND
+ * @flags: Current flags for the object
+ * @sparselist: List of kgsl_sparse_binding_object to bind/unbind
+ * @synclist: List of kgsl_command_syncpoints
+ * @sparsesize: Size of kgsl_sparse_binding_object
+ * @numsparse: Number of elements in list
+ * @sync_size: Size of kgsl_command_syncpoint structure
+ * @numsyncs: Number of kgsl_command_syncpoints in syncpoint list
+ * @context_id: Context ID submitting the kgsl_gpu_command
+ * @timestamp: Timestamp for the submitted commands
+ * @id: Virtual ID to bind/unbind
+ */
+struct kgsl_gpu_sparse_command {
+	__u64 flags;
+	__u64 __user sparselist;
+	__u64 __user synclist;
+	unsigned int sparsesize;
+	unsigned int numsparse;
+	unsigned int syncsize;
+	unsigned int numsyncs;
+	unsigned int context_id;
+	unsigned int timestamp;
+	unsigned int id;
+};
+
+#define IOCTL_KGSL_GPU_SPARSE_COMMAND \
+	_IOWR(KGSL_IOC_TYPE, 0x55, struct kgsl_gpu_sparse_command)
+
+#define KGSL_GPUMEM_RANGE_OP_BIND 1
+#define KGSL_GPUMEM_RANGE_OP_UNBIND 2
+
+/**
+ * struct kgsl_gpumem_bind_range - specifies a bind operation for a virtual
+ * buffer object
+ * @child_offset: Offset to the start of memory within the child buffer object
+ * (not used for KGSL_GPUMEM_RANGE_OP_UNBIND operations)
+ * @target_offset: GPU address offset within the target VBO
+ * @length: Amount of memory to map/unmap (in bytes)
+ * @child_id: The GPU buffer ID for the child object to map/unmap in the VBO
+ * @op: One of KGSL_GPUMEM_RANGE_OP_BIND or KGSL_GPUMEM_RANGE_OP_UNBIND
+ *
+ * This defines a specific bind operation to a virtual buffer object specified
+ * in &struct kgsl_gpumem_bind_ranges. When @op is KGSL_GPUMEM_RANGE_OP_BIND the
+ * physical memory starting at @child_offset in the memory object identified by
+ * @child_id will be mapped into the target virtual buffer object starting at
+ * @offset for @length bytes.
+ *
+ * When @op is KGSL_GPUMEM_RANGE_OP_UNBIND any entries in the target virtual
+ * buffer object between @offset and @length that belong to @child_id will be
+ * removed.
+ */
+struct kgsl_gpumem_bind_range {
+	__u64 child_offset;
+	__u64 target_offset;
+	__u64 length;
+	__u32 child_id;
+	__u32 op;
+};
+
+#define KGSL_GPUMEM_BIND_ASYNC		(1UL << 0)
+#define KGSL_GPUMEM_BIND_FENCE_OUT	(1UL << 1)
+
+/**
+ * struct kgsl_gpumem_bind_ranges - Argument to IOCTL_KGSL_GPUMEM_BIND_RANGES to
+ * either map or unmap a child buffer object into a virtual buffer object.
+ * @ranges: User memory pointer to an array of range operations of type &struct
+ * kgsl_gpumem_bind_range
+ * @ranges_nents: Number of entries in @ranges
+ * @ranges_size: Size of each entry in @ranges in bytes
+ * @id: GPU buffer object identifier for the target virtual buffer object
+ * @flags: Bitmap of KGSL_GPUMEM_BIND_ASYNC and KGSL_GPUMEM_BIND_FENCE_OUT
+ * @fence_id: If KGSL_GPUMEM_BIND_FENCE_OUT is set in @flags contains the
+ * identifier for the sync fence that will be signaled after the operation
+ * completes
+ *
+ * Describes a number of range operations to perform on a virtual buffer object
+ * identified by @id. Ranges should be a __u64 representation of an array of
+ * &struct kgsl_gpumem_bind_range entries. @ranges_nents will contain the number
+ * of entries in the array, and @ranges_size will contain the size of each entry
+ * in the array. If KGSL_GPUMEM_BIND_ASYNC is set the operation will be
+ * performed asynchronously and the operation will immediately return to the
+ * user. Otherwise the calling context will block until the operation has
+ * completed.
+ *
+ * If KGSL_GPUMEM_BIND_ASYNC and KGSL_GPUMEM_BIND_FENCE_OUT are both set a sync
+ * fence will be created and returned in @fence_id. The fence will be signaled
+ * when the bind operation has completed.
+ */
+struct kgsl_gpumem_bind_ranges {
+	__u64 ranges;
+	__u32 ranges_nents;
+	__u32 ranges_size;
+	__u32 id;
+	__u32 flags;
+	int fence_id;
+	/* private: 64 bit compatibility */
+	__u32 padding;
+};
+
+#define IOCTL_KGSL_GPUMEM_BIND_RANGES \
+	_IOWR(KGSL_IOC_TYPE, 0x56, struct kgsl_gpumem_bind_ranges)
+
+#define KGSL_GPU_AUX_COMMAND_BIND	(1 << 0)
+#define KGSL_GPU_AUX_COMMAND_TIMELINE	(1 << 1)
+/* Reuse the same flag that GPU COMMAND uses */
+#define KGSL_GPU_AUX_COMMAND_SYNC	KGSL_CMDBATCH_SYNC
+
+/**
+ * struct kgsl_gpu_aux_command_bind - Descriptor for a GPU AUX bind command
+ * @rangeslist: Pointer to a list of &struct kgsl_gpumem_bind_range items
+ * @numranges Number of entries in @rangeslist
+ * @rangesize: Size of each entry in @rangeslist
+ * @target: The GPU memory ID for the target virtual buffer object
+ *
+ * Describe a GPU AUX command to bind ranges in a virtual buffer object.
+ * @rangeslist points to a &struct kgsl_gpumem_bind_ranges which is the same
+ * struct that is used by IOCTl_KGSL_GPUMEM_BIND_RANGES. @numrages is the size
+ * of the array in @rangeslist and @rangesize is the size of each entity in
+ * @rangeslist. @target points to the GPU ID for the target VBO object.
+ */
+struct kgsl_gpu_aux_command_bind {
+	__u64 rangeslist;
+	__u64 numranges;
+	__u64 rangesize;
+	__u32 target;
+/* private: Padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+/**
+ * struct kgsl_gpu_aux_command_generic - Container for an AUX command
+ * @priv: Pointer to the type specific buffer
+ * @size: Size of the type specific buffer
+ * @type: type of sync point defined here
+ *
+ * Describes a generic container for GPU aux commands. @priv is a user pointer
+ * to the command struct matching @type of size @size.
+ */
+struct kgsl_gpu_aux_command_generic {
+	__u64 priv;
+	__u64 size;
+	__u32 type;
+/* private: Padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+/**
+ * struct kgsl_gpu_aux_command - Argument for IOCTL_KGSL_GPU_AUX_COMMAND
+ * @flags: flags for the object
+ * @cmdlist: List of &struct kgsl_gpu_aux_command_generic objects
+ * @cmd_size: Size of each entry in @cmdlist
+ * @numcmds: Number of entries in @cmdlist
+ * @synclist: List of &struct kgsl_command_syncpoint objects
+ * @syncsize: Size of each entry in @synclist
+ * @numsyncs: Number of entries in @synclist
+ * @context_id: ID of the context submitting the aux command
+ * @timestamp: Timestamp for the command submission
+ *
+ * Describe a GPU auxiliary command. Auxiliary commands are tasks that are not
+ * performed on hardware but can be queued like normal GPU commands. Like GPU
+ * commands AUX commands are assigned a timestamp and processed in order in the
+ * queue. They can also have standard sync objects attached. The only
+ * difference is that AUX commands usually perform some sort of administrative
+ * task in the CPU and are retired in the dispatcher.
+ *
+ * For bind operations flags must have one of the KGSL_GPU_AUX_COMMAND_* flags
+ * set. If sync objects are attached KGSL_GPU_AUX_COMMAND_SYNC must be set.
+ * @cmdlist points to an array of &struct kgsl_gpu_aux_command_generic structs
+ * which in turn will have a pointer to a specific command type.
+ * @numcmds is the number of commands in the list and @cmdsize is the size
+ * of each entity in @cmdlist.
+ *
+ * If KGSL_GPU_AUX_COMMAND_SYNC is specified @synclist will point to an array of
+ * &struct kgsl_command_syncpoint items in the same fashion as a GPU hardware
+ * command. @numsyncs and @syncsize describe the list.
+ *
+ * @context_id is the context that is submitting the command and @timestamp
+ * contains the timestamp for the operation.
+ */
+struct kgsl_gpu_aux_command {
+	__u64 flags;
+	__u64 cmdlist;
+	__u32 cmdsize;
+	__u32 numcmds;
+	__u64 synclist;
+	__u32 syncsize;
+	__u32 numsyncs;
+	__u32 context_id;
+	__u32 timestamp;
+};
+
+#define IOCTL_KGSL_GPU_AUX_COMMAND \
+	_IOWR(KGSL_IOC_TYPE, 0x57, struct kgsl_gpu_aux_command)
+
+/**
+ * struct kgsl_timeline_create - Argument for IOCTL_KGSL_TIMELINE_CREATE
+ * @seqno: Initial sequence number for the timeline
+ * @id: Timeline identifier [out]
+ *
+ * Create a new semaphore timeline and return the identifier in @id.
+ * The identifier is global for the device and can be used to
+ * identify the timeline in all subsequent commands.
+ */
+struct kgsl_timeline_create {
+	__u64 seqno;
+	__u32 id;
+/* private: padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define IOCTL_KGSL_TIMELINE_CREATE \
+	_IOWR(KGSL_IOC_TYPE, 0x58, struct kgsl_timeline_create)
+
+/**
+ * struct kgsl_timeline_val - A container to store a timeline/sequence number
+ * pair.
+ * @seqno: Sequence number to signal/query
+ * @timeline: The timeline identifier to signal/query
+ *
+ * A container to store a timeline/seqno pair used by the query and signal
+ * ioctls.
+ */
+struct kgsl_timeline_val {
+	__u64 seqno;
+	__u32 timeline;
+/* private: padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define KGSL_TIMELINE_WAIT_ALL 1
+#define KGSL_TIMELINE_WAIT_ANY 2
+
+/**
+ * struct kgsl_timeline_wait - Argument for IOCTL_KGSL_TIMELINE_WAIT
+ * @tv_sec: Number of seconds to wait for the signal
+ * @tv_nsec: Number of nanoseconds to wait for the signal
+ * @timelines: Address of an array of &struct kgsl_timeline_val entries
+ * @count: Number of entries in @timeline
+ * @timelines_size: Size of each entry in @timelines
+ * @flags: One of KGSL_TIMELINE_WAIT_ALL or KGSL_TIMELINE_WAIT_ANY
+ *
+ * Wait for the timelines listed in @timelines to be signaled. If @flags is
+ * equal to KGSL_TIMELINE_WAIT_ALL then wait for all timelines or if
+ * KGSL_TIMELINE_WAIT_ANY is specified then wait for any of the timelines to
+ * signal. @tv_sec and @tv_nsec indicates the number of seconds and nanoseconds
+ * that the process should be blocked waiting for the signal.
+ */
+struct kgsl_timeline_wait {
+	__s64 tv_sec;
+	__s64 tv_nsec;
+	__u64 timelines;
+	__u32 count;
+	__u32 timelines_size;
+	__u32 flags;
+/* private: padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define IOCTL_KGSL_TIMELINE_WAIT \
+	_IOW(KGSL_IOC_TYPE, 0x59, struct kgsl_timeline_wait)
+
+#define IOCTL_KGSL_TIMELINE_QUERY \
+	_IOWR(KGSL_IOC_TYPE, 0x5A, struct kgsl_timeline_val)
+
+/**
+ * struct kgsl_timeline_signal - argument for IOCTL_KGSL_TIMELINE_SIGNAL
+ * @timelines: Address of an array of &struct kgsl_timeline_val entries
+ * @count: Number of entries in @timelines
+ * @timelines_size: Size of each entry in @timelines
+ *
+ * Signal an array of timelines of type @struct kgsl_timeline_val.
+ */
+struct kgsl_timeline_signal {
+	__u64 timelines;
+	__u32 count;
+	__u32 timelines_size;
+};
+
+#define IOCTL_KGSL_TIMELINE_SIGNAL \
+	_IOW(KGSL_IOC_TYPE, 0x5B, struct kgsl_timeline_signal)
+
+/**
+ * struct kgsl_timeline_fence_get - argument for IOCTL_KGSL_TIMELINE_FENCE_GET
+ * @seqno: Sequence number for the fence
+ * @timeline: Timeline to create the fence on
+ * @handle: Contains the fence fd for a successful operation [out]
+ *
+ * Create a sync file descriptor for the seqnum on the timeline and return it in
+ * @handle.  Can be polled and queried just like any other sync file descriptor
+ */
+struct kgsl_timeline_fence_get {
+	__u64 seqno;
+	__u32 timeline;
+	int handle;
+};
+
+#define IOCTL_KGSL_TIMELINE_FENCE_GET \
+	_IOWR(KGSL_IOC_TYPE, 0x5C, struct kgsl_timeline_fence_get)
+/**
+ * IOCTL_KGSL_TIMELINE_DESTROY takes a u32 identifier for the timeline to
+ * destroy
+ */
+#define IOCTL_KGSL_TIMELINE_DESTROY _IOW(KGSL_IOC_TYPE, 0x5D, __u32)
+
+/**
+ * struct kgsl_gpu_aux_command_timeline - An aux command for timeline signals
+ * @timelines: An array of &struct kgsl_timeline_val elements
+ * @count: The number of entries in @timelines
+ * @timelines_size: The size of each element in @timelines
+ *
+ * An aux command for timeline signals that can be pointed to by
+ * &struct kgsl_gpu_aux_command_generic when the type is
+ * KGSL_GPU_AUX_COMMAND_TIMELINE.
+ */
+struct kgsl_gpu_aux_command_timeline {
+	__u64 timelines;
+	__u32 count;
+	__u32 timelines_size;
+};
+
+/* Macros for fault type used in kgsl_fault structure */
+#define KGSL_FAULT_TYPE_NO_FAULT    0
+#define KGSL_FAULT_TYPE_PAGEFAULT   1
+#define KGSL_FAULT_TYPE_MAX         2
+
+/* Macros to be used in kgsl_pagefault_report structure */
+#define KGSL_PAGEFAULT_TYPE_NONE                  0
+#define KGSL_PAGEFAULT_TYPE_READ                  (1 << 0)
+#define KGSL_PAGEFAULT_TYPE_WRITE                 (1 << 1)
+#define KGSL_PAGEFAULT_TYPE_TRANSLATION           (1 << 2)
+#define KGSL_PAGEFAULT_TYPE_PERMISSION            (1 << 3)
+#define KGSL_PAGEFAULT_TYPE_EXTERNAL              (1 << 4)
+#define KGSL_PAGEFAULT_TYPE_TRANSACTION_STALLED   (1 << 5)
+
+/**
+ * struct kgsl_pagefault_report - Descriptor for each page fault
+ * @fault_addr: page fault address
+ * @fault_type: type of page fault
+ *
+ * Contains information about supported GPU page fault.
+ * Supported fault type: KGSL_PAGEFAULT_TYPE_*
+ */
+struct kgsl_pagefault_report {
+	__u64 fault_addr;
+	/* private: reserved for future use */
+	__u64 reserved[2];
+	__u32 fault_type;
+	/* private: padding for 64 bit compatibility */
+	__u32 __pad;
+};
+
+/**
+ * struct kgsl_fault - Descriptor for each GPU fault type
+ * @fault: User memory pointer to list of specific fault type
+ * @type: Type of gpu fault
+ * @count: Number of entries in @fault
+ * @size: Size of each entry in @fault in bytes
+ *
+ * Contains information about each GPU fault type. If user passes 0 for all the fields, KGSL
+ * will return the @count and @type of fault. Based on this, user can allocate a buffer for
+ * specific fault type, fill the @fault and specify the structure size of type specific fault
+ * in @size. User can walk through @fault list to parse the fault type specific information.
+ *
+ * Supported type: KGSL_FAULT_TYPE_*
+ */
+struct kgsl_fault {
+	__u64 fault;
+	__u32 type;
+	__u32 count;
+	__u32 size;
+	/* private: padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+/**
+ * struct kgsl_fault_report - Container for list of GPU faults
+ * @faultlist: User memory pointer to list of fault descriptor &struct kgsl_fault
+ * @faultnents: Number of entries in @faultlist. Each entry corresponds to a fault type i.e.
+ * KGSL_FAULT_TYPE_*
+ * @faultsize: Size of each entry in @faultlist in bytes
+ * @context_id: ID of a KGSL context
+ *
+ * Returns a list of GPU faults for a context identified by @context_id. If the user specifies
+ * @context_id only, then KGSL will set the @faultnents to the number of fault types it has
+ * for that context.
+ *
+ * User is expected to allocate an array of @struct kgsl_fault with @faultnents number of entries
+ * and fill the @faultlist field. On calling @IOCTL_KGSL_GET_FAULT_REPORT, KGSL will return the
+ * type and count for each fault. Based on this, user needs to update the @kgsl_fault structure.
+ * Then, it should call the @IOCTL_KGSL_GET_FAULT_REPORT again for kernel to fill the fault
+ * information.
+ */
+struct kgsl_fault_report {
+	__u64 faultlist;
+	__u32 faultnents;
+	__u32 faultsize;
+	__u32 context_id;
+	/* private: padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define IOCTL_KGSL_GET_FAULT_REPORT \
+	_IOWR(KGSL_IOC_TYPE, 0x5E, struct kgsl_fault_report)
+
+/**
+ * struct kgsl_recurring_object - Argument for IOCTL_KGSL_RECURRING_COMMAND
+ * @flags: Current flags for the object
+ * @cmdlist: List of kgsl_command_objects for submission
+ * @cmd_size: Size of kgsl_command_objects structure
+ * @numcmds: Number of kgsl_command_objects in command list
+ * @objlist: List of kgsl_command_objects for tracking
+ * @obj_size: Size of kgsl_command_objects structure
+ * @numobjs: Number of kgsl_command_objects in object list
+ * @context_id: Context ID submitting the kgsl_recurring_command
+ */
+struct kgsl_recurring_command {
+	__u64 flags;
+	__u64 __user cmdlist;
+	__u32 cmdsize;
+	__u32 numcmds;
+	__u64 __user objlist;
+	__u32 objsize;
+	__u32 numobjs;
+	__u32 context_id;
+	/* private: Padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define IOCTL_KGSL_RECURRING_COMMAND \
+	_IOWR(KGSL_IOC_TYPE, 0x5F, struct kgsl_recurring_command)
+
+enum kgsl_calibrated_time_domain {
+	KGSL_CALIBRATED_TIME_DOMAIN_DEVICE = 0,
+	KGSL_CALIBRATED_TIME_DOMAIN_MONOTONIC = 1,
+	KGSL_CALIBRATED_TIME_DOMAIN_MONOTONIC_RAW = 2,
+	KGSL_CALIBRATED_TIME_DOMAIN_MAX,
+};
+
+/**
+ * struct kgsl_read_calibrated_timestamps - Argument for IOCTL_KGSL_READ_CALIBRATED_TIMESTAMPS
+ * @sources: List of time domains of type enum kgsl_calibrated_time_domain
+ * @ts: List of calibrated timestamps
+ * @deviation: Deviation between timestamp samples in nsecs
+ * @count: Number of timestamps to read
+ *
+ * Returns a list of calibrated timestamps corresponding to an input list of time domains to
+ * query.
+ */
+struct kgsl_read_calibrated_timestamps {
+	__u64 __user sources;
+	__u64 __user ts;
+	__u64 deviation;
+	__u32 count;
+	/* private: Padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define IOCTL_KGSL_READ_CALIBRATED_TIMESTAMPS \
+	_IOWR(KGSL_IOC_TYPE, 0x60, struct kgsl_read_calibrated_timestamps)
+
+#endif /* _UAPI_MSM_KGSL_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl.c
@@ -0,0 +1,5356 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2008-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <uapi/linux/sched/types.h>
+#include <linux/bitfield.h>
+#include <linux/ctype.h>
+#include <linux/debugfs.h>
+#include <linux/delay.h>
+#include <linux/dma-buf.h>
+#include <linux/dma-map-ops.h>
+#include <linux/fdtable.h>
+#include <linux/io.h>
+#include <linux/mem-buf.h>
+#include <linux/mman.h>
+#include <linux/mm_types.h>
+#include <linux/msm_kgsl.h>
+#include <linux/msm_sysstats.h>
+#include <linux/of.h>
+#include <linux/of_fdt.h>
+#include <linux/pm_runtime.h>
+#include <linux/security.h>
+#include <linux/sort.h>
+#include <linux/string_helpers.h>
+#include <soc/qcom/of_common.h>
+#include <soc/qcom/secure_buffer.h>
+
+#include "kgsl_compat.h"
+#include "kgsl_debugfs.h"
+#include "kgsl_device.h"
+#include "kgsl_eventlog.h"
+#include "kgsl_mmu.h"
+#include "kgsl_pool.h"
+#include "kgsl_reclaim.h"
+#include "kgsl_sync.h"
+#include "kgsl_sysfs.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+/* Instantiate tracepoints */
+#define CREATE_TRACE_POINTS
+#include "kgsl_power_trace.h"
+
+#ifndef arch_mmap_check
+#define arch_mmap_check(addr, len, flags)	(0)
+#endif
+
+#ifndef pgprot_writebackcache
+#define pgprot_writebackcache(_prot)	(_prot)
+#endif
+
+#ifndef pgprot_writethroughcache
+#define pgprot_writethroughcache(_prot)	(_prot)
+#endif
+
+#if defined(CONFIG_ARM64) || defined(CONFIG_ARM_LPAE)
+#define KGSL_DMA_BIT_MASK	DMA_BIT_MASK(64)
+#else
+#define KGSL_DMA_BIT_MASK	DMA_BIT_MASK(32)
+#endif
+
+/* List of dmabufs mapped */
+static LIST_HEAD(kgsl_dmabuf_list);
+static DEFINE_SPINLOCK(kgsl_dmabuf_lock);
+
+struct dmabuf_list_entry {
+	struct page *firstpage;
+	struct list_head node;
+	struct list_head dmabuf_list;
+};
+
+struct kgsl_dma_buf_meta {
+	struct kgsl_mem_entry *entry;
+	struct dma_buf_attachment *attach;
+	struct dma_buf *dmabuf;
+	struct sg_table *table;
+	struct dmabuf_list_entry *dle;
+	struct list_head node;
+};
+
+static inline struct kgsl_pagetable *_get_memdesc_pagetable(
+		struct kgsl_pagetable *pt, struct kgsl_mem_entry *entry)
+{
+	/* if a secured buffer, map it to secure global pagetable */
+	if (kgsl_memdesc_is_secured(&entry->memdesc))
+		return pt->mmu->securepagetable;
+
+	return pt;
+}
+
+static void kgsl_mem_entry_detach_process(struct kgsl_mem_entry *entry);
+
+static const struct vm_operations_struct kgsl_gpumem_vm_ops;
+
+/*
+ * The memfree list contains the last N blocks of memory that have been freed.
+ * On a GPU fault we walk the list to see if the faulting address had been
+ * recently freed and print out a message to that effect
+ */
+
+#define MEMFREE_ENTRIES 512
+
+static DEFINE_SPINLOCK(memfree_lock);
+
+struct memfree_entry {
+	pid_t ptname;
+	uint64_t gpuaddr;
+	uint64_t size;
+	pid_t pid;
+	uint64_t flags;
+};
+
+static struct {
+	struct memfree_entry *list;
+	int head;
+	int tail;
+} memfree;
+
+static inline bool match_memfree_addr(struct memfree_entry *entry,
+		pid_t ptname, uint64_t gpuaddr)
+{
+	return ((entry->ptname == ptname) &&
+		(entry->size > 0) &&
+		(gpuaddr >= entry->gpuaddr &&
+			 gpuaddr < (entry->gpuaddr + entry->size)));
+}
+int kgsl_memfree_find_entry(pid_t ptname, uint64_t *gpuaddr,
+	uint64_t *size, uint64_t *flags, pid_t *pid)
+{
+	int ptr;
+
+	if (memfree.list == NULL)
+		return 0;
+
+	spin_lock(&memfree_lock);
+
+	ptr = memfree.head - 1;
+	if (ptr < 0)
+		ptr = MEMFREE_ENTRIES - 1;
+
+	/* Walk backwards through the list looking for the last match  */
+	while (ptr != memfree.tail) {
+		struct memfree_entry *entry = &memfree.list[ptr];
+
+		if (match_memfree_addr(entry, ptname, *gpuaddr)) {
+			*gpuaddr = entry->gpuaddr;
+			*flags = entry->flags;
+			*size = entry->size;
+			*pid = entry->pid;
+
+			spin_unlock(&memfree_lock);
+			return 1;
+		}
+
+		ptr = ptr - 1;
+
+		if (ptr < 0)
+			ptr = MEMFREE_ENTRIES - 1;
+	}
+
+	spin_unlock(&memfree_lock);
+	return 0;
+}
+
+static void kgsl_memfree_purge(struct kgsl_pagetable *pagetable,
+		uint64_t gpuaddr, uint64_t size)
+{
+	pid_t ptname = pagetable ? pagetable->name : 0;
+	int i;
+
+	if (memfree.list == NULL)
+		return;
+
+	spin_lock(&memfree_lock);
+
+	for (i = 0; i < MEMFREE_ENTRIES; i++) {
+		struct memfree_entry *entry = &memfree.list[i];
+
+		if (entry->ptname != ptname || entry->size == 0)
+			continue;
+
+		if (gpuaddr > entry->gpuaddr &&
+			gpuaddr < entry->gpuaddr + entry->size) {
+			/* truncate the end of the entry */
+			entry->size = gpuaddr - entry->gpuaddr;
+		} else if (gpuaddr <= entry->gpuaddr) {
+			if (gpuaddr + size > entry->gpuaddr &&
+				gpuaddr + size < entry->gpuaddr + entry->size)
+				/* Truncate the beginning of the entry */
+				entry->gpuaddr = gpuaddr + size;
+			else if (gpuaddr + size >= entry->gpuaddr + entry->size)
+				/* Remove the entire entry */
+				entry->size = 0;
+		}
+	}
+	spin_unlock(&memfree_lock);
+}
+
+static void kgsl_memfree_add(pid_t pid, pid_t ptname, uint64_t gpuaddr,
+		uint64_t size, uint64_t flags)
+
+{
+	struct memfree_entry *entry;
+
+	if (memfree.list == NULL)
+		return;
+
+	spin_lock(&memfree_lock);
+
+	entry = &memfree.list[memfree.head];
+
+	entry->pid = pid;
+	entry->ptname = ptname;
+	entry->gpuaddr = gpuaddr;
+	entry->size = size;
+	entry->flags = flags;
+
+	memfree.head = (memfree.head + 1) % MEMFREE_ENTRIES;
+
+	if (memfree.head == memfree.tail)
+		memfree.tail = (memfree.tail + 1) % MEMFREE_ENTRIES;
+
+	spin_unlock(&memfree_lock);
+}
+
+int kgsl_readtimestamp(struct kgsl_device *device, void *priv,
+		enum kgsl_timestamp_type type, unsigned int *timestamp)
+{
+	if (device)
+		return device->ftbl->readtimestamp(device, priv, type,
+			timestamp);
+	return -EINVAL;
+
+}
+
+const char *kgsl_context_type(int type)
+{
+	if (type == KGSL_CONTEXT_TYPE_GL)
+		return "GL";
+	else if (type == KGSL_CONTEXT_TYPE_CL)
+		return "CL";
+	else if (type == KGSL_CONTEXT_TYPE_C2D)
+		return "C2D";
+	else if (type == KGSL_CONTEXT_TYPE_RS)
+		return "RS";
+	else if (type == KGSL_CONTEXT_TYPE_VK)
+		return "VK";
+
+	return "ANY";
+}
+
+static struct kgsl_mem_entry *kgsl_mem_entry_create(void)
+{
+	struct kgsl_mem_entry *entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+
+	if (entry != NULL) {
+		kref_init(&entry->refcount);
+		/* put this ref in userspace memory alloc and map ioctls */
+		kref_get(&entry->refcount);
+		atomic_set(&entry->map_count, 0);
+		atomic_set(&entry->vbo_count, 0);
+	}
+
+	return entry;
+}
+
+static void add_dmabuf_list(struct kgsl_dma_buf_meta *metadata)
+{
+	struct kgsl_device *device = dev_get_drvdata(metadata->attach->dev);
+	struct dmabuf_list_entry *dle;
+	struct page *page;
+
+	/*
+	 * Get the first page. We will use it to identify the imported
+	 * buffer, since the same buffer can be mapped as different
+	 * mem entries.
+	 */
+	page = sg_page(metadata->table->sgl);
+
+	spin_lock(&kgsl_dmabuf_lock);
+
+	/* Go through the list to see if we imported this buffer before */
+	list_for_each_entry(dle, &kgsl_dmabuf_list, node) {
+		if (dle->firstpage == page) {
+			/* Add the dmabuf metadata to the list for this dle */
+			metadata->dle = dle;
+			list_add(&metadata->node, &dle->dmabuf_list);
+			spin_unlock(&kgsl_dmabuf_lock);
+			return;
+		}
+	}
+
+	/* This is a new buffer. Add a new entry for it */
+	dle = kzalloc(sizeof(*dle), GFP_ATOMIC);
+	if (dle) {
+		dle->firstpage = page;
+		INIT_LIST_HEAD(&dle->dmabuf_list);
+		list_add(&dle->node, &kgsl_dmabuf_list);
+		metadata->dle = dle;
+		list_add(&metadata->node, &dle->dmabuf_list);
+		kgsl_trace_gpu_mem_total(device,
+				 metadata->entry->memdesc.size);
+	}
+	spin_unlock(&kgsl_dmabuf_lock);
+}
+
+static void remove_dmabuf_list(struct kgsl_dma_buf_meta *metadata)
+{
+	struct kgsl_device *device = dev_get_drvdata(metadata->attach->dev);
+	struct dmabuf_list_entry *dle = metadata->dle;
+
+	if (!dle)
+		return;
+
+	spin_lock(&kgsl_dmabuf_lock);
+	list_del(&metadata->node);
+	if (list_empty(&dle->dmabuf_list)) {
+		list_del(&dle->node);
+		kfree(dle);
+		kgsl_trace_gpu_mem_total(device,
+				-(metadata->entry->memdesc.size));
+	}
+	spin_unlock(&kgsl_dmabuf_lock);
+}
+
+#ifdef CONFIG_DMA_SHARED_BUFFER
+static void kgsl_destroy_ion(struct kgsl_memdesc *memdesc)
+{
+	struct kgsl_mem_entry *entry = container_of(memdesc,
+		struct kgsl_mem_entry, memdesc);
+	struct kgsl_dma_buf_meta *metadata = entry->priv_data;
+
+	if (memdesc->priv & KGSL_MEMDESC_MAPPED)
+		return;
+
+	if (metadata != NULL) {
+		remove_dmabuf_list(metadata);
+		dma_buf_unmap_attachment(metadata->attach, memdesc->sgt, DMA_BIDIRECTIONAL);
+		dma_buf_detach(metadata->dmabuf, metadata->attach);
+		dma_buf_put(metadata->dmabuf);
+		kfree(metadata);
+	}
+
+	memdesc->sgt = NULL;
+}
+
+static const struct kgsl_memdesc_ops kgsl_dmabuf_ops = {
+	.free = kgsl_destroy_ion,
+	.put_gpuaddr = kgsl_unmap_and_put_gpuaddr,
+};
+#endif
+
+static void kgsl_destroy_anon(struct kgsl_memdesc *memdesc)
+{
+	int i = 0, j;
+	struct scatterlist *sg;
+	struct page *page;
+
+	if (memdesc->priv & KGSL_MEMDESC_MAPPED)
+		return;
+
+	for_each_sg(memdesc->sgt->sgl, sg, memdesc->sgt->nents, i) {
+		page = sg_page(sg);
+		for (j = 0; j < (sg->length >> PAGE_SHIFT); j++) {
+
+			/*
+			 * Mark the page in the scatterlist as dirty if they
+			 * were writable by the GPU.
+			 */
+			if (!(memdesc->flags & KGSL_MEMFLAGS_GPUREADONLY))
+				set_page_dirty_lock(nth_page(page, j));
+
+			/*
+			 * Put the page reference taken using get_user_pages
+			 * during memdesc_sg_virt.
+			 */
+			put_page(nth_page(page, j));
+		}
+	}
+
+	sg_free_table(memdesc->sgt);
+	kfree(memdesc->sgt);
+	memdesc->sgt = NULL;
+}
+
+void
+kgsl_mem_entry_destroy(struct kref *kref)
+{
+	struct kgsl_mem_entry *entry = container_of(kref,
+						    struct kgsl_mem_entry,
+						    refcount);
+	unsigned int memtype;
+
+	if (entry == NULL)
+		return;
+
+	/* pull out the memtype before the flags get cleared */
+	memtype = kgsl_memdesc_usermem_type(&entry->memdesc);
+
+	/*
+	 * VBO allocations at gpumem_alloc_vbo_entry are not added into stats
+	 * (using kgsl_process_add_stats) so do not subtract here. For all other
+	 * allocations subtract before freeing memdesc
+	 */
+	if (!(entry->memdesc.flags & KGSL_MEMFLAGS_VBO))
+		atomic64_sub(entry->memdesc.size, &entry->priv->stats[memtype].cur);
+
+	/* Detach from process list */
+	kgsl_mem_entry_detach_process(entry);
+
+	if (memtype != KGSL_MEM_ENTRY_KERNEL)
+		atomic_long_sub(entry->memdesc.size,
+			&kgsl_driver.stats.mapped);
+
+	kgsl_sharedmem_free(&entry->memdesc);
+
+	kfree(entry);
+}
+
+/* Scheduled by kgsl_mem_entry_destroy_deferred() */
+static void _deferred_destroy(struct work_struct *work)
+{
+	struct kgsl_mem_entry *entry =
+		container_of(work, struct kgsl_mem_entry, work);
+
+	kgsl_mem_entry_destroy(&entry->refcount);
+}
+
+void kgsl_mem_entry_destroy_deferred(struct kref *kref)
+{
+	struct kgsl_mem_entry *entry =
+		container_of(kref, struct kgsl_mem_entry, refcount);
+
+	INIT_WORK(&entry->work, _deferred_destroy);
+	queue_work(kgsl_driver.lockless_workqueue, &entry->work);
+}
+
+/* Commit the entry to the process so it can be accessed by other operations */
+static void kgsl_mem_entry_commit_process(struct kgsl_mem_entry *entry)
+{
+	if (!entry)
+		return;
+
+	spin_lock(&entry->priv->mem_lock);
+	idr_replace(&entry->priv->mem_idr, entry, entry->id);
+	spin_unlock(&entry->priv->mem_lock);
+}
+
+static int kgsl_mem_entry_attach_to_process(struct kgsl_device *device,
+		struct kgsl_process_private *process,
+		struct kgsl_mem_entry *entry)
+{
+	struct kgsl_memdesc *memdesc = &entry->memdesc;
+	int ret, id;
+
+	ret = kgsl_process_private_get(process);
+	if (!ret)
+		return -EBADF;
+
+	/* Assign a gpu address */
+	if (!kgsl_memdesc_use_cpu_map(memdesc) &&
+		kgsl_mmu_get_mmutype(device) != KGSL_MMU_TYPE_NONE) {
+		struct kgsl_pagetable *pagetable;
+
+		pagetable = kgsl_memdesc_is_secured(memdesc) ?
+			device->mmu.securepagetable : process->pagetable;
+
+		ret = kgsl_mmu_get_gpuaddr(pagetable, memdesc);
+		if (ret) {
+			kgsl_process_private_put(process);
+			return ret;
+		}
+	}
+
+	idr_preload(GFP_KERNEL);
+	spin_lock(&process->mem_lock);
+	/* Allocate the ID but don't attach the pointer just yet */
+	id = idr_alloc(&process->mem_idr, NULL, 1, 0, GFP_NOWAIT);
+	spin_unlock(&process->mem_lock);
+	idr_preload_end();
+
+	if (id < 0) {
+		if (!kgsl_memdesc_use_cpu_map(memdesc))
+			kgsl_mmu_put_gpuaddr(memdesc->pagetable, memdesc);
+		kgsl_process_private_put(process);
+		return id;
+	}
+
+	entry->id = id;
+	entry->priv = process;
+
+	return 0;
+}
+
+/*
+ * Attach the memory object to a process by (possibly) getting a GPU address and
+ * (possibly) mapping it
+ */
+static int kgsl_mem_entry_attach_and_map(struct kgsl_device *device,
+		struct kgsl_process_private *process,
+		struct kgsl_mem_entry *entry)
+{
+	struct kgsl_memdesc *memdesc = &entry->memdesc;
+	int ret;
+
+	ret = kgsl_mem_entry_attach_to_process(device, process, entry);
+	if (ret)
+		return ret;
+
+	if (memdesc->gpuaddr) {
+		/*
+		 * Map the memory if a GPU address is already assigned, either
+		 * through kgsl_mem_entry_attach_to_process() or via some other
+		 * SVM process
+		 */
+		ret = kgsl_mmu_map(memdesc->pagetable, memdesc);
+
+		if (ret) {
+			kgsl_mem_entry_detach_process(entry);
+			return ret;
+		}
+	}
+
+	kgsl_memfree_purge(memdesc->pagetable, memdesc->gpuaddr,
+		memdesc->size);
+
+	return ret;
+}
+
+/* Detach a memory entry from a process and unmap it from the MMU */
+static void kgsl_mem_entry_detach_process(struct kgsl_mem_entry *entry)
+{
+	if (entry == NULL)
+		return;
+
+	/*
+	 * First remove the entry from mem_idr list
+	 * so that no one can operate on obsolete values
+	 */
+	spin_lock(&entry->priv->mem_lock);
+	if (entry->id != 0)
+		idr_remove(&entry->priv->mem_idr, entry->id);
+	entry->id = 0;
+
+	spin_unlock(&entry->priv->mem_lock);
+
+	kgsl_sharedmem_put_gpuaddr(&entry->memdesc);
+
+	if (entry->memdesc.priv & KGSL_MEMDESC_RECLAIMED)
+		atomic_sub(entry->memdesc.page_count,
+					&entry->priv->unpinned_page_count);
+
+	kgsl_process_private_put(entry->priv);
+
+	entry->priv = NULL;
+}
+
+#ifdef CONFIG_QCOM_KGSL_CONTEXT_DEBUG
+static void kgsl_context_debug_info(struct kgsl_device *device)
+{
+	struct kgsl_context *context;
+	struct kgsl_process_private *p;
+	int next;
+	/*
+	 * Keep an interval between consecutive logging to avoid
+	 * flooding the kernel log
+	 */
+	static DEFINE_RATELIMIT_STATE(_rs, 10 * HZ, 1);
+
+	if (!__ratelimit(&_rs))
+		return;
+
+	dev_info(device->dev, "KGSL active contexts:\n");
+	dev_info(device->dev, "pid      process         total    attached   detached\n");
+
+	read_lock(&kgsl_driver.proclist_lock);
+	read_lock(&device->context_lock);
+
+	list_for_each_entry(p, &kgsl_driver.process_list, list) {
+		int total_contexts = 0, num_detached = 0;
+
+		idr_for_each_entry(&device->context_idr, context, next) {
+			if (context->proc_priv == p) {
+				total_contexts++;
+				if (kgsl_context_detached(context))
+					num_detached++;
+			}
+		}
+
+		dev_info(device->dev, "%-8u %-15.15s %-8d %-10d %-10d\n",
+				pid_nr(p->pid), p->comm, total_contexts,
+				total_contexts - num_detached, num_detached);
+	}
+
+	read_unlock(&device->context_lock);
+	read_unlock(&kgsl_driver.proclist_lock);
+}
+#else
+static void kgsl_context_debug_info(struct kgsl_device *device)
+{
+}
+#endif
+
+/**
+ * kgsl_context_dump() - dump information about a draw context
+ * @device: KGSL device that owns the context
+ * @context: KGSL context to dump information about
+ *
+ * Dump specific information about the context to the kernel log.  Used for
+ * fence timeout callbacks
+ */
+void kgsl_context_dump(struct kgsl_context *context)
+{
+	struct kgsl_device *device;
+
+	if (_kgsl_context_get(context) == 0)
+		return;
+
+	device = context->device;
+
+	if (kgsl_context_detached(context)) {
+		dev_err(device->dev, "  context[%u]: context detached\n",
+			context->id);
+	} else if (device->ftbl->drawctxt_dump != NULL)
+		device->ftbl->drawctxt_dump(device, context);
+
+	kgsl_context_put(context);
+}
+
+/* Allocate a new context ID */
+static int _kgsl_get_context_id(struct kgsl_device *device)
+{
+	int id;
+
+	idr_preload(GFP_KERNEL);
+	write_lock(&device->context_lock);
+	/* Allocate the slot but don't put a pointer in it yet */
+	id = idr_alloc(&device->context_idr, NULL, 1,
+		KGSL_MEMSTORE_MAX, GFP_NOWAIT);
+	write_unlock(&device->context_lock);
+	idr_preload_end();
+
+	return id;
+}
+
+/**
+ * kgsl_context_init() - helper to initialize kgsl_context members
+ * @dev_priv: the owner of the context
+ * @context: the newly created context struct, should be allocated by
+ * the device specific drawctxt_create function.
+ *
+ * This is a helper function for the device specific drawctxt_create
+ * function to initialize the common members of its context struct.
+ * If this function succeeds, reference counting is active in the context
+ * struct and the caller should kgsl_context_put() it on error.
+ * If it fails, the caller should just free the context structure
+ * it passed in.
+ */
+int kgsl_context_init(struct kgsl_device_private *dev_priv,
+			struct kgsl_context *context)
+{
+	struct kgsl_device *device = dev_priv->device;
+	int ret = 0, id;
+	struct kgsl_process_private  *proc_priv = dev_priv->process_priv;
+
+	/*
+	 * Read and increment the context count under lock to make sure
+	 * no process goes beyond the specified context limit.
+	 */
+	spin_lock(&proc_priv->ctxt_count_lock);
+	if (atomic_read(&proc_priv->ctxt_count) > KGSL_MAX_CONTEXTS_PER_PROC) {
+		dev_err(device->dev,
+			     "Per process context limit reached for pid %u\n",
+			     pid_nr(dev_priv->process_priv->pid));
+		spin_unlock(&proc_priv->ctxt_count_lock);
+		kgsl_context_debug_info(device);
+		return -ENOSPC;
+	}
+
+	atomic_inc(&proc_priv->ctxt_count);
+	spin_unlock(&proc_priv->ctxt_count_lock);
+
+	id = _kgsl_get_context_id(device);
+	if (id == -ENOSPC) {
+		/*
+		 * Before declaring that there are no contexts left try
+		 * flushing the event worker just in case there are
+		 * detached contexts waiting to finish
+		 */
+
+		kthread_flush_worker(device->events_worker);
+		id = _kgsl_get_context_id(device);
+	}
+
+	if (id < 0) {
+		if (id == -ENOSPC) {
+			dev_warn(device->dev,
+				      "cannot have more than %zu contexts due to memstore limitation\n",
+				      KGSL_MEMSTORE_MAX);
+			kgsl_context_debug_info(device);
+		}
+		atomic_dec(&proc_priv->ctxt_count);
+		return id;
+	}
+
+	context->id = id;
+
+	mutex_init(&context->fault_lock);
+	INIT_LIST_HEAD(&context->faults);
+	kref_init(&context->refcount);
+	/*
+	 * Get a refernce to the process private so its not destroyed, until
+	 * the context is destroyed. This will also prevent the pagetable
+	 * from being destroyed
+	 */
+	if (!kgsl_process_private_get(dev_priv->process_priv)) {
+		ret = -EBADF;
+		goto out;
+	}
+	context->device = dev_priv->device;
+	context->dev_priv = dev_priv;
+	context->proc_priv = dev_priv->process_priv;
+	context->tid = task_pid_nr(current);
+
+	ret = kgsl_sync_timeline_create(context);
+	if (ret) {
+		kgsl_process_private_put(dev_priv->process_priv);
+		goto out;
+	}
+
+	kgsl_add_event_group(device, &context->events, context,
+		kgsl_readtimestamp, context, "context-%d", id);
+
+out:
+	if (ret) {
+		atomic_dec(&proc_priv->ctxt_count);
+		write_lock(&device->context_lock);
+		idr_remove(&dev_priv->device->context_idr, id);
+		write_unlock(&device->context_lock);
+	}
+
+	return ret;
+}
+
+void kgsl_free_faults(struct kgsl_context *context)
+{
+	struct kgsl_fault_node *p, *tmp;
+
+	if (!(context->flags & KGSL_CONTEXT_FAULT_INFO))
+		return;
+
+	list_for_each_entry_safe(p, tmp, &context->faults, node) {
+		list_del(&p->node);
+		kfree(p->priv);
+		kfree(p);
+	}
+}
+
+/**
+ * kgsl_context_detach() - Release the "master" context reference
+ * @context: The context that will be detached
+ *
+ * This is called when a context becomes unusable, because userspace
+ * has requested for it to be destroyed. The context itself may
+ * exist a bit longer until its reference count goes to zero.
+ * Other code referencing the context can detect that it has been
+ * detached by checking the KGSL_CONTEXT_PRIV_DETACHED bit in
+ * context->priv.
+ */
+void kgsl_context_detach(struct kgsl_context *context)
+{
+	struct kgsl_device *device;
+
+	if (context == NULL)
+		return;
+
+	device = context->device;
+	device->ftbl->dequeue_recurring_cmd(device, context);
+
+	/*
+	 * Mark the context as detached to keep others from using
+	 * the context before it gets fully removed, and to make sure
+	 * we don't try to detach twice.
+	 */
+	if (test_and_set_bit(KGSL_CONTEXT_PRIV_DETACHED, &context->priv))
+		return;
+
+	trace_kgsl_context_detach(device, context);
+
+	context->device->ftbl->drawctxt_detach(context);
+
+	/*
+	 * Cancel all pending events after the device-specific context is
+	 * detached, to avoid possibly freeing memory while it is still
+	 * in use by the GPU.
+	 */
+	kgsl_cancel_events(device, &context->events);
+
+	/* Remove the event group from the list */
+	kgsl_del_event_group(device, &context->events);
+
+	kgsl_sync_timeline_detach(context->ktimeline);
+	kgsl_context_put(context);
+}
+
+void
+kgsl_context_destroy(struct kref *kref)
+{
+	struct kgsl_context *context = container_of(kref, struct kgsl_context,
+						    refcount);
+	struct kgsl_device *device = context->device;
+
+	trace_kgsl_context_destroy(device, context);
+
+	/*
+	 * It's not safe to destroy the context if it's not detached as GPU
+	 * may still be executing commands
+	 */
+	BUG_ON(!kgsl_context_detached(context));
+
+	kgsl_free_faults(context);
+	kgsl_sync_timeline_put(context->ktimeline);
+
+	write_lock(&device->context_lock);
+	if (context->id != KGSL_CONTEXT_INVALID) {
+
+		/* Clear the timestamps in the memstore during destroy */
+		kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, soptimestamp), 0);
+		kgsl_sharedmem_writel(device->memstore,
+			KGSL_MEMSTORE_OFFSET(context->id, eoptimestamp), 0);
+
+		/* clear device power constraint */
+		if (context->id == device->pwrctrl.constraint.owner_id) {
+			trace_kgsl_constraint(device,
+				device->pwrctrl.constraint.type,
+				device->pwrctrl.active_pwrlevel,
+				0);
+			device->pwrctrl.constraint.type = KGSL_CONSTRAINT_NONE;
+		}
+
+		atomic_dec(&context->proc_priv->ctxt_count);
+		idr_remove(&device->context_idr, context->id);
+		context->id = KGSL_CONTEXT_INVALID;
+	}
+	write_unlock(&device->context_lock);
+	kgsl_process_private_put(context->proc_priv);
+
+	device->ftbl->drawctxt_destroy(context);
+}
+
+struct kgsl_device *kgsl_get_device(int dev_idx)
+{
+	int i;
+	struct kgsl_device *ret = NULL;
+
+	mutex_lock(&kgsl_driver.devlock);
+
+	for (i = 0; i < ARRAY_SIZE(kgsl_driver.devp); i++) {
+		if (kgsl_driver.devp[i] && kgsl_driver.devp[i]->id == dev_idx) {
+			ret = kgsl_driver.devp[i];
+			break;
+		}
+	}
+
+	mutex_unlock(&kgsl_driver.devlock);
+	return ret;
+}
+
+static struct kgsl_device *kgsl_get_minor(int minor)
+{
+	struct kgsl_device *ret = NULL;
+
+	if (minor < 0 || minor >= ARRAY_SIZE(kgsl_driver.devp))
+		return NULL;
+
+	mutex_lock(&kgsl_driver.devlock);
+	ret = kgsl_driver.devp[minor];
+	mutex_unlock(&kgsl_driver.devlock);
+
+	return ret;
+}
+
+/**
+ * kgsl_check_timestamp() - return true if the specified timestamp is retired
+ * @device: Pointer to the KGSL device to check
+ * @context: Pointer to the context for the timestamp
+ * @timestamp: The timestamp to compare
+ */
+bool kgsl_check_timestamp(struct kgsl_device *device,
+	struct kgsl_context *context, unsigned int timestamp)
+{
+	unsigned int ts_processed;
+
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_RETIRED,
+		&ts_processed);
+
+	return (timestamp_cmp(ts_processed, timestamp) >= 0);
+}
+
+static void kgsl_work_period_release(struct kref *kref)
+{
+	struct gpu_work_period *wp = container_of(kref,
+			struct gpu_work_period, refcount);
+
+	spin_lock(&kgsl_driver.wp_list_lock);
+	if (!list_empty(&wp->list))
+		list_del_init(&wp->list);
+	spin_unlock(&kgsl_driver.wp_list_lock);
+
+	kfree(wp);
+}
+
+static void kgsl_put_work_period(struct gpu_work_period *wp)
+{
+	if (!IS_ERR_OR_NULL(wp))
+		kref_put(&wp->refcount, kgsl_work_period_release);
+}
+
+/**
+ * kgsl_destroy_process_private() - Cleanup function to free process private
+ * @kref: - Pointer to object being destroyed's kref struct
+ * Free struct object and all other resources attached to it.
+ * Since the function can be used when not all resources inside process
+ * private have been allocated, there is a check to (before each resource
+ * cleanup) see if the struct member being cleaned is in fact allocated or not.
+ * If the value is not NULL, resource is freed.
+ */
+static void kgsl_destroy_process_private(struct kref *kref)
+{
+	struct kgsl_process_private *private = container_of(kref,
+			struct kgsl_process_private, refcount);
+
+	kgsl_put_work_period(private->period);
+	/*
+	 * While removing sysfs entries, kernfs_mutex is held by sysfs apis. Since
+	 * it is a global fs mutex, sometimes it takes longer for kgsl to get hold
+	 * of the lock. Meanwhile, kgsl open thread may exhaust all its re-tries
+	 * and open can fail. To avoid this, remove sysfs entries inside process
+	 * mutex to avoid wasting re-tries when kgsl is waiting for kernfs mutex.
+	 */
+	mutex_lock(&kgsl_driver.process_mutex);
+
+	debugfs_remove_recursive(private->debug_root);
+	kobject_put(&private->kobj_memtype);
+	kobject_put(&private->kobj);
+
+	/* When using global pagetables, do not detach global pagetable */
+	if (private->pagetable->name != KGSL_MMU_GLOBAL_PT)
+		kgsl_mmu_detach_pagetable(private->pagetable);
+
+	/* Remove the process struct from the master list */
+	write_lock(&kgsl_driver.proclist_lock);
+	list_del(&private->list);
+	write_unlock(&kgsl_driver.proclist_lock);
+	mutex_unlock(&kgsl_driver.process_mutex);
+
+	kfree(private->cmdline);
+	put_pid(private->pid);
+	idr_destroy(&private->mem_idr);
+	idr_destroy(&private->syncsource_idr);
+
+	/* When using global pagetables, do not put global pagetable */
+	if (private->pagetable->name != KGSL_MMU_GLOBAL_PT)
+		kgsl_mmu_putpagetable(private->pagetable);
+
+	kfree(private);
+}
+
+void
+kgsl_process_private_put(struct kgsl_process_private *private)
+{
+	if (private)
+		kref_put(&private->refcount, kgsl_destroy_process_private);
+}
+
+/**
+ * kgsl_process_private_find() - Find the process associated with the specified
+ * name
+ * @name: pid_t of the process to search for
+ * Return the process struct for the given ID.
+ */
+struct kgsl_process_private *kgsl_process_private_find(pid_t pid)
+{
+	struct kgsl_process_private *p, *private = NULL;
+
+	read_lock(&kgsl_driver.proclist_lock);
+	list_for_each_entry(p, &kgsl_driver.process_list, list) {
+		if (pid_nr(p->pid) == pid) {
+			if (kgsl_process_private_get(p))
+				private = p;
+			break;
+		}
+	}
+	read_unlock(&kgsl_driver.proclist_lock);
+
+	return private;
+}
+
+void kgsl_work_period_update(struct kgsl_device *device,
+				  struct gpu_work_period *period, u64 active)
+{
+	spin_lock(&device->work_period_lock);
+	if (test_bit(KGSL_WORK_PERIOD, &period->flags)) {
+		period->active += active;
+		period->cmds++;
+	}
+	spin_unlock(&device->work_period_lock);
+}
+
+static void _defer_work_period_put(struct work_struct *work)
+{
+	struct gpu_work_period *wp =
+		container_of(work, struct gpu_work_period, defer_ws);
+
+	/* Put back the refcount that was taken in kgsl_drawobj_cmd_create() */
+	kgsl_put_work_period(wp);
+}
+
+#define KGSL_GPU_ID 1
+static void _log_gpu_work_events(struct work_struct *work)
+{
+	struct kgsl_device *device = container_of(work, struct kgsl_device,
+							work_period_ws);
+	struct gpu_work_period *wp;
+	u64 active_time;
+	bool restart = false;
+
+	spin_lock(&device->work_period_lock);
+	device->gpu_period.end = ktime_get_ns();
+
+	spin_lock(&kgsl_driver.wp_list_lock);
+	list_for_each_entry(wp, &kgsl_driver.wp_list, list) {
+		if (!test_bit(KGSL_WORK_PERIOD, &wp->flags))
+			continue;
+
+		/* Active time in XO cycles(19.2MHz), convert to nanoseconds */
+		active_time = wp->active * 10000;
+		do_div(active_time, 192);
+
+		/* Ensure active_time is within work period */
+		active_time = min_t(u64, active_time,
+			device->gpu_period.end - device->gpu_period.begin);
+		/*
+		 * Emit GPU work period events via a kernel tracepoint
+		 * to provide information to the Android OS about how
+		 * apps are using the GPU.
+		 */
+		if (active_time)
+			trace_gpu_work_period(KGSL_GPU_ID, wp->uid,
+					device->gpu_period.begin,
+					device->gpu_period.end,
+					active_time);
+		/* Reset gpu work period stats */
+		wp->active = 0;
+		wp->cmds = 0;
+		atomic_set(&wp->frames, 0);
+
+		/* make sure other CPUs see the update */
+		smp_wmb();
+
+		if (!atomic_read(&wp->active_cmds)) {
+			__clear_bit(KGSL_WORK_PERIOD, &wp->flags);
+			queue_work(kgsl_driver.lockless_workqueue, &wp->defer_ws);
+		} else {
+			restart = true;
+		}
+	}
+	spin_unlock(&kgsl_driver.wp_list_lock);
+
+	if (restart) {
+		/*
+		 * GPU work period duration (end time - begin time) must be at
+		 * most 1 second. The event for a period must be emitted within
+		 * 1 second of the end time of the period. Restart timer within
+		 * 1 second to emit gpu work period events.
+		 */
+		mod_timer(&device->work_period_timer,
+			  jiffies + msecs_to_jiffies(KGSL_WORK_PERIOD_MS));
+		device->gpu_period.begin = device->gpu_period.end;
+	} else {
+		memset(&device->gpu_period, 0, sizeof(device->gpu_period));
+		__clear_bit(KGSL_WORK_PERIOD, &device->flags);
+	}
+	spin_unlock(&device->work_period_lock);
+
+}
+
+static void kgsl_work_period_timer(struct timer_list *t)
+{
+	struct kgsl_device *device = from_timer(device, t, work_period_timer);
+
+	queue_work(kgsl_driver.lockless_workqueue, &device->work_period_ws);
+}
+
+static struct gpu_work_period *kgsl_get_work_period(uid_t uid)
+{
+	struct gpu_work_period *wp;
+
+	spin_lock(&kgsl_driver.wp_list_lock);
+	list_for_each_entry(wp, &kgsl_driver.wp_list, list) {
+		if ((uid == wp->uid) && kref_get_unless_zero(&wp->refcount)) {
+			spin_unlock(&kgsl_driver.wp_list_lock);
+			return wp;
+		}
+	}
+
+	wp = kzalloc(sizeof(*wp), GFP_ATOMIC);
+	if (!wp) {
+		spin_unlock(&kgsl_driver.wp_list_lock);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	kref_init(&wp->refcount);
+	wp->uid = uid;
+	INIT_WORK(&wp->defer_ws, _defer_work_period_put);
+	list_add(&wp->list, &kgsl_driver.wp_list);
+	spin_unlock(&kgsl_driver.wp_list_lock);
+
+	return wp;
+}
+
+static struct kgsl_process_private *kgsl_process_private_new(
+		struct kgsl_device *device)
+{
+	struct kgsl_process_private *private;
+	struct pid *cur_pid = get_task_pid(current->group_leader, PIDTYPE_PID);
+
+	/* Search in the process list */
+	list_for_each_entry(private, &kgsl_driver.process_list, list) {
+		if (private->pid == cur_pid) {
+			if (!kgsl_process_private_get(private)) {
+				/*
+				 * This will happen only if refcount is zero
+				 * i.e. destroy is triggered but didn't complete
+				 * yet. Return -EEXIST to indicate caller that
+				 * destroy is pending to allow caller to take
+				 * appropriate action.
+				 */
+				private = ERR_PTR(-EEXIST);
+			} else {
+				mutex_lock(&private->private_mutex);
+				private->fd_count++;
+				mutex_unlock(&private->private_mutex);
+			}
+
+			/*
+			 * We need to hold only one reference to the PID for
+			 * each process struct to avoid overflowing the
+			 * reference counter which can lead to use-after-free.
+			 */
+			put_pid(cur_pid);
+			return private;
+		}
+	}
+
+	/* Create a new object */
+	private = kzalloc(sizeof(struct kgsl_process_private), GFP_KERNEL);
+	if (private == NULL) {
+		put_pid(cur_pid);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	private->period = kgsl_get_work_period(current_uid().val);
+	if (IS_ERR(private->period)) {
+		int err = PTR_ERR(private->period);
+
+		kfree(private);
+		return ERR_PTR(err);
+	}
+
+	kref_init(&private->refcount);
+
+	private->fd_count = 1;
+	private->pid = cur_pid;
+	get_task_comm(private->comm, current->group_leader);
+	private->cmdline = kstrdup_quotable_cmdline(current, GFP_KERNEL);
+
+	spin_lock_init(&private->mem_lock);
+	spin_lock_init(&private->syncsource_lock);
+	spin_lock_init(&private->ctxt_count_lock);
+	mutex_init(&private->private_mutex);
+
+	idr_init(&private->mem_idr);
+	idr_init(&private->syncsource_idr);
+
+	kgsl_reclaim_proc_private_init(private);
+
+	/* Allocate a pagetable for the new process object */
+	private->pagetable = kgsl_mmu_getpagetable(&device->mmu, pid_nr(cur_pid));
+	if (IS_ERR(private->pagetable)) {
+		int err = PTR_ERR(private->pagetable);
+
+		kgsl_put_work_period(private->period);
+		idr_destroy(&private->mem_idr);
+		idr_destroy(&private->syncsource_idr);
+		put_pid(private->pid);
+
+		kfree(private);
+		private = ERR_PTR(err);
+		return private;
+	}
+
+	kgsl_process_init_sysfs(device, private);
+	kgsl_process_init_debugfs(private);
+	write_lock(&kgsl_driver.proclist_lock);
+	list_add(&private->list, &kgsl_driver.process_list);
+	write_unlock(&kgsl_driver.proclist_lock);
+
+	return private;
+}
+
+static void process_release_memory(struct kgsl_process_private *private)
+{
+	struct kgsl_mem_entry *entry;
+	int next = 0;
+
+	while (1) {
+		spin_lock(&private->mem_lock);
+		entry = idr_get_next(&private->mem_idr, &next);
+		if (entry == NULL) {
+			spin_unlock(&private->mem_lock);
+			break;
+		}
+		/*
+		 * If the free pending flag is not set it means that user space
+		 * did not free it's reference to this entry, in that case
+		 * free a reference to this entry, other references are from
+		 * within kgsl so they will be freed eventually by kgsl
+		 */
+		if (!entry->pending_free) {
+			entry->pending_free = 1;
+			spin_unlock(&private->mem_lock);
+			kgsl_mem_entry_put(entry);
+		} else {
+			spin_unlock(&private->mem_lock);
+		}
+		next = next + 1;
+	}
+}
+
+static void kgsl_process_private_close(struct kgsl_device_private *dev_priv,
+		struct kgsl_process_private *private)
+{
+	mutex_lock(&private->private_mutex);
+
+	if (--private->fd_count > 0) {
+		mutex_unlock(&private->private_mutex);
+		kgsl_process_private_put(private);
+		return;
+	}
+
+	/*
+	 * If this is the last file on the process garbage collect
+	 * any outstanding resources
+	 */
+	process_release_memory(private);
+
+	/* Release all syncsource objects from process private */
+	kgsl_syncsource_process_release_syncsources(private);
+
+	mutex_unlock(&private->private_mutex);
+
+	kgsl_process_private_put(private);
+}
+
+static struct kgsl_process_private *_process_private_open(
+		struct kgsl_device *device)
+{
+	struct kgsl_process_private *private;
+
+	mutex_lock(&kgsl_driver.process_mutex);
+	private = kgsl_process_private_new(device);
+	mutex_unlock(&kgsl_driver.process_mutex);
+
+	return private;
+}
+
+static struct kgsl_process_private *kgsl_process_private_open(
+		struct kgsl_device *device)
+{
+	struct kgsl_process_private *private;
+	int i;
+
+	private = _process_private_open(device);
+
+	/*
+	 * If we get error and error is -EEXIST that means previous process
+	 * private destroy is triggered but didn't complete. Retry creating
+	 * process private after sometime to allow previous destroy to complete.
+	 */
+	for (i = 0; (PTR_ERR_OR_ZERO(private) == -EEXIST) && (i < 50); i++) {
+		usleep_range(10, 100);
+		private = _process_private_open(device);
+	}
+
+	return private;
+}
+
+int kgsl_gpu_frame_count(pid_t pid, u64 *frame_count)
+{
+	struct kgsl_process_private *p;
+
+	if (!frame_count)
+		return -EINVAL;
+
+	p = kgsl_process_private_find(pid);
+	if (!p)
+		return -ENOENT;
+
+	*frame_count = atomic64_read(&p->frame_count);
+	kgsl_process_private_put(p);
+
+	return 0;
+}
+EXPORT_SYMBOL(kgsl_gpu_frame_count);
+
+int kgsl_add_rcu_notifier(struct notifier_block *nb)
+{
+	struct kgsl_device *device = kgsl_get_device(0);
+
+	if (!device)
+		return -ENODEV;
+
+	return srcu_notifier_chain_register(&device->nh, nb);
+}
+EXPORT_SYMBOL(kgsl_add_rcu_notifier);
+
+int kgsl_del_rcu_notifier(struct notifier_block *nb)
+{
+	struct kgsl_device *device = kgsl_get_device(0);
+
+	if (!device)
+		return -ENODEV;
+
+	return srcu_notifier_chain_unregister(&device->nh, nb);
+}
+EXPORT_SYMBOL(kgsl_del_rcu_notifier);
+
+static int kgsl_close_device(struct kgsl_device *device)
+{
+	int result = 0;
+
+	mutex_lock(&device->mutex);
+	if (device->open_count == 1)
+		result = device->ftbl->last_close(device);
+
+	/*
+	 * We must decrement the open_count after last_close() has finished.
+	 * This is because last_close() relinquishes device mutex while
+	 * waiting for active count to become 0. This opens up a window
+	 * where a new process can come in, see that open_count is 0, and
+	 * initiate a first_open(). This can potentially mess up the power
+	 * state machine. To avoid a first_open() from happening before
+	 * last_close() has finished, decrement the open_count after
+	 * last_close().
+	 */
+	device->open_count--;
+	mutex_unlock(&device->mutex);
+	return result;
+
+}
+
+static void device_release_contexts(struct kgsl_device_private *dev_priv)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_context *context;
+	int next = 0;
+	int result = 0;
+
+	while (1) {
+		read_lock(&device->context_lock);
+		context = idr_get_next(&device->context_idr, &next);
+
+		if (context == NULL) {
+			read_unlock(&device->context_lock);
+			break;
+		} else if (context->dev_priv == dev_priv) {
+			/*
+			 * Hold a reference to the context in case somebody
+			 * tries to put it while we are detaching
+			 */
+			result = _kgsl_context_get(context);
+		}
+		read_unlock(&device->context_lock);
+
+		if (result) {
+			kgsl_context_detach(context);
+			kgsl_context_put(context);
+			result = 0;
+		}
+
+		next = next + 1;
+	}
+}
+
+static int kgsl_release(struct inode *inodep, struct file *filep)
+{
+	struct kgsl_device_private *dev_priv = filep->private_data;
+	struct kgsl_device *device = dev_priv->device;
+	int result;
+
+	filep->private_data = NULL;
+
+	/* Release the contexts for the file */
+	device_release_contexts(dev_priv);
+
+	/* Close down the process wide resources for the file */
+	kgsl_process_private_close(dev_priv, dev_priv->process_priv);
+
+	/* Destroy the device-specific structure */
+	device->ftbl->device_private_destroy(dev_priv);
+
+	result = kgsl_close_device(device);
+	pm_runtime_put(&device->pdev->dev);
+
+	return result;
+}
+
+static int kgsl_open_device(struct kgsl_device *device)
+{
+	int result = 0;
+
+	mutex_lock(&device->mutex);
+	if (device->open_count == 0) {
+		result = device->ftbl->first_open(device);
+		if (result)
+			goto out;
+	}
+	device->open_count++;
+out:
+	mutex_unlock(&device->mutex);
+	return result;
+}
+
+static int kgsl_open(struct inode *inodep, struct file *filep)
+{
+	int result;
+	struct kgsl_device_private *dev_priv;
+	struct kgsl_device *device;
+	unsigned int minor = iminor(inodep);
+
+	device = kgsl_get_minor(minor);
+	if (device == NULL) {
+		pr_err("kgsl: No device found\n");
+		return -ENODEV;
+	}
+
+	result = pm_runtime_get_sync(&device->pdev->dev);
+	if (result < 0) {
+		dev_err(device->dev,
+			     "Runtime PM: Unable to wake up the device, rc = %d\n",
+			     result);
+		return result;
+	}
+	result = 0;
+
+	dev_priv = device->ftbl->device_private_create();
+	if (dev_priv == NULL) {
+		result = -ENOMEM;
+		goto err;
+	}
+
+	dev_priv->device = device;
+	filep->private_data = dev_priv;
+
+	result = kgsl_open_device(device);
+	if (result)
+		goto err;
+
+	/*
+	 * Get file (per process) private struct. This must be done
+	 * after the first start so that the global pagetable mappings
+	 * are set up before we create the per-process pagetable.
+	 */
+	dev_priv->process_priv = kgsl_process_private_open(device);
+	if (IS_ERR(dev_priv->process_priv)) {
+		result = PTR_ERR(dev_priv->process_priv);
+		kgsl_close_device(device);
+		goto err;
+	}
+
+err:
+	if (result) {
+		filep->private_data = NULL;
+		kfree(dev_priv);
+		pm_runtime_put(&device->pdev->dev);
+	}
+	return result;
+}
+
+#define GPUADDR_IN_MEMDESC(_val, _memdesc) \
+	(((_val) >= (_memdesc)->gpuaddr) && \
+	 ((_val) < ((_memdesc)->gpuaddr + (_memdesc)->size)))
+
+/**
+ * kgsl_sharedmem_find() - Find a gpu memory allocation
+ *
+ * @private: private data for the process to check.
+ * @gpuaddr: start address of the region
+ *
+ * Find a gpu allocation. Caller must kgsl_mem_entry_put()
+ * the returned entry when finished using it.
+ */
+struct kgsl_mem_entry * __must_check
+kgsl_sharedmem_find(struct kgsl_process_private *private, uint64_t gpuaddr)
+{
+	int id;
+	struct kgsl_mem_entry *entry, *ret = NULL;
+
+	if (!private)
+		return NULL;
+
+	if (!kgsl_mmu_gpuaddr_in_range(private->pagetable, gpuaddr, 0) &&
+		!kgsl_mmu_gpuaddr_in_range(
+			private->pagetable->mmu->securepagetable, gpuaddr, 0))
+		return NULL;
+
+	spin_lock(&private->mem_lock);
+	idr_for_each_entry(&private->mem_idr, entry, id) {
+		if (GPUADDR_IN_MEMDESC(gpuaddr, &entry->memdesc)) {
+			if (!entry->pending_free)
+				ret = kgsl_mem_entry_get(entry);
+			break;
+		}
+	}
+	spin_unlock(&private->mem_lock);
+
+	return ret;
+}
+
+static struct kgsl_mem_entry * __must_check
+kgsl_sharedmem_find_id_flags(struct kgsl_process_private *process,
+		unsigned int id, uint64_t flags)
+{
+	struct kgsl_mem_entry *entry, *ret = NULL;
+
+	spin_lock(&process->mem_lock);
+	entry = idr_find(&process->mem_idr, id);
+	if (entry)
+		if (!entry->pending_free &&
+				(flags & entry->memdesc.flags) == flags)
+			ret = kgsl_mem_entry_get(entry);
+	spin_unlock(&process->mem_lock);
+
+	return ret;
+}
+
+/**
+ * kgsl_sharedmem_find_id() - find a memory entry by id
+ * @process: the owning process
+ * @id: id to find
+ *
+ * @returns - the mem_entry or NULL
+ *
+ * Caller must kgsl_mem_entry_put() the returned entry, when finished using
+ * it.
+ */
+struct kgsl_mem_entry * __must_check
+kgsl_sharedmem_find_id(struct kgsl_process_private *process, unsigned int id)
+{
+	return kgsl_sharedmem_find_id_flags(process, id, 0);
+}
+
+/**
+ * kgsl_mem_entry_unset_pend() - Unset the pending free flag of an entry
+ * @entry - The memory entry
+ */
+static inline void kgsl_mem_entry_unset_pend(struct kgsl_mem_entry *entry)
+{
+	if (entry == NULL)
+		return;
+	spin_lock(&entry->priv->mem_lock);
+	entry->pending_free = 0;
+	spin_unlock(&entry->priv->mem_lock);
+}
+
+/**
+ * kgsl_mem_entry_set_pend() - Set the pending free flag of a memory entry
+ * @entry - The memory entry
+ *
+ * @returns - true if pending flag was 0 else false
+ *
+ * This function will set the pending free flag if it is previously unset. Used
+ * to prevent race condition between ioctls calling free/freememontimestamp
+ * on the same entry. Whichever thread set's the flag first will do the free.
+ */
+static inline bool kgsl_mem_entry_set_pend(struct kgsl_mem_entry *entry)
+{
+	bool ret = false;
+
+	if (entry == NULL)
+		return false;
+
+	spin_lock(&entry->priv->mem_lock);
+	if (!entry->pending_free) {
+		entry->pending_free = 1;
+		ret = true;
+	}
+	spin_unlock(&entry->priv->mem_lock);
+	return ret;
+}
+
+static int kgsl_get_ctxt_fault_stats(struct kgsl_context *context,
+		struct kgsl_context_property *ctxt_property)
+{
+	struct kgsl_context_property_fault fault_stats;
+	size_t copy;
+
+	/* Return the size of the subtype struct */
+	if (ctxt_property->size == 0) {
+		ctxt_property->size = sizeof(fault_stats);
+		return 0;
+	}
+
+	memset(&fault_stats, 0, sizeof(fault_stats));
+
+	copy = min_t(size_t, ctxt_property->size, sizeof(fault_stats));
+
+	fault_stats.faults = context->total_fault_count;
+	fault_stats.timestamp = context->last_faulted_cmd_ts;
+
+	/*
+	 * Copy the context fault stats to data which also serves as
+	 * the out parameter.
+	 */
+	if (copy_to_user(u64_to_user_ptr(ctxt_property->data),
+				&fault_stats, copy))
+		return -EFAULT;
+
+	return 0;
+}
+
+static long kgsl_get_ctxt_properties(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param)
+{
+	/* Return fault stats of given context */
+	struct kgsl_context_property ctxt_property;
+	struct kgsl_context *context;
+	size_t copy;
+	long ret;
+
+	/*
+	 * If sizebytes is zero, tell the user how big the
+	 * ctxt_property struct should be.
+	 */
+	if (param->sizebytes == 0) {
+		param->sizebytes = sizeof(ctxt_property);
+		return 0;
+	}
+
+	memset(&ctxt_property, 0, sizeof(ctxt_property));
+
+	copy = min_t(size_t, param->sizebytes, sizeof(ctxt_property));
+
+	/* We expect the value passed in to contain the context id */
+	if (copy_from_user(&ctxt_property, param->value, copy))
+		return -EFAULT;
+
+	/* ctxt type zero is not valid, as we consider it as uninitialized. */
+	if (ctxt_property.type == 0)
+		return -EINVAL;
+
+	context = kgsl_context_get_owner(dev_priv,
+			ctxt_property.contextid);
+	if (!context)
+		return -EINVAL;
+
+	if (ctxt_property.type == KGSL_CONTEXT_PROP_FAULTS)
+		ret = kgsl_get_ctxt_fault_stats(context, &ctxt_property);
+	else
+		ret = -EOPNOTSUPP;
+
+	kgsl_context_put(context);
+
+	return ret;
+}
+
+static long kgsl_prop_version(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param)
+{
+	struct kgsl_version version = {
+		.drv_major = KGSL_VERSION_MAJOR,
+		.drv_minor = KGSL_VERSION_MINOR,
+		.dev_major = 3,
+		.dev_minor = 1,
+	};
+
+	if (param->sizebytes != sizeof(version))
+		return -EINVAL;
+
+	if (copy_to_user(param->value, &version, sizeof(version)))
+		return -EFAULT;
+
+	return 0;
+}
+
+/* Return reset status of given context and clear it */
+static long kgsl_prop_gpu_reset_stat(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param)
+{
+	u32 id;
+	struct kgsl_context *context;
+
+	if (param->sizebytes != sizeof(id))
+		return -EINVAL;
+
+	/* We expect the value passed in to contain the context id */
+	if (copy_from_user(&id, param->value, sizeof(id)))
+		return -EFAULT;
+
+	context = kgsl_context_get_owner(dev_priv, id);
+	if (!context)
+		return -EINVAL;
+
+	/*
+	 * Copy the reset status to value which also serves as
+	 * the out parameter
+	 */
+	id = context->reset_status;
+
+	context->reset_status = KGSL_CTX_STAT_NO_ERROR;
+	kgsl_context_put(context);
+
+	if (copy_to_user(param->value, &id, sizeof(id)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static long kgsl_prop_secure_buf_alignment(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param)
+{
+	u32 align = PAGE_SIZE;
+
+	if (param->sizebytes != sizeof(align))
+		return -EINVAL;
+
+	if (copy_to_user(param->value, &align, sizeof(align)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static long kgsl_prop_secure_ctxt_support(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param)
+{
+	u32 secure;
+
+	if (param->sizebytes != sizeof(secure))
+		return -EINVAL;
+
+	secure = dev_priv->device->mmu.secured ? 1 : 0;
+
+	if (copy_to_user(param->value, &secure, sizeof(secure)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static int kgsl_query_caps_properties(struct kgsl_device *device,
+		struct kgsl_capabilities *caps)
+{
+	struct kgsl_capabilities_properties props;
+	size_t copy;
+	u32 count, *local;
+	int ret;
+
+	/* Return the size of the subtype struct */
+	if (caps->size == 0) {
+		caps->size = sizeof(props);
+		return 0;
+	}
+
+	memset(&props, 0, sizeof(props));
+
+	copy = min_t(size_t, caps->size, sizeof(props));
+
+	if (copy_from_user(&props, u64_to_user_ptr(caps->data), copy))
+		return -EFAULT;
+
+	/* Get the number of properties */
+	count = kgsl_query_property_list(device, NULL, 0);
+
+	/*
+	 * If the incoming user count is zero, they are querying the number of
+	 * available properties. Set it and return.
+	 */
+	if (props.count == 0) {
+		props.count = count;
+		goto done;
+	}
+
+	/* Copy the lesser of the user or kernel property count */
+	if (props.count < count)
+		count = props.count;
+
+	/* Create a local buffer to store the property list */
+	local = kcalloc(count, sizeof(u32), GFP_KERNEL);
+	if (!local)
+		return -ENOMEM;
+
+	/* Get the properties */
+	props.count = kgsl_query_property_list(device, local, count);
+
+	ret = copy_to_user(u64_to_user_ptr(props.list), local,
+		props.count * sizeof(u32));
+
+	kfree(local);
+
+	if (ret)
+		return -EFAULT;
+
+done:
+	if (copy_to_user(u64_to_user_ptr(caps->data), &props, copy))
+		return -EFAULT;
+
+	return 0;
+}
+
+static long kgsl_prop_query_capabilities(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param)
+{
+	struct kgsl_capabilities caps;
+	long ret;
+	size_t copy;
+
+	/*
+	 * If sizebytes is zero, tell the user how big the capabilities struct
+	 * should be
+	 */
+	if (param->sizebytes == 0) {
+		param->sizebytes = sizeof(caps);
+		return 0;
+	}
+
+	memset(&caps, 0, sizeof(caps));
+
+	copy = min_t(size_t, param->sizebytes, sizeof(caps));
+
+	if (copy_from_user(&caps, param->value, copy))
+		return -EFAULT;
+
+	/* querytype must be non zero */
+	if (caps.querytype == 0)
+		return -EINVAL;
+
+	if (caps.querytype == KGSL_QUERY_CAPS_PROPERTIES)
+		ret = kgsl_query_caps_properties(dev_priv->device, &caps);
+	else {
+		/* Unsupported querytypes should return a unique return value */
+		return -EOPNOTSUPP;
+	}
+
+	if (copy_to_user(param->value, &caps, copy))
+		return -EFAULT;
+
+	return ret;
+}
+
+static long kgsl_get_gpu_va64_size(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param)
+{
+	u64 va_size = KGSL_IOMMU_VA_END64 - KGSL_IOMMU_VA_BASE64;
+
+	if (param->sizebytes != sizeof(va_size))
+		return -EINVAL;
+
+	if (copy_to_user(param->value, &va_size, sizeof(va_size)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static long kgsl_get_gpu_secure_va_size(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param)
+{
+	u64 size = KGSL_IOMMU_SECURE_SIZE(&dev_priv->device->mmu);
+
+	if (param->sizebytes != sizeof(size))
+		return -EINVAL;
+
+	if (copy_to_user(param->value, &size, sizeof(size)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static long kgsl_get_gpu_secure_va_inuse(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param)
+{
+	u64 val;
+
+	if (param->sizebytes != sizeof(val))
+		return -EINVAL;
+
+	val = atomic_long_read(&kgsl_driver.stats.secure);
+
+	if (copy_to_user(param->value, &val, sizeof(val)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static const struct {
+	int type;
+	long (*func)(struct kgsl_device_private *dev_priv,
+		struct kgsl_device_getproperty *param);
+} kgsl_property_funcs[] = {
+	{ KGSL_PROP_VERSION, kgsl_prop_version },
+	{ KGSL_PROP_GPU_RESET_STAT, kgsl_prop_gpu_reset_stat},
+	{ KGSL_PROP_SECURE_BUFFER_ALIGNMENT, kgsl_prop_secure_buf_alignment },
+	{ KGSL_PROP_SECURE_CTXT_SUPPORT, kgsl_prop_secure_ctxt_support },
+	{ KGSL_PROP_QUERY_CAPABILITIES, kgsl_prop_query_capabilities },
+	{ KGSL_PROP_CONTEXT_PROPERTY, kgsl_get_ctxt_properties },
+	{ KGSL_PROP_GPU_VA64_SIZE, kgsl_get_gpu_va64_size },
+	{ KGSL_PROP_GPU_SECURE_VA_SIZE, kgsl_get_gpu_secure_va_size },
+	{ KGSL_PROP_GPU_SECURE_VA_INUSE, kgsl_get_gpu_secure_va_inuse },
+};
+
+/*call all ioctl sub functions with driver locked*/
+long kgsl_ioctl_device_getproperty(struct kgsl_device_private *dev_priv,
+					  unsigned int cmd, void *data)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_device_getproperty *param = data;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(kgsl_property_funcs); i++) {
+		if (param->type == kgsl_property_funcs[i].type)
+			return kgsl_property_funcs[i].func(dev_priv, param);
+	}
+
+	if (is_compat_task())
+		return device->ftbl->getproperty_compat(device, param);
+
+	return device->ftbl->getproperty(device, param);
+}
+
+int kgsl_query_property_list(struct kgsl_device *device, u32 *list, u32 count)
+{
+	int num = 0;
+
+	if (!list) {
+		num = ARRAY_SIZE(kgsl_property_funcs);
+
+		if (device->ftbl->query_property_list)
+			num += device->ftbl->query_property_list(device, list,
+				count);
+
+		return num;
+	}
+
+	for (; num < count && num < ARRAY_SIZE(kgsl_property_funcs); num++)
+		list[num] = kgsl_property_funcs[num].type;
+
+	if (device->ftbl->query_property_list)
+		num += device->ftbl->query_property_list(device, &list[num],
+			count - num);
+
+	return num;
+}
+
+long kgsl_ioctl_device_setproperty(struct kgsl_device_private *dev_priv,
+					  unsigned int cmd, void *data)
+{
+	int result = 0;
+	/* The getproperty struct is reused for setproperty too */
+	struct kgsl_device_getproperty *param = data;
+
+	/* Reroute to compat version if coming from compat_ioctl */
+	if (is_compat_task())
+		result = dev_priv->device->ftbl->setproperty_compat(
+			dev_priv, param->type, param->value,
+			param->sizebytes);
+	else if (dev_priv->device->ftbl->setproperty)
+		result = dev_priv->device->ftbl->setproperty(
+			dev_priv, param->type, param->value,
+			param->sizebytes);
+
+	return result;
+}
+
+long kgsl_ioctl_device_waittimestamp_ctxtid(
+		struct kgsl_device_private *dev_priv, unsigned int cmd,
+		void *data)
+{
+	struct kgsl_device_waittimestamp_ctxtid *param = data;
+	struct kgsl_device *device = dev_priv->device;
+	long result = -EINVAL;
+	unsigned int temp_cur_ts = 0;
+	struct kgsl_context *context;
+
+	context = kgsl_context_get_owner(dev_priv, param->context_id);
+	if (context == NULL)
+		return result;
+
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_RETIRED,
+		&temp_cur_ts);
+
+	trace_kgsl_waittimestamp_entry(device, context->id, temp_cur_ts,
+		param->timestamp, param->timeout);
+
+	result = device->ftbl->waittimestamp(device, context, param->timestamp,
+		param->timeout);
+
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_RETIRED,
+		&temp_cur_ts);
+	trace_kgsl_waittimestamp_exit(device, temp_cur_ts, result);
+
+	kgsl_context_put(context);
+
+	return result;
+}
+
+long kgsl_ioctl_rb_issueibcmds(struct kgsl_device_private *dev_priv,
+				      unsigned int cmd, void *data)
+{
+	struct kgsl_ringbuffer_issueibcmds *param = data;
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_context *context;
+	struct kgsl_drawobj *drawobj;
+	struct kgsl_drawobj_cmd *cmdobj;
+	long result = -EINVAL;
+
+	/* The legacy functions don't support synchronization commands */
+	if ((param->flags & (KGSL_DRAWOBJ_SYNC | KGSL_DRAWOBJ_MARKER)))
+		return -EINVAL;
+
+	/* Sanity check the number of IBs */
+	if (param->flags & KGSL_DRAWOBJ_SUBMIT_IB_LIST &&
+			(param->numibs == 0 || param->numibs > KGSL_MAX_NUMIBS))
+		return -EINVAL;
+
+	/* Get the context */
+	context = kgsl_context_get_owner(dev_priv, param->drawctxt_id);
+	if (context == NULL)
+		return -EINVAL;
+
+	cmdobj = kgsl_drawobj_cmd_create(device, context, param->flags,
+					CMDOBJ_TYPE);
+	if (IS_ERR(cmdobj)) {
+		kgsl_context_put(context);
+		return PTR_ERR(cmdobj);
+	}
+
+	drawobj = DRAWOBJ(cmdobj);
+
+	if (param->flags & KGSL_DRAWOBJ_SUBMIT_IB_LIST)
+		result = kgsl_drawobj_cmd_add_ibdesc_list(device, cmdobj,
+			(void __user *) param->ibdesc_addr,
+			param->numibs);
+	else {
+		struct kgsl_ibdesc ibdesc;
+		/* Ultra legacy path */
+
+		ibdesc.gpuaddr = param->ibdesc_addr;
+		ibdesc.sizedwords = param->numibs;
+		ibdesc.ctrl = 0;
+
+		result = kgsl_drawobj_cmd_add_ibdesc(device, cmdobj, &ibdesc);
+	}
+
+	if (result == 0)
+		result = kgsl_reclaim_to_pinned_state(dev_priv->process_priv);
+
+	if (result == 0)
+		result = dev_priv->device->ftbl->queue_cmds(dev_priv, context,
+				&drawobj, 1, &param->timestamp);
+
+	/*
+	 * -EPROTO is a "success" error - it just tells the user that the
+	 * context had previously faulted
+	 */
+	if (result && result != -EPROTO)
+		kgsl_drawobj_destroy(drawobj);
+
+	kgsl_context_put(context);
+	return result;
+}
+
+/* Returns 0 on failure.  Returns command type(s) on success */
+static unsigned int _process_command_input(struct kgsl_device *device,
+		unsigned int flags, unsigned int numcmds,
+		unsigned int numobjs, unsigned int numsyncs)
+{
+	if (numcmds > KGSL_MAX_NUMIBS ||
+			numobjs > KGSL_MAX_NUMIBS ||
+			numsyncs > KGSL_MAX_SYNCPOINTS)
+		return 0;
+
+	/*
+	 * The SYNC bit is supposed to identify a dummy sync object
+	 * so warn the user if they specified any IBs with it.
+	 * A MARKER command can either have IBs or not but if the
+	 * command has 0 IBs it is automatically assumed to be a marker.
+	 */
+
+	/* If they specify the flag, go with what they say */
+	if (flags & KGSL_DRAWOBJ_MARKER)
+		return MARKEROBJ_TYPE;
+	else if (flags & KGSL_DRAWOBJ_SYNC)
+		return SYNCOBJ_TYPE;
+
+	/* If not, deduce what they meant */
+	if (numsyncs && numcmds)
+		return SYNCOBJ_TYPE | CMDOBJ_TYPE;
+	else if (numsyncs)
+		return SYNCOBJ_TYPE;
+	else if (numcmds)
+		return CMDOBJ_TYPE;
+	else if (numcmds == 0)
+		return MARKEROBJ_TYPE;
+
+	return 0;
+}
+
+long kgsl_ioctl_submit_commands(struct kgsl_device_private *dev_priv,
+				      unsigned int cmd, void *data)
+{
+	struct kgsl_submit_commands *param = data;
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_context *context;
+	struct kgsl_drawobj *drawobj[2];
+	unsigned int type;
+	long result;
+	unsigned int i = 0;
+
+	type = _process_command_input(device, param->flags, param->numcmds, 0,
+			param->numsyncs);
+	if (!type)
+		return -EINVAL;
+
+	context = kgsl_context_get_owner(dev_priv, param->context_id);
+	if (context == NULL)
+		return -EINVAL;
+
+	if (type & SYNCOBJ_TYPE) {
+		struct kgsl_drawobj_sync *syncobj =
+				kgsl_drawobj_sync_create(device, context);
+		if (IS_ERR(syncobj)) {
+			result = PTR_ERR(syncobj);
+			goto done;
+		}
+
+		drawobj[i++] = DRAWOBJ(syncobj);
+
+		result = kgsl_drawobj_sync_add_syncpoints(device, syncobj,
+				param->synclist, param->numsyncs);
+		if (result)
+			goto done;
+
+		if (!(syncobj->flags & KGSL_SYNCOBJ_SW))
+			syncobj->flags |= KGSL_SYNCOBJ_HW;
+	}
+
+	if (type & (CMDOBJ_TYPE | MARKEROBJ_TYPE)) {
+		struct kgsl_drawobj_cmd *cmdobj =
+				kgsl_drawobj_cmd_create(device,
+					context, param->flags, type);
+		if (IS_ERR(cmdobj)) {
+			result = PTR_ERR(cmdobj);
+			goto done;
+		}
+
+		drawobj[i++] = DRAWOBJ(cmdobj);
+
+		result = kgsl_drawobj_cmd_add_ibdesc_list(device, cmdobj,
+				param->cmdlist, param->numcmds);
+		if (result)
+			goto done;
+
+		/* If no profiling buffer was specified, clear the flag */
+		if (cmdobj->profiling_buf_entry == NULL)
+			DRAWOBJ(cmdobj)->flags &=
+				~(unsigned long)KGSL_DRAWOBJ_PROFILING;
+
+		if (type & CMDOBJ_TYPE) {
+			result = kgsl_reclaim_to_pinned_state(
+					dev_priv->process_priv);
+			if (result)
+				goto done;
+		}
+	}
+
+	result = device->ftbl->queue_cmds(dev_priv, context, drawobj,
+			i, &param->timestamp);
+
+done:
+	/*
+	 * -EPROTO is a "success" error - it just tells the user that the
+	 * context had previously faulted
+	 */
+	if (result && result != -EPROTO)
+		while (i--)
+			kgsl_drawobj_destroy(drawobj[i]);
+
+
+	kgsl_context_put(context);
+	return result;
+}
+
+long kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_gpu_command *param = data;
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_context *context;
+	struct kgsl_drawobj *drawobj[2];
+	unsigned int type;
+	long result;
+	unsigned int i = 0;
+
+	type = _process_command_input(device, param->flags, param->numcmds,
+			param->numobjs, param->numsyncs);
+	if (!type)
+		return -EINVAL;
+
+	context = kgsl_context_get_owner(dev_priv, param->context_id);
+	if (context == NULL)
+		return -EINVAL;
+
+	if (type & SYNCOBJ_TYPE) {
+		struct kgsl_drawobj_sync *syncobj =
+				kgsl_drawobj_sync_create(device, context);
+
+		if (IS_ERR(syncobj)) {
+			result = PTR_ERR(syncobj);
+			goto done;
+		}
+
+		drawobj[i++] = DRAWOBJ(syncobj);
+
+		result = kgsl_drawobj_sync_add_synclist(device, syncobj,
+				u64_to_user_ptr(param->synclist),
+				param->syncsize, param->numsyncs);
+		if (result)
+			goto done;
+
+		if (!(syncobj->flags & KGSL_SYNCOBJ_SW))
+			syncobj->flags |= KGSL_SYNCOBJ_HW;
+	}
+
+	if (type & (CMDOBJ_TYPE | MARKEROBJ_TYPE)) {
+		struct kgsl_drawobj_cmd *cmdobj =
+				kgsl_drawobj_cmd_create(device,
+					context, param->flags, type);
+
+		if (IS_ERR(cmdobj)) {
+			result = PTR_ERR(cmdobj);
+			goto done;
+		}
+
+		drawobj[i++] = DRAWOBJ(cmdobj);
+
+		result = kgsl_drawobj_cmd_add_cmdlist(device, cmdobj,
+			u64_to_user_ptr(param->cmdlist),
+			param->cmdsize, param->numcmds);
+		if (result)
+			goto done;
+
+		result = kgsl_drawobj_cmd_add_memlist(device, cmdobj,
+			u64_to_user_ptr(param->objlist),
+			param->objsize, param->numobjs);
+		if (result)
+			goto done;
+
+		/* If no profiling buffer was specified, clear the flag */
+		if (cmdobj->profiling_buf_entry == NULL)
+			DRAWOBJ(cmdobj)->flags &=
+				~(unsigned long)KGSL_DRAWOBJ_PROFILING;
+
+		if (type & CMDOBJ_TYPE) {
+			result = kgsl_reclaim_to_pinned_state(
+					dev_priv->process_priv);
+			if (result)
+				goto done;
+		}
+	}
+
+	result = device->ftbl->queue_cmds(dev_priv, context, drawobj,
+				i, &param->timestamp);
+
+done:
+	/*
+	 * -EPROTO is a "success" error - it just tells the user that the
+	 * context had previously faulted
+	 */
+	if (result && result != -EPROTO)
+		while (i--)
+			kgsl_drawobj_destroy(drawobj[i]);
+
+	kgsl_context_put(context);
+	return result;
+}
+
+long kgsl_ioctl_gpu_aux_command(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_gpu_aux_command *param = data;
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_context *context;
+	struct kgsl_drawobj **drawobjs;
+	void __user *cmdlist;
+	u32 count;
+	int i, index = 0;
+	long ret;
+	struct kgsl_gpu_aux_command_generic generic;
+
+	/* We support only one aux command */
+	if (param->numcmds != 1)
+		return -EINVAL;
+
+	if (!(param->flags &
+		(KGSL_GPU_AUX_COMMAND_BIND | KGSL_GPU_AUX_COMMAND_TIMELINE)))
+		return -EINVAL;
+
+	if ((param->flags & KGSL_GPU_AUX_COMMAND_SYNC) &&
+		(param->numsyncs > KGSL_MAX_SYNCPOINTS))
+		return -EINVAL;
+
+	context = kgsl_context_get_owner(dev_priv, param->context_id);
+	if (!context)
+		return -EINVAL;
+
+	/*
+	 * param->numcmds is always one and we have one additional drawobj
+	 * for the timestamp sync if KGSL_GPU_AUX_COMMAND_SYNC flag is passed.
+	 * On top of that we make an implicit sync object for the last queued
+	 * timestamp on this context.
+	 */
+	count = (param->flags & KGSL_GPU_AUX_COMMAND_SYNC) ? 3 : 2;
+
+	drawobjs = kvcalloc(count, sizeof(*drawobjs),
+		GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
+
+	if (!drawobjs) {
+		kgsl_context_put(context);
+		return -ENOMEM;
+	}
+
+	trace_kgsl_aux_command(context->id, param->numcmds, param->flags,
+		param->timestamp);
+
+	if (param->flags & KGSL_GPU_AUX_COMMAND_SYNC) {
+		struct kgsl_drawobj_sync *syncobj =
+			kgsl_drawobj_sync_create(device, context);
+
+		if (IS_ERR(syncobj)) {
+			ret = PTR_ERR(syncobj);
+			goto err;
+		}
+
+		drawobjs[index++] = DRAWOBJ(syncobj);
+
+		ret = kgsl_drawobj_sync_add_synclist(device, syncobj,
+				u64_to_user_ptr(param->synclist),
+				param->syncsize, param->numsyncs);
+		if (ret)
+			goto err;
+	}
+
+	cmdlist = u64_to_user_ptr(param->cmdlist);
+
+	/*
+	 * Create a draw object for KGSL_GPU_AUX_COMMAND_BIND or
+	 * KGSL_GPU_AUX_COMMAND_TIMELINE.
+	 */
+	if (copy_struct_from_user(&generic, sizeof(generic),
+		cmdlist, param->cmdsize)) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	if (generic.type == KGSL_GPU_AUX_COMMAND_BIND) {
+		struct kgsl_drawobj_sync *tsobj;
+		struct kgsl_drawobj_bind *bindobj;
+		u32 queued;
+
+		kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_QUEUED,
+				&queued);
+		/*
+		 * Make an implicit sync object for the last queued timestamp
+		 * on this context
+		 */
+		tsobj = kgsl_drawobj_create_timestamp_syncobj(device,
+			context, queued);
+
+		if (IS_ERR(tsobj)) {
+			ret = PTR_ERR(tsobj);
+			goto err;
+		}
+
+		drawobjs[index++] = DRAWOBJ(tsobj);
+
+		bindobj = kgsl_drawobj_bind_create(device, context);
+
+		if (IS_ERR(bindobj)) {
+			ret = PTR_ERR(bindobj);
+			goto err;
+		}
+
+		drawobjs[index++] = DRAWOBJ(bindobj);
+
+		ret = kgsl_drawobj_add_bind(dev_priv, bindobj,
+			cmdlist, param->cmdsize);
+		if (ret)
+			goto err;
+	} else if (generic.type == KGSL_GPU_AUX_COMMAND_TIMELINE) {
+		struct kgsl_drawobj_timeline *timelineobj;
+		struct kgsl_drawobj_cmd *markerobj;
+
+		timelineobj = kgsl_drawobj_timeline_create(device,
+			context);
+
+		if (IS_ERR(timelineobj)) {
+			ret = PTR_ERR(timelineobj);
+			goto err;
+		}
+
+		drawobjs[index++] = DRAWOBJ(timelineobj);
+
+		ret = kgsl_drawobj_add_timeline(dev_priv, timelineobj,
+			cmdlist, param->cmdsize);
+		if (ret)
+			goto err;
+
+		/*
+		 * Userspace needs a timestamp to associate with this
+		 * submisssion. Use a marker to keep the timestamp
+		 * bookkeeping correct.
+		 */
+		markerobj = kgsl_drawobj_cmd_create(device, context,
+			KGSL_DRAWOBJ_MARKER, MARKEROBJ_TYPE);
+
+		if (IS_ERR(markerobj)) {
+			ret = PTR_ERR(markerobj);
+			goto err;
+		}
+
+		drawobjs[index++] = DRAWOBJ(markerobj);
+	} else {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	ret = device->ftbl->queue_cmds(dev_priv, context,
+		drawobjs, index, &param->timestamp);
+
+err:
+	kgsl_context_put(context);
+
+	if (ret && ret != -EPROTO) {
+		for (i = 0; i < count; i++)
+			kgsl_drawobj_destroy(drawobjs[i]);
+	}
+
+	kvfree(drawobjs);
+	return ret;
+}
+
+/* Returns 0 on failure.  Returns command type(s) on success */
+static unsigned int _process_recurring_input(struct kgsl_device *device,
+		unsigned int flags, unsigned int numcmds,
+		unsigned int numobjs)
+{
+	if (numcmds > KGSL_MAX_NUMIBS ||
+			numobjs > KGSL_MAX_NUMIBS)
+		return 0;
+
+	/* SYNC and MARKER object is not allowed through recurring command */
+	if ((flags & KGSL_DRAWOBJ_MARKER) || (flags & KGSL_DRAWOBJ_SYNC))
+		return 0;
+
+	if (numcmds)
+		return CMDOBJ_TYPE;
+
+	return 0;
+}
+
+long kgsl_ioctl_recurring_command(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_recurring_command *param = data;
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_context *context = NULL;
+	struct kgsl_drawobj *drawobj = NULL;
+	struct kgsl_drawobj_cmd *cmdobj = NULL;
+	unsigned int type;
+	long result;
+
+	if (!(param->flags & (unsigned long)(KGSL_DRAWOBJ_START_RECURRING |
+			KGSL_DRAWOBJ_STOP_RECURRING)))
+		return  -EINVAL;
+
+	context = kgsl_context_get_owner(dev_priv, param->context_id);
+	if (context == NULL)
+		return -EINVAL;
+
+	type = _process_recurring_input(device, param->flags, param->numcmds,
+			param->numobjs);
+	if (!type) {
+		kgsl_context_put(context);
+		return -EINVAL;
+	}
+
+	cmdobj = kgsl_drawobj_cmd_create(device, context, param->flags, type);
+	if (IS_ERR(cmdobj)) {
+		result = PTR_ERR(cmdobj);
+		goto done;
+	}
+
+	drawobj = DRAWOBJ(cmdobj);
+
+	/* Clear the profiling flag for recurring command */
+	drawobj->flags &= ~(unsigned long)KGSL_DRAWOBJ_PROFILING;
+
+	result = kgsl_drawobj_cmd_add_cmdlist(device, cmdobj,
+		u64_to_user_ptr(param->cmdlist),
+		param->cmdsize, param->numcmds);
+	if (result)
+		goto done;
+
+	result = kgsl_drawobj_cmd_add_memlist(device, cmdobj,
+		u64_to_user_ptr(param->objlist),
+		param->objsize, param->numobjs);
+	if (result)
+		goto done;
+
+	if (drawobj->flags & KGSL_DRAWOBJ_STOP_RECURRING) {
+		result = device->ftbl->dequeue_recurring_cmd(device, context);
+		if (!result)
+			kgsl_drawobj_destroy(drawobj);
+	} else {
+		result = device->ftbl->queue_recurring_cmd(dev_priv, context, drawobj);
+	}
+
+done:
+	/*
+	 * -EPROTO is a "success" error - it just tells the user that the
+	 * context had previously faulted
+	 */
+	if (result && result != -EPROTO)
+		kgsl_drawobj_destroy(drawobj);
+
+	kgsl_context_put(context);
+
+	return result;
+}
+
+long kgsl_ioctl_cmdstream_readtimestamp_ctxtid(struct kgsl_device_private
+						*dev_priv, unsigned int cmd,
+						void *data)
+{
+	struct kgsl_cmdstream_readtimestamp_ctxtid *param = data;
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_context *context;
+	long result = -EINVAL;
+
+	mutex_lock(&device->mutex);
+	context = kgsl_context_get_owner(dev_priv, param->context_id);
+
+	if (context) {
+		result = kgsl_readtimestamp(device, context,
+			param->type, &param->timestamp);
+
+		trace_kgsl_readtimestamp(device, context->id,
+			param->type, param->timestamp);
+	}
+
+	kgsl_context_put(context);
+	mutex_unlock(&device->mutex);
+	return result;
+}
+
+long kgsl_ioctl_drawctxt_create(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	int result = 0;
+	struct kgsl_drawctxt_create *param = data;
+	struct kgsl_context *context = NULL;
+	struct kgsl_device *device = dev_priv->device;
+
+	context = device->ftbl->drawctxt_create(dev_priv, &param->flags);
+	if (IS_ERR(context)) {
+		result = PTR_ERR(context);
+		goto done;
+	}
+	trace_kgsl_context_create(dev_priv->device, context, param->flags);
+
+	/* Commit the pointer to the context in context_idr */
+	write_lock(&device->context_lock);
+	idr_replace(&device->context_idr, context, context->id);
+	param->drawctxt_id = context->id;
+	write_unlock(&device->context_lock);
+
+done:
+	return result;
+}
+
+long kgsl_ioctl_drawctxt_destroy(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	struct kgsl_drawctxt_destroy *param = data;
+	struct kgsl_context *context;
+
+	context = kgsl_context_get_owner(dev_priv, param->drawctxt_id);
+	if (context == NULL)
+		return -EINVAL;
+
+	kgsl_context_detach(context);
+	kgsl_context_put(context);
+
+	return 0;
+}
+
+long gpumem_free_entry(struct kgsl_mem_entry *entry)
+{
+	if (!kgsl_mem_entry_set_pend(entry))
+		return -EBUSY;
+
+	trace_kgsl_mem_free(entry);
+	kgsl_memfree_add(pid_nr(entry->priv->pid),
+			entry->memdesc.pagetable ?
+				entry->memdesc.pagetable->name : 0,
+			entry->memdesc.gpuaddr, entry->memdesc.size,
+			entry->memdesc.flags);
+
+	kgsl_mem_entry_put(entry);
+
+	return 0;
+}
+
+static void gpumem_free_func(struct kgsl_device *device,
+		struct kgsl_event_group *group, void *priv, int ret)
+{
+	struct kgsl_context *context = group->context;
+	struct kgsl_mem_entry *entry = priv;
+	unsigned int timestamp;
+
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_RETIRED, &timestamp);
+
+	/* Free the memory for all event types */
+	trace_kgsl_mem_timestamp_free(device, entry, KGSL_CONTEXT_ID(context),
+		timestamp, 0);
+	kgsl_memfree_add(pid_nr(entry->priv->pid),
+			entry->memdesc.pagetable ?
+				entry->memdesc.pagetable->name : 0,
+			entry->memdesc.gpuaddr, entry->memdesc.size,
+			entry->memdesc.flags);
+
+	kgsl_mem_entry_put_deferred(entry);
+}
+
+static long gpumem_free_entry_on_timestamp(struct kgsl_device *device,
+		struct kgsl_mem_entry *entry,
+		struct kgsl_context *context, unsigned int timestamp)
+{
+	int ret;
+	unsigned int temp;
+
+	if (!kgsl_mem_entry_set_pend(entry))
+		return -EBUSY;
+
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_RETIRED, &temp);
+	trace_kgsl_mem_timestamp_queue(device, entry, context->id, temp,
+		timestamp);
+	ret = kgsl_add_event(device, &context->events,
+		timestamp, gpumem_free_func, entry);
+
+	if (ret)
+		kgsl_mem_entry_unset_pend(entry);
+
+	return ret;
+}
+
+long kgsl_ioctl_sharedmem_free(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	struct kgsl_sharedmem_free *param = data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_mem_entry *entry;
+	long ret;
+
+	entry = kgsl_sharedmem_find(private, (uint64_t) param->gpuaddr);
+	if (entry == NULL)
+		return -EINVAL;
+
+	ret = gpumem_free_entry(entry);
+	kgsl_mem_entry_put(entry);
+
+	return ret;
+}
+
+long kgsl_ioctl_gpumem_free_id(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	struct kgsl_gpumem_free_id *param = data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_mem_entry *entry;
+	long ret;
+
+	entry = kgsl_sharedmem_find_id(private, param->id);
+	if (entry == NULL)
+		return -EINVAL;
+
+	ret = gpumem_free_entry(entry);
+	kgsl_mem_entry_put(entry);
+
+	return ret;
+}
+
+static long gpuobj_free_on_timestamp(struct kgsl_device_private *dev_priv,
+		struct kgsl_mem_entry *entry, struct kgsl_gpuobj_free *param)
+{
+	struct kgsl_gpu_event_timestamp event;
+	struct kgsl_context *context;
+	long ret;
+
+	if (copy_struct_from_user(&event, sizeof(event),
+		u64_to_user_ptr(param->priv), param->len))
+		return -EFAULT;
+
+	if (event.context_id == 0)
+		return -EINVAL;
+
+	context = kgsl_context_get_owner(dev_priv, event.context_id);
+	if (context == NULL)
+		return -EINVAL;
+
+	ret = gpumem_free_entry_on_timestamp(dev_priv->device, entry, context,
+		event.timestamp);
+
+	kgsl_context_put(context);
+	return ret;
+}
+
+static bool gpuobj_free_fence_func(void *priv)
+{
+	struct kgsl_mem_entry *entry = priv;
+
+	trace_kgsl_mem_free(entry);
+	kgsl_memfree_add(pid_nr(entry->priv->pid),
+			entry->memdesc.pagetable ?
+				entry->memdesc.pagetable->name : 0,
+			entry->memdesc.gpuaddr, entry->memdesc.size,
+			entry->memdesc.flags);
+
+	kgsl_mem_entry_put_deferred(entry);
+	return true;
+}
+
+static long gpuobj_free_on_fence(struct kgsl_device_private *dev_priv,
+		struct kgsl_mem_entry *entry, struct kgsl_gpuobj_free *param)
+{
+	struct kgsl_sync_fence_cb *handle;
+	struct kgsl_gpu_event_fence event;
+
+	if (!kgsl_mem_entry_set_pend(entry))
+		return -EBUSY;
+
+	if (copy_struct_from_user(&event, sizeof(event),
+		u64_to_user_ptr(param->priv), param->len)) {
+		kgsl_mem_entry_unset_pend(entry);
+		return -EFAULT;
+	}
+
+	if (event.fd < 0) {
+		kgsl_mem_entry_unset_pend(entry);
+		return -EINVAL;
+	}
+
+	handle = kgsl_sync_fence_async_wait(event.fd, gpuobj_free_fence_func, entry);
+
+	if (IS_ERR(handle)) {
+		kgsl_mem_entry_unset_pend(entry);
+		return PTR_ERR(handle);
+	}
+
+	/* if handle is NULL the fence has already signaled */
+	if (handle == NULL)
+		gpuobj_free_fence_func(entry);
+
+	return 0;
+}
+
+long kgsl_ioctl_gpuobj_free(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_gpuobj_free *param = data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_mem_entry *entry;
+	long ret;
+
+	entry = kgsl_sharedmem_find_id(private, param->id);
+	if (entry == NULL)
+		return -EINVAL;
+
+	/* If no event is specified then free immediately */
+	if (!(param->flags & KGSL_GPUOBJ_FREE_ON_EVENT))
+		ret = gpumem_free_entry(entry);
+	else if (param->type == KGSL_GPU_EVENT_TIMESTAMP)
+		ret = gpuobj_free_on_timestamp(dev_priv, entry, param);
+	else if (param->type == KGSL_GPU_EVENT_FENCE)
+		ret = gpuobj_free_on_fence(dev_priv, entry, param);
+	else
+		ret = -EINVAL;
+
+	kgsl_mem_entry_put(entry);
+	return ret;
+}
+
+long kgsl_ioctl_cmdstream_freememontimestamp_ctxtid(
+		struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_cmdstream_freememontimestamp_ctxtid *param = data;
+	struct kgsl_context *context = NULL;
+	struct kgsl_mem_entry *entry;
+	long ret = -EINVAL;
+
+	if (param->type != KGSL_TIMESTAMP_RETIRED)
+		return -EINVAL;
+
+	context = kgsl_context_get_owner(dev_priv, param->context_id);
+	if (context == NULL)
+		return -EINVAL;
+
+	entry = kgsl_sharedmem_find(dev_priv->process_priv,
+		(uint64_t) param->gpuaddr);
+	if (entry == NULL) {
+		kgsl_context_put(context);
+		return -EINVAL;
+	}
+
+	ret = gpumem_free_entry_on_timestamp(dev_priv->device, entry,
+		context, param->timestamp);
+
+	kgsl_mem_entry_put(entry);
+	kgsl_context_put(context);
+
+	return ret;
+}
+
+static int check_vma(unsigned long hostptr, u64 size)
+{
+	struct vm_area_struct *vma;
+	unsigned long cur = hostptr;
+
+	while (cur < (hostptr + size)) {
+		vma = find_vma(current->mm, cur);
+		if (!vma)
+			return false;
+
+		/* Don't remap memory that we already own */
+		if (vma->vm_file && vma->vm_ops == &kgsl_gpumem_vm_ops)
+			return false;
+
+		cur = vma->vm_end;
+	}
+
+	return true;
+}
+
+static int memdesc_sg_virt(struct kgsl_memdesc *memdesc, unsigned long useraddr)
+{
+	int ret = 0;
+	long npages = 0, i;
+	size_t sglen = (size_t) (memdesc->size / PAGE_SIZE);
+	struct page **pages = NULL;
+	int write = ((memdesc->flags & KGSL_MEMFLAGS_GPUREADONLY) ? 0 :
+								FOLL_WRITE);
+
+	if (sglen == 0 || sglen >= LONG_MAX)
+		return -EINVAL;
+
+	pages = kvcalloc(sglen, sizeof(*pages), GFP_KERNEL);
+	if (pages == NULL)
+		return -ENOMEM;
+
+	memdesc->sgt = kmalloc(sizeof(*memdesc->sgt), GFP_KERNEL);
+	if (memdesc->sgt == NULL) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	mmap_read_lock(current->mm);
+	if (!check_vma(useraddr, memdesc->size)) {
+		mmap_read_unlock(current->mm);
+		ret = -EFAULT;
+		goto out;
+	}
+
+#if (KERNEL_VERSION(6, 4, 0) <= LINUX_VERSION_CODE)
+	npages = get_user_pages(useraddr, sglen, write, pages);
+#else
+	npages = get_user_pages(useraddr, sglen, write, pages, NULL);
+#endif
+
+	mmap_read_unlock(current->mm);
+
+	ret = (npages < 0) ? (int)npages : 0;
+	if (ret)
+		goto out;
+
+	if ((unsigned long) npages != sglen) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	ret = sg_alloc_table_from_pages(memdesc->sgt, pages, npages,
+					0, memdesc->size, GFP_KERNEL);
+
+	if (ret)
+		goto out;
+
+	ret = kgsl_cache_range_op(memdesc, 0, memdesc->size,
+			KGSL_CACHE_OP_FLUSH);
+
+	if (ret)
+		sg_free_table(memdesc->sgt);
+out:
+	if (ret) {
+		for (i = 0; i < npages; i++)
+			put_page(pages[i]);
+
+		kfree(memdesc->sgt);
+		memdesc->sgt = NULL;
+	}
+	kvfree(pages);
+	return ret;
+}
+
+static const struct kgsl_memdesc_ops kgsl_usermem_ops = {
+	.free = kgsl_destroy_anon,
+	.put_gpuaddr = kgsl_unmap_and_put_gpuaddr,
+};
+
+static int kgsl_setup_anon_useraddr(struct kgsl_pagetable *pagetable,
+	struct kgsl_mem_entry *entry, unsigned long hostptr,
+	size_t offset, size_t size)
+{
+	/* Map an anonymous memory chunk */
+
+	int ret;
+
+	if (size == 0 || offset != 0 ||
+		!IS_ALIGNED(size, PAGE_SIZE))
+		return -EINVAL;
+
+	entry->memdesc.pagetable = pagetable;
+	entry->memdesc.size = (uint64_t) size;
+	entry->memdesc.flags |= (uint64_t)KGSL_MEMFLAGS_USERMEM_ADDR;
+	entry->memdesc.ops = &kgsl_usermem_ops;
+
+	if (kgsl_memdesc_use_cpu_map(&entry->memdesc)) {
+
+		/* Register the address in the database */
+		ret = kgsl_mmu_set_svm_region(pagetable,
+			(uint64_t) hostptr, (uint64_t) size);
+
+		/* if OOM, retry once after flushing lockless_workqueue */
+		if (ret == -ENOMEM) {
+			flush_workqueue(kgsl_driver.lockless_workqueue);
+			ret = kgsl_mmu_set_svm_region(pagetable,
+				(uint64_t) hostptr, (uint64_t) size);
+		}
+
+		if (ret)
+			return ret;
+
+		entry->memdesc.gpuaddr = (uint64_t) hostptr;
+	}
+
+	ret =  memdesc_sg_virt(&entry->memdesc, hostptr);
+
+	if (ret && kgsl_memdesc_use_cpu_map(&entry->memdesc))
+		kgsl_mmu_put_gpuaddr(pagetable, &entry->memdesc);
+
+	return ret;
+}
+
+static int kgsl_setup_useraddr(struct kgsl_device *device,
+		struct kgsl_pagetable *pagetable,
+		struct kgsl_mem_entry *entry,
+		unsigned long hostptr, size_t offset, size_t size)
+{
+	if (hostptr == 0 || !IS_ALIGNED(hostptr, PAGE_SIZE))
+		return -EINVAL;
+
+	return kgsl_setup_anon_useraddr(pagetable, entry,
+		hostptr, offset, size);
+}
+
+static long _gpuobj_map_useraddr(struct kgsl_device *device,
+		struct kgsl_pagetable *pagetable,
+		struct kgsl_mem_entry *entry,
+		struct kgsl_gpuobj_import *param)
+{
+	struct kgsl_gpuobj_import_useraddr useraddr;
+
+	param->flags &= KGSL_MEMFLAGS_GPUREADONLY
+		| KGSL_CACHEMODE_MASK
+		| KGSL_MEMFLAGS_USE_CPU_MAP
+		| KGSL_MEMTYPE_MASK
+		| KGSL_MEMFLAGS_FORCE_32BIT
+		| KGSL_MEMFLAGS_IOCOHERENT;
+
+	/* Specifying SECURE is an explicit error */
+	if (param->flags & KGSL_MEMFLAGS_SECURE)
+		return -ENOTSUPP;
+
+	kgsl_memdesc_init(device, &entry->memdesc, param->flags);
+
+	if (copy_from_user(&useraddr,
+		u64_to_user_ptr(param->priv), sizeof(useraddr)))
+		return -EINVAL;
+
+	/* Verify that the virtaddr and len are within bounds */
+	if (useraddr.virtaddr > ULONG_MAX)
+		return -EINVAL;
+
+	return kgsl_setup_useraddr(device, pagetable, entry,
+		(unsigned long) useraddr.virtaddr, 0, param->priv_len);
+}
+
+static bool check_and_warn_secured(struct kgsl_device *device)
+{
+	if (kgsl_mmu_is_secured(&device->mmu))
+		return true;
+
+	dev_WARN_ONCE(device->dev, 1, "Secure buffers are not supported\n");
+	return false;
+}
+
+#ifdef CONFIG_DMA_SHARED_BUFFER
+static int kgsl_setup_dma_buf(struct kgsl_device *device,
+				struct kgsl_pagetable *pagetable,
+				struct kgsl_mem_entry *entry,
+				struct dma_buf *dmabuf);
+
+static long _gpuobj_map_dma_buf(struct kgsl_device *device,
+		struct kgsl_pagetable *pagetable,
+		struct kgsl_mem_entry *entry,
+		struct kgsl_gpuobj_import *param,
+		int *fd)
+{
+	bool iocoherent = (param->flags & KGSL_MEMFLAGS_IOCOHERENT);
+	struct kgsl_gpuobj_import_dma_buf buf;
+	struct dma_buf *dmabuf;
+	int ret;
+
+	param->flags &= KGSL_MEMFLAGS_GPUREADONLY |
+		KGSL_MEMTYPE_MASK |
+		KGSL_MEMALIGN_MASK |
+		KGSL_MEMFLAGS_SECURE |
+		KGSL_MEMFLAGS_FORCE_32BIT |
+		KGSL_MEMFLAGS_GUARD_PAGE;
+
+	kgsl_memdesc_init(device, &entry->memdesc, param->flags);
+
+	/*
+	 * If content protection is not enabled and secure buffer
+	 * is requested to be mapped return error.
+	 */
+	if (entry->memdesc.flags & KGSL_MEMFLAGS_SECURE) {
+		if (!check_and_warn_secured(device))
+			return -ENOTSUPP;
+
+		entry->memdesc.priv |= KGSL_MEMDESC_SECURE;
+	}
+
+	if (copy_struct_from_user(&buf, sizeof(buf),
+		u64_to_user_ptr(param->priv), param->priv_len))
+		return -EFAULT;
+
+	if (buf.fd < 0)
+		return -EINVAL;
+
+	*fd = buf.fd;
+	dmabuf = dma_buf_get(buf.fd);
+
+	if (IS_ERR(dmabuf))
+		return PTR_ERR(dmabuf);
+
+	/*
+	 * DMA BUFS are always cached so make sure that is reflected in
+	 * the memdesc.
+	 */
+	entry->memdesc.flags |=
+		FIELD_PREP(KGSL_CACHEMODE_MASK, KGSL_CACHEMODE_WRITEBACK);
+
+	/*
+	 * Enable I/O coherency if it is 1) a thing, and either
+	 * 2) enabled by default or 3) enabled by the caller
+	 */
+	if (kgsl_mmu_has_feature(device, KGSL_MMU_IO_COHERENT) &&
+			(IS_ENABLED(CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT) ||
+			 iocoherent))
+		entry->memdesc.flags |= KGSL_MEMFLAGS_IOCOHERENT;
+
+	ret = kgsl_setup_dma_buf(device, pagetable, entry, dmabuf);
+	if (ret)
+		dma_buf_put(dmabuf);
+
+	return ret;
+}
+#else
+static long _gpuobj_map_dma_buf(struct kgsl_device *device,
+		struct kgsl_pagetable *pagetable,
+		struct kgsl_mem_entry *entry,
+		struct kgsl_gpuobj_import *param,
+		int *fd)
+{
+	return -EINVAL;
+}
+#endif
+
+static void kgsl_process_add_stats(struct kgsl_process_private *priv,
+	unsigned int type, uint64_t size)
+{
+	u64 ret = atomic64_add_return(size, &priv->stats[type].cur);
+
+	if (ret > priv->stats[type].max)
+		priv->stats[type].max = ret;
+}
+
+static u64 kgsl_get_stats(pid_t pid)
+{
+	struct kgsl_process_private *process;
+	u64 ret;
+
+	if (pid < 0)
+		return atomic_long_read(&kgsl_driver.stats.page_alloc);
+
+	process = kgsl_process_private_find(pid);
+
+	if (!process)
+		return 0;
+
+	ret = atomic64_read(&process->stats[KGSL_MEM_ENTRY_KERNEL].cur);
+	kgsl_process_private_put(process);
+
+	return ret;
+}
+
+long kgsl_ioctl_gpuobj_import(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_gpuobj_import *param = data;
+	struct kgsl_mem_entry *entry;
+	int ret, fd = -1;
+
+	if (param->type != KGSL_USER_MEM_TYPE_ADDR &&
+		param->type != KGSL_USER_MEM_TYPE_DMABUF)
+		return -ENOTSUPP;
+
+	if (param->flags & KGSL_MEMFLAGS_VBO)
+		return -EINVAL;
+
+	entry = kgsl_mem_entry_create();
+	if (entry == NULL)
+		return -ENOMEM;
+
+	if (param->type == KGSL_USER_MEM_TYPE_ADDR)
+		ret = _gpuobj_map_useraddr(device, private->pagetable,
+			entry, param);
+	else
+		ret = _gpuobj_map_dma_buf(device, private->pagetable,
+			entry, param, &fd);
+
+	if (ret)
+		goto out;
+
+	if (entry->memdesc.size >= SZ_1M)
+		kgsl_memdesc_set_align(&entry->memdesc, ilog2(SZ_1M));
+	else if (entry->memdesc.size >= SZ_64K)
+		kgsl_memdesc_set_align(&entry->memdesc, ilog2(SZ_64K));
+
+	param->flags = entry->memdesc.flags;
+
+	ret = kgsl_mem_entry_attach_and_map(device, private, entry);
+	if (ret)
+		goto unmap;
+
+	param->id = entry->id;
+
+	KGSL_STATS_ADD(entry->memdesc.size, &kgsl_driver.stats.mapped,
+		&kgsl_driver.stats.mapped_max);
+
+	kgsl_process_add_stats(private,
+		kgsl_memdesc_usermem_type(&entry->memdesc),
+		entry->memdesc.size);
+
+	trace_kgsl_mem_map(entry, fd);
+
+	kgsl_mem_entry_commit_process(entry);
+
+	/* Put the extra ref from kgsl_mem_entry_create() */
+	kgsl_mem_entry_put(entry);
+
+	return 0;
+
+unmap:
+	kgsl_sharedmem_free(&entry->memdesc);
+
+out:
+	kfree(entry);
+	return ret;
+}
+
+static long _map_usermem_addr(struct kgsl_device *device,
+		struct kgsl_pagetable *pagetable, struct kgsl_mem_entry *entry,
+		unsigned long hostptr, size_t offset, size_t size)
+{
+	if (!kgsl_mmu_has_feature(device, KGSL_MMU_PAGED))
+		return -EINVAL;
+
+	/* No CPU mapped buffer could ever be secure */
+	if (entry->memdesc.flags & KGSL_MEMFLAGS_SECURE)
+		return -EINVAL;
+
+	return kgsl_setup_useraddr(device, pagetable, entry, hostptr,
+		offset, size);
+}
+
+#ifdef CONFIG_DMA_SHARED_BUFFER
+static int _map_usermem_dma_buf(struct kgsl_device *device,
+		struct kgsl_pagetable *pagetable,
+		struct kgsl_mem_entry *entry,
+		unsigned int fd)
+{
+	int ret;
+	struct dma_buf *dmabuf;
+
+	/*
+	 * If content protection is not enabled and secure buffer
+	 * is requested to be mapped return error.
+	 */
+
+	if (entry->memdesc.flags & KGSL_MEMFLAGS_SECURE) {
+		if (!check_and_warn_secured(device))
+			return -EOPNOTSUPP;
+
+		entry->memdesc.priv |= KGSL_MEMDESC_SECURE;
+	}
+
+	dmabuf = dma_buf_get(fd);
+	if (IS_ERR_OR_NULL(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
+		return ret ? ret : -EINVAL;
+	}
+	ret = kgsl_setup_dma_buf(device, pagetable, entry, dmabuf);
+	if (ret)
+		dma_buf_put(dmabuf);
+	return ret;
+}
+#else
+static int _map_usermem_dma_buf(struct kgsl_device *device,
+		struct kgsl_pagetable *pagetable,
+		struct kgsl_mem_entry *entry,
+		unsigned int fd)
+{
+	return -EINVAL;
+}
+#endif
+
+#ifdef CONFIG_DMA_SHARED_BUFFER
+static int verify_secure_access(struct kgsl_device *device,
+	struct kgsl_mem_entry *entry, struct dma_buf *dmabuf)
+{
+	bool secure = entry->memdesc.priv & KGSL_MEMDESC_SECURE;
+	uint32_t *vmid_list = NULL, *perms_list = NULL;
+	uint32_t nelems = 0;
+	int i;
+
+	if (mem_buf_dma_buf_copy_vmperm(dmabuf, (int **)&vmid_list,
+		(int **)&perms_list, (int *)&nelems)) {
+		dev_dbg(device->dev, "Skipped access check\n");
+		return 0;
+	}
+
+	/* Check if secure buffer is accessible to CP_PIXEL */
+	for (i = 0; i < nelems; i++) {
+		if  (vmid_list[i] == VMID_CP_PIXEL)
+			break;
+	}
+
+	kfree(vmid_list);
+	kfree(perms_list);
+
+	/*
+	 * Do not import a buffer if it is accessible to CP_PIXEL but is being imported as
+	 * a buffer accessible to non-secure GPU. Also, make sure if buffer is to be made
+	 * accessible to secure GPU, it must be accessible to CP_PIXEL
+	 */
+	if (!(secure ^ (i == nelems)))
+		return -EPERM;
+
+	if (secure && mem_buf_dma_buf_exclusive_owner(dmabuf))
+		return -EPERM;
+
+	return 0;
+}
+
+static int kgsl_setup_dma_buf(struct kgsl_device *device,
+				struct kgsl_pagetable *pagetable,
+				struct kgsl_mem_entry *entry,
+				struct dma_buf *dmabuf)
+{
+	int ret = 0;
+	struct scatterlist *s;
+	struct sg_table *sg_table = NULL;
+	struct dma_buf_attachment *attach = NULL;
+	struct kgsl_dma_buf_meta *metadata;
+
+	metadata = kzalloc(sizeof(*metadata), GFP_KERNEL);
+	if (!metadata)
+		return -ENOMEM;
+
+	attach = dma_buf_attach(dmabuf, device->dev);
+
+	if (IS_ERR(attach)) {
+		ret = PTR_ERR(attach);
+		goto out;
+	}
+
+#ifndef CONFIG_QCOM_KGSL_UPSTREAM
+	/*
+	 * If dma buffer is marked IO coherent, skip sync at attach,
+	 * which involves flushing the buffer on CPU.
+	 * HW manages coherency for IO coherent buffers.
+	 */
+	if (entry->memdesc.flags & KGSL_MEMFLAGS_IOCOHERENT)
+		attach->dma_map_attrs |= DMA_ATTR_SKIP_CPU_SYNC;
+#endif
+
+	metadata->dmabuf = dmabuf;
+	metadata->attach = attach;
+	metadata->entry = entry;
+
+	entry->priv_data = metadata;
+	entry->memdesc.pagetable = pagetable;
+	entry->memdesc.size = 0;
+	entry->memdesc.ops = &kgsl_dmabuf_ops;
+	/* USE_CPU_MAP is not impemented for ION. */
+	entry->memdesc.flags &= ~((uint64_t) KGSL_MEMFLAGS_USE_CPU_MAP);
+	entry->memdesc.flags |= (uint64_t)KGSL_MEMFLAGS_USERMEM_ION;
+
+	sg_table = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
+
+	if (IS_ERR_OR_NULL(sg_table)) {
+		ret = PTR_ERR(sg_table);
+		goto out;
+	}
+
+	metadata->table = sg_table;
+	entry->priv_data = metadata;
+	entry->memdesc.sgt = sg_table;
+
+	ret = verify_secure_access(device, entry, dmabuf);
+	if (ret)
+		goto out;
+
+	/* Calculate the size of the memdesc from the sglist */
+	for (s = entry->memdesc.sgt->sgl; s != NULL; s = sg_next(s))
+		entry->memdesc.size += (uint64_t) s->length;
+
+	if (!entry->memdesc.size) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	add_dmabuf_list(metadata);
+	entry->memdesc.size = PAGE_ALIGN(entry->memdesc.size);
+
+out:
+	if (ret) {
+		if (!IS_ERR_OR_NULL(sg_table))
+			dma_buf_unmap_attachment(attach, sg_table, DMA_BIDIRECTIONAL);
+
+		if (!IS_ERR_OR_NULL(attach))
+			dma_buf_detach(dmabuf, attach);
+
+		kfree(metadata);
+	}
+
+	return ret;
+}
+#endif
+
+#ifdef CONFIG_DMA_SHARED_BUFFER
+void kgsl_get_egl_counts(struct kgsl_mem_entry *entry,
+		int *egl_surface_count, int *egl_image_count)
+{
+	struct kgsl_dma_buf_meta *metadata = entry->priv_data;
+	struct dmabuf_list_entry *dle = metadata->dle;
+	struct kgsl_dma_buf_meta *scan_meta;
+	struct kgsl_mem_entry *scan_mem_entry;
+
+	if (!dle)
+		return;
+
+	spin_lock(&kgsl_dmabuf_lock);
+	list_for_each_entry(scan_meta, &dle->dmabuf_list, node) {
+		scan_mem_entry = scan_meta->entry;
+
+		switch (kgsl_memdesc_get_memtype(&scan_mem_entry->memdesc)) {
+		case KGSL_MEMTYPE_EGL_SURFACE:
+			(*egl_surface_count)++;
+			break;
+		case KGSL_MEMTYPE_EGL_IMAGE:
+			(*egl_image_count)++;
+			break;
+		}
+	}
+	spin_unlock(&kgsl_dmabuf_lock);
+}
+
+unsigned long kgsl_get_dmabuf_inode_number(struct kgsl_mem_entry *entry)
+{
+	struct kgsl_dma_buf_meta *metadata = entry->priv_data;
+
+	return metadata ? file_inode(metadata->dmabuf->file)->i_ino : 0;
+}
+#else
+void kgsl_get_egl_counts(struct kgsl_mem_entry *entry,
+		int *egl_surface_count, int *egl_image_count)
+{
+}
+
+unsigned long kgsl_get_dmabuf_inode_number(struct kgsl_mem_entry *entry)
+{
+}
+#endif
+
+long kgsl_ioctl_map_user_mem(struct kgsl_device_private *dev_priv,
+				     unsigned int cmd, void *data)
+{
+	int result = -EINVAL;
+	struct kgsl_map_user_mem *param = data;
+	struct kgsl_mem_entry *entry = NULL;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_device *device = dev_priv->device;
+	unsigned int memtype;
+	uint64_t flags;
+
+	/*
+	 * If content protection is not enabled and secure buffer
+	 * is requested to be mapped return error.
+	 */
+
+	if (param->flags & KGSL_MEMFLAGS_SECURE) {
+		if (!check_and_warn_secured(device))
+			return -EOPNOTSUPP;
+
+		/* Can't use CPU map with secure buffers */
+		if (param->flags & KGSL_MEMFLAGS_USE_CPU_MAP)
+			return -EINVAL;
+	}
+
+	entry = kgsl_mem_entry_create();
+
+	if (entry == NULL)
+		return -ENOMEM;
+
+	/*
+	 * Convert from enum value to KGSL_MEM_ENTRY value, so that
+	 * we can use the latter consistently everywhere.
+	 */
+	memtype = param->memtype + 1;
+
+	/*
+	 * Mask off unknown flags from userspace. This way the caller can
+	 * check if a flag is supported by looking at the returned flags.
+	 * Note: CACHEMODE is ignored for this call. Caching should be
+	 * determined by type of allocation being mapped.
+	 */
+	flags = param->flags & (KGSL_MEMFLAGS_GPUREADONLY
+				| KGSL_MEMTYPE_MASK
+				| KGSL_MEMALIGN_MASK
+				| KGSL_MEMFLAGS_USE_CPU_MAP
+				| KGSL_MEMFLAGS_SECURE
+				| KGSL_MEMFLAGS_IOCOHERENT);
+
+	if (is_compat_task())
+		flags |= KGSL_MEMFLAGS_FORCE_32BIT;
+
+	kgsl_memdesc_init(device, &entry->memdesc, flags);
+
+	switch (memtype) {
+	case KGSL_MEM_ENTRY_USER:
+		result = _map_usermem_addr(device, private->pagetable,
+			entry, param->hostptr, param->offset, param->len);
+		break;
+	case KGSL_MEM_ENTRY_ION:
+		if (param->offset != 0)
+			result = -EINVAL;
+		else
+			result = _map_usermem_dma_buf(device,
+				private->pagetable, entry, param->fd);
+		break;
+	default:
+		result = -EOPNOTSUPP;
+		break;
+	}
+
+	if (result)
+		goto error;
+
+	if (entry->memdesc.size >= SZ_2M)
+		kgsl_memdesc_set_align(&entry->memdesc, ilog2(SZ_2M));
+	else if (entry->memdesc.size >= SZ_1M)
+		kgsl_memdesc_set_align(&entry->memdesc, ilog2(SZ_1M));
+	else if (entry->memdesc.size >= SZ_64K)
+		kgsl_memdesc_set_align(&entry->memdesc, ilog2(SZ_64));
+
+	/* echo back flags */
+	param->flags = (unsigned int) entry->memdesc.flags;
+
+	result = kgsl_mem_entry_attach_and_map(device, private,
+		entry);
+	if (result)
+		goto error_attach;
+
+	/* Adjust the returned value for a non 4k aligned offset */
+	param->gpuaddr = (unsigned long)
+		entry->memdesc.gpuaddr + (param->offset & PAGE_MASK);
+
+	KGSL_STATS_ADD(param->len, &kgsl_driver.stats.mapped,
+		&kgsl_driver.stats.mapped_max);
+
+	kgsl_process_add_stats(private,
+			kgsl_memdesc_usermem_type(&entry->memdesc), param->len);
+
+	trace_kgsl_mem_map(entry, param->fd);
+
+	kgsl_mem_entry_commit_process(entry);
+
+	/* Put the extra ref from kgsl_mem_entry_create() */
+	kgsl_mem_entry_put(entry);
+
+	return result;
+
+error_attach:
+	kgsl_sharedmem_free(&entry->memdesc);
+error:
+	/* Clear gpuaddr here so userspace doesn't get any wrong ideas */
+	param->gpuaddr = 0;
+
+	kfree(entry);
+	return result;
+}
+
+static int _kgsl_gpumem_sync_cache(struct kgsl_mem_entry *entry,
+		uint64_t offset, uint64_t length, unsigned int op)
+{
+	int ret = 0;
+	int cacheop;
+
+	if (!entry)
+		return 0;
+
+	 /* Cache ops are not allowed on secure memory */
+	if (entry->memdesc.flags & KGSL_MEMFLAGS_SECURE)
+		return 0;
+
+	/*
+	 * Flush is defined as (clean | invalidate).  If both bits are set, then
+	 * do a flush, otherwise check for the individual bits and clean or inv
+	 * as requested
+	 */
+
+	if ((op & KGSL_GPUMEM_CACHE_FLUSH) == KGSL_GPUMEM_CACHE_FLUSH)
+		cacheop = KGSL_CACHE_OP_FLUSH;
+	else if (op & KGSL_GPUMEM_CACHE_CLEAN)
+		cacheop = KGSL_CACHE_OP_CLEAN;
+	else if (op & KGSL_GPUMEM_CACHE_INV)
+		cacheop = KGSL_CACHE_OP_INV;
+	else {
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (!(op & KGSL_GPUMEM_CACHE_RANGE)) {
+		offset = 0;
+		length = entry->memdesc.size;
+	}
+
+	if (kgsl_cachemode_is_cached(entry->memdesc.flags)) {
+		trace_kgsl_mem_sync_cache(entry, offset, length, op);
+		ret = kgsl_cache_range_op(&entry->memdesc, offset,
+					length, cacheop);
+	}
+
+done:
+	return ret;
+}
+
+/* New cache sync function - supports both directions (clean and invalidate) */
+
+long kgsl_ioctl_gpumem_sync_cache(struct kgsl_device_private *dev_priv,
+	unsigned int cmd, void *data)
+{
+	struct kgsl_gpumem_sync_cache *param = data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_mem_entry *entry = NULL;
+	long ret;
+
+	if (param->id != 0)
+		entry = kgsl_sharedmem_find_id(private, param->id);
+	else if (param->gpuaddr != 0)
+		entry = kgsl_sharedmem_find(private, (uint64_t) param->gpuaddr);
+
+	if (entry == NULL)
+		return -EINVAL;
+
+	ret = _kgsl_gpumem_sync_cache(entry, (uint64_t) param->offset,
+					(uint64_t) param->length, param->op);
+	kgsl_mem_entry_put(entry);
+	return ret;
+}
+
+static int mem_id_cmp(const void *_a, const void *_b)
+{
+	const unsigned int *a = _a, *b = _b;
+
+	if (*a == *b)
+		return 0;
+	return (*a > *b) ? 1 : -1;
+}
+
+#ifdef CONFIG_ARM64
+/* Do not support full flush on ARM64 targets */
+static inline bool check_full_flush(size_t size, int op)
+{
+	return false;
+}
+#else
+/* Support full flush if the size is bigger than the threshold */
+static inline bool check_full_flush(size_t size, int op)
+{
+	/* If we exceed the breakeven point, flush the entire cache */
+	bool ret = (kgsl_driver.full_cache_threshold != 0) &&
+		(size >= kgsl_driver.full_cache_threshold) &&
+		(op == KGSL_GPUMEM_CACHE_FLUSH);
+	if (ret)
+		flush_cache_all();
+	return ret;
+}
+#endif
+
+long kgsl_ioctl_gpumem_sync_cache_bulk(struct kgsl_device_private *dev_priv,
+	unsigned int cmd, void *data)
+{
+	int i;
+	struct kgsl_gpumem_sync_cache_bulk *param = data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	unsigned int id, last_id = 0, *id_list = NULL, actual_count = 0;
+	struct kgsl_mem_entry **entries = NULL;
+	long ret = 0;
+	uint64_t op_size = 0;
+	bool full_flush = false;
+
+	if (param->id_list == NULL || param->count == 0
+			|| param->count > (PAGE_SIZE / sizeof(unsigned int)))
+		return -EINVAL;
+
+	id_list = kcalloc(param->count, sizeof(unsigned int), GFP_KERNEL);
+	if (id_list == NULL)
+		return -ENOMEM;
+
+	entries = kcalloc(param->count, sizeof(*entries), GFP_KERNEL);
+	if (entries == NULL) {
+		ret = -ENOMEM;
+		goto end;
+	}
+
+	if (copy_from_user(id_list, param->id_list,
+				param->count * sizeof(unsigned int))) {
+		ret = -EFAULT;
+		goto end;
+	}
+	/* sort the ids so we can weed out duplicates */
+	sort(id_list, param->count, sizeof(*id_list), mem_id_cmp, NULL);
+
+	for (i = 0; i < param->count; i++) {
+		unsigned int cachemode;
+		struct kgsl_mem_entry *entry = NULL;
+
+		id = id_list[i];
+		/* skip 0 ids or duplicates */
+		if (id == last_id)
+			continue;
+
+		entry = kgsl_sharedmem_find_id(private, id);
+		if (entry == NULL)
+			continue;
+
+		/* skip uncached memory */
+		cachemode = kgsl_memdesc_get_cachemode(&entry->memdesc);
+		if (cachemode != KGSL_CACHEMODE_WRITETHROUGH &&
+		    cachemode != KGSL_CACHEMODE_WRITEBACK) {
+			kgsl_mem_entry_put(entry);
+			continue;
+		}
+
+		op_size += entry->memdesc.size;
+		entries[actual_count++] = entry;
+
+		full_flush  = check_full_flush(op_size, param->op);
+		if (full_flush) {
+			trace_kgsl_mem_sync_full_cache(actual_count, op_size);
+			break;
+		}
+
+		last_id = id;
+	}
+
+	param->op &= ~KGSL_GPUMEM_CACHE_RANGE;
+
+	for (i = 0; i < actual_count; i++) {
+		if (!full_flush)
+			_kgsl_gpumem_sync_cache(entries[i], 0,
+						entries[i]->memdesc.size,
+						param->op);
+		kgsl_mem_entry_put(entries[i]);
+	}
+end:
+	kfree(entries);
+	kfree(id_list);
+	return ret;
+}
+
+/* Legacy cache function, does a flush (clean  + invalidate) */
+
+long kgsl_ioctl_sharedmem_flush_cache(struct kgsl_device_private *dev_priv,
+				 unsigned int cmd, void *data)
+{
+	struct kgsl_sharedmem_free *param = data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_mem_entry *entry = NULL;
+	long ret;
+
+	entry = kgsl_sharedmem_find(private, (uint64_t) param->gpuaddr);
+	if (entry == NULL)
+		return -EINVAL;
+
+	ret = _kgsl_gpumem_sync_cache(entry, 0, entry->memdesc.size,
+					KGSL_GPUMEM_CACHE_FLUSH);
+	kgsl_mem_entry_put(entry);
+	return ret;
+}
+
+long kgsl_ioctl_gpuobj_sync(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_gpuobj_sync *param = data;
+	struct kgsl_gpuobj_sync_obj *objs;
+	struct kgsl_mem_entry **entries;
+	long ret = 0;
+	uint64_t size = 0;
+	int i;
+	void __user *ptr;
+
+	if (param->count == 0 || param->count > 128)
+		return -EINVAL;
+
+	objs = kcalloc(param->count, sizeof(*objs), GFP_KERNEL);
+	if (objs == NULL)
+		return -ENOMEM;
+
+	entries = kcalloc(param->count, sizeof(*entries), GFP_KERNEL);
+	if (entries == NULL) {
+		kfree(objs);
+		return -ENOMEM;
+	}
+
+	ptr = u64_to_user_ptr(param->objs);
+
+	for (i = 0; i < param->count; i++) {
+		ret = copy_struct_from_user(&objs[i], sizeof(*objs), ptr,
+			param->obj_len);
+		if (ret)
+			goto out;
+
+		entries[i] = kgsl_sharedmem_find_id(private, objs[i].id);
+
+		/* Not finding the ID is not a fatal failure - just skip it */
+		if (entries[i] == NULL)
+			continue;
+
+		if (!(objs[i].op & KGSL_GPUMEM_CACHE_RANGE))
+			size += entries[i]->memdesc.size;
+		else if (objs[i].offset < entries[i]->memdesc.size)
+			size += (entries[i]->memdesc.size - objs[i].offset);
+
+		if (check_full_flush(size, objs[i].op)) {
+			trace_kgsl_mem_sync_full_cache(i, size);
+			goto out;
+		}
+
+		ptr += sizeof(*objs);
+	}
+
+	for (i = 0; !ret && i < param->count; i++)
+		ret = _kgsl_gpumem_sync_cache(entries[i],
+			objs[i].offset, objs[i].length, objs[i].op);
+
+out:
+	for (i = 0; i < param->count; i++)
+		kgsl_mem_entry_put(entries[i]);
+
+	kfree(entries);
+	kfree(objs);
+
+	return ret;
+}
+
+static int kgsl_update_fault_details(struct kgsl_context *context,
+		void __user *ptr, u32 faultnents, u32 faultsize)
+{
+	u32 size = min_t(u32, sizeof(struct kgsl_fault), faultsize);
+	u32 cur_idx[KGSL_FAULT_TYPE_MAX] = {0};
+	struct kgsl_fault_node *fault_node;
+	struct kgsl_fault *faults;
+	int i, ret = 0;
+
+	faults = kcalloc(KGSL_FAULT_TYPE_MAX, sizeof(struct kgsl_fault),
+			GFP_KERNEL);
+	if (!faults)
+		return -ENOMEM;
+
+	for (i = 0; i < faultnents; i++) {
+		struct kgsl_fault fault = {0};
+
+		if (copy_from_user(&fault, ptr + i * faultsize, size)) {
+			ret = -EFAULT;
+			goto err;
+		}
+
+		if (fault.type >= KGSL_FAULT_TYPE_MAX) {
+			ret = -EINVAL;
+			goto err;
+		}
+
+		memcpy(&faults[fault.type], &fault, sizeof(fault));
+	}
+
+	mutex_lock(&context->fault_lock);
+
+	list_for_each_entry(fault_node, &context->faults, node) {
+		u32 fault_type = fault_node->type;
+
+		if (cur_idx[fault_type] >= faults[fault_type].count)
+			continue;
+
+		switch (fault_type) {
+		case KGSL_FAULT_TYPE_PAGEFAULT:
+			size = sizeof(struct kgsl_pagefault_report);
+		}
+
+		size = min_t(u32, size, faults[fault_type].size);
+
+		if (copy_to_user(u64_to_user_ptr(faults[fault_type].fault +
+			cur_idx[fault_type] * faults[fault_type].size),
+			fault_node->priv, size)) {
+			ret = -EFAULT;
+			goto release_lock;
+		}
+
+		cur_idx[fault_type] += 1;
+	}
+
+release_lock:
+	mutex_unlock(&context->fault_lock);
+
+err:
+	kfree(faults);
+	return ret;
+}
+
+static int kgsl_update_fault_count(struct kgsl_context *context,
+		void __user *faults, u32 faultnents, u32 faultsize)
+{
+	u32 size = min_t(u32, sizeof(struct kgsl_fault), faultsize);
+	u32 faultcount[KGSL_FAULT_TYPE_MAX] = {0};
+	struct kgsl_fault_node *fault_node;
+	int i, j;
+
+	mutex_lock(&context->fault_lock);
+	list_for_each_entry(fault_node, &context->faults, node)
+		faultcount[fault_node->type]++;
+	mutex_unlock(&context->fault_lock);
+
+	/* KGSL_FAULT_TYPE_NO_FAULT (i.e. 0) is not an actual fault type */
+	for (i = 0, j = 1; i < faultnents && j < KGSL_FAULT_TYPE_MAX; j++) {
+		struct kgsl_fault fault = {0};
+
+		if (!faultcount[j])
+			continue;
+
+		fault.type = j;
+		fault.count = faultcount[j];
+
+		if (copy_to_user(faults, &fault, size))
+			return -EFAULT;
+
+		faults += faultsize;
+		i++;
+	}
+
+	return 0;
+}
+
+long kgsl_ioctl_get_fault_report(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_fault_report *param = data;
+	u32 size = min_t(u32, sizeof(struct kgsl_fault), param->faultsize);
+	void __user *ptr = u64_to_user_ptr(param->faultlist);
+	struct kgsl_context *context;
+	int i, ret = 0;
+
+	context = kgsl_context_get_owner(dev_priv, param->context_id);
+	if (!context)
+		return -EINVAL;
+
+	/* This IOCTL is valid for invalidated contexts only */
+	if (!(context->flags & KGSL_CONTEXT_FAULT_INFO) ||
+		!kgsl_context_invalid(context)) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	/* Return the number of fault types */
+	if (!param->faultlist) {
+		param->faultnents = KGSL_FAULT_TYPE_MAX;
+		kgsl_context_put(context);
+		return 0;
+	}
+
+	/* Check if it's a request to get fault counts or to fill the fault information */
+	for (i = 0; i < param->faultnents; i++) {
+		struct kgsl_fault fault = {0};
+
+		if (copy_from_user(&fault, ptr, size)) {
+			ret = -EFAULT;
+			goto err;
+		}
+
+		if (fault.fault)
+			break;
+
+		ptr += param->faultsize;
+	}
+
+	ptr = u64_to_user_ptr(param->faultlist);
+
+	if (i == param->faultnents)
+		ret = kgsl_update_fault_count(context, ptr, param->faultnents,
+			param->faultsize);
+	else
+		ret = kgsl_update_fault_details(context, ptr, param->faultnents,
+			param->faultsize);
+
+err:
+	kgsl_context_put(context);
+	return ret;
+}
+
+int kgsl_add_fault(struct kgsl_context *context, u32 type, void *priv)
+{
+	struct kgsl_fault_node *fault, *p, *tmp;
+	int length = 0;
+	ktime_t tout;
+
+	if (kgsl_context_is_bad(context))
+		return -EINVAL;
+
+	fault = kmalloc(sizeof(struct kgsl_fault_node), GFP_KERNEL);
+	if (!fault)
+		return -ENOMEM;
+
+	fault->type = type;
+	fault->priv = priv;
+	fault->time = ktime_get();
+
+	tout = ktime_sub_ms(ktime_get(), KGSL_MAX_FAULT_TIME_THRESHOLD);
+
+	mutex_lock(&context->fault_lock);
+
+	list_for_each_entry_safe(p, tmp, &context->faults, node) {
+		if (ktime_compare(p->time, tout) > 0) {
+			length++;
+			continue;
+		}
+
+		list_del(&p->node);
+		kfree(p->priv);
+		kfree(p);
+	}
+
+	if (length == KGSL_MAX_FAULT_ENTRIES) {
+		tmp = list_first_entry(&context->faults, struct kgsl_fault_node, node);
+		list_del(&tmp->node);
+		kfree(tmp->priv);
+		kfree(tmp);
+	}
+
+	list_add_tail(&fault->node, &context->faults);
+	mutex_unlock(&context->fault_lock);
+
+	return 0;
+}
+
+#ifdef CONFIG_ARM64
+static uint64_t kgsl_filter_cachemode(uint64_t flags)
+{
+	/*
+	 * WRITETHROUGH is not supported in arm64, so we tell the user that we
+	 * use WRITEBACK which is the default caching policy.
+	 */
+	if (FIELD_GET(KGSL_CACHEMODE_MASK, flags) == KGSL_CACHEMODE_WRITETHROUGH) {
+		flags &= ~((uint64_t) KGSL_CACHEMODE_MASK);
+		flags |= FIELD_PREP(KGSL_CACHEMODE_MASK, KGSL_CACHEMODE_WRITEBACK);
+	}
+	return flags;
+}
+#else
+static uint64_t kgsl_filter_cachemode(uint64_t flags)
+{
+	return flags;
+}
+#endif
+
+/* The largest allowable alignment for a GPU object is 32MB */
+#define KGSL_MAX_ALIGN (32 * SZ_1M)
+
+static u64 cap_alignment(struct kgsl_device *device, u64 flags)
+{
+	u32 align = FIELD_GET(KGSL_MEMALIGN_MASK, flags);
+
+	if (align >= ilog2(KGSL_MAX_ALIGN)) {
+	/* Cap the alignment bits to the highest number we can handle */
+		dev_err(device->dev,
+			"Alignment too large; restricting to %dK\n",
+			KGSL_MAX_ALIGN >> 10);
+		align = ilog2(KGSL_MAX_ALIGN);
+	}
+
+	flags &= ~((u64) KGSL_MEMALIGN_MASK);
+	return flags | FIELD_PREP(KGSL_MEMALIGN_MASK, align);
+}
+
+static u64 gpumem_max_va_size(struct kgsl_pagetable *pt, u64 flags)
+{
+	if (flags & KGSL_MEMFLAGS_FORCE_32BIT)
+		return pt->compat_va_end - pt->compat_va_start;
+
+	return pt->va_end - pt->va_start;
+}
+
+static struct kgsl_mem_entry *
+gpumem_alloc_vbo_entry(struct kgsl_device_private *dev_priv,
+		u64 size, u64 flags)
+{
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_memdesc *memdesc;
+	struct kgsl_mem_entry *entry;
+	struct kgsl_pagetable *pt;
+	int ret;
+
+	/* Disallow specific flags */
+	if (flags & (KGSL_MEMFLAGS_GPUREADONLY | KGSL_CACHEMODE_MASK))
+		return ERR_PTR(-EINVAL);
+
+	if (flags & (KGSL_MEMFLAGS_USE_CPU_MAP | KGSL_MEMFLAGS_IOCOHERENT))
+		return ERR_PTR(-EINVAL);
+
+	/* Quietly ignore the other flags that aren't this list */
+	flags &= KGSL_MEMFLAGS_SECURE |
+		KGSL_MEMFLAGS_VBO |
+		KGSL_MEMFLAGS_VBO_NO_MAP_ZERO |
+		KGSL_MEMTYPE_MASK |
+		KGSL_MEMALIGN_MASK |
+		KGSL_MEMFLAGS_FORCE_32BIT;
+
+	if ((flags & KGSL_MEMFLAGS_SECURE) && !check_and_warn_secured(device))
+		return ERR_PTR(-EOPNOTSUPP);
+
+	pt = (flags & KGSL_MEMFLAGS_SECURE) ?
+			device->mmu.securepagetable : private->pagetable;
+
+	if (!size || (size > gpumem_max_va_size(pt, flags)))
+		return ERR_PTR(-EINVAL);
+
+	flags = cap_alignment(device, flags);
+
+	entry = kgsl_mem_entry_create();
+	if (!entry)
+		return ERR_PTR(-ENOMEM);
+
+	memdesc = &entry->memdesc;
+
+	ret = kgsl_sharedmem_allocate_vbo(device, memdesc, size, flags);
+	if (ret) {
+		kfree(entry);
+		return ERR_PTR(ret);
+	}
+
+	if (flags & KGSL_MEMFLAGS_SECURE)
+		entry->memdesc.priv |= KGSL_MEMDESC_SECURE;
+
+	ret = kgsl_mem_entry_attach_to_process(device, private, entry);
+	if (ret)
+		goto out;
+
+	/* Map the zero page unless explicitly asked not to */
+	if (!(flags & KGSL_MEMFLAGS_VBO_NO_MAP_ZERO))
+		ret = kgsl_mmu_map_zero_page_to_range(memdesc->pagetable,
+			memdesc, 0, memdesc->size);
+
+	if (!ret) {
+		trace_kgsl_mem_alloc(entry);
+		kgsl_mem_entry_commit_process(entry);
+		return entry;
+	}
+
+out:
+	kgsl_sharedmem_free(memdesc);
+	kfree(entry);
+	return ERR_PTR(ret);
+}
+
+struct kgsl_mem_entry *gpumem_alloc_entry(
+		struct kgsl_device_private *dev_priv,
+		uint64_t size, uint64_t flags)
+{
+	int ret;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_mem_entry *entry;
+	struct kgsl_device *device = dev_priv->device;
+	u32 cachemode;
+
+	/* For 32-bit kernel world nothing to do with this flag */
+	if (BITS_PER_LONG == 32)
+		flags &= ~((uint64_t) KGSL_MEMFLAGS_FORCE_32BIT);
+
+	if (flags & KGSL_MEMFLAGS_VBO)
+		return gpumem_alloc_vbo_entry(dev_priv, size, flags);
+
+	flags &= KGSL_MEMFLAGS_GPUREADONLY
+		| KGSL_CACHEMODE_MASK
+		| KGSL_MEMTYPE_MASK
+		| KGSL_MEMALIGN_MASK
+		| KGSL_MEMFLAGS_USE_CPU_MAP
+		| KGSL_MEMFLAGS_SECURE
+		| KGSL_MEMFLAGS_FORCE_32BIT
+		| KGSL_MEMFLAGS_IOCOHERENT
+		| KGSL_MEMFLAGS_GUARD_PAGE;
+
+	/* Return not supported error if secure memory isn't enabled */
+	if ((flags & KGSL_MEMFLAGS_SECURE) && !check_and_warn_secured(device))
+		return ERR_PTR(-EOPNOTSUPP);
+
+	flags = cap_alignment(device, flags);
+
+	/* For now only allow allocations up to 4G */
+	if (size == 0 || size > UINT_MAX)
+		return ERR_PTR(-EINVAL);
+
+	flags = kgsl_filter_cachemode(flags);
+
+	entry = kgsl_mem_entry_create();
+	if (entry == NULL)
+		return ERR_PTR(-ENOMEM);
+
+	if (IS_ENABLED(CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT) &&
+		kgsl_cachemode_is_cached(flags))
+		flags |= KGSL_MEMFLAGS_IOCOHERENT;
+
+	ret = kgsl_allocate_user(device, &entry->memdesc,
+		size, flags, 0);
+	if (ret != 0)
+		goto err;
+
+	ret = kgsl_mem_entry_attach_and_map(device, private, entry);
+	if (ret != 0) {
+		kgsl_sharedmem_free(&entry->memdesc);
+		goto err;
+	}
+
+	cachemode = kgsl_memdesc_get_cachemode(&entry->memdesc);
+	/*
+	 * Secure buffers cannot be reclaimed. For IO-COHERENT devices cached
+	 * buffers can safely reclaimed. But avoid reclaim cached buffers of
+	 * non IO-COHERENT devices as we could get request for cache operations
+	 * on these buffers when they are reclaimed.
+	 */
+	if (!(flags & KGSL_MEMFLAGS_SECURE) &&
+			(((flags & KGSL_MEMFLAGS_IOCOHERENT) &&
+			!(cachemode == KGSL_CACHEMODE_WRITETHROUGH)) ||
+			(!(flags & KGSL_MEMFLAGS_IOCOHERENT) &&
+			 !(cachemode == KGSL_CACHEMODE_WRITEBACK) &&
+			!(cachemode == KGSL_CACHEMODE_WRITETHROUGH))))
+		entry->memdesc.priv |= KGSL_MEMDESC_CAN_RECLAIM;
+
+	kgsl_process_add_stats(private,
+			kgsl_memdesc_usermem_type(&entry->memdesc),
+			entry->memdesc.size);
+	trace_kgsl_mem_alloc(entry);
+
+	kgsl_mem_entry_commit_process(entry);
+	return entry;
+err:
+	kfree(entry);
+	return ERR_PTR(ret);
+}
+
+static void copy_metadata(struct kgsl_mem_entry *entry, uint64_t metadata,
+		unsigned int len)
+{
+	unsigned int i, size;
+
+	if (len == 0)
+		return;
+
+	size = min_t(unsigned int, len, sizeof(entry->metadata) - 1);
+
+	if (copy_from_user(entry->metadata, u64_to_user_ptr(metadata), size)) {
+		memset(entry->metadata, 0, sizeof(entry->metadata));
+		return;
+	}
+
+	/* Clean up non printable characters in the string */
+	for (i = 0; i < size && entry->metadata[i] != 0; i++) {
+		if (!isprint(entry->metadata[i]))
+			entry->metadata[i] = '?';
+	}
+}
+
+long kgsl_ioctl_gpuobj_alloc(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_gpuobj_alloc *param = data;
+	struct kgsl_mem_entry *entry;
+
+	entry = gpumem_alloc_entry(dev_priv, param->size, param->flags);
+
+	if (IS_ERR(entry))
+		return PTR_ERR(entry);
+
+	copy_metadata(entry, param->metadata, param->metadata_len);
+
+	param->size = entry->memdesc.size;
+	param->flags = entry->memdesc.flags;
+	param->mmapsize = kgsl_memdesc_footprint(&entry->memdesc);
+	param->id = entry->id;
+
+	/* Put the extra ref from kgsl_mem_entry_create() */
+	kgsl_mem_entry_put(entry);
+
+	return 0;
+}
+
+long kgsl_ioctl_gpumem_alloc(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_gpumem_alloc *param = data;
+	struct kgsl_mem_entry *entry;
+	uint64_t flags = param->flags;
+
+	/* Legacy functions doesn't support these advanced features */
+	flags &= ~((uint64_t) KGSL_MEMFLAGS_USE_CPU_MAP);
+
+	if (is_compat_task())
+		flags |= KGSL_MEMFLAGS_FORCE_32BIT;
+
+	entry = gpumem_alloc_entry(dev_priv, (uint64_t) param->size, flags);
+
+	if (IS_ERR(entry))
+		return PTR_ERR(entry);
+
+	param->gpuaddr = (unsigned long) entry->memdesc.gpuaddr;
+	param->size = (size_t) entry->memdesc.size;
+	param->flags = (unsigned int) entry->memdesc.flags;
+
+	/* Put the extra ref from kgsl_mem_entry_create() */
+	kgsl_mem_entry_put(entry);
+
+	return 0;
+}
+
+long kgsl_ioctl_gpumem_alloc_id(struct kgsl_device_private *dev_priv,
+			unsigned int cmd, void *data)
+{
+	struct kgsl_gpumem_alloc_id *param = data;
+	struct kgsl_mem_entry *entry;
+	uint64_t flags = param->flags;
+
+	if (is_compat_task())
+		flags |= KGSL_MEMFLAGS_FORCE_32BIT;
+
+	entry = gpumem_alloc_entry(dev_priv, (uint64_t) param->size, flags);
+
+	if (IS_ERR(entry))
+		return PTR_ERR(entry);
+
+	param->id = entry->id;
+	param->flags = (unsigned int) entry->memdesc.flags;
+	param->size = (size_t) entry->memdesc.size;
+	param->mmapsize = (size_t) kgsl_memdesc_footprint(&entry->memdesc);
+	param->gpuaddr = (unsigned long) entry->memdesc.gpuaddr;
+
+	/* Put the extra ref from kgsl_mem_entry_create() */
+	kgsl_mem_entry_put(entry);
+
+	return 0;
+}
+
+long kgsl_ioctl_gpumem_get_info(struct kgsl_device_private *dev_priv,
+			unsigned int cmd, void *data)
+{
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_gpumem_get_info *param = data;
+	struct kgsl_mem_entry *entry = NULL;
+	int result = 0;
+
+	if (param->id != 0)
+		entry = kgsl_sharedmem_find_id(private, param->id);
+	else if (param->gpuaddr != 0)
+		entry = kgsl_sharedmem_find(private, (uint64_t) param->gpuaddr);
+
+	if (entry == NULL)
+		return -EINVAL;
+
+	/*
+	 * If any of the 64 bit address / sizes would end up being
+	 * truncated, return -ERANGE.  That will signal the user that they
+	 * should use a more modern API
+	 */
+	if (entry->memdesc.gpuaddr > ULONG_MAX)
+		result = -ERANGE;
+
+	param->gpuaddr = (unsigned long) entry->memdesc.gpuaddr;
+	param->id = entry->id;
+	param->flags = (unsigned int) entry->memdesc.flags;
+	param->size = (size_t) entry->memdesc.size;
+	param->mmapsize = (size_t) kgsl_memdesc_footprint(&entry->memdesc);
+	/*
+	 * Entries can have multiple user mappings so thre isn't any one address
+	 * we can report. Plus, the user should already know their mappings, so
+	 * there isn't any value in reporting it back to them.
+	 */
+	param->useraddr = 0;
+
+	kgsl_mem_entry_put(entry);
+	return result;
+}
+
+long kgsl_ioctl_gpuobj_info(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_gpuobj_info *param = data;
+	struct kgsl_mem_entry *entry;
+
+	if (param->id == 0)
+		return -EINVAL;
+
+	entry = kgsl_sharedmem_find_id(private, param->id);
+	if (entry == NULL)
+		return -EINVAL;
+
+	param->id = entry->id;
+	param->gpuaddr = entry->memdesc.gpuaddr;
+	param->flags = entry->memdesc.flags;
+	param->size = entry->memdesc.size;
+
+	/* VBOs cannot be mapped, so don't report a va_len */
+	if (entry->memdesc.flags & KGSL_MEMFLAGS_VBO)
+		param->va_len = 0;
+	else
+		param->va_len = kgsl_memdesc_footprint(&entry->memdesc);
+
+	/*
+	 * Entries can have multiple user mappings so thre isn't any one address
+	 * we can report. Plus, the user should already know their mappings, so
+	 * there isn't any value in reporting it back to them.
+	 */
+	param->va_addr = 0;
+
+	kgsl_mem_entry_put(entry);
+	return 0;
+}
+
+long kgsl_ioctl_gpuobj_set_info(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_gpuobj_set_info *param = data;
+	struct kgsl_mem_entry *entry;
+	int ret = 0;
+
+	if (param->id == 0)
+		return -EINVAL;
+
+	entry = kgsl_sharedmem_find_id(private, param->id);
+	if (entry == NULL)
+		return -EINVAL;
+
+	if (param->flags & KGSL_GPUOBJ_SET_INFO_METADATA)
+		copy_metadata(entry, param->metadata, param->metadata_len);
+
+	if (param->flags & KGSL_GPUOBJ_SET_INFO_TYPE) {
+		if (FIELD_FIT(KGSL_MEMTYPE_MASK, param->type)) {
+			entry->memdesc.flags &= ~((uint64_t) KGSL_MEMTYPE_MASK);
+			entry->memdesc.flags |=
+				FIELD_PREP(KGSL_MEMTYPE_MASK, param->type);
+		} else
+			ret = -EINVAL;
+	}
+
+	kgsl_mem_entry_put(entry);
+	return ret;
+}
+
+/**
+ * kgsl_ioctl_timestamp_event - Register a new timestamp event from userspace
+ * @dev_priv - pointer to the private device structure
+ * @cmd - the ioctl cmd passed from kgsl_ioctl
+ * @data - the user data buffer from kgsl_ioctl
+ * @returns 0 on success or error code on failure
+ */
+
+long kgsl_ioctl_timestamp_event(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_timestamp_event *param = data;
+	int ret;
+
+	switch (param->type) {
+	case KGSL_TIMESTAMP_EVENT_FENCE:
+		ret = kgsl_add_fence_event(dev_priv->device,
+			param->context_id, param->timestamp, param->priv,
+			param->len, dev_priv);
+		break;
+	default:
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+static vm_fault_t
+kgsl_memstore_vm_fault(struct vm_fault *vmf)
+{
+	struct kgsl_memdesc *memdesc = vmf->vma->vm_private_data;
+
+	return memdesc->ops->vmfault(memdesc, vmf->vma, vmf);
+}
+
+static const struct vm_operations_struct kgsl_memstore_vm_ops = {
+	.fault = kgsl_memstore_vm_fault,
+};
+
+static inline void kgsl_vm_flags_clear(struct vm_area_struct *vma, vm_flags_t flags)
+{
+#if (KERNEL_VERSION(6, 1, 25) <= LINUX_VERSION_CODE)
+	vm_flags_clear(vma, flags);
+#else
+	vma->vm_flags &= ~flags;
+#endif
+}
+
+static inline void kgsl_vm_flags_set(struct vm_area_struct *vma, vm_flags_t flags)
+{
+#if (KERNEL_VERSION(6, 1, 25) <= LINUX_VERSION_CODE)
+	vm_flags_set(vma, flags);
+#else
+	vma->vm_flags |= flags;
+#endif
+}
+
+static int
+kgsl_mmap_memstore(struct file *file, struct kgsl_device *device,
+		struct vm_area_struct *vma)
+{
+	struct kgsl_memdesc *memdesc = device->memstore;
+	unsigned int vma_size = vma->vm_end - vma->vm_start;
+
+	/* The memstore can only be mapped as read only */
+
+	if (vma->vm_flags & VM_WRITE)
+		return -EPERM;
+
+	kgsl_vm_flags_clear(vma, VM_MAYWRITE);
+
+	if (memdesc->size  != vma_size) {
+		dev_err(device->dev, "Cannot partially map the memstore\n");
+		return -EINVAL;
+	}
+
+	vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+	vma->vm_private_data = memdesc;
+	kgsl_vm_flags_set(vma, memdesc->ops->vmflags);
+	vma->vm_ops = &kgsl_memstore_vm_ops;
+	vma->vm_file = file;
+
+	return 0;
+}
+
+/*
+ * kgsl_gpumem_vm_open is called whenever a vma region is copied or split.
+ * Increase the refcount to make sure that the accounting stays correct
+ */
+
+static void kgsl_gpumem_vm_open(struct vm_area_struct *vma)
+{
+	struct kgsl_mem_entry *entry = vma->vm_private_data;
+
+	if (!kgsl_mem_entry_get(entry))
+		vma->vm_private_data = NULL;
+
+	atomic_inc(&entry->map_count);
+}
+
+static vm_fault_t
+kgsl_gpumem_vm_fault(struct vm_fault *vmf)
+{
+	struct kgsl_mem_entry *entry = vmf->vma->vm_private_data;
+
+	if (!entry)
+		return VM_FAULT_SIGBUS;
+	if (!entry->memdesc.ops || !entry->memdesc.ops->vmfault)
+		return VM_FAULT_SIGBUS;
+
+	return entry->memdesc.ops->vmfault(&entry->memdesc, vmf->vma, vmf);
+}
+
+static void
+kgsl_gpumem_vm_close(struct vm_area_struct *vma)
+{
+	struct kgsl_mem_entry *entry  = vma->vm_private_data;
+
+	if (!entry)
+		return;
+
+	/*
+	 * Remove the memdesc from the mapped stat once all the mappings have
+	 * gone away
+	 */
+	if (!atomic_dec_return(&entry->map_count))
+		atomic64_sub(entry->memdesc.size, &entry->priv->gpumem_mapped);
+
+	kgsl_mem_entry_put(entry);
+}
+
+static const struct vm_operations_struct kgsl_gpumem_vm_ops = {
+	.open  = kgsl_gpumem_vm_open,
+	.fault = kgsl_gpumem_vm_fault,
+	.close = kgsl_gpumem_vm_close,
+};
+
+static int
+get_mmap_entry(struct kgsl_process_private *private,
+		struct kgsl_mem_entry **out_entry, unsigned long pgoff,
+		unsigned long len)
+{
+	int ret = 0;
+	struct kgsl_mem_entry *entry;
+
+	entry = kgsl_sharedmem_find_id(private, pgoff);
+	if (entry == NULL)
+		entry = kgsl_sharedmem_find(private, pgoff << PAGE_SHIFT);
+
+	if (!entry)
+		return -EINVAL;
+
+	if (!entry->memdesc.ops ||
+		!entry->memdesc.ops->vmflags ||
+		!entry->memdesc.ops->vmfault) {
+		ret = -EINVAL;
+		goto err_put;
+	}
+
+	/* Don't allow ourselves to remap user memory */
+	if (entry->memdesc.flags & KGSL_MEMFLAGS_USERMEM_ADDR) {
+		ret = -EBUSY;
+		goto err_put;
+	}
+
+	if (kgsl_memdesc_use_cpu_map(&entry->memdesc)) {
+		if (len != kgsl_memdesc_footprint(&entry->memdesc)) {
+			ret = -ERANGE;
+			goto err_put;
+		}
+	} else if (len != kgsl_memdesc_footprint(&entry->memdesc) &&
+		len != entry->memdesc.size) {
+		/*
+		 * If cpu_map != gpumap then user can map either the
+		 * footprint or the entry size
+		 */
+		ret = -ERANGE;
+		goto err_put;
+	}
+
+	*out_entry = entry;
+	return 0;
+err_put:
+	kgsl_mem_entry_put(entry);
+	return ret;
+}
+
+static unsigned long _gpu_set_svm_region(struct kgsl_process_private *private,
+		struct kgsl_mem_entry *entry, unsigned long addr,
+		unsigned long size)
+{
+	int ret;
+
+	/*
+	 * Protect access to the gpuaddr here to prevent multiple vmas from
+	 * trying to map a SVM region at the same time
+	 */
+	spin_lock(&entry->memdesc.lock);
+
+	if (entry->memdesc.gpuaddr) {
+		spin_unlock(&entry->memdesc.lock);
+		return (unsigned long) -EBUSY;
+	}
+
+	ret = kgsl_mmu_set_svm_region(private->pagetable, (uint64_t) addr,
+		(uint64_t) size);
+
+	if (ret != 0) {
+		spin_unlock(&entry->memdesc.lock);
+		return (unsigned long) ret;
+	}
+
+	entry->memdesc.gpuaddr = (uint64_t) addr;
+	spin_unlock(&entry->memdesc.lock);
+
+	entry->memdesc.pagetable = private->pagetable;
+
+	ret = kgsl_mmu_map(private->pagetable, &entry->memdesc);
+	if (ret) {
+		kgsl_mmu_put_gpuaddr(private->pagetable, &entry->memdesc);
+		return (unsigned long) ret;
+	}
+
+	kgsl_memfree_purge(private->pagetable, entry->memdesc.gpuaddr,
+		entry->memdesc.size);
+
+	return addr;
+}
+
+static unsigned long get_align(struct kgsl_mem_entry *entry)
+{
+	int bit = kgsl_memdesc_get_align(&entry->memdesc);
+
+	if (bit >= ilog2(SZ_2M))
+		return SZ_2M;
+	else if (bit >= ilog2(SZ_1M))
+		return SZ_1M;
+	else if (bit >= ilog2(SZ_64K))
+		return SZ_64K;
+
+	return SZ_4K;
+}
+
+static unsigned long set_svm_area(struct file *file,
+		struct kgsl_mem_entry *entry,
+		unsigned long addr, unsigned long len,
+		unsigned long flags)
+{
+	struct kgsl_device_private *dev_priv = file->private_data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	unsigned long ret;
+
+	/*
+	 * Do additoinal constraints checking on the address. Passing MAP_FIXED
+	 * ensures that the address we want gets checked
+	 */
+	ret = current->mm->get_unmapped_area(file, addr, len, 0,
+		flags & MAP_FIXED);
+
+	/* If it passes, attempt to set the region in the SVM */
+	if (!IS_ERR_VALUE(ret))
+		return _gpu_set_svm_region(private, entry, addr, len);
+
+	return ret;
+}
+
+static unsigned long get_svm_unmapped_area(struct file *file,
+		struct kgsl_mem_entry *entry,
+		unsigned long addr, unsigned long len,
+		unsigned long flags)
+{
+	struct kgsl_device_private *dev_priv = file->private_data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	unsigned long align = get_align(entry);
+	unsigned long ret, iova;
+	u64 start = 0, end = 0;
+	struct vm_area_struct *vma;
+
+	if (flags & MAP_FIXED) {
+		/* Even fixed addresses need to obey alignment */
+		if (!IS_ALIGNED(addr, align))
+			return -EINVAL;
+
+		return set_svm_area(file, entry, addr, len, flags);
+	}
+
+	/* If a hint was provided, try to use that first */
+	if (addr) {
+		if (IS_ALIGNED(addr, align)) {
+			ret = set_svm_area(file, entry, addr, len, flags);
+			if (!IS_ERR_VALUE(ret))
+				return ret;
+		}
+	}
+
+	/* Get the SVM range for the current process */
+	if (kgsl_mmu_svm_range(private->pagetable, &start, &end,
+		entry->memdesc.flags))
+		return -ERANGE;
+
+	/* Find the first gap in the iova map */
+	iova = kgsl_mmu_find_svm_region(private->pagetable, start, end,
+		len, align);
+
+	while (!IS_ERR_VALUE(iova)) {
+		vma = find_vma_intersection(current->mm, iova, iova + len - 1);
+		if (vma) {
+			iova = vma->vm_start;
+		} else {
+			ret = set_svm_area(file, entry, iova, len, flags);
+			if (!IS_ERR_VALUE(ret))
+				return ret;
+
+			/*
+			 * set_svm_area will return -EBUSY if we tried to set up
+			 * SVM on an object that already has a GPU address. If
+			 * that happens don't bother walking the rest of the
+			 * region
+			 */
+			if ((long) ret == -EBUSY)
+				return -EBUSY;
+
+		}
+
+		iova = kgsl_mmu_find_svm_region(private->pagetable,
+			start, iova - 1, len, align);
+	}
+
+	return -ENOMEM;
+}
+
+static unsigned long
+kgsl_get_unmapped_area(struct file *file, unsigned long addr,
+			unsigned long len, unsigned long pgoff,
+			unsigned long flags)
+{
+	unsigned long val;
+	unsigned long vma_offset = pgoff << PAGE_SHIFT;
+	struct kgsl_device_private *dev_priv = file->private_data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_mem_entry *entry = NULL;
+
+	if (vma_offset == (unsigned long) KGSL_MEMSTORE_TOKEN_ADDRESS)
+		return get_unmapped_area(NULL, addr, len, pgoff, flags);
+
+	val = get_mmap_entry(private, &entry, pgoff, len);
+	if (val)
+		return val;
+
+	/* Do not allow CPU mappings for secure buffers */
+	if (kgsl_memdesc_is_secured(&entry->memdesc)) {
+		kgsl_mem_entry_put(entry);
+		return (unsigned long) -EPERM;
+	}
+
+	if (!kgsl_memdesc_use_cpu_map(&entry->memdesc)) {
+		val = current->mm->get_unmapped_area(file, addr, len, 0, flags);
+		if (IS_ERR_VALUE(val))
+			dev_err_ratelimited(device->dev,
+					       "get_unmapped_area: pid %d addr %lx pgoff %lx len %ld failed error %d\n",
+					       pid_nr(private->pid), addr, pgoff, len,
+					       (int) val);
+	} else {
+		val = get_svm_unmapped_area(file, entry, addr, len, flags);
+		/* if OOM, retry once after flushing lockless_workqueue */
+		if (val == -ENOMEM) {
+			flush_workqueue(kgsl_driver.lockless_workqueue);
+			val = get_svm_unmapped_area(file, entry, addr, len, flags);
+		}
+		if (IS_ERR_VALUE(val))
+			dev_err_ratelimited(device->dev,
+					       "_get_svm_area: pid %d addr %lx pgoff %lx len %ld failed error %d\n",
+					       pid_nr(private->pid), addr, pgoff, len,
+					       (int) val);
+	}
+
+	kgsl_mem_entry_put(entry);
+	return val;
+}
+
+static int kgsl_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	unsigned int cache;
+	unsigned long vma_offset = vma->vm_pgoff << PAGE_SHIFT;
+	struct kgsl_device_private *dev_priv = file->private_data;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_mem_entry *entry = NULL;
+	struct kgsl_device *device = dev_priv->device;
+	uint64_t flags;
+	int ret;
+
+	/* Handle leagacy behavior for memstore */
+
+	if (vma_offset == (unsigned long) KGSL_MEMSTORE_TOKEN_ADDRESS)
+		return kgsl_mmap_memstore(file, device, vma);
+
+	/*
+	 * The reference count on the entry that we get from
+	 * get_mmap_entry() will be held until kgsl_gpumem_vm_close().
+	 */
+	ret = get_mmap_entry(private, &entry, vma->vm_pgoff,
+				vma->vm_end - vma->vm_start);
+	if (ret)
+		return ret;
+
+	kgsl_vm_flags_set(vma, entry->memdesc.ops->vmflags);
+
+	vma->vm_private_data = entry;
+
+	/* Determine user-side caching policy */
+
+	cache = kgsl_memdesc_get_cachemode(&entry->memdesc);
+
+	switch (cache) {
+	case KGSL_CACHEMODE_WRITETHROUGH:
+		vma->vm_page_prot = pgprot_writethroughcache(vma->vm_page_prot);
+		if (pgprot_val(vma->vm_page_prot) ==
+			pgprot_val(pgprot_writebackcache(vma->vm_page_prot)))
+			WARN_ONCE(1, "WRITETHROUGH is deprecated for arm64");
+		break;
+	case KGSL_CACHEMODE_WRITEBACK:
+		vma->vm_page_prot = pgprot_writebackcache(vma->vm_page_prot);
+		break;
+	case KGSL_CACHEMODE_UNCACHED:
+	case KGSL_CACHEMODE_WRITECOMBINE:
+	default:
+		vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+		break;
+	}
+
+	vma->vm_ops = &kgsl_gpumem_vm_ops;
+
+	flags = entry->memdesc.flags;
+
+	if (!(flags & KGSL_MEMFLAGS_IOCOHERENT) &&
+	    (cache == KGSL_CACHEMODE_WRITEBACK ||
+	     cache == KGSL_CACHEMODE_WRITETHROUGH)) {
+		int i;
+		unsigned long addr = vma->vm_start;
+		struct kgsl_memdesc *m = &entry->memdesc;
+
+		for (i = 0; i < m->page_count; i++) {
+			struct page *page = m->pages[i];
+
+			vm_insert_page(vma, addr, page);
+			addr += PAGE_SIZE;
+		}
+	}
+
+	if (entry->memdesc.shmem_filp) {
+		fput(vma->vm_file);
+		vma->vm_file = get_file(entry->memdesc.shmem_filp);
+	}
+
+	/*
+	 * kgsl gets the entry id or the gpu address through vm_pgoff.
+	 * It is used during mmap and never needed again. But this vm_pgoff
+	 * has different meaning at other parts of kernel. Not setting to
+	 * zero will let way for wrong assumption when tried to unmap a page
+	 * from this vma.
+	 */
+	vma->vm_pgoff = 0;
+
+	if (atomic_inc_return(&entry->map_count) == 1)
+		atomic64_add(entry->memdesc.size, &entry->priv->gpumem_mapped);
+
+	trace_kgsl_mem_mmap(entry, vma->vm_start);
+	return 0;
+}
+
+#define KGSL_READ_MESSAGE "OH HAI GPU\n"
+
+static ssize_t kgsl_read(struct file *filep, char __user *buf, size_t count,
+		loff_t *pos)
+{
+	return simple_read_from_buffer(buf, count, pos,
+			KGSL_READ_MESSAGE, strlen(KGSL_READ_MESSAGE) + 1);
+}
+
+static const struct file_operations kgsl_fops = {
+	.owner = THIS_MODULE,
+	.release = kgsl_release,
+	.open = kgsl_open,
+	.mmap = kgsl_mmap,
+	.read = kgsl_read,
+	.get_unmapped_area = kgsl_get_unmapped_area,
+	.unlocked_ioctl = kgsl_ioctl,
+	.compat_ioctl = kgsl_compat_ioctl,
+};
+
+struct kgsl_driver kgsl_driver  = {
+	.process_mutex = __MUTEX_INITIALIZER(kgsl_driver.process_mutex),
+	.proclist_lock = __RW_LOCK_UNLOCKED(kgsl_driver.proclist_lock),
+	.ptlock = __SPIN_LOCK_UNLOCKED(kgsl_driver.ptlock),
+	.wp_list_lock = __SPIN_LOCK_UNLOCKED(kgsl_driver.wp_list_lock),
+	.devlock = __MUTEX_INITIALIZER(kgsl_driver.devlock),
+	/*
+	 * Full cache flushes are faster than line by line on at least
+	 * 8064 and 8974 once the region to be flushed is > 16mb.
+	 */
+	.full_cache_threshold = SZ_16M,
+
+	.stats.vmalloc = ATOMIC_LONG_INIT(0),
+	.stats.vmalloc_max = ATOMIC_LONG_INIT(0),
+	.stats.page_alloc = ATOMIC_LONG_INIT(0),
+	.stats.page_alloc_max = ATOMIC_LONG_INIT(0),
+	.stats.coherent = ATOMIC_LONG_INIT(0),
+	.stats.coherent_max = ATOMIC_LONG_INIT(0),
+	.stats.secure = ATOMIC_LONG_INIT(0),
+	.stats.secure_max = ATOMIC_LONG_INIT(0),
+	.stats.mapped = ATOMIC_LONG_INIT(0),
+	.stats.mapped_max = ATOMIC_LONG_INIT(0),
+};
+
+static void _unregister_device(struct kgsl_device *device)
+{
+	int minor;
+
+	if (device->gpu_sysfs_kobj.state_initialized)
+		kobject_put(&device->gpu_sysfs_kobj);
+
+	mutex_lock(&kgsl_driver.devlock);
+	for (minor = 0; minor < ARRAY_SIZE(kgsl_driver.devp); minor++) {
+		if (device == kgsl_driver.devp[minor]) {
+			device_destroy(kgsl_driver.class,
+				MKDEV(MAJOR(kgsl_driver.major), minor));
+			kgsl_driver.devp[minor] = NULL;
+			break;
+		}
+	}
+	mutex_unlock(&kgsl_driver.devlock);
+}
+
+/* sysfs_ops for the /sys/kernel/gpu kobject */
+static ssize_t kgsl_gpu_sysfs_attr_show(struct kobject *kobj,
+		struct attribute *__attr, char *buf)
+{
+	struct kgsl_gpu_sysfs_attr *attr = container_of(__attr,
+		struct kgsl_gpu_sysfs_attr, attr);
+	struct kgsl_device *device = container_of(kobj,
+			struct kgsl_device, gpu_sysfs_kobj);
+
+	if (attr->show)
+		return attr->show(device, buf);
+
+	return -EIO;
+}
+
+static ssize_t kgsl_gpu_sysfs_attr_store(struct kobject *kobj,
+		struct attribute *__attr, const char *buf, size_t count)
+{
+	struct kgsl_gpu_sysfs_attr *attr = container_of(__attr,
+		struct kgsl_gpu_sysfs_attr, attr);
+	struct kgsl_device *device = container_of(kobj,
+			struct kgsl_device, gpu_sysfs_kobj);
+
+	if (attr->store)
+		return attr->store(device, buf, count);
+
+	return -EIO;
+}
+
+/* Dummy release function - we have nothing to do here */
+static void kgsl_gpu_sysfs_release(struct kobject *kobj)
+{
+}
+
+static const struct sysfs_ops kgsl_gpu_sysfs_ops = {
+	.show = kgsl_gpu_sysfs_attr_show,
+	.store = kgsl_gpu_sysfs_attr_store,
+};
+
+static struct kobj_type kgsl_gpu_sysfs_ktype = {
+	.sysfs_ops = &kgsl_gpu_sysfs_ops,
+	.release = kgsl_gpu_sysfs_release,
+};
+
+static int _register_device(struct kgsl_device *device)
+{
+	static u64 dma_mask = DMA_BIT_MASK(64);
+	static struct device_dma_parameters dma_parms;
+	int minor, ret;
+	dev_t dev;
+
+	/* Find a minor for the device */
+
+	mutex_lock(&kgsl_driver.devlock);
+	for (minor = 0; minor < ARRAY_SIZE(kgsl_driver.devp); minor++) {
+		if (kgsl_driver.devp[minor] == NULL) {
+			kgsl_driver.devp[minor] = device;
+			break;
+		}
+	}
+	mutex_unlock(&kgsl_driver.devlock);
+
+	if (minor == ARRAY_SIZE(kgsl_driver.devp)) {
+		pr_err("kgsl: minor devices exhausted\n");
+		return -ENODEV;
+	}
+
+	/* Create the device */
+	dev = MKDEV(MAJOR(kgsl_driver.major), minor);
+	device->dev = device_create(kgsl_driver.class,
+				    &device->pdev->dev,
+				    dev, device,
+				    device->name);
+
+	if (IS_ERR(device->dev)) {
+		mutex_lock(&kgsl_driver.devlock);
+		kgsl_driver.devp[minor] = NULL;
+		mutex_unlock(&kgsl_driver.devlock);
+		ret = PTR_ERR(device->dev);
+		pr_err("kgsl: device_create(%s): %d\n", device->name, ret);
+		return ret;
+	}
+
+	device->dev->dma_mask = &dma_mask;
+	device->dev->dma_parms = &dma_parms;
+
+	dma_set_max_seg_size(device->dev, (u32)DMA_BIT_MASK(32));
+
+	set_dma_ops(device->dev, NULL);
+
+	WARN_ON(kobject_init_and_add(&device->gpu_sysfs_kobj, &kgsl_gpu_sysfs_ktype,
+		kernel_kobj, "gpu"));
+
+	return 0;
+}
+
+int kgsl_request_irq(struct platform_device *pdev, const  char *name,
+		irq_handler_t handler, void *data)
+{
+	int ret, num = platform_get_irq_byname(pdev, name);
+
+	if (num < 0)
+		return num;
+
+	ret = devm_request_irq(&pdev->dev, num, handler, IRQF_TRIGGER_HIGH,
+		name, data);
+
+	if (ret) {
+		dev_err(&pdev->dev, "Unable to get interrupt %s: %d\n",
+			name, ret);
+		return ret;
+	}
+
+	disable_irq(num);
+	return num;
+}
+
+int kgsl_of_property_read_ddrtype(struct device_node *node, const char *base,
+		u32 *ptr)
+{
+	char str[32];
+	int ddr = get_ddrtype();
+
+	/* get_ddrtype() returns error if the DDR type isn't determined */
+	if (ddr >= 0) {
+		int ret;
+
+		/* Construct expanded string for the DDR type  */
+		ret = snprintf(str, sizeof(str), "%s-ddr%d", base, ddr);
+
+		/* WARN_ON() if the array size was too small for the string */
+		if (WARN_ON(ret > sizeof(str)))
+			return -ENOMEM;
+
+		/* Read the expanded string */
+		if (!of_property_read_u32(node, str, ptr))
+			return 0;
+	}
+
+	/* Read the default string */
+	return of_property_read_u32(node, base, ptr);
+}
+
+int kgsl_device_platform_probe(struct kgsl_device *device)
+{
+	struct platform_device *pdev = device->pdev;
+	int status = -EINVAL;
+
+	status = _register_device(device);
+	if (status)
+		return status;
+
+	/* Can return -EPROBE_DEFER */
+	status = kgsl_pwrctrl_init(device);
+	if (status)
+		goto error;
+
+	device->events_worker = kthread_create_worker(0, "kgsl-events");
+
+	if (IS_ERR(device->events_worker)) {
+		status = PTR_ERR(device->events_worker);
+		dev_err(device->dev, "Failed to create events worker ret=%d\n", status);
+		goto error_pwrctrl_close;
+	}
+
+	sched_set_fifo(device->events_worker->task);
+
+	status = kgsl_reclaim_init();
+	if (status)
+		goto error_pwrctrl_close;
+
+	rwlock_init(&device->context_lock);
+	spin_lock_init(&device->submit_lock);
+
+	idr_init(&device->timelines);
+	spin_lock_init(&device->timelines_lock);
+
+	kgsl_device_debugfs_init(device);
+
+	dma_set_coherent_mask(&pdev->dev, KGSL_DMA_BIT_MASK);
+
+	/* Set up the GPU events for the device */
+	kgsl_device_events_probe(device);
+
+	/* Initialize common sysfs entries */
+	kgsl_pwrctrl_init_sysfs(device);
+
+	timer_setup(&device->work_period_timer, kgsl_work_period_timer, 0);
+	spin_lock_init(&device->work_period_lock);
+	INIT_WORK(&device->work_period_ws, _log_gpu_work_events);
+
+	return 0;
+
+error_pwrctrl_close:
+	if (!IS_ERR(device->events_worker))
+		kthread_destroy_worker(device->events_worker);
+
+	kgsl_pwrctrl_close(device);
+error:
+	_unregister_device(device);
+	return status;
+}
+
+void kgsl_device_platform_remove(struct kgsl_device *device)
+{
+	del_timer(&device->work_period_timer);
+
+	kthread_destroy_worker(device->events_worker);
+
+	kgsl_device_snapshot_close(device);
+
+	idr_destroy(&device->context_idr);
+	idr_destroy(&device->timelines);
+
+	kgsl_device_events_remove(device);
+
+	kgsl_free_globals(device);
+
+	kgsl_pwrctrl_close(device);
+
+	kgsl_device_debugfs_close(device);
+	_unregister_device(device);
+}
+
+void kgsl_core_exit(void)
+{
+	kgsl_exit_page_pools();
+	kgsl_eventlog_exit();
+
+	if (kgsl_driver.workqueue) {
+		destroy_workqueue(kgsl_driver.workqueue);
+		kgsl_driver.workqueue = NULL;
+	}
+
+	if (kgsl_driver.lockless_workqueue) {
+		destroy_workqueue(kgsl_driver.lockless_workqueue);
+		kgsl_driver.lockless_workqueue = NULL;
+	}
+
+	kgsl_events_exit();
+	kgsl_core_debugfs_close();
+
+	kgsl_reclaim_close();
+
+	/*
+	 * We call device_unregister()
+	 * only if kgsl_driver.virtdev has been populated.
+	 * We check at least one member of kgsl_driver.virtdev to
+	 * see if it is not NULL (and thus, has been populated).
+	 */
+	if (kgsl_driver.virtdev.class)
+		device_unregister(&kgsl_driver.virtdev);
+
+	if (kgsl_driver.class) {
+		class_destroy(kgsl_driver.class);
+		kgsl_driver.class = NULL;
+	}
+
+	kgsl_drawobjs_cache_exit();
+
+	kfree(memfree.list);
+	memset(&memfree, 0, sizeof(memfree));
+
+	unregister_chrdev_region(kgsl_driver.major,
+		ARRAY_SIZE(kgsl_driver.devp));
+
+	sysstats_unregister_kgsl_stats_cb();
+}
+
+int __init kgsl_core_init(void)
+{
+	int result = 0;
+
+	KGSL_BOOT_MARKER("KGSL Init");
+
+	/* alloc major and minor device numbers */
+	result = alloc_chrdev_region(&kgsl_driver.major, 0,
+		ARRAY_SIZE(kgsl_driver.devp), "kgsl");
+
+	if (result < 0) {
+
+		pr_err("kgsl: alloc_chrdev_region failed err = %d\n", result);
+		goto err;
+	}
+
+	cdev_init(&kgsl_driver.cdev, &kgsl_fops);
+	kgsl_driver.cdev.owner = THIS_MODULE;
+	kgsl_driver.cdev.ops = &kgsl_fops;
+	result = cdev_add(&kgsl_driver.cdev, MKDEV(MAJOR(kgsl_driver.major), 0),
+		ARRAY_SIZE(kgsl_driver.devp));
+
+	if (result) {
+		pr_err("kgsl: cdev_add() failed, dev_num= %d,result= %d\n",
+				kgsl_driver.major, result);
+		goto err;
+	}
+
+#if (KERNEL_VERSION(6, 3, 0) <= LINUX_VERSION_CODE)
+	kgsl_driver.class = class_create("kgsl");
+#else
+	kgsl_driver.class = class_create(THIS_MODULE, "kgsl");
+#endif
+	if (IS_ERR(kgsl_driver.class)) {
+		result = PTR_ERR(kgsl_driver.class);
+		pr_err("kgsl: failed to create class for kgsl\n");
+		goto err;
+	}
+
+	/*
+	 * Make a virtual device for managing core related things
+	 * in sysfs
+	 */
+	kgsl_driver.virtdev.class = kgsl_driver.class;
+	dev_set_name(&kgsl_driver.virtdev, "kgsl");
+	result = device_register(&kgsl_driver.virtdev);
+	if (result) {
+		put_device(&kgsl_driver.virtdev);
+		pr_err("kgsl: driver_register failed\n");
+		goto err;
+	}
+
+	/* Make kobjects in the virtual device for storing statistics */
+
+	kgsl_driver.ptkobj =
+	  kobject_create_and_add("pagetables",
+				 &kgsl_driver.virtdev.kobj);
+
+	kgsl_driver.prockobj =
+		kobject_create_and_add("proc",
+				       &kgsl_driver.virtdev.kobj);
+
+	kgsl_core_debugfs_init();
+
+	kgsl_sharedmem_init_sysfs();
+
+	/* Initialize the memory pools */
+	kgsl_probe_page_pools();
+
+	kgsl_register_shmem_callback();
+
+	INIT_LIST_HEAD(&kgsl_driver.process_list);
+
+	INIT_LIST_HEAD(&kgsl_driver.pagetable_list);
+
+	INIT_LIST_HEAD(&kgsl_driver.wp_list);
+
+	kgsl_driver.workqueue = alloc_workqueue("kgsl-workqueue",
+		WQ_UNBOUND | WQ_MEM_RECLAIM | WQ_SYSFS, 0);
+
+	if (!kgsl_driver.workqueue) {
+		pr_err("kgsl: Failed to allocate kgsl workqueue\n");
+		result = -ENOMEM;
+		goto err;
+	}
+
+	/*
+	 * The lockless workqueue is used to perform work which doesn't need to
+	 * take the device mutex
+	 */
+	kgsl_driver.lockless_workqueue = alloc_workqueue("kgsl-lockless-work",
+		WQ_UNBOUND | WQ_MEM_RECLAIM, 0);
+
+	if (!kgsl_driver.lockless_workqueue) {
+		pr_err("kgsl: Failed to allocate lockless workqueue\n");
+		result = -ENOMEM;
+		goto err;
+	}
+
+	kgsl_eventlog_init();
+
+	kgsl_events_init();
+
+	result = kgsl_drawobjs_cache_init();
+	if (result)
+		goto err;
+
+	memfree.list = kcalloc(MEMFREE_ENTRIES, sizeof(struct memfree_entry),
+		GFP_KERNEL);
+
+	sysstats_register_kgsl_stats_cb(kgsl_get_stats);
+
+	KGSL_BOOT_MARKER("KGSL Ready");
+
+	return 0;
+
+err:
+	kgsl_core_exit();
+	return result;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl.h
@@ -0,0 +1,699 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2008-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_H
+#define __KGSL_H
+
+#include <linux/cdev.h>
+#include <linux/compat.h>
+#include <linux/interrupt.h>
+#include <linux/kthread.h>
+#include <linux/mm.h>
+#include <uapi/linux/msm_kgsl.h>
+#include <linux/uaccess.h>
+#include <linux/version.h>
+
+#include "kgsl_gmu_core.h"
+#include "kgsl_pwrscale.h"
+
+#define KGSL_L3_DEVICE "kgsl-l3"
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0))
+#include <soc/qcom/boot_stats.h>
+#define KGSL_BOOT_MARKER(str)          place_marker("M - DRIVER " str)
+#else
+#define KGSL_BOOT_MARKER(str)          pr_info("boot_kpi: M - DRIVER " str)
+#endif
+
+/*
+ * --- kgsl drawobj flags ---
+ * These flags are same as --- drawobj flags ---
+ * but renamed to reflect that cmdbatch is renamed to drawobj.
+ */
+#define KGSL_DRAWOBJ_MEMLIST           KGSL_CMDBATCH_MEMLIST
+#define KGSL_DRAWOBJ_MARKER            KGSL_CMDBATCH_MARKER
+#define KGSL_DRAWOBJ_SUBMIT_IB_LIST    KGSL_CMDBATCH_SUBMIT_IB_LIST
+#define KGSL_DRAWOBJ_CTX_SWITCH        KGSL_CMDBATCH_CTX_SWITCH
+#define KGSL_DRAWOBJ_PROFILING         KGSL_CMDBATCH_PROFILING
+#define KGSL_DRAWOBJ_PROFILING_KTIME   KGSL_CMDBATCH_PROFILING_KTIME
+#define KGSL_DRAWOBJ_END_OF_FRAME      KGSL_CMDBATCH_END_OF_FRAME
+#define KGSL_DRAWOBJ_SYNC              KGSL_CMDBATCH_SYNC
+#define KGSL_DRAWOBJ_PWR_CONSTRAINT    KGSL_CMDBATCH_PWR_CONSTRAINT
+#define KGSL_DRAWOBJ_START_RECURRING   KGSL_CMDBATCH_START_RECURRING
+#define KGSL_DRAWOBJ_STOP_RECURRING    KGSL_CMDBATCH_STOP_RECURRING
+
+
+#define kgsl_drawobj_profiling_buffer kgsl_cmdbatch_profiling_buffer
+
+
+/* The number of memstore arrays limits the number of contexts allowed.
+ * If more contexts are needed, update multiple for MEMSTORE_SIZE
+ */
+#define KGSL_MEMSTORE_SIZE	((int)(PAGE_SIZE * 8))
+#define KGSL_MEMSTORE_GLOBAL	(0)
+#define KGSL_PRIORITY_MAX_RB_LEVELS 4
+#define KGSL_LPAC_RB_ID		KGSL_PRIORITY_MAX_RB_LEVELS
+/* Subtract one for LPAC */
+#define KGSL_MEMSTORE_MAX	(KGSL_MEMSTORE_SIZE / \
+	sizeof(struct kgsl_devmemstore) - 2 - KGSL_PRIORITY_MAX_RB_LEVELS)
+#define KGSL_MAX_CONTEXTS_PER_PROC 200
+
+#define MEMSTORE_RB_OFFSET(rb, field)	\
+	KGSL_MEMSTORE_OFFSET(((rb)->id + KGSL_MEMSTORE_MAX), field)
+
+#define MEMSTORE_ID_GPU_ADDR(dev, iter, field) \
+	((dev)->memstore->gpuaddr + KGSL_MEMSTORE_OFFSET(iter, field))
+
+#define MEMSTORE_RB_GPU_ADDR(dev, rb, field)	\
+	((dev)->memstore->gpuaddr + \
+	 KGSL_MEMSTORE_OFFSET(((rb)->id + KGSL_MEMSTORE_MAX), field))
+
+/*
+ * SCRATCH MEMORY: The scratch memory is one page worth of data that
+ * is mapped into the GPU. This allows for some 'shared' data between
+ * the GPU and CPU. For example, it will be used by the GPU to write
+ * each updated RPTR for each RB.
+ */
+
+/* Shadow global helpers */
+struct adreno_rb_shadow {
+	/** @rptr: per ringbuffer address where GPU writes the rptr */
+	u32 rptr;
+	/** @bv_rptr: per ringbuffer address where GPU writes BV rptr */
+	u32 bv_rptr;
+	/** @bv_ts: per ringbuffer address where BV ringbuffer timestamp is written to */
+	u32 bv_ts;
+	/** @current_rb_ptname: The current pagetable active on the given RB */
+	u32 current_rb_ptname;
+	/** @ttbr0: value to program into TTBR0 during pagetable switch */
+	u64 ttbr0;
+	/** @contextidr: value to program into CONTEXTIDR during pagetable switch */
+	u32 contextidr;
+};
+
+/**
+ * struct gpu_work_period - App specific GPU work period stats
+ */
+struct gpu_work_period {
+	struct kref refcount;
+	struct list_head list;
+	/** @uid: application unique identifier */
+	uid_t uid;
+	/** @active: Total amount of time the GPU spent running work */
+	u64 active;
+	/** @cmds: Total number of commands completed within work period */
+	u32 cmds;
+	/** @frames: Total number of frames completed within work period */
+	atomic_t frames;
+	/** @flags: Flags to accumulate GPU busy stats */
+	unsigned long flags;
+	/** @active_cmds: The number of active cmds from application */
+	atomic_t active_cmds;
+	/** @defer_ws: Work struct to clear gpu work period */
+	struct work_struct defer_ws;
+};
+
+#define SCRATCH_RB_OFFSET(id, _field) ((id * sizeof(struct adreno_rb_shadow)) + \
+	offsetof(struct adreno_rb_shadow, _field))
+#define SCRATCH_RB_GPU_ADDR(dev, id, _field) \
+	((dev)->scratch->gpuaddr + SCRATCH_RB_OFFSET(id, _field))
+
+/* OFFSET to KMD postamble packets in scratch buffer */
+#define SCRATCH_POSTAMBLE_OFFSET (100 * sizeof(u64))
+#define SCRATCH_POSTAMBLE_ADDR(dev) \
+	((dev)->scratch->gpuaddr + SCRATCH_POSTAMBLE_OFFSET)
+
+/* Timestamp window used to detect rollovers (half of integer range) */
+#define KGSL_TIMESTAMP_WINDOW 0x80000000
+
+/*
+ * A macro for memory statistics - add the new size to the stat and if
+ * the statisic is greater then _max, set _max
+ */
+static inline void KGSL_STATS_ADD(uint64_t size, atomic_long_t *stat,
+		atomic_long_t *max)
+{
+	uint64_t ret = atomic_long_add_return(size, stat);
+
+	if (ret > atomic_long_read(max))
+		atomic_long_set(max, ret);
+}
+
+#define KGSL_MAX_NUMIBS 2000
+#define KGSL_MAX_SYNCPOINTS 32
+
+struct kgsl_device;
+struct kgsl_context;
+
+/**
+ * struct kgsl_driver - main container for global KGSL things
+ * @cdev: Character device struct
+ * @major: Major ID for the KGSL device
+ * @class: Pointer to the class struct for the core KGSL sysfs entries
+ * @virtdev: Virtual device for managing the core
+ * @ptkobj: kobject for storing the pagetable statistics
+ * @prockobj: kobject for storing the process statistics
+ * @devp: Array of pointers to the individual KGSL device structs
+ * @process_list: List of open processes
+ * @pagetable_list: LIst of open pagetables
+ * @ptlock: Lock for accessing the pagetable list
+ * @process_mutex: Mutex for accessing the process list
+ * @proclist_lock: Lock for accessing the process list
+ * @devlock: Mutex protecting the device list
+ * @stats: Struct containing atomic memory statistics
+ * @full_cache_threshold: the threshold that triggers a full cache flush
+ * @workqueue: Pointer to a single threaded workqueue
+ */
+struct kgsl_driver {
+	struct cdev cdev;
+	dev_t major;
+	struct class *class;
+	struct device virtdev;
+	struct kobject *ptkobj;
+	struct kobject *prockobj;
+	struct kgsl_device *devp[1];
+	struct list_head process_list;
+	/** @wp_list: List of work period allocated per uid */
+	struct list_head wp_list;
+	/** @wp_list_lock: Lock for accessing the work period list */
+	spinlock_t wp_list_lock;
+	struct list_head pagetable_list;
+	spinlock_t ptlock;
+	struct mutex process_mutex;
+	rwlock_t proclist_lock;
+	struct mutex devlock;
+	struct {
+		atomic_long_t vmalloc;
+		atomic_long_t vmalloc_max;
+		atomic_long_t page_alloc;
+		atomic_long_t page_alloc_max;
+		atomic_long_t coherent;
+		atomic_long_t coherent_max;
+		atomic_long_t secure;
+		atomic_long_t secure_max;
+		atomic_long_t mapped;
+		atomic_long_t mapped_max;
+	} stats;
+	unsigned int full_cache_threshold;
+	struct workqueue_struct *workqueue;
+	/* @lockless_workqueue: Pointer to a workqueue handler which doesn't hold device mutex */
+	struct workqueue_struct *lockless_workqueue;
+};
+
+extern struct kgsl_driver kgsl_driver;
+
+struct kgsl_pagetable;
+struct kgsl_memdesc;
+
+struct kgsl_memdesc_ops {
+	unsigned int vmflags;
+	vm_fault_t (*vmfault)(struct kgsl_memdesc *memdesc,
+		struct vm_area_struct *vma, struct vm_fault *vmf);
+	void (*free)(struct kgsl_memdesc *memdesc);
+	int (*map_kernel)(struct kgsl_memdesc *memdesc);
+	void (*unmap_kernel)(struct kgsl_memdesc *memdesc);
+	/**
+	 * @put_gpuaddr: Put away the GPU address and unmap the memory
+	 * descriptor
+	 */
+	void (*put_gpuaddr)(struct kgsl_memdesc *memdesc);
+};
+
+/* Internal definitions for memdesc->priv */
+#define KGSL_MEMDESC_GUARD_PAGE BIT(0)
+/* Set if the memdesc is mapped into all pagetables */
+#define KGSL_MEMDESC_GLOBAL BIT(1)
+/* The memdesc is frozen during a snapshot */
+#define KGSL_MEMDESC_FROZEN BIT(2)
+/* The memdesc is mapped into a pagetable */
+#define KGSL_MEMDESC_MAPPED BIT(3)
+/* The memdesc is secured for content protection */
+#define KGSL_MEMDESC_SECURE BIT(4)
+/* Memory is accessible in privileged mode */
+#define KGSL_MEMDESC_PRIVILEGED BIT(6)
+/* This is an instruction buffer */
+#define KGSL_MEMDESC_UCODE BIT(7)
+/* For global buffers, randomly assign an address from the region */
+#define KGSL_MEMDESC_RANDOM BIT(8)
+/* Allocate memory from the system instead of the pools */
+#define KGSL_MEMDESC_SYSMEM BIT(9)
+/* The memdesc pages can be reclaimed */
+#define KGSL_MEMDESC_CAN_RECLAIM BIT(10)
+/* The memdesc pages were reclaimed */
+#define KGSL_MEMDESC_RECLAIMED BIT(11)
+/* Skip reclaim of the memdesc pages */
+#define KGSL_MEMDESC_SKIP_RECLAIM BIT(12)
+/* The memdesc is hypassigned to HLOS*/
+#define KGSL_MEMDESC_HYPASSIGNED_HLOS BIT(13)
+
+/**
+ * struct kgsl_memdesc - GPU memory object descriptor
+ * @pagetable: Pointer to the pagetable that the object is mapped in
+ * @hostptr: Kernel virtual address
+ * @hostptr_count: Number of threads using hostptr
+ * @gpuaddr: GPU virtual address
+ * @physaddr: Physical address of the memory object
+ * @size: Size of the memory object
+ * @priv: Internal flags and settings
+ * @sgt: Scatter gather table for allocated pages
+ * @ops: Function hooks for the memdesc memory type
+ * @flags: Flags set from userspace
+ * @dev: Pointer to the struct device that owns this memory
+ * @attrs: dma attributes for this memory
+ * @pages: An array of pointers to allocated pages
+ * @page_count: Total number of pages allocated
+ */
+struct kgsl_memdesc {
+	struct kgsl_pagetable *pagetable;
+	void *hostptr;
+	unsigned int hostptr_count;
+	uint64_t gpuaddr;
+	phys_addr_t physaddr;
+	uint64_t size;
+	unsigned int priv;
+	struct sg_table *sgt;
+	const struct kgsl_memdesc_ops *ops;
+	uint64_t flags;
+	struct device *dev;
+	unsigned long attrs;
+	struct page **pages;
+	unsigned int page_count;
+	/*
+	 * @lock: Spinlock to protect the gpuaddr from being accessed by
+	 * multiple entities trying to map the same SVM region at once
+	 */
+	spinlock_t lock;
+	/** @shmem_filp: Pointer to the shmem file backing this memdesc */
+	struct file *shmem_filp;
+	/** @ranges: rbtree base for the interval list of vbo ranges */
+	struct rb_root_cached ranges;
+	/** @ranges_lock: Mutex to protect the range database */
+	struct mutex ranges_lock;
+	/** @gmuaddr: GMU VA if this is mapped in GMU */
+	u32 gmuaddr;
+	/*@kgsl_dev: kgsl device dev instance */
+	struct device *kgsl_dev;
+	/*@shmem_page_list: shmem pages list */
+	struct list_head shmem_page_list;
+};
+
+/**
+ * struct kgsl_global_memdesc  - wrapper for global memory objects
+ */
+struct kgsl_global_memdesc {
+	/** @memdesc: Container for the GPU memory descriptor for the object */
+	struct kgsl_memdesc memdesc;
+	/** @name: Name of the object for the debugfs list */
+	const char *name;
+	/** @node: List node for the list of global objects */
+	struct list_head node;
+};
+
+/*
+ * List of different memory entry types. The usermem enum
+ * starts at 0, which we use for allocated memory, so 1 is
+ * added to the enum values.
+ */
+#define KGSL_MEM_ENTRY_KERNEL 0
+#define KGSL_MEM_ENTRY_USER (KGSL_USER_MEM_TYPE_ADDR + 1)
+#define KGSL_MEM_ENTRY_ION (KGSL_USER_MEM_TYPE_ION + 1)
+#define KGSL_MEM_ENTRY_MAX (KGSL_USER_MEM_TYPE_MAX + 1)
+
+/* For application specific GPU work period stats */
+#define KGSL_WORK_PERIOD	0
+/* GPU work period time in msec to emulate application work stats */
+#define KGSL_WORK_PERIOD_MS	900
+
+/* symbolic table for trace and debugfs */
+/*
+ * struct kgsl_mem_entry - a userspace memory allocation
+ * @refcount: reference count. Currently userspace can only
+ *  hold a single reference count, but the kernel may hold more.
+ * @memdesc: description of the memory
+ * @priv_data: type-specific data, such as the dma-buf attachment pointer.
+ * @node: rb_node for the gpu address lookup rb tree
+ * @id: idr index for this entry, can be used to find memory that does not have
+ *  a valid GPU address.
+ * @priv: back pointer to the process that owns this memory
+ * @pending_free: if !0, userspace requested that his memory be freed, but there
+ *  are still references to it.
+ * @dev_priv: back pointer to the device file that created this entry.
+ * @metadata: String containing user specified metadata for the entry
+ * @work: Work struct used to schedule kgsl_mem_entry_destroy()
+ */
+struct kgsl_mem_entry {
+	struct kref refcount;
+	struct kgsl_memdesc memdesc;
+	void *priv_data;
+	struct rb_node node;
+	unsigned int id;
+	struct kgsl_process_private *priv;
+	int pending_free;
+	char metadata[KGSL_GPUOBJ_ALLOC_METADATA_MAX + 1];
+	struct work_struct work;
+	/**
+	 * @map_count: Count how many vmas this object is mapped in - used for
+	 * debugfs accounting
+	 */
+	atomic_t map_count;
+	/** @vbo_count: Count how many VBO ranges this entry is mapped in */
+	atomic_t vbo_count;
+};
+
+struct kgsl_device_private;
+struct kgsl_event_group;
+
+typedef void (*kgsl_event_func)(struct kgsl_device *, struct kgsl_event_group *,
+		void *, int);
+
+/**
+ * struct kgsl_event - KGSL GPU timestamp event
+ * @device: Pointer to the KGSL device that owns the event
+ * @context: Pointer to the context that owns the event
+ * @timestamp: Timestamp for the event to expire
+ * @func: Callback function for for the event when it expires
+ * @priv: Private data passed to the callback function
+ * @node: List node for the kgsl_event_group list
+ * @created: Jiffies when the event was created
+ * @work: kthread_work struct for dispatching the callback
+ * @result: KGSL event result type to pass to the callback
+ * group: The event group this event belongs to
+ */
+struct kgsl_event {
+	struct kgsl_device *device;
+	struct kgsl_context *context;
+	unsigned int timestamp;
+	kgsl_event_func func;
+	void *priv;
+	struct list_head node;
+	unsigned int created;
+	struct kthread_work work;
+	int result;
+	struct kgsl_event_group *group;
+};
+
+typedef int (*readtimestamp_func)(struct kgsl_device *, void *,
+	enum kgsl_timestamp_type, unsigned int *);
+
+/**
+ * struct event_group - A list of GPU events
+ * @context: Pointer to the active context for the events
+ * @lock: Spinlock for protecting the list
+ * @events: List of active GPU events
+ * @group: Node for the master group list
+ * @processed: Last processed timestamp
+ * @name: String name for the group (for the debugfs file)
+ * @readtimestamp: Function pointer to read a timestamp
+ * @priv: Priv member to pass to the readtimestamp function
+ */
+struct kgsl_event_group {
+	struct kgsl_context *context;
+	spinlock_t lock;
+	struct list_head events;
+	struct list_head group;
+	unsigned int processed;
+	char name[64];
+	readtimestamp_func readtimestamp;
+	void *priv;
+};
+
+/**
+ * struct submission_info - Container for submission statistics
+ * @inflight: Number of commands that are inflight
+ * @rb_id: id of the ringbuffer to which this submission is made
+ * @rptr: Read pointer of the ringbuffer
+ * @wptr: Write pointer of the ringbuffer
+ * @gmu_dispatch_queue: GMU dispach queue to which this submission is made
+ */
+struct submission_info {
+	int inflight;
+	u32 rb_id;
+	u32 rptr;
+	u32 wptr;
+	u32 gmu_dispatch_queue;
+};
+
+/**
+ * struct retire_info - Container for retire statistics
+ * @inflight: NUmber of commands that are inflight
+ * @rb_id: id of the ringbuffer to which this submission is made
+ * @rptr: Read pointer of the ringbuffer
+ * @wptr: Write pointer of the ringbuffer
+ * @gmu_dispatch_queue: GMU dispach queue to which this submission is made
+ * @timestamp: Timestamp of submission that retired
+ * @submitted_to_rb: AO ticks when GMU put this submission on ringbuffer
+ * @sop: AO ticks when GPU started procssing this submission
+ * @eop: AO ticks when GPU finished this submission
+ * @retired_on_gmu: AO ticks when GMU retired this submission
+ * @active: Number AO of ticks taken by GPU to complete the command
+ */
+struct retire_info {
+	int inflight;
+	int rb_id;
+	u32 rptr;
+	u32 wptr;
+	u32 gmu_dispatch_queue;
+	u32 timestamp;
+	u64 submitted_to_rb;
+	u64 sop;
+	u64 eop;
+	u64 retired_on_gmu;
+	u64 active;
+};
+
+long kgsl_ioctl_device_getproperty(struct kgsl_device_private *dev_priv,
+					  unsigned int cmd, void *data);
+long kgsl_ioctl_device_setproperty(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_device_waittimestamp_ctxtid(struct kgsl_device_private
+				*dev_priv, unsigned int cmd, void *data);
+long kgsl_ioctl_rb_issueibcmds(struct kgsl_device_private *dev_priv,
+				      unsigned int cmd, void *data);
+long kgsl_ioctl_submit_commands(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data);
+long kgsl_ioctl_cmdstream_readtimestamp_ctxtid(struct kgsl_device_private
+					*dev_priv, unsigned int cmd,
+					void *data);
+long kgsl_ioctl_cmdstream_freememontimestamp_ctxtid(
+						struct kgsl_device_private
+						*dev_priv, unsigned int cmd,
+						void *data);
+long kgsl_ioctl_drawctxt_create(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_drawctxt_destroy(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_sharedmem_free(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpumem_free_id(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_map_user_mem(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpumem_sync_cache(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpumem_sync_cache_bulk(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_sharedmem_flush_cache(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpumem_alloc(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpumem_alloc_id(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpumem_get_info(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_timestamp_event(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpuobj_alloc(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpuobj_free(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpuobj_info(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpuobj_import(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpuobj_sync(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data);
+long kgsl_ioctl_gpuobj_set_info(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data);
+long kgsl_ioctl_gpumem_bind_ranges(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data);
+long kgsl_ioctl_gpu_aux_command(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data);
+long kgsl_ioctl_timeline_create(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data);
+long kgsl_ioctl_timeline_wait(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data);
+long kgsl_ioctl_timeline_query(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data);
+long kgsl_ioctl_timeline_fence_get(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data);
+long kgsl_ioctl_timeline_signal(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data);
+long kgsl_ioctl_timeline_destroy(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data);
+long kgsl_ioctl_get_fault_report(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data);
+long kgsl_ioctl_recurring_command(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data);
+
+void kgsl_mem_entry_destroy(struct kref *kref);
+void kgsl_mem_entry_destroy_deferred(struct kref *kref);
+
+void kgsl_get_egl_counts(struct kgsl_mem_entry *entry,
+			int *egl_surface_count, int *egl_image_count);
+
+unsigned long kgsl_get_dmabuf_inode_number(struct kgsl_mem_entry *entry);
+
+struct kgsl_mem_entry * __must_check
+kgsl_sharedmem_find(struct kgsl_process_private *private, uint64_t gpuaddr);
+
+struct kgsl_mem_entry * __must_check
+kgsl_sharedmem_find_id(struct kgsl_process_private *process, unsigned int id);
+
+struct kgsl_mem_entry *gpumem_alloc_entry(struct kgsl_device_private *dev_priv,
+				uint64_t size, uint64_t flags);
+long gpumem_free_entry(struct kgsl_mem_entry *entry);
+
+enum kgsl_mmutype kgsl_mmu_get_mmutype(struct kgsl_device *device);
+
+/* Helper functions */
+int kgsl_request_irq(struct platform_device *pdev, const  char *name,
+		irq_handler_t handler, void *data);
+
+int __init kgsl_core_init(void);
+void kgsl_core_exit(void);
+
+static inline bool kgsl_gpuaddr_in_memdesc(const struct kgsl_memdesc *memdesc,
+				uint64_t gpuaddr, uint64_t size)
+{
+	if (IS_ERR_OR_NULL(memdesc))
+		return false;
+
+	/* set a minimum size to search for */
+	if (!size)
+		size = 1;
+
+	/* don't overflow */
+	if (size > U64_MAX - gpuaddr)
+		return false;
+
+	return (gpuaddr >= memdesc->gpuaddr &&
+	    ((gpuaddr + size) <= (memdesc->gpuaddr + memdesc->size)));
+}
+
+static inline void *kgsl_memdesc_map(struct kgsl_memdesc *memdesc)
+{
+	if (memdesc->ops && memdesc->ops->map_kernel)
+		memdesc->ops->map_kernel(memdesc);
+
+	return memdesc->hostptr;
+}
+
+static inline void kgsl_memdesc_unmap(struct kgsl_memdesc *memdesc)
+{
+	if (memdesc->ops && memdesc->ops->unmap_kernel)
+		memdesc->ops->unmap_kernel(memdesc);
+}
+
+static inline void *kgsl_gpuaddr_to_vaddr(struct kgsl_memdesc *memdesc,
+					     uint64_t gpuaddr)
+{
+	void *hostptr = NULL;
+
+	if ((gpuaddr >= memdesc->gpuaddr) &&
+		(gpuaddr < (memdesc->gpuaddr + memdesc->size)))
+		hostptr = kgsl_memdesc_map(memdesc);
+
+	return hostptr != NULL ? hostptr + (gpuaddr - memdesc->gpuaddr) : NULL;
+}
+
+static inline int timestamp_cmp(unsigned int a, unsigned int b)
+{
+	/* check for equal */
+	if (a == b)
+		return 0;
+
+	/* check for greater-than for non-rollover case */
+	if ((a > b) && (a - b < KGSL_TIMESTAMP_WINDOW))
+		return 1;
+
+	/* check for greater-than for rollover case
+	 * note that <= is required to ensure that consistent
+	 * results are returned for values whose difference is
+	 * equal to the window size
+	 */
+	a += KGSL_TIMESTAMP_WINDOW;
+	b += KGSL_TIMESTAMP_WINDOW;
+	return ((a > b) && (a - b <= KGSL_TIMESTAMP_WINDOW)) ? 1 : -1;
+}
+
+/**
+ * kgsl_schedule_work() - Schedule a work item on the KGSL workqueue
+ * @work: work item to schedule
+ */
+static inline void kgsl_schedule_work(struct work_struct *work)
+{
+	queue_work(kgsl_driver.workqueue, work);
+}
+
+static inline struct kgsl_mem_entry *
+kgsl_mem_entry_get(struct kgsl_mem_entry *entry)
+{
+	if (!IS_ERR_OR_NULL(entry) && kref_get_unless_zero(&entry->refcount))
+		return entry;
+
+	return NULL;
+}
+
+static inline void
+kgsl_mem_entry_put(struct kgsl_mem_entry *entry)
+{
+	if (!IS_ERR_OR_NULL(entry))
+		kref_put(&entry->refcount, kgsl_mem_entry_destroy);
+}
+
+/*
+ * kgsl_mem_entry_put_deferred() - Puts refcount and triggers deferred
+ * mem_entry destroy when refcount is the last refcount.
+ * @entry: memory entry to be put.
+ *
+ * Use this to put a memory entry when we don't want to block
+ * the caller while destroying memory entry.
+ */
+static inline void kgsl_mem_entry_put_deferred(struct kgsl_mem_entry *entry)
+{
+	if (entry)
+		kref_put(&entry->refcount, kgsl_mem_entry_destroy_deferred);
+}
+
+/*
+ * kgsl_addr_range_overlap() - Checks if 2 ranges overlap
+ * @gpuaddr1: Start of first address range
+ * @size1: Size of first address range
+ * @gpuaddr2: Start of second address range
+ * @size2: Size of second address range
+ *
+ * Function returns true if the 2 given address ranges overlap
+ * else false
+ */
+static inline bool kgsl_addr_range_overlap(uint64_t gpuaddr1,
+		uint64_t size1, uint64_t gpuaddr2, uint64_t size2)
+{
+	if ((size1 > (U64_MAX - gpuaddr1)) || (size2 > (U64_MAX - gpuaddr2)))
+		return false;
+	return !(((gpuaddr1 + size1) <= gpuaddr2) ||
+		(gpuaddr1 >= (gpuaddr2 + size2)));
+}
+
+/**
+ * kgsl_work_period_update() - To update application work period stats
+ * @device: Pointer to the KGSL device
+ * @period: GPU work period stats
+ * @active: Command active time
+ */
+void kgsl_work_period_update(struct kgsl_device *device,
+			struct gpu_work_period *period, u64 active);
+#endif /* __KGSL_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_bus.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_bus.c
@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/interconnect/qcom,icc.h>
+#include <linux/interconnect.h>
+#include <linux/of.h>
+#include <soc/qcom/of_common.h>
+
+#include "kgsl_bus.h"
+#include "kgsl_device.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+static u32 _ab_buslevel_update(struct kgsl_pwrctrl *pwr,
+		u32 ib)
+{
+	if (!ib)
+		return 0;
+
+	/*
+	 * In the absence of any other settings, make ab 25% of ib
+	 * where the ib vote is in kbps
+	 */
+	if ((!pwr->bus_percent_ab) && (!pwr->bus_ab_mbytes))
+		return 25 * ib / 100000;
+
+	if (pwr->bus_width)
+		return pwr->bus_ab_mbytes;
+
+	return (pwr->bus_percent_ab * pwr->bus_max) / 100;
+}
+
+int kgsl_bus_update(struct kgsl_device *device,
+			 enum kgsl_bus_vote vote_state)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int buslevel;
+	u32 ab;
+
+	/* the bus should be ON to update the active frequency */
+	if ((vote_state != KGSL_BUS_VOTE_OFF) &&
+		!(test_bit(KGSL_PWRFLAGS_AXI_ON, &pwr->power_flags)))
+		return 0;
+	/*
+	 * If the bus should remain on calculate our request and submit it,
+	 * otherwise request bus level 0, off.
+	 */
+	switch (vote_state) {
+	case KGSL_BUS_VOTE_OFF:
+		/* If the bus is being turned off, reset to default level */
+		pwr->cur_dcvs_buslevel = 0;
+		pwr->bus_mod = 0;
+		pwr->bus_percent_ab = 0;
+		pwr->bus_ab_mbytes = 0;
+		ab = 0;
+		break;
+	case KGSL_BUS_VOTE_ON:
+		{
+		/* FIXME: this might be wrong? */
+		int cur = pwr->pwrlevels[pwr->active_pwrlevel].bus_freq;
+
+		buslevel = min_t(int, pwr->pwrlevels[0].bus_max,
+				cur + pwr->bus_mod);
+		buslevel = max_t(int, buslevel, 1);
+		pwr->cur_dcvs_buslevel = buslevel;
+		ab = _ab_buslevel_update(pwr, pwr->ddr_table[buslevel]);
+		break;
+		}
+	case KGSL_BUS_VOTE_MINIMUM:
+		/* Request bus level 1, minimum non-zero value */
+		pwr->cur_dcvs_buslevel = 1;
+		pwr->bus_mod = 0;
+		pwr->bus_percent_ab = 0;
+		pwr->bus_ab_mbytes = 0;
+		ab = _ab_buslevel_update(pwr,
+			pwr->ddr_table[pwr->cur_dcvs_buslevel]);
+		break;
+	case KGSL_BUS_VOTE_RT_HINT_ON:
+		pwr->rt_bus_hint_active = true;
+		/* Only update IB during bus hint */
+		ab = pwr->cur_ab;
+		break;
+	case KGSL_BUS_VOTE_RT_HINT_OFF:
+		pwr->rt_bus_hint_active = false;
+		/* Only update IB during bus hint */
+		ab = pwr->cur_ab;
+		break;
+	}
+
+	buslevel = pwr->rt_bus_hint_active ?
+		max(pwr->cur_dcvs_buslevel, pwr->rt_bus_hint) :
+		pwr->cur_dcvs_buslevel;
+
+	return device->ftbl->gpu_bus_set(device, buslevel, ab);
+}
+
+#ifdef CONFIG_QCOM_KGSL_UPSTREAM
+void kgsl_icc_set_tag(struct kgsl_pwrctrl *pwr, int buslevel)
+{
+	icc_set_tag(pwr->icc_path, QCOM_ICC_TAG_ALWAYS);
+}
+#else
+void kgsl_icc_set_tag(struct kgsl_pwrctrl *pwr, int buslevel)
+{
+	if (buslevel == pwr->pwrlevels[0].bus_max)
+		icc_set_tag(pwr->icc_path, QCOM_ICC_TAG_ALWAYS | QCOM_ICC_TAG_PERF_MODE);
+	else
+		icc_set_tag(pwr->icc_path, QCOM_ICC_TAG_ALWAYS);
+}
+#endif
+
+static void validate_pwrlevels(struct kgsl_device *device, u32 *ibs,
+		int count)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int i;
+
+	for (i = 0; i < pwr->num_pwrlevels - 1; i++) {
+		struct kgsl_pwrlevel *pwrlevel = &pwr->pwrlevels[i];
+
+		if (pwrlevel->bus_freq >= count) {
+			dev_err(device->dev, "Bus setting for GPU freq %d is out of bounds\n",
+				pwrlevel->gpu_freq);
+			pwrlevel->bus_freq = count - 1;
+		}
+
+		if (pwrlevel->bus_max >= count) {
+			dev_err(device->dev, "Bus max for GPU freq %d is out of bounds\n",
+				pwrlevel->gpu_freq);
+			pwrlevel->bus_max = count - 1;
+		}
+
+		if (pwrlevel->bus_min >= count) {
+			dev_err(device->dev, "Bus min for GPU freq %d is out of bounds\n",
+				pwrlevel->gpu_freq);
+			pwrlevel->bus_min = count - 1;
+		}
+
+		if (pwrlevel->bus_min > pwrlevel->bus_max) {
+			dev_err(device->dev, "Bus min is bigger than bus max for GPU freq %d\n",
+				pwrlevel->gpu_freq);
+			pwrlevel->bus_min = pwrlevel->bus_max;
+		}
+	}
+}
+
+u32 *kgsl_bus_get_table(struct platform_device *pdev,
+		const char *name, int *count)
+{
+	u32 *levels;
+	int i, num = of_property_count_elems_of_size(pdev->dev.of_node,
+		name, sizeof(u32));
+
+	/* If the bus wasn't specified, then build a static table */
+	if (num <= 0)
+		return ERR_PTR(-EINVAL);
+
+	levels = kcalloc(num, sizeof(*levels), GFP_KERNEL);
+	if (!levels)
+		return ERR_PTR(-ENOMEM);
+
+	for (i = 0; i < num; i++)
+		of_property_read_u32_index(pdev->dev.of_node,
+			name, i, &levels[i]);
+
+	*count = num;
+	return levels;
+}
+
+int kgsl_bus_init(struct kgsl_device *device, struct platform_device *pdev)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int count;
+	int ddr = get_ddrtype();
+
+	if (ddr >= 0) {
+		char str[32];
+
+		snprintf(str, sizeof(str), "qcom,bus-table-ddr%d", ddr);
+
+		pwr->ddr_table = kgsl_bus_get_table(pdev, str, &count);
+		if (!IS_ERR(pwr->ddr_table))
+			goto done;
+	}
+
+	/* Look if a generic table is present */
+	pwr->ddr_table = kgsl_bus_get_table(pdev, "qcom,bus-table-ddr", &count);
+	if (IS_ERR(pwr->ddr_table)) {
+		int ret = PTR_ERR(pwr->ddr_table);
+
+		pwr->ddr_table = NULL;
+		return ret;
+	}
+done:
+	pwr->ddr_table_count = count;
+
+	validate_pwrlevels(device, pwr->ddr_table, pwr->ddr_table_count);
+
+	pwr->icc_path = of_icc_get(&pdev->dev, "gpu_icc_path");
+	if (IS_ERR(pwr->icc_path) && !gmu_core_scales_bandwidth(device)) {
+		WARN(1, "The CPU has no way to set the GPU bus levels\n");
+
+		kfree(pwr->ddr_table);
+		pwr->ddr_table = NULL;
+		return PTR_ERR(pwr->icc_path);
+	}
+
+	return 0;
+}
+
+void kgsl_bus_close(struct kgsl_device *device)
+{
+	kfree(device->pwrctrl.ddr_table);
+	device->pwrctrl.ddr_table = NULL;
+	icc_put(device->pwrctrl.icc_path);
+	device->pwrctrl.icc_path = NULL;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_bus.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_bus.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _KGSL_BUS_H
+#define _KGSL_BUS_H
+
+enum kgsl_bus_vote {
+	KGSL_BUS_VOTE_OFF = 0,
+	KGSL_BUS_VOTE_ON,
+	KGSL_BUS_VOTE_MINIMUM,
+	KGSL_BUS_VOTE_RT_HINT_OFF,
+	KGSL_BUS_VOTE_RT_HINT_ON,
+};
+
+struct kgsl_device;
+struct platform_device;
+struct kgsl_pwrctrl;
+
+int kgsl_bus_init(struct kgsl_device *device, struct platform_device *pdev);
+void kgsl_bus_close(struct kgsl_device *device);
+int kgsl_bus_update(struct kgsl_device *device, enum kgsl_bus_vote vote_state);
+void kgsl_icc_set_tag(struct kgsl_pwrctrl *pwr, int buslevel);
+
+u32 *kgsl_bus_get_table(struct platform_device *pdev,
+		const char *name, int *count);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_compat.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_compat.c
@@ -0,0 +1,397 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2013-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "kgsl_device.h"
+#include "kgsl_compat.h"
+#include "kgsl_sync.h"
+
+static long
+kgsl_ioctl_device_getproperty_compat(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data)
+{
+	struct kgsl_device_getproperty_compat *param32 = data;
+	struct kgsl_device_getproperty param;
+
+	param.type = param32->type;
+	param.value = compat_ptr(param32->value);
+	param.sizebytes = (size_t)param32->sizebytes;
+
+	return kgsl_ioctl_device_getproperty(dev_priv, cmd, &param);
+}
+
+static long
+kgsl_ioctl_device_setproperty_compat(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data)
+{
+	struct kgsl_device_getproperty_compat *param32 = data;
+	struct kgsl_device_getproperty param;
+
+	param.type = param32->type;
+	param.value = compat_ptr(param32->value);
+	param.sizebytes = (size_t)param32->sizebytes;
+
+	return kgsl_ioctl_device_setproperty(dev_priv, cmd, &param);
+}
+
+static long
+kgsl_ioctl_submit_commands_compat(struct kgsl_device_private *dev_priv,
+				      unsigned int cmd, void *data)
+{
+	int result;
+	struct kgsl_submit_commands_compat *param32 = data;
+	struct kgsl_submit_commands param;
+
+	param.context_id = param32->context_id;
+	param.flags = param32->flags;
+	param.cmdlist = compat_ptr(param32->cmdlist);
+	param.numcmds = param32->numcmds;
+	param.synclist = compat_ptr(param32->synclist);
+	param.numsyncs = param32->numsyncs;
+	param.timestamp = param32->timestamp;
+
+	result = kgsl_ioctl_submit_commands(dev_priv, cmd, &param);
+
+	param32->timestamp = param.timestamp;
+
+	return result;
+}
+
+static long
+kgsl_ioctl_rb_issueibcmds_compat(struct kgsl_device_private *dev_priv,
+				      unsigned int cmd, void *data)
+{
+	int result;
+	struct kgsl_ringbuffer_issueibcmds_compat *param32 = data;
+	struct kgsl_ringbuffer_issueibcmds param;
+
+	param.drawctxt_id = param32->drawctxt_id;
+	param.flags = param32->flags;
+	param.ibdesc_addr = (unsigned long)param32->ibdesc_addr;
+	param.numibs = param32->numibs;
+	param.timestamp = param32->timestamp;
+
+	result = kgsl_ioctl_rb_issueibcmds(dev_priv, cmd, &param);
+
+	param32->timestamp = param.timestamp;
+
+	return result;
+}
+
+static long kgsl_ioctl_cmdstream_freememontimestamp_ctxtid_compat(
+						struct kgsl_device_private
+						*dev_priv, unsigned int cmd,
+						void *data)
+{
+	struct kgsl_cmdstream_freememontimestamp_ctxtid_compat *param32 = data;
+	struct kgsl_cmdstream_freememontimestamp_ctxtid param;
+
+	param.context_id = param32->context_id;
+	param.gpuaddr = (unsigned long)param32->gpuaddr;
+	param.type = param32->type;
+	param.timestamp = param32->timestamp;
+
+	return kgsl_ioctl_cmdstream_freememontimestamp_ctxtid(dev_priv, cmd,
+								&param);
+}
+
+static long kgsl_ioctl_sharedmem_free_compat(struct kgsl_device_private
+					*dev_priv, unsigned int cmd,
+					void *data)
+{
+	struct kgsl_sharedmem_free_compat *param32 = data;
+	struct kgsl_sharedmem_free param;
+
+	param.gpuaddr = (unsigned long)param32->gpuaddr;
+
+	return kgsl_ioctl_sharedmem_free(dev_priv, cmd, &param);
+}
+
+static long kgsl_ioctl_map_user_mem_compat(struct kgsl_device_private
+					*dev_priv, unsigned int cmd,
+					void *data)
+{
+	int result = 0;
+	struct kgsl_map_user_mem_compat *param32 = data;
+	struct kgsl_map_user_mem param;
+
+	param.fd = param32->fd;
+	param.gpuaddr = (unsigned long)param32->gpuaddr;
+	param.len = (size_t)param32->len;
+	param.offset = (size_t)param32->offset;
+	param.hostptr = (unsigned long)param32->hostptr;
+	param.memtype = param32->memtype;
+	param.flags = param32->flags;
+
+	result = kgsl_ioctl_map_user_mem(dev_priv, cmd, &param);
+
+	param32->gpuaddr = gpuaddr_to_compat(param.gpuaddr);
+	param32->flags = param.flags;
+	return result;
+}
+
+static long
+kgsl_ioctl_gpumem_sync_cache_compat(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data)
+{
+	struct kgsl_gpumem_sync_cache_compat *param32 = data;
+	struct kgsl_gpumem_sync_cache param;
+
+	param.gpuaddr = (unsigned long)param32->gpuaddr;
+	param.id = param32->id;
+	param.op = param32->op;
+	param.offset = (size_t)param32->offset;
+	param.length = (size_t)param32->length;
+
+	return kgsl_ioctl_gpumem_sync_cache(dev_priv, cmd, &param);
+}
+
+static long
+kgsl_ioctl_gpumem_sync_cache_bulk_compat(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	struct kgsl_gpumem_sync_cache_bulk_compat *param32 = data;
+	struct kgsl_gpumem_sync_cache_bulk param;
+
+	param.id_list = compat_ptr(param32->id_list);
+	param.count = param32->count;
+	param.op = param32->op;
+
+	return kgsl_ioctl_gpumem_sync_cache_bulk(dev_priv, cmd, &param);
+}
+
+static long
+kgsl_ioctl_sharedmem_flush_cache_compat(struct kgsl_device_private *dev_priv,
+				 unsigned int cmd, void *data)
+{
+	struct kgsl_sharedmem_free_compat *param32 = data;
+	struct kgsl_sharedmem_free param;
+
+	param.gpuaddr = (unsigned long)param32->gpuaddr;
+
+	return kgsl_ioctl_sharedmem_flush_cache(dev_priv, cmd, &param);
+}
+
+static long
+kgsl_ioctl_gpumem_alloc_compat(struct kgsl_device_private *dev_priv,
+			unsigned int cmd, void *data)
+{
+	int result = 0;
+	struct kgsl_gpumem_alloc_compat *param32 = data;
+	struct kgsl_gpumem_alloc param;
+
+	param.gpuaddr = (unsigned long)param32->gpuaddr;
+	param.size = (size_t)param32->size;
+	param.flags = param32->flags;
+
+	/*
+	 * Since this is a 32 bit application the page aligned size is expected
+	 * to fit inside of 32 bits - check for overflow and return error if so
+	 */
+	if (PAGE_ALIGN(param.size) >= UINT_MAX)
+		return -EINVAL;
+
+	result = kgsl_ioctl_gpumem_alloc(dev_priv, cmd, &param);
+
+	param32->gpuaddr = gpuaddr_to_compat(param.gpuaddr);
+	param32->size = sizet_to_compat(param.size);
+	param32->flags = param.flags;
+
+	return result;
+}
+
+static long
+kgsl_ioctl_gpumem_alloc_id_compat(struct kgsl_device_private *dev_priv,
+			unsigned int cmd, void *data)
+{
+	int result = 0;
+	struct kgsl_gpumem_alloc_id_compat *param32 = data;
+	struct kgsl_gpumem_alloc_id param;
+
+	param.id = param32->id;
+	param.flags = param32->flags;
+	param.size = (size_t)param32->size;
+	param.mmapsize = (size_t)param32->mmapsize;
+	param.gpuaddr = (unsigned long)param32->gpuaddr;
+
+	/*
+	 * Since this is a 32 bit application the page aligned size is expected
+	 * to fit inside of 32 bits - check for overflow and return error if so
+	 */
+	if (PAGE_ALIGN(param.size) >= UINT_MAX)
+		return -EINVAL;
+
+	result = kgsl_ioctl_gpumem_alloc_id(dev_priv, cmd, &param);
+
+	param32->id = param.id;
+	param32->flags = param.flags;
+	param32->size = sizet_to_compat(param.size);
+	param32->mmapsize = sizet_to_compat(param.mmapsize);
+	param32->gpuaddr = gpuaddr_to_compat(param.gpuaddr);
+
+	return result;
+}
+
+static long
+kgsl_ioctl_gpumem_get_info_compat(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data)
+{
+	int result = 0;
+	struct kgsl_gpumem_get_info_compat *param32 = data;
+	struct kgsl_gpumem_get_info param;
+
+	param.gpuaddr = (unsigned long)param32->gpuaddr;
+	param.id = param32->id;
+	param.flags = param32->flags;
+	param.size = (size_t)param32->size;
+	param.mmapsize = (size_t)param32->mmapsize;
+	param.useraddr = (unsigned long)param32->useraddr;
+
+	result = kgsl_ioctl_gpumem_get_info(dev_priv, cmd, &param);
+
+	param32->gpuaddr = gpuaddr_to_compat(param.gpuaddr);
+	param32->id = param.id;
+	param32->flags = param.flags;
+	param32->size = sizet_to_compat(param.size);
+	param32->mmapsize = sizet_to_compat(param.mmapsize);
+	param32->useraddr = (compat_ulong_t)param.useraddr;
+
+	return result;
+}
+
+static long kgsl_ioctl_timestamp_event_compat(struct kgsl_device_private
+				*dev_priv, unsigned int cmd, void *data)
+{
+	struct kgsl_timestamp_event_compat *param32 = data;
+	struct kgsl_timestamp_event param;
+
+	param.type = param32->type;
+	param.timestamp = param32->timestamp;
+	param.context_id = param32->context_id;
+	param.priv = compat_ptr(param32->priv);
+	param.len = (size_t)param32->len;
+
+	return kgsl_ioctl_timestamp_event(dev_priv, cmd, &param);
+}
+
+
+static const struct kgsl_ioctl kgsl_compat_ioctl_funcs[] = {
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_DEVICE_GETPROPERTY_COMPAT,
+			kgsl_ioctl_device_getproperty_compat),
+	/* IOCTL_KGSL_DEVICE_WAITTIMESTAMP is no longer supported */
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_DEVICE_WAITTIMESTAMP_CTXTID,
+			kgsl_ioctl_device_waittimestamp_ctxtid),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_RINGBUFFER_ISSUEIBCMDS_COMPAT,
+			kgsl_ioctl_rb_issueibcmds_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SUBMIT_COMMANDS_COMPAT,
+			kgsl_ioctl_submit_commands_compat),
+	/* IOCTL_KGSL_CMDSTREAM_READTIMESTAMP is no longer supported */
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_CMDSTREAM_READTIMESTAMP_CTXTID,
+			kgsl_ioctl_cmdstream_readtimestamp_ctxtid),
+	/* IOCTL_KGSL_CMDSTREAM_FREEMEMONTIMESTAMP is no longer supported */
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_CMDSTREAM_FREEMEMONTIMESTAMP_CTXTID_COMPAT,
+			kgsl_ioctl_cmdstream_freememontimestamp_ctxtid_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_DRAWCTXT_CREATE,
+			kgsl_ioctl_drawctxt_create),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_DRAWCTXT_DESTROY,
+			kgsl_ioctl_drawctxt_destroy),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_MAP_USER_MEM_COMPAT,
+			kgsl_ioctl_map_user_mem_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SHAREDMEM_FREE_COMPAT,
+			kgsl_ioctl_sharedmem_free_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SHAREDMEM_FLUSH_CACHE_COMPAT,
+			kgsl_ioctl_sharedmem_flush_cache_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_ALLOC_COMPAT,
+			kgsl_ioctl_gpumem_alloc_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMESTAMP_EVENT_COMPAT,
+			kgsl_ioctl_timestamp_event_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SETPROPERTY_COMPAT,
+			kgsl_ioctl_device_setproperty_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_ALLOC_ID_COMPAT,
+			kgsl_ioctl_gpumem_alloc_id_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_FREE_ID,
+			kgsl_ioctl_gpumem_free_id),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_GET_INFO_COMPAT,
+			kgsl_ioctl_gpumem_get_info_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_SYNC_CACHE_COMPAT,
+			kgsl_ioctl_gpumem_sync_cache_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_SYNC_CACHE_BULK_COMPAT,
+			kgsl_ioctl_gpumem_sync_cache_bulk_compat),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SYNCSOURCE_CREATE,
+			kgsl_ioctl_syncsource_create),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SYNCSOURCE_DESTROY,
+			kgsl_ioctl_syncsource_destroy),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE,
+			kgsl_ioctl_syncsource_create_fence),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SYNCSOURCE_SIGNAL_FENCE,
+			kgsl_ioctl_syncsource_signal_fence),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_ALLOC,
+			kgsl_ioctl_gpuobj_alloc),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_FREE,
+			kgsl_ioctl_gpuobj_free),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_INFO,
+			kgsl_ioctl_gpuobj_info),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_IMPORT,
+			kgsl_ioctl_gpuobj_import),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_SYNC,
+			kgsl_ioctl_gpuobj_sync),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPU_COMMAND,
+			kgsl_ioctl_gpu_command),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_SET_INFO,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_PHYS_ALLOC,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_PHYS_FREE,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_VIRT_ALLOC,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_VIRT_FREE,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_BIND,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPU_SPARSE_COMMAND,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_BIND_RANGES,
+			kgsl_ioctl_gpumem_bind_ranges),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPU_AUX_COMMAND,
+			kgsl_ioctl_gpu_aux_command),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_CREATE,
+			kgsl_ioctl_timeline_create),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_WAIT,
+			kgsl_ioctl_timeline_wait),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_FENCE_GET,
+			kgsl_ioctl_timeline_fence_get),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_QUERY,
+			kgsl_ioctl_timeline_query),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_SIGNAL,
+			kgsl_ioctl_timeline_signal),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_DESTROY,
+			kgsl_ioctl_timeline_destroy),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GET_FAULT_REPORT,
+			kgsl_ioctl_get_fault_report),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_RECURRING_COMMAND,
+			kgsl_ioctl_recurring_command),
+};
+
+long kgsl_compat_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+{
+	struct kgsl_device_private *dev_priv = filep->private_data;
+	struct kgsl_device *device = dev_priv->device;
+
+	long ret = kgsl_ioctl_helper(filep, cmd, arg, kgsl_compat_ioctl_funcs,
+		ARRAY_SIZE(kgsl_compat_ioctl_funcs));
+
+	/*
+	 * If the command was unrecognized in the generic core, try the device
+	 * specific function
+	 */
+
+	if (ret == -ENOIOCTLCMD) {
+		if (device->ftbl->compat_ioctl != NULL)
+			return device->ftbl->compat_ioctl(dev_priv, cmd, arg);
+	}
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_compat.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_compat.h
@@ -0,0 +1,243 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2013-2017,2019,2021 The Linux Foundation. All rights reserved.
+ */
+#ifndef __KGSL_COMPAT_H
+#define __KGSL_COMPAT_H
+
+#include <linux/compat.h>
+#include <uapi/linux/msm_kgsl.h>
+
+#ifdef CONFIG_COMPAT
+
+struct kgsl_ibdesc_compat {
+	compat_ulong_t gpuaddr;
+	unsigned int __pad;
+	compat_size_t sizedwords;
+	unsigned int ctrl;
+};
+
+struct kgsl_cmd_syncpoint_compat {
+	int type;
+	compat_uptr_t priv;
+	compat_size_t size;
+};
+
+struct kgsl_devinfo_compat {
+	unsigned int device_id;
+	unsigned int chip_id;
+	unsigned int mmu_enabled;
+	compat_ulong_t gmem_gpubaseaddr;
+	unsigned int gpu_id;
+	compat_size_t gmem_sizebytes;
+};
+
+struct kgsl_shadowprop_compat {
+	compat_ulong_t gpuaddr;
+	compat_size_t size;
+	unsigned int flags;
+};
+
+struct kgsl_device_constraint_compat {
+	unsigned int type;
+	unsigned int context_id;
+	compat_uptr_t data;
+	compat_size_t size;
+};
+
+struct kgsl_device_getproperty_compat {
+	unsigned int type;
+	compat_uptr_t value;
+	compat_size_t sizebytes;
+};
+
+#define IOCTL_KGSL_DEVICE_GETPROPERTY_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x2, struct kgsl_device_getproperty_compat)
+
+#define IOCTL_KGSL_SETPROPERTY_COMPAT \
+	_IOW(KGSL_IOC_TYPE, 0x32, struct kgsl_device_getproperty_compat)
+
+
+struct kgsl_submit_commands_compat {
+	unsigned int context_id;
+	unsigned int flags;
+	compat_uptr_t cmdlist;
+	unsigned int numcmds;
+	compat_uptr_t synclist;
+	unsigned int numsyncs;
+	unsigned int timestamp;
+/* private: reserved for future use */
+	unsigned int __pad[4];
+};
+
+#define IOCTL_KGSL_SUBMIT_COMMANDS_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x3D, struct kgsl_submit_commands_compat)
+
+struct kgsl_ringbuffer_issueibcmds_compat {
+	unsigned int drawctxt_id;
+	compat_ulong_t ibdesc_addr;
+	unsigned int numibs;
+	unsigned int timestamp; /* output param */
+	unsigned int flags;
+};
+
+#define IOCTL_KGSL_RINGBUFFER_ISSUEIBCMDS_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x10, struct kgsl_ringbuffer_issueibcmds_compat)
+
+struct kgsl_cmdstream_freememontimestamp_ctxtid_compat {
+	unsigned int context_id;
+	compat_ulong_t gpuaddr;
+	unsigned int type;
+	unsigned int timestamp;
+};
+
+#define IOCTL_KGSL_CMDSTREAM_FREEMEMONTIMESTAMP_CTXTID_COMPAT \
+	_IOW(KGSL_IOC_TYPE, 0x17, \
+	struct kgsl_cmdstream_freememontimestamp_ctxtid_compat)
+
+struct kgsl_map_user_mem_compat {
+	int fd;
+	compat_ulong_t gpuaddr;
+	compat_size_t len;
+	compat_size_t offset;
+	compat_ulong_t hostptr;
+	enum kgsl_user_mem_type memtype;
+	unsigned int flags;
+};
+
+#define IOCTL_KGSL_MAP_USER_MEM_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x15, struct kgsl_map_user_mem_compat)
+
+struct kgsl_sharedmem_free_compat {
+	compat_ulong_t gpuaddr;
+};
+
+#define IOCTL_KGSL_SHAREDMEM_FLUSH_CACHE_COMPAT \
+	_IOW(KGSL_IOC_TYPE, 0x24, struct kgsl_sharedmem_free_compat)
+
+#define IOCTL_KGSL_SHAREDMEM_FREE_COMPAT \
+	_IOW(KGSL_IOC_TYPE, 0x21, struct kgsl_sharedmem_free_compat)
+
+struct kgsl_gpumem_alloc_compat {
+	compat_ulong_t gpuaddr; /* output param */
+	compat_size_t size;
+	unsigned int flags;
+};
+
+#define IOCTL_KGSL_GPUMEM_ALLOC_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x2f, struct kgsl_gpumem_alloc_compat)
+
+struct kgsl_cff_syncmem_compat {
+	compat_ulong_t gpuaddr;
+	compat_size_t len;
+	unsigned int __pad[2]; /* For future binary compatibility */
+};
+
+#define IOCTL_KGSL_CFF_SYNCMEM_COMPAT \
+	_IOW(KGSL_IOC_TYPE, 0x30, struct kgsl_cff_syncmem_compat)
+
+struct kgsl_timestamp_event_compat {
+	int type;                /* Type of event (see list below) */
+	unsigned int timestamp;  /* Timestamp to trigger event on */
+	unsigned int context_id; /* Context for the timestamp */
+	compat_uptr_t priv;      /* Pointer to the event specific blob */
+	compat_size_t len;       /* Size of the event specific blob */
+};
+
+#define IOCTL_KGSL_TIMESTAMP_EVENT_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x33, struct kgsl_timestamp_event_compat)
+
+struct kgsl_gpumem_alloc_id_compat {
+	unsigned int id;
+	unsigned int flags;
+	compat_size_t size;
+	compat_size_t mmapsize;
+	compat_ulong_t gpuaddr;
+/* private: reserved for future use*/
+	unsigned int __pad[2];
+};
+
+#define IOCTL_KGSL_GPUMEM_ALLOC_ID_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x34, struct kgsl_gpumem_alloc_id_compat)
+
+struct kgsl_gpumem_get_info_compat {
+	compat_ulong_t gpuaddr;
+	unsigned int id;
+	unsigned int flags;
+	compat_size_t size;
+	compat_size_t mmapsize;
+	compat_ulong_t useraddr;
+/* private: reserved for future use*/
+	unsigned int __pad[4];
+};
+
+#define IOCTL_KGSL_GPUMEM_GET_INFO_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x36, struct kgsl_gpumem_get_info_compat)
+
+struct kgsl_gpumem_sync_cache_compat {
+	compat_ulong_t gpuaddr;
+	unsigned int id;
+	unsigned int op;
+	compat_size_t offset;
+	compat_size_t length;
+};
+
+#define IOCTL_KGSL_GPUMEM_SYNC_CACHE_COMPAT \
+	_IOW(KGSL_IOC_TYPE, 0x37, struct kgsl_gpumem_sync_cache_compat)
+
+struct kgsl_gpumem_sync_cache_bulk_compat {
+	compat_uptr_t id_list;
+	unsigned int count;
+	unsigned int op;
+/* private: reserved for future use */
+	unsigned int __pad[2]; /* For future binary compatibility */
+};
+
+#define IOCTL_KGSL_GPUMEM_SYNC_CACHE_BULK_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x3C, struct kgsl_gpumem_sync_cache_bulk_compat)
+
+struct kgsl_perfcounter_query_compat {
+	unsigned int groupid;
+	compat_uptr_t countables;
+	unsigned int count;
+	unsigned int max_counters;
+	unsigned int __pad[2];
+};
+
+#define IOCTL_KGSL_PERFCOUNTER_QUERY_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x3A, struct kgsl_perfcounter_query_compat)
+
+struct kgsl_perfcounter_read_compat {
+	compat_uptr_t reads;
+	unsigned int count;
+	unsigned int __pad[2];
+};
+
+#define IOCTL_KGSL_PERFCOUNTER_READ_COMPAT \
+	_IOWR(KGSL_IOC_TYPE, 0x3B, struct kgsl_perfcounter_read_compat)
+
+static inline compat_ulong_t gpuaddr_to_compat(unsigned long gpuaddr)
+{
+	WARN(gpuaddr >> 32, "Top 32 bits of gpuaddr have been set\n");
+	return (compat_ulong_t)gpuaddr;
+}
+
+static inline compat_size_t sizet_to_compat(size_t size)
+{
+	WARN(size >> 32, "Size greater than 4G\n");
+	return (compat_size_t)size;
+}
+
+long kgsl_compat_ioctl(struct file *filep, unsigned int cmd,
+			unsigned long arg);
+
+#else
+
+static inline long kgsl_compat_ioctl(struct file *filep, unsigned int cmd,
+			unsigned long arg)
+{
+	return -EINVAL;
+}
+
+#endif /* CONFIG_COMPAT */
+#endif /* __KGSL_COMPAT_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_debugfs.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_debugfs.c
@@ -0,0 +1,459 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2002,2008-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/io.h>
+
+#include "kgsl_debugfs.h"
+#include "kgsl_device.h"
+#include "kgsl_pool.h"
+#include "kgsl_sharedmem.h"
+
+struct dentry *kgsl_debugfs_dir, *mempools_debugfs;
+static struct dentry *proc_d_debugfs;
+
+static void kgsl_qdss_gfx_register_probe(struct kgsl_device *device)
+{
+	struct resource *res;
+
+	res = platform_get_resource_byname(device->pdev, IORESOURCE_MEM,
+							"qdss_gfx");
+
+	if (res == NULL)
+		return;
+
+	device->qdss_gfx_virt = devm_ioremap(&device->pdev->dev, res->start,
+							resource_size(res));
+
+	if (device->qdss_gfx_virt == NULL)
+		dev_warn(device->dev, "qdss_gfx ioremap failed\n");
+}
+
+static int _isdb_set(void *data, u64 val)
+{
+	struct kgsl_device *device = data;
+
+	if (device->qdss_gfx_virt == NULL)
+		kgsl_qdss_gfx_register_probe(device);
+
+	device->set_isdb_breakpoint = val ? true : false;
+	return 0;
+}
+
+static int _isdb_get(void *data, u64 *val)
+{
+	struct kgsl_device *device = data;
+
+	*val = device->set_isdb_breakpoint ? 1 : 0;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(_isdb_fops, _isdb_get, _isdb_set, "%llu\n");
+
+static int globals_show(struct seq_file *s, void *unused)
+{
+	struct kgsl_device *device = s->private;
+	struct kgsl_global_memdesc *md;
+
+	list_for_each_entry(md, &device->globals, node) {
+		struct kgsl_memdesc *memdesc = &md->memdesc;
+		char flags[6];
+
+		flags[0] = memdesc->priv & KGSL_MEMDESC_PRIVILEGED ?  'p' : '-';
+		flags[1] = !(memdesc->flags & KGSL_MEMFLAGS_GPUREADONLY) ? 'w' : '-';
+		flags[2] = kgsl_memdesc_is_secured(memdesc) ?  's' : '-';
+		flags[3] = memdesc->priv & KGSL_MEMDESC_RANDOM ?  'r' : '-';
+		flags[4] = memdesc->priv & KGSL_MEMDESC_UCODE ? 'u' : '-';
+		flags[5] = '\0';
+
+		seq_printf(s, "0x%pK-0x%pK %16llu %5s %s\n",
+			(u64 *)(uintptr_t) memdesc->gpuaddr,
+			(u64 *)(uintptr_t) (memdesc->gpuaddr +
+			memdesc->size - 1), memdesc->size, flags,
+			md->name);
+	}
+
+	return 0;
+}
+
+DEFINE_SHOW_ATTRIBUTE(globals);
+
+static int _pool_size_get(void *data, u64 *val)
+{
+	*val = (u64) kgsl_pool_size_total();
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(_pool_size_fops, _pool_size_get, NULL, "%llu\n");
+
+DEFINE_DEBUGFS_ATTRIBUTE(_reserved_fops,
+					kgsl_pool_reserved_get, NULL, "%llu\n");
+DEFINE_DEBUGFS_ATTRIBUTE(_page_count_fops,
+					kgsl_pool_page_count_get, NULL, "%llu\n");
+
+void kgsl_pool_init_debugfs(struct dentry *pool_debugfs,
+					char *name, void *pool)
+{
+	struct dentry *dentry;
+
+	pool_debugfs = debugfs_create_dir(name, mempools_debugfs);
+
+	if (IS_ERR_OR_NULL(pool_debugfs)) {
+		WARN((pool_debugfs == NULL),
+			"Unable to create debugfs dir for %s\n", name);
+		pool_debugfs = NULL;
+		return;
+	}
+
+	dentry = debugfs_create_file("reserved", 0444,
+		pool_debugfs, pool, &_reserved_fops);
+
+	WARN((IS_ERR_OR_NULL(dentry)),
+		"Unable to create 'reserved' file for %s\n", name);
+
+	dentry = debugfs_create_file("count", 0444,
+		pool_debugfs, pool, &_page_count_fops);
+
+	WARN((IS_ERR_OR_NULL(dentry)),
+		"Unable to create 'count' file for %s\n", name);
+}
+
+void kgsl_device_debugfs_init(struct kgsl_device *device)
+{
+	struct dentry *snapshot_dir;
+
+	if (IS_ERR_OR_NULL(kgsl_debugfs_dir))
+		return;
+
+	device->d_debugfs = debugfs_create_dir(device->name,
+						       kgsl_debugfs_dir);
+
+	debugfs_create_file("globals", 0444, device->d_debugfs, device,
+		&globals_fops);
+
+	snapshot_dir = debugfs_create_dir("snapshot", kgsl_debugfs_dir);
+	debugfs_create_file("break_isdb", 0644, snapshot_dir, device,
+		&_isdb_fops);
+}
+
+void kgsl_device_debugfs_close(struct kgsl_device *device)
+{
+	debugfs_remove_recursive(device->d_debugfs);
+}
+
+static const char *memtype_str(int memtype)
+{
+	if (memtype == KGSL_MEM_ENTRY_KERNEL)
+		return "gpumem";
+	else if (memtype == KGSL_MEM_ENTRY_USER)
+		return "usermem";
+	else if (memtype == KGSL_MEM_ENTRY_ION)
+		return "ion";
+
+	return "unknown";
+}
+
+static char get_alignflag(const struct kgsl_memdesc *m)
+{
+	int align = kgsl_memdesc_get_align(m);
+
+	if (align >= ilog2(SZ_1M))
+		return 'L';
+	else if (align >= ilog2(SZ_64K))
+		return 'l';
+	return '-';
+}
+
+static char get_cacheflag(const struct kgsl_memdesc *m)
+{
+	static const char table[] = {
+		[KGSL_CACHEMODE_WRITECOMBINE] = '-',
+		[KGSL_CACHEMODE_UNCACHED] = 'u',
+		[KGSL_CACHEMODE_WRITEBACK] = 'b',
+		[KGSL_CACHEMODE_WRITETHROUGH] = 't',
+	};
+
+	return table[kgsl_memdesc_get_cachemode(m)];
+}
+
+
+static int print_mem_entry(void *data, void *ptr)
+{
+	struct seq_file *s = data;
+	struct kgsl_mem_entry *entry = ptr;
+	char flags[11];
+	char usage[16];
+	struct kgsl_memdesc *m = &entry->memdesc;
+	unsigned int usermem_type = kgsl_memdesc_usermem_type(m);
+	int egl_surface_count = 0, egl_image_count = 0;
+	unsigned long inode_number = 0;
+	u32 map_count = atomic_read(&entry->map_count);
+
+	flags[0] = kgsl_memdesc_is_global(m) ?  'g' : '-';
+	flags[1] = '-';
+	flags[2] = !(m->flags & KGSL_MEMFLAGS_GPUREADONLY) ? 'w' : '-';
+	flags[3] = get_alignflag(m);
+	flags[4] = get_cacheflag(m);
+	flags[5] = kgsl_memdesc_use_cpu_map(m) ? 'p' : '-';
+	/* Show Y if at least one vma has this entry mapped (could be multiple) */
+	flags[6] = map_count ? 'Y' : 'N';
+	flags[7] = kgsl_memdesc_is_secured(m) ?  's' : '-';
+	flags[8] = '-';
+	flags[9] = m->flags & KGSL_MEMFLAGS_VBO ? 'v' : '-';
+	flags[10] = '\0';
+
+	kgsl_get_memory_usage(usage, sizeof(usage), m->flags);
+
+	if (usermem_type == KGSL_MEM_ENTRY_ION) {
+		kgsl_get_egl_counts(entry, &egl_surface_count,
+						&egl_image_count);
+		inode_number = kgsl_get_dmabuf_inode_number(entry);
+	}
+
+	seq_printf(s, "%pK %pK %16llu %5d %10s %10s %16s %5d %10d %6d %6d %10lu",
+			(uint64_t *)(uintptr_t) m->gpuaddr,
+			/*
+			 * Show zero for the useraddr - we can't reliably track
+			 * that value for multiple vmas anyway
+			 */
+			NULL, m->size, entry->id, flags,
+			memtype_str(usermem_type),
+			usage, (m->sgt ? m->sgt->nents : 0), map_count,
+			egl_surface_count, egl_image_count, inode_number);
+
+	if (entry->metadata[0] != 0)
+		seq_printf(s, " %s", entry->metadata);
+
+	seq_putc(s, '\n');
+
+	return 0;
+}
+
+static struct kgsl_mem_entry *process_mem_seq_find(struct seq_file *s,
+						void *ptr, loff_t pos)
+{
+	struct kgsl_mem_entry *entry = ptr;
+	struct kgsl_process_private *private = s->private;
+	int id = 0;
+
+	loff_t temp_pos = 1;
+
+	if (entry != SEQ_START_TOKEN)
+		id = entry->id + 1;
+
+	spin_lock(&private->mem_lock);
+	for (entry = idr_get_next(&private->mem_idr, &id); entry;
+		id++, entry = idr_get_next(&private->mem_idr, &id),
+							temp_pos++) {
+		if (temp_pos == pos && kgsl_mem_entry_get(entry)) {
+			spin_unlock(&private->mem_lock);
+			goto found;
+		}
+	}
+	spin_unlock(&private->mem_lock);
+
+	entry = NULL;
+found:
+	if (ptr != SEQ_START_TOKEN)
+		kgsl_mem_entry_put(ptr);
+
+	return entry;
+}
+
+static void *process_mem_seq_start(struct seq_file *s, loff_t *pos)
+{
+	loff_t seq_file_offset = *pos;
+
+	if (seq_file_offset == 0)
+		return SEQ_START_TOKEN;
+	else
+		return process_mem_seq_find(s, SEQ_START_TOKEN,
+						seq_file_offset);
+}
+
+static void process_mem_seq_stop(struct seq_file *s, void *ptr)
+{
+	if (ptr && ptr != SEQ_START_TOKEN)
+		kgsl_mem_entry_put(ptr);
+}
+
+static void *process_mem_seq_next(struct seq_file *s, void *ptr,
+							loff_t *pos)
+{
+	++*pos;
+	return process_mem_seq_find(s, ptr, 1);
+}
+
+static int process_mem_seq_show(struct seq_file *s, void *ptr)
+{
+	if (ptr == SEQ_START_TOKEN) {
+		seq_printf(s, "%16s %16s %16s %5s %10s %10s %16s %5s %10s %6s %6s %10s\n",
+			"gpuaddr", "useraddr", "size", "id", "flags", "type",
+			"usage", "sglen", "mapcnt", "eglsrf", "eglimg", "inode");
+		return 0;
+	} else
+		return print_mem_entry(s, ptr);
+}
+
+static const struct seq_operations process_mem_seq_fops = {
+	.start = process_mem_seq_start,
+	.stop = process_mem_seq_stop,
+	.next = process_mem_seq_next,
+	.show = process_mem_seq_show,
+};
+
+static int process_mem_open(struct inode *inode, struct file *file)
+{
+	int ret;
+	pid_t pid = (pid_t) (unsigned long) inode->i_private;
+	struct seq_file *s = NULL;
+	struct kgsl_process_private *private = NULL;
+
+	private = kgsl_process_private_find(pid);
+
+	if (!private)
+		return -ENODEV;
+
+	ret = seq_open(file, &process_mem_seq_fops);
+	if (ret)
+		kgsl_process_private_put(private);
+	else {
+		s = file->private_data;
+		s->private = private;
+	}
+
+	return ret;
+}
+
+static int process_mem_release(struct inode *inode, struct file *file)
+{
+	struct kgsl_process_private *private =
+		((struct seq_file *)file->private_data)->private;
+
+	if (private)
+		kgsl_process_private_put(private);
+
+	return seq_release(inode, file);
+}
+
+static const struct file_operations process_mem_fops = {
+	.open = process_mem_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = process_mem_release,
+};
+
+
+static int print_vbo_ranges(int id, void *ptr, void *data)
+{
+	kgsl_memdesc_print_vbo_ranges(ptr, data);
+	return 0;
+}
+
+static int vbo_print(struct seq_file *s, void *unused)
+{
+	struct kgsl_process_private *private = s->private;
+
+	seq_puts(s, "id    child range\n");
+
+	spin_lock(&private->mem_lock);
+	idr_for_each(&private->mem_idr, print_vbo_ranges, s);
+	spin_unlock(&private->mem_lock);
+
+	return 0;
+}
+
+static int vbo_open(struct inode *inode, struct file *file)
+{
+	pid_t pid = (pid_t) (unsigned long) inode->i_private;
+	struct kgsl_process_private *private;
+	int ret;
+
+	private = kgsl_process_private_find(pid);
+
+	if (!private)
+		return -ENODEV;
+
+	ret = single_open(file, vbo_print, private);
+	if (ret)
+		kgsl_process_private_put(private);
+
+	return ret;
+}
+
+static const struct file_operations vbo_fops = {
+	.open = vbo_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	/* Reuse the same release function */
+	.release = process_mem_release,
+};
+
+/**
+ * kgsl_process_init_debugfs() - Initialize debugfs for a process
+ * @private: Pointer to process private structure created for the process
+ *
+ * kgsl_process_init_debugfs() is called at the time of creating the
+ * process struct when a process opens kgsl device for the first time.
+ * This function is not fatal - all we do is print a warning message if
+ * the files can't be created
+ */
+void kgsl_process_init_debugfs(struct kgsl_process_private *private)
+{
+	unsigned char name[16];
+	struct dentry *dentry;
+
+	snprintf(name, sizeof(name), "%d", pid_nr(private->pid));
+
+	private->debug_root = debugfs_create_dir(name, proc_d_debugfs);
+
+	if (IS_ERR(private->debug_root)) {
+		WARN_ONCE("Unable to create debugfs dir for %s\n", name);
+		private->debug_root = NULL;
+		return;
+	}
+
+	dentry = debugfs_create_file("mem", 0444, private->debug_root,
+		(void *) ((unsigned long) pid_nr(private->pid)), &process_mem_fops);
+
+	if (IS_ERR(dentry))
+		WARN_ONCE("Unable to create 'mem' file for %s\n", name);
+
+	debugfs_create_file("vbos", 0444, private->debug_root,
+		(void *) ((unsigned long) pid_nr(private->pid)), &vbo_fops);
+}
+
+void kgsl_core_debugfs_init(void)
+{
+	struct dentry *debug_dir, *dentry;
+
+	kgsl_debugfs_dir = debugfs_create_dir("kgsl", NULL);
+	if (IS_ERR_OR_NULL(kgsl_debugfs_dir))
+		return;
+
+	debug_dir = debugfs_create_dir("debug", kgsl_debugfs_dir);
+
+	proc_d_debugfs = debugfs_create_dir("proc", kgsl_debugfs_dir);
+
+	debugfs_create_bool("strict_memory", 0644, debug_dir,
+		&kgsl_sharedmem_noretry_flag);
+
+	mempools_debugfs = debugfs_create_dir("mempools", kgsl_debugfs_dir);
+
+	if (IS_ERR_OR_NULL(mempools_debugfs))
+		return;
+
+	dentry = debugfs_create_file("pool_size", 0444,
+		mempools_debugfs, NULL, &_pool_size_fops);
+
+	WARN((IS_ERR_OR_NULL(dentry)),
+		"Unable to create 'pool_size' file for mempools\n");
+}
+
+void kgsl_core_debugfs_close(void)
+{
+	debugfs_remove_recursive(kgsl_debugfs_dir);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_debugfs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_debugfs.h
@@ -0,0 +1,41 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2002,2008-2011,2013,2015,2017,2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef _KGSL_DEBUGFS_H
+#define _KGSL_DEBUGFS_H
+
+struct kgsl_device;
+struct kgsl_process_private;
+
+#ifdef CONFIG_DEBUG_FS
+void kgsl_core_debugfs_init(void);
+void kgsl_core_debugfs_close(void);
+
+void kgsl_device_debugfs_init(struct kgsl_device *device);
+void kgsl_device_debugfs_close(struct kgsl_device *device);
+
+extern struct dentry *kgsl_debugfs_dir;
+static inline struct dentry *kgsl_get_debugfs_dir(void)
+{
+	return kgsl_debugfs_dir;
+}
+
+void kgsl_pool_init_debugfs(struct dentry *pool_debugfs,
+					char *name, void *pool);
+void kgsl_process_init_debugfs(struct kgsl_process_private *priv);
+#else
+static inline void kgsl_core_debugfs_init(void) { }
+static inline void kgsl_device_debugfs_init(struct kgsl_device *device) { }
+static inline void kgsl_device_debugfs_close(struct kgsl_device *device) { }
+static inline void kgsl_core_debugfs_close(void) { }
+static inline struct dentry *kgsl_get_debugfs_dir(void) { return NULL; }
+static inline void kgsl_pool_init_debugfs(struct dentry *pool_debugfs,
+					char *name, void *pool) { }
+static inline void kgsl_process_init_debugfs(struct kgsl_process_private *priv)
+{
+}
+#endif
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_device.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_device.h
@@ -0,0 +1,1093 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_DEVICE_H
+#define __KGSL_DEVICE_H
+
+#include <linux/sched/mm.h>
+#include <linux/sched/task.h>
+#include <trace/events/gpu_mem.h>
+
+#include "kgsl.h"
+#include "kgsl_drawobj.h"
+#include "kgsl_mmu.h"
+#include "kgsl_regmap.h"
+
+#define KGSL_IOCTL_FUNC(_cmd, _func) \
+	[_IOC_NR((_cmd))] = \
+		{ .cmd = (_cmd), .func = (_func) }
+
+/*
+ * KGSL device state is initialized to INIT when platform_probe		*
+ * successfully initialized the device.  Once a device has been opened	*
+ * (started) it becomes active.  NAP implies that only low latency	*
+ * resources (for now clocks on some platforms) are off.  SLEEP implies	*
+ * that the KGSL module believes a device is idle (has been inactive	*
+ * past its timer) and all system resources are released.  SUSPEND is	*
+ * requested by the kernel and will be enforced upon all open devices.	*
+ * RESET indicates that GPU or GMU hang happens. KGSL is handling	*
+ * snapshot or recover GPU from hang. MINBW implies that DDR BW vote is	*
+ * set to non-zero minimum value.
+ */
+
+#define KGSL_STATE_NONE		0x00000000
+#define KGSL_STATE_INIT		0x00000001
+#define KGSL_STATE_ACTIVE	0x00000002
+#define KGSL_STATE_NAP		0x00000004 /* Not Used */
+#define KGSL_STATE_SUSPEND	0x00000010
+#define KGSL_STATE_AWARE	0x00000020
+#define KGSL_STATE_SLUMBER	0x00000080
+#define KGSL_STATE_MINBW	0x00000100 /* Not Used */
+
+/**
+ * enum kgsl_event_results - result codes passed to an event callback when the
+ * event is retired or cancelled
+ * @KGSL_EVENT_RETIRED: The timestamp associated with the event retired
+ * successflly
+ * @KGSL_EVENT_CANCELLED: The event was cancelled before the event was fired
+ */
+enum kgsl_event_results {
+	KGSL_EVENT_RETIRED = 1,
+	KGSL_EVENT_CANCELLED = 2,
+};
+
+/*
+ * "list" of event types for ftrace symbolic magic
+ */
+
+#define KGSL_CONTEXT_FLAGS \
+	{ KGSL_CONTEXT_NO_GMEM_ALLOC, "NO_GMEM_ALLOC" }, \
+	{ KGSL_CONTEXT_PREAMBLE, "PREAMBLE" }, \
+	{ KGSL_CONTEXT_TRASH_STATE, "TRASH_STATE" }, \
+	{ KGSL_CONTEXT_CTX_SWITCH, "CTX_SWITCH" }, \
+	{ KGSL_CONTEXT_PER_CONTEXT_TS, "PER_CONTEXT_TS" }, \
+	{ KGSL_CONTEXT_USER_GENERATED_TS, "USER_TS" }, \
+	{ KGSL_CONTEXT_NO_FAULT_TOLERANCE, "NO_FT" }, \
+	{ KGSL_CONTEXT_INVALIDATE_ON_FAULT, "INVALIDATE_ON_FAULT" }, \
+	{ KGSL_CONTEXT_PWR_CONSTRAINT, "PWR" }, \
+	{ KGSL_CONTEXT_SAVE_GMEM, "SAVE_GMEM" }, \
+	{ KGSL_CONTEXT_IFH_NOP, "IFH_NOP" }, \
+	{ KGSL_CONTEXT_SECURE, "SECURE" }, \
+	{ KGSL_CONTEXT_LPAC, "LPAC" }, \
+	{ KGSL_CONTEXT_NO_SNAPSHOT, "NO_SNAPSHOT" }
+
+#define KGSL_CONTEXT_ID(_context) \
+	((_context != NULL) ? (_context)->id : KGSL_MEMSTORE_GLOBAL)
+
+struct kgsl_device;
+struct platform_device;
+struct kgsl_device_private;
+struct kgsl_context;
+struct kgsl_power_stats;
+struct kgsl_event;
+struct kgsl_snapshot;
+struct kgsl_sync_fence;
+
+struct kgsl_functable {
+	/* Mandatory functions - these functions must be implemented
+	 * by the client device.  The driver will not check for a NULL
+	 * pointer before calling the hook.
+	 */
+	int (*suspend_context)(struct kgsl_device *device);
+	int (*first_open)(struct kgsl_device *device);
+	int (*last_close)(struct kgsl_device *device);
+	int (*start)(struct kgsl_device *device, int priority);
+	int (*stop)(struct kgsl_device *device);
+	int (*getproperty)(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param);
+	int (*getproperty_compat)(struct kgsl_device *device,
+		struct kgsl_device_getproperty *param);
+	int (*waittimestamp)(struct kgsl_device *device,
+		struct kgsl_context *context, unsigned int timestamp,
+		unsigned int msecs);
+	int (*readtimestamp)(struct kgsl_device *device, void *priv,
+		enum kgsl_timestamp_type type, unsigned int *timestamp);
+	int (*queue_cmds)(struct kgsl_device_private *dev_priv,
+		struct kgsl_context *context, struct kgsl_drawobj *drawobj[],
+		uint32_t count, uint32_t *timestamp);
+	void (*power_stats)(struct kgsl_device *device,
+		struct kgsl_power_stats *stats);
+	void (*snapshot)(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot, struct kgsl_context *context,
+		struct kgsl_context *context_lpac);
+	/** @drain_and_idle: Drain the GPU and wait for it to idle */
+	int (*drain_and_idle)(struct kgsl_device *device);
+	struct kgsl_device_private * (*device_private_create)(void);
+	void (*device_private_destroy)(struct kgsl_device_private *dev_priv);
+	/*
+	 * Optional functions - these functions are not mandatory.  The
+	 * driver will check that the function pointer is not NULL before
+	 * calling the hook
+	 */
+	struct kgsl_context *(*drawctxt_create)
+				(struct kgsl_device_private *dev_priv,
+						uint32_t *flags);
+	void (*drawctxt_detach)(struct kgsl_context *context);
+	void (*drawctxt_destroy)(struct kgsl_context *context);
+	void (*drawctxt_dump)(struct kgsl_device *device,
+		struct kgsl_context *context);
+	long (*ioctl)(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, unsigned long arg);
+	long (*compat_ioctl)(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, unsigned long arg);
+	int (*setproperty)(struct kgsl_device_private *dev_priv,
+		unsigned int type, void __user *value,
+		unsigned int sizebytes);
+	int (*setproperty_compat)(struct kgsl_device_private *dev_priv,
+		unsigned int type, void __user *value,
+		unsigned int sizebytes);
+	void (*drawctxt_sched)(struct kgsl_device *device,
+		struct kgsl_context *context);
+	void (*resume)(struct kgsl_device *device);
+	int (*regulator_enable)(struct kgsl_device *device);
+	bool (*is_hw_collapsible)(struct kgsl_device *device);
+	void (*regulator_disable)(struct kgsl_device *device);
+	void (*pwrlevel_change_settings)(struct kgsl_device *device,
+		unsigned int prelevel, unsigned int postlevel, bool post);
+	/**
+	 * @query_property_list: query the list of properties
+	 * supported by the device. If 'list' is NULL just return the total
+	 * number of properties available otherwise copy up to 'count' items
+	 * into the list and return the total number of items copied.
+	 */
+	int (*query_property_list)(struct kgsl_device *device, u32 *list,
+		u32 count);
+	bool (*is_hwcg_on)(struct kgsl_device *device);
+	/** @gpu_clock_set: Target specific function to set gpu frequency */
+	int (*gpu_clock_set)(struct kgsl_device *device, u32 pwrlevel);
+	/** @gpu_bus_set: Target specific function to set gpu bandwidth */
+	int (*gpu_bus_set)(struct kgsl_device *device, int bus_level, u32 ab);
+	void (*deassert_gbif_halt)(struct kgsl_device *device);
+	/** @queue_recurring_cmd: Queue recurring commands to GMU */
+	int (*queue_recurring_cmd)(struct kgsl_device_private *dev_priv,
+		struct kgsl_context *context, struct kgsl_drawobj *drawobj);
+	/** @dequeue_recurring_cmd: Dequeue recurring commands from GMU */
+	int (*dequeue_recurring_cmd)(struct kgsl_device *device,
+		struct kgsl_context *context);
+	/** set_isdb_breakpoint_registers: Program isdb registers to issue break command */
+	void (*set_isdb_breakpoint_registers)(struct kgsl_device *device);
+	/** @create_hw_fence: Create a hardware fence */
+	void (*create_hw_fence)(struct kgsl_device *device, struct kgsl_sync_fence *kfence);
+};
+
+struct kgsl_ioctl {
+	unsigned int cmd;
+	long (*func)(struct kgsl_device_private *dev_priv,
+				unsigned int cmd, void *data);
+};
+
+long kgsl_ioctl_helper(struct file *filep, unsigned int cmd, unsigned long arg,
+		const struct kgsl_ioctl *cmds, int len);
+
+/* Flag to mark that the memobj_node should not go to the hadrware */
+#define MEMOBJ_SKIP BIT(1)
+
+/**
+ * struct kgsl_memobj_node - Memory object descriptor
+ * @node: Local list node for the object
+ * @id: GPU memory ID for the object
+ * offset: Offset within the object
+ * @gpuaddr: GPU address for the object
+ * @flags: External flags passed by the user
+ * @priv: Internal flags set by the driver
+ */
+struct kgsl_memobj_node {
+	struct list_head node;
+	unsigned int id;
+	uint64_t offset;
+	uint64_t gpuaddr;
+	uint64_t size;
+	unsigned long flags;
+	unsigned long priv;
+};
+
+struct kgsl_device {
+	struct device *dev;
+	const char *name;
+	u32 id;
+
+	/* Kernel virtual address for GPU shader memory */
+	void __iomem *shader_mem_virt;
+
+	/* Starting kernel virtual address for QDSS GFX DBG register block */
+	void __iomem *qdss_gfx_virt;
+
+	struct kgsl_memdesc *memstore;
+	struct kgsl_memdesc *scratch;
+
+	struct kgsl_mmu mmu;
+	struct gmu_core_device gmu_core;
+	struct completion hwaccess_gate;
+	struct completion halt_gate;
+	const struct kgsl_functable *ftbl;
+	struct work_struct idle_check_ws;
+	struct timer_list idle_timer;
+	struct kgsl_pwrctrl pwrctrl;
+	int open_count;
+
+	/* For GPU inline submission */
+	uint32_t submit_now;
+	spinlock_t submit_lock;
+	/** @skip_inline_submit: Track if user threads should make an inline submission or not */
+	bool skip_inline_submit;
+
+	struct mutex mutex;
+	uint32_t state;
+	uint32_t requested_state;
+
+	atomic_t active_cnt;
+	/** @total_mapped: To trace overall gpu memory usage */
+	atomic64_t total_mapped;
+
+	wait_queue_head_t active_cnt_wq;
+	struct platform_device *pdev;
+	struct dentry *d_debugfs;
+	struct idr context_idr;
+	rwlock_t context_lock;
+
+	struct {
+		void *ptr;
+		dma_addr_t dma_handle;
+		u32 size;
+	} snapshot_memory;
+
+	struct kgsl_snapshot *snapshot;
+	/** @panic_nb: notifier block to capture GPU snapshot on kernel panic */
+	struct notifier_block panic_nb;
+	struct {
+		void *ptr;
+		u32 size;
+	} snapshot_memory_atomic;
+
+	u32 snapshot_faultcount;	/* Total number of faults since boot */
+	bool force_panic;		/* Force panic after snapshot dump */
+	bool skip_ib_capture;		/* Skip IB capture after snapshot */
+	bool prioritize_unrecoverable;	/* Overwrite with new GMU snapshots */
+	bool set_isdb_breakpoint;	/* Set isdb registers before snapshot */
+	bool snapshot_atomic;		/* To capture snapshot in atomic context*/
+	/* Use CP Crash dumper to get GPU snapshot*/
+	bool snapshot_crashdumper;
+	/* Use HOST side register reads to get GPU snapshot*/
+	bool snapshot_legacy;
+	/* Use to dump the context record in bytes */
+	u64 snapshot_ctxt_record_size;
+
+	struct kobject snapshot_kobj;
+
+	struct kgsl_pwrscale pwrscale;
+
+	int reset_counter; /* Track how many GPU core resets have occurred */
+	struct kthread_worker *events_worker;
+
+	/* Number of active contexts seen globally for this device */
+	int active_context_count;
+	struct kobject gpu_sysfs_kobj;
+	unsigned int l3_freq[3];
+	unsigned int num_l3_pwrlevels;
+	/* store current L3 vote to determine if we should change our vote */
+	unsigned int cur_l3_pwrlevel;
+	/** @globals: List of global memory objects */
+	struct list_head globals;
+	/** @globlal_map: bitmap for global memory allocations */
+	unsigned long *global_map;
+	/* @qdss_desc: Memory descriptor for the QDSS region if applicable */
+	struct kgsl_memdesc *qdss_desc;
+	/* @qtimer_desc: Memory descriptor for the QDSS region if applicable */
+	struct kgsl_memdesc *qtimer_desc;
+	/** @event_groups: List of event groups for this device */
+	struct list_head event_groups;
+	/** @event_groups_lock: A R/W lock for the events group list */
+	rwlock_t event_groups_lock;
+	/** @speed_bin: Speed bin for the GPU device if applicable */
+	u32 speed_bin;
+	/** @gmu_fault: Set when a gmu or rgmu fault is encountered */
+	bool gmu_fault;
+	/** @regmap: GPU register map */
+	struct kgsl_regmap regmap;
+	/** @timelines: Iterator for assigning IDs to timelines */
+	struct idr timelines;
+	/** @timelines_lock: Spinlock to protect the timelines idr */
+	spinlock_t timelines_lock;
+	/** @fence_trace_array: A local trace array for fence debugging */
+	struct trace_array *fence_trace_array;
+	/** @l3_vote: Enable/Disable l3 voting */
+	bool l3_vote;
+	/** @pdev_loaded: Flag to test if platform driver is probed */
+	bool pdev_loaded;
+	/** @nh: Pointer to head of the SRCU notifier chain */
+	struct srcu_notifier_head nh;
+	/** @bcl_data_kobj: Kobj for bcl_data sysfs node */
+	struct kobject bcl_data_kobj;
+	/** @work_period_timer: Timer to capture application GPU work stats */
+	struct timer_list work_period_timer;
+	/** @work_period_lock: Lock to protect application GPU work periods */
+	spinlock_t work_period_lock;
+	/** @work_period_ws: Work struct to emulate application GPU work events */
+	struct work_struct work_period_ws;
+	/** @flags: Flags for gpu_period stats */
+	unsigned long flags;
+	struct {
+		u64 begin;
+		u64 end;
+	} gpu_period;
+	/** @idle_jiffies: Latest idle jiffies */
+	unsigned long idle_jiffies;
+	/** @dump_all_ibs: Whether to dump all ibs in snapshot */
+	bool dump_all_ibs;
+};
+
+#define KGSL_MMU_DEVICE(_mmu) \
+	container_of((_mmu), struct kgsl_device, mmu)
+
+/**
+ * enum bits for struct kgsl_context.priv
+ * @KGSL_CONTEXT_PRIV_SUBMITTED - The context has submitted commands to gpu.
+ * @KGSL_CONTEXT_PRIV_DETACHED  - The context has been destroyed by userspace
+ *	and is no longer using the gpu.
+ * @KGSL_CONTEXT_PRIV_INVALID - The context has been destroyed by the kernel
+ *	because it caused a GPU fault.
+ * @KGSL_CONTEXT_PRIV_PAGEFAULT - The context has caused a page fault.
+ * @KGSL_CONTEXT_PRIV_DEVICE_SPECIFIC - this value and higher values are
+ *	reserved for devices specific use.
+ */
+enum kgsl_context_priv {
+	KGSL_CONTEXT_PRIV_SUBMITTED = 0,
+	KGSL_CONTEXT_PRIV_DETACHED,
+	KGSL_CONTEXT_PRIV_INVALID,
+	KGSL_CONTEXT_PRIV_PAGEFAULT,
+	KGSL_CONTEXT_PRIV_DEVICE_SPECIFIC = 16,
+};
+
+struct kgsl_process_private;
+
+#define KGSL_MAX_FAULT_ENTRIES 40
+
+/* Maintain faults observed within threshold time (in milliseconds) */
+#define KGSL_MAX_FAULT_TIME_THRESHOLD 5000
+
+/**
+ * struct kgsl_fault_node - GPU fault descriptor
+ * @node: List node for list of faults
+ * @type: Type of fault
+ * @priv: Pointer to type specific fault
+ * @time: Time when fault was observed
+ */
+struct kgsl_fault_node {
+	struct list_head node;
+	u32 type;
+	void *priv;
+	ktime_t time;
+};
+
+/**
+ * struct kgsl_context - The context fields that are valid for a user defined
+ * context
+ * @refcount: kref object for reference counting the context
+ * @id: integer identifier for the context
+ * @priority; The context's priority to submit commands to GPU
+ * @tid: task that created this context.
+ * @dev_priv: pointer to the owning device instance
+ * @proc_priv: pointer to process private, the process that allocated the
+ * context
+ * @priv: in-kernel context flags, use KGSL_CONTEXT_* values
+ * @reset_status: status indication whether a gpu reset occurred and whether
+ * this context was responsible for causing it
+ * @timeline: sync timeline used to create fences that can be signaled when a
+ * sync_pt timestamp expires
+ * @events: A kgsl_event_group for this context - contains the list of GPU
+ * events
+ * @flags: flags from userspace controlling the behavior of this context
+ * @pwr_constraint: power constraint from userspace for this context
+ * @fault_count: number of times gpu hanged in last _context_throttle_time ms
+ * @fault_time: time of the first gpu hang in last _context_throttle_time ms
+ * @user_ctxt_record: memory descriptor used by CP to save/restore VPC data
+ * across preemption
+ * @total_fault_count: number of times gpu faulted in this context
+ * @last_faulted_cmd_ts: last faulted command batch timestamp
+ * @gmu_registered: whether context is registered with gmu or not
+ */
+struct kgsl_context {
+	struct kref refcount;
+	uint32_t id;
+	uint32_t priority;
+	pid_t tid;
+	struct kgsl_device_private *dev_priv;
+	struct kgsl_process_private *proc_priv;
+	unsigned long priv;
+	struct kgsl_device *device;
+	unsigned int reset_status;
+	struct kgsl_sync_timeline *ktimeline;
+	struct kgsl_event_group events;
+	unsigned int flags;
+	struct kgsl_pwr_constraint pwr_constraint;
+	struct kgsl_pwr_constraint l3_pwr_constraint;
+	unsigned int fault_count;
+	ktime_t fault_time;
+	struct kgsl_mem_entry *user_ctxt_record;
+	unsigned int total_fault_count;
+	unsigned int last_faulted_cmd_ts;
+	bool gmu_registered;
+	/**
+	 * @gmu_dispatch_queue: dispatch queue id to which this context will be
+	 * submitted
+	 */
+	u32 gmu_dispatch_queue;
+	/** @faults: List of @kgsl_fault_node to store fault information */
+	struct list_head faults;
+	/** @fault_lock: Mutex to protect faults */
+	struct mutex fault_lock;
+};
+
+#define _context_comm(_c) \
+	(((_c) && (_c)->proc_priv) ? (_c)->proc_priv->comm : "unknown")
+
+/*
+ * Print log messages with the context process name/pid:
+ * [...] kgsl kgsl-3d0: kgsl-api-test[22182]:
+ */
+
+#define pr_context(_d, _c, fmt, args...) \
+		dev_err((_d)->dev, "%s[%d]: " fmt, \
+		_context_comm((_c)), \
+		pid_nr((_c)->proc_priv->pid), ##args)
+
+/**
+ * struct kgsl_process_private -  Private structure for a KGSL process (across
+ * all devices)
+ * @priv: Internal flags, use KGSL_PROCESS_* values
+ * @pid: Identification structure for the task owner of the process
+ * @comm: task name of the process
+ * @mem_lock: Spinlock to protect the process memory lists
+ * @refcount: kref object for reference counting the process
+ * @idr: Iterator for assigning IDs to memory allocations
+ * @pagetable: Pointer to the pagetable owned by this process
+ * @kobj: Pointer to a kobj for the sysfs directory for this process
+ * @debug_root: Pointer to the debugfs root for this process
+ * @stats: Memory allocation statistics for this process
+ * @gpumem_mapped: KGSL memory mapped in the process address space
+ * @syncsource_idr: sync sources created by this process
+ * @syncsource_lock: Spinlock to protect the syncsource idr
+ * @fd_count: Counter for the number of FDs for this process
+ * @ctxt_count: Count for the number of contexts for this process
+ * @ctxt_count_lock: Spinlock to protect ctxt_count
+ * @frame_count: Count for the number of frames processed
+ */
+struct kgsl_process_private {
+	unsigned long priv;
+	struct pid *pid;
+	char comm[TASK_COMM_LEN];
+	spinlock_t mem_lock;
+	struct kref refcount;
+	struct idr mem_idr;
+	struct kgsl_pagetable *pagetable;
+	struct list_head list;
+	struct list_head reclaim_list;
+	struct kobject kobj;
+	struct dentry *debug_root;
+	struct {
+		atomic64_t cur;
+		uint64_t max;
+	} stats[KGSL_MEM_ENTRY_MAX];
+	atomic64_t gpumem_mapped;
+	struct idr syncsource_idr;
+	spinlock_t syncsource_lock;
+	int fd_count;
+	atomic_t ctxt_count;
+	spinlock_t ctxt_count_lock;
+	atomic64_t frame_count;
+	/**
+	 * @state: state consisting KGSL_PROC_STATE and KGSL_PROC_PINNED_STATE
+	 */
+	unsigned long state;
+	/**
+	 * @unpinned_page_count: The number of pages unpinned for reclaim
+	 */
+	atomic_t unpinned_page_count;
+	/**
+	 * @fg_work: Work struct to schedule foreground work
+	 */
+	struct work_struct fg_work;
+	/**
+	 * @reclaim_lock: Mutex lock to protect KGSL_PROC_PINNED_STATE
+	 */
+	struct mutex reclaim_lock;
+	/** @period: Stats for GPU utilization */
+	struct gpu_work_period *period;
+	/**
+	 * @cmd_count: The number of cmds that are active for the process
+	 */
+	atomic_t cmd_count;
+	/**
+	 * @kobj_memtype: Pointer to a kobj for memtype sysfs directory for this
+	 * process
+	 */
+	struct kobject kobj_memtype;
+	/**
+	 * @private_mutex: Mutex lock to protect kgsl_process_private
+	 */
+	struct mutex private_mutex;
+	/**
+	 * @cmdline: Cmdline string of the process
+	 */
+	char *cmdline;
+};
+
+struct kgsl_device_private {
+	struct kgsl_device *device;
+	struct kgsl_process_private *process_priv;
+};
+
+/**
+ * struct kgsl_snapshot - details for a specific snapshot instance
+ * @ib1base: Active IB1 base address at the time of fault
+ * @ib2base: Active IB2 base address at the time of fault
+ * @ib1size: Number of DWORDS pending in IB1 at the time of fault
+ * @ib2size: Number of DWORDS pending in IB2 at the time of fault
+ * @ib1dumped: Active IB1 dump status to sansphot binary
+ * @ib2dumped: Active IB2 dump status to sansphot binary
+ * @start: Pointer to the start of the static snapshot region
+ * @size: Size of the current snapshot instance
+ * @ptr: Pointer to the next block of memory to write to during snapshotting
+ * @remain: Bytes left in the snapshot region
+ * @timestamp: Timestamp of the snapshot instance (in seconds since boot)
+ * @mempool: Pointer to the memory pool for storing memory objects
+ * @mempool_size: Size of the memory pool
+ * @obj_list: List of frozen GPU buffers that are waiting to be dumped.
+ * @cp_list: List of IB's to be dumped.
+ * @work: worker to dump the frozen memory
+ * @dump_gate: completion gate signaled by worker when it is finished.
+ * @process: the process that caused the hang, if known.
+ * @sysfs_read: Count of current reads via sysfs
+ * @first_read: True until the snapshot read is started
+ * @recovered: True if GPU was recovered after previous snapshot
+ */
+struct kgsl_snapshot {
+	uint64_t ib1base;
+	uint64_t ib2base;
+	unsigned int ib1size;
+	unsigned int ib2size;
+	bool ib1dumped;
+	bool ib2dumped;
+	u64 ib1base_lpac;
+	u64 ib2base_lpac;
+	u32 ib1size_lpac;
+	u32 ib2size_lpac;
+	bool ib1dumped_lpac;
+	bool ib2dumped_lpac;
+	u8 *start;
+	size_t size;
+	u8 *ptr;
+	size_t remain;
+	unsigned long timestamp;
+	u8 *mempool;
+	size_t mempool_size;
+	struct list_head obj_list;
+	struct list_head cp_list;
+	struct work_struct work;
+	struct completion dump_gate;
+	struct kgsl_process_private *process;
+	struct kgsl_process_private *process_lpac;
+	unsigned int sysfs_read;
+	bool first_read;
+	bool recovered;
+	struct kgsl_device *device;
+};
+
+/**
+ * struct kgsl_snapshot_object  - GPU memory in the snapshot
+ * @gpuaddr: The GPU address identified during snapshot
+ * @size: The buffer size identified during snapshot
+ * @offset: offset from start of the allocated kgsl_mem_entry
+ * @type: SNAPSHOT_OBJ_TYPE_* identifier.
+ * @entry: the reference counted memory entry for this buffer
+ * @node: node for kgsl_snapshot.obj_list
+ */
+struct kgsl_snapshot_object {
+	uint64_t gpuaddr;
+	uint64_t size;
+	uint64_t offset;
+	int type;
+	struct kgsl_mem_entry *entry;
+	struct list_head node;
+};
+
+struct kgsl_device *kgsl_get_device(int dev_idx);
+
+static inline void kgsl_regread(struct kgsl_device *device,
+				unsigned int offsetwords,
+				unsigned int *value)
+{
+	*value = kgsl_regmap_read(&device->regmap, offsetwords);
+}
+
+static inline void kgsl_regread64(struct kgsl_device *device,
+				  u32 offsetwords_lo, u32 offsetwords_hi,
+				  u64 *value)
+{
+	u32 val_lo = 0, val_hi = 0;
+
+	val_lo = kgsl_regmap_read(&device->regmap, offsetwords_lo);
+	val_hi = kgsl_regmap_read(&device->regmap, offsetwords_hi);
+
+	*value = (((u64)val_hi << 32) | val_lo);
+}
+
+static inline void kgsl_regwrite(struct kgsl_device *device,
+				 unsigned int offsetwords,
+				 unsigned int value)
+{
+	kgsl_regmap_write(&device->regmap, value, offsetwords);
+}
+
+static inline void kgsl_regrmw(struct kgsl_device *device,
+		unsigned int offsetwords,
+		unsigned int mask, unsigned int bits)
+{
+	kgsl_regmap_rmw(&device->regmap, offsetwords, mask, bits);
+}
+
+static inline bool kgsl_state_is_awake(struct kgsl_device *device)
+{
+	return (device->state == KGSL_STATE_ACTIVE ||
+		device->state == KGSL_STATE_AWARE);
+}
+
+/**
+ * kgsl_start_idle_timer - Start the idle timer
+ * @device: A KGSL device handle
+ *
+ * Start the idle timer to expire in 'interval_timeout' milliseconds
+ */
+static inline void kgsl_start_idle_timer(struct kgsl_device *device)
+{
+	device->idle_jiffies = jiffies + msecs_to_jiffies(device->pwrctrl.interval_timeout);
+	mod_timer(&device->idle_timer, device->idle_jiffies);
+}
+
+int kgsl_readtimestamp(struct kgsl_device *device, void *priv,
+		enum kgsl_timestamp_type type, unsigned int *timestamp);
+
+bool kgsl_check_timestamp(struct kgsl_device *device,
+		struct kgsl_context *context, unsigned int timestamp);
+
+int kgsl_device_platform_probe(struct kgsl_device *device);
+
+void kgsl_device_platform_remove(struct kgsl_device *device);
+
+const char *kgsl_pwrstate_to_str(unsigned int state);
+
+/**
+ * kgsl_device_snapshot_probe - add resources for the device GPU snapshot
+ * @device: The device to initialize
+ * @size: The size of the static region to allocate
+ *
+ * Allocate memory for a GPU snapshot for the specified device,
+ * and create the sysfs files to manage it
+ */
+void kgsl_device_snapshot_probe(struct kgsl_device *device, u32 size);
+
+void kgsl_device_snapshot(struct kgsl_device *device,
+			struct kgsl_context *context, struct kgsl_context *context_lpac,
+			bool gmu_fault);
+void kgsl_device_snapshot_close(struct kgsl_device *device);
+
+void kgsl_events_init(void);
+void kgsl_events_exit(void);
+
+/**
+ * kgsl_device_events_probe - Set up events for the KGSL device
+ * @device: A KGSL GPU device handle
+ *
+ * Set up the list and lock for GPU events for this device
+ */
+void kgsl_device_events_probe(struct kgsl_device *device);
+
+/**
+ * kgsl_device_events_remove - Remove all event groups from the KGSL device
+ * @device: A KGSL GPU device handle
+ *
+ * Remove all of the GPU event groups from the device and warn if any of them
+ * still have events pending
+ */
+void kgsl_device_events_remove(struct kgsl_device *device);
+
+void kgsl_context_detach(struct kgsl_context *context);
+
+/**
+ * kgsl_del_event_group - Remove a GPU event group from a device
+ * @device: A KGSL GPU device handle
+ * @group: Event group to be removed
+ *
+ * Remove the specified group from the list of event groups on @device.
+ */
+void kgsl_del_event_group(struct kgsl_device *device,
+		struct kgsl_event_group *group);
+
+/**
+ * kgsl_add_event_group - Add a new GPU event group
+ * @device: A KGSL GPU device handle
+ * @group: Pointer to the new group to add to the list
+ * @context: Context that owns the group (or NULL for global)
+ * @readtimestamp: Function pointer to the readtimestamp function to call when
+ * processing events
+ * @priv: Priv member to pass to the readtimestamp function
+ * @fmt: The format string to use to build the event name
+ * @...: Arguments for the format string
+ */
+void kgsl_add_event_group(struct kgsl_device *device,
+		struct kgsl_event_group *group,
+		struct kgsl_context *context, readtimestamp_func readtimestamp,
+		void *priv, const char *fmt, ...);
+
+void kgsl_cancel_events_timestamp(struct kgsl_device *device,
+		struct kgsl_event_group *group, unsigned int timestamp);
+void kgsl_cancel_events(struct kgsl_device *device,
+		struct kgsl_event_group *group);
+void kgsl_cancel_event(struct kgsl_device *device,
+		struct kgsl_event_group *group, unsigned int timestamp,
+		kgsl_event_func func, void *priv);
+bool kgsl_event_pending(struct kgsl_device *device,
+		struct kgsl_event_group *group, unsigned int timestamp,
+		kgsl_event_func func, void *priv);
+int kgsl_add_event(struct kgsl_device *device, struct kgsl_event_group *group,
+		unsigned int timestamp, kgsl_event_func func, void *priv);
+void kgsl_process_event_group(struct kgsl_device *device,
+	struct kgsl_event_group *group);
+void kgsl_flush_event_group(struct kgsl_device *device,
+		struct kgsl_event_group *group);
+void kgsl_process_event_groups(struct kgsl_device *device);
+
+void kgsl_context_destroy(struct kref *kref);
+
+int kgsl_context_init(struct kgsl_device_private *dev_priv,
+		struct kgsl_context *context);
+
+void kgsl_context_dump(struct kgsl_context *context);
+
+int kgsl_memfree_find_entry(pid_t ptname, uint64_t *gpuaddr,
+	uint64_t *size, uint64_t *flags, pid_t *pid);
+
+long kgsl_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
+
+long kgsl_ioctl_copy_in(unsigned int kernel_cmd, unsigned int user_cmd,
+		unsigned long arg, unsigned char *ptr);
+
+long kgsl_ioctl_copy_out(unsigned int kernel_cmd, unsigned int user_cmd,
+		unsigned long arg, unsigned char *ptr);
+
+/**
+ * kgsl_context_type - Return a symbolic string for the context type
+ * @type: Context type
+ *
+ * Return: Symbolic string representing the context type
+ */
+const char *kgsl_context_type(int type);
+
+/**
+ * kgsl_context_put() - Release context reference count
+ * @context: Pointer to the KGSL context to be released
+ *
+ * Reduce the reference count on a KGSL context and destroy it if it is no
+ * longer needed
+ */
+static inline void
+kgsl_context_put(struct kgsl_context *context)
+{
+	if (context)
+		kref_put(&context->refcount, kgsl_context_destroy);
+}
+
+/**
+ * kgsl_context_detached() - check if a context is detached
+ * @context: the context
+ *
+ * Check if a context has been destroyed by userspace and is only waiting
+ * for reference counts to go away. This check is used to weed out
+ * contexts that shouldn't use the gpu so NULL is considered detached.
+ */
+static inline bool kgsl_context_detached(struct kgsl_context *context)
+{
+	return (context == NULL || test_bit(KGSL_CONTEXT_PRIV_DETACHED,
+						&context->priv));
+}
+
+/**
+ * kgsl_context_invalid() - check if a context is invalid
+ * @context: the context
+ *
+ * Check if a context has been invalidated by the kernel and may no
+ * longer use the GPU.
+ */
+static inline bool kgsl_context_invalid(struct kgsl_context *context)
+{
+	return (context == NULL || test_bit(KGSL_CONTEXT_PRIV_INVALID,
+						&context->priv));
+}
+
+/** kgsl_context_is_bad - Check if a context is detached or invalid
+ * @context: Pointer to a KGSL context handle
+ *
+ * Return: True if the context has been detached or is invalid
+ */
+static inline bool kgsl_context_is_bad(struct kgsl_context *context)
+{
+	return (kgsl_context_detached(context) ||
+		kgsl_context_invalid(context));
+}
+
+/** kgsl_check_context_state - Check if a context is bad or invalid
+ *  @context: Pointer to a KGSL context handle
+ *
+ * Return: True if the context has been marked bad or invalid
+ */
+static inline int kgsl_check_context_state(struct kgsl_context *context)
+{
+	if (kgsl_context_invalid(context))
+		return -EDEADLK;
+
+	if (kgsl_context_detached(context))
+		return -ENOENT;
+
+	return 0;
+}
+
+/**
+ * kgsl_context_get() - get a pointer to a KGSL context
+ * @device: Pointer to the KGSL device that owns the context
+ * @id: Context ID
+ *
+ * Find the context associated with the given ID number, increase the reference
+ * count on it and return it.  The caller must make sure that this call is
+ * paired with a kgsl_context_put.  This function is for internal use because it
+ * doesn't validate the ownership of the context with the calling process - use
+ * kgsl_context_get_owner for that
+ */
+static inline struct kgsl_context *kgsl_context_get(struct kgsl_device *device,
+		uint32_t id)
+{
+	int result = 0;
+	struct kgsl_context *context = NULL;
+
+	read_lock(&device->context_lock);
+
+	context = idr_find(&device->context_idr, id);
+
+	/* Don't return a context that has been detached */
+	if (kgsl_context_detached(context))
+		context = NULL;
+	else
+		result = kref_get_unless_zero(&context->refcount);
+
+	read_unlock(&device->context_lock);
+
+	if (!result)
+		return NULL;
+	return context;
+}
+
+/**
+ * _kgsl_context_get() - lightweight function to just increment the ref count
+ * @context: Pointer to the KGSL context
+ *
+ * Get a reference to the specified KGSL context structure. This is a
+ * lightweight way to just increase the refcount on a known context rather than
+ * walking through kgsl_context_get and searching the iterator
+ */
+static inline int _kgsl_context_get(struct kgsl_context *context)
+{
+	int ret = 0;
+
+	if (context)
+		ret = kref_get_unless_zero(&context->refcount);
+
+	return ret;
+}
+
+/**
+ * kgsl_context_get_owner() - get a pointer to a KGSL context in a specific
+ * process
+ * @dev_priv: Pointer to the process struct
+ * @id: Context ID to return
+ *
+ * Find the context associated with the given ID number, increase the reference
+ * count on it and return it.  The caller must make sure that this call is
+ * paired with a kgsl_context_put. This function validates that the context id
+ * given is owned by the dev_priv instancet that is passed in.  See
+ * kgsl_context_get for the internal version that doesn't do the check
+ */
+static inline struct kgsl_context *kgsl_context_get_owner(
+		struct kgsl_device_private *dev_priv, uint32_t id)
+{
+	struct kgsl_context *context;
+
+	context = kgsl_context_get(dev_priv->device, id);
+
+	/* Verify that the context belongs to current calling fd. */
+	if (context != NULL && context->dev_priv != dev_priv) {
+		kgsl_context_put(context);
+		return NULL;
+	}
+
+	return context;
+}
+
+/**
+ * kgsl_process_private_get() - increment the refcount on a
+ * kgsl_process_private struct
+ * @process: Pointer to the KGSL process_private
+ *
+ * Returns 0 if the structure is invalid and a reference count could not be
+ * obtained, nonzero otherwise.
+ */
+static inline int kgsl_process_private_get(struct kgsl_process_private *process)
+{
+	if (process != NULL)
+		return kref_get_unless_zero(&process->refcount);
+	return 0;
+}
+
+void kgsl_process_private_put(struct kgsl_process_private *private);
+
+
+struct kgsl_process_private *kgsl_process_private_find(pid_t pid);
+
+/*
+ * A helper macro to print out "not enough memory functions" - this
+ * makes it easy to standardize the messages as well as cut down on
+ * the number of strings in the binary
+ */
+#define SNAPSHOT_ERR_NOMEM(_d, _s) \
+	dev_err((_d)->dev, \
+	"snapshot: not enough snapshot memory for section %s\n", (_s))
+
+/**
+ * struct kgsl_snapshot_registers - list of registers to snapshot
+ * @regs: Pointer to an array of register ranges
+ * @count: Number of entries in the array
+ */
+struct kgsl_snapshot_registers {
+	const unsigned int *regs;
+	unsigned int count;
+};
+
+size_t kgsl_snapshot_dump_registers(struct kgsl_device *device, u8 *buf,
+		size_t remain, void *priv);
+
+void kgsl_snapshot_indexed_registers(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot, unsigned int index,
+	unsigned int data, unsigned int start, unsigned int count);
+
+int kgsl_snapshot_get_object(struct kgsl_snapshot *snapshot,
+	struct kgsl_process_private *process, uint64_t gpuaddr,
+	uint64_t size, unsigned int type);
+
+int kgsl_snapshot_have_object(struct kgsl_snapshot *snapshot,
+	struct kgsl_process_private *process,
+	uint64_t gpuaddr, uint64_t size);
+
+struct adreno_ib_object_list;
+
+int kgsl_snapshot_add_ib_obj_list(struct kgsl_snapshot *snapshot,
+	struct adreno_ib_object_list *ib_obj_list);
+
+void kgsl_snapshot_add_section(struct kgsl_device *device, u16 id,
+	struct kgsl_snapshot *snapshot,
+	size_t (*func)(struct kgsl_device *, u8 *, size_t, void *),
+	void *priv);
+
+/**
+ * kgsl_of_property_read_ddrtype - Get property from devicetree based on
+ * the type of DDR.
+ * @node: Devicetree node
+ * @base: prefix string of the property
+ * @ptr:  Pointer to store the value of the property
+ *
+ * First look up the devicetree property based on the prefix string and DDR
+ * type. If property is not specified per DDR type, then look for the property
+ * based on prefix string only.
+ *
+ * Return: 0 on success or error code on failure.
+ */
+int kgsl_of_property_read_ddrtype(struct device_node *node, const char *base,
+		u32 *ptr);
+
+/**
+ * kgsl_query_property_list - Get a list of valid properties
+ * @device: A KGSL device handle
+ * @list: Pointer to a list of u32s
+ * @count: Number of items in @list
+ *
+ * Populate a list with the IDs for supported properties. If @list is NULL,
+ * just return the number of properties available, otherwise fill up to @count
+ * items in the list with property identifiers.
+ *
+ * Returns the number of total properties if @list is NULL or the number of
+ * properties copied to @list.
+ */
+int kgsl_query_property_list(struct kgsl_device *device, u32 *list, u32 count);
+
+static inline bool kgsl_mmu_has_feature(struct kgsl_device *device,
+		enum kgsl_mmu_feature feature)
+{
+	return test_bit(feature, &device->mmu.features);
+}
+
+static inline void kgsl_mmu_set_feature(struct kgsl_device *device,
+	      enum kgsl_mmu_feature feature)
+{
+	set_bit(feature, &device->mmu.features);
+}
+
+/**
+ * kgsl_add_fault - Add fault information for a context
+ * @context: Pointer to the KGSL context
+ * @type: type of fault info
+ * @priv: Pointer to type specific fault info
+ *
+ * Return: 0 on success or error code on failure.
+ */
+int kgsl_add_fault(struct kgsl_context *context, u32 type, void *priv);
+
+/**
+ * kgsl_free_faults - Free fault information for a context
+ * @context: Pointer to the KGSL context
+ */
+void kgsl_free_faults(struct kgsl_context *context);
+
+/**
+ * kgsl_trace_gpu_mem_total - Overall gpu memory usage tracking which includes
+ * process allocations, imported dmabufs and kgsl globals
+ * @device: A KGSL device handle
+ * @delta: delta of total mapped memory size
+ */
+#ifdef CONFIG_TRACE_GPU_MEM
+static inline void kgsl_trace_gpu_mem_total(struct kgsl_device *device,
+						s64 delta)
+{
+	u64 total_size;
+
+	total_size = atomic64_add_return(delta, &device->total_mapped);
+	trace_gpu_mem_total(0, 0, total_size);
+}
+#else
+static inline void kgsl_trace_gpu_mem_total(struct kgsl_device *device,
+						s64 delta) {}
+#endif
+
+/*
+ * kgsl_context_is_lpac() - Checks if context is LPAC
+ * @context: KGSL context to check
+ *
+ * Function returns true if context is LPAC else false
+ */
+static inline bool kgsl_context_is_lpac(struct kgsl_context *context)
+{
+	if (context == NULL)
+		return false;
+
+	return (context->flags & KGSL_CONTEXT_LPAC) ? true : false;
+}
+
+#endif  /* __KGSL_DEVICE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_drawobj.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_drawobj.c
@@ -0,0 +1,1629 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+/*
+ * KGSL drawobj management
+ * A drawobj is a single submission from userland.  The drawobj
+ * encapsulates everything about the submission : command buffers, flags and
+ * sync points.
+ *
+ * Sync points are events that need to expire before the
+ * drawobj can be queued to the hardware. All synpoints are contained in an
+ * array of kgsl_drawobj_sync_event structs in the drawobj. There can be
+ * multiple types of events both internal ones (GPU events) and external
+ * triggers. As the events expire bits are cleared in a pending bitmap stored
+ * in the drawobj. The GPU will submit the command as soon as the bitmap
+ * goes to zero indicating no more pending events.
+ */
+
+#include <linux/slab.h>
+#include <linux/dma-fence-array.h>
+
+#include "adreno_drawctxt.h"
+#include "kgsl_compat.h"
+#include "kgsl_device.h"
+#include "kgsl_drawobj.h"
+#include "kgsl_eventlog.h"
+#include "kgsl_sync.h"
+#include "kgsl_timeline.h"
+#include "kgsl_trace.h"
+
+/*
+ * Define an kmem cache for the memobj structures since we
+ * allocate and free them so frequently
+ */
+static struct kmem_cache *memobjs_cache;
+
+static void syncobj_destroy_object(struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_drawobj_sync *syncobj = SYNCOBJ(drawobj);
+	int i;
+
+	for (i = 0; i < syncobj->numsyncs; i++) {
+		struct kgsl_drawobj_sync_event *event = &syncobj->synclist[i];
+
+		if (event->type == KGSL_CMD_SYNCPOINT_TYPE_FENCE) {
+			struct event_fence_info *priv = event->priv;
+
+			if (priv) {
+				kfree(priv->fences);
+				kfree(priv);
+			}
+
+			if (event->handle) {
+				struct kgsl_sync_fence_cb *kcb = event->handle;
+
+				dma_fence_put(kcb->fence);
+				kfree(kcb);
+			}
+
+		} else if (event->type == KGSL_CMD_SYNCPOINT_TYPE_TIMELINE) {
+			kfree(event->priv);
+		}
+	}
+
+	kfree(syncobj->synclist);
+	kfree(syncobj);
+}
+
+static void cmdobj_destroy_object(struct kgsl_drawobj *drawobj)
+{
+	kfree(CMDOBJ(drawobj));
+}
+
+static void bindobj_destroy_object(struct kgsl_drawobj *drawobj)
+{
+	kfree(BINDOBJ(drawobj));
+}
+
+static void timelineobj_destroy_object(struct kgsl_drawobj *drawobj)
+{
+	kfree(TIMELINEOBJ(drawobj));
+}
+
+void kgsl_drawobj_destroy_object(struct kref *kref)
+{
+	struct kgsl_drawobj *drawobj = container_of(kref,
+		struct kgsl_drawobj, refcount);
+
+	kgsl_context_put(drawobj->context);
+	drawobj->destroy_object(drawobj);
+}
+
+void kgsl_dump_syncpoints(struct kgsl_device *device,
+	struct kgsl_drawobj_sync *syncobj)
+{
+	struct kgsl_drawobj_sync_event *event;
+	unsigned int i;
+
+	for (i = 0; i < syncobj->numsyncs; i++) {
+		event = &syncobj->synclist[i];
+
+		if (!kgsl_drawobj_event_pending(syncobj, i))
+			continue;
+
+		switch (event->type) {
+		case KGSL_CMD_SYNCPOINT_TYPE_TIMESTAMP: {
+			unsigned int retired;
+
+			 kgsl_readtimestamp(event->device,
+				event->context, KGSL_TIMESTAMP_RETIRED,
+				&retired);
+
+			dev_err(device->dev,
+				"  [timestamp] context %u timestamp %u (retired %u)\n",
+				event->context->id, event->timestamp,
+				retired);
+			break;
+		}
+		case KGSL_CMD_SYNCPOINT_TYPE_FENCE: {
+			int j;
+			struct event_fence_info *info = event->priv;
+
+			for (j = 0; info && j < info->num_fences; j++)
+				dev_err(device->dev, "[%d]  fence: %s\n",
+					i, info->fences[j].name);
+			break;
+		}
+		case KGSL_CMD_SYNCPOINT_TYPE_TIMELINE: {
+			int j;
+			struct event_timeline_info *info = event->priv;
+
+			for (j = 0; info && info[j].timeline; j++)
+				dev_err(device->dev, "[%d]  timeline: %d seqno %lld\n",
+					i, info[j].timeline, info[j].seqno);
+			break;
+		}
+		}
+	}
+}
+
+static void syncobj_timer(struct timer_list *t)
+{
+	struct kgsl_device *device;
+	struct kgsl_drawobj_sync *syncobj = from_timer(syncobj, t, timer);
+	struct kgsl_drawobj *drawobj;
+	struct kgsl_drawobj_sync_event *event;
+	unsigned int i;
+
+	if (syncobj == NULL)
+		return;
+
+	drawobj = DRAWOBJ(syncobj);
+
+	if (!kref_get_unless_zero(&drawobj->refcount))
+		return;
+
+	if (drawobj->context == NULL) {
+		kgsl_drawobj_put(drawobj);
+		return;
+	}
+
+	device = drawobj->context->device;
+
+	dev_err(device->dev,
+		"kgsl: possible gpu syncpoint deadlock for context %u timestamp %u\n",
+		drawobj->context->id, drawobj->timestamp);
+
+	set_bit(ADRENO_CONTEXT_FENCE_LOG, &drawobj->context->priv);
+	kgsl_context_dump(drawobj->context);
+	clear_bit(ADRENO_CONTEXT_FENCE_LOG, &drawobj->context->priv);
+
+	dev_err(device->dev, "      pending events:\n");
+
+	for (i = 0; i < syncobj->numsyncs; i++) {
+		event = &syncobj->synclist[i];
+
+		if (!kgsl_drawobj_event_pending(syncobj, i))
+			continue;
+
+		switch (event->type) {
+		case KGSL_CMD_SYNCPOINT_TYPE_TIMESTAMP:
+			dev_err(device->dev, "       [%u] TIMESTAMP %u:%u\n",
+				i, event->context->id, event->timestamp);
+			break;
+		case KGSL_CMD_SYNCPOINT_TYPE_FENCE: {
+			int j;
+			struct event_fence_info *info = event->priv;
+
+			for (j = 0; info && j < info->num_fences; j++)
+				dev_err(device->dev, "       [%u] FENCE %s\n",
+					i, info->fences[j].name);
+			break;
+		}
+		case KGSL_CMD_SYNCPOINT_TYPE_TIMELINE: {
+			int j;
+			struct event_timeline_info *info = event->priv;
+			struct dma_fence *fence = event->fence;
+			bool retired = false;
+			bool signaled = test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
+					&fence->flags);
+			const char *str = NULL;
+
+			if (fence->ops->signaled && fence->ops->signaled(fence))
+				retired = true;
+
+			if (!retired)
+				str = "not retired";
+			else if (retired && signaled)
+				str = "signaled";
+			else if (retired && !signaled)
+				str = "retired but not signaled";
+			dev_err(device->dev, "       [%u] FENCE %s\n",
+				i, str);
+			for (j = 0; info && info[j].timeline; j++)
+				dev_err(device->dev, "       TIMELINE %d SEQNO %lld\n",
+					info[j].timeline, info[j].seqno);
+			break;
+		}
+		}
+	}
+
+	kgsl_drawobj_put(drawobj);
+	dev_err(device->dev, "--gpu syncpoint deadlock print end--\n");
+}
+
+/*
+ * a generic function to retire a pending sync event and (possibly) kick the
+ * dispatcher.
+ * Returns false if the event was already marked for cancellation in another
+ * thread. This function should return true if this thread is responsible for
+ * freeing up the memory, and the event will not be cancelled.
+ */
+static bool drawobj_sync_expire(struct kgsl_device *device,
+	struct kgsl_drawobj_sync_event *event)
+{
+	struct kgsl_drawobj_sync *syncobj = event->syncobj;
+	/*
+	 * Clear the event from the pending mask - if it is already clear, then
+	 * leave without doing anything useful
+	 */
+	if (!test_and_clear_bit(event->id, &syncobj->pending))
+		return false;
+
+	/*
+	 * If no more pending events, delete the timer and schedule the command
+	 * for dispatch
+	 */
+	if (!kgsl_drawobj_events_pending(event->syncobj)) {
+		del_timer(&syncobj->timer);
+
+		if (device->ftbl->drawctxt_sched)
+			device->ftbl->drawctxt_sched(device,
+				event->syncobj->base.context);
+	}
+	return true;
+}
+
+/*
+ * This function is called by the GPU event when the sync event timestamp
+ * expires
+ */
+static void drawobj_sync_func(struct kgsl_device *device,
+		struct kgsl_event_group *group, void *priv, int result)
+{
+	struct kgsl_drawobj_sync_event *event = priv;
+
+	trace_syncpoint_timestamp_expire(event->syncobj,
+		event->context, event->timestamp);
+
+	/*
+	 * Put down the context ref count only if
+	 * this thread successfully clears the pending bit mask.
+	 */
+	if (drawobj_sync_expire(device, event))
+		kgsl_context_put(event->context);
+
+	kgsl_drawobj_put(&event->syncobj->base);
+}
+
+static void drawobj_sync_timeline_fence_work(struct work_struct *work)
+{
+	struct kgsl_drawobj_sync_event *event = container_of(work,
+		struct kgsl_drawobj_sync_event, work);
+
+	dma_fence_put(event->fence);
+	kgsl_drawobj_put(&event->syncobj->base);
+}
+
+static void trace_syncpoint_timeline_fence(struct kgsl_drawobj_sync *syncobj,
+	struct dma_fence *f, bool expire)
+{
+	struct dma_fence_array *array = to_dma_fence_array(f);
+	struct dma_fence **fences = &f;
+	u32 num_fences = 1;
+	int i;
+
+	if (array) {
+		num_fences = array->num_fences;
+		fences = array->fences;
+	}
+
+	for (i = 0; i < num_fences; i++) {
+		char fence_name[KGSL_FENCE_NAME_LEN];
+
+		snprintf(fence_name, sizeof(fence_name), "%s:%llu",
+			fences[i]->ops->get_timeline_name(fences[i]),
+			fences[i]->seqno);
+		if (expire) {
+			trace_syncpoint_fence_expire(syncobj, fence_name);
+			log_kgsl_syncpoint_fence_expire_event(
+			syncobj->base.context->id, fence_name);
+		} else {
+			trace_syncpoint_fence(syncobj, fence_name);
+			log_kgsl_syncpoint_fence_event(
+			syncobj->base.context->id, fence_name);
+		}
+	}
+}
+
+static void drawobj_sync_timeline_fence_callback(struct dma_fence *f,
+		struct dma_fence_cb *cb)
+{
+	struct kgsl_drawobj_sync_event *event = container_of(cb,
+		struct kgsl_drawobj_sync_event, cb);
+
+	trace_syncpoint_timeline_fence(event->syncobj, f, true);
+
+	/*
+	 * Mark the event as synced and then fire off a worker to handle
+	 * removing the fence
+	 */
+	if (drawobj_sync_expire(event->device, event))
+		queue_work(kgsl_driver.lockless_workqueue, &event->work);
+}
+
+static void syncobj_destroy(struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_drawobj_sync *syncobj = SYNCOBJ(drawobj);
+	unsigned int i;
+
+	/* Zap the canary timer */
+	del_timer_sync(&syncobj->timer);
+
+	/*
+	 * Clear all pending events - this will render any subsequent async
+	 * callbacks harmless
+	 */
+	for (i = 0; i < syncobj->numsyncs; i++) {
+		struct kgsl_drawobj_sync_event *event = &syncobj->synclist[i];
+
+		/*
+		 * Don't do anything if the event has already expired.
+		 * If this thread clears the pending bit mask then it is
+		 * responsible for doing context put.
+		 */
+		if (!test_and_clear_bit(i, &syncobj->pending))
+			continue;
+
+		switch (event->type) {
+		case KGSL_CMD_SYNCPOINT_TYPE_TIMESTAMP:
+			kgsl_cancel_event(drawobj->device,
+				&event->context->events, event->timestamp,
+				drawobj_sync_func, event);
+			/*
+			 * Do context put here to make sure the context is alive
+			 * till this thread cancels kgsl event.
+			 */
+			kgsl_context_put(event->context);
+			break;
+		case KGSL_CMD_SYNCPOINT_TYPE_FENCE:
+			kgsl_sync_fence_async_cancel(event->handle);
+			kgsl_drawobj_put(drawobj);
+			break;
+		case KGSL_CMD_SYNCPOINT_TYPE_TIMELINE:
+			dma_fence_remove_callback(event->fence, &event->cb);
+			dma_fence_put(event->fence);
+			kgsl_drawobj_put(drawobj);
+			break;
+		}
+	}
+
+	/*
+	 * If we cancelled an event, there's a good chance that the context is
+	 * on a dispatcher queue, so schedule to get it removed.
+	 */
+	if (!bitmap_empty(&syncobj->pending, KGSL_MAX_SYNCPOINTS) &&
+		drawobj->device->ftbl->drawctxt_sched)
+		drawobj->device->ftbl->drawctxt_sched(drawobj->device,
+							drawobj->context);
+
+}
+
+static void _drawobj_timelineobj_retire(struct kref *kref)
+{
+	int i;
+	struct kgsl_drawobj_timeline *timelineobj = container_of(kref,
+				struct kgsl_drawobj_timeline, sig_refcount);
+
+	for (i = 0; i < timelineobj->count; i++) {
+		kgsl_timeline_signal(timelineobj->timelines[i].timeline,
+			timelineobj->timelines[i].seqno);
+
+		kgsl_timeline_put(timelineobj->timelines[i].timeline);
+		kgsl_context_put(timelineobj->timelines[i].context);
+	}
+
+	kvfree(timelineobj->timelines);
+	timelineobj->timelines = NULL;
+	timelineobj->count = 0;
+}
+
+static void kgsl_timelineobj_signal(struct kgsl_drawobj_timeline *timelineobj)
+{
+	kref_put(&timelineobj->sig_refcount, _drawobj_timelineobj_retire);
+}
+
+static void timelineobj_destroy(struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_drawobj_timeline *timelineobj = TIMELINEOBJ(drawobj);
+	int i;
+
+	/*
+	 * At this point any syncobjs blocking this timelinobj have been
+	 * signaled. The timelineobj now only needs all preceding timestamps to
+	 * retire before signaling the timelines. Notify timelines to keep them
+	 * in sync with the timestamps as they retire.
+	 */
+	for (i = 0; i < timelineobj->count; i++)
+		kgsl_timeline_add_signal(&timelineobj->timelines[i]);
+
+	/*
+	 * The scheduler is done with the timelineobj. Put the initial
+	 * sig_refcount to continue with the signaling process.
+	 */
+	kgsl_timelineobj_signal(timelineobj);
+}
+
+static void bindobj_destroy(struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_drawobj_bind *bindobj = BINDOBJ(drawobj);
+
+	kgsl_sharedmem_put_bind_op(bindobj->bind);
+}
+
+static void cmdobj_destroy(struct kgsl_drawobj *drawobj)
+{
+	struct kgsl_drawobj_cmd *cmdobj = CMDOBJ(drawobj);
+	struct kgsl_memobj_node *mem, *tmpmem;
+
+	/*
+	 * Release the refcount on the mem entry associated with the
+	 * ib profiling buffer
+	 */
+	if (cmdobj->base.flags & KGSL_DRAWOBJ_PROFILING)
+		kgsl_mem_entry_put(cmdobj->profiling_buf_entry);
+
+	/* Destroy the command list */
+	list_for_each_entry_safe(mem, tmpmem, &cmdobj->cmdlist, node) {
+		list_del_init(&mem->node);
+		kmem_cache_free(memobjs_cache, mem);
+	}
+
+	/* Destroy the memory list */
+	list_for_each_entry_safe(mem, tmpmem, &cmdobj->memlist, node) {
+		list_del_init(&mem->node);
+		kmem_cache_free(memobjs_cache, mem);
+	}
+
+	if (drawobj->type & CMDOBJ_TYPE) {
+		atomic_dec(&drawobj->context->proc_priv->cmd_count);
+		atomic_dec(&drawobj->context->proc_priv->period->active_cmds);
+	}
+}
+
+/**
+ * kgsl_drawobj_destroy() - Destroy a kgsl object structure
+ * @obj: Pointer to the kgsl object to destroy
+ *
+ * Start the process of destroying a command batch.  Cancel any pending events
+ * and decrement the refcount.  Asynchronous events can still signal after
+ * kgsl_drawobj_destroy has returned.
+ */
+void kgsl_drawobj_destroy(struct kgsl_drawobj *drawobj)
+{
+	if (IS_ERR_OR_NULL(drawobj))
+		return;
+
+	drawobj->destroy(drawobj);
+
+	kgsl_drawobj_put(drawobj);
+}
+
+static bool drawobj_sync_fence_func(void *priv)
+{
+	struct kgsl_drawobj_sync_event *event = priv;
+	struct event_fence_info *info = event->priv;
+	int i;
+
+	for (i = 0; info && i < info->num_fences; i++) {
+		trace_syncpoint_fence_expire(event->syncobj,
+			info->fences[i].name);
+		log_kgsl_syncpoint_fence_expire_event(
+		event->syncobj->base.context->id, info->fences[i].name);
+	}
+
+	/*
+	 * Only call kgsl_drawobj_put() if it's not marked for cancellation
+	 * in another thread.
+	 */
+	if (drawobj_sync_expire(event->device, event)) {
+		kgsl_drawobj_put(&event->syncobj->base);
+		return true;
+	}
+	return false;
+}
+
+static struct event_timeline_info *
+drawobj_get_sync_timeline_priv(void __user *uptr, u64 usize, u32 count)
+{
+	int i;
+	struct event_timeline_info *priv;
+
+	/* Make sure we don't accidently overflow count */
+	if (count == UINT_MAX)
+		return NULL;
+
+	priv = kcalloc(count + 1, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return NULL;
+
+	for (i = 0; i < count; i++, uptr += usize) {
+		struct kgsl_timeline_val val;
+
+		if (copy_struct_from_user(&val, sizeof(val), uptr, usize))
+			continue;
+
+		priv[i].timeline = val.timeline;
+		priv[i].seqno = val.seqno;
+	}
+
+	priv[i].timeline = 0;
+	return priv;
+}
+
+static int drawobj_add_sync_timeline(struct kgsl_device *device,
+
+		struct kgsl_drawobj_sync *syncobj, void __user *uptr,
+		u64 usize)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(syncobj);
+	struct kgsl_cmd_syncpoint_timeline sync;
+	struct kgsl_drawobj_sync_event *event;
+	struct dma_fence *fence;
+	unsigned int id;
+	int ret;
+
+	if (copy_struct_from_user(&sync, sizeof(sync), uptr, usize))
+		return -EFAULT;
+
+	fence = kgsl_timelines_to_fence_array(device, sync.timelines,
+		sync.count, sync.timelines_size, false);
+	if (IS_ERR(fence))
+		return PTR_ERR(fence);
+
+	kref_get(&drawobj->refcount);
+
+	id = syncobj->numsyncs++;
+
+	event = &syncobj->synclist[id];
+
+	event->id = id;
+	event->type = KGSL_CMD_SYNCPOINT_TYPE_TIMELINE;
+	event->syncobj = syncobj;
+	event->device = device;
+	event->context = NULL;
+	event->fence = fence;
+	INIT_WORK(&event->work, drawobj_sync_timeline_fence_work);
+
+	INIT_LIST_HEAD(&event->cb.node);
+
+	event->priv =
+		drawobj_get_sync_timeline_priv(u64_to_user_ptr(sync.timelines),
+			sync.timelines_size, sync.count);
+
+	/* Set pending flag before adding callback to avoid race */
+	set_bit(event->id, &syncobj->pending);
+
+	/* Get a dma_fence refcount to hand over to the callback */
+	dma_fence_get(event->fence);
+	ret = dma_fence_add_callback(event->fence,
+		&event->cb, drawobj_sync_timeline_fence_callback);
+
+	if (ret) {
+		clear_bit(event->id, &syncobj->pending);
+
+		if (dma_fence_is_signaled(event->fence)) {
+			trace_syncpoint_fence_expire(syncobj, "signaled");
+			log_kgsl_syncpoint_fence_expire_event(
+			syncobj->base.context->id, "signaled");
+			dma_fence_put(event->fence);
+			ret = 0;
+		}
+
+		/* Put the refcount from fence creation */
+		dma_fence_put(event->fence);
+		kgsl_drawobj_put(drawobj);
+		return ret;
+	}
+
+	trace_syncpoint_timeline_fence(event->syncobj, event->fence, false);
+
+	/* Put the refcount from fence creation */
+	dma_fence_put(event->fence);
+	return 0;
+}
+
+static int drawobj_add_sync_fence(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj, void __user *data,
+		u64 datasize)
+{
+	struct kgsl_cmd_syncpoint_fence sync;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(syncobj);
+	struct kgsl_drawobj_sync_event *event;
+	struct event_fence_info *priv;
+	unsigned int id, i;
+
+	if (copy_struct_from_user(&sync, sizeof(sync), data, datasize))
+		return -EFAULT;
+
+	kref_get(&drawobj->refcount);
+
+	id = syncobj->numsyncs++;
+
+	event = &syncobj->synclist[id];
+
+	event->id = id;
+	event->type = KGSL_CMD_SYNCPOINT_TYPE_FENCE;
+	event->syncobj = syncobj;
+	event->device = device;
+	event->context = NULL;
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+
+	set_bit(event->id, &syncobj->pending);
+
+	event->handle = kgsl_sync_fence_async_wait(sync.fd, drawobj_sync_fence_func, event);
+
+	event->priv = priv;
+
+	if (IS_ERR_OR_NULL(event->handle)) {
+		int ret = PTR_ERR(event->handle);
+
+		clear_bit(event->id, &syncobj->pending);
+		event->handle = NULL;
+
+		kgsl_drawobj_put(drawobj);
+
+		/*
+		 * If ret == 0 the fence was already signaled - print a trace
+		 * message so we can track that
+		 */
+		if (ret == 0) {
+			trace_syncpoint_fence_expire(syncobj, "signaled");
+			log_kgsl_syncpoint_fence_expire_event(
+				syncobj->base.context->id, "signaled");
+		}
+
+		return ret;
+	}
+
+	kgsl_get_fence_info(event);
+
+	for (i = 0; priv && i < priv->num_fences; i++) {
+		trace_syncpoint_fence(syncobj, priv->fences[i].name);
+		log_kgsl_syncpoint_fence_event(syncobj->base.context->id,
+			priv->fences[i].name);
+	}
+
+	return 0;
+}
+
+/* drawobj_add_sync_timestamp() - Add a new sync point for a sync obj
+ * @device: KGSL device
+ * @syncobj: KGSL sync obj to add the sync point to
+ * @priv: Private structure passed by the user
+ *
+ * Add a new sync point timestamp event to the sync obj.
+ */
+static int drawobj_add_sync_timestamp(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj,
+		struct kgsl_cmd_syncpoint_timestamp *timestamp)
+
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(syncobj);
+	struct kgsl_context *context = kgsl_context_get(device,
+		timestamp->context_id);
+	struct kgsl_drawobj_sync_event *event;
+	int ret = -EINVAL;
+	unsigned int id;
+
+	if (context == NULL)
+		return -EINVAL;
+
+	/*
+	 * We allow somebody to create a sync point on their own context.
+	 * This has the effect of delaying a command from submitting until the
+	 * dependent command has cleared.  That said we obviously can't let them
+	 * create a sync point on a future timestamp.
+	 */
+
+	if (context == drawobj->context) {
+		unsigned int queued;
+
+		kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_QUEUED,
+			&queued);
+
+		if (timestamp_cmp(timestamp->timestamp, queued) > 0) {
+			dev_err(device->dev,
+				     "Cannot create syncpoint for future timestamp %d (current %d)\n",
+				     timestamp->timestamp, queued);
+			goto done;
+		}
+	}
+
+	kref_get(&drawobj->refcount);
+
+	id = syncobj->numsyncs++;
+
+	event = &syncobj->synclist[id];
+	event->id = id;
+
+	event->type = KGSL_CMD_SYNCPOINT_TYPE_TIMESTAMP;
+	event->syncobj = syncobj;
+	event->context = context;
+	event->timestamp = timestamp->timestamp;
+	event->device = device;
+
+	set_bit(event->id, &syncobj->pending);
+
+	ret = kgsl_add_event(device, &context->events, timestamp->timestamp,
+		drawobj_sync_func, event);
+
+	if (ret) {
+		clear_bit(event->id, &syncobj->pending);
+		kgsl_drawobj_put(drawobj);
+	} else {
+		trace_syncpoint_timestamp(syncobj, context,
+			timestamp->timestamp);
+	}
+
+done:
+	if (ret)
+		kgsl_context_put(context);
+
+	return ret;
+}
+
+static int drawobj_add_sync_timestamp_from_user(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj, void __user *data,
+		u64 datasize)
+{
+	struct kgsl_cmd_syncpoint_timestamp timestamp;
+
+	if (copy_struct_from_user(&timestamp, sizeof(timestamp),
+			data, datasize))
+		return -EFAULT;
+
+	return drawobj_add_sync_timestamp(device, syncobj, &timestamp);
+}
+
+/**
+ * kgsl_drawobj_sync_add_sync() - Add a sync point to a command
+ * batch
+ * @device: Pointer to the KGSL device struct for the GPU
+ * @syncobj: Pointer to the sync obj
+ * @sync: Pointer to the user-specified struct defining the syncpoint
+ *
+ * Create a new sync point in the sync obj based on the
+ * user specified parameters
+ */
+int kgsl_drawobj_sync_add_sync(struct kgsl_device *device,
+	struct kgsl_drawobj_sync *syncobj,
+	struct kgsl_cmd_syncpoint *sync)
+{
+	struct kgsl_drawobj *drawobj = DRAWOBJ(syncobj);
+
+	if (sync->type != KGSL_CMD_SYNCPOINT_TYPE_FENCE)
+		syncobj->flags |= KGSL_SYNCOBJ_SW;
+
+	if (sync->type == KGSL_CMD_SYNCPOINT_TYPE_TIMESTAMP)
+		return drawobj_add_sync_timestamp_from_user(device,
+			syncobj, sync->priv, sync->size);
+	else if (sync->type == KGSL_CMD_SYNCPOINT_TYPE_FENCE)
+		return drawobj_add_sync_fence(device,
+			syncobj, sync->priv, sync->size);
+	else if (sync->type == KGSL_CMD_SYNCPOINT_TYPE_TIMELINE)
+		return drawobj_add_sync_timeline(device,
+			syncobj, sync->priv, sync->size);
+
+	dev_err(device->dev, "bad syncpoint type %d for ctxt %u\n",
+		sync->type, drawobj->context->id);
+
+	return -EINVAL;
+}
+
+static void add_profiling_buffer(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj,
+		uint64_t gpuaddr, uint64_t size,
+		unsigned int id, uint64_t offset)
+{
+	struct kgsl_mem_entry *entry;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+	u64 start;
+
+	if (!(drawobj->flags & KGSL_DRAWOBJ_PROFILING))
+		return;
+
+	/* Only the first buffer entry counts - ignore the rest */
+	if (cmdobj->profiling_buf_entry != NULL)
+		return;
+
+	if (id != 0)
+		entry = kgsl_sharedmem_find_id(drawobj->context->proc_priv,
+				id);
+	else
+		entry = kgsl_sharedmem_find(drawobj->context->proc_priv,
+			gpuaddr);
+
+	if (entry != NULL) {
+		start = id ? (entry->memdesc.gpuaddr + offset) : gpuaddr;
+		/*
+		 * Make sure there is enough room in the object to store the
+		 * entire profiling buffer object
+		 */
+		if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size) ||
+			!kgsl_gpuaddr_in_memdesc(&entry->memdesc, start,
+				sizeof(struct kgsl_drawobj_profiling_buffer))) {
+			kgsl_mem_entry_put(entry);
+			entry = NULL;
+		}
+	}
+
+	if (entry == NULL) {
+		dev_err(device->dev,
+			"ignore bad profile buffer ctxt %u id %d offset %lld gpuaddr %llx size %lld\n",
+			drawobj->context->id, id, offset, gpuaddr, size);
+		return;
+	}
+
+	cmdobj->profiling_buffer_gpuaddr = start;
+	cmdobj->profiling_buf_entry = entry;
+}
+
+/**
+ * kgsl_drawobj_cmd_add_ibdesc() - Add a legacy ibdesc to a command
+ * batch
+ * @cmdobj: Pointer to the ib
+ * @ibdesc: Pointer to the user-specified struct defining the memory or IB
+ *
+ * Create a new memory entry in the ib based on the
+ * user specified parameters
+ */
+int kgsl_drawobj_cmd_add_ibdesc(struct kgsl_device *device,
+	struct kgsl_drawobj_cmd *cmdobj, struct kgsl_ibdesc *ibdesc)
+{
+	uint64_t gpuaddr = (uint64_t) ibdesc->gpuaddr;
+	uint64_t size = (uint64_t) ibdesc->sizedwords << 2;
+	struct kgsl_memobj_node *mem;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
+
+	/* sanitize the ibdesc ctrl flags */
+	ibdesc->ctrl &= KGSL_IBDESC_MEMLIST | KGSL_IBDESC_PROFILING_BUFFER;
+
+	if (drawobj->flags & KGSL_DRAWOBJ_MEMLIST &&
+			ibdesc->ctrl & KGSL_IBDESC_MEMLIST) {
+		if (ibdesc->ctrl & KGSL_IBDESC_PROFILING_BUFFER) {
+			add_profiling_buffer(device, cmdobj,
+					gpuaddr, size, 0, 0);
+			return 0;
+		}
+	}
+
+	/* Ignore if SYNC or MARKER is specified */
+	if (drawobj->type & (SYNCOBJ_TYPE | MARKEROBJ_TYPE))
+		return 0;
+
+	mem = kmem_cache_alloc(memobjs_cache, GFP_KERNEL);
+	if (mem == NULL)
+		return -ENOMEM;
+
+	mem->gpuaddr = gpuaddr;
+	mem->size = size;
+	mem->priv = 0;
+	mem->id = 0;
+	mem->offset = 0;
+	mem->flags = 0;
+
+	if (drawobj->flags & KGSL_DRAWOBJ_MEMLIST &&
+			ibdesc->ctrl & KGSL_IBDESC_MEMLIST)
+		/* add to the memlist */
+		list_add_tail(&mem->node, &cmdobj->memlist);
+	else {
+		/* set the preamble flag if directed to */
+		if (drawobj->context->flags & KGSL_CONTEXT_PREAMBLE &&
+				list_empty(&cmdobj->cmdlist))
+			mem->flags = KGSL_CMDLIST_CTXTSWITCH_PREAMBLE;
+
+		/* add to the cmd list */
+		list_add_tail(&mem->node, &cmdobj->cmdlist);
+	}
+
+	return 0;
+}
+
+static int drawobj_init(struct kgsl_device *device,
+	struct kgsl_context *context, struct kgsl_drawobj *drawobj,
+	int type)
+{
+	/*
+	 * Increase the reference count on the context so it doesn't disappear
+	 * during the lifetime of this object
+	 */
+	if (!_kgsl_context_get(context))
+		return -ENOENT;
+
+	kref_init(&drawobj->refcount);
+
+	drawobj->device = device;
+	drawobj->context = context;
+	drawobj->type = type;
+
+	return 0;
+}
+
+static int get_aux_command(void __user *ptr, u64 generic_size,
+		int type, void *auxcmd, size_t auxcmd_size)
+{
+	struct kgsl_gpu_aux_command_generic generic;
+	u64 size;
+
+	if (copy_struct_from_user(&generic, sizeof(generic), ptr, generic_size))
+		return -EFAULT;
+
+	if (generic.type != type)
+		return -EINVAL;
+
+	size = min_t(u64, auxcmd_size, generic.size);
+	if (copy_from_user(auxcmd, u64_to_user_ptr(generic.priv), size))
+		return -EFAULT;
+
+	return 0;
+}
+
+struct kgsl_drawobj_timeline *
+kgsl_drawobj_timeline_create(struct kgsl_device *device,
+		struct kgsl_context *context)
+{
+	int ret;
+	struct kgsl_drawobj_timeline *timelineobj =
+		kzalloc(sizeof(*timelineobj), GFP_KERNEL);
+
+	if (!timelineobj)
+		return ERR_PTR(-ENOMEM);
+
+	ret = drawobj_init(device, context, &timelineobj->base,
+		TIMELINEOBJ_TYPE);
+	if (ret) {
+		kfree(timelineobj);
+		return ERR_PTR(ret);
+	}
+
+	/*
+	 * Initialize the sig_refcount that triggers the timeline signal.
+	 * This refcount goes to 0 when:
+	 * 1) This timelineobj is popped off the context queue. This implies
+	 *    any syncobj blocking this timelineobj was already signaled, or
+	 *    the context queue is cleaned up at detach time.
+	 * 2) The cmdobjs queued on this context before this timeline object
+	 *    are retired.
+	 */
+	kref_init(&timelineobj->sig_refcount);
+
+	timelineobj->base.destroy = timelineobj_destroy;
+	timelineobj->base.destroy_object = timelineobj_destroy_object;
+
+	return timelineobj;
+}
+
+static void _timeline_signaled(struct kgsl_device *device,
+		struct kgsl_event_group *group, void *priv, int ret)
+{
+	struct kgsl_drawobj_timeline *timelineobj = priv;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(timelineobj);
+
+	/* Put the sig_refcount we took when registering this event */
+	kgsl_timelineobj_signal(timelineobj);
+
+	/* Put the drawobj refcount we took when registering this event */
+	kgsl_drawobj_put(drawobj);
+}
+
+int kgsl_drawobj_add_timeline(struct kgsl_device_private *dev_priv,
+		struct kgsl_drawobj_timeline *timelineobj,
+		void __user *src, u64 cmdsize)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_gpu_aux_command_timeline cmd;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(timelineobj);
+	struct kgsl_context *context = drawobj->context;
+	int i, ret;
+	u32 queued;
+
+	memset(&cmd, 0, sizeof(cmd));
+
+	ret = get_aux_command(src, cmdsize,
+		KGSL_GPU_AUX_COMMAND_TIMELINE, &cmd, sizeof(cmd));
+	if (ret)
+		return ret;
+
+	if (!cmd.count)
+		return -EINVAL;
+
+	timelineobj->timelines = kvcalloc(cmd.count,
+		sizeof(*timelineobj->timelines),
+		GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
+	if (!timelineobj->timelines)
+		return -ENOMEM;
+
+	src = u64_to_user_ptr(cmd.timelines);
+
+	/* Get the last queued timestamp on the drawobj context */
+	ret = kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_QUEUED, &queued);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < cmd.count; i++) {
+		struct kgsl_timeline_val val;
+
+		if (copy_struct_from_user(&val, sizeof(val), src,
+			cmd.timelines_size)) {
+			ret = -EFAULT;
+			goto err;
+		}
+
+		if (val.padding) {
+			ret = -EINVAL;
+			goto err;
+		}
+
+		timelineobj->timelines[i].timeline =
+			kgsl_timeline_by_id(dev_priv->device,
+				val.timeline);
+
+		if (!timelineobj->timelines[i].timeline) {
+			ret = -ENODEV;
+			goto err;
+		}
+
+		/* Get a context refcount so we can use the context pointer */
+		if (!_kgsl_context_get(context)) {
+			ret = -ENODEV;
+			goto err;
+		}
+
+		trace_kgsl_drawobj_timeline(val.timeline, val.seqno);
+		timelineobj->timelines[i].seqno = val.seqno;
+		timelineobj->timelines[i].context = context;
+		timelineobj->timelines[i].timestamp = queued;
+
+		src += cmd.timelines_size;
+	}
+
+	timelineobj->count = cmd.count;
+
+	/*
+	 * Register a kgsl_event to notify us when the last queued timestamp
+	 * retires. Take a refcount on the drawobj to keep it valid for the
+	 * callback, and take the sig_refcount to synchronize with the
+	 * timelineobj retire. Both these refcounts are put in the callback.
+	 */
+	kref_get(&drawobj->refcount);
+	kref_get(&timelineobj->sig_refcount);
+	ret = kgsl_add_event(device, &context->events, queued,
+			_timeline_signaled, timelineobj);
+
+	if (ret)
+		goto event_err;
+
+	return 0;
+
+event_err:
+	/*
+	 * If there was an error, put back sig_refcount and drawobj refcounts.
+	 * The caller still holds initial refcounts on both and puts them in
+	 * kgsl_drawobj_destroy(). Clean up the timelinelines array since we
+	 * do not want to signal anything now.
+	 */
+	kgsl_timelineobj_signal(timelineobj);
+	kgsl_drawobj_put(drawobj);
+err:
+	for (i = 0; i < cmd.count; i++) {
+		kgsl_timeline_put(timelineobj->timelines[i].timeline);
+		kgsl_context_put(timelineobj->timelines[i].context);
+	}
+
+	kvfree(timelineobj->timelines);
+	timelineobj->timelines = NULL;
+	return ret;
+}
+
+static void kgsl_drawobj_bind_callback(struct kgsl_sharedmem_bind_op *op)
+{
+	struct kgsl_drawobj_bind *bindobj = op->data;
+	struct kgsl_drawobj *drawobj = DRAWOBJ(bindobj);
+	struct kgsl_device *device = drawobj->device;
+
+	set_bit(KGSL_BINDOBJ_STATE_DONE, &bindobj->state);
+
+	/* Re-schedule the context */
+	if (device->ftbl->drawctxt_sched)
+		device->ftbl->drawctxt_sched(device,
+			drawobj->context);
+
+	/* Put back the reference we took when we started the operation */
+	kgsl_context_put(drawobj->context);
+	kgsl_drawobj_put(drawobj);
+}
+
+int kgsl_drawobj_add_bind(struct kgsl_device_private *dev_priv,
+		struct kgsl_drawobj_bind *bindobj,
+		void __user *src, u64 cmdsize)
+{
+	struct kgsl_gpu_aux_command_bind cmd;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_sharedmem_bind_op *op;
+	int ret;
+
+	ret = get_aux_command(src, cmdsize,
+		KGSL_GPU_AUX_COMMAND_BIND, &cmd, sizeof(cmd));
+	if (ret)
+		return ret;
+
+	op = kgsl_sharedmem_create_bind_op(private, cmd.target,
+		u64_to_user_ptr(cmd.rangeslist), cmd.numranges,
+		cmd.rangesize);
+
+	if (IS_ERR(op))
+		return PTR_ERR(op);
+
+	op->callback = kgsl_drawobj_bind_callback;
+	op->data = bindobj;
+
+	bindobj->bind = op;
+	return 0;
+}
+
+struct kgsl_drawobj_bind *kgsl_drawobj_bind_create(struct kgsl_device *device,
+		struct kgsl_context *context)
+{
+	int ret;
+	struct kgsl_drawobj_bind *bindobj =
+		kzalloc(sizeof(*bindobj), GFP_KERNEL);
+
+	if (!bindobj)
+		return ERR_PTR(-ENOMEM);
+
+	ret = drawobj_init(device, context, &bindobj->base, BINDOBJ_TYPE);
+	if (ret) {
+		kfree(bindobj);
+		return ERR_PTR(ret);
+	}
+
+	bindobj->base.destroy = bindobj_destroy;
+	bindobj->base.destroy_object = bindobj_destroy_object;
+
+	return bindobj;
+}
+
+/**
+ * kgsl_drawobj_sync_create() - Create a new sync obj
+ * structure
+ * @device: Pointer to a KGSL device struct
+ * @context: Pointer to a KGSL context struct
+ *
+ * Allocate an new kgsl_drawobj_sync structure
+ */
+struct kgsl_drawobj_sync *kgsl_drawobj_sync_create(struct kgsl_device *device,
+		struct kgsl_context *context)
+{
+	struct kgsl_drawobj_sync *syncobj =
+		kzalloc(sizeof(*syncobj), GFP_KERNEL);
+	int ret;
+
+	if (!syncobj)
+		return ERR_PTR(-ENOMEM);
+
+	ret = drawobj_init(device, context, &syncobj->base, SYNCOBJ_TYPE);
+	if (ret) {
+		kfree(syncobj);
+		return ERR_PTR(ret);
+	}
+
+	syncobj->base.destroy = syncobj_destroy;
+	syncobj->base.destroy_object = syncobj_destroy_object;
+
+	timer_setup(&syncobj->timer, syncobj_timer, 0);
+
+	return syncobj;
+}
+
+/**
+ * kgsl_drawobj_cmd_create() - Create a new command obj
+ * structure
+ * @device: Pointer to a KGSL device struct
+ * @context: Pointer to a KGSL context struct
+ * @flags: Flags for the command obj
+ * @type: type of cmdobj MARKER/CMD
+ *
+ * Allocate a new kgsl_drawobj_cmd structure
+ */
+struct kgsl_drawobj_cmd *kgsl_drawobj_cmd_create(struct kgsl_device *device,
+		struct kgsl_context *context, unsigned int flags,
+		unsigned int type)
+{
+	struct kgsl_drawobj_cmd *cmdobj = kzalloc(sizeof(*cmdobj), GFP_KERNEL);
+	int ret;
+
+	if (!cmdobj)
+		return ERR_PTR(-ENOMEM);
+
+	ret = drawobj_init(device, context, &cmdobj->base,
+		(type & (CMDOBJ_TYPE | MARKEROBJ_TYPE)));
+	if (ret) {
+		kfree(cmdobj);
+		return ERR_PTR(ret);
+	}
+
+	cmdobj->base.destroy = cmdobj_destroy;
+	cmdobj->base.destroy_object = cmdobj_destroy_object;
+
+	/* sanitize our flags for drawobjs */
+	cmdobj->base.flags = flags & (KGSL_DRAWOBJ_CTX_SWITCH
+		| KGSL_DRAWOBJ_MARKER
+		| KGSL_DRAWOBJ_END_OF_FRAME
+		| KGSL_DRAWOBJ_PWR_CONSTRAINT
+		| KGSL_DRAWOBJ_MEMLIST
+		| KGSL_DRAWOBJ_PROFILING
+		| KGSL_DRAWOBJ_PROFILING_KTIME
+		| KGSL_DRAWOBJ_START_RECURRING
+		| KGSL_DRAWOBJ_STOP_RECURRING);
+
+	INIT_LIST_HEAD(&cmdobj->cmdlist);
+	INIT_LIST_HEAD(&cmdobj->memlist);
+	cmdobj->requeue_cnt = 0;
+
+	if (!(type & CMDOBJ_TYPE))
+		return cmdobj;
+
+	atomic_inc(&context->proc_priv->cmd_count);
+	atomic_inc(&context->proc_priv->period->active_cmds);
+	spin_lock(&device->work_period_lock);
+	if (!__test_and_set_bit(KGSL_WORK_PERIOD, &device->flags)) {
+		mod_timer(&device->work_period_timer,
+			  jiffies + msecs_to_jiffies(KGSL_WORK_PERIOD_MS));
+		device->gpu_period.begin = ktime_get_ns();
+	}
+
+	/* Take a refcount here and put it back in kgsl_work_period_timer() */
+	if (!__test_and_set_bit(KGSL_WORK_PERIOD, &context->proc_priv->period->flags))
+		kref_get(&context->proc_priv->period->refcount);
+
+	spin_unlock(&device->work_period_lock);
+
+	return cmdobj;
+}
+
+#ifdef CONFIG_COMPAT
+static int add_ibdesc_list_compat(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj, void __user *ptr, int count)
+{
+	int i, ret = 0;
+	struct kgsl_ibdesc_compat ibdesc32;
+	struct kgsl_ibdesc ibdesc;
+
+	for (i = 0; i < count; i++) {
+		memset(&ibdesc32, 0, sizeof(ibdesc32));
+
+		if (copy_from_user(&ibdesc32, ptr, sizeof(ibdesc32))) {
+			ret = -EFAULT;
+			break;
+		}
+
+		ibdesc.gpuaddr = (unsigned long) ibdesc32.gpuaddr;
+		ibdesc.sizedwords = (size_t) ibdesc32.sizedwords;
+		ibdesc.ctrl = (unsigned int) ibdesc32.ctrl;
+
+		ret = kgsl_drawobj_cmd_add_ibdesc(device, cmdobj, &ibdesc);
+		if (ret)
+			break;
+
+		ptr += sizeof(ibdesc32);
+	}
+
+	return ret;
+}
+
+static int add_syncpoints_compat(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj, void __user *ptr, int count)
+{
+	struct kgsl_cmd_syncpoint_compat sync32;
+	struct kgsl_cmd_syncpoint sync;
+	int i, ret = 0;
+
+	for (i = 0; i < count; i++) {
+		memset(&sync32, 0, sizeof(sync32));
+
+		if (copy_from_user(&sync32, ptr, sizeof(sync32))) {
+			ret = -EFAULT;
+			break;
+		}
+
+		sync.type = sync32.type;
+		sync.priv = compat_ptr(sync32.priv);
+		sync.size = (size_t) sync32.size;
+
+		ret = kgsl_drawobj_sync_add_sync(device, syncobj, &sync);
+		if (ret)
+			break;
+
+		ptr += sizeof(sync32);
+	}
+
+	return ret;
+}
+#else
+static int add_ibdesc_list_compat(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj, void __user *ptr, int count)
+{
+	return -EINVAL;
+}
+
+static int add_syncpoints_compat(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj, void __user *ptr, int count)
+{
+	return -EINVAL;
+}
+#endif
+
+/* Returns:
+ *   -EINVAL: Bad data
+ *   0: All data fields are empty (nothing to do)
+ *   1: All list information is valid
+ */
+static int _verify_input_list(unsigned int count, void __user *ptr,
+		unsigned int size)
+{
+	/* Return early if nothing going on */
+	if (count == 0 && ptr == NULL && size == 0)
+		return 0;
+
+	/* Sanity check inputs */
+	if (count == 0 || ptr == NULL || size == 0)
+		return -EINVAL;
+
+	return 1;
+}
+
+int kgsl_drawobj_cmd_add_ibdesc_list(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj, void __user *ptr, int count)
+{
+	struct kgsl_ibdesc ibdesc;
+	struct kgsl_drawobj *baseobj = DRAWOBJ(cmdobj);
+	int i, ret;
+
+	/* Ignore everything if this is a MARKER */
+	if (baseobj->type & MARKEROBJ_TYPE)
+		return 0;
+
+	ret = _verify_input_list(count, ptr, sizeof(ibdesc));
+	if (ret <= 0)
+		return -EINVAL;
+
+	if (is_compat_task())
+		return add_ibdesc_list_compat(device, cmdobj, ptr, count);
+
+	for (i = 0; i < count; i++) {
+		memset(&ibdesc, 0, sizeof(ibdesc));
+
+		if (copy_from_user(&ibdesc, ptr, sizeof(ibdesc)))
+			return -EFAULT;
+
+		ret = kgsl_drawobj_cmd_add_ibdesc(device, cmdobj, &ibdesc);
+		if (ret)
+			return ret;
+
+		ptr += sizeof(ibdesc);
+	}
+
+	return 0;
+}
+
+int kgsl_drawobj_sync_add_syncpoints(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj, void __user *ptr, int count)
+{
+	struct kgsl_cmd_syncpoint sync;
+	int i, ret;
+
+	if (count == 0)
+		return 0;
+
+	syncobj->synclist = kcalloc(count,
+		sizeof(struct kgsl_drawobj_sync_event), GFP_KERNEL);
+
+	if (syncobj->synclist == NULL)
+		return -ENOMEM;
+
+	if (is_compat_task())
+		return add_syncpoints_compat(device, syncobj, ptr, count);
+
+	for (i = 0; i < count; i++) {
+		memset(&sync, 0, sizeof(sync));
+
+		if (copy_from_user(&sync, ptr, sizeof(sync)))
+			return -EFAULT;
+
+		ret = kgsl_drawobj_sync_add_sync(device, syncobj, &sync);
+		if (ret)
+			return ret;
+
+		ptr += sizeof(sync);
+	}
+
+	return 0;
+}
+
+static int kgsl_drawobj_add_memobject(struct list_head *head,
+		struct kgsl_command_object *obj)
+{
+	struct kgsl_memobj_node *mem;
+
+	mem = kmem_cache_alloc(memobjs_cache, GFP_KERNEL);
+	if (mem == NULL)
+		return -ENOMEM;
+
+	mem->gpuaddr = obj->gpuaddr;
+	mem->size = obj->size;
+	mem->id = obj->id;
+	mem->offset = obj->offset;
+	mem->flags = obj->flags;
+	mem->priv = 0;
+
+	list_add_tail(&mem->node, head);
+	return 0;
+}
+
+#define CMDLIST_FLAGS \
+	(KGSL_CMDLIST_IB | \
+	 KGSL_CMDLIST_CTXTSWITCH_PREAMBLE | \
+	 KGSL_CMDLIST_IB_PREAMBLE)
+
+/* This can only accept MARKEROBJ_TYPE and CMDOBJ_TYPE */
+int kgsl_drawobj_cmd_add_cmdlist(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj, void __user *ptr,
+		unsigned int size, unsigned int count)
+{
+	struct kgsl_command_object obj;
+	struct kgsl_drawobj *baseobj = DRAWOBJ(cmdobj);
+	int i, ret;
+
+	/* Ignore everything if this is a MARKER */
+	if (baseobj->type & MARKEROBJ_TYPE)
+		return 0;
+
+	ret = _verify_input_list(count, ptr, size);
+	if (ret <= 0)
+		return ret;
+
+	for (i = 0; i < count; i++) {
+		if (copy_struct_from_user(&obj, sizeof(obj), ptr, size))
+			return -EFAULT;
+
+		/* Sanity check the flags */
+		if (!(obj.flags & CMDLIST_FLAGS)) {
+			dev_err(device->dev,
+				     "invalid cmdobj ctxt %u flags %d id %d offset %llu addr %llx size %llu\n",
+				     baseobj->context->id, obj.flags, obj.id,
+				     obj.offset, obj.gpuaddr, obj.size);
+			return -EINVAL;
+		}
+
+		ret = kgsl_drawobj_add_memobject(&cmdobj->cmdlist, &obj);
+		if (ret)
+			return ret;
+
+		ptr += sizeof(obj);
+	}
+
+	return 0;
+}
+
+int kgsl_drawobj_cmd_add_memlist(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj, void __user *ptr,
+		unsigned int size, unsigned int count)
+{
+	struct kgsl_command_object obj;
+	struct kgsl_drawobj *baseobj = DRAWOBJ(cmdobj);
+	int i, ret;
+
+	/* Ignore everything if this is a MARKER */
+	if (baseobj->type & MARKEROBJ_TYPE)
+		return 0;
+
+	ret = _verify_input_list(count, ptr, size);
+	if (ret <= 0)
+		return ret;
+
+	for (i = 0; i < count; i++) {
+		if (copy_struct_from_user(&obj, sizeof(obj), ptr, size))
+			return -EFAULT;
+
+		if (!(obj.flags & KGSL_OBJLIST_MEMOBJ)) {
+			dev_err(device->dev,
+				     "invalid memobj ctxt %u flags %d id %d offset %lld addr %lld size %lld\n",
+				     DRAWOBJ(cmdobj)->context->id, obj.flags,
+				     obj.id, obj.offset, obj.gpuaddr,
+				     obj.size);
+			return -EINVAL;
+		}
+
+		if (obj.flags & KGSL_OBJLIST_PROFILE)
+			add_profiling_buffer(device, cmdobj, obj.gpuaddr,
+				obj.size, obj.id, obj.offset);
+		else {
+			ret = kgsl_drawobj_add_memobject(&cmdobj->memlist,
+				&obj);
+			if (ret)
+				return ret;
+		}
+
+		ptr += sizeof(obj);
+	}
+
+	return 0;
+}
+
+struct kgsl_drawobj_sync *
+kgsl_drawobj_create_timestamp_syncobj(struct kgsl_device *device,
+		struct kgsl_context *context, unsigned int timestamp)
+{
+	struct kgsl_drawobj_sync *syncobj;
+	struct kgsl_cmd_syncpoint_timestamp priv;
+	int ret;
+
+	syncobj = kgsl_drawobj_sync_create(device, context);
+	if (IS_ERR(syncobj))
+		return syncobj;
+
+	syncobj->synclist = kzalloc(sizeof(*syncobj->synclist), GFP_KERNEL);
+	if (!syncobj->synclist) {
+		kgsl_drawobj_destroy(DRAWOBJ(syncobj));
+		return ERR_PTR(-ENOMEM);
+	}
+
+	priv.timestamp = timestamp;
+	priv.context_id = context->id;
+
+	ret = drawobj_add_sync_timestamp(device, syncobj, &priv);
+	if (ret) {
+		kgsl_drawobj_destroy(DRAWOBJ(syncobj));
+		return ERR_PTR(ret);
+	}
+
+	return syncobj;
+}
+
+int kgsl_drawobj_sync_add_synclist(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj, void __user *ptr,
+		unsigned int size, unsigned int count)
+{
+	struct kgsl_command_syncpoint syncpoint;
+	struct kgsl_cmd_syncpoint sync;
+	int i, ret;
+
+	/* If creating a sync and the data is not there or wrong then error */
+	ret = _verify_input_list(count, ptr, size);
+	if (ret <= 0)
+		return -EINVAL;
+
+	syncobj->synclist = kcalloc(count,
+		sizeof(struct kgsl_drawobj_sync_event), GFP_KERNEL);
+
+	if (syncobj->synclist == NULL)
+		return -ENOMEM;
+
+	for (i = 0; i < count; i++) {
+		if (copy_struct_from_user(&syncpoint, sizeof(syncpoint), ptr, size))
+			return -EFAULT;
+
+		sync.type = syncpoint.type;
+		sync.priv = u64_to_user_ptr(syncpoint.priv);
+		sync.size = syncpoint.size;
+
+		ret = kgsl_drawobj_sync_add_sync(device, syncobj, &sync);
+		if (ret)
+			return ret;
+
+		ptr += sizeof(syncpoint);
+	}
+
+	return 0;
+}
+
+void kgsl_drawobjs_cache_exit(void)
+{
+	kmem_cache_destroy(memobjs_cache);
+}
+
+int kgsl_drawobjs_cache_init(void)
+{
+	memobjs_cache = KMEM_CACHE(kgsl_memobj_node, 0);
+
+	if (!memobjs_cache)
+		return -ENOMEM;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_drawobj.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_drawobj.h
@@ -0,0 +1,347 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __KGSL_DRAWOBJ_H
+#define __KGSL_DRAWOBJ_H
+
+#include <linux/dma-fence.h>
+#include <linux/kref.h>
+
+#define DRAWOBJ(obj) (&obj->base)
+#define SYNCOBJ(obj) \
+	container_of(obj, struct kgsl_drawobj_sync, base)
+#define CMDOBJ(obj) \
+	container_of(obj, struct kgsl_drawobj_cmd, base)
+
+#define CMDOBJ_TYPE     BIT(0)
+#define MARKEROBJ_TYPE  BIT(1)
+#define SYNCOBJ_TYPE    BIT(2)
+#define BINDOBJ_TYPE    BIT(3)
+#define TIMELINEOBJ_TYPE    BIT(4)
+
+/**
+ * struct kgsl_drawobj - KGSL drawobj descriptor
+ * @device: KGSL GPU device that the command was created for
+ * @context: KGSL context that created the command
+ * @type: Object type
+ * @timestamp: Timestamp assigned to the command
+ * @flags: flags
+ * @refcount: kref structure to maintain the reference count
+ */
+struct kgsl_drawobj {
+	struct kgsl_device *device;
+	struct kgsl_context *context;
+	uint32_t type;
+	uint32_t timestamp;
+	unsigned long flags;
+	struct kref refcount;
+	/** @destroy: Callbak function to take down the object */
+	void (*destroy)(struct kgsl_drawobj *drawobj);
+	/** @destroy_object: Callback function to free the object memory */
+	void (*destroy_object)(struct kgsl_drawobj *drawobj);
+};
+
+/**
+ * struct kgsl_drawobj_cmd - KGSL command obj, This covers marker
+ * cmds also since markers are special form of cmds that do not
+ * need their cmds to be executed.
+ * @base: Base kgsl_drawobj, this needs to be the first entry
+ * @priv: Internal flags
+ * @global_ts: The ringbuffer timestamp corresponding to this
+ *    command obj
+ * @fault_policy: Internal policy describing how to handle this command in case
+ * of a fault
+ * @fault_recovery: recovery actions actually tried for this batch
+ *     be hung
+ * @refcount: kref structure to maintain the reference count
+ * @cmdlist: List of IBs to issue
+ * @memlist: List of all memory used in this command batch
+ * @marker_timestamp: For markers, the timestamp of the last "real" command that
+ * was queued
+ * @profiling_buf_entry: Mem entry containing the profiling buffer
+ * @profiling_buffer_gpuaddr: GPU virt address of the profile buffer added here
+ * for easy access
+ * @profile_index: Index to store the start/stop ticks in the kernel profiling
+ * buffer
+ * @submit_ticks: Variable to hold ticks at the time of
+ *     command obj submit.
+
+ */
+struct kgsl_drawobj_cmd {
+	struct kgsl_drawobj base;
+	unsigned long priv;
+	unsigned int global_ts;
+	unsigned long fault_policy;
+	unsigned long fault_recovery;
+	struct list_head cmdlist;
+	struct list_head memlist;
+	unsigned int marker_timestamp;
+	struct kgsl_mem_entry *profiling_buf_entry;
+	uint64_t profiling_buffer_gpuaddr;
+	unsigned int profile_index;
+	uint64_t submit_ticks;
+	/* @numibs: Number of ibs in this cmdobj */
+	u32 numibs;
+	/* @requeue_cnt: Number of times cmdobj was requeued before submission to dq succeeded */
+	u32 requeue_cnt;
+};
+
+/* This sync object cannot be sent to hardware */
+#define KGSL_SYNCOBJ_SW BIT(0)
+/* This sync object can be sent to hardware */
+#define KGSL_SYNCOBJ_HW BIT(1)
+
+/**
+ * struct kgsl_drawobj_sync - KGSL sync object
+ * @base: Base kgsl_drawobj, this needs to be the first entry
+ * @synclist: Array of context/timestamp tuples to wait for before issuing
+ * @numsyncs: Number of sync entries in the array
+ * @pending: Bitmask of sync events that are active
+ * @timer: a timer used to track possible sync timeouts for this
+ *         sync obj
+ * @timeout_jiffies: For a sync obj the jiffies at
+ * which the timer will expire
+ */
+struct kgsl_drawobj_sync {
+	struct kgsl_drawobj base;
+	struct kgsl_drawobj_sync_event *synclist;
+	unsigned int numsyncs;
+	unsigned long pending;
+	struct timer_list timer;
+	unsigned long timeout_jiffies;
+	/** @flags: sync object internal flags */
+	u32 flags;
+	/** @num_hw_fence: number of hw fences in this syncobj */
+	u32 num_hw_fence;
+};
+
+#define KGSL_BINDOBJ_STATE_START 0
+#define KGSL_BINDOBJ_STATE_DONE  1
+
+/**
+ * struct kgsl_drawobj_bind - KGSL virtual buffer object bind operation
+ * @base: &struct kgsl_drawobj container
+ * @state: Current state of the draw operation
+ * @bind: Pointer to the VBO bind operation struct
+ */
+struct kgsl_drawobj_bind {
+	struct kgsl_drawobj base;
+	unsigned long state;
+	struct kgsl_sharedmem_bind_op *bind;
+};
+
+static inline struct kgsl_drawobj_bind *BINDOBJ(struct kgsl_drawobj *obj)
+{
+	return container_of(obj, struct kgsl_drawobj_bind, base);
+}
+
+/**
+ * struct kgsl_drawobj_timeline - KGSL timeline signal operation
+ */
+struct kgsl_drawobj_timeline {
+	/** @base: &struct kgsl_drawobj container */
+	struct kgsl_drawobj base;
+	/** @sig_refcount: Refcount to trigger timeline signaling */
+	struct kref sig_refcount;
+	/* @timelines: Array of timeline events to signal */
+	struct kgsl_timeline_event *timelines;
+	/** @count: Number of items in timelines */
+	int count;
+};
+
+static inline struct kgsl_drawobj_timeline *
+TIMELINEOBJ(struct kgsl_drawobj *obj)
+{
+	return container_of(obj, struct kgsl_drawobj_timeline, base);
+}
+
+#define KGSL_FENCE_NAME_LEN 74
+
+struct fence_info {
+	char name[KGSL_FENCE_NAME_LEN];
+};
+
+struct event_fence_info {
+	struct fence_info *fences;
+	int num_fences;
+};
+
+struct event_timeline_info {
+	u64 seqno;
+	u32 timeline;
+};
+
+/**
+ * struct kgsl_drawobj_sync_event
+ * @id: identifer (positiion within the pending bitmap)
+ * @type: Syncpoint type
+ * @syncobj: Pointer to the syncobj that owns the sync event
+ * @context: KGSL context for whose timestamp we want to
+ *           register this event
+ * @timestamp: Pending timestamp for the event
+ * @handle: Pointer to a sync fence handle
+ * @device: Pointer to the KGSL device
+ */
+struct kgsl_drawobj_sync_event {
+	unsigned int id;
+	int type;
+	struct kgsl_drawobj_sync *syncobj;
+	struct kgsl_context *context;
+	unsigned int timestamp;
+	struct kgsl_sync_fence_cb *handle;
+	struct kgsl_device *device;
+	/** @priv: Type specific private information */
+	void *priv;
+	/**
+	 * @fence: Pointer to a dma fence for KGSL_CMD_SYNCPOINT_TYPE_TIMELINE
+	 * events
+	 */
+	struct dma_fence *fence;
+	/** @cb: Callback struct for KGSL_CMD_SYNCPOINT_TYPE_TIMELINE */
+	struct dma_fence_cb cb;
+	/** @work : work_struct for KGSL_CMD_SYNCPOINT_TYPE_TIMELINE */
+	struct work_struct work;
+};
+
+#define KGSL_DRAWOBJ_FLAGS \
+	{ KGSL_DRAWOBJ_MARKER, "MARKER" }, \
+	{ KGSL_DRAWOBJ_CTX_SWITCH, "CTX_SWITCH" }, \
+	{ KGSL_DRAWOBJ_SYNC, "SYNC" }, \
+	{ KGSL_DRAWOBJ_END_OF_FRAME, "EOF" }, \
+	{ KGSL_DRAWOBJ_PWR_CONSTRAINT, "PWR_CONSTRAINT" }, \
+	{ KGSL_DRAWOBJ_SUBMIT_IB_LIST, "IB_LIST" }
+
+/**
+ * enum kgsl_drawobj_cmd_priv - Internal command obj flags
+ * @CMDOBJ_SKIP - skip the entire command obj
+ * @CMDOBJ_FORCE_PREAMBLE - Force the preamble on for
+ *           command obj
+ * @CMDOBJ_WFI - Force wait-for-idle for the submission
+ * @CMDOBJ_PROFILE - store the start / retire ticks for
+ * @CMDOBJ_FAULT - Mark the command object as faulted
+ * the command obj in the profiling buffer
+ * @CMDOBJ_RECURRING_START: To track recurring command object at GMU
+ * @CMDOBJ_RECURRING_STOP: To untrack recurring command object from GMU
+ * @CMDOBJ_MARKER_EXPIRED: Whether this MARKER object is retired or not
+ */
+enum kgsl_drawobj_cmd_priv {
+	CMDOBJ_SKIP = 0,
+	CMDOBJ_FORCE_PREAMBLE,
+	CMDOBJ_WFI,
+	CMDOBJ_PROFILE,
+	CMDOBJ_FAULT,
+	CMDOBJ_RECURRING_START,
+	CMDOBJ_RECURRING_STOP,
+	CMDOBJ_MARKER_EXPIRED,
+};
+
+struct kgsl_ibdesc;
+struct kgsl_cmd_syncpoint;
+
+struct kgsl_drawobj_cmd *kgsl_drawobj_cmd_create(struct kgsl_device *device,
+		struct kgsl_context *context, unsigned int flags,
+		unsigned int type);
+int kgsl_drawobj_cmd_add_ibdesc(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj, struct kgsl_ibdesc *ibdesc);
+int kgsl_drawobj_cmd_add_ibdesc_list(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj, void __user *ptr, int count);
+int kgsl_drawobj_cmd_add_cmdlist(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj, void __user *ptr,
+		unsigned int size, unsigned int count);
+int kgsl_drawobj_cmd_add_memlist(struct kgsl_device *device,
+		struct kgsl_drawobj_cmd *cmdobj, void __user *ptr,
+		unsigned int size, unsigned int count);
+
+struct kgsl_drawobj_sync *kgsl_drawobj_sync_create(struct kgsl_device *device,
+		struct kgsl_context *context);
+int kgsl_drawobj_sync_add_syncpoints(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj, void __user *ptr,
+		int count);
+int kgsl_drawobj_sync_add_synclist(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj, void __user *ptr,
+		unsigned int size, unsigned int count);
+int kgsl_drawobj_sync_add_sync(struct kgsl_device *device,
+		struct kgsl_drawobj_sync *syncobj,
+		struct kgsl_cmd_syncpoint *sync);
+
+int kgsl_drawobjs_cache_init(void);
+void kgsl_drawobjs_cache_exit(void);
+
+void kgsl_dump_syncpoints(struct kgsl_device *device,
+	struct kgsl_drawobj_sync *syncobj);
+
+void kgsl_drawobj_destroy(struct kgsl_drawobj *drawobj);
+
+void kgsl_drawobj_destroy_object(struct kref *kref);
+
+static inline bool kgsl_drawobj_events_pending(
+		struct kgsl_drawobj_sync *syncobj)
+{
+	return !bitmap_empty(&syncobj->pending, KGSL_MAX_SYNCPOINTS);
+}
+
+static inline bool kgsl_drawobj_event_pending(
+		struct kgsl_drawobj_sync *syncobj, unsigned int bit)
+{
+	if (bit >= KGSL_MAX_SYNCPOINTS)
+		return false;
+
+	return test_bit(bit, &syncobj->pending);
+}
+
+static inline void kgsl_drawobj_put(struct kgsl_drawobj *drawobj)
+{
+	if (drawobj)
+		kref_put(&drawobj->refcount, kgsl_drawobj_destroy_object);
+}
+
+/**
+ * kgsl_drawobj_create_timestamp_syncobj - Create a syncobj for a timestamp
+ * @device: A GPU device handle
+ * @context: Draw context for the syncobj
+ * @timestamp: Timestamp to sync on
+ *
+ * Create a sync object for @timestamp on @context.
+ * Return: A pointer to the sync object
+ */
+struct kgsl_drawobj_sync *
+kgsl_drawobj_create_timestamp_syncobj(struct kgsl_device *device,
+		struct kgsl_context *context, unsigned int timestamp);
+
+struct kgsl_drawobj_bind *kgsl_drawobj_bind_create(struct kgsl_device *device,
+		struct kgsl_context *context);
+
+int kgsl_drawobj_add_bind(struct kgsl_device_private *dev_priv,
+		struct kgsl_drawobj_bind *bindobj,
+		void __user *src, u64 cmdsize);
+
+/**
+ * kgsl_drawobj_timeline_create - Create a timeline draw object
+ * @device: A GPU device handle
+ * @context: Draw context for the drawobj
+ *
+ * Create a timeline draw object on @context.
+ * Return: A pointer to the draw object
+ */
+struct kgsl_drawobj_timeline *
+kgsl_drawobj_timeline_create(struct kgsl_device *device,
+		struct kgsl_context *context);
+
+/**
+ * kgsl_drwobj_add_timeline - Add a timeline to a timeline drawobj
+ * @dev_priv: Pointer to the process private data
+ * @timelineobj: Pointer to a timeline drawobject
+ * @src: Ponter to the &struct kgsl_timeline_val from userspace
+ * @cmdsize: size of the object in @src
+ *
+ * Add a timeline to an draw object.
+ * Return: 0 on success or negative on failure
+ */
+int kgsl_drawobj_add_timeline(struct kgsl_device_private *dev_priv,
+		struct kgsl_drawobj_timeline *timelineobj,
+		void __user *src, u64 cmdsize);
+
+#endif /* __KGSL_DRAWOBJ_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_eventlog.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_eventlog.c
@@ -0,0 +1,266 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/sched.h>
+#include <linux/sched/clock.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+
+#include "kgsl_device.h"
+#include "kgsl_eventlog.h"
+#include "kgsl_snapshot.h"
+#include "kgsl_util.h"
+
+#define EVENTLOG_SIZE (SZ_64K + SZ_32K)
+#define MAGIC 0xabbaabba
+#define LOG_FENCE_NAME_LEN 74
+
+#define KGSL_SNAPSHOT_EVENTLOG_TYPE 0x1
+#define KGSL_SNAPSHOT_EVENTLOG_VERSION 0x0
+
+/*
+ * This an internal event used to skip empty space at the bottom of the
+ * ringbuffer
+ */
+
+#define LOG_SKIP 1
+#define LOG_FIRE_EVENT 2
+#define LOG_CMDBATCH_SUBMITTED_EVENT 3
+#define LOG_CMDBATCH_RETIRED_EVENT 4
+#define LOG_SYNCPOINT_FENCE_EVENT 5
+#define LOG_SYNCPOINT_FENCE_EXPIRE_EVENT 6
+#define LOG_TIMELINE_FENCE_ALLOC_EVENT 7
+#define LOG_TIMELINE_FENCE_RELEASE_EVENT 8
+
+static spinlock_t lock;
+static void *kgsl_eventlog;
+static int eventlog_wptr;
+
+struct kgsl_log_header {
+	/** @magic: Magic value to identify header */
+	u32 magic;
+	/** @pid: : PID of the process */
+	int pid;
+	/** @time: System time in nanoseconds */
+	u64 time;
+	/** @event: bits[0:15] specify the event ID. bits[16:31] specify event version */
+	u32 event;
+	/** @size: Size of the event data in bytes */
+	u32 size;
+};
+
+/* Add a marker to skip the rest of the eventlog and start over fresh */
+static void add_skip_header(u32 offset)
+{
+	struct kgsl_log_header *header = kgsl_eventlog + offset;
+
+	header->magic = MAGIC;
+	header->time = local_clock();
+	header->pid = 0;
+	header->event = FIELD_PREP(GENMASK(15, 0), LOG_SKIP);
+	header->size = EVENTLOG_SIZE - sizeof(*header) - offset;
+}
+
+static void *kgsl_eventlog_alloc(u16 eventid, u32 size)
+{
+	struct kgsl_log_header *header;
+	u32 datasize = size + sizeof(*header);
+	unsigned long flags;
+	void *data;
+
+	if (!kgsl_eventlog)
+		return NULL;
+
+	spin_lock_irqsave(&lock, flags);
+	if (eventlog_wptr + datasize > (EVENTLOG_SIZE - sizeof(*header))) {
+		add_skip_header(eventlog_wptr);
+		eventlog_wptr = datasize;
+		data = kgsl_eventlog;
+	} else {
+		data = kgsl_eventlog + eventlog_wptr;
+		eventlog_wptr += datasize;
+	}
+	spin_unlock_irqrestore(&lock, flags);
+
+	header = data;
+
+	header->magic = MAGIC;
+	header->time = local_clock();
+	header->pid = current->pid;
+	header->event = FIELD_PREP(GENMASK(15, 0), eventid);
+	header->size = size;
+
+	return data + sizeof(*header);
+}
+
+void kgsl_eventlog_init(void)
+{
+	kgsl_eventlog = kzalloc(EVENTLOG_SIZE, GFP_KERNEL);
+	eventlog_wptr = 0;
+
+	spin_lock_init(&lock);
+
+	kgsl_add_to_minidump("KGSL_EVENTLOG", (u64) kgsl_eventlog,
+				__pa(kgsl_eventlog), EVENTLOG_SIZE);
+}
+
+void kgsl_eventlog_exit(void)
+{
+	kgsl_remove_from_minidump("KGSL_EVENTLOG", (u64) kgsl_eventlog,
+				__pa(kgsl_eventlog), EVENTLOG_SIZE);
+
+	kfree(kgsl_eventlog);
+	kgsl_eventlog = NULL;
+	eventlog_wptr = 0;
+}
+
+void log_kgsl_fire_event(u32 id, u32 ts, u32 type, u32 age)
+{
+	struct {
+		u32 id;
+		u32 ts;
+		u32 type;
+		u32 age;
+	} *entry;
+
+	entry = kgsl_eventlog_alloc(LOG_FIRE_EVENT, sizeof(*entry));
+	if (!entry)
+		return;
+
+	entry->id = id;
+	entry->ts = ts;
+	entry->type = type;
+	entry->age = age;
+}
+
+void log_kgsl_cmdbatch_submitted_event(u32 id, u32 ts, u32 prio, u64 flags)
+{
+	struct {
+		u32 id;
+		u32 ts;
+		u32 prio;
+		u64 flags;
+	} *entry;
+
+	entry = kgsl_eventlog_alloc(LOG_CMDBATCH_SUBMITTED_EVENT, sizeof(*entry));
+	if (!entry)
+		return;
+
+	entry->id = id;
+	entry->ts = ts;
+	entry->prio = prio;
+	entry->flags = flags;
+}
+
+void log_kgsl_cmdbatch_retired_event(u32 id, u32 ts, u32 prio, u64 flags,
+		u64 start, u64 retire)
+{
+	struct {
+		u32 id;
+		u32 ts;
+		u32 prio;
+		u64 flags;
+		u64 start;
+		u64 retire;
+	} *entry;
+
+	entry = kgsl_eventlog_alloc(LOG_CMDBATCH_RETIRED_EVENT, sizeof(*entry));
+	if (!entry)
+		return;
+
+	entry->id = id;
+	entry->ts = ts;
+	entry->prio = prio;
+	entry->flags = flags;
+	entry->start = start;
+	entry->retire = retire;
+}
+
+void log_kgsl_syncpoint_fence_event(u32 id, char *fence_name)
+{
+	struct {
+		u32 id;
+		char name[LOG_FENCE_NAME_LEN];
+	} *entry;
+
+	entry = kgsl_eventlog_alloc(LOG_SYNCPOINT_FENCE_EVENT, sizeof(*entry));
+	if (!entry)
+		return;
+
+	entry->id = id;
+	memset(entry->name, 0, sizeof(entry->name));
+	strscpy(entry->name, fence_name, sizeof(entry->name));
+}
+
+void log_kgsl_syncpoint_fence_expire_event(u32 id, char *fence_name)
+{
+	struct {
+		u32 id;
+		char name[LOG_FENCE_NAME_LEN];
+	} *entry;
+
+	entry = kgsl_eventlog_alloc(LOG_SYNCPOINT_FENCE_EXPIRE_EVENT, sizeof(*entry));
+	if (!entry)
+		return;
+
+	entry->id = id;
+	memset(entry->name, 0, sizeof(entry->name));
+	strscpy(entry->name, fence_name, sizeof(entry->name));
+}
+
+void log_kgsl_timeline_fence_alloc_event(u32 id, u64 seqno)
+{
+	struct {
+		u32 id;
+		u64 seqno;
+	} *entry;
+
+	entry = kgsl_eventlog_alloc(LOG_TIMELINE_FENCE_ALLOC_EVENT, sizeof(*entry));
+	if (!entry)
+		return;
+
+	entry->id = id;
+	entry->seqno = seqno;
+}
+
+void log_kgsl_timeline_fence_release_event(u32 id, u64 seqno)
+{
+	struct {
+		u32 id;
+		u64 seqno;
+	} *entry;
+
+	entry = kgsl_eventlog_alloc(LOG_TIMELINE_FENCE_RELEASE_EVENT, sizeof(*entry));
+	if (!entry)
+		return;
+
+	entry->id = id;
+	entry->seqno = seqno;
+}
+
+size_t kgsl_snapshot_eventlog_buffer(struct kgsl_device *device,
+		u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_eventlog *hdr =
+		(struct kgsl_snapshot_eventlog *)buf;
+	u32 *data = (u32 *)(buf + sizeof(*hdr));
+
+	if (!kgsl_eventlog)
+		return 0;
+
+	if (remain < EVENTLOG_SIZE + sizeof(*hdr)) {
+		dev_err(device->dev,
+			"snapshot: Not enough memory for eventlog\n");
+		return 0;
+	}
+
+	hdr->size = EVENTLOG_SIZE;
+	hdr->type = KGSL_SNAPSHOT_EVENTLOG_TYPE;
+	hdr->version = KGSL_SNAPSHOT_EVENTLOG_VERSION;
+	memcpy(data, kgsl_eventlog, EVENTLOG_SIZE);
+
+	return EVENTLOG_SIZE + sizeof(*hdr);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_eventlog.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_eventlog.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _KGSL_EVENTLOG_H
+#define _KGSL_EVENTLOG_H
+
+void kgsl_eventlog_init(void);
+void kgsl_eventlog_exit(void);
+
+void log_kgsl_fire_event(u32 id, u32 ts, u32 type, u32 age);
+void log_kgsl_cmdbatch_submitted_event(u32 id, u32 ts, u32 prio, u64 flags);
+void log_kgsl_cmdbatch_retired_event(u32 id, u32 ts, u32 prio, u64 flags,
+		u64 start, u64 retire);
+void log_kgsl_syncpoint_fence_event(u32 id, char *fence_name);
+void log_kgsl_syncpoint_fence_expire_event(u32 id, char *fence_name);
+void log_kgsl_timeline_fence_alloc_event(u32 id, u64 seqno);
+void log_kgsl_timeline_fence_release_event(u32 id, u64 seqno);
+size_t kgsl_snapshot_eventlog_buffer(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_events.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_events.c
@@ -0,0 +1,435 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2011-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/spinlock.h>
+
+#include "kgsl_debugfs.h"
+#include "kgsl_device.h"
+#include "kgsl_eventlog.h"
+#include "kgsl_trace.h"
+
+/*
+ * Define an kmem cache for the event structures since we allocate and free them
+ * so frequently
+ */
+static struct kmem_cache *events_cache;
+
+static inline void signal_event(struct kgsl_device *device,
+		struct kgsl_event *event, int result)
+{
+	list_del(&event->node);
+	event->result = result;
+	kthread_queue_work(device->events_worker, &event->work);
+}
+
+/**
+ * _kgsl_event_worker() - Work handler for processing GPU event callbacks
+ * @work: Pointer to the kthread_work for the event
+ *
+ * Each event callback has its own kthread_work struct and is run on a event specific
+ * worker thread.  This is the worker that queues up the event callback function.
+ */
+static void _kgsl_event_worker(struct kthread_work *work)
+{
+	struct kgsl_event *event = container_of(work, struct kgsl_event, work);
+	int id = KGSL_CONTEXT_ID(event->context);
+
+	trace_kgsl_fire_event(id, event->timestamp, event->result,
+		jiffies - event->created, event->func);
+
+	log_kgsl_fire_event(id, event->timestamp, event->result,
+		jiffies - event->created);
+
+	event->func(event->device, event->group, event->priv, event->result);
+
+	kgsl_context_put(event->context);
+	kmem_cache_free(events_cache, event);
+}
+
+/* return true if the group needs to be processed */
+static bool _do_process_group(unsigned int processed, unsigned int cur)
+{
+	if (processed == cur)
+		return false;
+
+	/*
+	 * This ensures that the timestamp didn't slip back accidently, maybe
+	 * due to a memory barrier issue. This is highly unlikely but we've
+	 * been burned here in the past.
+	 */
+	if ((cur < processed) && ((processed - cur) < KGSL_TIMESTAMP_WINDOW))
+		return false;
+
+	return true;
+}
+
+static void _process_event_group(struct kgsl_device *device,
+		struct kgsl_event_group *group, bool flush)
+{
+	struct kgsl_event *event, *tmp;
+	unsigned int timestamp;
+	struct kgsl_context *context;
+
+	if (group == NULL)
+		return;
+
+	context = group->context;
+
+	/*
+	 * Sanity check to be sure that we we aren't racing with the context
+	 * getting destroyed
+	 */
+	if (WARN_ON(context != NULL && !_kgsl_context_get(context)))
+		return;
+
+	spin_lock(&group->lock);
+
+	group->readtimestamp(device, group->priv, KGSL_TIMESTAMP_RETIRED,
+		&timestamp);
+
+	if (!flush && !_do_process_group(group->processed, timestamp))
+		goto out;
+
+	list_for_each_entry_safe(event, tmp, &group->events, node) {
+		if (timestamp_cmp(event->timestamp, timestamp) <= 0)
+			signal_event(device, event, KGSL_EVENT_RETIRED);
+		else if (flush)
+			signal_event(device, event, KGSL_EVENT_CANCELLED);
+
+	}
+
+	group->processed = timestamp;
+
+out:
+	spin_unlock(&group->lock);
+	kgsl_context_put(context);
+}
+
+/**
+ * kgsl_process_event_group() - Handle all the retired events in a group
+ * @device: Pointer to a KGSL device
+ * @group: Pointer to a GPU events group to process
+ */
+
+void kgsl_process_event_group(struct kgsl_device *device,
+		struct kgsl_event_group *group)
+{
+	_process_event_group(device, group, false);
+}
+
+/**
+ * kgsl_flush_event_group() - flush all the events in a group by retiring the
+ * ones can be retired and cancelling the ones that are pending
+ * @device: Pointer to a KGSL device
+ * @group: Pointer to a GPU events group to process
+ */
+void kgsl_flush_event_group(struct kgsl_device *device,
+		struct kgsl_event_group *group)
+{
+	_process_event_group(device, group, true);
+}
+
+/**
+ * kgsl_cancel_events_timestamp() - Cancel pending events for a given timestamp
+ * @device: Pointer to a KGSL device
+ * @group: Ponter to the GPU event group that owns the event
+ * @timestamp: Registered expiry timestamp for the event
+ */
+void kgsl_cancel_events_timestamp(struct kgsl_device *device,
+		struct kgsl_event_group *group, unsigned int timestamp)
+{
+	struct kgsl_event *event, *tmp;
+
+	spin_lock(&group->lock);
+
+	list_for_each_entry_safe(event, tmp, &group->events, node) {
+		if (timestamp_cmp(timestamp, event->timestamp) == 0)
+			signal_event(device, event, KGSL_EVENT_CANCELLED);
+	}
+
+	spin_unlock(&group->lock);
+}
+
+/**
+ * kgsl_cancel_events() - Cancel all pending events in the group
+ * @device: Pointer to a KGSL device
+ * @group: Pointer to a kgsl_events_group
+ */
+void kgsl_cancel_events(struct kgsl_device *device,
+		struct kgsl_event_group *group)
+{
+	struct kgsl_event *event, *tmp;
+
+	spin_lock(&group->lock);
+
+	list_for_each_entry_safe(event, tmp, &group->events, node)
+		signal_event(device, event, KGSL_EVENT_CANCELLED);
+
+	spin_unlock(&group->lock);
+}
+
+/**
+ * kgsl_cancel_event() - Cancel a specific event from a group
+ * @device: Pointer to a KGSL device
+ * @group: Pointer to the group that contains the events
+ * @timestamp: Registered expiry timestamp for the event
+ * @func: Registered callback for the function
+ * @priv: Registered priv data for the function
+ */
+void kgsl_cancel_event(struct kgsl_device *device,
+		struct kgsl_event_group *group, unsigned int timestamp,
+		kgsl_event_func func, void *priv)
+{
+	struct kgsl_event *event, *tmp;
+
+	spin_lock(&group->lock);
+
+	list_for_each_entry_safe(event, tmp, &group->events, node) {
+		if (timestamp == event->timestamp && func == event->func &&
+			event->priv == priv)
+			signal_event(device, event, KGSL_EVENT_CANCELLED);
+	}
+
+	spin_unlock(&group->lock);
+}
+
+/**
+ * kgsl_event_pending() - Searches for an event in an event group
+ * @device: Pointer to a KGSL device
+ * @group: Pointer to the group that contains the events
+ * @timestamp: Registered expiry timestamp for the event
+ * @func: Registered callback for the function
+ * @priv: Registered priv data for the function
+ */
+bool kgsl_event_pending(struct kgsl_device *device,
+		struct kgsl_event_group *group,
+		unsigned int timestamp, kgsl_event_func func, void *priv)
+{
+	struct kgsl_event *event;
+	bool result = false;
+
+	spin_lock(&group->lock);
+	list_for_each_entry(event, &group->events, node) {
+		if (timestamp == event->timestamp && func == event->func &&
+			event->priv == priv) {
+			result = true;
+			break;
+		}
+	}
+	spin_unlock(&group->lock);
+	return result;
+}
+/**
+ * kgsl_add_event() - Add a new GPU event to a group
+ * @device: Pointer to a KGSL device
+ * @group: Pointer to the group to add the event to
+ * @timestamp: Timestamp that the event will expire on
+ * @func: Callback function for the event
+ * @priv: Private data to send to the callback function
+ */
+int kgsl_add_event(struct kgsl_device *device, struct kgsl_event_group *group,
+		unsigned int timestamp, kgsl_event_func func, void *priv)
+{
+	unsigned int queued;
+	struct kgsl_context *context = group->context;
+	struct kgsl_event *event;
+	unsigned int retired;
+
+	if (!func)
+		return -EINVAL;
+
+	/*
+	 * If the caller is creating their own timestamps, let them schedule
+	 * events in the future. Otherwise only allow timestamps that have been
+	 * queued.
+	 */
+	if (!context || !(context->flags & KGSL_CONTEXT_USER_GENERATED_TS)) {
+		group->readtimestamp(device, group->priv, KGSL_TIMESTAMP_QUEUED,
+			&queued);
+
+		if (timestamp_cmp(timestamp, queued) > 0)
+			return -EINVAL;
+	}
+
+	event = kmem_cache_alloc(events_cache, GFP_KERNEL);
+	if (event == NULL)
+		return -ENOMEM;
+
+	/* Get a reference to the context while the event is active */
+	if (context != NULL && !_kgsl_context_get(context)) {
+		kmem_cache_free(events_cache, event);
+		return -ENOENT;
+	}
+
+	event->device = device;
+	event->context = context;
+	event->timestamp = timestamp;
+	event->priv = priv;
+	event->func = func;
+	event->created = jiffies;
+	event->group = group;
+
+	kthread_init_work(&event->work, _kgsl_event_worker);
+
+	trace_kgsl_register_event(KGSL_CONTEXT_ID(context), timestamp, func);
+
+	spin_lock(&group->lock);
+
+	/*
+	 * Check to see if the requested timestamp has already retired.  If so,
+	 * schedule the callback right away
+	 */
+	group->readtimestamp(device, group->priv, KGSL_TIMESTAMP_RETIRED,
+		&retired);
+
+	if (timestamp_cmp(retired, timestamp) >= 0) {
+		event->result = KGSL_EVENT_RETIRED;
+		kthread_queue_work(device->events_worker, &event->work);
+		spin_unlock(&group->lock);
+		return 0;
+	}
+
+	/* Add the event to the group list */
+	list_add_tail(&event->node, &group->events);
+
+	spin_unlock(&group->lock);
+
+	return 0;
+}
+
+void kgsl_process_event_groups(struct kgsl_device *device)
+{
+	struct kgsl_event_group *group;
+
+	read_lock(&device->event_groups_lock);
+	list_for_each_entry(group, &device->event_groups, group)
+		_process_event_group(device, group, false);
+	read_unlock(&device->event_groups_lock);
+}
+
+void kgsl_del_event_group(struct kgsl_device *device,
+		struct kgsl_event_group *group)
+{
+	/* Check if the group is uninintalized */
+	if (!group->context)
+		return;
+
+	/* Make sure that all the events have been deleted from the list */
+	WARN_ON(!list_empty(&group->events));
+
+	write_lock(&device->event_groups_lock);
+	list_del(&group->group);
+	write_unlock(&device->event_groups_lock);
+}
+
+void kgsl_add_event_group(struct kgsl_device *device,
+		struct kgsl_event_group *group, struct kgsl_context *context,
+		readtimestamp_func readtimestamp,
+		void *priv, const char *fmt, ...)
+{
+	va_list args;
+
+	WARN_ON(readtimestamp == NULL);
+
+	spin_lock_init(&group->lock);
+	INIT_LIST_HEAD(&group->events);
+
+	group->context = context;
+	group->readtimestamp = readtimestamp;
+	group->priv = priv;
+
+	if (fmt) {
+		va_start(args, fmt);
+		vsnprintf(group->name, sizeof(group->name), fmt, args);
+		va_end(args);
+	}
+
+	write_lock(&device->event_groups_lock);
+	list_add_tail(&group->group, &device->event_groups);
+	write_unlock(&device->event_groups_lock);
+}
+
+static void events_debugfs_print_group(struct seq_file *s,
+		struct kgsl_event_group *group)
+{
+	struct kgsl_event *event;
+	unsigned int retired;
+
+	spin_lock(&group->lock);
+
+	seq_printf(s, "%s: last=%d\n", group->name, group->processed);
+
+	list_for_each_entry(event, &group->events, node) {
+
+		group->readtimestamp(event->device, group->priv,
+			KGSL_TIMESTAMP_RETIRED, &retired);
+
+		seq_printf(s, "\t%u:%u age=%lu func=%ps [retired=%u]\n",
+			group->context ? group->context->id :
+						KGSL_MEMSTORE_GLOBAL,
+			event->timestamp, jiffies  - event->created,
+			event->func, retired);
+	}
+	spin_unlock(&group->lock);
+}
+
+static int events_show(struct seq_file *s, void *unused)
+{
+	struct kgsl_device *device = s->private;
+	struct kgsl_event_group *group;
+
+	seq_puts(s, "event groups:\n");
+	seq_puts(s, "--------------\n");
+
+	read_lock(&device->event_groups_lock);
+	list_for_each_entry(group, &device->event_groups, group) {
+		events_debugfs_print_group(s, group);
+		seq_puts(s, "\n");
+	}
+	read_unlock(&device->event_groups_lock);
+
+	return 0;
+}
+
+DEFINE_SHOW_ATTRIBUTE(events);
+
+void kgsl_device_events_remove(struct kgsl_device *device)
+{
+	struct kgsl_event_group *group, *tmp;
+
+	write_lock(&device->event_groups_lock);
+	list_for_each_entry_safe(group, tmp, &device->event_groups, group) {
+		WARN_ON(!list_empty(&group->events));
+		list_del(&group->group);
+	}
+	write_unlock(&device->event_groups_lock);
+}
+
+void kgsl_device_events_probe(struct kgsl_device *device)
+{
+	INIT_LIST_HEAD(&device->event_groups);
+	rwlock_init(&device->event_groups_lock);
+
+	debugfs_create_file("events", 0444, device->d_debugfs, device,
+		&events_fops);
+}
+
+/**
+ * kgsl_events_exit() - Destroy the event kmem cache on module exit
+ */
+void kgsl_events_exit(void)
+{
+	kmem_cache_destroy(events_cache);
+}
+
+/**
+ * kgsl_events_init() - Create the event kmem cache on module start
+ */
+void __init kgsl_events_init(void)
+{
+	events_cache = KMEM_CACHE(kgsl_event, 0);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_gmu_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_gmu_core.c
@@ -0,0 +1,368 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+#include <linux/of.h>
+#include <linux/io.h>
+#include <linux/iopoll.h>
+
+#include "adreno.h"
+#include "adreno_trace.h"
+#include "kgsl_device.h"
+#include "kgsl_gmu_core.h"
+#include "kgsl_trace.h"
+
+static const struct of_device_id gmu_match_table[] = {
+	{ .compatible = "qcom,gpu-gmu", .data = &a6xx_gmu_driver },
+	{ .compatible = "qcom,gpu-rgmu", .data = &a6xx_rgmu_driver },
+	{ .compatible = "qcom,gen7-gmu", .data = &gen7_gmu_driver },
+	{},
+};
+
+void __init gmu_core_register(void)
+{
+	const struct of_device_id *match;
+	struct device_node *node;
+
+	node = of_find_matching_node_and_match(NULL, gmu_match_table,
+		&match);
+	if (!node)
+		return;
+
+	platform_driver_register((struct platform_driver *) match->data);
+	of_node_put(node);
+}
+
+void gmu_core_unregister(void)
+{
+	const struct of_device_id *match;
+	struct device_node *node;
+
+	node = of_find_matching_node_and_match(NULL, gmu_match_table,
+		&match);
+	if (!node)
+		return;
+
+	platform_driver_unregister((struct platform_driver *) match->data);
+	of_node_put(node);
+}
+
+bool gmu_core_isenabled(struct kgsl_device *device)
+{
+	return test_bit(GMU_ENABLED, &device->gmu_core.flags);
+}
+
+bool gmu_core_gpmu_isenabled(struct kgsl_device *device)
+{
+	return (device->gmu_core.dev_ops != NULL);
+}
+
+bool gmu_core_scales_bandwidth(struct kgsl_device *device)
+{
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->scales_bandwidth)
+		return ops->scales_bandwidth(device);
+
+	return false;
+}
+
+int gmu_core_dev_acd_set(struct kgsl_device *device, bool val)
+{
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->acd_set)
+		return ops->acd_set(device, val);
+
+	return -EINVAL;
+}
+
+void gmu_core_regread(struct kgsl_device *device, unsigned int offsetwords,
+		unsigned int *value)
+{
+	u32 val = kgsl_regmap_read(&device->regmap, offsetwords);
+	*value  = val;
+}
+
+void gmu_core_regwrite(struct kgsl_device *device, unsigned int offsetwords,
+		unsigned int value)
+{
+	kgsl_regmap_write(&device->regmap, value, offsetwords);
+}
+
+void gmu_core_blkwrite(struct kgsl_device *device, unsigned int offsetwords,
+		const void *buffer, size_t size)
+{
+	kgsl_regmap_bulk_write(&device->regmap, offsetwords,
+		buffer, size >> 2);
+}
+
+void gmu_core_regrmw(struct kgsl_device *device,
+		unsigned int offsetwords,
+		unsigned int mask, unsigned int bits)
+{
+	kgsl_regmap_rmw(&device->regmap, offsetwords, mask, bits);
+}
+
+int gmu_core_dev_oob_set(struct kgsl_device *device, enum oob_request req)
+{
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->oob_set)
+		return ops->oob_set(device, req);
+
+	return 0;
+}
+
+void gmu_core_dev_oob_clear(struct kgsl_device *device, enum oob_request req)
+{
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->oob_clear)
+		ops->oob_clear(device, req);
+}
+
+void gmu_core_dev_cooperative_reset(struct kgsl_device *device)
+{
+
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->cooperative_reset)
+		ops->cooperative_reset(device);
+}
+
+int gmu_core_dev_ifpc_isenabled(struct kgsl_device *device)
+{
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->ifpc_isenabled)
+		return ops->ifpc_isenabled(device);
+
+	return 0;
+}
+
+int gmu_core_dev_ifpc_store(struct kgsl_device *device, unsigned int val)
+{
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->ifpc_store)
+		return ops->ifpc_store(device, val);
+
+	return -EINVAL;
+}
+
+int gmu_core_dev_wait_for_active_transition(struct kgsl_device *device)
+{
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->wait_for_active_transition)
+		return ops->wait_for_active_transition(device);
+
+	return 0;
+}
+
+void gmu_core_fault_snapshot(struct kgsl_device *device)
+{
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	/* Send NMI first to halt GMU and capture the state close to the point of failure */
+	if (ops && ops->send_nmi)
+		ops->send_nmi(device, false);
+
+	kgsl_device_snapshot(device, NULL, NULL, true);
+}
+
+int gmu_core_timed_poll_check(struct kgsl_device *device,
+		unsigned int offset, unsigned int expected_ret,
+		unsigned int timeout_ms, unsigned int mask)
+{
+	u32 val;
+
+	return kgsl_regmap_read_poll_timeout(&device->regmap, offset,
+		val, (val & mask) == expected_ret, 100, timeout_ms * 1000);
+}
+
+int gmu_core_map_memdesc(struct iommu_domain *domain, struct kgsl_memdesc *memdesc,
+		u64 gmuaddr, int attrs)
+{
+	size_t mapped;
+
+	if (!memdesc->pages) {
+		mapped = kgsl_mmu_map_sg(domain, gmuaddr, memdesc->sgt->sgl,
+			memdesc->sgt->nents, attrs);
+	} else {
+		struct sg_table sgt = { 0 };
+		int ret;
+
+		ret = sg_alloc_table_from_pages(&sgt, memdesc->pages,
+			memdesc->page_count, 0, memdesc->size, GFP_KERNEL);
+
+		if (ret)
+			return ret;
+
+		mapped = kgsl_mmu_map_sg(domain, gmuaddr, sgt.sgl, sgt.nents, attrs);
+		sg_free_table(&sgt);
+	}
+
+	return mapped == 0 ? -ENOMEM : 0;
+}
+
+void gmu_core_dev_force_first_boot(struct kgsl_device *device)
+{
+	const struct gmu_dev_ops *ops = GMU_DEVICE_OPS(device);
+
+	if (ops && ops->force_first_boot)
+		return ops->force_first_boot(device);
+}
+
+void gmu_core_set_vrb_register(void *ptr, u32 index, u32 val)
+{
+	u32 *vrb = ptr;
+
+	vrb[index] = val;
+
+	/* Make sure the vrb write is posted before moving ahead */
+	wmb();
+}
+
+static void stream_trace_data(struct gmu_trace_packet *pkt)
+{
+	switch (pkt->trace_id) {
+	case GMU_TRACE_PREEMPT_TRIGGER: {
+		struct trace_preempt_trigger *data =
+				(struct trace_preempt_trigger *)pkt->payload;
+
+		trace_adreno_preempt_trigger(data->cur_rb, data->next_rb,
+			data->ctx_switch_cntl, pkt->ticks);
+		break;
+		}
+	case GMU_TRACE_PREEMPT_DONE: {
+		struct trace_preempt_done *data =
+				(struct trace_preempt_done *)pkt->payload;
+
+		trace_adreno_preempt_done(data->prev_rb, data->next_rb,
+			data->ctx_switch_cntl, pkt->ticks);
+		break;
+		}
+	default: {
+		char str[64];
+
+		snprintf(str, sizeof(str),
+			 "Unsupported GMU trace id %d\n", pkt->trace_id);
+		trace_kgsl_msg(str);
+		}
+	}
+}
+
+void gmu_core_process_trace_data(struct kgsl_device *device,
+	struct device *dev, struct kgsl_gmu_trace *trace)
+{
+	struct gmu_trace_header *trace_hdr;
+	u32 size, *buffer;
+	struct gmu_trace_packet *pkt;
+	u16 seq_num, num_pkts = 0;
+	u32 ridx, widx;
+
+	if (IS_ERR_OR_NULL(trace->md))
+		return;
+
+	trace_hdr = trace->md->hostptr;
+	buffer = trace->md->hostptr;
+
+	ridx = readl(&trace_hdr->read_index);
+	widx = readl(&trace_hdr->write_index);
+
+	if (ridx == widx)
+		return;
+
+	/*
+	 * Don't process any traces and force set read_index to write_index if
+	 * previously encountered invalid trace packet
+	 */
+	if (trace->reset_hdr) {
+		/* update read index to let f2h daemon to go to sleep */
+		writel(trace_hdr->write_index, &trace_hdr->read_index);
+		return;
+	}
+
+	/* start reading trace buffer data */
+	pkt = (struct gmu_trace_packet *)&buffer[trace_hdr->payload_offset + ridx];
+
+	/* Validate packet header */
+	if (TRACE_PKT_GET_VALID_FIELD(pkt->hdr) != TRACE_PKT_VALID) {
+		char str[128];
+
+		snprintf(str, sizeof(str),
+			"Invalid trace packet found at read index: %d resetting trace header\n",
+			trace_hdr->read_index);
+		/*
+		 * GMU is not expected to write an invalid trace packet. This
+		 * condition can be true in case there is memory corruption. In
+		 * such scenario fastforward readindex to writeindex so the we
+		 * don't process any trace packets until we reset the trace
+		 * header in next slumber exit.
+		 */
+		dev_err_ratelimited(device->dev, "%s\n", str);
+		trace_kgsl_msg(str);
+		writel(trace_hdr->write_index, &trace_hdr->read_index);
+		trace->reset_hdr = true;
+		return;
+	}
+
+	size = TRACE_PKT_GET_SIZE(pkt->hdr);
+
+	if (TRACE_PKT_GET_SKIP_FIELD(pkt->hdr))
+		goto done;
+
+	seq_num = TRACE_PKT_GET_SEQNUM(pkt->hdr);
+	num_pkts = seq_num - trace->seq_num;
+
+	/* Detect trace packet loss by tracking any gaps in the sequence number */
+	if (num_pkts > 1) {
+		char str[128];
+
+		snprintf(str, sizeof(str),
+			"%d GMU trace packets dropped from sequence number: %d\n",
+			num_pkts - 1, trace->seq_num);
+		trace_kgsl_msg(str);
+	}
+
+	trace->seq_num = seq_num;
+	stream_trace_data(pkt);
+done:
+	ridx = (ridx + size) % trace_hdr->payload_size;
+	writel(ridx, &trace_hdr->read_index);
+}
+
+bool gmu_core_is_trace_empty(struct gmu_trace_header *hdr)
+{
+	return (readl(&hdr->read_index) == readl(&hdr->write_index)) ? true : false;
+}
+
+void gmu_core_trace_header_init(struct kgsl_gmu_trace *trace)
+{
+	struct gmu_trace_header *hdr = trace->md->hostptr;
+
+	hdr->threshold = TRACE_BUFFER_THRESHOLD;
+	hdr->timeout = TRACE_TIMEOUT_MSEC;
+	hdr->metadata = FIELD_PREP(GENMASK(31, 30), TRACE_MODE_DROP) |
+			FIELD_PREP(GENMASK(3, 0), TRACE_HEADER_VERSION_1);
+	hdr->cookie = trace->md->gmuaddr;
+	hdr->size = trace->md->size;
+	hdr->log_type = TRACE_LOGTYPE_HWSCHED;
+}
+
+void gmu_core_reset_trace_header(struct kgsl_gmu_trace *trace)
+{
+	if (!trace->reset_hdr || IS_ERR_OR_NULL(trace->md))
+		return;
+
+	memset(trace->md->hostptr, 0, sizeof(struct gmu_trace_header));
+	/* Reset sequence number to detect trace packet loss */
+	trace->seq_num = 0;
+	gmu_core_trace_header_init(trace);
+	trace->reset_hdr = false;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_gmu_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_gmu_core.h
@@ -0,0 +1,526 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_GMU_CORE_H
+#define __KGSL_GMU_CORE_H
+
+#include <linux/rbtree.h>
+#include <linux/mailbox_client.h>
+
+/* GMU_DEVICE - Given an KGSL device return the GMU specific struct */
+#define GMU_DEVICE_OPS(_a) ((_a)->gmu_core.dev_ops)
+
+#define MAX_GX_LEVELS		32
+#define MAX_GX_LEVELS_LEGACY	16
+#define MAX_CX_LEVELS		4
+#define MAX_BW_LEVELS		16
+#define MAX_CNOC_LEVELS		2
+#define MAX_CNOC_CMDS		6
+#define MAX_BW_CMDS		8
+#define INVALID_DCVS_IDX	0xFF
+#define INVALID_AB_VALUE	0xFFFF
+#define INVALID_BW_VOTE		(INVALID_DCVS_IDX | \
+					(FIELD_PREP(GENMASK(31, 16), INVALID_AB_VALUE)))
+#if MAX_CNOC_LEVELS > MAX_GX_LEVELS
+#error "CNOC levels cannot exceed GX levels"
+#endif
+
+/*
+ * These are the different ways the GMU can boot. GMU_WARM_BOOT is waking up
+ * from slumber. GMU_COLD_BOOT is booting for the first time. GMU_RESET
+ * is a soft reset of the GMU.
+ */
+enum gmu_core_boot {
+	GMU_WARM_BOOT = 0,
+	GMU_COLD_BOOT = 1,
+	GMU_RESET = 2
+};
+
+/* Bits for the flags field in the gmu structure */
+enum gmu_core_flags {
+	GMU_BOOT_INIT_DONE = 0,
+	GMU_HFI_ON,
+	GMU_FAULT,
+	GMU_DCVS_REPLAY,
+	GMU_ENABLED,
+	GMU_RSCC_SLEEP_SEQ_DONE,
+	GMU_DISABLE_SLUMBER,
+};
+
+/*
+ * OOB requests values. These range from 0 to 7 and then
+ * the BIT() offset into the actual value is calculated
+ * later based on the request. This keeps the math clean
+ * and easy to ensure not reaching over/under the range
+ * of 8 bits.
+ */
+enum oob_request {
+	oob_gpu = 0,
+	oob_perfcntr = 1,
+	oob_boot_slumber = 6, /* reserved special case */
+	oob_dcvs = 7, /* reserved special case */
+	oob_max,
+};
+
+enum gmu_pwrctrl_mode {
+	GMU_FW_START,
+	GMU_FW_STOP,
+	GMU_SUSPEND,
+	GMU_DCVS_NOHFI,
+	GMU_NOTIFY_SLUMBER,
+	INVALID_POWER_CTRL
+};
+
+#define GPU_HW_ACTIVE	0x00
+#define GPU_HW_IFPC	0x03
+#define GPU_HW_SLUMBER	0x0f
+
+/*
+ * Wait time before trying to write the register again.
+ * Hopefully the GMU has finished waking up during this delay.
+ * This delay must be less than the IFPC main hysteresis or
+ * the GMU will start shutting down before we try again.
+ */
+#define GMU_CORE_WAKEUP_DELAY_US 10
+
+/* Max amount of tries to wake up the GMU. The short retry
+ * limit is half of the long retry limit. After the short
+ * number of retries, we print an informational message to say
+ * exiting IFPC is taking longer than expected. We continue
+ * to retry after this until the long retry limit.
+ */
+#define GMU_CORE_SHORT_WAKEUP_RETRY_LIMIT 100
+#define GMU_CORE_LONG_WAKEUP_RETRY_LIMIT 200
+
+#define FENCE_STATUS_WRITEDROPPED0_MASK 0x1
+#define FENCE_STATUS_WRITEDROPPED1_MASK 0x2
+
+#define GMU_MAX_PWRLEVELS	2
+#define GMU_FREQ_MIN   200000000
+#define GMU_FREQ_MAX   500000000
+
+#define HFI_VERSION(major, minor, step) \
+	(FIELD_PREP(GENMASK(31, 28), major) | \
+	 FIELD_PREP(GENMASK(27, 16), minor) | \
+	 FIELD_PREP(GENMASK(15, 0), step))
+
+#define GMU_VER_MAJOR(ver) (((ver) >> 28) & 0xF)
+#define GMU_VER_MINOR(ver) (((ver) >> 16) & 0xFFF)
+#define GMU_VER_STEP(ver) ((ver) & 0xFFFF)
+#define GMU_VERSION(major, minor, step) \
+	((((major) & 0xF) << 28) | (((minor) & 0xFFF) << 16) | ((step) & 0xFFFF))
+
+#define GMU_INT_WDOG_BITE		BIT(0)
+#define GMU_INT_RSCC_COMP		BIT(1)
+#define GMU_INT_FENCE_ERR		BIT(3)
+#define GMU_INT_DBD_WAKEUP		BIT(4)
+#define GMU_INT_HOST_AHB_BUS_ERR	BIT(5)
+#define GMU_AO_INT_MASK		\
+		(GMU_INT_WDOG_BITE |	\
+		GMU_INT_FENCE_ERR |	\
+		GMU_INT_HOST_AHB_BUS_ERR)
+
+/* Bitmask for GPU low power mode enabling and hysterisis*/
+#define SPTP_ENABLE_MASK (BIT(2) | BIT(0))
+#define IFPC_ENABLE_MASK (BIT(1) | BIT(0))
+
+/* Bitmask for RPMH capability enabling */
+#define RPMH_INTERFACE_ENABLE	BIT(0)
+#define LLC_VOTE_ENABLE			BIT(4)
+#define DDR_VOTE_ENABLE			BIT(8)
+#define MX_VOTE_ENABLE			BIT(9)
+#define CX_VOTE_ENABLE			BIT(10)
+#define GFX_VOTE_ENABLE			BIT(11)
+#define RPMH_ENABLE_MASK	(RPMH_INTERFACE_ENABLE	| \
+				LLC_VOTE_ENABLE		| \
+				DDR_VOTE_ENABLE		| \
+				MX_VOTE_ENABLE		| \
+				CX_VOTE_ENABLE		| \
+				GFX_VOTE_ENABLE)
+
+/* Constants for GMU OOBs */
+#define OOB_BOOT_OPTION         0
+#define OOB_SLUMBER_OPTION      1
+
+/* Gmu FW block header format */
+struct gmu_block_header {
+	u32 addr;
+	u32 size;
+	u32 type;
+	u32 value;
+};
+
+/* GMU Block types */
+#define GMU_BLK_TYPE_DATA 0
+#define GMU_BLK_TYPE_PREALLOC_REQ 1
+#define GMU_BLK_TYPE_CORE_VER 2
+#define GMU_BLK_TYPE_CORE_DEV_VER 3
+#define GMU_BLK_TYPE_PWR_VER 4
+#define GMU_BLK_TYPE_PWR_DEV_VER 5
+#define GMU_BLK_TYPE_HFI_VER 6
+#define GMU_BLK_TYPE_PREALLOC_PERSIST_REQ 7
+
+/* For GMU Logs*/
+#define GMU_LOG_SIZE  SZ_64K
+
+/* For GMU virtual register bank */
+#define GMU_VRB_SIZE  SZ_4K
+
+/*
+ * GMU Virtual Register Definitions
+ * These values are dword offsets into the GMU Virtual Register Bank
+ */
+enum gmu_vrb_idx {
+	/* Number of dwords supported by VRB */
+	VRB_SIZE_IDX = 0,
+	/* Contains the address of warmboot scratch buffer */
+	VRB_WARMBOOT_SCRATCH_IDX = 1,
+	/* Contains the address of GMU trace buffer */
+	VRB_TRACE_BUFFER_ADDR_IDX = 2,
+};
+
+/* For GMU Trace */
+#define GMU_TRACE_SIZE  SZ_16K
+
+/* Trace header defines */
+/* Logtype to decode the trace pkt data */
+#define TRACE_LOGTYPE_HWSCHED	1
+/* Trace buffer threshold for GMU to send F2H message */
+#define TRACE_BUFFER_THRESHOLD	80
+/*
+ * GMU Trace timer value to check trace packet consumption. GMU timer handler tracks the
+ * readindex, If it's not moved since last timer fired, GMU will send the f2h message to
+ * drain trace packets. GMU Trace Timer will be restarted if the readindex is moving.
+ */
+#define TRACE_TIMEOUT_MSEC	5
+
+/* Trace metadata defines */
+/* Trace drop mode hint for GMU to drop trace packets when trace buffer is full */
+#define TRACE_MODE_DROP	1
+/* Trace buffer header version */
+#define TRACE_HEADER_VERSION_1	1
+
+/* Trace packet defines */
+#define TRACE_PKT_VALID	1
+#define TRACE_PKT_SEQ_MASK	GENMASK(15, 0)
+#define TRACE_PKT_SZ_MASK	GENMASK(27, 16)
+#define TRACE_PKT_SZ_SHIFT	16
+#define TRACE_PKT_VALID_MASK	GENMASK(31, 31)
+#define TRACE_PKT_SKIP_MASK	GENMASK(30, 30)
+#define TRACE_PKT_VALID_SHIFT	31
+#define TRACE_PKT_SKIP_SHIFT	30
+
+#define TRACE_PKT_GET_SEQNUM(hdr) ((hdr) & TRACE_PKT_SEQ_MASK)
+#define TRACE_PKT_GET_SIZE(hdr) (((hdr) & TRACE_PKT_SZ_MASK) >> TRACE_PKT_SZ_SHIFT)
+#define TRACE_PKT_GET_VALID_FIELD(hdr) (((hdr) & TRACE_PKT_VALID_MASK) >> TRACE_PKT_VALID_SHIFT)
+#define TRACE_PKT_GET_SKIP_FIELD(hdr) (((hdr) & TRACE_PKT_SKIP_MASK) >> TRACE_PKT_SKIP_SHIFT)
+
+/*
+ * Trace buffer header definition
+ * Trace buffer header fields initialized/updated by KGSL and GMU
+ * GMU input: Following header fields are initialized by KGSL
+ *           - @metadata, @threshold, @size, @cookie, @timeout, @log_type
+ *           - @readIndex updated by kgsl when traces messages are consumed.
+ * GMU output: Following header fields are initialized by GMU only
+ *           - @magic, @payload_offset, @payload_size
+ *           - @write_index updated by GMU upon filling the trace messages
+ */
+struct gmu_trace_header {
+	/** @magic: Initialized by GMU to check header is valid or not */
+	u32 magic;
+	/**
+	 * @metadata: Trace buffer metadata.Bit(31) Trace Mode to log tracepoints
+	 * messages, Bits [3:0] Version for header format changes.
+	 */
+	u32 metadata;
+	/**
+	 * @threshold: % at which GMU to send f2h message to wakeup KMD to consume
+	 * tracepoints data. Set it to zero to disable thresholding. Threshold is %
+	 * of buffer full condition not the trace packet count. If GMU is continuously
+	 * writing to trace buffer makes it buffer full condition when KMD is not
+	 * consuming it. So GMU check the how much trace buffer % space is full based
+	 * on the threshold % value.If the trace packets are filling over % buffer full
+	 * condition GMU will send the f2h message for KMD to drain the trace messages.
+	 */
+	u32 threshold;
+	/** @size: trace buffer allocation size in bytes */
+	u32 size;
+	/** @read_index: trace buffer read index in dwords */
+	u32 read_index;
+	/** @write_index: trace buffer write index in dwords */
+	u32 write_index;
+	/** @payload_offset: trace buffer payload dword offset */
+	u32 payload_offset;
+	/** @payload_size: trace buffer payload size in dword */
+	u32 payload_size;
+	/** cookie: cookie data sent through F2H_PROCESS_MESSAGE */
+	u64 cookie;
+	/**
+	 * timeout: GMU Trace Timer value in msec - zero to disable trace timer else
+	 * value for GMU trace timerhandler to send HFI msg.
+	 */
+	u32 timeout;
+	/** @log_type: To decode the trace buffer data */
+	u32 log_type;
+} __packed;
+
+/* Trace ID definition */
+enum gmu_trace_id {
+	GMU_TRACE_PREEMPT_TRIGGER = 1,
+	GMU_TRACE_PREEMPT_DONE = 2,
+	GMU_TRACE_MAX,
+};
+
+struct trace_preempt_trigger {
+	u32 cur_rb;
+	u32 next_rb;
+	u32 ctx_switch_cntl;
+} __packed;
+
+struct trace_preempt_done {
+	u32 prev_rb;
+	u32 next_rb;
+	u32 ctx_switch_cntl;
+} __packed;
+
+/**
+ * struct kgsl_gmu_trace  - wrapper for gmu trace memory object
+ */
+struct kgsl_gmu_trace {
+	 /** @md: gmu trace memory descriptor */
+	struct kgsl_memdesc *md;
+	/* @seq_num: GMU trace packet sequence number to detect drop packet count */
+	u16 seq_num;
+	/* @reset_hdr: To reset trace buffer header incase of invalid packet */
+	bool reset_hdr;
+};
+
+/* GMU memdesc entries */
+#define GMU_KERNEL_ENTRIES		16
+
+enum gmu_mem_type {
+	GMU_ITCM = 0,
+	GMU_ICACHE,
+	GMU_CACHE = GMU_ICACHE,
+	GMU_DTCM,
+	GMU_DCACHE,
+	GMU_NONCACHED_KERNEL, /* GMU VBIF3 uncached VA range: 0x60000000 - 0x7fffffff */
+	GMU_NONCACHED_KERNEL_EXTENDED, /* GMU VBIF3 uncached VA range: 0xc0000000 - 0xdfffffff */
+	GMU_NONCACHED_USER,
+	GMU_MEM_TYPE_MAX,
+};
+
+/**
+ * struct gmu_memdesc - Gmu shared memory object descriptor
+ * @hostptr: Kernel virtual address
+ * @gmuaddr: GPU virtual address
+ * @physaddr: Physical address of the memory object
+ * @size: Size of the memory object
+ */
+struct gmu_memdesc {
+	void *hostptr;
+	u32 gmuaddr;
+	phys_addr_t physaddr;
+	u32 size;
+};
+
+struct kgsl_mailbox {
+	struct mbox_client client;
+	struct mbox_chan *channel;
+};
+
+struct icc_path;
+
+struct gmu_vma_node {
+	struct rb_node node;
+	u32 va;
+	u32 size;
+};
+
+struct gmu_vma_entry {
+	/** @start: Starting virtual address of the vma */
+	u32 start;
+	/** @size: Size of this vma */
+	u32 size;
+	/** @next_va: Next available virtual address in this vma */
+	u32 next_va;
+	/** @lock: Spinlock for synchronization */
+	spinlock_t lock;
+	/** @vma_root: RB tree root that keeps track of dynamic allocations */
+	struct rb_root vma_root;
+};
+
+enum {
+	GMU_PRIV_FIRST_BOOT_DONE = 0,
+	GMU_PRIV_GPU_STARTED,
+	GMU_PRIV_HFI_STARTED,
+	GMU_PRIV_RSCC_SLEEP_DONE,
+	GMU_PRIV_PM_SUSPEND,
+	GMU_PRIV_PDC_RSC_LOADED,
+	/* Indicates if GMU INIT HFI messages are recorded successfully */
+	GMU_PRIV_WARMBOOT_GMU_INIT_DONE,
+	/* Indicates if GPU BOOT HFI messages are recorded successfully */
+	GMU_PRIV_WARMBOOT_GPU_BOOT_DONE,
+};
+
+struct device_node;
+struct kgsl_device;
+struct kgsl_snapshot;
+
+struct gmu_dev_ops {
+	int (*oob_set)(struct kgsl_device *device, enum oob_request req);
+	void (*oob_clear)(struct kgsl_device *device, enum oob_request req);
+	int (*ifpc_store)(struct kgsl_device *device, unsigned int val);
+	unsigned int (*ifpc_isenabled)(struct kgsl_device *device);
+	void (*cooperative_reset)(struct kgsl_device *device);
+	int (*wait_for_active_transition)(struct kgsl_device *device);
+	bool (*scales_bandwidth)(struct kgsl_device *device);
+	int (*acd_set)(struct kgsl_device *device, bool val);
+	int (*bcl_sid_set)(struct kgsl_device *device, u32 sid_id, u64 sid_val);
+	u64 (*bcl_sid_get)(struct kgsl_device *device, u32 sid_id);
+	void (*force_first_boot)(struct kgsl_device *device);
+	void (*send_nmi)(struct kgsl_device *device, bool force);
+};
+
+/**
+ * struct gmu_core_device - GMU Core device structure
+ * @ptr: Pointer to GMU device structure
+ * @dev_ops: Pointer to gmu device operations
+ * @flags: GMU flags
+ */
+struct gmu_core_device {
+	void *ptr;
+	const struct gmu_dev_ops *dev_ops;
+	unsigned long flags;
+};
+
+extern struct platform_driver a6xx_gmu_driver;
+extern struct platform_driver a6xx_rgmu_driver;
+extern struct platform_driver a6xx_hwsched_driver;
+extern struct platform_driver gen7_gmu_driver;
+extern struct platform_driver gen7_hwsched_driver;
+
+/* GMU core functions */
+
+void __init gmu_core_register(void);
+void gmu_core_unregister(void);
+
+bool gmu_core_gpmu_isenabled(struct kgsl_device *device);
+bool gmu_core_scales_bandwidth(struct kgsl_device *device);
+bool gmu_core_isenabled(struct kgsl_device *device);
+int gmu_core_dev_acd_set(struct kgsl_device *device, bool val);
+void gmu_core_regread(struct kgsl_device *device, unsigned int offsetwords,
+		unsigned int *value);
+void gmu_core_regwrite(struct kgsl_device *device, unsigned int offsetwords,
+		unsigned int value);
+
+/**
+ * gmu_core_blkwrite - Do a bulk I/O write to GMU
+ * @device: Pointer to the kgsl device
+ * @offsetwords: Destination dword offset
+ * @buffer: Pointer to the source buffer
+ * @size: Number of bytes to copy
+ *
+ * Write a series of GMU registers quickly without bothering to spend time
+ * logging the register writes. The logging of these writes causes extra
+ * delays that could allow IRQs arrive and be serviced before finishing
+ * all the writes.
+ */
+void gmu_core_blkwrite(struct kgsl_device *device, unsigned int offsetwords,
+		const void *buffer, size_t size);
+void gmu_core_regrmw(struct kgsl_device *device, unsigned int offsetwords,
+		unsigned int mask, unsigned int bits);
+int gmu_core_dev_oob_set(struct kgsl_device *device, enum oob_request req);
+void gmu_core_dev_oob_clear(struct kgsl_device *device, enum oob_request req);
+int gmu_core_dev_ifpc_isenabled(struct kgsl_device *device);
+int gmu_core_dev_ifpc_store(struct kgsl_device *device, unsigned int val);
+int gmu_core_dev_wait_for_active_transition(struct kgsl_device *device);
+void gmu_core_dev_cooperative_reset(struct kgsl_device *device);
+
+/**
+ * gmu_core_fault_snapshot - Set gmu fault and trigger snapshot
+ * @device: Pointer to the kgsl device
+ *
+ * Set the gmu fault and take snapshot when we hit a gmu fault
+ */
+void gmu_core_fault_snapshot(struct kgsl_device *device);
+
+/**
+ * gmu_core_timed_poll_check() - polling *gmu* register at given offset until
+ * its value changed to match expected value. The function times
+ * out and returns after given duration if register is not updated
+ * as expected.
+ *
+ * @device: Pointer to KGSL device
+ * @offset: Register offset in dwords
+ * @expected_ret: expected register value that stops polling
+ * @timeout_ms: time in milliseconds to poll the register
+ * @mask: bitmask to filter register value to match expected_ret
+ */
+int gmu_core_timed_poll_check(struct kgsl_device *device,
+		unsigned int offset, unsigned int expected_ret,
+		unsigned int timeout_ms, unsigned int mask);
+
+struct kgsl_memdesc;
+struct iommu_domain;
+
+struct gmu_mem_type_desc {
+	/** @memdesc: Pointer to the memory descriptor */
+	struct kgsl_memdesc *memdesc;
+	/** @type: Type of the memory descriptor */
+	u32 type;
+};
+
+/**
+ * gmu_core_map_memdesc - Map the memdesc into the GMU IOMMU domain
+ * @domain: Domain to map the memory into
+ * @memdesc: Memory descriptor to map
+ * @gmuaddr: Virtual GMU address to map the memory into
+ * @attrs: Attributes for the mapping
+ *
+ * Return: 0 on success or -ENOMEM on failure
+ */
+int gmu_core_map_memdesc(struct iommu_domain *domain, struct kgsl_memdesc *memdesc,
+		u64 gmuaddr, int attrs);
+void gmu_core_dev_force_first_boot(struct kgsl_device *device);
+
+/**
+ * gmu_core_set_vrb_register - set vrb register value at specified index
+ * @ptr: vrb host pointer
+ * @index: vrb index to write the value
+ * @val: value to be writen into vrb
+ */
+void gmu_core_set_vrb_register(void *ptr, u32 index, u32 val);
+
+/**
+ * gmu_core_process_trace_data - Process gmu trace buffer data writes to default linux trace buffer
+ * @device: Pointer to KGSL device
+ * @dev: GMU device instance
+ * @trace: GMU trace memory pointer
+ */
+void gmu_core_process_trace_data(struct kgsl_device *device,
+	struct device *dev, struct kgsl_gmu_trace *trace);
+
+/**
+ * gmu_core_is_trace_empty - Check for trace buffer empty/full status
+ * @hdr: Pointer to gmu trace header
+ *
+ * Return: true if readidex equl to writeindex else false
+ */
+bool gmu_core_is_trace_empty(struct gmu_trace_header *hdr);
+
+/**
+ * gmu_core_trace_header_init - Initialize the GMU trace buffer header
+ * @trace: Pointer to kgsl gmu trace
+ */
+void gmu_core_trace_header_init(struct kgsl_gmu_trace *trace);
+
+/**
+ * gmu_core_reset_trace_header - Reset GMU trace buffer header
+ * @trace: Pointer to kgsl gmu trace
+ */
+void gmu_core_reset_trace_header(struct kgsl_gmu_trace *trace);
+
+#endif /* __KGSL_GMU_CORE_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_ioctl.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_ioctl.c
@@ -0,0 +1,194 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2008-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "kgsl_device.h"
+#include "kgsl_sync.h"
+
+static const struct kgsl_ioctl kgsl_ioctl_funcs[] = {
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_DEVICE_GETPROPERTY,
+			kgsl_ioctl_device_getproperty),
+	/* IOCTL_KGSL_DEVICE_WAITTIMESTAMP is no longer supported */
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_DEVICE_WAITTIMESTAMP_CTXTID,
+			kgsl_ioctl_device_waittimestamp_ctxtid),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_RINGBUFFER_ISSUEIBCMDS,
+			kgsl_ioctl_rb_issueibcmds),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SUBMIT_COMMANDS,
+			kgsl_ioctl_submit_commands),
+	/* IOCTL_KGSL_CMDSTREAM_READTIMESTAMP is no longer supported */
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_CMDSTREAM_READTIMESTAMP_CTXTID,
+			kgsl_ioctl_cmdstream_readtimestamp_ctxtid),
+	/* IOCTL_KGSL_CMDSTREAM_FREEMEMONTIMESTAMP is no longer supported */
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_CMDSTREAM_FREEMEMONTIMESTAMP_CTXTID,
+			kgsl_ioctl_cmdstream_freememontimestamp_ctxtid),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_DRAWCTXT_CREATE,
+			kgsl_ioctl_drawctxt_create),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_DRAWCTXT_DESTROY,
+			kgsl_ioctl_drawctxt_destroy),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_MAP_USER_MEM,
+			kgsl_ioctl_map_user_mem),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SHAREDMEM_FROM_PMEM,
+			kgsl_ioctl_map_user_mem),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SHAREDMEM_FREE,
+			kgsl_ioctl_sharedmem_free),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SHAREDMEM_FLUSH_CACHE,
+			kgsl_ioctl_sharedmem_flush_cache),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_ALLOC,
+			kgsl_ioctl_gpumem_alloc),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMESTAMP_EVENT,
+			kgsl_ioctl_timestamp_event),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SETPROPERTY,
+			kgsl_ioctl_device_setproperty),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_ALLOC_ID,
+			kgsl_ioctl_gpumem_alloc_id),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_FREE_ID,
+			kgsl_ioctl_gpumem_free_id),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_GET_INFO,
+			kgsl_ioctl_gpumem_get_info),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_SYNC_CACHE,
+			kgsl_ioctl_gpumem_sync_cache),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_SYNC_CACHE_BULK,
+			kgsl_ioctl_gpumem_sync_cache_bulk),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SYNCSOURCE_CREATE,
+			kgsl_ioctl_syncsource_create),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SYNCSOURCE_DESTROY,
+			kgsl_ioctl_syncsource_destroy),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE,
+			kgsl_ioctl_syncsource_create_fence),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SYNCSOURCE_SIGNAL_FENCE,
+			kgsl_ioctl_syncsource_signal_fence),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_ALLOC,
+			kgsl_ioctl_gpuobj_alloc),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_FREE,
+			kgsl_ioctl_gpuobj_free),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_INFO,
+			kgsl_ioctl_gpuobj_info),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_IMPORT,
+			kgsl_ioctl_gpuobj_import),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_SYNC,
+			kgsl_ioctl_gpuobj_sync),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPU_COMMAND,
+			kgsl_ioctl_gpu_command),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUOBJ_SET_INFO,
+			kgsl_ioctl_gpuobj_set_info),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_PHYS_ALLOC,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_PHYS_FREE,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_VIRT_ALLOC,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_VIRT_FREE,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_SPARSE_BIND,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPU_SPARSE_COMMAND,
+			NULL),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPUMEM_BIND_RANGES,
+			kgsl_ioctl_gpumem_bind_ranges),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GPU_AUX_COMMAND,
+			kgsl_ioctl_gpu_aux_command),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_CREATE,
+			kgsl_ioctl_timeline_create),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_WAIT,
+			kgsl_ioctl_timeline_wait),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_FENCE_GET,
+			kgsl_ioctl_timeline_fence_get),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_QUERY,
+			kgsl_ioctl_timeline_query),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_SIGNAL,
+			kgsl_ioctl_timeline_signal),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_TIMELINE_DESTROY,
+			kgsl_ioctl_timeline_destroy),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_GET_FAULT_REPORT,
+			kgsl_ioctl_get_fault_report),
+	KGSL_IOCTL_FUNC(IOCTL_KGSL_RECURRING_COMMAND,
+			kgsl_ioctl_recurring_command),
+};
+
+long kgsl_ioctl_copy_in(unsigned int kernel_cmd, unsigned int user_cmd,
+		unsigned long arg, unsigned char *ptr)
+{
+	unsigned int usize = _IOC_SIZE(user_cmd);
+	unsigned int ksize = _IOC_SIZE(kernel_cmd);
+	unsigned int copy = ksize < usize ? ksize : usize;
+
+	if ((kernel_cmd & IOC_IN) && (user_cmd & IOC_IN)) {
+		if (copy > 0 && copy_from_user(ptr, (void __user *) arg, copy))
+			return -EFAULT;
+	}
+
+	return 0;
+}
+
+long kgsl_ioctl_copy_out(unsigned int kernel_cmd, unsigned int user_cmd,
+		unsigned long arg, unsigned char *ptr)
+{
+	unsigned int usize = _IOC_SIZE(user_cmd);
+	unsigned int ksize = _IOC_SIZE(kernel_cmd);
+	unsigned int copy = ksize < usize ? ksize : usize;
+
+	if ((kernel_cmd & IOC_OUT) && (user_cmd & IOC_OUT)) {
+		if (copy > 0 && copy_to_user((void __user *) arg, ptr, copy))
+			return -EFAULT;
+	}
+
+	return 0;
+}
+
+long kgsl_ioctl_helper(struct file *filep, unsigned int cmd, unsigned long arg,
+		const struct kgsl_ioctl *cmds, int len)
+{
+	struct kgsl_device_private *dev_priv = filep->private_data;
+	unsigned char data[128] = { 0 };
+	unsigned int nr = _IOC_NR(cmd);
+	long ret;
+
+	if (nr >= len || cmds[nr].func == NULL)
+		return -ENOIOCTLCMD;
+
+	if (_IOC_SIZE(cmds[nr].cmd) > sizeof(data)) {
+		dev_err_ratelimited(dev_priv->device->dev,
+			"data too big for ioctl 0x%08x: %d/%zu\n",
+			cmd, _IOC_SIZE(cmds[nr].cmd), sizeof(data));
+		return -EINVAL;
+	}
+
+	if (_IOC_SIZE(cmds[nr].cmd)) {
+		ret = kgsl_ioctl_copy_in(cmds[nr].cmd, cmd, arg, data);
+		if (ret)
+			return ret;
+	}
+
+	ret = cmds[nr].func(dev_priv, cmd, data);
+
+	if (ret == 0 && _IOC_SIZE(cmds[nr].cmd))
+		ret = kgsl_ioctl_copy_out(cmds[nr].cmd, cmd, arg, data);
+
+	return ret;
+}
+
+long kgsl_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+{
+	struct kgsl_device_private *dev_priv = filep->private_data;
+	struct kgsl_device *device = dev_priv->device;
+	long ret;
+
+	ret = kgsl_ioctl_helper(filep, cmd, arg, kgsl_ioctl_funcs,
+		ARRAY_SIZE(kgsl_ioctl_funcs));
+
+	/*
+	 * If the command was unrecognized in the generic core, try the device
+	 * specific function
+	 */
+
+	if (ret == -ENOIOCTLCMD) {
+		if (is_compat_task())
+			return device->ftbl->compat_ioctl(dev_priv, cmd, arg);
+
+		return device->ftbl->ioctl(dev_priv, cmd, arg);
+	}
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_iommu.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_iommu.c
@@ -0,0 +1,2779 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2011-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/bitfield.h>
+#include <linux/compat.h>
+#include <linux/io.h>
+#include <linux/iopoll.h>
+#include <linux/of_device.h>
+#include <linux/of_platform.h>
+#include <linux/scatterlist.h>
+#include <linux/qcom-iommu-util.h>
+#include <linux/qcom-io-pgtable.h>
+#include <linux/seq_file.h>
+#include <linux/delay.h>
+#include <linux/pm_runtime.h>
+#include <linux/version.h>
+#if (KERNEL_VERSION(6, 3, 0) <= LINUX_VERSION_CODE)
+#include <linux/firmware/qcom/qcom_scm.h>
+#else
+#include <linux/qcom_scm.h>
+#endif
+#ifdef CONFIG_QCOM_KGSL_UPSTREAM
+#include <linux/firmware/qcom/qcom_scm_addon.h>
+#endif
+#include <linux/random.h>
+#include <linux/regulator/consumer.h>
+#include <soc/qcom/secure_buffer.h>
+
+#include "adreno.h"
+#include "kgsl_device.h"
+#include "kgsl_iommu.h"
+#include "kgsl_mmu.h"
+#include "kgsl_pwrctrl.h"
+#include "kgsl_sharedmem.h"
+#include "kgsl_trace.h"
+
+#define KGSL_IOMMU_SPLIT_TABLE_BASE 0x0001ff8000000000ULL
+
+#define KGSL_IOMMU_IDR1_OFFSET 0x24
+#define IDR1_NUMPAGENDXB GENMASK(30, 28)
+#define IDR1_PAGESIZE BIT(31)
+
+static const struct kgsl_mmu_pt_ops secure_pt_ops;
+static const struct kgsl_mmu_pt_ops default_pt_ops;
+static const struct kgsl_mmu_pt_ops iopgtbl_pt_ops;
+
+/* Zero page for non-secure VBOs */
+static struct page *kgsl_vbo_zero_page;
+
+/*
+ * struct kgsl_iommu_addr_entry - entry in the kgsl_pagetable rbtree.
+ * @base: starting virtual address of the entry
+ * @size: size of the entry
+ * @node: the rbtree node
+ */
+struct kgsl_iommu_addr_entry {
+	uint64_t base;
+	uint64_t size;
+	struct rb_node node;
+};
+
+static struct kmem_cache *addr_entry_cache;
+
+/* These are dummy TLB ops for the io-pgtable instances */
+
+static void _tlb_flush_all(void *cookie)
+{
+}
+
+static void _tlb_flush_walk(unsigned long iova, size_t size,
+		size_t granule, void *cookie)
+{
+}
+
+static void _tlb_add_page(struct iommu_iotlb_gather *gather,
+		unsigned long iova, size_t granule, void *cookie)
+{
+}
+
+static const struct iommu_flush_ops kgsl_iopgtbl_tlb_ops = {
+	.tlb_flush_all = _tlb_flush_all,
+	.tlb_flush_walk = _tlb_flush_walk,
+	.tlb_add_page = _tlb_add_page,
+};
+
+static struct kgsl_iommu_pt *to_iommu_pt(struct kgsl_pagetable *pagetable)
+{
+	return container_of(pagetable, struct kgsl_iommu_pt, base);
+}
+
+static u32 get_llcc_flags(struct kgsl_mmu *mmu)
+{
+	if (!test_bit(KGSL_MMU_LLCC_ENABLE, &mmu->features))
+		return 0;
+
+	if (mmu->subtype == KGSL_IOMMU_SMMU_V500)
+		return 0;
+	else
+		return IOMMU_USE_UPSTREAM_HINT;
+}
+
+static int _iommu_get_protection_flags(struct kgsl_mmu *mmu,
+	struct kgsl_memdesc *memdesc)
+{
+	int flags = IOMMU_READ | IOMMU_WRITE | IOMMU_NOEXEC;
+
+	flags |= get_llcc_flags(mmu);
+
+	if (memdesc->flags & KGSL_MEMFLAGS_GPUREADONLY)
+		flags &= ~IOMMU_WRITE;
+
+	if (memdesc->priv & KGSL_MEMDESC_PRIVILEGED)
+		flags |= IOMMU_PRIV;
+
+	if (memdesc->flags & KGSL_MEMFLAGS_IOCOHERENT)
+		flags |= IOMMU_CACHE;
+
+	if (memdesc->priv & KGSL_MEMDESC_UCODE)
+		flags &= ~IOMMU_NOEXEC;
+
+	return flags;
+}
+
+/* Get a scattterlist for the subrange in the child memdesc */
+static int get_sg_from_child(struct sg_table *sgt, struct kgsl_memdesc *child,
+		u64 offset, u64 length)
+{
+	int npages = (length >> PAGE_SHIFT);
+	int pgoffset = (offset >> PAGE_SHIFT);
+	struct scatterlist *target_sg;
+	struct sg_page_iter iter;
+	int i = 0, ret;
+
+	if (child->pages)
+		return sg_alloc_table_from_pages(sgt,
+			child->pages + pgoffset, npages, 0,
+			length, GFP_KERNEL);
+
+	ret = sg_alloc_table(sgt, npages, GFP_KERNEL);
+	if (ret)
+		return ret;
+
+	target_sg = sgt->sgl;
+
+	for_each_sgtable_page(child->sgt, &iter, pgoffset) {
+		sg_set_page(target_sg, sg_page_iter_page(&iter), PAGE_SIZE, 0);
+		target_sg = sg_next(target_sg);
+
+		if (++i == npages)
+			break;
+	}
+
+	return 0;
+}
+
+static struct iommu_domain *to_iommu_domain(struct kgsl_iommu_context *context)
+{
+	return context->domain;
+}
+
+static struct kgsl_iommu *to_kgsl_iommu(struct kgsl_pagetable *pt)
+{
+	return &pt->mmu->iommu;
+}
+
+/*
+ * One page allocation for a guard region to protect against over-zealous
+ * GPU pre-fetch
+ */
+static struct page *kgsl_guard_page;
+static struct page *kgsl_secure_guard_page;
+
+static struct page *iommu_get_guard_page(struct kgsl_memdesc *memdesc)
+{
+	if (kgsl_memdesc_is_secured(memdesc)) {
+		if (!kgsl_secure_guard_page)
+			kgsl_secure_guard_page = kgsl_alloc_secure_page();
+
+		return kgsl_secure_guard_page;
+	}
+
+	if (!kgsl_guard_page)
+		kgsl_guard_page = alloc_page(GFP_KERNEL | __GFP_ZERO |
+			__GFP_NORETRY | __GFP_HIGHMEM);
+
+	return kgsl_guard_page;
+}
+
+static size_t iommu_pgsize(unsigned long pgsize_bitmap, unsigned long iova,
+		phys_addr_t paddr, size_t size, size_t *count)
+{
+	unsigned int pgsize_idx, pgsize_idx_next;
+	unsigned long pgsizes;
+	size_t offset, pgsize, pgsize_next;
+	unsigned long addr_merge = paddr | iova;
+
+	/* Page sizes supported by the hardware and small enough for @size */
+	pgsizes = pgsize_bitmap & GENMASK(__fls(size), 0);
+
+	/* Constrain the page sizes further based on the maximum alignment */
+	if (likely(addr_merge))
+		pgsizes &= GENMASK(__ffs(addr_merge), 0);
+
+	/* Make sure we have at least one suitable page size */
+	if (!pgsizes)
+		return 0;
+
+	/* Pick the biggest page size remaining */
+	pgsize_idx = __fls(pgsizes);
+	pgsize = BIT(pgsize_idx);
+	if (!count)
+		return pgsize;
+
+	/* Find the next biggest support page size, if it exists */
+	pgsizes = pgsize_bitmap & ~GENMASK(pgsize_idx, 0);
+	if (!pgsizes)
+		goto out_set_count;
+
+	pgsize_idx_next = __ffs(pgsizes);
+	pgsize_next = BIT(pgsize_idx_next);
+
+	/*
+	 * There's no point trying a bigger page size unless the virtual
+	 * and physical addresses are similarly offset within the larger page.
+	 */
+	if ((iova ^ paddr) & (pgsize_next - 1))
+		goto out_set_count;
+
+	/* Calculate the offset to the next page size alignment boundary */
+	offset = pgsize_next - (addr_merge & (pgsize_next - 1));
+
+	/*
+	 * If size is big enough to accommodate the larger page, reduce
+	 * the number of smaller pages.
+	 */
+	if (offset + pgsize_next <= size)
+		size = offset;
+
+out_set_count:
+	*count = size >> pgsize_idx;
+	return pgsize;
+}
+
+static void kgsl_iommu_flush_tlb(struct kgsl_mmu *mmu)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	iommu_flush_iotlb_all(to_iommu_domain(&iommu->user_context));
+
+	/* As LPAC is optional, check LPAC domain is present before flush */
+	if (iommu->lpac_context.domain)
+		iommu_flush_iotlb_all(to_iommu_domain(&iommu->lpac_context));
+}
+
+static int _iopgtbl_unmap(struct kgsl_iommu_pt *pt, u64 gpuaddr, size_t size)
+{
+	struct io_pgtable_ops *ops = pt->pgtbl_ops;
+	size_t unmapped = 0;
+
+	while (unmapped < size) {
+		size_t ret, size_to_unmap, remaining, pgcount;
+
+		remaining = (size - unmapped);
+		size_to_unmap = iommu_pgsize(pt->cfg.pgsize_bitmap,
+				gpuaddr, gpuaddr, remaining, &pgcount);
+		if (size_to_unmap == 0)
+			break;
+
+		ret = ops->unmap_pages(ops, gpuaddr, size_to_unmap,
+				pgcount, NULL);
+
+		if (ret == 0)
+			break;
+
+		gpuaddr += ret;
+		unmapped += ret;
+	}
+
+	if (unmapped != size)
+		return -EINVAL;
+
+	/*
+	 * Skip below logic for 6.1 kernel version and above as
+	 * qcom_skip_tlb_management() API takes care of avoiding
+	 * TLB operations during slumber.
+	 */
+	if (KERNEL_VERSION(6, 1, 0) > LINUX_VERSION_CODE) {
+		struct kgsl_device *device = KGSL_MMU_DEVICE(pt->base.mmu);
+
+		/* Skip TLB Operations if GPU is in slumber */
+		if (mutex_trylock(&device->mutex)) {
+			if (device->state == KGSL_STATE_SLUMBER) {
+				mutex_unlock(&device->mutex);
+				return 0;
+			}
+			mutex_unlock(&device->mutex);
+		}
+	}
+
+	kgsl_iommu_flush_tlb(pt->base.mmu);
+	return 0;
+}
+
+static size_t _iopgtbl_map_pages(struct kgsl_iommu_pt *pt, u64 gpuaddr,
+		struct page **pages, int npages, int prot)
+{
+	struct io_pgtable_ops *ops = pt->pgtbl_ops;
+	size_t mapped = 0;
+	u64 addr = gpuaddr;
+	int ret, i;
+
+	for (i = 0; i < npages; i++) {
+		ret = ops->map_pages(ops, addr, page_to_phys(pages[i]), PAGE_SIZE, 1,
+			prot, GFP_KERNEL, &mapped);
+		if (ret) {
+			_iopgtbl_unmap(pt, gpuaddr, mapped);
+			return 0;
+		}
+		addr += PAGE_SIZE;
+	}
+
+	return mapped;
+}
+
+static size_t _iopgtbl_map_sg(struct kgsl_iommu_pt *pt, u64 gpuaddr,
+		struct sg_table *sgt, int prot)
+{
+	struct io_pgtable_ops *ops = pt->pgtbl_ops;
+	struct scatterlist *sg;
+	size_t mapped = 0;
+	u64 addr = gpuaddr;
+	int ret, i;
+
+	for_each_sg(sgt->sgl, sg, sgt->nents, i) {
+		size_t size = sg->length;
+		phys_addr_t phys = sg_phys(sg);
+
+		while (size) {
+			size_t count, map_size = 0;
+			size_t pgsize = iommu_pgsize(pt->cfg.pgsize_bitmap,
+					addr, phys, size, &count);
+
+			ret = ops->map_pages(ops, addr, phys, pgsize, count,
+					     prot, GFP_KERNEL, &map_size);
+
+			mapped += map_size;
+
+			if (ret) {
+				_iopgtbl_unmap(pt, gpuaddr, mapped);
+				return 0;
+			}
+
+			addr += map_size;
+			phys += map_size;
+			size -= map_size;
+		}
+
+	}
+
+	return mapped;
+}
+
+static void kgsl_iommu_send_tlb_hint(struct kgsl_mmu *mmu, bool hint)
+{
+#if (KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE)
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	/*
+	 * Send hint to SMMU driver for skipping TLB operations during slumber.
+	 * This will help to avoid unnecessary cx gdsc toggling.
+	 */
+	qcom_skip_tlb_management(&iommu->user_context.pdev->dev, hint);
+	if (iommu->lpac_context.domain)
+		qcom_skip_tlb_management(&iommu->lpac_context.pdev->dev, hint);
+#endif
+
+	/*
+	 * TLB operations are skipped during slumber. Incase CX doesn't
+	 * go down, it can result in incorrect translations due to stale
+	 * TLB entries. Flush TLB before boot up to ensure fresh start.
+	 */
+	if (!hint)
+		kgsl_iommu_flush_tlb(mmu);
+}
+
+static int
+kgsl_iopgtbl_map_child(struct kgsl_pagetable *pt, struct kgsl_memdesc *memdesc,
+	u64 offset, struct kgsl_memdesc *child, u64 child_offset, u64 length)
+{
+	struct kgsl_iommu_pt *iommu_pt = to_iommu_pt(pt);
+	struct sg_table sgt;
+	u32 flags;
+	size_t mapped;
+	int ret;
+
+	ret = get_sg_from_child(&sgt, child, child_offset, length);
+	if (ret)
+		return ret;
+
+	/* Inherit the flags from the child for this mapping */
+	flags = _iommu_get_protection_flags(pt->mmu, child);
+
+	mapped = _iopgtbl_map_sg(iommu_pt, memdesc->gpuaddr + offset, &sgt, flags);
+
+	sg_free_table(&sgt);
+
+	return mapped ? 0 : -ENOMEM;
+}
+
+
+static int
+kgsl_iopgtbl_unmap_range(struct kgsl_pagetable *pt, struct kgsl_memdesc *memdesc,
+		u64 offset, u64 length)
+{
+	if (WARN_ON(offset >= memdesc->size ||
+		(offset + length) > memdesc->size))
+		return -ERANGE;
+
+	return _iopgtbl_unmap(to_iommu_pt(pt), memdesc->gpuaddr + offset,
+			length);
+}
+
+static size_t _iopgtbl_map_page_to_range(struct kgsl_iommu_pt *pt,
+		struct page *page, u64 gpuaddr, size_t range, int prot)
+{
+	struct io_pgtable_ops *ops = pt->pgtbl_ops;
+	size_t mapped = 0;
+	u64 addr = gpuaddr;
+	int ret;
+
+	while (range) {
+		ret = ops->map_pages(ops, addr, page_to_phys(page), PAGE_SIZE,
+				     1, prot, GFP_KERNEL, &mapped);
+		if (ret) {
+			_iopgtbl_unmap(pt, gpuaddr, mapped);
+			return 0;
+		}
+
+		addr += PAGE_SIZE;
+		range -= PAGE_SIZE;
+	}
+
+	return mapped;
+}
+
+static int kgsl_iopgtbl_map_zero_page_to_range(struct kgsl_pagetable *pt,
+		struct kgsl_memdesc *memdesc, u64 offset, u64 length)
+{
+	/*
+	 * The SMMU only does the PRT compare at the bottom level of the page table, because
+	 * there is not an easy way for the hardware to perform this check at earlier levels.
+	 * Mark this page writable to avoid page faults while writing to it. Since the address
+	 * of this zero page is programmed in PRR register, MMU will intercept any accesses to
+	 * the page before they go to DDR and will terminate the transaction.
+	 */
+	u32 flags = IOMMU_READ | IOMMU_WRITE | IOMMU_NOEXEC | get_llcc_flags(pt->mmu);
+	struct kgsl_iommu_pt *iommu_pt = to_iommu_pt(pt);
+	struct page *page = kgsl_vbo_zero_page;
+
+	if (WARN_ON(!page))
+		return -ENODEV;
+
+	if (WARN_ON((offset >= memdesc->size) ||
+		(offset + length) > memdesc->size))
+		return -ERANGE;
+
+	if (!_iopgtbl_map_page_to_range(iommu_pt, page, memdesc->gpuaddr + offset,
+		length, flags))
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int kgsl_iopgtbl_map(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	struct kgsl_iommu_pt *pt = to_iommu_pt(pagetable);
+	size_t mapped, padding;
+	int prot;
+
+	/* Get the protection flags for the user context */
+	prot = _iommu_get_protection_flags(pagetable->mmu, memdesc);
+
+	if (memdesc->sgt)
+		mapped = _iopgtbl_map_sg(pt, memdesc->gpuaddr,
+			memdesc->sgt, prot);
+	else
+		mapped = _iopgtbl_map_pages(pt, memdesc->gpuaddr,
+			memdesc->pages, memdesc->page_count, prot);
+
+	if (mapped == 0)
+		return -ENOMEM;
+
+	padding = kgsl_memdesc_footprint(memdesc) - mapped;
+
+	if (padding) {
+		struct page *page = iommu_get_guard_page(memdesc);
+		size_t ret;
+
+		if (page)
+			ret = _iopgtbl_map_page_to_range(pt, page,
+				memdesc->gpuaddr + mapped, padding,
+				prot & ~IOMMU_WRITE);
+
+		if (!page || !ret) {
+			_iopgtbl_unmap(pt, memdesc->gpuaddr, mapped);
+			return -ENOMEM;
+		}
+	}
+
+	return 0;
+}
+
+static int kgsl_iopgtbl_unmap(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	return _iopgtbl_unmap(to_iommu_pt(pagetable), memdesc->gpuaddr,
+		kgsl_memdesc_footprint(memdesc));
+}
+
+static int _iommu_unmap(struct iommu_domain *domain, u64 addr, size_t size)
+{
+	size_t unmapped = 0;
+
+	if (!domain)
+		return 0;
+
+	/* Sign extend TTBR1 addresses all the way to avoid warning */
+	if (addr & (1ULL << 48))
+		addr |= 0xffff000000000000;
+
+	unmapped = iommu_unmap(domain, addr, size);
+
+	return (unmapped == size) ? 0 : -ENOMEM;
+}
+
+
+static size_t _iommu_map_page_to_range(struct iommu_domain *domain,
+		struct page *page, u64 gpuaddr, size_t range, int prot)
+{
+	size_t mapped = 0;
+	u64 addr = gpuaddr;
+
+	if (!page)
+		return 0;
+
+	/* Sign extend TTBR1 addresses all the way to avoid warning */
+	if (gpuaddr & (1ULL << 48))
+		gpuaddr |= 0xffff000000000000;
+
+
+	while (range) {
+#if (KERNEL_VERSION(6, 2, 0) <= LINUX_VERSION_CODE)
+		int ret = iommu_map(domain, addr, page_to_phys(page),
+				    PAGE_SIZE, prot, GFP_KERNEL);
+#else
+		int ret = iommu_map(domain, addr, page_to_phys(page),
+				    PAGE_SIZE, prot);
+#endif
+		if (ret) {
+			iommu_unmap(domain, gpuaddr, mapped);
+			return 0;
+		}
+
+		addr += PAGE_SIZE;
+		mapped += PAGE_SIZE;
+		range -= PAGE_SIZE;
+	}
+
+	return mapped;
+}
+
+static size_t _iommu_map_sg(struct iommu_domain *domain, u64 gpuaddr,
+		struct sg_table *sgt, int prot)
+{
+	/* Sign extend TTBR1 addresses all the way to avoid warning */
+	if (gpuaddr & (1ULL << 48))
+		gpuaddr |= 0xffff000000000000;
+
+	return kgsl_mmu_map_sg(domain, gpuaddr, sgt->sgl, sgt->orig_nents, prot);
+}
+
+static int
+_kgsl_iommu_map(struct kgsl_mmu *mmu, struct iommu_domain *domain,
+		struct kgsl_memdesc *memdesc)
+{
+	int prot = _iommu_get_protection_flags(mmu, memdesc);
+	size_t mapped, padding;
+	int ret = 0;
+
+	/*
+	 * For paged memory allocated through kgsl, memdesc->pages is not NULL.
+	 * Allocate sgt here just for its map operation. Contiguous memory
+	 * already has its sgt, so no need to allocate it here.
+	 */
+	if (!memdesc->pages) {
+		mapped = _iommu_map_sg(domain, memdesc->gpuaddr,
+				memdesc->sgt, prot);
+	} else {
+		struct sg_table sgt;
+
+		ret = sg_alloc_table_from_pages(&sgt, memdesc->pages,
+			memdesc->page_count, 0, memdesc->size, GFP_KERNEL);
+		if (ret)
+			return ret;
+
+		mapped = _iommu_map_sg(domain, memdesc->gpuaddr, &sgt, prot);
+		sg_free_table(&sgt);
+	}
+
+	if (!mapped)
+		return -ENOMEM;
+
+	padding = kgsl_memdesc_footprint(memdesc) - mapped;
+
+	if (padding) {
+		struct page *page = iommu_get_guard_page(memdesc);
+		size_t guard_mapped;
+
+		if (page)
+			guard_mapped = _iommu_map_page_to_range(domain, page,
+				memdesc->gpuaddr + mapped, padding, prot & ~IOMMU_WRITE);
+
+		if (!page || !guard_mapped) {
+			_iommu_unmap(domain, memdesc->gpuaddr, mapped);
+			ret = -ENOMEM;
+		}
+	}
+
+	return ret;
+}
+
+static int kgsl_iommu_secure_map(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	struct kgsl_iommu *iommu = &pagetable->mmu->iommu;
+	struct iommu_domain *domain = to_iommu_domain(&iommu->secure_context);
+
+	return _kgsl_iommu_map(pagetable->mmu, domain, memdesc);
+}
+
+/*
+ * Return true if the address is in the TTBR0 region. This is used for cases
+ * when the "default" pagetable is used for both TTBR0 and TTBR1
+ */
+static bool is_lower_address(struct kgsl_mmu *mmu, u64 addr)
+{
+	return (test_bit(KGSL_MMU_IOPGTABLE, &mmu->features) &&
+		addr < KGSL_IOMMU_SPLIT_TABLE_BASE);
+}
+
+static int _kgsl_iommu_unmap(struct iommu_domain *domain,
+		struct kgsl_memdesc *memdesc)
+{
+	if (memdesc->size == 0 || memdesc->gpuaddr == 0)
+		return -EINVAL;
+
+	return _iommu_unmap(domain, memdesc->gpuaddr,
+		kgsl_memdesc_footprint(memdesc));
+}
+
+/* Map on the default pagetable and the LPAC pagetable if it exists */
+static int kgsl_iommu_default_map(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	struct kgsl_mmu *mmu = pagetable->mmu;
+	struct kgsl_iommu *iommu = &mmu->iommu;
+	struct iommu_domain *domain, *lpac;
+	int ret;
+
+	if (is_lower_address(mmu, memdesc->gpuaddr))
+		return kgsl_iopgtbl_map(pagetable, memdesc);
+
+	domain = to_iommu_domain(&iommu->user_context);
+
+	/* Map the object to the default GPU domain */
+	ret = _kgsl_iommu_map(mmu, domain, memdesc);
+
+	/* Also map the object to the LPAC domain if it exists */
+	lpac = to_iommu_domain(&iommu->lpac_context);
+
+	if (!ret && lpac) {
+		ret = _kgsl_iommu_map(mmu, lpac, memdesc);
+
+		/* On failure, also unmap from the default domain */
+		if (ret)
+			_kgsl_iommu_unmap(domain, memdesc);
+
+	}
+
+	return ret;
+}
+
+static int kgsl_iommu_secure_unmap(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	struct kgsl_iommu *iommu = &pagetable->mmu->iommu;
+
+	if (memdesc->size == 0 || memdesc->gpuaddr == 0)
+		return -EINVAL;
+
+	return _kgsl_iommu_unmap(to_iommu_domain(&iommu->secure_context),
+		memdesc);
+}
+
+static int kgsl_iommu_default_unmap(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	struct kgsl_mmu *mmu = pagetable->mmu;
+	struct kgsl_iommu *iommu = &mmu->iommu;
+	int ret;
+
+	if (memdesc->size == 0 || memdesc->gpuaddr == 0)
+		return -EINVAL;
+
+	if (is_lower_address(mmu, memdesc->gpuaddr))
+		return kgsl_iopgtbl_unmap(pagetable, memdesc);
+
+	/* Unmap from the default domain */
+	ret = _kgsl_iommu_unmap(to_iommu_domain(&iommu->user_context), memdesc);
+
+	/* Unmap from the LPAC domain if it exists */
+	ret |= _kgsl_iommu_unmap(to_iommu_domain(&iommu->lpac_context), memdesc);
+	return ret;
+}
+
+static bool kgsl_iommu_addr_is_global(struct kgsl_mmu *mmu, u64 addr)
+{
+	if (test_bit(KGSL_MMU_IOPGTABLE, &mmu->features))
+		return (addr >= KGSL_IOMMU_SPLIT_TABLE_BASE);
+
+	return ((addr >= KGSL_IOMMU_GLOBAL_MEM_BASE(mmu)) &&
+		(addr < KGSL_IOMMU_GLOBAL_MEM_BASE(mmu) +
+		 KGSL_IOMMU_GLOBAL_MEM_SIZE));
+}
+
+static void __iomem *kgsl_iommu_reg(struct kgsl_iommu_context *ctx,
+		u32 offset)
+{
+	struct kgsl_iommu *iommu = KGSL_IOMMU(ctx->kgsldev);
+
+	if (!iommu->cb0_offset) {
+		u32 reg =
+			readl_relaxed(iommu->regbase + KGSL_IOMMU_IDR1_OFFSET);
+
+		iommu->pagesize =
+			FIELD_GET(IDR1_PAGESIZE, reg) ? SZ_64K : SZ_4K;
+
+		/*
+		 * The number of pages in the global address space or
+		 * translation bank address space is 2^(NUMPAGENDXB + 1).
+		 */
+		iommu->cb0_offset = iommu->pagesize *
+			(1 << (FIELD_GET(IDR1_NUMPAGENDXB, reg) + 1));
+	}
+
+	return (void __iomem *) (iommu->regbase + iommu->cb0_offset +
+		(ctx->cb_num * iommu->pagesize) + offset);
+}
+
+static u64 KGSL_IOMMU_GET_CTX_REG_Q(struct kgsl_iommu_context *ctx, u32 offset)
+{
+	void __iomem *addr = kgsl_iommu_reg(ctx, offset);
+
+	return readq_relaxed(addr);
+}
+
+static void KGSL_IOMMU_SET_CTX_REG(struct kgsl_iommu_context *ctx, u32 offset,
+		u32 val)
+{
+	void __iomem *addr = kgsl_iommu_reg(ctx, offset);
+
+	writel_relaxed(val, addr);
+}
+
+static u32 KGSL_IOMMU_GET_CTX_REG(struct kgsl_iommu_context *ctx, u32 offset)
+{
+	void __iomem *addr = kgsl_iommu_reg(ctx, offset);
+
+	return readl_relaxed(addr);
+}
+
+static int kgsl_iommu_get_gpuaddr(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc);
+
+static void kgsl_iommu_map_secure_global(struct kgsl_mmu *mmu,
+		struct kgsl_memdesc *memdesc)
+{
+	if (IS_ERR_OR_NULL(mmu->securepagetable))
+		return;
+
+	if (!memdesc->gpuaddr) {
+		int ret = kgsl_iommu_get_gpuaddr(mmu->securepagetable,
+			memdesc);
+
+		if (WARN_ON(ret))
+			return;
+	}
+
+	kgsl_iommu_secure_map(mmu->securepagetable, memdesc);
+}
+
+#define KGSL_GLOBAL_MEM_PAGES (KGSL_IOMMU_GLOBAL_MEM_SIZE >> PAGE_SHIFT)
+
+static u64 global_get_offset(struct kgsl_device *device, u64 size,
+		unsigned long priv)
+{
+	int start = 0, bit;
+
+	if (!device->global_map) {
+		device->global_map =
+			kcalloc(BITS_TO_LONGS(KGSL_GLOBAL_MEM_PAGES),
+			sizeof(unsigned long), GFP_KERNEL);
+		if (!device->global_map)
+			return (unsigned long) -ENOMEM;
+	}
+
+	if (priv & KGSL_MEMDESC_RANDOM) {
+		u32 offset = KGSL_GLOBAL_MEM_PAGES - (size >> PAGE_SHIFT);
+
+		start = get_random_u32() % offset;
+	}
+
+	while (start >= 0) {
+		bit = bitmap_find_next_zero_area(device->global_map,
+			KGSL_GLOBAL_MEM_PAGES, start, size >> PAGE_SHIFT, 0);
+
+		if (bit < KGSL_GLOBAL_MEM_PAGES)
+			break;
+
+		/*
+		 * Later implementations might want to randomize this to reduce
+		 * predictability
+		 */
+		start--;
+	}
+
+	if (WARN_ON(start < 0))
+		return (unsigned long) -ENOMEM;
+
+	bitmap_set(device->global_map, bit, size >> PAGE_SHIFT);
+
+	return bit << PAGE_SHIFT;
+}
+
+static void kgsl_iommu_map_global(struct kgsl_mmu *mmu,
+		struct kgsl_memdesc *memdesc, u32 padding)
+{
+	struct kgsl_device *device = KGSL_MMU_DEVICE(mmu);
+
+	if (memdesc->flags & KGSL_MEMFLAGS_SECURE) {
+		kgsl_iommu_map_secure_global(mmu, memdesc);
+		return;
+	}
+
+	if (!memdesc->gpuaddr) {
+		u64 offset;
+
+		offset = global_get_offset(device, memdesc->size + padding,
+			memdesc->priv);
+
+		if (IS_ERR_VALUE(offset))
+			return;
+
+		memdesc->gpuaddr = mmu->defaultpagetable->global_base + offset;
+	}
+
+	kgsl_iommu_default_map(mmu->defaultpagetable, memdesc);
+}
+
+/* Print the mem entry for the pagefault debugging */
+static void print_entry(struct device *dev, struct kgsl_mem_entry *entry,
+		pid_t pid)
+{
+	char name[32];
+
+	if (!entry) {
+		dev_crit(dev, "**EMPTY**\n");
+		return;
+	}
+
+	kgsl_get_memory_usage(name, sizeof(name), entry->memdesc.flags);
+
+	dev_err(dev, "[%016llX - %016llX] %s %s (pid = %d) (%s)\n",
+	      entry->memdesc.gpuaddr,
+	      entry->memdesc.gpuaddr + entry->memdesc.size - 1,
+	      entry->memdesc.priv & KGSL_MEMDESC_GUARD_PAGE ? "(+guard)" : "",
+	      entry->pending_free ? "(pending free)" : "",
+	      pid, name);
+}
+
+/* Check if the address in the list of recently freed memory */
+static void kgsl_iommu_check_if_freed(struct device *dev,
+		struct kgsl_iommu_context *context, u64 addr, u32 ptname)
+{
+	uint64_t gpuaddr = addr;
+	uint64_t size = 0;
+	uint64_t flags = 0;
+	char name[32];
+	pid_t pid;
+
+	if (!kgsl_memfree_find_entry(ptname, &gpuaddr, &size, &flags, &pid))
+		return;
+
+	kgsl_get_memory_usage(name, sizeof(name), flags);
+
+	dev_err(dev, "---- premature free ----\n");
+	dev_err(dev, "[%8.8llX-%8.8llX] (%s) was already freed by pid %d\n",
+		gpuaddr, gpuaddr + size, name, pid);
+}
+
+static struct kgsl_process_private *kgsl_iommu_get_process(u64 ptbase)
+{
+	struct kgsl_process_private *p;
+	struct kgsl_iommu_pt *iommu_pt;
+
+	read_lock(&kgsl_driver.proclist_lock);
+
+	list_for_each_entry(p, &kgsl_driver.process_list, list) {
+		iommu_pt = to_iommu_pt(p->pagetable);
+		if (iommu_pt->ttbr0 == MMU_SW_PT_BASE(ptbase)) {
+			if (!kgsl_process_private_get(p))
+				p = NULL;
+
+			read_unlock(&kgsl_driver.proclist_lock);
+			return p;
+		}
+	}
+
+	read_unlock(&kgsl_driver.proclist_lock);
+
+	return NULL;
+}
+
+static void kgsl_iommu_add_fault_info(struct kgsl_context *context,
+		unsigned long addr, int flags)
+{
+	struct kgsl_pagefault_report *report;
+	u32 fault_flag = 0;
+
+	if (!context || !(context->flags & KGSL_CONTEXT_FAULT_INFO))
+		return;
+
+	report = kzalloc(sizeof(struct kgsl_pagefault_report), GFP_KERNEL);
+	if (!report)
+		return;
+
+	if (flags & IOMMU_FAULT_TRANSLATION)
+		fault_flag = KGSL_PAGEFAULT_TYPE_TRANSLATION;
+	else if (flags & IOMMU_FAULT_PERMISSION)
+		fault_flag = KGSL_PAGEFAULT_TYPE_PERMISSION;
+	else if (flags & IOMMU_FAULT_EXTERNAL)
+		fault_flag = KGSL_PAGEFAULT_TYPE_EXTERNAL;
+	else if (flags & IOMMU_FAULT_TRANSACTION_STALLED)
+		fault_flag = KGSL_PAGEFAULT_TYPE_TRANSACTION_STALLED;
+
+	fault_flag |= (flags & IOMMU_FAULT_WRITE) ? KGSL_PAGEFAULT_TYPE_WRITE :
+			KGSL_PAGEFAULT_TYPE_READ;
+
+	report->fault_addr = addr;
+	report->fault_type = fault_flag;
+	if (kgsl_add_fault(context, KGSL_FAULT_TYPE_PAGEFAULT, report))
+		kfree(report);
+}
+
+static void kgsl_iommu_print_fault(struct kgsl_mmu *mmu,
+		struct kgsl_iommu_context *ctxt, unsigned long addr,
+		u64 ptbase, u32 contextid,
+		int flags, struct kgsl_process_private *private,
+		struct kgsl_context *context)
+{
+	struct kgsl_device *device = KGSL_MMU_DEVICE(mmu);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+	struct kgsl_mem_entry *prev = NULL, *next = NULL, *entry;
+	const char *fault_type = NULL;
+	const char *comm = NULL;
+	u32 ptname = KGSL_MMU_GLOBAL_PT;
+	int id;
+
+	if (private) {
+		comm = private->comm;
+		ptname = pid_nr(private->pid);
+	}
+
+	trace_kgsl_mmu_pagefault(device, addr,
+			ptname, comm,
+			(flags & IOMMU_FAULT_WRITE) ? "write" : "read");
+
+	if (flags & IOMMU_FAULT_TRANSLATION)
+		fault_type = "translation";
+	else if (flags & IOMMU_FAULT_PERMISSION)
+		fault_type = "permission";
+	else if (flags & IOMMU_FAULT_EXTERNAL)
+		fault_type = "external";
+	else if (flags & IOMMU_FAULT_TRANSACTION_STALLED)
+		fault_type = "transaction stalled";
+	else
+		fault_type = "unknown";
+
+
+	/* FIXME: This seems buggy */
+	if (test_bit(KGSL_FT_PAGEFAULT_LOG_ONE_PER_PAGE, &mmu->pfpolicy))
+		if (!kgsl_mmu_log_fault_addr(mmu, ptbase, addr))
+			return;
+
+	if (!__ratelimit(&ctxt->ratelimit))
+		return;
+
+	dev_crit(device->dev,
+		"GPU PAGE FAULT: addr = %lX pid= %d name=%s drawctxt=%d context pid = %d\n", addr,
+		ptname, comm, contextid, context ? context->tid : 0);
+
+	dev_crit(device->dev,
+		"context=%s TTBR0=0x%llx (%s %s fault)\n",
+		ctxt->name, ptbase,
+		(flags & IOMMU_FAULT_WRITE) ? "write" : "read", fault_type);
+
+	if (gpudev->iommu_fault_block) {
+		u32 fsynr1 = KGSL_IOMMU_GET_CTX_REG(ctxt,
+			KGSL_IOMMU_CTX_FSYNR1);
+
+		dev_crit(device->dev,
+			"FAULTING BLOCK: %s\n",
+			gpudev->iommu_fault_block(device, fsynr1));
+	}
+
+	/* Don't print the debug if this is a permissions fault */
+	if ((flags & IOMMU_FAULT_PERMISSION))
+		return;
+
+	kgsl_iommu_check_if_freed(device->dev, ctxt, addr, ptname);
+
+	/*
+	 * Don't print any debug information if the address is
+	 * in the global region. These are rare and nobody needs
+	 * to know the addresses that are in here
+	 */
+	if (kgsl_iommu_addr_is_global(mmu, addr)) {
+		dev_crit(device->dev, "Fault in global memory\n");
+		return;
+	}
+
+	if (!private)
+		return;
+
+	dev_crit(device->dev, "---- nearby memory ----\n");
+
+	spin_lock(&private->mem_lock);
+	idr_for_each_entry(&private->mem_idr, entry, id) {
+		u64 cur = entry->memdesc.gpuaddr;
+
+		if (cur < addr) {
+			if (!prev || prev->memdesc.gpuaddr < cur)
+				prev = entry;
+		}
+
+		if (cur > addr) {
+			if (!next || next->memdesc.gpuaddr > cur)
+				next = entry;
+		}
+	}
+
+	print_entry(device->dev, prev, pid_nr(private->pid));
+	dev_crit(device->dev, "<- fault @ %16.16lx\n", addr);
+	print_entry(device->dev, next, pid_nr(private->pid));
+
+	spin_unlock(&private->mem_lock);
+}
+
+/*
+ * Return true if the IOMMU should stall and trigger a snapshot on a pagefault
+ */
+static bool kgsl_iommu_check_stall_on_fault(struct kgsl_iommu_context *ctx,
+	struct kgsl_mmu *mmu, int flags)
+{
+	struct kgsl_device *device = KGSL_MMU_DEVICE(mmu);
+
+	if (!(flags & IOMMU_FAULT_TRANSACTION_STALLED))
+		return false;
+
+	if (!test_bit(KGSL_FT_PAGEFAULT_GPUHALT_ENABLE, &mmu->pfpolicy))
+		return false;
+
+	if (test_bit(KGSL_MMU_PAGEFAULT_TERMINATE, &mmu->features))
+		return false;
+
+	/*
+	 * Sometimes, there can be multiple invocations of the fault handler.
+	 * Make sure we trigger reset/recovery only once.
+	 */
+	if (ctx->stalled_on_fault)
+		return false;
+
+	if (!mutex_trylock(&device->mutex))
+		return true;
+
+	/*
+	 * Turn off GPU IRQ so we don't get faults from it too.
+	 * The device mutex must be held to change power state
+	 */
+	if (gmu_core_isenabled(device))
+		kgsl_pwrctrl_irq(device, false);
+	else
+		kgsl_pwrctrl_change_state(device, KGSL_STATE_AWARE);
+
+	mutex_unlock(&device->mutex);
+	return true;
+}
+
+static int kgsl_iommu_fault_handler(struct kgsl_mmu *mmu,
+		struct kgsl_iommu_context *ctx, unsigned long addr, int flags)
+{
+	struct kgsl_device *device = KGSL_MMU_DEVICE(mmu);
+	u64 ptbase;
+	u32 contextidr;
+	bool stall;
+	struct kgsl_process_private *private;
+	struct kgsl_context *context;
+
+	ptbase = KGSL_IOMMU_GET_CTX_REG_Q(ctx, KGSL_IOMMU_CTX_TTBR0);
+	contextidr = KGSL_IOMMU_GET_CTX_REG(ctx, KGSL_IOMMU_CTX_CONTEXTIDR);
+
+	private = kgsl_iommu_get_process(ptbase);
+	context = kgsl_context_get(device, contextidr);
+
+	stall = kgsl_iommu_check_stall_on_fault(ctx, mmu, flags);
+
+	kgsl_iommu_print_fault(mmu, ctx, addr, ptbase, contextidr, flags, private,
+		context);
+	kgsl_iommu_add_fault_info(context, addr, flags);
+
+	if (stall) {
+		struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+		u32 sctlr;
+
+		/*
+		 * Disable context fault interrupts as we do not clear FSR in
+		 * the ISR. Will be re-enabled after FSR is cleared.
+		 */
+		sctlr = KGSL_IOMMU_GET_CTX_REG(ctx, KGSL_IOMMU_CTX_SCTLR);
+		sctlr &= ~(0x1 << KGSL_IOMMU_SCTLR_CFIE_SHIFT);
+		KGSL_IOMMU_SET_CTX_REG(ctx, KGSL_IOMMU_CTX_SCTLR, sctlr);
+
+		/* This is used by reset/recovery path */
+		ctx->stalled_on_fault = true;
+
+		/* Go ahead with recovery*/
+		if (adreno_dev->dispatch_ops && adreno_dev->dispatch_ops->fault)
+			adreno_dev->dispatch_ops->fault(adreno_dev,
+				ADRENO_IOMMU_PAGE_FAULT);
+	}
+
+	kgsl_context_put(context);
+	kgsl_process_private_put(private);
+
+	/* Return -EBUSY to keep the IOMMU driver from resuming on a stall */
+	return stall ? -EBUSY : 0;
+}
+
+static int kgsl_iommu_default_fault_handler(struct iommu_domain *domain,
+	struct device *dev, unsigned long addr, int flags, void *token)
+{
+	struct kgsl_mmu *mmu = token;
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	return kgsl_iommu_fault_handler(mmu, &iommu->user_context,
+		addr, flags);
+}
+
+static int kgsl_iommu_lpac_fault_handler(struct iommu_domain *domain,
+	struct device *dev, unsigned long addr, int flags, void *token)
+{
+	struct kgsl_mmu *mmu = token;
+	struct kgsl_iommu *iommu = &mmu->iommu;
+	struct kgsl_iommu_context *ctx = &iommu->lpac_context;
+	u32 fsynr0, fsynr1;
+
+	fsynr0 = KGSL_IOMMU_GET_CTX_REG(ctx, KGSL_IOMMU_CTX_FSYNR0);
+	fsynr1 = KGSL_IOMMU_GET_CTX_REG(ctx, KGSL_IOMMU_CTX_FSYNR1);
+
+	dev_crit(KGSL_MMU_DEVICE(mmu)->dev,
+		"LPAC PAGE FAULT iova=0x%16lx, fsynr0=0x%x, fsynr1=0x%x\n",
+		addr, fsynr0, fsynr1);
+
+	return kgsl_iommu_fault_handler(mmu, &iommu->lpac_context,
+		addr, flags);
+}
+
+static int kgsl_iommu_secure_fault_handler(struct iommu_domain *domain,
+	struct device *dev, unsigned long addr, int flags, void *token)
+{
+	struct kgsl_mmu *mmu = token;
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	return kgsl_iommu_fault_handler(mmu, &iommu->secure_context,
+		addr, flags);
+}
+
+/*
+ * kgsl_iommu_disable_clk() - Disable iommu clocks
+ * Disable IOMMU clocks
+ */
+static void kgsl_iommu_disable_clk(struct kgsl_mmu *mmu)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	atomic_dec(&iommu->clk_enable_count);
+
+	/*
+	 * Make sure the clk refcounts are good. An unbalance may
+	 * cause the clocks to be off when we need them on.
+	 */
+	WARN_ON(atomic_read(&iommu->clk_enable_count) < 0);
+
+	clk_bulk_disable_unprepare(iommu->num_clks, iommu->clks);
+
+	if (!IS_ERR_OR_NULL(iommu->cx_regulator))
+		regulator_disable(iommu->cx_regulator);
+
+	if (pm_runtime_enabled(&iommu->pdev->dev))
+		pm_runtime_put_sync(&iommu->pdev->dev);
+}
+
+/*
+ * kgsl_iommu_enable_clk - Enable iommu clocks
+ * Enable all the IOMMU clocks
+ */
+static void kgsl_iommu_enable_clk(struct kgsl_mmu *mmu)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	if (!IS_ERR_OR_NULL(iommu->cx_regulator))
+		WARN_ON(regulator_enable(iommu->cx_regulator));
+
+	if (pm_runtime_enabled(&iommu->pdev->dev))
+		WARN_ON(pm_runtime_resume_and_get(&iommu->pdev->dev));
+
+	WARN_ON(clk_bulk_prepare_enable(iommu->num_clks, iommu->clks));
+
+	atomic_inc(&iommu->clk_enable_count);
+}
+
+/* kgsl_iommu_get_ttbr0 - Get TTBR0 setting for a pagetable */
+static u64 kgsl_iommu_get_ttbr0(struct kgsl_pagetable *pagetable)
+{
+	struct kgsl_iommu_pt *pt = to_iommu_pt(pagetable);
+
+	/* This will be zero if KGSL_MMU_IOPGTABLE is not enabled */
+	return pt->ttbr0;
+}
+
+/* Set TTBR0 for the given context with the specific configuration */
+static void kgsl_iommu_set_ttbr0(struct kgsl_iommu_context *context,
+		struct kgsl_mmu *mmu, const struct io_pgtable_cfg *pgtbl_cfg)
+{
+	struct adreno_smmu_priv *adreno_smmu;
+
+	/* Quietly return if the context doesn't have a domain */
+	if (!context->domain)
+		return;
+
+	adreno_smmu = dev_get_drvdata(&context->pdev->dev);
+
+	/* Enable CX and clocks before we call into SMMU to setup registers */
+	kgsl_iommu_enable_clk(mmu);
+	adreno_smmu->set_ttbr0_cfg(adreno_smmu->cookie, pgtbl_cfg);
+	kgsl_iommu_disable_clk(mmu);
+}
+
+static int kgsl_iommu_get_context_bank(struct kgsl_pagetable *pt, struct kgsl_context *context)
+{
+	struct kgsl_iommu *iommu = to_kgsl_iommu(pt);
+	struct iommu_domain *domain;
+
+	if (kgsl_context_is_lpac(context))
+		domain = to_iommu_domain(&iommu->lpac_context);
+	else
+		domain = to_iommu_domain(&iommu->user_context);
+
+	return qcom_iommu_get_context_bank_nr(domain);
+}
+
+static int kgsl_iommu_get_asid(struct kgsl_pagetable *pt, struct kgsl_context *context)
+{
+	struct kgsl_iommu *iommu = to_kgsl_iommu(pt);
+	struct iommu_domain *domain;
+
+	if (kgsl_context_is_lpac(context))
+		domain = to_iommu_domain(&iommu->lpac_context);
+	else
+		domain = to_iommu_domain(&iommu->user_context);
+
+	return qcom_iommu_get_asid_nr(domain);
+}
+
+static void kgsl_iommu_destroy_default_pagetable(struct kgsl_pagetable *pagetable)
+{
+	struct kgsl_device *device = KGSL_MMU_DEVICE(pagetable->mmu);
+	struct kgsl_iommu_pt *pt = to_iommu_pt(pagetable);
+	struct kgsl_global_memdesc *md;
+
+	list_for_each_entry(md, &device->globals, node) {
+		if (md->memdesc.flags & KGSL_MEMFLAGS_SECURE)
+			continue;
+
+		kgsl_iommu_default_unmap(pagetable, &md->memdesc);
+	}
+
+	kfree(pt);
+}
+
+static void kgsl_iommu_destroy_pagetable(struct kgsl_pagetable *pagetable)
+{
+	struct kgsl_iommu_pt *pt = to_iommu_pt(pagetable);
+
+	free_io_pgtable_ops(pt->pgtbl_ops);
+	kfree(pt);
+}
+
+static void _enable_gpuhtw_llc(struct kgsl_mmu *mmu, struct iommu_domain *domain)
+{
+	if (!test_bit(KGSL_MMU_LLCC_ENABLE, &mmu->features))
+		return;
+
+	if (mmu->subtype == KGSL_IOMMU_SMMU_V500) {
+		if (!test_bit(KGSL_MMU_IO_COHERENT, &mmu->features))
+			iommu_set_pgtable_quirks(domain,
+					IO_PGTABLE_QUIRK_QCOM_USE_LLC_NWA);
+	} else
+		iommu_set_pgtable_quirks(domain, IO_PGTABLE_QUIRK_ARM_OUTER_WBWA);
+}
+
+int kgsl_set_smmu_aperture(struct kgsl_device *device,
+		struct kgsl_iommu_context *context)
+{
+	int ret;
+
+	if (!test_bit(KGSL_MMU_SMMU_APERTURE, &device->mmu.features))
+		return 0;
+
+	ret = qcom_scm_kgsl_set_smmu_aperture(context->cb_num);
+	if (ret == -EBUSY)
+		ret = qcom_scm_kgsl_set_smmu_aperture(context->cb_num);
+
+	if (ret)
+		dev_err(&device->pdev->dev, "Unable to set the SMMU aperture: %d. The aperture needs to be set to use per-process pagetables\n",
+			ret);
+
+	return ret;
+}
+
+static int set_smmu_lpac_aperture(struct kgsl_device *device,
+		struct kgsl_iommu_context *context)
+{
+	int ret;
+
+	if (!test_bit(KGSL_MMU_SMMU_APERTURE, &device->mmu.features))
+		return 0;
+
+	ret = qcom_scm_kgsl_set_smmu_lpac_aperture(context->cb_num);
+	if (ret == -EBUSY)
+		ret = qcom_scm_kgsl_set_smmu_lpac_aperture(context->cb_num);
+
+	if (ret)
+		dev_err(&device->pdev->dev, "Unable to set the LPAC SMMU aperture: %d. The aperture needs to be set to use per-process pagetables\n",
+			ret);
+
+	return ret;
+}
+
+/* FIXME: better name feor this function */
+static int kgsl_iopgtbl_alloc(struct kgsl_iommu_context *ctx, struct kgsl_iommu_pt *pt)
+{
+	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(&ctx->pdev->dev);
+	const struct io_pgtable_cfg *cfg = NULL;
+
+	if (adreno_smmu->cookie)
+		cfg = adreno_smmu->get_ttbr1_cfg(adreno_smmu->cookie);
+	if (!cfg)
+		return -ENODEV;
+
+	pt->cfg = *cfg;
+	pt->cfg.quirks &= ~IO_PGTABLE_QUIRK_ARM_TTBR1;
+	pt->cfg.tlb = &kgsl_iopgtbl_tlb_ops;
+
+	pt->pgtbl_ops = alloc_io_pgtable_ops(ARM_64_LPAE_S1, &pt->cfg, NULL);
+
+	if (!pt->pgtbl_ops)
+		return -ENOMEM;
+
+	pt->ttbr0 = pt->cfg.arm_lpae_s1_cfg.ttbr;
+
+	return 0;
+}
+
+static struct kgsl_pagetable *kgsl_iommu_default_pagetable(struct kgsl_mmu *mmu)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+	struct kgsl_iommu_pt *iommu_pt;
+	int ret;
+
+	iommu_pt = kzalloc(sizeof(*iommu_pt), GFP_KERNEL);
+	if (!iommu_pt)
+		return ERR_PTR(-ENOMEM);
+
+	kgsl_mmu_pagetable_init(mmu, &iommu_pt->base, KGSL_MMU_GLOBAL_PT);
+
+	iommu_pt->base.fault_addr = U64_MAX;
+	iommu_pt->base.rbtree = RB_ROOT;
+	iommu_pt->base.pt_ops = &default_pt_ops;
+
+	if (test_bit(KGSL_MMU_64BIT, &mmu->features)) {
+		iommu_pt->base.compat_va_start = KGSL_IOMMU_SVM_BASE32(mmu);
+		iommu_pt->base.compat_va_end = KGSL_IOMMU_SVM_END32(mmu);
+		iommu_pt->base.va_start = KGSL_IOMMU_VA_BASE64;
+		iommu_pt->base.va_end = KGSL_IOMMU_VA_END64;
+
+	} else {
+		iommu_pt->base.va_start = KGSL_IOMMU_SVM_BASE32(mmu);
+		iommu_pt->base.va_end = KGSL_IOMMU_GLOBAL_MEM_BASE(mmu);
+		iommu_pt->base.compat_va_start = iommu_pt->base.va_start;
+		iommu_pt->base.compat_va_end = iommu_pt->base.va_end;
+	}
+
+	if (!test_bit(KGSL_MMU_IOPGTABLE, &mmu->features)) {
+		iommu_pt->base.global_base = KGSL_IOMMU_GLOBAL_MEM_BASE(mmu);
+
+		kgsl_mmu_pagetable_add(mmu, &iommu_pt->base);
+		return &iommu_pt->base;
+	}
+
+	iommu_pt->base.global_base = KGSL_IOMMU_SPLIT_TABLE_BASE;
+
+	/*
+	 * Set up a "default' TTBR0 for the pagetable - this would only be used
+	 * in cases when the per-process pagetable allocation failed for some
+	 * reason
+	 */
+	ret = kgsl_iopgtbl_alloc(&iommu->user_context, iommu_pt);
+	if (ret) {
+		kfree(iommu_pt);
+		return ERR_PTR(ret);
+	}
+
+	kgsl_mmu_pagetable_add(mmu, &iommu_pt->base);
+	return &iommu_pt->base;
+
+}
+
+#if IS_ENABLED(CONFIG_QCOM_SECURE_BUFFER)
+static struct kgsl_pagetable *kgsl_iommu_secure_pagetable(struct kgsl_mmu *mmu)
+{
+	struct kgsl_iommu_pt *iommu_pt;
+
+	if (!mmu->secured)
+		return ERR_PTR(-EPERM);
+
+	iommu_pt = kzalloc(sizeof(*iommu_pt), GFP_KERNEL);
+	if (!iommu_pt)
+		return ERR_PTR(-ENOMEM);
+
+	kgsl_mmu_pagetable_init(mmu, &iommu_pt->base, KGSL_MMU_SECURE_PT);
+	iommu_pt->base.fault_addr = U64_MAX;
+	iommu_pt->base.rbtree = RB_ROOT;
+	iommu_pt->base.pt_ops = &secure_pt_ops;
+
+	iommu_pt->base.compat_va_start = KGSL_IOMMU_SECURE_BASE32;
+	iommu_pt->base.compat_va_end = KGSL_IOMMU_SECURE_END32;
+	iommu_pt->base.va_start = KGSL_IOMMU_SECURE_BASE(mmu);
+	iommu_pt->base.va_end = KGSL_IOMMU_SECURE_END(mmu);
+
+	kgsl_mmu_pagetable_add(mmu, &iommu_pt->base);
+	return &iommu_pt->base;
+}
+#else
+static struct kgsl_pagetable *kgsl_iommu_secure_pagetable(struct kgsl_mmu *mmu)
+{
+	return ERR_PTR(-EPERM);
+}
+#endif
+
+static struct kgsl_pagetable *kgsl_iopgtbl_pagetable(struct kgsl_mmu *mmu, u32 name)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+	struct kgsl_iommu_pt *pt;
+	int ret;
+
+	pt = kzalloc(sizeof(*pt), GFP_KERNEL);
+	if (!pt)
+		return ERR_PTR(-ENOMEM);
+
+	kgsl_mmu_pagetable_init(mmu, &pt->base, name);
+
+	pt->base.fault_addr = U64_MAX;
+	pt->base.rbtree = RB_ROOT;
+	pt->base.pt_ops = &iopgtbl_pt_ops;
+
+	if (test_bit(KGSL_MMU_64BIT, &mmu->features)) {
+		pt->base.compat_va_start = KGSL_IOMMU_SVM_BASE32(mmu);
+		pt->base.compat_va_end = KGSL_IOMMU_SVM_END32(mmu);
+		pt->base.va_start = KGSL_IOMMU_VA_BASE64;
+		pt->base.va_end = KGSL_IOMMU_VA_END64;
+
+		if (is_compat_task()) {
+			pt->base.svm_start = KGSL_IOMMU_SVM_BASE32(mmu);
+			pt->base.svm_end = KGSL_IOMMU_SVM_END32(mmu);
+		} else {
+			pt->base.svm_start = KGSL_IOMMU_SVM_BASE64;
+			pt->base.svm_end = KGSL_IOMMU_SVM_END64;
+		}
+
+	} else {
+		pt->base.va_start = KGSL_IOMMU_SVM_BASE32(mmu);
+		pt->base.va_end = KGSL_IOMMU_GLOBAL_MEM_BASE(mmu);
+		pt->base.compat_va_start = pt->base.va_start;
+		pt->base.compat_va_end = pt->base.va_end;
+		pt->base.svm_start = KGSL_IOMMU_SVM_BASE32(mmu);
+		pt->base.svm_end = KGSL_IOMMU_SVM_END32(mmu);
+	}
+
+	/*
+	 * We expect the 64-bit SVM and non-SVM ranges not to overlap so that
+	 * va_hint points to VA space at the top of the 64-bit non-SVM range.
+	 */
+	BUILD_BUG_ON_MSG(!((KGSL_IOMMU_VA_BASE64 >= KGSL_IOMMU_SVM_END64) ||
+			(KGSL_IOMMU_SVM_BASE64 >= KGSL_IOMMU_VA_END64)),
+			"64-bit SVM and non-SVM ranges should not overlap");
+
+	/* Set up the hint for 64-bit non-SVM VA on per-process pagetables */
+	pt->base.va_hint = pt->base.va_start;
+
+	ret = kgsl_iopgtbl_alloc(&iommu->user_context, pt);
+	if (ret) {
+		kfree(pt);
+		return ERR_PTR(ret);
+	}
+
+	kgsl_mmu_pagetable_add(mmu, &pt->base);
+	return &pt->base;
+}
+
+static struct kgsl_pagetable *kgsl_iommu_getpagetable(struct kgsl_mmu *mmu,
+		unsigned long name)
+{
+	struct kgsl_pagetable *pt;
+
+	/* If we already know the pagetable, return it */
+	pt = kgsl_get_pagetable(name);
+	if (pt)
+		return pt;
+
+	/* If io-pgtables are not in effect, just use the default pagetable */
+	if (!test_bit(KGSL_MMU_IOPGTABLE, &mmu->features))
+		return mmu->defaultpagetable;
+
+	pt = kgsl_iopgtbl_pagetable(mmu, name);
+
+	/*
+	 * If the io-pgtable allocation didn't work then fall back to the
+	 * default pagetable for this cycle
+	 */
+	if (!pt)
+		return mmu->defaultpagetable;
+
+	return pt;
+}
+
+static void kgsl_iommu_detach_context(struct kgsl_iommu_context *context)
+{
+	if (!context->domain)
+		return;
+
+	iommu_detach_device(context->domain, &context->pdev->dev);
+	iommu_domain_free(context->domain);
+
+	context->domain = NULL;
+
+	platform_device_put(context->pdev);
+
+	context->pdev = NULL;
+}
+
+static void kgsl_iommu_close(struct kgsl_mmu *mmu)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	/* First put away the default pagetables */
+	kgsl_mmu_putpagetable(mmu->defaultpagetable);
+
+	kgsl_mmu_putpagetable(mmu->securepagetable);
+
+	/*
+	 * Flush the workqueue to ensure pagetables are
+	 * destroyed before proceeding further
+	 */
+	flush_workqueue(kgsl_driver.workqueue);
+
+	mmu->defaultpagetable = NULL;
+	mmu->securepagetable = NULL;
+
+	kgsl_iommu_set_ttbr0(&iommu->lpac_context, mmu, NULL);
+	kgsl_iommu_set_ttbr0(&iommu->user_context, mmu, NULL);
+
+	/* Next, detach the context banks */
+	kgsl_iommu_detach_context(&iommu->user_context);
+	kgsl_iommu_detach_context(&iommu->lpac_context);
+	kgsl_iommu_detach_context(&iommu->secure_context);
+
+	kgsl_free_secure_page(kgsl_secure_guard_page);
+	kgsl_secure_guard_page = NULL;
+
+	if (kgsl_guard_page != NULL) {
+		__free_page(kgsl_guard_page);
+		kgsl_guard_page = NULL;
+	}
+
+	if (pm_runtime_enabled(&iommu->pdev->dev))
+		pm_runtime_disable(&iommu->pdev->dev);
+
+	kmem_cache_destroy(addr_entry_cache);
+	addr_entry_cache = NULL;
+}
+
+/* Program the PRR marker and enable it in the ACTLR register */
+static void _iommu_context_set_prr(struct kgsl_mmu *mmu,
+		struct kgsl_iommu_context *ctx)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+	struct page *page = kgsl_vbo_zero_page;
+	u32 val;
+
+	if (ctx->cb_num < 0)
+		return;
+
+	/* Quietly return if the context doesn't have a domain */
+	if (!ctx->domain)
+		return;
+
+	if (!page)
+		return;
+
+	writel_relaxed(lower_32_bits(page_to_phys(page)),
+		iommu->regbase + KGSL_IOMMU_PRR_CFG_LADDR);
+
+	writel_relaxed(upper_32_bits(page_to_phys(page)),
+		iommu->regbase + KGSL_IOMMU_PRR_CFG_UADDR);
+
+	val = KGSL_IOMMU_GET_CTX_REG(ctx, KGSL_IOMMU_CTX_ACTLR);
+	val |= FIELD_PREP(KGSL_IOMMU_ACTLR_PRR_ENABLE, 1);
+	KGSL_IOMMU_SET_CTX_REG(ctx, KGSL_IOMMU_CTX_ACTLR, val);
+
+	/* Make sure all of the preceding writes have posted */
+	wmb();
+}
+
+static void kgsl_iommu_configure_gpu_sctlr(struct kgsl_mmu *mmu,
+		unsigned long pf_policy,
+		struct kgsl_iommu_context *ctx)
+{
+	u32 sctlr_val;
+
+	/*
+	 * If pagefault policy is GPUHALT_ENABLE,
+	 *   If terminate feature flag is enabled:
+	 *     1) Program CFCFG to 0 to terminate the faulting transaction
+	 *     2) Program HUPCF to 0 (terminate subsequent transactions
+	 *        in the presence of an outstanding fault)
+	 *   Else configure stall:
+	 *     1) Program CFCFG to 1 to enable STALL mode
+	 *     2) Program HUPCF to 0 (Stall subsequent
+	 *        transactions in the presence of an outstanding fault)
+	 * else
+	 * 1) Program CFCFG to 0 to disable STALL mode (0=Terminate)
+	 * 2) Program HUPCF to 1 (Process subsequent transactions
+	 *    independently of any outstanding fault)
+	 */
+
+	sctlr_val = KGSL_IOMMU_GET_CTX_REG(ctx, KGSL_IOMMU_CTX_SCTLR);
+	if (test_bit(KGSL_FT_PAGEFAULT_GPUHALT_ENABLE, &pf_policy)) {
+		if (test_bit(KGSL_MMU_PAGEFAULT_TERMINATE, &mmu->features)) {
+			sctlr_val &= ~(0x1 << KGSL_IOMMU_SCTLR_CFCFG_SHIFT);
+			sctlr_val &= ~(0x1 << KGSL_IOMMU_SCTLR_HUPCF_SHIFT);
+		} else {
+			sctlr_val |= (0x1 << KGSL_IOMMU_SCTLR_CFCFG_SHIFT);
+			sctlr_val &= ~(0x1 << KGSL_IOMMU_SCTLR_HUPCF_SHIFT);
+		}
+	} else {
+		sctlr_val &= ~(0x1 << KGSL_IOMMU_SCTLR_CFCFG_SHIFT);
+		sctlr_val |= (0x1 << KGSL_IOMMU_SCTLR_HUPCF_SHIFT);
+	}
+	KGSL_IOMMU_SET_CTX_REG(ctx, KGSL_IOMMU_CTX_SCTLR, sctlr_val);
+}
+
+static int kgsl_iommu_start(struct kgsl_mmu *mmu)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	kgsl_iommu_enable_clk(mmu);
+
+	/* Set the following registers only when the MMU type is QSMMU */
+	if (mmu->subtype != KGSL_IOMMU_SMMU_V500) {
+		/* Enable hazard check from GPU_SMMU_HUM_CFG */
+		writel_relaxed(0x02, iommu->regbase + 0x6800);
+
+		/* Write to GPU_SMMU_DORA_ORDERING to disable reordering */
+		writel_relaxed(0x01, iommu->regbase + 0x64a0);
+
+		/* make sure register write committed */
+		wmb();
+	}
+
+	kgsl_iommu_configure_gpu_sctlr(mmu, mmu->pfpolicy, &iommu->user_context);
+
+	_iommu_context_set_prr(mmu, &iommu->user_context);
+	if (mmu->secured)
+		_iommu_context_set_prr(mmu, &iommu->secure_context);
+
+	if (iommu->lpac_context.domain) {
+		_iommu_context_set_prr(mmu, &iommu->lpac_context);
+		kgsl_iommu_configure_gpu_sctlr(mmu, mmu->pfpolicy, &iommu->lpac_context);
+	}
+
+	kgsl_iommu_disable_clk(mmu);
+	return 0;
+}
+
+static void kgsl_iommu_context_clear_fsr(struct kgsl_mmu *mmu, struct kgsl_iommu_context *ctx)
+{
+	unsigned int sctlr_val;
+
+	if (ctx->stalled_on_fault) {
+		kgsl_iommu_enable_clk(mmu);
+		KGSL_IOMMU_SET_CTX_REG(ctx, KGSL_IOMMU_CTX_FSR, 0xffffffff);
+		/*
+		 * Re-enable context fault interrupts after clearing
+		 * FSR to prevent the interrupt from firing repeatedly
+		 */
+		sctlr_val = KGSL_IOMMU_GET_CTX_REG(ctx, KGSL_IOMMU_CTX_SCTLR);
+		sctlr_val |= (0x1 << KGSL_IOMMU_SCTLR_CFIE_SHIFT);
+		KGSL_IOMMU_SET_CTX_REG(ctx, KGSL_IOMMU_CTX_SCTLR, sctlr_val);
+		/*
+		 * Make sure the above register writes
+		 * are not reordered across the barrier
+		 * as we use writel_relaxed to write them
+		 */
+		wmb();
+		kgsl_iommu_disable_clk(mmu);
+		ctx->stalled_on_fault = false;
+	}
+}
+
+static void kgsl_iommu_clear_fsr(struct kgsl_mmu *mmu)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	kgsl_iommu_context_clear_fsr(mmu, &iommu->user_context);
+
+	if (iommu->lpac_context.domain)
+		kgsl_iommu_context_clear_fsr(mmu, &iommu->lpac_context);
+}
+
+static void kgsl_iommu_context_pagefault_resume(struct kgsl_iommu *iommu, struct kgsl_iommu_context *ctx,
+			bool terminate)
+{
+	u32 sctlr_val = 0;
+
+	if (!ctx->stalled_on_fault)
+		return;
+
+	if (!terminate)
+		goto clear_fsr;
+
+	sctlr_val = KGSL_IOMMU_GET_CTX_REG(ctx, KGSL_IOMMU_CTX_SCTLR);
+	/*
+	 * As part of recovery, GBIF halt sequence should be performed.
+	 * In a worst case scenario, if any GPU block is generating a
+	 * stream of un-ending faulting transactions, SMMU would enter
+	 * stall-on-fault mode again after resuming and not let GBIF
+	 * halt succeed. In order to avoid that situation and terminate
+	 * those faulty transactions, set CFCFG and HUPCF to 0.
+	 */
+	sctlr_val &= ~(0x1 << KGSL_IOMMU_SCTLR_CFCFG_SHIFT);
+	sctlr_val &= ~(0x1 << KGSL_IOMMU_SCTLR_HUPCF_SHIFT);
+	KGSL_IOMMU_SET_CTX_REG(ctx, KGSL_IOMMU_CTX_SCTLR, sctlr_val);
+	/*
+	 * Make sure the above register write is not reordered across
+	 * the barrier as we use writel_relaxed to write it.
+	 */
+	wmb();
+
+clear_fsr:
+	/*
+	 * This will only clear fault bits in FSR. FSR.SS will still
+	 * be set. Writing to RESUME (below) is the only way to clear
+	 * FSR.SS bit.
+	 */
+	KGSL_IOMMU_SET_CTX_REG(ctx, KGSL_IOMMU_CTX_FSR, 0xffffffff);
+	/*
+	 * Make sure the above register write is not reordered across
+	 * the barrier as we use writel_relaxed to write it.
+	 */
+	wmb();
+
+	/*
+	 * Write 1 to RESUME.TnR to terminate the stalled transaction.
+	 * This will also allow the SMMU to process new transactions.
+	 */
+	KGSL_IOMMU_SET_CTX_REG(ctx, KGSL_IOMMU_CTX_RESUME, 1);
+	/*
+	 * Make sure the above register writes are not reordered across
+	 * the barrier as we use writel_relaxed to write them.
+	 */
+	wmb();
+}
+
+static void kgsl_iommu_pagefault_resume(struct kgsl_mmu *mmu, bool terminate)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	kgsl_iommu_context_pagefault_resume(iommu, &iommu->user_context, terminate);
+
+	if (iommu->lpac_context.domain)
+		kgsl_iommu_context_pagefault_resume(iommu, &iommu->lpac_context, terminate);
+}
+
+static u64
+kgsl_iommu_get_current_ttbr0(struct kgsl_mmu *mmu, struct kgsl_context *context)
+{
+	u64 val;
+	struct kgsl_iommu *iommu = &mmu->iommu;
+	struct kgsl_iommu_context *ctx = &iommu->user_context;
+
+	if (kgsl_context_is_lpac(context))
+		ctx = &iommu->lpac_context;
+
+	/*
+	 * We cannot enable or disable the clocks in interrupt context, this
+	 * function is called from interrupt context if there is an axi error
+	 */
+	if (in_interrupt())
+		return 0;
+
+	if (ctx->cb_num < 0)
+		return 0;
+
+	kgsl_iommu_enable_clk(mmu);
+	val = KGSL_IOMMU_GET_CTX_REG_Q(ctx, KGSL_IOMMU_CTX_TTBR0);
+	kgsl_iommu_disable_clk(mmu);
+	return val;
+}
+
+/*
+ * kgsl_iommu_set_pf_policy() - Set the pagefault policy for IOMMU
+ * @mmu: Pointer to mmu structure
+ * @pf_policy: The pagefault polict to set
+ *
+ * Check if the new policy indicated by pf_policy is same as current
+ * policy, if same then return else set the policy
+ */
+static int kgsl_iommu_set_pf_policy_ctxt(struct kgsl_mmu *mmu,
+				unsigned long pf_policy, struct kgsl_iommu_context *ctx)
+{
+	int cur, new;
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	cur = test_bit(KGSL_FT_PAGEFAULT_GPUHALT_ENABLE, &mmu->pfpolicy);
+	new = test_bit(KGSL_FT_PAGEFAULT_GPUHALT_ENABLE, &pf_policy);
+
+	if (cur == new)
+		return 0;
+
+	kgsl_iommu_enable_clk(mmu);
+
+	kgsl_iommu_configure_gpu_sctlr(mmu, pf_policy, &iommu->user_context);
+	if (iommu->lpac_context.domain)
+		kgsl_iommu_configure_gpu_sctlr(mmu, pf_policy, &iommu->lpac_context);
+
+	kgsl_iommu_disable_clk(mmu);
+	return 0;
+}
+
+static int kgsl_iommu_set_pf_policy(struct kgsl_mmu *mmu,
+				unsigned long pf_policy)
+{
+	struct kgsl_iommu *iommu = &mmu->iommu;
+
+	kgsl_iommu_set_pf_policy_ctxt(mmu, pf_policy, &iommu->user_context);
+
+	if (iommu->lpac_context.domain)
+		kgsl_iommu_set_pf_policy_ctxt(mmu, pf_policy, &iommu->lpac_context);
+
+	return 0;
+}
+
+static struct kgsl_iommu_addr_entry *_find_gpuaddr(
+		struct kgsl_pagetable *pagetable, uint64_t gpuaddr)
+{
+	struct rb_node *node = pagetable->rbtree.rb_node;
+
+	while (node != NULL) {
+		struct kgsl_iommu_addr_entry *entry = rb_entry(node,
+			struct kgsl_iommu_addr_entry, node);
+
+		if (gpuaddr < entry->base)
+			node = node->rb_left;
+		else if (gpuaddr > entry->base)
+			node = node->rb_right;
+		else
+			return entry;
+	}
+
+	return NULL;
+}
+
+static int _remove_gpuaddr(struct kgsl_pagetable *pagetable,
+		uint64_t gpuaddr)
+{
+	struct kgsl_iommu_addr_entry *entry;
+
+	entry = _find_gpuaddr(pagetable, gpuaddr);
+
+	if (WARN(!entry, "GPU address %llx doesn't exist\n", gpuaddr))
+		return -ENOMEM;
+
+	/*
+	 * If the hint was based on this entry, adjust it to the end of the
+	 * previous entry.
+	 */
+	if (pagetable->va_hint == (entry->base + entry->size)) {
+		struct kgsl_iommu_addr_entry *prev =
+			rb_entry_safe(rb_prev(&entry->node),
+				struct kgsl_iommu_addr_entry, node);
+
+		pagetable->va_hint = pagetable->va_start;
+		if (prev)
+			pagetable->va_hint = max_t(u64, prev->base + prev->size,
+							pagetable->va_start);
+	}
+
+	rb_erase(&entry->node, &pagetable->rbtree);
+	kmem_cache_free(addr_entry_cache, entry);
+	return 0;
+}
+
+static int _insert_gpuaddr(struct kgsl_pagetable *pagetable,
+		uint64_t gpuaddr, uint64_t size)
+{
+	struct rb_node **node, *parent = NULL;
+	struct kgsl_iommu_addr_entry *new =
+		kmem_cache_alloc(addr_entry_cache, GFP_ATOMIC);
+
+	if (new == NULL)
+		return -ENOMEM;
+
+	new->base = gpuaddr;
+	new->size = size;
+
+	node = &pagetable->rbtree.rb_node;
+
+	while (*node != NULL) {
+		struct kgsl_iommu_addr_entry *this;
+
+		parent = *node;
+		this = rb_entry(parent, struct kgsl_iommu_addr_entry, node);
+
+		if (new->base < this->base)
+			node = &parent->rb_left;
+		else if (new->base > this->base)
+			node = &parent->rb_right;
+		else {
+			/* Duplicate entry */
+			WARN_RATELIMIT(1, "duplicate gpuaddr: 0x%llx\n", gpuaddr);
+			kmem_cache_free(addr_entry_cache, new);
+			return -EEXIST;
+		}
+	}
+
+	rb_link_node(&new->node, parent, node);
+	rb_insert_color(&new->node, &pagetable->rbtree);
+
+	return 0;
+}
+
+static u64 _get_unmapped_area_hint(struct kgsl_pagetable *pagetable,
+		u64 bottom, u64 top, u64 size, u64 align)
+{
+	u64 hint;
+
+	/*
+	 * VA fragmentation can be a problem on global and secure pagetables
+	 * that are common to all processes, or if we're constrained to a 32-bit
+	 * range. Don't use the va_hint in these cases.
+	 */
+	if (!pagetable->va_hint || !upper_32_bits(top))
+		return (u64) -EINVAL;
+
+	/* Satisfy requested alignment */
+	hint = ALIGN(pagetable->va_hint, align);
+
+	/*
+	 * The va_hint is the highest VA that was allocated in the non-SVM
+	 * region. The 64-bit SVM and non-SVM regions do not overlap. So, we
+	 * know there is no VA allocated at this gpuaddr. Therefore, we only
+	 * need to check whether we have enough space for this allocation.
+	 */
+	if ((hint + size) > top)
+		return (u64) -ENOMEM;
+
+	pagetable->va_hint = hint + size;
+	return hint;
+}
+
+static uint64_t _get_unmapped_area(struct kgsl_pagetable *pagetable,
+		uint64_t bottom, uint64_t top, uint64_t size,
+		uint64_t align)
+{
+	struct rb_node *node;
+	uint64_t start;
+
+	/* Check if we can assign a gpuaddr based on the last allocation */
+	start = _get_unmapped_area_hint(pagetable, bottom, top, size, align);
+	if (!IS_ERR_VALUE(start))
+		return start;
+
+	/* Fall back to searching through the range. */
+	node = rb_first(&pagetable->rbtree);
+	bottom = ALIGN(bottom, align);
+	start = bottom;
+
+	while (node != NULL) {
+		uint64_t gap;
+		struct kgsl_iommu_addr_entry *entry = rb_entry(node,
+			struct kgsl_iommu_addr_entry, node);
+
+		/*
+		 * Skip any entries that are outside of the range, but make sure
+		 * to account for some that might straddle the lower bound
+		 */
+		if (entry->base < bottom) {
+			if (entry->base + entry->size > bottom)
+				start = ALIGN(entry->base + entry->size, align);
+			node = rb_next(node);
+			continue;
+		}
+
+		/* Stop if we went over the top */
+		if (entry->base >= top)
+			break;
+
+		/* Make sure there is a gap to consider */
+		if (start < entry->base) {
+			gap = entry->base - start;
+
+			if (gap >= size)
+				return start;
+		}
+
+		/* Stop if there is no more room in the region */
+		if (entry->base + entry->size >= top)
+			return (uint64_t) -ENOMEM;
+
+		/* Start the next cycle at the end of the current entry */
+		start = ALIGN(entry->base + entry->size, align);
+		node = rb_next(node);
+	}
+
+	if (start + size <= top)
+		return start;
+
+	return (uint64_t) -ENOMEM;
+}
+
+static uint64_t _get_unmapped_area_topdown(struct kgsl_pagetable *pagetable,
+		uint64_t bottom, uint64_t top, uint64_t size,
+		uint64_t align)
+{
+	struct rb_node *node = rb_last(&pagetable->rbtree);
+	uint64_t end = top;
+	uint64_t mask = ~(align - 1);
+	struct kgsl_iommu_addr_entry *entry;
+
+	/* Make sure that the bottom is correctly aligned */
+	bottom = ALIGN(bottom, align);
+
+	/* Make sure the requested size will fit in the range */
+	if (size > (top - bottom))
+		return -ENOMEM;
+
+	/* Walk back through the list to find the highest entry in the range */
+	for (node = rb_last(&pagetable->rbtree); node != NULL; node = rb_prev(node)) {
+		entry = rb_entry(node, struct kgsl_iommu_addr_entry, node);
+		if (entry->base < top)
+			break;
+	}
+
+	while (node != NULL) {
+		uint64_t offset;
+
+		entry = rb_entry(node, struct kgsl_iommu_addr_entry, node);
+
+		/* If the entire entry is below the range the search is over */
+		if ((entry->base + entry->size) < bottom)
+			break;
+
+		/* Get the top of the entry properly aligned */
+		offset = ALIGN(entry->base + entry->size, align);
+
+		/*
+		 * Try to allocate the memory from the top of the gap,
+		 * making sure that it fits between the top of this entry and
+		 * the bottom of the previous one
+		 */
+
+		if ((end > size) && (offset < end)) {
+			uint64_t chunk = (end - size) & mask;
+
+			if (chunk >= offset)
+				return chunk;
+		}
+
+		/*
+		 * If we get here and the current entry is outside of the range
+		 * then we are officially out of room
+		 */
+
+		if (entry->base < bottom)
+			return (uint64_t) -ENOMEM;
+
+		/* Set the top of the gap to the current entry->base */
+		end = entry->base;
+
+		/* And move on to the next lower entry */
+		node = rb_prev(node);
+	}
+
+	/* If we get here then there are no more entries in the region */
+	if ((end > size) && (((end - size) & mask) >= bottom))
+		return (end - size) & mask;
+
+	return (uint64_t) -ENOMEM;
+}
+
+static uint64_t kgsl_iommu_find_svm_region(struct kgsl_pagetable *pagetable,
+		uint64_t start, uint64_t end, uint64_t size,
+		uint64_t alignment)
+{
+	uint64_t addr;
+
+	/* Avoid black holes */
+	if (WARN(end <= start, "Bad search range: 0x%llx-0x%llx", start, end))
+		return (uint64_t) -EINVAL;
+
+	spin_lock(&pagetable->lock);
+	addr = _get_unmapped_area_topdown(pagetable,
+			start, end, size, alignment);
+	spin_unlock(&pagetable->lock);
+	return addr;
+}
+
+static bool iommu_addr_in_svm_ranges(struct kgsl_pagetable *pagetable,
+	u64 gpuaddr, u64 size)
+{
+	u64 end = gpuaddr + size;
+
+	/* Make sure size is not zero and we don't wrap around */
+	if (end <= gpuaddr)
+		return false;
+
+	if ((gpuaddr >= pagetable->compat_va_start && gpuaddr < pagetable->compat_va_end) &&
+		(end > pagetable->compat_va_start &&
+			end <= pagetable->compat_va_end))
+		return true;
+
+	if ((gpuaddr >= pagetable->svm_start && gpuaddr < pagetable->svm_end) &&
+		(end > pagetable->svm_start &&
+			end <= pagetable->svm_end))
+		return true;
+
+	return false;
+}
+
+static int kgsl_iommu_set_svm_region(struct kgsl_pagetable *pagetable,
+		uint64_t gpuaddr, uint64_t size)
+{
+	int ret = -ENOMEM;
+	struct rb_node *node;
+
+	/* Make sure the requested address doesn't fall out of SVM range */
+	if (!iommu_addr_in_svm_ranges(pagetable, gpuaddr, size))
+		return -ENOMEM;
+
+	spin_lock(&pagetable->lock);
+	node = pagetable->rbtree.rb_node;
+
+	while (node != NULL) {
+		uint64_t start, end;
+		struct kgsl_iommu_addr_entry *entry = rb_entry(node,
+			struct kgsl_iommu_addr_entry, node);
+
+		start = entry->base;
+		end = entry->base + entry->size;
+
+		if (gpuaddr  + size <= start)
+			node = node->rb_left;
+		else if (end <= gpuaddr)
+			node = node->rb_right;
+		else
+			goto out;
+	}
+
+	ret = _insert_gpuaddr(pagetable, gpuaddr, size);
+out:
+	spin_unlock(&pagetable->lock);
+	return ret;
+}
+
+static int get_gpuaddr(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc, u64 start, u64 end,
+		u64 size, u64 align)
+{
+	u64 addr;
+	int ret;
+
+	spin_lock(&pagetable->lock);
+	addr = _get_unmapped_area(pagetable, start, end, size, align);
+	if (addr == (u64) -ENOMEM) {
+		spin_unlock(&pagetable->lock);
+		return -ENOMEM;
+	}
+
+	ret = _insert_gpuaddr(pagetable, addr, size);
+	spin_unlock(&pagetable->lock);
+
+	if (ret == 0) {
+		memdesc->gpuaddr = addr;
+		memdesc->pagetable = pagetable;
+	}
+
+	return ret;
+}
+
+static int kgsl_iommu_get_gpuaddr(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	int ret = 0;
+	u64 start, end, size, align;
+
+	if (WARN_ON(kgsl_memdesc_use_cpu_map(memdesc)))
+		return -EINVAL;
+
+	if (memdesc->flags & KGSL_MEMFLAGS_SECURE &&
+			pagetable->name != KGSL_MMU_SECURE_PT)
+		return -EINVAL;
+
+	size = kgsl_memdesc_footprint(memdesc);
+
+	align = max_t(uint64_t, 1 << kgsl_memdesc_get_align(memdesc),
+			PAGE_SIZE);
+
+	if (memdesc->flags & KGSL_MEMFLAGS_FORCE_32BIT) {
+		start = pagetable->compat_va_start;
+		end = pagetable->compat_va_end;
+	} else {
+		start = pagetable->va_start;
+		end = pagetable->va_end;
+	}
+
+	ret = get_gpuaddr(pagetable, memdesc, start, end, size, align);
+	/* if OOM, retry once after flushing lockless_workqueue */
+	if (ret == -ENOMEM) {
+		flush_workqueue(kgsl_driver.lockless_workqueue);
+		ret = get_gpuaddr(pagetable, memdesc, start, end, size, align);
+	}
+
+	return ret;
+}
+
+static void kgsl_iommu_put_gpuaddr(struct kgsl_memdesc *memdesc)
+{
+	if (memdesc->pagetable == NULL)
+		return;
+
+	spin_lock(&memdesc->pagetable->lock);
+
+	_remove_gpuaddr(memdesc->pagetable, memdesc->gpuaddr);
+
+	spin_unlock(&memdesc->pagetable->lock);
+}
+
+static int kgsl_iommu_svm_range(struct kgsl_pagetable *pagetable,
+		uint64_t *lo, uint64_t *hi, uint64_t memflags)
+{
+	bool gpu_compat = (memflags & KGSL_MEMFLAGS_FORCE_32BIT) != 0;
+
+	if (lo != NULL)
+		*lo = gpu_compat ? pagetable->compat_va_start : pagetable->svm_start;
+	if (hi != NULL)
+		*hi = gpu_compat ? pagetable->compat_va_end : pagetable->svm_end;
+
+	return 0;
+}
+
+static bool kgsl_iommu_addr_in_range(struct kgsl_pagetable *pagetable,
+		uint64_t gpuaddr, uint64_t size)
+{
+	if (gpuaddr == 0)
+		return false;
+
+	if (gpuaddr >= pagetable->va_start && (gpuaddr + size) <
+			pagetable->va_end)
+		return true;
+
+	if (gpuaddr >= pagetable->compat_va_start && (gpuaddr + size) <
+			pagetable->compat_va_end)
+		return true;
+
+	if (gpuaddr >= pagetable->svm_start && (gpuaddr + size) <
+			pagetable->svm_end)
+		return true;
+
+	return false;
+}
+
+static int kgsl_iommu_setup_context(struct kgsl_mmu *mmu,
+		struct device_node *parent,
+		struct kgsl_iommu_context *context, const char *name,
+		iommu_fault_handler_t handler)
+{
+	struct device_node *node = of_find_node_by_name(parent, name);
+	struct platform_device *pdev;
+	struct kgsl_device *device = KGSL_MMU_DEVICE(mmu);
+	int ret;
+
+	if (!node)
+		return -ENOENT;
+
+	pdev = of_find_device_by_node(node);
+	ret = of_dma_configure(&pdev->dev, node, true);
+	of_node_put(node);
+
+	if (ret)
+		return ret;
+
+	context->cb_num = -1;
+	context->name = name;
+	context->kgsldev = device;
+	context->pdev = pdev;
+	ratelimit_default_init(&context->ratelimit);
+
+	/* Set the adreno_smmu priv data for the device */
+	dev_set_drvdata(&pdev->dev, &context->adreno_smmu);
+
+	/* Create a new context */
+	context->domain = iommu_domain_alloc(&platform_bus_type);
+	if (!context->domain) {
+		/*FIXME: Put back the pdev here? */
+		return -ENODEV;
+	}
+
+	_enable_gpuhtw_llc(mmu, context->domain);
+
+	ret = iommu_attach_device(context->domain, &context->pdev->dev);
+	if (ret) {
+		/* FIXME: put back the device here? */
+		iommu_domain_free(context->domain);
+		context->domain = NULL;
+		return ret;
+	}
+
+	iommu_set_fault_handler(context->domain, handler, mmu);
+
+	context->cb_num = qcom_iommu_get_context_bank_nr(context->domain);
+
+	if (context->cb_num >= 0)
+		return 0;
+
+	dev_err(&device->pdev->dev, "Couldn't get the context bank for %s: %d\n",
+		context->name, context->cb_num);
+
+	iommu_detach_device(context->domain, &context->pdev->dev);
+	iommu_domain_free(context->domain);
+
+	/* FIXME: put back the device here? */
+	context->domain = NULL;
+
+	return context->cb_num;
+}
+
+static int iommu_probe_user_context(struct kgsl_device *device,
+		struct device_node *node)
+{
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+	struct kgsl_mmu *mmu = &device->mmu;
+	struct kgsl_iommu_pt *pt;
+	int ret;
+
+	ret = kgsl_iommu_setup_context(mmu, node, &iommu->user_context,
+		"gfx3d_user", kgsl_iommu_default_fault_handler);
+	if (ret)
+		return ret;
+
+	/*
+	 * It is problamatic if smmu driver does system suspend before consumer
+	 * device (gpu). So smmu driver creates a device_link to act as a
+	 * supplier which in turn will ensure correct order during system
+	 * suspend. In kgsl, since we don't initialize iommu on the gpu device,
+	 * we should create a device_link between kgsl iommu device and gpu
+	 * device to maintain a correct suspend order between smmu device and
+	 * gpu device.
+	 */
+	if (!device_link_add(&device->pdev->dev, &iommu->user_context.pdev->dev,
+				DL_FLAG_AUTOREMOVE_CONSUMER))
+		dev_err(&iommu->user_context.pdev->dev,
+				"Unable to create device link to gpu device\n");
+
+	ret = kgsl_iommu_setup_context(mmu, node, &iommu->lpac_context,
+	       "gfx3d_lpac", kgsl_iommu_lpac_fault_handler);
+	/* LPAC is optional, ignore setup failures in absence of LPAC feature */
+	if ((ret < 0) && ADRENO_FEATURE(adreno_dev, ADRENO_LPAC))
+		goto err;
+
+	/*
+	 * FIXME: If adreno_smmu->cookie wasn't initialized then we can't do
+	 * IOPGTABLE
+	 */
+
+	/* Make the default pagetable */
+	mmu->defaultpagetable = kgsl_iommu_default_pagetable(mmu);
+	if (IS_ERR(mmu->defaultpagetable))
+		return PTR_ERR(mmu->defaultpagetable);
+
+	/* If IOPGTABLE isn't enabled then we are done */
+	if (!test_bit(KGSL_MMU_IOPGTABLE, &mmu->features))
+		return 0;
+
+	pt = to_iommu_pt(mmu->defaultpagetable);
+
+	/* Enable TTBR0 on the default and LPAC contexts */
+	kgsl_iommu_set_ttbr0(&iommu->user_context, mmu, &pt->cfg);
+
+	kgsl_set_smmu_aperture(device, &iommu->user_context);
+
+	kgsl_iommu_set_ttbr0(&iommu->lpac_context, mmu, &pt->cfg);
+
+	ret = set_smmu_lpac_aperture(device, &iommu->lpac_context);
+	/* LPAC is optional, ignore setup failures in absence of LPAC feature */
+	if ((ret < 0) && ADRENO_FEATURE(adreno_dev, ADRENO_LPAC)) {
+		kgsl_iommu_detach_context(&iommu->lpac_context);
+		goto err;
+	}
+
+	return 0;
+
+err:
+	kgsl_mmu_putpagetable(mmu->defaultpagetable);
+	mmu->defaultpagetable = NULL;
+	kgsl_iommu_detach_context(&iommu->user_context);
+
+	return ret;
+}
+
+static int iommu_probe_secure_context(struct kgsl_device *device,
+		struct device_node *parent)
+{
+	struct device_node *node;
+	struct platform_device *pdev;
+	int ret;
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct kgsl_mmu *mmu = &device->mmu;
+	struct kgsl_iommu_context *context = &iommu->secure_context;
+	int secure_vmid = VMID_CP_PIXEL;
+
+	if (!mmu->secured)
+		return -EPERM;
+
+	node = of_find_node_by_name(parent, "gfx3d_secure");
+	if (!node) {
+		ret = -ENOENT;
+		goto err;
+	}
+
+	pdev = of_find_device_by_node(node);
+	if (!pdev) {
+		ret = -ENODEV;
+		goto err_node_put;
+	}
+
+	ret = of_dma_configure(&pdev->dev, node, true);
+	if (ret)
+		goto err_device_put;
+
+	context->cb_num = -1;
+	context->name = "gfx3d_secure";
+	context->kgsldev = device;
+	context->pdev = pdev;
+	ratelimit_default_init(&context->ratelimit);
+
+	context->domain = iommu_domain_alloc(&platform_bus_type);
+	if (!context->domain) {
+		ret = -ENODEV;
+		goto err_device_put;
+	}
+
+	ret = qcom_iommu_set_secure_vmid(context->domain, secure_vmid);
+	if (ret) {
+		dev_err(&device->pdev->dev, "Unable to set the secure VMID: %d\n", ret);
+		goto err_domain_free;
+	}
+
+	_enable_gpuhtw_llc(mmu, context->domain);
+
+	ret = iommu_attach_device(context->domain, &context->pdev->dev);
+	if (ret)
+		goto err_domain_free;
+
+	iommu_set_fault_handler(context->domain,
+		kgsl_iommu_secure_fault_handler, mmu);
+
+	context->cb_num = qcom_iommu_get_context_bank_nr(context->domain);
+
+	if (context->cb_num < 0) {
+		ret = context->cb_num;
+		goto err_detach_device;
+	}
+
+	mmu->securepagetable = kgsl_iommu_secure_pagetable(mmu);
+
+	if (!IS_ERR(mmu->securepagetable))
+		return 0;
+
+err_detach_device:
+	iommu_detach_device(context->domain, &context->pdev->dev);
+err_domain_free:
+	iommu_domain_free(context->domain);
+	context->domain = NULL;
+err_device_put:
+	platform_device_put(pdev);
+	context->pdev = NULL;
+err_node_put:
+	of_node_put(node);
+err:
+	mmu->secured = false;
+
+	return ret;
+}
+
+static const char * const kgsl_iommu_clocks[] = {
+	"gcc_gpu_memnoc_gfx",
+	"gcc_gpu_snoc_dvm_gfx",
+	"gpu_cc_ahb",
+	"gpu_cc_cx_gmu",
+	"gpu_cc_hlos1_vote_gpu_smmu",
+	"gpu_cc_hub_aon",
+	"gpu_cc_hub_cx_int",
+	"gcc_bimc_gpu_axi",
+	"gcc_gpu_ahb",
+	"gcc_gpu_axi_clk",
+	"gcc_smmu_cfg_clk",
+	"gcc_gfx_tcu_clk",
+};
+
+static const struct kgsl_mmu_ops kgsl_iommu_ops;
+
+static void kgsl_iommu_check_config(struct kgsl_mmu *mmu,
+		struct device_node *parent)
+{
+	struct device_node *node = of_find_node_by_name(parent, "gfx3d_user");
+	struct device_node *phandle;
+
+	if (!node)
+		return;
+
+	phandle = of_parse_phandle(node, "iommus", 0);
+
+	if (phandle) {
+		if (of_device_is_compatible(phandle, "qcom,qsmmu-v500") ||
+			of_device_is_compatible(phandle, "arm,mmu-500"))
+			mmu->subtype = KGSL_IOMMU_SMMU_V500;
+		if (of_device_is_compatible(phandle, "qcom,adreno-smmu"))
+			set_bit(KGSL_MMU_IOPGTABLE, &mmu->features);
+
+		of_node_put(phandle);
+	}
+
+	of_node_put(node);
+}
+
+int kgsl_iommu_bind(struct kgsl_device *device, struct platform_device *pdev)
+{
+	u32 val[2];
+	int ret, i;
+	struct kgsl_iommu *iommu = KGSL_IOMMU(device);
+	struct kgsl_mmu *mmu = &device->mmu;
+	struct device_node *node = pdev->dev.of_node;
+	struct kgsl_global_memdesc *md;
+
+	/* Create a kmem cache for the pagetable address objects */
+	if (!addr_entry_cache) {
+		addr_entry_cache = KMEM_CACHE(kgsl_iommu_addr_entry, 0);
+		if (!addr_entry_cache) {
+			ret = -ENOMEM;
+			goto err;
+		}
+	}
+
+	ret = of_property_read_u32_array(node, "reg", val, 2);
+	if (ret) {
+		dev_err(&device->pdev->dev,
+			"%pOF: Unable to read KGSL IOMMU register range\n",
+			node);
+		goto err;
+	}
+
+	iommu->regbase = devm_ioremap(&device->pdev->dev, val[0], val[1]);
+	if (!iommu->regbase) {
+		dev_err(&device->pdev->dev, "Couldn't map IOMMU registers\n");
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	iommu->pdev = pdev;
+	iommu->num_clks = 0;
+
+	iommu->clks = devm_kcalloc(&pdev->dev, ARRAY_SIZE(kgsl_iommu_clocks),
+				sizeof(*iommu->clks), GFP_KERNEL);
+	if (!iommu->clks) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(kgsl_iommu_clocks); i++) {
+		struct clk *c;
+
+		c = devm_clk_get(&device->pdev->dev, kgsl_iommu_clocks[i]);
+		if (IS_ERR(c))
+			continue;
+
+		iommu->clks[iommu->num_clks].id = kgsl_iommu_clocks[i];
+		iommu->clks[iommu->num_clks++].clk = c;
+	}
+
+	/*
+	 * IOMMU device is already bound to power domain by core framework
+	 * as there is only single power domain
+	 */
+	if (of_property_read_bool(pdev->dev.of_node, "power-domains"))
+		pm_runtime_enable(&pdev->dev);
+	else
+		iommu->cx_regulator = devm_regulator_get(&pdev->dev, "vddcx");
+
+	set_bit(KGSL_MMU_PAGED, &mmu->features);
+
+	mmu->type = KGSL_MMU_TYPE_IOMMU;
+	mmu->mmu_ops = &kgsl_iommu_ops;
+
+	/* Peek at the phandle to set up configuration */
+	kgsl_iommu_check_config(mmu, node);
+
+	/* Probe the default pagetable */
+	ret = iommu_probe_user_context(device, node);
+	if (ret) {
+		of_platform_depopulate(&pdev->dev);
+		goto err;
+	}
+
+	/* Probe the secure pagetable (this is optional) */
+	iommu_probe_secure_context(device, node);
+
+	/* Map any globals that might have been created early */
+	list_for_each_entry(md, &device->globals, node) {
+
+		if (md->memdesc.flags & KGSL_MEMFLAGS_SECURE) {
+			if (IS_ERR_OR_NULL(mmu->securepagetable))
+				continue;
+
+			kgsl_iommu_secure_map(mmu->securepagetable,
+				&md->memdesc);
+		} else
+			kgsl_iommu_default_map(mmu->defaultpagetable,
+				&md->memdesc);
+	}
+
+	/* QDSS is supported only when QCOM_KGSL_QDSS_STM is enabled */
+	if (IS_ENABLED(CONFIG_QCOM_KGSL_QDSS_STM))
+		device->qdss_desc = kgsl_allocate_global_fixed(device,
+					"qcom,gpu-qdss-stm", "gpu-qdss");
+
+	device->qtimer_desc = kgsl_allocate_global_fixed(device,
+		"qcom,gpu-timer", "gpu-qtimer");
+
+	/*
+	 * Only support VBOs on MMU500 hardware that supports the PRR
+	 * marker register to ignore writes to the zero page
+	 */
+	if ((mmu->subtype == KGSL_IOMMU_SMMU_V500) &&
+			test_bit(KGSL_MMU_SUPPORT_VBO, &mmu->features)) {
+		/*
+		 * We need to allocate a page because we need a known physical
+		 * address to program in the PRR register but the hardware
+		 * should intercept accesses to the page before they go to DDR
+		 * so this should be mostly just a placeholder
+		 */
+		kgsl_vbo_zero_page = alloc_page(GFP_KERNEL | __GFP_ZERO |
+			__GFP_NORETRY | __GFP_HIGHMEM);
+	}
+	if (!kgsl_vbo_zero_page)
+		clear_bit(KGSL_MMU_SUPPORT_VBO, &mmu->features);
+
+	return 0;
+
+err:
+	if (pm_runtime_enabled(&pdev->dev))
+		pm_runtime_disable(&pdev->dev);
+
+	kmem_cache_destroy(addr_entry_cache);
+	addr_entry_cache = NULL;
+
+	return ret;
+}
+
+static const struct kgsl_mmu_ops kgsl_iommu_ops = {
+	.mmu_close = kgsl_iommu_close,
+	.mmu_start = kgsl_iommu_start,
+	.mmu_clear_fsr = kgsl_iommu_clear_fsr,
+	.mmu_get_current_ttbr0 = kgsl_iommu_get_current_ttbr0,
+	.mmu_enable_clk = kgsl_iommu_enable_clk,
+	.mmu_disable_clk = kgsl_iommu_disable_clk,
+	.mmu_set_pf_policy = kgsl_iommu_set_pf_policy,
+	.mmu_pagefault_resume = kgsl_iommu_pagefault_resume,
+	.mmu_getpagetable = kgsl_iommu_getpagetable,
+	.mmu_map_global = kgsl_iommu_map_global,
+	.mmu_send_tlb_hint = kgsl_iommu_send_tlb_hint,
+};
+
+static const struct kgsl_mmu_pt_ops iopgtbl_pt_ops = {
+	.mmu_map = kgsl_iopgtbl_map,
+	.mmu_map_child = kgsl_iopgtbl_map_child,
+	.mmu_map_zero_page_to_range = kgsl_iopgtbl_map_zero_page_to_range,
+	.mmu_unmap = kgsl_iopgtbl_unmap,
+	.mmu_unmap_range = kgsl_iopgtbl_unmap_range,
+	.mmu_destroy_pagetable = kgsl_iommu_destroy_pagetable,
+	.get_ttbr0 = kgsl_iommu_get_ttbr0,
+	.get_context_bank = kgsl_iommu_get_context_bank,
+	.get_asid = kgsl_iommu_get_asid,
+	.get_gpuaddr = kgsl_iommu_get_gpuaddr,
+	.put_gpuaddr = kgsl_iommu_put_gpuaddr,
+	.set_svm_region = kgsl_iommu_set_svm_region,
+	.find_svm_region = kgsl_iommu_find_svm_region,
+	.svm_range = kgsl_iommu_svm_range,
+	.addr_in_range = kgsl_iommu_addr_in_range,
+};
+
+static const struct kgsl_mmu_pt_ops secure_pt_ops = {
+	.mmu_map = kgsl_iommu_secure_map,
+	.mmu_unmap = kgsl_iommu_secure_unmap,
+	.mmu_destroy_pagetable = kgsl_iommu_destroy_pagetable,
+	.get_context_bank = kgsl_iommu_get_context_bank,
+	.get_asid = kgsl_iommu_get_asid,
+	.get_gpuaddr = kgsl_iommu_get_gpuaddr,
+	.put_gpuaddr = kgsl_iommu_put_gpuaddr,
+	.addr_in_range = kgsl_iommu_addr_in_range,
+};
+
+static const struct kgsl_mmu_pt_ops default_pt_ops = {
+	.mmu_map = kgsl_iommu_default_map,
+	.mmu_unmap = kgsl_iommu_default_unmap,
+	.mmu_destroy_pagetable = kgsl_iommu_destroy_default_pagetable,
+	.get_ttbr0 = kgsl_iommu_get_ttbr0,
+	.get_context_bank = kgsl_iommu_get_context_bank,
+	.get_asid = kgsl_iommu_get_asid,
+	.get_gpuaddr = kgsl_iommu_get_gpuaddr,
+	.put_gpuaddr = kgsl_iommu_put_gpuaddr,
+	.addr_in_range = kgsl_iommu_addr_in_range,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_iommu.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_iommu.h
@@ -0,0 +1,202 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_IOMMU_H
+#define __KGSL_IOMMU_H
+
+#include <linux/adreno-smmu-priv.h>
+#include <linux/io-pgtable.h>
+/*
+ * These defines control the address range for allocations that
+ * are mapped into all pagetables.
+ */
+#define KGSL_IOMMU_GLOBAL_MEM_SIZE	(20 * SZ_1M)
+#define KGSL_IOMMU_GLOBAL_MEM_BASE32	0xf8000000
+#define KGSL_IOMMU_GLOBAL_MEM_BASE64	\
+	(KGSL_MEMSTORE_TOKEN_ADDRESS - KGSL_IOMMU_GLOBAL_MEM_SIZE)
+
+/*
+ * This is a dummy token address that we use to identify memstore when the user
+ * wants to map it. mmap() uses a unsigned long for the offset so we need a 32
+ * bit value that works with all sized apps. We chose a value that was purposely
+ * unmapped so if you increase the global memory size make sure it doesn't
+ * conflict
+ */
+
+#define KGSL_MEMSTORE_TOKEN_ADDRESS	(KGSL_IOMMU_SECURE_BASE32 - SZ_4K)
+
+#define KGSL_IOMMU_GLOBAL_MEM_BASE(__mmu)	\
+	(test_bit(KGSL_MMU_64BIT, &(__mmu)->features) ? \
+		KGSL_IOMMU_GLOBAL_MEM_BASE64 : KGSL_IOMMU_GLOBAL_MEM_BASE32)
+
+#define KGSL_IOMMU_SVM_BASE32(__mmu)	\
+	(ADRENO_DEVICE(KGSL_MMU_DEVICE(__mmu))->uche_gmem_base + \
+		ADRENO_DEVICE(KGSL_MMU_DEVICE(__mmu))->gpucore->gmem_size)
+
+#define KGSL_IOMMU_SVM_END32(__mmu) \
+	(test_bit(KGSL_MMU_64BIT, &(__mmu)->features) ? \
+		(test_bit(KGSL_MMU_IOPGTABLE, &(__mmu)->features) ? \
+		 KGSL_MEMSTORE_TOKEN_ADDRESS : \
+		 KGSL_IOMMU_GLOBAL_MEM_BASE64) : \
+	(0xC0000000 - SZ_16M))
+
+/*
+ * Limit secure size to 256MB for 32bit kernels.
+ */
+#define KGSL_IOMMU_SECURE_SIZE32 SZ_256M
+#define KGSL_IOMMU_SECURE_BASE32	\
+	(KGSL_IOMMU_SECURE_BASE64 - KGSL_IOMMU_SECURE_SIZE32)
+#define KGSL_IOMMU_SECURE_END32 KGSL_IOMMU_SECURE_BASE64
+
+#define KGSL_IOMMU_SECURE_BASE64	0x100000000ULL
+#define KGSL_IOMMU_SECURE_END64	\
+	(KGSL_IOMMU_SECURE_BASE64 + KGSL_IOMMU_SECURE_SIZE64)
+
+#define KGSL_IOMMU_MAX_SECURE_SIZE 0xFFFFF000
+
+#define KGSL_IOMMU_SECURE_SIZE64	\
+	(KGSL_IOMMU_MAX_SECURE_SIZE - KGSL_IOMMU_SECURE_SIZE32)
+
+#define KGSL_IOMMU_SECURE_BASE(_mmu) (test_bit(KGSL_MMU_64BIT, \
+			&(_mmu)->features) ? KGSL_IOMMU_SECURE_BASE64 : \
+			KGSL_IOMMU_SECURE_BASE32)
+#define KGSL_IOMMU_SECURE_END(_mmu) (test_bit(KGSL_MMU_64BIT, \
+			&(_mmu)->features) ? KGSL_IOMMU_SECURE_END64 : \
+			KGSL_IOMMU_SECURE_END32)
+#define KGSL_IOMMU_SECURE_SIZE(_mmu) (test_bit(KGSL_MMU_64BIT, \
+			&(_mmu)->features) ? KGSL_IOMMU_MAX_SECURE_SIZE : \
+			KGSL_IOMMU_SECURE_SIZE32)
+
+/* The CPU supports 39 bit addresses */
+#define KGSL_IOMMU_SVM_BASE64		0x1000000000ULL
+#define KGSL_IOMMU_SVM_END64		0x4000000000ULL
+#define KGSL_IOMMU_VA_BASE64		0x4000000000ULL
+#define KGSL_IOMMU_VA_END64		0x8000000000ULL
+
+#define CP_APERTURE_REG			0
+#define CP_SMMU_APERTURE_ID		0x1B
+
+/* Global SMMU register offsets */
+#define KGSL_IOMMU_PRR_CFG_LADDR	0x6008
+#define KGSL_IOMMU_PRR_CFG_UADDR	0x600c
+
+/* Register offsets */
+#define KGSL_IOMMU_CTX_SCTLR		0x0000
+#define KGSL_IOMMU_CTX_ACTLR		0x0004
+#define KGSL_IOMMU_CTX_TTBR0		0x0020
+#define KGSL_IOMMU_CTX_CONTEXTIDR	0x0034
+#define KGSL_IOMMU_CTX_FSR		0x0058
+#define KGSL_IOMMU_CTX_TLBIALL		0x0618
+#define KGSL_IOMMU_CTX_RESUME		0x0008
+#define KGSL_IOMMU_CTX_FSYNR0		0x0068
+#define KGSL_IOMMU_CTX_FSYNR1		0x006c
+#define KGSL_IOMMU_CTX_TLBSYNC		0x07f0
+#define KGSL_IOMMU_CTX_TLBSTATUS	0x07f4
+
+/* TLBSTATUS register fields */
+#define KGSL_IOMMU_CTX_TLBSTATUS_SACTIVE BIT(0)
+
+/* SCTLR fields */
+#define KGSL_IOMMU_SCTLR_HUPCF_SHIFT		8
+#define KGSL_IOMMU_SCTLR_CFCFG_SHIFT		7
+#define KGSL_IOMMU_SCTLR_CFIE_SHIFT		6
+
+#define KGSL_IOMMU_ACTLR_PRR_ENABLE		BIT(5)
+
+/* FSR fields */
+#define KGSL_IOMMU_FSR_SS_SHIFT		30
+
+/* ASID field in TTBR register */
+#define KGSL_IOMMU_ASID_START_BIT	48
+
+/* offset at which a nop command is placed in setstate */
+#define KGSL_IOMMU_SETSTATE_NOP_OFFSET	1024
+
+/*
+ * struct kgsl_iommu_context - Structure holding data about an iommu context
+ * bank
+ * @pdev: pointer to the iommu context's platform device
+ * @name: context name
+ * @id: The id of the context, used for deciding how it is used.
+ * @cb_num: The hardware context bank number, used for calculating register
+ *		offsets.
+ * @kgsldev: The kgsl device that uses this context.
+ * @stalled_on_fault: Flag when set indicates that this iommu device is stalled
+ * on a page fault
+ */
+struct kgsl_iommu_context {
+	struct platform_device *pdev;
+	const char *name;
+	int cb_num;
+	struct kgsl_device *kgsldev;
+	bool stalled_on_fault;
+	/** ratelimit: Ratelimit state for the context */
+	struct ratelimit_state ratelimit;
+	struct iommu_domain *domain;
+	struct adreno_smmu_priv adreno_smmu;
+};
+
+/*
+ * struct kgsl_iommu - Structure holding iommu data for kgsl driver
+ * @regbase: Virtual address of the IOMMU register base
+ * @regstart: Physical address of the iommu registers
+ * @regsize: Length of the iommu register region.
+ * @setstate: Scratch GPU memory for IOMMU operations
+ * @clk_enable_count: The ref count of clock enable calls
+ * @clks: Array of pointers to IOMMU clocks
+ * @smmu_info: smmu info used in a5xx preemption
+ */
+struct kgsl_iommu {
+	/** @user_context: Container for the user iommu context */
+	struct kgsl_iommu_context user_context;
+	/** @secure_context: Container for the secure iommu context */
+	struct kgsl_iommu_context secure_context;
+	/** @lpac_context: Container for the LPAC iommu context */
+	struct kgsl_iommu_context lpac_context;
+	void __iomem *regbase;
+	struct kgsl_memdesc *setstate;
+	atomic_t clk_enable_count;
+	struct clk_bulk_data *clks;
+	int num_clks;
+	struct kgsl_memdesc *smmu_info;
+	/** @pdev: Pointer to the platform device for the IOMMU device */
+	struct platform_device *pdev;
+	/**
+	 * @ppt_active: Set when the first per process pagetable is created.
+	 * This is used to warn when global buffers are created that might not
+	 * be mapped in all contexts
+	 */
+	bool ppt_active;
+	/** @cb0_offset: Offset of context bank 0 from iommu register base */
+	u32 cb0_offset;
+	/** @pagesize: Size of each context bank register space */
+	u32 pagesize;
+	/** @cx_regulator: CX regulator handle in case the IOMMU needs it */
+	struct regulator *cx_regulator;
+};
+
+/*
+ * struct kgsl_iommu_pt - Iommu pagetable structure private to kgsl driver
+ * @domain: Pointer to the iommu domain that contains the iommu pagetable
+ * @ttbr0: register value to set when using this pagetable
+ */
+struct kgsl_iommu_pt {
+	struct kgsl_pagetable base;
+	u64 ttbr0;
+
+	struct io_pgtable_ops *pgtbl_ops;
+	struct io_pgtable_cfg cfg;
+};
+
+/**
+ * kgsl_set_smmu_aperture - set SMMU Aperture for user context
+ * @device: A GPU device handle
+ *
+ * Return: 0 on success or negative on failure.
+ */
+int kgsl_set_smmu_aperture(struct kgsl_device *device,
+		struct kgsl_iommu_context *context);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_mmu.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_mmu.c
@@ -0,0 +1,738 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/component.h>
+#include <linux/of_platform.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+
+#include "kgsl_device.h"
+#include "kgsl_mmu.h"
+#include "kgsl_sharedmem.h"
+
+static void pagetable_remove_sysfs_objects(struct kgsl_pagetable *pagetable);
+
+static void _deferred_destroy(struct work_struct *ws)
+{
+	struct kgsl_pagetable *pagetable = container_of(ws,
+					struct kgsl_pagetable, destroy_ws);
+
+	WARN_ON(!list_empty(&pagetable->list));
+
+	pagetable->pt_ops->mmu_destroy_pagetable(pagetable);
+}
+
+static void kgsl_destroy_pagetable(struct kref *kref)
+{
+	struct kgsl_pagetable *pagetable = container_of(kref,
+		struct kgsl_pagetable, refcount);
+
+	kgsl_mmu_detach_pagetable(pagetable);
+
+	kgsl_schedule_work(&pagetable->destroy_ws);
+}
+
+struct kgsl_pagetable *
+kgsl_get_pagetable(unsigned long name)
+{
+	struct kgsl_pagetable *pt, *ret = NULL;
+	unsigned long flags;
+
+	spin_lock_irqsave(&kgsl_driver.ptlock, flags);
+	list_for_each_entry(pt, &kgsl_driver.pagetable_list, list) {
+		if (name == pt->name && kref_get_unless_zero(&pt->refcount)) {
+			ret = pt;
+			break;
+		}
+	}
+
+	spin_unlock_irqrestore(&kgsl_driver.ptlock, flags);
+	return ret;
+}
+
+static struct kgsl_pagetable *
+_get_pt_from_kobj(struct kobject *kobj)
+{
+	unsigned int ptname;
+
+	if (!kobj)
+		return NULL;
+
+	if (kstrtou32(kobj->name, 0, &ptname))
+		return NULL;
+
+	return kgsl_get_pagetable(ptname);
+}
+
+static ssize_t
+sysfs_show_entries(struct kobject *kobj,
+		   struct kobj_attribute *attr,
+		   char *buf)
+{
+	struct kgsl_pagetable *pt;
+	int ret = 0;
+
+	pt = _get_pt_from_kobj(kobj);
+
+	if (pt) {
+		unsigned int val = atomic_read(&pt->stats.entries);
+
+		ret += scnprintf(buf, PAGE_SIZE, "%d\n", val);
+	}
+
+	kref_put(&pt->refcount, kgsl_destroy_pagetable);
+	return ret;
+}
+
+static ssize_t
+sysfs_show_mapped(struct kobject *kobj,
+		  struct kobj_attribute *attr,
+		  char *buf)
+{
+	struct kgsl_pagetable *pt;
+	int ret = 0;
+
+	pt = _get_pt_from_kobj(kobj);
+
+	if (pt) {
+		uint64_t val = atomic_long_read(&pt->stats.mapped);
+
+		ret += scnprintf(buf, PAGE_SIZE, "%llu\n", val);
+	}
+
+	kref_put(&pt->refcount, kgsl_destroy_pagetable);
+	return ret;
+}
+
+static ssize_t
+sysfs_show_max_mapped(struct kobject *kobj,
+		      struct kobj_attribute *attr,
+		      char *buf)
+{
+	struct kgsl_pagetable *pt;
+	int ret = 0;
+
+	pt = _get_pt_from_kobj(kobj);
+
+	if (pt) {
+		uint64_t val = atomic_long_read(&pt->stats.max_mapped);
+
+		ret += scnprintf(buf, PAGE_SIZE, "%llu\n", val);
+	}
+
+	kref_put(&pt->refcount, kgsl_destroy_pagetable);
+	return ret;
+}
+
+static struct kobj_attribute attr_entries = {
+	.attr = { .name = "entries", .mode = 0444 },
+	.show = sysfs_show_entries,
+	.store = NULL,
+};
+
+static struct kobj_attribute attr_mapped = {
+	.attr = { .name = "mapped", .mode = 0444 },
+	.show = sysfs_show_mapped,
+	.store = NULL,
+};
+
+static struct kobj_attribute attr_max_mapped = {
+	.attr = { .name = "max_mapped", .mode = 0444 },
+	.show = sysfs_show_max_mapped,
+	.store = NULL,
+};
+
+static struct attribute *pagetable_attrs[] = {
+	&attr_entries.attr,
+	&attr_mapped.attr,
+	&attr_max_mapped.attr,
+	NULL,
+};
+
+static struct attribute_group pagetable_attr_group = {
+	.attrs = pagetable_attrs,
+};
+
+static void
+pagetable_remove_sysfs_objects(struct kgsl_pagetable *pagetable)
+{
+	if (pagetable->kobj)
+		sysfs_remove_group(pagetable->kobj,
+				   &pagetable_attr_group);
+
+	kobject_put(pagetable->kobj);
+	pagetable->kobj = NULL;
+}
+
+static int
+pagetable_add_sysfs_objects(struct kgsl_pagetable *pagetable)
+{
+	char ptname[16];
+	int ret = -ENOMEM;
+
+	snprintf(ptname, sizeof(ptname), "%d", pagetable->name);
+	pagetable->kobj = kobject_create_and_add(ptname,
+						 kgsl_driver.ptkobj);
+	if (pagetable->kobj == NULL)
+		goto err;
+
+	ret = sysfs_create_group(pagetable->kobj, &pagetable_attr_group);
+
+err:
+	if (ret) {
+		if (pagetable->kobj)
+			kobject_put(pagetable->kobj);
+
+		pagetable->kobj = NULL;
+	}
+
+	return ret;
+}
+
+#ifdef CONFIG_TRACE_GPU_MEM
+static void kgsl_mmu_trace_gpu_mem_pagetable(struct kgsl_pagetable *pagetable)
+{
+	if (pagetable->name == KGSL_MMU_GLOBAL_PT ||
+			pagetable->name == KGSL_MMU_SECURE_PT)
+		return;
+
+	trace_gpu_mem_total(0, pagetable->name,
+			(u64)atomic_long_read(&pagetable->stats.mapped));
+}
+#else
+static void kgsl_mmu_trace_gpu_mem_pagetable(struct kgsl_pagetable *pagetable)
+{
+}
+#endif
+
+void
+kgsl_mmu_detach_pagetable(struct kgsl_pagetable *pagetable)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&kgsl_driver.ptlock, flags);
+
+	if (!list_empty(&pagetable->list))
+		list_del_init(&pagetable->list);
+
+	spin_unlock_irqrestore(&kgsl_driver.ptlock, flags);
+
+	pagetable_remove_sysfs_objects(pagetable);
+}
+
+unsigned int
+kgsl_mmu_log_fault_addr(struct kgsl_mmu *mmu, u64 pt_base,
+		uint64_t addr)
+{
+	struct kgsl_pagetable *pt;
+	unsigned int ret = 0;
+
+	spin_lock(&kgsl_driver.ptlock);
+	list_for_each_entry(pt, &kgsl_driver.pagetable_list, list) {
+		if (kgsl_mmu_pagetable_get_ttbr0(pt) == MMU_SW_PT_BASE(pt_base)) {
+			if ((addr & ~(PAGE_SIZE-1)) == pt->fault_addr) {
+				ret = 1;
+				break;
+			}
+			pt->fault_addr = (addr & ~(PAGE_SIZE-1));
+			ret = 0;
+			break;
+		}
+	}
+	spin_unlock(&kgsl_driver.ptlock);
+
+	return ret;
+}
+
+int kgsl_mmu_start(struct kgsl_device *device)
+{
+	struct kgsl_mmu *mmu = &device->mmu;
+
+	if (MMU_OP_VALID(mmu, mmu_start))
+		return mmu->mmu_ops->mmu_start(mmu);
+
+	return 0;
+}
+
+void kgsl_mmu_pagetable_init(struct kgsl_mmu *mmu,
+		struct kgsl_pagetable *pagetable, u32 name)
+{
+	kref_init(&pagetable->refcount);
+
+	spin_lock_init(&pagetable->lock);
+	INIT_WORK(&pagetable->destroy_ws, _deferred_destroy);
+
+	pagetable->mmu = mmu;
+	pagetable->name = name;
+
+	atomic_set(&pagetable->stats.entries, 0);
+	atomic_long_set(&pagetable->stats.mapped, 0);
+	atomic_long_set(&pagetable->stats.max_mapped, 0);
+}
+
+void kgsl_mmu_pagetable_add(struct kgsl_mmu *mmu, struct kgsl_pagetable *pagetable)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&kgsl_driver.ptlock, flags);
+	list_add(&pagetable->list, &kgsl_driver.pagetable_list);
+	spin_unlock_irqrestore(&kgsl_driver.ptlock, flags);
+
+	/* Create the sysfs entries */
+	pagetable_add_sysfs_objects(pagetable);
+}
+
+void kgsl_mmu_putpagetable(struct kgsl_pagetable *pagetable)
+{
+	if (!IS_ERR_OR_NULL(pagetable))
+		kref_put(&pagetable->refcount, kgsl_destroy_pagetable);
+}
+
+/**
+ * kgsl_mmu_find_svm_region() - Find a empty spot in the SVM region
+ * @pagetable: KGSL pagetable to search
+ * @start: start of search range, must be within kgsl_mmu_svm_range()
+ * @end: end of search range, must be within kgsl_mmu_svm_range()
+ * @size: Size of the region to find
+ * @align: Desired alignment of the address
+ */
+uint64_t kgsl_mmu_find_svm_region(struct kgsl_pagetable *pagetable,
+		uint64_t start, uint64_t end, uint64_t size,
+		uint64_t align)
+{
+	if (PT_OP_VALID(pagetable, find_svm_region))
+		return pagetable->pt_ops->find_svm_region(pagetable, start,
+			end, size, align);
+	return -ENOMEM;
+}
+
+/**
+ * kgsl_mmu_set_svm_region() - Check if a region is empty and reserve it if so
+ * @pagetable: KGSL pagetable to search
+ * @gpuaddr: GPU address to check/reserve
+ * @size: Size of the region to check/reserve
+ */
+int kgsl_mmu_set_svm_region(struct kgsl_pagetable *pagetable, uint64_t gpuaddr,
+		uint64_t size)
+{
+	if (PT_OP_VALID(pagetable, set_svm_region))
+		return pagetable->pt_ops->set_svm_region(pagetable, gpuaddr,
+			size);
+	return -ENOMEM;
+}
+
+int
+kgsl_mmu_map(struct kgsl_pagetable *pagetable,
+				struct kgsl_memdesc *memdesc)
+{
+	int size;
+	struct kgsl_device *device = KGSL_MMU_DEVICE(pagetable->mmu);
+
+	if (!memdesc->gpuaddr)
+		return -EINVAL;
+	/* Only global mappings should be mapped multiple times */
+	if (!kgsl_memdesc_is_global(memdesc) &&
+			(KGSL_MEMDESC_MAPPED & memdesc->priv))
+		return -EINVAL;
+
+	if (memdesc->flags & KGSL_MEMFLAGS_VBO)
+		return -EINVAL;
+
+	size = kgsl_memdesc_footprint(memdesc);
+
+	if (PT_OP_VALID(pagetable, mmu_map)) {
+		int ret;
+
+		ret = pagetable->pt_ops->mmu_map(pagetable, memdesc);
+		if (ret)
+			return ret;
+
+		atomic_inc(&pagetable->stats.entries);
+		KGSL_STATS_ADD(size, &pagetable->stats.mapped,
+				&pagetable->stats.max_mapped);
+		kgsl_mmu_trace_gpu_mem_pagetable(pagetable);
+
+		if (!kgsl_memdesc_is_global(memdesc)
+				&& !(memdesc->flags & KGSL_MEMFLAGS_USERMEM_ION)) {
+			kgsl_trace_gpu_mem_total(device, size);
+		}
+
+		memdesc->priv |= KGSL_MEMDESC_MAPPED;
+	}
+
+	return 0;
+}
+
+int kgsl_mmu_map_child(struct kgsl_pagetable *pt,
+		struct kgsl_memdesc *memdesc, u64 offset,
+		struct kgsl_memdesc *child, u64 child_offset,
+		u64 length)
+{
+	/* This only makes sense for virtual buffer objects */
+	if (!(memdesc->flags & KGSL_MEMFLAGS_VBO))
+		return -EINVAL;
+
+	if (!memdesc->gpuaddr)
+		return -EINVAL;
+
+	if (PT_OP_VALID(pt, mmu_map_child)) {
+		int ret;
+
+		ret = pt->pt_ops->mmu_map_child(pt, memdesc,
+			offset, child, child_offset, length);
+		if (ret)
+			return ret;
+
+		KGSL_STATS_ADD(length, &pt->stats.mapped,
+				&pt->stats.max_mapped);
+	}
+
+	return 0;
+}
+
+int kgsl_mmu_map_zero_page_to_range(struct kgsl_pagetable *pt,
+		struct kgsl_memdesc *memdesc, u64 start, u64 length)
+{
+	int ret = -EINVAL;
+
+	/* This only makes sense for virtual buffer objects */
+	if (!(memdesc->flags & KGSL_MEMFLAGS_VBO))
+		return -EINVAL;
+
+	if (!memdesc->gpuaddr)
+		return -EINVAL;
+
+	if (PT_OP_VALID(pt, mmu_map_zero_page_to_range)) {
+		ret = pt->pt_ops->mmu_map_zero_page_to_range(pt,
+			memdesc, start, length);
+		if (ret)
+			return ret;
+
+		KGSL_STATS_ADD(length, &pt->stats.mapped,
+				&pt->stats.max_mapped);
+	}
+
+	return 0;
+}
+
+/**
+ * kgsl_mmu_svm_range() - Return the range for SVM (if applicable)
+ * @pagetable: Pagetable to query the range from
+ * @lo: Pointer to store the start of the SVM range
+ * @hi: Pointer to store the end of the SVM range
+ * @memflags: Flags from the buffer we are mapping
+ */
+int kgsl_mmu_svm_range(struct kgsl_pagetable *pagetable,
+		uint64_t *lo, uint64_t *hi, uint64_t memflags)
+{
+	if (PT_OP_VALID(pagetable, svm_range))
+		return pagetable->pt_ops->svm_range(pagetable, lo, hi,
+			memflags);
+
+	return -ENODEV;
+}
+
+int
+kgsl_mmu_unmap(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	int ret = 0;
+	struct kgsl_device *device = KGSL_MMU_DEVICE(pagetable->mmu);
+
+	if (memdesc->size == 0)
+		return -EINVAL;
+
+	if ((memdesc->flags & KGSL_MEMFLAGS_VBO))
+		return -EINVAL;
+
+	/* Only global mappings should be mapped multiple times */
+	if (!(KGSL_MEMDESC_MAPPED & memdesc->priv))
+		return -EINVAL;
+
+	if (PT_OP_VALID(pagetable, mmu_unmap)) {
+		uint64_t size;
+
+		size = kgsl_memdesc_footprint(memdesc);
+
+		ret = pagetable->pt_ops->mmu_unmap(pagetable, memdesc);
+		if (ret)
+			return ret;
+
+		atomic_dec(&pagetable->stats.entries);
+		atomic_long_sub(size, &pagetable->stats.mapped);
+		kgsl_mmu_trace_gpu_mem_pagetable(pagetable);
+
+		if (!kgsl_memdesc_is_global(memdesc)) {
+			memdesc->priv &= ~KGSL_MEMDESC_MAPPED;
+			if (!(memdesc->flags & KGSL_MEMFLAGS_USERMEM_ION))
+				kgsl_trace_gpu_mem_total(device, -(size));
+		}
+	}
+
+	return ret;
+}
+
+int
+kgsl_mmu_unmap_range(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc, u64 offset, u64 length)
+{
+	int ret = 0;
+
+	/* Only allow virtual buffer objects to use this function */
+	if (!(memdesc->flags & KGSL_MEMFLAGS_VBO))
+		return -EINVAL;
+
+	if (PT_OP_VALID(pagetable, mmu_unmap_range)) {
+		ret = pagetable->pt_ops->mmu_unmap_range(pagetable, memdesc,
+			offset, length);
+
+		if (!ret)
+			atomic_long_sub(length, &pagetable->stats.mapped);
+	}
+
+	return ret;
+}
+
+void kgsl_mmu_map_global(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u32 padding)
+{
+	struct kgsl_mmu *mmu = &(device->mmu);
+
+	if (MMU_OP_VALID(mmu, mmu_map_global))
+		mmu->mmu_ops->mmu_map_global(mmu, memdesc, padding);
+}
+
+int kgsl_mmu_pagetable_get_context_bank(struct kgsl_pagetable *pagetable,
+	struct kgsl_context *context)
+{
+	if (PT_OP_VALID(pagetable, get_context_bank))
+		return pagetable->pt_ops->get_context_bank(pagetable, context);
+
+	return -ENOENT;
+}
+
+int kgsl_mmu_pagetable_get_asid(struct kgsl_pagetable *pagetable,
+		struct kgsl_context *context)
+{
+	if (PT_OP_VALID(pagetable, get_asid))
+		return pagetable->pt_ops->get_asid(pagetable, context);
+
+	return -ENOENT;
+}
+
+enum kgsl_mmutype kgsl_mmu_get_mmutype(struct kgsl_device *device)
+{
+	return device ? device->mmu.type : KGSL_MMU_TYPE_NONE;
+}
+
+bool kgsl_mmu_gpuaddr_in_range(struct kgsl_pagetable *pagetable,
+		uint64_t gpuaddr, uint64_t size)
+{
+	if (PT_OP_VALID(pagetable, addr_in_range))
+		return pagetable->pt_ops->addr_in_range(pagetable, gpuaddr, size);
+
+	return false;
+}
+
+/*
+ * NOMMU definitions - NOMMU really just means that the MMU is kept in pass
+ * through and the GPU directly accesses physical memory. Used in debug mode
+ * and when a real MMU isn't up and running yet.
+ */
+
+static bool nommu_gpuaddr_in_range(struct kgsl_pagetable *pagetable,
+		uint64_t gpuaddr, uint64_t size)
+{
+	return (gpuaddr != 0) ? true : false;
+}
+
+static int nommu_get_gpuaddr(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	if (WARN_ONCE(memdesc->sgt->nents > 1,
+		"Attempt to map non-contiguous memory with NOMMU\n"))
+		return -EINVAL;
+
+	memdesc->gpuaddr = (uint64_t) sg_phys(memdesc->sgt->sgl);
+
+	if (memdesc->gpuaddr) {
+		memdesc->pagetable = pagetable;
+		return 0;
+	}
+
+	return -ENOMEM;
+}
+
+static void nommu_destroy_pagetable(struct kgsl_pagetable *pt)
+{
+	kfree(pt);
+}
+
+static const struct kgsl_mmu_pt_ops nommu_pt_ops = {
+	.get_gpuaddr = nommu_get_gpuaddr,
+	.addr_in_range = nommu_gpuaddr_in_range,
+	.mmu_destroy_pagetable = nommu_destroy_pagetable,
+};
+
+static struct kgsl_pagetable *nommu_getpagetable(struct kgsl_mmu *mmu,
+		unsigned long name)
+{
+	struct kgsl_device *device = KGSL_MMU_DEVICE(mmu);
+	struct kgsl_pagetable *pagetable;
+	struct kgsl_global_memdesc *md;
+
+	pagetable = kgsl_get_pagetable(KGSL_MMU_GLOBAL_PT);
+
+	if (pagetable == NULL) {
+		pagetable = kzalloc(sizeof(*pagetable), GFP_KERNEL);
+		if (!pagetable)
+			return ERR_PTR(-ENOMEM);
+
+		kgsl_mmu_pagetable_init(mmu, pagetable, KGSL_MMU_GLOBAL_PT);
+		pagetable->pt_ops = &nommu_pt_ops;
+
+		list_for_each_entry(md, &device->globals, node)
+			md->memdesc.gpuaddr =
+				(uint64_t) sg_phys(md->memdesc.sgt->sgl);
+
+		kgsl_mmu_pagetable_add(mmu, pagetable);
+	}
+
+	return pagetable;
+}
+
+static struct kgsl_mmu_ops kgsl_nommu_ops = {
+	.mmu_getpagetable = nommu_getpagetable,
+};
+
+ssize_t kgsl_mmu_map_sg(struct iommu_domain *domain,
+				unsigned long iova, struct scatterlist *sg,
+				unsigned int nents, int prot)
+{
+#if (KERNEL_VERSION(6, 2, 0) <= LINUX_VERSION_CODE)
+	return iommu_map_sg(domain, iova, sg, nents, prot, GFP_KERNEL);
+#else
+	return iommu_map_sg(domain, iova, sg, nents, prot);
+#endif
+}
+
+static int kgsl_mmu_cb_bind(struct device *dev, struct device *master, void *data)
+{
+	return 0;
+}
+
+static void kgsl_mmu_cb_unbind(struct device *dev, struct device *master,
+		void *data)
+{
+}
+
+static int kgsl_mmu_bind(struct device *dev, struct device *master, void *data)
+{
+	struct kgsl_device *device = dev_get_drvdata(master);
+	struct kgsl_mmu *mmu = &device->mmu;
+	int ret;
+
+	/*
+	 * Try to bind the IOMMU and if it doesn't exist for some reason
+	 * go for the NOMMU option instead
+	 */
+	ret = kgsl_iommu_bind(device, to_platform_device(dev));
+
+	if (!ret || ret == -EPROBE_DEFER)
+		return ret;
+
+	mmu->mmu_ops = &kgsl_nommu_ops;
+	mmu->type = KGSL_MMU_TYPE_NONE;
+	return 0;
+}
+
+static void kgsl_mmu_unbind(struct device *dev, struct device *master,
+		void *data)
+{
+	struct kgsl_device *device = dev_get_drvdata(master);
+	struct kgsl_mmu *mmu = &device->mmu;
+
+	if (MMU_OP_VALID(mmu, mmu_close))
+		mmu->mmu_ops->mmu_close(mmu);
+}
+
+static const struct component_ops kgsl_mmu_cb_component_ops = {
+	.bind = kgsl_mmu_cb_bind,
+	.unbind = kgsl_mmu_cb_unbind,
+};
+
+static const struct component_ops kgsl_mmu_component_ops = {
+	.bind = kgsl_mmu_bind,
+	.unbind = kgsl_mmu_unbind,
+};
+
+static int kgsl_mmu_dev_probe(struct platform_device *pdev)
+{
+	/*
+	 * Add kgsl-smmu and context bank as a component device to establish
+	 * correct probe order with smmu driver.
+	 *
+	 * As context bank node in DT contains "iommus" property. fw_devlink
+	 * ensures that context bank is probed only after corresponding
+	 * supplier (smmu driver) probe is done.
+	 *
+	 * Adding context bank as a component device ensures master bind
+	 * (adreno_bind) is called only once component (kgsl-smmu and context
+	 * banks) probe is done thus ensuring correct probe order with smmu
+	 * driver.
+	 *
+	 * kgsl-smmu also need to be a component because we need kgsl-smmu
+	 * device info in order to initialize the context banks.
+	 */
+	if (of_device_is_compatible(pdev->dev.of_node,
+				"qcom,smmu-kgsl-cb")) {
+		return component_add(&pdev->dev, &kgsl_mmu_cb_component_ops);
+	}
+
+	/* Fill out the rest of the devices in the node */
+	of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
+
+	return component_add(&pdev->dev, &kgsl_mmu_component_ops);
+}
+
+static int kgsl_mmu_dev_remove(struct platform_device *pdev)
+{
+	if (of_device_is_compatible(pdev->dev.of_node,
+				"qcom,smmu-kgsl-cb")) {
+		component_del(&pdev->dev, &kgsl_mmu_cb_component_ops);
+		return 0;
+	}
+
+	component_del(&pdev->dev, &kgsl_mmu_component_ops);
+
+	of_platform_depopulate(&pdev->dev);
+	return 0;
+}
+
+static const struct of_device_id mmu_match_table[] = {
+	{ .compatible = "qcom,kgsl-smmu-v2" },
+	{ .compatible = "qcom,smmu-kgsl-cb" },
+	{},
+};
+
+static struct platform_driver kgsl_mmu_driver = {
+	.probe = kgsl_mmu_dev_probe,
+	.remove = kgsl_mmu_dev_remove,
+	.driver = {
+		.name = "kgsl-iommu",
+		.of_match_table = mmu_match_table,
+	}
+};
+
+int __init kgsl_mmu_init(void)
+{
+	return platform_driver_register(&kgsl_mmu_driver);
+}
+
+void kgsl_mmu_exit(void)
+{
+	platform_driver_unregister(&kgsl_mmu_driver);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_mmu.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_mmu.h
@@ -0,0 +1,433 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_MMU_H
+#define __KGSL_MMU_H
+
+#include <linux/platform_device.h>
+
+/* Identifier for the global page table */
+/*
+ * Per process page tables will probably pass in the thread group
+ *  as an identifier
+ */
+#define KGSL_MMU_GLOBAL_PT 0
+#define KGSL_MMU_SECURE_PT 1
+
+#define MMU_DEFAULT_TTBR0(_d) \
+	(kgsl_mmu_pagetable_get_ttbr0((_d)->mmu.defaultpagetable))
+
+/* Mask ASID fields to match 48bit ptbase address*/
+#define MMU_SW_PT_BASE(_ttbr0) \
+	(_ttbr0 & (BIT_ULL(KGSL_IOMMU_ASID_START_BIT) - 1))
+
+#define KGSL_MMU_DEVICE(_mmu) \
+	container_of((_mmu), struct kgsl_device, mmu)
+
+/**
+ * enum kgsl_ft_pagefault_policy_bits - KGSL pagefault policy bits
+ * @KGSL_FT_PAGEFAULT_INT_ENABLE: No longer used, but retained for compatibility
+ * @KGSL_FT_PAGEFAULT_GPUHALT_ENABLE: enable GPU halt on pagefaults
+ * @KGSL_FT_PAGEFAULT_LOG_ONE_PER_PAGE: log one pagefault per page
+ * @KGSL_FT_PAGEFAULT_LOG_ONE_PER_INT: log one pagefault per interrupt
+ */
+enum {
+	KGSL_FT_PAGEFAULT_INT_ENABLE = 0,
+	KGSL_FT_PAGEFAULT_GPUHALT_ENABLE = 1,
+	KGSL_FT_PAGEFAULT_LOG_ONE_PER_PAGE = 2,
+	KGSL_FT_PAGEFAULT_LOG_ONE_PER_INT = 3,
+	/* KGSL_FT_PAGEFAULT_MAX_BITS is used to calculate the mask */
+	KGSL_FT_PAGEFAULT_MAX_BITS,
+};
+
+#define KGSL_FT_PAGEFAULT_MASK GENMASK(KGSL_FT_PAGEFAULT_MAX_BITS - 1, 0)
+
+#define KGSL_FT_PAGEFAULT_DEFAULT_POLICY 0
+
+struct kgsl_device;
+
+enum kgsl_mmutype {
+	KGSL_MMU_TYPE_IOMMU = 0,
+	KGSL_MMU_TYPE_NONE
+};
+
+#define KGSL_IOMMU_SMMU_V500 1
+
+struct kgsl_pagetable {
+	spinlock_t lock;
+	struct kref refcount;
+	struct list_head list;
+	unsigned int name;
+	struct kobject *kobj;
+	struct work_struct destroy_ws;
+
+	struct {
+		atomic_t entries;
+		atomic_long_t mapped;
+		atomic_long_t max_mapped;
+	} stats;
+	const struct kgsl_mmu_pt_ops *pt_ops;
+	uint64_t fault_addr;
+	struct kgsl_mmu *mmu;
+	/** @rbtree: all buffers mapped into the pagetable, indexed by gpuaddr */
+	struct rb_root rbtree;
+	/** @va_start: Start of virtual range used in this pagetable */
+	u64 va_start;
+	/** @va_end: End of virtual range */
+	u64 va_end;
+	/**
+	 * @svm_start: Start of shared virtual memory range. Addresses in this
+	 * range are also valid in the process's CPU address space.
+	 */
+	u64 svm_start;
+	/** @svm_end: end of 32 bit compatible range */
+	u64 svm_end;
+	/**
+	 * @compat_va_start - Start of the "compat" virtual address range for
+	 * forced 32 bit allocations
+	 */
+	u64 compat_va_start;
+	/**
+	 * @compat_va_end - End of the "compat" virtual address range for
+	 * forced 32 bit allocations
+	 */
+	u64 compat_va_end;
+	/** @va_hint: Virtual address hint for 64-bit non-SVM allocations */
+	u64 va_hint;
+	u64 global_base;
+};
+
+struct kgsl_mmu;
+
+struct kgsl_mmu_ops {
+	void (*mmu_close)(struct kgsl_mmu *mmu);
+	int (*mmu_start)(struct kgsl_mmu *mmu);
+	uint64_t (*mmu_get_current_ttbr0)(struct kgsl_mmu *mmu, struct kgsl_context *context);
+	void (*mmu_pagefault_resume)(struct kgsl_mmu *mmu, bool terminate);
+	void (*mmu_clear_fsr)(struct kgsl_mmu *mmu);
+	void (*mmu_enable_clk)(struct kgsl_mmu *mmu);
+	void (*mmu_disable_clk)(struct kgsl_mmu *mmu);
+	int (*mmu_set_pf_policy)(struct kgsl_mmu *mmu, unsigned long pf_policy);
+	int (*mmu_init_pt)(struct kgsl_mmu *mmu, struct kgsl_pagetable *pt);
+	struct kgsl_pagetable * (*mmu_getpagetable)(struct kgsl_mmu *mmu,
+			unsigned long name);
+	void (*mmu_map_global)(struct kgsl_mmu *mmu,
+		struct kgsl_memdesc *memdesc, u32 padding);
+	void (*mmu_send_tlb_hint)(struct kgsl_mmu *mmu, bool hint);
+};
+
+struct kgsl_mmu_pt_ops {
+	int (*mmu_map)(struct kgsl_pagetable *pt,
+			struct kgsl_memdesc *memdesc);
+	int (*mmu_map_child)(struct kgsl_pagetable *pt,
+		struct kgsl_memdesc *memdesc, u64 offset,
+		struct kgsl_memdesc *child, u64 child_offset,
+		u64 length);
+	int (*mmu_map_zero_page_to_range)(struct kgsl_pagetable *pt,
+		struct kgsl_memdesc *memdesc, u64 start, u64 length);
+	int (*mmu_unmap)(struct kgsl_pagetable *pt,
+			struct kgsl_memdesc *memdesc);
+	int (*mmu_unmap_range)(struct kgsl_pagetable *pt,
+			struct kgsl_memdesc *memdesc, u64 offset, u64 length);
+	void (*mmu_destroy_pagetable)(struct kgsl_pagetable *pt);
+	u64 (*get_ttbr0)(struct kgsl_pagetable *pt);
+	int (*get_context_bank)(struct kgsl_pagetable *pt, struct kgsl_context *context);
+	int (*get_asid)(struct kgsl_pagetable *pt, struct kgsl_context *context);
+	int (*get_gpuaddr)(struct kgsl_pagetable *pt,
+				struct kgsl_memdesc *memdesc);
+	void (*put_gpuaddr)(struct kgsl_memdesc *memdesc);
+	uint64_t (*find_svm_region)(struct kgsl_pagetable *pt, uint64_t start,
+		uint64_t end, uint64_t size, uint64_t align);
+	int (*set_svm_region)(struct kgsl_pagetable *pt,
+				uint64_t gpuaddr, uint64_t size);
+	int (*svm_range)(struct kgsl_pagetable *pt, uint64_t *lo, uint64_t *hi,
+			uint64_t memflags);
+	bool (*addr_in_range)(struct kgsl_pagetable *pagetable,
+			uint64_t gpuaddr, uint64_t size);
+};
+
+enum kgsl_mmu_feature {
+	/* @KGSL_MMU_64BIT: Use 64 bit virtual address space */
+	KGSL_MMU_64BIT,
+	/* @KGSL_MMU_PAGED: Support paged memory */
+	KGSL_MMU_PAGED,
+	/*
+	 * @KGSL_MMU_NEED_GUARD_PAGE: Set if a guard page is needed for each
+	 * mapped region
+	 */
+	KGSL_MMU_NEED_GUARD_PAGE,
+	/** @KGSL_MMU_IO_COHERENT: Set if a device supports I/O coherency */
+	KGSL_MMU_IO_COHERENT,
+	/** @KGSL_MMU_LLC_ENABLE: Set if LLC is activated for the target */
+	KGSL_MMU_LLCC_ENABLE,
+	/** @KGSL_MMU_SMMU_APERTURE: Set the SMMU aperture */
+	KGSL_MMU_SMMU_APERTURE,
+	/**
+	 * @KGSL_MMU_IOPGTABLE: Set if the qcom,adreno-smmu implementation is
+	 * available. Implies split address space and per-process pagetables
+	 */
+	KGSL_MMU_IOPGTABLE,
+	/** @KGSL_MMU_SUPPORT_VBO: Non-secure VBOs are supported */
+	KGSL_MMU_SUPPORT_VBO,
+	/** @KGSL_MMU_PAGEFAULT_TERMINATE: Set to make pagefaults fatal */
+	KGSL_MMU_PAGEFAULT_TERMINATE,
+};
+
+#include "kgsl_iommu.h"
+
+/**
+ * struct kgsl_mmu - Master definition for KGSL MMU devices
+ * @flags: MMU device flags
+ * @type: Type of MMU that is attached
+ * @subtype: Sub Type of MMU that is attached
+ * @defaultpagetable: Default pagetable object for the MMU
+ * @securepagetable: Default secure pagetable object for the MMU
+ * @mmu_ops: Function pointers for the MMU sub-type
+ * @secured: True if the MMU needs to be secured
+ * @feature: Static list of MMU features
+ */
+struct kgsl_mmu {
+	unsigned long flags;
+	enum kgsl_mmutype type;
+	u32 subtype;
+	struct kgsl_pagetable *defaultpagetable;
+	struct kgsl_pagetable *securepagetable;
+	const struct kgsl_mmu_ops *mmu_ops;
+	bool secured;
+	unsigned long features;
+	/** @pfpolicy: The current pagefault policy for the device */
+	unsigned long pfpolicy;
+	/** mmu: Pointer to the IOMMU sub-device */
+	struct kgsl_iommu iommu;
+};
+
+#define KGSL_IOMMU(d) (&((d)->mmu.iommu))
+
+int __init kgsl_mmu_init(void);
+void kgsl_mmu_exit(void);
+
+int kgsl_mmu_start(struct kgsl_device *device);
+
+void kgsl_mmu_putpagetable(struct kgsl_pagetable *pagetable);
+
+int kgsl_mmu_map(struct kgsl_pagetable *pagetable,
+		 struct kgsl_memdesc *memdesc);
+int kgsl_mmu_map_child(struct kgsl_pagetable *pt,
+		struct kgsl_memdesc *memdesc, u64 offset,
+		struct kgsl_memdesc *child, u64 child_offset,
+		u64 length);
+int kgsl_mmu_map_zero_page_to_range(struct kgsl_pagetable *pt,
+		struct kgsl_memdesc *memdesc, u64 start, u64 length);
+int kgsl_mmu_unmap(struct kgsl_pagetable *pagetable,
+		    struct kgsl_memdesc *memdesc);
+int kgsl_mmu_unmap_range(struct kgsl_pagetable *pt,
+		struct kgsl_memdesc *memdesc, u64 offset, u64 length);
+unsigned int kgsl_mmu_log_fault_addr(struct kgsl_mmu *mmu,
+		u64 ttbr0, uint64_t addr);
+bool kgsl_mmu_gpuaddr_in_range(struct kgsl_pagetable *pt, uint64_t gpuaddr,
+		uint64_t size);
+
+uint64_t kgsl_mmu_find_svm_region(struct kgsl_pagetable *pagetable,
+		uint64_t start, uint64_t end, uint64_t size,
+		uint64_t alignment);
+
+int kgsl_mmu_set_svm_region(struct kgsl_pagetable *pagetable, uint64_t gpuaddr,
+		uint64_t size);
+
+void kgsl_mmu_detach_pagetable(struct kgsl_pagetable *pagetable);
+
+int kgsl_mmu_svm_range(struct kgsl_pagetable *pagetable,
+		uint64_t *lo, uint64_t *hi, uint64_t memflags);
+
+struct kgsl_pagetable *kgsl_get_pagetable(unsigned long name);
+
+/*
+ * Static inline functions of MMU that simply call the SMMU specific
+ * function using a function pointer. These functions can be thought
+ * of as wrappers around the actual function
+ */
+
+#define MMU_OP_VALID(_mmu, _field) \
+	(((_mmu) != NULL) && \
+	 ((_mmu)->mmu_ops != NULL) && \
+	 ((_mmu)->mmu_ops->_field != NULL))
+
+#define PT_OP_VALID(_pt, _field) \
+	(((_pt) != NULL) && \
+	 ((_pt)->pt_ops != NULL) && \
+	 ((_pt)->pt_ops->_field != NULL))
+
+/**
+ * kgsl_mmu_get_gpuaddr - Assign a GPU address to the memdesc
+ * @pagetable: GPU pagetable to assign the address in
+ * @memdesc: mem descriptor to assign the memory to
+ *
+ * Return: 0 on success or negative on failure
+ */
+static inline int kgsl_mmu_get_gpuaddr(struct kgsl_pagetable *pagetable,
+		 struct kgsl_memdesc *memdesc)
+{
+	if (PT_OP_VALID(pagetable, get_gpuaddr))
+		return pagetable->pt_ops->get_gpuaddr(pagetable, memdesc);
+
+	return -ENOMEM;
+}
+
+/**
+ * kgsl_mmu_put_gpuaddr - Remove a GPU address from a pagetable
+ * @pagetable: Pagetable to release the memory from
+ * @memdesc: Memory descriptor containing the GPU address to free
+ *
+ * Release a GPU address in the MMU virtual address space.
+ */
+static inline void kgsl_mmu_put_gpuaddr(struct kgsl_pagetable *pagetable,
+		struct kgsl_memdesc *memdesc)
+{
+	if (PT_OP_VALID(pagetable, put_gpuaddr))
+		pagetable->pt_ops->put_gpuaddr(memdesc);
+}
+
+static inline u64 kgsl_mmu_get_current_ttbr0(struct kgsl_mmu *mmu, struct kgsl_context *context)
+{
+	if (MMU_OP_VALID(mmu, mmu_get_current_ttbr0))
+		return mmu->mmu_ops->mmu_get_current_ttbr0(mmu, context);
+
+	return 0;
+}
+
+static inline struct kgsl_pagetable *kgsl_mmu_getpagetable(struct kgsl_mmu *mmu,
+		unsigned long name)
+{
+	if (MMU_OP_VALID(mmu, mmu_getpagetable))
+		return mmu->mmu_ops->mmu_getpagetable(mmu, name);
+
+	return NULL;
+}
+
+static inline void kgsl_mmu_enable_clk(struct kgsl_mmu *mmu)
+{
+	if (MMU_OP_VALID(mmu, mmu_enable_clk))
+		mmu->mmu_ops->mmu_enable_clk(mmu);
+}
+
+static inline void kgsl_mmu_disable_clk(struct kgsl_mmu *mmu)
+{
+	if (MMU_OP_VALID(mmu, mmu_disable_clk))
+		mmu->mmu_ops->mmu_disable_clk(mmu);
+}
+
+static inline int kgsl_mmu_set_pagefault_policy(struct kgsl_mmu *mmu,
+						unsigned long pf_policy)
+{
+	if (MMU_OP_VALID(mmu, mmu_set_pf_policy))
+		return mmu->mmu_ops->mmu_set_pf_policy(mmu, pf_policy);
+
+	return 0;
+}
+
+static inline void kgsl_mmu_pagefault_resume(struct kgsl_mmu *mmu,
+	bool terminate)
+{
+	if (MMU_OP_VALID(mmu, mmu_pagefault_resume))
+		return mmu->mmu_ops->mmu_pagefault_resume(mmu, terminate);
+}
+
+static inline void kgsl_mmu_clear_fsr(struct kgsl_mmu *mmu)
+{
+	if (MMU_OP_VALID(mmu, mmu_clear_fsr))
+		return mmu->mmu_ops->mmu_clear_fsr(mmu);
+}
+
+static inline bool kgsl_mmu_is_perprocess(struct kgsl_mmu *mmu)
+{
+	return test_bit(KGSL_MMU_IOPGTABLE, &mmu->features);
+}
+
+static inline bool kgsl_mmu_is_secured(struct kgsl_mmu *mmu)
+{
+	return mmu && (mmu->secured) && (!IS_ERR_OR_NULL(mmu->securepagetable));
+}
+
+static inline u64
+kgsl_mmu_pagetable_get_ttbr0(struct kgsl_pagetable *pagetable)
+{
+	if (PT_OP_VALID(pagetable, get_ttbr0))
+		return pagetable->pt_ops->get_ttbr0(pagetable);
+
+	return 0;
+}
+
+static inline void kgsl_mmu_send_tlb_hint(struct kgsl_mmu *mmu, bool hint)
+{
+	if (MMU_OP_VALID(mmu, mmu_send_tlb_hint))
+		return mmu->mmu_ops->mmu_send_tlb_hint(mmu, hint);
+}
+
+/**
+ * kgsl_mmu_map_global - Map a memdesc as a global buffer
+ * @device: A KGSL GPU device handle
+ * @memdesc: Pointer to a GPU memory descriptor
+ * @padding: Any padding to add to the end of the VA allotment (in bytes)
+ *
+ * Map a buffer as globally accessible in all pagetable contexts
+ */
+void kgsl_mmu_map_global(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u32 padding);
+
+/**
+ * kgsl_mmu_pagetable_get_context_bank - Return the context bank number
+ * @pagetable: A handle to a given pagetable
+ * @context : LPAC or User context
+ *
+ * This function will find the context number of the given pagetable
+
+ * Return: The context bank number the pagetable is attached to or
+ * negative error on failure.
+ */
+int kgsl_mmu_pagetable_get_context_bank(struct kgsl_pagetable *pagetable,
+			struct kgsl_context *context);
+
+
+/**
+ * kgsl_mmu_pagetable_get_asid - Return the ASID number
+ * @pagetable: A handle to a given pagetable
+ * @context: LPAC or GC context
+ *
+ * This function will find the ASID number of the given pagetable
+
+ * Return: The ASID number the pagetable is attached to or
+ * negative error on failure.
+ */
+int kgsl_mmu_pagetable_get_asid(struct kgsl_pagetable *pagetable,
+					struct kgsl_context *context);
+
+void kgsl_mmu_pagetable_init(struct kgsl_mmu *mmu,
+		struct kgsl_pagetable *pagetable, u32 name);
+
+void kgsl_mmu_pagetable_add(struct kgsl_mmu *mmu, struct kgsl_pagetable *pagetable);
+
+#if IS_ENABLED(CONFIG_ARM_SMMU)
+int kgsl_iommu_bind(struct kgsl_device *device, struct platform_device *pdev);
+#else
+static inline int kgsl_iommu_bind(struct kgsl_device *device, struct platform_device *pdev)
+{
+	return -ENODEV;
+}
+#endif
+
+/**
+ * kgsl_mmu_map_sg - Map the given buffer to the IOMMU domain
+ * @domain: The IOMMU domain to perform the mapping
+ * @iova: The start address to map the buffer
+ * @sgt: The sg_table object describing the buffer
+ * @prot: IOMMU protection bits
+ *
+ * Creates a mapping at @iova for the buffer described by a scatterlist
+ * stored in the given sg_table object in the provided IOMMU domain.
+ */
+ssize_t kgsl_mmu_map_sg(struct iommu_domain *domain,
+				unsigned long iova, struct scatterlist *sg,
+				unsigned int nents, int prot);
+#endif /* __KGSL_MMU_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_pool.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_pool.c
@@ -0,0 +1,793 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <asm/cacheflush.h>
+#include <linux/debugfs.h>
+#include <linux/highmem.h>
+#include <linux/mempool.h>
+#include <linux/of.h>
+#include <linux/scatterlist.h>
+#include <linux/version.h>
+
+#include "kgsl_debugfs.h"
+#include "kgsl_device.h"
+#include "kgsl_pool.h"
+#include "kgsl_sharedmem.h"
+#include "kgsl_trace.h"
+
+#ifdef CONFIG_QCOM_KGSL_SORT_POOL
+
+struct kgsl_pool_page_entry {
+	phys_addr_t physaddr;
+	struct page *page;
+	struct rb_node node;
+};
+
+static struct kmem_cache *addr_page_cache;
+
+/**
+ * struct kgsl_page_pool - Structure to hold information for the pool
+ * @pool_order: Page order describing the size of the page
+ * @page_count: Number of pages currently present in the pool
+ * @reserved_pages: Number of pages reserved at init for the pool
+ * @list_lock: Spinlock for page list in the pool
+ * @pool_rbtree: RB tree with all pages held/reserved in this pool
+ * @mempool: Mempool to pre-allocate tracking structs for pages in this pool
+ * @debug_root: Pointer to the debugfs root for this pool
+ * @max_pages: Limit on number of pages this pool can hold
+ */
+struct kgsl_page_pool {
+	unsigned int pool_order;
+	unsigned int page_count;
+	unsigned int reserved_pages;
+	spinlock_t list_lock;
+	struct rb_root pool_rbtree;
+	mempool_t *mempool;
+	struct dentry *debug_root;
+	unsigned int max_pages;
+};
+
+static void *_pool_entry_alloc(gfp_t gfp_mask, void *arg)
+{
+	return kmem_cache_alloc(addr_page_cache, gfp_mask);
+}
+
+static void _pool_entry_free(void *element, void *arg)
+{
+	return kmem_cache_free(addr_page_cache, element);
+}
+
+static int
+__kgsl_pool_add_page(struct kgsl_page_pool *pool, struct page *p)
+{
+	struct rb_node **node, *parent = NULL;
+	struct kgsl_pool_page_entry *new_page, *entry;
+	gfp_t gfp_mask = GFP_KERNEL & ~__GFP_DIRECT_RECLAIM;
+
+	new_page = pool->mempool ? mempool_alloc(pool->mempool, gfp_mask) :
+			kmem_cache_alloc(addr_page_cache, gfp_mask);
+	if (new_page == NULL)
+		return -ENOMEM;
+
+	spin_lock(&pool->list_lock);
+	node = &pool->pool_rbtree.rb_node;
+	new_page->physaddr = page_to_phys(p);
+	new_page->page = p;
+
+	while (*node != NULL) {
+		parent = *node;
+		entry = rb_entry(parent, struct kgsl_pool_page_entry, node);
+
+		if (new_page->physaddr < entry->physaddr)
+			node = &parent->rb_left;
+		else
+			node = &parent->rb_right;
+	}
+
+	rb_link_node(&new_page->node, parent, node);
+	rb_insert_color(&new_page->node, &pool->pool_rbtree);
+
+	/*
+	 * page_count may be read without the list_lock held. Use WRITE_ONCE
+	 * to avoid compiler optimizations that may break consistency.
+	 */
+	ASSERT_EXCLUSIVE_WRITER(pool->page_count);
+	WRITE_ONCE(pool->page_count, pool->page_count + 1);
+	spin_unlock(&pool->list_lock);
+
+	return 0;
+}
+
+static struct page *
+__kgsl_pool_get_page(struct kgsl_page_pool *pool)
+{
+	struct rb_node *node;
+	struct kgsl_pool_page_entry *entry;
+	struct page *p;
+
+	node = rb_first(&pool->pool_rbtree);
+	if (!node)
+		return NULL;
+
+	entry = rb_entry(node, struct kgsl_pool_page_entry, node);
+	p = entry->page;
+	rb_erase(&entry->node, &pool->pool_rbtree);
+	if (pool->mempool)
+		mempool_free(entry, pool->mempool);
+	else
+		kmem_cache_free(addr_page_cache, entry);
+
+	/*
+	 * page_count may be read without the list_lock held. Use WRITE_ONCE
+	 * to avoid compiler optimizations that may break consistency.
+	 */
+	ASSERT_EXCLUSIVE_WRITER(pool->page_count);
+	WRITE_ONCE(pool->page_count, pool->page_count - 1);
+	return p;
+}
+
+static void kgsl_pool_list_init(struct kgsl_page_pool *pool)
+{
+	pool->pool_rbtree = RB_ROOT;
+}
+
+static void kgsl_pool_cache_init(void)
+{
+	addr_page_cache =  KMEM_CACHE(kgsl_pool_page_entry, 0);
+}
+
+static void kgsl_pool_cache_destroy(void)
+{
+	kmem_cache_destroy(addr_page_cache);
+}
+
+static void kgsl_destroy_page_pool(struct kgsl_page_pool *pool)
+{
+	mempool_destroy(pool->mempool);
+}
+
+#else
+/**
+ * struct kgsl_page_pool - Structure to hold information for the pool
+ * @pool_order: Page order describing the size of the page
+ * @page_count: Number of pages currently present in the pool
+ * @reserved_pages: Number of pages reserved at init for the pool
+ * @list_lock: Spinlock for page list in the pool
+ * @page_list: List of pages held/reserved in this pool
+ * @debug_root: Pointer to the debugfs root for this pool
+ * @max_pages: Limit on number of pages this pool can hold
+ */
+struct kgsl_page_pool {
+	unsigned int pool_order;
+	unsigned int page_count;
+	unsigned int reserved_pages;
+	spinlock_t list_lock;
+	struct list_head page_list;
+	struct dentry *debug_root;
+	unsigned int max_pages;
+};
+
+static int
+__kgsl_pool_add_page(struct kgsl_page_pool *pool, struct page *p)
+{
+	spin_lock(&pool->list_lock);
+	list_add_tail(&p->lru, &pool->page_list);
+
+	/*
+	 * page_count may be read without the list_lock held. Use WRITE_ONCE
+	 * to avoid compiler optimizations that may break consistency.
+	 */
+	ASSERT_EXCLUSIVE_WRITER(pool->page_count);
+	WRITE_ONCE(pool->page_count, pool->page_count + 1);
+	spin_unlock(&pool->list_lock);
+
+	return 0;
+}
+
+static struct page *
+__kgsl_pool_get_page(struct kgsl_page_pool *pool)
+{
+	struct page *p;
+
+	p = list_first_entry_or_null(&pool->page_list, struct page, lru);
+	if (p) {
+		/*
+		 * page_count may be read without the list_lock held. Use
+		 * WRITE_ONCE to avoid compiler optimizations that may break
+		 * consistency.
+		 */
+		ASSERT_EXCLUSIVE_WRITER(pool->page_count);
+		WRITE_ONCE(pool->page_count, pool->page_count - 1);
+		list_del(&p->lru);
+	}
+
+	return p;
+}
+
+static void kgsl_pool_list_init(struct kgsl_page_pool *pool)
+{
+	INIT_LIST_HEAD(&pool->page_list);
+}
+
+static void kgsl_pool_cache_init(void)
+{
+}
+
+static void kgsl_pool_cache_destroy(void)
+{
+}
+
+static void kgsl_destroy_page_pool(struct kgsl_page_pool *pool)
+{
+}
+#endif
+
+static struct kgsl_page_pool kgsl_pools[6];
+static int kgsl_num_pools;
+static int kgsl_pool_max_pages;
+
+/* Return the index of the pool for the specified order */
+static int kgsl_get_pool_index(int order)
+{
+	int i;
+
+	for (i = 0; i < kgsl_num_pools; i++) {
+		if (kgsl_pools[i].pool_order == order)
+			return i;
+	}
+
+	return -EINVAL;
+}
+
+/* Returns KGSL pool corresponding to input page order*/
+static struct kgsl_page_pool *
+_kgsl_get_pool_from_order(int order)
+{
+	int index = kgsl_get_pool_index(order);
+
+	return index >= 0 ? &kgsl_pools[index] : NULL;
+}
+
+/* Add a page to specified pool */
+static void
+_kgsl_pool_add_page(struct kgsl_page_pool *pool, struct page *p)
+{
+	if (!p)
+		return;
+
+	/*
+	 * Sanity check to make sure we don't re-pool a page that
+	 * somebody else has a reference to.
+	 */
+	if (WARN_ON(unlikely(page_count(p) > 1))) {
+		__free_pages(p, pool->pool_order);
+		return;
+	}
+
+	if (__kgsl_pool_add_page(pool, p)) {
+		__free_pages(p, pool->pool_order);
+		trace_kgsl_pool_free_page(pool->pool_order);
+		return;
+	}
+
+	/* Use READ_ONCE to read page_count without holding list_lock */
+	trace_kgsl_pool_add_page(pool->pool_order, READ_ONCE(pool->page_count));
+	mod_node_page_state(page_pgdat(p),  NR_KERNEL_MISC_RECLAIMABLE,
+				(1 << pool->pool_order));
+}
+
+/* Returns a page from specified pool */
+static struct page *
+_kgsl_pool_get_page(struct kgsl_page_pool *pool)
+{
+	struct page *p = NULL;
+
+	spin_lock(&pool->list_lock);
+	p = __kgsl_pool_get_page(pool);
+	spin_unlock(&pool->list_lock);
+	if (p != NULL) {
+		/* Use READ_ONCE to read page_count without holding list_lock */
+		trace_kgsl_pool_get_page(pool->pool_order,
+				READ_ONCE(pool->page_count));
+		mod_node_page_state(page_pgdat(p), NR_KERNEL_MISC_RECLAIMABLE,
+				-(1 << pool->pool_order));
+	}
+	return p;
+}
+
+int kgsl_pool_size_total(void)
+{
+	int i;
+	int total = 0;
+
+	for (i = 0; i < kgsl_num_pools; i++) {
+		struct kgsl_page_pool *kgsl_pool = &kgsl_pools[i];
+
+		spin_lock(&kgsl_pool->list_lock);
+		total += kgsl_pool->page_count * (1 << kgsl_pool->pool_order);
+		spin_unlock(&kgsl_pool->list_lock);
+	}
+
+	return total;
+}
+
+/* Returns the total number of pages in all pools excluding reserved pages */
+static unsigned long kgsl_pool_size_nonreserved(void)
+{
+	int i;
+	unsigned long total = 0;
+
+	for (i = 0; i < kgsl_num_pools; i++) {
+		struct kgsl_page_pool *pool = &kgsl_pools[i];
+
+		spin_lock(&pool->list_lock);
+		if (pool->page_count > pool->reserved_pages)
+			total += (pool->page_count - pool->reserved_pages) *
+					(1 << pool->pool_order);
+		spin_unlock(&pool->list_lock);
+	}
+
+	return total;
+}
+
+/*
+ * Returns a page from specified pool only if pool
+ * currently holds more number of pages than reserved
+ * pages.
+ */
+static struct page *
+_kgsl_pool_get_nonreserved_page(struct kgsl_page_pool *pool)
+{
+	struct page *p = NULL;
+
+	spin_lock(&pool->list_lock);
+	if (pool->page_count <= pool->reserved_pages) {
+		spin_unlock(&pool->list_lock);
+		return NULL;
+	}
+
+	p = __kgsl_pool_get_page(pool);
+	spin_unlock(&pool->list_lock);
+	if (p != NULL) {
+		/* Use READ_ONCE to read page_count without holding list_lock */
+		trace_kgsl_pool_get_page(pool->pool_order,
+					READ_ONCE(pool->page_count));
+		mod_node_page_state(page_pgdat(p), NR_KERNEL_MISC_RECLAIMABLE,
+				-(1 << pool->pool_order));
+	}
+	return p;
+}
+
+/*
+ * This will shrink the specified pool by num_pages or by
+ * (page_count - reserved_pages), whichever is smaller.
+ */
+static unsigned int
+_kgsl_pool_shrink(struct kgsl_page_pool *pool,
+			unsigned int num_pages, bool exit)
+{
+	int j;
+	unsigned int pcount = 0;
+	struct page *(*get_page)(struct kgsl_page_pool *) =
+		_kgsl_pool_get_nonreserved_page;
+
+	if (pool == NULL || num_pages == 0)
+		return pcount;
+
+	num_pages = (num_pages + (1 << pool->pool_order) - 1) >>
+				pool->pool_order;
+
+	/* This is to ensure that we free reserved pages */
+	if (exit)
+		get_page = _kgsl_pool_get_page;
+
+	for (j = 0; j < num_pages; j++) {
+		struct page *page = get_page(pool);
+
+		if (!page)
+			break;
+
+		__free_pages(page, pool->pool_order);
+		pcount += (1 << pool->pool_order);
+		trace_kgsl_pool_free_page(pool->pool_order);
+	}
+
+	return pcount;
+}
+
+/*
+ * This function removes number of pages specified by
+ * target_pages from the total pool size.
+ *
+ * Remove target_pages from the pool, starting from higher order pool.
+ */
+static unsigned long
+kgsl_pool_reduce(int target_pages, bool exit)
+{
+	int i, ret;
+	unsigned long pcount = 0;
+
+	for (i = (kgsl_num_pools - 1); i >= 0; i--) {
+		if (target_pages <= 0)
+			return pcount;
+
+		/* Remove target_pages pages from this pool */
+		ret = _kgsl_pool_shrink(&kgsl_pools[i], target_pages, exit);
+		target_pages -= ret;
+		pcount += ret;
+	}
+
+	return pcount;
+}
+
+void kgsl_pool_free_pages(struct page **pages, unsigned int pcount)
+{
+	int i;
+
+	if (!pages)
+		return;
+
+	for (i = 0; i < pcount;) {
+		/*
+		 * Free each page or compound page group individually.
+		 */
+		struct page *p = pages[i];
+
+		i += 1 << compound_order(p);
+		kgsl_pool_free_page(p);
+	}
+}
+
+static int kgsl_pool_get_retry_order(unsigned int order)
+{
+	int i;
+
+	for (i = kgsl_num_pools-1; i > 0; i--)
+		if (order >= kgsl_pools[i].pool_order)
+			return kgsl_pools[i].pool_order;
+
+	return 0;
+}
+
+/*
+ * Return true if the pool of specified page size is supported
+ * or no pools are supported otherwise return false.
+ */
+static bool kgsl_pool_available(unsigned int page_size)
+{
+	int order = get_order(page_size);
+
+	if (!kgsl_num_pools)
+		return true;
+
+	return (kgsl_get_pool_index(order) >= 0);
+}
+
+u32 kgsl_get_page_size(size_t size, unsigned int align)
+{
+	u32 pool;
+
+	if (!size)
+		return 0;
+
+	for (pool = rounddown_pow_of_two(size); pool > PAGE_SIZE; pool >>= 1)
+		if ((align >= ilog2(pool)) && (size >= pool) &&
+			kgsl_pool_available(pool))
+			return pool;
+
+	return PAGE_SIZE;
+}
+
+int kgsl_pool_alloc_page(int *page_size, struct page **pages,
+			unsigned int pages_len, unsigned int *align,
+			struct device *dev)
+{
+	int j;
+	int pcount = 0;
+	struct kgsl_page_pool *pool;
+	struct page *page = NULL;
+	struct page *p = NULL;
+	int order = get_order(*page_size);
+	int pool_idx;
+	size_t size = 0;
+
+	if ((pages == NULL) || pages_len < (*page_size >> PAGE_SHIFT))
+		return -EINVAL;
+
+	/* If the pool is not configured get pages from the system */
+	if (!kgsl_num_pools) {
+		gfp_t gfp_mask = kgsl_gfp_mask(order);
+
+		page = alloc_pages(gfp_mask, order);
+		if (page == NULL) {
+			/* Retry with lower order pages */
+			if (order > 0) {
+				size = PAGE_SIZE << --order;
+				goto eagain;
+
+			} else
+				return -ENOMEM;
+		}
+		trace_kgsl_pool_alloc_page_system(order);
+		goto done;
+	}
+
+	pool = _kgsl_get_pool_from_order(order);
+	if (pool == NULL) {
+		/* Retry with lower order pages */
+		if (order > 0) {
+			size = PAGE_SIZE << kgsl_pool_get_retry_order(order);
+			goto eagain;
+		} else {
+			/*
+			 * Fall back to direct allocation in case
+			 * pool with zero order is not present
+			 */
+			gfp_t gfp_mask = kgsl_gfp_mask(order);
+
+			page = alloc_pages(gfp_mask, order);
+			if (page == NULL)
+				return -ENOMEM;
+			trace_kgsl_pool_alloc_page_system(order);
+			goto done;
+		}
+	}
+
+	pool_idx = kgsl_get_pool_index(order);
+	page = _kgsl_pool_get_page(pool);
+
+	/* Allocate a new page if not allocated from pool */
+	if (page == NULL) {
+		gfp_t gfp_mask = kgsl_gfp_mask(order);
+
+		page = alloc_pages(gfp_mask, order);
+
+		if (!page) {
+			if (pool_idx > 0) {
+				/* Retry with lower order pages */
+				size = PAGE_SIZE <<
+					kgsl_pools[pool_idx-1].pool_order;
+				goto eagain;
+			} else
+				return -ENOMEM;
+		}
+		trace_kgsl_pool_alloc_page_system(order);
+	}
+
+done:
+	kgsl_zero_page(page, order, dev);
+
+	for (j = 0; j < (*page_size >> PAGE_SHIFT); j++) {
+		p = nth_page(page, j);
+		pages[pcount] = p;
+		pcount++;
+	}
+
+	return pcount;
+
+eagain:
+	trace_kgsl_pool_try_page_lower(get_order(*page_size));
+	*page_size = kgsl_get_page_size(size, ilog2(size));
+	*align = ilog2(*page_size);
+	return -EAGAIN;
+}
+
+void kgsl_pool_free_page(struct page *page)
+{
+	struct kgsl_page_pool *pool;
+	int page_order;
+
+	if (page == NULL)
+		return;
+
+	page_order = compound_order(page);
+
+	if (!kgsl_pool_max_pages ||
+			(kgsl_pool_size_total() < kgsl_pool_max_pages)) {
+		pool = _kgsl_get_pool_from_order(page_order);
+		/* Use READ_ONCE to read page_count without holding list_lock */
+		if (pool && (READ_ONCE(pool->page_count) < pool->max_pages)) {
+			_kgsl_pool_add_page(pool, page);
+			return;
+		}
+	}
+
+	/* Give back to system as not added to pool */
+	__free_pages(page, page_order);
+	trace_kgsl_pool_free_page(page_order);
+}
+
+/* Functions for the shrinker */
+
+static unsigned long
+kgsl_pool_shrink_scan_objects(struct shrinker *shrinker,
+					struct shrink_control *sc)
+{
+	/* sc->nr_to_scan represents number of pages to be removed*/
+	unsigned long pcount = kgsl_pool_reduce(sc->nr_to_scan, false);
+
+	/* If pools are exhausted return SHRINK_STOP */
+	return pcount ? pcount : SHRINK_STOP;
+}
+
+static unsigned long
+kgsl_pool_shrink_count_objects(struct shrinker *shrinker,
+					struct shrink_control *sc)
+{
+	/*
+	 * Return non-reserved pool size as we don't
+	 * want shrinker to free reserved pages.
+	 */
+	return kgsl_pool_size_nonreserved();
+}
+
+#if (KERNEL_VERSION(6, 7, 0) <= LINUX_VERSION_CODE)
+
+static struct shrinker *kgsl_pool_shrinker;
+
+#else
+
+/* Shrinker callback data*/
+static struct shrinker kgsl_pool_shrinker = {
+	.count_objects = kgsl_pool_shrink_count_objects,
+	.scan_objects = kgsl_pool_shrink_scan_objects,
+	.seeks = DEFAULT_SEEKS,
+	.batch = 0,
+};
+
+#endif
+
+int kgsl_pool_reserved_get(void *data, u64 *val)
+{
+	struct kgsl_page_pool *pool = data;
+
+	*val = (u64) pool->reserved_pages;
+	return 0;
+}
+
+int kgsl_pool_page_count_get(void *data, u64 *val)
+{
+	struct kgsl_page_pool *pool = data;
+
+	/* Use READ_ONCE to read page_count without holding list_lock */
+	*val = (u64) READ_ONCE(pool->page_count);
+	return 0;
+}
+
+static void kgsl_pool_reserve_pages(struct kgsl_page_pool *pool,
+		struct device_node *node)
+{
+	u32 reserved = 0;
+	int i;
+
+	of_property_read_u32(node, "qcom,mempool-reserved", &reserved);
+
+	reserved = min_t(u32, reserved, pool->max_pages);
+
+	/* Limit the total number of reserved pages to 4096 */
+	pool->reserved_pages = min_t(u32, reserved, 4096);
+
+#if IS_ENABLED(CONFIG_QCOM_KGSL_SORT_POOL)
+	/*
+	 * Pre-allocate tracking structs for reserved_pages so that
+	 * the pool can hold them even in low memory conditions
+	 */
+	pool->mempool = mempool_create(pool->reserved_pages,
+			_pool_entry_alloc, _pool_entry_free, NULL);
+#endif
+
+	for (i = 0; i < pool->reserved_pages; i++) {
+		gfp_t gfp_mask = kgsl_gfp_mask(pool->pool_order);
+		struct page *page;
+
+		page = alloc_pages(gfp_mask, pool->pool_order);
+		_kgsl_pool_add_page(pool, page);
+	}
+}
+
+static int kgsl_of_parse_mempool(struct kgsl_page_pool *pool,
+		struct device_node *node)
+{
+	u32 size;
+	int order;
+	unsigned char name[8];
+
+	if (of_property_read_u32(node, "qcom,mempool-page-size", &size))
+		return -EINVAL;
+
+	order = get_order(size);
+
+	if (order > 8) {
+		pr_err("kgsl: %pOF: pool order %d is too big\n", node, order);
+		return -EINVAL;
+	}
+
+	pool->pool_order = order;
+
+	if (of_property_read_u32(node, "qcom,mempool-max-pages", &pool->max_pages))
+		pool->max_pages = UINT_MAX;
+
+	spin_lock_init(&pool->list_lock);
+	kgsl_pool_list_init(pool);
+
+	kgsl_pool_reserve_pages(pool, node);
+
+	snprintf(name, sizeof(name), "%d_order", (pool->pool_order));
+	kgsl_pool_init_debugfs(pool->debug_root, name, (void *) pool);
+
+	return 0;
+}
+
+void kgsl_probe_page_pools(void)
+{
+	struct device_node *node, *child;
+
+	node = of_find_compatible_node(NULL, NULL, "qcom,gpu-mempools");
+	if (!node)
+		return;
+
+	/* Get Max pages limit for mempool */
+	of_property_read_u32(node, "qcom,mempool-max-pages",
+			&kgsl_pool_max_pages);
+
+	kgsl_pool_cache_init();
+
+	for_each_child_of_node(node, child) {
+		u32 index;
+
+		if (of_property_read_u32(child, "reg", &index) ||
+				index >= ARRAY_SIZE(kgsl_pools)) {
+			pr_err("kgsl: %pOF: pool index error\n", child);
+			continue;
+		}
+
+		if (!kgsl_of_parse_mempool(&kgsl_pools[index], child))
+			kgsl_num_pools++;
+	}
+
+	of_node_put(node);
+
+	/* Initialize shrinker */
+#if (KERNEL_VERSION(6, 7, 0) <= LINUX_VERSION_CODE)
+	{
+		kgsl_pool_shrinker = shrinker_alloc(0, "kgsl_pool_shrinker");
+		if (WARN_ON(!kgsl_pool_shrinker))
+			return;
+
+		kgsl_pool_shrinker->count_objects = kgsl_pool_shrink_count_objects;
+		kgsl_pool_shrinker->scan_objects = kgsl_pool_shrink_scan_objects;
+
+		shrinker_register(kgsl_pool_shrinker);
+	}
+#elif (KERNEL_VERSION(6, 0, 0) <= LINUX_VERSION_CODE)
+	register_shrinker(&kgsl_pool_shrinker, "kgsl_pool_shrinker");
+#else
+	register_shrinker(&kgsl_pool_shrinker);
+#endif
+}
+
+void kgsl_exit_page_pools(void)
+{
+	int i;
+
+	/* Release all pages in pools, if any.*/
+	kgsl_pool_reduce(INT_MAX, true);
+
+	/* Unregister shrinker */
+#if (KERNEL_VERSION(6, 7, 0) <= LINUX_VERSION_CODE)
+	shrinker_free(kgsl_pool_shrinker);
+#else
+	unregister_shrinker(&kgsl_pool_shrinker);
+#endif
+
+	/* Destroy helper structures */
+	for (i = 0; i < kgsl_num_pools; i++)
+		kgsl_destroy_page_pool(&kgsl_pools[i]);
+
+	/* Destroy the kmem cache */
+	kgsl_pool_cache_destroy();
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_pool.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_pool.h
@@ -0,0 +1,103 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2017,2019,2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023,2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_POOL_H
+#define __KGSL_POOL_H
+
+#ifdef CONFIG_QCOM_KGSL_USE_SHMEM
+static inline void kgsl_probe_page_pools(void) { }
+static inline void kgsl_exit_page_pools(void) { }
+
+static inline u32 kgsl_get_page_size(size_t size, unsigned int align)
+{
+	u32 page_size;
+
+	if (!size)
+		return 0;
+
+	for (page_size = rounddown_pow_of_two(size); page_size > PAGE_SIZE; page_size >>= 1)
+		if ((align >= ilog2(page_size)) && (size >= page_size))
+			return page_size;
+
+	return PAGE_SIZE;
+}
+
+static inline int kgsl_pool_page_count_get(void *data, u64 *val)
+{
+	return 0;
+}
+
+static inline int kgsl_pool_reserved_get(void *data, u64 *val)
+{
+	return 0;
+}
+
+static inline int kgsl_pool_size_total(void)
+{
+	return 0;
+}
+#else
+/**
+ * kgsl_pool_free_page - Frees the page and adds it back to pool/system memory
+ * @page: Pointer to page struct that needs to be freed
+ */
+void kgsl_pool_free_page(struct page *page);
+
+/**
+ * kgsl_get_page_size - Get supported pagesize
+ * @size: Size of the page
+ * @align: Desired alignment of the size
+ *
+ * Return largest available page size from pools that can be used to meet
+ * given size and alignment requirements
+ */
+u32 kgsl_get_page_size(size_t size, unsigned int align);
+
+/**
+ * kgsl_pool_alloc_page - Allocate a page of requested size
+ * @page_size: Size of the page to be allocated
+ * @pages: pointer to hold list of pages, should be big enough to hold
+ * requested page
+ * @len: Length of array pages
+ *
+ * Return total page count on success and negative value on failure
+ */
+int kgsl_pool_alloc_page(int *page_size, struct page **pages,
+			unsigned int pages_len, unsigned int *align,
+			struct device *dev);
+
+/**
+ * kgsl_pool_free_pages - Free pages in an pages array
+ * @pages: pointer to an array of page structs
+ * @page_count: Number of entries in @pages
+ *
+ * Free the pages by collapsing any physical adjacent pages.
+ * Pages are added back to the pool, if pool has sufficient space
+ * otherwise they are given back to system.
+ */
+void kgsl_pool_free_pages(struct page **pages, unsigned int page_count);
+
+/* Debugfs node functions */
+int kgsl_pool_reserved_get(void *data, u64 *val);
+int kgsl_pool_page_count_get(void *data, u64 *val);
+
+/**
+ * kgsl_pool_size_total - Return the number of pages in all kgsl page pools
+ */
+int kgsl_pool_size_total(void);
+
+/**
+ * kgsl_probe_page_pools - Initialize the memory pools
+ */
+void kgsl_probe_page_pools(void);
+
+/**
+ * kgsl_exit_page_pools - Free outstanding pooled memory
+ */
+void kgsl_exit_page_pools(void);
+
+#endif
+#endif /* __KGSL_POOL_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_power_trace.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_power_trace.h
@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#if !defined(_KGSL_POWER_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _KGSL_POWER_TRACE_H
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM power
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE kgsl_power_trace
+
+#include <linux/tracepoint.h>
+
+DECLARE_EVENT_CLASS(gpu_work_period_class,
+
+	TP_PROTO(u32 gpu_id, u32 uid, u64 start_time_ns,
+		 u64 end_time_ns, u64 total_active_duration_ns),
+
+	TP_ARGS(gpu_id, uid, start_time_ns, end_time_ns, total_active_duration_ns),
+
+	TP_STRUCT__entry(
+		__field(u32, gpu_id)
+		__field(u32, uid)
+		__field(u64, start_time_ns)
+		__field(u64, end_time_ns)
+		__field(u64, total_active_duration_ns)
+	),
+
+	TP_fast_assign(
+		__entry->gpu_id = gpu_id;
+		__entry->uid = uid;
+		__entry->start_time_ns = start_time_ns;
+		__entry->end_time_ns = end_time_ns;
+		__entry->total_active_duration_ns = total_active_duration_ns;
+	),
+
+	TP_printk("gpu_id=%u uid=%u start_time_ns=%llu end_time_ns=%llu total_active_duration_ns=%llu",
+		  __entry->gpu_id,
+		  __entry->uid,
+		  __entry->start_time_ns,
+		  __entry->end_time_ns,
+		  __entry->total_active_duration_ns)
+	);
+
+DEFINE_EVENT(gpu_work_period_class, gpu_work_period,
+	TP_PROTO(u32 gpu_id, u32 uid, u64 start_time_ns,
+		 u64 end_time_ns, u64 total_active_duration_ns),
+
+	TP_ARGS(gpu_id, uid, start_time_ns, end_time_ns, total_active_duration_ns)
+);
+#endif /* _KGSL_POWER_TRACE_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_pwrctrl.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_pwrctrl.c
@@ -0,0 +1,2439 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2010-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/clk/qcom.h>
+#include <linux/interconnect.h>
+#include <linux/iopoll.h>
+#include <linux/of_device.h>
+#include <linux/of_platform.h>
+#include <linux/pm_domain.h>
+#include <linux/pm_runtime.h>
+#include <linux/regulator/consumer.h>
+#include <linux/slab.h>
+#include <linux/thermal.h>
+#include <linux/msm_kgsl.h>
+#include <soc/qcom/dcvs.h>
+
+#include "kgsl_device.h"
+#include "kgsl_bus.h"
+#include "kgsl_pwrscale.h"
+#include "kgsl_sysfs.h"
+#include "kgsl_trace.h"
+#include "kgsl_util.h"
+
+#define UPDATE_BUSY_VAL		1000000
+
+#define KGSL_MAX_BUSLEVELS	20
+
+/* Order deeply matters here because reasons. New entries go on the end */
+static const char * const clocks[KGSL_MAX_CLKS] = {
+	"src_clk",
+	"core_clk",
+	"iface_clk",
+	"mem_clk",
+	"mem_iface_clk",
+	"alt_mem_iface_clk",
+	"rbbmtimer_clk",
+	"gtcu_clk",
+	"gtbu_clk",
+	"gtcu_iface_clk",
+	"alwayson_clk",
+	"isense_clk",
+	"rbcpr_clk",
+	"iref_clk",
+	"gmu_clk",
+	"ahb_clk",
+	"smmu_vote",
+	"apb_pclk",
+};
+
+static void kgsl_pwrctrl_clk(struct kgsl_device *device, bool state,
+					int requested_state);
+static int kgsl_pwrctrl_pwrrail(struct kgsl_device *device, bool state);
+static int _isense_clk_set_rate(struct kgsl_pwrctrl *pwr, int level);
+static int kgsl_pwrctrl_clk_set_rate(struct clk *grp_clk, unsigned int freq,
+				const char *name);
+static void _gpu_clk_prepare_enable(struct kgsl_device *device,
+				struct clk *clk, const char *name);
+static void _bimc_clk_prepare_enable(struct kgsl_device *device,
+				struct clk *clk, const char *name);
+
+/**
+ * _adjust_pwrlevel() - Given a requested power level do bounds checking on the
+ * constraints and return the nearest possible level
+ * @device: Pointer to the kgsl_device struct
+ * @level: Requested level
+ * @pwrc: Pointer to the power constraint to be applied
+ *
+ * Apply thermal and max/min limits first.  Then force the level with a
+ * constraint if one exists.
+ */
+static unsigned int _adjust_pwrlevel(struct kgsl_pwrctrl *pwr, int level,
+					struct kgsl_pwr_constraint *pwrc)
+{
+	unsigned int max_pwrlevel = max_t(unsigned int, pwr->thermal_pwrlevel,
+					pwr->max_pwrlevel);
+	unsigned int min_pwrlevel = min_t(unsigned int,
+					pwr->thermal_pwrlevel_floor,
+					pwr->min_pwrlevel);
+
+	/* Ensure that max/min pwrlevels are within thermal max/min limits */
+	max_pwrlevel = min_t(unsigned int, max_pwrlevel,
+					pwr->thermal_pwrlevel_floor);
+	min_pwrlevel = max_t(unsigned int, min_pwrlevel,
+					pwr->thermal_pwrlevel);
+
+	switch (pwrc->type) {
+	case KGSL_CONSTRAINT_PWRLEVEL: {
+		switch (pwrc->sub_type) {
+		case KGSL_CONSTRAINT_PWR_MAX:
+			return max_pwrlevel;
+		case KGSL_CONSTRAINT_PWR_MIN:
+			return min_pwrlevel;
+		default:
+			break;
+		}
+	}
+	break;
+	}
+
+	if (level < max_pwrlevel)
+		return max_pwrlevel;
+	if (level > min_pwrlevel)
+		return min_pwrlevel;
+
+	return level;
+}
+
+/**
+ * kgsl_pwrctrl_pwrlevel_change_settings() - Program h/w during powerlevel
+ * transitions
+ * @device: Pointer to the kgsl_device struct
+ * @post: flag to check if the call is before/after the clk_rate change
+ * @wake_up: flag to check if device is active or waking up
+ */
+static void kgsl_pwrctrl_pwrlevel_change_settings(struct kgsl_device *device,
+			bool post)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	unsigned int old = pwr->previous_pwrlevel;
+	unsigned int new = pwr->active_pwrlevel;
+
+	if (device->state != KGSL_STATE_ACTIVE)
+		return;
+	if (old == new)
+		return;
+
+	device->ftbl->pwrlevel_change_settings(device, old, new, post);
+}
+
+/**
+ * kgsl_pwrctrl_adjust_pwrlevel() - Adjust the power level if
+ * required by thermal, max/min, constraints, etc
+ * @device: Pointer to the kgsl_device struct
+ * @new_level: Requested powerlevel, an index into the pwrlevel array
+ */
+unsigned int kgsl_pwrctrl_adjust_pwrlevel(struct kgsl_device *device,
+				unsigned int new_level)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	unsigned int old_level = pwr->active_pwrlevel;
+	bool reset = false;
+
+	/* If a pwr constraint is expired, remove it */
+	if ((pwr->constraint.type != KGSL_CONSTRAINT_NONE) &&
+		(time_after(jiffies, pwr->constraint.expires))) {
+
+		struct kgsl_context *context = kgsl_context_get(device,
+				pwr->constraint.owner_id);
+
+		/* We couldn't get a reference, clear the constraint */
+		if (!context) {
+			reset = true;
+			goto done;
+		}
+
+		/*
+		 * If the last timestamp that set the constraint has retired,
+		 * clear the constraint
+		 */
+		if (kgsl_check_timestamp(device, context,
+			pwr->constraint.owner_timestamp)) {
+			reset = true;
+			kgsl_context_put(context);
+			goto done;
+		}
+
+		/*
+		 * Increase the timeout to keep the constraint at least till
+		 * the timestamp retires
+		 */
+		pwr->constraint.expires = jiffies +
+			msecs_to_jiffies(device->pwrctrl.interval_timeout);
+
+		kgsl_context_put(context);
+	}
+
+done:
+	if (reset) {
+		/* Trace the constraint being un-set by the driver */
+		trace_kgsl_constraint(device, pwr->constraint.type,
+						old_level, 0);
+		/*Invalidate the constraint set */
+		pwr->constraint.expires = 0;
+		pwr->constraint.type = KGSL_CONSTRAINT_NONE;
+	}
+
+	/*
+	 * Adjust the power level if required by thermal, max/min,
+	 * constraints, etc
+	 */
+	return _adjust_pwrlevel(pwr, new_level, &pwr->constraint);
+}
+
+/**
+ * kgsl_pwrctrl_pwrlevel_change() - Validate and change power levels
+ * @device: Pointer to the kgsl_device struct
+ * @new_level: Requested powerlevel, an index into the pwrlevel array
+ *
+ * Check that any power level constraints are still valid.  Update the
+ * requested level according to any thermal, max/min, or power constraints.
+ * If a new GPU level is going to be set, update the bus to that level's
+ * default value.  Do not change the bus if a constraint keeps the new
+ * level at the current level.  Set the new GPU frequency.
+ */
+void kgsl_pwrctrl_pwrlevel_change(struct kgsl_device *device,
+				unsigned int new_level)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct kgsl_pwrlevel *pwrlevel;
+	unsigned int old_level = pwr->active_pwrlevel;
+
+	new_level = kgsl_pwrctrl_adjust_pwrlevel(device, new_level);
+
+	if (new_level == old_level)
+		return;
+
+	kgsl_pwrscale_update_stats(device);
+
+	/*
+	 * Set the active and previous powerlevel first in case the clocks are
+	 * off - if we don't do this then the pwrlevel change won't take effect
+	 * when the clocks come back
+	 */
+	pwr->active_pwrlevel = new_level;
+	pwr->previous_pwrlevel = old_level;
+
+	/*
+	 * If the bus is running faster than its default level and the GPU
+	 * frequency is moving down keep the DDR at a relatively high level.
+	 */
+	if (pwr->bus_mod < 0 || new_level < old_level) {
+		pwr->bus_mod = 0;
+		pwr->bus_percent_ab = 0;
+	}
+	/*
+	 * Update the bus before the GPU clock to prevent underrun during
+	 * frequency increases.
+	 */
+	if (new_level < old_level)
+		kgsl_bus_update(device, KGSL_BUS_VOTE_ON);
+
+	pwrlevel = &pwr->pwrlevels[pwr->active_pwrlevel];
+	/* Change register settings if any  BEFORE pwrlevel change*/
+	kgsl_pwrctrl_pwrlevel_change_settings(device, 0);
+	device->ftbl->gpu_clock_set(device, pwr->active_pwrlevel);
+	_isense_clk_set_rate(pwr, pwr->active_pwrlevel);
+
+	trace_kgsl_pwrlevel(device,
+			pwr->active_pwrlevel, pwrlevel->gpu_freq,
+			pwr->previous_pwrlevel,
+			pwr->pwrlevels[old_level].gpu_freq);
+
+	trace_gpu_frequency(pwrlevel->gpu_freq/1000, 0);
+
+	/*  Update the bus after GPU clock decreases. */
+	if (new_level > old_level)
+		kgsl_bus_update(device, KGSL_BUS_VOTE_ON);
+
+	/*
+	 * Some targets do not support the bandwidth requirement of
+	 * GPU at TURBO, for such targets we need to set GPU-BIMC
+	 * interface clocks to TURBO directly whenever GPU runs at
+	 * TURBO. The TURBO frequency of gfx-bimc need to be defined
+	 * in target device tree.
+	 */
+	if (pwr->gpu_bimc_int_clk) {
+		if (pwr->active_pwrlevel == 0 &&
+				!pwr->gpu_bimc_interface_enabled) {
+			kgsl_pwrctrl_clk_set_rate(pwr->gpu_bimc_int_clk,
+					pwr->gpu_bimc_int_clk_freq,
+					"bimc_gpu_clk");
+			_bimc_clk_prepare_enable(device,
+					pwr->gpu_bimc_int_clk,
+					"bimc_gpu_clk");
+			pwr->gpu_bimc_interface_enabled = true;
+		} else if (pwr->previous_pwrlevel == 0
+				&& pwr->gpu_bimc_interface_enabled) {
+			clk_disable_unprepare(pwr->gpu_bimc_int_clk);
+			pwr->gpu_bimc_interface_enabled = false;
+		}
+	}
+
+	/* Change register settings if any AFTER pwrlevel change*/
+	kgsl_pwrctrl_pwrlevel_change_settings(device, 1);
+}
+
+void kgsl_pwrctrl_set_constraint(struct kgsl_device *device,
+			struct kgsl_pwr_constraint *pwrc, uint32_t id, u32 ts)
+{
+	unsigned int constraint;
+	struct kgsl_pwr_constraint *pwrc_old;
+
+	if (device == NULL || pwrc == NULL)
+		return;
+	constraint = _adjust_pwrlevel(&device->pwrctrl,
+				device->pwrctrl.active_pwrlevel, pwrc);
+	pwrc_old = &device->pwrctrl.constraint;
+
+	/*
+	 * If a constraint is already set, set a new constraint only
+	 * if it is faster. If the requested constraint is the same
+	 * as the current one, update ownership and timestamp.
+	 */
+	if ((pwrc_old->type == KGSL_CONSTRAINT_NONE) ||
+		(pwrc_old->sub_type == KGSL_CONSTRAINT_PWR_MIN &&
+		 pwrc->sub_type == KGSL_CONSTRAINT_PWR_MAX)) {
+		pwrc_old->type = pwrc->type;
+		pwrc_old->sub_type = pwrc->sub_type;
+		pwrc_old->owner_id = id;
+		pwrc_old->expires = jiffies +
+			msecs_to_jiffies(device->pwrctrl.interval_timeout);
+		pwrc_old->owner_timestamp = ts;
+		kgsl_pwrctrl_pwrlevel_change(device, constraint);
+		/* Trace the constraint being set by the driver */
+		trace_kgsl_constraint(device, pwrc_old->type, constraint, 1);
+	} else if (pwrc_old->type == pwrc->type) {
+		pwrc_old->owner_id = id;
+		pwrc_old->owner_timestamp = ts;
+		pwrc_old->expires = jiffies +
+			msecs_to_jiffies(device->pwrctrl.interval_timeout);
+	}
+}
+
+static int kgsl_pwrctrl_set_thermal_limit(struct kgsl_device *device,
+		u32 level)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret = -EINVAL;
+
+	if (level >= pwr->num_pwrlevels)
+		level = pwr->num_pwrlevels - 1;
+
+	if (dev_pm_qos_request_active(&pwr->sysfs_thermal_req))
+		ret = dev_pm_qos_update_request(&pwr->sysfs_thermal_req,
+			(pwr->pwrlevels[level].gpu_freq / 1000));
+
+	return (ret < 0) ? ret : 0;
+}
+
+static ssize_t thermal_pwrlevel_store(struct device *dev,
+				struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	int ret;
+	u32 level;
+
+	ret = kstrtou32(buf, 0, &level);
+	if (ret)
+		return ret;
+
+	ret = kgsl_pwrctrl_set_thermal_limit(device, level);
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+static ssize_t thermal_pwrlevel_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n", pwr->thermal_pwrlevel);
+}
+
+static ssize_t max_pwrlevel_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret;
+	unsigned int level = 0;
+
+	ret = kstrtou32(buf, 0, &level);
+	if (ret)
+		return ret;
+
+	mutex_lock(&device->mutex);
+
+	/* You can't set a maximum power level lower than the minimum */
+	if (level > pwr->min_pwrlevel)
+		level = pwr->min_pwrlevel;
+
+	pwr->max_pwrlevel = level;
+
+	/* Update the current level using the new limit */
+	kgsl_pwrctrl_pwrlevel_change(device, pwr->active_pwrlevel);
+	mutex_unlock(&device->mutex);
+
+	return count;
+}
+
+static ssize_t max_pwrlevel_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	return scnprintf(buf, PAGE_SIZE, "%u\n", pwr->max_pwrlevel);
+}
+
+static void kgsl_pwrctrl_min_pwrlevel_set(struct kgsl_device *device,
+					int level)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	mutex_lock(&device->mutex);
+	if (level >= pwr->num_pwrlevels)
+		level = pwr->num_pwrlevels - 1;
+
+	/* You can't set a minimum power level lower than the maximum */
+	if (level < pwr->max_pwrlevel)
+		level = pwr->max_pwrlevel;
+
+	pwr->min_pwrlevel = level;
+
+	/* Update the current level using the new limit */
+	kgsl_pwrctrl_pwrlevel_change(device, pwr->active_pwrlevel);
+
+	mutex_unlock(&device->mutex);
+}
+
+static ssize_t min_pwrlevel_store(struct device *dev,
+				struct device_attribute *attr, const char *buf,
+				size_t count)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	int ret;
+	unsigned int level = 0;
+
+	ret = kstrtou32(buf, 0, &level);
+	if (ret)
+		return ret;
+
+	kgsl_pwrctrl_min_pwrlevel_set(device, level);
+
+	return count;
+}
+
+static ssize_t min_pwrlevel_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	return scnprintf(buf, PAGE_SIZE, "%u\n", pwr->min_pwrlevel);
+}
+
+static ssize_t num_pwrlevels_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n", pwr->num_pwrlevels);
+}
+
+/* Given a GPU clock value, return the lowest matching powerlevel */
+
+static int _get_nearest_pwrlevel(struct kgsl_pwrctrl *pwr, unsigned int clock)
+{
+	int i;
+
+	for (i = pwr->num_pwrlevels - 1; i >= 0; i--) {
+		if (abs(pwr->pwrlevels[i].gpu_freq - clock) < 5000000)
+			return i;
+	}
+
+	return -ERANGE;
+}
+
+static ssize_t max_gpuclk_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	u32 freq;
+	int ret, level;
+
+	ret = kstrtou32(buf, 0, &freq);
+	if (ret)
+		return ret;
+
+	level = _get_nearest_pwrlevel(&device->pwrctrl, freq);
+	if (level < 0)
+		return level;
+
+	/*
+	 * You would think this would set max_pwrlevel but the legacy behavior
+	 * is that it set thermal_pwrlevel instead so we don't want to mess with
+	 * that.
+	 */
+	ret = kgsl_pwrctrl_set_thermal_limit(device, level);
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+static ssize_t max_gpuclk_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+		device->pwrctrl.pwrlevels[pwr->thermal_pwrlevel].gpu_freq);
+}
+
+static ssize_t gpuclk_store(struct device *dev,
+				     struct device_attribute *attr,
+				     const char *buf, size_t count)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	unsigned int val = 0;
+	int ret, level;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	mutex_lock(&device->mutex);
+	level = _get_nearest_pwrlevel(pwr, val);
+	if (level >= 0)
+		kgsl_pwrctrl_pwrlevel_change(device, (unsigned int) level);
+
+	mutex_unlock(&device->mutex);
+	return count;
+}
+
+static ssize_t gpuclk_show(struct device *dev,
+				    struct device_attribute *attr,
+				    char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return scnprintf(buf, PAGE_SIZE, "%ld\n",
+		kgsl_pwrctrl_active_freq(&device->pwrctrl));
+}
+
+static ssize_t idle_timer_store(struct device *dev, struct device_attribute *attr,
+					const char *buf, size_t count)
+{
+	unsigned int val = 0;
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	/*
+	 * We don't quite accept a maximum of 0xFFFFFFFF due to internal jiffy
+	 * math, so make sure the value falls within the largest offset we can
+	 * deal with
+	 */
+
+	if (val > jiffies_to_usecs(MAX_JIFFY_OFFSET))
+		return -EINVAL;
+
+	mutex_lock(&device->mutex);
+	device->pwrctrl.interval_timeout = val;
+	mutex_unlock(&device->mutex);
+
+	return count;
+}
+
+static ssize_t idle_timer_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return scnprintf(buf, PAGE_SIZE, "%u\n", device->pwrctrl.interval_timeout);
+}
+
+static ssize_t minbw_timer_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count)
+{
+	/* minbw_timer is deprecated, so return EOPNOTSUPP */
+	return -EOPNOTSUPP;
+}
+
+static ssize_t minbw_timer_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	/* minbw_timer is deprecated, so return it as always disabled */
+	return scnprintf(buf, PAGE_SIZE, "0\n");
+}
+
+static ssize_t gpubusy_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	int ret;
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_clk_stats *stats = &device->pwrctrl.clk_stats;
+
+	ret = scnprintf(buf, PAGE_SIZE, "%7d %7d\n",
+			stats->busy_old, stats->total_old);
+	if (!test_bit(KGSL_PWRFLAGS_AXI_ON, &device->pwrctrl.power_flags)) {
+		stats->busy_old = 0;
+		stats->total_old = 0;
+	}
+	return ret;
+}
+
+static ssize_t gpu_available_frequencies_show(struct device *dev,
+					struct device_attribute *attr,
+					char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int index, num_chars = 0;
+
+	for (index = 0; index < pwr->num_pwrlevels; index++) {
+		num_chars += scnprintf(buf + num_chars,
+			PAGE_SIZE - num_chars - 1,
+			"%d ", pwr->pwrlevels[index].gpu_freq);
+		/* One space for trailing null and another for the newline */
+		if (num_chars >= PAGE_SIZE - 2)
+			break;
+	}
+	buf[num_chars++] = '\n';
+	return num_chars;
+}
+
+static ssize_t gpu_clock_stats_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int index, num_chars = 0;
+
+	mutex_lock(&device->mutex);
+	kgsl_pwrscale_update_stats(device);
+	mutex_unlock(&device->mutex);
+	for (index = 0; index < pwr->num_pwrlevels; index++)
+		num_chars += scnprintf(buf + num_chars, PAGE_SIZE - num_chars,
+			"%llu ", pwr->clock_times[index]);
+
+	if (num_chars < PAGE_SIZE)
+		buf[num_chars++] = '\n';
+
+	return num_chars;
+}
+
+static ssize_t reset_count_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n", device->reset_counter);
+}
+
+static void __force_on(struct kgsl_device *device, int flag, int on)
+{
+	if (on) {
+		switch (flag) {
+		case KGSL_PWRFLAGS_CLK_ON:
+			/* make sure pwrrail is ON before enabling clocks */
+			kgsl_pwrctrl_pwrrail(device, true);
+			kgsl_pwrctrl_clk(device, true,
+				KGSL_STATE_ACTIVE);
+			break;
+		case KGSL_PWRFLAGS_AXI_ON:
+			kgsl_pwrctrl_axi(device, true);
+			break;
+		case KGSL_PWRFLAGS_POWER_ON:
+			kgsl_pwrctrl_pwrrail(device, true);
+			break;
+		}
+		set_bit(flag, &device->pwrctrl.ctrl_flags);
+	} else {
+		clear_bit(flag, &device->pwrctrl.ctrl_flags);
+	}
+}
+
+static ssize_t __force_on_show(struct device *dev,
+					struct device_attribute *attr,
+					char *buf, int flag)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+		test_bit(flag, &device->pwrctrl.ctrl_flags));
+}
+
+static ssize_t __force_on_store(struct device *dev,
+					struct device_attribute *attr,
+					const char *buf, size_t count,
+					int flag)
+{
+	unsigned int val = 0;
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	mutex_lock(&device->mutex);
+	__force_on(device, flag, val);
+	mutex_unlock(&device->mutex);
+
+	return count;
+}
+
+static ssize_t force_clk_on_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	return __force_on_show(dev, attr, buf, KGSL_PWRFLAGS_CLK_ON);
+}
+
+static ssize_t force_clk_on_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	return __force_on_store(dev, attr, buf, count, KGSL_PWRFLAGS_CLK_ON);
+}
+
+static ssize_t force_bus_on_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	return __force_on_show(dev, attr, buf, KGSL_PWRFLAGS_AXI_ON);
+}
+
+static ssize_t force_bus_on_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	return __force_on_store(dev, attr, buf, count, KGSL_PWRFLAGS_AXI_ON);
+}
+
+static ssize_t force_rail_on_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	return __force_on_show(dev, attr, buf, KGSL_PWRFLAGS_POWER_ON);
+}
+
+static ssize_t force_rail_on_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	return __force_on_store(dev, attr, buf, count, KGSL_PWRFLAGS_POWER_ON);
+}
+
+static ssize_t force_no_nap_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	/* force_no_nap is deprecated, so return it as always disabled */
+	return scnprintf(buf, PAGE_SIZE, "0\n");
+}
+
+static ssize_t force_no_nap_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	/* force_no_nap is deprecated, so return EOPNOTSUPP */
+	return -EOPNOTSUPP;
+}
+
+static ssize_t bus_split_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+		device->pwrctrl.bus_control);
+}
+
+static ssize_t bus_split_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	unsigned int val = 0;
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	int ret;
+
+	ret = kstrtou32(buf, 0, &val);
+	if (ret)
+		return ret;
+
+	mutex_lock(&device->mutex);
+	device->pwrctrl.bus_control = val ? true : false;
+	mutex_unlock(&device->mutex);
+
+	return count;
+}
+
+static ssize_t default_pwrlevel_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+		device->pwrctrl.default_pwrlevel);
+}
+
+static ssize_t default_pwrlevel_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct kgsl_pwrscale *pwrscale = &device->pwrscale;
+	int ret;
+	unsigned int level = 0;
+
+	ret = kstrtou32(buf, 0, &level);
+	if (ret)
+		return ret;
+
+	if (level >= pwr->num_pwrlevels)
+		return count;
+
+	mutex_lock(&device->mutex);
+	pwr->default_pwrlevel = level;
+	pwrscale->gpu_profile.profile.initial_freq
+			= pwr->pwrlevels[level].gpu_freq;
+
+	mutex_unlock(&device->mutex);
+	return count;
+}
+
+static ssize_t popp_show(struct device *dev,
+					   struct device_attribute *attr,
+					   char *buf)
+{
+	/* POPP is deprecated, so return it as always disabled */
+	return scnprintf(buf, PAGE_SIZE, "0\n");
+}
+
+static ssize_t _gpu_busy_show(struct kgsl_device *device,
+					char *buf)
+{
+	int ret;
+	struct kgsl_clk_stats *stats = &device->pwrctrl.clk_stats;
+	unsigned int busy_percent = 0;
+
+	if (stats->total_old != 0)
+		busy_percent = (stats->busy_old * 100) / stats->total_old;
+
+	ret = scnprintf(buf, PAGE_SIZE, "%d %%\n", busy_percent);
+
+	/* Reset the stats if GPU is OFF */
+	if (!test_bit(KGSL_PWRFLAGS_AXI_ON, &device->pwrctrl.power_flags)) {
+		stats->busy_old = 0;
+		stats->total_old = 0;
+	}
+	return ret;
+}
+
+static ssize_t gpu_busy_percentage_show(struct device *dev,
+					struct device_attribute *attr,
+					char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return _gpu_busy_show(device, buf);
+}
+
+static ssize_t _min_clock_mhz_show(struct kgsl_device *device,
+					char *buf)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+			pwr->pwrlevels[pwr->min_pwrlevel].gpu_freq / 1000000);
+}
+
+
+static ssize_t min_clock_mhz_show(struct device *dev,
+					struct device_attribute *attr,
+					char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return _min_clock_mhz_show(device, buf);
+}
+
+static ssize_t _min_clock_mhz_store(struct kgsl_device *device,
+				const char *buf, size_t count)
+{
+	int level, ret;
+	unsigned int freq;
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	ret = kstrtou32(buf, 0, &freq);
+	if (ret)
+		return ret;
+
+	freq *= 1000000;
+	level = _get_nearest_pwrlevel(pwr, freq);
+
+	if (level >= 0)
+		kgsl_pwrctrl_min_pwrlevel_set(device, level);
+
+	return count;
+}
+
+static ssize_t min_clock_mhz_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return _min_clock_mhz_store(device, buf, count);
+}
+
+static ssize_t _max_clock_mhz_show(struct kgsl_device *device, char *buf)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+		pwr->pwrlevels[pwr->thermal_pwrlevel].gpu_freq / 1000000);
+}
+
+static ssize_t max_clock_mhz_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return _max_clock_mhz_show(device, buf);
+}
+
+static ssize_t _max_clock_mhz_store(struct kgsl_device *device,
+				const char *buf, size_t count)
+{
+	u32 freq;
+	int ret, level;
+
+	ret = kstrtou32(buf, 0, &freq);
+	if (ret)
+		return ret;
+
+	level = _get_nearest_pwrlevel(&device->pwrctrl, freq * 1000000);
+	if (level < 0)
+		return level;
+
+	/*
+	 * You would think this would set max_pwrlevel but the legacy behavior
+	 * is that it set thermal_pwrlevel instead so we don't want to mess with
+	 * that.
+	 */
+	ret = kgsl_pwrctrl_set_thermal_limit(device, level);
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+static ssize_t max_clock_mhz_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return _max_clock_mhz_store(device, buf, count);
+}
+
+static ssize_t _clock_mhz_show(struct kgsl_device *device, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%ld\n",
+			kgsl_pwrctrl_active_freq(&device->pwrctrl) / 1000000);
+}
+
+static ssize_t clock_mhz_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return _clock_mhz_show(device, buf);
+}
+
+static ssize_t _freq_table_mhz_show(struct kgsl_device *device,
+					char *buf)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int index, num_chars = 0;
+
+	for (index = 0; index < pwr->num_pwrlevels; index++) {
+		num_chars += scnprintf(buf + num_chars,
+			PAGE_SIZE - num_chars - 1,
+			"%d ", pwr->pwrlevels[index].gpu_freq / 1000000);
+		/* One space for trailing null and another for the newline */
+		if (num_chars >= PAGE_SIZE - 2)
+			break;
+	}
+
+	buf[num_chars++] = '\n';
+
+	return num_chars;
+}
+
+static ssize_t freq_table_mhz_show(struct device *dev,
+					struct device_attribute *attr,
+					char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return _freq_table_mhz_show(device, buf);
+}
+
+static ssize_t _gpu_tmu_show(struct kgsl_device *device,
+					char *buf)
+{
+	struct device *dev;
+	struct thermal_zone_device *thermal_dev;
+	int temperature = 0, max_temp = 0;
+	const char *name;
+	struct property *prop;
+
+	dev = &device->pdev->dev;
+
+	of_property_for_each_string(dev->of_node, "qcom,tzone-names", prop, name) {
+		thermal_dev = thermal_zone_get_zone_by_name(name);
+		if (IS_ERR(thermal_dev))
+			continue;
+
+		if (thermal_zone_get_temp(thermal_dev, &temperature))
+			continue;
+
+		max_temp = max(temperature, max_temp);
+	}
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+			max_temp);
+}
+
+static ssize_t temp_show(struct device *dev,
+					struct device_attribute *attr,
+					char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	return _gpu_tmu_show(device, buf);
+}
+
+static ssize_t pwrscale_store(struct device *dev,
+			struct device_attribute *attr,
+			const char *buf, size_t count)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	int ret;
+	unsigned int enable = 0;
+
+	ret = kstrtou32(buf, 0, &enable);
+	if (ret)
+		return ret;
+
+	mutex_lock(&device->mutex);
+
+	if (enable)
+		kgsl_pwrscale_enable(device);
+	else
+		kgsl_pwrscale_disable(device, false);
+
+	mutex_unlock(&device->mutex);
+
+	return count;
+}
+
+static ssize_t pwrscale_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrscale *psc = &device->pwrscale;
+
+	return scnprintf(buf, PAGE_SIZE, "%u\n", psc->enabled);
+}
+
+static DEVICE_ATTR_RO(temp);
+static DEVICE_ATTR_RW(gpuclk);
+static DEVICE_ATTR_RW(max_gpuclk);
+static DEVICE_ATTR_RW(idle_timer);
+static DEVICE_ATTR_RW(minbw_timer);
+static DEVICE_ATTR_RO(gpubusy);
+static DEVICE_ATTR_RO(gpu_available_frequencies);
+static DEVICE_ATTR_RO(gpu_clock_stats);
+static DEVICE_ATTR_RW(max_pwrlevel);
+static DEVICE_ATTR_RW(min_pwrlevel);
+static DEVICE_ATTR_RW(thermal_pwrlevel);
+static DEVICE_ATTR_RO(num_pwrlevels);
+static DEVICE_ATTR_RO(reset_count);
+static DEVICE_ATTR_RW(force_clk_on);
+static DEVICE_ATTR_RW(force_bus_on);
+static DEVICE_ATTR_RW(force_rail_on);
+static DEVICE_ATTR_RW(bus_split);
+static DEVICE_ATTR_RW(default_pwrlevel);
+static DEVICE_ATTR_RO(popp);
+static DEVICE_ATTR_RW(force_no_nap);
+static DEVICE_ATTR_RO(gpu_busy_percentage);
+static DEVICE_ATTR_RW(min_clock_mhz);
+static DEVICE_ATTR_RW(max_clock_mhz);
+static DEVICE_ATTR_RO(clock_mhz);
+static DEVICE_ATTR_RO(freq_table_mhz);
+static DEVICE_ATTR_RW(pwrscale);
+
+static const struct attribute *pwrctrl_attr_list[] = {
+	&dev_attr_gpuclk.attr,
+	&dev_attr_max_gpuclk.attr,
+	&dev_attr_idle_timer.attr,
+	&dev_attr_minbw_timer.attr,
+	&dev_attr_gpubusy.attr,
+	&dev_attr_gpu_available_frequencies.attr,
+	&dev_attr_gpu_clock_stats.attr,
+	&dev_attr_max_pwrlevel.attr,
+	&dev_attr_min_pwrlevel.attr,
+	&dev_attr_thermal_pwrlevel.attr,
+	&dev_attr_num_pwrlevels.attr,
+	&dev_attr_reset_count.attr,
+	&dev_attr_force_clk_on.attr,
+	&dev_attr_force_bus_on.attr,
+	&dev_attr_force_rail_on.attr,
+	&dev_attr_force_no_nap.attr,
+	&dev_attr_bus_split.attr,
+	&dev_attr_default_pwrlevel.attr,
+	&dev_attr_popp.attr,
+	&dev_attr_gpu_busy_percentage.attr,
+	&dev_attr_min_clock_mhz.attr,
+	&dev_attr_max_clock_mhz.attr,
+	&dev_attr_clock_mhz.attr,
+	&dev_attr_freq_table_mhz.attr,
+	&dev_attr_temp.attr,
+	&dev_attr_pwrscale.attr,
+	NULL,
+};
+
+static GPU_SYSFS_ATTR(gpu_busy, 0444, _gpu_busy_show, NULL);
+static GPU_SYSFS_ATTR(gpu_min_clock, 0644, _min_clock_mhz_show,
+		_min_clock_mhz_store);
+static GPU_SYSFS_ATTR(gpu_max_clock, 0644, _max_clock_mhz_show,
+		_max_clock_mhz_store);
+static GPU_SYSFS_ATTR(gpu_clock, 0444, _clock_mhz_show, NULL);
+static GPU_SYSFS_ATTR(gpu_freq_table, 0444, _freq_table_mhz_show, NULL);
+static GPU_SYSFS_ATTR(gpu_tmu, 0444, _gpu_tmu_show, NULL);
+
+static const struct attribute *gpu_sysfs_attr_list[] = {
+	&gpu_sysfs_attr_gpu_busy.attr,
+	&gpu_sysfs_attr_gpu_min_clock.attr,
+	&gpu_sysfs_attr_gpu_max_clock.attr,
+	&gpu_sysfs_attr_gpu_clock.attr,
+	&gpu_sysfs_attr_gpu_freq_table.attr,
+	&gpu_sysfs_attr_gpu_tmu.attr,
+	NULL,
+};
+
+int kgsl_pwrctrl_init_sysfs(struct kgsl_device *device)
+{
+	int ret;
+
+	ret = sysfs_create_files(&device->dev->kobj, pwrctrl_attr_list);
+	if (ret)
+		return ret;
+
+	if (!device->gpu_sysfs_kobj.state_in_sysfs)
+		return 0;
+
+	return sysfs_create_files(&device->gpu_sysfs_kobj, gpu_sysfs_attr_list);
+}
+
+/*
+ * Track the amount of time the gpu is on vs the total system time.
+ * Regularly update the percentage of busy time displayed by sysfs.
+ */
+void kgsl_pwrctrl_busy_time(struct kgsl_device *device, u64 time, u64 busy)
+{
+	struct kgsl_clk_stats *stats = &device->pwrctrl.clk_stats;
+
+	stats->total += time;
+	stats->busy += busy;
+
+	if (stats->total < UPDATE_BUSY_VAL)
+		return;
+
+	/* Update the output regularly and reset the counters. */
+	stats->total_old = stats->total;
+	stats->busy_old = stats->busy;
+	stats->total = 0;
+	stats->busy = 0;
+
+	trace_kgsl_gpubusy(device, stats->busy_old, stats->total_old);
+}
+
+static void kgsl_pwrctrl_clk(struct kgsl_device *device, bool state,
+					  int requested_state)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int i = 0;
+
+	if (gmu_core_gpmu_isenabled(device))
+		return;
+	if (test_bit(KGSL_PWRFLAGS_CLK_ON, &pwr->ctrl_flags))
+		return;
+
+	if (!state) {
+		if (test_and_clear_bit(KGSL_PWRFLAGS_CLK_ON,
+			&pwr->power_flags)) {
+			trace_kgsl_clk(device, state,
+					kgsl_pwrctrl_active_freq(pwr));
+			/* Disable gpu-bimc-interface clocks */
+			if (pwr->gpu_bimc_int_clk &&
+					pwr->gpu_bimc_interface_enabled) {
+				clk_disable_unprepare(pwr->gpu_bimc_int_clk);
+				pwr->gpu_bimc_interface_enabled = false;
+			}
+
+			for (i = KGSL_MAX_CLKS - 1; i > 0; i--)
+				clk_disable(pwr->grp_clks[i]);
+			/* High latency clock maintenance. */
+			if (pwr->pwrlevels[0].gpu_freq > 0) {
+				for (i = KGSL_MAX_CLKS - 1; i > 0; i--)
+					clk_unprepare(pwr->grp_clks[i]);
+				device->ftbl->gpu_clock_set(device,
+						pwr->num_pwrlevels - 1);
+				_isense_clk_set_rate(pwr,
+					pwr->num_pwrlevels - 1);
+			}
+
+			/* Turn off the IOMMU clocks */
+			kgsl_mmu_disable_clk(&device->mmu);
+		} else if (requested_state == KGSL_STATE_SLUMBER) {
+			/* High latency clock maintenance. */
+			for (i = KGSL_MAX_CLKS - 1; i > 0; i--)
+				clk_unprepare(pwr->grp_clks[i]);
+			if ((pwr->pwrlevels[0].gpu_freq > 0)) {
+				device->ftbl->gpu_clock_set(device,
+						pwr->num_pwrlevels - 1);
+				_isense_clk_set_rate(pwr,
+					pwr->num_pwrlevels - 1);
+			}
+		}
+	} else {
+		if (!test_and_set_bit(KGSL_PWRFLAGS_CLK_ON,
+			&pwr->power_flags)) {
+			trace_kgsl_clk(device, state,
+					kgsl_pwrctrl_active_freq(pwr));
+
+			if (pwr->pwrlevels[0].gpu_freq > 0) {
+				device->ftbl->gpu_clock_set(device,
+						pwr->active_pwrlevel);
+				_isense_clk_set_rate(pwr,
+					pwr->active_pwrlevel);
+			}
+
+			for (i = KGSL_MAX_CLKS - 1; i > 0; i--)
+				_gpu_clk_prepare_enable(device,
+						pwr->grp_clks[i], clocks[i]);
+
+			/* Enable the gpu-bimc-interface clocks */
+			if (pwr->gpu_bimc_int_clk) {
+				if (pwr->active_pwrlevel == 0 &&
+					!pwr->gpu_bimc_interface_enabled) {
+					kgsl_pwrctrl_clk_set_rate(
+						pwr->gpu_bimc_int_clk,
+						pwr->gpu_bimc_int_clk_freq,
+						"bimc_gpu_clk");
+					_bimc_clk_prepare_enable(device,
+						pwr->gpu_bimc_int_clk,
+						"bimc_gpu_clk");
+					pwr->gpu_bimc_interface_enabled = true;
+				}
+			}
+
+			/* Turn on the IOMMU clocks */
+			kgsl_mmu_enable_clk(&device->mmu);
+		}
+
+	}
+}
+
+int kgsl_pwrctrl_axi(struct kgsl_device *device, bool state)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	if (test_bit(KGSL_PWRFLAGS_AXI_ON, &pwr->ctrl_flags))
+		return 0;
+
+	if (!state) {
+		if (test_and_clear_bit(KGSL_PWRFLAGS_AXI_ON,
+			&pwr->power_flags)) {
+			trace_kgsl_bus(device, state);
+			return kgsl_bus_update(device, KGSL_BUS_VOTE_OFF);
+		}
+	} else {
+		if (!test_and_set_bit(KGSL_PWRFLAGS_AXI_ON,
+			&pwr->power_flags)) {
+			trace_kgsl_bus(device, state);
+			return kgsl_bus_update(device, KGSL_BUS_VOTE_ON);
+		}
+	}
+
+	return 0;
+}
+
+static int kgsl_genpd_disable_wait(struct device *dev, u32 timeout)
+{
+	ktime_t tout = ktime_add_us(ktime_get(), timeout * USEC_PER_MSEC);
+	int ret;
+
+	ret = pm_runtime_put_sync(dev);
+	if (ret < 0)
+		return ret;
+
+	for (;;) {
+		if (!kgsl_genpd_is_enabled(dev))
+			return 0;
+
+		if (ktime_compare(ktime_get(), tout) > 0)
+			return (!kgsl_genpd_is_enabled(dev) ? 0 : -ETIMEDOUT);
+
+		usleep_range((100 >> 2) + 1, 100);
+	}
+}
+
+static int kgsl_regulator_disable_wait(struct regulator *reg, u32 timeout)
+{
+	ktime_t tout = ktime_add_us(ktime_get(), timeout * USEC_PER_MSEC);
+	int ret;
+
+	ret = regulator_disable(reg);
+	if (ret)
+		return ret;
+
+	for (;;) {
+		if (!regulator_is_enabled(reg))
+			return 0;
+
+		if (ktime_compare(ktime_get(), tout) > 0)
+			return (!regulator_is_enabled(reg) ? 0 : -ETIMEDOUT);
+
+		usleep_range((100 >> 2) + 1, 100);
+	}
+}
+
+int kgsl_pwrctrl_enable_cx_gdsc(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret;
+
+	if (!pwr->cx_regulator && !pwr->cx_pd)
+		return 0;
+
+	ret = wait_for_completion_timeout(&pwr->cx_gdsc_gate, msecs_to_jiffies(5000));
+	if (!ret) {
+		/* Dump the cx regulator consumer list */
+		if (pwr->cx_regulator) {
+			dev_err(device->dev, "GPU CX wait timeout. Dumping CX votes:\n");
+			qcom_clk_dump(NULL, pwr->cx_regulator, false);
+		} else {
+			dev_err(device->dev, "GPU CX wait timeout\n");
+		}
+	}
+
+	if (pwr->cx_regulator)
+		ret = regulator_enable(pwr->cx_regulator);
+	else
+		ret = pm_runtime_resume_and_get(pwr->cx_pd);
+
+	if (ret)
+		dev_err(device->dev, "Failed to enable CX gdsc, error %d\n", ret);
+
+	kgsl_mmu_send_tlb_hint(&device->mmu, false);
+	pwr->cx_gdsc_wait = false;
+	return ret;
+}
+
+int kgsl_pwrctrl_enable_gx_gdsc(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret;
+
+	if (!pwr->gx_regulator && !pwr->gx_pd)
+		return 0;
+
+	if (pwr->gx_regulator)
+		ret = regulator_enable(pwr->gx_regulator);
+	else
+		ret = pm_runtime_resume_and_get(pwr->gx_pd);
+
+	if (ret)
+		dev_err(device->dev, "Failed to enable GX gdsc, error %d\n", ret);
+
+	return ret;
+}
+
+void kgsl_pwrctrl_disable_cx_gdsc(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	if (!pwr->cx_regulator && !pwr->cx_pd)
+		return;
+
+	kgsl_mmu_send_tlb_hint(&device->mmu, true);
+	reinit_completion(&pwr->cx_gdsc_gate);
+	pwr->cx_gdsc_wait = true;
+
+	if (pwr->cx_regulator)
+		regulator_disable(pwr->cx_regulator);
+	else
+		pm_runtime_put_sync(pwr->cx_pd);
+}
+
+void kgsl_pwrctrl_disable_gx_gdsc(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret;
+
+	if (!pwr->gx_regulator && !pwr->gx_pd)
+		return;
+
+	if (pwr->gx_regulator)
+		ret = kgsl_regulator_disable_wait(pwr->gx_regulator, 200);
+	else
+		ret = kgsl_genpd_disable_wait(pwr->gx_pd, 200);
+
+	if (ret)
+		dev_err(device->dev, "vdd is stuck on, error %d\n", ret);
+}
+
+static int enable_gdscs(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret;
+
+	if (test_and_set_bit(KGSL_PWRFLAGS_POWER_ON, &pwr->power_flags))
+		return 0;
+
+	ret = kgsl_pwrctrl_enable_cx_gdsc(device);
+	if (!ret) {
+		/* Set parent in retention voltage to power up vdd supply */
+		ret = kgsl_regulator_set_voltage(device->dev,
+				pwr->gx_regulator_parent,
+				pwr->gx_regulator_parent_min_corner);
+		if (!ret)
+			ret = kgsl_pwrctrl_enable_gx_gdsc(device);
+	}
+
+	if (ret) {
+		clear_bit(KGSL_PWRFLAGS_POWER_ON, &pwr->power_flags);
+		return ret;
+	}
+
+	trace_kgsl_rail(device, KGSL_PWRFLAGS_POWER_ON);
+	return 0;
+}
+
+#ifdef CONFIG_QCOM_KGSL_UPSTREAM
+static int kgsl_device_link_add_cxpd_iommu(struct kgsl_device *device, struct platform_device *pdev)
+{
+	struct device_node *phandle;
+	struct platform_device *iommu_pdev;
+
+	phandle = of_parse_phandle(pdev->dev.of_node, "iommus", 0);
+
+	if (!phandle)
+		return -ENOENT;
+
+	iommu_pdev = of_find_device_by_node(phandle);
+
+	if (!iommu_pdev) {
+		of_node_put(phandle);
+		return -ENOENT;
+	}
+
+	/*
+	 * As part of runtime_resume PM callback, the smmu driver resets the device.
+	 * This creates problems if GPU is active and runtime_resume callback of
+	 * iommu device kicks in. Hence, add device link between the CX power domain
+	 * and iommu device to keep the iommu device active when GPU is active. This
+	 * is not needed when using downstream driver with qcom addons because reset
+	 * of the device is done only during resume PM callback.
+	 */
+	if (!device_link_add(device->pwrctrl.cx_pd, &iommu_pdev->dev, DL_FLAG_PM_RUNTIME |
+				DL_FLAG_AUTOREMOVE_SUPPLIER))
+		dev_err(device->dev,
+				"Unable to create device link between cxpd and iommu\n");
+
+	put_device(&iommu_pdev->dev);
+	of_node_put(phandle);
+
+	return 0;
+}
+#else
+static int kgsl_device_link_add_cxpd_iommu(struct kgsl_device *device, struct platform_device *pdev)
+{
+	return 0;
+}
+#endif
+
+static int kgsl_pwrctrl_probe_cx_gdsc(struct kgsl_device *device, struct platform_device *pdev)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	if (of_property_read_bool(pdev->dev.of_node, "power-domains")) {
+		/* Get virtual device handle for CX GDSC to control it */
+		struct device *cx_pd = dev_pm_domain_attach_by_name(&pdev->dev, "cx");
+
+		if (IS_ERR_OR_NULL(cx_pd)) {
+			dev_err_probe(&pdev->dev, PTR_ERR(cx_pd),
+					"Failed to attach cx power domain\n");
+			return IS_ERR(cx_pd) ? PTR_ERR(cx_pd) : -EINVAL;
+		}
+		pwr->cx_pd = cx_pd;
+
+		return kgsl_device_link_add_cxpd_iommu(device, pdev);
+	} else {
+		struct regulator *cx_regulator = devm_regulator_get(&pdev->dev, "vddcx");
+
+		if (IS_ERR(cx_regulator)) {
+			dev_err_probe(&pdev->dev, PTR_ERR(cx_regulator),
+					"Couldn't get the vddcx\n");
+			return PTR_ERR(cx_regulator);
+		}
+		pwr->cx_regulator = cx_regulator;
+	}
+
+	return 0;
+}
+
+static int kgsl_pwrctrl_probe_gx_gdsc(struct kgsl_device *device, struct platform_device *pdev)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	if (of_property_read_bool(pdev->dev.of_node, "power-domains")) {
+		/* Get virtual device handle for GX GDSC to control it */
+		struct device *gx_pd = dev_pm_domain_attach_by_name(&pdev->dev, "gx");
+
+		if (IS_ERR_OR_NULL(gx_pd)) {
+			dev_err_probe(&pdev->dev, PTR_ERR(gx_pd),
+					"Failed to attach gx power domain\n");
+			return IS_ERR(gx_pd) ? PTR_ERR(gx_pd) : -EINVAL;
+		}
+		pwr->gx_pd = gx_pd;
+	} else {
+		struct regulator *gx_regulator = devm_regulator_get(&pdev->dev, "vdd");
+
+		if (IS_ERR(gx_regulator)) {
+			dev_err_probe(&pdev->dev, PTR_ERR(gx_regulator),
+					"Couldn't get the vdd\n");
+			return PTR_ERR(gx_regulator);
+		}
+		pwr->gx_regulator = gx_regulator;
+	}
+
+	return 0;
+}
+
+int kgsl_pwrctrl_probe_gdscs(struct kgsl_device *device, struct platform_device *pdev)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int ret;
+
+	ret = kgsl_pwrctrl_probe_cx_gdsc(device, pdev);
+	if (ret)
+		return ret;
+
+	ret = kgsl_pwrctrl_probe_gx_gdsc(device, pdev);
+	if (ret && pwr->cx_pd) {
+		dev_pm_domain_detach(pwr->cx_pd, false);
+		pwr->cx_pd = NULL;
+	}
+
+	return ret;
+}
+
+static int kgsl_cx_gdsc_event(struct notifier_block *nb,
+	unsigned long event, void *data)
+{
+	struct kgsl_pwrctrl *pwr = container_of(nb, struct kgsl_pwrctrl, cx_gdsc_nb);
+	struct kgsl_device *device = container_of(pwr, struct kgsl_device, pwrctrl);
+	u32 val;
+
+	if (!pwr->cx_gdsc_wait)
+		return 0;
+
+	if (pwr->cx_pd && (event != GENPD_NOTIFY_OFF))
+		return 0;
+
+	if (pwr->cx_regulator && !(event & REGULATOR_EVENT_DISABLE))
+		return 0;
+
+	if (pwr->cx_gdsc_offset) {
+		if (kgsl_regmap_read_poll_timeout(&device->regmap, pwr->cx_gdsc_offset,
+			val, !(val & BIT(31)), 100, 100 * 1000))
+			dev_err(device->dev, "GPU CX wait timeout.\n");
+	}
+
+	pwr->cx_gdsc_wait = false;
+	complete_all(&pwr->cx_gdsc_gate);
+
+	return 0;
+}
+
+static int kgsl_register_gdsc_notifier(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	if (!pwr->cx_regulator && !pwr->cx_pd)
+		return 0;
+
+	pwr->cx_gdsc_nb.notifier_call = kgsl_cx_gdsc_event;
+	if (pwr->cx_regulator)
+		return devm_regulator_register_notifier(pwr->cx_regulator, &pwr->cx_gdsc_nb);
+
+	return dev_pm_genpd_add_notifier(pwr->cx_pd, &pwr->cx_gdsc_nb);
+}
+
+static int kgsl_pwrctrl_pwrrail(struct kgsl_device *device, bool state)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int status = 0;
+
+	if (gmu_core_gpmu_isenabled(device))
+		return 0;
+	/*
+	 * Disabling the regulator means also disabling dependent clocks.
+	 * Hence don't disable it if force clock ON is set.
+	 */
+	if (test_bit(KGSL_PWRFLAGS_POWER_ON, &pwr->ctrl_flags) ||
+		test_bit(KGSL_PWRFLAGS_CLK_ON, &pwr->ctrl_flags))
+		return 0;
+
+	if (!state) {
+		if (test_and_clear_bit(KGSL_PWRFLAGS_POWER_ON,
+			&pwr->power_flags)) {
+			kgsl_mmu_send_tlb_hint(&device->mmu, true);
+			trace_kgsl_rail(device, state);
+
+			/* Set the parent in retention voltage to disable CPR interrupts */
+			kgsl_regulator_set_voltage(device->dev, pwr->gx_regulator_parent,
+					pwr->gx_regulator_parent_min_corner);
+
+			kgsl_pwrctrl_disable_gx_gdsc(device);
+
+			/* Remove the vote for the vdd parent supply */
+			kgsl_regulator_set_voltage(device->dev, pwr->gx_regulator_parent, 0);
+
+			kgsl_pwrctrl_disable_cx_gdsc(device);
+		}
+	} else {
+		status = enable_gdscs(device);
+		kgsl_mmu_send_tlb_hint(&device->mmu, false);
+	}
+
+	return status;
+}
+
+void kgsl_pwrctrl_irq(struct kgsl_device *device, bool state)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	if (state) {
+		if (!test_and_set_bit(KGSL_PWRFLAGS_IRQ_ON,
+			&pwr->power_flags)) {
+			trace_kgsl_irq(device, state);
+			enable_irq(pwr->interrupt_num);
+		}
+	} else {
+		if (test_and_clear_bit(KGSL_PWRFLAGS_IRQ_ON,
+			&pwr->power_flags)) {
+			trace_kgsl_irq(device, state);
+			if (in_interrupt())
+				disable_irq_nosync(pwr->interrupt_num);
+			else
+				disable_irq(pwr->interrupt_num);
+		}
+	}
+}
+
+static int _get_clocks(struct kgsl_device *device)
+{
+	struct device *dev = &device->pdev->dev;
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	const char *name;
+	struct property *prop;
+
+	pwr->isense_clk_indx = 0;
+	of_property_for_each_string(dev->of_node, "clock-names", prop, name) {
+		int i;
+
+		for (i = 0; i < KGSL_MAX_CLKS; i++) {
+			if (pwr->grp_clks[i] || strcmp(clocks[i], name))
+				continue;
+			/* apb_pclk should only be enabled if QCOM_KGSL_QDSS_STM is enabled */
+			if (!strcmp(name, "apb_pclk") && !IS_ENABLED(CONFIG_QCOM_KGSL_QDSS_STM))
+				continue;
+
+			pwr->grp_clks[i] = devm_clk_get(dev, name);
+
+			if (IS_ERR(pwr->grp_clks[i])) {
+				int ret = PTR_ERR(pwr->grp_clks[i]);
+
+				dev_err(dev, "Couldn't get clock: %s (%d)\n",
+					name, ret);
+				pwr->grp_clks[i] = NULL;
+				return ret;
+			}
+
+			if (!strcmp(name, "isense_clk"))
+				pwr->isense_clk_indx = i;
+			break;
+		}
+	}
+
+	if (pwr->isense_clk_indx && of_property_read_u32(dev->of_node,
+		"qcom,isense-clk-on-level", &pwr->isense_clk_on_level)) {
+		dev_err(dev, "Couldn't get isense clock on level\n");
+		return -ENXIO;
+	}
+	return 0;
+}
+
+static int _isense_clk_set_rate(struct kgsl_pwrctrl *pwr, int level)
+{
+	int rate;
+
+	if (!pwr->isense_clk_indx)
+		return -EINVAL;
+
+	rate = clk_round_rate(pwr->grp_clks[pwr->isense_clk_indx],
+		level > pwr->isense_clk_on_level ?
+		KGSL_XO_CLK_FREQ : KGSL_ISENSE_CLK_FREQ);
+	return kgsl_pwrctrl_clk_set_rate(pwr->grp_clks[pwr->isense_clk_indx],
+			rate, clocks[pwr->isense_clk_indx]);
+}
+
+/*
+ * _gpu_clk_prepare_enable - Enable the specified GPU clock
+ * Try once to enable it and then BUG() for debug
+ */
+static void _gpu_clk_prepare_enable(struct kgsl_device *device,
+		struct clk *clk, const char *name)
+{
+	int ret = clk_prepare_enable(clk);
+
+	if (ret)
+		dev_err(device->dev, "GPU Clock %s enable error:%d\n", name, ret);
+}
+
+/*
+ * _bimc_clk_prepare_enable - Enable the specified GPU clock
+ *  Try once to enable it and then BUG() for debug
+ */
+static void _bimc_clk_prepare_enable(struct kgsl_device *device,
+		struct clk *clk, const char *name)
+{
+	int ret = clk_prepare_enable(clk);
+	/* Failure is fatal so BUG() to facilitate debug */
+	if (ret)
+		dev_err(device->dev, "GPU clock %s enable error:%d\n",
+				name, ret);
+}
+
+static int kgsl_pwrctrl_clk_set_rate(struct clk *grp_clk, unsigned int freq,
+		const char *name)
+{
+	int ret = clk_set_rate(grp_clk, freq);
+
+	WARN(ret, "%s set freq %d failed:%d\n", name, freq, ret);
+	return ret;
+}
+
+int kgsl_pwrctrl_init(struct kgsl_device *device)
+{
+	int i, result, freq;
+	struct platform_device *pdev = device->pdev;
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	result = _get_clocks(device);
+	if (result)
+		return result;
+
+	/* Make sure we have a source clk for freq setting */
+	if (pwr->grp_clks[0] == NULL)
+		pwr->grp_clks[0] = pwr->grp_clks[1];
+
+	/* Getting gfx-bimc-interface-clk frequency */
+	if (!of_property_read_u32(pdev->dev.of_node,
+			"qcom,gpu-bimc-interface-clk-freq",
+			&pwr->gpu_bimc_int_clk_freq))
+		pwr->gpu_bimc_int_clk = devm_clk_get(&pdev->dev,
+					"bimc_gpu_clk");
+
+	if (pwr->num_pwrlevels == 0) {
+		dev_err(device->dev, "No power levels are defined\n");
+		return -EINVAL;
+	}
+
+	init_waitqueue_head(&device->active_cnt_wq);
+
+	/* Initialize the thermal clock constraints */
+	pwr->thermal_pwrlevel = 0;
+	pwr->thermal_pwrlevel_floor = pwr->num_pwrlevels - 1;
+
+	result = dev_pm_qos_add_request(&pdev->dev, &pwr->sysfs_thermal_req,
+			DEV_PM_QOS_MAX_FREQUENCY,
+			PM_QOS_MAX_FREQUENCY_DEFAULT_VALUE);
+	if (result < 0)
+		dev_err(device->dev, "PM QoS thermal request failed:%d\n", result);
+
+	for (i = 0; i < pwr->num_pwrlevels; i++) {
+		freq = pwr->pwrlevels[i].gpu_freq;
+
+		if (freq > 0)
+			freq = clk_round_rate(pwr->grp_clks[0], freq);
+
+		if (freq >= pwr->pwrlevels[i].gpu_freq)
+			pwr->pwrlevels[i].gpu_freq = freq;
+	}
+
+	clk_set_rate(pwr->grp_clks[0],
+		pwr->pwrlevels[pwr->num_pwrlevels - 1].gpu_freq);
+
+	freq = clk_round_rate(pwr->grp_clks[6], KGSL_XO_CLK_FREQ);
+	if (freq > 0)
+		kgsl_pwrctrl_clk_set_rate(pwr->grp_clks[6],
+			freq, clocks[6]);
+
+	_isense_clk_set_rate(pwr, pwr->num_pwrlevels - 1);
+
+	if (of_property_read_bool(pdev->dev.of_node, "vddcx-supply") ||
+		(of_property_match_string(pdev->dev.of_node, "power-domain-names", "cx") >= 0))
+		kgsl_pwrctrl_probe_cx_gdsc(device, pdev);
+
+	if (of_property_read_bool(pdev->dev.of_node, "vdd-supply") ||
+		(of_property_match_string(pdev->dev.of_node, "power-domain-names", "gx") >= 0))
+		kgsl_pwrctrl_probe_gx_gdsc(device, pdev);
+
+	if (of_property_read_bool(pdev->dev.of_node, "vdd-parent-supply")) {
+		pwr->gx_regulator_parent = devm_regulator_get(&pdev->dev,
+				"vdd-parent");
+		if (IS_ERR(pwr->gx_regulator_parent)) {
+			dev_err(device->dev,
+				"Failed to get vdd-parent regulator:%ld\n",
+				PTR_ERR(pwr->gx_regulator_parent));
+			return -ENODEV;
+		}
+		if (of_property_read_u32(pdev->dev.of_node,
+					"vdd-parent-min-corner",
+					&pwr->gx_regulator_parent_min_corner)) {
+			dev_err(device->dev,
+				"vdd-parent-min-corner not found\n");
+			return -ENODEV;
+		}
+	}
+
+	init_completion(&pwr->cx_gdsc_gate);
+	complete_all(&pwr->cx_gdsc_gate);
+
+	result = kgsl_register_gdsc_notifier(device);
+	if (result) {
+		dev_err(&pdev->dev, "Failed to register gdsc notifier: %d\n", result);
+		return result;
+	}
+
+	pwr->power_flags = 0;
+
+	pm_runtime_enable(&pdev->dev);
+
+	return 0;
+}
+
+void kgsl_pwrctrl_close(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	pwr->power_flags = 0;
+
+	if (dev_pm_qos_request_active(&pwr->sysfs_thermal_req))
+		dev_pm_qos_remove_request(&pwr->sysfs_thermal_req);
+
+	pm_runtime_disable(&device->pdev->dev);
+
+	if (pwr->cx_pd) {
+		dev_pm_genpd_remove_notifier(pwr->cx_pd);
+		dev_pm_domain_detach(pwr->cx_pd, false);
+		pwr->cx_pd = NULL;
+	}
+
+	if (pwr->gx_pd) {
+		dev_pm_domain_detach(pwr->gx_pd, false);
+		pwr->gx_pd = NULL;
+	}
+}
+
+void kgsl_idle_check(struct work_struct *work)
+{
+	struct kgsl_device *device = container_of(work, struct kgsl_device,
+							idle_check_ws);
+	int ret = 0;
+	unsigned int requested_state;
+
+	mutex_lock(&device->mutex);
+
+	/*
+	 * After scheduling idle work for transitioning to SLUMBER, it's
+	 * possbile that requested state can change to NONE if any new workload
+	 * comes before kgsl_idle_check is executed or it gets the device mutex.
+	 * In such case, no need to change state to NONE.
+	 */
+	if (device->requested_state == KGSL_STATE_NONE) {
+		mutex_unlock(&device->mutex);
+		return;
+	}
+
+	requested_state = device->requested_state;
+
+	if (device->state == KGSL_STATE_ACTIVE) {
+
+		if (!atomic_read(&device->active_cnt)) {
+			spin_lock(&device->submit_lock);
+			if (device->submit_now) {
+				spin_unlock(&device->submit_lock);
+				goto done;
+			}
+			/* Don't allow GPU inline submission in SLUMBER */
+			if (requested_state == KGSL_STATE_SLUMBER)
+				device->skip_inline_submit = true;
+			spin_unlock(&device->submit_lock);
+
+			ret = kgsl_pwrctrl_change_state(device,
+					device->requested_state);
+			if (ret == -EBUSY) {
+				if (requested_state == KGSL_STATE_SLUMBER) {
+					spin_lock(&device->submit_lock);
+					device->skip_inline_submit = false;
+					spin_unlock(&device->submit_lock);
+				}
+				/*
+				 * If the GPU is currently busy, restore
+				 * the requested state and reschedule
+				 * idle work.
+				 */
+				kgsl_pwrctrl_request_state(device,
+					requested_state);
+				kgsl_schedule_work(&device->idle_check_ws);
+			}
+		}
+done:
+		if (!ret)
+			kgsl_pwrctrl_request_state(device, KGSL_STATE_NONE);
+
+		if (device->state == KGSL_STATE_ACTIVE)
+			kgsl_start_idle_timer(device);
+	}
+
+	kgsl_pwrscale_update(device);
+	mutex_unlock(&device->mutex);
+}
+
+void kgsl_timer(struct timer_list *t)
+{
+	struct kgsl_device *device = from_timer(device, t, idle_timer);
+
+	if (device->requested_state != KGSL_STATE_SUSPEND) {
+		kgsl_pwrctrl_request_state(device, KGSL_STATE_SLUMBER);
+		/* Have work run in a non-interrupt context. */
+		kgsl_schedule_work(&device->idle_check_ws);
+	}
+}
+
+static bool kgsl_pwrctrl_isenabled(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+
+	return ((test_bit(KGSL_PWRFLAGS_CLK_ON, &pwr->power_flags) != 0) &&
+		(test_bit(KGSL_PWRFLAGS_AXI_ON, &pwr->power_flags) != 0));
+}
+
+/**
+ * kgsl_pre_hwaccess - Enforce preconditions for touching registers
+ * @device: The device
+ *
+ * This function ensures that the correct lock is held and that the GPU
+ * clock is on immediately before a register is read or written. Note
+ * that this function does not check active_cnt because the registers
+ * must be accessed during device start and stop, when the active_cnt
+ * may legitimately be 0.
+ */
+void kgsl_pre_hwaccess(struct kgsl_device *device)
+{
+	/* In order to touch a register you must hold the device mutex */
+	WARN_ON(!mutex_is_locked(&device->mutex));
+
+	/*
+	 * A register access without device power will cause a fatal timeout.
+	 * This is not valid for targets with a GMU.
+	 */
+	if (!gmu_core_gpmu_isenabled(device))
+		WARN_ON(!kgsl_pwrctrl_isenabled(device));
+}
+
+static int kgsl_pwrctrl_enable(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int level, status;
+
+	level = pwr->default_pwrlevel;
+
+	kgsl_pwrctrl_pwrlevel_change(device, level);
+
+	/* Order pwrrail/clk sequence based upon platform */
+	status = kgsl_pwrctrl_pwrrail(device, true);
+	if (status)
+		return status;
+	kgsl_pwrctrl_clk(device, true, KGSL_STATE_ACTIVE);
+	kgsl_pwrctrl_axi(device, true);
+
+	return device->ftbl->regulator_enable(device);
+}
+
+void kgsl_pwrctrl_clear_l3_vote(struct kgsl_device *device)
+{
+	int status;
+	struct dcvs_freq freq = {0};
+
+	if (!device->num_l3_pwrlevels)
+		return;
+
+	freq.hw_type = DCVS_L3;
+
+	status = qcom_dcvs_update_votes(KGSL_L3_DEVICE, &freq, 1,
+			DCVS_SLOW_PATH);
+	if (!status)
+		device->cur_l3_pwrlevel = 0;
+	else
+		dev_err(device->dev, "Could not clear l3_vote: %d\n",
+			     status);
+}
+
+static void kgsl_pwrctrl_disable(struct kgsl_device *device)
+{
+	kgsl_pwrctrl_clear_l3_vote(device);
+
+	/* Order pwrrail/clk sequence based upon platform */
+	device->ftbl->regulator_disable(device);
+	kgsl_pwrctrl_axi(device, false);
+	kgsl_pwrctrl_clk(device, false, KGSL_STATE_SLUMBER);
+	kgsl_pwrctrl_pwrrail(device, false);
+}
+
+/**
+ * _init() - Get the GPU ready to start, but don't turn anything on
+ * @device - Pointer to the kgsl_device struct
+ */
+static int _init(struct kgsl_device *device)
+{
+	int status = 0;
+
+	switch (device->state) {
+	case KGSL_STATE_ACTIVE:
+		kgsl_pwrctrl_irq(device, false);
+		del_timer_sync(&device->idle_timer);
+		device->ftbl->stop(device);
+		fallthrough;
+	case KGSL_STATE_AWARE:
+		kgsl_pwrctrl_disable(device);
+		fallthrough;
+	case KGSL_STATE_SLUMBER:
+		fallthrough;
+	case KGSL_STATE_NONE:
+		kgsl_pwrctrl_set_state(device, KGSL_STATE_INIT);
+	}
+
+	return status;
+}
+
+/**
+ * _wake() - Power up the GPU from a slumber state
+ * @device - Pointer to the kgsl_device struct
+ *
+ * Resume the GPU from a lower power state to ACTIVE.
+ */
+static int _wake(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	int status = 0;
+
+	switch (device->state) {
+	case KGSL_STATE_SUSPEND:
+		complete_all(&device->hwaccess_gate);
+		/* Call the GPU specific resume function */
+		device->ftbl->resume(device);
+		fallthrough;
+	case KGSL_STATE_SLUMBER:
+		status = device->ftbl->start(device,
+				device->pwrctrl.superfast);
+		device->pwrctrl.superfast = false;
+
+		if (status) {
+			kgsl_pwrctrl_request_state(device, KGSL_STATE_NONE);
+			dev_err(device->dev, "start failed %d\n", status);
+			break;
+		}
+		kgsl_pwrctrl_axi(device, true);
+		kgsl_pwrscale_wake(device);
+		kgsl_pwrctrl_irq(device, true);
+		trace_gpu_frequency(
+			pwr->pwrlevels[pwr->active_pwrlevel].gpu_freq/1000, 0);
+
+		kgsl_bus_update(device, KGSL_BUS_VOTE_ON);
+
+		/* Turn on the core clocks */
+		kgsl_pwrctrl_clk(device, true, KGSL_STATE_ACTIVE);
+
+		device->ftbl->deassert_gbif_halt(device);
+		pwr->last_stat_updated = ktime_get();
+		/*
+		 * No need to turn on/off irq here as it no longer affects
+		 * power collapse
+		 */
+		kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+
+		/* All settings for power level transitions are complete*/
+		pwr->previous_pwrlevel = pwr->active_pwrlevel;
+		kgsl_start_idle_timer(device);
+		break;
+	case KGSL_STATE_AWARE:
+		/* Enable state before turning on irq */
+		kgsl_pwrctrl_set_state(device, KGSL_STATE_ACTIVE);
+		kgsl_pwrctrl_irq(device, true);
+		kgsl_start_idle_timer(device);
+		break;
+	default:
+		dev_warn(device->dev, "unhandled state %s\n",
+				kgsl_pwrstate_to_str(device->state));
+		kgsl_pwrctrl_request_state(device, KGSL_STATE_NONE);
+		status = -EINVAL;
+		break;
+	}
+	return status;
+}
+
+/*
+ * _aware() - Put device into AWARE
+ * @device: Device pointer
+ *
+ * The GPU should be available for register reads/writes and able
+ * to communicate with the rest of the system.  However disable all
+ * paths that allow a switch to an interrupt context (interrupts &
+ * timers).
+ * Return 0 on success else error code
+ */
+static int
+_aware(struct kgsl_device *device)
+{
+	int status = 0;
+
+	switch (device->state) {
+	case KGSL_STATE_INIT:
+		status = kgsl_pwrctrl_enable(device);
+		break;
+	case KGSL_STATE_ACTIVE:
+		kgsl_pwrctrl_irq(device, false);
+		del_timer_sync(&device->idle_timer);
+		break;
+	case KGSL_STATE_SLUMBER:
+		status = kgsl_pwrctrl_enable(device);
+		break;
+	default:
+		status = -EINVAL;
+	}
+
+	if (!status)
+		kgsl_pwrctrl_set_state(device, KGSL_STATE_AWARE);
+
+	return status;
+}
+
+static int
+_slumber(struct kgsl_device *device)
+{
+	int status = 0;
+
+	switch (device->state) {
+	case KGSL_STATE_ACTIVE:
+		if (!device->ftbl->is_hw_collapsible(device)) {
+			kgsl_pwrctrl_request_state(device, KGSL_STATE_NONE);
+			return -EBUSY;
+		}
+		del_timer_sync(&device->idle_timer);
+		kgsl_pwrctrl_irq(device, false);
+		/* make sure power is on to stop the device*/
+		status = kgsl_pwrctrl_enable(device);
+		device->ftbl->suspend_context(device);
+		device->ftbl->stop(device);
+		kgsl_pwrctrl_disable(device);
+		kgsl_pwrscale_sleep(device);
+		trace_gpu_frequency(0, 0);
+		kgsl_pwrctrl_set_state(device, KGSL_STATE_SLUMBER);
+		break;
+	case KGSL_STATE_SUSPEND:
+		complete_all(&device->hwaccess_gate);
+		device->ftbl->resume(device);
+		kgsl_pwrctrl_set_state(device, KGSL_STATE_SLUMBER);
+		break;
+	case KGSL_STATE_AWARE:
+		kgsl_pwrctrl_disable(device);
+		trace_gpu_frequency(0, 0);
+		kgsl_pwrctrl_set_state(device, KGSL_STATE_SLUMBER);
+		break;
+	default:
+		kgsl_pwrctrl_request_state(device, KGSL_STATE_NONE);
+		break;
+
+	}
+	return status;
+}
+
+/*
+ * _suspend() - Put device into suspend
+ * @device: Device pointer
+ *
+ * Return 0 on success else error code
+ */
+static int _suspend(struct kgsl_device *device)
+{
+	int ret = 0;
+
+	if ((device->state == KGSL_STATE_NONE) ||
+			(device->state == KGSL_STATE_INIT) ||
+			(device->state == KGSL_STATE_SUSPEND))
+		return ret;
+
+	/*
+	 * drain to prevent from more commands being submitted
+	 * and wait for it to go idle
+	 */
+	ret = device->ftbl->drain_and_idle(device);
+	if (ret)
+		goto err;
+
+	ret = _slumber(device);
+	if (ret)
+		goto err;
+
+	kgsl_pwrctrl_set_state(device, KGSL_STATE_SUSPEND);
+	return ret;
+
+err:
+	device->ftbl->resume(device);
+	dev_err(device->dev, "device failed to SUSPEND %d\n", ret);
+	return ret;
+}
+
+/*
+ * kgsl_pwrctrl_change_state() changes the GPU state to the input
+ * @device: Pointer to a KGSL device
+ * @state: desired KGSL state
+ *
+ * Caller must hold the device mutex. If the requested state change
+ * is valid, execute it.  Otherwise return an error code explaining
+ * why the change has not taken place.  Also print an error if an
+ * unexpected state change failure occurs.  For example, a change to
+ * SLUMBER may be rejected because the GPU is busy, this is not an error.
+ * A change to SUSPEND should go through no matter what, so if it
+ * fails an additional error message will be printed to dmesg.
+ */
+int kgsl_pwrctrl_change_state(struct kgsl_device *device, int state)
+{
+	int status = 0;
+
+	if (device->state == state)
+		return status;
+	kgsl_pwrctrl_request_state(device, state);
+
+	/* Work through the legal state transitions */
+	switch (state) {
+	case KGSL_STATE_INIT:
+		status = _init(device);
+		break;
+	case KGSL_STATE_AWARE:
+		status = _aware(device);
+		break;
+	case KGSL_STATE_ACTIVE:
+		status = _wake(device);
+		break;
+	case KGSL_STATE_SLUMBER:
+		status = _slumber(device);
+		break;
+	case KGSL_STATE_SUSPEND:
+		status = _suspend(device);
+		break;
+	default:
+		dev_err(device->dev, "bad state request 0x%x\n", state);
+		kgsl_pwrctrl_request_state(device, KGSL_STATE_NONE);
+		status = -EINVAL;
+		break;
+	}
+
+	return status;
+}
+
+void kgsl_pwrctrl_set_state(struct kgsl_device *device,
+				unsigned int state)
+{
+	trace_kgsl_pwr_set_state(device, state);
+	device->state = state;
+	device->requested_state = KGSL_STATE_NONE;
+
+	spin_lock(&device->submit_lock);
+	if (state == KGSL_STATE_ACTIVE)
+		device->skip_inline_submit = false;
+	else
+		device->skip_inline_submit = true;
+	spin_unlock(&device->submit_lock);
+}
+
+void kgsl_pwrctrl_request_state(struct kgsl_device *device,
+				unsigned int state)
+{
+	if (state != KGSL_STATE_NONE && state != device->requested_state)
+		trace_kgsl_pwr_request_state(device, state);
+	device->requested_state = state;
+}
+
+const char *kgsl_pwrstate_to_str(unsigned int state)
+{
+	switch (state) {
+	case KGSL_STATE_NONE:
+		return "NONE";
+	case KGSL_STATE_INIT:
+		return "INIT";
+	case KGSL_STATE_AWARE:
+		return "AWARE";
+	case KGSL_STATE_ACTIVE:
+		return "ACTIVE";
+	case KGSL_STATE_SUSPEND:
+		return "SUSPEND";
+	case KGSL_STATE_SLUMBER:
+		return "SLUMBER";
+	default:
+		break;
+	}
+	return "UNKNOWN";
+}
+
+static int _check_active_count(struct kgsl_device *device, int count)
+{
+	/* Return 0 if the active count is greater than the desired value */
+	return atomic_read(&device->active_cnt) > count ? 0 : 1;
+}
+
+int kgsl_active_count_wait(struct kgsl_device *device, int count,
+	unsigned long wait_jiffies)
+{
+	int result = 0;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return -EINVAL;
+
+	while (atomic_read(&device->active_cnt) > count) {
+		long ret;
+
+		mutex_unlock(&device->mutex);
+		ret = wait_event_timeout(device->active_cnt_wq,
+			_check_active_count(device, count), wait_jiffies);
+		mutex_lock(&device->mutex);
+		result = ret == 0 ? -ETIMEDOUT : 0;
+		if (!result)
+			wait_jiffies = ret;
+		else
+			break;
+	}
+
+	return result;
+}
+
+/**
+ * kgsl_pwrctrl_set_default_gpu_pwrlevel() - Set GPU to default power level
+ * @device: Pointer to the kgsl_device struct
+ */
+int kgsl_pwrctrl_set_default_gpu_pwrlevel(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	unsigned int new_level = pwr->default_pwrlevel;
+	unsigned int old_level = pwr->active_pwrlevel;
+
+	/*
+	 * Update the level according to any thermal,
+	 * max/min, or power constraints.
+	 */
+	new_level = kgsl_pwrctrl_adjust_pwrlevel(device, new_level);
+
+	pwr->active_pwrlevel = new_level;
+	pwr->previous_pwrlevel = old_level;
+
+	/* Request adjusted DCVS level */
+	return device->ftbl->gpu_clock_set(device, pwr->active_pwrlevel);
+}
+
+int kgsl_gpu_num_freqs(void)
+{
+	struct kgsl_device *device = kgsl_get_device(0);
+
+	if (!device)
+		return -ENODEV;
+
+	return device->pwrctrl.num_pwrlevels;
+}
+EXPORT_SYMBOL(kgsl_gpu_num_freqs);
+
+int kgsl_gpu_stat(struct kgsl_gpu_freq_stat *stats, u32 numfreq)
+{
+	struct kgsl_device *device = kgsl_get_device(0);
+	struct kgsl_pwrctrl *pwr;
+	int i;
+
+	if (!device)
+		return -ENODEV;
+
+	pwr = &device->pwrctrl;
+
+	if (!stats || (numfreq < pwr->num_pwrlevels))
+		return -EINVAL;
+
+	mutex_lock(&device->mutex);
+	kgsl_pwrscale_update_stats(device);
+
+	for (i = 0; i < pwr->num_pwrlevels; i++) {
+		stats[i].freq = pwr->pwrlevels[i].gpu_freq;
+		stats[i].active_time = pwr->clock_times[i];
+		stats[i].idle_time = pwr->time_in_pwrlevel[i] - pwr->clock_times[i];
+	}
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+EXPORT_SYMBOL(kgsl_gpu_stat);
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_pwrctrl.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_pwrctrl.h
@@ -0,0 +1,320 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2010-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_PWRCTRL_H
+#define __KGSL_PWRCTRL_H
+
+#include <linux/clk.h>
+#include <linux/pm_qos.h>
+
+/*****************************************************************************
+ * power flags
+ ****************************************************************************/
+#define KGSL_MAX_CLKS 18
+
+#define KGSL_MAX_PWRLEVELS 32
+
+#define KGSL_PWRFLAGS_POWER_ON 0
+#define KGSL_PWRFLAGS_CLK_ON   1
+#define KGSL_PWRFLAGS_AXI_ON   2
+#define KGSL_PWRFLAGS_IRQ_ON   3
+
+/* Use to enable all the force power on states at once */
+#define KGSL_PWR_ON GENMASK(5, 0)
+
+/* Only two supported levels, min & max */
+#define KGSL_CONSTRAINT_PWR_MAXLEVELS 2
+
+#define KGSL_XO_CLK_FREQ	19200000
+#define KGSL_ISENSE_CLK_FREQ	200000000
+
+struct platform_device;
+struct icc_path;
+
+struct kgsl_clk_stats {
+	unsigned int busy;
+	unsigned int total;
+	unsigned int busy_old;
+	unsigned int total_old;
+};
+
+struct kgsl_pwr_constraint {
+	unsigned int type;
+	unsigned int sub_type;
+	unsigned long expires;
+	uint32_t owner_id;
+	u32 owner_timestamp;
+};
+
+/**
+ * struct kgsl_pwrlevel - Struct holding different pwrlevel info obtained from
+ * from dtsi file
+ * @gpu_freq:          GPU frequency vote in Hz
+ * @bus_freq:          Bus bandwidth vote index
+ * @bus_min:           Min bus index @gpu_freq
+ * @bus_max:           Max bus index @gpu_freq
+ */
+struct kgsl_pwrlevel {
+	unsigned int gpu_freq;
+	unsigned int bus_freq;
+	unsigned int bus_min;
+	unsigned int bus_max;
+	unsigned int acd_level;
+	/** @cx_level: CX vote */
+	u32 cx_level;
+	/** @voltage_level: Voltage level used by the GMU to vote RPMh */
+	u32 voltage_level;
+};
+
+/**
+ * struct kgsl_pwrctrl - Power control settings for a KGSL device
+ * @interrupt_num - The interrupt number for the device
+ * @grp_clks - Array of clocks structures that we control
+ * @power_flags - Control flags for power
+ * @pwrlevels - List of supported power levels
+ * @active_pwrlevel - The currently active power level
+ * @previous_pwrlevel - The power level before transition
+ * @thermal_pwrlevel - maximum powerlevel constraint from thermal
+ * @thermal_pwrlevel_floor - minimum powerlevel constraint from thermal
+ * @default_pwrlevel - device wake up power level
+ * @max_pwrlevel - maximum allowable powerlevel per the user
+ * @min_pwrlevel - minimum allowable powerlevel per the user
+ * @num_pwrlevels - number of available power levels
+ * @throttle_mask - LM throttle mask
+ * @interval_timeout - timeout to be idle before a power event
+ * @clock_times - Each GPU frequency's accumulated active time in us
+ * @clk_stats - structure of clock statistics
+ * @input_disable - To disable GPU wakeup on touch input event
+ * @bus_control - true if the bus calculation is independent
+ * @bus_mod - modifier from the current power level for the bus vote
+ * @bus_percent_ab - current percent of total possible bus usage
+ * @bus_width - target specific bus width in number of bytes
+ * @bus_ab_mbytes - AB vote in Mbytes for current bus usage
+ * @constraint - currently active power constraint
+ * @superfast - Boolean flag to indicate that the GPU start should be run in the
+ * higher priority thread
+ * isense_clk_indx - index of isense clock, 0 if no isense
+ * isense_clk_on_level - isense clock rate is XO rate below this level.
+ */
+
+struct kgsl_pwrctrl {
+	int interrupt_num;
+	struct clk *grp_clks[KGSL_MAX_CLKS];
+	struct clk *gpu_bimc_int_clk;
+	/** @cx_regulator: Pointer to the CX domain regulator if applicable */
+	struct regulator *cx_regulator;
+	/** @gx_regulator: Pointer to the GX domain regulator if applicable */
+	struct regulator *gx_regulator;
+	/** @cx_pd: Power domain for controlling CX GDSC */
+	struct device *cx_pd;
+	/** @gx_pd: Power domain for controlling GX GDSC */
+	struct device *gx_pd;
+	/** @gx_regulator_parent: Pointer to the GX domain parent supply */
+	struct regulator *gx_regulator_parent;
+	/** @gx_regulator_parent_min_corner: Minimum supply voltage for GX parent */
+	u32 gx_regulator_parent_min_corner;
+	/** @cx_gdsc_nb: Notifier block for cx gdsc regulator */
+	struct notifier_block cx_gdsc_nb;
+	/** @cx_gdsc_gate: Completion to signal cx gdsc collapse status */
+	struct completion cx_gdsc_gate;
+	/** @cx_gdsc_wait: Whether to wait for cx gdsc to turn off */
+	bool cx_gdsc_wait;
+	/** @cx_gdsc_offset: Offset of CX GDSC register */
+	u32 cx_gdsc_offset;
+	int isense_clk_indx;
+	int isense_clk_on_level;
+	unsigned long power_flags;
+	unsigned long ctrl_flags;
+	struct kgsl_pwrlevel pwrlevels[KGSL_MAX_PWRLEVELS];
+	unsigned int active_pwrlevel;
+	unsigned int previous_pwrlevel;
+	unsigned int thermal_pwrlevel;
+	unsigned int thermal_pwrlevel_floor;
+	unsigned int default_pwrlevel;
+	unsigned int max_pwrlevel;
+	unsigned int min_pwrlevel;
+	unsigned int num_pwrlevels;
+	unsigned int throttle_mask;
+	u32 interval_timeout;
+	u64 clock_times[KGSL_MAX_PWRLEVELS];
+	struct kgsl_clk_stats clk_stats;
+	bool bus_control;
+	int bus_mod;
+	unsigned int bus_percent_ab;
+	unsigned int bus_width;
+	unsigned long bus_ab_mbytes;
+	/** @ddr_table: List of the DDR bandwidths in KBps for the target */
+	u32 *ddr_table;
+	/** @ddr_table_count: Number of objects in @ddr_table */
+	int ddr_table_count;
+	/** cur_buslevel: The last buslevel voted by the driver */
+	int cur_buslevel;
+	/** @bus_max: The maximum bandwidth available to the device */
+	unsigned long bus_max;
+	struct kgsl_pwr_constraint constraint;
+	bool superfast;
+	unsigned int gpu_bimc_int_clk_freq;
+	bool gpu_bimc_interface_enabled;
+	/** @icc_path: Interconnect path for the GPU (if applicable) */
+	struct icc_path *icc_path;
+	/** cur_ab: The last ab voted by the driver */
+	u32 cur_ab;
+	/** @sysfs_thermal_req - PM QoS maximum frequency request from user (via sysfs) */
+	struct dev_pm_qos_request sysfs_thermal_req;
+	/** @time_in_pwrlevel: Each pwrlevel active duration in usec */
+	u64 time_in_pwrlevel[KGSL_MAX_PWRLEVELS];
+	/** @last_stat_updated: The last time stats were updated */
+	ktime_t last_stat_updated;
+	/** @nb_max: Notifier block for DEV_PM_QOS_MAX_FREQUENCY */
+	struct notifier_block nb_max;
+	/** @cur_dcvs_buslevel: Current bus level decided by bus DCVS */
+	u32 cur_dcvs_buslevel;
+	/** @rt_bus_hint: IB level hint for real time clients i.e. RB-0 */
+	u32 rt_bus_hint;
+	/** @rt_bus_hint_active: Boolean flag to indicate if RT bus hint is active */
+	bool rt_bus_hint_active;
+};
+
+int kgsl_pwrctrl_init(struct kgsl_device *device);
+void kgsl_pwrctrl_close(struct kgsl_device *device);
+void kgsl_timer(struct timer_list *t);
+void kgsl_pre_hwaccess(struct kgsl_device *device);
+void kgsl_pwrctrl_pwrlevel_change(struct kgsl_device *device,
+	unsigned int level);
+int kgsl_pwrctrl_init_sysfs(struct kgsl_device *device);
+int kgsl_pwrctrl_change_state(struct kgsl_device *device, int state);
+
+unsigned int kgsl_pwrctrl_adjust_pwrlevel(struct kgsl_device *device,
+	unsigned int new_level);
+
+/*
+ * kgsl_pwrctrl_active_freq - get currently configured frequency
+ * @pwr: kgsl_pwrctrl structure for the device
+ *
+ * Returns the currently configured frequency for the device.
+ */
+static inline unsigned long
+kgsl_pwrctrl_active_freq(struct kgsl_pwrctrl *pwr)
+{
+	return pwr->pwrlevels[pwr->active_pwrlevel].gpu_freq;
+}
+
+/**
+ * kgsl_active_count_wait() - Wait for activity to finish.
+ * @device: Pointer to a KGSL device
+ * @count: Active count value to wait for
+ * @wait_jiffies: Jiffies to wait
+ *
+ * Block until the active_cnt value hits the desired value
+ */
+int kgsl_active_count_wait(struct kgsl_device *device, int count,
+	unsigned long wait_jiffies);
+void kgsl_pwrctrl_busy_time(struct kgsl_device *device, u64 time, u64 busy);
+
+/**
+ * kgsl_pwrctrl_set_constraint() - Validate and change enforced constraint
+ * @device: Pointer to the kgsl_device struct
+ * @pwrc: Pointer to requested constraint
+ * @id: Context id which owns the constraint
+ * @ts: The timestamp for which this constraint is enforced
+ *
+ * Accept the new constraint if no previous constraint existed or if the
+ * new constraint is faster than the previous one.  If the new and previous
+ * constraints are equal, update the timestamp and ownership to make sure
+ * the constraint expires at the correct time.
+ */
+void kgsl_pwrctrl_set_constraint(struct kgsl_device *device,
+			struct kgsl_pwr_constraint *pwrc, u32 id, u32 ts);
+int kgsl_pwrctrl_set_default_gpu_pwrlevel(struct kgsl_device *device);
+
+/**
+ * kgsl_pwrctrl_request_state - Request a specific power state
+ * @device: Pointer to the kgsl device
+ * @state: Power state requested
+ */
+void kgsl_pwrctrl_request_state(struct kgsl_device *device, u32 state);
+
+/**
+ * kgsl_pwrctrl_set_state - Set a specific power state
+ * @device: Pointer to the kgsl device
+ * @state: Power state requested
+ */
+void kgsl_pwrctrl_set_state(struct kgsl_device *device, u32 state);
+
+/**
+ * kgsl_pwrctrl_axi - Propagate bus votes during slumber entry and exit
+ * @device: Pointer to the kgsl device
+ * @state: Whether we are going to slumber or coming out of slumber
+ *
+ * This function will propagate the default bus vote when coming out of
+ * slumber and set bus bandwidth to 0 when going into slumber
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int kgsl_pwrctrl_axi(struct kgsl_device *device, bool state);
+
+/**
+ * kgsl_idle_check - kgsl idle function
+ * @work: work item being run by the function
+ *
+ * This function is called for work that is queued by the interrupt
+ * handler or the idle timer. It attempts to transition to a clocks
+ * off state if the active_cnt is 0 and the hardware is idle.
+ */
+void kgsl_idle_check(struct work_struct *work);
+
+/**
+ * kgsl_pwrctrl_irq - Enable or disable gpu interrupts
+ * @device: Handle to the kgsl device
+ * @state: Variable to decide whether interrupts need to be enabled or disabled
+ *
+ */
+void kgsl_pwrctrl_irq(struct kgsl_device *device, bool state);
+
+/**
+ * kgsl_pwrctrl_clear_l3_vote - Relinquish l3 vote
+ * @device: Handle to the kgsl device
+ *
+ * Clear the l3 vote when going into slumber
+ */
+void kgsl_pwrctrl_clear_l3_vote(struct kgsl_device *device);
+
+/**
+ * kgsl_pwrctrl_enable_cx_gdsc - Enable cx gdsc
+ * @device: Pointer to the kgsl device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int kgsl_pwrctrl_enable_cx_gdsc(struct kgsl_device *device);
+
+/**
+ * kgsl_pwrctrl_disable_cx_gdsc - Disable cx gdsc
+ * @device: Pointer to the kgsl device
+ */
+void kgsl_pwrctrl_disable_cx_gdsc(struct kgsl_device *device);
+
+/**
+ * kgsl_pwrctrl_enable_gx_gdsc - Enable gx gdsc
+ * @device: Pointer to the kgsl device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int kgsl_pwrctrl_enable_gx_gdsc(struct kgsl_device *device);
+
+/**
+ * kgsl_pwrctrl_disable_gx_gdsc - Disable gx gdsc
+ * @device: Pointer to the kgsl device
+ */
+void kgsl_pwrctrl_disable_gx_gdsc(struct kgsl_device *device);
+
+/**
+ * kgsl_pwrctrl_probe_gdscs - Probe gdscs
+ * @device: Pointer to the kgsl device
+ * @pdev: Pointer to the platform device
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int kgsl_pwrctrl_probe_gdscs(struct kgsl_device *device, struct platform_device *pdev);
+#endif /* __KGSL_PWRCTRL_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_pwrscale.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_pwrscale.c
@@ -0,0 +1,879 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2010-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/devfreq_cooling.h>
+#include <linux/slab.h>
+
+#include "kgsl_bus.h"
+#include "kgsl_device.h"
+#include "kgsl_pwrscale.h"
+#include "kgsl_trace.h"
+
+static struct devfreq_msm_adreno_tz_data adreno_tz_data = {
+	.bus = {
+		.max = 350,
+		.floating = true,
+	},
+	.mod_percent = 100,
+};
+
+static void do_devfreq_suspend(struct work_struct *work);
+static void do_devfreq_resume(struct work_struct *work);
+static void do_devfreq_notify(struct work_struct *work);
+
+/*
+ * These variables are used to keep the latest data
+ * returned by kgsl_devfreq_get_dev_status
+ */
+static struct xstats last_xstats;
+static struct devfreq_dev_status last_status = { .private_data = &last_xstats };
+
+/*
+ * kgsl_pwrscale_sleep - notify governor that device is going off
+ * @device: The device
+ *
+ * Called shortly after all pending work is completed.
+ */
+void kgsl_pwrscale_sleep(struct kgsl_device *device)
+{
+	if (!device->pwrscale.enabled)
+		return;
+	device->pwrscale.on_time = 0;
+
+	/* to call devfreq_suspend_device() from a kernel thread */
+	queue_work(device->pwrscale.devfreq_wq,
+		&device->pwrscale.devfreq_suspend_ws);
+}
+
+/*
+ * kgsl_pwrscale_wake - notify governor that device is going on
+ * @device: The device
+ *
+ * Called when the device is returning to an active state.
+ */
+void kgsl_pwrscale_wake(struct kgsl_device *device)
+{
+	struct kgsl_power_stats stats;
+	struct kgsl_pwrscale *psc = &device->pwrscale;
+
+	if (!device->pwrscale.enabled)
+		return;
+	/* clear old stats before waking */
+	memset(&psc->accum_stats, 0, sizeof(psc->accum_stats));
+	memset(&last_xstats, 0, sizeof(last_xstats));
+
+	/* and any hw activity from waking up*/
+	device->ftbl->power_stats(device, &stats);
+
+	psc->time = ktime_get();
+
+	psc->next_governor_call = ktime_add_us(psc->time,
+			KGSL_GOVERNOR_CALL_INTERVAL);
+
+	/* to call devfreq_resume_device() from a kernel thread */
+	queue_work(psc->devfreq_wq, &psc->devfreq_resume_ws);
+}
+
+/*
+ * kgsl_pwrscale_busy - update pwrscale state for new work
+ * @device: The device
+ *
+ * Called when new work is submitted to the device.
+ * This function must be called with the device mutex locked.
+ */
+void kgsl_pwrscale_busy(struct kgsl_device *device)
+{
+	if (!device->pwrscale.enabled)
+		return;
+	if (device->pwrscale.on_time == 0)
+		device->pwrscale.on_time = ktime_to_us(ktime_get());
+}
+
+/**
+ * kgsl_pwrscale_update_stats() - update device busy statistics
+ * @device: The device
+ *
+ * Read hardware busy counters and accumulate the results.
+ */
+void kgsl_pwrscale_update_stats(struct kgsl_device *device)
+{
+	struct kgsl_pwrctrl *pwrctrl = &device->pwrctrl;
+	struct kgsl_pwrscale *psc = &device->pwrscale;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (!psc->enabled)
+		return;
+
+	if (device->state == KGSL_STATE_ACTIVE) {
+		struct kgsl_power_stats stats;
+		ktime_t cur_time = ktime_get();
+
+		device->ftbl->power_stats(device, &stats);
+		device->pwrscale.accum_stats.busy_time += stats.busy_time;
+		device->pwrscale.accum_stats.ram_time += stats.ram_time;
+		device->pwrscale.accum_stats.ram_wait += stats.ram_wait;
+		pwrctrl->clock_times[pwrctrl->active_pwrlevel] +=
+				stats.busy_time;
+		pwrctrl->time_in_pwrlevel[pwrctrl->active_pwrlevel] +=
+			ktime_us_delta(cur_time, pwrctrl->last_stat_updated);
+		pwrctrl->last_stat_updated = cur_time;
+	}
+}
+
+/**
+ * kgsl_pwrscale_update() - update device busy statistics
+ * @device: The device
+ *
+ * If enough time has passed schedule the next call to devfreq
+ * get_dev_status.
+ */
+void kgsl_pwrscale_update(struct kgsl_device *device)
+{
+	ktime_t t;
+
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (!device->pwrscale.enabled)
+		return;
+
+	t = ktime_get();
+	if (ktime_compare(t, device->pwrscale.next_governor_call) < 0)
+		return;
+
+	device->pwrscale.next_governor_call = ktime_add_us(t,
+			KGSL_GOVERNOR_CALL_INTERVAL);
+
+	/* to call update_devfreq() from a kernel thread */
+	if (device->state != KGSL_STATE_SLUMBER)
+		queue_work(device->pwrscale.devfreq_wq,
+			&device->pwrscale.devfreq_notify_ws);
+}
+
+/*
+ * kgsl_pwrscale_disable - temporarily disable the governor
+ * @device: The device
+ * @turbo: Indicates if pwrlevel should be forced to turbo
+ *
+ * Temporarily disable the governor, to prevent interference
+ * with profiling tools that expect a fixed clock frequency.
+ * This function must be called with the device mutex locked.
+ */
+void kgsl_pwrscale_disable(struct kgsl_device *device, bool turbo)
+{
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (device->pwrscale.devfreqptr)
+		queue_work(device->pwrscale.devfreq_wq,
+			&device->pwrscale.devfreq_suspend_ws);
+	device->pwrscale.enabled = false;
+	if (turbo)
+		kgsl_pwrctrl_pwrlevel_change(device, 0);
+}
+
+/*
+ * kgsl_pwrscale_enable - re-enable the governor
+ * @device: The device
+ *
+ * Reenable the governor after a kgsl_pwrscale_disable() call.
+ * This function must be called with the device mutex locked.
+ */
+void kgsl_pwrscale_enable(struct kgsl_device *device)
+{
+	if (WARN_ON(!mutex_is_locked(&device->mutex)))
+		return;
+
+	if (device->pwrscale.devfreqptr) {
+		queue_work(device->pwrscale.devfreq_wq,
+			&device->pwrscale.devfreq_resume_ws);
+		device->pwrscale.enabled = true;
+	} else {
+		/*
+		 * Don't enable it if devfreq is not set and let the device
+		 * run at default level;
+		 */
+		kgsl_pwrctrl_pwrlevel_change(device,
+					device->pwrctrl.default_pwrlevel);
+		device->pwrscale.enabled = false;
+	}
+}
+
+/*
+ * kgsl_devfreq_target - devfreq_dev_profile.target callback
+ * @dev: see devfreq.h
+ * @freq: see devfreq.h
+ * @flags: see devfreq.h
+ *
+ * This is a devfreq callback function for dcvs recommendations and
+ * thermal constraints. If any thermal constraints are present,
+ * devfreq adjusts the gpu frequency range to cap the max frequency
+ * thereby not recommending anything above the constraint.
+ * This function expects the device mutex to be unlocked.
+ */
+int kgsl_devfreq_target(struct device *dev, unsigned long *freq, u32 flags)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr;
+	int level;
+	unsigned int i;
+	unsigned long cur_freq, rec_freq;
+	struct kgsl_pwrscale *pwrscale = &device->pwrscale;
+
+	if (device == NULL)
+		return -ENODEV;
+	if (freq == NULL)
+		return -EINVAL;
+
+	if (!pwrscale->devfreq_enabled) {
+		/*
+		 * When we try to use performance governor, this function
+		 * will called by devfreq driver, while adding governor using
+		 * devfreq_add_device.
+		 * To add and start performance governor successfully during
+		 * probe, return 0 when we reach here. pwrscale->enabled will
+		 * be set to true after successfully starting the governor.
+		 */
+		if (!pwrscale->enabled)
+			return 0;
+		return -EPROTO;
+	}
+	pwr = &device->pwrctrl;
+
+	rec_freq = *freq;
+
+	mutex_lock(&device->mutex);
+	cur_freq = kgsl_pwrctrl_active_freq(pwr);
+	level = pwr->active_pwrlevel;
+
+	/* If the governor recommends a new frequency, update it here */
+	if (rec_freq != cur_freq) {
+		for (i = 0; i < pwr->num_pwrlevels; i++)
+			if (rec_freq == pwr->pwrlevels[i].gpu_freq) {
+				level = i;
+				break;
+			}
+		if (level != pwr->active_pwrlevel)
+			kgsl_pwrctrl_pwrlevel_change(device, level);
+	}
+
+	*freq = kgsl_pwrctrl_active_freq(pwr);
+
+	mutex_unlock(&device->mutex);
+	return 0;
+}
+
+/*
+ * kgsl_devfreq_get_dev_status - devfreq_dev_profile.get_dev_status callback
+ * @dev: see devfreq.h
+ * @freq: see devfreq.h
+ * @flags: see devfreq.h
+ *
+ * This function expects the device mutex to be unlocked.
+ */
+int kgsl_devfreq_get_dev_status(struct device *dev,
+				struct devfreq_dev_status *stat)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwrctrl;
+	struct kgsl_pwrscale *pwrscale;
+	ktime_t tmp1, tmp2;
+
+	if (device == NULL)
+		return -ENODEV;
+	if (stat == NULL)
+		return -EINVAL;
+	if (!device->pwrscale.devfreq_enabled)
+		return -EPROTO;
+
+	pwrscale = &device->pwrscale;
+	pwrctrl = &device->pwrctrl;
+
+	mutex_lock(&device->mutex);
+
+	tmp1 = ktime_get();
+	/*
+	 * If the GPU clock is on grab the latest power counter
+	 * values.  Otherwise the most recent ACTIVE values will
+	 * already be stored in accum_stats.
+	 */
+	kgsl_pwrscale_update_stats(device);
+
+	tmp2 = ktime_get();
+	stat->total_time = ktime_us_delta(tmp2, pwrscale->time);
+	pwrscale->time = tmp1;
+
+	stat->busy_time = pwrscale->accum_stats.busy_time;
+
+	stat->current_frequency = kgsl_pwrctrl_active_freq(&device->pwrctrl);
+
+	stat->private_data = &device->active_context_count;
+
+	/*
+	 * keep the latest devfreq_dev_status values
+	 * and vbif counters data
+	 * to be (re)used by kgsl_busmon_get_dev_status()
+	 */
+	if (pwrctrl->bus_control) {
+		struct xstats *last_b =
+			(struct xstats *)last_status.private_data;
+
+		last_status.total_time = stat->total_time;
+		last_status.busy_time = stat->busy_time;
+		last_status.current_frequency = stat->current_frequency;
+
+		last_b->ram_time = device->pwrscale.accum_stats.ram_time;
+		last_b->ram_wait = device->pwrscale.accum_stats.ram_wait;
+		last_b->buslevel = device->pwrctrl.cur_dcvs_buslevel;
+
+		if (pwrscale->avoid_ddr_stall) {
+			struct kgsl_pwrlevel *pwrlevel;
+
+			pwrlevel = &pwrctrl->pwrlevels[pwrctrl->min_pwrlevel];
+			last_b->gpu_minfreq = pwrlevel->gpu_freq;
+		}
+	}
+
+	kgsl_pwrctrl_busy_time(device, stat->total_time, stat->busy_time);
+	trace_kgsl_pwrstats(device, stat->total_time,
+		&pwrscale->accum_stats, device->active_context_count);
+	memset(&pwrscale->accum_stats, 0, sizeof(pwrscale->accum_stats));
+
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+/*
+ * kgsl_devfreq_get_cur_freq - devfreq_dev_profile.get_cur_freq callback
+ * @dev: see devfreq.h
+ * @freq: see devfreq.h
+ * @flags: see devfreq.h
+ *
+ * This function expects the device mutex to be unlocked.
+ */
+int kgsl_devfreq_get_cur_freq(struct device *dev, unsigned long *freq)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrscale *pwrscale = &device->pwrscale;
+
+	if (device == NULL)
+		return -ENODEV;
+	if (freq == NULL)
+		return -EINVAL;
+
+	if (!pwrscale->devfreq_enabled) {
+		/*
+		 * When we try to use performance governor, this function
+		 * will called by devfreq driver, while adding governor using
+		 * devfreq_add_device.
+		 * To add and start performance governor successfully during
+		 * probe, return 0 when we reach here. pwrscale->enabled will
+		 * be set to true after successfully starting the governor.
+		 */
+		if (!pwrscale->enabled)
+			return 0;
+		return -EPROTO;
+	}
+
+	mutex_lock(&device->mutex);
+	*freq = kgsl_pwrctrl_active_freq(&device->pwrctrl);
+	mutex_unlock(&device->mutex);
+
+	return 0;
+}
+
+/*
+ * kgsl_busmon_get_dev_status - devfreq_dev_profile.get_dev_status callback
+ * @dev: see devfreq.h
+ * @freq: see devfreq.h
+ * @flags: see devfreq.h
+ *
+ * This function expects the device mutex to be unlocked.
+ */
+int kgsl_busmon_get_dev_status(struct device *dev,
+			struct devfreq_dev_status *stat)
+{
+	struct xstats *b;
+	struct kgsl_device *device = dev_get_drvdata(dev);
+
+	if (!device->pwrscale.devfreq_enabled)
+		return -EPROTO;
+
+	stat->total_time = last_status.total_time;
+	stat->busy_time = last_status.busy_time;
+	stat->current_frequency = last_status.current_frequency;
+
+	if (stat->private_data) {
+		struct xstats *last_b =
+			(struct xstats *)last_status.private_data;
+		b = (struct xstats *)stat->private_data;
+		b->ram_time = last_b->ram_time;
+		b->ram_wait = last_b->ram_wait;
+		b->buslevel = last_b->buslevel;
+		b->gpu_minfreq = last_b->gpu_minfreq;
+	}
+	return 0;
+}
+
+static int _read_hint(u32 flags)
+{
+	switch (flags) {
+	case BUSMON_FLAG_FAST_HINT:
+		return 1;
+	case BUSMON_FLAG_SUPER_FAST_HINT:
+		return 2;
+	case BUSMON_FLAG_SLOW_HINT:
+		return -1;
+	default:
+		return 0;
+	}
+}
+
+/*
+ * kgsl_busmon_target - devfreq_dev_profile.target callback
+ * @dev: see devfreq.h
+ * @freq: see devfreq.h
+ * @flags: see devfreq.h
+ *
+ * This function expects the device mutex to be unlocked.
+ */
+int kgsl_busmon_target(struct device *dev, unsigned long *freq, u32 flags)
+{
+	struct kgsl_device *device = dev_get_drvdata(dev);
+	struct kgsl_pwrctrl *pwr;
+	struct kgsl_pwrlevel *pwr_level;
+	int  level, b;
+	u32 bus_flag;
+	unsigned long ab_mbytes;
+
+	if (device == NULL)
+		return -ENODEV;
+	if (freq == NULL)
+		return -EINVAL;
+	if (!device->pwrscale.enabled)
+		return 0;
+	if (!device->pwrscale.devfreq_enabled)
+		return -EPROTO;
+
+	pwr = &device->pwrctrl;
+
+	if (!pwr->bus_control)
+		return 0;
+
+	mutex_lock(&device->mutex);
+	level = pwr->active_pwrlevel;
+	pwr_level = &pwr->pwrlevels[level];
+	bus_flag = device->pwrscale.bus_profile.flag;
+	device->pwrscale.bus_profile.flag = 0;
+	ab_mbytes = device->pwrscale.bus_profile.ab_mbytes;
+
+	/*
+	 * Bus devfreq governor has calculated its recomendations
+	 * when gpu was running with *freq frequency.
+	 * If the gpu frequency is different now it's better to
+	 * ignore the call
+	 */
+	if (pwr_level->gpu_freq != *freq) {
+		mutex_unlock(&device->mutex);
+		return 0;
+	}
+
+	b = pwr->bus_mod;
+	pwr->bus_mod += _read_hint(bus_flag);
+
+	/* trim calculated change to fit range */
+	if (pwr_level->bus_freq + pwr->bus_mod < pwr_level->bus_min)
+		pwr->bus_mod = -(pwr_level->bus_freq - pwr_level->bus_min);
+	else if (pwr_level->bus_freq + pwr->bus_mod > pwr_level->bus_max)
+		pwr->bus_mod = pwr_level->bus_max - pwr_level->bus_freq;
+
+	/* Update bus vote if AB or IB is modified */
+	if ((pwr->bus_mod != b) || (pwr->bus_ab_mbytes != ab_mbytes)) {
+		pwr->bus_percent_ab = device->pwrscale.bus_profile.percent_ab;
+		/*
+		 * When gpu is thermally throttled to its lowest power level,
+		 * drop GPU's AB vote as a last resort to lower CX voltage and
+		 * to prevent thermal reset.
+		 * Ignore this check when only single power level in use to
+		 * avoid setting default AB vote in normal situations too.
+		 */
+		if (pwr->thermal_pwrlevel != pwr->num_pwrlevels - 1 ||
+			pwr->num_pwrlevels == 1)
+			pwr->bus_ab_mbytes = ab_mbytes;
+		else
+			pwr->bus_ab_mbytes = 0;
+		kgsl_bus_update(device, KGSL_BUS_VOTE_ON);
+	}
+
+	mutex_unlock(&device->mutex);
+	return 0;
+}
+
+int kgsl_busmon_get_cur_freq(struct device *dev, unsigned long *freq)
+{
+	return 0;
+}
+
+static void busmon_dev_release(struct device *dev)
+{
+}
+
+static void pwrscale_busmon_create(struct kgsl_device *device,
+		struct platform_device *pdev, unsigned long *table)
+{
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct kgsl_pwrscale *pwrscale = &device->pwrscale;
+	struct device *dev = &pwrscale->busmondev;
+	struct msm_busmon_extended_profile *bus_profile;
+	struct devfreq *bus_devfreq;
+	int i, ret;
+
+	bus_profile = &pwrscale->bus_profile;
+	bus_profile->private_data = &adreno_tz_data;
+
+	bus_profile->profile.target = kgsl_busmon_target;
+	bus_profile->profile.get_dev_status = kgsl_busmon_get_dev_status;
+	bus_profile->profile.get_cur_freq = kgsl_busmon_get_cur_freq;
+
+	bus_profile->profile.max_state = pwr->num_pwrlevels;
+	bus_profile->profile.freq_table = table;
+
+	dev->parent = &pdev->dev;
+	dev->release = busmon_dev_release;
+
+	dev_set_name(dev, "kgsl-busmon");
+	dev_set_drvdata(dev, device);
+	if (device_register(dev)) {
+		put_device(dev);
+		return;
+	}
+
+	/* Build out the OPP table for the busmon device */
+	for (i = 0; i < pwr->num_pwrlevels; i++) {
+		if (!pwr->pwrlevels[i].gpu_freq)
+			continue;
+
+		dev_pm_opp_add(dev, pwr->pwrlevels[i].gpu_freq, 0);
+	}
+
+	ret = devfreq_gpubw_init();
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to add busmon governor: %d\n", ret);
+		dev_pm_opp_remove_all_dynamic(dev);
+		device_unregister(dev);
+		return;
+	}
+
+	bus_devfreq = devfreq_add_device(dev, &pwrscale->bus_profile.profile,
+		"gpubw_mon", NULL);
+
+	if (IS_ERR_OR_NULL(bus_devfreq)) {
+		dev_err(&pdev->dev, "Bus scaling not enabled\n");
+		devfreq_gpubw_exit();
+		dev_pm_opp_remove_all_dynamic(dev);
+		device_unregister(dev);
+		return;
+	}
+
+	pwrscale->bus_devfreq = bus_devfreq;
+}
+
+static void pwrscale_of_get_ca_target_pwrlevel(struct kgsl_device *device,
+		struct device_node *node)
+{
+	u32 pwrlevel = 1;
+
+	of_property_read_u32(node, "qcom,ca-target-pwrlevel", &pwrlevel);
+
+	if (pwrlevel >= device->pwrctrl.num_pwrlevels)
+		pwrlevel = 1;
+
+	device->pwrscale.ctxt_aware_target_pwrlevel = pwrlevel;
+}
+
+/* Get context aware properties */
+static void pwrscale_of_ca_aware(struct kgsl_device *device)
+{
+	struct kgsl_pwrscale *pwrscale = &device->pwrscale;
+	struct device_node *parent = device->pdev->dev.of_node;
+	struct device_node *node, *child;
+
+	pwrscale->ctxt_aware_enable =
+		of_property_read_bool(parent, "qcom,enable-ca-jump");
+
+	if (!pwrscale->ctxt_aware_enable)
+		return;
+
+	pwrscale->ctxt_aware_busy_penalty = 12000;
+	of_property_read_u32(parent, "qcom,ca-busy-penalty",
+		&pwrscale->ctxt_aware_busy_penalty);
+
+
+	pwrscale->ctxt_aware_target_pwrlevel = 1;
+
+	node = of_find_node_by_name(parent, "qcom,gpu-pwrlevel-bins");
+	if (node == NULL) {
+		pwrscale_of_get_ca_target_pwrlevel(device, parent);
+		return;
+	}
+
+	for_each_child_of_node(node, child) {
+		u32 bin;
+
+		if (of_property_read_u32(child, "qcom,speed-bin", &bin))
+			continue;
+
+		if (bin == device->speed_bin) {
+			pwrscale_of_get_ca_target_pwrlevel(device, child);
+			of_node_put(child);
+			break;
+		}
+	}
+
+	of_node_put(node);
+}
+
+/*
+ * thermal_max_notifier_call - Callback function registered to receive qos max
+ * frequency events.
+ * @nb: The notifier block
+ * @val: Max frequency value in KHz for GPU
+ *
+ * The function subscribes to GPU max frequency change and updates thermal
+ * power level accordingly.
+ */
+static int thermal_max_notifier_call(struct notifier_block *nb, unsigned long val, void *data)
+{
+	struct kgsl_pwrctrl *pwr = container_of(nb, struct kgsl_pwrctrl, nb_max);
+	struct kgsl_device *device = container_of(pwr, struct kgsl_device, pwrctrl);
+	u32 max_freq = val * 1000;
+	int level;
+
+	if (!device->pwrscale.devfreq_enabled)
+		return NOTIFY_DONE;
+
+	for (level = pwr->num_pwrlevels - 1; level >= 0; level--) {
+		/* get nearest power level with a maximum delta of 5MHz */
+		if (abs(pwr->pwrlevels[level].gpu_freq - max_freq) < 5000000)
+			break;
+	}
+
+	if (level < 0)
+		return NOTIFY_DONE;
+
+	if (level == pwr->thermal_pwrlevel)
+		return NOTIFY_OK;
+
+	trace_kgsl_thermal_constraint(max_freq);
+	pwr->thermal_pwrlevel = level;
+
+	mutex_lock(&device->mutex);
+
+	/* Update the current level using the new limit */
+	kgsl_pwrctrl_pwrlevel_change(device, pwr->active_pwrlevel);
+
+	mutex_unlock(&device->mutex);
+	return NOTIFY_OK;
+}
+
+int kgsl_pwrscale_init(struct kgsl_device *device, struct platform_device *pdev,
+		const char *governor)
+{
+	struct kgsl_pwrscale *pwrscale = &device->pwrscale;
+	struct kgsl_pwrctrl *pwr = &device->pwrctrl;
+	struct devfreq *devfreq;
+	struct msm_adreno_extended_profile *gpu_profile;
+	int i, ret;
+
+	adreno_tz_data.avoid_ddr_stall = pwrscale->avoid_ddr_stall;
+
+	gpu_profile = &pwrscale->gpu_profile;
+	gpu_profile->private_data = &adreno_tz_data;
+
+	gpu_profile->profile.target = kgsl_devfreq_target;
+	gpu_profile->profile.get_dev_status = kgsl_devfreq_get_dev_status;
+	gpu_profile->profile.get_cur_freq = kgsl_devfreq_get_cur_freq;
+
+	gpu_profile->profile.initial_freq =
+		pwr->pwrlevels[pwr->default_pwrlevel].gpu_freq;
+
+	gpu_profile->profile.polling_ms = 10;
+
+	pwrscale_of_ca_aware(device);
+
+	for (i = 0; i < pwr->num_pwrlevels; i++)
+		pwrscale->freq_table[i] = pwr->pwrlevels[i].gpu_freq;
+
+	/*
+	 * Max_state is the number of valid power levels.
+	 * The valid power levels range from 0 - (max_state - 1)
+	 */
+	gpu_profile->profile.max_state = pwr->num_pwrlevels;
+	/* link storage array to the devfreq profile pointer */
+	gpu_profile->profile.freq_table = pwrscale->freq_table;
+
+	/* if there is only 1 freq, no point in running a governor */
+	if (gpu_profile->profile.max_state == 1)
+		governor = "performance";
+
+	/* initialize msm-adreno-tz governor specific data here */
+	adreno_tz_data.disable_busy_time_burst =
+		of_property_read_bool(pdev->dev.of_node,
+		"qcom,disable-busy-time-burst");
+
+	if (pwrscale->ctxt_aware_enable) {
+		adreno_tz_data.ctxt_aware_enable = pwrscale->ctxt_aware_enable;
+		adreno_tz_data.bin.ctxt_aware_target_pwrlevel =
+			pwrscale->ctxt_aware_target_pwrlevel;
+		adreno_tz_data.bin.ctxt_aware_busy_penalty =
+			pwrscale->ctxt_aware_busy_penalty;
+	}
+
+	/*
+	 * If there is a separate GX power rail, allow
+	 * independent modification to its voltage through
+	 * the bus bandwidth vote.
+	 */
+	if (pwr->bus_control) {
+		adreno_tz_data.bus.num = pwr->ddr_table_count;
+		adreno_tz_data.bus.ib_kbps = pwr->ddr_table;
+		adreno_tz_data.bus.width = pwr->bus_width;
+
+		if (!kgsl_of_property_read_ddrtype(device->pdev->dev.of_node,
+			"qcom,bus-accesses", &adreno_tz_data.bus.max))
+			adreno_tz_data.bus.floating = false;
+	}
+
+	pwrscale->devfreq_wq = create_freezable_workqueue("kgsl_devfreq_wq");
+	if (!pwrscale->devfreq_wq) {
+		dev_err(device->dev, "Failed to allocate kgsl devfreq workqueue\n");
+		device->pwrscale.enabled = false;
+		return -ENOMEM;
+	}
+
+	ret = msm_adreno_tz_init();
+	if (ret) {
+		dev_err(device->dev, "Failed to add adreno tz governor: %d\n", ret);
+		device->pwrscale.enabled = false;
+		return ret;
+	}
+
+	pwr->nb_max.notifier_call = thermal_max_notifier_call;
+	ret = dev_pm_qos_add_notifier(&pdev->dev, &pwr->nb_max, DEV_PM_QOS_MAX_FREQUENCY);
+
+	if (ret) {
+		dev_err(device->dev, "Unable to register notifier call for thermal: %d\n", ret);
+		device->pwrscale.enabled = false;
+		msm_adreno_tz_exit();
+		return ret;
+	}
+
+	devfreq = devfreq_add_device(&pdev->dev, &gpu_profile->profile,
+			governor, &adreno_tz_data);
+	if (IS_ERR_OR_NULL(devfreq)) {
+		device->pwrscale.enabled = false;
+		msm_adreno_tz_exit();
+		return IS_ERR(devfreq) ? PTR_ERR(devfreq) : -EINVAL;
+	}
+
+	pwrscale->enabled = true;
+	pwrscale->devfreqptr = devfreq;
+	pwrscale->cooling_dev = of_devfreq_cooling_register(pdev->dev.of_node,
+		devfreq);
+	if (IS_ERR(pwrscale->cooling_dev))
+		pwrscale->cooling_dev = NULL;
+
+	if (adreno_tz_data.bus.num)
+		pwrscale_busmon_create(device, pdev, pwrscale->freq_table);
+
+	WARN_ON(sysfs_create_link(&device->dev->kobj,
+			&devfreq->dev.kobj, "devfreq"));
+
+	INIT_WORK(&pwrscale->devfreq_suspend_ws, do_devfreq_suspend);
+	INIT_WORK(&pwrscale->devfreq_resume_ws, do_devfreq_resume);
+	INIT_WORK(&pwrscale->devfreq_notify_ws, do_devfreq_notify);
+
+	pwrscale->next_governor_call = ktime_add_us(ktime_get(),
+			KGSL_GOVERNOR_CALL_INTERVAL);
+
+	return 0;
+}
+
+/*
+ * kgsl_pwrscale_close - clean up pwrscale
+ * @device: the device
+ *
+ * This function should be called with the device mutex locked.
+ */
+void kgsl_pwrscale_close(struct kgsl_device *device)
+{
+	struct kgsl_pwrscale *pwrscale;
+	struct kgsl_pwrctrl *pwr;
+
+	pwr = &device->pwrctrl;
+	pwrscale = &device->pwrscale;
+
+	if (pwrscale->bus_devfreq) {
+		devfreq_remove_device(pwrscale->bus_devfreq);
+		pwrscale->bus_devfreq = NULL;
+		devfreq_gpubw_exit();
+		dev_pm_opp_remove_all_dynamic(&pwrscale->busmondev);
+		device_unregister(&pwrscale->busmondev);
+	}
+
+	if (!pwrscale->devfreqptr)
+		return;
+	if (pwrscale->cooling_dev)
+		devfreq_cooling_unregister(pwrscale->cooling_dev);
+
+	if (pwrscale->devfreq_wq) {
+		flush_workqueue(pwrscale->devfreq_wq);
+		destroy_workqueue(pwrscale->devfreq_wq);
+		pwrscale->devfreq_wq = NULL;
+	}
+
+	devfreq_remove_device(device->pwrscale.devfreqptr);
+	device->pwrscale.devfreqptr = NULL;
+	dev_pm_qos_remove_notifier(&device->pdev->dev, &pwr->nb_max, DEV_PM_QOS_MAX_FREQUENCY);
+	msm_adreno_tz_exit();
+}
+
+static void do_devfreq_suspend(struct work_struct *work)
+{
+	struct kgsl_pwrscale *pwrscale = container_of(work,
+			struct kgsl_pwrscale, devfreq_suspend_ws);
+
+	devfreq_suspend_device(pwrscale->devfreqptr);
+	devfreq_suspend_device(pwrscale->bus_devfreq);
+}
+
+static void do_devfreq_resume(struct work_struct *work)
+{
+	struct kgsl_pwrscale *pwrscale = container_of(work,
+			struct kgsl_pwrscale, devfreq_resume_ws);
+
+	devfreq_resume_device(pwrscale->devfreqptr);
+	devfreq_resume_device(pwrscale->bus_devfreq);
+}
+
+static void do_devfreq_notify(struct work_struct *work)
+{
+	struct kgsl_pwrscale *pwrscale = container_of(work,
+			struct kgsl_pwrscale, devfreq_notify_ws);
+
+	mutex_lock(&pwrscale->devfreqptr->lock);
+	update_devfreq(pwrscale->devfreqptr);
+	mutex_unlock(&pwrscale->devfreqptr->lock);
+
+	if (pwrscale->bus_devfreq) {
+		mutex_lock(&pwrscale->bus_devfreq->lock);
+		update_devfreq(pwrscale->bus_devfreq);
+		mutex_unlock(&pwrscale->bus_devfreq->lock);
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_pwrscale.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_pwrscale.h
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2010-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022,2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __KGSL_PWRSCALE_H
+#define __KGSL_PWRSCALE_H
+
+#include "governor.h"
+#include "kgsl_pwrctrl.h"
+#include "msm_adreno_devfreq.h"
+
+/* devfreq governor call window in usec */
+#define KGSL_GOVERNOR_CALL_INTERVAL 10000
+
+struct kgsl_power_stats {
+	u64 busy_time;
+	u64 ram_time;
+	u64 ram_wait;
+};
+
+/**
+ * struct kgsl_pwrscale - Power scaling settings for a KGSL device
+ * @devfreqptr - Pointer to the devfreq device
+ * @gpu_profile - GPU profile data for the devfreq device
+ * @bus_profile - Bus specific data for the bus devfreq device
+ * @freq_table - GPU frequencies for the DCVS algorithm
+ * @last_governor - Prior devfreq governor
+ * @accum_stats - Accumulated statistics for various frequency calculations
+ * @enabled - Whether or not power scaling is enabled
+ * @time - Last submitted sample timestamp
+ * @on_time - Timestamp when gpu busy begins
+ * @devfreq_wq - Main devfreq workqueue
+ * @devfreq_suspend_ws - Pass device suspension to devfreq
+ * @devfreq_resume_ws - Pass device resume to devfreq
+ * @devfreq_notify_ws - Notify devfreq to update sampling
+ * @next_governor_call - Timestamp after which the governor may be notified of
+ * a new sample
+ * @cooling_dev - Thermal cooling device handle
+ * @ctxt_aware_enable - Whether or not ctxt aware DCVS feature is enabled
+ * @ctxt_aware_busy_penalty - The time in microseconds required to trigger
+ * ctxt aware power level jump
+ * @ctxt_aware_target_pwrlevel - pwrlevel to jump on in case of ctxt aware
+ * power level jump
+ */
+struct kgsl_pwrscale {
+	struct devfreq *devfreqptr;
+	struct msm_adreno_extended_profile gpu_profile;
+	struct msm_busmon_extended_profile bus_profile;
+	unsigned long freq_table[KGSL_MAX_PWRLEVELS];
+	char last_governor[DEVFREQ_NAME_LEN];
+	struct kgsl_power_stats accum_stats;
+	bool enabled;
+	ktime_t time;
+	s64 on_time;
+	struct workqueue_struct *devfreq_wq;
+	struct work_struct devfreq_suspend_ws;
+	struct work_struct devfreq_resume_ws;
+	struct work_struct devfreq_notify_ws;
+	ktime_t next_governor_call;
+	struct thermal_cooling_device *cooling_dev;
+	bool ctxt_aware_enable;
+	unsigned int ctxt_aware_target_pwrlevel;
+	unsigned int ctxt_aware_busy_penalty;
+	/** @busmondev: A child device for the busmon  governor */
+	struct device busmondev;
+	/** @bus_devfreq: Pointer to the bus devfreq device */
+	struct devfreq *bus_devfreq;
+	/** @devfreq_enabled: Whether or not devfreq is enabled */
+	bool devfreq_enabled;
+	/**
+	 * @avoid_ddr_stall: Whether or not to increase IB vote on high
+	 * ddr stall
+	 */
+	bool avoid_ddr_stall;
+};
+
+/**
+ * kgsl_pwrscale_init - Initialize the pwrscale subsystem
+ * @device: A GPU device handle
+ * @pdev: A pointer to the GPU platform device
+ * @governor: default devfreq governor to use for GPU frequency scaling
+ *
+ * Return: 0 on success or negative on failure
+ */
+int kgsl_pwrscale_init(struct kgsl_device *device, struct platform_device *pdev,
+		const char *governor);
+void kgsl_pwrscale_close(struct kgsl_device *device);
+
+void kgsl_pwrscale_update(struct kgsl_device *device);
+void kgsl_pwrscale_update_stats(struct kgsl_device *device);
+void kgsl_pwrscale_busy(struct kgsl_device *device);
+void kgsl_pwrscale_sleep(struct kgsl_device *device);
+void kgsl_pwrscale_wake(struct kgsl_device *device);
+
+void kgsl_pwrscale_enable(struct kgsl_device *device);
+void kgsl_pwrscale_disable(struct kgsl_device *device, bool turbo);
+
+int kgsl_devfreq_target(struct device *dev, unsigned long *freq, u32 flags);
+int kgsl_devfreq_get_dev_status(struct device *dev,
+			struct devfreq_dev_status *stat);
+int kgsl_devfreq_get_cur_freq(struct device *dev, unsigned long *freq);
+
+int kgsl_busmon_target(struct device *dev, unsigned long *freq, u32 flags);
+int kgsl_busmon_get_dev_status(struct device *dev,
+			struct devfreq_dev_status *stat);
+int kgsl_busmon_get_cur_freq(struct device *dev, unsigned long *freq);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_reclaim.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_reclaim.c
@@ -0,0 +1,461 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/kthread.h>
+#include <linux/notifier.h>
+#include <linux/pagevec.h>
+#include <linux/shmem_fs.h>
+#include <linux/swap.h>
+#include <linux/version.h>
+
+#include "kgsl_reclaim.h"
+#include "kgsl_sharedmem.h"
+#include "kgsl_trace.h"
+
+/*
+ * Reclaiming excessive number of pages from a process will impact launch
+ * latency for the subsequent launch of the process. After measuring the
+ * launch latencies by having various maximum limits, it has been decided
+ * that allowing 30MB (7680 pages) of relcaim per process will have little
+ * impact and the latency will be within acceptable limit.
+ */
+static u32 kgsl_reclaim_max_page_limit = 7680;
+
+/* Setting this to 0 means we reclaim pages as specified in shrinker call */
+static u32 kgsl_nr_to_scan;
+
+struct work_struct reclaim_work;
+
+static atomic_t kgsl_nr_to_reclaim;
+
+static int kgsl_memdesc_get_reclaimed_pages(struct kgsl_mem_entry *entry)
+{
+	struct kgsl_memdesc *memdesc = &entry->memdesc;
+	int i, ret;
+	struct page *page;
+
+	for (i = 0; i < memdesc->page_count; i++) {
+		if (memdesc->pages[i])
+			continue;
+
+		page = shmem_read_mapping_page_gfp(
+			memdesc->shmem_filp->f_mapping, i, kgsl_gfp_mask(0));
+
+		if (IS_ERR(page))
+			return PTR_ERR(page);
+
+		kgsl_page_sync(memdesc->dev, page, PAGE_SIZE, DMA_BIDIRECTIONAL);
+
+		/*
+		 * Update the pages array only if vmfault has not
+		 * updated it meanwhile
+		 */
+		spin_lock(&memdesc->lock);
+		if (!memdesc->pages[i]) {
+			memdesc->pages[i] = page;
+			atomic_dec(&entry->priv->unpinned_page_count);
+		} else
+			put_page(page);
+		spin_unlock(&memdesc->lock);
+	}
+
+	ret = kgsl_mmu_map(memdesc->pagetable, memdesc);
+	if (ret)
+		return ret;
+
+	trace_kgsl_reclaim_memdesc(entry, false);
+
+	memdesc->priv &= ~KGSL_MEMDESC_RECLAIMED;
+	memdesc->priv &= ~KGSL_MEMDESC_SKIP_RECLAIM;
+
+	return 0;
+}
+
+int kgsl_reclaim_to_pinned_state(
+		struct kgsl_process_private *process)
+{
+	struct kgsl_mem_entry *entry, *valid_entry;
+	int next = 0, ret = 0, count;
+
+	mutex_lock(&process->reclaim_lock);
+
+	if (test_bit(KGSL_PROC_PINNED_STATE, &process->state))
+		goto done;
+
+	count = atomic_read(&process->unpinned_page_count);
+
+	for ( ; ; ) {
+		valid_entry = NULL;
+		spin_lock(&process->mem_lock);
+		entry = idr_get_next(&process->mem_idr, &next);
+		if (entry == NULL) {
+			spin_unlock(&process->mem_lock);
+			break;
+		}
+
+		if (entry->memdesc.priv & KGSL_MEMDESC_RECLAIMED)
+			valid_entry = kgsl_mem_entry_get(entry);
+		spin_unlock(&process->mem_lock);
+
+		if (valid_entry) {
+			ret = kgsl_memdesc_get_reclaimed_pages(entry);
+			kgsl_mem_entry_put(entry);
+			if (ret)
+				goto done;
+		}
+
+		next++;
+	}
+
+	trace_kgsl_reclaim_process(process, count, false);
+	set_bit(KGSL_PROC_PINNED_STATE, &process->state);
+done:
+	mutex_unlock(&process->reclaim_lock);
+	return ret;
+}
+
+static void kgsl_reclaim_foreground_work(struct work_struct *work)
+{
+	struct kgsl_process_private *process =
+		container_of(work, struct kgsl_process_private, fg_work);
+
+	if (test_bit(KGSL_PROC_STATE, &process->state))
+		kgsl_reclaim_to_pinned_state(process);
+	kgsl_process_private_put(process);
+}
+
+static ssize_t kgsl_proc_state_show(struct kobject *kobj,
+		struct kgsl_process_attribute *attr, char *buf)
+{
+	struct kgsl_process_private *process =
+		container_of(kobj, struct kgsl_process_private, kobj);
+
+	if (test_bit(KGSL_PROC_STATE, &process->state))
+		return scnprintf(buf, PAGE_SIZE, "foreground\n");
+	else
+		return scnprintf(buf, PAGE_SIZE, "background\n");
+}
+
+static ssize_t kgsl_proc_state_store(struct kobject *kobj,
+	struct kgsl_process_attribute *attr, const char *buf, ssize_t count)
+{
+	struct kgsl_process_private *process =
+		container_of(kobj, struct kgsl_process_private, kobj);
+
+	if (sysfs_streq(buf, "foreground")) {
+		if (!test_and_set_bit(KGSL_PROC_STATE, &process->state) &&
+			kgsl_process_private_get(process))
+			kgsl_schedule_work(&process->fg_work);
+	} else if (sysfs_streq(buf, "background")) {
+		clear_bit(KGSL_PROC_STATE, &process->state);
+	} else
+		return -EINVAL;
+
+	return count;
+}
+
+static ssize_t gpumem_reclaimed_show(struct kobject *kobj,
+		struct kgsl_process_attribute *attr, char *buf)
+{
+	struct kgsl_process_private *process =
+		container_of(kobj, struct kgsl_process_private, kobj);
+
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+		atomic_read(&process->unpinned_page_count) << PAGE_SHIFT);
+}
+
+PROCESS_ATTR(state, 0644, kgsl_proc_state_show, kgsl_proc_state_store);
+PROCESS_ATTR(gpumem_reclaimed, 0444, gpumem_reclaimed_show, NULL);
+
+static const struct attribute *proc_reclaim_attrs[] = {
+	&attr_state.attr,
+	&attr_gpumem_reclaimed.attr,
+	NULL,
+};
+
+void kgsl_reclaim_proc_sysfs_init(struct kgsl_process_private *process)
+{
+	WARN_ON(sysfs_create_files(&process->kobj, proc_reclaim_attrs));
+}
+
+ssize_t kgsl_proc_max_reclaim_limit_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count)
+{
+	int ret;
+
+	ret = kstrtou32(buf, 0, &kgsl_reclaim_max_page_limit);
+	return ret ? ret : count;
+}
+
+ssize_t kgsl_proc_max_reclaim_limit_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%d\n", kgsl_reclaim_max_page_limit);
+}
+
+ssize_t kgsl_nr_to_scan_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count)
+{
+	int ret;
+
+	ret = kstrtou32(buf, 0, &kgsl_nr_to_scan);
+	return ret ? ret : count;
+}
+
+ssize_t kgsl_nr_to_scan_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%d\n", kgsl_nr_to_scan);
+}
+
+static void kgsl_release_page_vec(struct pagevec *pvec)
+{
+	check_move_unevictable_pages(pvec);
+	__pagevec_release(pvec);
+}
+
+static u32 kgsl_reclaim_process(struct kgsl_process_private *process,
+		u32 pages_to_reclaim)
+{
+	struct kgsl_memdesc *memdesc;
+	struct kgsl_mem_entry *entry, *valid_entry;
+	u32 next = 0, remaining = pages_to_reclaim;
+
+	/*
+	 * If we do not get the lock here, it means that the buffers are
+	 * being pinned back. So do not keep waiting here as we would anyway
+	 * return empty handed once the lock is acquired.
+	 */
+	if (!mutex_trylock(&process->reclaim_lock))
+		return 0;
+
+	while (remaining) {
+
+		if (atomic_read(&process->unpinned_page_count) >=
+				kgsl_reclaim_max_page_limit)
+			break;
+
+		/* Abort reclaim if process submitted work. */
+		if (atomic_read(&process->cmd_count))
+			break;
+
+		/* Abort reclaim if process foreground hint is received. */
+		if (test_bit(KGSL_PROC_STATE, &process->state))
+			break;
+
+		valid_entry = NULL;
+		spin_lock(&process->mem_lock);
+		entry = idr_get_next(&process->mem_idr, &next);
+		if (entry == NULL) {
+			spin_unlock(&process->mem_lock);
+			break;
+		}
+
+		memdesc = &entry->memdesc;
+		if (!entry->pending_free &&
+				(memdesc->priv & KGSL_MEMDESC_CAN_RECLAIM) &&
+				!(memdesc->priv & KGSL_MEMDESC_RECLAIMED) &&
+				!(memdesc->priv & KGSL_MEMDESC_SKIP_RECLAIM))
+			valid_entry = kgsl_mem_entry_get(entry);
+		spin_unlock(&process->mem_lock);
+
+		if (!valid_entry) {
+			next++;
+			continue;
+		}
+
+		/* Do not reclaim pages mapped into a VBO */
+		if (atomic_read(&valid_entry->vbo_count)) {
+			kgsl_mem_entry_put(entry);
+			next++;
+			continue;
+		}
+
+		if ((atomic_read(&process->unpinned_page_count) +
+			memdesc->page_count) > kgsl_reclaim_max_page_limit) {
+			kgsl_mem_entry_put(entry);
+			next++;
+			continue;
+		}
+
+		if (memdesc->page_count > remaining) {
+			kgsl_mem_entry_put(entry);
+			next++;
+			continue;
+		}
+
+		if (!kgsl_mmu_unmap(memdesc->pagetable, memdesc)) {
+			int i;
+			struct pagevec pvec;
+
+			/*
+			 * Pages that are first allocated are by default added to
+			 * unevictable list. To reclaim them, we first clear the
+			 * AS_UNEVICTABLE flag of the shmem file address space thus
+			 * check_move_unevictable_pages() places them on the
+			 * evictable list.
+			 *
+			 * Once reclaim is done, hint that further shmem allocations
+			 * will have to be on the unevictable list.
+			 */
+			mapping_clear_unevictable(memdesc->shmem_filp->f_mapping);
+			pagevec_init(&pvec);
+			for (i = 0; i < memdesc->page_count; i++) {
+				set_page_dirty_lock(memdesc->pages[i]);
+				spin_lock(&memdesc->lock);
+				pagevec_add(&pvec, memdesc->pages[i]);
+				memdesc->pages[i] = NULL;
+				atomic_inc(&process->unpinned_page_count);
+				spin_unlock(&memdesc->lock);
+				if (pagevec_count(&pvec) == PAGEVEC_SIZE)
+					kgsl_release_page_vec(&pvec);
+				remaining--;
+			}
+			if (pagevec_count(&pvec))
+				kgsl_release_page_vec(&pvec);
+
+			reclaim_shmem_address_space(memdesc->shmem_filp->f_mapping);
+			mapping_set_unevictable(memdesc->shmem_filp->f_mapping);
+			memdesc->priv |= KGSL_MEMDESC_RECLAIMED;
+			trace_kgsl_reclaim_memdesc(entry, true);
+		}
+
+		kgsl_mem_entry_put(entry);
+		next++;
+	}
+
+	if (next)
+		clear_bit(KGSL_PROC_PINNED_STATE, &process->state);
+
+	trace_kgsl_reclaim_process(process, pages_to_reclaim - remaining, true);
+	mutex_unlock(&process->reclaim_lock);
+
+	return (pages_to_reclaim - remaining);
+}
+
+static void kgsl_reclaim_background_work(struct work_struct *work)
+{
+	u32 bg_proc = 0, nr_pages = atomic_read(&kgsl_nr_to_reclaim);
+	u64 pp_nr_pages;
+	struct list_head kgsl_reclaim_process_list;
+	struct kgsl_process_private *process, *next;
+
+	INIT_LIST_HEAD(&kgsl_reclaim_process_list);
+	read_lock(&kgsl_driver.proclist_lock);
+	list_for_each_entry(process, &kgsl_driver.process_list, list) {
+		if (test_bit(KGSL_PROC_STATE, &process->state) ||
+				!kgsl_process_private_get(process))
+			continue;
+
+		bg_proc++;
+		list_add(&process->reclaim_list, &kgsl_reclaim_process_list);
+	}
+	read_unlock(&kgsl_driver.proclist_lock);
+
+	list_for_each_entry(process, &kgsl_reclaim_process_list, reclaim_list) {
+		if (!nr_pages)
+			break;
+
+		pp_nr_pages = nr_pages;
+		do_div(pp_nr_pages, bg_proc--);
+		nr_pages -= kgsl_reclaim_process(process, pp_nr_pages);
+	}
+
+	list_for_each_entry_safe(process, next,
+			&kgsl_reclaim_process_list, reclaim_list) {
+		list_del(&process->reclaim_list);
+		kgsl_process_private_put(process);
+	}
+}
+
+/* Shrinker callback functions */
+static unsigned long
+kgsl_reclaim_shrink_scan_objects(struct shrinker *shrinker,
+		struct shrink_control *sc)
+{
+	if (!current_is_kswapd())
+		return 0;
+
+	atomic_set(&kgsl_nr_to_reclaim, kgsl_nr_to_scan ?
+					kgsl_nr_to_scan : sc->nr_to_scan);
+	kgsl_schedule_work(&reclaim_work);
+
+	return atomic_read(&kgsl_nr_to_reclaim);
+}
+
+static unsigned long
+kgsl_reclaim_shrink_count_objects(struct shrinker *shrinker,
+		struct shrink_control *sc)
+{
+	struct kgsl_process_private *process;
+	unsigned long count_reclaimable = 0;
+
+	if (!current_is_kswapd())
+		return 0;
+
+	read_lock(&kgsl_driver.proclist_lock);
+	list_for_each_entry(process, &kgsl_driver.process_list, list) {
+		if (!test_bit(KGSL_PROC_STATE, &process->state))
+			count_reclaimable += kgsl_reclaim_max_page_limit -
+				atomic_read(&process->unpinned_page_count);
+	}
+	read_unlock(&kgsl_driver.proclist_lock);
+
+	return count_reclaimable;
+}
+
+/* Shrinker callback data*/
+static struct shrinker kgsl_reclaim_shrinker = {
+	.count_objects = kgsl_reclaim_shrink_count_objects,
+	.scan_objects = kgsl_reclaim_shrink_scan_objects,
+	.seeks = DEFAULT_SEEKS,
+	.batch = 0,
+};
+
+void kgsl_reclaim_proc_private_init(struct kgsl_process_private *process)
+{
+	mutex_init(&process->reclaim_lock);
+	INIT_WORK(&process->fg_work, kgsl_reclaim_foreground_work);
+	set_bit(KGSL_PROC_PINNED_STATE, &process->state);
+	set_bit(KGSL_PROC_STATE, &process->state);
+	atomic_set(&process->unpinned_page_count, 0);
+}
+
+int kgsl_reclaim_start(void)
+{
+	int ret;
+
+	/* Initialize shrinker */
+#if (KERNEL_VERSION(6, 0, 0) <= LINUX_VERSION_CODE)
+	ret = register_shrinker(&kgsl_reclaim_shrinker, "kgsl_reclaim_shrinker");
+#else
+	ret = register_shrinker(&kgsl_reclaim_shrinker);
+#endif
+	if (ret)
+		pr_err("kgsl: reclaim: Failed to register shrinker\n");
+
+	return ret;
+}
+
+int kgsl_reclaim_init(void)
+{
+	int ret = kgsl_reclaim_start();
+
+	if (ret)
+		return ret;
+
+	INIT_WORK(&reclaim_work, kgsl_reclaim_background_work);
+
+	return 0;
+}
+
+void kgsl_reclaim_close(void)
+{
+	/* Unregister shrinker */
+	unregister_shrinker(&kgsl_reclaim_shrinker);
+
+	cancel_work_sync(&reclaim_work);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_reclaim.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_reclaim.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_RECLAIM_H
+#define __KGSL_RECLAIM_H
+
+
+#include "kgsl_device.h"
+
+#ifdef CONFIG_QCOM_KGSL_PROCESS_RECLAIM
+
+/* Set if all the memdescs of this process are pinned */
+#define KGSL_PROC_PINNED_STATE 0
+/* Process foreground/background state. Set if process is in foreground */
+#define KGSL_PROC_STATE 1
+
+int kgsl_reclaim_start(void);
+int kgsl_reclaim_init(void);
+void kgsl_reclaim_close(void);
+int kgsl_reclaim_to_pinned_state(struct kgsl_process_private *priv);
+void kgsl_reclaim_proc_sysfs_init(struct kgsl_process_private *process);
+void kgsl_reclaim_proc_private_init(struct kgsl_process_private *process);
+ssize_t kgsl_proc_max_reclaim_limit_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count);
+ssize_t kgsl_proc_max_reclaim_limit_show(struct device *dev,
+		struct device_attribute *attr, char *buf);
+ssize_t kgsl_nr_to_scan_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count);
+ssize_t kgsl_nr_to_scan_show(struct device *dev,
+		struct device_attribute *attr, char *buf);
+#else
+static inline int kgsl_reclaim_start(void)
+{
+	return 0;
+}
+
+static inline int kgsl_reclaim_init(void)
+{
+	return 0;
+}
+
+static inline void kgsl_reclaim_close(void) { }
+
+static inline int kgsl_reclaim_to_pinned_state(
+		struct kgsl_process_private *priv)
+{
+	return 0;
+}
+
+static inline void kgsl_reclaim_proc_sysfs_init
+		(struct kgsl_process_private *process) { }
+
+static inline void kgsl_reclaim_proc_private_init
+		(struct kgsl_process_private *process) { }
+
+#endif
+#endif /* __KGSL_RECLAIM_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_regmap.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_regmap.c
@@ -0,0 +1,337 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/platform_device.h>
+
+#include "kgsl_regmap.h"
+#include "kgsl_trace.h"
+
+#define region_addr(region, _offset) \
+	((region)->virt + (((_offset) - (region)->offset) << 2))
+
+static int kgsl_regmap_init_region(struct kgsl_regmap *regmap,
+		struct platform_device *pdev,
+		struct kgsl_regmap_region *region,
+		struct resource *res, const struct kgsl_regmap_ops *ops,
+		void *priv)
+{
+	void __iomem *ptr;
+
+	ptr = devm_ioremap(&pdev->dev, res->start, resource_size(res));
+	if (!ptr)
+		return -ENOMEM;
+
+	region->virt = ptr;
+	region->offset = (res->start - regmap->base->start) >> 2;
+	region->size = resource_size(res) >> 2;
+	region->ops = ops;
+	region->priv = priv;
+
+	return 0;
+}
+
+/* Initialize the regmap with the base region.  All added regions will be offset
+ * from this base
+ */
+int kgsl_regmap_init(struct platform_device *pdev, struct kgsl_regmap *regmap,
+		const char *name, const struct kgsl_regmap_ops *ops,
+		void *priv)
+{
+	struct kgsl_regmap_region *region;
+	struct resource *res;
+	int ret;
+
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, name);
+	if (!res)
+		return -ENODEV;
+
+	regmap->base = res;
+
+	region = &regmap->region[0];
+	ret = kgsl_regmap_init_region(regmap, pdev, region, res, ops, priv);
+
+	if (!ret)
+		regmap->count = 1;
+
+	return ret;
+}
+
+/* Add a new region to the regmap */
+int kgsl_regmap_add_region(struct kgsl_regmap *regmap, struct platform_device *pdev,
+		const char *name, const struct kgsl_regmap_ops *ops, void *priv)
+{
+	struct kgsl_regmap_region *region;
+	struct resource *res;
+	int ret;
+
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, name);
+	if (!res)
+		return -ENODEV;
+
+	if (WARN_ON(regmap->count >= ARRAY_SIZE(regmap->region)))
+		return -ENODEV;
+
+	region = &regmap->region[regmap->count];
+
+	ret = kgsl_regmap_init_region(regmap, pdev, region, res, ops, priv);
+	if (!ret)
+		regmap->count++;
+
+	return ret;
+}
+
+#define in_range(a, base, len) \
+	(((a) >= (base)) && ((a) < ((base) + (len))))
+
+struct kgsl_regmap_region *kgsl_regmap_get_region(struct kgsl_regmap *regmap,
+		u32 offset)
+{
+	int i;
+
+	for (i = 0; i < regmap->count; i++) {
+		struct kgsl_regmap_region *region = &regmap->region[i];
+
+		if (in_range(offset, region->offset, region->size))
+			return region;
+	}
+
+	return NULL;
+}
+
+bool kgsl_regmap_valid_offset(struct kgsl_regmap *regmap, u32 offset)
+{
+	if (kgsl_regmap_get_region(regmap, offset))
+		return true;
+
+	return false;
+}
+
+u32 kgsl_regmap_read(struct kgsl_regmap *regmap, u32 offset)
+{
+	struct kgsl_regmap_region *region = kgsl_regmap_get_region(regmap, offset);
+	u32 val;
+
+	if (WARN(!region, "Out of bounds register read offset: 0x%x\n", offset))
+		return 0;
+
+	if (region->ops && region->ops->preaccess)
+		region->ops->preaccess(region);
+
+	val = readl_relaxed(region_addr(region, offset));
+	/* Allow previous read to post before returning the value */
+	rmb();
+
+	return val;
+}
+
+void kgsl_regmap_write(struct kgsl_regmap *regmap, u32 value, u32 offset)
+{
+	struct kgsl_regmap_region *region = kgsl_regmap_get_region(regmap, offset);
+
+	if (WARN(!region, "Out of bounds register write offset: 0x%x\n", offset))
+		return;
+
+	if (region->ops && region->ops->preaccess)
+		region->ops->preaccess(region);
+
+	/* Make sure all pending writes have posted first */
+	wmb();
+	writel_relaxed(value, region_addr(region, offset));
+
+	trace_kgsl_regwrite(offset, value);
+}
+
+void kgsl_regmap_multi_write(struct kgsl_regmap *regmap,
+		const struct kgsl_regmap_list *list, int count)
+{
+	struct kgsl_regmap_region *region, *prev = NULL;
+	int i;
+
+	/*
+	 * do one write barrier to ensure all previous writes are done before
+	 * starting the list
+	 */
+	wmb();
+
+	for (i = 0; i < count; i++) {
+		region = kgsl_regmap_get_region(regmap, list[i].offset);
+
+		if (WARN(!region, "Out of bounds register write offset: 0x%x\n",
+			list[i].offset))
+			continue;
+
+		/*
+		 * The registers might be in different regions. If a region has
+		 * a preaccess function we need to call it at least once before
+		 * writing registers but we don't want to call it every time if
+		 * we can avoid it. "cache" the current region and don't call
+		 * pre-access if it is the same region from the previous access.
+		 * This isn't perfect but it should cut down on some unneeded
+		 * cpu cycles
+		 */
+
+		if (region != prev && region->ops && region->ops->preaccess)
+			region->ops->preaccess(region);
+
+		prev = region;
+
+		writel_relaxed(list[i].val, region_addr(region, list[i].offset));
+		trace_kgsl_regwrite(list[i].val, list[i].offset);
+	}
+}
+
+void kgsl_regmap_rmw(struct kgsl_regmap *regmap, u32 offset, u32 mask,
+		u32 or)
+{
+	struct kgsl_regmap_region *region = kgsl_regmap_get_region(regmap, offset);
+	u32 val;
+
+	if (WARN(!region, "Out of bounds register read-modify-write offset: 0x%x\n",
+		offset))
+		return;
+
+	if (region->ops && region->ops->preaccess)
+		region->ops->preaccess(region);
+
+	val = readl_relaxed(region_addr(region, offset));
+	/* Make sure the read posted and all pending writes are done */
+	mb();
+	writel_relaxed((val & ~mask) | or, region_addr(region, offset));
+
+	trace_kgsl_regwrite(offset, (val & ~mask) | or);
+}
+
+void kgsl_regmap_bulk_write(struct kgsl_regmap *regmap, u32 offset,
+		const void *data, int dwords)
+{
+	struct kgsl_regmap_region *region = kgsl_regmap_get_region(regmap, offset);
+
+	if (WARN(!region, "Out of bounds register bulk write offset: 0x%x\n", offset))
+		return;
+
+	if (region->ops && region->ops->preaccess)
+		region->ops->preaccess(region);
+
+	/*
+	 * A bulk write operation can only be in one region - it cannot
+	 * cross boundaries
+	 */
+	if (WARN((offset - region->offset) + dwords > region->size,
+		"OUt of bounds bulk write size: 0x%x\n", offset + dwords))
+		return;
+
+	/* Make sure all pending write are done first */
+	wmb();
+	memcpy_toio(region_addr(region, offset), data, dwords << 2);
+}
+
+void kgsl_regmap_bulk_read(struct kgsl_regmap *regmap, u32 offset,
+		const void *data, int dwords)
+{
+	struct kgsl_regmap_region *region = kgsl_regmap_get_region(regmap, offset);
+
+	if (WARN(!region, "Out of bounds register bulk read offset: 0x%x\n", offset))
+		return;
+
+	if (region->ops && region->ops->preaccess)
+		region->ops->preaccess(region);
+
+	/*
+	 * A bulk read operation can only be in one region - it cannot
+	 * cross boundaries
+	 */
+	if (WARN((offset - region->offset) + dwords > region->size,
+		"Out of bounds bulk read size: 0x%x\n", offset + dwords))
+		return;
+
+	memcpy_fromio(region_addr(region, offset), data, dwords << 2);
+
+	/* Make sure the copy is finished before moving on */
+	rmb();
+}
+
+void __iomem *kgsl_regmap_virt(struct kgsl_regmap *regmap, u32 offset)
+{
+	struct kgsl_regmap_region *region = kgsl_regmap_get_region(regmap, offset);
+
+	if (region)
+		return region_addr(region, offset);
+
+	return NULL;
+}
+
+void kgsl_regmap_read_indexed(struct kgsl_regmap *regmap, u32 addr,
+		u32 data, u32 *dest, int count)
+{
+	struct kgsl_regmap_region *region = kgsl_regmap_get_region(regmap, addr);
+	int i;
+
+	if (!region)
+		return;
+
+	/* Make sure the offset is in the same region */
+	if (kgsl_regmap_get_region(regmap, data) != region)
+		return;
+
+	if (region->ops && region->ops->preaccess)
+		region->ops->preaccess(region);
+
+	/* Write the address register */
+	writel_relaxed(0, region_addr(region, addr));
+
+	/* Make sure the write finishes */
+	wmb();
+
+	for (i = 0; i < count; i++)
+		dest[i] = readl_relaxed(region_addr(region, data));
+
+	/* Do one barrier at the end to make sure all the data is posted */
+	rmb();
+}
+
+void kgsl_regmap_read_indexed_interleaved(struct kgsl_regmap *regmap, u32 addr,
+		u32 data, u32 *dest, u32 start, int count)
+{
+	struct kgsl_regmap_region *region = kgsl_regmap_get_region(regmap, addr);
+	int i;
+
+	if (!region)
+		return;
+
+	/* Make sure the offset is in the same region */
+	if (kgsl_regmap_get_region(regmap, data) != region)
+		return;
+
+	if (region->ops && region->ops->preaccess)
+		region->ops->preaccess(region);
+
+	for (i = 0; i < count; i++) {
+		/* Write the address register */
+		writel_relaxed(start + i, region_addr(region, addr));
+		/* Make sure the write finishes */
+		wmb();
+
+		dest[i] = readl_relaxed(region_addr(region, data));
+		/* Make sure the read finishes */
+		rmb();
+	}
+}
+
+/* A special helper function to work with read_poll_timeout */
+int kgsl_regmap_poll_read(struct kgsl_regmap_region *region, u32 offset,
+		u32 *val)
+{
+	/* FIXME: WARN on !region? */
+	if (WARN(!region, "Out of bounds poll read: 0x%x\n", offset))
+		return -ENODEV;
+
+	*val = readl_relaxed(region_addr(region, offset));
+	/* Make sure the read is finished before moving on */
+	rmb();
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_regmap.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_regmap.h
@@ -0,0 +1,275 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef KGSL_REGMAP_H
+#define KGSL_REGMAP_H
+
+struct kgsl_regmap;
+struct kgsl_regmap_region;
+
+/**
+ * @ksgl_regmap_ops - Helper functions to access registers in a regmap region
+ */
+struct kgsl_regmap_ops {
+	/**
+	 * @preaccess: called before accesses to the register. This is used by
+	 * adreno to call kgsl_pre_hwaccess()
+	 */
+	void (*preaccess)(struct kgsl_regmap_region *region);
+};
+
+/**
+ * struct kgsl_regmap_region - Defines a region of registers in a kgsl_regmap
+ */
+struct kgsl_regmap_region {
+	/** @virt: Kernel address for the re-mapped region */
+	void __iomem *virt;
+	/** @offset: Dword offset of the region from the regmap base */
+	u32 offset;
+	/** @size: Size of the region in dwords */
+	u32 size;
+	/** @ops: Helper functions to access registers in the region */
+	const struct kgsl_regmap_ops *ops;
+	/** @priv: Private data to send to the ops */
+	void *priv;
+};
+
+/**
+ * struct kgsl_regmap - Define a set of individual regions that are all indexed
+ * from a commmon base. This is used to access GPU and GMU registers in
+ * separate io-remmaped regions from a single set of function calls.
+ */
+struct kgsl_regmap {
+	/**
+	 * @base: Resource pointer for the "base" region (the region that all
+	 * other regions are indexed from)
+	 */
+	struct resource *base;
+	/** @region: Array of regions for this regmap */
+	struct kgsl_regmap_region region[4];
+	/** @count: Number of active regions in @region */
+	int count;
+};
+
+/**
+ * struct kgsl_regmap_list
+ */
+struct kgsl_regmap_list {
+	/** offset: Dword offset of the register to write */
+	u32 offset;
+	/** val: Value to write */
+	u32 val;
+};
+
+/**
+ * kgsl_regmap_init - Initialize a regmap
+ * @pdev: Pointer to the platform device that owns @name
+ * @regmap: Pointer to the regmap to initialize
+ * @name: Name of the resource to map
+ * @ops: Pointer to the regmap ops for this region
+ * @priv: Private data to pass to the regmap ops
+ *
+ * Initialize a regmap and set the resource @name as the base region in the
+ * regmap. All other regions will be indexed from the start of this region.
+ * This will nominally be the start of the GPU register region.
+ *
+ * Return: 0 on success or negative error on failure.
+ */
+int kgsl_regmap_init(struct platform_device *pdev, struct kgsl_regmap *regmap,
+		const char *name, const struct kgsl_regmap_ops *ops,
+		void *priv);
+
+/**
+ * kgsl_regmap_add_region - Add a region to an existing regmap
+ * @regmap: The regmap to add the region to
+ * @pdev: Pointer to the platform device that owns @name
+ * @name: Name of the resource to map
+ * @ops: Pointer to the regmap ops for this region
+ * @priv: Private data to pass to the regmap ops
+ *
+ * Add a new region to the regmap. It will be indexed against the base
+ * address already defined when the regmap was initialized. For example,
+ * if the base GPU address is at physical address 0x3d000000 and the new
+ * region is at physical address 0x3d010000 this region will be added at
+ * (0x3d010000 - 0x3d000000) or dword offset 0x4000.
+ *
+ * Return: 0 on success or negative error on failure.
+ */
+int kgsl_regmap_add_region(struct kgsl_regmap *regmap, struct platform_device *pdev,
+		const char *name, const struct kgsl_regmap_ops *ops, void *priv);
+
+/**
+ * kgsl_regmap_valid_offset - return true if the offset is valid
+ * @regmap: The regmap to query
+ * @offset: The dword offset to query
+ *
+ * Return: True if @offset is a valid register in the regmap
+ */
+bool kgsl_regmap_valid_offset(struct kgsl_regmap *regmap, u32 offset);
+
+/**
+ * kgsl_regmap_read - Read a register from the regmap
+ * @regmap: The regmap to read from
+ * @offset: The dword offset to read
+ *
+ * Read the register at the specified offset indexed against the base address in
+ * the regmap. An offset that falls out of mapped regions will WARN and return
+ * 0.
+ *
+ * Return: The value of the register at @offset
+ */
+u32 kgsl_regmap_read(struct kgsl_regmap *regmap, u32 offset);
+
+/**
+ * kgsl_regmap_write - Write a register to the regmap
+ * @regmap: The regmap to write to
+ * @data: The value to write to @offset
+ * @offset: The dword offset to write
+ *
+ * Write @data to the register at the specified offset indexed against the base
+ * address in he regmap. An offset that falls out of mapped regions will WARN
+ * and skip the write.
+ */
+void kgsl_regmap_write(struct kgsl_regmap *regmap, u32 value, u32 offset);
+
+/**
+ * kgsl_regmap_multi_write - Write a list of registers
+ * @regmap: The regmap to write to
+ * @list: A pointer to an array of &strut kgsl_regmap_list items
+ * @count: NUmber of items in @list
+ *
+ * Write all the registers in @list to the regmap.
+ */
+
+void kgsl_regmap_multi_write(struct kgsl_regmap *regmap,
+	const struct kgsl_regmap_list *list, int count);
+
+/**
+ * kgsl_regmap_rmw - read-modify-write a register in the regmap
+ * @regmap: The regmap to write to
+ * @offset: The dword offset to write
+ * @mask: Mask the register contents against this mask
+ * @or: OR these bits into the register before writing it back again
+ *
+ * Read the register at @offset, mask it against @mask, OR the bits in @or and
+ * write it back to @offset. @offset will be indexed against the base
+ * address in the regmap. An offset that falls out of mapped regions will WARN
+ * and skip the operation.
+ */
+void kgsl_regmap_rmw(struct kgsl_regmap *regmap, u32 offset, u32 mask,
+		u32 or);
+
+/**
+ * kgsl_regmap_bulk_write - Write an array of values to a I/O region
+ * @regmap: The regmap to write to
+ * @offset: The dword offset to start writing to
+ * @data: The data to write
+ * @dwords: Number of dwords to write
+ *
+ * Bulk write @data to the I/O region starting at @offset for @dwords.
+ * The write operation must fit fully inside a single region (no crossing the
+ * boundaries). @offset will be indexed against the base
+ * address in he regmap. An offset that falls out of mapped regions will WARN
+ * and skip the operation.
+ */
+void kgsl_regmap_bulk_write(struct kgsl_regmap *regmap, u32 offset,
+		const void *data, int dwords);
+
+/**
+ * kgsl_regmap_bulk_read - Read an array of values to a I/O region
+ * @regmap: The regmap to read from
+ * @offset: The dword offset to start reading from
+ * @data: The data pointer to read into
+ * @dwords: Number of dwords to read
+ *
+ * Bulk read into @data the I/O region starting at @offset for @dwords.
+ * The read operation must fit fully inside a single region (no crossing the
+ * boundaries). @offset will be indexed against the base
+ * address in the regmap. An offset that falls out of mapped regions will WARN
+ * and skip the operation.
+ */
+void kgsl_regmap_bulk_read(struct kgsl_regmap *regmap, u32 offset,
+		const void *data, int dwords);
+
+/**
+ * kgsl_regmap_virt - Return the kernel address for a offset
+ * @regmap: The regmap to write to
+ * @offset: The dword offset to map to a kernel address
+ *
+ * Return: The kernel address for @offset or NULL if out of range.
+ */
+void __iomem *kgsl_regmap_virt(struct kgsl_regmap *regmap, u32 offset);
+
+/**
+ * kgsl_regmap_read_indexed - Read a indexed pair of registers
+ * @regmap: The regmap to read from
+ * @addr: The offset of the address register for the index pair
+ * @data: The offset of the data register for the index pair
+ * @dest: An array to put the values
+ * @count: Number of dwords to read from @data
+ *
+ * This function configures the address register once and then
+ * reads from the data register in a loop.
+ */
+void kgsl_regmap_read_indexed(struct kgsl_regmap *regmap, u32 addr,
+		u32 data, u32 *dest, int count);
+
+/**
+ * kgsl_regmap_read_indexed_interleaved - Dump an indexed pair of registers
+ * @regmap: The regmap to read from
+ * @addr: The offset of the address register for the index pair
+ * @data: The offset of the data register for the index pair
+ * @dest: An array to put the values
+ * @start: Starting value to be programmed in the address register
+ * @count: Number of dwords to read from @data
+ *
+ * This function is slightly different than kgsl_regmap_read_indexed()
+ * in that it takes as argument a start value that is to be programmed
+ * in the address register and secondly, the address register is to be
+ * configured before every read of the data register.
+ */
+void kgsl_regmap_read_indexed_interleaved(struct kgsl_regmap *regmap, u32 addr,
+		u32 data, u32 *dest, u32 start, int count);
+
+/**
+ * kgsl_regmap_get_region - Return the region for the given offset
+ * @regmap: The regmap to query
+ * @offset: The offset to query
+ *
+ * Return: The &struct kgsl_regmap_region that owns the offset or NULL
+ */
+struct kgsl_regmap_region *kgsl_regmap_get_region(struct kgsl_regmap *regmap,
+		u32 offset);
+
+/**
+ * kgsl_regmap_poll_read - A helper function for kgsl_regmap_read_poll_timeout
+ * @region: Pointer to a &struct kgsl_regmap_region
+ * @offset: Offset to read
+ * @val: Pointer for the result
+ *
+ * This is a special helper function to be called only from
+ * kgsl_regmap_read_poll_timeout.
+ *
+ * Return: 0 on success or -ENODEV if the region is NULL.
+ */
+int kgsl_regmap_poll_read(struct kgsl_regmap_region *region, u32 offset,
+		u32 *val);
+
+#define kgsl_regmap_read_poll_timeout(regmap, offset, val, cond,		\
+		sleep_us, timeout_us)						\
+({										\
+	int __ret, __tmp;							\
+	struct kgsl_regmap_region *region =					\
+		kgsl_regmap_get_region(regmap, offset);				\
+										\
+	if (region && region->ops && region->ops->preaccess)			\
+		region->ops->preaccess(region);					\
+	__tmp = read_poll_timeout(kgsl_regmap_poll_read, __ret, __ret || (cond),\
+			sleep_us, timeout_us, false, region, offset, &(val));	\
+	__ret ?: __tmp;								\
+})
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_sharedmem.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_sharedmem.c
@@ -0,0 +1,1970 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <asm/cacheflush.h>
+#include <linux/of_platform.h>
+#include <linux/highmem.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/shmem_fs.h>
+#include <linux/sched/signal.h>
+#include <linux/version.h>
+
+#include "kgsl_device.h"
+#include "kgsl_pool.h"
+#include "kgsl_reclaim.h"
+#include "kgsl_sharedmem.h"
+
+/*
+ * The user can set this from debugfs to force failed memory allocations to
+ * fail without trying OOM first.  This is a debug setting useful for
+ * stress applications that want to test failure cases without pushing the
+ * system into unrecoverable OOM panics
+ */
+
+bool kgsl_sharedmem_noretry_flag;
+
+static DEFINE_MUTEX(kernel_map_global_lock);
+
+#define MEMTYPE(_type, _name) \
+	static struct kgsl_memtype memtype_##_name = { \
+	.type = _type, \
+	.attr = { .name = __stringify(_name), .mode = 0444 } \
+}
+
+struct kgsl_memtype {
+	unsigned int type;
+	struct attribute attr;
+};
+
+/* We can not use macro MEMTYPE for "any(0)" because of special characters */
+static struct kgsl_memtype memtype_any0 = {
+	.type = KGSL_MEMTYPE_OBJECTANY,
+	.attr = { .name = "any(0)", .mode = 0444 },
+};
+
+MEMTYPE(KGSL_MEMTYPE_FRAMEBUFFER, framebuffer);
+MEMTYPE(KGSL_MEMTYPE_RENDERBUFFER, renderbuffer);
+MEMTYPE(KGSL_MEMTYPE_ARRAYBUFFER, arraybuffer);
+MEMTYPE(KGSL_MEMTYPE_ELEMENTARRAYBUFFER, elementarraybuffer);
+MEMTYPE(KGSL_MEMTYPE_VERTEXARRAYBUFFER, vertexarraybuffer);
+MEMTYPE(KGSL_MEMTYPE_TEXTURE, texture);
+MEMTYPE(KGSL_MEMTYPE_SURFACE, surface);
+MEMTYPE(KGSL_MEMTYPE_EGL_SURFACE, egl_surface);
+MEMTYPE(KGSL_MEMTYPE_GL, gl);
+MEMTYPE(KGSL_MEMTYPE_CL, cl);
+MEMTYPE(KGSL_MEMTYPE_CL_BUFFER_MAP, cl_buffer_map);
+MEMTYPE(KGSL_MEMTYPE_CL_BUFFER_NOMAP, cl_buffer_nomap);
+MEMTYPE(KGSL_MEMTYPE_CL_IMAGE_MAP, cl_image_map);
+MEMTYPE(KGSL_MEMTYPE_CL_IMAGE_NOMAP, cl_image_nomap);
+MEMTYPE(KGSL_MEMTYPE_CL_KERNEL_STACK, cl_kernel_stack);
+MEMTYPE(KGSL_MEMTYPE_COMMAND, command);
+MEMTYPE(KGSL_MEMTYPE_2D, 2d);
+MEMTYPE(KGSL_MEMTYPE_EGL_IMAGE, egl_image);
+MEMTYPE(KGSL_MEMTYPE_EGL_SHADOW, egl_shadow);
+MEMTYPE(KGSL_MEMTYPE_MULTISAMPLE, egl_multisample);
+MEMTYPE(KGSL_MEMTYPE_KERNEL, kernel);
+
+static struct attribute *memtype_attrs[] = {
+	&memtype_any0.attr,
+	&memtype_framebuffer.attr,
+	&memtype_renderbuffer.attr,
+	&memtype_arraybuffer.attr,
+	&memtype_elementarraybuffer.attr,
+	&memtype_vertexarraybuffer.attr,
+	&memtype_texture.attr,
+	&memtype_surface.attr,
+	&memtype_egl_surface.attr,
+	&memtype_gl.attr,
+	&memtype_cl.attr,
+	&memtype_cl_buffer_map.attr,
+	&memtype_cl_buffer_nomap.attr,
+	&memtype_cl_image_map.attr,
+	&memtype_cl_image_nomap.attr,
+	&memtype_cl_kernel_stack.attr,
+	&memtype_command.attr,
+	&memtype_2d.attr,
+	&memtype_egl_image.attr,
+	&memtype_egl_shadow.attr,
+	&memtype_egl_multisample.attr,
+	&memtype_kernel.attr,
+	NULL,
+};
+
+ATTRIBUTE_GROUPS(memtype);
+
+/* An attribute for showing per-process memory statistics */
+struct kgsl_mem_entry_attribute {
+	struct kgsl_process_attribute attr;
+	int memtype;
+	ssize_t (*show)(struct kgsl_process_private *priv,
+		int type, char *buf);
+};
+
+static inline struct kgsl_process_attribute *to_process_attr(
+		struct attribute *attr)
+{
+	return container_of(attr, struct kgsl_process_attribute, attr);
+}
+
+#define to_mem_entry_attr(a) \
+container_of(a, struct kgsl_mem_entry_attribute, attr)
+
+#define __MEM_ENTRY_ATTR(_type, _name, _show) \
+{ \
+	.attr = __ATTR(_name, 0444, mem_entry_sysfs_show, NULL), \
+	.memtype = _type, \
+	.show = _show, \
+}
+
+#define MEM_ENTRY_ATTR(_type, _name, _show)  \
+	static struct kgsl_mem_entry_attribute mem_entry_##_name = \
+		__MEM_ENTRY_ATTR(_type, _name, _show)
+
+static ssize_t mem_entry_sysfs_show(struct kobject *kobj,
+	struct kgsl_process_attribute *attr, char *buf)
+{
+	struct kgsl_mem_entry_attribute *pattr = to_mem_entry_attr(attr);
+	struct kgsl_process_private *priv =
+		container_of(kobj, struct kgsl_process_private, kobj);
+
+	return pattr->show(priv, pattr->memtype, buf);
+}
+
+struct deferred_work {
+	struct kgsl_process_private *private;
+	struct work_struct work;
+};
+
+static void process_private_deferred_put(struct work_struct *work)
+{
+	struct deferred_work *free_work =
+		container_of(work, struct deferred_work, work);
+
+	kgsl_process_private_put(free_work->private);
+	kfree(free_work);
+}
+
+static ssize_t memtype_sysfs_show(struct kobject *kobj,
+	struct attribute *attr, char *buf)
+{
+	struct kgsl_process_private *priv;
+	struct kgsl_memtype *memtype;
+	struct kgsl_mem_entry *entry;
+	u64 size = 0;
+	int id = 0;
+	struct deferred_work *work = kzalloc(sizeof(struct deferred_work),
+			GFP_KERNEL);
+
+	if (!work)
+		return -ENOMEM;
+
+	priv = container_of(kobj, struct kgsl_process_private, kobj_memtype);
+	memtype = container_of(attr, struct kgsl_memtype, attr);
+
+	/*
+	 * Take a process refcount here and put it back in a deferred manner.
+	 * This is to avoid a deadlock where we put back last reference of the
+	 * process private (via kgsl_mem_entry_put) here and end up trying to
+	 * remove sysfs kobject while we are still in the middle of reading one
+	 * of the sysfs files.
+	 */
+	if (!kgsl_process_private_get(priv)) {
+		kfree(work);
+		return -ENOENT;
+	}
+
+	work->private = priv;
+	INIT_WORK(&work->work, process_private_deferred_put);
+
+	spin_lock(&priv->mem_lock);
+	for (entry = idr_get_next(&priv->mem_idr, &id); entry;
+		id++, entry = idr_get_next(&priv->mem_idr, &id)) {
+		struct kgsl_memdesc *memdesc;
+		unsigned int type;
+
+		if (!kgsl_mem_entry_get(entry))
+			continue;
+		spin_unlock(&priv->mem_lock);
+
+		memdesc = &entry->memdesc;
+		type = kgsl_memdesc_get_memtype(memdesc);
+
+		if (type == memtype->type)
+			size += memdesc->size;
+
+		kgsl_mem_entry_put(entry);
+		spin_lock(&priv->mem_lock);
+	}
+	spin_unlock(&priv->mem_lock);
+
+	queue_work(kgsl_driver.lockless_workqueue, &work->work);
+
+	return scnprintf(buf, PAGE_SIZE, "%llu\n", size);
+}
+
+static const struct sysfs_ops memtype_sysfs_ops = {
+	.show = memtype_sysfs_show,
+};
+
+static struct kobj_type ktype_memtype = {
+	.sysfs_ops = &memtype_sysfs_ops,
+	.default_groups = memtype_groups,
+};
+
+static ssize_t
+imported_mem_show(struct kgsl_process_private *priv,
+				int type, char *buf)
+{
+	struct kgsl_mem_entry *entry;
+	uint64_t imported_mem = 0;
+	int id = 0;
+	struct deferred_work *work = kzalloc(sizeof(struct deferred_work),
+		GFP_KERNEL);
+
+	if (!work)
+		return -ENOMEM;
+
+	/*
+	 * Take a process refcount here and put it back in a deferred manner.
+	 * This is to avoid a deadlock where we put back last reference of the
+	 * process private (via kgsl_mem_entry_put) here and end up trying to
+	 * remove sysfs kobject while we are still in the middle of reading one
+	 * of the sysfs files.
+	 */
+	if (!kgsl_process_private_get(priv)) {
+		kfree(work);
+		return -ENOENT;
+	}
+
+	work->private = priv;
+	INIT_WORK(&work->work, process_private_deferred_put);
+
+	spin_lock(&priv->mem_lock);
+	for (entry = idr_get_next(&priv->mem_idr, &id); entry;
+		id++, entry = idr_get_next(&priv->mem_idr, &id)) {
+
+		int egl_surface_count = 0, egl_image_count = 0;
+		struct kgsl_memdesc *m;
+
+		if (!kgsl_mem_entry_get(entry))
+			continue;
+		spin_unlock(&priv->mem_lock);
+
+		m = &entry->memdesc;
+		if (kgsl_memdesc_usermem_type(m) == KGSL_MEM_ENTRY_ION) {
+			kgsl_get_egl_counts(entry, &egl_surface_count,
+					&egl_image_count);
+
+			if (kgsl_memdesc_get_memtype(m) ==
+						KGSL_MEMTYPE_EGL_SURFACE)
+				imported_mem += m->size;
+			else if (egl_surface_count == 0) {
+				uint64_t size = m->size;
+
+				do_div(size, (egl_image_count ?
+							egl_image_count : 1));
+				imported_mem += size;
+			}
+		}
+
+		kgsl_mem_entry_put(entry);
+		spin_lock(&priv->mem_lock);
+	}
+	spin_unlock(&priv->mem_lock);
+
+	queue_work(kgsl_driver.lockless_workqueue, &work->work);
+
+	return scnprintf(buf, PAGE_SIZE, "%llu\n", imported_mem);
+}
+
+static ssize_t
+gpumem_mapped_show(struct kgsl_process_private *priv,
+				int type, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%lld\n",
+			atomic64_read(&priv->gpumem_mapped));
+}
+
+static ssize_t
+gpumem_unmapped_show(struct kgsl_process_private *priv, int type, char *buf)
+{
+	u64 gpumem_total = atomic64_read(&priv->stats[type].cur);
+	u64 gpumem_mapped = atomic64_read(&priv->gpumem_mapped);
+
+	if (gpumem_mapped > gpumem_total)
+		return -EIO;
+
+	return scnprintf(buf, PAGE_SIZE, "%llu\n",
+			gpumem_total - gpumem_mapped);
+}
+
+/**
+ * Show the current amount of memory allocated for the given memtype
+ */
+
+static ssize_t
+mem_entry_show(struct kgsl_process_private *priv, int type, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%lld\n",
+			atomic64_read(&priv->stats[type].cur));
+}
+
+/**
+ * Show the maximum memory allocated for the given memtype through the life of
+ * the process
+ */
+
+static ssize_t
+mem_entry_max_show(struct kgsl_process_private *priv, int type, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%llu\n", priv->stats[type].max);
+}
+
+static ssize_t process_sysfs_show(struct kobject *kobj,
+	struct attribute *attr, char *buf)
+{
+	struct kgsl_process_attribute *pattr = to_process_attr(attr);
+
+	return pattr->show(kobj, pattr, buf);
+}
+
+static ssize_t process_sysfs_store(struct kobject *kobj,
+	struct attribute *attr, const char *buf, size_t count)
+{
+	struct kgsl_process_attribute *pattr = to_process_attr(attr);
+
+	if (pattr->store)
+		return pattr->store(kobj, pattr, buf, count);
+	return -EIO;
+}
+
+/* Dummy release function - we have nothing to do here */
+static void process_sysfs_release(struct kobject *kobj)
+{
+}
+
+static const struct sysfs_ops process_sysfs_ops = {
+	.show = process_sysfs_show,
+	.store = process_sysfs_store,
+};
+
+MEM_ENTRY_ATTR(KGSL_MEM_ENTRY_KERNEL, kernel, mem_entry_show);
+MEM_ENTRY_ATTR(KGSL_MEM_ENTRY_KERNEL, kernel_max, mem_entry_max_show);
+MEM_ENTRY_ATTR(KGSL_MEM_ENTRY_USER, user, mem_entry_show);
+MEM_ENTRY_ATTR(KGSL_MEM_ENTRY_USER, user_max, mem_entry_max_show);
+#ifdef CONFIG_ION
+MEM_ENTRY_ATTR(KGSL_MEM_ENTRY_USER, ion, mem_entry_show);
+MEM_ENTRY_ATTR(KGSL_MEM_ENTRY_USER, ion_max, mem_entry_max_show);
+#endif
+MEM_ENTRY_ATTR(0, imported_mem, imported_mem_show);
+MEM_ENTRY_ATTR(0, gpumem_mapped, gpumem_mapped_show);
+MEM_ENTRY_ATTR(KGSL_MEM_ENTRY_KERNEL, gpumem_unmapped, gpumem_unmapped_show);
+
+static struct attribute *mem_entry_attrs[] = {
+	&mem_entry_kernel.attr.attr,
+	&mem_entry_kernel_max.attr.attr,
+	&mem_entry_user.attr.attr,
+	&mem_entry_user_max.attr.attr,
+#ifdef CONFIG_ION
+	&mem_entry_ion.attr.attr,
+	&mem_entry_ion_max.attr.attr,
+#endif
+	&mem_entry_imported_mem.attr.attr,
+	&mem_entry_gpumem_mapped.attr.attr,
+	&mem_entry_gpumem_unmapped.attr.attr,
+	NULL,
+};
+ATTRIBUTE_GROUPS(mem_entry);
+
+static struct kobj_type process_ktype = {
+	.sysfs_ops = &process_sysfs_ops,
+	.release = &process_sysfs_release,
+	.default_groups = mem_entry_groups,
+};
+#ifdef CONFIG_QCOM_KGSL_PROCESS_RECLAIM
+static struct device_attribute dev_attr_max_reclaim_limit = {
+	.attr = { .name = "max_reclaim_limit", .mode = 0644 },
+	.show = kgsl_proc_max_reclaim_limit_show,
+	.store = kgsl_proc_max_reclaim_limit_store,
+};
+
+static struct device_attribute dev_attr_page_reclaim_per_call = {
+	.attr = { .name = "page_reclaim_per_call", .mode = 0644 },
+	.show = kgsl_nr_to_scan_show,
+	.store = kgsl_nr_to_scan_store,
+};
+#endif
+
+/**
+ * kgsl_process_init_sysfs() - Initialize and create sysfs files for a process
+ *
+ * @device: Pointer to kgsl device struct
+ * @private: Pointer to the structure for the process
+ *
+ * kgsl_process_init_sysfs() is called at the time of creating the
+ * process struct when a process opens the kgsl device for the first time.
+ * This function creates the sysfs files for the process.
+ */
+void kgsl_process_init_sysfs(struct kgsl_device *device,
+		struct kgsl_process_private *private)
+{
+	if (kobject_init_and_add(&private->kobj, &process_ktype,
+		kgsl_driver.prockobj, "%d", pid_nr(private->pid))) {
+		dev_err(device->dev, "Unable to add sysfs for process %d\n",
+			pid_nr(private->pid));
+	}
+
+	kgsl_reclaim_proc_sysfs_init(private);
+
+	if (kobject_init_and_add(&private->kobj_memtype, &ktype_memtype,
+		&private->kobj, "memtype")) {
+		dev_err(device->dev, "Unable to add memtype sysfs for process %d\n",
+			pid_nr(private->pid));
+	}
+}
+
+static ssize_t memstat_show(struct device *dev,
+			 struct device_attribute *attr, char *buf)
+{
+	uint64_t val = 0;
+
+	if (!strcmp(attr->attr.name, "vmalloc"))
+		val = atomic_long_read(&kgsl_driver.stats.vmalloc);
+	else if (!strcmp(attr->attr.name, "vmalloc_max"))
+		val = atomic_long_read(&kgsl_driver.stats.vmalloc_max);
+	else if (!strcmp(attr->attr.name, "page_alloc"))
+		val = atomic_long_read(&kgsl_driver.stats.page_alloc);
+	else if (!strcmp(attr->attr.name, "page_alloc_max"))
+		val = atomic_long_read(&kgsl_driver.stats.page_alloc_max);
+	else if (!strcmp(attr->attr.name, "coherent"))
+		val = atomic_long_read(&kgsl_driver.stats.coherent);
+	else if (!strcmp(attr->attr.name, "coherent_max"))
+		val = atomic_long_read(&kgsl_driver.stats.coherent_max);
+	else if (!strcmp(attr->attr.name, "secure"))
+		val = atomic_long_read(&kgsl_driver.stats.secure);
+	else if (!strcmp(attr->attr.name, "secure_max"))
+		val = atomic_long_read(&kgsl_driver.stats.secure_max);
+	else if (!strcmp(attr->attr.name, "mapped"))
+		val = atomic_long_read(&kgsl_driver.stats.mapped);
+	else if (!strcmp(attr->attr.name, "mapped_max"))
+		val = atomic_long_read(&kgsl_driver.stats.mapped_max);
+
+	return scnprintf(buf, PAGE_SIZE, "%llu\n", val);
+}
+
+static ssize_t full_cache_threshold_store(struct device *dev,
+					 struct device_attribute *attr,
+					 const char *buf, size_t count)
+{
+	int ret;
+	unsigned int thresh = 0;
+
+	ret = kstrtou32(buf, 0, &thresh);
+	if (ret)
+		return ret;
+
+	kgsl_driver.full_cache_threshold = thresh;
+	return count;
+}
+
+static ssize_t full_cache_threshold_show(struct device *dev,
+					struct device_attribute *attr,
+					char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+			kgsl_driver.full_cache_threshold);
+}
+
+static DEVICE_ATTR(vmalloc, 0444, memstat_show, NULL);
+static DEVICE_ATTR(vmalloc_max, 0444, memstat_show, NULL);
+static DEVICE_ATTR(page_alloc, 0444, memstat_show, NULL);
+static DEVICE_ATTR(page_alloc_max, 0444, memstat_show, NULL);
+static DEVICE_ATTR(coherent, 0444, memstat_show, NULL);
+static DEVICE_ATTR(coherent_max, 0444, memstat_show, NULL);
+static DEVICE_ATTR(secure, 0444, memstat_show, NULL);
+static DEVICE_ATTR(secure_max, 0444, memstat_show, NULL);
+static DEVICE_ATTR(mapped, 0444, memstat_show, NULL);
+static DEVICE_ATTR(mapped_max, 0444, memstat_show, NULL);
+static DEVICE_ATTR_RW(full_cache_threshold);
+
+static const struct attribute *drv_attr_list[] = {
+	&dev_attr_vmalloc.attr,
+	&dev_attr_vmalloc_max.attr,
+	&dev_attr_page_alloc.attr,
+	&dev_attr_page_alloc_max.attr,
+	&dev_attr_coherent.attr,
+	&dev_attr_coherent_max.attr,
+	&dev_attr_secure.attr,
+	&dev_attr_secure_max.attr,
+	&dev_attr_mapped.attr,
+	&dev_attr_mapped_max.attr,
+	&dev_attr_full_cache_threshold.attr,
+#ifdef CONFIG_QCOM_KGSL_PROCESS_RECLAIM
+	&dev_attr_max_reclaim_limit.attr,
+	&dev_attr_page_reclaim_per_call.attr,
+#endif
+	NULL,
+};
+
+int
+kgsl_sharedmem_init_sysfs(void)
+{
+	return sysfs_create_files(&kgsl_driver.virtdev.kobj, drv_attr_list);
+}
+
+static vm_fault_t kgsl_paged_vmfault(struct kgsl_memdesc *memdesc,
+				struct vm_area_struct *vma,
+				struct vm_fault *vmf)
+{
+	int pgoff, ret;
+	struct page *page;
+	unsigned int offset = vmf->address - vma->vm_start;
+
+	if (offset >= memdesc->size)
+		return VM_FAULT_SIGBUS;
+
+	pgoff = offset >> PAGE_SHIFT;
+
+	spin_lock(&memdesc->lock);
+	if (memdesc->pages[pgoff]) {
+		page = memdesc->pages[pgoff];
+		get_page(page);
+	} else {
+		struct kgsl_process_private *priv =
+			((struct kgsl_mem_entry *)vma->vm_private_data)->priv;
+
+		/* We are here because page was reclaimed */
+		memdesc->priv |= KGSL_MEMDESC_SKIP_RECLAIM;
+		spin_unlock(&memdesc->lock);
+
+		page = shmem_read_mapping_page_gfp(
+			memdesc->shmem_filp->f_mapping, pgoff,
+			kgsl_gfp_mask(0));
+		if (IS_ERR(page))
+			return VM_FAULT_SIGBUS;
+		kgsl_page_sync(memdesc->dev, page, PAGE_SIZE, DMA_BIDIRECTIONAL);
+
+		spin_lock(&memdesc->lock);
+		/*
+		 * Update the pages array only if the page was
+		 * not already brought back.
+		 */
+		if (!memdesc->pages[pgoff]) {
+			memdesc->pages[pgoff] = page;
+			atomic_dec(&priv->unpinned_page_count);
+			get_page(page);
+		}
+	}
+	spin_unlock(&memdesc->lock);
+
+	ret = vmf_insert_page(vma, vmf->address, page);
+	put_page(page);
+	return ret;
+}
+
+static void kgsl_paged_unmap_kernel(struct kgsl_memdesc *memdesc)
+{
+	mutex_lock(&kernel_map_global_lock);
+	if (!memdesc->hostptr) {
+		/* If already unmapped the refcount should be 0 */
+		WARN_ON(memdesc->hostptr_count);
+		goto done;
+	}
+	memdesc->hostptr_count--;
+	if (memdesc->hostptr_count)
+		goto done;
+	vunmap(memdesc->hostptr);
+
+	atomic_long_sub(memdesc->size, &kgsl_driver.stats.vmalloc);
+	memdesc->hostptr = NULL;
+done:
+	mutex_unlock(&kernel_map_global_lock);
+}
+
+#if IS_ENABLED(CONFIG_QCOM_SECURE_BUFFER)
+
+#include <soc/qcom/secure_buffer.h>
+
+int kgsl_lock_sgt(struct sg_table *sgt, u64 size)
+{
+	int dest_perms = PERM_READ | PERM_WRITE;
+	int source_vm = VMID_HLOS;
+	int dest_vm = VMID_CP_PIXEL;
+	int ret;
+
+	do {
+		ret = hyp_assign_table(sgt, &source_vm, 1, &dest_vm,
+					&dest_perms, 1);
+	} while (ret == -EAGAIN);
+
+	if (ret) {
+		/*
+		 * If returned error code is EADDRNOTAVAIL, then this
+		 * memory may no longer be in a usable state as security
+		 * state of the pages is unknown after this failure. This
+		 * memory can neither be added back to the pool nor buddy
+		 * system.
+		 */
+		if (ret == -EADDRNOTAVAIL)
+			pr_err("Failure to lock secure GPU memory 0x%llx bytes will not be recoverable\n",
+				size);
+
+		return ret;
+	}
+
+	return 0;
+}
+
+int kgsl_unlock_sgt(struct sg_table *sgt)
+{
+	int dest_perms = PERM_READ | PERM_WRITE | PERM_EXEC;
+	int source_vm = VMID_CP_PIXEL;
+	int dest_vm = VMID_HLOS;
+	int ret;
+
+	do {
+		ret = hyp_assign_table(sgt, &source_vm, 1, &dest_vm,
+					&dest_perms, 1);
+	} while (ret == -EAGAIN);
+
+	if (ret)
+		return ret;
+
+	return 0;
+}
+#endif
+
+static int kgsl_paged_map_kernel(struct kgsl_memdesc *memdesc)
+{
+	int ret = 0;
+
+	/* Sanity check - don't map more than we could possibly chew */
+	if (memdesc->size > ULONG_MAX)
+		return -ENOMEM;
+
+	mutex_lock(&kernel_map_global_lock);
+	if ((!memdesc->hostptr) && (memdesc->pages != NULL)) {
+		pgprot_t page_prot;
+		u64 cache;
+
+		/* Determine user-side caching policy */
+		cache = kgsl_memdesc_get_cachemode(memdesc);
+		switch (cache) {
+		case KGSL_CACHEMODE_WRITETHROUGH:
+			page_prot = PAGE_KERNEL;
+			WARN_ONCE(1, "WRITETHROUGH is deprecated for arm64");
+			break;
+		case KGSL_CACHEMODE_WRITEBACK:
+			page_prot = PAGE_KERNEL;
+			break;
+		case KGSL_CACHEMODE_UNCACHED:
+		case KGSL_CACHEMODE_WRITECOMBINE:
+		default:
+			page_prot = pgprot_writecombine(PAGE_KERNEL);
+			break;
+		}
+
+		memdesc->hostptr = vmap(memdesc->pages, memdesc->page_count,
+					VM_IOREMAP, page_prot);
+		if (memdesc->hostptr)
+			KGSL_STATS_ADD(memdesc->size,
+				&kgsl_driver.stats.vmalloc,
+				&kgsl_driver.stats.vmalloc_max);
+		else
+			ret = -ENOMEM;
+	}
+	if (memdesc->hostptr)
+		memdesc->hostptr_count++;
+
+	mutex_unlock(&kernel_map_global_lock);
+
+	return ret;
+}
+
+static vm_fault_t kgsl_contiguous_vmfault(struct kgsl_memdesc *memdesc,
+				struct vm_area_struct *vma,
+				struct vm_fault *vmf)
+{
+	unsigned long offset, pfn;
+
+	offset = ((unsigned long) vmf->address - vma->vm_start) >>
+		PAGE_SHIFT;
+
+	pfn = (memdesc->physaddr >> PAGE_SHIFT) + offset;
+	return vmf_insert_pfn(vma, vmf->address, pfn);
+}
+
+static void _dma_cache_op(struct device *dev, struct page *page,
+		unsigned int op)
+{
+	struct scatterlist sgl;
+
+	sg_init_table(&sgl, 1);
+	sg_set_page(&sgl, page, PAGE_SIZE, 0);
+	sg_dma_address(&sgl) = page_to_phys(page);
+
+	/*
+	 * APIs for Cache Maintenance Operations are updated in kernel
+	 * version 6.1. Prior to 6.1, dma_sync_sg_for_device() with
+	 * DMA_FROM_DEVICE as direction triggers cache invalidate and
+	 * clean whereas in kernel version 6.1, it triggers only cache
+	 * clean. Hence use dma_sync_sg_for_cpu() for cache invalidate
+	 * for kernel version 6.1 and above.
+	 */
+
+	switch (op) {
+	case KGSL_CACHE_OP_FLUSH:
+		dma_sync_sg_for_device(dev, &sgl, 1, DMA_TO_DEVICE);
+#if (KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE)
+		dma_sync_sg_for_cpu(dev, &sgl, 1, DMA_FROM_DEVICE);
+#else
+		dma_sync_sg_for_device(dev, &sgl, 1, DMA_FROM_DEVICE);
+#endif
+		break;
+	case KGSL_CACHE_OP_CLEAN:
+		dma_sync_sg_for_device(dev, &sgl, 1, DMA_TO_DEVICE);
+		break;
+	case KGSL_CACHE_OP_INV:
+		dma_sync_sg_for_device(dev, &sgl, 1, DMA_FROM_DEVICE);
+#if (KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE)
+		dma_sync_sg_for_cpu(dev, &sgl, 1, DMA_FROM_DEVICE);
+#endif
+		break;
+	}
+}
+
+int kgsl_cache_range_op(struct kgsl_memdesc *memdesc, uint64_t offset,
+		uint64_t size, unsigned int op)
+{
+	int i;
+
+	if (memdesc->flags & KGSL_MEMFLAGS_IOCOHERENT)
+		return 0;
+
+	if (size == 0 || size > UINT_MAX)
+		return -EINVAL;
+
+	/* Make sure that the offset + size does not overflow */
+	if ((offset + size < offset) || (offset + size < size))
+		return -ERANGE;
+
+	/* Check that offset+length does not exceed memdesc->size */
+	if (offset + size > memdesc->size)
+		return -ERANGE;
+
+	size += offset & PAGE_MASK;
+	offset &= ~PAGE_MASK;
+
+	/* If there is a sgt, use for_each_sg_page to walk it */
+	if (memdesc->sgt) {
+		struct sg_page_iter sg_iter;
+
+		for_each_sg_page(memdesc->sgt->sgl, &sg_iter,
+			PAGE_ALIGN(size) >> PAGE_SHIFT, offset >> PAGE_SHIFT)
+			_dma_cache_op(memdesc->dev, sg_page_iter_page(&sg_iter), op);
+		return 0;
+	}
+
+	/* Otherwise just walk through the list of pages */
+	for (i = 0; i < memdesc->page_count; i++) {
+		u64 cur = (i << PAGE_SHIFT);
+
+		if ((cur < offset) || (cur >= (offset + size)))
+			continue;
+
+		_dma_cache_op(memdesc->dev, memdesc->pages[i], op);
+	}
+
+	return 0;
+}
+
+void kgsl_memdesc_init(struct kgsl_device *device,
+			struct kgsl_memdesc *memdesc, uint64_t flags)
+{
+	struct kgsl_mmu *mmu = &device->mmu;
+	unsigned int align;
+
+	memset(memdesc, 0, sizeof(*memdesc));
+	/* Turn off SVM if the system doesn't support it */
+	if (!kgsl_mmu_is_perprocess(mmu))
+		flags &= ~((uint64_t) KGSL_MEMFLAGS_USE_CPU_MAP);
+
+	/* Secure memory disables advanced addressing modes */
+	if (flags & KGSL_MEMFLAGS_SECURE)
+		flags &= ~((uint64_t) KGSL_MEMFLAGS_USE_CPU_MAP);
+
+	/* Disable IO coherence if it is not supported on the chip */
+	if (!kgsl_mmu_has_feature(device, KGSL_MMU_IO_COHERENT)) {
+		flags &= ~((uint64_t) KGSL_MEMFLAGS_IOCOHERENT);
+
+		WARN_ONCE(IS_ENABLED(CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT),
+			"I/O coherency is not supported on this target\n");
+	} else if (IS_ENABLED(CONFIG_QCOM_KGSL_IOCOHERENCY_DEFAULT))
+		flags |= KGSL_MEMFLAGS_IOCOHERENT;
+
+	/*
+	 * We can't enable I/O coherency on uncached surfaces because of
+	 * situations where hardware might snoop the cpu caches which can
+	 * have stale data. This happens primarily due to the limitations
+	 * of dma caching APIs available on arm64
+	 */
+	if (!kgsl_cachemode_is_cached(flags))
+		flags &= ~((u64) KGSL_MEMFLAGS_IOCOHERENT);
+
+	if (kgsl_mmu_has_feature(device, KGSL_MMU_NEED_GUARD_PAGE) ||
+		(flags & KGSL_MEMFLAGS_GUARD_PAGE))
+		memdesc->priv |= KGSL_MEMDESC_GUARD_PAGE;
+
+	if (flags & KGSL_MEMFLAGS_SECURE)
+		memdesc->priv |= KGSL_MEMDESC_SECURE;
+
+	memdesc->flags = flags;
+	memdesc->kgsl_dev = device->dev;
+
+	/*
+	 * For io-coherent buffers don't set memdesc->dev, so that we skip DMA
+	 * cache operations at allocation time
+	 */
+	if (!(flags & KGSL_MEMFLAGS_IOCOHERENT))
+		memdesc->dev = &device->pdev->dev;
+
+	align = max_t(unsigned int,
+		kgsl_memdesc_get_align(memdesc), ilog2(PAGE_SIZE));
+	kgsl_memdesc_set_align(memdesc, align);
+
+	spin_lock_init(&memdesc->lock);
+}
+
+void kgsl_sharedmem_free(struct kgsl_memdesc *memdesc)
+{
+	if (!memdesc || !memdesc->size)
+		return;
+
+	/* Assume if no operations were specified something went bad early */
+	if (!memdesc->ops)
+		return;
+
+	if (memdesc->ops->put_gpuaddr)
+		memdesc->ops->put_gpuaddr(memdesc);
+
+	if (memdesc->ops->free)
+		memdesc->ops->free(memdesc);
+}
+
+int
+kgsl_sharedmem_readl(const struct kgsl_memdesc *memdesc,
+			uint32_t *dst,
+			uint64_t offsetbytes)
+{
+	uint32_t *src;
+
+	if (WARN_ON(memdesc == NULL || memdesc->hostptr == NULL ||
+		dst == NULL))
+		return -EINVAL;
+
+	WARN_ON(offsetbytes % sizeof(uint32_t) != 0);
+	if (offsetbytes % sizeof(uint32_t) != 0)
+		return -EINVAL;
+
+	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));
+	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))
+		return -ERANGE;
+
+	/*
+	 * We are reading shared memory between CPU and GPU.
+	 * Make sure reads before this are complete
+	 */
+	rmb();
+	src = (uint32_t *)(memdesc->hostptr + offsetbytes);
+	*dst = *src;
+	return 0;
+}
+
+void
+kgsl_sharedmem_writel(const struct kgsl_memdesc *memdesc,
+			uint64_t offsetbytes,
+			uint32_t src)
+{
+	/* Quietly return if the memdesc isn't valid */
+	if (IS_ERR_OR_NULL(memdesc) || WARN_ON(!memdesc->hostptr))
+		return;
+
+	if (WARN_ON(!IS_ALIGNED(offsetbytes, sizeof(u32))))
+		return;
+
+	if (WARN_ON(offsetbytes > (memdesc->size - sizeof(u32))))
+		return;
+
+	*((u32 *) (memdesc->hostptr + offsetbytes)) = src;
+
+	/* Make sure the write is posted before continuing */
+	wmb();
+}
+
+int
+kgsl_sharedmem_readq(const struct kgsl_memdesc *memdesc,
+			uint64_t *dst,
+			uint64_t offsetbytes)
+{
+	uint64_t *src;
+
+	if (WARN_ON(memdesc == NULL || memdesc->hostptr == NULL ||
+		dst == NULL))
+		return -EINVAL;
+
+	WARN_ON(offsetbytes % sizeof(uint32_t) != 0);
+	if (offsetbytes % sizeof(uint32_t) != 0)
+		return -EINVAL;
+
+	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));
+	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))
+		return -ERANGE;
+
+	/*
+	 * We are reading shared memory between CPU and GPU.
+	 * Make sure reads before this are complete
+	 */
+	rmb();
+	src = (uint64_t *)(memdesc->hostptr + offsetbytes);
+	*dst = *src;
+	return 0;
+}
+
+void
+kgsl_sharedmem_writeq(const struct kgsl_memdesc *memdesc,
+			uint64_t offsetbytes,
+			uint64_t src)
+{
+	/* Quietly return if the memdesc isn't valid */
+	if (IS_ERR_OR_NULL(memdesc) || WARN_ON(!memdesc->hostptr))
+		return;
+
+	if (WARN_ON(!IS_ALIGNED(offsetbytes, sizeof(u64))))
+		return;
+
+	if (WARN_ON(offsetbytes > (memdesc->size - sizeof(u64))))
+		return;
+
+	*((u64 *) (memdesc->hostptr + offsetbytes)) = src;
+
+	/* Make sure the write is posted before continuing */
+	wmb();
+}
+
+void kgsl_get_memory_usage(char *name, size_t name_size, uint64_t memflags)
+{
+	unsigned int type = FIELD_GET(KGSL_MEMTYPE_MASK, memflags);
+	struct kgsl_memtype *memtype;
+	int i;
+
+	for (i = 0; memtype_attrs[i]; i++) {
+		memtype = container_of(memtype_attrs[i], struct kgsl_memtype, attr);
+		if (memtype->type == type) {
+			strscpy(name, memtype->attr.name, name_size);
+			return;
+		}
+	}
+
+	snprintf(name, name_size, "VK/others(%3d)", type);
+}
+
+int kgsl_memdesc_sg_dma(struct kgsl_memdesc *memdesc,
+		phys_addr_t addr, u64 size)
+{
+	int ret;
+	struct page *page = phys_to_page(addr);
+
+	memdesc->sgt = kmalloc(sizeof(*memdesc->sgt), GFP_KERNEL);
+	if (memdesc->sgt == NULL)
+		return -ENOMEM;
+
+	ret = sg_alloc_table(memdesc->sgt, 1, GFP_KERNEL);
+	if (ret) {
+		kfree(memdesc->sgt);
+		memdesc->sgt = NULL;
+		return ret;
+	}
+
+	sg_set_page(memdesc->sgt->sgl, page, (size_t) size, 0);
+	return 0;
+}
+
+static void _kgsl_contiguous_free(struct kgsl_memdesc *memdesc)
+{
+	dma_free_attrs(memdesc->dev, memdesc->size,
+			memdesc->hostptr, memdesc->physaddr,
+			memdesc->attrs);
+
+	sg_free_table(memdesc->sgt);
+	kfree(memdesc->sgt);
+
+	memdesc->sgt = NULL;
+}
+
+static void kgsl_contiguous_free(struct kgsl_memdesc *memdesc)
+{
+	if (!memdesc->hostptr)
+		return;
+
+	if (memdesc->priv & KGSL_MEMDESC_MAPPED)
+		return;
+
+	atomic_long_sub(memdesc->size, &kgsl_driver.stats.coherent);
+
+	_kgsl_contiguous_free(memdesc);
+}
+
+#ifdef CONFIG_QCOM_KGSL_USE_SHMEM
+#include <linux/shmem_fs.h>
+#include <trace/hooks/mm.h>
+
+static int _kgsl_shmem_alloc_page(struct kgsl_memdesc *memdesc, u32 order)
+{
+	int pcount;
+	struct page *page;
+	gfp_t gfp_mask = kgsl_gfp_mask(order);
+
+	if (fatal_signal_pending(current))
+		return -ENOMEM;
+
+	/* Allocate non compound page to split 4K page chunks */
+	gfp_mask &= ~__GFP_COMP;
+
+	page = alloc_pages(gfp_mask, order);
+	if (page == NULL) {
+		/* Retry with lower order pages */
+		if (order > 1)
+			return -EAGAIN;
+		else
+			return -ENOMEM;
+	}
+
+	/* Split non-compound higher-order pages to 4k pages */
+	split_page(page, order);
+
+	for (pcount = 0; pcount < (1 << order); pcount++) {
+		clear_highpage(&page[pcount]);
+		list_add_tail(&page[pcount].lru, &memdesc->shmem_page_list);
+	}
+
+	return pcount;
+}
+
+static int kgsl_shmem_alloc_pages(struct kgsl_memdesc *memdesc)
+{
+	int ret, count = 0;
+	u32 size, align, order;
+	/* Length of remaining unallocated memdesc pages */
+	u64 len = memdesc->size - ((u64)memdesc->page_count << PAGE_SHIFT);
+
+	/* 4k allocation managed by the SHMEM */
+	if (len == PAGE_SIZE)
+		return 0;
+
+	/* Start with 1MB alignment to get the biggest page we can */
+	align = ilog2(SZ_1M);
+	size = kgsl_get_page_size(len, align);
+	order = get_order(size);
+
+	while (len) {
+		ret = _kgsl_shmem_alloc_page(memdesc, order);
+
+		if (ret == -EAGAIN) {
+			size = PAGE_SIZE << --order;
+			size = kgsl_get_page_size(size, ilog2(size));
+			align = ilog2(size);
+			continue;
+		} else if (ret <= 0) {
+			return -ENOMEM;
+		}
+
+		count += ret;
+		len -= size;
+		size = kgsl_get_page_size(len, align);
+		align = ilog2(size);
+		order = get_order(size);
+	}
+	return count;
+}
+
+static void kgsl_shmem_fill_page(void *ptr,
+	struct shmem_inode_info *inode, struct folio **folio)
+{
+	struct kgsl_memdesc *memdesc = (struct kgsl_memdesc *)inode->android_vendor_data1;
+
+	if (IS_ERR_OR_NULL(memdesc))
+		return;
+
+	if (list_empty(&memdesc->shmem_page_list)) {
+		int ret = kgsl_shmem_alloc_pages(memdesc);
+
+		if (ret <= 0)
+			return;
+	}
+
+	*folio = list_first_entry(&memdesc->shmem_page_list, struct folio, lru);
+	list_del(&(*folio)->lru);
+}
+
+void kgsl_register_shmem_callback(void)
+{
+	register_trace_android_rvh_shmem_get_folio(kgsl_shmem_fill_page, NULL);
+}
+
+static int kgsl_alloc_page(struct kgsl_memdesc *memdesc, int *page_size,
+			struct page **pages, unsigned int pages_len,
+			unsigned int *align, unsigned int page_off)
+{
+	struct page *page;
+	u32 pcount = (memdesc->size >> PAGE_SHIFT)  - memdesc->page_count;
+
+	if (pages == NULL)
+		return -EINVAL;
+
+	if (fatal_signal_pending(current))
+		return -ENOMEM;
+
+	page = shmem_read_mapping_page_gfp(memdesc->shmem_filp->f_mapping, page_off,
+			kgsl_gfp_mask(0));
+	if (IS_ERR(page))
+		return PTR_ERR(page);
+
+	/* Clear only shmem driver allocated pages */
+	if ((memdesc->size == PAGE_SIZE) ||
+	    (list_empty(&memdesc->shmem_page_list) && (pcount > 1)))
+		clear_highpage(page);
+
+	kgsl_page_sync(memdesc->kgsl_dev, page, PAGE_SIZE, DMA_TO_DEVICE);
+
+	*page_size = PAGE_SIZE;
+	*pages = page;
+
+	return 1;
+}
+
+static int kgsl_memdesc_file_setup(struct kgsl_memdesc *memdesc)
+{
+	int ret;
+
+	memdesc->shmem_filp = shmem_file_setup("kgsl-3d0", memdesc->size,
+			VM_NORESERVE);
+	if (IS_ERR(memdesc->shmem_filp)) {
+		ret = PTR_ERR(memdesc->shmem_filp);
+		memdesc->shmem_filp = NULL;
+		return ret;
+	}
+
+	INIT_LIST_HEAD(&memdesc->shmem_page_list);
+	SHMEM_I(memdesc->shmem_filp->f_mapping->host)->android_vendor_data1 = (u64)memdesc;
+	mapping_set_unevictable(memdesc->shmem_filp->f_mapping);
+
+	return 0;
+}
+
+static void kgsl_free_page(struct page *p)
+{
+	put_page(p);
+}
+
+static void _kgsl_free_pages(struct kgsl_memdesc *memdesc)
+{
+	int i;
+
+	WARN(!list_empty(&memdesc->shmem_page_list),
+	     "KGSL shmem page list is not empty\n");
+
+	for (i = 0; i < memdesc->page_count; i++)
+		if (memdesc->pages[i])
+			put_page(memdesc->pages[i]);
+
+	SHMEM_I(memdesc->shmem_filp->f_mapping->host)->android_vendor_data1 = 0;
+	fput(memdesc->shmem_filp);
+}
+
+/* If CONFIG_QCOM_KGSL_USE_SHMEM is defined we don't use compound pages */
+static u32 kgsl_get_page_order(struct page *page)
+{
+	return 0;
+}
+#else
+void kgsl_register_shmem_callback(void) { }
+
+static int kgsl_alloc_page(struct kgsl_memdesc *memdesc, int *page_size,
+			struct page **pages, unsigned int pages_len,
+			unsigned int *align, unsigned int page_off)
+{
+	if (fatal_signal_pending(current))
+		return -ENOMEM;
+
+	return kgsl_pool_alloc_page(page_size, pages,
+			pages_len, align, memdesc->kgsl_dev);
+}
+
+static int kgsl_memdesc_file_setup(struct kgsl_memdesc *memdesc)
+{
+	return 0;
+}
+
+static void kgsl_free_page(struct page *p)
+{
+	kgsl_pool_free_page(p);
+}
+
+static void _kgsl_free_pages(struct kgsl_memdesc *memdesc)
+{
+	kgsl_pool_free_pages(memdesc->pages, memdesc->page_count);
+}
+
+static u32 kgsl_get_page_order(struct page *page)
+{
+	return compound_order(page);
+}
+#endif
+
+void kgsl_page_sync(struct device *dev, struct page *page,
+		size_t size, enum dma_data_direction dir)
+{
+	struct scatterlist sg;
+
+	/* The caller may choose not to specify a device on purpose */
+	if (!dev)
+		return;
+
+	sg_init_table(&sg, 1);
+	sg_set_page(&sg, page, size, 0);
+	sg_dma_address(&sg) = page_to_phys(page);
+
+	/*
+	 * APIs for Cache Maintenance Operations are updated in kernel
+	 * version 6.1. Prior to 6.1, dma_sync_sg_for_device() with
+	 * DMA_BIDIRECTIONAL as direction triggers cache invalidate and
+	 * clean whereas in kernel version 6.1, it triggers only cache
+	 * clean. Hence use dma_sync_sg_for_cpu() for cache invalidate
+	 * for kernel version 6.1 and above.
+	 */
+
+	if ((dir == DMA_BIDIRECTIONAL) &&
+		KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) {
+		dma_sync_sg_for_device(dev, &sg, 1, DMA_TO_DEVICE);
+		dma_sync_sg_for_cpu(dev, &sg, 1, DMA_FROM_DEVICE);
+	} else
+		dma_sync_sg_for_device(dev, &sg, 1, dir);
+}
+
+void kgsl_zero_page(struct page *p, unsigned int order,
+		struct device *dev)
+{
+	int i;
+
+	for (i = 0; i < (1 << order); i++) {
+		struct page *page = nth_page(p, i);
+
+		clear_highpage(page);
+	}
+
+	kgsl_page_sync(dev, p, PAGE_SIZE << order, DMA_TO_DEVICE);
+}
+
+gfp_t kgsl_gfp_mask(int page_order)
+{
+	gfp_t gfp_mask = __GFP_HIGHMEM;
+
+	if (page_order > 0) {
+		gfp_mask |= __GFP_COMP | __GFP_NORETRY | __GFP_NOWARN;
+		gfp_mask &= ~__GFP_RECLAIM;
+	} else
+		gfp_mask |= GFP_KERNEL;
+
+	if (kgsl_sharedmem_noretry_flag)
+		gfp_mask |= __GFP_NORETRY | __GFP_NOWARN;
+
+	return gfp_mask;
+}
+
+static int _kgsl_alloc_pages(struct kgsl_memdesc *memdesc,
+		struct page ***pages)
+{
+	int count = 0;
+	int npages = memdesc->size >> PAGE_SHIFT;
+	struct page **local = kvcalloc(npages, sizeof(*local), GFP_KERNEL);
+	u32 page_size, align;
+	u64 len = memdesc->size;
+	bool memwq_flush_done = false;
+
+	if (!local)
+		return -ENOMEM;
+
+	count = kgsl_memdesc_file_setup(memdesc);
+	if (count) {
+		kvfree(local);
+		return count;
+	}
+
+	/* Start with 1MB alignment to get the biggest page we can */
+	align = ilog2(SZ_1M);
+
+	page_size = kgsl_get_page_size(len, align);
+
+	while (len) {
+		int ret = kgsl_alloc_page(memdesc, &page_size, &local[count],
+			npages, &align, count);
+
+		if (ret == -EAGAIN)
+			continue;
+		else if (ret <= 0) {
+			int i;
+
+			/* if OOM, retry once after flushing lockless_workqueue */
+			if (ret == -ENOMEM && !memwq_flush_done) {
+				flush_workqueue(kgsl_driver.lockless_workqueue);
+				memwq_flush_done = true;
+				continue;
+			}
+
+			for (i = 0; i < count; ) {
+				int n = 1 << kgsl_get_page_order(local[i]);
+
+				kgsl_free_page(local[i]);
+				i += n;
+			}
+			kvfree(local);
+
+			if (!kgsl_sharedmem_noretry_flag)
+				pr_err_ratelimited("kgsl: out of memory: only allocated %lldKb of %lldKb requested\n",
+					(memdesc->size - len) >> 10, memdesc->size >> 10);
+
+			if (memdesc->shmem_filp)
+				fput(memdesc->shmem_filp);
+
+			return -ENOMEM;
+		}
+
+		count += ret;
+		memdesc->page_count += ret;
+		npages -= ret;
+		len -= page_size;
+
+		page_size = kgsl_get_page_size(len, align);
+	}
+
+	*pages = local;
+
+	return count;
+}
+
+static void kgsl_free_pages(struct kgsl_memdesc *memdesc)
+{
+	kgsl_paged_unmap_kernel(memdesc);
+	WARN_ON(memdesc->hostptr);
+
+	if (memdesc->priv & KGSL_MEMDESC_MAPPED)
+		return;
+
+	atomic_long_sub(memdesc->size, &kgsl_driver.stats.page_alloc);
+
+	_kgsl_free_pages(memdesc);
+
+	memdesc->page_count = 0;
+	kvfree(memdesc->pages);
+
+	memdesc->pages = NULL;
+}
+
+static void kgsl_free_system_pages(struct kgsl_memdesc *memdesc)
+{
+	int i;
+
+	kgsl_paged_unmap_kernel(memdesc);
+	WARN_ON(memdesc->hostptr);
+
+	if (memdesc->priv & KGSL_MEMDESC_MAPPED)
+		return;
+
+	atomic_long_sub(memdesc->size, &kgsl_driver.stats.page_alloc);
+
+	for (i = 0; i < memdesc->page_count; i++)
+		__free_pages(memdesc->pages[i], get_order(PAGE_SIZE));
+
+	memdesc->page_count = 0;
+	kvfree(memdesc->pages);
+	memdesc->pages = NULL;
+}
+
+void kgsl_unmap_and_put_gpuaddr(struct kgsl_memdesc *memdesc)
+{
+	if (!memdesc->size || !memdesc->gpuaddr)
+		return;
+
+	if (WARN_ON(kgsl_memdesc_is_global(memdesc)))
+		return;
+
+	/*
+	 * Don't release the GPU address if the memory fails to unmap because
+	 * the IOMMU driver will BUG later if we reallocated the address and
+	 * tried to map it
+	 */
+	if (!kgsl_memdesc_is_reclaimed(memdesc) &&
+		kgsl_mmu_unmap(memdesc->pagetable, memdesc))
+		return;
+
+	kgsl_mmu_put_gpuaddr(memdesc->pagetable, memdesc);
+
+	memdesc->gpuaddr = 0;
+	memdesc->pagetable = NULL;
+}
+
+static const struct kgsl_memdesc_ops kgsl_contiguous_ops = {
+	.free = kgsl_contiguous_free,
+	.vmflags = VM_DONTDUMP | VM_PFNMAP | VM_DONTEXPAND | VM_DONTCOPY,
+	.vmfault = kgsl_contiguous_vmfault,
+	.put_gpuaddr = kgsl_unmap_and_put_gpuaddr,
+};
+
+#if IS_ENABLED(CONFIG_QCOM_SECURE_BUFFER)
+static void kgsl_free_pages_from_sgt(struct kgsl_memdesc *memdesc)
+{
+	int i;
+	struct scatterlist *sg;
+
+	for_each_sg(memdesc->sgt->sgl, sg, memdesc->sgt->nents, i) {
+		/*
+		 * sg_alloc_table_from_pages() will collapse any physically
+		 * adjacent pages into a single scatterlist entry. We cannot
+		 * just call __free_pages() on the entire set since we cannot
+		 * ensure that the size is a whole order. Instead, free each
+		 * page or compound page group individually.
+		 */
+		struct page *p = sg_page(sg), *next;
+		unsigned int count;
+		unsigned int j = 0;
+
+		while (j < (sg->length/PAGE_SIZE)) {
+			count = 1 << compound_order(p);
+			next = nth_page(p, count);
+			kgsl_free_page(p);
+
+			p = next;
+			j += count;
+		}
+	}
+
+	if (memdesc->shmem_filp)
+		fput(memdesc->shmem_filp);
+}
+
+static void kgsl_free_secure_system_pages(struct kgsl_memdesc *memdesc)
+{
+	int i;
+	struct scatterlist *sg;
+	int ret;
+
+	if (memdesc->priv & KGSL_MEMDESC_MAPPED)
+		return;
+
+	ret = kgsl_unlock_sgt(memdesc->sgt);
+
+	if (ret) {
+		/*
+		 * Unlock of the secure buffer failed. This buffer will
+		 * be stuck in secure side forever and is unrecoverable.
+		 * Give up on the buffer and don't return it to the
+		 * pool.
+		 */
+		pr_err("kgsl: secure buf unlock failed: gpuaddr: %llx size: %llx ret: %d\n",
+			memdesc->gpuaddr, memdesc->size, ret);
+		return;
+	}
+
+	atomic_long_sub(memdesc->size, &kgsl_driver.stats.secure);
+
+	for_each_sg(memdesc->sgt->sgl, sg, memdesc->sgt->nents, i) {
+		struct page *page = sg_page(sg);
+
+		__free_pages(page, get_order(PAGE_SIZE));
+	}
+
+	sg_free_table(memdesc->sgt);
+	kfree(memdesc->sgt);
+
+	memdesc->sgt = NULL;
+}
+
+static void kgsl_free_secure_pages(struct kgsl_memdesc *memdesc)
+{
+	int ret;
+
+	if (memdesc->priv & KGSL_MEMDESC_MAPPED)
+		return;
+
+	ret = kgsl_unlock_sgt(memdesc->sgt);
+	if (ret) {
+		/*
+		 * Unlock of the secure buffer failed. This buffer will
+		 * be stuck in secure side forever and is unrecoverable.
+		 * Give up on the buffer and don't return it to the
+		 * pool.
+		 */
+		pr_err("kgsl: secure buf unlock failed: gpuaddr: %llx size: %llx ret: %d\n",
+			memdesc->gpuaddr, memdesc->size, ret);
+		return;
+	}
+
+	atomic_long_sub(memdesc->size, &kgsl_driver.stats.secure);
+
+	kgsl_free_pages_from_sgt(memdesc);
+
+	sg_free_table(memdesc->sgt);
+	kfree(memdesc->sgt);
+
+	memdesc->sgt = NULL;
+}
+
+void kgsl_free_secure_page(struct page *page)
+{
+	struct sg_table sgt;
+	struct scatterlist sgl;
+
+	if (!page)
+		return;
+
+	sgt.sgl = &sgl;
+	sgt.nents = 1;
+	sgt.orig_nents = 1;
+	sg_init_table(&sgl, 1);
+	sg_set_page(&sgl, page, PAGE_SIZE, 0);
+
+	kgsl_unlock_sgt(&sgt);
+	__free_page(page);
+}
+
+struct page *kgsl_alloc_secure_page(void)
+{
+	struct page *page;
+	struct sg_table sgt;
+	struct scatterlist sgl;
+	int status;
+
+	page = alloc_page(GFP_KERNEL | __GFP_ZERO |
+			__GFP_NORETRY | __GFP_HIGHMEM);
+	if (!page)
+		return NULL;
+
+	sgt.sgl = &sgl;
+	sgt.nents = 1;
+	sgt.orig_nents = 1;
+	sg_init_table(&sgl, 1);
+	sg_set_page(&sgl, page, PAGE_SIZE, 0);
+
+	status = kgsl_lock_sgt(&sgt, PAGE_SIZE);
+	if (status) {
+		if (status == -EADDRNOTAVAIL)
+			return NULL;
+
+		__free_page(page);
+		return NULL;
+	}
+	return page;
+}
+
+static const struct kgsl_memdesc_ops kgsl_secure_system_ops = {
+	.free = kgsl_free_secure_system_pages,
+	/* FIXME: Make sure vmflags / vmfault does the right thing here */
+};
+
+static const struct kgsl_memdesc_ops kgsl_secure_page_ops = {
+	.free = kgsl_free_secure_pages,
+	/* FIXME: Make sure vmflags / vmfault does the right thing here */
+	.put_gpuaddr = kgsl_unmap_and_put_gpuaddr,
+};
+#else
+void kgsl_free_secure_page(struct page *page)
+{
+}
+
+struct page *kgsl_alloc_secure_page(void)
+{
+	return NULL;
+}
+#endif
+
+static const struct kgsl_memdesc_ops kgsl_page_ops = {
+	.free = kgsl_free_pages,
+	.vmflags = VM_DONTDUMP | VM_DONTEXPAND | VM_DONTCOPY | VM_MIXEDMAP,
+	.vmfault = kgsl_paged_vmfault,
+	.map_kernel = kgsl_paged_map_kernel,
+	.unmap_kernel = kgsl_paged_unmap_kernel,
+	.put_gpuaddr = kgsl_unmap_and_put_gpuaddr,
+};
+
+static const struct kgsl_memdesc_ops kgsl_system_ops = {
+	.free = kgsl_free_system_pages,
+	.vmflags = VM_DONTDUMP | VM_DONTEXPAND | VM_DONTCOPY | VM_MIXEDMAP,
+	.vmfault = kgsl_paged_vmfault,
+	.map_kernel = kgsl_paged_map_kernel,
+	.unmap_kernel = kgsl_paged_unmap_kernel,
+};
+
+static int kgsl_system_alloc_pages(struct kgsl_memdesc *memdesc, struct page ***pages)
+{
+	struct page **local;
+	int i, npages = memdesc->size >> PAGE_SHIFT;
+
+	local = kvcalloc(npages, sizeof(*pages), GFP_KERNEL | __GFP_NORETRY);
+	if (!local)
+		return -ENOMEM;
+
+	for (i = 0; i < npages; i++) {
+		gfp_t gfp = __GFP_ZERO | __GFP_HIGHMEM |
+			GFP_KERNEL | __GFP_NORETRY;
+
+		if (!fatal_signal_pending(current))
+			local[i] = alloc_pages(gfp, get_order(PAGE_SIZE));
+		else
+			local[i] = NULL;
+
+		if (!local[i]) {
+			for (i = i - 1; i >= 0; i--)
+				__free_pages(local[i], get_order(PAGE_SIZE));
+			kvfree(local);
+			return -ENOMEM;
+		}
+
+		/* Make sure the cache is clean */
+		kgsl_page_sync(memdesc->kgsl_dev, local[i], PAGE_SIZE, DMA_TO_DEVICE);
+	}
+
+	*pages = local;
+	memdesc->page_count = npages;
+	return npages;
+}
+
+#if IS_ENABLED(CONFIG_QCOM_SECURE_BUFFER)
+static int kgsl_alloc_secure_pages(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u64 size, u64 flags, u32 priv)
+{
+	struct page **pages;
+	int count;
+	struct sg_table *sgt;
+	int ret;
+
+	size = PAGE_ALIGN(size);
+
+	if (!size || size > UINT_MAX)
+		return -EINVAL;
+
+	kgsl_memdesc_init(device, memdesc, flags);
+	memdesc->priv |= priv;
+	memdesc->size = size;
+
+	if (priv & KGSL_MEMDESC_SYSMEM) {
+		memdesc->ops = &kgsl_secure_system_ops;
+		count = kgsl_system_alloc_pages(memdesc, &pages);
+	} else {
+		memdesc->ops = &kgsl_secure_page_ops;
+		count = _kgsl_alloc_pages(memdesc, &pages);
+	}
+
+	if (count < 0)
+		return count;
+
+	sgt = kzalloc(sizeof(*sgt), GFP_KERNEL);
+	if (!sgt) {
+		_kgsl_free_pages(memdesc);
+		kvfree(pages);
+		return -ENOMEM;
+	}
+
+	ret = sg_alloc_table_from_pages(sgt, pages, count, 0, size, GFP_KERNEL);
+	if (ret) {
+		kfree(sgt);
+		_kgsl_free_pages(memdesc);
+		kvfree(pages);
+		return ret;
+	}
+
+	/* Now that we've moved to a sg table don't need the pages anymore */
+	kvfree(pages);
+
+	ret = kgsl_lock_sgt(sgt, size);
+	if (ret) {
+		if (ret != -EADDRNOTAVAIL)
+			kgsl_free_pages_from_sgt(memdesc);
+		sg_free_table(sgt);
+		kfree(sgt);
+		return ret;
+	}
+
+	memdesc->sgt = sgt;
+
+	KGSL_STATS_ADD(size, &kgsl_driver.stats.secure,
+		&kgsl_driver.stats.secure_max);
+
+	return 0;
+}
+
+static int kgsl_allocate_secure(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u64 size, u64 flags, u32 priv)
+{
+	return kgsl_alloc_secure_pages(device, memdesc, size, flags, priv);
+}
+#else
+static int kgsl_allocate_secure(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u64 size, u64 flags, u32 priv)
+{
+	return -ENODEV;
+}
+#endif
+
+static int kgsl_alloc_pages(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u64 size, u64 flags, u32 priv)
+{
+	struct page **pages;
+	int count;
+
+	size = PAGE_ALIGN(size);
+
+	if (!size || size > UINT_MAX)
+		return -EINVAL;
+
+	kgsl_memdesc_init(device, memdesc, flags);
+	memdesc->priv |= priv;
+	memdesc->size = size;
+
+	if (priv & KGSL_MEMDESC_SYSMEM) {
+		memdesc->ops = &kgsl_system_ops;
+		count = kgsl_system_alloc_pages(memdesc, &pages);
+	} else {
+		memdesc->ops = &kgsl_page_ops;
+		count = _kgsl_alloc_pages(memdesc, &pages);
+	}
+
+	if (count < 0)
+		return count;
+
+	memdesc->pages = pages;
+
+	KGSL_STATS_ADD(size, &kgsl_driver.stats.page_alloc,
+		&kgsl_driver.stats.page_alloc_max);
+
+	return 0;
+}
+
+static int _kgsl_alloc_contiguous(struct device *dev,
+		struct kgsl_memdesc *memdesc, u64 size, unsigned long attrs)
+{
+	int ret;
+	phys_addr_t phys;
+	void *ptr;
+
+	ptr = dma_alloc_attrs(dev, (size_t) size, &phys,
+		GFP_KERNEL, attrs);
+	if (!ptr)
+		return -ENOMEM;
+
+	memdesc->size = size;
+	memdesc->dev = dev;
+	memdesc->hostptr = ptr;
+	memdesc->physaddr = phys;
+	memdesc->gpuaddr = phys;
+	memdesc->attrs = attrs;
+
+	ret = kgsl_memdesc_sg_dma(memdesc, phys, size);
+	if (ret)
+		dma_free_attrs(dev, (size_t) size, ptr, phys, attrs);
+
+	return ret;
+}
+
+static int kgsl_alloc_contiguous(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u64 size, u64 flags, u32 priv)
+{
+	int ret;
+
+	size = PAGE_ALIGN(size);
+
+	if (!size || size > UINT_MAX)
+		return -EINVAL;
+
+	kgsl_memdesc_init(device, memdesc, flags);
+	memdesc->priv |= priv;
+
+	memdesc->ops = &kgsl_contiguous_ops;
+	ret = _kgsl_alloc_contiguous(&device->pdev->dev, memdesc, size, 0);
+
+	if (!ret)
+		KGSL_STATS_ADD(size, &kgsl_driver.stats.coherent,
+			&kgsl_driver.stats.coherent_max);
+
+	return ret;
+}
+
+int kgsl_allocate_user(struct kgsl_device *device, struct kgsl_memdesc *memdesc,
+		u64 size, u64 flags, u32 priv)
+{
+	if (device->mmu.type == KGSL_MMU_TYPE_NONE)
+		return kgsl_alloc_contiguous(device, memdesc, size, flags,
+			priv);
+	else if (flags & KGSL_MEMFLAGS_SECURE)
+		return kgsl_allocate_secure(device, memdesc, size, flags, priv);
+
+	return kgsl_alloc_pages(device, memdesc, size, flags, priv);
+}
+
+int kgsl_allocate_kernel(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u64 size, u64 flags, u32 priv)
+{
+	int ret;
+
+	ret = kgsl_allocate_user(device, memdesc, size, flags, priv);
+	if (ret)
+		return ret;
+
+	if (memdesc->ops->map_kernel) {
+		ret = memdesc->ops->map_kernel(memdesc);
+		if (ret) {
+			kgsl_sharedmem_free(memdesc);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+int kgsl_memdesc_init_fixed(struct kgsl_device *device,
+		struct platform_device *pdev, const char *resource,
+		struct kgsl_memdesc *memdesc)
+{
+	u32 entry[2];
+
+	if (of_property_read_u32_array(pdev->dev.of_node,
+		resource, entry, 2))
+		return -ENODEV;
+
+	kgsl_memdesc_init(device, memdesc, 0);
+	memdesc->physaddr = entry[0];
+	memdesc->size = entry[1];
+
+	return kgsl_memdesc_sg_dma(memdesc, entry[0], entry[1]);
+}
+
+struct kgsl_memdesc *kgsl_allocate_global_fixed(struct kgsl_device *device,
+		const char *resource, const char *name)
+{
+	struct kgsl_global_memdesc *gmd = kzalloc(sizeof(*gmd), GFP_KERNEL);
+	int ret;
+
+	if (!gmd)
+		return ERR_PTR(-ENOMEM);
+
+	ret = kgsl_memdesc_init_fixed(device, device->pdev, resource,
+			&gmd->memdesc);
+	if (ret) {
+		kfree(gmd);
+		return ERR_PTR(ret);
+	}
+
+	gmd->memdesc.priv = KGSL_MEMDESC_GLOBAL;
+	gmd->name = name;
+
+	/*
+	 * No lock here, because this function is only called during probe/init
+	 * while the caller is holding the mutex
+	 */
+	list_add_tail(&gmd->node, &device->globals);
+	kgsl_mmu_map_global(device, &gmd->memdesc, 0);
+
+	return &gmd->memdesc;
+}
+
+static struct kgsl_memdesc *
+kgsl_allocate_secure_global(struct kgsl_device *device,
+		u64 size, u64 flags, u32 priv, const char *name)
+{
+	struct kgsl_global_memdesc *md;
+	int ret;
+
+	md = kzalloc(sizeof(*md), GFP_KERNEL);
+	if (!md)
+		return ERR_PTR(-ENOMEM);
+
+	/* Make sure that we get global memory from system memory */
+	priv |= KGSL_MEMDESC_GLOBAL | KGSL_MEMDESC_SYSMEM;
+
+	ret = kgsl_allocate_secure(device, &md->memdesc, size, flags, priv);
+	if (ret) {
+		kfree(md);
+		return ERR_PTR(ret);
+	}
+
+	md->name = name;
+
+	/*
+	 * No lock here, because this function is only called during probe/init
+	 * while the caller is holding the mutex
+	 */
+	list_add_tail(&md->node, &device->globals);
+
+	/*
+	 * No offset needed, we'll get an address inside of the pagetable
+	 * normally
+	 */
+	kgsl_mmu_map_global(device, &md->memdesc, 0);
+	kgsl_trace_gpu_mem_total(device, md->memdesc.size);
+
+	return &md->memdesc;
+}
+
+struct kgsl_memdesc *kgsl_allocate_global(struct kgsl_device *device,
+		u64 size, u32 padding, u64 flags, u32 priv, const char *name)
+{
+	int ret;
+	struct kgsl_global_memdesc *md;
+
+	if (flags & KGSL_MEMFLAGS_SECURE)
+		return kgsl_allocate_secure_global(device, size, flags, priv,
+			name);
+
+	md = kzalloc(sizeof(*md), GFP_KERNEL);
+	if (!md)
+		return ERR_PTR(-ENOMEM);
+
+	/*
+	 * Make sure that we get global memory from system memory to keep from
+	 * taking up pool memory for the life of the driver
+	 */
+	priv |= KGSL_MEMDESC_GLOBAL | KGSL_MEMDESC_SYSMEM;
+
+	ret = kgsl_allocate_kernel(device, &md->memdesc, size, flags, priv);
+	if (ret) {
+		kfree(md);
+		return ERR_PTR(ret);
+	}
+
+	md->name = name;
+
+	/*
+	 * No lock here, because this function is only called during probe/init
+	 * while the caller is holding the mute
+	 */
+	list_add_tail(&md->node, &device->globals);
+
+	kgsl_mmu_map_global(device, &md->memdesc, padding);
+	kgsl_trace_gpu_mem_total(device, md->memdesc.size);
+
+	return &md->memdesc;
+}
+
+void kgsl_free_globals(struct kgsl_device *device)
+{
+	struct kgsl_global_memdesc *md, *tmp;
+
+	list_for_each_entry_safe(md, tmp, &device->globals, node) {
+		kgsl_sharedmem_free(&md->memdesc);
+		list_del(&md->node);
+		kfree(md);
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_sharedmem.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_sharedmem.h
@@ -0,0 +1,493 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_SHAREDMEM_H
+#define __KGSL_SHAREDMEM_H
+
+#include <linux/bitfield.h>
+#include <linux/dma-mapping.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+
+#include "kgsl.h"
+#include "kgsl_mmu.h"
+
+struct kgsl_device;
+struct kgsl_process_private;
+
+extern bool kgsl_sharedmem_noretry_flag;
+
+#define KGSL_CACHE_OP_INV       0x01
+#define KGSL_CACHE_OP_FLUSH     0x02
+#define KGSL_CACHE_OP_CLEAN     0x03
+
+void kgsl_sharedmem_free(struct kgsl_memdesc *memdesc);
+
+int kgsl_sharedmem_readl(const struct kgsl_memdesc *memdesc,
+			uint32_t *dst,
+			uint64_t offsetbytes);
+
+/**
+ * kgsl_sharedmem_writel - write a 32 bit value to a shared memory object
+ * @memdesc: Pointer to a GPU memory object
+ * @offsetbytes: Offset inside of @memdesc to write to
+ * @src: Value to write
+ *
+ * Write @src to @offsetbytes from the start of @memdesc
+ */
+void kgsl_sharedmem_writel(const struct kgsl_memdesc *memdesc,
+			uint64_t offsetbytes,
+			uint32_t src);
+
+int kgsl_sharedmem_readq(const struct kgsl_memdesc *memdesc,
+			uint64_t *dst,
+			uint64_t offsetbytes);
+
+/**
+ * kgsl_sharedmem_writeq - write a 64 bit value to a shared memory object
+ * @memdesc: Pointer to a GPU memory object
+ * @offsetbytes: Offset inside of @memdesc to write to
+ * @src: Value to write
+ *
+ * Write @src to @offsetbytes from the start of @memdesc
+ */
+void kgsl_sharedmem_writeq(const struct kgsl_memdesc *memdesc,
+			uint64_t offsetbytes,
+			uint64_t src);
+
+int kgsl_cache_range_op(struct kgsl_memdesc *memdesc,
+			uint64_t offset, uint64_t size,
+			unsigned int op);
+
+void kgsl_memdesc_init(struct kgsl_device *device,
+			struct kgsl_memdesc *memdesc, uint64_t flags);
+
+void kgsl_process_init_sysfs(struct kgsl_device *device,
+		struct kgsl_process_private *private);
+
+int kgsl_sharedmem_init_sysfs(void);
+
+void kgsl_get_memory_usage(char *str, size_t len, uint64_t memflags);
+
+void kgsl_free_secure_page(struct page *page);
+
+struct page *kgsl_alloc_secure_page(void);
+
+#if IS_ENABLED(CONFIG_QCOM_SECURE_BUFFER)
+int kgsl_lock_sgt(struct sg_table *sgt, u64 size);
+
+int kgsl_unlock_sgt(struct sg_table *sgt);
+#endif
+
+/**
+ * kgsl_zero_page() - zero out a page
+ * @p: pointer to the struct page
+ * @order: order of the page
+ * @dev: A &struct device pointer
+ *
+ * Map a page into kernel and zero it out
+ */
+void kgsl_zero_page(struct page *p, unsigned int order,
+		struct device *dev);
+
+/**
+ * kgsl_gfp_mask() - get gfp_mask to be used
+ * @page_order: order of the page
+ *
+ * Get the gfp_mask to be used for page allocation
+ * based on the order of the page
+ *
+ * Return appropriate gfp_mask
+ */
+gfp_t kgsl_gfp_mask(int page_order);
+
+/**
+ * kgsl_allocate_user - Allocate user visible GPU memory
+ * @device: A GPU device handle
+ * @memdesc: Memory descriptor for the object
+ * @size: Size of the allocation in bytes
+ * @flags: Control flags for the allocation
+ * @priv: Internal flags for the allocation
+ *
+ * Allocate GPU memory on behalf of the user.
+ * Return: 0 on success or negative on failure.
+ */
+int kgsl_allocate_user(struct kgsl_device *device, struct kgsl_memdesc *memdesc,
+		u64 size, u64 flags, u32 priv);
+
+/**
+ * kgsl_allocate_kernel - Allocate kernel visible GPU memory
+ * @device: A GPU device handle
+ * @memdesc: Memory descriptor for the object
+ * @size: Size of the allocation in bytes
+ * @flags: Control flags for the allocation
+ * @priv: Internal flags for the allocation
+ *
+ * Allocate GPU memory on for use by the kernel. Kernel objects are
+ * automatically mapped into the kernel address space (except for secure).
+ * Return: 0 on success or negative on failure.
+ */
+int kgsl_allocate_kernel(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u64 size, u64 flags, u32 priv);
+
+/**
+ * kgsl_allocate_global - Allocate a global GPU memory object
+ * @device: A GPU device handle
+ * @size: Size of the allocation in bytes
+ * @padding: Amount of extra adding to add to the VA allocation
+ * @flags: Control flags for the allocation
+ * @priv: Internal flags for the allocation
+ * @name: Name of the allocation (for the debugfs file)
+ *
+ * Allocate a global GPU object for use by all processes. The buffer is
+ * automatically mapped into the kernel address space and added to the list of
+ * global buffers that get mapped into each newly created pagetable.
+ * Return: The memory descriptor on success or a ERR_PTR encoded error on
+ * failure.
+ */
+struct kgsl_memdesc *kgsl_allocate_global(struct kgsl_device *device,
+		u64 size, u32 padding, u64 flags, u32 priv, const char *name);
+
+/**
+ * kgsl_allocate_global_fixed - Allocate a global GPU memory object from a fixed
+ * region defined in the device tree
+ * @device: A GPU device handle
+ * @size: Size of the allocation in bytes
+ * @flags: Control flags for the allocation
+ * @priv: Internal flags for the allocation
+ *
+ * Allocate a global GPU object for use by all processes. The buffer is
+ * added to the list of global buffers that get mapped into each newly created
+ * pagetable.
+ *
+ * Return: The memory descriptor on success or a ERR_PTR encoded error on
+ * failure.
+ */
+struct kgsl_memdesc *kgsl_allocate_global_fixed(struct kgsl_device *device,
+		const char *resource, const char *name);
+/**
+ * kgsl_memdesc_init_fixed - Intializes a memory object from a fixed
+ * region defined in the device tree
+ * @device: A GPU device handle
+ * @pdev: Pointer to the platform device
+ * @resource: Name of the resource to get the size and address to allocate
+ * @memdesc: Memory descriptor for the object
+ *
+ * Intializes a memory object for a fixed I/O region defined in device tree.
+ *
+ * Return: 0 on success or negative on failure.
+ */
+int kgsl_memdesc_init_fixed(struct kgsl_device *device,
+	struct platform_device *pdev, const char *resource,
+	struct kgsl_memdesc *memdesc);
+
+/**
+ * kgsl_free_globals - Free all global objects
+ * @device: A GPU device handle
+ *
+ * Free all the global buffer objects. Should only be called during shutdown
+ * after the pagetables have been freed
+ */
+void kgsl_free_globals(struct kgsl_device *device);
+
+/**
+ * kgsl_page_sync_for_device - Initialize SG table with page & sync to/from device
+ * @dev: A GPU device handle
+ * @page: Pointer to the struct page
+ * @size: Size of the page
+ * @dir: DMA direction flag
+ */
+void kgsl_page_sync(struct device *dev, struct page *page,
+		size_t size, enum dma_data_direction dir);
+
+/*
+ * kgsl_memdesc_get_align - Get alignment flags from a memdesc
+ * @memdesc - the memdesc
+ *
+ * Returns the alignment requested, as power of 2 exponent.
+ */
+static inline int
+kgsl_memdesc_get_align(const struct kgsl_memdesc *memdesc)
+{
+	return FIELD_GET(KGSL_MEMALIGN_MASK, memdesc->flags);
+}
+
+/*
+ * kgsl_memdesc_get_cachemode - Get cache mode of a memdesc
+ * @memdesc: the memdesc
+ *
+ * Returns a KGSL_CACHEMODE* value.
+ */
+static inline int
+kgsl_memdesc_get_cachemode(const struct kgsl_memdesc *memdesc)
+{
+	return FIELD_GET(KGSL_CACHEMODE_MASK, memdesc->flags);
+}
+
+static inline unsigned int
+kgsl_memdesc_get_memtype(const struct kgsl_memdesc *memdesc)
+{
+	return FIELD_GET(KGSL_MEMTYPE_MASK, memdesc->flags);
+}
+/*
+ * kgsl_memdesc_set_align - Set alignment flags of a memdesc
+ * @memdesc - the memdesc
+ * @align - alignment requested, as a power of 2 exponent.
+ */
+static inline int
+kgsl_memdesc_set_align(struct kgsl_memdesc *memdesc, unsigned int align)
+{
+	if (align > 32)
+		align = 32;
+
+	memdesc->flags &= ~(uint64_t)KGSL_MEMALIGN_MASK;
+	memdesc->flags |= FIELD_PREP(KGSL_MEMALIGN_MASK, align);
+	return 0;
+}
+
+/**
+ * kgsl_memdesc_usermem_type - return buffer type
+ * @memdesc - the memdesc
+ *
+ * Returns a KGSL_MEM_ENTRY_* value for this buffer, which
+ * identifies if was allocated by us, or imported from
+ * another allocator.
+ */
+static inline unsigned int
+kgsl_memdesc_usermem_type(const struct kgsl_memdesc *memdesc)
+{
+	return FIELD_GET(KGSL_MEMFLAGS_USERMEM_MASK, memdesc->flags);
+}
+
+/**
+ * kgsl_memdesc_sg_dma - Turn a dma_addr (from CMA) into a sg table
+ * @memdesc: Pointer to a memory descriptor
+ * @addr: Physical address from the dma_alloc function
+ * @size: Size of the chunk
+ *
+ * Create a sg table for the contiguous chunk specified by addr and size.
+ *
+ * Return: 0 on success or negative on failure.
+ */
+int kgsl_memdesc_sg_dma(struct kgsl_memdesc *memdesc,
+		phys_addr_t addr, u64 size);
+
+/*
+ * kgsl_memdesc_is_global - is this a globally mapped buffer?
+ * @memdesc: the memdesc
+ *
+ * Return: True if this is a global mapping
+ */
+static inline bool kgsl_memdesc_is_global(const struct kgsl_memdesc *memdesc)
+{
+	return memdesc && (memdesc->priv & KGSL_MEMDESC_GLOBAL);
+}
+
+/*
+ * kgsl_memdesc_is_secured - is this a secure buffer?
+ * @memdesc: the memdesc
+ *
+ * Returns true if this is a secure mapping, false otherwise
+ */
+static inline bool kgsl_memdesc_is_secured(const struct kgsl_memdesc *memdesc)
+{
+	return memdesc && (memdesc->priv & KGSL_MEMDESC_SECURE);
+}
+
+/*
+ * kgsl_memdesc_is_reclaimed - check if a buffer is reclaimed
+ * @memdesc: the memdesc
+ *
+ * Return: true if the memdesc pages were reclaimed, false otherwise
+ */
+static inline bool kgsl_memdesc_is_reclaimed(const struct kgsl_memdesc *memdesc)
+{
+	return memdesc && (memdesc->priv & KGSL_MEMDESC_RECLAIMED);
+}
+
+/*
+ * kgsl_memdesc_use_cpu_map - use the same virtual mapping on CPU and GPU?
+ * @memdesc: the memdesc
+ *
+ * Return: true if the memdesc is using SVM mapping
+ */
+static inline bool
+kgsl_memdesc_use_cpu_map(const struct kgsl_memdesc *memdesc)
+{
+	return memdesc && (memdesc->flags & KGSL_MEMFLAGS_USE_CPU_MAP);
+}
+
+/*
+ * kgsl_memdesc_footprint - get the size of the mmap region
+ * @memdesc - the memdesc
+ *
+ * The entire memdesc must be mapped. Additionally if the
+ * CPU mapping is going to be mirrored, there must be room
+ * for the guard page to be mapped so that the address spaces
+ * match up.
+ */
+static inline uint64_t
+kgsl_memdesc_footprint(const struct kgsl_memdesc *memdesc)
+{
+	if (!(memdesc->priv & KGSL_MEMDESC_GUARD_PAGE))
+		return memdesc->size;
+
+	return PAGE_ALIGN(memdesc->size + PAGE_SIZE);
+}
+
+/**
+ * kgsl_memdesc_put_gpuaddr - Release the gpuaddr assigned to a memdesc
+ * @memdesc: Pointer to a GPU memory object
+ *
+ * Call the memdesc specific function to release the GPU address assigned to the
+ * memdesc and unmap the memory
+ */
+static inline void kgsl_sharedmem_put_gpuaddr(struct kgsl_memdesc *memdesc)
+{
+	if (memdesc && memdesc->ops->put_gpuaddr)
+		memdesc->ops->put_gpuaddr(memdesc);
+}
+
+/**
+ * kgsl_cachemode_is_cached - Return true if the passed flags indicate a cached
+ * buffer
+ * @flags: A bitmask of KGSL_MEMDESC_ flags
+ *
+ * Return: true if the flags indicate a cached buffer
+ */
+static inline bool kgsl_cachemode_is_cached(u64 flags)
+{
+	u64 mode = FIELD_GET(KGSL_CACHEMODE_MASK, flags);
+
+	return (mode != KGSL_CACHEMODE_UNCACHED &&
+		mode != KGSL_CACHEMODE_WRITECOMBINE);
+}
+
+/**
+ * kgsl_unmap_and_put_gpuaddr - Unmap the memory and release the gpuaddr
+ * assigned to a memdesc
+ * @memdesc: Pointer to a GPU memory object
+ *
+ * Remove the mapping from pagetable and release the GPU address assigned
+ * to the memdesc
+ */
+void kgsl_unmap_and_put_gpuaddr(struct kgsl_memdesc *memdesc);
+
+/**
+ * struct kgsl_process_attribute - basic attribute for a process
+ * @attr: Underlying struct attribute
+ * @show: Attribute show function
+ * @store: Attribute store function
+ */
+struct kgsl_process_attribute {
+	struct attribute attr;
+	ssize_t (*show)(struct kobject *kobj,
+			struct kgsl_process_attribute *attr, char *buf);
+	ssize_t (*store)(struct kobject *kobj,
+		struct kgsl_process_attribute *attr, const char *buf,
+		ssize_t count);
+};
+
+#define PROCESS_ATTR(_name, _mode, _show, _store) \
+	static struct kgsl_process_attribute attr_##_name = \
+			__ATTR(_name, _mode, _show, _store)
+
+struct kgsl_sharedmem_bind_op_range {
+	u64 start;
+	u64 last;
+	u32 child_offset;
+	u32 op;
+	struct kgsl_mem_entry *entry;
+};
+
+struct kgsl_sharedmem_bind_op {
+	struct kgsl_mem_entry *target;
+	struct kgsl_sharedmem_bind_op_range *ops;
+	int nr_ops;
+	void (*callback)(struct kgsl_sharedmem_bind_op *op);
+	void *data;
+	struct work_struct work;
+	struct completion comp;
+	struct kref ref;
+};
+
+/**
+ * kgsl_sharedmem_allocate_vbo - Allocate a new virtual buffer object
+ * @device: A KGSL GPU handle
+ * @memdesc: Memory descriptor container to initialize
+ * @size:  Size of the VBO
+ * @flags: Bitmask of KGSL_MEMFLAGS_*
+ *
+ * Initialize a new virtual buffer object memory descriptor
+ *
+ * Return: 0 on success or negative on failure.
+ */
+int kgsl_sharedmem_allocate_vbo(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u64 size, u64 flags);
+
+/**
+ * kgsl_memdesc_print_vbo_ranges - Print a new virtual buffer object
+ * @entry: A KGSL memory entry
+ * @s:	seq_file pointer
+ *
+ * Print virtual buffer object memory ranges
+ */
+void kgsl_memdesc_print_vbo_ranges(struct kgsl_mem_entry *entry,
+		struct seq_file *s);
+
+/**
+ * kgsl_sharedmem_create_bind_op - Create a new bind op
+ * @private: A KGSL process private
+ * @target_id:	Target virtual buffer object id
+ * @ranges: User memory pointer to an array of range operations of type &struct
+ * kgsl_gpumem_bind_range
+ * @ranges_nents: Number of entries in @ranges
+ * @ranges_size: Size of each entry in @ranges in bytes
+ *
+ * Create a new bind op to be used to map ranges
+ *
+ * Return: On success return kgsl_sharedmem_bind_op pointer or negative
+ * on failure
+ *
+ */
+struct kgsl_sharedmem_bind_op *
+kgsl_sharedmem_create_bind_op(struct kgsl_process_private *private,
+		u32 target_id, void __user *ranges, u32 ranges_nents,
+		u64 ranges_size);
+
+/**
+ * kgsl_sharedmem_bind_ranges - Bind ranges to virtual buffer object
+ * @op: One of KGSL_GPUMEM_RANGE_OP_BIND or KGSL_GPUMEM_RANGE_OP_UNBIND
+ *
+ * Add or remove a range from kgsl memory descriptor
+ */
+void kgsl_sharedmem_bind_ranges(struct kgsl_sharedmem_bind_op *op);
+
+/**
+ * kgsl_sharedmem_bind_range_destroy - Bind ranges to virtual buffer object
+ * @kref: kref to bind kgsl_sharedmem_bind_op
+ *
+ * Destroy bind ranges object
+ */
+void kgsl_sharedmem_bind_range_destroy(struct kref *kref);
+
+/**
+ * kgsl_sharedmem_put_bind_op - Bind ranges to virtual buffer object
+ * @op: One of KGSL_GPUMEM_RANGE_OP_BIND or KGSL_GPUMEM_RANGE_OP_UNBIND
+ *
+ * Put kgsl_sharedmem_bind_range_destroy to free resources
+ */
+static inline void kgsl_sharedmem_put_bind_op(struct kgsl_sharedmem_bind_op *op)
+{
+	if (!IS_ERR_OR_NULL(op))
+		kref_put(&op->ref, kgsl_sharedmem_bind_range_destroy);
+}
+
+/**
+ * kgsl_register_shmem_callback - Register vendor hook callback with SHMEM
+ * driver
+ */
+void kgsl_register_shmem_callback(void);
+#endif /* __KGSL_SHAREDMEM_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_snapshot.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_snapshot.c
@@ -0,0 +1,1249 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of.h>
+#include <linux/panic_notifier.h>
+#include <linux/slab.h>
+#include <linux/utsname.h>
+
+#include "adreno_cp_parser.h"
+#include "kgsl_device.h"
+#include "kgsl_eventlog.h"
+#include "kgsl_sharedmem.h"
+#include "kgsl_snapshot.h"
+#include "kgsl_util.h"
+
+static void kgsl_snapshot_save_frozen_objs(struct work_struct *work);
+
+/* Placeholder for list of ib objects that contain all objects in that IB */
+
+struct kgsl_snapshot_cp_obj {
+	struct adreno_ib_object_list *ib_obj_list;
+	struct list_head node;
+};
+
+struct snapshot_obj_itr {
+	u8 *buf;      /* Buffer pointer to write to */
+	int pos;        /* Current position in the sequence */
+	loff_t offset;  /* file offset to start writing from */
+	size_t remain;  /* Bytes remaining in buffer */
+	size_t write;   /* Bytes written so far */
+};
+
+static inline u64 snapshot_phy_addr(struct kgsl_device *device)
+{
+	return device->snapshot_memory.dma_handle ?
+		device->snapshot_memory.dma_handle : __pa(device->snapshot_memory.ptr);
+}
+
+static inline u64 atomic_snapshot_phy_addr(struct kgsl_device *device)
+{
+	return device->snapshot_memory_atomic.ptr == device->snapshot_memory.ptr ?
+		snapshot_phy_addr(device) : __pa(device->snapshot_memory_atomic.ptr);
+}
+
+static void obj_itr_init(struct snapshot_obj_itr *itr, u8 *buf,
+	loff_t offset, size_t remain)
+{
+	itr->buf = buf;
+	itr->offset = offset;
+	itr->remain = remain;
+	itr->pos = 0;
+	itr->write = 0;
+}
+
+static int obj_itr_out(struct snapshot_obj_itr *itr, void *src, int size)
+{
+	if (itr->remain == 0)
+		return 0;
+
+	if ((itr->pos + size) <= itr->offset)
+		goto done;
+
+	/* Handle the case that offset is in the middle of the buffer */
+
+	if (itr->offset > itr->pos) {
+		src += (itr->offset - itr->pos);
+		size -= (itr->offset - itr->pos);
+
+		/* Advance pos to the offset start */
+		itr->pos = itr->offset;
+	}
+
+	if (size > itr->remain)
+		size = itr->remain;
+
+	memcpy(itr->buf, src, size);
+
+	itr->buf += size;
+	itr->write += size;
+	itr->remain -= size;
+
+done:
+	itr->pos += size;
+	return size;
+}
+
+static void kgsl_snapshot_put_object(struct kgsl_snapshot_object *obj)
+{
+	list_del(&obj->node);
+
+	obj->entry->memdesc.priv &= ~KGSL_MEMDESC_FROZEN;
+	obj->entry->memdesc.priv &= ~KGSL_MEMDESC_SKIP_RECLAIM;
+	kgsl_mem_entry_put(obj->entry);
+
+	kfree(obj);
+}
+
+/**
+ * kgsl_snapshot_have_object() - return 1 if the object has been processed
+ * @snapshot: the snapshot data
+ * @process: The process that owns the the object to freeze
+ * @gpuaddr: The gpu address of the object to freeze
+ * @size: the size of the object (may not always be the size of the region)
+ *
+ * Return 1 if the object is already in the list - this can save us from
+ * having to parse the same thing over again. There are 2 lists that are
+ * tracking objects so check for the object in both lists
+ */
+int kgsl_snapshot_have_object(struct kgsl_snapshot *snapshot,
+	struct kgsl_process_private *process,
+	uint64_t gpuaddr, uint64_t size)
+{
+	struct kgsl_snapshot_object *obj;
+	struct kgsl_snapshot_cp_obj *obj_cp;
+	struct adreno_ib_object *ib_obj;
+	int i;
+
+	/* Check whether the object is tracked already in ib list */
+	list_for_each_entry(obj_cp, &snapshot->cp_list, node) {
+		if (obj_cp->ib_obj_list == NULL
+			|| obj_cp->ib_obj_list->num_objs == 0)
+			continue;
+
+		ib_obj = &(obj_cp->ib_obj_list->obj_list[0]);
+		if (ib_obj->entry == NULL || ib_obj->entry->priv != process)
+			continue;
+
+		for (i = 0; i < obj_cp->ib_obj_list->num_objs; i++) {
+			ib_obj = &(obj_cp->ib_obj_list->obj_list[i]);
+			if ((gpuaddr >= ib_obj->gpuaddr) &&
+				((gpuaddr + size) <=
+				(ib_obj->gpuaddr + ib_obj->size)))
+				return 1;
+		}
+	}
+
+	list_for_each_entry(obj, &snapshot->obj_list, node) {
+		if (obj->entry == NULL || obj->entry->priv != process)
+			continue;
+
+		if ((gpuaddr >= obj->gpuaddr) &&
+			((gpuaddr + size) <= (obj->gpuaddr + obj->size)))
+			return 1;
+	}
+
+	return 0;
+}
+
+/**
+ * kgsl_snapshot_get_object() - Mark a GPU buffer to be frozen
+ * @snapshot: The snapshot data
+ * @process: The process that owns the object we want to freeze
+ * @gpuaddr: The gpu address of the object to freeze
+ * @size: the size of the object (may not always be the size of the region)
+ * @type: the type of object being saved (shader, vbo, etc)
+ *
+ * Mark and freeze a GPU buffer object.  This will prevent it from being
+ * freed until it can be copied out as part of the snapshot dump.  Returns the
+ * size of the object being frozen
+ */
+int kgsl_snapshot_get_object(struct kgsl_snapshot *snapshot,
+	struct kgsl_process_private *process, uint64_t gpuaddr,
+	uint64_t size, unsigned int type)
+{
+	struct kgsl_mem_entry *entry;
+	struct kgsl_snapshot_object *obj;
+	uint64_t offset;
+	int ret = -EINVAL;
+	unsigned int mem_type;
+
+	if (!gpuaddr)
+		return 0;
+
+	entry = kgsl_sharedmem_find(process, gpuaddr);
+
+	if (entry == NULL)
+		return -EINVAL;
+
+	/* We can't freeze external memory, because we don't own it */
+	if (entry->memdesc.flags & KGSL_MEMFLAGS_USERMEM_MASK)
+		goto err_put;
+	/*
+	 * Do not save texture and render targets in snapshot,
+	 * they can be just too big
+	 */
+
+	mem_type = kgsl_memdesc_get_memtype(&entry->memdesc);
+	if (mem_type == KGSL_MEMTYPE_TEXTURE ||
+		mem_type == KGSL_MEMTYPE_EGL_SURFACE ||
+		mem_type == KGSL_MEMTYPE_EGL_IMAGE) {
+		ret = 0;
+		goto err_put;
+	}
+
+	/*
+	 * size indicates the number of bytes in the region to save. This might
+	 * not always be the entire size of the region because some buffers are
+	 * sub-allocated from a larger region.  However, if size 0 was passed
+	 * thats a flag that the caller wants to capture the entire buffer
+	 */
+
+	if (size == 0) {
+		size = entry->memdesc.size;
+		offset = 0;
+
+		/* Adjust the gpuaddr to the start of the object */
+		gpuaddr = entry->memdesc.gpuaddr;
+	} else {
+		offset = gpuaddr - entry->memdesc.gpuaddr;
+	}
+
+	if (size + offset > entry->memdesc.size) {
+		dev_err(snapshot->device->dev,
+			"snapshot: invalid size for GPU buffer 0x%016llx\n",
+			gpuaddr);
+		goto err_put;
+	}
+
+	/* If the buffer is already on the list, skip it */
+	list_for_each_entry(obj, &snapshot->obj_list, node) {
+		/* combine the range with existing object if they overlap */
+		if (obj->entry->priv == process && obj->type == type &&
+			kgsl_addr_range_overlap(obj->gpuaddr, obj->size,
+				gpuaddr, size)) {
+			uint64_t end1 = obj->gpuaddr + obj->size;
+			uint64_t end2 = gpuaddr + size;
+
+			if (obj->gpuaddr > gpuaddr)
+				obj->gpuaddr = gpuaddr;
+			if (end1 > end2)
+				obj->size = end1 - obj->gpuaddr;
+			else
+				obj->size = end2 - obj->gpuaddr;
+			obj->offset = obj->gpuaddr - entry->memdesc.gpuaddr;
+			ret = 0;
+			goto err_put;
+		}
+	}
+
+	obj = kzalloc(sizeof(*obj), GFP_KERNEL);
+
+	if (obj == NULL)
+		goto err_put;
+
+	obj->type = type;
+	obj->entry = entry;
+	obj->gpuaddr = gpuaddr;
+	obj->size = size;
+	obj->offset = offset;
+
+	list_add(&obj->node, &snapshot->obj_list);
+
+	/*
+	 * Return the size of the entire mem entry that was frozen - this gets
+	 * used for tracking how much memory is frozen for a hang.  Also, mark
+	 * the memory entry as frozen. If the entry was already marked as
+	 * frozen, then another buffer already got to it.  In that case, return
+	 * 0 so it doesn't get counted twice
+	 */
+
+	ret = (entry->memdesc.priv & KGSL_MEMDESC_FROZEN) ? 0
+		: entry->memdesc.size;
+
+	entry->memdesc.priv |= KGSL_MEMDESC_FROZEN;
+
+	return ret;
+err_put:
+	entry->memdesc.priv &= ~KGSL_MEMDESC_SKIP_RECLAIM;
+	kgsl_mem_entry_put(entry);
+	return ret;
+}
+
+/**
+ * kgsl_snapshot_dump_registers - helper function to dump device registers
+ * @device - the device to dump registers from
+ * @snapshot - pointer to the start of the region of memory for the snapshot
+ * @remain - a pointer to the number of bytes remaining in the snapshot
+ * @priv - A pointer to the kgsl_snapshot_registers data
+ *
+ * Given an array of register ranges pairs (start,end [inclusive]), dump the
+ * registers into a snapshot register section.  The snapshot region stores a
+ * part of dwords for each register - the word address of the register, and
+ * the value.
+ */
+size_t kgsl_snapshot_dump_registers(struct kgsl_device *device, u8 *buf,
+	size_t remain, void *priv)
+{
+	struct kgsl_snapshot_regs *header = (struct kgsl_snapshot_regs *)buf;
+	struct kgsl_snapshot_registers *regs = priv;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+	int count = 0, j, k;
+
+	/* Figure out how many registers we are going to dump */
+
+	for (j = 0; j < regs->count; j++) {
+		int start = regs->regs[j * 2];
+		int end = regs->regs[j * 2 + 1];
+
+		count += (end - start + 1);
+	}
+
+	if (remain < (count * 8) + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "REGISTERS");
+		return 0;
+	}
+
+	for (j = 0; j < regs->count; j++) {
+		unsigned int start = regs->regs[j * 2];
+		unsigned int end = regs->regs[j * 2 + 1];
+
+		for (k = start; k <= end; k++) {
+			unsigned int val;
+
+			kgsl_regread(device, k, &val);
+			*data++ = k;
+			*data++ = val;
+		}
+	}
+
+	header->count = count;
+
+	/* Return the size of the section */
+	return (count * 8) + sizeof(*header);
+}
+
+struct kgsl_snapshot_indexed_registers {
+	unsigned int index;
+	unsigned int data;
+	unsigned int start;
+	unsigned int count;
+};
+
+static size_t kgsl_snapshot_dump_indexed_regs(struct kgsl_device *device,
+	u8 *buf, size_t remain, void *priv)
+{
+	struct kgsl_snapshot_indexed_registers *iregs = priv;
+	struct kgsl_snapshot_indexed_regs *header =
+		(struct kgsl_snapshot_indexed_regs *)buf;
+	unsigned int *data = (unsigned int *)(buf + sizeof(*header));
+
+	if (remain < (iregs->count * 4) + sizeof(*header)) {
+		SNAPSHOT_ERR_NOMEM(device, "INDEXED REGS");
+		return 0;
+	}
+
+	header->index_reg = iregs->index;
+	header->data_reg = iregs->data;
+	header->count = iregs->count;
+	header->start = iregs->start;
+
+	kgsl_regmap_read_indexed_interleaved(&device->regmap, iregs->index,
+		iregs->data, data, iregs->start, iregs->count);
+
+	return (iregs->count * 4) + sizeof(*header);
+}
+
+/**
+ * kgsl_snapshot_indexed_registers - Add a set of indexed registers to the
+ * snapshot
+ * @device: Pointer to the KGSL device being snapshotted
+ * @snapshot: Snapshot instance
+ * @index: Offset for the index register
+ * @data: Offset for the data register
+ * @start: Index to start reading
+ * @count: Number of entries to read
+ *
+ * Dump the values from an indexed register group into the snapshot
+ */
+void kgsl_snapshot_indexed_registers(struct kgsl_device *device,
+		struct kgsl_snapshot *snapshot,
+		unsigned int index, unsigned int data,
+		unsigned int start,
+		unsigned int count)
+{
+	struct kgsl_snapshot_indexed_registers iregs;
+
+	iregs.index = index;
+	iregs.data = data;
+	iregs.start = start;
+	iregs.count = count;
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_INDEXED_REGS,
+		snapshot, kgsl_snapshot_dump_indexed_regs, &iregs);
+}
+
+/**
+ * kgsl_snapshot_add_section() - Add a new section to the GPU snapshot
+ * @device: the KGSL device being snapshotted
+ * @id: the section id
+ * @snapshot: pointer to the snapshot instance
+ * @func:  Function pointer to fill the section
+ * @priv: Private pointer to pass to the function
+ *
+ * Set up a KGSL snapshot header by filling the memory with the callback
+ * function and adding the standard section header
+ */
+void kgsl_snapshot_add_section(struct kgsl_device *device, u16 id,
+	struct kgsl_snapshot *snapshot,
+	size_t (*func)(struct kgsl_device *, u8 *, size_t, void *),
+	void *priv)
+{
+	struct kgsl_snapshot_section_header *header =
+		(struct kgsl_snapshot_section_header *)snapshot->ptr;
+	u8 *data = snapshot->ptr + sizeof(*header);
+	size_t ret = 0;
+
+	/*
+	 * Sanity check to make sure there is enough for the header.  The
+	 * callback will check to make sure there is enough for the rest
+	 * of the data.  If there isn't enough room then don't advance the
+	 * pointer.
+	 */
+
+	if (snapshot->remain < sizeof(*header))
+		return;
+
+	/* It is legal to have no function (i.e. - make an empty section) */
+	if (func) {
+		ret = func(device, data, snapshot->remain - sizeof(*header),
+			priv);
+
+		/*
+		 * If there wasn't enough room for the data then don't bother
+		 * setting up the header.
+		 */
+
+		if (ret == 0)
+			return;
+	}
+
+	header->magic = SNAPSHOT_SECTION_MAGIC;
+	header->id = id;
+	header->size = ret + sizeof(*header);
+
+	snapshot->ptr += header->size;
+	snapshot->remain -= header->size;
+	snapshot->size += header->size;
+}
+
+static void kgsl_free_snapshot(struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_snapshot_object *obj, *tmp;
+	struct kgsl_device *device = snapshot->device;
+
+	wait_for_completion(&snapshot->dump_gate);
+
+	list_for_each_entry_safe(obj, tmp,
+				&snapshot->obj_list, node)
+		kgsl_snapshot_put_object(obj);
+
+	if (snapshot->mempool)
+		vfree(snapshot->mempool);
+
+	kfree(snapshot);
+	dev_err(device->dev, "snapshot: objects released\n");
+}
+
+#define SP0_ISDB_ISDB_BRKPT_CFG 0x40014
+#define SP0_ISDB_ISDB_EN 0x40004
+#define SP0_ISDB_ISDB_CMD 0x4000C
+
+void isdb_write(void __iomem *base, u32 offset)
+{
+	/* To set the SCHBREAKTYPE bit */
+	__raw_writel(0x801, base + SP0_ISDB_ISDB_BRKPT_CFG + offset);
+
+	/*
+	 * ensure the configurations are set before
+	 * enabling ISDB
+	 */
+	wmb();
+	/* To set the ISDBCLKON and ISDB_EN bits*/
+	__raw_writel(0x03, base + SP0_ISDB_ISDB_EN + offset);
+
+	/*
+	 * ensure previous write to enable isdb posts
+	 * before issuing the break command
+	 */
+	wmb();
+	/*To issue ISDB_0_ISDB_CMD_BREAK*/
+	__raw_writel(0x1, base + SP0_ISDB_ISDB_CMD + offset);
+}
+
+static void kgsl_device_snapshot_atomic(struct kgsl_device *device)
+{
+	struct kgsl_snapshot *snapshot;
+	struct timespec64 boot;
+
+	if (device->snapshot && device->force_panic)
+		return;
+
+	if (!atomic_read(&device->active_cnt)) {
+		dev_err(device->dev, "snapshot: device is powered off\n");
+		return;
+	}
+
+	device->snapshot_memory_atomic.size = device->snapshot_memory.size;
+	if (!device->snapshot_faultcount) {
+		/* Use non-atomic snapshot memory if it is unused */
+		device->snapshot_memory_atomic.ptr = device->snapshot_memory.ptr;
+	} else {
+		/* Limit size to 3MB to avoid failure for atomic snapshot memory */
+		if (device->snapshot_memory_atomic.size > (SZ_2M + SZ_1M))
+			device->snapshot_memory_atomic.size = (SZ_2M + SZ_1M);
+
+		device->snapshot_memory_atomic.ptr = devm_kzalloc(&device->pdev->dev,
+					device->snapshot_memory_atomic.size, GFP_ATOMIC);
+
+		/* If we fail to allocate more than 1MB fall back to 1MB */
+		if (WARN_ON((!device->snapshot_memory_atomic.ptr) &&
+			device->snapshot_memory_atomic.size > SZ_1M)) {
+			device->snapshot_memory_atomic.size = SZ_1M;
+			device->snapshot_memory_atomic.ptr = devm_kzalloc(&device->pdev->dev,
+					device->snapshot_memory_atomic.size, GFP_ATOMIC);
+		}
+
+		if (!device->snapshot_memory_atomic.ptr) {
+			dev_err(device->dev,
+				"Failed to allocate memory for atomic snapshot\n");
+			return;
+		}
+	}
+
+	/* Allocate memory for the snapshot instance */
+	snapshot = kzalloc(sizeof(*snapshot), GFP_ATOMIC);
+	if (snapshot == NULL)
+		return;
+
+	device->snapshot_atomic = true;
+	INIT_LIST_HEAD(&snapshot->obj_list);
+	INIT_LIST_HEAD(&snapshot->cp_list);
+
+	snapshot->start = device->snapshot_memory_atomic.ptr;
+	snapshot->ptr = device->snapshot_memory_atomic.ptr;
+	snapshot->remain = device->snapshot_memory_atomic.size;
+
+	/*
+	 * Trigger both GPU and GMU snapshot. GPU specific code
+	 * will take care of whether to dumps full state or only
+	 * GMU state based on current GPU power state.
+	 */
+	if (device->ftbl->snapshot)
+		device->ftbl->snapshot(device, snapshot, NULL, NULL);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_EVENTLOG,
+		snapshot, kgsl_snapshot_eventlog_buffer, NULL);
+
+	/*
+	 * The timestamp is the seconds since boot so it is easier to match to
+	 * the kernel log
+	 */
+	getboottime64(&boot);
+	snapshot->timestamp = ktime_get_real_seconds() - boot.tv_sec;
+
+	kgsl_add_to_minidump("ATOMIC_GPU_SNAPSHOT", (u64) device->snapshot_memory_atomic.ptr,
+		atomic_snapshot_phy_addr(device), device->snapshot_memory_atomic.size);
+
+	/* log buffer info to aid in ramdump fault tolerance */
+	dev_err(device->dev, "Atomic GPU snapshot created at pa %llx++0x%zx\n",
+			atomic_snapshot_phy_addr(device), snapshot->size);
+}
+
+/**
+ * kgsl_snapshot() - construct a device snapshot
+ * @device: device to snapshot
+ * @context: the context that is hung, might be NULL if unknown.
+ * @gmu_fault: whether this snapshot is triggered by a GMU fault.
+ *
+ * Given a device, construct a binary snapshot dump of the current device state
+ * and store it in the device snapshot memory.
+ */
+void kgsl_device_snapshot(struct kgsl_device *device,
+		struct kgsl_context *context,  struct kgsl_context *context_lpac,
+		bool gmu_fault)
+{
+	struct kgsl_snapshot *snapshot;
+	struct timespec64 boot;
+
+	if (device->ftbl->set_isdb_breakpoint_registers)
+		device->ftbl->set_isdb_breakpoint_registers(device);
+
+	if (device->snapshot_memory.ptr == NULL) {
+		dev_err(device->dev,
+			     "snapshot: no snapshot memory available\n");
+		return;
+	}
+
+	if (WARN(!kgsl_state_is_awake(device),
+		"snapshot: device is powered off\n"))
+		return;
+
+	/* increment the hang count for good book keeping */
+	device->snapshot_faultcount++;
+	device->gmu_fault = gmu_fault;
+
+	if (device->snapshot != NULL) {
+
+		/*
+		 * Snapshot over-write policy:
+		 * 1. By default, don't over-write the very first snapshot,
+		 *    be it a gmu or gpu fault.
+		 * 2. Never over-write existing snapshot on a gpu fault.
+		 * 3. Never over-write a snapshot that we didn't recover from.
+		 * 4. In order to over-write a new gmu fault snapshot with a
+		 *    previously recovered fault, then set the sysfs knob
+		 *    prioritize_recoverable to true.
+		 */
+		if (!device->prioritize_unrecoverable ||
+			!device->snapshot->recovered || !gmu_fault)
+			return;
+
+		/*
+		 * If another thread is currently reading it, that thread
+		 * will free it, otherwise free it now.
+		 */
+		if (!device->snapshot->sysfs_read)
+			kgsl_free_snapshot(device->snapshot);
+		device->snapshot = NULL;
+	}
+
+	/* Allocate memory for the snapshot instance */
+	snapshot = kzalloc(sizeof(*snapshot), GFP_KERNEL);
+	if (snapshot == NULL)
+		return;
+
+	init_completion(&snapshot->dump_gate);
+	INIT_LIST_HEAD(&snapshot->obj_list);
+	INIT_LIST_HEAD(&snapshot->cp_list);
+	INIT_WORK(&snapshot->work, kgsl_snapshot_save_frozen_objs);
+
+	snapshot->start = device->snapshot_memory.ptr;
+	snapshot->ptr = device->snapshot_memory.ptr;
+	snapshot->remain = device->snapshot_memory.size;
+	snapshot->recovered = false;
+	snapshot->first_read = true;
+	snapshot->sysfs_read = 0;
+
+	device->ftbl->snapshot(device, snapshot, context, context_lpac);
+
+	kgsl_snapshot_add_section(device, KGSL_SNAPSHOT_SECTION_EVENTLOG,
+		snapshot, kgsl_snapshot_eventlog_buffer, NULL);
+
+	/*
+	 * The timestamp is the seconds since boot so it is easier to match to
+	 * the kernel log
+	 */
+
+	getboottime64(&boot);
+	snapshot->timestamp = ktime_get_real_seconds() - boot.tv_sec;
+
+	/* Store the instance in the device until it gets dumped */
+	device->snapshot = snapshot;
+	snapshot->device = device;
+
+	/* log buffer info to aid in ramdump fault tolerance */
+	dev_err(device->dev, "%s snapshot created at pa %llx++0x%zx\n",
+			gmu_fault ? "GMU" : "GPU", snapshot_phy_addr(device),
+			snapshot->size);
+
+	kgsl_add_to_minidump("GPU_SNAPSHOT", (u64) device->snapshot_memory.ptr,
+			snapshot_phy_addr(device), device->snapshot_memory.size);
+
+	if (device->skip_ib_capture)
+		BUG_ON(device->force_panic);
+
+	sysfs_notify(&device->snapshot_kobj, NULL, "timestamp");
+
+	/*
+	 * Queue a work item that will save the IB data in snapshot into
+	 * static memory to prevent loss of data due to overwriting of
+	 * memory. If force panic is enabled, there is no need to move
+	 * ahead and IB data can be dumped inline.
+	 */
+	if (device->force_panic)
+		kgsl_snapshot_save_frozen_objs(&snapshot->work);
+	else
+		kgsl_schedule_work(&snapshot->work);
+}
+
+/* An attribute for showing snapshot details */
+struct kgsl_snapshot_attribute {
+	struct attribute attr;
+	ssize_t (*show)(struct kgsl_device *device, char *buf);
+	ssize_t (*store)(struct kgsl_device *device, const char *buf,
+		size_t count);
+};
+
+/**
+ * kgsl_snapshot_process_ib_obj_list() - Go through the list of IB's which need
+ * to be dumped for snapshot and move them to the global snapshot list so
+ * they will get dumped when the global list is dumped
+ * @device: device being snapshotted
+ */
+static void kgsl_snapshot_process_ib_obj_list(struct kgsl_snapshot *snapshot)
+{
+	struct kgsl_snapshot_cp_obj *obj, *obj_temp;
+	struct adreno_ib_object *ib_obj;
+	int i;
+
+	list_for_each_entry_safe(obj, obj_temp, &snapshot->cp_list,
+			node) {
+		for (i = 0; i < obj->ib_obj_list->num_objs; i++) {
+			ib_obj = &(obj->ib_obj_list->obj_list[i]);
+			kgsl_snapshot_get_object(snapshot, ib_obj->entry->priv,
+				ib_obj->gpuaddr, ib_obj->size,
+				ib_obj->snapshot_obj_type);
+		}
+		list_del(&obj->node);
+		adreno_ib_destroy_obj_list(obj->ib_obj_list);
+		kfree(obj);
+	}
+}
+
+#define to_snapshot_attr(a) \
+container_of(a, struct kgsl_snapshot_attribute, attr)
+
+#define kobj_to_device(a) \
+container_of(a, struct kgsl_device, snapshot_kobj)
+
+static int snapshot_release(struct kgsl_device *device,
+	struct kgsl_snapshot *snapshot)
+{
+	bool snapshot_free = false;
+	int ret = 0;
+
+	mutex_lock(&device->mutex);
+	snapshot->sysfs_read--;
+
+	/*
+	 * If someone's replaced the snapshot, return an error and free
+	 * the snapshot if this is the last thread to read it.
+	 */
+	if (device->snapshot != snapshot) {
+		ret = -EIO;
+		if (!snapshot->sysfs_read)
+			snapshot_free = true;
+	}
+	mutex_unlock(&device->mutex);
+	if (snapshot_free)
+		kgsl_free_snapshot(snapshot);
+	return ret;
+}
+
+/* Dump the sysfs binary data to the user */
+static ssize_t snapshot_show(struct file *filep, struct kobject *kobj,
+	struct bin_attribute *attr, char *buf, loff_t off,
+	size_t count)
+{
+	struct kgsl_device *device = kobj_to_device(kobj);
+	struct kgsl_snapshot *snapshot;
+	struct kgsl_snapshot_section_header head;
+	struct snapshot_obj_itr itr;
+	int ret = 0;
+
+	mutex_lock(&device->mutex);
+	snapshot = device->snapshot;
+	if (snapshot != NULL) {
+		/*
+		 * If we're reading at a non-zero offset from a new snapshot,
+		 * that means we want to read from the previous snapshot (which
+		 * was overwritten), so return an error
+		 */
+		if (snapshot->first_read) {
+			if (off)
+				ret = -EIO;
+			else
+				snapshot->first_read = false;
+		}
+		if (!ret)
+			snapshot->sysfs_read++;
+	}
+	mutex_unlock(&device->mutex);
+
+	if (ret)
+		return ret;
+
+	/* Return nothing if we haven't taken a snapshot yet */
+	if (snapshot == NULL)
+		return 0;
+
+	/*
+	 * Wait for the dump worker to finish. This is interruptible
+	 * to allow userspace to bail if things go horribly wrong.
+	 */
+	ret = wait_for_completion_interruptible(&snapshot->dump_gate);
+	if (ret) {
+		snapshot_release(device, snapshot);
+		return ret;
+	}
+
+	obj_itr_init(&itr, buf, off, count);
+
+	ret = obj_itr_out(&itr, snapshot->start, snapshot->size);
+	if (ret == 0)
+		goto done;
+
+	/* Dump the memory pool if it exists */
+	if (snapshot->mempool) {
+		ret = obj_itr_out(&itr, snapshot->mempool,
+				snapshot->mempool_size);
+		if (ret == 0)
+			goto done;
+	}
+
+	{
+		head.magic = SNAPSHOT_SECTION_MAGIC;
+		head.id = KGSL_SNAPSHOT_SECTION_END;
+		head.size = sizeof(head);
+
+		obj_itr_out(&itr, &head, sizeof(head));
+	}
+
+	/*
+	 * Make sure everything has been written out before destroying things.
+	 * The best way to confirm this is to go all the way through without
+	 * writing any bytes - so only release if we get this far and
+	 * itr->write is 0 and there are no concurrent reads pending
+	 */
+
+	if (itr.write == 0) {
+		bool snapshot_free = false;
+
+		mutex_lock(&device->mutex);
+		if (--snapshot->sysfs_read == 0) {
+			if (device->snapshot == snapshot)
+				device->snapshot = NULL;
+			snapshot_free = true;
+		}
+		mutex_unlock(&device->mutex);
+
+		if (snapshot_free)
+			kgsl_free_snapshot(snapshot);
+		return 0;
+	}
+
+done:
+	ret = snapshot_release(device, snapshot);
+	return (ret < 0) ? ret : itr.write;
+}
+
+/* Show the total number of hangs since device boot */
+static ssize_t faultcount_show(struct kgsl_device *device, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%d\n", device->snapshot_faultcount);
+}
+
+/* Reset the total number of hangs since device boot */
+static ssize_t faultcount_store(struct kgsl_device *device, const char *buf,
+	size_t count)
+{
+	if (count)
+		device->snapshot_faultcount = 0;
+
+	return count;
+}
+
+/* Show the force_panic request status */
+static ssize_t force_panic_show(struct kgsl_device *device, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%d\n", device->force_panic);
+}
+
+/* Store the panic request value to force_panic */
+static ssize_t force_panic_store(struct kgsl_device *device, const char *buf,
+	size_t count)
+{
+	if (kstrtobool(buf, &device->force_panic))
+		return -EINVAL;
+	return count;
+}
+
+/* Show the break_ib request status */
+static ssize_t skip_ib_capture_show(struct kgsl_device *device, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%d\n", device->skip_ib_capture);
+}
+
+/* Store the panic request value to break_ib */
+static ssize_t skip_ib_capture_store(struct kgsl_device *device,
+						const char *buf, size_t count)
+{
+	int ret;
+
+	ret = kstrtobool(buf, &device->skip_ib_capture);
+	return ret ? ret : count;
+}
+
+/* Show the prioritize_unrecoverable status */
+static ssize_t prioritize_unrecoverable_show(
+		struct kgsl_device *device, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%d\n",
+			device->prioritize_unrecoverable);
+}
+
+/* Store the priority value to prioritize unrecoverable */
+static ssize_t prioritize_unrecoverable_store(
+		struct kgsl_device *device, const char *buf, size_t count)
+{
+	if (kstrtobool(buf, &device->prioritize_unrecoverable))
+		return -EINVAL;
+
+	return count;
+}
+
+/* Show the snapshot_crashdumper request status */
+static ssize_t snapshot_crashdumper_show(struct kgsl_device *device, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%d\n", device->snapshot_crashdumper);
+}
+
+
+/* Store the value to snapshot_crashdumper*/
+static ssize_t snapshot_crashdumper_store(struct kgsl_device *device,
+	const char *buf, size_t count)
+{
+	if (kstrtobool(buf, &device->snapshot_crashdumper))
+		return -EINVAL;
+	return count;
+}
+
+/* Show the timestamp of the last collected snapshot */
+static ssize_t timestamp_show(struct kgsl_device *device, char *buf)
+{
+	unsigned long timestamp;
+
+	mutex_lock(&device->mutex);
+	timestamp = device->snapshot ? device->snapshot->timestamp : 0;
+	mutex_unlock(&device->mutex);
+	return scnprintf(buf, PAGE_SIZE, "%lu\n", timestamp);
+}
+
+static ssize_t snapshot_legacy_show(struct kgsl_device *device, char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%d\n", device->snapshot_legacy);
+}
+
+static ssize_t snapshot_legacy_store(struct kgsl_device *device,
+	const char *buf, size_t count)
+{
+	if (kstrtobool(buf, &device->snapshot_legacy))
+		return -EINVAL;
+
+	return count;
+}
+
+static struct bin_attribute snapshot_attr = {
+	.attr.name = "dump",
+	.attr.mode = 0444,
+	.size = 0,
+	.read = snapshot_show
+};
+
+#define SNAPSHOT_ATTR(_name, _mode, _show, _store) \
+struct kgsl_snapshot_attribute attr_##_name = { \
+	.attr = { .name = __stringify(_name), .mode = _mode }, \
+	.show = _show, \
+	.store = _store, \
+}
+
+static SNAPSHOT_ATTR(timestamp, 0444, timestamp_show, NULL);
+static SNAPSHOT_ATTR(faultcount, 0644, faultcount_show, faultcount_store);
+static SNAPSHOT_ATTR(force_panic, 0644, force_panic_show, force_panic_store);
+static SNAPSHOT_ATTR(prioritize_unrecoverable, 0644,
+		prioritize_unrecoverable_show, prioritize_unrecoverable_store);
+static SNAPSHOT_ATTR(snapshot_crashdumper, 0644, snapshot_crashdumper_show,
+	snapshot_crashdumper_store);
+static SNAPSHOT_ATTR(snapshot_legacy, 0644, snapshot_legacy_show,
+	snapshot_legacy_store);
+static SNAPSHOT_ATTR(skip_ib_capture, 0644, skip_ib_capture_show,
+		skip_ib_capture_store);
+
+static ssize_t snapshot_sysfs_show(struct kobject *kobj,
+	struct attribute *attr, char *buf)
+{
+	struct kgsl_snapshot_attribute *pattr = to_snapshot_attr(attr);
+	struct kgsl_device *device = kobj_to_device(kobj);
+	ssize_t ret;
+
+	if (device && pattr->show)
+		ret = pattr->show(device, buf);
+	else
+		ret = -EIO;
+
+	return ret;
+}
+
+static ssize_t snapshot_sysfs_store(struct kobject *kobj,
+	struct attribute *attr, const char *buf, size_t count)
+{
+	struct kgsl_snapshot_attribute *pattr = to_snapshot_attr(attr);
+	struct kgsl_device *device = kobj_to_device(kobj);
+	ssize_t ret = -EIO;
+
+	if (pattr->store)
+		ret = pattr->store(device, buf, count);
+
+	return ret;
+}
+
+static const struct sysfs_ops snapshot_sysfs_ops = {
+	.show = snapshot_sysfs_show,
+	.store = snapshot_sysfs_store,
+};
+
+static struct kobj_type ktype_snapshot = {
+	.sysfs_ops = &snapshot_sysfs_ops,
+};
+
+static const struct attribute *snapshot_attrs[] = {
+	&attr_timestamp.attr,
+	&attr_faultcount.attr,
+	&attr_force_panic.attr,
+	&attr_prioritize_unrecoverable.attr,
+	&attr_snapshot_crashdumper.attr,
+	&attr_snapshot_legacy.attr,
+	&attr_skip_ib_capture.attr,
+	NULL,
+};
+
+static int kgsl_panic_notifier_callback(struct notifier_block *nb,
+		unsigned long action, void *unused)
+{
+	struct kgsl_device *device = container_of(nb, struct kgsl_device,
+							panic_nb);
+
+	/* To send NMI to GMU */
+	device->gmu_fault = true;
+	kgsl_device_snapshot_atomic(device);
+
+	return NOTIFY_OK;
+}
+
+void kgsl_device_snapshot_probe(struct kgsl_device *device, u32 size)
+{
+	device->snapshot_memory.size = size;
+
+	device->snapshot_memory.ptr = dma_alloc_coherent(&device->pdev->dev,
+		device->snapshot_memory.size, &device->snapshot_memory.dma_handle,
+		GFP_KERNEL);
+	/*
+	 * If we fail to allocate more than 1MB for snapshot fall back
+	 * to 1MB
+	 */
+	if (WARN_ON((!device->snapshot_memory.ptr) && size > SZ_1M)) {
+		device->snapshot_memory.size = SZ_1M;
+		device->snapshot_memory.ptr = devm_kzalloc(&device->pdev->dev,
+			device->snapshot_memory.size, GFP_KERNEL);
+	}
+
+	if (!device->snapshot_memory.ptr) {
+		dev_err(device->dev,
+			"KGSL failed to allocate memory for snapshot\n");
+		return;
+	}
+
+	device->snapshot = NULL;
+	device->snapshot_faultcount = 0;
+	device->force_panic = false;
+	device->snapshot_crashdumper = true;
+	device->snapshot_legacy = false;
+
+	device->snapshot_atomic = false;
+	device->panic_nb.notifier_call = kgsl_panic_notifier_callback;
+	device->panic_nb.priority = 1;
+	device->snapshot_ctxt_record_size = 64 * 1024;
+
+	/*
+	 * Set this to false so that we only ever keep the first snapshot around
+	 * If we want to over-write with a gmu snapshot, then set it to true
+	 * via sysfs
+	 */
+	device->prioritize_unrecoverable = false;
+
+	if (kobject_init_and_add(&device->snapshot_kobj, &ktype_snapshot,
+		&device->dev->kobj, "snapshot"))
+		return;
+
+	WARN_ON(sysfs_create_bin_file(&device->snapshot_kobj, &snapshot_attr));
+	WARN_ON(sysfs_create_files(&device->snapshot_kobj, snapshot_attrs));
+	atomic_notifier_chain_register(&panic_notifier_list,
+			&device->panic_nb);
+}
+
+/**
+ * kgsl_device_snapshot_close() - take down snapshot memory for a device
+ * @device: Pointer to the kgsl_device
+ *
+ * Remove the sysfs files and free the memory allocated for the GPU
+ * snapshot
+ */
+void kgsl_device_snapshot_close(struct kgsl_device *device)
+{
+	if (device->snapshot_memory.ptr == NULL)
+		return;
+
+	kgsl_remove_from_minidump("GPU_SNAPSHOT", (u64) device->snapshot_memory.ptr,
+			snapshot_phy_addr(device), device->snapshot_memory.size);
+
+	atomic_notifier_chain_unregister(&panic_notifier_list,
+					 &device->panic_nb);
+
+	sysfs_remove_bin_file(&device->snapshot_kobj, &snapshot_attr);
+	sysfs_remove_files(&device->snapshot_kobj, snapshot_attrs);
+
+	kobject_put(&device->snapshot_kobj);
+
+	if (device->snapshot_memory.dma_handle)
+		dma_free_coherent(&device->pdev->dev, device->snapshot_memory.size,
+			device->snapshot_memory.ptr, device->snapshot_memory.dma_handle);
+}
+
+/**
+ * kgsl_snapshot_add_ib_obj_list() - Add a IB object list to the snapshot
+ * object list
+ * @device: the device that is being snapshotted
+ * @ib_obj_list: The IB list that has objects required to execute an IB
+ * @num_objs: Number of IB objects
+ * @ptbase: The pagetable base in which the IB is mapped
+ *
+ * Adds a new IB to the list of IB objects maintained when getting snapshot
+ * Returns 0 on success else -ENOMEM on error
+ */
+int kgsl_snapshot_add_ib_obj_list(struct kgsl_snapshot *snapshot,
+	struct adreno_ib_object_list *ib_obj_list)
+{
+	struct kgsl_snapshot_cp_obj *obj;
+
+	obj = kzalloc(sizeof(*obj), GFP_KERNEL);
+	if (!obj)
+		return -ENOMEM;
+	obj->ib_obj_list = ib_obj_list;
+	list_add(&obj->node, &snapshot->cp_list);
+	return 0;
+}
+
+static size_t _mempool_add_object(struct kgsl_snapshot *snapshot, u8 *data,
+		struct kgsl_snapshot_object *obj)
+{
+	struct kgsl_snapshot_section_header *section =
+		(struct kgsl_snapshot_section_header *)data;
+	struct kgsl_snapshot_gpu_object_v2 *header =
+		(struct kgsl_snapshot_gpu_object_v2 *)(data + sizeof(*section));
+	u8 *dest = data + sizeof(*section) + sizeof(*header);
+	uint64_t size;
+
+	size = obj->size;
+
+	if (!kgsl_memdesc_map(&obj->entry->memdesc)) {
+		dev_err(snapshot->device->dev,
+			"snapshot: failed to map GPU object\n");
+		return 0;
+	}
+
+	section->magic = SNAPSHOT_SECTION_MAGIC;
+	section->id = KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2;
+	section->size = size + sizeof(*header) + sizeof(*section);
+
+	header->size = size >> 2;
+	header->gpuaddr = obj->gpuaddr;
+	header->ptbase =
+		kgsl_mmu_pagetable_get_ttbr0(obj->entry->priv->pagetable);
+	header->type = obj->type;
+
+	if (kgsl_addr_range_overlap(obj->gpuaddr, obj->size,
+				snapshot->ib1base, snapshot->ib1size))
+		snapshot->ib1dumped = true;
+
+	if (kgsl_addr_range_overlap(obj->gpuaddr, obj->size,
+				snapshot->ib2base, snapshot->ib2size))
+		snapshot->ib2dumped = true;
+
+	memcpy(dest, obj->entry->memdesc.hostptr + obj->offset, size);
+	kgsl_memdesc_unmap(&obj->entry->memdesc);
+
+	return section->size;
+}
+
+/**
+ * kgsl_snapshot_save_frozen_objs() - Save the objects frozen in snapshot into
+ * memory so that the data reported in these objects is correct when snapshot
+ * is taken
+ * @work: The work item that scheduled this work
+ */
+static void kgsl_snapshot_save_frozen_objs(struct work_struct *work)
+{
+	struct kgsl_snapshot *snapshot = container_of(work,
+				struct kgsl_snapshot, work);
+	struct kgsl_snapshot_object *obj, *tmp;
+	size_t size = 0;
+	void *ptr;
+
+	if (snapshot->device->gmu_fault)
+		goto gmu_only;
+
+	kgsl_snapshot_process_ib_obj_list(snapshot);
+
+	list_for_each_entry(obj, &snapshot->obj_list, node) {
+		obj->size = ALIGN(obj->size, 4);
+
+		size += ((size_t) obj->size +
+			sizeof(struct kgsl_snapshot_gpu_object_v2) +
+			sizeof(struct kgsl_snapshot_section_header));
+	}
+
+	if (size == 0)
+		goto done;
+
+	snapshot->mempool = vmalloc(size);
+
+	ptr = snapshot->mempool;
+	snapshot->mempool_size = 0;
+
+	/* even if vmalloc fails, make sure we clean up the obj_list */
+	list_for_each_entry_safe(obj, tmp, &snapshot->obj_list, node) {
+		if (snapshot->mempool) {
+			size_t ret = _mempool_add_object(snapshot, ptr, obj);
+
+			ptr += ret;
+			snapshot->mempool_size += ret;
+		}
+
+		kgsl_snapshot_put_object(obj);
+	}
+done:
+	/*
+	 * Get rid of the process struct here, so that it doesn't sit
+	 * around until someone bothers to read the snapshot file.
+	 */
+	kgsl_process_private_put(snapshot->process);
+	snapshot->process = NULL;
+
+	if (snapshot->ib1base && !snapshot->ib1dumped)
+		dev_err(snapshot->device->dev,
+				"snapshot: Active IB1:%016llx not dumped\n",
+				snapshot->ib1base);
+	else if (snapshot->ib2base && !snapshot->ib2dumped)
+		dev_err(snapshot->device->dev,
+			       "snapshot: Active IB2:%016llx not dumped\n",
+				snapshot->ib2base);
+
+gmu_only:
+	BUG_ON(!snapshot->device->skip_ib_capture &&
+				snapshot->device->force_panic);
+	complete_all(&snapshot->dump_gate);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_snapshot.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_snapshot.h
@@ -0,0 +1,384 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _KGSL_SNAPSHOT_H_
+#define _KGSL_SNAPSHOT_H_
+
+#include <linux/types.h>
+
+/* Snapshot header */
+
+/* High word is static, low word is snapshot version ID */
+#define SNAPSHOT_MAGIC 0x504D0002
+
+/* GPU ID scheme:
+ * [16:31] - core identifer (0x0002 for 2D or 0x0003 for 3D)
+ * [00:16] - GPU specific identifier
+ */
+
+struct kgsl_snapshot_header {
+	__u32 magic; /* Magic identifier */
+	__u32 gpuid; /* GPU ID - see above */
+	/* Added in snapshot version 2 */
+	__u32 chipid; /* Chip ID from the GPU */
+} __packed;
+
+/* Section header */
+#define SNAPSHOT_SECTION_MAGIC 0xABCD
+
+struct kgsl_snapshot_section_header {
+	__u16 magic; /* Magic identifier */
+	__u16 id;    /* Type of section */
+	__u32 size;  /* Size of the section including this header */
+} __packed;
+
+/* Section identifiers */
+#define KGSL_SNAPSHOT_SECTION_OS           0x0101
+#define KGSL_SNAPSHOT_SECTION_REGS         0x0201
+#define KGSL_SNAPSHOT_SECTION_REGS_V2      0x0202
+#define KGSL_SNAPSHOT_SECTION_RB           0x0301
+#define KGSL_SNAPSHOT_SECTION_RB_V2        0x0302
+#define KGSL_SNAPSHOT_SECTION_IB           0x0401
+#define KGSL_SNAPSHOT_SECTION_IB_V2        0x0402
+#define KGSL_SNAPSHOT_SECTION_INDEXED_REGS 0x0501
+#define KGSL_SNAPSHOT_SECTION_ISTORE       0x0801
+#define KGSL_SNAPSHOT_SECTION_DEBUG        0x0901
+#define KGSL_SNAPSHOT_SECTION_DEBUGBUS     0x0A01
+#define KGSL_SNAPSHOT_SECTION_GPU_OBJECT   0x0B01
+#define KGSL_SNAPSHOT_SECTION_GPU_OBJECT_V2 0x0B02
+#define KGSL_SNAPSHOT_SECTION_MEMLIST      0x0E01
+#define KGSL_SNAPSHOT_SECTION_MEMLIST_V2   0x0E02
+#define KGSL_SNAPSHOT_SECTION_SHADER       0x1201
+#define KGSL_SNAPSHOT_SECTION_SHADER_V2    0x1202
+#define KGSL_SNAPSHOT_SECTION_MVC          0x1501
+#define KGSL_SNAPSHOT_SECTION_MVC_V2       0x1502
+#define KGSL_SNAPSHOT_SECTION_GMU          0x1601
+#define KGSL_SNAPSHOT_SECTION_GMU_MEMORY   0x1701
+#define KGSL_SNAPSHOT_SECTION_SIDE_DEBUGBUS 0x1801
+#define KGSL_SNAPSHOT_SECTION_TRACE_BUFFER 0x1901
+#define KGSL_SNAPSHOT_SECTION_EVENTLOG     0x1A01
+
+#define KGSL_SNAPSHOT_SECTION_END          0xFFFF
+
+/* OS sub-section header */
+#define KGSL_SNAPSHOT_OS_LINUX             0x0001
+#define KGSL_SNAPSHOT_OS_LINUX_V3          0x00000202
+#define KGSL_SNAPSHOT_OS_LINUX_V4          0x00000203
+
+/* Linux OS specific information */
+struct kgsl_snapshot_linux {
+	int osid;                   /* subsection OS identifier */
+	int state;		    /* 1 if the thread is running, 0 for hung */
+	__u32 seconds;		    /* Unix timestamp for the snapshot */
+	__u32 power_flags;            /* Current power flags */
+	__u32 power_level;            /* Current power level */
+	__u32 power_interval_timeout; /* Power interval timeout */
+	__u32 grpclk;                 /* Current GP clock value */
+	__u32 busclk;		    /* Current busclk value */
+	__u32 ptbase;		    /* Current ptbase */
+	__u32 pid;		    /* PID of the process that owns the PT */
+	__u32 current_context;	    /* ID of the current context */
+	__u32 ctxtcount;	    /* Number of contexts appended to section */
+	unsigned char release[32];  /* kernel release */
+	unsigned char version[32];  /* kernel version */
+	unsigned char comm[16];	    /* Name of the process that owns the PT */
+} __packed;
+
+struct kgsl_snapshot_linux_v2 {
+	int osid;                   /* subsection OS identifier */
+	__u32 seconds;		    /* Unix timestamp for the snapshot */
+	__u32 power_flags;            /* Current power flags */
+	__u32 power_level;            /* Current power level */
+	__u32 power_interval_timeout; /* Power interval timeout */
+	__u32 grpclk;                 /* Current GP clock value */
+	__u32 busclk;		    /* Current busclk value */
+	__u64 ptbase;		    /* Current ptbase */
+	__u32 pid;		    /* PID of the process that owns the PT */
+	__u32 current_context;	    /* ID of the current context */
+	__u32 ctxtcount;	    /* Number of contexts appended to section */
+	unsigned char release[32];  /* kernel release */
+	unsigned char version[32];  /* kernel version */
+	unsigned char comm[16];	    /* Name of the process that owns the PT */
+} __packed;
+
+struct kgsl_snapshot_linux_v4 {
+	int osid;		/* subsection OS identifier */
+	__u32 seconds;		/* Unix timestamp for the snapshot */
+	__u32 power_flags;	/* Current power flags */
+	__u32 power_level;	/* Current power level */
+	__u32 power_interval_timeout;	/* Power interval timeout */
+	__u32 grpclk;		/* Current GP clock value */
+	__u32 busclk;		/* Current busclk value */
+	__u64 ptbase;		/* Current ptbase */
+	__u64 ptbase_lpac;	/* Current LPAC ptbase */
+	__u32 pid;		/* PID of the process that owns the PT */
+	__u32 pid_lpac;		/* PID of the LPAC process that owns the PT */
+	__u32 current_context;	/* ID of the current context */
+	__u32 current_context_lpac;	/* ID of the current LPAC context */
+	__u32 ctxtcount;	/* Number of contexts appended to section */
+	unsigned char release[32];	/* kernel release */
+	unsigned char version[32];	/* kernel version */
+	unsigned char comm[16];		/* Name of the process that owns the PT */
+	unsigned char comm_lpac[16];	/* Name of the LPAC process that owns the PT */
+} __packed;
+
+/*
+ * This structure contains a record of an active context.
+ * These are appended one after another in the OS section below
+ * the header above
+ */
+
+struct kgsl_snapshot_linux_context {
+	__u32 id;			/* The context ID */
+	__u32 timestamp_queued;		/* The last queued timestamp */
+	__u32 timestamp_retired;	/* The last timestamp retired by HW */
+};
+
+struct kgsl_snapshot_linux_context_v2 {
+	__u32 id;			/* The context ID */
+	__u32 timestamp_queued;		/* The last queued timestamp */
+	__u32 timestamp_consumed;	/* The last timestamp consumed by HW */
+	__u32 timestamp_retired;	/* The last timestamp retired by HW */
+};
+/* Ringbuffer sub-section header */
+struct kgsl_snapshot_rb {
+	int start;  /* dword at the start of the dump */
+	int end;    /* dword at the end of the dump */
+	int rbsize; /* Size (in dwords) of the ringbuffer */
+	int wptr;   /* Current index of the CPU write pointer */
+	int rptr;   /* Current index of the GPU read pointer */
+	int count;  /* Number of dwords in the dump */
+	__u32 timestamp_queued; /* The last queued timestamp */
+	__u32 timestamp_retired; /* The last timestamp retired by HW */
+} __packed;
+
+struct kgsl_snapshot_rb_v2 {
+	int start;  /* dword at the start of the dump */
+	int end;    /* dword at the end of the dump */
+	int rbsize; /* Size (in dwords) of the ringbuffer */
+	int wptr;   /* Current index of the CPU write pointer */
+	int rptr;   /* Current index of the GPU read pointer */
+	int count;  /* Number of dwords in the dump */
+	__u32 timestamp_queued; /* The last queued timestamp */
+	__u32 timestamp_retired; /* The last timestamp retired by HW */
+	__u64 gpuaddr; /* The GPU address of the ringbuffer */
+	__u32 id; /* Ringbuffer identifier */
+} __packed;
+
+
+/* Replay or Memory list section, both sections have same header */
+struct kgsl_snapshot_replay_mem_list {
+	/*
+	 * Number of IBs to replay for replay section or
+	 * number of memory list entries for mem list section
+	 */
+	int num_entries;
+	/* Pagetable base to which the replay IBs or memory entries belong */
+	__u32 ptbase;
+} __packed;
+
+/* Replay or Memory list section, both sections have same header */
+struct kgsl_snapshot_mem_list_v2 {
+	/*
+	 * Number of IBs to replay for replay section or
+	 * number of memory list entries for mem list section
+	 */
+	int num_entries;
+	/* Pagetable base to which the replay IBs or memory entries belong */
+	__u64 ptbase;
+} __packed;
+
+
+/* Indirect buffer sub-section header */
+struct kgsl_snapshot_ib {
+	__u32 gpuaddr; /* GPU address of the the IB */
+	__u32 ptbase;  /* Base for the pagetable the GPU address is valid in */
+	int size;    /* Size of the IB */
+} __packed;
+
+/* Indirect buffer sub-section header (v2) */
+struct kgsl_snapshot_ib_v2 {
+	__u64 gpuaddr; /* GPU address of the the IB */
+	__u64 ptbase;  /* Base for the pagetable the GPU address is valid in */
+	__u64 size;    /* Size of the IB */
+} __packed;
+
+/* GMU memory ID's */
+#define SNAPSHOT_GMU_MEM_UNKNOWN	0x00
+#define SNAPSHOT_GMU_MEM_HFI		0x01
+#define SNAPSHOT_GMU_MEM_LOG		0x02
+#define SNAPSHOT_GMU_MEM_BWTABLE	0x03
+#define SNAPSHOT_GMU_MEM_DEBUG		0x04
+#define SNAPSHOT_GMU_MEM_BIN_BLOCK	0x05
+#define SNAPSHOT_GMU_MEM_CONTEXT_QUEUE	0x06
+#define SNAPSHOT_GMU_MEM_HW_FENCE	0x07
+#define SNAPSHOT_GMU_MEM_WARMBOOT	0x08
+#define SNAPSHOT_GMU_MEM_VRB		0x09
+#define SNAPSHOT_GMU_MEM_TRACE		0x0a
+
+/* GMU memory section data */
+struct kgsl_snapshot_gmu_mem {
+	int type;
+	uint64_t hostaddr;
+	uint64_t gmuaddr;
+	uint64_t gpuaddr;
+} __packed;
+
+/* Register sub-section header */
+struct kgsl_snapshot_regs {
+	__u32 count; /* Number of register pairs in the section */
+} __packed;
+
+/* Indexed register sub-section header */
+struct kgsl_snapshot_indexed_regs {
+	__u32 index_reg; /* Offset of the index register for this section */
+	__u32 data_reg;  /* Offset of the data register for this section */
+	int start;     /* Starting index */
+	int count;     /* Number of dwords in the data */
+} __packed;
+
+/* MVC register sub-section header */
+struct kgsl_snapshot_mvc_regs {
+	int ctxt_id;
+	int cluster_id;
+} __packed;
+
+struct kgsl_snapshot_mvc_regs_v2 {
+	int ctxt_id;
+	int cluster_id;
+	int pipe_id;
+	int location_id;
+} __packed;
+
+/* Istore sub-section header */
+struct kgsl_snapshot_istore {
+	int count;   /* Number of instructions in the istore */
+} __packed;
+
+/* Debug data sub-section header */
+
+/* A2XX debug sections */
+#define SNAPSHOT_DEBUG_SX         1
+#define SNAPSHOT_DEBUG_CP         2
+#define SNAPSHOT_DEBUG_SQ         3
+#define SNAPSHOT_DEBUG_SQTHREAD   4
+#define SNAPSHOT_DEBUG_MIU        5
+
+/* A3XX debug sections */
+#define SNAPSHOT_DEBUG_VPC_MEMORY 6
+#define SNAPSHOT_DEBUG_CP_MEQ     7
+#define SNAPSHOT_DEBUG_CP_PM4_RAM 8
+#define SNAPSHOT_DEBUG_CP_PFP_RAM 9
+#define SNAPSHOT_DEBUG_CP_ROQ     10
+#define SNAPSHOT_DEBUG_SHADER_MEMORY 11
+#define SNAPSHOT_DEBUG_CP_MERCIU 12
+#define SNAPSHOT_DEBUG_SQE_VERSION 14
+
+/* GMU Version information */
+#define SNAPSHOT_DEBUG_GMU_CORE_VERSION 15
+#define SNAPSHOT_DEBUG_GMU_CORE_DEV_VERSION 16
+#define SNAPSHOT_DEBUG_GMU_PWR_VERSION 17
+#define SNAPSHOT_DEBUG_GMU_PWR_DEV_VERSION 18
+#define SNAPSHOT_DEBUG_GMU_HFI_VERSION 19
+#define SNAPSHOT_DEBUG_AQE_VERSION 20
+
+struct kgsl_snapshot_debug {
+	int type;    /* Type identifier for the attached tata */
+	int size;   /* Size of the section in dwords */
+} __packed;
+
+struct kgsl_snapshot_debugbus {
+	int id;	   /* Debug bus ID */
+	int count; /* Number of dwords in the dump */
+} __packed;
+
+struct kgsl_snapshot_side_debugbus {
+	int id;   /* Debug bus ID */
+	int size; /* Number of dwords in the dump */
+	int valid_data;  /* Mask of valid bits of the side debugbus */
+} __packed;
+
+struct kgsl_snapshot_shader {
+	int type;  /* SP/TP statetype */
+	int index; /* SP/TP index */
+	int size;  /* Number of dwords in the dump */
+} __packed;
+
+struct kgsl_snapshot_shader_v2 {
+	int type;  /* SP/TP statetype */
+	int index; /* SP/TP index */
+	int usptp; /* USPTP index */
+	int pipe_id; /* Pipe id */
+	int location; /* Location value */
+	u32 size;  /* Number of dwords in the dump */
+} __packed;
+
+#define TRACE_BUF_NUM_SIG 4
+
+/**
+ * enum trace_buffer_source - Bits to identify the source block of trace buffer information
+ * GX_DBGC : Signals captured from GX block
+ * CX_DBGC : Signals captured from CX block
+ */
+enum trace_buffer_source {
+	GX_DBGC = 1,
+	CX_DBGC = 2,
+};
+
+/**
+ * kgsl_snapshot_trace_buffer: Header Information for the tracebuffer in snapshot.
+ */
+struct kgsl_snapshot_trace_buffer {
+	/** @dbgc_ctrl: Identify source for trace */
+	__u16 dbgc_ctrl;
+	/** @dbgc_ctrl: Identify source for trace */
+	__u16 segment;
+	/** @granularity: The total number of segments in each packet */
+	__u16 granularity;
+	/** @ping_blk: Signal block */
+	__u16 ping_blk[TRACE_BUF_NUM_SIG];
+	/** @ping_idx: Signal Index */
+	__u16 ping_idx[TRACE_BUF_NUM_SIG];
+	/** @size: Number of bytes in the dump */
+	__u32 size;
+} __packed;
+
+#define SNAPSHOT_GPU_OBJECT_SHADER  1
+#define SNAPSHOT_GPU_OBJECT_IB      2
+#define SNAPSHOT_GPU_OBJECT_GENERIC 3
+#define SNAPSHOT_GPU_OBJECT_DRAW    4
+#define SNAPSHOT_GPU_OBJECT_GLOBAL  5
+
+struct kgsl_snapshot_gpu_object {
+	int type;      /* Type of GPU object */
+	__u32 gpuaddr; /* GPU address of the the object */
+	__u32 ptbase;  /* Base for the pagetable the GPU address is valid in */
+	int size;    /* Size of the object (in dwords) */
+};
+
+struct kgsl_snapshot_gpu_object_v2 {
+	int type;      /* Type of GPU object */
+	__u64 gpuaddr; /* GPU address of the the object */
+	__u64 ptbase;  /* Base for the pagetable the GPU address is valid in */
+	__u64 size;    /* Size of the object (in dwords) */
+} __packed;
+
+struct kgsl_snapshot_eventlog {
+	/** @type: Type of the event log buffer */
+	__u16 type;
+	/** @version: Version of the event log buffer */
+	__u16 version;
+	/** @size: Size of the eventlog buffer in bytes */
+	u32 size;
+} __packed;
+
+struct kgsl_device;
+struct kgsl_process_private;
+
+void kgsl_snapshot_push_object(struct kgsl_device *device,
+		struct kgsl_process_private *process,
+		uint64_t gpuaddr, uint64_t dwords);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_sync.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_sync.c
@@ -0,0 +1,917 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2012-2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/file.h>
+#include <linux/slab.h>
+#include <linux/sync_file.h>
+
+#include "kgsl_device.h"
+#include "kgsl_sync.h"
+
+#if (KERNEL_VERSION(6, 3, 0) <= LINUX_VERSION_CODE)
+#include <msm_hw_fence.h>
+#else
+#include <linux/soc/qcom/msm_hw_fence.h>
+#endif
+
+static const struct dma_fence_ops kgsl_sync_fence_ops;
+
+static struct kgsl_sync_fence *kgsl_sync_fence_create(
+					struct kgsl_context *context,
+					unsigned int timestamp)
+{
+	struct kgsl_sync_fence *kfence;
+	struct kgsl_sync_timeline *ktimeline = context->ktimeline;
+	unsigned long flags;
+
+	/* Get a refcount to the timeline. Put when released */
+	if (!kref_get_unless_zero(&ktimeline->kref))
+		return NULL;
+
+	kfence = kzalloc(sizeof(*kfence), GFP_KERNEL);
+	if (kfence == NULL) {
+		kgsl_sync_timeline_put(ktimeline);
+		return NULL;
+	}
+
+	kfence->parent = ktimeline;
+	kfence->context_id = context->id;
+	kfence->timestamp = timestamp;
+
+	dma_fence_init(&kfence->fence, &kgsl_sync_fence_ops, &ktimeline->lock,
+		ktimeline->fence_context, timestamp);
+
+	/*
+	 * sync_file_create() takes a refcount to the fence. This refcount is
+	 * put when the fence is signaled.
+	 */
+	kfence->sync_file = sync_file_create(&kfence->fence);
+
+	if (kfence->sync_file == NULL) {
+		kgsl_sync_timeline_put(ktimeline);
+		dev_err(context->device->dev, "Create sync_file failed\n");
+		kfree(kfence);
+		return NULL;
+	}
+
+	spin_lock_irqsave(&ktimeline->lock, flags);
+	list_add_tail(&kfence->child_list, &ktimeline->child_list_head);
+	spin_unlock_irqrestore(&ktimeline->lock, flags);
+
+	return kfence;
+}
+
+static void kgsl_sync_fence_release(struct dma_fence *fence)
+{
+	struct kgsl_sync_fence *kfence = (struct kgsl_sync_fence *)fence;
+
+	if (test_bit(MSM_HW_FENCE_FLAG_ENABLED_BIT, &fence->flags))
+		msm_hw_fence_destroy(kfence->hw_fence_handle, fence);
+
+	kgsl_sync_timeline_put(kfence->parent);
+	kfree(kfence);
+}
+
+/* Called with ktimeline->lock held */
+static bool kgsl_sync_fence_has_signaled(struct dma_fence *fence)
+{
+	struct kgsl_sync_fence *kfence = (struct kgsl_sync_fence *)fence;
+	struct kgsl_sync_timeline *ktimeline = kfence->parent;
+	unsigned int ts = kfence->timestamp;
+
+	return (timestamp_cmp(ktimeline->last_timestamp, ts) >= 0);
+}
+
+static bool kgsl_enable_signaling(struct dma_fence *fence)
+{
+	return !kgsl_sync_fence_has_signaled(fence);
+}
+
+struct kgsl_sync_fence_event_priv {
+	struct kgsl_context *context;
+	unsigned int timestamp;
+};
+
+/**
+ * kgsl_sync_fence_event_cb - Event callback for a fence timestamp event
+ * @device - The KGSL device that expired the timestamp
+ * @context- Pointer to the context that owns the event
+ * @priv: Private data for the callback
+ * @result - Result of the event (retired or canceled)
+ *
+ * Signal a fence following the expiration of a timestamp
+ */
+
+static void kgsl_sync_fence_event_cb(struct kgsl_device *device,
+		struct kgsl_event_group *group, void *priv, int result)
+{
+	struct kgsl_sync_fence_event_priv *ev = priv;
+
+	kgsl_sync_timeline_signal(ev->context->ktimeline, ev->timestamp);
+	kgsl_context_put(ev->context);
+	kfree(ev);
+}
+
+static int _add_fence_event(struct kgsl_device *device,
+	struct kgsl_context *context, unsigned int timestamp)
+{
+	struct kgsl_sync_fence_event_priv *event;
+	int ret;
+
+	event = kmalloc(sizeof(*event), GFP_KERNEL);
+	if (event == NULL)
+		return -ENOMEM;
+
+	/*
+	 * Increase the refcount for the context to keep it through the
+	 * callback
+	 */
+	if (!_kgsl_context_get(context)) {
+		kfree(event);
+		return -ENOENT;
+	}
+
+	event->context = context;
+	event->timestamp = timestamp;
+
+	ret = kgsl_add_event(device, &context->events, timestamp,
+		kgsl_sync_fence_event_cb, event);
+
+	if (ret) {
+		kgsl_context_put(context);
+		kfree(event);
+	}
+
+	return ret;
+}
+
+/* Only to be used if creating a related event failed */
+static void kgsl_sync_cancel(struct kgsl_sync_fence *kfence)
+{
+	spin_lock(&kfence->parent->lock);
+	if (!list_empty(&kfence->child_list)) {
+		list_del_init(&kfence->child_list);
+		dma_fence_put(&kfence->fence);
+	}
+	spin_unlock(&kfence->parent->lock);
+}
+
+/**
+ * kgsl_add_fence_event - Create a new fence event
+ * @device - KGSL device to create the event on
+ * @timestamp - Timestamp to trigger the event
+ * @data - Return fence fd stored in struct kgsl_timestamp_event_fence
+ * @len - length of the fence event
+ * @owner - driver instance that owns this event
+ * @returns 0 on success or error code on error
+ *
+ * Create a fence and register an event to signal the fence when
+ * the timestamp expires
+ */
+
+int kgsl_add_fence_event(struct kgsl_device *device,
+	u32 context_id, u32 timestamp, void __user *data, int len,
+	struct kgsl_device_private *owner)
+{
+	struct kgsl_timestamp_event_fence priv;
+	struct kgsl_context *context;
+	struct kgsl_sync_fence *kfence = NULL;
+	int ret = -EINVAL;
+	unsigned int cur;
+	bool retired = false;
+
+	priv.fence_fd = -1;
+
+	if (len != sizeof(priv))
+		return -EINVAL;
+
+	context = kgsl_context_get_owner(owner, context_id);
+
+	if (context == NULL)
+		return -EINVAL;
+
+	if (test_bit(KGSL_CONTEXT_PRIV_INVALID, &context->priv))
+		goto out;
+
+	kfence = kgsl_sync_fence_create(context, timestamp);
+	if (kfence == NULL) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	priv.fence_fd = get_unused_fd_flags(0);
+	if (priv.fence_fd < 0) {
+		dev_crit_ratelimited(device->dev,
+					"Unable to get a file descriptor: %d\n",
+					priv.fence_fd);
+		ret = priv.fence_fd;
+		goto out;
+	}
+
+	/*
+	 * If the timestamp hasn't expired yet create an event to trigger it.
+	 * Otherwise, just signal the fence - there is no reason to go through
+	 * the effort of creating a fence we don't need.
+	 */
+
+	kgsl_readtimestamp(device, context, KGSL_TIMESTAMP_RETIRED, &cur);
+
+	retired = timestamp_cmp(cur, timestamp) >= 0;
+
+	if (retired) {
+		ret = 0;
+		kgsl_sync_timeline_signal(context->ktimeline, cur);
+	} else {
+		ret = _add_fence_event(device, context, timestamp);
+		if (ret)
+			goto out;
+	}
+
+	if (copy_to_user(data, &priv, sizeof(priv))) {
+		ret = -EFAULT;
+		goto out;
+	}
+
+	if (!retired)
+		device->ftbl->create_hw_fence(device, kfence);
+
+	fd_install(priv.fence_fd, kfence->sync_file->file);
+
+out:
+	kgsl_context_put(context);
+	if (ret) {
+		if (priv.fence_fd >= 0)
+			put_unused_fd(priv.fence_fd);
+
+		if (kfence) {
+			kgsl_sync_cancel(kfence);
+			/*
+			 * Put the refcount of sync file. This will release
+			 * kfence->fence as well.
+			 */
+			fput(kfence->sync_file->file);
+		}
+	}
+	return ret;
+}
+
+static void kgsl_sync_timeline_value_str(struct dma_fence *fence,
+					char *str, int size)
+{
+	struct kgsl_sync_fence *kfence = (struct kgsl_sync_fence *)fence;
+	struct kgsl_sync_timeline *ktimeline = kfence->parent;
+	struct kgsl_context *context = NULL;
+	unsigned long flags;
+	int ret = 0;
+
+	unsigned int timestamp_retired;
+	unsigned int timestamp_queued;
+
+	if (!kref_get_unless_zero(&ktimeline->kref))
+		return;
+	if (!ktimeline->device)
+		goto put_timeline;
+
+	spin_lock_irqsave(&ktimeline->lock, flags);
+	ret = _kgsl_context_get(ktimeline->context);
+	context = ret ? ktimeline->context : NULL;
+	spin_unlock_irqrestore(&ktimeline->lock, flags);
+
+	/* Get the last signaled timestamp if the context is not valid */
+	timestamp_queued = ktimeline->last_timestamp;
+	timestamp_retired = timestamp_queued;
+	if (context) {
+		kgsl_readtimestamp(ktimeline->device, context,
+			KGSL_TIMESTAMP_RETIRED, &timestamp_retired);
+
+		kgsl_readtimestamp(ktimeline->device, context,
+			KGSL_TIMESTAMP_QUEUED, &timestamp_queued);
+
+		kgsl_context_put(context);
+	}
+
+	snprintf(str, size, "%u queued:%u retired:%u",
+		ktimeline->last_timestamp,
+		timestamp_queued, timestamp_retired);
+
+put_timeline:
+	kgsl_sync_timeline_put(ktimeline);
+}
+
+static void kgsl_sync_fence_value_str(struct dma_fence *fence,
+					char *str, int size)
+{
+	struct kgsl_sync_fence *kfence = (struct kgsl_sync_fence *)fence;
+
+	snprintf(str, size, "%u", kfence->timestamp);
+}
+
+static const char *kgsl_sync_fence_driver_name(struct dma_fence *fence)
+{
+	return "kgsl-timeline";
+}
+
+static const char *kgsl_sync_timeline_name(struct dma_fence *fence)
+{
+	struct kgsl_sync_fence *kfence = (struct kgsl_sync_fence *)fence;
+	struct kgsl_sync_timeline *ktimeline = kfence->parent;
+
+	return ktimeline->name;
+}
+
+int kgsl_sync_timeline_create(struct kgsl_context *context)
+{
+	struct kgsl_sync_timeline *ktimeline;
+
+	/* Put context at detach time */
+	if (!_kgsl_context_get(context))
+		return -ENOENT;
+
+	ktimeline = kzalloc(sizeof(*ktimeline), GFP_KERNEL);
+	if (ktimeline == NULL) {
+		kgsl_context_put(context);
+		return -ENOMEM;
+	}
+
+	kref_init(&ktimeline->kref);
+	snprintf(ktimeline->name, sizeof(ktimeline->name),
+		"%s_%u-%.15s(%d)-%.15s(%d)",
+		context->device->name, context->id,
+		current->group_leader->comm, current->group_leader->pid,
+		current->comm, current->pid);
+
+	ktimeline->fence_context = dma_fence_context_alloc(1);
+	ktimeline->last_timestamp = 0;
+	INIT_LIST_HEAD(&ktimeline->child_list_head);
+	spin_lock_init(&ktimeline->lock);
+	ktimeline->device = context->device;
+
+	/*
+	 * The context pointer is valid till detach time, where we put the
+	 * refcount on the context
+	 */
+	ktimeline->context = context;
+
+	context->ktimeline = ktimeline;
+
+	return 0;
+}
+
+void kgsl_sync_timeline_signal(struct kgsl_sync_timeline *ktimeline,
+					unsigned int timestamp)
+{
+	unsigned long flags;
+	struct kgsl_sync_fence *kfence, *next;
+
+	if (!kref_get_unless_zero(&ktimeline->kref))
+		return;
+
+	spin_lock_irqsave(&ktimeline->lock, flags);
+	if (timestamp_cmp(timestamp, ktimeline->last_timestamp) > 0)
+		ktimeline->last_timestamp = timestamp;
+
+	list_for_each_entry_safe(kfence, next, &ktimeline->child_list_head,
+				child_list) {
+		if (dma_fence_is_signaled_locked(&kfence->fence)) {
+			list_del_init(&kfence->child_list);
+			dma_fence_put(&kfence->fence);
+		}
+	}
+
+	spin_unlock_irqrestore(&ktimeline->lock, flags);
+	kgsl_sync_timeline_put(ktimeline);
+}
+
+void kgsl_sync_timeline_detach(struct kgsl_sync_timeline *ktimeline)
+{
+	unsigned long flags;
+	struct kgsl_context *context = ktimeline->context;
+
+	/* Set context pointer to NULL and drop our refcount on the context */
+	spin_lock_irqsave(&ktimeline->lock, flags);
+	ktimeline->context = NULL;
+	spin_unlock_irqrestore(&ktimeline->lock, flags);
+	kgsl_context_put(context);
+}
+
+static void kgsl_sync_timeline_destroy(struct kref *kref)
+{
+	struct kgsl_sync_timeline *ktimeline =
+		container_of(kref, struct kgsl_sync_timeline, kref);
+
+	kfree(ktimeline);
+}
+
+void kgsl_sync_timeline_put(struct kgsl_sync_timeline *ktimeline)
+{
+	if (ktimeline)
+		kref_put(&ktimeline->kref, kgsl_sync_timeline_destroy);
+}
+
+static const struct dma_fence_ops kgsl_sync_fence_ops = {
+	.get_driver_name = kgsl_sync_fence_driver_name,
+	.get_timeline_name = kgsl_sync_timeline_name,
+	.enable_signaling = kgsl_enable_signaling,
+	.signaled = kgsl_sync_fence_has_signaled,
+	.wait = dma_fence_default_wait,
+	.release = kgsl_sync_fence_release,
+
+	.fence_value_str = kgsl_sync_fence_value_str,
+	.timeline_value_str = kgsl_sync_timeline_value_str,
+};
+
+static void kgsl_sync_fence_callback(struct dma_fence *fence,
+					 struct dma_fence_cb *cb)
+{
+	struct kgsl_sync_fence_cb *kcb = (struct kgsl_sync_fence_cb *)cb;
+
+	kcb->func(kcb->priv);
+}
+
+bool is_kgsl_fence(struct dma_fence *f)
+{
+	if (f->ops == &kgsl_sync_fence_ops)
+		return true;
+
+	return false;
+}
+
+static void kgsl_count_hw_fences(struct kgsl_drawobj_sync_event *event, struct dma_fence *fence)
+{
+	/*
+	 * Even one unsignaled sw-only fence in this sync object means we can't send this sync
+	 * object to the hardware
+	 */
+	if (event->syncobj->flags & KGSL_SYNCOBJ_SW)
+		return;
+
+	if (!test_bit(MSM_HW_FENCE_FLAG_ENABLED_BIT, &fence->flags)) {
+		/* Ignore software fences that are already signaled */
+		if (!dma_fence_is_signaled(fence))
+			event->syncobj->flags |= KGSL_SYNCOBJ_SW;
+	} else {
+		event->syncobj->num_hw_fence++;
+	}
+}
+
+void kgsl_get_fence_info(struct kgsl_drawobj_sync_event *event)
+{
+	unsigned int num_fences;
+	struct dma_fence *fence, **fences;
+	struct dma_fence_array *array;
+	struct event_fence_info *info_ptr = event->priv;
+	int i;
+
+	fence = event->handle->fence;
+
+	array = to_dma_fence_array(fence);
+	if (array != NULL) {
+		num_fences = array->num_fences;
+		fences = array->fences;
+	} else {
+		num_fences = 1;
+		fences = &fence;
+	}
+
+	if (!info_ptr)
+		goto count;
+
+	info_ptr->fences = kcalloc(num_fences, sizeof(struct fence_info),
+			GFP_KERNEL);
+	if (info_ptr->fences == NULL)
+		goto count;
+
+	info_ptr->num_fences = num_fences;
+
+	for (i = 0; i < num_fences; i++) {
+		struct dma_fence *f = fences[i];
+		struct fence_info *fi = &info_ptr->fences[i];
+		int len;
+
+		len =  scnprintf(fi->name, sizeof(fi->name), "%s %s",
+			f->ops->get_driver_name(f),
+			f->ops->get_timeline_name(f));
+
+		if (f->ops->fence_value_str) {
+			len += scnprintf(fi->name + len, sizeof(fi->name) - len,
+				": ");
+			f->ops->fence_value_str(f, fi->name + len,
+				sizeof(fi->name) - len);
+		}
+
+		kgsl_count_hw_fences(event, f);
+	}
+
+	return;
+count:
+	for (i = 0; i < num_fences; i++)
+		kgsl_count_hw_fences(event, fences[i]);
+}
+
+struct kgsl_sync_fence_cb *kgsl_sync_fence_async_wait(int fd,
+	bool (*func)(void *priv), void *priv)
+{
+	struct kgsl_sync_fence_cb *kcb;
+	struct dma_fence *fence;
+	int status;
+
+	fence = sync_file_get_fence(fd);
+	if (fence == NULL)
+		return ERR_PTR(-EINVAL);
+
+	/* create the callback */
+	kcb = kzalloc(sizeof(*kcb), GFP_KERNEL);
+	if (kcb == NULL) {
+		dma_fence_put(fence);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	kcb->fence = fence;
+	kcb->priv = priv;
+	kcb->func = func;
+
+	/* if status then error or signaled */
+	status = dma_fence_add_callback(fence, &kcb->fence_cb,
+				kgsl_sync_fence_callback);
+
+	if (status) {
+		kfree(kcb);
+		if (!dma_fence_is_signaled(fence))
+			kcb = ERR_PTR(status);
+		else
+			kcb = NULL;
+		dma_fence_put(fence);
+	}
+
+	return kcb;
+}
+
+/*
+ * Cancel the fence async callback.
+ */
+void kgsl_sync_fence_async_cancel(struct kgsl_sync_fence_cb *kcb)
+{
+	if (kcb == NULL)
+		return;
+
+	dma_fence_remove_callback(kcb->fence, &kcb->fence_cb);
+}
+
+struct kgsl_syncsource {
+	struct kref refcount;
+	char name[32];
+	int id;
+	struct kgsl_process_private *private;
+	struct list_head child_list_head;
+	spinlock_t lock;
+};
+
+struct kgsl_syncsource_fence {
+	struct dma_fence fence;
+	struct kgsl_syncsource *parent;
+	struct list_head child_list;
+};
+
+static const struct dma_fence_ops kgsl_syncsource_fence_ops;
+
+long kgsl_ioctl_syncsource_create(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	struct kgsl_syncsource *syncsource = NULL;
+	struct kgsl_syncsource_create *param = data;
+	int ret = -EINVAL;
+	int id = 0;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+
+	if (!kgsl_process_private_get(private))
+		return ret;
+
+	syncsource = kzalloc(sizeof(*syncsource), GFP_KERNEL);
+	if (syncsource == NULL) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	kref_init(&syncsource->refcount);
+	snprintf(syncsource->name, sizeof(syncsource->name),
+		"kgsl-syncsource-pid-%d", current->group_leader->pid);
+	syncsource->private = private;
+	INIT_LIST_HEAD(&syncsource->child_list_head);
+	spin_lock_init(&syncsource->lock);
+
+	idr_preload(GFP_KERNEL);
+	spin_lock(&private->syncsource_lock);
+	id = idr_alloc(&private->syncsource_idr, syncsource, 1, 0, GFP_NOWAIT);
+	if (id > 0) {
+		syncsource->id = id;
+		param->id = id;
+		ret = 0;
+	} else {
+		ret = id;
+	}
+
+	spin_unlock(&private->syncsource_lock);
+	idr_preload_end();
+
+out:
+	if (ret) {
+		kgsl_process_private_put(private);
+		kfree(syncsource);
+	}
+
+	return ret;
+}
+
+static struct kgsl_syncsource *
+kgsl_syncsource_get(struct kgsl_process_private *private, int id)
+{
+	int result = 0;
+	struct kgsl_syncsource *syncsource = NULL;
+
+	spin_lock(&private->syncsource_lock);
+
+	syncsource = idr_find(&private->syncsource_idr, id);
+	if (syncsource)
+		result = kref_get_unless_zero(&syncsource->refcount);
+
+	spin_unlock(&private->syncsource_lock);
+
+	return result ? syncsource : NULL;
+}
+
+static void kgsl_syncsource_destroy(struct kref *kref)
+{
+	struct kgsl_syncsource *syncsource = container_of(kref,
+						struct kgsl_syncsource,
+						refcount);
+
+	struct kgsl_process_private *private = syncsource->private;
+
+	/* Done with process private. Release the refcount */
+	kgsl_process_private_put(private);
+
+	kfree(syncsource);
+}
+
+void kgsl_syncsource_put(struct kgsl_syncsource *syncsource)
+{
+	if (syncsource)
+		kref_put(&syncsource->refcount, kgsl_syncsource_destroy);
+}
+
+static void kgsl_syncsource_cleanup(struct kgsl_process_private *private,
+				struct kgsl_syncsource *syncsource)
+{
+	struct kgsl_syncsource_fence *sfence, *next;
+	unsigned long flags;
+
+	/* Signal all fences to release any callbacks */
+	spin_lock_irqsave(&syncsource->lock, flags);
+
+	list_for_each_entry_safe(sfence, next, &syncsource->child_list_head,
+				child_list) {
+		dma_fence_signal_locked(&sfence->fence);
+		list_del_init(&sfence->child_list);
+	}
+
+	spin_unlock_irqrestore(&syncsource->lock, flags);
+
+	/* put reference from syncsource creation */
+	kgsl_syncsource_put(syncsource);
+}
+
+long kgsl_ioctl_syncsource_destroy(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	struct kgsl_syncsource_destroy *param = data;
+	struct kgsl_syncsource *syncsource = NULL;
+	struct kgsl_process_private *private = dev_priv->process_priv;
+
+	spin_lock(&private->syncsource_lock);
+	syncsource = idr_find(&private->syncsource_idr, param->id);
+
+	if (syncsource == NULL) {
+		spin_unlock(&private->syncsource_lock);
+		return -EINVAL;
+	}
+
+	if (syncsource->id != 0) {
+		idr_remove(&private->syncsource_idr, syncsource->id);
+		syncsource->id = 0;
+	}
+	spin_unlock(&private->syncsource_lock);
+
+	kgsl_syncsource_cleanup(private, syncsource);
+	return 0;
+}
+
+long kgsl_ioctl_syncsource_create_fence(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	struct kgsl_syncsource_create_fence *param = data;
+	struct kgsl_syncsource *syncsource = NULL;
+	int ret = -EINVAL;
+	struct kgsl_syncsource_fence *sfence = NULL;
+	struct sync_file *sync_file = NULL;
+	int fd = -1;
+	unsigned long flags;
+
+	/*
+	 * Take a refcount that is released when the fence is released
+	 * (or if fence can't be added to the syncsource).
+	 */
+	syncsource = kgsl_syncsource_get(dev_priv->process_priv,
+					param->id);
+	if (syncsource == NULL)
+		goto out;
+
+	sfence = kzalloc(sizeof(*sfence), GFP_KERNEL);
+	if (sfence == NULL) {
+		ret = -ENOMEM;
+		goto out;
+	}
+	sfence->parent = syncsource;
+
+	/* Use a new fence context for each fence */
+	dma_fence_init(&sfence->fence, &kgsl_syncsource_fence_ops,
+		&syncsource->lock, dma_fence_context_alloc(1), 1);
+
+	sync_file = sync_file_create(&sfence->fence);
+
+	if (sync_file == NULL) {
+		dev_err(dev_priv->device->dev,
+			     "Create sync_file failed\n");
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	fd = get_unused_fd_flags(0);
+	if (fd < 0) {
+		ret = -EBADF;
+		goto out;
+	}
+	ret = 0;
+
+	fd_install(fd, sync_file->file);
+
+	param->fence_fd = fd;
+
+	spin_lock_irqsave(&syncsource->lock, flags);
+	list_add_tail(&sfence->child_list, &syncsource->child_list_head);
+	spin_unlock_irqrestore(&syncsource->lock, flags);
+out:
+	/*
+	 * We're transferring ownership of the fence to the sync file.
+	 * The sync file takes an extra refcount when it is created, so put
+	 * our refcount.
+	 */
+	if (sync_file)
+		dma_fence_put(&sfence->fence);
+
+	if (ret) {
+		if (sync_file)
+			fput(sync_file->file);
+		else if (sfence)
+			dma_fence_put(&sfence->fence);
+		else
+			kgsl_syncsource_put(syncsource);
+	}
+
+	return ret;
+}
+
+static int kgsl_syncsource_signal(struct kgsl_syncsource *syncsource,
+					struct dma_fence *fence)
+{
+	struct kgsl_syncsource_fence *sfence, *next;
+	int ret = -EINVAL;
+	unsigned long flags;
+
+	spin_lock_irqsave(&syncsource->lock, flags);
+
+	list_for_each_entry_safe(sfence, next, &syncsource->child_list_head,
+				child_list) {
+		if (fence == &sfence->fence) {
+			dma_fence_signal_locked(fence);
+			list_del_init(&sfence->child_list);
+
+			ret = 0;
+			break;
+		}
+	}
+
+	spin_unlock_irqrestore(&syncsource->lock, flags);
+
+	return ret;
+}
+
+long kgsl_ioctl_syncsource_signal_fence(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	int ret = -EINVAL;
+	struct kgsl_syncsource_signal_fence *param = data;
+	struct kgsl_syncsource *syncsource = NULL;
+	struct dma_fence *fence = NULL;
+
+	syncsource = kgsl_syncsource_get(dev_priv->process_priv,
+					param->id);
+	if (syncsource == NULL)
+		goto out;
+
+	fence = sync_file_get_fence(param->fence_fd);
+	if (fence == NULL) {
+		ret = -EBADF;
+		goto out;
+	}
+
+	ret = kgsl_syncsource_signal(syncsource, fence);
+out:
+	if (fence)
+		dma_fence_put(fence);
+	if (syncsource)
+		kgsl_syncsource_put(syncsource);
+	return ret;
+}
+
+static void kgsl_syncsource_fence_release(struct dma_fence *fence)
+{
+	struct kgsl_syncsource_fence *sfence =
+			(struct kgsl_syncsource_fence *)fence;
+
+	/* Signal if it's not signaled yet */
+	kgsl_syncsource_signal(sfence->parent, fence);
+
+	/* Release the refcount on the syncsource */
+	kgsl_syncsource_put(sfence->parent);
+
+	kfree(sfence);
+}
+
+void kgsl_syncsource_process_release_syncsources(
+		struct kgsl_process_private *private)
+{
+	struct kgsl_syncsource *syncsource;
+	int next = 0;
+
+	while (1) {
+		spin_lock(&private->syncsource_lock);
+		syncsource = idr_get_next(&private->syncsource_idr, &next);
+
+		if (syncsource == NULL) {
+			spin_unlock(&private->syncsource_lock);
+			break;
+		}
+
+		if (syncsource->id != 0) {
+			idr_remove(&private->syncsource_idr, syncsource->id);
+			syncsource->id = 0;
+		}
+		spin_unlock(&private->syncsource_lock);
+
+		kgsl_syncsource_cleanup(private, syncsource);
+		next = next + 1;
+	}
+}
+
+static const char *kgsl_syncsource_get_timeline_name(struct dma_fence *fence)
+{
+	struct kgsl_syncsource_fence *sfence =
+			(struct kgsl_syncsource_fence *)fence;
+	struct kgsl_syncsource *syncsource = sfence->parent;
+
+	return syncsource->name;
+}
+
+static bool kgsl_syncsource_enable_signaling(struct dma_fence *fence)
+{
+	return true;
+}
+
+static const char *kgsl_syncsource_driver_name(struct dma_fence *fence)
+{
+	return "kgsl-syncsource-timeline";
+}
+
+static void kgsl_syncsource_fence_value_str(struct dma_fence *fence,
+						char *str, int size)
+{
+	/*
+	 * Each fence is independent of the others on the same timeline.
+	 * We use a different context for each of them.
+	 */
+	snprintf(str, size, "%llu", fence->context);
+}
+
+static const struct dma_fence_ops kgsl_syncsource_fence_ops = {
+	.get_driver_name = kgsl_syncsource_driver_name,
+	.get_timeline_name = kgsl_syncsource_get_timeline_name,
+	.enable_signaling = kgsl_syncsource_enable_signaling,
+	.wait = dma_fence_default_wait,
+	.release = kgsl_syncsource_fence_release,
+
+	.fence_value_str = kgsl_syncsource_fence_value_str,
+};
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_sync.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_sync.h
@@ -0,0 +1,208 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2014,2018-2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#ifndef __KGSL_SYNC_H
+#define __KGSL_SYNC_H
+
+#include <linux/dma-fence.h>
+
+/**
+ * struct kgsl_sync_timeline - A sync timeline associated with a kgsl context
+ * @kref: Refcount to keep the struct alive until all its fences are signaled,
+	  and as long as the context exists
+ * @name: String to describe this timeline
+ * @fence_context: Used by the fence driver to identify fences belonging to
+ *		   this context
+ * @child_list_head: List head for all fences on this timeline
+ * @lock: Spinlock to protect this timeline
+ * @last_timestamp: Last timestamp when signaling fences
+ * @device: kgsl device
+ * @context: kgsl context
+ */
+struct kgsl_sync_timeline {
+	struct kref kref;
+	char name[32];
+
+	u64 fence_context;
+
+	struct list_head child_list_head;
+
+	spinlock_t lock;
+	unsigned int last_timestamp;
+	struct kgsl_device *device;
+	struct kgsl_context *context;
+};
+
+/**
+ * struct kgsl_sync_fence - A struct containing a fence and other data
+ *				associated with it
+ * @fence: The fence struct
+ * @sync_file: Pointer to the sync file
+ * @parent: Pointer to the kgsl sync timeline this fence is on
+ * @child_list: List of fences on the same timeline
+ * @context_id: kgsl context id
+ * @timestamp: Context timestamp that this fence is associated with
+ */
+struct kgsl_sync_fence {
+	struct dma_fence fence;
+	struct sync_file *sync_file;
+	struct kgsl_sync_timeline *parent;
+	struct list_head child_list;
+	u32 context_id;
+	unsigned int timestamp;
+	/** @hw_fence_index: Index of hw fence in hw fence table */
+	u64 hw_fence_index;
+	/** @hw_fence_handle: Handle to the hw fence client */
+	void *hw_fence_handle;
+};
+
+/**
+ * struct kgsl_sync_fence_cb - Used for fence callbacks
+ * fence_cb: Fence callback struct
+ * fence: Pointer to the fence for which the callback is done
+ * priv: Private data for the callback
+ * func: Pointer to the kgsl function to call. This function should return
+ * false if the sync callback is marked for cancellation in a separate thread.
+ */
+struct kgsl_sync_fence_cb {
+	struct dma_fence_cb fence_cb;
+	struct dma_fence *fence;
+	void *priv;
+	bool (*func)(void *priv);
+};
+
+struct kgsl_device_private;
+struct kgsl_drawobj_sync_event;
+struct event_fence_info;
+struct kgsl_process_private;
+struct kgsl_syncsource;
+
+#if defined(CONFIG_SYNC_FILE)
+int kgsl_add_fence_event(struct kgsl_device *device,
+	u32 context_id, u32 timestamp, void __user *data, int len,
+	struct kgsl_device_private *owner);
+
+int kgsl_sync_timeline_create(struct kgsl_context *context);
+
+void kgsl_sync_timeline_detach(struct kgsl_sync_timeline *ktimeline);
+
+void kgsl_sync_timeline_put(struct kgsl_sync_timeline *ktimeline);
+
+struct kgsl_sync_fence_cb *kgsl_sync_fence_async_wait(int fd, bool (*func)(void *priv), void *priv);
+
+void kgsl_get_fence_info(struct kgsl_drawobj_sync_event *event);
+
+void kgsl_sync_fence_async_cancel(struct kgsl_sync_fence_cb *kcb);
+
+long kgsl_ioctl_syncsource_create(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_syncsource_destroy(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_syncsource_create_fence(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+long kgsl_ioctl_syncsource_signal_fence(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data);
+
+void kgsl_syncsource_put(struct kgsl_syncsource *syncsource);
+
+void kgsl_syncsource_process_release_syncsources(
+		struct kgsl_process_private *private);
+
+bool is_kgsl_fence(struct dma_fence *f);
+
+void kgsl_sync_timeline_signal(struct kgsl_sync_timeline *ktimeline,
+		u32 timestamp);
+
+#else
+static inline int kgsl_add_fence_event(struct kgsl_device *device,
+	u32 context_id, u32 timestamp, void __user *data, int len,
+	struct kgsl_device_private *owner)
+{
+	return -EINVAL;
+}
+
+static inline int kgsl_sync_timeline_create(struct kgsl_context *context)
+{
+	context->ktimeline = NULL;
+	return 0;
+}
+
+static inline void kgsl_sync_timeline_detach(struct kgsl_sync_timeline *ktimeline)
+{
+}
+
+static inline void kgsl_sync_timeline_put(struct kgsl_sync_timeline *ktimeline)
+{
+}
+
+
+static inline void kgsl_get_fence_info(struct kgsl_drawobj_sync_event *event)
+{
+}
+
+static inline struct kgsl_sync_fence_cb *kgsl_sync_fence_async_wait(int fd,
+	bool (*func)(void *priv), void *priv);
+{
+	return NULL;
+}
+
+static inline void
+kgsl_sync_fence_async_cancel(struct kgsl_sync_fence_cb *kcb)
+{
+}
+
+static inline long
+kgsl_ioctl_syncsource_create(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	return -ENOIOCTLCMD;
+}
+
+static inline long
+kgsl_ioctl_syncsource_destroy(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	return -ENOIOCTLCMD;
+}
+
+static inline long
+kgsl_ioctl_syncsource_create_fence(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	return -ENOIOCTLCMD;
+}
+
+static inline long
+kgsl_ioctl_syncsource_signal_fence(struct kgsl_device_private *dev_priv,
+					unsigned int cmd, void *data)
+{
+	return -ENOIOCTLCMD;
+}
+
+static inline void kgsl_syncsource_put(struct kgsl_syncsource *syncsource)
+{
+
+}
+
+static inline void kgsl_syncsource_process_release_syncsources(
+		struct kgsl_process_private *private)
+{
+
+}
+
+bool is_kgsl_fence(struct dma_fence *f)
+{
+
+}
+
+void kgsl_sync_timeline_signal(struct kgsl_sync_timeline *ktimeline,
+		u32 timestamp)
+{
+
+}
+
+#endif /* CONFIG_SYNC_FILE */
+
+#endif /* __KGSL_SYNC_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_sysfs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_sysfs.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ */
+#ifndef _KGSL_SYSFS_H_
+#define _KGSL_SYSFS_H_
+
+struct kgsl_device;
+
+/**
+ * struct kgsl_gpu_sysfs_attr - Attribute definition for sysfs objects in the
+ * /sys/kernel/gpu kobject
+ */
+struct kgsl_gpu_sysfs_attr {
+	/** @attr: Attribute for the sysfs node */
+	struct attribute attr;
+	/** @show: Show function for the node */
+	ssize_t (*show)(struct kgsl_device *device, char *buf);
+	/** @store: Store function for the node */
+	ssize_t (*store)(struct kgsl_device *device, const char *buf,
+			size_t count);
+};
+
+#define GPU_SYSFS_ATTR(_name, _mode, _show, _store)		\
+const struct kgsl_gpu_sysfs_attr gpu_sysfs_attr_##_name = {		\
+	.attr = { .name = __stringify(_name), .mode = _mode },	\
+	.show = _show,						\
+	.store = _store,					\
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_timeline.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_timeline.c
@@ -0,0 +1,622 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/dma-fence.h>
+#include <linux/file.h>
+#include <linux/list.h>
+#include <linux/kref.h>
+#include <linux/sync_file.h>
+
+#include "kgsl_device.h"
+#include "kgsl_eventlog.h"
+#include "kgsl_sharedmem.h"
+#include "kgsl_timeline.h"
+#include "kgsl_trace.h"
+
+struct kgsl_timeline_fence {
+	struct dma_fence base;
+	struct kgsl_timeline *timeline;
+	struct list_head node;
+};
+
+struct dma_fence *kgsl_timelines_to_fence_array(struct kgsl_device *device,
+		u64 timelines, u32 count, u64 usize, bool any)
+{
+	void __user *uptr = u64_to_user_ptr(timelines);
+	struct dma_fence_array *array;
+	struct dma_fence **fences;
+	int i, ret = 0;
+
+	if (!count || count > INT_MAX)
+		return ERR_PTR(-EINVAL);
+
+	fences = kcalloc(count, sizeof(*fences),
+		GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
+
+	if (!fences)
+		return ERR_PTR(-ENOMEM);
+
+	for (i = 0; i < count; i++) {
+		struct kgsl_timeline_val val;
+		struct kgsl_timeline *timeline;
+
+		if (copy_struct_from_user(&val, sizeof(val), uptr, usize)) {
+			ret = -EFAULT;
+			goto err;
+		}
+
+		if (val.padding) {
+			ret = -EINVAL;
+			goto err;
+		}
+
+		timeline = kgsl_timeline_by_id(device, val.timeline);
+		if (!timeline) {
+			ret = -ENOENT;
+			goto err;
+		}
+
+		fences[i] = kgsl_timeline_fence_alloc(timeline, val.seqno);
+		kgsl_timeline_put(timeline);
+
+		if (IS_ERR(fences[i])) {
+			ret = PTR_ERR(fences[i]);
+			goto err;
+		}
+
+		uptr += usize;
+	}
+
+	/* No need for a fence array for only one fence */
+	if (count == 1) {
+		struct dma_fence *fence = fences[0];
+
+		kfree(fences);
+		return fence;
+	}
+
+	array = dma_fence_array_create(count, fences,
+		dma_fence_context_alloc(1), 0, any);
+
+	if (array)
+		return &array->base;
+
+	ret = -ENOMEM;
+err:
+	for (i = 0; i < count; i++) {
+		if (!IS_ERR_OR_NULL(fences[i]))
+			dma_fence_put(fences[i]);
+	}
+
+	kfree(fences);
+	return ERR_PTR(ret);
+}
+
+void kgsl_timeline_destroy(struct kref *kref)
+{
+	struct kgsl_timeline *timeline = container_of(kref,
+		struct kgsl_timeline, ref);
+
+	WARN_ON(!list_empty(&timeline->fences));
+	WARN_ON(!list_empty(&timeline->events));
+
+	trace_kgsl_timeline_destroy(timeline->id);
+
+	kfree(timeline);
+}
+
+struct kgsl_timeline *kgsl_timeline_get(struct kgsl_timeline *timeline)
+{
+	if (timeline) {
+		if (!kref_get_unless_zero(&timeline->ref))
+			return NULL;
+	}
+
+	return timeline;
+}
+
+static struct kgsl_timeline *kgsl_timeline_alloc(struct kgsl_device_private *dev_priv,
+		u64 initial)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_timeline *timeline;
+	int id;
+
+	timeline = kzalloc(sizeof(*timeline), GFP_KERNEL);
+	if (!timeline)
+		return ERR_PTR(-ENOMEM);
+
+	idr_preload(GFP_KERNEL);
+	spin_lock(&device->timelines_lock);
+	/* Allocate the ID but don't attach the pointer just yet */
+	id = idr_alloc(&device->timelines, NULL, 1, 0, GFP_NOWAIT);
+	spin_unlock(&device->timelines_lock);
+	idr_preload_end();
+
+	if (id < 0) {
+		kfree(timeline);
+		return ERR_PTR(id);
+	}
+
+	timeline->context = dma_fence_context_alloc(1);
+	timeline->id = id;
+	INIT_LIST_HEAD(&timeline->fences);
+	INIT_LIST_HEAD(&timeline->events);
+	timeline->value = initial;
+	timeline->dev_priv = dev_priv;
+
+	snprintf((char *) timeline->name, sizeof(timeline->name),
+		"kgsl-sw-timeline-%d", id);
+
+	trace_kgsl_timeline_alloc(id, initial);
+
+	spin_lock_init(&timeline->lock);
+	spin_lock_init(&timeline->fence_lock);
+
+	kref_init(&timeline->ref);
+
+	return timeline;
+}
+
+static struct kgsl_timeline_fence *to_timeline_fence(struct dma_fence *fence)
+{
+	return container_of(fence, struct kgsl_timeline_fence, base);
+}
+
+static void timeline_fence_release(struct dma_fence *fence)
+{
+	struct kgsl_timeline_fence *f = to_timeline_fence(fence);
+	struct kgsl_timeline *timeline = f->timeline;
+	struct kgsl_timeline_fence *cur, *temp;
+	unsigned long flags;
+
+	spin_lock_irqsave(&timeline->fence_lock, flags);
+
+	/* If the fence is still on the active list, remove it */
+	list_for_each_entry_safe(cur, temp, &timeline->fences, node) {
+		if (f != cur)
+			continue;
+
+		list_del_init(&f->node);
+		break;
+	}
+	spin_unlock_irqrestore(&timeline->fence_lock, flags);
+	trace_kgsl_timeline_fence_release(f->timeline->id, fence->seqno);
+	log_kgsl_timeline_fence_release_event(f->timeline->id, fence->seqno);
+
+	kgsl_timeline_put(f->timeline);
+	dma_fence_free(fence);
+}
+
+static bool timeline_fence_signaled(struct dma_fence *fence)
+{
+	struct kgsl_timeline_fence *f = to_timeline_fence(fence);
+
+	return !__dma_fence_is_later(fence->seqno, f->timeline->value,
+		fence->ops);
+}
+
+static bool timeline_fence_enable_signaling(struct dma_fence *fence)
+{
+	/*
+	 * Return value of false indicates the fence already passed.
+	 * When fence is not passed we return true indicating successful
+	 * enabling.
+	 */
+	return !timeline_fence_signaled(fence);
+}
+
+static const char *timeline_get_driver_name(struct dma_fence *fence)
+{
+	return "kgsl-sw-timeline";
+}
+
+static const char *timeline_get_timeline_name(struct dma_fence *fence)
+{
+	struct kgsl_timeline_fence *f = to_timeline_fence(fence);
+
+	return f->timeline->name;
+}
+
+static void timeline_get_value_str(struct dma_fence *fence,
+		char *str, int size)
+{
+	struct kgsl_timeline_fence *f = to_timeline_fence(fence);
+
+	snprintf(str, size, "%lld", f->timeline->value);
+}
+
+static const struct dma_fence_ops timeline_fence_ops = {
+	.get_driver_name = timeline_get_driver_name,
+	.get_timeline_name = timeline_get_timeline_name,
+	.signaled = timeline_fence_signaled,
+	.release = timeline_fence_release,
+	.enable_signaling = timeline_fence_enable_signaling,
+	.timeline_value_str = timeline_get_value_str,
+	.use_64bit_seqno = true,
+};
+
+static void kgsl_timeline_add_fence(struct kgsl_timeline *timeline,
+		struct kgsl_timeline_fence *fence)
+{
+	struct kgsl_timeline_fence *entry;
+	unsigned long flags;
+
+	spin_lock_irqsave(&timeline->fence_lock, flags);
+	list_for_each_entry(entry, &timeline->fences, node) {
+		if (fence->base.seqno < entry->base.seqno) {
+			list_add_tail(&fence->node, &entry->node);
+			spin_unlock_irqrestore(&timeline->fence_lock, flags);
+			return;
+		}
+	}
+
+	list_add_tail(&fence->node, &timeline->fences);
+	spin_unlock_irqrestore(&timeline->fence_lock, flags);
+}
+
+void kgsl_timeline_add_signal(struct kgsl_timeline_event *signal)
+{
+	struct kgsl_timeline *timeline = signal->timeline;
+	struct kgsl_timeline_event *event;
+	unsigned long flags;
+
+	spin_lock_irqsave(&timeline->lock, flags);
+
+	/* If we already signaled this seqno don't add it to the list */
+	if (timeline->value >= signal->seqno)
+		goto done;
+
+	/* Keep the list sorted by seqno */
+	list_for_each_entry_reverse(event, &timeline->events, node) {
+		if (event->seqno <= signal->seqno)
+			break;
+	}
+	list_add(&signal->node, &event->node);
+done:
+	spin_unlock_irqrestore(&timeline->lock, flags);
+}
+
+void kgsl_timeline_signal(struct kgsl_timeline *timeline, u64 seqno)
+{
+	struct kgsl_timeline_fence *fence, *tmp;
+	struct kgsl_timeline_event *event, *tmp_event;
+	struct list_head temp;
+
+	INIT_LIST_HEAD(&temp);
+
+	spin_lock_irq(&timeline->lock);
+
+	if (seqno < timeline->value)
+		goto unlock;
+
+	trace_kgsl_timeline_signal(timeline->id, seqno);
+
+	timeline->value = seqno;
+	list_for_each_entry_safe(event, tmp_event, &timeline->events, node) {
+		/* List is sorted by seqno */
+		if (event->seqno > seqno)
+			break;
+
+		/* Remove retired nodes */
+		list_del(&event->node);
+	}
+
+	spin_lock(&timeline->fence_lock);
+	list_for_each_entry_safe(fence, tmp, &timeline->fences, node)
+		if (timeline_fence_signaled(&fence->base) &&
+				kref_get_unless_zero(&fence->base.refcount))
+			list_move(&fence->node, &temp);
+	spin_unlock(&timeline->fence_lock);
+
+	list_for_each_entry_safe(fence, tmp, &temp, node) {
+		dma_fence_signal_locked(&fence->base);
+		dma_fence_put(&fence->base);
+	}
+
+unlock:
+	spin_unlock_irq(&timeline->lock);
+}
+
+struct dma_fence *kgsl_timeline_fence_alloc(struct kgsl_timeline *timeline,
+		u64 seqno)
+{
+	struct kgsl_timeline_fence *fence;
+
+	fence = kzalloc(sizeof(*fence), GFP_KERNEL);
+	if (!fence)
+		return ERR_PTR(-ENOMEM);
+
+	fence->timeline = kgsl_timeline_get(timeline);
+	if (!fence->timeline) {
+		kfree(fence);
+		return ERR_PTR(-ENOENT);
+	}
+
+	dma_fence_init(&fence->base, &timeline_fence_ops,
+		&timeline->lock, timeline->context, seqno);
+
+	INIT_LIST_HEAD(&fence->node);
+
+	/*
+	 * Once fence is checked as not signaled, allow it to be added
+	 * in the list before other thread such as kgsl_timeline_signal
+	 * can get chance to signal.
+	 */
+	spin_lock_irq(&timeline->lock);
+	if (!dma_fence_is_signaled_locked(&fence->base))
+		kgsl_timeline_add_fence(timeline, fence);
+
+	trace_kgsl_timeline_fence_alloc(timeline->id, seqno);
+	spin_unlock_irq(&timeline->lock);
+
+	log_kgsl_timeline_fence_alloc_event(timeline->id, seqno);
+
+	return &fence->base;
+}
+
+long kgsl_ioctl_timeline_create(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_timeline_create *param = data;
+	struct kgsl_timeline *timeline;
+
+	timeline = kgsl_timeline_alloc(dev_priv, param->seqno);
+	if (IS_ERR(timeline))
+		return PTR_ERR(timeline);
+
+	/* Commit the pointer to the timeline in timeline idr */
+	spin_lock(&device->timelines_lock);
+	idr_replace(&device->timelines, timeline, timeline->id);
+	param->id = timeline->id;
+	spin_unlock(&device->timelines_lock);
+	return 0;
+}
+
+struct kgsl_timeline *kgsl_timeline_by_id(struct kgsl_device *device,
+		u32 id)
+{
+	struct kgsl_timeline *timeline;
+	int ret = 0;
+
+	spin_lock(&device->timelines_lock);
+	timeline = idr_find(&device->timelines, id);
+
+	if (timeline)
+		ret = kref_get_unless_zero(&timeline->ref);
+	spin_unlock(&device->timelines_lock);
+
+	return ret ? timeline : NULL;
+}
+
+long kgsl_ioctl_timeline_wait(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_timeline_wait *param = data;
+	struct dma_fence *fence;
+	unsigned long timeout;
+	signed long ret;
+
+	if (param->flags != KGSL_TIMELINE_WAIT_ANY &&
+		param->flags != KGSL_TIMELINE_WAIT_ALL)
+		return -EINVAL;
+
+	if (param->padding)
+		return -EINVAL;
+
+	fence = kgsl_timelines_to_fence_array(device, param->timelines,
+		param->count, param->timelines_size,
+		(param->flags == KGSL_TIMELINE_WAIT_ANY));
+
+	if (IS_ERR(fence))
+		return PTR_ERR(fence);
+
+	if (param->tv_sec >= KTIME_SEC_MAX)
+		timeout = MAX_SCHEDULE_TIMEOUT;
+	else {
+		ktime_t time = ktime_set(param->tv_sec, param->tv_nsec);
+
+		timeout = msecs_to_jiffies(ktime_to_ms(time));
+	}
+
+	trace_kgsl_timeline_wait(param->flags, param->tv_sec, param->tv_nsec);
+
+	/* secs.nsecs to jiffies */
+	if (!timeout)
+		ret = dma_fence_is_signaled(fence) ? 0 : -EBUSY;
+	else {
+		ret = dma_fence_wait_timeout(fence, true, timeout);
+
+		if (!ret)
+			ret = -ETIMEDOUT;
+		else if (ret > 0)
+			ret = 0;
+	}
+
+	dma_fence_put(fence);
+
+	return ret;
+}
+
+long kgsl_ioctl_timeline_query(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_timeline_val *param = data;
+	struct kgsl_timeline *timeline;
+	struct kgsl_timeline_event *event;
+	u64 seqno;
+
+	if (param->padding)
+		return -EINVAL;
+
+	timeline = kgsl_timeline_by_id(dev_priv->device, param->timeline);
+	if (!timeline)
+		return -ENODEV;
+
+	/*
+	 * Start from the end of the list to find the last retired signal event
+	 * that was not yet processed. Leave the entry in the list until the
+	 * timeline signal actually advances the timeline's value. This ensures
+	 * subsequent query ioctls return a monotonically increasing seqno.
+	 */
+	spin_lock_irq(&timeline->lock);
+	seqno = timeline->value;
+	list_for_each_entry_reverse(event, &timeline->events, node) {
+		if (kgsl_check_timestamp(event->context->device,
+			event->context, event->timestamp)) {
+			seqno = event->seqno;
+			break;
+		}
+	}
+	spin_unlock_irq(&timeline->lock);
+
+	param->seqno = seqno;
+	kgsl_timeline_put(timeline);
+
+	return 0;
+}
+
+long kgsl_ioctl_timeline_fence_get(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_timeline_fence_get *param = data;
+	struct kgsl_timeline *timeline;
+	struct sync_file *sync_file;
+	struct dma_fence *fence;
+	int ret = 0, fd;
+
+	timeline = kgsl_timeline_by_id(device, param->timeline);
+	if (!timeline)
+		return -ENODEV;
+
+	fence = kgsl_timeline_fence_alloc(timeline, param->seqno);
+
+	if (IS_ERR(fence)) {
+		kgsl_timeline_put(timeline);
+		return PTR_ERR(fence);
+	}
+
+	fd = get_unused_fd_flags(O_CLOEXEC);
+	if (fd < 0) {
+		ret = fd;
+		goto out;
+	}
+
+	sync_file = sync_file_create(fence);
+	if (sync_file) {
+		fd_install(fd, sync_file->file);
+		param->handle = fd;
+	} else {
+		put_unused_fd(fd);
+		ret = -ENOMEM;
+	}
+
+out:
+	dma_fence_put(fence);
+	kgsl_timeline_put(timeline);
+
+	return ret;
+}
+
+long kgsl_ioctl_timeline_signal(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_timeline_signal *param = data;
+	u64 timelines;
+	int i;
+
+	if (!param->timelines_size) {
+		param->timelines_size = sizeof(struct kgsl_timeline_val);
+		return -EAGAIN;
+	}
+
+	if (!param->count)
+		return -EINVAL;
+
+	timelines = param->timelines;
+
+	for (i = 0; i < param->count; i++) {
+		struct kgsl_timeline *timeline;
+		struct kgsl_timeline_val val;
+
+		if (copy_struct_from_user(&val, sizeof(val),
+			u64_to_user_ptr(timelines), param->timelines_size))
+			return -EFAULT;
+
+		if (val.padding)
+			return -EINVAL;
+
+		timeline = kgsl_timeline_by_id(device, val.timeline);
+		if (!timeline)
+			return -ENODEV;
+
+		kgsl_timeline_signal(timeline, val.seqno);
+
+		kgsl_timeline_put(timeline);
+
+		timelines += param->timelines_size;
+	}
+
+	return 0;
+}
+
+long kgsl_ioctl_timeline_destroy(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_device *device = dev_priv->device;
+	struct kgsl_timeline_fence *fence, *tmp;
+	struct kgsl_timeline *timeline;
+	struct list_head temp;
+	u32 *param = data;
+
+	if (*param == 0)
+		return -ENODEV;
+
+	spin_lock(&device->timelines_lock);
+	timeline = idr_find(&device->timelines, *param);
+
+	if (timeline == NULL) {
+		spin_unlock(&device->timelines_lock);
+		return -ENODEV;
+	}
+
+	/*
+	 * Validate that the id given is owned by the dev_priv
+	 * instance that is passed in. If not, abort.
+	 */
+	if (timeline->dev_priv != dev_priv) {
+		spin_unlock(&device->timelines_lock);
+		return -EINVAL;
+	}
+
+	idr_remove(&device->timelines, timeline->id);
+	spin_unlock(&device->timelines_lock);
+
+	INIT_LIST_HEAD(&temp);
+
+	spin_lock(&timeline->fence_lock);
+	list_for_each_entry_safe(fence, tmp, &timeline->fences, node)
+		if (!kref_get_unless_zero(&fence->base.refcount))
+			list_del_init(&fence->node);
+	list_replace_init(&timeline->fences, &temp);
+	spin_unlock(&timeline->fence_lock);
+
+	spin_lock_irq(&timeline->lock);
+	list_for_each_entry_safe(fence, tmp, &temp, node) {
+		dma_fence_set_error(&fence->base, -ENOENT);
+		dma_fence_signal_locked(&fence->base);
+		dma_fence_put(&fence->base);
+	}
+	spin_unlock_irq(&timeline->lock);
+
+	kgsl_timeline_put(timeline);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_timeline.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_timeline.h
@@ -0,0 +1,142 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __KGSL_TIMELINE_H
+#define __KGSL_TIMELINE_H
+
+/**
+ * struct kgsl_timeline - Container for a timeline object
+ */
+struct kgsl_timeline {
+	/** @context: dma-fence timeline context */
+	u64 context;
+	/** @id: Timeline identifier */
+	int id;
+	/** @value: Current value of the timeline */
+	u64 value;
+	/** @fence_lock: Lock to protect @fences */
+	spinlock_t fence_lock;
+	/** @lock: Lock to use for locking each fence in @fences */
+	spinlock_t lock;
+	/** @ref: Reference count for the struct */
+	struct kref ref;
+	/** @fences: sorted list of active fences */
+	struct list_head fences;
+	/** @events: sorted list of events to be retired */
+	struct list_head events;
+	/** @name: Name of the timeline for debugging */
+	const char name[32];
+	/** @dev_priv: pointer to the owning device instance */
+	struct kgsl_device_private *dev_priv;
+};
+
+/**
+ * struct kgsl_timeline_event - Contains data to signal a timeline
+ */
+struct kgsl_timeline_event {
+	/** @timeline: Pointer to the timeline to signal */
+	struct kgsl_timeline *timeline;
+	/** @seqno: seqno of the timeline to signal */
+	u64 seqno;
+	/** @context: context this event is waiting for */
+	struct kgsl_context *context;
+	/** @timestamp: context timestamp this event is waiting for */
+	unsigned int timestamp;
+	/** @node: list node */
+	struct list_head node;
+};
+
+/**
+ * kgsl_timeline_add_signal - Notify a timeline of an upcoming signal
+ * @signal: Pointer to a kgsl_timeline_event
+ *
+ * Notify the timeline that a GPU AUX command is expected to signal.
+ */
+void kgsl_timeline_add_signal(struct kgsl_timeline_event *signal);
+
+/**
+ * kgsl_timeline_signal - Signal the timeline
+ * @timeline: Pointer to a timeline container
+ * @seqno: Seqeuence number to signal
+ *
+ * Advance @timeline to sequence number @seqno and signal any fences that might
+ * have expired.
+ */
+void kgsl_timeline_signal(struct kgsl_timeline *timeline, u64 seqno);
+
+/**
+ * kgsl_timeline_destroy - Timeline destroy callback
+ * @kref: Refcount pointer for the timeline
+ *
+ * Reference count callback for the timeline called when the all the object
+ * references have been released.
+ */
+void kgsl_timeline_destroy(struct kref *kref);
+
+/**
+ * kgsl_timeline_fence_alloc - Allocate a new fence on a timeline
+ * @timeline: Pointer to a timeline container
+ * @seqno: Sequence number for the new fence to wait for
+ *
+ * Create and return a new fence on the timeline that will expire when the
+ * timeline value is greater or equal to @seqno.
+ * Return: A pointer to the newly created fence
+ */
+struct dma_fence *kgsl_timeline_fence_alloc(struct kgsl_timeline *timeline,
+		u64 seqno);
+
+/**
+ * kgsl_timeline_by_id - Look up a timeline by an id
+ * @device: A KGSL device handle
+ * @id: Lookup identifier
+ *
+ * Find and return the timeline associated with identifer @id.
+ * Return: A pointer to a timeline or PTR_ERR() encoded error on failure.
+ */
+struct kgsl_timeline *kgsl_timeline_by_id(struct kgsl_device *device,
+		u32 id);
+
+/**
+ * kgsl_timeline_get - Get a reference to an existing timeline
+ * @timeline: Pointer to a timeline container
+ *
+ * Get a new reference to the timeline and return the pointer back to the user.
+ * Return: The pointer to the timeline or PTR_ERR encoded error on failure
+ */
+struct kgsl_timeline *kgsl_timeline_get(struct kgsl_timeline *timeline);
+
+/**
+ * kgsl_timeline_put - Release a reference to a timeline
+ * @timeline: Pointer to a timeline container
+ *
+ * Release a reference to a timeline and destroy it if there are no other
+ * references
+ */
+static inline void kgsl_timeline_put(struct kgsl_timeline *timeline)
+{
+	if (!IS_ERR_OR_NULL(timeline))
+		kref_put(&timeline->ref, kgsl_timeline_destroy);
+}
+
+/**
+ * kgsl_timelines_to_fence_array - Return a dma-fence array of timeline fences
+ * @device: A KGSL device handle
+ * @timelines: Userspace pointer to an array of &struct kgsl_timeline_val
+ * @count: Number of entries in @timelines
+ * @usize: Size of each entry in @timelines
+ * @any: True if the fence should expire on any timeline expiring or false if it
+ * should wait until all timelines have expired
+ *
+ * Give a list of &struct kgsl_timeline_val entries, create a dma-fence-array
+ * containing fences for each timeline/seqno pair. If @any is set the
+ * dma-fence-array will be set to expire if any of the encapsulated timeline
+ * fences expire.  If @any is false, then the fence will wait for ALL of the
+ * encapsulated timeline fences to expire.
+ */
+struct dma_fence *kgsl_timelines_to_fence_array(struct kgsl_device *device,
+		u64 timelines, u32 count, u64 usize, bool any);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_trace.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_trace.c
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2011,2013,2015,2019 The Linux Foundation. All rights reserved.
+ */
+
+#include <linux/module.h>
+
+#include "kgsl_device.h"
+
+/* Instantiate tracepoints */
+#define CREATE_TRACE_POINTS
+#include "kgsl_trace.h"
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_trace.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_trace.h
@@ -0,0 +1,1591 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2011-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#if !defined(_KGSL_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _KGSL_TRACE_H
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM kgsl
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE kgsl_trace
+
+#include <linux/tracepoint.h>
+
+#include "kgsl.h"
+#include "kgsl_drawobj.h"
+#include "kgsl_sharedmem.h"
+
+#define show_memtype(type) \
+	__print_symbolic(type, \
+		{ KGSL_MEM_ENTRY_KERNEL, "gpumem" }, \
+		{ KGSL_MEM_ENTRY_USER, "usermem" }, \
+		{ KGSL_MEM_ENTRY_ION, "ion" })
+
+#define show_constraint(type) \
+	__print_symbolic(type, \
+		{ KGSL_CONSTRAINT_NONE, "None" }, \
+		{ KGSL_CONSTRAINT_PWRLEVEL, "Pwrlevel" }, \
+		{ KGSL_CONSTRAINT_L3_NONE, "L3_none" }, \
+		{ KGSL_CONSTRAINT_L3_PWRLEVEL, "L3_pwrlevel" })
+
+struct kgsl_ringbuffer_issueibcmds;
+struct kgsl_device_waittimestamp;
+
+/*
+ * Tracepoint for kgsl issue ib commands
+ */
+TRACE_EVENT(kgsl_issueibcmds,
+
+	TP_PROTO(struct kgsl_device *device,
+			int drawctxt_id,
+			unsigned int numibs,
+			int timestamp,
+			int flags,
+			int result,
+			unsigned int type),
+
+	TP_ARGS(device, drawctxt_id, numibs, timestamp,
+		flags, result, type),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, drawctxt_id)
+		__field(unsigned int, numibs)
+		__field(unsigned int, timestamp)
+		__field(unsigned int, flags)
+		__field(int, result)
+		__field(unsigned int, drawctxt_type)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->drawctxt_id = drawctxt_id;
+		__entry->numibs = numibs;
+		__entry->timestamp = timestamp;
+		__entry->flags = flags;
+		__entry->result = result;
+		__entry->drawctxt_type = type;
+	),
+
+	TP_printk(
+		"d_name=%s ctx=%u ib=0x0 numibs=%u ts=%u flags=%s result=%d type=%s",
+		__get_str(device_name),
+		__entry->drawctxt_id,
+		__entry->numibs,
+		__entry->timestamp,
+		__entry->flags ? __print_flags(__entry->flags, "|",
+						KGSL_DRAWOBJ_FLAGS) : "None",
+		__entry->result,
+		kgsl_context_type(__entry->drawctxt_type)
+	)
+);
+
+/*
+ * Tracepoint for kgsl readtimestamp
+ */
+TRACE_EVENT(kgsl_readtimestamp,
+
+	TP_PROTO(struct kgsl_device *device,
+			unsigned int context_id,
+			unsigned int type,
+			unsigned int timestamp),
+
+	TP_ARGS(device, context_id, type, timestamp),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, context_id)
+		__field(unsigned int, type)
+		__field(unsigned int, timestamp)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->context_id = context_id;
+		__entry->type = type;
+		__entry->timestamp = timestamp;
+	),
+
+	TP_printk(
+		"d_name=%s context_id=%u type=%u ts=%u",
+		__get_str(device_name),
+		__entry->context_id,
+		__entry->type,
+		__entry->timestamp
+	)
+);
+
+/*
+ * Tracepoint for kgsl waittimestamp entry
+ */
+TRACE_EVENT(kgsl_waittimestamp_entry,
+
+	TP_PROTO(struct kgsl_device *device,
+			unsigned int context_id,
+			unsigned int curr_ts,
+			unsigned int wait_ts,
+			unsigned int timeout),
+
+	TP_ARGS(device, context_id, curr_ts, wait_ts, timeout),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, context_id)
+		__field(unsigned int, curr_ts)
+		__field(unsigned int, wait_ts)
+		__field(unsigned int, timeout)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->context_id = context_id;
+		__entry->curr_ts = curr_ts;
+		__entry->wait_ts = wait_ts;
+		__entry->timeout = timeout;
+	),
+
+	TP_printk(
+		"d_name=%s ctx=%u curr_ts=%u ts=%u timeout=%u",
+		__get_str(device_name),
+		__entry->context_id,
+		__entry->curr_ts,
+		__entry->wait_ts,
+		__entry->timeout
+	)
+);
+
+/*
+ * Tracepoint for kgsl waittimestamp exit
+ */
+TRACE_EVENT(kgsl_waittimestamp_exit,
+
+	TP_PROTO(struct kgsl_device *device, unsigned int curr_ts,
+		 int result),
+
+	TP_ARGS(device, curr_ts, result),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, curr_ts)
+		__field(int, result)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->curr_ts = curr_ts;
+		__entry->result = result;
+	),
+
+	TP_printk(
+		"d_name=%s curr_ts=%u result=%d",
+		__get_str(device_name),
+		__entry->curr_ts,
+		__entry->result
+	)
+);
+
+DECLARE_EVENT_CLASS(kgsl_pwr_template,
+	TP_PROTO(struct kgsl_device *device, bool on),
+
+	TP_ARGS(device, on),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(bool, on)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->on = on;
+	),
+
+	TP_printk(
+		"d_name=%s flag=%s",
+		__get_str(device_name),
+		__entry->on ? "on" : "off"
+	)
+);
+
+DEFINE_EVENT(kgsl_pwr_template, kgsl_irq,
+	TP_PROTO(struct kgsl_device *device, bool on),
+	TP_ARGS(device, on)
+);
+
+DEFINE_EVENT(kgsl_pwr_template, kgsl_bus,
+	TP_PROTO(struct kgsl_device *device, bool on),
+	TP_ARGS(device, on)
+);
+
+DEFINE_EVENT(kgsl_pwr_template, kgsl_rail,
+	TP_PROTO(struct kgsl_device *device, bool on),
+	TP_ARGS(device, on)
+);
+
+TRACE_EVENT(kgsl_clk,
+
+	TP_PROTO(struct kgsl_device *device, bool on,
+		unsigned int freq),
+
+	TP_ARGS(device, on, freq),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(bool, on)
+		__field(unsigned int, freq)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->on = on;
+		__entry->freq = freq;
+	),
+
+	TP_printk(
+		"d_name=%s flag=%s active_freq=%d",
+		__get_str(device_name),
+		__entry->on ? "on" : "off",
+		__entry->freq
+	)
+);
+
+TRACE_EVENT(kgsl_gmu_pwrlevel,
+
+	TP_PROTO(unsigned long freq,
+		unsigned long prev_freq),
+
+	TP_ARGS(freq, prev_freq),
+
+	TP_STRUCT__entry(
+		__field(unsigned long, freq)
+		__field(unsigned long, prev_freq)
+	),
+
+	TP_fast_assign(
+		__entry->freq = freq;
+		__entry->prev_freq = prev_freq;
+	),
+
+	TP_printk(
+		"gmu_freq=%ld gmu_prev_freq=%ld",
+		__entry->freq,
+		__entry->prev_freq
+	)
+);
+
+TRACE_EVENT(kgsl_pwrlevel,
+
+	TP_PROTO(struct kgsl_device *device,
+		unsigned int pwrlevel,
+		unsigned int freq,
+		unsigned int prev_pwrlevel,
+		unsigned int prev_freq),
+
+	TP_ARGS(device, pwrlevel, freq, prev_pwrlevel, prev_freq),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, pwrlevel)
+		__field(unsigned int, freq)
+		__field(unsigned int, prev_pwrlevel)
+		__field(unsigned int, prev_freq)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->pwrlevel = pwrlevel;
+		__entry->freq = freq;
+		__entry->prev_pwrlevel = prev_pwrlevel;
+		__entry->prev_freq = prev_freq;
+	),
+
+	TP_printk(
+		"d_name=%s pwrlevel=%d freq=%d prev_pwrlevel=%d prev_freq=%d",
+		__get_str(device_name),
+		__entry->pwrlevel,
+		__entry->freq,
+		__entry->prev_pwrlevel,
+		__entry->prev_freq
+	)
+);
+
+/*
+ * Tracepoint for kgsl gpu_frequency
+ */
+TRACE_EVENT(gpu_frequency,
+	TP_PROTO(unsigned int gpu_freq, unsigned int gpu_id),
+	TP_ARGS(gpu_freq, gpu_id),
+	TP_STRUCT__entry(
+		__field(unsigned int, gpu_freq)
+		__field(unsigned int, gpu_id)
+	),
+	TP_fast_assign(
+		__entry->gpu_freq = gpu_freq;
+		__entry->gpu_id = gpu_id;
+	),
+
+	TP_printk("gpu_freq=%luKhz gpu_id=%lu",
+		(unsigned long)__entry->gpu_freq,
+		(unsigned long)__entry->gpu_id)
+);
+
+TRACE_EVENT(kgsl_buslevel,
+
+	TP_PROTO(struct kgsl_device *device, u32 pwrlevel,
+		 u32 bus, u32 avg_bw),
+
+	TP_ARGS(device, pwrlevel, bus, avg_bw),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(u32, pwrlevel)
+		__field(u32, bus)
+		__field(u32, avg_bw)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->pwrlevel = pwrlevel;
+		__entry->bus = bus;
+		__entry->avg_bw = avg_bw;
+	),
+
+	TP_printk(
+		"d_name=%s pwrlevel=%u bus=%u avg_bw=%u",
+		__get_str(device_name),
+		__entry->pwrlevel,
+		__entry->bus,
+		__entry->avg_bw
+	)
+);
+
+TRACE_EVENT(kgsl_gpubusy,
+	TP_PROTO(struct kgsl_device *device, unsigned int busy,
+		unsigned int elapsed),
+
+	TP_ARGS(device, busy, elapsed),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, busy)
+		__field(unsigned int, elapsed)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->busy = busy;
+		__entry->elapsed = elapsed;
+	),
+
+	TP_printk(
+		"d_name=%s busy=%u elapsed=%d",
+		__get_str(device_name),
+		__entry->busy,
+		__entry->elapsed
+	)
+);
+
+TRACE_EVENT(kgsl_pwrstats,
+	TP_PROTO(struct kgsl_device *device, s64 time,
+		struct kgsl_power_stats *pstats, u32 ctxt_count),
+
+	TP_ARGS(device, time, pstats, ctxt_count),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(s64, total_time)
+		__field(u64, busy_time)
+		__field(u64, ram_time)
+		__field(u64, ram_wait)
+		__field(u32, context_count)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->total_time = time;
+		__entry->busy_time = pstats->busy_time;
+		__entry->ram_time = pstats->ram_time;
+		__entry->ram_wait = pstats->ram_wait;
+		__entry->context_count = ctxt_count;
+	),
+
+	TP_printk(
+		"d_name=%s total=%lld busy=%lld ram_time=%lld ram_wait=%lld context_count=%u",
+		__get_str(device_name), __entry->total_time, __entry->busy_time,
+		__entry->ram_time, __entry->ram_wait, __entry->context_count
+	)
+);
+
+DECLARE_EVENT_CLASS(kgsl_pwrstate_template,
+	TP_PROTO(struct kgsl_device *device, unsigned int state),
+
+	TP_ARGS(device, state),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, state)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->state = state;
+	),
+
+	TP_printk(
+		"d_name=%s state=%s",
+		__get_str(device_name),
+		kgsl_pwrstate_to_str(__entry->state)
+	)
+);
+
+DEFINE_EVENT(kgsl_pwrstate_template, kgsl_pwr_set_state,
+	TP_PROTO(struct kgsl_device *device, unsigned int state),
+	TP_ARGS(device, state)
+);
+
+DEFINE_EVENT(kgsl_pwrstate_template, kgsl_pwr_request_state,
+	TP_PROTO(struct kgsl_device *device, unsigned int state),
+	TP_ARGS(device, state)
+);
+
+TRACE_EVENT(kgsl_mem_alloc,
+
+	TP_PROTO(struct kgsl_mem_entry *mem_entry),
+
+	TP_ARGS(mem_entry),
+
+	TP_STRUCT__entry(
+		__field(uint64_t, gpuaddr)
+		__field(uint64_t, size)
+		__field(unsigned int, tgid)
+		__array(char, usage, 16)
+		__field(unsigned int, id)
+		__field(uint64_t, flags)
+	),
+
+	TP_fast_assign(
+		__entry->gpuaddr = mem_entry->memdesc.gpuaddr;
+		__entry->size = mem_entry->memdesc.size;
+		__entry->tgid = pid_nr(mem_entry->priv->pid);
+		kgsl_get_memory_usage(__entry->usage, sizeof(__entry->usage),
+				     mem_entry->memdesc.flags);
+		__entry->id = mem_entry->id;
+		__entry->flags = mem_entry->memdesc.flags;
+	),
+
+	TP_printk(
+		"gpuaddr=0x%llx size=%llu tgid=%u usage=%s id=%u flags=0x%llx",
+		__entry->gpuaddr, __entry->size, __entry->tgid,
+		__entry->usage, __entry->id, __entry->flags
+	)
+);
+
+TRACE_EVENT(kgsl_mem_mmap,
+
+	TP_PROTO(struct kgsl_mem_entry *mem_entry, unsigned long useraddr),
+
+	TP_ARGS(mem_entry, useraddr),
+
+	TP_STRUCT__entry(
+		__field(unsigned long, useraddr)
+		__field(uint64_t, gpuaddr)
+		__field(uint64_t, size)
+		__array(char, usage, 16)
+		__field(unsigned int, id)
+		__field(uint64_t, flags)
+	),
+
+	TP_fast_assign(
+		__entry->useraddr = useraddr;
+		__entry->gpuaddr = mem_entry->memdesc.gpuaddr;
+		__entry->size = mem_entry->memdesc.size;
+		kgsl_get_memory_usage(__entry->usage, sizeof(__entry->usage),
+				     mem_entry->memdesc.flags);
+		__entry->id = mem_entry->id;
+		__entry->flags = mem_entry->memdesc.flags;
+	),
+
+	TP_printk(
+	 "useraddr=0x%lx gpuaddr=0x%llx size=%llu usage=%s id=%u flags=0x%llx",
+		__entry->useraddr, __entry->gpuaddr, __entry->size,
+		__entry->usage, __entry->id, __entry->flags
+	)
+);
+
+TRACE_EVENT(kgsl_mem_unmapped_area_collision,
+
+	TP_PROTO(struct kgsl_mem_entry *mem_entry,
+		 unsigned long addr,
+		 unsigned long len),
+
+	TP_ARGS(mem_entry, addr, len),
+
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned long, addr)
+		__field(unsigned long, len)
+	),
+
+	TP_fast_assign(
+		__entry->id = mem_entry->id;
+		__entry->len = len;
+		__entry->addr = addr;
+	),
+
+	TP_printk(
+		"id=%u len=%lu addr=0x%lx",
+		__entry->id, __entry->len, __entry->addr
+	)
+);
+
+TRACE_EVENT(kgsl_mem_map,
+
+	TP_PROTO(struct kgsl_mem_entry *mem_entry, int fd),
+
+	TP_ARGS(mem_entry, fd),
+
+	TP_STRUCT__entry(
+		__field(uint64_t, gpuaddr)
+		__field(uint64_t, size)
+		__field(int, fd)
+		__field(int, type)
+		__field(unsigned int, tgid)
+		__array(char, usage, 16)
+		__field(unsigned int, id)
+	),
+
+	TP_fast_assign(
+		__entry->gpuaddr = mem_entry->memdesc.gpuaddr;
+		__entry->size = mem_entry->memdesc.size;
+		__entry->fd = fd;
+		__entry->type = kgsl_memdesc_usermem_type(&mem_entry->memdesc);
+		__entry->tgid = pid_nr(mem_entry->priv->pid);
+		kgsl_get_memory_usage(__entry->usage, sizeof(__entry->usage),
+				     mem_entry->memdesc.flags);
+		__entry->id = mem_entry->id;
+	),
+
+	TP_printk(
+		"gpuaddr=0x%llx size=%llu type=%s fd=%d tgid=%u usage=%s id=%u",
+		__entry->gpuaddr, __entry->size,
+		show_memtype(__entry->type),
+		__entry->fd, __entry->tgid,
+		__entry->usage, __entry->id
+	)
+);
+
+TRACE_EVENT(kgsl_mem_free,
+
+	TP_PROTO(struct kgsl_mem_entry *mem_entry),
+
+	TP_ARGS(mem_entry),
+
+	TP_STRUCT__entry(
+		__field(uint64_t, gpuaddr)
+		__field(uint64_t, size)
+		__field(int, type)
+		__field(int, fd)
+		__field(unsigned int, tgid)
+		__array(char, usage, 16)
+		__field(unsigned int, id)
+	),
+
+	TP_fast_assign(
+		__entry->gpuaddr = mem_entry->memdesc.gpuaddr;
+		__entry->size = mem_entry->memdesc.size;
+		__entry->type = kgsl_memdesc_usermem_type(&mem_entry->memdesc);
+		__entry->tgid = pid_nr(mem_entry->priv->pid);
+		kgsl_get_memory_usage(__entry->usage, sizeof(__entry->usage),
+				     mem_entry->memdesc.flags);
+		__entry->id = mem_entry->id;
+	),
+
+	TP_printk(
+		"gpuaddr=0x%llx size=%llu type=%s tgid=%u usage=%s id=%u",
+		__entry->gpuaddr, __entry->size,
+		show_memtype(__entry->type),
+		__entry->tgid, __entry->usage, __entry->id
+	)
+);
+
+TRACE_EVENT(kgsl_mem_sync_cache,
+
+	TP_PROTO(struct kgsl_mem_entry *mem_entry, uint64_t offset,
+		uint64_t length, unsigned int op),
+
+	TP_ARGS(mem_entry, offset, length, op),
+
+	TP_STRUCT__entry(
+		__field(uint64_t, gpuaddr)
+		__array(char, usage, 16)
+		__field(unsigned int, tgid)
+		__field(unsigned int, id)
+		__field(unsigned int, op)
+		__field(uint64_t, offset)
+		__field(uint64_t, length)
+	),
+
+	TP_fast_assign(
+		__entry->gpuaddr = mem_entry->memdesc.gpuaddr;
+		kgsl_get_memory_usage(__entry->usage, sizeof(__entry->usage),
+				     mem_entry->memdesc.flags);
+		__entry->tgid = pid_nr(mem_entry->priv->pid);
+		__entry->id = mem_entry->id;
+		__entry->op = op;
+		__entry->offset = offset;
+		__entry->length = (length == 0) ?
+				mem_entry->memdesc.size : length;
+	),
+
+	TP_printk(
+	 "gpuaddr=0x%llx size=%llu tgid=%u  usage=%s id=%u op=%c%c offset=%llu",
+		__entry->gpuaddr,  __entry->length,
+		__entry->tgid, __entry->usage, __entry->id,
+		(__entry->op & KGSL_GPUMEM_CACHE_CLEAN) ? 'c' : '.',
+		(__entry->op & KGSL_GPUMEM_CACHE_INV) ? 'i' : '.',
+		__entry->offset
+	)
+);
+
+TRACE_EVENT(kgsl_mem_add_bind_range,
+	TP_PROTO(struct kgsl_mem_entry *target, u64 offset,
+		 struct kgsl_mem_entry *child, u64 length),
+
+	TP_ARGS(target, offset, child, length),
+
+	TP_STRUCT__entry(
+		__field(u64, gpuaddr)
+		__field(u32, target)
+		__field(u32, tgid)
+		__field(u32, child)
+		__field(u64, length)
+	),
+
+	TP_fast_assign(
+		__entry->gpuaddr = target->memdesc.gpuaddr + offset;
+		__entry->tgid = pid_nr(target->priv->pid);
+		__entry->target = target->id;
+		__entry->child = child->id;
+		__entry->length = length;
+	),
+
+	TP_printk(
+	"tgid=%u target=%d gpuaddr=%llx length %llu child=%d",
+		__entry->tgid, __entry->target, __entry->gpuaddr,
+		__entry->length, __entry->child
+	)
+);
+
+TRACE_EVENT(kgsl_mem_remove_bind_range,
+	TP_PROTO(struct kgsl_mem_entry *target, u64 offset,
+		 struct kgsl_mem_entry *child, u64 length),
+
+	TP_ARGS(target, offset, child, length),
+
+	TP_STRUCT__entry(
+		__field(u64, gpuaddr)
+		__field(u32, target)
+		__field(u32, tgid)
+		__field(u32, child)
+		__field(u64, length)
+	),
+
+	TP_fast_assign(
+		__entry->gpuaddr = target->memdesc.gpuaddr + offset;
+		__entry->tgid = pid_nr(target->priv->pid);
+		__entry->target = target->id;
+		__entry->child = child->id;
+		__entry->length = length;
+	),
+
+	TP_printk(
+	"tgid=%u target=%d gpuaddr=%llx length %llu child=%d",
+		__entry->tgid, __entry->target, __entry->gpuaddr,
+		__entry->length, __entry->child
+	)
+);
+
+TRACE_EVENT(kgsl_mem_sync_full_cache,
+
+	TP_PROTO(unsigned int num_bufs, uint64_t bulk_size),
+	TP_ARGS(num_bufs, bulk_size),
+
+	TP_STRUCT__entry(
+		__field(unsigned int, num_bufs)
+		__field(uint64_t, bulk_size)
+	),
+
+	TP_fast_assign(
+		__entry->num_bufs = num_bufs;
+		__entry->bulk_size = bulk_size;
+	),
+
+	TP_printk(
+		"num_bufs=%u bulk_size=%llu op=ci",
+		__entry->num_bufs, __entry->bulk_size
+	)
+);
+
+DECLARE_EVENT_CLASS(kgsl_mem_timestamp_template,
+
+	TP_PROTO(struct kgsl_device *device, struct kgsl_mem_entry *mem_entry,
+		unsigned int id, unsigned int curr_ts, unsigned int free_ts),
+
+	TP_ARGS(device, mem_entry, id, curr_ts, free_ts),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(uint64_t, gpuaddr)
+		__field(uint64_t, size)
+		__field(int, type)
+		__array(char, usage, 16)
+		__field(unsigned int, id)
+		__field(unsigned int, drawctxt_id)
+		__field(unsigned int, curr_ts)
+		__field(unsigned int, free_ts)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->gpuaddr = mem_entry->memdesc.gpuaddr;
+		__entry->size = mem_entry->memdesc.size;
+		kgsl_get_memory_usage(__entry->usage, sizeof(__entry->usage),
+				     mem_entry->memdesc.flags);
+		__entry->id = mem_entry->id;
+		__entry->drawctxt_id = id;
+		__entry->type = kgsl_memdesc_usermem_type(&mem_entry->memdesc);
+		__entry->curr_ts = curr_ts;
+		__entry->free_ts = free_ts;
+	),
+
+	TP_printk(
+		"d_name=%s gpuaddr=0x%llx size=%llu type=%s usage=%s id=%u ctx=%u curr_ts=%u free_ts=%u",
+		__get_str(device_name),
+		__entry->gpuaddr,
+		__entry->size,
+		show_memtype(__entry->type),
+		__entry->usage,
+		__entry->id,
+		__entry->drawctxt_id,
+		__entry->curr_ts,
+		__entry->free_ts
+	)
+);
+
+DEFINE_EVENT(kgsl_mem_timestamp_template, kgsl_mem_timestamp_queue,
+	TP_PROTO(struct kgsl_device *device, struct kgsl_mem_entry *mem_entry,
+		unsigned int id, unsigned int curr_ts, unsigned int free_ts),
+	TP_ARGS(device, mem_entry, id, curr_ts, free_ts)
+);
+
+DEFINE_EVENT(kgsl_mem_timestamp_template, kgsl_mem_timestamp_free,
+	TP_PROTO(struct kgsl_device *device, struct kgsl_mem_entry *mem_entry,
+		unsigned int id, unsigned int curr_ts, unsigned int free_ts),
+	TP_ARGS(device, mem_entry, id, curr_ts, free_ts)
+);
+
+TRACE_EVENT(kgsl_context_create,
+
+	TP_PROTO(struct kgsl_device *device, struct kgsl_context *context,
+		 unsigned int flags),
+
+	TP_ARGS(device, context, flags),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, id)
+		__field(unsigned int, flags)
+		__field(unsigned int, priority)
+		__field(unsigned int, type)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->id = context->id;
+		__entry->flags = flags & ~(KGSL_CONTEXT_PRIORITY_MASK |
+						KGSL_CONTEXT_TYPE_MASK);
+		__entry->priority =
+			(flags & KGSL_CONTEXT_PRIORITY_MASK)
+				>> KGSL_CONTEXT_PRIORITY_SHIFT;
+		__entry->type =
+			(flags & KGSL_CONTEXT_TYPE_MASK)
+				>> KGSL_CONTEXT_TYPE_SHIFT;
+	),
+
+	TP_printk(
+		"d_name=%s ctx=%u flags=%s priority=%u type=%s",
+		__get_str(device_name), __entry->id,
+		__entry->flags ? __print_flags(__entry->flags, "|",
+						KGSL_CONTEXT_FLAGS) : "None",
+		__entry->priority,
+		kgsl_context_type(__entry->type)
+	)
+);
+
+TRACE_EVENT(kgsl_context_detach,
+
+	TP_PROTO(struct kgsl_device *device, struct kgsl_context *context),
+
+	TP_ARGS(device, context),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, id)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->id = context->id;
+	),
+
+	TP_printk(
+		"d_name=%s ctx=%u",
+		__get_str(device_name), __entry->id
+	)
+);
+
+TRACE_EVENT(kgsl_context_destroy,
+
+	TP_PROTO(struct kgsl_device *device, struct kgsl_context *context),
+
+	TP_ARGS(device, context),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, id)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->id = context->id;
+	),
+
+	TP_printk(
+		"d_name=%s ctx=%u",
+		__get_str(device_name), __entry->id
+	)
+);
+
+TRACE_EVENT(kgsl_user_pwrlevel_constraint,
+
+	TP_PROTO(struct kgsl_device *device, unsigned int id, unsigned int type,
+		unsigned int sub_type),
+
+	TP_ARGS(device, id, type, sub_type),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, id)
+		__field(unsigned int, type)
+		__field(unsigned int, sub_type)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->id = id;
+		__entry->type = type;
+		__entry->sub_type = sub_type;
+	),
+
+	TP_printk(
+		"d_name=%s ctx=%u constraint_type=%s constraint_subtype=%s",
+		__get_str(device_name), __entry->id,
+		show_constraint(__entry->type),
+		__print_symbolic(__entry->sub_type,
+			{ KGSL_CONSTRAINT_PWR_MIN, "Min" },
+			{ KGSL_CONSTRAINT_PWR_MAX, "Max" })
+	)
+);
+
+TRACE_EVENT(kgsl_constraint,
+
+	TP_PROTO(struct kgsl_device *device, unsigned int type,
+		unsigned int value, unsigned int on),
+
+	TP_ARGS(device, type, value, on),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, type)
+		__field(unsigned int, value)
+		__field(unsigned int, on)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->type = type;
+		__entry->value = value;
+		__entry->on = on;
+	),
+
+	TP_printk(
+		"d_name=%s constraint_type=%s constraint_value=%u status=%s",
+		__get_str(device_name),
+		show_constraint(__entry->type),
+		__entry->value,
+		__entry->on ? "ON" : "OFF"
+	)
+);
+
+TRACE_EVENT(kgsl_mmu_pagefault,
+
+	TP_PROTO(struct kgsl_device *device, unsigned long page,
+		 unsigned int pt, const char *name, const char *op),
+
+	TP_ARGS(device, page, pt, name, op),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned long, page)
+		__field(unsigned int, pt)
+		__string(name, name)
+		__string(op, op)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->page = page;
+		__entry->pt = pt;
+		__assign_str(name, name);
+		__assign_str(op, op);
+	),
+
+	TP_printk(
+		"d_name=%s page=0x%lx pt=%u op=%s name=%s",
+		__get_str(device_name), __entry->page, __entry->pt,
+		__get_str(op), __get_str(name)
+	)
+);
+
+TRACE_EVENT(kgsl_regwrite,
+
+	TP_PROTO(unsigned int offset, unsigned int value),
+
+	TP_ARGS(offset, value),
+
+	TP_STRUCT__entry(
+		__string(device_name, "kgsl-3d0")
+		__field(unsigned int, offset)
+		__field(unsigned int, value)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, "kgsl-3d0");
+		__entry->offset = offset;
+		__entry->value = value;
+	),
+
+	TP_printk(
+		"d_name=%s reg=0x%x value=0x%x",
+		__get_str(device_name), __entry->offset, __entry->value
+	)
+);
+
+TRACE_EVENT(kgsl_register_event,
+		TP_PROTO(unsigned int id, unsigned int timestamp, void *func),
+		TP_ARGS(id, timestamp, func),
+		TP_STRUCT__entry(
+			__field(unsigned int, id)
+			__field(unsigned int, timestamp)
+			__field(void *, func)
+		),
+		TP_fast_assign(
+			__entry->id = id;
+			__entry->timestamp = timestamp;
+			__entry->func = func;
+		),
+		TP_printk(
+			"ctx=%u ts=%u cb=%pS",
+			__entry->id, __entry->timestamp, __entry->func)
+);
+
+TRACE_EVENT(kgsl_fire_event,
+		TP_PROTO(unsigned int id, unsigned int ts,
+			unsigned int type, unsigned int age, void *func),
+		TP_ARGS(id, ts, type, age, func),
+		TP_STRUCT__entry(
+			__field(unsigned int, id)
+			__field(unsigned int, ts)
+			__field(unsigned int, type)
+			__field(unsigned int, age)
+			__field(void *, func)
+		),
+		TP_fast_assign(
+			__entry->id = id;
+			__entry->ts = ts;
+			__entry->type = type;
+			__entry->age = age;
+			__entry->func = func;
+		),
+		TP_printk(
+			"ctx=%u ts=%u type=%s age=%u cb=%pS",
+			__entry->id, __entry->ts,
+			__print_symbolic(__entry->type,
+				{ KGSL_EVENT_RETIRED, "retired" },
+				{ KGSL_EVENT_CANCELLED, "cancelled" }),
+			__entry->age, __entry->func)
+);
+
+TRACE_EVENT(kgsl_active_count,
+
+	TP_PROTO(struct kgsl_device *device, unsigned long ip),
+
+	TP_ARGS(device, ip),
+
+	TP_STRUCT__entry(
+		__string(device_name, device->name)
+		__field(unsigned int, count)
+		__field(unsigned long, ip)
+	),
+
+	TP_fast_assign(
+		__assign_str(device_name, device->name);
+		__entry->count = atomic_read(&device->active_cnt);
+		__entry->ip = ip;
+	),
+
+	TP_printk(
+		"d_name=%s active_cnt=%u func=%ps",
+		__get_str(device_name), __entry->count, (void *) __entry->ip
+	)
+);
+
+TRACE_EVENT(kgsl_pagetable_destroy,
+	TP_PROTO(u64 ptbase, unsigned int name),
+	TP_ARGS(ptbase, name),
+	TP_STRUCT__entry(
+		__field(u64, ptbase)
+		__field(unsigned int, name)
+	),
+	TP_fast_assign(
+		__entry->ptbase = ptbase;
+		__entry->name = name;
+	),
+	TP_printk("ptbase=%llx name=%u", __entry->ptbase, __entry->name)
+);
+
+DECLARE_EVENT_CLASS(syncpoint_timestamp_template,
+	TP_PROTO(struct kgsl_drawobj_sync *syncobj,
+		struct kgsl_context *context,
+		unsigned int timestamp),
+	TP_ARGS(syncobj, context, timestamp),
+	TP_STRUCT__entry(
+		__field(unsigned int, syncobj_context_id)
+		__field(unsigned int, context_id)
+		__field(unsigned int, timestamp)
+	),
+	TP_fast_assign(
+		__entry->syncobj_context_id = syncobj->base.context->id;
+		__entry->context_id = context->id;
+		__entry->timestamp = timestamp;
+	),
+	TP_printk("ctx=%u sync ctx=%u ts=%u",
+		__entry->syncobj_context_id, __entry->context_id,
+		__entry->timestamp)
+);
+
+DEFINE_EVENT(syncpoint_timestamp_template, syncpoint_timestamp,
+	TP_PROTO(struct kgsl_drawobj_sync *syncobj,
+		struct kgsl_context *context,
+		unsigned int timestamp),
+	TP_ARGS(syncobj, context, timestamp)
+);
+
+DEFINE_EVENT(syncpoint_timestamp_template, syncpoint_timestamp_expire,
+	TP_PROTO(struct kgsl_drawobj_sync *syncobj,
+		struct kgsl_context *context,
+		unsigned int timestamp),
+	TP_ARGS(syncobj, context, timestamp)
+);
+
+DECLARE_EVENT_CLASS(syncpoint_fence_template,
+	TP_PROTO(struct kgsl_drawobj_sync *syncobj, char *name),
+	TP_ARGS(syncobj, name),
+	TP_STRUCT__entry(
+		__string(fence_name, name)
+		__field(unsigned int, syncobj_context_id)
+	),
+	TP_fast_assign(
+		__entry->syncobj_context_id = syncobj->base.context->id;
+		__assign_str(fence_name, name);
+	),
+	TP_printk("ctx=%u fence=%s",
+		__entry->syncobj_context_id, __get_str(fence_name))
+);
+
+DEFINE_EVENT(syncpoint_fence_template, syncpoint_fence,
+	TP_PROTO(struct kgsl_drawobj_sync *syncobj, char *name),
+	TP_ARGS(syncobj, name)
+);
+
+DEFINE_EVENT(syncpoint_fence_template, syncpoint_fence_expire,
+	TP_PROTO(struct kgsl_drawobj_sync *syncobj, char *name),
+	TP_ARGS(syncobj, name)
+);
+
+TRACE_EVENT(kgsl_msg,
+	TP_PROTO(const char *msg),
+	TP_ARGS(msg),
+	TP_STRUCT__entry(
+		__string(msg, msg)
+	),
+	TP_fast_assign(
+		__assign_str(msg, msg);
+	),
+	TP_printk(
+		"%s", __get_str(msg)
+	)
+);
+
+TRACE_EVENT(kgsl_clock_throttling,
+	TP_PROTO(
+		int idle_10pct,
+		int crc_50pct,
+		int crc_more50pct,
+		int crc_less50pct,
+		int64_t adj
+	),
+	TP_ARGS(
+		idle_10pct,
+		crc_50pct,
+		crc_more50pct,
+		crc_less50pct,
+		adj
+	),
+	TP_STRUCT__entry(
+		__field(int, idle_10pct)
+		__field(int, crc_50pct)
+		__field(int, crc_more50pct)
+		__field(int, crc_less50pct)
+		__field(int64_t, adj)
+	),
+	TP_fast_assign(
+		__entry->idle_10pct = idle_10pct;
+		__entry->crc_50pct = crc_50pct;
+		__entry->crc_more50pct = crc_more50pct;
+		__entry->crc_less50pct = crc_less50pct;
+		__entry->adj = adj;
+	),
+	TP_printk("idle_10=%d crc_50=%d crc_more50=%d crc_less50=%d adj=%lld",
+		__entry->idle_10pct, __entry->crc_50pct, __entry->crc_more50pct,
+		__entry->crc_less50pct, __entry->adj
+	)
+);
+
+TRACE_EVENT(kgsl_bcl_clock_throttling,
+	TP_PROTO(
+		int crc_25pct,
+		int crc_58pct,
+		int crc_75pct
+	),
+	TP_ARGS(
+		crc_25pct,
+		crc_58pct,
+		crc_75pct
+	),
+	TP_STRUCT__entry(
+		__field(int, crc_25pct)
+		__field(int, crc_58pct)
+		__field(int, crc_75pct)
+	),
+	TP_fast_assign(
+		__entry->crc_25pct = crc_25pct;
+		__entry->crc_58pct = crc_58pct;
+		__entry->crc_75pct = crc_75pct;
+	),
+	TP_printk("crc_25=%d crc_58=%d crc_75=%d",
+		__entry->crc_25pct, __entry->crc_58pct,
+		__entry->crc_75pct
+	)
+);
+
+DECLARE_EVENT_CLASS(gmu_oob_template,
+	TP_PROTO(unsigned int mask),
+	TP_ARGS(mask),
+	TP_STRUCT__entry(
+		__field(unsigned int, mask)
+	),
+	TP_fast_assign(
+		__entry->mask = mask;
+	),
+	TP_printk("mask=0x%08x", __entry->mask)
+);
+
+DEFINE_EVENT(gmu_oob_template, kgsl_gmu_oob_set,
+	TP_PROTO(unsigned int mask),
+	TP_ARGS(mask)
+);
+
+DEFINE_EVENT(gmu_oob_template, kgsl_gmu_oob_clear,
+	TP_PROTO(unsigned int mask),
+	TP_ARGS(mask)
+);
+
+DECLARE_EVENT_CLASS(hfi_msg_template,
+	TP_PROTO(unsigned int id, unsigned int size, unsigned int seqnum),
+	TP_ARGS(id, size, seqnum),
+	TP_STRUCT__entry(
+		__field(unsigned int, id)
+		__field(unsigned int, size)
+		__field(unsigned int, seq)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->size = size;
+		__entry->seq = seqnum;
+	),
+	TP_printk("id=0x%x size=0x%x seqnum=0x%x",
+		__entry->id, __entry->size, __entry->seq)
+);
+
+DEFINE_EVENT(hfi_msg_template, kgsl_hfi_send,
+	TP_PROTO(unsigned int id, unsigned int size, unsigned int seqnum),
+	TP_ARGS(id, size, seqnum)
+);
+
+DEFINE_EVENT(hfi_msg_template, kgsl_hfi_receive,
+	TP_PROTO(unsigned int id, unsigned int size, unsigned int seqnum),
+	TP_ARGS(id, size, seqnum)
+);
+
+TRACE_EVENT(kgsl_timeline_alloc,
+	TP_PROTO(
+		u32 id,
+		u64 seqno
+	),
+	TP_ARGS(
+		id,
+		seqno
+	),
+	TP_STRUCT__entry(
+		__field(u32, id)
+		__field(u64, seqno)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->seqno = seqno;
+	),
+	TP_printk("id=%u initial=%llu",
+		__entry->id, __entry->seqno
+	)
+);
+
+TRACE_EVENT(kgsl_timeline_destroy,
+	TP_PROTO(
+		u32 id
+	),
+	TP_ARGS(
+		id
+	),
+	TP_STRUCT__entry(
+		__field(u32, id)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+	),
+	TP_printk("id=%u",
+		__entry->id
+	)
+);
+
+
+TRACE_EVENT(kgsl_timeline_signal,
+	TP_PROTO(
+		u32 id,
+		u64 seqno
+	),
+	TP_ARGS(
+		id,
+		seqno
+	),
+	TP_STRUCT__entry(
+		__field(u32, id)
+		__field(u64, seqno)
+	),
+	TP_fast_assign(
+		__entry->id = id;
+		__entry->seqno = seqno;
+	),
+	TP_printk("id=%u seqno=%llu",
+		__entry->id, __entry->seqno
+	)
+);
+
+TRACE_EVENT(kgsl_timeline_fence_alloc,
+	TP_PROTO(
+		u32 timeline,
+		u64 seqno
+	),
+	TP_ARGS(
+		timeline,
+		seqno
+	),
+	TP_STRUCT__entry(
+		__field(u32, timeline)
+		__field(u64, seqno)
+	),
+	TP_fast_assign(
+		__entry->timeline = timeline;
+		__entry->seqno = seqno;
+	),
+	TP_printk("timeline=%u seqno=%llu",
+		__entry->timeline, __entry->seqno
+	)
+);
+
+TRACE_EVENT(kgsl_timeline_fence_release,
+	TP_PROTO(
+		u32 timeline,
+		u64 seqno
+	),
+	TP_ARGS(
+		timeline,
+		seqno
+	),
+	TP_STRUCT__entry(
+		__field(u32, timeline)
+		__field(u64, seqno)
+	),
+	TP_fast_assign(
+		__entry->timeline = timeline;
+		__entry->seqno = seqno;
+	),
+	TP_printk("timeline=%u seqno=%llu",
+		__entry->timeline, __entry->seqno
+	)
+);
+
+
+TRACE_EVENT(kgsl_timeline_wait,
+	TP_PROTO(
+		u32 flags,
+		s64 tv_sec,
+		s64 tv_nsec
+	),
+	TP_ARGS(
+		flags,
+		tv_sec,
+		tv_nsec
+	),
+	TP_STRUCT__entry(
+		__field(u32, flags)
+		__field(s64, tv_sec)
+		__field(s64, tv_nsec)
+	),
+	TP_fast_assign(
+		__entry->flags = flags;
+		__entry->tv_sec = tv_sec;
+		__entry->tv_nsec = tv_nsec;
+	),
+	TP_printk("flags=0x%x tv_sec=%llu tv_nsec=%llu",
+		__entry->flags, __entry->tv_sec, __entry->tv_nsec
+
+	)
+);
+
+TRACE_EVENT(kgsl_aux_command,
+	TP_PROTO(u32 drawctxt_id, u32 numcmds, u32 flags, u32 timestamp
+	),
+	TP_ARGS(drawctxt_id, numcmds, flags, timestamp
+	),
+	TP_STRUCT__entry(
+		__field(u32, drawctxt_id)
+		__field(u32, numcmds)
+		__field(u32, flags)
+		__field(u32, timestamp)
+	),
+	TP_fast_assign(
+		__entry->drawctxt_id = drawctxt_id;
+		__entry->numcmds = numcmds;
+		__entry->flags = flags;
+		__entry->timestamp = timestamp;
+	),
+	TP_printk("context=%u numcmds=%u flags=0x%x timestamp=%u",
+		__entry->drawctxt_id, __entry->numcmds, __entry->flags,
+		__entry->timestamp
+	)
+);
+
+TRACE_EVENT(kgsl_drawobj_timeline,
+	TP_PROTO(u32 timeline, u64 seqno
+	),
+	TP_ARGS(timeline, seqno
+	),
+	TP_STRUCT__entry(
+		__field(u32, timeline)
+		__field(u64, seqno)
+	),
+	TP_fast_assign(
+		__entry->timeline = timeline;
+		__entry->seqno = seqno;
+	),
+	TP_printk("timeline=%u seqno=%llu",
+		__entry->timeline, __entry->seqno
+	)
+);
+
+TRACE_EVENT(kgsl_thermal_constraint,
+	TP_PROTO(
+		s32 max_freq
+	),
+	TP_ARGS(
+		max_freq
+	),
+	TP_STRUCT__entry(
+		__field(s32, max_freq)
+	),
+	TP_fast_assign(
+		__entry->max_freq = max_freq;
+	),
+	TP_printk("Thermal max freq=%d",
+		__entry->max_freq
+	)
+);
+
+TRACE_EVENT(kgsl_pool_add_page,
+	TP_PROTO(int order, u32 count),
+	TP_ARGS(order, count),
+	TP_STRUCT__entry(
+		__field(int, order)
+		__field(u32, count)
+	),
+	TP_fast_assign(
+		__entry->order = order;
+		__entry->count = count;
+	),
+	TP_printk("order=%d count=%u",
+		__entry->order, __entry->count
+	)
+);
+
+TRACE_EVENT(kgsl_pool_get_page,
+	TP_PROTO(int order, u32 count),
+	TP_ARGS(order, count),
+	TP_STRUCT__entry(
+		__field(int, order)
+		__field(u32, count)
+	),
+	TP_fast_assign(
+		__entry->order = order;
+		__entry->count = count;
+	),
+	TP_printk("order=%d count=%u",
+		__entry->order, __entry->count
+	)
+);
+
+TRACE_EVENT(kgsl_pool_alloc_page_system,
+	TP_PROTO(int order),
+	TP_ARGS(order),
+	TP_STRUCT__entry(
+		__field(int, order)
+	),
+	TP_fast_assign(
+		__entry->order = order;
+	),
+	TP_printk("order=%d",
+		__entry->order
+	)
+);
+
+TRACE_EVENT(kgsl_pool_try_page_lower,
+	TP_PROTO(int order),
+	TP_ARGS(order),
+	TP_STRUCT__entry(
+		__field(int, order)
+	),
+	TP_fast_assign(
+		__entry->order = order;
+	),
+	TP_printk("order=%d",
+		__entry->order
+	)
+);
+
+TRACE_EVENT(kgsl_pool_free_page,
+	TP_PROTO(int order),
+	TP_ARGS(order),
+	TP_STRUCT__entry(
+		__field(int, order)
+	),
+	TP_fast_assign(
+		__entry->order = order;
+	),
+	TP_printk("order=%d",
+		__entry->order
+	)
+);
+
+TRACE_EVENT(kgsl_reclaim_memdesc,
+	TP_PROTO(
+		struct kgsl_mem_entry *mem_entry,
+		bool swapout
+	),
+
+	TP_ARGS(mem_entry, swapout
+	),
+
+	TP_STRUCT__entry(
+		__field(uint64_t, gpuaddr)
+		__field(uint64_t, size)
+		__field(unsigned int, page_count)
+		__field(unsigned int, tgid)
+		__field(unsigned int, id)
+		__field(uint64_t, flags)
+		__field(bool, swapout)
+	),
+
+	TP_fast_assign(
+		__entry->gpuaddr = mem_entry->memdesc.gpuaddr;
+		__entry->size = mem_entry->memdesc.size;
+		__entry->page_count = mem_entry->memdesc.page_count;
+		__entry->tgid = pid_nr(mem_entry->priv->pid);
+		__entry->id = mem_entry->id;
+		__entry->flags = mem_entry->memdesc.flags;
+		__entry->swapout = swapout;
+	),
+
+	TP_printk(
+		"gpuaddr=0x%llx size=%llu page_count=%u tgid=%u id=%u flags=0x%llx swap=%s",
+		__entry->gpuaddr, __entry->size, __entry->page_count, __entry->tgid,
+		__entry->id, __entry->flags, __entry->swapout ? "out" : "in"
+	)
+);
+
+TRACE_EVENT(kgsl_reclaim_process,
+	TP_PROTO(
+		struct kgsl_process_private *process,
+		u32 swap_count,
+		bool swapout
+	),
+
+	TP_ARGS(process, swap_count, swapout
+	),
+
+	TP_STRUCT__entry(
+		__field(unsigned int, pid)
+		__field(u32, swap_count)
+		__field(u32, unpinned_page_count)
+		__field(bool, swapout)
+	),
+	TP_fast_assign(
+		__entry->pid = pid_nr(process->pid);
+		__entry->swap_count = swap_count;
+		__entry->unpinned_page_count = atomic_read(&process->unpinned_page_count);
+		__entry->swapout = swapout;
+	),
+	TP_printk(
+		"tgid=%u swapped=%u swapped_out_total=%u swap=%s",
+		__entry->pid, __entry->swap_count, __entry->unpinned_page_count,
+		__entry->swapout ? "out" : "in"
+	)
+);
+
+#endif /* _KGSL_TRACE_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_util.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_util.c
@@ -0,0 +1,425 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/firmware.h>
+#include <linux/ktime.h>
+#include <linux/of_address.h>
+#include <linux/pm_domain.h>
+#include <linux/version.h>
+#if (KERNEL_VERSION(6, 3, 0) <= LINUX_VERSION_CODE)
+#include <linux/firmware/qcom/qcom_scm.h>
+#else
+#include <linux/qcom_scm.h>
+#endif
+#ifdef CONFIG_QCOM_KGSL_UPSTREAM
+#include <linux/firmware/qcom/qcom_scm_addon.h>
+#endif
+#include <linux/regulator/consumer.h>
+#include <linux/slab.h>
+#include <linux/soc/qcom/mdt_loader.h>
+#include <linux/string.h>
+
+#include "adreno.h"
+#include "kgsl_util.h"
+
+bool kgsl_genpd_is_enabled(struct device *dev)
+{
+	struct generic_pm_domain *genpd;
+
+	if (IS_ERR_OR_NULL(dev) || IS_ERR_OR_NULL(dev->pm_domain))
+		return false;
+
+	genpd = pd_to_genpd(dev->pm_domain);
+	return (genpd->status == GENPD_STATE_ON);
+}
+
+struct clk *kgsl_of_clk_by_name(struct clk_bulk_data *clks, int count,
+		const char *id)
+{
+	int i;
+
+	for (i = 0; clks && i < count; i++)
+		if (!strcmp(clks[i].id, id))
+			return clks[i].clk;
+
+	return NULL;
+}
+
+int kgsl_regulator_set_voltage(struct device *dev,
+		struct regulator *reg, u32 voltage)
+{
+	int ret;
+
+	if (IS_ERR_OR_NULL(reg))
+		return 0;
+
+	ret = regulator_set_voltage(reg, voltage, INT_MAX);
+	if (ret)
+		dev_err(dev, "Regulator set voltage:%d failed:%d\n", voltage, ret);
+
+	return ret;
+}
+
+int kgsl_clk_set_rate(struct clk_bulk_data *clks, int num_clks,
+		const char *id, unsigned long rate)
+{
+	struct clk *clk;
+
+	clk = kgsl_of_clk_by_name(clks, num_clks, id);
+	if (!clk)
+		return -ENODEV;
+
+	return clk_set_rate(clk, rate);
+}
+
+#if (KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE)
+int kgsl_scm_gpu_init_regs(struct device *dev, u32 gpu_req)
+{
+	int ret;
+
+	if (!gpu_req)
+		return -EOPNOTSUPP;
+
+	ret = qcom_scm_kgsl_init_regs(gpu_req);
+	if (ret)
+		dev_err(dev, "Scm call for requests:0x%x failed with ret:: %d\n",
+									gpu_req, ret);
+
+	return ret;
+}
+#endif
+
+/*
+ * The PASID has stayed consistent across all targets thus far so we are
+ * cautiously optimistic that we can hard code it
+ */
+#define GPU_PASID 13
+
+int kgsl_zap_shader_load(struct device *dev, const char *name)
+{
+	struct device_node *np, *mem_np;
+	const struct firmware *fw;
+	void *mem_region = NULL;
+	phys_addr_t mem_phys;
+	struct resource res;
+	ssize_t mem_size;
+	int ret;
+
+	np = of_get_child_by_name(dev->of_node, "zap-shader");
+	if (!np) {
+		dev_err(dev, "zap-shader node not found. Please update the device tree\n");
+		return -ENODEV;
+	}
+
+	mem_np = of_parse_phandle(np, "memory-region", 0);
+	of_node_put(np);
+	if (!mem_np) {
+		dev_err(dev, "Couldn't parse the mem-region from the zap-shader node\n");
+		return -EINVAL;
+	}
+
+	ret = of_address_to_resource(mem_np, 0, &res);
+	of_node_put(mem_np);
+	if (ret)
+		return ret;
+
+	ret = request_firmware(&fw, name, dev);
+	if (ret) {
+		dev_err(dev, "Couldn't load the firmware %s\n", name);
+		return ret;
+	}
+
+	mem_size = qcom_mdt_get_size(fw);
+	if (mem_size < 0) {
+		ret = mem_size;
+		goto out;
+	}
+
+	if (mem_size > resource_size(&res)) {
+		ret = -E2BIG;
+		goto out;
+	}
+
+	mem_phys = res.start;
+
+	mem_region = memremap(mem_phys, mem_size, MEMREMAP_WC);
+	if (!mem_region) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	ret = qcom_mdt_load(dev, fw, name, GPU_PASID, mem_region,
+		mem_phys, mem_size, NULL);
+	if (ret) {
+		dev_err(dev, "Error %d while loading the MDT\n", ret);
+		goto out;
+	}
+
+	ret = qcom_scm_pas_auth_and_reset(GPU_PASID);
+
+out:
+	if (mem_region)
+		memunmap(mem_region);
+
+	release_firmware(fw);
+	return ret;
+}
+
+int kgsl_zap_shader_unload(struct device *dev)
+{
+	int ret;
+
+	ret = qcom_scm_pas_shutdown_retry(GPU_PASID);
+	if (ret)
+		dev_err(dev, "Error %d while PAS shutdown\n", ret);
+
+	return ret;
+}
+
+int kgsl_hwlock(struct cpu_gpu_lock *lock)
+{
+	unsigned long timeout = jiffies + msecs_to_jiffies(1000);
+
+	/* Indicate that the CPU wants the lock */
+	lock->cpu_req = 1;
+
+	/* post the request */
+	wmb();
+
+	/* Wait for our turn */
+	lock->turn = 0;
+
+	/* Finish all memory transactions before moving on */
+	mb();
+
+	/*
+	 * Spin here while GPU ucode holds the lock, lock->gpu_req will
+	 * be set to 0 after GPU ucode releases the lock. Maximum wait time
+	 * is 1 second and this should be enough for GPU to release the lock.
+	 */
+	while (lock->gpu_req && lock->turn == 0) {
+		cpu_relax();
+		/* Get the latest updates from GPU */
+		rmb();
+
+		if (time_after(jiffies, timeout))
+			break;
+	}
+
+	if (lock->gpu_req && lock->turn == 0)
+		return -EBUSY;
+
+	return 0;
+}
+
+void kgsl_hwunlock(struct cpu_gpu_lock *lock)
+{
+	/* Make sure all writes are done before releasing the lock */
+	wmb();
+	lock->cpu_req = 0;
+}
+
+int get_ddrtype(void)
+{
+	int ret;
+	u64 ddr_type;
+	struct device_node *root_node;
+	struct device_node *mem_node = NULL;
+
+	root_node = of_find_node_by_path("/");
+
+	if (root_node == NULL) {
+		pr_err("kgsl: Unable to find device tree root node\n");
+		return -ENOENT;
+	}
+
+	do {
+		mem_node = of_get_next_child(root_node, mem_node);
+		if (of_node_name_prefix(mem_node, "memory"))
+			break;
+	} while (mem_node != NULL);
+
+	of_node_put(root_node);
+	if (mem_node == NULL) {
+		pr_err("kgsl: Unable to find device tree memory node\n");
+		return -ENOENT;
+	}
+
+	ret = of_property_read_u64(mem_node, "ddr_device_type", &ddr_type);
+
+	of_node_put(mem_node);
+	if (ret < 0) {
+		pr_err("kgsl: ddr_device_type read failed\n");
+		return ret;
+	}
+
+	return ddr_type;
+}
+
+#if IS_ENABLED(CONFIG_QCOM_VA_MINIDUMP)
+#include <soc/qcom/minidump.h>
+
+void kgsl_add_to_minidump(char *name, u64 virt_addr, u64 phy_addr, size_t size)
+{
+	struct md_region md_entry = {0};
+	int ret;
+
+	if (!msm_minidump_enabled())
+		return;
+
+	scnprintf(md_entry.name, sizeof(md_entry.name), name);
+	md_entry.virt_addr = virt_addr;
+	md_entry.phys_addr = phy_addr;
+	md_entry.size = size;
+	ret = msm_minidump_add_region(&md_entry);
+	if (ret < 0 && ret != -EEXIST)
+		pr_err("kgsl: Failed to register %s with minidump:%d\n", name, ret);
+
+}
+
+void kgsl_remove_from_minidump(char *name, u64 virt_addr, u64 phy_addr, size_t size)
+{
+	struct md_region md_entry = {0};
+	int ret;
+
+	if (!msm_minidump_enabled())
+		return;
+
+	scnprintf(md_entry.name, sizeof(md_entry.name), name);
+	md_entry.virt_addr = virt_addr;
+	md_entry.phys_addr = phy_addr;
+	md_entry.size = size;
+	ret = msm_minidump_remove_region(&md_entry);
+	if (ret < 0 && ret != -ENOENT)
+		pr_err("kgsl: Failed to remove %s from minidump\n", name);
+}
+
+int kgsl_add_va_to_minidump(struct device *dev, const char *name, void *ptr,
+		size_t size)
+{
+	struct va_md_entry entry = {0};
+	int ret;
+
+	scnprintf(entry.owner, sizeof(entry.owner), name);
+	entry.vaddr = (u64)(ptr);
+	entry.size = size;
+	ret = qcom_va_md_add_region(&entry);
+	if (ret < 0)
+		dev_err(dev, "Failed to register %s with va_minidump: %d\n", name,
+				ret);
+
+	return ret;
+}
+
+static int kgsl_add_driver_data_to_va_minidump(struct kgsl_device *device)
+{
+	int ret;
+	char name[MAX_VA_MINIDUMP_STR_LEN];
+	struct kgsl_pagetable *pt;
+	struct adreno_context *ctxt;
+	struct kgsl_process_private *p;
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(device);
+
+	ret = kgsl_add_va_to_minidump(device->dev, KGSL_DRIVER,
+			(void *)(&kgsl_driver), sizeof(struct kgsl_driver));
+	if (ret)
+		return ret;
+
+	/* hwsched path may not have scratch entry */
+	if (device->scratch) {
+		ret = kgsl_add_va_to_minidump(device->dev, KGSL_SCRATCH_ENTRY,
+				device->scratch->hostptr, device->scratch->size);
+		if (ret)
+			return ret;
+	}
+
+	ret = kgsl_add_va_to_minidump(device->dev, KGSL_MEMSTORE_ENTRY,
+			device->memstore->hostptr, device->memstore->size);
+	if (ret)
+		return ret;
+
+	spin_lock(&adreno_dev->active_list_lock);
+	list_for_each_entry(ctxt, &adreno_dev->active_list, active_node) {
+		snprintf(name, sizeof(name), KGSL_ADRENO_CTX_ENTRY"_%d", ctxt->base.id);
+		ret = kgsl_add_va_to_minidump(device->dev, name,
+				(void *)(ctxt), sizeof(struct adreno_context));
+		if (ret)
+			break;
+	}
+	spin_unlock(&adreno_dev->active_list_lock);
+
+	read_lock(&kgsl_driver.proclist_lock);
+	list_for_each_entry(p, &kgsl_driver.process_list, list) {
+		snprintf(name, sizeof(name), KGSL_PROC_PRIV_ENTRY "_%d", pid_nr(p->pid));
+		ret = kgsl_add_va_to_minidump(device->dev, name,
+				(void *)(p), sizeof(struct kgsl_process_private));
+		if (ret)
+			break;
+	}
+	read_unlock(&kgsl_driver.proclist_lock);
+
+	spin_lock(&kgsl_driver.ptlock);
+	list_for_each_entry(pt, &kgsl_driver.pagetable_list, list) {
+		snprintf(name, sizeof(name), KGSL_PGTABLE_ENTRY"_%d", pt->name);
+		ret = kgsl_add_va_to_minidump(device->dev, name,
+				(void *)(pt), sizeof(struct kgsl_pagetable));
+		if (ret)
+			break;
+	}
+	spin_unlock(&kgsl_driver.ptlock);
+
+	return ret;
+}
+
+static int kgsl_va_minidump_callback(struct notifier_block *nb,
+		unsigned long action, void *unused)
+{
+	struct adreno_device *adreno_dev = ADRENO_DEVICE(kgsl_driver.devp[0]);
+	const struct adreno_gpudev *gpudev = ADRENO_GPU_DEVICE(adreno_dev);
+
+	if (kgsl_add_driver_data_to_va_minidump(kgsl_driver.devp[0]))
+		return NOTIFY_BAD;
+
+	if (gpudev->add_to_va_minidump(adreno_dev))
+		return NOTIFY_BAD;
+
+	return NOTIFY_OK;
+}
+
+static struct notifier_block kgsl_va_minidump_nb = {
+	.priority = INT_MAX,
+	.notifier_call = kgsl_va_minidump_callback,
+};
+
+void kgsl_qcom_va_md_register(struct kgsl_device *device)
+{
+	int ret;
+
+	if (!qcom_va_md_enabled())
+		return;
+
+	ret = qcom_va_md_register("KGSL", &kgsl_va_minidump_nb);
+	if (ret)
+		dev_err(device->dev, "Failed to register notifier with va_minidump: %d\n", ret);
+}
+
+void kgsl_qcom_va_md_unregister(struct kgsl_device *device)
+{
+	int ret;
+
+	if (!qcom_va_md_enabled())
+		return;
+
+	ret = qcom_va_md_unregister("KGSL", &kgsl_va_minidump_nb);
+	if (ret)
+		dev_err(device->dev, "Failed to unregister notifier with va_minidump: %d\n", ret);
+}
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_util.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_util.h
@@ -0,0 +1,280 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _KGSL_UTIL_H_
+#define _KGSL_UTIL_H_
+
+#include <linux/version.h>
+
+#define KGSL_DRIVER "kgsl_driver"
+#define KGSL_ADRENO_DEVICE "kgsl_adreno_device"
+#define KGSL_A6XX_DEVICE "kgsl_a6xx_device"
+#define KGSL_GEN7_DEVICE "kgsl_gen7_device"
+#define KGSL_HWSCHED_DEVICE "kgsl_hwsched_device"
+
+#define KGSL_SCRATCH_ENTRY "kgsl_scratch"
+#define KGSL_MEMSTORE_ENTRY "kgsl_memstore"
+#define KGSL_GMU_LOG_ENTRY "kgsl_gmu_log"
+#define KGSL_GMU_TRACE_ENTRY "kgsl_gmu_trace"
+#define KGSL_HFIMEM_ENTRY "kgsl_hfi_mem"
+#define KGSL_GMU_DUMPMEM_ENTRY "kgsl_gmu_dump_mem"
+#define KGSL_GMU_RB_ENTRY "kgsl_gmu_rb"
+#define KGSL_GMU_KERNEL_PROF_ENTRY "kgsl_gmu_kernel_profiling"
+#define KGSL_GMU_USER_PROF_ENTRY "kgsl_gmu_user_profiling"
+#define KGSL_GMU_CMD_BUFFER_ENTRY "kgsl_gmu_cmd_buffer"
+#define KGSL_HFI_BIG_IB_ENTRY "kgsl_hfi_big_ib"
+#define KGSL_HFI_BIG_IB_REC_ENTRY "kgsl_hfi_big_ib_rec"
+#define KGSL_ADRENO_CTX_ENTRY "kgsl_adreno_ctx"
+#define KGSL_PROC_PRIV_ENTRY "kgsl_proc_priv"
+#define KGSL_PGTABLE_ENTRY "kgsl_pgtable"
+#define KGSL_GMU_VRB_ENTRY "kgsl_gmu_vrb"
+
+#define MAX_VA_MINIDUMP_STR_LEN 32
+
+
+/**
+ * Request TZ to program set of access controlled registers that KGSL needs
+ * irrespective of any features
+ */
+#define GPU_ALWAYS_EN_REQ BIT(0)
+/**
+ * Request TZ to program BCL id to access controlled register when BCL is
+ * enabled
+ */
+#define GPU_BCL_EN_REQ BIT(1)
+/**
+ * Request TZ to program set of access controlled register for CLX feature
+ * when enabled
+ */
+#define GPU_CLX_EN_REQ BIT(2)
+/**
+ * Request TZ to program tsense ids to access controlled registers for reading
+ * gpu temperature sensors
+ */
+#define GPU_TSENSE_EN_REQ BIT(3)
+
+struct regulator;
+struct clk_bulk_data;
+
+/**
+ * struct cpu_gpu_lock - CP spinlock structure for power up list
+ * @gpu_req: flag value set by CP
+ * @cpu_req: flag value set by KMD
+ * @turn: turn variable set by both CP and KMD
+ * @list_length: this tells CP the last dword in the list:
+ * 16 + (4 * (List_Length - 1))
+ * @list_offset: this tells CP the start of preemption only list:
+ * 16 + (4 * List_Offset)
+ * @ifpc_list_len: number of static ifpc duplets in the list
+ * @preemption_list_len: number of static preemption duplets in the list
+ * @dynamic_list_len: number of dynamically added triplets in the list
+ */
+struct cpu_gpu_lock {
+	u32 gpu_req;
+	u32 cpu_req;
+	u32 turn;
+	union {
+		struct {
+			u16 list_length;
+			u16 list_offset;
+		};
+		struct {
+			u8 ifpc_list_len;
+			u8 preemption_list_len;
+			u16 dynamic_list_len;
+		};
+	};
+};
+
+/**
+ * kgsl_hwlock - Try to get the spinlock
+ * @lock: cpu_gpu_lock structure
+ *
+ * Spin while the GPU has the lock.
+ *
+ * Return: 0 if lock is successful, -EBUSY if timed out waiting for lock
+ */
+int kgsl_hwlock(struct cpu_gpu_lock *lock);
+
+/**
+ * kgsl_hwunlock - Release a previously grabbed lock
+ * @lock: cpu_gpu_lock structure
+ */
+void kgsl_hwunlock(struct cpu_gpu_lock *lock);
+
+/**
+ * kgsl_genpd_is_enabled - Check whether genpd is enabled or not
+ * @dev: Power domain handle
+ *
+ * Return: True if genpd is enabled otherwise false.
+ */
+bool kgsl_genpd_is_enabled(struct device *dev);
+
+/**
+ * kgsl_of_clk_by_name - Return a clock device for a given name
+ * @clks: Pointer to an array of bulk clk data
+ * @count: Number of entries in the array
+ * @id: Name of the clock to search for
+ *
+ * Returns: A pointer to the clock device for the given name or NULL if not
+ * found
+ */
+struct clk *kgsl_of_clk_by_name(struct clk_bulk_data *clks, int count,
+		const char *id);
+/**
+ * kgsl_regulator_set_voltage - Set voltage level for regulator
+ * @dev: A &struct device pointer
+ * @reg: A &struct regulator handle
+ * @voltage: Voltage value to set regulator
+ *
+ * Return: 0 on success and negative error on failure.
+ */
+int kgsl_regulator_set_voltage(struct device *dev,
+		struct regulator *reg, u32 voltage);
+
+/**
+ * kgsl_clk_set_rate - Set a clock to a given rate
+ * @clks: Pointer to an array of bulk clk data
+ * @count: Number of entries in the array
+ * @id: Name of the clock to search for
+ * @rate: Rate to st the clock to
+ *
+ * Return: 0 on success or negative error on failure
+ */
+int kgsl_clk_set_rate(struct clk_bulk_data *clks, int num_clks,
+		const char *id, unsigned long rate);
+
+/**
+ * kgsl_scm_gpu_init_regs - Load secure registers through tz
+ * @dev: Pointer to the GPU platform device
+ * @gpu_req: Bit mask of requests to enable
+ *
+ * Return: 0 on success or negative on failure and EOPNOTSUPP if scm call
+ * not supported
+ */
+#if (KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE)
+int kgsl_scm_gpu_init_regs(struct device *dev, u32 gpu_req);
+#else
+static inline int kgsl_scm_gpu_init_regs(struct device *dev, u32 gpu_req)
+{
+	return -EOPNOTSUPP;
+}
+#endif
+
+/**
+ * kgsl_zap_shader_load - Load a zap shader
+ * @dev: Pointer to the struct device for the GPU platform device
+ * @name: Basename of the zap shader to load (without the postfix)
+ *
+ * Load and install the zap shader named @name. Name should be specified without
+ * the extension for example "a660_zap" instead of "a660_zap.mdt".
+ *
+ * Return: 0 on success or negative on failure
+ */
+int kgsl_zap_shader_load(struct device *dev, const char *name);
+
+/**
+ * kgsl_zap_shader_unload - Unload a zap shader
+ * @dev: Pointer to the struct device for the GPU platform device
+ *
+ * Unload zap_shader and shutdown the peripheral
+ * Return: 0 on success or negative on failure
+ */
+int kgsl_zap_shader_unload(struct device *dev);
+
+#if IS_ENABLED(CONFIG_QCOM_VA_MINIDUMP)
+/**
+ * kgsl_add_to_minidump - Add a physically contiguous section to minidump
+ * @name: Name of the section
+ * @virt_addr: Virtual address of the section
+ * @phy_addr: Physical address of the section
+ * @size: Size of the section
+ */
+void kgsl_add_to_minidump(char *name, u64 virt_addr, u64 phy_addr, size_t size);
+
+/**
+ * kgsl_remove_from_minidump - Remove a contiguous section from minidump
+ * @name: Name of the section
+ * @virt_addr: Virtual address of the section
+ * @phy_addr: Physical address of the section
+ * @size: Size of the section
+ */
+void kgsl_remove_from_minidump(char *name, u64 virt_addr, u64 phy_addr, size_t size);
+
+/**
+ * kgsl_add_va_to_minidump - Add a physically non-contiguous section to minidump
+ * @dev: Pointer to the struct device for the GPU platform device
+ * @name: Name of the section
+ * @ptr: Virtual address of the section
+ * @size: Size of the section
+ */
+int kgsl_add_va_to_minidump(struct device *dev, const char *name, void *ptr,
+		size_t size);
+
+/**
+ * kgsl_qcom_va_md_register - Register driver with va-minidump
+ * @device: Pointer to kgsl device
+ */
+void kgsl_qcom_va_md_register(struct kgsl_device *device);
+
+/**
+ * kgsl_qcom_va_md_unregister - Unregister driver with va-minidump
+ * @device: Pointer to kgsl device
+ */
+void kgsl_qcom_va_md_unregister(struct kgsl_device *device);
+#else
+static inline void kgsl_add_to_minidump(char *name, u64 virt_addr, u64 phy_addr, size_t size)
+{
+}
+
+static inline void kgsl_remove_from_minidump(char *name, u64 virt_addr, u64 phy_addr, size_t size)
+{
+}
+
+static inline int kgsl_add_va_to_minidump(struct device *dev, const char *name, void *ptr,
+               size_t size)
+{
+       return 0;
+}
+
+static inline void kgsl_qcom_va_md_register(struct kgsl_device *device)
+{
+}
+
+static inline void kgsl_qcom_va_md_unregister(struct kgsl_device *device)
+{
+}
+#endif
+
+#ifdef CONFIG_QCOM_KGSL_UPSTREAM
+static inline int qcom_scm_pas_shutdown_retry(u32 peripheral)
+{
+	return -EINVAL;
+}
+
+static inline int qcom_scm_kgsl_set_smmu_lpac_aperture(
+                               unsigned int num_context_bank)
+{
+       return -EINVAL;
+}
+#endif
+
+/**
+ * isdb_write - Program isdb registers to issue break commands to SP
+ * @base: Base address of qdss registers to be programmed
+ * @offset: offset to the SP block
+ */
+void isdb_write(void __iomem *base, u32 offset);
+
+/**
+ * get_ddrtype - Return the type of ddr on the current device
+ *
+ * On match, returns a non-zero positive value which matches the ddr type.
+ * Otherwise returns -ENOENT or negative value on failure.
+ */
+int get_ddrtype(void);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/kgsl_vbo.c
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/kgsl_vbo.c
@@ -0,0 +1,732 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/file.h>
+#include <linux/interval_tree.h>
+#include <linux/seq_file.h>
+#include <linux/sync_file.h>
+#include <linux/slab.h>
+
+#include "kgsl_device.h"
+#include "kgsl_mmu.h"
+#include "kgsl_reclaim.h"
+#include "kgsl_sharedmem.h"
+#include "kgsl_trace.h"
+
+struct kgsl_memdesc_bind_range {
+	struct kgsl_mem_entry *entry;
+	struct interval_tree_node range;
+};
+
+static struct kgsl_memdesc_bind_range *bind_to_range(struct interval_tree_node *node)
+{
+	return container_of(node, struct kgsl_memdesc_bind_range, range);
+}
+
+static struct kgsl_memdesc_bind_range *bind_range_create(u64 start, u64 last,
+		struct kgsl_mem_entry *entry)
+{
+	struct kgsl_memdesc_bind_range *range =
+		kzalloc(sizeof(*range), GFP_KERNEL);
+
+	if (!range)
+		return ERR_PTR(-ENOMEM);
+
+	range->range.start = start;
+	range->range.last = last;
+	range->entry = kgsl_mem_entry_get(entry);
+
+	if (!range->entry) {
+		kfree(range);
+		return ERR_PTR(-EINVAL);
+	}
+
+	atomic_inc(&entry->vbo_count);
+	return range;
+}
+
+static void bind_range_destroy(struct kgsl_memdesc_bind_range *range)
+{
+	struct kgsl_mem_entry *entry = range->entry;
+
+	atomic_dec(&entry->vbo_count);
+	kgsl_mem_entry_put(entry);
+	kfree(range);
+}
+
+static u64 bind_range_len(struct kgsl_memdesc_bind_range *range)
+{
+	return (range->range.last - range->range.start) + 1;
+}
+
+void kgsl_memdesc_print_vbo_ranges(struct kgsl_mem_entry *entry,
+		struct seq_file *s)
+{
+	struct  interval_tree_node *next;
+	struct kgsl_memdesc *memdesc = &entry->memdesc;
+
+	if (!(memdesc->flags & KGSL_MEMFLAGS_VBO))
+		return;
+
+	/*
+	 * We are called in an atomic context so try to get the mutex but if we
+	 * don't then skip this item
+	 */
+	if (!mutex_trylock(&memdesc->ranges_lock))
+		return;
+
+	next = interval_tree_iter_first(&memdesc->ranges, 0, ~0UL);
+	while (next) {
+		struct kgsl_memdesc_bind_range *range = bind_to_range(next);
+
+		seq_printf(s, "%5d %5d 0x%16.16lx-0x%16.16lx\n",
+			entry->id, range->entry->id, range->range.start,
+			range->range.last);
+
+		next = interval_tree_iter_next(next, 0, ~0UL);
+	}
+
+	mutex_unlock(&memdesc->ranges_lock);
+}
+
+static void kgsl_memdesc_remove_range(struct kgsl_mem_entry *target,
+		u64 start, u64 last, struct kgsl_mem_entry *entry)
+{
+	struct  interval_tree_node *node, *next;
+	struct kgsl_memdesc_bind_range *range;
+	struct kgsl_memdesc *memdesc = &target->memdesc;
+
+	mutex_lock(&memdesc->ranges_lock);
+
+	next = interval_tree_iter_first(&memdesc->ranges, start, last);
+	while (next) {
+		node = next;
+		range = bind_to_range(node);
+		next = interval_tree_iter_next(node, start, last);
+
+		/*
+		 * If entry is null, consider it as a special request. Unbind
+		 * the entire range between start and last in this case.
+		 */
+		if (!entry || range->entry->id == entry->id) {
+			if (kgsl_mmu_unmap_range(memdesc->pagetable,
+				memdesc, range->range.start, bind_range_len(range)))
+				continue;
+
+			interval_tree_remove(node, &memdesc->ranges);
+			trace_kgsl_mem_remove_bind_range(target,
+				range->range.start, range->entry,
+				bind_range_len(range));
+
+			if (!(memdesc->flags & KGSL_MEMFLAGS_VBO_NO_MAP_ZERO))
+				kgsl_mmu_map_zero_page_to_range(memdesc->pagetable,
+					memdesc, range->range.start, bind_range_len(range));
+
+			bind_range_destroy(range);
+		}
+	}
+
+	mutex_unlock(&memdesc->ranges_lock);
+}
+
+static int kgsl_memdesc_add_range(struct kgsl_mem_entry *target,
+		u64 start, u64 last, struct kgsl_mem_entry *entry, u64 offset)
+{
+	struct  interval_tree_node *node, *next;
+	struct kgsl_memdesc *memdesc = &target->memdesc;
+	struct kgsl_memdesc_bind_range *range =
+		bind_range_create(start, last, entry);
+	int ret = 0;
+
+	if (IS_ERR(range))
+		return PTR_ERR(range);
+
+	mutex_lock(&memdesc->ranges_lock);
+
+	/*
+	 * If the VBO maps the zero page, then we can unmap the requested range
+	 * in one call. Otherwise we have to figure out what ranges to unmap
+	 * while walking the interval tree.
+	 */
+	if (!(memdesc->flags & KGSL_MEMFLAGS_VBO_NO_MAP_ZERO)) {
+		ret = kgsl_mmu_unmap_range(memdesc->pagetable, memdesc, start,
+			last - start + 1);
+		if (ret)
+			goto error;
+	}
+
+	next = interval_tree_iter_first(&memdesc->ranges, start, last);
+
+	while (next) {
+		struct kgsl_memdesc_bind_range *cur;
+
+		node = next;
+		cur = bind_to_range(node);
+		next = interval_tree_iter_next(node, start, last);
+
+		trace_kgsl_mem_remove_bind_range(target, cur->range.start,
+			cur->entry, bind_range_len(cur));
+
+		interval_tree_remove(node, &memdesc->ranges);
+
+		if (start <= cur->range.start) {
+			if (last >= cur->range.last) {
+				/* Unmap the entire cur range */
+				if (memdesc->flags & KGSL_MEMFLAGS_VBO_NO_MAP_ZERO) {
+					ret = kgsl_mmu_unmap_range(memdesc->pagetable, memdesc,
+						cur->range.start,
+						cur->range.last - cur->range.start + 1);
+					if (ret) {
+						interval_tree_insert(node, &memdesc->ranges);
+						goto error;
+					}
+				}
+
+				bind_range_destroy(cur);
+				continue;
+			}
+
+			/* Unmap the range overlapping cur */
+			if (memdesc->flags & KGSL_MEMFLAGS_VBO_NO_MAP_ZERO) {
+				ret = kgsl_mmu_unmap_range(memdesc->pagetable, memdesc,
+					cur->range.start,
+					last - cur->range.start + 1);
+				if (ret) {
+					interval_tree_insert(node, &memdesc->ranges);
+					goto error;
+				}
+			}
+
+			/* Adjust the start of the mapping */
+			cur->range.start = last + 1;
+			/* And put it back into the tree */
+			interval_tree_insert(node, &memdesc->ranges);
+
+			trace_kgsl_mem_add_bind_range(target,
+				cur->range.start, cur->entry, bind_range_len(cur));
+		} else {
+			if (last < cur->range.last) {
+				struct kgsl_memdesc_bind_range *temp;
+
+				/*
+				 * The range is split into two so make a new
+				 * entry for the far side
+				 */
+				temp = bind_range_create(last + 1, cur->range.last,
+					cur->entry);
+				/* FIXME: Uhoh, this would be bad */
+				BUG_ON(IS_ERR(temp));
+
+				interval_tree_insert(&temp->range,
+					&memdesc->ranges);
+
+				trace_kgsl_mem_add_bind_range(target,
+					temp->range.start,
+					temp->entry, bind_range_len(temp));
+			}
+
+			/* Unmap the range overlapping cur */
+			if (memdesc->flags & KGSL_MEMFLAGS_VBO_NO_MAP_ZERO) {
+				ret = kgsl_mmu_unmap_range(memdesc->pagetable, memdesc,
+					start,
+					min_t(u64, cur->range.last, last) - start + 1);
+				if (ret) {
+					interval_tree_insert(node, &memdesc->ranges);
+					goto error;
+				}
+			}
+
+			cur->range.last = start - 1;
+			interval_tree_insert(node, &memdesc->ranges);
+
+			trace_kgsl_mem_add_bind_range(target, cur->range.start,
+				cur->entry, bind_range_len(cur));
+		}
+	}
+
+	ret = kgsl_mmu_map_child(memdesc->pagetable, memdesc, start,
+			&entry->memdesc, offset, last - start + 1);
+	if (ret)
+		goto error;
+
+	/* Add the new range */
+	interval_tree_insert(&range->range, &memdesc->ranges);
+
+	trace_kgsl_mem_add_bind_range(target, range->range.start,
+		range->entry, bind_range_len(range));
+	mutex_unlock(&memdesc->ranges_lock);
+
+	return ret;
+
+error:
+	bind_range_destroy(range);
+	mutex_unlock(&memdesc->ranges_lock);
+	return ret;
+}
+
+static void kgsl_sharedmem_vbo_put_gpuaddr(struct kgsl_memdesc *memdesc)
+{
+	struct interval_tree_node *node, *next;
+	struct kgsl_memdesc_bind_range *range;
+	int ret = 0;
+	bool unmap_fail;
+
+	/*
+	 * If the VBO maps the zero range then we can unmap the entire
+	 * pagetable region in one call.
+	 */
+	if (!(memdesc->flags & KGSL_MEMFLAGS_VBO_NO_MAP_ZERO))
+		ret = kgsl_mmu_unmap_range(memdesc->pagetable, memdesc,
+			0, memdesc->size);
+
+	unmap_fail = ret;
+
+	/*
+	 * FIXME: do we have a use after free potential here?  We might need to
+	 * lock this and set a "do not update" bit
+	 */
+
+	/* Now delete each range and release the mem entries */
+	next = interval_tree_iter_first(&memdesc->ranges, 0, ~0UL);
+
+	while (next) {
+		node = next;
+		range = bind_to_range(node);
+		next = interval_tree_iter_next(node, 0, ~0UL);
+
+		interval_tree_remove(node, &memdesc->ranges);
+
+		/* Unmap this range */
+		if (memdesc->flags & KGSL_MEMFLAGS_VBO_NO_MAP_ZERO)
+			ret = kgsl_mmu_unmap_range(memdesc->pagetable, memdesc,
+				range->range.start,
+				range->range.last - range->range.start + 1);
+
+		/* Put the child's refcount if unmap succeeds */
+		if (!ret)
+			bind_range_destroy(range);
+		else
+			kfree(range);
+
+		unmap_fail = unmap_fail || ret;
+	}
+
+	if (unmap_fail)
+		return;
+
+	/* Put back the GPU address */
+	kgsl_mmu_put_gpuaddr(memdesc->pagetable, memdesc);
+
+	memdesc->gpuaddr = 0;
+	memdesc->pagetable = NULL;
+}
+
+static struct kgsl_memdesc_ops kgsl_vbo_ops = {
+	.put_gpuaddr = kgsl_sharedmem_vbo_put_gpuaddr,
+};
+
+int kgsl_sharedmem_allocate_vbo(struct kgsl_device *device,
+		struct kgsl_memdesc *memdesc, u64 size, u64 flags)
+{
+	size = PAGE_ALIGN(size);
+
+	/* Make sure that VBOs are supported by the MMU */
+	if (WARN_ON_ONCE(!kgsl_mmu_has_feature(device,
+		KGSL_MMU_SUPPORT_VBO)))
+		return -EOPNOTSUPP;
+
+	kgsl_memdesc_init(device, memdesc, flags);
+	memdesc->priv = 0;
+
+	memdesc->ops = &kgsl_vbo_ops;
+	memdesc->size = size;
+
+	/* Set up the interval tree and lock */
+	memdesc->ranges = RB_ROOT_CACHED;
+	mutex_init(&memdesc->ranges_lock);
+
+	return 0;
+}
+
+static bool kgsl_memdesc_check_range(struct kgsl_memdesc *memdesc,
+		u64 offset, u64 length)
+{
+	return ((offset < memdesc->size) &&
+		(offset + length > offset) &&
+		(offset + length) <= memdesc->size);
+}
+
+static void kgsl_sharedmem_free_bind_op(struct kgsl_sharedmem_bind_op *op)
+{
+	int i;
+
+	if (IS_ERR_OR_NULL(op))
+		return;
+
+	for (i = 0; i < op->nr_ops; i++) {
+		/* Decrement the vbo_count we added when creating the bind_op */
+		if (op->ops[i].entry)
+			atomic_dec(&op->ops[i].entry->vbo_count);
+
+		/* Release the reference on the child entry */
+		kgsl_mem_entry_put_deferred(op->ops[i].entry);
+	}
+
+	/* Release the reference on the target entry */
+	kgsl_mem_entry_put_deferred(op->target);
+
+	kvfree(op->ops);
+	kfree(op);
+}
+
+struct kgsl_sharedmem_bind_op *
+kgsl_sharedmem_create_bind_op(struct kgsl_process_private *private,
+		u32 target_id, void __user *ranges, u32 ranges_nents,
+		u64 ranges_size)
+{
+	struct kgsl_sharedmem_bind_op *op;
+	struct kgsl_mem_entry *target;
+	int ret, i;
+
+	/* There must be at least one defined operation */
+	if (!ranges_nents)
+		return ERR_PTR(-EINVAL);
+
+	/* Find the target memory entry */
+	target = kgsl_sharedmem_find_id(private, target_id);
+	if (!target)
+		return ERR_PTR(-ENOENT);
+
+	if (!(target->memdesc.flags & KGSL_MEMFLAGS_VBO)) {
+		kgsl_mem_entry_put(target);
+		return ERR_PTR(-EINVAL);
+	}
+
+	/* Make a container for the bind operations */
+	op = kzalloc(sizeof(*op), GFP_KERNEL);
+	if (!op) {
+		kgsl_mem_entry_put(target);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	/*
+	 * Make an array for the individual operations.  Use __GFP_NOWARN and
+	 * __GFP_NORETRY to make sure a very large request quietly fails
+	 */
+	op->ops = kvcalloc(ranges_nents, sizeof(*op->ops),
+		GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
+	if (!op->ops) {
+		kfree(op);
+		kgsl_mem_entry_put(target);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	op->nr_ops = ranges_nents;
+	op->target = target;
+
+	/* Make sure process is pinned in memory before proceeding */
+	atomic_inc(&private->cmd_count);
+	ret = kgsl_reclaim_to_pinned_state(private);
+	if (ret)
+		goto err;
+
+	for (i = 0; i < ranges_nents; i++) {
+		struct kgsl_gpumem_bind_range range;
+		struct kgsl_mem_entry *entry;
+		u32 size;
+
+		size = min_t(u32, sizeof(range), ranges_size);
+
+		ret = -EINVAL;
+
+		if (copy_from_user(&range, ranges, size)) {
+			ret = -EFAULT;
+			goto err;
+		}
+
+		/* The offset must be page aligned */
+		if (!PAGE_ALIGNED(range.target_offset))
+			goto err;
+
+		/* The length of the operation must be aligned and non zero */
+		if (!range.length || !PAGE_ALIGNED(range.length))
+			goto err;
+
+		/* Make sure the range fits in the target */
+		if (!kgsl_memdesc_check_range(&target->memdesc,
+			range.target_offset, range.length))
+			goto err;
+
+		/*
+		 * Special case: Consider child id 0 as a special request incase of
+		 * unbind. This helps to unbind the specified range (could span multiple
+		 * child buffers) without supplying backing physical buffer information.
+		 */
+		if (range.child_id == 0 && range.op == KGSL_GPUMEM_RANGE_OP_UNBIND) {
+			op->ops[i].entry = NULL;
+			op->ops[i].start = range.target_offset;
+			op->ops[i].last = range.target_offset + range.length - 1;
+			/* Child offset doesn't matter for unbind. set it to 0 */
+			op->ops[i].child_offset = 0;
+			op->ops[i].op = range.op;
+
+			ranges += ranges_size;
+			continue;
+		}
+
+		/* Get the child object */
+		op->ops[i].entry = kgsl_sharedmem_find_id(private,
+			range.child_id);
+		entry = op->ops[i].entry;
+		if (!entry) {
+			ret = -ENOENT;
+			goto err;
+		}
+
+		/* Keep the child pinned in memory */
+		atomic_inc(&entry->vbo_count);
+
+		/* Make sure the child is not a VBO */
+		if ((entry->memdesc.flags & KGSL_MEMFLAGS_VBO)) {
+			ret = -EINVAL;
+			goto err;
+		}
+
+		/*
+		 * Make sure that only secure children are mapped in secure VBOs
+		 * and vice versa
+		 */
+		if ((target->memdesc.flags & KGSL_MEMFLAGS_SECURE) !=
+		    (entry->memdesc.flags & KGSL_MEMFLAGS_SECURE)) {
+			ret = -EPERM;
+			goto err;
+		}
+
+		/* Make sure the range operation is valid */
+		if (range.op != KGSL_GPUMEM_RANGE_OP_BIND &&
+			range.op != KGSL_GPUMEM_RANGE_OP_UNBIND)
+			goto err;
+
+		if (range.op == KGSL_GPUMEM_RANGE_OP_BIND) {
+			if (!PAGE_ALIGNED(range.child_offset))
+				goto err;
+
+			/* Make sure the range fits in the child */
+			if (!kgsl_memdesc_check_range(&entry->memdesc,
+				range.child_offset, range.length))
+				goto err;
+		} else {
+			/* For unop operations the child offset must be 0 */
+			if (range.child_offset)
+				goto err;
+		}
+
+		op->ops[i].entry = entry;
+		op->ops[i].start = range.target_offset;
+		op->ops[i].last = range.target_offset + range.length - 1;
+		op->ops[i].child_offset = range.child_offset;
+		op->ops[i].op = range.op;
+
+		ranges += ranges_size;
+	}
+
+	atomic_dec(&private->cmd_count);
+	init_completion(&op->comp);
+	kref_init(&op->ref);
+
+	return op;
+
+err:
+	atomic_dec(&private->cmd_count);
+	kgsl_sharedmem_free_bind_op(op);
+	return ERR_PTR(ret);
+}
+
+void kgsl_sharedmem_bind_range_destroy(struct kref *kref)
+{
+	struct kgsl_sharedmem_bind_op *op = container_of(kref,
+		struct kgsl_sharedmem_bind_op, ref);
+
+	kgsl_sharedmem_free_bind_op(op);
+}
+
+static void kgsl_sharedmem_bind_worker(struct work_struct *work)
+{
+	struct kgsl_sharedmem_bind_op *op = container_of(work,
+		struct kgsl_sharedmem_bind_op, work);
+	int i;
+
+	for (i = 0; i < op->nr_ops; i++) {
+		if (op->ops[i].op == KGSL_GPUMEM_RANGE_OP_BIND)
+			kgsl_memdesc_add_range(op->target,
+				op->ops[i].start,
+				op->ops[i].last,
+				op->ops[i].entry,
+				op->ops[i].child_offset);
+		else
+			kgsl_memdesc_remove_range(op->target,
+				op->ops[i].start,
+				op->ops[i].last,
+				op->ops[i].entry);
+	}
+
+	/* Wake up any threads waiting for the bind operation */
+	complete_all(&op->comp);
+
+	if (op->callback)
+		op->callback(op);
+
+	/* Put the refcount we took when scheduling the worker */
+	kgsl_sharedmem_put_bind_op(op);
+}
+
+void kgsl_sharedmem_bind_ranges(struct kgsl_sharedmem_bind_op *op)
+{
+	/* Take a reference to the operation while it is scheduled */
+	kref_get(&op->ref);
+
+	INIT_WORK(&op->work, kgsl_sharedmem_bind_worker);
+	schedule_work(&op->work);
+}
+
+struct kgsl_sharedmem_bind_fence {
+	struct dma_fence base;
+	spinlock_t lock;
+	int fd;
+	struct kgsl_sharedmem_bind_op *op;
+};
+
+static const char *bind_fence_get_driver_name(struct dma_fence *fence)
+{
+	return "kgsl_sharedmem_bind";
+}
+
+static const char *bind_fence_get_timeline_name(struct dma_fence *fence)
+{
+	return "(unbound)";
+}
+
+static void bind_fence_release(struct dma_fence *fence)
+{
+	struct kgsl_sharedmem_bind_fence *bind_fence = container_of(fence,
+		struct kgsl_sharedmem_bind_fence, base);
+
+	kgsl_sharedmem_put_bind_op(bind_fence->op);
+	kfree(bind_fence);
+}
+
+static void
+kgsl_sharedmem_bind_fence_callback(struct kgsl_sharedmem_bind_op *op)
+{
+	struct kgsl_sharedmem_bind_fence *bind_fence = op->data;
+
+	dma_fence_signal(&bind_fence->base);
+	dma_fence_put(&bind_fence->base);
+}
+
+static const struct dma_fence_ops kgsl_sharedmem_bind_fence_ops = {
+	.get_driver_name = bind_fence_get_driver_name,
+	.get_timeline_name = bind_fence_get_timeline_name,
+	.release = bind_fence_release,
+};
+
+static struct kgsl_sharedmem_bind_fence *
+kgsl_sharedmem_bind_fence(struct kgsl_sharedmem_bind_op *op)
+{
+	struct kgsl_sharedmem_bind_fence *fence;
+	struct sync_file *sync_file;
+	int fd;
+
+	fence = kzalloc(sizeof(*fence), GFP_KERNEL);
+	if (!fence)
+		return ERR_PTR(-ENOMEM);
+
+	spin_lock_init(&fence->lock);
+
+	dma_fence_init(&fence->base, &kgsl_sharedmem_bind_fence_ops,
+		&fence->lock, dma_fence_context_alloc(1), 0);
+
+	fd = get_unused_fd_flags(O_CLOEXEC);
+	if (fd < 0) {
+		kfree(fence);
+		return ERR_PTR(fd);
+	}
+
+	sync_file = sync_file_create(&fence->base);
+	if (!sync_file) {
+		put_unused_fd(fd);
+		kfree(fence);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	fd_install(fd, sync_file->file);
+
+	fence->fd = fd;
+	fence->op = op;
+
+	return fence;
+}
+
+long kgsl_ioctl_gpumem_bind_ranges(struct kgsl_device_private *dev_priv,
+		unsigned int cmd, void *data)
+{
+	struct kgsl_process_private *private = dev_priv->process_priv;
+	struct kgsl_gpumem_bind_ranges *param = data;
+	struct kgsl_sharedmem_bind_op *op;
+	int ret;
+
+	/* If ranges_size isn't set, return the expected size to the user */
+	if (!param->ranges_size) {
+		param->ranges_size = sizeof(struct kgsl_gpumem_bind_range);
+		return 0;
+	}
+
+	/* FENCE_OUT only makes sense with ASYNC */
+	if ((param->flags & KGSL_GPUMEM_BIND_FENCE_OUT) &&
+	    !(param->flags & KGSL_GPUMEM_BIND_ASYNC))
+		return -EINVAL;
+
+	op = kgsl_sharedmem_create_bind_op(private, param->id,
+		u64_to_user_ptr(param->ranges), param->ranges_nents,
+		param->ranges_size);
+	if (IS_ERR(op))
+		return PTR_ERR(op);
+
+	if (param->flags & KGSL_GPUMEM_BIND_ASYNC) {
+		struct kgsl_sharedmem_bind_fence *fence;
+
+		if (param->flags & KGSL_GPUMEM_BIND_FENCE_OUT) {
+			fence = kgsl_sharedmem_bind_fence(op);
+
+			if (IS_ERR(fence)) {
+				kgsl_sharedmem_put_bind_op(op);
+				return PTR_ERR(fence);
+			}
+
+			op->data = fence;
+			op->callback = kgsl_sharedmem_bind_fence_callback;
+			param->fence_id = fence->fd;
+		}
+
+		kgsl_sharedmem_bind_ranges(op);
+
+		if (!(param->flags & KGSL_GPUMEM_BIND_FENCE_OUT))
+			kgsl_sharedmem_put_bind_op(op);
+
+		return 0;
+	}
+
+	/*
+	 * Schedule the work. All the resources will be released after
+	 * the bind operation is done
+	 */
+	kgsl_sharedmem_bind_ranges(op);
+
+	ret = wait_for_completion_interruptible(&op->comp);
+	kgsl_sharedmem_put_bind_op(op);
+
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/graphics/msm_adreno_devfreq.h
+++ linux-qcom-6.8.0/ubuntu/qcom/graphics/msm_adreno_devfreq.h
@@ -0,0 +1,112 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef MSM_ADRENO_DEVFREQ_H
+#define MSM_ADRENO_DEVFREQ_H
+
+#include <linux/devfreq.h>
+#include <linux/notifier.h>
+
+/* Flags used to send bus modifier hint from busmon governer to driver */
+#define BUSMON_FLAG_FAST_HINT		BIT(0)
+#define BUSMON_FLAG_SUPER_FAST_HINT	BIT(1)
+#define BUSMON_FLAG_SLOW_HINT		BIT(2)
+
+struct device;
+
+/* same as KGSL_MAX_PWRLEVELS */
+#define MSM_ADRENO_MAX_PWRLEVELS 32
+
+struct xstats {
+	u64 ram_time;
+	u64 ram_wait;
+	int buslevel;
+	unsigned long gpu_minfreq;
+};
+
+struct devfreq_msm_adreno_tz_data {
+	struct notifier_block nb;
+	struct {
+		s64 total_time;
+		s64 busy_time;
+		u32 ctxt_aware_target_pwrlevel;
+		u32 ctxt_aware_busy_penalty;
+	} bin;
+	struct {
+		u64 total_time;
+		u64 ram_time;
+		u64 ram_wait;
+		u64 gpu_time;
+		u32 num;
+		u32 max;
+		u32 width;
+		u32 *up;
+		u32 *down;
+		s32 *p_up;
+		s32 *p_down;
+		u32 *ib_kbps;
+		bool floating;
+	} bus;
+	unsigned int device_id;
+	bool is_64;
+	bool disable_busy_time_burst;
+	bool ctxt_aware_enable;
+	/* Multiplier to change gpu busy status */
+	u32 mod_percent;
+	/* Increase IB vote on high ddr stall */
+	bool avoid_ddr_stall;
+};
+
+struct msm_adreno_extended_profile {
+	struct devfreq_msm_adreno_tz_data *private_data;
+	struct devfreq_dev_profile profile;
+};
+
+struct msm_busmon_extended_profile {
+	u32 flag;
+	u32 sampling_ms;
+	unsigned long percent_ab;
+	unsigned long ab_mbytes;
+	struct devfreq_msm_adreno_tz_data *private_data;
+	struct devfreq_dev_profile profile;
+};
+
+typedef void(*getbw_func)(unsigned long *, unsigned long *, void *);
+
+int devfreq_vbif_update_bw(void);
+void devfreq_vbif_register_callback(getbw_func func, void *data);
+
+int devfreq_gpubw_init(void);
+
+void devfreq_gpubw_exit(void);
+
+int msm_adreno_tz_init(void);
+
+void msm_adreno_tz_exit(void);
+
+int msm_adreno_tz_reinit(struct devfreq *devfreq);
+
+#if defined(CONFIG_QTEE_SHM_BRIDGE)
+#include <linux/qtee_shmbridge.h>
+#else
+struct qtee_shm {
+	phys_addr_t paddr;
+	void *vaddr;
+	size_t size;
+};
+
+static inline bool qtee_shmbridge_is_enabled(void)
+{
+	return false;
+}
+static inline int32_t qtee_shmbridge_allocate_shm(size_t size, struct qtee_shm *shm)
+{
+	return -EINVAL;
+}
+static inline void qtee_shmbridge_free_shm(struct qtee_shm *shm) { }
+#endif
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/LICENSE
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/LICENSE
@@ -0,0 +1,339 @@
+  GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/Makefile
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/Makefile
@@ -0,0 +1,94 @@
+ifeq ($(RELEASE_PACKAGE),1)
+EXTRA_CFLAGS+=-DRELEASE_PACKAGE
+endif
+LBITS := $(shell getconf LONG_BIT)
+ifeq ($(LBITS),64)
+CCFLAGS += -m64
+EXTRA_CFLAGS+=-DSYSTEM_IS_64
+else
+CCFLAGS += -m32
+endif
+
+EXTRA_CFLAGS+=-DTC956X
+EXTRA_CFLAGS+=-DCONFIG_TC956X_PLATFORM_SUPPORT
+
+ifeq ($(TC956X_PCIE_GEN3_SETTING),1)
+EXTRA_CFLAGS+=-DTC956X_PCIE_GEN3_SETTING
+endif
+
+ifeq ($(TC956X_LOAD_FW_HEADER),1)
+EXTRA_CFLAGS+=-DTC956X_LOAD_FW_HEADER
+endif
+
+ifeq ($(TC956X_IOCTL_REG_RD_WR_ENABLE),1)
+EXTRA_CFLAGS+=-DTC956X_IOCTL_REG_RD_WR_ENABLE
+endif
+
+ifeq ($(TC956X_MAGIC_PACKET_WOL_GPIO),1)
+EXTRA_CFLAGS+=-DTC956X_MAGIC_PACKET_WOL_GPIO
+endif
+
+ifeq ($(TC956X_MAGIC_PACKET_WOL_CONF),1)
+EXTRA_CFLAGS+=-DTC956X_MAGIC_PACKET_WOL_CONF
+endif
+
+ifeq ($(TC956X_DMA_OFFLOAD_ENABLE),1)
+EXTRA_CFLAGS+=-DTC956X_DMA_OFFLOAD_ENABLE
+DMA_OFFLOAD = 1
+endif
+
+ifeq ($(vf), 1)
+EXTRA_CFLAGS+=-DTC956X_SRIOV_VF
+
+obj-m := tc956x_vf_pcie_eth.o
+tc956x_vf_pcie_eth-y := tc956xmac_main.o tc956xmac_ethtool.o \
+	      mmc_core.o tc956xmac_hwtstamp.o tc956xmac_ptp.o \
+	      hwif.o  tc956xmac_tc.o dwxgmac2_core.o \
+	      dwxgmac2_descs.o dwxgmac2_dma.o tc956x_pci.o \
+	      tc956x_vf_mbx_wrapper.o tc956x_msigen.o \
+	      tc956x_vf_rsc_mng.o tc956x_vf_mbx.o \
+	      tc956x_pcie_logstat.o tc956x_qcom.o
+	      
+else
+
+EXTRA_CFLAGS+=-DTC956X_SRIOV_PF
+
+obj-m := tc956x_pcie_eth.o
+tc956x_pcie_eth-y := tc956xmac_main.o tc956xmac_ethtool.o tc956xmac_mdio.o \
+	      mmc_core.o tc956xmac_hwtstamp.o tc956xmac_ptp.o tc956x_xpcs.o tc956x_pma.o \
+	      hwif.o  tc956xmac_tc.o dwxgmac2_core.o \
+	      dwxgmac2_descs.o dwxgmac2_dma.o tc956x_pci.o \
+	      tc956x_msigen.o \
+	      tc956x_pcie_logstat.o tc956x_pf_rsc_mng.o \
+	      tc956x_qcom.o
+
+ifeq ($(pf), 1)
+	tc956x_pcie_eth-y += tc956x_pf_mbx_wrapper.o tc956x_pf_rsc_mng.o tc956x_pf_mbx.o
+else ifeq ($(cpe), 1)
+EXTRA_CFLAGS+=-DTC956X_CPE_CONFIG
+else ifeq ($(port_bridge), 1)
+EXTRA_CFLAGS+=-DTC956X_ENABLE_MAC2MAC_BRIDGE
+else 
+EXTRA_CFLAGS+=-DTC956X_AUTOMOTIVE_CONFIG
+endif
+
+ifeq ($(DMA_OFFLOAD), 1)
+	tc956x_pcie_eth-y += tc956x_ipa_intf.o
+endif	 
+
+ifeq ($(TC956XMAC_SELFTESTS), 1)
+	tc956x_pcie_eth-y += tc956xmac_selftests.o
+endif
+#TC956X_Host_Driver-industrial_limited_tested_20241022_V_04-00-01-QPSSW-210.patch
+ccflags-y := -Wmissing-prototypes
+
+endif
+
+modules:
+	$(MAKE) -C $(KERNEL_SRC) M=$(PWD) modules
+
+modules_install:
+	make -C $(KERNEL_SRC) M=$(PWD) modules_install
+
+clean:
+	make -C $(KERNEL_SRC) M=$(PWD) clean
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/Readme.md
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/Readme.md
@@ -0,0 +1,614 @@
+# Toshiba Electronic Devices & Storage Corporation TC956X PCIe Ethernet Host Driver
+Release Date: 29 Mar 2024
+
+Release Version: V_04-00
+
+TC956X PCIe EMAC driver is based on "Fedora 30, kernel-5.4.19", "Fedora 36, kernel-6.1.18" and "Fedora 39, kernel-6.6.1"
+
+# Compilation & Run: Need to be root user to execute the following steps.
+1.  Execute following commands:
+
+    #make clean
+
+    #make
+2.  By default, TC956X_DMA_OFFLOAD_ENABLE is disabled. If IPA offload is needed, execute following commands:
+
+    #make clean
+
+    #make TC956X_DMA_OFFLOAD_ENABLE=1
+
+    To compile driver with load firmware header (fw.h) use the below command
+    #make TC956X_LOAD_FW_HEADER=1 
+
+    In order to compile the Driver to include the code for applying Gen3 setting, execute Make with below argument
+    #make TC956X_PCIE_GEN3_SETTING=1
+	
+	By default code compiles with Automotive configuration, to compile code in CPE configuration use the following with any other arguments that may be needed,
+    #make cpe=1
+
+    Please note, incase both fw.h and Gen3 settings are needed, then both arugments need to be specified.
+	To compile for board RBTC9563_3MA, Enable RBTC9563_3MA MACRO in common.h file.
+
+
+3.	Load phylink module
+
+	#modprobe phylink
+4.  Load the driver
+
+	#insmod tc956x_pcie_eth.ko pcie_link_speed=X
+
+	In the module parameter pcie_link_speed, X is the desired PCIe Gen speed. X can be 3 or 2 or 1.
+	Passing module parameter (pcie_link_speed=X) is optional.
+	If module parameter is not passed, by default Gen3 speed will be selected by the driver.
+
+	Please note that driver should be compiled using below command to use this feature:
+	#make TC956X_PCIE_GEN3_SETTING=1
+5.  Remove the driver
+
+	#rmmod tc956x_pcie_eth
+
+# Note:
+
+1. Use below commands to advertise with Autonegotiation ON for speeds 10Gbps, 5Gbps, 2.5Gbps, 1Gbps, 100Mbps and 10Mbps as ethtool speed command does not support.
+
+    ethtool -s <interface> advertise 0x7000 autoneg on --> changes the advertisement to 10Gbps
+    
+    ethtool -s <interface> advertise 0x1000000006000 autoneg on --> changes the advertisement to 5Gbps
+
+    ethtool -s <interface> advertise 0x800000006000 autoneg on --> changes the advertisement to 2.5Gbps
+
+    ethtool -s <interface> advertise 0x6020 autoneg on --> changes the advertisement to 1Gbps
+
+    ethtool -s <interface> advertise 0x6008 autoneg on --> changes the advertisement to 100Mbps
+
+    ethtool -s <interface> advertise 0x6002 autoneg on --> changes the advertisement 10Mbps
+
+2. Use the below command to insert the kernel module with specific modes for interfaces:
+	
+    #insmod tc956x_pcie_eth.ko mac0_interface=x mac1_interface=y
+
+       argument info:
+	     mac0_interface: For PORT0 interface mode setting
+	     mac1_interface: For PORT1 interface mode setting
+	     x = [0: USXGMII, 1: XFI (default), 2: RGMII (unsupported), 3: SGMII, 4: 2500Base-X]
+	     y = [0: USXGMII, 1: XFI, 2: RGMII, 3: SGMII(default), 4: 2500Base-X]
+  
+    If invalid and unsupported modes are passed as kernel module parameter, the default interface mode will be selected.
+
+3. Regarding the performance, use the below command to increase the dynamic byte queue limit
+
+    $echo "900000" > /sys/devices/pci0000\:00/0000\:00\:01.0/0000\:01\:00.0/0000\:02\:03.0/0000\:05\:00.0/net/enp5s0f0/queues/tx-0/byte_queue_limits/limit_min
+
+    900000 is the random value chosen. It needs to adjust this value on their system and check
+    "0000\:00/0000\:00\:01.0/0000\:01\:00.0/0000\:02\:03.0/0000\:05\:00.0/" value can be obtained from the "lspci -t" command
+
+4. The debug counters to check the interrupt count is available.
+
+    "#ethtool -S <interface>" needs to be executed and sample output is as below
+  
+       total_interrupts: 120109
+       lpi_intr_n: 0
+       pmt_intr_n: 0
+       event_intr_n: 0
+       tx_intr_n: 120000
+       rx_intr_n: 51
+       xpcs_intr_n: 0
+       phy_intr_n: 46
+       sw_msi_n: 12
+
+   tx_intr_n = No of. Tx interrupts originating from eMAC
+   sw_msi_n = No. of SW MSIs triggered by Systick Handler as part of optimized Tx Timer based on Systick approach.
+   So total number of interrupts for Tx = tx_intr_n + sw_msi_n
+   Please note that whenever Rx interruts are generated, the Host ISR will process the Tx completed descriptors too.
+
+5. With V_01-00-07, when IPA API start_channel() is invoked for Rx direction, MAC_Address1_High is updated with 0xBF000000. 
+   This register setting is almost similar to promiscuous mode. So please install appropriate FRP instructions.
+
+6. From V_01-00-08 onwards, Port0 ethernet interface will not be created only if there is no ethernet PHY attached to it
+
+7. Enable TC956X_PHY_INTERRUPT_MODE_EMAC0 macro for supporting PORT0 Interrupt mode. Disable the macro if the phy driver supports only polling mode.
+   Enable TC956X_PHY_INTERRUPT_MODE_EMAC1 macro for supporting PORT1 Interrupt mode. Disable the macro if the phy driver supports only polling mode.
+
+8. Change below macro values for configuration of Link state L0 and L1 transaction delay.
+	/* Link state change delay configuration for Upstream Port */
+	#define USP_L0s_ENTRY_DELAY	(0x1FU)
+	#define USP_L1_ENTRY_DELAY	(0x3FFU)
+
+	/* Link state change delay configuration for Downstream Port-1 */
+	#define DSP1_L0s_ENTRY_DELAY	(0x1FU)
+	#define DSP1_L1_ENTRY_DELAY	(0x3FFU)
+
+	/* Link state change delay configuration for Downstream Port-2 */
+	#define DSP2_L0s_ENTRY_DELAY	(0x1FU)
+	#define DSP2_L1_ENTRY_DELAY	(0x3FFU)
+
+	/* Link state change delay configuration for Virtual Downstream Port */
+	#define VDSP_L0s_ENTRY_DELAY	(0x1FU)
+	#define VDSP_L1_ENTRY_DELAY	(0x3FFU)
+
+	/* Link state change delay configuration for Internal Endpoint */
+	#define EP_L0s_ENTRY_DELAY	(0x1FU)
+	#define EP_L1_ENTRY_DELAY	(0x3FFU)
+
+	Formula:
+		L0 entry delay = XXX_L0s_ENTRY_DELAY * 256 ns
+		L1 entry delay = XXX_L1_ENTRY_DELAY * 256 ns
+		
+		XXX_L0s_ENTRY_DELAY range: 1-31
+		XXX_L1_ENTRY_DELAY: 1-1023
+
+9. To check vlan feature status execute:
+	ethtool -k <interface> | grep vlan
+
+	To enable/disable following vlan features execute:
+		(a) rx-vlan-filter:
+			ethtool -K <interface> rx-vlan-filter <on|off>
+		(b) rx-vlan-offload:
+			ethtool -K <interface> rxvlan <on|off>
+		(c) tx-vlan-offload:
+			ethtool -K <interface> txvlan <on|off>
+
+	Use following to configure VLAN:
+		(a) modprobe 8021q
+		(b) vconfig add <interface> <vlanid>
+		(c) vconfig set_flag <interface>.<vlanid> 1 0
+		(d) ifconfig <interface>.<vlanid> <ip> netmask 255.255.255.0 broadcast <ip mask> up
+
+	Default Configuraton:
+		(a) Rx vlan filter is disabled.
+		(b) Rx valn offload (vlan stripping) is disabled.
+		(c) Tx vlan offload is enabled.
+
+10. Please use the below command to insert the kernel module for passing pause frames to application except pause frames from PHY:
+
+	#insmod tc956x_pcie_eth.ko mac0_filter_phy_pause=x mac1_filter_phy_pause=x
+
+	argument info:
+		mac0_filter_phy_pause: For PORT0
+		mac1_filter_phy_pause: For PORT1
+		x = [0: DISABLE (default), 1: ENABLE]
+
+	If invalid values are passed as kernel module parameter, the default value will be selected.
+
+11. Use below commands to check WOL support and its type:
+	#ethtool <interface>
+
+12. WOL command Usage :
+	#ethtool -s <interface> wol <type - p/g/d>.
+
+	Supported WOL options and meaning:
+	
+	| Option | Meaning |
+	| :-----: | :----: |
+	|  p	  |  Wake on phy activity |
+	|  g	  |  Wake on MagicPacket(tm) |
+	|  d	  |  Disable (wake on nothing). (Default) |
+
+	Example - To wake on phy activity and magic packet use :
+	ethtool -s eth0 wol pg
+
+13. Please use the below command to insert the kernel module to enable EEE and configure LPI Auto Entry timer:
+
+	#insmod tc956x_pcie_eth.ko mac0_eee_enable=X mac0_lpi_timer=Y mac1_eee_enable=X mac1_lpi_timer=Y
+
+	argument info:
+
+		mac0_eee_enable: For PORT0
+		mac1_eee_enable: For PORT1
+		X = [0: DISABLE (default), 1: ENABLE]
+		This module parameter is to Enable/Disable EEE for Port 0/1 - default is 0.
+		If invalid values are passed as kernel module parameter, the default value will be selected.		
+
+		mac0_lpi_timer: For PORT0
+		mac1_lpi_timer: For PORT1
+		Y = [0..1048568 (us)]
+		This module parameter is to configure LPI Automatic Entry Timer for Port 0/1 - default is 600 (us).
+		If invalid values are passed as kernel module parameter, the default value will be selected.		
+
+	In addition to above module parameter, use below ethtool command to configure EEE and LPI auto entry timer.
+	#ethtool --set-eee <interfcae> eee <on/off> tx-timer <time in us>
+	Example: #ethtool --set-eee enp7s0f0 eee on tx-timer 10000
+
+	Use below command to check the status of EEE configuration
+	#ethtool --show-eee <interface>
+
+14. Please use the below command to insert the kernel module for RX Queue size, Flow control thresholds & TX Queue size configuration.
+
+	#insmod tc956x_pcie_eth.ko mac0_rxq0_size=x mac0_rxq0_rfd=y mac0_rxq0_rfa=y
+		mac0_rxq1_size=x mac0_rxq1_rfd=y mac0_rxq1_rfa=y
+		mac0_txq0_size=x mac0_txq1_size=x
+		mac1_rxq0_size=x mac1_rxq0_rfd=y mac1_rxq0_rfa=y
+		mac1_rxq1_size=x mac1_rxq1_rfd=y mac1_rxq1_rfa=y
+		mac1_txq0_size=x mac1_txq1_size=x
+
+	argument info:
+		mac0_rxq0_size: For PORT0 RX Queue-0
+		mac0_rxq1_size: For PORT0 RX Queue-1
+		mac1_rxq0_size: For PORT1 RX Queue-0
+		mac1_rxq1_size: For PORT1 RX Queue-1
+		mac0_txq0_size: For PORT0 TX Queue-0
+		mac0_txq1_size: For PORT0 TX Queue-1
+		mac1_txq0_size: For PORT1 TX Queue-0
+		mac1_txq1_size: For PORT1 TX Queue-1
+		x = [Range Supported : 3072..44032 (bytes)], default is 18432 (bytes)
+
+		mac0_rxq0_rfd: For PORT0 Queue-0 threshold for Disable flow control
+		mac0_rxq1_rfd: For PORT0 Queue-1 threshold for Disable flow control
+		mac0_rxq0_rfa: For PORT0 Queue-0 threshold for Enable flow control
+		mac0_rxq1_rfa: For PORT0 Queue-1 threshold for Enable flow control
+		mac1_rxq0_rfd: For PORT1 Queue-0 threshold for Disable flow control
+		mac1_rxq1_rfd: For PORT1 Queue-1 threshold for Disable flow control
+		mac1_rxq0_rfa: For PORT1 Queue-0 threshold for Enable flow control
+		mac1_rxq1_rfa: For PORT1 Queue-1 threshold for Enable flow control
+		y = [Range Supported : 0..84], default is 24 (13KB)
+
+	If invalid values are passed as kernel module parameter, the default value will be selected for Queue Sizes and for Flow control 80% of Queue size will be used.
+
+	Note:
+	1. Please configure flow control thresholds (RFD & RFA) as per Queue size (Default values are for Default Queue size which is 18KB).
+
+15. Please use the below command to insert the kernel module for counting Link partner pause frames and output to ethtool:
+
+	#insmod tc956x_pcie_eth.ko mac0_en_lp_pause_frame_cnt=x mac1_en_lp_pause_frame_cnt=x
+
+	argument info:
+		mac0_en_lp_pause_frame_cnt: For PORT0
+		mac1_en_lp_pause_frame_cnt: For PORT1
+		x = [0: DISABLE (default), 1: ENABLE]
+
+	If invalid values are passed as kernel module parameter, the default value will be selected.
+	Note: It is required to enable kernel module parameter "mac0_filter_phy_pause/mac1_filter_phy_pause" along with this module parameter to count link partner pause frames.
+
+16. Please use the below command to insert the kernel module for power saving at Link Down state:
+
+	#insmod tc956x_pcie_eth.ko mac_power_save_at_link_down=x
+
+	argument info:
+		mac_power_save_at_link_down: Common for both PORT0 & PORT1
+		x = [0: DISABLE (default), 1: ENABLE]
+
+	If invalid values are passed as kernel module parameter, the default value will be selected.
+
+17. Debufs directory will be created for port specific in debug path of kernel i.e. "/sys/kernel/debug" in x86 Linux platfrom.
+    Under port specific debugfs directory (tc956x_port0_debug/tc956x_port1_debug), module specific files are created to get dump of debug information related to module.
+	Example: 
+	config_stats	--> Registers related to CONFIG module
+	mac_stats	--> Registers related to MAC block
+	mtl_stats	--> Registers related to MTL block
+	dma_stats	--> Registers related to DMA block
+	m3_stats	--> Debug information related to M3 Firmware
+	interrupt_stats	--> Registers related to MSI & INT blocks
+	other_stats	--> Information related to Driver & Firmware, TAMAP, Flexible Receiver Parser, mmc counters
+	reg_dump	--> Dumps all registers of MAC, MTL, DMA and CNFG modules
+    
+    Information will be printed to "dmesg" console, when files related to specific module are invoked.
+    
+    debugfs file can be invoked by using "cat" command.
+	Example:
+	cat /sys/kernel/debug/tc956x_port0_debug/config_stats
+
+18. Use the below command to insert the kernel module for SW reset during link down.
+
+	#insmod tc956x_pcie_eth.ko mac0_link_down_macrst=x mac1_link_down_macrst=y
+
+	argument info:
+		mac0_link_down_macrst: For PORT0
+		x = [0: DISABLE, 1: ENABLE (default)]
+		mac1_link_down_macrst: For PORT1
+		y = [0: DISABLE (default), 1: ENABLE]
+
+	If invalid values are passed as kernel module parameter, the default value will be selected.
+
+19. Uncomment TC956X_WITHOUT_MDIO_WITHOUT_PHY macro in tc956xmac_inc.h file to disable mdio and remove PHY dependency.
+	//#define TC956X_WITHOUT_MDIO_WITHOUT_PHY
+
+# Release Versions:
+
+## TC956X_Host_Driver_20210326_V_01-00:
+
+1. Initial Version
+
+## TC956X_Host_Driver_20210705_V_01-00-01:
+
+1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+2. XFI interface supported and added module parameters for selection of Port0 and Port1 interface
+3. kernel_read API replaced with kernel_read_file_from_path API
+4. sprintf, vsprintf APIs replaced with vcnsprintf or vcnsprintf APIs
+5. API to print IPA DMA channel statistics supported
+6. Correction of print statement about selection of C45 PHY for Port0 interface
+
+## TC956X_Host_Driver_20210705_V_01-00-02:
+
+1. XFI interface supported through compile time macro.
+2. Removed module parameters for selection of Port0 and Port1 interface
+3. Debugfs support for IPA statistics
+
+## TC956X_Host_Driver_20210720_V_01-00-03:
+
+1. Debugfs not supported for IPA statistics
+2. Default Port1 interface selected as SGMII
+
+## TC956X_Host_Driver_20210722_V_01-00-04:
+
+1. Module parameters for selection of Port0 and Port1 interface
+
+## TC956X_Host_Driver_20210722_V_01-00-05:
+
+1. Dynamic CM3 TAMAP configuration 
+
+## TC956X_Host_Driver_20210722_V_01-00-06:
+
+1. Add support for contiguous allocation of memory
+
+## TC956X_Host_Driver_20210729_V_01-00-07:
+
+1. Add support to set MAC Address register
+
+## TC956X_Host_Driver_20210806_V_01-00-08:
+
+1. Store and use Port0 pci_dev for all DMA allocation/mapping for IPA path
+2. Register Port0 as only PCIe device, in case its PHY is not found
+
+## TC956X_Host_Driver_20210816_V_01-00-09:
+
+1. PHY interrupt mode supported through .config_intr and .ack_interrupt API
+
+## TC956X_Host_Driver_20210824_V_01-00-10:
+
+1. TC956X_PCIE_GEN3_SETTING macro setting supported through makefile. By default Gen3 settings will not be applied by the Driver as TC956X_PCIE_GEN3_SETTING is not defined.
+2. TC956X_LOAD_FW_HEADER macro setting supported through makefile. By default, TC956X_LOAD_FW_HEADER macro is disabled. If FIRMWARE_NAME is not specified in Makefile, the default value shall be TC956X_Firmware_PCIeBridge.bin
+3. Platform APIs supported.
+4. Modified PHY C22/C45 debug message.
+
+## TC956X_Host_Driver_20210902_V_01-00-11:
+
+1. Configuration of Link state L0 and L1 transaction delay for PCIe switch ports & Endpoint. By default maximum values are set for L0s and L1 latencies.
+
+## TC956X_Host_Driver_20210909_V_01-00-12:
+
+1. Reverted changes related to usage of Port-0 pci_dev for all DMA allocation/mapping for IPA path
+
+## TC956X_Host_Driver_20210914_V_01-00-13:
+
+1. Synchronization between ethtool vlan features "rx-vlan-offload", "rx-vlan-filter", "tx-vlan-offload" output and register settings.
+2. Added ethtool support to update "rx-vlan-offload", "rx-vlan-filter", and "tx-vlan-offload".
+3. Removed IOCTL TC956XMAC_VLAN_STRIP_CONFIG.
+4. Removed "Disable VLAN Filter" option in IOCTL TC956XMAC_VLAN_FILTERING.
+
+## TC956X_Host_Driver_20210923_V_01-00-14:
+
+1. Updated RX Queue Threshold limits for Activating and Deactivating Flow control 
+2. Filtering All pause frames by default.
+3. Capturing RBU status and updating to ethtool statistics for both S/W & IPA DMA channels
+
+## TC956X_Host_Driver_20210929_V_01-00-15:
+
+1. Added check for Device presence before changing PCIe ports speed.
+
+## TC956X_Host_Driver_20211014_V_01-00-16:
+
+1. Configuring pause frame control using kernel module parameter also forwarding only Link partner pause frames to Application and filtering PHY pause frames using FRP.
+2. Returning error on disabling Receive Flow Control via ethtool for speed other than 10G in XFI mode.
+
+## TC956X_Host_Driver_20211019_V_01-00-17:
+
+1. Added M3 SRAM Debug counters to ethtool statistics.
+2. Added MTL RX Overflow/packet miss count, TX underflow counts,Rx Watchdog value to ethtool statistics.
+
+## TC956X_Host_Driver_20211021_V_01-00-18:
+
+1. Added support for GPIO configuration API
+
+## TC956X_Host_Driver_20211025_V_01-00-19:
+
+1. Added PM support for suspend-resume.
+2. Added WOL Interrupt Handler and ethtool Support.
+3. Updated EEE support for PHY and MAC Control. (EEE macros are not enabled as EEE LPI interrupts disable are still under validation)
+
+## TC956X_Host_Driver_20211104_V_01-00-20:
+
+1. Added separate control functions for MAC TX and RX start/stop.
+2. Stopped disabling/enabling of MAC TX during Link down/up.
+3. Disabled link state latency configuration for all PCIe ports by default 
+
+## TC956X_Host_Driver_20211108_V_01-00-21:
+
+1. Skip queuing PHY Work during suspend and cancel any phy work if already queued.
+2. Restore Gen 3 Speed after resume.
+
+## TC956X_Host_Driver_20211124_V_01-00-22:
+
+1. Single port Suspend/Resume supported
+
+## TC956X_Host_Driver_20211124_V_01-00-23:
+
+1. Restricted MDIO access when no PHY found or MDIO registration fails
+2. Added mdio lock for making mii bus of private member to null to avoid parallel accessing to MDIO bus
+
+## TC956X_Host_Driver_20211124_V_01-00-24:
+
+1. Runtime configuration of EEE supported and LPI interrupts disabled by default.
+2. Module param added to configure EEE and LPI timer.
+3. Driver name corrected in ethtool display.
+
+## TC956X_Host_Driver_20211130_V_01-00-25:
+
+1. Print message correction for PCIe BAR size and Physical Address.
+
+## TC956X_Host_Driver_20211130_V_01-00-26:
+
+1. Added PHY Workqueue Cancel during suspend only if network interface available.
+
+## TC956X_Host_Driver_20211201_V_01-00-27:
+
+1. Free EMAC IRQ during suspend and request EMAC IRQ during resume.
+
+## TC956X_Host_Driver_20211201_V_01-00-28:
+
+1. Resetting SRAM Region before loading firmware.
+
+## TC956X_Host_Driver_20211203_V_01-00-29:
+
+1. Max C22/C45 PHY address changed to PHY_MAX_ADDR.
+2. Added error check for phydev in tc956xmac_suspend().
+
+## TC956X_Host_Driver_20211208_V_01-00-30:
+
+1. Added module parameters for Rx Queue Size, Flow Control thresholds and Tx Queue Size configuration.
+2. Renamed all module parameters for easy readability.
+
+## TC956X_Host_Driver_20211210_V_01-00-31:
+
+1. Support for link partner pause frame counting.
+2. Module parameter support to enable/disable link partner pause frame counting.
+
+## TC956X_Host_Driver_20211227_V_01-00-32:
+
+1. Support for eMAC Reset and unused clock disable during Suspend and restoring it back during resume.
+2. Resetting and disabling of unused clocks for eMAC Port, when no-found PHY for that particular port.
+3. Valid phy-address and mii-pointer NULL check in tc956xmac_suspend().
+
+## TC956X_Host_Driver_20220106_V_01-00-33:
+
+1. Null check added while freeing skb buff data
+2. Code comments corrected for flow control configuration
+
+## TC956X_Host_Driver_20220107_V_01-00-34:
+
+1. During emac resume, attach the net device after initializing the queues
+
+## TC956X_Host_Driver_20220111_V_01-00-35:
+
+1. Fixed phy mode support
+2. Error return when no phy driver found during ISR work queue execution
+
+## TC956X_Host_Driver_20220118_V_01-00-36:
+
+1. IRQ device name modified to differentiate between WOL and EMAC interrupt IRQs
+
+## TC956X_Host_Driver_20220120_V_01-00-37:
+
+1. Skip resume_config and reset eMAC if port unavailable (PHY not connected) during suspend-resume.
+2. Restore clock after resume in set_power.
+3. Shifted Queuing Work to end of resume to prevent MSI disable on resume.
+
+## TC956X_Host_Driver_20220124_V_01-00-38:
+
+1. Set Clock control and Reset control register to default value on driver unload.
+
+## TC956X_Host_Driver_20220131_V_01-00-39:
+
+1. Debug dump API supported to dump registers during crash.
+
+## TC956X_Host_Driver_20220202_V_01-00-40:
+
+1. Tx Queue flushed and checked for status after Tx DMA stop.
+
+## TC956X_Host_Driver_20220204_V_01-00-41:
+
+1. DMA channel status cleared only for SW path allocated DMA channels. IPA path DMA channel status clearing is skipped.
+2. Ethtool statistics added to print doorbell SRAM area for all the channels.
+
+## TC956X_Host_Driver_20220214_V_01-00-42:
+
+1. Reset assert and clock disable support during Link Down.
+
+## TC956X_Host_Driver_20220222_V_01-00-43:
+
+1. Supported GPIO configuration save and restoration.
+
+## TC956X_Host_Driver_20220225_V_01-00-44:
+
+1. XPCS module is re-initialized after link-up as MACxPONRST is asserted during link-down.
+2. Disable Rx side EEE LPI before configuring Rx Parser (FRP). Enable the same after Rx Parser configuration.
+
+## TC956X_Host_Driver_20220309_V_01-00-45:
+1. Handling of Non S/W path DMA channel abnormal interrupts in Driver and only TI & RI interrupts handled in FW.
+2. Reading MSI status for checking interrupt status of SW MSI.
+
+## TC956X_Host_Driver_20220322_V_01-00-46:
+1. PCI bus info updated for ethtool get driver version.
+
+## TC956X_Host_Driver_20220405_V_01-00-47:
+1. Disable MSI and flush phy work queue during driver release.
+
+## TC956X_Host_Driver_20220406_V_01-00-48:
+1. Dynamic MTU change supported. Max MTU supported is 2000 bytes.
+
+## TC956X_Host_Driver_20220414_V_01-00-49:
+1. Ignoring error from tc956xmac_hw_setup in tc956xmac_open API.
+
+## TC956X_Host_Driver_20220425_V_01-00-50:
+1. Perform platform remove after MDIO deregistration.
+
+## TC956X_Host_Driver_20220429_V_01-00-51:
+1. Checking for DMA status update as stop after TX DMA stop.
+2. Checking for Tx MTL Queue Read/Write contollers in idle state after TX DMA stop.
+3. Triggering Power saving at Link down after releasing of Offloaded DMA channels.
+4. Added kernel Module parameter for selecting Power saving at Link down and default is disabled.
+5. Added Lock for syncing linkdown, port rlease and release of offloaded DMA channels.
+
+## TC956X_Host_Driver_20220615_V_01-00-52:
+1. Added debugfs support for module specific register dump.
+
+## TC956X_Host_Driver_20220808_V_01-00-53:
+1. For IPA offload path, disable RBU interrupt when RBU interrupt occurs.
+   Interrupt should be enabled back in IPA SW.
+
+## TC956X_Host_Driver_20220831_V_01-00-54:
+1. Fix for configuring Rx Parser when EEE is enabled and RGMII Interface is used
+
+## TC956X_Host_Driver_20220902_V_01-00-55:
+1. 2500Base-X support for line speeds 2.5Gbps, 1Gbps, 100Mbps.
+
+## TC956X_Host_Driver_20221021_V_01-00-56:
+1. MDIO registration failures treated as error of type "ENODEV"
+
+## TC956X_Host_Driver_20221109_V_01-00-57:
+1. Update of fix for configuring Rx Parser when EEE is enabled
+
+## TC956X_Host_Driver_20221222_V_01-00-58:
+1. Support for SW reset during link down.
+2. Module parameters introduced for the control of SW reset and by default SW reset is disabled.
+
+## TC956X_Host_Driver_20230509_V_01-00-59:
+1. Module parameters for SW reset (during link change) enabled by default for Port0.
+
+## TC956X_Linux_Host_Driver_20230810_V_01-01-59
+1. Automotive AVB/TSN support (Merge of version V_03-00) with changes as mentioned below.
+ a. WOL platform related changes moved under user defined macro.
+ b. Enable EEE for 2.5G and 5G speeds, when driver is loaded with EEE ON module param.
+ c. USXGMII support for Port1.
+ d. Added IOCTL support for TC956XMAC_VLAN_STRIP_CONFIG. Ethtool status updated accordingly.
+ e. During resume, interface attach done irrespective of interface presence.
+ f. Added module param for configuration of phy device addr for phy detection, MDC clock and C45/C22 presence
+ g. By default IPA offload is disabled.
+ h. Default Port1 interface is set to RGMII.
+ i. All the entries of TAMAP table set for default values.
+ j. Kernel timers are used to process transmitted Tx descriptors. Systick timers are not used.
+ k. Dynamic change of MTU not supported. Max MTU supported is 9000.
+ l. IPA feaure support for Automotive usecase
+ m. Port2Port Feature support
+2. Default Port 0 interface is XFI and Port1 interface is SGMII 
+3. IPA (macro TC956X_DMA_OFFLOAD_ENABLE) enabled by default
+4. Kernel timers are used to process transmitted TX descriptor. Systick timers are not used.
+5. Dynamic change of MTU not supported. Max MTU supported is 9000.
+6. Port 1 supports USXGMII, XFI and 25000Base-X interface also.
+
+## TC956X_Linux_Host_Driver_20231110_V_01-02-59
+1. Kernel 6.1.18 Porting changes
+2. TC956x switch to switch connection support (upto 1 level) over DSP ports
+
+## TC956X_Linux_Host_Driver_20231226_V_01-03-59
+1. Kernel 6.6.1 Porting changes
+2. Added the support for TC commands taprio and flower
+
+## TC956X_Linux_Host_Driver_20240213_V_04-00
+1. Merged CPE (V_02-00) and Automotive throughput package
+2. Added Support for external timestamp event
+
+## TC956X_Linux_Host_Driver_20240329_V_04-00
+1. Bug fix for SGMII interface 1Gbps speed change
+2. Support for without MDIO and without PHY scenarios
+3. Added support for 5G and 2.5G EEE activation (applicable for Kernel 6.3 onwards)
+4. TC956x switch to switch connection support (upto 2 level) over DSP ports
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/common.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/common.h
@@ -0,0 +1,2923 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * common.h - Common Header File
+ *
+ * Copyright (C) 2007-2009 STMicroelectronics Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  20 Jul 2021 : CONFIG_DEBUG_FS_TC956X removed and renamed as CONFIG_DEBUG_FS
+ *  VERSION     : 01-00-03
+ *  22 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported with module parameters
+ *  VERSION     : 01-00-04
+ *  23 Jul 2021 : 1. Enable DMA IPA OFFLOAD and FRP by default
+ *  VERSION     : 01-00-06
+ *  02 Sep 2021 : 1. Configuration of Link state L0 and L1 transaction delay for PCIe switch ports & Endpoint.
+ *  VERSION     : 01-00-11
+ *  23 Sep 2021 : 1. Enabling MSI MASK for MAC EVENT Interrupt to process RBU status and update to ethtool statistics
+ *  VERSION     : 01-00-14
+ *  14 Oct 2021 : 1. Moving common Macros to common header file
+ *  VERSION     : 01-00-16
+ *  19 Oct 2021 : 1. Adding M3 SRAM Debug counters to ethtool statistics
+ *                2. Adding MTL RX Overflow/packet miss count, TX underflow counts,Rx Watchdog value to ethtool statistics.
+ *  VERSION     : 01-00-17
+ *  21 Oct 2021 : 1. Added support for GPIO configuration API
+ *  VERSION     : 01-00-18
+ *  26 Oct 2021 : 1. Added macro to enable/disable EEE.
+ *              : 2. Added enums for PM Suspend-Resume.
+ *              : 3. Added macros for EEE, LPI Timer and MAC RST Status.
+ *  VERSION     : 01-00-19
+ *  04 Nov 2021 : 1. Disabled link state latency configuration for all PCIe ports by default
+ *  VERSION     : 01-00-20
+ *  08 Nov 2021 : 1. Added macro for Maximum Port
+ *  VERSION     : 01-00-21
+ *  24 Nov 2021 : 1. Single Port Suspend/Resume supported
+ *  VERSION     : 01-00-22
+ *  24 Nov 2021 : 1. EEE update for runtime configuration and LPI interrupt disabled.
+ *  VERSION     : 01-00-24
+ *  08 Dec 2021 : 1. Added Macro for Maximum Tx, Rx Queue Size and byte size.
+ *  VERSION     : 01-00-30
+ *  10 Dec 2021 : 1. Added link partner pause frame count debug counters to ethtool statistics.
+ *  VERSION     : 01-00-31
+ *  27 Dec 2021 : 1. Support for eMAC Reset and unused clock disable during Suspend and restoring it back during resume.
+ *  VERSION     : 01-00-32
+ *  24 Jan 2022 : 1. Set Clock control and Reset control register to default value on driver unload.
+ *  VERSION     : 01-00-38
+ *  31 Jan 2022 : 1. Additional macros defined for debug dump API usage.
+ *  VERSION     : 01-00-39
+ *  04 Feb 2021 : 1. Ethtool statistics added to print doorbell SRAM area for all the channels.
+ *  VERSION     : 01-00-41
+ *  14 Feb 2021 : 1. Reset assert and clock disable support during Link Down.
+ *  VERSION     : 01-00-42
+ *  06 Apr 2022 : 1.Max MTU supported is 2000 bytes.
+ *  VERSION     : 01-00-48
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Added support for board device RBTC9563_3MA
+ *  VERSION     : 04-00
+*/
+
+#ifndef __COMMON_H__
+#define __COMMON_H__
+
+#include <linux/etherdevice.h>
+#include <linux/netdevice.h>
+#include "tc956xmac_inc.h"
+#include <linux/phy.h>
+#include <linux/module.h>
+#include <net/pkt_sched.h>
+#include <net/pkt_cls.h>
+#if IS_ENABLED(CONFIG_VLAN_8021Q)
+#define TC956XMAC_VLAN_TAG_USED
+#include <linux/if_vlan.h>
+#endif
+
+#include "descs.h"
+#include "hwif.h"
+#include "mmc.h"
+#ifdef TC956X
+#ifndef TC956X_SRIOV_VF
+#include "tc956x_xpcs.h"
+#endif
+#include "tc956x_pma.h"
+#endif
+
+//#define TC956X_LPI_INTERRUPT
+/* Indepenedent Suspend/Resume Debug */
+#undef TC956X_PM_DEBUG
+#define TC956X_MAX_PORT			2
+#define TC956X_ALL_MAC_PORT_SUSPENDED	0 /* All EMAC Port Suspended. To be used just after suspend and before resume. */
+#define TC956X_NO_MAC_DEVICE_IN_USE	0 /* No EMAC Port in use. To be used at probe and remove. */
+#define TC956X_SINGLE_MAC_DEVICE_IN_USE	1 /* One of the EMAC Port in use. To be used at remove. */
+#define TC956X_ALL_MAC_PORT_LINK_DOWN	2 /* All ports are Link Down */
+#define TC956X_TOT_CASCADE_DEV	7 /* Maximum number of devices for 2 Level cascade setup */
+#define TC956X_PCI_BD_MASK	0xFFF8
+
+/* Suspend-Resume Arguments */
+enum TC956X_PORT_PM_STATE {
+	SUSPEND = 0,
+	RESUME,
+};
+
+/* Link Down Change Power State Arguments */
+enum TC956X_PORT_LINK_CHANGE_STATE {
+	LINK_DOWN = 0,
+	LINK_UP,
+};
+#if defined(TC956X_SRIOV_PF)
+//#define TC956X_PCIE_LINK_STATE_LATENCY_CTRL
+#define TC956X_PCIE_DSP_CUT_THROUGH
+#endif
+#define DISABLE		0x0U
+#define ENABLE		0x1U
+#define SIZE_512B	0x200U
+#define SIZE_1KB	0x400U
+
+/* Synopsys Core versions */
+#define DWMAC_CORE_3_40		0x34
+#define DWMAC_CORE_3_50		0x35
+#define DWMAC_CORE_4_00		0x40
+#define DWMAC_CORE_4_10		0x41
+#define DWMAC_CORE_5_00		0x50
+#define DWMAC_CORE_5_10		0x51
+#define DWXGMAC_CORE_2_10	0x21
+#define DWXGMAC_CORE_3_01	0x30
+
+//#define DISABLE_EMAC_PORT1
+#ifndef TC956X_SRIOV_VF
+#define EEE /* Enable for EEE support */
+#endif
+
+#define TC956X_MAC_ADDR_CNT 14
+/* Note: Multiple macro definitions for TC956X_PCIE_LOGSTAT and TC956X_PCIE_LOGSTAT_SUMMARY_ENABLE.
+ * Please also define/undefine same macro in tc956xmac_ioctl.h, if changing in this file
+ */
+/* #undef TC956X_PCIE_LOGSTAT */
+#define TC956X_PCIE_LOGSTAT
+#ifdef TC956X_PCIE_LOGSTAT
+/* Enable/Disable Logstat Summary Print during probe and resume. */
+#undef TC956X_PCIE_LOGSTAT_SUMMARY_ENABLE
+#endif
+
+/* This macro to be enabled for loading cbs based on speed change */
+// #define TC956X_DYNAMIC_LOAD_CBS
+
+/* This macro to be enabled while running TSN demo Application */
+// #define TSN_DEMO_AUTOMOTIVE
+
+/* This macro to be disabled for board device other than RBTC9563_3MA */
+/* #define RBTC9563_3MA */
+
+#define TC956X_M3_DMEM_OFFSET	0x40000
+#define MAC2MAC_ETH0_RXDESC_L	0x7800
+#define MAC2MAC_ETH0_RXDESC_H	0x7804
+#define MAC2MAC_ETH1_RXDESC_L	0xB800
+#define MAC2MAC_ETH1_RXDESC_H	0xB804
+
+//#define   TX_LOGGING_TRACE
+//#define   RX_LOGGING_TRACE
+#define TC956XMAC_CHAN0	0  /* Always supported and default for all chips */
+//#define TC956X_SRIOV_PF
+#define TC956X_SRIOV_LOCK
+//#define TC956X_SRIOV_DEBUG
+
+
+#define TC956XMAC_CHA_NO_0	BIT(0)
+#define TC956XMAC_CHA_NO_1	BIT(1)
+#define TC956XMAC_CHA_NO_2	BIT(2)
+#define TC956XMAC_CHA_NO_3	BIT(3)
+
+#ifdef TC956X_SRIOV_PF
+/* VF number for each VF Application */
+#define TC956XMAC_VF_IVI 1
+#define TC956XMAC_VF_TCU 2
+#define TC956XMAC_VF_ADAS 3
+
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE) || defined(TC956X_CPE_CONFIG)
+/* Legacy channel for each VF Application */
+#define TC956XMAC_CHA_IVI TC956XMAC_CHA_NO_0
+#define TC956XMAC_CHA_TCU TC956XMAC_CHA_NO_0
+#define TC956XMAC_CHA_ADAS TC956XMAC_CHA_NO_0
+#define TC956XMAC_CHA_PF TC956XMAC_CHA_NO_0
+#if defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+#define TC956XMAC_CHA_M2M TC956XMAC_CHA_NO_2
+#endif
+#else
+/* Legacy channel for each VF Application */
+#define TC956XMAC_CHA_IVI TC956XMAC_CHA_NO_0
+#define TC956XMAC_CHA_TCU TC956XMAC_CHA_NO_1
+#define TC956XMAC_CHA_ADAS TC956XMAC_CHA_NO_2
+#define TC956XMAC_CHA_PF TC956XMAC_CHA_NO_3
+#endif
+#endif
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+#define TC956X_TOT_MSI_VEC	2
+#else
+#define TC956X_TOT_MSI_VEC	1
+#endif
+
+#define TC956X_MSI_VECTOR_0	0
+#define TC956X_MSI_VECTOR_1	1
+
+#define ETH_DMA_DUMP_OFFSET1 (0x3000 / 4)
+#define ETH_DMA_DUMP_OFFSET1_END   (0x30A0 / 4)
+#define ETH_DMA_DUMP_OFFSET2 (0x3100 / 4)
+
+#define ETH_CORE_DUMP_OFFSET1     (0x0)
+#define ETH_CORE_DUMP_OFFSET1_END (0xe0 / 4)
+#define ETH_CORE_DUMP_OFFSET2     (0x110 / 4)
+#define ETH_CORE_DUMP_OFFSET2_END (0xdd0 / 4)
+#define ETH_CORE_DUMP_OFFSET3     (0x1000 / 4)
+#define ETH_CORE_DUMP_OFFSET3_END (0x10f4 / 4)
+#define ETH_CORE_DUMP_OFFSET4     (0x1100 / 4)
+#define ETH_CORE_DUMP_OFFSET4_END (0x1108 / 4)
+#define ETH_CORE_DUMP_OFFSET5     (0x1110 / 4)
+#define ETH_CORE_DUMP_OFFSET5_END (0x1124 / 4)
+#define ETH_CORE_DUMP_OFFSET6     (0x1140 / 4)
+#define ETH_CORE_DUMP_OFFSET6_END (0x1174 / 4)
+
+/* 0x20004000 to 0x2000401C is for Port0, 0x20004020 to 0x2000403C is for Port1 */
+#define SRAM_TX_PCIE_ADDR_LOC	0x44000
+
+/* 0x20004040 to 0x2000405C is for Port0, 0x20004060 to 0x2000407C is for Port1 */
+#define SRAM_RX_PCIE_ADDR_LOC	0x44040
+
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+
+#ifdef TC956X
+int tc956xmac_init(void);
+#endif
+
+#ifdef TC956X
+void tc956xmac_exit(void);
+#endif
+
+#endif
+#endif /* TC956X_SRIOV_PF */
+
+#ifdef TC956X_SRIOV_PF
+/* TC956X Semaphore lock/unlock register */
+#define NSEM(reg)			(0x1100 + (reg * 4))
+/* TC956X Semaphore read register */
+#define NSEM_RD(reg)			(0x1140 + (reg * 4))
+
+#define MBX_MSG_OFST		4 /* First 4 bytes for ACK management */
+#define MBX_MSG_SIZE		60 /* Excluding ACK */
+#define MBX_ACK_SIZE		4 /* ACK management */
+#define MBX_TOT_SIZE		(MBX_MSG_SIZE + MBX_ACK_SIZE)
+
+#define ACK			0x01
+#define NACK			0x02
+
+#define MAX_NO_OF_VFS 3
+
+/* Mailbox opcode definitions */
+#define OPCODE_MBX_ADD_MAC_ADDR		0x01
+#define OPCODE_MBX_SET_TX_Q_WEIGHT	0x02
+#define OPCODE_MBX_CFG_CBS		0x03
+#define OPCODE_MBX_SET_TX_Q_PRIOR	0x04
+#define OPCODE_MBX_RESET_EEE_MODE       0x05
+#define OPCODE_MBX_VF_IOCTL		        0x06
+#define OPCODE_MBX_VF_ETHTOOL		    0x07
+#define OPCODE_MBX_VF_ADD_MAC		    0x08
+#define OPCODE_MBX_VF_DELETE_MAC	    0x09
+#define OPCODE_MBX_VF_ADD_VLAN		    0x10
+#define OPCODE_MBX_VF_DELETE_VLAN	    0x11
+#define OPCODE_MBX_SET_DMA_TX_MODE	0x12
+#define OPCODE_MBX_VF_GET_LINK_STATUS	0x13
+#define OPCODE_MBX_PHY_LINK		0x14
+#define OPCODE_MBX_SETUP_CBS		0x15
+#define OPCODE_MBX_RX_CRC		0x16
+#define OPCODE_MBX_RX_CSUM		0x17
+#define OPCODE_MBX_DRV_CAP		0x18
+#define OPCODE_MBX_VF_GET_MII_PHY		0x23
+#define TC956XMAC_GET_PAUSE_PARAM_2		0x24
+#define OPCODE_MBX_GET_UMAC_ADDR        0x25
+#define OPCODE_VF_RESET                 0x26
+#define OPCODE_MBX_DMA_CH_TLPTR		0x29
+#define OPCODE_MBX_SETUP_ETF		    0x30
+#define OPCODE_MBX_FLR					0x33
+#define OPCODE_MBX_DMA_ERR		0x34
+#define OPCODE_MBX_ACK_MSG		0xFF
+
+#define SIZE_MBX_SET_TX_Q_WEIGHT		8
+#define SIZE_MBX_CFG_CBS			20
+#define SIZE_MBX_SETUP_ETF			5
+#define SIZE_MBX_CFG_EST			540 /* 28 + (4*128) */
+#define SIZE_MBX_CFG_FPE			20
+#define SIZE_MBX_SETUP_CBS				21
+#define SIZE_MBX_SET_TX_Q_PRIOR			8
+#define SIZE_MBX_SET_DMA_TX_MODE		13
+#define SIZE_MBX_VF_GET_LINK_STATUS		0
+#define SIZE_MBX_PHY_LINK		12
+#define SIZE_MBX_RX_CRC		4
+#define SIZE_MBX_RX_CSUM		4
+#define SIZE_MBX_DRV_CAP		        4
+#define SIZE_GET_UMAC_ADDR              4
+#define SIZE_SET_UMAC_ADDR              10
+#define SIZE_MBX_VF_MAC				6
+#define SIZE_MBX_VF_VLAN				2
+#define SIZE_MBX_VF_REG_WR			13
+#define SIZE_MBX_VF_SPEED			1
+#define SIZE_MBX_SET_GET_CBS_1			56
+#define SIZE_MBX_SET_GET_RXP_1		56
+#define SIZE_MBX_SET_GET_CBS_2			44
+#define SIZE_MBX_VF_PAUSE_PARAM		1
+#define SIZE_MBX_VF_EEE				1
+#define SIZE_MBX_VF_TS_INFO			1
+#define SIZE_VF_RESET			    1
+#define SIZE_MBX_VF_TIMESTAMP		2
+#define SIZE_MBX_SET_GET_EST_1		56
+#define SIZE_MBX_RX_DMA_TL_PTR		4
+#define SIZE_MBX_SET_GET_FPE_1    20
+#define SIZE_MBX_GET_HW_STMP    12
+
+#define MAX_SIZE_GCL_MSG 14
+#define EST_FIX_MSG_LEN 28
+#define RXP_FIX_MSG_LEN 16
+#define VF_UP         1
+#define VF_DOWN       0
+#define VF_SUSPEND    2
+#define VF_RELEASE    3
+
+#define SCH_WQ_PHY_REG_RD 1
+#define SCH_WQ_RX_DMA_ERR 2
+#define SCH_WQ_GET_PAUSE_PARAM 3
+
+#endif /* #ifdef TC956X_SRIOV_PF */
+
+#ifdef TC956X_SRIOV_VF
+#define TC956X_MIN_MSI_VEC	1
+#define TC956X_MAX_MSI_VEC	1
+
+#define TC956X_MSI_VECTOR_0	0
+#define TC956X_MSI_VECTOR_1	1
+#endif
+
+enum mbx_msg_fns {
+	mcu = 0,
+	pf0 = 1,
+	pf1 = 2,
+	vf0 = 3,
+	vf1 = 4,
+	vf2 = 5
+};
+
+struct fn_id {
+	bool fn_type; /*0 - PF; 1-VF*/
+	u8 pf_no; /* PF number [0-1], In case of VF, this gives information
+		   * about associated PF
+		   */
+	u8 vf_no; /*VF number [1-3]*/
+};
+
+
+/* Packets types */
+enum packets_types {
+	PACKET_AVCPQ = 0x1, /* AV Untagged Control packets */
+	PACKET_PTPQ = 0x2, /* PTP Packets */
+	PACKET_DCBCPQ = 0x3, /* DCB Control Packets */
+	PACKET_UPQ = 0x4, /* Untagged Packets */
+	PACKET_MCBCQ = 0x5, /* Multicast & Broadcast Packets */
+#ifdef TC956X
+	PACKET_FPE_RESIDUE = 0x6, /* Frame Pre-emption residue packets */
+#endif
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+	PACKET_FILTER_FAIL = 0x7, /* Filter Fail packets */
+#endif
+};
+
+//#define TX_LOGGING_TRACE
+
+/*	Dual Port related Macros	*/
+#define RM_PF0_ID		(0)
+#define RM_PF1_ID		(1)
+#define RM_IS_PF		(0)
+#define RM_IS_VF		(1)
+#define MAC_PORT_NUM_CHECK	(priv->port_num == RM_PF0_ID)
+
+/* Select the MDC range based on PHY specification.
+ * IEEE recommends max of 2.5MHz. But if PHY supports more than that, then it can be used
+ */
+#define PORT0_MDC	TC956XMAC_XGMAC_MDC_CSR_12
+#define PORT1_MDC	TC956XMAC_XGMAC_MDC_CSR_62
+
+#ifdef TC956X
+#define PORT0_C45_STATE		true
+#define PORT1_C45_STATE		false
+#endif
+
+#if defined(TX_LOGGING_TRACE)
+#define PACKET_IPG      125000
+#define PACKET_CDT_IPG  500000
+#endif
+
+#define TC956X_M3_FW_EXIT_VALUE		2
+
+#ifdef TC956X
+
+#define TC956X_AVB_PRIORITY_CLASS_A	(3)
+#define TC956X_AVB_PRIORITY_CLASS_B	(2)
+#define TC956X_PRIORITY_CLASS_CDT	(7)
+
+/* skip the addresses added during hw setup*/
+
+/*
+ * Note: If source address (SA) replacement or SA insertion feature is
+ * supported, MAC_ADDR_ADD_SKIP_OFST should be increased accordingly
+ */
+#define TC956X_MAX_PERFECT_ADDRESSES	32
+#define TC956X_MAX_PERFECT_VLAN		16
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+#define XGMAC_ADDR_ADD_SKIP_OFST	6
+#else
+#define XGMAC_ADDR_ADD_SKIP_OFST	3
+#endif
+
+
+#define TC956X_MAC_STATE_VACANT		0x0
+#define TC956X_MAC_STATE_OCCUPIED	0x1
+#define TC956X_MAC_STATE_NEW			0x2
+#define TC956X_MAC_STATE_MODIFIED	0x4
+
+
+/* C45 registers for Port0 PHY */
+
+/* CL45_CTRL_REG is the equivalent of CL22 BMCR */
+#define PHY0_CL45_CTRL_REG_MMD_BANK      (7)
+#define PHY0_CL45_CTRL_REG_ADDR          (0x0)
+
+/* CL45_STATUS_REG is the equivalent of CL22 BMSR */
+#define PHY0_CL45_STATUS_REG_MMD_BANK    (7)
+#define PHY0_CL45_STATUS_REG_ADDR        (0x1)
+
+/* CL45_PHYID1 is the equivalent of CL22 PHYIDR1 */
+#define PHY0_CL45_PHYID1_MMD_BANK        (1)
+#define PHY0_CL45_PHYID1_ADDR            (2)
+
+/* CL45_PHYID1 is the equivalent of CL22 PHYIDR2 */
+#define PHY0_CL45_PHYID2_MMD_BANK        (1)
+#define PHY0_CL45_PHYID2_ADDR            (3)
+
+#define PHY0_CL45_PHYID1_REG	\
+((PHY0_CL45_PHYID1_MMD_BANK << 16) | (PHY0_CL45_PHYID1_ADDR))
+
+#define PHY0_CL45_PHYID2_REG	\
+((PHY0_CL45_PHYID2_MMD_BANK << 16) | (PHY0_CL45_PHYID2_ADDR))
+
+
+/* C45 registers for Port1 PHY */
+
+/* CL45_CTRL_REG is the equivalent of CL22 BMCR */
+#define PHY1_CL45_CTRL_REG_MMD_BANK      (7)
+#define PHY1_CL45_CTRL_REG_ADDR          (0x0)
+
+/* CL45_STATUS_REG is the equivalent of CL22 BMSR */
+#define PHY1_CL45_STATUS_REG_MMD_BANK    (7)
+#define PHY1_CL45_STATUS_REG_ADDR        (0x1)
+
+/* CL45_PHYID1 is the equivalent of CL22 PHYIDR1 */
+#define PHY1_CL45_PHYID1_MMD_BANK        (1)
+#define PHY1_CL45_PHYID1_ADDR            (2)
+
+/* CL45_PHYID1 is the equivalent of CL22 PHYIDR2 */
+#define PHY1_CL45_PHYID2_MMD_BANK        (1)
+#define PHY1_CL45_PHYID2_ADDR            (3)
+
+#define PHY1_CL45_PHYID1_REG	\
+((PHY1_CL45_PHYID1_MMD_BANK << 16) | (PHY1_CL45_PHYID1_ADDR))
+
+#define PHY1_CL45_PHYID2_REG	\
+((PHY1_CL45_PHYID2_MMD_BANK << 16) | (PHY1_CL45_PHYID2_ADDR))
+
+
+/* CL45_CTRL_REG is the equivalent of CL22 BMCR */
+#define PHY_CL45_CTRL_REG_MMD_BANK		((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_CTRL_REG_MMD_BANK) : (PHY1_CL45_CTRL_REG_MMD_BANK))
+
+#define PHY_CL45_CTRL_REG_ADDR			((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_CTRL_REG_ADDR) : (PHY1_CL45_CTRL_REG_ADDR))
+
+/* CL45_STATUS_REG is the equivalent of CL22 BMSR */
+#define PHY_CL45_STATUS_REG_MMD_BANK	((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_STATUS_REG_MMD_BANK) : (PHY1_CL45_STATUS_REG_MMD_BANK))
+
+#define PHY_CL45_STATUS_REG_ADDR		((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_STATUS_REG_ADDR) : (PHY1_CL45_STATUS_REG_ADDR))
+
+/* CL45_PHYID1 is the equivalent of CL22 PHYIDR1 */
+#define PHY_CL45_PHYID1_MMD_BANK		((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_PHYID1_MMD_BANK) : (PHY1_CL45_PHYID1_MMD_BANK))
+
+#define PHY_CL45_PHYID1_ADDR		((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_PHYID1_ADDR) : (PHY1_CL45_PHYID1_ADDR))
+
+/* CL45_PHYID1 is the equivalent of CL22 PHYIDR2 */
+#define PHY_CL45_PHYID2_MMD_BANK		((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_PHYID2_MMD_BANK) : (PHY1_CL45_PHYID2_MMD_BANK))
+
+#define PHY_CL45_PHYID2_ADDR		((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_PHYID2_ADDR) : (PHY1_CL45_PHYID2_ADDR))
+
+#define PHY_CL45_PHYID1_REG		((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_PHYID1_REG) : (PHY1_CL45_PHYID1_REG))
+
+#define PHY_CL45_PHYID2_REG		((MAC_PORT_NUM_CHECK) ? \
+						(PHY0_CL45_PHYID2_REG) : (PHY1_CL45_PHYID2_REG))
+
+#define NFUNCEN4_OFFSET			(0x1528)
+
+#define MAX_RX_QUEUE_SIZE	47104 /* 46KB Maximun RX Queue size */
+#define MAX_TX_QUEUE_SIZE	47104 /* 46KB Maximun TX Queue size */
+
+#define TC956X_DA_MAP		0xF
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+
+/************************ TC956X_SRIOV_PF Starts ************************/
+
+#define TC956X_DMA_RX_AIS  BIT(14)
+#define TC956X_DMA_RX_FBE  BIT(12)
+#define TC956X_DMA_RX_RPS  BIT(8)
+#define MAX_TX_QUEUES_TO_USE	8
+#define MAX_RX_QUEUES_TO_USE	8
+
+/* Tx Queue Size*/
+#define TX_QUEUE0_SIZE	4096
+#define TX_QUEUE1_SIZE	4096
+#define TX_QUEUE2_SIZE	18432
+#define TX_QUEUE3_SIZE	4096
+#define TX_QUEUE4_SIZE	1024
+#define TX_QUEUE5_SIZE	4096
+#define TX_QUEUE6_SIZE	4096
+#define TX_QUEUE7_SIZE	4096
+
+/* TX Queue 0: Legacy and Jumbo packets */
+#define TX_QUEUE0_MODE		MTL_QUEUE_DCB
+/* TX Queue 1:Legacy*/
+#define TX_QUEUE1_MODE		MTL_QUEUE_DCB
+/* TX Queue 2: Legacy */
+#define TX_QUEUE2_MODE		MTL_QUEUE_DCB
+/* TX Queue 3: Legacy */
+#define TX_QUEUE3_MODE		MTL_QUEUE_DCB
+/* TX Queue 4: Untagged PTP */
+#define TX_QUEUE4_MODE		MTL_QUEUE_DCB
+/* TX Queue 5: AVB Class B AVTP packet */
+#define TX_QUEUE5_MODE		MTL_QUEUE_AVB
+/* TX Queue 6: AVB Class A AVTP packet */
+#define TX_QUEUE6_MODE		MTL_QUEUE_AVB
+/* TX Queue 7: TSN Class CDT packet */
+#if defined(TSN_DEMO_AUTOMOTIVE)
+#define TX_QUEUE7_MODE		MTL_QUEUE_DCB
+#else
+#define TX_QUEUE7_MODE		MTL_QUEUE_AVB
+#endif
+
+/* Tx Queue TBS Enable/Disable */
+#define TX_QUEUE0_TBS		0
+#define TX_QUEUE1_TBS		0
+#define TX_QUEUE2_TBS		0
+#define TX_QUEUE3_TBS		0
+#define TX_QUEUE4_TBS		0
+#define TX_QUEUE5_TBS		1
+#define TX_QUEUE6_TBS		1
+#define TX_QUEUE7_TBS		1
+
+/* Tx Queue TSO Enable/Disable */
+#define TX_QUEUE0_TSO		1
+#define TX_QUEUE1_TSO		1
+#define TX_QUEUE2_TSO		1
+#define TX_QUEUE3_TSO		1
+#define TX_QUEUE4_TSO		0
+#define TX_QUEUE5_TSO		0
+#define TX_QUEUE6_TSO		0
+#define TX_QUEUE7_TSO		0
+
+/* Configure TxQueue - Traffic Class mapping */
+#define TX_QUEUE0_TC	0x0
+#define TX_QUEUE1_TC	0x0
+#define TX_QUEUE2_TC	0x0
+#define TX_QUEUE3_TC	0x0
+#define TX_QUEUE4_TC	0x1
+#define TX_QUEUE5_TC	0x2
+#define TX_QUEUE6_TC	0x3
+#define TX_QUEUE7_TC	0x4
+
+
+/*
+ * RX Queue 0: Unicast/Untagged Packets - Packets with
+ * unique MAC Address of Host/Guest OS DMA channel selection will be based on
+ * MAC_Address(#i)_High.DCS
+ */
+#define RX_QUEUE0_MODE		MTL_QUEUE_DCB
+/* RX Queue 1: VLAN Tagged Legacy packets- Pkt routing will be based on VLAN */
+#define RX_QUEUE1_MODE		MTL_QUEUE_DCB
+/* RX Queue 2: Untagged gPTP packets */
+#define RX_QUEUE2_MODE		MTL_QUEUE_DCB
+/* RX Queue 3: Filter Fail packet queue */
+#define RX_QUEUE3_MODE		MTL_QUEUE_DCB
+/* RX Queue 4: AVB Class B AVTP packets */
+#define RX_QUEUE4_MODE		MTL_QUEUE_AVB
+/* RX Queue 5: AVB Class A AVTP packets */
+#define RX_QUEUE5_MODE		MTL_QUEUE_AVB
+/* RX Queue 6:TSN  Class CDT packets */
+#define RX_QUEUE6_MODE		MTL_QUEUE_AVB
+/* RX Queue 7: Broadcast/Multicast packets */
+#define RX_QUEUE7_MODE		MTL_QUEUE_DCB
+
+/* Rx Queue Size */
+#define RX_QUEUE0_SIZE	18432
+#define RX_QUEUE1_SIZE	4096
+#define RX_QUEUE2_SIZE	1024
+#define RX_QUEUE3_SIZE	4096
+#define RX_QUEUE4_SIZE	4096
+#define RX_QUEUE5_SIZE	4096
+#define RX_QUEUE6_SIZE	4096
+#define RX_QUEUE7_SIZE	4096
+
+/* Rx Queue Packet Routing */
+#define RX_QUEUE0_PKT_ROUTE	PACKET_UPQ
+#define RX_QUEUE1_PKT_ROUTE	0
+#define RX_QUEUE2_PKT_ROUTE	PACKET_PTPQ
+#define RX_QUEUE3_PKT_ROUTE	PACKET_FILTER_FAIL
+/* Queue 4,5,6 Routed based on Packet Priority Configured in
+ * MAC_RxQ_Ctrl2/MAC_RxQ_Ctrl3
+ */
+#define RX_QUEUE4_PKT_ROUTE	0
+#define RX_QUEUE5_PKT_ROUTE	0
+#define RX_QUEUE6_PKT_ROUTE	0
+#define RX_QUEUE7_PKT_ROUTE	PACKET_MCBCQ
+
+/* Unicast/Untagged packet */
+#define LEG_UNTAGGED_PACKET	TC956X_DA_MAP
+/* VLAN tagged packets */
+#define LEG_TAGGED_PACKET	TC956X_DA_MAP
+/* Untagged gPTP packet */
+#define UNTAGGED_GPTP_PACKET	4
+/* Filter Failed Unicast, Multicast, Tagged packets.
+ * Route to PF Best Effort Channel. Used only in SRIOV promiscuous mode
+ */
+#define FILTER_FAIL_PACKET	3
+/* Class B AVB Packet */
+#define AVB_CLASS_B_PACKET	5
+/* Class A AVB Packet */
+#define AVB_CLASS_A_PACKET	6
+/* TSN Class CDT Packet */
+#define TSN_CLASS_CDT_PACKET	7
+/* Broadcast/Multicast packet */
+#define BC_MC_PACKET		TC956X_DA_MAP
+
+#define TX_QUEUE0_USE_PRIO	true
+#define TX_QUEUE1_USE_PRIO	true
+#define TX_QUEUE2_USE_PRIO	true
+#define TX_QUEUE3_USE_PRIO	true
+#define TX_QUEUE4_USE_PRIO	false
+#define TX_QUEUE5_USE_PRIO	false
+#define TX_QUEUE6_USE_PRIO	false
+#define TX_QUEUE7_USE_PRIO	false
+
+#define TX_QUEUE0_PRIO		0xFF	/* TC0 Priority */
+#define TX_QUEUE1_PRIO		0xFF
+#define TX_QUEUE2_PRIO		0xFF
+#define TX_QUEUE3_PRIO		0xFF
+#define TX_QUEUE4_PRIO		0x00
+#define TX_QUEUE5_PRIO		0x00
+#define TX_QUEUE6_PRIO		0x00
+#define TX_QUEUE7_PRIO		0x00
+
+/* Rx Queue Use Priority */
+#define RX_QUEUE0_USE_PRIO		false
+#define RX_QUEUE1_USE_PRIO		true
+#define RX_QUEUE2_USE_PRIO		false
+#define RX_QUEUE3_USE_PRIO		false
+#define RX_QUEUE4_USE_PRIO		true
+#define RX_QUEUE5_USE_PRIO		true
+#define RX_QUEUE6_USE_PRIO		true
+#define RX_QUEUE7_USE_PRIO		false
+
+/* Rx Queue VLAN tagged Priority mapping */
+#define RX_QUEUE0_PRIO		0
+#define RX_QUEUE1_PRIO		0xFF
+#define RX_QUEUE2_PRIO		0
+#define RX_QUEUE3_PRIO		0
+#define RX_QUEUE4_PRIO		(1 << TC956X_AVB_PRIORITY_CLASS_B)
+#define RX_QUEUE5_PRIO		(1 << TC956X_AVB_PRIORITY_CLASS_A)
+#define RX_QUEUE6_PRIO		(1 << TC956X_PRIORITY_CLASS_CDT)
+#define RX_QUEUE7_PRIO		0
+
+#define EEPROM_OFFSET		0
+#define EEPROM_MAC_COUNT	14
+
+/* DMA Ch allocation in tx-rx pairs for PF & VF */
+#define TC956X_PF_CH_ALLOC	0x18	/* PF - Ch 3, 4 */
+#define TC956X_VF0_CH_ALLOC	0x21	/* VF0 - Ch 0, 5 */
+#define TC956X_VF1_CH_ALLOC	0x02	/* VF1 - Ch 1 */
+#define TC956X_VF2_CH_ALLOC	0xC4	/* VF2 - Ch 2, 6, 7 */
+
+#define TC956X_DMA0_VF_MAP  0U
+#define TC956X_DMA1_VF_MAP  1U
+#define TC956X_DMA2_VF_MAP  2U
+#define TC956X_DMA3_VF_MAP  3U
+#define TC956X_DMA4_VF_MAP  3U
+#define TC956X_DMA5_VF_MAP  0U
+#define TC956X_DMA6_VF_MAP  2U
+#define TC956X_DMA7_VF_MAP  2U
+
+#define TC956X_RXQ0_CH_MAP  3U
+#define TC956X_RXQ1_CH_MAP  3U
+#define TC956X_RXQ2_CH_MAP  4U
+#define TC956X_RXQ3_CH_MAP  3U
+#define TC956X_RXQ4_CH_MAP  8U
+#define TC956X_RXQ5_CH_MAP  8U
+#define TC956X_RXQ6_CH_MAP  8U
+#define TC956X_RXQ7_CH_MAP  3U
+
+
+/************************* TC956X_SRIOV_PF Ends *************************/
+
+
+#elif defined(TC956X_SRIOV_PF) && !defined(TC956X_CPE_CONFIG)
+
+/***************** Automotive and Port Bridge Config Starts *************/
+
+
+#if defined(TC956X_DMA_OFFLOAD_ENABLE)
+#define TX_DMA_CH0_OWNER USE_IN_TC956X_SW
+#define TX_DMA_CH1_OWNER NOT_USED
+#define TX_DMA_CH2_OWNER USE_IN_TC956X_SW
+#define TX_DMA_CH3_OWNER USE_IN_TC956X_SW
+#define TX_DMA_CH4_OWNER USE_IN_TC956X_SW
+#define TX_DMA_CH5_OWNER USE_IN_TC956X_SW
+#define TX_DMA_CH6_OWNER USE_IN_TC956X_SW
+#define TX_DMA_CH7_OWNER USE_IN_TC956X_SW
+
+#define RX_DMA_CH0_OWNER USE_IN_TC956X_SW
+#define RX_DMA_CH1_OWNER NOT_USED
+#define RX_DMA_CH2_OWNER USE_IN_TC956X_SW
+#define RX_DMA_CH3_OWNER USE_IN_TC956X_SW
+#define RX_DMA_CH4_OWNER USE_IN_TC956X_SW
+#define RX_DMA_CH5_OWNER USE_IN_TC956X_SW
+#define RX_DMA_CH6_OWNER USE_IN_TC956X_SW
+#define RX_DMA_CH7_OWNER USE_IN_TC956X_SW
+#endif
+#define TC956X_DMA_RX_AIS  BIT(14)
+#define TC956X_DMA_RX_FBE  BIT(12)
+#define TC956X_DMA_RX_RPS  BIT(8)
+#define MAX_TX_QUEUES_TO_USE	8
+#define MAX_RX_QUEUES_TO_USE	8
+
+/* Tx Queue Size*/
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+#define TX_QUEUE0_SIZE	18432
+#define TX_QUEUE1_SIZE	0
+#define TX_QUEUE2_SIZE	18432
+#define TX_QUEUE3_SIZE	0
+#define TX_QUEUE4_SIZE	1024
+#define TX_QUEUE5_SIZE	2048
+#define TX_QUEUE6_SIZE	2048
+#define TX_QUEUE7_SIZE	4096
+#else
+#define TX_QUEUE0_SIZE	18432
+#define TX_QUEUE1_SIZE	14336
+#define TX_QUEUE2_SIZE	0
+#define TX_QUEUE3_SIZE	0
+#define TX_QUEUE4_SIZE	1024
+#define TX_QUEUE5_SIZE	4096
+#define TX_QUEUE6_SIZE	4096
+#define TX_QUEUE7_SIZE	4096
+#endif
+
+/* TX Queue 0: Legacy and Jumbo packets */
+#define TX_QUEUE0_MODE		MTL_QUEUE_DCB
+/* TX Queue 1: Legacy */
+#define TX_QUEUE1_MODE		MTL_QUEUE_DCB
+/* TX Queue 2: Legacy */
+#define TX_QUEUE2_MODE		MTL_QUEUE_DISABLE
+/* TX Queue 3: Legacy */
+#define TX_QUEUE3_MODE		MTL_QUEUE_DISABLE
+/* TX Queue 4: Untagged PTP */
+#define TX_QUEUE4_MODE		MTL_QUEUE_DCB
+/* TX Queue 5: AVB Class B AVTP packet */
+#define TX_QUEUE5_MODE		MTL_QUEUE_AVB
+/* TX Queue 6: AVB Class A AVTP packet */
+#define TX_QUEUE6_MODE		MTL_QUEUE_AVB
+/* TX Queue 7: TSN Class CDT packet */
+#if defined(TSN_DEMO_AUTOMOTIVE)
+#define TX_QUEUE7_MODE		MTL_QUEUE_DCB
+#else
+#define TX_QUEUE7_MODE		MTL_QUEUE_AVB
+#endif
+
+/* Tx Queue TBS Enable/Disable */
+#define TX_QUEUE0_TBS		0
+#define TX_QUEUE1_TBS		0
+#define TX_QUEUE2_TBS		0
+#define TX_QUEUE3_TBS		0
+#define TX_QUEUE4_TBS		0
+#define TX_QUEUE5_TBS		1
+#define TX_QUEUE6_TBS		1
+#define TX_QUEUE7_TBS		1
+
+/* Tx Queue TSO Enable/Disable */
+#define TX_QUEUE0_TSO		1
+#define TX_QUEUE1_TSO		1
+#define TX_QUEUE2_TSO		0
+#define TX_QUEUE3_TSO		0
+#define TX_QUEUE4_TSO		0
+#define TX_QUEUE5_TSO		0
+#define TX_QUEUE6_TSO		0
+#define TX_QUEUE7_TSO		0
+
+/* Configure TxQueue - Traffic Class mapping */
+#define TX_QUEUE0_TC	0x0
+#define TX_QUEUE1_TC	0x0
+#define TX_QUEUE2_TC	0x0
+#define TX_QUEUE3_TC	0x0
+#define TX_QUEUE4_TC	0x1
+#define TX_QUEUE5_TC	0x2
+#define TX_QUEUE6_TC	0x3
+#define TX_QUEUE7_TC	0x4
+
+
+/*
+ * RX Queue 0: Unicast/Untagged Packets - Packets with
+ * unique MAC Address of Host/Guest OS DMA channel selection will be based on
+ * MAC_Address(#i)_High.DCS
+ */
+#define RX_QUEUE0_MODE		MTL_QUEUE_DCB
+/* RX Queue 1: VLAN Tagged Legacy packets- Pkt routing will be based on VLAN */
+/* Queue is used for MAC2MAC Usecase */
+#define RX_QUEUE1_MODE		MTL_QUEUE_DCB
+/* RX Queue 2: Untagged gPTP packets */
+#define RX_QUEUE2_MODE		MTL_QUEUE_DCB
+/* RX Queue 3: Untagged AV Control packets */
+#define RX_QUEUE3_MODE		MTL_QUEUE_AVB
+/* RX Queue 4: AVB Class B AVTP packets */
+#define RX_QUEUE4_MODE		MTL_QUEUE_AVB
+/* RX Queue 5: AVB Class A AVTP packets */
+#define RX_QUEUE5_MODE		MTL_QUEUE_AVB
+/* RX Queue 6:TSN  Class CDT packets */
+#define RX_QUEUE6_MODE		MTL_QUEUE_AVB
+/* RX Queue 7: Broadcast/Multicast packets */
+#define RX_QUEUE7_MODE		MTL_QUEUE_DCB
+
+/* Rx Queue Size */
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+#define RX_QUEUE0_SIZE	18432
+#define RX_QUEUE1_SIZE	18432
+#define RX_QUEUE2_SIZE	1024
+#define RX_QUEUE3_SIZE	1024
+#define RX_QUEUE4_SIZE	2048
+#define RX_QUEUE5_SIZE	1024
+#define RX_QUEUE6_SIZE	1024
+#define RX_QUEUE7_SIZE	4096
+#else
+#define RX_QUEUE0_SIZE	18432
+#define RX_QUEUE1_SIZE	4096
+#define RX_QUEUE2_SIZE	1024
+#define RX_QUEUE3_SIZE	1024
+#define RX_QUEUE4_SIZE	4096
+#define RX_QUEUE5_SIZE	4096
+#define RX_QUEUE6_SIZE	4096
+#define RX_QUEUE7_SIZE	4096
+#endif
+/* Rx Queue Packet Routing */
+#define RX_QUEUE0_PKT_ROUTE	PACKET_UPQ
+#define RX_QUEUE1_PKT_ROUTE	0
+#define RX_QUEUE2_PKT_ROUTE	PACKET_PTPQ
+#define RX_QUEUE3_PKT_ROUTE	PACKET_AVCPQ
+/* Queue 4,5,6 Routed based on Packet Priority Configured in
+ * MAC_RxQ_Ctrl2/MAC_RxQ_Ctrl3
+ */
+#define RX_QUEUE4_PKT_ROUTE	0
+#define RX_QUEUE5_PKT_ROUTE	0
+#define RX_QUEUE6_PKT_ROUTE	0
+#define RX_QUEUE7_PKT_ROUTE	PACKET_MCBCQ
+
+
+/* Unicast/Untagged packet */
+#define LEG_UNTAGGED_PACKET	TC956X_DA_MAP
+/* VLAN tagged packets */
+#define LEG_TAGGED_PACKET	TC956X_DA_MAP
+/* Untagged gPTP packet */
+#define UNTAGGED_GPTP_PACKET	4
+/* Untagged AV Control Packet */
+#define UNTAGGED_AVCTRL_PACKET	3
+/* Class B AVB Packet */
+#define AVB_CLASS_B_PACKET	5
+/* Class A AVB Packet */
+#define AVB_CLASS_A_PACKET	6
+/* TSN Class CDT Packet */
+#define TSN_CLASS_CDT_PACKET	7
+/* Broadcast/Multicast packet */
+#define BC_MC_PACKET		TC956X_DA_MAP
+
+#define TX_QUEUE0_USE_PRIO	true
+#define TX_QUEUE1_USE_PRIO	true
+#define TX_QUEUE2_USE_PRIO	true
+#define TX_QUEUE3_USE_PRIO	true
+#define TX_QUEUE4_USE_PRIO	false
+#define TX_QUEUE5_USE_PRIO	false
+#define TX_QUEUE6_USE_PRIO	false
+#define TX_QUEUE7_USE_PRIO	false
+
+#define TX_QUEUE0_PRIO		0xFF	/* TC0 Priority */
+#define TX_QUEUE1_PRIO		0xFF
+#define TX_QUEUE2_PRIO		0xFF
+#define TX_QUEUE3_PRIO		0xFF
+#define TX_QUEUE4_PRIO		0x00
+#define TX_QUEUE5_PRIO		0x00
+#define TX_QUEUE6_PRIO		0x00
+#define TX_QUEUE7_PRIO		0x00
+
+/* Rx Queue Use Priority */
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+/* RXQ0 used for Host unicast/untagged and vlan tagged packets
+RXQ1 used for MAC2MAC */
+#define RX_QUEUE0_USE_PRIO		true
+#define RX_QUEUE1_USE_PRIO		false
+#else
+#define RX_QUEUE0_USE_PRIO		false
+#define RX_QUEUE1_USE_PRIO		true
+#endif
+#define RX_QUEUE2_USE_PRIO		false
+#define RX_QUEUE3_USE_PRIO		false
+#define RX_QUEUE4_USE_PRIO		true
+#define RX_QUEUE5_USE_PRIO		true
+#define RX_QUEUE6_USE_PRIO		true
+#define RX_QUEUE7_USE_PRIO		false
+
+/* Rx Queue VLAN tagged Priority mapping */
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+#define RX_QUEUE0_PRIO		0xFF
+#define RX_QUEUE1_PRIO		0
+#else
+#define RX_QUEUE0_PRIO		0
+#define RX_QUEUE1_PRIO		0xFF
+#endif
+#define RX_QUEUE2_PRIO		0
+#define RX_QUEUE3_PRIO		0
+#define RX_QUEUE4_PRIO		(1 << TC956X_AVB_PRIORITY_CLASS_B)
+#define RX_QUEUE5_PRIO		(1 << TC956X_AVB_PRIORITY_CLASS_A)
+#define RX_QUEUE6_PRIO		(1 << TC956X_PRIORITY_CLASS_CDT)
+#define RX_QUEUE7_PRIO		0
+
+#define EEPROM_OFFSET		0
+#define EEPROM_MAC_COUNT	14 //2
+
+/* DMA Ch allocation in tx-rx pairs for PF & VF */
+#define TC956X_PF_CH_ALLOC	0xFF	/* PF - All Channels */
+#define TC956X_VF0_CH_ALLOC	0x00	/* VF0 - NA */
+#define TC956X_VF1_CH_ALLOC	0x00	/* VF1 - NA */
+#define TC956X_VF2_CH_ALLOC	0x00	/* VF2 - NA */
+
+#ifdef TC956X_AUTOMOTIVE_CONFIG
+#define TC956X_RXQ0_CH_MAP  0U
+#define TC956X_RXQ1_CH_MAP  0U
+#define TC956X_RXQ2_CH_MAP  4U
+#define TC956X_RXQ3_CH_MAP  3U
+#define TC956X_RXQ4_CH_MAP  5U
+#define TC956X_RXQ5_CH_MAP  6U
+#define TC956X_RXQ6_CH_MAP  7U
+#define TC956X_RXQ7_CH_MAP  0U
+#else
+#define TC956X_RXQ0_CH_MAP  0U
+#define TC956X_RXQ1_CH_MAP  2U
+#define TC956X_RXQ2_CH_MAP  4U
+#define TC956X_RXQ3_CH_MAP  3U
+#define TC956X_RXQ4_CH_MAP  5U
+#define TC956X_RXQ5_CH_MAP  6U
+#define TC956X_RXQ6_CH_MAP  7U
+#define TC956X_RXQ7_CH_MAP  0U
+#endif
+
+
+/***************** Automotive and Port Bridge Config Ends ***************/
+
+#elif defined TC956X_SRIOV_VF
+
+/************************ TC956X_SRIOV_VF Starts ************************/
+#define MAX_TX_QUEUES_TO_USE 8
+#define MAX_RX_QUEUES_TO_USE 8
+
+#define MAX_FUNCS_PER_PF 4
+#define TX_TC_ZERO		0x0
+#define TC956X_DMA_CH0_MASK 0x01
+
+#define EEPROM_PORT_OFFSET	((MAC_PORT_NUM_CHECK) ? \
+					(EEPROM_VF_SLOT_OFST1) : (EEPROM_VF_SLOT_OFST2))
+
+#define EEPROM_VF_SLOT_OFST1	2
+#define EEPROM_VF_SLOT_OFST2	3
+
+/************************** TC956X_SRIOV_VF Ends ************************/
+
+#else /* TC956X_SRIOV_PF */
+
+#ifdef TC956X
+/*************************** CPE Config Starts **************************/
+
+/* TC956X_CPE_CONFIG usecase Configruations */
+
+#define TX_DMA_CH0_OWNER USE_IN_TC956X_SW
+#define TX_DMA_CH1_OWNER NOT_USED
+#define TX_DMA_CH2_OWNER NOT_USED
+#define TX_DMA_CH3_OWNER NOT_USED
+#define TX_DMA_CH4_OWNER NOT_USED
+#define TX_DMA_CH5_OWNER NOT_USED
+#define TX_DMA_CH6_OWNER NOT_USED
+#define TX_DMA_CH7_OWNER NOT_USED
+
+#define RX_DMA_CH0_OWNER USE_IN_TC956X_SW
+#define RX_DMA_CH1_OWNER NOT_USED
+#define RX_DMA_CH2_OWNER NOT_USED
+#define RX_DMA_CH3_OWNER NOT_USED
+#define RX_DMA_CH4_OWNER NOT_USED
+#define RX_DMA_CH5_OWNER NOT_USED
+#define RX_DMA_CH6_OWNER NOT_USED
+#define RX_DMA_CH7_OWNER NOT_USED
+
+#define MAX_TX_QUEUES_TO_USE 2
+#define MAX_RX_QUEUES_TO_USE 2
+
+/* Tx Queue Size*/
+#define TX_QUEUE0_SIZE		18432
+#define TX_QUEUE1_SIZE		18432
+#define TX_QUEUE2_SIZE		0
+#define TX_QUEUE3_SIZE		0
+#define TX_QUEUE4_SIZE		0
+#define TX_QUEUE5_SIZE		0
+#define TX_QUEUE6_SIZE		0
+#define TX_QUEUE7_SIZE		0
+
+/* TX Queue 0: Legacy and Jumbo packets */
+#define TX_QUEUE0_MODE		MTL_QUEUE_DCB
+/* TX Queue 1: Legacy */
+#define TX_QUEUE1_MODE		MTL_QUEUE_DCB
+/* TX Queue 2: Legacy */
+#define TX_QUEUE2_MODE		MTL_QUEUE_DISABLE
+/* TX Queue 3: Legacy */
+#define TX_QUEUE3_MODE		MTL_QUEUE_DISABLE
+/* TX Queue 4: Untagged PTP */
+#define TX_QUEUE4_MODE		MTL_QUEUE_DISABLE
+/* TX Queue 5: AVB Class B AVTP packet */
+#define TX_QUEUE5_MODE		MTL_QUEUE_DISABLE
+/* TX Queue 6: AVB Class A AVTP packet */
+#define TX_QUEUE6_MODE		MTL_QUEUE_DISABLE
+/* TX Queue 7: TSN Class CDT packet */
+#define TX_QUEUE7_MODE		MTL_QUEUE_DISABLE
+
+/* Tx Queue TBS Enable/Disable */
+#define TX_QUEUE0_TBS		0
+#define TX_QUEUE1_TBS		0
+#define TX_QUEUE2_TBS		0
+#define TX_QUEUE3_TBS		0
+#define TX_QUEUE4_TBS		0
+#define TX_QUEUE5_TBS		0
+#define TX_QUEUE6_TBS		0
+#define TX_QUEUE7_TBS		0
+
+/* Tx Queue TSO Enable/Disable */
+#define TX_QUEUE0_TSO		1
+#define TX_QUEUE1_TSO		0
+#define TX_QUEUE2_TSO		0
+#define TX_QUEUE3_TSO		0
+#define TX_QUEUE4_TSO		0
+#define TX_QUEUE5_TSO		0
+#define TX_QUEUE6_TSO		0
+#define TX_QUEUE7_TSO		0
+
+/* Configure TxQueue - Traffic Class mapping */
+#define TX_QUEUE0_TC	0x0
+#define TX_QUEUE1_TC	0x1
+#define TX_QUEUE2_TC	0x0
+#define TX_QUEUE3_TC	0x0
+#define TX_QUEUE4_TC	0x0
+#define TX_QUEUE5_TC	0x0
+#define TX_QUEUE6_TC	0x0
+#define TX_QUEUE7_TC	0x0
+
+
+/* Rx Queue Size */
+#define RX_QUEUE0_SIZE		18432
+#define RX_QUEUE1_SIZE		18432
+#define RX_QUEUE2_SIZE		0
+#define RX_QUEUE3_SIZE		0
+#define RX_QUEUE4_SIZE		0
+#define RX_QUEUE5_SIZE		0
+#define RX_QUEUE6_SIZE		0
+#define RX_QUEUE7_SIZE		0
+
+/*
+ * RX Queue 0: Unicast/Untagged Packets - Packets with
+ * unique MAC Address of Host/Guest OS DMA channel selection will be based on
+ * MAC_Address(#i)_High.DCS
+ */
+#define RX_QUEUE0_MODE		MTL_QUEUE_DCB
+/* RX Queue 1: VLAN Tagged Legacy packets - Pkt routing will be based on VLAN */
+#define RX_QUEUE1_MODE		MTL_QUEUE_DCB
+/* RX Queue 2: Untagged gPTP packets */
+#define RX_QUEUE2_MODE		MTL_QUEUE_DISABLE
+/* RX Queue 3: Untagged AV Control packets */
+#define RX_QUEUE3_MODE		MTL_QUEUE_DISABLE
+/* RX Queue 4: AVB Class B AVTP packets */
+#define RX_QUEUE4_MODE		MTL_QUEUE_DISABLE
+/* RX Queue 5: AVB Class A AVTP packets */
+#define RX_QUEUE5_MODE		MTL_QUEUE_DISABLE
+/* RX Queue 6:TSN  Class CDT packets */
+#define RX_QUEUE6_MODE		MTL_QUEUE_DISABLE
+/* RX Queue 7: Broadcast/Multicast packets */
+#define RX_QUEUE7_MODE		MTL_QUEUE_DISABLE
+
+/* Rx Queue Packet Routing */
+#define RX_QUEUE0_PKT_ROUTE	PACKET_MCBCQ
+#define RX_QUEUE1_PKT_ROUTE	PACKET_UPQ
+#define RX_QUEUE2_PKT_ROUTE	0
+#define RX_QUEUE3_PKT_ROUTE	0
+#define RX_QUEUE4_PKT_ROUTE	0
+#define RX_QUEUE5_PKT_ROUTE	0
+#define RX_QUEUE6_PKT_ROUTE	0
+#define RX_QUEUE7_PKT_ROUTE	0
+
+
+/* Packet Type - Rx DMA channel static mapping */
+/* Unicast/Untagged packet */
+#define LEG_UNTAGGED_PACKET	TC956X_DA_MAP
+
+/* VLAN tagged packets
+ * For static mapping, route to RxCh0
+ */
+#define LEG_TAGGED_PACKET	TC956X_DA_MAP
+
+/* Untagged gPTP packet */
+#define UNTAGGED_GPTP_PACKET	4	/*Not used in CPE case */
+
+/* Untagged AV Control Packet */
+#define UNTAGGED_AVCTRL_PACKET	3	/*Not used in CPE case */
+
+/* Class B AVB Packet */
+#define AVB_CLASS_B_PACKET	5	/*Not used in CPE case */
+
+/* Class A AVB Packet */
+#define AVB_CLASS_A_PACKET	6	/*Not used in CPE case */
+
+/* TSN Class CDT Packet */
+#define TSN_CLASS_CDT_PACKET	7	/*Not used in CPE case */
+
+/* Broadcast/Multicast packet */
+#define BC_MC_PACKET		TC956X_DA_MAP
+
+
+#define TX_QUEUE0_USE_PRIO	false
+#define TX_QUEUE1_USE_PRIO	false
+#define TX_QUEUE2_USE_PRIO	false
+#define TX_QUEUE3_USE_PRIO	false
+#define TX_QUEUE4_USE_PRIO	false
+#define TX_QUEUE5_USE_PRIO	false
+#define TX_QUEUE6_USE_PRIO	false
+#define TX_QUEUE7_USE_PRIO	false
+
+#define TX_QUEUE0_PRIO		0x00	/* TC0 Priority */
+#define TX_QUEUE1_PRIO		0x00
+#define TX_QUEUE2_PRIO		0x00
+#define TX_QUEUE3_PRIO		0x00
+#define TX_QUEUE4_PRIO		0x00
+#define TX_QUEUE5_PRIO		0x00
+#define TX_QUEUE6_PRIO		0x00
+#define TX_QUEUE7_PRIO		0x00
+
+
+/* Rx Queue Use Priority */
+#define RX_QUEUE0_USE_PRIO	false
+#define RX_QUEUE1_USE_PRIO	true
+#define RX_QUEUE2_USE_PRIO	false
+#define RX_QUEUE3_USE_PRIO	false
+#define RX_QUEUE4_USE_PRIO	false
+#define RX_QUEUE5_USE_PRIO	false
+#define RX_QUEUE6_USE_PRIO	false
+#define RX_QUEUE7_USE_PRIO	false
+
+/* Rx Queue VLAN tagged Priority mapping */
+#define RX_QUEUE0_PRIO		0
+#define RX_QUEUE1_PRIO		0xFF
+#define RX_QUEUE2_PRIO		0
+#define RX_QUEUE3_PRIO		0
+#define RX_QUEUE4_PRIO		0
+#define RX_QUEUE5_PRIO		0
+#define RX_QUEUE6_PRIO		0
+#define RX_QUEUE7_PRIO		0
+
+#define EEPROM_OFFSET		0
+#define EEPROM_MAC_COUNT	2
+
+/* DMA Ch allocation in tx-rx pairs for PF & VF */
+#define TC956X_PF_CH_ALLOC	0xFF	/* PF - All Channels */
+#define TC956X_VF0_CH_ALLOC	0x00	/* VF0 - NA */
+#define TC956X_VF1_CH_ALLOC	0x00	/* VF1 - NA */
+#define TC956X_VF2_CH_ALLOC	0x00	/* VF2 - NA */
+
+#define TC956X_RXQ0_CH_MAP  0U
+#define TC956X_RXQ1_CH_MAP  1U
+#define TC956X_RXQ2_CH_MAP  0U
+#define TC956X_RXQ3_CH_MAP  0U
+#define TC956X_RXQ4_CH_MAP  0U
+#define TC956X_RXQ5_CH_MAP  0U
+#define TC956X_RXQ6_CH_MAP  0U
+#define TC956X_RXQ7_CH_MAP  0U
+
+/**************************** CPE Config Ends ***************************/
+
+#endif /* TC956X */
+#endif /* TC956X_SRIOV_PF */
+
+/* PCI new class code  */
+#define PCI_ETHC_CLASS_CODE		0x020000
+
+#ifdef TC956X
+#define MAC0_BASE_OFFSET		0x40000/* eMAC0 Base Offset */
+#define MAC1_BASE_OFFSET		0x48000 /* eMAC1 Base Offset */
+#else
+#define MAC0_BASE_OFFSET		0xA000/* eMAC0 Base Offset */
+#define MAC1_BASE_OFFSET		0xA000 /* eMAC1 Base Offset */
+#endif
+
+#define TC956X_PTP_SYSCLOCK		250000000 /* System clock is 250MHz */
+#define TC956X_TARGET_PTP_CLK	50000000
+
+/* Debug prints */
+#define NMSGPR_INFO(dev, x...)		dev_info(dev, x)
+#define NMSGPR_ALERT(dev, x...)		dev_alert(dev, x)
+#define NMSGPR_ERR(dev, x...)		dev_err(dev, x)
+
+//#define TC956X_DBG_FUNC
+//#define TC956X_DBG_PTP
+//#define TC956X_DBG_TSN
+//#define TC956X_DBG_MDIO
+//#define TC956X_DBG_ETHTOOL
+//#define TC956X_DBG_L1
+//#define TC956X_DBG_L2
+//#define TC956X_TEST
+//#define TC956X_MSI_GEN_SW_AGENT /*Macro to enable and handle SW MSI interrupt*/
+//#define TC956X_TEST_RXCH1_FRP_DISABLED
+//#define TC956X_PKT_DUP
+#define TC956X_FRP_ENABLE
+
+
+#ifdef TC956X_DBG_PTP
+#define DBGPR_FUNC_PTP(x...)	pr_alert(x)
+#else
+#define DBGPR_FUNC_PTP(x...)	do { } while (0)
+#endif
+
+#ifdef TC956X_DBG_TSN
+#define DBGPR_FUNC_TSN(x...)	pr_alert(x)
+#else
+#define DBGPR_FUNC_TSN(x...)	do { } while (0)
+#endif
+
+#ifdef TC956X_DBG_MDIO
+#define DBGPR_FUNC_MDIO(x...)	pr_alert(x)
+#else
+#define DBGPR_FUNC_MDIO(x...)	do { } while (0)
+#endif
+
+#ifdef TC956X_DBG_ETHTOOL
+#define DBGPR_FUNC_ETHTOOL(x...)	pr_alert(x)
+#else
+#define DBGPR_FUNC_ETHTOOL(x...)	do { } while (0)
+#endif
+
+#ifdef TC956X_SRIOV_VF
+/* TC956X Semaphore lock/unlock register */
+#define NSEM(reg)					(0x1100 + (reg * 4))
+/* TC956X Semaphore read register */
+#define NSEM_RD(reg)				(0x1140 + (reg * 4))
+
+#endif
+
+//#define TC956X_DBG_FUNC
+#define TC956X_TEST
+#define TC956X_DBG_L1
+#define TC956X_DBG_L2
+
+
+//#define TC956X_KPRINT_DEBUG_L1
+#define TC956X_KPRINT_INFO
+#define TC956X_KPRINT_NOTICE
+#define TC956X_KPRINT_WARNING
+#define TC956X_KPRINT_ERR
+#define TC956X_KPRINT_CRIT
+#define TC956X_KPRINT_ALERT
+
+
+/* Debug prints */
+#define NMSGPR_INFO(dev, x...)  dev_info(dev, x)
+#define NMSGPR_ALERT(dev, x...) dev_alert(dev, x)
+#define NMSGPR_ERR(dev, x...)   dev_err(dev, x)
+
+#ifdef TC956X_DBG_FUNC
+#define DBGPR_FUNC(dev, x...) dev_alert(dev, x)
+#else
+#define DBGPR_FUNC(dev, x...) do { } while (0)
+#endif
+#ifdef TC956X_TEST
+#define DBGPR_TEST(dev, x...) dev_alert(dev, x)
+#else
+#define DBGPR_TEST(dev, x...) do { } while (0)
+#endif
+
+#ifdef TC956X_DBG_L1
+#define NDBGPR_L1(dev, x...) dev_dbg(dev, x)
+#else
+#define NDBGPR_L1(dev, x...) do { } while (0)
+#endif
+
+#ifdef TC956X_DBG_L2
+#define NDBGPR_L2(dev, x...) dev_dbg(dev, x)
+#else
+#define NDBGPR_L2(dev, x...) do { } while (0)
+#endif
+
+/* Kernel Print without dev */
+#ifdef TC956X_KPRINT_DEBUG_L2
+#define KPRINT_DEBUG2(x...) printk(KERN_DEBUG x)
+#else
+#define KPRINT_DEBUG2(x...) do { } while (0)
+#endif
+
+#ifdef TC956X_KPRINT_DEBUG_L1
+#define KPRINT_DEBUG1(x...) printk(KERN_DEBUG x)
+#else
+#define KPRINT_DEBUG1(x...) do { } while (0)
+#endif
+
+#ifdef TC956X_KPRINT_INFO
+#define KPRINT_INFO(x...) printk(KERN_INFO x)
+#else
+#define KPRINT_INFO(x...) do { } while (0)
+#endif
+
+#ifdef TC956X_KPRINT_NOTICE
+#define KPRINT_NOTICE(x...) printk(KERN_NOTICE x)
+#else
+#define KPRINT_NOTICE(x...) do { } while (0)
+#endif
+
+#ifdef TC956X_KPRINT_WARNING
+#define KPRINT_WARNING(x...) printk(KERN_WARNING x)
+#else
+#define KPRINT_WARNING(x...) do { } while (0)
+#endif
+
+#ifdef TC956X_KPRINT_ERR
+#define KPRINT_ERR(x...) printk(KERN_ERR x)
+#else
+#define KPRINT_ERR(x...) do { } while (0)
+#endif
+
+#ifdef TC956X_KPRINT_CRIT
+#define KPRINT_CRIT(x...) printk(KERN_CRIT x)
+#else
+#define KPRINT_CRIT(x...) do { } while (0)
+#endif
+
+#ifdef TC956X_KPRINT_ALERT
+#define KPRINT_ALERT(x...) printk(KERN_ALERT x)
+#else
+#define KPRINT_ALERT(x...) do { } while (0)
+#endif
+
+
+#define SPEED_1GBPS		(1000) /* 1Gbps Interms of MBPS */
+#define SPEED_10GBPS		(10000) /* 10Gbps Interms of MBPS */
+
+//#define RSC_MNG_OFFSET		0x2000
+//#define RSCMNG_ID_REG		((RSC_MNG_OFFSET) + 0x00000000)
+#define RSCMNG_PFN		GENMASK(3, 0)
+#define RSCMNG_PFN_SHIFT	0
+
+/*	Configuration Register Address	*/
+#define NCID_OFFSET		(0x0000) /* TC956X Chip and revision ID */
+#define NMODESTS_OFFSET		(0x0004) /* TC956X current operation mode */
+#define NFUNCEN0_OFFSET		(0x0008) /* TC956X pin mux control */
+#define NPCIEBOOT_OFFSET	(0x0018) /* TC956X PCIE Boot HW Sequence Status and Control */
+
+/* Pinmux for PPS Out PPO01 and PPO11*/
+#define NFUNCEN0_JTAGEN_MASK	0x40000000U
+#define NFUNCEN0_JTAG_MASK	0x000F0000U
+#define NFUNCEN0_JTAG_SHIFT	16U
+#define FUNCTION1		0x1U
+#define FUNCTION2		0x2U
+#define NFUNCEN4_GPIO2_MASK	0x00000F00U
+#define NFUNCEN4_GPIO2_SHIFT	8U
+#define NFUNCEN4_GPIO4_MASK	0x000F0000
+#define NFUNCEN4_GPIO4_SHIFT	16U
+
+#define NSYSDATA0_OFFSET	(0x0100)
+#define NSYSDATA1_OFFSET	(0x0104)
+
+#ifdef TC956X
+#define NCTLSTS_OFFSET		(0x1000)  /* TC956X control and status */
+#define NCLKCTRL0_OFFSET	(0x1004)  /* TC956X clock control Register-0 */
+#define NCLKCTRL0_MCUCEN	BIT(0)
+#define NCLKCTRL0_INTCEN	BIT(4)
+#define NCLKCTRL0_MAC0TXCEN	BIT(7)
+#define NCLKCTRL0_PCIECEN	BIT(9)
+#define NCLKCTRL0_I2SSPIEN	BIT(12)
+#define NCLKCTRL0_SRMCEM	BIT(13)
+#define NCLKCTRL0_MAC0RXCEN	BIT(14)
+#define NCLKCTRL0_UARTOCEN	BIT(16)
+#define NCLKCTRL0_MSIGENCEN	BIT(18)
+#define NCLKCTRL0_POEPLLCEN	BIT(24)
+#define NCLKCTRL0_SGMPCIEN	BIT(25)
+#define NCLKCTRL0_REFCLKOCEN	BIT(26)
+#define NCLKCTRL0_MAC0125CLKEN	BIT(29)
+#define NCLKCTRL0_MAC0312CLKEN	BIT(30)
+#define NCLKCTRL0_MAC0ALLCLKEN	BIT(31)
+#define NRSTCTRL0_OFFSET	(0x1008)  /* TC956X reset control Register-0 */
+#define NRSTCTRL0_MCURST	BIT(0)
+#define NRSTCTRL0_INTRST	BIT(4)
+#define NRSTCTRL0_MAC0RST	BIT(7)
+#define NRSTCTRL0_PCIERST	BIT(9)
+#define NRSTCTRL0_UART0RST	BIT(16)
+#define NRSTCTRL0_MSIGENRST	BIT(18)
+#define NRSTCTRL0_MAC0PMARST	BIT(30)
+#define NRSTCTRL0_MAC0PONRST	BIT(31)
+#define NCLKCTRL1_OFFSET	(0x100C)  /* TC956X clock control Register-1 for eMAC Port-1*/
+#define NCLKCTRL1_MAC1TXCEN	BIT(7)
+#define NCLKCTRL1_MAC1RXCEN	BIT(14)
+#define NCLKCTRL1_MAC1RMCEN	BIT(15)
+#define NCLKCTRL1_MAC1125CLKEN1	BIT(29)
+#define NCLKCTRL1_MAC1312CLKEN1	BIT(30)
+#define NCLKCTRL1_MAC1ALLCLKEN1	BIT(31)
+#define NRSTCTRL1_OFFSET	(0x1010)  /* TC956X reset control Register-1 for eMAC Port-1*/
+#define NRSTCTRL1_MAC1RST1	BIT(7)
+#define NRSTCTRL1_MAC1PMARST1	BIT(30)
+#define NRSTCTRL1_MAC1PONRST1	BIT(31)
+#define NRSTCTRL_EMAC_MASK     (NRSTCTRL0_MAC0RST | NRSTCTRL0_MAC0PMARST | \
+				 NRSTCTRL0_MAC0PONRST)
+#define NCLKCTRL_EMAC_MASK     (NCLKCTRL0_MAC0TXCEN | NCLKCTRL0_MAC0RXCEN | \
+				 NCLKCTRL0_MAC0125CLKEN | NCLKCTRL0_MAC0312CLKEN | \
+				 NCLKCTRL1_MAC1RMCEN | NCLKCTRL0_MAC0ALLCLKEN)
+#define NCLKCTRL0_COMMON_EMAC_MASK     (NCLKCTRL0_POEPLLCEN | NCLKCTRL0_SGMPCIEN | \
+				 NCLKCTRL0_REFCLKOCEN)
+#if defined(TC956X_CPE_CONFIG)
+#define NRSTCTRL0_DEFAULT	(NRSTCTRL0_MAC0PONRST| NRSTCTRL0_MAC0PMARST | \
+					NRSTCTRL0_MSIGENRST  | NRSTCTRL0_UART0RST | \
+					NRSTCTRL0_MAC0RST | NRSTCTRL0_INTRST | \
+					NRSTCTRL0_MCURST)
+#else
+#define NRSTCTRL0_DEFAULT	(NRSTCTRL0_MAC0PONRST | NRSTCTRL0_MAC0PMARST | \
+					NRSTCTRL0_MAC0RST)
+#endif
+#define NRSTCTRL_COMMON (NRSTCTRL0_MSIGENRST  | NRSTCTRL0_UART0RST | \
+					NRSTCTRL0_INTRST | NRSTCTRL0_MCURST)
+#define NCLKCTRL0_DEFAULT	(NCLKCTRL0_SRMCEM | NCLKCTRL0_I2SSPIEN | \
+					NCLKCTRL0_PCIECEN | NCLKCTRL0_MCUCEN)
+#define NCLKCTRL_ENABLE_COMMON_EMAC_MASK (NCLKCTRL0_SRMCEM | NCLKCTRL0_I2SSPIEN | \
+					NCLKCTRL0_PCIECEN | NCLKCTRL0_MCUCEN)
+#define NCLKCTRL_DISABLE_COMMON_EMAC_MASK (NCLKCTRL0_MAC0ALLCLKEN | NCLKCTRL0_MAC0312CLKEN | \
+								NCLKCTRL0_MAC0125CLKEN | NCLKCTRL0_REFCLKOCEN | \
+								NCLKCTRL0_SGMPCIEN | NCLKCTRL0_POEPLLCEN | \
+								NCLKCTRL0_MSIGENCEN | NCLKCTRL0_UARTOCEN | \
+								NCLKCTRL0_MAC0RXCEN | NCLKCTRL0_MAC0TXCEN | \
+								NCLKCTRL0_INTCEN)
+#define NCLKCTRL_PORT0_EMAC_MASK     (NCLKCTRL0_MAC0TXCEN | NCLKCTRL0_MAC0RXCEN | \
+				 NCLKCTRL0_MAC0125CLKEN | NCLKCTRL0_MAC0312CLKEN | \
+				 NCLKCTRL0_MAC0ALLCLKEN)
+
+#define NBUSCTRL_OFFSET		(0x1014)
+
+#define NRSTCTRL_LINK_DOWN		(NRSTCTRL0_MAC0PMARST | NRSTCTRL0_MAC0PONRST)
+#define NCLKCTRL_LINK_DOWN		(NCLKCTRL0_MAC0TXCEN | NCLKCTRL0_MAC0RXCEN | \
+						NCLKCTRL0_MAC0125CLKEN | NCLKCTRL0_MAC0312CLKEN | \
+						NCLKCTRL1_MAC1RMCEN)
+#define NRSTCTRL_LINK_DOWN_SAVE			(0xC0000080U) /* Save Non-Common Reset Register Bits Between Port 0 and Port 1 */
+#define NCLKCTRL_LINK_DOWN_SAVE			(0xE000C080U) /* Save Non-Common Clock Register Bits Between Port 0 and Port 1 */
+#define NRSTCTRL_LINK_DOWN_CMN_SAVE		(0x00051213U) /* Save Common Reset Register Bits Between Port 0 and Port 1 */
+#define NCLKCTRL_LINK_DOWN_CMN_SAVE		(0x07053211U) /* Save Common Clock Register Bits Between Port 0 and Port 1 */
+
+#define TC956X_MSIGENCEN	18
+
+/* Interrupts to CM3 to be enabled in FW */
+#define TC956X_INT_MASK0	0xFFFF1FFF/*0x00000000*/
+#define TC956X_INT_MASK1	0xFFFF1F80/*0x00000000*/
+#define TC956X_INT_MASK2	0x00007740/*0x00000000*/
+#endif
+
+#define NSPLLPARAM_OFFSET	(0x1020) /* TC956X System PLL parameters */
+#define NSPLLUPDT_OFFSET		(0x1024) /* TC956X System PLL update */
+#define NOSCCTRL_OFFSET		(0x1028) /* TC956X OSC drive strength control */
+
+#define NEMACTXCDLY_OFFSET	(0x1050) /* Integrated Delay on RGMII TXC */
+#define NEMACINTO00EN_OFFSET	(0x1054)
+#define NEMACINTO01EN_OFFSET	(0x1058)
+#define NEMACINTO10EN_OFFSET	(0x105C)
+#define NEMACINTO11EN_OFFSET	(0x1060)
+
+#ifdef TC956X
+#define NEMAC0CTL_OFFSET	(0x1070) /* eMAC Port-0 Control */
+#endif
+
+#ifdef TC956X_SRIOV_PF
+/* MSIGEN Registers */
+
+#define MSI_INT_TX_CH0		3
+#define MSI_INT_RX_CH0		11
+
+#define MSI_INT_EXT_PHY		20
+
+#define TC956X_MSI_BASE		(0xF000)
+
+#define TC956X_MSI_F_OFFSET		(0x0100)
+#define TC956X_MSI_OUT_EN_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0000))
+#define TC956X_MSI_MASK_SET_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0008))
+#define TC956X_MSI_INT_RAW_STS_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE + \
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0014))
+#define TC956X_MSI_STS_OFFSET(pf_id, vf_id)		(TC956X_MSI_BASE + \
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0018))
+#define TC956X_MSI_MASK_CLR_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x000c))
+#define TC956X_MSI_INT_STS_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0010))
+#define TC956X_MSI_VECT_SET0_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0020))
+#define TC956X_MSI_VECT_SET1_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0024))
+#define TC956X_MSI_VECT_SET2_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0028))
+#define TC956X_MSI_VECT_SET3_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x002C))
+#define TC956X_MSI_VECT_SET4_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0030))
+#define TC956X_MSI_VECT_SET5_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0034))
+#define TC956X_MSI_VECT_SET6_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0038))
+#define TC956X_MSI_VECT_SET7_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x003C))
+#define TC956X_MSI_SW_MSI_CLR(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0054))
+#define TC956X_MSI_EVENT_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0068))
+
+#define TC956X_MSI_CNT0(pf_id, vf_id)			(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0080))
+#define TC956X_MSI_CNT1(pf_id, vf_id)			(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0084))
+#define TC956X_MSI_CNT2(pf_id, vf_id)			(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0088))
+#define TC956X_MSI_CNT3(pf_id, vf_id)			(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x008C))
+#define TC956X_MSI_CNT4(pf_id, vf_id)			(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x0090))
+#define TC956X_MSI_CNT11(pf_id, vf_id)			(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x00AC))
+#define TC956X_MSI_CNT12(pf_id, vf_id)			(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x00B0))
+#define TC956X_MSI_CNT20(pf_id, vf_id)			(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x00D0))
+#define TC956X_MSI_CNT24(pf_id, vf_id)			(TC956X_MSI_BASE +\
+						(vf_id * TC956X_MSI_F_OFFSET) + (pf_id * TC956X_MSI_F_OFFSET) + (0x00E0))
+
+#define TC956X_MSI_OUT_EN_CLR	(0x00000000)
+
+/* Enabled LPI_INT, EVENT_INT, TX_INT[3], TX_INT[4], RX_INT[3], RX_INT[4]
+ * XPCS_INT, PFMAILBOX_INT
+ * INT 6, 7, 14, 15 is allocated to MSI Vector 1.
+ * All other enabled INT to Vector 0.
+ */
+
+#if defined(TC956X_AUTOMOTIVE_CONFIG)
+#ifdef TC956X_LPI_INTERRUPT
+#define TC956X_MSI_OUT_EN (0x0017FFF9)
+#else /* #ifdef TC956X_LPI_INTERRUPT */
+#define TC956X_MSI_OUT_EN (0x0017FFF8)
+#endif /* #ifdef TC956X_LPI_INTERRUPT */
+#elif defined(TC956X_CPE_CONFIG)
+
+#ifdef TC956X_LPI_INTERRUPT
+#define TC956X_MSI_OUT_EN (0x0110181D)
+#else /* #ifdef TC956X_LPI_INTERRUPT */
+#define TC956X_MSI_OUT_EN (0x0110181C)
+#endif /* #ifdef TC956X_LPI_INTERRUPT */
+
+#else /* #if defined(TC956X_AUTOMOTIVE_CONFIG) */
+#define TC956X_MSI_OUT_EN (0x0037FFFD)
+#endif /* #if defined(TC956X_AUTOMOTIVE_CONFIG) */
+
+#define TC956X_MSI_OUT_INTR_EVENT 2
+
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE) || defined(TC956X_CPE_CONFIG)
+#define TC956X_MSI_MASK_SET	(0xFFFFFFFE)
+#define TC956X_MSI_MASK_CLR	(0x00000001)
+#define TC956X_MSI_SET0		(0x00000000)
+#define TC956X_MSI_SET1		(0x00000000)
+#define TC956X_MSI_SET2		(0x00000000)
+#define TC956X_MSI_SET3		(0x00000000)
+#define TC956X_MSI_SET4		(0x00000000)
+#define TC956X_MSI_SET5		(0x00000000)
+#define TC956X_MSI_SET6		(0x00000000)
+#define TC956X_MSI_SET7		(0x00000000)
+#else
+#define TC956X_MSI_MASK_SET	(0xFFFFFFFC)
+#define TC956X_MSI_MASK_CLR	(0x00000003)
+#define TC956X_MSI_SET0		(0x00010101)
+#define TC956X_MSI_SET1		(0x00000000)
+#define TC956X_MSI_SET2		(0x00000000)
+#define TC956X_MSI_SET3		(0x00000000)
+#define TC956X_MSI_SET4		(0x01000000)
+#define TC956X_MSI_SET5		(0x01010101)
+#define TC956X_MSI_SET6		(0x01010101)
+#define TC956X_MSI_SET7		(0x01010101)
+#endif
+
+#endif /* TC956X_SRIOV_PF */
+
+#define NEMAC1CTL_OFFSET	(0x1074) /* eMAC Port-1 Control */
+#define NEMACSTS_OFFSET		(0x1078) /* eMAC status */
+#define NEMACIOCTL_OFFSET	(0x107C) /* eMAC IO Control */
+
+#define NEMACCTL_SP_SEL_MASK			GENMASK(3, 0)
+#define NEMACCTL_INIT_DONE			0x200000
+#define NEMACCTL_LPIHWCLKEN			(0x100)
+#define NEMACCTL_PHY_INF_SEL_MASK		GENMASK(5, 4)
+#define NEMACCTL_PHY_INF_SEL			(0x10)/* Phy_intf_sel : clock from PHY */
+#define NEMACCTL_SP_SEL_SGMII_10M		(0x7) /* SGMII 10M */
+#define NEMACCTL_SP_SEL_SGMII_100M		(0x6) /* SGMII 100M */
+#define NEMACCTL_SP_SEL_SGMII_1000M		(0x5) /* SGMII 1000M */
+#define NEMACCTL_SP_SEL_SGMII_2500M		(0x4) /* SGMII 2500M */
+#define NEMACCTL_SP_SEL_USXGMII_2_5G_2_5G	(0xD) /* USXGMII 2.5G/2.5G */
+#define NEMACCTL_SP_SEL_USXGMII_2_5G_5G		(0xC) /* USXGMII 2.5G/5G */
+#define NEMACCTL_SP_SEL_USXGMII_2_5G_10G	(0xB) /* USXGMII 2.5G/10G */
+#define NEMACCTL_SP_SEL_USXGMII_5G_5G		(0xA) /* USXGMII 5G/5G */
+#define NEMACCTL_SP_SEL_USXGMII_5G_10G		(0x9) /* USXGMII 5G/10G */
+#define NEMACCTL_SP_SEL_USXGMII_10G_10G		(0x8) /* USXGMII 10G/10G */
+#define NEMACCTL_SP_SEL_RGMII_10M		(0x2) /* RGMII 10M */
+#define NEMACCTL_SP_SEL_RGMII_100M		(0x1) /* RGMII 100M */
+#define NEMACCTL_SP_SEL_RGMII_1000M		(0x0) /* RGMII 1000M */
+
+
+#define GPIOI0_OFFSET	(0x1200) /* GPIO Input-0 register */
+#define GPIOI1_OFFSET	(0x1204) /* GPIO Input-1 register */
+#define GPIOE0_OFFSET	(0x1208) /* GPIO Enable-0 register */
+#define GPIOE1_OFFSET	(0x120C) /* GPIO Enable-1 register */
+#define GPIOO0_OFFSET	(0x1210) /* GPIO Output-0 register */
+#define GPIOO1_OFFSET	(0x1214) /* GPIO Output-1 register */
+
+#define NPCIEPWR_OFFSET	(0x1300) /* PCIe power gating control */
+
+#define I2CERRADD_OFFSET	(0x1400)
+#define SPIERRADD_OFFSET	(0x1404)
+#define NFUNCEN1_OFFSET		(0x1514)
+#define NFUNCEN2_OFFSET		(0x151C)
+#define NFUNCEN3_OFFSET		(0x1524)
+#define NFUNCEN4_OFFSET		(0x1528)
+#define NFUNCEN5_OFFSET		(0x152C)
+#define NFUNCEN6_OFFSET		(0x1530)
+#define NFUNCEN7_OFFSET		(0x153C)
+
+#define NFUNCEN_FUNC0		(0)
+#define NFUNCEN_FUNC1		(1)
+#define NFUNCEN_FUNC2		(2)
+#define NFUNCEN4_GPIO_00	GENMASK(3, 0)
+#define NFUNCEN4_GPIO_00_SHIFT	(0)
+#define NFUNCEN4_GPIO_01	GENMASK(7, 4)
+#define NFUNCEN4_GPIO_01_SHIFT	(4)
+#define NFUNCEN4_GPIO_02	GENMASK(11, 8)
+#define NFUNCEN4_GPIO_02_SHIFT	(8)
+#define NFUNCEN4_GPIO_03	GENMASK(15, 12)
+#define NFUNCEN4_GPIO_03_SHIFT	(12)
+#define NFUNCEN4_GPIO_04	GENMASK(19, 16)
+#define NFUNCEN4_GPIO_04_SHIFT	(16)
+#define NFUNCEN4_GPIO_05	GENMASK(23, 20)
+#define NFUNCEN4_GPIO_05_SHIFT	(20)
+#define NFUNCEN4_GPIO_06	GENMASK(27, 24)
+#define NFUNCEN4_GPIO_06_SHIFT	(24)
+#define NFUNCEN5_GPIO_10	GENMASK(3, 0)
+#define NFUNCEN5_GPIO_10_SHIFT	(0)
+#define NFUNCEN5_GPIO_11	GENMASK(7, 4)
+#define NFUNCEN5_GPIO_11_SHIFT	(4)
+#define NFUNCEN6_GPIO_12	GENMASK(19, 16)
+#define NFUNCEN6_GPIO_12_SHIFT	(16)
+#define NFUNCEN7_GPIO_13	GENMASK(3, 0)
+#define NFUNCEN7_GPIO_13_SHIFT	(0)
+
+#define NIOCFG1_OFFSET		(0x1614)
+#define NIOCFG7_OFFSET		(0x163C)
+#define NIOEN7_OFFSET		(0x173C)
+
+#define GPIO_00			(0)
+#define GPIO_01			(1)
+#define GPIO_02			(2)
+#define GPIO_03			(3)
+#define GPIO_04			(4)
+#define GPIO_05			(5)
+#define GPIO_06			(6)
+#define GPIO_10			(10)
+#define GPIO_11			(11)
+#define GPIO_12			(12)
+#define GPIO_13			(13)
+#define GPIO_32			(32)
+
+#define TRIG00_SHIFT		4
+#define TRIG10_SHIFT		12
+#define TRIG00_MASK			0xF0
+#define TRIG10_MASK			0xF000
+#define TSIE_SHIFT			12
+
+/* PCIe registers */
+#define PCIE_OFFSET				(0x20000)
+#define PCIE_RANGE_UP_OFFSET_RgOffAddr(no)	(PCIE_OFFSET + 0x6200 + (no*0x10))
+#define PCIE_RANGE_EN_RgOffAddr(no)		(PCIE_OFFSET + 0x6204 + (no*0x10))
+#define PCIE_RANGE_UP_RPLC_RgOffAddr(no)	(PCIE_OFFSET + 0x6208 + (no*0x10))
+#define PCIE_RANGE_WIDTH_RgOffAddr(no)		(PCIE_OFFSET + 0x620C + (no*0x10))
+
+/* INTC Registers */
+#define INTC_OFFSET		(0x8000)
+#define INTC_INTSTATUS		(INTC_OFFSET)
+#define INTC_MAC0STATUS		(INTC_OFFSET + 0x0C)
+#define INTC_MAC1STATUS		(INTC_OFFSET + 0x10)
+#define INTC_EXTINTFLG		(INTC_OFFSET + 0x14)
+#define INTC_PCIEL12FLG         (INTC_OFFSET + 0x18)
+#define INTC_I2CSPIINTFLG	(INTC_OFFSET + 0x1C)
+
+#define INTMCUMASK0		(INTC_OFFSET + 0x20)
+#define INTMCUMASK1		(INTC_OFFSET + 0x24)
+#define INTMCUMASK2		(INTC_OFFSET + 0x28)
+#define INTMCUMASK3		(INTC_OFFSET + 0x2C)
+#define INTMCUMASK_TX_CH0	16
+#define INTMCUMASK_RX_CH0	24
+
+#define INTC_EXTINTCFG		(INTC_OFFSET + 0x4C)
+#define INTC_MCUFLG		(INTC_OFFSET + 0x54)
+#define INTC_EXTFLG		(INTC_OFFSET + 0x58)
+#define INTC_MACPPOFLG		(INTC_OFFSET + 0x5C)
+#define INTC_INTINTWDCTL	(INTC_OFFSET + 0x60)
+#define INTC_INTINTWDEXP	(INTC_OFFSET + 0x64)
+#define INTC_INTINTWDMON	(INTC_OFFSET + 0x68)
+
+#define MACRXSTS_MASK		(0xFF)
+#define MACTXSTS_MASK		(0xFF0000)
+
+#define INTC_INTSTS_MAC_EVENT	BIT(11)
+
+#define MAC_OFFSET		((MAC_PORT_NUM_CHECK) ? \
+				(MAC0_BASE_OFFSET) : (MAC1_BASE_OFFSET))
+
+#define NEMACCTL_OFFSET	\
+	((MAC_PORT_NUM_CHECK) ? (NEMAC0CTL_OFFSET) : (NEMAC1CTL_OFFSET))
+
+#define INTC_MAC_STATUS	\
+	((MAC_PORT_NUM_CHECK) ? (INTC_MAC0STATUS) : (INTC_MAC1STATUS))
+
+
+
+#ifdef TC956X
+#define TC956X_ETH_XPCS_INT				BIT(19)
+#define TC956X_EXT_PHY_ETH_INT			BIT(20)
+
+#ifdef TC956X_SW_MSI
+#define TC956X_SW_MSI_INT			BIT(24)
+#endif
+
+#define TC956X_SSREG_BRREG_REG_BASE		(0x00024000U)
+
+#define TC956X_GLUE_LOGIC_BASE_OFST		(0x0002C000U)
+
+/*All phy core use the same base address, glue register we need to select correct phy core*/
+#define TC956X_PHY_CORE0_REG_BASE		(0x00028000U)
+#define TC956X_PHY_CORE1_REG_BASE		(0x00028000U)
+#define TC956X_PHY_CORE2_REG_BASE		(0x00028000U)
+#define TC956X_PHY_CORE3_REG_BASE		(0x00028000U)
+
+
+#define TC956X_SSREG_K_PCICONF_015_000		(TC956X_SSREG_BRREG_REG_BASE \
+						+ 0x00000850U)
+#define TC956X_SSREG_K_PCICONF_031_016		(TC956X_SSREG_BRREG_REG_BASE \
+						+ 0x00000854U)
+#define TC956X_SSREG_K_PCICONF_021_021		(TC956X_SSREG_BRREG_REG_BASE \
+						+ 0x000009E4U)
+#define TC956X_SSREG_K_PCICONF_022_022		(TC956X_SSREG_BRREG_REG_BASE \
+						+ 0x000009E8U)
+
+#define TC956X_GLUE_EFUSE_CTRL			(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x0000001CU)
+#define TC956X_GLUE_SW_REG_ACCESS_CTRL		(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x0000002CU)
+#define TC956X_GLUE_PHY_REG_ACCESS_CTRL		(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x00000030U)
+#define TC956X_GLUE_SW_RESET_CTRL		(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x00000044U)
+#define TC956X_GLUE_SW_DSP1_TEST_IN_31_00	(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x0000006CU)
+#define TC956X_GLUE_SW_DSP2_TEST_IN_31_00	(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x00000074U)
+#define TC956X_GLUE_SW_USP_TEST_OUT_127_096	(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x00000098U)
+#define TC956X_GLUE_TL_LINK_SPEED_MON		(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x00000244U)
+#define TC956X_GLUE_TL_NUM_LANES_MON		(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x00000248U)
+#define TC956X_GLUE_RSVD_RW0			(TC956X_GLUE_LOGIC_BASE_OFST \
+						+ 0x0000024CU)
+
+#ifdef TC956X_PCIE_LINK_STATE_LATENCY_CTRL
+#define TC956X_PCIE_S_REG_OFFSET		(0x00024000U)
+#define TC956X_PCIE_S_L0s_ENTRY_LATENCY		(TC956X_PCIE_S_REG_OFFSET \
+						+ 0x0000096CU)
+#define TC956X_PCIE_S_L1_ENTRY_LATENCY		(TC956X_PCIE_S_REG_OFFSET \
+						+ 0x00000970U)
+
+#define TC956X_PCIE_EP_REG_OFFSET		(0x00020000U)
+#define TC956X_PCIE_EP_CAPB_SET			(TC956X_PCIE_EP_REG_OFFSET \
+						+ 0x000000D8U)
+
+#define	TC956X_PCIE_EP_L0s_ENTRY_SHIFT		(13)
+#define	TC956X_PCIE_EP_L1_ENTRY_SHIFT		(18)
+
+#define TC956X_PCIE_EP_L0s_ENTRY_MASK		GENMASK(17, 13)
+#define TC956X_PCIE_EP_L1_ENTRY_MASK		GENMASK(27, 18)
+
+#define TC956X_PCIE_S_EN_ALL_PORTS_ACCESS	(0xF)
+
+/*
+L0s value range: 1-31
+L1 value range : 1-1023
+
+Ex: entry value is n then
+entry delay = n * 256 ns */
+
+/* Link state change delay configuration for Upstream Port */
+#define USP_L0s_ENTRY_DELAY	(0x1FU)
+#define USP_L1_ENTRY_DELAY	(0x3FFU)
+
+/* Link state change delay configuration for Downstream Port-1 */
+#define DSP1_L0s_ENTRY_DELAY	(0x1FU)
+#define DSP1_L1_ENTRY_DELAY	(0x3FFU)
+
+/* Link state change delay configuration for Downstream Port-2 */
+#define DSP2_L0s_ENTRY_DELAY	(0x1FU)
+#define DSP2_L1_ENTRY_DELAY	(0x3FFU)
+
+/* Link state change delay configuration for Virtual Downstream Port */
+#define VDSP_L0s_ENTRY_DELAY	(0x1FU)
+#define VDSP_L1_ENTRY_DELAY	(0x3FFU)
+
+/* Link state change delay configuration for Internal Endpoint */
+#define EP_L0s_ENTRY_DELAY	(0x1FU)
+#define EP_L1_ENTRY_DELAY	(0x3FFU)
+
+#endif /* end of TC956X_PCIE_LINK_STATE_LATENCY_CTRL */
+
+#define TC956X_PHY_COREX_PMACNT_GL_PM_PWRST2_CFG0	(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x0000009CU)
+#define TC956X_PHY_COREX_PMACNT_GL_PM_PWRST2_CFG1	(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x000000A0U)
+#define TC956X_PHY_COREX_PCS_GL_MD_CFG_TXMARGIN0	(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x00000234U)
+#define TC956X_PHY_COREX_PMA_LN_PCS_TAP_ADV_R0		(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x00003148U)
+#define TC956X_PHY_COREX_PMA_LN_PCS_TAP_DLY_R0		(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x0000314CU)
+#define TC956X_PHY_COREX_PMA_LN_PCS_TAP_ADV_R1		(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x000031B4U)
+#define TC956X_PHY_COREX_PMA_LN_PCS_TAP_DLY_R1		(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x000031B8U)
+#define TC956X_PHY_COREX_PMA_LN_PCS_TAP_ADV_R2		(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x00003220U)
+#define TC956X_PHY_COREX_PMA_LN_PCS_TAP_DLY_R2		(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x00003224U)
+#define TC956X_PHY_COREX_PMA_LN_RT_OVREN_PCS_TAP_ADV	(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x000032F0U)
+#define TC956X_PHY_COREX_PMA_LN_RT_OVREN_PCS_TAP_DLY	(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x000032F4U)
+#define TC956X_PHY_COREX_PMACNT_LN_PM_LOSCNT_CNT0	(TC956X_PHY_CORE0_REG_BASE \
+							+ 0x00000844U)
+
+#define TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_RESULT_BEST_MON0	(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000890U)
+#define TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2	(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000A18U)
+#define TC956X_PHY_COREX_PMACNT_LN_PM_EQ_CFG0_R2		(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000A04U)
+#define TC956X_PHY_COREX_PMACNT_LN_PM_EQ_CFG1_R2		(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000A08U)
+#define TC956X_PHY_COREX_PMACNT_LN_PM_EQ1_CFG0_R2		(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000A0CU)
+#define TC956X_PHY_COREX_PMACNT_LN_PM_EQ2_CFG0_R2		(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000A14U)
+#define TC956X_PHY_COREX_PMACNT_GL_PM_DFE_PD_CTRL		(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000254U)
+#define TC956X_PHY_CORE1_PMACNT_GL_PM_DFE_PD_CTRL		(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000244U)
+#define TC956X_PHY_COREX_PMACNT_GL_PM_IF_CNT0			(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000040U)
+#define TC956X_PHY_COREX_PMACNT_GL_PM_IF_CNT4			(TC956X_PHY_CORE0_REG_BASE \
+								+ 0x00000050U)
+
+/* PHY core 0 registers */
+#define TC956X_PHY_CORE0_GL_LANE_ACCESS		(TC956X_PHY_CORE0_REG_BASE \
+						+ 0x00000000U)
+#define TC956X_PHY_CORE0_POWER_CTL		(TC956X_PHY_CORE0_REG_BASE \
+						+ 0x0000309CU)
+#define TC956X_PHY_CORE0_OVEREN_POWER_CTL	(TC956X_PHY_CORE0_REG_BASE \
+						+ 0x000032C8U)
+#define TC956X_PMA_LN_PCS2PMA_PHYMODE_R2	(TC956X_PHY_CORE0_REG_BASE \
+						+ 0x00003268U)
+#define TC956X_PHY_CORE0_MISC_RW0_R0		(TC956X_PHY_CORE0_REG_BASE \
+						+ 0x00000288U)
+#define TC956X_PHY_CORE0_MISC_RW0_R1		(TC956X_PHY_CORE0_REG_BASE \
+						+ 0x000002BCU)
+#define TC956X_PHY_CORE0_MISC_RW0_R2		(TC956X_PHY_CORE0_REG_BASE \
+						+ 0x000002F0U)
+/* PHY core 1 registers */
+#define TC956X_PHY_CORE1_GL_LANE_ACCESS		(TC956X_PHY_CORE1_REG_BASE \
+						+ 0x00000000U)
+#define TC956X_PHY_CORE1_POWER_CTL		(TC956X_PHY_CORE1_REG_BASE \
+						+ 0x0000309CU)
+#define TC956X_PHY_CORE1_OVEREN_POWER_CTL	(TC956X_PHY_CORE1_REG_BASE \
+						+ 0x000032C8U)
+
+#define TC956X_PHY_CORE1_MISC_RW0_R0		(TC956X_PHY_CORE1_REG_BASE \
+						+ 0x00000278U)
+#define TC956X_PHY_CORE1_MISC_RW0_R1		(TC956X_PHY_CORE1_REG_BASE \
+						+ 0x000002A0U)
+#define TC956X_PHY_CORE1_MISC_RW0_R2		(TC956X_PHY_CORE1_REG_BASE \
+						+ 0x000002C8U)
+
+#define TC956X_GLUE_LTSSM_STATE_MASK		(0x0000001FU)
+#define TC956X_GLUE_LTSSM_STATE_SHIFT		(0)
+#define TC956X_GLUE_DLL_MASK			(0x00000020U)
+#define TC956X_GLUE_DLL_SHIFT			(5)
+#define TC956X_GLUE_SPEED_MASK(x)		(0x0000000FU << (8*x))
+#define TC956X_GLUE_SPEED_SHIFT(x)		(8*x)
+
+#define USP_LANE_WIDTH_MASK			(0x0000003F)
+#define DSP1_LANE_WIDTH_MASK			(0x00003F00)
+#define DSP1_LANE_WIDTH_SHIFT			(8)
+#define TC956X_GLUE_LANE_WIDTH_MASK(x)		(0x0000003FU << (8*x))
+#define TC956X_GLUE_LANE_WIDTH_SHIFT(x)		(8*x)
+
+#define USP_LINK_WIDTH_CHANGE_4_TO_1		(0x00000010)
+#define USP_LINK_WIDTH_CHANGE_4_TO_2		(0x00000011)
+#define USP_LINK_WIDTH_CHANGE_1_2_TO_4		(0x00000013)
+#define USP_LINK_WIDTH_CHANGE_2_TO_1		(0x00000010)
+#define USP_LINK_WIDTH_CHANGE_1_TO_2		(0x00000011)
+#define DSP1_LINK_WIDTH_CHANGE_2_TO_1		(0x00100000)
+#define DSP1_LINK_WIDTH_CHANGE_1_TO_2		(0x00110000)
+
+#define SW_PORT_ENABLE_MASK			GENMASK(3, 0)
+#define SW_PORT_ENABLE_SHIFT			0U
+#define SW_USP_ENABLE				(0x00000001)
+#define SW_DSP1_ENABLE				(0x00000002)
+#define SW_DSP2_ENABLE				(0x00000004)
+#define SW_VDSP_ENABLE				(0x00000008)
+
+
+#define PHY_CORE_ENABLE_MASK			GENMASK(3, 0)
+#define PHY_CORE_0_ENABLE			(0x00000001)
+#define PHY_CORE_1_ENABLE			(0x00000002)
+#define PHY_CORE_2_ENABLE			(0x00000004)
+#define PHY_CORE_3_ENABLE			(0x00000008)
+
+
+#define LANE_ENABLE_MASK			GENMASK(1, 0)
+#define LANE_0_ENABLE				(0x00000001)
+#define LANE_1_ENABLE				(0x00000002)
+
+#define POWER_CTL_MASK				GENMASK(24, 0)
+#define POWER_CTL_LOW_POWER_ENABLE		0x00474804
+
+#define POWER_CTL_OVER_ENABLE			0x00000001
+#define PC_DEBUG_P1_TOGGLE			0x00000001
+
+#define ENABLE_CUT_THROUGH_ON_RX_PATH_MASK	0x1U
+#define ENABLE_CUT_THROUGH_ON_TX_PATH_MASK	0x1U
+#endif
+
+/* MSIGEN Registers */
+
+#define MSI_INT_TX_CH0		3
+#define MSI_INT_RX_CH0		11
+#define MSI_INT_EXT_PHY		20
+
+#ifdef TC956X_SW_MSI
+#define MSI_INT_SW_MSI		24
+#endif
+
+#ifdef TC956X_SRIOV_VF //VF_DRV related
+#define TC956X_MSIGENCEN	18
+
+/* MSIGEN Registers */
+#define TC956X_MSI_BASE		(0xF000)
+#define TC956X_MSI_PF0		(0x0000)
+#define TC956X_MSI_PF1		(0x0100)
+
+#define TC956X_MSI_OUT_EN_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300)  + (0x0000))
+#define TC956X_MSI_MASK_SET_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x0008))
+#define TC956X_MSI_MASK_CLR_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x000c))
+#define TC956X_MSI_VECT_SET0_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x0020))
+#define TC956X_MSI_VECT_SET1_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x0024))
+#define TC956X_MSI_VECT_SET2_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x0028))
+#define TC956X_MSI_VECT_SET3_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x002C))
+#define TC956X_MSI_VECT_SET4_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x0030))
+#define TC956X_MSI_VECT_SET5_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x0034))
+#define TC956X_MSI_VECT_SET6_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x0038))
+#define TC956X_MSI_VECT_SET7_OFFSET(pf_id, vf_id)	(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x003C))
+
+#define TC956X_MSI_EVENT_OFFSET(pf_id, vf_id)		(TC956X_MSI_BASE +\
+						TC956X_MSI_PF1 + (vf_id * 0x100) + (pf_id * 0x300) + (0x0068))
+
+
+#define TC956X_MSI_OUT_EN_CLR	(0x00000000)
+/* Enabled LPI_INT, EVENT_INT, TX_INT[3], TX_INT[4], RX_INT[3], RX_INT[4]
+ * XPCS_INT, PFMAILBOX_INT
+ */
+//#define TC956X_MSI_OUT_EN	(0x0028C0C5)
+#define TC956X_MSI_OUT_EN	(0x0027FFF8)
+
+
+#define TC956X_MSI_MASK_SET	(0xFFFFFFFE)
+#define TC956X_MSI_MASK_CLR	(0x00000001)
+#define TC956X_MSI_SET0		(0x00000000)
+#define TC956X_MSI_SET1		(0x00000000)
+#define TC956X_MSI_SET2		(0x00000000)
+#define TC956X_MSI_SET3		(0x00000000)
+#define TC956X_MSI_SET4		(0x00000000)
+#define TC956X_MSI_SET5		(0x00000000)
+#define TC956X_MSI_SET6		(0x00000000)
+#define TC956X_MSI_SET7		(0x00000000)
+
+#define TC956X_MSI_INT_TXDMA_CH0	(3)
+#define TC956X_MSI_INT_RXDMA_CH0	(11)
+#define TC956X_MSI_INT_MBX		(21)
+
+#endif // #ifdef TC956X_SRIOV_VF
+
+#if defined(TC956X_AUTOMOTIVE_CONFIG)
+#define CLASS_B_CH			5 /* Class B Queue */
+#define CLASS_CDT_CH			7 /* CDT Queue */
+#endif
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+#define HOST_BEST_EFF_CH		3 /* Best effort traffic Queue*/
+#define UNTAGGED_PTP_CH			4 /* Untagged PTP Queue */
+#define CLASS_B_CH			5 /* Class B Queue */
+#define CLASS_A_CH			6 /* Class A Queue */
+#define CLASS_CDT_CH			7 /* CDT Queue */
+
+#define TC956X_GPTP_TX_CH		UNTAGGED_PTP_CH
+/* All data is redirected to Legacy Channel for SRIOV Usecase */
+#define LEGACY_VLAN_TAGGED_CH		HOST_BEST_EFF_CH
+#define AVB_CLASS_B_TX_CH		HOST_BEST_EFF_CH
+#define AVB_CLASS_A_TX_CH		HOST_BEST_EFF_CH
+#define TSN_CLASS_CDT_TX_CH		HOST_BEST_EFF_CH
+
+#elif defined(TC956X_SRIOV_PF) && (defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE))
+#define HOST_BEST_EFF_CH		0 /* Legacy channel is best effort traffic */
+#define LEGACY_VLAN_TAGGED_CH		0 /* Legacy VLAN tagged queue */
+#define TC956X_GPTP_TX_CH		4 /* gPTP Tx Channel */
+#define AVB_CLASS_B_TX_CH		5 /* AVB Class B Qeuue */
+#define AVB_CLASS_A_TX_CH		6 /* AVB Class A Qeuue */
+#define TSN_CLASS_CDT_TX_CH		7 /* Express Control Traffic */
+
+#else
+#ifdef TC956X
+
+#ifndef TC956X_SRIOV_VF
+/* CPE usecase only TxCH 0 is applicable */
+#define HOST_BEST_EFF_CH		0 /* Legacy channel is best effort traffic */
+#define LEGACY_VLAN_TAGGED_CH	0 /* Legacy VLAN tagged queue */
+#define TC956X_GPTP_TX_CH		0 /* gPTP Tx Channel */
+#define AVB_CLASS_B_TX_CH		0 /* AVB Class B Qeuue */
+#define AVB_CLASS_A_TX_CH		0 /* AVB Class A Qeuue */
+#define TSN_CLASS_CDT_TX_CH		0 /* Express Control Traffic */
+#endif
+#endif
+#endif
+
+/* Scale factor for the CBS calculus */
+#define AVB_CBS_SCALE	1024
+
+#define TC956X_HOST_PHYSICAL_ADRS_MASK	(0x10) /* bit no 37: (1<<36) */
+
+#define ETHNORMAL_LEN		1500
+#if defined(TC956X_CPE_CONFIG)
+/*Max supported MTU limited to 2000, not 'ETH_FRAME_LEN + ETH_FCS_LEN + VLAN_HLEN' */
+#define MAX_SUPPORTED_MTU	2000 /*(ETH_FRAME_LEN + ETH_FCS_LEN + VLAN_HLEN)*/
+#else
+#define MAX_SUPPORTED_MTU	(ETH_FRAME_LEN + ETH_FCS_LEN + VLAN_HLEN)
+#endif
+#define MIN_SUPPORTED_MTU	(ETH_ZLEN + ETH_FCS_LEN + VLAN_HLEN)
+
+#define HOST_MAC_ADDR_OFFSET 2
+#define HOST_BC_ADDR_OFFSET 0
+
+#endif /* End of TC956X Define */
+
+/* These need to be power of two, and >= 4 */
+#define DMA_TX_SIZE 512
+#define DMA_RX_SIZE 512
+#define TC956XMAC_GET_ENTRY(x, size)	((x + 1) & (size - 1))
+
+/* default DMA channel for TC */
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+#define TC956X_TC_DEFAULT_DMA_CH (0x1 << 3)
+#else
+#define TC956X_TC_DEFAULT_DMA_CH (0x1 << 0)
+#endif
+
+#undef FRAME_FILTER_DEBUG
+/* #define FRAME_FILTER_DEBUG */
+
+#define TOTAL_VF 3
+/* Extra statistic and debug information exposed by ethtool */
+struct tc956xmac_extra_stats {
+	/* Transmit errors */
+	u64 tx_underflow ____cacheline_aligned;
+	u64 tx_carrier;
+	u64 tx_losscarrier;
+	u64 vlan_tag;
+	u64 tx_deferred;
+	u64 tx_vlan;
+	u64 tx_jabber;
+	u64 tx_frame_flushed;
+	u64 tx_payload_error;
+	u64 tx_ip_header_error;
+	/* Receive errors */
+	u64 rx_desc;
+	u64 sa_filter_fail;
+	u64 overflow_error;
+	u64 ipc_csum_error;
+	u64 rx_collision;
+	u64 rx_crc_errors;
+	u64 dribbling_bit;
+	u64 rx_length;
+	u64 rx_mii;
+	u64 rx_multicast;
+	u64 rx_gmac_overflow;
+	u64 rx_watchdog;
+	u64 da_rx_filter_fail;
+	u64 sa_rx_filter_fail;
+	u64 rx_missed_cntr;
+	u64 rx_overflow_cntr;
+	u64 rx_vlan;
+	u64 rx_split_hdr_pkt_n;
+	/* Tx/Rx IRQ error info */
+	u64 tx_undeflow_irq;
+	u64 tx_process_stopped_irq[TC956XMAC_CH_MAX];
+	u64 tx_jabber_irq;
+	u64 rx_overflow_irq;
+	u64 rx_buf_unav_irq[TC956XMAC_CH_MAX];
+	u64 rx_process_stopped_irq;
+	u64 rx_watchdog_irq;
+	u64 tx_early_irq;
+	u64 fatal_bus_error_irq[TC956XMAC_CH_MAX];
+	/* Tx/Rx IRQ Events */
+	u64 rx_early_irq;
+	u64 threshold;
+	u64 tx_pkt_n[TC956XMAC_CH_MAX];
+	u64 tx_pkt_errors_n[TC956XMAC_CH_MAX];
+	u64 rx_pkt_n[TC956XMAC_CH_MAX];
+	u64 normal_irq_n[TC956XMAC_CH_MAX];
+	u64 rx_normal_irq_n[TC956XMAC_CH_MAX];
+	u64 napi_poll_tx[TC956XMAC_CH_MAX];
+	u64 napi_poll_rx[TC956XMAC_CH_MAX];
+	u64 tx_normal_irq_n[TC956XMAC_CH_MAX];
+	u64 tx_clean[TC956XMAC_CH_MAX];
+	u64 tx_set_ic_bit;
+	u64 irq_receive_pmt_irq_n;
+	/* MMC info */
+	u64 mmc_tx_irq_n;
+	u64 mmc_rx_irq_n;
+	u64 mmc_rx_csum_offload_irq_n;
+	/* EEE */
+	u64 irq_tx_path_in_lpi_mode_n;
+	u64 irq_tx_path_exit_lpi_mode_n;
+	u64 irq_rx_path_in_lpi_mode_n;
+	u64 irq_rx_path_exit_lpi_mode_n;
+	u64 phy_eee_wakeup_error_n;
+	/* Extended RDES status */
+	u64 ip_hdr_err;
+	u64 ip_payload_err;
+	u64 ip_csum_bypassed;
+	u64 ipv4_pkt_rcvd;
+	u64 ipv6_pkt_rcvd;
+	u64 no_ptp_rx_msg_type_ext;
+	u64 ptp_rx_msg_type_sync;
+	u64 ptp_rx_msg_type_follow_up;
+	u64 ptp_rx_msg_type_delay_req;
+	u64 ptp_rx_msg_type_delay_resp;
+	u64 ptp_rx_msg_type_pdelay_req;
+	u64 ptp_rx_msg_type_pdelay_resp;
+	u64 ptp_rx_msg_type_pdelay_follow_up;
+	u64 ptp_rx_msg_type_announce;
+	u64 ptp_rx_msg_type_management;
+	u64 ptp_rx_msg_pkt_reserved_type;
+	u64 ptp_frame_type;
+	u64 ptp_ver;
+	u64 timestamp_dropped;
+	u64 av_pkt_rcvd;
+	u64 av_tagged_pkt_rcvd;
+	u64 vlan_tag_priority_val;
+	u64 l3_filter_match;
+	u64 l4_filter_match;
+	u64 l3_l4_filter_no_match;
+	/* PCS */
+	u64 irq_pcs_ane_n;
+	u64 irq_pcs_link_n;
+	u64 irq_rgmii_n;
+	u64 pcs_link;
+	u64 pcs_duplex;
+	u64 pcs_speed;
+	/* debug register */
+	u64 mtl_tx_status_fifo_full;
+	u64 mtl_tx_fifo_not_empty[MTL_MAX_TX_QUEUES];
+	u64 mmtl_fifo_ctrl[MTL_MAX_TX_QUEUES];
+	u64 mtl_tx_fifo_read_ctrl_write[MTL_MAX_TX_QUEUES];
+	u64 mtl_tx_fifo_read_ctrl_wait[MTL_MAX_TX_QUEUES];
+	u64 mtl_tx_fifo_read_ctrl_read[MTL_MAX_TX_QUEUES];
+	u64 mtl_tx_fifo_read_ctrl_idle[MTL_MAX_TX_QUEUES];
+	u64 mac_tx_in_pause[MTL_MAX_TX_QUEUES];
+	u64 mac_tx_frame_ctrl_xfer;
+	u64 mac_tx_frame_ctrl_idle;
+	u64 mac_tx_frame_ctrl_wait;
+	u64 mac_tx_frame_ctrl_pause;
+	u64 mac_gmii_tx_proto_engine;
+	u64 mtl_rx_fifo_fill_level_full[MTL_MAX_RX_QUEUES];
+	u64 mtl_rx_fifo_fill_above_thresh[MTL_MAX_RX_QUEUES];
+	u64 mtl_rx_fifo_fill_below_thresh[MTL_MAX_RX_QUEUES];
+	u64 mtl_rx_fifo_fill_level_empty[MTL_MAX_RX_QUEUES];
+	u64 mtl_rx_fifo_read_ctrl_flush[MTL_MAX_RX_QUEUES];
+	u64 mtl_rx_fifo_read_ctrl_read[MTL_MAX_RX_QUEUES];
+	u64 mtl_rx_fifo_read_ctrl_status[MTL_MAX_RX_QUEUES];
+	u64 mtl_rx_fifo_read_ctrl_idle[MTL_MAX_RX_QUEUES];
+	u64 mtl_rx_fifo_ctrl_active[MTL_MAX_RX_QUEUES];
+	u64 mac_rx_frame_ctrl_fifo;
+	u64 mac_gmii_rx_proto_engine;
+	/* TSO */
+	u64 tx_tso_frames[TC956XMAC_CH_MAX];
+	u64 tx_tso_nfrags[TC956XMAC_CH_MAX];
+
+	/* Tx desc statistics */
+	u64 txch_status[TC956XMAC_CH_MAX];
+	u64 txch_control[TC956XMAC_CH_MAX];
+	u64 txch_desc_list_haddr[TC956XMAC_CH_MAX];
+	u64 txch_desc_list_laddr[TC956XMAC_CH_MAX];
+	u64 txch_desc_ring_len[TC956XMAC_CH_MAX];
+	u64 txch_desc_curr_haddr[TC956XMAC_CH_MAX];
+	u64 txch_desc_curr_laddr[TC956XMAC_CH_MAX];
+	u64 txch_desc_tail[TC956XMAC_CH_MAX];
+	u64 txch_desc_buf_haddr[TC956XMAC_CH_MAX];
+	u64 txch_desc_buf_laddr[TC956XMAC_CH_MAX];
+	u64 txch_sw_cur_tx[TC956XMAC_CH_MAX];
+	u64 txch_sw_dirty_tx[TC956XMAC_CH_MAX];
+
+	/* Rx desc statistics */
+	u64 rxch_status[TC956XMAC_CH_MAX];
+	u64 rxch_control[TC956XMAC_CH_MAX];
+	u64 rxch_desc_list_haddr[TC956XMAC_CH_MAX];
+	u64 rxch_desc_list_laddr[TC956XMAC_CH_MAX];
+	u64 rxch_desc_ring_len[TC956XMAC_CH_MAX];
+	u64 rxch_desc_curr_haddr[TC956XMAC_CH_MAX];
+	u64 rxch_desc_curr_laddr[TC956XMAC_CH_MAX];
+	u64 rxch_desc_tail[TC956XMAC_CH_MAX];
+	u64 rxch_desc_buf_haddr[TC956XMAC_CH_MAX];
+	u64 rxch_desc_buf_laddr[TC956XMAC_CH_MAX];
+	u64 rxch_sw_cur_rx[TC956XMAC_CH_MAX];
+	u64 rxch_sw_dirty_rx[TC956XMAC_CH_MAX];
+#ifdef TC956X_SRIOV_PF
+	u64 mbx_pf_sent_vf[TOTAL_VF];
+	u64 mbx_pf_rcvd_vf[TOTAL_VF];
+#else
+	u64 mbx_vf_sent_pf;
+	u64 mbx_vf_rcvd_pf;
+#endif
+
+	/*debug interrupt counters */
+	u64 total_interrupts;
+	u64 lpi_intr_n;
+	u64 pmt_intr_n;
+	u64 event_intr_n;
+	u64 tx_intr_n;
+	u64 rx_intr_n;
+	u64 xpcs_intr_n;
+	u64 phy_intr_n;
+	u64 sw_msi_n;
+	/*MTL Debug counters */
+	u64 mtl_tx_underflow[MTL_MAX_TX_QUEUES];
+	u64 mtl_rx_miss_pkt_cnt[MTL_MAX_RX_QUEUES];
+	u64 mtl_rx_overflow_pkt_cnt[MTL_MAX_RX_QUEUES];
+	u64 rxch_watchdog_timer[TC956XMAC_CH_MAX];
+	u64 link_partner_pause_frame_cnt;
+
+	/*m3 SRAM debug counters */
+	u64 m3_debug_cnt0;
+	u64 m3_debug_cnt1;
+	u64 m3_debug_cnt2;
+	u64 m3_debug_cnt3;
+	u64 m3_debug_cnt4;
+	u64 m3_debug_cnt5;
+	u64 m3_debug_cnt6;
+	u64 m3_debug_cnt7;
+	u64 m3_debug_cnt8;
+	u64 m3_debug_cnt9;
+	u64 m3_debug_cnt10;
+	u64 m3_watchdog_exp_cnt;
+	u64 m3_watchdog_monitor_cnt;
+	u64 m3_debug_cnt13;
+	u64 m3_debug_cnt14;
+	u64 m3_systick_cnt_upper_value;
+	u64 m3_systick_cnt_lower_value;
+	u64 m3_tx_timeout_port0;
+	u64 m3_tx_timeout_port1;
+	u64 m3_debug_cnt19;
+	u64 m3_tx_pcie_addr_loc_port0[TC956XMAC_CH_MAX];
+	u64 m3_tx_pcie_addr_loc_port1[TC956XMAC_CH_MAX];
+	u64 m3_rx_pcie_addr_loc_port0[TC956XMAC_CH_MAX];
+	u64 m3_rx_pcie_addr_loc_port1[TC956XMAC_CH_MAX];
+
+};
+
+/* Safety Feature statistics exposed by ethtool */
+struct tc956xmac_safety_stats {
+	unsigned long mac_errors[32];
+	unsigned long mtl_errors[32];
+	unsigned long dma_errors[32];
+};
+
+#ifdef TC956X_SRIOV_VF
+struct tc956x_sw_counters {
+	u64 tx_frame_count_good_bad;
+	u64 rx_frame_count_good_bad;
+	u64 rx_frame_count_good;
+	u64 rx_fame_count_bad;
+	u64 rx_packet_good_octets;
+	u64 rx_header_good_octets;
+	u64 rx_av_tagged_datapacket_count;
+	u64 rx_av_tagged_controlpacket_count;
+	u64 rx_nonav_packet_count;
+	u64 rx_tunnel_packet_count;
+	u64 rx_non_ip_pkt_count;
+	u64 rx_ipv4_tcp_pkt_count;
+	u64 rx_ipv4_udp_pkt_count;
+	u64 rx_ipv4_icmp_pkt_count;
+	u64 rx_ipv4_igmp_pkt_count;
+	u64 rx_ipv4_unkown_pkt_count;
+	u64 rx_ipv6_tcp_pkt_count;
+	u64 rx_ipv6_udp_pkt_count;
+	u64 rx_ipv6_icmp_pkt_count;
+	u64 rx_ipv6_unkown_pkt_count;
+	u64 rx_err_wd_timeout_count;
+	u64 rx_err_gmii_inv_count;
+	u64 rx_err_crc_count;
+	u64 rx_err_giant_count;
+	u64 rx_err_checksum_count;
+	u64 rx_err_overflow_count;
+	u64 rx_err_bus_count;
+	u64 rx_err_pkt_len_count;
+	u64 rx_err_runt_pkt_count;
+	u64 rx_err_dribble_count;
+	u64 rx_err_t_out_ip_header_count;
+	u64 rx_err_t_out_ip_pl_l4_csum_count;
+	u64 rx_err_t_in_ip_header_count;
+	u64 rx_err_t_in_ip_pl_l4_csum_count;
+	u64 rx_err_t_invalid_vlan_header;
+	u64 rx_l2_len_pkt_count;
+	u64 rx_l2_mac_control_pkt_count;
+	u64 rx_l2_dcb_control_pkt_count;
+	u64 rx_l2_arp_pkt_count;
+	u64 rx_l2_oam_type_pkt_count;
+	u64 rx_l2_untg_typ_match_pkt_count;
+	u64 rx_l2_other_type_pkt_count;
+	u64 rx_l2_single_svlan_pkt_count;
+	u64 rx_l2_single_cvlan_pkt_count;
+	u64 rx_l2_d_cvlan_cvlan_pkt_count;
+	u64 rx_l2_d_svlan_svlan_pkt_count;
+	u64 rx_l2_d_svlan_cvlan_pkt_count;
+	u64 rx_l2_d_cvlan_svlan_pkt_count;
+	u64 rx_l2_untg_av_control_pkt_count;
+	u64 rx_ptp_no_msg;
+	u64 rx_ptp_msg_type_sync;
+	u64 rx_ptp_msg_type_follow_up;
+	u64 rx_ptp_msg_type_delay_req;
+	u64 rx_ptp_msg_type_delay_resp;
+	u64 rx_ptp_msg_type_pdelay_req;
+	u64 rx_ptp_msg_type_pdelay_resp;
+	u64 rx_ptp_msg_type_pdelay_follow_up;
+	u64 rx_ptp_msg_type_announce;
+	u64 rx_ptp_msg_type_management;
+	u64 rx_ptp_msg_pkt_signaling;
+	u64 rx_ptp_msg_pkt_reserved_type;
+};
+#endif //#ifdef TC956X_SRIOV_VF
+
+struct tc956x_mac_addr {
+	u8 mac_address[6];
+	u8 status;
+	u8 counter;
+	u8 vf[4];
+};
+
+struct vf_status {
+	u8 vf_number;
+	u8 loc_counter;
+};
+
+struct tc956x_vlan_id {
+	u16 vid;
+	u8 status;
+	u8 glo_counter;
+	struct vf_status vf[4];
+};
+/* Number of fields in Safety Stats */
+#define TC956XMAC_SAFETY_FEAT_SIZE	\
+	(sizeof(struct tc956xmac_safety_stats) / sizeof(unsigned long))
+
+/* CSR Frequency Access Defines*/
+#define CSR_F_35M	35000000
+#define CSR_F_60M	60000000
+#define CSR_F_100M	100000000
+#define CSR_F_150M	150000000
+#define CSR_F_250M	250000000
+#define CSR_F_300M	300000000
+
+#define	MAC_CSR_H_FRQ_MASK	0x20
+
+#define HASH_TABLE_SIZE 64
+#define MAX_MAC_ADDR_FILTERS 32
+#define PAUSE_TIME 0xffff
+
+/* Flow Control defines */
+#define FLOW_OFF	0
+#define FLOW_RX		1
+#define FLOW_TX		2
+#define FLOW_AUTO	(FLOW_TX | FLOW_RX)
+
+/* PCS defines */
+#define TC956XMAC_PCS_RGMII	(1 << 0)
+#define TC956XMAC_PCS_SGMII	(1 << 1)
+#define TC956XMAC_PCS_TBI		(1 << 2)
+#define TC956XMAC_PCS_RTBI		(1 << 3)
+#define TC956XMAC_PCS_USXGMII	(1 << 4)
+
+
+#define SF_DMA_MODE 1		/* DMA STORE-AND-FORWARD Operation Mode */
+
+/* DAM HW feature register fields */
+#define DMA_HW_FEAT_MIISEL	0x00000001	/* 10/100 Mbps Support */
+#define DMA_HW_FEAT_GMIISEL	0x00000002	/* 1000 Mbps Support */
+#define DMA_HW_FEAT_HDSEL	0x00000004	/* Half-Duplex Support */
+#define DMA_HW_FEAT_EXTHASHEN	0x00000008	/* Expanded DA Hash Filter */
+#define DMA_HW_FEAT_HASHSEL	0x00000010	/* HASH Filter */
+#define DMA_HW_FEAT_ADDMAC	0x00000020	/* Multiple MAC Addr Reg */
+#define DMA_HW_FEAT_PCSSEL	0x00000040	/* PCS registers */
+#define DMA_HW_FEAT_L3L4FLTREN	0x00000080	/* Layer 3 & Layer 4 Feature */
+#define DMA_HW_FEAT_SMASEL	0x00000100	/* SMA(MDIO) Interface */
+#define DMA_HW_FEAT_RWKSEL	0x00000200	/* PMT Remote Wakeup */
+#define DMA_HW_FEAT_MGKSEL	0x00000400	/* PMT Magic Packet */
+#define DMA_HW_FEAT_MMCSEL	0x00000800	/* RMON Module */
+#define DMA_HW_FEAT_TSVER1SEL	0x00001000	/* Only IEEE 1588-2002 */
+#define DMA_HW_FEAT_TSVER2SEL	0x00002000	/* IEEE 1588-2008 PTPv2 */
+#define DMA_HW_FEAT_EEESEL	0x00004000	/* Energy Efficient Ethernet */
+#define DMA_HW_FEAT_AVSEL	0x00008000	/* AV Feature */
+#define DMA_HW_FEAT_TXCOESEL	0x00010000	/* Checksum Offload in Tx */
+#define DMA_HW_FEAT_RXTYP1COE	0x00020000	/* IP COE (Type 1) in Rx */
+#define DMA_HW_FEAT_RXTYP2COE	0x00040000	/* IP COE (Type 2) in Rx */
+#define DMA_HW_FEAT_RXFIFOSIZE	0x00080000	/* Rx FIFO > 2048 Bytes */
+#define DMA_HW_FEAT_RXCHCNT	0x00300000	/* No. additional Rx Channels */
+#define DMA_HW_FEAT_TXCHCNT	0x00c00000	/* No. additional Tx Channels */
+#define DMA_HW_FEAT_ENHDESSEL	0x01000000	/* Alternate Descriptor */
+/* Timestamping with Internal System Time */
+#define DMA_HW_FEAT_INTTSEN	0x02000000
+#define DMA_HW_FEAT_FLEXIPPSEN	0x04000000	/* Flexible PPS Output */
+#define DMA_HW_FEAT_SAVLANINS	0x08000000	/* Source Addr or VLAN */
+#define DMA_HW_FEAT_ACTPHYIF	0x70000000	/* Active/selected PHY iface */
+#define DEFAULT_DMA_PBL		8
+
+/* PCS status and mask defines */
+#define	PCS_ANE_IRQ		BIT(2)	/* PCS Auto-Negotiation */
+#define	PCS_LINK_IRQ		BIT(1)	/* PCS Link */
+#define	PCS_RGSMIIIS_IRQ	BIT(0)	/* RGMII or SMII Interrupt */
+
+/* Max/Min RI Watchdog Timer count value */
+#define MAX_DMA_RIWT		0xFF
+#define MIN_DMA_RIWT		0x1
+#define DEF_DMA_RIWT		0xa0
+/* Tx coalesce parameters */
+#define TC956XMAC_COAL_TX_TIMER	1000
+#define TC956XMAC_MAX_COAL_TX_TICK	100000
+#define TC956XMAC_TX_MAX_FRAMES	256
+#define TC956XMAC_RX_MAX_FRAMES    32
+#define TC956XMAC_TX_FRAMES	64
+#define TC956XMAC_RX_FRAMES	0
+
+/* Rx IPC status */
+enum rx_frame_status {
+	good_frame = 0x0,
+	discard_frame = 0x1,
+	csum_none = 0x2,
+	llc_snap = 0x4,
+	dma_own = 0x8,
+	rx_not_ls = 0x10,
+};
+
+/* Tx status */
+enum tx_frame_status {
+	tx_done = 0x0,
+	tx_not_ls = 0x1,
+	tx_err = 0x2,
+	tx_dma_own = 0x4,
+};
+
+enum dma_irq_status {
+	tx_hard_error = 0x1,
+	tx_hard_error_bump_tc = 0x2,
+	handle_rx = 0x4,
+	handle_tx = 0x8,
+};
+
+#ifdef TC956X_SRIOV_VF
+
+#define MBX_MSG_OFST		4 /* First 4 bytes for ACK management */
+#define MBX_MSG_SIZE		60 /* Excluding ACK */
+#define MBX_ACK_SIZE		4 /* ACK management */
+#define MBX_TOT_SIZE		(MBX_MSG_SIZE + MBX_ACK_SIZE)
+
+#define ACK			0x01
+#define NACK			0x02
+
+/* Mailbox opcode definitions */
+#define OPCODE_MBX_ADD_MAC_ADDR			0x01
+#define OPCODE_MBX_SET_TX_Q_WEIGHT		0x02
+#define OPCODE_MBX_CFG_CBS				0x03
+#define OPCODE_MBX_SET_TX_Q_PRIOR		0x04
+#define OPCODE_MBX_RESET_EEE_MODE       0x05
+#define OPCODE_MBX_VF_IOCTL				0x06
+#define OPCODE_MBX_VF_ETHTOOL			0x07
+#define OPCODE_MBX_VF_ADD_MAC			0x08
+#define OPCODE_MBX_VF_DELETE_MAC		0x09
+#define OPCODE_MBX_VF_ADD_VLAN			0x10
+#define OPCODE_MBX_VF_DELETE_VLAN		0x11
+#define OPCODE_MBX_SET_DMA_TX_MODE		0x12
+#define OPCODE_MBX_VF_GET_LINK_STATUS	0x13
+#define OPCODE_MBX_PHY_LINK		0x14
+#define OPCODE_MBX_SETUP_CBS		0x15
+#define OPCODE_MBX_RX_CRC		0x16
+#define OPCODE_MBX_RX_CSUM		0x17
+#define OPCODE_MBX_DRV_CAP		0x18
+#define OPCODE_MBX_VF_GET_PAUSE_PARAM	0x19
+#define OPCODE_MBX_VF_GET_EEE			0x20
+#define OPCODE_MBX_VF_GET_TS_INFO		0x22
+#define OPCODE_MBX_VF_GET_MII_PHY		0x23
+#define OPCODE_MBX_VF_GET_PAUSE_PARAM_2 0x24
+#define OPCODE_MBX_GET_UMAC_ADDR        0x25
+#define OPCODE_VF_RESET                 0x26
+#define OPCODE_MBX_DMA_CH_TLPTR			0x29
+#define OPCODE_MBX_SETUP_ETF			0x30
+#define OPCODE_MBX_FLR					0x33
+#define OPCODE_MBX_DMA_ERR		0x34
+#define OPCODE_MBX_ACK_MSG				0xFF
+
+#define SIZE_MBX_SET_TX_Q_WEIGHT		8
+#define SIZE_MBX_CFG_CBS				20
+#define SIZE_MBX_SETUP_ETF				5
+#define SIZE_MBX_SETUP_CBS				21
+#define SIZE_MBX_CFG_EST				56
+#define SIZE_MBX_CFG_FPE				20
+#define SIZE_MBX_SET_TX_Q_PRIOR			8
+#define SIZE_MBX_SET_DMA_TX_MODE		13
+#define SIZE_MBX_VF_GET_LINK_STATUS		0
+#define SIZE_MBX_PHY_LINK			12
+#define SIZE_MBX_RX_CRC		4
+#define SIZE_MBX_RX_CSUM	4
+#define SIZE_MBX_DRV_CAP	            4
+#define SIZE_SET_UMAC_ADDR              10
+#define SIZE_GET_UMAC_ADDR              4
+#define SIZE_MBX_VF_MAC				6
+#define SIZE_MBX_VF_VLAN				2
+#define SIZE_MBX_VF_REG_WR			13
+#define SIZE_MBX_VF_SPEED			1
+#define SIZE_MBX_SET_GET_CBS_1			56
+#define SIZE_MBX_SET_GET_CBS_2			44
+#define SIZE_MBX_SET_GET_EST_1		56
+#define SIZE_MBX_SET_GET_RXP_1		56
+#define SIZE_MBX_SET_GET_FPE_1		20
+#define SIZE_MBX_VF_GET_CBS			2
+#define SIZE_MBX_VF_PAUSE_PARAM		1
+#define SIZE_MBX_VF_EEE				1
+#define SIZE_MBX_VF_TS_INFO			1
+#define SIZE_VF_RESET			    1
+#define SIZE_MBX_VF_TIMESTAMP		2
+#define SIZE_MBX_VF_GET_EST			1
+#define SIZE_MBX_VF_GET_RXP			1
+#define SIZE_MBX_VF_GET_FPE			1
+#define SIZE_MBX_VF_GET_MII_REG		23
+#define SIZE_MBX_RX_DMA_TL_PTR		4
+#define SIZE_MBX_GET_HW_STMP    12
+
+#define MAX_SIZE_GCL_MSG 14
+#define EST_FIX_MSG_LEN 28
+#define RXP_FIX_MSG_LEN 16
+#define VF_UP       1
+#define VF_DOWN     0
+#define VF_SUSPEND  2
+#define VF_RELEASE  3
+
+#define SCH_WQ_PF_FLR 1
+#define SCH_WQ_RX_DMA_ERR 2
+#define SCH_WQ_LINK_STATE_UP 3
+#endif /* #ifdef TC956X_SRIOV_VF */
+
+/* EEE and LPI defines */
+#define	CORE_IRQ_TX_PATH_IN_LPI_MODE	(1 << 0)
+#define	CORE_IRQ_TX_PATH_EXIT_LPI_MODE	(1 << 1)
+#define	CORE_IRQ_RX_PATH_IN_LPI_MODE	(1 << 2)
+#define	CORE_IRQ_RX_PATH_EXIT_LPI_MODE	(1 << 3)
+
+#define CORE_IRQ_MTL_RX_OVERFLOW	BIT(8)
+
+/* Physical Coding Sublayer */
+struct rgmii_adv {
+	unsigned int pause;
+	unsigned int duplex;
+	unsigned int lp_pause;
+	unsigned int lp_duplex;
+};
+
+#define TC956XMAC_PCS_PAUSE	1
+#define TC956XMAC_PCS_ASYM_PAUSE	2
+
+/* DMA HW capabilities */
+struct dma_features {
+	unsigned int mbps_10_100;
+	unsigned int mbps_1000;
+	unsigned int half_duplex;
+	unsigned int hash_filter;
+	unsigned int multi_addr;
+	unsigned int pcs;
+	unsigned int sma_mdio;
+	unsigned int pmt_remote_wake_up;
+	unsigned int pmt_magic_frame;
+	unsigned int rmon;
+	/* IEEE 1588-2002 */
+	unsigned int time_stamp;
+	/* IEEE 1588-2008 */
+	unsigned int atime_stamp;
+	/* 802.3az - Energy-Efficient Ethernet (EEE) */
+	unsigned int eee;
+	unsigned int av;
+	unsigned int hash_tb_sz;
+	unsigned int tsoen;
+	/* TX and RX csum */
+	unsigned int tx_coe;
+	unsigned int rx_coe;
+	unsigned int rx_coe_type1;
+	unsigned int rx_coe_type2;
+	unsigned int rxfifo_over_2048;
+	/* TX and RX number of channels */
+	unsigned int number_rx_channel;
+	unsigned int number_tx_channel;
+	/* TX and RX number of queues */
+	unsigned int number_rx_queues;
+	unsigned int number_tx_queues;
+	/* PPS output */
+	unsigned int pps_out_num;
+	/* Alternate (enhanced) DESC mode */
+	unsigned int enh_desc;
+	/* TX and RX FIFO sizes */
+	unsigned int tx_fifo_size;
+	unsigned int rx_fifo_size;
+	/* Automotive Safety Package */
+	unsigned int asp;
+	/* RX Parser */
+	unsigned int spram;
+	unsigned int frpsel;
+	unsigned int frpbs;
+	unsigned int frpes;
+	unsigned int addr64;
+	unsigned int rssen;
+	unsigned int vlhash;
+	unsigned int sphen;
+	unsigned int vlins;
+	unsigned int dvlan;
+	unsigned int l3l4fnum;
+	unsigned int arpoffsel;
+	/* TSN Features */
+	unsigned int estwid;
+	unsigned int estdep;
+	unsigned int estsel;
+	unsigned int fpesel;
+	unsigned int tbssel;
+	unsigned int ptoen;
+	unsigned int osten;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,13,0)
+	/* Numbers of Auxiliary Snapshot Inputs */
+	unsigned int aux_snapshot_n;
+#endif
+};
+
+/* RX Buffer size must be multiple of 4/8/16 bytes */
+#define BUF_SIZE_16KiB 16368
+#define BUF_SIZE_8KiB 8188
+#define BUF_SIZE_4KiB 4096
+#define BUF_SIZE_2KiB 2048
+
+/* Power Down and WOL */
+#define PMT_NOT_SUPPORTED 0
+#define PMT_SUPPORTED 1
+
+/* Common MAC defines */
+#define MAC_CTRL_REG		(MAC_OFFSET + 0x00000000)	/* MAC Control */
+#define MAC_ENABLE_TX		0x00000008	/* Transmitter Enable */
+#define MAC_ENABLE_RX		0x00000004	/* Receiver Enable */
+
+/* Default LPI timers */
+#define TC956XMAC_DEFAULT_LIT_LS	0x3E8
+#define TC956XMAC_DEFAULT_TWT_LS	0x1E
+#define TC956XMAC_LIT_LS		0x0011
+#define TC956XMAC_TWT_LS		0x0028
+#define TC956XMAC_TIC_1US_CNTR		0x7c
+#define TC956XMAC_LPIET_600US		0x258
+#define TC956X_PHY_SPEED_5G		5000
+#define TC956X_PHY_SPEED_2_5G		2500
+
+#define TC956XMAC_CHAIN_MODE	0x1
+#define TC956XMAC_RING_MODE	0x2
+
+#define JUMBO_LEN		(TC956XMAC_ALIGN(9000))
+
+/* Receive Side Scaling */
+#define TC956XMAC_RSS_HASH_KEY_SIZE	40
+#define TC956XMAC_RSS_MAX_TABLE_SIZE	256
+
+/* VLAN */
+#define TC956XMAC_VLAN_NONE	0x0
+#define TC956XMAC_VLAN_REMOVE	0x1
+#define TC956XMAC_VLAN_INSERT	0x2
+#define TC956XMAC_VLAN_REPLACE	0x3
+
+#define TC956X_ENABLE 1
+#define TC956X_DISABLE 0
+
+/* Numbers in Words */
+
+#define TC956X_ZERO		0
+#define TC956X_ONE		1
+#define TC956X_TWO		2
+#define TC956X_THREE		3
+#define TC956X_FOUR		4
+#define TC956X_FIVE		5
+#define TC956X_SIX		6
+#define TC956X_SEVEN		7
+#define TC956X_EIGHT		8
+#define TC956X_NINE		9
+#define TC956X_TEN		10
+#define TC956X_SIXTEEN		16
+#define TC956X_TWENTY_FOUR	24
+#define TC956X_FORTY_EIGHT	48
+#define TC956X_FORTY_NINE	49
+
+/* EEPROM Mac address mask values */
+#define EEPROM_MAC_ADDR_MASK1 0x000000FF
+#define EEPROM_MAC_ADDR_MASK2 0x0000FF00
+#define EEPROM_MAC_ADDR_MASK3 0x00FF0000
+#define EEPROM_MAC_ADDR_MASK4 0xFF000000
+
+#define TC956X_MIN_LPI_AUTO_ENTRY_TIMER		0
+#define TC956X_MAX_LPI_AUTO_ENTRY_TIMER		0xFFFF8 /* LPI Entry timer is in the units of 8 micro second granularity. So mask the last 3 bits. */
+
+extern const struct tc956xmac_desc_ops enh_desc_ops;
+extern const struct tc956xmac_desc_ops ndesc_ops;
+
+struct mac_device_info;
+
+extern const struct tc956xmac_hwtimestamp tc956xmac_ptp;
+extern const struct tc956xmac_mode_ops dwmac4_ring_mode_ops;
+
+struct mac_link {
+	u32 speed_mask;
+	u32 speed10;
+	u32 speed100;
+	u32 speed1000;
+	u32 speed2500;
+	u32 duplex;
+	struct {
+		u32 speed2500;
+		u32 speed5000;
+		u32 speed10000;
+	} xgmii;
+};
+
+struct mii_regs {
+	unsigned int addr;	/* MII Address */
+	unsigned int data;	/* MII Data */
+	unsigned int addr_shift;	/* MII address shift */
+	unsigned int reg_shift;		/* MII reg shift */
+	unsigned int addr_mask;		/* MII address mask */
+	unsigned int reg_mask;		/* MII reg mask */
+	unsigned int clk_csr_shift;
+	unsigned int clk_csr_mask;
+};
+
+struct mac_device_info {
+	const struct tc956xmac_ops *mac;
+	const struct tc956xmac_desc_ops *desc;
+	const struct tc956xmac_dma_ops *dma;
+	const struct tc956xmac_mode_ops *mode;
+	const struct tc956xmac_hwtimestamp *ptp;
+	const struct tc956xmac_tc_ops *tc;
+	const struct tc956x_msi_ops *msi;
+#ifdef TC956X_SRIOV_PF
+	const struct mac_rsc_mng_ops *rsc;
+	const struct mac_mbx_ops *mbx;
+	const struct tc956x_mbx_wrapper_ops *mbx_wrapper;
+#endif
+#ifdef TC956X_SRIOV_VF
+	const struct mac_rsc_mng_ops *rsc;
+	const struct mac_mbx_ops *mbx;
+	const struct tc956xmac_mbx_wrapper_ops *mbx_wrapper;
+#endif
+	const struct tc956xmac_mmc_ops *mmc;
+	const struct tc956xmac_pma_ops *pma;
+	struct mii_regs mii;	/* MII register Addresses */
+	struct mac_link link;
+	void __iomem *pcsr;     /* vpointer to device CSRs */
+	unsigned int multicast_filter_bins;
+	unsigned int unicast_filter_entries;
+	unsigned int mcast_bits_log2;
+	unsigned int rx_csum;
+	unsigned int pcs;
+#ifdef TC956X
+	unsigned int xpcs;
+#endif
+	unsigned int pmt;
+	unsigned int ps;
+};
+
+struct tc956xmac_rx_routing {
+	u32 reg_mask;
+	u32 reg_shift;
+};
+
+int dwmac100_setup(struct tc956xmac_priv *priv);
+int dwmac1000_setup(struct tc956xmac_priv *priv);
+int dwmac4_setup(struct tc956xmac_priv *priv);
+int dwxgmac2_setup(struct tc956xmac_priv *priv);
+
+#ifdef TC956X_SRIOV_PF
+void tc956xmac_set_mac_addr(void __iomem *ioaddr, u8 addr[6],
+			 unsigned int high, unsigned int low);
+void tc956xmac_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
+			 unsigned int high, unsigned int low);
+void tc956xmac_set_mac(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool enable);
+int tc956x_add_mac_addr(struct net_device *dev, const unsigned char *mac);
+#elif defined TC956X_SRIOV_VF
+void tc956xmac_vf_set_mac_addr(void __iomem *ioaddr, u8 addr[6],
+			 unsigned int high, unsigned int low);
+void tc956xmac_vf_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
+			 unsigned int high, unsigned int low);
+void tc956xmac_set_mac(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool enable);
+#endif
+void tc956xmac_dwmac4_set_mac_addr(void __iomem *ioaddr, u8 addr[6],
+				unsigned int high, unsigned int low);
+void tc956xmac_dwmac4_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
+				unsigned int high, unsigned int low);
+void tc956xmac_dwmac4_set_mac(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool enable);
+
+void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr);
+
+extern const struct tc956xmac_mode_ops ring_mode_ops;
+extern const struct tc956xmac_mode_ops chain_mode_ops;
+extern const struct tc956xmac_desc_ops dwmac4_desc_ops;
+
+#ifdef TC956X_SRIOV_VF
+void tc956xmac_mailbox_service_event_schedule(struct tc956xmac_priv *priv);
+#endif
+#endif /* __COMMON_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/config.ini
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/config.ini
@@ -0,0 +1,25 @@
+#MAC ID configuration, For Test purpose only
+MDIOBUSID1: 1: MAC_ID01: EC:21:E5:10:4F:EA
+MDIOBUSID2: 1: MAC_ID02: EC:21:E5:11:4F:EA
+MDIOBUSID3: 1: MAC_ID03: EC:21:E5:12:4F:EA
+MDIOBUSID4: 1: MAC_ID04: EC:21:E5:13:4F:EA
+MDIOBUSID5: 1: MAC_ID05: EC:21:E5:14:4F:EA
+MDIOBUSID6: 1: MAC_ID06: EC:21:E5:15:4F:EA
+MDIOBUSID7: 1: MAC_ID07: EC:21:E5:16:4F:EA
+MDIOBUSID8: 1: MAC_ID08: EC:21:E5:17:4F:EA
+MDIOBUSID9: 1: MAC_ID09: EC:21:E5:18:4F:EA
+MDIOBUSID10: 1: MAC_ID10: EC:21:E5:19:4F:EA
+MDIOBUSID11: 1: MAC_ID11: EC:21:E5:1A:4F:EA
+MDIOBUSID12: 1: MAC_ID12: EC:21:E5:1B:4F:EA
+MDIOBUSID13: 1: MAC_ID13: EC:21:E5:1C:4F:EA
+MDIOBUSID14: 1: MAC_ID14: EC:21:E5:1D:4F:EA
+#SRIOV MAC ID configuration, For Test purpose only
+#MDIOBUSID1: 1: MAC_ID01: EC:21:E5:10:4F:EA
+#MDIOBUSID2: 1: MAC_ID02: EC:21:E5:11:4F:EA
+#MDIOBUSID1: 1: MAC_ID11: EC:21:E5:12:4F:EA
+#MDIOBUSID2: 1: MAC_ID12: EC:21:E5:13:4F:EA
+#MDIOBUSID1: 1: MAC_ID21: EC:21:E5:14:4F:EA
+#MDIOBUSID2: 1: MAC_ID22: EC:21:E5:15:4F:EA
+#MDIOBUSID1: 1: MAC_ID31: EC:21:E5:16:4F:EA
+#MDIOBUSID2: 1: MAC_ID32: EC:21:E5:17:4F:EA
+#End of file (New line)
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/descs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/descs.h
@@ -0,0 +1,227 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * descs.h - Header File to describe the DMA descriptors and related definitions.
+ * This is for DWMAC100 and 1000 cores.
+ *
+ * Copyright (C) 2007-2009 STMicroelectronics Ltd
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ */
+
+#ifndef __DESCS_H__
+#define __DESCS_H__
+
+#include <linux/bitops.h>
+
+/* Normal receive descriptor defines */
+
+/* RDES0 */
+#define	RDES0_PAYLOAD_CSUM_ERR	BIT(0)
+#define	RDES0_CRC_ERROR		BIT(1)
+#define	RDES0_DRIBBLING		BIT(2)
+#define	RDES0_MII_ERROR		BIT(3)
+#define	RDES0_RECEIVE_WATCHDOG	BIT(4)
+#define	RDES0_FRAME_TYPE	BIT(5)
+#define	RDES0_COLLISION		BIT(6)
+#define	RDES0_IPC_CSUM_ERROR	BIT(7)
+#define	RDES0_LAST_DESCRIPTOR	BIT(8)
+#define	RDES0_FIRST_DESCRIPTOR	BIT(9)
+#define	RDES0_VLAN_TAG		BIT(10)
+#define	RDES0_OVERFLOW_ERROR	BIT(11)
+#define	RDES0_LENGTH_ERROR	BIT(12)
+#define	RDES0_SA_FILTER_FAIL	BIT(13)
+#define	RDES0_DESCRIPTOR_ERROR	BIT(14)
+#define	RDES0_ERROR_SUMMARY	BIT(15)
+#define	RDES0_FRAME_LEN_MASK	GENMASK(29, 16)
+#define RDES0_FRAME_LEN_SHIFT	16
+#define	RDES0_DA_FILTER_FAIL	BIT(30)
+#define	RDES0_OWN		BIT(31)
+			/* RDES1 */
+#define	RDES1_BUFFER1_SIZE_MASK		GENMASK(10, 0)
+#define	RDES1_BUFFER2_SIZE_MASK		GENMASK(21, 11)
+#define	RDES1_BUFFER2_SIZE_SHIFT	11
+#define	RDES1_SECOND_ADDRESS_CHAINED	BIT(24)
+#define	RDES1_END_RING			BIT(25)
+#define	RDES1_DISABLE_IC		BIT(31)
+
+/* Enhanced receive descriptor defines */
+
+/* RDES0 (similar to normal RDES) */
+#define	 ERDES0_RX_MAC_ADDR	BIT(0)
+
+/* RDES1: completely differ from normal desc definitions */
+#define	ERDES1_BUFFER1_SIZE_MASK	GENMASK(12, 0)
+#define	ERDES1_SECOND_ADDRESS_CHAINED	BIT(14)
+#define	ERDES1_END_RING			BIT(15)
+#define	ERDES1_BUFFER2_SIZE_MASK	GENMASK(28, 16)
+#define ERDES1_BUFFER2_SIZE_SHIFT	16
+#define	ERDES1_DISABLE_IC		BIT(31)
+
+/* Normal transmit descriptor defines */
+/* TDES0 */
+#define	TDES0_DEFERRED			BIT(0)
+#define	TDES0_UNDERFLOW_ERROR		BIT(1)
+#define	TDES0_EXCESSIVE_DEFERRAL	BIT(2)
+#define	TDES0_COLLISION_COUNT_MASK	GENMASK(6, 3)
+#define	TDES0_VLAN_FRAME		BIT(7)
+#define	TDES0_EXCESSIVE_COLLISIONS	BIT(8)
+#define	TDES0_LATE_COLLISION		BIT(9)
+#define	TDES0_NO_CARRIER		BIT(10)
+#define	TDES0_LOSS_CARRIER		BIT(11)
+#define	TDES0_PAYLOAD_ERROR		BIT(12)
+#define	TDES0_FRAME_FLUSHED		BIT(13)
+#define	TDES0_JABBER_TIMEOUT		BIT(14)
+#define	TDES0_ERROR_SUMMARY		BIT(15)
+#define	TDES0_IP_HEADER_ERROR		BIT(16)
+#define	TDES0_TIME_STAMP_STATUS		BIT(17)
+#define	TDES0_OWN			((u32)BIT(31))	/* silence sparse */
+/* TDES1 */
+#define	TDES1_BUFFER1_SIZE_MASK		GENMASK(10, 0)
+#define	TDES1_BUFFER2_SIZE_MASK		GENMASK(21, 11)
+#define	TDES1_BUFFER2_SIZE_SHIFT	11
+#define	TDES1_TIME_STAMP_ENABLE		BIT(22)
+#define	TDES1_DISABLE_PADDING		BIT(23)
+#define	TDES1_SECOND_ADDRESS_CHAINED	BIT(24)
+#define	TDES1_END_RING			BIT(25)
+#define	TDES1_CRC_DISABLE		BIT(26)
+#define	TDES1_CHECKSUM_INSERTION_MASK	GENMASK(28, 27)
+#define	TDES1_CHECKSUM_INSERTION_SHIFT	27
+#define	TDES1_FIRST_SEGMENT		BIT(29)
+#define	TDES1_LAST_SEGMENT		BIT(30)
+#define	TDES1_INTERRUPT			BIT(31)
+
+/* Enhanced transmit descriptor defines */
+/* TDES0 */
+#define	ETDES0_DEFERRED			BIT(0)
+#define	ETDES0_UNDERFLOW_ERROR		BIT(1)
+#define	ETDES0_EXCESSIVE_DEFERRAL	BIT(2)
+#define	ETDES0_COLLISION_COUNT_MASK	GENMASK(6, 3)
+#define	ETDES0_VLAN_FRAME		BIT(7)
+#define	ETDES0_EXCESSIVE_COLLISIONS	BIT(8)
+#define	ETDES0_LATE_COLLISION		BIT(9)
+#define	ETDES0_NO_CARRIER		BIT(10)
+#define	ETDES0_LOSS_CARRIER		BIT(11)
+#define	ETDES0_PAYLOAD_ERROR		BIT(12)
+#define	ETDES0_FRAME_FLUSHED		BIT(13)
+#define	ETDES0_JABBER_TIMEOUT		BIT(14)
+#define	ETDES0_ERROR_SUMMARY		BIT(15)
+#define	ETDES0_IP_HEADER_ERROR		BIT(16)
+#define	ETDES0_TIME_STAMP_STATUS	BIT(17)
+#define	ETDES0_SECOND_ADDRESS_CHAINED	BIT(20)
+#define	ETDES0_END_RING			BIT(21)
+#define	ETDES0_CHECKSUM_INSERTION_MASK	GENMASK(23, 22)
+#define	ETDES0_CHECKSUM_INSERTION_SHIFT	22
+#define	ETDES0_TIME_STAMP_ENABLE	BIT(25)
+#define	ETDES0_DISABLE_PADDING		BIT(26)
+#define	ETDES0_CRC_DISABLE		BIT(27)
+#define	ETDES0_FIRST_SEGMENT		BIT(28)
+#define	ETDES0_LAST_SEGMENT		BIT(29)
+#define	ETDES0_INTERRUPT		BIT(30)
+#define	ETDES0_OWN			((u32)BIT(31))	/* silence sparse */
+/* TDES1 */
+#define	ETDES1_BUFFER1_SIZE_MASK	GENMASK(12, 0)
+#define	ETDES1_BUFFER2_SIZE_MASK	GENMASK(28, 16)
+#define	ETDES1_BUFFER2_SIZE_SHIFT	16
+
+/* Extended Receive descriptor definitions */
+#define	ERDES4_IP_PAYLOAD_TYPE_MASK	GENMASK(6, 2)
+#define	ERDES4_IP_HDR_ERR		BIT(3)
+#define	ERDES4_IP_PAYLOAD_ERR		BIT(4)
+#define	ERDES4_IP_CSUM_BYPASSED		BIT(5)
+#define	ERDES4_IPV4_PKT_RCVD		BIT(6)
+#define	ERDES4_IPV6_PKT_RCVD		BIT(7)
+#define	ERDES4_MSG_TYPE_MASK		GENMASK(11, 8)
+#define	ERDES4_PTP_FRAME_TYPE		BIT(12)
+#define	ERDES4_PTP_VER			BIT(13)
+#define	ERDES4_TIMESTAMP_DROPPED	BIT(14)
+#define	ERDES4_AV_PKT_RCVD		BIT(16)
+#define	ERDES4_AV_TAGGED_PKT_RCVD	BIT(17)
+#define	ERDES4_VLAN_TAG_PRI_VAL_MASK	GENMASK(20, 18)
+#define	ERDES4_L3_FILTER_MATCH		BIT(24)
+#define	ERDES4_L4_FILTER_MATCH		BIT(25)
+#define	ERDES4_L3_L4_FILT_NO_MATCH_MASK	GENMASK(27, 26)
+
+/* Extended RDES4 message type definitions */
+#define RDES_EXT_NO_PTP			0x0
+#define RDES_EXT_SYNC			0x1
+#define RDES_EXT_FOLLOW_UP		0x2
+#define RDES_EXT_DELAY_REQ		0x3
+#define RDES_EXT_DELAY_RESP		0x4
+#define RDES_EXT_PDELAY_REQ		0x5
+#define RDES_EXT_PDELAY_RESP		0x6
+#define RDES_EXT_PDELAY_FOLLOW_UP	0x7
+#define RDES_PTP_ANNOUNCE		0x8
+#define RDES_PTP_MANAGEMENT		0x9
+#define RDES_PTP_SIGNALING		0xa
+#define RDES_PTP_PKT_RESERVED_TYPE	0xf
+
+#ifdef TC956X_SRIOV_VF /* MMC SW counter related */
+/* RDES3 PMT message type definitions */
+#define RDES_PMT_NO_PTP			0x0
+#define RDES_PMT_SYNC			0x1
+#define RDES_PMT_FOLLOW_UP		0x2
+#define RDES_PMT_DELAY_REQ		0x3
+#define RDES_PMT_DELAY_RESP		0x4
+#define RDES_PMT_PDELAY_REQ		0x5
+#define RDES_PMT_PDELAY_RESP		0x6
+#define RDES_PMT_PDELAY_FOLLOW_UP	0x7
+#define RDES_PMT_PTP_ANNOUNCE		0x8
+#define RDES_PMT_PTP_MANAGEMENT		0x9
+#define RDES_PMT_PTP_SIGNALING		0xa
+#define RDES_PMT_PTP_PKT_RESERVED_TYPE	0xf
+#endif
+/* Basic descriptor structure for normal and alternate descriptors */
+struct dma_desc {
+	__le32 des0;
+	__le32 des1;
+	__le32 des2;
+	__le32 des3;
+};
+
+/* Extended descriptor structure (e.g. >= databook 3.50a) */
+struct dma_extended_desc {
+	struct dma_desc basic;	/* Basic descriptors */
+	__le32 des4;	/* Extended Status */
+	__le32 des5;	/* Reserved */
+	__le32 des6;	/* Tx/Rx Timestamp Low */
+	__le32 des7;	/* Tx/Rx Timestamp High */
+};
+
+/* Enhanced descriptor for TBS */
+struct dma_edesc {
+	__le32 des4;
+	__le32 des5;
+	__le32 des6;
+	__le32 des7;
+	struct dma_desc basic;
+};
+
+/* Transmit checksum insertion control */
+#define	TX_CIC_FULL	3	/* Include IP header and pseudoheader */
+
+#endif /* __DESCS_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/dwxgmac2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/dwxgmac2.h
@@ -0,0 +1,888 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * dwxgmac2.h
+ *
+ * Copyright (C) 2018 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  17 Jul 2020 : 1. Filtering updates
+ *  VERSION     : 00-01
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  29 Jul 2021 : 1. Add support to set MAC Address register
+ *  VERSION     : 01-00-07
+ *  14 Sep 2021 : 1. Synchronization between ethtool vlan features
+ *                   "rx-vlan-offload", "rx-vlan-filter", "tx-vlan-offload" output and register settings.
+ *                2. Added ethtool support to update "rx-vlan-offload", "rx-vlan-filter",
+ *                   and "tx-vlan-offload".
+ *                3. Removed IOCTL TC956XMAC_VLAN_STRIP_CONFIG.
+ *                4. Removed "Disable VLAN Filter" option in IOCTL TC956XMAC_VLAN_FILTERING.
+ *  VERSION     : 01-00-13
+ *  19 Oct 2021 : 1. Adding M3 SRAM Debug counters to ethtool statistics
+ *                2. Adding MTL RX Overflow/packet miss count, TX underflow counts,Rx Watchdog value to ethtool statistics.
+ *  VERSION     : 01-00-17
+ *  25 Oct 2021 : 1. Added EEE macros for MAC controlled EEE.
+ *  VERSION     : 01-00-19
+ *  31 Jan 2022 : 1. Additional macros defined for debug dump API usage.
+ *  VERSION     : 01-00-39
+ *  02 Feb 2022 : 1. Macros added for Tx Queue flush and Rx DMA flush
+ *  VERSION     : 01-00-40
+ *  18 Dec 2023 : 1. IOCTL/TC/IPA/ModuleParams register write bug fixes.
+ *  VERSION     : 01-00-41
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *  VERSION     : 04-00
+ *  29 Mar 2024 : 1. Support for without MDIO and without PHY case
+ *  VERSION     : 04-00
+ */
+
+
+#ifndef __TC956XMAC_DWXGMAC2_H__
+#define __TC956XMAC_DWXGMAC2_H__
+
+#include "common.h"
+
+/* Misc */
+#define XGMAC_JUMBO_LEN		(TC956XMAC_ALIGN(9000))
+
+/* MAC Registers */
+#define XGMAC_TX_CONFIG		(MAC_OFFSET + 0x00000000)
+#define XGMAC_CONFIG_SS_OFF		29
+#define XGMAC_CONFIG_SS_MASK		GENMASK(31, 29)
+#define XGMAC_CONFIG_SS_10000		(0x0 << XGMAC_CONFIG_SS_OFF)
+#define XGMAC_CONFIG_SS_2500_GMII	(0x2 << XGMAC_CONFIG_SS_OFF)
+#define XGMAC_CONFIG_SS_1000_GMII	(0x3 << XGMAC_CONFIG_SS_OFF)
+#define XGMAC_CONFIG_SS_100_MII	(0x4 << XGMAC_CONFIG_SS_OFF)
+#define XGMAC_CONFIG_SS_5000		(0x5 << XGMAC_CONFIG_SS_OFF)
+#define XGMAC_CONFIG_SS_2500		(0x6 << XGMAC_CONFIG_SS_OFF)
+#define XGMAC_CONFIG_SS_10_MII		(0x7 << XGMAC_CONFIG_SS_OFF)
+#define XGMAC_CONFIG_SARC		GENMASK(22, 20)
+#define XGMAC_CONFIG_SARC_SHIFT	20
+#define XGMAC_CONFIG_JD		BIT(16)
+#define XGMAC_CONFIG_TE		BIT(0)
+#define XGMAC_CORE_INIT_TX		(XGMAC_CONFIG_JD)
+#define XGMAC_RX_CONFIG		(MAC_OFFSET + 0x00000004)
+#define XGMAC_CONFIG_ARPEN		BIT(31)
+#define XGMAC_CONFIG_GPSL		GENMASK(29, 16)
+#define XGMAC_CONFIG_GPSL_SHIFT	16
+#define XGMAC_CONFIG_HDSMS		GENMASK(14, 12)
+#define XGMAC_CONFIG_HDSMS_SHIFT	12
+#define XGMAC_CONFIG_HDSMS_256		(0x2 << XGMAC_CONFIG_HDSMS_SHIFT)
+#define XGMAC_CONFIG_S2KP		BIT(11)
+#define XGMAC_CONFIG_LM		BIT(10)
+#define XGMAC_CONFIG_IPC		BIT(9)
+#define XGMAC_CONFIG_JE		BIT(8)
+#define XGMAC_CONFIG_WD		BIT(7)
+#define XGMAC_CONFIG_GPSLCE		BIT(6)
+#define XGMAC_CONFIG_DCRCC		BIT(3)
+#define XGMAC_CONFIG_CST		BIT(2)
+#define XGMAC_CONFIG_ACS		BIT(1)
+#define XGMAC_CONFIG_RE		BIT(0)
+#define XGMAC_CORE_INIT_RX		(XGMAC_CONFIG_GPSLCE | XGMAC_CONFIG_WD | \
+					((XGMAC_JUMBO_LEN + ETH_HLEN + ETH_FCS_LEN + \
+					  VLAN_HLEN) << XGMAC_CONFIG_GPSL_SHIFT))
+#define XGMAC_PACKET_FILTER		(MAC_OFFSET + 0x00000008)
+#define XGMAC_EXTENDED_REG		(MAC_OFFSET + 0x00000140)
+#define XGMAC_PACKET_FILTER_DAIF	BIT(3)
+#define XGMAC_PACKET_FILTER_DAIF_LPOS	(3)
+#define XGMAC_PACKET_FILTER_SA			BIT(9)
+#define XGMAC_PACKET_FILTER_SAIF			BIT(8)
+#define XGMAC_SA							BIT(30)
+
+#define XGMAC_PACKET_FILTER_MASK_PR_DIS    (0x7FFFFB6E)
+#define XGMAC_PACKET_FILTER_MASK_PR_EN     (0xFFFFFB6E)
+#define XGMAC_FILTER_DDS		BIT(7)
+#define XGMAC_FILTER_RA		BIT(31)
+#define XGMAC_FILTER_IPFE		BIT(20)
+#define XGMAC_FILTER_VTFE		BIT(16)
+#define XGMAC_FILTER_VTFE_LPOS		(16)
+#define XGMAC_FILTER_HPF		BIT(10)
+#define XGMAC_FILTER_PCF		BIT(7)
+#define XGMAC_FILTER_PM		BIT(4)
+#define XGMAC_FILTER_DAIF		BIT(3)
+#define XGMAC_FILTER_DAIF_LPOS		(3)
+#define XGMAC_FILTER_HMC		BIT(2)
+#define XGMAC_FILTER_HUC		BIT(1)
+#define XGMAC_FILTER_PR		BIT(0)
+#define XGMAC_HASH_TABLE(x)		(MAC_OFFSET + (0x00000010 + (x) * 4))
+#define XGMAC_HI_DCS_SHIFT		16
+#define XGMAC_HI_REG_AE		BIT(31)
+#define XGMAC_HI_REG_DCS_MASK		GENMASK(17, 16)
+#define XGMAC_HI_REG_DCS1		BIT(16)
+#define XGMAC_HI_REG_DCS2		BIT(17)
+#define XGMAC_HI_REG_PF		(BIT(16) | BIT(17))
+#define XGMAC_MAX_HASH_TABLE		2
+#define XGMAC_HASH_TAB_0_31		(MAC_OFFSET + 0x00000010)
+#define XGMAC_HASH_TAB_32_63		(MAC_OFFSET + 0x00000014)
+#define XGMAC_VLAN_TAG			(MAC_OFFSET + 0x00000050)
+#define XGMAC_VLAN_EVLRXS		BIT(24)
+#define XGMAC_VLAN_EDVLP		BIT(26)
+#define XGMAC_VLAN_ETV_LPOS		16
+#define XGMAC_VLAN_EVLS			GENMASK(22, 21)
+#define XGMAC_VLAN_EVLS_SHIFT		21
+#define XGMAC_VLAN_VTHM			BIT(25)
+#define XGMAC_VLANTR_VTHM_LPOS		(25)
+#define XGMAC_VLANTR_VTIM		BIT(17)
+#define XGMAC_VLANTR_VTIM_LPOS		(17)
+#define XGMAC_VLAN_DOVLTC		BIT(20)
+#define XGMAC_VLAN_ERSVLM		BIT(19)
+#define XGMAC_VLAN_ESVL		BIT(18)
+#define XGMAC_VLAN_ETV			BIT(16)
+#define XGMAC_VLAN_ETV_DATA		BIT(17)
+#define XGMAC_VLAN_VID			GENMASK(15, 0)
+#define XGMAC_VLAN_VL_LPOS		(0)
+#define XGMAC_VLAN_HASH_TABLE		(MAC_OFFSET + 0x00000058)
+#define XGMAC_VLAN_INCL		(MAC_OFFSET + 0x00000060)
+#define XGMAC_VLAN_VLTI		BIT(20)
+#define XGMAC_VLAN_CSVL		BIT(19)
+#define XGMAC_VLAN_VLC			GENMASK(17, 16)
+#define XGMAC_VLAN_VLC_SHIFT		16
+#define XGMAC_RXQ_CTRL0		(MAC_OFFSET + 0x000000a0)
+#define XGMAC_RXQEN(x)			GENMASK((x) * 2 + 1, (x) * 2)
+#define XGMAC_RXQEN_SHIFT(x)		((x) * 2)
+#define XGMAC_RXQ_CTRL1		(MAC_OFFSET + 0x000000a4)
+#define XGMAC_RQ			GENMASK(7, 4)
+#define XGMAC_RQ_SHIFT			4
+#define XGMAC_RXQ_CTRL2		(MAC_OFFSET + 0x000000a8)
+#define XGMAC_RXQ_CTRL3		(MAC_OFFSET + 0x000000ac)
+#define XGMAC_RXQ_CTRL4		(MAC_OFFSET + 0x00000094)
+#define XGMAC_VFFQ_MASK			GENMASK(20, 17)
+#define XGMAC_VFFQ_SHIFT		17
+#define XGMAC_MFFQ_MASK			GENMASK(12, 9)
+#define XGMAC_MFFQ_SHIFT		9
+#define XGMAC_UFFQ_MASK			GENMASK(4, 1)
+#define XGMAC_UFFQ_SHIFT		1
+#define XGMAC_VFFQE			BIT(16)
+#define XGMAC_MFFQE			BIT(8)
+#define XGMAC_UFFQE			BIT(0)
+#define XGMAC_PSRQ(x)			GENMASK((x) * 8 + 7, (x) * 8)
+#define XGMAC_PSRQ_SHIFT(x)		((x) * 8)
+#define XGMAC_INT_STATUS		(MAC_OFFSET + 0x000000b0)
+#define XGMAC_TSIS			BIT(12)
+#define XGMAC_LPIIS			BIT(5)
+#define XGMAC_PMTIS			BIT(4)
+#define XGMAC_INT_EN			(MAC_OFFSET + 0x000000b4)
+#define XGMAC_TSIE			BIT(12)
+#define XGMAC_LPIIE			BIT(5)
+#define XGMAC_PMTIE			BIT(4)
+#define XGMAC_AUXTSTRIG		BIT(2) /* MAC_Timestamp_Status register */
+#ifndef TC956X
+#define XGMAC_INT_DEFAULT_EN		(XGMAC_LPIIE | XGMAC_PMTIE)
+#else
+#define XGMAC_INT_DEFAULT_EN		(XGMAC_LPIIE)
+#endif
+
+#define XGMAC_RX_TX_STS			(MAC_OFFSET + 0x000000b8)
+#define XGMAC_Qx_TX_FLOW_CTRL(x)	(MAC_OFFSET + (0x00000070 + (x) * 4))
+#define XGMAC_PT			GENMASK(31, 16)
+#define XGMAC_PT_SHIFT			16
+#define XGMAC_TFE			BIT(1)
+#define XGMAC_FCB			BIT(0)
+#define XGMAC_RX_FLOW_CTRL		(MAC_OFFSET + 0x00000090)
+#define XGMAC_PFCE			BIT(8)
+#define XGMAC_RFE			BIT(0)
+#define XGMAC_PMT			(MAC_OFFSET + 0x000000c0)
+#define XGMAC_GLBLUCAST		BIT(9)
+#define XGMAC_RWKPKTEN			BIT(2)
+#define XGMAC_MGKPKTEN			BIT(1)
+#define XGMAC_PWRDWN			BIT(0)
+#define XGMAC_LPI_CTRL			(MAC_OFFSET + 0x000000d0)
+#define XGMAC_TXCGE			BIT(21)
+#define XGMAC_LPITXA			BIT(19)
+
+#ifdef EEE_MAC_CONTROLLED_MODE
+#define XGMAC_PLSDIS			BIT(18)
+#define XGMAC_LPIATE			BIT(20)
+#endif
+#define XGMAC_PLS			BIT(17)
+#define XGMAC_LPITXEN			BIT(16)
+#define XGMAC_RLPIEX			BIT(3)
+#define XGMAC_RLPIEN			BIT(2)
+#define XGMAC_TLPIEX			BIT(1)
+#define XGMAC_TLPIEN			BIT(0)
+#define XGMAC_LPI_TIMER_CTRL		(MAC_OFFSET + 0x000000d4)
+#define XGMAC_LPI_TIMER_CTRL_TWT_MASK	GENMASK(15, 0)
+#define XGMAC_LPI_TIMER_CTRL_LST_MASK	GENMASK(25, 16)
+#define XGMAC_LPI_TIMER_CTRL_LST_SHIFT	16
+
+#ifdef EEE_MAC_CONTROLLED_MODE
+#define XGMAC_LPI_1US_Tic_Counter	(MAC_OFFSET + 0x000000dc)
+#define XGMAC_LPI_1US_Tic_Counter_MASK		GENMASK(11, 0)
+#define XGMAC_LPI_Auto_Entry_Timer	(MAC_OFFSET + 0x000000d8)
+#define XGMAC_LPIET			0xFFFF8
+#endif
+#define XGMAC_DEBUG			(MAC_OFFSET + 0x00000114)
+#define XGMAC_HW_FEATURE0		(MAC_OFFSET + 0x0000011c)
+#define XGMAC_HW_FEATURE0_BASE		(0x0000011c)
+#define XGMAC_HWFEAT_SAVLANINS		BIT(27)
+#define XGMAC_HWFEAT_RXCOESEL		BIT(16)
+#define XGMAC_HWFEAT_TXCOESEL		BIT(14)
+#define XGMAC_HWFEAT_EEESEL		BIT(13)
+#define XGMAC_HWFEAT_TSSEL		BIT(12)
+#define XGMAC_HWFEAT_AVSEL		BIT(11)
+#define XGMAC_HWFEAT_RAVSEL		BIT(10)
+#define XGMAC_HWFEAT_ARPOFFSEL		BIT(9)
+#define XGMAC_HWFEAT_MMCSEL		BIT(8)
+#define XGMAC_HWFEAT_MGKSEL		BIT(7)
+#define XGMAC_HWFEAT_RWKSEL		BIT(6)
+#ifdef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+#define XGMAC_HWFEAT_SMASEL		BIT(5)
+#endif
+#define XGMAC_HWFEAT_VLHASH		BIT(4)
+#define XGMAC_HWFEAT_GMIISEL		BIT(1)
+#define XGMAC_HW_FEATURE1		(MAC_OFFSET + 0x00000120)
+#define XGMAC_HW_FEATURE1_BASE		(0x00000120)
+#define XGMAC_HWFEAT_L3L4FNUM		GENMASK(30, 27)
+#define XGMAC_HWFEAT_HASHTBLSZ		GENMASK(25, 24)
+#define XGMAC_HWFEAT_RSSEN		BIT(20)
+#define XGMAC_HWFEAT_TSOEN		BIT(18)
+#define XGMAC_HWFEAT_SPHEN		BIT(17)
+#define XGMAC_HWFEAT_OSTEN		BIT(11)
+#define XGMAC_HWFEAT_PTOEN		BIT(12)
+#define XGMAC_HWFEAT_ADDR64		GENMASK(15, 14)
+#define XGMAC_HWFEAT_TXFIFOSIZE	GENMASK(10, 6)
+#define XGMAC_HWFEAT_RXFIFOSIZE	GENMASK(4, 0)
+#define XGMAC_HW_FEATURE2		(MAC_OFFSET + 0x00000124)
+#define XGMAC_HW_FEATURE2_BASE		(0x00000124)
+#define XGMAC_HWFEAT_AUXSNAPNUM		GENMASK(30, 28)
+#define XGMAC_HWFEAT_PPSOUTNUM		GENMASK(26, 24)
+#define XGMAC_HWFEAT_TXCHCNT		GENMASK(21, 18)
+#define XGMAC_HWFEAT_TXCHCNT_SHIFT	(18)
+#define XGMAC_HWFEAT_RXCHCNT		GENMASK(15, 12)
+#define XGMAC_HWFEAT_RXCHCNT_SHIFT	(12)
+#define XGMAC_HWFEAT_TXQCNT		GENMASK(9, 6)
+#define XGMAC_HWFEAT_RXQCNT		GENMASK(3, 0)
+#define XGMAC_HW_FEATURE3		(MAC_OFFSET + 0x00000128)
+#define XGMAC_HW_FEATURE3_BASE		(0x00000128)
+#define XGMAC_HWFEAT_TBSSEL		BIT(27)
+#define XGMAC_HWFEAT_FPESEL		BIT(26)
+#define XGMAC_HWFEAT_ESTWID		GENMASK(24, 23)
+#define XGMAC_HWFEAT_ESTDEP		GENMASK(22, 20)
+#define XGMAC_HWFEAT_ESTSEL		BIT(19)
+#define XGMAC_HWFEAT_ASP		GENMASK(15, 14)
+#define XGMAC_HWFEAT_DVLAN		BIT(13)
+#define XGMAC_HWFEAT_FRPES		GENMASK(12, 11)
+#define XGMAC_HWFEAT_FRPPB		GENMASK(10, 9)
+#define XGMAC_HWFEAT_FRPSEL		BIT(3)
+#define XGMAC_MAC_DPP_FSM_INT_STATUS	(MAC_OFFSET + 0x00000150)
+#define XGMAC_MAC_FSM_CONTROL		(MAC_OFFSET + 0x00000158)
+#define XGMAC_PRTYEN			BIT(1)
+#define XGMAC_TMOUTEN			BIT(0)
+#define XGMAC_MDIO_ADDR		(MAC_OFFSET + 0x00000200)
+#define XGMAC_MDIO_DATA		(MAC_OFFSET + 0x00000204)
+#define XGMAC_MDIO_C22P		(MAC_OFFSET + 0x00000220)
+#define XGMAC_FPE_CTRL_STS		(MAC_OFFSET + 0x00000280)
+#define XGMAC_EFPE			BIT(0)
+#define XGMAC_ADDRx_HIGH(x)		(MAC_OFFSET + (0x00000300 + (x) * 0x8))
+#define XGMAC_VLAN_TAG_CTRL		(MAC_OFFSET + 0x00000050)
+#define XGMAC_VLAN_TAG_DATA		(MAC_OFFSET + 0x00000054)
+#define XGMAC_ADDR_OFFSET			GENMASK(6, 2)
+#define XGMAC_ADDR_OFFSET_LPOS		2
+#define XGMAC_VLAN_CT			BIT(1)
+#define XGMAC_VLAN_OB			BIT(0)
+#define XGMAC_VLAN_DMACHE		BIT(24)
+#define XGMAC_VLAN_EN			BIT(16)
+#define TC956X_VLAN_DMACH		BIT(25)	/* DMA CHANNEL = 1*/
+#define XGMAC_DMA_In(x)		(MAC_OFFSET + (0x00000704 + (x) * 0x4))
+#define XGMAC_INDR_ACC_CTRL		(MAC_OFFSET + 0x00000700)
+#define XGMAC_INDR_ACC_CTRL_RSVD	BIT(31)
+#define XGMAC_INDR_ACC_CTRL_MSEL	GENMASK(19, 16)
+#define XGMAC_INDR_ACC_CTRL_MSEL_SHIFT	(16)
+#define XGMAC_INDR_ACC_CTRL_AOFF	GENMASK(15, 8)
+#define XGMAC_INDR_ACC_CTRL_AOFF_SHIFT	(8)
+#define XGMAC_INDR_ACC_CTRL_AUTO	BIT(5)
+#define XGMAC_INDR_ACC_CTRL_COM		BIT(1)
+#define XGMAC_INDR_ACC_CTRL_COM_SHIFT	(1)
+#define XGMAC_INDR_ACC_CTRL_OB		BIT(0)
+#define XGMAC_INDR_ACC_CTRL_OB_SHIFT	(0)
+#define XGMAC_DCHSEL			(0)
+#define XGMAC_INDR_ACC_DATA		(MAC_OFFSET + 0x00000704)
+#define XGMAC_MSEL_DCHSEL		(0)
+#define XGMAC_COM_READ			(1)
+#define XGMAC_COM_WRITE			(0)
+#define XGMAC_ADDR_MAX			32
+#define XGMAC_AE			BIT(31)
+#define XGMAC_AE_SHIFT			31
+#define XGMAC_MBC			GENSMASK(29, 24)
+#define XGMAC_MBC_SHIFT		24
+#define XGMAC_DCS			GENMASK(19, 16)
+#define XGMAC_DCS_SHIFT		16
+#define XGMAC_ADDRx_LOW(x)		(MAC_OFFSET + (0x00000304 + (x) * 0x8))
+#define XGMAC_L3L4_ADDR_CTRL		(MAC_OFFSET + 0x00000c00)
+#define XGMAC_IDDR			GENMASK(15, 8)
+#define XGMAC_IDDR_SHIFT		8
+#define XGMAC_IDDR_FNUM		4
+#define XGMAC_TT			BIT(1)
+#define XGMAC_XB			BIT(0)
+#define XGMAC_L3L4_DATA		(MAC_OFFSET + 0x00000c04)
+#define XGMAC_L3L4_CTRL		0x0
+#define XGMAC_L4DPIM0			BIT(21)
+#define XGMAC_L4DPM0			BIT(20)
+#define XGMAC_L4SPIM0			BIT(19)
+#define XGMAC_L4SPM0			BIT(18)
+#define XGMAC_L4PEN0			BIT(16)
+#define XGMAC_L3HDBM0			GENMASK(15, 11)
+#define XGMAC_L3HSBM0			GENMASK(10, 6)
+#define XGMAC_L3DAIM0			BIT(5)
+#define XGMAC_L3DAM0			BIT(4)
+#define XGMAC_L3SAIM0			BIT(3)
+#define XGMAC_L3SAM0			BIT(2)
+#define XGMAC_L3PEN0			BIT(0)
+#define XGMAC_L4_ADDR			0x1
+#define XGMAC_L4DP0			GENMASK(31, 16)
+#define XGMAC_L4DP0_SHIFT		16
+#define XGMAC_L4SP0			GENMASK(15, 0)
+#define XGMAC_L3_ADDR0			0x4
+#define XGMAC_L3_ADDR1			0x5
+#define XGMAC_L3_ADDR2			0x6
+#define XMGAC_L3_ADDR3			0x7
+#define XGMAC_ARP_ADDR			(MAC_OFFSET + 0x00000c10)
+#define XGMAC_RSS_CTRL			(MAC_OFFSET + 0x00000c80)
+#define XGMAC_UDP4TE			BIT(3)
+#define XGMAC_TCP4TE			BIT(2)
+#define XGMAC_IP2TE			BIT(1)
+#define XGMAC_RSSE			BIT(0)
+#define XGMAC_RSS_ADDR			(MAC_OFFSET + 0x00000c88)
+#define XGMAC_RSSIA_SHIFT		8
+#define XGMAC_ADDRT			BIT(2)
+#define XGMAC_CT			BIT(1)
+#define XGMAC_OB			BIT(0)
+#define XGMAC_RSS_DATA			(MAC_OFFSET + 0x00000c8c)
+#define XGMAC_TIMESTAMP_STATUS		(MAC_OFFSET + 0x00000d20)
+#define XGMAC_TXTSC			BIT(15)
+#define XGMAC_TXTIMESTAMP_NSEC		(MAC_OFFSET + 0x00000d30)
+#define XGMAC_TXTSSTSLO		GENMASK(30, 0)
+#define XGMAC_TXTIMESTAMP_SEC		(MAC_OFFSET + 0x00000d34)
+#define XGMAC_INGRESSTIMESTAMP_NSEC	(MAC_OFFSET + 0x00000d58)
+#define XGMAC_INGRESSTIMESTAMP_SEC	(MAC_OFFSET + 0x00000d5c)
+#define XGMAC_PPS_CONTROL		(MAC_OFFSET + 0x00000d70)
+#define XGMAC_PPS_MAXIDX(x)		((((x) + 1) * 8) - 1)
+#define XGMAC_PPS_MINIDX(x)		((x) * 8)
+#define XGMAC_PPSx_MASK(x)		\
+	(GENMASK(XGMAC_PPS_MAXIDX(x), XGMAC_PPS_MINIDX(x)))
+#define XGMAC_TRGTMODSELx(x, val)	\
+	(GENMASK(XGMAC_PPS_MAXIDX(x) - 1, XGMAC_PPS_MAXIDX(x) - 2) & \
+	((val) << (XGMAC_PPS_MAXIDX(x) - 2)))
+#define XGMAC_PPSCMDx(x, val)		\
+	(GENMASK(XGMAC_PPS_MINIDX(x) + 3, XGMAC_PPS_MINIDX(x)) & \
+	((val) << XGMAC_PPS_MINIDX(x)))
+#define XGMAC_PPSCMD_START		0x2
+#define XGMAC_PPSCMD_STOP		0x5
+#define XGMAC_PPSEN0			BIT(4)
+#define XGMAC_PPSx_TARGET_TIME_SEC(x)	(MAC_OFFSET + (0x00000d80 + (x) * 0x10))
+#define XGMAC_PPSx_TARGET_TIME_NSEC(x)	(MAC_OFFSET + (0x00000d84 + (x) * 0x10))
+#define XGMAC_TRGTBUSY0			BIT(31)
+#define XGMAC_PPSx_INTERVAL(x)	(MAC_OFFSET + (0x00000d88 + (x) * 0x10))
+#define XGMAC_PPSx_WIDTH(x)		(MAC_OFFSET + (0x00000d8c + (x) * 0x10))
+#define XGMAC_PTO_CTRL			(MAC_OFFSET + 0x00000dc0)
+#define XGMAC_APDREQEN			BIT(2)
+#define XGMAC_ASYNCEN			BIT(1)
+#define XGMAC_PTOEN			BIT(0)
+
+#define ABSOLUTE_LEOS			0x2FAF1 /* Launch Expiry Offset ~50ms */
+#define EST_LEOS			0x1E4 /* Launch expiry offset ~124us (CTR -1) */
+#define LEGOS				7
+
+#ifdef TC956X
+#define XGMAC_MAC_AUX_CTRL		(MAC_OFFSET + 0x00000d40)
+#endif
+#define XGMAC_ATSEN3			BIT(7)
+#define XGMAC_ATSEN2			BIT(6)
+#define XGMAC_ATSEN1			BIT(5)
+#define XGMAC_ATSEN0			BIT(4)
+#define XGMAC_ATSFC			BIT(0)
+
+/* MTL Registers */
+#define XGMAC_MTL_OPMODE		(MAC_OFFSET + 0x00001000)
+#define XGMAC_FRPE			BIT(15)
+#define XGMAC_ETSALG			GENMASK(6, 5)
+#define XGMAC_WRR			(0x0 << 5)
+#define XGMAC_WFQ			(0x1 << 5)
+#define XGMAC_DWRR			(0x2 << 5)
+#define XGMAC_RAA			BIT(2)
+#define XGMAC_MTL_INT_STATUS		(MAC_OFFSET + 0x00001020)
+#define XGMAC_MTL_RXQ_DMA_MAP0		(MAC_OFFSET + 0x00001030)
+#define XGMAC_MTL_RXQ_DMA_MAP1		(MAC_OFFSET + 0x00001034)
+#define XGMAC_QxDDMACH_SHIFT(x)		((x * 8) + 7)
+#define XGMAC_QxMDMACH(x)		GENMASK((x) * 8 + 7, (x) * 8)
+#define XGMAC_QxMDMACH_SHIFT(x)	((x) * 8)
+#define XGMAC_QDDMACH			BIT(7)
+#define XGMAC_TC_PRTY_MAP0		(MAC_OFFSET + 0x00001040)
+#define XGMAC_TC_PRTY_MAP1		(MAC_OFFSET + 0x00001044)
+#define XGMAC_PSTC(x)			GENMASK((x) * 8 + 7, (x) * 8)
+#define XGMAC_PSTC_SHIFT(x)		((x) * 8)
+#define XGMAC_MTL_TBS_CTRL		(MAC_OFFSET + 0x00001048)
+#define XGMAC_LEOS			GENMASK(31, 8)
+#define XGMAC_LEOS_SHIFT		8
+#define XGMAC_ESTM			BIT(0)
+#define XGMAC_MTL_EST_CONTROL		(MAC_OFFSET + 0x00001050)
+#define XGMAC_PTOV			GENMASK(31, 23)
+#define XGMAC_PTOV_SHIFT		23
+#define XGMAC_SSWL			BIT(1)
+#define XGMAC_EEST			BIT(0)
+#define XGMAC_MTL_EST_STATUS		(MAC_OFFSET + 0x00001058)
+#define XGMAC_SWOL			BIT(7)
+#define XGMAC_MTL_EST_GCL_CONTROL	(MAC_OFFSET + 0x00001080)
+#define XGMAC_BTR_LOW			0x0
+#define XGMAC_BTR_HIGH			0x1
+#define XGMAC_CTR_LOW			0x2
+#define XGMAC_CTR_HIGH			0x3
+#define XGMAC_TER			0x4
+#define XGMAC_LLR			0x5
+#define XGMAC_ADDR_SHIFT		8
+#define XGMAC_DBGM			BIT(4)
+#define XGMAC_GCRR			BIT(2)
+#define XGMAC_R1W0			BIT(1)
+#define XGMAC_SRWO			BIT(0)
+#define XGMAC_MTL_EST_GCL_DATA		(MAC_OFFSET + 0x00001084)
+#define XGMAC_MTL_FPE_CTRL_STS		(MAC_OFFSET + 0x00001090)
+#define XGMAC_MTL_FPE_PEC_MASK		GENMASK(15, 8)
+#define XGMAC_MTL_FPE_PEC_SHIFT	8
+#define XGMAC_MTL_FPE_AFSZ_MASK	GENMASK(1, 0)
+#define XGMAC_MTL_FPE_ADVANCE		(MAC_OFFSET + 0x00001094)
+#define XGMAC_MTL_FPE_HOLD_ADVANCE_MASK	GENMASK(15, 0)
+#define XGMAC_MTL_FPE_RELEASE_ADVANCE_MASK	GENMASK(31, 16)
+#define XGMAC_MTL_FPE_ADVANCE_SHIFT	16
+#define XGMAC_MTL_RXP_CONTROL_STATUS	(MAC_OFFSET + 0x000010a0)
+#define XGMAC_RXPI			BIT(31)
+#define XGMAC_NPE			GENMASK(23, 16)
+#define XGMAC_NVE			GENMASK(7, 0)
+#define XGMAC_MTL_RXP_IACC_CTRL_ST	(MAC_OFFSET + 0x000010b0)
+#define XGMAC_STARTBUSY		BIT(31)
+#define XGMAC_ACCSEL		BIT(24)
+#define XGMAC_WRRDN			BIT(16)
+#define XGMAC_ADDR			GENMASK(9, 0)
+#define XGMAC_MTL_RXP_IACC_DATA	(MAC_OFFSET + 0x000010b4)
+#define XGMAC_MTL_ECC_CONTROL		(MAC_OFFSET + 0x000010c0)
+#define XGMAC_MTL_SAFETY_INT_STATUS	(MAC_OFFSET + 0x000010c4)
+#define XGMAC_MEUIS			BIT(1)
+#define XGMAC_MECIS			BIT(0)
+#define XGMAC_MTL_ECC_INT_ENABLE	(MAC_OFFSET + 0x000010c8)
+#define XGMAC_RPCEIE			BIT(12)
+#define XGMAC_ECEIE			BIT(8)
+#define XGMAC_RXCEIE			BIT(4)
+#define XGMAC_TXCEIE			BIT(0)
+#define XGMAC_MTL_ECC_INT_STATUS	(MAC_OFFSET + 0x000010cc)
+#define XGMAC_MTL_TXQ_OPMODE(x)	(MAC_OFFSET + (0x00001100 + (0x80 * (x))))
+#define XGMAC_TQS			GENMASK(25, 16)
+#define XGMAC_TQS_SHIFT		16
+#define XGMAC_Q2TCMAP			GENMASK(10, 8)
+#define XGMAC_Q2TCMAP_SHIFT		8
+#define XGMAC_TTC			GENMASK(6, 4)
+#define XGMAC_TTC_SHIFT		4
+#define XGMAC_TXQEN			GENMASK(3, 2)
+#define XGMAC_TXQEN_SHIFT		2
+#define XGMAC_TSF			BIT(1)
+#define XGMAC_FTQ			BIT(0)
+
+#define XGMAC_MTL_TXQ_UF_OFFSET(x)	(MAC_OFFSET + (0x00001104 + (0x80 * (x))))
+#define XGMAC_MTL_UFPKTCNT_MASK		GENMASK(10, 0)
+#define XGMAC_MTL_TXQ_UFPKT_CNT(x)	((XGMAC_MTL_TXQ_UF_OFFSET(x)) & XGMAC_MTL_UFPKTCNT_MASK)
+
+#define XGMAC_MTL_TXQ_Debug(x)		(MAC_OFFSET + (0x00001108 + (0x80 * (x))))
+#define XGMAC_MTL_DEBUG_TXQSTS		BIT(4)
+#define XGMAC_MTL_DEBUG_TWCSTS		BIT(3)
+#define XGMAC_MTL_DEBUG_TRCSTS_MASK	GENMASK(2, 1)
+#define XGMAC_MTL_DEBUG_TRCSTS_SHIFT	1
+#define XGMAC_MTL_DEBUG_TRCSTS_IDLE	0
+#define XGMAC_MTL_DEBUG_TRCSTS_READ	1
+#define XGMAC_MTL_DEBUG_TRCSTS_TXW	2
+#define XGMAC_MTL_DEBUG_TRCSTS_WRITE	3
+#define XGMAC_MTL_DEBUG_TCPAUSED	BIT(0)
+#define XGMAC_MTL_TCx_ETS_CONTROL(x)	(MAC_OFFSET + (0x00001110 + (0x80 * (x))))
+#define XGMAC_MTL_TCx_QUANTUM_WEIGHT(x) (MAC_OFFSET + (0x00001118 + (0x80 * (x))))
+#define XGMAC_MTL_TCx_QUANTUM_WEIGHT_ISCQW_MASK	GENMASK(20, 0)
+#define XGMAC_MTL_TCx_SENDSLOPE(x)	(MAC_OFFSET + (0x0000111c + (0x80 * (x))))
+#define XGMAC_MTL_TCx_SENDSLOPE_CRED_SSC_MASK	GENMASK(15, 0)
+#define XGMAC_MTL_TCx_HICREDIT(x)	(MAC_OFFSET + (0x00001120 + (0x80 * (x))))
+#define XGMAC_MTL_TCx_HICREDIT_HC_MASK		GENMASK(28, 0)
+#define XGMAC_MTL_TCx_LOCREDIT(x)	(MAC_OFFSET + (0x00001124 + (0x80 * (x))))
+#define XGMAC_MTL_TCx_LOCREDIT_LC_MASK		GENMASK(28, 0)
+#define XGMAC_CC			BIT(3)
+#define XGMAC_TSA			GENMASK(1, 0)
+#define XGMAC_SP			(0x0 << 0)
+#define XGMAC_CBS			(0x1 << 0)
+#define XGMAC_ETS			(0x2 << 0)
+#define XGMAC_MTL_RXQ_OPMODE(x)	(MAC_OFFSET + (0x00001140 + (0x80 * (x))))
+#define XGMAC_RQS			GENMASK(25, 16)
+#define XGMAC_RQS_SHIFT		16
+#define XGMAC_EHFC			BIT(7)
+#define XGMAC_RSF			BIT(5)
+#define XGMAC_RTC			GENMASK(1, 0)
+#define XGMAC_RTC_SHIFT		0
+#define XGMAC_MTL_RXQ_MISS_PKT_OF_CNT_OFFSET(x)	(MAC_OFFSET + 0x00001144 + (0x80 * (x)))
+#define XGMAC_OVFPKTCNT_MASK		GENMASK(10, 0)
+#define XGMAC_MISPKTCNT_MASK		GENMASK(26, 16)
+#define XGMAC_MISPKTCNT_SHIFT		16
+
+#ifdef TC956X_SRIOV_PF
+#define XGMAC_MTL_RXQ_Debug(x)		(MAC_OFFSET + (0x00001148 + (0x80 * (x))))
+#elif defined TC956X_SRIOV_VF
+#define XGMAC_MTL_RXQ_Debug(x)		(0x00001148 + (0x80 * (x)))
+#endif
+#define XGMAC_MTL_DEBUG_RXQSTS_MASK	GENMASK(5, 4)
+#define XGMAC_MTL_DEBUG_RXQSTS_SHIFT	4
+#define XGMAC_MTL_DEBUG_RXQSTS_EMPTY	0
+#define XGMAC_MTL_DEBUG_RXQSTS_BT	1
+#define XGMAC_MTL_DEBUG_RXQSTS_AT	2
+#define XGMAC_MTL_DEBUG_RXQSTS_FULL	3
+#define XGMAC_MTL_DEBUG_RRCSTS_MASK	GENMASK(2, 1)
+#define XGMAC_MTL_DEBUG_RRCSTS_SHIFT	1
+#define XGMAC_MTL_DEBUG_RRCSTS_IDLE	0
+#define XGMAC_MTL_DEBUG_RRCSTS_RDATA	1
+#define XGMAC_MTL_DEBUG_RRCSTS_RSTAT	2
+#define XGMAC_MTL_DEBUG_RRCSTS_FLUSH	3
+#define XGMAC_MTL_DEBUG_RWCSTS		BIT(0)
+#define XGMAC_DEBUG_TFCSTS_MASK	GENMASK(18, 17)
+#define XGMAC_DEBUG_TFCSTS_SHIFT	17
+#define XGMAC_DEBUG_TFCSTS_IDLE	0
+#define XGMAC_DEBUG_TFCSTS_WAIT	1
+#define XGMAC_DEBUG_TFCSTS_GEN_PAUSE	2
+#define XGMAC_DEBUG_TFCSTS_XFER	3
+#define XGMAC_DEBUG_TPESTS		BIT(16)
+#define XGMAC_DEBUG_RFCFCSTS_MASK	GENMASK(2, 1)
+#define XGMAC_DEBUG_RFCFCSTS_SHIFT	1
+#define XGMAC_DEBUG_RPESTS		BIT(0)
+#define XGMAC_MTL_RXQ_FLOW_CONTROL(x)	(MAC_OFFSET + (0x00001150 + (0x80 * (x))))
+#define XGMAC_RFD			GENMASK(31, 17)
+#define XGMAC_RFD_SHIFT		17
+#define XGMAC_RFA			GENMASK(15, 1)
+#define XGMAC_RFA_SHIFT		1
+#define XGMAC_MTL_QINTEN(x)		(MAC_OFFSET + (0x00001170 + (0x80 * (x))))
+#define XGMAC_RXOIE			BIT(16)
+#define XGMAC_MTL_QINT_STATUS(x)	(MAC_OFFSET + (0x00001174 + (0x80 * (x))))
+#define XGMAC_RXOVFIS			BIT(16)
+#define XGMAC_ABPSIS			BIT(1)
+#define XGMAC_TXUNFIS			BIT(0)
+#ifdef TC956X
+#define XGMAC_MAC_REGSIZE		(XGMAC_MTL_QINT_STATUS(7) / 4)/*Total 7 queue*/
+#else
+#define XGMAC_MAC_REGSIZE		(XGMAC_MTL_QINT_STATUS(15) / 4)
+#endif
+
+/* Rx Queue Routing */
+#define XGMAC_RXQCTRL_AVCPQ_MASK	GENMASK(31, 28)
+#define XGMAC_RXQCTRL_AVCPQ_SHIFT	28
+#define XGMAC_RXQCTRL_PTPQ_MASK	GENMASK(27, 24)
+#define XGMAC_RXQCTRL_PTPQ_SHIFT	24
+#define XGMAC_RXQCTRL_TACPQE		BIT(23)
+#define XGMAC_RXQCTRL_TACPQE_SHIFT	23
+#define XGMAC_RXQCTRL_TPQC_MASK	GENMASK(23, 21)
+#define XGMAC_RXQCTRL_TPQC_SHIFT	21
+#define XGMAC_RXQCTRL_OMCBCQ		BIT(20)
+#define XGMAC_RXQCTRL_OMCBCQ_SHIFT	20
+#define XGMAC_RXQCTRL_DCBCPQ_MASK	GENMASK(19, 16)
+#define XGMAC_RXQCTRL_DCBCPQ_SHIFT	16
+#define XGMAC_RXQCTRL_MCBCQEN		BIT(15)
+#define XGMAC_RXQCTRL_MCBCQEN_SHIFT	15
+#define XGMAC_RXQCTRL_MCBCQ_MASK	GENMASK(11, 8)
+#define XGMAC_RXQCTRL_MCBCQ_SHIFT	8
+#define XGMAC_RXQCTRL_FPRQ_MASK	GENMASK(7, 4)
+#define XGMAC_RXQCTRL_FPRQ_SHIFT	4
+#define XGMAC_RXQCTRL_UPQ_MASK		GENMASK(3, 0)
+#define XGMAC_RXQCTRL_UPQ_SHIFT	0
+
+/* DMA Registers */
+#define XGMAC_DMA_MODE			(MAC_OFFSET + 0x00003000)
+#define XGMAC_DSPW			BIT(8)
+#define XGMAC_DSPW_SHIFT		8
+#define XGMAC_SWR			BIT(0)
+#define XGMAC_DMA_MODE_INTM_MASK	GENMASK(13, 12)
+//#define XGMAC_DMA_MODE_INTM_SHIFT	12
+#define XGMAC_DMA_MODE_INTM			BIT(12)
+
+#define XGMAC_DMA_SYSBUS_MODE		(MAC_OFFSET + 0x00003004)
+#define XGMAC_WR_OSR_LMT		GENMASK(29, 24)
+#define XGMAC_WR_OSR_LMT_SHIFT		24
+#define XGMAC_RD_OSR_LMT		GENMASK(21, 16)
+#define XGMAC_RD_OSR_LMT_SHIFT		16
+#define XGMAC_EN_LPI			BIT(15)
+#define XGMAC_LPI_XIT_PKT		BIT(14)
+#define XGMAC_AAL			BIT(12)
+#define XGMAC_EAME			BIT(11)
+#define XGMAC_BLEN			GENMASK(7, 1)
+#define XGMAC_BLEN256			BIT(7)
+#define XGMAC_BLEN128			BIT(6)
+#define XGMAC_BLEN64			BIT(5)
+#define XGMAC_BLEN32			BIT(4)
+#define XGMAC_BLEN16			BIT(3)
+#define XGMAC_BLEN8			BIT(2)
+#define XGMAC_BLEN4			BIT(1)
+#define XGMAC_UNDEF			BIT(0)
+#define XGMAC_TX_EDMA_CTRL		(MAC_OFFSET + 0x00003040)
+#define XGMAC_TDPS			BIT(30)
+#define XGMAC_RX_EDMA_CTRL		(MAC_OFFSET + 0x00003044)
+#define XGMAC_RDPS			GENMASK(29, 0)
+#define XGMAC_DMA_TBS_CTRL0		(MAC_OFFSET + 0x00003054)
+#define XGMAC_DMA_TBS_CTRL1		(MAC_OFFSET + 0x00003058)
+#define XGMAC_DMA_TBS_CTRL2		(MAC_OFFSET + 0x0000305c)
+#define XGMAC_DMA_TBS_CTRL3		(MAC_OFFSET + 0x00003060)
+#define XGMAC_FTOS			GENMASK(31, 8)
+#define XGMAC_FTOS_SHIFT		8
+#define XGMAC_FGOS			GENMASK(6, 4)
+#define XGMAC_FGOS_SHIFT		4
+#define XGMAC_FTOV			BIT(0)
+#define XGMAC_DEF_FTOS			(XGMAC_FTOS | XGMAC_FTOV)
+#define XGMAC_DMA_SAFETY_INT_STATUS	(MAC_OFFSET + 0x00003064)
+#define XGMAC_MCSIS			BIT(31)
+#define XGMAC_MSUIS			BIT(29)
+#define XGMAC_MSCIS			BIT(28)
+#define XGMAC_DEUIS			BIT(1)
+#define XGMAC_DECIS			BIT(0)
+#define XGMAC_DMA_ECC_INT_ENABLE	(MAC_OFFSET + 0x00003068)
+#define XGMAC_DCEIE			BIT(1)
+#define XGMAC_TCEIE			BIT(0)
+#define XGMAC_DMA_ECC_INT_STATUS	(MAC_OFFSET + 0x0000306c)
+#define XGMAC_DMA_CH_CONTROL(x)	(MAC_OFFSET + (0x00003100 + (0x80 * (x))))
+#define XGMAC_SPH			BIT(24)
+#define XGMAC_PBLx8			BIT(16)
+#define XGMAC_DMA_CH_TX_CONTROL(x)	(MAC_OFFSET + (0x00003104 + (0x80 * (x))))
+#define XGMAC_EDSE			BIT(28)
+#define XGMAC_TFSEL			GENMASK(30, 29)
+#define XGMAC_TFSEL_SHIFT		29
+#define XGMAC_TxPBL			GENMASK(21, 16)
+#define XGMAC_TxPBL_SHIFT		16
+#define XGMAC_TSE			BIT(12)
+#define XGMAC_OSP			BIT(4)
+#define XGMAC_TXST			BIT(0)
+#define XGMAC_DMA_CH_RX_CONTROL(x)	(MAC_OFFSET + (0x00003108 + (0x80 * (x))))
+#define XGMAC_RxPBL			GENMASK(21, 16)
+#define XGMAC_RxPBL_SHIFT		16
+#define XGMAC_RBSZ			GENMASK(14, 1)
+#define XGMAC_RBSZ_SHIFT		1
+#define XGMAC_RXST			BIT(0)
+#define XGMAC_RPF			BIT(31)
+#define XGMAC_DMA_CH_TxDESC_HADDR(x)	(MAC_OFFSET + (0x00003110 + (0x80 * (x))))
+#define XGMAC_DMA_CH_TxDESC_LADDR(x)	(MAC_OFFSET + (0x00003114 + (0x80 * (x))))
+#define XGMAC_DMA_CH_RxDESC_HADDR(x)	(MAC_OFFSET + (0x00003118 + (0x80 * (x))))
+#define XGMAC_DMA_CH_RxDESC_LADDR(x)	(MAC_OFFSET + (0x0000311c + (0x80 * (x))))
+#define XGMAC_DMA_CH_TxDESC_TAIL_LPTR(x)	(MAC_OFFSET + (0x00003124 + (0x80 * (x))))
+#define XGMAC_DMA_CH_RxDESC_TAIL_LPTR(x)	(MAC_OFFSET + (0x0000312c + (0x80 * (x))))
+#define XGMAC_DMA_CH_TX_CONTROL2(x)	(MAC_OFFSET + (0x00003130 + (0x80 * (x))))
+#define XGMAC_TDRL			GENMASK(12, 0)
+#define XGMAC_TDRL_SHIFT		0
+#define XGMAC_DMA_CH_RX_CONTROL2(x)	(MAC_OFFSET + (0x00003134 + (0x80 * (x))))
+#define XGMAC_OWRQ			GENMASK(25, 24)
+#define XGMAC_OWRQ_SHIFT		24
+#define XGMAC_RDRL			GENMASK(12, 0)
+#define XGMAC_RDRL_SHIFT		0
+#define XGMAC_DMA_CH_INT_EN(x)		(MAC_OFFSET + (0x00003138 + (0x80 * (x))))
+#define XGMAC_NIE			BIT(15)
+#define XGMAC_AIE			BIT(14)
+#define XGMAC_FBEE			BIT(12)
+#define XGMAC_RSE			BIT(8)
+#define XGMAC_RBUE			BIT(7)
+#define XGMAC_RIE			BIT(6)
+#define XGMAC_TBUE			BIT(2)
+#define XGMAC_TIE			BIT(0)
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE) || defined(TC956X_CPE_CONFIG)
+#define XGMAC_DMA_INT_DEFAULT_EN	(XGMAC_NIE | XGMAC_AIE | XGMAC_RBUE | \
+					XGMAC_RIE | XGMAC_TIE)
+#else
+#define XGMAC_DMA_INT_DEFAULT_EN	(XGMAC_NIE | XGMAC_AIE | XGMAC_RBUE | \
+					XGMAC_RIE | XGMAC_TIE | XGMAC_RSE | XGMAC_FBEE)
+#endif
+#define XGMAC_DMA_INT_DEFAULT_RX	(XGMAC_RBUE | XGMAC_RIE)
+#define XGMAC_DMA_INT_DEFAULT_TX	(XGMAC_TIE)
+#define XGMAC_DMA_CH_Rx_WATCHDOG(x)	(MAC_OFFSET + (0x0000313c + (0x80 * (x))))
+#define XGMAC_RWT			GENMASK(7, 0)
+#define XGMAC_DMA_CH_STATUS(x)		(MAC_OFFSET + (0x00003160 + (0x80 * (x))))
+
+#define XGMAC_DMA_CH_DBG_STATUS(x)	(MAC_OFFSET + (0x00003164 + (0x80 * (x))))
+
+#define XGMAC_NIS			BIT(15)
+#define XGMAC_AIS			BIT(14)
+#define XGMAC_FBE			BIT(12)
+#define XGMAC_RBU			BIT(7)
+#define XGMAC_RI			BIT(6)
+#define XGMAC_TBU			BIT(2)
+#define XGMAC_TPS			BIT(1)
+#define XGMAC_TI			BIT(0)
+#define XGMAC_RPS			BIT(8)
+
+#define XGMAC_DMA_CH_Cur_TxDESC_HADDR(x)	(MAC_OFFSET + (0x00003140 + (0x80 * (x))))
+#define XGMAC_DMA_CH_Cur_TxDESC_LADDR(x)	(MAC_OFFSET + (0x00003144 + (0x80 * (x))))
+#define XGMAC_DMA_CH_Cur_RxDESC_HADDR(x)	(MAC_OFFSET + (0x00003148 + (0x80 * (x))))
+#define XGMAC_DMA_CH_Cur_RxDESC_LADDR(x)	(MAC_OFFSET + (0x0000314C + (0x80 * (x))))
+#define XGMAC_DMA_CH_Cur_TxBuff_HADDR(x)	(MAC_OFFSET + (0x00003150 + (0x80 * (x))))
+#define XGMAC_DMA_CH_Cur_TxBuff_LADDR(x)	(MAC_OFFSET + (0x00003154 + (0x80 * (x))))
+#define XGMAC_DMA_CH_Cur_RxBuff_HADDR(x)	(MAC_OFFSET + (0x00003158 + (0x80 * (x))))
+#define XGMAC_DMA_CH_Cur_RxBuff_LADDR(x)	(MAC_OFFSET + (0x0000315c + (0x80 * (x))))
+
+#define XGMAC_DMA_DEBUG_STATUS0			(MAC_OFFSET + 0x3020)
+
+#ifdef TC956X
+#define XGMAC_REGSIZE			(0x000034FC / 4)
+#else
+#define XGMAC_REGSIZE			(((0x0000317c + (0x80 * 15)) / 4))
+#endif
+#define XGMAC_DMA_REG_SIZE		((0x00003084) / 4)
+/* CRC & Pad Values */
+#ifdef TC956X
+#define TC956X_TX_CRC_PAD_INSERT	0
+#define TC956X_TX_CRC_INSERT		1
+#define TC956X_TX_CRC_PAD_DISABLE	2
+#define TC956X_TX_CRC_REPLACE		3
+
+#define TC956X_RX_CRC_DISABLE_CHECK	XGMAC_CONFIG_DCRCC
+#define TC956X_RX_CRC_TYPE_STRIP	XGMAC_CONFIG_CST
+#define TC956X_RX_CRC_PAD_STRIP	XGMAC_CONFIG_ACS
+#define TC956X_RX_CRC_DEFAULT		(XGMAC_CONFIG_ACS | XGMAC_CONFIG_CST)
+#endif
+/* Descriptors */
+#define XGMAC_TDES0_LTV		BIT(31)
+#define XGMAC_TDES0_LT			GENMASK(7, 0)
+#define XGMAC_TDES1_LT			GENMASK(31, 8)
+#define XGMAC_TDES2_IVT		GENMASK(31, 16)
+#define XGMAC_TDES2_IVT_SHIFT		16
+#define XGMAC_TDES2_IOC		BIT(31)
+#define XGMAC_TDES2_TTSE		BIT(30)
+#define XGMAC_TDES2_B2L		GENMASK(29, 16)
+#define XGMAC_TDES2_B2L_SHIFT		16
+#define XGMAC_TDES2_VTIR		GENMASK(15, 14)
+#define XGMAC_TDES2_VTIR_SHIFT		14
+#define XGMAC_TDES2_B1L		GENMASK(13, 0)
+#define XGMAC_TDES3_OWN		BIT(31)
+#define XGMAC_TDES3_CTXT		BIT(30)
+#define XGMAC_TDES3_FD			BIT(29)
+#define XGMAC_TDES3_LD			BIT(28)
+#define XGMAC_TDES3_OSTC		BIT(27)
+#define XGMAC_TDES3_CPC		GENMASK(27, 26)
+#define XGMAC_TDES3_CPC_SHIFT		26
+#define XGMAC_TDES3_TCMSSV		BIT(26)
+#define XGMAC_TDES3_SAIC		GENMASK(25, 23)
+#define XGMAC_TDES3_SAIC_SHIFT		23
+#define XGMAC_TDES3_TBSV		BIT(24)
+#define XGMAC_TDES3_THL		GENMASK(22, 19)
+#define XGMAC_TDES3_THL_SHIFT		19
+#define XGMAC_TDES3_IVTIR		GENMASK(19, 18)
+#define XGMAC_TDES3_IVTIR_SHIFT	18
+#define XGMAC_TDES3_TSE		BIT(18)
+#define XGMAC_TDES3_IVLTV		BIT(17)
+#define XGMAC_TDES3_CIC		GENMASK(17, 16)
+#define XGMAC_TDES3_CIC_SHIFT		16
+#define XGMAC_TDES3_TPL		GENMASK(17, 0)
+#define XGMAC_TDES3_VLTV		BIT(16)
+#define XGMAC_TDES3_VT			GENMASK(15, 0)
+#define XGMAC_TDES3_FL			GENMASK(14, 0)
+#define XGMAC_RDES2_HL			GENMASK(9, 0)
+#ifdef TC956X_SRIOV_VF
+#define XGMAC_RDES2_TNP			BIT(11)
+#define XGMAC_RDES2_TNP_SHIFT		11
+#endif
+#define XGMAC_RDES3_OWN		BIT(31)
+#define XGMAC_RDES3_CTXT		BIT(30)
+#define XGMAC_RDES3_IOC		BIT(30)
+#define XGMAC_RDES3_LD			BIT(28)
+#define XGMAC_RDES3_CDA		BIT(27)
+#define XGMAC_RDES3_RSV		BIT(26)
+#define XGMAC_RDES3_L34T		GENMASK(23, 20)
+#define XGMAC_RDES3_L34T_SHIFT		20
+#ifdef TC956X_SRIOV_VF
+#define XGMAC_RDES3_ETLT		GENMASK(19, 16)
+#define XGMAC_RDES3_ETLT_SHIFT		16
+#endif
+#define XGMAC_L34T_IP4TCP		0x1
+#define XGMAC_L34T_IP4UDP		0x2
+#define XGMAC_L34T_IP6TCP		0x9
+#define XGMAC_L34T_IP6UDP		0xA
+#define XGMAC_RDES3_ES			BIT(15)
+#ifdef TC956X_SRIOV_VF
+#define XGMAC_RDES3_ES_SHIFT		15
+#endif
+#define XGMAC_RDES3_PL			GENMASK(13, 0)
+#define XGMAC_RDES3_TSD		BIT(6)
+#define XGMAC_RDES3_TSA		BIT(4)
+
+#ifdef TC956X
+#define XGMAC_RDES0_OVT_INDEX		0
+#define XGMAC_RDES0_OVT_WIDTH		16
+#define XGMAC_RDES2_VF_INDEX		15
+#define XGMAC_RDES2_VF_WIDTH		1
+#define XGMAC_RDES3_ES_INDEX		15
+#define XGMAC_RDES3_ES_WIDTH		1
+#define XGMAC_RDES3_ETLT_INDEX		16
+#define XGMAC_RDES3_ETLT_WIDTH		4
+#define PKT_TYPE_SINGLE_CVLAN		0x09
+
+#define GET_BITS_LE(_var, _index, _width)				\
+	((le32_to_cpu((_var)) >> (_index)) & ((0x1 << (_width)) - 1))
+
+#define XGMAC_GET_BITS_LE(_var, _prefix, _field)			\
+	GET_BITS_LE((_var),						\
+		 _prefix##_##_field##_INDEX,				\
+		 _prefix##_##_field##_WIDTH)
+#endif
+
+#ifdef TC956X_SRIOV_VF
+#define XGMAC_RDES3_PMT		GENMASK(3, 0)
+
+#define XGMAC_RDES2_AVTDP		BIT(1)
+#define XGMAC_RDES2_AVTCP		BIT(0)
+
+#define XGMAC_L34T_NON_IP	0
+#define XGMAC_L34T_IPV4_TCP	1
+#define XGMAC_L34T_IPV4_UDP	2
+#define XGMAC_L34T_IPV4_ICMP	3
+#define XGMAC_L34T_IPV4_IGMP	4
+#define XGMAC_L34T_IPV4_UNKNOWN	7
+#define XGMAC_L34T_IPV6_TCP	9
+#define XGMAC_L34T_IPV6_UDP	10
+#define XGMAC_L34T_IPV6_ICMP	11
+#define XGMAC_L34T_IPV6_UNKNOWN	15
+
+
+#define XGMAC_ET_WD_TIMEOUT	1
+#define XGMAC_ET_INV_GMII	2
+#define XGMAC_ET_CRC		3
+#define XGMAC_ET_GIANT_PKT	4
+#define XGMAC_ET_IP_HEADER	5
+#define XGMAC_ET_L4_CSUM	6
+#define XGMAC_ET_OVERFLOW	7
+#define XGMAC_ET_BUS		8
+#define XGMAC_ET_LENGTH		9
+#define XGMAC_ET_GOOD_RUNT	10
+#define XGMAC_ET_DRIBBLE	12
+
+#define XGMAC_ET_T_OUTER_IP_HEADER		5
+#define XGMAC_ET_T_OUTER_HEADER_PAYLOAD_L4_CSUM	6
+#define XGMAC_ET_T_INNER_IP_HEADER		9
+#define XGMAC_ET_T_INNER_L4_PAYLOAD		10
+#define XGMAC_ET_T_INV_VXLAN_HEADER		11
+
+#define XGMAC_LT_LENGTH			0
+#define XGMAC_LT_MAC_CONTROL		1
+#define XGMAC_LT_DCB_CONTROL		2
+#define XGMAC_LT_ARP_REQ		3
+#define XGMAC_LT_OAM			4
+#define XGMAC_LT_MAC_RX_ETH_TYPE_MATCH	5
+#define XGMAC_LT_OTH_TYPE		7
+#define XGMAC_LT_SVLAN			8
+#define XGMAC_LT_CVLAN			9
+#define XGMAC_LT_D_CVLAN_CVLAN		10
+#define XGMAC_LT_D_SVLAN_SVLAN		11
+#define XGMAC_LT_D_SVLAN_CVLAN		12
+#define XGMAC_LT_D_CVLAN_SVLAN		13
+#define XGMAC_LT_UNTAG_AV_CONTROL	6
+#endif /* #ifdef TC956X_SRIOV_VF */
+#endif /* __TC956XMAC_DWXGMAC2_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/dwxgmac2_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/dwxgmac2_core.c
@@ -0,0 +1,3275 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * dwxgmac2_core.c
+ *
+ * Copyright (C) 2018 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  17 July 2020 : 1. Filtering updates
+ *  VERSION      : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  22 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported with module parameters
+ *  VERSION     : 01-00-04
+ *  14 Sep 2021 : 1. Synchronization between ethtool vlan features
+ *                   "rx-vlan-offload", "rx-vlan-filter", "tx-vlan-offload" output and register settings.
+ *                2. Added ethtool support to update "rx-vlan-offload", "rx-vlan-filter",
+ *                   and "tx-vlan-offload".
+ *                3. Removed IOCTL TC956XMAC_VLAN_STRIP_CONFIG.
+ *                4. Removed "Disable VLAN Filter" option in IOCTL TC956XMAC_VLAN_FILTERING.
+ *  VERSION     : 01-00-13
+ *  23 Sep 2021 : 1. Filtering All pause frames by default
+ *  VERSION     : 01-00-14
+ *  14 Oct 2021 : 1. Configuring pause frame control using kernel module parameter also forwarding
+ *                only Link partner pause frames to Application and filtering PHY pause frames using FRP
+ *  VERSION     : 01-00-16
+ *  26 Oct 2021 : 1. Added EEE print in host IRQ and updated EEE configuration.
+ *  VERSION     : 01-00-19
+ *  04 Nov 2021 : 1. Added separate control functons for MAC TX and RX start/stop
+ *  VERSION     : 01-00-20
+ *  24 Nov 2021 : 1. EEE update for runtime configuration and LPI interrupt disabled.
+ *                2. USXGMII support during link change
+ *  VERSION     : 01-00-24
+ *  08 Dec 2021 : 1. Renamed pause frames module parameter
+ *  VERSION     : 01-00-30
+ *  10 Nov 2023 : 1. Kernel 6.1 Porting changes
+ *  VERSION     : 01-02-59
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *  VERSION     : 04-00
+ */
+
+#include <linux/bitrev.h>
+#include <linux/crc32.h>
+#include <linux/iopoll.h>
+#include "tc956xmac.h"
+#include "tc956xmac_ptp.h"
+#include "dwxgmac2.h"
+
+#ifndef TC956X_SRIOV_VF
+extern unsigned int mac0_filter_phy_pause;
+extern unsigned int mac1_filter_phy_pause;
+#endif
+
+#ifdef TC956X_SRIOV_DEBUG
+void tc956x_filter_debug(struct tc956xmac_priv *priv);
+#endif
+#ifdef TC956X_SRIOV_PF
+int tc956x_pf_set_mac_filter(struct net_device *dev, int vf, const u8 *mac);
+void tc956x_pf_del_mac_filter(struct net_device *dev, int vf, const u8 *mac);
+void tc956x_pf_del_umac_addr(struct tc956xmac_priv *priv, int index, int vf);
+void tc956x_pf_set_vlan_filter(struct net_device *dev, u16 vf, u16 vid);
+void tc956x_pf_del_vlan_filter(struct net_device *dev, u16 vf, u16 vid);
+#endif
+
+static void tc956x_set_mac_addr(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+				const u8 *mac, int index, int vf);
+#ifdef TC956X
+static void dwxgmac2_disable_tx_vlan(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw);
+static void dwxgmac2_enable_rx_vlan_stripping(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw);
+static void dwxgmac2_disable_rx_vlan_stripping(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw);
+static void dwxgmac2_enable_rx_vlan_filtering(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw);
+static void dwxgmac2_disable_rx_vlan_filtering(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw);
+#endif
+
+static void dwxgmac2_core_init(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw, struct net_device *dev)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 tx, rx;
+
+	tx = readl(ioaddr + XGMAC_TX_CONFIG);
+	rx = readl(ioaddr + XGMAC_RX_CONFIG);
+
+	tx |= XGMAC_CORE_INIT_TX;
+	rx |= XGMAC_CORE_INIT_RX;
+
+	if (hw->ps) {
+		tx |= XGMAC_CONFIG_TE;
+		tx &= ~hw->link.speed_mask;
+
+		switch (hw->ps) {
+		case SPEED_10000:
+			tx |= hw->link.xgmii.speed10000;
+			break;
+		case SPEED_5000:
+			if (priv->plat->interface == PHY_INTERFACE_MODE_USXGMII)
+				tx |= hw->link.xgmii.speed5000;
+			break;
+		case SPEED_2500:
+			if (priv->plat->interface == PHY_INTERFACE_MODE_USXGMII)
+				tx |= hw->link.xgmii.speed2500;
+			else
+				tx |= hw->link.speed2500;
+			break;
+		case SPEED_1000:
+		default:
+			tx |= hw->link.speed1000;
+			break;
+		}
+	}
+#ifndef TC956X
+	if ((priv->plat->interface == PHY_INTERFACE_MODE_RGMII) || (priv->plat->interface == PHY_INTERFACE_MODE_RGMII_ID))
+		tx |= hw->link.speed1000;
+	else if (priv->plat->interface == PHY_INTERFACE_MODE_SGMII)
+		tx |= hw->link.speed2500;
+	else if ((priv->plat->interface == PHY_INTERFACE_MODE_USXGMII) ||
+		(priv->plat->interface == PHY_INTERFACE_MODE_10GKR)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+			|| (priv->plat->interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+			)
+		tx |= hw->link.xgmii.speed10000;
+#endif
+	writel(tx, ioaddr + XGMAC_TX_CONFIG);
+	writel(rx, ioaddr + XGMAC_RX_CONFIG);
+#ifdef TC956X_LPI_INTERRUPT
+	writel(XGMAC_INT_DEFAULT_EN, ioaddr + XGMAC_INT_EN);
+#endif
+	netdev_dbg(priv->dev, "%s: MAC TX Config = 0x%x", __func__,
+			readl(ioaddr + XGMAC_TX_CONFIG));
+
+	netdev_dbg(priv->dev, "%s: MAC RX Config = 0x%x", __func__,
+			readl(ioaddr + XGMAC_RX_CONFIG));
+}
+
+static void dwxgmac2_set_mac(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+					bool enable)
+{
+	u32 tx = readl(ioaddr + XGMAC_TX_CONFIG);
+	u32 rx = readl(ioaddr + XGMAC_RX_CONFIG);
+
+	if (enable) {
+		tx |= XGMAC_CONFIG_TE;
+		rx |= XGMAC_CONFIG_RE;
+	} else {
+		tx &= ~XGMAC_CONFIG_TE;
+		rx &= ~XGMAC_CONFIG_RE;
+	}
+
+	writel(tx, ioaddr + XGMAC_TX_CONFIG);
+	writel(rx, ioaddr + XGMAC_RX_CONFIG);
+}
+
+static void dwxgmac2_set_mac_tx(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+					bool enable)
+{
+	u32 tx = readl(ioaddr + XGMAC_TX_CONFIG);
+
+	if (enable) {
+		tx |= XGMAC_CONFIG_TE;
+	} else {
+		tx &= ~XGMAC_CONFIG_TE;
+	}
+
+	writel(tx, ioaddr + XGMAC_TX_CONFIG);
+}
+
+static void dwxgmac2_set_mac_rx(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+					bool enable)
+{
+	u32 rx = readl(ioaddr + XGMAC_RX_CONFIG);
+
+	if (enable) {
+		rx |= XGMAC_CONFIG_RE;
+	} else {
+		rx &= ~XGMAC_CONFIG_RE;
+	}
+
+	writel(rx, ioaddr + XGMAC_RX_CONFIG);
+}
+
+static int dwxgmac2_rx_ipc(struct tc956xmac_priv *priv, struct mac_device_info *hw)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_RX_CONFIG);
+	if (hw->rx_csum)
+		value |= XGMAC_CONFIG_IPC;
+	else
+		value &= ~XGMAC_CONFIG_IPC;
+	writel(value, ioaddr + XGMAC_RX_CONFIG);
+
+	return !!(readl(ioaddr + XGMAC_RX_CONFIG) & XGMAC_CONFIG_IPC);
+}
+
+static void dwxgmac2_rx_queue_enable(struct tc956xmac_priv *priv,
+					struct mac_device_info *hw, u8 mode,
+					u32 queue)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_RXQ_CTRL0) & ~XGMAC_RXQEN(queue);
+	if (mode == MTL_QUEUE_AVB)
+		value |= 0x1 << XGMAC_RXQEN_SHIFT(queue);
+	else if (mode == MTL_QUEUE_DCB)
+		value |= 0x2 << XGMAC_RXQEN_SHIFT(queue);
+	writel(value, ioaddr + XGMAC_RXQ_CTRL0);
+
+	netdev_dbg(priv->dev, "%s: MAC RxQ%d Control = 0x%x", __func__,
+			queue, readl(ioaddr + XGMAC_RXQ_CTRL0));
+}
+
+static void dwxgmac2_rx_queue_prio(struct tc956xmac_priv *priv,
+				   struct mac_device_info *hw, u32 prio,
+				   u32 queue)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value, reg;
+
+	reg = (queue < 4) ? XGMAC_RXQ_CTRL2 : XGMAC_RXQ_CTRL3;
+	if (queue >= 4)
+		queue -= 4;
+
+	value = readl(ioaddr + reg);
+	value &= ~XGMAC_PSRQ(queue);
+	value |= (prio << XGMAC_PSRQ_SHIFT(queue)) & XGMAC_PSRQ(queue);
+
+	writel(value, ioaddr + reg);
+
+	netdev_dbg(priv->dev, "%s: MAC RxQ%d Control = 0x%x", __func__,
+			queue, readl(ioaddr + reg));
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static void dwxgmac2_tx_queue_prio(struct tc956xmac_priv *priv,
+				   struct mac_device_info *hw, u32 prio,
+				   u32 queue)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value, reg;
+
+	reg = (queue < 4) ? XGMAC_TC_PRTY_MAP0 : XGMAC_TC_PRTY_MAP1;
+	if (queue >= 4)
+		queue -= 4;
+
+	value = readl(ioaddr + reg);
+	value &= ~XGMAC_PSTC(queue);
+	value |= (prio << XGMAC_PSTC_SHIFT(queue)) & XGMAC_PSTC(queue);
+
+	writel(value, ioaddr + reg);
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static void tc956x_rx_queue_routing(struct tc956xmac_priv *priv,
+				    struct mac_device_info *hw,
+				    u8 packet, u32 queue)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	static const struct tc956xmac_rx_routing route_possibilities[] = {
+		{ XGMAC_RXQCTRL_AVCPQ_MASK, XGMAC_RXQCTRL_AVCPQ_SHIFT },
+		{ XGMAC_RXQCTRL_PTPQ_MASK, XGMAC_RXQCTRL_PTPQ_SHIFT },
+		{ XGMAC_RXQCTRL_DCBCPQ_MASK, XGMAC_RXQCTRL_DCBCPQ_SHIFT },
+		{ XGMAC_RXQCTRL_UPQ_MASK, XGMAC_RXQCTRL_UPQ_SHIFT },
+		{ XGMAC_RXQCTRL_MCBCQ_MASK, XGMAC_RXQCTRL_MCBCQ_SHIFT },
+		{ XGMAC_RXQCTRL_FPRQ_MASK, XGMAC_RXQCTRL_FPRQ_SHIFT },
+	};
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+	/* Fail packet routing for UC, MC, VLAN */
+	if (packet == PACKET_FILTER_FAIL) {
+		value = readl(ioaddr + XGMAC_RXQ_CTRL4);
+
+		value &= (~(XGMAC_VFFQ_MASK | XGMAC_MFFQ_MASK | XGMAC_UFFQ_MASK));
+
+		value |= ((queue << XGMAC_UFFQ_SHIFT) | \
+				(queue << XGMAC_MFFQ_SHIFT) | \
+				(queue << XGMAC_VFFQ_SHIFT));
+
+		value |= XGMAC_UFFQE | XGMAC_MFFQE | XGMAC_VFFQE;
+
+		writel(value, ioaddr + XGMAC_RXQ_CTRL4);
+
+		return;
+	}
+#endif
+	value = readl(ioaddr + XGMAC_RXQ_CTRL1);
+
+	/* routing configuration */
+	value &= ~route_possibilities[packet - 1].reg_mask;
+	value |= (queue << route_possibilities[packet-1].reg_shift) &
+		 route_possibilities[packet - 1].reg_mask;
+
+	/* some packets require extra ops */
+	if (packet == PACKET_MCBCQ) {
+		value &= ~XGMAC_RXQCTRL_MCBCQEN;
+		value |= 0x1 << XGMAC_RXQCTRL_MCBCQEN_SHIFT;
+
+		/* If multicast/broadcast queue is enabled, then set OMCBCQ bit */
+		value &= ~XGMAC_RXQCTRL_OMCBCQ;
+		value |= 0x1 << XGMAC_RXQCTRL_OMCBCQ_SHIFT;
+	}
+
+	writel(value, ioaddr + XGMAC_RXQ_CTRL1);
+}
+
+static void dwxgmac2_prog_mtl_rx_algorithms(struct tc956xmac_priv *priv,
+					    struct mac_device_info *hw,
+					    u32 rx_alg)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_MTL_OPMODE);
+	value &= ~XGMAC_RAA;
+
+	switch (rx_alg) {
+	case MTL_RX_ALGORITHM_SP:
+		break;
+	case MTL_RX_ALGORITHM_WSP:
+		value |= XGMAC_RAA;
+		break;
+	default:
+		break;
+	}
+
+	writel(value, ioaddr + XGMAC_MTL_OPMODE);
+}
+
+static void dwxgmac2_prog_mtl_tx_algorithms(struct tc956xmac_priv *priv,
+					    struct mac_device_info *hw,
+					    u32 tx_alg)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	bool ets = true;
+	u32 value;
+	int i;
+
+	value = readl(ioaddr + XGMAC_MTL_OPMODE);
+	value &= ~XGMAC_ETSALG;
+
+	switch (tx_alg) {
+	case MTL_TX_ALGORITHM_WRR:
+		value |= XGMAC_WRR;
+		break;
+	case MTL_TX_ALGORITHM_WFQ:
+		value |= XGMAC_WFQ;
+		break;
+	case MTL_TX_ALGORITHM_DWRR:
+		value |= XGMAC_DWRR;
+		break;
+	default:
+		ets = false;
+		break;
+	}
+
+	writel(value, ioaddr + XGMAC_MTL_OPMODE);
+
+	/* Set ETS if desired */
+	for (i = 0; i < MTL_MAX_TX_TC; i++) {
+		value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(i));
+		value &= ~XGMAC_TSA;
+		if (ets)
+			value |= XGMAC_ETS;
+		writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(i));
+	}
+}
+
+static void dwxgmac2_set_mtl_tx_queue_weight(struct tc956xmac_priv *priv,
+					     struct mac_device_info *hw,
+					     u32 weight, u32 tc)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value = readl(ioaddr + XGMAC_MTL_TCx_QUANTUM_WEIGHT(tc));
+
+	value &= ~XGMAC_MTL_TCx_QUANTUM_WEIGHT_ISCQW_MASK;
+	value |= weight & XGMAC_MTL_TCx_QUANTUM_WEIGHT_ISCQW_MASK;
+	writel(value, ioaddr + XGMAC_MTL_TCx_QUANTUM_WEIGHT(tc));
+
+	netdev_dbg(priv->dev, "%s: MTL_TC%d weight = %d", __func__, tc, weight);
+}
+
+static void dwxgmac2_map_mtl_to_dma(struct tc956xmac_priv *priv,
+				    struct mac_device_info *hw, u32 queue,
+				    u32 chan)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value, reg, rx_q;
+
+	rx_q = queue;
+	reg = (queue < 4) ? XGMAC_MTL_RXQ_DMA_MAP0 : XGMAC_MTL_RXQ_DMA_MAP1;
+	if (queue >= 4)
+		queue -= 4;
+
+	value = readl(ioaddr + reg);
+#ifdef TC956X_SRIOV_PF
+	/* Set QxDDMACH to enable Rx Q-ch mapping based on DA Filter Value */
+	if (priv->plat->rx_queues_cfg[rx_q].chan == TC956X_DA_MAP) {
+		value |= 1 << XGMAC_QxDDMACH_SHIFT(queue);
+	} else {
+#endif
+		value &= ~XGMAC_QxMDMACH(queue);
+		value |= (chan << XGMAC_QxMDMACH_SHIFT(queue)) & XGMAC_QxMDMACH(queue);
+#ifdef TC956X_SRIOV_PF
+	}
+#endif
+
+	writel(value, ioaddr + reg);
+
+	netdev_dbg(priv->dev, "%s: MTLQ%d DMA mapping = 0x%x", __func__, queue,
+			readl(ioaddr + reg));
+}
+
+static void dwxgmac2_config_cbs(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw,
+				u32 send_slope, u32 idle_slope,
+				u32 high_credit, u32 low_credit, u32 queue)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+	u8 traffic_class;
+
+	traffic_class = priv->plat->tx_queues_cfg[queue].traffic_class;
+
+	/* configure send slope */
+	value = readl(ioaddr + XGMAC_MTL_TCx_SENDSLOPE(traffic_class));
+	value &= ~XGMAC_MTL_TCx_SENDSLOPE_CRED_SSC_MASK;
+	value |= send_slope & XGMAC_MTL_TCx_SENDSLOPE_CRED_SSC_MASK;
+	writel(value, ioaddr + XGMAC_MTL_TCx_SENDSLOPE(traffic_class));
+
+	/* configure idle slope (same register as tx weight) */
+	value = readl(ioaddr + XGMAC_MTL_TCx_QUANTUM_WEIGHT(traffic_class));
+	value &= ~XGMAC_MTL_TCx_QUANTUM_WEIGHT_ISCQW_MASK;
+	value |= idle_slope & XGMAC_MTL_TCx_QUANTUM_WEIGHT_ISCQW_MASK;
+	writel(value, ioaddr + XGMAC_MTL_TCx_QUANTUM_WEIGHT(traffic_class));
+
+	/* configure high credit */
+	value = readl(ioaddr + XGMAC_MTL_TCx_HICREDIT(traffic_class));
+	value &= ~XGMAC_MTL_TCx_HICREDIT_HC_MASK;
+	value |= high_credit & XGMAC_MTL_TCx_HICREDIT_HC_MASK;
+	writel(value, ioaddr + XGMAC_MTL_TCx_HICREDIT(traffic_class));
+
+	/* configure low credit */
+	value = readl(ioaddr + XGMAC_MTL_TCx_LOCREDIT(traffic_class));
+	value &= ~XGMAC_MTL_TCx_LOCREDIT_LC_MASK;
+	value |= low_credit & XGMAC_MTL_TCx_LOCREDIT_LC_MASK;
+	writel(value, ioaddr + XGMAC_MTL_TCx_LOCREDIT(traffic_class));
+	value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(traffic_class));
+
+	/* CC is always set 0 */
+	value &= ~(XGMAC_TSA | XGMAC_CC);
+	value |= XGMAC_CBS;
+	writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(traffic_class));
+
+	netdev_dbg(priv->dev, "%s: MTL_TC%d Send Slope Register = 0x%x", __func__, traffic_class,
+			readl(ioaddr + XGMAC_MTL_TCx_SENDSLOPE(traffic_class)));
+	netdev_dbg(priv->dev, "%s: MTL_TC%d Idle Slope Register = 0x%x", __func__, traffic_class,
+			readl(ioaddr + XGMAC_MTL_TCx_QUANTUM_WEIGHT(traffic_class)));
+	netdev_dbg(priv->dev, "%s: MTL_TC%d High Credit Register = 0x%x", __func__, traffic_class,
+			readl(ioaddr + XGMAC_MTL_TCx_HICREDIT(traffic_class)));
+	netdev_dbg(priv->dev, "%s: MTL_TC%d Lo Credit Register = 0x%x", __func__, traffic_class,
+			readl(ioaddr + XGMAC_MTL_TCx_LOCREDIT(traffic_class)));
+
+}
+
+static void dwxgmac2_dump_regs(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw, u32 *reg_space)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	int i, ch, tc, k;
+
+	KPRINT_DEBUG1("************************************EMAC Dump***********************************************");
+	for (i = ETH_CORE_DUMP_OFFSET1; i <= ETH_CORE_DUMP_OFFSET1_END; i++) {/*MAC reg*/
+		reg_space[i] = readl(ioaddr + MAC_OFFSET + (i * 4));
+		KPRINT_DEBUG1("%04x : %08x\n", i*4, reg_space[i]);
+	}
+
+	for (i = ETH_CORE_DUMP_OFFSET2; i <= ETH_CORE_DUMP_OFFSET2_END; i++) { /*MAC reg*/
+		reg_space[i] = readl(ioaddr + MAC_OFFSET + (i * 4));
+		KPRINT_DEBUG1("%04x : %08x\n", i*4, reg_space[i]);
+	}
+
+	for (i = ETH_CORE_DUMP_OFFSET3; i <= ETH_CORE_DUMP_OFFSET3_END; i++) {/*MTL reg*/
+		reg_space[i] = readl(ioaddr + MAC_OFFSET + (i * 4));
+		KPRINT_DEBUG1("%04x : %08x\n", i*4, reg_space[i]);
+	}
+
+	for (i = ETH_CORE_DUMP_OFFSET4; i <= ETH_CORE_DUMP_OFFSET4_END; i++) {/*MTL TX reg*/
+		for (ch = 0; ch < 8; ch++) {
+			k = i + (0x20 * ch);
+			reg_space[k] = readl(ioaddr + MAC_OFFSET + ((0x0080 * ch) + (i * 4)));
+			KPRINT_DEBUG1("%04x : %08x\n", (0x0080 * ch) + (i * 4), reg_space[k]);
+		}
+	}
+
+	for (i = ETH_CORE_DUMP_OFFSET5; i <= ETH_CORE_DUMP_OFFSET5_END; i++) {/*MTL TCQ reg*/
+		for (tc = 0; tc < 5; tc++) {
+			k = i + (0x20 * tc);
+			reg_space[k] = readl(ioaddr + MAC_OFFSET + ((0x0080 * tc) + (i * 4)));
+			KPRINT_DEBUG1("%04x : %08x\n", (0x0080 * tc) + (i * 4), reg_space[k]);
+		}
+	}
+
+	for (i = ETH_CORE_DUMP_OFFSET6; i <= ETH_CORE_DUMP_OFFSET6_END; i++) {/*MTL RX reg*/
+		for (ch = 0; ch < 8; ch++) {
+			k = i + (0x20 * ch);
+			reg_space[k] = readl(ioaddr + MAC_OFFSET + (0x0080*ch) + (i * 4));
+			KPRINT_DEBUG1("%04x : %08x\n", (0x0080 * ch) + (i * 4), reg_space[k]);
+		}
+	}
+}
+
+static int dwxgmac2_host_irq_status(struct tc956xmac_priv *priv,
+				    struct mac_device_info *hw,
+				    struct tc956xmac_extra_stats *x)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 stat, en;
+	int ret = 0;
+	int val = 0;
+
+	en = readl(ioaddr + XGMAC_INT_EN);
+	stat = readl(ioaddr + XGMAC_INT_STATUS);
+
+	stat &= en;
+
+	if (stat & XGMAC_PMTIS) {
+		x->irq_receive_pmt_irq_n++;
+		readl(ioaddr + XGMAC_PMT);
+	}
+
+	if (stat & XGMAC_LPIIS) {
+		u32 lpi = readl(ioaddr + XGMAC_LPI_CTRL);
+
+		if (lpi & XGMAC_TLPIEN) {
+			KPRINT_INFO("Transmit LPI Entry.....\n");
+			ret |= CORE_IRQ_TX_PATH_IN_LPI_MODE;
+			x->irq_tx_path_in_lpi_mode_n++;
+		}
+		if (lpi & XGMAC_TLPIEX) {
+			KPRINT_INFO("Transmit LPI Exit.....\n");
+			ret |= CORE_IRQ_TX_PATH_EXIT_LPI_MODE;
+			x->irq_tx_path_exit_lpi_mode_n++;
+		}
+		if (lpi & XGMAC_RLPIEN) {
+			KPRINT_INFO("Receive LPI Entry.......\n");
+			x->irq_rx_path_in_lpi_mode_n++;
+		}
+		if (lpi & XGMAC_RLPIEX) {
+			KPRINT_INFO("Receive LPI Exit......\n");
+			x->irq_rx_path_exit_lpi_mode_n++;
+		}
+
+#ifdef EEE
+		val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_XS_PCS_DIG_STS);
+		KPRINT_INFO("XPCS LPI status : %x........\n", val);
+		if (val & XGMAC_LTX_LRX_STATE) {
+			if (val & XGMAC_LPI_RECEIVE_STATE)
+				KPRINT_INFO("XPCS LPI Receive State.........\n");
+			if (val & XGMAC_LPI_TRANSMIT_STATE)
+				KPRINT_INFO("XPCS LPI transmit state.....\n");
+		}
+
+		val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_XS_PCS_STS1);
+		if (val & XGMAC_RX_LPI_RECEIVE)
+			KPRINT_INFO("XPCS RX LPI Received......");
+		if (val & XGAMC_TX_LPI_RECEIVE)
+			KPRINT_INFO("XPCS TX LPI Received......");
+#endif
+	}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 13, 0)
+	if (stat & XGMAC_TSIS) {
+		val = readl(ioaddr + PTP_XGMAC_OFFSET + PTP_TS_STATUS);
+		if (val & XGMAC_AUXTSTRIG) {
+			KPRINT_INFO("\n");
+			KPRINT_INFO("second: %x\n",	readl(ioaddr + PTP_XGMAC_OFFSET + PTP_ATS_SEC));
+			KPRINT_INFO("subsec(ns): %x\n", readl(ioaddr + PTP_XGMAC_OFFSET + PTP_ATS_NSEC));
+		}
+	}
+#endif
+	return ret;
+}
+
+static int dwxgmac2_host_mtl_irq_status(struct tc956xmac_priv *priv,
+					struct mac_device_info *hw, u32 chan)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	int ret = 0;
+	u32 status;
+
+	status = readl(ioaddr + XGMAC_MTL_INT_STATUS);
+	if (status & BIT(chan)) {
+		u32 chan_status = readl(ioaddr + XGMAC_MTL_QINT_STATUS(chan));
+
+		if (chan_status & XGMAC_RXOVFIS)
+			ret |= CORE_IRQ_MTL_RX_OVERFLOW;
+
+		writel(~0x0, ioaddr + XGMAC_MTL_QINT_STATUS(chan));
+	}
+
+	return ret;
+}
+
+static void dwxgmac2_flow_ctrl(struct tc956xmac_priv *priv,
+			       struct mac_device_info *hw, unsigned int duplex,
+			       unsigned int fc, unsigned int pause_time,
+			       u32 tx_cnt)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 i, flow;
+
+	flow = readl(ioaddr + XGMAC_RX_FLOW_CTRL);
+	flow &= ~XGMAC_RFE;
+	if (fc & FLOW_RX)
+#ifdef TC956X_SRIOV_PF
+		flow |= XGMAC_RFE;
+#elif defined TC956X_SRIOV_VF
+		flow |= XGMAC_RFE;
+#endif
+	writel(flow, ioaddr + XGMAC_RX_FLOW_CTRL);
+
+	for (i = 0; i < tx_cnt; i++) {
+		flow = readl(ioaddr + XGMAC_Qx_TX_FLOW_CTRL(i));
+		flow &= ~(XGMAC_FCB | XGMAC_TFE | XGMAC_PT);
+		if (fc & FLOW_TX) {
+			flow |= XGMAC_TFE;
+
+			if (duplex)
+				flow |= (pause_time << XGMAC_PT_SHIFT) & XGMAC_PT;
+		}
+		writel(flow, ioaddr + XGMAC_Qx_TX_FLOW_CTRL(i));
+	}
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static void dwxgmac2_pmt(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw, unsigned long mode)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 val = 0x0;
+
+	if (mode & WAKE_MAGIC)
+		val |= XGMAC_PWRDWN | XGMAC_MGKPKTEN;
+	if (mode & WAKE_UCAST)
+		val |= XGMAC_PWRDWN | XGMAC_GLBLUCAST | XGMAC_RWKPKTEN;
+	if (val) {
+		u32 cfg = readl(ioaddr + XGMAC_RX_CONFIG);
+
+		cfg |= XGMAC_CONFIG_RE;
+		writel(cfg, ioaddr + XGMAC_RX_CONFIG);
+	}
+
+	writel(val, ioaddr + XGMAC_PMT);
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+
+static void dwxgmac2_set_umac_addr(struct tc956xmac_priv *priv,
+				   struct mac_device_info *hw,
+				   unsigned char *addr, unsigned int reg_n,
+				   unsigned int vf)
+{
+
+	tc956x_set_mac_addr(priv, hw, addr, reg_n, vf);
+}
+
+static void dwxgmac2_get_umac_addr(struct tc956xmac_priv *priv,
+				   struct mac_device_info *hw,
+				   unsigned char *addr, unsigned int reg_n)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 hi_addr, lo_addr;
+
+	/* Read the MAC address from the hardware */
+	hi_addr = readl(ioaddr + XGMAC_ADDRx_HIGH(reg_n));
+	lo_addr = readl(ioaddr + XGMAC_ADDRx_LOW(reg_n));
+
+	/* Extract the MAC address from the high and low words */
+	addr[0] = lo_addr & 0xff;
+	addr[1] = (lo_addr >> 8) & 0xff;
+	addr[2] = (lo_addr >> 16) & 0xff;
+	addr[3] = (lo_addr >> 24) & 0xff;
+	addr[4] = hi_addr & 0xff;
+	addr[5] = (hi_addr >> 8) & 0xff;
+}
+
+static void dwxgmac2_set_eee_mode(struct tc956xmac_priv *priv,
+				  struct mac_device_info *hw,
+				  bool en_tx_lpi_clockgating)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_LPI_CTRL);
+
+	value |= XGMAC_LPITXEN | XGMAC_LPITXA;
+	if (en_tx_lpi_clockgating)
+		value |= XGMAC_TXCGE;
+#ifdef EEE_MAC_CONTROLLED_MODE
+	value |= XGMAC_PLS | XGMAC_PLSDIS | XGMAC_LPIATE;
+#endif
+	writel(value, ioaddr + XGMAC_LPI_CTRL);
+}
+
+static void dwxgmac2_reset_eee_mode(struct tc956xmac_priv *priv,
+						struct mac_device_info *hw)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_LPI_CTRL);
+	value &= ~(XGMAC_LPITXEN | XGMAC_LPITXA | XGMAC_TXCGE);
+#ifdef EEE_MAC_CONTROLLED_MODE
+	value &= ~(XGMAC_PLS | XGMAC_PLSDIS | XGMAC_LPIATE);
+#endif
+	writel(value, ioaddr + XGMAC_LPI_CTRL);
+}
+
+static void dwxgmac2_set_eee_pls(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw, int link)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_LPI_CTRL);
+	if (link)
+		value |= XGMAC_PLS;
+	else
+		value &= ~XGMAC_PLS;
+	writel(value, ioaddr + XGMAC_LPI_CTRL);
+	KPRINT_DEBUG1("LPI Control status register PLS bit: 0x%X\n", ((value & 0x20000) >> 17));
+}
+
+static void dwxgmac2_set_eee_timer(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw, int ls, int tw)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+	value = readl(ioaddr + XGMAC_LPI_TIMER_CTRL);
+
+	value &= ~(XGMAC_LPI_TIMER_CTRL_TWT_MASK | XGMAC_LPI_TIMER_CTRL_LST_MASK);
+	value |= ((tw & XGMAC_LPI_TIMER_CTRL_TWT_MASK)
+		| ((ls << XGMAC_LPI_TIMER_CTRL_LST_SHIFT) & XGMAC_LPI_TIMER_CTRL_LST_MASK));
+	writel(value, ioaddr + XGMAC_LPI_TIMER_CTRL);
+}
+
+static void dwxgmac2_set_mchash(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 *mcfilterbits,
+				int mcbitslog2)
+{
+	int numhashregs, regs, data = 0;
+
+	switch (mcbitslog2) {
+	case 6:
+		numhashregs = 2;
+		break;
+	case 7:
+		numhashregs = 4;
+		break;
+	case 8:
+		numhashregs = 8;
+		break;
+	default:
+		return;
+	}
+
+	for (regs = 0; regs < numhashregs; regs++) {
+		data = readl(ioaddr + XGMAC_HASH_TABLE(regs));
+
+		data |= mcfilterbits[regs];
+		writel(data, ioaddr + XGMAC_HASH_TABLE(regs));
+	}
+}
+
+#ifdef TC956X_SRIOV_PF
+static s32 tc956x_mac_ind_acc_wr_rd(struct tc956xmac_priv *priv, u8 wr_rd, u32 msel, u32 offset, u32 *val)
+{
+	u32 reg_data, limit;
+	void __iomem *ioaddr = priv->ioaddr;
+
+	/* Wait till previous operation is complete */
+	limit = 1000;
+	while (limit--) {
+		if (!(readl(ioaddr + XGMAC_INDR_ACC_CTRL) & XGMAC_INDR_ACC_CTRL_OB))
+			break;
+		udelay(1);
+	}
+	if (limit < 0)
+		return -EBUSY;
+
+	/* Clear previous values */
+	reg_data = readl(ioaddr + XGMAC_INDR_ACC_CTRL);
+	reg_data &= (~(XGMAC_INDR_ACC_CTRL_RSVD | XGMAC_INDR_ACC_CTRL_MSEL | \
+			XGMAC_INDR_ACC_CTRL_AOFF | XGMAC_INDR_ACC_CTRL_COM | \
+			XGMAC_INDR_ACC_CTRL_AUTO));
+
+	if (wr_rd) {
+		/* Indirect Read sequence */
+
+		/* Set read params */
+		reg_data |= (msel << XGMAC_INDR_ACC_CTRL_MSEL_SHIFT) | \
+				(wr_rd << XGMAC_INDR_ACC_CTRL_COM_SHIFT) | \
+				(offset << XGMAC_INDR_ACC_CTRL_AOFF_SHIFT);
+
+		writel(reg_data, ioaddr + XGMAC_INDR_ACC_CTRL);
+
+
+		/* Start Operation */
+		reg_data |= XGMAC_INDR_ACC_CTRL_OB;
+
+		writel(reg_data, ioaddr + XGMAC_INDR_ACC_CTRL);
+
+		/* Wait for completion */
+		limit = 1000;
+		while (limit--) {
+			if (!(readl(ioaddr + XGMAC_INDR_ACC_CTRL) & XGMAC_INDR_ACC_CTRL_OB))
+				break;
+			udelay(1);
+		}
+		if (limit < 0)
+			return -EBUSY;
+
+		/* Read value */
+		*val = readl(ioaddr + XGMAC_INDR_ACC_DATA);
+
+
+	} else {
+		/* Indirect Write sequence */
+
+		/* Set write value and params */
+		writel(*val, ioaddr + XGMAC_INDR_ACC_DATA);
+
+		reg_data |= (msel << XGMAC_INDR_ACC_CTRL_MSEL_SHIFT) | \
+				(offset << XGMAC_INDR_ACC_CTRL_AOFF_SHIFT);
+
+		writel(reg_data, ioaddr + XGMAC_INDR_ACC_CTRL);
+
+		/* Start Operation */
+		reg_data |= XGMAC_INDR_ACC_CTRL_OB;
+
+		writel(reg_data, ioaddr + XGMAC_INDR_ACC_CTRL);
+
+		/* Wait for completion */
+		limit = 1000;//10000;
+		while (limit--) {
+			if (!(readl(ioaddr + XGMAC_INDR_ACC_CTRL) & XGMAC_INDR_ACC_CTRL_OB))
+				break;
+			udelay(1);
+		}
+		if (limit < 0)
+			return -EBUSY;
+
+	}
+
+	return 0;
+
+}
+
+#ifdef TC956X_SRIOV_DEBUG
+void tc956x_filter_debug(struct tc956xmac_priv *priv)
+{
+	u32 reg_data = 0, offset;
+	void __iomem *ioaddr = priv->ioaddr;
+
+	for (offset = 0; offset < 32; offset++) {
+		if (tc956x_mac_ind_acc_wr_rd(priv, XGMAC_COM_READ, XGMAC_MSEL_DCHSEL, offset, &reg_data)) {
+			netdev_err(priv->dev, "Setting XDCS Failed\n");
+			return;
+		}
+		KPRINT_INFO("%d %08x %08x %01x\n", offset, readl(ioaddr + XGMAC_ADDRx_HIGH(offset)), readl(ioaddr + XGMAC_ADDRx_LOW(offset)), reg_data);
+	}
+}
+#endif
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+static void tc956x_set_dma_ch(struct tc956xmac_priv *priv, struct mac_device_info *hw, int index, int vf, bool mc_addr)
+#else
+static void tc956x_set_dma_ch(struct tc956xmac_priv *priv, struct mac_device_info *hw, int index, int vf)
+#endif
+{
+	u32 data = 0, reg_data = 0;
+
+	reg_data = 0;
+
+	if (tc956x_mac_ind_acc_wr_rd(priv, XGMAC_COM_READ, XGMAC_MSEL_DCHSEL, index, &reg_data)) {
+		netdev_err(priv->dev, "Setting XDCS Failed\n");
+		return;
+	}
+
+	if (vf == TC956XMAC_VF_IVI) /* IVI */
+		data |= TC956XMAC_CHA_IVI;
+	else if (vf == TC956XMAC_VF_TCU) /* TCU */
+		data |= TC956XMAC_CHA_TCU;
+	else if (vf == TC956XMAC_VF_ADAS) /* ADAS */
+		data |= TC956XMAC_CHA_ADAS;
+	else if (vf == PF_DRIVER) {/* PF */
+#if defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+		if (mc_addr)
+			data |= TC956XMAC_CHA_M2M;
+		data |= TC956XMAC_CHA_PF;
+
+#else
+		data |= TC956XMAC_CHA_PF;
+#endif
+	} else
+		data |= TC956XMAC_CHA_NO_0;
+
+	reg_data |= data;
+
+	if (tc956x_mac_ind_acc_wr_rd(priv, XGMAC_COM_WRITE, XGMAC_MSEL_DCHSEL, index, &reg_data)) {
+		netdev_err(priv->dev, "Setting XDCS Failed\n");
+		return;
+	}
+
+}
+
+static void tc956x_del_dma_ch(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+				int index, int vf)
+{
+	u32 data = 0, reg_data = 0;
+
+
+	if (tc956x_mac_ind_acc_wr_rd(priv, XGMAC_COM_READ, XGMAC_MSEL_DCHSEL, index, &reg_data)) {
+		netdev_err(priv->dev, "Setting XDCS Failed\n");
+		return;
+	}
+
+	if (vf == TC956XMAC_VF_IVI) /* IVI */
+		data |= TC956XMAC_CHA_IVI;
+	else if (vf == TC956XMAC_VF_TCU) /* TCU */
+		data |= TC956XMAC_CHA_TCU;
+	else if (vf == TC956XMAC_VF_ADAS) /* ADAS */
+		data |= TC956XMAC_CHA_ADAS;
+	else if (vf == PF_DRIVER) /* PF */
+		data |= TC956XMAC_CHA_PF;
+	else
+		data |= TC956XMAC_CHA_NO_0;
+
+	reg_data &= ~data;
+
+
+	if (tc956x_mac_ind_acc_wr_rd(priv, XGMAC_COM_WRITE, XGMAC_MSEL_DCHSEL, index, &reg_data)) {
+		netdev_err(priv->dev, "Setting XDCS Failed\n");
+		return;
+	}
+}
+
+#endif
+
+static void tc956x_set_mac_addr(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+				const u8 *mac, int index, int vf)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	unsigned long data = 0;
+	u32 value;
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+	u8 flow_ctrl_addr[6] = {0x01, 0x80, 0xC2, 0x00, 0x00, 0x01};
+	bool multicast_addr = false;
+#endif
+
+	data = (mac[5] << 8) | mac[4];
+	/* For MAC Addr registers se have to set the Address Enable (AE)
+	 * bit that has no effect on the High Reg 0 where the bit 31 (MO)
+	 * is RO.
+	 */
+	value = readl(ioaddr + XGMAC_PACKET_FILTER);
+	if ((value & XGMAC_PACKET_FILTER_SA) || (value & XGMAC_PACKET_FILTER_SAIF))
+		writel(data | XGMAC_AE | XGMAC_SA, ioaddr + XGMAC_ADDRx_HIGH(index));
+	else
+		writel(data | XGMAC_AE, ioaddr + XGMAC_ADDRx_HIGH(index));
+
+	data = 0;
+	data = (mac[3] << 24) | (mac[2] << 16) | (mac[1] << 8) | mac[0];
+	writel(data, ioaddr + XGMAC_ADDRx_LOW(index));
+
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+	if (is_multicast_ether_addr(mac))
+		multicast_addr = true;
+
+	/* Route all multicast Flow control packets to PCI path */
+	if (!memcmp(&flow_ctrl_addr[0], &mac[0], TC956X_SIX))
+		multicast_addr = false;
+
+	tc956x_set_dma_ch(priv, hw, index, vf, multicast_addr);
+#else
+	tc956x_set_dma_ch(priv, hw, index, vf);
+#endif
+#endif
+}
+
+static void tc956x_del_mac_addr(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+				int index, int vf)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	unsigned long data = 0;
+
+	writel(data, ioaddr + XGMAC_ADDRx_HIGH(index));
+	writel(data, ioaddr + XGMAC_ADDRx_LOW(index));
+
+#ifdef TC956X_SRIOV_PF
+	/*clearing the dma indirect XDCS register
+	 * when the mac address is completely deleted from the sw table
+	 */
+
+	if (tc956x_mac_ind_acc_wr_rd(priv, XGMAC_COM_WRITE, XGMAC_MSEL_DCHSEL, index, (u32 *)&data)) {
+		netdev_err(priv->dev, "Setting XDCS Failed\n");
+		return;
+	}
+#endif
+
+}
+
+static void tc956x_del_sw_mac_helper(struct tc956x_mac_addr *mac_table, int vf)
+{
+	int vf_number;
+
+	for (vf_number = 0; vf_number < 4; vf_number++) {
+		if (mac_table->vf[vf_number] == vf) {
+			mac_table->vf[vf_number] = 0;
+			mac_table->counter--;
+			if (mac_table->counter == 0)
+				mac_table->status = TC956X_MAC_STATE_VACANT;
+			break;
+		}
+	}
+}
+
+static void tc956x_del_sw_mac_table(struct net_device *dev,
+						const u8 *mac, int vf)
+{
+	int i;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct mac_device_info *hw = priv->hw;
+	struct tc956x_mac_addr *mac_table = &priv->mac_table[0];
+	u32 mc_filter[2];
+	u32 nr;
+	u32 data1, data2;
+
+	void __iomem *ioaddr = (void __iomem *)dev->base_addr;
+
+	for (i = XGMAC_ADDR_ADD_SKIP_OFST; i < (TC956X_MAX_PERFECT_ADDRESSES);
+	     i++, mac_table++) {
+		if (mac_table->status == TC956X_MAC_STATE_OCCUPIED) {
+			if (ether_addr_equal(mac, mac_table->mac_address)) {
+				tc956x_del_sw_mac_helper(mac_table, vf);
+				break;
+			}
+		}
+	}
+	if (mac_table->counter == 0) {
+		/* deleting the crc from hast table*/
+		if (priv->l2_filtering_mode == 1) {
+			memset(mc_filter, 0, sizeof(mc_filter));
+			nr = (bitrev32(~crc32_le(~0, mac_table->mac_address, 6)) >> 26);
+			/* The most significant bit determines the register
+			 * to use while the other 5 bits determines the bit
+			 * within the selected register
+			 */
+			mc_filter[nr >> 5] |= (1 << (nr & 0x1F));
+
+			data1 = 0;
+			data1 = readl(ioaddr + XGMAC_HASH_TAB_0_31);
+
+			data2 = readl(ioaddr + XGMAC_HASH_TAB_32_63);
+
+			data1 &= ~mc_filter[0];
+			data2 &= ~mc_filter[1];
+
+			writel(data1, ioaddr + XGMAC_HASH_TAB_0_31);
+			writel(data2, ioaddr + XGMAC_HASH_TAB_32_63);
+		}
+		tc956x_del_mac_addr(priv, hw, i, vf);
+#ifdef TC956X_SRIOV_PF
+	} else {
+		tc956x_del_dma_ch(priv, hw, i, vf);
+#endif
+	}
+}
+
+static int tc956x_add_actual_mac_table(struct net_device *dev,
+							const u8 *mac, int vf)
+{
+	int i;
+	int ret_value = -1;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct mac_device_info *hw = priv->hw;
+	int mcbitslog2 = hw->mcast_bits_log2;
+	void __iomem *ioaddr = (void __iomem *)dev->base_addr;
+	u32 mc_filter[2];
+	u32 nr, flag = 0;
+	u32 value;
+
+	struct tc956x_mac_addr *mac_table = &priv->mac_table[0];
+
+	for (i = XGMAC_ADDR_ADD_SKIP_OFST; i < (TC956X_MAX_PERFECT_ADDRESSES);
+	     i++, mac_table++) {
+		if (mac_table->status & TC956X_MAC_STATE_OCCUPIED)
+			continue;
+
+		flag = 1;
+		ether_addr_copy(mac_table->mac_address, mac);
+		mac_table->status = TC956X_MAC_STATE_OCCUPIED;
+		mac_table->counter++;
+		mac_table->vf[0] = vf;
+		ret_value = 0;
+		break;
+	}
+	if (flag == 1) {
+		if (priv->l2_filtering_mode == 1) {
+			memset(mc_filter, 0, sizeof(mc_filter));
+			nr = (bitrev32(~crc32_le(~0, mac, 6))
+				>> (32 - mcbitslog2));
+			mc_filter[nr >> 5] |= (1 << (nr & 0x1F));
+
+			dwxgmac2_set_mchash(priv, ioaddr, mc_filter, mcbitslog2);
+		}
+		tc956x_set_mac_addr(priv, hw, mac, i, vf);
+	} else {
+
+		KPRINT_INFO("Space is not available in MAC_Table\n");
+		KPRINT_INFO("Enabling the promisc mode\n");
+		value = readl(ioaddr + XGMAC_PACKET_FILTER);
+#if defined(TC956X_SRIOV_PF) || defined(TC956X_SRIOV_VF) || defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE) || defined(TC956X_CPE_CONFIG)
+		value |= XGMAC_FILTER_RA;
+#else
+		value |= XGMAC_FILTER_PR;
+#endif
+		writel(value, ioaddr + XGMAC_PACKET_FILTER);
+	}
+	return ret_value;
+}
+
+
+static int tc956x_mac_duplication(struct tc956xmac_priv *priv,
+					    struct mac_device_info *hw,
+					    struct tc956x_mac_addr *mac_table,
+					    const u8 *mac, int vf)
+{
+	int i, vf_no;
+	int free_index = 0, ret_value = -1;
+
+	for (i = XGMAC_ADDR_ADD_SKIP_OFST; i < (TC956X_MAX_PERFECT_ADDRESSES);
+	     i++, mac_table++) {
+		if (mac_table->status == TC956X_MAC_STATE_OCCUPIED) {
+			if (ether_addr_equal(mac, mac_table->mac_address)) {
+				if (is_unicast_ether_addr(mac)) {
+					KPRINT_DEBUG1("%pM mac is unicast address and it cannot be duplicated\n", mac);
+					return -1;
+				}
+				for (vf_no = 0; vf_no < 4; vf_no++) {
+					if (mac_table->vf[vf_no] == 0) {
+						free_index = vf_no;
+					} else if (
+						mac_table->vf[vf_no] == vf) {
+						return -1;
+					}
+				}
+#ifdef TC956X_SRIOV_PF
+					/*if vf is not found in vf[],
+					 *than add vf no, in free index
+					 *of vf[]
+					 */
+					KPRINT_DEBUG1(KERN_DEBUG "%d offset %pM mac duplication\n", i, mac);
+					mac_table->vf[free_index] = vf;
+					mac_table->counter++;
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+					tc956x_set_dma_ch(priv, hw, i, vf, false);
+#else
+					tc956x_set_dma_ch(priv, hw, i, vf);
+#endif
+					ret_value = TC956X_MAC_STATE_MODIFIED;
+					return ret_value;
+#elif defined TC956X_SRIOV_VF
+				/*if vf is not found in vf[],
+				 *than add vf no, in free index
+				 *of vf[]
+				 */
+				mac_table->vf[free_index] = vf;
+				mac_table->counter++;
+				ret_value = TC956X_MAC_STATE_MODIFIED;
+				return ret_value;
+#endif
+			}
+		}
+	}
+			ret_value = TC956X_MAC_STATE_NEW;
+	return ret_value;
+
+}
+
+static int tc956x_check_mac_duplication(struct net_device *dev, const u8 *mac, int vf)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct tc956x_mac_addr *mac_table = &priv->mac_table[0];
+	struct mac_device_info *hw = priv->hw;
+	int ret_value = -1;
+
+	if (is_zero_ether_addr(mac)) {
+		;
+	} else {
+		ret_value =
+			tc956x_mac_duplication(priv, hw,
+							mac_table, mac, vf);
+	}
+	return ret_value;
+}
+
+static int tc956x_add_sw_mac_table(struct net_device *dev, const u8 *mac, int vf)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	void __iomem *ioaddr = (void __iomem *)dev->base_addr;
+	u32 value = readl(ioaddr + XGMAC_PACKET_FILTER);
+	unsigned int reg_value;
+	int ret_value = 0;
+#if defined(TC956X_SRIOV_PF)
+	u32 value_extended = readl(ioaddr + XGMAC_EXTENDED_REG);
+#endif
+
+#ifndef TC956X_ENABLE_MAC2MAC_BRIDGE
+	value &= ~(XGMAC_FILTER_PR | XGMAC_FILTER_HMC | XGMAC_FILTER_PM
+				| XGMAC_FILTER_RA);
+#endif
+	value |= XGMAC_FILTER_HPF;
+	writel(value, ioaddr + XGMAC_PACKET_FILTER);
+
+#if defined(TC956X_SRIOV_PF)
+	value_extended |= XGMAC_FILTER_DDS;
+	writel(value_extended, ioaddr + XGMAC_EXTENDED_REG);
+#endif
+
+	if (priv->l2_filtering_mode == 1) {
+		value |= XGMAC_FILTER_HMC;
+		value |= XGMAC_FILTER_HUC;
+	} else {
+	}
+
+	ret_value = tc956x_check_mac_duplication(dev, mac, vf);
+	if (ret_value == TC956X_MAC_STATE_NEW)
+		ret_value = tc956x_add_actual_mac_table(dev, mac, vf);
+
+	reg_value = readl(ioaddr + XGMAC_PACKET_FILTER);
+	if (reg_value & XGMAC_FILTER_RA)
+		reg_value &= XGMAC_PACKET_FILTER_MASK_PR_EN;
+	else
+		reg_value &= XGMAC_PACKET_FILTER_MASK_PR_DIS;
+	reg_value |= value;
+	writel(reg_value, ioaddr + XGMAC_PACKET_FILTER);
+	value = readl(ioaddr + XGMAC_PACKET_FILTER);
+
+	return ret_value;
+}
+
+#ifdef TC956X_SRIOV_PF
+int tc956x_pf_set_mac_filter(struct net_device *dev,
+				int vf, const u8 *mac)
+{
+
+	if (tc956x_add_sw_mac_table(dev, mac, vf) >= 0)
+		return 0;
+	else
+		return -EPERM;
+}
+
+void tc956x_pf_del_mac_filter(struct net_device *dev,
+	int vf, const u8 *mac)
+{
+	tc956x_del_sw_mac_table(dev, mac, vf);
+}
+
+void tc956x_pf_del_umac_addr(struct tc956xmac_priv *priv,
+				int index, int vf)
+{
+	struct mac_device_info *hw = priv->hw;
+
+	tc956x_del_mac_addr(priv, hw, index, vf);
+	tc956x_del_dma_ch(priv, hw, 0, vf);
+}
+#endif
+
+#ifdef TC956X_SRIOV_PF
+int tc956x_add_mac_addr(struct net_device *dev, const unsigned char *mac)
+#elif defined TC956X_SRIOV_VF
+static int tc956x_add_mac_addr(struct net_device *dev, const unsigned char *mac)
+#endif
+{
+	int ret_value;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	unsigned long flags;
+
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+	ret_value = tc956x_add_sw_mac_table(dev, mac, PF_DRIVER);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	return ret_value;
+}
+
+static int tc956x_delete_mac_addr(struct net_device *dev,
+	const unsigned char *mac)
+{
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	tc956x_del_sw_mac_table(dev, mac, PF_DRIVER);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+
+	return 0;
+}
+static void dwxgmac2_set_filter(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+				struct net_device *dev)
+{
+	void __iomem *ioaddr = (void __iomem *)dev->base_addr;
+	u32 value = readl(ioaddr + XGMAC_PACKET_FILTER);
+	u32 i;
+
+#ifndef TC956X_ENABLE_MAC2MAC_BRIDGE
+	value &= ~(XGMAC_FILTER_PR | XGMAC_FILTER_HMC | XGMAC_FILTER_PM |
+		   XGMAC_FILTER_RA);
+#endif
+	value |= XGMAC_FILTER_HPF;
+#ifndef TC956X_SRIOV_VF
+	/* Configuring to Pass all pause frames to application, PHY pause frames will be filtered by FRP */
+	if ((mac0_filter_phy_pause == ENABLE && priv->port_num == RM_PF0_ID) ||
+	   (mac1_filter_phy_pause == ENABLE && priv->port_num == RM_PF1_ID)) {
+		/* setting pcf to 0b10 i.e. pass pause frames of address filter fail to Application */
+		value |= 0x80;
+	}
+#endif
+	writel(value, ioaddr + XGMAC_PACKET_FILTER);
+	if (dev->flags & IFF_PROMISC) {
+#if defined(TC956X_SRIOV_PF) || defined(TC956X_SRIOV_VF) || defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE) || defined(TC956X_CPE_CONFIG)
+		value |= XGMAC_FILTER_RA;
+#else
+		value |= XGMAC_FILTER_PR;
+#endif
+		writel(value, ioaddr + XGMAC_PACKET_FILTER);
+	} else if (dev->flags & IFF_ALLMULTI) {
+		value |= XGMAC_FILTER_PM;
+		writel(value, ioaddr + XGMAC_PACKET_FILTER);
+		for (i = 0; i < XGMAC_MAX_HASH_TABLE; i++)
+			writel(~0x0, ioaddr + XGMAC_HASH_TABLE(i));
+	} else {
+		__dev_uc_sync(dev, tc956x_add_mac_addr, tc956x_delete_mac_addr);
+
+		__dev_mc_sync(dev, tc956x_add_mac_addr, tc956x_delete_mac_addr);
+	}
+#ifdef TC956X
+	if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
+		dwxgmac2_enable_rx_vlan_filtering(priv, hw);
+	else
+		dwxgmac2_disable_rx_vlan_filtering(priv, hw);
+
+	if (dev->features & NETIF_F_HW_VLAN_CTAG_RX)
+		dwxgmac2_enable_rx_vlan_stripping(priv, hw);
+	else
+		dwxgmac2_disable_rx_vlan_stripping(priv, hw);
+#endif
+}
+
+static void dwxgmac2_set_mac_loopback(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, bool enable)
+{
+	u32 value = readl(ioaddr + XGMAC_RX_CONFIG);
+
+	if (enable)
+		value |= XGMAC_CONFIG_LM;
+	else
+		value &= ~XGMAC_CONFIG_LM;
+
+	writel(value, ioaddr + XGMAC_RX_CONFIG);
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static int dwxgmac2_rss_write_reg(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool is_key, int idx,
+				  u32 val)
+{
+	u32 ctrl = 0;
+
+	writel(val, ioaddr + XGMAC_RSS_DATA);
+	ctrl |= idx << XGMAC_RSSIA_SHIFT;
+	ctrl |= is_key ? XGMAC_ADDRT : 0x0;
+	ctrl |= XGMAC_OB;
+	writel(ctrl, ioaddr + XGMAC_RSS_ADDR);
+
+	return readl_poll_timeout(ioaddr + XGMAC_RSS_ADDR, ctrl,
+				  !(ctrl & XGMAC_OB), 100, 10000);
+}
+
+static int dwxgmac2_rss_configure(struct tc956xmac_priv *priv,
+				  struct mac_device_info *hw,
+				  struct tc956xmac_rss *cfg, u32 num_rxq)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value, *key;
+	int i, ret;
+
+	value = readl(ioaddr + XGMAC_RSS_CTRL);
+	if (!cfg || !cfg->enable) {
+		value &= ~XGMAC_RSSE;
+		writel(value, ioaddr + XGMAC_RSS_CTRL);
+		return 0;
+	}
+
+	key = (u32 *)cfg->key;
+	for (i = 0; i < (ARRAY_SIZE(cfg->key) / sizeof(u32)); i++) {
+		ret = dwxgmac2_rss_write_reg(priv, ioaddr, true, i, key[i]);
+		if (ret)
+			return ret;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(cfg->table); i++) {
+		ret = dwxgmac2_rss_write_reg(priv, ioaddr, false, i, cfg->table[i]);
+		if (ret)
+			return ret;
+	}
+
+	for (i = 0; i < num_rxq; i++)
+		dwxgmac2_map_mtl_to_dma(priv, hw, i, XGMAC_QDDMACH);
+
+	value |= XGMAC_UDP4TE | XGMAC_TCP4TE | XGMAC_IP2TE | XGMAC_RSSE;
+	writel(value, ioaddr + XGMAC_RSS_CTRL);
+	return 0;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+static void tc956x_del_vlan_addr(struct tc956xmac_priv *priv, struct mac_device_info *hw, int count)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	unsigned long data = 0;
+	int err;
+
+	data = readl(ioaddr + XGMAC_VLAN_TAG_DATA);
+
+	data &= ~XGMAC_VLAN_VID;
+	data &= ~XGMAC_VLAN_DMACHE;
+	/*writting 0 in vid will pass all the packets*/
+	writel(data, ioaddr + XGMAC_VLAN_TAG_DATA);
+
+	data = 0;
+	data |= ((count << XGMAC_ADDR_OFFSET_LPOS) & XGMAC_ADDR_OFFSET);
+	data &= ~XGMAC_VLAN_CT;/*write command*/
+	data |= XGMAC_VLAN_OB;
+
+	writel(data, ioaddr + XGMAC_VLAN_TAG_CTRL);
+
+	err = readl_poll_timeout_atomic(ioaddr + XGMAC_VLAN_TAG_CTRL, data,
+									!(data & XGMAC_VLAN_OB), 1, 10);
+	if (err < 0)
+		netdev_err(priv->dev, "Timeout\n");
+
+}
+
+static void tc956x_vlan_addr_reg(struct tc956xmac_priv *priv, struct mac_device_info *hw, int count,
+				 u16 VLAN)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	unsigned long data = 0;
+
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+	data = 0;
+	data |= VLAN;
+	data |= XGMAC_VLAN_EN;
+	data |= XGMAC_VLAN_ETV_DATA;
+	data &= ~XGMAC_VLAN_DMACHE;
+	writel(data, ioaddr + XGMAC_VLAN_TAG_DATA);
+
+	data = 0;
+#ifdef TC956X_SRIOV_PF
+	data = readl(ioaddr + XGMAC_VLAN_TAG_CTRL);
+#endif
+	data &= ~XGMAC_ADDR_OFFSET;
+	data |= (count << XGMAC_ADDR_OFFSET_LPOS);
+	data &= ~XGMAC_VLAN_CT;/*write command*/
+	data |= XGMAC_VLAN_OB;
+
+	writel(data, ioaddr + XGMAC_VLAN_TAG_CTRL);
+
+	do {
+		data = readl(ioaddr + XGMAC_VLAN_TAG_CTRL) & XGMAC_VLAN_OB;
+	} while (data);
+
+#else
+	data = readl(ioaddr + XGMAC_VLAN_TAG_DATA);
+	data |= VLAN;
+	data |= XGMAC_VLAN_EN;
+	data |= XGMAC_VLAN_DMACHE;
+	data |= TC956X_VLAN_DMACH;/*DMAC Channel = 1*/
+	writel(data, ioaddr + XGMAC_VLAN_TAG_DATA);
+
+	data = 0;
+	data = readl(ioaddr + XGMAC_VLAN_TAG_CTRL);
+	data &= ~XGMAC_ADDR_OFFSET;
+	data |= (count << XGMAC_ADDR_OFFSET_LPOS);
+	data &= ~XGMAC_VLAN_CT;/*write command*/
+	data |= XGMAC_VLAN_OB;
+
+	writel(data, ioaddr + XGMAC_VLAN_TAG_CTRL);
+
+	do {
+		data = readl(ioaddr + XGMAC_VLAN_TAG_CTRL) & XGMAC_VLAN_OB;
+	} while (data);
+
+#endif
+
+}
+
+static void tc956x_del_sw_vlan_helper(struct tc956x_vlan_id *vlan_table,
+	u16 vid, u16 vf)
+{
+	int vf_number;
+
+	for (vf_number = 0; vf_number < 4;
+	vf_number++) {
+		if (vlan_table->vf[vf_number].vf_number == vf) {
+			vlan_table->vf[vf_number].loc_counter--;
+
+			vlan_table->glo_counter--;
+
+			if (vlan_table->vf[vf_number].loc_counter == 0)
+				vlan_table->vf[vf_number].vf_number = 0;
+
+			if (vlan_table->glo_counter == 0)
+				vlan_table->status = TC956X_MAC_STATE_VACANT;
+
+			break;
+		}
+	}
+}
+
+static void tc956x_del_sw_vlan_table(struct tc956xmac_priv *priv, struct net_device *dev, u16 vid, u16 vf)
+{
+	int i;
+	struct mac_device_info *hw = priv->hw;
+	struct tc956x_vlan_id *vlan_table = &priv->vlan_table[0];
+	unsigned short new_index, old_index;
+	int crc32_val = 0;
+	unsigned int enb_12bit_vhash;
+	u32 flag = 0;
+
+	for (i = 0; i < (TC956X_MAX_PERFECT_VLAN);
+	     i++, vlan_table++) {
+		if (vlan_table->status == TC956X_MAC_STATE_OCCUPIED) {
+			if (vlan_table->vid == vid) {
+				flag = 1;
+				tc956x_del_sw_vlan_helper
+					(vlan_table, vid, vf);
+				break;
+			}
+		}
+	}
+	if (flag == 1) {
+		if (vlan_table->glo_counter == 0) {
+			/* deleting the crc from hast table
+			 */
+			if (priv->vlan_hash_filtering == 1) {
+				/* The upper 4 bits of the calculated CRC
+				 * are used to index the content of the VLAN
+				 * Hash Table Reg.
+				 */
+				enb_12bit_vhash = (readl(priv->ioaddr +
+				XGMAC_VLAN_TAG) & XGMAC_VLAN_ETV)
+				>> XGMAC_VLAN_ETV_LPOS;
+
+				if (enb_12bit_vhash)
+					vid = vid & 0xFFF;
+
+				crc32_val = (bitrev32(~crc32_le(~0,
+				(unsigned char *)&vid, 2)) >> 28);
+				/* These 4(0xF) bits determines the
+				 * bit within the VLAN Hash Table Reg 0
+				 */
+
+				if (enb_12bit_vhash)
+					new_index = (1 << (crc32_val & 0xF));
+				else
+					new_index = (1 << (~crc32_val & 0xF));
+
+				old_index =
+				(readl(priv->ioaddr +
+				XGMAC_VLAN_HASH_TABLE) &
+				XGMAC_VLAN_VID) >> XGMAC_VLAN_VL_LPOS;
+				old_index &= (~new_index);
+
+				writel(old_index, priv->ioaddr +
+				XGMAC_VLAN_HASH_TABLE);
+			}
+			tc956x_del_vlan_addr(priv, hw, i);
+		}
+	} else {
+		KPRINT_INFO("Passed id is not present\n");
+	}
+}
+
+static int tc956x_add_actual_vlan_table(struct net_device *dev, u16 vid, int vf)
+{
+	int i;
+	int ret_value = -1;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct mac_device_info *hw = priv->hw;
+	unsigned short new_index, old_index;
+	int crc32_val = 0;
+	unsigned int enb_12bit_vhash;
+	u32 flag = 0;
+	struct tc956x_vlan_id *vlan_table = &priv->vlan_table[0];
+
+	for (i = 0; i < (TC956X_MAX_PERFECT_VLAN);
+	     i++, vlan_table++) {
+		if (vlan_table->status & TC956X_MAC_STATE_OCCUPIED)
+			continue;
+
+		flag = 1;
+		vlan_table->vid = vid;
+		vlan_table->status = TC956X_MAC_STATE_OCCUPIED;
+		vlan_table->glo_counter++;
+		vlan_table->vf[0].vf_number = vf;
+		vlan_table->vf[0].loc_counter++;
+
+		ret_value = 0;
+		break;
+	}
+	if (flag == 1) {
+		if (priv->vlan_hash_filtering) {
+		/* The upper 4 bits of the calculated CRC are used to
+		 * index the content of the VLAN Hash Table Reg.
+		 */
+			enb_12bit_vhash = (readl(priv->ioaddr +
+			XGMAC_VLAN_TAG) & XGMAC_VLAN_ETV)
+			>> XGMAC_VLAN_ETV_LPOS;
+
+			if (enb_12bit_vhash)
+				vid = vid & 0xFFF;
+			crc32_val =
+			(bitrev32(~crc32_le(~0, (unsigned char *)&vid, 2))
+				>> 28);
+
+			if (enb_12bit_vhash)
+				new_index = (1 << (crc32_val & 0xF));
+			else
+				new_index = (1 << (~crc32_val & 0xF));
+
+			old_index = (readl(priv->ioaddr + XGMAC_VLAN_HASH_TABLE) &
+				XGMAC_VLAN_VID) >> XGMAC_VLAN_VL_LPOS;
+
+			old_index |= new_index;
+			writel(old_index, priv->ioaddr + XGMAC_VLAN_HASH_TABLE);
+		}
+		tc956x_vlan_addr_reg(priv, hw, i, vid);
+	} else {
+		KPRINT_INFO("VLAN table is full\n");
+	}
+	return ret_value;
+}
+
+
+static int tc956x_vlan_duplication_helper(struct tc956x_vlan_id *vlan_table,
+						u16 vid, int vf)
+{
+	int vf_no, vm_found = 0;
+	int free_index = 0, ret_value = -1;
+
+	for (vf_no = 0; vf_no < 4; vf_no++) {
+		if (vlan_table->vf[vf_no].vf_number == 0) {
+			free_index = vf_no;
+		} else if (vlan_table->vf[vf_no].vf_number == vf) {
+			vm_found = 1;
+
+			vlan_table->vf[vf_no].loc_counter++;
+
+			vlan_table->glo_counter++;
+
+			ret_value =
+			TC956X_MAC_STATE_MODIFIED;
+			break;
+		}
+	}
+
+	if (vm_found != 1) {
+		vlan_table->vf[free_index].vf_number = vf;
+
+		vlan_table->vf[free_index].loc_counter++;
+
+		vlan_table->glo_counter++;
+
+		ret_value = TC956X_MAC_STATE_MODIFIED;
+	}
+
+	return ret_value;
+}
+
+static int tc956x_check_vlan_duplication(struct net_device *dev, u16 vid, int vf)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct tc956x_vlan_id *vlan_table = &priv->vlan_table[0];
+	int i;
+	int ret_value = -1;
+
+	if (vid == 0) {
+
+		KPRINT_INFO("Zero vlan id\n");
+
+	} else {
+		for (i = 0; i < (TC956X_MAX_PERFECT_VLAN); i++, vlan_table++) {
+			if (vlan_table->status == TC956X_MAC_STATE_OCCUPIED) {
+				if (vid == vlan_table->vid) {
+					ret_value =
+					tc956x_vlan_duplication_helper
+					(vlan_table, vid, vf);
+					break;
+				} else
+					ret_value = TC956X_MAC_STATE_OCCUPIED;
+			} else
+				ret_value = TC956X_MAC_STATE_NEW;
+		}
+	}
+	return ret_value;
+}
+
+static void dwxgmac2_update_vlan_hash(struct tc956xmac_priv *priv,
+				      struct net_device *dev, bool is_double,
+				      u16 vid, u16 vf)
+{
+	void __iomem *ioaddr = (void __iomem *)dev->base_addr;
+	u32 value, ret_value;
+
+	if (priv->vlan_hash_filtering) {
+		value = readl(ioaddr + XGMAC_PACKET_FILTER);
+
+		value |= XGMAC_FILTER_VTFE;
+
+		writel(value, ioaddr + XGMAC_PACKET_FILTER);
+
+		value = 0;
+		value = readl(ioaddr + XGMAC_VLAN_TAG);
+		value |= (XGMAC_VLAN_VTHM | XGMAC_VLAN_ETV);
+		if (is_double) {
+			value |= XGMAC_VLAN_EDVLP;
+			value |= XGMAC_VLAN_ESVL;
+			value |= XGMAC_VLAN_DOVLTC;
+		}
+		writel(value, ioaddr + XGMAC_VLAN_TAG);
+	} else {
+		value = readl(ioaddr + XGMAC_PACKET_FILTER);
+
+		value |= XGMAC_FILTER_VTFE;
+
+		writel(value, ioaddr + XGMAC_PACKET_FILTER);
+
+		value = 0;
+		value = readl(ioaddr + XGMAC_VLAN_TAG);
+		value |= XGMAC_VLAN_ETV;
+		if (is_double) {
+			value |= XGMAC_VLAN_EDVLP;
+			value |= XGMAC_VLAN_ESVL;
+			value |= XGMAC_VLAN_DOVLTC;
+		}
+		writel(value, ioaddr + XGMAC_VLAN_TAG);
+	}
+
+	ret_value = tc956x_check_vlan_duplication(dev, vid, vf);
+	if (ret_value == TC956X_MAC_STATE_NEW)
+		ret_value = tc956x_add_actual_vlan_table(dev, vid, vf);
+
+}
+
+#ifdef TC956X_SRIOV_PF
+
+void tc956x_pf_set_vlan_filter(struct net_device *dev, u16 vf, u16 vid)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	dwxgmac2_update_vlan_hash(priv, dev, 0, vid, vf);
+}
+
+void tc956x_pf_del_vlan_filter(struct net_device *dev, u16 vf, u16 vid)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	tc956x_del_sw_vlan_table(priv, dev, vid, vf);
+}
+#endif
+
+struct dwxgmac3_error_desc {
+	bool valid;
+	const char *desc;
+	const char *detailed_desc;
+};
+
+#define STAT_OFF(field)	offsetof(struct tc956xmac_safety_stats, field)
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static void dwxgmac3_log_error(struct net_device *ndev, u32 value, bool corr,
+			       const char *module_name,
+			       const struct dwxgmac3_error_desc *desc,
+			       unsigned long field_offset,
+			       struct tc956xmac_safety_stats *stats)
+{
+	unsigned long loc, mask;
+	u8 *bptr = (u8 *)stats;
+	unsigned long *ptr;
+
+	ptr = (unsigned long *)(bptr + field_offset);
+
+	mask = value;
+	for_each_set_bit(loc, &mask, 32) {
+		netdev_err(ndev, "Found %s error in %s: '%s: %s'\n", corr ?
+				"correctable" : "uncorrectable", module_name,
+				desc[loc].desc, desc[loc].detailed_desc);
+
+		/* Update counters */
+		ptr[loc]++;
+	}
+}
+
+static const struct dwxgmac3_error_desc dwxgmac3_mac_errors[32] = {
+	{ true, "ATPES", "Application Transmit Interface Parity Check Error" },
+	{ true, "DPES", "Descriptor Cache Data Path Parity Check Error" },
+	{ true, "TPES", "TSO Data Path Parity Check Error" },
+	{ true, "TSOPES", "TSO Header Data Path Parity Check Error" },
+	{ true, "MTPES", "MTL Data Path Parity Check Error" },
+	{ true, "MTSPES", "MTL TX Status Data Path Parity Check Error" },
+	{ true, "MTBUPES", "MAC TBU Data Path Parity Check Error" },
+	{ true, "MTFCPES", "MAC TFC Data Path Parity Check Error" },
+	{ true, "ARPES", "Application Receive Interface Data Path Parity Check Error" },
+	{ true, "MRWCPES", "MTL RWC Data Path Parity Check Error" },
+	{ true, "MRRCPES", "MTL RCC Data Path Parity Check Error" },
+	{ true, "CWPES", "CSR Write Data Path Parity Check Error" },
+	{ true, "ASRPES", "AXI Slave Read Data Path Parity Check Error" },
+	{ true, "TTES", "TX FSM Timeout Error" },
+	{ true, "RTES", "RX FSM Timeout Error" },
+	{ true, "CTES", "CSR FSM Timeout Error" },
+	{ true, "ATES", "APP FSM Timeout Error" },
+	{ true, "PTES", "PTP FSM Timeout Error" },
+	{ false, "UNKNOWN", "Unknown Error" }, /* 18 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 19 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 20 */
+	{ true, "MSTTES", "Master Read/Write Timeout Error" },
+	{ true, "SLVTES", "Slave Read/Write Timeout Error" },
+	{ true, "ATITES", "Application Timeout on ATI Interface Error" },
+	{ true, "ARITES", "Application Timeout on ARI Interface Error" },
+	{ true, "FSMPES", "FSM State Parity Error" },
+	{ false, "UNKNOWN", "Unknown Error" }, /* 26 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 27 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 28 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 29 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 30 */
+	{ true, "CPI", "Control Register Parity Check Error" },
+};
+
+static void dwxgmac3_handle_mac_err(struct net_device *ndev,
+				    void __iomem *ioaddr, bool correctable,
+				    struct tc956xmac_safety_stats *stats)
+{
+	u32 value;
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+
+	value = readl(ioaddr + XGMAC_MAC_DPP_FSM_INT_STATUS);
+	writel(value, ioaddr + XGMAC_MAC_DPP_FSM_INT_STATUS);
+
+	dwxgmac3_log_error(ndev, value, correctable, "MAC",
+			   dwxgmac3_mac_errors, STAT_OFF(mac_errors), stats);
+}
+
+static const struct dwxgmac3_error_desc dwxgmac3_mtl_errors[32] = {
+	{ true, "TXCES", "MTL TX Memory Error" },
+	{ true, "TXAMS", "MTL TX Memory Address Mismatch Error" },
+	{ true, "TXUES", "MTL TX Memory Error" },
+	{ false, "UNKNOWN", "Unknown Error" }, /* 3 */
+	{ true, "RXCES", "MTL RX Memory Error" },
+	{ true, "RXAMS", "MTL RX Memory Address Mismatch Error" },
+	{ true, "RXUES", "MTL RX Memory Error" },
+	{ false, "UNKNOWN", "Unknown Error" }, /* 7 */
+	{ true, "ECES", "MTL EST Memory Error" },
+	{ true, "EAMS", "MTL EST Memory Address Mismatch Error" },
+	{ true, "EUES", "MTL EST Memory Error" },
+	{ false, "UNKNOWN", "Unknown Error" }, /* 11 */
+	{ true, "RPCES", "MTL RX Parser Memory Error" },
+	{ true, "RPAMS", "MTL RX Parser Memory Address Mismatch Error" },
+	{ true, "RPUES", "MTL RX Parser Memory Error" },
+	{ false, "UNKNOWN", "Unknown Error" }, /* 15 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 16 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 17 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 18 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 19 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 20 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 21 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 22 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 23 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 24 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 25 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 26 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 27 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 28 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 29 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 30 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 31 */
+};
+
+static void dwxgmac3_handle_mtl_err(struct net_device *ndev,
+				    void __iomem *ioaddr, bool correctable,
+				    struct tc956xmac_safety_stats *stats)
+{
+	u32 value;
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+
+	value = readl(ioaddr + XGMAC_MTL_ECC_INT_STATUS);
+	writel(value, ioaddr + XGMAC_MTL_ECC_INT_STATUS);
+
+	dwxgmac3_log_error(ndev, value, correctable, "MTL",
+			   dwxgmac3_mtl_errors, STAT_OFF(mtl_errors), stats);
+}
+
+static const struct dwxgmac3_error_desc dwxgmac3_dma_errors[32] = {
+	{ true, "TCES", "DMA TSO Memory Error" },
+	{ true, "TAMS", "DMA TSO Memory Address Mismatch Error" },
+	{ true, "TUES", "DMA TSO Memory Error" },
+	{ false, "UNKNOWN", "Unknown Error" }, /* 3 */
+	{ true, "DCES", "DMA DCACHE Memory Error" },
+	{ true, "DAMS", "DMA DCACHE Address Mismatch Error" },
+	{ true, "DUES", "DMA DCACHE Memory Error" },
+	{ false, "UNKNOWN", "Unknown Error" }, /* 7 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 8 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 9 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 10 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 11 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 12 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 13 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 14 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 15 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 16 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 17 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 18 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 19 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 20 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 21 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 22 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 23 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 24 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 25 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 26 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 27 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 28 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 29 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 30 */
+	{ false, "UNKNOWN", "Unknown Error" }, /* 31 */
+};
+
+static void dwxgmac3_handle_dma_err(struct net_device *ndev,
+				    void __iomem *ioaddr, bool correctable,
+				    struct tc956xmac_safety_stats *stats)
+{
+	u32 value;
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+
+	value = readl(ioaddr + XGMAC_DMA_ECC_INT_STATUS);
+	writel(value, ioaddr + XGMAC_DMA_ECC_INT_STATUS);
+
+	dwxgmac3_log_error(ndev, value, correctable, "DMA",
+			   dwxgmac3_dma_errors, STAT_OFF(dma_errors), stats);
+}
+
+static int dwxgmac3_safety_feat_config(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, unsigned int asp)
+{
+	u32 value;
+
+	if (!asp)
+		return -EINVAL;
+
+	/* 1. Enable Safety Features */
+	writel(0x0, ioaddr + XGMAC_MTL_ECC_CONTROL);
+
+	/* 2. Enable MTL Safety Interrupts */
+	value = readl(ioaddr + XGMAC_MTL_ECC_INT_ENABLE);
+	value |= XGMAC_RPCEIE; /* RX Parser Memory Correctable Error */
+	value |= XGMAC_ECEIE; /* EST Memory Correctable Error */
+	value |= XGMAC_RXCEIE; /* RX Memory Correctable Error */
+	value |= XGMAC_TXCEIE; /* TX Memory Correctable Error */
+	writel(value, ioaddr + XGMAC_MTL_ECC_INT_ENABLE);
+
+	/* 3. Enable DMA Safety Interrupts */
+	value = readl(ioaddr + XGMAC_DMA_ECC_INT_ENABLE);
+	value |= XGMAC_DCEIE; /* Descriptor Cache Memory Correctable Error */
+	value |= XGMAC_TCEIE; /* TSO Memory Correctable Error */
+	writel(value, ioaddr + XGMAC_DMA_ECC_INT_ENABLE);
+
+	/* Only ECC Protection for External Memory feature is selected */
+	if (asp <= 0x1)
+		return 0;
+
+	/* 4. Enable Parity and Timeout for FSM */
+	value = readl(ioaddr + XGMAC_MAC_FSM_CONTROL);
+	value |= XGMAC_PRTYEN; /* FSM Parity Feature */
+	value |= XGMAC_TMOUTEN; /* FSM Timeout Feature */
+	writel(value, ioaddr + XGMAC_MAC_FSM_CONTROL);
+
+	return 0;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static int dwxgmac3_safety_feat_irq_status(struct tc956xmac_priv *priv,
+					   struct net_device *ndev,
+					   void __iomem *ioaddr,
+					   unsigned int asp,
+					   struct tc956xmac_safety_stats *stats)
+{
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	bool err, corr;
+	u32 mtl, dma;
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	int ret = 0;
+
+	if (!asp)
+		return -EINVAL;
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+
+	mtl = readl(ioaddr + XGMAC_MTL_SAFETY_INT_STATUS);
+	dma = readl(ioaddr + XGMAC_DMA_SAFETY_INT_STATUS);
+
+	err = (mtl & XGMAC_MCSIS) || (dma & XGMAC_MCSIS);
+	corr = false;
+	if (err) {
+		dwxgmac3_handle_mac_err(ndev, ioaddr, corr, stats);
+		ret |= !corr;
+	}
+
+	err = (mtl & (XGMAC_MEUIS | XGMAC_MECIS)) ||
+	      (dma & (XGMAC_MSUIS | XGMAC_MSCIS));
+	corr = (mtl & XGMAC_MECIS) || (dma & XGMAC_MSCIS);
+	if (err) {
+		dwxgmac3_handle_mtl_err(ndev, ioaddr, corr, stats);
+		ret |= !corr;
+	}
+
+	err = dma & (XGMAC_DEUIS | XGMAC_DECIS);
+	corr = dma & XGMAC_DECIS;
+	if (err) {
+		dwxgmac3_handle_dma_err(ndev, ioaddr, corr, stats);
+		ret |= !corr;
+	}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+	return ret;
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static const struct dwxgmac3_error {
+	const struct dwxgmac3_error_desc *desc;
+} dwxgmac3_all_errors[] = {
+	{ dwxgmac3_mac_errors },
+	{ dwxgmac3_mtl_errors },
+	{ dwxgmac3_dma_errors },
+};
+
+static int dwxgmac3_safety_feat_dump(struct tc956xmac_priv *priv,
+				     struct tc956xmac_safety_stats *stats,
+				     int index, unsigned long *count,
+				     const char **desc)
+{
+	int module = index / 32, offset = index % 32;
+	unsigned long *ptr = (unsigned long *)stats;
+
+	if (module >= ARRAY_SIZE(dwxgmac3_all_errors))
+		return -EINVAL;
+	if (!dwxgmac3_all_errors[module].desc[offset].valid)
+		return -EINVAL;
+	if (count)
+		*count = *(ptr + index);
+	if (desc)
+		*desc = dwxgmac3_all_errors[module].desc[offset].desc;
+	return 0;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+static int dwxgmac3_rxp_disable(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	int limit;
+	u32 val = readl(ioaddr + XGMAC_MTL_OPMODE);
+
+	val &= ~XGMAC_FRPE;
+	writel(val, ioaddr + XGMAC_MTL_OPMODE);
+
+	limit = 10000;
+	while (limit--) {
+		if (!(readl(ioaddr + XGMAC_MTL_RXP_CONTROL_STATUS) & XGMAC_RXPI))
+			break;
+		udelay(1);
+	}
+
+	if (limit < 0)
+		return -EBUSY;
+
+	return 0;
+}
+
+static void dwxgmac3_rxp_enable(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 val;
+
+	val = readl(ioaddr + XGMAC_MTL_OPMODE);
+	val |= XGMAC_FRPE;
+	writel(val, ioaddr + XGMAC_MTL_OPMODE);
+}
+
+static int dwxgmac3_rxp_update_single_entry(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+					    struct tc956xmac_tc_entry *entry,
+					    int pos)
+{
+	int ret, i;
+
+	for (i = 0; i < (sizeof(entry->val) / sizeof(u32)); i++) {
+		int real_pos = pos * (sizeof(entry->val) / sizeof(u32)) + i;
+		u32 val;
+
+		/* Wait for ready */
+		ret = readl_poll_timeout(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST,
+				val, !(val & XGMAC_STARTBUSY), 1, 10000);
+		if (ret)
+			return ret;
+
+		/* Write data */
+		val = *((u32 *)&entry->val + i);
+		writel(val, ioaddr + XGMAC_MTL_RXP_IACC_DATA);
+
+		/* Write pos */
+		val = real_pos & XGMAC_ADDR;
+		writel(val, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+		/* Write OP */
+		val |= XGMAC_WRRDN;
+		writel(val, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+		/* Start Write */
+		val |= XGMAC_STARTBUSY;
+		writel(val, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+		/* Wait for done */
+		ret = readl_poll_timeout(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST,
+				val, !(val & XGMAC_STARTBUSY), 1, 10000);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static struct tc956xmac_tc_entry *
+dwxgmac3_rxp_get_next_entry(struct tc956xmac_tc_entry *entries,
+			    unsigned int count, u32 curr_prio)
+{
+	struct tc956xmac_tc_entry *entry;
+	u32 min_prio = ~0x0;
+	int i, min_prio_idx;
+	bool found = false;
+
+	for (i = count - 1; i >= 0; i--) {
+		entry = &entries[i];
+
+		/* Do not update unused entries */
+		if (!entry->in_use)
+			continue;
+		/* Do not update already updated entries (i.e. fragments) */
+		if (entry->in_hw)
+			continue;
+		/* Let last entry be updated last */
+		if (entry->is_last)
+			continue;
+		/* Do not return fragments */
+		if (entry->is_frag)
+			continue;
+		/* Check if we already checked this prio */
+		if (entry->prio < curr_prio)
+			continue;
+		/* Check if this is the minimum prio */
+		if (entry->prio < min_prio) {
+			min_prio = entry->prio;
+			min_prio_idx = i;
+			found = true;
+		}
+	}
+
+	if (found)
+		return &entries[min_prio_idx];
+	return NULL;
+}
+
+static int dwxgmac2_rx_parser_write_entry(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+		struct tc956xmac_rx_parser_entry *entry, int entry_pos)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	int limit;
+	int i;
+
+	for (i = 0; i < (sizeof(*entry) / sizeof(u32)); i++) {
+		int real_pos = entry_pos * (sizeof(*entry) / sizeof(u32)) + i;
+		u32 value = *((u32 *)entry + i);
+
+		writel(value, ioaddr + XGMAC_MTL_RXP_IACC_DATA);
+
+		value = real_pos & XGMAC_ADDR;
+		writel(value, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+		limit = 10000;
+		while (limit--) {
+			if (!(readl(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST) &
+			      XGMAC_STARTBUSY))
+				break;
+			udelay(1);
+		}
+		if (limit < 0)
+			return -EBUSY;
+		/* Write op */
+		value |= XGMAC_WRRDN;
+		writel(value, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+		/* Start write */
+		value |= XGMAC_STARTBUSY;
+		writel(value, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+		/* Wait for done */
+		limit = 10000;
+		while (limit--) {
+			if (!(readl(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST) &
+			      XGMAC_STARTBUSY))
+				break;
+			udelay(1);
+		}
+		if (limit < 0)
+			return -EBUSY;
+	}
+
+	return 0;
+}
+
+static int dwxgmac2_rx_parser_config(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+				     struct tc956xmac_rx_parser_cfg *cfg)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	int i, ret;
+	u32 value;
+
+	if (cfg->npe <= 0 || cfg->nve <= 0)
+		return -EINVAL;
+	value = readl(ioaddr + XGMAC_MTL_RXP_CONTROL_STATUS);
+	value &= ~(XGMAC_NPE | XGMAC_NVE);
+	value |= (((cfg->npe - 1) << 16) & XGMAC_NPE);
+	value |= (((cfg->nve - 1) << 0) & XGMAC_NVE);
+	writel(value, ioaddr + XGMAC_MTL_RXP_CONTROL_STATUS);
+
+	for (i = 0; i < cfg->nve; i++) {
+		ret = dwxgmac2_rx_parser_write_entry(priv, hw, &cfg->entries[i], i);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int dwxgmac2_rx_parser_init(struct tc956xmac_priv *priv,
+			struct net_device *ndev, struct mac_device_info *hw,
+			unsigned int spram, unsigned int frpsel, unsigned int frpes,
+			struct tc956xmac_rx_parser_cfg *cfg)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value, old_value = readl(ioaddr + XGMAC_RX_CONFIG);
+	int ret, max_entries = frpes;
+
+	if (!cfg || !frpsel)
+		return -EINVAL;
+	if (cfg->nve > max_entries || cfg->npe > max_entries) {
+		netdev_err(ndev, "Invalid RX Parser configuration supplied\n");
+		return -EINVAL;
+	}
+
+	/* Force disable RX */
+	value = old_value & ~XGMAC_CONFIG_RE;
+	writel(value, ioaddr + XGMAC_RX_CONFIG);
+
+	/* Disable RX Parser */
+	ret = dwxgmac3_rxp_disable(priv, ioaddr);
+	if (ret) {
+		netdev_err(ndev, "Failed to disable RX Parser\n");
+		return ret;
+	}
+
+	/* Nothing to do if we don't want to enable RX Parser */
+	if (cfg->nve <= 0 || cfg->npe <= 0) {
+		/* Restore RX to previous state */
+		writel(old_value, ioaddr + XGMAC_RX_CONFIG);
+		return -EINVAL;
+	}
+
+	/* Store table */
+	ret = dwxgmac2_rx_parser_config(priv, hw, cfg);
+	if (ret) {
+		netdev_err(ndev, "Failed to configure RX Parser\n");
+		return ret;
+	}
+
+	/* Enable RX Parser */
+	dwxgmac3_rxp_enable(priv, ioaddr);
+
+	/* Restore RX to previous state */
+	writel(old_value, ioaddr + XGMAC_RX_CONFIG);
+
+	netdev_info(ndev, "Enabling RX Parser\n");
+	return 0;
+}
+static int dwxgmac3_rxp_config(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+			       struct tc956xmac_tc_entry *entries,
+			       unsigned int count)
+{
+	struct tc956xmac_tc_entry *entry, *frag;
+	int i, ret, nve = 0;
+	u32 curr_prio = 0;
+	u32 old_val, val;
+
+	/* Force disable RX */
+	old_val = readl(ioaddr + XGMAC_RX_CONFIG);
+	val = old_val & ~XGMAC_CONFIG_RE;
+	writel(val, ioaddr + XGMAC_RX_CONFIG);
+
+	/* Disable RX Parser */
+	ret = dwxgmac3_rxp_disable(priv, ioaddr);
+	if (ret)
+		goto re_enable;
+
+	/* Set all entries as NOT in HW */
+	for (i = 0; i < count; i++) {
+		entry = &entries[i];
+		entry->in_hw = false;
+	}
+
+	/* Update entries by reverse order */
+	while (1) {
+		entry = dwxgmac3_rxp_get_next_entry(entries, count, curr_prio);
+		if (!entry)
+			break;
+
+		curr_prio = entry->prio;
+		frag = entry->frag_ptr;
+
+		/* Set special fragment requirements */
+		if (frag) {
+			entry->val.af = 0;
+			entry->val.rf = 0;
+			entry->val.nc = 1;
+			entry->val.ok_index = nve + 2;
+		}
+
+		ret = dwxgmac3_rxp_update_single_entry(priv, ioaddr, entry, nve);
+		if (ret)
+			goto re_enable;
+
+		entry->table_pos = nve++;
+		entry->in_hw = true;
+
+		if (frag && !frag->in_hw) {
+			ret = dwxgmac3_rxp_update_single_entry(priv, ioaddr, frag, nve);
+			if (ret)
+				goto re_enable;
+			frag->table_pos = nve++;
+			frag->in_hw = true;
+		}
+	}
+
+	if (!nve)
+		goto re_enable;
+
+	/* Update all pass entry */
+	for (i = 0; i < count; i++) {
+		entry = &entries[i];
+		if (!entry->is_last)
+			continue;
+
+		ret = dwxgmac3_rxp_update_single_entry(priv, ioaddr, entry, nve);
+		if (ret)
+			goto re_enable;
+
+		entry->table_pos = nve++;
+	}
+
+	/* Assume n. of parsable entries == n. of valid entries */
+	val = (nve << 16) & XGMAC_NPE;
+	val |= nve & XGMAC_NVE;
+	writel(val, ioaddr + XGMAC_MTL_RXP_CONTROL_STATUS);
+
+	/* Enable RX Parser */
+	dwxgmac3_rxp_enable(priv, ioaddr);
+
+re_enable:
+	/* Re-enable RX */
+	writel(old_val, ioaddr + XGMAC_RX_CONFIG);
+	return ret;
+}
+
+static int dwxgmac2_get_mac_tx_timestamp(struct tc956xmac_priv *priv,
+					struct mac_device_info *hw, u64 *ts)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	if (readl_poll_timeout_atomic(ioaddr + XGMAC_TIMESTAMP_STATUS,
+				      value, value & XGMAC_TXTSC, 100, 10000))
+		return -EBUSY;
+
+	*ts = readl(ioaddr + XGMAC_TXTIMESTAMP_NSEC) & XGMAC_TXTSSTSLO;
+	*ts += readl(ioaddr + XGMAC_TXTIMESTAMP_SEC) * 1000000000ULL;
+	return 0;
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static int dwxgmac2_flex_pps_config(struct tc956xmac_priv *priv,
+				    void __iomem *ioaddr, int index,
+				    struct tc956xmac_pps_cfg *cfg, bool enable,
+				    u32 sub_second_inc, u32 systime_flags)
+{
+	u32 tnsec = readl(ioaddr + XGMAC_PPSx_TARGET_TIME_NSEC(index));
+	u32 val = readl(ioaddr + XGMAC_PPS_CONTROL);
+	u64 period;
+
+	if (!cfg->available)
+		return -EINVAL;
+	if (tnsec & XGMAC_TRGTBUSY0)
+		return -EBUSY;
+	if (!sub_second_inc || !systime_flags)
+		return -EINVAL;
+
+	val &= ~XGMAC_PPSx_MASK(index);
+
+	if (!enable) {
+		val |= XGMAC_PPSCMDx(index, XGMAC_PPSCMD_STOP);
+		writel(val, ioaddr + XGMAC_PPS_CONTROL);
+		return 0;
+	}
+
+	val |= XGMAC_PPSCMDx(index, XGMAC_PPSCMD_START);
+	val |= XGMAC_TRGTMODSELx(index, XGMAC_PPSCMD_START);
+	val |= XGMAC_PPSEN0;
+
+	writel(cfg->start.tv_sec, ioaddr + XGMAC_PPSx_TARGET_TIME_SEC(index));
+
+	if (!(systime_flags & PTP_TCR_TSCTRLSSR))
+		cfg->start.tv_nsec = (cfg->start.tv_nsec * 1000) / 465;
+	writel(cfg->start.tv_nsec, ioaddr + XGMAC_PPSx_TARGET_TIME_NSEC(index));
+
+	period = cfg->period.tv_sec * 1000000000;
+	period += cfg->period.tv_nsec;
+
+	do_div(period, sub_second_inc);
+
+	if (period <= 1)
+		return -EINVAL;
+
+	writel(period - 1, ioaddr + XGMAC_PPSx_INTERVAL(index));
+
+	period >>= 1;
+	if (period <= 1)
+		return -EINVAL;
+
+	writel(period - 1, ioaddr + XGMAC_PPSx_WIDTH(index));
+
+	/* Finally, activate it */
+	writel(val, ioaddr + XGMAC_PPS_CONTROL);
+	return 0;
+}
+
+static void dwxgmac2_sarc_configure(struct tc956xmac_priv *priv, void __iomem *ioaddr, int val)
+{
+	u32 value = readl(ioaddr + XGMAC_TX_CONFIG);
+
+	value &= ~XGMAC_CONFIG_SARC;
+	value |= val << XGMAC_CONFIG_SARC_SHIFT;
+
+	writel(value, ioaddr + XGMAC_TX_CONFIG);
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static void dwxgmac2_enable_vlan(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw, u32 type)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_VLAN_INCL);
+	value |= XGMAC_VLAN_VLTI;
+	value &= ~XGMAC_VLAN_CSVL; /* Only use CVLAN */
+	if (priv->dev->features & NETIF_F_HW_VLAN_STAG_TX)
+		value |= XGMAC_VLAN_CSVL; /* Only use SVLAN */
+	value &= ~XGMAC_VLAN_VLC;
+	value |= (type << XGMAC_VLAN_VLC_SHIFT) & XGMAC_VLAN_VLC;
+	writel(value, ioaddr + XGMAC_VLAN_INCL);
+}
+#ifdef TC956X
+static void dwxgmac2_disable_tx_vlan(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_VLAN_INCL);
+	value &= ~XGMAC_VLAN_VLTI;
+	value &= ~XGMAC_VLAN_VLC;
+	writel(value, ioaddr + XGMAC_VLAN_INCL);
+}
+
+static void dwxgmac2_enable_rx_vlan_stripping(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_VLAN_TAG_CTRL);
+	/* Put the VLAN tag in the Rx descriptor */
+	value |= XGMAC_VLAN_EVLRXS;
+
+	/* Don't check the VLAN type */
+	value |= XGMAC_VLAN_DOVLTC;
+
+	/* Check only C-TAG (0x8100) packets */
+	value &= ~XGMAC_VLAN_ERSVLM;
+
+	/* Don't consider an S-TAG (0x88A8) packet as a VLAN packet */
+	value &= ~XGMAC_VLAN_ESVL;
+
+	/* Enable VLAN tag stripping */
+	value |= XGMAC_VLAN_EVLS;
+	writel(value, ioaddr + XGMAC_VLAN_TAG_CTRL);
+}
+
+static void dwxgmac2_disable_rx_vlan_stripping(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_VLAN_TAG_CTRL);
+	/* Disable VLAN tag stripping */
+	value &= ~XGMAC_VLAN_EVLS;
+	writel(value, ioaddr + XGMAC_VLAN_TAG_CTRL);
+}
+
+static void dwxgmac2_enable_rx_vlan_filtering(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_PACKET_FILTER);
+	/* Enable VLAN filtering */
+	value |= XGMAC_FILTER_VTFE;
+	writel(value, ioaddr + XGMAC_PACKET_FILTER);
+
+	writel(value, ioaddr + XGMAC_VLAN_TAG_CTRL);
+}
+
+static void dwxgmac2_disable_rx_vlan_filtering(struct tc956xmac_priv *priv,
+				struct mac_device_info *hw)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_PACKET_FILTER);
+	/* Enable VLAN filtering */
+	value &= ~XGMAC_FILTER_VTFE;
+	writel(value, ioaddr + XGMAC_PACKET_FILTER);
+}
+#endif
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static int dwxgmac2_filter_wait(struct tc956xmac_priv *priv, struct mac_device_info *hw)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	if (readl_poll_timeout(ioaddr + XGMAC_L3L4_ADDR_CTRL, value,
+			       !(value & XGMAC_XB), 100, 10000))
+		return -EBUSY;
+	return 0;
+}
+
+static int dwxgmac2_filter_read(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+				u32 filter_no, u8 reg, u32 *data)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+	int ret;
+
+	ret = dwxgmac2_filter_wait(priv, hw);
+	if (ret)
+		return ret;
+
+	value = readl(ioaddr + XGMAC_L3L4_ADDR_CTRL);
+	value &= ~XGMAC_IDDR;
+	value |= (((filter_no << XGMAC_IDDR_FNUM) | reg) << XGMAC_IDDR_SHIFT) & XGMAC_IDDR;
+	value |= XGMAC_TT | XGMAC_XB;
+	writel(value, ioaddr + XGMAC_L3L4_ADDR_CTRL);
+
+	ret = dwxgmac2_filter_wait(priv, hw);
+	if (ret)
+		return ret;
+
+	*data = readl(ioaddr + XGMAC_L3L4_DATA);
+	return 0;
+}
+
+static int dwxgmac2_filter_write(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 filter_no,
+				 u8 reg, u32 data)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+	int ret;
+
+	ret = dwxgmac2_filter_wait(priv, hw);
+	if (ret)
+		return ret;
+
+	writel(data, ioaddr + XGMAC_L3L4_DATA);
+
+	value = readl(ioaddr + XGMAC_L3L4_ADDR_CTRL);
+	value &= ~(XGMAC_TT | XGMAC_IDDR);
+	value |= (((filter_no << XGMAC_IDDR_FNUM) | reg) << XGMAC_IDDR_SHIFT) & XGMAC_IDDR;
+	value |= XGMAC_XB;
+	writel(value, ioaddr + XGMAC_L3L4_ADDR_CTRL);
+
+	return dwxgmac2_filter_wait(priv, hw);
+}
+
+static int dwxgmac2_config_l3_filter(struct tc956xmac_priv *priv,
+				     struct mac_device_info *hw, u32 filter_no,
+				     bool en, bool ipv6, bool sa, bool inv,
+				     u32 match)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+	int ret;
+
+	value = readl(ioaddr + XGMAC_PACKET_FILTER);
+	value |= XGMAC_FILTER_IPFE;
+	writel(value, ioaddr + XGMAC_PACKET_FILTER);
+
+	ret = dwxgmac2_filter_read(priv, hw, filter_no, XGMAC_L3L4_CTRL, &value);
+	if (ret)
+		return ret;
+
+	/* For IPv6 not both SA/DA filters can be active */
+	if (ipv6) {
+		value |= XGMAC_L3PEN0;
+		value &= ~(XGMAC_L3SAM0 | XGMAC_L3SAIM0);
+		value &= ~(XGMAC_L3DAM0 | XGMAC_L3DAIM0);
+		if (sa) {
+			value |= XGMAC_L3SAM0;
+			if (inv)
+				value |= XGMAC_L3SAIM0;
+		} else {
+			value |= XGMAC_L3DAM0;
+			if (inv)
+				value |= XGMAC_L3DAIM0;
+		}
+	} else {
+		value &= ~XGMAC_L3PEN0;
+		if (sa) {
+			value |= XGMAC_L3SAM0;
+			if (inv)
+				value |= XGMAC_L3SAIM0;
+		} else {
+			value |= XGMAC_L3DAM0;
+			if (inv)
+				value |= XGMAC_L3DAIM0;
+		}
+	}
+
+	ret = dwxgmac2_filter_write(priv, hw, filter_no, XGMAC_L3L4_CTRL, value);
+	if (ret)
+		return ret;
+
+	if (sa) {
+		ret = dwxgmac2_filter_write(priv, hw, filter_no, XGMAC_L3_ADDR0, match);
+		if (ret)
+			return ret;
+	} else {
+		ret = dwxgmac2_filter_write(priv, hw, filter_no, XGMAC_L3_ADDR1, match);
+		if (ret)
+			return ret;
+	}
+
+	if (!en)
+		return dwxgmac2_filter_write(priv, hw, filter_no, XGMAC_L3L4_CTRL, 0);
+
+	return 0;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+static void dwxgmac2_debug(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+			 struct tc956xmac_extra_stats *x,
+			 u32 rx_queues, u32 tx_queues)
+{
+	u32 value;
+	u32 queue;
+
+	for (queue = 0; queue < tx_queues; queue++) {
+#ifdef TC956X_SRIOV_VF
+		if (priv->plat->tx_q_in_use[queue] == 0)
+			continue;
+#endif
+		value = readl(ioaddr + XGMAC_MTL_TXQ_Debug(queue));
+
+		if (value & XGMAC_MTL_DEBUG_TXQSTS)
+			x->mtl_tx_fifo_not_empty[queue]++;
+		if (value & XGMAC_MTL_DEBUG_TWCSTS)
+			x->mmtl_fifo_ctrl[queue]++;
+		if (value & XGMAC_MTL_DEBUG_TRCSTS_MASK) {
+			u32 trcsts = (value & XGMAC_MTL_DEBUG_TRCSTS_MASK)
+				     >> XGMAC_MTL_DEBUG_TRCSTS_SHIFT;
+			if (trcsts == XGMAC_MTL_DEBUG_TRCSTS_WRITE)
+				x->mtl_tx_fifo_read_ctrl_write[queue]++;
+			else if (trcsts == XGMAC_MTL_DEBUG_TRCSTS_TXW)
+				x->mtl_tx_fifo_read_ctrl_wait[queue]++;
+			else if (trcsts == XGMAC_MTL_DEBUG_TRCSTS_READ)
+				x->mtl_tx_fifo_read_ctrl_read[queue]++;
+			else
+				x->mtl_tx_fifo_read_ctrl_idle[queue]++;
+		}
+		if (value & XGMAC_MTL_DEBUG_TCPAUSED)
+			x->mac_tx_in_pause[queue]++;
+	}
+
+	for (queue = 0; queue < rx_queues; queue++) {
+#ifdef TC956X_SRIOV_VF
+		if (priv->plat->rx_q_in_use[queue] == 0)
+			continue;
+#endif
+		value = readl(ioaddr + XGMAC_MTL_RXQ_Debug(queue));
+
+		if (value & XGMAC_MTL_DEBUG_RXQSTS_MASK) {
+			u32 rxfsts = (value & XGMAC_MTL_DEBUG_RXQSTS_MASK)
+				     >> XGMAC_MTL_DEBUG_RXQSTS_SHIFT;
+
+			if (rxfsts == XGMAC_MTL_DEBUG_RXQSTS_FULL)
+				x->mtl_rx_fifo_fill_level_full[queue]++;
+			else if (rxfsts == XGMAC_MTL_DEBUG_RXQSTS_AT)
+				x->mtl_rx_fifo_fill_above_thresh[queue]++;
+			else if (rxfsts == XGMAC_MTL_DEBUG_RXQSTS_BT)
+				x->mtl_rx_fifo_fill_below_thresh[queue]++;
+			else
+				x->mtl_rx_fifo_fill_level_empty[queue]++;
+		}
+		if (value & XGMAC_MTL_DEBUG_RRCSTS_MASK) {
+			u32 rrcsts = (value & XGMAC_MTL_DEBUG_RRCSTS_MASK) >>
+				     XGMAC_MTL_DEBUG_RRCSTS_SHIFT;
+
+			if (rrcsts == XGMAC_MTL_DEBUG_RRCSTS_FLUSH)
+				x->mtl_rx_fifo_read_ctrl_flush[queue]++;
+			else if (rrcsts == XGMAC_MTL_DEBUG_RRCSTS_RSTAT)
+				x->mtl_rx_fifo_read_ctrl_read[queue]++;
+			else if (rrcsts == XGMAC_MTL_DEBUG_RRCSTS_RDATA)
+				x->mtl_rx_fifo_read_ctrl_status[queue]++;
+			else
+				x->mtl_rx_fifo_read_ctrl_idle[queue]++;
+		}
+		if (value & XGMAC_MTL_DEBUG_RWCSTS)
+			x->mtl_rx_fifo_ctrl_active[queue]++;
+	}
+
+	/* GMAC debug */
+	value = readl(ioaddr + XGMAC_DEBUG);
+
+	if (value & XGMAC_DEBUG_TFCSTS_MASK) {
+		u32 tfcsts = (value & XGMAC_DEBUG_TFCSTS_MASK)
+			      >> XGMAC_DEBUG_TFCSTS_SHIFT;
+
+		if (tfcsts == XGMAC_DEBUG_TFCSTS_XFER)
+			x->mac_tx_frame_ctrl_xfer++;
+		else if (tfcsts == XGMAC_DEBUG_TFCSTS_GEN_PAUSE)
+			x->mac_tx_frame_ctrl_pause++;
+		else if (tfcsts == XGMAC_DEBUG_TFCSTS_WAIT)
+			x->mac_tx_frame_ctrl_wait++;
+		else
+			x->mac_tx_frame_ctrl_idle++;
+	}
+	if (value & XGMAC_DEBUG_TPESTS)
+		x->mac_gmii_tx_proto_engine++;
+	if (value & XGMAC_DEBUG_RFCFCSTS_MASK)
+		x->mac_rx_frame_ctrl_fifo = (value & XGMAC_DEBUG_RFCFCSTS_MASK);
+	if (value & XGMAC_DEBUG_RPESTS)
+		x->mac_gmii_rx_proto_engine++;
+
+}
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static int dwxgmac2_config_l4_filter(struct tc956xmac_priv *priv,
+				     struct mac_device_info *hw, u32 filter_no,
+				     bool en, bool udp, bool sa, bool inv,
+				     u32 match)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+	int ret;
+
+	value = readl(ioaddr + XGMAC_PACKET_FILTER);
+	value |= XGMAC_FILTER_IPFE;
+	writel(value, ioaddr + XGMAC_PACKET_FILTER);
+
+	ret = dwxgmac2_filter_read(priv, hw, filter_no, XGMAC_L3L4_CTRL, &value);
+	if (ret)
+		return ret;
+
+	if (udp)
+		value |= XGMAC_L4PEN0;
+	else
+		value &= ~XGMAC_L4PEN0;
+
+	value &= ~(XGMAC_L4SPM0 | XGMAC_L4SPIM0);
+	value &= ~(XGMAC_L4DPM0 | XGMAC_L4DPIM0);
+	if (sa) {
+		value |= XGMAC_L4SPM0;
+		if (inv)
+			value |= XGMAC_L4SPIM0;
+	} else {
+		value |= XGMAC_L4DPM0;
+		if (inv)
+			value |= XGMAC_L4DPIM0;
+	}
+
+	ret = dwxgmac2_filter_write(priv, hw, filter_no, XGMAC_L3L4_CTRL, value);
+	if (ret)
+		return ret;
+
+	if (sa) {
+		value = match & XGMAC_L4SP0;
+
+		ret = dwxgmac2_filter_write(priv, hw, filter_no, XGMAC_L4_ADDR, value);
+		if (ret)
+			return ret;
+	} else {
+		value = (match << XGMAC_L4DP0_SHIFT) & XGMAC_L4DP0;
+
+		ret = dwxgmac2_filter_write(priv, hw, filter_no, XGMAC_L4_ADDR, value);
+		if (ret)
+			return ret;
+	}
+
+	if (!en)
+		return dwxgmac2_filter_write(priv, hw, filter_no, XGMAC_L3L4_CTRL, 0);
+
+	return 0;
+}
+
+static void dwxgmac2_set_arp_offload(struct tc956xmac_priv *priv,
+				     struct mac_device_info *hw, bool en, u32 addr)
+{
+	void __iomem *ioaddr = hw->pcsr;
+	u32 value;
+
+	writel(addr, ioaddr + XGMAC_ARP_ADDR);
+
+	value = readl(ioaddr + XGMAC_RX_CONFIG);
+	if (en)
+		value |= XGMAC_CONFIG_ARPEN;
+	else
+		value &= ~XGMAC_CONFIG_ARPEN;
+	writel(value, ioaddr + XGMAC_RX_CONFIG);
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+#ifdef DEBUG_TSN
+static int dwxgmac3_est_read(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 reg, u32 *val, bool gcl)
+{
+	u32 ctrl = 0x0;
+
+#ifdef GCL_PRINT
+	static unsigned int count;
+
+	if (count % 8000 == 0) {
+		if (readl(ioaddr + XGMAC_MTL_EST_STATUS) & XGMAC_SWOL)
+			pr_info("GCL0:hw\n");
+		else
+			pr_info("GCL1:hw\n");
+	}
+	count++;
+#endif
+
+	if (readl(ioaddr + XGMAC_MTL_EST_STATUS) & XGMAC_SWOL)
+		ctrl &= (~(1 << 5));    /* Forcing to read bank 0 */
+	else
+		ctrl |= (1 << 5);	/* Forcing to read bank 1  */
+
+
+	ctrl |= XGMAC_DBGM;	/* Debug mode enable   */
+	ctrl |= reg;
+	ctrl |= gcl ? 0x0 : XGMAC_GCRR;
+	ctrl |= XGMAC_R1W0;
+
+	ctrl |= XGMAC_SRWO;
+	writel(ctrl, ioaddr + XGMAC_MTL_EST_GCL_CONTROL);
+
+	if (readl_poll_timeout_atomic(ioaddr + XGMAC_MTL_EST_GCL_CONTROL,
+				      ctrl, !(ctrl & XGMAC_SRWO), 100, 5000))
+		return -ETIMEDOUT;
+
+	*val = readl(ioaddr + XGMAC_MTL_EST_GCL_DATA);
+	return 0;
+}
+#endif
+
+static int dwxgmac3_est_write(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 reg, u32 val, bool gcl)
+{
+	u32 ctrl;
+
+	writel(val, ioaddr + XGMAC_MTL_EST_GCL_DATA);
+
+	ctrl = (reg << XGMAC_ADDR_SHIFT);
+	ctrl |= gcl ? 0 : XGMAC_GCRR;
+
+	writel(ctrl, ioaddr + XGMAC_MTL_EST_GCL_CONTROL);
+
+	ctrl |= XGMAC_SRWO;
+	writel(ctrl, ioaddr + XGMAC_MTL_EST_GCL_CONTROL);
+
+	return readl_poll_timeout_atomic(ioaddr + XGMAC_MTL_EST_GCL_CONTROL,
+					 ctrl, !(ctrl & XGMAC_SRWO), 100, 5000);
+}
+
+static int dwxgmac3_est_configure(struct tc956xmac_priv *priv,
+				  void __iomem *ioaddr, struct tc956xmac_est *cfg,
+				  unsigned int ptp_rate)
+{
+	int i, ret = 0x0;
+	u32 ctrl, reg_data;
+
+#if defined(TX_LOGGING_TRACE)
+	int j;
+	u64 read_btr = 0, read_ctr = 0;
+	static u32 switch_cnt;
+	char *qptr = NULL, *pptr = NULL;
+	int char_buff_size = 100*100;
+
+	pptr = (char *)kzalloc(100*100, GFP_KERNEL);
+	if (!pptr) {
+		pr_err("Malloc pptr Error\n");
+		return -ENOMEM;
+	}
+	qptr = (char *)kzalloc(100*100, GFP_KERNEL);
+	if (!qptr) {
+		pr_err("Malloc qptr Error\n");
+		kfree(pptr);
+		return -ENOMEM;
+	}
+#endif
+
+	if (!cfg->enable) {
+		/* Disable EST */
+		ctrl = readl(ioaddr + XGMAC_MTL_EST_CONTROL);
+		ctrl &= ~XGMAC_EEST;
+		writel(ctrl, ioaddr + XGMAC_MTL_EST_CONTROL);
+		return 0;
+	}
+
+	ret |= dwxgmac3_est_write(priv, ioaddr, XGMAC_BTR_LOW, cfg->btr[0], false);
+	ret |= dwxgmac3_est_write(priv, ioaddr, XGMAC_BTR_HIGH, cfg->btr[1], false);
+	ret |= dwxgmac3_est_write(priv, ioaddr, XGMAC_TER, cfg->ter, false);
+	ret |= dwxgmac3_est_write(priv, ioaddr, XGMAC_LLR, cfg->gcl_size, false);
+	ret |= dwxgmac3_est_write(priv, ioaddr, XGMAC_CTR_LOW, cfg->ctr[0], false);
+	ret |= dwxgmac3_est_write(priv, ioaddr, XGMAC_CTR_HIGH, cfg->ctr[1], false);
+	if (ret)
+		return ret;
+
+	netdev_dbg(priv->dev, "%s: EST BTR Low = 0x%x", __func__, cfg->btr[0]);
+	netdev_dbg(priv->dev, "%s: EST BTR High = 0x%x", __func__, cfg->btr[1]);
+	netdev_dbg(priv->dev, "%s: EST TER = 0x%x", __func__, cfg->ter);
+	netdev_dbg(priv->dev, "%s: EST LLR = 0x%x", __func__, cfg->gcl_size);
+	netdev_dbg(priv->dev, "%s: EST CTR Low = 0x%x", __func__, cfg->ctr[0]);
+	netdev_dbg(priv->dev, "%s: EST CTR High = 0x%x", __func__, cfg->ctr[1]);
+
+	for (i = 0; i < cfg->gcl_size; i++) {
+		ret = dwxgmac3_est_write(priv, ioaddr, i, cfg->gcl[i], true);
+		if (ret)
+			return ret;
+		netdev_dbg(priv->dev, "%s: EST GCL[%d] = 0x%x", __func__, i, cfg->gcl[i]);
+	}
+
+#if defined(TX_LOGGING_TRACE) /* Log the actual time of BTR to be used for comparision */
+	{
+		read_btr = ((u64)cfg->btr[1] * 1000000000ULL) + cfg->btr[0];
+		read_ctr = ((u64)((cfg->ctr[1] & 0xff) * 1000000000ULL)) + cfg->ctr[0];
+
+		if (read_btr != 0) {
+			/* [EST]TS,<BTR Value>,<CTR Value>,<IPG of class A>,<IPG of class B> */
+			trace_printk("[EST[%d]]TS,%llu,%llu,%d,%d\n",
+					switch_cnt, read_btr, read_ctr,
+						PACKET_IPG, PACKET_CDT_IPG);
+			for (i = 0; i < cfg->gcl_size; i++) {
+				scnprintf((pptr+(i*11)), char_buff_size - (i*11), ",%010d", (cfg->gcl[i]&0xffffff));
+				for (j = 0; j < MTL_MAX_TX_TC; j++) {
+					scnprintf((qptr+(i*5*2)+(j*2)), char_buff_size - (i*5*2) + (j*2), ",%d",
+						((cfg->gcl[i]>>(24+j))&0x1));
+				}
+			}
+			trace_printk("[GCL_TI[%d]]TS%s\n", switch_cnt, pptr);
+			trace_printk("[GCL_ROW[%d]]TS%s\n", switch_cnt, qptr);
+		}
+		switch_cnt++;
+	}
+#endif
+
+
+	if (readl(ioaddr + XGMAC_MTL_EST_STATUS) & XGMAC_SWOL)
+		pr_alert("GCL 1 is used by Software\n");
+	else
+		pr_alert("GCL 0 is used by Software\n");
+
+
+
+	ctrl = readl(ioaddr + XGMAC_MTL_EST_CONTROL);
+	ctrl &= ~XGMAC_PTOV;
+	ctrl |= ((1000000000 / ptp_rate) * 9) << XGMAC_PTOV_SHIFT;
+	ctrl |= XGMAC_EEST | XGMAC_SSWL;
+
+	writel(ctrl, ioaddr + XGMAC_MTL_EST_CONTROL);
+
+	/* Use Normal/Absolute mode for Launch Time */
+	reg_data = readl(ioaddr + XGMAC_MTL_TBS_CTRL);
+	writel(reg_data & (~XGMAC_ESTM),  ioaddr + XGMAC_MTL_TBS_CTRL);
+
+
+	reg_data = readl(ioaddr + XGMAC_MTL_TBS_CTRL);
+	reg_data &= ~XGMAC_LEOS;
+
+	if ((readl(ioaddr + XGMAC_MTL_TBS_CTRL)) & XGMAC_ESTM)
+		/* Launch expiry offset (~124us) in units of 256ns, Launch Expiry Offset Valid bit */
+		reg_data |=  (EST_LEOS << XGMAC_LEOS_SHIFT);
+	else
+		/* Launch expiry offset (~50ms) in units of 256ns, Launch Expiry Offset Valid bit */
+		reg_data |=  (ABSOLUTE_LEOS << XGMAC_LEOS_SHIFT);
+
+	writel(reg_data, ioaddr + XGMAC_MTL_TBS_CTRL);
+
+
+#if defined(TX_LOGGING_TRACE)
+	kfree(qptr);
+	kfree(pptr);
+#endif
+	return 0;
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static void dwxgmac3_fpe_configure(struct tc956xmac_priv *priv,
+				   void __iomem *ioaddr, u32 num_txq,
+				   u32 num_rxq, bool enable)
+{
+	u32 value;
+
+	if (!enable) {
+		value = readl(ioaddr + XGMAC_FPE_CTRL_STS);
+
+		value &= ~XGMAC_EFPE;
+
+		writel(value, ioaddr + XGMAC_FPE_CTRL_STS);
+		return;
+	}
+
+	value = readl(ioaddr + XGMAC_RXQ_CTRL1);
+	value &= ~XGMAC_RQ;
+	value |= ((num_rxq - 1) << XGMAC_RQ_SHIFT) & XGMAC_RQ;
+	writel(value, ioaddr + XGMAC_RXQ_CTRL1);
+
+	value = readl(ioaddr + XGMAC_FPE_CTRL_STS);
+	value |= XGMAC_EFPE;
+	writel(value, ioaddr + XGMAC_FPE_CTRL_STS);
+}
+
+static void dwxgmac3_set_ptp_offload(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, bool en)
+{
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_PTO_CTRL);
+	if (en)
+		value |= XGMAC_PTOEN | XGMAC_APDREQEN | XGMAC_ASYNCEN;
+	else
+		value &= ~XGMAC_PTOEN;
+	writel(value, ioaddr + XGMAC_PTO_CTRL);
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+/**
+ * tc956x_enable_jumbo_frm - Enable jumbo frame support for Tx and Rx in EMAC.
+ *
+ * @dev: pointer to net_device structure
+ * @en: Enable/Disable
+ */
+static void tc956x_enable_jumbo_frm(struct tc956xmac_priv *priv,
+					struct net_device *dev, u32 en)
+{
+	u32 value_tx = readl(priv->ioaddr + XGMAC_TX_CONFIG);
+	u32 value_rx = readl(priv->ioaddr + XGMAC_RX_CONFIG);
+
+	if (en) {
+
+		value_tx |= XGMAC_CONFIG_JD;
+		netdev_dbg(priv->dev, "%s: Jumbo frame enabled with size = %d",
+			__func__, dev->mtu);
+	} else {
+
+		value_tx &= ~XGMAC_CONFIG_JD;
+		value_rx &= ~XGMAC_CONFIG_JE;
+
+		netdev_dbg(priv->dev, "%s: Jumbo frame disabled with size = %d",
+			__func__, dev->mtu);
+	}
+
+	writel(value_tx, priv->ioaddr + XGMAC_TX_CONFIG);
+	writel(value_rx, priv->ioaddr + XGMAC_RX_CONFIG);
+
+}
+
+const struct tc956xmac_ops dwxgmac210_ops = {
+	.core_init = dwxgmac2_core_init,
+	.set_mac = dwxgmac2_set_mac,
+	.set_mac_tx = dwxgmac2_set_mac_tx,
+	.set_mac_rx = dwxgmac2_set_mac_rx,
+	.rx_ipc = dwxgmac2_rx_ipc,
+	.rx_queue_enable = dwxgmac2_rx_queue_enable,
+	.rx_queue_prio = dwxgmac2_rx_queue_prio,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.tx_queue_prio = dwxgmac2_tx_queue_prio,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.rx_queue_routing = tc956x_rx_queue_routing,
+	.prog_mtl_rx_algorithms = dwxgmac2_prog_mtl_rx_algorithms,
+	.prog_mtl_tx_algorithms = dwxgmac2_prog_mtl_tx_algorithms,
+	.set_mtl_tx_queue_weight = dwxgmac2_set_mtl_tx_queue_weight,
+	.map_mtl_to_dma = dwxgmac2_map_mtl_to_dma,
+	.config_cbs = dwxgmac2_config_cbs,
+	.dump_regs = dwxgmac2_dump_regs,
+	.host_irq_status = dwxgmac2_host_irq_status,
+	.host_mtl_irq_status = dwxgmac2_host_mtl_irq_status,
+	.flow_ctrl = dwxgmac2_flow_ctrl,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.pmt = dwxgmac2_pmt,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.set_umac_addr = dwxgmac2_set_umac_addr,
+	.get_umac_addr = dwxgmac2_get_umac_addr,
+	.set_eee_mode = dwxgmac2_set_eee_mode,
+	.reset_eee_mode = dwxgmac2_reset_eee_mode,
+	.set_eee_timer = dwxgmac2_set_eee_timer,
+	.set_eee_pls = dwxgmac2_set_eee_pls,
+	.pcs_ctrl_ane = NULL,
+	.pcs_rane = NULL,
+	.pcs_get_adv_lp = NULL,
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+	.xpcs_init = tc956x_xpcs_init,
+	.xpcs_ctrl_ane = tc956x_xpcs_ctrl_ane,
+#endif
+#endif
+	.debug = dwxgmac2_debug,
+	.set_filter = dwxgmac2_set_filter,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.safety_feat_config = dwxgmac3_safety_feat_config,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.safety_feat_irq_status = dwxgmac3_safety_feat_irq_status,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.safety_feat_dump = dwxgmac3_safety_feat_dump,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.set_mac_loopback = dwxgmac2_set_mac_loopback,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.rss_configure = dwxgmac2_rss_configure,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.update_vlan_hash = dwxgmac2_update_vlan_hash,
+	.delete_vlan = tc956x_del_sw_vlan_table,
+	.rx_parser_init = dwxgmac2_rx_parser_init,
+	.rxp_config = dwxgmac3_rxp_config,
+	.get_mac_tx_timestamp = dwxgmac2_get_mac_tx_timestamp,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.flex_pps_config = dwxgmac2_flex_pps_config,
+	.sarc_configure = dwxgmac2_sarc_configure,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.enable_vlan = dwxgmac2_enable_vlan,
+#ifdef TC956X
+	.disable_tx_vlan = dwxgmac2_disable_tx_vlan,
+	.enable_rx_vlan_stripping = dwxgmac2_enable_rx_vlan_stripping,
+	.disable_rx_vlan_stripping = dwxgmac2_disable_rx_vlan_stripping,
+	.enable_rx_vlan_filtering = dwxgmac2_enable_rx_vlan_filtering,
+	.disable_rx_vlan_filtering = dwxgmac2_disable_rx_vlan_filtering,
+#endif
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.config_l3_filter = dwxgmac2_config_l3_filter,
+	.config_l4_filter = dwxgmac2_config_l4_filter,
+	.set_arp_offload = dwxgmac2_set_arp_offload,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.est_configure = dwxgmac3_est_configure,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.fpe_configure = dwxgmac3_fpe_configure,
+	.set_ptp_offload = dwxgmac3_set_ptp_offload,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.jumbo_en = tc956x_enable_jumbo_frm,
+};
+
+int dwxgmac2_setup(struct tc956xmac_priv *priv)
+{
+	struct mac_device_info *mac = priv->hw;
+
+	dev_info(priv->device, "\tXGMAC2\n");
+
+	priv->dev->priv_flags |= IFF_UNICAST_FLT;
+	mac->pcsr = priv->ioaddr;
+	mac->multicast_filter_bins = priv->plat->multicast_filter_bins;
+	mac->unicast_filter_entries = priv->plat->unicast_filter_entries;
+	mac->mcast_bits_log2 = 0;
+
+	if (mac->multicast_filter_bins)
+		mac->mcast_bits_log2 = ilog2(mac->multicast_filter_bins);
+
+	mac->link.duplex = 0;
+	mac->link.speed10 = XGMAC_CONFIG_SS_10_MII;
+	mac->link.speed100 = XGMAC_CONFIG_SS_100_MII;
+	mac->link.speed1000 = XGMAC_CONFIG_SS_1000_GMII;
+	mac->link.speed2500 = XGMAC_CONFIG_SS_2500_GMII;
+	mac->link.xgmii.speed2500 = XGMAC_CONFIG_SS_2500;
+	mac->link.xgmii.speed5000 = XGMAC_CONFIG_SS_5000;
+	mac->link.xgmii.speed10000 = XGMAC_CONFIG_SS_10000;
+	mac->link.speed_mask = XGMAC_CONFIG_SS_MASK;
+
+	mac->mii.addr = XGMAC_MDIO_ADDR;
+	mac->mii.data = XGMAC_MDIO_DATA;
+	mac->mii.addr_shift = 16;
+	mac->mii.addr_mask = GENMASK(20, 16);
+	mac->mii.reg_shift = 0;
+	mac->mii.reg_mask = GENMASK(15, 0);
+	mac->mii.clk_csr_shift = 19;
+	mac->mii.clk_csr_mask = GENMASK(21, 19);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/dwxgmac2_descs.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/dwxgmac2_descs.c
@@ -0,0 +1,673 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * dwxgmac2_descs.c
+ *
+ * Copyright (C) 2018 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  20 Jul 2021 : 1. Debug prints removed
+ *  VERSION     : 01-00-03
+ */
+
+#include "tc956xmac_inc.h"
+#include "tc956xmac.h"
+#include "common.h"
+#include "dwxgmac2.h"
+
+static int dwxgmac2_get_tx_status(struct tc956xmac_priv *priv, void *data,
+					struct tc956xmac_extra_stats *x,
+					struct dma_desc *p, void __iomem *ioaddr)
+{
+	unsigned int tdes3 = le32_to_cpu(p->des3);
+	int ret = tx_done;
+
+	if (unlikely(tdes3 & XGMAC_TDES3_OWN))
+		return tx_dma_own;
+	if (likely(!(tdes3 & XGMAC_TDES3_LD)))
+		return tx_not_ls;
+#ifdef TC956X_SRIOV_VF
+	priv->sw_stats.tx_frame_count_good_bad++;
+#endif
+	return ret;
+}
+
+static int dwxgmac2_get_rx_status(struct tc956xmac_priv *priv, void *data,
+					struct tc956xmac_extra_stats *x,
+					struct dma_desc *p)
+{
+	unsigned int rdes3 = le32_to_cpu(p->des3);
+#ifdef TC956X_SRIOV_VF
+	u32 rdes2 = le32_to_cpu(p->des2), l34t_type = 0;
+	u32 error_summary = 0, etlt = 0, tnp = 0;
+#endif
+
+	if (unlikely(rdes3 & XGMAC_RDES3_OWN))
+		return dma_own;
+	if (unlikely(rdes3 & XGMAC_RDES3_CTXT))
+		return discard_frame;
+	if (likely(!(rdes3 & XGMAC_RDES3_LD)))
+		return rx_not_ls;
+	if (unlikely((rdes3 & XGMAC_RDES3_ES) && (rdes3 & XGMAC_RDES3_LD)))
+		return discard_frame;
+
+#ifdef TC956X_SRIOV_VF
+	l34t_type = (rdes3 & XGMAC_RDES3_L34T) >> XGMAC_RDES3_L34T_SHIFT;
+	error_summary = (rdes3 & XGMAC_RDES3_ES) >> XGMAC_RDES3_ES_SHIFT;
+	etlt = (rdes3 & XGMAC_RDES3_ETLT) >> XGMAC_RDES3_ETLT_SHIFT;
+	tnp = (rdes2 & XGMAC_RDES2_TNP) >> XGMAC_RDES2_TNP_SHIFT;
+
+
+	if (!(rdes3 & XGMAC_RDES3_OWN)) {
+		priv->sw_stats.rx_frame_count_good_bad++;
+		if (l34t_type == XGMAC_L34T_NON_IP) {
+			/* Non IP Packet */
+			priv->sw_stats.rx_non_ip_pkt_count++;
+			if (rdes2 & XGMAC_RDES2_AVTDP)
+				priv->sw_stats.rx_av_tagged_datapacket_count++;
+			else if (rdes2 & XGMAC_RDES2_AVTCP)
+				priv->sw_stats.rx_av_tagged_controlpacket_count++;
+		} else {
+			/* IP Packet */
+			priv->sw_stats.rx_nonav_packet_count++;
+			priv->sw_stats.rx_header_good_octets +=
+				le32_to_cpu(p->des2) & XGMAC_RDES2_HL;
+			if (l34t_type == XGMAC_L34T_IPV4_TCP)
+				priv->sw_stats.rx_ipv4_tcp_pkt_count++;
+			if (l34t_type == XGMAC_L34T_IPV4_UDP)
+				priv->sw_stats.rx_ipv4_udp_pkt_count++;
+			if (l34t_type == XGMAC_L34T_IPV4_ICMP)
+				priv->sw_stats.rx_ipv4_icmp_pkt_count++;
+			if (l34t_type == XGMAC_L34T_IPV4_IGMP)
+				priv->sw_stats.rx_ipv4_igmp_pkt_count++;
+			if (l34t_type == XGMAC_L34T_IPV4_UNKNOWN)
+				priv->sw_stats.rx_ipv4_unkown_pkt_count++;
+			if (l34t_type == XGMAC_L34T_IPV6_TCP)
+				priv->sw_stats.rx_ipv6_tcp_pkt_count++;
+			if (l34t_type == XGMAC_L34T_IPV6_UDP)
+				priv->sw_stats.rx_ipv6_udp_pkt_count++;
+			if (l34t_type == XGMAC_L34T_IPV6_ICMP)
+				priv->sw_stats.rx_ipv6_icmp_pkt_count++;
+			if (l34t_type == XGMAC_L34T_IPV6_UNKNOWN)
+				priv->sw_stats.rx_ipv6_unkown_pkt_count++;
+		}
+		if (error_summary) {
+			priv->sw_stats.rx_fame_count_bad++;
+			if (etlt == XGMAC_ET_WD_TIMEOUT)
+				priv->sw_stats.rx_err_wd_timeout_count++;
+			if (etlt == XGMAC_ET_INV_GMII)
+				priv->sw_stats.rx_err_gmii_inv_count++;
+			if (etlt == XGMAC_ET_CRC)
+				priv->sw_stats.rx_err_crc_count++;
+			if (etlt == XGMAC_ET_GIANT_PKT)
+				priv->sw_stats.rx_err_giant_count++;
+			if (etlt == XGMAC_ET_IP_HEADER)
+				priv->sw_stats.rx_err_giant_count++;
+			if (etlt == XGMAC_ET_L4_CSUM)
+				priv->sw_stats.rx_err_checksum_count++;
+			if (etlt == XGMAC_ET_OVERFLOW)
+				priv->sw_stats.rx_err_overflow_count++;
+			if (etlt == XGMAC_ET_BUS)
+				priv->sw_stats.rx_err_bus_count++;
+			if (etlt == XGMAC_ET_LENGTH)
+				priv->sw_stats.rx_err_pkt_len_count++;
+			if (etlt == XGMAC_ET_GOOD_RUNT)
+				priv->sw_stats.rx_err_runt_pkt_count++;
+			if (etlt == XGMAC_ET_DRIBBLE)
+				priv->sw_stats.rx_err_dribble_count++;
+			if (tnp) {
+				priv->sw_stats.rx_tunnel_packet_count++;
+				if (etlt == XGMAC_ET_T_OUTER_IP_HEADER)
+					priv->sw_stats.rx_err_t_out_ip_header_count++;
+				if (etlt == XGMAC_ET_T_OUTER_HEADER_PAYLOAD_L4_CSUM)
+					priv->sw_stats.rx_err_t_out_ip_pl_l4_csum_count++;
+				if (etlt == XGMAC_ET_T_INNER_IP_HEADER)
+					priv->sw_stats.rx_err_t_in_ip_header_count++;
+				if (etlt == XGMAC_ET_T_INNER_L4_PAYLOAD)
+					priv->sw_stats.rx_err_t_in_ip_pl_l4_csum_count++;
+				if (etlt == XGMAC_ET_T_INV_VXLAN_HEADER)
+					priv->sw_stats.rx_err_t_invalid_vlan_header++;
+			}
+		} else {
+			priv->sw_stats.rx_frame_count_good++;
+			priv->sw_stats.rx_packet_good_octets +=
+						(rdes3 & XGMAC_RDES3_PL);
+			priv->sw_stats.rx_header_good_octets +=
+				le32_to_cpu(p->des2) & XGMAC_RDES2_HL;
+			if (etlt == XGMAC_LT_LENGTH)
+				priv->sw_stats.rx_l2_len_pkt_count++;
+			if (etlt == XGMAC_LT_MAC_CONTROL)
+				priv->sw_stats.rx_l2_mac_control_pkt_count++;
+			if (etlt == XGMAC_LT_DCB_CONTROL)
+				priv->sw_stats.rx_l2_dcb_control_pkt_count++;
+			if (etlt == XGMAC_LT_ARP_REQ)
+				priv->sw_stats.rx_l2_arp_pkt_count++;
+			if (etlt == XGMAC_LT_OAM)
+				priv->sw_stats.rx_l2_oam_type_pkt_count++;
+			if (etlt == XGMAC_LT_MAC_RX_ETH_TYPE_MATCH)
+				priv->sw_stats.rx_l2_untg_typ_match_pkt_count++;
+			if (etlt == XGMAC_LT_OTH_TYPE)
+				priv->sw_stats.rx_l2_other_type_pkt_count++;
+			if (etlt == XGMAC_LT_SVLAN)
+				priv->sw_stats.rx_l2_single_svlan_pkt_count++;
+			if (etlt == XGMAC_LT_CVLAN)
+				priv->sw_stats.rx_l2_single_cvlan_pkt_count++;
+			if (etlt == XGMAC_LT_D_CVLAN_CVLAN)
+				priv->sw_stats.rx_l2_d_cvlan_cvlan_pkt_count++;
+			if (etlt == XGMAC_LT_D_SVLAN_SVLAN)
+				priv->sw_stats.rx_l2_d_svlan_svlan_pkt_count++;
+			if (etlt == XGMAC_LT_D_SVLAN_CVLAN)
+				priv->sw_stats.rx_l2_d_svlan_cvlan_pkt_count++;
+			if (etlt == XGMAC_LT_D_CVLAN_SVLAN)
+				priv->sw_stats.rx_l2_d_cvlan_svlan_pkt_count++;
+			if (etlt == XGMAC_LT_UNTAG_AV_CONTROL)
+				priv->sw_stats.rx_l2_untg_av_control_pkt_count++;
+		}
+	}
+#endif /* #ifdef TC956X_SRIOV_VF */
+	return good_frame;
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static int dwxgmac2_get_tx_len(struct tc956xmac_priv *priv, struct dma_desc *p)
+{
+	return (le32_to_cpu(p->des2) & XGMAC_TDES2_B1L);
+}
+
+static int dwxgmac2_get_tx_owner(struct tc956xmac_priv *priv, struct dma_desc *p)
+{
+	return (le32_to_cpu(p->des3) & XGMAC_TDES3_OWN) > 0;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static void dwxgmac2_set_tx_owner(struct tc956xmac_priv *priv, struct dma_desc *p)
+{
+	p->des3 |= cpu_to_le32(XGMAC_TDES3_OWN);
+}
+
+static void dwxgmac2_set_rx_owner(struct tc956xmac_priv *priv,
+					struct dma_desc *p, int disable_rx_ic)
+{
+	p->des3 |= cpu_to_le32(XGMAC_RDES3_OWN);
+
+	if (!disable_rx_ic)
+		p->des3 |= cpu_to_le32(XGMAC_RDES3_IOC);
+}
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static int dwxgmac2_get_tx_ls(struct tc956xmac_priv *priv, struct dma_desc *p)
+{
+	return (le32_to_cpu(p->des3) & XGMAC_RDES3_LD) > 0;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static int dwxgmac2_get_rx_frame_len(struct tc956xmac_priv *priv,
+					      struct dma_desc *p, int rx_coe)
+{
+	return (le32_to_cpu(p->des3) & XGMAC_RDES3_PL);
+}
+
+static void dwxgmac2_enable_tx_timestamp(struct tc956xmac_priv *priv,
+						   struct dma_desc *p)
+{
+	p->des2 |= cpu_to_le32(XGMAC_TDES2_TTSE);
+}
+
+static int dwxgmac2_get_tx_timestamp_status(struct tc956xmac_priv *priv,
+							struct dma_desc *p)
+{
+	return 0; /* Not supported */
+}
+
+static inline void dwxgmac2_get_timestamp(struct tc956xmac_priv *priv,
+						   void *desc, u32 ats, u64 *ts)
+{
+	struct dma_desc *p = (struct dma_desc *)desc;
+	u64 ns = 0;
+
+	ns += le32_to_cpu(p->des1) * 1000000000ULL;
+	ns += le32_to_cpu(p->des0);
+
+	*ts = ns;
+
+	netdev_dbg(priv->dev, "%s: timestamp in ns = 0x%llx", __func__, ns);
+}
+
+static int dwxgmac2_rx_check_timestamp(struct tc956xmac_priv *priv, void *desc)
+{
+	struct dma_desc *p = (struct dma_desc *)desc;
+	unsigned int rdes3 = le32_to_cpu(p->des3);
+	bool desc_valid, ts_valid;
+
+	dma_rmb();
+
+	desc_valid = !(rdes3 & XGMAC_RDES3_OWN) && (rdes3 & XGMAC_RDES3_CTXT);
+	ts_valid = !(rdes3 & XGMAC_RDES3_TSD) && (rdes3 & XGMAC_RDES3_TSA);
+
+	if (likely(desc_valid && ts_valid)) {
+		if ((le32_to_cpu(p->des0) == 0xffffffff) && (le32_to_cpu(p->des1) == 0xffffffff))
+			return -EINVAL;
+
+		netdev_dbg(priv->dev, "%s: Rx timestamp Low = 0x%x", __func__,
+				le32_to_cpu(p->des0));
+
+		netdev_dbg(priv->dev, "%s: Rx timestamp High = 0x%x", __func__,
+				le32_to_cpu(p->des1));
+		return 0;
+	}
+
+	/* Timestamp not ready */
+	return 1;
+}
+
+static int dwxgmac2_get_rx_timestamp_status(struct tc956xmac_priv *priv,
+						void *desc, void *next_desc,
+						u32 ats)
+{
+	struct dma_desc *p = (struct dma_desc *)desc;
+	unsigned int rdes3 = le32_to_cpu(p->des3);
+	int ret = -EBUSY;
+	unsigned int i = 0;
+#ifdef TC956X_SRIOV_VF
+	u32 message_type;
+#endif
+	if (likely(rdes3 & XGMAC_RDES3_CDA)) {
+		do {
+			ret = dwxgmac2_rx_check_timestamp(priv, next_desc);
+			if (ret < 0)
+				goto exit;
+
+			i++;
+
+			if (ret == 1)
+				udelay(1);
+
+		} while ((ret == 1) && (i < 25));
+
+	if (i == 25)
+		ret = -EBUSY;
+	}
+
+#ifdef TC956X_SRIOV_VF
+	/* Read frame type to SW MMC counters from PMT bits in RDES3 */
+	if ((rdes3 & XGMAC_RDES3_OWN) && (rdes3 & XGMAC_RDES3_CTXT)) {
+
+		message_type = (rdes3 &  XGMAC_RDES3_PMT);
+		if (message_type == RDES_PMT_NO_PTP)
+			priv->sw_stats.rx_ptp_no_msg++;
+		else if (message_type == RDES_PMT_SYNC)
+			priv->sw_stats.rx_ptp_msg_type_sync++;
+		else if (message_type == RDES_PMT_FOLLOW_UP)
+			priv->sw_stats.rx_ptp_msg_type_follow_up++;
+		else if (message_type == RDES_PMT_DELAY_REQ)
+			priv->sw_stats.rx_ptp_msg_type_delay_req++;
+		else if (message_type == RDES_PMT_DELAY_RESP)
+			priv->sw_stats.rx_ptp_msg_type_delay_resp++;
+		else if (message_type == RDES_PMT_PDELAY_REQ)
+			priv->sw_stats.rx_ptp_msg_type_pdelay_req++;
+		else if (message_type == RDES_PMT_PDELAY_RESP)
+			priv->sw_stats.rx_ptp_msg_type_pdelay_resp++;
+		else if (message_type == RDES_PMT_PDELAY_FOLLOW_UP)
+			priv->sw_stats.rx_ptp_msg_type_pdelay_follow_up++;
+		else if (message_type == RDES_PMT_PTP_ANNOUNCE)
+			priv->sw_stats.rx_ptp_msg_type_announce++;
+		else if (message_type == RDES_PMT_PTP_MANAGEMENT)
+			priv->sw_stats.rx_ptp_msg_type_management++;
+		else if (message_type == RDES_PMT_PTP_SIGNALING)
+			priv->sw_stats.rx_ptp_msg_pkt_signaling++;
+		else if (message_type == RDES_PMT_PTP_PKT_RESERVED_TYPE)
+			priv->sw_stats.rx_ptp_msg_pkt_reserved_type++;
+	}
+#endif
+exit:
+	return !ret;
+}
+
+static void dwxgmac2_init_rx_desc(struct tc956xmac_priv *priv,
+					struct dma_desc *p, int disable_rx_ic,
+					int mode, int end, int bfsize)
+{
+	dwxgmac2_set_rx_owner(priv, p, disable_rx_ic);
+}
+
+static void dwxgmac2_init_tx_desc(struct tc956xmac_priv *priv,
+					struct dma_desc *p, int mode, int end)
+{
+	p->des0 = 0;
+	p->des1 = 0;
+	p->des2 = 0;
+	p->des3 = 0;
+}
+
+/**
+ * dwxgmac2_prepare_tx_desc - Fill descriptors based on the provided input
+ * parameters.
+ *
+ * @p: pointer to dma_desc descriptor
+ * @is_fs: 1 - first descriptor, 0 - not first descriptor
+ * @len: buffer length
+ * @csum_flag: checksum flag  1 - Enable HW checksum computaion, 0 - disable
+ * @crc_pad: CRC padding configuration
+ * @mode: descriptor mode
+ * @tx_own: descriptor own bit setting
+ * @ls: 1 - last descriptor, 0 - not last descriptor
+ * @tot_pkt_len: total packet length
+ */
+static void dwxgmac2_prepare_tx_desc(struct tc956xmac_priv *priv,
+				     struct dma_desc *p, int is_fs, int len,
+				     bool csum_flag, u32 crc_pad, int mode,
+				     bool tx_own, bool ls,
+				     unsigned int tot_pkt_len)
+{
+	unsigned int tdes3 = le32_to_cpu(p->des3);
+
+	p->des2 |= cpu_to_le32(len & XGMAC_TDES2_B1L);
+
+	tdes3 |= tot_pkt_len & XGMAC_TDES3_FL;
+	if (is_fs)
+		tdes3 |= XGMAC_TDES3_FD;
+	else
+		tdes3 &= ~XGMAC_TDES3_FD;
+
+	if (csum_flag)
+		tdes3 |= 0x3 << XGMAC_TDES3_CIC_SHIFT;
+	else
+		tdes3 &= ~XGMAC_TDES3_CIC;
+
+	if (crc_pad)
+		tdes3 |= crc_pad << XGMAC_TDES3_CPC_SHIFT;
+	else
+		tdes3 &= ~XGMAC_TDES3_CPC;
+
+	if (ls)
+		tdes3 |= XGMAC_TDES3_LD;
+	else
+		tdes3 &= ~XGMAC_TDES3_LD;
+
+	/* Finally set the OWN bit. Later the DMA will start! */
+	if (tx_own)
+		tdes3 |= XGMAC_TDES3_OWN;
+
+	if (is_fs && tx_own)
+		/* When the own bit, for the first frame, has to be set, all
+		 * descriptors for the same frame has to be set before, to
+		 * avoid race condition.
+		 */
+		dma_wmb();
+
+	p->des3 = cpu_to_le32(tdes3);
+}
+
+static void dwxgmac2_prepare_tso_tx_desc(struct tc956xmac_priv *priv,
+					 struct dma_desc *p, int is_fs,
+					 int len1, int len2, bool tx_own,
+					 bool ls, unsigned int tcphdrlen,
+					 unsigned int tcppayloadlen)
+{
+	unsigned int tdes3 = le32_to_cpu(p->des3);
+
+	if (len1)
+		p->des2 |= cpu_to_le32(len1 & XGMAC_TDES2_B1L);
+	if (len2)
+		p->des2 |= cpu_to_le32((len2 << XGMAC_TDES2_B2L_SHIFT) &
+				XGMAC_TDES2_B2L);
+	if (is_fs) {
+		tdes3 |= XGMAC_TDES3_FD | XGMAC_TDES3_TSE;
+		tdes3 |= (tcphdrlen << XGMAC_TDES3_THL_SHIFT) &
+			XGMAC_TDES3_THL;
+		tdes3 |= tcppayloadlen & XGMAC_TDES3_TPL;
+	} else {
+		tdes3 &= ~XGMAC_TDES3_FD;
+	}
+
+	if (ls)
+		tdes3 |= XGMAC_TDES3_LD;
+	else
+		tdes3 &= ~XGMAC_TDES3_LD;
+
+	/* Finally set the OWN bit. Later the DMA will start! */
+	if (tx_own)
+		tdes3 |= XGMAC_TDES3_OWN;
+
+	if (is_fs && tx_own)
+		/* When the own bit, for the first frame, has to be set, all
+		 * descriptors for the same frame has to be set before, to
+		 * avoid race condition.
+		 */
+		dma_wmb();
+
+	p->des3 = cpu_to_le32(tdes3);
+}
+
+static void dwxgmac2_release_tx_desc(struct tc956xmac_priv *priv,
+					      struct dma_desc *p, int mode)
+{
+	p->des0 = 0;
+	p->des1 = 0;
+	p->des2 = 0;
+	p->des3 = 0;
+}
+
+static void dwxgmac2_set_tx_ic(struct tc956xmac_priv *priv, struct dma_desc *p)
+{
+	p->des2 |= cpu_to_le32(XGMAC_TDES2_IOC);
+}
+
+static void dwxgmac2_set_mss(struct tc956xmac_priv *priv,
+					struct dma_desc *p, unsigned int mss)
+{
+	p->des0 = 0;
+	p->des1 = 0;
+	p->des2 = cpu_to_le32(mss);
+	p->des3 = cpu_to_le32(XGMAC_TDES3_CTXT | XGMAC_TDES3_TCMSSV);
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static void dwxgmac2_get_addr(struct tc956xmac_priv *priv,
+				struct dma_desc *p, unsigned int *addr)
+{
+	*addr = le32_to_cpu(p->des0);
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static void dwxgmac2_set_addr(struct tc956xmac_priv *priv,
+				struct dma_desc *p, dma_addr_t addr)
+{
+	p->des0 = cpu_to_le32(lower_32_bits(addr));
+#ifdef TC956X
+	/* Set the mask for physical address access  */
+	p->des1 = cpu_to_le32(TC956X_HOST_PHYSICAL_ADRS_MASK |
+		  (upper_32_bits(addr) & 0xF));
+#else
+	p->des1 = cpu_to_le32(upper_32_bits(addr));
+#endif
+
+}
+
+static void dwxgmac2_clear(struct tc956xmac_priv *priv, struct dma_desc *p)
+{
+	p->des0 = 0;
+	p->des1 = 0;
+	p->des2 = 0;
+	p->des3 = 0;
+}
+
+static int dwxgmac2_get_rx_hash(struct tc956xmac_priv *priv,
+				struct dma_desc *p, u32 *hash,
+				enum pkt_hash_types *type)
+{
+	unsigned int rdes3 = le32_to_cpu(p->des3);
+	u32 ptype;
+
+	if (rdes3 & XGMAC_RDES3_RSV) {
+		ptype = (rdes3 & XGMAC_RDES3_L34T) >> XGMAC_RDES3_L34T_SHIFT;
+
+		switch (ptype) {
+		case XGMAC_L34T_IP4TCP:
+		case XGMAC_L34T_IP4UDP:
+		case XGMAC_L34T_IP6TCP:
+		case XGMAC_L34T_IP6UDP:
+			*type = PKT_HASH_TYPE_L4;
+			break;
+		default:
+			*type = PKT_HASH_TYPE_L3;
+			break;
+		}
+
+		*hash = le32_to_cpu(p->des1);
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static int dwxgmac2_get_rx_header_len(struct tc956xmac_priv *priv,
+						struct dma_desc *p, unsigned int *len)
+{
+	if (le32_to_cpu(p->des3) & XGMAC_RDES3_L34T)
+		*len = le32_to_cpu(p->des2) & XGMAC_RDES2_HL;
+	return 0;
+}
+
+static void dwxgmac2_set_sec_addr(struct tc956xmac_priv *priv,
+					struct dma_desc *p, dma_addr_t addr)
+{
+	p->des2 = cpu_to_le32(lower_32_bits(addr));
+	p->des3 = cpu_to_le32(upper_32_bits(addr));
+}
+
+static void dwxgmac2_set_sarc(struct tc956xmac_priv *priv,
+					struct dma_desc *p, u32 sarc_type)
+{
+	sarc_type <<= XGMAC_TDES3_SAIC_SHIFT;
+
+	p->des3 |= cpu_to_le32(sarc_type & XGMAC_TDES3_SAIC);
+}
+
+static void dwxgmac2_set_vlan_tag(struct tc956xmac_priv *priv,
+					struct dma_desc *p, u16 tag, u16 inner_tag,
+					u32 inner_type)
+{
+	p->des0 = 0;
+	p->des1 = 0;
+	p->des2 = 0;
+	p->des3 = 0;
+
+	/* Inner VLAN */
+	if (inner_type) {
+		u32 des = inner_tag << XGMAC_TDES2_IVT_SHIFT;
+
+		des &= XGMAC_TDES2_IVT;
+		p->des2 = cpu_to_le32(des);
+
+		des = inner_type << XGMAC_TDES3_IVTIR_SHIFT;
+		des &= XGMAC_TDES3_IVTIR;
+		p->des3 = cpu_to_le32(des | XGMAC_TDES3_IVLTV);
+	}
+
+	/* Outer VLAN */
+	p->des3 |= cpu_to_le32(tag & XGMAC_TDES3_VT);
+	p->des3 |= cpu_to_le32(XGMAC_TDES3_VLTV);
+
+	p->des3 |= cpu_to_le32(XGMAC_TDES3_CTXT);
+}
+
+static void dwxgmac2_set_vlan(struct tc956xmac_priv *priv, struct dma_desc *p,
+					u32 type)
+{
+	type <<= XGMAC_TDES2_VTIR_SHIFT;
+	p->des2 |= cpu_to_le32(type & XGMAC_TDES2_VTIR);
+}
+
+static void dwxgmac2_set_tbs(struct tc956xmac_priv *priv, struct dma_edesc *p,
+				u32 sec, u32 nsec, bool lt_valid)
+{
+	p->des4 = 0;
+	p->des5 = 0;
+	if (lt_valid) {
+		p->des4 = cpu_to_le32((sec & XGMAC_TDES0_LT) | XGMAC_TDES0_LTV);
+		p->des5 = cpu_to_le32(nsec & XGMAC_TDES1_LT);
+	}
+	p->des6 = 0;
+	p->des7 = 0;
+}
+
+static void dwxgmac2_set_ostc(struct tc956xmac_priv *priv,
+				struct dma_desc *p, u32 ttsh, u32 ttsl)
+{
+	p->des2 = 0;
+
+	/* Set the timestamp for the DMA to use for doing one-step correction */
+	p->des0 = cpu_to_le32(ttsl);
+	p->des1 = cpu_to_le32(ttsh);
+
+	/* One-Step Timestamp Correction Enable */
+	p->des3 |= cpu_to_le32(XGMAC_TDES3_OSTC | XGMAC_TDES3_TCMSSV);
+
+	/* Set Context Type for Context descriptor */
+	p->des3 |= cpu_to_le32(XGMAC_TDES3_CTXT);
+}
+
+const struct tc956xmac_desc_ops dwxgmac210_desc_ops = {
+	.tx_status = dwxgmac2_get_tx_status,
+	.rx_status = dwxgmac2_get_rx_status,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.get_tx_len = dwxgmac2_get_tx_len,
+	.get_tx_owner = dwxgmac2_get_tx_owner,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.set_tx_owner = dwxgmac2_set_tx_owner,
+	.set_rx_owner = dwxgmac2_set_rx_owner,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.get_tx_ls = dwxgmac2_get_tx_ls,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.get_rx_frame_len = dwxgmac2_get_rx_frame_len,
+	.enable_tx_timestamp = dwxgmac2_enable_tx_timestamp,
+	.get_tx_timestamp_status = dwxgmac2_get_tx_timestamp_status,
+	.get_rx_timestamp_status = dwxgmac2_get_rx_timestamp_status,
+	.get_timestamp = dwxgmac2_get_timestamp,
+	.set_tx_ic = dwxgmac2_set_tx_ic,
+	.prepare_tx_desc = dwxgmac2_prepare_tx_desc,
+	.prepare_tso_tx_desc = dwxgmac2_prepare_tso_tx_desc,
+	.release_tx_desc = dwxgmac2_release_tx_desc,
+	.init_rx_desc = dwxgmac2_init_rx_desc,
+	.init_tx_desc = dwxgmac2_init_tx_desc,
+	.set_mss = dwxgmac2_set_mss,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.get_addr = dwxgmac2_get_addr,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.set_addr = dwxgmac2_set_addr,
+	.clear = dwxgmac2_clear,
+	.get_rx_hash = dwxgmac2_get_rx_hash,
+	.get_rx_header_len = dwxgmac2_get_rx_header_len,
+	.set_sec_addr = dwxgmac2_set_sec_addr,
+	.set_sarc = dwxgmac2_set_sarc,
+	.set_vlan_tag = dwxgmac2_set_vlan_tag,
+	.set_vlan = dwxgmac2_set_vlan,
+	.set_tbs = dwxgmac2_set_tbs,
+	.set_ostc = dwxgmac2_set_ostc,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/dwxgmac2_dma.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/dwxgmac2_dma.c
@@ -0,0 +1,911 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * dwxgmac2_dma.c
+ *
+ * Copyright (C) 2018 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  20 Jul 2021 : 1. Debug prints removed
+ *  VERSION     : 01-00-03
+ *  23 Sep 2021 : 1. Updating RX Queue Threshold Limits for Flow control
+ *                   Threshold Limit for Activating Flow control
+ *                   Threshold Limit for Deactivating Flow control
+ *  VERSION     : 01-00-14
+ *  08 Dec 2021 : 1. Added module parameter for Flow control thresholds per Queue
+ *  VERSION     : 01-00-30
+ *  02 Feb 2022 : 1. Tx Queue flushed and checked for status after Tx DMA stop
+ *  VERSION     : 01-00-40
+ *  29 Apr 2022 : 1. Checking for DMA status update as stop after TX DMA stop
+ *                2. Checking for Tx MTL Queue Read/Write contollers in idle state after TX DMA stop
+ *  VERSION     : 01-00-51
+ *  26 Dec 2023 : 1. Kernel 6.6 Porting changes
+ *  VERSION     : 01-03-59
+ *  13 Feb 2024 : 1. IOCTL/TC/IPA/ModuleParams register write bug fixes.
+ *  VERSION     : 04-00
+ *  29 Mar 2024 : 1. Support for without MDIO and without PHY case
+ *  VERSION     : 04-00
+ */
+
+#include <linux/iopoll.h>
+#include "tc956xmac.h"
+#include "dwxgmac2.h"
+
+static int dwxgmac2_dma_reset(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 value = readl(ioaddr + XGMAC_DMA_MODE);
+
+	/* DMA SW reset */
+	writel(value | XGMAC_SWR, ioaddr + XGMAC_DMA_MODE);
+
+	return readl_poll_timeout(ioaddr + XGMAC_DMA_MODE, value,
+				  !(value & XGMAC_SWR), 0, 100000);
+}
+
+static void dwxgmac2_dma_init(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+			      struct tc956xmac_dma_cfg *dma_cfg, int atds)
+{
+	u32 value = readl(ioaddr + XGMAC_DMA_SYSBUS_MODE);
+
+	if (dma_cfg->aal)
+		value |= XGMAC_AAL;
+
+	if (dma_cfg->eame)
+		value |= XGMAC_EAME;
+
+	writel(value, ioaddr + XGMAC_DMA_SYSBUS_MODE);
+
+	value = readl(ioaddr + XGMAC_DMA_MODE);
+	/* Due to the erratum in XGMAC 3.01a,  DSPW=0, OWRQ=3 needs to be set */
+	value &= ~XGMAC_DSPW;
+	value |= XGMAC_DMA_MODE_INTM;
+	writel(value, ioaddr + XGMAC_DMA_MODE);
+
+}
+
+static void dwxgmac2_dma_init_chan(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+				   struct tc956xmac_dma_cfg *dma_cfg, u32 chan)
+{
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_CONTROL(chan));
+
+	if (dma_cfg->pblx8)
+		value |= XGMAC_PBLx8;
+
+	writel(value, ioaddr + XGMAC_DMA_CH_CONTROL(chan));
+	writel(XGMAC_DMA_INT_DEFAULT_EN, ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+}
+
+static void dwxgmac2_dma_init_rx_chan(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr,
+					struct tc956xmac_dma_cfg *dma_cfg,
+					dma_addr_t phy, u32 chan)
+{
+	u32 rxpbl = dma_cfg->rxpbl ?: dma_cfg->pbl;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	value &= ~XGMAC_RxPBL;
+	value |= (rxpbl << XGMAC_RxPBL_SHIFT) & XGMAC_RxPBL;
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+
+	/* Due to the erratum in XGMAC 3.01a,  DSPW=0, OWRQ=3 needs to be set */
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL2(chan));
+	value &= ~XGMAC_OWRQ;
+	value |= (3 << XGMAC_OWRQ_SHIFT);
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL2(chan));
+
+	if (likely(dma_cfg->eame))
+#ifdef TC956X
+		writel(TC956X_HOST_PHYSICAL_ADRS_MASK | (upper_32_bits(phy) & 0xF),
+	       ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(chan));
+#else
+		writel(upper_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(chan));
+#endif
+	writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(chan));
+}
+
+static void dwxgmac2_dma_init_tx_chan(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr,
+					struct tc956xmac_dma_cfg *dma_cfg,
+					dma_addr_t phy, u32 chan)
+{
+	u32 txpbl = dma_cfg->txpbl ?: dma_cfg->pbl;
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	value &= ~XGMAC_TxPBL;
+	value |= (txpbl << XGMAC_TxPBL_SHIFT) & XGMAC_TxPBL;
+	value |= XGMAC_OSP;
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+
+	if (likely(dma_cfg->eame))
+#ifdef TC956X
+		writel(TC956X_HOST_PHYSICAL_ADRS_MASK |
+			(upper_32_bits(phy) & 0xF),
+			ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(chan));
+#else
+		writel(upper_32_bits(phy), ioaddr +
+			XGMAC_DMA_CH_TxDESC_HADDR(chan));
+#endif
+	writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(chan));
+}
+
+static void dwxgmac2_dma_axi(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+					struct tc956xmac_axi *axi)
+{
+	u32 value = readl(ioaddr + XGMAC_DMA_SYSBUS_MODE);
+	int i;
+
+	if (axi->axi_lpi_en)
+		value |= XGMAC_EN_LPI;
+	if (axi->axi_xit_frm)
+		value |= XGMAC_LPI_XIT_PKT;
+
+	value &= ~XGMAC_WR_OSR_LMT;
+	value |= (axi->axi_wr_osr_lmt << XGMAC_WR_OSR_LMT_SHIFT) &
+		XGMAC_WR_OSR_LMT;
+
+	value &= ~XGMAC_RD_OSR_LMT;
+	value |= (axi->axi_rd_osr_lmt << XGMAC_RD_OSR_LMT_SHIFT) &
+		XGMAC_RD_OSR_LMT;
+
+	if (!axi->axi_fb)
+		value |= XGMAC_UNDEF;
+
+	value &= ~XGMAC_BLEN;
+	for (i = 0; i < AXI_BLEN; i++) {
+		switch (axi->axi_blen[i]) {
+		case 256:
+			value |= XGMAC_BLEN256;
+			break;
+		case 128:
+			value |= XGMAC_BLEN128;
+			break;
+		case 64:
+			value |= XGMAC_BLEN64;
+			break;
+		case 32:
+			value |= XGMAC_BLEN32;
+			break;
+		case 16:
+			value |= XGMAC_BLEN16;
+			break;
+		case 8:
+			value |= XGMAC_BLEN8;
+			break;
+		case 4:
+			value |= XGMAC_BLEN4;
+			break;
+		}
+		netdev_dbg(priv->dev, "%s: Burst length supported = %d",
+				__func__, axi->axi_blen[i]);
+	}
+
+	writel(value, ioaddr + XGMAC_DMA_SYSBUS_MODE);
+	writel(0, ioaddr + XGMAC_TX_EDMA_CTRL);
+	writel(XGMAC_RDPS, ioaddr + XGMAC_RX_EDMA_CTRL);
+}
+
+static void dwxgmac2_dma_dump_regs(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 *reg_space)
+{
+	int i;
+
+	for (i = ETH_DMA_DUMP_OFFSET1; i <= ETH_DMA_DUMP_OFFSET1_END; i++) {
+		reg_space[i] = readl(ioaddr + MAC_OFFSET + (4 * i));
+		KPRINT_DEBUG1("%04x : %08x\n", i*4, reg_space[i]);
+	}
+
+	for (i = ETH_DMA_DUMP_OFFSET2; i < XGMAC_REGSIZE; i++) {
+		reg_space[i] = readl(ioaddr + MAC_OFFSET + (4 * i));
+		KPRINT_DEBUG1("%04x : %08x\n", i*4, reg_space[i]);
+	}
+
+	KPRINT_DEBUG1("**********************************************************************************");
+}
+
+/**
+ * dwxgmac2_dma_rx_mode - Configure Rx MTL registers.
+ *
+ * @ioaddr: Device SFR base address
+ * @mode: MTL operating mode
+ * @channel: Rx channel number
+ * @fifosz: MTL FIFO size
+ * @qmode: Queue mode
+ */
+static void dwxgmac2_dma_rx_mode(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, int mode,
+					u32 channel, int fifosz, u8 qmode)
+{
+	u32 value = readl(ioaddr + XGMAC_MTL_RXQ_OPMODE(channel));
+	unsigned int rqs = 0;
+
+	if (fifosz != 0)
+		rqs = fifosz / 256 - 1;
+
+
+	if (mode == SF_DMA_MODE) {
+		value |= XGMAC_RSF;
+	} else {
+		value &= ~XGMAC_RSF;
+		value &= ~XGMAC_RTC;
+
+		if (mode <= 64)
+			value |= 0x0 << XGMAC_RTC_SHIFT;
+		else if (mode <= 96)
+			value |= 0x2 << XGMAC_RTC_SHIFT;
+		else
+			value |= 0x3 << XGMAC_RTC_SHIFT;
+	}
+
+	value &= ~XGMAC_RQS;
+	value |= (rqs << XGMAC_RQS_SHIFT) & XGMAC_RQS;
+
+	if ((fifosz >= 4096) && (qmode != MTL_QUEUE_AVB)) {
+		u32 flow = readl(ioaddr + XGMAC_MTL_RXQ_FLOW_CONTROL(channel));
+		unsigned int rfd, rfa;
+
+		value |= XGMAC_EHFC;
+
+		rfd = priv->plat->rx_queues_cfg[channel].rfd;
+		rfa = priv->plat->rx_queues_cfg[channel].rfa;
+
+		flow &= ~XGMAC_RFD;
+		flow |= rfd << XGMAC_RFD_SHIFT;
+
+		flow &= ~XGMAC_RFA;
+		flow |= rfa << XGMAC_RFA_SHIFT;
+
+		writel(flow, ioaddr + XGMAC_MTL_RXQ_FLOW_CONTROL(channel));
+	}
+
+	writel(value, ioaddr + XGMAC_MTL_RXQ_OPMODE(channel));
+
+	/* Enable MTL RX overflow */
+	value = readl(ioaddr + XGMAC_MTL_QINTEN(channel));
+	writel(value | XGMAC_RXOIE, ioaddr + XGMAC_MTL_QINTEN(channel));
+}
+
+static void dwxgmac2_dma_tx_mode(struct tc956xmac_priv *priv,
+				 void __iomem *ioaddr, int mode,
+				 u32 channel, int fifosz, u8 qmode)
+{
+	u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(channel));
+	unsigned int tqs = 0;
+	u8 traffic_class = 0;
+
+	if (fifosz != 0)
+		tqs = fifosz / 256 - 1;
+
+	if (mode == SF_DMA_MODE) {
+		value |= XGMAC_TSF;
+	} else {
+		value &= ~XGMAC_TSF;
+		value &= ~XGMAC_TTC;
+
+		if (mode <= 64)
+			value |= 0x0 << XGMAC_TTC_SHIFT;
+		else if (mode <= 96)
+			value |= 0x2 << XGMAC_TTC_SHIFT;
+		else if (mode <= 128)
+			value |= 0x3 << XGMAC_TTC_SHIFT;
+		else if (mode <= 192)
+			value |= 0x4 << XGMAC_TTC_SHIFT;
+		else if (mode <= 256)
+			value |= 0x5 << XGMAC_TTC_SHIFT;
+		else if (mode <= 384)
+			value |= 0x6 << XGMAC_TTC_SHIFT;
+		else
+			value |= 0x7 << XGMAC_TTC_SHIFT;
+	}
+
+	traffic_class = priv->plat->tx_queues_cfg[channel].traffic_class;
+	value |= (traffic_class << XGMAC_Q2TCMAP_SHIFT) & XGMAC_Q2TCMAP;
+
+	value &= ~XGMAC_TXQEN;
+	if (qmode != MTL_QUEUE_AVB)
+		value |= 0x2 << XGMAC_TXQEN_SHIFT;
+	else
+		value |= 0x1 << XGMAC_TXQEN_SHIFT;
+
+	value &= ~XGMAC_TQS;
+	value |= (tqs << XGMAC_TQS_SHIFT) & XGMAC_TQS;
+
+	writel(value, ioaddr +  XGMAC_MTL_TXQ_OPMODE(channel));
+}
+
+static void dwxgmac2_enable_dma_irq(struct tc956xmac_priv *priv,
+				    void __iomem *ioaddr, u32 chan,
+				    bool rx, bool tx)
+{
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+
+	if (rx)
+		value |= XGMAC_DMA_INT_DEFAULT_RX;
+	if (tx)
+		value |= XGMAC_DMA_INT_DEFAULT_TX;
+
+	writel(value, ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+}
+
+static void dwxgmac2_disable_dma_irq(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 chan,
+					bool rx, bool tx)
+{
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+
+	if (rx)
+		value &= ~XGMAC_DMA_INT_DEFAULT_RX;
+	if (tx)
+		value &= ~XGMAC_DMA_INT_DEFAULT_TX;
+
+	writel(value, ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+}
+
+static void dwxgmac2_dma_start_tx(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 chan)
+{
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	value |= XGMAC_TXST;
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+
+	/* TE set will enable all the MAC transmisster, PF to configure when
+	 *  starting its channel for tranmission
+	 */
+#ifndef TC956X_SRIOV_VF
+#ifndef TC956X_DMA_OFFLOAD_ENABLE
+	value = readl(ioaddr + XGMAC_TX_CONFIG);
+	value |= XGMAC_CONFIG_TE;
+	writel(value, ioaddr + XGMAC_TX_CONFIG);
+#endif
+#endif
+}
+
+static void dwxgmac2_dma_stop_tx(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 chan)
+{
+	u32 value;
+	int limit;
+
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+	value &= ~XGMAC_TXST;
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+
+	/* TE reset will disable the MAC transmisster, it is possible that
+	 * other MAC channels are used by other VF/PF. So donot configure this
+	 */
+
+	/*Check whether Tx DMA is in stop state */
+	limit = 10000;
+	while (limit--) {
+		if ((readl(ioaddr + XGMAC_DMA_CH_STATUS(chan)) & XGMAC_TPS))
+			break;
+		udelay(1);
+	}
+	if (limit == -1)
+		KPRINT_ERR("Tx DMA (%d) is not in stop state\n", chan);
+
+	DBGPR_FUNC(priv->device, "%s DMA chnl status : 0x%x, chnl : %d, limit [%d]\n", __func__, readl(ioaddr + XGMAC_DMA_CH_STATUS(chan)), chan, limit);
+
+	/*Check whether MTL Tx Read/Write controller is in Idle state */
+	limit = 10000;
+	while (limit--) {
+		if (!(readl(ioaddr + XGMAC_MTL_TXQ_Debug(chan)) & (XGMAC_MTL_DEBUG_TWCSTS |
+			XGMAC_MTL_DEBUG_TRCSTS_MASK)))
+			break;
+		udelay(1);
+	}
+	if (limit == -1)
+		KPRINT_ERR("MTL Tx Read/Write controller (%d) is not in idle state\n", chan);
+
+	DBGPR_FUNC(priv->device, "%s MTL TXQ status : 0x%x, chnl : %d, limit [%d]\n", __func__, readl(ioaddr + XGMAC_MTL_TXQ_Debug(chan)), chan, limit);
+
+	/* Flush the Tx Queue */
+	value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(chan));
+	value |= XGMAC_FTQ;
+	writel(value, ioaddr +  XGMAC_MTL_TXQ_OPMODE(chan));
+
+	/*Check the TxQ empty status with timeout of 10ms*/
+	limit = 10000;
+	while (limit--) {
+		if (!(readl(ioaddr + XGMAC_MTL_TXQ_Debug(chan)) & XGMAC_MTL_DEBUG_TXQSTS))
+			break;
+		udelay(1);
+	}
+	if (limit == -1)
+		KPRINT_ERR("Tx Queue did not get time to empty after flush operation\n");
+
+	DBGPR_FUNC(priv->device, "%s MTL TXQ status after flush: 0x%x, limit [%d]\n", __func__, readl(ioaddr + XGMAC_MTL_TXQ_Debug(chan)), limit);
+
+#ifndef TC956X_SRIOV_VF
+#ifndef TC956X_DMA_OFFLOAD_ENABLE
+	value = readl(ioaddr + XGMAC_TX_CONFIG);
+	value &= ~XGMAC_CONFIG_TE;
+	writel(value, ioaddr + XGMAC_TX_CONFIG);
+#endif
+#endif
+}
+
+static void dwxgmac2_dma_start_rx(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 chan)
+{
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	value |= XGMAC_RXST;
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+
+	/* RE set will enable all the MAC receiver, PF to configure when
+	 *  starting its channel for reception
+	 */
+#ifndef TC956X_SRIOV_VF
+#ifndef TC956X_DMA_OFFLOAD_ENABLE
+	value = readl(ioaddr + XGMAC_RX_CONFIG);
+	value |= XGMAC_CONFIG_RE;
+	writel(value, ioaddr + XGMAC_RX_CONFIG);
+#endif
+#endif
+}
+
+static void dwxgmac2_dma_stop_rx(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 chan)
+{
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	value &= ~XGMAC_RXST;
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+
+#ifndef TC956X_SRIOV_VF
+#ifndef TC956X_DMA_OFFLOAD_ENABLE
+	value = readl(ioaddr + XGMAC_RX_CONFIG);
+	value &= ~XGMAC_CONFIG_RE;
+	writel(value, ioaddr + XGMAC_RX_CONFIG);
+#endif
+#endif
+}
+
+static int dwxgmac2_dma_interrupt(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+				  struct tc956xmac_extra_stats *x, u32 chan)
+{
+	u32 intr_status = readl(ioaddr + XGMAC_DMA_CH_STATUS(chan));
+	u32 intr_en = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+	int ret = 0;
+
+	/* ABNORMAL interrupts */
+	if (unlikely(intr_status & XGMAC_AIS)) {
+		if (unlikely(intr_status & XGMAC_RBU)) {
+			x->rx_buf_unav_irq[chan]++;
+			ret |= handle_rx;
+		}
+		if (unlikely(intr_status & XGMAC_TPS)) {
+			x->tx_process_stopped_irq[chan]++;
+			ret |= tx_hard_error;
+		}
+		if (unlikely(intr_status & XGMAC_FBE)) {
+			x->fatal_bus_error_irq[chan]++;
+			ret |= tx_hard_error;
+		}
+	}
+
+	/* TX/RX NORMAL interrupts */
+//	if (likely(intr_status & XGMAC_NIS)) {
+	if (1) {
+		x->normal_irq_n[chan]++;
+
+		if (likely(intr_status & XGMAC_RI)) {
+			x->rx_normal_irq_n[chan]++;
+			ret |= handle_rx;
+		}
+		if (likely(intr_status & (XGMAC_TI | XGMAC_TBU))) {
+			x->tx_normal_irq_n[chan]++;
+			ret |= handle_tx;
+		}
+	}
+
+	/* Clear interrupts */
+	writel(intr_en & intr_status, ioaddr + XGMAC_DMA_CH_STATUS(chan));
+
+	return ret;
+}
+
+static void dwxgmac2_get_hw_feature(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr,
+					struct dma_features *dma_cap)
+{
+	u32 hw_cap;
+
+	/*  MAC HW feature 0 */
+	hw_cap = readl(ioaddr + XGMAC_HW_FEATURE0);
+	dma_cap->vlins = (hw_cap & XGMAC_HWFEAT_SAVLANINS) >> 27;
+	dma_cap->rx_coe = (hw_cap & XGMAC_HWFEAT_RXCOESEL) >> 16;
+	dma_cap->tx_coe = (hw_cap & XGMAC_HWFEAT_TXCOESEL) >> 14;
+	dma_cap->eee = (hw_cap & XGMAC_HWFEAT_EEESEL) >> 13;
+	dma_cap->atime_stamp = (hw_cap & XGMAC_HWFEAT_TSSEL) >> 12;
+	dma_cap->av = (hw_cap & XGMAC_HWFEAT_AVSEL) >> 11;
+	dma_cap->av &= !((hw_cap & XGMAC_HWFEAT_RAVSEL) >> 10);
+	dma_cap->arpoffsel = (hw_cap & XGMAC_HWFEAT_ARPOFFSEL) >> 9;
+	dma_cap->rmon = (hw_cap & XGMAC_HWFEAT_MMCSEL) >> 8;
+	dma_cap->pmt_magic_frame = (hw_cap & XGMAC_HWFEAT_MGKSEL) >> 7;
+	dma_cap->pmt_remote_wake_up = (hw_cap & XGMAC_HWFEAT_RWKSEL) >> 6;
+#ifdef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	dma_cap->sma_mdio = (hw_cap & XGMAC_HWFEAT_SMASEL) >> 5;
+#endif
+	dma_cap->vlhash = (hw_cap & XGMAC_HWFEAT_VLHASH) >> 4;
+	dma_cap->mbps_1000 = (hw_cap & XGMAC_HWFEAT_GMIISEL) >> 1;
+
+	/* MAC HW feature 1 */
+	hw_cap = readl(ioaddr + XGMAC_HW_FEATURE1);
+	dma_cap->l3l4fnum = (hw_cap & XGMAC_HWFEAT_L3L4FNUM) >> 27;
+	dma_cap->hash_tb_sz = (hw_cap & XGMAC_HWFEAT_HASHTBLSZ) >> 24;
+	dma_cap->rssen = (hw_cap & XGMAC_HWFEAT_RSSEN) >> 20;
+	dma_cap->tsoen = (hw_cap & XGMAC_HWFEAT_TSOEN) >> 18;
+	dma_cap->sphen = (hw_cap & XGMAC_HWFEAT_SPHEN) >> 17;
+	dma_cap->ptoen = (hw_cap & XGMAC_HWFEAT_PTOEN) >> 12;
+	dma_cap->osten = (hw_cap & XGMAC_HWFEAT_OSTEN) >> 11;
+
+	dma_cap->addr64 = (hw_cap & XGMAC_HWFEAT_ADDR64) >> 14;
+	switch (dma_cap->addr64) {
+	case 0:
+		dma_cap->addr64 = 32;
+		break;
+	case 1:
+		dma_cap->addr64 = 40;
+		break;
+	case 2:
+		dma_cap->addr64 = 48;
+		break;
+	default:
+		dma_cap->addr64 = 32;
+		break;
+	}
+
+	if (IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT))
+		NMSGPR_INFO(priv->device, "64 bit platform\n");
+	else {
+		NMSGPR_INFO(priv->device, "32 bit platform\n");
+		dma_cap->addr64 = 32;
+	}
+
+	dma_cap->tx_fifo_size =
+		128 << ((hw_cap & XGMAC_HWFEAT_TXFIFOSIZE) >> 6);
+	dma_cap->rx_fifo_size =
+		128 << ((hw_cap & XGMAC_HWFEAT_RXFIFOSIZE) >> 0);
+
+	/* MAC HW feature 2 */
+	hw_cap = readl(ioaddr + XGMAC_HW_FEATURE2);
+	dma_cap->pps_out_num = (hw_cap & XGMAC_HWFEAT_PPSOUTNUM) >> 24;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+	dma_cap->aux_snapshot_n = (hw_cap & XGMAC_HWFEAT_AUXSNAPNUM) >> 28;
+#endif
+	dma_cap->number_tx_channel =
+		((hw_cap & XGMAC_HWFEAT_TXCHCNT) >> 18) + 1;
+	dma_cap->number_rx_channel =
+		((hw_cap & XGMAC_HWFEAT_RXCHCNT) >> 12) + 1;
+	dma_cap->number_tx_queues =
+		((hw_cap & XGMAC_HWFEAT_TXQCNT) >> 6) + 1;
+	dma_cap->number_rx_queues =
+		((hw_cap & XGMAC_HWFEAT_RXQCNT) >> 0) + 1;
+
+	/* MAC HW feature 3 */
+	hw_cap = readl(ioaddr + XGMAC_HW_FEATURE3);
+	dma_cap->tbssel = (hw_cap & XGMAC_HWFEAT_TBSSEL) >> 27;
+	dma_cap->fpesel = (hw_cap & XGMAC_HWFEAT_FPESEL) >> 26;
+	dma_cap->estwid = (hw_cap & XGMAC_HWFEAT_ESTWID) >> 23;
+	dma_cap->estdep = (hw_cap & XGMAC_HWFEAT_ESTDEP) >> 20;
+	dma_cap->estsel = (hw_cap & XGMAC_HWFEAT_ESTSEL) >> 19;
+	dma_cap->asp = (hw_cap & XGMAC_HWFEAT_ASP) >> 14;
+	dma_cap->dvlan = (hw_cap & XGMAC_HWFEAT_DVLAN) >> 13;
+	dma_cap->frpes = (hw_cap & XGMAC_HWFEAT_FRPES) >> 11;
+	dma_cap->frpbs = (hw_cap & XGMAC_HWFEAT_FRPPB) >> 9;
+#ifndef TC956X_SRIOV_VF
+	dma_cap->frpsel = (hw_cap & XGMAC_HWFEAT_FRPSEL) >> 3;
+#elif (defined TC956X_SRIOV_VF)
+	dma_cap->frpsel = 0; /* VF to not support FRP */
+#endif
+	switch (dma_cap->frpes) {
+	default:
+		dma_cap->frpes = 0;
+		break;
+	case 0x0:
+		dma_cap->frpes = 64;
+		break;
+	case 0x1:
+		dma_cap->frpes = 128;
+		break;
+	case 0x2:
+		dma_cap->frpes = 256;
+		break;
+	}
+#ifdef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	dma_cap->sma_mdio = 0;
+#endif
+}
+
+static void dwxgmac2_rx_watchdog(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 riwt, u32 nchan)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+#ifdef TC956X_SRIOV_PF
+	if (priv->plat->rx_ch_in_use[nchan] == TC956X_DISABLE_CHNL)
+		return;
+#elif (defined TC956X_SRIOV_VF)
+	if (priv->plat->ch_in_use[nchan] == NOT_USED)
+		return;
+#else
+	if (priv->plat->rx_dma_ch_owner[nchan] != USE_IN_TC956X_SW)
+		return;
+#endif
+
+	writel(riwt & XGMAC_RWT, ioaddr + XGMAC_DMA_CH_Rx_WATCHDOG(nchan));
+#else
+	u32 i;
+
+	for (i = 0; i < nchan; i++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[i] == TC956X_DISABLE_CHNL)
+			continue;
+#elif (defined TC956X_SRIOV_VF)
+		if (priv->plat->ch_in_use[i] == NOT_USED)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[i] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		writel(riwt & XGMAC_RWT, ioaddr + XGMAC_DMA_CH_Rx_WATCHDOG(i));
+	}
+#endif
+}
+
+static void dwxgmac2_set_rx_ring_len(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 len, u32 chan)
+{
+	u32 val;
+
+	val = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL2(chan));
+	val &= ~XGMAC_RDRL;
+	val |= (len << XGMAC_RDRL_SHIFT) & XGMAC_RDRL;
+	writel(val, ioaddr + XGMAC_DMA_CH_RX_CONTROL2(chan));
+}
+
+static void dwxgmac2_set_tx_ring_len(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 len, u32 chan)
+{
+	writel(len, ioaddr + XGMAC_DMA_CH_TX_CONTROL2(chan));
+}
+
+static void dwxgmac2_set_rx_tail_ptr(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 ptr, u32 chan)
+{
+	writel(ptr, ioaddr + XGMAC_DMA_CH_RxDESC_TAIL_LPTR(chan));
+
+}
+
+static void dwxgmac2_set_tx_tail_ptr(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 ptr, u32 chan)
+{
+	writel(ptr, ioaddr + XGMAC_DMA_CH_TxDESC_TAIL_LPTR(chan));
+}
+
+static void dwxgmac2_enable_tso(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, bool en, u32 chan)
+{
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+
+	if (en)
+		value |= XGMAC_TSE;
+	else
+		value &= ~XGMAC_TSE;
+
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static void dwxgmac2_qmode(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+				u32 channel, u8 qmode)
+{
+	u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(channel));
+#ifndef TC956X_SRIOV_VF
+	u32 flow = readl(ioaddr + XGMAC_RX_FLOW_CTRL);
+#endif
+	value &= ~XGMAC_TXQEN;
+	if (qmode != MTL_QUEUE_AVB) {
+		value |= 0x2 << XGMAC_TXQEN_SHIFT;
+		//writel(0, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(channel));
+	} else {
+		value |= 0x1 << XGMAC_TXQEN_SHIFT;
+		/* RFE configuration is handled in PF driver */
+#ifndef TC956X_SRIOV_VF
+		writel(flow & (~XGMAC_RFE), ioaddr + XGMAC_RX_FLOW_CTRL);
+#endif
+	}
+
+	writel(value, ioaddr +  XGMAC_MTL_TXQ_OPMODE(channel));
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static void dwxgmac2_set_bfsize(struct tc956xmac_priv *priv,
+				void __iomem *ioaddr, int bfsize, u32 chan)
+{
+	u32 value;
+
+	value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+	value &= ~XGMAC_RBSZ;
+	value |= (bfsize << XGMAC_RBSZ_SHIFT) & XGMAC_RBSZ;
+	writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+}
+
+static void dwxgmac2_enable_sph(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, bool en, u32 chan)
+{
+	u32 value = readl(ioaddr + XGMAC_RX_CONFIG);
+
+	/* Common register configuration only done in PF driver */
+#ifndef TC956X_SRIOV_VF
+	value &= ~XGMAC_CONFIG_HDSMS;
+	value |= XGMAC_CONFIG_HDSMS_256; /* Segment max 256 bytes */
+	writel(value, ioaddr + XGMAC_RX_CONFIG);
+#endif
+	value = readl(ioaddr + XGMAC_DMA_CH_CONTROL(chan));
+	if (en)
+		value |= XGMAC_SPH;
+	else
+		value &= ~XGMAC_SPH;
+	writel(value, ioaddr + XGMAC_DMA_CH_CONTROL(chan));
+}
+
+static int dwxgmac2_enable_tbs(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+					bool en, u32 chan)
+{
+	u32 value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+
+	if (en) {
+		value &= ~XGMAC_TFSEL;
+		value |= (XGMAC_EDSE) | (0 << XGMAC_TFSEL_SHIFT);
+	} else {
+		value &= ~XGMAC_EDSE;
+	}
+	writel(value, ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan));
+
+	value = readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chan)) & XGMAC_EDSE;
+
+	if (en && !value)
+		return -EIO;
+
+	/* Below configuration done on common DMA registers
+	 * so PF driver can configure this.
+	 */
+	writel((100 << XGMAC_FTOS_SHIFT) | (1 << XGMAC_FGOS_SHIFT) | XGMAC_FTOV,
+		ioaddr + XGMAC_DMA_TBS_CTRL0);
+	writel((100 << XGMAC_FTOS_SHIFT) | (1 << XGMAC_FGOS_SHIFT) | XGMAC_FTOV,
+		ioaddr + XGMAC_DMA_TBS_CTRL1);
+	writel((100 << XGMAC_FTOS_SHIFT) | (1 << XGMAC_FGOS_SHIFT) | XGMAC_FTOV,
+		ioaddr + XGMAC_DMA_TBS_CTRL2);
+	writel((100 << XGMAC_FTOS_SHIFT) | (1 << XGMAC_FGOS_SHIFT) | XGMAC_FTOV,
+		ioaddr + XGMAC_DMA_TBS_CTRL3);
+	return 0;
+}
+
+static void dwxgmac2_desc_stats(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 chno;
+
+	for (chno = 0; chno < priv->plat->tx_queues_to_use; chno++) {
+#ifdef TC956X_SRIOV_VF
+		if (priv->plat->ch_in_use[chno] == 0)
+			continue;
+#endif
+		priv->xstats.txch_status[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_STATUS(chno));
+		priv->xstats.txch_control[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL(chno));
+		priv->xstats.txch_desc_list_haddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(chno));
+		priv->xstats.txch_desc_list_laddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(chno));
+		priv->xstats.txch_desc_ring_len[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_TX_CONTROL2(chno)) & (XGMAC_TDRL);
+		priv->xstats.txch_desc_curr_haddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_Cur_TxDESC_HADDR(chno));
+		priv->xstats.txch_desc_curr_laddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_Cur_TxDESC_LADDR(chno));
+		priv->xstats.txch_desc_tail[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_TxDESC_TAIL_LPTR(chno));
+		priv->xstats.txch_desc_buf_haddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_Cur_TxBuff_HADDR(chno));
+		priv->xstats.txch_desc_buf_laddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_Cur_TxBuff_LADDR(chno));
+		priv->xstats.txch_sw_cur_tx[chno] = priv->tx_queue[chno].cur_tx;
+		priv->xstats.txch_sw_dirty_tx[chno] = priv->tx_queue[chno].dirty_tx;
+	}
+
+	for (chno = 0; chno < priv->plat->rx_queues_to_use; chno++) {
+#ifdef TC956X_SRIOV_VF
+		if (priv->plat->ch_in_use[chno] == 0)
+			continue;
+#endif
+		priv->xstats.rxch_status[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_STATUS(chno));
+		priv->xstats.rxch_control[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chno));
+		priv->xstats.rxch_desc_list_haddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(chno));
+		priv->xstats.rxch_desc_list_laddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(chno));
+		priv->xstats.rxch_desc_ring_len[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL2(chno)) & (XGMAC_RDRL);
+		priv->xstats.rxch_desc_curr_haddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_Cur_RxDESC_HADDR(chno));
+		priv->xstats.rxch_desc_curr_laddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_Cur_RxDESC_LADDR(chno));
+		priv->xstats.rxch_desc_tail[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_RxDESC_TAIL_LPTR(chno));
+		priv->xstats.rxch_desc_buf_haddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_Cur_RxBuff_HADDR(chno));
+		priv->xstats.rxch_desc_buf_laddr[chno] =
+			readl(ioaddr + XGMAC_DMA_CH_Cur_RxBuff_LADDR(chno));
+		priv->xstats.rxch_sw_cur_rx[chno] = priv->rx_queue[chno].cur_rx;
+		priv->xstats.rxch_sw_dirty_rx[chno] = priv->rx_queue[chno].dirty_rx;
+	}
+}
+
+const struct tc956xmac_dma_ops dwxgmac210_dma_ops = {
+	.reset = dwxgmac2_dma_reset,
+	.init = dwxgmac2_dma_init,
+	.init_chan = dwxgmac2_dma_init_chan,
+	.init_rx_chan = dwxgmac2_dma_init_rx_chan,
+	.init_tx_chan = dwxgmac2_dma_init_tx_chan,
+	.axi = dwxgmac2_dma_axi,
+	.dump_regs = dwxgmac2_dma_dump_regs,
+	.dma_rx_mode = dwxgmac2_dma_rx_mode,
+	.dma_tx_mode = dwxgmac2_dma_tx_mode,
+	.enable_dma_irq = dwxgmac2_enable_dma_irq,
+	.disable_dma_irq = dwxgmac2_disable_dma_irq,
+	.start_tx = dwxgmac2_dma_start_tx,
+	.stop_tx = dwxgmac2_dma_stop_tx,
+	.start_rx = dwxgmac2_dma_start_rx,
+	.stop_rx = dwxgmac2_dma_stop_rx,
+	.dma_interrupt = dwxgmac2_dma_interrupt,
+	.get_hw_feature = dwxgmac2_get_hw_feature,
+	.rx_watchdog = dwxgmac2_rx_watchdog,
+	.set_rx_ring_len = dwxgmac2_set_rx_ring_len,
+	.set_tx_ring_len = dwxgmac2_set_tx_ring_len,
+	.set_rx_tail_ptr = dwxgmac2_set_rx_tail_ptr,
+	.set_tx_tail_ptr = dwxgmac2_set_tx_tail_ptr,
+	.enable_tso = dwxgmac2_enable_tso,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.qmode = dwxgmac2_qmode,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.set_bfsize = dwxgmac2_set_bfsize,
+	.enable_sph = dwxgmac2_enable_sph,
+	.enable_tbs = dwxgmac2_enable_tbs,
+	.desc_stats = dwxgmac2_desc_stats,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/hwif.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/hwif.c
@@ -0,0 +1,387 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * hwif.c
+ *
+ * Copyright (C) 2018 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *  VERSION     : 04-00
+ */
+
+#include "common.h"
+#include "tc956xmac.h"
+#include "tc956xmac_ptp.h"
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+#include "tc956x_xpcs.h"
+#include "tc956x_pma.h"
+#endif
+#endif
+
+static u32 tc956xmac_get_id(struct tc956xmac_priv *priv, u32 id_reg)
+{
+	u32 reg = readl(priv->ioaddr + id_reg);
+
+	if (!reg) {
+		dev_info(priv->device, "Version ID not available\n");
+		return 0x0;
+	}
+
+	dev_info(priv->device, "User ID: 0x%x, Synopsys ID: 0x%x\n",
+			(unsigned int)(reg & GENMASK(15, 8)) >> 8,
+			(unsigned int)(reg & GENMASK(7, 0)));
+	return reg & GENMASK(7, 0);
+}
+
+#ifndef TC956X
+static void tc956xmac_dwmac_mode_quirk(struct tc956xmac_priv *priv)
+{
+	struct mac_device_info *mac = priv->hw;
+
+	if (priv->chain_mode) {
+		dev_info(priv->device, "Chain mode enabled\n");
+		priv->mode = TC956XMAC_CHAIN_MODE;
+		mac->mode = &chain_mode_ops;
+	} else {
+		dev_info(priv->device, "Ring mode enabled\n");
+		priv->mode = TC956XMAC_RING_MODE;
+		mac->mode = &ring_mode_ops;
+	}
+}
+
+static int tc956xmac_dwmac1_quirks(struct tc956xmac_priv *priv)
+{
+	struct mac_device_info *mac = priv->hw;
+
+	if (priv->plat->enh_desc) {
+		dev_info(priv->device, "Enhanced/Alternate descriptors\n");
+
+		/* GMAC older than 3.50 has no extended descriptors */
+		if (priv->synopsys_id >= DWMAC_CORE_3_50) {
+			dev_info(priv->device, "Enabled extended descriptors\n");
+			priv->extend_desc = 1;
+		} else {
+			dev_warn(priv->device, "Extended descriptors not supported\n");
+		}
+
+		mac->desc = &enh_desc_ops;
+	} else {
+		dev_info(priv->device, "Normal descriptors\n");
+		mac->desc = &ndesc_ops;
+	}
+
+	tc956xmac_dwmac_mode_quirk(priv);
+	return 0;
+}
+
+static int tc956xmac_dwmac4_quirks(struct tc956xmac_priv *priv)
+{
+	tc956xmac_dwmac_mode_quirk(priv);
+	return 0;
+}
+#endif
+
+static const struct tc956xmac_hwif_entry {
+	bool gmac;
+	bool gmac4;
+	bool xgmac;
+	u32 min_id;
+	const struct tc956xmac_regs_off regs;
+	const void *desc;
+	const void *dma;
+	const void *mac;
+	const void *hwtimestamp;
+	const void *mode;
+	const void *tc;
+	const void *mmc;
+	const void *pma;
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+	const void *msi;
+	const void *rsc;
+	const void *mbx;
+	const void *mbx_wrapper;
+#endif
+	int (*setup)(struct tc956xmac_priv *priv);
+	int (*quirks)(struct tc956xmac_priv *priv);
+} tc956xmac_hw[] = {
+	/* NOTE: New HW versions shall go to the end of this table */
+#ifndef TC956X
+	{
+		.gmac = false,
+		.gmac4 = false,
+		.xgmac = false,
+		.min_id = 0,
+		.regs = {
+			.ptp_off = PTP_GMAC3_X_OFFSET_BASE,
+			.mmc_off = MMC_GMAC3_X_OFFSET_BASE,
+		},
+		.desc = NULL,
+		.dma = &dwmac100_dma_ops,
+		.mac = &dwmac100_ops,
+		.hwtimestamp = &tc956xmac_ptp,
+		.mode = NULL,
+		.tc = NULL,
+		.mmc = &dwmac_mmc_ops,
+		.setup = dwmac100_setup,
+		.quirks = tc956xmac_dwmac1_quirks,
+	}, {
+		.gmac = true,
+		.gmac4 = false,
+		.xgmac = false,
+		.min_id = 0,
+		.regs = {
+			.ptp_off = PTP_GMAC3_X_OFFSET_BASE,
+			.mmc_off = MMC_GMAC3_X_OFFSET_BASE,
+		},
+		.desc = NULL,
+		.dma = &dwmac1000_dma_ops,
+		.mac = &dwmac1000_ops,
+		.hwtimestamp = &tc956xmac_ptp,
+		.mode = NULL,
+		.tc = NULL,
+		.mmc = &dwmac_mmc_ops,
+		.setup = dwmac1000_setup,
+		.quirks = tc956xmac_dwmac1_quirks,
+	}, {
+		.gmac = false,
+		.gmac4 = true,
+		.xgmac = false,
+		.min_id = 0,
+		.regs = {
+			.ptp_off = PTP_GMAC4_OFFSET_BASE,
+			.mmc_off = MMC_GMAC4_OFFSET_BASE,
+		},
+		.desc = &dwmac4_desc_ops,
+		.dma = &dwmac4_dma_ops,
+		.mac = &dwmac4_ops,
+		.hwtimestamp = &tc956xmac_ptp,
+		.mode = NULL,
+		.tc = &dwmac510_tc_ops,
+		.mmc = &dwmac_mmc_ops,
+		.setup = dwmac4_setup,
+		.quirks = tc956xmac_dwmac4_quirks,
+	}, {
+		.gmac = false,
+		.gmac4 = true,
+		.xgmac = false,
+		.min_id = DWMAC_CORE_4_00,
+		.regs = {
+			.ptp_off = PTP_GMAC4_OFFSET_BASE,
+			.mmc_off = MMC_GMAC4_OFFSET_BASE,
+		},
+		.desc = &dwmac4_desc_ops,
+		.dma = &dwmac4_dma_ops,
+		.mac = &dwmac410_ops,
+		.hwtimestamp = &tc956xmac_ptp,
+		.mode = &dwmac4_ring_mode_ops,
+		.tc = &dwmac510_tc_ops,
+		.mmc = &dwmac_mmc_ops,
+		.setup = dwmac4_setup,
+		.quirks = NULL,
+	}, {
+		.gmac = false,
+		.gmac4 = true,
+		.xgmac = false,
+		.min_id = DWMAC_CORE_4_10,
+		.regs = {
+			.ptp_off = PTP_GMAC4_OFFSET_BASE,
+			.mmc_off = MMC_GMAC4_OFFSET_BASE,
+		},
+		.desc = &dwmac4_desc_ops,
+		.dma = &dwmac410_dma_ops,
+		.mac = &dwmac410_ops,
+		.hwtimestamp = &tc956xmac_ptp,
+		.mode = &dwmac4_ring_mode_ops,
+		.tc = &dwmac510_tc_ops,
+		.mmc = &dwmac_mmc_ops,
+		.setup = dwmac4_setup,
+		.quirks = NULL,
+	}, {
+		.gmac = false,
+		.gmac4 = true,
+		.xgmac = false,
+		.min_id = DWMAC_CORE_5_10,
+		.regs = {
+			.ptp_off = PTP_GMAC4_OFFSET_BASE,
+			.mmc_off = MMC_GMAC4_OFFSET_BASE,
+		},
+		.desc = &dwmac4_desc_ops,
+		.dma = &dwmac410_dma_ops,
+		.mac = &dwmac510_ops,
+		.hwtimestamp = &tc956xmac_ptp,
+		.mode = &dwmac4_ring_mode_ops,
+		.tc = &dwmac510_tc_ops,
+		.mmc = &dwmac_mmc_ops,
+		.setup = dwmac4_setup,
+		.quirks = NULL,
+	}, {
+#endif
+	{
+		.gmac = false,
+		.gmac4 = false,
+		.xgmac = true,
+		.min_id = DWXGMAC_CORE_3_01,
+		.regs = {
+			.ptp_off = PTP_XGMAC_OFFSET_BASE,
+			.mmc_off = MMC_XGMAC_OFFSET_BASE,
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+			.xpcs_off = XPCS_XGMAC_OFFSET,
+			.pma_off = PMA_XGMAC_OFFSET,
+#endif
+#endif
+		},
+		.desc = &dwxgmac210_desc_ops,
+		.dma = &dwxgmac210_dma_ops,
+		.mac = &dwxgmac210_ops,
+		.hwtimestamp = &tc956xmac_ptp,
+		.mode = NULL,
+		.tc = &dwmac510_tc_ops,
+		.mmc = &dwxgmac_mmc_ops,
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+		.pma = &tc956x_pma_ops,
+#endif
+#endif
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+		.msi = &tc956x_msigen_ops,
+		.rsc = &tc956xmac_rsc_mng_ops,
+#endif
+
+#if (defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)) | defined(TC956X_SRIOV_VF)
+		.mbx = &tc956xmac_mbx_ops,
+		.mbx_wrapper = &tc956xmac_mbx_wrapper_ops,
+#endif
+		.setup = dwxgmac2_setup,
+		.quirks = NULL,
+	},
+};
+
+int tc956xmac_hwif_init(struct tc956xmac_priv *priv)
+{
+	bool needs_xgmac = priv->plat->has_xgmac;
+	bool needs_gmac4 = priv->plat->has_gmac4;
+	bool needs_gmac = priv->plat->has_gmac;
+	const struct tc956xmac_hwif_entry *entry;
+	struct mac_device_info *mac;
+	bool needs_setup = true;
+	int i, ret;
+	u32 id;
+	u32 mac_offset_base = priv->port_num == RM_PF0_ID ?
+					MAC0_BASE_OFFSET : MAC1_BASE_OFFSET;
+
+	if (needs_gmac)
+		id = tc956xmac_get_id(priv, GMAC_VERSION);
+	else if (needs_gmac4 || needs_xgmac)
+		id = tc956xmac_get_id(priv, GMAC4_VERSION);
+	else
+		id = 0;
+
+	/* Save ID for later use */
+	priv->synopsys_id = id;
+
+	/* Lets assume some safe values first */
+	priv->ptpaddr = priv->ioaddr +
+		(needs_gmac4 ? PTP_GMAC4_OFFSET : PTP_GMAC3_X_OFFSET);
+	priv->mmcaddr = priv->ioaddr +
+		(needs_gmac4 ? MMC_GMAC4_OFFSET : MMC_GMAC3_X_OFFSET);
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+	priv->xpcsaddr = priv->ioaddr + XPCS_XGMAC_OFFSET;
+	priv->pmaaddr = priv->ioaddr + PMA_XGMAC_OFFSET;
+#endif
+#endif
+
+	/* Check for HW specific setup first */
+	if (priv->plat->setup) {
+		mac = priv->plat->setup(priv);
+		needs_setup = false;
+	} else {
+		mac = devm_kzalloc(priv->device, sizeof(*mac), GFP_KERNEL);
+	}
+
+	if (!mac)
+		return -ENOMEM;
+
+	/* Fallback to generic HW */
+	for (i = ARRAY_SIZE(tc956xmac_hw) - 1; i >= 0; i--) {
+		entry = &tc956xmac_hw[i];
+
+		if (needs_gmac ^ entry->gmac)
+			continue;
+		if (needs_gmac4 ^ entry->gmac4)
+			continue;
+		if (needs_xgmac ^ entry->xgmac)
+			continue;
+		/* Use synopsys_id var because some setups can override this */
+		if (priv->synopsys_id < entry->min_id)
+			continue;
+
+		/* Only use generic HW helpers if needed */
+		mac->desc = mac->desc ? : entry->desc;
+		mac->dma = mac->dma ? : entry->dma;
+		mac->mac = mac->mac ? : entry->mac;
+		mac->ptp = mac->ptp ? : entry->hwtimestamp;
+		mac->mode = mac->mode ? : entry->mode;
+		mac->tc = mac->tc ? : entry->tc;
+		mac->mmc = mac->mmc ? : entry->mmc;
+#ifndef TC956X_SRIOV_VF
+		mac->pma = mac->pma ? : entry->pma;
+#endif
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+		mac->msi = mac->msi ? : entry->msi;
+		mac->rsc = mac->rsc ? : entry->rsc;
+		mac->mbx = mac->mbx ? : entry->mbx;
+		mac->mbx_wrapper = mac->mbx_wrapper ? : entry->mbx_wrapper;
+#endif
+		priv->hw = mac;
+		priv->ptpaddr = priv->ioaddr + mac_offset_base + entry->regs.ptp_off;
+		priv->mmcaddr = priv->ioaddr + mac_offset_base + entry->regs.mmc_off;
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+		priv->xpcsaddr = priv->ioaddr + mac_offset_base + entry->regs.xpcs_off;
+		priv->pmaaddr = priv->ioaddr + mac_offset_base + entry->regs.pma_off;
+#endif
+#endif
+		/* Entry found */
+		if (needs_setup) {
+			ret = entry->setup(priv);
+			if (ret)
+				return ret;
+		}
+
+		/* Save quirks, if needed for posterior use */
+		priv->hwif_quirks = entry->quirks;
+		return 0;
+	}
+
+	dev_err(priv->device, "Failed to find HW IF (id=0x%x, gmac=%d/%d)\n",
+			id, needs_gmac, needs_gmac4);
+	return -EINVAL;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/hwif.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/hwif.h
@@ -0,0 +1,1104 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * hwif.h
+ *
+ * Copyright (C) 2018 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  14 Sep 2021 : 1. Synchronization between ethtool vlan features
+ *                   "rx-vlan-offload", "rx-vlan-filter", "tx-vlan-offload" output and register settings.
+ *                2. Added ethtool support to update "rx-vlan-offload", "rx-vlan-filter",
+ *                   and "tx-vlan-offload".
+ *                3. Removed IOCTL TC956XMAC_VLAN_STRIP_CONFIG.
+ *                4. Removed "Disable VLAN Filter" option in IOCTL TC956XMAC_VLAN_FILTERING.
+ *  VERSION     : 01-00-13
+ *  04 Nov 2021 : 1. Added separate control functons for MAC TX and RX start/stop
+ *  VERSION     : 01-00-20
+ *  26 Dec 2023 : 1. Added the support for TC commands taprio and flower
+ *  VERSION     : 01-03-59
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *  VERSION     : 04-00
+ */
+
+#ifndef __TC956XMAC_HWIF_H__
+#define __TC956XMAC_HWIF_H__
+
+#include <linux/netdevice.h>
+#include "tc956xmac_inc.h"
+#include <linux/version.h>
+
+#define tc956xmac_do_void_callback(__priv, __module, __cname,  __arg0, __args...) \
+({ \
+	int __result = -EINVAL; \
+	if ((__priv)->hw->__module && (__priv)->hw->__module->__cname) { \
+		(__priv)->hw->__module->__cname(__priv, (__arg0), ##__args); \
+		__result = 0; \
+	} \
+	__result; \
+})
+#define tc956xmac_do_callback(__priv, __module, __cname,  __arg0, __args...) \
+({ \
+	int __result = -EINVAL; \
+	if ((__priv)->hw->__module && (__priv)->hw->__module->__cname) \
+		__result = (__priv)->hw->__module->__cname(__priv, (__arg0), ##__args); \
+	__result; \
+})
+#define tc956xmac_do_void_no_param_callback(__priv, __module, __cname) \
+({ \
+	int __result = -EINVAL; \
+	if ((__priv)->hw->__module && (__priv)->hw->__module->__cname) { \
+		(__priv)->hw->__module->__cname(__priv); \
+		__result = 0; \
+	} \
+	__result; \
+})
+
+struct tc956xmac_priv;
+struct tc956xmac_extra_stats;
+struct tc956xmac_safety_stats;
+struct dma_desc;
+struct dma_extended_desc;
+struct dma_edesc;
+
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+struct fn_id;
+enum mbx_msg_fns;
+#endif
+
+/* Descriptors helpers */
+struct tc956xmac_desc_ops {
+	/* DMA RX descriptor ring initialization */
+	void (*init_rx_desc)(struct tc956xmac_priv *priv, struct dma_desc *p, int disable_rx_ic, int mode,
+			int end, int bfsize);
+	/* DMA TX descriptor ring initialization */
+	void (*init_tx_desc)(struct tc956xmac_priv *priv, struct dma_desc *p, int mode, int end);
+	/* Invoked by the xmit function to prepare the tx descriptor */
+	void (*prepare_tx_desc)(struct tc956xmac_priv *priv, struct dma_desc *p, int is_fs, int len,
+			bool csum_flag, u32 crc_pad, int mode, bool tx_own,
+			bool ls, unsigned int tot_pkt_len);
+	void (*prepare_tso_tx_desc)(struct tc956xmac_priv *priv, struct dma_desc *p, int is_fs, int len1,
+			int len2, bool tx_own, bool ls, unsigned int tcphdrlen,
+			unsigned int tcppayloadlen);
+	/* Set/get the owner of the descriptor */
+	void (*set_tx_owner)(struct tc956xmac_priv *priv, struct dma_desc *p);
+	int (*get_tx_owner)(struct tc956xmac_priv *priv, struct dma_desc *p);
+	/* Clean the tx descriptor as soon as the tx irq is received */
+	void (*release_tx_desc)(struct tc956xmac_priv *priv, struct dma_desc *p, int mode);
+	/*
+	 * Clear interrupt on tx frame completion. When this bit is
+	 * set an interrupt happens as soon as the frame is transmitted
+	 */
+	void (*set_tx_ic)(struct tc956xmac_priv *priv, struct dma_desc *p);
+	/* Last tx segment reports the transmit status */
+	int (*get_tx_ls)(struct tc956xmac_priv *priv, struct dma_desc *p);
+	/* Return the transmit status looking at the TDES1 */
+	int (*tx_status)(struct tc956xmac_priv *priv, void *data, struct tc956xmac_extra_stats *x,
+			struct dma_desc *p, void __iomem *ioaddr);
+	/* Get the buffer size from the descriptor */
+	int (*get_tx_len)(struct tc956xmac_priv *priv, struct dma_desc *p);
+	/* Handle extra events on specific interrupts hw dependent */
+	void (*set_rx_owner)(struct tc956xmac_priv *priv, struct dma_desc *p, int disable_rx_ic);
+	/* Get the receive frame size */
+	int (*get_rx_frame_len)(struct tc956xmac_priv *priv, struct dma_desc *p, int rx_coe_type);
+	/* Return the reception status looking at the RDES1 */
+	int (*rx_status)(struct tc956xmac_priv *priv, void *data, struct tc956xmac_extra_stats *x,
+			struct dma_desc *p);
+	void (*rx_extended_status)(struct tc956xmac_priv *priv, void *data, struct tc956xmac_extra_stats *x,
+			struct dma_extended_desc *p);
+	/* Set tx timestamp enable bit */
+	void (*enable_tx_timestamp)(struct tc956xmac_priv *priv, struct dma_desc *p);
+	/* get tx timestamp status */
+	int (*get_tx_timestamp_status)(struct tc956xmac_priv *priv, struct dma_desc *p);
+	/* get timestamp value */
+	void (*get_timestamp)(struct tc956xmac_priv *priv, void *desc, u32 ats, u64 *ts);
+	/* get rx timestamp status */
+	int (*get_rx_timestamp_status)(struct tc956xmac_priv *priv, void *desc, void *next_desc, u32 ats);
+	/* Display ring */
+	void (*display_ring)(struct tc956xmac_priv *priv, void *head, unsigned int size, bool rx);
+	/* set MSS via context descriptor */
+	void (*set_mss)(struct tc956xmac_priv *priv, struct dma_desc *p, unsigned int mss);
+	/* get descriptor skbuff address */
+	void (*get_addr)(struct tc956xmac_priv *priv, struct dma_desc *p, unsigned int *addr);
+	/* set descriptor skbuff address */
+	void (*set_addr)(struct tc956xmac_priv *priv, struct dma_desc *p, dma_addr_t addr);
+	/* clear descriptor */
+	void (*clear)(struct tc956xmac_priv *priv, struct dma_desc *p);
+	/* RSS */
+	int (*get_rx_hash)(struct tc956xmac_priv *priv, struct dma_desc *p, u32 *hash,
+			   enum pkt_hash_types *type);
+	int (*get_rx_header_len)(struct tc956xmac_priv *priv, struct dma_desc *p, unsigned int *len);
+	void (*set_sec_addr)(struct tc956xmac_priv *priv, struct dma_desc *p, dma_addr_t addr);
+	void (*set_sarc)(struct tc956xmac_priv *priv, struct dma_desc *p, u32 sarc_type);
+	void (*set_vlan_tag)(struct tc956xmac_priv *priv, struct dma_desc *p, u16 tag, u16 inner_tag,
+			     u32 inner_type);
+	void (*set_vlan)(struct tc956xmac_priv *priv, struct dma_desc *p, u32 type);
+	void (*set_tbs)(struct tc956xmac_priv *priv, struct dma_edesc *p, u32 sec, u32 nsec, bool lt_valid);
+	void (*set_ostc)(struct tc956xmac_priv *priv, struct dma_desc *p, u32 ttsh, u32 ttsl);
+};
+
+#define tc956xmac_init_rx_desc(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, init_rx_desc, __args)
+#define tc956xmac_init_tx_desc(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, init_tx_desc, __args)
+#define tc956xmac_prepare_tx_desc(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, prepare_tx_desc, __args)
+#define tc956xmac_prepare_tso_tx_desc(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, prepare_tso_tx_desc, __args)
+#define tc956xmac_set_tx_owner(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_tx_owner, __args)
+#define tc956xmac_get_tx_owner(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, get_tx_owner, __args)
+#define tc956xmac_release_tx_desc(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, release_tx_desc, __args)
+#define tc956xmac_set_tx_ic(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_tx_ic, __args)
+#define tc956xmac_get_tx_ls(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, get_tx_ls, __args)
+#define tc956xmac_tx_status(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, tx_status, __args)
+#define tc956xmac_get_tx_len(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, get_tx_len, __args)
+#define tc956xmac_set_rx_owner(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_rx_owner, __args)
+#define tc956xmac_get_rx_frame_len(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, get_rx_frame_len, __args)
+#define tc956xmac_rx_status(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, rx_status, __args)
+#define tc956xmac_rx_extended_status(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, rx_extended_status, __args)
+#define tc956xmac_enable_tx_timestamp(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, enable_tx_timestamp, __args)
+#define tc956xmac_get_tx_timestamp_status(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, get_tx_timestamp_status, __args)
+#define tc956xmac_get_timestamp(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, get_timestamp, __args)
+#define tc956xmac_get_rx_timestamp_status(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, get_rx_timestamp_status, __args)
+#define tc956xmac_display_ring(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, display_ring, __args)
+#define tc956xmac_set_mss(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_mss, __args)
+#define tc956xmac_get_desc_addr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, get_addr, __args)
+#define tc956xmac_set_desc_addr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_addr, __args)
+#define tc956xmac_clear_desc(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, clear, __args)
+#define tc956xmac_get_rx_hash(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, get_rx_hash, __args)
+#define tc956xmac_get_rx_header_len(__priv, __args...) \
+	tc956xmac_do_callback(__priv, desc, get_rx_header_len, __args)
+#define tc956xmac_set_desc_sec_addr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_sec_addr, __args)
+#define tc956xmac_set_desc_sarc(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_sarc, __args)
+#define tc956xmac_set_desc_vlan_tag(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_vlan_tag, __args)
+#define tc956xmac_set_desc_vlan(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_vlan, __args)
+#define tc956xmac_set_desc_tbs(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_tbs, __args)
+#define tc956xmac_set_desc_ostc(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, desc, set_ostc, __args)
+
+struct tc956xmac_dma_cfg;
+struct dma_features;
+
+/* Specific DMA helpers */
+struct tc956xmac_dma_ops {
+	/* DMA core initialization */
+	int (*reset)(struct tc956xmac_priv *priv, void __iomem *ioaddr);
+	void (*init)(struct tc956xmac_priv *priv, void __iomem *ioaddr, struct tc956xmac_dma_cfg *dma_cfg,
+		     int atds);
+	void (*init_chan)(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+			  struct tc956xmac_dma_cfg *dma_cfg, u32 chan);
+	void (*init_rx_chan)(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+			     struct tc956xmac_dma_cfg *dma_cfg,
+			     dma_addr_t phy, u32 chan);
+	void (*init_tx_chan)(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+			     struct tc956xmac_dma_cfg *dma_cfg,
+			     dma_addr_t phy, u32 chan);
+	/* Configure the AXI Bus Mode Register */
+	void (*axi)(struct tc956xmac_priv *priv, void __iomem *ioaddr, struct tc956xmac_axi *axi);
+	/* Dump DMA registers */
+	void (*dump_regs)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 *reg_space);
+	void (*dma_rx_mode)(struct tc956xmac_priv *priv, void __iomem *ioaddr, int mode, u32 channel,
+			    int fifosz, u8 qmode);
+	void (*dma_tx_mode)(struct tc956xmac_priv *priv, void __iomem *ioaddr, int mode, u32 channel,
+			    int fifosz, u8 qmode);
+	/* To track extra statistic (if supported) */
+	void (*dma_diagnostic_fr)(struct tc956xmac_priv *priv, void *data, struct tc956xmac_extra_stats *x,
+				   void __iomem *ioaddr);
+	void (*enable_dma_transmission)(struct tc956xmac_priv *priv, void __iomem *ioaddr);
+	void (*enable_dma_irq)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 chan,
+			       bool rx, bool tx);
+	void (*disable_dma_irq)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 chan,
+				bool rx, bool tx);
+	void (*start_tx)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 chan);
+	void (*stop_tx)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 chan);
+	void (*start_rx)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 chan);
+	void (*stop_rx)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 chan);
+	int (*dma_interrupt)(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+			      struct tc956xmac_extra_stats *x, u32 chan);
+	/* If supported then get the optional core features */
+	void (*get_hw_feature)(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+			       struct dma_features *dma_cap);
+	/* Program the HW RX Watchdog */
+	void (*rx_watchdog)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 riwt, u32 number_chan);
+	void (*set_tx_ring_len)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 len, u32 chan);
+	void (*set_rx_ring_len)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 len, u32 chan);
+	void (*set_rx_tail_ptr)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 tail_ptr, u32 chan);
+	void (*set_tx_tail_ptr)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 tail_ptr, u32 chan);
+	void (*enable_tso)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool en, u32 chan);
+	void (*qmode)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 channel, u8 qmode);
+	void (*set_bfsize)(struct tc956xmac_priv *priv, void __iomem *ioaddr, int bfsize, u32 chan);
+	void (*enable_sph)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool en, u32 chan);
+	int (*enable_tbs)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool en, u32 chan);
+	void (*desc_stats)(struct tc956xmac_priv *priv, void __iomem *ioaddr);
+};
+
+#define tc956xmac_reset(__priv, __args...) \
+	tc956xmac_do_callback(__priv, dma, reset, __args)
+#define tc956xmac_dma_init(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, init, __args)
+#define tc956xmac_init_chan(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, init_chan, __args)
+#define tc956xmac_init_rx_chan(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, init_rx_chan, __args)
+#define tc956xmac_init_tx_chan(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, init_tx_chan, __args)
+#define tc956xmac_axi(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, axi, __args)
+#define tc956xmac_dump_dma_regs(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, dump_regs, __args)
+#define tc956xmac_dma_rx_mode(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, dma_rx_mode, __args)
+#ifdef TC956X_SRIOV_PF
+#define tc956xmac_dma_tx_mode(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, dma_tx_mode, __args)
+#elif (defined TC956X_SRIOV_VF)
+#define tc956xmac_dma_tx_mode(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, dma_tx_mode, __args)
+#endif
+#define tc956xmac_dma_diagnostic_fr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, dma_diagnostic_fr, __args)
+#define tc956xmac_enable_dma_transmission(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, enable_dma_transmission, __args)
+#define tc956xmac_enable_dma_irq(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, enable_dma_irq, __args)
+#define tc956xmac_disable_dma_irq(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, disable_dma_irq, __args)
+#define tc956xmac_start_tx(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, start_tx, __args)
+#define tc956xmac_stop_tx(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, stop_tx, __args)
+#define tc956xmac_start_rx(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, start_rx, __args)
+#define tc956xmac_stop_rx(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, stop_rx, __args)
+#define tc956xmac_dma_interrupt_status(__priv, __args...) \
+	tc956xmac_do_callback(__priv, dma, dma_interrupt, __args)
+#define tc956xmac_get_hw_feature(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, get_hw_feature, __args)
+#define tc956xmac_rx_watchdog(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, rx_watchdog, __args)
+#define tc956xmac_set_tx_ring_len(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, set_tx_ring_len, __args)
+#define tc956xmac_set_rx_ring_len(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, set_rx_ring_len, __args)
+#define tc956xmac_set_rx_tail_ptr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, set_rx_tail_ptr, __args)
+#define tc956xmac_set_tx_tail_ptr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, set_tx_tail_ptr, __args)
+#define tc956xmac_enable_tso(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, enable_tso, __args)
+#define tc956xmac_dma_qmode(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, qmode, __args)
+#define tc956xmac_set_dma_bfsize(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, set_bfsize, __args)
+#define tc956xmac_enable_sph(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, enable_sph, __args)
+#define tc956xmac_enable_tbs(__priv, __args...) \
+	tc956xmac_do_callback(__priv, dma, enable_tbs, __args)
+#define tc956xmac_dma_desc_stats(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, dma, desc_stats, __args)
+
+struct mac_device_info;
+struct net_device;
+struct rgmii_adv;
+struct tc956xmac_safety_stats;
+struct tc956xmac_tc_entry;
+struct tc956xmac_pps_cfg;
+struct tc956xmac_rss;
+struct tc956xmac_est;
+struct tc956xmac_rx_parser_cfg;
+
+/* Helpers to program the MAC core */
+struct tc956xmac_ops {
+	/* MAC core initialization */
+	void (*core_init)(struct tc956xmac_priv *priv, struct mac_device_info *hw, struct net_device *dev);
+	/* Enable the MAC RX/TX */
+	void (*set_mac)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool enable);
+	/* Start/Stop the MAC TX */
+	void (*set_mac_tx)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool enable);
+	/* Start/Stop the MAC RX */
+	void (*set_mac_rx)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool enable);
+	/* Enable and verify that the IPC module is supported */
+	int (*rx_ipc)(struct tc956xmac_priv *priv, struct mac_device_info *hw);
+	/* Enable RX Queues */
+	void (*rx_queue_enable)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u8 mode, u32 queue);
+	/* RX Queues Priority */
+	void (*rx_queue_prio)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 prio, u32 queue);
+	/* TX Queues Priority */
+	void (*tx_queue_prio)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 prio, u32 queue);
+	/* RX Queues Routing */
+	void (*rx_queue_routing)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u8 packet,
+				 u32 queue);
+	/* Program RX Algorithms */
+	void (*prog_mtl_rx_algorithms)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 rx_alg);
+	/* Program TX Algorithms */
+	void (*prog_mtl_tx_algorithms)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 tx_alg);
+	/* Set MTL TX queues weight */
+	void (*set_mtl_tx_queue_weight)(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+					u32 weight, u32 tc);
+	/* RX MTL queue to RX dma mapping */
+	void (*map_mtl_to_dma)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 queue, u32 chan);
+	/* Configure AV Algorithm */
+	void (*config_cbs)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 send_slope,
+			   u32 idle_slope, u32 high_credit, u32 low_credit,
+			   u32 queue);
+	/* Dump MAC registers */
+	void (*dump_regs)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 *reg_space);
+	/* Handle extra events on specific interrupts hw dependent */
+	int (*host_irq_status)(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+			       struct tc956xmac_extra_stats *x);
+	/* Handle MTL interrupts */
+	int (*host_mtl_irq_status)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 chan);
+	/* Multicast filter setting */
+	void (*set_filter)(struct tc956xmac_priv *priv, struct mac_device_info *hw, struct net_device *dev);
+	/* Flow control setting */
+	void (*flow_ctrl)(struct tc956xmac_priv *priv, struct mac_device_info *hw, unsigned int duplex,
+			  unsigned int fc, unsigned int pause_time, u32 tx_cnt);
+	/* Set power management mode (e.g. magic frame) */
+	void (*pmt)(struct tc956xmac_priv *priv, struct mac_device_info *hw, unsigned long mode);
+	/* Set/Get Unicast MAC addresses */
+	void (*set_umac_addr)(struct tc956xmac_priv *priv, struct mac_device_info *hw, unsigned char *addr,
+			      unsigned int reg_n, unsigned int vf);
+	void (*get_umac_addr)(struct tc956xmac_priv *priv, struct mac_device_info *hw, unsigned char *addr,
+			      unsigned int reg_n);
+	void (*set_eee_mode)(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+			     bool en_tx_lpi_clockgating);
+	void (*reset_eee_mode)(struct tc956xmac_priv *priv, struct mac_device_info *hw);
+	void (*set_eee_timer)(struct tc956xmac_priv *priv, struct mac_device_info *hw, int ls, int tw);
+	void (*set_eee_pls)(struct tc956xmac_priv *priv, struct mac_device_info *hw, int link);
+	void (*debug)(struct tc956xmac_priv *priv, void __iomem *ioaddr, struct tc956xmac_extra_stats *x,
+		      u32 rx_queues, u32 tx_queues);
+	/* PCS calls */
+	void (*pcs_ctrl_ane)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool ane, bool srgmi_ral,
+			     bool loopback);
+	void (*pcs_rane)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool restart);
+	void (*pcs_get_adv_lp)(struct tc956xmac_priv *priv, void __iomem *ioaddr, struct rgmii_adv *adv);
+#ifdef TC956X
+	int (*xpcs_init)(struct tc956xmac_priv *priv, void __iomem *xpcsaddr);
+	void (*xpcs_ctrl_ane)(struct tc956xmac_priv *priv, bool ane);
+#endif
+	/* Safety Features */
+	int (*safety_feat_config)(struct tc956xmac_priv *priv, void __iomem *ioaddr, unsigned int asp);
+	int (*safety_feat_irq_status)(struct tc956xmac_priv *priv, struct net_device *ndev,
+			void __iomem *ioaddr, unsigned int asp,
+			struct tc956xmac_safety_stats *stats);
+	int (*safety_feat_dump)(struct tc956xmac_priv *priv, struct tc956xmac_safety_stats *stats,
+			int index, unsigned long *count, const char **desc);
+	/* Flexible RX Parser */
+	int (*rxp_config)(struct tc956xmac_priv *priv, void __iomem *ioaddr, struct tc956xmac_tc_entry *entries,
+			  unsigned int count);
+	int (*rx_parser_init)(struct tc956xmac_priv *priv, struct net_device *ndev,
+			struct mac_device_info *hw, unsigned int spram,
+			unsigned int frpsel, unsigned int frpes,
+			struct tc956xmac_rx_parser_cfg *cnf);
+	/* Flexible PPS */
+	int (*flex_pps_config)(struct tc956xmac_priv *priv, void __iomem *ioaddr, int index,
+			       struct tc956xmac_pps_cfg *cfg, bool enable,
+			       u32 sub_second_inc, u32 systime_flags);
+	/* Loopback for selftests */
+	void (*set_mac_loopback)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool enable);
+	/* RSS */
+	int (*rss_configure)(struct tc956xmac_priv *priv, struct mac_device_info *hw,
+			     struct tc956xmac_rss *cfg, u32 num_rxq);
+	/* VLAN */
+	void (*update_vlan_hash)(struct tc956xmac_priv *priv, struct net_device *dev, bool is_double, u16 vid,
+				u16 vf);
+
+	void (*delete_vlan)(struct tc956xmac_priv *priv, struct net_device *dev, u16 vid,
+				u16 vf);
+	void (*enable_vlan)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 type);
+#ifdef TC956X
+	void (*disable_tx_vlan)(struct tc956xmac_priv *priv, struct mac_device_info *hw);
+	void (*enable_rx_vlan_stripping)(struct tc956xmac_priv *priv, struct mac_device_info *hw);
+	void (*disable_rx_vlan_stripping)(struct tc956xmac_priv *priv, struct mac_device_info *hw);
+	void (*enable_rx_vlan_filtering)(struct tc956xmac_priv *priv, struct mac_device_info *hw);
+	void (*disable_rx_vlan_filtering)(struct tc956xmac_priv *priv, struct mac_device_info *hw);
+#endif
+	/* TX Timestamp */
+	int (*get_mac_tx_timestamp)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u64 *ts);
+	/* Source Address Insertion / Replacement */
+	void (*sarc_configure)(struct tc956xmac_priv *priv, void __iomem *ioaddr, int val);
+	/* Filtering */
+	int (*config_l3_filter)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 filter_no,
+				bool en, bool ipv6, bool sa, bool inv,
+				u32 match);
+	int (*config_l4_filter)(struct tc956xmac_priv *priv, struct mac_device_info *hw, u32 filter_no,
+				bool en, bool udp, bool sa, bool inv,
+				u32 match);
+	void (*set_arp_offload)(struct tc956xmac_priv *priv, struct mac_device_info *hw, bool en, u32 addr);
+	int (*est_configure)(struct tc956xmac_priv *priv, void __iomem *ioaddr, struct tc956xmac_est *cfg,
+			     unsigned int ptp_rate);
+	void (*fpe_configure)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 num_txq, u32 num_rxq,
+			      bool enable);
+	void (*set_ptp_offload)(struct tc956xmac_priv *priv, void __iomem *ioaddr, bool en);
+	void (*jumbo_en)(struct tc956xmac_priv *priv, struct net_device *dev, u32 en);
+};
+
+#define tc956xmac_core_init(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, core_init, __args)
+#define tc956xmac_mac_set(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_mac, __args)
+#define tc956xmac_mac_set_tx(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_mac_tx, __args)
+#define tc956xmac_mac_set_rx(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_mac_rx, __args)
+#define tc956xmac_rx_ipc(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, rx_ipc, __args)
+#define tc956xmac_rx_queue_enable(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, rx_queue_enable, __args)
+#define tc956xmac_rx_queue_prio(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, rx_queue_prio, __args)
+#ifdef TC956X_SRIOV_PF
+#define tc956xmac_tx_queue_prio(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, tx_queue_prio, __args)
+#elif (defined TC956X_SRIOV_VF)
+#define tc956xmac_tx_queue_prio(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, tx_queue_prio, __args)
+#endif
+#define tc956xmac_rx_queue_routing(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, rx_queue_routing, __args)
+#define tc956xmac_prog_mtl_rx_algorithms(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, prog_mtl_rx_algorithms, __args)
+#define tc956xmac_prog_mtl_tx_algorithms(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, prog_mtl_tx_algorithms, __args)
+#ifdef TC956X_SRIOV_PF
+#define tc956xmac_set_mtl_tx_queue_weight(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_mtl_tx_queue_weight, __args)
+#elif (defined TC956X_SRIOV_VF)
+#define tc956xmac_set_mtl_tx_queue_weight(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, set_mtl_tx_queue_weight, __args)
+#endif
+
+#define tc956xmac_map_mtl_to_dma(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, map_mtl_to_dma, __args)
+#ifdef TC956X_SRIOV_PF
+#define tc956xmac_config_cbs(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, config_cbs, __args)
+#elif defined TC956X_SRIOV_VF
+#define tc956xmac_config_cbs(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, config_cbs, __args)
+#endif
+
+#ifdef TC956X_SRIOV_VF
+#define tc956x_phy_link(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, phy_link, __args)
+#define tc956x_setup_mbx_etf(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, setup_mbx_etf, __args)
+#define tc956x_get_drv_cap(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, get_drv_cap, __args)
+#define tc956x_rx_crc(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, rx_crc, __args)
+#define tc956x_rx_dma_ch_tlptr(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, rx_dma_ch_tlptr, __args)
+#define tc956x_rx_dma_err(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, rx_dma_err, __args)
+#define tc956x_rx_csum(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, rx_csum, __args)
+#define tc956x_mbx_flr(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, pf_flr, __args)
+#endif
+
+#define tc956xmac_dump_mac_regs(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, dump_regs, __args)
+#define tc956xmac_host_irq_status(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, host_irq_status, __args)
+#define tc956xmac_host_mtl_irq_status(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, host_mtl_irq_status, __args)
+#define tc956xmac_set_filter(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_filter, __args)
+#define tc956xmac_flow_ctrl(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, flow_ctrl, __args)
+#define tc956xmac_pmt(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, pmt, __args)
+#ifdef TC956X_SRIOV_PF
+#define tc956xmac_set_umac_addr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_umac_addr, __args)
+#elif (defined TC956X_SRIOV_VF)
+#define tc956xmac_set_umac_addr(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, set_umac_addr, __args)
+#endif
+#ifdef TC956X_SRIOV_PF
+#define tc956xmac_get_umac_addr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, get_umac_addr, __args)
+#elif (defined TC956X_SRIOV_VF)
+#define tc956xmac_get_umac_addr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, get_umac_addr, __args)
+#endif
+#define tc956xmac_set_eee_mode(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_eee_mode, __args)
+#ifdef TC956X_SRIOV_VF
+#define tc956xmac_reset_eee_mode(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, reset_eee_mode, __args)
+#else
+#define tc956xmac_reset_eee_mode(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, reset_eee_mode, __args)
+#endif
+#define tc956xmac_set_eee_timer(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_eee_timer, __args)
+#define tc956xmac_set_eee_pls(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_eee_pls, __args)
+#define tc956xmac_mac_debug(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, debug, __args)
+#ifdef TC956X
+#define tc956xmac_xpcs_init(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mac, xpcs_init, __args)
+#define tc956xmac_xpcs_ctrl_ane(__priv, __args...) \
+		tc956xmac_do_void_callback(__priv, mac, xpcs_ctrl_ane, __args)
+#endif
+#define tc956xmac_pcs_ctrl_ane(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, pcs_ctrl_ane, __args)
+#define tc956xmac_pcs_rane(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, pcs_rane, __args)
+#define tc956xmac_pcs_get_adv_lp(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, pcs_get_adv_lp, __args)
+#define tc956xmac_safety_feat_config(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, safety_feat_config, __args)
+#define tc956xmac_safety_feat_irq_status(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, safety_feat_irq_status, __args)
+#define tc956xmac_safety_feat_dump(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, safety_feat_dump, __args)
+#define tc956xmac_rxp_config(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, rxp_config, __args)
+#define tc956xmac_rx_parser_init(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, rx_parser_init, __args)
+#define tc956xmac_flex_pps_config(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, flex_pps_config, __args)
+#define tc956xmac_set_mac_loopback(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_mac_loopback, __args)
+#define tc956xmac_rss_configure(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, rss_configure, __args)
+#define tc956xmac_update_vlan_hash(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, update_vlan_hash, __args)
+#ifdef TC956X_SRIOV_PF
+#define tc956xmac_delete_vlan(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, delete_vlan, __args)
+#else //TC956X_SRIOV_PF
+#define tc956xmac_delete_vlan(__priv, __args...) \
+			tc956xmac_do_void_callback(__priv, mbx_wrapper, delete_vlan, __args)
+#endif
+#define tc956xmac_enable_vlan(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, enable_vlan, __args)
+#ifdef TC956X
+#define tc956xmac_disable_tx_vlan(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, disable_tx_vlan, __args)
+#define tc956xmac_enable_rx_vlan_stripping(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, enable_rx_vlan_stripping, __args)
+#define tc956xmac_disable_rx_vlan_stripping(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, disable_rx_vlan_stripping, __args)
+#define tc956xmac_enable_rx_vlan_filtering(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, enable_rx_vlan_filtering, __args)
+#define tc956xmac_disable_rx_vlan_filtering(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, disable_rx_vlan_filtering, __args)
+#endif
+#define tc956xmac_get_mac_tx_timestamp(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, get_mac_tx_timestamp, __args)
+#define tc956xmac_sarc_configure(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, sarc_configure, __args)
+#define tc956xmac_config_l3_filter(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, config_l3_filter, __args)
+#define tc956xmac_config_l4_filter(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, config_l4_filter, __args)
+#define tc956xmac_set_arp_offload(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_arp_offload, __args)
+#define tc956xmac_est_configure(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mac, est_configure, __args)
+#define tc956xmac_fpe_configure(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, fpe_configure, __args)
+#define tc956xmac_set_ptp_offload(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, set_ptp_offload, __args)
+#define tc956xmac_jumbo_en(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mac, jumbo_en, __args)
+#ifdef TC956X_SRIOV_VF
+#define tc956xmac_get_speed(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mbx_wrapper, get_speed, __args)
+#define tc956xmac_get_est(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mbx_wrapper, get_est, __args)
+#define tc956xmac_set_est(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mbx_wrapper, set_est, __args)
+#define tc956xmac_get_rxp(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mbx_wrapper, get_rxp, __args)
+#define tc956xmac_set_rxp(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mbx_wrapper, set_rxp, __args)
+#define tc956xmac_get_fpe(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mbx_wrapper, get_fpe, __args)
+#define tc956xmac_set_fpe(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mbx_wrapper, set_fpe, __args)
+#define tc956xmac_reg_wr(__priv, __args...) \
+			tc956xmac_do_callback(__priv, mbx_wrapper, reg_wr, __args)
+
+#define tc956xmac_get_cbs(__priv, __args...) \
+			tc956xmac_do_callback(__priv, mbx_wrapper, get_cbs, __args)
+
+#define tc956xmac_set_cbs(__priv, __args...) \
+			tc956xmac_do_callback(__priv, mbx_wrapper, set_cbs, __args)
+
+#define tc956xmac_ethtool_get_pauseparam(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, get_pause_param, __args)
+
+#define tc956xmac_ethtool_get_eee(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, get_eee, __args)
+
+
+#define tc956xmac_add_mac(__priv, __args...) \
+			tc956xmac_do_callback(__priv, mbx_wrapper, add_mac, __args)
+
+#define tc956xmac_delete_mac(__priv, __args...) \
+			tc956xmac_do_void_callback(__priv, mbx_wrapper, delete_mac, __args)
+
+#define tc956xmac_add_vlan(__priv, __args...) \
+			tc956xmac_do_void_callback(__priv, mbx_wrapper, add_vlan, __args)
+#endif
+#ifdef TC956X_SRIOV_VF
+#define tc956xmac_get_link_status(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, get_link_status, __args)
+
+#define tc956xmac_vf_reset(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, vf_reset, __args)
+#endif
+/* PTP and HW Timer helpers */
+struct tc956xmac_hwtimestamp {
+	void (*config_hw_tstamping)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 data);
+	void (*config_sub_second_increment)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 ptp_clock,
+					   int gmac4, u32 *ssinc);
+	int (*init_systime)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 sec, u32 nsec);
+	int (*config_addend)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 addend);
+	int (*adjust_systime)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 sec, u32 nsec,
+			       int add_sub, int gmac4);
+	void (*get_systime)(struct tc956xmac_priv *priv, void __iomem *ioaddr, u64 *systime);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,13,0)
+	void (*get_ptptime)(void __iomem *ioaddr, u64 *ptp_time);
+	void (*timestamp_interrupt)(struct tc956xmac_priv *priv, void __iomem *ioaddr);
+#endif
+};
+
+#define tc956xmac_config_hw_tstamping(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, ptp, config_hw_tstamping, __args)
+#define tc956xmac_config_sub_second_increment(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, ptp, config_sub_second_increment, __args)
+#define tc956xmac_init_systime(__priv, __args...) \
+	tc956xmac_do_callback(__priv, ptp, init_systime, __args)
+#define tc956xmac_config_addend(__priv, __args...) \
+	tc956xmac_do_callback(__priv, ptp, config_addend, __args)
+#define tc956xmac_adjust_systime(__priv, __args...) \
+	tc956xmac_do_callback(__priv, ptp, adjust_systime, __args)
+#define tc956xmac_get_systime(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, ptp, get_systime, __args)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,13,0)
+#define tc956xmac_timestamp_interrupt(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, ptp, timestamp_interrupt, __args)
+#endif
+
+/* Helpers to manage the descriptors for chain and ring modes */
+struct tc956xmac_mode_ops {
+	void (*init)(struct tc956xmac_priv *priv, void *des, dma_addr_t phy_addr, unsigned int size,
+		      unsigned int extend_desc);
+	unsigned int (*is_jumbo_frm)(struct tc956xmac_priv *priv, int len, int ehn_desc);
+	int (*jumbo_frm)(struct tc956xmac_priv *priv, void *priv_ptr, struct sk_buff *skb, int csum);
+	int (*set_16kib_bfsize)(struct tc956xmac_priv *priv, int mtu);
+	void (*init_desc3)(struct tc956xmac_priv *priv, struct dma_desc *p);
+	void (*refill_desc3)(struct tc956xmac_priv *priv, void *priv_ptr, struct dma_desc *p);
+	void (*clean_desc3)(struct tc956xmac_priv *priv, void *priv_ptr, struct dma_desc *p);
+};
+
+#define tc956xmac_mode_init(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mode, init, __args)
+#define tc956xmac_is_jumbo_frm(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mode, is_jumbo_frm, __args)
+#define tc956xmac_jumbo_frm(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mode, jumbo_frm, __args)
+#define tc956xmac_set_16kib_bfsize(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mode, set_16kib_bfsize, __args)
+#define tc956xmac_init_desc3(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mode, init_desc3, __args)
+#define tc956xmac_refill_desc3(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mode, refill_desc3, __args)
+#define tc956xmac_clean_desc3(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mode, clean_desc3, __args)
+
+#ifdef TC956X_SRIOV_PF
+struct tc956xmac_priv;
+#endif
+struct tc_cls_u32_offload;
+struct tc_cbs_qopt_offload;
+struct flow_cls_offload;
+struct tc_taprio_qopt_offload;
+struct tc_etf_qopt_offload;
+struct tc_query_caps_base;
+
+struct tc956xmac_tc_ops {
+	int (*init)(struct tc956xmac_priv *priv, void *data);
+	int (*setup_cls_u32)(struct tc956xmac_priv *priv,
+			     struct tc_cls_u32_offload *cls);
+	int (*setup_cbs)(struct tc956xmac_priv *priv,
+			 struct tc_cbs_qopt_offload *qopt);
+	int (*setup_cls)(struct tc956xmac_priv *priv,
+			 struct flow_cls_offload *cls);
+	int (*setup_taprio)(struct tc956xmac_priv *priv,
+			    struct tc_taprio_qopt_offload *qopt);
+	int (*setup_etf)(struct tc956xmac_priv *priv,
+			 struct tc_etf_qopt_offload *qopt);
+	int (*query_caps)(struct tc956xmac_priv *priv,
+			 struct tc_query_caps_base *base);
+};
+
+#define tc956xmac_tc_init(__priv, __args...) \
+	tc956xmac_do_callback(__priv, tc, init, __args)
+#define tc956xmac_tc_setup_cls_u32(__priv, __args...) \
+	tc956xmac_do_callback(__priv, tc, setup_cls_u32, __args)
+#ifdef TC956X_SRIOV_PF
+#define tc956xmac_tc_setup_cbs(__priv, __args...) \
+	tc956xmac_do_callback(__priv, tc, setup_cbs, __args)
+#elif (defined TC956X_SRIOV_VF)
+#define tc956xmac_tc_setup_cbs(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx_wrapper, setup_cbs, __args)
+#endif
+#define tc956xmac_tc_setup_cls(__priv, __args...) \
+	tc956xmac_do_callback(__priv, tc, setup_cls, __args)
+#define tc956xmac_tc_setup_taprio(__priv, __args...) \
+	tc956xmac_do_callback(__priv, tc, setup_taprio, __args)
+#define tc956xmac_tc_setup_etf(__priv, __args...) \
+	tc956xmac_do_callback(__priv, tc, setup_etf, __args)
+#if LINUX_VERSION_CODE > KERNEL_VERSION(6,2,16)
+#define tc956xmac_tc_setup_query_cap(__priv, __args...) \
+	tc956xmac_do_callback(__priv, tc, query_caps, __args)
+#endif
+
+struct tc956xmac_counters;
+
+struct tc956xmac_mmc_ops {
+	void (*ctrl)(struct tc956xmac_priv *priv, void __iomem *ioaddr, unsigned int mode);
+	void (*intr_all_mask)(struct tc956xmac_priv *priv, void __iomem *ioaddr);
+	void (*read)(struct tc956xmac_priv *priv, void __iomem *ioaddr, struct tc956xmac_counters *mmc);
+};
+
+#define tc956xmac_mmc_ctrl(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mmc, ctrl, __args)
+#define tc956xmac_mmc_intr_all_mask(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mmc, intr_all_mask, __args)
+#define tc956xmac_mmc_read(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mmc, read, __args)
+
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+struct mac_rsc_mng_ops {
+#ifdef TC956X_SRIOV_VF
+	int (*init)(struct tc956xmac_priv *priv, struct net_device *dev);
+#endif
+	int (*get_fn_id)(struct tc956xmac_priv *priv, void __iomem *reg_pci_bridge_config_addr, struct fn_id *fn_id_info);
+	/*rscs[4] = {PFx_DMA_bit_pattern, VF0_DMA_bit_pattern, VF1_DMA_bit_pattern, VF2_DMA_bit_pattern}*/
+	void (*set_rscs)(struct tc956xmac_priv *priv, struct net_device *dev, u8 *rscs);
+	/*resource allocated rscs - bit pattern [DMA7 bit-7] ... ... ... [DMA0 bit-0]*/
+	void (*get_rscs)(struct tc956xmac_priv *priv, struct net_device *dev, u8 *rscs);
+};
+#endif
+
+#ifdef TC956X_SRIOV_VF
+#define tc956xmac_rsc_mng_init(__priv, __args...) \
+	tc956xmac_do_callback(__priv, rsc, init, __args)
+#endif
+#define tc956xmac_rsc_mng_get_fn_id(__priv, __args...) \
+	tc956xmac_do_callback(__priv, rsc, get_fn_id, __args)
+#define tc956xmac_rsc_mng_set_rscs(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, rsc, set_rscs, __args)
+#define tc956xmac_rsc_mng_get_rscs(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, rsc, get_rscs, __args)
+
+#ifdef TC956X_SRIOV_VF
+/* Specific mailbox helpers */
+struct tc956xmac_mbx_wrapper_ops {
+	void (*dma_tx_mode)(struct tc956xmac_priv *priv, int mode, u32 channel,
+			    int fifosz, u8 qmode);
+	void (*get_umac_addr)(struct tc956xmac_priv *priv, unsigned char *addr,
+			      unsigned int reg_n);
+	int (*set_umac_addr)(struct tc956xmac_priv *priv, unsigned char *addr,
+			      unsigned int reg_n);
+	/* Set MTL TX queues weight */
+	void (*set_mtl_tx_queue_weight)(struct tc956xmac_priv *priv,
+					u32 weight, u32 traffic_class);
+	/* Configure AV Algorithm */
+	void (*config_cbs)(struct tc956xmac_priv *priv, u32 send_slope,
+			   u32 idle_slope, u32 high_credit, u32 low_credit,
+			   u32 queue);
+	int (*setup_cbs)(struct tc956xmac_priv *priv, struct tc_cbs_qopt_offload *qopt);
+	/* TX Queues Priority */
+	void (*tx_queue_prio)(struct tc956xmac_priv *priv, u32 prio, u32 queue);
+	/* Get PF link status */
+	void (*get_link_status)(struct tc956xmac_priv *priv, u32 *link_status,
+				u32 *speed, u32 *duplex);
+	/* PHY Link state change from PF */
+	int (*phy_link)(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg);
+	int (*setup_mbx_etf)(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg);
+	/* Get driver Capabilities from PF */
+	void (*get_drv_cap)(struct tc956xmac_priv *priv, struct tc956xmac_priv *priv1);
+	void (*reset_eee_mode)(struct tc956xmac_priv *priv, struct mac_device_info *hw);
+	void (*vf_reset)(struct tc956xmac_priv *priv, u8 vf_status);
+	/* Rx CRC state update from PF */
+	int (*rx_crc)(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg);
+	int (*rx_dma_ch_tlptr)(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg);
+	int (*rx_dma_err)(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg);
+	/* Rx checksum state update from PF */
+	int (*rx_csum)(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg);
+	int (*pf_flr)(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg);
+	int (*get_cbs)(struct tc956xmac_priv *priv, void __user *data);
+	int (*set_cbs)(struct tc956xmac_priv *priv, void __user *data);
+	int (*get_est)(struct tc956xmac_priv *priv,	void __user *data);
+	int (*set_est)(struct tc956xmac_priv *priv,	void __user *data);
+	int (*get_rxp)(struct tc956xmac_priv *priv,	void __user *data);
+	int (*set_rxp)(struct tc956xmac_priv *priv,	void __user *data);
+	int (*get_fpe)(struct tc956xmac_priv *priv, void __user *data);
+	int (*set_fpe)(struct tc956xmac_priv *priv, void __user *data);
+	int (*get_speed)(struct tc956xmac_priv *priv, void __user *data);
+	int (*reg_wr)(struct tc956xmac_priv *priv, void __user *data);
+	int (*get_pause_param)(struct tc956xmac_priv *priv, struct ethtool_pauseparam *pause);
+	int (*get_eee)(struct tc956xmac_priv *priv,  struct ethtool_eee *edata);
+	int (*get_ts_info)(struct tc956xmac_priv *priv, struct ethtool_ts_info *info);
+	int (*add_mac)(struct tc956xmac_priv *priv,  const u8 *mac);
+	void (*delete_mac)(struct tc956xmac_priv *priv, const u8 *mac);
+	void (*delete_vlan)(struct tc956xmac_priv *priv, u16 vid);
+	void (*add_vlan)(struct tc956xmac_priv *priv, u16 vid);
+};
+#endif
+
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+struct mac_mbx_ops {
+	void (*init)(struct tc956xmac_priv *priv, void *data);
+	int (*read)(struct tc956xmac_priv *priv, u8 *msg_buff,
+		enum mbx_msg_fns msg_src, struct fn_id *fn_id_info);
+	int (*write)(struct tc956xmac_priv *priv, u8 *msg_buff,
+		enum mbx_msg_fns msg_dst, struct fn_id *fn_id_info);
+	void (*send_ack)(struct tc956xmac_priv *priv, u8 *msg_buff,
+		enum mbx_msg_fns msg_dst, struct fn_id *fn_id_info);
+	/* normally interrupt method is used.
+	 * But for ACK/NACK checking this can be used.
+	 */
+	int (*poll_for_ack)(struct tc956xmac_priv *priv, enum mbx_msg_fns msg_src);
+};
+
+#define tc956xmac_mbx_init(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx, init, __args)
+#define tc956xmac_mbx_read(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx, read, __args)
+#define tc956xmac_mbx_write(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx, write, __args)
+#define tc956xmac_mbx_send_ack(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, mbx, send_ack, __args)
+#define tc956xmac_mbx_poll_for_ack(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx, poll_for_ack, __args)
+#endif /* #ifdef TC956X_SRIOV_PF/VF */
+
+#ifdef TC956X_SRIOV_PF
+
+struct tc956x_msi_ops {
+	void (*init)(struct tc956xmac_priv *priv, struct net_device *dev);
+	void (*interrupt_en)(struct tc956xmac_priv *priv, struct net_device *dev, u32 en);
+	void (*interrupt_clr)(struct tc956xmac_priv *priv, struct net_device *dev, u32 vector);
+};
+
+#define tc956x_msi_init(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, msi, init, __args)
+#define tc956x_msi_intr_en(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, msi, interrupt_en, __args)
+#define tc956x_msi_intr_clr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, msi, interrupt_clr, __args)
+
+/* Specific mailbox helpers */
+struct tc956x_mbx_wrapper_ops {
+	void (*phy_link)(struct tc956xmac_priv *priv);
+	int (*set_dma_tx_mode)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff);
+	int (*set_mtl_tx_queue_weight)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff);
+	int (*config_cbs)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff);
+	int (*setup_cbs)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff);
+	int (*setup_mbx_etf)(struct tc956xmac_priv *priv, u32 ch, u8 vf);
+	int (*tx_queue_prio)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff);
+	int (*vf_get_link_status)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff);
+	void (*rx_crc)(struct tc956xmac_priv *priv);
+	void (*rx_csum)(struct tc956xmac_priv *priv);
+	void (*pf_flr)(struct tc956xmac_priv *priv);
+	int (*reset_eee_mode)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff);
+	int (*get_umac_addr)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff);
+	int (*set_umac_addr)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff, u8 vf_no);
+	int (*vf_reset)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff, u8 vf_no);
+	int (*get_drv_cap)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff);
+	int (*vf_ioctl)(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff, u8 vf_no);
+	int (*vf_ethtool)(struct tc956xmac_priv *priv, struct net_device *dev, u8 *mbx_buff, u8 *ack_buff);
+	int (*add_mac)(struct tc956xmac_priv *priv, struct net_device *dev, u8 *mbx_buff, u8 *ack_buff, u8 vf_no);
+	int (*delete_mac)(struct tc956xmac_priv *priv, struct net_device *dev, u8 *mbx_buff, u8 *ack_buff, u8 vf_no);
+	int (*add_vlan)(struct tc956xmac_priv *priv, struct net_device *dev, u8 *mbx_buff, u8 *ack_buff, u8 vf_no);
+	int (*delete_vlan)(struct tc956xmac_priv *priv, struct net_device *dev, u8 *mbx_buff, u8 *ack_buff, u8 vf_no);
+	int (*rx_dma_ch_tlptr)(struct tc956xmac_priv *priv, u32 ch, u8 vf_no);
+	int (*rx_dma_err)(struct tc956xmac_priv *priv, u8 vf_no);
+};
+
+#define tc956x_mbx_wrap_phy_link(__priv) \
+	tc956xmac_do_void_no_param_callback(__priv, mbx_wrapper, phy_link)
+#define tc956x_mbx_wrap_set_dma_tx_mode(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, set_dma_tx_mode, __args)
+#define tc956x_mbx_wrap_set_mtl_tx_queue_weight(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, set_mtl_tx_queue_weight, __args)
+#define tc956x_mbx_wrap_config_cbs(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, config_cbs, __args)
+#define tc956x_mbx_wrap_setup_cbs(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, setup_cbs, __args)
+#define tc956x_mbx_wrap_setup_etf(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, setup_mbx_etf, __args)
+#define tc956x_mbx_wrap_tx_queue_prior(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, tx_queue_prio, __args)
+#define tc956x_mbx_wrap_get_link_status(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, vf_get_link_status, __args)
+#define tc956x_mbx_wrap_set_rx_crc(__priv, __args...) \
+	tc956xmac_do_void_no_param_callback(__priv, mbx_wrapper, rx_crc)
+#define tc956x_mbx_wrap_set_rx_csum(__priv, __args...) \
+	tc956xmac_do_void_no_param_callback(__priv, mbx_wrapper, rx_csum)
+#define tc956x_mbx_wrap_pf_flr(__priv, __args...) \
+	tc956xmac_do_void_no_param_callback(__priv, mbx_wrapper, pf_flr)
+#define tc956x_mbx_wrap_rx_dma_ch_tlptr(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, rx_dma_ch_tlptr, __args)
+#define tc956x_mbx_wrap_rx_dma_err(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, rx_dma_err, __args)
+#define tc956x_mbx_wrap_reset_eee_mode(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, reset_eee_mode, __args)
+#define tc956x_mbx_wrap_get_umac_addr(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, get_umac_addr, __args)
+#define tc956x_mbx_wrap_set_umac_addr(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, set_umac_addr, __args)
+#define tc956x_mbx_wrap_get_drv_cap(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, get_drv_cap, __args)
+#define tc956x_mbx_wrap_vf_reset(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, vf_reset, __args)
+#define tc956xmac_mbx_ioctl_interface(__priv, __args...) \
+	tc956xmac_do_callback(__priv, mbx_wrapper, vf_ioctl, __args)
+#define tc956xmac_mbx_ethtool_interface(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mbx_wrapper, vf_ethtool, __args)
+
+#define tc956xmac_mbx_add_mac(__priv, __args...) \
+		tc956xmac_do_callback(__priv, mbx_wrapper, add_mac, __args)
+#define tc956xmac_mbx_delete_mac(__priv, __args...) \
+			tc956xmac_do_callback(__priv, mbx_wrapper, delete_mac, __args)
+#define tc956xmac_mbx_add_vlan(__priv, __args...) \
+			tc956xmac_do_callback(__priv, mbx_wrapper, add_vlan, __args)
+#define tc956xmac_mbx_delete_vlan(__priv, __args...) \
+				tc956xmac_do_callback(__priv, mbx_wrapper, delete_vlan, __args)
+
+#endif /* TC956X_SRIOV_PF */
+
+#ifdef TC956X
+/*PMA module*/
+struct tc956xmac_pma_ops {
+	int (*init)(struct tc956xmac_priv *priv, void __iomem *pmaaddr);
+};
+
+#define tc956x_pma_setup(__priv, __args...) \
+	tc956xmac_do_callback(__priv, pma, init, __args)
+
+#endif
+
+struct tc956xmac_regs_off {
+	u32 ptp_off;
+	u32 mmc_off;
+#ifdef TC956X
+	u32 xpcs_off;
+	u32 pma_off;
+#endif
+};
+
+#ifdef TC956X_SRIOV_VF
+struct tc956x_msi_ops {
+	void (*init)(struct tc956xmac_priv *priv, struct net_device *dev, struct fn_id *fn_id_info);
+	void (*interrupt_en)(struct tc956xmac_priv *priv, struct net_device *dev, u32 en, struct fn_id *fn_id_info);
+	void (*interrupt_clr)(struct tc956xmac_priv *priv, struct net_device *dev, u32 vector, struct fn_id *fn_id_info);
+};
+
+#define tc956x_msi_init(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, msi, init, __args)
+#define tc956x_msi_intr_en(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, msi, interrupt_en, __args)
+#define tc956x_msi_intr_clr(__priv, __args...) \
+	tc956xmac_do_void_callback(__priv, msi, interrupt_clr, __args)
+#endif
+
+extern const struct tc956xmac_ops dwmac100_ops;
+extern const struct tc956xmac_dma_ops dwmac100_dma_ops;
+extern const struct tc956xmac_ops dwmac1000_ops;
+extern const struct tc956xmac_dma_ops dwmac1000_dma_ops;
+extern const struct tc956xmac_ops dwmac4_ops;
+extern const struct tc956xmac_dma_ops dwmac4_dma_ops;
+extern const struct tc956xmac_ops dwmac410_ops;
+extern const struct tc956xmac_dma_ops dwmac410_dma_ops;
+extern const struct tc956xmac_ops dwmac510_ops;
+extern const struct tc956xmac_tc_ops dwmac510_tc_ops;
+extern const struct tc956xmac_ops dwxgmac210_ops;
+extern const struct tc956xmac_dma_ops dwxgmac210_dma_ops;
+extern const struct tc956xmac_desc_ops dwxgmac210_desc_ops;
+extern const struct tc956xmac_mmc_ops dwmac_mmc_ops;
+extern const struct tc956xmac_mmc_ops dwxgmac_mmc_ops;
+#ifdef TC956X
+extern const struct tc956xmac_pma_ops tc956x_pma_ops;
+#endif
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+extern const struct tc956x_msi_ops tc956x_msigen_ops;
+extern const struct mac_rsc_mng_ops tc956xmac_rsc_mng_ops;
+extern const struct mac_mbx_ops tc956xmac_mbx_ops;
+#endif
+
+#ifdef TC956X_SRIOV_PF
+extern const struct tc956x_mbx_wrapper_ops tc956xmac_mbx_wrapper_ops;
+#elif defined TC956X_SRIOV_VF
+extern const struct tc956xmac_mbx_wrapper_ops tc956xmac_mbx_wrapper_ops;
+#endif
+
+#define GMAC_VERSION		(MAC_OFFSET + 0x00000020)	/* GMAC CORE Version */
+#define GMAC4_VERSION		(MAC_OFFSET + 0x00000110)	/* GMAC4+ CORE Version */
+
+int tc956xmac_hwif_init(struct tc956xmac_priv *priv);
+
+#endif /* __TC956XMAC_HWIF_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/mmc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/mmc.h
@@ -0,0 +1,175 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * mmc.h
+ *
+ * Copyright (C) 2011 STMicroelectronics Ltd
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  26 Oct 2021 : 1. Added EEE mmc counters for MAC COntrolled mode.
+ *  VERSION     : 01-00-19
+ *  24 Nov 2021 : 1. EEE update for runtime configuration and LPI interrupt disabled.
+ *  VERSION     : 01-00-24
+ */
+
+#ifndef __MMC_H__
+#define __MMC_H__
+
+/* MMC control register */
+/* When set, all counter are reset */
+#define MMC_CNTRL_COUNTER_RESET		0x1
+/* When set, do not roll over zero after reaching the max value*/
+#define MMC_CNTRL_COUNTER_STOP_ROLLOVER	0x2
+#define MMC_CNTRL_RESET_ON_READ		0x4	/* Reset after reading */
+#define MMC_CNTRL_COUNTER_FREEZER	0x8	/* Freeze counter values to the
+						 * current value.
+						 */
+#define MMC_CNTRL_PRESET		0x10
+#define MMC_CNTRL_FULL_HALF_PRESET	0x20
+
+#define MMC_GMAC4_OFFSET		(MAC_OFFSET + 0x700)
+#define MMC_GMAC3_X_OFFSET		(MAC_OFFSET + 0x100)
+#define MMC_XGMAC_OFFSET		(MAC_OFFSET + 0x800)
+
+#define MMC_GMAC4_OFFSET_BASE		(0x700)
+#define MMC_GMAC3_X_OFFSET_BASE	(0x100)
+#define MMC_XGMAC_OFFSET_BASE		(0x800)
+
+struct tc956xmac_counters {
+	u64 mmc_tx_broadcastframe_g;
+	u64 mmc_tx_multicastframe_g;
+	u64 mmc_tx_64_octets_gb;
+	u64 mmc_tx_framecount_gb;
+	u64 mmc_tx_65_to_127_octets_gb;
+	u64 mmc_tx_128_to_255_octets_gb;
+	u64 mmc_tx_256_to_511_octets_gb;
+	u64 mmc_tx_octetcount_gb;
+	u64 mmc_tx_512_to_1023_octets_gb;
+	u64 mmc_tx_1024_to_max_octets_gb;
+	u64 mmc_tx_unicast_gb;
+	u64 mmc_tx_multicast_gb;
+	u64 mmc_tx_broadcast_gb;
+	u64 mmc_tx_underflow_error;
+	u64 mmc_tx_singlecol_g;
+	u64 mmc_tx_multicol_g;
+	u64 mmc_tx_deferred;
+	u64 mmc_tx_latecol;
+	u64 mmc_tx_exesscol;
+	u64 mmc_tx_carrier_error;
+	u64 mmc_tx_octetcount_g;
+	u64 mmc_tx_framecount_g;
+	u64 mmc_tx_excessdef;
+	u64 mmc_tx_pause_frame;
+	u64 mmc_tx_vlan_frame_g;
+	u64 mmc_tx_lpi_us_cntr;
+	u64 mmc_tx_lpi_tran_cntr;
+	u64 mmc_rx_lpi_us_cntr;
+	u64 mmc_rx_lpi_tran_cntr;
+	u64 mmc_tx_per_priority_pkt;
+	u64 mmc_tx_per_priority_pfc_pkt;
+	u64 mmc_tx_per_priority_gpfc_pkt;
+	u64 mmc_tx_per_priority_octet_gb;
+
+	/* MMC RX counter registers */
+	u64 mmc_rx_framecount_gb;
+	u64 mmc_rx_octetcount_gb;
+	u64 mmc_rx_octetcount_g;
+	u64 mmc_rx_broadcastframe_g;
+	u64 mmc_rx_multicastframe_g;
+	u64 mmc_rx_crc_error;
+	u64 mmc_rx_align_error;
+	u64 mmc_rx_run_error;
+	u64 mmc_rx_jabber_error;
+	u64 mmc_rx_undersize_g;
+	u64 mmc_rx_oversize_g;
+	u64 mmc_rx_64_octets_gb;
+	u64 mmc_rx_65_to_127_octets_gb;
+	u64 mmc_rx_128_to_255_octets_gb;
+	u64 mmc_rx_256_to_511_octets_gb;
+	u64 mmc_rx_512_to_1023_octets_gb;
+	u64 mmc_rx_1024_to_max_octets_gb;
+	u64 mmc_rx_unicast_g;
+	u64 mmc_rx_length_error;
+	u64 mmc_rx_autofrangetype;
+	u64 mmc_rx_pause_frames;
+	u64 mmc_rx_fifo_overflow;
+	u64 mmc_rx_vlan_frames_gb;
+	u64 mmc_rx_watchdog_error;
+	u64 mmc_rx_per_priority_pkt;
+	u64 mmc_rx_per_priority_pkt_bad;
+	u64 mmc_rx_per_priority_pkt_pfc;
+	u64 mmc_rx_per_priority_octet;
+	/* IPC */
+	u64 mmc_rx_ipc_intr_mask;
+	u64 mmc_rx_ipc_intr;
+	/* IPv4 */
+	u64 mmc_rx_ipv4_gd;
+	u64 mmc_rx_ipv4_hderr;
+	u64 mmc_rx_ipv4_nopay;
+	u64 mmc_rx_ipv4_frag;
+	u64 mmc_rx_ipv4_udsbl;
+
+	u64 mmc_rx_ipv4_gd_octets;
+	u64 mmc_rx_ipv4_hderr_octets;
+	u64 mmc_rx_ipv4_nopay_octets;
+	u64 mmc_rx_ipv4_frag_octets;
+	u64 mmc_rx_ipv4_udsbl_octets;
+
+	/* IPV6 */
+	u64 mmc_rx_ipv6_gd_octets;
+	u64 mmc_rx_ipv6_hderr_octets;
+	u64 mmc_rx_ipv6_nopay_octets;
+
+	u64 mmc_rx_ipv6_gd;
+	u64 mmc_rx_ipv6_hderr;
+	u64 mmc_rx_ipv6_nopay;
+
+	/* Protocols */
+	u64 mmc_rx_udp_gd;
+	u64 mmc_rx_udp_err;
+	u64 mmc_rx_tcp_gd;
+	u64 mmc_rx_tcp_err;
+	u64 mmc_rx_icmp_gd;
+	u64 mmc_rx_icmp_err;
+
+	u64 mmc_rx_udp_gd_octets;
+	u64 mmc_rx_udp_err_octets;
+	u64 mmc_rx_tcp_gd_octets;
+	u64 mmc_rx_tcp_err_octets;
+	u64 mmc_rx_icmp_gd_octets;
+	u64 mmc_rx_icmp_err_octets;
+
+	/* FPE */
+	u64 mmc_tx_fpe_fragment_cntr;
+	u64 mmc_tx_hold_req_cntr;
+	u64 mmc_rx_packet_assembly_err_cntr;
+	u64 mmc_rx_packet_smd_err_cntr;
+	u64 mmc_rx_packet_assembly_ok_cntr;
+	u64 mmc_rx_fpe_fragment_cntr;
+};
+
+#endif /* __MMC_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/mmc_core.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/mmc_core.c
@@ -0,0 +1,544 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * mmc_core.c
+ *
+ * Copyright (C) 2011 STMicroelectronics Ltd
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  24 Nov 2021 : 1. EEE HW counter support.
+ *  VERSION     : 01-00-24
+ */
+
+#include <linux/kernel.h>
+#include <linux/io.h>
+#include "hwif.h"
+#include "mmc.h"
+#include "tc956xmac.h"
+
+/* MAC Management Counters register offset */
+
+#define MMC_CNTRL		0x00	/* MMC Control */
+#define MMC_RX_INTR		0x04	/* MMC RX Interrupt */
+#define MMC_TX_INTR		0x08	/* MMC TX Interrupt */
+#define MMC_RX_INTR_MASK	0x0c	/* MMC Interrupt Mask */
+#define MMC_TX_INTR_MASK	0x10	/* MMC Interrupt Mask */
+#define MMC_DEFAULT_MASK	0xffffffff
+
+/* MMC TX counter registers */
+
+/* Note:
+ * _GB register stands for good and bad frames
+ * _G is for good only.
+ */
+#define MMC_TX_OCTETCOUNT_GB		0x14
+#define MMC_TX_FRAMECOUNT_GB		0x18
+#define MMC_TX_BROADCASTFRAME_G		0x1c
+#define MMC_TX_MULTICASTFRAME_G		0x20
+#define MMC_TX_64_OCTETS_GB		0x24
+#define MMC_TX_65_TO_127_OCTETS_GB	0x28
+#define MMC_TX_128_TO_255_OCTETS_GB	0x2c
+#define MMC_TX_256_TO_511_OCTETS_GB	0x30
+#define MMC_TX_512_TO_1023_OCTETS_GB	0x34
+#define MMC_TX_1024_TO_MAX_OCTETS_GB	0x38
+#define MMC_TX_UNICAST_GB		0x3c
+#define MMC_TX_MULTICAST_GB		0x40
+#define MMC_TX_BROADCAST_GB		0x44
+#define MMC_TX_UNDERFLOW_ERROR		0x48
+#define MMC_TX_SINGLECOL_G		0x4c
+#define MMC_TX_MULTICOL_G		0x50
+#define MMC_TX_DEFERRED			0x54
+#define MMC_TX_LATECOL			0x58
+#define MMC_TX_EXESSCOL			0x5c
+#define MMC_TX_CARRIER_ERROR		0x60
+#define MMC_TX_OCTETCOUNT_G		0x64
+#define MMC_TX_FRAMECOUNT_G		0x68
+#define MMC_TX_EXCESSDEF		0x6c
+#define MMC_TX_PAUSE_FRAME		0x70
+#define MMC_TX_VLAN_FRAME_G		0x74
+
+/* MMC RX counter registers */
+#define MMC_RX_FRAMECOUNT_GB		0x80
+#define MMC_RX_OCTETCOUNT_GB		0x84
+#define MMC_RX_OCTETCOUNT_G		0x88
+#define MMC_RX_BROADCASTFRAME_G		0x8c
+#define MMC_RX_MULTICASTFRAME_G		0x90
+#define MMC_RX_CRC_ERROR		0x94
+#define MMC_RX_ALIGN_ERROR		0x98
+#define MMC_RX_RUN_ERROR		0x9C
+#define MMC_RX_JABBER_ERROR		0xA0
+#define MMC_RX_UNDERSIZE_G		0xA4
+#define MMC_RX_OVERSIZE_G		0xA8
+#define MMC_RX_64_OCTETS_GB		0xAC
+#define MMC_RX_65_TO_127_OCTETS_GB	0xb0
+#define MMC_RX_128_TO_255_OCTETS_GB	0xb4
+#define MMC_RX_256_TO_511_OCTETS_GB	0xb8
+#define MMC_RX_512_TO_1023_OCTETS_GB	0xbc
+#define MMC_RX_1024_TO_MAX_OCTETS_GB	0xc0
+#define MMC_RX_UNICAST_G		0xc4
+#define MMC_RX_LENGTH_ERROR		0xc8
+#define MMC_RX_AUTOFRANGETYPE		0xcc
+#define MMC_RX_PAUSE_FRAMES		0xd0
+#define MMC_RX_FIFO_OVERFLOW		0xd4
+#define MMC_RX_VLAN_FRAMES_GB		0xd8
+#define MMC_RX_WATCHDOG_ERROR		0xdc
+/* IPC*/
+#define MMC_RX_IPC_INTR_MASK		0x100
+#define MMC_RX_IPC_INTR			0x108
+/* IPv4*/
+#define MMC_RX_IPV4_GD			0x110
+#define MMC_RX_IPV4_HDERR		0x114
+#define MMC_RX_IPV4_NOPAY		0x118
+#define MMC_RX_IPV4_FRAG		0x11C
+#define MMC_RX_IPV4_UDSBL		0x120
+
+#define MMC_RX_IPV4_GD_OCTETS		0x150
+#define MMC_RX_IPV4_HDERR_OCTETS	0x154
+#define MMC_RX_IPV4_NOPAY_OCTETS	0x158
+#define MMC_RX_IPV4_FRAG_OCTETS		0x15c
+#define MMC_RX_IPV4_UDSBL_OCTETS	0x160
+
+/* IPV6*/
+#define MMC_RX_IPV6_GD_OCTETS		0x164
+#define MMC_RX_IPV6_HDERR_OCTETS	0x168
+#define MMC_RX_IPV6_NOPAY_OCTETS	0x16c
+
+#define MMC_RX_IPV6_GD			0x124
+#define MMC_RX_IPV6_HDERR		0x128
+#define MMC_RX_IPV6_NOPAY		0x12c
+
+/* Protocols*/
+#define MMC_RX_UDP_GD			0x130
+#define MMC_RX_UDP_ERR			0x134
+#define MMC_RX_TCP_GD			0x138
+#define MMC_RX_TCP_ERR			0x13c
+#define MMC_RX_ICMP_GD			0x140
+#define MMC_RX_ICMP_ERR			0x144
+
+#define MMC_RX_UDP_GD_OCTETS		0x170
+#define MMC_RX_UDP_ERR_OCTETS		0x174
+#define MMC_RX_TCP_GD_OCTETS		0x178
+#define MMC_RX_TCP_ERR_OCTETS		0x17c
+#define MMC_RX_ICMP_GD_OCTETS		0x180
+#define MMC_RX_ICMP_ERR_OCTETS		0x184
+
+#define MMC_TX_FPE_FRAG			0x1a8
+#define MMC_TX_HOLD_REQ			0x1ac
+#define MMC_RX_PKT_ASSEMBLY_ERR		0x1c8
+#define MMC_RX_PKT_SMD_ERR		0x1cc
+#define MMC_RX_PKT_ASSEMBLY_OK		0x1d0
+#define MMC_RX_FPE_FRAG			0x1d4
+
+/* XGMAC MMC Registers */
+#define MMC_XGMAC_TX_OCTET_GB		0x14
+#define MMC_XGMAC_TX_PKT_GB		0x1c
+#define MMC_XGMAC_TX_BROAD_PKT_G	0x24
+#define MMC_XGMAC_TX_MULTI_PKT_G	0x2c
+#define MMC_XGMAC_TX_64OCT_GB		0x34
+#define MMC_XGMAC_TX_65OCT_GB		0x3c
+#define MMC_XGMAC_TX_128OCT_GB		0x44
+#define MMC_XGMAC_TX_256OCT_GB		0x4c
+#define MMC_XGMAC_TX_512OCT_GB		0x54
+#define MMC_XGMAC_TX_1024OCT_GB		0x5c
+#define MMC_XGMAC_TX_UNI_PKT_GB		0x64
+#define MMC_XGMAC_TX_MULTI_PKT_GB	0x6c
+#define MMC_XGMAC_TX_BROAD_PKT_GB	0x74
+#define MMC_XGMAC_TX_UNDER		0x7c
+#define MMC_XGMAC_TX_OCTET_G		0x84
+#define MMC_XGMAC_TX_PKT_G		0x8c
+#define MMC_XGMAC_TX_PAUSE		0x94
+#define MMC_XGMAC_TX_VLAN_PKT_G		0x9c
+#define MMC_XGMAC_TX_LPI_USEC		0xa4
+#define MMC_XGMAC_TX_LPI_TRAN		0xa8
+#define MMC_XGMAC_TX_PER_PRIOR_PKT		0xd4/* Priority MMC */
+#define MMC_XGMAC_TX_PER_PRIOR_PFC_PKT	0xd8/* Priority MMC */
+#define MMC_XGMAC_TX_PER_PRIOR_GPFC_PKT	0xdc/* Priority MMC */
+#define MMC_XGMAC_TX_PER_PRIOR_OCTET_GB		0xe0/* Priority MMC */
+
+#define MMC_XGMAC_RX_PKT_GB		0x100
+#define MMC_XGMAC_RX_OCTET_GB		0x108
+#define MMC_XGMAC_RX_OCTET_G		0x110
+#define MMC_XGMAC_RX_BROAD_PKT_G	0x118
+#define MMC_XGMAC_RX_MULTI_PKT_G	0x120
+#define MMC_XGMAC_RX_CRC_ERR		0x128
+#define MMC_XGMAC_RX_RUNT_ERR		0x130
+#define MMC_XGMAC_RX_JABBER_ERR		0x134
+#define MMC_XGMAC_RX_UNDER		0x138
+#define MMC_XGMAC_RX_OVER		0x13c
+#define MMC_XGMAC_RX_64OCT_GB		0x140
+#define MMC_XGMAC_RX_65OCT_GB		0x148
+#define MMC_XGMAC_RX_128OCT_GB		0x150
+#define MMC_XGMAC_RX_256OCT_GB		0x158
+#define MMC_XGMAC_RX_512OCT_GB		0x160
+#define MMC_XGMAC_RX_1024OCT_GB		0x168
+#define MMC_XGMAC_RX_UNI_PKT_G		0x170
+#define MMC_XGMAC_RX_LENGTH_ERR		0x178
+#define MMC_XGMAC_RX_RANGE		0x180
+#define MMC_XGMAC_RX_PAUSE		0x188
+#define MMC_XGMAC_RX_FIFOOVER_PKT	0x190
+#define MMC_XGMAC_RX_VLAN_PKT_GB	0x198
+#define MMC_XGMAC_RX_WATCHDOG_ERR	0x1a0
+#define MMC_XGMAC_RX_LPI_USEC		0x1a4
+#define MMC_XGMAC_RX_LPI_TRAN		0x1a8
+#define MMC_XGMAC_RX_DISCARD_PKT_GB	0x1ac
+#define MMC_XGMAC_RX_DISCARD_OCT_GB	0x1b4
+#define MMC_XGMAC_RX_ALIGN_ERR_PKT	0x1bc
+#define MMC_XGMAC_RX_PER_PRIOR_PKT	0x1d4/* RX Priority register */
+#define MMC_XGMAC_RX_PER_PRIOR_PKT_BAD	0x1d8/* RX Priority register */
+#define MMC_XGMAC_RX_PER_PRIOR_PFC_PKT	0x1dc/* RX Priority register */
+#define MMC_XGMAC_RX_PER_PRIOR_OCTET	0x1e0/* RX Priority register */
+
+#define MMC_XGMAC_TX_FPE_FRAG		0x208
+#define MMC_XGMAC_TX_HOLD_REQ		0x20c
+#define MMC_XGMAC_RX_PKT_ASSEMBLY_ERR	0x228
+#define MMC_XGMAC_RX_PKT_SMD_ERR	0x22c
+#define MMC_XGMAC_RX_PKT_ASSEMBLY_OK	0x230
+#define MMC_XGMAC_RX_FPE_FRAG		0x234
+#define MMC_XGMAC_RX_IPC_INTR_MASK	0x25c
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static void dwmac_mmc_ctrl(struct tc956xmac_priv *priv, void __iomem *mmcaddr,
+				unsigned int mode)
+{
+	u32 value = readl(mmcaddr + MMC_CNTRL);
+
+	value |= (mode & 0x3F);
+
+	writel(value, mmcaddr + MMC_CNTRL);
+
+	pr_debug("tc956xmac: MMC ctrl register (offset 0x%x): 0x%08x\n",
+		 MMC_CNTRL, value);
+}
+
+/* To mask all interrupts.*/
+static void dwmac_mmc_intr_all_mask(struct tc956xmac_priv *priv,
+					void __iomem *mmcaddr)
+{
+	writel(MMC_DEFAULT_MASK, mmcaddr + MMC_RX_INTR_MASK);
+	writel(MMC_DEFAULT_MASK, mmcaddr + MMC_TX_INTR_MASK);
+#ifndef TC956X
+	writel(MMC_DEFAULT_MASK, mmcaddr + MMC_RX_IPC_INTR_MASK);
+#endif
+}
+
+/* This reads the MAC core counters (if actaully supported).
+ * by default the MMC core is programmed to reset each
+ * counter after a read. So all the field of the mmc struct
+ * have to be incremented.
+ */
+static void dwmac_mmc_read(struct tc956xmac_priv *priv, void __iomem *mmcaddr,
+				struct tc956xmac_counters *mmc)
+{
+	mmc->mmc_tx_octetcount_gb += readl(mmcaddr + MMC_TX_OCTETCOUNT_GB);
+	mmc->mmc_tx_framecount_gb += readl(mmcaddr + MMC_TX_FRAMECOUNT_GB);
+	mmc->mmc_tx_broadcastframe_g += readl(mmcaddr +
+					      MMC_TX_BROADCASTFRAME_G);
+	mmc->mmc_tx_multicastframe_g += readl(mmcaddr +
+					      MMC_TX_MULTICASTFRAME_G);
+	mmc->mmc_tx_64_octets_gb += readl(mmcaddr + MMC_TX_64_OCTETS_GB);
+	mmc->mmc_tx_65_to_127_octets_gb +=
+	    readl(mmcaddr + MMC_TX_65_TO_127_OCTETS_GB);
+	mmc->mmc_tx_128_to_255_octets_gb +=
+	    readl(mmcaddr + MMC_TX_128_TO_255_OCTETS_GB);
+	mmc->mmc_tx_256_to_511_octets_gb +=
+	    readl(mmcaddr + MMC_TX_256_TO_511_OCTETS_GB);
+	mmc->mmc_tx_512_to_1023_octets_gb +=
+	    readl(mmcaddr + MMC_TX_512_TO_1023_OCTETS_GB);
+	mmc->mmc_tx_1024_to_max_octets_gb +=
+	    readl(mmcaddr + MMC_TX_1024_TO_MAX_OCTETS_GB);
+	mmc->mmc_tx_unicast_gb += readl(mmcaddr + MMC_TX_UNICAST_GB);
+	mmc->mmc_tx_multicast_gb += readl(mmcaddr + MMC_TX_MULTICAST_GB);
+	mmc->mmc_tx_broadcast_gb += readl(mmcaddr + MMC_TX_BROADCAST_GB);
+	mmc->mmc_tx_underflow_error += readl(mmcaddr + MMC_TX_UNDERFLOW_ERROR);
+	mmc->mmc_tx_singlecol_g += readl(mmcaddr + MMC_TX_SINGLECOL_G);
+	mmc->mmc_tx_multicol_g += readl(mmcaddr + MMC_TX_MULTICOL_G);
+	mmc->mmc_tx_deferred += readl(mmcaddr + MMC_TX_DEFERRED);
+	mmc->mmc_tx_latecol += readl(mmcaddr + MMC_TX_LATECOL);
+	mmc->mmc_tx_exesscol += readl(mmcaddr + MMC_TX_EXESSCOL);
+	mmc->mmc_tx_carrier_error += readl(mmcaddr + MMC_TX_CARRIER_ERROR);
+	mmc->mmc_tx_octetcount_g += readl(mmcaddr + MMC_TX_OCTETCOUNT_G);
+	mmc->mmc_tx_framecount_g += readl(mmcaddr + MMC_TX_FRAMECOUNT_G);
+	mmc->mmc_tx_excessdef += readl(mmcaddr + MMC_TX_EXCESSDEF);
+	mmc->mmc_tx_pause_frame += readl(mmcaddr + MMC_TX_PAUSE_FRAME);
+	mmc->mmc_tx_vlan_frame_g += readl(mmcaddr + MMC_TX_VLAN_FRAME_G);
+
+	/* MMC RX counter registers */
+	mmc->mmc_rx_framecount_gb += readl(mmcaddr + MMC_RX_FRAMECOUNT_GB);
+	mmc->mmc_rx_octetcount_gb += readl(mmcaddr + MMC_RX_OCTETCOUNT_GB);
+	mmc->mmc_rx_octetcount_g += readl(mmcaddr + MMC_RX_OCTETCOUNT_G);
+	mmc->mmc_rx_broadcastframe_g += readl(mmcaddr +
+					      MMC_RX_BROADCASTFRAME_G);
+	mmc->mmc_rx_multicastframe_g += readl(mmcaddr +
+					      MMC_RX_MULTICASTFRAME_G);
+	mmc->mmc_rx_crc_error += readl(mmcaddr + MMC_RX_CRC_ERROR);
+	mmc->mmc_rx_align_error += readl(mmcaddr + MMC_RX_ALIGN_ERROR);
+	mmc->mmc_rx_run_error += readl(mmcaddr + MMC_RX_RUN_ERROR);
+	mmc->mmc_rx_jabber_error += readl(mmcaddr + MMC_RX_JABBER_ERROR);
+	mmc->mmc_rx_undersize_g += readl(mmcaddr + MMC_RX_UNDERSIZE_G);
+	mmc->mmc_rx_oversize_g += readl(mmcaddr + MMC_RX_OVERSIZE_G);
+	mmc->mmc_rx_64_octets_gb += readl(mmcaddr + MMC_RX_64_OCTETS_GB);
+	mmc->mmc_rx_65_to_127_octets_gb +=
+	    readl(mmcaddr + MMC_RX_65_TO_127_OCTETS_GB);
+	mmc->mmc_rx_128_to_255_octets_gb +=
+	    readl(mmcaddr + MMC_RX_128_TO_255_OCTETS_GB);
+	mmc->mmc_rx_256_to_511_octets_gb +=
+	    readl(mmcaddr + MMC_RX_256_TO_511_OCTETS_GB);
+	mmc->mmc_rx_512_to_1023_octets_gb +=
+	    readl(mmcaddr + MMC_RX_512_TO_1023_OCTETS_GB);
+	mmc->mmc_rx_1024_to_max_octets_gb +=
+	    readl(mmcaddr + MMC_RX_1024_TO_MAX_OCTETS_GB);
+	mmc->mmc_rx_unicast_g += readl(mmcaddr + MMC_RX_UNICAST_G);
+	mmc->mmc_rx_length_error += readl(mmcaddr + MMC_RX_LENGTH_ERROR);
+	mmc->mmc_rx_autofrangetype += readl(mmcaddr + MMC_RX_AUTOFRANGETYPE);
+	mmc->mmc_rx_pause_frames += readl(mmcaddr + MMC_RX_PAUSE_FRAMES);
+	mmc->mmc_rx_fifo_overflow += readl(mmcaddr + MMC_RX_FIFO_OVERFLOW);
+	mmc->mmc_rx_vlan_frames_gb += readl(mmcaddr + MMC_RX_VLAN_FRAMES_GB);
+	mmc->mmc_rx_watchdog_error += readl(mmcaddr + MMC_RX_WATCHDOG_ERROR);
+	/* IPC */
+	mmc->mmc_rx_ipc_intr_mask += readl(mmcaddr + MMC_RX_IPC_INTR_MASK);
+	mmc->mmc_rx_ipc_intr += readl(mmcaddr + MMC_RX_IPC_INTR);
+	/* IPv4 */
+	mmc->mmc_rx_ipv4_gd += readl(mmcaddr + MMC_RX_IPV4_GD);
+	mmc->mmc_rx_ipv4_hderr += readl(mmcaddr + MMC_RX_IPV4_HDERR);
+	mmc->mmc_rx_ipv4_nopay += readl(mmcaddr + MMC_RX_IPV4_NOPAY);
+	mmc->mmc_rx_ipv4_frag += readl(mmcaddr + MMC_RX_IPV4_FRAG);
+	mmc->mmc_rx_ipv4_udsbl += readl(mmcaddr + MMC_RX_IPV4_UDSBL);
+
+	mmc->mmc_rx_ipv4_gd_octets += readl(mmcaddr + MMC_RX_IPV4_GD_OCTETS);
+	mmc->mmc_rx_ipv4_hderr_octets +=
+	    readl(mmcaddr + MMC_RX_IPV4_HDERR_OCTETS);
+	mmc->mmc_rx_ipv4_nopay_octets +=
+	    readl(mmcaddr + MMC_RX_IPV4_NOPAY_OCTETS);
+	mmc->mmc_rx_ipv4_frag_octets += readl(mmcaddr +
+					      MMC_RX_IPV4_FRAG_OCTETS);
+	mmc->mmc_rx_ipv4_udsbl_octets +=
+	    readl(mmcaddr + MMC_RX_IPV4_UDSBL_OCTETS);
+
+	/* IPV6 */
+	mmc->mmc_rx_ipv6_gd_octets += readl(mmcaddr + MMC_RX_IPV6_GD_OCTETS);
+	mmc->mmc_rx_ipv6_hderr_octets +=
+	    readl(mmcaddr + MMC_RX_IPV6_HDERR_OCTETS);
+	mmc->mmc_rx_ipv6_nopay_octets +=
+	    readl(mmcaddr + MMC_RX_IPV6_NOPAY_OCTETS);
+
+	mmc->mmc_rx_ipv6_gd += readl(mmcaddr + MMC_RX_IPV6_GD);
+	mmc->mmc_rx_ipv6_hderr += readl(mmcaddr + MMC_RX_IPV6_HDERR);
+	mmc->mmc_rx_ipv6_nopay += readl(mmcaddr + MMC_RX_IPV6_NOPAY);
+
+	/* Protocols */
+	mmc->mmc_rx_udp_gd += readl(mmcaddr + MMC_RX_UDP_GD);
+	mmc->mmc_rx_udp_err += readl(mmcaddr + MMC_RX_UDP_ERR);
+	mmc->mmc_rx_tcp_gd += readl(mmcaddr + MMC_RX_TCP_GD);
+	mmc->mmc_rx_tcp_err += readl(mmcaddr + MMC_RX_TCP_ERR);
+	mmc->mmc_rx_icmp_gd += readl(mmcaddr + MMC_RX_ICMP_GD);
+	mmc->mmc_rx_icmp_err += readl(mmcaddr + MMC_RX_ICMP_ERR);
+
+	mmc->mmc_rx_udp_gd_octets += readl(mmcaddr + MMC_RX_UDP_GD_OCTETS);
+	mmc->mmc_rx_udp_err_octets += readl(mmcaddr + MMC_RX_UDP_ERR_OCTETS);
+	mmc->mmc_rx_tcp_gd_octets += readl(mmcaddr + MMC_RX_TCP_GD_OCTETS);
+	mmc->mmc_rx_tcp_err_octets += readl(mmcaddr + MMC_RX_TCP_ERR_OCTETS);
+	mmc->mmc_rx_icmp_gd_octets += readl(mmcaddr + MMC_RX_ICMP_GD_OCTETS);
+	mmc->mmc_rx_icmp_err_octets += readl(mmcaddr + MMC_RX_ICMP_ERR_OCTETS);
+
+	mmc->mmc_tx_fpe_fragment_cntr += readl(mmcaddr + MMC_TX_FPE_FRAG);
+	mmc->mmc_tx_hold_req_cntr += readl(mmcaddr + MMC_TX_HOLD_REQ);
+	mmc->mmc_rx_packet_assembly_err_cntr +=
+		readl(mmcaddr + MMC_RX_PKT_ASSEMBLY_ERR);
+	mmc->mmc_rx_packet_smd_err_cntr += readl(mmcaddr + MMC_RX_PKT_SMD_ERR);
+	mmc->mmc_rx_packet_assembly_ok_cntr +=
+		readl(mmcaddr + MMC_RX_PKT_ASSEMBLY_OK);
+	mmc->mmc_rx_fpe_fragment_cntr += readl(mmcaddr + MMC_RX_FPE_FRAG);
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+const struct tc956xmac_mmc_ops dwmac_mmc_ops = {
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.ctrl = dwmac_mmc_ctrl,
+	.intr_all_mask = dwmac_mmc_intr_all_mask,
+	.read = dwmac_mmc_read,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+};
+
+static void dwxgmac_mmc_ctrl(struct tc956xmac_priv *priv, void __iomem *mmcaddr,
+				unsigned int mode)
+{
+	u32 value = readl(mmcaddr + MMC_CNTRL);
+
+	value |= (mode & 0x3F);
+
+	writel(value, mmcaddr + MMC_CNTRL);
+}
+
+static void dwxgmac_mmc_intr_all_mask(struct tc956xmac_priv *priv,
+					void __iomem *mmcaddr)
+{
+	writel(0x0, mmcaddr + MMC_RX_INTR_MASK);
+	writel(0x0, mmcaddr + MMC_TX_INTR_MASK);
+#ifndef TC956X
+	writel(MMC_DEFAULT_MASK, mmcaddr + MMC_XGMAC_RX_IPC_INTR_MASK);
+#endif
+}
+
+static void dwxgmac_read_mmc_reg(void __iomem *addr, u32 reg, u64 *dest)
+{
+	u64 tmp = 0;
+
+	tmp += readl(addr + reg);
+	tmp += ((u64)readl(addr + reg + 0x4)) << 32;
+	*dest = *dest + tmp;
+}
+
+/* This reads the MAC core counters (if actaully supported).
+ * by default the MMC core is programmed to reset each
+ * counter after a read. So all the field of the mmc struct
+ * have to be incremented.
+ */
+static void dwxgmac_mmc_read(struct tc956xmac_priv *priv, void __iomem *mmcaddr,
+				struct tc956xmac_counters *mmc)
+{
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_OCTET_GB,
+			     &mmc->mmc_tx_octetcount_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_PKT_GB,
+			     &mmc->mmc_tx_framecount_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_BROAD_PKT_G,
+			     &mmc->mmc_tx_broadcastframe_g);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_MULTI_PKT_G,
+			     &mmc->mmc_tx_multicastframe_g);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_64OCT_GB,
+			     &mmc->mmc_tx_64_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_65OCT_GB,
+			     &mmc->mmc_tx_65_to_127_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_128OCT_GB,
+			     &mmc->mmc_tx_128_to_255_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_256OCT_GB,
+			     &mmc->mmc_tx_256_to_511_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_512OCT_GB,
+			     &mmc->mmc_tx_512_to_1023_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_1024OCT_GB,
+			     &mmc->mmc_tx_1024_to_max_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_UNI_PKT_GB,
+			     &mmc->mmc_tx_unicast_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_MULTI_PKT_GB,
+			     &mmc->mmc_tx_multicast_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_BROAD_PKT_GB,
+			     &mmc->mmc_tx_broadcast_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_UNDER,
+			     &mmc->mmc_tx_underflow_error);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_OCTET_G,
+			     &mmc->mmc_tx_octetcount_g);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_PKT_G,
+			     &mmc->mmc_tx_framecount_g);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_PAUSE,
+			     &mmc->mmc_tx_pause_frame);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_VLAN_PKT_G,
+			     &mmc->mmc_tx_vlan_frame_g);
+	mmc->mmc_tx_per_priority_pkt += readl(mmcaddr +
+				MMC_XGMAC_TX_PER_PRIOR_PKT);
+	mmc->mmc_tx_per_priority_pfc_pkt += readl(mmcaddr +
+				MMC_XGMAC_TX_PER_PRIOR_PFC_PKT);
+	mmc->mmc_tx_per_priority_gpfc_pkt += readl(mmcaddr +
+				MMC_XGMAC_TX_PER_PRIOR_GPFC_PKT);
+
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_TX_PER_PRIOR_OCTET_GB,
+			     &mmc->mmc_tx_per_priority_octet_gb);
+
+	/* MMC EEE registers */
+	mmc->mmc_tx_lpi_tran_cntr += readl(mmcaddr + MMC_XGMAC_TX_LPI_TRAN);
+	mmc->mmc_rx_lpi_tran_cntr += readl(mmcaddr + MMC_XGMAC_RX_LPI_TRAN);
+
+	/* MMC RX counter registers */
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_PKT_GB,
+			     &mmc->mmc_rx_framecount_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_OCTET_GB,
+			     &mmc->mmc_rx_octetcount_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_OCTET_G,
+			     &mmc->mmc_rx_octetcount_g);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_BROAD_PKT_G,
+			     &mmc->mmc_rx_broadcastframe_g);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_MULTI_PKT_G,
+			     &mmc->mmc_rx_multicastframe_g);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_CRC_ERR,
+			     &mmc->mmc_rx_crc_error);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_CRC_ERR,
+			     &mmc->mmc_rx_crc_error);
+	mmc->mmc_rx_run_error += readl(mmcaddr + MMC_XGMAC_RX_RUNT_ERR);
+	mmc->mmc_rx_jabber_error += readl(mmcaddr + MMC_XGMAC_RX_JABBER_ERR);
+	mmc->mmc_rx_undersize_g += readl(mmcaddr + MMC_XGMAC_RX_UNDER);
+	mmc->mmc_rx_oversize_g += readl(mmcaddr + MMC_XGMAC_RX_OVER);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_64OCT_GB,
+			     &mmc->mmc_rx_64_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_65OCT_GB,
+			     &mmc->mmc_rx_65_to_127_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_128OCT_GB,
+			     &mmc->mmc_rx_128_to_255_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_256OCT_GB,
+			     &mmc->mmc_rx_256_to_511_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_512OCT_GB,
+			     &mmc->mmc_rx_512_to_1023_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_1024OCT_GB,
+			     &mmc->mmc_rx_1024_to_max_octets_gb);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_UNI_PKT_G,
+			     &mmc->mmc_rx_unicast_g);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_LENGTH_ERR,
+			     &mmc->mmc_rx_length_error);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_RANGE,
+			     &mmc->mmc_rx_autofrangetype);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_PAUSE,
+			     &mmc->mmc_rx_pause_frames);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_FIFOOVER_PKT,
+			     &mmc->mmc_rx_fifo_overflow);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_VLAN_PKT_GB,
+			     &mmc->mmc_rx_vlan_frames_gb);
+	mmc->mmc_rx_watchdog_error += readl(mmcaddr + MMC_XGMAC_RX_WATCHDOG_ERR);
+	mmc->mmc_rx_per_priority_pkt += readl(mmcaddr +
+				MMC_XGMAC_RX_PER_PRIOR_PKT);
+	mmc->mmc_rx_per_priority_pkt_bad += readl(mmcaddr +
+				MMC_XGMAC_RX_PER_PRIOR_PKT_BAD);
+	mmc->mmc_rx_per_priority_pkt_pfc += readl(mmcaddr +
+				MMC_XGMAC_RX_PER_PRIOR_PFC_PKT);
+	dwxgmac_read_mmc_reg(mmcaddr, MMC_XGMAC_RX_PER_PRIOR_OCTET,
+			     &mmc->mmc_rx_per_priority_octet);
+
+#if !defined(TX_LOGGING_TRACE) && !defined(RX_LOGGING_TRACE)
+	mmc->mmc_tx_fpe_fragment_cntr += readl(mmcaddr + MMC_XGMAC_TX_FPE_FRAG);
+	mmc->mmc_tx_hold_req_cntr += readl(mmcaddr + MMC_XGMAC_TX_HOLD_REQ);
+	mmc->mmc_rx_packet_assembly_err_cntr +=
+		readl(mmcaddr + MMC_XGMAC_RX_PKT_ASSEMBLY_ERR);
+	mmc->mmc_rx_packet_smd_err_cntr +=
+		readl(mmcaddr + MMC_XGMAC_RX_PKT_SMD_ERR);
+	mmc->mmc_rx_packet_assembly_ok_cntr +=
+		readl(mmcaddr + MMC_XGMAC_RX_PKT_ASSEMBLY_OK);
+	mmc->mmc_rx_fpe_fragment_cntr +=
+		readl(mmcaddr + MMC_XGMAC_RX_FPE_FRAG);
+#endif
+}
+
+const struct tc956xmac_mmc_ops dwxgmac_mmc_ops = {
+	.ctrl = dwxgmac_mmc_ctrl,
+	.intr_all_mask = dwxgmac_mmc_intr_all_mask,
+	.read = dwxgmac_mmc_read,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_ipa_intf.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_ipa_intf.c
@@ -0,0 +1,1699 @@
+/*
+ * TC956x IPA I/F layer
+ *
+ * tc956x_ipa_intf.c
+ *
+ * Copyright (C) 2022 Toshiba Electronic Devices & Storage Corporation
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  20 Jul 2021 : 1. IPA statistics print function removed
+ *  VERSION     : 01-00-03
+ *  22 Jul 2021 : 1. Dynamic CM3 TAMAP configuration
+ *  VERSION     : 01-00-05
+ *  23 Jul 2021 : 1. Add support for contiguous allocation of memory
+ *  VERSION     : 01-00-06
+ *  29 Jul 2021 : 1. Add support to set MAC Address register
+ *  VERSION     : 01-00-07
+ *  05 Aug 2021 : Store and use Port0 pci_dev for all DMA allocation/mapping for IPA path
+ *  VERSION     : 01-00-08
+ *  09 Sep 2021 : Reverted changes related to usage of Port-0 pci_dev for all DMA allocation/mapping for IPA path
+ *  VERSION     : 01-00-12
+ *  31 Jan 2022 : 1. Common used macro moved to common.h file.
+ *  VERSION     : 01-00-39
+ *  29 Apr 2022 : 1. Triggering Power saving at Link down after release of offloaded DMA channels
+ *  VERSION     : 01-00-51
+ */
+
+#include <linux/dma-mapping.h>
+#include "common.h"
+#include "tc956xmac.h"
+#include "tc956xmac_ioctl.h"
+#ifdef TC956X
+#include "dwxgmac2.h"
+#endif
+#include "tc956x_ipa_intf.h"
+
+#define IPA_INTF_MAJOR_VERSION 0
+#define IPA_INTF_MINOR_VERSION 1
+
+#define CM3_PCIE_REGION_LOW_BOUND	0x60000000
+#define CM3_PCIE_REGION_UP_BOUND	0xC0000000
+
+/* At 10Gbps speed, only 72 entries can be parsed */
+#define MAX_PARSABLE_FRP_ENTRIES 72
+
+#define IPA_MAX_BUFFER_SIZE (9*1024) /* 9KBytes */
+#define IPA_MAX_DESC_CNT    512
+#define MAX_WDT		0xFF
+
+#define MAC_ADDR_INDEX 1
+#define MAC_ADDR_AE 1
+#define MAC_ADDR_MBC 0x3F
+#define MAC_ADDR_DCS 0x1
+static u8 mac_addr_default[6] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+
+static DEFINE_SPINLOCK(cm3_tamap_lock);
+
+extern int tc956xmac_rx_parser_configuration(struct tc956xmac_priv *priv);
+extern void tc956x_config_CM3_tamap(struct device *dev,
+				void __iomem *reg_pci_base_addr,
+				struct tc956xmac_cm3_tamap *tamap,
+				u8 table_entry);
+/*!
+ * \brief This API will return the version of IPA I/F maintained by Toshiba
+ *	  The API will check for NULL pointers
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ *
+ * \return : Correct Major and Minor number of the IPA I/F version
+ *	     Major Number = Minor Number = 0xFF incase ndev is NULL or
+ *	     tc956xmac_priv extracted from ndev is NULL
+ */
+
+struct tc956x_ipa_version get_ipa_intf_version(struct net_device *ndev)
+{
+	struct tc956x_ipa_version version;
+
+	version.major = 0xFF;
+	version.minor = 0xFF;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return version;
+	}
+
+	version.major = IPA_INTF_MAJOR_VERSION;
+	version.minor = IPA_INTF_MINOR_VERSION;
+
+	return version;
+}
+EXPORT_SYMBOL_GPL(get_ipa_intf_version);
+
+/*!
+ * \brief This API will store the client private structure inside TC956x private structure.
+ *	  The API will check for NULL pointers. client_priv == NULL will be considered as a valid argument
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in]  client_priv : Client private data structure
+ *
+ * \return : 0 on success
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ */
+
+int set_client_priv_data(struct net_device *ndev, void *client_priv)
+{
+	struct tc956xmac_priv *priv;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv->client_priv = client_priv;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(set_client_priv_data);
+
+/*!
+ * \brief This API will return the client private data structure
+ *	  The API will check for NULL pointers
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ *
+ * \return : Pointer to the client private data structure
+ *	     NULL if ndev or tc956xmac_priv extracted from ndev is NULL
+ */
+
+void* get_client_priv_data(struct net_device *ndev)
+{
+	struct tc956xmac_priv *priv;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return NULL;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return NULL;
+	}
+
+	return priv->client_priv;
+}
+EXPORT_SYMBOL_GPL(get_client_priv_data);
+
+static void free_ipa_tx_resources(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[channel->channel_num];
+	u32 i;
+
+	if (channel->ch_flags == TC956X_CONTIG_BUFS) {
+		dma_free_coherent(priv->device,
+				  channel->desc_size * channel->desc_cnt,
+				  channel->desc_addr.desc_virt_addrs_base,
+				  tx_q->dma_tx_phy);
+		dma_free_coherent(priv->device,
+				  channel->buf_size * channel->desc_cnt,
+				  channel->buff_pool_addr.buff_pool_va_addrs_base[0],
+				  tx_q->buff_tx_phy);
+	} else {
+		for (i = 0; i < channel->desc_cnt; i++) {
+			dma_unmap_single(priv->device,
+					 tx_q->tx_offload_skbuff_dma[i],
+					 channel->buf_size, DMA_TO_DEVICE);
+
+			if (tx_q->tx_offload_skbuff[i])
+				dev_kfree_skb_any(tx_q->tx_offload_skbuff[i]);
+
+			channel->buff_pool_addr.buff_pool_dma_addrs_base[i] = 0;
+			channel->buff_pool_addr.buff_pool_va_addrs_base[i] = NULL;
+		}
+		dma_free_coherent(priv->device, channel->desc_size * channel->desc_cnt,
+				  channel->desc_addr.desc_virt_addrs_base,
+				  tx_q->dma_tx_phy);
+		kfree(tx_q->tx_offload_skbuff);
+		kfree(tx_q->tx_offload_skbuff_dma);
+	}
+}
+
+static void free_ipa_rx_resources(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[channel->channel_num];
+	u32 i;
+
+	if (channel->ch_flags == TC956X_CONTIG_BUFS) {
+		dma_free_coherent(priv->device,
+				  channel->desc_size * channel->desc_cnt,
+				  channel->desc_addr.desc_virt_addrs_base,
+				  rx_q->dma_rx_phy);
+		dma_free_coherent(priv->device,
+				  channel->buf_size * channel->desc_cnt,
+				  channel->buff_pool_addr.buff_pool_va_addrs_base[0],
+				  rx_q->buff_rx_phy);
+	} else {
+		for (i = 0; i < channel->desc_cnt; i++) {
+			dma_unmap_single(priv->device,
+					 rx_q->rx_offload_skbuff_dma[i],
+					 channel->buf_size, DMA_FROM_DEVICE);
+
+			if (rx_q->rx_offload_skbuff[i])
+				dev_kfree_skb_any(rx_q->rx_offload_skbuff[i]);
+
+			channel->buff_pool_addr.buff_pool_dma_addrs_base[i] = 0;
+			channel->buff_pool_addr.buff_pool_va_addrs_base[i] = NULL;
+		}
+		dma_free_coherent(priv->device, channel->desc_size * channel->desc_cnt,
+				  channel->desc_addr.desc_virt_addrs_base,
+				  rx_q->dma_rx_phy);
+		kfree(rx_q->rx_offload_skbuff);
+		kfree(rx_q->rx_offload_skbuff_dma);
+	}
+}
+
+static int find_free_tx_channel(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	u32 ch;
+	struct tc956xmac_tx_queue *tx_q;
+
+	for (ch = 0; ch < MAX_TX_QUEUES_TO_USE; ch++) {
+		/* Find a free channel to use for IPA */
+		if (priv->plat->tx_dma_ch_owner[ch] == NOT_USED) {
+			channel->channel_num = ch;
+			break;
+		}
+	}
+
+	if (ch >= MAX_TX_QUEUES_TO_USE) {
+		netdev_err(priv->dev, "%s: ERROR: No valid Tx channel available\n", __func__);
+		return -EINVAL;
+	}
+
+	priv->plat->tx_dma_ch_owner[ch] = USE_IN_OFFLOADER;
+
+	tx_q = &priv->tx_queue[ch];
+	tx_q->priv_data = priv;
+
+	return 0;
+}
+
+static int find_free_rx_channel(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	u32 ch;
+	struct tc956xmac_rx_queue *rx_q;
+
+	for (ch = 0; ch < MAX_RX_QUEUES_TO_USE; ch++) {
+		/* Find a free channel to use for IPA */
+		if (priv->plat->rx_dma_ch_owner[ch] == NOT_USED) {
+			channel->channel_num = ch;
+			break;
+		}
+	}
+
+	if (ch >= MAX_RX_QUEUES_TO_USE) {
+		netdev_err(priv->dev, "%s: ERROR: No valid Rx channel available\n", __func__);
+		return -EINVAL;
+	}
+
+	priv->plat->rx_dma_ch_owner[ch] = USE_IN_OFFLOADER;
+
+	rx_q = &priv->rx_queue[ch];
+	rx_q->priv_data = priv;
+
+	return 0;
+}
+
+static int alloc_ipa_tx_resources(struct net_device *ndev, struct channel_info *channel, gfp_t flags)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	struct tc956xmac_tx_queue *tx_q;
+	struct sk_buff *skb;
+	u32 i;
+	int ret = -EINVAL;
+
+	ret = find_free_tx_channel(ndev, channel);
+
+	if (ret)
+		return ret;
+
+	tx_q = &priv->tx_queue[channel->channel_num];
+
+	channel->desc_addr.desc_virt_addrs_base = dma_alloc_coherent(priv->device,
+								channel->desc_size * channel->desc_cnt,
+								&tx_q->dma_tx_phy, flags);
+
+	if (!channel->desc_addr.desc_virt_addrs_base) {
+		netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+		goto err_mem;
+	}
+
+	tx_q->dma_tx = channel->desc_addr.desc_virt_addrs_base;
+	channel->desc_addr.desc_dma_addrs_base = tx_q->dma_tx_phy;
+
+	if (channel->ch_flags == TC956X_CONTIG_BUFS) {
+		channel->buff_pool_addr.buff_pool_va_addrs_base[0] = dma_alloc_coherent(priv->device, channel->buf_size * channel->desc_cnt,
+								&tx_q->buff_tx_phy, flags);
+		if (!channel->buff_pool_addr.buff_pool_va_addrs_base[0]) {
+			netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+			goto err_mem;
+		}
+		channel->buff_pool_addr.buff_pool_dma_addrs_base[0] = tx_q->buff_tx_phy;
+		tx_q->buffer_tx_va_addr = channel->buff_pool_addr.buff_pool_va_addrs_base[0];
+		return 0;
+	}
+
+	tx_q->tx_offload_skbuff_dma = kcalloc(channel->desc_cnt,
+				      sizeof(*tx_q->tx_offload_skbuff_dma), flags);
+	if (!tx_q->tx_offload_skbuff_dma) {
+
+		netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+		goto err_mem;
+	}
+
+	tx_q->tx_offload_skbuff = kcalloc(channel->desc_cnt, sizeof(struct sk_buff *), flags);
+	if (!tx_q->tx_offload_skbuff) {
+		netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+		goto err_mem;
+	}
+
+	for (i = 0; i < channel->desc_cnt; i++) {
+		skb = __netdev_alloc_skb_ip_align(priv->dev, channel->buf_size, flags);
+
+		if (!skb) {
+			netdev_err(priv->dev,
+					"%s: Rx init fails; skb is NULL\n", __func__);
+			goto err_mem;
+		}
+
+		tx_q->tx_offload_skbuff[i] = skb;
+		tx_q->tx_offload_skbuff_dma[i] = dma_map_single(priv->device, skb->data,
+							channel->buf_size, DMA_TO_DEVICE);
+
+		if (dma_mapping_error(priv->device, tx_q->tx_offload_skbuff_dma[i])) {
+			netdev_err(priv->dev, "%s: DMA mapping error\n", __func__);
+			dev_kfree_skb_any(skb);
+			goto err_mem;
+		}
+
+		channel->buff_pool_addr.buff_pool_va_addrs_base[i] = (void *)tx_q->tx_offload_skbuff[i]->data;
+		channel->buff_pool_addr.buff_pool_dma_addrs_base[i] = tx_q->tx_offload_skbuff_dma[i];
+
+	}
+
+	return 0;
+
+err_mem:
+	free_ipa_tx_resources(ndev, channel);
+	return -ENOMEM;
+}
+
+static int alloc_ipa_rx_resources(struct net_device *ndev, struct channel_info *channel, gfp_t flags)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	struct tc956xmac_rx_queue *rx_q;
+	struct sk_buff *skb;
+	u32 i;
+	int ret = -EINVAL;
+
+	ret = find_free_rx_channel(ndev, channel);
+
+	if (ret)
+		return ret;
+
+	rx_q = &priv->rx_queue[channel->channel_num];
+
+	channel->desc_addr.desc_virt_addrs_base = dma_alloc_coherent(priv->device, channel->desc_size * channel->desc_cnt,
+								&rx_q->dma_rx_phy, flags);
+
+	if (!channel->desc_addr.desc_virt_addrs_base) {
+		netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+		goto err_mem;
+	}
+
+	rx_q->dma_rx = channel->desc_addr.desc_virt_addrs_base;
+	channel->desc_addr.desc_dma_addrs_base = rx_q->dma_rx_phy;
+
+	if (channel->ch_flags == TC956X_CONTIG_BUFS) {
+		channel->buff_pool_addr.buff_pool_va_addrs_base[0] = dma_alloc_coherent(priv->device, channel->buf_size * channel->desc_cnt,
+								&rx_q->buff_rx_phy, flags);
+		if (!channel->buff_pool_addr.buff_pool_va_addrs_base[0]) {
+			netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+			goto err_mem;
+		}
+		channel->buff_pool_addr.buff_pool_dma_addrs_base[0] = rx_q->buff_rx_phy;
+		rx_q->buffer_rx_va_addr = channel->buff_pool_addr.buff_pool_va_addrs_base[0];
+		return 0;
+	}
+
+	rx_q->rx_offload_skbuff_dma = kcalloc(channel->desc_cnt,
+				      sizeof(*rx_q->rx_offload_skbuff_dma), flags);
+
+	if (!rx_q->rx_offload_skbuff_dma) {
+
+		netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+		goto err_mem;
+	}
+
+	rx_q->rx_offload_skbuff = kcalloc(channel->desc_cnt, sizeof(struct sk_buff *), flags);
+	if (!rx_q->rx_offload_skbuff) {
+		netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+		goto err_mem;
+	}
+
+	for (i = 0; i < channel->desc_cnt; i++) {
+		skb = __netdev_alloc_skb_ip_align(priv->dev, channel->buf_size, flags);
+
+		if (!skb) {
+			netdev_err(priv->dev,
+					"%s: Rx init fails; skb is NULL\n", __func__);
+			goto err_mem;
+		}
+
+		rx_q->rx_offload_skbuff[i] = skb;
+		rx_q->rx_offload_skbuff_dma[i] = dma_map_single(priv->device, skb->data,
+							channel->buf_size, DMA_FROM_DEVICE);
+
+		if (dma_mapping_error(priv->device, rx_q->rx_offload_skbuff_dma[i])) {
+			netdev_err(priv->dev, "%s: DMA mapping error\n", __func__);
+			dev_kfree_skb_any(skb);
+			goto err_mem;
+		}
+
+		channel->buff_pool_addr.buff_pool_va_addrs_base[i] = (void *)rx_q->rx_offload_skbuff[i]->data;
+		channel->buff_pool_addr.buff_pool_dma_addrs_base[i] = rx_q->rx_offload_skbuff_dma[i];
+
+	}
+
+	return 0;
+
+err_mem:
+	free_ipa_rx_resources(ndev, channel);
+	return -ENOMEM;
+}
+
+static void tc956xmac_init_ipa_tx_ch(struct tc956xmac_priv *priv, struct channel_info *channel)
+{
+	u32 i;
+	u32 chan = channel->channel_num;
+	struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[chan];
+
+	for (i = 0; i < channel->desc_cnt; i++) {
+
+		struct dma_desc *p;
+
+		p = tx_q->dma_tx + i;
+
+		tc956xmac_clear_desc(priv, p);
+		if (channel->ch_flags == TC956X_CONTIG_BUFS) {
+			tc956xmac_set_desc_addr(priv, p, (tx_q->buff_tx_phy + (i * channel->buf_size)));
+		} else {
+			tc956xmac_set_desc_addr(priv, p, channel->buff_pool_addr.buff_pool_dma_addrs_base[i]);
+		}
+	}
+
+	tc956xmac_init_chan(priv, priv->ioaddr, priv->plat->dma_cfg, chan);
+	tc956xmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+				tx_q->dma_tx_phy, chan);
+
+	tx_q->tx_tail_addr = tx_q->dma_tx_phy;
+	tc956xmac_set_tx_tail_ptr(priv, priv->ioaddr,
+				       tx_q->tx_tail_addr, chan);
+
+	tc956xmac_set_tx_ring_len(priv, priv->ioaddr, channel->desc_cnt - 1, chan);
+
+	tc956xmac_set_mtl_tx_queue_weight(priv, priv->hw,
+					priv->plat->tx_queues_cfg[chan].weight, chan);
+
+}
+
+static void tc956xmac_init_ipa_rx_ch(struct tc956xmac_priv *priv, struct channel_info *channel)
+{
+	u32 i;
+	u32 chan = channel->channel_num;
+	struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[chan];
+
+	for (i = 0; i < channel->desc_cnt; i++) {
+		struct dma_desc *p;
+
+		p = rx_q->dma_rx + i;
+
+		tc956xmac_init_rx_desc(priv, &rx_q->dma_rx[i],
+					priv->use_riwt, priv->mode,
+					(i == channel->desc_cnt - 1),
+					channel->buf_size);
+
+		if (channel->ch_flags == TC956X_CONTIG_BUFS) {
+			tc956xmac_set_desc_addr(priv, p, (rx_q->buff_rx_phy + (i * channel->buf_size)));
+		} else {
+			tc956xmac_set_desc_addr(priv, p, channel->buff_pool_addr.buff_pool_dma_addrs_base[i]);
+		}
+	}
+
+	tc956xmac_init_chan(priv, priv->ioaddr, priv->plat->dma_cfg, chan);
+	tc956xmac_init_rx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+				    rx_q->dma_rx_phy, chan);
+
+	rx_q->rx_tail_addr = rx_q->dma_rx_phy +
+				 (channel->desc_cnt * sizeof(struct dma_desc));
+	tc956xmac_set_rx_tail_ptr(priv, priv->ioaddr, rx_q->rx_tail_addr, chan);
+
+	tc956xmac_set_rx_ring_len(priv, priv->ioaddr, (channel->desc_cnt - 1), chan);
+	tc956xmac_set_dma_bfsize(priv, priv->ioaddr, channel->buf_size, chan);
+
+}
+
+static void dealloc_ipa_tx_resources(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	struct tc956xmac_tx_queue *tx_q;
+	u32 ch = channel->channel_num;
+
+	priv->plat->tx_dma_ch_owner[ch] = NOT_USED;
+
+	tx_q = &priv->tx_queue[ch];
+	tx_q->priv_data = NULL;
+
+	free_ipa_tx_resources(ndev, channel);
+
+	tx_q->dma_tx = NULL;
+
+}
+
+static void dealloc_ipa_rx_resources(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	struct tc956xmac_rx_queue *rx_q;
+	u32 ch = channel->channel_num;
+
+	priv->plat->rx_dma_ch_owner[ch] = NOT_USED;
+
+	rx_q = &priv->rx_queue[ch];
+	rx_q->priv_data = NULL;
+
+	free_ipa_rx_resources(ndev, channel);
+
+	rx_q->dma_rx = NULL;
+}
+
+
+/*!
+ * \brief API to allocate a channel for IPA  Tx/Rx datapath,
+ *	  allocate memory and buffers for the DMA channel, setup the
+ *	  descriptors and configure the the require registers and
+ *	  mark the channel as used by IPA in the TC956x driver
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as,
+ *	  out of bounds buf size > 9K bytes, descriptor count > 512
+ *
+ * \param[in] channel_input : data structure specifying all input needed to request a channel
+ *
+ * \return channel_info : Allocate memory for channel_info structure and initialize the structure members
+ *			  NULL on fail
+ * \remarks :In case of Tx, only TDES0 and TDES1 will be updated with buffer addresses. TDES2 and TDES3
+ *	    must be updated by the offloading driver.
+ */
+struct channel_info* request_channel(struct request_channel_input *channel_input)
+{
+	struct channel_info *channel;
+	struct tc956xmac_priv *priv;
+	struct tc956xmac_tx_queue *tx_q;
+	struct tc956xmac_rx_queue *rx_q;
+
+	if (!channel_input) {
+		pr_err("%s: ERROR: Invalid channel_input pointer\n", __func__);
+		return NULL;
+	}
+
+	if (!channel_input->ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return NULL;
+	}
+
+	priv = netdev_priv(channel_input->ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return NULL;
+	}
+
+	if (channel_input->desc_cnt > IPA_MAX_DESC_CNT) {
+		netdev_err(priv->dev, "%s: ERROR: Descriptor count greater than %d\n", __func__, IPA_MAX_DESC_CNT);
+		return NULL;
+	}
+
+	if (channel_input->buf_size > IPA_MAX_BUFFER_SIZE) {
+		netdev_err(priv->dev, "%s: ERROR: Buffer size greater than %d bytes\n", __func__, IPA_MAX_BUFFER_SIZE);
+
+		return NULL;
+	}
+
+	channel = kzalloc(sizeof(*channel), GFP_KERNEL);
+	if (!channel) {
+		netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+		return NULL;
+	}
+
+	channel->buf_size = channel_input->buf_size;
+	channel->client_ch_priv = channel_input->client_ch_priv;
+	channel->desc_cnt = channel_input->desc_cnt;
+	channel->desc_size = sizeof(struct dma_desc);
+	channel->direction = channel_input->ch_dir;
+	channel->mem_ops = channel_input->mem_ops;
+	channel->ch_flags = channel_input->ch_flags;
+
+	channel->buff_pool_addr.buff_pool_va_addrs_base = kcalloc(channel_input->desc_cnt, sizeof(void *),
+								  (gfp_t)channel_input->flags);
+
+	if (!channel->buff_pool_addr.buff_pool_va_addrs_base) {
+		netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+		goto err_buff_mem_alloc;
+	}
+
+	channel->buff_pool_addr.buff_pool_dma_addrs_base = kcalloc(channel_input->desc_cnt, sizeof(dma_addr_t),
+								   (gfp_t)channel_input->flags);
+
+	if (!channel->buff_pool_addr.buff_pool_dma_addrs_base) {
+		netdev_err(priv->dev, "%s: ERROR: allocating memory\n", __func__);
+		goto err_buff_dma_mem_alloc;
+	}
+
+	channel->dma_pdev = (struct pci_dev *)priv->device;
+
+	if (channel->mem_ops) {
+		/*if mem_ops is a valid, memory resrouces will be allocated by IPA */
+
+		if (channel->mem_ops->alloc_descs) {
+			channel->mem_ops->alloc_descs(channel_input->ndev, channel->desc_size, NULL,
+							    (gfp_t)channel_input->flags,
+							    channel->mem_ops, channel);
+		} else {
+			netdev_err(priv->dev,
+				"%s: ERROR: mem_ops is valid but alloc_descs is invalid\n", __func__);
+			goto err_invalid_mem_ops;
+		}
+
+		if (channel->mem_ops->alloc_buf) {
+			channel->mem_ops->alloc_buf(channel_input->ndev, channel->desc_size, NULL,
+							  (gfp_t)channel_input->flags,
+							  channel->mem_ops, channel);
+		} else {
+			netdev_err(priv->dev,
+				"%s: ERROR: mem_ops is valid but alloc_buff is invalid\n", __func__);
+
+			if (channel->mem_ops->free_descs)
+				channel->mem_ops->free_descs(channel_input->ndev, NULL,
+								   sizeof(struct dma_desc), NULL,
+								   channel->mem_ops, channel);
+
+			goto err_invalid_mem_ops;
+		}
+
+		if (channel_input->ch_dir == CH_DIR_TX) {
+			find_free_tx_channel(channel_input->ndev, channel);
+			tx_q = &priv->tx_queue[channel->channel_num];
+			tx_q->dma_tx = channel->desc_addr.desc_virt_addrs_base;
+			tx_q->dma_tx_phy = channel->desc_addr.desc_dma_addrs_base;
+		} else if (channel_input->ch_dir == CH_DIR_RX) {
+			find_free_rx_channel(channel_input->ndev, channel);
+			rx_q = &priv->rx_queue[channel->channel_num];
+			rx_q->dma_rx = channel->desc_addr.desc_virt_addrs_base;
+			rx_q->dma_rx_phy = channel->desc_addr.desc_dma_addrs_base;
+		} else {
+			netdev_err(priv->dev,
+					"%s: ERROR: Invalid channel direction\n", __func__);
+			goto err_invalid_ch_dir;
+		}
+	} else {
+		/* Allocate resources for descriptor and buffer */
+
+		if (channel_input->ch_dir == CH_DIR_TX) {
+			if (alloc_ipa_tx_resources(channel_input->ndev, channel, (gfp_t)channel_input->flags)) {
+				netdev_err(priv->dev,
+						"%s: ERROR: allocating Tx resources\n", __func__);
+				goto err_invalid_mem_ops;
+			}
+		} else if (channel_input->ch_dir == CH_DIR_RX) {
+			if (alloc_ipa_rx_resources(channel_input->ndev, channel, (gfp_t)channel_input->flags)) {
+				netdev_err(priv->dev,
+						"%s: ERROR: allocating Rx resources\n", __func__);
+				goto err_invalid_mem_ops;
+			}
+		} else {
+			netdev_err(priv->dev,
+					"%s: ERROR: Invalid channel direction\n", __func__);
+
+			goto err_invalid_ch_dir;
+		}
+
+	}
+
+	/* Configure DMA registers */
+	if (channel_input->ch_dir == CH_DIR_TX) {
+		tc956xmac_init_ipa_tx_ch(priv, channel);
+		tc956xmac_stop_tx(priv, priv->ioaddr, channel->channel_num);
+		channel_input->tail_ptr_addr = XGMAC_DMA_CH_TxDESC_TAIL_LPTR(channel->channel_num);
+	} else if (channel_input->ch_dir == CH_DIR_RX) {
+		tc956xmac_init_ipa_rx_ch(priv, channel);
+		tc956xmac_stop_rx(priv, priv->ioaddr, channel->channel_num);
+		channel_input->tail_ptr_addr = XGMAC_DMA_CH_RxDESC_TAIL_LPTR(channel->channel_num);
+	} else {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel direction\n", __func__);
+
+		goto err_invalid_ch_dir;
+	}
+
+	return channel;
+
+err_invalid_ch_dir:
+err_invalid_mem_ops:
+err_buff_dma_mem_alloc:
+	kfree(channel->buff_pool_addr.buff_pool_va_addrs_base);
+err_buff_mem_alloc:
+	channel->desc_addr.desc_dma_addrs_base = 0;
+	kfree(channel);
+
+	return NULL;
+
+}
+EXPORT_SYMBOL_GPL(request_channel);
+
+
+/*!
+ * \brief Release the resources associated with the channel
+ *	  and mark the channel as free in the TC956x driver,
+ *	  reset the descriptors and registers
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer or memory buffers in channel pointer are NULL
+ *
+ * \remarks : DMA Channel has to be stopped prior to invoking this API
+ */
+int release_channel(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv;
+	struct mem_ops *mem_ops;
+	struct tc956xmac_tx_queue *tx_q;
+	struct tc956xmac_rx_queue *rx_q;
+	u32 ch;
+	u32 offload_release_sts = true;
+
+	int ret = -EINVAL;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!channel) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel info structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if ((!channel->desc_addr.desc_virt_addrs_base) || (!channel->desc_addr.desc_dma_addrs_base) ||
+		(!channel->buff_pool_addr.buff_pool_dma_addrs_base) || (!channel->buff_pool_addr.buff_pool_va_addrs_base)) {
+
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid memory pointers\n", __func__);
+		return -EINVAL;
+	}
+
+	if ((channel->direction == CH_DIR_RX &&
+		priv->plat->rx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if ((channel->direction == CH_DIR_TX &&
+		priv->plat->tx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	priv = netdev_priv(ndev);
+	mem_ops = channel->mem_ops;
+
+	if (mem_ops) {
+		if (mem_ops->free_descs) {
+			mem_ops->free_descs(ndev, NULL, channel->desc_size, NULL, mem_ops, channel);
+			ret = 0;
+		} else {
+			netdev_err(priv->dev,
+					"%s: ERROR: mem_ops is valid but free_descs is invalid\n", __func__);
+			ret = -EINVAL;
+			goto err_free_desc;
+		}
+
+		if (mem_ops->free_buf) {
+			mem_ops->free_buf(ndev, NULL, channel->desc_size, NULL, mem_ops, channel);
+			ret = 0;
+		} else {
+			netdev_err(priv->dev,
+					"%s: ERROR: mem_ops is valid but free_buf is invalid\n", __func__);
+			ret = -EINVAL;
+			goto err_free_buff;
+		}
+
+		if (channel->direction == CH_DIR_TX) {
+			priv->plat->tx_dma_ch_owner[channel->channel_num] = NOT_USED;
+
+			tx_q = &priv->tx_queue[channel->channel_num];
+			tx_q->priv_data = NULL;
+			tx_q->dma_tx = NULL;
+		} else if (channel->direction == CH_DIR_RX) {
+			priv->plat->rx_dma_ch_owner[channel->channel_num] = NOT_USED;
+
+			rx_q = &priv->rx_queue[channel->channel_num];
+			rx_q->priv_data = NULL;
+			rx_q->dma_rx = NULL;
+		} else {
+			netdev_err(priv->dev,
+					"%s: ERROR: Invalid channel direction\n", __func__);
+			ret = -EINVAL;
+			goto err_invalid_ch_dir;
+		}
+
+	} else {
+
+		if (channel->direction == CH_DIR_TX) {
+			tc956xmac_stop_tx(priv, priv->ioaddr, channel->channel_num);
+			dealloc_ipa_tx_resources(ndev, channel);
+			ret = 0;
+		} else if (channel->direction == CH_DIR_RX) {
+			tc956xmac_stop_rx(priv, priv->ioaddr, channel->channel_num);
+			dealloc_ipa_rx_resources(ndev, channel);
+			ret = 0;
+		} else {
+			netdev_err(priv->dev,
+					"%s: ERROR: Invalid channel direction\n", __func__);
+			ret = -EINVAL;
+			goto err_invalid_ch_dir;
+		}
+	}
+
+	mutex_lock(&priv->port_ld_release_lock);
+	/* Checking whether any Tx channel enabled for offload or not*/
+	for (ch = 0; ch < MAX_TX_QUEUES_TO_USE; ch++) {
+		/* If offload channels are not freed, update the flag, so that power saving API will not be called*/
+		if (priv->plat->tx_dma_ch_owner[ch] == USE_IN_OFFLOADER) {
+			offload_release_sts = false;
+			break;
+		}
+	}
+	/* Checking whether any Rx channel enabled for offload or not*/
+	for (ch = 0; ch < MAX_RX_QUEUES_TO_USE; ch++) {
+		/* If offload channels are not freed, update the flag, so that power saving API will not be called*/
+		if (priv->plat->rx_dma_ch_owner[ch] == USE_IN_OFFLOADER) {
+			offload_release_sts = false;
+			break;
+		}
+	}
+
+	/* If all channels are freed, call API for power saving*/
+	if (priv->port_release == true && offload_release_sts == true) {
+		tc956xmac_link_change_set_power(priv, LINK_DOWN); /* Save, Assert and Disable Reset and Clock */
+	}
+	mutex_unlock(&priv->port_ld_release_lock);
+
+err_free_desc:
+err_free_buff:
+err_invalid_ch_dir:
+	kfree(channel->buff_pool_addr.buff_pool_va_addrs_base);
+	channel->desc_addr.desc_dma_addrs_base = 0;
+	kfree(channel);
+
+	return ret;
+
+
+}
+EXPORT_SYMBOL_GPL(release_channel);
+
+
+/*!
+ * \brief Update the location in CM3 SRAM with a PCIe Write Address and
+ *	  value for the associated channel. When Tx/Rx interrupts occur,
+ *	  the FW will write the value to the PCIe location
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as,
+ *	  non IPA channel, out of range CM3 accesesible PCIe address
+ *
+ * \param[in] ndev : TC956x netdev  data structure
+ * \param[in] channel : Pointer to channel info containing the channel information
+ * \param[in] addr : PCIe Address location to which the PCIe write is to be performed from CM3 FW
+ *
+ * \return : O for success
+ *	     -EPERM if non IPA channels are accessed, out of range PCIe access location for CM3
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ *
+ * \remarks :
+ *	     If this API is invoked for a channel without calling release_event(),
+ *	     then the PCIe address and value for that channel will be overwritten
+ *	     Mask = 2 ^ (CM3_TAMAP_ATR_SIZE + 1) - 1
+ *	     TRSL_ADDR = DMA_PCIe_ADDR & ~((2 ^ (ATR_SIZE + 1) - 1) = TRSL_ADDR = DMA_PCIe_ADDR & ~Mask
+ *	     CM3 Target Address = DMA_PCIe_ADDR & Mask | SRC_ADDR
+ */
+int request_event(struct net_device *ndev, struct channel_info *channel, dma_addr_t addr)
+{
+	struct tc956xmac_priv *priv;
+	u8 table_entry = 1; /* Table entry 0 is for eMAC */
+	struct tc956xmac_cm3_tamap tamap;
+	u32 val, cm3_target_addr;
+	dma_addr_t trsl_addr;
+	unsigned long flags;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!channel) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel info structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if ((channel->direction == CH_DIR_RX &&
+		priv->plat->rx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if ((channel->direction == CH_DIR_TX &&
+		priv->plat->tx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	spin_lock_irqsave(&cm3_tamap_lock, flags);
+	while (table_entry <= MAX_CM3_TAMAP_ENTRIES) {
+		val = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry));
+
+		KPRINT_INFO("SL0%d TRSL_ADDR HI = 0x%08x\n", table_entry,
+			readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + TC956X_AXI4_SLV_TRSL_ADDR_HI(0, table_entry)));
+		KPRINT_INFO("SL0%d TRSL_ADDR LO = 0x%08x\n", table_entry,
+			readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + TC956X_AXI4_SLV_TRSL_ADDR_LO(0, table_entry)));
+		KPRINT_INFO("SL0%d SRC_ADDR HI = 0x%08x\n", table_entry,
+			readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_HI(0, table_entry)));
+		KPRINT_INFO("SL0%d SRC_ADDR LO = 0x%08x\n", table_entry,
+			readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry)));
+
+		if (((val & TC956X_ATR_SIZE_MASK) >> TC956x_ATR_SIZE_SHIFT) != 0x3F) {
+			/* If a entry already exists, then check the range */
+			trsl_addr = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + TC956X_AXI4_SLV_TRSL_ADDR_LO(0, table_entry));
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+			trsl_addr |= (dma_addr_t)readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + TC956X_AXI4_SLV_TRSL_ADDR_HI(0, table_entry)) << 32U;
+#endif
+			if ((trsl_addr <= addr) && (addr <= (trsl_addr + CM3_TAMAP_SIZE - 1))) {
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+				netdev_info(priv->dev, "TAMAP Table %d manages address = 0x%x\n", table_entry, addr);
+#else
+				netdev_info(priv->dev, "TAMAP Table %d manages address = 0x%llx\n", table_entry, addr);
+#endif
+				break;
+			}
+		} else {
+
+			/* Create a new tamap entry */
+			tamap.src_addr_hi = 0x0;
+			tamap.src_addr_low = CM3_TAMAP_SRC_ADDR_START + (CM3_TAMAP_SIZE * (table_entry - 1));
+			trsl_addr = addr & ~CM3_TAMAP_MASK;
+			tamap.trsl_addr_hi = upper_32_bits(trsl_addr);
+			tamap.trsl_addr_low = lower_32_bits(trsl_addr);
+			tamap.atr_size = CM3_TAMAP_ATR_SIZE;
+
+			tc956x_config_CM3_tamap(priv->device, priv->tc956x_BRIDGE_CFG_pci_base_addr,
+							&tamap, table_entry);
+			break;
+		}
+		table_entry++;
+	}
+	spin_unlock_irqrestore(&cm3_tamap_lock, flags);
+
+	if (table_entry > MAX_CM3_TAMAP_ENTRIES) {
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+		netdev_err(priv->dev,
+				"%s: ERROR: TAMAP Table full. Cannot map PCIe address = 0x%x\n", __func__, addr);
+#else
+		netdev_err(priv->dev,
+				"%s: ERROR: TAMAP Table full. Cannot map PCIe address = 0x%llx\n", __func__, addr);
+#endif
+		return -EPERM;
+	}
+
+	/* Derive CM3 target address */
+	cm3_target_addr = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry)) & TC956X_SRC_LO_MASK;
+	cm3_target_addr |= (addr & CM3_TAMAP_MASK);
+
+	if (cm3_target_addr < CM3_PCIE_REGION_LOW_BOUND || cm3_target_addr >= CM3_PCIE_REGION_UP_BOUND) {
+		netdev_err(priv->dev,
+				"%s: ERROR: PCIe address out of range\n", __func__);
+		return -EPERM;
+	}
+
+	if (channel->direction == CH_DIR_TX) {
+#ifdef TC956X
+		writel(cm3_target_addr, priv->tc956x_SRAM_pci_base_addr +
+			SRAM_TX_PCIE_ADDR_LOC + (priv->port_num * TC956XMAC_CH_MAX * 4) +
+			(channel->channel_num * 4));
+#endif
+	} else if (channel->direction == CH_DIR_RX) {
+#ifdef TC956X
+		writel(cm3_target_addr, priv->tc956x_SRAM_pci_base_addr +
+			SRAM_RX_PCIE_ADDR_LOC + (priv->port_num * TC956XMAC_CH_MAX * 4) +
+			(channel->channel_num * 4));
+#endif
+	} else {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel direction\n", __func__);
+		return -EINVAL;
+
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(request_event);
+
+
+/*!
+ * \brief Update the location in CM3 SRAM with a PCIe Write Address and
+ *	  value for the associated channel to zero
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ */
+int release_event(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!channel) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel info structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if ((channel->direction == CH_DIR_RX &&
+		priv->plat->rx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if ((channel->direction == CH_DIR_TX &&
+		priv->plat->tx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if (channel->direction == CH_DIR_TX) {
+#ifdef TC956X
+		writel(0, priv->tc956x_SRAM_pci_base_addr +
+			SRAM_TX_PCIE_ADDR_LOC + (priv->port_num * TC956XMAC_CH_MAX * 4) +
+			(channel->channel_num * 4));
+#endif
+
+	} else if (channel->direction == CH_DIR_RX) {
+#ifdef TC956X
+		writel(0, priv->tc956x_SRAM_pci_base_addr +
+			SRAM_RX_PCIE_ADDR_LOC + (priv->port_num * TC956XMAC_CH_MAX * 4) +
+			(channel->channel_num * 4));
+#endif
+	} else {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel direction\n", __func__);
+		return -EINVAL;
+
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(release_event);
+
+
+/*!
+ * \brief Enable interrupt generation for given channel
+ *
+ * The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ */
+int enable_event(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv;
+	u32 reg;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!channel) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel info structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if ((channel->direction == CH_DIR_RX &&
+		priv->plat->rx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if ((channel->direction == CH_DIR_TX &&
+		priv->plat->tx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if (channel->direction == CH_DIR_TX) {
+#ifdef TC956X
+		if (priv->port_num == RM_PF0_ID) {
+			reg = readl(priv->ioaddr + INTMCUMASK0);
+			reg &= ~(1 << (INTMCUMASK_TX_CH0 + channel->channel_num));
+			writel(reg, priv->ioaddr + INTMCUMASK0);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			reg = readl(priv->ioaddr + INTMCUMASK1);
+			reg &= ~(1 << (INTMCUMASK_TX_CH0 + channel->channel_num));
+			writel(reg, priv->ioaddr + INTMCUMASK1);
+		}
+#endif
+
+	} else if (channel->direction == CH_DIR_RX) {
+#ifdef TC956X
+		if (priv->port_num == RM_PF0_ID) {
+			reg = readl(priv->ioaddr + INTMCUMASK0);
+			reg &= ~(1 << (INTMCUMASK_RX_CH0 + channel->channel_num));
+			writel(reg, priv->ioaddr + INTMCUMASK0);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			reg = readl(priv->ioaddr + INTMCUMASK1);
+			reg &= ~(1 << (INTMCUMASK_RX_CH0 + channel->channel_num));
+			writel(reg, priv->ioaddr + INTMCUMASK1);
+		}
+#endif
+
+	} else {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel direction\n", __func__);
+		return -EINVAL;
+
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(enable_event);
+
+/*!
+ * \brief Disable interrupt generation for given channel
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ */
+int disable_event(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv;
+	u32 reg;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!channel) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel info structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if ((channel->direction == CH_DIR_RX &&
+		priv->plat->rx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if ((channel->direction == CH_DIR_TX &&
+		priv->plat->tx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if (channel->direction == CH_DIR_TX) {
+		if (priv->port_num == RM_PF0_ID) {
+			reg = readl(priv->ioaddr + INTMCUMASK0);
+			reg |= (1 << (INTMCUMASK_TX_CH0 + channel->channel_num));
+			writel(reg, priv->ioaddr + INTMCUMASK0);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			reg = readl(priv->ioaddr + INTMCUMASK1);
+			reg |= (1 << (INTMCUMASK_TX_CH0 + channel->channel_num));
+			writel(reg, priv->ioaddr + INTMCUMASK1);
+		}
+
+	} else if (channel->direction == CH_DIR_RX) {
+		if (priv->port_num == RM_PF0_ID) {
+			reg = readl(priv->ioaddr + INTMCUMASK0);
+			reg |= (1 << (INTMCUMASK_RX_CH0 + channel->channel_num));
+			writel(reg, priv->ioaddr + INTMCUMASK0);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			reg = readl(priv->ioaddr + INTMCUMASK1);
+			reg |= (1 << (INTMCUMASK_RX_CH0 + channel->channel_num));
+			writel(reg, priv->ioaddr + INTMCUMASK1);
+		}
+
+	} else {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel direction\n", __func__);
+		return -EINVAL;
+
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(disable_event);
+
+/*!
+ * \brief Control the Rx DMA interrupt generation by modfying the Rx WDT timer
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as,
+ *	  non IPA channel, event moderation for Tx path
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ * \param[in] wdt : Watchdog timeout value in clock cycles
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed, IPA Tx channel
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ */
+int set_event_mod(struct net_device *ndev, struct channel_info *channel, unsigned int wdt)
+{
+	struct tc956xmac_priv *priv;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!channel) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel info structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if ((priv->plat->rx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER) ||
+		channel->direction == CH_DIR_TX) {
+
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+		return -EPERM;
+	}
+
+	if (wdt > MAX_WDT) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Timeout value Out of range\n", __func__);
+		return -EINVAL;
+	}
+#ifdef TC956X
+	writel(wdt & XGMAC_RWT, priv->ioaddr + XGMAC_DMA_CH_Rx_WATCHDOG(channel->channel_num));
+#endif
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(set_event_mod);
+
+/*!
+ * \brief This API will configure the FRP table with the parameters passed through rx_filter_info.
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel,
+ *	  number of filter entries > 72
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] filter_params: filter_params containig the parameters based on which packet will pass or drop
+ * \return : Return 0 on success, -ve value on error
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL filter_params, if number of entries > 72
+ *
+ * \remarks : The entries should be prepared considering the filtering and routing to CortexA also
+ *	      MAC Rx will be stopped while updating FRP table dynamically.
+ */
+int set_rx_filter(struct net_device *ndev, struct rx_filter_info *filter_params)
+{
+	struct tc956xmac_priv *priv;
+	struct tc956xmac_rx_parser_cfg *cfg;
+	u32 ret = -EINVAL;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!filter_params) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid filter parameters structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if (filter_params->npe > MAX_PARSABLE_FRP_ENTRIES) {
+		netdev_err(priv->dev,
+				"%s: ERROR: No. of FRP entries exceed maximum parsable entries of %d\n",
+				__func__, MAX_PARSABLE_FRP_ENTRIES);
+		return -EINVAL;
+	}
+
+	cfg = &priv->plat->rxp_cfg;
+
+	cfg->nve = filter_params->nve;
+	cfg->npe = filter_params->npe;
+	memcpy(cfg->entries, filter_params->entries, filter_params->nve * sizeof(filter_params->entries[0]));
+
+	priv->plat->rxp_cfg.enable = true;
+	ret = tc956xmac_rx_parser_configuration(priv);
+
+	return ret;
+
+}
+EXPORT_SYMBOL_GPL(set_rx_filter);
+
+/*!
+ * \brief This API will clear the FRP filters and route all packets to RxCh0
+ *
+ *	 The API will check for NULL pointers
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \return : Return 0 on success, -ve value on error
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *
+ * \remarks : MAC Rx will be stopped while updating FRP table dynamically.
+
+ */
+int clear_rx_filter(struct net_device *ndev)
+{
+	struct tc956xmac_priv *priv;
+	struct tc956xmac_rx_parser_cfg *cfg;
+	struct rxp_filter_entry filter_entries;
+	u32 ret = -EINVAL;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+#ifdef TC956X
+	/* Create FRP entries to route all packets to RxCh0 */
+	filter_entries.match_data = 0x00000000;
+	filter_entries.match_en = 0x00000000;
+	filter_entries.af = 1;
+	filter_entries.rf = 0;
+	filter_entries.im = 0;
+	filter_entries.nc = 0;
+	filter_entries.res1 = 0;
+	filter_entries.frame_offset = 0;
+	filter_entries.res2 = 0;
+	filter_entries.ok_index = 0;
+	filter_entries.res3 = 0;
+	filter_entries.dma_ch_no = 1;
+	filter_entries.res4 = 0;
+#endif
+
+	cfg = &priv->plat->rxp_cfg;
+
+	cfg->nve = 1;
+	cfg->npe = 1;
+
+	memcpy(cfg->entries, &filter_entries, cfg->nve * sizeof(struct rxp_filter_entry));
+
+	ret = tc956xmac_rx_parser_configuration(priv);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(clear_rx_filter);
+
+/*!
+ * \brief Start the DMA channel. channel_dir member variable
+ *	  will be used to start the Tx/Rx channel
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+
+ */
+int start_channel(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv;
+	struct mac_addr_list mac_addr;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!channel) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel info structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if ((channel->direction == CH_DIR_RX &&
+		priv->plat->rx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if ((channel->direction == CH_DIR_TX &&
+		priv->plat->tx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if (channel->direction == CH_DIR_TX) {
+		netdev_dbg(priv->dev, "DMA Tx process started in channel = %d\n", channel->channel_num);
+		tc956xmac_start_tx(priv, priv->ioaddr, channel->channel_num);
+	} else if (channel->direction == CH_DIR_RX) {
+		mac_addr.ae = MAC_ADDR_AE;
+		mac_addr.mbc = MAC_ADDR_MBC;
+		mac_addr.dcs = MAC_ADDR_DCS;
+		memcpy(&mac_addr.addr[0], &mac_addr_default[0], sizeof(mac_addr_default));
+		set_mac_addr(ndev, &mac_addr, MAC_ADDR_INDEX);
+
+		netdev_dbg(priv->dev, "DMA Rx process started in channel = %d\n", channel->channel_num);
+		tc956xmac_start_rx(priv, priv->ioaddr, channel->channel_num);
+	} else {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+		return -EPERM;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(start_channel);
+
+/*!
+ * \brief Stop the DMA channel. channel_dir member variable will be
+ *	  used to stop the Tx/Rx channel. In case of Rx, clear the
+ *	  MTL queue associated with the channel and this will result in packet drops
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer  NULL
+ */
+int stop_channel(struct net_device *ndev, struct channel_info *channel)
+{
+	struct tc956xmac_priv *priv;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!channel) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel info structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if ((channel->direction == CH_DIR_RX &&
+		priv->plat->rx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if ((channel->direction == CH_DIR_TX &&
+		priv->plat->tx_dma_ch_owner[channel->channel_num] != USE_IN_OFFLOADER)) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+			return -EPERM;
+	}
+
+	if (channel->direction == CH_DIR_TX) {
+		netdev_dbg(priv->dev, "DMA Tx process stopped in channel = %d\n", channel->channel_num);
+		tc956xmac_stop_tx(priv, priv->ioaddr, channel->channel_num);
+	} else if (channel->direction == CH_DIR_RX) {
+		netdev_dbg(priv->dev, "DMA Rx process stopped in channel = %d\n", channel->channel_num);
+		tc956xmac_stop_rx(priv, priv->ioaddr, channel->channel_num);
+	} else {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid channel\n", __func__);
+		return -EPERM;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(stop_channel);
+
+/*!
+ * \brief Configure MAC registers at a particular index in the MAC Address list
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] mac_addr : Pointer to structure containing mac_addr_list that needs to updated
+ *		     in MAC_Address_High and MAC_Address_Low registers
+ * \param[in] index : Index in the MAC Address Register list
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if index 0 used
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if mac_addr NULL
+ *
+ * \remarks : Do not use the API to set register at index 0.
+ *	      There is possibilty of kernel network subsytem overwriting these registers
+ *	      when " tc956xmac_set_rx_mode" is invoked via "ndo_set_rx_mode" callback.
+ */
+int set_mac_addr(struct net_device *ndev, struct mac_addr_list *mac_addr, u8 index)
+{
+	struct tc956xmac_priv *priv;
+	u32 data;
+
+	if (!ndev) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	priv = netdev_priv(ndev);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -ENODEV;
+	}
+
+	if (!mac_addr) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Invalid mac addr list structure\n", __func__);
+		return -EINVAL;
+	}
+
+	if (index == 0) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Do not use index 0\n", __func__);
+		return -EPERM;
+	}
+
+	if (index >= TC956X_MAX_PERFECT_ADDRESSES) {
+		netdev_err(priv->dev,
+				"%s: ERROR: Index out of range\n", __func__);
+		return -EPERM;
+	}
+
+	data = (mac_addr->addr[5] << 8) | (mac_addr->addr[4]) |
+		(mac_addr->ae << XGMAC_AE_SHIFT) | (mac_addr->mbc << XGMAC_MBC_SHIFT);
+	writel(data, priv->ioaddr + XGMAC_ADDRx_HIGH(index));
+
+	data = (mac_addr->addr[3] << 24) | (mac_addr->addr[2] << 16) |
+		(mac_addr->addr[1] << 8) | mac_addr->addr[0];
+	writel(data, priv->ioaddr + XGMAC_ADDRx_LOW(index));
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(set_mac_addr);
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_ipa_intf.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_ipa_intf.h
@@ -0,0 +1,424 @@
+/*
+ * TC956x IPA I/F layer
+ *
+ * tc956x_ipa_intf.h
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  29 Oct 2020 : Initial version
+ *  04 Dec 2020 : Updated return values.
+ *  16 Dec 2020 : Updated request_event API
+ *  VERSION     : 00-03
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  20 Jul 2021 : 1. IPA statistics print function removed
+ *  VERSION     : 01-00-03
+ *  22 Jul 2021 : 1. Dynamic CM3 TAMAP configuration
+ *  VERSION     : 01-00-05
+ *  23 Jul 2021 : 1. Add support for contiguous allocation of memory
+ *  VERSION     : 01-00-06
+ *  29 Jul 2021 : 1. Add support to set MAC Address register
+ *  VERSION     : 01-00-07
+ *  05 Aug 2021 : Store and use Port0 pci_dev for all DMA allocation/mapping for IPA path
+ *  VERSION     : 01-00-08
+ */
+
+#ifndef __TC956x_IPA_INTF_H
+#define __TC956x_IPA_INTF_H
+
+#include <linux/netdevice.h>
+
+enum channel_dir {
+	CH_DIR_RX,
+	CH_DIR_TX,
+};
+
+struct tc956x_ipa_version {
+	unsigned char major;  /* IPA I/F major version */
+	unsigned char minor;  /* IPA I/F minor version */
+};
+
+/*!
+ * \remarks :
+ * desc_virt_addrs_base : If mem_ops is valid, the base pointer will be updated mem_ops callbacks
+ * desc_dma_addrs_base : If mem_ops is valid, the base address will be updated mem_ops callbacks
+ */
+
+struct ipa_desc_addr {
+	struct dma_desc *desc_virt_addrs_base;	/* Base address to descriptor vitrual addr */
+	dma_addr_t desc_dma_addrs_base;		/* Base address to descriptor dma addr */
+};
+
+struct ipa_buff_pool_addr {
+	void **buff_pool_va_addrs_base;		/* array to hold each buffer VA */
+	dma_addr_t *buff_pool_dma_addrs_base;	/* array to hold each buffer DMA addr */
+};
+
+struct rxp_filter_entry {
+	u32 match_data;
+	u32 match_en;
+	u8 af:1;
+	u8 rf:1;
+	u8 im:1;
+	u8 nc:1;
+	u8 res1:4;
+	u8 frame_offset:6;
+	u8 res2:2;
+	u8 ok_index;
+	u8 res3;
+	u16 dma_ch_no;
+	u16 res4;
+};
+
+struct rx_filter_info {
+	u32 nve;	/* Max block entries user want to write */
+	u32 npe;	/* number of parsable entries in the Instruction Table. */
+	struct rxp_filter_entry entries[128];	/* FRP table entries */
+};
+
+enum tc956x_ch_flags {
+	TC956X_CONTIG_BUFS = BIT(0), /* Alloc entire ring buffer memory as a contiguous block */
+	/*...*/
+};
+
+/* Represents Tx/Rx channel allocated for IPA offload data path */
+struct channel_info {
+	unsigned int channel_num;	/* Channel number */
+	enum channel_dir direction;	/* Tx/Rx */
+
+	unsigned int buf_size;		/* Buffer size */
+	unsigned int desc_cnt;		/* Descriptor Count */
+	size_t desc_size;		/* Descriptor size in bytes */
+
+	struct ipa_desc_addr desc_addr; /* Structure containing the address of descriptors */
+	struct ipa_buff_pool_addr buff_pool_addr; /* Structure containing the address of Tx/RX buffers */
+
+	struct mem_ops *mem_ops;	/* store mem ops to use for allocate/freeing */
+	void *client_ch_priv;		/* channel specific private data */
+	unsigned int ch_flags;
+
+	struct pci_dev* dma_pdev;	/* pdev that should be used for dma allocation */
+};
+
+struct request_channel_input {
+	unsigned int desc_cnt;   /* No. of required descriptors for the Tx/Rx Channel */
+	enum channel_dir ch_dir; /* CH_DIR_RX for Rx Channel, CH_DIR_TX for Tx Channel */
+
+	unsigned int buf_size;   /* Data buffer size */
+	unsigned long flags;	 /* flags for memory allocation Same as gfp_t? */
+	struct net_device *ndev; /* TC956x netdev data structure */
+
+	struct mem_ops *mem_ops; /* If NULL, use default flags for memory allocation.
+				    otherwise use the function pointers provided for
+				    descriptor and buffer allocation */
+	void *client_ch_priv;    /* To store in channel_info and pass it to mem_ops */
+	unsigned int ch_flags;
+	phys_addr_t tail_ptr_addr;
+};
+
+struct mem_ops {
+
+	void *(*alloc_descs)(struct net_device *ndev, size_t size, dma_addr_t *daddr,
+				gfp_t gfp, struct mem_ops *ops, struct channel_info *channel);
+	void *(*alloc_buf)(struct net_device *ndev, size_t size, dma_addr_t *daddr,
+				gfp_t gfp, struct mem_ops *ops, struct channel_info *channel);
+
+	void (*free_descs)(struct net_device *ndev, void *buf, size_t size,
+				dma_addr_t *daddr, struct mem_ops *ops, struct channel_info  *channel);
+	void (*free_buf)(struct net_device *ndev, void *buf, size_t size,
+				dma_addr_t *daddr, struct mem_ops *ops, struct channel_info *channel);
+};
+
+struct mac_addr_list {
+	u8 addr[6];	/* 0th to 3rd bytes will be programmed in MAC_Address_Low.ADDLO
+			 * 4th - 5th bytes will be programmed in MAC_Address_High.ADDRHI
+			 */
+	u8 ae;		/* Address Enable */
+	u8 mbc;		/* Mask Byte Control */
+	u16 dcs;	/* DMA Channel Select */
+};
+
+/*!
+ * \brief This API will return the version of IPA I/F maintained by Toshiba
+ *	  The API will check for NULL pointers
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ *
+ * \return : Correct Major and Minor number of the IPA I/F version
+ *	     Major Number = Minor Number = 0xFF incase ndev is NULL or
+ *	     tc956xmac_priv extracted from ndev is NULL
+ */
+struct tc956x_ipa_version get_ipa_intf_version(struct net_device *ndev);
+
+
+/*!
+ * \brief This API will store the client private structure inside TC956x private structure.
+ *	The API will check for NULL pointers. client_priv == NULL will be considered as a valid argument
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in]  client_priv : Client private data structure
+ *
+ * \return : 0 on success
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ */
+int set_client_priv_data(struct net_device *ndev, void *client_priv);
+
+
+/*!
+ * \brief This API will return the client private data structure
+ *	  The API will check for NULL pointers
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ *
+ * \return : Pointer to the client private data structure
+ *	     NULL if ndev or tc956xmac_priv extracted from ndev is NULL
+ */
+void* get_client_priv_data(struct net_device *ndev);
+
+
+/*!
+ * \brief API to allocate a channel for IPA  Tx/Rx datapath,
+ *	  allocate memory and buffers for the DMA channel, setup the
+ *	  descriptors and configure the the require registers and
+ *	  mark the channel as used by IPA in the TC956x driver
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as,
+ *	  out of bounds buf size > 9K bytes, descriptor count > 512
+ *
+ * \param[in] channel_input : data structure specifying all input needed to request a channel
+ *
+ * \return channel_info : Allocate memory for channel_info structure and initialize the structure members
+ *			  NULL on fail
+ * \remarks :In case of Tx, only TDES0 and TDES1 will be updated with buffer addresses. TDES2 and TDES3
+ *	    must be updated by the offloading driver.
+ */
+struct channel_info* request_channel(struct request_channel_input *channel_input);
+
+
+/*!
+ * \brief Release the resources associated with the channel
+ *	  and mark the channel as free in the TC956x driver,
+ *	  reset the descriptors and registers
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer or memory buffers in channel pointer are NULL
+ *
+ * \remarks : DMA Channel has to be stopped prior to invoking this API
+ */
+int release_channel(struct net_device *ndev, struct channel_info *channel);
+
+
+/*!
+ * \brief Update the location in CM3 SRAM with a PCIe Write Address and
+ *	  value for the associated channel. When Tx/Rx interrupts occur,
+ *	  the FW will write the value to the PCIe location
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as,
+ *	  non IPA channel, out of range CM3 accesesible PCIe address
+ *
+ * \param[in] ndev : TC956x netdev  data structure
+ * \param[in] channel : Pointer to channel info containing the channel information
+ * \param[in] addr : PCIe Address location to which the PCIe write is to be performed from CM3 FW
+ *
+ * \return : O for success
+ *	     -EPERM if non IPA channels are accessed, out of range PCIe access location for CM3
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ *
+ * \remarks :
+ *	     If this API is invoked for a channel without calling release_event(),
+ *	     then the PCIe address and value for that channel will be overwritten
+ *	     Mask = 2 ^ (CM3_TAMAP_ATR_SIZE + 1) - 1
+ *	     TRSL_ADDR = DMA_PCIe_ADDR & ~((2 ^ (ATR_SIZE + 1) - 1) = TRSL_ADDR = DMA_PCIe_ADDR & ~Mask
+ *	     CM3 Target Address = DMA_PCIe_ADDR & Mask | SRC_ADDR
+ */
+int request_event(struct net_device *ndev, struct channel_info *channel, dma_addr_t addr);
+
+
+/*!
+ * \brief Update the location in CM3 SRAM with a PCIe Write Address and
+ *	  value for the associated channel to zero
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ */
+int release_event(struct net_device *ndev, struct channel_info *channel);
+
+
+/*!
+ * \brief Enable interrupt generation for given channel
+ *
+ * The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ */
+int enable_event(struct net_device *ndev, struct channel_info *channel);
+
+
+/*!
+ * \brief Disable interrupt generation for given channel
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ */
+int disable_event(struct net_device *ndev, struct channel_info *channel);
+
+
+/*!
+ * \brief Control the Rx DMA interrupt generation by modfying the Rx WDT timer
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as,
+ *	  non IPA channel, event moderation for Tx path
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ * \param[in] wdt : Watchdog timeout value in clock cycles
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed, IPA Tx channel
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+ */
+int set_event_mod(struct net_device *ndev, struct channel_info *channel, unsigned int wdt);
+
+
+/*!
+ * \brief This API will configure the FRP table with the parameters passed through rx_filter_info.
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel,
+ *	  number of filter entries > 72
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] filter_params: filter_params containig the parameters based on which packet will pass or drop
+ * \return : Return 0 on success, -ve value on error
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL filter_params, if number of entries > 72
+ *
+ * \remarks : The entries should be prepared considering the filtering and routing to CortexA also
+ *	      MAC Rx will be stopped while updating FRP table dynamically.
+ */
+
+int set_rx_filter(struct net_device *ndev, struct rx_filter_info *filter_params);
+
+
+/*!
+ * \brief This API will clear the FRP filters and route all packets to RxCh0
+ *
+ *	 The API will check for NULL pointers
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \return : Return 0 on success, -ve value on error
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *
+ * \remarks : MAC Rx will be stopped while updating FRP table dynamically.
+
+ */
+int clear_rx_filter(struct net_device *ndev);
+
+
+/*!
+ * \brief Start the DMA channel. channel_dir member variable
+ *	  will be used to start the Tx/Rx channel
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer NULL
+
+ */
+int start_channel(struct net_device *ndev, struct channel_info *channel);
+
+
+/*!
+ * \brief Stop the DMA channel. channel_dir member variable will be
+ *	  used to stop the Tx/Rx channel. In case of Rx, clear the
+ *	  MTL queue associated with the channel and this will result in packet drops
+ *
+ *	  The API will check for NULL pointers and Invalid arguments such as non IPA channel
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] channel : Pointer to structure containing channel_info that needs to be released
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if non IPA channels are accessed
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if channel pointer  NULL
+ */
+int stop_channel(struct net_device *ndev, struct channel_info *channel);
+
+
+/*!
+ * \brief Configure MAC registers at a particular index in the MAC Address list
+ *
+ * \param[in] ndev : TC956x netdev data structure
+ * \param[in] mac_addr : Pointer to structure containing mac_addr_list that needs to updated
+ *		     in MAC_Address_High and MAC_Address_Low registers
+ * \param[in] index : Index in the MAC Address Register list
+ *
+ * \return : Return 0 on success, -ve value on error
+ *	     -EPERM if index 0 used
+ *	     -ENODEV if ndev is NULL, tc956xmac_priv extracted from ndev is NULL
+ *	     -EINVAL if mac_addr NULL
+ *
+ * \remarks : Do not use the API to set register at index 0.
+ *	      There is possibilty of kernel network subsytem overwriting these registers
+ *	      when " tc956xmac_set_rx_mode" is invoked via "ndo_set_rx_mode" callback.
+ */
+int set_mac_addr(struct net_device *ndev, struct mac_addr_list *mac_addr, u8 index);
+
+#endif /* __TC956x_IPA_INTF_H */
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_msigen.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_msigen.c
@@ -0,0 +1,292 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_msigen.c
+ *
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  14 SEP 2020 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  30 Nov 2021 : Base lined for SRIOV
+ *  VERSION     : 01-02
+ *
+ *  20 May 2022 : 1. Automotive Driver, CPE fixes merged and IPA Features supported
+ *                2. Base lined version
+ *  VERSION     : 03-00
+ *  29 Mar 2024 : 1. Support for without MDIO and without PHY case
+ *  VERSION     : 04-00
+ */
+
+#include <linux/kernel.h>
+#include <linux/io.h>
+#include "hwif.h"
+#include "common.h"
+#include "tc956xmac.h"
+
+#ifdef TC956X_SRIOV_PF
+/**
+ * tc956x_msigen_init
+ *
+ * \brief API to Initialize and configure MSIGEN module
+ *
+ * \details This function is used to configures clock, reset, sets mask and
+ * interrupt source to MSI vector mapping.
+ *
+ * \param[in] dev - Pointer to net device structure
+ *
+ * \return None
+ */
+static void tc956x_msigen_init(struct tc956xmac_priv *priv, struct net_device *dev)
+{
+	u32 rd_val;
+
+	/* Enable MSIGEN Module */
+#ifdef TC956X
+	rd_val = readl(priv->ioaddr + NCLKCTRL0_OFFSET);
+	rd_val |= (1 << TC956X_MSIGENCEN);
+	writel(rd_val, priv->ioaddr + NCLKCTRL0_OFFSET);
+	rd_val = readl(priv->ioaddr + NRSTCTRL0_OFFSET);
+	rd_val &= ~(1 << TC956X_MSIGENCEN);
+	writel(rd_val, priv->ioaddr + NRSTCTRL0_OFFSET);
+#else
+	rd_val = readl(priv->ioaddr + NCLKCTRL_OFFSET);
+	rd_val |= (1 << TC956X_MSIGENCEN);
+	writel(rd_val, priv->ioaddr + NCLKCTRL_OFFSET);
+	rd_val = readl(priv->ioaddr + NRSTCTRL_OFFSET);
+	rd_val &= ~(1 << TC956X_MSIGENCEN);
+	writel(rd_val, priv->ioaddr + NRSTCTRL_OFFSET);
+#endif
+	/* Initialize MSIGEN */
+
+	writel(TC956X_MSI_OUT_EN_CLR, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	writel(TC956X_MSI_MASK_SET, priv->ioaddr + TC956X_MSI_MASK_SET_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	writel(TC956X_MSI_MASK_CLR, priv->ioaddr + TC956X_MSI_MASK_CLR_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	/* DMA Ch Tx-Rx Interrupt sources are assigned to Vector 0,
+	 * All other Interrupt sources are assigned to Vector 1
+	 */
+	writel(TC956X_MSI_SET0, priv->ioaddr + TC956X_MSI_VECT_SET0_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	writel(TC956X_MSI_SET1, priv->ioaddr + TC956X_MSI_VECT_SET1_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	writel(TC956X_MSI_SET2, priv->ioaddr + TC956X_MSI_VECT_SET2_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	writel(TC956X_MSI_SET3, priv->ioaddr + TC956X_MSI_VECT_SET3_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	writel(TC956X_MSI_SET4, priv->ioaddr + TC956X_MSI_VECT_SET4_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	writel(TC956X_MSI_SET5, priv->ioaddr + TC956X_MSI_VECT_SET5_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	writel(TC956X_MSI_SET6, priv->ioaddr + TC956X_MSI_VECT_SET6_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	writel(TC956X_MSI_SET7, priv->ioaddr + TC956X_MSI_VECT_SET7_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+}
+
+/**
+ * tc956x_interrupt_en
+ *
+ * \brief API to enable disable MSI interrupts
+ *
+ * \details This function is used to set/clear interrupts
+ *
+ * \param[in] dev - Pointer to net device structure
+ * \param[in] en -	1 - Enable interrupts
+ * 0 - Disable interrupts
+ * \return None
+ */
+static void tc956x_interrupt_en(struct tc956xmac_priv *priv, struct net_device *dev, u32 en)
+{
+	u32 chan, mask_val = 0;
+
+	if (en) {
+
+		/* Disable MSI for Tx/Rx channels that is not enabled in the Function */
+
+		for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) {
+#ifdef TC956X_SRIOV_PF
+			if (priv->plat->tx_ch_in_use[chan] != TC956X_ENABLE_CHNL)
+#endif
+				mask_val |= (1 << (MSI_INT_TX_CH0 + chan));
+		}
+
+		for (chan = 0; chan < priv->plat->rx_queues_to_use; chan++) {
+#ifdef TC956X_SRIOV_PF
+			if (priv->plat->rx_ch_in_use[chan] != TC956X_ENABLE_CHNL)
+#endif
+				mask_val |= (1 << (MSI_INT_RX_CH0 + chan));
+		}
+#ifdef TC956X_SRIOV_PF
+		if (priv->dev->phydev != NULL) {
+			/* PHY MSI interrupt enabled */
+			mask_val &= ~(1 << MSI_INT_EXT_PHY);
+		} else
+			mask_val |= (1 << MSI_INT_EXT_PHY); /* Disable PHY interrupt on PHY absence */
+#else
+		/* PHY MSI interrupt diabled */
+		mask_val |= (1 << MSI_INT_EXT_PHY);
+#endif
+		mask_val = TC956X_MSI_OUT_EN & (~mask_val);
+
+#ifdef TC956X_SW_MSI
+		/* Enable SW MSI interrupt */
+		KPRINT_INFO("%s Enable SW MSI", __func__);
+		mask_val |=  (1 << MSI_INT_SW_MSI);
+
+		/*Clear SW MSI*/
+		writel(1, priv->ioaddr + TC956X_MSI_SW_MSI_CLR(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+#endif
+		writel(mask_val, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	} else
+		writel(TC956X_MSI_OUT_EN_CLR, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+	netdev_dbg(priv->dev, "%s mask_val : %x\n", __func__, mask_val);
+}
+
+/**
+ * tc956x_interrupt_clr
+ *
+ * \brief API to enable clear MSI vector
+ *
+ * \details This function is used to clear MSI vector. To be called
+ * after handling the interrupts.
+ *
+ * \param[in] dev - Pointer to net device structure
+ * \param[in] vector - Supported values TC956X_MSI_VECTOR_0, TC956X_MSI_VECTOR_1
+ *
+ * \return None
+ */
+static void tc956x_interrupt_clr(struct tc956xmac_priv *priv, struct net_device *dev, u32 vector)
+{
+	writel((1<<vector), priv->ioaddr + TC956X_MSI_MASK_CLR_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+	netdev_dbg(priv->dev, "%s %d\n", __func__, vector);
+}
+#elif defined TC956X_SRIOV_VF
+/**
+ * tc956x_msigen_init
+ *
+ * \brief API to Initialize and configure MSIGEN module
+ *
+ * \details This function is used to configures clock, reset, sets mask and
+ *		interrupt source to MSI vector mapping.
+ *
+ * \param[in] dev - Pointer to net device structure
+ *
+ * \return None
+ */
+static void tc956x_msigen_init(struct tc956xmac_priv *priv, struct net_device *dev,
+					struct fn_id *fn_id_info)
+{
+	//struct tc956xmac_priv *priv = netdev_priv(dev);
+	u8 pf_id = fn_id_info->pf_no;
+	u8 vf_id = fn_id_info->vf_no;
+
+#ifndef TC956X_SRIOV_VF
+	/* Enable MSIGEN Module */
+	rd_val = readl(priv->ioaddr + NCLKCTRL0_OFFSET);
+	rd_val |= (1 << TC956X_MSIGENCEN);
+	writel(rd_val, priv->ioaddr + NCLKCTRL0_OFFSET);
+	rd_val = readl(priv->ioaddr + NRSTCTRL0_OFFSET);
+	rd_val &= ~(1 << TC956X_MSIGENCEN);
+	writel(rd_val, priv->ioaddr + NRSTCTRL0_OFFSET);
+#endif
+
+	/* Initialize MSIGEN */
+	writel(TC956X_MSI_OUT_EN_CLR, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_MASK_SET, priv->ioaddr + TC956X_MSI_MASK_SET_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_MASK_CLR, priv->ioaddr + TC956X_MSI_MASK_CLR_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_SET0, priv->ioaddr + TC956X_MSI_VECT_SET0_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_SET1, priv->ioaddr + TC956X_MSI_VECT_SET1_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_SET2, priv->ioaddr + TC956X_MSI_VECT_SET2_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_SET3, priv->ioaddr + TC956X_MSI_VECT_SET3_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_SET4, priv->ioaddr + TC956X_MSI_VECT_SET4_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_SET5, priv->ioaddr + TC956X_MSI_VECT_SET5_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_SET6, priv->ioaddr + TC956X_MSI_VECT_SET6_OFFSET(pf_id, vf_id));
+	writel(TC956X_MSI_SET7, priv->ioaddr + TC956X_MSI_VECT_SET7_OFFSET(pf_id, vf_id));
+
+
+}
+
+/**
+ * tc956x_interrupt_en
+ *
+ * \brief API to enable disable MSI interrupts
+ *
+ * \details This function is used to set/clear interrupts
+ *
+ * \param[in] dev - Pointer to net device structure
+ * \param[in] en -	1 - Enable interrupts
+ * 0 - Disable interrupts
+ * \return None
+ */
+static void tc956x_interrupt_en(struct tc956xmac_priv *priv, struct net_device *dev, u32 en,
+						struct fn_id *fn_id_info)
+{
+	//struct tc956xmac_priv *priv = netdev_priv(dev);
+	u8 pf_id = fn_id_info->pf_no;
+	u8 vf_id = fn_id_info->vf_no;
+
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 ch;
+	u32 msi_out_en = 0;
+
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+#ifdef TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[ch] == 0)
+			continue;
+#endif
+		msi_out_en |= (1 << (ch + TC956X_MSI_INT_TXDMA_CH0)); /* tx dma channel setting */
+		msi_out_en |= (1 << (ch + TC956X_MSI_INT_RXDMA_CH0)); /* rx dma channel setting */
+	}
+
+#ifdef TC956X_SRIOV_VF
+	msi_out_en |= (1 << TC956X_MSI_INT_MBX); /* Mailbox interrupt setting */
+#endif
+
+	msi_out_en = TC956X_MSI_OUT_EN & (msi_out_en);
+
+	if (en)
+		writel(msi_out_en, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(pf_id, vf_id));
+	else
+		writel(TC956X_MSI_OUT_EN_CLR, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(pf_id, vf_id));
+}
+
+/**
+ * tc956x_interrupt_clr
+ *
+ * \brief API to enable clear MSI vector
+ *
+ * \details This function is used to clear MSI vector. To be called
+ * after handling the interrupts.
+ *
+ * \param[in] dev - Pointer to net device structure
+ * \param[in] vector - Supported values TC956X_MSI_VECTOR_0, TC956X_MSI_VECTOR_1
+ *
+ * \return None
+ */
+static void tc956x_interrupt_clr(struct tc956xmac_priv *priv, struct net_device *dev, u32 vector,
+						struct fn_id *fn_id_info)
+{
+	u8 pf_id = fn_id_info->pf_no;
+	u8 vf_id = fn_id_info->vf_no;
+
+	writel((1 << vector), priv->ioaddr + TC956X_MSI_MASK_CLR_OFFSET(pf_id, vf_id));
+
+}
+#endif
+const struct tc956x_msi_ops tc956x_msigen_ops = {
+	.init = tc956x_msigen_init,
+	.interrupt_en = tc956x_interrupt_en,
+	.interrupt_clr = tc956x_interrupt_clr,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pci.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pci.c
@@ -0,0 +1,4714 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_pci.c
+ *
+ * Copyright (C) 2011-2012  Vayavya Labs Pvt Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  20 Jul 2021 : Version update
+ *  VERSION     : 01-00-03
+ *  22 Jul 2021 : 1. Version update
+ *                2. USXGMII/XFI/SGMII/RGMII interface supported with module parameter
+ *  VERSION     : 01-00-04
+ *  22 Jul 2021 : 1. Dynamic CM3 TAMAP configuration
+ *  VERSION     : 01-00-05
+ *  23 Jul 2021 : 1. Add support for contiguous allocation of memory
+ *  VERSION     : 01-00-06
+ *  29 Jul 2021 : 1. Add support to set MAC Address register
+ *  VERSION     : 01-00-07
+ *  05 Aug 2021 : 1. Register Port0 as only PCIe device, incase its PHY is not found
+ *  VERSION     : 01-00-08
+ *  16 Aug 2021 : 1. PHY interrupt mode supported through .config_intr and .ack_interrupt API
+ *  VERSION     : 01-00-09
+ *  24 Aug 2021 : 1. Disable TC956X_PCIE_GEN3_SETTING and TC956X_LOAD_FW_HEADER macros and provide support via Makefile
+ *                2. Platform API supported
+ *  VERSION     : 01-00-10
+ *  02 Sep 2021 : 1. Configuration of Link state L0 and L1 transaction delay for PCIe switch ports & Endpoint.
+ *  VERSION     : 01-00-11
+ *  09 Sep 2021 : Reverted changes related to usage of Port-0 pci_dev for all DMA allocation/mapping for IPA path
+ *  VERSION     : 01-00-12
+ *  14 Sep 2021 : 1. Version update
+ *  VERSION     : 01-00-13
+ *  23 Sep 2021 : 1. Version update
+ *  VERSION     : 01-00-14
+ *  29 Sep 2021 : 1. Version update
+ *                2. Added check for Device presence before changing PCIe ports speed.
+ *  VERSION     : 01-00-15
+ *  14 Oct 2021 : 1. Version update
+ *                2. Configuring pause frame control using kernel module parameter also forwarding
+ *                   only Link partner pause frames to Application and filtering PHY pause frames using FRP
+ *  VERSION     : 01-00-16
+ *  19 Oct 2021 : 1. Version update
+ *  VERSION     : 01-00-17
+ *  21 Oct 2021 : 1. Version update
+ *  VERSION     : 01-00-18
+ *  26 Oct 2021 : 1. Added support for EEE PHY and MAC Control Mode support.
+ *                2. Added PM support for suspend-resume.
+ *                3. Added platform api calls.
+ *                4. Version update
+ *  VERSION     : 01-00-19
+ *  04 Nov 2021 : 1. Version update
+ *  VERSION     : 01-00-20
+ *  08 Nov 2021 : 1. Version update.
+ *                2. Cancel PHY Workqueue before suspend.
+ *                3. Restore Gen 3 Speed after resume.
+ *  VERSION     : 01-00-21
+ *  24 Nov 2021 : 1. Version update
+ *                2. Single Port Suspend/Resume supported
+ *  VERSION     : 01-00-22
+ *  24 Nov 2021 : 1. Version update
+ *  VERSION     : 01-00-23
+ *  24 Nov 2021 : 1. Module param support for EEE enable/disable and LPI timer configuration.
+ *                2. Version update
+ *  VERSION     : 01-00-24
+ *  30 Nov 2021 : 1. Print message correction for PCIe BAR size and Physical Address.
+ *                2. Version update
+ *  VERSION     : 01-00-25
+ *  30 Nov 2021 : 1. Removed PHY Workqueue Cancellation before suspend.
+ *                2. Version update
+ *  VERSION     : 01-00-26
+ *  01 Dec 2021 : 1. Version update
+ *  VERSION     : 01-00-27
+ *  01 Dec 2021 : 1. Resetting SRAM Region before loading firmware.
+ *                2. Version update
+ *  VERSION     : 01-00-28
+ *  03 Dec 2021 : 1. Version update
+ *  VERSION     : 01-00-29
+ *  08 Dec 2021 : 1. Added Module parameter for Rx Queue Size, Flow control threaholds and Tx Queue Size configuration
+ *                2. Renamed All Module parameters for easy readability.
+ *                3. Printing User Configured/Default Module Parameters for future purpose.
+ *                4. Version update.
+ *  VERSION     : 01-00-30
+ *  10 Dec 2021 : 1. Added Module parameter to count Link partner pause frames and output to ethtool.
+ *                2. Version update.
+ *  VERSION     : 01-00-31
+ *  27 Dec 2021 : 1. Support for eMAC Reset and unused clock disable during Suspend and restoring it back during resume.
+ *                2. Version update.
+ *  VERSION     : 01-00-32
+ *  06 Jan 2022 : 1. Code comments corrected for flow control configuration
+ *                2. Version update.
+ *  VERSION     : 01-00-33
+ *  07 Jan 2022 : 1. Version update
+ *  VERSION     : 01-00-34
+ *  11 Jan 2022 : 1. Module parameter added to configure fixed phy mode
+ *                2. Version update.
+ *  VERSION     : 01-00-35
+ *  18 Jan 2022 : 1. Version update
+ *  VERSION     : 01-00-36
+ *  20 Jan 2022 : 1. Restore clock after resume in set_power.
+ *                2. Skip Resume-Config if port unavailable (PHY not connected) during suspend-resume.
+ *                3. Shifted Queuing Work to end of resume to prevent MSI disable on resume.
+ *                4. Version update
+ *  VERSION     : 01-00-37
+ *  24 Jan 2022 : 1. Set Clock control and Reset control register to default value on driver unload.
+ *                2. Version update
+ *  VERSION     : 01-00-38
+ *  31 Jan 2022 : 1. Version update
+ *  VERSION     : 01-00-39
+ *  02 Feb 2022 : 1. Version update
+ *  VERSION     : 01-00-40
+ *  04 Feb 2022 : 1. Version update
+ *  VERSION     : 01-00-41
+ *  14 Feb 2022 : 1. Version update
+ *  VERSION     : 01-00-42
+ *  22 Feb 2022 : 1. GPIO configuration restoration supported during resume.
+ *                2. Version update
+ *  VERSION     : 01-00-43
+ *  25 Feb 2022 : 1. Version update
+ *  VERSION     : 01-00-44
+ *  09 Mar 2022 : 1. Version update
+ *  VERSION     : 01-00-45
+ *  22 Mar 2022 : 1. Version update
+ *  VERSION     : 01-00-46
+ *  05 Apr 2022 : 1. Version update
+ *  VERSION     : 01-00-47
+ *  06 Apr 2022 : 1. Version update
+ *                2. Max MTU supported is 2000 bytes.
+ *  VERSION     : 01-00-48
+ *  14 Apr 2022 : 1. Version update
+ *  VERSION     : 01-00-49
+ *  25 Apr 2022 : 1. Version update
+ *  VERSION     : 01-00-50
+ *  29 Apr 2022 : 1. Module parameter added for selecting Power saving at Link down and default is disabled
+ *                2. Version update
+ *  VERSION     : 01-00-51
+ *  15 Jun 2022 : 1. Version update
+ *  VERSION     : 01-00-52
+ *  08 Aug 2022 : 1. Version update
+ *  VERSION     : 01-00-53
+ *  31 Aug 2022 : 1. Version update
+ *  VERSION     : 01-00-54
+ *  02 Sep 2022 : 1. 2500Base-X support for line speeds 2.5Gbps, 1Gbps, 100Mbps.
+ *                2. Version update
+ *  VERSION     : 01-00-55
+ *  21 Oct 2022 : 1. Version update
+ *  VERSION     : 01-00-56
+ *  09 Nov 2022 : 1. Version update
+ *  VERSION     : 01-00-57
+ *  22 Dec 2022 : 1. Version update
+ *                2. Module parameters introduced for the control of SW reset and by default SW reset is disabled.
+ *  VERSION     : 01-00-58
+ *  09 May 2023 : 1. Version update
+ *                2. Module parameters to control SW reset (during link change) enabled by default for Port0.
+ *  VERSION     : 01-00-59
+ *  10 Nov 2023 : 1. Kernel 6.1 Porting changes
+ *                2. DSP Cascade related modifications.
+ *                3. Version update
+ *  VERSION     : 01-02-59
+ *  26 Dec 2023 : 1. Kernel 6.6 Porting changes
+ *                2. Added the support for TC commands taprio and flower
+ *                3. Version update
+ *  VERSION     : 01-03-59
+ *  19 Feb 2024 : 1. IOCTL/TC/IPA/ModuleParams register write bug fixes.
+ *                2. Added following module params.
+ *                   Transmit/Receive Programmable Burst Length,
+ *                   PCIe L0s/L1 Link state change delay configuration for Internal Endpoint,
+ *                   AXI Maximum Write/Read Outstanding Request Limit, AXI DMA Burst Length.
+ *                3. Version update
+ *  VERSION     : 04-00
+ *  29 Mar 2024 : 1. Support for without MDIO and without PHY case
+ *                2. Support for TC956x switch to switch connection (upto 2 level) over DSP ports
+ *  VERSION     : 04-00
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/pci.h>
+#include <linux/dmi.h>
+#include <linux/firmware.h>
+#include <linux/version.h>
+#include <linux/aer.h>
+#include <linux/iopoll.h>
+#include "dwxgmac2.h"
+#include "tc956xmac.h"
+#include "tc956xmac_config.h"
+#include "tc956xmac_inc.h"
+#include "common.h"
+
+#ifdef TC956X_LOAD_FW_HEADER
+#include "fw.h"
+#endif
+#ifdef TC956X_SRIOV_VF
+#include "tc956x_vf_rsc_mng.h"
+#endif
+
+#ifdef TC956X_PCIE_LOGSTAT
+#include "tc956x_pcie_logstat.h"
+#endif /* #ifdef TC956X_PCIE_LOGSTAT */
+
+static DEFINE_MUTEX(tc956x_pm_suspend_lock);
+
+struct tx956x_shrd_mem tx956x_pci_shrd_mem[TC956X_TOT_CASCADE_DEV];
+
+uint16_t tc956x_get_shared_mem_offset(struct pci_dev *pdev, uint16_t pci_bd)
+{
+	uint16_t offset;
+
+	for (offset = 0; offset < TC956X_TOT_CASCADE_DEV; offset++) {
+		if (tx956x_pci_shrd_mem[offset].pci_bd == 0) {
+			tx956x_pci_shrd_mem[offset].pci_bd = pci_bd;
+			dev_info(&pdev->dev, "New shared memory offset %d allocated\n", offset);
+			return offset;	/* Free memory is available */
+		} else if (tx956x_pci_shrd_mem[offset].pci_bd == pci_bd) {
+			dev_info(&pdev->dev, "Existing shared memory offset %d found\n", offset);
+			return offset;	/* Allocated memory found */
+		}
+	}
+	return 0xFFFF;
+}
+#ifndef TC956X_SRIOV_VF
+#ifdef CONFIG_PCI_IOV
+static int tc956x_no_of_vf;
+#endif
+#ifdef TC956X_PCIE_GEN3_SETTING
+static unsigned int pcie_link_speed = 3;
+#endif
+#endif
+
+unsigned int mac0_force_speed_mode = DISABLE;
+unsigned int mac1_force_speed_mode = DISABLE;
+unsigned int mac0_force_config_speed = 3; /* 1Gbps */
+unsigned int mac1_force_config_speed = 3; /* 1Gbps */
+
+#if defined(TC956X_SRIOV_PF)
+static unsigned int mac0_interface = ENABLE_XFI_INTERFACE;
+static unsigned int mac1_interface = ENABLE_SGMII_INTERFACE;
+
+unsigned int mac0_filter_phy_pause = DISABLE;
+unsigned int mac1_filter_phy_pause = DISABLE;
+
+static unsigned int mac0_eee_enable = DISABLE;
+static unsigned int mac0_lpi_timer = TC956XMAC_LPIET_600US;
+static unsigned int mac1_eee_enable = DISABLE;
+static unsigned int mac1_lpi_timer = TC956XMAC_LPIET_600US;
+
+static unsigned int mac0_rxq0_size = RX_QUEUE0_SIZE;
+static unsigned int mac0_rxq1_size = RX_QUEUE1_SIZE;
+#if defined(TC956X_CPE_CONFIG)
+static unsigned int mac0_rxq0_rfd = 24;
+static unsigned int mac0_rxq0_rfa = 24;
+static unsigned int mac0_rxq1_rfd = 24;
+static unsigned int mac0_rxq1_rfa = 24;
+#else
+static unsigned int mac0_rxq0_rfd = 0xe;
+static unsigned int mac0_rxq0_rfa = 0x3;
+static unsigned int mac0_rxq1_rfd = 5;
+static unsigned int mac0_rxq1_rfa = 5;
+#endif
+static unsigned int mac0_txq0_size = TX_QUEUE0_SIZE;
+static unsigned int mac0_txq1_size = TX_QUEUE1_SIZE;
+
+static unsigned int mac1_rxq0_size = RX_QUEUE0_SIZE;
+static unsigned int mac1_rxq1_size = RX_QUEUE1_SIZE;
+#if defined(TC956X_CPE_CONFIG)
+static unsigned int mac1_rxq0_rfd = 24;
+static unsigned int mac1_rxq0_rfa = 24;
+static unsigned int mac1_rxq1_rfd = 24;
+static unsigned int mac1_rxq1_rfa = 24;
+#else
+static unsigned int mac1_rxq0_rfd = 0xe;
+static unsigned int mac1_rxq0_rfa = 0x3;
+static unsigned int mac1_rxq1_rfd = 5;
+static unsigned int mac1_rxq1_rfa = 5;
+#endif
+static unsigned int mac1_txq0_size = TX_QUEUE0_SIZE;
+static unsigned int mac1_txq1_size = TX_QUEUE1_SIZE;
+
+static unsigned int port0_mdc = TC956XMAC_XGMAC_MDC_CSR_12;
+static int port0_c45_state = 1; /* C45 selected by default */
+
+static unsigned int port1_mdc = TC956XMAC_XGMAC_MDC_CSR_62;
+static int port1_c45_state; /* C22 selected by default */
+
+static unsigned int port0_phyaddr;
+static unsigned int port1_phyaddr;
+unsigned int mac0_link_down_macrst = ENABLE;
+unsigned int mac1_link_down_macrst = DISABLE;
+
+#endif
+
+unsigned int mac0_en_lp_pause_frame_cnt = DISABLE;
+unsigned int mac1_en_lp_pause_frame_cnt = DISABLE;
+
+unsigned int mac_power_save_at_link_down = DISABLE;
+
+static int mac0_tx_pbl = 16;
+static int mac0_rx_pbl = 16;
+static int mac1_tx_pbl = 16;
+static int mac1_rx_pbl = 16;
+
+#ifdef TC956X_PCIE_LINK_STATE_LATENCY_CTRL
+static unsigned int ep_l0s_delay = EP_L0s_ENTRY_DELAY;
+static unsigned int ep_l1_delay = EP_L1_ENTRY_DELAY;
+#endif
+
+static unsigned int mac0_axi_wr_osr_lmt = 31;
+static unsigned int mac0_axi_rd_osr_lmt = 31;
+static unsigned int mac1_axi_wr_osr_lmt = 31;
+static unsigned int mac1_axi_rd_osr_lmt = 31;
+
+static unsigned int mac0_axi_blen;
+static unsigned int mac1_axi_blen;
+static const struct tc956x_version tc956x_drv_version = {0, 4, 0, 0, 0, 0};
+int tc956xmac_pm_usage_counter; /* Device Usage Counter */
+int tc956x_dsp_count;
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_MAGIC_PACKET_WOL_GPIO
+static void tc956x_wol_gpio_trigger(void __iomem *reg_base_addr, bool mode);
+#endif
+#endif
+/*
+ * This struct is used to associate PCI Function of MAC controller on a board,
+ * discovered via DMI, with the address of PHY connected to the MAC. The
+ * negative value of the address means that MAC controller is not connected
+ * with PHY.
+ */
+struct tc956xmac_pci_func_data {
+	unsigned int func;
+	int phy_addr;
+};
+
+struct tc956xmac_pci_dmi_data {
+	const struct tc956xmac_pci_func_data *func;
+	size_t nfuncs;
+};
+
+struct tc956xmac_pci_info {
+	int (*setup)(struct pci_dev *pdev, struct plat_tc956xmacenet_data *plat);
+};
+
+/* By default, Bypass FRP routing */
+/* User to configure routing for FRP usecase */
+
+static struct tc956xmac_rx_parser_entry snps_rxp_entries[] = {
+#ifdef TC956X
+	{
+#ifdef TC956X_SRIOV_PF
+		.match_data = 0x00000000, .match_en = 0x00000000, .af = 1, .rf = 1, .im = 0, .nc = 0, .res1 = 0, .frame_offset = 0, .res2 = 0, .ok_index = 0, .res3 = 0, .dma_ch_no = 0x0, .res4 = 0, /* FRP Bypass */
+#elif defined TC956X_SRIOV_VF
+		.match_data = 0x00000000, .match_en = 0x00000000, .af = 1, .rf = 0, .im = 0, .nc = 0, .res1 = 0, .frame_offset = 0, .res2 = 0, .ok_index = 0, .res3 = 0, .dma_ch_no = 1, .res4 = 0,
+#endif
+	},
+#endif
+};
+
+#ifndef TC956X_SRIOV_VF
+static struct tc956xmac_rx_parser_entry snps_rxp_entries_filter_phy_pause_frames[] = {
+/* 0th entry */{.match_data = 0x00000888, .match_en = 0x0000FFFF, .af = 0, .rf = 0, .im = 0, .nc = 1, .res1 = 0, .frame_offset = 3, .res2 = 0, .ok_index = 3, .res3 = 0, .dma_ch_no = 1, .res4 = 0,},
+/* Checking SA Address 00:01:02:03:04:05 AQR PHYs SA Address as Ether type Match*/
+/* 1st entry */{.match_data = 0x01000000, .match_en = 0xFFFF0000, .af = 0, .rf = 0, .im = 0, .nc = 1, .res1 = 0, .frame_offset = 1, .res2 = 0, .ok_index = 3, .res3 = 0, .dma_ch_no = 1, .res4 = 0,},
+/* 2nd entry */{.match_data = 0x05040302, .match_en = 0xFFFFFFFF, .af = 0, .rf = 1, .im = 0, .nc = 0, .res1 = 0, .frame_offset = 2, .res2 = 0, .ok_index = 0, .res3 = 0, .dma_ch_no = 1, .res4 = 0,},
+/* Route all other packets to DMA channel-0 */
+/* 3rd entry */{.match_data = 0x00000000, .match_en = 0x00000000, .af = 1, .rf = 0, .im = 0, .nc = 0, .res1 = 0, .frame_offset = 0, .res2 = 0, .ok_index = 0, .res3 = 0, .dma_ch_no = 1, .res4 = 0,},
+/* 4th entry */{.match_data = 0x00000000, .match_en = 0x00000000, .af = 1, .rf = 0, .im = 0, .nc = 0, .res1 = 0, .frame_offset = 0, .res2 = 0, .ok_index = 0, .res3 = 0, .dma_ch_no = 1, .res4 = 0,},
+};
+#endif
+
+/*!
+ * \brief API to save and restore clock and reset during suspend-resume.
+ *
+ * \details This fucntion saves the EMAC clock and reset bits before
+ * suspend. And restores the same settings after resume.
+ *
+ * \param[in] priv - pointer to device private structure.
+ * \param[in] state - identify SUSPEND and RESUME operation.
+ *
+ * \return None
+ */
+static void tc956xmac_pm_set_power(struct tc956xmac_priv *priv, enum TC956X_PORT_PM_STATE state)
+{
+	void *nrst_reg = NULL, *nclk_reg = NULL, *commonclk_reg = NULL;
+	u32 nrst_val = 0, nclk_val = 0, commonclk_val = 0;
+
+	KPRINT_INFO("-->%s : Port %d interface %s", __func__, priv->port_num, priv->dev->name);
+	/* Select register address by port */
+	if (priv->port_num == 0) {
+		nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET;
+		nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+	} else {
+		nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL1_OFFSET;
+		nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL1_OFFSET;
+	}
+
+	if (state == SUSPEND) {
+		KPRINT_INFO("%s : Port %d interface %s Set Power for Suspend", __func__, priv->port_num, priv->dev->name);
+		/* Modify register for reset, clock and MSI_OUTEN */
+		nrst_val = readl(nrst_reg);
+		nclk_val = readl(nclk_reg);
+		KPRINT_INFO("%s : Port %d interface %s Rd RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+			nrst_val, nclk_val);
+		/* Save values before Asserting reset and Clock Disable */
+		priv->pm_saved_emac_rst = nrst_val & NRSTCTRL_EMAC_MASK;
+		priv->pm_saved_emac_clk = nclk_val & NCLKCTRL_EMAC_MASK;
+		nrst_val = nrst_val | NRSTCTRL_EMAC_MASK;
+		nclk_val = nclk_val & ~NCLKCTRL_EMAC_MASK;
+		writel(nrst_val, nrst_reg);
+		writel(nclk_val, nclk_reg);
+		if (tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt == TC956X_ALL_MAC_PORT_SUSPENDED) {
+			commonclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+			commonclk_val = readl(commonclk_reg);
+			KPRINT_INFO("%s : Port %d interface %s Common CLK Rd Reg:%x", __func__, priv->port_num, priv->dev->name,
+				commonclk_val);
+			/* Clear Common Clocks only when both port suspends */
+			commonclk_val = commonclk_val & ~NCLKCTRL0_COMMON_EMAC_MASK;
+			writel(commonclk_val, commonclk_reg);
+			KPRINT_INFO("%s : Port %d interface %s Common CLK Wr Reg:%x", __func__, priv->port_num, priv->dev->name,
+				commonclk_val);
+		}
+	} else if (state == RESUME) {
+		KPRINT_INFO("%s : Port %d interface %s Set Power for Resume", __func__, priv->port_num, priv->dev->name);
+		if (tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt == TC956X_ALL_MAC_PORT_SUSPENDED) {
+			commonclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+			commonclk_val = readl(commonclk_reg);
+			KPRINT_INFO("%s : Port %d interface %s Common CLK Rd Reg:%x", __func__, priv->port_num, priv->dev->name,
+				commonclk_val);
+			/* Clear Common Clocks only when both port suspends */
+			commonclk_val = commonclk_val | NCLKCTRL0_COMMON_EMAC_MASK;
+			writel(commonclk_val, commonclk_reg);
+			KPRINT_INFO("%s : Port %d interface %s Common CLK WR Reg:%x", __func__, priv->port_num, priv->dev->name,
+				commonclk_val);
+		}
+		nrst_val = readl(nrst_reg);
+		nclk_val = readl(nclk_reg);
+		KPRINT_INFO("%s : Port %d interface %s Rd RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+			nrst_val, nclk_val);
+		/* Restore values same as before suspend */
+		nrst_val = (nrst_val & ~NRSTCTRL_EMAC_MASK) | priv->pm_saved_emac_rst;
+		nclk_val = nclk_val | priv->pm_saved_emac_clk; /* Restore Clock */
+		writel(nclk_val, nclk_reg);
+		writel(nrst_val, nrst_reg);
+	}
+	KPRINT_INFO("%s : Port %d interface %s priv->pm_saved_emac_rst %x priv->pm_saved_emac_clk %x", __func__,
+		priv->port_num, priv->dev->name, priv->pm_saved_emac_rst, priv->pm_saved_emac_clk);
+	KPRINT_INFO("%s : Port %d %s Wr RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+		readl(nrst_reg), readl(nclk_reg));
+	KPRINT_INFO("<--%s : Port %d interface %s", __func__, priv->port_num, priv->dev->name);
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static int tc956xmac_pci_find_phy_addr(struct pci_dev *pdev,
+				const struct dmi_system_id *dmi_list)
+{
+	const struct tc956xmac_pci_func_data *func_data;
+	const struct tc956xmac_pci_dmi_data *dmi_data;
+	const struct dmi_system_id *dmi_id;
+	int func = PCI_FUNC(pdev->devfn);
+	size_t n;
+
+	dmi_id = dmi_first_match(dmi_list);
+	if (!dmi_id)
+		return -ENODEV;
+
+	dmi_data = dmi_id->driver_data;
+	func_data = dmi_data->func;
+
+	for (n = 0; n < dmi_data->nfuncs; n++, func_data++)
+		if (func_data->func == func)
+			return func_data->phy_addr;
+
+	return -ENODEV;
+}
+
+static void common_default_data(struct plat_tc956xmacenet_data *plat)
+{
+	plat->clk_csr = 2;/* clk_csr_i = 20-35MHz & MDC = clk_csr_i/16 */
+	plat->has_gmac = 1;
+
+	plat->phy_addr = -1;
+	plat->force_sf_dma_mode = 1;
+
+	plat->mdio_bus_data->needs_reset = false;
+	plat->mdio_bus_data->phy_mask = 0;
+
+	/* Set default value for multicast hash bins */
+	plat->multicast_filter_bins = HASH_TABLE_SIZE;
+
+	/* Set the maxmtu to a default of JUMBO_LEN */
+	plat->maxmtu = JUMBO_LEN;
+
+	/* Set default number of RX and TX queues to use */
+	plat->tx_queues_to_use = 1;
+	plat->rx_queues_to_use = 1;
+
+	/* Disable Priority config by default */
+	plat->tx_queues_cfg[0].use_prio = false;
+	plat->rx_queues_cfg[0].use_prio = false;
+
+	/* Disable RX queues routing by default */
+	plat->rx_queues_cfg[0].pkt_route = 0x0;
+	/*For RXP config */
+	plat->rxp_cfg.enable = false;
+
+	plat->rxp_cfg.nve = ARRAY_SIZE(snps_rxp_entries);
+	plat->rxp_cfg.npe = ARRAY_SIZE(snps_rxp_entries);
+	memcpy(plat->rxp_cfg.entries, snps_rxp_entries,
+			ARRAY_SIZE(snps_rxp_entries) *
+			sizeof(struct tc956xmac_rx_parser_entry));
+
+}
+
+static int tc956xmac_default_data(struct pci_dev *pdev,
+			       struct plat_tc956xmacenet_data *plat)
+{
+	KPRINT_INFO("%s  >", __func__);
+	/* Set common default data first */
+	common_default_data(plat);
+
+	plat->dma_cfg->pbl = 32;
+	plat->dma_cfg->pblx8 = true;
+
+#if !defined(TC956X_SRIOV_PF) && !defined(TC956X_SRIOV_VF)
+	plat->tx_dma_ch_owner[0] = TX_DMA_CH0_OWNER;
+	plat->tx_dma_ch_owner[1] = TX_DMA_CH1_OWNER;
+	plat->tx_dma_ch_owner[2] = TX_DMA_CH2_OWNER;
+	plat->tx_dma_ch_owner[3] = TX_DMA_CH3_OWNER;
+	plat->tx_dma_ch_owner[4] = TX_DMA_CH4_OWNER;
+	plat->tx_dma_ch_owner[5] = TX_DMA_CH5_OWNER;
+	plat->tx_dma_ch_owner[6] = TX_DMA_CH6_OWNER;
+	plat->tx_dma_ch_owner[7] = TX_DMA_CH7_OWNER;
+
+	plat->rx_dma_ch_owner[0] = RX_DMA_CH0_OWNER;
+	plat->rx_dma_ch_owner[1] = RX_DMA_CH1_OWNER;
+	plat->rx_dma_ch_owner[2] = RX_DMA_CH2_OWNER;
+	plat->rx_dma_ch_owner[3] = RX_DMA_CH3_OWNER;
+	plat->rx_dma_ch_owner[4] = RX_DMA_CH4_OWNER;
+	plat->rx_dma_ch_owner[5] = RX_DMA_CH5_OWNER;
+	plat->rx_dma_ch_owner[6] = RX_DMA_CH6_OWNER;
+	plat->rx_dma_ch_owner[7] = RX_DMA_CH7_OWNER;
+#endif
+	KPRINT_INFO("%s  <", __func__);
+	return 0;
+}
+
+static const struct tc956xmac_pci_info tc956xmac_pci_info = {
+	.setup = tc956xmac_default_data,
+};
+
+static int intel_mgbe_common_data(struct pci_dev *pdev,
+				struct plat_tc956xmacenet_data *plat)
+{
+	int i;
+
+	plat->clk_csr = 5;
+	plat->has_gmac = 0;
+	plat->has_gmac4 = 1;
+	plat->force_sf_dma_mode = 0;
+	plat->tso_en = 1;
+
+	plat->rx_sched_algorithm = MTL_RX_ALGORITHM_SP;
+
+	for (i = 0; i < plat->rx_queues_to_use; i++) {
+		plat->rx_queues_cfg[i].mode_to_use = MTL_QUEUE_DCB;
+		plat->rx_queues_cfg[i].chan = i;
+
+		/* Disable Priority config by default */
+		plat->rx_queues_cfg[i].use_prio = false;
+
+		/* Disable RX queues routing by default */
+		plat->rx_queues_cfg[i].pkt_route = 0x0;
+	}
+
+	for (i = 0; i < plat->tx_queues_to_use; i++) {
+		plat->tx_queues_cfg[i].mode_to_use = MTL_QUEUE_DCB;
+
+		/* Disable Priority config by default */
+		plat->tx_queues_cfg[i].use_prio = false;
+	}
+
+	/* FIFO size is 4096 bytes for 1 tx/rx queue */
+	plat->tx_fifo_size = plat->tx_queues_to_use * 4096;
+	plat->rx_fifo_size = plat->rx_queues_to_use * 4096;
+
+	plat->tx_sched_algorithm = MTL_TX_ALGORITHM_WRR;
+	plat->tx_queues_cfg[0].weight = 0x09;
+	plat->tx_queues_cfg[1].weight = 0x0A;
+	plat->tx_queues_cfg[2].weight = 0x0B;
+	plat->tx_queues_cfg[3].weight = 0x0C;
+	plat->tx_queues_cfg[4].weight = 0x0D;
+	plat->tx_queues_cfg[5].weight = 0x0E;
+	plat->tx_queues_cfg[6].weight = 0x0F;
+	plat->tx_queues_cfg[7].weight = 0x10;
+
+	plat->mdio_bus_data->phy_mask = 0;
+
+	plat->dma_cfg->pbl = 32;
+	plat->dma_cfg->pblx8 = true;
+	plat->dma_cfg->fixed_burst = 0;
+	plat->dma_cfg->mixed_burst = 0;
+	plat->dma_cfg->aal = 0;
+
+	plat->axi = devm_kzalloc(&pdev->dev, sizeof(*plat->axi),
+				 GFP_KERNEL);
+	if (!plat->axi)
+		return -ENOMEM;
+
+	plat->axi->axi_lpi_en = 0;
+	plat->axi->axi_xit_frm = 0;
+	plat->axi->axi_wr_osr_lmt = 1;
+	plat->axi->axi_rd_osr_lmt = 1;
+	plat->axi->axi_blen[0] = 4;
+	plat->axi->axi_blen[1] = 8;
+	plat->axi->axi_blen[2] = 16;
+
+	plat->ptp_max_adj = plat->clk_ptp_rate;
+
+	/* Set system clock */
+	plat->tc956xmac_clk = clk_register_fixed_rate(&pdev->dev,
+						"tc956xmac-clk", NULL, 0,
+						plat->clk_ptp_rate);
+
+	if (IS_ERR(plat->tc956xmac_clk)) {
+		dev_warn(&pdev->dev, "Fail to register tc956xmac-clk\n");
+		plat->tc956xmac_clk = NULL;
+	}
+	clk_prepare_enable(plat->tc956xmac_clk);
+
+	/* Set default value for multicast hash bins */
+	plat->multicast_filter_bins = HASH_TABLE_SIZE;
+
+	/* Set default value for unicast filter entries */
+	plat->unicast_filter_entries = 1;
+
+	/* Set the maxmtu to a default of JUMBO_LEN */
+	plat->maxmtu = JUMBO_LEN;
+
+	return 0;
+}
+
+static int ehl_common_data(struct pci_dev *pdev,
+			struct plat_tc956xmacenet_data *plat)
+{
+	int ret;
+
+	plat->rx_queues_to_use = 8;
+	plat->tx_queues_to_use = 8;
+	plat->clk_ptp_rate = 200000000;
+	ret = intel_mgbe_common_data(pdev, plat);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int ehl_sgmii_data(struct pci_dev *pdev,
+			  struct plat_tc956xmacenet_data *plat)
+{
+	plat->bus_id = 1;
+	plat->phy_addr = 0;
+	plat->interface = PHY_INTERFACE_MODE_SGMII;
+	return ehl_common_data(pdev, plat);
+}
+
+static struct tc956xmac_pci_info ehl_sgmii1g_pci_info = {
+	.setup = ehl_sgmii_data,
+};
+
+static int ehl_rgmii_data(struct pci_dev *pdev,
+			  struct plat_tc956xmacenet_data *plat)
+{
+	plat->bus_id = 1;
+	plat->phy_addr = 0;
+	plat->interface = PHY_INTERFACE_MODE_RGMII;
+	return ehl_common_data(pdev, plat);
+}
+
+static struct tc956xmac_pci_info ehl_rgmii1g_pci_info = {
+	.setup = ehl_rgmii_data,
+};
+
+static int tgl_common_data(struct pci_dev *pdev,
+			   struct plat_tc956xmacenet_data *plat)
+{
+	int ret;
+
+	plat->rx_queues_to_use = 6;
+	plat->tx_queues_to_use = 4;
+	plat->clk_ptp_rate = 200000000;
+	ret = intel_mgbe_common_data(pdev, plat);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int tgl_sgmii_data(struct pci_dev *pdev,
+			  struct plat_tc956xmacenet_data *plat)
+{
+	plat->bus_id = 1;
+	plat->phy_addr = 0;
+	plat->interface = PHY_INTERFACE_MODE_SGMII;
+
+	return tgl_common_data(pdev, plat);
+}
+
+static struct tc956xmac_pci_info tgl_sgmii1g_pci_info = {
+	.setup = tgl_sgmii_data,
+};
+
+static const struct tc956xmac_pci_func_data galileo_tc956xmac_func_data[] = {
+	{
+		.func = 6,
+		.phy_addr = 1,
+	},
+};
+
+static const struct tc956xmac_pci_dmi_data galileo_tc956xmac_dmi_data = {
+	.func = galileo_tc956xmac_func_data,
+	.nfuncs = ARRAY_SIZE(galileo_tc956xmac_func_data),
+};
+
+static const struct tc956xmac_pci_func_data iot2040_tc956xmac_func_data[] = {
+	{
+		.func = 6,
+		.phy_addr = 1,
+	},
+	{
+		.func = 7,
+		.phy_addr = 1,
+	},
+};
+
+static const struct tc956xmac_pci_dmi_data iot2040_tc956xmac_dmi_data = {
+	.func = iot2040_tc956xmac_func_data,
+	.nfuncs = ARRAY_SIZE(iot2040_tc956xmac_func_data),
+};
+
+static const struct dmi_system_id quark_pci_dmi[] = {
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "Galileo"),
+		},
+		.driver_data = (void *)&galileo_tc956xmac_dmi_data,
+	},
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "GalileoGen2"),
+		},
+		.driver_data = (void *)&galileo_tc956xmac_dmi_data,
+	},
+	/*
+	 * There are 2 types of SIMATIC IOT2000: IOT2020 and IOT2040.
+	 * The asset tag "6ES7647-0AA00-0YA2" is only for IOT2020 which
+	 * has only one pci network device while other asset tags are
+	 * for IOT2040 which has two.
+	 */
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "SIMATIC IOT2000"),
+			DMI_EXACT_MATCH(DMI_BOARD_ASSET_TAG,
+					"6ES7647-0AA00-0YA2"),
+		},
+		.driver_data = (void *)&galileo_tc956xmac_dmi_data,
+	},
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "SIMATIC IOT2000"),
+		},
+		.driver_data = (void *)&iot2040_tc956xmac_dmi_data,
+	},
+	{}
+};
+
+static int quark_default_data(struct pci_dev *pdev,
+			      struct plat_tc956xmacenet_data *plat)
+{
+	int ret;
+
+	/* Set common default data first */
+	common_default_data(plat);
+
+	/*
+	 * Refuse to load the driver and register net device if MAC controller
+	 * does not connect to any PHY interface.
+	 */
+	ret = tc956xmac_pci_find_phy_addr(pdev, quark_pci_dmi);
+	if (ret < 0) {
+		/* Return error to the caller on DMI enabled boards. */
+		if (dmi_get_system_info(DMI_BOARD_NAME))
+			return ret;
+
+		/*
+		 * Galileo boards with old firmware don't support DMI. We always
+		 * use 1 here as PHY address, so at least the first found MAC
+		 * controller would be probed.
+		 */
+		ret = 1;
+	}
+
+	plat->bus_id = pci_dev_id(pdev);
+	plat->phy_addr = ret;
+	plat->interface = PHY_INTERFACE_MODE_RMII;
+
+	plat->dma_cfg->pbl = 16;
+	plat->dma_cfg->pblx8 = true;
+	plat->dma_cfg->fixed_burst = 1;
+
+	return 0;
+}
+
+static const struct tc956xmac_pci_info quark_pci_info = {
+	.setup = quark_default_data,
+};
+
+static int snps_gmac5_default_data(struct pci_dev *pdev,
+				   struct plat_tc956xmacenet_data *plat)
+{
+	int i;
+
+	plat->clk_csr = 5;
+	plat->has_gmac4 = 1;
+	plat->force_sf_dma_mode = 1;
+	plat->tso_en = 1;
+	plat->sph_en = 1;
+	plat->pmt = 1;
+
+	plat->clk_ptp_rate = 62500000;
+	plat->clk_ref_rate = 62500000;
+
+	plat->mdio_bus_data->phy_mask = 0;
+
+	/* Set default value for multicast hash bins */
+	plat->multicast_filter_bins = HASH_TABLE_SIZE;
+
+	/* Set default value for unicast filter entries */
+	plat->unicast_filter_entries = 1;
+
+	/* Set the maxmtu to a default of JUMBO_LEN */
+	plat->maxmtu = JUMBO_LEN;
+
+	/* Set default number of RX and TX queues to use */
+	plat->tx_queues_to_use = 4;
+	plat->rx_queues_to_use = 4;
+
+	plat->tx_sched_algorithm = MTL_TX_ALGORITHM_WRR;
+	for (i = 0; i < plat->tx_queues_to_use; i++) {
+		plat->tx_queues_cfg[i].use_prio = false;
+		plat->tx_queues_cfg[i].mode_to_use = MTL_QUEUE_DCB;
+		plat->tx_queues_cfg[i].weight = 25;
+		if (i > 0)
+			plat->tx_queues_cfg[i].tbs_en = 1;
+	}
+
+	plat->rx_sched_algorithm = MTL_RX_ALGORITHM_SP;
+	for (i = 0; i < plat->rx_queues_to_use; i++) {
+		plat->rx_queues_cfg[i].use_prio = false;
+		plat->rx_queues_cfg[i].mode_to_use = MTL_QUEUE_DCB;
+		plat->rx_queues_cfg[i].pkt_route = 0x0;
+		plat->rx_queues_cfg[i].chan = i;
+	}
+
+	plat->bus_id = 1;
+	plat->phy_addr = -1;
+	plat->interface = PHY_INTERFACE_MODE_GMII;
+
+	plat->dma_cfg->pbl = 32;
+	plat->dma_cfg->pblx8 = true;
+
+	/* Axi Configuration */
+	plat->axi = devm_kzalloc(&pdev->dev, sizeof(*plat->axi), GFP_KERNEL);
+	if (!plat->axi)
+		return -ENOMEM;
+
+	plat->axi->axi_wr_osr_lmt = 31;
+	plat->axi->axi_rd_osr_lmt = 31;
+
+	plat->axi->axi_fb = false;
+	plat->axi->axi_blen[0] = 4;
+	plat->axi->axi_blen[1] = 8;
+	plat->axi->axi_blen[2] = 16;
+	plat->axi->axi_blen[3] = 32;
+
+	/* EST Configuration */
+	plat->est = devm_kzalloc(&pdev->dev, sizeof(*plat->est), GFP_KERNEL);
+	if (!plat->est)
+		return -ENOMEM;
+
+	plat->est->enable = 0;
+	plat->est->btr_offset[0] = 0;
+	plat->est->btr_offset[1] = 0;
+	plat->est->ctr[0] = 100000 * plat->tx_queues_to_use;
+	plat->est->ctr[1] = 0;
+	plat->est->ter = 0;
+	plat->est->gcl_size = plat->tx_queues_to_use;
+
+	for (i = 0; i < plat->tx_queues_to_use; i++) {
+#ifndef TC956X
+		u32 value = BIT(24 + i) + 100000;
+
+		plat->est->gcl_unaligned[i] = value;
+#endif
+	}
+
+	return 0;
+}
+
+static const struct tc956xmac_pci_info snps_gmac5_pci_info = {
+	.setup = snps_gmac5_default_data,
+};
+
+#define XGMAC3_PHY_OFF		0x00008000
+#define XGMAC3_PHY_ADDR		(XGMAC3_PHY_OFF + 0x00000ff0)
+
+static int xgmac3_phy_read(void *priv, int phyaddr, int phyreg)
+{
+	struct tc956xmac_priv *spriv = priv;
+	u32 off, ret;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+	if (!(phyreg & MII_ADDR_C45))
+		return -ENODEV;
+
+	phyreg &= ~MII_ADDR_C45;
+#endif
+	off = (phyreg & GENMASK(7, 0)) << 4;
+
+	writel(phyreg >> 8, spriv->ioaddr + XGMAC3_PHY_ADDR);
+	readl(spriv->ioaddr + XGMAC3_PHY_ADDR);
+	usleep_range(100, 200);
+	readl(spriv->ioaddr + XGMAC3_PHY_OFF + off);
+	usleep_range(100, 200);
+	ret = readl(spriv->ioaddr + XGMAC3_PHY_OFF + off);
+
+	return ret;
+}
+
+static int xgmac3_phy_write(void *priv, int phyaddr, int phyreg, u16 phydata)
+{
+	struct tc956xmac_priv *spriv = priv;
+	u32 off;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+	if (!(phyreg & MII_ADDR_C45))
+		return -ENODEV;
+
+	phyreg &= ~MII_ADDR_C45;
+#endif
+	off = (phyreg & GENMASK(7, 0)) << 4;
+
+	writel(phyreg >> 8, spriv->ioaddr + XGMAC3_PHY_ADDR);
+	readl(spriv->ioaddr + XGMAC3_PHY_ADDR);
+	usleep_range(100, 200);
+	writel(phydata, spriv->ioaddr + XGMAC3_PHY_OFF + off);
+	readl(spriv->ioaddr + XGMAC3_PHY_OFF + off);
+	usleep_range(100, 200);
+
+	return 0;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static void xgmac_default_data(struct plat_tc956xmacenet_data *plat)
+{
+	plat->has_xgmac = 1;
+	plat->force_sf_dma_mode = 1;
+	plat->tso_en = 1;
+#ifdef TC956X
+	plat->cphy_read = NULL;
+	plat->cphy_write = NULL;
+#else
+	plat->cphy_read = xgmac3_phy_read;
+	plat->cphy_write = xgmac3_phy_write;
+#endif
+	plat->mdio_bus_data->phy_mask = 0;
+#ifdef TC956X
+
+	switch (plat->mdc_clk) {
+	case TC956XMAC_XGMAC_MDC_CSR_4:
+		plat->clk_csr = 0x0;
+		plat->clk_crs = 1;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_6:
+		plat->clk_csr = 0x1;
+		plat->clk_crs = 1;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_8:
+		plat->clk_csr = 0x2;
+		plat->clk_crs = 1;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_10:
+		plat->clk_csr = 0x3;
+		plat->clk_crs = 1;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_12:
+		plat->clk_csr = 0x4;
+		plat->clk_crs = 1;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_14:
+		plat->clk_csr = 0x5;
+		plat->clk_crs = 1;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_16:
+		plat->clk_csr = 0x6;
+		plat->clk_crs = 1;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_18:
+		plat->clk_csr = 0x7;
+		plat->clk_crs = 1;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_62:
+		plat->clk_csr = 0x0;
+		plat->clk_crs = 0;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_102:
+		plat->clk_csr = 0x1;
+		plat->clk_crs = 0;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_122:
+		plat->clk_csr = 0x2;
+		plat->clk_crs = 0;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_142:
+		plat->clk_csr = 0x3;
+		plat->clk_crs = 0;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_162:
+		plat->clk_csr = 0x4;
+		plat->clk_crs = 0;
+		break;
+	case TC956XMAC_XGMAC_MDC_CSR_202:
+		plat->clk_csr = 0x5;
+		plat->clk_crs = 0;
+		break;
+
+	};
+
+	plat->has_gmac = 0;
+	plat->has_gmac4 = 0;
+	plat->force_thresh_dma_mode  = 0;
+	plat->mdio_bus_data->needs_reset = false;
+	if ((plat->port_interface == ENABLE_USXGMII_INTERFACE) ||
+	   (plat->port_interface == ENABLE_XFI_INTERFACE))
+		plat->mac_port_sel_speed = 10000;
+
+	if (plat->port_interface == ENABLE_RGMII_INTERFACE)
+		plat->mac_port_sel_speed = 1000;
+
+	if ((plat->port_interface == ENABLE_SGMII_INTERFACE) ||
+		(plat->port_interface == ENABLE_2500BASE_X_INTERFACE)) {
+		plat->mac_port_sel_speed = 2500;
+	}
+
+	plat->riwt_off = 0;
+	plat->rss_en = 0;
+#endif
+
+	/*For RXP config */
+#ifdef TC956X_FRP_ENABLE
+	plat->rxp_cfg.enable = true;
+#else
+	plat->rxp_cfg.enable = false;
+#endif
+
+	plat->rxp_cfg.nve = ARRAY_SIZE(snps_rxp_entries);
+	plat->rxp_cfg.npe = ARRAY_SIZE(snps_rxp_entries);
+	memcpy(plat->rxp_cfg.entries, snps_rxp_entries,
+			ARRAY_SIZE(snps_rxp_entries) *
+			sizeof(struct tc956xmac_rx_parser_entry));
+#ifndef TC956X_SRIOV_VF
+	/* Over writing the Default FRP table with FRP Table for Filtering PHY pause frames */
+	if ((mac0_filter_phy_pause == ENABLE && plat->port_num == RM_PF0_ID) ||
+	   (mac1_filter_phy_pause == ENABLE && plat->port_num == RM_PF1_ID)) {
+		plat->rxp_cfg.nve = ARRAY_SIZE(snps_rxp_entries_filter_phy_pause_frames);
+		plat->rxp_cfg.npe = ARRAY_SIZE(snps_rxp_entries_filter_phy_pause_frames);
+		memcpy(plat->rxp_cfg.entries, snps_rxp_entries_filter_phy_pause_frames,
+				ARRAY_SIZE(snps_rxp_entries_filter_phy_pause_frames) *
+				sizeof(struct tc956xmac_rx_parser_entry));
+	}
+#endif
+}
+
+#ifdef TC956X_SRIOV_VF
+#ifdef TC956X_SRIOV_DEBUG
+static void tc956x_print_vf_mac_config(struct pci_dev *pdev,
+				struct plat_tc956xmacenet_data *plat)
+{
+	u8 ch, k;
+
+	dev_info(&pdev->dev, "******************************************************************\n");
+	dev_info(&pdev->dev, "VF %d - MAC Config Params:\n", (plat->vf_id + 1));
+	dev_info(&pdev->dev, "rx_queues_to_use_actual : %d\n", plat->rx_queues_to_use_actual);
+	dev_info(&pdev->dev, "tx_queues_to_use_actual : %d\n", plat->tx_queues_to_use_actual);
+	dev_info(&pdev->dev, "Ch enabled : \t");
+	for (ch = 0; ch < MTL_MAX_RX_QUEUES; ch++) {
+
+		if (plat->ch_in_use[ch] == 1)
+			dev_info(&pdev->dev, " %d\t", ch);
+	}
+	dev_info(&pdev->dev, "Tx Q in use : \t");
+	for (ch = 0; ch < MTL_MAX_RX_QUEUES; ch++) {
+
+		if (plat->tx_q_in_use[ch] == 1)
+			dev_info(&pdev->dev, "Q: %d Size: %d\t", ch, plat->tx_q_size[ch]);
+	}
+	dev_info(&pdev->dev, "Rx Q in use : \t");
+	for (ch = 0; ch < MTL_MAX_RX_QUEUES; ch++) {
+
+		if (plat->rx_q_in_use[ch] == 1)
+			dev_info(&pdev->dev, " %d\t", ch);
+	}
+	dev_info(&pdev->dev, "Best Ef Ch : %d\n", plat->best_effort_ch_no);
+	dev_info(&pdev->dev, "AVB A Ch : %d\n", plat->avb_class_a_ch_no);
+	dev_info(&pdev->dev, "AVB B Ch : %d\n", plat->avb_class_b_ch_no);
+	dev_info(&pdev->dev, "TSN Ch : %d\n", plat->tsn_ch_no);
+
+
+
+	dev_info(&pdev->dev, "Tx Q config :\n");
+	for (k = 0; k < MTL_MAX_RX_QUEUES; k++) {
+		dev_info(&pdev->dev, "Q%d : weight %d\n", k, plat->tx_queues_cfg[k].weight);
+		dev_info(&pdev->dev, "Q%d : mode_to_use %d\n", k, plat->tx_queues_cfg[k].mode_to_use);
+		dev_info(&pdev->dev, "Q%d : send_slope %d\n", k, plat->tx_queues_cfg[k].send_slope);
+		dev_info(&pdev->dev, "Q%d : idle_slope %d\n", k, plat->tx_queues_cfg[k].idle_slope);
+		dev_info(&pdev->dev, "Q%d : high_credit %d\n", k, plat->tx_queues_cfg[k].high_credit);
+		dev_info(&pdev->dev, "Q%d : low_credit %d\n", k, plat->tx_queues_cfg[k].low_credit);
+		dev_info(&pdev->dev, "Q%d : use_prio %d\n", k, plat->tx_queues_cfg[k].use_prio);
+		dev_info(&pdev->dev, "Q%d : prio %d\n", k, plat->tx_queues_cfg[k].prio);
+		dev_info(&pdev->dev, "Q%d : tbs_en %d\n", k, plat->tx_queues_cfg[k].tbs_en);
+		dev_info(&pdev->dev, "Q%d : tso_en %d\n", k, plat->tx_queues_cfg[k].tso_en);
+		dev_info(&pdev->dev, "\n");
+	}
+	dev_info(&pdev->dev, "******************************************************************\n");
+}
+#endif
+#endif /* TC956X_SRIOV_VF */
+
+static int tc956xmac_xgmac3_default_data(struct pci_dev *pdev,
+				struct plat_tc956xmacenet_data *plat)
+{
+#ifndef TC956X_SRIOV_VF
+	unsigned int queue0_rfd = 0, queue1_rfd = 0, queue0_rfa = 0, queue1_rfa = 0, temp_var = 0;
+	unsigned int rxqueue0_size = 0, rxqueue1_size = 0, txqueue0_size = 0, txqueue1_size = 0;
+#endif
+	unsigned int forced_speed = 3; /* default 1Gbps */
+	unsigned int axi_blen = 0; /* default */
+	/* Set common default data first */
+	xgmac_default_data(plat);
+
+	plat->gate_mask = 1; /* 1: tc_to_txq gate mask enabled by default. Traffic control gate event mapped to respective queues in kernel and sent to Driver */
+	plat->bus_id = 1;
+#ifdef TC956X
+	plat->phy_addr = -1;
+#else
+	plat->phy_addr = 0;
+#endif
+	plat->pdev = pdev;
+	plat->pse = 0;
+
+#ifdef TC956X
+	if (plat->port_interface == ENABLE_USXGMII_INTERFACE) {
+		plat->interface = PHY_INTERFACE_MODE_USXGMII;
+		plat->max_speed = 10000;
+	}
+	if (plat->port_interface == ENABLE_XFI_INTERFACE) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+		plat->interface = PHY_INTERFACE_MODE_10GBASER;
+#else
+		plat->interface = PHY_INTERFACE_MODE_10GKR;
+#endif
+		plat->max_speed = 10000;
+	}
+	if (plat->port_interface == ENABLE_RGMII_INTERFACE) {
+		plat->interface = PHY_INTERFACE_MODE_RGMII;
+		plat->max_speed = 1000;
+	}
+	if (plat->port_interface == ENABLE_RGMII_ID_INTERFACE) {
+		plat->interface = PHY_INTERFACE_MODE_RGMII_ID;
+		plat->max_speed = 1000;
+	}
+	if ((plat->port_interface == ENABLE_SGMII_INTERFACE) ||
+		(plat->port_interface == ENABLE_2500BASE_X_INTERFACE)) {
+		plat->interface = PHY_INTERFACE_MODE_SGMII;
+		plat->max_speed = 2500;
+	}
+#else
+	plat->interface = PHY_INTERFACE_MODE_USXGMII;
+	plat->max_speed = 10000;
+
+#endif
+	plat->phy_interface = plat->interface;
+
+	/* Configure forced speed based on the module param.
+	 * This is applicable only for fixed phy mode.
+	 */
+	if (plat->port_num == RM_PF0_ID)
+		forced_speed = mac0_force_config_speed;
+
+	if (plat->port_num == RM_PF1_ID)
+		forced_speed = mac1_force_config_speed;
+
+	switch (forced_speed) {
+	case 0:
+		plat->forced_speed = SPEED_10000;
+		break;
+	case 1:
+		plat->forced_speed = SPEED_5000;
+		break;
+	case 2:
+		plat->forced_speed = SPEED_2500;
+		break;
+	case 3:
+		plat->forced_speed = SPEED_1000;
+		break;
+	case 4:
+		plat->forced_speed = SPEED_100;
+		break;
+	case 5:
+		plat->forced_speed = SPEED_10;
+		break;
+	default:
+		plat->forced_speed = SPEED_1000;
+		break;
+	}
+
+#ifdef TC956X
+	plat->clk_ptp_rate = TC956X_TARGET_PTP_CLK;
+#else
+	plat->clk_ref_rate = 62500000;
+#endif
+
+#ifdef TC956X
+	/* Set default value for multicast hash bins */
+	plat->multicast_filter_bins = HASH_TABLE_SIZE;
+	/* Set default value for unicast filter entries */
+	plat->unicast_filter_entries = MAX_MAC_ADDR_FILTERS;
+#else
+	plat->multicast_filter_bins = 0;
+	/* Set default value for unicast filter entries */
+	plat->unicast_filter_entries = 1;
+
+#endif
+#if defined(TC956X_CPE_CONFIG)
+	plat->maxmtu = MAX_SUPPORTED_MTU/*XGMAC_JUMBO_LEN*/;
+#else
+	plat->maxmtu = XGMAC_JUMBO_LEN;
+#endif
+
+	/* Set default number of RX and TX queues to use */
+#ifdef TC956X
+	plat->tx_queues_to_use = MAX_TX_QUEUES_TO_USE;
+	plat->rx_queues_to_use = MAX_RX_QUEUES_TO_USE;
+#ifdef TC956X_SRIOV_VF
+	plat->rx_queues_to_use_actual = tc956xmac_vf[plat->vf_id].rx_queues_to_use_actual;
+	plat->tx_queues_to_use_actual = tc956xmac_vf[plat->vf_id].tx_queues_to_use_actual;
+	memcpy(plat->ch_in_use, tc956xmac_vf[plat->vf_id].ch_in_use, sizeof(plat->ch_in_use));
+	memcpy(plat->tx_q_in_use, tc956xmac_vf[plat->vf_id].tx_q_in_use, sizeof(plat->tx_q_in_use));
+	memcpy(plat->rx_q_in_use, tc956xmac_vf[plat->vf_id].rx_q_in_use, sizeof(plat->rx_q_in_use));
+	memcpy(plat->tx_q_size, tc956xmac_vf[plat->vf_id].tx_q_size, sizeof(plat->tx_q_size));
+	plat->best_effort_ch_no = tc956xmac_vf[plat->vf_id].best_effort_ch_no;
+	plat->gptp_ch_no = tc956xmac_vf[plat->vf_id].gptp_ch_no;
+	plat->avb_class_a_ch_no = tc956xmac_vf[plat->vf_id].avb_class_a_ch_no;
+	plat->avb_class_b_ch_no = tc956xmac_vf[plat->vf_id].avb_class_b_ch_no;
+	plat->tsn_ch_no = tc956xmac_vf[plat->vf_id].tsn_ch_no;
+	plat->tsn_application = tc956xmac_vf[plat->vf_id].tsn_application;
+	plat->avb_application = tc956xmac_vf[plat->vf_id].avb_application;
+#endif
+#else
+	plat->tx_queues_to_use = 1;
+	plat->rx_queues_to_use = 1;
+#endif
+
+#ifdef TC956X
+	/* MTL Configuration */
+
+	/*Rx queue configuration for VFs are done in PF driver, so skip setting it here*/
+#ifndef TC956X_SRIOV_VF
+	/* Static Mapping */
+	/* Note : Best Effort, Broadcast/Multicast packet routing based
+	 * on DA filter Channel Mapping
+	 */
+	/* Unicast/Untagged Packets : Consider Jumbo packets */
+	plat->rx_queues_cfg[0].chan = LEG_UNTAGGED_PACKET;
+	/* VLAN Tagged Legacy packets */
+	plat->rx_queues_cfg[1].chan = LEG_TAGGED_PACKET;
+	/* Untagged gPTP packets  */
+	plat->rx_queues_cfg[2].chan = UNTAGGED_GPTP_PACKET;
+
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE) || defined(TC956X_CPE_CONFIG)
+	/* Tagged/Untagged  AV control pkts */
+	plat->rx_queues_cfg[3].chan = UNTAGGED_AVCTRL_PACKET;
+#else
+	/* Filter Failed Unicast, Multicast, Tagged packets */
+	plat->rx_queues_cfg[3].chan = FILTER_FAIL_PACKET;
+#endif
+
+	/* AVB Class B */
+	plat->rx_queues_cfg[4].chan = AVB_CLASS_B_PACKET;
+	/* AVB Class A */
+	plat->rx_queues_cfg[5].chan = AVB_CLASS_A_PACKET;
+	/* CDT */
+	plat->rx_queues_cfg[6].chan = TSN_CLASS_CDT_PACKET;
+	/* Broadcast/Multicast packets to support pkt duplication it should be highest queue */
+	plat->rx_queues_cfg[7].chan = BC_MC_PACKET;
+
+	/* Rx Queue Packet routing */
+	plat->rx_queues_cfg[0].pkt_route = RX_QUEUE0_PKT_ROUTE;
+	plat->rx_queues_cfg[1].pkt_route = RX_QUEUE1_PKT_ROUTE;
+	plat->rx_queues_cfg[2].pkt_route = RX_QUEUE2_PKT_ROUTE;
+	plat->rx_queues_cfg[3].pkt_route = RX_QUEUE3_PKT_ROUTE;
+	plat->rx_queues_cfg[4].pkt_route = RX_QUEUE4_PKT_ROUTE;
+	plat->rx_queues_cfg[5].pkt_route = RX_QUEUE5_PKT_ROUTE;
+	plat->rx_queues_cfg[6].pkt_route = RX_QUEUE6_PKT_ROUTE;
+	plat->rx_queues_cfg[7].pkt_route = RX_QUEUE7_PKT_ROUTE;
+	/* MTL Scheduler for RX and TX */
+
+	plat->rx_sched_algorithm = MTL_RX_ALGORITHM_SP;
+	plat->tx_sched_algorithm = MTL_TX_ALGORITHM_WRR;
+#endif
+
+#ifndef TC956X_SRIOV_VF
+	/* Due to the erratum in XGMAC 3.01a, WRR weights not considered in
+	 * TX DMA read data arbitration. Workaround is at set all weights for Tx Queues with
+	 * WRR arbitration logic to 1
+	 */
+
+	 /* Best Effort weitghts are same as its mapped to TC0 */
+	plat->tx_queues_cfg[0].weight = 0x11;
+	plat->tx_queues_cfg[1].weight = 0x11;
+	plat->tx_queues_cfg[2].weight = 0x11;
+	plat->tx_queues_cfg[3].weight = 0x11;
+#if defined(TC956X_CPE_CONFIG)
+	plat->tx_queues_cfg[4].weight = 0x11;
+#else
+	plat->tx_queues_cfg[4].weight = 0x12;
+#endif
+	plat->tx_queues_cfg[5].weight = 0x13;
+	plat->tx_queues_cfg[6].weight = 0x14;
+	plat->tx_queues_cfg[7].weight = 0x15;
+#else
+	/* Each VF will have different configuration which is initialised in the
+	 * tc956xmac_vf table. Copy all the tx queue configuration for this vf_id
+	 * here
+	 */
+	memcpy(plat->tx_queues_cfg, tc956xmac_vf[plat->vf_id].tx_queues_cfg, sizeof(plat->tx_queues_cfg));
+#endif
+
+	/*Rx queue configuration for VFs are done in PF driver, so skip setting it here*/
+#ifndef TC956X_SRIOV_VF
+	plat->rx_queues_cfg[0].mode_to_use = RX_QUEUE0_MODE;
+	plat->rx_queues_cfg[1].mode_to_use = RX_QUEUE1_MODE;
+	plat->rx_queues_cfg[2].mode_to_use = RX_QUEUE2_MODE;
+	plat->rx_queues_cfg[3].mode_to_use = RX_QUEUE3_MODE;
+	plat->rx_queues_cfg[4].mode_to_use = RX_QUEUE4_MODE;
+	plat->rx_queues_cfg[5].mode_to_use = RX_QUEUE5_MODE;
+	plat->rx_queues_cfg[6].mode_to_use = RX_QUEUE6_MODE;
+	plat->rx_queues_cfg[7].mode_to_use = RX_QUEUE7_MODE;
+#endif
+
+#ifndef TC956X_SRIOV_VF
+	plat->tx_queues_cfg[0].mode_to_use = TX_QUEUE0_MODE;
+	plat->tx_queues_cfg[1].mode_to_use = TX_QUEUE1_MODE;
+	plat->tx_queues_cfg[2].mode_to_use = TX_QUEUE2_MODE;
+	plat->tx_queues_cfg[3].mode_to_use = TX_QUEUE3_MODE;
+	plat->tx_queues_cfg[4].mode_to_use = TX_QUEUE4_MODE;
+	plat->tx_queues_cfg[5].mode_to_use = TX_QUEUE5_MODE;
+	plat->tx_queues_cfg[6].mode_to_use = TX_QUEUE6_MODE;
+	plat->tx_queues_cfg[7].mode_to_use = TX_QUEUE7_MODE;
+#else
+	/*Already all configurations are copied through mem_cpy above*/
+#endif
+
+#ifndef TC956X_SRIOV_VF
+	/* CBS are per TC basis in TC956X (total TC = 5) */
+	/* CBS: queue 5 -> Class B traffic (25% BW) */
+	/* plat->tx_queues_cfg[3].idle_slope = plat->est_cfg.enable ? 0x8e4 : 0x800; */
+
+	/* CBS: queue 5 -> Class B traffic (25% BW) */
+	plat->tx_queues_cfg[5].idle_slope = 0x800;
+	plat->tx_queues_cfg[5].send_slope = 0x1800;
+	plat->tx_queues_cfg[5].high_credit = 0x320000;
+	plat->tx_queues_cfg[5].low_credit = 0xff6a0000;
+
+	/* CBS: queue 6 -> Class A traffic (25% BW) */
+	/* plat->tx_queues_cfg[5].idle_slope = plat->est_cfg.enable ? 0x8e4 : 0x800; */
+	plat->tx_queues_cfg[6].idle_slope = 0x800;
+	plat->tx_queues_cfg[6].send_slope = 0x1800;
+	plat->tx_queues_cfg[6].high_credit = 0x320000;
+	plat->tx_queues_cfg[6].low_credit = 0xff6a0000;
+
+	/* CBS: queue 7 -> Class CDT traffic (40%) BW */
+	/* plat->tx_queues_cfg[4].idle_slope = plat->est_cfg.enable ? 0xe38 : 0xccc; */
+	plat->tx_queues_cfg[7].idle_slope = 0xccc;
+	plat->tx_queues_cfg[7].send_slope = 0x1333;
+	plat->tx_queues_cfg[7].high_credit = 0x500000;
+	plat->tx_queues_cfg[7].low_credit = 0xff880000;
+
+#endif
+#ifndef TC956X_SRIOV_VF
+	/* Tx TC priority */
+	plat->tx_queues_cfg[0].use_prio = TX_QUEUE0_USE_PRIO;
+	plat->tx_queues_cfg[1].use_prio = TX_QUEUE1_USE_PRIO;
+	plat->tx_queues_cfg[2].use_prio = TX_QUEUE2_USE_PRIO;
+	plat->tx_queues_cfg[3].use_prio = TX_QUEUE3_USE_PRIO;
+	plat->tx_queues_cfg[4].use_prio = TX_QUEUE4_USE_PRIO;
+	plat->tx_queues_cfg[5].use_prio = TX_QUEUE5_USE_PRIO;
+	plat->tx_queues_cfg[6].use_prio = TX_QUEUE6_USE_PRIO;
+	plat->tx_queues_cfg[7].use_prio = TX_QUEUE7_USE_PRIO;
+
+	plat->tx_queues_cfg[0].prio = TX_QUEUE0_PRIO;
+	plat->tx_queues_cfg[1].prio = TX_QUEUE1_PRIO;
+	plat->tx_queues_cfg[2].prio = TX_QUEUE2_PRIO;
+	plat->tx_queues_cfg[3].prio = TX_QUEUE3_PRIO;
+	plat->tx_queues_cfg[4].prio = TX_QUEUE4_PRIO;
+	plat->tx_queues_cfg[5].prio = TX_QUEUE5_PRIO;
+	plat->tx_queues_cfg[6].prio = TX_QUEUE6_PRIO;
+	plat->tx_queues_cfg[7].prio = TX_QUEUE7_PRIO;
+
+	/* Enable/Disable TBS */
+	plat->tx_queues_cfg[0].tbs_en = TX_QUEUE0_TBS;
+	plat->tx_queues_cfg[1].tbs_en = TX_QUEUE1_TBS;
+	plat->tx_queues_cfg[2].tbs_en = TX_QUEUE2_TBS;
+	plat->tx_queues_cfg[3].tbs_en = TX_QUEUE3_TBS;
+	plat->tx_queues_cfg[4].tbs_en = TX_QUEUE4_TBS;
+	plat->tx_queues_cfg[5].tbs_en = TX_QUEUE5_TBS;
+	plat->tx_queues_cfg[6].tbs_en = TX_QUEUE6_TBS;
+	plat->tx_queues_cfg[7].tbs_en = TX_QUEUE7_TBS;
+
+	/* Enable/Disable TSO*/
+	plat->tx_queues_cfg[0].tso_en = TX_QUEUE0_TSO;
+	plat->tx_queues_cfg[1].tso_en = TX_QUEUE1_TSO;
+	plat->tx_queues_cfg[2].tso_en = TX_QUEUE2_TSO;
+	plat->tx_queues_cfg[3].tso_en = TX_QUEUE3_TSO;
+	plat->tx_queues_cfg[4].tso_en = TX_QUEUE4_TSO;
+	plat->tx_queues_cfg[5].tso_en = TX_QUEUE5_TSO;
+	plat->tx_queues_cfg[6].tso_en = TX_QUEUE6_TSO;
+	plat->tx_queues_cfg[7].tso_en = TX_QUEUE7_TSO;
+
+	plat->tx_queues_cfg[0].traffic_class = TX_QUEUE0_TC;
+	plat->tx_queues_cfg[1].traffic_class = TX_QUEUE1_TC;
+	plat->tx_queues_cfg[2].traffic_class = TX_QUEUE2_TC;
+	plat->tx_queues_cfg[3].traffic_class = TX_QUEUE3_TC;
+	plat->tx_queues_cfg[4].traffic_class = TX_QUEUE4_TC;
+	plat->tx_queues_cfg[5].traffic_class = TX_QUEUE5_TC;
+	plat->tx_queues_cfg[6].traffic_class = TX_QUEUE6_TC;
+	plat->tx_queues_cfg[7].traffic_class = TX_QUEUE7_TC;
+
+
+	plat->rx_queues_cfg[0].use_prio = RX_QUEUE0_USE_PRIO;
+	plat->rx_queues_cfg[0].prio = RX_QUEUE0_PRIO;
+
+	plat->rx_queues_cfg[1].use_prio = RX_QUEUE1_USE_PRIO;
+	plat->rx_queues_cfg[1].prio = RX_QUEUE1_PRIO;
+
+	plat->rx_queues_cfg[2].use_prio = RX_QUEUE2_USE_PRIO;
+	plat->rx_queues_cfg[2].prio = RX_QUEUE2_PRIO;
+
+	plat->rx_queues_cfg[3].use_prio = RX_QUEUE3_USE_PRIO;
+	plat->rx_queues_cfg[3].prio = RX_QUEUE3_PRIO;
+
+	plat->rx_queues_cfg[4].use_prio = RX_QUEUE4_USE_PRIO;
+	plat->rx_queues_cfg[4].prio = RX_QUEUE4_PRIO;
+
+	plat->rx_queues_cfg[5].use_prio = RX_QUEUE5_USE_PRIO;
+	plat->rx_queues_cfg[5].prio = RX_QUEUE5_PRIO;
+
+	plat->rx_queues_cfg[6].use_prio = RX_QUEUE6_USE_PRIO;
+	plat->rx_queues_cfg[6].prio = RX_QUEUE6_PRIO;
+
+	plat->rx_queues_cfg[7].use_prio = RX_QUEUE7_USE_PRIO;
+	plat->rx_queues_cfg[7].prio = RX_QUEUE7_PRIO;
+#endif
+#else	/* TC956X */
+	/* Disable Priority config by default */
+	plat->tx_queues_cfg[0].use_prio = false;
+	plat->tx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+	plat->rx_queues_cfg[0].use_prio = false;
+	plat->rx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+
+	/* Disable RX queues routing by default */
+	plat->rx_queues_cfg[0].pkt_route = 0x0;
+#endif
+
+#ifdef TC956X
+	if (plat->port_num == RM_PF0_ID)
+		plat->dma_cfg->txpbl = mac0_tx_pbl;
+
+	if (plat->port_num == RM_PF1_ID)
+		plat->dma_cfg->txpbl = mac1_tx_pbl;
+
+	if (plat->port_num == RM_PF0_ID)
+		plat->dma_cfg->rxpbl = mac0_rx_pbl;
+
+	if (plat->port_num == RM_PF1_ID)
+		plat->dma_cfg->rxpbl = mac1_rx_pbl;
+
+	plat->dma_cfg->pblx8 = true;
+#else
+	plat->dma_cfg->pbl = 32;
+	plat->dma_cfg->pblx8 = true;
+#endif
+	/* Axi Configuration */
+	plat->axi = devm_kzalloc(&pdev->dev, sizeof(*plat->axi), GFP_KERNEL);
+	if (!plat->axi)
+		return -ENOMEM;
+
+#ifdef TC956X
+#ifdef EEE_MAC_CONTROLLED_MODE
+	plat->axi->axi_lpi_en = 1;
+	plat->axi->axi_xit_frm = 0;
+	plat->en_tx_lpi_clockgating = 1;
+#endif
+	if (plat->port_num == RM_PF0_ID) {
+		plat->axi->axi_wr_osr_lmt = mac0_axi_wr_osr_lmt;
+		plat->axi->axi_rd_osr_lmt = mac0_axi_rd_osr_lmt;
+	}
+
+	if (plat->port_num == RM_PF1_ID) {
+		plat->axi->axi_wr_osr_lmt = mac1_axi_wr_osr_lmt;
+		plat->axi->axi_rd_osr_lmt = mac1_axi_rd_osr_lmt;
+	}
+
+#else
+	plat->axi->axi_wr_osr_lmt = 31;
+	plat->axi->axi_rd_osr_lmt = 31;
+#endif
+
+	if (plat->port_num == RM_PF0_ID)
+		axi_blen = mac0_axi_blen;
+
+	if (plat->port_num == RM_PF1_ID)
+		axi_blen = mac1_axi_blen;
+
+	plat->axi->axi_fb = true;
+	plat->axi->axi_blen[0] = 4;
+	plat->axi->axi_blen[1] = 0;
+	plat->axi->axi_blen[2] = 0;
+	plat->axi->axi_blen[3] = 0;
+	plat->axi->axi_blen[4] = 0;
+	plat->axi->axi_blen[5] = 0;
+	plat->axi->axi_blen[6] = 0;
+
+	switch (axi_blen) {
+	case 256:
+		plat->axi->axi_blen[6] = 256;
+		/* Falls through. */
+		fallthrough;
+	case 128:
+		plat->axi->axi_blen[5] = 128;
+		/* Falls through. */
+		fallthrough;
+	case 64:
+		plat->axi->axi_blen[4] = 64;
+		/* Falls through. */
+		fallthrough;
+	case 32:
+		plat->axi->axi_blen[3] = 32;
+		/* Falls through. */
+		fallthrough;
+	case 16:
+		plat->axi->axi_blen[2] = 16;
+		/* Falls through. */
+		fallthrough;
+	case 8:
+		plat->axi->axi_blen[1] = 8;
+		/* Falls through. */
+		fallthrough;
+	case 4:
+		plat->axi->axi_blen[0] = 4;
+		break;
+
+	default:
+		plat->axi->axi_fb = false;
+		plat->axi->axi_blen[0] = 4;
+		plat->axi->axi_blen[1] = 8;
+		plat->axi->axi_blen[2] = 16;
+		plat->axi->axi_blen[3] = 32;
+		plat->axi->axi_blen[4] = 64;
+		plat->axi->axi_blen[5] = 128;
+		plat->axi->axi_blen[6] = 256;
+		break;
+	}
+
+	if (!plat->est) {
+		plat->est = devm_kzalloc(&pdev->dev, sizeof(*plat->est),
+					 GFP_KERNEL);
+		if (!plat->est)
+			return -ENOMEM;
+	} else {
+		memset(plat->est, 0, sizeof(*plat->est));
+	}
+
+#ifdef TC956X_SRIOV_VF
+#ifdef TC956X_SRIOV_DEBUG
+	tc956x_print_vf_mac_config(pdev, plat);
+#endif
+#endif
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_DMA_OFFLOAD_ENABLE)
+	plat->tx_dma_ch_owner[0] = TX_DMA_CH0_OWNER;
+	plat->tx_dma_ch_owner[1] = TX_DMA_CH1_OWNER;
+	plat->tx_dma_ch_owner[2] = TX_DMA_CH2_OWNER;
+	plat->tx_dma_ch_owner[3] = TX_DMA_CH3_OWNER;
+	plat->tx_dma_ch_owner[4] = TX_DMA_CH4_OWNER;
+	plat->tx_dma_ch_owner[5] = TX_DMA_CH5_OWNER;
+	plat->tx_dma_ch_owner[6] = TX_DMA_CH6_OWNER;
+	plat->tx_dma_ch_owner[7] = TX_DMA_CH7_OWNER;
+
+	plat->rx_dma_ch_owner[0] = RX_DMA_CH0_OWNER;
+	plat->rx_dma_ch_owner[1] = RX_DMA_CH1_OWNER;
+	plat->rx_dma_ch_owner[2] = RX_DMA_CH2_OWNER;
+	plat->rx_dma_ch_owner[3] = RX_DMA_CH3_OWNER;
+	plat->rx_dma_ch_owner[4] = RX_DMA_CH4_OWNER;
+	plat->rx_dma_ch_owner[5] = RX_DMA_CH5_OWNER;
+	plat->rx_dma_ch_owner[6] = RX_DMA_CH6_OWNER;
+	plat->rx_dma_ch_owner[7] = RX_DMA_CH7_OWNER;
+#endif
+
+	/* Configuration of PHY operating mode 1(true): for interrupt mode, 0(false): for polling mode */
+	if (plat->port_num == RM_PF0_ID) {
+#ifdef TC956X_PHY_INTERRUPT_MODE_EMAC0
+		plat->phy_interrupt_mode = true;
+#else
+		plat->phy_interrupt_mode = false;
+#endif
+	}
+
+	if (plat->port_num == RM_PF1_ID) {
+#ifdef TC956X_PHY_INTERRUPT_MODE_EMAC1
+		plat->phy_interrupt_mode = true;
+#else
+		plat->phy_interrupt_mode = false;
+#endif
+	}
+
+#ifndef TC956X_SRIOV_VF
+	/* Rx Queue size and flow control thresholds configuration */
+	if (plat->port_num == RM_PF0_ID) {
+		rxqueue0_size = mac0_rxq0_size;
+		rxqueue1_size = mac0_rxq1_size;
+
+		queue0_rfd = mac0_rxq0_rfd;
+		queue0_rfa = mac0_rxq0_rfa;
+
+		queue1_rfd = mac0_rxq1_rfd;
+		queue1_rfa = mac0_rxq1_rfa;
+
+		txqueue0_size = mac0_txq0_size;
+		txqueue1_size = mac0_txq1_size;
+	}
+
+	if (plat->port_num == RM_PF1_ID) {
+		rxqueue0_size = mac1_rxq0_size;
+		rxqueue1_size = mac1_rxq1_size;
+
+		queue0_rfd = mac1_rxq0_rfd;
+		queue0_rfa = mac1_rxq0_rfa;
+
+		queue1_rfd = mac1_rxq1_rfd;
+		queue1_rfa = mac1_rxq1_rfa;
+
+		txqueue0_size = mac1_txq0_size;
+		txqueue1_size = mac1_txq1_size;
+	}
+
+	/* Validation of Queue size and Flow control thresholds and configuring local parameters to update registers*/
+	if ((rxqueue0_size + rxqueue1_size) <= MAX_RX_QUEUE_SIZE) {
+		plat->rx_queues_cfg[0].size = rxqueue0_size;
+		plat->rx_queues_cfg[1].size = rxqueue1_size;
+	} else {
+		plat->rx_queues_cfg[0].size = RX_QUEUE0_SIZE; /* Default configuration when invalid input given */
+		plat->rx_queues_cfg[1].size = RX_QUEUE1_SIZE;
+		NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid Rx Queue sizes passed rxq0_size=%d, rxq1_size=%d,Restoring default to rxq0_size=%d, rxq1_size=%d of port=%d Bus number=%x\n",
+			__func__, rxqueue0_size, rxqueue1_size, RX_QUEUE0_SIZE, RX_QUEUE1_SIZE, plat->port_num, pdev->bus->number);
+
+	}
+
+	if ((((queue0_rfd * SIZE_512B) + SIZE_1KB) < plat->rx_queues_cfg[0].size) &&
+		(((queue0_rfa * SIZE_512B) + SIZE_1KB) < plat->rx_queues_cfg[0].size)) {
+		plat->rx_queues_cfg[0].rfd = queue0_rfd;
+		plat->rx_queues_cfg[0].rfa = queue0_rfa;
+	} else {
+		temp_var = ((plat->rx_queues_cfg[0].size - (((plat->rx_queues_cfg[0].size)*8)/10))/SIZE_512B); /* configuration to 20% of FIFO Size */
+		if (temp_var >= 2) {
+			temp_var = (temp_var - 2);
+		} else {
+			temp_var = 0;
+		}
+		plat->rx_queues_cfg[0].rfd = temp_var;
+		plat->rx_queues_cfg[0].rfa = temp_var;
+		NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid Flow control threshold for Rx Queue-0 passed rxq0_rfd=%d, rxq0_rfa=%d,configuring to 20%% of Queue size, rxq0_rfd=%d, rxq0_rfa=%d of port=%d Bus number=%x\n",
+			__func__, queue0_rfd, queue0_rfa, plat->rx_queues_cfg[0].rfd, plat->rx_queues_cfg[0].rfa, plat->port_num, pdev->bus->number);
+	}
+
+	if ((((queue1_rfd * SIZE_512B) + SIZE_1KB) < plat->rx_queues_cfg[1].size) &&
+		(((queue1_rfa * SIZE_512B) + SIZE_1KB) < plat->rx_queues_cfg[1].size)) {
+		plat->rx_queues_cfg[1].rfd = queue1_rfd;
+		plat->rx_queues_cfg[1].rfa = queue1_rfa;
+	} else {
+		temp_var = ((plat->rx_queues_cfg[1].size - (((plat->rx_queues_cfg[1].size)*8)/10))/SIZE_512B); /* configuration to 20% of FIFO Size */
+		if (temp_var >= 2) {
+			temp_var = (temp_var - 2);
+		} else {
+			temp_var = 0;
+		}
+		plat->rx_queues_cfg[1].rfd = temp_var;
+		plat->rx_queues_cfg[1].rfa = temp_var;
+		NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid Flow control threshold for Rx Queue-1 passed rxq1_rfd=%d, rxq1_rfa=%d,configuring to 20%% of Queue size, rxq1_rfd=%d, rxq1_rfa=%d of port=%d Bus number=%x\n",
+			__func__, queue1_rfd, queue1_rfa, plat->rx_queues_cfg[1].rfd, plat->rx_queues_cfg[1].rfa, plat->port_num, pdev->bus->number);
+	}
+
+	if ((txqueue0_size + txqueue1_size) <= MAX_TX_QUEUE_SIZE) {
+		plat->tx_queues_cfg[0].size = txqueue0_size;
+		plat->tx_queues_cfg[1].size = txqueue1_size;
+	} else {
+		plat->tx_queues_cfg[0].size = TX_QUEUE0_SIZE; /* Default configuration when invalid input given */
+		plat->tx_queues_cfg[1].size = TX_QUEUE1_SIZE;
+		NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid Rx Queue sizes passed txq0_size=%d, txq1_size=%d, Restoring default to txq0_size=%d, txq1_size=%d of port=%d Bus number=%x\n",
+			__func__, rxqueue0_size, rxqueue1_size, TX_QUEUE0_SIZE, TX_QUEUE1_SIZE, plat->port_num, pdev->bus->number);
+	}
+#endif
+	return 0;
+}
+
+static const struct tc956xmac_pci_info tc956xmac_xgmac3_pci_info = {
+	.setup = tc956xmac_xgmac3_default_data,
+};
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static void xgmac_2_5g_default_data(struct plat_tc956xmacenet_data *plat)
+{
+	plat->clk_csr = 2;
+	plat->has_xgmac = 1;
+	plat->force_sf_dma_mode = 1;
+	plat->tso_en = 1;
+	plat->sph_en = 1;
+	plat->rss_en = 1;
+
+	plat->cphy_read = xgmac3_phy_read;
+	plat->cphy_write = xgmac3_phy_write;
+	plat->mdio_bus_data->phy_mask = 0;
+
+	plat->clk_ptp_rate = 62500000;
+	plat->clk_ref_rate = 62500000;
+
+	/* Set default value for multicast hash bins */
+	plat->multicast_filter_bins = 128;
+
+	/* Set default value for unicast filter entries */
+	plat->unicast_filter_entries = 32;
+
+	/* Set the maxmtu to a default of JUMBO_LEN */
+	plat->maxmtu = XGMAC_JUMBO_LEN;
+
+	/* Set default number of RX and TX queues to use */
+	plat->tx_queues_to_use = 4;
+	plat->rx_queues_to_use = 8;
+
+	plat->tx_sched_algorithm = MTL_TX_ALGORITHM_WRR;
+	plat->tx_queues_cfg[0].use_prio = false;
+	plat->tx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+	plat->tx_queues_cfg[0].weight = 12;
+	plat->tx_queues_cfg[1].use_prio = false;
+	plat->tx_queues_cfg[1].mode_to_use = MTL_QUEUE_DCB;
+	plat->tx_queues_cfg[1].weight = 12;
+	plat->tx_queues_cfg[2].use_prio = false;
+	plat->tx_queues_cfg[2].mode_to_use = MTL_QUEUE_DCB;
+	plat->tx_queues_cfg[2].weight = 12;
+	plat->tx_queues_cfg[3].use_prio = false;
+	plat->tx_queues_cfg[3].mode_to_use = MTL_QUEUE_DCB;
+	plat->tx_queues_cfg[3].weight = 12;
+	plat->tx_queues_cfg[4].use_prio = false;
+	plat->tx_queues_cfg[4].mode_to_use = MTL_QUEUE_DCB;
+	plat->tx_queues_cfg[4].weight = 12;
+	plat->tx_queues_cfg[5].use_prio = false;
+	plat->tx_queues_cfg[5].mode_to_use = MTL_QUEUE_DCB;
+	plat->tx_queues_cfg[5].weight = 12;
+	plat->tx_queues_cfg[6].use_prio = false;
+	plat->tx_queues_cfg[6].mode_to_use = MTL_QUEUE_DCB;
+	plat->tx_queues_cfg[6].weight = 12;
+	plat->tx_queues_cfg[7].use_prio = false;
+	plat->tx_queues_cfg[7].mode_to_use = MTL_QUEUE_DCB;
+	plat->tx_queues_cfg[7].weight = 12;
+	plat->rx_queues_cfg[0].use_prio = false;
+	plat->rx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+	plat->rx_queues_cfg[0].chan = 0;
+	plat->rx_queues_cfg[1].use_prio = false;
+	plat->rx_queues_cfg[1].mode_to_use = MTL_QUEUE_DCB;
+	plat->rx_queues_cfg[1].chan = 1;
+	plat->rx_queues_cfg[2].use_prio = false;
+	plat->rx_queues_cfg[2].mode_to_use = MTL_QUEUE_DCB;
+	plat->rx_queues_cfg[2].chan = 2;
+	plat->rx_queues_cfg[3].use_prio = false;
+	plat->rx_queues_cfg[3].mode_to_use = MTL_QUEUE_DCB;
+	plat->rx_queues_cfg[3].chan = 3;
+	plat->rx_queues_cfg[4].use_prio = false;
+	plat->rx_queues_cfg[4].mode_to_use = MTL_QUEUE_DCB;
+	plat->rx_queues_cfg[4].chan = 4;
+	plat->rx_queues_cfg[5].use_prio = false;
+	plat->rx_queues_cfg[5].mode_to_use = MTL_QUEUE_DCB;
+	plat->rx_queues_cfg[5].chan = 5;
+	plat->rx_queues_cfg[6].use_prio = false;
+	plat->rx_queues_cfg[6].mode_to_use = MTL_QUEUE_DCB;
+	plat->rx_queues_cfg[6].chan = 6;
+	plat->rx_queues_cfg[7].use_prio = false;
+	plat->rx_queues_cfg[7].mode_to_use = MTL_QUEUE_DCB;
+	plat->rx_queues_cfg[7].chan = 7;
+}
+
+static int tc956xmac_xgmac3_2_5g_default_data(struct pci_dev *pdev,
+					struct plat_tc956xmacenet_data *plat)
+{
+	int i;
+
+	/* Set common default data first */
+	xgmac_2_5g_default_data(plat);
+
+	plat->bus_id = 1;
+	plat->phy_addr = 0;
+	plat->interface = PHY_INTERFACE_MODE_USXGMII;
+	plat->max_speed = 2500;
+
+	plat->dma_cfg->pbl = 32;
+	plat->dma_cfg->pblx8 = true;
+
+	/* Axi Configuration */
+	plat->axi = devm_kzalloc(&pdev->dev, sizeof(*plat->axi), GFP_KERNEL);
+	if (!plat->axi)
+		return -ENOMEM;
+
+	plat->axi->axi_wr_osr_lmt = 31;
+	plat->axi->axi_rd_osr_lmt = 31;
+
+	plat->axi->axi_fb = false;
+	plat->axi->axi_blen[0] = 4;
+	plat->axi->axi_blen[1] = 8;
+	plat->axi->axi_blen[2] = 16;
+	plat->axi->axi_blen[3] = 32;
+
+	/* EST Configuration */
+	plat->est = devm_kzalloc(&pdev->dev, sizeof(*plat->est), GFP_KERNEL);
+	if (!plat->est)
+		return -ENOMEM;
+
+	plat->est->enable = 0;
+	plat->est->btr_offset[0] = 0;
+	plat->est->btr_offset[1] = 0;
+	plat->est->ctr[0] = 100000 * plat->tx_queues_to_use;
+	plat->est->ctr[1] = 0;
+	plat->est->ter = 0;
+	plat->est->gcl_size = plat->tx_queues_to_use;
+
+	for (i = 0; i < plat->tx_queues_to_use; i++) {
+#ifndef TC956X
+		u32 value = BIT(24 + i) + 100000;
+
+		plat->est->gcl_unaligned[i] = value;
+#endif
+	}
+
+	tc956xmac_config_data(plat);
+	return 0;
+}
+
+static const struct tc956xmac_pci_info tc956xmac_xgmac3_2_5g_pci_info = {
+	.setup = tc956xmac_xgmac3_2_5g_default_data,
+};
+
+static int tc956xmac_xgmac3_2_5g_mdio_default_data(struct pci_dev *pdev,
+						struct plat_tc956xmacenet_data *plat)
+{
+	int ret;
+
+	ret = tc956xmac_xgmac3_2_5g_default_data(pdev, plat);
+	if (ret)
+		return ret;
+
+	plat->mdio_bus_data->phy_mask = ~0x0;
+	plat->bus_id = 1;
+	plat->phy_addr = 0;
+
+	plat->cphy_read = NULL;
+	plat->cphy_write = NULL;
+	return 0;
+}
+
+static const struct tc956xmac_pci_info tc956xmac_xgmac3_2_5g_mdio_pci_info = {
+	.setup = tc956xmac_xgmac3_2_5g_mdio_default_data,
+};
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+#ifndef TC956X_SRIOV_VF
+/*!
+ * \brief API to Reset SRAM Region.
+ *
+ * \details This function Resets both IMEM & DMEM sections of tc956x.
+ *
+ * \param[in] dev  - pointer to device structure.
+ * \param[in] res  - pointer to tc956xmac_resources structure.
+ *
+ * \return none
+ */
+static void tc956x_reset_SRAM(struct device *dev, struct tc956xmac_resources *res)
+{
+	NMSGPR_INFO(dev,  "Resetting SRAM Region start\n");
+	/* Resetting SRAM IMEM Region */
+	memset_io(res->tc956x_SRAM_pci_base_addr, 0x0, 0x10000);
+	/* Resetting SRAM DMEM Region */
+	memset_io((res->tc956x_SRAM_pci_base_addr + 0x40000), 0x0, 0x10000);
+	NMSGPR_INFO(dev,  "Resetting SRAM Region end\n");
+}
+
+/*!
+ * \brief API to load firmware for CM3.
+ *
+ * \details This fucntion loads the firmware onto the SRAM of tc956x.
+ * The tc956x CM3 starts executing once the firmware loading is complete.
+ *
+ * \param[in] dev  - pointer to device structure.
+ * \param[in] id   - pointer to tc956xmac_resources structure.
+ *
+ * \return integer
+ *
+ * \retval 0 on success & -ve number on failure.
+ */
+
+s32 tc956x_load_firmware(struct device *dev, struct tc956xmac_resources *res)
+{
+	u32 adrs = 0, val = 0;
+	u32 fw_init_sync;
+#ifdef TC956X_LOAD_FW_HEADER
+	u32 fw_size = sizeof(fw_data);
+
+	NMSGPR_INFO(dev,  "FW Loading: .h\n");
+	/* Validate the size of the firmware */
+	if (fw_size > TC956X_FW_MAX_SIZE) {
+		NMSGPR_ERR(dev, "Error : FW size exceeds the memory size\n");
+		return -EINVAL;
+	}
+
+	NMSGPR_INFO(dev,  "FW Loading Start...\n");
+	NMSGPR_INFO(dev,  "FW Size = %d\n", fw_size);
+
+#ifdef TC956X
+	/* Assert M3 reset */
+	adrs = NRSTCTRL0_OFFSET;
+#else
+	adrs = NRSTCTRL_OFFSET;
+#endif
+	val = ioread32((void __iomem *)(res->addr + adrs));
+	NMSGPR_INFO(dev,  "Reset Register value = %lx\n", (unsigned long)val);
+
+	val |= NRSTCTRL0_RST_ASRT;
+	iowrite32(val, (void __iomem *)(res->addr + adrs));
+
+#ifdef TC956X
+	iowrite32(0, (void __iomem *)(res->tc956x_SRAM_pci_base_addr +
+			TC956X_M3_INIT_DONE));
+	iowrite32(0, (void __iomem *)(res->tc956x_SRAM_pci_base_addr +
+			TC956X_M3_FW_EXIT));
+	tc956x_reset_SRAM(dev, res);
+	mdelay(10);
+	iowrite8(EEPROM_OFFSET, (void __iomem *)(res->tc956x_SRAM_pci_base_addr +
+			TC956X_M3_SRAM_EEPROM_OFFSET_ADDR));
+	iowrite8(EEPROM_MAC_COUNT, (void __iomem *)(res->tc956x_SRAM_pci_base_addr +
+			TC956X_M3_SRAM_EEPROM_MAC_COUNT));
+#endif
+	/* Copy TC956X FW to SRAM */
+	adrs = TC956X_ZERO;/* SRAM Start Address */
+	do {
+		val =  fw_data[adrs + TC956X_ZERO] << TC956X_ZERO;
+		val |= fw_data[adrs + TC956X_ONE] << TC956X_EIGHT;
+		val |= fw_data[adrs + TC956X_TWO] << TC956X_SIXTEEN;
+		val |= fw_data[adrs + TC956X_THREE] << TC956X_TWENTY_FOUR;
+
+#ifdef TC956X
+		iowrite32(val, (void __iomem *)(res->tc956x_SRAM_pci_base_addr +
+			adrs));
+#endif
+
+		adrs += TC956X_FOUR;
+	} while (adrs < fw_size);
+
+#else
+	const struct firmware *pfw = NULL;
+
+	NMSGPR_INFO(dev,  "FW Loading: .bin\n");
+
+	/* Get TC956X FW binary through kernel firmware interface request */
+	if (request_firmware(&pfw, FIRMWARE_NAME, dev) != 0) {
+		NMSGPR_ERR(dev,
+		"TC956X: Error in calling request_firmware");
+		return -EINVAL;
+	}
+
+	if (pfw == NULL) {
+		NMSGPR_ERR(dev, "TC956X: request_firmware: pfw == NULL");
+		return -EINVAL;
+	}
+
+	/* Validate the size of the firmware */
+	if (pfw->size > TC956X_FW_MAX_SIZE) {
+		NMSGPR_ERR(dev, "Error : FW size exceeds the memory size\n");
+		return -EINVAL;
+	}
+
+	NMSGPR_INFO(dev,  "FW Loading Start...\n");
+	NMSGPR_INFO(dev,  "FW Size = %ld\n", (long)(pfw->size));
+
+	/* Assert M3 reset */
+#ifdef TC956X
+	adrs = NRSTCTRL0_OFFSET;
+#else
+	adrs = NRSTCTRL_OFFSET;
+#endif
+	val = ioread32((void __iomem *)(res->addr + adrs));
+	NMSGPR_INFO(dev,  "Reset Register value = %lx\n", (unsigned long)val);
+
+	val |= NRSTCTRL0_RST_ASRT;
+	iowrite32(val, (void __iomem *)(res->addr + adrs));
+
+#ifdef TC956X
+	iowrite32(0, (void __iomem *)(res->tc956x_SRAM_pci_base_addr +
+			TC956X_M3_INIT_DONE));
+#endif
+
+#ifdef TC956X
+	tc956x_reset_SRAM(dev, res);
+
+	mdelay(10);
+	iowrite8(EEPROM_OFFSET, (void __iomem *)(res->tc956x_SRAM_pci_base_addr +
+			TC956X_M3_SRAM_EEPROM_OFFSET_ADDR));
+	iowrite8(EEPROM_MAC_COUNT, (void __iomem *)(res->tc956x_SRAM_pci_base_addr +
+			TC956X_M3_SRAM_EEPROM_MAC_COUNT));
+
+	/* Copy TC956X FW to SRAM */
+	memcpy_toio(res->tc956x_SRAM_pci_base_addr, pfw->data, pfw->size);
+#endif
+	/* Release kernel firmware interface */
+	release_firmware(pfw);
+#endif
+
+	NMSGPR_INFO(dev,  "FW Loading Finish.\n");
+
+	/* De-assert M3 reset */
+#ifdef TC956X
+	adrs = NRSTCTRL0_OFFSET;
+#else
+	adrs = NRSTCTRL_OFFSET;
+#endif
+	val = ioread32((void __iomem *)(res->addr + adrs));
+	val &= ~NRSTCTRL0_RST_DE_ASRT;
+	iowrite32(val, (void __iomem *)(res->addr + adrs));
+
+#ifdef TC956X
+	readl_poll_timeout_atomic(res->tc956x_SRAM_pci_base_addr + TC956X_M3_INIT_DONE,
+				fw_init_sync, fw_init_sync, 100, 100000);
+#endif
+	if (!fw_init_sync)
+		NMSGPR_ALERT(dev, "TC956x FW yet to start!!!");
+	else
+		NMSGPR_INFO(dev,  "TC956x M3 started.\n");
+
+	return 0;
+}
+#endif /*TC956X_SRIOV_VF*/
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+/*
+ * brief API to populate the table address map registers.
+ *
+ * details This function pouplates the registers that are used to convert the
+ * AXI bus access to PCI TLP.
+ *
+ * param[in] dev  - pointer to device structure.
+ * param[in] id   - pointer to base address of registers.
+ * param[in] id	  - pointer to structure containing the TAMAP parameters
+ */
+void tc956x_config_CM3_tamap(struct device *dev,
+				void __iomem *reg_pci_base_addr,
+				struct tc956xmac_cm3_tamap *tamap,
+				u8 table_entry)
+{
+#ifdef TC956X
+	DBGPR_FUNC(dev, "-->%s\n", __func__);
+
+	writel(TC956X_AXI4_SLV01_TRSL_PARAM_VAL, reg_pci_base_addr +
+					TC956X_AXI4_SLV_TRSL_PARAM(0, table_entry));
+	writel(tamap->trsl_addr_hi, reg_pci_base_addr +
+					TC956X_AXI4_SLV_TRSL_ADDR_HI(0, table_entry));
+	writel(tamap->trsl_addr_low, reg_pci_base_addr +
+					TC956X_AXI4_SLV_TRSL_ADDR_LO(0, table_entry));
+	writel(tamap->src_addr_hi, reg_pci_base_addr +
+					TC956X_AXI4_SLV_SRC_ADDR_HI(0, table_entry));
+	writel((tamap->src_addr_low & TC956X_SRC_LO_MASK) |
+				(tamap->atr_size << 1) | TC956X_ATR_IMPL,
+				reg_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry));
+
+	KPRINT_INFO("SL0%d TRSL_MASK = 0x%08x\n", table_entry,
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_MASK1(0, table_entry)));
+	KPRINT_INFO("SL0%d TRSL_MASK = 0x%08x\n", table_entry,
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_MASK2(0, table_entry)));
+	KPRINT_INFO("SL0%d TRSL_PARAM = 0x%08x\n", table_entry,
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_PARAM(0, table_entry)));
+	KPRINT_INFO("SL0%d TRSL_ADDR HI = 0x%08x\n", table_entry,
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_ADDR_HI(0, table_entry)));
+	KPRINT_INFO("SL0%d TRSL_ADDR LO = 0x%08x\n", table_entry,
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_ADDR_LO(0, table_entry)));
+	KPRINT_INFO("SL0%d SRC_ADDR HI = 0x%08x\n", table_entry,
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_HI(0, table_entry)));
+	KPRINT_INFO("SL0%d SRC_ADDR LO = 0x%08x\n", table_entry,
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry)));
+
+#endif
+	DBGPR_FUNC(dev, "<--%s\n", __func__);
+}
+#endif
+
+#ifndef TC956X_SRIOV_VF
+/*
+ * brief API to populate the table address map registers.
+ *
+ * details This function pouplates the registers that are used to convert the
+ * AXI bus access to PCI TLP.
+ *
+ * param[in] dev  - pointer to device structure.
+ * param[in] id   - pointer to base address of registers.
+ */
+static void tc956x_config_tamap(struct device *dev,
+				void __iomem *reg_pci_base_addr)
+{
+#ifdef TC956X
+	u32 table_entry;
+
+	DBGPR_FUNC(dev, "-->%s\n", __func__);
+
+	/* Set all entries to default */
+	for (table_entry = 0; table_entry <= MAX_CM3_TAMAP_ENTRIES; table_entry++) {
+
+		writel(TC956X_AXI4_SLV00_TRSL_PARAM_VAL, reg_pci_base_addr +
+					TC956X_AXI4_SLV_TRSL_PARAM(0, table_entry));
+		writel(0x0, reg_pci_base_addr +
+					TC956X_AXI4_SLV_TRSL_ADDR_HI(0, table_entry));
+		writel(0x0, reg_pci_base_addr +
+					TC956X_AXI4_SLV_TRSL_ADDR_LO(0, table_entry));
+		writel(0x0, reg_pci_base_addr +
+					TC956X_AXI4_SLV_SRC_ADDR_HI(0, table_entry));
+		writel(TC956X_AXI4_SLV00_SRC_ADDR_LO_VAL_DEFAULT, reg_pci_base_addr +
+					TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry));
+
+	}
+
+
+
+	/* AXI4 Slave 0 - Table 0 Entry */
+	/* EDMA address region 0x10 0000 0000 - 0x1F FFFF FFFF is
+	 * translated to 0x0 0000 0000 - 0xF FFFF FFFF
+	 */
+	writel(TC956X_AXI4_SLV00_TRSL_PARAM_VAL, reg_pci_base_addr +
+					TC956X_AXI4_SLV_TRSL_PARAM(0, 0));
+	writel(TC956X_AXI4_SLV00_TRSL_ADDR_HI_VAL, reg_pci_base_addr +
+					TC956X_AXI4_SLV_TRSL_ADDR_HI(0, 0));
+	writel(TC956X_AXI4_SLV00_TRSL_ADDR_LO_VAL, reg_pci_base_addr +
+					TC956X_AXI4_SLV_TRSL_ADDR_LO(0, 0));
+	writel(TC956X_AXI4_SLV00_SRC_ADDR_HI_VAL, reg_pci_base_addr +
+					TC956X_AXI4_SLV_SRC_ADDR_HI(0, 0));
+	writel(TC956X_AXI4_SLV00_SRC_ADDR_LO_VAL |
+				TC956X_ATR_SIZE(TC956X_AXI4_SLV00_ATR_SIZE) |
+				TC956X_ATR_IMPL, reg_pci_base_addr +
+				TC956X_AXI4_SLV_SRC_ADDR_LO(0, 0));
+
+	KPRINT_INFO("SL00 TRSL_MASK = 0x%08x\n",
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_MASK1(0, 0)));
+	KPRINT_INFO("SL00 TRSL_MASK = 0x%08x\n",
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_MASK2(0, 0)));
+	KPRINT_INFO("SL00 TRSL_PARAM = 0x%08x\n",
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_PARAM(0, 0)));
+	KPRINT_INFO("SL00 TRSL_ADDR HI = 0x%08x\n",
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_ADDR_HI(0, 0)));
+	KPRINT_INFO("SL00 TRSL_ADDR LO = 0x%08x\n",
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_TRSL_ADDR_LO(0, 0)));
+	KPRINT_INFO("SL00 SRC_ADDR HI = 0x%08x\n",
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_HI(0, 0)));
+	KPRINT_INFO("SL00 SRC_ADDR LO = 0x%08x\n",
+		readl(reg_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_LO(0, 0)));
+
+#endif
+	DBGPR_FUNC(dev, "<--%s\n", __func__);
+}
+#endif
+
+#ifdef TC956X_SRIOV_VF
+static int tc956x_vf_get_fn_id(void __iomem *reg_pci_bridge_config_addr,
+				       struct fn_id *fn_id_info)
+{
+	void __iomem *ioaddr = reg_pci_bridge_config_addr;
+	u32 rsc_mng_id = readl(ioaddr + RSCMNG_ID_REG);
+
+	fn_id_info->fn_type = (rsc_mng_id & RSC_MNG_FN_TYPE) >> 16;
+	fn_id_info->pf_no = (rsc_mng_id & RSC_MNG_PF_FN_NUM);
+	fn_id_info->vf_no = ((rsc_mng_id & RSC_MNG_VF_FN_NUM) >> 8);
+
+	/** Below error check for VF driver.
+	 * In case of VF driver, function type to be 1
+	 */
+	if (fn_id_info->fn_type == 0)
+		return -1;
+
+	/* VF1,2,3 are supported */
+	if (fn_id_info->vf_no > 3)
+		return -1;
+
+	/* PF 0 and 1 are supported */
+	if (fn_id_info->pf_no > 1)
+		return -1;
+
+	return 0;
+}
+
+static int get_vf_id(struct plat_tc956xmacenet_data *plat_dat,
+		     struct tc956xmac_resources *res)
+{
+	struct fn_id fn_id_info;
+
+	tc956x_vf_get_fn_id(res->tc956x_BRIDGE_CFG_pci_base_addr, &fn_id_info);
+
+	plat_dat->vf_id = fn_id_info.vf_no - 1;
+	return 0;
+
+}
+#endif
+
+#ifdef TC956X
+
+#ifdef TC956X_PCIE_DISABLE_DSP1
+/*
+ * brief API to disable dsp1 port
+ *
+ * details This function sets the registers to disable DSP1 port
+ *
+ * param[in] dev  - pointer to device structure.
+ * param[in] id   - pointer to base address of registers.
+ */
+static void tc956x_pcie_disable_dsp1_port(struct device *dev,
+				void __iomem *reg_sfr_base_addr)
+{
+	u32 reg_data;
+	u32 pcie_mode;
+
+	DBGPR_FUNC(dev, "-->%s\n", __func__);
+
+	/* Read mode setting register
+	 * Mode settings values 0:Setting A: x4x1x1, 1:Setting B: x2x2x1
+	 */
+	reg_data = readl(reg_sfr_base_addr + NMODESTS_OFFSET);
+	pcie_mode = (reg_data & NMODESTS_MODE2) >> NMODESTS_MODE2_SHIFT;
+
+	KPRINT_INFO("Pcie mode: %d\n\r", pcie_mode);
+
+	switch (pcie_mode) {
+	case TC956X_PCIE_SETTING_A: /* 0:Setting A: x4x1x1 mode */
+		/* DSP1 test_in[11] Force receiver detection on all lanes */
+		writel(0x00000800, reg_sfr_base_addr + TC956X_GLUE_SW_DSP1_TEST_IN_31_00);
+		/*DSP1 is selected*/
+		writel(SW_DSP1_ENABLE, reg_sfr_base_addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+		/*Set 0xFFFF to vendor_id*/
+		writel(0xFFFF, reg_sfr_base_addr + TC956X_SSREG_K_PCICONF_015_000);
+		/*Set 0xFFFF to device_id*/
+		writel(0xFFFF, reg_sfr_base_addr + TC956X_SSREG_K_PCICONF_031_016);
+		/*PHY_CORE2 is selected*/
+		writel(PHY_CORE_2_ENABLE, reg_sfr_base_addr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+		/*PMACNT_GL_PM_PWRST2_CFG0 setting*/
+		writel(0x00000035, reg_sfr_base_addr + TC956X_PHY_COREX_PMACNT_GL_PM_PWRST2_CFG0);
+		/*PMACNT_GL_PM_PWRST2_CFG1*/
+		writel(0x114F4804, reg_sfr_base_addr + TC956X_PHY_COREX_PMACNT_GL_PM_PWRST2_CFG1);
+		/*Set 1 to pm_rxlos_rxei_override_en and Set 0 to pm_rxlos_rxei_override*/
+		writel(0x00000010, reg_sfr_base_addr + TC956X_PHY_COREX_PMACNT_LN_PM_LOSCNT_CNT0);
+		/*Set 1 to sw_dsp1_global_reset*/
+		writel(0x00000010, reg_sfr_base_addr + TC956X_GLUE_SW_RESET_CTRL);
+		/*Set 0 to sw_dsp1_global_reset*/
+		writel(0x00000000, reg_sfr_base_addr + TC956X_GLUE_SW_RESET_CTRL);
+	break;
+	case TC956X_PCIE_SETTING_B: /* 1:Setting B: x2x2x1 mode */
+		/* DSP1 test_in[11] Force receiver detection on all lanes */
+		writel(0x00000800, reg_sfr_base_addr + TC956X_GLUE_SW_DSP1_TEST_IN_31_00);
+		/*DSP1 is selected*/
+		writel(SW_DSP1_ENABLE, reg_sfr_base_addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+		/*Set 0xFFFF to vendor_id*/
+		writel(0xFFFF, reg_sfr_base_addr + TC956X_SSREG_K_PCICONF_015_000);
+		/*Set 0xFFFF to device_id*/
+		writel(0xFFFF, reg_sfr_base_addr + TC956X_SSREG_K_PCICONF_031_016);
+		/*PHY_CORE1 is selected*/
+		writel(PHY_CORE_1_ENABLE, reg_sfr_base_addr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+		/*lane_access_enable*/
+		writel(((LANE_1_ENABLE | LANE_0_ENABLE) & LANE_ENABLE_MASK),
+					reg_sfr_base_addr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+		/*PMACNT_GL_PM_PWRST2_CFG0 setting*/
+		writel(0x00000035, reg_sfr_base_addr + TC956X_PHY_COREX_PMACNT_GL_PM_PWRST2_CFG0);
+		/*PMACNT_GL_PM_PWRST2_CFG1*/
+		writel(0x114F4804, reg_sfr_base_addr + TC956X_PHY_COREX_PMACNT_GL_PM_PWRST2_CFG1);
+		/*Set 1 to pm_rxlos_rxei_override_en and Set 0 to pm_rxlos_rxei_override*/
+		writel(0x00000010, reg_sfr_base_addr + TC956X_PHY_COREX_PMACNT_LN_PM_LOSCNT_CNT0);
+		/*Set 1 to sw_dsp1_global_reset*/
+		writel(0x00000010, reg_sfr_base_addr + TC956X_GLUE_SW_RESET_CTRL);
+		/*Set 0 to sw_dsp1_global_reset*/
+		writel(0x00000000, reg_sfr_base_addr + TC956X_GLUE_SW_RESET_CTRL);
+	break;
+
+	}
+	DBGPR_FUNC(dev, "<--%s\n", __func__);
+}
+#endif /*#ifdef TC956X_PCIE_DISABLE_DSP1*/
+
+#ifdef TC956X_PCIE_DISABLE_DSP2
+/*
+ * brief API to disable dsp2 port
+ *
+ * details This function sets the registers to disable DSP2 port
+ *
+ * param[in] dev  - pointer to device structure.
+ * param[in] id   - pointer to base address of registers.
+ */
+static void tc956x_pcie_disable_dsp2_port(struct device *dev,
+				void __iomem *reg_sfr_base_addr)
+{
+	u32 reg_data;
+	u32 pcie_mode;
+
+	DBGPR_FUNC(dev, "-->%s\n", __func__);
+
+	/* Read mode setting register
+	 * Mode settings values 0:Setting A: x4x1x1, 1:Setting B: x2x2x1
+	 */
+	reg_data = readl(reg_sfr_base_addr + NMODESTS_OFFSET);
+	pcie_mode = (reg_data & NMODESTS_MODE2) >> NMODESTS_MODE2_SHIFT;
+
+	KPRINT_INFO("Pcie mode: %d\n\r", pcie_mode);
+
+	/*Same settings for both the PCIe modes*/
+	/* DSP2 test_in[11] Force receiver detection on all lanes */
+	writel(0x00000800, reg_sfr_base_addr + TC956X_GLUE_SW_DSP2_TEST_IN_31_00);
+	/*DSP2 is selected*/
+	writel(SW_DSP2_ENABLE, reg_sfr_base_addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+	/*Set 0xFFFF to vendor_id*/
+	writel(0xFFFF, reg_sfr_base_addr + TC956X_SSREG_K_PCICONF_015_000);
+	/*Set 0xFFFF to device_id*/
+	writel(0xFFFF, reg_sfr_base_addr + TC956X_SSREG_K_PCICONF_031_016);
+	/*PHY_CORE3 is selected*/
+	writel(PHY_CORE_3_ENABLE, reg_sfr_base_addr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	/*PMACNT_GL_PM_PWRST2_CFG0 setting*/
+	writel(0x00000035, reg_sfr_base_addr + TC956X_PHY_COREX_PMACNT_GL_PM_PWRST2_CFG0);
+	/*PMACNT_GL_PM_PWRST2_CFG1*/
+	writel(0x114F4804, reg_sfr_base_addr + TC956X_PHY_COREX_PMACNT_GL_PM_PWRST2_CFG1);
+	/*Set 1 to pm_rxlos_rxei_override_en and Set 0 to pm_rxlos_rxei_override*/
+	writel(0x00000010, reg_sfr_base_addr + TC956X_PHY_COREX_PMACNT_LN_PM_LOSCNT_CNT0);
+	/*Set 1 to sw_dsp2_global_reset*/
+	writel(0x00000100, reg_sfr_base_addr + TC956X_GLUE_SW_RESET_CTRL);
+	/*Set 0 to sw_dsp2_global_reset*/
+	writel(0x00000000, reg_sfr_base_addr + TC956X_GLUE_SW_RESET_CTRL);
+
+	DBGPR_FUNC(dev, "<--%s\n", __func__);
+}
+#endif /*#ifdef TC956X_PCIE_DISABLE_DSP2*/
+
+//#ifdef TC956X_PCIE_GEN3_SETTING
+static int tc956x_replace_aspm(struct pci_dev *pdev, u16 replace_value, u16 *org_value)
+{
+	int err;
+	u16 lnkctl;
+
+	err = pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &lnkctl);
+	if (err)
+		return err;
+
+	if (org_value)
+		*org_value = lnkctl & PCI_EXP_LNKCTL_ASPMC;
+
+	lnkctl = (lnkctl & ~PCI_EXP_LNKCTL_ASPMC) | (replace_value & PCI_EXP_LNKCTL_ASPMC);
+	err = pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, lnkctl);
+
+	return err;
+}
+
+static int tc956x_set_speed(struct pci_dev *pdev, u32 speed)
+{
+	int ret;
+	u16 lnksta, lnkctl, lnkctl_new, lnkctl2, lnkctl2_new;
+	u32 lnkcap;
+	u32 max_speed = 0, cur_speed = 0, org_speed = 0;
+
+	if (!pdev)
+		return -EINVAL;
+
+	ret = pcie_capability_read_dword(pdev, PCI_EXP_LNKCAP, &lnkcap);
+	if (ret == 0)
+		max_speed = (lnkcap & 0xf);
+
+	if (speed > max_speed)
+		speed = max_speed;
+
+	ret = pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnksta);
+	if (ret == 0)
+		org_speed = (lnksta & 0xf);
+
+	ret = pcie_capability_read_word(pdev, PCI_EXP_LNKCTL2, &lnkctl2);
+	if (ret == 0) {
+		lnkctl2_new = (lnkctl2 & ~PCI_EXP_LNKCTL2_TLS) | speed;
+		ret = pcie_capability_write_word(pdev, PCI_EXP_LNKCTL2, lnkctl2_new);
+	}
+
+	ret = pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &lnkctl);
+	if (ret == 0) {
+		lnkctl_new = (lnkctl | PCI_EXP_LNKCTL_RL);
+		ret = pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, lnkctl_new);
+	}
+
+	msleep(100);
+
+	ret = pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnksta);
+	if (ret == 0) {
+		cur_speed = (lnksta & 0xf);
+		pci_info(pdev, "Speed changed from Gen.%u to Gen.%u\n", org_speed, cur_speed);
+	}
+
+	return ret;
+}
+
+static int tc956x_get_speed(struct pci_dev *pdev, u32 *speed)
+{
+	int ret;
+	u16 lnksta;
+
+	if (speed == NULL)
+		return 0;
+
+	ret = pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnksta);
+	if (ret == 0)
+		*speed = (lnksta & 0xf);
+
+	return ret;
+}
+
+int tc956x_set_pci_speed(struct pci_dev *pdev, u32 speed)
+{
+	struct pci_dev *usp;
+	struct pci_dev *root;
+	struct pci_dev *dsp[3];
+	struct pci_dev **devs;
+	struct pci_dev *pd;
+	int i, j;
+	int dev_num;
+	u16 *aspm_org;
+	int ret = 0;
+	u32 cur_speed = 0;
+
+	dsp[2] = pci_upstream_bridge(pdev);
+	usp = pci_upstream_bridge(dsp[2]);
+	root = pci_upstream_bridge(usp);
+
+	ret = tc956x_get_speed(root, &cur_speed);
+	if ((ret == 0) && (cur_speed == speed))
+		return 0;
+
+	/* reset all dsp (down stream ports) information */
+	memset(dsp, 0, sizeof(dsp));
+
+	i = 0;
+	for_each_pci_bridge(pd, usp->subordinate)
+		dsp[i++] = pd;
+
+	dev_num = 0;
+	for (i = 0; ((i < 3) && (dsp[i] != NULL)); i++) {
+		struct pci_bus *bus = dsp[i]->subordinate;
+
+		if (bus)
+			list_for_each_entry(pd, &bus->devices, bus_list)
+				dev_num++;
+	}
+
+	devs = kcalloc(dev_num, sizeof(struct pci_dev *), GFP_KERNEL);
+	if (devs == NULL)
+		return -ENOSPC;
+
+	aspm_org = kcalloc(dev_num, sizeof(u16), GFP_KERNEL);
+	if (aspm_org == NULL) {
+		kfree(devs);
+		return -ENOSPC;
+	}
+
+	j = 0;
+	for (i = 0; ((i < 3) && (dsp[i] != NULL)); i++) {
+		struct pci_bus *bus = dsp[i]->subordinate;
+
+		if (bus)
+			list_for_each_entry(pd, &bus->devices, bus_list)
+				devs[j++] = pd;
+	}
+
+	/* Save ASPM and set zero */
+	for (i = 0; i < dev_num; i++)
+		tc956x_replace_aspm(devs[i], 0, &aspm_org[i]);
+
+	tc956x_set_speed(root, speed);
+	tc956x_set_speed(dsp[0], speed);
+	tc956x_set_speed(dsp[1], speed);
+	tc956x_set_speed(dsp[2], speed);
+	tc956x_set_speed(root, speed);
+
+	/* Restore ASPM */
+	for (i = 0; i < dev_num; i++)
+		tc956x_replace_aspm(devs[i], aspm_org[i], NULL);
+
+	kfree(aspm_org);
+	kfree(devs);
+
+	return ret;
+}
+//#endif /*#ifdef TC956X_PCIE_GEN3_SETTING*/
+#endif /*#ifdef TC956X*/
+
+
+/**
+ * tc956xmac_pci_probe
+ *
+ * @pdev: pci device pointer
+ * @id: pointer to table of device id/id's.
+ *
+ * Description: This probing function gets called for all PCI devices which
+ * match the ID table and are not "owned" by other driver yet. This function
+ * gets passed a "struct pci_dev *" for each device whose entry in the ID table
+ * matches the device. The probe functions returns zero when the driver choose
+ * to take "ownership" of the device or an error code(-ve no) otherwise.
+ */
+static int tc956xmac_pci_probe(struct pci_dev *pdev,
+			    const struct pci_device_id *id)
+{
+	struct tc956xmac_pci_info *info = (struct tc956xmac_pci_info *)id->driver_data;
+	struct plat_tc956xmacenet_data *plat;
+	struct tc956xmac_resources res;
+#if (defined(TC956X_PCIE_DSP_CUT_THROUGH) || defined(TC956X_PCIE_GEN3_SETTING)) && defined(TC956X_SRIOV_PF)
+	u32 val;
+#endif
+#if defined(TC956X_PCIE_LINK_STATE_LATENCY_CTRL) && defined(TC956X_SRIOV_PF)
+	u32 reg_val;
+#endif /* end of TC956X_PCIE_LINK_STATE_LATENCY_CTRL */
+#ifdef TC956X
+#ifndef TC956X_SRIOV_VF
+	/* use signal from EMSPHY */
+	uint8_t SgmSigPol = 0;
+#endif
+#endif
+	int ret;
+	int overlay;
+	char version_str[32];
+#if defined(TC956X_PCIE_DSP_CUT_THROUGH) && defined(TC956X_SRIOV_PF)
+	u32 pcie_mode; /* Read Setting A/B */
+#endif
+	uint16_t sh_mem_offset;
+
+	KPRINT_INFO("%s  >", __func__);
+#ifndef TC956X_SRIOV_VF
+	scnprintf(version_str, sizeof(version_str), "Host Driver Version %d%d-%d%d-%d%d",
+		tc956x_drv_version.rel_dbg,
+		tc956x_drv_version.major, tc956x_drv_version.minor,
+		tc956x_drv_version.sub_minor,
+		tc956x_drv_version.patch_rel_major, tc956x_drv_version.patch_rel_minor);
+#else
+	scnprintf(version_str, sizeof(version_str), "Virtual Function Driver Version %d%d-%d%d-%d%d",
+		tc956x_drv_version.rel_dbg,
+		tc956x_drv_version.major, tc956x_drv_version.minor,
+		tc956x_drv_version.sub_minor,
+		tc956x_drv_version.patch_rel_major, tc956x_drv_version.patch_rel_minor);
+#endif
+	NMSGPR_INFO(&pdev->dev, "%s\n", version_str);
+
+	plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL);
+	if (!plat)
+		return -ENOMEM;
+
+	plat->mdio_bus_data = devm_kzalloc(&pdev->dev,
+					   sizeof(*plat->mdio_bus_data),
+					   GFP_KERNEL);
+	if (!plat->mdio_bus_data)
+		return -ENOMEM;
+
+	plat->dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*plat->dma_cfg),
+				     GFP_KERNEL);
+	if (!plat->dma_cfg)
+		return -ENOMEM;
+
+	/* Enable pci device */
+	ret = pci_enable_device(pdev);
+	if (ret) {
+		dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n",
+			__func__);
+		goto err_out_enb_failed;
+	}
+
+	/* Request the PCI IO Memory for the device */
+	if (pci_request_regions(pdev, TC956X_RESOURCE_NAME)) {
+		NMSGPR_ERR(&(pdev->dev), "%s:Failed to get PCI regions\n",
+			TC956X_RESOURCE_NAME);
+		ret = -ENODEV;
+		DBGPR_FUNC(&(pdev->dev), "<--%s : ret: %d\n", __func__, ret);
+		goto err_out_req_reg_failed;
+	}
+	memset(&res, 0, sizeof(res));
+#if defined(TC956X_SRIOV_PF) && (defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE) || defined(TC956X_CPE_CONFIG))
+	if (tc956x_no_of_vf > 0) {
+		tc956x_no_of_vf = 0;
+		NMSGPR_INFO(&(pdev->dev),
+		"Enabling SRIOV not allowed in Automotive configuration\n");
+	}
+
+#endif
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_PCI_IOV
+
+
+	/* Enable SRIOV with the requested no of VFs */
+	if ((tc956x_no_of_vf != 0) && (pdev->is_physfn)) {
+
+		s32 pos = 0;
+
+		pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_SRIOV);
+		if (pos) {
+			NDBGPR_L1(&(pdev->dev), "SR-IOV capability found\n");
+
+			/* Validate and Enable the requested No. of VFs value */
+			if (tc956x_no_of_vf <= TC956X_TOTAL_VFS) {
+
+				ret = pci_enable_sriov(pdev, tc956x_no_of_vf);
+				if (ret) {
+
+					NMSGPR_ERR(&(pdev->dev),
+					"%s : SRIOV enable failed.\n",
+					TC956X_RESOURCE_NAME);
+					DBGPR_FUNC(&(pdev->dev),
+					"<--%s: ret: %d\n", __func__, ret);
+					goto err_sriov_vf_en_failed;
+				}
+
+				res.sriov_enabled = 1;
+
+				NMSGPR_INFO(&(pdev->dev),
+				"Total SR-IOV VFs Enabled: %d\n",
+					tc956x_no_of_vf);
+			} else {
+				NMSGPR_ALERT(&(pdev->dev),
+				"%s : VFs Value Out of Range.\n",
+					TC956X_RESOURCE_NAME);
+			}
+		} else {
+			NDBGPR_L1(&(pdev->dev),
+			"SR-IOV capability not found\n");
+		}
+	}
+#endif
+#endif
+	/* From the Kernel version 6.4.0, AER Error reporting is enabled by default.
+	 * It is enabled in pci_device_add() Kernel Space API.
+	 * So not required to enable from EMAC Driver.
+	 */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 4, 0)
+	/* Enable AER Error reporting, if device capability is detected */
+	if (pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR)) {
+
+		pci_enable_pcie_error_reporting(pdev);
+		NMSGPR_INFO(&(pdev->dev), "AER Capability Enabled\n");
+	}
+#endif
+	/* Enable the bus mastering */
+	pci_set_master(pdev);
+
+	dev_info(&(pdev->dev),
+		"BAR0 length = %lld bytes\n", (u64)pci_resource_len(pdev, 0));
+	dev_info(&(pdev->dev),
+		"BAR2 length = %lld bytes\n", (u64)pci_resource_len(pdev, 2));
+	dev_info(&(pdev->dev),
+		"BAR4 length = %lld bytes\n", (u64)pci_resource_len(pdev, 4));
+	dev_info(&(pdev->dev),
+		"BAR0 physical address = 0x%llx\n", (u64)pci_resource_start(pdev, 0));
+	dev_info(&(pdev->dev),
+		"BAR2 physical address = 0x%llx\n", (u64)pci_resource_start(pdev, 2));
+	dev_info(&(pdev->dev),
+		"BAR4 physical address = 0x%llx\n", (u64)pci_resource_start(pdev, 4));
+
+#ifdef TC956X
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+	res.tc956x_BRIDGE_CFG_pci_base_addr = ioremap
+		(pci_resource_start(pdev, TC956X_BAR0), pci_resource_len(pdev, TC956X_BAR0));
+#else
+	res.tc956x_BRIDGE_CFG_pci_base_addr = ioremap_nocache
+		(pci_resource_start(pdev, TC956X_BAR0), pci_resource_len(pdev, TC956X_BAR0));
+#endif
+	if (((void __iomem *)res.tc956x_BRIDGE_CFG_pci_base_addr == NULL)) {
+		NMSGPR_ERR(&(pdev->dev), "%s: cannot map TC956X BAR0, aborting", pci_name(pdev));
+		ret = -EIO;
+		DBGPR_FUNC(&(pdev->dev), "<--%s : ret: %d\n", __func__, ret);
+		goto err_out_map_failed;
+	}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+	res.tc956x_SRAM_pci_base_addr = ioremap
+		(pci_resource_start(pdev, TC956X_BAR2), pci_resource_len(pdev, TC956X_BAR2));
+#else
+	res.tc956x_SRAM_pci_base_addr = ioremap_nocache
+		(pci_resource_start(pdev, TC956X_BAR2), pci_resource_len(pdev, TC956X_BAR2));
+#endif
+	if (((void __iomem *)res.tc956x_SRAM_pci_base_addr == NULL)) {
+		pci_iounmap(pdev, (void __iomem *)res.tc956x_BRIDGE_CFG_pci_base_addr);
+		NMSGPR_ERR(&(pdev->dev), "%s: cannot map TC956X BAR2, aborting", pci_name(pdev));
+		ret = -EIO;
+		DBGPR_FUNC(&(pdev->dev), "<--%s : ret: %d\n", __func__, ret);
+		goto err_out_map_failed;
+	}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+	res.tc956x_SFR_pci_base_addr = ioremap
+		(pci_resource_start(pdev, TC956X_BAR4), pci_resource_len(pdev, TC956X_BAR4));
+#else
+	res.tc956x_SFR_pci_base_addr = ioremap_nocache
+		(pci_resource_start(pdev, TC956X_BAR4), pci_resource_len(pdev, TC956X_BAR4));
+#endif
+	if (((void __iomem *)res.tc956x_SFR_pci_base_addr == NULL)) {
+		pci_iounmap(pdev, (void __iomem *)res.tc956x_BRIDGE_CFG_pci_base_addr);
+		pci_iounmap(pdev, (void __iomem *)res.tc956x_SRAM_pci_base_addr);
+		NMSGPR_ERR(&(pdev->dev), "%s: cannot map TC956X BAR4, aborting", pci_name(pdev));
+		ret = -EIO;
+		DBGPR_FUNC(&(pdev->dev), "<--%s : ret: %d\n", __func__, ret);
+		goto err_out_map_failed;
+	}
+
+	NDBGPR_L1(&(pdev->dev), "BAR0 virtual address = %p\n", res.tc956x_BRIDGE_CFG_pci_base_addr);
+	NDBGPR_L1(&(pdev->dev), "BAR2 virtual address = %p\n", res.tc956x_SRAM_pci_base_addr);
+	NDBGPR_L1(&(pdev->dev), "BAR4 virtual address = %p\n", res.tc956x_SFR_pci_base_addr);
+
+	res.addr = res.tc956x_SFR_pci_base_addr;
+
+#ifdef TC956X
+	res.port_num = readl(res.tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG); /* Resource Manager ID */
+	res.port_num &= RSCMNG_PFN;
+#endif
+
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X_PCIE_LOGSTAT
+	if (res.port_num == RM_PF0_ID) {
+#ifdef TC956X_PCIE_LOGSTAT_SUMMARY_ENABLE
+		if ((tc956x_logstat_state_log_summary((void __iomem *)res.addr, UPSTREAM_PORT) < 0)
+		|| (tc956x_logstat_state_log_summary((void __iomem *)res.addr, DOWNSTREAM_PORT1) < 0)
+		|| (tc956x_logstat_state_log_summary((void __iomem *)res.addr, DOWNSTREAM_PORT2) < 0)
+		|| (tc956x_logstat_state_log_summary((void __iomem *)res.addr, INTERNAL_ENDPOINT) < 0)) {
+			ret = -EFAULT; /* The returns returned by above functions are -EFAULT only */
+			DBGPR_FUNC(&(pdev->dev), "<--%s : Error ret: %d\n", __func__, ret);
+			goto err_dvr_logstat;
+		}
+#endif /* #ifdef TC956X_PCIE_LOGSTAT_SUMMARY_ENABLE */
+
+		if ((tc956x_logstat_set_state_log_enable((void __iomem *)res.addr, UPSTREAM_PORT, STATE_LOG_ENABLE) < 0)
+		|| (tc956x_logstat_set_state_log_enable((void __iomem *)res.addr, DOWNSTREAM_PORT1, STATE_LOG_ENABLE) < 0)
+		|| (tc956x_logstat_set_state_log_enable((void __iomem *)res.addr, DOWNSTREAM_PORT2, STATE_LOG_ENABLE) < 0)
+		|| (tc956x_logstat_set_state_log_enable((void __iomem *)res.addr, INTERNAL_ENDPOINT, STATE_LOG_ENABLE) < 0)) {
+			ret = -EFAULT; /* The returns returned by above functions are -EFAULT only */
+			DBGPR_FUNC(&(pdev->dev), "<--%s : Error ret: %d\n", __func__, ret);
+			goto err_dvr_logstat;
+		}
+	}
+#endif /* TC956X_PCIE_LOGSTAT */
+
+#ifdef TC956X_PCIE_GEN3_SETTING
+	val = readl(res.addr + TC956X_GLUE_EFUSE_CTRL);
+	if ((val & 0x10) == 0) {
+		DBGPR_FUNC(&(pdev->dev), "<--%s : Applying Gen3 setting\n", __func__);
+		/* 0x4002C01C SSREG_GLUE_EFUSE_CTRL.pcie_usp_gen3_disable_efuse_ignore */
+		writel(0x10, res.addr + TC956X_GLUE_EFUSE_CTRL);
+		/* 0x4002C030 All PHY_COREs are selected */
+		writel(0x0f, res.addr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+		/* 0x40028000 All Lanes are selected */
+		writel(0x0f, res.addr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+		/* 0x4002B268 PMA_LN_PCS2PMA_PHYMODE_R2.pcs2pma_phymode */
+		writel(0x02, res.addr + TC956X_PMA_LN_PCS2PMA_PHYMODE_R2);
+	}
+
+	if ((pcie_link_speed >= 1) && (pcie_link_speed <= 3))
+		tc956x_set_pci_speed(pdev, pcie_link_speed);
+#endif
+#endif /*#ifdef TC956X_SRIOV_VF*/
+
+#if defined(TC956X_SRIOV_PF)
+#ifdef TC956X_PCIE_LINK_STATE_LATENCY_CTRL
+	/* 0x4002_C02C SSREG_GLUE_SW_REG_ACCESS_CTRL.sw_port_reg_access_enable for USP Access enable */
+	writel(SW_USP_ENABLE, res.addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+	/* 0x4002_496C K_PEXCONF_209_205.aspm_l0s_entry_delay in terms of 256ns */
+	writel(USP_L0s_ENTRY_DELAY, res.addr + TC956X_PCIE_S_L0s_ENTRY_LATENCY);
+	/* 0x4002_4970 K_PEXCONF_210_219.aspm_L1_entry_delay in terms of 256ns */
+	writel(USP_L1_ENTRY_DELAY, res.addr + TC956X_PCIE_S_L1_ENTRY_LATENCY);
+
+	/* 0x4002_C02C SSREG_GLUE_SW_REG_ACCESS_CTRL.sw_port_reg_access_enable for DSP1 Access enable */
+	writel(SW_DSP1_ENABLE, res.addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+	/* 0x4002_496C K_PEXCONF_209_205.aspm_l0s_entry_delay in terms of 256ns */
+	writel(DSP1_L0s_ENTRY_DELAY, res.addr + TC956X_PCIE_S_L0s_ENTRY_LATENCY);
+	/* 0x4002_4970 K_PEXCONF_210_219.aspm_L1_entry_delay in terms of 256ns */
+	writel(DSP1_L1_ENTRY_DELAY, res.addr + TC956X_PCIE_S_L1_ENTRY_LATENCY);
+
+	/* 0x4002_C02C SSREG_GLUE_SW_REG_ACCESS_CTRL.sw_port_reg_access_enable for DSP2 Access enable */
+	writel(SW_DSP2_ENABLE, res.addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+	/* 0x4002_496C K_PEXCONF_209_205.aspm_l0s_entry_delay in terms of 256ns */
+	writel(DSP2_L0s_ENTRY_DELAY, res.addr + TC956X_PCIE_S_L0s_ENTRY_LATENCY);
+	/* 0x4002_4970 K_PEXCONF_210_219.aspm_L1_entry_delay in terms of 256ns */
+	writel(DSP2_L1_ENTRY_DELAY, res.addr + TC956X_PCIE_S_L1_ENTRY_LATENCY);
+
+	/* 0x4002_C02C SSREG_GLUE_SW_REG_ACCESS_CTRL.sw_port_reg_access_enable
+	 * for VDSP Access enable
+	 */
+	writel(SW_VDSP_ENABLE, res.addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+	/* 0x4002_496C K_PEXCONF_209_205.aspm_l0s_entry_delay in terms of 256ns */
+	writel(VDSP_L0s_ENTRY_DELAY, res.addr + TC956X_PCIE_S_L0s_ENTRY_LATENCY);
+	/* 0x4002_4970 K_PEXCONF_210_219.aspm_L1_entry_delay in terms of 256ns */
+	writel(VDSP_L1_ENTRY_DELAY, res.addr + TC956X_PCIE_S_L1_ENTRY_LATENCY);
+
+	/* 0x4002_00D8 Reading PCIE EP Capability setting Register */
+	reg_val = readl(res.addr + TC956X_PCIE_EP_CAPB_SET);
+
+	/* Clearing PCIE EP Capability setting of L0s & L1 entry delays */
+	reg_val &= ~(TC956X_PCIE_EP_L0s_ENTRY_MASK | TC956X_PCIE_EP_L1_ENTRY_MASK);
+
+	/* Updating PCIE EP Capability setting of L0s & L1 entry delays */
+	reg_val |= (((ep_l0s_delay << TC956X_PCIE_EP_L0s_ENTRY_SHIFT) &
+				TC956X_PCIE_EP_L0s_ENTRY_MASK) |
+			((ep_l1_delay << TC956X_PCIE_EP_L1_ENTRY_SHIFT) &
+				TC956X_PCIE_EP_L1_ENTRY_MASK));
+
+	/* 0x4002_00D8 PCIE EP Capability setting L0S & L1 entry delay in terms of 256ns */
+	writel(reg_val, res.addr + TC956X_PCIE_EP_CAPB_SET);
+
+	/* 0x4002_C02C SSREG_GLUE_SW_REG_ACCESS_CTRL.sw_port_reg_access_enable
+	 * for All Switch Ports Access enable
+	 */
+	writel(TC956X_PCIE_S_EN_ALL_PORTS_ACCESS, res.addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+#endif /* end of TC956X_PCIE_LINK_STATE_LATENCY_CTRL */
+#endif /* TC956X_SRIOV_PF*/
+
+#ifdef TC956X_SRIOV_VF
+	get_vf_id(plat, &res);
+#endif /*#ifdef TC956X_SRIOV_VF*/
+
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X_PCIE_DISABLE_DSP1
+	tc956x_pcie_disable_dsp1_port(&pdev->dev, res.tc956x_SFR_pci_base_addr);
+#endif
+
+#ifdef TC956X_PCIE_DISABLE_DSP2
+	tc956x_pcie_disable_dsp2_port(&pdev->dev, res.tc956x_SFR_pci_base_addr);
+#endif
+
+
+#endif
+
+#ifdef TC956X
+	res.port_num = readl(res.tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG); /* Resource Manager ID */
+	res.port_num &= RSCMNG_PFN;
+#endif
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_MAGIC_PACKET_WOL_GPIO
+	if (res.port_num == RM_PF0_ID) {
+		KPRINT_INFO("%s: Port %d Bus number %x - Configuring GPIO for WOL", __func__, res.port_num, pdev->bus->number);
+		tc956x_wol_gpio_trigger(res.addr, false); /* Set to LOW */
+	}
+#endif
+#endif /* TC956X_SRIOV_PF */
+#ifdef DISABLE_EMAC_PORT1
+#ifdef TC956X
+	if (res.port_num == RM_PF1_ID) {
+
+		NMSGPR_ALERT(&pdev->dev, "Disabling all eMAC clocks for Port 1\n");
+		/* Disable all clocks to eMAC Port1 */
+		ret = readl(res.addr + NCLKCTRL1_OFFSET);
+
+		ret &= (~(NCLKCTRL1_MAC1TXCEN | NCLKCTRL1_MAC1RXCEN |
+			  NCLKCTRL1_MAC1ALLCLKEN1 | NCLKCTRL1_MAC1RMCEN));
+		writel(ret, res.addr + NCLKCTRL1_OFFSET);
+
+		ret = -ENODEV;
+		goto disable_emac_port;
+	}
+#endif
+#endif
+#endif /*#ifdef TC956X_SRIOV_VF*/
+
+	plat->port_num = res.port_num;
+
+#ifndef TC956X_SRIOV_VF
+	/* User configured/Default Module parameters of TC956x*/
+	NMSGPR_INFO(&pdev->dev, "User Configured/Default Module parameters of TC956x of Port-%d bus number-%x\n", plat->port_num, pdev->bus->number);
+	if (plat->port_num == RM_PF0_ID) {
+#ifdef TC956X_PCIE_GEN3_SETTING
+		NMSGPR_INFO(&pdev->dev, "pcie_link_speed = %d\n", pcie_link_speed);
+#endif
+		NMSGPR_INFO(&pdev->dev, "mac0_force_speed_mode = %d\n", mac0_force_speed_mode);
+		NMSGPR_INFO(&pdev->dev, "mac0_force_config_speed = %d\n", mac0_force_config_speed);
+		NMSGPR_INFO(&pdev->dev, "mac0_interface = %d\n", mac0_interface);
+		NMSGPR_INFO(&pdev->dev, "mac0_eee_enable = %d\n", mac0_eee_enable);
+		NMSGPR_INFO(&pdev->dev, "mac0_lpi_timer = %d\n", mac0_lpi_timer);
+		NMSGPR_INFO(&pdev->dev, "mac0_filter_phy_pause = %d\n", mac0_filter_phy_pause);
+		NMSGPR_INFO(&pdev->dev, "mac0_rxq0_size = %d\n", mac0_rxq0_size);
+		NMSGPR_INFO(&pdev->dev, "mac0_rxq1_size = %d\n", mac0_rxq1_size);
+		NMSGPR_INFO(&pdev->dev, "mac0_rxq0_rfd  = %d\n", mac0_rxq0_rfd);
+		NMSGPR_INFO(&pdev->dev, "mac0_rxq0_rfa  = %d\n", mac0_rxq0_rfa);
+		NMSGPR_INFO(&pdev->dev, "mac0_rxq1_rfd  = %d\n", mac0_rxq1_rfd);
+		NMSGPR_INFO(&pdev->dev, "mac0_rxq1_rfa  = %d\n", mac0_rxq1_rfa);
+		NMSGPR_INFO(&pdev->dev, "mac0_txq0_size = %d\n", mac0_txq0_size);
+		NMSGPR_INFO(&pdev->dev, "mac0_txq1_size = %d\n", mac0_txq1_size);
+		NMSGPR_INFO(&pdev->dev, "mac0_en_lp_pause_frame_cnt = %d\n", mac0_en_lp_pause_frame_cnt);
+		NMSGPR_INFO(&pdev->dev, "mac_power_save_at_link_down = %d \n", mac_power_save_at_link_down);
+		NMSGPR_INFO(&pdev->dev, "mac0_link_down_macrst = %d \n", mac0_link_down_macrst);
+	} else if (plat->port_num == RM_PF1_ID) {
+		NMSGPR_INFO(&pdev->dev, "mac1_force_speed_mode = %d\n", mac1_force_speed_mode);
+		NMSGPR_INFO(&pdev->dev, "mac1_force_config_speed = %d\n", mac1_force_config_speed);
+		NMSGPR_INFO(&pdev->dev, "mac1_interface = %d\n", mac1_interface);
+		NMSGPR_INFO(&pdev->dev, "mac1_eee_enable = %d\n", mac1_eee_enable);
+		NMSGPR_INFO(&pdev->dev, "mac1_filter_phy_pause = %d\n", mac1_filter_phy_pause);
+		NMSGPR_INFO(&pdev->dev, "mac1_lpi_timer = %d\n", mac1_lpi_timer);
+		NMSGPR_INFO(&pdev->dev, "mac1_rxq0_size = %d\n", mac1_rxq0_size);
+		NMSGPR_INFO(&pdev->dev, "mac1_rxq1_size = %d\n", mac1_rxq1_size);
+		NMSGPR_INFO(&pdev->dev, "mac1_rxq0_rfd  = %d\n", mac1_rxq0_rfd);
+		NMSGPR_INFO(&pdev->dev, "mac1_rxq0_rfa  = %d\n", mac1_rxq0_rfa);
+		NMSGPR_INFO(&pdev->dev, "mac1_rxq1_rfd  = %d\n", mac1_rxq1_rfd);
+		NMSGPR_INFO(&pdev->dev, "mac1_rxq1_rfa  = %d\n", mac1_rxq1_rfa);
+		NMSGPR_INFO(&pdev->dev, "mac1_txq0_size = %d\n", mac1_txq0_size);
+		NMSGPR_INFO(&pdev->dev, "mac1_txq1_size = %d\n", mac1_txq1_size);
+		NMSGPR_INFO(&pdev->dev, "mac1_en_lp_pause_frame_cnt = %d\n", mac1_en_lp_pause_frame_cnt);
+		NMSGPR_INFO(&pdev->dev, "mac1_link_down_macrst = %d \n", mac1_link_down_macrst);
+	}
+#endif
+#if defined(TC956X_SRIOV_PF)
+
+	if (res.port_num == RM_PF0_ID) {
+		plat->mdc_clk = port0_mdc;
+		plat->c45_needed = port0_c45_state == 1 ? true : false;
+		plat->start_phy_addr = port0_phyaddr;
+	}
+
+	if (res.port_num == RM_PF1_ID) {
+		plat->mdc_clk = port1_mdc;
+		plat->c45_needed = port1_c45_state == 1 ? true : false;
+		plat->start_phy_addr = port1_phyaddr;
+	}
+
+	if (res.port_num == RM_PF0_ID) {
+		/* Set the PORT0 interface mode to default, in case of invalid input */
+		if ((mac0_interface ==  ENABLE_RGMII_INTERFACE) ||
+		(mac0_interface >  ENABLE_2500BASE_X_INTERFACE))
+			mac0_interface = ENABLE_XFI_INTERFACE;
+
+		res.port_interface = mac0_interface;
+	}
+
+	if (res.port_num == RM_PF1_ID) {
+		/* Set the PORT1 interface mode to default, in case of invalid input */
+		if ((mac1_interface < ENABLE_USXGMII_INTERFACE) ||
+		(mac1_interface >  ENABLE_2500BASE_X_INTERFACE))
+			mac1_interface = ENABLE_SGMII_INTERFACE;
+		res.port_interface = mac1_interface;
+	}
+
+	overlay = tc956x_platform_port_interface_overlay(&pdev->dev, &res);
+	if (overlay) {
+		plat->mdc_clk = res.mdc_clk;
+		plat->c45_needed = res.c45_state;
+
+		if (res.port_num == RM_PF0_ID) {
+			mac0_link_down_macrst = res.link_down_macrst == 1 ? ENABLE : DISABLE;
+		}
+		if (res.port_num == RM_PF1_ID) {
+			mac1_link_down_macrst = res.link_down_macrst == 1 ? ENABLE : DISABLE;
+		}
+	}
+
+	plat->port_interface = res.port_interface;
+
+	if (res.port_num == RM_PF0_ID) {
+
+		if ((mac0_force_speed_mode != DISABLE) && (mac0_force_speed_mode != ENABLE)) {
+			mac0_force_speed_mode = DISABLE;
+			NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid mac0_force_speed_mode parameter passed. Restoring default to %d. Supported Values are 0 and 1.\n",
+			__func__, mac0_force_speed_mode);
+		}
+		if (mac0_force_speed_mode == ENABLE) {
+			if (mac0_force_config_speed > 5) { /*Configuring default value on error*/
+				mac0_force_config_speed = 3;
+				NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid mac0_force_config_speed parameter passed. Restoring default to %d. Supported Values are 0 to 5.\n",
+				__func__, mac0_force_config_speed);
+			}
+		}
+		if ((mac0_eee_enable != DISABLE) &&
+		(mac0_eee_enable != ENABLE)) {
+			mac0_eee_enable = DISABLE;
+			NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid mac0_eee_enable parameter passed. Restoring default to %d. Supported Values are 0 and 1.\n",
+			__func__, mac0_eee_enable);
+		}
+
+		if ((mac0_eee_enable == ENABLE) &&
+		(mac0_lpi_timer > TC956X_MAX_LPI_AUTO_ENTRY_TIMER)) {
+			mac0_lpi_timer = TC956XMAC_LPIET_600US;
+			NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid mac0_lpi_timer parameter passed. Restoring default to %d. Supported Values between %d and %d.\n",
+			__func__, mac1_lpi_timer,
+			TC956X_MIN_LPI_AUTO_ENTRY_TIMER, TC956X_MAX_LPI_AUTO_ENTRY_TIMER);
+		}
+		res.eee_enabled = mac0_eee_enable;
+		res.tx_lpi_timer = mac0_lpi_timer;
+	}
+
+	if (res.port_num == RM_PF1_ID) {
+
+		if ((mac1_force_speed_mode != DISABLE) && (mac1_force_speed_mode != ENABLE)) {
+			mac1_force_speed_mode = DISABLE;
+			NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid mac1_force_speed_mode parameter passed. Restoring default to %d. Supported Values are 0 and 1.\n",
+			__func__, mac1_force_speed_mode);
+		}
+		if (mac1_force_speed_mode == ENABLE) {
+			if (mac1_force_config_speed > 5) { /*Configuring default value on error*/
+				mac1_force_config_speed = 3;
+				NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid mac1_force_config_speed parameter passed. Restoring default to %d. Supported Values are 0 to 5.\n",
+				__func__, mac1_force_config_speed);
+			}
+		}
+
+		if ((mac1_eee_enable != DISABLE) &&
+		(mac1_eee_enable != ENABLE)) {
+			mac1_eee_enable = DISABLE;
+			NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid mac1_eee_enable parameter passed. Restoring default to %d. Supported Values are 0 and 1.\n",
+			__func__, mac1_eee_enable);
+		}
+
+		if ((mac0_eee_enable == ENABLE) &&
+		(mac1_lpi_timer > TC956X_MAX_LPI_AUTO_ENTRY_TIMER)) {
+			mac1_lpi_timer = TC956XMAC_LPIET_600US;
+			NMSGPR_INFO(&(pdev->dev), "%s: ERROR Invalid mac1_lpi_timer parameter passed. Restoring default to %d. Supported Values between %d and %d.\n",
+			__func__, mac1_lpi_timer,
+			TC956X_MIN_LPI_AUTO_ENTRY_TIMER, TC956X_MAX_LPI_AUTO_ENTRY_TIMER);
+		}
+		res.eee_enabled = mac1_eee_enable;
+		res.tx_lpi_timer = mac1_lpi_timer;
+	}
+#endif
+	ret = info->setup(pdev, plat);
+
+	if (ret)
+		return ret;
+
+#ifdef TC956X
+#ifndef TC956X_SRIOV_VF
+	if (res.port_num == RM_PF0_ID) {
+		ret = readl(res.addr + NRSTCTRL0_OFFSET);
+		ret |= (NRSTCTRL0_INTRST);
+		writel(ret, res.addr + NRSTCTRL0_OFFSET);
+
+		ret = readl(res.addr + NCLKCTRL0_OFFSET);
+		ret |= NCLKCTRL0_INTCEN;
+		writel(ret, res.addr + NCLKCTRL0_OFFSET);
+
+		ret = readl(res.addr + NRSTCTRL0_OFFSET);
+		ret &= (~(NRSTCTRL0_INTRST));
+		writel(ret, res.addr + NRSTCTRL0_OFFSET);
+
+		/* Configure Address Transslation block
+		 * Bridge Base address to be passed for TC956X
+		 */
+		tc956x_config_tamap(&pdev->dev, res.tc956x_BRIDGE_CFG_pci_base_addr);
+	}
+#endif /*#ifdef TC956X_SRIOV_VF*/
+#endif
+#ifdef TC956X_SRIOV_PF
+	NMSGPR_INFO(&(pdev->dev), "Initialising eMAC Port %d bus number-%x\n", res.port_num, pdev->bus->number);
+	/* Enable MSI  and Allocate Vectors */
+	ret = pci_alloc_irq_vectors(pdev, TC956X_TOT_MSI_VEC,
+				TC956X_TOT_MSI_VEC, PCI_IRQ_MSI);
+
+	if (ret < TC956X_TOT_MSI_VEC) {
+		dev_err(&(pdev->dev),
+		"%s:Enable MSI error\n", TC956X_RESOURCE_NAME);
+		DBGPR_FUNC(&(pdev->dev), "<--%s : ret: %d\n", __func__, ret);
+		goto err_out_msi_failed;
+	}
+
+	DBGPR_FUNC(&(pdev->dev), "%s : Allocated MSI Vectors : %d",
+								__func__, ret);
+#elif defined TC956X_SRIOV_VF
+	/* Enable MSI  and Allocate Vectors */
+	ret = pci_alloc_irq_vectors(pdev, TC956X_MIN_MSI_VEC,
+				TC956X_MAX_MSI_VEC, PCI_IRQ_MSI);
+
+	if (ret < TC956X_MIN_MSI_VEC) {
+		dev_err(&(pdev->dev),
+		"%s:Enable MSI error\n", TC956X_RESOURCE_NAME);
+		DBGPR_FUNC(&(pdev->dev), "<--%s : ret: %d\n", __func__, ret);
+		goto err_out_msi_failed;
+	}
+
+	DBGPR_FUNC(&(pdev->dev), "<--%s : Allocated MSI Vectors : %d", __func__, ret);
+#else
+	/* Enable MSI Operation */
+	ret = pci_enable_msi(pdev);
+	if (ret) {
+		dev_err(&(pdev->dev),
+		"%s:Enable MSI error\n", TC956X_RESOURCE_NAME);
+		DBGPR_FUNC(&(pdev->dev), "<--%s : ret: %d\n", __func__, ret);
+		goto err_out_msi_failed;
+	}
+
+#endif /*#ifdef TC956X_SRIOV_VF*/
+	pci_write_config_dword(pdev, pdev->msi_cap + PCI_MSI_MASK_64, 0);
+
+#ifndef TC956X_SRIOV_VF
+#ifdef EEPROM_MAC_ADDR
+
+#ifdef TC956X
+	iowrite8(EEPROM_OFFSET, (void __iomem *)(res.tc956x_SRAM_pci_base_addr +
+			TC956X_M3_SRAM_EEPROM_OFFSET_ADDR));
+	iowrite8(EEPROM_MAC_COUNT, (void __iomem *)(res.tc956x_SRAM_pci_base_addr +
+			TC956X_M3_SRAM_EEPROM_MAC_COUNT));
+#endif
+
+#endif
+
+#ifdef TC956X
+	if (res.port_num == RM_PF0_ID) {
+		ret = tc956x_load_firmware(&pdev->dev, &res);
+		if (ret)
+			NMSGPR_ERR(&(pdev->dev), "Firmware load failed\n");
+	}
+#endif
+
+#ifdef TC956X
+
+	if (res.port_num == RM_PF0_ID) {
+		ret = readl(res.addr + NRSTCTRL0_OFFSET);
+
+		/* Assertion of EMAC Port0 software Reset */
+		ret |= NRSTCTRL0_MAC0RST;
+
+		writel(ret, res.addr + NRSTCTRL0_OFFSET);
+
+		NMSGPR_INFO(&pdev->dev, "Enabling all eMAC clocks for Port 0 Bus number %x\n", pdev->bus->number);
+		/* Enable all clocks to eMAC Port0 */
+		ret = readl(res.addr + NCLKCTRL0_OFFSET);
+
+		ret |= ((NCLKCTRL0_MAC0TXCEN | NCLKCTRL0_MAC0ALLCLKEN | NCLKCTRL0_MAC0RXCEN));
+		/* Only if "current" port is SGMII 2.5G, configure below clocks. */
+		if ((res.port_interface == ENABLE_SGMII_INTERFACE) ||
+			(res.port_interface == ENABLE_2500BASE_X_INTERFACE)) {
+			ret &= ~NCLKCTRL0_POEPLLCEN;
+			ret &= ~NCLKCTRL0_SGMPCIEN;
+			ret &= ~NCLKCTRL0_REFCLKOCEN;
+			ret &= ~NCLKCTRL0_MAC0125CLKEN;
+			ret &= ~NCLKCTRL0_MAC0312CLKEN;
+		}
+		writel(ret, res.addr + NCLKCTRL0_OFFSET);
+
+		/* Interface configuration for port0*/
+		ret = readl(res.addr + NEMAC0CTL_OFFSET);
+		ret &= ~(NEMACCTL_SP_SEL_MASK | NEMACCTL_PHY_INF_SEL_MASK);
+		if ((res.port_interface == ENABLE_SGMII_INTERFACE) ||
+			(res.port_interface == ENABLE_2500BASE_X_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_SGMII_2500M;
+		else if ((res.port_interface == ENABLE_USXGMII_INTERFACE) ||
+			(res.port_interface == ENABLE_XFI_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_USXGMII_10G_10G;
+
+		ret &= ~(0x00000040); /* Mask Polarity */
+		if (SgmSigPol == 1)
+			ret |= 0x00000040; /* Set Active low */
+
+		ret |= NEMACCTL_PHY_INF_SEL | NEMACCTL_LPIHWCLKEN;
+		writel(ret, res.addr + NEMAC0CTL_OFFSET);
+
+		/* De-assertion of EMAC Port0  software Reset*/
+		ret = readl(res.addr + NRSTCTRL0_OFFSET);
+		ret &= ~(NRSTCTRL0_MAC0RST);
+		writel(ret, res.addr + NRSTCTRL0_OFFSET);
+	}
+
+	if (res.port_num == RM_PF1_ID) {
+		ret = readl(res.addr + NRSTCTRL1_OFFSET);
+
+		/* Assertion of EMAC Port1 software Reset*/
+		ret |= NRSTCTRL1_MAC1RST1;
+		writel(ret, res.addr + NRSTCTRL1_OFFSET);
+
+		NMSGPR_INFO(&pdev->dev, "Enabling all eMAC clocks for Port 1 Bus number-%x\n", pdev->bus->number);
+		/* Enable all clocks to eMAC Port1 */
+		ret = readl(res.addr + NCLKCTRL1_OFFSET);
+
+		ret |= ((NCLKCTRL1_MAC1TXCEN | NCLKCTRL1_MAC1RXCEN |
+		NCLKCTRL1_MAC1ALLCLKEN1 | 1 << 15));
+		if ((res.port_interface == ENABLE_SGMII_INTERFACE) ||
+			(res.port_interface == ENABLE_2500BASE_X_INTERFACE)) {
+			ret &= ~NCLKCTRL1_MAC1125CLKEN1;
+			ret &= ~NCLKCTRL1_MAC1312CLKEN1;
+		}
+		writel(ret, res.addr + NCLKCTRL1_OFFSET);
+
+		/* Interface configuration for port1*/
+		ret = readl(res.addr + NEMAC1CTL_OFFSET);
+		ret &= ~(NEMACCTL_SP_SEL_MASK | NEMACCTL_PHY_INF_SEL_MASK);
+		if ((res.port_interface == ENABLE_RGMII_INTERFACE) ||
+			(res.port_interface == ENABLE_RGMII_ID_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_RGMII_1000M;
+		else if ((res.port_interface == ENABLE_SGMII_INTERFACE) ||
+			(res.port_interface == ENABLE_2500BASE_X_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_SGMII_2500M;
+		else if ((res.port_interface == ENABLE_USXGMII_INTERFACE) ||
+			(res.port_interface == ENABLE_XFI_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_USXGMII_10G_10G;
+
+		ret &= ~(0x00000040); /* Mask Polarity */
+		if (SgmSigPol == 1)
+			ret |= 0x00000040; /* Set Active low */
+
+		ret |= NEMACCTL_PHY_INF_SEL | NEMACCTL_LPIHWCLKEN;
+		writel(ret, res.addr + NEMAC1CTL_OFFSET);
+
+		/* De-assertion of EMAC Port1  software Reset */
+		ret = readl(res.addr + NRSTCTRL1_OFFSET);
+		ret &= ~NRSTCTRL1_MAC1RST1;
+		writel(ret, res.addr + NRSTCTRL1_OFFSET);
+	}
+#endif
+
+#endif /*#ifdef TC956X_SRIOV_VF*/
+
+	res.wol_irq = pdev->irq;
+	res.irq = pdev->irq;
+	res.lpi_irq = pdev->irq;
+
+	plat->bus_id = ((pdev->bus->number<<4) | res.port_num);
+
+	sh_mem_offset = tc956x_get_shared_mem_offset(pdev, pci_dev_id(pdev) & TC956X_PCI_BD_MASK);
+	if (sh_mem_offset < TC956X_TOT_CASCADE_DEV)
+		res.pci_bd  = sh_mem_offset;
+	else {
+		dev_err(&(pdev->dev), "Error finding shared memory\n");
+		goto err_out_msi_failed;
+	}
+
+#ifdef TC956X_SRIOV_PF
+	ret = tc956xmac_dvr_probe(&pdev->dev, plat, &res);
+#elif defined TC956X_SRIOV_VF
+	ret = tc956xmac_vf_dvr_probe(&pdev->dev, plat, &res);
+#endif
+	if (ret) {
+		if (ret == -ENODEV) {
+			dev_info(&(pdev->dev), "Port%d Bus%x will be registered as PCIe device only", res.port_num, pdev->bus->number);
+			/* Make sure probe() succeeds by returning 0 to caller of probe() */
+			ret = 0;
+		} else {
+			dev_err(&(pdev->dev), "<--%s : ret: %d\n", __func__, ret);
+			goto err_dvr_probe;
+		}
+	}
+
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+	if ((res.port_num == RM_PF1_ID) && ((res.port_interface == ENABLE_RGMII_INTERFACE) || (res.port_interface == ENABLE_RGMII_ID_INTERFACE))) {
+		writel(0x00000000, res.addr + 0x1050);
+		writel(0xF300F300, res.addr + 0x107C);
+	}
+#endif
+#endif /*#ifdef TC956X_SRIOV_VF*/
+
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_PCIE_DSP_CUT_THROUGH
+	DBGPR_FUNC(&(pdev->dev), "<--%s : Adding DSP Cut Through Settings", __func__);
+	/* Read mode setting register
+	 * Mode settings values 0:Setting A: x4x1x1, 1:Setting B: x2x2x1
+	 */
+	val = readl(res.addr + NMODESTS_OFFSET);
+	pcie_mode = (val & NMODESTS_MODE2) >> NMODESTS_MODE2_SHIFT;
+
+	switch (pcie_mode) {
+	case TC956X_PCIE_SETTING_A: /* 0:Setting A: x4x1x1 mode */
+		DBGPR_FUNC(&(pdev->dev), "%s : Setting A : Adding DSP Cut Through Settings for DSP1 & DSP2", __func__);
+		/*DSP1 & DSP2 is selected*/
+		val = readl(res.addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+		val &= ~(SW_DSP1_ENABLE|SW_DSP2_ENABLE);
+		val |= (SW_DSP1_ENABLE|SW_DSP2_ENABLE);
+		writel(val, res.addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+		/*Set 0x0 to Rx Bit enable_cut_through_on_receive_path*/
+		val = readl(res.addr + TC956X_SSREG_K_PCICONF_021_021);
+		val &= ~(ENABLE_CUT_THROUGH_ON_RX_PATH_MASK);
+		writel(val, res.addr + TC956X_SSREG_K_PCICONF_021_021);
+		/*Set 0x00000000 to Tx Bit enable_cut_through_on_transmit_path*/
+		val = readl(res.addr + TC956X_SSREG_K_PCICONF_022_022);
+		val &= ~(ENABLE_CUT_THROUGH_ON_TX_PATH_MASK);
+		writel(val, res.addr + TC956X_SSREG_K_PCICONF_022_022);
+		break;
+	case TC956X_PCIE_SETTING_B: /* 1:Setting B: x2x2x1 mode */
+		DBGPR_FUNC(&(pdev->dev), "%s : Setting B : Adding DSP Cut Through Settings for DSP2", __func__);
+		/*DSP2 is selected*/
+		val = readl(res.addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+		val &= ~(SW_DSP2_ENABLE);
+		val |= (SW_DSP2_ENABLE);
+		writel(val, res.addr + TC956X_GLUE_SW_REG_ACCESS_CTRL);
+		/*Set 0x0 to Rx Bit enable_cut_through_on_receive_path*/
+		val = readl(res.addr + TC956X_SSREG_K_PCICONF_021_021);
+		val &= ~(ENABLE_CUT_THROUGH_ON_RX_PATH_MASK);
+		writel(val, res.addr + TC956X_SSREG_K_PCICONF_021_021);
+		/*Set 0x0 to Tx Bit enable_cut_through_on_transmit_path*/
+		val = readl(res.addr + TC956X_SSREG_K_PCICONF_022_022);
+		val &= ~(ENABLE_CUT_THROUGH_ON_TX_PATH_MASK);
+		writel(val, res.addr + TC956X_SSREG_K_PCICONF_022_022);
+		break;
+	}
+#endif /* #ifdef TC956X_PCIE_DSP_CUT_THROUGH */
+#endif /* #ifdef TC956X_SRIOV_PF */
+
+	mutex_lock(&tc956x_pm_suspend_lock);
+	/* Increment device usage counter */
+	tc956xmac_pm_usage_counter++;
+	tx956x_pci_shrd_mem[res.pci_bd].pci_dev_active_cnt++;
+	DBGPR_FUNC(&(pdev->dev), "%s : (Device Usage Count = [%d])\n", __func__, tx956x_pci_shrd_mem[res.pci_bd].pci_dev_active_cnt);
+	mutex_unlock(&tc956x_pm_suspend_lock);
+
+	return ret;
+
+
+err_dvr_probe:
+err_out_msi_failed:
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+	pci_free_irq_vectors(pdev);
+#else
+	pci_disable_msi(pdev);
+#endif
+#ifdef DISABLE_EMAC_PORT1
+disable_emac_port:
+#endif
+#ifdef TC956X
+	if (((void __iomem *)res.tc956x_SFR_pci_base_addr != NULL))
+		pci_iounmap(pdev, (void __iomem *)res.tc956x_SFR_pci_base_addr);
+	if (((void __iomem *)res.tc956x_SRAM_pci_base_addr != NULL))
+		pci_iounmap(pdev, (void __iomem *)res.tc956x_SRAM_pci_base_addr);
+	if (((void __iomem *)res.tc956x_BRIDGE_CFG_pci_base_addr != NULL))
+		pci_iounmap(pdev, (void __iomem *)res.tc956x_BRIDGE_CFG_pci_base_addr);
+#endif
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X_PCIE_LOGSTAT
+err_dvr_logstat:
+#endif
+#endif
+err_out_map_failed:
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X
+#ifdef CONFIG_PCI_IOV
+	/* Disable SR-IOV */
+
+	if ((res.sriov_enabled != 0) && pdev->is_physfn) {
+		NMSGPR_INFO(&(pdev->dev), "Disabling sriov\n");
+		res.sriov_enabled = 0;
+		pci_disable_sriov(pdev);
+	}
+#endif
+#endif
+#ifdef TC956X
+#ifdef CONFIG_PCI_IOV
+err_sriov_vf_en_failed:
+#endif
+#endif
+#endif
+	pci_release_regions(pdev);
+err_out_req_reg_failed:
+	pci_disable_device(pdev);
+err_out_enb_failed:
+	return ret;
+
+}
+
+/**
+ * tc956x_pci_remove
+ *
+ * \brief API to release all the resources from the driver.
+ *
+ * \details The remove function gets called whenever a device being handled
+ * by this driver is removed (either during deregistration of the driver or
+ * when it is manually pulled out of a hot-pluggable slot). This function
+ * should reverse operations performed at probe time. The remove function
+ * always gets called from process context, so it can sleep.
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ *
+ * \return void
+ */
+static void tc956xmac_pci_remove(struct pci_dev *pdev)
+{
+	struct net_device *ndev = dev_get_drvdata(&pdev->dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+#ifdef TC956X_SRIOV_PF
+	void *nrst_reg, *nclk_reg;
+	u32 nrst_val, nclk_val;
+#endif
+
+	DBGPR_FUNC(&(pdev->dev), "-->%s\n", __func__);
+
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_PCI_IOV
+	/* Disable SR-IOV */
+	if ((priv->sriov_enabled != 0) && pdev->is_physfn) {
+		NMSGPR_INFO(&(pdev->dev), "Disabling sriov\n");
+		priv->sriov_enabled = 0;
+		pci_disable_sriov(pdev);
+	}
+#endif
+	/* phy_addr == -1 indicates that PHY was not found and
+	 * device is registered as only PCIe device. So skip any
+	 * ethernet device related uninitialization
+	 */
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	if (priv->plat->phy_addr != -1)
+#endif
+		tc956xmac_dvr_remove(&pdev->dev);
+
+	/* Set reset value for CLK control and RESET Control registers */
+	if (priv->port_num == 0) {
+		nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET;
+		nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+		nrst_val = readl(nrst_reg);
+		nclk_val = readl(nclk_reg);
+		nrst_val |= NRSTCTRL0_DEFAULT;
+		nclk_val &= ~NCLKCTRL_PORT0_EMAC_MASK;
+	} else {
+		nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL1_OFFSET;
+		nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL1_OFFSET;
+		nrst_val = NRSTCTRL_EMAC_MASK;
+		nclk_val = 0;
+	}
+	writel(nrst_val, nrst_reg);
+	writel(nclk_val, nclk_reg);
+	if (tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt == TC956X_SINGLE_MAC_DEVICE_IN_USE) {
+		/* Set reset value for Common CLK control and Common RESET Control registers */
+		nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET;
+		nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+		nrst_val = readl(nrst_reg);
+		nclk_val = readl(nclk_reg);
+		nrst_val |= NRSTCTRL_COMMON;
+		nclk_val |= NCLKCTRL_ENABLE_COMMON_EMAC_MASK;
+		nclk_val &= ~NCLKCTRL_DISABLE_COMMON_EMAC_MASK;
+		writel(nrst_val, nrst_reg);
+		writel(nclk_val, nclk_reg);
+	}
+	KPRINT_INFO("%s : Port %d %s Wr RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+		readl(nrst_reg), readl(nclk_reg));
+
+#elif defined TC956X_SRIOV_VF
+	tc956xmac_vf_dvr_remove(&pdev->dev);
+#endif
+	pdev->irq = 0;
+
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+	/* Free allocated interrupt vectors for device */
+	pci_free_irq_vectors(pdev);
+#else
+	/* Disable MSI Operation */
+	pci_disable_msi(pdev);
+#endif
+
+	if (priv->plat->tc956xmac_clk)
+		clk_unregister_fixed_rate(priv->plat->tc956xmac_clk);
+
+
+#ifdef TC956X
+	/* Un-map previously mapped BAR0/2/4 address memory */
+	if ((void __iomem *)priv->tc956x_SFR_pci_base_addr != NULL)
+		pci_iounmap(pdev, (void __iomem *)
+			priv->tc956x_SFR_pci_base_addr);
+	if ((void __iomem *)priv->tc956x_SRAM_pci_base_addr != NULL)
+		pci_iounmap(pdev, (void __iomem *)
+			priv->tc956x_SRAM_pci_base_addr);
+	if ((void __iomem *)priv->tc956x_BRIDGE_CFG_pci_base_addr != NULL)
+		pci_iounmap(pdev, (void __iomem *)
+			priv->tc956x_BRIDGE_CFG_pci_base_addr);
+#endif
+	pci_release_regions(pdev);
+
+	pci_disable_device(pdev);
+
+	mutex_lock(&tc956x_pm_suspend_lock);
+	/* Decrement device usage counter */
+	tc956xmac_pm_usage_counter--;
+	tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt--;
+	DBGPR_FUNC(&(pdev->dev), "%s : (Device Usage Count = [%d])\n", __func__, tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt);
+	mutex_unlock(&tc956x_pm_suspend_lock);
+	DBGPR_FUNC(&(pdev->dev), "<--%s\n", __func__);
+}
+
+/*!
+ * \brief API to disable pci device.
+ *
+ * \details This api will be called during suspend operation.
+ * This will disable pci device passed as argument.
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ *
+ * \return int
+ */
+static int tc956x_pcie_pm_disable_pci(struct pci_dev *pdev)
+{
+	struct net_device *ndev = dev_get_drvdata(&pdev->dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	int ret = 0;
+
+	DBGPR_FUNC(&(pdev->dev), "---->%s : Port %d %s - PCI Save State, Disable Device, Prepare to sleep", __func__, priv->port_num, ndev->name);
+	pci_save_state(pdev);
+	pci_disable_device(pdev);
+	pci_prepare_to_sleep(pdev);
+	DBGPR_FUNC(&(pdev->dev), "<----%s : Port %d %s- PCI Save State, Disable Device, Prepare to sleep", __func__, priv->port_num, ndev->name);
+	return ret;
+}
+
+/*!
+ * \brief API to enable pci device.
+ *
+ * \details This api will be called during resume operation.
+ * This will enable pci device passed as argument.
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ *
+ * \return int
+ */
+static int tc956x_pcie_pm_enable_pci(struct pci_dev *pdev)
+{
+	struct net_device *ndev = dev_get_drvdata(&pdev->dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	int ret = 0;
+
+	DBGPR_FUNC(&(pdev->dev), "---->%s : Port %d %s - PCI Set Power, Enable Device, Restore State & Set Master", __func__, priv->port_num, ndev->name);
+	pci_set_power_state(pdev, PCI_D0);
+	ret = pci_enable_device_mem(pdev);
+	if (ret) {
+		NMSGPR_ERR(&(pdev->dev),
+		"%s: error in calling pci_enable_device_mem", pci_name(pdev));
+		DBGPR_FUNC(&(pdev->dev), "<--%s\n", __func__);
+		return ret;
+	}
+	pci_restore_state(pdev);
+	pci_set_master(pdev);
+	DBGPR_FUNC(&(pdev->dev), "<----%s : Port %d %s - PCI Set Power, Enable Device, Restore State & Set Master", __func__, priv->port_num, ndev->name);
+	return ret;
+}
+
+/*!
+ * \brief API to extract child pci devices.
+ *
+ * \details This api will be called during suspend and resume operation.
+ * This will find pci child devices by getting parent device of argument pci device.
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ * \param[in] state - identify SUSPEND and RESUME operation.
+ *
+ * \return int
+ */
+static int tc956x_pcie_pm_pci(struct pci_dev *pdev, enum TC956X_PORT_PM_STATE state)
+{
+	static struct pci_dev *tc956x_pd = NULL, *tc956x_dsp_ep = NULL, *tc956x_port_pdev[2] = {NULL};
+	struct pci_bus *bus = NULL;
+	int ret = 0, i = 0, p = 0;
+	struct net_device *ndev = dev_get_drvdata(&pdev->dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+
+	if (tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt == TC956X_ALL_MAC_PORT_SUSPENDED) {
+		tc956x_dsp_ep = pci_upstream_bridge(pdev);
+		bus = tc956x_dsp_ep->subordinate;
+
+		if (bus)
+			list_for_each_entry(tc956x_pd, &bus->devices, bus_list)
+		tc956x_port_pdev[i++] = tc956x_pd;
+
+		for (p = 0; ((p < i) && (tc956x_port_pdev[p] != NULL)); p++) {
+			/* Enter only if at least 1 Port Suspended */
+			if (state == SUSPEND) {
+				ret = tc956x_pcie_pm_disable_pci(tc956x_port_pdev[p]);
+				if (ret < 0)
+					goto err;
+			} else if (state == RESUME) {
+				ret = tc956x_pcie_pm_enable_pci(tc956x_port_pdev[p]);
+				if (ret < 0)
+					goto err;
+			}
+		}
+	}
+err:
+	return ret;
+}
+
+/*!
+ * \brief Routine to put the device in suspend mode
+ *
+ * \details This function is called whenever pm_generic_suspend() gets invoked.
+ * This function invokes tc956xmac_suspend() to process MAC related suspend
+ * operations during PORT_WIDE suspend.
+ * This function handles PCI state during SYSTEM_WIDE suspend.
+ *
+ * \param[in] dev \96 pointer to device structure.
+ *
+ * \return int
+ *
+ * \retval 0
+ */
+static int tc956x_pcie_suspend(struct device *dev)
+{
+	struct pci_dev *pdev = to_pci_dev(dev);
+	struct net_device *ndev = dev_get_drvdata(&pdev->dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	int ret = 0;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	u8 i;
+	u32 val;
+#endif
+
+	DBGPR_FUNC(&(pdev->dev), "-->%s\n", __func__);
+	if (priv->tc956x_port_pm_suspend == true) {
+		DBGPR_FUNC(&(pdev->dev), "<--%s : Port %d interface %s already Suspended\n", __func__, priv->port_num, priv->dev->name);
+		return -1;
+	}
+	/* Set flag to avoid queuing any more work */
+	priv->tc956x_port_pm_suspend = true;
+
+	mutex_lock(&tc956x_pm_suspend_lock);
+
+	/* Decrement device usage counter */
+	tc956xmac_pm_usage_counter--;
+	tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt--;
+	DBGPR_FUNC(&(pdev->dev), "%s : (Number of Ports Left to Suspend = [%d])\n", __func__, tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt);
+
+	/* Call tc956xmac_suspend() */
+#ifdef TC956X_SRIOV_PF
+	tc956xmac_suspend(&pdev->dev);
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	if (tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt == TC956X_ALL_MAC_PORT_SUSPENDED) {
+		DBGPR_FUNC(&(pdev->dev), "%s : Port %d %s - Tamap Configuration", __func__, priv->port_num, priv->dev->name);
+		/* Since TAMAP is common for Port0 and Port1,
+		 * Store CM3 TAMAP entries of one Port0
+		 */
+		for (i = 1; i <= MAX_CM3_TAMAP_ENTRIES; i++) {
+			priv->cm3_tamap[i-1].valid = false;
+
+			val = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + TC956X_AXI4_SLV_SRC_ADDR_LO(0, i));
+			if (((val & TC956X_ATR_SIZE_MASK) >> TC956x_ATR_SIZE_SHIFT) != 0x3F) {
+				priv->cm3_tamap[i-1].trsl_addr_hi = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+									TC956X_AXI4_SLV_TRSL_ADDR_HI(0, i));
+				priv->cm3_tamap[i-1].trsl_addr_low = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+									TC956X_AXI4_SLV_TRSL_ADDR_LO(0, i));
+				priv->cm3_tamap[i-1].src_addr_hi = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+									TC956X_AXI4_SLV_SRC_ADDR_HI(0, i));
+				priv->cm3_tamap[i-1].src_addr_low = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+									TC956X_AXI4_SLV_SRC_ADDR_LO(0, i)) & TC956X_SRC_LO_MASK;
+				priv->cm3_tamap[i-1].atr_size = (readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+									TC956X_AXI4_SLV_SRC_ADDR_LO(0, i)) & TC956X_ATR_SIZE_MASK) >> TC956x_ATR_SIZE_SHIFT;
+				priv->cm3_tamap[i-1].valid = true;
+			}
+		}
+	}
+#endif
+#elif defined TC956X_SRIOV_VF
+	tc956xmac_vf_suspend(&pdev->dev);
+#endif
+	DBGPR_FUNC(&(pdev->dev), "%s : Port %d %s- Platform Suspend", __func__, priv->port_num, priv->dev->name);
+#ifdef TC956X_SRIOV_PF
+	ret = tc956x_platform_suspend(priv);
+	if (ret) {
+		NMSGPR_ERR(&(pdev->dev), "%s: error in calling tc956x_platform_suspend", pci_name(pdev));
+		goto err;
+	}
+#endif
+
+	tc956xmac_pm_set_power(priv, SUSPEND);
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_MAGIC_PACKET_WOL_GPIO
+	if (priv->port_num == RM_PF0_ID) {
+		KPRINT_INFO("%s: Port %d %s - Configuring GPIO for WOL", __func__, priv->port_num, priv->dev->name);
+		tc956x_wol_gpio_trigger(priv->ioaddr, true); /* Set to HIGH */
+	}
+#endif
+#endif
+	ret = tc956x_pcie_pm_pci(pdev, SUSPEND);
+	if (ret < 0)
+		goto err;
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	if (priv->wol_config_enabled == true) {
+		/* Set Flag to configure original interface and speed after resume. */
+		priv->wol_config_enabled = false; /* Note: QC can place this either at end of suspend or beginning of resume */
+		KPRINT_INFO("%s Port %d %s : Updated flag priv->wol_config_enabled to %d", __func__, priv->port_num, priv->dev->name, priv->wol_config_enabled);
+	}
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+#endif
+err:
+	mutex_unlock(&tc956x_pm_suspend_lock);
+	DBGPR_FUNC(&(pdev->dev), "<--%s\n", __func__);
+	return ret;
+}
+
+#ifndef TC956X_SRIOV_VF
+/*!
+ * \brief Routine to configure device during resume
+ *
+ * \details This function gets called by PCI core when the device is being
+ * resumed. It is always called after suspend has been called. These function
+ * reverse operations performed at suspend time. This function configure emac
+ * port 0, 1 and xpcs to perform MAC realted resume operations.
+ *
+ * \param[in] pdev pointer to pci device structure.
+ *
+ * \return s32
+ *
+ * \retval 0
+ */
+#ifdef TC956X
+static int tc956x_pcie_resume_config(struct pci_dev *pdev)
+{
+	struct net_device *ndev = dev_get_drvdata(&pdev->dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	/* use signal from MSPHY */
+	uint8_t SgmSigPol = 0;
+	int ret = 0;
+
+	DBGPR_FUNC(&(pdev->dev), "---> %s", __func__);
+	/* Skip Config when Port unavailable */
+	if ((priv->plat->phy_addr == -1) || (priv->mii == NULL)) {
+		DBGPR_FUNC(&(pdev->dev), "%s : Invalid PHY Address (%d)\n", __func__, priv->plat->phy_addr);
+		ret = -1;
+		goto err_phy_addr;
+	}
+
+	if (priv->port_num == RM_PF0_ID) {
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET);
+
+		/* Assertion of EMAC Port0 software Reset */
+		ret |= NRSTCTRL0_MAC0RST;
+
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET);
+
+		NMSGPR_ALERT(&pdev->dev, "Enabling all eMAC clocks for Port 0 %s\n", priv->dev->name);
+		/* Enable all clocks to eMAC Port0 */
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET);
+
+		ret |= ((NCLKCTRL0_MAC0TXCEN | NCLKCTRL0_MAC0ALLCLKEN | NCLKCTRL0_MAC0RXCEN));
+		if ((priv->port_interface == ENABLE_SGMII_INTERFACE) ||
+			(priv->port_interface == ENABLE_2500BASE_X_INTERFACE)) {
+			/* Disable Clocks for 2.5Gbps SGMII */
+			ret &= ~NCLKCTRL0_POEPLLCEN;
+			ret &= ~NCLKCTRL0_SGMPCIEN;
+			ret &= ~NCLKCTRL0_REFCLKOCEN;
+			ret &= ~NCLKCTRL0_MAC0125CLKEN;
+			ret &= ~NCLKCTRL0_MAC0312CLKEN;
+		}
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET);
+
+		/* Interface configuration for port0*/
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NEMAC0CTL_OFFSET);
+		ret &= ~(NEMACCTL_SP_SEL_MASK | NEMACCTL_PHY_INF_SEL_MASK);
+		if ((priv->port_interface == ENABLE_SGMII_INTERFACE) ||
+			(priv->port_interface == ENABLE_2500BASE_X_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_SGMII_2500M;
+		else if ((priv->port_interface == ENABLE_USXGMII_INTERFACE) ||
+			(priv->port_interface == ENABLE_XFI_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_USXGMII_10G_10G;
+
+		ret &= ~(0x00000040); /* Mask Polarity */
+		if (SgmSigPol == 1)
+			ret |= 0x00000040; /* Set Active low */
+
+		ret |= NEMACCTL_PHY_INF_SEL | NEMACCTL_LPIHWCLKEN;
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NEMAC0CTL_OFFSET);
+
+		/* De-assertion of EMAC Port0  software Reset*/
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET);
+		ret &= ~(NRSTCTRL0_MAC0RST);
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET);
+	}
+
+	if (priv->port_num == RM_PF1_ID) {
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NRSTCTRL1_OFFSET);
+
+		/* Assertion of EMAC Port1 software Reset*/
+		ret |= NRSTCTRL1_MAC1RST1;
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NRSTCTRL1_OFFSET);
+
+		NMSGPR_ALERT(&pdev->dev, "Enabling all eMAC clocks for Port 1 %s\n", priv->dev->name);
+		/* Enable all clocks to eMAC Port1 */
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NCLKCTRL1_OFFSET);
+
+		ret |= ((NCLKCTRL1_MAC1TXCEN | NCLKCTRL1_MAC1RXCEN |
+		NCLKCTRL1_MAC1ALLCLKEN1 | 1 << 15));
+		if ((priv->port_interface == ENABLE_SGMII_INTERFACE) ||
+			(priv->port_interface == ENABLE_2500BASE_X_INTERFACE)) {
+			ret &= ~NCLKCTRL1_MAC1125CLKEN1;
+			ret &= ~NCLKCTRL1_MAC1312CLKEN1;
+		}
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NCLKCTRL1_OFFSET);
+
+		/* Interface configuration for port1*/
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NEMAC1CTL_OFFSET);
+		ret &= ~(NEMACCTL_SP_SEL_MASK | NEMACCTL_PHY_INF_SEL_MASK);
+		if ((priv->port_interface == ENABLE_RGMII_INTERFACE) ||
+			(priv->port_interface == ENABLE_RGMII_ID_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_RGMII_1000M;
+		else if ((priv->port_interface == ENABLE_SGMII_INTERFACE) ||
+			(priv->port_interface == ENABLE_2500BASE_X_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_SGMII_2500M;
+		else if ((priv->port_interface == ENABLE_USXGMII_INTERFACE) ||
+			(priv->port_interface == ENABLE_XFI_INTERFACE))
+			ret |= NEMACCTL_SP_SEL_USXGMII_10G_10G;
+
+		ret &= ~(0x00000040); /* Mask Polarity */
+		if (SgmSigPol == 1)
+			ret |= 0x00000040; /* Set Active low */
+
+		ret |= NEMACCTL_PHY_INF_SEL | NEMACCTL_LPIHWCLKEN;
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NEMAC1CTL_OFFSET);
+
+		/* De-assertion of EMAC Port1  software Reset */
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NRSTCTRL1_OFFSET);
+		ret &= ~NRSTCTRL1_MAC1RST1;
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NRSTCTRL1_OFFSET);
+	}
+
+/*PMA module init*/
+	if (priv->hw->xpcs) {
+
+		if (priv->port_num == RM_PF0_ID) {
+			/* Assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL0_OFFSET);
+			ret |= (NRSTCTRL0_MAC0PMARST | NRSTCTRL0_MAC0PONRST);
+			writel(ret, priv->ioaddr + NRSTCTRL0_OFFSET);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			/* Assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL1_OFFSET);
+			ret |= (NRSTCTRL1_MAC1PMARST1 | NRSTCTRL1_MAC1PONRST1);
+			writel(ret, priv->ioaddr + NRSTCTRL1_OFFSET);
+		}
+
+		ret = tc956x_pma_setup(priv, priv->pmaaddr);
+		if (ret < 0)
+			KPRINT_INFO("PMA switching to internal clock Failed\n");
+
+		if (priv->port_num == RM_PF0_ID) {
+			/* De-assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL0_OFFSET);
+			ret &= ~(NRSTCTRL0_MAC0PMARST | NRSTCTRL0_MAC0PONRST);
+#ifdef EEE_MAC_CONTROLLED_MODE
+			ret &= ~(NRSTCTRL0_MAC0RST | NRSTCTRL0_MAC0RST);
+#endif
+			writel(ret, priv->ioaddr + NRSTCTRL0_OFFSET);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			/* De-assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL1_OFFSET);
+			ret &= ~(NRSTCTRL1_MAC1PMARST1 | NRSTCTRL1_MAC1PONRST1);
+			writel(ret, priv->ioaddr + NRSTCTRL1_OFFSET);
+		}
+
+		if (priv->port_num == RM_PF0_ID) {
+			do {
+				ret = readl(priv->ioaddr + NEMAC0CTL_OFFSET);
+		} while ((NEMACCTL_INIT_DONE & ret) != NEMACCTL_INIT_DONE);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			do {
+				ret = readl(priv->ioaddr + NEMAC1CTL_OFFSET);
+		} while ((NEMACCTL_INIT_DONE & ret) != NEMACCTL_INIT_DONE);
+		}
+#ifndef TC956X_SRIOV_VF
+		ret = tc956x_xpcs_init(priv, priv->xpcsaddr);
+#endif
+		if (ret < 0)
+			KPRINT_INFO("XPCS initialization error\n");
+	}
+
+err_phy_addr:
+	DBGPR_FUNC(&(pdev->dev), "<--- %s", __func__);
+	return ret;
+}
+#endif
+#endif
+/*!
+ * \brief Routine to resume device operation
+ *
+ * \details This function gets called whenever pm_generic_resume() gets invoked.
+ * This function reverse operations performed at suspend time. This function restores the
+ * power state of the device and restores the PCI config space for SYSTEM_WIDE resume.
+ * And it invokes tc956xmac_resume() to perform MAC realted resume operations
+ * for PORT_WIDE resume.
+ *
+ * \param[in] dev pointer to device structure.
+ *
+ * \return int
+ *
+ * \retval 0
+ */
+
+static int tc956x_pcie_resume(struct device *dev)
+{
+	struct pci_dev *pdev = to_pci_dev(dev);
+#ifndef TC956X_SRIOV_VF
+	struct net_device *ndev = dev_get_drvdata(&pdev->dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	u8 i;
+#endif
+#ifdef TC956X_PCIE_GEN3_SETTING
+	u32 val;
+#endif
+#endif
+	int ret = 0;
+
+#ifndef TC956X_SRIOV_VF
+	DBGPR_FUNC(&(pdev->dev), "-->%s\n", __func__);
+	if (priv->tc956x_port_pm_suspend == false) {
+		DBGPR_FUNC(&(pdev->dev), "%s : Port %d %s already Resumed\n", __func__, priv->port_num, priv->dev->name);
+		return -1;
+	}
+#endif
+	mutex_lock(&tc956x_pm_suspend_lock);
+
+#ifndef TC956X_SRIOV_VF
+	ret = tc956x_pcie_pm_enable_pci(pdev);
+	if (ret < 0)
+		goto err;
+
+	tc956xmac_pm_set_power(priv, RESUME);
+
+	/* Restore the GPIO settings which was saved during GPIO configuration */
+	ret = tc956x_gpio_restore_configuration(priv);
+	if (ret < 0)
+		KPRINT_INFO("GPIO configuration restoration failed\n");
+
+	DBGPR_FUNC(&(pdev->dev), "%s : Port %d %s - Platform Resume", __func__, priv->port_num, priv->dev->name);
+	ret = tc956x_platform_resume(priv);
+	if (ret) {
+		NMSGPR_ERR(&(pdev->dev), "%s: error in calling tc956x_platform_resume", pci_name(pdev));
+		pci_disable_device(pdev);
+		goto err;
+	}
+
+#ifdef TC956X_PCIE_GEN3_SETTING
+	if (tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt == TC956X_ALL_MAC_PORT_SUSPENDED) {
+		/* Reset Speed to Gen3 after resume */
+		DBGPR_FUNC(&(pdev->dev), "%s : Port %d %s- Set Speed to Gen3", __func__, priv->port_num, priv->dev->name);
+		val = readl(priv->ioaddr + TC956X_GLUE_EFUSE_CTRL);
+		if ((val & 0x10) == 0) {
+			DBGPR_FUNC(&(pdev->dev), "<--%s : Applying Gen3 setting\n", __func__);
+			/* 0x4002C01C SSREG_GLUE_EFUSE_CTRL.pcie_usp_gen3_disable_efuse_ignore */
+			writel(0x10, priv->ioaddr + TC956X_GLUE_EFUSE_CTRL);
+			/* 0x4002C030 All PHY_COREs are selected */
+			writel(0x0f, priv->ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			/* 0x40028000 All Lanes are selected */
+			writel(0x0f, priv->ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			/* 0x4002B268 PMA_LN_PCS2PMA_PHYMODE_R2.pcs2pma_phymode */
+			writel(0x02, priv->ioaddr + TC956X_PMA_LN_PCS2PMA_PHYMODE_R2);
+		}
+
+		if ((pcie_link_speed >= 1) && (pcie_link_speed <= 3))
+			tc956x_set_pci_speed(pdev, pcie_link_speed);
+	}
+#endif
+#endif
+#ifndef TC956X_SRIOV_VF
+	/* Configure TA map registers */
+
+	if (tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt == TC956X_ALL_MAC_PORT_SUSPENDED) {
+		DBGPR_FUNC(&(pdev->dev), "%s : Tamap Re-configuration", __func__);
+		tc956x_config_tamap(&pdev->dev, priv->tc956x_BRIDGE_CFG_pci_base_addr);
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+		for (i = 1; i <= MAX_CM3_TAMAP_ENTRIES; i++) {
+			if (priv->cm3_tamap[i-1].valid)
+				tc956x_config_CM3_tamap(&pdev->dev, priv->tc956x_BRIDGE_CFG_pci_base_addr,
+							&priv->cm3_tamap[i-1], i);
+		}
+
+#endif
+	}
+
+#ifdef TC956X
+	/* Configure EMAC Port */
+	tc956x_pcie_resume_config(pdev);
+#endif
+#endif
+
+	/* Call tc956xmac_resume() */
+#ifdef TC956X_SRIOV_PF
+	tc956xmac_resume(&pdev->dev);
+	if ((priv->port_num == RM_PF1_ID) && ((priv->port_interface == ENABLE_RGMII_INTERFACE) ||(priv->port_interface == ENABLE_RGMII_ID_INTERFACE))) {
+		writel(NEMACTXCDLY_DEFAULT, priv->ioaddr + TC9563_CFG_NEMACTXCDLY);
+		writel(NEMACIOCTL_DEFAULT, priv->ioaddr + TC9563_CFG_NEMACIOCTL);
+	}
+#elif defined TC956X_SRIOV_VF
+	tc956xmac_vf_resume(&pdev->dev);
+#endif
+
+#ifndef TC956X_SRIOV_VF
+	/* Increment device usage counter */
+	tc956xmac_pm_usage_counter++;
+	tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt++;
+	DBGPR_FUNC(&(pdev->dev), "%s : (Number of Ports Resumed = [%d])\n", __func__, tx956x_pci_shrd_mem[priv->pci_bd].pci_dev_active_cnt);
+
+	priv->tc956x_port_pm_suspend = false;
+
+	/* Queue Work after resume complete to prevent MSI Disable */
+	if (priv->tc956xmac_pm_wol_interrupt) {
+		DBGPR_FUNC(&(pdev->dev), "%s : Clearing WOL and queuing phy work", __func__);
+		/* Clear WOL Interrupt after resume, if WOL enabled */
+		priv->tc956xmac_pm_wol_interrupt = false;
+		/* Queue the work in system_wq */
+		queue_work(system_wq, &priv->emac_phy_work);
+	}
+
+#ifdef TC956X_MAGIC_PACKET_WOL_GPIO
+	if (priv->port_num == RM_PF0_ID) {
+		KPRINT_INFO("%s: Port %d - Configuring GPIO for WOL", __func__, priv->port_num);
+		tc956x_wol_gpio_trigger(priv->ioaddr, false); /* Set to LOW */
+	}
+#endif
+#ifdef TC956X_PCIE_LOGSTAT
+	if (priv->port_num == RM_PF0_ID) {
+#ifdef TC956X_PCIE_LOGSTAT_SUMMARY_ENABLE
+		if ((tc956x_logstat_state_log_summary((void __iomem *)priv->ioaddr, UPSTREAM_PORT) < 0)
+		|| (tc956x_logstat_state_log_summary((void __iomem *)priv->ioaddr, DOWNSTREAM_PORT1) < 0)
+		|| (tc956x_logstat_state_log_summary((void __iomem *)priv->ioaddr, DOWNSTREAM_PORT2) < 0)
+		|| (tc956x_logstat_state_log_summary((void __iomem *)priv->ioaddr, INTERNAL_ENDPOINT) < 0)) {
+			ret = -EFAULT; /* The returns returned by above function are -EFAULT only */
+			NMSGPR_ERR(&(pdev->dev),
+			"%s: error in calling tc956x_logstat_state_log_summary", pci_name(pdev));
+			DBGPR_FUNC(&(pdev->dev), "<--%s : Error ret: %d\n", __func__, ret);
+			goto err_resume_logstat;
+		}
+#endif /* #ifdef TC956X_PCIE_LOGSTAT_SUMMARY_ENABLE */
+		if ((tc956x_logstat_set_state_log_enable((void __iomem *)priv->ioaddr, UPSTREAM_PORT, STATE_LOG_ENABLE) < 0)
+			|| (tc956x_logstat_set_state_log_enable((void __iomem *)priv->ioaddr, DOWNSTREAM_PORT1, STATE_LOG_ENABLE) < 0)
+			|| (tc956x_logstat_set_state_log_enable((void __iomem *)priv->ioaddr, DOWNSTREAM_PORT2, STATE_LOG_ENABLE) < 0)
+			|| (tc956x_logstat_set_state_log_enable((void __iomem *)priv->ioaddr, INTERNAL_ENDPOINT, STATE_LOG_ENABLE) < 0)) {
+			ret = -EFAULT; /* The returns returned by above function are -EFAULT only */
+			NMSGPR_ERR(&(pdev->dev),
+			"%s: error in calling tc956x_logstat_set_state_log_enable", pci_name(pdev));
+			DBGPR_FUNC(&(pdev->dev), "<--%s : Error ret: %d\n", __func__, ret);
+			goto err_resume_logstat;
+		}
+	}
+#endif /* TC956X_PCIE_LOGSTAT */
+#endif
+	DBGPR_FUNC(&(pdev->dev), "<--%s\n", __func__);
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X_PCIE_LOGSTAT
+err_resume_logstat:
+#endif /* TC956X_PCIE_LOGSTAT */
+#endif /* TC956X_SRIOV_VF */
+#ifndef TC956X_SRIOV_VF
+err:
+#endif
+	mutex_unlock(&tc956x_pm_suspend_lock);
+	DBGPR_FUNC(&(pdev->dev), "<--%s\n", __func__);
+
+	return ret;
+}
+
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_MAGIC_PACKET_WOL_GPIO
+/*!
+ * \brief API to signal SUSPEND/RESUME to external Host Triggering Device.
+ *
+ * \details This is a api to configure GPIO04 and set its output value
+ * based on mode to (HIGH/LOW) passed as argument.
+ *
+ * \param[in] reg_base_addr - pointer to BAR 4 base address.
+ * \param[in] mode - true or false
+ */
+static void tc956x_wol_gpio_trigger(void __iomem *reg_base_addr, bool mode)
+{
+	u32 reg;
+
+	KPRINT_INFO("-->%s\n", __func__);
+	/* Set GPIO to Function.0*/
+	reg = readl(reg_base_addr + NFUNCEN4_OFFSET);
+	reg &= (~(BIT(4)));
+	writel(reg, reg_base_addr + NFUNCEN4_OFFSET);
+	KPRINT_INFO("%s: Setting GPIO04 to Function 0 (%x:%x)\n", __func__,
+		NFUNCEN4_OFFSET, readl(reg_base_addr + NFUNCEN4_OFFSET));
+
+	/* GPIO04:OUT Enable*/
+	reg = readl(reg_base_addr + GPIOE0_OFFSET);
+	reg = (reg & ~(BIT(4)));
+	writel(reg, reg_base_addr + GPIOE0_OFFSET);
+	KPRINT_INFO("%s: Setting GPIO04 Direction to Out Enable (%x:%x)\n", __func__,
+		GPIOE0_OFFSET, readl(reg_base_addr + GPIOE0_OFFSET));
+
+	reg = readl(reg_base_addr + GPIOO0_OFFSET);
+	if (!mode) { /* Set GPIO04 to LOW */
+		KPRINT_INFO("%s: Setting GPIO04 to LOW\n", __func__);
+		reg &= (~(BIT(4)));
+	} else { /* Set GPIO04 to HIGH */
+		KPRINT_INFO("%s: Setting GPIO04 to HIGH\n", __func__);
+		reg |= (BIT(4));
+	}
+	writel(reg, reg_base_addr + GPIOO0_OFFSET);
+	KPRINT_INFO("%s: Setting GPIO04 Value (%x:%x)\n", __func__,
+		GPIOO0_OFFSET, readl(reg_base_addr + GPIOO0_OFFSET));
+	KPRINT_INFO("<--%s\n", __func__);
+}
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_GPIO */
+#endif /* TC956X_SRIOV_PF */
+/*!
+ * \brief API to shutdown the device.
+ *
+ * \details This is a dummy implementation for the shutdown feature of the
+ * pci_driver structure.
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ */
+static void tc956x_pcie_shutdown(struct pci_dev *pdev)
+{
+#ifdef TC956X_SRIOV_VF
+	tc956xmac_vf_dvr_remove(&pdev->dev);
+#endif
+
+	DBGPR_FUNC(&(pdev->dev), "-->%s\n", __func__);
+	NMSGPR_ALERT(&(pdev->dev), "Handle the shutdown\n");
+	DBGPR_FUNC(&(pdev->dev), "<--%s\n", __func__);
+}
+
+/**
+ * tc956x_pcie_error_detected
+ *
+ * \brief Function is called when PCI AER kernel module detects an error.
+ *
+ * \details This is a dummy implementation for the callback registration
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ *
+ * \param[in] state - PCI error state.
+ *
+ * \return Error recovery state
+ */
+static pci_ers_result_t tc956x_pcie_error_detected(struct pci_dev *pdev,
+						pci_channel_state_t state)
+{
+	NMSGPR_ERR(&(pdev->dev), "PCI AER Error detected : %d\n", state);
+
+	/* No further error recovery to be carried out */
+	return PCI_ERS_RESULT_DISCONNECT;
+}
+
+/**
+ * tc956x_pcie_slot_reset
+ *
+ * \brief Function is called when PCI AER kernel module issues an slot reset.
+ *
+ * \details This is a dummy implementation for the callback registration
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ *
+ * \return Error recovery state
+ */
+static pci_ers_result_t tc956x_pcie_slot_reset(struct pci_dev *pdev)
+{
+	NMSGPR_ERR(&(pdev->dev), "PCI AER Slot reset Invoked\n");
+
+	/* No further error recovery to be carried out */
+	return PCI_ERS_RESULT_DISCONNECT;
+}
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+/**
+ * tc956x_pcie_reset_prepare
+ *
+ * \brief Function is called when PCI FLR issued
+ *
+ * \details This is a implementation for the device close
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ *
+ * \return None
+ */
+static void tc956x_pcie_reset_prepare(struct pci_dev *pdev)
+{
+	struct net_device *ndev = dev_get_drvdata(&pdev->dev);
+#ifdef TC956X_SRIOV_PF
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+#endif
+
+	/* Invoke device driver close */
+	if (netif_running(ndev)) {
+		rtnl_lock();
+		dev_close(ndev);
+		rtnl_unlock();
+	}
+
+#ifdef TC956X_SRIOV_PF
+	tc956x_mbx_wrap_pf_flr(priv);
+#endif
+}
+
+/**
+ * tc956x_pcie_reset_done
+ *
+ * \brief Function is called when PCI FLR issued
+ *
+ * \details This is a implementation for the device open
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ *
+ * \return None
+ */
+static void tc956x_pcie_reset_done(struct pci_dev *pdev)
+{
+	struct net_device *ndev = dev_get_drvdata(&pdev->dev);
+
+#ifdef TC956X_SRIOV_PF
+	/* Configure EMAC Port */
+	tc956x_pcie_resume_config(pdev);
+#endif
+
+	/* Invoke device driver open */
+	if (!netif_running(ndev)) {
+		rtnl_lock();
+		dev_open(ndev, NULL);
+		rtnl_unlock();
+	}
+}
+
+#endif
+
+/**
+ * tc956x_pcie_io_resume
+ *
+ * \brief Function is called when PCI AER kernel module requests for
+ *	  device to resume.
+ *
+ * \details This is a dummy implementation for the callback registration
+ *
+ * \param[in] pdev - pointer to pci_dev structure.
+ *
+ * \return void
+ */
+static void tc956x_pcie_io_resume(struct pci_dev *pdev)
+{
+	NMSGPR_ERR(&(pdev->dev), "PCI AER Resume Invoked\n");
+}
+
+/* PCI AER Error handlers */
+static struct pci_error_handlers tc956x_err_handler = {
+	.error_detected = tc956x_pcie_error_detected,
+	.slot_reset = tc956x_pcie_slot_reset,
+	.resume = tc956x_pcie_io_resume,
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+	.reset_prepare = tc956x_pcie_reset_prepare,
+	.reset_done = tc956x_pcie_reset_done,
+#endif
+};
+
+/* synthetic ID, no official vendor */
+#define PCI_VENDOR_ID_TC956XMAC 0x700
+
+#define TC956XMAC_QUARK_ID  0x0937
+#define TC956XMAC_DEVICE_ID 0x1108
+#define TC956XMAC_EHL_RGMII1G_ID	0x4b30
+#define TC956XMAC_EHL_SGMII1G_ID	0x4b31
+#define TC956XMAC_TGL_SGMII1G_ID	0xa0ac
+#define TC956XMAC_GMAC5_ID		0x7102
+#define TC956XMAC_XGMAC3_10G	0x7203
+#define TC956XMAC_XGMAC3_2_5G	0x7207
+#define TC956XMAC_XGMAC3_2_5G_MDIO	0x7211
+
+#define TC956XMAC_DEVICE(vendor_id, dev_id, info)	{	\
+	PCI_VDEVICE(vendor_id, dev_id),			\
+	.driver_data = (kernel_ulong_t)&info		\
+	}
+
+static const struct pci_device_id tc956xmac_id_table[] = {
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	TC956XMAC_DEVICE(TC956XMAC, TC956XMAC_DEVICE_ID, tc956xmac_pci_info),
+	TC956XMAC_DEVICE(STMICRO, PCI_DEVICE_ID_STMICRO_MAC, tc956xmac_pci_info),
+	TC956XMAC_DEVICE(INTEL, TC956XMAC_QUARK_ID, quark_pci_info),
+	TC956XMAC_DEVICE(INTEL, TC956XMAC_EHL_RGMII1G_ID, ehl_rgmii1g_pci_info),
+	TC956XMAC_DEVICE(INTEL, TC956XMAC_EHL_SGMII1G_ID, ehl_sgmii1g_pci_info),
+	TC956XMAC_DEVICE(INTEL, TC956XMAC_TGL_SGMII1G_ID, tgl_sgmii1g_pci_info),
+	TC956XMAC_DEVICE(SYNOPSYS, TC956XMAC_GMAC5_ID, snps_gmac5_pci_info),
+	TC956XMAC_DEVICE(SYNOPSYS, TC956XMAC_XGMAC3_10G, tc956xmac_xgmac3_pci_info),
+	TC956XMAC_DEVICE(SYNOPSYS, TC956XMAC_XGMAC3_2_5G, tc956xmac_xgmac3_2_5g_pci_info),
+	TC956XMAC_DEVICE(SYNOPSYS, TC956XMAC_XGMAC3_2_5G_MDIO,
+		      tc956xmac_xgmac3_2_5g_mdio_pci_info),
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+#ifdef TC956X
+	TC956XMAC_DEVICE(TOSHIBA, DEVICE_ID, tc956xmac_xgmac3_pci_info),
+#endif
+	{}
+};
+MODULE_DEVICE_TABLE(pci, tc956xmac_id_table);
+
+static SIMPLE_DEV_PM_OPS(tc956xmac_pm_ops, tc956x_pcie_suspend, tc956x_pcie_resume);
+
+static struct pci_driver tc956xmac_pci_driver = {
+	.name = TC956X_RESOURCE_NAME,
+	.id_table = tc956xmac_id_table,
+	.probe = tc956xmac_pci_probe,
+	.remove = tc956xmac_pci_remove,
+	.shutdown	= tc956x_pcie_shutdown,
+	.driver		= {
+		.name		= TC956X_RESOURCE_NAME,
+		.owner		= THIS_MODULE,
+		.pm		= &tc956xmac_pm_ops,
+	},
+	.err_handler = &tc956x_err_handler
+};
+
+
+/*!
+ * \brief API to register the driver.
+ *
+ * \details This is the first function called when the driver is loaded.
+ * It register the driver with PCI sub-system
+ *
+ * \return void.
+ */
+static s32 __init tc956x_init_module(void)
+{
+	s32 ret = 0;
+
+	KPRINT_INFO("%s", __func__);
+	ret = pci_register_driver(&tc956xmac_pci_driver);
+	if (ret) {
+		KPRINT_INFO("TC956X : Driver registration failed");
+		return ret;
+	}
+
+	tc956xmac_init();
+	KPRINT_INFO("%s", __func__);
+	return ret;
+}
+
+/*!
+ * \brief API to unregister the driver.
+ *
+ * \details This is the first function called when the driver is removed.
+ * It unregister the driver from PCI sub-system
+ *
+ * \return void.
+ */
+static void __exit tc956x_exit_module(void)
+{
+	KPRINT_INFO("%s", __func__);
+	pci_unregister_driver(&tc956xmac_pci_driver);
+	tc956xmac_exit();
+	KPRINT_INFO("%s", __func__);
+}
+
+/*!
+ * \brief Macro to register the driver registration function.
+ *
+ * \details A module always begin with either the init_module or the function
+ * you specify with module_init call. This is the entry function for modules;
+ * it tells the kernel what functionality the module provides and sets up the
+ * kernel to run the module's functions when they're needed. Once it does this,
+ * entry function returns and the module does nothing until the kernel wants
+ * to do something with the code that the module provides.
+ */
+module_init(tc956x_init_module);
+
+/*!
+ * \brief Macro to register the driver un-registration function.
+ *
+ * \details All modules end by calling either cleanup_module or the function
+ * you specify with the module_exit call. This is the exit function for modules;
+ * it undoes whatever entry function did. It unregisters the functionality
+ * that the entry function registered.
+ */
+module_exit(tc956x_exit_module);
+#ifndef TC956X_SRIOV_VF
+#ifdef CONFIG_PCI_IOV
+/* Input parameter for No of virtural functions to Enable per VF.
+ * tc956x_no_of_vf - Valid vlaues are 0 to 3.
+ */
+module_param(tc956x_no_of_vf, int, MOD_PARAM_ACCESS);
+#endif
+
+#ifdef TC956X_PCIE_GEN3_SETTING
+module_param(pcie_link_speed, uint, 0444);
+MODULE_PARM_DESC(pcie_link_speed,
+		 "PCIe speed Gen TC956X - default is 3, [1..3]");
+#endif
+#endif
+
+#if defined(TC956X_SRIOV_PF)
+module_param(mac0_interface, uint, 0444);
+MODULE_PARM_DESC(mac0_interface,
+		 "PORT0 interface mode TC956X - default is 1,\
+		 [0: USXGMII, 1: XFI, 2: RGMII(not supported), 3: SGMII, 4: 2500Base-X]");
+
+module_param(mac1_interface, uint, 0444);
+MODULE_PARM_DESC(mac1_interface,
+		 "PORT1 interface mode TC956X - default is 3,\
+		 [0: USXGMII, 1: XFI, 2: RGMII, 3: SGMII, 4: 2500Base-X]");
+
+module_param(mac0_filter_phy_pause, uint, 0444);
+MODULE_PARM_DESC(mac0_filter_phy_pause,
+		 "Filter PHY pause frames alone and pass Link partner pause frames to application in PORT0 - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac1_filter_phy_pause, uint, 0444);
+MODULE_PARM_DESC(mac1_filter_phy_pause,
+		 "Filter PHY pause frames alone and pass Link partner pause frames to application in PORT1 - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac0_eee_enable, uint, 0444);
+MODULE_PARM_DESC(mac0_eee_enable,
+		 "Enable/Disable EEE for Port 0 - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac0_lpi_timer, uint, 0444);
+MODULE_PARM_DESC(mac0_lpi_timer,
+		 "LPI Automatic Entry Timer for Port 0 - default is 600 (us),\
+		 [Range Supported : 0..1048568 (us)]");
+
+module_param(mac1_eee_enable, uint, 0444);
+MODULE_PARM_DESC(mac1_eee_enable,
+		 "Enable/Disable EEE for Port 1 - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac1_lpi_timer, uint, 0444);
+MODULE_PARM_DESC(mac1_lpi_timer,
+		 "LPI Automatic Entry Timer for Port 1 - default is 600 (us),\
+		 [Range Supported : 0..1048568 (us)]");
+
+module_param(mac0_rxq0_size, uint, 0444);
+MODULE_PARM_DESC(mac0_rxq0_size,
+		 "Rx Queue-0 size of Port 0 - default is 18432 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+
+module_param(mac0_rxq1_size, uint, 0444);
+#ifdef TC956X_CPE_CONFIG
+MODULE_PARM_DESC(mac0_rxq1_size,
+		 "Rx Queue-1 size of Port 0 - default is 18432 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+#else
+MODULE_PARM_DESC(mac0_rxq1_size,
+		 "Rx Queue-1 size of Port 0 - default is 4096 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+#endif
+module_param(mac0_rxq0_rfd, uint, 0444);
+MODULE_PARM_DESC(mac0_rxq0_rfd,
+		 "Flow control thresholds for Rx Queue-0 of Port 0  for disable - default is 24 (13KB) \
+		 [Range Supported : 0..84]");
+
+module_param(mac0_rxq1_rfd, uint, 0444);
+MODULE_PARM_DESC(mac0_rxq1_rfd,
+		 "Flow control thresholds for Rx Queue-1 of Port 0 for disable - default is 24 (13KB)\
+		 [Range Supported : 0..84]");
+
+module_param(mac0_rxq0_rfa, uint, 0444);
+MODULE_PARM_DESC(mac0_rxq0_rfa,
+		 "Flow control thresholds for Rx Queue-0 of Port 0 for enable - default is 24 (13KB) \
+		 [Range Supported : 0..84]");
+
+module_param(mac0_rxq1_rfa, uint, 0444);
+MODULE_PARM_DESC(mac0_rxq1_rfa,
+		 "Flow control thresholds for Rx Queue-1 of Port 0 for enable - default is 24 (13KB)\
+		 [Range Supported : 0..84]");
+
+module_param(mac0_txq0_size, uint, 0444);
+MODULE_PARM_DESC(mac0_txq0_size,
+		 "Tx Queue-0 size of Port 0 - default is 18432 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+
+module_param(mac0_txq1_size, uint, 0444);
+#ifdef TC956X_CPE_CONFIG
+MODULE_PARM_DESC(mac0_txq1_size,
+		 "Tx Queue-1 size of Port 0 - default is 18432 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+#else
+MODULE_PARM_DESC(mac0_txq1_size,
+		 "Tx Queue-1 size of Port 0 - default is 14336 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+#endif
+module_param(mac1_rxq0_size, uint, 0444);
+MODULE_PARM_DESC(mac1_rxq0_size,
+		 "Rx Queue-0 size of Port 1 - default is 18432 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+
+module_param(mac1_rxq1_size, uint, 0444);
+MODULE_PARM_DESC(mac1_rxq1_size,
+		 "Rx Queue-1 size of Port 1 - default is 4096 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+
+module_param(mac1_rxq0_rfd, uint, 0444);
+MODULE_PARM_DESC(mac1_rxq0_rfd,
+		 "Flow control thresholds for Rx Queue-0 of Port 1 for disable - default is 24 (13KB) \
+		 [Range Supported : 0..84]");
+
+module_param(mac1_rxq1_rfd, uint, 0444);
+MODULE_PARM_DESC(mac1_rxq1_rfd,
+		 "Flow control thresholds for Rx Queue-1 of Port 1 for disable - default is 24 (13KB)\
+		 [Range Supported : 0..84]");
+
+module_param(mac1_rxq0_rfa, uint, 0444);
+MODULE_PARM_DESC(mac1_rxq0_rfa,
+		 "Flow control thresholds for Rx Queue-0 of Port 1  for enable - default is 24 (13KB) \
+		 [Range Supported : 0..84]");
+
+module_param(mac1_rxq1_rfa, uint, 0444);
+MODULE_PARM_DESC(mac1_rxq1_rfa,
+		 "Flow control thresholds for Rx Queue-1 of Port 1 for enable - default is 24 (13KB)\
+		 [Range Supported : 0..84]");
+
+module_param(mac1_txq0_size, uint, 0444);
+MODULE_PARM_DESC(mac1_txq0_size,
+		 "Tx Queue-0 size of Port 1 - default is 18432 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+
+module_param(mac1_txq1_size, uint, 0444);
+MODULE_PARM_DESC(mac1_txq1_size,
+		 "Tx Queue-1 size of Port 1 - default is 14336 (bytes),\
+		 [Range Supported : 3072..44032 (bytes)]");
+
+module_param(mac0_en_lp_pause_frame_cnt, uint, 0444);
+MODULE_PARM_DESC(mac0_en_lp_pause_frame_cnt,
+		 "Enable counter to count Link Partner pause frames in PORT0 - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac1_en_lp_pause_frame_cnt, uint, 0444);
+MODULE_PARM_DESC(mac1_en_lp_pause_frame_cnt,
+		 "Enable counter to count Link Partner pause frames in PORT1 - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac0_force_speed_mode, uint, 0444);
+MODULE_PARM_DESC(mac0_force_speed_mode,
+		 "Enable MAC0 force speed mode - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac0_force_config_speed, uint, 0444);
+MODULE_PARM_DESC(mac0_force_config_speed,
+		 "Configure MAC0 force speed - default is 3,\
+		 [0: 10G, 1: 5G, 2: 2.5G, 3: 1G, 4: 100M, 5: 10M]");
+
+module_param(mac1_force_speed_mode, uint, 0444);
+MODULE_PARM_DESC(mac1_force_speed_mode,
+		 "Enable MAC1 force speed mode - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac1_force_config_speed, uint, 0444);
+MODULE_PARM_DESC(mac1_force_config_speed,
+		 "Configure MAC1 force speed - default is 3,\
+		 [0: 10G, 1: 5G, 2: 2.5G, 3: 1G, 4: 100M, 5: 10M]");
+
+module_param(mac_power_save_at_link_down, uint, 0444);
+MODULE_PARM_DESC(mac_power_save_at_link_down,
+		 "Enable Power saving during Link down - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(port0_mdc, uint, 0444);
+MODULE_PARM_DESC(port0_mdc,
+		 "PORT0 MDC clock setting - default is 0x4,\
+		 select the value based on the following MDIO clock settings:\
+		 [0x0 - clk_csr_i/4,\
+		 0x1 - clk_csr_i/6,\
+		 0x2 - clk_csr_i/8,\
+		 0x3 - clk_csr_i/10,\
+		 0x4 - clk_csr_i/12,\
+		 0x5 - clk_csr_i/14,\
+		 0x6 - clk_csr_i/16,\
+		 0x7 - clk_csr_i/18,\
+		 0x8 - clk_csr_i/62,\
+		 0x9 - clk_csr_i/102,\
+		 0xA - clk_csr_i/122,\
+		 0xB - clk_csr_i/142,\
+		 0xC - clk_csr_i/162,\
+		 0xD - clk_csr_i/202]");
+
+module_param(port0_c45_state, int, 0444);
+MODULE_PARM_DESC(port0_c45_state,
+		 "PORT0 phy driver clause setting - default is 1 (true),\
+		 [1 - true, 0 - false]");
+
+module_param(port1_mdc, uint, 0444);
+MODULE_PARM_DESC(port1_mdc,
+		 "PORT1 MDC clock setting - default is 0x8,\
+		 select the value based on the following MDIO clock settings:\
+		 [0x0 - clk_csr_i/4,\
+		 0x1 - clk_csr_i/6,\
+		 0x2 - clk_csr_i/8,\
+		 0x3 - clk_csr_i/10,\
+		 0x4 - clk_csr_i/12,\
+		 0x5 - clk_csr_i/14,\
+		 0x6 - clk_csr_i/16,\
+		 0x7 - clk_csr_i/18,\
+		 0x8 - clk_csr_i/62,\
+		 0x9 - clk_csr_i/102,\
+		 0xA - clk_csr_i/122,\
+		 0xB - clk_csr_i/142,\
+		 0xC - clk_csr_i/162,\
+		 0xD - clk_csr_i/202]");
+
+module_param(port1_c45_state, int, 0444);
+MODULE_PARM_DESC(port1_c45_state,
+		 "PORT1 phy driver clause setting - default is 0 (false),\
+		 [1 - true, 0 - false]");
+
+module_param(port0_phyaddr, uint, 0444);
+MODULE_PARM_DESC(port0_phyaddr,
+		 "PORT0 Phy device addr for phy detection, default is 0,\
+		 [0 to 31]");
+
+module_param(port1_phyaddr, uint, 0444);
+MODULE_PARM_DESC(port1_phyaddr,
+		 "PORT1 Phy device addr for phy detection, default is 0,\
+		 [0 to 31]");
+
+module_param(mac0_link_down_macrst, uint, 0444);
+MODULE_PARM_DESC(mac0_link_down_macrst,
+		 "MAC0 reset for PHY Clock loss during Link Down - default is 1,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac1_link_down_macrst, uint, 0444);
+MODULE_PARM_DESC(mac1_link_down_macrst,
+		 "MAC1 reset for PHY Clock loss during Link Down - default is 0,\
+		 [0: DISABLE, 1: ENABLE]");
+
+module_param(mac0_tx_pbl, int, 0444);
+MODULE_PARM_DESC(mac0_tx_pbl,
+		"Port-0 Transmit Programmable Burst Length, default is 16,\
+		Supports following values: 1, 2, 4, 8, 16, or 32.");
+
+module_param(mac0_rx_pbl, int, 0444);
+MODULE_PARM_DESC(mac0_rx_pbl,
+		"Port-0 Receive Programmable Burst Length, default is 16,\
+		Supports following values: 1, 2, 4, 8, 16, or 32.");
+
+module_param(mac1_tx_pbl, int, 0444);
+MODULE_PARM_DESC(mac1_tx_pbl,
+		"Port-1 Transmit Programmable Burst Length, default is 16,\
+		Supports following values: 1, 2, 4, 8, 16, or 32.");
+
+module_param(mac1_rx_pbl, int, 0444);
+MODULE_PARM_DESC(mac1_rx_pbl,
+		"Port-1 Receive Programmable Burst Length, default is 16,\
+		Supports following values: 1, 2, 4, 8, 16, or 32.");
+
+#ifdef TC956X_PCIE_LINK_STATE_LATENCY_CTRL
+module_param(ep_l0s_delay, uint, 0444);
+MODULE_PARM_DESC(ep_l0s_delay,
+		"L0s Link state change delay configuration for\
+		Internal Endpoint\
+		Range: 1-31");
+
+module_param(ep_l1_delay, uint, 0444);
+MODULE_PARM_DESC(ep_l1_delay,
+		"L1 Link state change delay configuration for\
+		Internal Endpoint\
+		Range: 1-1023");
+#endif
+
+module_param(mac0_axi_wr_osr_lmt, uint, 0444);
+MODULE_PARM_DESC(mac0_axi_wr_osr_lmt,
+		"Port-0 AXI Maximum Write Outstanding Request Limit");
+
+module_param(mac0_axi_rd_osr_lmt, uint, 0444);
+MODULE_PARM_DESC(mac0_axi_rd_osr_lmt,
+		"Port-0 AXI Maximum Read Outstanding Request Limit");
+
+module_param(mac1_axi_wr_osr_lmt, uint, 0444);
+MODULE_PARM_DESC(mac1_axi_wr_osr_lmt,
+		"Port-1 AXI Maximum Write Outstanding Request Limit");
+
+module_param(mac1_axi_rd_osr_lmt, uint, 0444);
+MODULE_PARM_DESC(mac1_axi_rd_osr_lmt,
+		"Port-1 AXI Maximum Read Outstanding Request Limit");
+
+module_param(mac0_axi_blen, uint, 0444);
+MODULE_PARM_DESC(mac0_axi_blen,
+		"Port-0 AXI DMA Burst Length\
+		Supported values: 4,8,16,32,64,128,256");
+
+module_param(mac1_axi_blen, uint, 0444);
+MODULE_PARM_DESC(mac1_axi_blen,
+		"Port-1 AXI DMA Burst Length\
+		Supported values: 4,8,16,32,64,128,256");
+
+#endif
+MODULE_DESCRIPTION("TC956X PCI Express Ethernet Network Driver");
+MODULE_AUTHOR("Toshiba Electronic Devices & Storage Corporation");
+MODULE_LICENSE("GPL v2");
+MODULE_VERSION(DRV_MODULE_VERSION);
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pcie_logstat.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pcie_logstat.c
@@ -0,0 +1,764 @@
+/*
+ * TC956X PCIe Logging and Statistics driver.
+ *
+ * tc956x_pcie_logstat.c
+ *
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  17 Sep 2020 : Base lined
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *  VERSION     : 04-00
+ */
+
+/* ===================================
+ * Include Files
+ * ===================================
+ */
+#include "tc956x_pcie_logstat.h"
+/* Ensure header file containing TC956X_PCIE_LOGSTAT is included in
+ * tc956x_pcie_logstat.h
+ */
+#ifdef TC956X_PCIE_LOGSTAT
+/* ===================================
+ * Global Variables
+ * ===================================
+ */
+/*
+ * Array containing Different Available Ports.
+ */
+static uint8_t pcie_port[4][20] = {
+	"Upstream Port",
+	"Downstream Port1",
+	"Downstream Port2",
+	"Endpoint Port",
+};
+
+/*
+ * Array containing different LTSSM states.
+ */
+static uint8_t ltssm_states[COUNT_LTSSM_REG_STATES][25] = {
+	"Detect.Quiet",
+	"Detect.Active",
+	"Polling.Active",
+	"Polling.Compliance",
+	"Polling.Configuration",
+	"Config.LinkwidthStart",
+	"Config.LinkwidthAccept",
+	"Config.LanenumWait",
+	"Config.LanenumAccept",
+	"Config.Complete",
+	"Config.Idle",
+	"Recovery.RcvrLock",
+	"Recovery.Equalization",
+	"Recovery.Speed",
+	"Recovery.RcvrCfg",
+	"Recovery.Idle",
+	"L0",
+	"L0s",
+	"L1.Entry",
+	"L1.Idle",
+	"L2.Idle/L2.TransmitWake",
+	"Reserved",
+	"Disabled",
+	"Loopback.Entry",
+	"Loopback.Active",
+	"Loopback.Exit",
+	"Hot Reset",
+};
+
+/*
+ * Array containing different Receive L0s sub-states.
+ */
+static uint8_t rx_L0s_state[4][20] = {
+	"RxL0s.Inactive",
+	"RxL0s.Idle",
+	"RxL0s.FTS",
+	"RxL0s.OutRecovery",
+};
+
+/*
+ * Array containing different Transmit L0s sub-states.
+ */
+static uint8_t tx_L0s_state[4][15] = {
+	"TxL0s.Inactive",
+	"TxL0s.Idle",
+	"TxL0s.FTS",
+	"TxL0s.OutL0",
+};
+
+/*
+ * Array containing different L1 sub-states.
+ */
+static uint8_t state_L1[8][20] = {
+	"Inactive",
+	"L1.1",
+	"L1.2 entry",
+	"L1.2 idle",
+	"L1.2 exit",
+	"L1.0",
+	"Entry",
+	"Exit",
+};
+
+/*
+ * Array containing Data Layer Status.
+ */
+static uint8_t dl_state[2][20] = {
+	"Non DL_Active",
+	"DL_Active",
+};
+
+
+/* Static Variables for Analysis */
+static uint8_t DlActive_Pre = LOGSTAT_DUMMY_VALUE, LinkSpeed_Pre = LOGSTAT_DUMMY_VALUE;
+static uint8_t LinkWidth_Pre = LOGSTAT_DUMMY_VALUE;
+static uint8_t DlActive = LOGSTAT_DUMMY_VALUE, LinkSpeed = LOGSTAT_DUMMY_VALUE, LinkWidth = LOGSTAT_DUMMY_VALUE;
+
+/* ===================================
+ * Function Definition
+ * ===================================
+ */
+
+/**
+ * tc956x_pcie_ioctl_state_log_summary
+ *
+ * \brief IOCTL Function to read and print State Log summary.
+ *
+ * \details This function is called whenever IOCTL TC956X_PCIE_STATE_LOG_SUMMARY
+ * is invoked by user. This function prints a summary of State Log for particular
+ * port after PCIE State Transition, example PCIe Lane change, speed change, etc.
+ * State Log will contain following:
+ * 1. LTSSM Timeout Occured(or not).
+ * 2. DLL Active(or not).
+ * 3. Link Speed Transition.
+ * 4. Link Width Transition.
+ * 4. L1 PM Substate Transition.
+ * 5. TxL0s State Transition.
+ * 6. RxL0s State Transition.
+ * 7. Equalization Phase.
+ * 8. LTSSM State Transition.
+ *
+ * \param[in] priv - pointer to pcie private data.
+ * \param[in] data - data passed from user space.
+ *
+ * \return -EFAULT in case of copy failure, otherwise 0
+ */
+int tc956x_pcie_ioctl_state_log_summary(const struct tc956xmac_priv *priv, void __user *data)
+{
+	int ret = 0;
+	struct tc956x_ioctl_state_log_summary ioctl_data;
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	if ((priv == NULL) || (data == NULL))
+		return -EFAULT;
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		ret = -EFAULT;
+
+	if (ret == 0)
+		ret = tc956x_logstat_state_log_summary(priv->ioaddr, ioctl_data.port);
+
+	return ret;
+}
+
+/**
+ * tc956x_pcie_ioctl_state_log_summary
+ *
+ * \brief IOCTL Function to read and print State Log summary.
+ *
+ * \details This function performs following :
+ * 1. Reads current PCIe Link Parameters
+ * 2. Stop State Logging.
+ * 3. Get current State Log Status.
+ * 4. Set FIFO Pointer from 0 to 31 and Get Sate Log Data for each FIFO pointer.
+ * 5. Analyze all 32 State Log Data.
+ * 6. Print LTSSM state transition, if valid values are observed.
+ *
+ * NOTE: The function doesn't enable back the State Logging after Stop.
+ *
+ * \param[in] priv - pointer to pcie private data.
+ * \param[in] data - data passed from user space.
+ *
+ * \return -EFAULT in case of copy failure, otherwise 0
+ */
+int tc956x_logstat_state_log_summary(void __iomem *pbase_addr, enum ports nport)
+{
+	int ret = 0;
+	uint8_t state = 0, dll = 0, speed = 0, width = 0, status = 0;
+	uint8_t count = 0; /* count for invalid State Log Data */
+	int8_t fptr = 0; /* signed state log fifo pointer. can become negative. */
+	char cur_ltssm[25];
+	uint32_t val = 0, cur_state = 0;
+	uint32_t fifo_array[MAX_FIFO_READ_POINTER + 1]; /* Array of State Log Read Value for each FIFO Read Ptr */
+
+	if (pbase_addr == NULL) {
+		ret = -EFAULT;
+		KPRINT_INFO("%s : NULL Pointer Arguments\n", __func__);
+	}
+
+	if (ret == 0) {
+		KPRINT_INFO("State Transition Log Summary : %s\n", pcie_port[nport]);
+		/* Get PCIe LTSSM, DLL, Speed, Width, State Log Status & Disable Stop State Logging */
+		if ((tc956x_logstat_get_pcie_cur_ltssm(pbase_addr, nport, &state) < 0)
+		|| (tc956x_logstat_get_pcie_cur_dll(pbase_addr, nport, &dll) < 0)
+		|| (tc956x_logstat_get_pcie_cur_speed(pbase_addr, nport, &speed) < 0)
+		|| (tc956x_logstat_get_pcie_cur_width(pbase_addr, nport, &width) < 0)
+		|| (tc956x_logstat_set_state_log_enable(pbase_addr, nport, STATE_LOG_DISABLE) < 0)
+		|| (tc956x_logstat_get_state_log_stop_status(pbase_addr, nport, &status) < 0)) {
+			ret = -1;
+			goto end;
+		}
+
+		strcpy(cur_ltssm, ltssm_states[state]);
+		/* State Logging Should Stop after Disabling State Log */
+		/* Read State Log Data for each fifo pointer */
+		for (fptr = 0; fptr <= MAX_FIFO_READ_POINTER; fptr++) {
+			if ((tc956x_logstat_set_state_log_fifo_ptr(pbase_addr, nport, fptr) < 0)
+			|| (tc956x_logstat_get_state_log_data(pbase_addr, nport, &val) < 0)) {
+				ret = -1;
+				goto end;
+			}
+			fifo_array[fptr] = val;
+		}
+		/* Reset all values */
+		DlActive_Pre = LOGSTAT_DUMMY_VALUE;
+		LinkSpeed_Pre = LOGSTAT_DUMMY_VALUE;
+		LinkWidth_Pre = LOGSTAT_DUMMY_VALUE;
+		DlActive = LOGSTAT_DUMMY_VALUE;
+		LinkSpeed = LOGSTAT_DUMMY_VALUE;
+		LinkWidth = LOGSTAT_DUMMY_VALUE;
+
+		/* Analyze State Log Data using state log of each fifo pointer */
+		for (fptr = MAX_FIFO_READ_POINTER; fptr >= 0; fptr--) {
+			if (fifo_array[fptr] != INVALID_STATE_LOG) {
+				cur_state = fifo_array[fptr];
+				/* Start analyzing only after prev_state is set */
+				ret = tc956x_logstat_state_log_analyze(cur_state);
+				if (ret < 0)
+					goto end;
+
+				count++;
+			} else {
+				continue;
+			}
+		}
+
+		if (count == 0) {
+			KPRINT_INFO("==> LTSSM is not changed\n");
+			KPRINT_INFO("Speed:Gen%d, Width:x%d, LTSSM:%s, DLL:%d\n", speed, width, cur_ltssm, dll);
+			ret = 0;
+		}
+
+		if (status == STATE_LOG_STOP)
+			KPRINT_INFO("STATE LOGGING is stopped\n");
+	}
+end:
+	return ret;
+}
+
+/**
+ * tc956x_logstat_get_state_log_stop_status
+ *
+ * \brief Function to get State Log Stop Status.
+ *
+ * \details This function reads the State Logging Status from register.
+ * PCIe State Loggging is running if value returned by function is set,
+ * otherwise stopped.
+ *
+ * \param[in] pbase_addr - pointer to Bar4 base address.
+ * \param[in] nport - log start/stop for port passed.
+ * \param[out] pstop_status - state logging status (1 : stopped, 0 : still running).
+ *
+ * \return -EFAULT in case of copy failure, otherwise 0
+ */
+int tc956x_logstat_get_state_log_stop_status(void __iomem *pbase_addr, enum ports nport, uint8_t *pstop_status)
+{
+	int ret = 0;
+	uint32_t regval = 0;
+	uint32_t port_offset; /* Port Address Register Offset */
+
+	if ((pbase_addr == NULL) || (pstop_status == NULL)) {
+		ret = -EFAULT;
+		KPRINT_INFO("%s : Invalid Arguments\n", __func__);
+	}
+
+	if (ret == 0) {
+		port_offset = nport * STATE_LOG_REG_OFFSET;
+		/* Get State Logging Stop Status */
+		regval = readl(pbase_addr + TC956X_CONF_REG_NPCIEUSPLOGST + port_offset);
+		*pstop_status = (regval & STOP_STATUS_MASK) >> STOP_STATUS_SHIFT;
+		/* KPRINT_INFO("RD: Addr= 0x%08X, Val= 0x%08X\n", TC956X_CONF_REG_NPCIEUSPLOGST + port_offset, regval); */
+	}
+	return ret;
+}
+
+
+/**
+ * tc956x_logstat_set_state_log_fifo_ptr
+ *
+ * \brief Function to set State Log FIFO Read Pointer.
+ *
+ * \details This function write the FIFO Pointer. State Logging Data will be read as per
+ * FIFO Pointer set in register.
+ *
+ * \param[in] pbase_addr - pointer to Bar4 base address.
+ * \param[in] nport - log start/stop for port passed.
+ * \param[in] fifo_pointer - fifo pointer (0 to 31) for which state log to be read.
+ *
+ * \return -EFAULT in case of copy failure, otherwise 0
+ */
+int tc956x_logstat_set_state_log_fifo_ptr(void __iomem *pbase_addr, enum ports nport, uint8_t fifo_pointer)
+{
+	int ret = 0;
+	uint32_t regval = 0;
+	uint32_t port_offset; /* Port Address Register Offset */
+
+	if ((pbase_addr == NULL) || (fifo_pointer > MAX_FIFO_READ_POINTER)) {
+		ret = -EFAULT;
+		KPRINT_INFO("%s : Invalid Arguments\n", __func__);
+	}
+
+	if (ret == 0) {
+		port_offset = nport * STATE_LOG_REG_OFFSET;
+		/* Set FIFO Read Pointer Register */
+		regval = readl(pbase_addr + TC956X_CONF_REG_NPCIEUSPLOGRDCTRL + port_offset);
+		regval &= ~FIFO_READ_POINTER_MASK;
+		regval |= (((uint32_t)(fifo_pointer) & FIFO_READ_POINTER_MASK) >> FIFO_READ_POINTER_SHIFT);
+		writel(regval, pbase_addr + TC956X_CONF_REG_NPCIEUSPLOGRDCTRL + port_offset);
+		/* KPRINT_INFO("WR: Addr= 0x%08X, Val= 0x%08X\n", TC956X_CONF_REG_NPCIEUSPLOGRDCTRL + port_offset, regval); */
+	}
+	return ret;
+}
+
+/**
+ * tc956x_logstat_get_state_log_data
+ *
+ * \brief Function to read State Log Data.
+ *
+ * \details This function reads the State Logging Data from register.
+ *
+ * \param[in] pbase_addr - pointer to Bar4 base address.
+ * \param[in] nport - log start/stop for port passed.
+ * \param[out] pstate_log_data - pointer to state log data read.
+ *
+ * \return -EFAULT in case of copy failure, otherwise 0
+ */
+int tc956x_logstat_get_state_log_data(void __iomem *pbase_addr, enum ports nport, uint32_t *pstate_log_data)
+{
+	int ret = 0;
+	uint32_t port_offset; /* Port Address Register Offset */
+
+	if ((pbase_addr == NULL) || (pstate_log_data == NULL)) {
+		ret = -EFAULT;
+		KPRINT_INFO("%s : NULL Pointer Arguments\n", __func__);
+	}
+
+	if (ret == 0) {
+		port_offset = nport * STATE_LOG_REG_OFFSET;
+		/* Read LTSSM Log Data Register */
+		*pstate_log_data = readl(pbase_addr + TC956X_CONF_REG_NPCIEUSPLOGD + port_offset);
+		/* KPRINT_INFO("RD: Addr= 0x%08X, Val= 0x%08X\n", TC956X_CONF_REG_NPCIEUSPLOGD + port_offset, *pstate_log_data); */
+	}
+	return ret;
+}
+
+/**
+ * tc956x_logstat_state_log_analyze
+ *
+ * \brief Function to analyze State Log Data.
+ *
+ * \details This function analyze the State Logging Data as per current value passed.
+ *
+ * \param[in] cur_state - FIFO register data containing current state of pcie.
+ *
+ * \return always 0.
+ */
+int tc956x_logstat_state_log_analyze(uint32_t cur_state)
+{
+	union tc956x_logstat_State_Log_Data curr_state_log_data;
+	uint8_t timeout = 0, activelane = 0, l1_substate = 0, tx_l0s = 0, rx_l0s = 0, eqphase = 0, ltssm = 0;
+	uint8_t l1ss[20], txl0s_dec[20], rxl0s_dec[20], ltssm_dec[30];
+	uint8_t append_str[150];
+
+	/* Assign Previous and Current State Log Data */
+	curr_state_log_data.reg_val = cur_state;
+
+	/* Decoding State Log */
+	/* LTSSM Timeout Decoding */
+	if (curr_state_log_data.bitfield.fifo_read_value8 == LTSSM_TIMEOUT_OCCURRED)
+		timeout = LTSSM_TIMEOUT_OCCURRED;
+	else
+		timeout = LTSSM_TIMEOUT_NOT_OCCURRED;
+
+	/* DL_Active Decoding */
+	DlActive_Pre = DlActive;
+
+	if (curr_state_log_data.bitfield.fifo_read_value7 == DL_ACTIVE)
+		DlActive = DL_ACTIVE;
+	else
+		DlActive = DL_NOT_ACTIVE;
+
+	/* Link Speed Decoding */
+	LinkSpeed_Pre = LinkSpeed;
+	LinkSpeed = curr_state_log_data.bitfield.fifo_read_value6;
+
+	/* Link Width Decoding */
+	LinkWidth_Pre = LinkWidth;
+	activelane = curr_state_log_data.bitfield.fifo_read_value5;
+	LinkWidth = 0;
+	while (activelane) {
+		LinkWidth += activelane & ACTIVE_SINGLE_LANE_MASK;
+		activelane = (activelane >> ACTIVE_SINGLE_LANE_SHIFT) & ACTIVE_ALL_LANE_MASK;
+	}
+
+	/* L1 PM Substate Decoding */
+	l1_substate = curr_state_log_data.bitfield.fifo_read_value4;
+	strcpy(l1ss, state_L1[l1_substate]);
+
+	/* TxL0s Decoding */
+	tx_l0s = curr_state_log_data.bitfield.fifo_read_value3;
+	strcpy(txl0s_dec, tx_L0s_state[tx_l0s]);
+
+	/* RxL0s Decoding */
+	rx_l0s = curr_state_log_data.bitfield.fifo_read_value2;
+	strcpy(rxl0s_dec, rx_L0s_state[rx_l0s]);
+
+	/* EQ Phase Decoding */
+	eqphase = curr_state_log_data.bitfield.fifo_read_value1;
+
+	/* LTSSM Decoding */
+	ltssm = curr_state_log_data.bitfield.fifo_read_value0;
+	if (ltssm <= LTSSM_MAX_VALUE)
+		strcpy(ltssm_dec, ltssm_states[ltssm]);
+
+	/* Print State Log Summary */
+	if (timeout == LTSSM_TIMEOUT_OCCURRED)
+		KPRINT_INFO("==> LTSSM Timeout occurred!\n");
+	else {
+		if ((DlActive_Pre == DL_NOT_ACTIVE) && (DlActive == DL_ACTIVE))
+			KPRINT_INFO("==> Linkup!\n");
+		else if ((DlActive_Pre == DL_ACTIVE) && (DlActive == DL_NOT_ACTIVE))
+			KPRINT_INFO("==> Link is down!\n");
+
+		if (LinkSpeed_Pre != LOGSTAT_DUMMY_VALUE) {
+			if (LinkSpeed < LinkSpeed_Pre)
+				KPRINT_INFO("==> Speed down occurred! (Gen%d --> Gen%d)\n", LinkSpeed_Pre, LinkSpeed);
+			else if (LinkSpeed > LinkSpeed_Pre)
+				KPRINT_INFO("==> Speed up occurred! (Gen%d --> Gen%d)\n", LinkSpeed_Pre, LinkSpeed);
+		}
+
+		if ((LinkWidth_Pre != LOGSTAT_DUMMY_VALUE) && (LinkWidth_Pre != ALL_LANES_INACTIVE)) {
+			if (LinkWidth < LinkWidth_Pre) {
+				if (strcmp(ltssm_dec, "Detect.Active") == 0) {
+					if (LinkWidth > 1)
+						KPRINT_INFO("==> Receiver Detection is occurred! (Only %d Lanes is detected)\n", LinkWidth);
+					else
+						KPRINT_INFO("==> Receiver Detection is occurred! (Only 1 Lane is detected)\n");
+				} else
+					KPRINT_INFO("==> Link Width down configure occurred! (x%d --> x%d)\n", LinkWidth_Pre, LinkWidth);
+			} else if (LinkWidth > LinkWidth_Pre)
+				KPRINT_INFO("==> Link Width upconfigure occurred! (x%d --> x%d)\n", LinkWidth_Pre, LinkWidth);
+		}
+
+		sprintf(append_str, "--> DL_Active:%d, Speed:Gen%d, Width:x%d, LTSSM:%s", DlActive, LinkSpeed, LinkWidth, ltssm_dec);
+
+		if ((tx_l0s != INACTIVE_L0s) && (rx_l0s != INACTIVE_L0s))
+			KPRINT_INFO("%s (%d:%s, %d:%s)\n", append_str, tx_l0s, txl0s_dec, rx_l0s, rxl0s_dec);
+		else if ((tx_l0s != INACTIVE_L0s) && (rx_l0s == INACTIVE_L0s))
+			KPRINT_INFO("%s (%s)\n", append_str, txl0s_dec);
+		else if ((tx_l0s == INACTIVE_L0s) && (rx_l0s != INACTIVE_L0s))
+			KPRINT_INFO("%s (%s)\n", append_str, rxl0s_dec);
+		else if (strcmp(ltssm_dec, "Recovery.Equalization"))
+			KPRINT_INFO("%s (Phase %d)\n", append_str, eqphase);
+		else if (l1_substate != INACTIVE_L1)
+			KPRINT_INFO("%s (%s)\n", append_str, l1ss);
+	}
+	return 0;
+}
+
+/**
+ * tc956x_pcie_ioctl_get_pcie_link_params
+ *
+ * \brief IOCTL Function to read PCIe Link LTSSM, DL State, Speed and Width.
+ *
+ * \details This function is called whenever IOCTL TC956X_PCIE_GET_PCIE_LINK_PARAMS
+ * is invoked by user. This function reads and print Current LTSSM State, DL Link State,
+ * Link Speed and Link Width.
+ *
+ * \param[in] priv - pointer to pcie private data.
+ * \param[in] data - data passed from user space.
+ *
+ * \return -EFAULT in case of copy failure, otherwise 0
+ */
+int tc956x_pcie_ioctl_get_pcie_link_params(const struct tc956xmac_priv *priv, void __user *data)
+{
+	int ret = 0;
+	struct tc956x_ioctl_pcie_link_params ioctl_data;
+	struct tc956x_pcie_link_params link_param;
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	if ((priv == NULL) || (data == NULL))
+		return -EFAULT;
+
+	memset(&link_param, 0, sizeof(link_param));
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		ret = -EFAULT;
+
+	if (ret == 0) {
+		if ((tc956x_logstat_get_pcie_cur_ltssm(priv->ioaddr, ioctl_data.port, &(link_param.ltssm)) < 0)
+		|| (tc956x_logstat_get_pcie_cur_dll(priv->ioaddr, ioctl_data.port, &(link_param.dll)) < 0)
+		|| (tc956x_logstat_get_pcie_cur_speed(priv->ioaddr, ioctl_data.port, &(link_param.speed)) < 0)
+		|| (tc956x_logstat_get_pcie_cur_width(priv->ioaddr, ioctl_data.port, &(link_param.width)) < 0)) {
+			ret = -EFAULT;
+		}
+	}
+
+	if (ret == 0) {
+		if (copy_to_user((void __user *)ioctl_data.link_param, &link_param, sizeof(link_param)))
+			ret = -EFAULT;
+	}
+
+	DBGPR_FUNC(priv->device, "<-- %s\n", __func__);
+	return ret;
+}
+
+/**
+ * tc956x_logstat_get_pcie_cur_ltssm
+ *
+ * \brief Function to read current PCIe Link LTSSM State.
+ *
+ * \details This function reads current Link Training and Status State Machine
+ * State from register.
+ *
+ * \param[in] pbase_addr - pointer to BAR4 base address.
+ * \param[in] nport - port for which to get current ltssm value.
+ * \param[out] pltssm - pointer to ltssm value from register.
+ *
+ * \return -EFAULT in case of bad address, otherwise 0
+ */
+int tc956x_logstat_get_pcie_cur_ltssm(void __iomem *pbase_addr, enum ports nport, uint8_t *pltssm)
+{
+	int ret = 0;
+	uint32_t regval;
+	uint32_t reg_offset; /* Port Address Register Offset */
+
+	if ((pbase_addr == NULL) || (pltssm == NULL)) {
+		ret = -EFAULT;
+		KPRINT_INFO("%s : NULL Pointer Arguments\n", __func__);
+	}
+
+	if (ret == 0) {
+		reg_offset = nport * GLUE_REG_LTSSM_OFFSET;
+		/* Read Current LTSSM State */
+		regval = readl(pbase_addr + TC956X_GLUE_SW_USP_TEST_OUT_127_096 + reg_offset);
+		*pltssm = (regval & TC956X_GLUE_LTSSM_STATE_MASK) >> TC956X_GLUE_LTSSM_STATE_SHIFT;
+		KPRINT_INFO("%s : LTSSM State %s for port %s\n", __func__, ltssm_states[(*pltssm)], pcie_port[nport]);
+		if ((*pltssm) > LTSSM_MAX_VALUE)
+			ret = -1;
+	}
+	return ret;
+}
+
+/**
+ * tc956x_logstat_get_pcie_cur_dll
+ *
+ * \brief Function to read current PCIe Link DLL Active State.
+ *
+ * \details This function reads current Data Link Layer Active State from register.
+ *
+ * \param[in] pbase_addr - pointer to BAR4 base address.
+ * \param[in] nport - port for which to get current ltssm value.
+ * \param[out] pdll - pointer to dll active state value from register.
+ *
+ * \return -EFAULT in case of bad address, otherwise 0
+ */
+int tc956x_logstat_get_pcie_cur_dll(void __iomem *pbase_addr, enum ports nport, uint8_t *pdll)
+{
+	int ret = 0;
+	uint32_t regval;
+	uint32_t reg_offset; /* Port Address Register Offset */
+
+	if ((pbase_addr == NULL) || (pdll == NULL)) {
+		ret = -EFAULT;
+		KPRINT_INFO("%s : NULL Pointer Arguments\n", __func__);
+	}
+
+	if (ret == 0) {
+		reg_offset = nport * GLUE_REG_LTSSM_OFFSET;
+		/* Read DLL State */
+		regval = readl(pbase_addr + TC956X_GLUE_SW_USP_TEST_OUT_127_096 + reg_offset);
+		*pdll = (regval & TC956X_GLUE_DLL_MASK) >> TC956X_GLUE_DLL_SHIFT;
+		KPRINT_INFO("%s : DLL State %s for port %s\n", __func__, dl_state[(*pdll)], pcie_port[nport]);
+	}
+	return ret;
+}
+
+/**
+ * tc956x_logstat_get_pcie_cur_speed
+ *
+ * \brief Function to read current PCIe Link Speed.
+ *
+ * \details This function reads current PCIe Link Speed from register.
+ *
+ * \param[in] pbase_addr - pointer to BAR4 base address.
+ * \param[in] nport - port for which to get current ltssm value.
+ * \param[out] pspeed_val - pointer to current link speed value from register.
+ *
+ * \return -EFAULT in case of bad address, otherwise 0
+ */
+int tc956x_logstat_get_pcie_cur_speed(void __iomem *pbase_addr, enum ports nport, uint8_t *pspeed_val)
+{
+	int ret = 0;
+	uint32_t regval;
+
+	if ((pbase_addr == NULL) || (pspeed_val == NULL)) {
+		ret = -EFAULT;
+		KPRINT_INFO("%s : NULL Pointer Arguments\n", __func__);
+	}
+
+	if (ret == 0) {
+		/* Read Speed */
+		regval = readl(pbase_addr + TC956X_GLUE_TL_LINK_SPEED_MON);
+		*pspeed_val = (regval & TC956X_GLUE_SPEED_MASK(nport)) >> TC956X_GLUE_SPEED_SHIFT(nport);
+		KPRINT_INFO("%s : Link Speed Gen%d for port %s\n", __func__, (*pspeed_val), pcie_port[nport]);
+	}
+	return ret;
+}
+
+/**
+ * tc956x_logstat_get_pcie_cur_width
+ *
+ * \brief Function to read current PCIe Link Width.
+ *
+ * \details This function reads current PCIe Link Width from register.
+ *
+ * \param[in] pbase_addr - pointer to BAR4 base address.
+ * \param[in] nport - port for which to get current ltssm value.
+ * \param[out] plane_width_val - pointer to current lane width value from register.
+ *
+ * \return -EFAULT in case of bad address, otherwise 0
+ */
+int tc956x_logstat_get_pcie_cur_width(void __iomem *pbase_addr, enum ports nport, uint8_t *plane_width_val)
+{
+	int ret = 0;
+	uint32_t regval;
+
+	if ((pbase_addr == NULL) || (plane_width_val == NULL)) {
+		ret = -EFAULT;
+		KPRINT_INFO("%s : NULL Pointer Arguments\n", __func__);
+	}
+
+	if (ret == 0) {
+		/* Read Lane Width */
+		regval = readl(pbase_addr + TC956X_GLUE_TL_NUM_LANES_MON);
+		*plane_width_val = (regval & TC956X_GLUE_LANE_WIDTH_MASK(nport)) >> TC956X_GLUE_LANE_WIDTH_SHIFT(nport);
+		KPRINT_INFO("%s : Lane Width x%d for port %s\n", __func__, (*plane_width_val), pcie_port[nport]);
+	}
+	return ret;
+}
+
+
+/**
+ * tc956x_pcie_ioctl_StateLogStop
+ *
+ * \brief IOCTL Function to Enable and Disable State Logging.
+ *
+ * \details This function is called whenever IOCTL TC956X_PCIE_STATE_LOG_ENABLE
+ * is invoked by user. This function set register to enable/disable state logging.
+ *
+ * \param[in] priv - pointer to pcie private data.
+ * \param[in] data - data passed from user space.
+ *
+ * \return -EFAULT in case of bad address, otherwise 0.
+ */
+int tc956x_pcie_ioctl_state_log_enable(const struct tc956xmac_priv *priv, void __user *data)
+{
+	int ret = 0;
+	struct tc956x_ioctl_state_log_enable ioctl_data;
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	if ((priv == NULL) || (data == NULL))
+		return -EFAULT;
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		ret = -EFAULT;
+
+	if (ret == 0)
+		ret = tc956x_logstat_set_state_log_enable(priv->ioaddr, ioctl_data.port, ioctl_data.enable);
+
+	DBGPR_FUNC(priv->device, "<-- %s\n", __func__);
+
+	return ret;
+}
+
+/**
+ * tc956x_logstat_set_state_log_enable
+ *
+ * \brief Function to Enable and Disable State Log.
+ *
+ * \details This function enable or disable State Logging based on mode passed.
+ *
+ * \param[in] pbase_addr - pointer to Bar4 base address.
+ * \param[in] nport - log start/stop for port passed.
+ * \param[in] mode - start or stop state logging.
+ *
+ * \return -EFAULT in case of bad address, otherwise 0
+ */
+int tc956x_logstat_set_state_log_enable(void __iomem *pbase_addr, enum ports nport, enum state_log_enable enable)
+{
+	int ret = 0;
+	uint32_t port_offset; /* Port Address Register Offset */
+
+	if (pbase_addr == NULL) {
+		ret = -EFAULT;
+		KPRINT_INFO("%s : Invalid Arguments\n", __func__);
+	}
+
+	if (ret == 0) {
+		port_offset = nport * STATE_LOG_REG_OFFSET;
+
+		if (enable == STATE_LOG_ENABLE) {
+			/* Stop State Log */
+			writel(STATE_LOG_DISABLE, pbase_addr + TC956X_CONF_REG_NPCIEUSPLOGCTRL + port_offset);
+			/* Start State Log */
+			writel(STATE_LOG_ENABLE, pbase_addr + TC956X_CONF_REG_NPCIEUSPLOGCTRL + port_offset);
+			/* Verify Sate Log Enable */
+			if (readl(pbase_addr + TC956X_CONF_REG_NPCIEUSPLOGCTRL + port_offset) == STATE_LOG_ENABLE)
+				KPRINT_INFO("%s : Enabling State Logging for port %s\n", __func__, pcie_port[nport]);
+		} else {
+			/* Stop State Log */
+			writel(STATE_LOG_DISABLE, pbase_addr + TC956X_CONF_REG_NPCIEUSPLOGCTRL + port_offset);
+		}
+		/* KPRINT_INFO("WR: Addr= 0x%08X, Val= 0x%08X\n", TC956X_CONF_REG_NPCIEUSPLOGCTRL + port_offset, enable); */
+	}
+
+	return ret;
+}
+
+#endif /* ifdef TC956X_PCIE_LOGSTAT */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pcie_logstat.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pcie_logstat.h
@@ -0,0 +1,193 @@
+/*
+ * TC956X PCIe Logging and Statistics header file.
+ *
+ * tc956x_pcie_logstat.h
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+
+/*! History:
+ *  17 Sep 2020 : Base lined
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  14 Oct 2021 : 1. Moving common Macros to common header file
+ *  VERSION     : 01-00-16
+ */
+
+#ifndef __TC956X_PCIE_LOGSTAT_H__
+#define __TC956X_PCIE_LOGSTAT_H__
+
+/* ===================================
+ * Include
+ * ===================================
+ */
+#include "common.h"
+#include "tc956xmac.h"
+#include "tc956xmac_ioctl.h"
+
+#ifdef TC956X_PCIE_LOGSTAT
+
+/* ===================================
+ * Macros
+ * ===================================
+ */
+/* Configuration Register Address */
+#ifdef TC956X
+#define TC956X_CONF_REG_NPCIEUSPLOGCFG				(0x00001320U)
+#define TC956X_CONF_REG_NPCIEUSPLOGCTRL				(0x00001324U)
+#define TC956X_CONF_REG_NPCIEUSPLOGST				(0x00001328U)
+#define TC956X_CONF_REG_NPCIEUSPLOGRDCTRL			(0x0000132CU)
+#define TC956X_CONF_REG_NPCIEUSPLOGD				(0x00001330U)
+
+#define LTSSM_CONF_REG_OFFSET					(0x20U)
+#endif /* TC956X */
+ /* LTSSM Enable Bit Mask Value*/
+#define LTSSM_BIT_MASK						(0x00000001U)
+#define LTSSM_PORT_EN_SHIFT					(0x4U)
+/* Common NPCIEUSPLOGCFG, NPCIEDSP1LOGCFG, NPCIEDSP2LOGCFG, NPCIEEPLOGCFG
+ * register Logging Configuration Bit Mask and Shift Value
+ */
+#define STOP_COUNT_VALUE_MASK					(0x00000FF0U)
+#define STOP_COUNT_VALUE_SHIFT					(4U)
+#define LINKWIDTH_DOWN_ST_MASK					(0x00000008U)
+#define LINKWIDTH_DOWN_ST_SHIFT					(3U)
+#define LINKSPEED_DOWN_ST_MASK					(0x00000004U)
+#define LINKSPEED_DOWN_ST_SHIFT					(2U)
+#define TIMEOUT_STOP_MASK					(0x00000002U)
+#define TIMEOUT_STOP_SHIFT					(1U)
+#define L0S_MASK_MASK						(0x00000001U)
+#define L0S_MASK_SHIFT						(0U)
+#define STATE_LOGGING_ENABLE_MASK				(0x00000001U)
+#define STATE_LOGGING_ENABLE_SHIFT				(0U)
+#define FIFO_READ_POINTER_MASK					(0x0000001FU)
+#define FIFO_READ_POINTER_SHIFT					(0U)
+#define STOP_STATUS_MASK					(0x00000001U)
+#define STOP_STATUS_SHIFT					(0U)
+
+#define COUNT_LTSSM_REG_STATES					(28U)
+
+/* Common NPCIEUSPLOGD, NPCIEDSP1LOGD, NPCIEDSP2LOGD, NPCIEEPLOGD
+ * Register Logging Read Data Bit Mask and Shift Value
+ */
+#define FIFO_READ_VALUE8_MASK					(0x20000000U)
+#define FIFO_READ_VALUE8_SHIFT					(29U)
+#define FIFO_READ_VALUE7_MASK					(0x10000000U)
+#define FIFO_READ_VALUE7_SHIFT					(28U)
+#define FIFO_READ_VALUE6_MASK					(0x03000000U)
+#define FIFO_READ_VALUE6_SHIFT					(24U)
+#define FIFO_READ_VALUE5_MASK					(0x00F00000U)
+#define FIFO_READ_VALUE5_SHIFT					(20U)
+#define FIFO_READ_VALUE4_MASK					(0x00070000U)
+#define FIFO_READ_VALUE4_SHIFT					(16U)
+#define FIFO_READ_VALUE3_MASK					(0x0000C000U)
+#define FIFO_READ_VALUE3_SHIFT					(14U)
+#define FIFO_READ_VALUE2_MASK					(0x00003000U)
+#define FIFO_READ_VALUE2_SHIFT					(12U)
+#define FIFO_READ_VALUE1_MASK					(0x00000300U)
+#define FIFO_READ_VALUE1_SHIFT					(8U)
+#define FIFO_READ_VALUE0_MASK					(0x0000001FU)
+#define FIFO_READ_VALUE0_SHIFT					(0U)
+#define STOP_STATUS_MASK					(0x00000001U)
+#define STOP_STATUS_SHIFT					(0U)
+/* Common NPCIEUSPLOGD, NPCIEDSP1LOGD, NPCIEDSP2LOGD, NPCIEEPLOGD
+ * Register, Different Lanes Bit Mask Values
+ */
+#define LANE0_MASK						(0x1U)
+#define LANE0_SHIFT						(0U)
+#define LANE1_MASK						(0x2U)
+#define LANE1_SHIFT						(1U)
+#define LANE2_MASK						(0x4U)
+#define LANE2_SHIFT						(2U)
+#define LANE3_MASK						(0x8U)
+#define LANE3_SHIFT						(3U)
+
+#define MAX_STOP_CNT						(0xFFU)
+#define MAX_FIFO_POINTER					(31U)
+
+#define STATE_LOG_REG_OFFSET					(0x20U)
+#define GLUE_REG_LTSSM_OFFSET					(0x40U)
+
+#define STATE_LOG_STOP						(1U)
+#define MAX_FIFO_READ_POINTER					(0x1F)
+#define INVALID_STATE_LOG					(0x33F7F31FU)
+
+#define LTSSM_TIMEOUT_NOT_OCCURRED				(0U)
+#define LTSSM_TIMEOUT_OCCURRED					(1U)
+#define DL_ACTIVE						(1U)
+#define DL_NOT_ACTIVE						(0U)
+#define ALL_LANES_INACTIVE					(0U)
+#define INACTIVE_L0s						(0U)
+#define EQ_PHASE0						(0U)
+#define INACTIVE_L1						(0U)
+
+#define LTSSM_MAX_VALUE						(0x1A)
+#define LOGSTAT_DUMMY_VALUE					(0xFF)
+#define ACTIVE_SINGLE_LANE_MASK					(1)
+#define ACTIVE_SINGLE_LANE_SHIFT				(1)
+#define ACTIVE_ALL_LANE_MASK					(0xF)
+/* ===================================
+ * Enumeration
+ * ===================================
+ */
+
+/* ===================================
+ * Structure/Union
+ * ===================================
+ */
+union tc956x_logstat_State_Log_Data {
+	struct {
+		unsigned char fifo_read_value0 :5;
+		unsigned char reserved1 :3;
+		unsigned char fifo_read_value1 :2;
+		unsigned char reserved2 :2;
+		unsigned char fifo_read_value2 :2;
+		unsigned char fifo_read_value3 :2;
+		unsigned char fifo_read_value4 :3;
+		unsigned char reserved3 :1;
+		unsigned char fifo_read_value5 :4;
+		unsigned char fifo_read_value6 :2;
+		unsigned char reserved4 :2;
+		unsigned char fifo_read_value7 :1;
+		unsigned char fifo_read_value8 :1;
+		unsigned char reserved5 :2;
+	} bitfield;
+	unsigned int reg_val;
+};
+
+/* ===================================
+ * Function Declaration
+ * ===================================
+ */
+int tc956x_pcie_ioctl_state_log_summary(const struct tc956xmac_priv *priv, void __user *data);
+int tc956x_pcie_ioctl_get_pcie_link_params(const struct tc956xmac_priv *priv, void __user *data);
+int tc956x_pcie_ioctl_state_log_enable(const struct tc956xmac_priv *priv, void __user *data);
+int tc956x_logstat_state_log_summary(void __iomem *pbase_addr, enum ports nport);
+int tc956x_logstat_get_state_log_stop_status(void __iomem *pbase_addr, enum ports nport, uint8_t *pstop_status);
+int tc956x_logstat_set_state_log_fifo_ptr(void __iomem *pbase_addr, enum ports nport, uint8_t fifo_pointer);
+int tc956x_logstat_get_state_log_data(void __iomem *pbase_addr, enum ports nport, uint32_t *pstate_log_data);
+int tc956x_logstat_state_log_analyze(unsigned int cur_state);
+int tc956x_logstat_get_pcie_cur_ltssm(void __iomem *pbase_addr, enum ports nport, uint8_t *pltssm);
+int tc956x_logstat_get_pcie_cur_dll(void __iomem *pbase_addr, enum ports nport, uint8_t *pdll);
+int tc956x_logstat_get_pcie_cur_speed(void __iomem *pbase_addr, enum ports nport, uint8_t *pspeed_val);
+int tc956x_logstat_get_pcie_cur_width(void __iomem *pbase_addr, enum ports nport, uint8_t *plane_width_val);
+int tc956x_logstat_set_state_log_enable(void __iomem *pbase_addr, enum ports nport, enum state_log_enable enable);
+#endif /* #ifdef TC956X_PCIE_LOGSTAT */
+#endif /* __TC956X_PCIE_LOGSTAT_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pf_mbx.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pf_mbx.c
@@ -0,0 +1,612 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_pf_mbx.c
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  10 July 2020 : Initial Version
+ *  VERSION      : 00-01
+ *
+ *  30 Nov 2021 : Base lined for SRIOV
+ *  VERSION     : 01-02
+ */
+
+#include "tc956x_pf_mbx.h"
+#include "tc956xmac.h"
+#include "tc956x_pf_rsc_mng.h"
+
+#ifdef TC956X_SRIOV_PF
+
+/**
+ * This table maintains the SRAM mapping for PF0->VF0s, VF0s->PF0, PF1->VF1s,
+ *  VF1s->PF1, PF0->PF1, PF1->PF0, MCU->PF0, PF0->MCU, PF1->MCU, MCU->PF1
+ * Each communication SRAM size is of 64 bytes. In total 30 such SRAMs are
+ * required for above mentioned communication path.
+ * In general, in Design of HW semaphore: PF uses one SRAM location for
+ * any request and ACK message to a particular VF and VF uses other
+ * SRAM location for requestand ACK. In Design of No semaphore: PF use one
+ * SRAM location to send request, VF to use same location (overwrite) to send
+ * the ACK, similarly VF uses other SRAM to send request, PF to use same location
+ * (overwrite) to send the ACK.
+ */
+static u8 PF_VF_mbx_idx[PFS_MAX][FNS_MAX][2] = {
+	{
+		{1, 2}, /* PF0 <--> MCU [PF0 RQST Msg/PF0 ACK Msg,
+			 * MCU ACK Msg/MCU RQST Msg]
+			 */
+		{0, 0}, /* PF0 <--> PF0 [Not a valid,
+			 * just to maintain index it is used]
+			 */
+		{3, 4}, /* PF0 <--> PF1 [PF0 RQST Msg/PF0 ACK Msg,
+			 * PF1 ACK Msg/PF1 RQST Msg]
+			 */
+		{5, 6}, /* PF0 <--> VF00 [PF0 RQST Msg/PF0 ACK Msg,
+			 * VF0 ACK Msg/VF0 RQST Msg]
+			 */
+		{7, 8}, /* PF0 <--> VF01 [PF0 RQST Msg/PF0 ACK Msg,
+			 * VF1 ACK Msg/VF1 RQST Msg]
+			 */
+		{9, 10} /* PF0 <--> VF02 [PF0 RQST Msg/PF0 ACK Msg,
+			 * VF2 ACK Msg/VF2 RQST Msg]
+			 */
+	},
+
+	{
+		{11, 12}, /* PF1 <--> MCU [PF1 RQST Msg/PF1 ACK Msg,
+			   * MCU ACK Msg/MCU RQST Msg]
+			   */
+		{0, 0},	  /* PF1 <--> PF1 [Not a valid,
+			   * just to maintain index it is used]
+			   */
+		{3, 4},	  /* PF1 <--> PF0 [PF1 RQST Msg/PF1 ACK Msg,
+			   * PF0 ACK Msg/PF0 RQST Msg]
+			   */
+		{13, 14}, /* PF1 <--> VF10 [PF1 RQST Msg/PF1 ACK Msg,
+			   * VF0 ACK Msg/VF0 RQST Msg]
+			   */
+		{15, 16}, /* PF1 <--> VF11 [PF1 RQST Msg/PF1 ACK Msg,
+			   * VF1 ACK Msg/VF1 RQST Msg]
+			   */
+		{17, 18}  /* PF1 <--> VF12 [PF1 RQST Msg/PF1 ACK Msg,
+			   * VF2 ACK Msg/VF2 RQST Msg]
+			   */
+	},
+
+	{
+		{19, 20}, /* MCU <--> VF00 [MCU RQST Msg/MCU ACK Msg,
+			   * VF00 ACK Msg/VF00 RQST Msg]
+			   */
+		{21, 22}, /* MCU <--> VF01 [MCU RQST Msg/MCU ACK Msg,
+			   * VF01 ACK Msg/VF01 RQST Msg]
+			   */
+		{23, 24}, /* MCU <--> VF02 [MCU RQST Msg/MCU ACK Msg,
+			   * VF02 ACK Msg/VF02 RQST Msg]
+			   */
+		{25, 26}, /* MCU <--> VF10 [MCU RQST Msg/MCU ACK Msg,
+			   * VF10 ACK Msg/VF10 RQST Msg]
+			   */
+		{27, 28}, /* MCU <--> VF11 [MCU RQST Msg/MCU ACK Msg,
+			   * VF11 ACK Msg/VF11 RQST Msg]
+			   */
+		{29, 30}  /* MCU <--> VF12 [MCU RQST Msg/MCU ACK Msg,
+			   * VF12 ACK Msg/VF12 RQST Msg]
+			   */
+	},
+};
+
+/**
+ * pf_get_mbx_mem_idx
+ *
+ * \brief API to return pointer pointing to SRAM index
+ *
+ * \details This function to return the pointer to the 1D array of
+ * PF_VF_mbx_idx where it points to SRAM location of specific PF->Fn
+ *
+ * \param[in] msg_src - Function to/from where PF needs to write/read
+ * \param[in] fn_id_info - Pointer to this function id information
+ *
+ * \return pointer to the SRAM index
+ */
+
+static u8 *pf_get_mbx_mem_idx(enum mbx_msg_fns msg_src,
+			      struct fn_id *fn_id_info)
+{
+	return *(*(PF_VF_mbx_idx + fn_id_info->pf_no) + msg_src);
+}
+
+/**
+ * tc956x_pf_get_fn_idx_from_int_sts
+ *
+ * \brief Helper function to get function that raised the mailbox interrupt
+ *
+ * \details This function is called to get the function which raised the
+ * mailbox interrupt. Interrupt source can be MCU, VFs or other PF
+ *
+ * \param[in] msg_dst - Function to which interrupt should be set
+ * \param[in] fn_id_info - Pointer to Function info structure
+ *
+ * \return function type or error
+ */
+int tc956x_pf_get_fn_idx_from_int_sts(struct tc956xmac_priv *priv,
+					     struct fn_id *fn_id_info)
+{
+	void __iomem *ioaddr = priv->tc956x_BRIDGE_CFG_pci_base_addr;
+	u32 rsc_mng_int_sts = readl(ioaddr + RSCMNG_INT_ST_REG);
+
+	if ((rsc_mng_int_sts & RSC_MNG_INT_MCU_MASK) == RSC_MNG_INT_MCU_MASK) {
+		writel(RSC_MNG_INT_MCU_MASK, ioaddr + RSCMNG_INT_ST_REG);
+		return mcu;
+	} else if ((rsc_mng_int_sts & RSC_MNG_INT_VF2_MASK) ==
+		RSC_MNG_INT_VF2_MASK) {
+		writel(RSC_MNG_INT_VF2_MASK, ioaddr + RSCMNG_INT_ST_REG);
+		return vf2;
+	} else if ((rsc_mng_int_sts & RSC_MNG_INT_VF1_MASK) ==
+		RSC_MNG_INT_VF1_MASK) {
+		writel(RSC_MNG_INT_VF1_MASK, ioaddr + RSCMNG_INT_ST_REG);
+		return vf1;
+	} else if ((rsc_mng_int_sts & RSC_MNG_INT_VF0_MASK) ==
+		RSC_MNG_INT_VF0_MASK) {
+		writel(RSC_MNG_INT_VF0_MASK, ioaddr + RSCMNG_INT_ST_REG);
+		return vf0;
+	} else if ((rsc_mng_int_sts & RSC_MNG_INT_OTHR_PF_MASK) ==
+		RSC_MNG_INT_OTHR_PF_MASK) {
+		if (fn_id_info->pf_no == 0) {
+			writel(RSC_MNG_INT_OTHR_PF_MASK, ioaddr + RSCMNG_INT_ST_REG);
+			return pf1;
+		} else if (fn_id_info->pf_no == 1) {
+			writel(RSC_MNG_INT_OTHR_PF_MASK, ioaddr + RSCMNG_INT_ST_REG);
+			return pf0;
+		} else
+			return -1;
+	} else
+		return -1;
+}
+
+static int trylock_semaphore(void __iomem *ioaddr, u8 idx)
+{
+	u32 rd_val = 0;
+
+	/* Read 0 for lock. Else already semaphore is locked
+	 * curr value : action  :  next value
+	 * 0	      : read  0 :     1
+	 * 1	      : read  1 :     1
+	 */
+
+	rd_val = readl(ioaddr + NSEM(idx));
+	if (rd_val == 0)
+		return 0;
+	else
+		return -EBUSY;
+}
+
+static int unlock_semaphore(void __iomem *ioaddr, u8 idx)
+{
+	u32 wr_val = 1;
+
+	/* Write 1 to unlock
+	 * curr value : action  :  next value
+	 * 0	      : write 0 :      0
+	 * 0	      : write 1 :      0
+	 * 1	      : write 0 :      1
+	 * 1	      : write 1 :      0
+	 */
+	writel(wr_val, ioaddr + NSEM(idx));
+	return 0;
+}
+
+/**
+ * tc956x_pf_parse_mbx
+ *
+ * \brief API to read and process the PF mailbox
+ *
+ * \details This function should be called from ISR to parse the mailbox for
+ * the mail received from particular function. Message will be processed and
+ * ACK/NACK will be sent in this function
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_src - Function to which ACK should be posted
+ *
+ * \return None
+ */
+void tc956x_pf_parse_mbx(struct tc956xmac_priv *priv,
+				enum mbx_msg_fns msg_src)
+{
+	u8 msg_buff[MBX_TOT_SIZE];
+
+	/* Get the function id information and read the mailbox.
+	 * Function id can be get earlier too
+	 */
+	if (!tc956xmac_rsc_mng_get_fn_id(priv,
+		priv->tc956x_BRIDGE_CFG_pci_base_addr, &priv->fn_id_info)) {
+		/* Read and acknowledge the mailbox */
+		tc956xmac_mbx_read(priv, msg_buff, msg_src,
+				   &priv->fn_id_info);
+	}
+}
+
+
+/**
+ * tc956x_pf_check_for_ack
+ *
+ * \brief Helper function to check for ACK
+ *
+ * \details This function is called from polling function to check if
+ * any ACK or NACK is received after writing in the mailbox
+ *
+ * \param[in] dev - Pointer to device structure
+ * \param[in] msg_dst - Function from which ACK/NACK should be read
+ * \param[in] fn_id_info - Pointer to Function info structure
+ *
+ * \return ACK/NACK or error
+ */
+static int tc956x_pf_check_for_ack(struct tc956xmac_priv *priv,
+				   enum mbx_msg_fns msg_dst,
+				   struct fn_id *fn_id_info)
+{
+	u8 *ptr_mail_box_idx;
+	u8 ack_buff[MBX_ACK_SIZE];
+
+	/* Read the correct mailbox access index as per
+	 * the destination function
+	 */
+	ptr_mail_box_idx = pf_get_mbx_mem_idx(msg_dst, fn_id_info);
+
+	/* Copy the ACK inidication data (first 4 bytes) from VF->PF mailbox */
+	memcpy_fromio(ack_buff,
+	       (priv->tc956x_SRAM_mailbox_base_addr +
+		      ((*ptr_mail_box_idx + PF_READ_ACK_OFST) * MBX_TOT_SIZE)),
+	       MBX_ACK_SIZE);
+
+	if ((ack_buff[0] & RSC_MNG_ACK_MASK) == RSC_MNG_ACK_MASK)
+		return ACK;
+	else if ((ack_buff[0] & RSC_MNG_NACK_MASK) == RSC_MNG_NACK_MASK)
+		return NACK;
+	else
+		return -1;
+}
+
+/**
+ * tc956x_pf_mbx_init
+ *
+ * \brief API to initialise mailbox memory and parameters
+ *
+ * \details This function initialise mailbox memory used by this function.
+ * Also to initialise parameters used for mailbox control.
+ *
+ * \param[in] ndev - Pointer to device structure
+ *
+ * \return None
+ */
+static void tc956x_pf_mbx_init(struct tc956xmac_priv *priv, void *data)
+{
+	priv->tc956x_SRAM_mailbox_base_addr = priv->tc956x_SRAM_pci_base_addr + PF_MBX_SRAM_ADDR;
+	memset_io(priv->tc956x_SRAM_mailbox_base_addr, 0, 1920);
+}
+
+/**
+ * tc956x_pf_mbx_poll_for_ack
+ *
+ * \brief API to poll for acknowledgement
+ *
+ * \details This function will poll for acknowledgement after writing to the
+ * mailbox memory. Polling is done by means of reading a
+ * resource manager register
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_dst - Function from which ACK should be polled
+ *
+ * \return None
+ */
+static int tc956x_pf_mbx_poll_for_ack(struct tc956xmac_priv *priv,
+				      enum mbx_msg_fns msg_dst)
+{
+
+	int countdown = MBX_TIMEOUT;
+	int ack_status;
+
+	ack_status =
+		tc956x_pf_check_for_ack(priv, msg_dst, &priv->fn_id_info);
+
+	while (countdown && (ack_status < 0)) {
+		countdown--;
+		udelay(1000);
+		ack_status = tc956x_pf_check_for_ack(priv, msg_dst,
+						     &priv->fn_id_info);
+	}
+
+	return ack_status;
+}
+
+/**
+ * tc956x_pf_mbx_send_ack
+ *
+ * \brief API to send acknowledgement
+ *
+ * \details This function will post the acknowledgement message
+ * to the mailbox memory.
+ * Basically this should be called after every read
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_buff - Pointer to buffer having the acknowledgement message
+ * \param[in] msg_dst - Function to which ACK should be posted
+ * \param[in] fn_id_info - Pointer to function id information
+ *
+ * \return None
+ */
+static void tc956x_pf_mbx_send_ack(struct tc956xmac_priv *priv, u8 *msg_buff,
+				  enum mbx_msg_fns msg_dst,
+				  struct fn_id *fn_id_info)
+{
+	u8 *ptr_mail_box_idx;
+
+	/* Read the correct mailbox access index as per
+	 * the destination function
+	 */
+	ptr_mail_box_idx = pf_get_mbx_mem_idx(msg_dst, fn_id_info);
+
+	/* Copy the ACK message data to PF->VF SRAM area.
+	 * Also first 4 bytes of ACK indications also copied here
+	 */
+	memcpy_toio((priv->tc956x_SRAM_mailbox_base_addr +
+		      ((*ptr_mail_box_idx + PF_SEND_ACK_OFST) * MBX_TOT_SIZE)),
+	       msg_buff, MBX_TOT_SIZE);
+
+	if (msg_dst >= 3)
+		priv->xstats.mbx_pf_sent_vf[msg_dst - 3]++;
+}
+
+/**
+ * tc956x_pf_trigger_interrupt
+ *
+ * \brief Helper function to set mailbox interrupt bit
+ *
+ * \details This function is called to set the mailbox interrupt bits while
+ * writing the mailbox. Interrupt targets can be MCU, VFs or other PF
+ *
+ * \param[in] msg_dst - Function to which interrupt should be set
+ *
+ * \return None
+ */
+static void tc956x_pf_trigger_interrupt(struct tc956xmac_priv *priv,
+					enum mbx_msg_fns msg_dst)
+{
+	void __iomem *ioaddr = priv->tc956x_BRIDGE_CFG_pci_base_addr;
+	u32 rsc_mng_interrupt_ctl = readl(ioaddr + RSCMNG_INT_CTRL_REG);
+
+	if (mcu == msg_dst)
+		rsc_mng_interrupt_ctl |= MBX_MCU_INTERRUPT;
+	else if (vf2 == msg_dst)
+		rsc_mng_interrupt_ctl |= MBX_VF3_INTERRUPT;
+	else if (vf1 == msg_dst)
+		rsc_mng_interrupt_ctl |= MBX_VF2_INTERRUPT;
+	else if (vf0 == msg_dst)
+		rsc_mng_interrupt_ctl |= MBX_VF1_INTERRUPT;
+	else if ((pf0 == msg_dst) || (pf1 == msg_dst))
+		rsc_mng_interrupt_ctl |= MBX_PF_INTERRUPT;
+
+	writel(rsc_mng_interrupt_ctl, ioaddr + RSCMNG_INT_CTRL_REG);
+}
+
+/**
+ * tc956x_pf_mbx_write
+ *
+ * \brief API to write a message to particular mailbox (sram)
+ *
+ * \details This function will post the request message to the mailbox memory.
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_buff - Pointer to buffer having the request message
+ * Skip the first 4 bytes while preparing data in this buffer
+ * \param[in] msg_dst - Function to which message should be posted
+ * \param[in] fn_id_info - Pointer to function id information
+ *
+ * \return success or error code
+ */
+static int tc956x_pf_mbx_write(struct tc956xmac_priv *priv, u8 *msg_buff,
+			       enum mbx_msg_fns msg_dst,
+			       struct fn_id *fn_id_info)
+{
+	u8 *ptr_mail_box_idx;
+	int ret;
+
+	/* Read the correct mailbox access index as per
+	 * the destination function
+	 */
+	ptr_mail_box_idx = pf_get_mbx_mem_idx(msg_dst, fn_id_info);
+
+	/* Get the semaphore lock before udpating mailbox */
+	ret = trylock_semaphore(priv->ioaddr, ((*ptr_mail_box_idx + 1) >> 1));
+	if (ret != 0)
+		return ret;
+
+
+	/* Clear the mailbox including ACK area (first 4 bytes) */
+	memset_io((priv->tc956x_SRAM_mailbox_base_addr +
+		      ((*ptr_mail_box_idx + PF_SEND_RQST_OFST) * MBX_TOT_SIZE)),
+	       0, MBX_TOT_SIZE);
+
+	/* Copy the mailbox data from local buffer to PF->VF or other
+	 * destination mailbox SRAM memory
+	 */
+	memcpy_toio((priv->tc956x_SRAM_mailbox_base_addr +
+	((*ptr_mail_box_idx + PF_SEND_RQST_OFST)*MBX_TOT_SIZE) + MBX_MSG_OFST),
+	       msg_buff, MBX_MSG_SIZE);
+
+	if (msg_dst >= 3)
+		priv->xstats.mbx_pf_sent_vf[msg_dst - 3]++;
+
+	/*Set the interrupt bit in resource manager interrupt register*/
+	tc956x_pf_trigger_interrupt(priv, msg_dst);
+
+	/*poll for ack/nack from the VF/MCU/Other PF*/
+	ret = tc956xmac_mbx_poll_for_ack(priv, msg_dst);
+
+	/* Read for ACK message */
+	if (ret > 0) {
+		tc956xmac_mbx_read(priv, msg_buff, msg_dst,
+				   &priv->fn_id_info);
+	}
+
+	unlock_semaphore(priv->ioaddr, ((*ptr_mail_box_idx + 1) >> 1));
+
+	return ret;
+}
+
+/**
+ * tc956x_pf_mbx_read
+ *
+ * \brief API to read a message from particular mailbox (sram)
+ *
+ * \details This function will read request message from the mailbox
+ * memory. This function to be called from mailbox interrupt routine.
+ * This API can be used in case of ACK message read as well.
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_buff - Pointer to read the mailbox message of max size
+ * 64 bytes
+ * \param[in] msg_src - Function from which mailbox message should be read
+ * \param[in] fn_id_info - Pointer to function id information
+ *
+ * \return success or error code
+ */
+static int tc956x_pf_mbx_read(struct tc956xmac_priv *priv, u8 *msg_buff,
+			      enum mbx_msg_fns msg_src,
+			      struct fn_id *fn_id_info)
+{
+	u8 *ptr_mail_box_idx;
+	enum mbx_msg_fns msg_dst;
+	u8 ack_msg[MBX_MSG_SIZE];
+	u8 ret_val = 0;
+	u8 vf_no = 0;
+
+	/* Read the correct mailbox access index as per
+	 * the destination function
+	 */
+	ptr_mail_box_idx = pf_get_mbx_mem_idx(msg_src, fn_id_info);
+
+	/* Copy the mailbox data from VF->PF mailbox */
+	memcpy_fromio(msg_buff,
+		(priv->tc956x_SRAM_mailbox_base_addr +
+			((*ptr_mail_box_idx + PF_READ_RQST_OFST) * MBX_TOT_SIZE)),
+		MBX_TOT_SIZE);
+
+	if (msg_src >= 3)
+		vf_no = msg_src - 2;
+
+	priv->xstats.mbx_pf_rcvd_vf[vf_no - 1]++;
+
+	switch (msg_buff[MBX_MSG_OFST]) {
+	case OPCODE_MBX_ADD_MAC_ADDR:
+		/* Call specific function for the type and get the return
+		 * as ACK,NACK and associated data
+		 */
+		ret_val =  tc956x_mbx_wrap_set_umac_addr(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0], vf_no);
+		break;
+
+	case OPCODE_MBX_SET_TX_Q_WEIGHT: /* set mtl tx queue weight */
+		ret_val = tc956x_mbx_wrap_set_mtl_tx_queue_weight(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_CFG_CBS: /* config cbs */
+		ret_val = tc956x_mbx_wrap_config_cbs(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_SETUP_CBS: /* setup cbs */
+		ret_val = tc956x_mbx_wrap_setup_cbs(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_SET_TX_Q_PRIOR: /* tx queue prior */
+		ret_val = tc956x_mbx_wrap_tx_queue_prior(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_SET_DMA_TX_MODE: /* set dma tx mode */
+		ret_val = tc956x_mbx_wrap_set_dma_tx_mode(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_VF_GET_LINK_STATUS: /* vf get link status */
+		ret_val = tc956x_mbx_wrap_get_link_status(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_VF_IOCTL:
+		ret_val = tc956xmac_mbx_ioctl_interface(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0], vf_no);
+		break;
+	case OPCODE_MBX_VF_ETHTOOL:
+		ret_val = tc956xmac_mbx_ethtool_interface(priv, priv->dev, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_VF_ADD_MAC:
+		ret_val = tc956xmac_mbx_add_mac(priv, priv->dev, &msg_buff[MBX_MSG_OFST], &ack_msg[0], vf_no);
+		break;
+	case OPCODE_MBX_VF_DELETE_MAC:
+		ret_val = tc956xmac_mbx_delete_mac(priv, priv->dev, &msg_buff[MBX_MSG_OFST], &ack_msg[0], vf_no);
+		break;
+	case OPCODE_MBX_VF_ADD_VLAN:
+		ret_val = tc956xmac_mbx_add_vlan(priv, priv->dev, &msg_buff[MBX_MSG_OFST], &ack_msg[0], vf_no);
+		break;
+	case OPCODE_MBX_VF_DELETE_VLAN:
+		ret_val = tc956xmac_mbx_delete_vlan(priv, priv->dev, &msg_buff[MBX_MSG_OFST], &ack_msg[0], vf_no);
+		break;
+	case OPCODE_MBX_DRV_CAP:
+		ret_val = tc956x_mbx_wrap_get_drv_cap(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_GET_UMAC_ADDR:
+	    ret_val = tc956x_mbx_wrap_get_umac_addr(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_RESET_EEE_MODE:
+	    ret_val = tc956x_mbx_wrap_reset_eee_mode(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_VF_RESET:
+	    ret_val = tc956x_mbx_wrap_vf_reset(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0], vf_no);
+		break;
+	case OPCODE_MBX_ACK_MSG:
+		/* ACK message */
+		memset_io((priv->tc956x_SRAM_mailbox_base_addr +
+		      ((*ptr_mail_box_idx + PF_READ_RQST_OFST) * MBX_TOT_SIZE)), 0,
+	       MBX_TOT_SIZE);
+		break;
+	default:
+		break;
+	}
+
+	/* Send the Acknowldegment if message read is not ACK message */
+	if (msg_buff[MBX_MSG_OFST] != OPCODE_MBX_ACK_MSG) {
+		/* For sending ACK, source of request message becomes
+		 * the destination
+		 */
+		msg_dst = msg_src;
+
+		/* Prepare first 4 bytes of ACK inidication data */
+		msg_buff[0] = ret_val;
+		msg_buff[1] = 0x0;
+		msg_buff[2] = 0x0;
+		msg_buff[3] = 0x0;
+
+		memcpy(&msg_buff[MBX_MSG_OFST], ack_msg, MBX_MSG_SIZE);
+
+		/* After successful parsing, ACK/NACK the functions which
+		 * originated the message
+		 */
+		tc956xmac_mbx_send_ack(priv, msg_buff, msg_dst,
+				       fn_id_info);
+	}
+	return 0;
+}
+
+const struct mac_mbx_ops tc956xmac_mbx_ops = {
+	.init = tc956x_pf_mbx_init,
+	.read = tc956x_pf_mbx_read,
+	.write = tc956x_pf_mbx_write,
+	.send_ack = tc956x_pf_mbx_send_ack,
+	.poll_for_ack = tc956x_pf_mbx_poll_for_ack,
+};
+#endif /* #ifdef TC956X_SRIOV_PF */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pf_mbx.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pf_mbx.h
@@ -0,0 +1,47 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_pf_mbx.h
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  10 July 2020 : Initial Version
+ *  VERSION      : 00-01
+ *
+ *  30 Nov 2021  : Base lined for SRIOV
+ *  VERSION      : 01-02
+ */
+
+#ifndef __TC956X_PF_MBX_H__
+#define __TC956X_PF_MBX_H__
+
+#include "common.h"
+#include <linux/netdevice.h>
+
+#define PF_READ_RQST_OFST 1
+#define PF_SEND_ACK_OFST 0
+
+#define PF_SEND_RQST_OFST 0
+#define PF_READ_ACK_OFST 1
+
+#define PFS_MAX 3 /* 2 PF + 1 MCU */
+#define FNS_MAX 6 /* actually 5 communication paths */
+#define PF_MBX_SRAM_ADDR 0x47060 /*0x20007060*/
+
+#endif /* __TC956X_PF_MBX_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pf_mbx_wrapper.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pf_mbx_wrapper.c
@@ -0,0 +1,1816 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_mbx_wrapper.c
+ *
+ * Copyright (C) 2022 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  15 Sep 2020 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  30 Nov 2021 : Base lined for SRIOV
+ *  VERSION     : 01-02
+ *
+ *  20 May 2022 : 1. Automotive Driver, CPE fixes merged and IPA Features supported
+ *                2. Base lined version
+ *  VERSION     : 03-00
+ */
+
+#include "tc956x_pf_mbx.h"
+#include "tc956xmac.h"
+#include "common.h"
+
+extern int tc956xmac_ioctl_get_cbs(struct tc956xmac_priv *priv, void *data);
+extern int tc956xmac_ioctl_set_cbs(struct tc956xmac_priv *priv, void *data);
+extern int tc956xmac_ioctl_set_rxp(struct tc956xmac_priv *priv, void *data);
+extern int tc956xmac_ioctl_get_rxp(struct tc956xmac_priv *priv, void *data);
+extern int tc956xmac_ioctl_set_est(struct tc956xmac_priv *priv, void *data);
+extern int tc956xmac_ioctl_get_est(struct tc956xmac_priv *priv, void *data);
+extern int tc956xmac_ioctl_set_fpe(struct tc956xmac_priv *priv, void *data);
+extern int tc956xmac_ioctl_get_fpe(struct tc956xmac_priv *priv, void *data);
+extern int tc956xmac_ethtool_op_get_eee(struct net_device *dev,
+										struct ethtool_eee *edata);
+
+
+extern int tc956x_pf_set_mac_filter(struct net_device *dev, int vf,
+										const u8 *mac);
+
+extern void tc956x_pf_del_mac_filter(struct net_device *dev, int vf, const u8 *mac);
+
+extern void tc956x_pf_set_vlan_filter(struct net_device *dev, u16 vf, u16 vid);
+
+extern void tc956x_pf_del_vlan_filter(struct net_device *dev, u16 vf, u16 vid);
+
+extern void tc956x_pf_del_umac_addr(struct tc956xmac_priv *priv, int index, int vf);
+
+extern void tc956xmac_service_mbx_event_schedule(struct tc956xmac_priv *priv);
+
+#ifdef TC956X_SRIOV_PF
+/**
+ * tc956x_mbx_mac_link
+ *
+ * \brief API to send link state and params to VFs
+ *
+ * \details This function is used to send PHY link parameters to VF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ *
+ * \return None
+ */
+static void tc956x_mbx_phy_link(struct tc956xmac_priv *priv)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MAX_NO_OF_VFS][MBX_TOT_SIZE];
+	int ret, i;
+	enum mbx_msg_fns msg_dst;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG1("NULL pointer error");
+		return;
+	}
+
+	for (i = 0; i < MAX_NO_OF_VFS; i++) {
+
+		mbx[i][0] = OPCODE_MBX_PHY_LINK; /* opcode */
+		mbx[i][1] = SIZE_MBX_PHY_LINK; /* size */
+
+	/* Copy link, speed and duplex values */
+		memcpy(&mbx[i][2], &priv->link, SIZE_MBX_PHY_LINK);
+	}
+
+	/* Send data to all VFs */
+	for (i = vf0; i <= vf2; i++) {
+
+		if (priv->clear_to_send[i-vf0] == VF_UP) {
+			msg_dst = (enum mbx_msg_fns) i;
+
+			ret = tc956xmac_mbx_write(priv, &mbx[i-vf0][0], msg_dst,
+							&priv->fn_id_info);
+
+			/* Validation of successfull message posting can be done
+			* by reading the mbx buffer for ACK opcode (0xFE)
+			*/
+
+			if (ret > 0)
+				KPRINT_DEBUG1(
+					"mailbox write with ACK or NACK %d msgbuff %x %x\n",
+									ret, mbx[i-vf0][0], mbx[i-vf0][4]);
+			else
+				KPRINT_DEBUG1("mailbox write failed");
+		} else
+			KPRINT_DEBUG1("VF %d not up", i-vf0);
+	}
+}
+
+/**
+ * tc956x_mbx_rx_dma_ch_tlptr
+ *
+ * \brief API to send ch numer to VF where overflow detected
+ *
+ * \details This function is used to send DMA channel no to VF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] ch - DMA channel no
+ * \param[in] vf - VF no of DMA channel
+ *
+ * \return 0 or error
+ */
+static int tc956x_mbx_rx_dma_ch_tlptr(struct tc956xmac_priv *priv, u32 ch, u8 vf)
+{
+
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret = 0;
+	enum mbx_msg_fns msg_dst;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG1("NULL pointer error");
+		return -EFAULT;
+	}
+
+	mbx[0] = OPCODE_MBX_DMA_CH_TLPTR; /* opcode */
+	mbx[1] = SIZE_MBX_RX_DMA_TL_PTR; /* size */
+
+	memcpy(&mbx[2], &ch, SIZE_MBX_RX_DMA_TL_PTR);
+
+	if (priv->clear_to_send[vf] == VF_UP) {
+		msg_dst = (enum mbx_msg_fns)(vf + 3);
+
+		ret = tc956xmac_mbx_write(priv, &mbx[0], msg_dst,
+							&priv->fn_id_info);
+
+		/* Validation of successfull message posting can be done
+		 * by reading the mbx buffer for ACK opcode (0xFF)
+		 */
+		if (ret > 0)
+			KPRINT_DEBUG1(
+				"mailbox write with ACK or NACK %d msgbuff %x %x\n",
+								ret, mbx[0], mbx[4]);
+		else
+			KPRINT_DEBUG1("mailbox write failed");
+	} else
+		KPRINT_DEBUG1("VF %d is not UP", vf);
+
+	return ret;
+}
+
+/**
+ * tc956x_mbx_set_dma_tx_mode
+ *
+ * \brief API to set dma tx mode
+ *
+ * \details This function is used to set dma tx mode on VF request using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_set_dma_tx_mode(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff)
+{
+	u32 txmode = 0;
+	u32 chan = 0;
+	u8 qmode = 0;
+	int txfifosz;
+
+	if (priv == NULL || mbx_buff == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_SET_DMA_TX_MODE)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_MBX_SET_DMA_TX_MODE)
+		return NACK;
+
+	memcpy(&txmode, &mbx_buff[2], sizeof(txmode));
+	memcpy(&chan, &mbx_buff[6], sizeof(chan));
+	memcpy(&txfifosz, &mbx_buff[10], sizeof(txfifosz));
+	qmode = mbx_buff[14];
+
+	/* Call core API to set the register */
+	tc956xmac_dma_tx_mode(priv, priv->ioaddr, txmode, chan,
+				txfifosz, qmode);
+
+	/* Clear the ACK buffer as there is no ACK message */
+	ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_set_mtl_tx_queue_weight
+ *
+ * \brief API to set tx mtl queue weight
+ *
+ * \details This function is used to set tx mtl queue weight on VF request using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_set_mtl_tx_queue_weight(struct tc956xmac_priv *priv, u8 *mbx_buff,
+												u8 *ack_buff)
+{
+	u32 weight, traffic_class;
+
+	if (priv == NULL || mbx_buff == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_SET_TX_Q_WEIGHT)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_MBX_SET_TX_Q_WEIGHT)
+		return NACK;
+
+	memcpy(&weight, &mbx_buff[2], sizeof(weight));
+	memcpy(&traffic_class, &mbx_buff[6], sizeof(traffic_class));
+
+	/* Call core API to set the register */
+	tc956xmac_set_mtl_tx_queue_weight(priv, priv->hw, weight, traffic_class);
+
+	/* Clear the ACK buffer as there is no ACK message */
+	ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_config_cbs
+ *
+ * \brief API to configure te cbs param
+ *
+ * \details This function is used to configure te cbs param on VF request using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_config_cbs(struct tc956xmac_priv *priv,
+				u8 *mbx_buff, u8 *ack_buff)
+{
+	u32 send_slope, idle_slope, high_credit;
+	u32	low_credit, queue;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	if (priv == NULL || mbx_buff == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_CFG_CBS)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_MBX_CFG_CBS)
+		return NACK;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.cbs, flags);
+#endif
+	memcpy(&send_slope, &mbx_buff[2], sizeof(send_slope));
+	memcpy(&idle_slope, &mbx_buff[6], sizeof(idle_slope));
+	memcpy(&high_credit, &mbx_buff[10], sizeof(high_credit));
+	memcpy(&low_credit, &mbx_buff[14], sizeof(low_credit));
+	memcpy(&queue, &mbx_buff[18], sizeof(queue));
+
+	/* Call core API to set the register */
+	tc956xmac_config_cbs(priv, priv->hw, send_slope,
+		idle_slope, high_credit, low_credit, queue);
+
+	if (priv->speed == SPEED_100) {
+		priv->cbs_speed100_cfg[queue].send_slope = send_slope;
+		priv->cbs_speed100_cfg[queue].idle_slope = idle_slope;
+		priv->cbs_speed100_cfg[queue].high_credit = high_credit;
+		priv->cbs_speed100_cfg[queue].low_credit = low_credit;
+	} else if (priv->speed == SPEED_1000) {
+		priv->cbs_speed1000_cfg[queue].send_slope = send_slope;
+		priv->cbs_speed1000_cfg[queue].idle_slope = idle_slope;
+		priv->cbs_speed1000_cfg[queue].high_credit = high_credit;
+		priv->cbs_speed1000_cfg[queue].low_credit = low_credit;
+	} else if (priv->speed == SPEED_10000) {
+		priv->cbs_speed10000_cfg[queue].send_slope = send_slope;
+		priv->cbs_speed10000_cfg[queue].idle_slope = idle_slope;
+		priv->cbs_speed10000_cfg[queue].high_credit = high_credit;
+		priv->cbs_speed10000_cfg[queue].low_credit = low_credit;
+	} else if (priv->speed == SPEED_2500) {
+		priv->cbs_speed2500_cfg[queue].send_slope = send_slope;
+		priv->cbs_speed2500_cfg[queue].idle_slope = idle_slope;
+		priv->cbs_speed2500_cfg[queue].high_credit = high_credit;
+		priv->cbs_speed2500_cfg[queue].low_credit = low_credit;
+	} else if (priv->speed == SPEED_5000) {
+		priv->cbs_speed5000_cfg[queue].send_slope = send_slope;
+		priv->cbs_speed5000_cfg[queue].idle_slope = idle_slope;
+		priv->cbs_speed5000_cfg[queue].high_credit = high_credit;
+		priv->cbs_speed5000_cfg[queue].low_credit = low_credit;
+	}
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.cbs, flags);
+#endif
+	/* Clear the ACK buffer as there is no ACK message */
+	ack_buff[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+
+}
+
+/**
+ * tc956x_mbx_setup_cbs
+ *
+ * \brief API to configure te cbs param using tc command
+ *
+ * \details This function is used to configure te cbs param using tc command
+ * on VF request using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_setup_cbs(struct tc956xmac_priv *priv,
+				u8 *mbx_buff, u8 *ack_buff)
+{
+	struct tc_cbs_qopt_offload qopt;
+
+	if (priv == NULL || mbx_buff == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_SETUP_CBS)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_MBX_SETUP_CBS)
+		return NACK;
+
+	memcpy(&qopt.enable, &mbx_buff[2], sizeof(qopt.enable));
+	memcpy(&qopt.idleslope, &mbx_buff[3], sizeof(qopt.idleslope));
+	memcpy(&qopt.sendslope, &mbx_buff[7], sizeof(qopt.sendslope));
+	memcpy(&qopt.hicredit, &mbx_buff[11], sizeof(qopt.hicredit));
+	memcpy(&qopt.locredit, &mbx_buff[15], sizeof(qopt.locredit));
+	memcpy(&qopt.queue, &mbx_buff[19], sizeof(qopt.queue));
+
+	tc956xmac_tc_setup_cbs(priv, &qopt);
+	/* Clear the ACK buffer as there is no ACK message */
+	ack_buff[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_tx_queue_prio
+ *
+ * \brief API to set tx queue priority
+ *
+ * \details This function is used to set tx queue priority
+ * on VF request using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_tx_queue_prio(struct tc956xmac_priv *priv,
+				u8 *mbx_buff, u8 *ack_buff)
+{
+	u32 queue;
+	u32 prio;
+
+	if (priv == NULL || mbx_buff == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_SET_TX_Q_PRIOR)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_MBX_SET_TX_Q_PRIOR)
+		return NACK;
+
+	memcpy(&prio, &mbx_buff[2], sizeof(prio));
+	memcpy(&queue, &mbx_buff[6], sizeof(queue));
+
+	/* Call core API to set the register */
+	tc956xmac_tx_queue_prio(priv, priv->hw, prio, queue);
+
+
+	/* Clear the ACK buffer as there is no ACK message */
+	ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+
+}
+
+/**
+ * tc956x_mbx_vf_get_link_status
+ *
+ * \brief API to send the pf link status
+ *
+ * \details This function is used to send the pf link status
+ * on VF request using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_vf_get_link_status(struct tc956xmac_priv *priv,
+					u8 *mbx_buff, u8 *ack_buff)
+{
+	if (priv == NULL || mbx_buff == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_VF_GET_LINK_STATUS)
+		return NACK;
+
+	if (mbx_buff[1] != 0)
+		return NACK;
+
+	ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+	ack_buff[1] = SIZE_MBX_PHY_LINK; /* set size */
+
+	/* Copy link, speed and duplex values */
+	memcpy(&ack_buff[2], &priv->link, SIZE_MBX_PHY_LINK);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+}
+
+/**
+ * tc956xmac_pf_ioctl_interface
+ *
+ * \brief API to process ioctl requests
+ *
+ * \details This function is used to process ioctl requests
+ * on VF request using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956xmac_pf_ioctl_interface(struct tc956xmac_priv *priv,
+							u8 *mbx, u8 *ack_buff, u8 vf_no)
+{
+	u32 val;
+	u32 addr;
+	u32 bar_num;
+	unsigned long flags;
+	struct hwtstamp_config *config = &priv->tstamp_config;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || mbx == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	switch (mbx[2]) {
+	case TC956XMAC_SET_CBS_1:
+	case TC956XMAC_SET_CBS_2:
+		{
+			static u8 msg_seq[TC956X_TOTAL_VFS], mbx_loc[TC956X_TOTAL_VFS][MBX_TOT_SIZE * TC956X_TWO];
+			static struct tc956xmac_ioctl_cbs_cfg cbs;
+
+			vf_no -= TC956X_ONE;
+			if (mbx[2] == TC956XMAC_SET_CBS_1) {
+
+				memset(&mbx_loc[vf_no][0], 0, MBX_TOT_SIZE * TC956X_TWO);
+
+				memcpy(&mbx_loc[vf_no][0], &mbx[4], SIZE_MBX_SET_GET_CBS_1);
+				msg_seq[vf_no] = TC956X_ONE << TC956X_ZERO;
+
+			} else if (mbx[2] == TC956XMAC_SET_CBS_2) {
+				memcpy(&mbx_loc[vf_no][SIZE_MBX_SET_GET_CBS_1], &mbx[4], SIZE_MBX_SET_GET_CBS_2);
+				msg_seq[vf_no] |= TC956X_ONE << TC956X_ONE;
+
+				if (msg_seq[vf_no] == TC956X_THREE) {
+
+					msg_seq[vf_no] = TC956X_ZERO;
+
+					memset(&cbs, 0, sizeof(cbs));
+
+					cbs.queue_idx = mbx[3];
+
+					memcpy(&cbs.speed100cfg.send_slope, &mbx_loc[vf_no][0], sizeof(cbs.speed100cfg.send_slope));
+					memcpy(&cbs.speed100cfg.idle_slope, &mbx_loc[vf_no][4], sizeof(cbs.speed100cfg.idle_slope));
+					memcpy(&cbs.speed100cfg.high_credit, &mbx_loc[vf_no][8], sizeof(cbs.speed100cfg.high_credit));
+					memcpy(&cbs.speed100cfg.low_credit, &mbx_loc[vf_no][12], sizeof(cbs.speed100cfg.low_credit));
+					memcpy(&cbs.speed100cfg.percentage, &mbx_loc[vf_no][16], sizeof(cbs.speed100cfg.percentage));
+
+					memcpy(&cbs.speed1000cfg.send_slope, &mbx_loc[vf_no][20], sizeof(cbs.speed1000cfg.send_slope));
+					memcpy(&cbs.speed1000cfg.idle_slope, &mbx_loc[vf_no][24], sizeof(cbs.speed1000cfg.idle_slope));
+					memcpy(&cbs.speed1000cfg.high_credit, &mbx_loc[vf_no][28], sizeof(cbs.speed1000cfg.high_credit));
+					memcpy(&cbs.speed1000cfg.low_credit, &mbx_loc[vf_no][32], sizeof(cbs.speed1000cfg.low_credit));
+					memcpy(&cbs.speed1000cfg.percentage, &mbx_loc[vf_no][36], sizeof(cbs.speed1000cfg.percentage));
+
+					memcpy(&cbs.speed10000cfg.send_slope, &mbx_loc[vf_no][40], sizeof(cbs.speed10000cfg.send_slope));
+					memcpy(&cbs.speed10000cfg.idle_slope, &mbx_loc[vf_no][44], sizeof(cbs.speed10000cfg.idle_slope));
+					memcpy(&cbs.speed10000cfg.high_credit, &mbx_loc[vf_no][48], sizeof(cbs.speed10000cfg.high_credit));
+					memcpy(&cbs.speed10000cfg.low_credit, &mbx_loc[vf_no][52], sizeof(cbs.speed10000cfg.low_credit));
+					memcpy(&cbs.speed10000cfg.percentage, &mbx_loc[vf_no][56], sizeof(cbs.speed10000cfg.percentage));
+
+					memcpy(&cbs.speed5000cfg.send_slope, &mbx_loc[vf_no][60], sizeof(cbs.speed5000cfg.send_slope));
+					memcpy(&cbs.speed5000cfg.idle_slope, &mbx_loc[vf_no][64], sizeof(cbs.speed5000cfg.idle_slope));
+					memcpy(&cbs.speed5000cfg.high_credit, &mbx_loc[vf_no][68], sizeof(cbs.speed5000cfg.high_credit));
+					memcpy(&cbs.speed5000cfg.low_credit, &mbx_loc[vf_no][72], sizeof(cbs.speed5000cfg.low_credit));
+					memcpy(&cbs.speed5000cfg.percentage, &mbx_loc[vf_no][76], sizeof(cbs.speed5000cfg.percentage));
+
+					memcpy(&cbs.speed2500cfg.send_slope, &mbx_loc[vf_no][80], sizeof(cbs.speed2500cfg.send_slope));
+					memcpy(&cbs.speed2500cfg.idle_slope, &mbx_loc[vf_no][84], sizeof(cbs.speed2500cfg.idle_slope));
+					memcpy(&cbs.speed2500cfg.high_credit, &mbx_loc[vf_no][88], sizeof(cbs.speed2500cfg.high_credit));
+					memcpy(&cbs.speed2500cfg.low_credit, &mbx_loc[vf_no][92], sizeof(cbs.speed2500cfg.low_credit));
+					memcpy(&cbs.speed2500cfg.percentage, &mbx_loc[vf_no][96], sizeof(cbs.speed2500cfg.percentage));
+
+					tc956xmac_ioctl_set_cbs(priv, &cbs);
+				}
+			}
+
+		/* Clear the ACK buffer as there is no ACK message */
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+		break;
+		}
+	case TC956XMAC_GET_CBS_1:
+	case TC956XMAC_GET_CBS_2:
+	{
+		static u8 mbx_loc[TC956X_TOTAL_VFS][MBX_TOT_SIZE * TC956X_TWO];
+		struct tc956xmac_ioctl_cbs_cfg cbs;
+		int ret = 0;
+
+		vf_no -= TC956X_ONE;
+		if (mbx[2] == TC956XMAC_GET_CBS_1) {
+			memset(&mbx_loc[vf_no][0], 0, sizeof(struct tc956xmac_ioctl_cbs_cfg));
+			cbs.queue_idx = mbx[3];
+			ret = tc956xmac_ioctl_get_cbs(priv, &cbs);
+			memcpy(&mbx_loc[vf_no][0], (u8 *)&cbs.speed100cfg, sizeof(cbs) - TC956X_EIGHT);
+
+			ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+			ack_buff[1] = SIZE_MBX_SET_GET_CBS_1;	/* set size */
+
+			memcpy(&ack_buff[2], &mbx_loc[vf_no][0], SIZE_MBX_SET_GET_CBS_1);
+
+		} else if (mbx[2] == TC956XMAC_GET_CBS_2) {
+
+			ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+			ack_buff[1] = SIZE_MBX_SET_GET_CBS_2;	/* set size */
+			memcpy(&ack_buff[2], &mbx_loc[vf_no][SIZE_MBX_SET_GET_CBS_1], SIZE_MBX_SET_GET_CBS_2);
+
+		}
+
+		break;
+	}
+	case TC956XMAC_SET_EST_1:
+	case TC956XMAC_SET_EST_2:
+	case TC956XMAC_SET_EST_3:
+	case TC956XMAC_SET_EST_4:
+	case TC956XMAC_SET_EST_5:
+	case TC956XMAC_SET_EST_6:
+	case TC956XMAC_SET_EST_7:
+	case TC956XMAC_SET_EST_8:
+	case TC956XMAC_SET_EST_9:
+	case TC956XMAC_SET_EST_10:
+	{
+		static u16 total_size, msg_size, offset = 1;
+		static u8 mbx_loc[MBX_TOT_SIZE * TC956X_TEN];
+		static struct tc956xmac_ioctl_est_cfg *est;
+
+		if (vf_no != TC956XMAC_VF_ADAS)
+			return NACK;
+
+		vf_no -= TC956X_ONE;
+
+		if (mbx[2] == TC956XMAC_SET_EST_1) {
+			est = kzalloc(sizeof(*est), GFP_ATOMIC);
+			if (!est)
+				return -ENOMEM;
+
+			memset(&mbx_loc[0], 0, MBX_TOT_SIZE * TC956X_TEN);
+			memcpy(&mbx_loc[0], &mbx[3], SIZE_MBX_SET_GET_EST_1);
+
+			memset(est, 0, sizeof(struct tc956xmac_est));
+			memcpy(&est->enabled, &mbx_loc[0], sizeof(est->enabled));
+			memcpy(&est->btr_offset[0], &mbx_loc[4], sizeof(est->btr_offset));
+			memcpy(&est->ctr[0], &mbx_loc[12], sizeof(est->ctr));
+			memcpy(&est->ter, &mbx_loc[20], sizeof(est->ter));
+			memcpy(&est->gcl_size, &mbx_loc[24], sizeof(est->gcl_size));
+
+			total_size = est->gcl_size * sizeof(*est->gcl);
+			msg_size = mbx[1] - EST_FIX_MSG_LEN;
+		} else {
+			memcpy(&mbx_loc[offset * SIZE_MBX_SET_GET_EST_1], &mbx[3], SIZE_MBX_SET_GET_EST_1);
+			msg_size += mbx[1];
+			offset++;
+		}
+		if (msg_size == total_size) {
+			memcpy(&est->gcl[0], &mbx_loc[28], est->gcl_size * sizeof(*est->gcl));
+			tc956xmac_ioctl_set_est(priv, est);
+			msg_size = 0;
+			total_size = 0;
+			offset = 1;
+		}
+		/* Clear the ACK buffer as there is no ACK message */
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+		break;
+	}
+	case TC956XMAC_GET_EST_1:
+	case TC956XMAC_GET_EST_2:
+	case TC956XMAC_GET_EST_3:
+	case TC956XMAC_GET_EST_4:
+	case TC956XMAC_GET_EST_5:
+	case TC956XMAC_GET_EST_6:
+	case TC956XMAC_GET_EST_7:
+	case TC956XMAC_GET_EST_8:
+	case TC956XMAC_GET_EST_9:
+	case TC956XMAC_GET_EST_10:
+	{
+		static u16 gcl_size, msg_size, toatl_msg_size, offset;
+		static u8 mbx_loc[MBX_TOT_SIZE * TC956X_TEN];
+		static struct tc956xmac_ioctl_est_cfg *est;
+
+		if (vf_no != TC956XMAC_VF_ADAS)
+			return NACK;
+
+		vf_no -= TC956X_ONE;
+
+		if (mbx[2] == TC956XMAC_GET_EST_1) {
+			est = kzalloc(sizeof(*est), GFP_ATOMIC);
+			if (!est)
+				return -ENOMEM;
+			tc956xmac_ioctl_get_est(priv, est);
+
+			memcpy(&mbx_loc[0], (u8 *)&est->enabled, sizeof(est->enabled));
+			memcpy(&mbx_loc[4], (u8 *)&est->estwid, sizeof(est->estwid));
+			memcpy(&mbx_loc[8], (u8 *)&est->estdep, sizeof(est->estdep));
+			memcpy(&mbx_loc[12], (u8 *)&est->btr_offset[0], sizeof(est->btr_offset));
+			memcpy(&mbx_loc[20], (u8 *)&est->ctr[0], sizeof(est->ctr));
+			memcpy(&mbx_loc[28], (u8 *)&est->ter, sizeof(est->ter));
+			memcpy(&mbx_loc[32], (u8 *)&est->gcl_size, sizeof(est->gcl_size));
+			memcpy(&mbx_loc[36], (u8 *)&est->gcl, (est->gcl_size * sizeof(*est->gcl)));
+
+			gcl_size = est->gcl_size * sizeof(*est->gcl);
+			toatl_msg_size = gcl_size + EST_FIX_MSG_LEN + 8;
+			msg_size = toatl_msg_size >= SIZE_MBX_SET_GET_EST_1 ? SIZE_MBX_SET_GET_EST_1 : toatl_msg_size;
+			offset = 0;
+		} else {
+			offset += msg_size;
+			msg_size = (toatl_msg_size - offset) >= SIZE_MBX_SET_GET_EST_1 ? SIZE_MBX_SET_GET_EST_1 : (toatl_msg_size - offset);
+		}
+
+		if (toatl_msg_size == (offset + msg_size)) {
+			kfree(est);
+		}
+
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		ack_buff[1] = msg_size; /* set ACK size */
+		memcpy(&ack_buff[2], &mbx_loc[offset], msg_size);
+
+		break;
+	}
+	case TC956XMAC_SET_RXP_1:
+	case TC956XMAC_SET_RXP_2:
+	case TC956XMAC_SET_RXP_3:
+	case TC956XMAC_SET_RXP_4:
+	case TC956XMAC_SET_RXP_5:
+	case TC956XMAC_SET_RXP_6:
+	case TC956XMAC_SET_RXP_7:
+	case TC956XMAC_SET_RXP_8:
+	case TC956XMAC_SET_RXP_9:
+	case TC956XMAC_SET_RXP_10:
+	case TC956XMAC_SET_RXP_11:
+	case TC956XMAC_SET_RXP_12:
+	case TC956XMAC_SET_RXP_13:
+	case TC956XMAC_SET_RXP_14:
+	case TC956XMAC_SET_RXP_15:
+	case TC956XMAC_SET_RXP_16:
+	case TC956XMAC_SET_RXP_17:
+	case TC956XMAC_SET_RXP_18:
+	case TC956XMAC_SET_RXP_19:
+	case TC956XMAC_SET_RXP_20:
+	case TC956XMAC_SET_RXP_21:
+	case TC956XMAC_SET_RXP_22:
+	case TC956XMAC_SET_RXP_23:
+	case TC956XMAC_SET_RXP_24:
+	case TC956XMAC_SET_RXP_25:
+	case TC956XMAC_SET_RXP_26:
+	case TC956XMAC_SET_RXP_27:
+	case TC956XMAC_SET_RXP_28:
+	case TC956XMAC_SET_RXP_29:
+	case TC956XMAC_SET_RXP_30:
+	case TC956XMAC_SET_RXP_31:
+	case TC956XMAC_SET_RXP_32:
+	case TC956XMAC_SET_RXP_33:
+	case TC956XMAC_SET_RXP_34:
+	case TC956XMAC_SET_RXP_35:
+	case TC956XMAC_SET_RXP_36:
+	case TC956XMAC_SET_RXP_37:
+	{
+		static u16 total_size, msg_size, offset = 1;
+		static u8 *mbx_loc;
+		static struct tc956xmac_ioctl_rxp_cfg *rxp;
+
+		if (mbx[2] == TC956XMAC_SET_RXP_1) {
+			rxp = kzalloc(sizeof(*rxp), GFP_ATOMIC);
+			if (!rxp)
+				return -ENOMEM;
+
+			mbx_loc = kzalloc(sizeof(*rxp), GFP_ATOMIC);
+			if (!mbx_loc) {
+				kfree(rxp);
+				return -ENOMEM;
+			}
+
+			memset(&mbx_loc[0], 0, sizeof(*rxp));
+			memcpy(&mbx_loc[0], &mbx[3], SIZE_MBX_SET_GET_RXP_1);
+
+			memset(rxp, 0, sizeof(struct tc956xmac_ioctl_rxp_cfg));
+			memcpy(&rxp->frpes, &mbx_loc[0], sizeof(rxp->frpes));
+			memcpy(&rxp->enabled, &mbx_loc[4], sizeof(rxp->enabled));
+			memcpy(&rxp->nve, &mbx_loc[8], sizeof(rxp->nve));
+			memcpy(&rxp->npe, &mbx_loc[12], sizeof(rxp->npe));
+
+			total_size = rxp->nve * sizeof(*rxp->entries);
+			msg_size = mbx[1] - RXP_FIX_MSG_LEN;
+		} else {
+			memcpy(&mbx_loc[offset*SIZE_MBX_SET_GET_RXP_1], &mbx[3], SIZE_MBX_SET_GET_RXP_1);
+			msg_size += mbx[1];
+			offset++;
+		}
+
+		if (msg_size == total_size) {
+			memcpy(&rxp->entries[0], &mbx_loc[16], total_size);
+			tc956xmac_ioctl_set_rxp(priv, rxp);
+			msg_size = 0;
+			total_size = 0;
+			offset = 1;
+			kfree(mbx_loc);
+		}
+		/* Clear the ACK buffer as there is no ACK message */
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+		break;
+	}
+	case TC956XMAC_GET_RXP_1:
+	case TC956XMAC_GET_RXP_2:
+	case TC956XMAC_GET_RXP_3:
+	case TC956XMAC_GET_RXP_4:
+	case TC956XMAC_GET_RXP_5:
+	case TC956XMAC_GET_RXP_6:
+	case TC956XMAC_GET_RXP_7:
+	case TC956XMAC_GET_RXP_8:
+	case TC956XMAC_GET_RXP_9:
+	case TC956XMAC_GET_RXP_10:
+	case TC956XMAC_GET_RXP_11:
+	case TC956XMAC_GET_RXP_12:
+	case TC956XMAC_GET_RXP_13:
+	case TC956XMAC_GET_RXP_14:
+	case TC956XMAC_GET_RXP_15:
+	case TC956XMAC_GET_RXP_16:
+	case TC956XMAC_GET_RXP_17:
+	case TC956XMAC_GET_RXP_18:
+	case TC956XMAC_GET_RXP_19:
+	case TC956XMAC_GET_RXP_20:
+	case TC956XMAC_GET_RXP_21:
+	case TC956XMAC_GET_RXP_22:
+	case TC956XMAC_GET_RXP_23:
+	case TC956XMAC_GET_RXP_24:
+	case TC956XMAC_GET_RXP_25:
+	case TC956XMAC_GET_RXP_26:
+	case TC956XMAC_GET_RXP_27:
+	case TC956XMAC_GET_RXP_28:
+	case TC956XMAC_GET_RXP_29:
+	case TC956XMAC_GET_RXP_30:
+	case TC956XMAC_GET_RXP_31:
+	case TC956XMAC_GET_RXP_32:
+	case TC956XMAC_GET_RXP_33:
+	case TC956XMAC_GET_RXP_34:
+	case TC956XMAC_GET_RXP_35:
+	case TC956XMAC_GET_RXP_36:
+	case TC956XMAC_GET_RXP_37:
+	{
+		static u16 rxp_size, msg_size, toatl_msg_size, offset;
+		static u8 *mbx_loc;
+		static struct tc956xmac_ioctl_rxp_cfg *rxp;
+
+		if (mbx[2] == TC956XMAC_GET_RXP_1) {
+			rxp = kzalloc(sizeof(*rxp), GFP_ATOMIC);
+			if (!rxp)
+				return -ENOMEM;
+
+			mbx_loc = kzalloc(sizeof(*rxp), GFP_ATOMIC);
+			if (!mbx_loc) {
+				kfree(rxp);
+				return -ENOMEM;
+			}
+			tc956xmac_ioctl_get_rxp(priv, rxp);
+
+			memcpy(&mbx_loc[0], (u8 *)&rxp->frpes, sizeof(rxp->frpes));
+			memcpy(&mbx_loc[4], (u8 *)&rxp->enabled, sizeof(rxp->enabled));
+			memcpy(&mbx_loc[8], (u8 *)&rxp->nve, sizeof(rxp->nve));
+			memcpy(&mbx_loc[12], (u8 *)&rxp->npe, sizeof(rxp->npe));
+			memcpy(&mbx_loc[16], (u8 *)&rxp->entries[0], (rxp->nve * sizeof(*rxp->entries)));
+
+			rxp_size = rxp->nve * sizeof(*rxp->entries);
+			toatl_msg_size = rxp_size + RXP_FIX_MSG_LEN;
+			msg_size = toatl_msg_size >= SIZE_MBX_SET_GET_RXP_1 ? SIZE_MBX_SET_GET_RXP_1 : toatl_msg_size;
+
+			offset = 0;
+		} else {
+			offset += msg_size;
+			msg_size = (toatl_msg_size - offset) >= SIZE_MBX_SET_GET_RXP_1 ? SIZE_MBX_SET_GET_RXP_1 : (toatl_msg_size - offset);
+		}
+
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		ack_buff[1] = msg_size; /* set ACK size */
+		memcpy(&ack_buff[2], &mbx_loc[offset], msg_size);
+
+		if (toatl_msg_size == (offset + msg_size)) {
+			kfree(rxp);
+			kfree(mbx_loc);
+		}
+
+		break;
+	}
+	case TC956XMAC_SET_FPE_1:
+	{
+		struct tc956xmac_ioctl_fpe_cfg fpe;
+
+		if (vf_no != TC956XMAC_VF_ADAS)
+			return NACK;
+
+		vf_no -= TC956X_ONE;
+
+		memcpy(&fpe.enabled, &mbx[3], sizeof(fpe.enabled));
+		memcpy(&fpe.pec, &mbx[7], sizeof(fpe.pec));
+		memcpy(&fpe.afsz, &mbx[11], sizeof(fpe.afsz));
+		memcpy(&fpe.RA_time, &mbx[15], sizeof(fpe.RA_time));
+		memcpy(&fpe.HA_time, &mbx[19], sizeof(fpe.HA_time));
+
+		tc956xmac_ioctl_set_fpe(priv, &fpe);
+
+		/* Clear the ACK buffer as there is no ACK message */
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+		break;
+	}
+	case TC956XMAC_GET_FPE_1:
+	{
+		struct tc956xmac_ioctl_fpe_cfg fpe;
+
+		if (vf_no != TC956XMAC_VF_ADAS)
+			return NACK;
+
+		vf_no -= TC956X_ONE;
+
+		tc956xmac_ioctl_get_fpe(priv, &fpe);
+
+		/* Clear the ACK buffer as there is no ACK message */
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		ack_buff[1] = SIZE_MBX_SET_GET_FPE_1;
+		memcpy(&ack_buff[2], (u8 *)&fpe.enabled, sizeof(fpe.enabled));
+		memcpy(&ack_buff[6], (u8 *)&fpe.pec, sizeof(fpe.pec));
+		memcpy(&ack_buff[10], (u8 *)&fpe.afsz, sizeof(fpe.afsz));
+		memcpy(&ack_buff[14], (u8 *)&fpe.RA_time, sizeof(fpe.RA_time));
+		memcpy(&ack_buff[18], (u8 *)&fpe.HA_time, sizeof(fpe.HA_time));
+		break;
+	}
+	case TC956XMAC_GET_SPEED:
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		ack_buff[1] = sizeof(priv->speed); /* set size */
+		memcpy(&ack_buff[2], (u8 *)&priv->speed,
+			sizeof(priv->speed));
+		break;
+
+	case TC956XMAC_REG_WR:
+		memcpy(&bar_num, &mbx[3], sizeof(bar_num));
+		memcpy(&addr, &mbx[7], sizeof(addr));
+		memcpy(&val, &mbx[11], sizeof(val));
+
+		if (bar_num == 4)
+			writel(val, (void __iomem *)(priv->dev->base_addr + addr));
+		else if (bar_num == 2)/*SRAM bar number 2*/
+			writel(val, (void __iomem *)(priv->tc956x_SRAM_pci_base_addr + addr));
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+		break;
+	case OPCODE_MBX_VF_GET_MII_PHY:
+		ack_buff[0] = OPCODE_MBX_ACK_MSG;
+		ack_buff[1] = sizeof(priv->plat->phy_addr);
+		memcpy(&ack_buff[2], (u8 *)&priv->plat->phy_addr,
+			sizeof(priv->plat->phy_addr));
+		break;
+	case OPCODE_MBX_VF_GET_MII_REG_1:
+		vf_no -= TC956X_ONE;
+		memcpy(&priv->mbx_wq_param.rq.ifr_ifru.ifru_data, &mbx[3], 6);
+		memcpy(&priv->mbx_wq_param.rq.ifr_ifrn.ifrn_name, &mbx[9], 16);
+
+		spin_lock_irqsave(&priv->wq_lock, flags);
+		priv->mbx_wq_param.fn_id = SCH_WQ_PHY_REG_RD;
+		priv->mbx_wq_param.val_out[vf_no] = 0;
+		priv->mbx_wq_param.vf_no = vf_no;
+
+		tc956xmac_service_mbx_event_schedule(priv);
+		spin_unlock_irqrestore(&priv->wq_lock, flags);
+
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+		break;
+	case OPCODE_MBX_VF_GET_MII_REG_2:
+		vf_no -= TC956X_ONE;
+		ack_buff[0] = OPCODE_MBX_ACK_MSG;
+		ack_buff[1] = sizeof(priv->mbx_wq_param.val_out[vf_no]);
+		memcpy(&ack_buff[2], (u8 *)&priv->mbx_wq_param.val_out[vf_no], sizeof(priv->mbx_wq_param.val_out[vf_no]));
+		break;
+	case OPCODE_MBX_VF_GET_HW_STMP:
+		ack_buff[0] = OPCODE_MBX_ACK_MSG;
+		ack_buff[1] = sizeof(*config);
+		memcpy(&ack_buff[2], (u8 *)config, sizeof(*config));
+		break;
+	}
+	return ACK;
+}
+
+/**
+ * tc956xmac_pf_ethtool_interface
+ *
+ * \brief API to process ethtool requests
+ *
+ * \details This function is used to process ethtool requests
+ * on VF request using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956xmac_pf_ethtool_interface(struct tc956xmac_priv *priv, struct net_device *netdev,
+								u8 *mbx, u8 *ack_buff)
+{
+	struct ethtool_eee edata;
+	unsigned long flags;
+
+	if (priv == NULL || mbx == NULL || netdev == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	switch (mbx[2]) {
+	case TC956XMAC_GET_PAUSE_PARAM:
+		spin_lock_irqsave(&priv->wq_lock, flags);
+		priv->mbx_wq_param.fn_id = SCH_WQ_GET_PAUSE_PARAM;
+		tc956xmac_service_mbx_event_schedule(priv);
+		spin_unlock_irqrestore(&priv->wq_lock, flags);
+
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+		break;
+	case TC956XMAC_GET_PAUSE_PARAM_2:
+		ack_buff[0] = OPCODE_MBX_ACK_MSG;
+		ack_buff[1] = sizeof(struct ethtool_pauseparam);
+		memcpy(&ack_buff[2], (u8 *)&priv->mbx_wq_param.pause,
+			sizeof(struct ethtool_pauseparam));
+		break;
+	case TC956XMAC_GET_EEE:
+		tc956xmac_ethtool_op_get_eee(netdev, &edata);
+		ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+		ack_buff[1] = sizeof(struct ethtool_eee); /* set size */
+		memcpy(&ack_buff[2], (u8 *)&edata,
+			sizeof(struct ethtool_eee));
+		break;
+
+	default:
+		break;
+	}
+
+	return ACK;
+}
+
+/**
+ * tc956xmac_pf_set_mac_filter
+ *
+ * \brief API to add the mac address filter value
+ *
+ * \details This function is used to add the mac address filter value
+ * on VF request using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] dev - Pointer to device
+ * \param[in] mbx_buff - Pointer to message
+ * \param[in] vf - VF no
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956xmac_pf_set_mac_filter(struct tc956xmac_priv *priv, struct net_device *dev,
+				u8 *mbx_buff, u8 *ack_buff, u8 vf)
+{
+	u8 mac[SIZE_MBX_VF_MAC];
+	int ret;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	if (priv == NULL || mbx_buff == NULL || dev == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_VF_ADD_MAC)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_MBX_VF_MAC)
+		return NACK;
+
+	memcpy(&mac[0], &mbx_buff[2], SIZE_MBX_VF_MAC);
+	/* Call core API to set the register */
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+	ret = tc956x_pf_set_mac_filter(dev, vf, &mac[0]);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	if (ret)
+		return NACK;
+
+	/* Clear the ACK buffer as there is no ACK message */
+	ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+}
+
+/**
+ * tc956xmac_pf_del_mac_filter
+ *
+ * \brief API to delete the mac address filter value
+ *
+ * \details This function is used to delete the mac address filter value
+ * on VF request using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] dev - Pointer to device
+ * \param[in] mbx_buff - Pointer to message
+ * \param[in] vf - VF no
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956xmac_pf_del_mac_filter(struct tc956xmac_priv *priv, struct net_device *dev,
+					u8 *mbx_buff, u8 *ack_buff, u8 vf)
+{
+
+	u8 mac[SIZE_MBX_VF_MAC];
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	if (priv == NULL || mbx_buff == NULL || dev == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_VF_DELETE_MAC)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_MBX_VF_MAC)
+		return NACK;
+
+	memcpy(&mac[0], &mbx_buff[2], SIZE_MBX_VF_MAC);
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+	/* Call core API to set the register */
+	tc956x_pf_del_mac_filter(dev, vf, &mac[0]);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	/* Clear the ACK buffer as there is no ACK message */
+	ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+}
+
+/**
+ * tc956xmac_pf_set_vlan_filter
+ *
+ * \brief API to add the vlan ids filter value
+ *
+ * \details This function is used to add the vlan filter value
+ * on VF request using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] dev - Pointer to device
+ * \param[in] mbx_buff - Pointer to message
+ * \param[in] vf - VF no
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956xmac_pf_set_vlan_filter(struct tc956xmac_priv *priv, struct net_device *dev,
+				u8 *mbx_buff, u8 *ack_buff, u8 vf)
+{
+	u16 vid;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	if (priv == NULL || mbx_buff == NULL || dev == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_VF_ADD_VLAN)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_MBX_VF_VLAN)
+		return NACK;
+
+	memcpy(&vid, &mbx_buff[2], SIZE_MBX_VF_VLAN);
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.vlan_filter, flags);
+#endif
+
+	/* Call core API to set the register */
+	tc956x_pf_set_vlan_filter(dev, vf, vid);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.vlan_filter, flags);
+#endif
+
+	/* Clear the ACK buffer as there is no ACK message */
+	ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+
+}
+
+/**
+ * tc956xmac_pf_set_vlan_filter
+ *
+ * \brief API to add the vlan ids filter value
+ *
+ * \details This function is used to add the vlan filter value
+ * on VF request using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] dev - Pointer to device
+ * \param[in] mbx_buff - Pointer to message
+ * \param[in] vf - VF no
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956xmac_pf_del_vlan_filter(struct tc956xmac_priv *priv, struct net_device *dev,
+						u8 *mbx_buff, u8 *ack_buff, u8 vf)
+{
+	u16 vid;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	if (priv == NULL || mbx_buff == NULL || dev == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_VF_DELETE_VLAN)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_MBX_VF_VLAN)
+		return NACK;
+
+	memcpy(&vid, &mbx_buff[2], SIZE_MBX_VF_VLAN);
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.vlan_filter, flags);
+#endif
+	/* Call core API to set the register */
+	tc956x_pf_del_vlan_filter(dev, vf, vid);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.vlan_filter, flags);
+#endif
+	/* Clear the ACK buffer as there is no ACK message */
+	ack_buff[0] = OPCODE_MBX_ACK_MSG; /* set ACK opcode */
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	/* return ACK as all steps are successfull */
+	return ACK;
+
+}
+/**
+ * tc956x_mbx_rx_crc
+ *
+ * \brief API to send Rx CRC state to VFs
+ *
+ * \details This function is used to send Rx CRC states to VF using
+ * mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ *
+ * \return None
+ */
+static void tc956x_mbx_rx_crc(struct tc956xmac_priv *priv)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MAX_NO_OF_VFS][MBX_TOT_SIZE];
+	int ret, i;
+	enum mbx_msg_fns msg_dst;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG1("NULL pointer error");
+		return;
+	}
+
+	for (i = 0; i < MAX_NO_OF_VFS; i++) {
+
+		mbx[i][0] = OPCODE_MBX_RX_CRC; /* opcode */
+		mbx[i][1] = SIZE_MBX_RX_CRC; /* size */
+
+	/* Copy Rx crc pad values */
+		memcpy(&mbx[i][2], &priv->rx_crc_pad_state, SIZE_MBX_RX_CRC);
+	}
+
+	/* Send data to all VFs */
+	for (i = vf0; i <= vf2; i++) {
+	if (priv->clear_to_send[i-vf0] == VF_UP) {
+
+		msg_dst = (enum mbx_msg_fns) i;
+		ret = tc956xmac_mbx_write(priv, &mbx[i-vf0][0], msg_dst,
+							&priv->fn_id_info);
+
+		/* Validation of successfull message posting can be done
+		 * by reading the mbx buffer for ACK opcode (0xFE)
+		 */
+
+		if (ret > 0)
+			KPRINT_DEBUG1(
+			"mailbox write with ACK or NACK %d msgbuff %x %x", ret, mbx[i-vf0][0], mbx[i-vf0][4]);
+		else
+			KPRINT_DEBUG1("mailbox write failed");
+		} else
+			KPRINT_DEBUG1("VF %d not up", i-vf0);
+	}
+}
+
+/**
+ * tc956x_mbx_rx_csum
+ *
+ * \brief API to send Rx checksum state to VFs
+ *
+ * \details This function is used to send Rx Checksum states to VF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ *
+ * \return None
+ */
+static void tc956x_mbx_rx_csum(struct tc956xmac_priv *priv)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MAX_NO_OF_VFS][MBX_TOT_SIZE];
+	int ret, i;
+	enum mbx_msg_fns msg_dst;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG1("NULL pointer error");
+		return;
+	}
+
+	for (i = 0; i < MAX_NO_OF_VFS; i++) {
+		mbx[i][0] = OPCODE_MBX_RX_CSUM; /* opcode */
+		mbx[i][1] = SIZE_MBX_RX_CSUM; /* size */
+
+		/* Copy link, speed and duplex values */
+		memcpy(&mbx[i][2], &priv->rx_csum_state, SIZE_MBX_RX_CSUM);
+	}
+
+	/* Send data to all VFs */
+	for (i = vf0; i <= vf2; i++) {
+		if (priv->clear_to_send[i-vf0] == VF_UP) {
+			msg_dst = (enum mbx_msg_fns) i;
+			ret = tc956xmac_mbx_write(priv, &mbx[i-vf0][0], msg_dst,
+							&priv->fn_id_info);
+
+		/* Validation of successfull message posting can be done
+		 * by reading the mbx buffer for ACK opcode (0xFE)
+		 */
+			if (ret > 0)
+				KPRINT_DEBUG1(
+				"mailbox write with ACK or NACK %d msgbuff %x %x\n", ret, mbx[i-vf0][0], mbx[i-vf0][4]);
+			else
+				KPRINT_DEBUG1("mailbox write failed");
+		} else
+			KPRINT_DEBUG1("VF %d not up", i-vf0);
+	}
+}
+
+/**
+ * tc956x_mbx_get_drv_cap
+ *
+ * \brief API to send PF driver featues state to VFs
+ *
+ * \details This function is used to send PF driver feature states to VF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_get_drv_cap(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff)
+{
+	if (priv == NULL || mbx_buff == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_DRV_CAP)
+		return NACK;
+
+	if (mbx_buff[1] != 0)
+		return NACK;
+
+	priv->pf_drv_cap.crc_en = priv->rx_crc_pad_state;
+	priv->pf_drv_cap.csum_en = priv->rx_csum_state;
+
+	ack_buff[0] = OPCODE_MBX_ACK_MSG;
+	ack_buff[1] = SIZE_MBX_DRV_CAP;
+	/* Copy driver capability to ack buffer */
+	memcpy(&ack_buff[2], &priv->pf_drv_cap, SIZE_MBX_DRV_CAP);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_get_umac_addr
+ *
+ * \brief API to send PF unicast mac addr to VFs
+ *
+ * \details This function is used to send PF unicast mac addr to VF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_get_umac_addr(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff)
+{
+	unsigned char addr[SIZE_MBX_VF_MAC];
+	unsigned int reg_n;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	if (priv == NULL || mbx_buff == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_GET_UMAC_ADDR)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_GET_UMAC_ADDR)
+		return NACK;
+
+	memcpy(&reg_n, &mbx_buff[2], SIZE_GET_UMAC_ADDR);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	tc956xmac_get_umac_addr(priv, priv->hw, addr, reg_n);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	ack_buff[0] = OPCODE_MBX_ACK_MSG;
+	ack_buff[1] = SIZE_MBX_VF_MAC;
+
+	memcpy(&ack_buff[2], addr, SIZE_MBX_VF_MAC);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_set_umac_addr
+ *
+ * \brief API to set unicast mac addr of VFs
+ *
+ * \details This function is used to send PF unicast mac addr to VF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_set_umac_addr(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_buff, u8 vf)
+{
+	unsigned char addr[SIZE_MBX_VF_MAC];
+	unsigned int reg_n;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	if (priv == NULL || mbx_buff == NULL || ack_buff == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_ADD_MAC_ADDR)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_SET_UMAC_ADDR)
+		return NACK;
+
+	memcpy(addr, &mbx_buff[2], SIZE_MBX_VF_MAC);
+	memcpy(&reg_n, &mbx_buff[8], 4);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	tc956xmac_set_umac_addr(priv, priv->hw, addr, reg_n, vf);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	ack_buff[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_buff[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_reset_eee
+ *
+ * \brief API to reset eee
+ *
+ * \details This function is used to reset eee mode on VF request using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mbx_buff - Pointer to message
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_reset_eee_mode(struct tc956xmac_priv *priv, u8 *mbx_buff, u8 *ack_msg)
+{
+	if (priv == NULL || mbx_buff == NULL || ack_msg == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_MBX_RESET_EEE_MODE)
+		return NACK;
+
+	if (mbx_buff[1] != 0)
+		return NACK;
+
+	tc956xmac_reset_eee_mode(priv, priv->hw);
+
+	ack_msg[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_msg[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+/**
+ * tc956xmac_mbx_vf_reset
+ *
+ * \brief API to send tbs sate change to VF
+ *
+ * \details This function is used to send TBS state change to VF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] ch - DMA channel no
+ * \param[in] vf - VF of DMA channel
+ *
+ * \return 0 or error
+ */
+static int tc956xmac_mbx_vf_reset(struct tc956xmac_priv *priv, u8 *mbx_buff,
+					u8 *ack_msg, u8 vf)
+{
+	struct tc956x_mac_addr *mac_table = &priv->mac_table[0];
+	struct tc956x_vlan_id *vlan_table = &priv->vlan_table[0];
+	u8 i, vf_number;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	if (priv == NULL || mbx_buff == NULL || ack_msg == NULL) {
+		KPRINT_DEBUG1("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (mbx_buff[0] != OPCODE_VF_RESET)
+		return NACK;
+
+	if (mbx_buff[1] != SIZE_VF_RESET)
+		return NACK;
+
+	if (mbx_buff[2] == VF_UP) {
+		priv->clear_to_send[vf-1] = VF_UP;
+		KPRINT_DEBUG1("P%d VF%d MBX State : UP\n", priv->port_num, vf-1);
+	} else if (mbx_buff[2] == VF_DOWN) {
+		priv->clear_to_send[vf-1] = VF_DOWN;
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+		spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+		tc956x_pf_del_umac_addr(priv, HOST_MAC_ADDR_OFFSET + vf, vf);   //VF device address
+		for (i = XGMAC_ADDR_ADD_SKIP_OFST; i < (TC956X_MAX_PERFECT_ADDRESSES);
+			i++, mac_table++) {
+			for (vf_number = 0; vf_number < 4; vf_number++) {
+				if (mac_table->vf[vf_number] == vf)
+					tc956x_pf_del_mac_filter(priv->dev, vf, (u8 *)&mac_table->mac_address);
+			}
+		}
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+		spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+		spin_lock_irqsave(&priv->spn_lock.vlan_filter, flags);
+#endif
+		for (i = 0; i < TC956X_MAX_PERFECT_VLAN; i++, vlan_table++) {
+			for (vf_number = 0; vf_number < 4; vf_number++) {
+				if (vlan_table->vf[vf_number].vf_number == vf)
+					tc956x_pf_del_vlan_filter(priv->dev, vf, vlan_table->vid);
+			}
+		}
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+		spin_unlock_irqrestore(&priv->spn_lock.vlan_filter, flags);
+#endif
+		KPRINT_DEBUG1("P%d VF%d MBX State : DOWN\n", priv->port_num, vf-1);
+	} else if (mbx_buff[2] == VF_SUSPEND || mbx_buff[2] == VF_RELEASE) {
+		priv->clear_to_send[vf-1] = mbx_buff[2];
+
+		if (mbx_buff[2] == VF_SUSPEND)
+			KPRINT_DEBUG1("P%d VF%d MBX State : SUSPEND\n", priv->port_num, vf-1);
+		else
+			KPRINT_DEBUG1("P%d VF%d MBX State : RELEASE\n", priv->port_num, vf-1);
+	}
+
+	ack_msg[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_msg[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_setup_etf
+ *
+ * \brief API to send tbs sate change to VF
+ *
+ * \details This function is used to send TBS state change to VF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] ch - DMA channel no
+ * \param[in] vf - VF of DMA channel
+ *
+ * \return 0 or error
+ */
+static int tc956x_mbx_setup_etf(struct tc956xmac_priv *priv, u32 ch, u8 vf)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret = 0;
+	enum mbx_msg_fns msg_dst;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG1("NULL pointer error");
+		return -EFAULT;
+	}
+
+	mbx[0] = OPCODE_MBX_SETUP_ETF; /* opcode */
+	mbx[1] = SIZE_MBX_SETUP_ETF; /* size */
+
+	memcpy(&mbx[2], &ch, 4);
+	memcpy(&mbx[6], &priv->tx_queue[ch].tbs, 1);
+
+	if (priv->clear_to_send[vf] == VF_UP) {
+		msg_dst = (enum mbx_msg_fns)(vf + 3);
+
+		ret = tc956xmac_mbx_write(priv, &mbx[0], msg_dst,
+							&priv->fn_id_info);
+
+		/* Validation of successfull message posting can be done
+		 * by reading the mbx buffer for ACK opcode (0xFF)
+		 */
+		if (ret > 0)
+			KPRINT_DEBUG1(
+				"mailbox write with ACK or NACK %d msgbuff %x %x\n",
+								ret, mbx[0], mbx[4]);
+		else
+			KPRINT_DEBUG1("mailbox write failed");
+	} else
+		KPRINT_DEBUG1("VF %d is not UP", vf);
+	return ret;
+}
+
+/**
+ * tc956x_mbx_flr
+ *
+ * \brief API to infor VF of PF FLR
+ *
+ * \details This function is used to inform VF about PF FLR using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ *
+ * \return none
+ */
+static void tc956x_mbx_flr(struct tc956xmac_priv *priv)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MAX_NO_OF_VFS][MBX_TOT_SIZE];
+	int ret, i;
+	enum mbx_msg_fns msg_dst;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG1("NULL pointer error");
+		return;
+	}
+
+	for (i = 0; i < MAX_NO_OF_VFS; i++) {
+		mbx[i][0] = OPCODE_MBX_FLR; /* opcode */
+		mbx[i][1] = 0; /* size */
+	}
+
+	/* Send data to all VFs */
+	for (i = vf0; i <= vf2; i++) {
+		if (priv->clear_to_send[i-vf0] == VF_UP) {
+			msg_dst = (enum mbx_msg_fns) i;
+				ret = tc956xmac_mbx_write(priv, &mbx[i-vf0][0], msg_dst,
+								&priv->fn_id_info);
+
+			/* Validation of successfull message posting can be done
+			 * by reading the mbx buffer for ACK opcode (0xFF)
+			 */
+			if (ret > 0) {
+				priv->clear_to_send[i-vf0] = VF_DOWN;
+				KPRINT_DEBUG1(
+				"mailbox write with ACK or NACK %d msgbuff %x %x\n", ret, mbx[i-vf0][0], mbx[i-vf0][4]);
+			} else
+				KPRINT_DEBUG1("mailbox write failed");
+		} else
+			KPRINT_DEBUG1("VF %d not up", i-vf0);
+	}
+}
+
+/**
+ * tc956x_mbx_rx_dma_ch_tlptr
+ *
+ * \brief API to send DMA err information to VF
+ *
+ * \details This function is used to send DMA error info to VF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] vf - VF no of DMA channel
+ *
+ * \return 0 or error
+ */
+static int tc956x_mbx_rx_dma_err(struct tc956xmac_priv *priv, u8 vf)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret = 0;
+	enum mbx_msg_fns msg_dst;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG1("NULL pointer error");
+		return -EFAULT;
+	}
+
+	mbx[0] = OPCODE_MBX_DMA_ERR; /* opcode */
+	mbx[1] = 0; /* size */
+
+	if (priv->clear_to_send[vf] == VF_UP) {
+		msg_dst = (enum mbx_msg_fns)(vf + 3);
+		ret = tc956xmac_mbx_write(priv, &mbx[0], msg_dst,
+							&priv->fn_id_info);
+
+		/* Validation of successfull message posting can be done
+		 * by reading the mbx buffer for ACK opcode (0xFF)
+		 */
+
+		if (ret > 0)
+			KPRINT_DEBUG1(
+				"mailbox write with ACK or NACK %d msgbuff %x %x\n",
+								ret, mbx[0], mbx[4]);
+		else
+			KPRINT_DEBUG1("mailbox write failed\n");
+	} else
+		KPRINT_DEBUG1("VF %d is not UP", vf);
+
+	return ret;
+}
+
+const struct tc956x_mbx_wrapper_ops tc956xmac_mbx_wrapper_ops = {
+	.phy_link = tc956x_mbx_phy_link,
+	.set_dma_tx_mode = tc956x_mbx_set_dma_tx_mode,
+	.set_mtl_tx_queue_weight = tc956x_mbx_set_mtl_tx_queue_weight,
+	.config_cbs = tc956x_mbx_config_cbs,
+	.setup_cbs = tc956x_mbx_setup_cbs,
+	.setup_mbx_etf = tc956x_mbx_setup_etf,
+	.tx_queue_prio = tc956x_mbx_tx_queue_prio,
+	.vf_get_link_status = tc956x_mbx_vf_get_link_status,
+	.rx_crc = tc956x_mbx_rx_crc,
+	.rx_csum = tc956x_mbx_rx_csum,
+	.reset_eee_mode = tc956x_mbx_reset_eee_mode,
+	.get_umac_addr = tc956x_mbx_get_umac_addr,
+	.set_umac_addr = tc956x_mbx_set_umac_addr,
+	.get_drv_cap = tc956x_mbx_get_drv_cap,
+	.vf_ioctl = tc956xmac_pf_ioctl_interface,
+	.vf_ethtool = tc956xmac_pf_ethtool_interface,
+	.add_mac = tc956xmac_pf_set_mac_filter,
+	.delete_mac = tc956xmac_pf_del_mac_filter,
+	.add_vlan = tc956xmac_pf_set_vlan_filter,
+	.delete_vlan = tc956xmac_pf_del_vlan_filter,
+	.vf_reset = tc956xmac_mbx_vf_reset,
+	.rx_dma_ch_tlptr = tc956x_mbx_rx_dma_ch_tlptr,
+	.pf_flr = tc956x_mbx_flr,
+	.rx_dma_err = tc956x_mbx_rx_dma_err,
+};
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pf_rsc_mng.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pf_rsc_mng.c
@@ -0,0 +1,158 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_pf_rsc_mng.c
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  04 June 2020 : Initial Version
+ *  VERSION      : 00-01
+ *
+ *  30 Nov 2021  : Base lined for SRIOV
+ *  VERSION      : 01-02
+ */
+
+#include "tc956xmac.h"
+#include "tc956x_pf_rsc_mng.h"
+
+/**
+ * tc956x_pf_rsc_mng_get_fn_id
+ *
+ * \brief API to get function ID of this function
+ *
+ * \details This function is called to get the function ID from
+ * the resource manager function ID register
+ *
+ * \param[in] dev - Pointer to device structure
+ * \param[in] fn_id_info - Pointer to function id info structure
+ *
+ * \return success or error
+ */
+
+static int tc956x_pf_rsc_mng_get_fn_id(struct tc956xmac_priv *priv, void __iomem *reg_pci_bridge_config_addr,
+						struct fn_id *fn_id_info)
+{
+	void __iomem *ioaddr = reg_pci_bridge_config_addr;
+	u32 rsc_mng_id = readl(ioaddr + RSCMNG_ID_REG);
+
+	fn_id_info->fn_type = (rsc_mng_id & RSC_MNG_FN_TYPE) >> 16;
+	fn_id_info->pf_no = (rsc_mng_id & RSC_MNG_PF_FN_NUM);
+	fn_id_info->vf_no = ((rsc_mng_id & RSC_MNG_VF_FN_NUM) >> 8);
+
+	/** Below error check for PF driver.
+	 * In case of PF driver, vf_no should be 0 and function type to be 0
+	 */
+	if ((fn_id_info->vf_no != 0) || (fn_id_info->fn_type != 0))
+		return -1;
+
+	/* PF 0 and 1 are supported */
+	if (fn_id_info->pf_no > 1)
+		return -1;
+
+	return 0;
+
+}
+
+/**
+ * tc956x_pf_rsc_mng_set_rscs
+ *
+ * \brief API to set the DMA channel resources for the functions
+ *
+ * \details This function is used to set the resources (DMA channels)
+ * for PF and it's associated VFs
+ *
+ * \param[in] dev - Pointer to device structure
+ * \param[in] rscs - Pointer to array of PF0, VF0, VF1, VF2 having
+ * DMA channel bit pattern <7,6,5,4,3,2,1,0>
+ * Example: for case 0-1 following is the array
+ * rscs[4] = {	0x18, --> PF0  DMACH 3, 4
+ *		0x21, --> VF00 DMACH 0, 5
+ *		0x02, --> VF01 DMACH 1
+ *		0xc4, --> VF02 DMACH 2, 6, 7
+ *	}
+ * \return None
+ */
+static void tc956x_pf_rsc_mng_set_rscs(struct tc956xmac_priv *priv, struct net_device *dev, u8 *rscs)
+{
+	void __iomem *ioaddr = priv->tc956x_BRIDGE_CFG_pci_base_addr;
+	u32 rsc_mng_rsc_ctl = 0;
+	u8 i, buffer_value;
+
+	for (i = 0; i < MAX_FUNCTIONS_PER_PF; i++) {
+		buffer_value = rscs[i];
+		if ((buffer_value & RSC_MNG_DMA_CH7_MASK) ==
+					RSC_MNG_DMA_CH7_MASK) /*DMA ch7 bit*/
+			rsc_mng_rsc_ctl |= (i << RSC_MNG_DMA_CH7_BIT_POS);
+
+		if ((buffer_value & RSC_MNG_DMA_CH6_MASK) ==
+					RSC_MNG_DMA_CH6_MASK) /*DMA ch6 bit*/
+			rsc_mng_rsc_ctl |= (i << RSC_MNG_DMA_CH6_BIT_POS);
+
+		if ((buffer_value & RSC_MNG_DMA_CH5_MASK) ==
+					RSC_MNG_DMA_CH5_MASK) /*DMA ch5 bit*/
+			rsc_mng_rsc_ctl |= (i << RSC_MNG_DMA_CH5_BIT_POS);
+
+		if ((buffer_value & RSC_MNG_DMA_CH4_MASK) ==
+					RSC_MNG_DMA_CH4_MASK) /*DMA ch4 bit*/
+			rsc_mng_rsc_ctl |= (i << RSC_MNG_DMA_CH4_BIT_POS);
+
+		if ((buffer_value & RSC_MNG_DMA_CH3_MASK) ==
+					RSC_MNG_DMA_CH3_MASK) /*DMA ch3 bit*/
+			rsc_mng_rsc_ctl |= (i << RSC_MNG_DMA_CH3_BIT_POS);
+
+		if ((buffer_value & RSC_MNG_DMA_CH2_MASK) ==
+					RSC_MNG_DMA_CH2_MASK) /*DMA ch2 bit*/
+			rsc_mng_rsc_ctl |= (i << RSC_MNG_DMA_CH2_BIT_POS);
+
+		if ((buffer_value & RSC_MNG_DMA_CH1_MASK) ==
+					RSC_MNG_DMA_CH1_MASK) /*DMA ch1 bit*/
+			rsc_mng_rsc_ctl |= (i << RSC_MNG_DMA_CH1_BIT_POS);
+
+		if ((buffer_value & RSC_MNG_DMA_CH0_MASK) ==
+					RSC_MNG_DMA_CH0_MASK) /*DMA ch0 bit*/
+			rsc_mng_rsc_ctl |= (i << RSC_MNG_DMA_CH0_BIT_POS);
+	}
+	writel(rsc_mng_rsc_ctl, ioaddr + RSCMNG_RSC_CTRL_REG);
+}
+
+/**
+ * tc956x_pf_rsc_mng_get_rscs
+ *
+ * \brief API to get the DMA channel resources allocated
+ *
+ * \details This function is used to get the resources (DMA channels)
+ * allocated for this function
+ *
+ * \param[in] dev - Pointer to device structure
+ * \param[in] rscs - Pointer to return DMA channel bit pattern in
+ * order <7,6,5,4,3,2,1,0>
+ * \return None
+ */
+
+static void tc956x_pf_rsc_mng_get_rscs(struct tc956xmac_priv *priv, struct net_device *dev, u8 *rscs)
+{
+	void __iomem *ioaddr = priv->tc956x_BRIDGE_CFG_pci_base_addr;
+	*rscs = ((readl(ioaddr + RSCMNG_RSC_ST_REG)) & RSC_MNG_RSC_STATUS_MASK);
+}
+
+const struct mac_rsc_mng_ops tc956xmac_rsc_mng_ops = {
+	.get_fn_id = tc956x_pf_rsc_mng_get_fn_id,
+	.set_rscs = tc956x_pf_rsc_mng_set_rscs,
+	.get_rscs = tc956x_pf_rsc_mng_get_rscs,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pf_rsc_mng.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pf_rsc_mng.h
@@ -0,0 +1,86 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_pf_rsc_mng.h
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  10 July 2020 : Initial Version
+ *  VERSION       : 00-01
+ *
+ *  30 Nov 2021  : Base lined for SRIOV
+ *  VERSION      : 01-02
+ */
+#ifndef __TC956X_PF_RSC_MNG_H__
+#define __TC956X_PF_RSC_MNG_H__
+
+#include "common.h"
+#include <linux/netdevice.h>
+
+#define MAX_FUNCTIONS_PER_PF 4 /*Max functions per pf including pf, vfs*/
+#define RSC_MNG_OFFSET 0x2000
+#define RSCMNG_ID_REG ((RSC_MNG_OFFSET) + 0x00000000)
+#define RSCMNG_RSC_CTRL_REG ((RSC_MNG_OFFSET) + 0x00000004)
+#define RSCMNG_RSC_ST_REG ((RSC_MNG_OFFSET) + 0x00000008)
+#define RSCMNG_INT_CTRL_REG ((RSC_MNG_OFFSET) + 0x0000000c)
+#define RSCMNG_INT_ST_REG ((RSC_MNG_OFFSET) + 0x00000010)
+
+#define RSC_MNG_FN_TYPE BIT(16)
+#define RSC_MNG_VF_FN_NUM GENMASK(11, 8)
+#define RSC_MNG_PF_FN_NUM GENMASK(3, 0)
+
+#define RSC_MNG_DMA_CH7_MASK 0x80
+#define RSC_MNG_DMA_CH6_MASK 0x40
+#define RSC_MNG_DMA_CH5_MASK 0x20
+#define RSC_MNG_DMA_CH4_MASK 0x10
+#define RSC_MNG_DMA_CH3_MASK 0x08
+#define RSC_MNG_DMA_CH2_MASK 0x04
+#define RSC_MNG_DMA_CH1_MASK 0x02
+#define RSC_MNG_DMA_CH0_MASK 0x01
+
+#define RSC_MNG_DMA_CH7_BIT_POS 28
+#define RSC_MNG_DMA_CH6_BIT_POS 24
+#define RSC_MNG_DMA_CH5_BIT_POS 20
+#define RSC_MNG_DMA_CH4_BIT_POS 16
+#define RSC_MNG_DMA_CH3_BIT_POS 12
+#define RSC_MNG_DMA_CH2_BIT_POS 8
+#define RSC_MNG_DMA_CH1_BIT_POS 4
+#define RSC_MNG_DMA_CH0_BIT_POS 0
+
+#define RSC_MNG_RSC_STATUS_MASK 0xff
+
+#define RSC_MNG_INT_STATUS_MASK 0x1f
+#define RSC_MNG_INT_MCU_MASK 0x10
+#define RSC_MNG_INT_VF2_MASK 0x08
+#define RSC_MNG_INT_VF1_MASK 0x04
+#define RSC_MNG_INT_VF0_MASK 0x02
+#define RSC_MNG_INT_OTHR_PF_MASK 0x01
+
+#define MBX_MCU_INTERRUPT BIT(4)
+#define MBX_VF3_INTERRUPT BIT(3)
+#define MBX_VF2_INTERRUPT BIT(2)
+#define MBX_VF1_INTERRUPT BIT(1)
+#define MBX_PF_INTERRUPT BIT(0)
+
+#define RSC_MNG_ACK_MASK 0x01
+#define RSC_MNG_NACK_MASK 0x02
+
+#define MBX_TIMEOUT 1000
+
+#endif /* __TC956X_PF_RSC_MNG_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pma.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pma.c
@@ -0,0 +1,77 @@
+/*
+ * TC956x PMA layer
+ *
+ * tc956x_pma.c
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  05 Nov 2020 : Initial version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ */
+
+#include "common.h"
+#include "tc956xmac.h"
+#include "tc956x_pma.h"
+#ifdef TC956X
+static int tc956x_pma_init(struct tc956xmac_priv *priv, void __iomem *pmaaddr)
+{
+
+	u32 reg_value;
+
+	/*Power on CML buffer*/
+	reg_value = readl(pmaaddr + XGMAC_PMA_GL_PM_CFG0);
+	reg_value = XGMAC_PMA_OFFSET0;
+	writel(reg_value, pmaaddr + XGMAC_PMA_GL_PM_CFG0);
+
+	/*Switch clock from C0_REFCK to CLK_REF_I*/
+	writel(XGMAC_PMA_OFFSET1, pmaaddr + XGMAC_PMA_CFG_0_1_R0);
+	writel(XGMAC_PMA_OFFSET1, pmaaddr + XGMAC_PMA_CFG_0_1_R1);
+	writel(XGMAC_PMA_OFFSET1, pmaaddr + XGMAC_PMA_CFG_0_1_R2);
+	writel(XGMAC_PMA_OFFSET1, pmaaddr + XGMAC_PMA_CFG_0_1_R3);
+	writel(XGMAC_PMA_OFFSET1, pmaaddr + XGMAC_PMA_CFG_0_1_R4);
+
+	/*Disable C0_REFCK*/
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_EN_R0);
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_TERM_EN_R0);
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_R_EN_R1);
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_TERM_EN_R1);
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_R_EN_R2);
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_TERM_EN_R2);
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_R_EN_R3);
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_TERM_EN_R3);
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_R_EN_R4);
+	writel(XGMAC_PMA_OFFSET0, pmaaddr + XGMAC_PMA_HWT_REFCK_TERM_EN_R4);
+
+	/*ASPETH mode decoded from sp_sel of NEMAC0CTL*/
+	/*PMA PLL enable*/
+	//writel(XGMAC_PMA_OFFSET2, pmaaddr + XGMAC_PCS_GL_PC_CNT0); //Commented as per monitor script
+
+	return 0;
+
+}
+
+const struct tc956xmac_pma_ops tc956x_pma_ops = {
+	.init = tc956x_pma_init,
+};
+#endif
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_pma.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_pma.h
@@ -0,0 +1,64 @@
+/*
+ * TC956x PMA Header
+ *
+ * tc956x_pma.h
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:  *  05 Nov 2020 : Initial version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ */
+
+#ifndef __TC956X_PMA_H__
+#define __TC956X_PMA_H__
+
+#include "common.h"
+
+#define PMA_XGMAC_OFFSET	0x4000
+
+/*PMA registers*/
+#define XGMAC_PMA_GL_PM_CFG0				0x000001B8
+#define XGMAC_PMA_CFG_0_1_R0				0x00001888
+#define XGMAC_PMA_CFG_0_1_R1				0x00001890
+#define XGMAC_PMA_CFG_0_1_R2				0x00001898
+#define XGMAC_PMA_CFG_0_1_R3				0x000018A0
+#define XGMAC_PMA_CFG_0_1_R4				0x000018A8
+
+#define	XGMAC_PMA_HWT_REFCK_EN_R0			0x00001080
+#define	XGMAC_PMA_HWT_REFCK_TERM_EN_R0		0x00001090
+#define XGMAC_PMA_HWT_REFCK_R_EN_R1			0x00001094
+#define XGMAC_PMA_HWT_REFCK_TERM_EN_R1		0x000010A4
+#define XGMAC_PMA_HWT_REFCK_R_EN_R2			0x000010A8
+#define XGMAC_PMA_HWT_REFCK_TERM_EN_R2		0x000010B8
+#define XGMAC_PMA_HWT_REFCK_R_EN_R3			0x000010BC
+#define XGMAC_PMA_HWT_REFCK_TERM_EN_R3		0x000010CC
+#define XGMAC_PMA_HWT_REFCK_R_EN_R4			0x000010D0
+#define XGMAC_PMA_HWT_REFCK_TERM_EN_R4		0x000010E0
+
+#define XGMAC_PCS_GL_PC_CNT0				0x0000016C
+
+/*PMA register values*/
+#define XGMAC_PMA_OFFSET0					0x00000000
+#define XGMAC_PMA_OFFSET1					0x0001EF04
+#define XGMAC_PMA_OFFSET2					0x00000001
+
+#endif /* __TC956X_PMA_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_qcom.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_qcom.c
@@ -0,0 +1,280 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright (c) 2021, The Linux Foundation. All rights reserved.
+// Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/regulator/consumer.h>
+#include <linux/of_irq.h>
+#include <linux/delay.h>
+
+#include "tc956xmac.h"
+
+struct tc956x_qcom_priv {
+	struct pinctrl *pinctrl;
+	struct pinctrl_state *pinctrl_default;
+	struct regulator *phy_supply;
+	u32 phy_rst_gpio;
+	u32 phy_rst_delay_us;
+	int wol_irq;
+};
+
+#define to_priv(priv) \
+	((struct tc956x_qcom_priv *)priv->plat_priv)
+
+static int tc956x_assert_phy_reset(struct tc956xmac_priv *priv)
+{
+	return tc956x_GPIO_OutputConfigPin(priv, to_priv(priv)->phy_rst_gpio, 0);
+}
+
+static int tc956x_deassert_phy_reset(struct tc956xmac_priv *priv)
+{
+	return tc956x_GPIO_OutputConfigPin(priv, to_priv(priv)->phy_rst_gpio, 1);
+}
+
+static int tc956x_phy_power_on(struct tc956xmac_priv *priv)
+{
+	int ret = 0;
+	struct tc956x_qcom_priv *qpriv = to_priv(priv);
+
+	ret = regulator_enable(to_priv(priv)->phy_supply);
+	if (ret) {
+		dev_err(priv->device, "Failed to enable PHY supply with error %d\n", ret);
+		return ret;
+	}
+
+	ret = tc956x_deassert_phy_reset(priv);
+	if (ret) {
+		dev_err(priv->device, "Failed to deassert QPS615 GPIO0%d\n", qpriv->phy_rst_gpio);
+		if (regulator_disable(qpriv->phy_supply))
+			dev_err(priv->device, "Failed to disable regulator\n");
+	}
+
+	dev_dbg(priv->device,"QPS615 PHY out of reset delay %d", qpriv->phy_rst_delay_us);
+	usleep_range(qpriv->phy_rst_delay_us, qpriv->phy_rst_delay_us);
+
+	return ret;
+}
+
+static int tc956x_phy_power_off(struct tc956xmac_priv *priv)
+{
+	int ret = 0;
+	struct tc956x_qcom_priv *qpriv = to_priv(priv);
+
+	ret = tc956x_assert_phy_reset(priv);
+	if (ret) {
+		dev_err(priv->device, "Failed to assert QPS615 GPIO%02d\n", qpriv->phy_rst_gpio);
+		return ret;
+	}
+
+	ret = regulator_disable(qpriv->phy_supply);
+	if (ret) {
+		dev_err(priv->device, "Failed to disable PHY supply with error %d\n", ret);
+		if (tc956x_deassert_phy_reset(priv))
+			dev_err(priv->device, "Failed to deassert PHY\n");
+	}
+
+	return ret;
+}
+
+static int tc956x_platform_of_parse(struct device *dev,
+				    struct tc956x_qcom_priv *qpriv)
+{
+	if (of_property_read_u32(dev->of_node,"qcom,phy-rst-gpio-id", &qpriv->phy_rst_gpio)) {
+		dev_err(dev, "Failed to get PHY reset GPIO\n");
+		return -EINVAL;
+	}
+
+	if (of_property_read_u32(dev->of_node, "qcom,phy-rst-delay-us", &qpriv->phy_rst_delay_us)) {
+		dev_err(dev, "Failed to get PHY reset delay time\n");
+		return -EINVAL;
+	}
+
+	qpriv->wol_irq = of_irq_get_byname(dev->of_node, "wol_irq");
+	if (qpriv->wol_irq <= 0) {
+		dev_err(dev, "Failed to get 'wol_irq' IRQ with error %d\n", qpriv->wol_irq);
+		return -EINVAL;
+	}
+
+	qpriv->phy_supply = devm_regulator_get(dev, "phy");
+	if (IS_ERR(qpriv->phy_supply)) {
+		dev_err(dev, "Failed to acquire supply 'phy-supply': %ld\n", PTR_ERR(qpriv->phy_supply));
+		return -EINVAL;
+	}
+
+	qpriv->pinctrl = devm_pinctrl_get(dev);
+	if (IS_ERR_OR_NULL(qpriv->pinctrl)) {
+		dev_err(dev, "Failed to get pinctrl handle\n");
+		goto err_pinctrl_get;
+	}
+
+	qpriv->pinctrl_default = pinctrl_lookup_state(qpriv->pinctrl, PINCTRL_STATE_DEFAULT);
+	if (IS_ERR_OR_NULL(qpriv->pinctrl_default)) {
+		dev_err(dev, "Failed to look up '%s' pinctrl state\n", PINCTRL_STATE_DEFAULT);
+		goto err_pinctrl_lookup_state;
+	}
+
+	return 0;
+
+err_pinctrl_lookup_state:
+	devm_pinctrl_put(qpriv->pinctrl);
+err_pinctrl_get:
+	devm_regulator_put(qpriv->phy_supply);
+	return -EINVAL;
+}
+
+int tc956x_platform_probe(struct tc956xmac_priv *priv,
+			  struct tc956xmac_resources *res)
+{
+	int ret = 0;
+	struct tc956x_qcom_priv *qpriv;
+
+	dev_dbg(priv->device, "QPS615 platform probing has started\n");
+
+	qpriv = kzalloc(sizeof(*qpriv), GFP_KERNEL);
+	if (!qpriv) {
+		dev_dbg(priv->device, "Failed to allocate memory for qpriv, exiting\n");
+		return -ENOMEM;
+	}
+
+	priv->plat_priv = qpriv;
+
+	ret = tc956x_platform_of_parse(priv->device, qpriv);
+	if (ret) {
+		dev_err(priv->device, "Failed to parse platform device tree\n");
+		goto err_parse_properties;
+	}
+
+	ret = tc956x_assert_phy_reset(priv);
+	if (ret) {
+		dev_err(priv->device, "Failed to assert the PHY reset with error %d\n", ret);
+		goto err_assert_phy_rst;
+	}
+
+	ret = pinctrl_select_state(qpriv->pinctrl, qpriv->pinctrl_default);
+	if (ret) {
+		dev_err(priv->device, "Failed to select the 'default' pincrl state\n");
+		goto err_pinctrl_select_state;
+	}
+
+	ret = tc956x_phy_power_on(priv);
+	if (ret) {
+		dev_err(priv->device, "Failed to power on PHY with error %d\n", ret);
+		goto err_power_on;
+	}
+
+	res->wol_irq = qpriv->wol_irq;
+	dev_info(priv->device, "QPS615 platform probing has finished successfully\n");
+
+	return 0;
+
+err_power_on:
+	irq_set_irq_wake(qpriv->wol_irq, 0);
+err_pinctrl_select_state:
+err_assert_phy_rst:
+err_parse_properties:
+	kfree(qpriv);
+	priv->plat_priv = NULL;
+	return -EINVAL;
+}
+
+int tc956x_platform_remove(struct tc956xmac_priv *priv)
+{
+	int ret = 0;
+	struct tc956x_qcom_priv *qpriv = to_priv(priv);
+
+	dev_dbg(priv->device, "Freeing QPS615 platform resources\n");
+
+	ret = tc956x_phy_power_off(priv);
+	if (ret)
+		dev_err(priv->device, "Failed to power off PHY with error %d\n", ret);
+
+	devm_regulator_put(qpriv->phy_supply);
+
+	devm_pinctrl_put(qpriv->pinctrl);
+	kfree(priv->plat_priv);
+	priv->plat_priv = NULL;
+
+	return ret;
+}
+
+int tc956x_platform_suspend(struct tc956xmac_priv *priv)
+{
+	int ret = 0;
+
+	if (priv->wolopts) {
+		ret = enable_irq_wake(priv->wol_irq);
+		if (unlikely(ret))
+			dev_err(priv->device, "Failed to set WOL IRQ %d as wake up capable with error %d\n",
+				priv->wol_irq, ret);
+	} else {
+		ret = tc956x_phy_power_off(priv);
+		if (ret)
+			dev_err(priv->device, "Failed to power off PHY with error %d\n", ret);
+	}
+
+	return ret;
+}
+
+int tc956x_platform_resume(struct tc956xmac_priv *priv)
+{
+	int ret = 0;
+
+	if (priv->wolopts) {
+		ret = disable_irq_wake(priv->wol_irq);
+		if (unlikely(ret))
+			dev_err(priv->device, "Failed to set WOL IRQ %d as a wake-disabled irq with error %d\n",
+				priv->wol_irq, ret);
+	} else {
+		ret = tc956x_phy_power_on(priv);
+		if (ret)
+			dev_err(priv->device, "Failed to power on the PHY with error %d\n", ret);
+	}
+
+	return ret;
+}
+
+int tc956x_platform_port_interface_overlay(struct device *dev, struct tc956xmac_resources *res)
+{
+	int ret = 0;
+	u32 interface;
+	u32 mdc_clk;
+	u32 c45_state;
+	u32 link_down_macrst;
+	u32 plat_interface;
+
+	if (of_property_read_u32(dev->of_node, "qcom,phy-port-interface", &interface)) {
+		dev_err(dev, "Failed to get phy port interface\n");
+		return ret;
+	} else {
+		dev_err(dev, "phy port interface overlay to %d from %d\n", interface, res->port_interface);
+		res->port_interface = interface;
+
+		if (of_property_read_u32(dev->of_node, "qcom,mdc-clk", &mdc_clk)) {
+			dev_err(dev, "Failed to get mdc clk\n");
+			return ret;
+		} else {
+			dev_err(dev, "mdc clk overlay to %d\n", mdc_clk);
+			res->mdc_clk = mdc_clk;
+		}
+
+		if (of_property_read_u32(dev->of_node, "qcom,c45-state", &c45_state)) {
+			dev_err(dev, "Failed to get c45 state\n");
+			return ret;
+		} else {
+			dev_err(dev, "c45 state overlay to %d\n", c45_state);
+			res->c45_state = c45_state;
+		}
+
+		if (of_property_read_u32(dev->of_node, "qcom,link-down-macrst", &link_down_macrst)) {
+			dev_err(dev, "Failed to get link down macrst\n");
+			return ret;
+		} else {
+			dev_err(dev, "link down macrst overlay to %d\n", link_down_macrst);
+			res->link_down_macrst = link_down_macrst;
+		}
+		ret = 1;
+	}
+	return ret;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_vf_mbx.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_vf_mbx.c
@@ -0,0 +1,550 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_vf_mbx.c
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  06 Nov 2020 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  30 Nov 2021 : Base lined for SRIOV
+ *  VERSION     : 01-02
+ */
+
+#include "tc956x_vf_mbx.h"
+#include "tc956xmac.h"
+#include "tc956x_vf_rsc_mng.h"
+
+#ifdef TC956X_SRIOV_VF
+
+/**
+ * This table maintains the SRAM mapping for PF0->VF0s, VF0s->PF0, PF1->VF1s,
+ *  VF1s->PF1, PF0->PF1, PF1->PF0, MCU->PF0, PF0->MCU, PF1->MCU, MCU->PF1
+ * Each communication SRAM size is of 64 bytes. In total 30 such SRAMs are
+ * required for above mentioned communication path.
+ * In general, in Design of HW semaphore: PF uses one SRAM location for
+ * any request and ACK message to a particular VF and VF uses other
+ * SRAM location for requestand ACK. In Design of No semaphore: PF use one
+ * SRAM location to send request, VF to use same location (overwrite) to send
+ * the ACK, similarly VF uses other SRAM to send request, PF to use same location
+ * (overwrite) to send the ACK.
+ */
+static u8 PF_VF_mbx_idx[PFS_MAX][VFNS_MAX][2] = {
+	{
+		{19, 20}, /* MCU <--> VF00 [MCU RQST Msg/MCU ACK Msg,
+			   * VF00 ACK Msg/VF00 RQST Msg]
+			   */
+		{21, 22}, /* MCU <--> VF01 [MCU RQST Msg/MCU ACK Msg,
+			   * VF01 ACK Msg/VF01 RQST Msg]
+			   */
+		{23, 24}, /* MCU <--> VF02 [MCU RQST Msg/MCU ACK Msg,
+			   * VF02 ACK Msg/VF02 RQST Msg]
+			   */
+	},
+	{
+		{5, 6}, /* PF0 <--> VF00 [PF0 RQST Msg/PF0 ACK Msg,
+			 * VF0 ACK Msg/VF0 RQST Msg]
+			 */
+		{7, 8}, /* PF0 <--> VF01 [PF0 RQST Msg/PF0 ACK Msg,
+			 * VF1 ACK Msg/VF1 RQST Msg]
+			 */
+		{9, 10} /* PF0 <--> VF02 [PF0 RQST Msg/PF0 ACK Msg,
+			 * VF2 ACK Msg/VF2 RQST Msg]
+			 */
+	},
+	{
+		{25, 26}, /* MCU <--> VF10 [MCU RQST Msg/MCU ACK Msg,
+			   * VF10 ACK Msg/VF10 RQST Msg]
+			   */
+		{27, 28}, /* MCU <--> VF11 [MCU RQST Msg/MCU ACK Msg,
+			   * VF11 ACK Msg/VF11 RQST Msg]
+			   */
+		{29, 30}  /* MCU <--> VF12 [MCU RQST Msg/MCU ACK Msg,
+			   * MCU VF12 Msg/VF12 RQST Msg]
+			   */
+	},
+	{
+		{13, 14}, /* PF1 <--> VF10 [PF1 RQST Msg/PF1 ACK Msg,
+			   * VF0 ACK Msg/VF0 RQST Msg]
+			   */
+		{15, 16}, /* PF2 <--> VF11 [PF1 RQST Msg/PF1 ACK Msg,
+			   * VF1 ACK Msg/VF1 RQST Msg]
+			   */
+		{17, 18}  /* PF3 <--> VF12 [PF1 RQST Msg/PF1 ACK Msg,
+			   * VF2 ACK Msg/VF2 RQST Msg]
+			   */
+	},
+
+};
+
+/**
+ * vf_get_mbx_mem_idx
+ *
+ * \brief API to return pointer pointing to SRAM index
+ *
+ * \details This function to return the pointer to the 1D array of
+ * PF_VF_mbx_idx where it points to SRAM location of specific PF->Fn
+ *
+ * \param[in] msg_src - Function to/from where PF needs to write/read
+ * \param[in] fn_id_info - Pointer to this function id information
+ *
+ * \return pointer to the SRAM index
+ */
+
+static u8 *vf_get_mbx_mem_idx(enum mbx_msg_fns msg_src,
+			      struct fn_id *fn_id_info)
+{
+	/* for MCU interrupt for VFs associated with pf1, below handling
+	 * is required as it is not possible to get correct offset from
+	 * the array with the other approach
+	 */
+	if ((msg_src == mcu) && (fn_id_info->pf_no == 1))
+		return *(*(PF_VF_mbx_idx + 2) + (fn_id_info->vf_no - 1));
+	else
+		return *(*(PF_VF_mbx_idx + (msg_src + fn_id_info->pf_no)) +
+			 (fn_id_info->vf_no - 1));
+}
+
+/**
+ * tc956x_vf_get_fn_idx_from_int_sts
+ *
+ * \brief Helper function to get function that raised the mailbox interrupt
+ *
+ * \details This function is called to get the function which raised the
+ * mailbox interrupt. Interrupt source can be MCU or associated PF
+ *
+ * \param[in] msg_dst - Function to which interrupt should be set
+ * \param[in] fn_id_info - Pointer to Function info structure
+ *
+ * \return function type or error
+ */
+int tc956x_vf_get_fn_idx_from_int_sts(struct tc956xmac_priv *priv,
+					     struct fn_id *fn_id_info)
+{
+	void __iomem *ioaddr = priv->tc956x_BRIDGE_CFG_pci_base_addr;
+	u32 rsc_mng_int_sts = readl(ioaddr + RSCMNG_INT_ST_REG);
+
+	if ((rsc_mng_int_sts & RSC_MNG_INT_MCU_MASK) == RSC_MNG_INT_MCU_MASK) {
+		writel(RSC_MNG_INT_MCU_MASK, ioaddr + RSCMNG_INT_ST_REG);
+		return mcu;
+	} else if ((rsc_mng_int_sts & RSC_MNG_INT_OTHR_PF_MASK) ==
+		 RSC_MNG_INT_OTHR_PF_MASK) {
+		if (fn_id_info->pf_no == 0) {
+			writel(RSC_MNG_INT_OTHR_PF_MASK, ioaddr + RSCMNG_INT_ST_REG);
+			return pf0;
+		} else if (fn_id_info->pf_no == 1) {
+			writel(RSC_MNG_INT_OTHR_PF_MASK, ioaddr + RSCMNG_INT_ST_REG);
+			return pf1;
+		} else
+			return -1;
+	} else /* Other interrupts are not supported */
+		return -1;
+}
+
+static int trylock_semaphore(void __iomem *ioaddr, u8 idx)
+{
+	u32 rd_val = 0;
+
+	/* Read 0 for lock. Else already semaphore is locked
+	 * curr value : action  :  next value
+	 * 0	      : read  0 :     1
+	 * 1	      : read  1 :     1
+	 */
+
+	rd_val = readl(ioaddr + NSEM(idx));
+	if (rd_val == 0)
+		return 0;
+	else
+		return -EBUSY;
+}
+
+static int unlock_semaphore(void __iomem *ioaddr, u8 idx)
+{
+	u32 wr_val = 1;
+
+	/* Write 1 to unlock
+	 * curr value : action  :  next value
+	 * 0	      : write 0 :      0
+	 * 0	      : write 1 :      0
+	 * 1	      : write 0 :      1
+	 * 1	      : write 1 :      0
+	 */
+	writel(wr_val, ioaddr + NSEM(idx));
+	return 0;
+}
+
+/**
+ * tc956x_vf_parse_mbx
+ *
+ * \brief API to read and process the VF mailbox
+ *
+ * \details This function should be called from ISR to parse the mailbox for
+ * the mail received from particular function. Message will be processed and
+ * ACK/NACK will be sent in this function
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_src - Function to which ACK should be posted
+ *
+ * \return None
+ */
+void tc956x_vf_parse_mbx(struct tc956xmac_priv *priv,
+				enum mbx_msg_fns msg_src)
+{
+	u8 msg_buff[MBX_TOT_SIZE];
+
+	/* Get the function id information and read the mailbox.
+	 * Function id can be get earlier too
+	 */
+	if (!tc956xmac_rsc_mng_get_fn_id(priv,
+		priv->tc956x_BRIDGE_CFG_pci_base_addr, &priv->fn_id_info)) {
+		/* Read and acknowledge the mailbox */
+		tc956xmac_mbx_read(priv, msg_buff, msg_src,
+				   &priv->fn_id_info);
+	}
+}
+
+/**
+ * tc956x_vf_check_for_ack
+ *
+ * \brief Helper function to check for ACK
+ *
+ * \details This function is called from polling function to check if
+ * any ACK or NACK is received after writing in the mailbox
+ *
+ * \param[in] dev - Pointer to device structure
+ * \param[in] msg_dst - Function from which ACK/NACK should be read
+ * \param[in] fn_id_info - Pointer to Function info structure
+ *
+ * \return ACK/NACK or error
+ */
+static int tc956x_vf_check_for_ack(struct tc956xmac_priv *priv,
+				   enum mbx_msg_fns msg_dst,
+				   struct fn_id *fn_id_info)
+{
+	u8 *ptr_mail_box_idx;
+	u8 ack_buff[MBX_ACK_SIZE];
+
+	/* Read the correct mailbox access index as per
+	 * the destination function
+	 */
+	ptr_mail_box_idx = vf_get_mbx_mem_idx(msg_dst, fn_id_info);
+
+	/* Copy the ACK inidication data (first 4 bytes) from PF->VF mailbox */
+	memcpy_fromio(ack_buff,
+	       (priv->tc956x_SRAM_mailbox_base_addr +
+		      ((*ptr_mail_box_idx + VF_READ_ACK_OFST) * MBX_TOT_SIZE)),
+	       MBX_ACK_SIZE);
+
+	if ((ack_buff[0] & RSC_MNG_ACK_MASK) == RSC_MNG_ACK_MASK)
+		return ACK;
+	else if ((ack_buff[0] & RSC_MNG_NACK_MASK) == RSC_MNG_NACK_MASK)
+		return NACK;
+	else
+		return -1;
+}
+
+/**
+ * tc956x_vf_mbx_init
+ *
+ * \brief API to initialise mailbox memory and parameters
+ *
+ * \details This function initialise mailbox memory used by this function.
+ * Also to initialise parameters used for mailbox control.
+ *
+ * \param[in] ndev - Pointer to device structure
+ *
+ * \return None
+ */
+
+static void tc956x_vf_mbx_init(struct tc956xmac_priv *priv, void *data)
+{
+	priv->tc956x_SRAM_mailbox_base_addr = priv->tc956x_SRAM_pci_base_addr + VF_MBX_SRAM_ADDR;
+}
+
+/**
+ * tc956x_vf_mbx_poll_for_ack
+ *
+ * \brief API to poll for acknowledgement
+ *
+ * \details This function will poll for acknowledgement after writing to the
+ * mailbox memory. Polling is done by means of reading a
+ * resource manager register
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_dst - Function from which ACK should be polled
+ *
+ * \return None
+ */
+static int tc956x_vf_mbx_poll_for_ack(struct tc956xmac_priv *priv,
+				      enum mbx_msg_fns msg_dst)
+{
+
+	int countdown = MBX_TIMEOUT;
+	int ack_status;
+
+	ack_status =
+		tc956x_vf_check_for_ack(priv, msg_dst, &priv->fn_id_info);
+
+	while (countdown && (ack_status < 0)) {
+		countdown--;
+		udelay(1000);
+		ack_status = tc956x_vf_check_for_ack(priv, msg_dst,
+						     &priv->fn_id_info);
+	}
+
+	return ack_status;
+}
+
+/**
+ * tc956x_vf_mbx_send_ack
+ *
+ * \brief API to send acknowledgement
+ *
+ * \details This function will post the acknowledgement message
+ * to the mailbox memory.
+ * Basically this should be called after every read
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_buff - Pointer to buffer having the acknowledgement message
+ * \param[in] msg_dst - Function to which ACK should be posted
+ * \param[in] fn_id_info - Pointer to function id information
+ *
+ * \return None
+ */
+static void tc956x_vf_mbx_send_ack(struct tc956xmac_priv *priv, u8 *msg_buff,
+				  enum mbx_msg_fns msg_dst,
+				  struct fn_id *fn_id_info)
+{
+	u8 *ptr_mail_box_idx;
+
+	/* Read the correct mailbox access index as per
+	 * the destination function
+	 */
+	ptr_mail_box_idx = vf_get_mbx_mem_idx(msg_dst, fn_id_info);
+
+	/* Copy the ACK message data to PF->VF SRAM area.
+	 * Also first 4 bytes of ACK indications also copied here
+	 */
+	memcpy_toio((priv->tc956x_SRAM_mailbox_base_addr +
+		      ((*ptr_mail_box_idx + VF_SEND_ACK_OFST) * MBX_TOT_SIZE)),
+	       msg_buff, MBX_TOT_SIZE);
+
+	priv->xstats.mbx_vf_sent_pf++;
+}
+
+/**
+ * tc956x_vf_trigger_interrupt
+ *
+ * \brief Helper function to set mailbox interrupt bit
+ *
+ * \details This function is called to set the mailbox interrupt bits while
+ * writing the mailbox. Interrupt targets can be MCU, VFs or other PF
+ *
+ * \param[in] msg_dst - Function to which interrupt should be set
+ *
+ * \return None
+ */
+static void tc956x_vf_trigger_interrupt(struct tc956xmac_priv *priv,
+					enum mbx_msg_fns msg_dst)
+{
+	void __iomem *ioaddr = priv->tc956x_BRIDGE_CFG_pci_base_addr;
+	u32 rsc_mng_interrupt_ctl = readl(ioaddr + RSCMNG_INT_CTRL_REG);
+
+	if (mcu == msg_dst)
+		rsc_mng_interrupt_ctl |= MBX_MCU_INTERRUPT;
+	else if ((pf0 == msg_dst) || (pf1 == msg_dst))
+		rsc_mng_interrupt_ctl |= MBX_PF_INTERRUPT;
+
+	writel(rsc_mng_interrupt_ctl, ioaddr + RSCMNG_INT_CTRL_REG);
+}
+
+/**
+ * tc956x_vf_mbx_write
+ *
+ * \brief API to write a message to particular mailbox (sram)
+ *
+ * \details This function will post the request message to the mailbox memory.
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_buff - Pointer to buffer having the request message
+ * Skip the first 4 bytes while preparing data in this buffer
+ * \param[in] msg_dst - Function to which message should be posted
+ * \param[in] fn_id_info - Pointer to function id information
+ *
+ * \return success or error code
+ */
+static int tc956x_vf_mbx_write(struct tc956xmac_priv *priv, u8 *msg_buff,
+			       enum mbx_msg_fns msg_dst,
+			       struct fn_id *fn_id_info)
+{
+	u8 *ptr_mail_box_idx;
+	int ret;
+
+
+	/* Read the correct mailbox access index as per
+	 * the destination function
+	 */
+	ptr_mail_box_idx = vf_get_mbx_mem_idx(msg_dst, fn_id_info);
+
+	/* Get the semaphore lock before udpating mailbox */
+	ret = trylock_semaphore(priv->ioaddr, ((*ptr_mail_box_idx + 1) >> 1));
+	if (ret != 0)
+		return ret;
+
+	/* Clear the mailbox including ACK area (first 4 bytes) */
+	memset_io((priv->tc956x_SRAM_mailbox_base_addr +
+		      ((*ptr_mail_box_idx + VF_SEND_RQST_OFST) * MBX_TOT_SIZE)),
+	       0, MBX_TOT_SIZE);
+
+	/* Copy the mailbox data from local buffer to VF->PF or VF->MCU
+	 * destination mailbox SRAM memory
+	 */
+	memcpy_toio((priv->tc956x_SRAM_mailbox_base_addr +
+	((*ptr_mail_box_idx + VF_SEND_RQST_OFST) * MBX_TOT_SIZE) + MBX_MSG_OFST),
+	       msg_buff, MBX_MSG_SIZE);
+
+	priv->xstats.mbx_vf_sent_pf++;
+
+	/*Set the interrupt bit in resource manager interrupt register*/
+	tc956x_vf_trigger_interrupt(priv, msg_dst);
+
+	/*poll for ack/nack from the VF/MCU/Other PF*/
+	ret = tc956xmac_mbx_poll_for_ack(priv, msg_dst);
+
+	/* Read for ACK message */
+	if (ret > 0) {
+		/* msg_buff to be overwritten here with ACK notification data
+		 * and ACK message data
+		 */
+		tc956xmac_mbx_read(priv, msg_buff, msg_dst,
+				   &priv->fn_id_info);
+	}
+
+	unlock_semaphore(priv->ioaddr, ((*ptr_mail_box_idx + 1) >> 1));
+
+	return ret;
+}
+
+/**
+ * tc956x_vf_mbx_read
+ *
+ * \brief API to read a message from particular mailbox (sram)
+ *
+ * \details This function will read request message from the mailbox
+ * memory. This function to be called from mailbox interrupt routine.
+ * This API can be used in case of ACK message read as well.
+ *
+ * \param[in] priv - Pointer to device private structure
+ * \param[in] msg_buff - Pointer to read the mailbox message of max size
+ * 64 bytes
+ * \param[in] msg_src - Function from which mailbox message should be read
+ * \param[in] fn_id_info - Pointer to function id information
+ *
+ * \return success or error code
+ */
+static int tc956x_vf_mbx_read(struct tc956xmac_priv *priv, u8 *msg_buff,
+			      enum mbx_msg_fns msg_src,
+			      struct fn_id *fn_id_info)
+{
+	u8 *ptr_mail_box_idx;
+	enum mbx_msg_fns msg_dst;
+	u8 ack_msg[MBX_MSG_SIZE];
+	u8 ret_val = 0;
+
+	/* Read the correct mailbox access index as per
+	 * the destination function
+	 */
+	ptr_mail_box_idx = vf_get_mbx_mem_idx(msg_src, fn_id_info);
+
+	/* Copy the mailbox data from PF->VF mailbox*/
+	memcpy_fromio(msg_buff,
+	       (priv->tc956x_SRAM_mailbox_base_addr +
+		      ((*ptr_mail_box_idx + VF_READ_RQST_OFST) * MBX_TOT_SIZE)),
+	       MBX_TOT_SIZE);
+
+	priv->xstats.mbx_vf_rcvd_pf++;
+
+	switch (msg_buff[MBX_MSG_OFST]) {
+	case OPCODE_MBX_PHY_LINK:
+		ret_val = tc956x_phy_link(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_RX_CSUM:
+		ret_val =  tc956x_rx_csum(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_RX_CRC:
+		ret_val = tc956x_rx_crc(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_DMA_CH_TLPTR:
+		ret_val = tc956x_rx_dma_ch_tlptr(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_SETUP_ETF:
+		ret_val = tc956x_setup_mbx_etf(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_FLR:
+		ret_val = tc956x_mbx_flr(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_DMA_ERR:
+		ret_val = tc956x_rx_dma_err(priv, &msg_buff[MBX_MSG_OFST], &ack_msg[0]);
+		break;
+	case OPCODE_MBX_ACK_MSG:
+		/* ACK message */
+		memset_io((priv->tc956x_SRAM_mailbox_base_addr +
+		      ((*ptr_mail_box_idx + VF_READ_RQST_OFST) * MBX_TOT_SIZE)), 0,
+	       MBX_TOT_SIZE);
+		break;
+	default:
+		break;
+	}
+
+	/* Send the Acknowldegment if message read is not ACK message */
+	if (msg_buff[MBX_MSG_OFST] != OPCODE_MBX_ACK_MSG) {
+		/* For sending ACK, source of request message becomes
+		 * the destination
+		 */
+		msg_dst = msg_src;
+
+		/* Prepare first 4 bytes of ACK inidication data */
+		msg_buff[0] = ret_val;
+		msg_buff[1] = 0x0;
+		msg_buff[2] = 0x0;
+		msg_buff[3] = 0x0;
+
+		/* Prepare 60 bytes of acknowledgment message */
+		memcpy(&msg_buff[MBX_MSG_OFST], ack_msg,
+			MBX_MSG_SIZE);
+
+		/* After successful parsing, ACK/NACK the functions which
+		 * originated the message
+		 */
+		tc956xmac_mbx_send_ack(priv, msg_buff, msg_dst,
+				       fn_id_info);
+	}
+	return 0;
+}
+
+const struct mac_mbx_ops tc956xmac_mbx_ops = {
+	.init = tc956x_vf_mbx_init,
+	.read = tc956x_vf_mbx_read,
+	.write = tc956x_vf_mbx_write,
+	.send_ack = tc956x_vf_mbx_send_ack,
+	.poll_for_ack = tc956x_vf_mbx_poll_for_ack,
+
+};
+#endif /* #ifdef TC956X_SRIOV_VF */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_vf_mbx.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_vf_mbx.h
@@ -0,0 +1,47 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_vf_mbx.h
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  10 Jul 2020 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  30 Nov 2021 : Base lined for SRIOV
+ *  VERSION     : 01-02
+ */
+
+#ifndef __TC956X_VF_MBX_H__
+#define __TC956X_VF_MBX_H__
+
+#include "common.h"
+#include <linux/netdevice.h>
+
+#define VF_READ_RQST_OFST 0 /* VF to read request of PF */
+#define VF_SEND_ACK_OFST 1  /* VF to send ACK to PF */
+
+#define VF_SEND_RQST_OFST 1 /* VF to send request to PF */
+#define VF_READ_ACK_OFST 0  /* VF to read ACK from PF */
+
+#define PFS_MAX 4  /* 2 PF + 2 MCU->VF0x, MCU->VF1x */
+#define VFNS_MAX 3 /* 3 VFs */
+
+#define VF_MBX_SRAM_ADDR 0x47060 /*0x20007060*/
+#endif /* __TC956X_VF_MBX_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_vf_mbx_wrapper.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_vf_mbx_wrapper.c
@@ -0,0 +1,2038 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_mbx_wrapper.c
+ *
+ * Copyright (C) 2022 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  06 Nov 2020 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  30 Nov 2021 : Base lined for SRIOV
+ *  VERSION     : 01-02
+ *
+ *  20 May 2022 : 1. Automotive Driver, CPE fixes merged and IPA Features supported
+ *                2. Base lined version
+ *  VERSION     : 03-00
+ */
+
+#include "tc956xmac.h"
+#include "dwxgmac2.h"
+
+#ifdef TC956X_SRIOV_VF
+
+/**
+ * tc956xmac_mbx_dma_tx_mode
+ *
+ * \brief API to set dma tx mode
+ *
+ * \details This function is used to send parameters of set dma tx mode to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mode - mode
+ * \param[in] channel - DMA channel no
+ * \param[in] fifosz - fifo size
+ * \param[in] qmode - queue mode
+ *
+ * \return None
+ */
+static void tc956xmac_mbx_dma_tx_mode(struct tc956xmac_priv *priv, int mode,
+				 u32 channel, int fifosz, u8 qmode)
+{
+
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_SET_DMA_TX_MODE; //opcode
+	mbx[1] = SIZE_MBX_SET_DMA_TX_MODE; //size
+
+	memcpy(&mbx[2], (u8 *)&mode, sizeof(mode));
+	memcpy(&mbx[6], (u8 *)&channel, sizeof(channel));
+	memcpy(&mbx[10], (u8 *)&fifosz, sizeof(fifosz));
+	mbx[14] = qmode;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+	/* Validation of successfull message posting can be done
+	 * by reading the mbx buffer for ACK opcode (0xFF)
+	 */
+
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n", ret,
+								mbx[0], mbx[4]);
+	else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956xmac_mbx_set_mtl_tx_queue_weight
+ *
+ * \brief API to set mtl tx queue weight
+ *
+ * \details This function is used to send parameters of mtl queue weight to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] weight - weight
+ * \param[in] traffic_class - traffic_class no
+ *
+ * \return None
+ */
+static void tc956xmac_mbx_set_mtl_tx_queue_weight(struct tc956xmac_priv *priv,
+				 u32 weight, u32 traffic_class)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_SET_TX_Q_WEIGHT; //opcode
+	mbx[1] = SIZE_MBX_SET_TX_Q_WEIGHT; //size
+
+	memcpy(&mbx[2], (u8 *)&weight, sizeof(weight));
+	memcpy(&mbx[6], (u8 *)&traffic_class, sizeof(traffic_class));
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+	/* Validation of successfull message posting can be done
+	 * by reading the mbx buffer for ACK opcode (0xFE)
+	 */
+
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n", ret,
+								mbx[0], mbx[4]);
+	else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956xmac_mbx_config_cbs
+ *
+ * \brief API to configure the cbs parameters for queue
+ *
+ * \details This function is used to send cbs parameters to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] send_slope - send_slope
+ * \param[in] idle_slope - idle_slope
+ * \param[in] high_credit - high_credit
+ * \param[in] low_credit - low_credit
+ * \param[in] queue - queue
+ *
+ * \return None
+ */
+static void tc956xmac_mbx_config_cbs(struct tc956xmac_priv *priv,
+				u32 send_slope, u32 idle_slope,
+				u32 high_credit, u32 low_credit, u32 queue)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_CFG_CBS; //opcode
+	mbx[1] = SIZE_MBX_CFG_CBS; //size
+
+	memcpy(&mbx[2], (u8 *)&send_slope, sizeof(send_slope));
+	memcpy(&mbx[6], (u8 *)&idle_slope, sizeof(idle_slope));
+	memcpy(&mbx[10], (u8 *)&high_credit, sizeof(high_credit));
+	memcpy(&mbx[14], (u8 *)&low_credit, sizeof(low_credit));
+	memcpy(&mbx[18], (u8 *)&queue, sizeof(queue));
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	/* Validation of successfull message posting can be done
+	 * by reading the mbx buffer for ACK opcode (0xFE)
+	 */
+
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n", ret,
+								mbx[0], mbx[4]);
+	else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956xmac_mbx_tx_queue_prio
+ *
+ * \brief API to set tx queue priority
+ *
+ * \details This function is used to send tx queue priority values to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] prio - priority
+ * \param[in] queue - queue
+ *
+ * \return None
+ */
+static void tc956xmac_mbx_tx_queue_prio(struct tc956xmac_priv *priv,
+				    u32 prio, u32 queue)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_SET_TX_Q_PRIOR; //opcode
+	mbx[1] = SIZE_MBX_SET_TX_Q_PRIOR; //size
+
+	memcpy(&mbx[2], (u8 *)&prio, sizeof(prio));
+	memcpy(&mbx[6], (u8 *)&queue, sizeof(queue));
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+	/* Validation of successfull message posting can be done
+	 * by reading the mbx buffer for ACK opcode (0xFE)
+	 */
+
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+								ret, mbx[0], mbx[4]);
+	else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956xmac_mbx_get_link_status
+ *
+ * \brief API to get pf link status parametrs
+ *
+ * \details This function is used to get link status from PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[out] link_status - link_status
+ * \param[out] speed - speed
+ * \param[out] duplex - duplex
+ *
+ * \return None
+ */
+static void tc956xmac_mbx_get_link_status(struct tc956xmac_priv *priv,
+						u32 *link_status, u32 *speed, u32 *duplex)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL || link_status == NULL || speed == NULL || duplex == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_VF_GET_LINK_STATUS; //opcode
+	mbx[1] = 0; //size
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+	/* Validation of successfull message posting can be done
+	 * by reading the mbx buffer for ACK opcode (0xFF)
+	 */
+
+	if (ret > 0) {
+		if (ret == ACK) {
+			/* Check the acknowledgement message for opcode and size,
+			 * then read the data from the ACK message
+			 */
+			if ((mbx[4] == OPCODE_MBX_ACK_MSG) && (mbx[5] == SIZE_MBX_PHY_LINK)) {
+				memcpy(link_status, &mbx[6], 4);
+				memcpy(speed, &mbx[10], 4);
+				memcpy(duplex, &mbx[14], 4);
+			}
+		}
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n", ret, mbx[0], mbx[4]);
+	} else {
+		KPRINT_DEBUG2("mailbox write failed");
+	}
+}
+
+/**
+ * tc956xmac_mbx_get_umac_addr
+ *
+ * \brief API to get mac address
+ *
+ * \details This function is used to get mac address from PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] reg_n - register index
+ * \param[out] addr - mac address
+ *
+ * \return None
+ */
+static void tc956xmac_mbx_get_umac_addr(struct tc956xmac_priv *priv,
+				unsigned char *addr, unsigned int reg_n)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL || addr == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_GET_UMAC_ADDR;
+	mbx[1] = SIZE_GET_UMAC_ADDR;
+
+	memcpy(&mbx[2], &reg_n, SIZE_GET_UMAC_ADDR);
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		if (ret == ACK) {
+			if ((mbx[4] == OPCODE_MBX_ACK_MSG) && (mbx[5] == SIZE_MBX_VF_MAC)) {
+				memcpy(addr, &mbx[6], SIZE_MBX_VF_MAC);
+			}
+		}
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n"
+					, ret, mbx[0], mbx[4]);
+	} else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956xmac_mbx_set_umac_addr
+ *
+ * \brief API to add mac address to register
+ *
+ * \details This function is used to send mac address to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] reg_n - register index
+ * \param[in] addr - mac address
+ *
+ * \return error/success
+ */
+static int tc956xmac_mbx_set_umac_addr(struct tc956xmac_priv *priv, unsigned char *addr, unsigned int reg_n)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	int ret = 0;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL || addr == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	mbx[0] = OPCODE_MBX_ADD_MAC_ADDR;
+	mbx[1] = SIZE_SET_UMAC_ADDR;
+
+	memcpy(&mbx[2], addr, SIZE_MBX_VF_MAC);
+	memcpy(&mbx[8], &reg_n, 4);
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x, %x\n"
+					, ret, mbx[0], mbx[4]);
+	} else
+		KPRINT_DEBUG2("mailbox write failed");
+
+	return ret;
+}
+
+/**
+ * tc956xmac_vf_ioctl_reg_wr
+ *
+ * \brief API to write value to register
+ *
+ * \details This function is used to send register value to set in PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] data - input adata from ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_reg_wr(struct tc956xmac_priv *priv,
+							void __user *data)
+{
+	struct tc956xmac_ioctl_reg_rd_wr ioctl_data;
+	u32 val;
+	u8 mbx[MBX_TOT_SIZE];
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+	int ret;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if (copy_from_user(&val, ioctl_data.ptr, sizeof(unsigned int)))
+		return -EFAULT;
+
+	mbx[0] = OPCODE_MBX_VF_IOCTL; /*opcode for ioctl*/
+	mbx[1] = SIZE_MBX_VF_REG_WR; /*size*/
+	mbx[2] = ioctl_data.cmd;
+	memcpy(&mbx[3], (u8 *)&ioctl_data.bar_num, sizeof(ioctl_data.bar_num));
+	memcpy(&mbx[7], (u8 *)&ioctl_data.addr, sizeof(ioctl_data.addr));
+	memcpy(&mbx[11], (u8 *)&val, sizeof(val));
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+		ret, mbx[0], mbx[4]);
+	else {
+		KPRINT_DEBUG2("mailbox write failed");
+		return ret;
+	}
+
+	return 0;
+}
+
+/**
+ * tc956xmac_vf_ioctl_get_connected_speed
+ *
+ * \brief API to get link speed
+ *
+ * \details This function is used to get link speed from PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[out] data - data to ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_get_connected_speed(struct tc956xmac_priv *priv,
+									void __user *data)
+{
+	struct tc956xmac_ioctl_speed ioctl_data;
+	u8 mbx[MBX_TOT_SIZE];
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+	int ret;
+
+	memset(&ioctl_data, 0, sizeof(ioctl_data));
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	mbx[0] = OPCODE_MBX_VF_IOCTL; /*opcode for ioctl*/
+	mbx[1] = SIZE_MBX_VF_SPEED; /*size*/
+	mbx[2] = ioctl_data.cmd;/*cmd for get_speed*/
+
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+	/* Validation of successfull message posting can be done
+	 * by reading the mbx buffer for ACK opcode (0xFE)
+	 */
+	if (ret > 0) {
+		if (ret == ACK) {
+			if ((mbx[4] == OPCODE_MBX_ACK_MSG) && (mbx[5] == sizeof(ioctl_data.connected_speed)))
+				memcpy(&ioctl_data.connected_speed, &mbx[6], sizeof(ioctl_data.connected_speed));
+		}
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n", ret, mbx[0], mbx[4]);
+	} else {
+		KPRINT_DEBUG2("mailbox write failed");
+		return ret;
+	}
+
+	if (copy_to_user(data, &ioctl_data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+	return 0;
+}
+
+/**
+ * tc956xmac_vf_ioctl_set_cbs
+ *
+ * \brief API to set cbs values for queue
+ *
+ * \details This function is used to set cbs values for queue to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] data - input data from ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_set_cbs(struct tc956xmac_priv *priv,
+						void __user *data)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	u8 mbx_loc[MBX_TOT_SIZE * 2], seq = 0, ack = 0;
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	u32 tx_qcount = priv->plat->tx_queues_to_use;
+	struct tc956xmac_ioctl_cbs_cfg cbs;
+	u8 qmode;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	if (copy_from_user(&cbs, data, sizeof(cbs)))
+		return -EFAULT;
+
+	if ((cbs.queue_idx >= tx_qcount) || (cbs.queue_idx == 0))
+		return -EINVAL;
+
+	if (!priv->hw->mac->config_cbs)
+		return -EINVAL;
+
+	qmode = priv->plat->tx_queues_cfg[cbs.queue_idx].mode_to_use;
+
+	if (qmode != MTL_QUEUE_AVB)
+		return -EINVAL;
+
+	memcpy(&mbx_loc[0], (u8 *)&cbs.speed100cfg.send_slope, sizeof(cbs.speed100cfg.send_slope));
+	memcpy(&mbx_loc[4], (u8 *)&cbs.speed100cfg.idle_slope, sizeof(cbs.speed100cfg.idle_slope));
+	memcpy(&mbx_loc[8], (u8 *)&cbs.speed100cfg.high_credit, sizeof(cbs.speed100cfg.high_credit));
+	memcpy(&mbx_loc[12], (u8 *)&cbs.speed100cfg.low_credit, sizeof(cbs.speed100cfg.low_credit));
+	memcpy(&mbx_loc[16], (u8 *)&cbs.speed100cfg.percentage, sizeof(cbs.speed100cfg.percentage));
+
+	memcpy(&mbx_loc[20], (u8 *)&cbs.speed1000cfg.send_slope, sizeof(cbs.speed1000cfg.send_slope));
+	memcpy(&mbx_loc[24], (u8 *)&cbs.speed1000cfg.idle_slope, sizeof(cbs.speed1000cfg.idle_slope));
+	memcpy(&mbx_loc[28], (u8 *)&cbs.speed1000cfg.high_credit, sizeof(cbs.speed1000cfg.high_credit));
+	memcpy(&mbx_loc[32], (u8 *)&cbs.speed1000cfg.low_credit, sizeof(cbs.speed1000cfg.low_credit));
+	memcpy(&mbx_loc[36], (u8 *)&cbs.speed1000cfg.percentage, sizeof(cbs.speed1000cfg.percentage));
+
+	memcpy(&mbx_loc[40], (u8 *)&cbs.speed10000cfg.send_slope, sizeof(cbs.speed10000cfg.send_slope));
+	memcpy(&mbx_loc[44], (u8 *)&cbs.speed10000cfg.idle_slope, sizeof(cbs.speed10000cfg.idle_slope));
+	memcpy(&mbx_loc[48], (u8 *)&cbs.speed10000cfg.high_credit, sizeof(cbs.speed10000cfg.high_credit));
+	memcpy(&mbx_loc[52], (u8 *)&cbs.speed10000cfg.low_credit, sizeof(cbs.speed10000cfg.low_credit));
+	memcpy(&mbx_loc[56], (u8 *)&cbs.speed10000cfg.percentage, sizeof(cbs.speed10000cfg.percentage));
+
+	memcpy(&mbx_loc[60], (u8 *)&cbs.speed5000cfg.send_slope, sizeof(cbs.speed5000cfg.send_slope));
+	memcpy(&mbx_loc[64], (u8 *)&cbs.speed5000cfg.idle_slope, sizeof(cbs.speed5000cfg.idle_slope));
+	memcpy(&mbx_loc[68], (u8 *)&cbs.speed5000cfg.high_credit, sizeof(cbs.speed5000cfg.high_credit));
+	memcpy(&mbx_loc[72], (u8 *)&cbs.speed5000cfg.low_credit, sizeof(cbs.speed5000cfg.low_credit));
+	memcpy(&mbx_loc[76], (u8 *)&cbs.speed5000cfg.percentage, sizeof(cbs.speed5000cfg.percentage));
+
+	memcpy(&mbx_loc[80], (u8 *)&cbs.speed2500cfg.send_slope, sizeof(cbs.speed2500cfg.send_slope));
+	memcpy(&mbx_loc[84], (u8 *)&cbs.speed2500cfg.idle_slope, sizeof(cbs.speed2500cfg.idle_slope));
+	memcpy(&mbx_loc[88], (u8 *)&cbs.speed2500cfg.high_credit, sizeof(cbs.speed2500cfg.high_credit));
+	memcpy(&mbx_loc[92], (u8 *)&cbs.speed2500cfg.low_credit, sizeof(cbs.speed2500cfg.low_credit));
+	memcpy(&mbx_loc[96], (u8 *)&cbs.speed2500cfg.percentage, sizeof(cbs.speed2500cfg.percentage));
+
+	mbx[0] = OPCODE_MBX_VF_IOCTL;
+	mbx[1] = SIZE_MBX_SET_GET_CBS_1;
+	mbx[2] = TC956XMAC_SET_CBS_1;
+	mbx[3] = cbs.queue_idx;
+
+	memcpy(&mbx[4], &mbx_loc[0], SIZE_MBX_SET_GET_CBS_1);
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		ack |= 1 << seq++;
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+		ret, mbx[0], mbx[4]);
+	} else
+		KPRINT_DEBUG2("mailbox write failed");
+
+	mbx[0] = OPCODE_MBX_VF_IOCTL;
+	mbx[1] = SIZE_MBX_SET_GET_CBS_2;
+	mbx[2] = TC956XMAC_SET_CBS_2;
+	mbx[3] = cbs.queue_idx;
+
+	memcpy(&mbx[4], &mbx_loc[SIZE_MBX_SET_GET_CBS_1], SIZE_MBX_SET_GET_CBS_2);
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		ack |= 1 << seq;
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+		ret, mbx[0], mbx[4]);
+	} else
+		KPRINT_DEBUG2("mailbox write failed");
+
+	if (ack == 0x3) {
+		return 0;
+	} else
+		return -EFAULT;
+}
+
+/**
+ * tc956xmac_vf_ioctl_get_cbs
+ *
+ * \brief API to get cbs values for queue
+ *
+ * \details This function is used to get cbs values for queue from PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[out] data - data to ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_get_cbs(struct tc956xmac_priv *priv,
+								void __user *data)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	u8 mbx_loc[MBX_TOT_SIZE * 2], seq = 0, ack = 0;
+
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	u32 tx_qcount = priv->plat->tx_queues_to_use;
+	struct tc956xmac_ioctl_cbs_cfg cbs;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	if (copy_from_user(&cbs, data, sizeof(cbs)))
+		return -EFAULT;
+	if (cbs.queue_idx >= tx_qcount)
+		return -EINVAL;
+
+	mbx[0] = OPCODE_MBX_VF_IOCTL;
+	mbx[1] = SIZE_MBX_VF_GET_CBS;
+	mbx[2] = TC956XMAC_GET_CBS_1;
+	mbx[3] = cbs.queue_idx;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		if (ret == ACK) {
+			if ((mbx[4] == OPCODE_MBX_ACK_MSG) && (mbx[5] == SIZE_MBX_SET_GET_CBS_1)) {
+				ack |= 1 << seq++;
+				memcpy(&mbx_loc[0], &mbx[6], SIZE_MBX_SET_GET_CBS_1);
+			}
+		}
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d  msgbuff %x %x\n", ret, mbx[0], mbx[4]);
+	} else
+		KPRINT_DEBUG2("mailbox write failed");
+
+	mbx[0] = OPCODE_MBX_VF_IOCTL;
+	mbx[1] = SIZE_MBX_VF_GET_CBS;
+	mbx[2] = TC956XMAC_GET_CBS_2;
+	mbx[3] = cbs.queue_idx;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		if (ret == ACK) {
+			if ((mbx[4] == OPCODE_MBX_ACK_MSG) && (mbx[5] == SIZE_MBX_SET_GET_CBS_2)) {
+				ack |= 1 << seq;
+				memcpy(&mbx_loc[SIZE_MBX_SET_GET_CBS_1], &mbx[6], SIZE_MBX_SET_GET_CBS_2);
+			}
+		}
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d  msgbuff %x %x\n", ret, mbx[0], mbx[4]);
+	} else
+		KPRINT_DEBUG2("mailbox write failed");
+
+	if (ack == 0x3) {
+		memcpy(&cbs.speed100cfg.send_slope, &mbx_loc[0], sizeof(cbs.speed100cfg.send_slope));
+		memcpy(&cbs.speed100cfg.idle_slope, &mbx_loc[4], sizeof(cbs.speed100cfg.idle_slope));
+		memcpy(&cbs.speed100cfg.high_credit, &mbx_loc[8], sizeof(cbs.speed100cfg.high_credit));
+		memcpy(&cbs.speed100cfg.low_credit, &mbx_loc[12], sizeof(cbs.speed100cfg.low_credit));
+		memcpy(&cbs.speed100cfg.percentage, &mbx_loc[16], sizeof(cbs.speed100cfg.percentage));
+
+		memcpy(&cbs.speed1000cfg.send_slope, &mbx_loc[20], sizeof(cbs.speed1000cfg.send_slope));
+		memcpy(&cbs.speed1000cfg.idle_slope, &mbx_loc[24], sizeof(cbs.speed1000cfg.idle_slope));
+		memcpy(&cbs.speed1000cfg.high_credit, &mbx_loc[28], sizeof(cbs.speed1000cfg.high_credit));
+		memcpy(&cbs.speed1000cfg.low_credit, &mbx_loc[32], sizeof(cbs.speed1000cfg.low_credit));
+		memcpy(&cbs.speed1000cfg.percentage, &mbx_loc[36], sizeof(cbs.speed1000cfg.percentage));
+
+		memcpy(&cbs.speed10000cfg.send_slope, &mbx_loc[40], sizeof(cbs.speed10000cfg.send_slope));
+		memcpy(&cbs.speed10000cfg.idle_slope, &mbx_loc[44], sizeof(cbs.speed10000cfg.idle_slope));
+		memcpy(&cbs.speed10000cfg.high_credit, &mbx_loc[48], sizeof(cbs.speed10000cfg.high_credit));
+		memcpy(&cbs.speed10000cfg.low_credit, &mbx_loc[52], sizeof(cbs.speed10000cfg.low_credit));
+		memcpy(&cbs.speed10000cfg.percentage, &mbx_loc[56], sizeof(cbs.speed10000cfg.percentage));
+
+		memcpy(&cbs.speed5000cfg.send_slope, &mbx_loc[60], sizeof(cbs.speed5000cfg.send_slope));
+		memcpy(&cbs.speed5000cfg.idle_slope, &mbx_loc[64], sizeof(cbs.speed5000cfg.idle_slope));
+		memcpy(&cbs.speed5000cfg.high_credit, &mbx_loc[68], sizeof(cbs.speed5000cfg.high_credit));
+		memcpy(&cbs.speed5000cfg.low_credit, &mbx_loc[72], sizeof(cbs.speed5000cfg.low_credit));
+		memcpy(&cbs.speed5000cfg.percentage, &mbx_loc[76], sizeof(cbs.speed5000cfg.percentage));
+
+		memcpy(&cbs.speed2500cfg.send_slope, &mbx_loc[80], sizeof(cbs.speed2500cfg.send_slope));
+		memcpy(&cbs.speed2500cfg.idle_slope, &mbx_loc[84], sizeof(cbs.speed2500cfg.idle_slope));
+		memcpy(&cbs.speed2500cfg.high_credit, &mbx_loc[88], sizeof(cbs.speed2500cfg.high_credit));
+		memcpy(&cbs.speed2500cfg.low_credit, &mbx_loc[92], sizeof(cbs.speed2500cfg.low_credit));
+		memcpy(&cbs.speed2500cfg.percentage, &mbx_loc[96], sizeof(cbs.speed2500cfg.percentage));
+	} else
+		return -EFAULT;
+
+	if (copy_to_user(data, &cbs, sizeof(cbs)))
+		return -EFAULT;
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+
+/**
+ * tc956xmac_vf_ioctl_set_est
+ *
+ * \brief API to add est entries
+ *
+ * \details This function is used to send add est entries to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] data - input data from ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_set_est(struct tc956xmac_priv *priv,
+						void __user *data)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	u8 mbx_loc[MBX_MSG_SIZE * 10];
+	int ret = 0, offset = 1, total_size;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+	u32 opcode, rem_gcl_cnt, msg_size;
+	struct tc956xmac_ioctl_est_cfg *est;
+
+	if (!priv->plat->tsn_application)
+		return -EFAULT;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	est = kzalloc(sizeof(*est), GFP_KERNEL);
+	if (!est)
+		return -ENOMEM;
+
+	if (copy_from_user(est, data, sizeof(struct tc956xmac_ioctl_est_cfg))) {
+		ret = -EINVAL;
+		goto out_free;
+	}
+
+	if (est->gcl_size > TC956XMAC_IOCTL_EST_GCL_MAX_ENTRIES) {
+		ret = -EINVAL;
+		goto out_free;
+	}
+
+	if (est->enabled) {
+		memcpy(&mbx_loc[0], (u8 *)&est->enabled, sizeof(est->enabled));
+		memcpy(&mbx_loc[4], (u8 *)&est->btr_offset[0], sizeof(est->btr_offset));
+		memcpy(&mbx_loc[12], (u8 *)&est->ctr[0], sizeof(est->ctr));
+		memcpy(&mbx_loc[20], (u8 *)&est->ter, sizeof(est->ter));
+		memcpy(&mbx_loc[24], (u8 *)&est->gcl_size, sizeof(est->gcl_size));
+		memcpy(&mbx_loc[28], (u8 *)&est->gcl, (est->gcl_size * sizeof(*est->gcl)));
+
+		total_size = (est->gcl_size * sizeof(*est->gcl)) + EST_FIX_MSG_LEN;
+		msg_size = est->gcl_size >= ((SIZE_MBX_SET_GET_EST_1 - EST_FIX_MSG_LEN) / sizeof(est->gcl_size)) ?
+								SIZE_MBX_SET_GET_EST_1 : ((est->gcl_size * sizeof(*est->gcl)) + EST_FIX_MSG_LEN);
+
+		mbx[0] = OPCODE_MBX_VF_IOCTL;
+		mbx[1] = msg_size;
+		mbx[2] = TC956XMAC_SET_EST_1;
+		memcpy(&mbx[3], &mbx_loc[0], mbx[1]);
+
+		ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+		if (ret > 0) {
+			KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+			ret, mbx[0], mbx[4]);
+		} else {
+			KPRINT_DEBUG2("mailbox write failed");
+			goto out_free;
+		}
+
+		opcode = TC956XMAC_SET_EST_1;
+		total_size -= msg_size;
+		rem_gcl_cnt = est->gcl_size > ((SIZE_MBX_SET_GET_EST_1 - EST_FIX_MSG_LEN) / sizeof(est->gcl_size)) ?
+						(est->gcl_size - ((SIZE_MBX_SET_GET_EST_1 - EST_FIX_MSG_LEN) / sizeof(est->gcl_size))) : 0;
+
+		while (total_size > 0) {
+			msg_size = rem_gcl_cnt >= MAX_SIZE_GCL_MSG ? SIZE_MBX_SET_GET_EST_1 : (rem_gcl_cnt * sizeof(*est->gcl));
+			opcode += 1;
+			mbx[0] = OPCODE_MBX_VF_IOCTL;
+			mbx[1] = msg_size;
+			mbx[2] = opcode;
+
+			memcpy(&mbx[3], &mbx_loc[offset * SIZE_MBX_SET_GET_EST_1], msg_size);
+			ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+			if (ret > 0) {
+				KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+				ret, mbx[0], mbx[4]);
+			} else {
+				KPRINT_DEBUG2("mailbox write failed");
+				goto out_free;
+			}
+
+			total_size -= msg_size;
+			rem_gcl_cnt = rem_gcl_cnt > MAX_SIZE_GCL_MSG ?  (rem_gcl_cnt - MAX_SIZE_GCL_MSG) : 0;
+			offset++;
+		}
+		ret = 0;
+	}
+
+out_free:
+	kfree(est);
+
+	return ret;
+}
+
+/**
+ * tc956xmac_vf_ioctl_get_est
+ *
+ * \brief API to get est entries
+ *
+ * \details This function is used to get est entries from PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[out] data - data to ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_get_est(struct tc956xmac_priv *priv,	void __user *data)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	u8 mbx_loc[MBX_MSG_SIZE * 10];
+	u16 msg_size, total_msg_size = 0;
+	int ret, offset = 0;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+	u32 gcl_size = 0, opcode;
+	struct tc956xmac_ioctl_est_cfg *est;
+
+	if (!priv->plat->tsn_application)
+		return -EFAULT;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	est = kzalloc(sizeof(*est), GFP_KERNEL);
+	if (!est)
+		return -ENOMEM;
+
+	opcode = TC956XMAC_GET_EST_1;
+
+	do {
+		mbx[0] = OPCODE_MBX_VF_IOCTL;
+		mbx[1] = SIZE_MBX_VF_GET_EST;
+		mbx[2] = opcode++;
+
+		ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+		if (ret > 0) {
+			if (ret == ACK) {
+				if (mbx[4] == OPCODE_MBX_ACK_MSG) {
+					msg_size = mbx[5];
+					memcpy(&mbx_loc[offset], &mbx[6], msg_size);
+					offset += msg_size;
+					if ((opcode - 1) == TC956XMAC_GET_EST_1) {
+						memcpy(&est->enabled, &mbx_loc[0], sizeof(est->enabled));
+						memcpy(&est->estwid, &mbx_loc[4], sizeof(est->estwid));
+						memcpy(&est->estdep, &mbx_loc[8], sizeof(est->estdep));
+						memcpy(&est->btr_offset[0], &mbx_loc[12], sizeof(est->btr_offset));
+						memcpy(&est->ctr[0], &mbx_loc[20], sizeof(est->ctr));
+						memcpy(&est->ter, &mbx_loc[28], sizeof(est->ter));
+						memcpy(&est->gcl_size, &mbx_loc[32], sizeof(est->gcl_size));
+
+						gcl_size = est->gcl_size * sizeof(*est->gcl);
+						total_msg_size = gcl_size + EST_FIX_MSG_LEN + 8; //8 due to estwid and estdep
+					}
+				}
+			}
+			KPRINT_DEBUG2("mailbox write with ACK or NACK %d  msgbuff %x %x\n", ret, mbx[0], mbx[4]);
+		} else {
+			KPRINT_DEBUG2("mailbox write failed");
+			goto out_free;
+		}
+	} while (offset != total_msg_size);
+
+	memcpy(&est->gcl, &mbx_loc[36], est->gcl_size * sizeof(*est->gcl));
+	ret = 0;
+
+	if (copy_to_user(data, est, sizeof(struct tc956xmac_ioctl_est_cfg))) {
+		goto out_free;
+		ret = -EFAULT;
+	}
+
+out_free:
+	kfree(est);
+
+	return ret;
+}
+
+/**
+ * tc956xmac_vf_ioctl_set_fpe
+ *
+ * \brief API to set fpe param
+ *
+ * \details This function is used to send fpe param to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] data - input data from ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_set_fpe(struct tc956xmac_priv *priv, void __user *data)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	struct tc956xmac_ioctl_fpe_cfg fpe;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	if (copy_from_user(&fpe, data, sizeof(struct tc956xmac_ioctl_fpe_cfg)))
+		return -EFAULT;
+
+	mbx[0] = OPCODE_MBX_VF_IOCTL;
+	mbx[1] = SIZE_MBX_SET_GET_FPE_1;
+	mbx[2] = TC956XMAC_SET_FPE_1;
+
+	memcpy(&mbx[3], (u8 *)&fpe.enabled, sizeof(fpe.enabled));
+	memcpy(&mbx[7], (u8 *)&fpe.pec, sizeof(fpe.pec));
+	memcpy(&mbx[11], (u8 *)&fpe.afsz, sizeof(fpe.afsz));
+	memcpy(&mbx[15], (u8 *)&fpe.RA_time, sizeof(fpe.RA_time));
+	memcpy(&mbx[19], (u8 *)&fpe.HA_time, sizeof(fpe.RA_time));
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+		ret, mbx[0], mbx[4]);
+	} else {
+		KPRINT_DEBUG2("mailbox write failed");
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+/**
+ * tc956xmac_vf_ioctl_get_fpe
+ *
+ * \brief API to get fpe parametrs
+ *
+ * \details This function is used to get fpe param from PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[out] data - data to ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_get_fpe(struct tc956xmac_priv *priv, void __user *data)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+	struct tc956xmac_ioctl_fpe_cfg fpe;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	mbx[0] = OPCODE_MBX_VF_IOCTL;
+	mbx[1] = SIZE_MBX_VF_GET_FPE;
+	mbx[2] = TC956XMAC_GET_FPE_1;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		if (ret == ACK) {
+			if ((mbx[4] == OPCODE_MBX_ACK_MSG) && (mbx[5] == SIZE_MBX_SET_GET_FPE_1)) {
+				memcpy(&fpe.enabled, &mbx[6], sizeof(fpe.enabled));
+				memcpy(&fpe.pec, &mbx[10], sizeof(fpe.pec));
+				memcpy(&fpe.afsz, &mbx[14], sizeof(fpe.afsz));
+				memcpy(&fpe.RA_time, &mbx[18], sizeof(fpe.RA_time));
+				memcpy(&fpe.HA_time, &mbx[22], sizeof(fpe.HA_time));
+			}
+		}
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d  msgbuff %x %x\n", ret, mbx[0], mbx[4]);
+	} else {
+		KPRINT_DEBUG2("mailbox write failed");
+		return -EFAULT;
+	}
+
+	if (copy_to_user(data, &fpe, sizeof(struct tc956xmac_ioctl_fpe_cfg)))
+		return -EFAULT;
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+
+/**
+ * tc956xmac_vf_ioctl_set_rxp
+ *
+ * \brief API to set frp entries
+ *
+ * \details This function is used to send frp entries to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] data - input data from ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_set_rxp(struct tc956xmac_priv *priv, void __user *data)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	u8 *mbx_loc;   //sizeof(struct tc956xmac_ioctl_rxp_cfg)
+	int ret = 0, offset = 1, total_size;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+	u32 opcode, msg_size;
+	struct tc956xmac_ioctl_rxp_cfg *rxp;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	rxp = kzalloc(sizeof(*rxp), GFP_KERNEL);
+	if (!rxp)
+		return -ENOMEM;
+
+	mbx_loc = kzalloc(sizeof(*rxp), GFP_KERNEL);
+	if (!mbx_loc) {
+		ret = -ENOMEM;
+		goto out_free;
+	}
+
+	if (copy_from_user(rxp, data, sizeof(struct tc956xmac_ioctl_rxp_cfg))) {
+		return -EINVAL;
+	}
+
+	if (rxp->nve > TC956XMAC_RX_PARSER_MAX_ENTRIES) {
+		return -EINVAL;
+	}
+
+	if (rxp->enabled) {
+		memcpy(&mbx_loc[0], (u8 *)&rxp->frpes, sizeof(rxp->frpes));
+		memcpy(&mbx_loc[4], (u8 *)&rxp->enabled, sizeof(rxp->enabled));
+		memcpy(&mbx_loc[8], (u8 *)&rxp->nve, sizeof(rxp->nve));
+		memcpy(&mbx_loc[12], (u8 *)&rxp->npe, sizeof(rxp->npe));
+		memcpy(&mbx_loc[16], (u8 *)&rxp->entries, (rxp->nve * sizeof(*rxp->entries)));
+
+		total_size = (rxp->nve * sizeof(*rxp->entries)) + RXP_FIX_MSG_LEN;
+		msg_size = total_size >= SIZE_MBX_SET_GET_RXP_1 ? SIZE_MBX_SET_GET_RXP_1 : total_size;
+
+		mbx[0] = OPCODE_MBX_VF_IOCTL;
+		mbx[1] = msg_size;
+		mbx[2] = TC956XMAC_SET_RXP_1;
+
+		memcpy(&mbx[3], &mbx_loc[0], mbx[1]);
+
+		ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+		if (ret > 0) {
+			KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+			ret, mbx[0], mbx[4]);
+		} else {
+			KPRINT_DEBUG2("mailbox write failed");
+			goto out_free;
+		}
+
+		opcode = TC956XMAC_SET_RXP_1;
+		total_size -= msg_size;
+
+		while (total_size > 0) {
+			msg_size = total_size >= SIZE_MBX_SET_GET_RXP_1 ? SIZE_MBX_SET_GET_RXP_1 : total_size;
+			opcode += 1;
+			mbx[0] = OPCODE_MBX_VF_IOCTL;
+			mbx[1] = msg_size;
+			mbx[2] = opcode;
+
+			memcpy(&mbx[3], &mbx_loc[offset * SIZE_MBX_SET_GET_RXP_1], msg_size);
+			ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+			if (ret > 0) {
+				KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+				ret, mbx[0], mbx[4]);
+			} else {
+				KPRINT_DEBUG2("mailbox write failed");
+				goto out_free;
+			}
+
+			total_size -= msg_size;
+			offset++;
+		}
+		ret = 0;
+	}
+
+out_free:
+	kfree(rxp);
+	kfree(mbx_loc);
+	return ret;
+}
+
+/**
+ * tc956xmac_vf_ioctl_get_rxp
+ *
+ * \brief API to get frp entries
+ *
+ * \details This function is used to get frp entries from PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[out] data - data to ioctl call
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ioctl_get_rxp(struct tc956xmac_priv *priv,	void __user *data)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	u8 *mbx_loc;
+	u16 msg_size, total_msg_size = 0;
+	int ret, offset = 0;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+	u32 rxp_size = 0, opcode;
+	struct tc956xmac_ioctl_rxp_cfg *rxp;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || data == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	rxp = kzalloc(sizeof(*rxp), GFP_KERNEL);
+	if (!rxp)
+		return -ENOMEM;
+
+	mbx_loc = kzalloc(sizeof(*rxp), GFP_KERNEL);
+	if (!mbx_loc) {
+		ret = -ENOMEM;
+		goto out_free;
+	}
+	opcode = TC956XMAC_GET_RXP_1;
+
+	do {
+		mbx[0] = OPCODE_MBX_VF_IOCTL;
+		mbx[1] = SIZE_MBX_VF_GET_RXP;
+		mbx[2] = opcode++;
+
+		ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+		if (ret > 0) {
+			if (ret == ACK) {
+				if (mbx[4] == OPCODE_MBX_ACK_MSG) {
+					msg_size = mbx[5];
+					memcpy(&mbx_loc[offset], &mbx[6], msg_size);
+					offset += msg_size;
+					if ((opcode - 1) == TC956XMAC_GET_RXP_1) {
+						memcpy(&rxp->frpes, &mbx_loc[0], sizeof(rxp->frpes));
+						memcpy(&rxp->enabled, &mbx_loc[4], sizeof(rxp->enabled));
+						memcpy(&rxp->nve, &mbx_loc[8], sizeof(rxp->nve));
+						memcpy(&rxp->npe, &mbx_loc[12], sizeof(rxp->npe));
+						rxp_size = rxp->nve * sizeof(*rxp->entries);
+						total_msg_size = rxp_size + RXP_FIX_MSG_LEN;
+					}
+				}
+			}
+			KPRINT_DEBUG2("mailbox write with ACK or NACK %d  msgbuff %x %x\n", ret, mbx[0], mbx[4]);
+		} else {
+			KPRINT_DEBUG2("mailbox write failed");
+			goto out_free;
+		}
+	} while (offset != total_msg_size);
+
+	memcpy(&rxp->entries[0], &mbx_loc[16], rxp->nve * sizeof(*rxp->entries));
+	ret = 0;
+
+	if (copy_to_user(data, rxp, sizeof(struct tc956xmac_ioctl_rxp_cfg))) {
+		goto out_free;
+		ret = -EFAULT;
+	}
+
+out_free:
+	kfree(rxp);
+	kfree(mbx_loc);
+	return ret;
+}
+
+/**
+ * tc956xmac_vf_ethtool_get_pauseparam
+ *
+ * \brief API to get pauseparameters
+ *
+ * \details This function is used to get ethtool pauseparam from PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[out] pause - pause parameters
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ethtool_get_pauseparam(struct tc956xmac_priv *priv,
+					struct ethtool_pauseparam *pause)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || pause == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	mbx[0] = OPCODE_MBX_VF_ETHTOOL;
+	mbx[1] = SIZE_MBX_VF_PAUSE_PARAM;
+	mbx[2] = OPCODE_MBX_VF_GET_PAUSE_PARAM;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		if (ret == ACK) {
+			mbx[0] = OPCODE_MBX_VF_ETHTOOL;
+			mbx[1] = SIZE_MBX_VF_PAUSE_PARAM;
+			mbx[2] = OPCODE_MBX_VF_GET_PAUSE_PARAM_2;
+
+			ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+			if (ret > 0) {
+				if (ret == ACK) {
+					if ((mbx[4] == OPCODE_MBX_ACK_MSG) &&
+						(mbx[5] == sizeof(struct ethtool_pauseparam))) {
+						memcpy(pause, &mbx[6], sizeof(struct ethtool_pauseparam));
+					}
+				}
+			} else {
+				KPRINT_DEBUG2("mailbox write failed");
+				return ret;
+			}
+		}
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d  msgbuff %x %x\n", ret, mbx[0], mbx[4]);
+	} else {
+		KPRINT_DEBUG2("mailbox write failed");
+		return ret;
+	}
+
+	return 0;
+}
+
+/**
+ * tc956xmac_vf_ethtool_get_eee
+ *
+ * \brief API to get eee parametrs
+ *
+ * \details This function is used to get ethtool eee param from PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[out] edata - edata parameters
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_ethtool_get_eee(struct tc956xmac_priv *priv,
+				     struct ethtool_eee *edata)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (priv == NULL || edata == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	mbx[0] = OPCODE_MBX_VF_ETHTOOL;
+	mbx[1] = SIZE_MBX_VF_EEE;
+	mbx[2] = OPCODE_MBX_VF_GET_EEE;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0) {
+		if (ret == ACK) {
+			if ((mbx[4] == OPCODE_MBX_ACK_MSG) &&
+				(mbx[5] == sizeof(struct ethtool_eee))) {
+				memcpy(edata, &mbx[6], sizeof(struct ethtool_eee));
+			}
+		}
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n", ret, mbx[0], mbx[4]);
+	} else {
+		KPRINT_DEBUG2("mailbox write failed");
+		return ret;
+	}
+
+	return 0;
+}
+
+/**
+ * tc956xmac_vf_add_mac
+ *
+ * \brief API to add mac address
+ *
+ * \details This function is used to send mac address to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mac - mac address
+ *
+ * \return success/error
+ */
+static int tc956xmac_vf_add_mac(struct tc956xmac_priv *priv, const u8 *mac)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL || mac == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	mbx[0] = OPCODE_MBX_VF_ADD_MAC;
+	mbx[1] = SIZE_MBX_VF_MAC;
+
+	memcpy(&mbx[2], mac, SIZE_MBX_VF_MAC);
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+		ret, mbx[0], mbx[4]);
+	else {
+		KPRINT_DEBUG2("mailbox write failed");
+		return ret;
+	}
+
+	return 0;
+}
+
+/**
+ * tc956xmac_vf_delete_mac
+ *
+ * \brief API to delete mac address
+ *
+ * \details This function is used to send mac address to delete to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] mac - mac address
+ *
+ * \return None
+ */
+static void tc956xmac_vf_delete_mac(struct tc956xmac_priv *priv, const u8 *mac)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL || mac == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_VF_DELETE_MAC;
+	mbx[1] = SIZE_MBX_VF_MAC;
+
+	memcpy(&mbx[2], mac, SIZE_MBX_VF_MAC);
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+		ret, mbx[0], mbx[4]);
+	else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956xmac_vf_add_vlan
+ *
+ * \brief API to add vlan id
+ *
+ * \details This function is used to send vlan id to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] vid - vlan id
+ *
+ * \return None
+ */
+static void tc956xmac_vf_add_vlan(struct tc956xmac_priv *priv, u16 vid)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_VF_ADD_VLAN;
+	mbx[1] = SIZE_MBX_VF_VLAN;
+
+	memcpy(&mbx[2], (u8 *)&vid, SIZE_MBX_VF_VLAN);
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+		ret, mbx[0], mbx[4]);
+	else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956xmac_vf_delete_vlan
+ *
+ * \brief API to delete vlan id
+ *
+ * \details This function is used to send vlan id to delete to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] vid - vlan id
+ *
+ * \return None
+ */
+static void tc956xmac_vf_delete_vlan(struct tc956xmac_priv *priv, u16 vid)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_VF_DELETE_VLAN;
+	mbx[1] = SIZE_MBX_VF_VLAN;
+
+	memcpy(&mbx[2], (u8 *)&vid, SIZE_MBX_VF_VLAN);
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n",
+		ret, mbx[0], mbx[4]);
+	else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956x_mbx_get_drv_cap
+ *
+ * \brief API to receive EMAC features state from PF
+ *
+ * \details This function is used to receive states for Jumbo frames, TSO,
+ * RX CRC and RC Checksum from PF using mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ *
+ * \return None
+ */
+static void tc956x_mbx_get_drv_cap(struct tc956xmac_priv *priv, struct tc956xmac_priv *priv1)
+{
+	/* Prepare mailbox message and call mailbox API for posting
+	 * and getting the ACK
+	 */
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_DRV_CAP;
+	mbx[1] = 0;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+	/* If ACK received, copy data*/
+	if (ret > 0) {
+		if (ret == ACK) {
+			if ((mbx[4] == OPCODE_MBX_ACK_MSG) && (mbx[5] == SIZE_MBX_DRV_CAP)) {
+
+			/* Copy PF drv capabiliites to priv*/
+			    memcpy((u8 *)&priv->pf_drv_cap, &mbx[6],
+							SIZE_MBX_DRV_CAP);
+			}
+		}
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n"
+					, ret, mbx[0], mbx[4]);
+	} else {
+		priv->pf_drv_cap.jumbo_en = false;
+		priv->pf_drv_cap.tso_en = false;
+		priv->pf_drv_cap.crc_en = false;
+		priv->pf_drv_cap.csum_en = false;
+		KPRINT_DEBUG2("mailbox write failed");
+	}
+}
+
+/**
+ * tc956xmac_vf_mbx_reset_eee_mode
+ *
+ * \brief API to reset eee mode
+ *
+ * \details This function is used to param of eee reset to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] hw - pointer to device information structure
+ *
+ * \return None
+ */
+static void tc956xmac_vf_mbx_reset_eee_mode(struct tc956xmac_priv *priv, struct mac_device_info *hw)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL || hw == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_MBX_RESET_EEE_MODE;
+	mbx[1] = 0;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n", ret,
+								mbx[0], mbx[4]);
+	else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956xmac_vf_mbx_reset
+ *
+ * \brief API to send VF status to PF
+ *
+ * \details This function is used to send VF status to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] vf_status - vf_status
+ *
+ * \return None
+ */
+static void tc956xmac_vf_mbx_reset(struct tc956xmac_priv *priv, u8 vf_status)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return;
+	}
+
+	mbx[0] = OPCODE_VF_RESET;
+	mbx[1] = SIZE_VF_RESET;
+	mbx[2] = vf_status;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n", ret,
+								mbx[0], mbx[4]);
+	else
+		KPRINT_DEBUG2("mailbox write failed");
+}
+
+/**
+ * tc956x_mbx_setup_cbs
+ *
+ * \brief API to setup cbs param for queue using TC command
+ *
+ * \details This function is used to send VF status to PF using
+ *		mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] qopt - pointer to tc_cbs_qopt_offload structure
+ *
+ * \return success/error
+ */
+static int tc956x_mbx_setup_cbs(struct tc956xmac_priv *priv, struct tc_cbs_qopt_offload *qopt)
+{
+	u8 mbx[MBX_TOT_SIZE];
+	int ret;
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+
+	if (priv == NULL || qopt == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return -EFAULT;
+	}
+
+	mbx[0] = OPCODE_MBX_SETUP_CBS; //opcode
+	mbx[1] = SIZE_MBX_SETUP_CBS; //size
+
+	memcpy(&mbx[2], (u8 *)&qopt->enable, sizeof(qopt->enable));
+	memcpy(&mbx[3], (u8 *)&qopt->idleslope, sizeof(qopt->idleslope));
+	memcpy(&mbx[7], (u8 *)&qopt->sendslope, sizeof(qopt->sendslope));
+	memcpy(&mbx[11], (u8 *)&qopt->hicredit, sizeof(qopt->hicredit));
+	memcpy(&mbx[15], (u8 *)&qopt->locredit, sizeof(qopt->locredit));
+	memcpy(&mbx[19], (u8 *)&qopt->queue, sizeof(qopt->queue));
+
+	if (priv->plat->ch_in_use[qopt->queue] == 0)
+		return -EFAULT;
+
+	ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+	if (ret > 0)
+		KPRINT_DEBUG2("mailbox write with ACK or NACK %d msgbuff %x %x\n", ret,
+								mbx[0], mbx[4]);
+	else {
+		KPRINT_DEBUG2("mailbox write failed");
+		return ret;
+	}
+
+	return 0;
+}
+
+/* Parsing PF->VF Message */
+/**
+ * tc956x_mbx_phy_link
+ *
+ * \brief API to receive link state and params from PF
+ *
+ * \details This function is used to receive PHY link parameters from PF using
+ *		mailbox interface during state change.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] msg_buf - Pointer to mailboc message buffer
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_phy_link(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg)
+{
+	u32 datal = 0, datah = 0;
+	u8 vf_mac_addr[6];
+	u8 comp_addr[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	unsigned long flags;
+
+	if (priv == NULL || msg_buf == NULL || ack_msg == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (msg_buf[0] != OPCODE_MBX_PHY_LINK)
+		return NACK;
+
+	if (msg_buf[1] != SIZE_MBX_PHY_LINK)
+		return NACK;
+
+	/* Copy link, speed and duplex values from mailbox */
+
+	memcpy((u8 *)&priv->link, &msg_buf[2], SIZE_MBX_PHY_LINK);
+
+	/* Indicate state change to NW layer */
+	if (priv->link) {
+		netif_carrier_on(priv->dev);
+		NMSGPR_INFO(priv->device, "PHY Link : UP\n");
+
+		datal = readl(priv->ioaddr + XGMAC_ADDRx_LOW(HOST_MAC_ADDR_OFFSET + priv->fn_id_info.vf_no));
+		datah = readl(priv->ioaddr + XGMAC_ADDRx_HIGH(HOST_MAC_ADDR_OFFSET + priv->fn_id_info.vf_no));
+
+		vf_mac_addr[0] = datal & 0xff;
+		vf_mac_addr[1] = (datal >> 8) & 0xff;
+		vf_mac_addr[2] = (datal >> 16) & 0xff;
+		vf_mac_addr[3] = (datal >> 24) & 0xff;
+		vf_mac_addr[4] = datah & 0xff;
+		vf_mac_addr[5] = (datah >> 8) & 0xff;
+
+		if (!(memcmp(vf_mac_addr, comp_addr, 6))) {
+			spin_lock_irqsave(&priv->wq_lock, flags);
+			priv->flag = SCH_WQ_LINK_STATE_UP;
+			tc956xmac_mailbox_service_event_schedule(priv);
+			spin_unlock_irqrestore(&priv->wq_lock, flags);
+
+		}
+	} else {
+		netif_carrier_off(priv->dev);
+		NMSGPR_INFO(priv->device, "PHY Link : DOWN\n");
+	}
+
+	KPRINT_DEBUG2("Link state change update received from PF\n");
+
+	ack_msg[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_msg[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_rx_crc
+ *
+ * \brief API to receive Rx CRC state from PF
+ *
+ * \details This function is used to receive Rx CRC state from PF using
+ * mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] msg_buf - Pointer to mailbox message buffer
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_rx_crc(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg)
+{
+	unsigned long flags;
+
+	if (priv == NULL || msg_buf == NULL || ack_msg == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (msg_buf[0] != OPCODE_MBX_RX_CRC)
+		return NACK;
+
+	if (msg_buf[1] != SIZE_MBX_RX_CRC)
+		return NACK;
+
+	/* Copy RX CRC state values from mailbox */
+	memcpy(&priv->rx_crc_pad_state, &msg_buf[2],
+						SIZE_MBX_RX_CRC);
+	priv->pf_drv_cap.crc_en = priv->rx_crc_pad_state;
+
+	spin_lock_irqsave(&priv->wq_lock, flags);
+	tc956xmac_mailbox_service_event_schedule(priv);
+	spin_unlock_irqrestore(&priv->wq_lock, flags);
+
+	KPRINT_DEBUG2("Rx CRC state received from PF");
+	ack_msg[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_msg[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_rx_csum
+ *
+ * \brief API to receive Rx Checksum state from PF
+ *
+ * \details This function is used to receive Rx Checksum state from PF using
+ * mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] msg_buf - Pointer to mailbox message buffer
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_rx_csum(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg)
+{
+	unsigned long flags;
+
+	if (priv == NULL || msg_buf == NULL || ack_msg == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (msg_buf[0] != OPCODE_MBX_RX_CSUM)
+		return NACK;
+
+	if (msg_buf[1] != SIZE_MBX_RX_CSUM)
+		return NACK;
+
+	/* Copy RX checksum state from mailbox */
+	memcpy(&priv->rx_csum_state, &msg_buf[2], SIZE_MBX_RX_CSUM);
+	priv->pf_drv_cap.csum_en = priv->rx_csum_state;
+
+	spin_lock_irqsave(&priv->wq_lock, flags);
+	tc956xmac_mailbox_service_event_schedule(priv);
+	spin_unlock_irqrestore(&priv->wq_lock, flags);
+
+	KPRINT_DEBUG2("Rx CSum state received from PF");
+
+	ack_msg[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_msg[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_rx_dma_ch_tlptr
+ *
+ * \brief API to receive dma ch no from PF to update tail pointer
+ *
+ * \details This function is used to receive dma ch no from PF using
+ * mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] msg_buf - Pointer to mailbox message buffer
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_rx_dma_ch_tlptr(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg)
+{
+	u32 ch;
+	struct tc956xmac_rx_queue *rx_q;
+
+	if (priv == NULL || msg_buf == NULL || ack_msg == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (msg_buf[0] != OPCODE_MBX_DMA_CH_TLPTR)
+		return NACK;
+
+	if (msg_buf[1] != SIZE_MBX_RX_DMA_TL_PTR)
+		return NACK;
+
+	memcpy(&ch, &msg_buf[2], SIZE_MBX_RX_DMA_TL_PTR);
+
+	if (priv->plat->ch_in_use[ch] == 0)
+		return NACK;
+
+	rx_q = &priv->rx_queue[ch];
+	tc956xmac_set_rx_tail_ptr(priv, priv->ioaddr, rx_q->rx_tail_addr, ch);
+
+	ack_msg[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_msg[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_setup_etf
+ *
+ * \brief API to receive tbs status from PF to update tail pointer
+ *
+ * \details This function is used to receive tbs status from PF using
+ * mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] msg_buf - Pointer to mailbox message buffer
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_setup_etf(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg)
+{
+	u32 ch;
+	u8 tbs_status;
+
+	if (priv == NULL || msg_buf == NULL || ack_msg == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (msg_buf[0] != OPCODE_MBX_SETUP_ETF)
+		return NACK;
+
+	if (msg_buf[1] != SIZE_MBX_SETUP_ETF)
+		return NACK;
+
+	memcpy(&ch, &msg_buf[2], 4);
+	memcpy(&tbs_status, &msg_buf[6], 1);
+
+	if (priv->plat->tx_queues_cfg[ch].mode_to_use != MTL_QUEUE_DISABLE) {
+		if (priv->tx_queue[ch].tbs & TC956XMAC_TBS_AVAIL) {
+			if (tbs_status)
+				priv->tx_queue[ch].tbs |= TC956XMAC_TBS_EN;
+			else
+				priv->tx_queue[ch].tbs &= ~TC956XMAC_TBS_EN;
+		}
+	}
+
+	ack_msg[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_msg[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_pf_flr
+ *
+ * \brief API to receive PF FLR trigger from PF
+ *
+ * \details This function is used to receive PF FLR trigger from PF using
+ * mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] msg_buf - Pointer to mailbox message buffer
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_pf_flr(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg)
+{
+	unsigned long flags;
+
+	if (priv == NULL || msg_buf == NULL || ack_msg == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (msg_buf[0] != OPCODE_MBX_FLR)
+		return NACK;
+
+	if (msg_buf[1] != 0)
+		return NACK;
+
+	spin_lock_irqsave(&priv->wq_lock, flags);
+	priv->flag = SCH_WQ_PF_FLR;
+	tc956xmac_mailbox_service_event_schedule(priv);
+	spin_unlock_irqrestore(&priv->wq_lock, flags);
+
+	ack_msg[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_msg[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+/**
+ * tc956x_mbx_rx_dma_err
+ *
+ * \brief API to receive DMA err state from PF
+ *
+ * \details This function is used to receive DMA err state from PF using
+ * mailbox interface.
+ *
+ * \param[in] priv - Pointer to device's private structure
+ * \param[in] msg_buf - Pointer to mailbox message buffer
+ * \param[out] ack_msg - Pointer to output ack
+ *
+ * \return ACK/NACK
+ */
+static int tc956x_mbx_rx_dma_err(struct tc956xmac_priv *priv, u8 *msg_buf, u8 *ack_msg)
+{
+	unsigned long flags;
+
+	if (priv == NULL || msg_buf == NULL || ack_msg == NULL) {
+		KPRINT_DEBUG2("NULL pointer error\n");
+		return NACK;
+	}
+
+	if (msg_buf[0] != OPCODE_MBX_DMA_ERR)
+		return NACK;
+
+	if (msg_buf[1] != 0)
+		return NACK;
+
+	spin_lock_irqsave(&priv->wq_lock, flags);
+	priv->flag = SCH_WQ_RX_DMA_ERR;
+	tc956xmac_mailbox_service_event_schedule(priv);
+	spin_unlock_irqrestore(&priv->wq_lock, flags);
+
+	ack_msg[0] = OPCODE_MBX_ACK_MSG;
+	memset(&ack_msg[1], 0, MBX_MSG_SIZE-1);
+
+	return ACK;
+}
+
+const struct tc956xmac_mbx_wrapper_ops tc956xmac_mbx_wrapper_ops = {
+	.dma_tx_mode = tc956xmac_mbx_dma_tx_mode,
+	.get_umac_addr = tc956xmac_mbx_get_umac_addr,
+	.set_umac_addr = tc956xmac_mbx_set_umac_addr,
+	.set_mtl_tx_queue_weight = tc956xmac_mbx_set_mtl_tx_queue_weight,
+	.config_cbs = tc956xmac_mbx_config_cbs,
+	.tx_queue_prio = tc956xmac_mbx_tx_queue_prio,
+	.get_link_status = tc956xmac_mbx_get_link_status,
+	.phy_link = tc956x_mbx_phy_link,
+	.get_drv_cap = tc956x_mbx_get_drv_cap,
+	.rx_crc = tc956x_mbx_rx_crc,
+	.rx_csum = tc956x_mbx_rx_csum,
+	.get_cbs = tc956xmac_vf_ioctl_get_cbs,
+	.set_cbs = tc956xmac_vf_ioctl_set_cbs,
+	.set_est = tc956xmac_vf_ioctl_set_est,
+	.get_est = tc956xmac_vf_ioctl_get_est,
+	.set_rxp = tc956xmac_vf_ioctl_set_rxp,
+	.get_rxp = tc956xmac_vf_ioctl_get_rxp,
+	.get_fpe = tc956xmac_vf_ioctl_get_fpe,
+	.set_fpe = tc956xmac_vf_ioctl_set_fpe,
+	.get_speed = tc956xmac_vf_ioctl_get_connected_speed,
+	.reg_wr = tc956xmac_vf_ioctl_reg_wr,
+	.get_pause_param = tc956xmac_vf_ethtool_get_pauseparam,
+	.get_eee = tc956xmac_vf_ethtool_get_eee,
+	.add_mac = tc956xmac_vf_add_mac,
+	.delete_mac = tc956xmac_vf_delete_mac,
+	.add_vlan = tc956xmac_vf_add_vlan,
+	.delete_vlan = tc956xmac_vf_delete_vlan,
+	.reset_eee_mode = tc956xmac_vf_mbx_reset_eee_mode,
+	.vf_reset = tc956xmac_vf_mbx_reset,
+	.rx_dma_ch_tlptr = tc956x_mbx_rx_dma_ch_tlptr,
+	.setup_cbs = tc956x_mbx_setup_cbs,
+	.setup_mbx_etf = tc956x_mbx_setup_etf,
+	.pf_flr = tc956x_mbx_pf_flr,
+	.rx_dma_err = tc956x_mbx_rx_dma_err,
+};
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_vf_rsc_mng.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_vf_rsc_mng.c
@@ -0,0 +1,119 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_vf_rsc_mng.c
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  04 Jun 2020 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  30 Nov 2021 : Base lined for SRIOV
+ *  VERSION     : 01-02
+ */
+
+#include "tc956x_vf_rsc_mng.h"
+#include "tc956xmac.h"
+
+
+/**
+ * tc956x_vf_rsc_mng_init
+ *
+ * \brief API to initialise resource manager parameters
+ *
+ * \details This function initialise parameters used for resource manager
+ * control.
+ *
+ * \param[in] ndev - Pointer to device structure
+ *
+ * \return None
+ */
+
+static int tc956x_vf_rsc_mng_init(struct tc956xmac_priv *priv, struct net_device *ndev)
+{
+	return 0;
+}
+
+/**
+ * tc956x_vf_rsc_mng_get_fn_id
+ *
+ * \brief API to get function ID of this function
+ *
+ * \details This function is called to get the function ID from
+ * the resource manager function ID register
+ *
+ * \param[in] dev - Pointer to device structure
+ * \param[in] fn_id_info - Pointer to function id info structure
+ *
+ * \return success or error
+ */
+
+int tc956x_vf_rsc_mng_get_fn_id(struct tc956xmac_priv *priv, void __iomem *reg_pci_bridge_config_addr,
+				       struct fn_id *fn_id_info)
+{
+	void __iomem *ioaddr = reg_pci_bridge_config_addr;
+	u32 rsc_mng_id = readl(ioaddr + RSCMNG_ID_REG);
+
+	fn_id_info->fn_type = (rsc_mng_id & RSC_MNG_FN_TYPE) >> 16;
+	fn_id_info->pf_no = (rsc_mng_id & RSC_MNG_PF_FN_NUM);
+	fn_id_info->vf_no = ((rsc_mng_id & RSC_MNG_VF_FN_NUM) >> 8);
+
+	/** Below error check for VF driver.
+	 * In case of VF driver, function type to be 1
+	 */
+	if (fn_id_info->fn_type == 0)
+		return -1;
+
+	/* VF1,2,3 are supported */
+	if (fn_id_info->vf_no > 3)
+		return -1;
+
+	/* PF 0 and 1 are supported */
+	if (fn_id_info->pf_no > 1)
+		return -1;
+
+	return 0;
+}
+
+/**
+ * tc956x_vf_rsc_mng_get_rscs
+ *
+ * \brief API to get the DMA channel resources allocated
+ *
+ * \details This function is used to get the resources (DMA channels)
+ * allocated for this function
+ *
+ * \param[in] dev - Pointer to device structure
+ * \param[in] rscs - Pointer to return DMA channel bit pattern in
+ * order <7,6,5,4,3,2,1,0>
+ * \return None
+ */
+
+static void tc956x_vf_rsc_mng_get_rscs(struct tc956xmac_priv *priv, struct net_device *dev, u8 *rscs)
+{
+	void __iomem *ioaddr = (void __iomem *)priv->tc956x_BRIDGE_CFG_pci_base_addr;
+	*rscs = ((readl(ioaddr + RSCMNG_RSC_ST_REG)) & RSC_MNG_RSC_STATUS_MASK);
+}
+
+const struct mac_rsc_mng_ops tc956xmac_rsc_mng_ops = {
+	.init = tc956x_vf_rsc_mng_init,
+	.get_fn_id = tc956x_vf_rsc_mng_get_fn_id,
+	.set_rscs = NULL, /* Not applicable for VF */
+	.get_rscs = tc956x_vf_rsc_mng_get_rscs,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_vf_rsc_mng.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_vf_rsc_mng.h
@@ -0,0 +1,87 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956x_vf_rsc_mng.h
+ *
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  10 Jul 2020  : Initial Version
+ *  VERSION      : 00-01
+ *
+ *  30 Nov 2021  : Base lined for SRIOV
+ *  VERSION      : 01-02
+ */
+
+#ifndef __TC956X_VF_RSC_MNG_H__
+#define __TC956X_VF_RSC_MNG_H__
+
+#include "common.h"
+#include <linux/netdevice.h>
+
+#define MAX_FUNCTIONS_PER_PF 4 /*Max functions per pf including pf, vfs*/
+#define RSC_MNG_OFFSET 0x2000
+#define RSCMNG_ID_REG ((RSC_MNG_OFFSET) + 0x00000000)
+#define RSCMNG_RSC_CTRL_REG ((RSC_MNG_OFFSET) + 0x00000004)
+#define RSCMNG_RSC_ST_REG ((RSC_MNG_OFFSET) + 0x00000008)
+#define RSCMNG_INT_CTRL_REG ((RSC_MNG_OFFSET) + 0x0000000c)
+#define RSCMNG_INT_ST_REG ((RSC_MNG_OFFSET) + 0x00000010)
+
+#define RSC_MNG_FN_TYPE BIT(16)
+#define RSC_MNG_VF_FN_NUM GENMASK(11, 8)
+#define RSC_MNG_PF_FN_NUM GENMASK(3, 0)
+
+#define RSC_MNG_DMA_CH7_MASK 0x80
+#define RSC_MNG_DMA_CH6_MASK 0x40
+#define RSC_MNG_DMA_CH5_MASK 0x20
+#define RSC_MNG_DMA_CH4_MASK 0x10
+#define RSC_MNG_DMA_CH3_MASK 0x08
+#define RSC_MNG_DMA_CH2_MASK 0x04
+#define RSC_MNG_DMA_CH1_MASK 0x02
+#define RSC_MNG_DMA_CH0_MASK 0x01
+
+#define RSC_MNG_DMA_CH7_BIT_POS 28
+#define RSC_MNG_DMA_CH6_BIT_POS 24
+#define RSC_MNG_DMA_CH5_BIT_POS 20
+#define RSC_MNG_DMA_CH4_BIT_POS 16
+#define RSC_MNG_DMA_CH3_BIT_POS 12
+#define RSC_MNG_DMA_CH2_BIT_POS 8
+#define RSC_MNG_DMA_CH1_BIT_POS 4
+#define RSC_MNG_DMA_CH0_BIT_POS 0
+
+#define RSC_MNG_RSC_STATUS_MASK 0xff
+
+#define RSC_MNG_INT_STATUS_MASK 0x1f
+#define RSC_MNG_INT_MCU_MASK 0x10
+#define RSC_MNG_INT_VF2_MASK 0x08
+#define RSC_MNG_INT_VF1_MASK 0x04
+#define RSC_MNG_INT_VF0_MASK 0x02
+#define RSC_MNG_INT_OTHR_PF_MASK 0x01
+
+#define MBX_MCU_INTERRUPT BIT(4)
+#define MBX_VF3_INTERRUPT BIT(3)
+#define MBX_VF2_INTERRUPT BIT(2)
+#define MBX_VF1_INTERRUPT BIT(1)
+#define MBX_PF_INTERRUPT BIT(0)
+
+#define RSC_MNG_ACK_MASK 0x01
+#define RSC_MNG_NACK_MASK 0x02
+
+#define MBX_TIMEOUT 1000
+
+#endif /* __TC956X_VF_RSC_MNG_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_xpcs.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_xpcs.c
@@ -0,0 +1,290 @@
+/*
+ * TC956x XPCS layer
+ *
+ * tc956x_xpcs.c
+ *
+ * Copyright (C) 2022 Toshiba Electronic Devices & Storage Corporation
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  05 Nov 2020 : Initial version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  22 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported with module parameters
+ *  VERSION     : 01-00-04
+ *  26 Oct 2021 : 1. Added EEE configration for PHY and MAC Controlled Mode.
+ *  VERSION     : 01-00-19
+ *  25 Feb 2022 : 1. Helper function added for XPCS Rx LPI enable/disable
+ *  VERSION     : 01-00-44
+ */
+
+#include "common.h"
+#include "tc956xmac.h"
+#include "tc956x_xpcs.h"
+#ifdef TC956X
+u32 tc956x_xpcs_read(void __iomem *xpcsaddr, u32 pcs_reg_num)
+{
+	u32 reg_value;
+	u16 base_address, offset;
+
+	base_address = pcs_reg_num >> XPCS_REG_BASE_ADDR;
+	offset = pcs_reg_num & XPCS_REG_OFFSET;
+
+	KPRINT_INFO("XPCS Indirect Access Base Register : %x, offset : %x", base_address, offset);
+	/*write base address to (PCS address + 0x3FC) register*/
+	writel(base_address, (xpcsaddr + XPCS_IND_ACCESS));
+
+	/*Access to offset address (PCS address + offset)*/
+	reg_value = readl(xpcsaddr + offset);
+	KPRINT_INFO("XPCS register %x indirect read access value : %x", pcs_reg_num, reg_value);
+
+	return reg_value;
+}
+
+u32 tc956x_xpcs_write(void __iomem *xpcsaddr, u32 pcs_reg_num, u32 value)
+{
+	u16 base_address, offset;
+
+	base_address = pcs_reg_num >> XPCS_REG_BASE_ADDR;
+	offset = pcs_reg_num & XPCS_REG_OFFSET;
+
+	KPRINT_INFO("XPCS Indirect Access Base Register : %x, offset : %x", base_address, offset);
+	/*write base address to (PCS address + 0x3FC) register*/
+	writel(base_address, (xpcsaddr + XPCS_IND_ACCESS));
+
+	/*Access to offset address (PCS address + offset)*/
+	writel(value, xpcsaddr + offset);
+	KPRINT_INFO("XPCS register %x indirect write access value : %x", pcs_reg_num, value);
+
+	return 0;
+}
+
+
+int tc956x_xpcs_init(struct tc956xmac_priv *priv, void __iomem *xpcsaddr)
+{
+	u32 reg_value;
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_SR_MII_CTRL);
+	if (reg_value & XGMAC_SOFT_RST)
+		return -1;
+
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	if (priv->wol_config_enabled != true) {
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+		/*Clause 37 autoneg related settings*/
+		if (priv->plat->interface == PHY_INTERFACE_MODE_SGMII) {
+			//DK2
+			//PCS Type Select SR_XS_PCS_CTRL2  PCS_TYPE_SEL -> 1
+			reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_SR_XS_PCS_CTRL2);
+			reg_value &= XGMAC_PCS_TYPE_SEL;
+			reg_value |= 0x1;
+			tc956x_xpcs_write(xpcsaddr, XGMAC_SR_XS_PCS_CTRL2, reg_value);
+
+			reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_MII_AN_CTRL);
+			reg_value &= XGMAC_PCS_MODE_MASK;
+			reg_value |= XGMAC_SGMII_MODE;/*SGMII PCS MODE*/
+			tc956x_xpcs_write(xpcsaddr, XGMAC_VR_MII_AN_CTRL, reg_value);
+
+			if (priv->is_sgmii_2p5g == true) {
+				reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1);
+				reg_value &= ~(0x4);
+				/* Enable only if SGMII 2.5G is enabled */
+				reg_value |= 0x4; /*EN_2_5G_MODE*/
+				tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1, reg_value);
+			}
+		}
+		if ((priv->plat->interface == PHY_INTERFACE_MODE_USXGMII) ||
+			(priv->plat->interface == PHY_INTERFACE_MODE_10GKR)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+			|| (priv->plat->interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+			) {
+			reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_SR_XS_PCS_CTRL2);
+			reg_value &= XGMAC_PCS_TYPE_SEL;/*PCS_TYPE_SEL as 10GBASE-R PCS */
+			tc956x_xpcs_write(xpcsaddr, XGMAC_SR_XS_PCS_CTRL2, reg_value);
+
+			reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1);
+			if (priv->plat->interface == PHY_INTERFACE_MODE_10GKR 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+				|| (priv->plat->interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+				) {
+				reg_value &= (~XGMAC_USXG_EN); /*Disable USXG_EN*/
+			} else {
+				reg_value |= XGMAC_USXG_EN; /*set USXG_EN*/
+			}
+
+			tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1, reg_value);
+
+			reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_KR_CTRL);
+			reg_value &= ~XGMAC_USXG_MODE;/*USXG_MODE : 0x000*/
+			tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_KR_CTRL, reg_value);
+
+			reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1);
+			reg_value |= XGMAC_VR_RST;/*set VR_RST*/
+			tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1, reg_value);
+
+			/*Wait for Reset to clear*/
+			do {
+				reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1);
+			} while ((XGMAC_VR_RST & reg_value) == XGMAC_VR_RST);
+
+		}
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	} else { /* SerDES Configuration for WOL SGMII 1G when native interface other than SGMII. */
+		KPRINT_INFO("%s Port %d %s: Entered with flag priv->wol_config_enabled %d", __func__, priv->port_num, priv->dev->name, priv->wol_config_enabled);
+		reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_SR_XS_PCS_CTRL2);
+			reg_value &= XGMAC_PCS_TYPE_SEL;
+			reg_value |= 0x1;
+			tc956x_xpcs_write(xpcsaddr, XGMAC_SR_XS_PCS_CTRL2, reg_value);
+
+			reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_MII_AN_CTRL);
+			reg_value &= XGMAC_PCS_MODE_MASK;
+			reg_value |= XGMAC_SGMII_MODE;/*SGMII PCS MODE*/
+			tc956x_xpcs_write(xpcsaddr, XGMAC_VR_MII_AN_CTRL, reg_value);
+	}
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+#ifdef EEE
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_SR_XS_PCS_CTRL1);
+	reg_value |= XGMAC_LPI_ENABLE;/* LPM : power down */
+	tc956x_xpcs_write(xpcsaddr, XGMAC_SR_XS_PCS_CTRL1, reg_value);
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_DIG_STS);
+	reg_value &= ~(XGMAC_PSEQ_STATE);/* PSEQ_STATE(B4:2)=3'b000 */
+	tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_DIG_STS, reg_value);
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_SR_XS_PCS_CTRL1);
+	reg_value &= ~(XGMAC_LPI_ENABLE);/* LPM : Normal Operation */
+	tc956x_xpcs_write(xpcsaddr, XGMAC_SR_XS_PCS_CTRL1, reg_value);
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_SR_XS_PCS_EEE_ABL);
+	reg_value |= XGMAC_KXEEE;/* KXEEE */
+	tc956x_xpcs_write(xpcsaddr, XGMAC_SR_XS_PCS_EEE_ABL, reg_value);
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_EEE_MCTRL0);
+	reg_value &= ~(XGMAC_MULT_FACT_100NS);
+#ifdef EEE_MAC_CONTROLLED_MODE
+	reg_value |= XGMAC_MULT_FACT_100NS_MAC; /* MULT_FACT_100NS */
+#else
+	reg_value |= XGMAC_MULT_FACT_100NS_PHY; /* MULT_FACT_100NS */
+#endif
+	reg_value |= XGMAC_SIGN_BIT;/* SIGN_BIT */
+	reg_value |= XGMAC_TX_RX_EN;/* TX_EN_CTRL, RX_EN_CTRL */
+	tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_EEE_MCTRL0, reg_value);
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_EEE_TXTIMER);
+	reg_value &= ~(XGMAC_EEE_TX_TIMER);
+#ifdef EEE_MAC_CONTROLLED_MODE
+	reg_value |= XGMAC_EEE_TX_TIMER_MAC_CONT; /* TWL_RES=0x5, T1U_RES=0x1, TSL_RES=0x3 */
+#else
+	reg_value |= XGMAC_EEE_TX_TIMER_PHY_CONT; /* TWL_RES=0xe, T1U_RES=0x8, TSL_RES=0x1c */
+#endif
+	tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_EEE_TXTIMER, reg_value);
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_EEE_RXTIMER);
+	reg_value &= ~(XGMAC_EEE_RX_TIMER);
+#ifdef EEE_MAC_CONTROLLED_MODE
+	reg_value |= XGMAC_EEE_RX_TIMER_MAC_CONT; /* TWR_RES=0x6, RES_100U=0x42 */
+#else
+	reg_value |= XGMAC_EEE_RX_TIMER_PHY_CONT; /* TWR_RES=0x88, RES_100U=0x28 */
+#endif
+	tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_EEE_RXTIMER, reg_value);
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_EEE_MCTRL1);
+	reg_value |= XGMAC_TRN_LPI;
+	tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_EEE_MCTRL1, reg_value);
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_XS_PCS_EEE_MCTRL0);
+
+	reg_value &= ~XGMAC_TX_RX_QUIET_EN;
+	reg_value |= XGMAC_TX_RX_QUIET_EN; /* RX_QUIET_EN, TX_QUIET_EN, LRX_EN, LTX_EN */
+
+	tc956x_xpcs_write(xpcsaddr, XGMAC_VR_XS_PCS_EEE_MCTRL0, reg_value);
+#endif
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_MII_AN_CTRL);
+	reg_value &= XGMAC_TX_CFIG_INTR_EN_MASK;/*TX_CONFIG MAC SIDE*/
+	reg_value |= XGMAC_MII_AN_INTR_EN;/*MII_AN_INTR_EN enabe*/
+	tc956x_xpcs_write(xpcsaddr, XGMAC_VR_MII_AN_CTRL, reg_value);
+
+	reg_value = tc956x_xpcs_read(xpcsaddr, XGMAC_VR_MII_DIG_CTRL1);
+	reg_value &= ~XGMAC_MAC_AUTO_SW_EN;/*MAC_AUTO_SW enable*/
+	if (priv->is_sgmii_2p5g != true)
+		/* Enable only if SGMII 2.5G is not enabled. */
+		reg_value |= XGMAC_MAC_AUTO_SW_EN;
+	tc956x_xpcs_write(xpcsaddr, XGMAC_VR_MII_DIG_CTRL1, reg_value);
+
+	return 0;
+}
+
+void tc956x_xpcs_ctrl_ane(struct tc956xmac_priv *priv, bool ane)
+{
+	u32 reg_value;
+
+	reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_MII_CTRL);
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	if (priv->wol_config_enabled != true) {
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+		if (ane) {
+			reg_value |= XGMAC_AN_37_ENABLE;
+			KPRINT_INFO("%s Enable AN", __func__);
+		} else {
+			reg_value &= (~XGMAC_AN_37_ENABLE);
+			KPRINT_INFO("%s Disable AN", __func__);
+			}
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	} else {
+		/* Configure SGMII 1Gbps when WOL flag is enabled and native interface is other than SGMII. */
+		KPRINT_INFO("%s Port %d %s: Entered with flag priv->wol_config_enabled %d", __func__, priv->port_num, priv->dev->name, priv->wol_config_enabled);
+		reg_value |= XGMAC_AN_37_ENABLE;
+		KPRINT_INFO("%s Enable AN", __func__);
+	}
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+	tc956x_xpcs_write(priv->xpcsaddr, XGMAC_SR_MII_CTRL, reg_value);
+}
+
+/**
+ *  tc956x_xpcs_ctrl0_lrx - to configure XPCS LPI Rx Enable bit
+ *  @priv: driver private structure
+ *  @lrx : true to enable, false to disable
+ *  @remarks : -
+ */
+void tc956x_xpcs_ctrl0_lrx(struct tc956xmac_priv *priv, bool lrx)
+{
+	u32 reg_value;
+
+	reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_XS_PCS_EEE_MCTRL0);
+	if (lrx) {
+		reg_value |= XGMAC_EEE_LRX_EN;
+		KPRINT_INFO("%s Enable XPCS LPI Rx\n", __func__);
+	} else {
+		reg_value &= (~XGMAC_EEE_LRX_EN);
+		KPRINT_INFO("%s Disable XPCS LPI Rx\n", __func__);
+	}
+
+	tc956x_xpcs_write(priv->xpcsaddr, XGMAC_VR_XS_PCS_EEE_MCTRL0, reg_value);
+}
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956x_xpcs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956x_xpcs.h
@@ -0,0 +1,131 @@
+/*
+ * TC956x XPCS Header
+ *
+ * tc956x_xpcs.h
+ *
+ * Copyright (C) 2022 Toshiba Electronic Devices & Storage Corporation
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  05 Nov 2020 : Initial version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  26 Oct 2021 : 1. Added EEE macros for PHY and MAC Controlled Mode.
+ *  VERSION     : 01-00-19
+ *  25 Feb 2022 : 1. Helper function added for XPCS Rx LPI enable/disable
+ *  VERSION     : 01-00-44
+ */
+
+#ifndef __TC956X_XPCS_H__
+#define __TC956X_XPCS_H__
+#include "common.h"
+
+#ifdef TC956X
+#define XPCS_XGMAC_OFFSET	0x3A00
+#endif
+
+/*XPCS registers*/
+#define XGMAC_SR_MII_CTRL				0x7C0000
+#define XGMAC_VR_MII_AN_CTRL			0x7e0004
+#define XGMAC_VR_MII_DIG_CTRL1			0x7e0000
+#define XGMAC_SR_XS_PCS_CTRL1			0xC0000
+#define XGMAC_SR_XS_PCS_STS1			0xC0004
+#define XGMAC_SR_XS_PCS_CTRL2			0xC001C
+#define XGMAC_SR_XS_PCS_EEE_ABL			0xC0050
+#define XGMAC_SR_XS_PCS_STS2			0xC0020
+#define XGMAC_VR_XS_PCS_DIG_CTRL1		0xe0000
+#define XGMAC_VR_XS_PCS_EEE_MCTRL0		0xe0018
+#define XGMAC_VR_XS_PCS_EEE_MCTRL1		0xe002c
+#define XGMAC_VR_XS_PCS_KR_CTRL			0xe001c
+#define XGMAC_VR_XS_PCS_EEE_TXTIMER		0xe0020
+#define XGMAC_VR_XS_PCS_EEE_RXTIMER		0xe0024
+#define XGMAC_VR_XS_PCS_DIG_STS			0xe0040
+#define XGMAC_VR_MII_AN_INTR_STS		0x7e0008
+#define XGMAC_SR_XS_PCS_STS2			0xC0020
+
+#define XGMAC_LTX_LRX_STATE			0xFC00
+#define XGMAC_LPI_RECEIVE_STATE			0x1C00
+#define XGMAC_LPI_TRANSMIT_STATE		0xE000
+#define XGMAC_RX_LPI_RECEIVE			0x400
+#define XGAMC_TX_LPI_RECEIVE			0x800
+#define XGMAC_LPI_ENABLE			0x0800
+#define XGMAC_PSEQ_STATE			0x001C
+#define XGMAC_KXEEE				0x0010
+#define XGMAC_MULT_FACT_100NS			0x0F00
+#define XGMAC_SIGN_BIT				0x40
+#define XGMAC_TX_RX_EN				0x90
+#define XGMAC_EEE_RX_TIMER			0x3FFF
+#define XGMAC_EEE_TX_TIMER			0x1FFF
+#define XGMAC_TX_RX_QUIET_EN			0x000F
+#define XGMAC_MULT_FACT_100NS_MAC		0xB00
+#define XGMAC_MULT_FACT_100NS_PHY		0xA00
+#define XGMAC_EEE_TX_TIMER_MAC_CONT		0x0543
+#define XGMAC_EEE_TX_TIMER_PHY_CONT		0x0E9C
+#define XGMAC_EEE_RX_TIMER_MAC_CONT		0x062A
+#define XGMAC_EEE_RX_TIMER_PHY_CONT		0x2888
+#define XGMAC_TRN_LPI				0x1
+
+/*XPCS Register value*/
+#define XGMAC_PCS_MODE_MASK				0xFFFFFFF9
+#define XGMAC_SGMII_MODE				0x00000004
+#define XGMAC_TX_CFIG_INTR_EN_MASK		0xFFFFFFF6/*Mask TX_CONFIG & MII_AN_INTR_EN*/
+#define XGMAC_MII_AN_INTR_EN			0x00000001/*MII_AN_INTR_EN*/
+#define XGMAC_MAC_AUTO_SW_EN			0x00000200/*MAC_AUTO_SW*/
+#define XGMAC_AN_37_ENABLE				0x00001000/*AN_EN*/
+#define XGMAC_PCS_TYPE_SEL				0xFFFFFFF0/*PCS_TYPE_SEL: 0x0000*/
+#define XGMAC_USXG_EN					0x00000200/*USXG_EN enable*/
+#define XGMAC_USXG_MODE					0x00001c00/*USXG_MODE: 0x000*/
+#define XGMAC_VR_RST					0x00008000/*set VR_RST*/
+#define XGMAC_USXG_AN_STS_SPEED_MASK	0x00001c00/*USXGMII autonegotiated speed*/
+#define XGMAC_USXG_AN_STS_DUPLEX_MASK	0x00002000/*USXGMII autonegtiated duplex*/
+#define XGMAC_USXG_AN_STS_LINK_MASK		0x00004000/*USXGMII link status*/
+#define XGMAC_SGM_STS_LINK_MASK			0x00000010/*SGMII link status*/
+#define XGMAC_SGM_STS_DUPLEX			0x00000002/*SGMII autonegotiated duplex*/
+#define XGMAC_SGM_STS_SPEED_MASK		0x0000000c/*SGMII autonegotiated speed*/
+#define XGMAC_SOFT_RST					0x00008000/*SOFT RST*/
+#define XGMAC_C37_AN_COMPL				0x00000001/*C37 Autoneg complete*/
+#define XGMAC_SR_MII_CTRL_SPEED			0x00002060/* SR_MII_CTRL Reg SPEED SS13, SS6, SS5 */
+#define XGMAC_SR_MII_CTRL_SPEED_10G		0x00002040/* SR_MII_CTRL SPEED: 10G */
+#define XGMAC_SR_MII_CTRL_SPEED_5G		0x00002020/* SR_MII_CTRL SPEED: 5G */
+#define XGMAC_SR_MII_CTRL_SPEED_2_5G	0x00000020/* SR_MII_CTRL SPEED: 5G */
+#define XGMAC_USRA_RST					0x400/* USRA_RST */
+#define XGMAC_EEE_LRX_EN			BIT(1)		/* LPI Rx Enable */
+
+
+
+#define XPCS_REG_BASE_ADDR				10
+#define XPCS_REG_OFFSET					0x0003FF
+#define XPCS_IND_ACCESS					0x3FC
+#define XPCS_SS_SGMII_1G				0x40
+#define XPCS_SS_SGMII_100M				0x2000
+#define XPCS_SS_SGMII_10M				0x0
+
+u32 tc956x_xpcs_read(void __iomem *xpcsaddr, u32 pcs_reg_num);
+u32 tc956x_xpcs_write(void __iomem *xpcsaddr, u32 pcs_reg_num, u32 value);
+void tc956x_xpcs_ctrl_ane(struct tc956xmac_priv *priv, bool ane);
+int tc956x_xpcs_init(struct tc956xmac_priv *priv, void __iomem *xpcsaddr);
+void tc956x_xpcs_ctrl0_lrx(struct tc956xmac_priv *priv, bool lrx);
+#endif /* __TC956X_XPCS_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac.h
@@ -0,0 +1,1321 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac.h
+ *
+ * Copyright (C) 2007-2009  STMicroelectronics Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  20 Jul 2021 : 1. Version update
+ *                2. Default Port1 interface selected as SGMII
+ *  VERSION     : 01-00-03
+ *  22 Jul 2021 : 1. Version update
+ *                2. USXGMII/XFI/SGMII/RGMII interface supported with module parameters
+ *  VERSION     : 01-00-04
+ *  22 Jul 2021 : 1. Dynamic CM3 TAMAP configuration
+ *  VERSION     : 01-00-05
+ *  23 Jul 2021 : 1. Add support for contiguous allocation of memory
+ *  VERSION     : 01-00-06
+ *  29 Jul 2021 : 1. Add support to set MAC Address register
+ *  VERSION     : 01-00-07
+ *  05 Aug 2021 : 1. Store and use Port0 pci_dev for all DMA allocation/mapping for IPA path
+ *              : 2. Register Port0 as only PCIe device, incase its PHY is not found
+ *  VERSION     : 01-00-08
+ *  16 Aug 2021 : 1. PHY interrupt mode supported through .config_intr and .ack_interrupt API
+ *  VERSION     : 01-00-09
+ *  24 Aug 2021 : 1. Disable TC956X_PCIE_GEN3_SETTING and TC956X_LOAD_FW_HEADER macros and provide support via Makefile
+ *              : 2. Platform API supported
+ *  VERSION     : 01-00-10
+ *  02 Sep 2021 : 1. Configuration of Link state L0 and L1 transaction delay for PCIe switch ports & Endpoint.
+ *  VERSION     : 01-00-11
+ *  09 Sep 2021 : Reverted changes related to usage of Port-0 pci_dev for all DMA allocation/mapping for IPA path
+ *  VERSION     : 01-00-12
+ *  14 Sep 2021 : 1. Version update
+ *  VERSION     : 01-00-13
+ *  23 Sep 2021 : 1. Version update
+ *  VERSION     : 01-00-14
+ *  29 Sep 2021 : 1. Version update
+ *  VERSION     : 01-00-15
+ *  14 Oct 2021 : 1. Version update
+ *  VERSION     : 01-00-16
+ *  19 Oct 2021 : 1. Adding M3 SRAM Debug counters to ethtool statistics
+ *                2. Adding MTL RX Overflow/packet miss count, TX underflow counts,Rx Watchdog value to ethtool statistics.
+ *                3. Version update
+ *  VERSION     : 01-00-17
+ *  21 Oct 2021 : 1. Added support for GPIO configuration API
+ *              : 2. Version update
+ *  VERSION     : 01-00-18
+ *  26 Oct 2021 : 1. Updated Driver Module Version.
+ *                2. Added variable for port-wise suspend status.
+ *                3. Added macro to control EEE MAC Control.
+ *  VERSION     : 01-00-19
+ *  04 Nov 2021 : 1. Version update
+ *  VERSION     : 01-00-20
+ *  08 Nov 2021 : 1. Version update
+ *  VERSION     : 01-00-21
+ *  24 Nov 2021 : 1. Version update
+ *                2. Private member used instead of global for wol interrupt indication
+ *  VERSION     : 01-00-22
+ *  24 Nov 2021 : 1. Version update
+ *  VERSION     : 01-00-23
+ *  24 Nov 2021 : 1. EEE macro enabled by default.
+ *                2. Module param support for EEE configuration
+ *                3. Version update
+ *  VERSION     : 01-00-24
+ *  30 Nov 2021 : 1. Version update
+ *  VERSION     : 01-00-25
+ *  30 Nov 2021 : 1. Version update
+ *  VERSION     : 01-00-26
+ *  01 Dec 2021 : 1. Version update
+ *  VERSION     : 01-00-27
+ *  01 Dec 2021 : 1. Version update
+ *  VERSION     : 01-00-28
+ *  03 Dec 2021 : 1. Version update
+ *  VERSION     : 01-00-29
+ *  08 Dec 2021 : 1. Version update
+ *  VERSION     : 01-00-30
+ *  10 Dec 2021 : 1. Version update
+ *  VERSION     : 01-00-31
+ *  27 Dec 2021 : 1. Support for eMAC Reset and unused clock disable during Suspend and restoring it back during resume.
+ *                2. Version update.
+ *  VERSION     : 01-00-32
+ *  06 Jan 2022 : 1. Version update
+ *  VERSION     : 01-00-33
+ *  07 Jan 2022 : 1. Version update
+ *  VERSION     : 01-00-34
+ *  11 Jan 2022 : 1. Version update
+ *  VERSION     : 01-00-35
+ *  18 Jan 2022 : 1. IRQ device name change
+ *                2. Version update
+ *  VERSION     : 01-00-36
+ *  20 Jan 2022 : 1. Version update
+ *  VERSION     : 01-00-37
+ *  24 Jan 2022 : 1. Version update
+ *  VERSION     : 01-00-38
+ *  31 Jan 2022 : 1. Debug dump API and structures added to dump registers during crash.
+ *                2. Version update.
+ *  VERSION     : 01-00-39
+ *  02 Feb 2022 : 1. Version update
+ *  VERSION     : 01-00-40
+ *  04 Feb 2022 : 1. Version update
+ *  VERSION     : 01-00-41
+ *  14 Feb 2022 : 1. Reset assert and clock disable support during Link Down.
+ *                2. Version update.
+ *  VERSION     : 01-00-42
+ *  22 Feb 2022 : 1. Supported GPIO configuration save and restoration
+ *                2. Version update.
+ *  VERSION     : 01-00-43
+ *  25 Feb 2022 : 1. Version update.
+ *  VERSION     : 01-00-44
+ *  09 Mar 2022 : 1. Version update
+ *  VERSION     : 01-00-45
+ *  22 Mar 2022 : 1. Version update
+ *  VERSION     : 01-00-46
+ *  05 Apr 2022 : 1. Version update
+ *  VERSION     : 01-00-47
+ *  06 Apr 2022 : 1. Version update
+ *  VERSION     : 01-00-48
+ *  14 Apr 2022 : 1. Version update
+ *  VERSION     : 01-00-49
+ *  25 Apr 2022 : 1. Version update
+ *  VERSION     : 01-00-50
+ *  29 Apr 2022 : 1. Added variable for tracking port release status and Lock for syncing linkdown, port rlease and release of offloaded DMA channels
+ *                2. Version update.
+ *  VERSION     : 01-00-51
+ *  15 Jun 2022 : 1. Added debugfs support for module specific register dump
+ *                2. Version update.
+ *  VERSION     : 01-00-52
+ *  08 Aug 2022 : 1. Version update
+ *  VERSION     : 01-00-53
+ *  31 Aug 2022 : 1. Added Fix for configuring Rx Parser when EEE is enabled and RGMII Interface is used
+ *                2. Version update.
+ *  VERSION     : 01-00-54
+ *  02 Sep 2022 : 1. 2500Base-X support for line speeds 2.5Gbps, 1Gbps, 100Mbps.
+ *                2. Version update
+ *  VERSION     : 01-00-55
+ *  21 Oct 2022 : 1. Version update
+ *  VERSION     : 01-00-56
+ *  09 Nov 2022 : 1. Version update
+ *  VERSION     : 01-00-57
+ *  22 Dec 2022 : 1. Support for SW reset during link down.
+ *                2. Version update
+ *  VERSION     : 01-00-58
+ *  09 May 2023 : 1. Version update
+ *  VERSION     : 01-00-59
+ *  10 Nov 2023 : 1. DSP Cascade related modifications
+ *                2. Kernel 6.1 Porting changes
+ *                3. Version update
+ *  VERSION     : 01-02-59
+ *
+ *  26 Dec 2023 : 1. Kernel 6.6 Porting changes
+ *                2. Added the support for TC commands taprio and flower
+ *                3. Version update
+ *  VERSION     : 01-03-59
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *                3. Added support for board device RBTC9563_3MA
+ *  VERSION     : 04-00
+ */
+
+#ifndef __TC956XMAC_H__
+#define __TC956XMAC_H__
+
+
+#include <linux/clk.h>
+#include <linux/if_vlan.h>
+#include "tc956xmac_inc.h"
+#ifndef TC956X_SRIOV_VF
+#include <linux/phylink.h>
+#endif
+#include <linux/pci.h>
+#include "common.h"
+#include <linux/ptp_clock_kernel.h>
+#include <linux/net_tstamp.h>
+#include <linux/reset.h>
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6,6,0)
+#include <net/page_pool.h>
+#else
+#include <net/page_pool/helpers.h>
+#endif
+#ifdef TC956X_SRIOV_PF
+#include "tc956x_pf_rsc_mng.h"
+#endif
+#ifndef TC956X_SRIOV_VF
+//#define TC956X_LOAD_FW_HEADER
+#endif
+#define PF_DRIVER 4
+
+/* Uncomment EEE_MAC_CONTROLLED_MODE macro for MAC controlled EEE Mode & comment for PHY controlled EEE mode */
+#define EEE_MAC_CONTROLLED_MODE
+/* Uncomment TC956X_5_G_2_5_G_EEE_SUPPORT macro for enabling EEE support for 5G and 2.5G */
+#define TC956X_5_G_2_5_G_EEE_SUPPORT
+// #define CONFIG_TC956XMAC_SELFTESTS  /*Enable this macro to test Feature selftest*/
+
+/* TC956X_Host_Driver-industrial_limited_tested_20241030_V_04-00-01-QPSSW-215.patch */
+/* Enable this macro when using TSB provided sample AQR driver which supports preamble suppression */
+// #define TC956X_SAMP_PHY_AQR_DRV_PSE_ENABLED
+
+#ifdef TC956X
+#define VENDOR_ID 0x1179
+#ifndef TC956X_SRIOV_VF
+#define DEVICE_ID 0x0220	/* PF - 0x0220, VF - 0x0221 */
+#elif (defined TC956X_SRIOV_VF)
+#define DEVICE_ID 0x0221	/* PF - 0x0220, VF - 0x0221 */
+#endif
+#endif
+
+#define SUB_SYS_VENDOR_ID 0x1179
+#define SUB_SYS_DEVICE_ID 0x0001
+
+#define PCI_ETHC_CLASS_CODE	0x020000
+#define PCI_ETHC_CLASS_MASK	0xFFFFFF
+
+#define MOD_PARAM_ACCESS 0444
+
+#define TC956X_PCI_DMA_WIDTH 64
+
+#define TC956X_TX_QUEUES 8
+#define TC956X_RX_QUEUES 8
+
+#ifndef FIRMWARE_NAME
+#define FIRMWARE_NAME "TC956X_Firmware_PCIeBridge.bin"
+#endif
+
+#define TC956X_TOTAL_VFS 3
+
+#ifdef TC956X
+#ifndef TC956X_SRIOV_VF
+
+#define TC956X_RESOURCE_NAME	"tc956x_pci-eth"
+#define IRQ_DEV_NAME(x)		(((x) == RM_PF0_ID) ? ("eth0") : ("eth1"))
+#define WOL_IRQ_DEV_NAME(x)	(((x) == RM_PF0_ID) ? ("eth0_wol") : ("eth1_wol"))
+
+#define DRV_MODULE_VERSION	"V_04-00-00"
+#define TC956X_FW_MAX_SIZE	(64*1024)
+#elif (defined TC956X_SRIOV_VF)
+#define TC956X_RESOURCE_NAME	"tc956x_vf_pci-eth"
+#define DRV_MODULE_VERSION	"V_01-01-59"
+#endif
+#define ATR_AXI4_SLV_BASE		0x0800
+#define ATR_AXI4_SLAVE_OFFSET		0x0100
+#define ATR_AXI4_TABLE_OFFSET		0x20
+#define TC956X_AXI4_SLV(ch, tid)	(ATR_AXI4_SLV_BASE +\
+					(ch * ATR_AXI4_SLAVE_OFFSET) +\
+					(tid * ATR_AXI4_TABLE_OFFSET))
+
+#define SRC_ADDR_LO_OFFSET		0x00
+#define SRC_ADDR_HI_OFFSET		0x04
+#define TRSL_ADDR_LO_OFFSET		0x08
+#define TRSL_ADDR_HI_OFFSET		0x0C
+#define TRSL_PARAM_OFFSET		0x10
+#define TRSL_MASK_OFFSET1		0x18
+#define TRSL_MASK_OFFSET2		0x1C
+#define TC956X_AXI4_SLV_SRC_ADDR_LO(ch, tid)	(TC956X_AXI4_SLV(ch, tid) +\
+							SRC_ADDR_LO_OFFSET)
+#define TC956X_AXI4_SLV_SRC_ADDR_HI(ch, tid)	(TC956X_AXI4_SLV(ch, tid) +\
+							SRC_ADDR_HI_OFFSET)
+#define TC956X_AXI4_SLV_TRSL_ADDR_LO(ch, tid)	(TC956X_AXI4_SLV(ch, tid) +\
+							TRSL_ADDR_LO_OFFSET)
+#define TC956X_AXI4_SLV_TRSL_ADDR_HI(ch, tid)	(TC956X_AXI4_SLV(ch, tid) +\
+							TRSL_ADDR_HI_OFFSET)
+#define TC956X_AXI4_SLV_TRSL_PARAM(ch, tid)	(TC956X_AXI4_SLV(ch, tid) +\
+							TRSL_PARAM_OFFSET)
+#define TC956X_AXI4_SLV_TRSL_MASK1(ch, tid)	(TC956X_AXI4_SLV(ch, tid) +\
+							TRSL_MASK_OFFSET1)
+#define TC956X_AXI4_SLV_TRSL_MASK2(ch, tid)	(TC956X_AXI4_SLV(ch, tid) +\
+							TRSL_MASK_OFFSET2)
+
+#define TC956X_ATR_IMPL 1U
+#define TC956X_ATR_SIZE(size) ((size - 1U) << 1U)
+#define TC956X_ATR_SIZE_MASK		GENMASK(6, 1)
+#define TC956x_ATR_SIZE_SHIFT		1
+#define TC956X_SRC_LO_MASK		GENMASK(31, 12)
+#define TC956X_SRC_LO_SHIFT		12
+
+#define TC956X_AXI4_SLV00_ATR_SIZE 36U
+#define TC956X_AXI4_SLV00_SRC_ADDR_LO_VAL  (0x00000000U)
+#define TC956X_AXI4_SLV00_SRC_ADDR_HI_VAL  (0x00000010U)
+#define TC956X_AXI4_SLV00_TRSL_ADDR_LO_VAL (0x00000000U)
+#define TC956X_AXI4_SLV00_TRSL_ADDR_HI_VAL (0x00000000U)
+#define TC956X_AXI4_SLV00_TRSL_PARAM_VAL   (0x00000000U)
+#define TC956X_AXI4_SLV00_SRC_ADDR_LO_VAL_DEFAULT  (0x0000007FU)
+
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+#define TC956X_AXI4_SLV01_ATR_SIZE	   28U	  /* 28 bit DMA Mask */
+#define TC956X_AXI4_SLV01_SRC_ADDR_LO_VAL  (0x60000000U)
+#define TC956X_AXI4_SLV01_SRC_ADDR_HI_VAL  (0x00000000U)
+#define TC956X_AXI4_SLV01_TRSL_ADDR_LO_VAL (0x00000000U)
+#define TC956X_AXI4_SLV01_TRSL_ADDR_HI_VAL (0x00000000U)
+#define TC956X_AXI4_SLV01_TRSL_PARAM_VAL   (0x00000000U)
+#endif
+
+#define TC956X_M3_SRAM_FW_VER_OFFSET 0x4F900 /* DMEM addrs 0x2000F900 */
+/* M3 Debug Counters in SRAM*/
+#define TC956X_M3_SRAM_DEBUG_CNTS_OFFSET	0x4F800 /* DMEM addrs 0x2000F800 */
+
+#define DB_CNT_LEN	4	/* Size of each debug counter in bytes */
+#define DB_CNT0		0	/* reserved0 */
+#define DB_CNT1		1	/* reserved1 */
+#define DB_CNT2		2	/* reserved2 */
+#define DB_CNT3		3	/* reserved3 */
+#define DB_CNT4		4	/* reserved4 */
+#define DB_CNT5		5	/* reserved5 */
+#define DB_CNT6		6	/* reserved6 */
+#define DB_CNT7		7	/* reserved7 */
+#define DB_CNT8		8	/* reserved8 */
+#define DB_CNT9		9	/* reserved9 */
+#define DB_CNT10	10	/* reserved10 */
+#define DB_CNT11	11	/* m3 watchdog expiry count*/
+#define DB_CNT12	12	/* m3 watchdog monitor value */
+#define DB_CNT13	13	/* reserved13 */
+#define DB_CNT14	14	/* reserved14 */
+#define DB_CNT15	15	/* m3 systick counter lower 32bits  */
+#define DB_CNT16	16	/* m3 systick counter upper 32bits */
+#define DB_CNT17	17	/* m3 transmission timeout indication for port0 */
+#define DB_CNT18	18	/* m3 transmission timeout indication for port1 */
+#define DB_CNT19	19	/* reserved19 */
+
+#define SIXTEEN						16
+#define TWENTY						20
+#define TWENTY_FOUR					24
+#define SIXTY_FOUR					64
+#define ONE_TWENTY_EIGHT			128
+#define TWO_FIFTY_SIX				256
+#define FIVE_HUNDRED_TWELVE			512
+#define THOUSAND_TWENTY_FOUR		1024
+
+#define SPD_DIV_10G					10000000
+#define SPD_DIV_5G					5000000
+#define SPD_DIV_2_5G				2500000
+#define SPD_DIV_1G					1000000
+#define SPD_DIV_100M				100000
+
+#define NRSTCTRL0_RST_ASRT 0x1
+#define NRSTCTRL0_RST_DE_ASRT 0x3
+
+#define TC956X_OFFSET_TAMAP 0x00000010
+#define TC956X_MASK_TAMAP 0xFFFFF000
+#define TC956X_SHIFT_TAMAP 32
+#define TC956X_OFFSET_OW 28
+#define TC956X_OFFSET_OW_MAX 53
+#define TC956X_HEX_ZERO 0x00000000
+
+#define TC956X_BAR0 0
+#define TC956X_BAR2 2
+#define TC956X_BAR4 4
+
+#define NMODESTS 0x0004
+#define NMODESTS_MODE 0x200
+#define NMODESTS_MODE2		0x400
+#define NMODESTS_MODE2_SHIFT	10
+#define TC956X_PCIE_SETTING_A	0 /* x4x1x1 mode */
+#define TC956X_PCIE_SETTING_B	1 /* x2x2x1 mode */
+
+#define TC9563_CFG_NEMACTXCDLY		0x1050U
+#define TC9563_CFG_NEMACIOCTL		0x107CU
+
+#define NEMACTXCDLY_DEFAULT		0x00000000U
+#define NEMACIOCTL_DEFAULT		0xF300F300
+/* Systick count SRAM  address  DMEM addrs 0x2000F83C, Check this value for any change */
+#define SYSTCIK_SRAM_OFFSET		0x4F83C
+
+/* Tx Timer count SRAM  address  DMEM addrs 0x2000F844, Check this value for any change */
+#define TX_TIMER_SRAM_OFFSET_0		0x4F844
+
+/* Tx Timer count SRAM  address  DMEM addrs 0x2000F848, Check this value for any change */
+#define TX_TIMER_SRAM_OFFSET_1		0x4F848
+
+#define TX_TIMER_SRAM_OFFSET(t) (((t) == RM_PF0_ID) ? (TX_TIMER_SRAM_OFFSET_0) : (TX_TIMER_SRAM_OFFSET_1))
+
+#define TC956X_M3_SRAM_EEPROM_MAC_ADDR		0x47000		/* DMEM addrs 0x20007000U */
+#define TC956X_M3_SRAM_EEPROM_OFFSET_ADDR	0x47050		/* DMEM addrs 0x20007050U */
+#define TC956X_M3_SRAM_EEPROM_MAC_COUNT		0x47051		/* DMEM addrs 0x20007051U */
+#define TC956X_M3_INIT_DONE					0x47054		/* DMEM addrs 0x20007054U */
+#define TC956X_M3_FW_EXIT					0x47058		/* DMEM addrs 0x20007058U */
+
+#define TC956X_M3_DBG_VER_START			0x4F900
+
+#define ENABLE_USXGMII_INTERFACE	0
+#define ENABLE_XFI_INTERFACE		1 /* XFI/SFI, this is same as USXGMII, except XPCS autoneg disabled */
+#define ENABLE_RGMII_INTERFACE		2
+#define ENABLE_SGMII_INTERFACE		3
+#define ENABLE_2500BASE_X_INTERFACE	4
+#define ENABLE_RGMII_ID_INTERFACE	5
+#define MTL_FPE_AFSZ_64		0
+#define MTL_FPE_AFSZ_128	1
+#define MTL_FPE_AFSZ_192	2
+#define MTL_FPE_AFSZ_256	3
+#ifdef TC956X_SRIOV_PF
+#define TC956X_DISABLE_CHNL 0
+#define TC956X_ENABLE_CHNL 1
+
+#define TC956X_DISABLE_QUEUE 0
+#define TC956X_ENABLE_QUEUE 1
+#endif
+
+#define MMC_XGMAC_TX_FPE_FRAG			0x208
+#define MMC_XGMAC_RX_PKT_ASSEMBLY_OK	0x230
+#define MMC_XGMAC_RX_FPE_FRAG			0x234
+
+#endif
+
+#define MAX_CM3_TAMAP_ENTRIES		3
+#define CM3_TAMAP_ATR_SIZE		28 /* ATR Size = 2 ^ (28 + 1) = 512MB */
+#define CM3_TAMAP_SIZE			(1 << (CM3_TAMAP_ATR_SIZE + 1))
+#define CM3_TAMAP_MASK			(CM3_TAMAP_SIZE - 1)
+#define CM3_TAMAP_SRC_ADDR_START	0x60000000
+
+#define	TC956XMAC_ALIGN(x)		ALIGN(ALIGN(x, SMP_CACHE_BYTES), 16)
+
+#define TC956X_MAX_LINK_DELAY		800
+
+#define XDP_PACKET_HEADROOM 256
+#define TC956X_MAX_RX_BUF_SIZE(num)	(((num) * PAGE_SIZE) - XDP_PACKET_HEADROOM)
+
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+struct tc956xmac_cm3_tamap {
+	u32 trsl_addr_hi;
+	u32 trsl_addr_low;
+	u32 src_addr_hi;
+	u32 src_addr_low;	/* Only [31:12] bits will be considered */
+	u32 atr_size;
+	bool valid;
+};
+#endif
+
+struct tc956xmac_resources {
+
+	void __iomem *addr;
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_PCI_IOV
+	u32 sriov_enabled;
+#endif
+#endif
+	void __iomem *tc956x_BRIDGE_CFG_pci_base_addr;
+	void __iomem *tc956x_SRAM_pci_base_addr;
+	void __iomem *tc956x_SFR_pci_base_addr;
+
+	const char *mac;
+	int wol_irq;
+	int lpi_irq;
+	int irq;
+#ifdef TC956X
+	unsigned int port_num;
+	unsigned int port_interface; /* Kernel module parameter variable for interface */
+	unsigned int eee_enabled; /* Parameter to store kernel module parameter to enable/disable EEE */
+	unsigned int tx_lpi_timer; /* Parameter to store kernel module parameter for LPI Auto Entry Timer */
+#endif
+	uint16_t pci_bd; /* PCI bus and device ID of self */
+
+	unsigned int mdc_clk;
+	unsigned int c45_state;
+	unsigned int link_down_macrst;
+};
+
+struct tc956xmac_tx_info {
+	dma_addr_t buf;
+	bool map_as_page;
+	unsigned int len;
+	bool last_segment;
+	bool is_jumbo;
+};
+
+#define TC956XMAC_TBS_AVAIL	BIT(0)
+#define TC956XMAC_TBS_EN		BIT(1)
+
+
+/* Frequently used values are kept adjacent for cache effect */
+struct tc956xmac_tx_queue {
+	u32 tx_count_frames;
+	int tbs;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,11,0)
+	struct hrtimer txtimer;
+#else
+	struct timer_list txtimer;
+#endif
+	u32 queue_index;
+	struct tc956xmac_priv *priv_data;
+	struct dma_extended_desc *dma_etx ____cacheline_aligned_in_smp;
+	struct dma_edesc *dma_entx;
+	struct dma_desc *dma_tx;
+	struct sk_buff **tx_skbuff;
+	struct tc956xmac_tx_info *tx_skbuff_dma;
+	unsigned int cur_tx;
+	unsigned int dirty_tx;
+	dma_addr_t dma_tx_phy;
+	u32 tx_tail_addr;
+	u32 mss;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	struct sk_buff **tx_offload_skbuff;
+	dma_addr_t *tx_offload_skbuff_dma;
+	dma_addr_t buff_tx_phy;
+	void *buffer_tx_va_addr;
+#endif
+};
+
+struct tc956xmac_rx_buffer {
+	struct page *page;
+	struct page *sec_page;
+	dma_addr_t addr;
+	dma_addr_t sec_addr;
+};
+
+struct tc956xmac_rx_queue {
+	u32 rx_count_frames;
+	u32 queue_index;
+	struct page_pool *page_pool;
+	struct tc956xmac_rx_buffer *buf_pool;
+	struct tc956xmac_priv *priv_data;
+	struct dma_extended_desc *dma_erx;
+	struct dma_desc *dma_rx ____cacheline_aligned_in_smp;
+	unsigned int cur_rx;
+	unsigned int dirty_rx;
+	u32 rx_zeroc_thresh;
+	dma_addr_t dma_rx_phy;
+	u32 rx_tail_addr;
+	unsigned int state_saved;
+	struct {
+		struct sk_buff *skb;
+		unsigned int len;
+		unsigned int error;
+	} state;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	struct sk_buff **rx_offload_skbuff;
+	dma_addr_t *rx_offload_skbuff_dma;
+	dma_addr_t buff_rx_phy;
+	void *buffer_rx_va_addr;
+#endif
+};
+
+struct tc956xmac_channel {
+	struct napi_struct rx_napi ____cacheline_aligned_in_smp;
+	struct napi_struct tx_napi ____cacheline_aligned_in_smp;
+	struct tc956xmac_priv *priv_data;
+	spinlock_t lock;
+	u32 index;
+};
+
+struct tc956xmac_tc_entry {
+	bool in_use;
+	bool in_hw;
+	bool is_last;
+	bool is_frag;
+	void *frag_ptr;
+	unsigned int table_pos;
+	u32 handle;
+	u32 prio;
+	struct {
+		u32 match_data;
+		u32 match_en;
+		u8 af:1;
+		u8 rf:1;
+		u8 im:1;
+		u8 nc:1;
+		u8 res1:4;
+		u8 frame_offset:6;
+		u8 res2:2;
+		u8 ok_index;
+		u8 res3;
+		u16 dma_ch_no;
+		u16 res4;
+	} __packed val;
+};
+
+#ifdef TC956X
+#define TC956XMAC_PPS_MAX		3 /* Two are for output signal generation and one is internal use for eMAC */
+#else
+#define TC956XMAC_PPS_MAX		4
+#endif
+struct tc956xmac_pps_cfg {
+	bool available;
+	struct timespec64 start;
+	struct timespec64 period;
+};
+
+struct tc956xmac_rss {
+	int enable;
+	u8 key[TC956XMAC_RSS_HASH_KEY_SIZE];
+	u32 table[TC956XMAC_RSS_MAX_TABLE_SIZE];
+};
+
+#define TC956XMAC_FLOW_ACTION_DROP		BIT(0)
+struct tc956xmac_flow_entry {
+	unsigned long cookie;
+	unsigned long action;
+	u8 ip_proto;
+	int in_use;
+	int idx;
+	int is_l4;
+};
+
+struct tc956xmac_rfs_entry {
+	unsigned long cookie;
+	u16 etype;
+	int in_use;
+	int type;
+	int tc;
+};
+
+struct tc956x_cbs_params {
+	u32 send_slope;
+	u32 idle_slope;
+	u32 high_credit;
+	u32 low_credit;
+	u32 percentage;
+};
+
+struct tc956x_gpio_config {
+	u8 config; /* 1: configured, 0: not configured*/
+	u8 out_val; /* 0 or 1 */
+};
+
+struct drv_cap {
+	u8 csum_en;
+	u8 crc_en;
+	u8 tso_en;
+	u8 jumbo_en;
+};
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+struct sync_locks {
+	spinlock_t mac_filter;
+	spinlock_t vlan_filter;
+	spinlock_t est;
+	spinlock_t fpe;
+	spinlock_t frp;
+	spinlock_t cbs;
+};
+#endif
+
+#ifdef TC956X_SRIOV_PF
+struct work_queue_param {
+	struct ethtool_pauseparam pause;
+	struct ifreq rq;
+	u16 val_out[MAX_NO_OF_VFS];
+	u32 queue_no;
+	u8 fn_id;
+	u8 vf_no;
+};
+#endif
+
+/* Rx Frame Steering */
+enum tc956x_rfs_type {
+	TC956X_RFS_T_VLAN,
+	TC956X_RFS_T_LLDP,
+	TC956X_RFS_T_1588,
+	TC956X_RFS_T_MAX,
+};
+
+struct tc956xmac_priv {
+	/* Frequently used values are kept adjacent for cache effect */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,13,0)
+	u32 tx_coal_frames[MTL_MAX_TX_QUEUES];
+	u32 tx_coal_timer[MTL_MAX_TX_QUEUES];
+	u32 rx_coal_frames[MTL_MAX_TX_QUEUES];
+#else
+	u32 tx_coal_frames;
+	u32 tx_coal_timer;
+	u32 rx_coal_frames;
+#endif
+	int tx_coalesce;
+	int hwts_tx_en;
+	bool tx_path_in_lpi_mode;
+	bool tso;
+	int sph;
+	u32 sarc_type;
+
+	unsigned int dma_buf_sz;
+	unsigned int rx_copybreak;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,13,0)
+	u32 rx_riwt[MTL_MAX_RX_QUEUES];
+#else
+	u32 rx_riwt;
+#endif
+	int hwts_rx_en;
+
+	void __iomem *ioaddr;
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_PCI_IOV
+	s32 sriov_enabled;
+#endif
+#endif
+	void __iomem *tc956x_BRIDGE_CFG_pci_base_addr;
+	void __iomem *tc956x_SRAM_pci_base_addr;
+	void __iomem *tc956x_SFR_pci_base_addr;
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+	void __iomem *tc956x_SRAM_mailbox_base_addr;
+#endif
+#ifdef TC956X_SRIOV_PF
+	unsigned char clear_to_send[MAX_NO_OF_VFS];
+#endif
+	struct net_device *dev;
+	struct device *device;
+	struct mac_device_info *hw;
+	int (*hwif_quirks)(struct tc956xmac_priv *priv);
+	struct mutex lock;
+
+	/* RX Queue */
+	struct tc956xmac_rx_queue rx_queue[MTL_MAX_RX_QUEUES];
+
+	/* TX Queue */
+	struct tc956xmac_tx_queue tx_queue[MTL_MAX_TX_QUEUES];
+
+	/* Generic channel for NAPI */
+	struct tc956xmac_channel channel[TC956XMAC_CH_MAX];
+
+	unsigned int l2_filtering_mode; /* 0 - if perfect and 1 - if hash filtering */
+	unsigned int vlan_hash_filtering;
+	struct tc956x_mac_addr *mac_table;
+	struct tc956x_vlan_id *vlan_table;
+	u32 sa_vlan_ins_via_reg;
+	unsigned char ins_mac_addr[ETH_ALEN];
+
+	/* RX Parser */
+	bool rxp_enabled;
+
+	/* Phy Link State */
+	u32 link;
+	int speed;
+	u32 duplex;
+	bool oldlink;
+	int oldduplex;
+
+	unsigned int flow_ctrl;
+	unsigned int pause;
+	struct mii_bus *mii;
+	int mii_irq[PHY_MAX_ADDR];
+#ifndef TC956X_SRIOV_VF
+	struct phylink_config phylink_config;
+	struct phylink *phylink;
+#endif
+	struct tc956xmac_extra_stats xstats ____cacheline_aligned_in_smp;
+	struct tc956xmac_safety_stats sstats;
+	struct plat_tc956xmacenet_data *plat;
+	struct dma_features dma_cap;
+	struct tc956xmac_counters mmc;
+#ifdef TC956X_SRIOV_VF
+	struct tc956x_sw_counters sw_stats;
+#endif
+	int hw_cap_support;
+	int synopsys_id;
+	u32 msg_enable;
+	int wolopts;
+	int wol_irq;
+	int clk_csr;
+	int lpi_irq;
+	unsigned int eee_enabled;
+	int eee_active;
+	unsigned int tx_lpi_timer;
+	unsigned int mode;
+	unsigned int chain_mode;
+	int extend_desc;
+	struct hwtstamp_config tstamp_config;
+	struct ptp_clock *ptp_clock;
+	struct ptp_clock_info ptp_clock_ops;
+	unsigned int default_addend;
+	u32 sub_second_inc;
+	u32 systime_flags;
+	u32 adv_ts;
+	int use_riwt;
+	int irq_wake;
+	spinlock_t ptp_lock;
+	void __iomem *mmcaddr;
+	void __iomem *ptpaddr;
+#ifdef TC956X
+	void __iomem *xpcsaddr;
+	void __iomem *pmaaddr;
+#endif
+	unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
+
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+	struct dentry *dbgfs_dir;
+#endif
+	char int_name_wol[IFNAMSIZ + 9]; /*TC956X_Host_Driver-industrial_limited_tested_20241114_V_04-00-01-QPSSW-218.patch*/
+#endif /* TC956X_SRIOV_PF */
+
+	unsigned long state;
+	struct workqueue_struct *wq;
+	struct work_struct service_task;
+#ifdef TC956X_SRIOV_PF
+	struct workqueue_struct *mbx_wq;
+	struct work_struct service_mbx_task;
+	struct work_queue_param mbx_wq_param;
+#endif
+	spinlock_t wq_lock;
+#ifdef TC956X_SRIOV_VF
+	struct workqueue_struct *mbx_wq;
+	struct work_struct mbx_service_task;
+	unsigned char flag;
+#endif
+	/* CBS configurations */
+	struct tc956x_cbs_params cbs_speed100_cfg[8];
+	struct tc956x_cbs_params cbs_speed1000_cfg[8];
+	struct tc956x_cbs_params cbs_speed2500_cfg[8];
+	struct tc956x_cbs_params cbs_speed5000_cfg[8];
+	struct tc956x_cbs_params cbs_speed10000_cfg[8];
+	/* TC Handling */
+	unsigned int tc_entries_max;
+	unsigned int tc_off_max;
+	struct tc956xmac_tc_entry *tc_entries;
+	unsigned int flow_entries_max;
+	struct tc956xmac_flow_entry *flow_entries;
+
+	unsigned int rfs_entries_max[TC956X_RFS_T_MAX];
+	unsigned int rfs_entries_cnt[TC956X_RFS_T_MAX];
+	unsigned int rfs_entries_total;
+	struct tc956xmac_rfs_entry *rfs_entries;
+
+	/* Pulse Per Second output */
+	struct tc956xmac_pps_cfg pps[TC956XMAC_PPS_MAX];
+
+	/* Receive Side Scaling */
+	struct tc956xmac_rss rss;
+#ifdef TC956X_SRIOV_PF
+	u8 dma_vf_map[TC956XMAC_CH_MAX];
+	u8 pf_queue_dma_map[MTL_MAX_TX_QUEUES];
+	/* Features enabled in PF */
+	struct drv_cap pf_drv_cap;
+#endif
+	/* Function ID information */
+	struct fn_id fn_id_info;
+#ifdef TC956X_SRIOV_VF
+	/* Features enabled in PF */
+	struct drv_cap pf_drv_cap;
+#endif
+	/* Tx Checksum Insertion */
+	u32 csum_insertion;
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+	u32 rx_csum_state;
+#endif
+	/* CRC Tx Rx Configuraion */
+	u32 tx_crc_pad_state;
+	u32 rx_crc_pad_state;
+#ifdef TC956X_SRIOV_PF
+	u8 rsc_dma_ch_alloc[MAX_FUNCTIONS_PER_PF];
+#endif
+	/* eMAC port number */
+#ifdef TC956X
+	u32 port_num;
+	u32 mac_loopback_mode;
+	u32 phy_loopback_mode;
+	bool is_sgmii_2p5g; /* For 2.5G SGMI, XPCS doesn't support AN. This flag is to identify 2.5G Speed for SGMII interface. */
+	u32 port_interface; /* Kernel module parameter variable for interface */
+	bool tc956x_port_pm_suspend; /* Port Suspend Status; True : port suspended, False : port resume */
+	bool tc956xmac_pm_wol_interrupt; /* Port-wise flag for clearing interrupt after resume. */
+#endif
+
+	/* set to 1 when ptp offload is enabled, else 0. */
+	u32 ptp_offload;
+	/*
+	 *ptp offloading mode - ORDINARY_SLAVE, ORDINARY_MASTER,
+	 * TRANSPARENT_SLAVE, TRANSPARENT_MASTER, PTOP_TRANSPERENT.
+	 */
+	u32 ptp_offloading_mode;
+
+	/* set to 1 when onestep timestamp is enabled, else 0. */
+	u32 ost_en;
+
+	/* Private data store for platform layer */
+	void *plat_priv;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	void *client_priv;
+	struct tc956xmac_cm3_tamap cm3_tamap[MAX_CM3_TAMAP_ENTRIES];
+#endif
+	/* Work struct for handling phy interrupt */
+	struct work_struct emac_phy_work;
+	u32 pm_saved_emac_rst; /* Save and restore EMAC Resets during suspend-resume sequence */
+	u32 pm_saved_emac_clk; /* Save and restore EMAC Clocks during suspend-resume sequence */
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	bool wol_config_enabled; /* Flag to indicate SerDes configuration for SGMII, 1Gbps for WOL */
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+	u32 pm_saved_linkdown_rst; /* Save and restore Resets during link-down sequence */
+	u32 pm_saved_linkdown_clk; /* Save and restore Clocks during link-down sequence */
+	bool port_link_down; /* Flag to save per port link down state */
+	bool port_release; /* Flag to notify appropriate sequence of link down & up */
+	struct mutex port_ld_release_lock; /* Mutex lock to handle (set and clear) flag to notify
+						appropriate sequence of link down & up */
+
+#endif
+	struct tc956x_gpio_config saved_gpio_config[GPIO_12 + 1]; /* Only GPIO0- GPIO06, GPI010-GPIO12 are used */
+
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+	struct dentry *debugfs_dir; /* debugfs structure pointer for port specific */
+#endif
+#endif /* TC956X_SRIOV_PF */
+
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+	void *pbridge_buffaddr;
+	dma_addr_t pbridge_handle;
+	size_t pbridge_buffsize;
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	struct sync_locks spn_lock;
+#endif
+	unsigned long link_state;
+	bool link_down_rst; /* For light-weight release and open during link-down */
+	uint16_t pci_bd; /* PCI bus and device ID of self */
+};
+
+struct tc956x_version {
+	unsigned char rel_dbg; /* 'R' for release, 'D' for debug */
+	unsigned char major;
+	unsigned char minor;
+	unsigned char sub_minor;
+	unsigned char patch_rel_major;
+	unsigned char patch_rel_minor;
+};
+
+enum tc956xmac_state {
+	TC956XMAC_DOWN,
+	TC956XMAC_RESET_REQUESTED,
+	TC956XMAC_RESETING,
+	TC956XMAC_SERVICE_SCHED,
+};
+
+struct tc956x_regs_config {
+	u32 ncid;
+	u32 nclkctrl0;
+	u32 nrstctrl0;
+	u32 nclkctrl1;
+	u32 nrstctrl1;
+	u32 nemac0ctl;
+	u32 nemac1ctl;
+	u32 nemacsts;
+	u32 gpioi0;
+	u32 gpioi1;
+	u32 gpioe0;
+	u32 gpioe1;
+};
+
+struct tc956x_regs_pcie {
+	u32 rsc_mng_id;
+};
+
+struct tc956x_regs_msi {
+	u32 msi_out_en;
+	u32 msi_mask_set;
+	u32 msi_mask_clr;
+	u32 int_sts;
+	u32 int_raw_sts;
+	u32 msi_sts;
+	u32 cnt_int0;
+	u32 cnt_int1;
+	u32 cnt_int2;
+	u32 cnt_int3;
+	u32 cnt_int4;
+	u32 cnt_int11;
+	u32 cnt_int12;
+	u32 cnt_int20;
+	u32 cnt_int24;
+};
+
+struct tc956x_regs_intc {
+	u32 intmcumask0;
+	u32 intmcumask1;
+	u32 intmcumask2;
+};
+
+struct tc956x_regs_dma_ch {
+	u32 control;
+	u32 list_haddr;
+	u32 list_laddr;
+	u32 ring_len;
+	u32 curr_haddr;
+	u32 curr_laddr;
+	u32 tail_ptr;
+	u32 buf_haddr;
+	u32 buf_laddr;
+};
+
+struct tx956x_tx_desc_buf_addrs {
+	dma_addr_t desc_phy_addr;
+	struct dma_desc *desc_va_addr;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	dma_addr_t buff_phy_addr;
+	void *buff_va_addr;
+#endif
+	struct sk_buff **tx_skbuff;
+	struct tc956xmac_tx_info *tx_skbuff_dma;
+};
+
+struct tx956x_rx_desc_buf_addrs {
+	dma_addr_t desc_phy_addr;
+	struct dma_desc *desc_va_addr;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	dma_addr_t buff_phy_addr;
+	void *buff_va_addr;
+#endif
+	struct tc956xmac_rx_buffer *buf_pool;
+};
+
+struct tc956x_regs_dma {
+	u32 debug_sts0;
+	u32 ch_control[TC956XMAC_CH_MAX];
+	u32 interrupt_enable[TC956XMAC_CH_MAX];
+	u32 ch_status[TC956XMAC_CH_MAX];
+	u32 debug_status[TC956XMAC_CH_MAX];
+	u32 rxch_watchdog_timer[TC956XMAC_CH_MAX];
+	struct tc956x_regs_dma_ch tx_ch[TC956XMAC_CH_MAX];
+	struct tc956x_regs_dma_ch rx_ch[TC956XMAC_CH_MAX];
+	/* RX Channels */
+	struct tx956x_rx_desc_buf_addrs rx_queue[MTL_MAX_RX_QUEUES];
+	/* TX Channels */
+	struct tx956x_tx_desc_buf_addrs tx_queue[MTL_MAX_TX_QUEUES];
+};
+
+struct tc956x_regs_mac {
+	u32 mac_tx_config;
+	u32 mac_rx_config;
+	u32 mac_pkt_filter;
+	u32 mac_tx_rx_status;
+	u32 mac_debug;
+};
+
+struct tc956x_regs_mtl_tx {
+	u32 op_mode;
+	u32 underflow;
+	u32 debug;
+};
+
+struct tc956x_regs_mtl_rx {
+	u32 op_mode;
+	u32 miss_pkt_overflow;
+	u32 debug;
+	u32 flow_control;
+};
+
+struct tc956x_regs_mtl {
+	u32 op_mode;
+	u32 mtl_rxq_dma_map0;
+	u32 mtl_rxq_dma_map1;
+	struct tc956x_regs_mtl_tx tx_info[MTL_MAX_TX_QUEUES];
+	struct tc956x_regs_mtl_rx rx_info[MTL_MAX_RX_QUEUES];
+};
+
+struct tc956x_regs_m3 {
+	u32 sram_tx_pcie_addr[TC956XMAC_CH_MAX];
+	u32 sram_rx_pcie_addr[TC956XMAC_CH_MAX];
+
+	u32 m3_fw_init_done;
+	u32 m3_fw_exit;
+
+	u32 m3_debug_cnt0;
+	u32 m3_debug_cnt1;
+	u32 m3_debug_cnt2;
+	u32 m3_debug_cnt3;
+	u32 m3_debug_cnt4;
+	u32 m3_debug_cnt5;
+	u32 m3_debug_cnt6;
+	u32 m3_debug_cnt7;
+	u32 m3_debug_cnt8;
+	u32 m3_debug_cnt9;
+	u32 m3_debug_cnt10;
+	u32 m3_watchdog_exp_cnt;
+	u32 m3_watchdog_monitor_cnt;
+	u32 m3_debug_cnt13;
+	u32 m3_debug_cnt14;
+	u32 m3_systick_cnt_upper_value;
+	u32 m3_systick_cnt_lower_value;
+	u32 m3_tx_timeout_port0;
+	u32 m3_tx_timeout_port1;
+	u32 m3_debug_cnt19;
+};
+
+struct tc956x_tamap {
+	u32 trsl_addr_hi;
+	u32 trsl_addr_low;
+	u32 src_addr_hi;
+	u32 src_addr_low;	/* Only [31:12] bits will be considered */
+	u32 atr_size;
+	u32 atr_impl;
+};
+
+struct tx956x_driver_info {
+	u8 driver[32];
+	u8 version[32];
+	u8 fw_version[32];
+};
+
+struct tc956x_statistics {
+	u64 rx_buf_unav_irq[TC956XMAC_CH_MAX];
+	u64 tx_pkt_n[TC956XMAC_CH_MAX];
+	u64 tx_pkt_errors_n[TC956XMAC_CH_MAX];
+	u64 rx_pkt_n[TC956XMAC_CH_MAX];
+
+	u64 mmc_tx_broadcastframe_g;
+	u64 mmc_tx_multicastframe_g;
+	u64 mmc_tx_64_octets_gb;
+	u64 mmc_tx_framecount_gb;
+	u64 mmc_tx_65_to_127_octets_gb;
+	u64 mmc_tx_128_to_255_octets_gb;
+	u64 mmc_tx_256_to_511_octets_gb;
+	u64 mmc_tx_512_to_1023_octets_gb;
+	u64 mmc_tx_1024_to_max_octets_gb;
+	u64 mmc_tx_unicast_gb;
+	u64 mmc_tx_underflow_error;
+	u64 mmc_tx_framecount_g;
+	u64 mmc_tx_pause_frame;
+	u64 mmc_tx_vlan_frame_g;
+	u64 mmc_tx_lpi_us_cntr;
+	u64 mmc_tx_lpi_tran_cntr;
+
+	/* MMC RX counter registers */
+	u64 mmc_rx_framecount_gb;
+	u64 mmc_rx_broadcastframe_g;
+	u64 mmc_rx_multicastframe_g;
+	u64 mmc_rx_crc_error;
+	u64 mmc_rx_jabber_error;
+	u64 mmc_rx_undersize_g;
+	u64 mmc_rx_oversize_g;
+	u64 mmc_rx_64_octets_gb;
+	u64 mmc_rx_65_to_127_octets_gb;
+	u64 mmc_rx_128_to_255_octets_gb;
+	u64 mmc_rx_256_to_511_octets_gb;
+	u64 mmc_rx_512_to_1023_octets_gb;
+	u64 mmc_rx_1024_to_max_octets_gb;
+	u64 mmc_rx_unicast_g;
+	u64 mmc_rx_length_error;
+	u64 mmc_rx_pause_frames;
+	u64 mmc_rx_fifo_overflow;
+	u64 mmc_rx_lpi_us_cntr;
+	u64 mmc_rx_lpi_tran_cntr;
+};
+
+struct tc956x_regs {
+
+	/*PCIe register*/
+	struct tc956x_regs_pcie pcie_reg;
+
+	/*Configuration register*/
+	struct tc956x_regs_config config_reg;
+
+	/*MSI register*/
+	struct tc956x_regs_msi msi_reg;
+
+	/*INTC register*/
+	struct tc956x_regs_intc intc_reg;
+
+	/*DMA Descriptor stats*/
+	struct tc956x_regs_dma dma_reg;
+
+	/*MAC debug stats*/
+	struct tc956x_regs_mac mac_reg;
+
+	/*MTL debug stats*/
+	struct tc956x_regs_mtl mtl_reg;
+
+	/*M3 stats*/
+	struct tc956x_regs_m3 m3_reg;
+
+	/*FRP Table*/
+	struct tc956xmac_rx_parser_cfg *rxp_cfg;
+
+	/* TAMAP */
+	struct tc956x_tamap tamap[MAX_CM3_TAMAP_ENTRIES + 1]; /*0th for PCIe-eMAC 1,2,3 for IPA*/
+
+	/*Driver & FW Information */
+	struct tx956x_driver_info info;
+
+	/* Statistics counters*/
+	struct tc956x_statistics stats;
+
+};
+
+int tc956x_dump_regs(struct net_device *net_device, struct tc956x_regs *regs);
+int tc956x_print_debug_regs(struct net_device *net_device, struct tc956x_regs *regs);
+int tc956xmac_mdio_unregister(struct net_device *ndev);
+int tc956xmac_mdio_register(struct net_device *ndev);
+int tc956xmac_mdio_reset(struct mii_bus *mii);
+void tc956xmac_set_ethtool_ops(struct net_device *netdev);
+
+void tc956xmac_ptp_register(struct tc956xmac_priv *priv);
+void tc956xmac_ptp_unregister(struct tc956xmac_priv *priv);
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_resume(struct device *dev);
+int tc956xmac_suspend(struct device *dev);
+int tc956xmac_dvr_remove(struct device *dev);
+int tc956xmac_dvr_probe(struct device *device,
+		     struct plat_tc956xmacenet_data *plat_dat,
+		     struct tc956xmac_resources *res);
+#elif defined TC956X_SRIOV_VF
+int tc956xmac_vf_resume(struct device *dev);
+int tc956xmac_vf_suspend(struct device *dev);
+int tc956xmac_vf_dvr_remove(struct device *dev);
+int tc956xmac_vf_dvr_probe(struct device *device,
+		     struct plat_tc956xmacenet_data *plat_dat,
+		     struct tc956xmac_resources *res);
+#endif
+void tc956xmac_disable_eee_mode(struct tc956xmac_priv *priv);
+bool tc956xmac_eee_init(struct tc956xmac_priv *priv);
+
+#ifdef CONFIG_TC956XMAC_SELFTESTS
+void tc956xmac_selftest_run(struct net_device *dev,
+			 struct ethtool_test *etest, u64 *buf);
+void tc956xmac_selftest_get_strings(struct tc956xmac_priv *priv, u8 *data);
+int tc956xmac_selftest_get_count(struct tc956xmac_priv *priv);
+#else
+static inline void tc956xmac_selftest_run(struct net_device *dev,
+				       struct ethtool_test *etest, u64 *buf)
+{
+	/* Not enabled */
+}
+static inline void tc956xmac_selftest_get_strings(struct tc956xmac_priv *priv,
+					       u8 *data)
+{
+	/* Not enabled */
+}
+static inline int tc956xmac_selftest_get_count(struct tc956xmac_priv *priv)
+{
+	return -EOPNOTSUPP;
+}
+#endif /* CONFIG_TC956XMAC_SELFTESTS */
+
+/* Function Prototypes */
+
+#ifndef TC956X_SRIOV_VF
+s32 tc956x_load_firmware(struct device *dev, struct tc956xmac_resources *res);
+#endif
+extern int tc956xmac_pm_usage_counter;
+extern int tc956x_dsp_count;
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+int tc956x_pf_get_fn_idx_from_int_sts(struct tc956xmac_priv *priv,
+					     struct fn_id *fn_id_info);
+void tc956x_pf_parse_mbx(struct tc956xmac_priv *priv,
+				enum mbx_msg_fns msg_src);
+#endif
+
+#ifdef CONFIG_TC956X_PLATFORM_SUPPORT
+int tc956x_platform_probe(struct tc956xmac_priv *priv, struct tc956xmac_resources *res);
+int tc956x_platform_remove(struct tc956xmac_priv *priv);
+int tc956x_platform_suspend(struct tc956xmac_priv *priv);
+int tc956x_platform_resume(struct tc956xmac_priv *priv);
+int tc956x_platform_port_interface_overlay(struct device *dev, struct tc956xmac_resources *res);
+#else
+int tc956x_platform_probe(struct tc956xmac_priv *priv, struct tc956xmac_resources *res);
+static inline int tc956x_platform_remove(struct tc956xmac_priv *priv) { return 0; }
+static inline int tc956x_platform_suspend(struct tc956xmac_priv *priv) { return 0; }
+int tc956x_platform_resume(struct tc956xmac_priv *priv);
+static inline int tc956x_platform_port_interface_overlay(struct device *dev, struct tc956xmac_resources *res) { return 0; }
+#endif
+
+int tc956x_GPIO_OutputConfigPin(struct tc956xmac_priv *priv, u32 gpio_pin, u8 out_value);
+int tc956x_gpio_restore_configuration(struct tc956xmac_priv *priv);
+
+#ifdef TC956X_SRIOV_VF
+int tc956x_vf_get_fn_idx_from_int_sts(struct tc956xmac_priv *priv,
+					     struct fn_id *fn_id_info);
+void tc956x_vf_parse_mbx(struct tc956xmac_priv *priv,
+				enum mbx_msg_fns msg_src);
+int tc956x_vf_rsc_mng_get_fn_id(struct tc956xmac_priv *priv, void __iomem *reg_pci_bridge_config_addr,
+				       struct fn_id *fn_id_info);
+
+#endif
+int tc956x_set_pci_speed(struct pci_dev *pdev, u32 speed);
+void tc956xmac_link_change_set_power(struct tc956xmac_priv *priv, enum TC956X_PORT_LINK_CHANGE_STATE state);
+/*TC956X_Host_Driver-industrial_limited_tested_20241022_V_04-00-01-QPSSW-210.patch*/
+uint16_t tc956x_get_shared_mem_offset(struct pci_dev *pdev, uint16_t pci_bd);
+
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+int tc956xmac_create_debugfs(struct net_device *net_device);
+int tc956xmac_cleanup_debugfs(struct net_device *net_device);
+#endif
+#endif
+
+#ifndef TC956X_SRIOV_VF
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+int genphy_c45_read_eee_adv_local(struct phy_device *phydev, unsigned long *adv);
+int genphy_c45_eee_is_active_local(struct phy_device *phydev, unsigned long *adv,
+			     unsigned long *lp, bool *is_enabled);
+int genphy_c45_ethtool_get_eee_local(struct phy_device *phydev,
+			       struct ethtool_eee *data);
+int phy_ethtool_get_eee_local(struct phy_device *phydev, struct ethtool_eee *data);
+int phylink_ethtool_get_eee_local(struct phy_device *phydev, struct ethtool_eee *eee);
+#endif
+
+#ifdef TC956X_5_G_2_5_G_EEE_SUPPORT
+extern int phy_ethtool_set_eee_2p5(struct phy_device *phydev, struct ethtool_eee *data);
+#endif
+#endif
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 5, 0)
+struct timespec64 tc956x_calc_basetime(ktime_t old_base_time,
+					   ktime_t current_time,
+					   u64 cycle_time);
+#endif
+
+#endif /* __TC956XMAC_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_config.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_config.h
@@ -0,0 +1,407 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_config.h - Configuration Helpers
+ *
+ * Copyright (C) 2019 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ */
+
+#ifndef __TC956XMAC_CONFIG_H__
+#define __TC956XMAC_CONFIG_H__
+
+#define TC956XMAC_CFG(__cfg)		SCFG_TC956XMAC_##__cfg
+#define TC956XMAC_EN(__cfg)		IS_ENABLED(TC956XMAC_CFG(__cfg))
+#define ___TC956XMAC_TXQ(__p, __cfg)	SCFG_TC956XMAC_TXQ##__p##__cfg
+#define ___TC956XMAC_RXQ(__p, __cfg)	SCFG_TC956XMAC_RXQ##__p##__cfg
+#define __TC956XMAC_TXQ(__n, __cfg)	___TC956XMAC_TXQ(__n, _##__cfg)
+#define __TC956XMAC_RXQ(__n, __cfg)	___TC956XMAC_RXQ(__n, _##__cfg)
+#define TC956XMAC_TXQ(__n, __cfg)		__TC956XMAC_TXQ(__n, __cfg)
+#define TC956XMAC_RXQ(__n, __cfg)		__TC956XMAC_RXQ(__n, __cfg)
+
+#ifndef SCFG_TC956XMAC
+static inline void tc956xmac_config_data(struct plat_tc956xmacenet_data *plat)
+{
+	/* Nothing to do */
+}
+#else /* !SCFG_TC956XMAC */
+static inline void tc956xmac_config_data(struct plat_tc956xmacenet_data *plat)
+{
+	plat->force_sf_dma_mode = TC956XMAC_EN(MTL_SF);
+	plat->force_thresh_dma_mode = TC956XMAC_EN(MTL_THR);
+	plat->tso_en = TC956XMAC_EN(TSO);
+	plat->rss_en = TC956XMAC_EN(RSS);
+	plat->sph_en = TC956XMAC_EN(SPH);
+	plat->pmt = TC956XMAC_EN(PMT);
+	plat->riwt_off = !TC956XMAC_EN(RIWT);
+
+#ifdef SCFG_TC956XMAC_PTP_RATE
+	plat->clk_ptp_rate = TC956XMAC_CFG(PTP_RATE);
+	plat->clk_ref_rate = TC956XMAC_CFG(PTP_RATE);
+#endif
+
+#ifdef SCFG_TC956XMAC_TXPBL
+	plat->dma_cfg->txpbl = TC956XMAC_CFG(TXPBL);
+#endif
+#ifdef SCFG_TC956XMAC_RXPBL
+	plat->dma_cfg->rxpbl = TC956XMAC_CFG(RXPBL);
+#endif
+	plat->dma_cfg->pblx8 = TC956XMAC_EN(PBLX8);
+	plat->dma_cfg->aal = TC956XMAC_EN(AXI_AAL);
+
+	if (plat->axi) {
+#ifdef SCFG_TC956XMAC_AXI_WR
+		plat->axi->axi_wr_osr_lmt = TC956XMAC_CFG(AXI_WR);
+#endif
+#ifdef SCFG_TC956XMAC_AXI_RD
+		plat->axi->axi_rd_osr_lmt = TC956XMAC_CFG(AXI_RD);
+#endif
+	}
+
+	/* TX Scheduling Algorithm */
+	if (TC956XMAC_EN(TX_SP))
+		plat->tx_sched_algorithm = MTL_TX_ALGORITHM_SP;
+	else if (TC956XMAC_EN(TX_WRR))
+		plat->tx_sched_algorithm = MTL_TX_ALGORITHM_WRR;
+	else if (TC956XMAC_EN(TX_WFQ))
+		plat->tx_sched_algorithm = MTL_TX_ALGORITHM_WFQ;
+	else if (TC956XMAC_EN(TX_DWRR))
+		plat->tx_sched_algorithm = MTL_TX_ALGORITHM_DWRR;
+
+	/* RX Scheduling Algorithm */
+	if (TC956XMAC_EN(RX_SP))
+		plat->rx_sched_algorithm = MTL_RX_ALGORITHM_SP;
+	else if (TC956XMAC_EN(RX_WSP))
+		plat->rx_sched_algorithm = MTL_RX_ALGORITHM_WSP;
+
+#ifdef SCFG_TC956XMAC_TXQ
+	plat->tx_queues_to_use = TC956XMAC_CFG(TXQ);
+#endif
+#ifdef SCFG_TC956XMAC_RXQ
+	plat->rx_queues_to_use = TC956XMAC_CFG(RXQ);
+#endif
+
+	/* TX Queue 0 */
+#ifdef SCFG_TC956XMAC_TXQ0_DCB
+	plat->tx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_TXQ0_AVB
+	plat->tx_queues_cfg[0].mode_to_use = MTL_QUEUE_AVB;
+	plat->tx_queues_cfg[0].idle_slope = TC956XMAC_TXQ(0, IDLESLOPE);
+	plat->tx_queues_cfg[0].send_slope = TC956XMAC_TXQ(0, SENDSLOPE);
+	plat->tx_queues_cfg[0].high_credit = TC956XMAC_TXQ(0, HICREDIT);
+	plat->tx_queues_cfg[0].low_credit = TC956XMAC_TXQ(0, LOCREDIT);
+#endif
+
+#ifdef SCFG_TC956XMAC_TXQ0_WEIGHT
+	plat->tx_queues_cfg[0].weight = TC956XMAC_TXQ(0, WEIGHT);
+#endif
+#ifdef SCFG_TC956XMAC_TXQ0_PRIO
+	plat->tx_queues_cfg[0].use_prio = true;
+	plat->tx_queues_cfg[0].prio = TC956XMAC_TXQ(0, PRIO);
+#endif
+	plat->tx_queues_cfg[0].tbs_en = IS_ENABLED(TC956XMAC_TXQ(0, TBS));
+
+	/* RX Queue 0 */
+#ifdef SCFG_TC956XMAC_RXQ0_DCB
+	plat->rx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_RXQ0_AVB
+	plat->rx_queues_cfg[0].mode_to_use = MTL_QUEUE_AVB;
+#endif
+
+#ifdef SCFG_TC956XMAC_RXQ0_CHANNEL
+	plat->rx_queues_cfg[0].chan = TC956XMAC_RXQ(0, CHANNEL);
+#endif
+#ifdef SCFG_TC956XMAC_RXQ0_PRIO
+	plat->rx_queues_cfg[0].use_prio = true;
+	plat->rx_queues_cfg[0].prio = TC956XMAC_RXQ(0, PRIO);
+#endif
+
+	/* TX Queue 1 */
+#ifdef SCFG_TC956XMAC_TXQ1_DCB
+	plat->tx_queues_cfg[1].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_TXQ1_AVB
+	plat->tx_queues_cfg[1].mode_to_use = MTL_QUEUE_AVB;
+	plat->tx_queues_cfg[1].idle_slope = TC956XMAC_TXQ(1, IDLESLOPE);
+	plat->tx_queues_cfg[1].send_slope = TC956XMAC_TXQ(1, SENDSLOPE);
+	plat->tx_queues_cfg[1].high_credit = TC956XMAC_TXQ(1, HICREDIT);
+	plat->tx_queues_cfg[1].low_credit = TC956XMAC_TXQ(1, LOCREDIT);
+#endif
+
+#ifdef SCFG_TC956XMAC_TXQ1_WEIGHT
+	plat->tx_queues_cfg[1].weight = TC956XMAC_TXQ(1, WEIGHT);
+#endif
+#ifdef SCFG_TC956XMAC_TXQ1_PRIO
+	plat->tx_queues_cfg[1].use_prio = true;
+	plat->tx_queues_cfg[1].prio = TC956XMAC_TXQ(1, PRIO);
+#endif
+	plat->tx_queues_cfg[1].tbs_en = IS_ENABLED(TC956XMAC_TXQ(1, TBS));
+
+	/* RX Queue 1 */
+#ifdef SCFG_TC956XMAC_RXQ1_DCB
+	plat->rx_queues_cfg[1].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_RXQ1_AVB
+	plat->rx_queues_cfg[1].mode_to_use = MTL_QUEUE_AVB;
+#endif
+
+#ifdef SCFG_TC956XMAC_RXQ1_CHANNEL
+	plat->rx_queues_cfg[1].chan = TC956XMAC_RXQ(1, CHANNEL);
+#endif
+#ifdef SCFG_TC956XMAC_RXQ1_PRIO
+	plat->rx_queues_cfg[1].use_prio = true;
+	plat->rx_queues_cfg[1].prio = TC956XMAC_RXQ(1, PRIO);
+#endif
+
+	/* TX Queue 2 */
+#ifdef SCFG_TC956XMAC_TXQ2_DCB
+	plat->tx_queues_cfg[2].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_TXQ2_AVB
+	plat->tx_queues_cfg[2].mode_to_use = MTL_QUEUE_AVB;
+	plat->tx_queues_cfg[2].idle_slope = TC956XMAC_TXQ(2, IDLESLOPE);
+	plat->tx_queues_cfg[2].send_slope = TC956XMAC_TXQ(2, SENDSLOPE);
+	plat->tx_queues_cfg[2].high_credit = TC956XMAC_TXQ(2, HICREDIT);
+	plat->tx_queues_cfg[2].low_credit = TC956XMAC_TXQ(2, LOCREDIT);
+#endif
+
+#ifdef SCFG_TC956XMAC_TXQ2_WEIGHT
+	plat->tx_queues_cfg[2].weight = TC956XMAC_TXQ(2, WEIGHT);
+#endif
+#ifdef SCFG_TC956XMAC_TXQ2_PRIO
+	plat->tx_queues_cfg[2].use_prio = true;
+	plat->tx_queues_cfg[2].prio = TC956XMAC_TXQ(2, PRIO);
+#endif
+	plat->tx_queues_cfg[2].tbs_en = IS_ENABLED(TC956XMAC_TXQ(2, TBS));
+
+	/* RX Queue 2 */
+#ifdef SCFG_TC956XMAC_RXQ2_DCB
+	plat->rx_queues_cfg[2].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_RXQ2_AVB
+	plat->rx_queues_cfg[2].mode_to_use = MTL_QUEUE_AVB;
+#endif
+
+#ifdef SCFG_TC956XMAC_RXQ2_CHANNEL
+	plat->rx_queues_cfg[2].chan = TC956XMAC_RXQ(2, CHANNEL);
+#endif
+#ifdef SCFG_TC956XMAC_RXQ2_PRIO
+	plat->rx_queues_cfg[2].use_prio = true;
+	plat->rx_queues_cfg[2].prio = TC956XMAC_RXQ(2, PRIO);
+#endif
+
+	/* TX Queue 3 */
+#ifdef SCFG_TC956XMAC_TXQ3_DCB
+	plat->tx_queues_cfg[3].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_TXQ3_AVB
+	plat->tx_queues_cfg[3].mode_to_use = MTL_QUEUE_AVB;
+	plat->tx_queues_cfg[3].idle_slope = TC956XMAC_TXQ(3, IDLESLOPE);
+	plat->tx_queues_cfg[3].send_slope = TC956XMAC_TXQ(3, SENDSLOPE);
+	plat->tx_queues_cfg[3].high_credit = TC956XMAC_TXQ(3, HICREDIT);
+	plat->tx_queues_cfg[3].low_credit = TC956XMAC_TXQ(3, LOCREDIT);
+#endif
+
+#ifdef SCFG_TC956XMAC_TXQ3_WEIGHT
+	plat->tx_queues_cfg[3].weight = TC956XMAC_TXQ(3, WEIGHT);
+#endif
+#ifdef SCFG_TC956XMAC_TXQ3_PRIO
+	plat->tx_queues_cfg[3].use_prio = true;
+	plat->tx_queues_cfg[3].prio = TC956XMAC_TXQ(3, PRIO);
+#endif
+	plat->tx_queues_cfg[3].tbs_en = IS_ENABLED(TC956XMAC_TXQ(3, TBS));
+
+	/* RX Queue 3 */
+#ifdef SCFG_TC956XMAC_RXQ3_DCB
+	plat->rx_queues_cfg[3].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_RXQ3_AVB
+	plat->rx_queues_cfg[3].mode_to_use = MTL_QUEUE_AVB;
+#endif
+
+#ifdef SCFG_TC956XMAC_RXQ3_CHANNEL
+	plat->rx_queues_cfg[3].chan = TC956XMAC_RXQ(3, CHANNEL);
+#endif
+#ifdef SCFG_TC956XMAC_RXQ3_PRIO
+	plat->rx_queues_cfg[3].use_prio = true;
+	plat->rx_queues_cfg[3].prio = TC956XMAC_RXQ(3, PRIO);
+#endif
+
+	/* TX Queue 4 */
+#ifdef SCFG_TC956XMAC_TXQ4_DCB
+	plat->tx_queues_cfg[4].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_TXQ4_AVB
+	plat->tx_queues_cfg[4].mode_to_use = MTL_QUEUE_AVB;
+	plat->tx_queues_cfg[4].idle_slope = TC956XMAC_TXQ(4, IDLESLOPE);
+	plat->tx_queues_cfg[4].send_slope = TC956XMAC_TXQ(4, SENDSLOPE);
+	plat->tx_queues_cfg[4].high_credit = TC956XMAC_TXQ(4, HICREDIT);
+	plat->tx_queues_cfg[4].low_credit = TC956XMAC_TXQ(4, LOCREDIT);
+#endif
+
+#ifdef SCFG_TC956XMAC_TXQ4_WEIGHT
+	plat->tx_queues_cfg[4].weight = TC956XMAC_TXQ(4, WEIGHT);
+#endif
+#ifdef SCFG_TC956XMAC_TXQ4_PRIO
+	plat->tx_queues_cfg[4].use_prio = true;
+	plat->tx_queues_cfg[4].prio = TC956XMAC_TXQ(4, PRIO);
+#endif
+	plat->tx_queues_cfg[4].tbs_en = IS_ENABLED(TC956XMAC_TXQ(4, TBS));
+
+	/* RX Queue 4 */
+#ifdef SCFG_TC956XMAC_RXQ4_DCB
+	plat->rx_queues_cfg[4].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_RXQ4_AVB
+	plat->rx_queues_cfg[4].mode_to_use = MTL_QUEUE_AVB;
+#endif
+
+#ifdef SCFG_TC956XMAC_RXQ4_CHANNEL
+	plat->rx_queues_cfg[4].chan = TC956XMAC_RXQ(4, CHANNEL);
+#endif
+#ifdef SCFG_TC956XMAC_RXQ4_PRIO
+	plat->rx_queues_cfg[4].use_prio = true;
+	plat->rx_queues_cfg[4].prio = TC956XMAC_RXQ(4, PRIO);
+#endif
+
+	/* TX Queue 5 */
+#ifdef SCFG_TC956XMAC_TXQ5_DCB
+	plat->tx_queues_cfg[5].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_TXQ5_AVB
+	plat->tx_queues_cfg[5].mode_to_use = MTL_QUEUE_AVB;
+	plat->tx_queues_cfg[5].idle_slope = TC956XMAC_TXQ(5, IDLESLOPE);
+	plat->tx_queues_cfg[5].send_slope = TC956XMAC_TXQ(5, SENDSLOPE);
+	plat->tx_queues_cfg[5].high_credit = TC956XMAC_TXQ(5, HICREDIT);
+	plat->tx_queues_cfg[5].low_credit = TC956XMAC_TXQ(5, LOCREDIT);
+#endif
+
+#ifdef SCFG_TC956XMAC_TXQ5_WEIGHT
+	plat->tx_queues_cfg[5].weight = TC956XMAC_TXQ(5, WEIGHT);
+#endif
+#ifdef SCFG_TC956XMAC_TXQ5_PRIO
+	plat->tx_queues_cfg[5].use_prio = true;
+	plat->tx_queues_cfg[5].prio = TC956XMAC_TXQ(5, PRIO);
+#endif
+	plat->tx_queues_cfg[5].tbs_en = IS_ENABLED(TC956XMAC_TXQ(5, TBS));
+
+	/* RX Queue 5 */
+#ifdef SCFG_TC956XMAC_RXQ5_DCB
+	plat->rx_queues_cfg[5].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_RXQ5_AVB
+	plat->rx_queues_cfg[5].mode_to_use = MTL_QUEUE_AVB;
+#endif
+
+#ifdef SCFG_TC956XMAC_RXQ5_CHANNEL
+	plat->rx_queues_cfg[5].chan = TC956XMAC_RXQ(5, CHANNEL);
+#endif
+#ifdef SCFG_TC956XMAC_RXQ5_PRIO
+	plat->rx_queues_cfg[5].use_prio = true;
+	plat->rx_queues_cfg[5].prio = TC956XMAC_RXQ(5, PRIO);
+#endif
+
+	/* TX Queue 6 */
+#ifdef SCFG_TC956XMAC_TXQ6_DCB
+	plat->tx_queues_cfg[6].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_TXQ6_AVB
+	plat->tx_queues_cfg[6].mode_to_use = MTL_QUEUE_AVB;
+	plat->tx_queues_cfg[6].idle_slope = TC956XMAC_TXQ(6, IDLESLOPE);
+	plat->tx_queues_cfg[6].send_slope = TC956XMAC_TXQ(6, SENDSLOPE);
+	plat->tx_queues_cfg[6].high_credit = TC956XMAC_TXQ(6, HICREDIT);
+	plat->tx_queues_cfg[6].low_credit = TC956XMAC_TXQ(6, LOCREDIT);
+#endif
+
+#ifdef SCFG_TC956XMAC_TXQ6_WEIGHT
+	plat->tx_queues_cfg[6].weight = TC956XMAC_TXQ(6, WEIGHT);
+#endif
+#ifdef SCFG_TC956XMAC_TXQ6_PRIO
+	plat->tx_queues_cfg[6].use_prio = true;
+	plat->tx_queues_cfg[6].prio = TC956XMAC_TXQ(6, PRIO);
+#endif
+	plat->tx_queues_cfg[6].tbs_en = IS_ENABLED(TC956XMAC_TXQ(6, TBS));
+
+	/* RX Queue 6 */
+#ifdef SCFG_TC956XMAC_RXQ6_DCB
+	plat->rx_queues_cfg[6].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_RXQ6_AVB
+	plat->rx_queues_cfg[6].mode_to_use = MTL_QUEUE_AVB;
+#endif
+
+#ifdef SCFG_TC956XMAC_RXQ6_CHANNEL
+	plat->rx_queues_cfg[6].chan = TC956XMAC_RXQ(6, CHANNEL);
+#endif
+#ifdef SCFG_TC956XMAC_RXQ6_PRIO
+	plat->rx_queues_cfg[6].use_prio = true;
+	plat->rx_queues_cfg[6].prio = TC956XMAC_RXQ(6, PRIO);
+#endif
+
+	/* TX Queue 7 */
+#ifdef SCFG_TC956XMAC_TXQ7_DCB
+	plat->tx_queues_cfg[7].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_TXQ7_AVB
+	plat->tx_queues_cfg[7].mode_to_use = MTL_QUEUE_AVB;
+	plat->tx_queues_cfg[7].idle_slope = TC956XMAC_TXQ(7, IDLESLOPE);
+	plat->tx_queues_cfg[7].send_slope = TC956XMAC_TXQ(7, SENDSLOPE);
+	plat->tx_queues_cfg[7].high_credit = TC956XMAC_TXQ(7, HICREDIT);
+	plat->tx_queues_cfg[7].low_credit = TC956XMAC_TXQ(7, LOCREDIT);
+#endif
+
+#ifdef SCFG_TC956XMAC_TXQ7_WEIGHT
+	plat->tx_queues_cfg[7].weight = TC956XMAC_TXQ(7, WEIGHT);
+#endif
+#ifdef SCFG_TC956XMAC_TXQ7_PRIO
+	plat->tx_queues_cfg[7].use_prio = true;
+	plat->tx_queues_cfg[7].prio = TC956XMAC_TXQ(7, PRIO);
+#endif
+	plat->tx_queues_cfg[7].tbs_en = IS_ENABLED(TC956XMAC_TXQ(7, TBS));
+
+	/* RX Queue 7 */
+#ifdef SCFG_TC956XMAC_RXQ7_DCB
+	plat->rx_queues_cfg[7].mode_to_use = MTL_QUEUE_DCB;
+#endif
+#ifdef SCFG_TC956XMAC_RXQ7_AVB
+	plat->rx_queues_cfg[7].mode_to_use = MTL_QUEUE_AVB;
+#endif
+
+#ifdef SCFG_TC956XMAC_RXQ7_CHANNEL
+	plat->rx_queues_cfg[7].chan = TC956XMAC_RXQ(7, CHANNEL);
+#endif
+#ifdef SCFG_TC956XMAC_RXQ7_PRIO
+	plat->rx_queues_cfg[7].use_prio = true;
+	plat->rx_queues_cfg[7].prio = TC956XMAC_RXQ(7, PRIO);
+#endif
+}
+#endif /* !SCFG_TC956XMAC */
+
+#endif /* __TC956XMAC_CONFIG_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_ethtool.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_ethtool.c
@@ -0,0 +1,2569 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_ethtool.c - Ethtool support
+ *
+ * Copyright (C) 2007-2009  STMicroelectronics Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  14 Oct 2021 : 1. Returning error on disabling Receive Flow Control via ethtool for speed other than 10G in XFI mode.
+ *  VERSION     : 01-00-16
+ *  19 Oct 2021 : 1. Adding M3 SRAM Debug counters to ethtool statistics
+ *                2. Adding MTL RX Overflow/packet miss count, TX underflow counts,Rx Watchdog value to ethtool statistics.
+ *  VERSION     : 01-00-17
+ *  26 Oct 2021 : 1. Added set_wol and get_wol support using ethtool.
+ *  VERSION     : 01-00-19
+ *  24 Nov 2021 : 1. EEE update for runtime configuration through ethtool.
+ *                2. ethtool driver name display corrected
+ *  VERSION     : 01-00-24
+ *  10 Dec 2021 : 1. Added link partner pause frame count debug counters to ethtool statistics.
+ *  VERSION     : 01-00-31
+ *  04 Feb 2022 : 1. Ethtool statistics added to print doorbell SRAM area for all the channels.
+ *  VERSION     : 01-00-41
+ *  22 Mar 2022 : 1. PCI bus info updated for ethtool get driver version
+ *  VERSION     : 01-00-46
+ *  10 Nov 2023 : 1. Kernel 6.1 Porting changes
+ *  VERSION     : 01-02-59
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *  VERSION     : 04-00
+ *  29 Mar 2024 : 1. Support for without MDIO and without PHY case
+ *                2. Added support for 5G and 2.5G EEE activation (applicable for Kernel 6.3 onwards)
+ *  VERSION     : 04-00
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/interrupt.h>
+#include <linux/mii.h>
+#ifndef TC956X_SRIOV_VF
+#include <linux/phylink.h>
+#endif  /* TC956X_SRIOV_VF */
+#include <linux/net_tstamp.h>
+#include <asm/io.h>
+#include <linux/iopoll.h>
+
+#include "tc956xmac.h"
+#include "dwxgmac2.h"
+
+#define REG_SPACE_SIZE	11512/*Total Reg Len*/
+#define MAC100_ETHTOOL_NAME	"tc956x_mac100"
+#define GMAC_ETHTOOL_NAME	"tc956x_gmac"
+#ifdef TC956X_SRIOV_PF
+#define XGMAC_ETHTOOL_NAME	TC956X_RESOURCE_NAME
+#elif defined TC956X_SRIOV_VF
+#define XGMAC_ETHTOOL_NAME	"tc956x_vf_pcie_eth"
+#endif
+#define ETHTOOL_DMA_OFFSET	55
+#ifdef TC956X_SRIOV_DEBUG
+extern void tc956x_filter_debug(struct tc956xmac_priv *priv);
+#endif
+#ifndef TC956X_SRIOV_VF
+void tc956xmac_get_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause);
+int tc956xmac_ethtool_op_get_eee(struct net_device *dev, struct ethtool_eee *edata);
+#endif
+#ifdef TC956X_5_G_2_5_G_EEE_SUPPORT
+#define TC956X_ADVERTISED_2500baseT_Full ETHTOOL_LINK_MODE_2500baseT_Full_BIT
+#define TC956X_ADVERTISED_5000baseT_Full ETHTOOL_LINK_MODE_5000baseT_Full_BIT
+#endif
+struct tc956xmac_stats {
+	char stat_string[ETH_GSTRING_LEN];
+	int sizeof_stat;
+	int stat_offset;
+};
+
+#define TC956XMAC_STAT(m)	\
+	{ #m, sizeof_field(struct tc956xmac_extra_stats, m),	\
+	offsetof(struct tc956xmac_priv, xstats.m)}
+
+static const struct tc956xmac_stats tc956xmac_gstrings_stats[] = {
+	/* Transmit errors */
+	TC956XMAC_STAT(tx_underflow),
+	TC956XMAC_STAT(tx_carrier),
+	TC956XMAC_STAT(tx_losscarrier),
+	TC956XMAC_STAT(vlan_tag),
+	TC956XMAC_STAT(tx_deferred),
+	TC956XMAC_STAT(tx_vlan),
+	TC956XMAC_STAT(tx_jabber),
+	TC956XMAC_STAT(tx_frame_flushed),
+	TC956XMAC_STAT(tx_payload_error),
+	TC956XMAC_STAT(tx_ip_header_error),
+	/* Receive errors */
+	TC956XMAC_STAT(rx_desc),
+	TC956XMAC_STAT(sa_filter_fail),
+	TC956XMAC_STAT(overflow_error),
+	TC956XMAC_STAT(ipc_csum_error),
+	TC956XMAC_STAT(rx_collision),
+	TC956XMAC_STAT(rx_crc_errors),
+	TC956XMAC_STAT(dribbling_bit),
+	TC956XMAC_STAT(rx_length),
+	TC956XMAC_STAT(rx_mii),
+	TC956XMAC_STAT(rx_multicast),
+	TC956XMAC_STAT(rx_gmac_overflow),
+	TC956XMAC_STAT(rx_watchdog),
+	TC956XMAC_STAT(da_rx_filter_fail),
+	TC956XMAC_STAT(sa_rx_filter_fail),
+	TC956XMAC_STAT(rx_missed_cntr),
+	TC956XMAC_STAT(rx_overflow_cntr),
+	TC956XMAC_STAT(rx_vlan),
+	TC956XMAC_STAT(rx_split_hdr_pkt_n),
+	/* Tx/Rx IRQ error info */
+	TC956XMAC_STAT(tx_undeflow_irq),
+	TC956XMAC_STAT(tx_process_stopped_irq[0]),
+	TC956XMAC_STAT(tx_process_stopped_irq[1]),
+	TC956XMAC_STAT(tx_process_stopped_irq[2]),
+	TC956XMAC_STAT(tx_process_stopped_irq[3]),
+	TC956XMAC_STAT(tx_process_stopped_irq[4]),
+	TC956XMAC_STAT(tx_process_stopped_irq[5]),
+	TC956XMAC_STAT(tx_process_stopped_irq[6]),
+	TC956XMAC_STAT(tx_process_stopped_irq[7]),
+	TC956XMAC_STAT(tx_jabber_irq),
+	TC956XMAC_STAT(rx_overflow_irq),
+	TC956XMAC_STAT(rx_buf_unav_irq[0]),
+	TC956XMAC_STAT(rx_buf_unav_irq[1]),
+	TC956XMAC_STAT(rx_buf_unav_irq[2]),
+	TC956XMAC_STAT(rx_buf_unav_irq[3]),
+	TC956XMAC_STAT(rx_buf_unav_irq[4]),
+	TC956XMAC_STAT(rx_buf_unav_irq[5]),
+	TC956XMAC_STAT(rx_buf_unav_irq[6]),
+	TC956XMAC_STAT(rx_buf_unav_irq[7]),
+	TC956XMAC_STAT(rx_process_stopped_irq),
+	TC956XMAC_STAT(rx_watchdog_irq),
+	TC956XMAC_STAT(tx_early_irq),
+	TC956XMAC_STAT(fatal_bus_error_irq[0]),
+	TC956XMAC_STAT(fatal_bus_error_irq[1]),
+	TC956XMAC_STAT(fatal_bus_error_irq[2]),
+	TC956XMAC_STAT(fatal_bus_error_irq[3]),
+	TC956XMAC_STAT(fatal_bus_error_irq[4]),
+	TC956XMAC_STAT(fatal_bus_error_irq[5]),
+	TC956XMAC_STAT(fatal_bus_error_irq[6]),
+	TC956XMAC_STAT(fatal_bus_error_irq[7]),
+	/* Tx/Rx IRQ Events */
+	TC956XMAC_STAT(rx_early_irq),
+	TC956XMAC_STAT(threshold),
+	TC956XMAC_STAT(tx_pkt_n[0]),
+	TC956XMAC_STAT(tx_pkt_n[1]),
+	TC956XMAC_STAT(tx_pkt_n[2]),
+	TC956XMAC_STAT(tx_pkt_n[3]),
+	TC956XMAC_STAT(tx_pkt_n[4]),
+	TC956XMAC_STAT(tx_pkt_n[5]),
+	TC956XMAC_STAT(tx_pkt_n[6]),
+	TC956XMAC_STAT(tx_pkt_n[7]),
+	TC956XMAC_STAT(tx_pkt_errors_n[0]),
+	TC956XMAC_STAT(tx_pkt_errors_n[1]),
+	TC956XMAC_STAT(tx_pkt_errors_n[2]),
+	TC956XMAC_STAT(tx_pkt_errors_n[3]),
+	TC956XMAC_STAT(tx_pkt_errors_n[4]),
+	TC956XMAC_STAT(tx_pkt_errors_n[5]),
+	TC956XMAC_STAT(tx_pkt_errors_n[6]),
+	TC956XMAC_STAT(tx_pkt_errors_n[7]),
+	TC956XMAC_STAT(rx_pkt_n[0]),
+	TC956XMAC_STAT(rx_pkt_n[1]),
+	TC956XMAC_STAT(rx_pkt_n[2]),
+	TC956XMAC_STAT(rx_pkt_n[3]),
+	TC956XMAC_STAT(rx_pkt_n[4]),
+	TC956XMAC_STAT(rx_pkt_n[5]),
+	TC956XMAC_STAT(rx_pkt_n[6]),
+	TC956XMAC_STAT(rx_pkt_n[7]),
+	TC956XMAC_STAT(normal_irq_n[0]),
+	TC956XMAC_STAT(normal_irq_n[1]),
+	TC956XMAC_STAT(normal_irq_n[2]),
+	TC956XMAC_STAT(normal_irq_n[3]),
+	TC956XMAC_STAT(normal_irq_n[4]),
+	TC956XMAC_STAT(normal_irq_n[5]),
+	TC956XMAC_STAT(normal_irq_n[6]),
+	TC956XMAC_STAT(normal_irq_n[7]),
+	TC956XMAC_STAT(rx_normal_irq_n[0]),
+	TC956XMAC_STAT(rx_normal_irq_n[1]),
+	TC956XMAC_STAT(rx_normal_irq_n[2]),
+	TC956XMAC_STAT(rx_normal_irq_n[3]),
+	TC956XMAC_STAT(rx_normal_irq_n[4]),
+	TC956XMAC_STAT(rx_normal_irq_n[5]),
+	TC956XMAC_STAT(rx_normal_irq_n[6]),
+	TC956XMAC_STAT(rx_normal_irq_n[7]),
+	TC956XMAC_STAT(napi_poll_tx[0]),
+	TC956XMAC_STAT(napi_poll_tx[1]),
+	TC956XMAC_STAT(napi_poll_tx[2]),
+	TC956XMAC_STAT(napi_poll_tx[3]),
+	TC956XMAC_STAT(napi_poll_tx[4]),
+	TC956XMAC_STAT(napi_poll_tx[5]),
+	TC956XMAC_STAT(napi_poll_tx[6]),
+	TC956XMAC_STAT(napi_poll_tx[7]),
+	TC956XMAC_STAT(napi_poll_rx[0]),
+	TC956XMAC_STAT(napi_poll_rx[1]),
+	TC956XMAC_STAT(napi_poll_rx[2]),
+	TC956XMAC_STAT(napi_poll_rx[3]),
+	TC956XMAC_STAT(napi_poll_rx[4]),
+	TC956XMAC_STAT(napi_poll_rx[5]),
+	TC956XMAC_STAT(napi_poll_rx[6]),
+	TC956XMAC_STAT(napi_poll_rx[7]),
+	TC956XMAC_STAT(tx_normal_irq_n[0]),
+	TC956XMAC_STAT(tx_normal_irq_n[1]),
+	TC956XMAC_STAT(tx_normal_irq_n[2]),
+	TC956XMAC_STAT(tx_normal_irq_n[3]),
+	TC956XMAC_STAT(tx_normal_irq_n[4]),
+	TC956XMAC_STAT(tx_normal_irq_n[5]),
+	TC956XMAC_STAT(tx_normal_irq_n[6]),
+	TC956XMAC_STAT(tx_normal_irq_n[7]),
+	TC956XMAC_STAT(tx_clean[0]),
+	TC956XMAC_STAT(tx_clean[1]),
+	TC956XMAC_STAT(tx_clean[2]),
+	TC956XMAC_STAT(tx_clean[3]),
+	TC956XMAC_STAT(tx_clean[4]),
+	TC956XMAC_STAT(tx_clean[5]),
+	TC956XMAC_STAT(tx_clean[6]),
+	TC956XMAC_STAT(tx_clean[7]),
+	TC956XMAC_STAT(tx_set_ic_bit),
+	TC956XMAC_STAT(irq_receive_pmt_irq_n),
+	/* MMC info */
+	TC956XMAC_STAT(mmc_tx_irq_n),
+	TC956XMAC_STAT(mmc_rx_irq_n),
+	TC956XMAC_STAT(mmc_rx_csum_offload_irq_n),
+	/* EEE */
+	TC956XMAC_STAT(irq_tx_path_in_lpi_mode_n),
+	TC956XMAC_STAT(irq_tx_path_exit_lpi_mode_n),
+	TC956XMAC_STAT(irq_rx_path_in_lpi_mode_n),
+	TC956XMAC_STAT(irq_rx_path_exit_lpi_mode_n),
+	TC956XMAC_STAT(phy_eee_wakeup_error_n),
+	/* Extended RDES status */
+	TC956XMAC_STAT(ip_hdr_err),
+	TC956XMAC_STAT(ip_payload_err),
+	TC956XMAC_STAT(ip_csum_bypassed),
+	TC956XMAC_STAT(ipv4_pkt_rcvd),
+	TC956XMAC_STAT(ipv6_pkt_rcvd),
+	TC956XMAC_STAT(no_ptp_rx_msg_type_ext),
+	TC956XMAC_STAT(ptp_rx_msg_type_sync),
+	TC956XMAC_STAT(ptp_rx_msg_type_follow_up),
+	TC956XMAC_STAT(ptp_rx_msg_type_delay_req),
+	TC956XMAC_STAT(ptp_rx_msg_type_delay_resp),
+	TC956XMAC_STAT(ptp_rx_msg_type_pdelay_req),
+	TC956XMAC_STAT(ptp_rx_msg_type_pdelay_resp),
+	TC956XMAC_STAT(ptp_rx_msg_type_pdelay_follow_up),
+	TC956XMAC_STAT(ptp_rx_msg_type_announce),
+	TC956XMAC_STAT(ptp_rx_msg_type_management),
+	TC956XMAC_STAT(ptp_rx_msg_pkt_reserved_type),
+	TC956XMAC_STAT(ptp_frame_type),
+	TC956XMAC_STAT(ptp_ver),
+	TC956XMAC_STAT(timestamp_dropped),
+	TC956XMAC_STAT(av_pkt_rcvd),
+	TC956XMAC_STAT(av_tagged_pkt_rcvd),
+	TC956XMAC_STAT(vlan_tag_priority_val),
+	TC956XMAC_STAT(l3_filter_match),
+	TC956XMAC_STAT(l4_filter_match),
+	TC956XMAC_STAT(l3_l4_filter_no_match),
+	/* PCS */
+	TC956XMAC_STAT(irq_pcs_ane_n),
+	TC956XMAC_STAT(irq_pcs_link_n),
+	TC956XMAC_STAT(irq_rgmii_n),
+	/* DEBUG */
+	TC956XMAC_STAT(mtl_tx_status_fifo_full),
+	TC956XMAC_STAT(mtl_tx_fifo_not_empty[0]),
+	TC956XMAC_STAT(mtl_tx_fifo_not_empty[1]),
+	TC956XMAC_STAT(mtl_tx_fifo_not_empty[2]),
+	TC956XMAC_STAT(mtl_tx_fifo_not_empty[3]),
+	TC956XMAC_STAT(mtl_tx_fifo_not_empty[4]),
+	TC956XMAC_STAT(mtl_tx_fifo_not_empty[5]),
+	TC956XMAC_STAT(mtl_tx_fifo_not_empty[6]),
+	TC956XMAC_STAT(mtl_tx_fifo_not_empty[7]),
+	TC956XMAC_STAT(mmtl_fifo_ctrl[0]),
+	TC956XMAC_STAT(mmtl_fifo_ctrl[1]),
+	TC956XMAC_STAT(mmtl_fifo_ctrl[3]),
+	TC956XMAC_STAT(mmtl_fifo_ctrl[4]),
+	TC956XMAC_STAT(mmtl_fifo_ctrl[5]),
+	TC956XMAC_STAT(mmtl_fifo_ctrl[6]),
+	TC956XMAC_STAT(mmtl_fifo_ctrl[7]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_write[0]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_write[1]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_write[2]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_write[3]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_write[4]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_write[5]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_write[6]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_write[7]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_wait[0]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_wait[1]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_wait[2]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_wait[3]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_wait[4]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_wait[5]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_wait[6]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_wait[7]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_read[0]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_read[1]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_read[2]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_read[3]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_read[4]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_read[5]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_read[6]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_read[7]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_idle[0]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_idle[1]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_idle[2]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_idle[3]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_idle[4]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_idle[5]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_idle[6]),
+	TC956XMAC_STAT(mtl_tx_fifo_read_ctrl_idle[7]),
+	TC956XMAC_STAT(mac_tx_in_pause[0]),
+	TC956XMAC_STAT(mac_tx_in_pause[1]),
+	TC956XMAC_STAT(mac_tx_in_pause[2]),
+	TC956XMAC_STAT(mac_tx_in_pause[3]),
+	TC956XMAC_STAT(mac_tx_in_pause[4]),
+	TC956XMAC_STAT(mac_tx_in_pause[5]),
+	TC956XMAC_STAT(mac_tx_in_pause[6]),
+	TC956XMAC_STAT(mac_tx_in_pause[7]),
+	TC956XMAC_STAT(mac_tx_frame_ctrl_xfer),
+	TC956XMAC_STAT(mac_tx_frame_ctrl_idle),
+	TC956XMAC_STAT(mac_tx_frame_ctrl_wait),
+	TC956XMAC_STAT(mac_tx_frame_ctrl_pause),
+	TC956XMAC_STAT(mac_gmii_tx_proto_engine),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_full[0]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_full[1]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_full[2]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_full[3]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_full[4]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_full[5]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_full[6]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_full[7]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_above_thresh[0]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_above_thresh[1]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_above_thresh[2]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_above_thresh[3]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_above_thresh[4]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_above_thresh[5]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_above_thresh[6]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_above_thresh[7]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_below_thresh[0]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_below_thresh[1]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_below_thresh[2]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_below_thresh[3]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_below_thresh[4]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_below_thresh[5]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_below_thresh[6]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_below_thresh[7]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_empty[0]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_empty[1]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_empty[2]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_empty[3]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_empty[4]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_empty[5]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_empty[6]),
+	TC956XMAC_STAT(mtl_rx_fifo_fill_level_empty[7]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_flush[0]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_flush[1]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_flush[2]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_flush[3]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_flush[4]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_flush[5]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_flush[6]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_flush[7]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_read[0]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_read[1]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_read[2]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_read[3]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_read[4]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_read[5]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_read[6]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_read[7]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_status[0]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_status[1]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_status[2]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_status[3]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_status[4]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_status[5]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_status[6]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_status[7]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_idle[0]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_idle[1]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_idle[2]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_idle[3]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_idle[4]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_idle[5]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_idle[6]),
+	TC956XMAC_STAT(mtl_rx_fifo_read_ctrl_idle[7]),
+	TC956XMAC_STAT(mtl_rx_fifo_ctrl_active[0]),
+	TC956XMAC_STAT(mtl_rx_fifo_ctrl_active[1]),
+	TC956XMAC_STAT(mtl_rx_fifo_ctrl_active[2]),
+	TC956XMAC_STAT(mtl_rx_fifo_ctrl_active[3]),
+	TC956XMAC_STAT(mtl_rx_fifo_ctrl_active[4]),
+	TC956XMAC_STAT(mtl_rx_fifo_ctrl_active[5]),
+	TC956XMAC_STAT(mtl_rx_fifo_ctrl_active[6]),
+	TC956XMAC_STAT(mtl_rx_fifo_ctrl_active[7]),
+	TC956XMAC_STAT(mac_rx_frame_ctrl_fifo),
+	TC956XMAC_STAT(mac_gmii_rx_proto_engine),
+	/* TSO */
+	TC956XMAC_STAT(tx_tso_frames[0]),
+	TC956XMAC_STAT(tx_tso_frames[1]),
+	TC956XMAC_STAT(tx_tso_frames[2]),
+	TC956XMAC_STAT(tx_tso_frames[3]),
+	TC956XMAC_STAT(tx_tso_frames[4]),
+	TC956XMAC_STAT(tx_tso_frames[5]),
+	TC956XMAC_STAT(tx_tso_frames[6]),
+	TC956XMAC_STAT(tx_tso_frames[7]),
+	TC956XMAC_STAT(tx_tso_nfrags[0]),
+	TC956XMAC_STAT(tx_tso_nfrags[1]),
+	TC956XMAC_STAT(tx_tso_nfrags[2]),
+	TC956XMAC_STAT(tx_tso_nfrags[3]),
+	TC956XMAC_STAT(tx_tso_nfrags[4]),
+	TC956XMAC_STAT(tx_tso_nfrags[5]),
+	TC956XMAC_STAT(tx_tso_nfrags[6]),
+	TC956XMAC_STAT(tx_tso_nfrags[7]),
+
+	/* Tx Desc statistics */
+	TC956XMAC_STAT(txch_status[0]),
+	TC956XMAC_STAT(txch_status[1]),
+	TC956XMAC_STAT(txch_status[2]),
+	TC956XMAC_STAT(txch_status[3]),
+	TC956XMAC_STAT(txch_status[4]),
+	TC956XMAC_STAT(txch_status[5]),
+	TC956XMAC_STAT(txch_status[6]),
+	TC956XMAC_STAT(txch_status[7]),
+	TC956XMAC_STAT(txch_control[0]),
+	TC956XMAC_STAT(txch_control[1]),
+	TC956XMAC_STAT(txch_control[2]),
+	TC956XMAC_STAT(txch_control[3]),
+	TC956XMAC_STAT(txch_control[4]),
+	TC956XMAC_STAT(txch_control[5]),
+	TC956XMAC_STAT(txch_control[6]),
+	TC956XMAC_STAT(txch_control[7]),
+	TC956XMAC_STAT(txch_desc_list_haddr[0]),
+	TC956XMAC_STAT(txch_desc_list_haddr[1]),
+	TC956XMAC_STAT(txch_desc_list_haddr[2]),
+	TC956XMAC_STAT(txch_desc_list_haddr[3]),
+	TC956XMAC_STAT(txch_desc_list_haddr[4]),
+	TC956XMAC_STAT(txch_desc_list_haddr[5]),
+	TC956XMAC_STAT(txch_desc_list_haddr[6]),
+	TC956XMAC_STAT(txch_desc_list_haddr[7]),
+	TC956XMAC_STAT(txch_desc_list_laddr[0]),
+	TC956XMAC_STAT(txch_desc_list_laddr[1]),
+	TC956XMAC_STAT(txch_desc_list_laddr[2]),
+	TC956XMAC_STAT(txch_desc_list_laddr[3]),
+	TC956XMAC_STAT(txch_desc_list_laddr[4]),
+	TC956XMAC_STAT(txch_desc_list_laddr[5]),
+	TC956XMAC_STAT(txch_desc_list_laddr[6]),
+	TC956XMAC_STAT(txch_desc_list_laddr[7]),
+	TC956XMAC_STAT(txch_desc_ring_len[0]),
+	TC956XMAC_STAT(txch_desc_ring_len[1]),
+	TC956XMAC_STAT(txch_desc_ring_len[2]),
+	TC956XMAC_STAT(txch_desc_ring_len[3]),
+	TC956XMAC_STAT(txch_desc_ring_len[4]),
+	TC956XMAC_STAT(txch_desc_ring_len[5]),
+	TC956XMAC_STAT(txch_desc_ring_len[6]),
+	TC956XMAC_STAT(txch_desc_ring_len[7]),
+	TC956XMAC_STAT(txch_desc_curr_haddr[0]),
+	TC956XMAC_STAT(txch_desc_curr_haddr[1]),
+	TC956XMAC_STAT(txch_desc_curr_haddr[2]),
+	TC956XMAC_STAT(txch_desc_curr_haddr[3]),
+	TC956XMAC_STAT(txch_desc_curr_haddr[4]),
+	TC956XMAC_STAT(txch_desc_curr_haddr[5]),
+	TC956XMAC_STAT(txch_desc_curr_haddr[6]),
+	TC956XMAC_STAT(txch_desc_curr_haddr[7]),
+	TC956XMAC_STAT(txch_desc_curr_laddr[0]),
+	TC956XMAC_STAT(txch_desc_curr_laddr[1]),
+	TC956XMAC_STAT(txch_desc_curr_laddr[2]),
+	TC956XMAC_STAT(txch_desc_curr_laddr[3]),
+	TC956XMAC_STAT(txch_desc_curr_laddr[4]),
+	TC956XMAC_STAT(txch_desc_curr_laddr[5]),
+	TC956XMAC_STAT(txch_desc_curr_laddr[6]),
+	TC956XMAC_STAT(txch_desc_curr_laddr[7]),
+	TC956XMAC_STAT(txch_desc_tail[0]),
+	TC956XMAC_STAT(txch_desc_tail[1]),
+	TC956XMAC_STAT(txch_desc_tail[2]),
+	TC956XMAC_STAT(txch_desc_tail[3]),
+	TC956XMAC_STAT(txch_desc_tail[4]),
+	TC956XMAC_STAT(txch_desc_tail[5]),
+	TC956XMAC_STAT(txch_desc_tail[6]),
+	TC956XMAC_STAT(txch_desc_tail[7]),
+	TC956XMAC_STAT(txch_desc_buf_haddr[0]),
+	TC956XMAC_STAT(txch_desc_buf_haddr[1]),
+	TC956XMAC_STAT(txch_desc_buf_haddr[2]),
+	TC956XMAC_STAT(txch_desc_buf_haddr[3]),
+	TC956XMAC_STAT(txch_desc_buf_haddr[4]),
+	TC956XMAC_STAT(txch_desc_buf_haddr[5]),
+	TC956XMAC_STAT(txch_desc_buf_haddr[6]),
+	TC956XMAC_STAT(txch_desc_buf_haddr[7]),
+	TC956XMAC_STAT(txch_desc_buf_laddr[0]),
+	TC956XMAC_STAT(txch_desc_buf_laddr[1]),
+	TC956XMAC_STAT(txch_desc_buf_laddr[2]),
+	TC956XMAC_STAT(txch_desc_buf_laddr[3]),
+	TC956XMAC_STAT(txch_desc_buf_laddr[4]),
+	TC956XMAC_STAT(txch_desc_buf_laddr[5]),
+	TC956XMAC_STAT(txch_desc_buf_laddr[6]),
+	TC956XMAC_STAT(txch_desc_buf_laddr[7]),
+	TC956XMAC_STAT(txch_sw_cur_tx[0]),
+	TC956XMAC_STAT(txch_sw_cur_tx[1]),
+	TC956XMAC_STAT(txch_sw_cur_tx[2]),
+	TC956XMAC_STAT(txch_sw_cur_tx[3]),
+	TC956XMAC_STAT(txch_sw_cur_tx[4]),
+	TC956XMAC_STAT(txch_sw_cur_tx[5]),
+	TC956XMAC_STAT(txch_sw_cur_tx[6]),
+	TC956XMAC_STAT(txch_sw_cur_tx[7]),
+	TC956XMAC_STAT(txch_sw_dirty_tx[0]),
+	TC956XMAC_STAT(txch_sw_dirty_tx[1]),
+	TC956XMAC_STAT(txch_sw_dirty_tx[2]),
+	TC956XMAC_STAT(txch_sw_dirty_tx[3]),
+	TC956XMAC_STAT(txch_sw_dirty_tx[4]),
+	TC956XMAC_STAT(txch_sw_dirty_tx[5]),
+	TC956XMAC_STAT(txch_sw_dirty_tx[6]),
+	TC956XMAC_STAT(txch_sw_dirty_tx[7]),
+
+	/* Rx Desc statistics */
+	TC956XMAC_STAT(rxch_status[0]),
+	TC956XMAC_STAT(rxch_status[1]),
+	TC956XMAC_STAT(rxch_status[2]),
+	TC956XMAC_STAT(rxch_status[3]),
+	TC956XMAC_STAT(rxch_status[4]),
+	TC956XMAC_STAT(rxch_status[5]),
+	TC956XMAC_STAT(rxch_status[6]),
+	TC956XMAC_STAT(rxch_status[7]),
+	TC956XMAC_STAT(rxch_control[0]),
+	TC956XMAC_STAT(rxch_control[1]),
+	TC956XMAC_STAT(rxch_control[2]),
+	TC956XMAC_STAT(rxch_control[3]),
+	TC956XMAC_STAT(rxch_control[4]),
+	TC956XMAC_STAT(rxch_control[5]),
+	TC956XMAC_STAT(rxch_control[6]),
+	TC956XMAC_STAT(rxch_control[7]),
+	TC956XMAC_STAT(rxch_desc_list_haddr[0]),
+	TC956XMAC_STAT(rxch_desc_list_haddr[1]),
+	TC956XMAC_STAT(rxch_desc_list_haddr[2]),
+	TC956XMAC_STAT(rxch_desc_list_haddr[3]),
+	TC956XMAC_STAT(rxch_desc_list_haddr[4]),
+	TC956XMAC_STAT(rxch_desc_list_haddr[5]),
+	TC956XMAC_STAT(rxch_desc_list_haddr[6]),
+	TC956XMAC_STAT(rxch_desc_list_haddr[7]),
+	TC956XMAC_STAT(rxch_desc_list_laddr[0]),
+	TC956XMAC_STAT(rxch_desc_list_laddr[1]),
+	TC956XMAC_STAT(rxch_desc_list_laddr[2]),
+	TC956XMAC_STAT(rxch_desc_list_laddr[3]),
+	TC956XMAC_STAT(rxch_desc_list_laddr[4]),
+	TC956XMAC_STAT(rxch_desc_list_laddr[5]),
+	TC956XMAC_STAT(rxch_desc_list_laddr[6]),
+	TC956XMAC_STAT(rxch_desc_list_laddr[7]),
+	TC956XMAC_STAT(rxch_desc_ring_len[0]),
+	TC956XMAC_STAT(rxch_desc_ring_len[1]),
+	TC956XMAC_STAT(rxch_desc_ring_len[2]),
+	TC956XMAC_STAT(rxch_desc_ring_len[3]),
+	TC956XMAC_STAT(rxch_desc_ring_len[4]),
+	TC956XMAC_STAT(rxch_desc_ring_len[5]),
+	TC956XMAC_STAT(rxch_desc_ring_len[6]),
+	TC956XMAC_STAT(rxch_desc_ring_len[7]),
+	TC956XMAC_STAT(rxch_desc_curr_haddr[0]),
+	TC956XMAC_STAT(rxch_desc_curr_haddr[1]),
+	TC956XMAC_STAT(rxch_desc_curr_haddr[2]),
+	TC956XMAC_STAT(rxch_desc_curr_haddr[3]),
+	TC956XMAC_STAT(rxch_desc_curr_haddr[4]),
+	TC956XMAC_STAT(rxch_desc_curr_haddr[5]),
+	TC956XMAC_STAT(rxch_desc_curr_haddr[6]),
+	TC956XMAC_STAT(rxch_desc_curr_haddr[7]),
+	TC956XMAC_STAT(rxch_desc_curr_laddr[0]),
+	TC956XMAC_STAT(rxch_desc_curr_laddr[1]),
+	TC956XMAC_STAT(rxch_desc_curr_laddr[2]),
+	TC956XMAC_STAT(rxch_desc_curr_laddr[3]),
+	TC956XMAC_STAT(rxch_desc_curr_laddr[4]),
+	TC956XMAC_STAT(rxch_desc_curr_laddr[5]),
+	TC956XMAC_STAT(rxch_desc_curr_laddr[6]),
+	TC956XMAC_STAT(rxch_desc_curr_laddr[7]),
+	TC956XMAC_STAT(rxch_desc_tail[0]),
+	TC956XMAC_STAT(rxch_desc_tail[1]),
+	TC956XMAC_STAT(rxch_desc_tail[2]),
+	TC956XMAC_STAT(rxch_desc_tail[3]),
+	TC956XMAC_STAT(rxch_desc_tail[4]),
+	TC956XMAC_STAT(rxch_desc_tail[5]),
+	TC956XMAC_STAT(rxch_desc_tail[6]),
+	TC956XMAC_STAT(rxch_desc_tail[7]),
+	TC956XMAC_STAT(rxch_desc_buf_haddr[0]),
+	TC956XMAC_STAT(rxch_desc_buf_haddr[1]),
+	TC956XMAC_STAT(rxch_desc_buf_haddr[2]),
+	TC956XMAC_STAT(rxch_desc_buf_haddr[3]),
+	TC956XMAC_STAT(rxch_desc_buf_haddr[4]),
+	TC956XMAC_STAT(rxch_desc_buf_haddr[5]),
+	TC956XMAC_STAT(rxch_desc_buf_haddr[6]),
+	TC956XMAC_STAT(rxch_desc_buf_haddr[7]),
+	TC956XMAC_STAT(rxch_desc_buf_laddr[0]),
+	TC956XMAC_STAT(rxch_desc_buf_laddr[1]),
+	TC956XMAC_STAT(rxch_desc_buf_laddr[2]),
+	TC956XMAC_STAT(rxch_desc_buf_laddr[3]),
+	TC956XMAC_STAT(rxch_desc_buf_laddr[4]),
+	TC956XMAC_STAT(rxch_desc_buf_laddr[5]),
+	TC956XMAC_STAT(rxch_desc_buf_laddr[6]),
+	TC956XMAC_STAT(rxch_desc_buf_laddr[7]),
+	TC956XMAC_STAT(rxch_sw_cur_rx[0]),
+	TC956XMAC_STAT(rxch_sw_cur_rx[1]),
+	TC956XMAC_STAT(rxch_sw_cur_rx[2]),
+	TC956XMAC_STAT(rxch_sw_cur_rx[3]),
+	TC956XMAC_STAT(rxch_sw_cur_rx[4]),
+	TC956XMAC_STAT(rxch_sw_cur_rx[5]),
+	TC956XMAC_STAT(rxch_sw_cur_rx[6]),
+	TC956XMAC_STAT(rxch_sw_cur_rx[7]),
+	TC956XMAC_STAT(rxch_sw_dirty_rx[0]),
+	TC956XMAC_STAT(rxch_sw_dirty_rx[1]),
+	TC956XMAC_STAT(rxch_sw_dirty_rx[2]),
+	TC956XMAC_STAT(rxch_sw_dirty_rx[3]),
+	TC956XMAC_STAT(rxch_sw_dirty_rx[4]),
+	TC956XMAC_STAT(rxch_sw_dirty_rx[5]),
+	TC956XMAC_STAT(rxch_sw_dirty_rx[6]),
+	TC956XMAC_STAT(rxch_sw_dirty_rx[7]),
+	TC956XMAC_STAT(total_interrupts),
+	TC956XMAC_STAT(lpi_intr_n),
+	TC956XMAC_STAT(pmt_intr_n),
+	TC956XMAC_STAT(event_intr_n),
+	TC956XMAC_STAT(tx_intr_n),
+	TC956XMAC_STAT(rx_intr_n),
+	TC956XMAC_STAT(xpcs_intr_n),
+	TC956XMAC_STAT(phy_intr_n),
+	TC956XMAC_STAT(sw_msi_n),
+	TC956XMAC_STAT(mtl_tx_underflow[0]),
+	TC956XMAC_STAT(mtl_tx_underflow[1]),
+	TC956XMAC_STAT(mtl_tx_underflow[3]),
+	TC956XMAC_STAT(mtl_tx_underflow[4]),
+	TC956XMAC_STAT(mtl_tx_underflow[5]),
+	TC956XMAC_STAT(mtl_tx_underflow[6]),
+	TC956XMAC_STAT(mtl_tx_underflow[7]),
+
+	TC956XMAC_STAT(mtl_rx_miss_pkt_cnt[0]),
+	TC956XMAC_STAT(mtl_rx_miss_pkt_cnt[1]),
+	TC956XMAC_STAT(mtl_rx_miss_pkt_cnt[3]),
+	TC956XMAC_STAT(mtl_rx_miss_pkt_cnt[4]),
+	TC956XMAC_STAT(mtl_rx_miss_pkt_cnt[5]),
+	TC956XMAC_STAT(mtl_rx_miss_pkt_cnt[6]),
+	TC956XMAC_STAT(mtl_rx_miss_pkt_cnt[7]),
+
+	TC956XMAC_STAT(mtl_rx_overflow_pkt_cnt[0]),
+	TC956XMAC_STAT(mtl_rx_overflow_pkt_cnt[1]),
+	TC956XMAC_STAT(mtl_rx_overflow_pkt_cnt[3]),
+	TC956XMAC_STAT(mtl_rx_overflow_pkt_cnt[4]),
+	TC956XMAC_STAT(mtl_rx_overflow_pkt_cnt[5]),
+	TC956XMAC_STAT(mtl_rx_overflow_pkt_cnt[6]),
+	TC956XMAC_STAT(mtl_rx_overflow_pkt_cnt[7]),
+
+	TC956XMAC_STAT(rxch_watchdog_timer[0]),
+	TC956XMAC_STAT(rxch_watchdog_timer[1]),
+	TC956XMAC_STAT(rxch_watchdog_timer[2]),
+	TC956XMAC_STAT(rxch_watchdog_timer[3]),
+	TC956XMAC_STAT(rxch_watchdog_timer[4]),
+	TC956XMAC_STAT(rxch_watchdog_timer[5]),
+	TC956XMAC_STAT(rxch_watchdog_timer[6]),
+	TC956XMAC_STAT(rxch_watchdog_timer[7]),
+	TC956XMAC_STAT(link_partner_pause_frame_cnt),
+
+	TC956XMAC_STAT(m3_debug_cnt0),
+	TC956XMAC_STAT(m3_debug_cnt1),
+	TC956XMAC_STAT(m3_debug_cnt2),
+	TC956XMAC_STAT(m3_debug_cnt3),
+	TC956XMAC_STAT(m3_debug_cnt4),
+	TC956XMAC_STAT(m3_debug_cnt5),
+	TC956XMAC_STAT(m3_debug_cnt6),
+	TC956XMAC_STAT(m3_debug_cnt7),
+	TC956XMAC_STAT(m3_debug_cnt8),
+	TC956XMAC_STAT(m3_debug_cnt9),
+	TC956XMAC_STAT(m3_debug_cnt10),
+	TC956XMAC_STAT(m3_watchdog_exp_cnt),
+	TC956XMAC_STAT(m3_watchdog_monitor_cnt),
+	TC956XMAC_STAT(m3_debug_cnt13),
+	TC956XMAC_STAT(m3_debug_cnt14),
+	TC956XMAC_STAT(m3_systick_cnt_upper_value),
+	TC956XMAC_STAT(m3_systick_cnt_lower_value),
+	TC956XMAC_STAT(m3_tx_timeout_port0),
+	TC956XMAC_STAT(m3_tx_timeout_port1),
+	TC956XMAC_STAT(m3_debug_cnt19),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port0[0]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port0[1]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port0[2]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port0[3]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port0[4]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port0[5]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port0[6]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port0[7]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port1[0]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port1[1]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port1[2]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port1[3]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port1[4]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port1[5]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port1[6]),
+	TC956XMAC_STAT(m3_tx_pcie_addr_loc_port1[7]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port0[0]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port0[1]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port0[2]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port0[3]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port0[4]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port0[5]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port0[6]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port0[7]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port1[0]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port1[1]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port1[2]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port1[3]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port1[4]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port1[5]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port1[6]),
+	TC956XMAC_STAT(m3_rx_pcie_addr_loc_port1[7]),
+
+#ifdef TC956X_SRIOV_PF
+	TC956XMAC_STAT(mbx_pf_sent_vf[0]),
+	TC956XMAC_STAT(mbx_pf_sent_vf[1]),
+	TC956XMAC_STAT(mbx_pf_sent_vf[2]),
+	TC956XMAC_STAT(mbx_pf_rcvd_vf[0]),
+	TC956XMAC_STAT(mbx_pf_rcvd_vf[1]),
+	TC956XMAC_STAT(mbx_pf_rcvd_vf[2]),
+#else
+	TC956XMAC_STAT(mbx_vf_sent_pf),
+	TC956XMAC_STAT(mbx_vf_rcvd_pf),
+#endif
+
+};
+#define TC956XMAC_STATS_LEN ARRAY_SIZE(tc956xmac_gstrings_stats)
+
+/* HW MAC Management counters (if supported) */
+#define TC956XMAC_MMC_STAT(m)	\
+	{ #m, sizeof_field(struct tc956xmac_counters, m),	\
+	offsetof(struct tc956xmac_priv, mmc.m)}
+
+static const struct tc956xmac_stats tc956xmac_mmc[] = {
+	TC956XMAC_MMC_STAT(mmc_tx_octetcount_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_framecount_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_broadcastframe_g),
+	TC956XMAC_MMC_STAT(mmc_tx_multicastframe_g),
+	TC956XMAC_MMC_STAT(mmc_tx_64_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_65_to_127_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_128_to_255_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_256_to_511_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_512_to_1023_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_1024_to_max_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_unicast_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_multicast_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_broadcast_gb),
+	TC956XMAC_MMC_STAT(mmc_tx_underflow_error),
+	TC956XMAC_MMC_STAT(mmc_tx_singlecol_g),
+	TC956XMAC_MMC_STAT(mmc_tx_multicol_g),
+	TC956XMAC_MMC_STAT(mmc_tx_deferred),
+	TC956XMAC_MMC_STAT(mmc_tx_latecol),
+	TC956XMAC_MMC_STAT(mmc_tx_exesscol),
+	TC956XMAC_MMC_STAT(mmc_tx_carrier_error),
+	TC956XMAC_MMC_STAT(mmc_tx_octetcount_g),
+	TC956XMAC_MMC_STAT(mmc_tx_framecount_g),
+	TC956XMAC_MMC_STAT(mmc_tx_excessdef),
+	TC956XMAC_MMC_STAT(mmc_tx_pause_frame),
+	TC956XMAC_MMC_STAT(mmc_tx_vlan_frame_g),
+	TC956XMAC_MMC_STAT(mmc_tx_lpi_tran_cntr),
+	TC956XMAC_MMC_STAT(mmc_rx_lpi_tran_cntr),
+	TC956XMAC_MMC_STAT(mmc_rx_framecount_gb),
+	TC956XMAC_MMC_STAT(mmc_rx_octetcount_gb),
+	TC956XMAC_MMC_STAT(mmc_rx_octetcount_g),
+	TC956XMAC_MMC_STAT(mmc_rx_broadcastframe_g),
+	TC956XMAC_MMC_STAT(mmc_rx_multicastframe_g),
+	TC956XMAC_MMC_STAT(mmc_rx_crc_error),
+	TC956XMAC_MMC_STAT(mmc_rx_align_error),
+	TC956XMAC_MMC_STAT(mmc_rx_run_error),
+	TC956XMAC_MMC_STAT(mmc_rx_jabber_error),
+	TC956XMAC_MMC_STAT(mmc_rx_undersize_g),
+	TC956XMAC_MMC_STAT(mmc_rx_oversize_g),
+	TC956XMAC_MMC_STAT(mmc_rx_64_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_rx_65_to_127_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_rx_128_to_255_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_rx_256_to_511_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_rx_512_to_1023_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_rx_1024_to_max_octets_gb),
+	TC956XMAC_MMC_STAT(mmc_rx_unicast_g),
+	TC956XMAC_MMC_STAT(mmc_rx_length_error),
+	TC956XMAC_MMC_STAT(mmc_rx_autofrangetype),
+	TC956XMAC_MMC_STAT(mmc_rx_pause_frames),
+	TC956XMAC_MMC_STAT(mmc_rx_fifo_overflow),
+	TC956XMAC_MMC_STAT(mmc_rx_vlan_frames_gb),
+	TC956XMAC_MMC_STAT(mmc_rx_watchdog_error),
+	TC956XMAC_MMC_STAT(mmc_rx_ipc_intr_mask),
+	TC956XMAC_MMC_STAT(mmc_rx_ipc_intr),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_gd),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_hderr),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_nopay),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_frag),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_udsbl),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_gd_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_hderr_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_nopay_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_frag_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv4_udsbl_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv6_gd_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv6_hderr_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv6_nopay_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv6_gd),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv6_hderr),
+	TC956XMAC_MMC_STAT(mmc_rx_ipv6_nopay),
+	TC956XMAC_MMC_STAT(mmc_rx_udp_gd),
+	TC956XMAC_MMC_STAT(mmc_rx_udp_err),
+	TC956XMAC_MMC_STAT(mmc_rx_tcp_gd),
+	TC956XMAC_MMC_STAT(mmc_rx_tcp_err),
+	TC956XMAC_MMC_STAT(mmc_rx_icmp_gd),
+	TC956XMAC_MMC_STAT(mmc_rx_icmp_err),
+	TC956XMAC_MMC_STAT(mmc_rx_udp_gd_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_udp_err_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_tcp_gd_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_tcp_err_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_icmp_gd_octets),
+	TC956XMAC_MMC_STAT(mmc_rx_icmp_err_octets),
+	TC956XMAC_MMC_STAT(mmc_tx_fpe_fragment_cntr),
+	TC956XMAC_MMC_STAT(mmc_tx_hold_req_cntr),
+	TC956XMAC_MMC_STAT(mmc_rx_packet_assembly_err_cntr),
+	TC956XMAC_MMC_STAT(mmc_rx_packet_smd_err_cntr),
+	TC956XMAC_MMC_STAT(mmc_rx_packet_assembly_ok_cntr),
+	TC956XMAC_MMC_STAT(mmc_rx_fpe_fragment_cntr),
+};
+#define TC956XMAC_MMC_STATS_LEN ARRAY_SIZE(tc956xmac_mmc)
+
+#ifdef TC956X_SRIOV_VF
+/* SW counters */
+#define TC956X_SW_STAT(m)	\
+	{ #m, sizeof_field(struct tc956x_sw_counters, m),	\
+	offsetof(struct tc956xmac_priv, sw_stats.m)}
+
+static const struct tc956xmac_stats tc956x_sw[] = {
+	TC956X_SW_STAT(tx_frame_count_good_bad),
+	TC956X_SW_STAT(rx_frame_count_good_bad),
+	TC956X_SW_STAT(rx_frame_count_good),
+	TC956X_SW_STAT(rx_fame_count_bad),
+	TC956X_SW_STAT(rx_packet_good_octets),
+	TC956X_SW_STAT(rx_header_good_octets),
+	TC956X_SW_STAT(rx_av_tagged_datapacket_count),
+	TC956X_SW_STAT(rx_av_tagged_controlpacket_count),
+	TC956X_SW_STAT(rx_nonav_packet_count),
+	TC956X_SW_STAT(rx_tunnel_packet_count),
+	TC956X_SW_STAT(rx_non_ip_pkt_count),
+	TC956X_SW_STAT(rx_ipv4_tcp_pkt_count),
+	TC956X_SW_STAT(rx_ipv4_udp_pkt_count),
+	TC956X_SW_STAT(rx_ipv4_icmp_pkt_count),
+	TC956X_SW_STAT(rx_ipv4_igmp_pkt_count),
+	TC956X_SW_STAT(rx_ipv4_unkown_pkt_count),
+	TC956X_SW_STAT(rx_ipv6_tcp_pkt_count),
+	TC956X_SW_STAT(rx_ipv6_udp_pkt_count),
+	TC956X_SW_STAT(rx_ipv6_icmp_pkt_count),
+	TC956X_SW_STAT(rx_ipv6_unkown_pkt_count),
+	TC956X_SW_STAT(rx_err_wd_timeout_count),
+	TC956X_SW_STAT(rx_err_gmii_inv_count),
+	TC956X_SW_STAT(rx_err_crc_count),
+	TC956X_SW_STAT(rx_err_giant_count),
+	TC956X_SW_STAT(rx_err_checksum_count),
+	TC956X_SW_STAT(rx_err_overflow_count),
+	TC956X_SW_STAT(rx_err_bus_count),
+	TC956X_SW_STAT(rx_err_pkt_len_count),
+	TC956X_SW_STAT(rx_err_runt_pkt_count),
+	TC956X_SW_STAT(rx_err_dribble_count),
+	TC956X_SW_STAT(rx_err_t_out_ip_header_count),
+	TC956X_SW_STAT(rx_err_t_out_ip_pl_l4_csum_count),
+	TC956X_SW_STAT(rx_err_t_in_ip_header_count),
+	TC956X_SW_STAT(rx_err_t_in_ip_pl_l4_csum_count),
+	TC956X_SW_STAT(rx_err_t_invalid_vlan_header),
+	TC956X_SW_STAT(rx_l2_len_pkt_count),
+	TC956X_SW_STAT(rx_l2_mac_control_pkt_count),
+	TC956X_SW_STAT(rx_l2_dcb_control_pkt_count),
+	TC956X_SW_STAT(rx_l2_arp_pkt_count),
+	TC956X_SW_STAT(rx_l2_oam_type_pkt_count),
+	TC956X_SW_STAT(rx_l2_untg_typ_match_pkt_count),
+	TC956X_SW_STAT(rx_l2_other_type_pkt_count),
+	TC956X_SW_STAT(rx_l2_single_svlan_pkt_count),
+	TC956X_SW_STAT(rx_l2_single_cvlan_pkt_count),
+	TC956X_SW_STAT(rx_l2_d_cvlan_cvlan_pkt_count),
+	TC956X_SW_STAT(rx_l2_d_svlan_svlan_pkt_count),
+	TC956X_SW_STAT(rx_l2_d_svlan_cvlan_pkt_count),
+	TC956X_SW_STAT(rx_l2_d_cvlan_svlan_pkt_count),
+	TC956X_SW_STAT(rx_l2_untg_av_control_pkt_count),
+	TC956X_SW_STAT(rx_ptp_no_msg),
+	TC956X_SW_STAT(rx_ptp_msg_type_sync),
+	TC956X_SW_STAT(rx_ptp_msg_type_follow_up),
+	TC956X_SW_STAT(rx_ptp_msg_type_delay_req),
+	TC956X_SW_STAT(rx_ptp_msg_type_delay_resp),
+	TC956X_SW_STAT(rx_ptp_msg_type_pdelay_req),
+	TC956X_SW_STAT(rx_ptp_msg_type_pdelay_resp),
+	TC956X_SW_STAT(rx_ptp_msg_type_pdelay_follow_up),
+	TC956X_SW_STAT(rx_ptp_msg_type_announce),
+	TC956X_SW_STAT(rx_ptp_msg_type_management),
+	TC956X_SW_STAT(rx_ptp_msg_pkt_signaling),
+	TC956X_SW_STAT(rx_ptp_msg_pkt_reserved_type),
+};
+#define TC956X_SW_STATS_LEN ARRAY_SIZE(tc956x_sw)
+#endif
+static const char tc956x_priv_flags_strings[][ETH_GSTRING_LEN] = {
+#define TC956XMAC_TX_FCS	BIT(0)
+"tx-fcs",
+};
+
+#define TC956X_PRIV_FLAGS_STR_LEN ARRAY_SIZE(tc956x_priv_flags_strings)
+
+static void tc956xmac_ethtool_getdrvinfo(struct net_device *dev,
+				      struct ethtool_drvinfo *info)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct pci_dev *pdev = to_pci_dev(priv->device);
+	struct tc956x_version *fw_version;
+	int reg = 0;
+	char fw_version_str[32];
+
+#ifdef TC956X
+	reg = readl(priv->tc956x_SRAM_pci_base_addr + TC956X_M3_DBG_VER_START);
+#endif
+
+	fw_version = (struct tc956x_version *)(&reg);
+	scnprintf(fw_version_str, sizeof(fw_version_str), "Firmware Version %s_%d.%d-%d", (fw_version->rel_dbg == 'D')?"DBG":"REL",
+								fw_version->major, fw_version->minor,
+								fw_version->sub_minor);
+
+	strscpy(info->fw_version, fw_version_str, sizeof(info->fw_version));
+
+	if (priv->plat->has_gmac || priv->plat->has_gmac4)
+		strscpy(info->driver, GMAC_ETHTOOL_NAME, sizeof(info->driver));
+	else if (priv->plat->has_xgmac)
+		strscpy(info->driver, XGMAC_ETHTOOL_NAME, sizeof(info->driver));
+	else
+		strscpy(info->driver, MAC100_ETHTOOL_NAME,
+			sizeof(info->driver));
+
+	strscpy(info->version, DRV_MODULE_VERSION, sizeof(info->version));
+	strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info));
+
+	info->n_priv_flags = TC956X_PRIV_FLAGS_STR_LEN;
+}
+#ifndef TC956X_SRIOV_VF
+static int tc956xmac_ethtool_get_link_ksettings(struct net_device *dev,
+					     struct ethtool_link_ksettings *cmd)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	if (priv->hw->pcs & TC956XMAC_PCS_RGMII ||
+	    priv->hw->pcs & TC956XMAC_PCS_SGMII ||
+	    priv->hw->pcs & TC956XMAC_PCS_USXGMII) {
+		struct rgmii_adv adv;
+		u32 supported, advertising, lp_advertising;
+
+		if (!priv->xstats.pcs_link) {
+			cmd->base.speed = SPEED_UNKNOWN;
+			cmd->base.duplex = DUPLEX_UNKNOWN;
+			return 0;
+		}
+		cmd->base.duplex = priv->xstats.pcs_duplex;
+
+		cmd->base.speed = priv->xstats.pcs_speed;
+
+		/* Get and convert ADV/LP_ADV from the HW AN registers */
+		if (tc956xmac_pcs_get_adv_lp(priv, priv->ioaddr, &adv))
+			return -EOPNOTSUPP;	/* should never happen indeed */
+
+		/* Encoding of PSE bits is defined in 802.3z, 37.2.1.4 */
+
+		ethtool_convert_link_mode_to_legacy_u32(
+			&supported, cmd->link_modes.supported);
+		ethtool_convert_link_mode_to_legacy_u32(
+			&advertising, cmd->link_modes.advertising);
+		ethtool_convert_link_mode_to_legacy_u32(
+			&lp_advertising, cmd->link_modes.lp_advertising);
+
+		if (adv.pause & TC956XMAC_PCS_PAUSE)
+			advertising |= ADVERTISED_Pause;
+		if (adv.pause & TC956XMAC_PCS_ASYM_PAUSE)
+			advertising |= ADVERTISED_Asym_Pause;
+		if (adv.lp_pause & TC956XMAC_PCS_PAUSE)
+			lp_advertising |= ADVERTISED_Pause;
+		if (adv.lp_pause & TC956XMAC_PCS_ASYM_PAUSE)
+			lp_advertising |= ADVERTISED_Asym_Pause;
+
+		/* Reg49[3] always set because ANE is always supported */
+		cmd->base.autoneg = ADVERTISED_Autoneg;
+		supported |= SUPPORTED_Autoneg;
+		advertising |= ADVERTISED_Autoneg;
+		lp_advertising |= ADVERTISED_Autoneg;
+
+		if (adv.duplex) {
+			supported |= (SUPPORTED_1000baseT_Full |
+				      SUPPORTED_100baseT_Full |
+				      SUPPORTED_10baseT_Full);
+			advertising |= (ADVERTISED_1000baseT_Full |
+					ADVERTISED_100baseT_Full |
+					ADVERTISED_10baseT_Full);
+		} else {
+			supported |= (SUPPORTED_1000baseT_Half |
+				      SUPPORTED_100baseT_Half |
+				      SUPPORTED_10baseT_Half);
+			advertising |= (ADVERTISED_1000baseT_Half |
+					ADVERTISED_100baseT_Half |
+					ADVERTISED_10baseT_Half);
+		}
+		if (adv.lp_duplex)
+			lp_advertising |= (ADVERTISED_1000baseT_Full |
+					   ADVERTISED_100baseT_Full |
+					   ADVERTISED_10baseT_Full);
+		else
+			lp_advertising |= (ADVERTISED_1000baseT_Half |
+					   ADVERTISED_100baseT_Half |
+					   ADVERTISED_10baseT_Half);
+		cmd->base.port = PORT_OTHER;
+
+		ethtool_convert_legacy_u32_to_link_mode(
+			cmd->link_modes.supported, supported);
+		ethtool_convert_legacy_u32_to_link_mode(
+			cmd->link_modes.advertising, advertising);
+		ethtool_convert_legacy_u32_to_link_mode(
+			cmd->link_modes.lp_advertising, lp_advertising);
+
+		return 0;
+	}
+
+	if (!netif_running(dev))
+		return -EBUSY;
+
+	if (dev->phydev == NULL)
+		return -ENODEV;
+
+	return phylink_ethtool_ksettings_get(priv->phylink, cmd);
+}
+
+static int
+tc956xmac_ethtool_set_link_ksettings(struct net_device *dev,
+				  const struct ethtool_link_ksettings *cmd)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	if (priv->hw->pcs & TC956XMAC_PCS_RGMII ||
+	    priv->hw->pcs & TC956XMAC_PCS_SGMII ||
+	    priv->hw->pcs & TC956XMAC_PCS_USXGMII) {
+		u32 mask = ADVERTISED_Autoneg | ADVERTISED_Pause;
+
+		/* Only support ANE */
+		if (cmd->base.autoneg != AUTONEG_ENABLE)
+			return -EINVAL;
+
+		mask &= (ADVERTISED_1000baseT_Half |
+			ADVERTISED_1000baseT_Full |
+			ADVERTISED_100baseT_Half |
+			ADVERTISED_100baseT_Full |
+			ADVERTISED_10baseT_Half |
+			ADVERTISED_10baseT_Full);
+
+		mutex_lock(&priv->lock);
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+		tc956x_xpcs_ctrl_ane(priv, 1);
+#else
+		tc956xmac_pcs_ctrl_ane(priv, priv->ioaddr, 1, priv->hw->ps, 0);
+#endif
+#endif /* TC956X_SRIOV_VF */
+		mutex_unlock(&priv->lock);
+
+		return 0;
+	}
+	/* Return if Autonegotiation disabled */
+	if (priv->port_num == RM_PF0_ID) {
+		if (cmd->base.autoneg != AUTONEG_ENABLE)
+			return -EINVAL;
+	}
+
+	if (!dev->phydev)
+		return -ENODEV;
+	return phylink_ethtool_ksettings_set(priv->phylink, cmd);
+}
+#endif  /* TC956X_SRIOV_VF */
+static u32 tc956xmac_ethtool_getmsglevel(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	return priv->msg_enable;
+}
+
+static void tc956xmac_ethtool_setmsglevel(struct net_device *dev, u32 level)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	priv->msg_enable = level;
+
+}
+
+static int tc956xmac_check_if_running(struct net_device *dev)
+{
+	if (!netif_running(dev))
+		return -EBUSY;
+	return 0;
+}
+
+static int tc956xmac_ethtool_get_regs_len(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	if (priv->plat->has_xgmac)
+		return XGMAC_REGSIZE * 4;
+	return REG_SPACE_SIZE * sizeof(u32);
+}
+
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_SRIOV_DEBUG
+static u32 rxp_read_frp_stat(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+					    int pos)
+{
+	int ret;
+
+	u32 val;
+
+	/* Wait for ready */
+	ret = readl_poll_timeout(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST,
+			val, !(val & XGMAC_STARTBUSY), 1, 10000);
+	if (ret)
+		return ret;
+
+	/* Write pos */
+	val = pos & XGMAC_ADDR;
+	val |= XGMAC_ACCSEL;
+	writel(val, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+	/* Start Read */
+	val |= XGMAC_STARTBUSY;
+	writel(val, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+	/* Wait for done */
+	ret = readl_poll_timeout(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST,
+			val, !(val & XGMAC_STARTBUSY), 1, 10000);
+	if (ret) {
+		netdev_err(priv->dev, "timeout error\n");
+		return ret;
+	} else
+		return readl(ioaddr + XGMAC_MTL_RXP_IACC_DATA);
+
+}
+
+static void tc956x_read_frp_stats(struct tc956xmac_priv *priv)
+{
+	u32 ch;
+
+	netdev_info(priv->dev, "For MTL_RXP_Drop_Cnt %d", (0x7FFFFFFF & rxp_read_frp_stat(priv, priv->ioaddr, 0)));
+	netdev_info(priv->dev, "For MTL_RXP_Error_Cnt %d", (0x7FFFFFFF & rxp_read_frp_stat(priv, priv->ioaddr, 1)));
+	netdev_info(priv->dev, "For MTL_RXP_Bypass_Cnt %d", (0x7FFFFFFF & rxp_read_frp_stat(priv, priv->ioaddr, 2)));
+
+	for (ch = 0; ch < TC956XMAC_CH_MAX; ch++) {
+		u32 read_pos = (0x40 + (0x10*ch));
+
+		netdev_info(priv->dev, "For DMA_CH%d_RXP_Accept_Cnt %d", ch, (0x7FFFFFFF & rxp_read_frp_stat(priv, priv->ioaddr, read_pos)));
+	}
+}
+#endif /* TC956X_SRIOV_DEBUG */
+#endif /* TC956X_SRIOV_PF */
+
+static void tc956xmac_ethtool_gregs(struct net_device *dev,
+			  struct ethtool_regs *regs, void *space)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	u32 *reg_space = (u32 *) space;
+
+	tc956xmac_dump_mac_regs(priv, priv->hw, reg_space);
+	tc956xmac_dump_dma_regs(priv, priv->ioaddr, reg_space);
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_SRIOV_DEBUG
+	tc956x_read_frp_stats(priv);
+	tc956x_filter_debug(priv);
+#endif
+#endif
+#ifndef TC956X
+	if (!priv->plat->has_xgmac && !priv->plat->has_gmac4) {
+		/* Copy DMA registers to where ethtool expects them */
+		memcpy(&reg_space[ETHTOOL_DMA_OFFSET],
+		       &reg_space[DMA_BUS_MODE / 4],
+		       NUM_DWMAC1000_DMA_REGS * 4);
+	}
+#endif
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+#ifndef TC956X_SRIOV_VF
+static int tc956xmac_nway_reset(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	return phylink_ethtool_nway_reset(priv->phylink);
+}
+#endif  /* TC956X_SRIOV_VF */
+#endif
+
+#ifdef TC956X_SRIOV_VF
+static void
+tc956xmac_get_pauseparam(struct net_device *netdev,
+		      struct ethtool_pauseparam *pause)
+{
+	struct tc956xmac_priv *priv = netdev_priv(netdev);
+
+	tc956xmac_ethtool_get_pauseparam(priv, pause);
+}
+#endif
+#ifndef TC956X_SRIOV_VF
+void
+tc956xmac_get_pauseparam(struct net_device *netdev,
+		      struct ethtool_pauseparam *pause)
+{
+	struct tc956xmac_priv *priv = netdev_priv(netdev);
+	struct rgmii_adv adv_lp;
+
+	if (priv->hw->pcs &&
+	    !tc956xmac_pcs_get_adv_lp(priv, priv->ioaddr, &adv_lp)) {
+		pause->autoneg = 1;
+		if (!adv_lp.pause)
+			return;
+	} else {
+		phylink_ethtool_get_pauseparam(priv->phylink, pause);
+		pause->rx_pause = (priv->flow_ctrl & FLOW_RX);
+		pause->tx_pause = (priv->flow_ctrl & FLOW_TX);
+	}
+}
+#endif
+
+static int
+tc956xmac_set_pauseparam(struct net_device *netdev,
+		      struct ethtool_pauseparam *pause)
+{
+	struct tc956xmac_priv *priv = netdev_priv(netdev);
+	int new_pause = FLOW_OFF;
+	struct rgmii_adv adv_lp;
+	u32 tx_cnt = priv->plat->tx_queues_to_use;
+	struct phy_device *phy = netdev->phydev;
+
+	if (!netdev->phydev)
+		return -ENODEV;
+
+	if ((priv->plat->port_interface == ENABLE_XFI_INTERFACE) && (priv->speed != SPEED_10000) && (!(pause->rx_pause))) {
+		KPRINT_ERR("RX Flow ctrl shouldn't be disabled for 10G lower speed in XFI Interface\n");
+		return -EOPNOTSUPP;
+	}
+
+	if (priv->hw->pcs &&
+	    !tc956xmac_pcs_get_adv_lp(priv, priv->ioaddr, &adv_lp)) {
+		pause->autoneg = 1;
+		if (!adv_lp.pause)
+			return -EOPNOTSUPP;
+		return 0;
+	} else {
+#ifndef TC956X_SRIOV_VF
+		phylink_ethtool_set_pauseparam(priv->phylink, pause);
+#endif  /* TC956X_SRIOV_VF */
+	}
+	if (pause->rx_pause)
+		new_pause |= FLOW_RX;
+	if (pause->tx_pause)
+		new_pause |= FLOW_TX;
+	priv->flow_ctrl = new_pause;
+
+	tc956xmac_flow_ctrl(priv, priv->hw, phy->duplex, priv->flow_ctrl,
+				 priv->pause, tx_cnt);
+	return 0;
+}
+
+#ifndef TC956X_SRIOV_VF
+static void tc956xmac_m3fw_stats_read(struct tc956xmac_priv *priv)
+{
+	u32 rx_queues_count = priv->plat->rx_queues_to_use;
+	u32 tx_queues_count = priv->plat->tx_queues_to_use;
+	u32 chno, reg_val = 0;
+
+	for (chno = 0; chno < tx_queues_count; chno++) {
+		/* Tx Underflow count may not match with actual value, as it is 11bit value
+		 * accumulation happening only when reading ethool statistics, not after overflow of counter
+		 */
+		priv->xstats.mtl_tx_underflow[chno] +=
+			readl(priv->ioaddr + XGMAC_MTL_TXQ_UFPKT_CNT(chno));
+	}
+	for (chno = 0; chno < rx_queues_count; chno++) {
+		/* Rx overflow/missed pkt count may not match with actual values, as these are 11bit values
+		 * accumulation happening only when reading ethool statistics, not after overflow of counters
+		 */
+		reg_val = readl(priv->ioaddr + XGMAC_MTL_RXQ_MISS_PKT_OF_CNT_OFFSET(chno));
+
+		priv->xstats.mtl_rx_miss_pkt_cnt[chno] += ((reg_val & XGMAC_MISPKTCNT_MASK) >>
+								XGMAC_MISPKTCNT_SHIFT);
+
+		priv->xstats.mtl_rx_overflow_pkt_cnt[chno] += (reg_val & XGMAC_OVFPKTCNT_MASK);
+
+		priv->xstats.rxch_watchdog_timer[chno] =
+			readl(priv->ioaddr + XGMAC_DMA_CH_Rx_WATCHDOG(chno));
+	}
+	/* Reading M3 Debug Counters*/
+	priv->xstats.m3_debug_cnt0 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT0)));
+	priv->xstats.m3_debug_cnt1 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT1)));
+	priv->xstats.m3_debug_cnt2 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT2)));
+	priv->xstats.m3_debug_cnt3 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT3)));
+	priv->xstats.m3_debug_cnt4 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT4)));
+	priv->xstats.m3_debug_cnt5 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT5)));
+	priv->xstats.m3_debug_cnt6 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT6)));
+	priv->xstats.m3_debug_cnt7 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT7)));
+	priv->xstats.m3_debug_cnt8 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT8)));
+	priv->xstats.m3_debug_cnt9 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT9)));
+	priv->xstats.m3_debug_cnt10 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT10)));
+	priv->xstats.m3_watchdog_exp_cnt = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT11)));
+	priv->xstats.m3_watchdog_monitor_cnt = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT12)));
+	priv->xstats.m3_debug_cnt13 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT13)));
+	priv->xstats.m3_debug_cnt14 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT14)));
+	priv->xstats.m3_systick_cnt_upper_value = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT16)));
+	priv->xstats.m3_systick_cnt_lower_value = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT15)));
+	priv->xstats.m3_tx_timeout_port0 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT17)));
+	priv->xstats.m3_tx_timeout_port1 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT18)));
+	priv->xstats.m3_debug_cnt19 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT19)));
+	for (chno = 0; chno < tx_queues_count; chno++) {
+		priv->xstats.m3_tx_pcie_addr_loc_port0[chno] = readl(priv->tc956x_SRAM_pci_base_addr +
+				(SRAM_TX_PCIE_ADDR_LOC + (chno * 4)));
+	}
+	for (chno = 0; chno < tx_queues_count; chno++) {
+		priv->xstats.m3_tx_pcie_addr_loc_port1[chno] = readl(priv->tc956x_SRAM_pci_base_addr +
+				(SRAM_TX_PCIE_ADDR_LOC + (TC956XMAC_CH_MAX * 4) + (chno * 4)));
+	}
+	for (chno = 0; chno < rx_queues_count; chno++) {
+		priv->xstats.m3_rx_pcie_addr_loc_port0[chno] = readl(priv->tc956x_SRAM_pci_base_addr +
+				(SRAM_RX_PCIE_ADDR_LOC + (chno * 4)));
+	}
+	for (chno = 0; chno < rx_queues_count; chno++) {
+		priv->xstats.m3_rx_pcie_addr_loc_port1[chno] = readl(priv->tc956x_SRAM_pci_base_addr +
+				(SRAM_RX_PCIE_ADDR_LOC + (TC956XMAC_CH_MAX * 4) + (chno * 4)));
+	}
+
+}
+#endif
+
+static void tc956xmac_get_ethtool_stats(struct net_device *dev,
+				 struct ethtool_stats *dummy, u64 *data)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	u32 rx_queues_count = priv->plat->rx_queues_to_use;
+	u32 tx_queues_count = priv->plat->tx_queues_to_use;
+#ifndef TC956X_SRIOV_VF
+	unsigned long count;
+#endif
+	int i, j = 0;
+#ifndef TC956X_SRIOV_VF
+	int ret;
+#endif
+
+#ifdef TC956X_SRIOV_VF
+
+	/* Copy only the SW stats for VF driver */
+	for (i = 0; i < TC956X_SW_STATS_LEN; i++) {
+		char *p;
+
+		p = (char *)priv + tc956x_sw[i].stat_offset;
+
+		data[j++] = (tc956x_sw[i].sizeof_stat ==
+			     sizeof(u64)) ? (*(u64 *)p) :
+			     (*(u32 *)p);
+	}
+
+	if (priv->synopsys_id >= DWMAC_CORE_3_50 ||
+			priv->synopsys_id == DWXGMAC_CORE_3_01) {
+		tc956xmac_mac_debug(priv, priv->ioaddr,
+				(void *)&priv->xstats,
+				rx_queues_count, tx_queues_count);
+
+		tc956xmac_dma_desc_stats(priv, priv->ioaddr);
+	}
+
+	for (i = 0; i < TC956XMAC_STATS_LEN; i++) {
+		char *p = (char *)priv + tc956xmac_gstrings_stats[i].stat_offset;
+
+		data[j++] = (tc956xmac_gstrings_stats[i].sizeof_stat ==
+			     sizeof(u64)) ? (*(u64 *)p) : (*(u32 *)p);
+	}
+#else
+	if (priv->dma_cap.asp) {
+		for (i = 0; i < TC956XMAC_SAFETY_FEAT_SIZE; i++) {
+			if (!tc956xmac_safety_feat_dump(priv, &priv->sstats, i,
+						&count, NULL))
+				data[j++] = count;
+		}
+	}
+
+	/* Update the DMA HW counters for dwmac10/100 */
+	ret = tc956xmac_dma_diagnostic_fr(priv, &dev->stats,
+					(void *)&priv->xstats, priv->ioaddr);
+	if (ret) {
+		/* If supported, for new GMAC chips expose the MMC counters */
+		if (priv->dma_cap.rmon) {
+			tc956xmac_mmc_read(priv, priv->mmcaddr, &priv->mmc);
+
+			for (i = 0; i < TC956XMAC_MMC_STATS_LEN; i++) {
+				char *p;
+
+				p = (char *)priv + tc956xmac_mmc[i].stat_offset;
+
+				data[j++] = (tc956xmac_mmc[i].sizeof_stat ==
+					     sizeof(u64)) ? (*(u64 *)p) :
+					     (*(u32 *)p);
+			}
+		}
+#ifndef TC956X_SRIOV_VF
+		if (priv->eee_enabled) {
+			int val = phylink_get_eee_err(priv->phylink);
+
+			if (val)
+				priv->xstats.phy_eee_wakeup_error_n = val;
+		}
+#endif  /* TC956X_SRIOV_VF */
+		if (priv->synopsys_id >= DWMAC_CORE_3_50 ||
+			priv->synopsys_id == DWXGMAC_CORE_3_01) {
+			tc956xmac_mac_debug(priv, priv->ioaddr,
+					(void *)&priv->xstats,
+					rx_queues_count, tx_queues_count);
+
+			tc956xmac_dma_desc_stats(priv, priv->ioaddr);
+		}
+	}
+	tc956xmac_m3fw_stats_read(priv);
+	for (i = 0; i < TC956XMAC_STATS_LEN; i++) {
+		char *p = (char *)priv + tc956xmac_gstrings_stats[i].stat_offset;
+
+		data[j++] = (tc956xmac_gstrings_stats[i].sizeof_stat ==
+			     sizeof(u64)) ? (*(u64 *)p) : (*(u32 *)p);
+	}
+#endif
+}
+
+static int tc956xmac_get_sset_count(struct net_device *netdev, int sset)
+{
+	struct tc956xmac_priv *priv = netdev_priv(netdev);
+#ifdef TC956X_SRIOV_VF
+	int len;
+#else
+	int i, len, safety_len = 0;
+#endif
+
+	switch (sset) {
+	case ETH_SS_STATS:
+#ifdef TC956X_SRIOV_VF
+		len = TC956X_SW_STATS_LEN + TC956XMAC_STATS_LEN;
+#else
+		len = TC956XMAC_STATS_LEN;
+
+		if (priv->dma_cap.rmon)
+			len += TC956XMAC_MMC_STATS_LEN;
+		if (priv->dma_cap.asp) {
+			for (i = 0; i < TC956XMAC_SAFETY_FEAT_SIZE; i++) {
+				if (!tc956xmac_safety_feat_dump(priv,
+							&priv->sstats, i,
+							NULL, NULL))
+					safety_len++;
+			}
+
+			len += safety_len;
+		}
+#endif
+		return len;
+	case ETH_SS_TEST:
+		return tc956xmac_selftest_get_count(priv);
+	case ETH_SS_PRIV_FLAGS:
+		return TC956X_PRIV_FLAGS_STR_LEN;
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+
+static void tc956xmac_get_strings(struct net_device *dev, u32 stringset, u8 *data)
+{
+	int i;
+	u8 *p = data;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	switch (stringset) {
+	case ETH_SS_STATS:
+#ifdef TC956X_SRIOV_VF
+		for (i = 0; i < TC956X_SW_STATS_LEN; i++) {
+			memcpy(p, tc956x_sw[i].stat_string,
+				ETH_GSTRING_LEN);
+			p += ETH_GSTRING_LEN;
+		}
+#else
+		if (priv->dma_cap.asp) {
+			for (i = 0; i < TC956XMAC_SAFETY_FEAT_SIZE; i++) {
+				const char *desc;
+
+				if (!tc956xmac_safety_feat_dump(priv,
+							&priv->sstats, i,
+							NULL, &desc)) {
+					memcpy(p, desc, ETH_GSTRING_LEN);
+					p += ETH_GSTRING_LEN;
+				}
+			}
+		}
+		if (priv->dma_cap.rmon)
+			for (i = 0; i < TC956XMAC_MMC_STATS_LEN; i++) {
+				memcpy(p, tc956xmac_mmc[i].stat_string,
+				       ETH_GSTRING_LEN);
+				p += ETH_GSTRING_LEN;
+			}
+#endif
+		for (i = 0; i < TC956XMAC_STATS_LEN; i++) {
+			memcpy(p, tc956xmac_gstrings_stats[i].stat_string,
+				ETH_GSTRING_LEN);
+			p += ETH_GSTRING_LEN;
+		}
+
+		break;
+	case ETH_SS_TEST:
+		tc956xmac_selftest_get_strings(priv, p);
+		break;
+	case ETH_SS_PRIV_FLAGS:
+		memcpy(data, tc956x_priv_flags_strings,
+				TC956X_PRIV_FLAGS_STR_LEN * ETH_GSTRING_LEN);
+		break;
+	default:
+		WARN_ON(1);
+		break;
+	}
+}
+
+#ifndef TC956X_SRIOV_VF
+
+static void tc956xmac_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	if (device_can_wakeup(priv->device))
+		phylink_ethtool_get_wol(priv->phylink, wol);
+}
+
+static int tc956xmac_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	u32 support = (WAKE_MAGIC | WAKE_PHY);
+	int ret;
+
+	if (!device_can_wakeup(priv->device))
+		return -EINVAL;
+
+	if (wol->wolopts & ~support)
+		return -EINVAL;
+
+	ret = phylink_ethtool_set_wol(priv->phylink, wol);
+	if (!ret)
+		device_set_wakeup_enable(priv->device, wol->wolopts);
+	else
+		return ret;
+
+	mutex_lock(&priv->lock);
+	priv->wolopts = wol->wolopts;
+	mutex_unlock(&priv->lock);
+
+	return ret;
+}
+
+/* Added Support for 5G and 2.5G EEE support */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+/**
+ * mii_eee_cap2_mod_linkmode_t_local()
+ * @adv: target the linkmode advertisement settings
+ * @val: register value
+ */
+static inline void mii_eee_cap2_mod_linkmode_t_local(unsigned long *adv, u32 val)
+{
+	linkmode_mod_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+			 adv, val & MDIO_EEE_2_5GT);
+	linkmode_mod_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+			 adv, val & MDIO_EEE_5GT);
+}
+
+/**
+ * genphy_c45_read_eee_adv_local - read advertised EEE link modes
+ * @phydev: target phy_device struct
+ * @adv: the linkmode advertisement status
+ */
+int genphy_c45_read_eee_adv_local(struct phy_device *phydev, unsigned long *adv)
+{
+	int val;
+
+	if (linkmode_intersects(phydev->supported_eee, PHY_EEE_CAP1_FEATURES)) {
+		/* IEEE 802.3-2018 45.2.7.13 EEE advertisement 1
+		 * (Register 7.60)
+		 */
+		val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV);
+		if (val < 0)
+			return val;
+
+		mii_eee_cap1_mod_linkmode_t(adv, val);
+	}
+
+	/* IEEE 802.3-2018 45.2.7.13 EEE advertisement 1
+	 * (Register 7.60)
+	 */
+	val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV2);
+	if (val < 0)
+		return val;
+
+	mii_eee_cap2_mod_linkmode_t_local(adv, val);
+
+	return 0;
+}
+
+/**
+ * genphy_c45_read_eee_lpa_local - read advertised LP EEE link modes
+ * @phydev: target phy_device struct
+ * @lpa: the linkmode LP advertisement status
+ */
+static int genphy_c45_read_eee_lpa_local(struct phy_device *phydev,
+				   unsigned long *lpa)
+{
+	int val;
+
+	if (linkmode_intersects(phydev->supported_eee, PHY_EEE_CAP1_FEATURES)) {
+		/* IEEE 802.3-2018 45.2.7.14 EEE link partner ability 1
+		 * (Register 7.61)
+		 */
+		val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_LPABLE);
+		if (val < 0)
+			return val;
+
+		mii_eee_cap1_mod_linkmode_t(lpa, val);
+	}
+
+	val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_LPABLE2);
+	if (val < 0)
+		return val;
+
+	mii_eee_cap2_mod_linkmode_t_local(lpa, val);
+
+	return 0;
+}
+
+/**
+ * genphy_c45_eee_is_active_local - get EEE status
+ * @phydev: target phy_device struct
+ * @adv: variable to store advertised linkmodes
+ * @lp: variable to store LP advertised linkmodes
+ * @is_enabled: variable to store EEE enabled/disabled configuration value
+ *
+ * Description: this function will read local and link partner PHY
+ * advertisements. Compare them return current EEE state.
+ */
+int genphy_c45_eee_is_active_local(struct phy_device *phydev, unsigned long *adv,
+			     unsigned long *lp, bool *is_enabled)
+{
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(tmp_adv) = {};
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(tmp_lp) = {};
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(common);
+	bool eee_enabled, eee_active;
+	int ret;
+
+	ret = genphy_c45_read_eee_adv_local(phydev, tmp_adv);
+	if (ret)
+		return ret;
+
+	ret = genphy_c45_read_eee_lpa_local(phydev, tmp_lp);
+	if (ret)
+		return ret;
+
+	eee_enabled = !linkmode_empty(tmp_adv);
+	linkmode_and(common, tmp_adv, tmp_lp);
+	if (eee_enabled && !linkmode_empty(common))
+		eee_active = phy_check_valid(phydev->speed, phydev->duplex,
+					     common);
+	else
+		eee_active = false;
+
+	if (adv)
+		linkmode_copy(adv, tmp_adv);
+	if (lp)
+		linkmode_copy(lp, tmp_lp);
+	if (is_enabled)
+		*is_enabled = eee_enabled;
+
+	return eee_active;
+}
+
+/**
+ * genphy_c45_ethtool_get_eee_local - get EEE supported and status
+ * @phydev: target phy_device struct
+ * @data: ethtool_eee data
+ *
+ * Description: it reports the Supported/Advertisement/LP Advertisement
+ * capabilities.
+ */
+int genphy_c45_ethtool_get_eee_local(struct phy_device *phydev,
+			       struct ethtool_eee *data)
+{
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(adv) = {};
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(lp) = {};
+	bool overflow = false, is_enabled;
+	int ret;
+
+	ret = genphy_c45_eee_is_active_local(phydev, adv, lp, &is_enabled);
+	if (ret < 0)
+		return ret;
+
+	data->eee_enabled = is_enabled;
+	data->eee_active = ret;
+
+	if (!ethtool_convert_link_mode_to_legacy_u32(&data->supported,
+						     phydev->supported_eee))
+		overflow = true;
+	if (!ethtool_convert_link_mode_to_legacy_u32(&data->advertised, adv))
+		overflow = true;
+	if (!ethtool_convert_link_mode_to_legacy_u32(&data->lp_advertised, lp))
+		overflow = true;
+
+	if (overflow)
+		phydev_warn(phydev, "Not all supported or advertised EEE link modes were passed to the user space\n");
+
+	return 0;
+}
+
+/**
+ * phy_ethtool_get_eee_local - get EEE supported and status
+ * @phydev: target phy_device struct
+ * @data: ethtool_eee data
+ *
+ * Description: it reportes the Supported/Advertisement/LP Advertisement
+ * capabilities.
+ */
+int phy_ethtool_get_eee_local(struct phy_device *phydev, struct ethtool_eee *data)
+{
+	int ret;
+
+	if (!phydev->drv)
+		return -EIO;
+
+	mutex_lock(&phydev->lock);
+	ret = genphy_c45_ethtool_get_eee_local(phydev, data);
+	mutex_unlock(&phydev->lock);
+
+	return ret;
+}
+
+/**
+ * phylink_ethtool_get_eee_local() - read the energy efficient ethernet parameters
+ * @pl: a pointer to a &struct phylink returned from phylink_create()
+ * @eee: a pointer to a &struct ethtool_eee for the read parameters
+ */
+int phylink_ethtool_get_eee_local(struct phy_device *phydev, struct ethtool_eee *eee)
+{
+	int ret = -EOPNOTSUPP;
+
+	ASSERT_RTNL();
+
+	if (phydev)
+		ret = phy_ethtool_get_eee_local(phydev, eee);
+
+	return ret;
+}
+#endif
+#ifdef DEBUG_EEE
+int phy_ethtool_get_eee_local(struct phy_device *phydev, struct ethtool_eee *data)
+{
+	int val;
+
+	if (!phydev->drv)
+		return -EIO;
+
+	/* Get Supported EEE */
+	val = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE);
+	KPRINT_INFO("%s --- cap: 0x%x\n", __func__, val);
+	if (val < 0)
+		return val;
+	data->supported = mmd_eee_cap_to_ethtool_sup_t(val);
+
+	/* Get advertisement EEE */
+	val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV);
+	if (val < 0)
+		return val;
+
+	KPRINT_INFO("%s --- adv: 0x%x\n", __func__, val);
+
+	data->advertised = mmd_eee_adv_to_ethtool_adv_t(val);
+	data->eee_enabled = !!data->advertised;
+
+	/* Get LP advertisement EEE */
+	val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_LPABLE);
+	if (val < 0)
+		return val;
+	KPRINT_INFO("%s --- lp_adv: 0x%x\n", __func__, val);
+
+	data->lp_advertised = mmd_eee_adv_to_ethtool_adv_t(val);
+
+	KPRINT_INFO("%s --- data->advertised: 0x%x\n", __func__, data->advertised);
+	KPRINT_INFO("%s --- data->lp_advertised: 0x%x\n", __func__, data->lp_advertised);
+
+	data->eee_active = !!(data->advertised & data->lp_advertised);
+
+
+	KPRINT_INFO("%s --- data->eee_enabled: 0x%x\n", __func__, data->eee_enabled);
+	KPRINT_INFO("%s --- data->eee_active: 0x%x\n", __func__, data->eee_active);
+
+	return 0;
+}
+int phy_ethtool_set_eee_local(struct phy_device *phydev, struct ethtool_eee *data)
+{
+	int cap, old_adv, adv = 0, ret;
+#ifdef TC956X_5_G_2_5_G_EEE_SUPPORT
+	int cap2p5, old_adv_2p5, adv_2p5 = 0;
+#endif
+	if (!phydev->drv)
+		return -EIO;
+
+	/* Get Supported EEE */
+	cap = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE);
+	KPRINT_INFO("%s --- cap: 0x%x\n", __func__, cap);
+	if (cap < 0)
+		return cap;
+
+
+	old_adv = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV);
+	KPRINT_INFO("%s --- old_adv:0x%x\n", __func__, old_adv);
+	if (old_adv < 0)
+		return old_adv;
+
+
+	if (data->eee_enabled) {
+		adv = !data->advertised ? cap :
+		      ethtool_adv_to_mmd_eee_adv_t(data->advertised) & cap;
+		/* Mask prohibited EEE modes */
+		adv &= ~phydev->eee_broken_modes;
+	}
+	KPRINT_INFO("%s --- adv:0x%x\n", __func__, adv);
+
+	if (old_adv != adv) {
+		ret = phy_write_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV, adv);
+		if (ret < 0)
+			return ret;
+
+		ret = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV);
+		KPRINT_INFO("%s --- readback adv:0x%x\n", __func__, ret);
+		if (ret < 0)
+			return ret;
+
+
+		/* Restart autonegotiation so the new modes get sent to the
+		 * link partner.
+		 */
+		if (phydev->autoneg == AUTONEG_ENABLE) {
+			ret = phy_restart_aneg(phydev);
+			if (ret < 0)
+				return ret;
+		}
+	}
+#ifdef TC956X_5_G_2_5_G_EEE_SUPPORT
+	cap2p5 = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE2);
+	KPRINT_INFO("%s --- cap2p5: 0x%x\n", __func__, cap2p5);
+	if (cap < 0)
+		return cap;
+
+	old_adv_2p5 = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV2);
+	KPRINT_INFO("%s --- old_adv_2p5:0x%x\n", __func__, old_adv_2p5);
+	if (old_adv_2p5 < 0)
+		return old_adv_2p5;
+
+	if (data->eee_enabled) {
+		adv_2p5 = !data->advertised ? cap2p5 :
+		      ethtool_adv_to_mmd_eee_adv_t(data->advertised) & cap2p5;
+		/* Mask prohibited EEE modes */
+		adv_2p5 &= ~phydev->eee_broken_modes;
+	}
+	KPRINT_INFO("%s --- adv_2p5:0x%x\n", __func__, adv_2p5);
+
+	if (old_adv_2p5 != adv_2p5) {
+		ret = phy_write_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV2, adv_2p5);
+		if (ret < 0)
+			return ret;
+
+		/* Restart autonegotiation so the new modes get sent to the
+		 * link partner.
+		 */
+		if (phydev->autoneg == AUTONEG_ENABLE) {
+			ret = phy_restart_aneg(phydev);
+			if (ret < 0)
+				return ret;
+		}
+	}
+#endif
+	return 0;
+}
+
+#endif
+
+#ifdef TC956X_5_G_2_5_G_EEE_SUPPORT
+
+static inline u16 tc956x_ethtool_adv_to_mmd_eee_adv2_t(u32 adv)
+{
+	u16 reg = 0;
+
+	if (adv & TC956X_ADVERTISED_2500baseT_Full)
+		reg |= MDIO_EEE_2_5GT;
+	if (adv & TC956X_ADVERTISED_5000baseT_Full)
+		reg |= MDIO_EEE_5GT;
+
+	return reg;
+}
+
+int phy_ethtool_set_eee_2p5(struct phy_device *phydev, struct ethtool_eee *data)
+{
+	int ret;
+	int cap2p5, old_adv_2p5, adv_2p5 = 0;
+
+	if (!phydev->drv)
+		return -EIO;
+
+	cap2p5 = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE2);
+	KPRINT_INFO("%s --- cap2p5: 0x%x\n", __func__, cap2p5);
+	if (cap2p5 < 0)
+		return cap2p5;
+
+	old_adv_2p5 = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV2);
+	KPRINT_INFO("%s --- old_adv_2p5:0x%x\n", __func__, old_adv_2p5);
+	if (old_adv_2p5 < 0)
+		return old_adv_2p5;
+	/* EEE advertise checking API corrected for 2.5G and 5G speeds. */
+	if (data->eee_enabled) {
+		adv_2p5 = !data->advertised ? cap2p5 :
+		      tc956x_ethtool_adv_to_mmd_eee_adv2_t(data->advertised) & cap2p5;
+		/* Mask prohibited EEE modes */
+		adv_2p5 &= ~phydev->eee_broken_modes;
+	}
+	KPRINT_INFO("%s --- adv_2p5:0x%x\n", __func__, adv_2p5);
+
+	if (old_adv_2p5 != adv_2p5) {
+		ret = phy_write_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV2, adv_2p5);
+		if (ret < 0)
+			return ret;
+
+		/* Restart autonegotiation so the new modes get sent to the
+		 * link partner.
+		 */
+		if (phydev->autoneg == AUTONEG_ENABLE) {
+			ret = phy_restart_aneg(phydev);
+			if (ret < 0)
+				return ret;
+		}
+	}
+	return 0;
+}
+#endif
+
+int tc956xmac_ethtool_op_get_eee(struct net_device *dev,
+				     struct ethtool_eee *edata)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	int ret;
+
+	if (!priv->dma_cap.eee)
+		return -EOPNOTSUPP;
+
+	edata->eee_enabled = priv->eee_enabled;
+	edata->eee_active = priv->eee_active;
+	edata->tx_lpi_timer = priv->tx_lpi_timer;
+	edata->tx_lpi_enabled = edata->eee_enabled;
+
+	DBGPR_FUNC(priv->device, "1--> %s edata->eee_active: %d\n", __func__, edata->eee_active);
+#ifndef DEBUG_EEE
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+	/* From Kernel Version 6.3 and above, the current speed will be checked for EEE advertisement
+	 * EEE adverstise and LP registers, are checked only for 10G and 1G speed in Kernel API.
+	 * So, added a local API to check the advertise and LP for 5G and 2.5G Speeds for EEE support.
+	 */
+	ret = phylink_ethtool_get_eee_local(priv->dev->phydev, edata);
+#else
+	ret = phylink_ethtool_get_eee(priv->phylink, edata);
+#endif
+#else
+	if (!priv->dev->phydev)
+		return -EIO;
+
+	ret = phy_ethtool_get_eee_local(priv->dev->phydev, edata);
+#endif
+	DBGPR_FUNC(priv->device, "2--> %s edata->eee_active: %d\n", __func__, edata->eee_active);
+
+	return ret;
+}
+#endif
+#ifdef TC956X_SRIOV_VF
+static int tc956xmac_ethtool_op_get_eee(struct net_device *dev,
+				     struct ethtool_eee *edata)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	tc956xmac_ethtool_get_eee(priv, edata);
+
+	return 0;
+}
+#endif
+static int tc956xmac_ethtool_op_set_eee(struct net_device *dev,
+				     struct ethtool_eee *edata)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#ifndef TC956X_SRIOV_VF
+	int ret;
+#endif
+
+	if (!priv->dev->phydev)
+		return -EIO;
+
+	if (!edata->eee_enabled) {
+		DBGPR_FUNC(priv->device, "%s Disable EEE\n", __func__);
+		tc956xmac_disable_eee_mode(priv);
+	} else {
+		DBGPR_FUNC(priv->device, "%s Enable EEE\n", __func__);
+		/* We are asking for enabling the EEE but it is safe
+		 * to verify all by invoking the eee_init function.
+		 * In case of failure it will return an error.
+		 */
+		if (priv->tx_lpi_timer != edata->tx_lpi_timer) {
+			if (edata->tx_lpi_timer > TC956X_MAX_LPI_AUTO_ENTRY_TIMER) {
+				DBGPR_FUNC(priv->device, "%s Error : Maximum LPI Auto Entry Time Supported %d\n",
+					__func__, TC956X_MAX_LPI_AUTO_ENTRY_TIMER);
+				return -EINVAL;
+			}
+			priv->tx_lpi_timer = edata->tx_lpi_timer;
+		}
+
+		edata->eee_enabled = tc956xmac_eee_init(priv);
+		if (!edata->eee_enabled)
+			return -EOPNOTSUPP;
+	}
+#ifndef TC956X_SRIOV_VF
+#ifndef DEBUG_EEE
+	ret = phylink_ethtool_set_eee(priv->phylink, edata);
+
+	ret |= phy_ethtool_set_eee_2p5(priv->dev->phydev, edata);
+#else
+	ret = phy_ethtool_set_eee_local(priv->dev->phydev, edata);
+#endif
+	if (ret)
+		return ret;
+#endif  /* TC956X_SRIOV_VF */
+	priv->eee_enabled = edata->eee_enabled;
+	priv->tx_lpi_timer = edata->tx_lpi_timer;
+
+	DBGPR_FUNC(priv->device, "1--> %s priv->eee_enabled: %d\n", __func__, priv->eee_enabled);
+
+	return 0;
+}
+
+static u32 tc956xmac_usec2riwt(u32 usec, struct tc956xmac_priv *priv)
+{
+	unsigned long clk = clk_get_rate(priv->plat->tc956xmac_clk);
+	u32 value, mult = 256;
+
+	if (!clk) {
+		clk = TC956X_PTP_SYSCLOCK;
+		if (!clk)
+			return 0;
+	}
+
+	for (mult = 256; mult <= 2048; mult *= 2) {
+		value = (usec * (clk / 1000000)) / mult;
+		if (value <= 0xff)
+			break;
+	}
+
+	return value;
+}
+
+static u32 tc956xmac_riwt2usec(u32 riwt, struct tc956xmac_priv *priv)
+{
+	unsigned long clk = clk_get_rate(priv->plat->tc956xmac_clk);
+	u32 mult = 256;
+
+	if (!clk) {
+		clk = TC956X_PTP_SYSCLOCK;
+		if (!clk)
+			return 0;
+	}
+
+	if (riwt > (1024 * 0xff))
+		mult = 2048;
+	else if (riwt > (512 * 0xff))
+		mult = 1024;
+	else if (riwt > (256 * 0xff))
+		mult = 512;
+	else
+		mult = 256;
+
+	return (riwt * mult) / (clk / 1000000);
+}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+static int __tc956xmac_get_coalesce(struct net_device *dev,
+				 struct ethtool_coalesce *ec,
+				 int queue)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	u32 max_cnt;
+	u32 rx_cnt;
+	u32 tx_cnt;
+
+	rx_cnt = priv->plat->rx_queues_to_use;
+	tx_cnt = priv->plat->tx_queues_to_use;
+	max_cnt = max(rx_cnt, tx_cnt);
+
+	if (queue < 0)
+		queue = 0;
+	else if (queue >= max_cnt)
+		return -EINVAL;
+
+	if (queue < tx_cnt) {
+		ec->tx_coalesce_usecs = priv->tx_coal_timer[queue];
+		ec->tx_max_coalesced_frames = priv->tx_coal_frames[queue];
+	} else {
+		ec->tx_coalesce_usecs = 0;
+		ec->tx_max_coalesced_frames = 0;
+	}
+
+	if (priv->use_riwt && queue < rx_cnt) {
+		ec->rx_max_coalesced_frames = priv->rx_coal_frames[queue];
+		ec->rx_coalesce_usecs = tc956xmac_riwt2usec(priv->rx_riwt[queue],
+							 priv);
+	} else {
+		ec->rx_max_coalesced_frames = 0;
+		ec->rx_coalesce_usecs = 0;
+	}
+
+	return 0;
+}
+
+static int tc956xmac_get_coalesce(struct net_device *dev,
+			       struct ethtool_coalesce *ec,
+			       struct kernel_ethtool_coalesce *kernel_coal,
+			       struct netlink_ext_ack *extack)
+{
+	return __tc956xmac_get_coalesce(dev, ec, -1);
+}
+
+static int __tc956xmac_set_coalesce(struct net_device *dev,
+				 struct ethtool_coalesce *ec,
+				 int queue)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	bool all_queues = false;
+	unsigned int rx_riwt;
+	u32 max_cnt;
+	u32 rx_cnt;
+	u32 tx_cnt;
+
+	rx_cnt = priv->plat->rx_queues_to_use;
+	tx_cnt = priv->plat->tx_queues_to_use;
+	max_cnt = max(rx_cnt, tx_cnt);
+
+	if (queue < 0)
+		all_queues = true;
+	else if (queue >= max_cnt)
+		return -EINVAL;
+
+	if (priv->use_riwt && (ec->rx_coalesce_usecs > 0)) {
+		rx_riwt = tc956xmac_usec2riwt(ec->rx_coalesce_usecs, priv);
+
+		if ((rx_riwt > MAX_DMA_RIWT) || (rx_riwt < MIN_DMA_RIWT))
+			return -EINVAL;
+
+		if (all_queues) {
+			int i;
+
+			for (i = 0; i < rx_cnt; i++) {
+				priv->rx_riwt[i] = rx_riwt;
+				tc956xmac_rx_watchdog(priv, priv->ioaddr,
+						   rx_riwt, i);
+				priv->rx_coal_frames[i] =
+					ec->rx_max_coalesced_frames;
+			}
+		} else if (queue < rx_cnt) {
+			priv->rx_riwt[queue] = rx_riwt;
+			tc956xmac_rx_watchdog(priv, priv->ioaddr,
+					   rx_riwt, queue);
+			priv->rx_coal_frames[queue] =
+				ec->rx_max_coalesced_frames;
+		}
+	}
+
+	if ((ec->tx_coalesce_usecs == 0) &&
+	    (ec->tx_max_coalesced_frames == 0))
+		return -EINVAL;
+
+	if ((ec->tx_coalesce_usecs > TC956XMAC_MAX_COAL_TX_TICK) ||
+	    (ec->tx_max_coalesced_frames > TC956XMAC_TX_MAX_FRAMES))
+		return -EINVAL;
+
+	if (all_queues) {
+		int i;
+
+		for (i = 0; i < tx_cnt; i++) {
+			priv->tx_coal_frames[i] =
+				ec->tx_max_coalesced_frames;
+			priv->tx_coal_timer[i] =
+				ec->tx_coalesce_usecs;
+		}
+	} else if (queue < tx_cnt) {
+		priv->tx_coal_frames[queue] =
+			ec->tx_max_coalesced_frames;
+		priv->tx_coal_timer[queue] =
+			ec->tx_coalesce_usecs;
+	}
+
+	return 0;
+}
+
+static int tc956xmac_set_coalesce(struct net_device *dev,
+			       struct ethtool_coalesce *ec,
+			       struct kernel_ethtool_coalesce *kernel_coal,
+			       struct netlink_ext_ack *extack)
+{
+	return __tc956xmac_set_coalesce(dev, ec, -1);
+}
+#else
+static int tc956xmac_get_coalesce(struct net_device *dev,
+			       struct ethtool_coalesce *ec)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	ec->tx_coalesce_usecs = priv->tx_coal_timer;
+	ec->tx_max_coalesced_frames = priv->tx_coal_frames;
+
+	if (priv->use_riwt) {
+		ec->rx_max_coalesced_frames = priv->rx_coal_frames;
+		ec->rx_coalesce_usecs = tc956xmac_riwt2usec(priv->rx_riwt, priv);
+	}
+
+	return 0;
+}
+
+static int tc956xmac_set_coalesce(struct net_device *dev,
+			       struct ethtool_coalesce *ec)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	u32 rx_cnt = priv->plat->rx_queues_to_use;
+	unsigned int rx_riwt;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 7, 0)
+	/* Check not supported parameters  */
+	if ((ec->rx_coalesce_usecs_irq) ||
+	    (ec->rx_max_coalesced_frames_irq) || (ec->tx_coalesce_usecs_irq) ||
+	    (ec->use_adaptive_rx_coalesce) || (ec->use_adaptive_tx_coalesce) ||
+	    (ec->pkt_rate_low) || (ec->rx_coalesce_usecs_low) ||
+	    (ec->rx_max_coalesced_frames_low) || (ec->tx_coalesce_usecs_high) ||
+	    (ec->tx_max_coalesced_frames_low) || (ec->pkt_rate_high) ||
+	    (ec->tx_coalesce_usecs_low) || (ec->rx_coalesce_usecs_high) ||
+	    (ec->rx_max_coalesced_frames_high) ||
+	    (ec->tx_max_coalesced_frames_irq) ||
+	    (ec->stats_block_coalesce_usecs) ||
+	    (ec->tx_max_coalesced_frames_high) || (ec->rate_sample_interval))
+		return -EOPNOTSUPP;
+#endif
+
+	if (priv->use_riwt && (ec->rx_coalesce_usecs > 0)) {
+		rx_riwt = tc956xmac_usec2riwt(ec->rx_coalesce_usecs, priv);
+
+		if ((rx_riwt > MAX_DMA_RIWT) || (rx_riwt < MIN_DMA_RIWT)) {
+			KPRINT_DEBUG1("Invalid rx_usecs value 0x%X\n", ec->rx_coalesce_usecs);
+			return -EINVAL;
+		}
+
+		priv->rx_riwt = rx_riwt;
+		tc956xmac_rx_watchdog(priv, priv->ioaddr, priv->rx_riwt, rx_cnt);
+	}
+
+	if (ec->rx_max_coalesced_frames > TC956XMAC_RX_MAX_FRAMES) {
+		KPRINT_DEBUG1("Invalid rx_frames value 0x%X\n", ec->rx_max_coalesced_frames);
+		return -EINVAL;
+	}
+
+	if ((ec->tx_coalesce_usecs == 0) &&
+	    (ec->tx_max_coalesced_frames == 0))
+		return -EINVAL;
+
+	if ((ec->tx_coalesce_usecs > TC956XMAC_MAX_COAL_TX_TICK) ||
+	    (ec->tx_max_coalesced_frames > TC956XMAC_TX_MAX_FRAMES))
+		return -EINVAL;
+
+	/* Only copy relevant parameters, ignore all others. */
+	priv->tx_coal_frames = ec->tx_max_coalesced_frames;
+	priv->tx_coal_timer = ec->tx_coalesce_usecs;
+	priv->rx_coal_frames = ec->rx_max_coalesced_frames;
+	return 0;
+}
+#endif
+#ifndef TC956X
+static int tc956xmac_get_rxnfc(struct net_device *dev,
+			    struct ethtool_rxnfc *rxnfc, u32 *rule_locs)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	switch (rxnfc->cmd) {
+	case ETHTOOL_GRXRINGS:
+		rxnfc->data = priv->plat->rx_queues_to_use;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return 0;
+}
+
+static u32 tc956xmac_get_rxfh_key_size(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	return sizeof(priv->rss.key);
+}
+
+static u32 tc956xmac_get_rxfh_indir_size(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	return ARRAY_SIZE(priv->rss.table);
+}
+
+static int tc956xmac_get_rxfh(struct net_device *dev, u32 *indir, u8 *key,
+			   u8 *hfunc)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	int i;
+
+	if (indir) {
+		for (i = 0; i < ARRAY_SIZE(priv->rss.table); i++)
+			indir[i] = priv->rss.table[i];
+	}
+
+	if (key)
+		memcpy(key, priv->rss.key, sizeof(priv->rss.key));
+	if (hfunc)
+		*hfunc = ETH_RSS_HASH_TOP;
+
+	return 0;
+}
+
+static int tc956xmac_set_rxfh(struct net_device *dev, const u32 *indir,
+			   const u8 *key, const u8 hfunc)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	int i;
+
+	if ((hfunc != ETH_RSS_HASH_NO_CHANGE) && (hfunc != ETH_RSS_HASH_TOP))
+		return -EOPNOTSUPP;
+
+	if (indir) {
+		for (i = 0; i < ARRAY_SIZE(priv->rss.table); i++)
+			priv->rss.table[i] = indir[i];
+	}
+
+	if (key)
+		memcpy(priv->rss.key, key, sizeof(priv->rss.key));
+
+	return tc956xmac_rss_configure(priv, priv->hw, &priv->rss,
+				    priv->plat->rx_queues_to_use);
+}
+#endif
+
+static int tc956xmac_get_ts_info(struct net_device *dev,
+			      struct ethtool_ts_info *info)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	if ((priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) {
+#ifdef TC956X_SRIOV_PF
+		info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE |
+					SOF_TIMESTAMPING_TX_HARDWARE |
+					SOF_TIMESTAMPING_RX_SOFTWARE |
+					SOF_TIMESTAMPING_RX_HARDWARE |
+					SOF_TIMESTAMPING_SOFTWARE |
+					SOF_TIMESTAMPING_RAW_HARDWARE;
+#else
+		info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE |
+					SOF_TIMESTAMPING_RX_SOFTWARE |
+					SOF_TIMESTAMPING_RX_HARDWARE |
+					SOF_TIMESTAMPING_SOFTWARE |
+					SOF_TIMESTAMPING_RAW_HARDWARE;
+#endif
+
+		if (priv->ptp_clock)
+			info->phc_index = ptp_clock_index(priv->ptp_clock);
+#ifdef TC956X_SRIOV_PF
+		info->tx_types = (1 << HWTSTAMP_TX_OFF) | (1 << HWTSTAMP_TX_ON);
+#else
+		info->tx_types = (1 << HWTSTAMP_TX_OFF);
+#endif
+
+#ifdef TC956X_SRIOV_PF
+		info->rx_filters = ((1 << HWTSTAMP_FILTER_NONE) |
+				    (1 << HWTSTAMP_FILTER_PTP_V1_L4_EVENT) |
+				    (1 << HWTSTAMP_FILTER_PTP_V1_L4_SYNC) |
+				    (1 << HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ) |
+				    (1 << HWTSTAMP_FILTER_PTP_V2_L4_EVENT) |
+				    (1 << HWTSTAMP_FILTER_PTP_V2_L4_SYNC) |
+				    (1 << HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ) |
+				    (1 << HWTSTAMP_FILTER_PTP_V2_EVENT) |
+				    (1 << HWTSTAMP_FILTER_PTP_V2_SYNC) |
+				    (1 << HWTSTAMP_FILTER_PTP_V2_DELAY_REQ) |
+				    (1 << HWTSTAMP_FILTER_ALL));
+#else
+		info->rx_filters = (1 << HWTSTAMP_FILTER_ALL);
+#endif
+
+		return 0;
+	} else
+		return ethtool_op_get_ts_info(dev, info);
+}
+
+#ifndef TC956X
+static int tc956xmac_get_tunable(struct net_device *dev,
+			      const struct ethtool_tunable *tuna, void *data)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	int ret = 0;
+
+	switch (tuna->id) {
+	case ETHTOOL_RX_COPYBREAK:
+		*(u32 *)data = priv->rx_copybreak;
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	return ret;
+}
+
+static int tc956xmac_set_tunable(struct net_device *dev,
+			      const struct ethtool_tunable *tuna,
+			      const void *data)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	int ret = 0;
+
+	switch (tuna->id) {
+	case ETHTOOL_RX_COPYBREAK:
+		priv->rx_copybreak = *(u32 *)data;
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	return ret;
+}
+#endif
+
+#ifdef TC956X
+static int tc956x_set_priv_flag(struct net_device *dev, u32 priv_flag)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	if (priv_flag & TC956XMAC_TX_FCS)
+		priv->tx_crc_pad_state = TC956X_TX_CRC_PAD_INSERT;
+	else
+		priv->tx_crc_pad_state = TC956X_TX_CRC_PAD_DISABLE;
+	KPRINT_INFO("tx_crc_pad_state : %x", priv->tx_crc_pad_state);
+
+	return 0;
+}
+
+static u32 tc956x_get_priv_flag(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	u32 ret;
+
+	if (priv->tx_crc_pad_state == TC956X_TX_CRC_PAD_INSERT)
+		ret = 1;
+	else
+		ret = 0;
+	KPRINT_INFO("tx_crc_pad_state : %x", priv->tx_crc_pad_state);
+	return ret;
+}
+#endif
+
+static const struct ethtool_ops tc956xmac_ethtool_ops = {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
+	.supported_coalesce_params = ETHTOOL_COALESCE_USECS |
+	    ETHTOOL_COALESCE_MAX_FRAMES,
+#endif
+	.begin = tc956xmac_check_if_running,
+	.get_drvinfo = tc956xmac_ethtool_getdrvinfo,
+	.get_msglevel = tc956xmac_ethtool_getmsglevel,
+	.set_msglevel = tc956xmac_ethtool_setmsglevel,
+	.get_regs = tc956xmac_ethtool_gregs,
+	.get_regs_len = tc956xmac_ethtool_get_regs_len,
+	.get_link = ethtool_op_get_link,
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.nway_reset = tc956xmac_nway_reset,
+#endif
+#endif  /* TC956X_SRIOV_VF */
+	.get_pauseparam = tc956xmac_get_pauseparam,
+	.set_pauseparam = tc956xmac_set_pauseparam,
+	.self_test = tc956xmac_selftest_run,
+	.get_ethtool_stats = tc956xmac_get_ethtool_stats,
+	.get_strings = tc956xmac_get_strings,
+#ifndef TC956X_SRIOV_VF
+	.get_wol = tc956xmac_get_wol,
+	.set_wol = tc956xmac_set_wol,
+#endif
+	.get_eee = tc956xmac_ethtool_op_get_eee,
+	.set_eee = tc956xmac_ethtool_op_set_eee,
+	.get_sset_count	= tc956xmac_get_sset_count,
+#ifndef TC956X
+	.get_rxnfc = tc956xmac_get_rxnfc,
+	.get_rxfh_key_size = tc956xmac_get_rxfh_key_size,
+	.get_rxfh_indir_size = tc956xmac_get_rxfh_indir_size,
+	.get_rxfh = tc956xmac_get_rxfh,
+	.set_rxfh = tc956xmac_set_rxfh,
+#endif
+	.get_ts_info = tc956xmac_get_ts_info,
+	.get_coalesce = tc956xmac_get_coalesce,
+	.set_coalesce = tc956xmac_set_coalesce,
+#ifndef TC956X
+	.get_tunable = tc956xmac_get_tunable,
+	.set_tunable = tc956xmac_set_tunable,
+#endif
+#ifndef TC956X_SRIOV_VF
+	.get_link_ksettings = tc956xmac_ethtool_get_link_ksettings,
+	.set_link_ksettings = tc956xmac_ethtool_set_link_ksettings,
+#endif  /* TC956X_SRIOV_VF */
+#ifdef TC956X
+	.set_priv_flags = tc956x_set_priv_flag,
+	.get_priv_flags = tc956x_get_priv_flag,
+#endif
+};
+
+void tc956xmac_set_ethtool_ops(struct net_device *netdev)
+{
+	netdev->ethtool_ops = &tc956xmac_ethtool_ops;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_hwtstamp.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_hwtstamp.c
@@ -0,0 +1,369 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_hwtstamp.c - This implements all the API for managing
+ *                        HW timestamp & PTP.
+ *
+ * Copyright (C) 2013  Vayavya Labs Pvt Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Vayavya Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  17 Jan 2024 : 1. Added Support for external timestamp event.
+ *  VERSION     : 04-00
+ */
+
+#include <linux/io.h>
+#include <linux/delay.h>
+#include "common.h"
+#include "tc956xmac_ptp.h"
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+#include <linux/ptp_clock_kernel.h>
+#include "tc956xmac.h"
+#include "dwxgmac2.h"
+#endif
+
+#ifdef TC956X_SRIOV_PF
+static u32 tc956xmac_get_ptp_subperiod(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 ptp_clock);
+static u32 tc956xmac_get_ptp_period(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 ptp_clock);
+
+static void config_hw_tstamping(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+					u32 data)
+{
+	writel(data, ioaddr + PTP_TCR);
+}
+
+static void config_sub_second_increment(struct tc956xmac_priv *priv,
+					void __iomem *ioaddr, u32 ptp_clock,
+					int ip, u32 *ssinc)
+{
+	u32 value = readl(ioaddr + PTP_TCR);
+	u32 subns, ns;
+	u32 reg_value;
+	u64 tmp;
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	u64 temp_quot;
+	u32 temp_rem;
+#endif
+
+	ns = tc956xmac_get_ptp_period(priv, ioaddr, ptp_clock);
+	subns = tc956xmac_get_ptp_subperiod(priv, ioaddr, ptp_clock);
+
+	/*  TSCTRLSSR always Enabled */
+	/* 0.465ns accuracy */
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	if (!(value & PTP_TCR_TSCTRLSSR)) {
+		tmp = mul_u32_u32(ns, 1000);
+		temp_quot = div_u64_rem(tmp, 465, &temp_rem);
+		ns = DIV_ROUND_CLOSEST_ULL(tmp - temp_rem, 465);
+
+		subns = DIV_ROUND_CLOSEST_ULL((tmp * 256) - mul_u32_u32(465 * ns, 256), 465);
+	} else {
+		subns = DIV_ROUND_CLOSEST_ULL(mul_u32_u32(subns, 256), 1000);
+	}
+#else
+	if (!(value & PTP_TCR_TSCTRLSSR)) {
+		tmp = ns * 1000;
+		ns = DIV_ROUND_CLOSEST(tmp - (tmp % 465), 465);
+		subns = DIV_ROUND_CLOSEST((tmp * 256) - (465 * ns * 256), 465);
+	} else {
+		subns = DIV_ROUND_CLOSEST(subns * 256, 1000);
+	}
+#endif
+
+	ns &= PTP_SSIR_SSINC_MASK;
+	subns &= PTP_SSIR_SNSINC_MASK;
+
+	reg_value = ns;
+	if (ip) {
+		reg_value = reg_value << GMAC4_PTP_SSIR_SSINC_SHIFT;
+		reg_value |= subns << GMAC4_PTP_SSIR_SNSINC_SHIFT;
+	}
+
+	writel(reg_value, ioaddr + PTP_SSIR);
+
+	if (ssinc)
+		*ssinc = ns;
+
+}
+
+static int init_systime(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+			u32 sec, u32 nsec)
+{
+	int limit;
+	u32 value;
+
+	writel(sec, ioaddr + PTP_STSUR);
+	writel(nsec, ioaddr + PTP_STNSUR);
+	/* issue command to initialize the system time value */
+	value = readl(ioaddr + PTP_TCR);
+	value |= PTP_TCR_TSINIT;
+	writel(value, ioaddr + PTP_TCR);
+
+	/* wait for present system time initialize to complete */
+	limit = 10;
+	while (limit--) {
+		if (!(readl(ioaddr + PTP_TCR) & PTP_TCR_TSINIT))
+			break;
+		mdelay(10);
+	}
+	if (limit < 0)
+		return -EBUSY;
+
+	return 0;
+}
+
+static int config_addend(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 addend)
+{
+	u32 value;
+	int limit;
+
+	writel(addend, ioaddr + PTP_TAR);
+	/* issue command to update the addend value */
+	value = readl(ioaddr + PTP_TCR);
+	value |= PTP_TCR_TSADDREG;
+	writel(value, ioaddr + PTP_TCR);
+
+	/* wait for present addend update to complete */
+	limit = 10;
+	while (limit--) {
+		if (!(readl(ioaddr + PTP_TCR) & PTP_TCR_TSADDREG))
+			break;
+		mdelay(10);
+	}
+	if (limit < 0)
+		return -EBUSY;
+
+	return 0;
+}
+
+static int adjust_systime(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+				u32 sec, u32 nsec, int add_sub, int gmac4)
+{
+	u32 value;
+	int limit;
+
+	if (add_sub) {
+		/* If the new sec value needs to be subtracted with
+		 * the system time, then MAC_STSUR reg should be
+		 * programmed with (2^32 – <new_sec_value>)
+		 */
+		if (gmac4)
+			sec = -sec;
+
+		value = readl(ioaddr + PTP_TCR);
+		if (value & PTP_TCR_TSCTRLSSR)
+			nsec = (PTP_DIGITAL_ROLLOVER_MODE - nsec);
+		else
+			nsec = (PTP_BINARY_ROLLOVER_MODE - nsec);
+	}
+
+	writel(sec, ioaddr + PTP_STSUR);
+	value = (add_sub << PTP_STNSUR_ADDSUB_SHIFT) | nsec;
+	writel(value, ioaddr + PTP_STNSUR);
+
+	/* issue command to initialize the system time value */
+	value = readl(ioaddr + PTP_TCR);
+	value |= PTP_TCR_TSUPDT;
+	writel(value, ioaddr + PTP_TCR);
+
+	/* wait for present system time adjust/update to complete */
+	limit = 10;
+	while (limit--) {
+		if (!(readl(ioaddr + PTP_TCR) & PTP_TCR_TSUPDT))
+			break;
+		mdelay(10);
+	}
+	if (limit < 0)
+		return -EBUSY;
+
+	return 0;
+}
+#endif
+static void get_systime(struct tc956xmac_priv *priv, void __iomem *ioaddr, u64 *systime)
+{
+
+	u64 ns;
+	u32 sec, sec_rollover_read;
+	u32 nsec, nsec_rollover_read;
+
+	sec = readl(ioaddr + PTP_STSR);
+	nsec = readl(ioaddr + PTP_STNSR);
+
+	sec_rollover_read = readl(ioaddr + PTP_STSR);
+	nsec_rollover_read = readl(ioaddr + PTP_STNSR);
+
+	if (sec != sec_rollover_read) {
+		sec = sec_rollover_read;
+		nsec = nsec_rollover_read;
+	}
+
+	/* Get the TSSS value */
+	ns = nsec;
+	/* Get the TSS and convert sec time value to nanosecond */
+	ns += sec * 1000000000ULL;
+
+	if (systime)
+		*systime = ns;
+
+}
+#ifdef TC956X_SRIOV_PF
+static u32 tc956xmac_get_ptp_period(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 ptp_clock)
+{
+	u32 value = readl(ioaddr + PTP_TCR);
+	u64 data;
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	u32 remainder;
+#endif
+
+	/* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
+	 *	formula = (1/ptp_clock) * 1000000000
+	 * where ptp_clock is 50MHz if fine method is used to update system
+	 */
+	/*  TSCFUPDT always Fine method */
+	/*  ptp_clock should be > 3.921568 MHz */
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	if (value & PTP_TCR_TSCFUPDT)
+		data = div_u64_rem(1000000000ULL, ptp_clock, &remainder);
+	else
+		data = div_u64_rem(1000000000ULL, 250000000, &remainder);
+
+#else
+	if (value & PTP_TCR_TSCFUPDT)
+		data = (1000000000ULL / ptp_clock);
+	else
+		data = (1000000000ULL / 250000000);
+#endif
+
+	return (u32)data;
+}
+
+static u32 tc956xmac_get_ptp_subperiod(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 ptp_clock)
+{
+	u32 value = readl(ioaddr + PTP_TCR);
+	u64 data;
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	u32 remainder;
+#endif
+
+	/* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
+	 *	formula = (1/ptp_clock) * 1000000000
+	 * where ptp_clock is 50MHz if fine method is used to update system
+	 */
+	 /* TSCFUPDT always Fine method */
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	if (value & PTP_TCR_TSCFUPDT)
+		data = div_u64_rem(1000000000ULL * 1000ULL, ptp_clock, &remainder);
+	else
+		data = div_u64_rem(1000000000ULL * 1000ULL, 250000000, &remainder);
+
+#else
+	if (value & PTP_TCR_TSCFUPDT)
+		data = (1000000000ULL * 1000ULL / ptp_clock);
+	else
+		data = (1000000000ULL * 1000ULL / 250000000);
+#endif
+
+	return  data - tc956xmac_get_ptp_period(priv, ioaddr, ptp_clock) * 1000;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+/*Added Support for external timestamp event */
+static void get_ptptime(void __iomem *ptpaddr, u64 *ptp_time)
+{
+	u64 ns;
+
+	ns = readl(ptpaddr + PTP_ATNR);
+	ns += readl(ptpaddr + PTP_ATSR) * NSEC_PER_SEC;
+
+	*ptp_time = ns;
+}
+
+static void timestamp_interrupt(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 num_snapshot, ts_status, tsync_int;
+	struct ptp_clock_event event;
+	unsigned long flags;
+	u64 ptp_time;
+	int i;
+	u32 aux_ctrl = 0;
+
+	tsync_int = readl(priv->ioaddr + XGMAC_INT_STATUS) & XGMAC_TSIS;
+
+	if (!tsync_int)
+		return;
+
+	/* Read timestamp status to clear interrupt from either external
+	 * timestamp or start/end of PPS.
+	 */
+	ts_status = readl(priv->ioaddr + XGMAC_TIMESTAMP_STATUS);
+	aux_ctrl = (readl(priv->ioaddr + XGMAC_MAC_AUX_CTRL)) & 0xF0;
+	if (!aux_ctrl)
+		return;
+
+	num_snapshot = (ts_status & MAC_TS_ATSNS_MASK) >>
+		       MAC_TS_ATSNS_SHIFT;
+
+	for (i = 0; i < num_snapshot; i++) {
+		spin_lock_irqsave(&priv->ptp_lock, flags);
+		get_ptptime(priv->ptpaddr, &ptp_time);
+		spin_unlock_irqrestore(&priv->ptp_lock, flags);
+		event.type = PTP_CLOCK_EXTTS;
+		event.index = 0;
+		event.timestamp = ptp_time;
+		ptp_clock_event(priv->ptp_clock, &event);
+	}
+}
+#endif
+
+const struct tc956xmac_hwtimestamp tc956xmac_ptp = {
+	.config_hw_tstamping = config_hw_tstamping,
+	.init_systime = init_systime,
+	.config_sub_second_increment = config_sub_second_increment,
+	.config_addend = config_addend,
+	.adjust_systime = adjust_systime,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+/*Added Support for external timestamp event */
+	.get_ptptime = get_ptptime,
+	.timestamp_interrupt = timestamp_interrupt,
+#endif
+	.get_systime = get_systime,
+};
+#else
+const struct tc956xmac_hwtimestamp tc956xmac_ptp = {
+	.config_hw_tstamping = NULL,
+	.init_systime = NULL,
+	.config_sub_second_increment = NULL,
+	.config_addend = NULL,
+	.adjust_systime = NULL,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+	.get_ptptime = NULL,
+	.timestamp_interrupt = NULL,
+#endif
+	.get_systime = get_systime,
+};
+#endif
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_inc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_inc.h
@@ -0,0 +1,770 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_inc.h
+ *
+ * Copyright (C) 2009  STMicroelectronics Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  22 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported with module parameters
+ *  VERSION     : 01-00-04
+ *  16 Aug 2021 : 1. PHY interrupt mode supported through .config_intr and .ack_interrupt API
+ *  VERSION     : 01-00-09
+ *  24 Aug 2021 : 1. Disable TC956X_PCIE_GEN3_SETTING and TC956X_LOAD_FW_HEADER macros and provide support via Makefile
+ *  VERSION     : 01-00-10
+ *  08 Dec 2021 : 1. Added Module parameters for Flow control thresholds per Queue.
+ *  VERSION     : 01-00-30
+ *  11 Jan 2022 : 1. Forced speed mode parameter added for fixed phy mode.
+ *  VERSION     : 01-00-35
+ *  26 Dec 2023 : 1. Added the support for TC commands taprio and flower
+ *  VERSION     : 01-03-59
+ *  29 Mar 2024 : 1. Support for without MDIO and without PHY case
+ *  VERSION     : 04-00
+ */
+
+#ifndef __TC956XMAC_PLATFORM_DATA
+#define __TC956XMAC_PLATFORM_DATA
+
+#include <linux/platform_device.h>
+#include <linux/phy.h>
+#include "tc956xmac_ioctl.h"
+
+//#define TC956X
+//#define TC956X_IOCTL_REG_RD_WR_ENABLE
+
+/* Enable TC956X_WITHOUT_MDIO_WITHOUT_PHY macro to disable MDIO and remove PHY dependency */
+//#define TC956X_WITHOUT_MDIO_WITHOUT_PHY
+//#define TC956X_PCIE_GEN3_SETTING
+//#define TC956X_PCIE_DISABLE_DSP1 /*Enable this macro to disable DSP1 port*/
+//#define TC956X_PCIE_DISABLE_DSP2 /*Enable this macro to disable DSP2 port*/
+/* Enable for PORT0 interrupt mode, if commented polling mode */
+#define TC956X_PHY_INTERRUPT_MODE_EMAC0
+/* Enable for PORT1 interrupt mode, if commented polling mode */
+#define TC956X_PHY_INTERRUPT_MODE_EMAC1
+
+#ifdef TC956X
+//#define TC956X_SRIOV_PF		/* Enable TC956X SRIOV Configuration */
+//#define TC956X_MBX_DESIGN_HW_SEMAPHORE
+#endif
+/* Enable this macro to use Systick timer instead of Kernel timers
+ * for handling Tx completion periodically
+ */
+#ifdef TC956X_CPE_CONFIG
+#define TX_COMPLETION_WITHOUT_TIMERS
+#define TC956X_SW_MSI /*Enable this macro to process SW MSI when CM3 Systick Handler sends SW MSI*/
+//#define ENABLE_TX_TIMER /*Enable this macro to use Kernel timer. TC956X_SW_MSI can be disabled in this case */
+#else
+//#define TX_COMPLETION_WITHOUT_TIMERS
+//#define TC956X_SW_MSI /*Enable this macro to process SW MSI when CM3 Systick Handler sends SW MSI*/
+#define ENABLE_TX_TIMER /*Enable this macro to use Kernel timer. TC956X_SW_MSI can be disabled in this case */
+#endif
+
+/* By default macro is defined and for code coverage this macro has to be disabled */
+#define TC956X_UNSUPPORTED_UNTESTED_FEATURE
+
+//#define EEPROM_MAC_ADDR
+//#define TC956X_MBX_DESIGN_HW_SEMAPHORE
+//#define TC956X_SRIOV_VF    /* This macro mentions applicable changes for VF driver from CPE driver. It should be enabled along with TC956X macro */
+
+#define MTL_MAX_RX_QUEUES	8
+#define MTL_MAX_TX_QUEUES	8
+#define MTL_MAX_TX_TC		5
+#define TC956XMAC_CH_MAX		8
+
+#define TC956XMAC_RX_COE_NONE	0
+#define TC956XMAC_RX_COE_TYPE1	1
+#define TC956XMAC_RX_COE_TYPE2	2
+
+/*
+ * Define the macros for CSR clock range parameters to be passed by
+ * platform code.
+ * This could also be configured at run time using CPU freq framework.
+ */
+
+/* MDC Clock Selection define*/
+#define	TC956XMAC_CSR_60_100M	0x0	/* MDC = clk_scr_i/42 */
+#define	TC956XMAC_CSR_100_150M	0x1	/* MDC = clk_scr_i/62 */
+#define	TC956XMAC_CSR_20_35M	0x2	/* MDC = clk_scr_i/16 */
+#define	TC956XMAC_CSR_35_60M	0x3	/* MDC = clk_scr_i/26 */
+#define	TC956XMAC_CSR_150_250M	0x4	/* MDC = clk_scr_i/102 */
+#define	TC956XMAC_CSR_250_300M	0x5	/* MDC = clk_scr_i/122 */
+
+/* MTL algorithms identifiers */
+#define MTL_TX_ALGORITHM_WRR	0x0
+#define MTL_TX_ALGORITHM_WFQ	0x1
+#define MTL_TX_ALGORITHM_DWRR	0x2
+#define MTL_TX_ALGORITHM_SP	0x3
+#define MTL_RX_ALGORITHM_SP	0x4
+#define MTL_RX_ALGORITHM_WSP	0x5
+
+/* RX/TX Queue Mode */
+#define MTL_QUEUE_AVB		0x0
+#define MTL_QUEUE_DCB		0x1
+#define MTL_QUEUE_DISABLE	0x2
+
+#ifdef TC956X_SRIOV_VF
+#define TC956X_ENABLE 1
+#define TC956X_DISABLE 0
+#endif
+
+/* The MDC clock could be set higher than the IEEE 802.3
+ * specified frequency limit 0f 2.5 MHz, by programming a clock divider
+ * of value different than the above defined values. The resultant MDIO
+ * clock frequency of 12.5 MHz is applicable for the interfacing chips
+ * supporting higher MDC clocks.
+ * The MDC clock selection macros need to be defined for MDC clock rate
+ * of 12.5 MHz, corresponding to the following selection.
+ */
+#define TC956XMAC_CSR_I_4		0x8	/* clk_csr_i/4 */
+#define TC956XMAC_CSR_I_6		0x9	/* clk_csr_i/6 */
+#define TC956XMAC_CSR_I_8		0xA	/* clk_csr_i/8 */
+#define TC956XMAC_CSR_I_10		0xB	/* clk_csr_i/10 */
+#define TC956XMAC_CSR_I_12		0xC	/* clk_csr_i/12 */
+#define TC956XMAC_CSR_I_14		0xD	/* clk_csr_i/14 */
+#define TC956XMAC_CSR_I_16		0xE	/* clk_csr_i/16 */
+#define TC956XMAC_CSR_I_18		0xF	/* clk_csr_i/18 */
+
+/* For TC956X, clk_scr_i = 125MHz */
+#define TC956XMAC_XGMAC_MDC_CSR_4		0x0 /*clk_csr_i/4 */
+#define TC956XMAC_XGMAC_MDC_CSR_6		0x1 /* clk_csr_i/6 */
+#define TC956XMAC_XGMAC_MDC_CSR_8		0x2 /* clk_csr_i/8 */
+#define TC956XMAC_XGMAC_MDC_CSR_10		0x3 /* clk_csr_i/10 */
+#define TC956XMAC_XGMAC_MDC_CSR_12		0x4 /* clk_csr_i/12 */
+#define TC956XMAC_XGMAC_MDC_CSR_14		0x5 /* clk_csr_i/14 */
+#define TC956XMAC_XGMAC_MDC_CSR_16		0x6 /* clk_csr_i/16 */
+#define TC956XMAC_XGMAC_MDC_CSR_18		0x7 /* clk_csr_i/18 */
+#define TC956XMAC_XGMAC_MDC_CSR_62		0x8 /* clk_csr_i/62 */
+#define TC956XMAC_XGMAC_MDC_CSR_102	0x9 /* clk_csr_i/102 */
+#define TC956XMAC_XGMAC_MDC_CSR_122	0xA /* clk_csr_i/122 */
+#define TC956XMAC_XGMAC_MDC_CSR_142	0xB /* clk_csr_i/142 */
+#define TC956XMAC_XGMAC_MDC_CSR_162	0xC /* clk_csr_i/162 */
+#define TC956XMAC_XGMAC_MDC_CSR_202	0xD /* clk_csr_i/202 */
+
+
+/* AXI DMA Burst length supported */
+#define DMA_AXI_BLEN_4		(1 << 1)
+#define DMA_AXI_BLEN_8		(1 << 2)
+#define DMA_AXI_BLEN_16		(1 << 3)
+#define DMA_AXI_BLEN_32		(1 << 4)
+#define DMA_AXI_BLEN_64		(1 << 5)
+#define DMA_AXI_BLEN_128	(1 << 6)
+#define DMA_AXI_BLEN_256	(1 << 7)
+#define DMA_AXI_BLEN_ALL (DMA_AXI_BLEN_4 | DMA_AXI_BLEN_8 | DMA_AXI_BLEN_16 \
+			| DMA_AXI_BLEN_32 | DMA_AXI_BLEN_64 \
+			| DMA_AXI_BLEN_128 | DMA_AXI_BLEN_256)
+
+/* Platfrom data for platform device structure's platform_data field */
+
+struct tc956xmac_mdio_bus_data {
+	unsigned int phy_mask;
+	int *irqs;
+	int probed_phy_irq;
+	bool needs_reset;
+};
+
+struct tc956xmac_dma_cfg {
+	int pbl;
+	int txpbl;
+	int rxpbl;
+	bool pblx8;
+	int fixed_burst;
+	int mixed_burst;
+	bool aal;
+	bool eame;
+};
+
+#define AXI_BLEN	7
+struct tc956xmac_axi {
+	bool axi_lpi_en;
+	bool axi_xit_frm;
+	u32 axi_wr_osr_lmt;
+	u32 axi_rd_osr_lmt;
+	bool axi_kbbe;
+	u32 axi_blen[AXI_BLEN];
+	bool axi_fb;
+	bool axi_mb;
+	bool axi_rb;
+};
+
+#define EST_GCL		128
+struct tc956xmac_est {
+	int enable;
+	u32 btr_offset[2];
+	u32 btr[2];
+	u32 ctr[2];
+	u32 ter;
+	u32 gcl[EST_GCL];
+	u32 gcl_size;
+#ifndef TC956X
+	u32 gcl_unaligned[EST_GCL];
+#endif
+};
+
+struct tc956xmac_rxq_cfg {
+	u8 mode_to_use;
+	u32 chan;
+	u8 pkt_route;
+	bool use_prio;
+	u32 prio;
+	u32 size;
+	u32 rfd;
+	u32 rfa;
+};
+
+struct tc956xmac_txq_cfg {
+	u32 weight;
+	u8 mode_to_use;
+	/* Credit Base Shaper parameters */
+	u32 send_slope;
+	u32 idle_slope;
+	u32 high_credit;
+	u32 low_credit;
+	bool use_prio;
+	u32 prio;
+	u32 tbs_en;
+	u32 tso_en;
+	u8 traffic_class;
+	u32 size;
+};
+
+struct tc956xmac_fpe_cfg {
+	bool enable;
+	u32 pec_cfg;
+	u32 afsz_cfg;
+	u32 RA_time;
+	u32 HA_time;
+};
+
+enum ch_owner {
+	NOT_USED = 0,
+	USE_IN_TC956X_SW = 1,
+	USE_IN_OFFLOADER = 2,
+};
+
+struct plat_tc956xmacenet_data {
+	int bus_id;
+	int phy_addr;
+	int interface;
+	struct tc956xmac_rx_parser_cfg rxp_cfg;
+	struct pci_dev *pdev;
+	phy_interface_t phy_interface;
+	struct tc956xmac_mdio_bus_data *mdio_bus_data;
+	struct device_node *phy_node;
+#ifndef TC956X_SRIOV_VF
+	struct device_node *phylink_node;
+#endif
+	struct device_node *mdio_node;
+	struct tc956xmac_dma_cfg *dma_cfg;
+	struct tc956xmac_est *est;
+	int clk_csr;
+	int clk_crs;
+	u8 mdc_clk;
+	bool c45_needed;
+	int has_gmac;
+	int enh_desc;
+	int tx_coe;
+	int rx_coe;
+	int bugged_jumbo;
+	int pmt;
+	int force_sf_dma_mode;
+	int force_thresh_dma_mode;
+	int riwt_off;
+	int max_speed;
+	int maxmtu;
+	int multicast_filter_bins;
+	int unicast_filter_entries;
+	int tx_fifo_size;
+	int rx_fifo_size;
+	u32 rx_queues_to_use;
+	u32 tx_queues_to_use;
+	/* Variable for queues and channels used in current driver instance */
+#ifdef TC956X_SRIOV_PF
+	u32 tx_ch_in_use[TC956XMAC_CH_MAX];
+	u32 rx_ch_in_use[TC956XMAC_CH_MAX];
+	u32 tx_q_in_use[MTL_MAX_TX_QUEUES];
+	u32 rx_q_in_use[MTL_MAX_RX_QUEUES];
+#elif defined TC956X_SRIOV_VF
+	u32 vf_id; /*0 or 1 or 2*/
+	u32 rx_queues_to_use_actual;
+	u32 tx_queues_to_use_actual;
+	u32 ch_in_use[TC956XMAC_CH_MAX];
+	u32 tx_q_in_use[MTL_MAX_TX_QUEUES];
+	u32 rx_q_in_use[MTL_MAX_TX_QUEUES];
+	u32 tx_q_size[MTL_MAX_TX_QUEUES];
+	u32 best_effort_ch_no;
+	u32 gptp_ch_no;
+	u32 avb_class_a_ch_no;
+	u32 avb_class_b_ch_no;
+	u32 tsn_ch_no;
+	u32 tsn_application;
+	u32 avb_application;
+#endif
+	u8 rx_sched_algorithm;
+	u8 tx_sched_algorithm;
+	struct tc956xmac_rxq_cfg rx_queues_cfg[MTL_MAX_RX_QUEUES];
+	struct tc956xmac_txq_cfg tx_queues_cfg[MTL_MAX_TX_QUEUES];
+	void (*fix_mac_speed)(void *priv, unsigned int speed);
+	int (*init)(struct platform_device *pdev, void *priv);
+	void (*exit)(struct platform_device *pdev, void *priv);
+	struct mac_device_info *(*setup)(void *priv);
+	void *bsp_priv;
+	struct clk *tc956xmac_clk;
+	struct clk *pclk;
+	struct clk *clk_ptp_ref;
+	unsigned int clk_ptp_rate;
+	unsigned int clk_ref_rate;
+	s32 ptp_max_adj;
+	struct reset_control *tc956xmac_rst;
+	struct tc956xmac_axi *axi;
+	int has_gmac4;
+	bool has_sun8i;
+	bool tso_en;
+	int rss_en;
+	int sph_en;
+	int mac_port_sel_speed;
+	bool en_tx_lpi_clockgating;
+	struct tc956xmac_fpe_cfg fpe_cfg;
+	int has_xgmac;
+	int (*cphy_read)(void *priv, int phyaddr, int phyreg);
+	int (*cphy_write)(void *priv, int phyaddr, int phyreg, u16 phydata);
+#ifndef TC956X_SRIOV_VF
+	enum ch_owner tx_dma_ch_owner[MTL_MAX_TX_QUEUES];
+	enum ch_owner rx_dma_ch_owner[MTL_MAX_RX_QUEUES];
+#endif
+	u32 port_num;
+	u32 port_interface; /* Kernel module parameter variable for interface */
+	bool phy_interrupt_mode; /* For Handling of PHY Operating mode */
+	int forced_speed; /* applicable only in case of fixed phy mode */
+	/*Preamble*/
+	bool pse;
+	int start_phy_addr;
+	bool gate_mask;
+};
+
+struct tx956x_shrd_mem {
+	uint16_t pci_bd;
+	uint16_t pci_dev_active_cnt;
+	uint16_t eth_link_down_cnt;
+};
+
+#ifdef TC956X_SRIOV_VF
+static const struct tc956xmac_vf_entry {
+	u32 rx_queues_to_use_actual;
+	u32 tx_queues_to_use_actual;
+	/* No of and name of Rx and Tx channel will be always same */
+	u32 ch_in_use[TC956XMAC_CH_MAX];
+	u32 tx_q_in_use[MTL_MAX_TX_QUEUES];
+	u32 rx_q_in_use[MTL_MAX_TX_QUEUES];
+	u32 tx_q_size[MTL_MAX_TX_QUEUES];
+	u32 best_effort_ch_no;
+	u32 gptp_ch_no;
+	u32 avb_class_a_ch_no;
+	u32 avb_class_b_ch_no;
+	u32 tsn_ch_no;
+	u32 tsn_application; /* Set if VF supports TSN application */
+	u32 avb_application; /* Set if VF supports AVB app */
+	struct tc956xmac_txq_cfg tx_queues_cfg[MTL_MAX_TX_QUEUES];
+} tc956xmac_vf[] = {
+	/* VF[0] configurations */
+	{
+		.rx_queues_to_use_actual = 8,
+		.tx_queues_to_use_actual = 8,
+		.ch_in_use = {1, 0, 0, 0, 0, 1, 0, 0},
+		.tx_q_in_use = {1, 0, 0, 0, 0, 1, 0, 0},
+		.rx_q_in_use = {0, 0, 0, 0, 0, 0, 0, 0},
+		.tx_q_size = {4096, 0, 0, 0, 0, 4096, 0, 0},
+		.best_effort_ch_no = 0,
+		.gptp_ch_no = 0,
+		.avb_class_a_ch_no = 0, /* Not used - redirect to BE Ch */
+		.avb_class_b_ch_no = 5,
+		.tsn_ch_no = 0,	/* Not used - redirect to BE Ch */
+		.tsn_application = 0,
+		.avb_application = 1,
+		.tx_queues_cfg = {
+			{ /*Tx queue 0 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DCB,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio = false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = TC956X_ENABLE,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 1 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio = false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 2 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio = false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 3 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio = false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 4 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio = false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 5 configuration */
+				/* CBS: queue 5 -> Class B traffic (25% BW) */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_AVB,
+				.send_slope = 0x1800,
+				.idle_slope = 0x800,
+				.high_credit = 0x320000,
+				.low_credit = 0xff6a0000,
+				.use_prio = false,
+				.prio = 0x0,
+				.tbs_en = TC956X_ENABLE,
+				.tso_en = 0x0,
+				.traffic_class = 2
+			},
+			{ /*Tx queue 6 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio = false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 7 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio = false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+		},
+	},
+	/* VF[1] configurations */
+	{
+		.rx_queues_to_use_actual = 8,
+		.tx_queues_to_use_actual = 8,
+		.ch_in_use = {0, 1, 0, 0, 0, 0, 0, 0},
+		.tx_q_in_use = {0, 1, 0, 0, 0, 0, 0, 0},
+		.rx_q_in_use = {0, 0, 0, 0, 0, 0, 0, 0},
+		.tx_q_size = {0, 4096, 0, 0, 0, 0, 0, 0},
+		.best_effort_ch_no = 1,
+		.gptp_ch_no = 1,
+		.avb_class_a_ch_no = 1, /* Not used - redirect to BE Ch */
+		.avb_class_b_ch_no = 1, /* Not used - redirect to BE Ch */
+		.tsn_ch_no = 1,	/* Not used - redirect to BE Ch */
+		.tsn_application = 0,
+		.avb_application = 0,
+		.tx_queues_cfg = {
+			{ /*Tx queue 0 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio = false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 1 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DCB,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = TC956X_ENABLE,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 2 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 3 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 4 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 5 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 6 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 7 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+		},
+	},
+	/* VF[2] configurations */
+	{
+		.rx_queues_to_use_actual = 8,
+		.tx_queues_to_use_actual = 8,
+		.ch_in_use = {0, 0, 1, 0, 0, 0, 1, 1},
+		.tx_q_in_use = {0, 0, 1, 0, 0, 0, 1, 1},
+		.rx_q_in_use = {0, 0, 0, 0, 0, 0, 0, 0},
+		.tx_q_size = {0, 0, 18432, 0, 0, 0, 4096, 4096},
+		.best_effort_ch_no = 2,
+		.gptp_ch_no = 2,
+		.avb_class_a_ch_no = 6,
+		.avb_class_b_ch_no = 2, /* Not used - redirect to BE Ch */
+		.tsn_ch_no = 7,
+		.tsn_application = 1,
+		.avb_application = 1,
+		.tx_queues_cfg = {
+			{ /*Tx queue 0 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 1 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 2 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DCB,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = TC956X_ENABLE,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 3 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 4 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 5 configuration */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_DISABLE,
+				.send_slope = 0x0,
+				.idle_slope = 0x0,
+				.high_credit = 0x0,
+				.low_credit = 0x0,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = 0x0,
+				.tso_en = 0x0,
+				.traffic_class = 0
+			},
+			{ /*Tx queue 6 configuration */
+				/* CBS: queue 6 -> Class A traffic (25% BW) */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_AVB,
+				.send_slope = 0x1800,
+				.idle_slope = 0x800,
+				.high_credit = 0x320000,
+				.low_credit = 0xff6a0000,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = TC956X_ENABLE,
+				.tso_en = 0x0,
+				.traffic_class = 3
+			},
+			{ /*Tx queue 7 configuration */
+				/* CBS: queue 7 -> Class CDT traffic (40%) BW */
+				.weight = 0x1,
+				.mode_to_use = MTL_QUEUE_AVB,
+				.send_slope = 0x1333,
+				.idle_slope = 0xccc,
+				.high_credit = 0x500000,
+				.low_credit = 0xff880000,
+				.use_prio =  false,
+				.prio = 0x0,
+				.tbs_en = TC956X_ENABLE,
+				.tso_en = 0x0,
+				.traffic_class = 4
+			},
+		},
+	},
+
+};
+#endif
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_ioctl.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_ioctl.h
@@ -0,0 +1,668 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_ioctl.h
+ *
+ * Copyright (C) 2018 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  14 Sep 2021 : 1. Synchronization between ethtool vlan features
+ *                   "rx-vlan-offload", "rx-vlan-filter", "tx-vlan-offload" output and register settings.
+ *                2. Added ethtool support to update "rx-vlan-offload", "rx-vlan-filter",
+ *                   and "tx-vlan-offload".
+ *                3. Removed IOCTL TC956XMAC_VLAN_STRIP_CONFIG.
+ *                4. Removed "Disable VLAN Filter" option in IOCTL TC956XMAC_VLAN_FILTERING.
+ *  VERSION     : 01-00-13
+ */
+
+#ifndef _IOCTL_H__
+#define _IOCTL_H__
+
+/* Note: Multiple macro definitions for TC956X_PCIE_LOGSTAT and TC956X_PCIE_LOGSTAT_SUMMARY_ENABLE.
+ * Please also define/undefine same macro in common.h, if changing in this file
+ */
+/* #undef TC956X_PCIE_LOGSTAT */
+#define TC956X_PCIE_LOGSTAT
+#ifdef TC956X_PCIE_LOGSTAT
+/* Enable/Disable Logstat Summary Print during probe and resume. */
+#undef TC956X_PCIE_LOGSTAT_SUMMARY_ENABLE
+#endif
+
+enum ioctl_commands {
+	TC956XMAC_GET_CBS = 0x1,
+	TC956XMAC_SET_CBS = 0x2,
+	TC956XMAC_GET_EST = 0x3,
+	TC956XMAC_SET_EST = 0x4,
+#ifdef TC956X_UNSUPPORTED_UNTESTED
+	TC956XMAC_GET_FPE = 0x5,
+	TC956XMAC_SET_FPE = 0x6,
+#endif
+	TC956XMAC_GET_RXP = 0x7,
+	TC956XMAC_SET_RXP = 0x8,
+	TC956XMAC_GET_SPEED = 0x9,
+	TC956XMAC_GET_TX_FREE_DESC = 0xa,
+	TC956XMAC_REG_RD = 0xb,
+	TC956XMAC_REG_WR = 0xc,
+	TC956XMAC_SET_MAC_LOOPBACK = 0xd,
+	TC956XMAC_SET_PHY_LOOPBACK = 0xe,
+	TC956XMAC_L2_DA_FILTERING_CMD = 0xf,
+	TC956XMAC_SET_PPS_OUT = 0x10,
+	TC956XMAC_PTPCLK_CONFIG = 0x11,
+	TC956XMAC_SA0_VLAN_INS_REP_REG = 0x12,
+	TC956XMAC_SA1_VLAN_INS_REP_REG = 0x13,
+	TC956XMAC_GET_TX_QCNT = 0x14,
+	TC956XMAC_GET_RX_QCNT = 0x15,
+	TC956XMAC_PCIE_CONFIG_REG_RD = 0x16,
+	TC956XMAC_PCIE_CONFIG_REG_WR = 0x17,
+	TC956XMAC_VLAN_FILTERING = 0x18,
+	TC956XMAC_PTPOFFLOADING = 0x19,
+	TC956X_GET_FW_STATUS = 0x1a,
+	TC956XMAC_ENABLE_AUX_TIMESTAMP = 0x1b,
+	TC956XMAC_ENABLE_ONESTEP_TIMESTAMP = 0x1c,
+#ifdef TC956X_PCIE_LOGSTAT
+	TC956X_PCIE_STATE_LOG_SUMMARY = 0x1d, /* LOGSTAT : Prints State Log Summary */
+	TC956X_PCIE_GET_PCIE_LINK_PARAMS = 0x1e, /* LOGSTAT : Return and Print PCIe LTSSM, DLL, Speed and Lane Width */
+	TC956X_PCIE_STATE_LOG_ENABLE    = 0x1f, /* LOGSTAT : Set State Log Enable/Disable */
+#endif /* #ifdef TC956X_PCIE_LOGSTAT */
+
+	TC956XMAC_VLAN_STRIP_CONFIG   = 0x22,
+	TC956XMAC_PCIE_LANE_CHANGE	= 0x23,
+	TC956XMAC_PCIE_SET_TX_MARGIN	= 0x24,
+	TC956XMAC_PCIE_SET_TX_DEEMPHASIS	= 0x25, /*Enable or disable Tx de-emphasis*/
+	TC956XMAC_PCIE_SET_DFE	= 0x26,
+	TC956XMAC_PCIE_SET_CTLE	= 0x27,
+	TC956XMAC_PCIE_SPEED_CHANGE	= 0x28,
+#ifdef TC956X_SRIOV_PF
+	TC956XMAC_GET_QMODE = 0x29,
+	TC956XMAC_SET_QMODE = 0x2a,
+	TC956XMAC_GET_CBS100 = 0x2b,
+	TC956XMAC_GET_CBS1000 = 0x2c,
+	TC956XMAC_GET_CBS2500 = 0x2d,
+	TC956XMAC_GET_CBS5000 = 0x2e,
+	TC956XMAC_GET_CBS10000 = 0x2f,
+	TC956XMAC_SET_CBS100 = 0x30,
+	TC956XMAC_SET_CBS1000 = 0x31,
+	TC956XMAC_SET_CBS2500 = 0x32,
+	TC956XMAC_SET_CBS5000 = 0x33,
+	TC956XMAC_SET_CBS10000 = 0x34,
+#endif
+};
+
+#define TC956XMAC_GET_CBS_1	0x29 /* Sub commands - CBS */
+#define TC956XMAC_GET_CBS_2	0x2a
+#define TC956XMAC_SET_CBS_1	0x2b
+#define TC956XMAC_SET_CBS_2	0x2c
+#define TC956XMAC_SET_EST_1	0x2d
+#define TC956XMAC_SET_EST_2	0x2e
+#define TC956XMAC_SET_EST_3	0x2f
+#define TC956XMAC_SET_EST_4	0x30
+#define TC956XMAC_SET_EST_5	0x31
+#define TC956XMAC_SET_EST_6	0x32
+#define TC956XMAC_SET_EST_7	0x33
+#define TC956XMAC_SET_EST_8	0x34
+#define TC956XMAC_SET_EST_9	0x35
+#define TC956XMAC_SET_EST_10 0x36
+#define TC956XMAC_SET_FPE_1	0x37
+#define TC956XMAC_GET_FPE_1	0x38
+#define TC956XMAC_GET_EST_1	0x39
+#define TC956XMAC_GET_EST_2	0x3a
+#define TC956XMAC_GET_EST_3	0x3b
+#define TC956XMAC_GET_EST_4	0x3c
+#define TC956XMAC_GET_EST_5	0x3d
+#define TC956XMAC_GET_EST_6	0x3e
+#define TC956XMAC_GET_EST_7	0x3f
+#define TC956XMAC_GET_EST_8	0x40
+#define TC956XMAC_GET_EST_9	0x41
+#define TC956XMAC_GET_EST_10	0x42
+#define TC956XMAC_SET_RXP_1	0x43
+#define TC956XMAC_SET_RXP_2	0x44
+#define TC956XMAC_SET_RXP_3	0x45
+#define TC956XMAC_SET_RXP_4	0x46
+#define TC956XMAC_SET_RXP_5	0x47
+#define TC956XMAC_SET_RXP_6	0x48
+#define TC956XMAC_SET_RXP_7	0x49
+#define TC956XMAC_SET_RXP_8	0x4a
+#define TC956XMAC_SET_RXP_9	0x4b
+#define TC956XMAC_SET_RXP_10	0x4c
+#define TC956XMAC_SET_RXP_11	0x4d
+#define TC956XMAC_SET_RXP_12	0x4e
+#define TC956XMAC_SET_RXP_13	0x4f
+#define TC956XMAC_SET_RXP_14	0x50
+#define TC956XMAC_SET_RXP_15	0x51
+#define TC956XMAC_SET_RXP_16	0x52
+#define TC956XMAC_SET_RXP_17	0x53
+#define TC956XMAC_SET_RXP_18	0x54
+#define TC956XMAC_SET_RXP_19	0x55
+#define TC956XMAC_SET_RXP_20	0x56
+#define TC956XMAC_SET_RXP_21	0x57
+#define TC956XMAC_SET_RXP_22	0x58
+#define TC956XMAC_SET_RXP_23	0x59
+#define TC956XMAC_SET_RXP_24	0x5a
+#define TC956XMAC_SET_RXP_25	0x5b
+#define TC956XMAC_SET_RXP_26	0x5c
+#define TC956XMAC_SET_RXP_27	0x5d
+#define TC956XMAC_SET_RXP_28	0x5e
+#define TC956XMAC_SET_RXP_29	0x5f
+#define TC956XMAC_SET_RXP_30	0x60
+#define TC956XMAC_SET_RXP_31	0x61
+#define TC956XMAC_SET_RXP_32	0x62
+#define TC956XMAC_SET_RXP_33	0x63
+#define TC956XMAC_SET_RXP_34	0x64
+#define TC956XMAC_SET_RXP_35	0x65
+#define TC956XMAC_SET_RXP_36	0x66
+#define TC956XMAC_SET_RXP_37	0x67
+#define TC956XMAC_GET_RXP_1	    0x68
+#define TC956XMAC_GET_RXP_2	    0x69
+#define TC956XMAC_GET_RXP_3	    0x6a
+#define TC956XMAC_GET_RXP_4	    0x6b
+#define TC956XMAC_GET_RXP_5	    0x6c
+#define TC956XMAC_GET_RXP_6	    0x6d
+#define TC956XMAC_GET_RXP_7	    0x6e
+#define TC956XMAC_GET_RXP_8	    0x6f
+#define TC956XMAC_GET_RXP_9	    0x70
+#define TC956XMAC_GET_RXP_10    0x71
+#define TC956XMAC_GET_RXP_11    0x72
+#define TC956XMAC_GET_RXP_12    0x73
+#define TC956XMAC_GET_RXP_13    0x74
+#define TC956XMAC_GET_RXP_14    0x75
+#define TC956XMAC_GET_RXP_15    0x76
+#define TC956XMAC_GET_RXP_16    0x77
+#define TC956XMAC_GET_RXP_17    0x78
+#define TC956XMAC_GET_RXP_18    0x79
+#define TC956XMAC_GET_RXP_19    0x7a
+#define TC956XMAC_GET_RXP_20    0x7b
+#define TC956XMAC_GET_RXP_21    0x7c
+#define TC956XMAC_GET_RXP_22    0x7d
+#define TC956XMAC_GET_RXP_23    0x7e
+#define TC956XMAC_GET_RXP_24    0x7f
+#define TC956XMAC_GET_RXP_25    0x80
+#define TC956XMAC_GET_RXP_26    0x81
+#define TC956XMAC_GET_RXP_27    0x82
+#define TC956XMAC_GET_RXP_28    0x83
+#define TC956XMAC_GET_RXP_29    0x84
+#define TC956XMAC_GET_RXP_30    0x85
+#define TC956XMAC_GET_RXP_31    0x86
+#define TC956XMAC_GET_RXP_32    0x87
+#define TC956XMAC_GET_RXP_33    0x88
+#define TC956XMAC_GET_RXP_34    0x89
+#define TC956XMAC_GET_RXP_35    0x8a
+#define TC956XMAC_GET_RXP_36    0x8b
+#define TC956XMAC_GET_RXP_37    0x8c
+#define OPCODE_MBX_VF_GET_HW_STMP		0x8d
+#define OPCODE_MBX_VF_GET_MII_REG_1		0x8e
+#define OPCODE_MBX_VF_GET_MII_REG_2		0x8f
+
+enum ethtool_command {
+	TC956XMAC_GET_PAUSE_PARAM = 0x19,
+	TC956XMAC_GET_EEE = 0x20,
+	TC956XMAC_GET_COALESCE = 0x21,
+	TC956XMAC_GET_TS_INFO = 0x22,
+};
+
+#define SIOCSTIOCTL	SIOCDEVPRIVATE
+
+#define TC956XMAC_IOCTL_QMODE_DCB		0x0
+#define TC956XMAC_IOCTL_QMODE_AVB		0x1
+
+#define TC956XMAC0_REG 0
+#define TC956XMAC1_REG 1
+
+
+/* Do not include the SA */
+#define TC956XMAC_SA0_NONE			((TC956XMAC0_REG << 2) | 0)
+/* Include/Insert the SA with value given in MAC Addr 0 Reg */
+#define TC956XMAC_SA0_DESC_INSERT	((TC956XMAC0_REG << 2) | 1)
+/* Replace the SA with the value given in MAC Addr 0 Reg */
+#define TC956XMAC_SA0_DESC_REPLACE	((TC956XMAC0_REG << 2) | 2)
+/* Include/Insert the SA with value given in MAC Addr 0 Reg */
+#define TC956XMAC_SA0_REG_INSERT	((TC956XMAC0_REG << 2) | 2)
+/* Replace the SA with the value given in MAC Addr 0 Reg */
+#define TC956XMAC_SA0_REG_REPLACE	((TC956XMAC0_REG << 2) | 3)
+
+/* Do not include the SA */
+#define TC956XMAC_SA1_NONE			((TC956XMAC1_REG << 2) | 0)
+/* Include/Insert the SA with value given in MAC Addr 1 Reg */
+#define TC956XMAC_SA1_DESC_INSERT	((TC956XMAC1_REG << 2) | 1)
+/* Replace the SA with the value given in MAC Addr 1 Reg */
+#define TC956XMAC_SA1_DESC_REPLACE	((TC956XMAC1_REG << 2) | 2)
+/* Include/Insert the SA with value given in MAC Addr 1 Reg */
+#define TC956XMAC_SA1_REG_INSERT	((TC956XMAC1_REG << 2) | 2)
+/* Replace the SA with the value given in MAC Addr 1 Reg */
+#define TC956XMAC_SA1_REG_REPLACE	((TC956XMAC1_REG << 2) | 3)
+
+/* for PTP offloading configuration */
+#define TC956X_PTP_OFFLOADING_DISABLE			0
+#define TC956X_PTP_OFFLOADING_ENABLE			1
+
+#define TC956X_PTP_ORDINARY_SLAVE			1
+#define TC956X_PTP_ORDINARY_MASTER			2
+#define TC956X_PTP_TRASPARENT_SLAVE			3
+#define TC956X_PTP_TRASPARENT_MASTER			4
+#define TC956X_PTP_PEER_TO_PEER_TRANSPARENT		5
+
+#define TC956X_AUX_SNAPSHOT_0				1
+
+struct tc956x_ioctl_aux_snapshot {
+	__u32 cmd;
+	__u32 aux_snapshot_ctrl;
+};
+#ifdef TC956X_SRIOV_PF
+struct tc956x_config_ptpoffloading {
+	__u32 cmd;
+	bool en_dis; /* Enable/Disable */
+	int mode;  /* PTP Ordinary/Transparent Slave, Ordinary/Transparent Master, Peer to Peer Transparent */
+	int domain_num; /* Domain Number between 0 and 0xFF */
+	bool mc_uc; /* Enable/Disable */
+	unsigned char mc_uc_addr[ETH_ALEN]; /* Mac Address */
+};
+
+struct tc956x_config_ost {
+	__u32 cmd;
+	bool en_dis; /* Enable/Disable OST */
+};
+
+struct tc956xmac_ioctl_qmode_cfg {
+	__u32 cmd;
+	__u32 queue_idx;
+	__u32 queue_mode;
+};
+#elif defined TC956X_SRIOV_VF
+struct tc956x_config_ptpoffloading {
+	__u32 cmd;
+	int en_dis;
+	int mode;
+	int domain_num;
+	int mc_uc;
+	unsigned char mc_uc_addr[ETH_ALEN];
+};
+
+struct tc956x_config_ost {
+	__u32 cmd;
+	int en_dis;
+};
+#endif
+struct tc956xmac_ioctl_cbs_params {
+	__u32 send_slope; /* Send Slope value supported 15 bits */
+	__u32 idle_slope; /* Idle Slope value supported 20 bits */
+	__u32 high_credit; /* High Credit value supported 28 bits */
+	__u32 low_credit; /* Low Credit value supported 28 bits */
+	__u32 percentage; /* Dummy */
+};
+
+struct tc956xmac_ioctl_cbs_cfg {
+	__u32 cmd;
+	__u32 queue_idx;
+	struct tc956xmac_ioctl_cbs_params speed100cfg;
+	struct tc956xmac_ioctl_cbs_params speed1000cfg;
+	struct tc956xmac_ioctl_cbs_params speed10000cfg;
+	struct tc956xmac_ioctl_cbs_params speed5000cfg;
+	struct tc956xmac_ioctl_cbs_params speed2500cfg;
+
+};
+
+struct tc956xmac_ioctl_speed {
+	__u32 cmd;
+	__u32 queue_idx;
+	__u32 connected_speed;
+};
+struct tc956xmac_ioctl_l2_da_filter {
+	unsigned int cmd;
+	unsigned int chInx;
+	int command_error;
+	/* 0 - perfect and 1 - hash filtering */
+	int perfect_hash;
+	/* 0 - perfect and 1 - inverse matching */
+	int perfect_inverse_match;
+};
+
+struct tc956xmac_ioctl_vlan_filter {
+	__u32 cmd;
+	/* 0 - disable and 1 - enable */
+	/* Please note 0 - disable is not supported */
+	int filter_enb_dis;
+	/* 0 - perfect and 1 - hash filtering */
+	int perfect_hash;
+	/* 0 - perfect and 1 - inverse matching */
+	int perfect_inverse_match;
+};
+
+struct tc956xmac_ioctl_free_desc {
+	__u32 cmd;
+	__u32 queue_idx;
+	void *ptr;
+};
+
+struct tc956xmac_PPS_Config {
+	__u32 cmd;
+	unsigned int ptpclk_freq; /* Maximum 250MHz */
+	unsigned int ppsout_freq; /* PPS Output Frequency */
+	unsigned int ppsout_duty; /* Duty Cycle between 0 and 100 */
+	unsigned int ppsout_align_ns; /* first output align to ppsout_align_ns in ns. */
+	unsigned short ppsout_ch; /* Ch0 and Ch1 */
+	bool ppsout_align; /* first output align */
+};
+
+struct tc956xmac_ioctl_reg_rd_wr {
+	__u32 cmd;
+	__u32 queue_idx;
+	__u32 bar_num;
+	__u32 addr;
+	void *ptr;
+};
+
+struct tc956xmac_ioctl_loopback {
+	__u32 cmd;
+	__u32 flags;
+};
+struct tc956xmac_ioctl_phy_loopback {
+	__u32 cmd;
+	__u32 flags;
+	__u32 phy_reg;
+	__u32 bit;
+};
+
+struct tc956xmac_rx_parser_entry {
+	__le32 match_data;
+	__le32 match_en;
+	__u8 af:1;
+	__u8 rf:1;
+	__u8 im:1;
+	__u8 nc:1;
+	__u8 res1:4;
+	__u8 frame_offset:6;
+	__u8 res2:2;
+	__u8 ok_index;
+	__u8 res3;
+	__u16 dma_ch_no;
+	__u16 res4;
+} __packed;
+
+struct tc956xmac_ioctl_rxp_entry {
+	__u32 match_data;
+	__u32 match_en;
+	__u8 af:1;
+	__u8 rf:1;
+	__u8 im:1;
+	__u8 nc:1;
+	__u8 res1:4;
+	__u8 frame_offset:6;
+	__u8 res2:2;
+	__u8 ok_index;
+	__u8 res3;
+	__u16 dma_ch_no;
+	__u16 res4;
+} __attribute__((packed));
+
+#define TC956XMAC_RX_PARSER_MAX_ENTRIES		128
+
+struct tc956xmac_rx_parser_cfg {
+	bool enable;
+	__u32 nve;
+	__u32 npe;
+	struct tc956xmac_rx_parser_entry entries[TC956XMAC_RX_PARSER_MAX_ENTRIES];
+};
+
+struct tc956xmac_ioctl_rxp_cfg {
+	__u32 cmd;
+	__u32 frpes;
+	__u32 enabled;
+	__u32 nve;
+	__u32 npe;
+	struct tc956xmac_ioctl_rxp_entry entries[TC956XMAC_RX_PARSER_MAX_ENTRIES];
+};
+
+#define TC956XMAC_IOCTL_EST_GCL_MAX_ENTRIES		128
+
+struct tc956xmac_ioctl_est_cfg {
+	__u32 cmd;
+	__u32 enabled;
+	__u32 estwid;		/* parameter used to get the value and not used in set */
+	__u32 estdep;		/* parameter used to get the value and not used in set */
+	__u32 btr_offset[2];
+	__u32 ctr[2];
+	__u32 ter;
+	__u32 gcl[TC956XMAC_IOCTL_EST_GCL_MAX_ENTRIES];
+	__u32 gcl_size;
+};
+
+struct tc956xmac_ioctl_fpe_cfg {
+	__u32 cmd;
+	__u32 enabled;
+	__u32 pec;
+	__u32 afsz;
+	__u32 RA_time;
+	__u32 HA_time;
+};
+
+struct tc956xmac_ioctl_sa_ins_cfg {
+	__u32 cmd;
+	unsigned int control_flag;
+	unsigned char mac_addr[ETH_ALEN];
+
+};
+
+struct tc956xmac_ioctl_tx_qcnt {
+	__u32 cmd;
+	__u32 queue_idx;
+	void *ptr;
+};
+
+struct tc956xmac_ioctl_rx_qcnt {
+	__u32 cmd;
+	__u32 queue_idx;
+	void *ptr;
+};
+
+struct tc956xmac_ioctl_pcie_reg_rd_wr {
+	__u32 cmd;
+	__u32 addr;
+	void *ptr;
+};
+
+struct tc956x_ioctl_fwstatus {
+	__u32 cmd;
+	__u32 wdt_count;
+	__u32 systick_count;
+	__u32 fw_status;
+};
+
+struct tc956xmac_ioctl_vlan_strip_cfg {
+	__u32 cmd;
+	__u32 enabled; /* 1 to enable stripping, 0 to disable stripping */
+};
+
+enum lane_width {
+	LANE_1	= 1,
+	LANE_2	= 2,
+	LANE_4	= 4,
+};
+
+enum pcie_speed {
+	GEN_1	= 1, /*2.5 GT/s*/
+	GEN_2	= 2, /*5 GT/s*/
+	GEN_3	= 3, /*8 GT/s*/
+};
+
+/**
+ * enum port - Enumeration for ports available
+ */
+enum ports {
+	UPSTREAM_PORT     = 0U, /* Used for Calculating port Offset */
+	DOWNSTREAM_PORT1  = 1U,
+	DOWNSTREAM_PORT2  = 2U,
+	INTERNAL_ENDPOINT = 3U,
+};
+
+#ifdef TC956X_PCIE_LOGSTAT
+
+/**
+ * enum state_log_enable - Enumeration for State Log Enable
+ */
+enum state_log_enable {
+	STATE_LOG_DISABLE = 0U,
+	STATE_LOG_ENABLE  = 1U,
+};
+
+/**
+ * struct tc956x_pcie_link_params - PCIe Link Parameters
+ *
+ * PCIe Link Parameters
+ * ltssm : Link Training and Status State Machine(LTSSM) Value(0 to 0x1F).
+ * dll : Data Link Layer Active/Inactive State Value(0, 1).
+ * speed : Link Speed (Gen1 : 2.5GT/s, Gen2 : 5 GT/s, Gen3 : 8GT/s).
+ * width : Number of Active Lanes(0, 1, 2, 3, 4).
+ */
+struct tc956x_pcie_link_params {
+	__u8 ltssm; /* Current Link Training and Status State Machine(LTSSM) Value */
+	__u8 dll; /* Current Data Link Layer State */
+	__u8 speed; /* Current Link Speed */
+	__u8 width; /* Current Link Width */
+};
+#endif /* #ifdef TC956X_PCIE_LOGSTAT */
+/**
+ * struct tc956x_ioctl_pcie_lane_change - IOCTL arguments for
+ * PCIe USP and DSPs lane change for power reduction
+ * dst_lane - Lane number which has to be switched from current configuration
+ * port - this lane switch to be operated on which port
+ */
+struct tc956x_ioctl_pcie_lane_change {
+	__u32 cmd;
+	enum lane_width target_lane_width; /* 1, 2, 4 */
+	enum ports port; /* USP, DSP1, others return error*/
+};
+
+
+/**
+ * struct tc956x_ioctl_pcie_set_tx_margin - IOCTL arguments for
+ * PCIe USP and DSPs tx margin change for power reduction
+ * txmargin - target tx margin value.
+ * port - USP/DSP1/DSP2 on which Tx margin setting to be done
+ */
+struct tc956x_ioctl_pcie_set_tx_margin {
+	__u32 cmd;
+	__u16 txmargin; /* Set Only LSB 0:8 bits valid*/
+	enum ports port; /* USP, DSP1, DSP2*/
+};
+
+/**
+ * struct tc956x_ioctl_pcie_set_tx_deemphasis - IOCTL arguments for
+ * PCIe USP and DSPs tx de-emphasis change for power reduction
+ * enable - enable or disable tx demphasis setting value.
+ * txpreset - Gen3 Tx preset value as defined by PCIe Base Specifications
+ * port - USP/DSP1/DSP2 on which Tx Deemphasis setting to be done
+ * Note: Gen1, Gen2 txpreset configuration not supported
+ */
+struct tc956x_ioctl_pcie_set_tx_deemphasis {
+	__u32 cmd;
+	__u8 enable; /* 1: enable, 0: disable*/
+	__u8 txpreset; /* Gen3 tx preset, valid values are from 0 to 10; dont care in case of 'disable' selection */
+	enum ports port; /* USP, DSP1, DSP2*/
+};
+
+
+/**
+ * struct tc956x_ioctl_pcie_set_dfe - IOCTL arguments for
+ * PCIe USP and DSPs DFE disable/enable for power reduction
+ * enable - enable or disable DFE
+ * port - USP/DSP1/DSP2 on which DFE should be enabled/disabled
+ */
+struct tc956x_ioctl_pcie_set_dfe {
+	__u32 cmd;
+	__u8 enable; /* 1: enable, 0: disable*/
+	enum ports port; /* USP, DSP1, DSP2*/
+};
+
+/**
+ * struct tc956x_ioctl_pcie_set_ctle_fixed_mode - IOCTL arguments for
+ * PCIe USP and DSPs CTLE configuration
+ * eqc_force - CTLE C value
+ * eq_res - CTLE R value
+ * vga_ctrl - CTLE VGA value
+ * port - USP/DSP1/DSP2 on which CTLE fixed mode setting to be done
+ */
+
+struct tc956x_ioctl_pcie_set_ctle_fixed_mode {
+	__u32 cmd;
+	__u8 eqc_force;
+	__u8 eq_res;
+	__u8 vga_ctrl;
+	enum ports port; /* USP, DSP1, DSP2r*/
+};
+
+/**
+ * struct tc956x_ioctl_pcie_set_speed - IOCTL arguments for
+ * PCIe USP and DSPs speed change
+ * speed - target pcie gen speed
+ */
+struct tc956x_ioctl_pcie_set_speed {
+	__u32 cmd;
+	enum pcie_speed speed; /*1 or 2 or 3*/
+};
+#ifdef TC956X_PCIE_LOGSTAT
+
+/**
+ * struct tc956x_ioctl_state_log_summary - IOCTL arguments for
+ * State Logging Summary.
+ *
+ * cmd - TC956X_PCIE_STATE_LOG_SUMMARY IOCTL.
+ * port - USP/DSP1/DSP2/EP for which state logging enable/disbale to be done.
+ */
+struct tc956x_ioctl_state_log_summary {
+	__u32 cmd;
+	enum ports port; /* USP, DSP1, DSP2, EP*/
+};
+
+/**
+ * struct tc956x_ioctl_state_log_enable - IOCTL arguments for
+ * Enabling/Disabling State Logging.
+ *
+ * cmd - TC956X_PCIE_STATE_LOG_ENABLE IOCTL.
+ * enable - enable/disable state log.
+ * port - USP/DSP1/DSP2/EP for which state logging enable/disbale to be done.
+ */
+struct tc956x_ioctl_state_log_enable {
+	__u32 cmd;
+	enum state_log_enable enable; /* Enable/Disable */
+	enum ports port; /* USP, DSP1, DSP2, EP*/
+};
+
+/**
+ * struct tc956x_ioctl_pcie_link_params - IOCTL arguments for State log data
+ *
+ * cmd - TC956X_PCIE_GET_PCIE_LINK_PARAMS IOCTL.
+ * link_param - structure for pcie link parameters to read.
+ * port - USP/DSP1/DSP2/EP for which state link parameters to be read.
+ */
+struct tc956x_ioctl_pcie_link_params {
+	__u32 cmd;
+	struct tc956x_pcie_link_params *link_param;
+	enum ports port;
+};
+
+#endif /* #ifdef TC956X_PCIE_LOGSTAT */
+
+#endif /*_IOCT_H */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_main.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_main.c
@@ -0,0 +1,16665 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_main.c
+ *
+ * Copyright(C) 2007-2011 STMicroelectronics Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  15 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported without module parameter
+ *  VERSION     : 01-00-02
+ *  20 Jul 2021 : 1. Flash MDIO ioctl supported
+ *                2. Rxp statistics function removed
+ *  VERSION     : 01-00-03
+ *  22 Jul 2021 : 1. USXGMII/XFI/SGMII/RGMII interface supported with module parameters
+ *  VERSION     : 01-00-04
+ *  22 Jul 2021 : 1. Dynamic CM3 TAMAP configuration
+ *  VERSION     : 01-00-05
+ *  05 Aug 2021 : 1. Register Port0 as only PCIe device, incase its PHY is not found
+ *  VERSION     : 01-00-08
+ *  16 Aug 2021 : 1. PHY interrupt mode supported through .config_intr and .ack_interrupt API
+ *  VERSION     : 01-00-09
+ *  24 Aug 2021 : 1. Platform API supported
+ *  VERSION     : 01-00-10
+ *  14 Sep 2021 : 1. Synchronization between ethtool vlan features
+ *                   "rx-vlan-offload", "rx-vlan-filter", "tx-vlan-offload" output and register settings.
+ *                2. Added ethtool support to update "rx-vlan-offload", "rx-vlan-filter",
+ *                   and "tx-vlan-offload".
+ *                3. Removed IOCTL TC956XMAC_VLAN_STRIP_CONFIG.
+ *                4. Removed "Disable VLAN Filter" option in IOCTL TC956XMAC_VLAN_FILTERING.
+ *  VERSION     : 01-00-13
+ *  23 Sep 2021 : 1. Capturing RBU status using MAC EVENT Interupt and updating to ethtool statistics for both S/W & IPA DMA channels
+ *  VERSION     : 01-00-14
+ *  21 Oct 2021 : 1. Added support for GPIO configuration API
+ *  VERSION     : 01-00-18
+ *  26 Oct 2021 : 1. Added support for EEE PHY and MAC Control Mode.
+ *                2. Added dev_pm_ops interface support for suspend-resume.
+ *                3. Changed IRQF_SHARED to IRQF_NO_SUSPEND and added WOL Interrupt Handler support.
+ *                4. Added Platform Apis.
+ *  VERSION     : 01-00-19
+ *  04 Nov 2021 : 1. Stopped disabling/enabling of MAC TX during Link down/up.
+ *  VERSION     : 01-00-20
+ *  08 Nov 2021 : 1. Skip queuing PHY Work during suspend.
+ *  VERSION     : 01-00-21
+ *  24 Nov 2021 : 1. Private member used instead of global for wol interrupt indication
+ *  VERSION     : 01-00-22
+ *  24 Nov 2021 : 1. EEE update for runtime configuration and LPI interrupt disabled.
+ *                2. EEE SW timers removed. Only HW timers used to control EEE LPI entry/exit
+ *                3. USXGMII support during link change
+ *  VERSION     : 01-00-24
+ *  30 Nov 2021 : 1. Added PHY Workqueue Cancel during suspend only if network interface available.
+ *  VERSION     : 01-00-26
+ *  01 Dec 2021 : 1. Free EMAC IRQ during suspend and request EMAC IRQ during resume.
+ *  VERSION     : 01-00-27
+ *  03 Dec 2021 : 1. Added error check for phydev in tc956xmac_suspend().
+ *  VERSION     : 01-00-29
+ *  08 Dec 2021 : 1. Added Module parameter for Rx & Tx Queue Size configuration.
+ *  VERSION     : 01-00-30
+ *  10 Dec 2021 : 1. Added Module parameter to count Link partner pause frames and output to ethtool.
+ *  VERSION     : 01-00-31
+ *  27 Dec 2021 : 1. Support for eMAC Reset and unused clock disable during Suspend and restoring it back during resume.
+ *                2. Resetting and disabling of unused clocks for eMAC Port, when no-found PHY for that particular port.
+ *                3. Valid phy-address and mii-pointer NULL check in tc956xmac_suspend().
+ *                4. Version update.
+ *  VERSION     : 01-00-32
+ *  06 Jan 2022 : 1. Null check added while freeing skb buff data
+ *  VERSION     : 01-00-33
+ *  07 Jan 2022 : 1. During emac resume, attach the net device after initializing the queues
+ *  VERSION     : 01-00-34
+ *  11 Jan 2022 : 1. Fixed phymode support added
+ *                2. Error return when no phy driver found during ISR work queue execution
+ *  VERSION     : 01-00-35
+ *  18 Jan 2022 : 1. IRQ device name change
+ *  VERSION     : 01-00-36
+ *  20 Jan 2022 : 1. Reset eMAC if port unavailable (PHY not connected) during suspend-resume.
+ *  VERSION     : 01-00-37
+ *  31 Jan 2022 : 1. Debug dump API supported to dump registers during crash.
+ *  VERSION     : 01-00-39
+ *  04 Feb 2022 : 1. DMA channel status cleared only for SW path allocated DMA channels. IPA path DMA channel status clearing is skipped.
+ *  VERSION     : 01-00-41
+ *  14 Feb 2022 : 1. Reset assert and clock disable support during Link Down.
+ *  VERSION     : 01-00-42
+ *  22 Feb 2022 : 1. Supported GPIO configuration save and restoration
+ *  VERSION     : 01-00-43
+ *  25 Feb 2022 : 1. XPCS module is re-initialized after link-up as MACxPONRST is asserted during link-down.
+ *                2. Disable Rx side EEE LPI before configuring Rx Parser (FRP). Enable the same after Rx Parser configuration.
+ *  VERSION     : 01-00-44
+ *  09 Mar 2022 : 1. Handling of Non S/W path DMA channel abnormal interrupts in Driver and only TI & RI interrupts handled in FW.
+ *                2. Reading MSI status for checking interrupt status of SW MSI.
+ *  VERSION     : 01-00-45
+ *  05 Apr 2022 : 1. Disable MSI and flush phy work queue during driver release.
+ *  VERSION     : 01-00-47
+ *  06 Apr 2022 : 1. Dynamic MTU change supported. Max MTU supported is 2000 bytes.
+ *                2. Constant buffer size of 2K used, so that during MTU change there is no buffer reconfiguration.
+ *  VERSION     : 01-00-48
+ *  14 Apr 2022 : 1. Ignoring error from tc956xmac_hw_setup in tc956xmac_open API.
+ *  VERSION     : 01-00-49
+ *  25 Apr 2022 : 1. Perform platform remove after MDIO deregistration.
+ *  VERSION     : 01-00-50
+ *  29 Apr 2022 : 1. Added Lock for syncing linkdown, port rlease and release of offloaded DMA channels.
+ *                2. Added kernel Module parameter for selecting Power saving at Link down.
+ *  VERSION     : 01-00-51
+ *  15 Jun 2022 : 1. Added debugfs support for module specific register dump
+ *  VERSION     : 01-00-52
+ *  08 Aug 2022 : 1. Disable RBU interrupt on RBU interrupt occurance. IPA SW should enable it back.
+ *  VERSION     : 01-00-53
+ *  31 Aug 2022 : 1. Added Fix for configuring Rx Parser when EEE is enabled and RGMII Interface is used
+ *  VERSION     : 01-00-54
+ *  02 Sep 2022 : 1. 2500Base-X support for line speeds 2.5Gbps, 1Gbps, 100Mbps.
+ *  VERSION     : 01-00-55
+ *  09 Nov 2022 : 1. Update of fix for configuring Rx Parser when EEE is enabled
+ *  VERSION     : 01-00-57
+ *  22 Dec 2022 : 1. Support for SW reset during link down.
+ *                2. Module parameters introduced for the control of SW reset and by default SW reset is disabled.
+ *  VERSION     : 01-00-58
+ *  10 Nov 2023 : 1. Kernel 6.1 Porting changes.
+ *                2. DSP Cascade related modifications.
+ *  VERSION     : 01-02-59
+ *  26 Dec 2023 : 1. Kernel 6.6 Porting changes
+ *                2. Added the support for TC commands taprio and flower
+ *  VERSION     : 01-03-59
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *                3. Added support for board device RBTC9563_3MA
+ *  VERSION     : 04-00
+ *  29 Mar 2024 : 1. Support for without MDIO and without PHY case
+ *                2. Bug fix for SGMII 1Gbps speed change
+ *                3. Support for TC956x switch to switch connection (upto 2 level) over DSP ports
+ *  VERSION     : 04-00
+ */
+
+#include <linux/clk.h>
+#include <linux/kernel.h>
+#include <linux/interrupt.h>
+#include <linux/iopoll.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/skbuff.h>
+#include <linux/ethtool.h>
+#include <linux/if_ether.h>
+#include <linux/crc32.h>
+#include <linux/mii.h>
+#include <linux/if.h>
+#include <linux/if_vlan.h>
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+#include <linux/prefetch.h>
+#include <linux/pinctrl/consumer.h>
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#endif /* CONFIG_DEBUG_FS */
+#endif /* TC956X_SRIOV_PF */
+#include <linux/net_tstamp.h>
+#ifdef TC956X_SRIOV_PF
+#include <linux/phylink.h>
+#endif
+#include <linux/udp.h>
+#include <net/pkt_cls.h>
+#include "tc956xmac_ptp.h"
+#include "tc956xmac.h"
+#include <linux/reset.h>
+#include <linux/of_mdio.h>
+#include <linux/version.h>
+#include <linux/ctype.h>
+#include "dwxgmac2.h"
+#include "hwif.h"
+#include "common.h"
+#include "tc956xmac_ioctl.h"
+#ifdef TC956X_5_G_2_5_G_EEE_SUPPORT
+#include <linux/phy.h>
+#include <linux/linkmode.h>
+#endif
+#ifdef TC956X_SRIOV_PF
+#include "tc956x_pf_rsc_mng.h"
+#include "tc956x_pf_mbx.h"
+#include "tc956x_pf_rsc_mng.h"
+#endif
+
+#ifdef TC956X_SRIOV_VF
+#include "tc956x_vf_mbx.h"
+#endif
+#ifdef TC956X_PCIE_LOGSTAT
+#include "tc956x_pcie_logstat.h"
+#endif /* #ifdef TC956X_PCIE_LOGSTAT */
+
+#define	TSO_MAX_BUFF_SIZE	(SZ_16K - 1)
+#define PPS_START_DELAY		100000000	/* 100 ms, in unit of ns */
+
+#include <linux/i2c.h>
+#define EEPROM_I2C_ADDRESS	0x50
+#define EEPROM_I2C_ADAPTER_ID	1
+#define EEPROM_READ_BYTE	300
+#define EEPROM_WRITE_OFFSET_BYTE	2
+
+typedef enum {
+	MAC_SRC_CONFIG_FILE = 0x0,
+	MAC_SRC_PLATFORM_EEPROM = 0x1,
+} MacSrcType_t;
+
+#ifdef TC956X_DYNAMIC_LOAD_CBS
+int prev_speed;
+#endif
+/* Module parameters */
+#define TX_TIMEO	5000
+static int watchdog = TX_TIMEO;
+module_param(watchdog, int, 0644);
+MODULE_PARM_DESC(watchdog, "Transmit timeout in milliseconds (default 5s)");
+
+static int debug = -1;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "Message Level (-1: default, 0: no output, 16: all)");
+
+static int phyaddr = -1;
+module_param(phyaddr, int, 0444);
+MODULE_PARM_DESC(phyaddr, "Physical device address");
+
+#define TC956XMAC_TX_THRESH	(DMA_TX_SIZE / 4)
+#define TC956XMAC_RX_THRESH	(DMA_RX_SIZE / 4)
+
+static int flow_ctrl = FLOW_AUTO;
+module_param(flow_ctrl, int, 0644);
+MODULE_PARM_DESC(flow_ctrl, "Flow control ability [on/off]");
+
+static int pause = PAUSE_TIME;
+module_param(pause, int, 0644);
+MODULE_PARM_DESC(pause, "Flow Control Pause Time");
+
+#define TC_DEFAULT 64
+static int tc = TC_DEFAULT;
+module_param(tc, int, 0644);
+MODULE_PARM_DESC(tc, "DMA threshold control value");
+
+#define	DEFAULT_BUFSIZE	1536
+static int buf_sz = DEFAULT_BUFSIZE;
+module_param(buf_sz, int, 0644);
+MODULE_PARM_DESC(buf_sz, "DMA buffer size");
+
+#define	TC956XMAC_RX_COPYBREAK	256
+
+static const u32 default_msg_level = (NETIF_MSG_DRV | NETIF_MSG_PROBE |
+				      NETIF_MSG_LINK | NETIF_MSG_IFUP |
+				      NETIF_MSG_IFDOWN | NETIF_MSG_TIMER);
+
+#ifdef TC956X_SRIOV_PF
+static void tc956x_ptp_configuration(struct tc956xmac_priv *priv, u32 tcr_config);
+#endif
+
+#define TC956XMAC_DEFAULT_LPI_TIMER	1000
+static int eee_timer = TC956XMAC_DEFAULT_LPI_TIMER;
+module_param(eee_timer, int, 0644);
+MODULE_PARM_DESC(eee_timer, "LPI tx expiration time in msec");
+#define TC956XMAC_LPI_T(x) (jiffies + msecs_to_jiffies(x))
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+static bool port_brige_state;
+static DEFINE_MUTEX(tc956x_port_bridge_lock);
+#endif
+
+static unsigned int mac0_rx_watchdog_timeout = DEF_DMA_RIWT;
+module_param(mac0_rx_watchdog_timeout, uint, 0444);
+MODULE_PARM_DESC(mac0_rx_watchdog_timeout,
+				"Port-0 Receive Watchdog timeout Range: [0x1 - 0xFF]");
+
+static unsigned int mac1_rx_watchdog_timeout = DEF_DMA_RIWT;
+module_param(mac1_rx_watchdog_timeout, uint, 0444);
+MODULE_PARM_DESC(mac1_rx_watchdog_timeout,
+				"Port-1 Receive Watchdog timeout Range: [0x1 - 0xFF]");
+
+static unsigned int mac0_tx_interrupt_num = TC956XMAC_TX_FRAMES;
+module_param(mac0_tx_interrupt_num, int, 0444);
+MODULE_PARM_DESC(mac0_tx_interrupt_num, "Port-0 Tx interrupt number");
+
+static unsigned int mac1_tx_interrupt_num = TC956XMAC_TX_FRAMES;
+module_param(mac1_tx_interrupt_num, int, 0444);
+MODULE_PARM_DESC(mac1_tx_interrupt_num, "Port-1 Tx interrupt number");
+
+/* By default the driver will use the ring mode to manage tx and rx descriptors,
+ * but allow user to force to use the chain instead of the ring
+ */
+static unsigned int chain_mode;
+module_param(chain_mode, int, 0444);
+MODULE_PARM_DESC(chain_mode, "To use chain instead of ring mode");
+#if defined(TC956X_SRIOV_PF)
+static irqreturn_t tc956xmac_interrupt_v0(int irq, void *dev_id);
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_CPE_CONFIG)
+/* One interrupt handler for Automotive, CPE config */
+static irqreturn_t tc956xmac_interrupt_v1(int irq, void *dev_id);
+#endif
+#elif defined(TC956X_SRIOV_VF)
+static irqreturn_t tc956xmac_interrupt_v0(int irq, void *dev_id);
+#endif
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+static const struct net_device_ops tc956xmac_netdev_ops;
+static void tc956xmac_init_fs(struct net_device *dev);
+static void tc956xmac_exit_fs(struct net_device *dev);
+#endif
+#endif /* TC956X_SRIOV_PF */
+
+#ifdef TC956X_SRIOV_PF
+extern struct tx956x_shrd_mem tx956x_pci_shrd_mem[TC956X_TOT_CASCADE_DEV];
+
+extern void tc956x_pf_del_umac_addr(struct tc956xmac_priv *priv, int index, int vf);
+extern void tc956x_pf_del_mac_filter(struct net_device *dev, int vf, const u8 *mac);
+extern void tc956x_pf_del_vlan_filter(struct net_device *dev, u16 vf, u16 vid);
+extern void tc956xmac_get_pauseparam(struct net_device *netdev,
+									struct ethtool_pauseparam *pause);
+
+int tc956xmac_ioctl_set_cbs(struct tc956xmac_priv *priv, void *data);
+int tc956xmac_ioctl_get_cbs(struct tc956xmac_priv *priv, void *data);
+int tc956xmac_ioctl_get_est(struct tc956xmac_priv *priv, void *data);
+int tc956xmac_ioctl_set_est(struct tc956xmac_priv *priv, void *data);
+int tc956xmac_ioctl_get_fpe(struct tc956xmac_priv *priv, void *data);
+int tc956xmac_ioctl_set_fpe(struct tc956xmac_priv *priv, void *data);
+int tc956xmac_ioctl_get_rxp(struct tc956xmac_priv *priv, void *data);
+int tc956xmac_ioctl_set_rxp(struct tc956xmac_priv *priv, void *data);
+void tc956xmac_service_mbx_event_schedule(struct tc956xmac_priv *priv);
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+extern int tc956x_pf_set_mac_filter(struct net_device *dev, int vf, const u8 *mac);
+#endif
+
+#endif /* TC956X_SRIOV_PF */
+#define TC956XMAC_COAL_TIMER(x) (jiffies + usecs_to_jiffies(x))
+
+/* MAC address */
+#ifdef TC956X_SRIOV_PF
+static u8 dev_addr[14][6] = {
+				{0xEC, 0x21, 0xE5, 0x10, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x11, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x12, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x13, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x14, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x15, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x16, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x17, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x18, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x19, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x1A, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x1B, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x1C, 0x4F, 0xEA},
+				{0xEC, 0x21, 0xE5, 0x1D, 0x4F, 0xEA},
+			};
+
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+u8 flow_ctrl_addr[6] = {0x01, 0x80, 0xC2, 0x00, 0x00, 0x01};
+#endif
+
+#elif defined(TC956X_SRIOV_VF) /* Defining different MAC address for VF */
+static u8 dev_addr[2][3][6] = {
+				{ /* PF-0 */
+				{0xEC, 0x21, 0xE5, 0x12, 0x4F, 0xEA}, /* VF-0 */
+				{0xEC, 0x21, 0xE5, 0x13, 0x4F, 0xEA}, /* VF-1 */
+				{0xEC, 0x21, 0xE5, 0x14, 0x4F, 0xEA}, /* VF-2 */
+				},
+				{ /* PF-1 */
+				{0xEC, 0x21, 0xE5, 0x15, 0x4F, 0xEA}, /* VF-0 */
+				{0xEC, 0x21, 0xE5, 0x16, 0x4F, 0xEA}, /* VF-1 */
+				{0xEC, 0x21, 0xE5, 0x17, 0x4F, 0xEA}, /* VF-2 */
+				},
+			};
+#endif
+
+#ifdef TC956X
+#ifndef TC956X_SRIOV_VF
+#define TX_PRESET_MAX		11
+static u8 tx_demphasis_setting[TX_PRESET_MAX][2] =	{
+			{0x00, 0x14}, /*Preshoot: 0 dB, De-emphasis: -6 dB*/
+			{0x00, 0x0E}, /*Preshoot: 0 dB, De-emphasis: -3.5 dB*/
+			{0x00, 0x10}, /*Preshoot: 0 dB, De-emphasis: -4.4 dB*/
+			{0x00, 0x0A}, /*Preshoot: 0 dB, De-emphasis: -2.5 dB*/
+			{0x00, 0x00}, /*Preshoot: 0 dB, De-emphasis: 0 dB*/
+			{0x08, 0x00}, /*Preshoot: 1.9 dB, De-emphasis: 0 dB*/
+			{0x0A, 0x00}, /*Preshoot: 2.5 dB, De-emphasis: 0 dB*/
+			{0x08, 0x10}, /*Preshoot: 3.5 dB, De-emphasis: -6 dB*/
+			{0x0A, 0x0A}, /*Preshoot: 3.5 dB, De-emphasis: -3.5 dB*/
+			{0x0E, 0x00}, /*Preshoot: 3.5 dB, De-emphasis: 0 dB*/
+			{0x00, 0x1B}, /*Preshoot: 0 dB, De-emphasis: -9.1 dB*/
+};
+#endif /* TC956X_SRIOV_VF */
+#endif
+
+struct config_parameter_list {
+	char mdio_key[32];
+	unsigned short mdio_key_len;
+	char mac_key[32];
+	unsigned short mac_key_len;
+	unsigned short mac_str_len;
+	char mac_str_def[20];
+};
+
+static const struct config_parameter_list config_param_list[] = {
+{"MDIOBUSID", 9, "MAC_ID", 6, 17, "00:00:00:00:00:00"},
+};
+
+static uint16_t mdio_bus_id;
+#define CONFIG_PARAM_NUM ARRAY_SIZE(config_param_list)
+int tc956xmac_rx_parser_configuration(struct tc956xmac_priv *);
+
+/* Source Address in Pause frame from PHY */
+static u8 phy_sa_addr[2][6] = {
+	{0x00, 0x01, 0x02, 0x03, 0x04, 0x05}, /*For Port-0*/
+	{0x00, 0x01, 0x02, 0x03, 0x04, 0x05}, /*For Port-1*/
+};
+extern unsigned int mac0_en_lp_pause_frame_cnt;
+extern unsigned int mac1_en_lp_pause_frame_cnt;
+#ifndef TC956X_SRIOV_VF
+
+extern unsigned int mac_power_save_at_link_down;
+
+extern unsigned int mac0_force_speed_mode;
+extern unsigned int mac1_force_speed_mode;
+
+extern unsigned int mac0_link_down_macrst;
+extern unsigned int mac1_link_down_macrst;
+
+static int dwxgmac2_rx_parser_read_entry(struct tc956xmac_priv *priv,
+		struct tc956xmac_rx_parser_entry *entry, int entry_pos)
+{
+	void __iomem *ioaddr = priv->ioaddr;
+	int limit;
+	int i;
+	u32 reg_val;
+
+	for (i = 0; i < (sizeof(*entry) / sizeof(u32)); i++) {
+		int real_pos = entry_pos * (sizeof(*entry) / sizeof(u32)) + i;
+
+		/* Set Entry Position */
+		reg_val = readl(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+		reg_val = reg_val & (~XGMAC_ADDR);
+		reg_val |= (real_pos & XGMAC_ADDR);
+		writel(reg_val, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+		/* Set Read op */
+		reg_val = readl(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+		reg_val &= ~XGMAC_WRRDN;
+		writel(reg_val, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+		/* Start read */
+		reg_val = readl(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+		reg_val |= XGMAC_STARTBUSY;
+		writel(reg_val, ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST);
+
+
+		limit = 10000;
+		while (limit--) {
+			if (!(readl(ioaddr + XGMAC_MTL_RXP_IACC_CTRL_ST) &
+			      XGMAC_STARTBUSY))
+				break;
+			udelay(1);
+		}
+		if (limit < 0)
+			return -EBUSY;
+
+		/* Read Data Reg */
+		*((unsigned int  *)entry + i) = readl(ioaddr  + XGMAC_MTL_RXP_IACC_DATA);
+	}
+
+	return 0;
+}
+
+
+int tc956x_dump_regs(struct net_device *net_device, struct tc956x_regs *regs)
+{
+	struct tc956xmac_priv *priv = netdev_priv(net_device);
+	u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
+	u32 ch, queue, table_entry, reg = 0;
+	struct tc956xmac_tx_queue *tx_q;
+	struct tc956xmac_rx_queue *rx_q;
+	u8 fw_version_str[32];
+	struct tc956x_version *fw_version;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* PCIe register dump */
+	regs->pcie_reg.rsc_mng_id = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG);
+
+	/* Configuration register dump */
+	regs->config_reg.ncid = readl(priv->ioaddr + NCID_OFFSET);
+	regs->config_reg.nclkctrl0 = readl(priv->ioaddr + NCLKCTRL0_OFFSET);
+	regs->config_reg.nrstctrl0 = readl(priv->ioaddr + NRSTCTRL0_OFFSET);
+	regs->config_reg.nclkctrl1 = readl(priv->ioaddr + NCLKCTRL1_OFFSET);
+	regs->config_reg.nrstctrl1 = readl(priv->ioaddr + NRSTCTRL1_OFFSET);
+	regs->config_reg.nemac0ctl = readl(priv->ioaddr + NEMAC0CTL_OFFSET);
+	regs->config_reg.nemac1ctl = readl(priv->ioaddr + NEMAC1CTL_OFFSET);
+	regs->config_reg.nemacsts = readl(priv->ioaddr + NEMACSTS_OFFSET);
+	regs->config_reg.gpioi0 = readl(priv->ioaddr + GPIOI0_OFFSET);
+	regs->config_reg.gpioi1 = readl(priv->ioaddr + GPIOI1_OFFSET);
+	regs->config_reg.gpioe0 = readl(priv->ioaddr + GPIOE0_OFFSET);
+	regs->config_reg.gpioe1 = readl(priv->ioaddr + GPIOE1_OFFSET);
+
+	/* MSI register dump */
+	regs->msi_reg.msi_out_en = readl(priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->port_num, 0));
+	regs->msi_reg.msi_mask_set = readl(priv->ioaddr + TC956X_MSI_MASK_SET_OFFSET(priv->port_num, 0));
+	regs->msi_reg.msi_mask_clr = readl(priv->ioaddr + TC956X_MSI_MASK_CLR_OFFSET(priv->port_num, 0));
+	regs->msi_reg.int_sts = readl(priv->ioaddr + TC956X_MSI_INT_STS_OFFSET(priv->port_num, 0));
+	regs->msi_reg.int_raw_sts = readl(priv->ioaddr + TC956X_MSI_INT_RAW_STS_OFFSET(priv->port_num, 0));
+	regs->msi_reg.msi_sts = readl(priv->ioaddr + TC956X_MSI_STS_OFFSET(priv->port_num, 0));
+	regs->msi_reg.cnt_int0 = readl(priv->ioaddr + TC956X_MSI_CNT0(priv->port_num, 0));
+	regs->msi_reg.cnt_int1 = readl(priv->ioaddr + TC956X_MSI_CNT1(priv->port_num, 0));
+	regs->msi_reg.cnt_int2 = readl(priv->ioaddr + TC956X_MSI_CNT2(priv->port_num, 0));
+	regs->msi_reg.cnt_int3 = readl(priv->ioaddr + TC956X_MSI_CNT3(priv->port_num, 0));
+	regs->msi_reg.cnt_int4 = readl(priv->ioaddr + TC956X_MSI_CNT4(priv->port_num, 0));
+	regs->msi_reg.cnt_int11 = readl(priv->ioaddr + TC956X_MSI_CNT11(priv->port_num, 0));
+	regs->msi_reg.cnt_int12 = readl(priv->ioaddr + TC956X_MSI_CNT12(priv->port_num, 0));
+	regs->msi_reg.cnt_int20 = readl(priv->ioaddr + TC956X_MSI_CNT20(priv->port_num, 0));
+	regs->msi_reg.cnt_int24 = readl(priv->ioaddr + TC956X_MSI_CNT24(priv->port_num, 0));
+
+	/* INTC register dump */
+	regs->intc_reg.intmcumask0 = readl(priv->ioaddr + INTMCUMASK0);
+	regs->intc_reg.intmcumask1 = readl(priv->ioaddr + INTMCUMASK1);
+	regs->intc_reg.intmcumask2 = readl(priv->ioaddr + INTMCUMASK2);
+
+	/* DMA channel register dump */
+	regs->dma_reg.debug_sts0 = readl(priv->ioaddr + XGMAC_DMA_DEBUG_STATUS0);
+
+	for (ch = 0; ch < maxq; ch++) {
+		regs->dma_reg.ch_control[ch] = readl(priv->ioaddr + XGMAC_DMA_CH_CONTROL(ch));
+		regs->dma_reg.interrupt_enable[ch] = readl(priv->ioaddr + XGMAC_DMA_CH_INT_EN(ch));
+		regs->dma_reg.ch_status[ch] = readl(priv->ioaddr + XGMAC_DMA_CH_STATUS(ch));
+		regs->dma_reg.debug_status[ch] = readl(priv->ioaddr + XGMAC_DMA_CH_DBG_STATUS(ch));
+		regs->dma_reg.rxch_watchdog_timer[ch] = readl(priv->ioaddr + XGMAC_DMA_CH_Rx_WATCHDOG(ch));
+	}
+
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+		regs->dma_reg.tx_ch[ch].control = readl(priv->ioaddr + XGMAC_DMA_CH_TX_CONTROL(ch));
+		regs->dma_reg.tx_ch[ch].list_haddr = readl(priv->ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(ch));
+		regs->dma_reg.tx_ch[ch].list_laddr = readl(priv->ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(ch));
+		regs->dma_reg.tx_ch[ch].ring_len = readl(priv->ioaddr + XGMAC_DMA_CH_TX_CONTROL2(ch));
+		regs->dma_reg.tx_ch[ch].curr_haddr = readl(priv->ioaddr + XGMAC_DMA_CH_Cur_TxDESC_HADDR(ch));
+		regs->dma_reg.tx_ch[ch].curr_laddr = readl(priv->ioaddr + XGMAC_DMA_CH_Cur_TxDESC_LADDR(ch));
+		regs->dma_reg.tx_ch[ch].tail_ptr = readl(priv->ioaddr + XGMAC_DMA_CH_TxDESC_TAIL_LPTR(ch));
+		regs->dma_reg.tx_ch[ch].buf_haddr = readl(priv->ioaddr + XGMAC_DMA_CH_Cur_TxBuff_HADDR(ch));
+		regs->dma_reg.tx_ch[ch].buf_laddr = readl(priv->ioaddr + XGMAC_DMA_CH_Cur_TxBuff_LADDR(ch));
+	}
+
+	for (ch = 0; ch < rx_queues_cnt; ch++) {
+		regs->dma_reg.rx_ch[ch].control = readl(priv->ioaddr + XGMAC_DMA_CH_RX_CONTROL(ch));
+		regs->dma_reg.rx_ch[ch].list_haddr = readl(priv->ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(ch));
+		regs->dma_reg.rx_ch[ch].list_laddr = readl(priv->ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(ch));
+		regs->dma_reg.rx_ch[ch].ring_len = readl(priv->ioaddr + XGMAC_DMA_CH_RX_CONTROL2(ch));
+		regs->dma_reg.rx_ch[ch].curr_haddr = readl(priv->ioaddr + XGMAC_DMA_CH_Cur_RxDESC_HADDR(ch));
+		regs->dma_reg.rx_ch[ch].curr_laddr = readl(priv->ioaddr + XGMAC_DMA_CH_Cur_RxDESC_LADDR(ch));
+		regs->dma_reg.rx_ch[ch].tail_ptr = readl(priv->ioaddr + XGMAC_DMA_CH_RxDESC_TAIL_LPTR(ch));
+		regs->dma_reg.rx_ch[ch].buf_haddr = readl(priv->ioaddr + XGMAC_DMA_CH_Cur_RxBuff_HADDR(ch));
+		regs->dma_reg.rx_ch[ch].buf_laddr = readl(priv->ioaddr + XGMAC_DMA_CH_Cur_RxBuff_LADDR(ch));
+	}
+
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+		tx_q = &priv->tx_queue[ch];
+		regs->dma_reg.tx_queue[ch].desc_phy_addr = tx_q->dma_tx_phy;
+		regs->dma_reg.tx_queue[ch].desc_va_addr = tx_q->dma_tx;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+		regs->dma_reg.tx_queue[ch].buff_phy_addr = tx_q->buff_tx_phy;
+		regs->dma_reg.tx_queue[ch].buff_va_addr = (void *)tx_q->buffer_tx_va_addr;
+#endif
+		regs->dma_reg.tx_queue[ch].tx_skbuff = tx_q->tx_skbuff;
+		regs->dma_reg.tx_queue[ch].tx_skbuff_dma = tx_q->tx_skbuff_dma;
+	}
+
+	for (ch = 0; ch < rx_queues_cnt; ch++) {
+		rx_q = &priv->rx_queue[ch];
+		regs->dma_reg.rx_queue[ch].desc_phy_addr = rx_q->dma_rx_phy;
+		regs->dma_reg.rx_queue[ch].desc_va_addr = rx_q->dma_rx;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+		regs->dma_reg.rx_queue[ch].buff_phy_addr = rx_q->buff_rx_phy;
+		regs->dma_reg.rx_queue[ch].buff_va_addr = (void *)rx_q->buffer_rx_va_addr;
+#endif
+		regs->dma_reg.rx_queue[ch].buf_pool = rx_q->buf_pool;
+	}
+
+	/* MAC register dump */
+	regs->mac_reg.mac_tx_config = readl(priv->ioaddr + XGMAC_TX_CONFIG);
+	regs->mac_reg.mac_rx_config = readl(priv->ioaddr + XGMAC_RX_CONFIG);
+	regs->mac_reg.mac_pkt_filter = readl(priv->ioaddr + XGMAC_PACKET_FILTER);
+	regs->mac_reg.mac_tx_rx_status = readl(priv->ioaddr + XGMAC_RX_TX_STS);
+	regs->mac_reg.mac_debug = readl(priv->ioaddr + XGMAC_DEBUG);
+
+	/* MTL register dump */
+	regs->mtl_reg.op_mode = readl(priv->ioaddr + XGMAC_MTL_OPMODE);
+	regs->mtl_reg.mtl_rxq_dma_map0 = readl(priv->ioaddr + XGMAC_MTL_RXQ_DMA_MAP0);
+	regs->mtl_reg.mtl_rxq_dma_map1 = readl(priv->ioaddr + XGMAC_MTL_RXQ_DMA_MAP1);
+
+	for (queue = 0; queue < MTL_MAX_TX_QUEUES; queue++) {
+		regs->mtl_reg.tx_info[queue].op_mode = readl(priv->ioaddr + XGMAC_MTL_TXQ_OPMODE(queue));
+		regs->mtl_reg.tx_info[queue].underflow = readl(priv->ioaddr + XGMAC_MTL_TXQ_UF_OFFSET(queue));
+		regs->mtl_reg.tx_info[queue].debug = readl(priv->ioaddr + XGMAC_MTL_TXQ_Debug(queue));
+	}
+
+	for (queue = 0; queue < MTL_MAX_RX_QUEUES; queue++) {
+		regs->mtl_reg.rx_info[queue].op_mode = readl(priv->ioaddr + XGMAC_MTL_RXQ_OPMODE(queue));
+		regs->mtl_reg.rx_info[queue].miss_pkt_overflow = readl(priv->ioaddr + XGMAC_MTL_RXQ_MISS_PKT_OF_CNT_OFFSET(queue));
+		regs->mtl_reg.rx_info[queue].debug = readl(priv->ioaddr + XGMAC_MTL_RXQ_Debug(queue));
+		regs->mtl_reg.rx_info[queue].flow_control = readl(priv->ioaddr + XGMAC_MTL_RXQ_FLOW_CONTROL(queue));
+	}
+
+	/* M3 SRAM dump */
+	for (ch = 0; ch < maxq; ch++) {
+		regs->m3_reg.sram_tx_pcie_addr[ch] = readl(priv->tc956x_SRAM_pci_base_addr + SRAM_TX_PCIE_ADDR_LOC +
+							(priv->port_num * TC956XMAC_CH_MAX * 4) + (ch * 4));
+		regs->m3_reg.sram_rx_pcie_addr[ch] = readl(priv->tc956x_SRAM_pci_base_addr + SRAM_RX_PCIE_ADDR_LOC +
+							(priv->port_num * TC956XMAC_CH_MAX * 4) + (ch * 4));
+	}
+
+	regs->m3_reg.m3_fw_init_done = readl(priv->tc956x_SRAM_pci_base_addr + TC956X_M3_INIT_DONE);
+	regs->m3_reg.m3_fw_exit	= readl(priv->tc956x_SRAM_pci_base_addr + TC956X_M3_FW_EXIT);
+
+	regs->m3_reg.m3_debug_cnt0 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT0)));
+	regs->m3_reg.m3_debug_cnt1 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT1)));
+	regs->m3_reg.m3_debug_cnt2 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT2)));
+	regs->m3_reg.m3_debug_cnt3 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT3)));
+	regs->m3_reg.m3_debug_cnt4 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT4)));
+	regs->m3_reg.m3_debug_cnt5 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT5)));
+	regs->m3_reg.m3_debug_cnt6 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT6)));
+	regs->m3_reg.m3_debug_cnt7 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT7)));
+	regs->m3_reg.m3_debug_cnt8 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT8)));
+	regs->m3_reg.m3_debug_cnt9 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT9)));
+	regs->m3_reg.m3_debug_cnt10 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT10)));
+	regs->m3_reg.m3_watchdog_exp_cnt = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT11)));
+	regs->m3_reg.m3_watchdog_monitor_cnt = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT12)));
+	regs->m3_reg.m3_debug_cnt13 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT13)));
+	regs->m3_reg.m3_debug_cnt14 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT14)));
+	regs->m3_reg.m3_systick_cnt_upper_value = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT16)));
+	regs->m3_reg.m3_systick_cnt_lower_value = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT15)));
+	regs->m3_reg.m3_tx_timeout_port0 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT17)));
+	regs->m3_reg.m3_tx_timeout_port1 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT18)));
+	regs->m3_reg.m3_debug_cnt19 = readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT19)));
+
+	regs->rxp_cfg = (struct tc956xmac_rx_parser_cfg *)&priv->plat->rxp_cfg;
+
+	/* TAMAP Information */
+	for (table_entry = 0; table_entry <= MAX_CM3_TAMAP_ENTRIES; table_entry++) {
+		regs->tamap[table_entry].trsl_addr_hi =	readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_TRSL_ADDR_HI(0, table_entry));
+		regs->tamap[table_entry].trsl_addr_low = readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_TRSL_ADDR_LO(0, table_entry));
+		regs->tamap[table_entry].src_addr_hi =	readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_SRC_ADDR_HI(0, table_entry));
+		regs->tamap[table_entry].src_addr_low = (readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry)) & TC956X_SRC_LO_MASK);
+		regs->tamap[table_entry].atr_size = ((readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry)) & TC956X_ATR_SIZE_MASK) >> 1);
+		regs->tamap[table_entry].atr_impl = (readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry)) & TC956X_ATR_IMPL);
+	}
+
+	/* Driver & FW Information */
+	strscpy(regs->info.driver, TC956X_RESOURCE_NAME, sizeof(regs->info.driver));
+	strscpy(regs->info.version, DRV_MODULE_VERSION, sizeof(regs->info.version));
+
+	reg = readl(priv->tc956x_SRAM_pci_base_addr + TC956X_M3_DBG_VER_START);
+	fw_version = (struct tc956x_version *)(&reg);
+	scnprintf(fw_version_str, sizeof(fw_version_str), "FW Version %s_%d.%d-%d", (fw_version->rel_dbg == 'D')?"DBG":"REL",
+					fw_version->major, fw_version->minor, fw_version->sub_minor);
+	strscpy(regs->info.fw_version, fw_version_str, sizeof(regs->info.fw_version));
+
+	/* Updating statistics */
+	tc956xmac_mmc_read(priv, priv->mmcaddr, &priv->mmc);
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+		regs->stats.rx_buf_unav_irq[ch] = priv->xstats.rx_buf_unav_irq[ch];
+		regs->stats.tx_pkt_n[ch] = priv->xstats.tx_pkt_n[ch];
+		regs->stats.tx_pkt_errors_n[ch] = priv->xstats.tx_pkt_errors_n[ch];
+		regs->stats.rx_pkt_n[ch] = priv->xstats.rx_pkt_n[ch];
+	}
+	regs->stats.mmc_tx_broadcastframe_g = priv->mmc.mmc_tx_broadcastframe_g;
+	regs->stats.mmc_tx_multicastframe_g = priv->mmc.mmc_tx_multicastframe_g;
+	regs->stats.mmc_tx_64_octets_gb = priv->mmc.mmc_tx_64_octets_gb;
+	regs->stats.mmc_tx_framecount_gb = priv->mmc.mmc_tx_framecount_gb;
+	regs->stats.mmc_tx_65_to_127_octets_gb = priv->mmc.mmc_tx_65_to_127_octets_gb;
+	regs->stats.mmc_tx_128_to_255_octets_gb = priv->mmc.mmc_tx_128_to_255_octets_gb;
+	regs->stats.mmc_tx_256_to_511_octets_gb = priv->mmc.mmc_tx_256_to_511_octets_gb;
+	regs->stats.mmc_tx_512_to_1023_octets_gb = priv->mmc.mmc_tx_512_to_1023_octets_gb;
+	regs->stats.mmc_tx_1024_to_max_octets_gb = priv->mmc.mmc_tx_1024_to_max_octets_gb;
+	regs->stats.mmc_tx_unicast_gb = priv->mmc.mmc_tx_unicast_gb;
+	regs->stats.mmc_tx_underflow_error = priv->mmc.mmc_tx_underflow_error;
+	regs->stats.mmc_tx_framecount_g = priv->mmc.mmc_tx_framecount_g;
+	regs->stats.mmc_tx_pause_frame = priv->mmc.mmc_tx_pause_frame;
+	regs->stats.mmc_tx_vlan_frame_g = priv->mmc.mmc_tx_vlan_frame_g;
+	regs->stats.mmc_tx_lpi_us_cntr = priv->mmc.mmc_tx_lpi_us_cntr;
+	regs->stats.mmc_tx_lpi_tran_cntr = priv->mmc.mmc_tx_lpi_tran_cntr;
+
+	regs->stats.mmc_rx_framecount_gb = priv->mmc.mmc_rx_framecount_gb;
+	regs->stats.mmc_rx_broadcastframe_g = priv->mmc.mmc_rx_broadcastframe_g;
+	regs->stats.mmc_rx_multicastframe_g = priv->mmc.mmc_rx_multicastframe_g;
+	regs->stats.mmc_rx_crc_error = priv->mmc.mmc_rx_crc_error;
+	regs->stats.mmc_rx_jabber_error = priv->mmc.mmc_rx_jabber_error;
+	regs->stats.mmc_rx_undersize_g = priv->mmc.mmc_rx_undersize_g;
+	regs->stats.mmc_rx_oversize_g = priv->mmc.mmc_rx_oversize_g;
+	regs->stats.mmc_rx_64_octets_gb = priv->mmc.mmc_rx_64_octets_gb;
+	regs->stats.mmc_rx_65_to_127_octets_gb = priv->mmc.mmc_rx_65_to_127_octets_gb;
+	regs->stats.mmc_rx_128_to_255_octets_gb = priv->mmc.mmc_rx_128_to_255_octets_gb;
+	regs->stats.mmc_rx_256_to_511_octets_gb = priv->mmc.mmc_rx_256_to_511_octets_gb;
+	regs->stats.mmc_rx_512_to_1023_octets_gb = priv->mmc.mmc_rx_512_to_1023_octets_gb;
+	regs->stats.mmc_rx_1024_to_max_octets_gb = priv->mmc.mmc_rx_1024_to_max_octets_gb;
+	regs->stats.mmc_rx_unicast_g = priv->mmc.mmc_rx_unicast_g;
+	regs->stats.mmc_rx_length_error = priv->mmc.mmc_rx_length_error;
+	regs->stats.mmc_rx_pause_frames = priv->mmc.mmc_rx_pause_frames;
+	regs->stats.mmc_rx_fifo_overflow = priv->mmc.mmc_rx_fifo_overflow;
+	regs->stats.mmc_rx_lpi_us_cntr = priv->mmc.mmc_rx_lpi_us_cntr;
+	regs->stats.mmc_rx_lpi_tran_cntr = priv->mmc.mmc_rx_lpi_tran_cntr;
+
+	/* Reading FRP Table information from Registers */
+	regs->rxp_cfg->nve = (readl(priv->ioaddr + XGMAC_MTL_RXP_CONTROL_STATUS) & 0xFF);
+	regs->rxp_cfg->npe = ((readl(priv->ioaddr + XGMAC_MTL_RXP_CONTROL_STATUS) >> 16) & 0xFF);
+	for (table_entry = 0; table_entry <= (regs->rxp_cfg->nve); table_entry++) {
+		dwxgmac2_rx_parser_read_entry(priv,
+		&(regs->rxp_cfg->entries[table_entry]), table_entry);
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(tc956x_dump_regs);
+#endif
+
+int tc956x_print_debug_regs(struct net_device *net_device, struct tc956x_regs *regs)
+{
+
+	struct tc956xmac_priv *priv = netdev_priv(net_device);
+	u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
+	u32 ch, queue, index;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	KPRINT_DEBUG1("regs->pcie_reg.rsc_mng_id = 0x%x\n", regs->pcie_reg.rsc_mng_id);
+
+	/* Configuration register dump */
+	KPRINT_DEBUG1("regs->config_reg.ncid = 0x%x\n", regs->config_reg.ncid);
+	KPRINT_DEBUG1("regs->config_reg.nclkctrl0 = 0x%x\n", regs->config_reg.nclkctrl0);
+	KPRINT_DEBUG1("regs->config_reg.nrstctrl0 = 0x%x\n", regs->config_reg.nrstctrl0);
+	KPRINT_DEBUG1("regs->config_reg.nclkctrl1 = 0x%x\n", regs->config_reg.nclkctrl1);
+	KPRINT_DEBUG1("regs->config_reg.nrstctrl1 = 0x%x\n", regs->config_reg.nrstctrl1);
+	KPRINT_DEBUG1("regs->config_reg.nemac0ctl = 0x%x\n", regs->config_reg.nemac0ctl);
+	KPRINT_DEBUG1("regs->config_reg.nemac1ctl = 0x%x\n", regs->config_reg.nemac1ctl);
+	KPRINT_DEBUG1("regs->config_reg.nemacsts = 0x%x\n", regs->config_reg.nemacsts);
+	KPRINT_DEBUG1("regs->config_reg.gpioi0 = 0x%x\n", regs->config_reg.gpioi0);
+	KPRINT_DEBUG1("regs->config_reg.gpioi1 = 0x%x\n", regs->config_reg.gpioi1);
+	KPRINT_DEBUG1("regs->config_reg.gpioe0 = 0x%x\n", regs->config_reg.gpioe0);
+	KPRINT_DEBUG1("regs->config_reg.gpioe1 = 0x%x\n", regs->config_reg.gpioe1);
+
+	/* MSI register dump */
+	KPRINT_DEBUG1("regs->msi_reg.msi_out_en = 0x%x\n", regs->msi_reg.msi_out_en);
+	KPRINT_DEBUG1("regs->msi_reg.msi_mask_set = 0x%x\n", regs->msi_reg.msi_mask_set);
+	KPRINT_DEBUG1("regs->msi_reg.msi_mask_clr = 0x%x\n", regs->msi_reg.msi_mask_clr);
+	KPRINT_DEBUG1("regs->msi_reg.int_sts = 0x%x\n", regs->msi_reg.int_sts);
+	KPRINT_DEBUG1("regs->msi_reg.int_raw_sts = 0x%x\n", regs->msi_reg.int_raw_sts);
+	KPRINT_DEBUG1("regs->msi_reg.msi_sts = 0x%x\n", regs->msi_reg.msi_sts);
+	KPRINT_DEBUG1("regs->msi_reg.cnt_int0 = 0x%x\n", regs->msi_reg.cnt_int0);
+	KPRINT_DEBUG1("regs->msi_reg.cnt_int1 = 0x%x\n", regs->msi_reg.cnt_int1);
+	KPRINT_DEBUG1("regs->msi_reg.cnt_int2 = 0x%x\n", regs->msi_reg.cnt_int2);
+	KPRINT_DEBUG1("regs->msi_reg.cnt_int3 = 0x%x\n", regs->msi_reg.cnt_int3);
+	KPRINT_DEBUG1("regs->msi_reg.cnt_int4 = 0x%x\n", regs->msi_reg.cnt_int4);
+	KPRINT_DEBUG1("regs->msi_reg.cnt_int11 = 0x%x\n", regs->msi_reg.cnt_int11);
+	KPRINT_DEBUG1("regs->msi_reg.cnt_int12 = 0x%x\n", regs->msi_reg.cnt_int12);
+	KPRINT_DEBUG1("regs->msi_reg.cnt_int20 = 0x%x\n", regs->msi_reg.cnt_int20);
+	KPRINT_DEBUG1("regs->msi_reg.cnt_int24 = 0x%x\n", regs->msi_reg.cnt_int24);
+
+	/* INTC register dump */
+	KPRINT_DEBUG1("regs->intc_reg.intmcumask0 = 0x%x\n", regs->intc_reg.intmcumask0);
+	KPRINT_DEBUG1("regs->intc_reg.intmcumask1 = 0x%x\n", regs->intc_reg.intmcumask1);
+	KPRINT_DEBUG1("regs->intc_reg.intmcumask2 = 0x%x\n", regs->intc_reg.intmcumask2);
+
+	/* DMA channel register dump */
+	KPRINT_DEBUG1("regs->dma_reg.debug_sts0 = 0x%x\n", regs->dma_reg.debug_sts0);
+
+	for (ch = 0; ch < maxq; ch++) {
+		KPRINT_DEBUG1("regs->dma_reg.ch_control[%d] = 0x%x\n", ch, regs->dma_reg.ch_control[ch]);
+		KPRINT_DEBUG1("regs->dma_reg.interrupt_enable[%d] = 0x%x\n", ch, regs->dma_reg.interrupt_enable[ch]);
+		KPRINT_DEBUG1("regs->dma_reg.ch_status[%d] = 0x%x\n", ch, regs->dma_reg.ch_status[ch]);
+		KPRINT_DEBUG1("regs->dma_reg.debug_status[%d] = 0x%x\n", ch, regs->dma_reg.debug_status[ch]);
+		KPRINT_DEBUG1("regs->dma_reg.rxch_watchdog_timer[%d] = 0x%x\n", ch, regs->dma_reg.rxch_watchdog_timer[ch]);
+	}
+
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+		KPRINT_DEBUG1("regs->dma_reg.tx_ch[%d].control = 0x%x\n", ch, regs->dma_reg.tx_ch[ch].control);
+		KPRINT_DEBUG1("regs->dma_reg.tx_ch[%d].list_haddr = 0x%x\n", ch, regs->dma_reg.tx_ch[ch].list_haddr);
+		KPRINT_DEBUG1("regs->dma_reg.tx_ch[%d].list_laddr = 0x%x\n", ch, regs->dma_reg.tx_ch[ch].list_laddr);
+		KPRINT_DEBUG1("regs->dma_reg.tx_ch[%d].ring_len = 0x%x\n", ch, regs->dma_reg.tx_ch[ch].ring_len);
+		KPRINT_DEBUG1("regs->dma_reg.tx_ch[%d].curr_haddr = 0x%x\n", ch, regs->dma_reg.tx_ch[ch].curr_haddr);
+		KPRINT_DEBUG1("regs->dma_reg.tx_ch[%d].curr_laddr = 0x%x\n", ch, regs->dma_reg.tx_ch[ch].curr_laddr);
+		KPRINT_DEBUG1("regs->dma_reg.tx_ch[%d].tail_ptr = 0x%x\n", ch, regs->dma_reg.tx_ch[ch].tail_ptr);
+		KPRINT_DEBUG1("regs->dma_reg.tx_ch[%d].buf_haddr = 0x%x\n", ch, regs->dma_reg.tx_ch[ch].buf_haddr);
+		KPRINT_DEBUG1("regs->dma_reg.tx_ch[%d].buf_laddr = 0x%x\n", ch, regs->dma_reg.tx_ch[ch].buf_laddr);
+	}
+
+	for (ch = 0; ch < rx_queues_cnt; ch++) {
+		KPRINT_DEBUG1("regs->dma_reg.rx_ch[%d].control = 0x%x\n", ch, regs->dma_reg.rx_ch[ch].control);
+		KPRINT_DEBUG1("regs->dma_reg.rx_ch[%d].list_haddr = 0x%x\n", ch, regs->dma_reg.rx_ch[ch].list_haddr);
+		KPRINT_DEBUG1("regs->dma_reg.rx_ch[%d].list_laddr = 0x%x\n", ch, regs->dma_reg.rx_ch[ch].list_laddr);
+		KPRINT_DEBUG1("regs->dma_reg.rx_ch[%d].ring_len = 0x%x\n", ch, regs->dma_reg.rx_ch[ch].ring_len);
+		KPRINT_DEBUG1("regs->dma_reg.rx_ch[%d].curr_haddr = 0x%x\n", ch, regs->dma_reg.rx_ch[ch].curr_haddr);
+		KPRINT_DEBUG1("regs->dma_reg.rx_ch[%d].curr_laddr = 0x%x\n", ch, regs->dma_reg.rx_ch[ch].curr_laddr);
+		KPRINT_DEBUG1("regs->dma_reg.rx_ch[%d].tail_ptr = 0x%x\n", ch, regs->dma_reg.rx_ch[ch].tail_ptr);
+		KPRINT_DEBUG1("regs->dma_reg.rx_ch[%d].buf_haddr = 0x%x\n", ch, regs->dma_reg.rx_ch[ch].buf_haddr);
+		KPRINT_DEBUG1("regs->dma_reg.rx_ch[%d].buf_laddr = 0x%x\n", ch, regs->dma_reg.rx_ch[ch].buf_laddr);
+	}
+
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+		KPRINT_DEBUG1("regs->dma_reg.tx_queue[%d].desc_phy_addr = 0x%llx\n", ch, regs->dma_reg.tx_queue[ch].desc_phy_addr);
+		KPRINT_DEBUG1("regs->dma_reg.tx_queue[%d].desc_va_addr = 0x%zx\n", ch, (size_t)(regs->dma_reg.tx_queue[ch].desc_va_addr));
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+		KPRINT_DEBUG1("regs->dma_reg.tx_queue[%d].buff_phy_addr = 0x%llx\n", ch, regs->dma_reg.tx_queue[ch].buff_phy_addr);
+		KPRINT_DEBUG1("regs->dma_reg.tx_queue[%d].buff_va_addr = 0x%zx\n", ch, (size_t)(regs->dma_reg.tx_queue[ch].buff_va_addr));
+#endif
+		KPRINT_DEBUG1("regs->dma_reg.tx_queue[%d].tx_skbuff = 0x%zx\n", ch, (size_t)(regs->dma_reg.tx_queue[ch].tx_skbuff));
+		KPRINT_DEBUG1("regs->dma_reg.tx_queue[%d].tx_skbuff_dma = 0x%zx\n", ch, (size_t)(regs->dma_reg.tx_queue[ch].tx_skbuff_dma));
+	}
+
+	for (ch = 0; ch < rx_queues_cnt; ch++) {
+		KPRINT_DEBUG1("regs->dma_reg.rx_queue[%d].desc_phy_addr = 0x%llx\n", ch, regs->dma_reg.rx_queue[ch].desc_phy_addr);
+		KPRINT_DEBUG1("regs->dma_reg.rx_queue[%d].desc_va_addr = 0x%zx\n", ch, (size_t)(regs->dma_reg.rx_queue[ch].desc_va_addr));
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+		KPRINT_DEBUG1("regs->dma_reg.rx_queue[%d].buff_phy_addr = 0x%llx\n", ch, regs->dma_reg.rx_queue[ch].buff_phy_addr);
+		KPRINT_DEBUG1("regs->dma_reg.rx_queue[%d].buff_va_addr = 0x%zx\n", ch, (size_t)(regs->dma_reg.rx_queue[ch].buff_va_addr));
+#endif
+		KPRINT_DEBUG1("regs->dma_reg.rx_queue[%d].buf_pool = 0x%zx\n", ch, (size_t)(regs->dma_reg.rx_queue[ch].buf_pool));
+	}
+
+	/* MAC register dump */
+	KPRINT_DEBUG1("regs->mac_reg.mac_tx_config = 0x%x\n", regs->mac_reg.mac_tx_config);
+	KPRINT_DEBUG1("regs->mac_reg.mac_rx_config = 0x%x\n", regs->mac_reg.mac_rx_config);
+	KPRINT_DEBUG1("regs->mac_reg.mac_pkt_filter = 0x%x\n", regs->mac_reg.mac_pkt_filter);
+	KPRINT_DEBUG1("regs->mac_reg.mac_tx_rx_status = 0x%x\n", regs->mac_reg.mac_tx_rx_status);
+	KPRINT_DEBUG1("regs->mac_reg.mac_debug = 0x%x\n", regs->mac_reg.mac_debug);
+
+	/* MTL register dump */
+	KPRINT_DEBUG1("regs->mtl_reg.op_mode = 0x%x\n", regs->mtl_reg.op_mode);
+	KPRINT_DEBUG1("regs->mtl_reg.mtl_rxq_dma_map0 = 0x%x\n",  regs->mtl_reg.mtl_rxq_dma_map0);
+	KPRINT_DEBUG1("regs->mtl_reg.mtl_rxq_dma_map1 = 0x%x\n", regs->mtl_reg.mtl_rxq_dma_map1);
+
+	for (queue = 0; queue < MTL_MAX_TX_QUEUES; queue++) {
+		KPRINT_DEBUG1("regs->mtl_reg.tx_info[%d].op_mode = 0x%x\n", queue, regs->mtl_reg.tx_info[queue].op_mode);
+		KPRINT_DEBUG1("regs->mtl_reg.tx_info[%d].underflow = 0x%x\n", queue, regs->mtl_reg.tx_info[queue].underflow);
+		KPRINT_DEBUG1("regs->mtl_reg.tx_info[%d].debug = 0x%x\n", queue, regs->mtl_reg.tx_info[queue].debug);
+	}
+
+	for (queue = 0; queue < MTL_MAX_RX_QUEUES; queue++) {
+		KPRINT_DEBUG1("regs->mtl_reg.rx_info[%d].op_mode = 0x%x\n", queue, regs->mtl_reg.rx_info[queue].op_mode);
+		KPRINT_DEBUG1("regs->mtl_reg.rx_info[%d].miss_pkt_overflow = 0x%x\n", queue, regs->mtl_reg.rx_info[queue].miss_pkt_overflow);
+		KPRINT_DEBUG1("regs->mtl_reg.rx_info[%d].debug = 0x%x\n", queue, regs->mtl_reg.rx_info[queue].debug);
+		KPRINT_DEBUG1("regs->mtl_reg.rx_info[%d].flow_control = 0x%x\n",  queue, regs->mtl_reg.rx_info[queue].flow_control);
+	}
+
+	/* M3 SRAM dump */
+	for (ch = 0; ch < maxq; ch++) {
+		KPRINT_DEBUG1("regs->m3_reg.sram_tx_pcie_addr[%d] = 0x%x\n", ch, regs->m3_reg.sram_tx_pcie_addr[ch]);
+		KPRINT_DEBUG1("regs->m3_reg.sram_rx_pcie_addr[%d] = 0x%x\n", ch, regs->m3_reg.sram_rx_pcie_addr[ch]);
+	}
+
+	KPRINT_DEBUG1("regs->m3_reg.m3_fw_init_done = 0x%x\n", regs->m3_reg.m3_fw_init_done);
+	KPRINT_DEBUG1("regs->m3_reg.m3_fw_exit	= 0x%x\n", regs->m3_reg.m3_fw_exit);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt0 = 0x%x\n", regs->m3_reg.m3_debug_cnt0);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt1 = 0x%x\n", regs->m3_reg.m3_debug_cnt1);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt2 = 0x%x\n", regs->m3_reg.m3_debug_cnt2);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt3 = 0x%x\n", regs->m3_reg.m3_debug_cnt3);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt4 = 0x%x\n", regs->m3_reg.m3_debug_cnt4);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt5 = 0x%x\n", regs->m3_reg.m3_debug_cnt5);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt6 = 0x%x\n", regs->m3_reg.m3_debug_cnt6);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt7 = 0x%x\n", regs->m3_reg.m3_debug_cnt7);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt8 = 0x%x\n", regs->m3_reg.m3_debug_cnt8);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt9 = 0x%x\n", regs->m3_reg.m3_debug_cnt9);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt10 = 0x%x\n", regs->m3_reg.m3_debug_cnt10);
+	KPRINT_DEBUG1("regs->m3_reg.m3_watchdog_exp_cnt = 0x%x\n", regs->m3_reg.m3_watchdog_exp_cnt);
+	KPRINT_DEBUG1("regs->m3_reg.m3_watchdog_monitor_cnt = 0x%x\n", regs->m3_reg.m3_watchdog_monitor_cnt);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt13 = 0x%x\n", regs->m3_reg.m3_debug_cnt13);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt14 = 0x%x\n", regs->m3_reg.m3_debug_cnt14);
+	KPRINT_DEBUG1("regs->m3_reg.m3_systick_cnt_upper_value = 0x%x\n", regs->m3_reg.m3_systick_cnt_upper_value);
+	KPRINT_DEBUG1("regs->m3_reg.m3_systick_cnt_lower_value = 0x%x\n", regs->m3_reg.m3_systick_cnt_lower_value);
+	KPRINT_DEBUG1("regs->m3_reg.m3_tx_timeout_port0 = 0x%x\n", regs->m3_reg.m3_tx_timeout_port0);
+	KPRINT_DEBUG1("regs->m3_reg.m3_tx_timeout_port1 = 0x%x\n", regs->m3_reg.m3_tx_timeout_port1);
+	KPRINT_DEBUG1("regs->m3_reg.m3_debug_cnt19 = 0x%x\n", regs->m3_reg.m3_debug_cnt19);
+
+	/* FRP Table Dump */
+	KPRINT_DEBUG1("regs->rxp_cfg->npe = %d\n", regs->rxp_cfg->npe);
+	KPRINT_DEBUG1("regs->rxp_cfg->nve = %d\n", regs->rxp_cfg->nve);
+	for (index = 0; index <= (regs->rxp_cfg->nve); index++) {
+		KPRINT_DEBUG1("regs->rxp_cfg->entries[%d].match_data = 0x%x\n", index, regs->rxp_cfg->entries[index].match_data);
+		KPRINT_DEBUG1("regs->rxp_cfg->entries[%d].match_en = 0x%x\n", index, regs->rxp_cfg->entries[index].match_en);
+		KPRINT_DEBUG1("regs->rxp_cfg->entries[%d].af = 0x%x\n", index, regs->rxp_cfg->entries[index].af);
+		KPRINT_DEBUG1("regs->rxp_cfg->entries[%d].rf = 0x%x\n", index, regs->rxp_cfg->entries[index].rf);
+		KPRINT_DEBUG1("regs->rxp_cfg->entries[%d].im = 0x%x\n", index, regs->rxp_cfg->entries[index].im);
+		KPRINT_DEBUG1("regs->rxp_cfg->entries[%d].nc = 0x%x\n", index, regs->rxp_cfg->entries[index].nc);
+		KPRINT_DEBUG1("regs->rxp_cfg->entries[%d].frame_offset = 0x%x\n", index, regs->rxp_cfg->entries[index].frame_offset);
+		KPRINT_DEBUG1("regs->rxp_cfg->entries[%d].ok_index = 0x%x\n", index, regs->rxp_cfg->entries[index].ok_index);
+		KPRINT_DEBUG1("regs->rxp_cfg->entries[%d].dma_ch_no = 0x%x\n", index, regs->rxp_cfg->entries[index].dma_ch_no);
+	}
+
+	/* TAMAP entries */
+	for (index = 0; index <= MAX_CM3_TAMAP_ENTRIES; index++) {
+		KPRINT_DEBUG1("regs->tamap[%d].trsl_addr_hi = 0x%x\n", index, regs->tamap[index].trsl_addr_hi);
+		KPRINT_DEBUG1("regs->tamap[%d].trsl_addr_low = 0x%x\n", index, regs->tamap[index].trsl_addr_low);
+		KPRINT_DEBUG1("regs->tamap[%d].src_addr_hi = 0x%x\n", index, regs->tamap[index].src_addr_hi);
+		KPRINT_DEBUG1("regs->tamap[%d].src_addr_low = 0x%x\n", index, regs->tamap[index].src_addr_low);
+		KPRINT_DEBUG1("regs->tamap[%d].atr_size = 0x%x\n", index, regs->tamap[index].atr_size);
+		KPRINT_DEBUG1("regs->tamap[%d].atr_impl = 0x%x\n", index, regs->tamap[index].atr_impl);
+	}
+
+	/* Driver & FW Information */
+	KPRINT_DEBUG1("regs->info.driver = %s\n", regs->info.driver);
+	KPRINT_DEBUG1("regs->info.version = %s\n", regs->info.version);
+	KPRINT_DEBUG1("regs->info.fw_version = %s\n", regs->info.fw_version);
+
+	/* statistics */
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+		KPRINT_DEBUG1("regs->stats.rx_buf_unav_irq[%d] = 0x%llx\n", ch, regs->stats.rx_buf_unav_irq[ch]);
+		KPRINT_DEBUG1("regs->stats.tx_pkt_n[%d] = 0x%llx\n", ch, regs->stats.tx_pkt_n[ch]);
+		KPRINT_DEBUG1("regs->stats.tx_pkt_errors_n[%d] = 0x%llx\n", ch, regs->stats.tx_pkt_errors_n[ch]);
+		KPRINT_DEBUG1("regs->stats.rx_pkt_n[%d] = 0x%llx\n", ch, regs->stats.rx_pkt_n[ch]);
+	}
+	KPRINT_DEBUG1("regs->stats.mmc_tx_broadcastframe_g = 0x%llx\n", regs->stats.mmc_tx_broadcastframe_g);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_multicastframe_g = 0x%llx\n", regs->stats.mmc_tx_multicastframe_g);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_64_octets_gb = 0x%llx\n", regs->stats.mmc_tx_64_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_framecount_gb = 0x%llx\n", regs->stats.mmc_tx_framecount_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_65_to_127_octets_gb = 0x%llx\n", regs->stats.mmc_tx_65_to_127_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_128_to_255_octets_gb = 0x%llx\n", regs->stats.mmc_tx_128_to_255_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_256_to_511_octets_gb = 0x%llx\n", regs->stats.mmc_tx_256_to_511_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_512_to_1023_octets_gb = 0x%llx\n", regs->stats.mmc_tx_512_to_1023_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_1024_to_max_octets_gb = 0x%llx\n", regs->stats.mmc_tx_1024_to_max_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_unicast_gb = 0x%llx\n", regs->stats.mmc_tx_unicast_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_underflow_error = 0x%llx\n", regs->stats.mmc_tx_underflow_error);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_framecount_g = 0x%llx\n", regs->stats.mmc_tx_framecount_g);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_pause_frame = 0x%llx\n", regs->stats.mmc_tx_pause_frame);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_vlan_frame_g = 0x%llx\n", regs->stats.mmc_tx_vlan_frame_g);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_lpi_us_cntr = 0x%llx\n", regs->stats.mmc_tx_lpi_us_cntr);
+	KPRINT_DEBUG1("regs->stats.mmc_tx_lpi_tran_cntr = 0x%llx\n", regs->stats.mmc_tx_lpi_tran_cntr);
+
+	KPRINT_DEBUG1("regs->stats.mmc_rx_framecount_gb = 0x%llx\n", regs->stats.mmc_rx_framecount_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_broadcastframe_g = 0x%llx\n", regs->stats.mmc_rx_broadcastframe_g);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_multicastframe_g = 0x%llx\n", regs->stats.mmc_rx_multicastframe_g);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_crc_error = 0x%llx\n", regs->stats.mmc_rx_crc_error);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_jabber_error = 0x%llx\n", regs->stats.mmc_rx_jabber_error);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_undersize_g = 0x%llx\n", regs->stats.mmc_rx_undersize_g);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_oversize_g = 0x%llx\n", regs->stats.mmc_rx_oversize_g);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_64_octets_gb = 0x%llx\n", regs->stats.mmc_rx_64_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_65_to_127_octets_gb = 0x%llx\n", regs->stats.mmc_rx_65_to_127_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_128_to_255_octets_gb = 0x%llx\n", regs->stats.mmc_rx_128_to_255_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_256_to_511_octets_gb = 0x%llx\n", regs->stats.mmc_rx_256_to_511_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_512_to_1023_octets_gb = 0x%llx\n", regs->stats.mmc_rx_512_to_1023_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_1024_to_max_octets_gb = 0x%llx\n", regs->stats.mmc_rx_1024_to_max_octets_gb);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_unicast_g = 0x%llx\n", regs->stats.mmc_rx_unicast_g);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_length_error = 0x%llx\n", regs->stats.mmc_rx_length_error);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_pause_frames = 0x%llx\n", regs->stats.mmc_rx_pause_frames);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_fifo_overflow = 0x%llx\n", regs->stats.mmc_rx_fifo_overflow);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_lpi_us_cntr = 0x%llx\n", regs->stats.mmc_rx_lpi_us_cntr);
+	KPRINT_DEBUG1("regs->stats.mmc_rx_lpi_tran_cntr = 0x%llx\n", regs->stats.mmc_rx_lpi_tran_cntr);
+
+	return 0;
+}
+
+extern unsigned int mac0_force_speed_mode;
+extern unsigned int mac1_force_speed_mode;
+
+static DEFINE_SPINLOCK(reg_dump_lock);
+static void dump_all_reg(struct tc956xmac_priv *priv)
+{
+	u32 i, j;
+	unsigned long flags;
+
+	spin_lock_irqsave(&reg_dump_lock, flags);
+
+	printk("--------------------------------------------------------\n");
+	printk("CNFREG dump\n");
+	for (i = 0; i <= 0x1800; i = i+4) {
+		if (i <= 0x20 || i >= 0x1000)
+			printk("CNFREG 0x%08x = 0x%08x\n", i, readl(priv->ioaddr + i));
+	}
+	printk("--------------------------------------------------------\n");
+	printk("PMATOP register dump\n");
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x441b8, readl(priv->ioaddr + 0x441b8));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x45888, readl(priv->ioaddr + 0x45888));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x45890, readl(priv->ioaddr + 0x45890));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x45898, readl(priv->ioaddr + 0x45898));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x458a0, readl(priv->ioaddr + 0x458a0));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x458a8, readl(priv->ioaddr + 0x458a8));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x45080, readl(priv->ioaddr + 0x45080));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x45090, readl(priv->ioaddr + 0x45090));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x45094, readl(priv->ioaddr + 0x45094));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x450a4, readl(priv->ioaddr + 0x450a4));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x450a8, readl(priv->ioaddr + 0x450a8));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x450b8, readl(priv->ioaddr + 0x450b8));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x450bc, readl(priv->ioaddr + 0x450bc));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x450cc, readl(priv->ioaddr + 0x450cc));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x450d0, readl(priv->ioaddr + 0x450d0));
+	printk("PMATOP Reg 0x%08x = 0x%08x\n", 0x450e0, readl(priv->ioaddr + 0x450e0));
+#ifndef TC956X_SRIOV_VF
+	printk("--------------------------------------------------------\n");
+	printk("XPCS register dump\n");
+	printk("XPCS Reg 0x%08x = 0x%08x\n", XGMAC_SR_MII_CTRL, tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_MII_CTRL));
+	printk("XPCS Reg 0x%08x = 0x%08x\n", XGMAC_SR_XS_PCS_CTRL2, tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_XS_PCS_CTRL2));
+	printk("XPCS Reg 0x%08x = 0x%08x\n", XGMAC_VR_MII_AN_CTRL, tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_CTRL));
+	printk("XPCS Reg 0x%08x = 0x%08x\n", XGMAC_VR_MII_DIG_CTRL1, tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_DIG_CTRL1));
+	printk("XPCS Reg 0x%08x = 0x%08x\n", XGMAC_VR_XS_PCS_DIG_CTRL1, tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1));
+	printk("XPCS Reg 0x%08x = 0x%08x\n", XGMAC_VR_MII_AN_INTR_STS, tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS));
+#endif
+	printk("--------------------------------------------------------\n");
+	printk("XGMAC-MAC register dump\n");
+	for (i = 0; i <= 0x810; i = i+4) {
+		printk("XGMAC MAC Reg 0x%08x = 0x%08x\n", MAC_OFFSET + i, readl(priv->ioaddr + MAC_OFFSET + i));
+	}
+	printk("--------------------------------------------------------\n");
+	printk("XGMAC-MTL register dump\n");
+	for (i = 0x1000; i <= 0x10B4; i = i+4) {
+		printk("XGMAC MTL Reg 0x%08x = 0x%08x\n", MAC_OFFSET + i, readl(priv->ioaddr + MAC_OFFSET + i));
+	}
+	for (i = 0x1100; i <= 0x1174; i = i+4) {
+		for (j = 0; j < 2; j++) {
+			printk("XGMAC MTL Reg 0x%08x = 0x%08x\n", MAC_OFFSET + i + (j*0x80), readl(priv->ioaddr + MAC_OFFSET + i + (j*0x80)));
+		}
+	}
+	printk("--------------------------------------------------------\n");
+	printk("XGMAC-DMA register dump\n");
+	for (i = 0x3000; i <= 0x3084; i = i+4) {
+		printk("XGMAC DMA Reg 0x%08x = 0x%08x\n", MAC_OFFSET + i, readl(priv->ioaddr + MAC_OFFSET + i));
+	}
+	for (i = 0x3100; i <= 0x317c; i = i+4) {
+		for (j = 0; j < 2; j++) {
+			printk("XGMAC DMA Reg 0x%08x = 0x%08x\n", MAC_OFFSET + i + (j*0x80), readl(priv->ioaddr + MAC_OFFSET + i + (j*0x80)));
+		}
+	}
+	printk("--------------------------------------------------------\n");
+
+	spin_unlock_irqrestore(&reg_dump_lock, flags);
+}
+
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+/**
+ * read_tc956x_status() - Debugfs read command for m3 status info
+ *
+ */
+static ssize_t read_tc956x_m3_status(struct file *file,
+	char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct tc956xmac_priv *priv = file->private_data;
+	u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
+	u32 ch;
+
+	if (!priv) {
+		pr_err(" %s  ERROR: Invalid private data pointer\n", __func__);
+		return -EINVAL;
+	}
+
+	/* PCIe register dump */
+	printk("pcie_reg.rsc_mng_id = 0x%x\n", readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG));
+
+	/* M3 SRAM dump */
+	for (ch = 0; ch < maxq; ch++) {
+		printk("sram_tx_pcie_addr[%d] = 0x%x\n", ch, readl(priv->tc956x_SRAM_pci_base_addr + SRAM_TX_PCIE_ADDR_LOC +
+							(priv->port_num * TC956XMAC_CH_MAX * 4) + (ch * 4)));
+		printk("sram_rx_pcie_addr[%d] = 0x%x\n", ch, readl(priv->tc956x_SRAM_pci_base_addr + SRAM_RX_PCIE_ADDR_LOC +
+							(priv->port_num * TC956XMAC_CH_MAX * 4) + (ch * 4)));
+	}
+
+	printk("m3_fw_init_done = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr + TC956X_M3_INIT_DONE));
+	printk("m3_fw_exit	= 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr + TC956X_M3_FW_EXIT));
+
+	printk("m3_debug_cnt0 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT0))));
+	printk("m3_debug_cnt1 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT1))));
+	printk("m3_debug_cnt2 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT2))));
+	printk("m3_debug_cnt3 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT3))));
+	printk("m3_debug_cnt4 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT4))));
+	printk("m3_debug_cnt5 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT5))));
+	printk("m3_debug_cnt6 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT6))));
+	printk("m3_debug_cnt7 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT7))));
+	printk("m3_debug_cnt8 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT8))));
+	printk("m3_debug_cnt9 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT9))));
+	printk("m3_debug_cnt10 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT10))));
+	printk("m3_watchdog_exp_cnt = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT11))));
+	printk("m3_watchdog_monitor_cnt = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT12))));
+	printk("m3_debug_cnt13 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT13))));
+	printk("m3_debug_cnt14 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT14))));
+	printk("m3_systick_cnt_upper_value = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT16))));
+	printk("m3_systick_cnt_lower_value = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT15))));
+	printk("m3_tx_timeout_port0 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT17))));
+	printk("m3_tx_timeout_port1 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT18))));
+	printk("m3_debug_cnt19 = 0x%x\n", readl(priv->tc956x_SRAM_pci_base_addr +
+				(TC956X_M3_SRAM_DEBUG_CNTS_OFFSET + (DB_CNT_LEN * DB_CNT19))));
+
+	return 0;
+}
+
+static const struct file_operations fops_m3_stats = {
+	.read = read_tc956x_m3_status,
+	.open = simple_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * read_tc956x_status() - Debugfs read command for mac info
+ *
+ */
+static ssize_t read_tc956x_mac_status(struct file *file,
+	char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct tc956xmac_priv *priv = file->private_data;
+
+	if (!priv) {
+		pr_err(" %s  ERROR: Invalid private data pointer\n", __func__);
+		return -EINVAL;
+	}
+
+	/* PCIe register dump */
+	printk("pcie_reg.rsc_mng_id = 0x%x\n", readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG));
+
+	/* MAC register dump */
+	printk("mac_reg.mac_tx_config = 0x%x\n", readl(priv->ioaddr + XGMAC_TX_CONFIG));
+	printk("mac_reg.mac_rx_config = 0x%x\n", readl(priv->ioaddr + XGMAC_RX_CONFIG));
+	printk("mac_reg.mac_pkt_filter = 0x%x\n", readl(priv->ioaddr + XGMAC_PACKET_FILTER));
+	printk("mac_reg.mac_tx_rx_status = 0x%x\n", readl(priv->ioaddr + XGMAC_RX_TX_STS));
+	printk("mac_reg.mac_debug = 0x%x\n", readl(priv->ioaddr + XGMAC_DEBUG));
+
+	return 0;
+
+}
+
+static const struct file_operations fops_mac_stats = {
+	.read = read_tc956x_mac_status,
+	.open = simple_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * read_tc956x_status() - Debugfs read command for mtl status info
+ *
+ */
+static ssize_t read_tc956x_mtl_status(struct file *file,
+	char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct tc956xmac_priv *priv = file->private_data;
+	u32 queue;
+
+	if (!priv) {
+		pr_err(" %s  ERROR: Invalid private data pointer\n", __func__);
+		return -EINVAL;
+	}
+
+	/* PCIe register dump */
+	printk("pcie_reg.rsc_mng_id = 0x%x\n", readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG));
+
+
+	/* MTL register dump */
+	printk("mtl_reg.op_mode = 0x%x\n", readl(priv->ioaddr + XGMAC_MTL_OPMODE));
+	printk("mtl_reg.mtl_rxq_dma_map0 = 0x%x\n", readl(priv->ioaddr + XGMAC_MTL_RXQ_DMA_MAP0));
+	printk("mtl_reg.mtl_rxq_dma_map1 = 0x%x\n", readl(priv->ioaddr + XGMAC_MTL_RXQ_DMA_MAP1));
+
+	for (queue = 0; queue < MTL_MAX_TX_QUEUES; queue++) {
+		printk("mtl_reg.tx_info[%d].op_mode = 0x%x\n", queue, readl(priv->ioaddr + XGMAC_MTL_TXQ_OPMODE(queue)));
+		printk("mtl_reg.tx_info[%d].underflow = 0x%x\n", queue, readl(priv->ioaddr + XGMAC_MTL_TXQ_UF_OFFSET(queue)));
+		printk("mtl_reg.tx_info[%d].debug = 0x%x\n", queue, readl(priv->ioaddr + XGMAC_MTL_TXQ_Debug(queue)));
+	}
+
+	for (queue = 0; queue < MTL_MAX_RX_QUEUES; queue++) {
+		printk("mtl_reg.rx_info[%d].op_mode = 0x%x\n", queue, readl(priv->ioaddr + XGMAC_MTL_RXQ_OPMODE(queue)));
+		printk("mtl_reg.rx_info[%d].miss_pkt_overflow = 0x%x\n", queue, readl(priv->ioaddr + XGMAC_MTL_RXQ_MISS_PKT_OF_CNT_OFFSET(queue)));
+		printk("mtl_reg.rx_info[%d].debug = 0x%x\n", queue, readl(priv->ioaddr + XGMAC_MTL_RXQ_Debug(queue)));
+		printk("mtl_reg.rx_info[%d].flow_control = 0x%x\n", queue, readl(priv->ioaddr + XGMAC_MTL_RXQ_FLOW_CONTROL(queue)));
+	}
+
+	return 0;
+}
+
+static const struct file_operations fops_mtl_stats = {
+	.read = read_tc956x_mtl_status,
+	.open = simple_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * read_tc956x_status() - Debugfs read command for dma status info
+ *
+ */
+static ssize_t read_tc956x_dma_status(struct file *file,
+	char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct tc956xmac_priv *priv = file->private_data;
+	u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
+	u32 ch;
+	struct tc956xmac_tx_queue *tx_q;
+	struct tc956xmac_rx_queue *rx_q;
+
+	if (!priv) {
+		pr_err(" %s  ERROR: Invalid private data pointer\n", __func__);
+		return -EINVAL;
+	}
+
+	/* PCIe register dump */
+	printk("pcie_reg.rsc_mng_id = 0x%x\n", readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG));
+
+	/* DMA channel register dump */
+	printk("dma_reg.debug_sts0 = 0x%x\n", readl(priv->ioaddr + XGMAC_DMA_DEBUG_STATUS0));
+
+	for (ch = 0; ch < maxq; ch++) {
+		printk("dma_reg.ch_control[%d] = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_CONTROL(ch)));
+		printk("dma_reg.interrupt_enable[%d] = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_INT_EN(ch)));
+		printk("dma_reg.ch_status[%d] = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_STATUS(ch)));
+		printk("dma_reg.debug_status[%d] = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_DBG_STATUS(ch)));
+		printk("dma_reg.rxch_watchdog_timer[%d] = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_Rx_WATCHDOG(ch)));
+	}
+
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+		printk("dma_reg.tx_ch[%d].control = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_TX_CONTROL(ch)));
+		printk("dma_reg.tx_ch[%d].list_haddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(ch)));
+		printk("dma_reg.tx_ch[%d].list_laddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(ch)));
+		printk("dma_reg.tx_ch[%d].ring_len = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_TX_CONTROL2(ch)));
+		printk("dma_reg.tx_ch[%d].curr_haddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_Cur_TxDESC_HADDR(ch)));
+		printk("dma_reg.tx_ch[%d].curr_laddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_Cur_TxDESC_LADDR(ch)));
+		printk("dma_reg.tx_ch[%d].tail_ptr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_TxDESC_TAIL_LPTR(ch)));
+		printk("dma_reg.tx_ch[%d].buf_haddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_Cur_TxBuff_HADDR(ch)));
+		printk("dma_reg.tx_ch[%d].buf_laddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_Cur_TxBuff_LADDR(ch)));
+	}
+
+	for (ch = 0; ch < rx_queues_cnt; ch++) {
+		printk("dma_reg.rx_ch[%d].control = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_RX_CONTROL(ch)));
+		printk("dma_reg.rx_ch[%d].list_haddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(ch)));
+		printk("dma_reg.rx_ch[%d].list_laddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(ch)));
+		printk("dma_reg.rx_ch[%d].ring_len = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_RX_CONTROL2(ch)));
+		printk("dma_reg.rx_ch[%d].curr_haddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_Cur_RxDESC_HADDR(ch)));
+		printk("dma_reg.rx_ch[%d].curr_laddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_Cur_RxDESC_LADDR(ch)));
+		printk("dma_reg.rx_ch[%d].tail_ptr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_RxDESC_TAIL_LPTR(ch)));
+		printk("dma_reg.rx_ch[%d].buf_haddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_Cur_RxBuff_HADDR(ch)));
+		printk("dma_reg.rx_ch[%d].buf_laddr = 0x%x\n", ch, readl(priv->ioaddr + XGMAC_DMA_CH_Cur_RxBuff_LADDR(ch)));
+	}
+
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+		tx_q = &priv->tx_queue[ch];
+		printk("dma_reg.tx_queue[%d].desc_phy_addr = 0x%lx\n", ch, (unsigned long)tx_q->dma_tx_phy);
+		printk("dma_reg.tx_queue[%d].desc_va_addr = 0x%lx\n", ch, (unsigned long)tx_q->dma_tx);
+		#ifdef TC956X_DMA_OFFLOAD_ENABLE
+		printk("dma_reg.tx_queue[%d].buff_phy_addr = 0x%lx\n", ch, (unsigned long)tx_q->buff_tx_phy);
+		printk("dma_reg.tx_queue[%d].buff_va_addr = 0x%lx\n", ch, (unsigned long)tx_q->buffer_tx_va_addr);
+		#endif
+		printk("dma_reg.tx_queue[%d].tx_skbuff = 0x%lx\n", ch, (unsigned long)tx_q->tx_skbuff);
+		printk("dma_reg.tx_queue[%d].tx_skbuff_dma = 0x%lx\n", ch, (unsigned long)tx_q->tx_skbuff_dma);
+	}
+
+	for (ch = 0; ch < rx_queues_cnt; ch++) {
+		rx_q = &priv->rx_queue[ch];
+		printk("dma_reg.rx_queue[%d].desc_phy_addr = 0x%lx\n", ch, (unsigned long)rx_q->dma_rx_phy);
+		printk("dma_reg.rx_queue[%d].desc_va_addr = 0x%lx\n", ch, (unsigned long)rx_q->dma_rx);
+		#ifdef TC956X_DMA_OFFLOAD_ENABLE
+		printk("dma_reg.rx_queue[%d].buff_phy_addr = 0x%lx\n", ch, (unsigned long)rx_q->buff_rx_phy);
+		printk("dma_reg.rx_queue[%d].buff_va_addr = 0x%lx\n", ch, (unsigned long)(void *)rx_q->buffer_rx_va_addr);
+		#endif
+		printk("dma_reg.rx_queue[%d].buf_pool = 0x%lx\n", ch, (unsigned long)rx_q->buf_pool);
+	}
+
+	return 0;
+}
+
+static const struct file_operations fops_dma_stats = {
+	.read = read_tc956x_dma_status,
+	.open = simple_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * read_tc956x_status() - Debugfs read command for interrupt status info
+ *
+ */
+static ssize_t read_tc956x_intr_status(struct file *file,
+	char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct tc956xmac_priv *priv = file->private_data;
+
+	if (!priv) {
+		pr_err(" %s  ERROR: Invalid private data pointer\n", __func__);
+		return -EINVAL;
+	}
+
+	/* PCIe register dump */
+	printk("pcie_reg.rsc_mng_id = 0x%x\n", readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG));
+
+	/* MSI register dump */
+	printk("msi_reg.msi_out_en = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->port_num, 0)));
+	printk("msi_reg.msi_mask_set = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_MASK_SET_OFFSET(priv->port_num, 0)));
+	printk("msi_reg.msi_mask_clr = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_MASK_CLR_OFFSET(priv->port_num, 0)));
+	printk("msi_reg.int_sts = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_INT_STS_OFFSET(priv->port_num, 0)));
+	printk("msi_reg.int_raw_sts = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_INT_RAW_STS_OFFSET(priv->port_num, 0)));
+	printk("msi_reg.msi_sts = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_STS_OFFSET(priv->port_num, 0)));
+	printk("msi_reg.cnt_int0 = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_CNT0(priv->port_num, 0)));
+	printk("msi_reg.cnt_int1 = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_CNT1(priv->port_num, 0)));
+	printk("msi_reg.cnt_int2 = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_CNT2(priv->port_num, 0)));
+	printk("msi_reg.cnt_int3 = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_CNT3(priv->port_num, 0)));
+	printk("msi_reg.cnt_int4 = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_CNT4(priv->port_num, 0)));
+	printk("msi_reg.cnt_int11 = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_CNT11(priv->port_num, 0)));
+	printk("msi_reg.cnt_int12 = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_CNT12(priv->port_num, 0)));
+	printk("msi_reg.cnt_int20 = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_CNT20(priv->port_num, 0)));
+	printk("msi_reg.cnt_int24 = 0x%x\n", readl(priv->ioaddr + TC956X_MSI_CNT24(priv->port_num, 0)));
+
+	/* INTC register dump */
+	printk("intc_reg.intmcumask0 = 0x%x\n", readl(priv->ioaddr + INTMCUMASK0));
+	printk("intc_reg.intmcumask1 = 0x%x\n", readl(priv->ioaddr + INTMCUMASK1));
+	printk("intc_reg.intmcumask2 = 0x%x\n", readl(priv->ioaddr + INTMCUMASK2));
+
+	return 0;
+}
+
+static const struct file_operations fops_intr_stats = {
+	.read = read_tc956x_intr_status,
+	.open = simple_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * read_tc956x_status() - Debugfs read command for configuration register status info
+ *
+ */
+static ssize_t read_tc956x_cnfg_status(struct file *file,
+	char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct tc956xmac_priv *priv = file->private_data;
+
+	if (!priv) {
+		pr_err(" %s  ERROR: Invalid private data pointer\n", __func__);
+		return -EINVAL;
+	}
+
+	/* PCIe register dump */
+	printk("pcie_reg.rsc_mng_id = 0x%x\n",readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG));
+
+	/* Configuration register dump */
+	printk("config_reg.ncid = 0x%x\n", readl(priv->ioaddr + NCID_OFFSET));
+	printk("config_reg.nclkctrl0 = 0x%x\n", readl(priv->ioaddr + NCLKCTRL0_OFFSET));
+	printk("config_reg.nrstctrl0 = 0x%x\n", readl(priv->ioaddr + NRSTCTRL0_OFFSET));
+	printk("config_reg.nclkctrl1 = 0x%x\n", readl(priv->ioaddr + NCLKCTRL1_OFFSET));
+	printk("config_reg.nrstctrl1 = 0x%x\n", readl(priv->ioaddr + NRSTCTRL1_OFFSET));
+	printk("config_reg.nemac0ctl = 0x%x\n", readl(priv->ioaddr + NEMAC0CTL_OFFSET));
+	printk("config_reg.nemac1ctl = 0x%x\n", readl(priv->ioaddr + NEMAC1CTL_OFFSET));
+	printk("config_reg.nemacsts = 0x%x\n", readl(priv->ioaddr + NEMACSTS_OFFSET));
+	printk("config_reg.gpioi0 = 0x%x\n", readl(priv->ioaddr + GPIOI0_OFFSET));
+	printk("config_reg.gpioi1 = 0x%x\n", readl(priv->ioaddr + GPIOI1_OFFSET));
+	printk("config_reg.gpioe0 = 0x%x\n", readl(priv->ioaddr + GPIOE0_OFFSET));
+	printk("config_reg.gpioe1 = 0x%x\n", readl(priv->ioaddr + GPIOE1_OFFSET));
+
+	return 0;
+}
+
+static const struct file_operations fops_cnfg_stats = {
+	.read = read_tc956x_cnfg_status,
+	.open = simple_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * read_tc956x_status() - Debugfs read command for other status info like TAMP, FRP Table, MMC counters, Version Info
+ *
+ */
+static ssize_t read_tc956x_other_status(struct file *file,
+	char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct tc956xmac_priv *priv = file->private_data;
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 ch, table_entry, reg = 0;
+	u8 fw_version_str[32];
+	struct tc956x_version *fw_version;
+	struct tc956xmac_rx_parser_cfg *rxp_cfg;
+
+	if (!priv) {
+		pr_err(" %s  ERROR: Invalid private data pointer\n", __func__);
+		return -EINVAL;
+	}
+
+	/* PCIe register dump */
+	printk("pcie_reg.rsc_mng_id = 0x%x\n", readl(priv->tc956x_BRIDGE_CFG_pci_base_addr + RSCMNG_ID_REG));
+
+	/* TAMAP Information */
+	for (table_entry = 0; table_entry <= MAX_CM3_TAMAP_ENTRIES; table_entry++) {
+		printk("TAMAP table %d, trsl_addr_hi = 0x%x\n", table_entry, (u32)readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_TRSL_ADDR_HI(0, table_entry)));
+		printk("TAMAP table %d, trsl_addr_low = 0x%x\n", table_entry, (u32) readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_TRSL_ADDR_LO(0, table_entry)));
+		printk("TAMAP table %d, src_addr_hi = 0x%x\n", table_entry, (u32)readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_SRC_ADDR_HI(0, table_entry)));
+		printk("TAMAP table %d, src_addr_low = 0x%x\n", table_entry, (u32)(readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry)) & TC956X_SRC_LO_MASK));
+		printk("TAMAP table %d, atr_size = 0x%x\n", table_entry,  (u32)((readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry)) & TC956X_ATR_SIZE_MASK) >> 1));
+		printk("TAMAP table %d, atr_impl = 0x%x\n", table_entry,  (u32)(readl(priv->tc956x_BRIDGE_CFG_pci_base_addr +
+						TC956X_AXI4_SLV_SRC_ADDR_LO(0, table_entry)) & TC956X_ATR_IMPL));
+	}
+
+	/* Driver & FW Information */
+	printk("info.driver = %s\n", TC956X_RESOURCE_NAME);
+	printk("info.version = %s\n", DRV_MODULE_VERSION);
+
+	reg = readl(priv->tc956x_SRAM_pci_base_addr + TC956X_M3_DBG_VER_START);
+	fw_version = (struct tc956x_version *)(&reg);
+	scnprintf(fw_version_str, sizeof(fw_version_str), "FW Version %s_%d.%d-%d", (fw_version->rel_dbg == 'D')?"DBG":"REL",
+					fw_version->major, fw_version->minor, fw_version->sub_minor);
+	printk("info.fw_version = %s\n", fw_version_str);
+
+	/* Updating statistics */
+	tc956xmac_mmc_read(priv, priv->mmcaddr, &priv->mmc);
+	for (ch = 0; ch < tx_queues_cnt; ch++) {
+		printk("rx_buf_unav_irq[%d] = 0x%llx\n", ch, priv->xstats.rx_buf_unav_irq[ch]);
+		printk("tx_pkt_n[%d] = 0x%llx\n", ch, priv->xstats.tx_pkt_n[ch]);
+		printk("tx_pkt_errors_n[%d] = 0x%llx\n", ch, priv->xstats.tx_pkt_errors_n[ch]);
+		printk("rx_pkt_n[%d] = 0x%llx\n", ch, priv->xstats.rx_pkt_n[ch]);
+	}
+	printk("mmc_tx_broadcastframe_g = 0x%llx\n", priv->mmc.mmc_tx_broadcastframe_g);
+	printk("mmc_tx_multicastframe_g = 0x%llx\n", priv->mmc.mmc_tx_multicastframe_g);
+	printk("mmc_tx_64_octets_gb = 0x%llx\n", priv->mmc.mmc_tx_64_octets_gb);
+	printk("mmc_tx_framecount_gb = 0x%llx\n", priv->mmc.mmc_tx_framecount_gb);
+	printk("mmc_tx_65_to_127_octets_gb = 0x%llx\n", priv->mmc.mmc_tx_65_to_127_octets_gb);
+	printk("mmc_tx_128_to_255_octets_gb = 0x%llx\n", priv->mmc.mmc_tx_128_to_255_octets_gb);
+	printk("mmc_tx_256_to_511_octets_gb = 0x%llx\n", priv->mmc.mmc_tx_256_to_511_octets_gb);
+	printk("mmc_tx_512_to_1023_octets_gb = 0x%llx\n", priv->mmc.mmc_tx_512_to_1023_octets_gb);
+	printk("mmc_tx_1024_to_max_octets_gb = 0x%llx\n", priv->mmc.mmc_tx_1024_to_max_octets_gb);
+	printk("mmc_tx_unicast_gb = 0x%llx\n", priv->mmc.mmc_tx_unicast_gb);
+	printk("mmc_tx_underflow_error = 0x%llx\n", priv->mmc.mmc_tx_underflow_error);
+	printk("mmc_tx_framecount_g = 0x%llx\n", priv->mmc.mmc_tx_framecount_g);
+	printk("mmc_tx_pause_frame = 0x%llx\n", priv->mmc.mmc_tx_pause_frame);
+	printk("mmc_tx_vlan_frame_g = 0x%llx\n", priv->mmc.mmc_tx_vlan_frame_g);
+	printk("mmc_tx_lpi_us_cntr = 0x%llx\n", priv->mmc.mmc_tx_lpi_us_cntr);
+	printk("mmc_tx_lpi_tran_cntr = 0x%llx\n", priv->mmc.mmc_tx_lpi_tran_cntr);
+
+	printk("mmc_rx_framecount_gb = 0x%llx\n", priv->mmc.mmc_rx_framecount_gb);
+	printk("mmc_rx_broadcastframe_g = 0x%llx\n", priv->mmc.mmc_rx_broadcastframe_g);
+	printk("mmc_rx_multicastframe_g = 0x%llx\n", priv->mmc.mmc_rx_multicastframe_g);
+	printk("mmc_rx_crc_error = 0x%llx\n", priv->mmc.mmc_rx_crc_error);
+	printk("mmc_rx_jabber_error = 0x%llx\n", priv->mmc.mmc_rx_jabber_error);
+	printk("mmc_rx_undersize_g = 0x%llx\n", priv->mmc.mmc_rx_undersize_g);
+	printk("mmc_rx_oversize_g = 0x%llx\n", priv->mmc.mmc_rx_oversize_g);
+	printk("mmc_rx_64_octets_gb = 0x%llx\n", priv->mmc.mmc_rx_64_octets_gb);
+	printk("mmc_rx_65_to_127_octets_gb = 0x%llx\n", priv->mmc.mmc_rx_65_to_127_octets_gb);
+	printk("mmc_rx_128_to_255_octets_gb = 0x%llx\n", priv->mmc.mmc_rx_128_to_255_octets_gb);
+	printk("mmc_rx_256_to_511_octets_gb = 0x%llx\n", priv->mmc.mmc_rx_256_to_511_octets_gb);
+	printk("mmc_rx_512_to_1023_octets_gb = 0x%llx\n", priv->mmc.mmc_rx_512_to_1023_octets_gb);
+	printk("mmc_rx_1024_to_max_octets_gb = 0x%llx\n", priv->mmc.mmc_rx_1024_to_max_octets_gb);
+	printk("mmc_rx_unicast_g = 0x%llx\n", priv->mmc.mmc_rx_unicast_g);
+	printk("mmc_rx_length_error = 0x%llx\n", priv->mmc.mmc_rx_length_error);
+	printk("mmc_rx_pause_frames = 0x%llx\n", priv->mmc.mmc_rx_pause_frames);
+	printk("mmc_rx_fifo_overflow = 0x%llx\n", priv->mmc.mmc_rx_fifo_overflow);
+	printk("mmc_rx_lpi_us_cntr = 0x%llx\n", priv->mmc.mmc_rx_lpi_us_cntr);
+	printk("mmc_rx_lpi_tran_cntr = 0x%llx\n", priv->mmc.mmc_rx_lpi_tran_cntr);
+
+	/* Reading FRP Table information from Registers */
+	rxp_cfg = (struct tc956xmac_rx_parser_cfg *)&priv->plat->rxp_cfg;
+	printk("rxp_cfg->nve = 0x%x\n", (readl(priv->ioaddr + XGMAC_MTL_RXP_CONTROL_STATUS) & 0xFF));
+	printk("rxp_cfg->npe = 0x%x\n", ((readl(priv->ioaddr + XGMAC_MTL_RXP_CONTROL_STATUS) >> 16) & 0xFF));
+	for (table_entry = 0; table_entry <= (rxp_cfg->nve); table_entry++) {
+		dwxgmac2_rx_parser_read_entry(priv,
+		&(rxp_cfg->entries[table_entry]), table_entry);
+
+		printk("rxp_cfg->entries[%d].match_data = 0x%x\n", table_entry, rxp_cfg->entries[table_entry].match_data);
+		printk("rxp_cfg->entries[%d].match_en = 0x%x\n", table_entry, rxp_cfg->entries[table_entry].match_en);
+		printk("rxp_cfg->entries[%d].af = 0x%x\n", table_entry, rxp_cfg->entries[table_entry].af);
+		printk("rxp_cfg->entries[%d].rf = 0x%x\n", table_entry, rxp_cfg->entries[table_entry].rf);
+		printk("rxp_cfg->entries[%d].im = 0x%x\n", table_entry, rxp_cfg->entries[table_entry].im);
+		printk("rxp_cfg->entries[%d].nc = 0x%x\n", table_entry, rxp_cfg->entries[table_entry].nc);
+		printk("rxp_cfg->entries[%d].frame_offset = 0x%x\n", table_entry, rxp_cfg->entries[table_entry].frame_offset);
+		printk("rxp_cfg->entries[%d].ok_index = 0x%x\n", table_entry, rxp_cfg->entries[table_entry].ok_index);
+		printk("rxp_cfg->entries[%d].dma_ch_no = 0x%x\n", table_entry, rxp_cfg->entries[table_entry].dma_ch_no);
+	}
+
+	return 0;
+}
+
+static const struct file_operations fops_other_stats = {
+	.read = read_tc956x_other_status,
+	.open = simple_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * read_tc956x_status() - Debugfs read command for dumping all registers of MAC, MTL, DMA...
+ *
+ */
+static ssize_t read_tc956x_reg_dump_status(struct file *file,
+	char __user *user_buf, size_t count, loff_t *ppos)
+{
+	struct tc956xmac_priv *priv = file->private_data;
+
+	if (!priv) {
+		pr_err(" %s  ERROR: Invalid private data pointer\n", __func__);
+		return -EINVAL;
+	}
+	dump_all_reg(priv);
+
+	return 0;
+}
+
+static const struct file_operations fops_reg_dump_stats = {
+	.read = read_tc956x_reg_dump_status,
+	.open = simple_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * tc956xmac_create_debugfs() - API to create debugfs node
+ * for debugging.
+ *
+ * IN: Network device structure: TC956x network interface structure specific to port.
+ * OUT: 0 on success and -1 on failure
+ */
+int tc956xmac_create_debugfs(struct net_device *net_device)
+{
+
+	struct tc956xmac_priv *priv;
+	static struct dentry *stats = NULL;
+	char dev_name[23];
+
+	if (!net_device) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -1;
+	}
+
+	priv = netdev_priv(net_device);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -1;
+	}
+
+	if (RM_PF0_ID == priv->port_num) {
+		snprintf(dev_name, sizeof(dev_name), "tc956x_%s_debug", net_device->name);
+		priv->debugfs_dir = debugfs_create_dir(dev_name, NULL);
+		if (!priv->debugfs_dir) {
+			pr_err("Cannot create TC956x debugfs dir for port-0 %ld %s\n", (long)priv->debugfs_dir, net_device->name);
+			return -1;
+		} else {
+			printk("Created TC956x debugfs dir for port-0 %s\n", net_device->name);
+		}
+	} else {
+		snprintf(dev_name, sizeof(dev_name), "tc956x_%s_debug", net_device->name);
+		priv->debugfs_dir = debugfs_create_dir(dev_name, NULL);
+		if (!priv->debugfs_dir) {
+			pr_err("Cannot create TC956x debugfs dir for port-1 %ld %s \n", (long)priv->debugfs_dir, net_device->name);
+			return -1;
+		} else {
+			printk("Created TC956x debugfs dir for port-1 %s\n", net_device->name);
+		}
+	}
+
+	stats = debugfs_create_file("m3_stats", S_IRUSR, priv->debugfs_dir,
+				priv, &fops_m3_stats);
+	if (!stats || IS_ERR(stats)) {
+		pr_err("Cannot create TC956x m3 debugfs stats file%ld for %s\n", (long)stats, net_device->name);
+		goto fail;
+	}
+
+	stats = debugfs_create_file("mac_stats", S_IRUSR, priv->debugfs_dir,
+				priv, &fops_mac_stats);
+	if (!stats || IS_ERR(stats)) {
+		pr_err("Cannot create TC956x mac debugfs stats file%ld for %s\n", (long)stats, net_device->name);
+		goto fail;
+	}
+
+	stats = debugfs_create_file("mtl_stats", S_IRUSR, priv->debugfs_dir,
+				priv, &fops_mtl_stats);
+	if (!stats || IS_ERR(stats)) {
+		pr_err("Cannot create TC956x mtl debugfs stats file%ld for %s\n", (long)stats, net_device->name);
+		goto fail;
+	}
+
+	stats = debugfs_create_file("dma_stats", S_IRUSR, priv->debugfs_dir,
+				priv, &fops_dma_stats);
+	if (!stats || IS_ERR(stats)) {
+		pr_err("Cannot create TC956x dma debugfs stats file%ld for %s\n", (long)stats, net_device->name);
+		goto fail;
+	}
+
+	stats = debugfs_create_file("interrupt_stats", S_IRUSR, priv->debugfs_dir,
+				priv, &fops_intr_stats);
+	if (!stats || IS_ERR(stats)) {
+		pr_err("Cannot create TC956x interrupt debugfs stats file%ld for %s\n", (long)stats, net_device->name);
+		goto fail;
+	}
+
+	stats = debugfs_create_file("config_stats", S_IRUSR, priv->debugfs_dir,
+				priv, &fops_cnfg_stats);
+	if (!stats || IS_ERR(stats)) {
+		pr_err("Cannot create TC956x cnfg debugfs stats file%ld for %s\n", (long)stats, net_device->name);
+		goto fail;
+	}
+
+	stats = debugfs_create_file("other_stats", S_IRUSR, priv->debugfs_dir,
+				priv, &fops_other_stats);
+	if (!stats || IS_ERR(stats)) {
+		pr_err("Cannot create TC956x other debugfs stats file%ld for %s\n", (long)stats, net_device->name);
+		goto fail;
+	}
+
+	stats = debugfs_create_file("reg_dump", S_IRUSR, priv->debugfs_dir,
+				priv, &fops_reg_dump_stats);
+	if (!stats || IS_ERR(stats)) {
+		pr_err("Cannot create TC956x registers dump debugfs file%ld for %s\n", (long)stats, net_device->name);
+		goto fail;
+	}
+
+	return 0;
+
+fail:
+	debugfs_remove_recursive(priv->debugfs_dir);
+	return -1;
+
+}
+
+/**
+ * tc956xmac_cleanup_debugfs() - API to cleanup debugfs node
+ * for debugging.
+ *
+ * IN: Network device structure: TC956x network interface structure specific to port.
+ * OUT: 0 on success and -1 on failure
+ */
+int tc956xmac_cleanup_debugfs(struct net_device *net_device)
+{
+	struct tc956xmac_priv *priv;
+
+	if (!net_device) {
+		pr_err("%s: ERROR: Invalid netdevice pointer\n", __func__);
+		return -1;
+	}
+
+	priv = netdev_priv(net_device);
+	if (!priv) {
+		pr_err("%s: ERROR: Invalid private data pointer\n", __func__);
+		return -1;
+	}
+
+	if (priv->debugfs_dir)
+		debugfs_remove_recursive(priv->debugfs_dir);
+
+	printk("TC956x port-%d %s, debugfs Deleted Successfully\n", priv->port_num, priv->dev->name);
+	return 0;
+
+}
+#endif/* End of CONFIG_DEBUG_FS */
+#endif /* TC956X_SRIOV_PF */
+
+/**
+ *  tc956x_GPIO_OutputConfigPin - to configure GPIO as output and write the value
+ *  @priv: driver private structure
+ *  @gpio_pin: GPIO pin number
+ *  @out_value : value to write to the GPIO pin. Can be 0 or 1
+ *  @remarks : Only GPIO0- GPIO06, GPI010-GPIO12 are allowed
+ */
+int tc956x_GPIO_OutputConfigPin(struct tc956xmac_priv *priv, u32 gpio_pin, u8 out_value)
+{
+	u32 config, val;
+
+	/* Only GPIO0- GPIO06, GPI010-GPIO12 are allowed */
+	switch (gpio_pin) {
+	case GPIO_00:
+		val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+		val &= ~NFUNCEN4_GPIO_00;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_00_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+		break;
+	case GPIO_01:
+		val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+		val &= ~NFUNCEN4_GPIO_01;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_01_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+		break;
+	case GPIO_02:
+		val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+		val &= ~NFUNCEN4_GPIO_02;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_02_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+		break;
+	case GPIO_03:
+		val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+		val &= ~NFUNCEN4_GPIO_03;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_03_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+		break;
+	case GPIO_04:
+		val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+		val &= ~NFUNCEN4_GPIO_04;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_04_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+		break;
+	case GPIO_05:
+		val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+		val &= ~NFUNCEN4_GPIO_05;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_05_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+		break;
+	case GPIO_06:
+		val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+		val &= ~NFUNCEN4_GPIO_06;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_06_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+		break;
+	case GPIO_10:
+		val = readl(priv->ioaddr + NFUNCEN5_OFFSET);
+		val &= ~NFUNCEN5_GPIO_10;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN5_GPIO_10_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN5_OFFSET);
+		break;
+	case GPIO_11:
+		val = readl(priv->ioaddr + NFUNCEN5_OFFSET);
+		val &= ~NFUNCEN5_GPIO_11;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN5_GPIO_11_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN5_OFFSET);
+		break;
+	case GPIO_12:
+		val = readl(priv->ioaddr + NFUNCEN6_OFFSET);
+		val &= ~NFUNCEN6_GPIO_12;
+		val |= (NFUNCEN_FUNC0 << NFUNCEN6_GPIO_12_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN6_OFFSET);
+		break;
+	case GPIO_13:
+		val = readl(priv->ioaddr + NFUNCEN7_OFFSET);
+		val &= ~NFUNCEN7_GPIO_13;
+		val |= (NFUNCEN_FUNC2 << NFUNCEN7_GPIO_13_SHIFT);
+		writel(val, priv->ioaddr + NFUNCEN7_OFFSET);
+		break;
+	default:
+		netdev_err(priv->dev, "Invalid GPIO pin - %d\n", gpio_pin);
+		return -EPERM;
+	}
+
+	priv->saved_gpio_config[gpio_pin].config = 1;
+
+	/* Write data to GPIO pin */
+	if (gpio_pin < GPIO_32) {
+		config = 1 << gpio_pin;
+		val = readl(priv->ioaddr + GPIOO0_OFFSET);
+		val &= ~config;
+		if (out_value)
+			val |= config;
+
+		writel(val, priv->ioaddr + GPIOO0_OFFSET);
+	}  else {
+		config = 1 << (gpio_pin - GPIO_32);
+		val = readl(priv->ioaddr + GPIOO1_OFFSET);
+		val &= ~config;
+		if (out_value)
+			val |= config;
+
+		writel(val, priv->ioaddr + GPIOO1_OFFSET);
+	}
+
+	priv->saved_gpio_config[gpio_pin].out_val = out_value;
+
+	/* Configure the GPIO pin in output direction */
+	if (gpio_pin < GPIO_32) {
+		config = ~(1 << gpio_pin);
+		val = readl(priv->ioaddr + GPIOE0_OFFSET);
+		writel(val & config, priv->ioaddr + GPIOE0_OFFSET);
+	} else {
+		config = ~(1 << (gpio_pin - GPIO_32));
+		val = readl(priv->ioaddr + GPIOE1_OFFSET);
+		writel(val & config, priv->ioaddr + GPIOE1_OFFSET);
+	}
+
+	return 0;
+}
+
+/**
+ *  tc956x_gpio_restore_configuration - to restore the saved configuration of GPIO
+ *  @priv: driver private structure
+ *  @remarks : Only GPIO0- GPIO06, GPI010-GPIO12 are allowed
+ */
+int tc956x_gpio_restore_configuration(struct tc956xmac_priv *priv)
+{
+	u32 config, val, gpio_pin, out_value;
+
+	DBGPR_FUNC(priv->device, "-->%s", __func__);
+
+	for (gpio_pin = 0; gpio_pin <= GPIO_12; gpio_pin++) {
+
+		/* Restore only the GPIOs which were configured/saved */
+		if (!(priv->saved_gpio_config[gpio_pin].config))
+			continue;
+
+		DBGPR_FUNC(priv->device, "%s : Restoring GPIO configuration for pin: %d, val: %d",
+				__func__, gpio_pin, priv->saved_gpio_config[gpio_pin].out_val);
+
+		/* Only GPIO0- GPIO06, GPI010-GPIO12 are allowed */
+		switch (gpio_pin) {
+		case GPIO_00:
+			val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+			val &= ~NFUNCEN4_GPIO_00;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_00_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+			break;
+		case GPIO_01:
+			val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+			val &= ~NFUNCEN4_GPIO_01;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_01_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+			break;
+		case GPIO_02:
+			val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+			val &= ~NFUNCEN4_GPIO_02;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_02_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+			break;
+		case GPIO_03:
+			val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+			val &= ~NFUNCEN4_GPIO_03;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_03_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+			break;
+		case GPIO_04:
+			val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+			val &= ~NFUNCEN4_GPIO_04;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_04_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+			break;
+		case GPIO_05:
+			val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+			val &= ~NFUNCEN4_GPIO_05;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_05_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+			break;
+		case GPIO_06:
+			val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+			val &= ~NFUNCEN4_GPIO_06;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN4_GPIO_06_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+			break;
+		case GPIO_10:
+			val = readl(priv->ioaddr + NFUNCEN5_OFFSET);
+			val &= ~NFUNCEN5_GPIO_10;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN5_GPIO_10_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN5_OFFSET);
+			break;
+		case GPIO_11:
+			val = readl(priv->ioaddr + NFUNCEN5_OFFSET);
+			val &= ~NFUNCEN5_GPIO_11;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN5_GPIO_11_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN5_OFFSET);
+			break;
+		case GPIO_12:
+			val = readl(priv->ioaddr + NFUNCEN6_OFFSET);
+			val &= ~NFUNCEN6_GPIO_12;
+			val |= (NFUNCEN_FUNC0 << NFUNCEN6_GPIO_12_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN6_OFFSET);
+			break;
+		case GPIO_13:
+			val = readl(priv->ioaddr + NFUNCEN7_OFFSET);
+			val &= ~NFUNCEN7_GPIO_13;
+			val |= (NFUNCEN_FUNC2 << NFUNCEN7_GPIO_13_SHIFT);
+			writel(val, priv->ioaddr + NFUNCEN7_OFFSET);
+			break;
+		default:
+			netdev_err(priv->dev, "Invalid GPIO pin - %d\n", gpio_pin);
+			return -EPERM;
+		}
+
+		out_value = priv->saved_gpio_config[gpio_pin].out_val;
+
+		/* Write data to GPIO pin */
+		if (gpio_pin < GPIO_32) {
+			config = 1 << gpio_pin;
+			val = readl(priv->ioaddr + GPIOO0_OFFSET);
+			val &= ~config;
+			if (out_value)
+				val |= config;
+
+			writel(val, priv->ioaddr + GPIOO0_OFFSET);
+		}  else {
+			config = 1 << (gpio_pin - GPIO_32);
+			val = readl(priv->ioaddr + GPIOO1_OFFSET);
+			val &= ~config;
+			if (out_value)
+				val |= config;
+
+			writel(val, priv->ioaddr + GPIOO1_OFFSET);
+		}
+
+		/* Configure the GPIO pin in output direction */
+		if (gpio_pin < GPIO_32) {
+			config = ~(1 << gpio_pin);
+			val = readl(priv->ioaddr + GPIOE0_OFFSET);
+			writel(val & config, priv->ioaddr + GPIOE0_OFFSET);
+		} else {
+			config = ~(1 << (gpio_pin - GPIO_32));
+			val = readl(priv->ioaddr + GPIOE1_OFFSET);
+			writel(val & config, priv->ioaddr + GPIOE1_OFFSET);
+		}
+	}
+	return 0;
+}
+
+#ifdef TC956X_SRIOV_PF
+/**
+ *  tc956xmac_wol_interrupt - ISR to handle WoL PHY interrupt
+ *  @irq: interrupt number.
+ *  @dev_id: to pass the net device pointer.
+ */
+static irqreturn_t tc956xmac_wol_interrupt(int irq, void *dev_id)
+{
+	struct net_device *dev = (struct net_device *)dev_id;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	/* Set flag to clear interrupt after resume */
+	DBGPR_FUNC(priv->device, "%s\n", __func__);
+	/* Set flag to indicate WOL interrupt trigger */
+	priv->tc956xmac_pm_wol_interrupt = true;
+	return IRQ_HANDLED;
+}
+#endif
+
+/**
+ * tc956xmac_verify_args - verify the driver parameters.
+ * Description: it checks the driver parameters and set a default in case of
+ * errors.
+ */
+static void tc956xmac_verify_args(void)
+{
+	if (unlikely(watchdog < 0))
+		watchdog = TX_TIMEO;
+	if (unlikely((buf_sz < DEFAULT_BUFSIZE) || (buf_sz > BUF_SIZE_16KiB)))
+		buf_sz = DEFAULT_BUFSIZE;
+	if (unlikely(flow_ctrl > 1))
+		flow_ctrl = FLOW_AUTO;
+	else if (likely(flow_ctrl < 0))
+		flow_ctrl = FLOW_OFF;
+	if (unlikely((pause < 0) || (pause > 0xffff)))
+		pause = PAUSE_TIME;
+	if (eee_timer < 0)
+		eee_timer = TC956XMAC_DEFAULT_LPI_TIMER;
+}
+
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_DYNAMIC_LOAD_CBS
+static void tc956xmac_set_cbs_speed(struct tc956xmac_priv *priv)
+{
+	u32 queue_idx;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	for (queue_idx = CLASS_B_CH ; queue_idx <= CLASS_CDT_CH; queue_idx++) {
+		if (priv->plat->tx_queues_cfg[queue_idx].mode_to_use == MTL_QUEUE_AVB)
+		{
+			if (priv->speed == SPEED_100) {
+				priv->plat->tx_queues_cfg[queue_idx].send_slope =
+										priv->cbs_speed100_cfg[queue_idx].send_slope;
+				priv->plat->tx_queues_cfg[queue_idx].idle_slope =
+										priv->cbs_speed100_cfg[queue_idx].idle_slope;
+				priv->plat->tx_queues_cfg[queue_idx].high_credit =
+										priv->cbs_speed100_cfg[queue_idx].high_credit;
+				priv->plat->tx_queues_cfg[queue_idx].low_credit =
+										priv->cbs_speed100_cfg[queue_idx].low_credit;
+			} else if (priv->speed == SPEED_1000) {
+				priv->plat->tx_queues_cfg[queue_idx].send_slope =
+										priv->cbs_speed1000_cfg[queue_idx].send_slope;
+				priv->plat->tx_queues_cfg[queue_idx].idle_slope =
+										priv->cbs_speed1000_cfg[queue_idx].idle_slope;
+				priv->plat->tx_queues_cfg[queue_idx].high_credit =
+										priv->cbs_speed1000_cfg[queue_idx].high_credit;
+				priv->plat->tx_queues_cfg[queue_idx].low_credit =
+										priv->cbs_speed1000_cfg[queue_idx].low_credit;
+			} else if (priv->speed == SPEED_10000) {
+				priv->plat->tx_queues_cfg[queue_idx].send_slope =
+										priv->cbs_speed10000_cfg[queue_idx].send_slope;
+				priv->plat->tx_queues_cfg[queue_idx].idle_slope =
+										priv->cbs_speed10000_cfg[queue_idx].idle_slope;
+				priv->plat->tx_queues_cfg[queue_idx].high_credit =
+										priv->cbs_speed10000_cfg[queue_idx].high_credit;
+				priv->plat->tx_queues_cfg[queue_idx].low_credit =
+										priv->cbs_speed10000_cfg[queue_idx].low_credit;
+			} else if (priv->speed == SPEED_2500) {
+				priv->plat->tx_queues_cfg[queue_idx].send_slope =
+										priv->cbs_speed2500_cfg[queue_idx].send_slope;
+				priv->plat->tx_queues_cfg[queue_idx].idle_slope =
+										priv->cbs_speed2500_cfg[queue_idx].idle_slope;
+				priv->plat->tx_queues_cfg[queue_idx].high_credit =
+										priv->cbs_speed2500_cfg[queue_idx].high_credit;
+				priv->plat->tx_queues_cfg[queue_idx].low_credit =
+										priv->cbs_speed2500_cfg[queue_idx].low_credit;
+			} else if (priv->speed == SPEED_5000) {
+				priv->plat->tx_queues_cfg[queue_idx].send_slope =
+										priv->cbs_speed5000_cfg[queue_idx].send_slope;
+				priv->plat->tx_queues_cfg[queue_idx].idle_slope =
+										priv->cbs_speed5000_cfg[queue_idx].idle_slope;
+				priv->plat->tx_queues_cfg[queue_idx].high_credit =
+										priv->cbs_speed5000_cfg[queue_idx].high_credit;
+				priv->plat->tx_queues_cfg[queue_idx].low_credit =
+										priv->cbs_speed5000_cfg[queue_idx].low_credit;
+			}
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+		spin_lock_irqsave(&priv->spn_lock.cbs, flags);
+#endif
+		tc956xmac_config_cbs(priv, priv->hw, priv->plat->tx_queues_cfg[queue_idx].send_slope,
+					priv->plat->tx_queues_cfg[queue_idx].idle_slope,
+					priv->plat->tx_queues_cfg[queue_idx].high_credit,
+					priv->plat->tx_queues_cfg[queue_idx].low_credit,
+					queue_idx);
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+		spin_unlock_irqrestore(&priv->spn_lock.cbs, flags);
+#endif
+		}
+	}
+}
+#endif /* DYNAMIC_LOAD_CBS */
+#endif
+/**
+ * tc956xmac_disable_all_queues - Disable all queues
+ * @priv: driver private structure
+ */
+static void tc956xmac_disable_all_queues(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X
+	u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+#endif
+
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
+	u32 queue;
+
+	for (queue = 0; queue < maxq; queue++) {
+		struct tc956xmac_channel *ch = &priv->channel[queue];
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+
+		if (queue < rx_queues_cnt)
+#else
+		if (queue < rx_queues_cnt && priv->plat->rx_dma_ch_owner[queue] == USE_IN_TC956X_SW)
+#endif
+			napi_disable(&ch->rx_napi);
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+
+		if (queue < tx_queues_cnt)
+#else
+		if (queue < tx_queues_cnt && priv->plat->tx_dma_ch_owner[queue] == USE_IN_TC956X_SW)
+#endif
+			napi_disable(&ch->tx_napi);
+	}
+}
+
+/**
+ * tc956xmac_enable_all_queues - Enable all queues
+ * @priv: driver private structure
+ */
+static void tc956xmac_enable_all_queues(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X
+	u32 rx_queues_cnt = priv->plat->rx_queues_to_use;
+#endif
+
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 maxq = max(rx_queues_cnt, tx_queues_cnt);
+	u32 queue;
+
+	for (queue = 0; queue < maxq; queue++) {
+		struct tc956xmac_channel *ch = &priv->channel[queue];
+
+#ifdef TC956X_SRIOV_PF
+		if (queue < rx_queues_cnt) {
+
+			if (priv->plat->rx_ch_in_use[queue] ==
+						TC956X_DISABLE_CHNL)
+				continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+
+		if (queue < rx_queues_cnt) {
+#else
+		if (queue < rx_queues_cnt && priv->plat->rx_dma_ch_owner[queue] == USE_IN_TC956X_SW) {
+#endif
+			napi_enable(&ch->rx_napi);
+		}
+#ifdef TC956X_SRIOV_PF
+		if (queue < tx_queues_cnt) {
+			if (priv->plat->tx_ch_in_use[queue] ==
+						TC956X_DISABLE_CHNL)
+				continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+
+		if (queue < tx_queues_cnt) {
+#else
+		if (queue < tx_queues_cnt && priv->plat->tx_dma_ch_owner[queue] == USE_IN_TC956X_SW) {
+#endif
+			napi_enable(&ch->tx_napi);
+		}
+	}
+}
+
+/**
+ * tc956xmac_stop_all_queues - Stop all queues
+ * @priv: driver private structure
+ */
+static void tc956xmac_stop_all_queues(struct tc956xmac_priv *priv)
+{
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 queue;
+
+	for (queue = 0; queue < tx_queues_cnt; queue++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		netif_tx_stop_queue(netdev_get_tx_queue(priv->dev, queue));
+	}
+}
+
+/**
+ * tc956xmac_start_all_queues - Start all queues
+ * @priv: driver private structure
+ */
+static void tc956xmac_start_all_queues(struct tc956xmac_priv *priv)
+{
+	u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+	u32 queue;
+
+	for (queue = 0; queue < tx_queues_cnt; queue++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		netif_tx_start_queue(netdev_get_tx_queue(priv->dev, queue));
+	}
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED
+static void tc956xmac_service_event_schedule(struct tc956xmac_priv *priv)
+{
+	if (!test_bit(TC956XMAC_DOWN, &priv->state) &&
+	    !test_and_set_bit(TC956XMAC_SERVICE_SCHED, &priv->state))
+		queue_work(priv->wq, &priv->service_task);
+}
+#endif
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+/**
+ * tc956xmac_service_mbx_event_schedule - Schedule work queue
+ * @priv: driver private structure
+ */
+void tc956xmac_service_mbx_event_schedule(struct tc956xmac_priv *priv)
+{
+	if (!test_bit(TC956XMAC_DOWN, &priv->state) &&
+	    !test_and_set_bit(TC956XMAC_SERVICE_SCHED, &priv->state))
+		queue_work(priv->mbx_wq, &priv->service_mbx_task);
+}
+#endif
+#ifdef TC956X_SRIOV_VF
+/**
+ * tc956xmac_mailbox_service_event_schedule - Schedule work queue
+ * @priv: driver private structure
+ */
+void tc956xmac_mailbox_service_event_schedule(struct tc956xmac_priv *priv)
+{
+	if (!test_bit(TC956XMAC_DOWN, &priv->state) &&
+	    !test_and_set_bit(TC956XMAC_SERVICE_SCHED, &priv->state))
+		queue_work(priv->mbx_wq, &priv->mbx_service_task);
+}
+#endif
+static void tc956xmac_global_err(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X_SRIOV_VF
+	netdev_alert(priv->dev, "%s PF %d VF %d disabling carrier\n", __func__, priv->fn_id_info.pf_no, priv->fn_id_info.vf_no);
+#endif
+	netif_carrier_off(priv->dev);
+	set_bit(TC956XMAC_RESET_REQUESTED, &priv->state);
+#ifdef TC956X_UNSUPPORTED_UNTESTED
+	tc956xmac_service_event_schedule(priv);
+#endif
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+#ifndef TC956X_SRIOV_VF
+/**
+ * tc956xmac_clk_csr_set - dynamically set the MDC clock
+ * @priv: driver private structure
+ * Description: this is to dynamically set the MDC clock according to the csr
+ * clock input.
+ * Note:
+ *	If a specific clk_csr value is passed from the platform
+ *	this means that the CSR Clock Range selection cannot be
+ *	changed at run-time and it is fixed (as reported in the driver
+ *	documentation). Viceversa the driver will try to set the MDC
+ *	clock dynamically according to the actual clock input.
+ */
+static void tc956xmac_clk_csr_set(struct tc956xmac_priv *priv)
+{
+	u32 clk_rate;
+
+	clk_rate = clk_get_rate(priv->plat->tc956xmac_clk);
+
+	/* Platform provided default clk_csr would be assumed valid
+	 * for all other cases except for the below mentioned ones.
+	 * For values higher than the IEEE 802.3 specified frequency
+	 * we can not estimate the proper divider as it is not known
+	 * the frequency of clk_csr_i. So we do not change the default
+	 * divider.
+	 */
+	if (!(priv->clk_csr & MAC_CSR_H_FRQ_MASK)) {
+		if (clk_rate < CSR_F_35M)
+			priv->clk_csr = TC956XMAC_CSR_20_35M;
+		else if ((clk_rate >= CSR_F_35M) && (clk_rate < CSR_F_60M))
+			priv->clk_csr = TC956XMAC_CSR_35_60M;
+		else if ((clk_rate >= CSR_F_60M) && (clk_rate < CSR_F_100M))
+			priv->clk_csr = TC956XMAC_CSR_60_100M;
+		else if ((clk_rate >= CSR_F_100M) && (clk_rate < CSR_F_150M))
+			priv->clk_csr = TC956XMAC_CSR_100_150M;
+		else if ((clk_rate >= CSR_F_150M) && (clk_rate < CSR_F_250M))
+			priv->clk_csr = TC956XMAC_CSR_150_250M;
+		else if ((clk_rate >= CSR_F_250M) && (clk_rate < CSR_F_300M))
+			priv->clk_csr = TC956XMAC_CSR_250_300M;
+	}
+
+	if (priv->plat->has_sun8i) {
+		if (clk_rate > 160000000)
+			priv->clk_csr = 0x03;
+		else if (clk_rate > 80000000)
+			priv->clk_csr = 0x02;
+		else if (clk_rate > 40000000)
+			priv->clk_csr = 0x01;
+		else
+			priv->clk_csr = 0;
+	}
+
+	if (priv->plat->has_xgmac) {
+		if (clk_rate > 400000000)
+			priv->clk_csr = 0x5;
+		else if (clk_rate > 350000000)
+			priv->clk_csr = 0x4;
+		else if (clk_rate > 300000000)
+			priv->clk_csr = 0x3;
+		else if (clk_rate > 250000000)
+			priv->clk_csr = 0x2;
+		else if (clk_rate > 150000000)
+			priv->clk_csr = 0x1;
+		else
+			priv->clk_csr = 0x0;
+	}
+}
+#endif /* TC956X_SRIOV_VF */
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+static void print_pkt(unsigned char *buf, int len)
+{
+	pr_debug("len = %d byte, buf addr: 0x%p\n", len, buf);
+	print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, buf, len);
+}
+
+static inline u32 tc956xmac_tx_avail(struct tc956xmac_priv *priv, u32 queue)
+{
+	struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+	u32 avail;
+
+	if (tx_q->dirty_tx > tx_q->cur_tx)
+		avail = tx_q->dirty_tx - tx_q->cur_tx - 1;
+	else
+		avail = DMA_TX_SIZE - tx_q->cur_tx + tx_q->dirty_tx - 1;
+
+	return avail;
+}
+
+/**
+ * tc956xmac_rx_dirty - Get RX queue dirty
+ * @priv: driver private structure
+ * @queue: RX queue index
+ */
+static inline u32 tc956xmac_rx_dirty(struct tc956xmac_priv *priv, u32 queue)
+{
+	struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+	u32 dirty;
+
+	if (rx_q->dirty_rx <= rx_q->cur_rx)
+		dirty = rx_q->cur_rx - rx_q->dirty_rx;
+	else
+		dirty = DMA_RX_SIZE - rx_q->dirty_rx + rx_q->cur_rx;
+
+	return dirty;
+}
+
+/**
+ * tc956xmac_enable_eee_mode - check and enter in LPI mode
+ * @priv: driver private structure
+ * Description: this function is to verify and enter in LPI mode in case of
+ * EEE.
+ */
+static void tc956xmac_enable_eee_mode(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X_SRIOV_PF
+	tc956xmac_set_eee_mode(priv, priv->hw,
+			priv->plat->en_tx_lpi_clockgating);
+#endif
+}
+
+/**
+ * tc956xmac_disable_eee_mode - disable and exit from LPI mode
+ * @priv: driver private structure
+ * Description: this function is to exit and disable EEE in case of
+ * LPI state is true. This is called by the xmit.
+ */
+void tc956xmac_disable_eee_mode(struct tc956xmac_priv *priv)
+{
+	tc956xmac_reset_eee_mode(priv, priv->hw);
+}
+
+/**
+ * tc956xmac_eee_init - init EEE
+ * @priv: driver private structure
+ * Description:
+ *  if the GMAC supports the EEE (from the HW cap reg) and the phy device
+ *  can also manage EEE, this function enable the LPI state and start related
+ *  timer.
+ */
+bool tc956xmac_eee_init(struct tc956xmac_priv *priv)
+{
+#ifdef EEE_MAC_CONTROLLED_MODE
+	int value;
+#endif
+
+	/* Using PCS we cannot dial with the phy registers at this stage
+	 * so we do not support extra feature like EEE.
+	 */
+	if ((priv->hw->pcs == TC956XMAC_PCS_RGMII) ||
+	    (priv->hw->pcs == TC956XMAC_PCS_TBI) ||
+	    (priv->hw->pcs == TC956XMAC_PCS_RTBI))
+		return false;
+
+	/* Check if MAC core supports the EEE feature. */
+	if (!priv->dma_cap.eee)
+		return false;
+
+	mutex_lock(&priv->lock);
+
+	tc956xmac_enable_eee_mode(priv);
+#ifdef EEE_MAC_CONTROLLED_MODE
+	tc956xmac_set_eee_timer(priv, priv->hw, TC956XMAC_LIT_LS, TC956XMAC_TWT_LS);
+	value = readl(priv->ioaddr + XGMAC_LPI_1US_Tic_Counter);
+	value &= ~XGMAC_LPI_1US_Tic_Counter_MASK;
+	value |= (TC956XMAC_TIC_1US_CNTR & XGMAC_LPI_1US_Tic_Counter_MASK); /* Setting  bit [11...0] */
+	writel(value, priv->ioaddr + XGMAC_LPI_1US_Tic_Counter);
+	value = readl(priv->ioaddr + XGMAC_LPI_Auto_Entry_Timer);
+	/* Setting LPIET bit [19...3] */
+	value &= ~(XGMAC_LPIET);
+	/* LPI Entry timer is in the units of 8 micro second granularity considering last reserved 2:0 bits as zero
+	 * So mask the last 3 bits
+	 */
+	value |= (priv->tx_lpi_timer & XGMAC_LPIET);
+	DBGPR_FUNC(priv->device, "%s Writing LPI timer value of [%d]\n", __func__, value);
+	writel(value, priv->ioaddr + XGMAC_LPI_Auto_Entry_Timer);
+#endif
+	mutex_unlock(&priv->lock);
+	netdev_dbg(priv->dev, "Energy-Efficient Ethernet initialized\n");
+	return true;
+}
+
+/* tc956xmac_get_tx_hwtstamp - get HW TX timestamps
+ * @priv: driver private structure
+ * @p : descriptor pointer
+ * @skb : the socket buffer
+ * Description :
+ * This function will read timestamp from the descriptor & pass it to stack.
+ * and also perform some sanity checks.
+ */
+static void tc956xmac_get_tx_hwtstamp(struct tc956xmac_priv *priv,
+				   struct dma_desc *p, struct sk_buff *skb)
+{
+	struct skb_shared_hwtstamps shhwtstamp;
+	bool found = false;
+	u64 ns = 0;
+#if defined(TX_LOGGING_TRACE)
+	static unsigned int ccnt1, ccnt2, ccnt3;
+	u32 qno = skb_get_queue_mapping(skb);
+#endif
+
+#ifdef PKT_RATE_DBG
+	static unsigned int count;
+	static u64 prev_ns;
+	u64 rate;
+#endif
+
+	if (!priv->hwts_tx_en)
+		return;
+
+#if !defined(TX_LOGGING_TRACE)
+	/* exit if skb doesn't support hw tstamp */
+	if (likely(!skb || !(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)))
+		return;
+#endif
+	/* check tx tstamp status */
+	if (tc956xmac_get_tx_timestamp_status(priv, p)) {
+		tc956xmac_get_timestamp(priv, p, priv->adv_ts, &ns);
+		found = true;
+	} else if (!tc956xmac_get_mac_tx_timestamp(priv, priv->hw, &ns)) {
+		found = true;
+	}
+
+	if (found) {
+		memset(&shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
+		shhwtstamp.hwtstamp = ns_to_ktime(ns);
+
+		netdev_dbg(priv->dev, "get valid TX hw timestamp %llu\n", ns);
+		/* pass tstamp to stack */
+		skb_tstamp_tx(skb, &shhwtstamp);
+	}
+
+#if defined(TX_LOGGING_TRACE)
+	if (found) {
+
+#ifdef PKT_RATE_DBG
+		if (count % 8000 == 0) {
+			rate = (8000*1000*1000000000ULL)/(unsigned int)(ns - prev_ns);
+#ifdef FPE
+			KPRINT_INFO("Tx FPE mmc_tx_frag_cnt:%d\n", priv->mmc.mmc_tx_fpe_fragment_cntr);
+#endif
+			prev_ns = ns;
+		}
+		count++;
+#endif
+
+#ifdef FPE
+		priv->mmc.mmc_tx_fpe_fragment_cntr += readl(priv->mmcaddr + MMC_XGMAC_TX_FPE_FRAG);
+#endif
+#ifdef TC956X_SRIOV_VF
+		if ((qno == priv->plat->avb_class_a_ch_no)
+			&& (priv->plat->best_effort_ch_no != priv->plat->avb_class_a_ch_no)) {/* For AVB */
+#else
+		if (qno == AVB_CLASS_A_TX_CH) {/* For AVB */
+#endif
+			if (skb->data[20] == 0)
+				ccnt1++;
+
+#ifdef FPE
+		trace_printk("[AVB]TS,%llu,%d,%03d,%02d,\n",
+				ns, ccnt1, skb->data[20], qno);
+#else
+		trace_printk("[AVB]TS,%llu,%d,%03d,%02d, ,\n",
+				ns, ccnt1, skb->data[20], qno);
+#endif
+#ifdef TC956X_SRIOV_VF
+		} else if ((qno == priv->plat->avb_class_b_ch_no)
+			&& (priv->plat->best_effort_ch_no != priv->plat->avb_class_b_ch_no)) {
+#else
+		} else if (qno == AVB_CLASS_B_TX_CH) {
+#endif
+
+			if (skb->data[20] == 0)
+				ccnt2++;
+
+			trace_printk("[CLASS_B]TS,%llu,%d,%03d,%02d, ,\n",
+					ns, ccnt2, skb->data[20], qno);
+#ifdef TC956X_SRIOV_VF
+		} else if ((qno == priv->plat->tsn_ch_no)
+			&& (priv->plat->best_effort_ch_no != priv->plat->tsn_ch_no)) {/*  For CDT */
+#else
+		} else if (qno == TSN_CLASS_CDT_TX_CH) {/*  For CDT */
+#endif
+
+			if (skb->data[20] == 0)
+				ccnt3++;
+
+#ifdef FPE
+			trace_printk("[CDT]TS,%llu,%d,%03d,%02d,\n",
+					ns, ccnt3, skb->data[20], qno);
+#else
+			trace_printk("[CDT]TS,%llu,%d,%03d,%02d, ,\n",
+					ns, ccnt3, skb->data[20], qno);
+#endif
+
+#ifdef TC956X_SRIOV_VF
+		} else if ((qno == priv->plat->gptp_ch_no)
+			&& (priv->plat->best_effort_ch_no != priv->plat->gptp_ch_no)) {
+#else
+		} else if (qno == TC956X_GPTP_TX_CH) {
+#endif
+			u16 gPTP_ID = 0;
+			u16 MsgType = 0;
+
+			MsgType = skb->data[14] & 0x0F;
+			gPTP_ID = skb->data[44];
+			gPTP_ID = (gPTP_ID<<8) | skb->data[45];
+
+			if (MsgType != 0x0b)
+				trace_printk("[gPTP]TS,%019llu,%04d,0x%x,%02d\n",
+						ns, gPTP_ID, MsgType, qno);
+
+#ifdef TC956X_SRIOV_VF
+		} else if (qno == priv->plat->best_effort_ch_no) {
+#else
+		} else if (qno == HOST_BEST_EFF_CH) {
+#endif
+#ifdef FPE
+			trace_printk("[LE]TS,%llu,00,000,%02d,\n", ns, qno);
+#else
+			trace_printk("[LE]TS,%llu,00,000,%02d, ,\n", ns, qno);
+#endif
+		} else {
+		}
+	}
+#endif
+
+}
+
+/* tc956xmac_get_rx_hwtstamp - get HW RX timestamps
+ * @priv: driver private structure
+ * @p : descriptor pointer
+ * @np : next descriptor pointer
+ * @skb : the socket buffer
+ * Description :
+ * This function will read received packet's timestamp from the descriptor
+ * and pass it to stack. It also perform some sanity checks.
+ */
+
+#if defined(RX_LOGGING_TRACE)
+static void tc956xmac_get_rx_hwtstamp(struct tc956xmac_priv *priv, struct dma_desc *p,
+				   struct dma_desc *np, struct sk_buff *skb,
+				   u32 qno)
+
+#else
+static void tc956xmac_get_rx_hwtstamp(struct tc956xmac_priv *priv, struct dma_desc *p,
+				   struct dma_desc *np, struct sk_buff *skb)
+#endif
+{
+	struct skb_shared_hwtstamps *shhwtstamp = NULL;
+	struct dma_desc *desc = p;
+	u64 ns = 0;
+#if defined(RX_LOGGING_TRACE)
+	static unsigned int ccnt1, ccnt2;
+	unsigned int proto = 0;
+#endif
+
+#ifdef FPE
+#if defined(RX_LOGGING_TRACE)
+	priv->mmc.mmc_rx_packet_assembly_ok_cntr += readl(priv->mmcaddr + MMC_XGMAC_RX_PKT_ASSEMBLY_OK);
+	priv->mmc.mmc_rx_fpe_fragment_cntr += readl(priv->mmcaddr + MMC_XGMAC_RX_FPE_FRAG);
+#endif
+#endif
+
+	if (!priv->hwts_rx_en)
+		return;
+
+
+	/* For GMAC4, the valid timestamp is from CTX next desc. */
+	if (priv->plat->has_gmac4 || priv->plat->has_xgmac)
+		desc = np;
+
+	/* Check if timestamp is available */
+	if (tc956xmac_get_rx_timestamp_status(priv, p, np, priv->adv_ts)) {
+#ifdef FPE
+#if defined(RX_LOGGING_TRACE)
+		static unsigned int count;
+
+		if (count % 8000 == 0) {
+			KPRINT_INFO("Rx FPE asmbly_ok_cnt:%lld,frag_cnt:%lld\n",
+				priv->mmc.mmc_rx_packet_assembly_ok_cntr,
+				priv->mmc.mmc_rx_fpe_fragment_cntr);
+		}
+		count++;
+#endif
+#endif
+		tc956xmac_get_timestamp(priv, desc, priv->adv_ts, &ns);
+		netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
+		shhwtstamp = skb_hwtstamps(skb);
+		memset(shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
+		shhwtstamp->hwtstamp = ns_to_ktime(ns);
+
+#if defined(RX_LOGGING_TRACE)
+		proto = htons(((skb->data[13]<<8) | skb->data[12]));
+		if (proto == ETH_P_8021Q) {
+			proto = htons(((skb->data[17]<<8) | skb->data[16]));
+			if (proto == ETH_P_TSN) {
+				if (skb->data[24] == 0 && skb->data[25] == 2) {
+				/* Differentiated by stream IDs 2 for CDT */
+					if ((unsigned char)skb->data[16] == 0)
+						ccnt1++;
+					trace_printk("[CDT]TS,%llu,%d,%03d,%02d\n",
+							ns, ccnt1, skb->data[16], qno);
+				} else if (skb->data[24] == 0 && skb->data[25] == 1) {
+					/* Differentiated by stream IDs 1 for AVB */
+					if ((unsigned char)skb->data[16] == 0)
+						ccnt2++;
+					trace_printk("[AVB]TS,%llu,%d,%03d,%02d\n",
+							ns, ccnt2, skb->data[16], qno);
+				}
+			}
+		} else if (proto == ETH_P_1588) {
+			if ((skb->data[14]&0x0F) != 0xb) {
+				u16 MsgType = skb->data[14] & 0x0F;
+				u16 gPTP_ID = (skb->data[44] << 8) | skb->data[45];
+
+				trace_printk("[gPTP]TS,%019llu,%04d,0x%x,%02d\n",
+						ns, gPTP_ID, MsgType, qno);
+			}
+		} else {
+		}
+#endif
+	} else {
+		netdev_dbg(priv->dev, "cannot get RX hw timestamp\n");
+	}
+}
+
+/**
+ *  tc956xmac_hwtstamp_set - control hardware timestamping.
+ *  @dev: device pointer.
+ *  @ifr: An IOCTL specific structure, that can contain a pointer to
+ *  a proprietary structure used to pass information to the driver.
+ *  Description:
+ *  This function configures the MAC to enable/disable both outgoing(TX)
+ *  and incoming(RX) packets time stamping based on user input.
+ *  Return Value:
+ *  0 on success and an appropriate -ve integer on failure.
+ */
+#ifndef TC956X_SRIOV_VF
+static int tc956xmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct hwtstamp_config config;
+	u32 ptp_v2 = 0;
+	u32 tstamp_all = 0;
+	u32 ptp_over_ipv4_udp = 0;
+	u32 ptp_over_ipv6_udp = 0;
+	u32 ptp_over_ethernet = 0;
+	u32 snap_type_sel = 0;
+	u32 ts_master_en = 0;
+	u32 ts_event_en = 0;
+	u32 value = 0;
+	u32 tcr_config = 0;
+	bool xmac;
+
+	xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
+
+	if (!(priv->dma_cap.time_stamp || priv->adv_ts)) {
+		netdev_alert(priv->dev, "No support for HW time stamping\n");
+		priv->hwts_tx_en = 0;
+		priv->hwts_rx_en = 0;
+
+		return -EOPNOTSUPP;
+	}
+
+	if (copy_from_user(&config, ifr->ifr_data,
+			   sizeof(config)))
+		return -EFAULT;
+
+	netdev_dbg(priv->dev, "%s config flags:0x%x, tx_type:0x%x, rx_filter:0x%x\n",
+		   __func__, config.flags, config.tx_type, config.rx_filter);
+
+	/* reserved for future extensions */
+	if (config.flags)
+		return -EINVAL;
+
+	if (config.tx_type != HWTSTAMP_TX_OFF &&
+	    config.tx_type != HWTSTAMP_TX_ON)
+		return -ERANGE;
+
+	if (priv->adv_ts) {
+		switch (config.rx_filter) {
+		case HWTSTAMP_FILTER_NONE:
+			/* time stamp no incoming packet at all */
+			config.rx_filter = HWTSTAMP_FILTER_NONE;
+			break;
+
+		case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
+			/* PTP v1, UDP, any kind of event packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
+			/* 'xmac' hardware can support Sync, Pdelay_Req and
+			 * Pdelay_resp by setting bit14 and bits17/16 to 01
+			 * This leaves Delay_Req timestamps out.
+			 * Enable all events *and* general purpose message
+			 * timestamping
+			 */
+			snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+			break;
+
+		case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
+			/* PTP v1, UDP, Sync packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_SYNC;
+			/* take time stamp for SYNC messages only */
+			ts_event_en = PTP_TCR_TSEVNTENA;
+
+			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+			break;
+
+		case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
+			/* PTP v1, UDP, Delay_req packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ;
+			/* take time stamp for Delay_Req messages only */
+			ts_master_en = PTP_TCR_TSMSTRENA;
+			ts_event_en = PTP_TCR_TSEVNTENA;
+
+			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+			break;
+
+		case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+			/* PTP v2, UDP, any kind of event packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+			ptp_v2 = PTP_TCR_TSVER2ENA;
+			/* take time stamp for all event messages */
+			snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+
+			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+			break;
+
+		case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+			/* PTP v2, UDP, Sync packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_SYNC;
+			ptp_v2 = PTP_TCR_TSVER2ENA;
+			/* take time stamp for SYNC messages only */
+			ts_event_en = PTP_TCR_TSEVNTENA;
+
+			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+			break;
+
+		case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ:
+			/* PTP v2, UDP, Delay_req packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ;
+			ptp_v2 = PTP_TCR_TSVER2ENA;
+			/* take time stamp for Delay_Req messages only */
+			ts_master_en = PTP_TCR_TSMSTRENA;
+			ts_event_en = PTP_TCR_TSEVNTENA;
+
+			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+			break;
+
+		case HWTSTAMP_FILTER_PTP_V2_EVENT:
+			/* PTP v2/802.AS1 any layer, any kind of event packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+			ptp_v2 = PTP_TCR_TSVER2ENA;
+			snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+			ts_event_en = PTP_TCR_TSEVNTENA;
+			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+			ptp_over_ethernet = PTP_TCR_TSIPENA;
+			break;
+
+		case HWTSTAMP_FILTER_PTP_V2_SYNC:
+			/* PTP v2/802.AS1, any layer, Sync packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V2_SYNC;
+			ptp_v2 = PTP_TCR_TSVER2ENA;
+			/* take time stamp for SYNC messages only */
+			ts_event_en = PTP_TCR_TSEVNTENA;
+
+			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+			ptp_over_ethernet = PTP_TCR_TSIPENA;
+			break;
+
+		case HWTSTAMP_FILTER_PTP_V2_DELAY_REQ:
+			/* PTP v2/802.AS1, any layer, Delay_req packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V2_DELAY_REQ;
+			ptp_v2 = PTP_TCR_TSVER2ENA;
+			/* take time stamp for Delay_Req messages only */
+			ts_master_en = PTP_TCR_TSMSTRENA;
+			ts_event_en = PTP_TCR_TSEVNTENA;
+
+			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+			ptp_over_ethernet = PTP_TCR_TSIPENA;
+			break;
+
+		case HWTSTAMP_FILTER_NTP_ALL:
+		case HWTSTAMP_FILTER_ALL:
+			/* time stamp any incoming packet */
+			config.rx_filter = HWTSTAMP_FILTER_ALL;
+			tstamp_all = PTP_TCR_TSENALL;
+			break;
+
+		default:
+			return -ERANGE;
+		}
+	} else {
+		switch (config.rx_filter) {
+		case HWTSTAMP_FILTER_NONE:
+			config.rx_filter = HWTSTAMP_FILTER_NONE;
+			break;
+		default:
+			/* PTP v1, UDP, any kind of event packet */
+			config.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
+			break;
+		}
+	}
+	priv->hwts_rx_en = ((config.rx_filter == HWTSTAMP_FILTER_NONE) ? 0 : 1);
+	priv->hwts_tx_en = config.tx_type == HWTSTAMP_TX_ON;
+
+	if (!priv->hwts_tx_en && !priv->hwts_rx_en)
+		tc956xmac_config_hw_tstamping(priv, priv->ptpaddr, 0);
+	else {
+		tcr_config = (PTP_TCR_TSENA | PTP_TCR_TSCFUPDT | PTP_TCR_TSCTRLSSR |
+			tstamp_all | ptp_v2 | ptp_over_ethernet |
+			ptp_over_ipv6_udp | ptp_over_ipv4_udp | ts_event_en |
+			ts_master_en | snap_type_sel | PTP_TCR_ASMEN);
+
+		value = readl(priv->ptpaddr + PTP_TCR);
+		/* Note : Values will never be set. "tc956x_ptp_configuration" function
+		 * call should be same as during probe.
+		 */
+		if (!(value & 0x00000001)) {
+			tc956x_ptp_configuration(priv, 0);
+			DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+		}
+
+	}
+
+	memcpy(&priv->tstamp_config, &config, sizeof(config));
+
+	return copy_to_user(ifr->ifr_data, &config,
+			    sizeof(config)) ? -EFAULT : 0;
+}
+
+/*
+ *  tc956xmac_hwtstamp_get - read hardware timestamping.
+ *  @dev: device pointer.
+ *  @ifr: An IOCTL specific structure, that can contain a pointer to
+ *  a proprietary structure used to pass information to the driver.
+ *  Description:
+ *  This function obtain the current hardware timestamping settings
+ *  as requested.
+ */
+static int tc956xmac_hwtstamp_get(struct net_device *dev, struct ifreq *ifr)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct hwtstamp_config *config = &priv->tstamp_config;
+
+	if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp))
+		return -EOPNOTSUPP;
+
+	return copy_to_user(ifr->ifr_data, config,
+			    sizeof(*config)) ? -EFAULT : 0;
+}
+
+/**
+ * tc956xmac_init_ptp - init PTP
+ * @priv: driver private structure
+ * Description: this is to verify if the HW supports the PTPv1 or PTPv2.
+ * This is done by looking at the HW cap. register.
+ * This function also registers the ptp driver.
+ */
+static int tc956xmac_init_ptp(struct tc956xmac_priv *priv)
+{
+	bool xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
+
+	if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp))
+		return -EOPNOTSUPP;
+
+	priv->adv_ts = 0;
+	/* Check if adv_ts can be enabled for dwmac 4.x / xgmac core */
+	if (xmac && priv->dma_cap.atime_stamp)
+		priv->adv_ts = 1;
+	/* Dwmac 3.x core with extend_desc can support adv_ts */
+	else if (priv->extend_desc && priv->dma_cap.atime_stamp)
+		priv->adv_ts = 1;
+
+	if (priv->dma_cap.time_stamp)
+		netdev_info(priv->dev, "IEEE 1588-2002 Timestamp supported\n");
+
+	if (priv->adv_ts)
+		netdev_info(priv->dev,
+			    "IEEE 1588-2008 Advanced Timestamp supported\n");
+
+	priv->hwts_tx_en = 0;
+	priv->hwts_rx_en = 0;
+
+	tc956xmac_ptp_register(priv);
+
+	return 0;
+}
+#endif /* TC956X_SRIOV_VF */
+
+static void tc956xmac_release_ptp(struct tc956xmac_priv *priv)
+{
+	if (priv->plat->clk_ptp_ref)
+		clk_disable_unprepare(priv->plat->clk_ptp_ref);
+	tc956xmac_ptp_unregister(priv);
+}
+#ifndef TC956X_SRIOV_VF
+/**
+ *  tc956xmac_mac_flow_ctrl - Configure flow control in all queues
+ *  @priv: driver private structure
+ *  Description: It is used for configuring the flow control in all queues
+ */
+static void tc956xmac_mac_flow_ctrl(struct tc956xmac_priv *priv, u32 duplex)
+{
+	u32 tx_cnt = priv->plat->tx_queues_to_use;
+
+	tc956xmac_flow_ctrl(priv, priv->hw, duplex, priv->flow_ctrl,
+			priv->pause, tx_cnt);
+}
+
+static void tc956xmac_validate(struct phylink_config *config,
+			    unsigned long *supported,
+			    struct phylink_link_state *state)
+{
+	struct tc956xmac_priv *priv = netdev_priv(to_net_dev(config->dev));
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(mac_supported) = { 0, };
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+	int tx_cnt = priv->plat->tx_queues_to_use;
+	int max_speed = priv->plat->max_speed;
+
+	phylink_set(mac_supported, 10baseT_Half);
+	phylink_set(mac_supported, 10baseT_Full);
+	phylink_set(mac_supported, 100baseT_Half);
+	phylink_set(mac_supported, 100baseT_Full);
+	phylink_set(mac_supported, 1000baseT_Half);
+	phylink_set(mac_supported, 1000baseT_Full);
+	phylink_set(mac_supported, 1000baseKX_Full);
+
+	phylink_set(mac_supported, Autoneg);
+	phylink_set(mac_supported, Pause);
+	phylink_set(mac_supported, Asym_Pause);
+	phylink_set_port_modes(mac_supported);
+
+	/*USXGMII interface does not support speed of 1000/100/10*/
+	if (priv->plat->interface == PHY_INTERFACE_MODE_USXGMII) {
+		phylink_set(mask, 10baseT_Half);
+		phylink_set(mask, 10baseT_Full);
+		phylink_set(mask, 100baseT_Half);
+		phylink_set(mask, 100baseT_Full);
+		phylink_set(mask, 1000baseT_Half);
+		phylink_set(mask, 1000baseT_Full);
+		phylink_set(mask, 1000baseKX_Full);
+	}
+
+
+	/* Cut down 1G if asked to */
+	if ((max_speed > 0) && (max_speed < 1000)) {
+		phylink_set(mask, 1000baseT_Full);
+		phylink_set(mask, 1000baseX_Full);
+	} else if (priv->plat->has_xgmac) {
+		if (!max_speed || (max_speed >= 2500)) {
+			phylink_set(mac_supported, 2500baseT_Full);
+			phylink_set(mac_supported, 2500baseX_Full);
+		}
+		if (!max_speed || (max_speed >= 5000))
+			phylink_set(mac_supported, 5000baseT_Full);
+		if (!max_speed || (max_speed >= 10000)) {
+			phylink_set(mac_supported, 10000baseSR_Full);
+			phylink_set(mac_supported, 10000baseLR_Full);
+			phylink_set(mac_supported, 10000baseER_Full);
+			phylink_set(mac_supported, 10000baseLRM_Full);
+			phylink_set(mac_supported, 10000baseT_Full);
+			phylink_set(mac_supported, 10000baseKX4_Full);
+			phylink_set(mac_supported, 10000baseKR_Full);
+		}
+	}
+
+	/* Half-Duplex can only work with single queue */
+	if (tx_cnt > 1) {
+#ifdef TC956X
+		KPRINT_INFO("Half duplex not supported in Port0");
+#else
+		phylink_set(mask, 10baseT_Half);
+		phylink_set(mask, 100baseT_Half);
+#endif
+
+#ifdef TC956X
+		phylink_set(mask, 1000baseT_Half);
+#endif
+	}
+
+	bitmap_and(supported, supported, mac_supported,
+			__ETHTOOL_LINK_MODE_MASK_NBITS);
+	bitmap_andnot(supported, supported, mask,
+			__ETHTOOL_LINK_MODE_MASK_NBITS);
+	bitmap_and(state->advertising, state->advertising, mac_supported,
+			__ETHTOOL_LINK_MODE_MASK_NBITS);
+	bitmap_andnot(state->advertising, state->advertising, mask,
+			__ETHTOOL_LINK_MODE_MASK_NBITS);
+}
+#endif  /* TC956X_SRIOV_VF */
+
+#ifndef TC956X_SRIOV_VF
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
+static void tc956xmac_mac_pcs_get_state(struct phylink_config *config,
+					struct phylink_link_state *state)
+{
+#ifndef TC956X
+	state->link = 0;
+#else
+	struct tc956xmac_priv *priv = netdev_priv(to_net_dev(config->dev));
+	u32 reg_value;
+
+	reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS);
+	if (reg_value & XGMAC_C37_AN_COMPL) {/*check if AN 37 is complete CL37_ANCMPLT_INTR*/
+		KPRINT_INFO("AN clause 37 completed");
+		if ((priv->plat->interface == PHY_INTERFACE_MODE_USXGMII) ||
+		   (priv->plat->interface == PHY_INTERFACE_MODE_10GKR)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+			|| (priv->plat->interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+			) {
+			if (reg_value & XGMAC_USXG_AN_STS_LINK_MASK) {/*check link status*/
+				state->link = 1;
+				KPRINT_INFO("XPCS USXGMII link up");
+
+				if (((reg_value & XGMAC_USXG_AN_STS_SPEED_MASK) >> 9) == 0x3)/*If USXG_AN_STS is 10G*/
+					state->speed = SPEED_10000;
+				else if (((reg_value & XGMAC_USXG_AN_STS_SPEED_MASK) >> 9) == 0x5)/*If USXG_AN_STS is 5G*/
+					state->speed = SPEED_5000;
+				else if (((reg_value & XGMAC_USXG_AN_STS_SPEED_MASK) >> 9) == 0x4)/*If USXG_AN_STS is 5G*/
+					state->speed = SPEED_2500;
+
+				if (reg_value & XGMAC_USXG_AN_STS_DUPLEX_MASK)/*If USXG_AN_STS is full duplex*/
+					state->duplex = DUPLEX_FULL;
+				else
+					state->duplex = DUPLEX_HALF;
+			} else {
+				KPRINT_INFO("XPCS USXGMII link down");
+				state->link = 0;
+			}
+
+		} else if (priv->plat->interface == PHY_INTERFACE_MODE_SGMII) {
+			if (reg_value & XGMAC_SGM_STS_LINK_MASK) {/*SGMII autonegotiated link */
+				state->link = 1;
+				KPRINT_INFO("XPCS SGMII link up");
+
+				if (reg_value & XGMAC_SGM_STS_DUPLEX)/*SGMII autonegotiated duplex */
+					state->duplex = DUPLEX_FULL;
+				else
+					state->duplex = DUPLEX_HALF;
+
+				if (((reg_value & XGMAC_SGM_STS_SPEED_MASK) >> 2) == 0x2) {/*SGMII autonegotiated speed */
+					if (priv->is_sgmii_2p5g == true)
+						state->speed = SPEED_2500; /*There is no seperate bit check for 2.5Gbps, so set here */
+					else
+						state->speed = SPEED_1000;
+				} else if (((reg_value & XGMAC_SGM_STS_SPEED_MASK) >> 2) == 0x1)
+					state->speed = SPEED_100;
+			} else {
+				state->link = 0;
+				KPRINT_INFO("XPCS SGMII link down");
+			}
+		}
+	}
+#endif
+}
+#endif
+#else	/* Required when using with Kernel v5.4 */
+static int tc956xmac_mac_link_state(struct phylink_config *config,
+				 struct phylink_link_state *state)
+{
+#ifndef TC956X
+	return -EOPNOTSUPP;
+#else
+	struct tc956xmac_priv *priv = netdev_priv(to_net_dev(config->dev));
+	u32 reg_value;
+
+	reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS);
+	if (reg_value & XGMAC_C37_AN_COMPL) {/*check if AN 37 is complete CL37_ANCMPLT_INTR*/
+		KPRINT_INFO("AN clause 37 completed");
+		if ((priv->plat->interface == PHY_INTERFACE_MODE_USXGMII) ||
+		   (priv->plat->interface == PHY_INTERFACE_MODE_10GKR)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+			|| (priv->plat->interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+			) {
+			if (reg_value & XGMAC_USXG_AN_STS_LINK_MASK) {/*check link status*/
+				state->link = 1;
+				KPRINT_INFO("XPCS USXGMII link up");
+
+				/*If USXG_AN_STS is 10G*/
+				if (((reg_value & XGMAC_USXG_AN_STS_SPEED_MASK) >> 9) == 0x3)
+					state->speed = SPEED_10000;
+				/*If USXG_AN_STS is 5G*/
+				else if (((reg_value & XGMAC_USXG_AN_STS_SPEED_MASK) >> 9) == 0x5)
+					state->speed = SPEED_5000;
+				/*If USXG_AN_STS is 5G*/
+				else if (((reg_value & XGMAC_USXG_AN_STS_SPEED_MASK) >> 9) == 0x4)
+					state->speed = SPEED_2500;
+
+				/*If USXG_AN_STS is full duplex*/
+				if (reg_value & XGMAC_USXG_AN_STS_DUPLEX_MASK)
+					state->duplex = DUPLEX_FULL;
+				else
+					state->duplex = DUPLEX_HALF;
+			} else {
+				KPRINT_INFO("XPCS USXGMII link down");
+				state->link = 0;
+			}
+
+		} else if (priv->plat->interface == PHY_INTERFACE_MODE_SGMII) {
+			if (reg_value & XGMAC_SGM_STS_LINK_MASK) {/*SGMII autonegotiated link */
+				state->link = 1;
+				KPRINT_INFO("XPCS SGMII link up");
+				/*SGMII autonegotiated duplex */
+				if (reg_value & XGMAC_SGM_STS_DUPLEX)
+					state->duplex = DUPLEX_FULL;
+				else
+					state->duplex = DUPLEX_HALF;
+				/*SGMII autonegotiated speed */
+				if (((reg_value & XGMAC_SGM_STS_SPEED_MASK) >> 2) == 0x2) {
+					if (priv->is_sgmii_2p5g == true)
+						state->speed = SPEED_2500; /*There is no seperate bit check for 2.5Gbps, so set here */
+					else
+						state->speed = SPEED_1000;
+				} else if (((reg_value & XGMAC_SGM_STS_SPEED_MASK) >> 2) == 0x1)
+					state->speed = SPEED_100;
+			} else {
+				state->link = 0;
+				KPRINT_INFO("XPCS SGMII link down");
+			}
+		}
+	}
+
+	return 0;
+#endif
+}
+#endif
+
+/**
+ *  tc956xmac_speed_change_init_mac - Initialize MAC during speed change.
+ *  @priv: driver private structure
+ *  @state : phy state structure
+ *  Description: It is used for initializing MAC during speed change of
+ *  USXGMII and SGMII.
+ */
+static void tc956xmac_speed_change_init_mac(struct tc956xmac_priv *priv,
+					const struct phylink_link_state *state)
+{
+	/* use signal from MSPHY */
+	uint8_t SgmSigPol = 0;
+	int ret = 0;
+	bool enable_an = true;
+
+	if (priv->port_num == RM_PF0_ID) {
+		/* Enable all clocks to eMAC Port0 */
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET);
+		if ((state->interface == PHY_INTERFACE_MODE_SGMII) &&
+		   (state->speed == SPEED_2500)) {
+			ret &= ~NCLKCTRL0_MAC0125CLKEN;
+			ret &= ~NCLKCTRL0_MAC0312CLKEN;
+		}
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET);
+
+		/* Interface configuration for port0*/
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NEMAC0CTL_OFFSET);
+		ret &= ~(NEMACCTL_SP_SEL_MASK | NEMACCTL_PHY_INF_SEL_MASK);
+		if (state->interface == PHY_INTERFACE_MODE_SGMII) {
+			if (state->speed == SPEED_2500)
+				ret |= NEMACCTL_SP_SEL_SGMII_2500M;
+			else
+				ret |= NEMACCTL_SP_SEL_SGMII_1000M;
+		} else {
+			/*else if ((PORT0_INTERFACE == ENABLE_USXGMII_INTERFACE)*/
+			if (state->speed == SPEED_10000)
+				ret |= NEMACCTL_SP_SEL_USXGMII_10G_10G;
+			else if (state->speed == SPEED_5000)
+				ret |= NEMACCTL_SP_SEL_USXGMII_5G_10G;
+			else if (state->speed == SPEED_2500)
+				ret |= NEMACCTL_SP_SEL_USXGMII_2_5G_10G;
+		}
+		ret &= ~(0x00000040); /* Mask Polarity */
+		if (SgmSigPol == 1)
+			ret |= 0x00000040; /* Set Active low */
+		ret |= (NEMACCTL_PHY_INF_SEL | NEMACCTL_LPIHWCLKEN);
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NEMAC0CTL_OFFSET);
+	}
+	if (priv->port_num == RM_PF1_ID) {
+		/* Enable all clocks to eMAC Port1 */
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NCLKCTRL1_OFFSET);
+		if ((state->interface == PHY_INTERFACE_MODE_SGMII) &&
+		   (state->speed == SPEED_2500)) {
+			ret &= ~NCLKCTRL1_MAC1125CLKEN1;
+			ret &= ~NCLKCTRL1_MAC1312CLKEN1;
+		} else {
+			ret &= ~NCLKCTRL1_MAC1312CLKEN1;
+			ret |= NCLKCTRL1_MAC1125CLKEN1;
+		}
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NCLKCTRL1_OFFSET);
+
+		/* Interface configuration for port1*/
+		ret = readl(priv->tc956x_SFR_pci_base_addr + NEMAC1CTL_OFFSET);
+		ret &= ~(NEMACCTL_SP_SEL_MASK | NEMACCTL_PHY_INF_SEL_MASK);
+		if (state->interface == PHY_INTERFACE_MODE_SGMII) {
+			if (state->speed == SPEED_2500)
+				ret |= NEMACCTL_SP_SEL_SGMII_2500M;
+			else
+				ret |= NEMACCTL_SP_SEL_SGMII_1000M;
+		} else {
+			if (state->speed == SPEED_10000)
+				ret |= NEMACCTL_SP_SEL_USXGMII_10G_10G;
+			else if (state->speed == SPEED_5000)
+				ret |= NEMACCTL_SP_SEL_USXGMII_5G_10G;
+			else if (state->speed == SPEED_2500)
+				ret |= NEMACCTL_SP_SEL_USXGMII_2_5G_10G;
+		}
+
+		ret &= ~(0x00000040); /* Mask Polarity */
+		if (SgmSigPol == 1)
+			ret |= 0x00000040; /* Set Active low */
+		ret |= (NEMACCTL_PHY_INF_SEL | NEMACCTL_LPIHWCLKEN);
+		writel(ret, priv->tc956x_SFR_pci_base_addr + NEMAC1CTL_OFFSET);
+	}
+
+	/*PMA module init*/
+	if (priv->hw->xpcs && (state->interface == PHY_INTERFACE_MODE_SGMII)) {
+		if (priv->port_num == RM_PF0_ID) {
+			/* Assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL0_OFFSET);
+			ret |= (NRSTCTRL0_MAC0PMARST | NRSTCTRL0_MAC0PONRST);
+			writel(ret, priv->ioaddr + NRSTCTRL0_OFFSET);
+		}
+		if (priv->port_num == RM_PF1_ID) {
+			/* Assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL1_OFFSET);
+			ret |= (NRSTCTRL1_MAC1PMARST1 | NRSTCTRL1_MAC1PONRST1);
+			writel(ret, priv->ioaddr + NRSTCTRL1_OFFSET);
+		}
+
+		ret = tc956x_pma_setup(priv, priv->pmaaddr);
+		if (ret < 0)
+			KPRINT_ERR("PMA switching to internal clock Failed\n");
+
+		if (priv->port_num == RM_PF0_ID) {
+			/* De-assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL0_OFFSET);
+			ret &= ~(NRSTCTRL0_MAC0PMARST | NRSTCTRL0_MAC0PONRST);
+			writel(ret, priv->ioaddr + NRSTCTRL0_OFFSET);
+		}
+		if (priv->port_num == RM_PF1_ID) {
+			/* De-assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL1_OFFSET);
+			ret &= ~(NRSTCTRL1_MAC1PMARST1 | NRSTCTRL1_MAC1PONRST1);
+			writel(ret, priv->ioaddr + NRSTCTRL1_OFFSET);
+		}
+
+		if (priv->port_num == RM_PF0_ID) {
+			do {
+				ret = readl(priv->ioaddr + NEMAC0CTL_OFFSET);
+			} while ((NEMACCTL_INIT_DONE & ret) != NEMACCTL_INIT_DONE);
+		}
+		if (priv->port_num == RM_PF1_ID) {
+			do {
+				ret = readl(priv->ioaddr + NEMAC1CTL_OFFSET);
+			} while ((NEMACCTL_INIT_DONE & ret) != NEMACCTL_INIT_DONE);
+		}
+		if ((state->interface == PHY_INTERFACE_MODE_SGMII)
+		&& (state->speed == SPEED_2500)) {
+			/* XPCS doesn't support AN for 2.5G SGMII.
+			 * Disable AN only if SGMII 2.5G is Enabled.
+			 */
+			priv->is_sgmii_2p5g = true;
+			enable_an = false;
+		} else {
+			priv->is_sgmii_2p5g = false;
+			enable_an = true;
+		}
+
+		ret = tc956x_xpcs_init(priv, priv->xpcsaddr);
+		if (ret < 0)
+			KPRINT_INFO("XPCS initialization error\n");
+		tc956x_xpcs_ctrl_ane(priv, enable_an);
+	}
+}
+
+static void tc956xmac_mac_config(struct phylink_config *config, unsigned int mode,
+				const struct phylink_link_state *state)
+{
+	struct tc956xmac_priv *priv = netdev_priv(to_net_dev(config->dev));
+	u32 ctrl, emac_ctrl;
+	u32 val;
+	bool config_done = false;
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	int ret = 0;
+#endif
+
+#ifdef TC956X
+	u32 reg_value;
+
+	ctrl = readl(priv->ioaddr + MAC_CTRL_REG);
+	ctrl &= ~priv->hw->link.speed_mask;
+
+	emac_ctrl = readl(priv->ioaddr + NEMACCTL_OFFSET);
+	emac_ctrl &= ~NEMACCTL_SP_SEL_MASK;
+
+	if (priv->hw->xpcs) {
+		reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS);
+		if (reg_value & XGMAC_C37_AN_COMPL) {/*check if AN 37 is complete CL37_ANCMPLT_INTR*/
+			KPRINT_INFO("AN clause 37 completed");
+			reg_value &= ~(XGMAC_C37_AN_COMPL);
+			tc956x_xpcs_write(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS, reg_value);
+			KPRINT_INFO("AN clause 37 complete bit cleared");
+		}
+
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+		if (priv->wol_config_enabled != true) {
+#endif
+			if (state->interface == PHY_INTERFACE_MODE_USXGMII) {
+				/* Invoke this only during speed change */
+				if ((state->speed != SPEED_UNKNOWN) && (state->speed != 0)) {
+					if (state->speed != priv->speed) {
+						tc956xmac_speed_change_init_mac(priv, state);
+					}
+				} else {
+					return;
+				}
+
+				/* Program autonegotiated speed to SR_MII_CTRL */
+				val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_MII_CTRL);
+				val &= ~XGMAC_SR_MII_CTRL_SPEED; /* Mask speed ss13, ss6, ss5 */
+
+				switch (state->speed) {
+				case SPEED_10000:
+					ctrl |= priv->hw->link.xgmii.speed10000;
+					emac_ctrl |= NEMACCTL_SP_SEL_USXGMII_10G_10G;
+					val |= XGMAC_SR_MII_CTRL_SPEED_10G;
+					break;
+				case SPEED_5000:
+					ctrl |= priv->hw->link.xgmii.speed5000;
+					emac_ctrl |= NEMACCTL_SP_SEL_USXGMII_5G_10G;
+					val |= XGMAC_SR_MII_CTRL_SPEED_5G;
+					break;
+				case SPEED_2500:
+					ctrl |= priv->hw->link.xgmii.speed2500;
+					emac_ctrl |= NEMACCTL_SP_SEL_USXGMII_2_5G_10G;
+					val |= XGMAC_SR_MII_CTRL_SPEED_2_5G;
+					break;
+				default:
+					return;
+				}
+
+				tc956x_xpcs_write(priv->xpcsaddr, XGMAC_SR_MII_CTRL, val);
+
+				/* USRA_RST set to 1 */
+				val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1);
+				val |= XGMAC_USRA_RST;
+				tc956x_xpcs_write(priv->xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1, val);
+				config_done = true;
+			}
+		if ((state->interface == PHY_INTERFACE_MODE_SGMII)
+			&& (priv->port_interface != ENABLE_2500BASE_X_INTERFACE)) { /* Autonegotiation not supported for SGMII */
+			reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS);
+			/* Clear autonegotiation only if completed. As for XPCS, 2.5G autonegotiation is not supported */
+			/* Switching from SGMII 2.5G to any speed doesn't cause AN completion */
+			if (reg_value & XGMAC_C37_AN_COMPL) {/*check if AN 37 is complete CL37_ANCMPLT_INTR*/
+				KPRINT_INFO("AN clause 37 completed");
+				reg_value &= ~(XGMAC_C37_AN_COMPL);
+				tc956x_xpcs_write(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS, reg_value);
+				KPRINT_INFO("AN clause 37 complete bit cleared");
+			}
+			/* Invoke this only during speed change */
+			if ((state->speed != SPEED_UNKNOWN) && (state->speed != 0)) {
+				if (state->speed != priv->speed)
+					tc956xmac_speed_change_init_mac(priv, state);
+			} else {
+				return;
+			}
+			val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_MII_CTRL);
+			val &= ~XGMAC_SR_MII_CTRL_SPEED; /* Mask speed ss13, ss6, ss5 */
+			switch (state->speed) {
+			case SPEED_2500:
+				ctrl |= priv->hw->link.speed2500;
+				/* Program autonegotiated speed to SR_MII_CTRL */
+				val |= XPCS_SS_SGMII_1G; /*1000 Mbps setting only available, so set the same*/
+				emac_ctrl |= NEMACCTL_SP_SEL_SGMII_2500M;
+				break;
+			case SPEED_1000:
+				ctrl |= priv->hw->link.speed1000;
+				val |= XPCS_SS_SGMII_1G; /*1000 Mbps setting only available, so set the same*/
+				emac_ctrl |= NEMACCTL_SP_SEL_SGMII_1000M;
+				break;
+			case SPEED_100:
+				ctrl |= priv->hw->link.speed100;
+				val |= XPCS_SS_SGMII_100M; /*100 Mbps setting */
+				emac_ctrl |= NEMACCTL_SP_SEL_SGMII_100M;
+				break;
+			case SPEED_10:
+				ctrl |= priv->hw->link.speed10;
+				val |= XPCS_SS_SGMII_10M; /*10 Mbps setting */
+				emac_ctrl |= NEMACCTL_SP_SEL_SGMII_10M;
+				break;
+			default:
+				return;
+			}
+			tc956x_xpcs_write(priv->xpcsaddr, XGMAC_SR_MII_CTRL, val);
+			config_done = true;
+		}
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+		} else {
+			/* Configure Speed for WOL SGMII 1Gbps */
+			KPRINT_INFO("%s Port %d %s: Entered with flag priv->wol_config_enabled %d", __func__, priv->port_num, priv->dev->name, priv->wol_config_enabled);
+			KPRINT_INFO("%s Port %d %s: Speed to configure %d", __func__, priv->port_num, priv->dev->name, state->speed);
+			reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS);
+			/* Clear autonegotiation only if completed. As for XPCS, 2.5G autonegotiation is not supported */
+			/* Switching from SGMII 2.5G to any speed doesn't cause AN completion */
+			if (reg_value & XGMAC_C37_AN_COMPL) {/*check if AN 37 is complete CL37_ANCMPLT_INTR*/
+				KPRINT_INFO("AN clause 37 completed");
+				reg_value &= ~(XGMAC_C37_AN_COMPL);
+				tc956x_xpcs_write(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS, reg_value);
+				KPRINT_INFO("AN clause 37 complete bit cleared");
+			}
+			ret = tc956x_xpcs_init(priv, priv->xpcsaddr);
+			if (ret < 0)
+				KPRINT_INFO("XPCS initialization error\n");
+			tc956x_xpcs_ctrl_ane(priv, true);
+			val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_MII_CTRL);
+			val &= ~XGMAC_SR_MII_CTRL_SPEED; /* Mask speed ss13, ss6, ss5 */
+			switch (state->speed) {
+			case SPEED_1000:
+				ctrl |= priv->hw->link.speed1000;
+				val |= XPCS_SS_SGMII_1G; /*1000 Mbps setting only available, so set the same*/
+				emac_ctrl |= NEMACCTL_SP_SEL_SGMII_1000M;
+				break;
+			case SPEED_100:
+				ctrl |= priv->hw->link.speed100;
+				val |= XPCS_SS_SGMII_100M; /*100 Mbps setting */
+				emac_ctrl |= NEMACCTL_SP_SEL_SGMII_100M;
+				break;
+			default:
+				return;
+			}
+			tc956x_xpcs_write(priv->xpcsaddr, XGMAC_SR_MII_CTRL, val);
+			config_done = true;
+		} /* End of if (priv->wol_config_enabled != true) */
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+	} else if (state->interface == PHY_INTERFACE_MODE_RGMII ||
+		   state->interface == PHY_INTERFACE_MODE_RGMII_ID) {
+		switch (state->speed) {
+		case SPEED_1000:
+			ctrl |= priv->hw->link.speed1000;
+			emac_ctrl |= NEMACCTL_SP_SEL_RGMII_1000M;
+			break;
+		case SPEED_100:
+			ctrl |= priv->hw->link.speed100;
+			emac_ctrl |= NEMACCTL_SP_SEL_RGMII_100M;
+			break;
+		case SPEED_10:
+			ctrl |= priv->hw->link.speed10;
+			emac_ctrl |= NEMACCTL_SP_SEL_RGMII_10M;
+			break;
+		default:
+			return;
+		}
+		config_done = true;
+	} else {
+		switch (state->speed) {
+		case SPEED_2500:
+			ctrl |= priv->hw->link.speed2500;
+			break;
+		case SPEED_1000:
+			ctrl |= priv->hw->link.speed1000;
+			break;
+		case SPEED_100:
+			ctrl |= priv->hw->link.speed100;
+			break;
+		case SPEED_10:
+			ctrl |= priv->hw->link.speed10;
+			break;
+		default:
+			return;
+		}
+		config_done = true;
+	}
+
+	priv->speed = state->speed;
+#ifdef TC956X_SRIOV_PF
+	priv->duplex = state->duplex;
+#endif
+	if (priv->plat->fix_mac_speed)
+		priv->plat->fix_mac_speed(priv->plat->bsp_priv, state->speed);
+
+	if (!state->duplex)
+		ctrl &= ~priv->hw->link.duplex;
+	else
+		ctrl |= priv->hw->link.duplex;
+
+	/* Flow Control operation */
+	if (state->pause)
+		tc956xmac_mac_flow_ctrl(priv, state->duplex);
+
+	if (config_done) {
+		writel(ctrl, priv->ioaddr + MAC_CTRL_REG);
+		writel(emac_ctrl, priv->ioaddr + NEMACCTL_OFFSET);
+	}
+#endif
+}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
+static void tc956xmac_mac_an_restart(struct phylink_config *config)
+{
+#ifdef TC956X
+	struct tc956xmac_priv *priv = netdev_priv(to_net_dev(config->dev));
+	bool enable_en = true;
+
+	if (priv->hw->xpcs) {
+		/*Enable XPCS Autoneg*/
+		if ((priv->plat->interface == PHY_INTERFACE_MODE_10GKR) ||
+			(priv->port_interface == ENABLE_2500BASE_X_INTERFACE)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+			|| (priv->plat->interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+			) {
+			enable_en = false;
+			KPRINT_INFO("%s :Port %d %s AN Enable:%d", __func__, priv->port_num, priv->dev->name, enable_en);
+		} else if (priv->plat->interface == PHY_INTERFACE_MODE_SGMII) {
+			if (priv->is_sgmii_2p5g == true) {
+				enable_en = false;
+				KPRINT_INFO("%s : Port %d %s AN Enable:%d", __func__, priv->port_num, priv->dev->name, enable_en);
+			} else {
+				enable_en = true;
+				KPRINT_INFO("%s : Port %d %s AN Enable:%d", __func__, priv->port_num, priv->dev->name, enable_en);
+			}
+		} else {
+			enable_en = true;
+			KPRINT_INFO("%s : Port %d %s AN Enable:%d", __func__, priv->port_num, priv->dev->name, enable_en);
+		}
+		tc956x_xpcs_ctrl_ane(priv, enable_en);
+	}
+#else
+	/*Not supported*/
+#endif
+}
+#endif
+
+static int tc956xmac_open(struct net_device *dev);
+static int tc956xmac_release(struct net_device *dev);
+static void tc956xmac_mac_link_down(struct phylink_config *config,
+				 unsigned int mode, phy_interface_t interface)
+{
+	u32 ch;
+	u32 offload_release_sts = true;
+	struct tc956xmac_priv *priv = netdev_priv(to_net_dev(config->dev));
+	struct net_device *ndev = to_net_dev(config->dev);
+
+	tc956xmac_mac_set_rx(priv, priv->ioaddr, false);
+	/* In SRIOV code, EEE is handled by PF driver */
+#ifndef TC956X_SRIOV_VF
+#ifdef EEE
+	priv->eee_active = false;
+	DBGPR_FUNC(priv->device, "%s Disable EEE\n", __func__);
+	tc956xmac_disable_eee_mode(priv);
+	tc956xmac_set_eee_pls(priv, priv->hw, false);
+#endif
+#ifdef TC956X_PM_DEBUG
+	pm_generic_suspend(priv->device);
+#endif
+
+	if (((mac0_link_down_macrst == ENABLE && priv->port_num == RM_PF0_ID) ||
+		(mac1_link_down_macrst == ENABLE && priv->port_num == RM_PF1_ID)) &&
+		netif_running(ndev))
+		priv->link_down_rst = true;
+	else
+		priv->link_down_rst = false;
+
+	KPRINT_INFO("link down1 priv->link_down_rst = %d\n", priv->link_down_rst);
+	if (priv->link_down_rst == true) {
+		tc956xmac_release(ndev);
+		tc956xmac_open(ndev);
+		priv->link_down_rst = false;
+	}
+
+	KPRINT_INFO("link down2 priv->link_down_rst = %d\n", priv->link_down_rst);
+	mutex_lock(&priv->port_ld_release_lock);
+	/* Checking whether all offload Tx channels released or not*/
+	for (ch = 0; ch < MAX_TX_QUEUES_TO_USE; ch++) {
+		/* If offload channels are not freed, update the flag, so that power saving API will not be called*/
+		if (priv->plat->tx_dma_ch_owner[ch] == USE_IN_OFFLOADER) {
+			offload_release_sts = false;
+			break;
+		}
+	}
+	/* Checking whether all offload Rx channels released or not*/
+	for (ch = 0; ch < MAX_RX_QUEUES_TO_USE; ch++) {
+		/* If offload channels are not freed, update the flag, so that power saving API will not be called*/
+		if (priv->plat->rx_dma_ch_owner[ch] == USE_IN_OFFLOADER) {
+			offload_release_sts = false;
+			break;
+		}
+	}
+
+	/* If all channels are freed, call API for power saving*/
+	if (priv->port_link_down == false && offload_release_sts == true) {
+		tc956xmac_link_change_set_power(priv, LINK_DOWN); /* Save, Assert and Disable Reset and Clock */
+	}
+	priv->port_release = true; /* setting port release to true as link-down invoked, and clear from open or link-up */
+	mutex_unlock(&priv->port_ld_release_lock);
+
+#endif
+}
+
+#ifdef TC956X_5_G_2_5_G_EEE_SUPPORT
+static inline bool tc956x_phy_check_valid(int speed, int duplex,
+				   unsigned long *features)
+{
+	return !!phy_lookup_setting(speed, duplex, features, true);
+}
+
+static void tc956x_mmd_eee_adv_to_linkmode_5G_2_5G(unsigned long *advertising, u16 eee_adv)
+{
+	linkmode_zero(advertising);
+
+	if (eee_adv & MDIO_EEE_5GT)
+		linkmode_set_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+				 advertising);
+	if (eee_adv & MDIO_EEE_2_5GT)
+		linkmode_set_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+				 advertising);
+}
+
+static int tc956x_phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
+{
+	if (!phydev->drv)
+		return -EIO;
+
+	KPRINT_INFO("%s EEE phy init for 5G/2.5G\n", __func__);
+
+	/* According to 802.3az,the EEE is supported only in full duplex-mode.
+	 */
+	if (phydev->duplex == DUPLEX_FULL) {
+		__ETHTOOL_DECLARE_LINK_MODE_MASK(common);
+		__ETHTOOL_DECLARE_LINK_MODE_MASK(lp);
+		__ETHTOOL_DECLARE_LINK_MODE_MASK(adv);
+		int eee_lp, eee_cap, eee_adv;
+		int status;
+		u32 cap;
+
+		/* Read phy status to properly get the right settings */
+		status = phy_read_status(phydev);
+		if (status) {
+			KPRINT_ERR("Error 0: %d\n", status);
+			return status;
+		}
+
+		/* First check if the EEE ability is supported */
+		eee_cap = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE2);
+		if (eee_cap <= 0) {
+			KPRINT_ERR("Error 2\n");
+			goto eee_exit_err;
+		}
+
+		cap = mmd_eee_cap_to_ethtool_sup_t(eee_cap);
+		if (!cap) {
+			KPRINT_ERR("Error 3\n");
+			goto eee_exit_err;
+		}
+
+		/* Check which link settings negotiated and verify it in
+		 * the EEE advertising registers.
+		 */
+		eee_lp = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_LPABLE2);
+		if (eee_lp <= 0) {
+			KPRINT_ERR("Error 4\n");
+			goto eee_exit_err;
+		}
+
+		eee_adv = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV2);
+		if (eee_adv <= 0) {
+			KPRINT_ERR("Error 5\n");
+			goto eee_exit_err;
+		}
+
+		tc956x_mmd_eee_adv_to_linkmode_5G_2_5G(adv, eee_adv);
+		tc956x_mmd_eee_adv_to_linkmode_5G_2_5G(lp, eee_lp);
+		linkmode_and(common, adv, lp);
+
+		if (!tc956x_phy_check_valid(phydev->speed, phydev->duplex, common)) {
+			KPRINT_ERR("Error 6\n");
+			goto eee_exit_err;
+		}
+
+		if (clk_stop_enable)
+			phy_set_bits_mmd(phydev, MDIO_MMD_PCS, MDIO_CTRL1,
+					 MDIO_PCS_CTRL1_CLKSTOP_EN);
+
+		return 0;
+	}
+eee_exit_err:
+	return -EPROTONOSUPPORT;
+}
+#endif
+
+#ifdef DEBUG_EEE
+static void mmd_eee_adv_to_linkmode_local(unsigned long *advertising, u16 eee_adv)
+{
+	linkmode_zero(advertising);
+
+	if (eee_adv & MDIO_EEE_100TX)
+		linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT,
+				 advertising);
+	if (eee_adv & MDIO_EEE_1000T)
+		linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+				 advertising);
+	if (eee_adv & MDIO_EEE_10GT)
+		linkmode_set_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT,
+				 advertising);
+	if (eee_adv & MDIO_EEE_1000KX)
+		linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseKX_Full_BIT,
+				 advertising);
+	if (eee_adv & MDIO_EEE_10GKX4)
+		linkmode_set_bit(ETHTOOL_LINK_MODE_10000baseKX4_Full_BIT,
+				 advertising);
+	if (eee_adv & MDIO_EEE_10GKR)
+		linkmode_set_bit(ETHTOOL_LINK_MODE_10000baseKR_Full_BIT,
+				 advertising);
+}
+
+int phy_init_eee_local(struct phy_device *phydev, bool clk_stop_enable)
+{
+	if (!phydev->drv)
+		return -EIO;
+
+	KPRINT_INFO("----> %s\n", __func__);
+
+
+	/* According to 802.3az,the EEE is supported only in full duplex-mode.
+	 */
+	if (phydev->duplex == DUPLEX_FULL) {
+		__ETHTOOL_DECLARE_LINK_MODE_MASK(common);
+		__ETHTOOL_DECLARE_LINK_MODE_MASK(lp);
+		__ETHTOOL_DECLARE_LINK_MODE_MASK(adv);
+		int eee_lp, eee_cap, eee_adv;
+		int status;
+		u32 cap;
+
+		/* Read phy status to properly get the right settings */
+		status = phy_read_status(phydev);
+		if (status) {
+			KPRINT_ERR("Error 0: %d\n", status);
+			return status;
+		}
+
+		/* First check if the EEE ability is supported */
+		eee_cap = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE);
+		if (eee_cap <= 0) {
+			KPRINT_ERR("Error 1\n");
+			goto eee_exit_err;
+		}
+
+		cap = mmd_eee_cap_to_ethtool_sup_t(eee_cap);
+		if (!cap) {
+			KPRINT_ERR("Error 2\n");
+			goto eee_exit_err;
+		}
+
+		/* Check which link settings negotiated and verify it in
+		 * the EEE advertising registers.
+		 */
+		eee_lp = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_LPABLE);
+		if (eee_lp <= 0) {
+			KPRINT_ERR("Error 3\n");
+			goto eee_exit_err;
+		}
+
+		eee_adv = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV);
+		if (eee_adv <= 0) {
+			KPRINT_ERR("Error 4\n");
+			goto eee_exit_err;
+		}
+
+		KPRINT_INFO("%s eee_adv: 0x%x\n", __func__, eee_adv);
+		KPRINT_INFO("%s eee_lp: 0x%x\n", __func__, eee_lp);
+
+
+		mmd_eee_adv_to_linkmode_local(adv, eee_adv);
+		mmd_eee_adv_to_linkmode_local(lp, eee_lp);
+
+		KPRINT_INFO("%s adv: 0x%x\n", __func__, adv);
+		KPRINT_INFO("%s eee_lp: 0x%x\n", __func__, lp);
+
+		linkmode_and(common, adv, lp);
+
+		KPRINT_INFO("%s common: 0x%x\n", __func__, common);
+
+		if (!tc956x_phy_check_valid(phydev->speed, phydev->duplex, common)) {
+			KPRINT_ERR("Error 5\n");
+			goto eee_exit_err;
+		}
+
+		if (clk_stop_enable)
+			/* Configure the PHY to stop receiving xMII
+			 * clock while it is signaling LPI.
+			 */
+			phy_set_bits_mmd(phydev, MDIO_MMD_PCS, MDIO_CTRL1,
+					 MDIO_PCS_CTRL1_CLKSTOP_EN);
+
+		return 0; /* EEE supported */
+	}
+eee_exit_err:
+	return -EPROTONOSUPPORT;
+}
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
+static void tc956xmac_mac_link_up(struct phylink_config *config,
+				   struct phy_device *phy,
+				   unsigned int mode, phy_interface_t interface,
+			       int speed, int duplex, bool tx_pause, bool rx_pause)
+#else
+static void tc956xmac_mac_link_up(struct phylink_config *config,
+			       unsigned int mode, phy_interface_t interface,
+			       struct phy_device *phy)
+#endif
+{
+	struct tc956xmac_priv *priv = netdev_priv(to_net_dev(config->dev));
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
+	u32 ctrl, emac_ctrl;
+	bool config_done = false;
+	u32 reg_value;
+	u32 val;
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	int ret;
+#endif
+	struct phylink_link_state state;
+
+	state.interface = interface;
+	state.speed = speed;
+	state.duplex = duplex;
+
+	ctrl = readl(priv->ioaddr + MAC_CTRL_REG);
+	ctrl &= ~priv->hw->link.speed_mask;
+
+	emac_ctrl = readl(priv->ioaddr + NEMACCTL_OFFSET);
+	emac_ctrl &= ~NEMACCTL_SP_SEL_MASK;
+
+	if (priv->hw->xpcs) {
+		reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS);
+		if (reg_value & XGMAC_C37_AN_COMPL) {/*check if AN 37 is complete CL37_ANCMPLT_INTR*/
+			KPRINT_INFO("AN clause 37 completed");
+			reg_value &= ~(XGMAC_C37_AN_COMPL);
+			tc956x_xpcs_write(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS, reg_value);
+			KPRINT_INFO("AN clause 37 complete bit cleared");
+		}
+
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+		if (priv->wol_config_enabled != true) {
+#endif
+			if (interface == PHY_INTERFACE_MODE_USXGMII) {
+				/* Invoke this only during speed change */
+				if ((speed != SPEED_UNKNOWN) && (speed != 0)) {
+					if (speed != priv->speed)
+						tc956xmac_speed_change_init_mac(priv, &state);
+				} else {
+					return;
+				}
+				/* Program autonegotiated speed to SR_MII_CTRL */
+				val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_MII_CTRL);
+				val &= ~XGMAC_SR_MII_CTRL_SPEED; /* Mask speed ss13, ss6, ss5 */
+
+				switch (speed) {
+				case SPEED_10000:
+					ctrl |= priv->hw->link.xgmii.speed10000;
+					emac_ctrl |= NEMACCTL_SP_SEL_USXGMII_10G_10G;
+					val |= XGMAC_SR_MII_CTRL_SPEED_10G;
+					break;
+				case SPEED_5000:
+					ctrl |= priv->hw->link.xgmii.speed5000;
+					emac_ctrl |= NEMACCTL_SP_SEL_USXGMII_5G_10G;
+					val |= XGMAC_SR_MII_CTRL_SPEED_5G;
+					break;
+				case SPEED_2500:
+					ctrl |= priv->hw->link.xgmii.speed2500;
+					emac_ctrl |= NEMACCTL_SP_SEL_USXGMII_2_5G_10G;
+					val |= XGMAC_SR_MII_CTRL_SPEED_2_5G;
+					break;
+				default:
+					return;
+				}
+				tc956x_xpcs_write(priv->xpcsaddr, XGMAC_SR_MII_CTRL, val);
+
+				/* USRA_RST set to 1 */
+				val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1);
+				val |= XGMAC_USRA_RST;
+				tc956x_xpcs_write(priv->xpcsaddr, XGMAC_VR_XS_PCS_DIG_CTRL1, val);
+				config_done = true;
+			}
+			if ((interface == PHY_INTERFACE_MODE_SGMII) &&
+			(priv->port_interface != ENABLE_2500BASE_X_INTERFACE)) {
+				reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS);
+				/* Clear autonegotiation only if completed. As for XPCS, 2.5G autonegotiation is not supported */
+				/* Switching from SGMII 2.5G to any speed doesn't cause AN completion */
+
+				if (reg_value & XGMAC_C37_AN_COMPL) {/*check if AN 37 is complete CL37_ANCMPLT_INTR*/
+					KPRINT_INFO("AN clause 37 completed");
+					reg_value &= ~(XGMAC_C37_AN_COMPL);
+					tc956x_xpcs_write(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS, reg_value);
+					KPRINT_INFO("AN clause 37 complete bit cleared");
+				}
+
+				/* Invoke this only during speed change */
+				if ((speed != SPEED_UNKNOWN) && (speed != 0)) {
+					if (speed != priv->speed)
+						tc956xmac_speed_change_init_mac(priv, &state);
+				} else {
+					return;
+				}
+
+				val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_MII_CTRL);
+				val &= ~XGMAC_SR_MII_CTRL_SPEED; /* Mask speed ss13, ss6, ss5 */
+
+				switch (speed) {
+				case SPEED_2500:
+					ctrl |= priv->hw->link.speed2500;
+					/* Program autonegotiated speed to SR_MII_CTRL */
+					val |= XPCS_SS_SGMII_1G; /*1000 Mbps setting only available, so set the same*/
+					emac_ctrl |= NEMACCTL_SP_SEL_SGMII_2500M;
+					break;
+				case SPEED_1000:
+					ctrl |= priv->hw->link.speed1000;
+					val |= XPCS_SS_SGMII_1G; /*1000 Mbps setting only available, so set the same*/
+					emac_ctrl |= NEMACCTL_SP_SEL_SGMII_1000M;
+					break;
+				case SPEED_100:
+					ctrl |= priv->hw->link.speed100;
+					val |= XPCS_SS_SGMII_100M; /*100 Mbps setting */
+					emac_ctrl |= NEMACCTL_SP_SEL_SGMII_100M;
+					break;
+				case SPEED_10:
+					ctrl |= priv->hw->link.speed10;
+					val |= XPCS_SS_SGMII_10M; /*10 Mbps setting */
+					emac_ctrl |= NEMACCTL_SP_SEL_SGMII_10M;
+					break;
+				default:
+					return;
+				}
+				tc956x_xpcs_write(priv->xpcsaddr, XGMAC_SR_MII_CTRL, val);
+				config_done = true;
+			}
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+		} else {
+			/* Configure Speed for WOL SGMII 1Gbps */
+			KPRINT_INFO("%s Port %d %s : Entered with flag priv->wol_config_enabled %d", __func__, priv->port_num, priv->dev->name, priv->wol_config_enabled);
+			KPRINT_INFO("%s Port %d %s : Speed to configure %d", __func__, priv->port_num, priv->dev->name, speed);
+			reg_value = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS);
+
+			/* Clear autonegotiation only if completed. As for XPCS, 2.5G autonegotiation is not supported */
+			/* Switching from SGMII 2.5G to any speed doesn't cause AN completion */
+			if (reg_value & XGMAC_C37_AN_COMPL) {/*check if AN 37 is complete CL37_ANCMPLT_INTR*/
+				KPRINT_INFO("AN clause 37 completed");
+				reg_value &= ~(XGMAC_C37_AN_COMPL);
+				tc956x_xpcs_write(priv->xpcsaddr, XGMAC_VR_MII_AN_INTR_STS, reg_value);
+				KPRINT_INFO("AN clause 37 complete bit cleared");
+			}
+
+			ret = tc956x_xpcs_init(priv, priv->xpcsaddr);
+			if (ret < 0)
+				KPRINT_INFO("XPCS initialization error\n");
+			tc956x_xpcs_ctrl_ane(priv, true);
+			val = tc956x_xpcs_read(priv->xpcsaddr, XGMAC_SR_MII_CTRL);
+			val &= ~XGMAC_SR_MII_CTRL_SPEED; /* Mask speed ss13, ss6, ss5 */
+			switch (speed) {
+			case SPEED_1000:
+				ctrl |= priv->hw->link.speed1000;
+				val |= XPCS_SS_SGMII_1G; /*1000 Mbps setting only available, so set the same*/
+				emac_ctrl |= NEMACCTL_SP_SEL_SGMII_1000M;
+				break;
+			case SPEED_100:
+				ctrl |= priv->hw->link.speed100;
+				val |= XPCS_SS_SGMII_100M; /*100 Mbps setting */
+				emac_ctrl |= NEMACCTL_SP_SEL_SGMII_100M;
+				break;
+			default:
+				return;
+			}
+			tc956x_xpcs_write(priv->xpcsaddr, XGMAC_SR_MII_CTRL, val);
+			config_done = true;
+		} /* End of if (priv->wol_config_enabled != true) */
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+	} else if (interface == PHY_INTERFACE_MODE_RGMII ||
+		   interface == PHY_INTERFACE_MODE_RGMII_ID) {
+		switch (speed) {
+		case SPEED_1000:
+			ctrl |= priv->hw->link.speed1000;
+			emac_ctrl |= NEMACCTL_SP_SEL_RGMII_1000M;
+			break;
+		case SPEED_100:
+			ctrl |= priv->hw->link.speed100;
+			emac_ctrl |= NEMACCTL_SP_SEL_RGMII_100M;
+			break;
+		case SPEED_10:
+			ctrl |= priv->hw->link.speed10;
+			emac_ctrl |= NEMACCTL_SP_SEL_RGMII_10M;
+			break;
+		default:
+			return;
+		}
+		config_done = true;
+	} else {
+		switch (speed) {
+		case SPEED_2500:
+			ctrl |= priv->hw->link.speed2500;
+			break;
+		case SPEED_1000:
+			ctrl |= priv->hw->link.speed1000;
+			break;
+		case SPEED_100:
+			ctrl |= priv->hw->link.speed100;
+			break;
+		case SPEED_10:
+			ctrl |= priv->hw->link.speed10;
+			break;
+		default:
+			return;
+		}
+		config_done = true;
+	}
+	priv->speed = speed;
+
+#ifdef TC956X_SRIOV_PF
+	priv->duplex = duplex;
+#endif
+
+	if (priv->plat->fix_mac_speed)
+		priv->plat->fix_mac_speed(priv->plat->bsp_priv, speed);
+
+	if (!duplex)
+		ctrl &= ~priv->hw->link.duplex;
+	else
+		ctrl |= priv->hw->link.duplex;
+
+	/* Flow Control operation */
+	if (rx_pause && tx_pause)
+		priv->flow_ctrl = FLOW_AUTO;
+	else if (rx_pause && !tx_pause)
+		priv->flow_ctrl = FLOW_RX;
+	else if (!rx_pause && tx_pause)
+		priv->flow_ctrl = FLOW_TX;
+	else
+		priv->flow_ctrl = FLOW_OFF;
+
+	tc956xmac_mac_flow_ctrl(priv, duplex);
+
+	if (config_done) {
+		writel(ctrl, priv->ioaddr + MAC_CTRL_REG);
+		writel(emac_ctrl, priv->ioaddr + NEMACCTL_OFFSET);
+	}
+
+	tc956xmac_mac_set(priv, priv->ioaddr, true);
+#endif
+#ifndef TC956X_SRIOV_VF
+	mutex_lock(&priv->port_ld_release_lock);
+	priv->port_release = false; /* setting port release to false as link-up invoked, and set to true from release or link down */
+	if (priv->port_link_down == true) {
+		tc956xmac_link_change_set_power(priv, LINK_UP); /* Restore, De-assert and Enable Reset and Clock */
+	}
+	mutex_unlock(&priv->port_ld_release_lock);
+#endif
+	tc956xmac_mac_set_rx(priv, priv->ioaddr, true);
+
+	/* In SRIOV code, EEE is handled by PF driver */
+#ifndef TC956X_SRIOV_VF
+#ifdef EEE
+	if (phy && priv->dma_cap.eee && priv->eee_enabled) {
+		DBGPR_FUNC(priv->device, "%s EEE Enable, checking to enable acive\n", __func__);
+#ifdef TC956X_5_G_2_5_G_EEE_SUPPORT
+		if (phy->speed == TC956X_PHY_SPEED_5G || phy->speed == TC956X_PHY_SPEED_2_5G) {
+			priv->eee_active = tc956x_phy_init_eee(phy, 1) >= 0;
+		} else {
+#ifndef DEBUG_EEE
+			priv->eee_active = phy_init_eee(phy, 1) >= 0;
+#else
+			priv->eee_active = phy_init_eee_local(phy, 1) >= 0;
+#endif
+		}
+#else
+#ifndef DEBUG_EEE
+		priv->eee_active = phy_init_eee(phy, 1) >= 0;
+#else
+		priv->eee_active = phy_init_eee_local(phy, 1) >= 0;
+#endif
+#endif
+		if (priv->eee_active) {
+			tc956xmac_eee_init(priv);
+			tc956xmac_set_eee_pls(priv, priv->hw, true);
+		}
+	}
+#endif
+	/* Send Link parameters to all VFs */
+	priv->link = true;
+#endif
+	DBGPR_FUNC(priv->device, "%s priv->eee_enabled: %d priv->eee_active: %d\n", __func__, priv->eee_enabled, priv->eee_active);
+	clear_bit(TC956XMAC_DOWN, &priv->link_state);
+
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_DYNAMIC_LOAD_CBS
+	if (prev_speed != priv->speed)
+	{
+		tc956xmac_set_cbs_speed(priv);
+	}
+	prev_speed = priv->speed;
+#endif
+	tc956x_mbx_wrap_phy_link(priv);
+#endif
+#ifdef TC956X_PM_DEBUG
+	pm_generic_resume(priv->device);
+#endif
+}
+
+static const struct phylink_mac_ops tc956xmac_phylink_mac_ops = {
+	.validate = tc956xmac_validate,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
+	.mac_pcs_get_state = tc956xmac_mac_pcs_get_state,
+#endif
+#else	/* Required when using with Kernel v5.4 */
+	.mac_link_state = tc956xmac_mac_link_state,
+#endif
+	.mac_config = tc956xmac_mac_config,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
+	.mac_an_restart = tc956xmac_mac_an_restart,
+#endif
+	.mac_link_down = tc956xmac_mac_link_down,
+	.mac_link_up = tc956xmac_mac_link_up,
+};
+#endif  /* TC956X_SRIOV_VF */
+#ifndef TC956X_SRIOV_VF
+/**
+ * tc956xmac_check_pcs_mode - verify if RGMII/SGMII is supported
+ * @priv: driver private structure
+ * Description: this is to verify if the HW supports the PCS.
+ * Physical Coding Sublayer (PCS) interface that can be used when the MAC is
+ * configured for the TBI, RTBI, or SGMII PHY interface.
+ */
+static void tc956xmac_check_pcs_mode(struct tc956xmac_priv *priv)
+{
+	int interface = priv->plat->interface;
+
+	if (priv->dma_cap.pcs) {
+		if ((interface == PHY_INTERFACE_MODE_RGMII) ||
+		    (interface == PHY_INTERFACE_MODE_RGMII_ID) ||
+		    (interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
+		    (interface == PHY_INTERFACE_MODE_RGMII_TXID)) {
+			netdev_dbg(priv->dev, "PCS RGMII support enabled\n");
+#ifdef TC956X
+			priv->hw->pcs = 0;
+#else
+			priv->hw->pcs = TC956XMAC_PCS_RGMII;
+#endif
+		} else if (interface == PHY_INTERFACE_MODE_SGMII) {
+			netdev_dbg(priv->dev, "PCS SGMII support enabled\n");
+#ifdef TC956X
+			priv->hw->pcs = TC956XMAC_PCS_SGMII;
+#endif
+		} else if ((interface == PHY_INTERFACE_MODE_USXGMII) ||
+			  (interface == PHY_INTERFACE_MODE_10GKR)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+			  || (interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+			  ) {
+			netdev_dbg(priv->dev, "PCS USXGMII/XFI support enabled\n");
+#ifdef TC956X
+			priv->hw->pcs = TC956XMAC_PCS_USXGMII;
+#endif
+		}
+	}
+#ifdef TC956X
+	priv->hw->pcs = 0;
+	if (interface == PHY_INTERFACE_MODE_RGMII ||
+		interface == PHY_INTERFACE_MODE_RGMII_ID) {
+		priv->hw->xpcs = 0;
+	} else if (interface == PHY_INTERFACE_MODE_SGMII) {
+		netdev_dbg(priv->dev, "PCS SGMII support enabled\n");
+		priv->hw->xpcs = TC956XMAC_PCS_SGMII;
+	} else if ((interface == PHY_INTERFACE_MODE_USXGMII) ||
+		  (interface == PHY_INTERFACE_MODE_10GKR)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+		  || (interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+		  ) {
+		netdev_dbg(priv->dev, "PCS USXGMII support enabled\n");
+		priv->hw->xpcs = TC956XMAC_PCS_USXGMII;
+	}
+#endif
+}
+
+/**
+ * tc956xmac_defer_phy_isr_work - Scheduled by the PHY Ext Interrupt from ISR Handler
+ *  @work: work_struct
+ */
+static void tc956xmac_defer_phy_isr_work(struct work_struct *work)
+{
+	struct phy_device *phydev = NULL;
+	int rd_val = 0;
+	struct tc956xmac_priv *priv =
+		container_of(work, struct tc956xmac_priv, emac_phy_work);
+	int addr = priv->plat->phy_addr;
+
+	DBGPR_FUNC(priv->device, "Entry: tc956xmac_defer_phy_isr_work\n");
+
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	phydev = mdiobus_get_phy(priv->mii, addr);
+#endif
+
+	if (!phydev) {
+		netdev_err(priv->dev, "no phy at addr %d\n", addr);
+		return;
+	}
+
+	if (!phydev->drv) {
+		netdev_err(priv->dev, "no phy driver\n");
+		return;
+	}
+
+	/* Call ack interrupt to clear the WOL interrupt status fields */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+	if (phydev->drv->handle_interrupt)
+		phydev->drv->handle_interrupt(phydev);
+#else
+	if (phydev->drv->ack_interrupt)
+		phydev->drv->ack_interrupt(phydev);
+#endif
+	phy_mac_interrupt(phydev);
+
+	/* PHY MSI interrupt Enable */
+	rd_val = readl(priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->port_num, 0)); /* MSI_OUT_EN: Reading */
+	rd_val |= (1 << MSI_INT_EXT_PHY);
+	writel(rd_val, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->port_num, 0)); /* MSI_OUT_EN: Enable MAC Ext Interrupt */
+
+	DBGPR_FUNC(priv->device, "Exit: tc956xmac_defer_phy_isr_work\n");
+}
+
+/**
+ * tc956xmac_init_phy - PHY initialization
+ * @dev: net device structure
+ * Description: it initializes the driver's PHY state, and attaches the PHY
+ * to the mac driver.
+ *  Return value:
+ *  0 on success
+ */
+static int tc956xmac_init_phy(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct device_node *node;
+	int ret;
+	struct phy_device *phydev = NULL;
+	int addr = priv->plat->phy_addr;
+	struct ethtool_eee edata;
+
+	node = priv->plat->phylink_node;
+
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	phydev = mdiobus_get_phy(priv->mii, addr);
+#endif
+
+	if (!phydev) {
+		netdev_err(priv->dev, "no phy at addr %d\n", addr);
+		return -ENODEV;
+	}
+	if (phydev->drv != NULL) {
+		if (true == priv->plat->phy_interrupt_mode && (phydev->drv->config_intr)) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+			phydev->irq = PHY_MAC_INTERRUPT;
+#else
+			phydev->irq = PHY_IGNORE_INTERRUPT;
+#endif
+			KPRINT_INFO("PHY configured in interrupt mode\n");
+			DBGPR_FUNC(priv->device, "%s PHY configured in interrupt mode\n", __func__);
+
+			INIT_WORK(&priv->emac_phy_work, tc956xmac_defer_phy_isr_work);
+		} else {
+			phydev->irq = PHY_POLL;
+			DBGPR_FUNC(priv->device, "%s [1] PHY configured in polling mode\n", __func__);
+		}
+	} else {
+		phydev->irq = PHY_POLL;
+		phydev->interrupts =  PHY_INTERRUPT_DISABLED;
+		DBGPR_FUNC(priv->device, "%s [2] PHY configured in polling mode\n", __func__);
+	}
+	if (node)
+		ret = phylink_of_phy_connect(priv->phylink, node, 0);
+
+	/* Some DT bindings do not set-up the PHY handle. Let's try to
+	 * manually parse it
+	 */
+	if (!node || ret) {
+		if (!phydev || (!phydev->phy_id && !phydev->is_c45)) {
+			/* Try C45 */
+			phydev = get_phy_device(priv->mii, addr, true);
+			if (phydev && !IS_ERR(phydev)) {
+				ret = phy_device_register(phydev);
+				if (ret) {
+					phy_device_free(phydev);
+					phydev = NULL;
+				}
+			} else {
+				phydev = NULL;
+			}
+		}
+
+		if (!phydev) {
+			netdev_err(priv->dev, "no phy at addr %d\n", addr);
+			return -ENODEV;
+		}
+
+		ret = phylink_connect_phy(priv->phylink, phydev);
+
+		phy_attached_info(phydev);
+	}
+
+	if (phydev->drv != NULL) {
+		if (true == priv->plat->phy_interrupt_mode && (phydev->drv->config_intr))
+			phydev->interrupts =  PHY_INTERRUPT_ENABLED;
+		else
+			phydev->interrupts =  PHY_INTERRUPT_DISABLED;
+	}
+
+	if (phydev->interrupts ==  PHY_INTERRUPT_ENABLED) {
+		if (!(phydev->drv->config_intr &&
+			!phydev->drv->config_intr(phydev))) {
+			KPRINT_ERR("Failed to configure PHY interrupt port number is %d %s", priv->port_num, dev->name);
+		}
+	}
+	/* Enable or disable EEE Advertisement based on eee_enabled settings which might be set using module param */
+	edata.eee_enabled = priv->eee_enabled;
+	edata.advertised = 0;
+
+	if (priv->phylink) {
+		if (priv->plat->interface != PHY_INTERFACE_MODE_RGMII &&
+			priv->plat->interface != PHY_INTERFACE_MODE_RGMII_ID) {
+			netdev_info(priv->dev, "Ethtool EEE Setting\n");
+			phylink_ethtool_set_eee(priv->phylink, &edata);
+#ifdef TC956X_5_G_2_5_G_EEE_SUPPORT
+			/* Enable EEE for 2.5G and 5G speeds, when driver is loaded with EEE ON module param. */
+			netdev_info(priv->dev, "Ethtool EEE Setting for 5G/2.5G\n");
+			ret |= phy_ethtool_set_eee_2p5(phydev, &edata);
+#endif
+		}
+	}
+	/* In forced speed mode, donot return error here */
+	if (((priv->port_num == RM_PF1_ID) && (mac1_force_speed_mode == ENABLE)) ||
+		((priv->port_num == RM_PF0_ID) && (mac0_force_speed_mode == ENABLE)))
+		ret = 0;
+
+	return ret;
+}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)
+static void tc956xmac_phylink_fixed_state(struct phylink_config *config, struct phylink_link_state *state)
+#else
+static void tc956xmac_phylink_fixed_state(struct net_device *dev, struct phylink_link_state *state)
+#endif
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)
+	struct net_device *dev = to_net_dev(config->dev);
+#endif
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	state->link = 1;
+	state->duplex = DUPLEX_FULL;
+	state->speed = priv->plat->forced_speed;
+
+	DBGPR_FUNC(priv->device, "%s state->speed: %d\n", __func__, state->speed);
+
+	return;
+}
+
+static int tc956xmac_phy_setup(struct tc956xmac_priv *priv)
+{
+	struct fwnode_handle *fwnode = of_fwnode_handle(priv->plat->phylink_node);
+	int mode = priv->plat->phy_interface;
+	struct phylink *phylink;
+
+	priv->phylink_config.dev = &priv->dev->dev;
+	priv->phylink_config.type = PHYLINK_NETDEV;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 16, 0)
+	/* Set the platform/firmware specified interface mode */
+	__set_bit(mode, priv->phylink_config.supported_interfaces);
+
+	/*If SGMII interface, add 2500BASEX also in supported interface as in some PHY,
+	* 2500Base-X and SGMII are used interchangeably
+	*/
+	if (mode == PHY_INTERFACE_MODE_SGMII)
+		__set_bit(PHY_INTERFACE_MODE_2500BASEX,  priv->phylink_config.supported_interfaces);
+
+#endif
+
+	phylink = phylink_create(&priv->phylink_config, fwnode,
+				 mode, &tc956xmac_phylink_mac_ops);
+	if (IS_ERR(phylink))
+		return PTR_ERR(phylink);
+
+	/* Fixed phy mode should be set using device tree, driver just registers callback here */
+	if (((priv->port_num == RM_PF1_ID) && (mac1_force_speed_mode == ENABLE)) ||
+		((priv->port_num == RM_PF0_ID) && (mac0_force_speed_mode == ENABLE)))
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)
+		priv->phylink_config.get_fixed_state = tc956xmac_phylink_fixed_state;
+#else
+		phylink_fixed_state_cb(phylink, tc956xmac_phylink_fixed_state);
+#endif
+	priv->phylink = phylink;
+	return 0;
+}
+#endif /*#ifdef TC956X_SRIOV_VF*/
+static void tc956xmac_display_rx_rings(struct tc956xmac_priv *priv)
+{
+	u32 rx_cnt = priv->plat->rx_queues_to_use;
+	void *head_rx;
+	u32 queue;
+
+	/* Display RX rings */
+	for (queue = 0; queue < rx_cnt; queue++) {
+		struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		pr_info("\tRX Queue %u rings\n", queue);
+
+		if (priv->extend_desc)
+			head_rx = (void *)rx_q->dma_erx;
+		else
+			head_rx = (void *)rx_q->dma_rx;
+
+		/* Display RX ring */
+		tc956xmac_display_ring(priv, head_rx, DMA_RX_SIZE, true);
+	}
+}
+
+static void tc956xmac_display_tx_rings(struct tc956xmac_priv *priv)
+{
+	u32 tx_cnt = priv->plat->tx_queues_to_use;
+	void *head_tx;
+	u32 queue;
+
+	/* Display TX rings */
+	for (queue = 0; queue < tx_cnt; queue++) {
+		struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		pr_info("\tTX Queue %d rings\n", queue);
+
+		if (priv->extend_desc)
+			head_tx = (void *)tx_q->dma_etx;
+		else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			head_tx = (void *)tx_q->dma_entx;
+		else
+			head_tx = (void *)tx_q->dma_tx;
+
+		tc956xmac_display_ring(priv, head_tx, DMA_TX_SIZE, false);
+	}
+}
+
+static void tc956xmac_display_rings(struct tc956xmac_priv *priv)
+{
+	/* Display RX ring */
+	tc956xmac_display_rx_rings(priv);
+
+	/* Display TX ring */
+	tc956xmac_display_tx_rings(priv);
+}
+
+static int tc956xmac_set_bfsize(int mtu, int bufsize)
+{
+	int ret = bufsize;
+
+	if (mtu >= BUF_SIZE_8KiB)
+		ret = BUF_SIZE_16KiB;
+	else if (mtu >= BUF_SIZE_4KiB)
+		ret = BUF_SIZE_8KiB;
+	else if (mtu >= BUF_SIZE_2KiB)
+		ret = BUF_SIZE_4KiB;
+	else if (mtu > DEFAULT_BUFSIZE)
+		ret = BUF_SIZE_2KiB;
+	else
+		ret = DEFAULT_BUFSIZE;
+
+	return ret;
+}
+
+/**
+ * tc956xmac_clear_rx_descriptors - clear RX descriptors
+ * @priv: driver private structure
+ * @queue: RX queue index
+ * Description: this function is called to clear the RX descriptors
+ * in case of both basic and extended descriptors are used.
+ */
+static void tc956xmac_clear_rx_descriptors(struct tc956xmac_priv *priv, u32 queue)
+{
+	struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+	int i;
+
+	/* Clear the RX descriptors */
+	for (i = 0; i < DMA_RX_SIZE; i++)
+		if (priv->extend_desc)
+			tc956xmac_init_rx_desc(priv, &rx_q->dma_erx[i].basic,
+					priv->use_riwt, priv->mode,
+					(i == DMA_RX_SIZE - 1),
+					priv->dma_buf_sz);
+		else
+			tc956xmac_init_rx_desc(priv, &rx_q->dma_rx[i],
+					priv->use_riwt, priv->mode,
+					(i == DMA_RX_SIZE - 1),
+					priv->dma_buf_sz);
+}
+
+/**
+ * tc956xmac_clear_tx_descriptors - clear tx descriptors
+ * @priv: driver private structure
+ * @queue: TX queue index.
+ * Description: this function is called to clear the TX descriptors
+ * in case of both basic and extended descriptors are used.
+ */
+static void tc956xmac_clear_tx_descriptors(struct tc956xmac_priv *priv, u32 queue)
+{
+	struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+	int i;
+
+	/* Clear the TX descriptors */
+	for (i = 0; i < DMA_TX_SIZE; i++) {
+		int last = (i == (DMA_TX_SIZE - 1));
+		struct dma_desc *p;
+
+		if (priv->extend_desc)
+			p = &tx_q->dma_etx[i].basic;
+		else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			p = &tx_q->dma_entx[i].basic;
+		else
+			p = &tx_q->dma_tx[i];
+
+		tc956xmac_init_tx_desc(priv, p, priv->mode, last);
+	}
+}
+
+/**
+ * tc956xmac_clear_descriptors - clear descriptors
+ * @priv: driver private structure
+ * Description: this function is called to clear the TX and RX descriptors
+ * in case of both basic and extended descriptors are used.
+ */
+static void tc956xmac_clear_descriptors(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X
+	u32 rx_queue_cnt = priv->plat->rx_queues_to_use;
+#endif
+
+	u32 tx_queue_cnt = priv->plat->tx_queues_to_use;
+	u32 queue;
+
+	/* Clear the RX descriptors */
+	for (queue = 0; queue < rx_queue_cnt; queue++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tc956xmac_clear_rx_descriptors(priv, queue);
+	}
+
+	/* Clear the TX descriptors */
+	for (queue = 0; queue < tx_queue_cnt; queue++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tc956xmac_clear_tx_descriptors(priv, queue);
+	}
+}
+
+/**
+ * tc956xmac_init_rx_buffers - init the RX descriptor buffer.
+ * @priv: driver private structure
+ * @p: descriptor pointer
+ * @i: descriptor index
+ * @flags: gfp flag
+ * @queue: RX queue index
+ * Description: this function is called to allocate a receive buffer, perform
+ * the DMA mapping and init the descriptor.
+ */
+static int tc956xmac_init_rx_buffers(struct tc956xmac_priv *priv, struct dma_desc *p,
+				  int i, gfp_t flags, u32 queue)
+{
+	struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+	struct tc956xmac_rx_buffer *buf = &rx_q->buf_pool[i];
+
+	buf->page = page_pool_dev_alloc_pages(rx_q->page_pool);
+	if (!buf->page)
+		return -ENOMEM;
+
+	if (priv->sph) {
+		buf->sec_page = page_pool_dev_alloc_pages(rx_q->page_pool);
+		if (!buf->sec_page)
+			return -ENOMEM;
+
+		buf->sec_addr = page_pool_get_dma_addr(buf->sec_page);
+		tc956xmac_set_desc_sec_addr(priv, p, buf->sec_addr);
+	} else {
+		buf->sec_page = NULL;
+	}
+
+	buf->addr = page_pool_get_dma_addr(buf->page);
+	tc956xmac_set_desc_addr(priv, p, buf->addr);
+	if (priv->dma_buf_sz == BUF_SIZE_16KiB)
+		tc956xmac_init_desc3(priv, p);
+
+	return 0;
+}
+
+/**
+ * tc956xmac_free_rx_buffer - free RX dma buffers
+ * @priv: private structure
+ * @queue: RX queue index
+ * @i: buffer index.
+ */
+static void tc956xmac_free_rx_buffer(struct tc956xmac_priv *priv, u32 queue, int i)
+{
+	struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+	struct tc956xmac_rx_buffer *buf = &rx_q->buf_pool[i];
+
+	if (buf->page)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
+		page_pool_put_full_page(rx_q->page_pool, buf->page, false);
+#else
+		page_pool_put_page(rx_q->page_pool, buf->page, false);
+#endif
+	buf->page = NULL;
+
+	if (buf->sec_page)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
+		page_pool_put_full_page(rx_q->page_pool, buf->sec_page, false);
+#else
+		page_pool_put_page(rx_q->page_pool, buf->sec_page, false);
+#endif
+	buf->sec_page = NULL;
+}
+
+/**
+ * tc956xmac_free_tx_buffer - free RX dma buffers
+ * @priv: private structure
+ * @queue: RX queue index
+ * @i: buffer index.
+ */
+static void tc956xmac_free_tx_buffer(struct tc956xmac_priv *priv, u32 queue, int i)
+{
+	struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+
+	if (tx_q->tx_skbuff_dma) {
+		if (tx_q->tx_skbuff_dma[i].buf) {
+			if (tx_q->tx_skbuff_dma[i].map_as_page)
+				dma_unmap_page(priv->device,
+					       tx_q->tx_skbuff_dma[i].buf,
+					       tx_q->tx_skbuff_dma[i].len,
+					       DMA_TO_DEVICE);
+			else
+				dma_unmap_single(priv->device,
+						 tx_q->tx_skbuff_dma[i].buf,
+						 tx_q->tx_skbuff_dma[i].len,
+						 DMA_TO_DEVICE);
+		}
+	}
+
+	if (tx_q->tx_skbuff) {
+		if (tx_q->tx_skbuff[i]) {
+			dev_kfree_skb_any(tx_q->tx_skbuff[i]);
+			tx_q->tx_skbuff[i] = NULL;
+			tx_q->tx_skbuff_dma[i].buf = 0;
+			tx_q->tx_skbuff_dma[i].map_as_page = false;
+		}
+	}
+}
+
+/**
+ * init_dma_rx_desc_rings - init the RX descriptor rings
+ * @dev: net device structure
+ * @flags: gfp flag.
+ * Description: this function initializes the DMA RX descriptors
+ * and allocates the socket buffers. It supports the chained and ring
+ * modes.
+ */
+static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#ifdef TC956X
+	u32 rx_count = priv->plat->rx_queues_to_use;
+#endif
+
+	int ret = -ENOMEM;
+	int queue;
+	int i;
+
+	/* RX INITIALIZATION */
+	netif_dbg(priv, probe, priv->dev,
+		  "SKB addresses:\nskb\t\tskb data\tdma data\n");
+
+	for (queue = 0; queue < rx_count; queue++) {
+		struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		netif_dbg(priv, probe, priv->dev,
+			  "(%s) dma_rx_phy=0x%08x\n", __func__,
+			  (u32)rx_q->dma_rx_phy);
+
+		tc956xmac_clear_rx_descriptors(priv, queue);
+
+		for (i = 0; i < DMA_RX_SIZE; i++) {
+			struct dma_desc *p;
+
+			if (priv->extend_desc)
+				p = &((rx_q->dma_erx + i)->basic);
+			else
+				p = rx_q->dma_rx + i;
+
+			ret = tc956xmac_init_rx_buffers(priv, p, i, flags,
+						     queue);
+			if (ret)
+				goto err_init_rx_buffers;
+		}
+
+		rx_q->cur_rx = 0;
+		rx_q->dirty_rx = (unsigned int)(i - DMA_RX_SIZE);
+
+		/* Setup the chained descriptor addresses */
+		if (priv->mode == TC956XMAC_CHAIN_MODE) {
+			if (priv->extend_desc)
+				tc956xmac_mode_init(priv, rx_q->dma_erx,
+						rx_q->dma_rx_phy, DMA_RX_SIZE, 1);
+			else
+				tc956xmac_mode_init(priv, rx_q->dma_rx,
+						rx_q->dma_rx_phy, DMA_RX_SIZE, 0);
+		}
+	}
+
+	return 0;
+
+err_init_rx_buffers:
+	while (queue >= 0) {
+#ifdef TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0) {
+			i = DMA_RX_SIZE;
+			queue--;
+			continue;
+		}
+#endif
+		while (--i >= 0)
+			tc956xmac_free_rx_buffer(priv, queue, i);
+
+		if (queue == 0)
+			break;
+
+		i = DMA_RX_SIZE;
+		queue--;
+	}
+
+	return ret;
+}
+
+/**
+ * init_dma_tx_desc_rings - init the TX descriptor rings
+ * @dev: net device structure.
+ * Description: this function initializes the DMA TX descriptors
+ * and allocates the socket buffers. It supports the chained and ring
+ * modes.
+ */
+static int init_dma_tx_desc_rings(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	u32 tx_queue_cnt = priv->plat->tx_queues_to_use;
+	u32 queue;
+	int i;
+
+	for (queue = 0; queue < tx_queue_cnt; queue++) {
+		struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		/* skip configuring for unallocated channel */
+		if (priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		netif_dbg(priv, probe, priv->dev,
+			  "(%s) dma_tx_phy=0x%08x\n", __func__,
+			 (u32)tx_q->dma_tx_phy);
+
+		/* Setup the chained descriptor addresses */
+		if (priv->mode == TC956XMAC_CHAIN_MODE) {
+			if (priv->extend_desc)
+				tc956xmac_mode_init(priv, tx_q->dma_etx,
+						tx_q->dma_tx_phy, DMA_TX_SIZE, 1);
+			else if (!(tx_q->tbs & TC956XMAC_TBS_AVAIL))
+				tc956xmac_mode_init(priv, tx_q->dma_tx,
+						tx_q->dma_tx_phy, DMA_TX_SIZE, 0);
+		}
+
+		for (i = 0; i < DMA_TX_SIZE; i++) {
+			struct dma_desc *p;
+
+			if (priv->extend_desc)
+				p = &((tx_q->dma_etx + i)->basic);
+			else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+				p = &((tx_q->dma_entx + i)->basic);
+			else
+				p = tx_q->dma_tx + i;
+
+			tc956xmac_clear_desc(priv, p);
+
+			tx_q->tx_skbuff_dma[i].buf = 0;
+			tx_q->tx_skbuff_dma[i].map_as_page = false;
+			tx_q->tx_skbuff_dma[i].len = 0;
+			tx_q->tx_skbuff_dma[i].last_segment = false;
+			tx_q->tx_skbuff[i] = NULL;
+		}
+
+		tx_q->dirty_tx = 0;
+		tx_q->cur_tx = 0;
+		tx_q->mss = 0;
+
+		netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue));
+	}
+
+	return 0;
+}
+
+/**
+ * init_dma_desc_rings - init the RX/TX descriptor rings
+ * @dev: net device structure
+ * @flags: gfp flag.
+ * Description: this function initializes the DMA RX/TX descriptors
+ * and allocates the socket buffers. It supports the chained and ring
+ * modes.
+ */
+static int init_dma_desc_rings(struct net_device *dev, gfp_t flags)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	int ret;
+
+	ret = init_dma_rx_desc_rings(dev, flags);
+	if (ret)
+		return ret;
+
+	ret = init_dma_tx_desc_rings(dev);
+
+	tc956xmac_clear_descriptors(priv);
+
+	if (netif_msg_hw(priv))
+		tc956xmac_display_rings(priv);
+
+	return ret;
+}
+
+/**
+ * dma_free_rx_skbufs - free RX dma buffers
+ * @priv: private structure
+ * @queue: RX queue index
+ */
+static void dma_free_rx_skbufs(struct tc956xmac_priv *priv, u32 queue)
+{
+	int i;
+
+	for (i = 0; i < DMA_RX_SIZE; i++)
+		tc956xmac_free_rx_buffer(priv, queue, i);
+}
+
+/**
+ * dma_free_tx_skbufs - free TX dma buffers
+ * @priv: private structure
+ * @queue: TX queue index
+ */
+static void dma_free_tx_skbufs(struct tc956xmac_priv *priv, u32 queue)
+{
+	int i;
+
+	for (i = 0; i < DMA_TX_SIZE; i++)
+		tc956xmac_free_tx_buffer(priv, queue, i);
+}
+
+/**
+ * free_dma_rx_desc_resources - free RX dma desc resources
+ * @priv: private structure
+ */
+static void free_dma_rx_desc_resources(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X
+	u32 rx_count = priv->plat->rx_queues_to_use;
+#endif
+
+	u32 queue;
+
+	/* Free RX queue resources */
+	for (queue = 0; queue < rx_count; queue++) {
+		struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		/* Release the DMA RX socket buffers */
+		dma_free_rx_skbufs(priv, queue);
+
+		/* Free DMA regions of consistent memory previously allocated */
+		if (!priv->extend_desc)
+			dma_free_coherent(priv->device,
+					  DMA_RX_SIZE * sizeof(struct dma_desc),
+					  rx_q->dma_rx, rx_q->dma_rx_phy);
+		else
+			dma_free_coherent(priv->device, DMA_RX_SIZE *
+					  sizeof(struct dma_extended_desc),
+					  rx_q->dma_erx, rx_q->dma_rx_phy);
+
+		kfree(rx_q->buf_pool);
+		if (rx_q->page_pool)
+			page_pool_destroy(rx_q->page_pool);
+	}
+}
+
+/**
+ * free_dma_tx_desc_resources - free TX dma desc resources
+ * @priv: private structure
+ */
+static void free_dma_tx_desc_resources(struct tc956xmac_priv *priv)
+{
+	u32 tx_count = priv->plat->tx_queues_to_use;
+	u32 queue;
+
+	/* Free TX queue resources */
+	for (queue = 0; queue < tx_count; queue++) {
+		struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+		size_t size;
+		void *addr;
+
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		/* Release the DMA TX socket buffers */
+		dma_free_tx_skbufs(priv, queue);
+
+		if (priv->extend_desc) {
+			size = sizeof(struct dma_extended_desc);
+			addr = tx_q->dma_etx;
+		} else if (tx_q->tbs & TC956XMAC_TBS_AVAIL) {
+			size = sizeof(struct dma_edesc);
+			addr = tx_q->dma_entx;
+		} else {
+			size = sizeof(struct dma_desc);
+			addr = tx_q->dma_tx;
+		}
+
+		size *= DMA_TX_SIZE;
+
+		dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy);
+
+		kfree(tx_q->tx_skbuff_dma);
+		tx_q->tx_skbuff_dma = NULL;
+
+		kfree(tx_q->tx_skbuff);
+		tx_q->tx_skbuff = NULL;
+
+	}
+}
+
+/**
+ * alloc_dma_rx_desc_resources - alloc RX resources.
+ * @priv: private structure
+ * Description: according to which descriptor can be used (extend or basic)
+ * this function allocates the resources for TX and RX paths. In case of
+ * reception, for example, it pre-allocated the RX socket buffer in order to
+ * allow zero-copy mechanism.
+ */
+static int alloc_dma_rx_desc_resources(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X
+	u32 rx_count = priv->plat->rx_queues_to_use;
+#endif
+
+	int ret = -ENOMEM;
+	u32 queue;
+
+	/* RX queues buffers and DMA */
+	for (queue = 0; queue < rx_count; queue++) {
+		struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+		struct page_pool_params pp_params = { 0 };
+		unsigned int num_pages;
+
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		/* Create Rx DMA resources for Host owned channels only */
+		if (priv->plat->rx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		rx_q->queue_index = queue;
+		rx_q->priv_data = priv;
+
+		pp_params.flags = PP_FLAG_DMA_MAP;
+		pp_params.pool_size = DMA_RX_SIZE;
+		num_pages = DIV_ROUND_UP(priv->dma_buf_sz, PAGE_SIZE);
+		pp_params.order = ilog2(num_pages);
+		pp_params.nid = dev_to_node(priv->device);
+		pp_params.dev = priv->device;
+		pp_params.dma_dir = DMA_FROM_DEVICE;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0)
+		pp_params.offset = 0;
+		pp_params.max_len = TC956X_MAX_RX_BUF_SIZE(num_pages);
+#endif
+		rx_q->page_pool = page_pool_create(&pp_params);
+		if (IS_ERR(rx_q->page_pool)) {
+			ret = PTR_ERR(rx_q->page_pool);
+			rx_q->page_pool = NULL;
+			goto err_dma;
+		}
+
+		rx_q->buf_pool = kcalloc(DMA_RX_SIZE, sizeof(*rx_q->buf_pool),
+					 GFP_KERNEL);
+		if (!rx_q->buf_pool)
+			goto err_dma;
+
+		if (priv->extend_desc) {
+			rx_q->dma_erx = dma_alloc_coherent(priv->device,
+							   DMA_RX_SIZE * sizeof(struct dma_extended_desc),
+							   &rx_q->dma_rx_phy,
+							   GFP_KERNEL);
+			if (!rx_q->dma_erx)
+				goto err_dma;
+
+		} else {
+			rx_q->dma_rx = dma_alloc_coherent(priv->device,
+							  DMA_RX_SIZE * sizeof(struct dma_desc),
+							  &rx_q->dma_rx_phy,
+							  GFP_KERNEL);
+			if (!rx_q->dma_rx)
+				goto err_dma;
+		}
+	}
+
+	return 0;
+
+err_dma:
+	free_dma_rx_desc_resources(priv);
+
+	return ret;
+}
+
+/**
+ * alloc_dma_tx_desc_resources - alloc TX resources.
+ * @priv: private structure
+ * Description: according to which descriptor can be used (extend or basic)
+ * this function allocates the resources for TX and RX paths. In case of
+ * reception, for example, it pre-allocated the RX socket buffer in order to
+ * allow zero-copy mechanism.
+ */
+static int alloc_dma_tx_desc_resources(struct tc956xmac_priv *priv)
+{
+	u32 tx_count = priv->plat->tx_queues_to_use;
+	int ret = -ENOMEM;
+	u32 queue;
+
+	/* TX queues buffers and DMA */
+	for (queue = 0; queue < tx_count; queue++) {
+		struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+		size_t size;
+		void *addr;
+
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[queue] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tx_q->queue_index = queue;
+		tx_q->priv_data = priv;
+
+		tx_q->tx_skbuff_dma = kcalloc(DMA_TX_SIZE,
+					      sizeof(*tx_q->tx_skbuff_dma),
+					      GFP_KERNEL);
+		if (!tx_q->tx_skbuff_dma)
+			goto err_dma;
+
+		tx_q->tx_skbuff = kcalloc(DMA_TX_SIZE,
+					  sizeof(struct sk_buff *),
+					  GFP_KERNEL);
+		if (!tx_q->tx_skbuff)
+			goto err_dma;
+
+		if (priv->extend_desc)
+			size = sizeof(struct dma_extended_desc);
+		else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			size = sizeof(struct dma_edesc);
+		else
+			size = sizeof(struct dma_desc);
+
+		size *= DMA_TX_SIZE;
+
+		addr = dma_alloc_coherent(priv->device, size,
+					  &tx_q->dma_tx_phy, GFP_KERNEL);
+		if (!addr)
+			goto err_dma;
+
+		if (priv->extend_desc)
+			tx_q->dma_etx = addr;
+		else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			tx_q->dma_entx = addr;
+		else
+			tx_q->dma_tx = addr;
+	}
+
+	return 0;
+
+err_dma:
+	free_dma_tx_desc_resources(priv);
+	return ret;
+}
+
+/**
+ * alloc_dma_desc_resources - alloc TX/RX resources.
+ * @priv: private structure
+ * Description: according to which descriptor can be used (extend or basic)
+ * this function allocates the resources for TX and RX paths. In case of
+ * reception, for example, it pre-allocated the RX socket buffer in order to
+ * allow zero-copy mechanism.
+ */
+static int alloc_dma_desc_resources(struct tc956xmac_priv *priv)
+{
+	/* RX Allocation */
+	int ret = alloc_dma_rx_desc_resources(priv);
+
+	if (ret)
+		return ret;
+
+	ret = alloc_dma_tx_desc_resources(priv);
+
+	return ret;
+}
+
+/**
+ * free_dma_desc_resources - free dma desc resources
+ * @priv: private structure
+ */
+static void free_dma_desc_resources(struct tc956xmac_priv *priv)
+{
+	/* Release the DMA RX socket buffers */
+	free_dma_rx_desc_resources(priv);
+
+	/* Release the DMA TX socket buffers */
+	free_dma_tx_desc_resources(priv);
+}
+
+#ifndef TC956X_SRIOV_VF
+/**
+ *  tc956xmac_mac_enable_rx_queues - Enable MAC rx queues
+ *  @priv: driver private structure
+ *  Description: It is used for enabling the rx queues in the MAC
+ */
+static void tc956xmac_mac_enable_rx_queues(struct tc956xmac_priv *priv)
+{
+	u32 rx_queues_count = priv->plat->rx_queues_to_use;
+	int queue;
+	u8 mode;
+
+	for (queue = 0; queue < rx_queues_count; queue++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_q_in_use[queue] == TC956X_DISABLE_QUEUE)
+			continue;
+#endif
+		mode = priv->plat->rx_queues_cfg[queue].mode_to_use;
+		tc956xmac_rx_queue_enable(priv, priv->hw, mode, queue);
+	}
+}
+#endif /* TC956X_SRIOV_VF */
+/**
+ * tc956xmac_start_rx_dma - start RX DMA channel
+ * @priv: driver private structure
+ * @chan: RX channel index
+ * Description:
+ * This starts a RX DMA channel
+ */
+static void tc956xmac_start_rx_dma(struct tc956xmac_priv *priv, u32 chan)
+{
+	netdev_dbg(priv->dev, "DMA RX processes started in channel %d\n", chan);
+	tc956xmac_start_rx(priv, priv->ioaddr, chan);
+}
+
+/**
+ * tc956xmac_start_tx_dma - start TX DMA channel
+ * @priv: driver private structure
+ * @chan: TX channel index
+ * Description:
+ * This starts a TX DMA channel
+ */
+static void tc956xmac_start_tx_dma(struct tc956xmac_priv *priv, u32 chan)
+{
+	netdev_dbg(priv->dev, "DMA TX processes started in channel %d\n", chan);
+	tc956xmac_start_tx(priv, priv->ioaddr, chan);
+}
+
+/**
+ * tc956xmac_stop_rx_dma - stop RX DMA channel
+ * @priv: driver private structure
+ * @chan: RX channel index
+ * Description:
+ * This stops a RX DMA channel
+ */
+static void tc956xmac_stop_rx_dma(struct tc956xmac_priv *priv, u32 chan)
+{
+	netdev_dbg(priv->dev, "DMA RX processes stopped in channel %d\n", chan);
+	tc956xmac_stop_rx(priv, priv->ioaddr, chan);
+}
+
+/**
+ * tc956xmac_stop_tx_dma - stop TX DMA channel
+ * @priv: driver private structure
+ * @chan: TX channel index
+ * Description:
+ * This stops a TX DMA channel
+ */
+static void tc956xmac_stop_tx_dma(struct tc956xmac_priv *priv, u32 chan)
+{
+	netdev_dbg(priv->dev, "DMA TX processes stopped in channel %d\n", chan);
+	tc956xmac_stop_tx(priv, priv->ioaddr, chan);
+}
+
+/**
+ * tc956xmac_start_all_dma - start all RX and TX DMA channels
+ * @priv: driver private structure
+ * Description:
+ * This starts all the RX and TX DMA channels
+ */
+static void tc956xmac_start_all_dma(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X
+	u32 rx_channels_count = priv->plat->rx_queues_to_use;
+#endif
+
+	u32 tx_channels_count = priv->plat->tx_queues_to_use;
+	u32 chan = 0;
+
+	for (chan = 0; chan < rx_channels_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[chan] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tc956xmac_start_rx_dma(priv, chan);
+	}
+
+	for (chan = 0; chan < tx_channels_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[chan] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tc956xmac_start_tx_dma(priv, chan);
+	}
+}
+
+/**
+ * tc956xmac_stop_all_dma - stop all RX and TX DMA channels
+ * @priv: driver private structure
+ * Description:
+ * This stops the RX and TX DMA channels
+ */
+static void tc956xmac_stop_all_dma(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X
+	u32 rx_channels_count = priv->plat->rx_queues_to_use;
+#endif
+
+	u32 tx_channels_count = priv->plat->tx_queues_to_use;
+	u32 chan = 0;
+
+	for (chan = 0; chan < rx_channels_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[chan] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tc956xmac_stop_rx_dma(priv, chan);
+	}
+
+	for (chan = 0; chan < tx_channels_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[chan] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tc956xmac_stop_tx_dma(priv, chan);
+	}
+}
+
+/**
+ *  tc956xmac_dma_operation_mode - HW DMA operation mode
+ *  @priv: driver private structure
+ *  Description: it is used for configuring the DMA operation mode register in
+ *  order to program the tx/rx DMA thresholds or Store-And-Forward mode.
+ */
+static void tc956xmac_dma_operation_mode(struct tc956xmac_priv *priv)
+{
+	u32 rx_channels_count = priv->plat->rx_queues_to_use;
+	u32 tx_channels_count = priv->plat->tx_queues_to_use;
+	int rxfifosz = priv->plat->rx_fifo_size;
+	int txfifosz = priv->plat->tx_fifo_size;
+	u32 txmode = 0;
+	u32 rxmode = 0;
+	u32 chan = 0;
+	u8 qmode = 0;
+
+	if (rxfifosz == 0)
+		rxfifosz = priv->dma_cap.rx_fifo_size;
+	if (txfifosz == 0)
+		txfifosz = priv->dma_cap.tx_fifo_size;
+
+	/* Adjust for real per queue fifo size */
+	rxfifosz /= rx_channels_count;
+	txfifosz /= tx_channels_count;
+
+	if (priv->plat->force_thresh_dma_mode) {
+		txmode = tc;
+		rxmode = tc;
+	} else if (priv->plat->force_sf_dma_mode || priv->plat->tx_coe) {
+		/*
+		 * In case of GMAC, SF mode can be enabled
+		 * to perform the TX COE in HW. This depends on:
+		 * 1) TX COE if actually supported
+		 * 2) There is no bugged Jumbo frame support
+		 *    that needs to not insert csum in the TDES.
+		 */
+		txmode = SF_DMA_MODE;
+		rxmode = SF_DMA_MODE;
+		priv->xstats.threshold = SF_DMA_MODE;
+	} else {
+		txmode = tc;
+		rxmode = SF_DMA_MODE;
+	}
+
+#ifndef TC956X_SRIOV_VF
+	/* configure all channels */
+	for (chan = 0; chan < rx_channels_count; chan++) {
+#ifdef TC956X
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_q_in_use[chan] == TC956X_DISABLE_QUEUE)
+			continue;
+#endif
+		switch (chan) {
+		case 0:
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_CPE_CONFIG)
+			rxfifosz = priv->plat->rx_queues_cfg[0].size;
+#else
+			rxfifosz = RX_QUEUE0_SIZE;
+#endif
+			break;
+		case 1:
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_CPE_CONFIG)
+			rxfifosz = priv->plat->rx_queues_cfg[1].size;
+#else
+			rxfifosz = RX_QUEUE1_SIZE;
+#endif
+			break;
+		case 2:
+			rxfifosz = RX_QUEUE2_SIZE;
+			break;
+		case 3:
+			rxfifosz = RX_QUEUE3_SIZE;
+			break;
+		case 4:
+			rxfifosz = RX_QUEUE4_SIZE;
+			break;
+		case 5:
+			rxfifosz = RX_QUEUE5_SIZE;
+			break;
+		case 6:
+			rxfifosz = RX_QUEUE6_SIZE;
+			break;
+		case 7:
+			rxfifosz = RX_QUEUE7_SIZE;
+			break;
+		default:
+			rxfifosz = RX_QUEUE0_SIZE;
+			break;
+		}
+#endif
+
+		qmode = priv->plat->rx_queues_cfg[chan].mode_to_use;
+
+		tc956xmac_dma_rx_mode(priv, priv->ioaddr, rxmode, chan,
+				rxfifosz, qmode);
+	}
+#endif
+
+	for (chan = 0; chan < rx_channels_count; chan++) {
+#ifdef TC956X
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+	/* configure only size in DMA register for the
+	 * channels used by VF, other channels skip
+	 */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[chan] == USE_IN_TC956X_SW)
+#endif
+			tc956xmac_set_dma_bfsize(priv, priv->ioaddr, priv->dma_buf_sz,
+						chan);
+#endif
+	}
+
+
+	for (chan = 0; chan < tx_channels_count; chan++) {
+#ifdef TC956X
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_q_in_use[chan] == TC956X_DISABLE_QUEUE)
+			continue;
+
+		switch (chan) {
+		case 0:
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_CPE_CONFIG)
+			txfifosz = priv->plat->tx_queues_cfg[0].size;
+#else
+			txfifosz = TX_QUEUE0_SIZE;
+#endif
+			break;
+		case 1:
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_CPE_CONFIG)
+			txfifosz = priv->plat->tx_queues_cfg[1].size;
+#else
+			txfifosz = TX_QUEUE1_SIZE;
+#endif
+			break;
+		case 2:
+			txfifosz = TX_QUEUE2_SIZE;
+			break;
+		case 3:
+			txfifosz = TX_QUEUE3_SIZE;
+			break;
+		case 4:
+			txfifosz = TX_QUEUE4_SIZE;
+			break;
+		case 5:
+			txfifosz = TX_QUEUE5_SIZE;
+			break;
+		case 6:
+			txfifosz = TX_QUEUE6_SIZE;
+			break;
+		case 7:
+			txfifosz = TX_QUEUE7_SIZE;
+			break;
+		default:
+			txfifosz = TX_QUEUE0_SIZE;
+			break;
+		}
+#elif defined TC956X_SRIOV_VF
+		/* configure only size in DMA register for the
+		 * channels used by VF, other channels skip
+		 */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+
+		txfifosz = priv->plat->tx_q_size[chan];
+#endif	/* TC956X_SRIOV_VF */
+#endif
+
+		qmode = priv->plat->tx_queues_cfg[chan].mode_to_use;
+
+		/* Use mailbox to set tx mode */
+#ifdef TC956X_SRIOV_PF
+		tc956xmac_dma_tx_mode(priv, priv->ioaddr, txmode, chan,
+				txfifosz, qmode);
+#elif defined TC956X_SRIOV_VF
+		tc956xmac_dma_tx_mode(priv, txmode, chan,
+				txfifosz, qmode);
+#endif
+
+	}
+}
+
+/**
+ * tc956xmac_tx_clean - to manage the transmission completion
+ * @priv: driver private structure
+ * @queue: TX queue index
+ * Description: it reclaims the transmit resources after transmission completes.
+ */
+static int tc956xmac_tx_clean(struct tc956xmac_priv *priv, int budget, u32 queue)
+{
+	struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+	unsigned int bytes_compl = 0, pkts_compl = 0;
+	unsigned int entry, count = 0;
+
+	__netif_tx_lock_bh(netdev_get_tx_queue(priv->dev, queue));
+
+	priv->xstats.tx_clean[queue]++;
+
+	entry = tx_q->dirty_tx;
+	while ((entry != tx_q->cur_tx) && (count < budget)) {
+		struct sk_buff *skb = tx_q->tx_skbuff[entry];
+		struct dma_desc *p;
+		int status;
+
+		if (priv->extend_desc)
+			p = (struct dma_desc *)(tx_q->dma_etx + entry);
+		else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			p = &tx_q->dma_entx[entry].basic;
+		else
+			p = tx_q->dma_tx + entry;
+
+		status = tc956xmac_tx_status(priv, &priv->dev->stats,
+				&priv->xstats, p, priv->ioaddr);
+		/* Check if the descriptor is owned by the DMA */
+		if (unlikely(status & tx_dma_own))
+			break;
+
+		count++;
+
+		/* Make sure descriptor fields are read after reading
+		 * the own bit.
+		 */
+		dma_rmb();
+
+		/* Just consider the last segment and ...*/
+		if (likely(!(status & tx_not_ls))) {
+			/* ... verify the status error condition */
+			if (unlikely(status & tx_err)) {
+				priv->dev->stats.tx_errors++;
+				priv->xstats.tx_pkt_errors_n[queue]++;
+			} else {
+				priv->dev->stats.tx_packets++;
+				priv->xstats.tx_pkt_n[queue]++;
+			}
+#if defined(TX_LOGGING_TRACE)
+			if (queue != skb_get_queue_mapping(skb))
+				pr_err("Tx Queue no. is different\n");
+#endif
+			tc956xmac_get_tx_hwtstamp(priv, p, skb);
+		}
+
+		if (likely(tx_q->tx_skbuff_dma[entry].buf)) {
+			if (tx_q->tx_skbuff_dma[entry].map_as_page)
+				dma_unmap_page(priv->device,
+					       tx_q->tx_skbuff_dma[entry].buf,
+					       tx_q->tx_skbuff_dma[entry].len,
+					       DMA_TO_DEVICE);
+			else
+				dma_unmap_single(priv->device,
+						 tx_q->tx_skbuff_dma[entry].buf,
+						 tx_q->tx_skbuff_dma[entry].len,
+						 DMA_TO_DEVICE);
+			tx_q->tx_skbuff_dma[entry].buf = 0;
+			tx_q->tx_skbuff_dma[entry].len = 0;
+			tx_q->tx_skbuff_dma[entry].map_as_page = false;
+		}
+
+		tc956xmac_clean_desc3(priv, tx_q, p);
+
+		tx_q->tx_skbuff_dma[entry].last_segment = false;
+		tx_q->tx_skbuff_dma[entry].is_jumbo = false;
+
+		if (likely(skb != NULL)) {
+			pkts_compl++;
+			bytes_compl += skb->len;
+			dev_consume_skb_any(skb);
+			tx_q->tx_skbuff[entry] = NULL;
+		}
+
+		tc956xmac_release_tx_desc(priv, p, priv->mode);
+
+		entry = TC956XMAC_GET_ENTRY(entry, DMA_TX_SIZE);
+	}
+	tx_q->dirty_tx = entry;
+
+	netdev_tx_completed_queue(netdev_get_tx_queue(priv->dev, queue),
+				  pkts_compl, bytes_compl);
+
+	if (unlikely(netif_tx_queue_stopped(netdev_get_tx_queue(priv->dev, queue))) &&
+	    tc956xmac_tx_avail(priv, queue) > TC956XMAC_TX_THRESH) {
+
+		netif_dbg(priv, tx_done, priv->dev,
+			  "%s: restart transmit\n", __func__);
+		netif_tx_wake_queue(netdev_get_tx_queue(priv->dev, queue));
+	}
+#ifdef ENABLE_TX_TIMER
+	/* We still have pending packets, let's call for a new scheduling */
+	if (tx_q->dirty_tx != tx_q->cur_tx) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+		hrtimer_start(&tx_q->txtimer,
+			TC956XMAC_COAL_TIMER(priv->tx_coal_timer[queue]), HRTIMER_MODE_REL);
+#else
+		mod_timer(&tx_q->txtimer, TC956XMAC_COAL_TIMER(priv->tx_coal_timer));
+#endif
+	}
+#endif
+	__netif_tx_unlock_bh(netdev_get_tx_queue(priv->dev, queue));
+
+	return count;
+}
+
+/**
+ * tc956xmac_tx_err - to manage the tx error
+ * @priv: driver private structure
+ * @chan: channel index
+ * Description: it cleans the descriptors and restarts the transmission
+ * in case of transmission errors.
+ */
+static void tc956xmac_tx_err(struct tc956xmac_priv *priv, u32 chan)
+{
+	struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[chan];
+
+	netif_tx_stop_queue(netdev_get_tx_queue(priv->dev, chan));
+
+	tc956xmac_stop_tx_dma(priv, chan);
+	dma_free_tx_skbufs(priv, chan);
+	tc956xmac_clear_tx_descriptors(priv, chan);
+	tx_q->dirty_tx = 0;
+	tx_q->cur_tx = 0;
+	tx_q->mss = 0;
+	netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, chan));
+	tc956xmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+			    tx_q->dma_tx_phy, chan);
+	tc956xmac_start_tx_dma(priv, chan);
+
+	priv->dev->stats.tx_errors++;
+	netif_tx_wake_queue(netdev_get_tx_queue(priv->dev, chan));
+}
+
+#ifndef TC956X_SRIOV_VF
+/**
+ *  tc956xmac_set_dma_operation_mode - Set DMA operation mode by channel
+ *  @priv: driver private structure
+ *  @txmode: TX operating mode
+ *  @rxmode: RX operating mode
+ *  @chan: channel index
+ *  Description: it is used for configuring of the DMA operation mode in
+ *  runtime in order to program the tx/rx DMA thresholds or Store-And-Forward
+ *  mode.
+ */
+static void tc956xmac_set_dma_operation_mode(struct tc956xmac_priv *priv, u32 txmode,
+					  u32 rxmode, u32 chan)
+{
+	u8 rxqmode = priv->plat->rx_queues_cfg[chan].mode_to_use;
+	u8 txqmode = priv->plat->tx_queues_cfg[chan].mode_to_use;
+	u32 rx_channels_count = priv->plat->rx_queues_to_use;
+	u32 tx_channels_count = priv->plat->tx_queues_to_use;
+	int rxfifosz = priv->plat->rx_fifo_size;
+	int txfifosz = priv->plat->tx_fifo_size;
+
+	if (rxfifosz == 0)
+		rxfifosz = priv->dma_cap.rx_fifo_size;
+	if (txfifosz == 0)
+		txfifosz = priv->dma_cap.tx_fifo_size;
+
+	/* Adjust for real per queue fifo size */
+	rxfifosz /= rx_channels_count;
+	txfifosz /= tx_channels_count;
+
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+	switch (chan) {
+	case 0:
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_CPE_CONFIG)
+		rxfifosz = priv->plat->rx_queues_cfg[0].size;
+		txfifosz = priv->plat->tx_queues_cfg[0].size;
+#else
+		rxfifosz = RX_QUEUE0_SIZE;
+		txfifosz = TX_QUEUE0_SIZE;
+#endif
+		break;
+	case 1:
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_CPE_CONFIG)
+		rxfifosz = priv->plat->rx_queues_cfg[1].size;
+		txfifosz = priv->plat->tx_queues_cfg[1].size;
+#else
+		rxfifosz = RX_QUEUE1_SIZE;
+		txfifosz = TX_QUEUE1_SIZE;
+#endif
+		break;
+	case 2:
+		rxfifosz = RX_QUEUE2_SIZE;
+		txfifosz = TX_QUEUE2_SIZE;
+		break;
+	case 3:
+		rxfifosz = RX_QUEUE3_SIZE;
+		txfifosz = TX_QUEUE3_SIZE;
+		break;
+	case 4:
+		rxfifosz = RX_QUEUE4_SIZE;
+		txfifosz = TX_QUEUE4_SIZE;
+		break;
+	case 5:
+		rxfifosz = RX_QUEUE5_SIZE;
+		txfifosz = TX_QUEUE5_SIZE;
+		break;
+	case 6:
+		rxfifosz = RX_QUEUE6_SIZE;
+		txfifosz = TX_QUEUE6_SIZE;
+		break;
+	case 7:
+		rxfifosz = RX_QUEUE7_SIZE;
+		txfifosz = TX_QUEUE7_SIZE;
+		break;
+	default:
+		rxfifosz = RX_QUEUE0_SIZE;
+		txfifosz = TX_QUEUE0_SIZE;
+		break;
+	}
+#endif
+
+	tc956xmac_dma_rx_mode(priv, priv->ioaddr, rxmode, chan, rxfifosz, rxqmode);
+#endif /* TC956X_SRIOV_VF */
+
+	/* Use mailbox to set tx mode */
+#ifndef TC956X_SRIOV_VF
+	tc956xmac_dma_tx_mode(priv, priv->ioaddr, txmode, chan, txfifosz, txqmode);
+#elif (defined TC956X_SRIOV_VF)
+	tc956xmac_dma_tx_mode(priv, priv, txmode, chan, txfifosz, txqmode);
+#endif
+}
+#endif /*#ifdef TC956X_SRIOV_VF*/
+
+#ifndef TC956X_SRIOV_VF
+static bool tc956xmac_safety_feat_interrupt(struct tc956xmac_priv *priv)
+{
+	int ret;
+
+	ret = tc956xmac_safety_feat_irq_status(priv, priv->dev,
+			priv->ioaddr, priv->dma_cap.asp, &priv->sstats);
+	if (ret && (ret != -EINVAL)) {
+		tc956xmac_global_err(priv);
+		return true;
+	}
+
+	return false;
+}
+#endif
+
+static int tc956xmac_napi_check(struct tc956xmac_priv *priv, u32 chan)
+{
+	int status = tc956xmac_dma_interrupt_status(priv, priv->ioaddr,
+						 &priv->xstats, chan);
+	struct tc956xmac_channel *ch = &priv->channel[chan];
+	unsigned long flags;
+
+#ifdef TC956X
+#ifdef TC956X_SRIOV_PF
+	if ((status & handle_rx) && (chan < priv->plat->rx_queues_to_use) && (priv->plat->rx_ch_in_use[chan] == TC956X_ENABLE_CHNL)) {
+#elif defined TC956X_SRIOV_VF
+	if ((status & handle_rx) && (chan < priv->plat->rx_queues_to_use) &&
+					(priv->plat->ch_in_use[chan] == 1)) {
+#else
+	if ((status & handle_rx) && (chan < priv->plat->rx_queues_to_use) &&
+		(priv->plat->rx_dma_ch_owner[chan] == USE_IN_TC956X_SW)) {
+#endif
+#endif
+
+		if (napi_schedule_prep(&ch->rx_napi)) {
+			spin_lock_irqsave(&ch->lock, flags);
+			tc956xmac_disable_dma_irq(priv, priv->ioaddr, chan, 1, 0);
+			spin_unlock_irqrestore(&ch->lock, flags);
+			__napi_schedule_irqoff(&ch->rx_napi);
+		}
+	}
+
+#ifdef TC956X_SRIOV_PF
+	if ((status & handle_tx) && (chan < priv->plat->tx_queues_to_use) && (priv->plat->tx_ch_in_use[chan] == TC956X_ENABLE_CHNL)) {
+#elif defined TC956X_SRIOV_VF
+	if ((status & handle_tx) && (chan < priv->plat->tx_queues_to_use) &&
+					(priv->plat->ch_in_use[chan] == 1)) {
+#else
+	if ((status & handle_tx) && (chan < priv->plat->tx_queues_to_use) &&
+		(priv->plat->tx_dma_ch_owner[chan] == USE_IN_TC956X_SW)) {
+#endif
+#ifdef TX_COMPLETION_WITHOUT_TIMERS
+		writel(0, priv->tc956x_SRAM_pci_base_addr
+				+ TX_TIMER_SRAM_OFFSET(priv->port_num));
+
+#endif
+		if (napi_schedule_prep(&ch->tx_napi)) {
+			spin_lock_irqsave(&ch->lock, flags);
+			tc956xmac_disable_dma_irq(priv, priv->ioaddr, chan, 0, 1);
+			spin_unlock_irqrestore(&ch->lock, flags);
+			__napi_schedule_irqoff(&ch->tx_napi);
+		}
+	}
+
+	return status;
+}
+
+/**
+ * tc956xmac_dma_interrupt - DMA ISR
+ * @priv: driver private structure
+ * Description: this is the DMA ISR. It is called by the main ISR.
+ * It calls the dwmac dma routine and schedule poll method in case of some
+ * work can be done.
+ */
+static void tc956xmac_dma_interrupt(struct tc956xmac_priv *priv)
+{
+	u32 tx_channel_count = priv->plat->tx_queues_to_use;
+
+#ifdef TC956X
+	u32 rx_channel_count = priv->plat->rx_queues_to_use;
+#endif
+	u32 channels_to_check = tx_channel_count > rx_channel_count ?
+				tx_channel_count : rx_channel_count;
+	u32 chan;
+	int status[max_t(u32, MTL_MAX_TX_QUEUES, MTL_MAX_RX_QUEUES)];
+
+	/* Make sure we never check beyond our status buffer. */
+	if (WARN_ON_ONCE(channels_to_check > ARRAY_SIZE(status)))
+		channels_to_check = ARRAY_SIZE(status);
+
+	for (chan = 0; chan < channels_to_check; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if ((priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL) && (priv->plat->rx_ch_in_use[chan] == TC956X_DISABLE_CHNL))
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#endif
+		status[chan] = tc956xmac_napi_check(priv, chan);
+	}
+
+	for (chan = 0; chan < tx_channel_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#endif
+		if (unlikely(status[chan] & tx_hard_error_bump_tc)) {
+			/* Try to bump up the dma threshold on this failure */
+			if (unlikely(priv->xstats.threshold != SF_DMA_MODE) &&
+			    (tc <= 256)) {
+				tc += 64;
+
+				// Note: Threshold mode is not used as per configuration. And setting of Rx DMA operation mode will be
+				// tricky as Rx queue is shared among more than on VF, this operation may affect other VF/PF
+				// So as of now this code is not used in VF driver
+#ifndef TC956X_SRIOV_VF
+				if (priv->plat->force_thresh_dma_mode)
+					tc956xmac_set_dma_operation_mode(priv,
+								      tc,
+								      tc,
+								      chan);
+				else
+					tc956xmac_set_dma_operation_mode(priv,
+								    tc,
+								    SF_DMA_MODE,
+								    chan);
+#endif
+				priv->xstats.threshold = tc;
+			}
+		} else if (unlikely(status[chan] == tx_hard_error)) {
+			tc956xmac_tx_err(priv, chan);
+		}
+	}
+}
+
+/**
+ * tc956xmac_mmc_setup: setup the Mac Management Counters (MMC)
+ * @priv: driver private structure
+ * Description: this masks the MMC irq, in fact, the counters are managed in SW.
+ */
+static void tc956xmac_mmc_setup(struct tc956xmac_priv *priv)
+{
+#ifndef TC956X_SRIOV_VF //CPE_DRV
+	unsigned int mode = MMC_CNTRL_RESET_ON_READ | MMC_CNTRL_COUNTER_RESET |
+			    MMC_CNTRL_PRESET | MMC_CNTRL_FULL_HALF_PRESET;
+
+	tc956xmac_mmc_intr_all_mask(priv, priv->mmcaddr);
+
+	if (priv->dma_cap.rmon) {
+		tc956xmac_mmc_ctrl(priv, priv->mmcaddr, mode);
+		memset(&priv->mmc, 0, sizeof(struct tc956xmac_counters));
+	} else
+		netdev_info(priv->dev, "No MAC Management Counters available\n");
+#else
+	memset(&priv->sw_stats, 0, sizeof(struct tc956x_sw_counters));
+#endif
+}
+
+/**
+ * tc956xmac_get_hw_features - get MAC capabilities from the HW cap. register.
+ * @priv: driver private structure
+ * Description:
+ *  new GMAC chip generations have a new register to indicate the
+ *  presence of the optional feature/functions.
+ *  This can be also used to override the value passed through the
+ *  platform and necessary for old MAC10/100 and GMAC chips.
+ */
+static int tc956xmac_get_hw_features(struct tc956xmac_priv *priv)
+{
+	return tc956xmac_get_hw_feature(priv, priv->ioaddr, &priv->dma_cap) == 0;
+}
+
+#ifdef TC956X_SRIOV_VF
+/**
+ * tc956xmac_check_ether_addr - check if the MAC addr is valid
+ * @priv: driver private structure
+ * Description:
+ * it is to verify if the MAC address is valid, in case of failures it
+ * generates a random MAC address
+ */
+static void tc956xmac_check_ether_addr(struct tc956xmac_priv *priv)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+	u8 addr[ETH_ALEN];
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+#ifndef TC956X_SRIOV_VF
+	if (!is_valid_ether_addr(priv->dev->dev_addr)) {
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+		spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+		tc956xmac_get_umac_addr(priv, priv->hw, addr, 0);
+#else
+		tc956xmac_get_umac_addr(priv, priv->hw, priv->dev->dev_addr, 0);
+#endif
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+		spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+		if (is_valid_ether_addr(addr))
+			eth_hw_addr_set(priv->dev, addr);
+		else
+#else
+		if (!is_valid_ether_addr(priv->dev->dev_addr))
+#endif
+			eth_hw_addr_random(priv->dev);
+		dev_info(priv->device, "device MAC address %pM\n",
+			 priv->dev->dev_addr);
+#ifndef TC956X_SRIOV_VF
+	}
+#endif
+}
+#endif
+
+/**
+ * tc956xmac_init_dma_engine - DMA init.
+ * @priv: driver private structure
+ * Description:
+ * It inits the DMA invoking the specific MAC/GMAC callback.
+ * Some DMA parameters can be passed from the platform;
+ * in case of these are not passed a default is kept for the MAC or GMAC.
+ */
+static int tc956xmac_init_dma_engine(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X
+	u32 rx_channels_count = priv->plat->rx_queues_to_use;
+#endif
+
+	u32 tx_channels_count = priv->plat->tx_queues_to_use;
+	u32 dma_csr_ch = max(rx_channels_count, tx_channels_count);
+	struct tc956xmac_rx_queue *rx_q;
+	struct tc956xmac_tx_queue *tx_q;
+	u32 chan = 0;
+	int atds = 0;
+	int ret = 0;
+
+	if (!priv->plat->dma_cfg || !priv->plat->dma_cfg->txpbl ||
+	    !priv->plat->dma_cfg->rxpbl) {
+		dev_err(priv->device, "Invalid DMA configuration\n");
+		return -EINVAL;
+	}
+
+	if (priv->extend_desc && (priv->mode == TC956XMAC_RING_MODE))
+		atds = 1;
+
+#ifndef TC956X_SRIOV_VF
+	ret = tc956xmac_reset(priv, priv->ioaddr);
+	if (ret) {
+		dev_err(priv->device, "Failed to reset the dma\n");
+		return ret;
+	}
+
+	/* DMA Configuration */
+	tc956xmac_dma_init(priv, priv->ioaddr, priv->plat->dma_cfg, atds);
+
+	if (priv->plat->axi)
+		tc956xmac_axi(priv, priv->ioaddr, priv->plat->axi);
+#endif
+
+	/* DMA CSR Channel configuration */
+	for (chan = 0; chan < dma_csr_ch; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if ((priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL) &&
+		(priv->plat->rx_ch_in_use[chan] == TC956X_DISABLE_CHNL))
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#endif
+		tc956xmac_init_chan(priv, priv->ioaddr, priv->plat->dma_cfg, chan);
+	}
+
+	/* DMA RX Channel Configuration */
+	for (chan = 0; chan < rx_channels_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[chan] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		rx_q = &priv->rx_queue[chan];
+
+		tc956xmac_init_rx_chan(priv, priv->ioaddr, priv->plat->dma_cfg, rx_q->dma_rx_phy, chan);
+
+		rx_q->rx_tail_addr = rx_q->dma_rx_phy +
+			    (DMA_RX_SIZE * sizeof(struct dma_desc));
+		tc956xmac_set_rx_tail_ptr(priv, priv->ioaddr, rx_q->rx_tail_addr, chan);
+	}
+
+	/* DMA TX Channel Configuration */
+	for (chan = 0; chan < tx_channels_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[chan] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tx_q = &priv->tx_queue[chan];
+
+		tc956xmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg,
+				    tx_q->dma_tx_phy, chan);
+
+		tx_q->tx_tail_addr = tx_q->dma_tx_phy;
+		tc956xmac_set_tx_tail_ptr(priv, priv->ioaddr,
+				       tx_q->tx_tail_addr, chan);
+	}
+
+	return ret;
+}
+
+#ifdef ENABLE_TX_TIMER
+static void tc956xmac_tx_timer_arm(struct tc956xmac_priv *priv, u32 queue)
+{
+	struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+	hrtimer_start(&tx_q->txtimer,
+		TC956XMAC_COAL_TIMER(priv->tx_coal_timer[queue]), HRTIMER_MODE_REL);
+#else
+	mod_timer(&tx_q->txtimer, TC956XMAC_COAL_TIMER(priv->tx_coal_timer));
+#endif
+}
+
+/**
+ * tc956xmac_tx_timer - mitigation sw timer for tx.
+ * @data: data pointer
+ * Description:
+ * This is the timer handler to directly invoke the tc956xmac_tx_clean.
+ */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+static enum hrtimer_restart tc956xmac_tx_timer(struct hrtimer *t)
+#else
+static void tc956xmac_tx_timer(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+	struct tc956xmac_tx_queue *tx_q = container_of(t, struct tc956xmac_tx_queue, txtimer);
+#else
+	struct tc956xmac_tx_queue *tx_q = from_timer(tx_q, t, txtimer);
+#endif
+	struct tc956xmac_priv *priv = tx_q->priv_data;
+	struct tc956xmac_channel *ch;
+
+	ch = &priv->channel[tx_q->queue_index];
+
+#ifdef TC956X_SRIOV_PF
+	if (priv->plat->tx_ch_in_use[tx_q->queue_index] == TC956X_DISABLE_CHNL)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+		return HRTIMER_NORESTART;
+#else
+		return;
+#endif
+#elif defined TC956X_SRIOV_VF
+	if (priv->plat->ch_in_use[tx_q->queue_index] == 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+		return HRTIMER_NORESTART;
+#else
+		return;
+#endif
+#else
+	if (priv->plat->tx_dma_ch_owner[tx_q->queue_index] != USE_IN_TC956X_SW)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+		return HRTIMER_NORESTART;
+#else
+		return;
+#endif
+#endif
+	/*
+	 * If NAPI is already running we can miss some events. Let's rearm
+	 * the timer and try again.
+	 */
+	if (likely(napi_schedule_prep(&ch->tx_napi))) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&ch->lock, flags);
+		tc956xmac_disable_dma_irq(priv, priv->ioaddr, ch->index, 0, 1);
+		spin_unlock_irqrestore(&ch->lock, flags);
+		__napi_schedule(&ch->tx_napi);
+	}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+		return HRTIMER_NORESTART;
+#else
+		return;
+#endif
+}
+
+#endif
+
+/**
+ * tc956xmac_init_coalesce - init mitigation options.
+ * @priv: driver private structure
+ * Description:
+ * This inits the coalesce parameters: i.e. timer rate,
+ * timer handler and default threshold used for enabling the
+ * interrupt on completion bit.
+ */
+static void tc956xmac_init_coalesce(struct tc956xmac_priv *priv)
+{
+
+	u32 tx_channel_count = priv->plat->tx_queues_to_use;
+	u32 chan;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+	u32 rx_channel_count = priv->plat->rx_queues_to_use;
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 13, 0)
+	if (priv->port_num == RM_PF0_ID)
+		priv->tx_coal_frames = mac0_tx_interrupt_num;
+
+	if (priv->port_num == RM_PF1_ID)
+		priv->tx_coal_frames = mac1_tx_interrupt_num;
+	priv->tx_coal_timer = TC956XMAC_COAL_TX_TIMER;
+	priv->rx_coal_frames = TC956XMAC_RX_FRAMES;
+#else
+
+	for (chan = 0; chan < tx_channel_count; chan++) {
+
+		if (priv->port_num == RM_PF0_ID)
+			priv->tx_coal_frames[chan] = mac0_tx_interrupt_num;
+
+		if (priv->port_num == RM_PF1_ID)
+			priv->tx_coal_frames[chan] = mac1_tx_interrupt_num;
+		priv->tx_coal_timer[chan] = TC956XMAC_COAL_TX_TIMER;
+	}
+
+	for (chan = 0; chan < rx_channel_count; chan++) {
+		priv->rx_coal_frames[chan] = TC956XMAC_RX_FRAMES;
+	}
+#endif
+
+#ifdef ENABLE_TX_TIMER
+	for (chan = 0; chan < tx_channel_count; chan++) {
+		struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[chan];
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[chan] != USE_IN_TC956X_SW)
+			continue;
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+		hrtimer_init(&tx_q->txtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+		tx_q->txtimer.function = tc956xmac_tx_timer;
+#else
+		timer_setup(&tx_q->txtimer, tc956xmac_tx_timer, 0);
+#endif
+	}
+#endif
+}
+
+static void tc956xmac_set_rings_length(struct tc956xmac_priv *priv)
+{
+#ifdef TC956X
+	u32 rx_channels_count = priv->plat->rx_queues_to_use;
+#endif
+
+	u32 tx_channels_count = priv->plat->tx_queues_to_use;
+	u32 chan;
+
+	/* set TX ring length */
+	for (chan = 0; chan < tx_channels_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[chan] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tc956xmac_set_tx_ring_len(priv, priv->ioaddr,
+				(DMA_TX_SIZE - 1), chan);
+	}
+
+	/* set RX ring length */
+	for (chan = 0; chan < rx_channels_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[chan] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tc956xmac_set_rx_ring_len(priv, priv->ioaddr,
+				(DMA_RX_SIZE - 1), chan);
+	}
+}
+
+/**
+ *  tc956xmac_set_tx_queue_weight - Set TX queue weight
+ *  @priv: driver private structure
+ *  Description: It is used for setting TX queues weight
+ */
+static void tc956xmac_set_tx_queue_weight(struct tc956xmac_priv *priv)
+{
+	u32 tx_queues_count = priv->plat->tx_queues_to_use;
+	u32 weight;
+	u32 queue, traffic_class;
+
+	/* Set weights for Traffic class based on Queue enable state */
+
+	for (queue = 0; queue < tx_queues_count; queue++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_q_in_use[queue] == TC956X_DISABLE_QUEUE)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated queue */
+		if (priv->plat->tx_q_in_use[queue] == 0)
+			continue;
+#endif
+
+		traffic_class = priv->plat->tx_queues_cfg[queue].traffic_class;
+#ifdef TC956X_SRIOV_VF
+		/* TC0 related configuration is done in PF only */
+		if (traffic_class == TX_TC_ZERO)
+			continue;
+#endif
+		weight = priv->plat->tx_queues_cfg[queue].weight;
+
+		/* Use mailbox wrapper API to pass to PF for updation */
+#ifdef TC956X_SRIOV_PF
+		tc956xmac_set_mtl_tx_queue_weight(priv, priv->hw, weight, traffic_class);
+#elif (defined TC956X_SRIOV_VF)
+		tc956xmac_set_mtl_tx_queue_weight(priv, weight, traffic_class);
+#endif
+
+	}
+}
+
+/**
+ *  tc956xmac_configure_cbs - Configure CBS in TX queue
+ *  @priv: driver private structure
+ *  Description: It is used for configuring CBS in AVB TX queues
+ */
+static void tc956xmac_configure_cbs(struct tc956xmac_priv *priv)
+{
+	u32 tx_queues_count = priv->plat->tx_queues_to_use;
+	u32 mode_to_use;
+	u32 queue;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	/* queue 0 is reserved for legacy traffic */
+	for (queue = 1; queue < tx_queues_count; queue++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_q_in_use[queue] == TC956X_DISABLE_QUEUE)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated queue */
+		if (priv->plat->tx_q_in_use[queue] == 0)
+			continue;
+#endif
+		mode_to_use = priv->plat->tx_queues_cfg[queue].mode_to_use;
+		if (mode_to_use != MTL_QUEUE_AVB)
+			continue;
+
+/* Mailbox to be used for CBS configuration */
+#ifdef TC956X_SRIOV_PF
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.cbs, flags);
+#endif
+		tc956xmac_config_cbs(priv, priv->hw,
+				priv->plat->tx_queues_cfg[queue].send_slope,
+				priv->plat->tx_queues_cfg[queue].idle_slope,
+				priv->plat->tx_queues_cfg[queue].high_credit,
+				priv->plat->tx_queues_cfg[queue].low_credit,
+				queue);
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.cbs, flags);
+#endif
+#elif (defined TC956X_SRIOV_VF)
+		tc956xmac_config_cbs(priv,
+				priv->plat->tx_queues_cfg[queue].send_slope,
+				priv->plat->tx_queues_cfg[queue].idle_slope,
+				priv->plat->tx_queues_cfg[queue].high_credit,
+				priv->plat->tx_queues_cfg[queue].low_credit,
+				queue);
+#endif
+
+	}
+}
+
+#ifndef TC956X_SRIOV_VF
+/**
+ *  tc956xmac_rx_queue_dma_chan_map - Map RX queue to RX dma channel
+ *  @priv: driver private structure
+ *  Description: It is used for mapping RX queues to RX dma channels
+ */
+static void tc956xmac_rx_queue_dma_chan_map(struct tc956xmac_priv *priv)
+{
+	u32 rx_queues_count = priv->plat->rx_queues_to_use;
+	u32 queue;
+	u32 chan;
+
+	for (queue = 0; queue < rx_queues_count; queue++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_q_in_use[queue] == TC956X_DISABLE_QUEUE)
+			continue;
+#endif
+		/* Enable DA based Queue-Ch mapping for elabled Queues */
+		chan = priv->plat->rx_queues_cfg[queue].chan;
+		tc956xmac_map_mtl_to_dma(priv, priv->hw, queue, chan);
+	}
+}
+
+/**
+ *  tc956xmac_mac_config_rx_queues_prio - Configure RX Queue priority
+ *  @priv: driver private structure
+ *  Description: It is used for configuring the RX Queue Priority
+ */
+static void tc956xmac_mac_config_rx_queues_prio(struct tc956xmac_priv *priv)
+{
+	u32 rx_queues_count = priv->plat->rx_queues_to_use;
+	u32 queue;
+	u32 prio;
+
+	for (queue = 0; queue < rx_queues_count; queue++) {
+		if (!priv->plat->rx_queues_cfg[queue].use_prio)
+			continue;
+
+		prio = priv->plat->rx_queues_cfg[queue].prio;
+		tc956xmac_rx_queue_prio(priv, priv->hw, prio, queue);
+	}
+}
+#endif
+/**
+ *  tc956xmac_mac_config_tx_queues_prio - Configure TX Queue priority
+ *  @priv: driver private structure
+ *  Description: It is used for configuring the TX Queue Priority
+ */
+static void tc956xmac_mac_config_tx_queues_prio(struct tc956xmac_priv *priv)
+{
+	u32 tx_queues_count = priv->plat->tx_queues_to_use;
+	u32 queue;
+	u32 prio;
+	u32 traffic_class;
+
+	for (queue = 0; queue < tx_queues_count; queue++) {
+#ifdef TC956X_SRIOV_VF
+		/* skip configuring for unallocated queue */
+		if (priv->plat->tx_q_in_use[queue] == 0)
+			continue;
+#endif
+		if (!priv->plat->tx_queues_cfg[queue].use_prio)
+			continue;
+
+		prio = priv->plat->tx_queues_cfg[queue].prio;
+
+		traffic_class = priv->plat->tx_queues_cfg[queue].traffic_class;
+
+#ifdef TC956X_SRIOV_PF
+		tc956xmac_tx_queue_prio(priv, priv->hw, prio, traffic_class);
+#elif defined TC956X_SRIOV_VF
+		tc956xmac_tx_queue_prio(priv, prio, traffic_class);
+#else
+		tc956xmac_tx_queue_prio(priv, priv->hw, prio, queue);
+#endif
+	}
+}
+
+#ifndef TC956X_SRIOV_VF
+
+/**
+ *  tc956xmac_mac_config_rx_queues_routing - Configure RX Queue Routing
+ *  @priv: driver private structure
+ *  Description: It is used for configuring the RX queue routing
+ */
+static void tc956xmac_mac_config_rx_queues_routing(struct tc956xmac_priv *priv)
+{
+	u32 rx_queues_count = priv->plat->rx_queues_to_use;
+	u32 queue;
+	u8 packet;
+
+	for (queue = 0; queue < rx_queues_count; queue++) {
+		/* no specific packet type routing specified for the queue */
+		if (priv->plat->rx_queues_cfg[queue].pkt_route == 0x0)
+			continue;
+
+		packet = priv->plat->rx_queues_cfg[queue].pkt_route;
+		tc956xmac_rx_queue_routing(priv, priv->hw, packet, queue);
+	}
+}
+
+static void tc956xmac_mac_config_rss(struct tc956xmac_priv *priv)
+{
+	if (!priv->dma_cap.rssen || !priv->plat->rss_en) {
+		priv->rss.enable = false;
+		return;
+	}
+
+	if (priv->dev->features & NETIF_F_RXHASH)
+		priv->rss.enable = true;
+	else
+		priv->rss.enable = false;
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	tc956xmac_rss_configure(priv, priv->hw, &priv->rss,
+			     priv->plat->rx_queues_to_use);
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+}
+#endif /* TC956X_SRIOV_VF */
+/**
+ *  tc956xmac_mtl_configuration - Configure MTL
+ *  @priv: driver private structure
+ *  Description: It is used for configurring MTL
+ */
+static void tc956xmac_mtl_configuration(struct tc956xmac_priv *priv)
+{
+#ifndef TC956X_SRIOV_VF
+	u32 rx_queues_count = priv->plat->rx_queues_to_use;
+#endif
+	u32 tx_queues_count = priv->plat->tx_queues_to_use;
+
+	if (tx_queues_count > 1)
+		tc956xmac_set_tx_queue_weight(priv);
+
+#ifndef TC956X_SRIOV_VF
+	/* Configure MTL RX algorithms */
+	if (rx_queues_count > 1)
+		tc956xmac_prog_mtl_rx_algorithms(priv, priv->hw,
+				priv->plat->rx_sched_algorithm);
+
+	/* Configure MTL TX algorithms */
+	if (tx_queues_count > 1)
+		tc956xmac_prog_mtl_tx_algorithms(priv, priv->hw,
+				priv->plat->tx_sched_algorithm);
+#endif
+
+	/* Configure CBS in AVB TX queues */
+	if (tx_queues_count > 1)
+		tc956xmac_configure_cbs(priv);
+
+/* Some of Rx queue are shared among more than one VF (DMA channels),
+ * so Rx queue configuration will be done by PF commonly
+ */
+#ifndef TC956X_SRIOV_VF
+	/* Map RX MTL to DMA channels */
+	tc956xmac_rx_queue_dma_chan_map(priv);
+
+	/* Enable MAC RX Queues */
+	tc956xmac_mac_enable_rx_queues(priv);
+
+	/* Set RX priorities */
+	if (rx_queues_count > 1)
+		tc956xmac_mac_config_rx_queues_prio(priv);
+
+	/* Set TX priorities */
+	if (tx_queues_count > 1)
+		tc956xmac_mac_config_tx_queues_prio(priv);
+
+	/* Set RX routing */
+	if (rx_queues_count > 1)
+		tc956xmac_mac_config_rx_queues_routing(priv);
+
+	/* Receive Side Scaling */
+	if (rx_queues_count > 1)
+		tc956xmac_mac_config_rss(priv);
+#else
+	/* Set TX priorities */
+	if (tx_queues_count > 1)
+		tc956xmac_mac_config_tx_queues_prio(priv);
+#endif
+}
+
+#ifndef TC956X_SRIOV_VF
+
+static void tc956xmac_safety_feat_configuration(struct tc956xmac_priv *priv)
+{
+	if (priv->dma_cap.asp) {
+		netdev_info(priv->dev, "Enabling Safety Features\n");
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+		tc956xmac_safety_feat_config(priv, priv->ioaddr, priv->dma_cap.asp);
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	} else {
+		netdev_info(priv->dev, "No Safety Features support found\n");
+	}
+}
+
+/**
+ * tc956x_rx_crc_pad_config - Rx packets CRC and Padding configuration.
+ *
+ * @priv: pointer to private structure
+ * @crc_pad: CRC padding configuration
+ */
+static void tc956x_rx_crc_pad_config(struct tc956xmac_priv *priv, u32 crc_pad)
+{
+
+#ifdef TC956X
+	u32 value = readl(priv->ioaddr + XGMAC_RX_CONFIG);
+
+	if (crc_pad & XGMAC_CONFIG_CST)
+		value |= XGMAC_CONFIG_CST;
+	else
+		value &= ~XGMAC_CONFIG_CST;
+
+	if (crc_pad & XGMAC_CONFIG_ACS)
+		value |= XGMAC_CONFIG_ACS;
+	else
+		value &= ~XGMAC_CONFIG_ACS;
+
+	writel(value, priv->ioaddr + XGMAC_RX_CONFIG);
+#endif
+}
+#endif
+/**
+ * tc956xmac_hw_setup - setup mac in a usable state.
+ *  @dev : pointer to the device structure.
+ *  Description:
+ *  this is the main function to setup the HW in a usable state because the
+ *  dma engine is reset, the core registers are configured (e.g. AXI,
+ *  Checksum features, timers). The DMA is ready to start receiving and
+ *  transmitting.
+ *  Return value:
+ *  0 on success and an appropriate (-)ve integer as defined in errno.h
+ *  file on failure.
+ */
+static int tc956xmac_hw_setup(struct net_device *dev, bool init_ptp)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#ifdef TC956X
+	u32 rx_cnt = priv->plat->rx_queues_to_use;
+#ifndef TC956X_SRIOV_VF
+	bool enable_en = true;
+#endif
+#endif
+	u8 dev_addr[6] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+	u32 queue;
+#endif
+	u32 tx_cnt = priv->plat->tx_queues_to_use;
+	u32 chan;
+	int ret;
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	/* Back up MMC registers into internal SW MMC counters */
+	if (priv->link_down_rst == true)
+		tc956xmac_mmc_read(priv, priv->mmcaddr, &priv->mmc);
+
+	/* DMA initialization and SW reset */
+	ret = tc956xmac_init_dma_engine(priv);
+	if (ret < 0) {
+		netdev_err(priv->dev,
+		"%s: DMA engine initialization failed check availability of clock if supplied from external source/PHY\n",
+			   __func__);
+		return ret;
+	}
+
+#ifdef TC956X_SRIOV_PF
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+	/* Copy the MAC addr into the HW  */
+	tc956xmac_set_umac_addr(priv, priv->hw, (unsigned char *)dev->dev_addr, HOST_MAC_ADDR_OFFSET, PF_DRIVER);
+
+	/* Adding Broadcast address to offset 0 to divert Rx packet to PF Legacy Channel */
+	tc956xmac_set_umac_addr(priv, priv->hw, &dev_addr[0], HOST_BC_ADDR_OFFSET, PF_DRIVER);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+#elif defined TC956X_SRIOV_VF
+	ret = -EBUSY;
+	while (ret == -EBUSY)
+		ret = tc956xmac_set_umac_addr(priv, dev_addr, 0);
+	ret = -EBUSY;
+	while (ret == -EBUSY)
+		ret = tc956xmac_set_umac_addr(priv, dev->dev_addr, HOST_MAC_ADDR_OFFSET + priv->fn_id_info.vf_no);
+#endif
+
+#ifndef TC956X_SRIOV_VF /* No speed related and core init in VF */
+	/* PS and related bits will be programmed according to the speed */
+#ifdef TC956X
+	if (priv->hw->pcs || priv->hw->xpcs) {
+#else
+	if (priv->hw->pcs) {
+#endif
+		int speed = priv->plat->mac_port_sel_speed;
+
+		if ((speed == SPEED_10) || (speed == SPEED_100) ||
+		    (speed == SPEED_1000) || (speed == SPEED_2500) ||
+		    (speed == SPEED_10000)) {
+			priv->hw->ps = speed;
+		} else {
+			dev_warn(priv->device, "invalid port speed\n");
+			priv->hw->ps = 0;
+		}
+	}
+
+	/* Initialize the MAC Core */
+	tc956xmac_core_init(priv, priv->hw, dev);
+#endif
+#ifndef TC956X_SRIOV_VF
+	/* Enable Jumbo Frame Support */
+	tc956xmac_jumbo_en(priv, dev, TC956X_ENABLE);
+
+#ifdef TC956X_SRIOV_PF
+	/* Update driver cap to let VF know about feature enable/disable */
+	priv->pf_drv_cap.jumbo_en = true;
+#elif (defined TC956X_SRIOV_VF)
+	/* Check if Jumbo frames Initialized in PF */
+	if (priv->pf_drv_cap.jumbo_en)
+		NMSGPR_INFO(priv->device, "Jumbo Frames supported\n");
+#endif
+#endif
+	/* Initialize MTL*/
+	tc956xmac_mtl_configuration(priv);
+
+	/* Safety feature not supported aswell not configured by VF*/
+#ifndef TC956X_SRIOV_VF
+	/* Initialize Safety Features */
+	tc956xmac_safety_feat_configuration(priv);
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.frp, flags);
+#endif
+	ret = tc956xmac_rx_parser_configuration(priv);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.frp, flags);
+#endif
+	/* Rx checksum offload configuration is done by PF
+	 * VF driver should know the status of core register configuration
+	 */
+#ifndef TC956X_SRIOV_VF
+	ret = tc956xmac_rx_ipc(priv, priv->hw);
+	if (!ret) {
+#else
+	if (!priv->pf_drv_cap.csum_en) {
+#endif
+		netdev_warn(priv->dev, "RX IPC Checksum Offload disabled\n");
+		priv->plat->rx_coe = TC956XMAC_RX_COE_NONE;
+		priv->hw->rx_csum = 0;
+#ifdef TC956X_SRIOV_PF
+		/* Update driver cap to let VF know about feature enable/disable
+		 */
+		priv->pf_drv_cap.csum_en = false;
+	} else {
+		/* Update driver cap to let VF know about feature enable/disable */
+		priv->pf_drv_cap.csum_en = true;
+		priv->rx_csum_state = priv->hw->rx_csum;
+#endif
+	}
+
+#ifndef TC956X_SRIOV_VF
+	/* Enable the MAC Rx/Tx */
+	tc956xmac_mac_set(priv, priv->ioaddr, true);
+#endif
+	/* Set the HW DMA mode and the COE */
+	tc956xmac_dma_operation_mode(priv);
+
+	/* Avoid SW MMC counters reset during link down MAC reset */
+	if (priv->link_down_rst == false)
+		tc956xmac_mmc_setup(priv);
+
+	/* CRC & Padding Configuration */
+
+	priv->tx_crc_pad_state = TC956X_TX_CRC_PAD_INSERT;
+	priv->rx_crc_pad_state = TC956X_RX_CRC_DEFAULT;
+	/* In SRIOV case the RX CRC configuration is handled by PF as it
+	 * impacts all drivers
+	 */
+
+#ifndef TC956X_SRIOV_VF
+	tc956x_rx_crc_pad_config(priv, priv->rx_crc_pad_state);
+#ifdef TC956X_SRIOV_PF
+	/* Update driver cap to let VF know about feature enable/disable */
+	priv->pf_drv_cap.crc_en = priv->rx_crc_pad_state;
+#endif
+
+	if (init_ptp) {
+		ret = clk_prepare_enable(priv->plat->clk_ptp_ref);
+		if (ret < 0)
+			netdev_warn(priv->dev, "failed to enable PTP reference clock: %d\n", ret);
+
+		ret = tc956xmac_init_ptp(priv);
+		if (ret == -EOPNOTSUPP)
+			netdev_warn(priv->dev, "PTP not supported by HW\n");
+		else if (ret)
+			netdev_warn(priv->dev, "PTP init failed\n");
+	}
+#endif
+	if (priv->use_riwt) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+		for (queue = 0; queue < rx_cnt; queue++) {
+			if (!priv->rx_riwt[queue]) {
+				if (priv->port_num == RM_PF0_ID)
+					priv->rx_riwt[queue] = mac0_rx_watchdog_timeout;
+
+				if (priv->port_num == RM_PF1_ID)
+					priv->rx_riwt[queue] = mac1_rx_watchdog_timeout;
+			}
+
+			ret = tc956xmac_rx_watchdog(priv, priv->ioaddr, priv->rx_riwt[queue], queue);
+		}
+#else
+		if (!priv->rx_riwt) {
+			if (priv->port_num == RM_PF0_ID)
+				priv->rx_riwt = mac0_rx_watchdog_timeout;
+
+			if (priv->port_num == RM_PF1_ID)
+				priv->rx_riwt = mac1_rx_watchdog_timeout;
+		}
+
+		ret = tc956xmac_rx_watchdog(priv, priv->ioaddr, priv->rx_riwt, rx_cnt);
+
+#endif
+	}
+
+	/* Auto negotiation not applicable for VF
+	 * PTP configuration not applicable for VF
+	 */
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+	if (priv->hw->xpcs) {
+		/*C37 AN enable*/
+		if ((priv->plat->interface == PHY_INTERFACE_MODE_10GKR) ||
+			(priv->port_interface == ENABLE_2500BASE_X_INTERFACE)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+			|| (priv->plat->interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+			)
+			enable_en = false;
+		else if (priv->plat->interface == PHY_INTERFACE_MODE_SGMII) {
+			if (priv->is_sgmii_2p5g == true)
+				enable_en = false;
+			else
+				enable_en = true;
+		} else
+			enable_en = true;
+		tc956x_xpcs_ctrl_ane(priv, enable_en);
+	}
+#else
+	if (priv->hw->pcs)
+		tc956xmac_pcs_ctrl_ane(priv, priv->ioaddr, 1, priv->hw->ps, 0);
+#endif
+	tc956x_ptp_configuration(priv, 0);
+#else
+	/* PTP init should have been done in PF */
+	priv->hwts_rx_en = 1;
+#endif /*#ifdef TC956X_SRIOV_VF*/
+
+	/* set TX and RX rings length */
+	tc956xmac_set_rings_length(priv);
+
+	/* Enable TSO */
+	if (priv->tso) {
+		for (chan = 0; chan < tx_cnt; chan++) {
+#ifdef TC956X_SRIOV_VF
+			if (priv->plat->ch_in_use[chan] == 0)
+				continue;
+			if (priv->plat->tx_queues_cfg[chan].tso_en && priv->tso)
+#else
+			if (priv->plat->tx_queues_cfg[chan].tso_en)
+#endif
+
+				tc956xmac_enable_tso(priv, priv->ioaddr, 1, chan);
+		}
+	}
+
+	/* Enable Split Header */
+	if (priv->sph && priv->hw->rx_csum) {
+		for (chan = 0; chan < rx_cnt; chan++) {
+#ifdef TC956X_SRIOV_PF
+			if (priv->plat->tx_queues_cfg[chan].tso_en)
+#elif defined TC956X_SRIOV_VF
+			if (priv->plat->ch_in_use[chan] == 0)
+				continue;
+#endif
+				tc956xmac_enable_sph(priv, priv->ioaddr, 1, chan);
+		}
+	}
+
+#ifndef TC956X_SRIOV_VF
+	/* VLAN Tag Insertion */
+#ifndef TC956X
+	if (priv->dma_cap.vlins)
+#else
+	if ((priv->dma_cap.vlins) && (dev->features & NETIF_F_HW_VLAN_CTAG_TX))
+#endif
+		tc956xmac_enable_vlan(priv, priv->hw, TC956XMAC_VLAN_INSERT);
+#endif
+
+	/* TBS */
+	for (chan = 0; chan < tx_cnt; chan++) {
+		struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[chan];
+		int enable = tx_q->tbs & TC956XMAC_TBS_AVAIL;
+
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+
+		if (priv->plat->tx_queues_cfg[chan].tbs_en == TC956X_DISABLE)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#endif
+		tc956xmac_enable_tbs(priv, priv->ioaddr, enable, chan);
+	}
+
+	/* PF driver to configure EST for all functions */
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.est, flags);
+#endif
+#ifndef TC956X_SRIOV_VF
+	if (priv->plat->est->enable)
+		tc956xmac_est_configure(priv, priv->ioaddr, priv->plat->est,
+				   priv->plat->clk_ptp_rate);
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.est, flags);
+#endif
+
+	/* Start the ball rolling... */
+	tc956xmac_start_all_dma(priv);
+
+	return 0;
+}
+
+#ifndef TC956X_SRIOV_VF
+static void tc956xmac_hw_teardown(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	clk_disable_unprepare(priv->plat->clk_ptp_ref);
+}
+
+#if !defined(TC956X_CPE_CONFIG)
+static void tc956xmac_set_cbs_default(struct tc956xmac_priv *priv)
+{
+	u32 queue_idx;
+	u32 tx_queue_cnt = priv->plat->tx_queues_to_use;
+
+	for (queue_idx = 0 ; queue_idx < tx_queue_cnt; queue_idx++) {
+		if (priv->plat->tx_queues_cfg[queue_idx].mode_to_use == MTL_QUEUE_AVB) {
+			/* CBS: queue 5/6/7 -> Class A/B/CDT traffic (25% BW) */
+			priv->cbs_speed100_cfg[queue_idx].idle_slope = 0x400;
+			priv->cbs_speed100_cfg[queue_idx].send_slope = 0xc00;
+			priv->cbs_speed100_cfg[queue_idx].high_credit = 0x320000;
+			priv->cbs_speed100_cfg[queue_idx].low_credit = 0xFF6A0000;
+
+			priv->cbs_speed1000_cfg[queue_idx].idle_slope = 0x800;
+			priv->cbs_speed1000_cfg[queue_idx].send_slope = 0x1800;
+			priv->cbs_speed1000_cfg[queue_idx].high_credit = 0x320000;
+			priv->cbs_speed1000_cfg[queue_idx].low_credit = 0xFF6A0000;
+
+			priv->cbs_speed2500_cfg[queue_idx].idle_slope = 0x800;
+			priv->cbs_speed2500_cfg[queue_idx].send_slope = 0x1800;
+			priv->cbs_speed2500_cfg[queue_idx].high_credit = 0x320000;
+			priv->cbs_speed2500_cfg[queue_idx].low_credit = 0xFF6A0000;
+
+			priv->cbs_speed5000_cfg[queue_idx].idle_slope = 0x2000;
+			priv->cbs_speed5000_cfg[queue_idx].send_slope = 0x6000;
+			priv->cbs_speed5000_cfg[queue_idx].high_credit = 0x320000;
+			priv->cbs_speed5000_cfg[queue_idx].low_credit = 0xFF6A0000;
+
+			priv->cbs_speed10000_cfg[queue_idx].idle_slope = 0x2000;
+			priv->cbs_speed10000_cfg[queue_idx].send_slope = 0x6000;
+			priv->cbs_speed10000_cfg[queue_idx].high_credit = 0x320000;
+			priv->cbs_speed10000_cfg[queue_idx].low_credit = 0xFF6A0000;
+		}
+	}
+
+}
+#endif
+
+#ifdef TC956X_SRIOV_PF
+/**
+ *  tc956x_pf_vf_ch_alloc - Configure Resource Manager Module to allocate
+ *  EMAC DMA channel for PF and VF.
+ *  @ndev : pointer to the device structure.
+ *  Description:
+ *  Configure Resource Manager Module to allocate EMAC DMA channel for
+ *  PF and VF.
+ *  Return value:
+ *  0 on success and (-)ve integer on failure.
+ */
+static int tc956x_pf_vf_ch_alloc(struct net_device *ndev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+
+	tc956xmac_rsc_mng_set_rscs(priv, ndev, &priv->rsc_dma_ch_alloc[0]);
+
+	return 0;
+}
+
+#endif
+#endif
+
+/**
+ *  tc956xmac_open - open entry point of the driver
+ *  @dev : pointer to the device structure.
+ *  Description:
+ *  This function is the open entry point of the driver.
+ *  Return value:
+ *  0 on success and an appropriate (-)ve integer as defined in errno.h
+ *  file on failure.
+ */
+static int tc956xmac_open(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct pci_dev *pdev = container_of(priv->device, struct pci_dev, dev);
+
+	int bfsize = 0;
+	u32 chan, rd_val;
+	int ret, irq_no;
+#ifdef TC956X_SRIOV_VF
+	u32 link_status = 0;
+	u32 speed;
+	u32 duplex;
+	int state_count = 0;
+#endif
+
+#ifndef TC956X_SRIOV_VF
+	struct phy_device *phydev = NULL;
+	int addr = priv->plat->phy_addr;
+	char *pwol_dev_name; /*TC956X_Host_Driver-industrial_limited_tested_20241114_V_04-00-01-QPSSW-218.patch*/
+
+	KPRINT_INFO("---> light weight = %d %s : Port %d interface %s", priv->link_down_rst, __func__, priv->port_num, dev->name);
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	phydev = mdiobus_get_phy(priv->mii, addr);
+#endif
+	KPRINT_INFO("Open priv->link_down_rst = %d priv->tc956x_port_pm_suspend = %d\n", priv->link_down_rst, priv->tc956x_port_pm_suspend);
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+	if (priv->link_down_rst == false)
+		tc956xmac_create_debugfs(priv->dev);/*Creating Debugfs*/
+#endif
+#endif /* TC956X_SRIOV_PF */
+
+
+#ifndef TC956X_SRIOV_VF
+	mutex_lock(&priv->port_ld_release_lock);
+	priv->port_release = false; /* setting port release to false as Open invoked, and set to true from release or link down */
+	if (priv->port_link_down == true) {
+		tc956xmac_link_change_set_power(priv, LINK_UP); /* Restore, De-assert and Enable Reset and Clock */
+	}
+	mutex_unlock(&priv->port_ld_release_lock);
+
+#endif
+
+	if (!phydev) {
+		netdev_err(priv->dev, "no phy at addr %d\n", addr);
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+		return -ENODEV;
+#endif
+	}
+
+	if (priv->link_down_rst == false) {
+		if (priv->hw->pcs != TC956XMAC_PCS_RGMII &&
+		    priv->hw->pcs != TC956XMAC_PCS_TBI &&
+		    priv->hw->pcs != TC956XMAC_PCS_RTBI) {
+			ret = tc956xmac_init_phy(dev);
+			if (ret) {
+				netdev_err(priv->dev,
+					   "%s: Cannot attach to PHY (error: %d)\n",
+					   __func__, ret);
+				KPRINT_INFO("<--- %s(1) : Port %d %s", __func__, priv->port_num, dev->name);
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+				return ret;
+#endif
+			}
+		}
+	}
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_CPE_CONFIG)
+	/* Do not re-allocate host resources during resume sequence. Only re-initialize resources */
+	if (priv->tc956x_port_pm_suspend == false) {
+		/* Extra statistics */
+		memset(&priv->xstats, 0, sizeof(struct tc956xmac_extra_stats));
+		priv->xstats.threshold = tc;
+
+		bfsize = tc956xmac_set_16kib_bfsize(priv, dev->mtu);
+		if (bfsize < 0)
+			bfsize = 0;
+
+		if (bfsize < BUF_SIZE_16KiB)
+			bfsize = tc956xmac_set_bfsize(dev->mtu, priv->dma_buf_sz);
+
+#if defined(TC956X_CPE_CONFIG)
+		/* Overwrite buff size allocated to 2K, to accomodate max mtu supported of 2000 bytes,
+		 * so that no buffer reconfiguration required during MTU change
+		 */
+		bfsize = BUF_SIZE_2KiB;
+#endif
+		priv->dma_buf_sz = bfsize;
+		buf_sz = bfsize;
+
+		priv->rx_copybreak = TC956XMAC_RX_COPYBREAK;
+
+		/* Earlier check for TBS */
+		for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) {
+			struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[chan];
+			int tbs_en = priv->plat->tx_queues_cfg[chan].tbs_en;
+
+			/* Set TC956XMAC_TBS_EN by default. Later allow tc command to
+			 *enable/disable
+			 */
+			tx_q->tbs |= tbs_en ? TC956XMAC_TBS_AVAIL | TC956XMAC_TBS_EN : 0;
+
+			if (tc956xmac_enable_tbs(priv, priv->ioaddr, tbs_en, chan))
+				tx_q->tbs &= ~TC956XMAC_TBS_AVAIL;
+		}
+	}
+#endif
+#ifdef TC956X_SRIOV_PF
+	/* Retrieve Function ID */
+	ret = tc956xmac_rsc_mng_get_fn_id(priv, priv->tc956x_BRIDGE_CFG_pci_base_addr, &priv->fn_id_info);
+	if (ret < 0) {
+		netdev_err(priv->dev, "%s: Invalid SRIOV Function ID\n",
+			   __func__);
+		return ret;
+	}
+
+	priv->port_num = priv->fn_id_info.pf_no;
+
+	if (priv->fn_id_info.fn_type == RM_IS_PF) {
+		/* Allocate DMA channels for PF & VF.
+		 * To be called from both PFs
+		 */
+		KPRINT_INFO("%s: SRIOV Rsc Mgr Channel Allocation\n", __func__);
+		ret = tc956x_pf_vf_ch_alloc(dev);
+		if (ret < 0) {
+			netdev_err(priv->dev, "%s: SRIOV CH Alloc failed\n",
+					__func__);
+			return ret;
+		}
+	}
+#endif
+
+#if defined(TC956X_SRIOV_PF)
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+	priv->dma_vf_map[0] = TC956X_DMA0_VF_MAP;	//vf1
+	priv->dma_vf_map[1] = TC956X_DMA1_VF_MAP;	//vf2
+	priv->dma_vf_map[2] = TC956X_DMA2_VF_MAP;	//vf3
+	priv->dma_vf_map[3] = TC956X_DMA3_VF_MAP;	//pf
+	priv->dma_vf_map[4] = TC956X_DMA4_VF_MAP;
+	priv->dma_vf_map[5] = TC956X_DMA5_VF_MAP;
+	priv->dma_vf_map[6] = TC956X_DMA6_VF_MAP;
+	priv->dma_vf_map[7] = TC956X_DMA7_VF_MAP;
+#endif
+
+	priv->pf_queue_dma_map[0] = TC956X_RXQ0_CH_MAP;
+	priv->pf_queue_dma_map[1] = TC956X_RXQ1_CH_MAP;
+	priv->pf_queue_dma_map[2] = TC956X_RXQ2_CH_MAP;
+	priv->pf_queue_dma_map[3] = TC956X_RXQ3_CH_MAP;
+	priv->pf_queue_dma_map[4] = TC956X_RXQ4_CH_MAP;	//NA to	PF
+	priv->pf_queue_dma_map[5] = TC956X_RXQ5_CH_MAP;	//NA to	PF
+	priv->pf_queue_dma_map[6] = TC956X_RXQ6_CH_MAP;	//NA to	PF
+	priv->pf_queue_dma_map[7] = TC956X_RXQ7_CH_MAP;
+#endif
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+	tc956xmac_mbx_init(priv, NULL);
+#endif
+
+	/* Extra statistics */
+	memset(&priv->xstats, 0, sizeof(struct tc956xmac_extra_stats));
+	priv->xstats.threshold = tc;
+#elif defined TC956X_SRIOV_VF
+	memset(&priv->sw_stats, 0, sizeof(struct tc956x_sw_counters));
+#endif
+
+#ifdef TC956X_SRIOV_VF
+	tc956xmac_get_link_status(priv, &link_status, &speed, &duplex);
+
+	while (link_status != true && state_count < 10) {
+		tc956xmac_get_link_status(priv, &link_status, &speed, &duplex);
+		state_count++;
+		udelay(100);
+	}
+#endif
+	bfsize = tc956xmac_set_16kib_bfsize(priv, dev->mtu);
+	if (bfsize < 0)
+		bfsize = 0;
+
+	if (bfsize < BUF_SIZE_16KiB)
+		bfsize = tc956xmac_set_bfsize(dev->mtu, priv->dma_buf_sz);
+
+	priv->dma_buf_sz = bfsize;
+	buf_sz = bfsize;
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_CPE_CONFIG)
+	tc956xmac_set_cbs_default(priv);
+#endif
+
+	priv->rx_copybreak = TC956XMAC_RX_COPYBREAK;
+
+	/* Earlier check for TBS */
+	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) {
+		struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[chan];
+		int tbs_en = priv->plat->tx_queues_cfg[chan].tbs_en;
+#ifdef TC956X_SRIOV_PF
+			if (priv->plat->tx_ch_in_use[chan] ==
+						TC956X_DISABLE_CHNL)
+				continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#endif
+		/* Set TC956XMAC_TBS_EN by default. Later allow tc command to
+		 *enable/disable
+		 */
+		tx_q->tbs |= tbs_en ? TC956XMAC_TBS_AVAIL | TC956XMAC_TBS_EN : 0;
+
+		if (tc956xmac_enable_tbs(priv, priv->ioaddr, tbs_en, chan))
+			tx_q->tbs &= ~TC956XMAC_TBS_AVAIL;
+	}
+
+	ret = alloc_dma_desc_resources(priv);
+	if (ret < 0) {
+		netdev_err(priv->dev, "%s: DMA descriptors allocation failed\n",
+			   __func__);
+		goto dma_desc_error;
+	}
+
+	ret = init_dma_desc_rings(dev, GFP_KERNEL);
+	if (ret < 0) {
+		netdev_err(priv->dev, "%s: DMA descriptors initialization failed\n",
+			   __func__);
+		goto init_error;
+	}
+
+	ret = tc956xmac_hw_setup(dev, true);
+	if (ret < 0) {
+		netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
+		/*goto init_error;*/
+	}
+
+
+#ifdef TC956X
+
+#ifdef TC956X_SRIOV_PF
+
+	/* Masked all interrupts.
+	 * Interrupts to CM3 to be enabled in FW
+	 */
+	if ((priv->fn_id_info.fn_type == RM_IS_PF) && (priv->fn_id_info.pf_no == RM_PF0_ID)) {
+		rd_val = readl(priv->ioaddr + INTMCUMASK0);
+		rd_val |= TC956X_INT_MASK0;
+		writel(rd_val, priv->ioaddr + INTMCUMASK0);
+	}
+	if ((priv->fn_id_info.fn_type == RM_IS_PF) && (priv->fn_id_info.pf_no == RM_PF1_ID)) {
+		rd_val = readl(priv->ioaddr + INTMCUMASK1);
+		rd_val |= TC956X_INT_MASK1;
+		writel(rd_val, priv->ioaddr + INTMCUMASK1);
+	}
+
+#ifdef EEE_MAC_CONTROLLED_MODE
+	if (priv->port_num == RM_PF0_ID) {
+		rd_val |= (NCLKCTRL0_MAC0312CLKEN | NCLKCTRL0_MAC0125CLKEN);
+	}
+	rd_val |= (NCLKCTRL0_POEPLLCEN | NCLKCTRL0_SGMPCIEN | NCLKCTRL0_REFCLKOCEN);
+#endif
+	/* Initialize MSIGEN */
+	tc956x_msi_init(priv, dev);
+
+#elif defined TC956X_SRIOV_VF
+	/* Initialize MSIGEN */
+	tc956x_msi_init(priv, dev, &priv->fn_id_info);
+
+#endif
+#endif /* TC956X */
+
+	tc956xmac_init_coalesce(priv);
+
+
+#ifndef TC956X_SRIOV_VF
+	if (priv->link_down_rst == false)  {
+		if (priv->phylink)
+			phylink_start(priv->phylink);
+	}
+
+	KPRINT_INFO("%s phylink started", __func__);
+#endif
+
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+
+	irq_no = pci_irq_vector(pdev, TC956X_MSI_VECTOR_0);
+	if (priv->link_down_rst == false) {
+
+		/* Request the IRQ lines */
+		ret = request_irq(irq_no, tc956xmac_interrupt_v0,
+			  IRQF_NO_SUSPEND, dev->name, dev);
+		if (unlikely(ret < 0)) {
+			netdev_err(priv->dev,
+				   "%s: ERROR: allocating the IRQ 0 : %d (error: %d)\n",
+				   __func__, dev->irq, ret);
+			goto irq_error;
+		}
+#ifdef TC956X_SRIOV_PF
+		/* Do not re-request WOL irq resources during resume sequence. */
+		if (priv->tc956x_port_pm_suspend == false) {
+			/* Request the Wake IRQ in case of another line is used for WoL */
+			if (priv->wol_irq != dev->irq) {
+				/*TC956X_Host_Driver-industrial_limited_tested_20241114_V_04-00-01-QPSSW-218.patch*/
+				pwol_dev_name = priv->int_name_wol;
+				snprintf(pwol_dev_name, sizeof(priv->int_name_wol), "%s_wol", dev->name);
+				ret = request_irq(priv->wol_irq, tc956xmac_wol_interrupt,
+						  IRQF_NO_SUSPEND, pwol_dev_name, dev);
+				if (unlikely(ret < 0)) {
+					netdev_err(priv->dev,
+						   "%s: ERROR: allocating the WoL IRQ %d (%d)\n",
+						   __func__, priv->wol_irq, ret);
+					goto wolirq_error;
+				}
+			}
+	#ifndef TC956X
+			/* Request the IRQ lines */
+			if (priv->lpi_irq > 0) {
+				ret = request_irq(priv->lpi_irq, tc956xmac_interrupt, IRQF_SHARED,
+						  dev->name, dev);
+				if (unlikely(ret < 0)) {
+					netdev_err(priv->dev,
+						   "%s: ERROR: allocating the LPI IRQ %d (%d)\n",
+						   __func__, priv->lpi_irq, ret);
+					goto lpiirq_error;
+				}
+			}
+	#endif
+			priv->tc956xmac_pm_wol_interrupt = false; /* Initialize flag for PHY Work queue */
+		}
+	}
+#endif /* TC956X_SRIOV_PF */
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+	irq_no = pci_irq_vector(pdev, TC956X_MSI_VECTOR_1);
+
+	ret = request_irq(irq_no, tc956xmac_interrupt_v1,
+			  IRQF_SHARED, dev->name, dev);
+	if (unlikely(ret < 0)) {
+		netdev_err(priv->dev,
+			   "%s: ERROR: allocating the IRQ 1 : %d (error: %d)\n",
+			   __func__, dev->irq, ret);
+		goto irq_error;
+	}
+#else
+	netdev_info(priv->dev, "%s: Only one interrupt handler registered\n",
+				   __func__);
+#endif
+#endif
+
+#ifdef TC956X_SRIOV_PF
+	/* Enable MSIGEN interrupt */
+	tc956x_msi_intr_en(priv, dev, TC956X_ENABLE);
+
+#elif defined TC956X_SRIOV_VF
+	/* Enable MSIGEN interrupt */
+	tc956x_msi_intr_en(priv, dev, TC956X_ENABLE, &priv->fn_id_info);
+#endif
+	tc956xmac_enable_all_queues(priv);
+
+	tc956xmac_start_all_queues(priv);
+
+#ifdef TC956X_SRIOV_PF
+	if (readl_poll_timeout_atomic(priv->ioaddr +  TC956X_MSI_EVENT_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no),
+					rd_val, !(rd_val & 0x1), 100, 10000)) {
+
+		netdev_warn(priv->dev, "MSI Vector not clear. MSI_MASK_CLR = 0x0%x\n",
+				readl(priv->ioaddr +  TC956X_MSI_MASK_CLR_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no)));
+
+	}
+
+	/* MSI_MASK_CLR: unmask vector 0 & 1*/
+	tc956x_msi_intr_clr(priv, dev, TC956X_MSI_VECTOR_0);
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_CPE_CONFIG)
+	tc956x_msi_intr_clr(priv, dev, TC956X_MSI_VECTOR_1);
+#endif
+
+#ifdef TX_COMPLETION_WITHOUT_TIMERS
+		writel(0, priv->tc956x_SRAM_pci_base_addr
+				+ TX_TIMER_SRAM_OFFSET(priv->port_num));
+#endif
+
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+
+	/* Route all multicast Flow control packets to PCI path */
+	tc956x_pf_set_mac_filter(dev, PF_DRIVER, (const u8*) &flow_ctrl_addr[0]);
+
+	if (priv->port_num == RM_PF0_ID) {
+		/* Write Eth0 RxBuffer Head address to DMEM */
+		writel(priv->pbridge_handle, priv->tc956x_SRAM_pci_base_addr
+				+ TC956X_M3_DMEM_OFFSET + (MAC2MAC_ETH0_RXDESC_L));
+		writel(upper_32_bits(priv->pbridge_handle),
+			priv->tc956x_SRAM_pci_base_addr	+ TC956X_M3_DMEM_OFFSET + (MAC2MAC_ETH0_RXDESC_H));
+		writel(0x1 << 0, priv->ioaddr + INTC_MCUFLG);
+	} else if (priv->port_num == RM_PF1_ID) {
+		/* Write Eth1 RxBuffer Head address to DMEM */
+		writel(priv->pbridge_handle, priv->tc956x_SRAM_pci_base_addr
+			+ TC956X_M3_DMEM_OFFSET + (MAC2MAC_ETH1_RXDESC_L));
+		writel(upper_32_bits(priv->pbridge_handle), priv->tc956x_SRAM_pci_base_addr
+			+ TC956X_M3_DMEM_OFFSET + (MAC2MAC_ETH1_RXDESC_H));
+		writel(0x1 << 1, priv->ioaddr + INTC_MCUFLG);
+	}
+	mutex_lock(&tc956x_port_bridge_lock);
+	port_brige_state = 1;
+	mutex_unlock(&tc956x_port_bridge_lock);
+	netdev_info(priv->dev, "%s: Port bridge Feature enabled\n", __func__);
+#endif
+
+#elif defined TC956X_SRIOV_VF
+	if (readl_poll_timeout_atomic(priv->ioaddr +  TC956X_MSI_EVENT_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no),
+					rd_val, !(rd_val & 0x1), 100, 10000)) {
+
+		netdev_warn(priv->dev, "MSI Vector not clear. MSI_MASK_CLR = 0x0%x\n",
+				readl(priv->ioaddr +  TC956X_MSI_MASK_CLR_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no)));
+	}
+
+	/* MSI_MASK_CLR: unmask vector 0 */
+	writel(0x00000001, priv->ioaddr + TC956X_MSI_MASK_CLR_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+	if (link_status == true) {
+		netif_carrier_on(dev);
+		NMSGPR_INFO(priv->device, "PHY Link : UP\n");
+	} else {
+		netif_carrier_off(dev);
+		NMSGPR_INFO(priv->device, "PHY Link : DOWN\n");
+	}
+
+	tc956xmac_vf_reset(priv, VF_UP);
+#endif
+#ifdef TX_COMPLETION_WITHOUT_TIMERS
+		writel(0, priv->tc956x_SRAM_pci_base_addr
+				+ TX_TIMER_SRAM_OFFSET(priv->port_num));
+#endif
+	KPRINT_INFO("<--- light weight = %d %s(2) : Port %d %s", priv->link_down_rst, __func__, priv->port_num, dev->name);
+	return 0;
+#ifdef TC956X_SRIOV_PF
+#ifndef TC956X
+lpiirq_error:
+	if (priv->wol_irq != dev->irq)
+		free_irq(priv->wol_irq, dev);
+#endif
+wolirq_error:
+	free_irq(dev->irq, dev);
+#endif
+irq_error:
+#ifndef TC956X_SRIOV_VF
+	phylink_stop(priv->phylink);
+#endif
+#ifdef ENABLE_TX_TIMER
+	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[chan] == USE_IN_TC956X_SW)
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+			hrtimer_cancel(&priv->tx_queue[chan].txtimer);
+#else
+			del_timer_sync(&priv->tx_queue[chan].txtimer);
+#endif
+	}
+#endif
+#ifndef TC956X_SRIOV_VF
+	tc956xmac_hw_teardown(dev);
+#endif
+
+init_error:
+	free_dma_desc_resources(priv);
+dma_desc_error:
+#ifndef TC956X_SRIOV_VF
+	phylink_disconnect_phy(priv->phylink);
+	KPRINT_INFO("<--- light weight = %d %s(3) : Port %d %s", priv->link_down_rst, __func__, priv->port_num, dev->name);
+#endif
+	return ret;
+}
+
+/**
+ *  tc956xmac_release - close entry point of the driver
+ *  @dev : device pointer.
+ *  Description:
+ *  This is the stop entry point of the driver.
+ */
+static int tc956xmac_release(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	struct pci_dev *pdev = container_of(priv->device, struct pci_dev, dev);
+#ifdef TC956X_SRIOV_PF
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE) || defined(TC956X_CPE_CONFIG)
+	struct phy_device *phydev = NULL;
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	int addr = priv->plat->phy_addr;
+#endif
+
+#endif
+	struct tc956x_mac_addr *mac_table = &priv->mac_table[0];
+	struct tc956x_vlan_id *vlan_table = &priv->vlan_table[0];
+	int i, vf_number;
+#endif
+	u32 ch;
+	u32 offload_release_sts = true;
+
+	int irq_no;
+#ifdef ENABLE_TX_TIMER
+	u32 chan;
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	KPRINT_INFO(" ---> light weight = %d %s : Port %d interface %s", priv->link_down_rst, __func__, priv->port_num, dev->name);
+#ifdef TX_COMPLETION_WITHOUT_TIMERS
+	writel(0, priv->tc956x_SRAM_pci_base_addr
+			+ TX_TIMER_SRAM_OFFSET(priv->port_num));
+
+#endif
+	KPRINT_INFO("Release priv->link_down_rst = %d priv->tc956x_port_pm_suspend = %d\n", priv->link_down_rst, priv->tc956x_port_pm_suspend);
+#ifdef TC956X_SRIOV_VF
+	tc956xmac_vf_reset(priv, VF_RELEASE);
+#endif
+
+#ifdef TC956X_SRIOV_PF
+	/* Disable all interrupt sources */
+	tc956x_msi_intr_en(priv, dev, TC956X_DISABLE);
+
+#if defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+	mutex_lock(&tc956x_port_bridge_lock);
+	if (port_brige_state) {
+		port_brige_state = 0;
+		writel(0x1 << 2, priv->ioaddr + INTC_MCUFLG);
+		KPRINT_INFO("Sending MCU Flag Port bridge exit signal\n");
+	}
+	mutex_unlock(&tc956x_port_bridge_lock);
+#endif
+
+#elif defined TC956X_SRIOV_VF
+	/* Disable all interrupt sources */
+	tc956x_msi_intr_en(priv, dev, 0, &priv->fn_id_info);
+#endif
+
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+	if (priv->link_down_rst == false)
+		tc956xmac_cleanup_debugfs(priv->dev);
+#endif
+#endif /* TC956X_SRIOV_PF */
+
+
+	/* Stop and disconnect the PHY */
+	if (priv->link_down_rst == false) {
+		if (priv->phylink) {
+			phylink_stop(priv->phylink);
+			phylink_disconnect_phy(priv->phylink);
+		}
+	}
+
+	mutex_lock(&priv->port_ld_release_lock);
+	if (priv->port_link_down == true) {
+		KPRINT_INFO("Link down happened before %s, restoring clocks to stop DMA\n", __func__);
+		tc956xmac_link_change_set_power(priv, LINK_UP); /* Restore, De-assert and Enable Reset and Clock */
+	}
+
+#endif
+	tc956xmac_stop_all_queues(priv);
+
+	tc956xmac_disable_all_queues(priv);
+
+	/* MSI_OUT_EN: Disable all MSI*/
+	if (priv->link_down_rst == false)
+		writel(0x00000000, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->port_num, 0));
+
+#ifdef ENABLE_TX_TIMER
+	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) {
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[chan] == TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[chan] == USE_IN_TC956X_SW)
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+			hrtimer_cancel(&priv->tx_queue[chan].txtimer);
+#else
+			del_timer_sync(&priv->tx_queue[chan].txtimer);
+#endif
+	}
+#endif
+#ifdef TC956X_SRIOV_PF
+	/* Free the IRQ lines */
+	if (priv->link_down_rst == false) {
+		irq_no = pci_irq_vector(pdev, TC956X_MSI_VECTOR_0);
+		free_irq(irq_no, dev);
+
+		/* Do not Free Host Irq resources during suspend sequence */
+		if (priv->tc956x_port_pm_suspend == false) {
+			if (priv->wol_irq != dev->irq)
+				free_irq(priv->wol_irq, dev);
+	#ifndef TC956X
+			if (priv->lpi_irq > 0)
+				free_irq(priv->lpi_irq, dev);
+	#endif
+		}
+	}
+
+#if defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE) || defined(TC956X_CPE_CONFIG)
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	phydev = mdiobus_get_phy(priv->mii, addr);
+#endif
+
+	if (phydev) {
+		if (phydev->drv != NULL) {
+			if ((true == priv->plat->phy_interrupt_mode) && (phydev->drv->config_intr)) {
+				DBGPR_FUNC((priv->device), "-->%s Flush work queue\n", __func__);
+				flush_work(&priv->emac_phy_work);
+			}
+		}
+	}
+
+#endif
+
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+	irq_no = pci_irq_vector(pdev, TC956X_MSI_VECTOR_1);
+	free_irq(irq_no, dev);
+#endif
+#elif defined TC956X_SRIOV_VF
+	irq_no = pci_irq_vector(pdev, TC956X_MSI_VECTOR_0);
+	free_irq(irq_no, dev);
+#endif
+
+#ifndef TC956X
+	if (priv->lpi_irq > 0)
+		free_irq(priv->lpi_irq, dev);
+#endif
+	/* Stop TX/RX DMA and clear the descriptors */
+	tc956xmac_stop_all_dma(priv);
+
+	/* Release and free the Rx/Tx resources */
+	free_dma_desc_resources(priv);
+
+#ifndef TC956X_SRIOV_VF
+	/* Disable the MAC Rx/Tx */
+	tc956xmac_mac_set(priv, priv->ioaddr, false);
+#endif
+	if (priv->link_down_rst == false)
+		netif_carrier_off(dev);
+	NMSGPR_INFO(priv->device, "PHY Link : DOWN\n");
+
+	tc956xmac_release_ptp(priv);
+
+	/* mutex_lock(&priv->port_ld_release_lock);*/
+	/* Checking whether all offload Tx channels released or not*/
+	for (ch = 0; ch < MAX_TX_QUEUES_TO_USE; ch++) {
+		/* If offload channels are not freed, update the flag, so that power saving API will not be called*/
+		if (priv->plat->tx_dma_ch_owner[ch] == USE_IN_OFFLOADER) {
+			offload_release_sts = false;
+			break;
+		}
+	}
+	/* Checking whether all offload Rx channels released or not*/
+	for (ch = 0; ch < MAX_RX_QUEUES_TO_USE; ch++) {
+		/* If offload channels are not freed, update the flag, so that power saving API will not be called*/
+		if (priv->plat->rx_dma_ch_owner[ch] == USE_IN_OFFLOADER) {
+			offload_release_sts = false;
+			break;
+		}
+	}
+	/* If all channels are freed, call API for power saving*/
+	if (priv->port_link_down == false && offload_release_sts == true) {
+		KPRINT_INFO(" %s, Assert Reset and Disabling clock\n", __func__);
+		tc956xmac_link_change_set_power(priv, LINK_DOWN); /* Save, Assert and Disable Reset and Clock */
+	}
+	priv->port_release = true; /* setting port release to true as release invoked, and clear from open or link-up */
+	mutex_unlock(&priv->port_ld_release_lock);
+
+#ifdef TC956X_SRIOV_PF
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+	for (i = XGMAC_ADDR_ADD_SKIP_OFST; i < (TC956X_MAX_PERFECT_ADDRESSES);
+			i++, mac_table++) {
+		for (vf_number = 0; vf_number < 4; vf_number++) {
+			if (mac_table->vf[vf_number] != 0)
+				tc956x_pf_del_mac_filter(priv->dev, mac_table->vf[vf_number], (u8 *)&mac_table->mac_address);
+		}
+	}
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.vlan_filter, flags);
+#endif
+	for (i = 0; i < TC956X_MAX_PERFECT_VLAN; i++, vlan_table++) {
+		for (vf_number = 0; vf_number < 4; vf_number++) {
+			if (vlan_table->vf[vf_number].vf_number != 0)
+				tc956x_pf_del_vlan_filter(priv->dev, vlan_table->vf[vf_number].vf_number, vlan_table->vid);
+		}
+	}
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.vlan_filter, flags);
+#endif
+#endif
+	KPRINT_INFO("<--- light weight = %d %s : Port %d %s", priv->link_down_rst, __func__, priv->port_num, dev->name);
+	return 0;
+}
+
+static bool tc956xmac_vlan_insert(struct tc956xmac_priv *priv, struct sk_buff *skb,
+			       struct tc956xmac_tx_queue *tx_q)
+{
+	u16 tag = 0x0, inner_tag = 0x0;
+	u32 inner_type = 0x0;
+	struct dma_desc *p;
+
+	if (!priv->dma_cap.vlins)
+		return false;
+	if (!skb_vlan_tag_present(skb))
+		return false;
+	if (skb->vlan_proto == htons(ETH_P_8021AD)) {
+		inner_tag = skb_vlan_tag_get(skb);
+		inner_type = TC956XMAC_VLAN_INSERT;
+	}
+
+	tag = skb_vlan_tag_get(skb);
+
+	if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+		p = &tx_q->dma_entx[tx_q->cur_tx].basic;
+	else
+		p = &tx_q->dma_tx[tx_q->cur_tx];
+
+	if (tc956xmac_set_desc_vlan_tag(priv, p, tag, inner_tag, inner_type))
+		return false;
+
+	tc956xmac_set_tx_owner(priv, p);
+	tx_q->cur_tx = TC956XMAC_GET_ENTRY(tx_q->cur_tx, DMA_TX_SIZE);
+	return true;
+}
+
+/**
+ *  tc956xmac_tso_allocator - close entry point of the driver
+ *  @priv: driver private structure
+ *  @des: buffer start address
+ *  @total_len: total length to fill in descriptors
+ *  @last_segmant: condition for the last descriptor
+ *  @queue: TX queue index
+ *  Description:
+ *  This function fills descriptor and request new descriptors according to
+ *  buffer length to fill
+ */
+static void tc956xmac_tso_allocator(struct tc956xmac_priv *priv, dma_addr_t des,
+				 int total_len, bool last_segment, u32 queue)
+{
+	struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+	struct dma_desc *desc;
+	u32 buff_size;
+	int tmp_len;
+
+	tmp_len = total_len;
+
+	while (tmp_len > 0) {
+		dma_addr_t curr_addr;
+
+		tx_q->cur_tx = TC956XMAC_GET_ENTRY(tx_q->cur_tx, DMA_TX_SIZE);
+		WARN_ON(tx_q->tx_skbuff[tx_q->cur_tx]);
+
+		if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			desc = &tx_q->dma_entx[tx_q->cur_tx].basic;
+		else
+			desc = &tx_q->dma_tx[tx_q->cur_tx];
+
+		curr_addr = des + (total_len - tmp_len);
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+		if (priv->dma_cap.addr64 <= 32)
+			desc->des0 = cpu_to_le32(curr_addr);
+		else
+#endif
+			tc956xmac_set_desc_addr(priv, desc, curr_addr);
+
+		buff_size = tmp_len >= TSO_MAX_BUFF_SIZE ?
+			    TSO_MAX_BUFF_SIZE : tmp_len;
+
+		tc956xmac_prepare_tso_tx_desc(priv, desc, 0, buff_size,
+				0, 1,
+				(last_segment) && (tmp_len <= TSO_MAX_BUFF_SIZE),
+				0, 0);
+
+		tmp_len -= TSO_MAX_BUFF_SIZE;
+	}
+}
+
+/**
+ *  tc956xmac_tso_xmit - Tx entry point of the driver for oversized frames (TSO)
+ *  @skb : the socket buffer
+ *  @dev : device pointer
+ *  Description: this is the transmit function that is called on TSO frames
+ *  (support available on GMAC4 and newer chips).
+ *  Diagram below show the ring programming in case of TSO frames:
+ *
+ *  First Descriptor
+ *   --------
+ *   | DES0 |---> buffer1 = L2/L3/L4 header
+ *   | DES1 |---> TCP Payload (can continue on next descr...)
+ *   | DES2 |---> buffer 1 and 2 len
+ *   | DES3 |---> must set TSE, TCP hdr len-> [22:19]. TCP payload len [17:0]
+ *   --------
+ *	|
+ *     ...
+ *	|
+ *   --------
+ *   | DES0 | --| Split TCP Payload on Buffers 1 and 2
+ *   | DES1 | --|
+ *   | DES2 | --> buffer 1 and 2 len
+ *   | DES3 |
+ *   --------
+ *
+ * mss is fixed when enable tso, so w/o programming the TDES3 ctx field.
+ */
+static netdev_tx_t tc956xmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct dma_desc *desc, *first, *mss_desc = NULL;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	int desc_size, tmp_pay_len = 0, first_tx;
+	int nfrags = skb_shinfo(skb)->nr_frags;
+	u32 queue = skb_get_queue_mapping(skb);
+	unsigned int first_entry, tx_packets;
+	struct tc956xmac_tx_queue *tx_q;
+	bool has_vlan, set_ic;
+	u8 proto_hdr_len, hdr;
+	u32 pay_len, mss;
+	dma_addr_t des;
+	int i;
+
+	tx_q = &priv->tx_queue[queue];
+	first_tx = tx_q->cur_tx;
+
+	/* Compute header lengths */
+	if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4) {
+		proto_hdr_len = skb_transport_offset(skb) + sizeof(struct udphdr);
+		hdr = sizeof(struct udphdr);
+	} else {
+		proto_hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+		hdr = tcp_hdrlen(skb);
+	}
+
+	/* Desc availability based on threshold should be enough safe */
+	if (unlikely(tc956xmac_tx_avail(priv, queue) <
+		(((skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1)))) {
+		if (!netif_tx_queue_stopped(netdev_get_tx_queue(dev, queue))) {
+			netif_tx_stop_queue(netdev_get_tx_queue(priv->dev,
+								queue));
+			/* This is a hard error, log it. */
+			netdev_err(priv->dev,
+				   "%s: Tx Ring full when queue awake\n",
+				   __func__);
+		}
+		return NETDEV_TX_BUSY;
+	}
+
+	pay_len = skb_headlen(skb) - proto_hdr_len; /* no frags */
+
+	mss = skb_shinfo(skb)->gso_size;
+
+	/* set new MSS value if needed */
+	if (mss != tx_q->mss) {
+		if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			mss_desc = &tx_q->dma_entx[tx_q->cur_tx].basic;
+		else
+			mss_desc = &tx_q->dma_tx[tx_q->cur_tx];
+
+		tc956xmac_set_mss(priv, mss_desc, mss);
+		tx_q->mss = mss;
+		tx_q->cur_tx = TC956XMAC_GET_ENTRY(tx_q->cur_tx, DMA_TX_SIZE);
+		WARN_ON(tx_q->tx_skbuff[tx_q->cur_tx]);
+	}
+
+	if (netif_msg_tx_queued(priv)) {
+		pr_info("%s: hdrlen %d, hdr_len %d, pay_len %d, mss %d\n",
+			__func__, hdr, proto_hdr_len, pay_len, mss);
+		pr_info("\tskb->len %d, skb->data_len %d\n", skb->len,
+			skb->data_len);
+	}
+
+	/* Check if VLAN can be inserted by HW */
+	has_vlan = tc956xmac_vlan_insert(priv, skb, tx_q);
+
+	first_entry = tx_q->cur_tx;
+	WARN_ON(tx_q->tx_skbuff[first_entry]);
+
+	if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+		desc = &tx_q->dma_entx[first_entry].basic;
+	else
+		desc = &tx_q->dma_tx[first_entry];
+	first = desc;
+
+	if (has_vlan)
+		tc956xmac_set_desc_vlan(priv, first, TC956XMAC_VLAN_INSERT);
+
+	/* first descriptor: fill Headers on Buf1 */
+	des = dma_map_single(priv->device, skb->data, skb_headlen(skb),
+			     DMA_TO_DEVICE);
+	if (dma_mapping_error(priv->device, des))
+		goto dma_map_err;
+
+	tx_q->tx_skbuff_dma[first_entry].buf = des;
+	tx_q->tx_skbuff_dma[first_entry].len = skb_headlen(skb);
+
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	if (priv->dma_cap.addr64 <= 32) {
+		first->des0 = cpu_to_le32(des);
+
+		/* Fill start of payload in buff2 of first descriptor */
+		if (pay_len)
+			first->des1 = cpu_to_le32(des + proto_hdr_len);
+
+		/* If needed take extra descriptors to fill the remaining
+		 * payload
+		 */
+		tmp_pay_len = pay_len - TSO_MAX_BUFF_SIZE;
+	} else {
+#endif
+		tc956xmac_set_desc_addr(priv, first, des);
+		tmp_pay_len = pay_len;
+		des += proto_hdr_len;
+		pay_len = 0;
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	}
+#endif
+
+	tc956xmac_tso_allocator(priv, des, tmp_pay_len, (nfrags == 0), queue);
+
+	/* Prepare fragments */
+	for (i = 0; i < nfrags; i++) {
+		const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+
+		des = skb_frag_dma_map(priv->device, frag, 0,
+				       skb_frag_size(frag),
+				       DMA_TO_DEVICE);
+		if (dma_mapping_error(priv->device, des))
+			goto dma_map_err;
+
+		tc956xmac_tso_allocator(priv, des, skb_frag_size(frag),
+				     (i == nfrags - 1), queue);
+
+		tx_q->tx_skbuff_dma[tx_q->cur_tx].buf = des;
+		tx_q->tx_skbuff_dma[tx_q->cur_tx].len = skb_frag_size(frag);
+		tx_q->tx_skbuff_dma[tx_q->cur_tx].map_as_page = true;
+	}
+
+	tx_q->tx_skbuff_dma[tx_q->cur_tx].last_segment = true;
+
+	/* Only the last descriptor gets to point to the skb. */
+	tx_q->tx_skbuff[tx_q->cur_tx] = skb;
+
+	/* Manage tx mitigation */
+	tx_packets = (tx_q->cur_tx + 1) - first_tx;
+	tx_q->tx_count_frames += tx_packets;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+	if ((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && priv->hwts_tx_en)
+		set_ic = true;
+	else if (!priv->tx_coal_frames[queue])
+		set_ic = false;
+	else if (tx_packets > priv->tx_coal_frames[queue])
+		set_ic = true;
+	else if ((tx_q->tx_count_frames % priv->tx_coal_frames[queue]) < tx_packets)
+		set_ic = true;
+	else
+		set_ic = false;
+#else
+	if ((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && priv->hwts_tx_en)
+		set_ic = true;
+	else if (!priv->tx_coal_frames)
+		set_ic = false;
+	else if (tx_packets > priv->tx_coal_frames)
+		set_ic = true;
+	else if ((tx_q->tx_count_frames % priv->tx_coal_frames) < tx_packets)
+		set_ic = true;
+	else
+		set_ic = false;
+#endif
+	if (set_ic) {
+		if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			desc = &tx_q->dma_entx[tx_q->cur_tx].basic;
+		else
+			desc = &tx_q->dma_tx[tx_q->cur_tx];
+
+		tx_q->tx_count_frames = 0;
+		tc956xmac_set_tx_ic(priv, desc);
+		priv->xstats.tx_set_ic_bit++;
+	}
+
+	/* We've used all descriptors we need for this skb, however,
+	 * advance cur_tx so that it references a fresh descriptor.
+	 * ndo_start_xmit will fill this descriptor the next time it's
+	 * called and tc956xmac_tx_clean may clean up to this descriptor.
+	 */
+	tx_q->cur_tx = TC956XMAC_GET_ENTRY(tx_q->cur_tx, DMA_TX_SIZE);
+
+	if (unlikely(tc956xmac_tx_avail(priv, queue) <= (MAX_SKB_FRAGS + 1))) {
+		netif_dbg(priv, hw, priv->dev, "%s: stop transmitted packets\n",
+			  __func__);
+		netif_tx_stop_queue(netdev_get_tx_queue(priv->dev, queue));
+	}
+
+	dev->stats.tx_bytes += skb->len;
+	priv->xstats.tx_tso_frames[queue]++;
+	priv->xstats.tx_tso_nfrags[queue] += nfrags;
+
+	if (priv->sarc_type)
+		tc956xmac_set_desc_sarc(priv, first, priv->sarc_type);
+
+	skb_tx_timestamp(skb);
+
+	if (unlikely((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+		     priv->hwts_tx_en)) {
+		/* declare that device is doing timestamping */
+		skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+		tc956xmac_enable_tx_timestamp(priv, first);
+	}
+
+	/* Complete the first descriptor before granting the DMA */
+	tc956xmac_prepare_tso_tx_desc(priv, first, 1,
+			proto_hdr_len,
+			pay_len,
+			1, tx_q->tx_skbuff_dma[first_entry].last_segment,
+			hdr / 4, (skb->len - proto_hdr_len));
+
+	/* If context desc is used to change MSS */
+	if (mss_desc) {
+		/* Make sure that first descriptor has been completely
+		 * written, including its own bit. This is because MSS is
+		 * actually before first descriptor, so we need to make
+		 * sure that MSS's own bit is the last thing written.
+		 */
+		dma_wmb();
+		tc956xmac_set_tx_owner(priv, mss_desc);
+	}
+
+	/* The own bit must be the latest setting done when prepare the
+	 * descriptor and then barrier is needed to make sure that
+	 * all is coherent before granting the DMA engine.
+	 */
+	wmb();
+
+	if (netif_msg_pktdata(priv)) {
+		pr_info("%s: curr=%d dirty=%d f=%d, e=%d, f_p=%p, nfrags %d\n",
+			__func__, tx_q->cur_tx, tx_q->dirty_tx, first_entry,
+			tx_q->cur_tx, first, nfrags);
+		pr_info(">>> frame to be transmitted: ");
+		print_pkt(skb->data, skb_headlen(skb));
+	}
+
+	netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len);
+
+	if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+		desc_size = sizeof(struct dma_edesc);
+	else
+		desc_size = sizeof(struct dma_desc);
+
+	tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * desc_size);
+	tc956xmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
+#ifdef ENABLE_TX_TIMER
+	tc956xmac_tx_timer_arm(priv, queue);
+#endif
+
+#ifdef TX_COMPLETION_WITHOUT_TIMERS
+	writel(1, priv->tc956x_SRAM_pci_base_addr
+			+ TX_TIMER_SRAM_OFFSET(priv->port_num));
+#endif
+	return NETDEV_TX_OK;
+
+dma_map_err:
+	dev_err(priv->device, "Tx dma map failed\n");
+	dev_kfree_skb(skb);
+	priv->dev->stats.tx_dropped++;
+	return NETDEV_TX_OK;
+}
+
+/**
+ *  tc956xmac_xmit - Tx entry point of the driver
+ *  @skb : the socket buffer
+ *  @dev : device pointer
+ *  Description : this is the tx entry point of the driver.
+ *  It programs the chain or the ring and supports oversized frames
+ *  and SG feature.
+ */
+static netdev_tx_t tc956xmac_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	unsigned int first_entry, tx_packets, enh_desc;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	unsigned int nopaged_len = skb_headlen(skb);
+	int i, csum_insertion = 0, is_jumbo = 0;
+	u32 queue = skb_get_queue_mapping(skb);
+	int nfrags = skb_shinfo(skb)->nr_frags;
+	int gso = skb_shinfo(skb)->gso_type;
+	struct dma_edesc *tbs_desc = NULL;
+	int entry, desc_size, first_tx;
+	struct dma_desc *desc, *first;
+	struct tc956xmac_tx_queue *tx_q;
+	bool has_vlan, set_ic;
+	dma_addr_t des;
+	u64 ns = 0;
+	u32 ts_low, ts_high;
+
+	tx_q = &priv->tx_queue[queue];
+	first_tx = tx_q->cur_tx;
+
+	KPRINT_DEBUG1("tso en = %d\n", priv->tso);
+	KPRINT_DEBUG1("skb tso en = %d\n", skb_is_gso(skb));
+	/* Manage oversized TCP frames for GMAC4 device */
+
+	/* TSO feature is supported based on configuration in PF */
+	if (skb_is_gso(skb) && priv->tso) {
+		KPRINT_DEBUG1("XMIT TSO IF\n");
+		if (gso & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))
+			return tc956xmac_tso_xmit(skb, dev);
+		if (priv->plat->has_gmac4 && (gso & SKB_GSO_UDP_L4))
+			return tc956xmac_tso_xmit(skb, dev);
+	}
+	KPRINT_DEBUG1("XMIT Normal\n");
+
+	if (unlikely(tc956xmac_tx_avail(priv, queue) < nfrags + 1)) {
+		if (!netif_tx_queue_stopped(netdev_get_tx_queue(dev, queue))) {
+			netif_tx_stop_queue(netdev_get_tx_queue(priv->dev,
+								queue));
+			/* This is a hard error, log it. */
+			netdev_err(priv->dev,
+				   "%s: Tx Ring full when queue awake\n",
+				   __func__);
+		}
+		return NETDEV_TX_BUSY;
+	}
+
+	/* Prepare context descriptor for one-step timestamp correction */
+#ifdef TC956X_SRIOV_VF
+	if ((tx_q->queue_index == priv->plat->gptp_ch_no) && (priv->ost_en == 1)
+		&& (priv->plat->best_effort_ch_no != priv->plat->gptp_ch_no)) {
+#else
+	if ((tx_q->queue_index == TC956X_GPTP_TX_CH) && (priv->ost_en == 1)) {
+#endif
+		if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			desc = &tx_q->dma_entx[tx_q->cur_tx].basic;
+		else
+			desc = &tx_q->dma_tx[tx_q->cur_tx];
+		tc956xmac_get_mac_tx_timestamp(priv, priv->hw, &ns);
+		ts_low = (u32)ns;
+		ts_high = (u32)(ns >> 32);
+		tc956xmac_set_desc_ostc(priv, desc, ts_high, ts_low);
+		tx_q->cur_tx = TC956XMAC_GET_ENTRY(tx_q->cur_tx, DMA_TX_SIZE);
+		WARN_ON(tx_q->tx_skbuff[tx_q->cur_tx]);
+	}
+
+	/* Check if VLAN can be inserted by HW */
+	has_vlan = tc956xmac_vlan_insert(priv, skb, tx_q);
+
+	entry = tx_q->cur_tx;
+	first_entry = entry;
+	WARN_ON(tx_q->tx_skbuff[first_entry]);
+
+	/* Update checksum value as per Ethtool configuration */
+	/*csum_insertion = (skb->ip_summed == CHECKSUM_PARTIAL);*/
+#ifdef TC956X_SRIOV_PF
+	if (queue == HOST_BEST_EFF_CH)
+		csum_insertion = priv->csum_insertion;
+#elif defined TC956X_SRIOV_VF
+	if (queue == priv->plat->best_effort_ch_no)
+		csum_insertion = priv->csum_insertion;
+#endif
+	else
+		csum_insertion = 0;
+
+	KPRINT_DEBUG1("csum_insertion = %d\n", csum_insertion);
+	KPRINT_DEBUG1("priv->tx_crc_pad_state = %d\n", priv->tx_crc_pad_state);
+	if (likely(priv->extend_desc))
+		desc = (struct dma_desc *)(tx_q->dma_etx + entry);
+	else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+		desc = &tx_q->dma_entx[entry].basic;
+	else
+		desc = tx_q->dma_tx + entry;
+
+	first = desc;
+
+	if (has_vlan)
+		tc956xmac_set_desc_vlan(priv, first, TC956XMAC_VLAN_INSERT);
+
+	enh_desc = priv->plat->enh_desc;
+	/* To program the descriptors according to the size of the frame */
+	if (enh_desc)
+		is_jumbo = tc956xmac_is_jumbo_frm(priv, skb->len, enh_desc);
+
+	if (unlikely(is_jumbo)) {
+		entry = tc956xmac_jumbo_frm(priv, tx_q, skb, csum_insertion);
+		if (unlikely(entry < 0) && (entry != -EINVAL))
+			goto dma_map_err;
+	}
+
+	for (i = 0; i < nfrags; i++) {
+		const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+		int len = skb_frag_size(frag);
+		bool last_segment = (i == (nfrags - 1));
+
+		entry = TC956XMAC_GET_ENTRY(entry, DMA_TX_SIZE);
+		WARN_ON(tx_q->tx_skbuff[entry]);
+
+		if (likely(priv->extend_desc))
+			desc = (struct dma_desc *)(tx_q->dma_etx + entry);
+		else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			desc = &tx_q->dma_entx[entry].basic;
+		else
+			desc = tx_q->dma_tx + entry;
+
+		des = skb_frag_dma_map(priv->device, frag, 0, len,
+				       DMA_TO_DEVICE);
+		if (dma_mapping_error(priv->device, des))
+			goto dma_map_err; /* should reuse desc w/o issues */
+
+		tx_q->tx_skbuff_dma[entry].buf = des;
+
+		tc956xmac_set_desc_addr(priv, desc, des);
+
+		tx_q->tx_skbuff_dma[entry].map_as_page = true;
+		tx_q->tx_skbuff_dma[entry].len = len;
+		tx_q->tx_skbuff_dma[entry].last_segment = last_segment;
+
+		/* Prepare the descriptor and set the own bit too */
+		tc956xmac_prepare_tx_desc(priv, desc, 0, len, csum_insertion,
+				priv->tx_crc_pad_state,	priv->mode, 1,
+				last_segment, skb->len);
+	}
+
+	/* Only the last descriptor gets to point to the skb. */
+	tx_q->tx_skbuff[entry] = skb;
+
+	/* According to the coalesce parameter the IC bit for the latest
+	 * segment is reset and the timer re-started to clean the tx status.
+	 * This approach takes care about the fragments: desc is the first
+	 * element in case of no SG.
+	 */
+	tx_packets = (entry + 1) - first_tx;
+	tx_q->tx_count_frames += tx_packets;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+	if ((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && priv->hwts_tx_en)
+		set_ic = true;
+	else if (!priv->tx_coal_frames[queue])
+		set_ic = false;
+	else if (tx_packets > priv->tx_coal_frames[queue])
+		set_ic = true;
+	else if ((tx_q->tx_count_frames % priv->tx_coal_frames[queue]) < tx_packets)
+		set_ic = true;
+	else
+		set_ic = false;
+#else
+	if ((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && priv->hwts_tx_en)
+		set_ic = true;
+	else if (!priv->tx_coal_frames)
+		set_ic = false;
+	else if (tx_packets > priv->tx_coal_frames)
+		set_ic = true;
+	else if ((tx_q->tx_count_frames % priv->tx_coal_frames) < tx_packets)
+		set_ic = true;
+	else
+		set_ic = false;
+#endif
+	if (set_ic) {
+		if (likely(priv->extend_desc))
+			desc = &tx_q->dma_etx[entry].basic;
+		else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+			desc = &tx_q->dma_entx[entry].basic;
+		else
+			desc = &tx_q->dma_tx[entry];
+
+		tx_q->tx_count_frames = 0;
+		tc956xmac_set_tx_ic(priv, desc);
+		priv->xstats.tx_set_ic_bit++;
+	}
+
+	/* We've used all descriptors we need for this skb, however,
+	 * advance cur_tx so that it references a fresh descriptor.
+	 * ndo_start_xmit will fill this descriptor the next time it's
+	 * called and tc956xmac_tx_clean may clean up to this descriptor.
+	 */
+	entry = TC956XMAC_GET_ENTRY(entry, DMA_TX_SIZE);
+	tx_q->cur_tx = entry;
+
+	if (netif_msg_pktdata(priv)) {
+		netdev_dbg(priv->dev,
+			   "%s: curr=%d dirty=%d f=%d, e=%d, first=%p, nfrags=%d",
+			   __func__, tx_q->cur_tx, tx_q->dirty_tx, first_entry,
+			   entry, first, nfrags);
+
+		netdev_dbg(priv->dev, ">>> frame to be transmitted: ");
+		print_pkt(skb->data, skb->len);
+	}
+
+	if (unlikely(tc956xmac_tx_avail(priv, queue) <= (MAX_SKB_FRAGS + 1))) {
+		netif_dbg(priv, hw, priv->dev, "%s: stop transmitted packets\n",
+			  __func__);
+		netif_tx_stop_queue(netdev_get_tx_queue(priv->dev, queue));
+	}
+
+	dev->stats.tx_bytes += skb->len;
+
+	if (priv->sarc_type)
+		tc956xmac_set_desc_sarc(priv, first, priv->sarc_type);
+
+	skb_tx_timestamp(skb);
+
+	/* Ready to fill the first descriptor and set the OWN bit w/o any
+	 * problems because all the descriptors are actually ready to be
+	 * passed to the DMA engine.
+	 */
+	if (likely(!is_jumbo)) {
+		bool last_segment = (nfrags == 0);
+
+		des = dma_map_single(priv->device, skb->data,
+				     nopaged_len, DMA_TO_DEVICE);
+		if (dma_mapping_error(priv->device, des))
+			goto dma_map_err;
+
+		tx_q->tx_skbuff_dma[first_entry].buf = des;
+
+		tc956xmac_set_desc_addr(priv, first, des);
+
+		tx_q->tx_skbuff_dma[first_entry].len = nopaged_len;
+		tx_q->tx_skbuff_dma[first_entry].last_segment = last_segment;
+
+		if (unlikely((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+			     priv->hwts_tx_en)) {
+			/* declare that device is doing timestamping */
+			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+			tc956xmac_enable_tx_timestamp(priv, first);
+		}
+
+		/* Prepare the first descriptor setting the OWN bit too */
+		tc956xmac_prepare_tx_desc(priv, first, 1, nopaged_len,
+				csum_insertion, priv->tx_crc_pad_state,
+				priv->mode, 0, last_segment, skb->len);
+	}
+
+	if (tx_q->tbs & TC956XMAC_TBS_EN) {
+		/* Check if timestamp_valid bit is enabled */
+		if (skb->data[19] & 0x01) {
+			struct timespec64 ts = ns_to_timespec64(skb->tstamp);
+			u32 Presentation_time, Traverse_time, app_launch_time;
+			u64 ns, lt;
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+			u64 quotient;
+			u32 reminder;
+#endif
+			unsigned long flags;
+
+			if (skb->tstamp) {
+				ts = ns_to_timespec64(skb->tstamp);
+			} else {
+				Presentation_time = skb->data[30];
+				Presentation_time = (Presentation_time<<8) |
+							 skb->data[31];
+				Presentation_time = (Presentation_time<<8) |
+							skb->data[32];
+				Presentation_time = (Presentation_time<<8) |
+							skb->data[33];
+#ifdef TC956X_SRIOV_VF
+				if ((priv->plat->avb_class_b_ch_no == queue)
+					&& (priv->plat->best_effort_ch_no != priv->plat->avb_class_b_ch_no))
+#else
+				if (queue == AVB_CLASS_B_TX_CH)
+#endif
+					Traverse_time = 50000000; /* Class B - 50ms */
+#ifdef TC956X_SRIOV_VF
+				else if ((priv->plat->avb_class_a_ch_no == queue)
+					&& (priv->plat->best_effort_ch_no != priv->plat->avb_class_a_ch_no))
+#else
+				else if (queue == AVB_CLASS_A_TX_CH)
+#endif
+					Traverse_time = 2000000; /* Class A- 2ms */
+				else
+					Traverse_time = 0; /* default */
+
+				if (Presentation_time >= Traverse_time)
+					app_launch_time =
+						Presentation_time - Traverse_time;
+				else
+					app_launch_time =
+						0x100000000ULL - Traverse_time +
+						 Presentation_time;
+
+				spin_lock_irqsave(&priv->ptp_lock, flags);
+				tc956xmac_get_systime(priv, priv->ptpaddr, &ns);
+				spin_unlock_irqrestore(&priv->ptp_lock, flags);
+
+				lt = ((ns >> 32) << 32) | app_launch_time;
+				if (((signed long)app_launch_time - (signed long)(ns & 0xFFFFFFFF)) < 0) {
+					/* If the difference is 2 seconds apart, it is judged as rollover */
+					if (((ns & 0xFFFFFFFF) - app_launch_time) > ((1ULL << 32) / 2))
+						lt += (u64)((u64)1 << 32);
+				}
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+				quotient = div_u64_rem(lt, 1000000000ULL,
+						&reminder);
+				ts.tv_sec = quotient & 0xFF;
+				ts.tv_nsec = reminder;
+#else
+				ts.tv_sec  = (lt / 1000000000) & 0xFF;
+				ts.tv_nsec = (lt % 1000000000);
+#endif
+			}
+			tbs_desc = &tx_q->dma_entx[first_entry];
+			tc956xmac_set_desc_tbs(priv, tbs_desc, ts.tv_sec, ts.tv_nsec, true);
+		} else {
+			tbs_desc = &tx_q->dma_entx[first_entry];
+			tc956xmac_set_desc_tbs(priv, tbs_desc, 0, 0, false);
+		}
+	}
+
+	tc956xmac_set_tx_owner(priv, first);
+
+	/* The own bit must be the latest setting done when prepare the
+	 * descriptor and then barrier is needed to make sure that
+	 * all is coherent before granting the DMA engine.
+	 */
+	wmb();
+
+	netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len);
+
+	tc956xmac_enable_dma_transmission(priv, priv->ioaddr);
+
+	if (likely(priv->extend_desc))
+		desc_size = sizeof(struct dma_extended_desc);
+	else if (tx_q->tbs & TC956XMAC_TBS_AVAIL)
+		desc_size = sizeof(struct dma_edesc);
+	else
+		desc_size = sizeof(struct dma_desc);
+
+	tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * desc_size);
+	tc956xmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
+
+#ifdef ENABLE_TX_TIMER
+	tc956xmac_tx_timer_arm(priv, queue);
+#endif
+
+#ifdef TX_COMPLETION_WITHOUT_TIMERS
+	writel(1, priv->tc956x_SRAM_pci_base_addr
+			+ TX_TIMER_SRAM_OFFSET(priv->port_num));
+#endif
+
+	return NETDEV_TX_OK;
+
+dma_map_err:
+	netdev_err(priv->dev, "Tx DMA map failed\n");
+	dev_kfree_skb(skb);
+	priv->dev->stats.tx_dropped++;
+	return NETDEV_TX_OK;
+}
+
+#ifndef TC956X
+/**
+ *  tc956xmac_rx_vlan - Rx VLAN Stripping Function
+ *  @dev : device pointer
+ *  @skb : the socket buffer
+ *  Description : this function strips vlan id from the skb
+ *  before forwarding to application.
+ */
+static void tc956xmac_rx_vlan(struct net_device *dev, struct sk_buff *skb)
+{
+	struct vlan_ethhdr *veth;
+	__be16 vlan_proto;
+	u16 vlanid;
+
+	veth = (struct vlan_ethhdr *)skb->data;
+	vlan_proto = veth->h_vlan_proto;
+
+	if ((vlan_proto == htons(ETH_P_8021Q) &&
+	     dev->features & NETIF_F_HW_VLAN_CTAG_RX) ||
+	    (vlan_proto == htons(ETH_P_8021AD) &&
+	     dev->features & NETIF_F_HW_VLAN_STAG_RX)) {
+		/* pop the vlan tag */
+		vlanid = ntohs(veth->h_vlan_TCI);
+		memmove(skb->data + VLAN_HLEN, veth, ETH_ALEN * 2);
+		skb_pull(skb, VLAN_HLEN);
+		__vlan_hwaccel_put_tag(skb, vlan_proto, vlanid);
+	}
+}
+#else
+/**
+ *  tc956xmac_rx_vlan - Rx VLAN Stripping Function
+ *  @dev : device pointer
+ *  @rdesc : rx descriptor
+ *  @skb : the socket buffer
+ *  Description : this function extracts vlan id from the descriptor
+ *  stripped by MAC VLAN filter.
+ */
+static void tc956xmac_rx_vlan(struct net_device *dev,
+				struct dma_desc *rdesc,
+				struct sk_buff *skb)
+{
+	u16 vlanid;
+	u32 err, etlt;
+
+	/* Check for error in descriptor */
+	err = XGMAC_GET_BITS_LE(rdesc->des3, XGMAC_RDES3, ES);
+	/* Check for L2 Packet Type Encoding */
+	etlt = XGMAC_GET_BITS_LE(rdesc->des3, XGMAC_RDES3, ETLT);
+	if (!err) {
+		/* No error if err is 0 or etlt is 0
+		 * Check packet type is Single CVLAN tag and
+		 * netdev supports VLAN CTAG
+		 */
+		if ((etlt == PKT_TYPE_SINGLE_CVLAN) &&
+		    (dev->features & NETIF_F_HW_VLAN_CTAG_RX)) {
+			vlanid = XGMAC_GET_BITS_LE(rdesc->des0,
+							XGMAC_RDES0,
+							OVT);
+			__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
+						vlanid);
+		}
+	}
+}
+#endif
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static inline int tc956xmac_rx_threshold_count(struct tc956xmac_rx_queue *rx_q)
+{
+	if (rx_q->rx_zeroc_thresh < TC956XMAC_RX_THRESH)
+		return 0;
+
+	return 1;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+/**
+ * tc956xmac_rx_refill - refill used skb preallocated buffers
+ * @priv: driver private structure
+ * @queue: RX queue index
+ * Description : this is to reallocate the skb for the reception process
+ * that is based on zero-copy.
+ */
+static inline void tc956xmac_rx_refill(struct tc956xmac_priv *priv, u32 queue)
+{
+	struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+	int len, dirty = tc956xmac_rx_dirty(priv, queue);
+	unsigned int entry = rx_q->dirty_rx;
+
+	len = DIV_ROUND_UP(priv->dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
+
+	while (dirty-- > 0) {
+		struct tc956xmac_rx_buffer *buf = &rx_q->buf_pool[entry];
+		struct dma_desc *p;
+		bool use_rx_wd;
+
+		if (priv->extend_desc)
+			p = (struct dma_desc *)(rx_q->dma_erx + entry);
+		else
+			p = rx_q->dma_rx + entry;
+
+		if (!buf->page) {
+			buf->page = page_pool_dev_alloc_pages(rx_q->page_pool);
+			if (!buf->page)
+				break;
+		}
+
+		if (priv->sph && !buf->sec_page) {
+			buf->sec_page = page_pool_dev_alloc_pages(rx_q->page_pool);
+			if (!buf->sec_page)
+				break;
+
+			buf->sec_addr = page_pool_get_dma_addr(buf->sec_page);
+
+			dma_sync_single_for_device(priv->device, buf->sec_addr,
+						   len, DMA_FROM_DEVICE);
+		}
+
+		buf->addr = page_pool_get_dma_addr(buf->page);
+
+		/* Sync whole allocation to device. This will invalidate old
+		 * data.
+		 */
+		dma_sync_single_for_device(priv->device, buf->addr, len,
+					   DMA_FROM_DEVICE);
+
+		tc956xmac_set_desc_addr(priv, p, buf->addr);
+		tc956xmac_set_desc_sec_addr(priv, p, buf->sec_addr);
+		tc956xmac_refill_desc3(priv, rx_q, p);
+
+		rx_q->rx_count_frames++;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+		rx_q->rx_count_frames += priv->rx_coal_frames[queue];
+		if (rx_q->rx_count_frames > priv->rx_coal_frames[queue])
+			rx_q->rx_count_frames = 0;
+
+		use_rx_wd = !priv->rx_coal_frames[queue];
+#else
+		rx_q->rx_count_frames += priv->rx_coal_frames;
+		if (rx_q->rx_count_frames > priv->rx_coal_frames)
+			rx_q->rx_count_frames = 0;
+
+		use_rx_wd = !priv->rx_coal_frames;
+#endif
+		use_rx_wd |= rx_q->rx_count_frames > 0;
+		if (!priv->use_riwt)
+			use_rx_wd = false;
+
+		dma_wmb();
+		tc956xmac_set_rx_owner(priv, p, use_rx_wd);
+
+		entry = TC956XMAC_GET_ENTRY(entry, DMA_RX_SIZE);
+	}
+	rx_q->dirty_rx = entry;
+	rx_q->rx_tail_addr = rx_q->dma_rx_phy +
+			    (rx_q->dirty_rx * sizeof(struct dma_desc));
+	tc956xmac_set_rx_tail_ptr(priv, priv->ioaddr, rx_q->rx_tail_addr, queue);
+}
+
+static unsigned int tc956xmac_rx_buf1_len(struct tc956xmac_priv *priv,
+				       struct dma_desc *p,
+				       int status, unsigned int len)
+{
+	int ret, coe = priv->hw->rx_csum;
+	unsigned int plen = 0, hlen = 0;
+
+	/* Not first descriptor, buffer is always zero */
+	if (priv->sph && len)
+		return 0;
+
+	/* First descriptor, get split header length */
+	ret = tc956xmac_get_rx_header_len(priv, p, &hlen);
+	if (priv->sph && hlen) {
+		priv->xstats.rx_split_hdr_pkt_n++;
+		return hlen;
+	}
+
+	/* First descriptor, not last descriptor and not split header */
+	if (status & rx_not_ls)
+		return priv->dma_buf_sz;
+
+	plen = tc956xmac_get_rx_frame_len(priv, p, coe);
+
+	/* First descriptor and last descriptor and not split header */
+	return min_t(unsigned int, priv->dma_buf_sz, plen);
+}
+
+static unsigned int tc956xmac_rx_buf2_len(struct tc956xmac_priv *priv,
+				       struct dma_desc *p,
+				       int status, unsigned int len)
+{
+	int coe = priv->hw->rx_csum;
+	unsigned int plen = 0;
+
+	/* Not split header, buffer is not available */
+	if (!priv->sph)
+		return 0;
+
+	/* Not last descriptor */
+	if (status & rx_not_ls)
+		return priv->dma_buf_sz;
+
+	plen = tc956xmac_get_rx_frame_len(priv, p, coe);
+
+	/* Last descriptor */
+	return plen - len;
+}
+
+/**
+ * tc956xmac_rx - manage the receive process
+ * @priv: driver private structure
+ * @limit: napi bugget
+ * @queue: RX queue index.
+ * Description :  this the function called by the napi poll method.
+ * It gets all the frames inside the ring.
+ */
+static int tc956xmac_rx(struct tc956xmac_priv *priv, int limit, u32 queue)
+{
+	struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+	struct tc956xmac_channel *ch = &priv->channel[queue];
+	unsigned int count = 0, error = 0, len = 0, per_queue_count = 0;
+	int status = 0, coe = priv->hw->rx_csum;
+	unsigned int next_entry = rx_q->cur_rx;
+	struct sk_buff *skb = NULL;
+	unsigned int proto;
+
+	if (netif_msg_rx_status(priv)) {
+		void *rx_head;
+
+		netdev_dbg(priv->dev, "%s: descriptor ring:\n", __func__);
+		if (priv->extend_desc)
+			rx_head = (void *)rx_q->dma_erx;
+		else
+			rx_head = (void *)rx_q->dma_rx;
+
+		tc956xmac_display_ring(priv, rx_head, DMA_RX_SIZE, true);
+	}
+	while (count < limit) {
+		unsigned int buf1_len = 0, buf2_len = 0;
+		enum pkt_hash_types hash_type;
+		struct tc956xmac_rx_buffer *buf;
+		struct dma_desc *np, *p;
+		int entry;
+		u32 hash;
+
+		if (!count && rx_q->state_saved) {
+			skb = rx_q->state.skb;
+			error = rx_q->state.error;
+			len = rx_q->state.len;
+		} else {
+			rx_q->state_saved = false;
+			skb = NULL;
+			error = 0;
+			len = 0;
+		}
+
+		if (count >= limit)
+			break;
+
+read_again:
+		buf1_len = 0;
+		buf2_len = 0;
+		entry = next_entry;
+		buf = &rx_q->buf_pool[entry];
+
+		if (priv->extend_desc)
+			p = (struct dma_desc *)(rx_q->dma_erx + entry);
+		else
+			p = rx_q->dma_rx + entry;
+
+		/* read the status of the incoming frame */
+		status = tc956xmac_rx_status(priv, &priv->dev->stats,
+				&priv->xstats, p);
+		/* check if managed by the DMA otherwise go ahead */
+		if (unlikely(status & dma_own))
+			break;
+
+		rx_q->cur_rx = TC956XMAC_GET_ENTRY(rx_q->cur_rx, DMA_RX_SIZE);
+		next_entry = rx_q->cur_rx;
+
+		if (priv->extend_desc)
+			np = (struct dma_desc *)(rx_q->dma_erx + next_entry);
+		else
+			np = rx_q->dma_rx + next_entry;
+
+		prefetch(np);
+
+		if (priv->extend_desc)
+			tc956xmac_rx_extended_status(priv, &priv->dev->stats,
+					&priv->xstats, rx_q->dma_erx + entry);
+		if (unlikely(status == discard_frame)) {
+			page_pool_recycle_direct(rx_q->page_pool, buf->page);
+			buf->page = NULL;
+			error = 1;
+			if (!priv->hwts_rx_en)
+				priv->dev->stats.rx_errors++;
+		}
+
+		if (unlikely(error && (status & rx_not_ls)))
+			goto read_again;
+		if (unlikely(error)) {
+			dev_kfree_skb(skb);
+			skb = NULL;
+			count++;
+			continue;
+		}
+
+		/* Buffer is good. Go on. */
+
+		prefetch(page_address(buf->page));
+		if (buf->sec_page)
+			prefetch(page_address(buf->sec_page));
+
+		buf1_len = tc956xmac_rx_buf1_len(priv, p, status, len);
+		len += buf1_len;
+		buf2_len = tc956xmac_rx_buf2_len(priv, p, status, len);
+		len += buf2_len;
+
+		/* CRC stripping is done in MAC (CST &ACS bits) based on ethtool state*/
+		if (!skb) {
+			skb = napi_alloc_skb(&ch->rx_napi, buf1_len);
+			if (!skb) {
+				priv->dev->stats.rx_dropped++;
+				count++;
+				goto drain_data;
+			}
+
+			dma_sync_single_for_cpu(priv->device, buf->addr,
+						buf1_len, DMA_FROM_DEVICE);
+			skb_copy_to_linear_data(skb, page_address(buf->page),
+						buf1_len);
+			skb_put(skb, buf1_len);
+
+			/* Data payload copied into SKB, page ready for recycle */
+			page_pool_recycle_direct(rx_q->page_pool, buf->page);
+			buf->page = NULL;
+		} else if (buf1_len) {
+			dma_sync_single_for_cpu(priv->device, buf->addr,
+						buf1_len, DMA_FROM_DEVICE);
+			skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+					buf->page, 0, buf1_len,
+					priv->dma_buf_sz);
+
+			/* Data payload appended into SKB */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
+			page_pool_release_page(rx_q->page_pool, buf->page);
+#else
+			skb_mark_for_recycle(skb);
+#endif
+			buf->page = NULL;
+		}
+
+		if (buf2_len) {
+			dma_sync_single_for_cpu(priv->device, buf->sec_addr,
+						buf2_len, DMA_FROM_DEVICE);
+			skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+					buf->sec_page, 0, buf2_len,
+					priv->dma_buf_sz);
+
+			/* Data payload appended into SKB */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
+			page_pool_release_page(rx_q->page_pool, buf->sec_page);
+#else
+			skb_mark_for_recycle(skb);
+#endif
+
+			buf->sec_page = NULL;
+		}
+
+drain_data:
+		if (likely(status & rx_not_ls))
+			goto read_again;
+		if (!skb)
+			continue;
+
+		/* Got entire packet into SKB. Finish it. */
+#ifdef RX_LOGGING_TRACE
+		tc956xmac_get_rx_hwtstamp(priv, p, np, skb, queue);
+#else
+		/* Pause frame counter to count link partner pause frames */
+		if ((mac0_en_lp_pause_frame_cnt == ENABLE && priv->port_num == RM_PF0_ID) ||
+			(mac1_en_lp_pause_frame_cnt == ENABLE && priv->port_num == RM_PF1_ID)) {
+			proto = htons(((skb->data[13]<<8) | skb->data[12]));
+			if (proto == ETH_P_PAUSE) {
+				if (!(skb->data[6] == phy_sa_addr[priv->port_num][0] && skb->data[7] == phy_sa_addr[priv->port_num][1]
+					&& skb->data[8] == phy_sa_addr[priv->port_num][2] && skb->data[9] == phy_sa_addr[priv->port_num][3]
+					&& skb->data[10] == phy_sa_addr[priv->port_num][4] && skb->data[11] == phy_sa_addr[priv->port_num][5])) {
+					priv->xstats.link_partner_pause_frame_cnt++;
+				}
+			}
+		}
+
+		tc956xmac_get_rx_hwtstamp(priv, p, np, skb);
+#endif
+#ifndef TC956X
+		tc956xmac_rx_vlan(priv->dev, skb);
+#else
+		tc956xmac_rx_vlan(priv->dev, p, skb);
+#endif
+		skb->protocol = eth_type_trans(skb, priv->dev);
+
+		if (unlikely(!coe))
+			skb_checksum_none_assert(skb);
+		else
+			skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+		if (!tc956xmac_get_rx_hash(priv, p, &hash, &hash_type))
+			skb_set_hash(skb, hash, hash_type);
+
+		skb_record_rx_queue(skb, queue);
+		napi_gro_receive(&ch->rx_napi, skb);
+		skb = NULL;
+
+		priv->dev->stats.rx_packets++;
+		priv->dev->stats.rx_bytes += len;
+		count++;
+		per_queue_count++;
+	}
+
+	if (status & rx_not_ls || skb) {
+		rx_q->state_saved = true;
+		rx_q->state.skb = skb;
+		rx_q->state.error = error;
+		rx_q->state.len = len;
+	}
+
+	tc956xmac_rx_refill(priv, queue);
+
+	/* priv->xstats.rx_pkt_n[queue]+= count; */
+	/* Count only Acceptd packet */
+	priv->xstats.rx_pkt_n[queue] += per_queue_count;
+
+
+	return count;
+}
+
+static int tc956xmac_napi_poll_rx(struct napi_struct *napi, int budget)
+{
+	struct tc956xmac_channel *ch =
+		container_of(napi, struct tc956xmac_channel, rx_napi);
+	struct tc956xmac_priv *priv = ch->priv_data;
+	u32 chan = ch->index;
+	int work_done;
+
+	priv->xstats.napi_poll_rx[chan]++;
+
+	work_done = tc956xmac_rx(priv, budget, chan);
+	if (work_done < budget && napi_complete_done(napi, work_done)) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&ch->lock, flags);
+		tc956xmac_enable_dma_irq(priv, priv->ioaddr, chan, 1, 0);
+		spin_unlock_irqrestore(&ch->lock, flags);
+	}
+
+	return work_done;
+}
+
+static int tc956xmac_napi_poll_tx(struct napi_struct *napi, int budget)
+{
+	struct tc956xmac_channel *ch =
+		container_of(napi, struct tc956xmac_channel, tx_napi);
+	struct tc956xmac_priv *priv = ch->priv_data;
+	u32 chan = ch->index;
+	int work_done;
+
+	priv->xstats.napi_poll_tx[chan]++;
+
+	work_done = tc956xmac_tx_clean(priv, DMA_TX_SIZE, chan);
+	work_done = min(work_done, budget);
+
+	if (work_done < budget && napi_complete_done(napi, work_done)) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&ch->lock, flags);
+		tc956xmac_enable_dma_irq(priv, priv->ioaddr, chan, 0, 1);
+		spin_unlock_irqrestore(&ch->lock, flags);
+	}
+
+	return work_done;
+}
+
+/**
+ *  tc956xmac_tx_timeout
+ *  @dev : Pointer to net device structure
+ *  Description: this function is called when a packet transmission fails to
+ *   complete within a reasonable time. The driver will mark the error in the
+ *   netdev structure and arrange for the device to be reset to a sane state
+ *   in order to transmit a new packet.
+ */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+static void tc956xmac_tx_timeout(struct net_device *dev, unsigned int txqueue)
+#else
+static void tc956xmac_tx_timeout(struct net_device *dev)
+#endif
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	tc956xmac_global_err(priv);
+}
+
+#ifdef TC956X_SRIOV_VF
+static int tc956x_vf_add_mac_addr(struct net_device *dev, const unsigned char *mac)
+{
+	int ret_value;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	ret_value = tc956xmac_add_mac(priv, mac);
+
+	return ret_value;
+}
+
+static int tc956x_vf_delete_mac_addr(struct net_device *dev,
+				const unsigned char *mac)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	tc956xmac_delete_mac(priv, mac);
+	return 0;
+}
+static void tc956x_vf_set_filter(struct mac_device_info *hw,
+				struct net_device *dev)
+{
+	__dev_uc_sync(dev, tc956x_vf_add_mac_addr, tc956x_vf_delete_mac_addr);
+
+	__dev_mc_sync(dev, tc956x_vf_add_mac_addr, tc956x_vf_delete_mac_addr);
+}
+#endif
+
+/**
+ *  tc956xmac_set_rx_mode - entry point for multicast addressing
+ *  @dev : pointer to the device structure
+ *  Description:
+ *  This function is a driver entry point which gets called by the kernel
+ *  whenever multicast addresses must be enabled/disabled.
+ *  Return value:
+ *  void.
+ */
+static void tc956xmac_set_rx_mode(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#ifndef TC956X_SRIOV_VF
+	tc956xmac_set_filter(priv, priv->hw, dev);
+#else
+	tc956x_vf_set_filter(priv->hw, dev);
+#endif
+}
+
+/**
+ *  tc956xmac_change_mtu - entry point to change MTU size for the device.
+ *  @dev : device pointer.
+ *  @new_mtu : the new MTU size for the device.
+ *  Description: the Maximum Transfer Unit (MTU) is used by the network layer
+ *  to drive packet transmission. Ethernet has an MTU of 1500 octets
+ *  (ETH_DATA_LEN). This value can be changed with ifconfig.
+ *  Return value:
+ *  0 on success and an appropriate (-)ve integer as defined in errno.h
+ *  file on failure.
+ */
+static int tc956xmac_change_mtu(struct net_device *dev, int new_mtu)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	int txfifosz = priv->plat->tx_fifo_size;
+
+
+	if (txfifosz == 0)
+		txfifosz = priv->dma_cap.tx_fifo_size;
+
+	txfifosz /= priv->plat->tx_queues_to_use;
+
+#ifndef TC956X_CPE_CONFIG
+	/* Dynamic MTU change is supported, so below condition is commented in CPE configuration */
+	if (netif_running(dev)) {
+		netdev_err(priv->dev, "must be stopped to change its MTU\n");
+		return -EBUSY;
+	}
+
+	/* Alignment of MTU reported to upper layers is not required in CPE configuration */
+	new_mtu = TC956XMAC_ALIGN(new_mtu);
+#endif
+#ifdef TC956X
+#ifdef TC956X_CPE_CONFIG
+	/* Supported frame sizes */
+	if ((new_mtu < MIN_SUPPORTED_MTU) || (new_mtu > MAX_SUPPORTED_MTU)) {
+		NMSGPR_ALERT(priv->device,
+		       "%s: invalid MTU, min %d and max %d MTU are supported\n",
+		       dev->name, MIN_SUPPORTED_MTU, MAX_SUPPORTED_MTU);
+		return -EINVAL;
+	}
+#else
+	/* Supported frame sizes */
+	if ((new_mtu < MIN_SUPPORTED_MTU) || (new_mtu > JUMBO_LEN)) {
+		NMSGPR_ALERT(priv->device,
+		       "%s: invalid MTU, min %d and max %d MTU are supported\n",
+		       dev->name, MIN_SUPPORTED_MTU, JUMBO_LEN);
+		return -EINVAL;
+	}
+#endif
+#else
+	/* If condition true, FIFO is too small or MTU too large */
+	if ((txfifosz < new_mtu) || (new_mtu > BUF_SIZE_16KiB))
+		return -EINVAL;
+#endif
+	dev->mtu = new_mtu;
+
+	netdev_update_features(dev);
+
+	return 0;
+}
+
+static netdev_features_t tc956xmac_fix_features(struct net_device *dev,
+					     netdev_features_t features)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+
+#ifdef TC956X_SRIOV_VF
+	/* Update dev->feature RX Checksum and RX FCS flags based on states
+	 * received from PF via mailbox.
+	 */
+	if (priv->rx_csum_state)
+		features |= NETIF_F_RXCSUM;
+	else
+		features &= ~NETIF_F_RXCSUM;
+
+	if (priv->rx_crc_pad_state)
+		features &= ~NETIF_F_RXFCS;
+	else
+		features |= NETIF_F_RXFCS;
+#endif
+	if (priv->plat->rx_coe == TC956XMAC_RX_COE_NONE)
+		features &= ~NETIF_F_RXCSUM;
+
+	if (!priv->plat->tx_coe)
+		features &= ~NETIF_F_CSUM_MASK;
+
+	/* Some GMAC devices have a bugged Jumbo frame support that
+	 * needs to have the Tx COE disabled for oversized frames
+	 * (due to limited buffer sizes). In this case we disable
+	 * the TX csum insertion in the TDES and not use SF.
+	 */
+	if (priv->plat->bugged_jumbo && (dev->mtu > ETH_DATA_LEN))
+		features &= ~NETIF_F_CSUM_MASK;
+
+#ifdef TC956X_SRIOV_PF
+	/* Disable tso if asked by ethtool */
+	if ((priv->plat->tso_en) && (priv->dma_cap.tsoen)) {
+		if (features & NETIF_F_TSO) {
+			priv->tso = true;
+			/* Update driver cap to let VF know about
+			 * feature enable/disable
+			 */
+			priv->pf_drv_cap.tso_en = true;
+		} else {
+			priv->tso = false;
+			/* Update driver cap to let VF know about
+			 * feature enable/disable
+			 */
+			priv->pf_drv_cap.tso_en = false;
+		}
+	}
+#elif defined TC956X_SRIOV_VF
+	if (priv->pf_drv_cap.tso_en) {
+		/* Disable tso if asked by ethtool */
+		if ((priv->plat->tso_en) && (priv->dma_cap.tsoen)) {
+			if (features & NETIF_F_TSO)
+				priv->tso = true;
+			else
+				priv->tso = false;
+		}
+	}
+#endif
+
+	return features;
+}
+
+static int tc956xmac_set_features(struct net_device *netdev,
+			       netdev_features_t features)
+{
+	struct tc956xmac_priv *priv = netdev_priv(netdev);
+	bool sph_en;
+	u32 chan;
+#ifdef TC956X
+	netdev_features_t txvlan, rxvlan, rxvlan_filter;
+
+	rxvlan = (netdev->features & NETIF_F_HW_VLAN_CTAG_RX);
+	txvlan = (netdev->features & NETIF_F_HW_VLAN_CTAG_TX);
+	rxvlan_filter = (netdev->features & NETIF_F_HW_VLAN_CTAG_FILTER);
+#endif
+
+#ifdef TC956X_SRIOV_VF
+	/* RX CSUM is handled in PF as it impacts all drivers */
+	if (priv->pf_drv_cap.csum_en)
+		priv->hw->rx_csum = priv->plat->rx_coe;
+	else
+		priv->hw->rx_csum = 0;
+#else
+	/* Keep the COE Type in case of csum is supporting */
+	if (features & NETIF_F_RXCSUM) {
+		if (priv->hw->rx_csum != priv->plat->rx_coe) {
+			priv->hw->rx_csum = priv->plat->rx_coe;
+			priv->rx_csum_state = priv->hw->rx_csum;
+#ifdef TC956X_SRIOV_PF
+			tc956x_mbx_wrap_set_rx_csum(priv);
+#endif
+		}
+	} else {
+		if (priv->hw->rx_csum != 0) {
+			priv->hw->rx_csum = 0;
+			priv->rx_csum_state = priv->hw->rx_csum;
+#ifdef TC956X_SRIOV_PF
+			tc956x_mbx_wrap_set_rx_csum(priv);
+#endif
+		}
+	}
+
+	/* No check needed because rx_coe has been set before and it will be
+	 * fixed in case of issue.
+	 */
+	tc956xmac_rx_ipc(priv, priv->hw);
+#endif
+	/* Tx Checksum Configuration via Ethtool */
+	if ((features & NETIF_F_IP_CSUM) || (features & NETIF_F_IPV6_CSUM))
+		priv->csum_insertion = 1;
+	else
+		priv->csum_insertion = 0;
+
+	KPRINT_DEBUG1("priv->csum_insertion = %d\n", priv->csum_insertion);
+#ifdef TC956X_SRIOV_PF /* Clean up needed */
+	/* Rx fcs Configuration via Ethtool */
+	if (features & NETIF_F_RXFCS) {
+		if (priv->rx_crc_pad_state != (priv->rx_crc_pad_state & (~TC956X_RX_CRC_DEFAULT))) {
+			priv->rx_crc_pad_state &= (~TC956X_RX_CRC_DEFAULT);
+			tc956x_mbx_wrap_set_rx_crc(priv);
+		}
+	} else {
+		if (priv->rx_crc_pad_state != TC956X_RX_CRC_DEFAULT) {
+			priv->rx_crc_pad_state = TC956X_RX_CRC_DEFAULT;
+			tc956x_mbx_wrap_set_rx_crc(priv);
+		}
+	}
+
+	tc956x_rx_crc_pad_config(priv, priv->rx_crc_pad_state);
+	KPRINT_DEBUG1("priv->rx_crc_pad_state = %d\n", priv->rx_crc_pad_state);
+
+	sph_en = (priv->hw->rx_csum > 0) && priv->sph;
+	for (chan = 0; chan < priv->plat->rx_queues_to_use; chan++)
+		tc956xmac_enable_sph(priv, priv->ioaddr, sph_en, chan);
+
+#elif defined TC956X_SRIOV_VF
+	/* Rx fcs Configuration via Ethtool */
+	if (features & NETIF_F_RXFCS) {
+		priv->rx_crc_pad_state &= (~TC956X_RX_CRC_DEFAULT);
+	} else {
+#ifdef TC956X
+		priv->rx_crc_pad_state = TC956X_RX_CRC_DEFAULT;
+#endif
+	}
+
+	sph_en = (priv->hw->rx_csum > 0) && priv->sph;
+	for (chan = 0; chan < priv->plat->rx_queues_to_use; chan++) {
+		if (priv->plat->ch_in_use[chan] == 0)
+			continue;
+		tc956xmac_enable_sph(priv, priv->ioaddr, sph_en, chan);
+	}
+#endif
+#ifdef TC956X
+	if ((features & NETIF_F_HW_VLAN_CTAG_RX) && !rxvlan)
+		tc956xmac_enable_rx_vlan_stripping(priv, priv->hw);
+	else if (!(features & NETIF_F_HW_VLAN_CTAG_RX) && rxvlan)
+		tc956xmac_disable_rx_vlan_stripping(priv, priv->hw);
+
+	if ((features & NETIF_F_HW_VLAN_CTAG_TX) && !txvlan)
+		tc956xmac_enable_vlan(priv, priv->hw, TC956XMAC_VLAN_INSERT);
+	else if (!(features & NETIF_F_HW_VLAN_CTAG_TX) && txvlan)
+		tc956xmac_disable_tx_vlan(priv, priv->hw);
+
+	if ((features & NETIF_F_HW_VLAN_CTAG_FILTER) && !rxvlan_filter)
+		tc956xmac_enable_rx_vlan_filtering(priv, priv->hw);
+	else if (!(features & NETIF_F_HW_VLAN_CTAG_FILTER) && rxvlan_filter)
+		tc956xmac_disable_rx_vlan_filtering(priv, priv->hw);
+#endif
+	return 0;
+}
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_CPE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+/**
+ * tc956xmac_rx_dma_error_recovery
+ *
+ * \brief API to handle and recover from the dma err
+ *
+ * \details This function is used to handle and recover from the dma error
+ *
+ * \param[in] priv - Pointer to device's private structure
+ *
+ * \return None
+ */
+static void tc956xmac_rx_dma_error_recovery(struct tc956xmac_priv *priv)
+{
+	u8 ch;
+	u32 intr_status = 0;
+	u32 reg_val = 0;
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+	unsigned long flags;
+#endif
+	for (ch = 0; ch < TC956XMAC_CH_MAX; ch++) {
+		intr_status = 0;
+		reg_val = 0;
+
+		intr_status = readl(priv->ioaddr + XGMAC_DMA_CH_STATUS(ch));
+
+		if ((intr_status & TC956X_DMA_RX_FBE) && (intr_status & TC956X_DMA_RX_RPS)) {
+			reg_val = readl(priv->ioaddr + XGMAC_DMA_CH_RX_CONTROL(ch));
+			reg_val |= 0x80000000;  //set bit 31 to flush ch
+			writel(reg_val, priv->ioaddr + XGMAC_DMA_CH_RX_CONTROL(ch));
+			writel(intr_status, priv->ioaddr + XGMAC_DMA_CH_STATUS(ch));
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+			spin_lock_irqsave(&priv->wq_lock, flags);
+			priv->mbx_wq_param.fn_id = SCH_WQ_RX_DMA_ERR;
+			tc956xmac_service_mbx_event_schedule(priv);
+			spin_unlock_irqrestore(&priv->wq_lock, flags);
+#endif
+		}
+	}
+}
+#endif
+
+
+
+
+#if defined(TC956X_SRIOV_PF) && (defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_CPE_CONFIG))
+static irqreturn_t tc956xmac_interrupt_v0(int irq, void *dev_id)
+{
+	struct net_device *dev = (struct net_device *)dev_id;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#ifndef TC956X_SRIOV_VF
+	u32 val = 0;
+#endif
+	bool xmac;
+	u32 queue;
+#if defined(TC956X_DMA_OFFLOAD_ENABLE)
+	uint32_t uiIntSts, uiIntclr = 0;
+	u32 value = 0;
+#endif
+	u32 queues_count;
+#ifdef TC956X_SRIOV_VF
+	enum mbx_msg_fns msg_src;
+	u8 i;
+#endif
+
+#ifdef TC956X
+	u32 rx_cnt = priv->plat->rx_queues_to_use;
+	u32 tx_cnt = priv->plat->tx_queues_to_use;
+
+	queues_count = (rx_cnt > tx_cnt) ? rx_cnt : tx_cnt;
+#endif
+
+	xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
+
+	if (priv->irq_wake)
+		pm_wakeup_event(priv->device, 0);
+
+	if (unlikely(!dev)) {
+		netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
+		return IRQ_NONE;
+	}
+
+	/* Check if adapter is up */
+	if (test_bit(TC956XMAC_DOWN, &priv->state))
+		return IRQ_HANDLED;
+	/* Check if a fatal error happened */
+	if (tc956xmac_safety_feat_interrupt(priv))
+		return IRQ_HANDLED;
+
+	val = readl(priv->ioaddr + TC956X_MSI_INT_STS_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+	priv->xstats.total_interrupts++;
+
+	if (val & (0xFF << 3))
+		priv->xstats.tx_intr_n++;
+
+	if (val & (0xFF << 11))
+		priv->xstats.rx_intr_n++;
+
+	/* Checking if any RBUs occurred and updating the statistics corresponding to channel */
+	if (val & (1 << 0))
+		priv->xstats.lpi_intr_n++;
+
+	if (val & (1 << 1))
+		priv->xstats.pmt_intr_n++;
+
+	if (val & (1 << 2))
+		priv->xstats.event_intr_n++;
+
+	if (val & (1 << 19))
+		priv->xstats.xpcs_intr_n++;
+
+	if (val & (1 << 20))
+		priv->xstats.phy_intr_n++;
+
+	if (val & (1 << 24))
+		priv->xstats.sw_msi_n++;
+
+#if defined(TC956X_DMA_OFFLOAD_ENABLE)
+	for (queue = 0; queue < queues_count; queue++) {
+		uiIntSts = readl(priv->ioaddr + XGMAC_DMA_CH_STATUS(queue));
+
+		/* Assuming DMA Tx and Rx channels are used as pairs */
+		if ((priv->plat->tx_ch_in_use[queue] != TC956X_ENABLE_CHNL) ||
+		    (priv->plat->rx_ch_in_use[queue] != TC956X_ENABLE_CHNL)) {
+			uiIntSts = readl(priv->ioaddr + XGMAC_DMA_CH_STATUS(queue));
+			/* Handling Abnormal interrupts of NON S/W path, TI & RI are handled in FW */
+			if (unlikely(uiIntSts & XGMAC_AIS)) {
+				if (unlikely(uiIntSts & XGMAC_RBU)) {
+					priv->xstats.rx_buf_unav_irq[queue]++;
+					uiIntclr |= XGMAC_RBU;
+				}
+				if (unlikely(uiIntSts & XGMAC_TPS)) {
+					priv->xstats.tx_process_stopped_irq[queue]++;
+					uiIntclr |= XGMAC_TPS;
+				}
+				if (unlikely(uiIntSts & XGMAC_FBE)) {
+					priv->xstats.fatal_bus_error_irq[queue]++;
+					uiIntclr |= XGMAC_FBE;
+				}
+				if (unlikely(uiIntSts & XGMAC_RPS)) {
+					uiIntclr |= XGMAC_RPS;
+				}
+				uiIntclr |= XGMAC_AIS;
+				writel(uiIntclr, (priv->ioaddr + XGMAC_DMA_CH_STATUS(queue)));
+			}
+			/* Disable RBU interrupt on RBU interrupt occurance. IPA SW should enable it back */
+			value = readl(priv->ioaddr + XGMAC_DMA_CH_INT_EN(queue));
+			if (((uiIntclr & XGMAC_RBU) == XGMAC_RBU) && (value & XGMAC_RBUE)) {
+				value = readl(priv->ioaddr + XGMAC_DMA_CH_INT_EN(queue));
+				value &= ~XGMAC_RBUE;
+				writel(value, priv->ioaddr + XGMAC_DMA_CH_INT_EN(queue));
+				printk("***RBU INT disabled***XGMAC_DMA_CH_INT_EN[%d]***** :0x%x\n", queue, readl(priv->ioaddr + XGMAC_DMA_CH_INT_EN(queue)));
+			}
+		}
+	}
+#endif
+
+/* To handle GMAC own interrupts */
+	if ((priv->plat->has_gmac) || xmac) {
+		int status = tc956xmac_host_irq_status(priv, priv->hw, &priv->xstats);
+		int mtl_status;
+
+		if (unlikely(status)) {
+			/* For LPI we need to save the tx status */
+			if (status & CORE_IRQ_TX_PATH_IN_LPI_MODE)
+				priv->tx_path_in_lpi_mode = true;
+			if (status & CORE_IRQ_TX_PATH_EXIT_LPI_MODE)
+				priv->tx_path_in_lpi_mode = false;
+		}
+
+		for (queue = 0; queue < queues_count; queue++) {
+
+			struct tc956xmac_rx_queue *rx_q;
+
+#ifdef TC956X_SRIOV_PF
+			if (priv->plat->rx_q_in_use[queue] == TC956X_DISABLE_QUEUE)
+				continue;
+
+#endif
+
+			mtl_status = tc956xmac_host_mtl_irq_status(priv, priv->hw,
+								queue);
+
+			if (mtl_status != -EINVAL)
+				status |= mtl_status;
+
+			if (status & CORE_IRQ_MTL_RX_OVERFLOW) {
+				u8 pf_dma_ch;
+
+				pf_dma_ch = priv->pf_queue_dma_map[queue];
+				rx_q = &priv->rx_queue[pf_dma_ch];
+
+				tc956xmac_set_rx_tail_ptr(priv, priv->ioaddr,
+						       rx_q->rx_tail_addr,
+						       pf_dma_ch);
+			}
+		}
+
+		/* PCS link status */
+		if (priv->hw->pcs) {
+			if (priv->xstats.pcs_link)
+				netif_carrier_on(dev);
+			else
+				netif_carrier_off(dev);
+		}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+		tc956xmac_timestamp_interrupt(priv, priv->ioaddr);
+#endif
+	}
+
+	/* To handle DMA interrupts */
+	tc956xmac_dma_interrupt(priv);
+
+
+	val = readl(priv->ioaddr + TC956X_MSI_INT_STS_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+	if (val & TC956X_EXT_PHY_ETH_INT) {
+		KPRINT_INFO("PHY Interrupt %s\n", __func__);
+#ifndef TC956X_SRIOV_VF
+		if (priv->port_link_down == true)
+			tc956xmac_link_change_set_power(priv, LINK_UP); /* Restore, De-assert and Enable Reset and Clock */
+#endif
+		/* Queue the work in system_wq */
+		if (priv->tc956x_port_pm_suspend == true) {
+			KPRINT_INFO("%s : (Do not queue PHY Work during suspend. Set WOL Interrupt flag)\n", __func__);
+			priv->tc956xmac_pm_wol_interrupt = true;
+		} else {
+			KPRINT_INFO("%s : (Queue PHY Work.)\n", __func__);
+			queue_work(system_wq, &priv->emac_phy_work);
+		}
+		/* phy_mac_interrupt(priv->dev->phydev); */
+		/* MSI_OUT_EN: Reading */
+		val = readl(priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+		val &= (~(1 << MSI_INT_EXT_PHY));
+		/* MSI_OUT_EN: Writing to disable MAC Ext Interrupt*/
+		writel(val, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	}
+
+#ifdef TC956X_SW_MSI
+	val = readl(priv->ioaddr + TC956X_MSI_INT_STS_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	if (val & TC956X_SW_MSI_INT) {
+		/*Clear SW MSI*/
+		writel(1, priv->ioaddr + TC956X_MSI_SW_MSI_CLR(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+		val = readl(priv->ioaddr + TC956X_MSI_SW_MSI_CLR(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	}
+#endif
+
+	/* unmask MSI vector 0 */
+	tc956x_msi_intr_clr(priv, dev, TC956X_MSI_VECTOR_0);
+	return IRQ_HANDLED;
+}
+#else
+
+/**
+ *  tc956xmac_interrupt_v0 - main ISR
+ *  @irq: interrupt number.
+ *  @dev_id: to pass the net device pointer.
+ *  Description: this is the main driver interrupt service routine.
+ *  It can call:
+ *  o DMA service routine (to manage incoming frame reception and transmission
+ *    status)
+ *  o Core interrupts to manage: remote wake-up, management counter, LPI
+ *    interrupts.
+ */
+static irqreturn_t tc956xmac_interrupt_v0(int irq, void *dev_id)
+{
+	struct net_device *dev = (struct net_device *)dev_id;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#ifndef TC956X_SRIOV_VF
+	u32 val = 0;
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_AUTOMOTIVE_CONFIG)
+	u32 queue, value;
+	uint32_t uiIntSts, uiIntclr = 0;
+#endif
+	u32 queues_count;
+#ifdef TC956X_SRIOV_VF
+	enum mbx_msg_fns msg_src;
+	u8 i;
+#endif
+#ifdef TC956X
+	u32 rx_cnt = priv->plat->rx_queues_to_use;
+	u32 tx_cnt = priv->plat->tx_queues_to_use;
+
+	queues_count = (rx_cnt > tx_cnt) ? rx_cnt : tx_cnt;
+#endif
+#ifndef TC956X_SRIOV_VF
+	val = readl(priv->ioaddr + TC956X_MSI_INT_STS_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+	priv->xstats.total_interrupts++;
+
+	if (val & (0xFF << 3))
+		priv->xstats.tx_intr_n++;
+
+	if (val & (0xFF << 11))
+		priv->xstats.rx_intr_n++;
+	/* Checking if any RBUs occurred and updating the statistics corresponding to channel */
+#endif
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_AUTOMOTIVE_CONFIG)
+	for (queue = 0; queue < queues_count; queue++) {
+		uiIntSts = readl(priv->ioaddr + XGMAC_DMA_CH_STATUS(queue));
+
+		/* Assuming DMA Tx and Rx channels are used as pairs */
+		if ((priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW) ||
+		    (priv->plat->rx_dma_ch_owner[queue] != USE_IN_TC956X_SW)) {
+			uiIntSts = readl(priv->ioaddr + XGMAC_DMA_CH_STATUS(queue));
+			/* Handling Abnormal interrupts of NON S/W path, TI & RI are handled in FW */
+			if (unlikely(uiIntSts & XGMAC_AIS)) {
+				if (unlikely(uiIntSts & XGMAC_RBU)) {
+					priv->xstats.rx_buf_unav_irq[queue]++;
+					uiIntclr |= XGMAC_RBU;
+				}
+				if (unlikely(uiIntSts & XGMAC_TPS)) {
+					priv->xstats.tx_process_stopped_irq[queue]++;
+					uiIntclr |= XGMAC_TPS;
+				}
+				if (unlikely(uiIntSts & XGMAC_FBE)) {
+					priv->xstats.fatal_bus_error_irq[queue]++;
+					uiIntclr |= XGMAC_FBE;
+				}
+				if (unlikely(uiIntSts & XGMAC_RPS)) {
+					uiIntclr |= XGMAC_RPS;
+				}
+				uiIntclr |= XGMAC_AIS;
+				writel(uiIntclr, (priv->ioaddr + XGMAC_DMA_CH_STATUS(queue)));
+			}
+
+			/* Disable RBU interrupt on RBU interrupt occurance. IPA SW should enable it back */
+			value = readl(priv->ioaddr + XGMAC_DMA_CH_INT_EN(queue));
+			if (((uiIntclr & XGMAC_RBU) == XGMAC_RBU) && (value & XGMAC_RBUE)) {
+				value = readl(priv->ioaddr + XGMAC_DMA_CH_INT_EN(queue));
+				value &= ~XGMAC_RBUE;
+				writel(value, priv->ioaddr + XGMAC_DMA_CH_INT_EN(queue));
+				printk("***RBU INT disabled***XGMAC_DMA_CH_INT_EN[%d]***** :0x%x\n", queue, readl(priv->ioaddr + XGMAC_DMA_CH_INT_EN(queue)));
+			}
+		}
+	}
+#endif
+	/* To handle DMA interrupts */
+	tc956xmac_dma_interrupt(priv);
+
+
+#ifdef TC956X_SRIOV_PF
+	tc956xmac_interrupt_v1(irq, dev_id);
+
+	/* unmask MSI vector 0 */
+	tc956x_msi_intr_clr(priv, dev, TC956X_MSI_VECTOR_0);
+#elif defined TC956X_SRIOV_VF
+		/* Run the through the loop PF and MCU */
+
+	for (i = 0; i < PFS_MAX; i++) {
+		msg_src = tc956x_vf_get_fn_idx_from_int_sts(priv,
+							    &priv->fn_id_info);
+		if (msg_src >= 0 && msg_src <= 2) {
+			/* Read and ack the mail and call respective
+			 * message type functions to perform the action
+			 */
+			tc956x_vf_parse_mbx(priv, msg_src);
+		} else {
+			/* No valid Interrupt*/
+		}
+	}
+
+	/* unmask MSI vector 0 */
+	tc956x_msi_intr_clr(priv, dev, TC956X_MSI_VECTOR_0, &priv->fn_id_info);
+#endif
+	return IRQ_HANDLED;
+}
+
+#ifdef TC956X_SRIOV_PF
+static irqreturn_t tc956xmac_interrupt_v1(int irq, void *dev_id)
+{
+	struct net_device *dev = (struct net_device *)dev_id;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+#ifdef TC956X
+	u32 rx_cnt = priv->plat->rx_queues_to_use;
+	u32 tx_cnt = priv->plat->tx_queues_to_use;
+#endif
+
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+	u32 i;
+	enum mbx_msg_fns msg_src;
+	unsigned long flags;
+#endif
+
+	u32 queues_count;
+	u32 queue;
+	bool xmac;
+	u32 val = 0;
+	//uint32_t uiIntSts, uiIntclr = 0;
+
+	xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
+#ifdef TC956X
+	queues_count = (rx_cnt > tx_cnt) ? rx_cnt : tx_cnt;
+#endif
+	if (priv->irq_wake)
+		pm_wakeup_event(priv->device, 0);
+
+	if (unlikely(!dev)) {
+		netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
+		return IRQ_NONE;
+	}
+
+	/* Check if adapter is up */
+	if (test_bit(TC956XMAC_DOWN, &priv->state))
+		return IRQ_HANDLED;
+	/* Check if a fatal error happened */
+	if (tc956xmac_safety_feat_interrupt(priv))
+		return IRQ_HANDLED;
+
+	val = readl(priv->ioaddr + TC956X_MSI_INT_STS_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+	priv->xstats.total_interrupts++;
+
+	if (val & (1 << 0))
+		priv->xstats.lpi_intr_n++;
+
+	if (val & (1 << 1))
+		priv->xstats.pmt_intr_n++;
+
+	if (val & (1 << 2))
+		priv->xstats.event_intr_n++;
+
+	if (val & (1 << 19))
+		priv->xstats.xpcs_intr_n++;
+
+	if (val & (1 << 20))
+		priv->xstats.phy_intr_n++;
+
+	if (val & (1 << 24))
+		priv->xstats.sw_msi_n++;
+
+#ifdef TC956X_SRIOV_PF
+	tc956xmac_rx_dma_error_recovery(priv);
+#endif
+
+	/* To handle GMAC own interrupts */
+	if ((priv->plat->has_gmac) || xmac) {
+		int status = tc956xmac_host_irq_status(priv, priv->hw, &priv->xstats);
+		int mtl_status;
+
+		if (unlikely(status)) {
+			/* For LPI we need to save the tx status */
+			if (status & CORE_IRQ_TX_PATH_IN_LPI_MODE)
+				priv->tx_path_in_lpi_mode = true;
+			if (status & CORE_IRQ_TX_PATH_EXIT_LPI_MODE)
+				priv->tx_path_in_lpi_mode = false;
+		}
+
+		for (queue = 0; queue < queues_count; queue++) {
+
+			struct tc956xmac_rx_queue *rx_q;
+
+#ifdef TC956X_SRIOV_PF
+			if (priv->plat->rx_q_in_use[queue] == TC956X_DISABLE_QUEUE)
+				continue;
+
+#endif
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+			if ((queue == TC956X_ONE) || (queue == TC956X_TWO))
+				continue;
+#endif
+			mtl_status = tc956xmac_host_mtl_irq_status(priv, priv->hw,
+								queue);
+
+			if (mtl_status != -EINVAL)
+				status |= mtl_status;
+
+			if (status & CORE_IRQ_MTL_RX_OVERFLOW) {
+				u8 pf_dma_ch;
+
+				status = status &  (~CORE_IRQ_MTL_RX_OVERFLOW);
+				priv->mbx_wq_param.queue_no = queue;
+				KPRINT_INFO("CORE_IRQ_MTL_RX_OVERFLOW for queue = %d\n", queue);
+				if (queue == 0 || queue == 1 || queue == 7) {
+					pf_dma_ch = priv->pf_queue_dma_map[queue];
+					rx_q = &priv->rx_queue[pf_dma_ch];
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+					spin_lock_irqsave(&priv->wq_lock, flags);
+					tc956xmac_service_mbx_event_schedule(priv);
+					spin_unlock_irqrestore(&priv->wq_lock, flags);
+#endif
+					tc956xmac_set_rx_tail_ptr(priv, priv->ioaddr,
+										rx_q->rx_tail_addr, pf_dma_ch);
+				} else if (queue == 2 || queue == 3) {
+					pf_dma_ch = priv->pf_queue_dma_map[queue];
+					rx_q = &priv->rx_queue[pf_dma_ch];
+					tc956xmac_set_rx_tail_ptr(priv, priv->ioaddr,
+									rx_q->rx_tail_addr, pf_dma_ch);
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+				} else {
+					spin_lock_irqsave(&priv->wq_lock, flags);
+					tc956xmac_service_mbx_event_schedule(priv);
+					spin_unlock_irqrestore(&priv->wq_lock, flags);
+#endif
+				}
+			}
+		}
+
+		/* PCS link status */
+		if (priv->hw->pcs) {
+			if (priv->xstats.pcs_link)
+				netif_carrier_on(dev);
+			else
+				netif_carrier_off(dev);
+		}
+	}
+
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+	/* Mailbox Events */
+	/* Run the through the loop of VF, PF (other PF) and MCU */
+	for (i = 0; i < FNS_MAX; i++) {
+		msg_src = tc956x_pf_get_fn_idx_from_int_sts(priv,
+							    &priv->fn_id_info);
+
+		if (msg_src >= 0 && msg_src <= 5) {
+			/* Read and ack the mail and call respective
+			 * message type functions to perform the action
+			 */
+			tc956x_pf_parse_mbx(priv, msg_src);
+		} else {
+			/* No valid Interrupt*/
+		}
+	}
+#endif
+
+	val = readl(priv->ioaddr + TC956X_MSI_INT_STS_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+	if (val & TC956X_EXT_PHY_ETH_INT) {
+		KPRINT_INFO("PHY Interrupt %s\n", __func__);
+#ifndef TC956X_SRIOV_VF
+		if (priv->port_link_down == true)
+			tc956xmac_link_change_set_power(priv, LINK_UP); /* Restore, De-assert and Enable Reset and Clock */
+#endif
+		/* Queue the work in system_wq */
+		if (priv->tc956x_port_pm_suspend == true) {
+			KPRINT_INFO("%s : (Do not queue PHY Work during suspend. Set WOL Interrupt flag)\n", __func__);
+			priv->tc956xmac_pm_wol_interrupt = true;
+		} else {
+			KPRINT_INFO("%s : (Queue PHY Work.)\n", __func__);
+			queue_work(system_wq, &priv->emac_phy_work);
+		}
+		/* phy_mac_interrupt(priv->dev->phydev); */
+		/* MSI_OUT_EN: Reading */
+		val = readl(priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+		val &= (~(1 << MSI_INT_EXT_PHY));
+		/* MSI_OUT_EN: Writing to disable MAC Ext Interrupt*/
+		writel(val, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	}
+
+#ifdef TC956X_SW_MSI
+	val = readl(priv->ioaddr + TC956X_MSI_INT_STS_OFFSET(priv->port_num));
+	if (val & TC956X_SW_MSI_INT) {
+		/*Clear SW MSI*/
+		writel(1, priv->ioaddr + TC956X_MSI_SW_MSI_CLR(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+
+		val = readl(priv->ioaddr + TC956X_MSI_SW_MSI_CLR(priv->fn_id_info.pf_no, priv->fn_id_info.vf_no));
+	}
+#endif
+
+#ifdef TC956X
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+	/* unmask MSI vector 1 */
+	tc956x_msi_intr_clr(priv, dev, TC956X_MSI_VECTOR_1);
+#endif
+#endif
+
+	return IRQ_HANDLED;
+}
+#endif
+#endif
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+#ifdef CONFIG_NET_POLL_CONTROLLER
+/* Polling receive - used by NETCONSOLE and other diagnostic tools
+ * to allow network I/O with interrupts disabled.
+ */
+static void tc956xmac_poll_controller(struct net_device *dev)
+{
+	disable_irq(dev->irq);
+#ifdef TC956X_SRIOV_PF
+	tc956xmac_interrupt_v0(dev->irq, dev);
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_CPE_CONFIG)
+	tc956xmac_interrupt_v1(dev->irq, dev);
+#endif
+#elif defined TC956X_SRIOV_VF
+	tc956xmac_interrupt_v0(dev->irq, dev);
+	//tc956xmac_interrupt_v1(dev->irq, dev);
+#endif
+	enable_irq(dev->irq);
+}
+#endif
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+int tc956xmac_rx_parser_configuration(struct tc956xmac_priv *priv)
+{
+	int ret = -EINVAL, re_init_eee = 0, dly_cnt = 0, ret_val;
+	struct ethtool_eee edata;
+
+#ifndef TC956X_SRIOV_VF
+	/* Disable EEE before configuring FRP */
+	if (priv->eee_enabled) {
+		if (priv->hw->xpcs) {
+			tc956x_xpcs_ctrl0_lrx(priv, false);
+			re_init_eee = 1;
+
+		} else if (priv->dev->phydev && priv->dev->phydev->link) {
+			/* Disable EEE only if PHY link is Up */
+
+			ret_val = phylink_ethtool_get_eee(priv->phylink, &edata);
+			if (ret_val)
+				KPRINT_INFO("Phylink get EEE error\n\r");
+
+			KPRINT_INFO("Disabling EEE\n\r");
+			priv->eee_enabled = 0;
+			edata.tx_lpi_enabled = priv->eee_enabled;
+			edata.tx_lpi_timer = priv->tx_lpi_timer;
+			edata.eee_enabled = priv->eee_enabled;
+
+			set_bit(TC956XMAC_DOWN, &priv->link_state);
+
+			tc956xmac_disable_eee_mode(priv);
+			ret_val = phylink_ethtool_set_eee(priv->phylink, &edata);
+			ret_val |= phy_ethtool_set_eee_2p5(priv->dev->phydev, &edata);
+			if (ret_val)
+				KPRINT_INFO("Phylink EEE config error\n\r");
+
+			/* Wait for AN - link down, link up sequence */
+			while (test_bit(TC956XMAC_DOWN, &priv->link_state)) {
+				msleep(10);
+				if (dly_cnt++ >= TC956X_MAX_LINK_DELAY) {
+					KPRINT_INFO("Link Up Timeout\n\r");
+					break;
+				}
+			}
+			KPRINT_INFO("AN duration : %d\n\r", dly_cnt*10);
+
+			re_init_eee = 1;
+		}
+	}
+#endif
+	if (priv->hw->mac->rx_parser_init && priv->plat->rxp_cfg.enable)
+		ret = tc956xmac_rx_parser_init(priv,
+			priv->dev, priv->hw, priv->dma_cap.spram,
+			priv->dma_cap.frpsel, priv->dma_cap.frpes,
+			&priv->plat->rxp_cfg);
+
+#ifndef TC956X_SRIOV_VF
+	/* Restore EEE state */
+	if (re_init_eee) {
+		re_init_eee = 0;
+		if (priv->hw->xpcs)
+			tc956x_xpcs_ctrl0_lrx(priv, true);
+		else {
+			ret_val = phylink_ethtool_get_eee(priv->phylink, &edata);
+			if (ret_val)
+				KPRINT_INFO("Phylink get EEE error\n\r");
+
+			KPRINT_INFO("Enabling EEE\n\r");
+			edata.tx_lpi_enabled = priv->eee_enabled;
+			edata.tx_lpi_timer = priv->tx_lpi_timer;
+
+			edata.eee_enabled = 1;
+
+			set_bit(TC956XMAC_DOWN, &priv->link_state);
+
+			edata.eee_enabled = tc956xmac_eee_init(priv);
+			priv->eee_enabled = edata.eee_enabled;
+			if (!edata.eee_enabled)
+				KPRINT_INFO("Error in init_eee\n\r");
+
+			ret_val = phylink_ethtool_set_eee(priv->phylink, &edata);
+			ret_val |= phy_ethtool_set_eee_2p5(priv->dev->phydev, &edata);
+			if (ret_val)
+				KPRINT_INFO("Phylink EEE config error\n\r");
+
+			/* Wait for AN - link down, link up sequence */
+			dly_cnt = 0;
+			while (test_bit(TC956XMAC_DOWN, &priv->link_state)) {
+				msleep(10);
+				if (dly_cnt++ >= TC956X_MAX_LINK_DELAY) {
+					KPRINT_INFO("Link Up Timeout\n\r");
+					break;
+				}
+			}
+			KPRINT_INFO("AN duration : %d \n\r", dly_cnt*10);
+		}
+	}
+
+#endif
+		/* spram feautre is not present in TC956X */
+	if (ret)
+		priv->rxp_enabled = false;
+	else
+		priv->rxp_enabled = true;
+
+	return ret;
+}
+
+#ifndef TC956X_SRIOV_VF
+static int tc956xmac_est_configuration_ioctl(struct tc956xmac_priv *priv)
+{
+	int ret = -EINVAL;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+#ifdef TC956X
+	ret = tc956xmac_est_configure(priv, priv->ioaddr, priv->plat->est,
+				   priv->plat->clk_ptp_rate);
+#endif
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return ret;
+}
+
+/**
+ * tc956xmac_ioctl_get_cbs - gets the cbs parameter
+ * @priv: driver private structure
+ * @data: tc956xmac_ioctl_cbs_cfg strcuture passed by user
+ * Note: percentage element is dummy parameter and is not used in code.
+ * Description :  this function gets called when ioctl TC956XMAC_IOTL_GET_CBS
+ * is invoked.
+ * As pre-requisite for calling this function, CBS Set must be done before get.
+ *
+ */
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_ioctl_get_cbs(struct tc956xmac_priv *priv, void *data)
+#else
+static int tc956xmac_ioctl_get_cbs(struct tc956xmac_priv *priv, void __user *data)
+#endif
+{
+	u32 tx_qcount = priv->plat->tx_queues_to_use;
+	struct tc956xmac_ioctl_cbs_cfg cbs;
+	u8 qmode;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+#ifdef TC956X_SRIOV_PF
+	memcpy(&cbs, data, sizeof(cbs));
+#else
+	if (copy_from_user(&cbs, data, sizeof(cbs)))
+		return -EFAULT;
+#endif
+
+	/* queue 0 is reserved for legacy traffic; cbs configuration not allowed (registers also not available for Q0)*/
+	if ((cbs.queue_idx >= tx_qcount) || (cbs.queue_idx == 0))
+		return -EINVAL;
+
+	qmode = priv->plat->tx_queues_cfg[cbs.queue_idx].mode_to_use;
+
+	/* Only AVB queue supported for cbs */
+	if (qmode != MTL_QUEUE_AVB)
+		return -EINVAL;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.cbs, flags);
+#endif
+	cbs.speed100cfg.send_slope = priv->cbs_speed100_cfg[cbs.queue_idx].send_slope;
+	cbs.speed100cfg.idle_slope = priv->cbs_speed100_cfg[cbs.queue_idx].idle_slope;
+	cbs.speed100cfg.high_credit = priv->cbs_speed100_cfg[cbs.queue_idx].high_credit;
+	cbs.speed100cfg.low_credit = priv->cbs_speed100_cfg[cbs.queue_idx].low_credit;
+
+	cbs.speed1000cfg.send_slope = priv->cbs_speed1000_cfg[cbs.queue_idx].send_slope;
+	cbs.speed1000cfg.idle_slope = priv->cbs_speed1000_cfg[cbs.queue_idx].idle_slope;
+	cbs.speed1000cfg.high_credit = priv->cbs_speed1000_cfg[cbs.queue_idx].high_credit;
+	cbs.speed1000cfg.low_credit = priv->cbs_speed1000_cfg[cbs.queue_idx].low_credit;
+
+	cbs.speed10000cfg.send_slope = priv->cbs_speed10000_cfg[cbs.queue_idx].send_slope;
+	cbs.speed10000cfg.idle_slope = priv->cbs_speed10000_cfg[cbs.queue_idx].idle_slope;
+	cbs.speed10000cfg.high_credit = priv->cbs_speed10000_cfg[cbs.queue_idx].high_credit;
+	cbs.speed10000cfg.low_credit = priv->cbs_speed10000_cfg[cbs.queue_idx].low_credit;
+
+	cbs.speed5000cfg.send_slope = priv->cbs_speed5000_cfg[cbs.queue_idx].send_slope;
+	cbs.speed5000cfg.idle_slope = priv->cbs_speed5000_cfg[cbs.queue_idx].idle_slope;
+	cbs.speed5000cfg.high_credit = priv->cbs_speed5000_cfg[cbs.queue_idx].high_credit;
+	cbs.speed5000cfg.low_credit = priv->cbs_speed5000_cfg[cbs.queue_idx].low_credit;
+
+	cbs.speed2500cfg.send_slope = priv->cbs_speed2500_cfg[cbs.queue_idx].send_slope;
+	cbs.speed2500cfg.idle_slope = priv->cbs_speed2500_cfg[cbs.queue_idx].idle_slope;
+	cbs.speed2500cfg.high_credit = priv->cbs_speed2500_cfg[cbs.queue_idx].high_credit;
+	cbs.speed2500cfg.low_credit = priv->cbs_speed2500_cfg[cbs.queue_idx].low_credit;
+#ifdef TC956X_SRIOV_PF
+	memcpy(data, &cbs, sizeof(cbs));
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.cbs, flags);
+#endif
+#else
+	if (copy_to_user(data, &cbs, sizeof(cbs)))
+		return -EFAULT;
+#endif
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_ioctl_set_cbs(struct tc956xmac_priv *priv, void *data)
+#else
+static int tc956xmac_ioctl_set_cbs(struct tc956xmac_priv *priv, void __user *data)
+#endif
+{
+	u32 tx_qcount = priv->plat->tx_queues_to_use;
+	struct tc956xmac_ioctl_cbs_cfg cbs;
+	u8 qmode;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+#ifdef TC956X_SRIOV_PF
+	memcpy(&cbs, data, sizeof(cbs));
+#else
+	if (copy_from_user(&cbs, data, sizeof(cbs)))
+		return -EFAULT;
+#endif
+
+	/* queue 0 is reserved for legacy traffic; cbs configuration not allowed (registers also not available for Q0)*/
+	if ((cbs.queue_idx >= tx_qcount) || (cbs.queue_idx == 0))
+		return -EINVAL;
+
+	if (!priv->hw->mac->config_cbs)
+		return -EINVAL;
+
+#ifdef TC956X_SRIOV_VF
+	/* skip configuring for unallocated queue */
+	if (priv->plat->tx_q_in_use[cbs.queue_idx] == 0)
+		return -EINVAL;
+#endif
+
+	qmode = priv->plat->tx_queues_cfg[cbs.queue_idx].mode_to_use;
+
+	if (qmode != MTL_QUEUE_AVB)
+		return -EINVAL;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.cbs, flags);
+#endif
+	priv->cbs_speed100_cfg[cbs.queue_idx].send_slope = cbs.speed100cfg.send_slope;
+	priv->cbs_speed100_cfg[cbs.queue_idx].idle_slope = cbs.speed100cfg.idle_slope;
+	priv->cbs_speed100_cfg[cbs.queue_idx].high_credit = cbs.speed100cfg.high_credit;
+	priv->cbs_speed100_cfg[cbs.queue_idx].low_credit = cbs.speed100cfg.low_credit;
+
+	priv->cbs_speed1000_cfg[cbs.queue_idx].send_slope = cbs.speed1000cfg.send_slope;
+	priv->cbs_speed1000_cfg[cbs.queue_idx].idle_slope = cbs.speed1000cfg.idle_slope;
+	priv->cbs_speed1000_cfg[cbs.queue_idx].high_credit = cbs.speed1000cfg.high_credit;
+	priv->cbs_speed1000_cfg[cbs.queue_idx].low_credit = cbs.speed1000cfg.low_credit;
+
+	priv->cbs_speed10000_cfg[cbs.queue_idx].send_slope = cbs.speed10000cfg.send_slope;
+	priv->cbs_speed10000_cfg[cbs.queue_idx].idle_slope = cbs.speed10000cfg.idle_slope;
+	priv->cbs_speed10000_cfg[cbs.queue_idx].high_credit = cbs.speed10000cfg.high_credit;
+	priv->cbs_speed10000_cfg[cbs.queue_idx].low_credit = cbs.speed10000cfg.low_credit;
+
+	priv->cbs_speed2500_cfg[cbs.queue_idx].send_slope = cbs.speed2500cfg.send_slope;
+	priv->cbs_speed2500_cfg[cbs.queue_idx].idle_slope = cbs.speed2500cfg.idle_slope;
+	priv->cbs_speed2500_cfg[cbs.queue_idx].high_credit = cbs.speed2500cfg.high_credit;
+	priv->cbs_speed2500_cfg[cbs.queue_idx].low_credit = cbs.speed2500cfg.low_credit;
+
+
+	priv->cbs_speed5000_cfg[cbs.queue_idx].send_slope = cbs.speed5000cfg.send_slope;
+	priv->cbs_speed5000_cfg[cbs.queue_idx].idle_slope = cbs.speed5000cfg.idle_slope;
+	priv->cbs_speed5000_cfg[cbs.queue_idx].high_credit = cbs.speed5000cfg.high_credit;
+	priv->cbs_speed5000_cfg[cbs.queue_idx].low_credit = cbs.speed5000cfg.low_credit;
+
+	if (priv->speed == SPEED_100) {
+		priv->plat->tx_queues_cfg[cbs.queue_idx].send_slope =
+								priv->cbs_speed100_cfg[cbs.queue_idx].send_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].idle_slope =
+								priv->cbs_speed100_cfg[cbs.queue_idx].idle_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].high_credit =
+								priv->cbs_speed100_cfg[cbs.queue_idx].high_credit;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].low_credit =
+								priv->cbs_speed100_cfg[cbs.queue_idx].low_credit;
+	} else if (priv->speed == SPEED_1000) {
+		priv->plat->tx_queues_cfg[cbs.queue_idx].send_slope =
+								priv->cbs_speed1000_cfg[cbs.queue_idx].send_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].idle_slope =
+								priv->cbs_speed1000_cfg[cbs.queue_idx].idle_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].high_credit =
+								priv->cbs_speed1000_cfg[cbs.queue_idx].high_credit;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].low_credit =
+								priv->cbs_speed1000_cfg[cbs.queue_idx].low_credit;
+	} else if (priv->speed == SPEED_10000) {
+		priv->plat->tx_queues_cfg[cbs.queue_idx].send_slope =
+								priv->cbs_speed10000_cfg[cbs.queue_idx].send_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].idle_slope =
+								priv->cbs_speed10000_cfg[cbs.queue_idx].idle_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].high_credit =
+								priv->cbs_speed10000_cfg[cbs.queue_idx].high_credit;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].low_credit =
+								priv->cbs_speed10000_cfg[cbs.queue_idx].low_credit;
+	} else if (priv->speed == SPEED_2500) {
+		priv->plat->tx_queues_cfg[cbs.queue_idx].send_slope =
+								priv->cbs_speed2500_cfg[cbs.queue_idx].send_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].idle_slope =
+								priv->cbs_speed2500_cfg[cbs.queue_idx].idle_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].high_credit =
+								priv->cbs_speed2500_cfg[cbs.queue_idx].high_credit;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].low_credit =
+								priv->cbs_speed2500_cfg[cbs.queue_idx].low_credit;
+	} else if (priv->speed == SPEED_5000) {
+		priv->plat->tx_queues_cfg[cbs.queue_idx].send_slope =
+								priv->cbs_speed5000_cfg[cbs.queue_idx].send_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].idle_slope =
+								priv->cbs_speed5000_cfg[cbs.queue_idx].idle_slope;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].high_credit =
+								priv->cbs_speed5000_cfg[cbs.queue_idx].high_credit;
+		priv->plat->tx_queues_cfg[cbs.queue_idx].low_credit =
+								priv->cbs_speed5000_cfg[cbs.queue_idx].low_credit;
+	}
+#ifdef TC956X_SRIOV_PF
+	tc956xmac_config_cbs(priv, priv->hw, priv->plat->tx_queues_cfg[cbs.queue_idx].send_slope,
+				priv->plat->tx_queues_cfg[cbs.queue_idx].idle_slope,
+				priv->plat->tx_queues_cfg[cbs.queue_idx].high_credit,
+				priv->plat->tx_queues_cfg[cbs.queue_idx].low_credit,
+				cbs.queue_idx);
+#elif defined TC956X_SRIOV_VF
+			tc956xmac_config_cbs(priv,
+			priv->plat->tx_queues_cfg[cbs.queue_idx].send_slope,
+			priv->plat->tx_queues_cfg[cbs.queue_idx].idle_slope,
+			priv->plat->tx_queues_cfg[cbs.queue_idx].high_credit,
+			priv->plat->tx_queues_cfg[cbs.queue_idx].low_credit,
+			cbs.queue_idx);
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.cbs, flags);
+#endif
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_ioctl_get_est(struct tc956xmac_priv *priv, void *data)
+#else
+static int tc956xmac_ioctl_get_est(struct tc956xmac_priv *priv, void __user *data)
+#endif
+{
+	struct tc956xmac_ioctl_est_cfg *est;
+	int ret = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+#ifdef TC956X_SRIOV_PF
+	est = data;
+#else
+	est = kzalloc(sizeof(*est), GFP_KERNEL);
+	if (!est)
+		return -ENOMEM;
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.est, flags);
+#endif
+	est->enabled = priv->plat->est->enable;
+	est->estwid = priv->dma_cap.estwid;
+	est->estdep = priv->dma_cap.estdep;
+	est->btr_offset[0] = priv->plat->est->btr_offset[0];
+	est->btr_offset[1] = priv->plat->est->btr_offset[1];
+	est->ctr[0] = priv->plat->est->ctr[0];
+	est->ctr[1] = priv->plat->est->ctr[1];
+	est->ter = priv->plat->est->ter;
+	est->gcl_size = priv->plat->est->gcl_size;
+	memcpy(est->gcl, priv->plat->est->gcl, est->gcl_size * sizeof(*est->gcl));
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.est, flags);
+#endif
+
+#ifndef TC956X_SRIOV_PF
+	if (copy_to_user(data, est, sizeof(*est))) {
+		ret = -EFAULT;
+		goto out_free;
+	}
+#endif
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+#ifndef TC956X_SRIOV_PF
+out_free:
+	kfree(est);
+#endif
+	return ret;
+}
+
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_ioctl_set_est(struct tc956xmac_priv *priv, void *data)
+#else
+static int tc956xmac_ioctl_set_est(struct tc956xmac_priv *priv, void __user *data)
+#endif
+{
+	struct tc956xmac_est *cfg = priv->plat->est;
+	struct tc956xmac_ioctl_est_cfg *est;
+	int ret = 0;
+	u64 system_time;
+	u32 system_time_s;
+	u32 system_time_ns;
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	u64 quotient;
+	u32 reminder;
+
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+#ifdef TC956X_SRIOV_PF
+	est = data;
+#else
+	est = kzalloc(sizeof(*est), GFP_KERNEL);
+	if (!est)
+		return -ENOMEM;
+
+	if (copy_from_user(est, data, sizeof(*est))) {
+		ret = -EFAULT;
+		goto out_free;
+	}
+#endif
+	if (est->gcl_size > TC956XMAC_IOCTL_EST_GCL_MAX_ENTRIES) {
+		ret = -EINVAL;
+		goto out_free;
+	}
+
+	if (cfg->gcl_size > priv->dma_cap.estdep) {
+		ret = -EINVAL;
+		goto out_free;
+	}
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.est, flags);
+#endif
+	if (est->enabled) {
+		cfg->btr_offset[0] = est->btr_offset[0];
+		cfg->btr_offset[1] = est->btr_offset[1];
+		cfg->ctr[0] = est->ctr[0];
+		cfg->ctr[1] = est->ctr[1];
+		cfg->ter = est->ter;
+		cfg->gcl_size = est->gcl_size;
+
+		/* BTR Offset */
+		tc956xmac_get_systime(priv, priv->ptpaddr, &system_time);
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+		quotient = div_u64_rem(system_time, 1000000000ULL, &reminder);
+		system_time_s = (u32)quotient;
+		system_time_ns = reminder;
+#else
+		system_time_s = system_time / 1000000000;
+		system_time_ns = system_time % 1000000000;
+#endif
+		cfg->btr[0] = cfg->btr_offset[0] + (u32)system_time_ns;
+		cfg->btr[1] = cfg->btr_offset[1] + (u32)system_time_s;
+		memcpy(cfg->gcl, est->gcl, cfg->gcl_size * sizeof(*cfg->gcl));
+	} else {
+		cfg->btr_offset[0] = 0;
+		cfg->btr_offset[1] = 0;
+		cfg->ctr[0] = 0;
+		cfg->ctr[1] = 0;
+		cfg->ter = 0;
+		cfg->gcl_size = 0;
+		memset(cfg->gcl, 0, sizeof(cfg->gcl));
+	}
+
+	cfg->enable = est->enabled;
+	tc956xmac_est_configuration_ioctl(priv);
+
+	if (!est->enabled)
+		ret = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.est, flags);
+#endif
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+out_free:
+	kfree(est);
+	return ret;
+}
+
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_ioctl_get_fpe(struct tc956xmac_priv *priv, void *data)
+#else
+static int tc956xmac_ioctl_get_fpe(struct tc956xmac_priv *priv, void __user *data)
+#endif
+{
+	struct tc956xmac_ioctl_fpe_cfg *fpe;
+	int ret = 0;
+	unsigned int control = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+#ifdef TC956X_SRIOV_PF
+	fpe = data;
+#else
+	fpe = kzalloc(sizeof(*fpe), GFP_KERNEL);
+
+	if (!fpe)
+		return -ENOMEM;
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.fpe, flags);
+#endif
+#ifdef TC956X
+	control = readl(priv->ioaddr + XGMAC_FPE_CTRL_STS);
+#endif
+
+	if (control & XGMAC_EFPE) {
+		fpe->enabled = 1;
+#ifdef TC956X
+		control = readl(priv->ioaddr + XGMAC_MTL_FPE_CTRL_STS);
+		fpe->pec = (control & XGMAC_MTL_FPE_PEC_MASK) >> XGMAC_MTL_FPE_PEC_SHIFT;
+		fpe->afsz = control & XGMAC_MTL_FPE_AFSZ_MASK;
+		control = readl(priv->ioaddr + XGMAC_MTL_FPE_ADVANCE);
+		fpe->HA_time =  (control & XGMAC_MTL_FPE_HOLD_ADVANCE_MASK);
+		fpe->RA_time =  (control & XGMAC_MTL_FPE_RELEASE_ADVANCE_MASK) >> XGMAC_MTL_FPE_ADVANCE_SHIFT;
+#endif
+	} else {
+		fpe->enabled = 0;
+		fpe->pec = 0;
+		fpe->afsz = 0;
+		fpe->HA_time = 0;
+		fpe->RA_time = 0;
+	}
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.fpe, flags);
+#endif
+#ifndef TC956X_SRIOV_PF
+	if (copy_to_user(data, fpe, sizeof(*fpe))) {
+		ret = -EFAULT;
+		goto out_free;
+	}
+out_free:
+		kfree(fpe);
+#endif
+		return ret;
+}
+
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_ioctl_set_fpe(struct tc956xmac_priv *priv, void *data)
+#else
+static int tc956xmac_ioctl_set_fpe(struct tc956xmac_priv *priv, void __user *data)
+#endif
+{
+	struct tc956xmac_ioctl_fpe_cfg *fpe;
+	int ret = 0;
+	unsigned int control = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+#ifdef TC956X_SRIOV_PF
+	fpe = data;
+#else
+	fpe = kzalloc(sizeof(*fpe), GFP_KERNEL);
+	if (!fpe)
+		return -ENOMEM;
+	if (copy_from_user(fpe, data, sizeof(*fpe))) {
+		ret = -EFAULT;
+		goto out_free;
+	}
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.fpe, flags);
+#endif
+#ifdef TC956X
+	if (fpe->enabled) {
+		control = readl(priv->ioaddr + XGMAC_MTL_FPE_CTRL_STS);
+		control &= ~(XGMAC_MTL_FPE_PEC_MASK | XGMAC_MTL_FPE_AFSZ_MASK);
+		control |= ((fpe->pec << XGMAC_MTL_FPE_PEC_SHIFT) & XGMAC_MTL_FPE_PEC_MASK) |
+				(fpe->afsz & XGMAC_MTL_FPE_AFSZ_MASK);
+		writel(control, priv->ioaddr + XGMAC_MTL_FPE_CTRL_STS);
+
+		control = readl(priv->ioaddr + XGMAC_MTL_FPE_ADVANCE);
+		control &= ~(XGMAC_MTL_FPE_HOLD_ADVANCE_MASK | XGMAC_MTL_FPE_RELEASE_ADVANCE_MASK);
+		control |= ((fpe->RA_time << XGMAC_MTL_FPE_ADVANCE_SHIFT) & XGMAC_MTL_FPE_RELEASE_ADVANCE_MASK) |
+				(fpe->HA_time & XGMAC_MTL_FPE_HOLD_ADVANCE_MASK);
+		writel(control, priv->ioaddr + XGMAC_MTL_FPE_ADVANCE);
+
+		control = readl(priv->ioaddr + XGMAC_FPE_CTRL_STS);
+		control |= XGMAC_EFPE;
+		writel(control, priv->ioaddr + XGMAC_FPE_CTRL_STS);
+	} else {
+		control = readl(priv->ioaddr + XGMAC_FPE_CTRL_STS);
+		control &= ~XGMAC_EFPE;
+		writel(control, priv->ioaddr + XGMAC_FPE_CTRL_STS);
+
+		control = readl(priv->ioaddr + XGMAC_MTL_FPE_ADVANCE);
+		control &= ~(XGMAC_MTL_FPE_HOLD_ADVANCE_MASK | XGMAC_MTL_FPE_RELEASE_ADVANCE_MASK);
+		writel(control, priv->ioaddr + XGMAC_MTL_FPE_ADVANCE);
+
+		control = readl(priv->ioaddr + XGMAC_MTL_FPE_CTRL_STS);
+		control &= ~(XGMAC_MTL_FPE_PEC_MASK | XGMAC_MTL_FPE_AFSZ_MASK);
+		writel(control, priv->ioaddr + XGMAC_MTL_FPE_CTRL_STS);
+	}
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.fpe, flags);
+#endif
+#ifndef TC956X_SRIOV_PF
+out_free:
+	kfree(fpe);
+#endif
+	return ret;
+}
+
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_ioctl_get_rxp(struct tc956xmac_priv *priv, void *data)
+#else
+static int tc956xmac_ioctl_get_rxp(struct tc956xmac_priv *priv, void __user *data)
+#endif
+{
+	struct tc956xmac_rx_parser_cfg *cfg = &priv->plat->rxp_cfg;
+	struct tc956xmac_ioctl_rxp_cfg *rxp;
+	int ret = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+#ifdef TC956X_SRIOV_PF
+	rxp = data;
+#else
+	rxp = kzalloc(sizeof(*rxp), GFP_KERNEL);
+	if (!rxp)
+		return -ENOMEM;
+#endif
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.frp, flags);
+#endif
+
+	rxp->enabled = priv->rxp_enabled;
+	rxp->frpes = priv->dma_cap.frpes;
+	rxp->nve = cfg->nve;
+	rxp->npe = cfg->npe;
+	memcpy(rxp->entries, cfg->entries, rxp->nve * sizeof(*cfg->entries));
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.frp, flags);
+#endif
+
+#ifndef TC956X_SRIOV_PF
+	if (copy_to_user(data, rxp, sizeof(*rxp))) {
+		ret = -EFAULT;
+		goto out_free;
+	}
+
+out_free:
+	kfree(rxp);
+#endif
+	return ret;
+}
+
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_ioctl_set_rxp(struct tc956xmac_priv *priv, void *data)
+#else
+static int tc956xmac_ioctl_set_rxp(struct tc956xmac_priv *priv, void __user *data)
+#endif
+{
+	struct tc956xmac_rx_parser_cfg *cfg = &priv->plat->rxp_cfg;
+	struct tc956xmac_ioctl_rxp_cfg *rxp;
+	int ret = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+#ifdef TC956X_SRIOV_PF
+	rxp = data;
+#else
+	rxp = kzalloc(sizeof(*rxp), GFP_KERNEL);
+	if (!rxp)
+		return -ENOMEM;
+
+	if (copy_from_user(rxp, data, sizeof(*rxp))) {
+		ret = -EFAULT;
+		goto out_free;
+	}
+#endif
+	if (rxp->nve > TC956XMAC_RX_PARSER_MAX_ENTRIES) {
+		ret = -EINVAL;
+		goto out_free;
+	}
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.frp, flags);
+#endif
+	if (rxp->enabled) {
+		cfg->nve = rxp->nve;
+		cfg->npe = rxp->npe;
+		memcpy(cfg->entries, rxp->entries,
+		       cfg->nve * sizeof(*cfg->entries));
+	} else {
+		cfg->nve = 0;
+		cfg->npe = 0;
+		memset(cfg->entries, 0, sizeof(cfg->entries));
+	}
+
+	ret = tc956xmac_rx_parser_configuration(priv);
+	if (!rxp->enabled)
+		ret = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.frp, flags);
+#endif
+out_free:
+	kfree(rxp);
+	return ret;
+}
+#endif
+
+static int tc956xmac_ioctl_get_tx_free_desc(struct tc956xmac_priv *priv, void __user *data)
+{
+	u32 tx_free_desc;
+	struct tc956xmac_ioctl_free_desc ioctl_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+#ifdef TC956X_SRIOV_PF
+	if ((ioctl_data.queue_idx < priv->plat->tx_queues_to_use) &&
+		(priv->plat->tx_ch_in_use[ioctl_data.queue_idx] == TC956X_ENABLE_CHNL)) {
+#else
+	if ((ioctl_data.queue_idx < priv->plat->tx_queues_to_use) &&
+		(priv->plat->ch_in_use[ioctl_data.queue_idx] == 1)) {
+#endif
+		tx_free_desc = tc956xmac_tx_avail(priv, ioctl_data.queue_idx);
+		if (copy_to_user((void __user *)ioctl_data.ptr, &tx_free_desc, sizeof(unsigned int)))
+			return -EFAULT;
+	} else {
+		NMSGPR_ALERT(priv->device, "Channel no %d is invalid\n", ioctl_data.queue_idx);
+		return -EFAULT;
+	}
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+
+#ifndef TC956X_SRIOV_VF
+static int tc956xmac_ioctl_get_connected_speed(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_speed ioctl_data;
+
+	memset(&ioctl_data, 0, sizeof(ioctl_data));
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	ioctl_data.connected_speed = priv->speed;
+
+	if (copy_to_user(data, &ioctl_data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+	return 0;
+}
+#endif /* TC956X_SRIOV_VF */
+#ifdef TC956X_IOCTL_REG_RD_WR_ENABLE
+
+/*!
+ * \brief API to read register
+ * \param[in] address offset as per tc956x data-sheet
+ * \param[in] bar number
+ * \return register value
+ */
+static int tc956xmac_reg_rd(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_reg_rd_wr ioctl_data;
+	u32 val;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+#ifdef TC956X
+		if (ioctl_data.bar_num == 4)
+			val = readl((void __iomem *)(priv->dev->base_addr + ioctl_data.addr));
+		else if (ioctl_data.bar_num == 2)/*SRAM bar number 2*/
+			val = readl((void __iomem *)(priv->tc956x_SRAM_pci_base_addr + ioctl_data.addr));
+		else if (ioctl_data.bar_num == 0)/*PCI bridge bar number 0*/
+			val = readl((void __iomem *)(priv->tc956x_BRIDGE_CFG_pci_base_addr + ioctl_data.addr));
+#endif
+
+	if (copy_to_user(ioctl_data.ptr, &val, sizeof(unsigned int)))
+		return -EFAULT;
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+
+}
+
+#ifndef TC956X_SRIOV_VF
+/*!
+ * \brief API to write register
+ * \param[in] address offset as per tc956x data-sheet
+ * \return register
+ */
+static int tc956xmac_reg_wr(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_reg_rd_wr ioctl_data;
+	u32 val;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if (copy_from_user(&val, ioctl_data.ptr, sizeof(unsigned int)))
+		return -EFAULT;
+
+#ifdef TC956X
+	if (ioctl_data.bar_num == 4)
+		writel(val, (void __iomem *)(priv->dev->base_addr + ioctl_data.addr));
+	else if (ioctl_data.bar_num == 2)/*SRAM bar number 2*/
+		writel(val, (void __iomem *)(priv->tc956x_SRAM_pci_base_addr + ioctl_data.addr));
+	else if (ioctl_data.bar_num == 0)/*PCI bridge bar number 0*/
+		writel(val, (void __iomem *)(priv->tc956x_BRIDGE_CFG_pci_base_addr + ioctl_data.addr));
+#endif
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+#endif
+#endif
+
+#ifndef TC956X_SRIOV_VF
+static int tc956xmac_ioctl_set_mac_loopback(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_loopback ioctl_data;
+	u32 value = 0;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if (priv->mac_loopback_mode == ioctl_data.flags) {
+		NDBGPR_L1(priv->device, " MAC loopback mode is already configured for the intended configuration\n");
+		return 0;
+	}
+#ifdef TC956X
+	value = readl((void __iomem *)priv->dev->base_addr + XGMAC_RX_CONFIG);
+	if (ioctl_data.flags)
+		value |= XGMAC_CONFIG_LM;
+	else
+		value &= ~XGMAC_CONFIG_LM;
+
+	writel(value, (void __iomem *)priv->dev->base_addr + XGMAC_RX_CONFIG);
+#endif
+
+	priv->mac_loopback_mode = ioctl_data.flags;
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+	return 0;
+}
+
+static int tc956xmac_ioctl_set_phy_loopback(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_phy_loopback ioctl_data;
+#ifdef TC956X
+	int ret;
+#endif
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if (priv->phy_loopback_mode == ioctl_data.flags) {
+		NDBGPR_L1(priv->device, " PHY loopback mode is already configured for the intended configuration\n");
+		return 0;
+	}
+
+	priv->phy_loopback_mode = ioctl_data.flags;
+
+#ifdef TC956X
+	if (priv->phy_loopback_mode)
+		ret = phy_loopback(priv->dev->phydev, true);
+	else
+		ret = phy_loopback(priv->dev->phydev, false);
+
+	if (ret)
+		return ret;
+
+#endif
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+	return 0;
+}
+
+static int tc956xmac_config_l2_da_filter(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_l2_da_filter ioctl_data;
+	int ret = 0;
+	unsigned int reg_val = 0;
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if (ioctl_data.perfect_hash) {
+		if (HASH_TABLE_SIZE > 0)
+			priv->l2_filtering_mode = 1;
+		else
+			ret = -1;
+	} else
+		priv->l2_filtering_mode = 0;
+
+	/* configure the l2 filter matching mode */
+	reg_val = readl(priv->ioaddr + XGMAC_PACKET_FILTER);
+	reg_val &= ~XGMAC_PACKET_FILTER_DAIF;
+	reg_val |= ((ioctl_data.perfect_inverse_match & 0x1)
+		    << XGMAC_PACKET_FILTER_DAIF_LPOS);
+	writel(reg_val, priv->ioaddr + XGMAC_PACKET_FILTER);
+	return ret;
+}
+
+static int tc956xmac_config_vlan_filter(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_vlan_filter ioctl_data;
+	u32 reg_val;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	if (!(priv->dev->features & NETIF_F_HW_VLAN_CTAG_FILTER))
+		return -EPERM;
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+	/* Disabling VLAN is not supported */
+	if (ioctl_data.filter_enb_dis == 0)
+		return -EINVAL;
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.vlan_filter, flags);
+#endif
+#ifndef TC956X
+	/* configure the vlan filter */
+	reg_val = readl(priv->ioaddr + XGMAC_PACKET_FILTER);
+	reg_val =  (ioctl_data.filter_enb_dis << XGMAC_VLAN_VLC_SHIFT);
+	writel(reg_val, priv->ioaddr + XGMAC_PACKET_FILTER);
+#endif
+	reg_val = readl(priv->ioaddr + XGMAC_VLAN_TAG);
+	reg_val = (reg_val & (~XGMAC_VLANTR_VTIM)) |
+		  (ioctl_data.perfect_inverse_match << XGMAC_VLANTR_VTIM_LPOS);
+	reg_val = (reg_val & (~XGMAC_VLAN_VTHM)) |
+		  (ioctl_data.perfect_hash << XGMAC_VLANTR_VTHM_LPOS);
+
+	/* When VLAN filtering is enabled, then VL/VID
+	 * should be > zero, if VLAN is not configured. Otherwise all VLAN
+	 * packets will be accepted. Hence we are writting 1 into VL. It also
+	 * means that MAC will always receive VLAN pkt with VID = 1 if inverse
+	 * march is not set.
+	 */
+	/* If hash filtering is enabled,
+	 * By default enable MAC to calculate vlan hash on only 12-bits of
+	 * received VLAN tag (ie only on VLAN id and ignore priority and other
+	 * fields)
+	 *
+	 */
+
+		reg_val = (reg_val & (~XGMAC_VLAN_ETV)) |
+			  (1 << XGMAC_VLAN_VLC_SHIFT);
+
+	writel(reg_val, priv->ioaddr + XGMAC_VLAN_TAG);
+	priv->vlan_hash_filtering = ioctl_data.perfect_hash;
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.vlan_filter, flags);
+#endif
+	KPRINT_INFO("Successfully %s VLAN %s filtering and %s matching\n",
+		  (ioctl_data.filter_enb_dis ? "ENABLED" : "DISABLED"),
+		  (ioctl_data.perfect_hash ? "HASH" : "PERFECT"),
+		  (ioctl_data.perfect_inverse_match ? "INVERSE" : "PERFECT"));
+
+	return 0;
+}
+
+/**
+ *  tc956xmac_ioctl - Entry point for the Ioctl
+ *  @dev: Device pointer.
+ *  @rq: An IOCTL specefic structure, that can contain a pointer to
+ *  a proprietary structure used to pass information to the driver.
+ *  @cmd: IOCTL command
+ *  Description:
+ *  Currently it supports the phy_mii_ioctl(...) and HW time stamping.
+ */
+/*!
+ * \brief API to Check the FW status
+ * \param[in] tc956xmac priv structure
+ * \param[in] An IOCTL specefic structure, that can contain a data pointer
+ * \return 0 (success) or Error value (fail)
+ */
+static int tc956x_xgmac_get_fw_status(struct tc956xmac_priv *priv,
+					void __user *data)
+{
+	struct tc956x_ioctl_fwstatus ioctl_data;
+	u32 wdt_count1, wdt_count2;
+	u32 systick_count1, systick_count2;
+	u32 fw_status;
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+
+	/* Read the WDT counter and Systik count value */
+	wdt_count1 = readl(priv->ioaddr + INTC_INTINTWDMON);
+#ifdef TC956X
+	systick_count1 = readl(priv->tc956x_SRAM_pci_base_addr
+				+ SYSTCIK_SRAM_OFFSET);
+#endif
+
+	mdelay(1);
+
+	/* Read the WDT counter and Systick count value */
+	wdt_count2 = readl(priv->ioaddr + INTC_INTINTWDMON);
+#ifdef TC956X
+	systick_count2 = readl(priv->tc956x_SRAM_pci_base_addr
+				+ SYSTCIK_SRAM_OFFSET);
+#endif
+	fw_status  = 1; /* running */
+
+	/*
+	 * 1. Firmware running case
+	 * wdt_count1 and  wdt_count2  have different values ( second value
+	 * read after 1ms)
+	 * systick_count1 and, systick_count2  have different vlaue ( second
+	 * value read after 1ms)
+	 * 2. Firmware not running case
+	 * wdt_count1 and  wdt_count2  have same values ( 0 or FULL value)
+	 * systick_count1 and, systick_count2 will have same values
+	 */
+	if ((wdt_count1 == wdt_count2) || (systick_count1 == systick_count2))
+		fw_status  = -1; /* Not running */
+
+
+	ioctl_data.wdt_count = wdt_count2;
+	ioctl_data.systick_count = systick_count2;
+	ioctl_data.fw_status = fw_status;
+
+	if (copy_to_user(data, &ioctl_data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+
+	DBGPR_FUNC(priv->device, "<-- %s\n", __func__);
+	return 0;
+}
+
+
+/**
+ * tc956x_ptp_configuration - Configure PTP
+ * @priv: driver private structure
+ * Description: It is used for configuring the PTP
+ * Return value:
+ * 0 on success or negative error number.
+ */
+static void tc956x_ptp_configuration(struct tc956xmac_priv *priv, u32 tcr_config)
+{
+	struct timespec64 now;
+	u32 control, sec_inc;
+	u64 temp;
+
+	if (tcr_config == 0) {
+#if defined(TC956X_CPE_CONFIG)
+		control = PTP_TCR_TSENA | PTP_TCR_TSCTRLSSR
+				| PTP_TCR_TSCFUPDT;
+#else
+		control = PTP_TCR_TSENA | PTP_TCR_TSCTRLSSR
+				| PTP_TCR_TSCFUPDT | PTP_TCR_TSENALL;
+#endif
+		control |= PTP_TCR_PTGE;
+		control |= 0x10013e03;
+	} else {
+		control = tcr_config;
+	}
+
+	tc956xmac_config_hw_tstamping(priv, priv->ptpaddr, control);
+
+	/* program Sub Second Increment reg */
+#ifdef TC956X
+	tc956xmac_config_sub_second_increment(priv,
+		priv->ptpaddr, priv->plat->clk_ptp_rate,
+		priv->plat->has_xgmac,
+		&sec_inc);
+#endif
+
+	temp = div_u64(1000000000ULL, sec_inc);
+
+	/*
+	 * calculate default added value: formula is :
+	 * addend = (2^32)/freq_div_ratio; where, freq_div_ratio = 1e9ns/sec_inc
+	 */
+	temp = (u64)(temp << 32);
+
+	priv->default_addend = div_u64(temp, TC956X_PTP_SYSCLOCK);
+
+	tc956xmac_config_addend(priv, priv->ptpaddr, priv->default_addend);
+
+	ktime_get_real_ts64(&now);
+	tc956xmac_init_systime(priv, priv->ptpaddr, (u32)now.tv_sec, now.tv_nsec);
+
+	priv->hwts_tx_en = 1;
+	priv->hwts_rx_en = 1;
+
+}
+
+static int pps_configuration(struct tc956xmac_priv *priv,
+			 struct tc956xmac_PPS_Config *tc956x_pps_cfg)
+{
+	unsigned int sec, subsec, val, align_ns = 0;
+	int value, interval, width, ppscmd, trgtmodsel = 0x3;
+
+	value = readl(priv->ptpaddr + PTP_TCR);
+	if (!(value & 0x00000001)) {
+		tc956x_ptp_configuration(priv, 0);
+		DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+	}
+
+	interval = (tc956x_pps_cfg->ptpclk_freq + tc956x_pps_cfg->ppsout_freq/2)
+			/ tc956x_pps_cfg->ppsout_freq;
+
+	width = ((interval * tc956x_pps_cfg->ppsout_duty) + 50)/100 - 1;
+	if (width >= interval)
+		width = interval - 1;
+	if (width < 0)
+		width = 0;
+
+	ppscmd = 0x3;	/* cancel start */
+	DBGPR_FUNC(priv->device, "interval: %d, width: %d\n", interval, width);
+
+	if (tc956x_pps_cfg->ppsout_align == 1) {
+		DBGPR_FUNC(priv->device, "PPS: PPSOut_Config: freq=%dHz, ch=%d, duty=%d, align=%d\n",
+			tc956x_pps_cfg->ppsout_freq,
+			tc956x_pps_cfg->ppsout_ch,
+			tc956x_pps_cfg->ppsout_duty,
+			tc956x_pps_cfg->ppsout_align_ns);
+	} else {
+		DBGPR_FUNC(priv->device, "PPS: PPSOut_Config: freq=%dHz, ch=%d, duty=%d, No alignment\n",
+			tc956x_pps_cfg->ppsout_freq,
+			tc956x_pps_cfg->ppsout_ch,
+			tc956x_pps_cfg->ppsout_duty);
+	}
+
+	DBGPR_FUNC(priv->device, ": with PTP Clock freq=%dHz\n", tc956x_pps_cfg->ptpclk_freq);
+
+	if (tc956x_pps_cfg->ppsout_align == 1) {
+		align_ns = tc956x_pps_cfg->ppsout_align_ns;
+		DBGPR_FUNC(priv->device, "(1000000000/tc956x_pps_cfg->ppsout_freq) : %d, tc956x_pps_cfg->ppsout_align_ns: %d\n",
+			(1000000000/tc956x_pps_cfg->ppsout_freq), tc956x_pps_cfg->ppsout_align_ns);
+		/* (1000000000/tc956x_pps_cfg->ppsout_freq))  adjust 32ns sync */
+		if (align_ns < 32) {
+			align_ns += (1000000000 - 32);	/* (1000000000/tc956x_pps_cfg->ppsout_freq)); */
+			DBGPR_FUNC(priv->device, "align_ns : %x\n", align_ns);
+		} else {
+			align_ns -= 32;	/* (1000000000/tc956x_pps_cfg->ppsout_freq) */
+		}
+	}
+
+#ifdef TC956X
+	writel((interval-1), priv->ioaddr + XGMAC_PPSx_INTERVAL(tc956x_pps_cfg->ppsout_ch));
+	writel(width, priv->ioaddr + XGMAC_PPSx_WIDTH(tc956x_pps_cfg->ppsout_ch));
+#endif
+
+	if (priv->port_num == RM_PF0_ID) {
+		if (tc956x_pps_cfg->ppsout_ch == 0) {  /* PPO00 */
+			val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+			val &= (~NFUNCEN4_GPIO2_MASK);	/* GPIO2 */
+			val |= ((FUNCTION1 << NFUNCEN4_GPIO2_SHIFT) & NFUNCEN4_GPIO2_MASK);
+			writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+		} else if (tc956x_pps_cfg->ppsout_ch == 1) { /* PPO01 */
+			val = readl(priv->ioaddr + NFUNCEN0_OFFSET);
+			val &= (~NFUNCEN0_JTAGEN_MASK); /* Disable JTAGEN */
+			val &= (~NFUNCEN0_JTAG_MASK); /* Clear JTAG Function */
+			val |= ((FUNCTION2 << NFUNCEN0_JTAG_SHIFT) & NFUNCEN0_JTAG_MASK);
+			writel(val, priv->ioaddr + NFUNCEN0_OFFSET);
+		}
+	} else if (priv->port_num == RM_PF1_ID) {
+		if (tc956x_pps_cfg->ppsout_ch == 0) {  /* PPO10 */
+			val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+			val &= (~NFUNCEN4_GPIO4_MASK); /* GPIO4 */
+			val |= ((FUNCTION1 << NFUNCEN4_GPIO4_SHIFT) & NFUNCEN4_GPIO4_MASK);
+			writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+		} else if (tc956x_pps_cfg->ppsout_ch == 1) {  /* PPO11 */
+			val = readl(priv->ioaddr + NFUNCEN0_OFFSET);
+			val &= (~NFUNCEN0_JTAGEN_MASK); /* Disable JTAGEN */
+			val &= (~NFUNCEN0_JTAG_MASK); /* Clear JTAG Function */
+			val |= ((FUNCTION2 << NFUNCEN0_JTAG_SHIFT) & NFUNCEN0_JTAG_MASK);
+			writel(val, priv->ioaddr + NFUNCEN0_OFFSET);
+		}
+	}
+
+#ifdef TC956X
+	val = readl(priv->ioaddr + XGMAC_PPS_CONTROL);
+	val |= XGMAC_PPSCMDx(tc956x_pps_cfg->ppsout_ch, ppscmd);
+	writel(val, priv->ioaddr + XGMAC_PPS_CONTROL);
+	val &= ~(0x7 << (tc956x_pps_cfg->ppsout_ch * 8));
+	val |= (XGMAC_PPSCMD_STOP << (tc956x_pps_cfg->ppsout_ch * 8)); /* stop pulse train immediately */
+	writel(val, priv->ioaddr + XGMAC_PPS_CONTROL);
+
+	sec = readl(priv->ioaddr + PTP_XGMAC_OFFSET + PTP_STSR);		/* PTP seconds */
+	subsec = readl(priv->ioaddr + PTP_XGMAC_OFFSET + PTP_STNSR);	/* PTP subseconds */
+
+	/* second roll over */
+	if (readl(priv->ioaddr + PTP_XGMAC_OFFSET + PTP_STSR) != sec) {
+		sec  = readl(priv->ioaddr + PTP_XGMAC_OFFSET + PTP_STSR);	/* PTP seconds */
+		subsec = readl(priv->ioaddr + PTP_XGMAC_OFFSET + PTP_STNSR);/* PTP subseconds */
+	}
+	DBGPR_FUNC(priv->device, "sec: %x\n", sec);
+	DBGPR_FUNC(priv->device, "subsec: %x\n", subsec);
+	if (tc956x_pps_cfg->ppsout_align == 1) {
+		subsec += PPS_START_DELAY;
+		if (subsec >= align_ns) {
+			/* s  += 1; */
+			DBGPR_FUNC(priv->device, "sec: %x\n", sec);
+		}
+		sec += 2;
+		DBGPR_FUNC(priv->device, "align_ns: %x\n", align_ns);
+		/*  PPS target sec */
+		writel(sec, priv->ioaddr + XGMAC_PPSx_TARGET_TIME_SEC(tc956x_pps_cfg->ppsout_ch));
+		/* PPS target nsec */
+		writel(align_ns, priv->ioaddr + XGMAC_PPSx_TARGET_TIME_NSEC(tc956x_pps_cfg->ppsout_ch));
+	} else {
+		subsec += PPS_START_DELAY;
+		if (subsec >= 1000000000) {
+			subsec -= 1000000000;
+			sec += 1;
+		}
+		/* set subsecond */
+		/* PPS target sec */
+		writel(sec, priv->ioaddr + XGMAC_PPSx_TARGET_TIME_SEC(tc956x_pps_cfg->ppsout_ch));
+		/* PPS target nsec */
+		writel(subsec, priv->ioaddr + XGMAC_PPSx_TARGET_TIME_NSEC(tc956x_pps_cfg->ppsout_ch));
+	}
+
+	val = readl(priv->ioaddr + XGMAC_PPS_CONTROL);
+	val &= ~GENMASK(((tc956x_pps_cfg->ppsout_ch + 1) * 8) - 1, tc956x_pps_cfg->ppsout_ch * 8);
+	val |= (XGMAC_PPSCMD_START << (tc956x_pps_cfg->ppsout_ch * 8)) | 0x10;	/* PPSEN0 */
+	val |= XGMAC_TRGTMODSELx(tc956x_pps_cfg->ppsout_ch, trgtmodsel);/* pulse output only */
+	writel(val, priv->ioaddr + XGMAC_PPS_CONTROL);
+
+	val = readl(priv->ioaddr + XGMAC_PPS_CONTROL);
+
+#ifdef VERIFY_PPO_USING_AUX
+	/* Enable Aux_control (bit 4) */
+	val = readl(priv->ioaddr + XGMAC_MAC_AUX_CTRL);
+	val |= (0x1 << 4);	/* set bit 4 */
+	val |= (0x1 << 0);	/* set bit 0 */
+	writel(val, priv->ioaddr + XGMAC_MAC_AUX_CTRL);
+
+	val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+	val |= (0x1 << 4);	/* set bit 4 GPIO1 TRIG00 */
+	writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+
+	/*  enable the trig interrupt */
+	val = readl(priv->ioaddr + XGMAC_INT_EN);
+	val &= ~(0x1 << 5);	/* clear bit 5 to disable LPI interrupt */
+	val |= (0x1 << 12);	/* set bit 12req=50000000Hz */
+	writel(val, priv->ioaddr + XGMAC_INT_EN);
+#endif
+#endif /* TC956X */
+
+	return 0;
+}
+
+/*!
+ * \brief API to configure pps
+ * \param[in] tc956xmac priv structure
+ * \param[in] An IOCTL specefic structure, that can contain a data pointer
+ * \return 0 (success) or Error value (fail)
+ */
+static int tc956xmac_set_ppsout(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_PPS_Config *tc956x_pps_cfg, tc956x_pps_cfg_data;
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	if (copy_from_user(&tc956x_pps_cfg_data, data, sizeof(struct tc956xmac_PPS_Config)))
+		return -EFAULT;
+
+	tc956x_pps_cfg = (struct tc956xmac_PPS_Config *)(&tc956x_pps_cfg_data);
+
+	if (tc956x_pps_cfg->ppsout_duty <= 0) {
+		DBGPR_FUNC(priv->device, "PPS: PPSOut_Config: duty cycle is invalid. Using duty=1\n");
+		tc956x_pps_cfg->ppsout_duty = 1;
+		return -EFAULT;
+	} else if (tc956x_pps_cfg->ppsout_duty >= 100) {
+		DBGPR_FUNC(priv->device, "PPS: PPSOut_Config: duty cycle is invalid. Using duty=99\n");
+		tc956x_pps_cfg->ppsout_duty = 99;
+		return -EFAULT;
+	}
+
+	if ((tc956x_pps_cfg->ppsout_ch != 0) && (tc956x_pps_cfg->ppsout_ch != 1)) {
+		DBGPR_FUNC(priv->device, "pps channel %d not supported by GPIO\n", tc956x_pps_cfg->ppsout_ch);
+		return -EFAULT;
+	}
+
+	return(pps_configuration(priv, tc956x_pps_cfg));
+}
+
+/*!
+ * \brief API to configure PTP clock
+ * \param[in] tc956xmac priv structure
+ * \param[in] An IOCTL specefic structure, that can contain a data pointer
+ * ptp_clock should be > 3.921568 MHz
+ * \return 0 (success) or Error value (fail)
+ */
+static int tc956xmac_ptp_clk_config(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_PPS_Config *tc956x_pps_cfg, tc956x_pps_cfg_data;
+	int ret = 0;
+	u32 value = 0;
+	__u64 temp = 0;
+	__u32 sec_inc;
+	struct timespec64 now;
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	if (copy_from_user(&tc956x_pps_cfg_data, data, sizeof(struct tc956xmac_PPS_Config))) {
+		DBGPR_FUNC(priv->device, "copy_from_user error: ifr data structure\n");
+		return -EFAULT;
+	}
+
+	tc956x_pps_cfg = (struct tc956xmac_PPS_Config *)(&tc956x_pps_cfg_data);
+
+	/*  Update minimum functional ptpclk_freq */
+	if ((tc956x_pps_cfg->ptpclk_freq == 0)
+	|| (tc956x_pps_cfg->ptpclk_freq > 250000000)) {
+		DBGPR_FUNC(priv->device, "PPS: Invalid PTPCLK_Config: freq=%dHz\n",
+			tc956x_pps_cfg->ptpclk_freq);
+		return -1;
+	}
+
+#ifdef TC956X
+	tc956xmac_config_sub_second_increment(priv,
+				priv->ptpaddr, tc956x_pps_cfg->ptpclk_freq,
+				priv->plat->has_xgmac,
+				&sec_inc);
+#endif
+
+	DBGPR_FUNC(priv->device, "sec_inc : %x , tc956x_pps_cfg->ptpclk_freq :%d\n", sec_inc, tc956x_pps_cfg->ptpclk_freq);
+	temp = div_u64(1000000000ULL, sec_inc);
+	temp = (u64)(temp << 32);
+	priv->default_addend = div_u64(temp, TC956X_PTP_SYSCLOCK);
+
+	DBGPR_FUNC(priv->device, "priv->default_addend : %x\n", priv->default_addend);
+	/*  Add handling of config_addend return */
+	tc956xmac_config_addend(priv, priv->ptpaddr, priv->default_addend);
+
+	value = readl(priv->ptpaddr + PTP_TCR);
+	/* Note : TSENA never disabled. */
+	if (!(value & 0x00000001)) {
+		DBGPR_FUNC(priv->device, "tc956x_xgmac_ptp_clk_config : init systime\n");
+		/* initialize system time */
+		ktime_get_real_ts64(&now);
+		tc956xmac_init_systime(priv, priv->ptpaddr, (u32)now.tv_sec, now.tv_nsec);
+		value |= PTP_TCR_TSINIT | PTP_TCR_TSENA | PTP_TCR_TSCFUPDT | PTP_TCR_TSCTRLSSR;
+		tc956xmac_config_hw_tstamping(priv, priv->ptpaddr, value);
+	}
+
+	return ret;
+}
+
+/*!
+ * \brief API to configure ptp offloading feature
+ * \param[in] tc956xmac priv structure
+ * \param[in] An IOCTL specefic structure, that can contain a data pointer
+ * \return 0 (success) or Error value (fail)
+ */
+static int tc956xmac_config_ptpoffload(struct tc956xmac_priv *priv, void __user *data)
+{
+	u32 pto_cntrl;
+	u32 varMAC_TCR;
+	struct tc956x_config_ptpoffloading ioctl_data;
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if ((ioctl_data.domain_num < 0U)
+	|| (ioctl_data.domain_num > 0xFFU)) {
+		return -EINVAL;
+	}
+
+	pto_cntrl = XGMAC_PTOEN;	/* enable ptp offloading */
+
+	varMAC_TCR = readl(priv->ptpaddr + PTP_TCR);
+	varMAC_TCR &= ~PTP_TCR_MODE_MASK;
+
+	if (ioctl_data.mode == TC956X_PTP_ORDINARY_SLAVE) {
+		varMAC_TCR |= PTP_TCR_TSEVNTENA;
+		priv->ptp_offloading_mode = TC956X_PTP_ORDINARY_SLAVE;
+	} else if (ioctl_data.mode == TC956X_PTP_TRASPARENT_SLAVE) {
+		pto_cntrl |= XGMAC_APDREQEN;
+		varMAC_TCR |= PTP_TCR_TSEVNTENA;
+		varMAC_TCR = varMAC_TCR & (~PTP_GMAC4_TCR_SNAPTYPSEL_1);
+		varMAC_TCR |= PTP_TCR_SNAPTYPSEL_1;
+		priv->ptp_offloading_mode = TC956X_PTP_TRASPARENT_SLAVE;
+	} else if (ioctl_data.mode == TC956X_PTP_ORDINARY_MASTER) {
+		pto_cntrl |= XGMAC_ASYNCEN;
+		varMAC_TCR |= PTP_TCR_TSEVNTENA;
+		varMAC_TCR |= PTP_TCR_TSMSTRENA;
+		priv->ptp_offloading_mode = TC956X_PTP_ORDINARY_MASTER;
+	} else if (ioctl_data.mode == TC956X_PTP_TRASPARENT_MASTER) {
+		pto_cntrl |= XGMAC_ASYNCEN | XGMAC_APDREQEN;
+		varMAC_TCR = varMAC_TCR & (~PTP_GMAC4_TCR_SNAPTYPSEL_1);
+		varMAC_TCR |= PTP_TCR_SNAPTYPSEL_1;
+		varMAC_TCR |= PTP_TCR_TSEVNTENA;
+		varMAC_TCR |= PTP_TCR_TSMSTRENA;
+		priv->ptp_offloading_mode = TC956X_PTP_TRASPARENT_MASTER;
+	} else if (ioctl_data.mode == TC956X_PTP_PEER_TO_PEER_TRANSPARENT) {
+		pto_cntrl |= XGMAC_APDREQEN;
+		varMAC_TCR |= (3 << PTP_TCR_SNAPTYPSEL_1_LPOS);
+		priv->ptp_offloading_mode = TC956X_PTP_PEER_TO_PEER_TRANSPARENT;
+	} else
+		return -EINVAL;
+
+	priv->ptp_offload = 1;
+	pto_cntrl |= (ioctl_data.domain_num << 8);
+
+	if ((ioctl_data.en_dis != TC956X_PTP_OFFLOADING_DISABLE) && (ioctl_data.mc_uc == 1))
+		tc956x_add_mac_addr(priv->dev, ioctl_data.mc_uc_addr);
+
+	if (ioctl_data.en_dis == TC956X_PTP_OFFLOADING_DISABLE) {
+		pto_cntrl = 0;
+		varMAC_TCR = readl(priv->ptpaddr + PTP_TCR);
+		priv->ptp_offload = 0;
+	}
+
+	writel(varMAC_TCR, priv->ptpaddr + PTP_TCR);
+
+
+#ifdef TC956X
+	writel(pto_cntrl, priv->ioaddr + XGMAC_PTO_CTRL);
+#endif
+	varMAC_TCR = readl(priv->ptpaddr + PTP_TCR);
+	varMAC_TCR &= (~PTP_TCR_TSENMACADDR);
+	varMAC_TCR |= ((ioctl_data.mc_uc & 0x1) << PTP_TCR_MC_UC_LPOS);
+	writel(varMAC_TCR, priv->ptpaddr + PTP_TCR);
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	return 0;
+}
+#endif
+
+#ifndef TC956X_SRIOV_VF
+
+/*!
+ * \brief API to configure to enable auxiliary timestamp feature
+ * \param[in] tc956xmac priv structure
+ * \param[in] An IOCTL specific structure, that can contain a data pointer
+ * \return 0 (success) or Error value (fail)
+ */
+static int tc956xmac_aux_timestamp_enable(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956x_ioctl_aux_snapshot ioctl_data;
+	u32 aux_cntrl_en, val, msi_out_val;
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	aux_cntrl_en = readl(priv->ioaddr + XGMAC_MAC_AUX_CTRL);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if (ioctl_data.aux_snapshot_ctrl > 1)
+		return -EFAULT;
+
+	if ((ioctl_data.aux_snapshot_ctrl & TC956X_AUX_SNAPSHOT_0))
+		aux_cntrl_en |= XGMAC_ATSEN0;
+	else
+		aux_cntrl_en &= ~XGMAC_ATSEN0;
+
+	/* Auxiliary timestamp FIFO clear */
+	aux_cntrl_en |= XGMAC_ATSFC;
+
+	writel(aux_cntrl_en, priv->ioaddr + XGMAC_MAC_AUX_CTRL);
+
+	if (priv->port_num == RM_PF0_ID) {
+		val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+		val &= ~TRIG00_MASK;
+		val |= (0x1 << TRIG00_SHIFT);	/* set bit 4 GPIO1 TRIG00 */
+		writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+	}
+	if (priv->port_num == RM_PF1_ID) {
+		val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+		val &= ~TRIG10_MASK;
+		val |= (0x1 << TRIG10_SHIFT);	/* set bit 12 GPIO3 TRIG10 */
+		writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+	}
+
+	msi_out_val = readl(priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->port_num, 0));
+	msi_out_val |= (0x1 << TC956X_MSI_OUT_INTR_EVENT);
+	writel(msi_out_val, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->port_num, 0));
+	/* Enable the Trig interrupt */
+	val = readl(priv->ioaddr + XGMAC_INT_EN);
+	val |= (0x1 << TSIE_SHIFT); /* set bit 12req=50000000Hz */
+	writel(val, priv->ioaddr + XGMAC_INT_EN);
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	return 0;
+
+}
+
+/*!
+ * \brief API to configure to enable/disable onestep timestamp feature
+ * \param[in] tc956xmac priv structure
+ * \param[in] An IOCTL specefic structure, that can contain a data pointer
+ * \return 0 (success) or Error value (fail)
+ */
+static int tc956xmac_config_onestep_timestamp(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956x_config_ost ioctl_data;
+
+	DBGPR_FUNC(priv->device, "--> %s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if ((priv->dma_cap.osten) && (ioctl_data.en_dis == 1))
+		priv->ost_en = 1;
+	else
+		priv->ost_en = 0;
+
+	return 0;
+
+}
+
+static int tc956xmac_sa_vlan_ins_config(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_sa_ins_cfg ioctl_data;
+	u32 reg_data;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if (priv->dma_cap.vlins) {
+		switch (ioctl_data.cmd) {
+		case TC956XMAC_SA0_VLAN_INS_REP_REG:
+			priv->sa_vlan_ins_via_reg = ioctl_data.control_flag;
+			if (ioctl_data.control_flag == TC956XMAC_SA0_NONE)
+				memcpy(priv->ins_mac_addr, priv->dev->dev_addr, ETH_ALEN);
+			else
+				memcpy(priv->ins_mac_addr, ioctl_data.mac_addr, ETH_ALEN);
+
+#ifdef TC956X
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+			spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+
+			tc956xmac_set_umac_addr(priv, priv->hw, priv->ins_mac_addr, 0, PF_DRIVER);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+			spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+			reg_data = readl(priv->ioaddr + XGMAC_TX_CONFIG);
+			reg_data = (reg_data & (~XGMAC_CONFIG_SARC)) |
+				   (priv->sa_vlan_ins_via_reg << XGMAC_CONFIG_SARC_SHIFT);
+			writel(reg_data, priv->ioaddr + XGMAC_TX_CONFIG);
+#endif
+
+			NMSGPR_ALERT(priv->device, "SA will use MAC0 with register for configuration %d\n", priv->sa_vlan_ins_via_reg);
+			break;
+		case TC956XMAC_SA1_VLAN_INS_REP_REG:
+			priv->sa_vlan_ins_via_reg = ioctl_data.control_flag;
+			if (ioctl_data.control_flag == TC956XMAC_SA1_NONE)
+				memcpy(priv->ins_mac_addr, priv->dev->dev_addr, ETH_ALEN);
+			else
+				memcpy(priv->ins_mac_addr, ioctl_data.mac_addr, ETH_ALEN);
+
+#ifdef TC956X
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+			spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+			tc956xmac_set_umac_addr(priv, priv->hw, priv->ins_mac_addr, 1, PF_DRIVER);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+			spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+			reg_data = readl(priv->ioaddr + XGMAC_TX_CONFIG);
+			reg_data = (reg_data & (~XGMAC_CONFIG_SARC)) |
+				   (priv->sa_vlan_ins_via_reg << XGMAC_CONFIG_SARC_SHIFT);
+			writel(reg_data, priv->ioaddr + XGMAC_TX_CONFIG);
+#endif
+			NMSGPR_ALERT(priv->device, "SA will use MAC1 with register for configuration %d\n", priv->sa_vlan_ins_via_reg);
+			break;
+		default:
+			return -EINVAL;
+		}
+	} else {
+		NMSGPR_ALERT(priv->device, "Device doesn't supports SA Insertion/Replacement\n");
+		return -EINVAL;
+	}
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+	return 0;
+}
+
+#endif /* TC956X_SRIOV_VF */
+static int tc956xmac_get_tx_qcnt(struct tc956xmac_priv *priv, void __user *data)
+{
+	u32 tx_qcnt = 0;
+	struct tc956xmac_ioctl_tx_qcnt ioctl_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	tx_qcnt = priv->plat->tx_queues_to_use;
+	if (copy_to_user((void __user *)ioctl_data.ptr, &tx_qcnt, sizeof(unsigned int)))
+		return -EFAULT;
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+
+static int tc956xmac_get_rx_qcnt(struct tc956xmac_priv *priv, void __user *data)
+{
+	u32 rx_qcnt = 0;
+	struct tc956xmac_ioctl_rx_qcnt ioctl_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	rx_qcnt = priv->plat->rx_queues_to_use;
+	if (copy_to_user((void __user *)ioctl_data.ptr, &rx_qcnt, sizeof(unsigned int)))
+		return -EFAULT;
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+
+/*!
+ * \brief API to read pcie conf register
+ * \param[in] address offset as per tc956x data-sheet
+ * \return -EFAULT in case of error, otherwise 0
+ * \description register can be read for pcie conf between 0 to 0xFFF.
+ */
+static int tc956xmac_pcie_config_reg_rd(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_pcie_reg_rd_wr ioctl_data;
+	u32 val;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	pci_read_config_dword(priv->plat->pdev, ioctl_data.addr, &val);
+
+	if (copy_to_user((void __user *)ioctl_data.ptr, &val, sizeof(unsigned int)))
+		return -EFAULT;
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+
+/*!
+ * \brief API to write pcie conf register
+ * \param[in] address offset as per tc956x data-sheet
+ * \return -EFAULT in case of error, otherwise 0
+ * \description register can be written for pcie conf between 0 to 0xFFF.
+ */
+static int tc956xmac_pcie_config_reg_wr(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_pcie_reg_rd_wr ioctl_data;
+	u32 val;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if (copy_from_user(&val, (const void __user *) ioctl_data.ptr, sizeof(unsigned int)))
+		return -EFAULT;
+
+	pci_write_config_dword(priv->plat->pdev, ioctl_data.addr, val);
+
+	DBGPR_FUNC(priv->device, "<--%s\n", __func__);
+
+	return 0;
+}
+
+#ifndef TC956X_SRIOV_VF
+/*!
+ * \brief IOCTL to enable/disable VLAN Rx Stripping
+ * \param[in] priv driver private structure
+ * \param[in] data user data
+ * \return -EFAULT in case of error, otherwise 0
+ * \description enable/disable stripping.
+ * Enable this function only if NETIF_F_HW_VLAN_CTAG_RX is user-configureable.
+ */
+static int tc956xmac_vlan_strip_config(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956xmac_ioctl_vlan_strip_cfg ioctl_data;
+	u32 reg_data;
+	struct net_device *dev = priv->dev;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	if (ioctl_data.enabled == 1) {
+		/* Enable VLAN Stripping */
+#ifdef TC956X
+		reg_data = readl(priv->ioaddr + XGMAC_VLAN_TAG);
+		reg_data &= ~XGMAC_VLAN_EVLS;
+		reg_data |= 0x3 << XGMAC_VLAN_EVLS_SHIFT;
+		dev->features |= NETIF_F_HW_VLAN_CTAG_RX;
+		writel(reg_data, priv->ioaddr + XGMAC_VLAN_TAG);
+#endif
+	} else {
+		/* Disable VLAN Stripping */
+#ifdef TC956X
+		reg_data = readl(priv->ioaddr + XGMAC_VLAN_TAG);
+		reg_data &= ~XGMAC_VLAN_EVLS;
+		dev->features &= ~NETIF_F_HW_VLAN_CTAG_RX;
+		writel(reg_data, priv->ioaddr + XGMAC_VLAN_TAG);
+#endif
+	}
+	netdev_features_change(dev);
+	return 0;
+}
+
+#ifdef TC956X
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static int tc956xmac_mode1_usp_lane_change_4_to_1(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 reg_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+
+	/* Clear SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 */
+	writel(0, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+	/* Set SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 to
+	 * direct Link Width Change (x4 --> x1) to PCIe Switch USP
+	 */
+	writel(USP_LINK_WIDTH_CHANGE_4_TO_1, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+	/* Set phy_core_reg_access_enable Register in Glue Logic Register to select
+	 * PHY_CORE 0 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	reg_data &= ~PHY_CORE_ENABLE_MASK;
+	reg_data |= (PHY_CORE_0_ENABLE & PHY_CORE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+
+	/* Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+	 * select Lane 1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+	reg_data &= ~LANE_ENABLE_MASK;
+	reg_data |= (LANE_1_ENABLE & LANE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+
+	/*Set pcs2pma_power_ctrl Register in PHY PHY_CORE0 Lane 1 PMA Lane Register
+	 * to select Lane 1 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_POWER_CTL);
+	reg_data &= ~POWER_CTL_MASK;
+	reg_data |= (POWER_CTL_LOW_POWER_ENABLE & POWER_CTL_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_POWER_CTL);
+
+
+	/* Set pcs2pma_power_ctrl_ovren Register in PHY PHY_CORE 0 Lane 1 PMA Lane Register
+	 * to select Lane 1 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_OVEREN_POWER_CTL);
+	writel((reg_data | POWER_CTL_OVER_ENABLE), ioaddr + TC956X_PHY_CORE0_OVEREN_POWER_CTL);
+
+
+	/* Set phy_core_reg_access_enable Register in Glue Logic Register to
+	 * select PHY_CORE 1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	reg_data &= ~PHY_CORE_ENABLE_MASK;
+	reg_data |= (PHY_CORE_1_ENABLE & PHY_CORE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+	/*Set lane_access_enable Register in PHY PHY_CORE 1 PCS Global Register to
+	 * select Lane 2/3 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+	reg_data &= ~LANE_ENABLE_MASK;
+	reg_data |= ((LANE_1_ENABLE | LANE_0_ENABLE) & LANE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+
+	/*Set pcs2pma_power_ctrl Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register
+	 * to select Lane 2/3 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_POWER_CTL);
+	reg_data &= ~POWER_CTL_MASK;
+	reg_data |= (POWER_CTL_LOW_POWER_ENABLE & POWER_CTL_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_POWER_CTL);
+
+	/* Set pcs2pma_power_ctrl_ovren Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register
+	 * to select Lane 2/3 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+	writel((reg_data | POWER_CTL_OVER_ENABLE), ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+
+	return 0;
+}
+
+
+static int tc956xmac_mode1_usp_lane_change_4_to_2(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 reg_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* Clear SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 */
+	writel(0, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+	/* Set SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 to
+	 * direct Link Width Change (x4 --> x2) to PCIe Switch USP
+	 */
+	writel(USP_LINK_WIDTH_CHANGE_4_TO_2, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+
+	/* Set phy_core_reg_access_enable Register in Glue Logic Register to
+	 * select PHY_CORE 1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	reg_data &= ~PHY_CORE_ENABLE_MASK;
+	reg_data |= (PHY_CORE_1_ENABLE & PHY_CORE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+	/*Set lane_access_enable Register in PHY PHY_CORE 1 PCS Global Register to
+	 * select Lane 2/3 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+	reg_data &= ~LANE_ENABLE_MASK;
+	reg_data |= ((LANE_1_ENABLE | LANE_0_ENABLE) & LANE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+
+	/*Set pcs2pma_power_ctrl Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register to
+	 * select Lane 2/3 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_POWER_CTL);
+	reg_data &= ~POWER_CTL_MASK;
+	reg_data |= (POWER_CTL_LOW_POWER_ENABLE & POWER_CTL_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_POWER_CTL);
+
+	/* Set pcs2pma_power_ctrl_ovren Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register to
+	 * select Lane 2/3 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+	writel((reg_data | POWER_CTL_OVER_ENABLE), ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+
+	return 0;
+}
+
+static int tc956xmac_mode1_usp_lane_change_1_2_to_4(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 reg_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+
+	/* Set phy_core_reg_access_enable Register in Glue Logic Register to
+	 * select PHY_CORE 1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	reg_data &= ~PHY_CORE_ENABLE_MASK;
+	reg_data |= (PHY_CORE_1_ENABLE & PHY_CORE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+	/*Set lane_access_enable Register in PHY PHY_CORE 1 PCS Global Register to
+	 * select Lane 2/3 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+	reg_data &= ~LANE_ENABLE_MASK;
+	reg_data |= ((LANE_1_ENABLE | LANE_0_ENABLE) & LANE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+
+	/* Clear pcs2pma_power_ctrl_ovren Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register to
+	 * select Lane 2/3 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+	reg_data &= (~POWER_CTL_OVER_ENABLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+
+	/* Clear Rate 0 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R0);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R0);
+
+	/*Clear Rate 1 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R1);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R1);
+
+	/*Clear Rate 2 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R2);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R2);
+
+	/* Set Rate 0 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R0);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R0);
+
+	/*Set Rate 1 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R1);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R1);
+
+	/*Set Rate 2 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 2/3 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R2);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R2);
+
+
+	/* Set phy_core_reg_access_enable Register in Glue Logic Register to
+	 * select PHY_CORE 0 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	reg_data &= ~PHY_CORE_ENABLE_MASK;
+	reg_data |= (PHY_CORE_0_ENABLE & PHY_CORE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+	/* Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+	 * select Lane 0/1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+	reg_data &= ~LANE_ENABLE_MASK;
+	reg_data |= ((LANE_1_ENABLE | LANE_0_ENABLE) & LANE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+	/* Clear pcs2pma_power_ctrl_ovren Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register to
+	 * select Lane 0/1 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_OVEREN_POWER_CTL);
+	reg_data &= (~POWER_CTL_OVER_ENABLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_OVEREN_POWER_CTL);
+
+	/* Clear Rate 0 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R0);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R0);
+
+	/*Clear Rate 1 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R1);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R1);
+
+	/*Clear Rate 2 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R2);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R2);
+
+	/* Set Rate 0 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R0);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R0);
+
+	/* Wait for 100us */
+	udelay(100);
+
+	/*Set Rate 1 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R1);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R1);
+
+	/* Wait for 100us */
+	udelay(100);
+
+	/*Set Rate 2 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R2);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R2);
+
+	/* Wait for 100us */
+	udelay(100);
+
+	/* Clear SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 */
+	writel(0, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+	/* Set SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 to
+	 * direct Link Width Change (x1/x2 --> x4) to PCIe Switch USP
+	 */
+	writel(USP_LINK_WIDTH_CHANGE_1_2_TO_4, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+
+	return 0;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static int tc956xmac_mode2_usp_lane_change_2_to_1(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 reg_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* Clear SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 */
+	writel(0, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+	/* Set SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 to
+	 * direct Link Width Change (x2 --> x1) to PCIe Switch USP
+	 */
+	writel(USP_LINK_WIDTH_CHANGE_2_TO_1, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+
+	/* Set phy_core_reg_access_enable Register in Glue Logic Register to
+	 * select PHY_CORE 0 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	reg_data &= ~PHY_CORE_ENABLE_MASK;
+	reg_data |= (PHY_CORE_0_ENABLE & PHY_CORE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+	/*Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+	 * select Lane 1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+	reg_data &= ~LANE_ENABLE_MASK;
+	reg_data |= (LANE_1_ENABLE & LANE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+	/*Set pcs2pma_power_ctrl Register in PHY PHY_CORE0 Lane 1 PMA Lane Register to
+	 * select Lane 1 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_POWER_CTL);
+	reg_data &= ~POWER_CTL_MASK;
+	reg_data |= (POWER_CTL_LOW_POWER_ENABLE & POWER_CTL_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_POWER_CTL);
+
+	/* Set pcs2pma_power_ctrl_ovren Register in PHY PHY_CORE 0 Lane 1 PMA Lane Register to
+	 * select Lane 1 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_OVEREN_POWER_CTL);
+	writel((reg_data | POWER_CTL_OVER_ENABLE), ioaddr + TC956X_PHY_CORE0_OVEREN_POWER_CTL);
+
+	return 0;
+}
+
+static int tc956xmac_mode2_usp_lane_change_1_to_2(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 reg_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+
+	/* Set phy_core_reg_access_enable Register in Glue Logic Register to
+	 * select PHY_CORE 0 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	reg_data &= ~PHY_CORE_ENABLE_MASK;
+	reg_data |= (PHY_CORE_0_ENABLE & PHY_CORE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+	/* Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+	 * select Lane 0/1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+	reg_data &= ~LANE_ENABLE_MASK;
+	reg_data |= ((LANE_1_ENABLE | LANE_0_ENABLE) & LANE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+	/* Clear pcs2pma_power_ctrl_ovren Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register to
+	 * select Lane 0/1 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_OVEREN_POWER_CTL);
+	reg_data &= (~POWER_CTL_OVER_ENABLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_OVEREN_POWER_CTL);
+
+	/* Clear Rate 0 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R0);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R0);
+
+	/*Clear Rate 1 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R1);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R1);
+
+	/*Clear Rate 2 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R2);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R2);
+
+	/* Set Rate 0 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R0);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R0);
+
+	/* Wait for 100us */
+	udelay(100);
+
+	/*Set Rate 1 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R1);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R1);
+
+	/* Wait for 100us */
+	udelay(100);
+
+	/*Set Rate 2 pc_debug_p1_toggle Register in PHY PHY_CORE 0 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE0_MISC_RW0_R2);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE0_MISC_RW0_R2);
+
+	/* Wait for 100us */
+	udelay(100);
+
+	/* Clear SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 */
+	writel(0, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+	/* Set SW_USP_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 to
+	 * direct Link Width Change (x1 --> x2) to PCIe Switch USP
+	 */
+	writel(USP_LINK_WIDTH_CHANGE_1_TO_2, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+
+	return 0;
+}
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+static int tc956xmac_mode2_dsp1_lane_change_2_to_1(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 reg_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* Clear SW_DSP1_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 */
+	writel(0, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+	/* Set SW_DSP1_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 to
+	 * direct Link Width Change (x2 --> x1) to PCIe Switch DSP1
+	 */
+	writel(DSP1_LINK_WIDTH_CHANGE_2_TO_1, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+	/* Set phy_core_reg_access_enable Register in Glue Logic Register to
+	 * select PHY_CORE 1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	reg_data &= ~PHY_CORE_ENABLE_MASK;
+	reg_data |= (PHY_CORE_1_ENABLE & PHY_CORE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+	/*Set lane_access_enable Register in PHY PHY_CORE 1 PCS Global Register to
+	 * select Lane 1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+	reg_data &= ~LANE_ENABLE_MASK;
+	reg_data |= (LANE_1_ENABLE & LANE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+
+	/*Set pcs2pma_power_ctrl Register in PHY PHY_CORE 1 Lane 1 PMA Lane Register to
+	 * select Lane 1 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_POWER_CTL);
+	reg_data &= ~POWER_CTL_MASK;
+	reg_data |= (POWER_CTL_LOW_POWER_ENABLE & POWER_CTL_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_POWER_CTL);
+
+	/* Set pcs2pma_power_ctrl_ovren Register in PHY PHY_CORE 1 Lane 1 PMA Lane Register to
+	 * select Lane 1 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+	writel((reg_data | POWER_CTL_OVER_ENABLE), ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+
+	return 0;
+}
+
+static int tc956xmac_mode2_dsp1_lane_change_1_to_2(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 reg_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+
+	/* Set phy_core_reg_access_enable Register in Glue Logic Register to
+	 * select PHY_CORE 1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+	reg_data &= ~PHY_CORE_ENABLE_MASK;
+	reg_data |= (PHY_CORE_1_ENABLE & PHY_CORE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+
+	/* Set lane_access_enable Register in PHY PHY_CORE 1 PCS Global Register to
+	 * select Lane 0/1 to access by APB I/F
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+	reg_data &= ~LANE_ENABLE_MASK;
+	reg_data |= ((LANE_1_ENABLE | LANE_0_ENABLE) & LANE_ENABLE_MASK);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_GL_LANE_ACCESS);
+
+	/* Clear pcs2pma_power_ctrl_ovren Register in PHY PHY_CORE 1 Lane 0/1 PMA Lane Register to
+	 * select Lane 0/1 to set Low Power mode
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+	reg_data &= (~POWER_CTL_OVER_ENABLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_OVEREN_POWER_CTL);
+
+	/* Clear Rate 0 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R0);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R0);
+
+	/*Clear Rate 1 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R1);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R1);
+
+	/*Clear Rate 2 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R2);
+	reg_data &= (~PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R2);
+
+	/* Set Rate 0 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R0);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R0);
+
+	/* Wait for 100us */
+	udelay(100);
+
+	/*Set Rate 1 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R1);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R1);
+
+	/* Wait for 100us */
+	udelay(100);
+
+	/*Set Rate 2 pc_debug_p1_toggle Register in PHY PHY_CORE 1 Lane 0/1 PMA Lane Register*/
+	reg_data = readl(ioaddr + TC956X_PHY_CORE1_MISC_RW0_R2);
+	reg_data |= (PC_DEBUG_P1_TOGGLE);
+	writel(reg_data, ioaddr + TC956X_PHY_CORE1_MISC_RW0_R2);
+
+	/* Wait for 100us */
+	udelay(100);
+
+	/* Clear SW_DSP1_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 */
+	writel(0, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+	/* Set SW_DSP1_TL_PM_BWCHANGE Register in Glue Logic Register rsvd_rw0 to
+	 * direct Link Width Change (x1 --> x2) to PCIe Switch DSP1
+	 */
+	writel(DSP1_LINK_WIDTH_CHANGE_1_TO_2, ioaddr + TC956X_GLUE_RSVD_RW0);
+
+
+	return 0;
+}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+static int tc956xmac_pcie_lane_change(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956x_ioctl_pcie_lane_change ioctl_data;
+	u32 reg_data;
+	u32 pcie_mode;
+	enum lane_width usp_curr_lane_width, dsp1_curr_lane_width;
+	void __iomem *ioaddr;
+
+	ioaddr = priv->ioaddr;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* Return error if the interface where lane change request sent is not Port 0 */
+	if (priv->port_num != RM_PF0_ID) {
+		KPRINT_INFO("Lane change requested through wrong interface\n\r");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	/* Read mode setting register
+	 * Mode settings values 0:Setting A: x4x1x1, 1:Setting B: x2x2x1
+	 */
+	reg_data = readl(priv->ioaddr + NMODESTS_OFFSET);
+	pcie_mode = (reg_data & NMODESTS_MODE2) >> NMODESTS_MODE2_SHIFT;
+
+	KPRINT_INFO("Pcie mode: %d\n\r", pcie_mode);
+
+	/* Get the current lane setting from glue lane monitor register */
+	reg_data = readl(priv->ioaddr + TC956X_GLUE_TL_NUM_LANES_MON);
+	usp_curr_lane_width = (reg_data & USP_LANE_WIDTH_MASK);
+	dsp1_curr_lane_width = ((reg_data & DSP1_LANE_WIDTH_MASK) >> DSP1_LANE_WIDTH_SHIFT);
+
+	switch (pcie_mode) {
+	case TC956X_PCIE_SETTING_A: /* 0:Setting A: x4x1x1 mode */
+		/* Only USP port lane can be changed in this setting, others return error */
+		if (ioctl_data.port != UPSTREAM_PORT) {
+			KPRINT_INFO("Lane change requested for unsupported port\n\r");
+			return -EINVAL;
+		}
+
+		/* If target link width is same as current width, return 0*/
+		if (usp_curr_lane_width == ioctl_data.target_lane_width) {
+			KPRINT_INFO("Already port is in requested lane. No change required\n\r");
+			return 0;
+		}
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+		/* All lane width change from x4 to x1, x4 to x2, x1/x2 to x4 are allowed */
+		if (usp_curr_lane_width == LANE_4 && ioctl_data.target_lane_width == LANE_1)
+			return tc956xmac_mode1_usp_lane_change_4_to_1(priv, ioaddr);
+		else if (usp_curr_lane_width == LANE_4 && ioctl_data.target_lane_width == LANE_2)
+			return tc956xmac_mode1_usp_lane_change_4_to_2(priv, ioaddr);
+		else if (ioctl_data.target_lane_width == LANE_4) /* x1/x2 to x4*/
+			return tc956xmac_mode1_usp_lane_change_1_2_to_4(priv, ioaddr);
+		else
+			return -EINVAL;
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+	break;
+	case TC956X_PCIE_SETTING_B: /* 1:Setting B: x2x2x1 mode */
+		/* Only USP and DSP1 port lane can be changed in this setting, others return error */
+		if ((ioctl_data.port != UPSTREAM_PORT) &&
+			(ioctl_data.port != DOWNSTREAM_PORT1)) {
+			KPRINT_INFO("Lane change requested for unsupported port\n\r");
+			return -EINVAL;
+		}
+
+		/* If target link width is same as current width, return 0*/
+		if (ioctl_data.port == UPSTREAM_PORT) {
+			if (usp_curr_lane_width == ioctl_data.target_lane_width) {
+				KPRINT_INFO("Already port is in requested lane. No change required\n\r");
+				return 0;
+			}
+
+			if (usp_curr_lane_width == LANE_2 && ioctl_data.target_lane_width == LANE_1)
+				return tc956xmac_mode2_usp_lane_change_2_to_1(priv, ioaddr);
+			else if (usp_curr_lane_width == LANE_1 && ioctl_data.target_lane_width == LANE_2)
+				return tc956xmac_mode2_usp_lane_change_1_to_2(priv, ioaddr);
+			else
+				return -EINVAL;
+		}
+
+		if (ioctl_data.port == DOWNSTREAM_PORT1) {
+			if (dsp1_curr_lane_width == ioctl_data.target_lane_width)
+				return 0;
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+			if (dsp1_curr_lane_width == LANE_2 && ioctl_data.target_lane_width == LANE_1)
+				return tc956xmac_mode2_dsp1_lane_change_2_to_1(priv, ioaddr);
+			else if (dsp1_curr_lane_width == LANE_1 && ioctl_data.target_lane_width == LANE_2)
+				return tc956xmac_mode2_dsp1_lane_change_1_to_2(priv, ioaddr);
+			else
+				return -EINVAL;
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+		}
+
+	break;
+
+	default:
+	break;
+
+	}
+
+	return 0;
+}
+
+
+static int tc956xmac_pcie_set_tx_margin(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956x_ioctl_pcie_set_tx_margin ioctl_data;
+	u32 reg_data;
+	u32 pcie_mode;
+	void __iomem *ioaddr;
+
+	ioaddr = priv->ioaddr;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* Return error if the interface where lane change request sent is not Port 0 */
+	if (priv->port_num != RM_PF0_ID) {
+		KPRINT_INFO("Tx Margin change requested through wrong interface\n\r");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	/* Read mode setting register
+	 * Mode settings values 0:Setting A: x4x1x1, 1:Setting B: x2x2x1
+	 */
+	reg_data = readl(priv->ioaddr + NMODESTS_OFFSET);
+	pcie_mode = (reg_data & NMODESTS_MODE2) >> NMODESTS_MODE2_SHIFT;
+
+	KPRINT_INFO("Pcie mode: %d\n\r", pcie_mode);
+
+	switch (pcie_mode) {
+	case TC956X_PCIE_SETTING_A: /* 0:Setting A: x4x1x1 mode */
+		switch (ioctl_data.port) {
+		case UPSTREAM_PORT:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= (PHY_CORE_0_ENABLE | PHY_CORE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			/* Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+			 * select Lane 0/1 to access by APB I/F
+			 */
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+		break;
+		case DOWNSTREAM_PORT1:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_2_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+		break;
+		case DOWNSTREAM_PORT2:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_3_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+		break;
+		default:
+			return -EINVAL;
+		}
+
+	break;
+	case TC956X_PCIE_SETTING_B: /* 1:Setting B: x2x2x1 mode */
+		switch (ioctl_data.port) {
+		case UPSTREAM_PORT:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_0_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			/* Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+			 * select Lane 0/1 to access by APB I/F
+			 */
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+		break;
+		case DOWNSTREAM_PORT1:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_1_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			/* Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+			 * select Lane 0/1 to access by APB I/F
+			 */
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+		break;
+		case DOWNSTREAM_PORT2:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_3_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+		break;
+		default:
+			return -EINVAL;
+
+		}
+	break;
+	default:
+		return -EINVAL;
+
+	}
+	writel((ioctl_data.txmargin & 0x1FF),
+			ioaddr + TC956X_PHY_COREX_PCS_GL_MD_CFG_TXMARGIN0);
+
+	return 0;
+}
+
+
+
+static int tc956xmac_set_gen3_deemphasis(struct tc956xmac_priv *priv, void __iomem *ioaddr,
+						__u8 txpreset, __u8 enable)
+{
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (enable) {
+		/*Write Gen1 De-emphasis setting (as of now no configuration through this IOCTL) */
+		writel(0x0, ioaddr + TC956X_PHY_COREX_PMA_LN_PCS_TAP_ADV_R0);
+		writel(0x0E, ioaddr + TC956X_PHY_COREX_PMA_LN_PCS_TAP_DLY_R0);
+
+		/*Write Gen2 De-emphasis setting (as of now no configuration through this IOCTL) */
+		writel(0x0, ioaddr + TC956X_PHY_COREX_PMA_LN_PCS_TAP_ADV_R1);
+		writel(0x14, ioaddr + TC956X_PHY_COREX_PMA_LN_PCS_TAP_DLY_R1);
+
+		/*Write Gen3 De-emphasis setting */
+		writel(tx_demphasis_setting[txpreset][0], ioaddr + TC956X_PHY_COREX_PMA_LN_PCS_TAP_ADV_R2);
+		writel(tx_demphasis_setting[txpreset][1], ioaddr + TC956X_PHY_COREX_PMA_LN_PCS_TAP_DLY_R2);
+
+		/*Set override enable setting */
+		writel(0x1, ioaddr + TC956X_PHY_COREX_PMA_LN_RT_OVREN_PCS_TAP_ADV);
+		writel(0x1, ioaddr + TC956X_PHY_COREX_PMA_LN_RT_OVREN_PCS_TAP_DLY);
+	} else {
+		/*Clear override enable setting */
+		writel(0x0, ioaddr + TC956X_PHY_COREX_PMA_LN_RT_OVREN_PCS_TAP_ADV);
+		writel(0x0, ioaddr + TC956X_PHY_COREX_PMA_LN_RT_OVREN_PCS_TAP_DLY);
+	}
+
+
+	return 0;
+}
+
+static int tc956xmac_dfe_read_and_write_ctle_optimised(struct tc956xmac_priv *priv, void __iomem *ioaddr)
+{
+	u32 reg_data;
+	u8 eqc_force, eq_res, vga_ctrl;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* Read the optimized CTLE values from correct phy core
+	 *(selection should be done before calling this function)
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_RESULT_BEST_MON0);
+	eqc_force = ((reg_data & 0x780) >> 0x7);
+	eq_res = ((reg_data & 0x78) >> 0x3);
+	vga_ctrl = (reg_data & 0x7);
+
+	/* Write back the optimized CTLE values from correct phy core
+	 * ((selection should be done before calling this function)
+	 */
+	reg_data = readl(ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+	reg_data &= ~0xFF7;
+	reg_data |= (eqc_force << 0x8 | eq_res << 0x4 | vga_ctrl);
+	writel(reg_data, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+	return 0;
+}
+
+static int tc956xmac_dfe_disable_settings(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 phy_core)
+{
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/*Set DFE Disable settings (1)*/
+	writel(0x0, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EQ_CFG0_R2);
+
+	/*Set DFE Disable settings (2)*/
+	writel(0x411, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EQ_CFG1_R2);
+
+	/*Set DFE Disable settings (3)*/
+	writel(0x11, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EQ1_CFG0_R2);
+
+	/*Set DFE Disable settings (4)*/
+	writel(0x11, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EQ2_CFG0_R2);
+
+	/*Set DFE Disable settings (5)*/
+	if (phy_core == PHY_CORE_1_ENABLE)
+		writel(0x7, ioaddr + TC956X_PHY_CORE1_PMACNT_GL_PM_DFE_PD_CTRL);
+	else /*For all other phy core write at offset 0x254*/
+		writel(0x7, ioaddr + TC956X_PHY_COREX_PMACNT_GL_PM_DFE_PD_CTRL);
+
+	return 0;
+}
+
+static int tc956xmac_dfe_enable_settings(struct tc956xmac_priv *priv, void __iomem *ioaddr, u32 phy_core)
+{
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/*Set DFE Enable settings (1)*/
+	writel(0x3, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EQ_CFG0_R2);
+
+	/*Set DFE Enable settings (2)*/
+	writel(0x2111, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EQ1_CFG0_R2);
+
+	/*Set DFE Enable settings (3)*/
+	writel(0x2111, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EQ2_CFG0_R2);
+
+	/*Set DFE Enable settings (4)*/
+	if (phy_core == PHY_CORE_1_ENABLE)
+		writel(0x3, ioaddr + TC956X_PHY_CORE1_PMACNT_GL_PM_DFE_PD_CTRL);
+	else /*For all other phy core write at offset 0x254*/
+		writel(0x3, ioaddr + TC956X_PHY_COREX_PMACNT_GL_PM_DFE_PD_CTRL);
+
+	return 0;
+}
+
+static int tc956xmac_dfe_pll_reset_settings(struct tc956xmac_priv *priv, void __iomem *ioaddr, u8 dfe_enable_flag)
+{
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/*Enable PHY Rate Change Override mode*/
+	writel(0x10, ioaddr + TC956X_PHY_COREX_PMACNT_GL_PM_IF_CNT0);
+
+	if (dfe_enable_flag)
+		/*Set DFE Enable settings (5)*/
+		writel(0x211, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EQ_CFG1_R2);
+
+	/*Execute PHY Rate Change*/
+	writel(0x21, ioaddr + TC956X_PHY_COREX_PMACNT_GL_PM_IF_CNT4);
+
+	/*Wait for PHY Rate Change done*/
+	mdelay(1);
+
+	/*Clear PHY Rate Change reqeust*/
+	writel(0x0, ioaddr + TC956X_PHY_COREX_PMACNT_GL_PM_IF_CNT4);
+
+	/*Disable PHY Rate Change Override mode*/
+	writel(0x0, ioaddr + TC956X_PHY_COREX_PMACNT_GL_PM_IF_CNT0);
+
+	return 0;
+}
+
+static int tc956xmac_pcie_set_tx_deemphasis(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956x_ioctl_pcie_set_tx_deemphasis ioctl_data;
+	u32 reg_data;
+	u32 pcie_mode;
+	void __iomem *ioaddr;
+
+	ioaddr = priv->ioaddr;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* Return error if the interface where lane change request sent is not Port 0 */
+	if (priv->port_num != RM_PF0_ID) {
+		KPRINT_INFO("Tx Margin change requested through wrong interface\n\r");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	/* Read mode setting register
+	 * Mode settings values 0:Setting A: x4x1x1, 1:Setting B: x2x2x1
+	 */
+	reg_data = readl(priv->ioaddr + NMODESTS_OFFSET);
+	pcie_mode = (reg_data & NMODESTS_MODE2) >> NMODESTS_MODE2_SHIFT;
+
+	KPRINT_INFO("Pcie mode: %d\n\r", pcie_mode);
+
+	switch (pcie_mode) {
+	case TC956X_PCIE_SETTING_A: /* 0:Setting A: x4x1x1 mode */
+		switch (ioctl_data.port) {
+		case UPSTREAM_PORT:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= (PHY_CORE_0_ENABLE | PHY_CORE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			/* Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+			 * select Lane 0/1 to access by APB I/F
+			 */
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			tc956xmac_set_gen3_deemphasis(priv, ioaddr, ioctl_data.txpreset, ioctl_data.enable);
+
+
+		break;
+		case DOWNSTREAM_PORT1:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_2_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			tc956xmac_set_gen3_deemphasis(priv, ioaddr, ioctl_data.txpreset, ioctl_data.enable);
+
+
+		break;
+		case DOWNSTREAM_PORT2:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_3_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			tc956xmac_set_gen3_deemphasis(priv, ioaddr, ioctl_data.txpreset, ioctl_data.enable);
+
+		break;
+		default:
+			return -EINVAL;
+
+		}
+
+	break;
+	case TC956X_PCIE_SETTING_B: /* 1:Setting B: x2x2x1 mode */
+		switch (ioctl_data.port) {
+		case UPSTREAM_PORT:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_0_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			/* Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+			 * select Lane 0/1 to access by APB I/F
+			 */
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			tc956xmac_set_gen3_deemphasis(priv, ioaddr, ioctl_data.txpreset, ioctl_data.enable);
+
+		break;
+		case DOWNSTREAM_PORT1:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_1_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			/* Set lane_access_enable Register in PHY PHY_CORE 0 PCS Global Register to
+			 * select Lane 0/1 to access by APB I/F
+			 */
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			tc956xmac_set_gen3_deemphasis(priv, ioaddr, ioctl_data.txpreset, ioctl_data.enable);
+
+		break;
+		case DOWNSTREAM_PORT2:
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_3_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			tc956xmac_set_gen3_deemphasis(priv, ioaddr, ioctl_data.txpreset, ioctl_data.enable);
+
+		break;
+		default:
+			return -EINVAL;
+		}
+	break;
+	default:
+		return -EINVAL;
+
+	}
+
+	return 0;
+}
+
+static int tc956xmac_pcie_set_dfe(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956x_ioctl_pcie_set_dfe ioctl_data;
+	u32 reg_data;
+	u32 pcie_mode;
+	void __iomem *ioaddr;
+
+	ioaddr = priv->ioaddr;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* Return error if the interface where lane change request sent is not Port 0 */
+	if (priv->port_num != RM_PF0_ID) {
+		KPRINT_INFO("Tx Margin change requested through wrong interface\n\r");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	/* Read mode setting register
+	 * Mode settings values 0:Setting A: x4x1x1, 1:Setting B: x2x2x1
+	 */
+	reg_data = readl(priv->ioaddr + NMODESTS_OFFSET);
+	pcie_mode = (reg_data & NMODESTS_MODE2) >> NMODESTS_MODE2_SHIFT;
+
+	KPRINT_INFO("Pcie mode: %d\n\r", pcie_mode);
+
+	switch (pcie_mode) {
+	case TC956X_PCIE_SETTING_A: /* 0:Setting A: x4x1x1 mode */
+		switch (ioctl_data.port) {
+		case UPSTREAM_PORT:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF) != 0x3) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			if (ioctl_data.enable == 0) { /*DFE Disable settings*/
+
+				/*Phy core 0, Lane 0 CTLE copy settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= LANE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+
+				/*Phy core 0, Lane 1 CTLE copy settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= LANE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+
+				/*Phy core 1, Lane 0 CTLE copysettings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= LANE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+
+				/*Phy core 1, Lane 1 CTLE copy settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= LANE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+				/*Disable DFE settings for Phy core0 and Lane 0/1*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_0_ENABLE);
+
+				/*Disable DFE settings for Phy core1 and Lane 0/1*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_1_ENABLE);
+
+				/*PLL reset settings for phy core 0/1*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= (PHY_CORE_0_ENABLE | PHY_CORE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+			} else { /*DFE Enable settings*/
+
+				/*Phy core 0/1, Lane 0/1 CTLE initial value register settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= (PHY_CORE_0_ENABLE | PHY_CORE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				writel(0x000008A5, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+
+				/*Enable DFE settings for Phy core0 */
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				tc956xmac_dfe_enable_settings(priv, ioaddr, PHY_CORE_0_ENABLE);
+
+
+				/*Enable DFE settings for Phy core1 */
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				tc956xmac_dfe_enable_settings(priv, ioaddr, PHY_CORE_1_ENABLE);
+
+
+				/*PLL reset settings for Phy core0/1*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= (PHY_CORE_0_ENABLE | PHY_CORE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+
+			}
+
+		break;
+		case DOWNSTREAM_PORT1:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF00) != 0x300) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_2_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+
+			if (ioctl_data.enable == 0) { /*DFE Disable settings*/
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+				/*Disable DFE settings for Phy core2*/
+				tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_2_ENABLE);
+
+				/*PLL reset settings for Phy core2*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+			} else { /*DFE Enable settings*/
+				writel(0x000008A5, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+				/*Enable DFE settings for Phy core2*/
+				tc956xmac_dfe_enable_settings(priv, ioaddr, PHY_CORE_2_ENABLE);
+
+				/*PLL reset settings for Phy core2*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+			}
+		break;
+		case DOWNSTREAM_PORT2:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF0000) != 0x30000) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_3_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+
+			if (ioctl_data.enable == 0) { /*DFE Disable settings*/
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+				/*Disable DFE settings for Phy core3*/
+				tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_3_ENABLE);
+
+				/*PLL reset settings for Phy core3*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+			} else {  /*DFE Enable settings*/
+				writel(0x000008A5, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+				/*Enable DFE settings for Phy core2*/
+				tc956xmac_dfe_enable_settings(priv, ioaddr, PHY_CORE_3_ENABLE);
+
+				/*PLL reset settings for Phy core2*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+			}
+
+		break;
+		default:
+			return -EINVAL;
+
+		}
+
+	break;
+	case TC956X_PCIE_SETTING_B: /* 1:Setting B: x2x2x1 mode */
+		switch (ioctl_data.port) {
+		case UPSTREAM_PORT:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF) != 0x3) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			if (ioctl_data.enable == 0) {//Disable setting
+				/*Phy core 0, Lane 0 CTLE copy settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= LANE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+
+				/*Phy core 0, Lane 1 CTLE copy settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= LANE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+
+				/*Disable DFE settings for Phy core0 and Lane 0/1*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_0_ENABLE);
+
+				/*PLL reset settings*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+			} else { /*Enable settings*/
+
+				/*Phy core 0, Lane 0/1 CTLE initial value register settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				writel(0x000008A5, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+				tc956xmac_dfe_enable_settings(priv, ioaddr, PHY_CORE_0_ENABLE);
+
+				/*PLL reset settings*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+
+			}
+		break;
+		case DOWNSTREAM_PORT1:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF00) != 0x300) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			if (ioctl_data.enable == 0) {//Disable setting
+				/*Phy core 1, Lane 0 CTLE copy settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= LANE_0_ENABLE;
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+
+				/*Phy core 1, Lane 1 CTLE copy settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= LANE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+
+				/*Disable DFE settings for Phy core1*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_1_ENABLE);
+
+				/*PLL reset settings for Phy core1*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+			} else { /*DFE Enable settings*/
+				/*Phy core 1, Lane 0 CTLE copy settings*/
+				reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+				reg_data &= ~PHY_CORE_ENABLE_MASK;
+				reg_data |= PHY_CORE_1_ENABLE;
+				writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+				reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+				reg_data &= ~LANE_ENABLE_MASK;
+				reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+				writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+				writel(0x000008A5, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+				tc956xmac_dfe_enable_settings(priv, ioaddr, PHY_CORE_1_ENABLE);
+
+				/*PLL reset settings*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+
+			}
+		break;
+		case DOWNSTREAM_PORT2:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF0000) != 0x30000) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_3_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			if (ioctl_data.enable == 0) {//Disable setting
+
+				tc956xmac_dfe_read_and_write_ctle_optimised(priv, ioaddr);
+
+
+				/*Disable DFE settings for Phy core3*/
+				tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_3_ENABLE);
+
+				/*PLL reset settings for Phy core3*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+			} else { /*DFE Enable settings*/
+				writel(0x000008A5, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+				tc956xmac_dfe_enable_settings(priv, ioaddr, PHY_CORE_3_ENABLE);
+
+				/*PLL reset settings*/
+				tc956xmac_dfe_pll_reset_settings(priv, ioaddr, ioctl_data.enable);
+
+			}
+		break;
+		default:
+			return -EINVAL;
+
+		}
+	break;
+	default:
+		return -EINVAL;
+
+	}
+
+	return 0;
+}
+
+static int tc956xmac_pcie_set_ctle_fixed(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct tc956x_ioctl_pcie_set_ctle_fixed_mode ioctl_data;
+	u32 reg_data;
+	u32 pcie_mode;
+	void __iomem *ioaddr;
+
+	ioaddr = priv->ioaddr;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	/* Return error if the interface where lane change request sent is not Port 0 */
+	if (priv->port_num != RM_PF0_ID) {
+		KPRINT_INFO("Tx Margin change requested through wrong interface\n\r");
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	/* Read mode setting register
+	 * Mode settings values 0:Setting A: x4x1x1, 1:Setting B: x2x2x1
+	 */
+	reg_data = readl(priv->ioaddr + NMODESTS_OFFSET);
+	pcie_mode = (reg_data & NMODESTS_MODE2) >> NMODESTS_MODE2_SHIFT;
+
+	KPRINT_INFO("Pcie mode: %d\n\r", pcie_mode);
+
+	switch (pcie_mode) {
+	case TC956X_PCIE_SETTING_A: /* 0:Setting A: x4x1x1 mode */
+		switch (ioctl_data.port) {
+		case UPSTREAM_PORT:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF) != 0x3) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			/*Phy core 0, Lane 0/1 */
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_0_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			/*Set CTLE initial value registers*/
+			reg_data = readl(ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+			reg_data &= ~0xFF7;
+			reg_data |= ((ioctl_data.eqc_force & 0xF) << 0x8 |
+				     (ioctl_data.eq_res & 0xF) << 0x4 |
+				     (ioctl_data.vga_ctrl & 0x7));
+			writel(reg_data, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+
+			/*Phy core 1, Lane 0/1 */
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_1_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			/*Set CTLE initial value registers*/
+			reg_data = readl(ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+			reg_data &= ~0xFF7;
+			reg_data |= ((ioctl_data.eqc_force & 0xF) << 0x8 |
+				     (ioctl_data.eq_res & 0xF) << 0x4 |
+				     (ioctl_data.vga_ctrl & 0x7));
+			writel(reg_data, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+
+			/*Disable DFE settings for Phy core0 and Lane 0/1*/
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_0_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_0_ENABLE);
+
+			/*Disable DFE settings for Phy core1 and Lane 0/1*/
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_1_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_1_ENABLE);
+
+			/*PLL reset settings for phy core 0/1*/
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= (PHY_CORE_0_ENABLE | PHY_CORE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			tc956xmac_dfe_pll_reset_settings(priv, ioaddr, 0);
+
+		break;
+		case DOWNSTREAM_PORT1:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF00) != 0x300) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_2_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+
+			/*Set CTLE initial value registers*/
+			reg_data = readl(ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+			reg_data &= ~0xFF7;
+			reg_data |= ((ioctl_data.eqc_force & 0xF) << 0x8 |
+				     (ioctl_data.eq_res & 0xF) << 0x4 |
+				     (ioctl_data.vga_ctrl & 0x7));
+			writel(reg_data, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+			/*Disable DFE settings for Phy core2*/
+			tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_2_ENABLE);
+
+			/*PLL reset settings for Phy core2*/
+			tc956xmac_dfe_pll_reset_settings(priv, ioaddr, 0);
+		break;
+		case DOWNSTREAM_PORT2:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF0000) != 0x30000) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_3_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			/*Set CTLE initial value registers*/
+			reg_data = readl(ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+			reg_data &= ~0xFF7;
+			reg_data |= ((ioctl_data.eqc_force & 0xF) << 0x8 |
+				     (ioctl_data.eq_res & 0xF) << 0x4 |
+				     (ioctl_data.vga_ctrl & 0x7));
+			writel(reg_data, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+			/*Disable DFE settings for Phy core3*/
+			tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_3_ENABLE);
+
+			/*PLL reset settings for Phy core3*/
+			tc956xmac_dfe_pll_reset_settings(priv, ioaddr, 0);
+
+		break;
+		default:
+			return -EINVAL;
+
+		}
+
+	break;
+	case TC956X_PCIE_SETTING_B: /* 1:Setting B: x2x2x1 mode */
+		switch (ioctl_data.port) {
+		case UPSTREAM_PORT:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF) != 0x3) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			/*Phy core 0, Lane 0 */
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_0_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+
+			/*Set CTLE initial value registers*/
+			reg_data = readl(ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+			reg_data &= ~0xFF7;
+			reg_data |= ((ioctl_data.eqc_force & 0xF) << 0x8 |
+				     (ioctl_data.eq_res & 0xF) << 0x4 |
+				     (ioctl_data.vga_ctrl & 0x7));
+			writel(reg_data, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+			/*Disable DFE settings for Phy core0 and Lane 0/1*/
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_0_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_0_ENABLE);
+
+			/*PLL reset settings done with disable flag*/
+			tc956xmac_dfe_pll_reset_settings(priv, ioaddr, 0);
+
+		break;
+		case DOWNSTREAM_PORT1:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF00) != 0x300) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			/*Phy core 1, Lane 0 */
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_1_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			/*Set CTLE initial value registers*/
+			reg_data = readl(ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+			reg_data &= ~0xFF7;
+			reg_data |= ((ioctl_data.eqc_force & 0xF) << 0x8 |
+				     (ioctl_data.eq_res & 0xF) << 0x4 |
+				     (ioctl_data.vga_ctrl & 0x7));
+			writel(reg_data, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+			/*Disable DFE settings for Phy core1*/
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_1_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			reg_data = readl(ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+			reg_data &= ~LANE_ENABLE_MASK;
+			reg_data |= (LANE_0_ENABLE | LANE_1_ENABLE);
+			writel(reg_data, ioaddr + TC956X_PHY_CORE0_GL_LANE_ACCESS);
+
+			tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_1_ENABLE);
+
+			/*PLL reset settings for Phy core1*/
+			tc956xmac_dfe_pll_reset_settings(priv, ioaddr, 0);
+		break;
+		case DOWNSTREAM_PORT2:
+			/*Device should be in Gen3 when we execute this command*/
+			reg_data = readl(ioaddr + TC956X_GLUE_TL_LINK_SPEED_MON);
+			if ((reg_data & 0xF0000) != 0x30000) {
+				KPRINT_INFO("Device not in Gen3 to execute DFE disable\n\r");
+				return -EINVAL;
+			}
+
+			reg_data = readl(ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+			reg_data &= ~PHY_CORE_ENABLE_MASK;
+			reg_data |= PHY_CORE_3_ENABLE;
+			writel(reg_data, ioaddr + TC956X_GLUE_PHY_REG_ACCESS_CTRL);
+
+			/*Set CTLE initial value registers*/
+			reg_data = readl(ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+			reg_data &= ~0xFF7;
+			reg_data |= ((ioctl_data.eqc_force & 0xF) << 0x8 |
+				     (ioctl_data.eq_res & 0xF) << 0x4 |
+				     (ioctl_data.vga_ctrl & 0x7));
+			writel(reg_data, ioaddr + TC956X_PHY_COREX_PMACNT_LN_PM_EMCNT_INIT_CFG0_R2);
+
+			/*Disable DFE settings for Phy core3*/
+			tc956xmac_dfe_disable_settings(priv, ioaddr, PHY_CORE_3_ENABLE);
+
+			/*PLL reset settings for Phy core3*/
+			tc956xmac_dfe_pll_reset_settings(priv, ioaddr, 0);
+		break;
+		default:
+			return -EINVAL;
+
+		}
+	break;
+	default:
+		return -EINVAL;
+
+	}
+
+	return 0;
+}
+
+static int tc956xmac_pcie_speed_change(struct tc956xmac_priv *priv, void __user *data)
+{
+	struct pci_dev *pdev = to_pci_dev(priv->device);
+	struct tc956x_ioctl_pcie_set_speed ioctl_data;
+
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+
+	if (copy_from_user(&ioctl_data, data, sizeof(ioctl_data)))
+		return -EFAULT;
+
+	return tc956x_set_pci_speed(pdev, (u32)ioctl_data.speed);
+}
+
+#endif /*#define TC956X*/
+#endif /*#ifdef TC956X_SRIOV_VF*/
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+static int tc956xmac_siocdevprivate(struct net_device *dev, struct ifreq *rq,
+			       void __user *data, int cmd)
+#else
+static int tc956xmac_extension_ioctl(struct tc956xmac_priv *priv,
+				     void __user *data)
+#endif
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#else
+	u32 cmd;
+#endif
+	DBGPR_FUNC(priv->device, "-->%s\n", __func__);
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+	if (copy_from_user(&cmd, data, sizeof(cmd)))
+		return -EFAULT;
+
+	switch (cmd) {
+	case TC956XMAC_GET_CBS:
+#ifdef TC956X_SRIOV_PF
+	{
+		int ret;
+		struct tc956xmac_ioctl_cbs_cfg cbs;
+
+		if (copy_from_user(&cbs, data, sizeof(cbs)))
+			return -EFAULT;
+
+		ret = tc956xmac_ioctl_get_cbs(priv, &cbs);
+
+		if (ret == 0) {
+			if (copy_to_user(data, &cbs, sizeof(cbs)))
+				return -EFAULT;
+		}
+
+		return ret;
+	}
+#elif (defined TC956X_SRIOV_VF)
+		return tc956xmac_get_cbs(priv, data);
+#endif
+	case TC956XMAC_SET_CBS:
+#ifdef TC956X_SRIOV_PF
+	{
+		struct tc956xmac_ioctl_cbs_cfg cbs;
+
+		if (copy_from_user(&cbs, data, sizeof(cbs)))
+			return -EFAULT;
+
+		return tc956xmac_ioctl_set_cbs(priv, &cbs);
+	}
+#elif (defined TC956X_SRIOV_VF)
+		return tc956xmac_set_cbs(priv, data);
+#endif
+	case TC956XMAC_GET_EST:
+#ifdef TC956X_SRIOV_PF
+	{
+		int ret;
+		struct tc956xmac_ioctl_est_cfg *est;
+
+		est = kzalloc(sizeof(*est), GFP_KERNEL);
+		if (!est)
+			return -ENOMEM;
+
+		ret = tc956xmac_ioctl_get_est(priv, est);
+		if (ret == 0) {
+			if (copy_to_user(data, est, sizeof(*est))) {
+				kfree(est);
+				return -EFAULT;
+			}
+		}
+		kfree(est);
+		return ret;
+	}
+#elif (defined TC956X_SRIOV_VF)
+	return tc956xmac_get_est(priv, data);
+#endif
+	case TC956XMAC_SET_EST:
+#ifdef TC956X_SRIOV_PF
+	{
+		struct tc956xmac_ioctl_est_cfg *est;
+
+		est = kzalloc(sizeof(*est), GFP_KERNEL);
+		if (!est)
+			return -ENOMEM;
+
+		if (copy_from_user(est, data, sizeof(*est))) {
+			kfree(est);
+			return -EFAULT;
+		}
+		return tc956xmac_ioctl_set_est(priv, est);
+	}
+#elif (defined TC956X_SRIOV_VF)
+	return tc956xmac_set_est(priv, data);
+#endif
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED
+	case TC956XMAC_GET_FPE: /*Function to Get FPE related configurations*/
+#ifdef TC956X_SRIOV_PF
+	{
+		int ret;
+		struct tc956xmac_ioctl_fpe_cfg *fpe;
+
+		fpe = kzalloc(sizeof(*fpe), GFP_KERNEL);
+		if (!fpe)
+			return -ENOMEM;
+
+		ret = tc956xmac_ioctl_get_fpe(priv, fpe);
+		if (ret == 0) {
+			if (copy_to_user(data, fpe, sizeof(*fpe))) {
+				kfree(fpe);
+				return -EFAULT;
+			}
+		}
+		kfree(fpe);
+		return ret;
+	}
+#elif (defined TC956X_SRIOV_VF)
+	return tc956xmac_get_fpe(priv, data);
+#endif
+	case TC956XMAC_SET_FPE: /*Function to Set FPE related configurations*/
+#ifdef TC956X_SRIOV_PF
+	{
+		struct tc956xmac_ioctl_fpe_cfg *fpe;
+
+		fpe = kzalloc(sizeof(*fpe), GFP_KERNEL);
+		if (!fpe)
+			return -ENOMEM;
+
+		if (copy_from_user(fpe, data, sizeof(*fpe))) {
+			kfree(fpe);
+			return -EFAULT;
+		}
+		return tc956xmac_ioctl_set_fpe(priv, fpe);
+	}
+#elif (defined TC956X_SRIOV_VF)
+		return tc956xmac_set_fpe(priv, data);
+#endif
+#endif /* TC956X_UNSUPPORTED_UNTESTED */
+
+#ifdef TC956X_SRIOV_PF
+	case TC956X_GET_FW_STATUS:
+		return tc956x_xgmac_get_fw_status(priv, data);
+	case TC956XMAC_VLAN_FILTERING:
+		return tc956xmac_config_vlan_filter(priv, data);
+#endif
+	case TC956XMAC_GET_RXP:
+#ifdef TC956X_SRIOV_PF
+	{
+		int ret;
+		struct tc956xmac_ioctl_rxp_cfg *rxp;
+
+		rxp = kzalloc(sizeof(*rxp), GFP_KERNEL);
+		if (!rxp)
+			return -ENOMEM;
+
+		ret = tc956xmac_ioctl_get_rxp(priv, rxp);
+		if (ret == 0) {
+			if (copy_to_user(data, rxp, sizeof(*rxp))) {
+				kfree(rxp);
+				return -EFAULT;
+			}
+		}
+		kfree(rxp);
+		return ret;
+	}
+#elif (defined TC956X_SRIOV_VF)
+		return tc956xmac_get_rxp(priv, data);
+#endif
+	case TC956XMAC_SET_RXP:
+#ifdef TC956X_SRIOV_PF
+	{
+		struct tc956xmac_ioctl_rxp_cfg *rxp;
+
+		rxp = kzalloc(sizeof(*rxp), GFP_KERNEL);
+		if (!rxp)
+			return -ENOMEM;
+
+		if (copy_from_user(rxp, data, sizeof(*rxp))) {
+			kfree(rxp);
+			return -EFAULT;
+		}
+		return tc956xmac_ioctl_set_rxp(priv, rxp);
+	}
+#elif (defined TC956X_SRIOV_VF)
+		return tc956xmac_set_rxp(priv, data);
+#endif
+	case TC956XMAC_GET_SPEED:
+#ifdef TC956X_SRIOV_PF
+		return tc956xmac_ioctl_get_connected_speed(priv, data);
+#elif defined TC956X_SRIOV_VF
+		return tc956xmac_get_speed(priv, data);
+#endif
+	case TC956XMAC_GET_TX_FREE_DESC:
+		return tc956xmac_ioctl_get_tx_free_desc(priv, data);
+#ifdef TC956X_IOCTL_REG_RD_WR_ENABLE
+	case TC956XMAC_REG_RD:
+		return tc956xmac_reg_rd(priv, data);
+	case TC956XMAC_REG_WR:
+#ifdef TC956X_SRIOV_PF
+		return tc956xmac_reg_wr(priv, data);
+#elif defined TC956X_SRIOV_VF
+		return tc956xmac_reg_wr(priv, data);
+#endif
+#endif /* TC956X_IOCTL_REG_RD_WR_ENABLE */
+#ifndef TC956X_SRIOV_VF
+	case TC956XMAC_SET_MAC_LOOPBACK:
+		return tc956xmac_ioctl_set_mac_loopback(priv, data);
+	case TC956XMAC_SET_PHY_LOOPBACK:
+		return tc956xmac_ioctl_set_phy_loopback(priv, data);
+	case TC956XMAC_L2_DA_FILTERING_CMD:
+		return tc956xmac_config_l2_da_filter(priv, data);
+	case TC956XMAC_SET_PPS_OUT:
+		return tc956xmac_set_ppsout(priv, data);
+	case TC956XMAC_PTPCLK_CONFIG:
+		return tc956xmac_ptp_clk_config(priv, data);
+	case TC956XMAC_SA0_VLAN_INS_REP_REG:
+		return tc956xmac_sa_vlan_ins_config(priv, data);
+	case TC956XMAC_SA1_VLAN_INS_REP_REG:
+		return tc956xmac_sa_vlan_ins_config(priv, data);
+#endif /* TC956X_SRIOV_VF */
+	case TC956XMAC_GET_TX_QCNT:
+		return tc956xmac_get_tx_qcnt(priv, data);
+	case TC956XMAC_GET_RX_QCNT:
+		return tc956xmac_get_rx_qcnt(priv, data);
+	case TC956XMAC_PCIE_CONFIG_REG_RD:
+		return tc956xmac_pcie_config_reg_rd(priv, data);
+	case TC956XMAC_PCIE_CONFIG_REG_WR:
+		return tc956xmac_pcie_config_reg_wr(priv, data);
+#ifdef TC956X_SRIOV_PF
+	case TC956XMAC_PTPOFFLOADING:
+		return tc956xmac_config_ptpoffload(priv, data);
+#endif /* TC956X_SRIOV_PF */
+	case TC956XMAC_ENABLE_AUX_TIMESTAMP:
+#ifdef TC956X_SRIOV_PF
+		return tc956xmac_aux_timestamp_enable(priv, data);
+#endif
+#ifdef TC956X_SRIOV_PF
+	case TC956XMAC_ENABLE_ONESTEP_TIMESTAMP:
+		return tc956xmac_config_onestep_timestamp(priv, data);
+#endif /* TC956X_SRIOV_PF */
+
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X_PCIE_LOGSTAT
+	case TC956X_PCIE_STATE_LOG_SUMMARY:
+		return tc956x_pcie_ioctl_state_log_summary(priv, data);
+	case TC956X_PCIE_GET_PCIE_LINK_PARAMS:
+		return tc956x_pcie_ioctl_get_pcie_link_params(priv, data);
+	case TC956X_PCIE_STATE_LOG_ENABLE:
+		return tc956x_pcie_ioctl_state_log_enable(priv, data);
+#endif /* #ifdef TC956X_PCIE_LOGSTAT */
+	case TC956XMAC_VLAN_STRIP_CONFIG:
+		return tc956xmac_vlan_strip_config(priv, data);
+#ifdef TC956X
+	case TC956XMAC_PCIE_LANE_CHANGE:
+		return tc956xmac_pcie_lane_change(priv, data);
+	case TC956XMAC_PCIE_SET_TX_MARGIN:
+		return tc956xmac_pcie_set_tx_margin(priv, data);
+	case TC956XMAC_PCIE_SET_TX_DEEMPHASIS:
+		return tc956xmac_pcie_set_tx_deemphasis(priv, data);
+	case TC956XMAC_PCIE_SET_DFE:
+		return tc956xmac_pcie_set_dfe(priv, data);
+	case TC956XMAC_PCIE_SET_CTLE:
+		return tc956xmac_pcie_set_ctle_fixed(priv, data);
+	case TC956XMAC_PCIE_SPEED_CHANGE:
+		return tc956xmac_pcie_speed_change(priv, data);
+#endif /* TC956X */
+#endif
+
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+#ifndef TC956X_SRIOV_VF
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+static int tc956xmac_phy_fw_flash_mdio_ioctl(struct net_device *ndev,
+					     struct ifreq *ifr, int cmd)
+{
+	struct mii_ioctl_data *mii = if_mii(ifr);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+
+	int ret = -EINVAL;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+	int prtad, devad;
+
+	if (mdio_phy_id_is_c45(mii->phy_id)) {
+		prtad = mdio_phy_id_prtad(mii->phy_id);
+		devad = mdio_phy_id_devad(mii->phy_id);
+		devad = MII_ADDR_C45 | devad << 16 | mii->reg_num;
+	} else {
+		prtad = mii->phy_id;
+		devad = mii->reg_num;
+	}
+#endif
+	switch (cmd) {
+	case SIOCGMIIPHY:
+		mii->phy_id = 0;
+		fallthrough;
+
+	case SIOCGMIIREG:
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+		ret = priv->mii->read(priv->mii, prtad, devad);
+#else
+		ret = phylink_mii_ioctl(priv->phylink, ifr, cmd);
+#endif
+		if (ret >= 0) {
+			mii->val_out = ret;
+			ret = 0;
+		}
+		break;
+
+	case SIOCSMIIREG:
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+		ret = priv->mii->write(priv->mii, prtad, devad, mii->val_in);
+#else
+		ret = phylink_mii_ioctl(priv->phylink, ifr, cmd);
+#endif
+		break;
+
+	default:
+		break;
+	}
+
+	return ret;
+}
+#endif
+#endif
+
+/**
+ *  tc956xmac_ioctl - Entry point for the Ioctl
+ *  @dev: Device pointer.
+ *  @rq: An IOCTL specefic structure, that can contain a pointer to
+ *  a proprietary structure used to pass information to the driver.
+ *  @cmd: IOCTL command
+ *  Description:
+ *  Currently it supports the phy_mii_ioctl(...) and HW time stamping.
+ */
+static int tc956xmac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#endif
+	int ret = -EOPNOTSUPP;
+
+#ifdef TC956X_SRIOV_VF
+	u8 mbx[MBX_TOT_SIZE];
+
+	enum mbx_msg_fns msg_dst = priv->fn_id_info.pf_no + 1;
+#endif
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	struct mii_ioctl_data *data = if_mii(rq);
+#endif
+
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	if (!netif_running(dev))
+#ifndef TC956X_SRIOV_VF
+		return tc956xmac_phy_fw_flash_mdio_ioctl(dev, rq, cmd);
+#else
+		return -EINVAL;
+#endif
+#else
+	ret = 0;
+#endif
+
+	switch (cmd) {
+	case SIOCGMIIPHY:
+#ifdef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+		return 0;
+#else
+#ifndef TC956X_SRIOV_VF
+		data->phy_id = priv->plat->phy_addr;
+		NMSGPR_ALERT(priv->device, "PHY ID: SIOCGMIIPHY\n");
+#elif (defined TC956X_SRIOV_VF)
+		mbx[0] = OPCODE_MBX_VF_IOCTL; //opcode for ioctl
+		mbx[1] = 1; //size
+		mbx[2] = OPCODE_MBX_VF_GET_MII_PHY;//cmd for SIOCGMIIPHY
+
+		ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+		/* Validation of successfull message posting can be done
+		 * by reading the mbx buffer for ACK opcode (0xFE)
+		 */
+		if (ret > 0) {
+			if (ret == ACK) {
+				/* Check the acknowledgement message for opcode and size,
+				 * then read the data from the ACK message
+				 */
+				if ((mbx[4] == OPCODE_MBX_ACK_MSG && mbx[5] == 4)) {
+					memcpy(&data->phy_id, &mbx[6], 4);
+					NMSGPR_ALERT(priv->device, "PHY ID: SIOCGMIIPHY\n");
+				}
+			}
+			KPRINT_DEBUG2("mailbox write with ACK or NACK %d %x %x", ret, mbx[4], mbx[5]);
+		} else {
+			KPRINT_DEBUG2("mailbox write failed");
+		}
+#endif
+		ret = 0;
+#endif
+
+		break;
+#ifndef TC956X_SRIOV_VF
+	case SIOCGMIIREG:
+	case SIOCSMIIREG:
+#ifdef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+		return 0;
+#else
+		ret = phylink_mii_ioctl(priv->phylink, rq, cmd);
+#endif
+		break;
+#elif defined TC956X_SRIOV_VF
+	case SIOCGMIIREG:
+		mbx[0] = OPCODE_MBX_VF_IOCTL; //opcode for ioctl
+		mbx[1] = SIZE_MBX_VF_GET_MII_REG; //size
+		mbx[2] = OPCODE_MBX_VF_GET_MII_REG_1;//cmd for SIOCGMIIREG
+
+		memcpy(&mbx[3], &(data->phy_id), 2);
+		memcpy(&mbx[5], &(data->reg_num), 2);
+		memcpy(&mbx[7], &(data->val_in), 2);
+
+		memset(&mbx[9], 0, sizeof(rq->ifr_ifrn.ifrn_name));
+		memcpy(&mbx[9], &rq->ifr_ifrn.ifrn_name, sizeof(rq->ifr_ifrn.ifrn_name));
+		ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+		/* Validation of successfull message posting can be done
+		 * by reading the mbx buffer for ACK opcode (0xFF)
+		 */
+		if (ret > 0) {
+			if (ret == ACK) {
+				KPRINT_DEBUG2("mailbox write with ACK or NACK %d %x %x", ret, mbx[4], mbx[5]);
+
+				mbx[0] = OPCODE_MBX_VF_IOCTL; //opcode for ioctl
+				mbx[1] = 1; //size
+				mbx[2] = OPCODE_MBX_VF_GET_MII_REG_2;
+
+				ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+				if (ret > 0) {
+					KPRINT_DEBUG2("mailbox write with ACK or NACK %d %x %x", ret, mbx[4], mbx[5]);
+
+					if (ret == ACK) {
+						/* Check the acknowledgement message for opcode and size,
+						 * then read the data from the ACK message
+						 */
+						if ((mbx[4] == OPCODE_MBX_ACK_MSG && mbx[5] == 2))
+							memcpy(&(data->val_out), &mbx[6], 2);
+					}
+				} else
+					KPRINT_DEBUG2("mailbox write failed");
+			}
+		} else {
+			KPRINT_DEBUG2("mailbox write failed");
+		}
+		ret = 0;
+		break;
+#endif
+#ifndef TC956X_SRIOV_VF
+	case SIOCSHWTSTAMP:
+		ret = tc956xmac_hwtstamp_set(dev, rq);
+		break;
+#endif
+	case SIOCGHWTSTAMP:
+#ifndef TC956X_SRIOV_VF
+		ret = tc956xmac_hwtstamp_get(dev, rq);
+#else
+		mbx[0] = OPCODE_MBX_VF_IOCTL; //opcode for ioctl
+		mbx[1] = 1; //size
+		mbx[2] = OPCODE_MBX_VF_GET_HW_STMP;//cmd for SIOCGHWTSTAMP
+
+		ret = tc956xmac_mbx_write(priv, mbx, msg_dst, &priv->fn_id_info);
+
+		/* Validation of successfull message posting can be done
+		 * by reading the mbx buffer for ACK opcode (0xFF)
+		 */
+		if (ret > 0) {
+			if (ret == ACK) {
+				/* Check the acknowledgement message for opcode and size,
+				 * then read the data from the ACK message
+				 */
+				if ((mbx[4] == OPCODE_MBX_ACK_MSG && mbx[5] == SIZE_MBX_GET_HW_STMP)) {
+					if (copy_to_user(rq->ifr_data, &mbx[6], SIZE_MBX_GET_HW_STMP))
+						ret = -EFAULT;
+				}
+			}
+			KPRINT_DEBUG2("mailbox write with ACK or NACK %d %x %x", ret, mbx[4], mbx[5]);
+		} else {
+			KPRINT_DEBUG2("mailbox write failed");
+		}
+#endif
+		break;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0)
+	case SIOCSTIOCTL:
+		if (!priv || !rq)
+			return -EINVAL;
+		ret = tc956xmac_extension_ioctl(priv, rq->ifr_data);
+		break;
+#endif
+	default:
+		break;
+	}
+
+	return ret;
+}
+
+static int tc956xmac_setup_tc_block_cb(enum tc_setup_type type, void *type_data,
+				    void *cb_priv)
+{
+	struct tc956xmac_priv *priv = cb_priv;
+	int ret = -EOPNOTSUPP;
+
+	if (!tc_cls_can_offload_and_chain0(priv->dev, type_data))
+		return ret;
+
+	tc956xmac_disable_all_queues(priv);
+
+	switch (type) {
+	case TC_SETUP_CLSU32:
+		ret = tc956xmac_tc_setup_cls_u32(priv, type_data);
+		break;
+	case TC_SETUP_CLSFLOWER:
+		ret = tc956xmac_tc_setup_cls(priv, type_data);
+		break;
+	default:
+		break;
+	}
+
+	tc956xmac_enable_all_queues(priv);
+	return ret;
+}
+
+static LIST_HEAD(tc956xmac_block_cb_list);
+
+static int tc956xmac_setup_tc(struct net_device *ndev, enum tc_setup_type type,
+			   void *type_data)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+
+	switch (type) {
+	case TC_SETUP_BLOCK:
+		return flow_block_cb_setup_simple(type_data,
+						  &tc956xmac_block_cb_list,
+						  tc956xmac_setup_tc_block_cb,
+						  priv, priv, true);
+	case TC_SETUP_QDISC_CBS:
+		return tc956xmac_tc_setup_cbs(priv, type_data);
+	case TC_SETUP_QDISC_TAPRIO:
+		return tc956xmac_tc_setup_taprio(priv, type_data);
+	case TC_SETUP_QDISC_ETF:
+		return tc956xmac_tc_setup_etf(priv, type_data);
+#if LINUX_VERSION_CODE > KERNEL_VERSION(6, 2, 16)
+	case TC_QUERY_CAPS:
+		return tc956xmac_tc_setup_query_cap(priv, type_data);
+#endif
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+
+static u16 tc956xmac_select_queue(struct net_device *dev, struct sk_buff *skb,
+			       struct net_device *sb_dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#ifdef TC956X
+	u16 txqueue_select;
+	unsigned int eth_or_vlan_tag;
+	unsigned int eth_type;
+	unsigned int avb_priority;
+
+	/* TX Channel assignment based on Vlan tag and protocol type */
+	eth_or_vlan_tag = htons(((skb->data[13]<<8) | skb->data[12]));
+	if (eth_or_vlan_tag == ETH_P_8021Q) {
+		eth_type = htons(((skb->data[17]<<8) | skb->data[16]));
+		if (eth_type == ETH_P_TSN) {
+			/* Extract VLAN priority field from the tx data */
+			avb_priority = htons((skb->data[15]<<8) | skb->data[14]);
+
+			avb_priority >>= 13;
+#ifndef TC956X_SRIOV_VF
+			if (avb_priority == TC956X_AVB_PRIORITY_CLASS_A)
+				txqueue_select = AVB_CLASS_A_TX_CH;
+			else if (avb_priority == TC956X_AVB_PRIORITY_CLASS_B)
+				txqueue_select = AVB_CLASS_B_TX_CH;
+			else if (avb_priority == TC956X_PRIORITY_CLASS_CDT)
+				txqueue_select = TSN_CLASS_CDT_TX_CH;
+			else
+				txqueue_select = HOST_BEST_EFF_CH;
+#elif (defined TC956X_SRIOV_VF)
+			if (avb_priority == TC956X_AVB_PRIORITY_CLASS_A)
+				txqueue_select = priv->plat->avb_class_a_ch_no;
+			else if (avb_priority == TC956X_AVB_PRIORITY_CLASS_B)
+				txqueue_select = priv->plat->avb_class_b_ch_no;
+			else if (avb_priority == TC956X_PRIORITY_CLASS_CDT)
+				txqueue_select = priv->plat->tsn_ch_no;
+			else
+				txqueue_select = priv->plat->best_effort_ch_no;
+#endif
+		} else {
+#ifndef TC956X_SRIOV_VF
+			txqueue_select = LEGACY_VLAN_TAGGED_CH;
+#elif (defined TC956X_SRIOV_VF)
+			txqueue_select = priv->plat->best_effort_ch_no;
+#endif
+		}
+	} else {
+#ifndef TC956X_SRIOV_VF
+		switch (eth_or_vlan_tag) {
+		case ETH_P_1588:
+			txqueue_select = TC956X_GPTP_TX_CH;
+			break;
+		default:
+			txqueue_select = HOST_BEST_EFF_CH;
+			break;
+		}
+#elif (defined TC956X_SRIOV_VF)
+		switch (eth_or_vlan_tag) {
+		case ETH_P_1588:
+			txqueue_select = priv->plat->gptp_ch_no;
+			break;
+		default:
+		txqueue_select = priv->plat->best_effort_ch_no;
+			break;
+		}
+#endif
+	}
+	netdev_dbg(priv->dev, "%s: Tx Queue select = %d", __func__, txqueue_select);
+	return txqueue_select;
+#else
+	int gso = skb_shinfo(skb)->gso_type;
+
+	if (gso & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6 | SKB_GSO_UDP_L4)) {
+		/*
+		 * There is no way to determine the number of TSO/USO
+		 * capable Queues. Let's use always the Queue 0
+		 * because if TSO/USO is supported then at least this
+		 * one will be capable.
+		 */
+		return 0;
+	}
+
+	return netdev_pick_tx(dev, skb, NULL) % dev->real_num_tx_queues;
+#endif
+}
+
+static int tc956xmac_set_mac_address(struct net_device *ndev, void *addr)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	int ret = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	ret = eth_mac_addr(ndev, addr);
+	if (ret)
+		return ret;
+
+#ifdef TC956X_SRIOV_VF
+	tc956xmac_set_umac_addr(priv, ndev->dev_addr, HOST_MAC_ADDR_OFFSET + priv->fn_id_info.vf_no);
+#else
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	tc956xmac_set_umac_addr(priv, priv->hw, (unsigned char *)ndev->dev_addr, HOST_MAC_ADDR_OFFSET, PF_DRIVER);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+#endif
+
+	return ret;
+}
+
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+static struct dentry *tc956xmac_fs_dir;
+
+#ifdef TC956X_UNSUPPORTED_UNTESETD_FEATURE
+static void sysfs_display_ring(void *head, int size, int extend_desc,
+			       struct seq_file *seq)
+{
+	int i;
+	struct dma_extended_desc *ep = (struct dma_extended_desc *)head;
+	struct dma_desc *p = (struct dma_desc *)head;
+
+	for (i = 0; i < size; i++) {
+		if (extend_desc) {
+			seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+				   i, (unsigned int)virt_to_phys(ep),
+				   le32_to_cpu(ep->basic.des0),
+				   le32_to_cpu(ep->basic.des1),
+				   le32_to_cpu(ep->basic.des2),
+				   le32_to_cpu(ep->basic.des3));
+			ep++;
+		} else {
+			seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+				   i, (unsigned int)virt_to_phys(p),
+				   le32_to_cpu(p->des0), le32_to_cpu(p->des1),
+				   le32_to_cpu(p->des2), le32_to_cpu(p->des3));
+			p++;
+		}
+		seq_printf(seq, "\n");
+	}
+}
+
+static int tc956xmac_rings_status_show(struct seq_file *seq, void *v)
+{
+	struct net_device *dev = seq->private;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	u32 rx_count = priv->plat->rx_queues_to_use;
+	u32 tx_count = priv->plat->tx_queues_to_use;
+	u32 queue;
+
+	if ((dev->flags & IFF_UP) == 0)
+		return 0;
+
+	for (queue = 0; queue < rx_count; queue++) {
+		struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+
+		if (priv->plat->rx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+
+		seq_printf(seq, "RX Queue %d:\n", queue);
+
+		if (priv->extend_desc) {
+			seq_printf(seq, "Extended descriptor ring:\n");
+			sysfs_display_ring((void *)rx_q->dma_erx,
+					   DMA_RX_SIZE, 1, seq);
+		} else {
+			seq_printf(seq, "Descriptor ring:\n");
+			sysfs_display_ring((void *)rx_q->dma_rx,
+					   DMA_RX_SIZE, 0, seq);
+		}
+	}
+
+	for (queue = 0; queue < tx_count; queue++) {
+		struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+
+		if (priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+
+		seq_printf(seq, "TX Queue %d:\n", queue);
+
+		if (priv->extend_desc) {
+			seq_printf(seq, "Extended descriptor ring:\n");
+			sysfs_display_ring((void *)tx_q->dma_etx,
+					   DMA_TX_SIZE, 1, seq);
+		} else if (!(tx_q->tbs & TC956XMAC_TBS_AVAIL)) {
+			seq_printf(seq, "Descriptor ring:\n");
+			sysfs_display_ring((void *)tx_q->dma_tx,
+					   DMA_TX_SIZE, 0, seq);
+		}
+	}
+
+	return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(tc956xmac_rings_status);
+
+static int tc956xmac_dma_cap_show(struct seq_file *seq, void *v)
+{
+	struct net_device *dev = seq->private;
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	if (!priv->hw_cap_support) {
+		seq_printf(seq, "DMA HW features not supported\n");
+		return 0;
+	}
+
+	seq_printf(seq, "==============================\n");
+	seq_printf(seq, "\tDMA HW features\n");
+	seq_printf(seq, "==============================\n");
+
+	seq_printf(seq, "\t10/100 Mbps: %s\n",
+		   (priv->dma_cap.mbps_10_100) ? "Y" : "N");
+	seq_printf(seq, "\t1000 Mbps: %s\n",
+		   (priv->dma_cap.mbps_1000) ? "Y" : "N");
+	seq_printf(seq, "\tHalf duplex: %s\n",
+		   (priv->dma_cap.half_duplex) ? "Y" : "N");
+	seq_printf(seq, "\tHash Filter: %s\n",
+		   (priv->dma_cap.hash_filter) ? "Y" : "N");
+	seq_printf(seq, "\tMultiple MAC address registers: %s\n",
+		   (priv->dma_cap.multi_addr) ? "Y" : "N");
+	seq_printf(seq, "\tPCS (TBI/SGMII/RTBI PHY interfaces): %s\n",
+		   (priv->dma_cap.pcs) ? "Y" : "N");
+	seq_printf(seq, "\tSMA (MDIO) Interface: %s\n",
+		   (priv->dma_cap.sma_mdio) ? "Y" : "N");
+	seq_printf(seq, "\tPMT Remote wake up: %s\n",
+		   (priv->dma_cap.pmt_remote_wake_up) ? "Y" : "N");
+	seq_printf(seq, "\tPMT Magic Frame: %s\n",
+		   (priv->dma_cap.pmt_magic_frame) ? "Y" : "N");
+	seq_printf(seq, "\tRMON module: %s\n",
+		   (priv->dma_cap.rmon) ? "Y" : "N");
+	seq_printf(seq, "\tIEEE 1588-2002 Time Stamp: %s\n",
+		   (priv->dma_cap.time_stamp) ? "Y" : "N");
+	seq_printf(seq, "\tIEEE 1588-2008 Advanced Time Stamp: %s\n",
+		   (priv->dma_cap.atime_stamp) ? "Y" : "N");
+	seq_printf(seq, "\t802.3az - Energy-Efficient Ethernet (EEE): %s\n",
+		   (priv->dma_cap.eee) ? "Y" : "N");
+	seq_printf(seq, "\tAV features: %s\n", (priv->dma_cap.av) ? "Y" : "N");
+	seq_printf(seq, "\tChecksum Offload in TX: %s\n",
+		   (priv->dma_cap.tx_coe) ? "Y" : "N");
+	if (priv->synopsys_id >= DWMAC_CORE_4_00) {
+		seq_printf(seq, "\tIP Checksum Offload in RX: %s\n",
+			   (priv->dma_cap.rx_coe) ? "Y" : "N");
+	} else {
+		seq_printf(seq, "\tIP Checksum Offload (type1) in RX: %s\n",
+			   (priv->dma_cap.rx_coe_type1) ? "Y" : "N");
+		seq_printf(seq, "\tIP Checksum Offload (type2) in RX: %s\n",
+			   (priv->dma_cap.rx_coe_type2) ? "Y" : "N");
+	}
+	seq_printf(seq, "\tRXFIFO > 2048bytes: %s\n",
+		   (priv->dma_cap.rxfifo_over_2048) ? "Y" : "N");
+	seq_printf(seq, "\tNumber of Additional RX channel: %d\n",
+		   priv->dma_cap.number_rx_channel);
+	seq_printf(seq, "\tNumber of Additional TX channel: %d\n",
+		   priv->dma_cap.number_tx_channel);
+	seq_printf(seq, "\tNumber of Additional RX queues: %d\n",
+		   priv->dma_cap.number_rx_queues);
+	seq_printf(seq, "\tNumber of Additional TX queues: %d\n",
+		   priv->dma_cap.number_tx_queues);
+	seq_printf(seq, "\tEnhanced descriptors: %s\n",
+		   (priv->dma_cap.enh_desc) ? "Y" : "N");
+	seq_printf(seq, "\tTX Fifo Size: %d\n", priv->dma_cap.tx_fifo_size);
+	seq_printf(seq, "\tRX Fifo Size: %d\n", priv->dma_cap.rx_fifo_size);
+	seq_printf(seq, "\tHash Table Size: %d\n", priv->dma_cap.hash_tb_sz);
+	seq_printf(seq, "\tTSO: %s\n", priv->dma_cap.tsoen ? "Y" : "N");
+	seq_printf(seq, "\tNumber of PPS Outputs: %d\n",
+		   priv->dma_cap.pps_out_num);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+	seq_printf(seq, "\tNumber of Auxiliary Snapshot Inputs: %d\n",
+		   priv->dma_cap.aux_snapshot_n);
+#endif
+	seq_printf(seq, "\tSafety Features: %s\n",
+		   priv->dma_cap.asp ? "Y" : "N");
+	seq_printf(seq, "\tFlexible RX Parser: %s\n",
+		   priv->dma_cap.frpsel ? "Y" : "N");
+	seq_printf(seq, "\tEnhanced Addressing: %d\n",
+		   priv->dma_cap.addr64);
+	seq_printf(seq, "\tReceive Side Scaling: %s\n",
+		   priv->dma_cap.rssen ? "Y" : "N");
+	seq_printf(seq, "\tVLAN Hash Filtering: %s\n",
+		   priv->dma_cap.vlhash ? "Y" : "N");
+	seq_printf(seq, "\tSplit Header: %s\n",
+		   priv->dma_cap.sphen ? "Y" : "N");
+	seq_printf(seq, "\tVLAN TX Insertion: %s\n",
+		   priv->dma_cap.vlins ? "Y" : "N");
+	seq_printf(seq, "\tDouble VLAN: %s\n",
+		   priv->dma_cap.dvlan ? "Y" : "N");
+	seq_printf(seq, "\tNumber of L3/L4 Filters: %d\n",
+		   priv->dma_cap.l3l4fnum);
+	seq_printf(seq, "\tARP Offloading: %s\n",
+		   priv->dma_cap.arpoffsel ? "Y" : "N");
+	seq_printf(seq, "\tEnhancements to Scheduled Traffic (EST): %s\n",
+		   priv->dma_cap.estsel ? "Y" : "N");
+	seq_printf(seq, "\tFrame Preemption (FPE): %s\n",
+		   priv->dma_cap.fpesel ? "Y" : "N");
+	seq_printf(seq, "\tTime-Based Scheduling (TBS): %s\n",
+		   priv->dma_cap.tbssel ? "Y" : "N");
+	return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(tc956xmac_dma_cap);
+
+/* Use network device events to rename debugfs file entries.
+ */
+static int tc956xmac_device_event(struct notifier_block *unused,
+			       unsigned long event, void *ptr)
+{
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+#ifndef TC956X_SRIOV_VF
+	if (dev->netdev_ops != &tc956xmac_netdev_ops)
+#else
+	if (dev->netdev_ops != &tc956xmac_vf_netdev_ops)
+#endif
+		goto done;
+
+	switch (event) {
+	case NETDEV_CHANGENAME:
+		if (priv->dbgfs_dir)
+			priv->dbgfs_dir = debugfs_rename(tc956xmac_fs_dir,
+							 priv->dbgfs_dir,
+							 tc956xmac_fs_dir,
+							 dev->name);
+		break;
+	}
+done:
+	return NOTIFY_DONE;
+}
+
+static struct notifier_block tc956xmac_notifier = {
+	.notifier_call = tc956xmac_device_event,
+};
+#endif
+static void tc956xmac_init_fs(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+
+	/* Create per netdev entries */
+	priv->dbgfs_dir = debugfs_create_dir(dev->name, tc956xmac_fs_dir);
+
+#ifndef TC956X
+	/* Entry to report DMA RX/TX rings */
+	debugfs_create_file("descriptors_status", 0444, priv->dbgfs_dir, dev,
+			    &tc956xmac_rings_status_fops);
+
+	/* Entry to report the DMA HW features */
+	debugfs_create_file("dma_cap", 0444, priv->dbgfs_dir, dev,
+			    &tc956xmac_dma_cap_fops);
+
+	register_netdevice_notifier(&tc956xmac_notifier);
+#endif
+}
+
+static void tc956xmac_exit_fs(struct net_device *dev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+#ifndef TC956X
+	unregister_netdevice_notifier(&tc956xmac_notifier);
+#endif
+	debugfs_remove_recursive(priv->dbgfs_dir);
+}
+#endif /* CONFIG_DEBUG_FS */
+#endif /* TC956X_SRIOV_PF */
+
+#ifndef TC956X
+static u32 tc956xmac_vid_crc32_le(__le16 vid_le)
+{
+	unsigned char *data = (unsigned char *)&vid_le;
+	unsigned char data_byte = 0;
+	u32 crc = ~0x0;
+	u32 temp = 0;
+	int i, bits;
+
+	bits = get_bitmask_order(VLAN_VID_MASK);
+	for (i = 0; i < bits; i++) {
+		if ((i % 8) == 0)
+			data_byte = data[i / 8];
+
+		temp = ((crc & 1) ^ data_byte) & 1;
+		crc >>= 1;
+		data_byte >>= 1;
+
+		if (temp)
+			crc ^= 0xedb88320;
+	}
+
+	return crc;
+}
+#endif
+
+static int tc956xmac_vlan_rx_add_vid(struct net_device *ndev, __be16 proto,
+				  u16 vid)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+#ifndef TC956X_SRIOV_VF
+	bool is_double = false;
+	int ret = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	if (be16_to_cpu(proto) == ETH_P_8021AD)
+		is_double = true;
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.vlan_filter, flags);
+#endif
+
+	tc956xmac_update_vlan_hash(priv, ndev, is_double, vid, PF_DRIVER);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.vlan_filter, flags);
+#endif
+	return ret;
+#elif (defined TC956X_SRIOV_VF)
+	tc956xmac_add_vlan(priv, vid);
+	return 0;
+#endif
+}
+
+static int tc956xmac_vlan_rx_kill_vid(struct net_device *ndev, __be16 proto,
+				   u16 vid)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+#ifndef TC956X_SRIOV_VF
+	int ret = 0;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+
+	spin_lock_irqsave(&priv->spn_lock.vlan_filter, flags);
+#endif
+	tc956xmac_delete_vlan(priv, ndev, vid, PF_DRIVER);
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.vlan_filter, flags);
+#endif
+	return ret;
+#elif (defined TC956X_SRIOV_VF)
+	tc956xmac_delete_vlan(priv, vid);
+	return 0;
+#endif
+}
+
+#ifndef TC956X_SRIOV_VF
+static const struct net_device_ops tc956xmac_netdev_ops = {
+#elif defined TC956X_SRIOV_VF
+static const struct net_device_ops tc956xmac_vf_netdev_ops = {
+#endif
+	.ndo_open = tc956xmac_open,
+	.ndo_start_xmit = tc956xmac_xmit,
+	.ndo_stop = tc956xmac_release,
+	.ndo_change_mtu = tc956xmac_change_mtu,
+	.ndo_fix_features = tc956xmac_fix_features,
+	.ndo_set_features = tc956xmac_set_features,
+	.ndo_set_rx_mode = tc956xmac_set_rx_mode,
+	.ndo_tx_timeout = tc956xmac_tx_timeout,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+	.ndo_eth_ioctl = tc956xmac_ioctl,
+	.ndo_siocdevprivate = tc956xmac_siocdevprivate,
+#else
+	.ndo_do_ioctl = tc956xmac_ioctl,
+#endif
+	.ndo_setup_tc = tc956xmac_setup_tc,
+	.ndo_select_queue = tc956xmac_select_queue,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+#ifdef CONFIG_NET_POLL_CONTROLLER
+	.ndo_poll_controller = tc956xmac_poll_controller,
+#endif
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+	.ndo_set_mac_address = tc956xmac_set_mac_address,
+	.ndo_vlan_rx_add_vid = tc956xmac_vlan_rx_add_vid,
+	.ndo_vlan_rx_kill_vid = tc956xmac_vlan_rx_kill_vid,
+};
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED
+static void tc956xmac_reset_subtask(struct tc956xmac_priv *priv)
+{
+	if (!test_and_clear_bit(TC956XMAC_RESET_REQUESTED, &priv->state))
+		return;
+	if (test_bit(TC956XMAC_DOWN, &priv->state))
+		return;
+
+	netdev_err(priv->dev, "Reset adapter.\n");
+
+	rtnl_lock();
+	netif_trans_update(priv->dev);
+	while (test_and_set_bit(TC956XMAC_RESETING, &priv->state))
+		usleep_range(1000, 2000);
+
+	set_bit(TC956XMAC_DOWN, &priv->state);
+	dev_close(priv->dev);
+	dev_open(priv->dev, NULL);
+	clear_bit(TC956XMAC_DOWN, &priv->state);
+	clear_bit(TC956XMAC_RESETING, &priv->state);
+	rtnl_unlock();
+}
+
+static void tc956xmac_service_task(struct work_struct *work)
+{
+	struct tc956xmac_priv *priv = container_of(work, struct tc956xmac_priv,
+			service_task);
+
+	tc956xmac_reset_subtask(priv);
+	clear_bit(TC956XMAC_SERVICE_SCHED, &priv->state);
+}
+#endif
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+/**
+ * tc956xmac_service_mbx_task - Service mailbox task
+ * @work: work structure
+ */
+static void tc956xmac_service_mbx_task(struct work_struct *work)
+{
+	struct tc956xmac_priv *priv = container_of(work, struct tc956xmac_priv,
+			service_mbx_task);
+	u32 dma_ch = 0;
+	u8 vf;
+	int ret = -EBUSY;
+	struct mii_ioctl_data *mii_ptr;
+
+	if (priv->mbx_wq_param.fn_id == SCH_WQ_PHY_REG_RD) {
+		mii_ptr = if_mii(&priv->mbx_wq_param.rq);
+		rtnl_lock();
+		ret = phylink_mii_ioctl(priv->phylink, &priv->mbx_wq_param.rq, SIOCGMIIREG);
+		rtnl_unlock();
+		priv->mbx_wq_param.val_out[priv->mbx_wq_param.vf_no] = mii_ptr->val_out;
+		priv->mbx_wq_param.fn_id = 0;
+	} else if (priv->mbx_wq_param.fn_id == SCH_WQ_RX_DMA_ERR) {
+		for (vf = 0; vf < MAX_NO_OF_VFS; vf++) {
+			while (ret == -EBUSY)
+				ret = tc956x_mbx_wrap_rx_dma_err(priv, vf);
+
+			if (ret == -1) {
+				priv->clear_to_send[vf] = VF_DOWN;
+				for (dma_ch = 0; dma_ch < TC956XMAC_CH_MAX; dma_ch++) {
+					if (priv->dma_vf_map[dma_ch] == vf)
+						tc956xmac_stop_rx_dma(priv, dma_ch);
+				}
+			}
+			ret = -EBUSY;  //to continue with next vf
+		}
+		/* Invoke device driver close */
+		if (netif_running(priv->dev)) {
+			rtnl_lock();
+			dev_close(priv->dev);
+			rtnl_unlock();
+		}
+		/* Invoke device driver open */
+		if (!netif_running(priv->dev)) {
+			rtnl_lock();
+			dev_open(priv->dev, NULL);
+			rtnl_unlock();
+		}
+		priv->mbx_wq_param.fn_id = 0;
+	} else if (priv->mbx_wq_param.fn_id == SCH_WQ_GET_PAUSE_PARAM) {
+		rtnl_lock();
+		tc956xmac_get_pauseparam(priv->dev, &priv->mbx_wq_param.pause);
+		rtnl_unlock();
+		priv->mbx_wq_param.fn_id = 0;
+	} else {
+		if (priv->mbx_wq_param.queue_no == 0 || priv->mbx_wq_param.queue_no == 1 || priv->mbx_wq_param.queue_no == 7) {
+			for (dma_ch = 0; dma_ch < 3; dma_ch++) {
+				vf = priv->dma_vf_map[dma_ch];
+				while (ret == -EBUSY)
+					ret = tc956x_mbx_wrap_rx_dma_ch_tlptr(priv, dma_ch, vf);
+				ret = -EBUSY;  //to continue with next vf
+			}
+		} else {
+			dma_ch = priv->plat->rx_queues_cfg[priv->mbx_wq_param.queue_no].chan;
+			vf = priv->dma_vf_map[dma_ch];
+			while (ret == -EBUSY)
+				ret = tc956x_mbx_wrap_rx_dma_ch_tlptr(priv, dma_ch, vf);
+		}
+	}
+	clear_bit(TC956XMAC_SERVICE_SCHED, &priv->state);
+}
+#endif
+
+#ifdef TC956X_SRIOV_VF
+static void tc956xmac_mailbox_service_task(struct work_struct *work)
+{
+	struct tc956xmac_priv *priv = container_of(work, struct tc956xmac_priv, mbx_service_task);
+	struct pci_dev *pdev = to_pci_dev(priv->device);
+
+	if (priv->flag == SCH_WQ_PF_FLR) {
+		pci_reset_function(pdev);
+		priv->flag = 0;
+	} else if (priv->flag == SCH_WQ_RX_DMA_ERR) {
+		tc956xmac_stop_all_dma(priv);
+		priv->flag = 0;
+	} else if (priv->flag == SCH_WQ_LINK_STATE_UP) {
+		int ret = 0;
+
+		ret = init_dma_desc_rings(priv->dev, GFP_KERNEL);
+		if (ret < 0) {
+			netdev_err(priv->dev, "%s: DMA descriptors initialization failed\n",
+				__func__);
+		}
+
+		ret = tc956xmac_hw_setup(priv->dev, true);
+		if (ret < 0)
+			netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
+		priv->flag = 0;
+	} else {
+		/* Indicate change of features required, which invokes ndo_fix_features
+		 * where dev->features are updated.
+		 */
+		rtnl_lock();
+		netdev_change_features(priv->dev);
+		rtnl_unlock();
+	}
+
+	clear_bit(TC956XMAC_SERVICE_SCHED, &priv->state);
+}
+#endif
+
+/**
+ *  tc956xmac_hw_init - Init the MAC device
+ *  @priv: driver private structure
+ *  Description: this function is to configure the MAC device according to
+ *  some platform parameters or the HW capability register. It prepares the
+ *  driver to use either ring or chain modes and to setup either enhanced or
+ *  normal descriptors.
+ */
+static int tc956xmac_hw_init(struct tc956xmac_priv *priv)
+{
+	int ret;
+
+	/* dwmac-sun8i only work in chain mode */
+	if (priv->plat->has_sun8i)
+		chain_mode = 1;
+#ifndef TC956X
+	priv->chain_mode = chain_mode;
+#endif
+
+	/* Initialize HW Interface */
+	ret = tc956xmac_hwif_init(priv);
+	if (ret)
+		return ret;
+
+	/* Get the HW capability (new GMAC newer than 3.50a) */
+	priv->hw_cap_support = tc956xmac_get_hw_features(priv);
+	if (priv->hw_cap_support) {
+		dev_info(priv->device, "DMA HW capability register supported\n");
+
+		/* We can override some gmac/dma configuration fields: e.g.
+		 * enh_desc, tx_coe (e.g. that are passed through the
+		 * platform) with the values from the HW capability
+		 * register (if supported).
+		 */
+		priv->plat->enh_desc = priv->dma_cap.enh_desc;
+		priv->plat->pmt = priv->dma_cap.pmt_remote_wake_up;
+		priv->hw->pmt = priv->plat->pmt;
+		if (priv->dma_cap.hash_tb_sz) {
+			priv->hw->multicast_filter_bins =
+					(BIT(priv->dma_cap.hash_tb_sz) << 5);
+			priv->hw->mcast_bits_log2 =
+					ilog2(priv->hw->multicast_filter_bins);
+		}
+
+		/* TXCOE doesn't work in thresh DMA mode */
+		if (priv->plat->force_thresh_dma_mode)
+			priv->plat->tx_coe = 0;
+		else
+			priv->plat->tx_coe = priv->dma_cap.tx_coe;
+
+		/* In case of GMAC4 rx_coe is from HW cap register. */
+
+		priv->plat->rx_coe = priv->dma_cap.rx_coe;
+
+		if (priv->dma_cap.rx_coe_type2)
+			priv->plat->rx_coe = TC956XMAC_RX_COE_TYPE2;
+		else if (priv->dma_cap.rx_coe_type1)
+			priv->plat->rx_coe = TC956XMAC_RX_COE_TYPE1;
+
+	} else {
+		dev_info(priv->device, "No HW DMA feature register supported\n");
+	}
+
+	if (priv->plat->rx_coe) {
+		priv->hw->rx_csum = priv->plat->rx_coe;
+		dev_info(priv->device, "RX Checksum Offload Engine supported\n");
+		if (priv->synopsys_id < DWMAC_CORE_4_00)
+			dev_info(priv->device, "COE Type %d\n", priv->hw->rx_csum);
+	}
+	if (priv->plat->tx_coe) {
+		dev_info(priv->device, "TX Checksum insertion supported\n");
+		priv->csum_insertion = 1;	/* Enable Tx Csum Offload */
+	}
+
+	if (priv->plat->pmt) {
+		dev_info(priv->device, "Wake-Up On Lan supported\n");
+		device_set_wakeup_capable(priv->device, 1);
+	}
+
+	if (priv->dma_cap.tsoen)
+		dev_info(priv->device, "TSO supported\n");
+
+	/* Run HW quirks, if any */
+	if (priv->hwif_quirks) {
+		ret = priv->hwif_quirks(priv);
+		if (ret)
+			return ret;
+	}
+
+	/* Rx Watchdog is available in the COREs newer than the 3.40.
+	 * In some case, for example on bugged HW this feature
+	 * has to be disable and this can be done by passing the
+	 * riwt_off field from the platform.
+	 */
+	if (((priv->synopsys_id >= DWMAC_CORE_3_50) ||
+	    (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) {
+		priv->use_riwt = 1;
+		dev_info(priv->device,
+			 "Enable RX Mitigation via HW Watchdog Timer\n");
+	}
+
+	return 0;
+}
+
+#ifdef TC956X
+/*
+ * brief This sequence is used to get Tx channel count
+ * param[in] count
+ * return Success or Failure
+ * retval  0 Success
+ * retval -1 Failure
+ */
+
+static unsigned char tc956x_get_tx_channel_count(struct tc956xmac_resources *res)
+{
+	unsigned char count;
+	unsigned long varMAC_HFR2;
+	u32 mac_offset_base = res->port_num == RM_PF0_ID ?
+					MAC0_BASE_OFFSET : MAC1_BASE_OFFSET;
+
+	KPRINT_INFO("-->%s\n", __func__);
+	varMAC_HFR2 = readl(res->addr + mac_offset_base + XGMAC_HW_FEATURE2_BASE);
+	count = ((varMAC_HFR2 & XGMAC_HWFEAT_TXCHCNT) >> XGMAC_HWFEAT_TXCHCNT_SHIFT) + 1;
+	KPRINT_INFO("<-- %s\n", __func__);
+	return count;
+}
+
+/*
+ * brief This sequence is used to get Rx channel count
+ * param[in] count
+ * return Success or Failure
+ * retval  0 Success
+ * retval -1 Failure
+ */
+
+static unsigned char tc956x_get_rx_channel_count(struct tc956xmac_resources *res)
+{
+	unsigned char count;
+	unsigned long varMAC_HFR2;
+	u32 mac_offset_base = res->port_num == RM_PF0_ID ?
+						MAC0_BASE_OFFSET : MAC1_BASE_OFFSET;
+
+	KPRINT_INFO("--> %s\n", __func__);
+
+	varMAC_HFR2 = readl(res->addr + mac_offset_base + XGMAC_HW_FEATURE2_BASE);
+	count = ((varMAC_HFR2 & XGMAC_HWFEAT_RXCHCNT) >> XGMAC_HWFEAT_RXCHCNT_SHIFT) + 1;
+	KPRINT_INFO("<-- %s\n", __func__);
+	return count;
+}
+#endif
+#ifndef EEPROM_MAC_ADDR
+
+/*!
+ * \brief API to validate MAC ID
+ *
+ * \param[in] char *s - pointer to MAC ID string
+ *
+ * \return boolean
+ *
+ * \retval true on success and false on failure.
+ */
+static bool isMAC(char *s)
+{
+	int i = 0;
+
+	if (s == NULL)
+		return false;
+
+	for (i = 0; i < 17; i++) {
+		if (i % 3 != 2 && !isxdigit(s[i]))
+			return false;
+		if (i % 3 == 2 && s[i] != ':')
+			return false;
+	}
+
+	return true;
+}
+
+/*!
+ * \brief API to extract MAC ID from given string
+ *
+ * \param[in] char *string - pointer to MAC ID string
+ *
+ * \return None
+ */
+static void extract_macid(char *string, uint8_t vf_id)
+{
+	char *token_m = NULL;
+	int j = 0;
+	int mac_id = 0;
+
+#ifdef TC956X_SRIOV_PF
+	static int addr_found;
+
+	/* Extract MAC ID byte by byte */
+	token_m = strsep(&string, ":");
+
+	while (token_m != NULL) {
+		sscanf(token_m, "%x", &mac_id);
+		if (addr_found < TC956X_MAC_ADDR_CNT) {
+			dev_addr[addr_found][j++] = mac_id;
+			token_m = strsep(&string, ":");
+		} else
+			break;
+	}
+	KPRINT_DEBUG1("MAC Addr : %pM\n", &dev_addr[addr_found][0]);
+#elif defined TC956X_SRIOV_VF
+	static int k;
+	int addr_found = 0;
+
+	/* Extract MAC ID byte by byte */
+	token_m = strsep(&string, ":");
+
+	while (token_m != NULL) {
+		sscanf(token_m, "%x", &mac_id);
+
+		if (addr_found < 2) {
+			dev_addr[k][addr_found + vf_id][j++] = mac_id;
+			token_m = strsep(&string, ":");
+		} else
+			break;
+	}
+	KPRINT_INFO("MAC Addr : %pM\n", &dev_addr[k][addr_found + vf_id][0]);
+
+	k++;
+#endif
+	addr_found++;
+}
+
+/*!
+ * \brief API to extract MAC ID from given string
+ *
+ * \param[in] char *string - pointer to MAC ID string
+ *
+ * \return None
+ */
+static void extract_macid_eeprom(char *string, uint8_t vf_id)
+{
+	char *token_m = NULL;
+	int j = 0;
+	int mac_id = 0;
+
+#ifdef TC956X_SRIOV_PF
+	static int addr_found_eeprom;
+
+	/* Extract MAC ID byte by byte */
+	token_m = strsep(&string, ":");
+
+	while (token_m != NULL) {
+		sscanf(token_m, "%x", &mac_id);
+		if (addr_found_eeprom < TC956X_MAC_ADDR_CNT) {
+			dev_addr[addr_found_eeprom][j++] = mac_id;
+			token_m = strsep(&string, ":");
+		} else
+			break;
+	}
+	KPRINT_DEBUG1("MAC Addr : %pM\n", &dev_addr[addr_found_eeprom][0]);
+#elif defined TC956X_SRIOV_VF
+	static int k;
+	int addr_found_eeprom = 0;
+
+	/* Extract MAC ID byte by byte */
+	token_m = strsep(&string, ":");
+
+	while (token_m != NULL) {
+		sscanf(token_m, "%x", &mac_id);
+
+		if (addr_found_eeprom < 2) {
+			dev_addr[k][addr_found_eeprom + vf_id][j++] = mac_id;
+			token_m = strsep(&string, ":");
+		} else
+			break;
+	}
+	KPRINT_INFO("MAC Addr : %pM\n", &dev_addr[k][addr_found_eeprom + vf_id][0]);
+
+	k++;
+#endif
+	addr_found_eeprom++;
+}
+
+/*!
+ * \brief API to parse and extract the user configured MAC ID
+ *
+ * \param[in] file_buf - Pointer to file data buffer
+ *
+ * \return boolean
+ *
+ * \return - True on Success and False in failure
+ */
+static bool lookfor_macid(char *file_buf, uint8_t port_id, uint8_t dev_id, MacSrcType_t mac_src)
+{
+	char *string = NULL, *token_n = NULL, *token_s = NULL, *token_m = NULL;
+	char *dev_no = NULL, *port_no = NULL;
+	bool status = false;
+	int tc956x_device_no = 0;
+	int total_valid_addr = 0;
+
+	string = file_buf;
+
+	/* Parse Line-0 */
+	token_n = strsep(&string, "\n");
+	while (token_n != NULL) {
+		/* Check if line is enabled */
+		if (token_n[0] != '#') {
+			/* Extract the token based space character */
+			token_s = strsep(&token_n, " ");
+			if (token_s != NULL) {
+				if (strncmp(token_s, config_param_list[0].mdio_key, 9) == 0) {
+					token_s = strsep(&token_n, " ");
+					dev_no = &token_n[6];
+					port_no = &token_n[7];
+					token_m = strsep(&token_s, ":");
+					sscanf(token_m, "%d", &tc956x_device_no);
+#if (!defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG))
+#ifdef TC956X_SRIOV_VF
+					if (((tc956x_device_no != mdio_bus_id) &&
+						(*port_no != (char)(port_id + 49))) ||
+						(*dev_no != (char)(dev_id + 49)))
+#else
+					if (((tc956x_device_no != mdio_bus_id) &&
+						(*port_no != (char)(port_id + 49))) ||
+						(*dev_no != (char)(dev_id + 48)))
+#endif
+#else
+					if (tc956x_device_no != mdio_bus_id)
+#endif
+					{
+						token_n = strsep(&string, "\n");
+						if (token_n == NULL)
+							break;
+						continue;
+					}
+				}
+			}
+
+			/* Extract the token based space character */
+			token_s = strsep(&token_n, " ");
+			if (token_s != NULL) {
+				/* Compare if parsed string matches with
+				 * key listed in configuration table
+				 */
+				if (strncmp(token_s, config_param_list[0].mac_key, 6) == 0) {
+
+					KPRINT_INFO("MAC_ID Key is found\n");
+					/* Read next word */
+					token_s = strsep(&token_n, "\n");
+					if (token_s != NULL) {
+
+						/* Check if MAC ID length
+						 * and MAC ID is valid
+						 */
+						if ((isMAC(token_s) == true)
+							&& (strlen(token_s) ==
+							config_param_list[0].mac_str_len)) {
+							/* If user configured
+							 * MAC ID is valid,
+							 * assign default MAC ID
+							 */
+							if (mac_src == MAC_SRC_CONFIG_FILE) {
+								extract_macid(token_s, dev_id);
+							} else {
+								extract_macid_eeprom(token_s, dev_id);
+							}
+							total_valid_addr++;
+
+							if (total_valid_addr > 1)
+								status = true;
+						} else {
+							KPRINT_INFO ("Valid Mac not found");
+						}
+					}
+				}
+			}
+		}
+		/* Read next lile */
+		token_n = strsep(&string, "\n");
+
+		if (token_n == NULL)
+			break;
+	}
+	return status;
+}
+
+/*!
+ * \brief Parse the EEPROM for MAC address
+ *
+ * \param[in] None
+ *
+ * \return True on Success and False in failure
+ *
+ */
+static int qps615_eeprom_readmac(uint8_t port_id, uint8_t dev_id)
+{
+	struct i2c_adapter *adapter;
+	int ret, i;
+
+	adapter = i2c_get_adapter(EEPROM_I2C_ADAPTER_ID);
+	if (!adapter) {
+		/* error, no such I2C adaptor. */
+		KPRINT_ERR("Chip at i2c Invalid i2c adapter %d\n", EEPROM_I2C_ADAPTER_ID);
+		return -ENODEV;
+	}
+
+	u8 wr_data[EEPROM_WRITE_OFFSET_BYTE] = {0, 0};
+	u8 rd_data[EEPROM_READ_BYTE];
+	struct i2c_msg msg[2];
+
+	msg[0].addr = EEPROM_I2C_ADDRESS;
+	msg[0].len = EEPROM_WRITE_OFFSET_BYTE;
+	msg[0].flags = 0;
+	msg[0].buf = wr_data;
+
+	msg[1].addr = EEPROM_I2C_ADDRESS;
+	msg[1].len = EEPROM_READ_BYTE;
+	msg[1].flags = I2C_M_RD;
+	msg[1].buf = rd_data;
+
+	ret = i2c_transfer(adapter, msg, 2);
+	if (ret != 2){
+		KPRINT_ERR("EEPROM I2C wrong response\n");
+		return ret;
+	} else {
+		/* Parse the EEPROM result */
+		for (i = 0; i < CONFIG_PARAM_NUM; i++) {
+			if (strstr((const char *)rd_data, config_param_list[i].mdio_key)) {
+				KPRINT_ERR("EEPROM Pattern Match\n");
+				if (strncmp(config_param_list[i].mdio_key, "MDIOBUSID", 9) == 0) {
+					/* MAC ID Configuration */
+					KPRINT_ERR("MAC_ID EEPROM Configuration\n");
+					lookfor_macid(rd_data, port_id, dev_id, MAC_SRC_PLATFORM_EEPROM);
+				}
+			} else {
+				KPRINT_ERR("Pattern NOT Match\n");
+			}
+		}
+	}
+	return 0;
+}
+
+/*!
+ * \brief Parse the user configuration file for various config
+ *
+ * \param[in] None
+ *
+ * \return None
+ *
+ */
+static void parse_config_file(uint8_t port_id, uint8_t dev_id, struct net_device *dev)
+{
+	void *data = NULL;
+	char *cdata;
+	int ret, i;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
+	ret = kernel_read_file_from_path("/var/persist/config.ini", 0, &data, INT_MAX, NULL, READING_POLICY);
+#else
+	loff_t size;
+
+	ret = kernel_read_file_from_path("/var/persist/config.ini", &data, &size, 1000, READING_POLICY);
+#endif
+	if (ret < 0) {
+		KPRINT_INFO("Mac configuration file not found\n");
+		eth_random_addr(&dev_addr[tc956xmac_pm_usage_counter][0]);
+		dev->addr_assign_type = NET_ADDR_RANDOM;
+		KPRINT_INFO("tc956xmac_pm_usage_counter=%d\n",tc956xmac_pm_usage_counter);
+		return;
+	} else {
+
+		cdata = data;
+		/* Parse the file */
+		for (i = 0; i < CONFIG_PARAM_NUM; i++) {
+			if (strstr((const char *)cdata, config_param_list[i].mdio_key)) {
+				KPRINT_DEBUG1("Pattern Match\n");
+				if (strncmp(config_param_list[i].mdio_key, "MDIOBUSID", 9) == 0) {
+					/* MAC ID Configuration */
+					KPRINT_DEBUG1("MAC_ID Configuration\n");
+					lookfor_macid(data, port_id, dev_id, MAC_SRC_CONFIG_FILE);
+				}
+			}
+		}
+	}
+
+	vfree(data);
+	KPRINT_INFO("<--%s", __func__);
+}
+#endif
+
+
+#ifdef TC956X_SRIOV_VF
+static int validate_rsc_mgr_alloc(struct tc956xmac_priv *priv, struct net_device *ndev)
+{
+	u8 rsc, i;
+	u8 ch_cnt = priv->plat->tx_queues_to_use;
+	u8 ret = 0;
+
+	/* Validate Resource allocation for VF */
+
+	tc956xmac_rsc_mng_get_rscs(priv, ndev, &rsc);
+
+	dev_info(priv->device, "VF %d Resource allocation %x\n", priv->plat->vf_id+1, rsc);
+
+	for (i = 0; i < ch_cnt; i++) {
+		if (priv->plat->ch_in_use[i])
+			if (!((rsc >> i) & TC956X_DMA_CH0_MASK))
+				ret = -1;
+	}
+
+	return ret;
+}
+#endif
+
+/**
+ * tc956xmac_dvr_probe
+ * @device: device pointer
+ * @plat_dat: platform data pointer
+ * @res: tc956xmac resource pointer
+ * Description: this is the main probe function used to
+ * call the alloc_etherdev, allocate the priv structure.
+ * Return:
+ * returns 0 on success, otherwise errno.
+ */
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_dvr_probe(struct device *device,
+#elif defined TC956X_SRIOV_VF
+int tc956xmac_vf_dvr_probe(struct device *device,
+#endif
+		     struct plat_tc956xmacenet_data *plat_dat,
+		     struct tc956xmac_resources *res)
+{
+	struct net_device *ndev = NULL;
+	struct tc956xmac_priv *priv;
+	u32 queue, rxq, maxq;
+	int i, ret = 0;
+	u8 tx_ch_count, rx_ch_count;
+	u32 mac_offset_base = res->port_num == RM_PF0_ID ?
+					MAC0_BASE_OFFSET : MAC1_BASE_OFFSET;
+
+#ifdef EEPROM_MAC_ADDR
+	u32 mac_addr;
+#endif
+	void *nrst_reg = NULL, *nclk_reg = NULL;
+	u32 nrst_val = 0, nclk_val = 0;
+#ifdef TC956X
+	KPRINT_INFO("HFR0 Val = 0x%08x", readl(res->addr + mac_offset_base +
+							XGMAC_HW_FEATURE0_BASE));
+	KPRINT_INFO("HFR1 Val = 0x%08x", readl(res->addr + mac_offset_base +
+							XGMAC_HW_FEATURE1_BASE));
+	KPRINT_INFO("HFR2 Val = 0x%08x", readl(res->addr + mac_offset_base +
+							XGMAC_HW_FEATURE2_BASE));
+	KPRINT_INFO("HFR3 Val = 0x%08x", readl(res->addr + mac_offset_base +
+							XGMAC_HW_FEATURE3_BASE));
+
+
+	tx_ch_count = tc956x_get_tx_channel_count(res);
+	rx_ch_count = tc956x_get_rx_channel_count(res);
+
+	ndev = devm_alloc_etherdev_mqs(device, sizeof(struct tc956xmac_priv),
+				       tx_ch_count, rx_ch_count);
+#endif
+
+	if (!ndev) {
+		NMSGPR_ALERT(device, "%s:Unable to alloc new net device\n",
+				TC956X_RESOURCE_NAME);
+		return -ENOMEM;
+	}
+
+	SET_NETDEV_DEV(ndev, device);
+
+	priv = netdev_priv(ndev);
+	priv->device = device;
+	priv->dev = ndev;
+	priv->ioaddr = res->addr;
+
+	memset(priv->saved_gpio_config, 0, sizeof(struct tc956x_gpio_config) * (GPIO_12 + 1));
+
+	ret = tc956x_platform_probe(priv, res);
+	if (ret) {
+		dev_err(priv->device, "Platform probe error %d\n", ret);
+		return -EPERM;
+	}
+#ifdef TC956X
+	priv->mac_loopback_mode = 0; /* Disable MAC loopback by default */
+	priv->phy_loopback_mode = 0; /* Disable PHY loopback by default */
+	priv->tc956x_port_pm_suspend = false; /* By Default Port suspend state set to false */
+	priv->link_down_rst = false; /* Disable MAC reset during link down by default */
+#endif
+
+	tc956xmac_set_ethtool_ops(ndev);
+	priv->pause = pause;
+	priv->plat = plat_dat;
+#ifdef TC956X_SRIOV_PF
+	priv->sriov_enabled = res->sriov_enabled;
+#endif
+#ifdef TC956X
+	priv->tc956x_SFR_pci_base_addr = res->tc956x_SFR_pci_base_addr;
+	priv->tc956x_SRAM_pci_base_addr = res->tc956x_SRAM_pci_base_addr;
+	priv->tc956x_BRIDGE_CFG_pci_base_addr = res->tc956x_BRIDGE_CFG_pci_base_addr;
+#endif
+	priv->port_num = res->port_num;
+	priv->dev->base_addr = (unsigned long)res->addr;
+	if (priv->plat->interface == PHY_INTERFACE_MODE_SGMII)
+		priv->is_sgmii_2p5g = true;
+	else
+		priv->is_sgmii_2p5g = false;
+#ifdef TC956X_SRIOV_PF
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	priv->wol_config_enabled = false; /* Disable WOL SGMII 1G, configuration by default */
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+#endif
+	priv->dev->irq = res->irq;
+	priv->wol_irq = res->wol_irq;
+	priv->lpi_irq = res->lpi_irq;
+	priv->port_interface = res->port_interface;
+	priv->eee_enabled = res->eee_enabled;
+	priv->tx_lpi_timer = res->tx_lpi_timer;
+	priv->pci_bd = res->pci_bd;
+
+#ifdef TC956X_SRIOV_PF
+	priv->pm_saved_linkdown_rst = 0;
+	priv->pm_saved_linkdown_clk = 0;
+	priv->port_link_down = false;
+	priv->port_release = false;
+
+
+	/* DMA Ch allocation for PF & VF */
+	priv->rsc_dma_ch_alloc[0] = TC956X_PF_CH_ALLOC;
+	priv->rsc_dma_ch_alloc[1] = TC956X_VF0_CH_ALLOC;
+	priv->rsc_dma_ch_alloc[2] = TC956X_VF1_CH_ALLOC;
+	priv->rsc_dma_ch_alloc[3] = TC956X_VF2_CH_ALLOC;
+
+#if !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+	/* SRIOV PF 0/1 Queue configuration
+	 * Note:
+	 *	1. Channels used in PF/VF configurations are enabled
+	 *		in respective drivers.
+	 *	2. Rx Queues are configured in PF only.
+	 *	3. Tx Queues are configured in respective devices. In case of
+	 *		VF, the Queue configuraion happens via mailbox.
+	 *	4. Traffic class configuraions are done in respective drivers except for TC0.
+	 *		TC0 is configured in PF only as its common for Tx 0,1,2,3
+	 *		as per current design.
+	 */
+
+	/* SRIOV PF */
+	/* Tx & Rx Channel Configuration */
+	priv->plat->tx_ch_in_use[0] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[1] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[2] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[3] = TC956X_ENABLE_CHNL;
+	priv->plat->tx_ch_in_use[4] = TC956X_ENABLE_CHNL;
+	priv->plat->tx_ch_in_use[5] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[6] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[7] = TC956X_DISABLE_CHNL;
+
+	priv->plat->rx_ch_in_use[0] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[1] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[2] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[3] = TC956X_ENABLE_CHNL;
+	priv->plat->rx_ch_in_use[4] = TC956X_ENABLE_CHNL;
+	priv->plat->rx_ch_in_use[5] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[6] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[7] = TC956X_DISABLE_CHNL;
+
+	/* Tx & Rx Queue Configuration */
+	priv->plat->tx_q_in_use[0] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[1] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[2] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[3] = TC956X_ENABLE_QUEUE;
+	priv->plat->tx_q_in_use[4] = TC956X_ENABLE_QUEUE;
+	priv->plat->tx_q_in_use[5] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[6] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[7] = TC956X_DISABLE_QUEUE;
+
+	priv->plat->rx_q_in_use[0] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[1] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[2] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[3] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[4] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[5] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[6] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[7] = TC956X_ENABLE_QUEUE;
+
+#elif defined(TC956X_AUTOMOTIVE_CONFIG) || defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+
+	/* Automotive, Port Bridge */
+	/* Tx & Rx Channel Configuration */
+	priv->plat->tx_ch_in_use[0] = TC956X_ENABLE_CHNL;
+	priv->plat->tx_ch_in_use[1] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[2] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[3] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[4] = TC956X_ENABLE_CHNL;
+	priv->plat->tx_ch_in_use[5] = TC956X_ENABLE_CHNL;
+	priv->plat->tx_ch_in_use[6] = TC956X_ENABLE_CHNL;
+	priv->plat->tx_ch_in_use[7] = TC956X_ENABLE_CHNL;
+
+	priv->plat->rx_ch_in_use[0] = TC956X_ENABLE_CHNL;
+	priv->plat->rx_ch_in_use[1] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[2] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[3] = TC956X_ENABLE_CHNL;
+	priv->plat->rx_ch_in_use[4] = TC956X_ENABLE_CHNL;
+	priv->plat->rx_ch_in_use[5] = TC956X_ENABLE_CHNL;
+	priv->plat->rx_ch_in_use[6] = TC956X_ENABLE_CHNL;
+	priv->plat->rx_ch_in_use[7] = TC956X_ENABLE_CHNL;
+
+	/* Tx & Rx Queue Configuration */
+	priv->plat->tx_q_in_use[0] = TC956X_ENABLE_QUEUE;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	priv->plat->tx_q_in_use[1] = TC956X_ENABLE_QUEUE;
+#else
+	priv->plat->tx_q_in_use[1] = TC956X_DISABLE_QUEUE;
+#endif
+#if defined(TC956X_ENABLE_MAC2MAC_BRIDGE)
+	priv->plat->tx_q_in_use[2] = TC956X_ENABLE_QUEUE;
+#else
+	priv->plat->tx_q_in_use[2] = TC956X_DISABLE_QUEUE;
+#endif
+	priv->plat->tx_q_in_use[3] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[4] = TC956X_ENABLE_QUEUE;
+	priv->plat->tx_q_in_use[5] = TC956X_ENABLE_QUEUE;
+	priv->plat->tx_q_in_use[6] = TC956X_ENABLE_QUEUE;
+	priv->plat->tx_q_in_use[7] = TC956X_ENABLE_QUEUE;
+
+	priv->plat->rx_q_in_use[0] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[1] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[2] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[3] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[4] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[5] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[6] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[7] = TC956X_ENABLE_QUEUE;
+
+#else
+
+	/* CPE */
+	KPRINT_INFO("****************************************************cpe q ch enable***************************\n");
+	/* Tx & Rx Channel Configuration */
+	priv->plat->tx_ch_in_use[0] = TC956X_ENABLE_CHNL;
+	priv->plat->tx_ch_in_use[1] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[2] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[3] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[4] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[5] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[6] = TC956X_DISABLE_CHNL;
+	priv->plat->tx_ch_in_use[7] = TC956X_DISABLE_CHNL;
+
+	priv->plat->rx_ch_in_use[0] = TC956X_ENABLE_CHNL;
+	priv->plat->rx_ch_in_use[1] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[2] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[3] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[4] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[5] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[6] = TC956X_DISABLE_CHNL;
+	priv->plat->rx_ch_in_use[7] = TC956X_DISABLE_CHNL;
+
+	/* Tx & Rx Queue Configuration */
+	priv->plat->tx_q_in_use[0] = TC956X_ENABLE_QUEUE;
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	priv->plat->tx_q_in_use[1] = TC956X_ENABLE_QUEUE;
+#else
+	priv->plat->tx_q_in_use[1] = TC956X_DISABLE_QUEUE;
+#endif
+	priv->plat->tx_q_in_use[2] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[3] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[4] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[5] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[6] = TC956X_DISABLE_QUEUE;
+	priv->plat->tx_q_in_use[7] = TC956X_DISABLE_QUEUE;
+
+	priv->plat->rx_q_in_use[0] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[1] = TC956X_ENABLE_QUEUE;
+	priv->plat->rx_q_in_use[2] = TC956X_DISABLE_QUEUE;
+	priv->plat->rx_q_in_use[3] = TC956X_DISABLE_QUEUE;
+	priv->plat->rx_q_in_use[4] = TC956X_DISABLE_QUEUE;
+	priv->plat->rx_q_in_use[5] = TC956X_DISABLE_QUEUE;
+	priv->plat->rx_q_in_use[6] = TC956X_DISABLE_QUEUE;
+	priv->plat->rx_q_in_use[7] = TC956X_DISABLE_QUEUE;
+#endif /* TC956X_AUTOMOTIVE_CONFIG */
+#endif /* TC956X_SRIOV_PF */
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	dev_info(priv->device, "Locks enabled for shared resources\n");
+	spin_lock_init(&priv->spn_lock.mac_filter);
+	spin_lock_init(&priv->spn_lock.vlan_filter);
+	spin_lock_init(&priv->spn_lock.est);
+	spin_lock_init(&priv->spn_lock.fpe);
+	spin_lock_init(&priv->spn_lock.frp);
+	spin_lock_init(&priv->spn_lock.cbs);
+#endif
+#ifndef TC956X_SRIOV_PF
+#ifdef TC956X_DMA_OFFLOAD_ENABLE
+	priv->client_priv = NULL;
+	memset(priv->cm3_tamap, 0, sizeof(struct tc956xmac_cm3_tamap) * MAX_CM3_TAMAP_ENTRIES);
+#endif
+#endif
+#ifdef TC956X
+	/* Read mac address from config.ini file */
+	++mdio_bus_id;
+
+#ifdef EEPROM_MAC_ADDR
+
+#ifdef TC956X
+#ifdef TC956X_SRIOV_VF
+
+	mac_addr = readl(priv->tc956x_SRAM_pci_base_addr +
+		TC956X_M3_SRAM_EEPROM_MAC_ADDR + (EEPROM_PORT_OFFSET * TC956X_EIGHT) +
+		(priv->plat->vf_id * TC956X_SIXTEEN));
+
+	if (mac_addr != 0) {
+
+		dev_addr[priv->port_num][priv->plat->vf_id][0] = (mac_addr & EEPROM_MAC_ADDR_MASK1);
+		dev_addr[priv->port_num][priv->plat->vf_id][1] =
+						(mac_addr & EEPROM_MAC_ADDR_MASK2) >> TC956X_EIGHT;
+		dev_addr[priv->port_num][priv->plat->vf_id][2] =
+						(mac_addr & EEPROM_MAC_ADDR_MASK3) >> TC956X_SIXTEEN;
+		dev_addr[priv->port_num][priv->plat->vf_id][3] =
+						(mac_addr & EEPROM_MAC_ADDR_MASK4) >> TC956X_TWENTY_FOUR;
+
+		mac_addr = readl(priv->tc956x_SRAM_pci_base_addr +
+			TC956X_M3_SRAM_EEPROM_MAC_ADDR + (EEPROM_PORT_OFFSET * TC956X_EIGHT) +
+			(priv->plat->vf_id * TC956X_SIXTEEN) + TC956X_FOUR);
+
+		dev_addr[priv->port_num][priv->plat->vf_id][4] = (mac_addr & EEPROM_MAC_ADDR_MASK1);
+		dev_addr[priv->port_num][priv->plat->vf_id][5] =
+						(mac_addr & EEPROM_MAC_ADDR_MASK2) >> TC956X_EIGHT;
+	}
+
+#else
+	mac_addr = readl(priv->tc956x_SRAM_pci_base_addr +
+		TC956X_M3_SRAM_EEPROM_MAC_ADDR + (TC956X_EIGHT * tc956xmac_pm_usage_counter));
+
+	if (mac_addr != 0) {
+		dev_addr[tc956xmac_pm_usage_counter][0] = (mac_addr & EEPROM_MAC_ADDR_MASK1);
+		dev_addr[tc956xmac_pm_usage_counter][1] = (mac_addr & EEPROM_MAC_ADDR_MASK2) >> TC956X_EIGHT;
+		dev_addr[tc956xmac_pm_usage_counter][2] = (mac_addr & EEPROM_MAC_ADDR_MASK3) >> TC956X_SIXTEEN;
+		dev_addr[tc956xmac_pm_usage_counter][3] = (mac_addr & EEPROM_MAC_ADDR_MASK4) >> TC956X_TWENTY_FOUR;
+
+		mac_addr = readl(priv->tc956x_SRAM_pci_base_addr +
+			TC956X_M3_SRAM_EEPROM_MAC_ADDR + (TC956X_EIGHT * tc956xmac_pm_usage_counter) + TC956X_FOUR);
+		dev_addr[tc956xmac_pm_usage_counter][4] = (mac_addr & EEPROM_MAC_ADDR_MASK1);
+		dev_addr[tc956xmac_pm_usage_counter][5] = (mac_addr & EEPROM_MAC_ADDR_MASK2) >> TC956X_EIGHT;
+	}
+#endif /* TC956X_SRIOV_VF */
+#endif /* TC956X */
+
+#else
+#ifdef TC956X_SRIOV_VF
+	/* To be enabled for config.ini parsing */
+	parse_config_file(priv->port_num, priv->plat->vf_id, priv->dev);
+#else
+	/* To be enabled for config.ini parsing */
+	parse_config_file(priv->port_num, 0, priv->dev);
+	/* To be enabled for EEPROM MAC parsing */
+	qps615_eeprom_readmac(priv->port_num, 0);
+#endif
+
+#endif /* EEPROM_MAC_ADDR */
+#ifndef TC956X_SRIOV_VF
+	res->mac = &dev_addr[tc956xmac_pm_usage_counter][0];
+
+	NMSGPR_INFO(device, "MAC Address: %02x:%02x:%02x:%02x:%02x:%02x\n",
+		dev_addr[tc956xmac_pm_usage_counter][0], dev_addr[tc956xmac_pm_usage_counter][1],
+		dev_addr[tc956xmac_pm_usage_counter][2], dev_addr[tc956xmac_pm_usage_counter][3],
+		dev_addr[tc956xmac_pm_usage_counter][4], dev_addr[tc956xmac_pm_usage_counter][5]);
+
+#elif (defined TC956X_SRIOV_VF)
+
+	res->mac = &dev_addr[priv->port_num][priv->plat->vf_id][0];
+	NMSGPR_INFO(device, "MAC Address: %02x:%02x:%02x:%02x:%02x:%02x\n",
+		dev_addr[priv->port_num][priv->plat->vf_id][0], dev_addr[priv->port_num][priv->plat->vf_id][1],
+		dev_addr[priv->port_num][priv->plat->vf_id][2], dev_addr[priv->port_num][priv->plat->vf_id][3],
+		dev_addr[priv->port_num][priv->plat->vf_id][4], dev_addr[priv->port_num][priv->plat->vf_id][5]);
+#endif
+
+#endif
+	if (!IS_ERR_OR_NULL(res->mac))
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+		eth_hw_addr_set(priv->dev, res->mac);
+#else
+		memcpy(priv->dev->dev_addr, res->mac, ETH_ALEN);
+#endif
+	dev_set_drvdata(device, priv->dev);
+
+	/* Verify driver arguments */
+	tc956xmac_verify_args();
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED
+	/* Allocate workqueue */
+	priv->wq = create_singlethread_workqueue("tc956xmac_wq");
+	if (!priv->wq) {
+		dev_err(priv->device, "failed to create workqueue\n");
+		return -ENOMEM;
+	}
+
+	INIT_WORK(&priv->service_task, tc956xmac_service_task);
+#endif
+
+#if defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)
+	/* Allocate workqueue */
+	priv->mbx_wq = create_singlethread_workqueue("tc956xmac_mbx_wq");
+	if (!priv->mbx_wq) {
+		dev_err(priv->device, "failed to create workqueue\n");
+		return -ENOMEM;
+	}
+
+	INIT_WORK(&priv->service_mbx_task, tc956xmac_service_mbx_task);
+#endif
+#ifdef TC956X_SRIOV_VF
+	/* Allocate workqueue */
+	priv->mbx_wq = create_singlethread_workqueue("tc956xmac_mailbox_wq");
+	if (!priv->mbx_wq) {
+		dev_err(priv->device, "failed to create workqueue\n");
+		return -ENOMEM;
+	}
+
+	INIT_WORK(&priv->mbx_service_task, tc956xmac_mailbox_service_task);
+#endif
+	/* Override with kernel parameters if supplied XXX CRS XXX
+	 * this needs to have multiple instances
+	 */
+	if ((phyaddr >= 0) && (phyaddr <= 31))
+		priv->plat->phy_addr = phyaddr;
+
+	if (priv->plat->tc956xmac_rst) {
+		ret = reset_control_assert(priv->plat->tc956xmac_rst);
+		reset_control_deassert(priv->plat->tc956xmac_rst);
+		/* Some reset controllers have only reset callback instead of
+		 * assert + deassert callbacks pair.
+		 */
+		if (ret == -ENOTSUPP)
+			reset_control_reset(priv->plat->tc956xmac_rst);
+	}
+
+	/* Init MAC and get the capabilities */
+	ret = tc956xmac_hw_init(priv);
+	if (ret)
+		goto error_hw_init;
+#ifdef TC956X_SRIOV_VF
+	ret = validate_rsc_mgr_alloc(priv, ndev);
+
+	if (ret) {
+		dev_err(priv->device, "VF %d Channel Resource allocation mismatch\n", priv->plat->vf_id + 1);
+		goto error_hw_init;
+	}
+
+	tc956xmac_check_ether_addr(priv);
+#endif
+	/* Configure real RX and TX queues */
+#ifndef TC956X_SRIOV_VF
+	netif_set_real_num_rx_queues(ndev, priv->plat->rx_queues_to_use);
+	netif_set_real_num_tx_queues(ndev, priv->plat->tx_queues_to_use);
+	ndev->netdev_ops = &tc956xmac_netdev_ops;
+#elif (defined TC956X_SRIOV_VF)
+	netif_set_real_num_rx_queues(ndev, priv->plat->rx_queues_to_use_actual);
+	netif_set_real_num_tx_queues(ndev, priv->plat->tx_queues_to_use_actual);
+	ndev->netdev_ops = &tc956xmac_vf_netdev_ops;
+#endif
+
+#ifdef TC956X_SRIOV_VF
+	ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+#else //CPE_DRV
+	ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+				NETIF_F_RXCSUM;
+#endif
+
+	ret = tc956xmac_tc_init(priv, NULL);
+	if (!ret)
+		ndev->hw_features |= NETIF_F_HW_TC;
+
+	/* Enable TSO module if any Queue TSO is Enabled */
+	for (queue = 0; queue < MTL_MAX_TX_QUEUES; queue++) {
+#ifdef TC956X_SRIOV_VF
+		if (priv->plat->tx_queues_cfg[0].tso_en == TC956X_ENABLE &&
+								priv->tso)
+#else
+		if (priv->plat->tx_queues_cfg[0].tso_en == TC956X_ENABLE)
+#endif
+			priv->plat->tso_en = 1;
+	}
+
+#ifndef TC956X_SRIOV_VF
+	if ((priv->plat->tso_en) && (priv->dma_cap.tsoen)) {
+		ndev->hw_features |= NETIF_F_TSO | NETIF_F_TSO6;
+		if (priv->plat->has_gmac4)
+			ndev->hw_features |= NETIF_F_GSO_UDP_L4;
+		priv->tso = true;
+		/* Update driver cap to let VF know about feature
+		 * enable/disable
+		 */
+		priv->pf_drv_cap.tso_en = true;
+		dev_info(priv->device, "TSO feature enabled\n");
+	} else {
+		priv->tso = false;
+		/* Update driver cap to let VF know about feature
+		 * enable/disable
+		 */
+		priv->pf_drv_cap.tso_en = false;
+	}
+#endif
+
+	if (priv->dma_cap.sphen && priv->plat->sph_en) {
+		ndev->hw_features |= NETIF_F_GRO;
+		priv->sph = true;
+		dev_info(priv->device, "SPH feature enabled\n");
+	}
+
+	if (priv->dma_cap.addr64) {
+		ret = dma_set_mask_and_coherent(device,
+				DMA_BIT_MASK(priv->dma_cap.addr64));
+		if (!ret) {
+			dev_info(priv->device, "Using %d bits DMA width\n",
+				 priv->dma_cap.addr64);
+		} else {
+			ret = dma_set_mask_and_coherent(device,
+					DMA_BIT_MASK(32));
+			if (ret) {
+				dev_err(priv->device, "Failed to set DMA Mask\n");
+				goto error_hw_init;
+			}
+
+			priv->dma_cap.addr64 = 32;
+		}
+	}
+	/*
+	 * Enable enhanced addressing mode in all configurations to support
+	 * mapping 0x10 XXXX XXXX TC956X address space to host.
+	 */
+	priv->plat->dma_cfg->eame = true;
+
+	ndev->features |= ndev->hw_features | NETIF_F_HIGHDMA;
+#ifdef TC956X_SRIOV_VF
+	/* Get the VF function id information */
+
+	if (tc956xmac_rsc_mng_get_fn_id(priv, priv->tc956x_BRIDGE_CFG_pci_base_addr,
+					&priv->fn_id_info)) {
+		netdev_err(priv->dev,
+				"%s: Wrong function id for the driver (error: %d)\n",
+				__func__, -ENODEV);
+		return -ENODEV;
+	}
+
+	tc956xmac_mbx_init(priv, NULL);
+
+	/* Get PF driver capabilities */
+	tc956x_get_drv_cap(priv, priv);
+	KPRINT_DEBUG1("priv->pf_drv_cap.jumbo_en = %d\n", priv->pf_drv_cap.jumbo_en);
+
+	/* These features will be modified based on PF configuration and mailbox
+	 * request from PF
+	 */
+	if (priv->pf_drv_cap.csum_en) {
+		ndev->features |= NETIF_F_RXCSUM;
+		ndev->hw_features |= NETIF_F_RXCSUM;
+	}
+
+	if (priv->pf_drv_cap.crc_en) {
+		ndev->features |= NETIF_F_RXFCS;
+		ndev->hw_features |= NETIF_F_RXFCS;
+	}
+
+	if (priv->pf_drv_cap.tso_en) {
+		if ((priv->plat->tso_en) && (priv->dma_cap.tsoen)) {
+			ndev->hw_features |= NETIF_F_TSO | NETIF_F_TSO6;
+			ndev->features |= NETIF_F_TSO | NETIF_F_TSO6;
+			if (priv->plat->has_gmac4) {
+				ndev->hw_features |= NETIF_F_GSO_UDP_L4;
+				ndev->features |= NETIF_F_GSO_UDP_L4;
+			}
+			priv->tso = true;
+			dev_info(priv->device, "TSO feature enabled\n");
+		} else {
+			priv->tso = false;
+		}
+	}
+#else
+	/* Ethtool rx-fcs state is Off by default */
+	ndev->hw_features |= NETIF_F_RXFCS;
+#endif
+	ndev->watchdog_timeo = msecs_to_jiffies(watchdog);
+#ifdef TC956XMAC_VLAN_TAG_USED
+	/* Both mac100 and gmac support receive VLAN tag detection */
+	/* Driver only supports CTAG */
+	ndev->features &= ~NETIF_F_HW_VLAN_CTAG_RX; /* Disable rx-vlan-offload by default */
+	ndev->hw_features |= NETIF_F_HW_VLAN_CTAG_RX; /* Support as User-changeable features */
+#ifndef TC956X
+	ndev->features |= NETIF_F_HW_VLAN_STAG_RX;
+#endif
+	if (priv->dma_cap.vlhash) {
+		/* Driver only supports CTAG */
+		ndev->features &= ~NETIF_F_HW_VLAN_CTAG_FILTER; /* Disable rx-vlan-filter by default */
+		ndev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER; /* Support as User-changeable features */
+#ifndef TC956X
+		ndev->features |= NETIF_F_HW_VLAN_STAG_FILTER;
+#endif
+	}
+	if (priv->dma_cap.vlins) {
+		ndev->features |= NETIF_F_HW_VLAN_CTAG_TX; /* Enable tx-vlan-offload by default */
+		ndev->hw_features |= NETIF_F_HW_VLAN_CTAG_TX; /* Support as User-changeable features */
+#ifndef TC956X
+		if (priv->dma_cap.dvlan)
+			ndev->features |= NETIF_F_HW_VLAN_STAG_TX;
+#endif
+	}
+#endif
+	priv->mac_table =
+		kcalloc(TC956X_MAX_PERFECT_ADDRESSES - XGMAC_ADDR_ADD_SKIP_OFST,
+			sizeof(struct tc956x_mac_addr), GFP_KERNEL);
+
+	if (!priv->mac_table)
+		goto error_hw_init;
+
+	priv->vlan_table =
+		kcalloc(TC956X_MAX_PERFECT_VLAN, sizeof(struct tc956x_vlan_id), GFP_KERNEL);
+
+	if (!priv->vlan_table) {
+		kfree(priv->mac_table);
+		goto error_hw_init;
+	}
+	priv->msg_enable = netif_msg_init(debug, default_msg_level);
+
+	/* Initialize RSS */
+	rxq = priv->plat->rx_queues_to_use;
+	netdev_rss_key_fill(priv->rss.key, sizeof(priv->rss.key));
+	for (i = 0; i < ARRAY_SIZE(priv->rss.table); i++)
+		priv->rss.table[i] = ethtool_rxfh_indir_default(i, rxq);
+
+	if (priv->dma_cap.rssen && priv->plat->rss_en)
+		ndev->features |= NETIF_F_RXHASH;
+
+	/* MTU range: 46 - hw-specific max */
+	ndev->min_mtu = ETH_ZLEN - ETH_HLEN;
+#ifdef TC956X_SRIOV_VF
+	/* Set MTU size based on Jumbo Frame feature enable */
+	if (priv->pf_drv_cap.jumbo_en) {
+#endif
+		if (priv->plat->has_xgmac)
+#ifdef TC956X_CPE_CONFIG
+			ndev->max_mtu = MAX_SUPPORTED_MTU/*XGMAC_JUMBO_LEN*/;
+#else
+			ndev->max_mtu = XGMAC_JUMBO_LEN;
+#endif
+		else if ((priv->plat->enh_desc) || (priv->synopsys_id >= DWMAC_CORE_4_00))
+			ndev->max_mtu = JUMBO_LEN;
+		else
+			ndev->max_mtu = SKB_MAX_HEAD(NET_SKB_PAD + NET_IP_ALIGN);
+#ifdef TC956X_SRIOV_VF
+	} else
+		ndev->max_mtu = SKB_MAX_HEAD(NET_SKB_PAD + NET_IP_ALIGN);
+#endif
+	/* Will not overwrite ndev->max_mtu if plat->maxmtu > ndev->max_mtu
+	 * as well as plat->maxmtu < ndev->min_mtu which is a invalid range.
+	 */
+	if ((priv->plat->maxmtu < ndev->max_mtu) &&
+	    (priv->plat->maxmtu >= ndev->min_mtu))
+		ndev->max_mtu = priv->plat->maxmtu;
+	else if (priv->plat->maxmtu < ndev->min_mtu)
+		dev_warn(priv->device,
+			 "%s: warning: maxmtu having invalid value (%d)\n",
+			 __func__, priv->plat->maxmtu);
+
+	netdev_dbg(priv->dev, "%s: MAX MTU size = %d", __func__, ndev->max_mtu);
+
+	if (flow_ctrl)
+		priv->flow_ctrl = FLOW_AUTO;/* RX/TX pause on */
+
+	/* Setup channels NAPI */
+	maxq = max(priv->plat->rx_queues_to_use, priv->plat->tx_queues_to_use);
+
+	for (queue = 0; queue < maxq; queue++) {
+		struct tc956xmac_channel *ch = &priv->channel[queue];
+
+		spin_lock_init(&ch->lock);
+		ch->priv_data = priv;
+		ch->index = queue;
+
+#ifdef TC956X_SRIOV_PF
+
+		if (queue < priv->plat->rx_queues_to_use) {
+
+			if (priv->plat->rx_ch_in_use[queue] ==
+						TC956X_DISABLE_CHNL)
+				continue;
+
+			/* Add napi only for applicable channels */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
+			netif_napi_add(ndev, &ch->rx_napi, tc956xmac_napi_poll_rx);
+#else
+			netif_napi_add(ndev, &ch->rx_napi, tc956xmac_napi_poll_rx,
+				       NAPI_POLL_WEIGHT);
+#endif
+		}
+		if (queue < priv->plat->tx_queues_to_use) {
+
+
+			if (priv->plat->tx_ch_in_use[queue] ==
+						TC956X_DISABLE_CHNL)
+				continue;
+
+			/* Add napi only for applicable channels */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 19, 0)
+			netif_napi_add_tx(ndev, &ch->tx_napi,
+					  tc956xmac_napi_poll_tx);
+#else
+			netif_tx_napi_add(ndev, &ch->tx_napi,
+					  tc956xmac_napi_poll_tx,
+					  NAPI_POLL_WEIGHT);
+#endif
+		}
+#elif defined TC956X_SRIOV_VF
+		/* DMA Tx or Rx channel number and counts are same for VF, so
+		 * use any one variable to skip the non-used channel
+		 */
+
+		if ((queue < priv->plat->rx_queues_to_use) &&
+				(priv->plat->ch_in_use[queue] == 1)) {
+			netif_napi_add(ndev, &ch->rx_napi, tc956xmac_napi_poll_rx,
+				       NAPI_POLL_WEIGHT);
+		}
+		if ((queue < priv->plat->tx_queues_to_use) &&
+				(priv->plat->ch_in_use[queue] == 1)) {
+			netif_tx_napi_add(ndev, &ch->tx_napi,
+					  tc956xmac_napi_poll_tx,
+					  NAPI_POLL_WEIGHT);
+		}
+#else /* TC956X_SRIOV_PF */
+		if ((queue < priv->plat->rx_queues_to_use) &&
+			(priv->plat->rx_dma_ch_owner[queue] == USE_IN_TC956X_SW)) {
+
+			netif_napi_add(ndev, &ch->rx_napi, tc956xmac_napi_poll_rx,
+				       NAPI_POLL_WEIGHT);
+		}
+		if ((queue < priv->plat->tx_queues_to_use) &&
+			(priv->plat->tx_dma_ch_owner[queue] == USE_IN_TC956X_SW)) {
+			netif_tx_napi_add(ndev, &ch->tx_napi,
+					  tc956xmac_napi_poll_tx,
+					  NAPI_POLL_WEIGHT);
+		}
+#endif /* TC956X_SRIOV_PF */
+	}
+
+	mutex_init(&priv->lock);
+	mutex_init(&priv->port_ld_release_lock);
+
+#ifndef TC956X_SRIOV_VF
+
+	/* If a specific clk_csr value is passed from the platform
+	 * this means that the CSR Clock Range selection cannot be
+	 * changed at run-time and it is fixed. Viceversa the driver'll try to
+	 * set the MDC clock dynamically according to the csr actual
+	 * clock input.
+	 */
+	if (priv->plat->clk_csr >= 0)
+		priv->clk_csr = priv->plat->clk_csr;
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	else
+		tc956xmac_clk_csr_set(priv);
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+	tc956xmac_check_pcs_mode(priv);
+
+#ifdef TC956X
+	/*PMA module init*/
+	if (priv->hw->xpcs) {
+
+		if (priv->port_num == RM_PF0_ID) {
+			/* Assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL0_OFFSET);
+			ret |= (NRSTCTRL0_MAC0PMARST | NRSTCTRL0_MAC0PONRST);
+			writel(ret, priv->ioaddr + NRSTCTRL0_OFFSET);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			/* Assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL1_OFFSET);
+			ret |= (NRSTCTRL1_MAC1PMARST1 | NRSTCTRL1_MAC1PONRST1);
+			writel(ret, priv->ioaddr + NRSTCTRL1_OFFSET);
+		}
+
+		ret = tc956x_pma_setup(priv, priv->pmaaddr);
+		if (ret < 0)
+			KPRINT_INFO("PMA switching to internal clock Failed\n");
+
+		if (priv->port_num == RM_PF0_ID) {
+			/* De-assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL0_OFFSET);
+			ret &= ~(NRSTCTRL0_MAC0PMARST | NRSTCTRL0_MAC0PONRST);
+			writel(ret, priv->ioaddr + NRSTCTRL0_OFFSET);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			/* De-assertion of PMA &  XPCS reset  software Reset*/
+			ret = readl(priv->ioaddr + NRSTCTRL1_OFFSET);
+			ret &= ~(NRSTCTRL1_MAC1PMARST1 | NRSTCTRL1_MAC1PONRST1);
+			writel(ret, priv->ioaddr + NRSTCTRL1_OFFSET);
+		}
+
+		if (priv->port_num == RM_PF0_ID) {
+			do {
+				ret = readl(priv->ioaddr + NEMAC0CTL_OFFSET);
+			} while ((NEMACCTL_INIT_DONE & ret) != NEMACCTL_INIT_DONE);
+		}
+
+		if (priv->port_num == RM_PF1_ID) {
+			do {
+				ret = readl(priv->ioaddr + NEMAC1CTL_OFFSET);
+			} while ((NEMACCTL_INIT_DONE & ret) != NEMACCTL_INIT_DONE);
+		}
+
+		ret = tc956x_xpcs_init(priv, priv->xpcsaddr);
+		if (ret < 0)
+			KPRINT_INFO("XPCS initialization error\n");
+	}
+
+#endif /* TC956X */
+	if (priv->hw->pcs != TC956XMAC_PCS_RGMII  &&
+		priv->hw->pcs != TC956XMAC_PCS_TBI &&
+		priv->hw->pcs != TC956XMAC_PCS_RTBI) {
+		/* MDIO bus Registration */
+#ifdef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+		if (priv->dma_cap.sma_mdio == 1) {
+#endif
+			ret = tc956xmac_mdio_register(ndev);
+			if (ret < 0) {
+				/* tc956xmac_mdio_register() will return -ENODEV when No PHY is found */
+				if (ret == -ENODEV) {
+					dev_info(priv->device, "Port%d Bus id %x will not be registered as ethernet controller", priv->port_num, priv->plat->bus_id);
+					goto error_mdio_register;
+				} else {
+					dev_err(priv->device,
+					"%s: MDIO bus (id: %d) registration failed",
+					__func__, priv->plat->bus_id);
+					goto error_mdio_register;
+				}
+			}
+#ifdef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+		}
+#endif
+	}
+
+	ret = tc956xmac_phy_setup(priv);
+	if (ret) {
+		netdev_err(ndev, "failed to setup phy (%d)\n", ret);
+		goto error_phy_setup;
+	}
+#endif /* TC956X_SRIOV_VF */
+	ret = register_netdev(ndev);
+	if (ret) {
+		dev_err(priv->device, "%s: ERROR %i registering the device\n",
+			__func__, ret);
+		goto error_netdev_register;
+	}
+
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+	tc956xmac_init_fs(ndev);
+#endif
+#endif /* TC956X_SRIOV_PF */
+
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+	priv->pbridge_buffsize = DEFAULT_BUFSIZE * DMA_RX_SIZE;
+	priv->pbridge_buffaddr = dma_alloc_coherent(priv->device,
+		priv->pbridge_buffsize, &priv->pbridge_handle, GFP_DMA);
+	if (priv->pbridge_buffaddr == NULL)
+		ret = -ENOSPC;
+#endif
+	return ret;
+
+error_netdev_register:
+#ifndef TC956X_SRIOV_VF
+	phylink_destroy(priv->phylink);
+error_phy_setup:
+#ifdef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	if (priv->dma_cap.sma_mdio == 1) {
+#endif
+		if (priv->hw->pcs != TC956XMAC_PCS_RGMII &&
+			priv->hw->pcs != TC956XMAC_PCS_TBI &&
+			priv->hw->pcs != TC956XMAC_PCS_RTBI)
+			tc956xmac_mdio_unregister(ndev);
+#ifdef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	}
+#endif
+error_mdio_register:
+	for (queue = 0; queue < maxq; queue++) {
+		struct tc956xmac_channel *ch = &priv->channel[queue];
+#ifdef TC956X_SRIOV_PF
+		if (queue < priv->plat->rx_queues_to_use) {
+			if (priv->plat->rx_ch_in_use[queue] ==
+					TC956X_DISABLE_CHNL)
+				continue;
+#else
+		if (queue < priv->plat->rx_queues_to_use &&
+				priv->plat->rx_dma_ch_owner[queue] == USE_IN_TC956X_SW)
+#endif
+			netif_napi_del(&ch->rx_napi);
+}
+#ifdef TC956X_SRIOV_PF
+		if (queue < priv->plat->tx_queues_to_use) {
+			if (priv->plat->tx_ch_in_use[queue] ==
+						TC956X_DISABLE_CHNL)
+				continue;
+#else
+		if (queue < priv->plat->tx_queues_to_use &&
+				priv->plat->tx_dma_ch_owner[queue] == USE_IN_TC956X_SW)
+#endif
+			netif_napi_del(&ch->tx_napi);
+		}
+	}
+#endif /* TC956X_SRIOV_VF */
+	if (priv->port_num == 0) {
+		nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET;
+		nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+	} else {
+		nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL1_OFFSET;
+		nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL1_OFFSET;
+	}
+	nrst_val = readl(nrst_reg);
+	nclk_val = readl(nclk_reg);
+	KPRINT_INFO("%s : Port %d interface %s Rd RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, ndev->name,
+		nrst_val, nclk_val);
+	/* Assert reset and Disable Clock for EMAC */
+	nrst_val = nrst_val | NRSTCTRL_EMAC_MASK;
+	nclk_val = nclk_val & ~NCLKCTRL_EMAC_MASK;
+	writel(nrst_val, nrst_reg);
+	writel(nclk_val, nclk_reg);
+	KPRINT_INFO("%s : Port %d interface %s Wr RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, ndev->name,
+		readl(nrst_reg), readl(nclk_reg));
+error_hw_init:
+#ifndef TC956X
+	destroy_workqueue(priv->wq);
+#endif
+#if (defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)) | defined(TC956X_SRIOV_VF)
+	destroy_workqueue(priv->mbx_wq);
+#endif
+
+	return ret;
+}
+#ifdef TC956X_SRIOV_PF
+EXPORT_SYMBOL_GPL(tc956xmac_dvr_probe);
+#elif defined TC956X_SRIOV_VF
+EXPORT_SYMBOL_GPL(tc956xmac_vf_dvr_probe);
+#endif
+/**
+ * tc956xmac_dvr_remove
+ * @dev: device pointer
+ * Description: this function resets the TX/RX processes, disables the MAC RX/TX
+ * changes the link status, releases the DMA descriptor rings.
+ */
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_dvr_remove(struct device *dev)
+#elif defined TC956X_SRIOV_VF
+int tc956xmac_vf_dvr_remove(struct device *dev)
+#endif
+{
+	struct net_device *ndev = dev_get_drvdata(dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+#ifndef TC956X_SRIOV_VF
+	u32 val;
+	struct phy_device *phydev = NULL;
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	int addr = priv->plat->phy_addr;
+#endif
+
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	phydev = mdiobus_get_phy(priv->mii, addr);
+#endif
+
+#endif
+
+	netdev_info(priv->dev, "%s: removing driver", __func__);
+
+#ifdef TC956X_SRIOV_VF
+	tc956xmac_vf_reset(priv, VF_DOWN);
+#else
+	if (phydev) {
+		if (phydev->drv != NULL) {
+			if ((true == priv->plat->phy_interrupt_mode) && (phydev->drv->config_intr))
+				cancel_work_sync(&priv->emac_phy_work);
+		}
+	}
+#endif
+
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+	tc956xmac_exit_fs(ndev);
+#endif
+#endif /* TC956X_SRIOV_PF */
+
+	tc956xmac_stop_all_dma(priv);
+
+#ifndef TC956X_SRIOV_VF
+	tc956xmac_mac_set(priv, priv->ioaddr, false);
+#endif
+
+	netif_carrier_off(ndev);
+	unregister_netdev(ndev);
+#ifndef TC956X_SRIOV_VF
+	phylink_destroy(priv->phylink);
+#endif
+	kfree(priv->mac_table);
+	kfree(priv->vlan_table);
+
+	if (priv->plat->tc956xmac_rst)
+		reset_control_assert(priv->plat->tc956xmac_rst);
+#ifndef TC956X_SRIOV_VF
+	clk_disable_unprepare(priv->plat->pclk);
+	clk_disable_unprepare(priv->plat->tc956xmac_clk);
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+	if (priv->hw->pcs != TC956XMAC_PCS_RGMII &&
+		priv->hw->pcs != TC956XMAC_PCS_TBI &&
+		priv->hw->pcs != TC956XMAC_PCS_RTBI)
+		tc956xmac_mdio_unregister(ndev);
+#endif
+
+	if (tc956x_platform_remove(priv))
+		dev_err(priv->device, "Platform remove error\n");
+
+#endif
+#ifndef TC956X
+	destroy_workqueue(priv->wq);
+#endif
+#if (defined(TC956X_SRIOV_PF) && !defined(TC956X_AUTOMOTIVE_CONFIG) && !defined(TC956X_ENABLE_MAC2MAC_BRIDGE) && !defined(TC956X_CPE_CONFIG)) | defined(TC956X_SRIOV_VF)
+	destroy_workqueue(priv->mbx_wq);
+#endif
+	mutex_destroy(&priv->lock);
+	mutex_destroy(&priv->port_ld_release_lock);
+
+#ifndef TC956X_SRIOV_VF
+#ifdef TC956X
+	val = ioread32((void __iomem *)(priv->tc956x_SRAM_pci_base_addr + TC956X_M3_FW_EXIT));
+	val += 1;
+#ifdef DISABLE_EMAC_PORT1
+	val = TC956X_M3_FW_EXIT_VALUE;
+#endif
+	iowrite32(val, (void __iomem *)(priv->tc956x_SRAM_pci_base_addr + TC956X_M3_FW_EXIT));
+#endif
+
+#ifdef TC956X_ENABLE_MAC2MAC_BRIDGE
+	dma_free_coherent(priv->device, priv->pbridge_buffsize, priv->pbridge_buffaddr,
+			priv->pbridge_handle);
+#endif
+#endif
+
+	return 0;
+}
+
+#ifdef TC956X_SRIOV_PF
+EXPORT_SYMBOL_GPL(tc956xmac_dvr_remove);
+#elif defined TC956X_SRIOV_VF
+EXPORT_SYMBOL_GPL(tc956xmac_vf_dvr_remove);
+#endif
+
+/**
+ * tc956xmac_suspend - suspend callback
+ * @dev: device pointer
+ * Description: this is the function to suspend the device and it is called
+ * by the platform driver to stop the network queue, release the resources,
+ * program the PMT register (for WoL), clean and release driver resources.
+ */
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_suspend(struct device *dev)
+#elif defined TC956X_SRIOV_VF
+int tc956xmac_vf_suspend(struct device *dev)
+#endif
+{
+	struct net_device *ndev = dev_get_drvdata(dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+#ifndef TC956X_SRIOV_VF
+	struct phy_device *phydev = NULL; /* For cancelling Work queue */
+	int addr = priv->plat->phy_addr;
+#endif
+	KPRINT_INFO("---> %s : Port %d %s", __func__, priv->port_num, priv->dev->name);
+#ifndef TC956X_SRIOV_VF
+	if ((priv->plat->phy_addr != -1) && (priv->mii != NULL))
+		phydev = mdiobus_get_phy(priv->mii, addr);
+#endif
+	if (!ndev)
+		return 0;
+#ifndef TC956X_SRIOV_VF
+	if (!phydev) {
+		DBGPR_FUNC(priv->device, "%s Error : No phy at Addr %d or MDIO Unavailable\n",
+			__func__, addr);
+#ifndef TC956X_WITHOUT_MDIO_WITHOUT_PHY
+		return 0;
+#endif
+
+	}
+#endif
+
+#ifdef TC956X_SRIOV_VF
+	tc956xmac_vf_reset(priv, VF_SUSPEND);
+#endif
+
+#ifndef TC956X_SRIOV_VF
+	/* Disabling EEE for issue in TC9560/62, to be tested for TC956X */
+	if (priv->eee_enabled)
+		tc956xmac_disable_eee_mode(priv);
+
+	//if (priv->wolopts) {
+	//	KPRINT_INFO("%s : Port %d - Phy Speed Down", __func__, priv->port_num);
+	//	phy_speed_down(phydev, true);
+	//}
+#endif
+
+	if (!netif_running(ndev))
+		goto clean_exit;
+
+#ifndef TC956X_SRIOV_VF
+	if (phydev) {
+		/* Cancel all work-queues before suspend start only when net interface is up and running */
+		if (phydev->drv != NULL) {
+			if ((true == priv->plat->phy_interrupt_mode) &&
+			(phydev->drv->config_intr)) {
+				DBGPR_FUNC(priv->device, "%s : (Flush All PHY work-queues)\n", __func__);
+				cancel_work_sync(&priv->emac_phy_work);
+			}
+		}
+	}
+#endif
+	/* Invoke device driver close only when net inteface is up and running. */
+	rtnl_lock();
+	tc956xmac_release(ndev);
+	rtnl_unlock();
+
+clean_exit:
+	/* Detach network device */
+	netif_device_detach(ndev);
+
+	priv->oldlink = false;
+	priv->speed = SPEED_UNKNOWN;
+	priv->oldduplex = DUPLEX_UNKNOWN;
+
+	KPRINT_INFO("<--- %s : Port %d %s", __func__, priv->port_num, priv->dev->name);
+	return 0;
+}
+#ifdef TC956X_SRIOV_PF
+EXPORT_SYMBOL_GPL(tc956xmac_suspend);
+#elif defined TC956X_SRIOV_VF
+EXPORT_SYMBOL_GPL(tc956xmac_vf_suspend);
+#endif
+#ifndef TC956X
+/**
+ * tc956xmac_reset_queues_param - reset queue parameters
+ * @dev: device pointer
+ */
+static void tc956xmac_reset_queues_param(struct tc956xmac_priv *priv)
+{
+	u32 rx_cnt = priv->plat->rx_queues_to_use;
+	u32 tx_cnt = priv->plat->tx_queues_to_use;
+	u32 queue;
+
+	for (queue = 0; queue < rx_cnt; queue++) {
+		struct tc956xmac_rx_queue *rx_q = &priv->rx_queue[queue];
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->rx_ch_in_use[queue] ==
+						TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->rx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		rx_q->cur_rx = 0;
+		rx_q->dirty_rx = 0;
+	}
+
+	for (queue = 0; queue < tx_cnt; queue++) {
+		struct tc956xmac_tx_queue *tx_q = &priv->tx_queue[queue];
+#ifdef TC956X_SRIOV_PF
+		if (priv->plat->tx_ch_in_use[queue] ==
+						TC956X_DISABLE_CHNL)
+			continue;
+#elif defined TC956X_SRIOV_VF
+		/* skip configuring for unallocated channel */
+		if (priv->plat->ch_in_use[queue] == 0)
+			continue;
+#else
+		if (priv->plat->tx_dma_ch_owner[queue] != USE_IN_TC956X_SW)
+			continue;
+#endif
+		tx_q->cur_tx = 0;
+		tx_q->dirty_tx = 0;
+		tx_q->mss = 0;
+	}
+}
+#endif /* TC956X */
+/**
+ * tc956xmac_resume - resume callback
+ * @dev: device pointer
+ * Description: when resume this function is invoked to setup the DMA and CORE
+ * in a usable state.
+ */
+#ifdef TC956X_SRIOV_PF
+int tc956xmac_resume(struct device *dev)
+#elif defined TC956X_SRIOV_VF
+int tc956xmac_vf_resume(struct device *dev)
+#endif
+{
+	struct net_device *ndev = dev_get_drvdata(dev);
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	struct tc956xmac_resources res;
+#ifndef TC956X_SRIOV_VF
+	u32 cm3_reset_status = 0;
+	s32 fw_load_status = 0;
+	void *nrst_reg = NULL, *nclk_reg = NULL;
+	u32 nrst_val = 0, nclk_val = 0;
+#endif /* TC956X_SRIOV_VF */
+
+	KPRINT_INFO("---> %s : Port %d %s", __func__, priv->port_num, priv->dev->name);
+#ifdef TC956X
+	memset(&res, 0, sizeof(res));
+#ifndef TC956X_SRIOV_VF
+	cm3_reset_status = readl((priv->ioaddr + NRSTCTRL0_OFFSET));
+	if ((cm3_reset_status & NRSTCTRL0_MCURST) == NRSTCTRL0_MCURST) {
+		res.tc956x_SFR_pci_base_addr = priv->tc956x_SFR_pci_base_addr;
+		res.addr = priv->ioaddr;
+		res.tc956x_SRAM_pci_base_addr = priv->tc956x_SRAM_pci_base_addr;
+		res.irq = priv->dev->irq;
+		fw_load_status = tc956x_load_firmware(dev, &res);
+		if (fw_load_status < 0) {
+			KPRINT_ERR("Firmware load failed\n");
+			return -EINVAL;
+		}
+	}
+
+	//if (priv->wolopts) {
+	//	KPRINT_INFO("%s : Port %d - Phy Speed Up", __func__, priv->port_num);
+	//	phy_speed_up(phydev);
+	//}
+#elif defined(TC956X_SRIOV_VF)
+	res.tc956x_SFR_pci_base_addr = priv->tc956x_SFR_pci_base_addr;
+	res.addr = priv->ioaddr;
+	res.tc956x_SRAM_pci_base_addr = priv->tc956x_SRAM_pci_base_addr;
+	res.irq = priv->dev->irq;
+#endif
+#endif /* TC956X */
+
+
+#ifndef TC956X
+	/* Reset Parameters. */
+	tc956xmac_reset_queues_param(priv);
+#endif
+	if (!netif_running(ndev))
+		goto clean_exit;
+
+	/* Invoke device driver open */
+	rtnl_lock();
+	tc956xmac_open(ndev);
+	rtnl_unlock();
+
+clean_exit:
+	/* Attach network device */
+	netif_device_attach(ndev);
+
+
+
+#ifdef TC956X_SRIOV_VF
+	tc956xmac_vf_reset(priv, VF_UP);
+#endif  /* TC956X_SRIOV_VF */
+
+#ifndef TC956X_SRIOV_VF
+	/*  Reset eMAC when Port unavailable */
+	if ((priv->plat->phy_addr == -1) || (priv->mii == NULL)) {
+		KPRINT_ERR("%s : Port %d %s : Invalid PHY Address (%d)\n", __func__, priv->port_num, priv->dev->name,
+			priv->plat->phy_addr);
+		/* Set Clocks same as before suspend */
+		if (priv->port_num == 0) {
+			nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET;
+			nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+		} else {
+			nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL1_OFFSET;
+			nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL1_OFFSET;
+		}
+		nrst_val = readl(nrst_reg);
+		nclk_val = readl(nclk_reg);
+		KPRINT_INFO("%s : Port %d %s Rd RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+			nrst_val, nclk_val);
+		/* Assert reset and Disable Clock for EMAC */
+		nrst_val = nrst_val | NRSTCTRL_EMAC_MASK;
+		nclk_val = nclk_val & ~NCLKCTRL_EMAC_MASK;
+		writel(nrst_val, nrst_reg);
+		writel(nclk_val, nclk_reg);
+		KPRINT_INFO("%s : Port %d %s Wr RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+			readl(nrst_reg), readl(nclk_reg));
+	}
+#endif
+	KPRINT_INFO("<--- %s : Port %d %s", __func__, priv->port_num, priv->dev->name);
+	return 0;
+}
+#ifdef TC956X_SRIOV_PF
+EXPORT_SYMBOL_GPL(tc956xmac_resume);
+#elif defined TC956X_SRIOV_VF
+EXPORT_SYMBOL_GPL(tc956xmac_vf_resume);
+#endif
+
+#ifndef TC956X_SRIOV_VF
+/*!
+ * \brief API to save and restore clock and reset during link down and link up.
+ *
+ * \details This fucntion saves the EMAC clock and reset bits before
+ * link down. And restores the same settings after link up.
+ *
+ * \param[in] priv - pointer to device private structure.
+ * \param[in] state - identify LINK DOWN and LINK DOWN operation.
+ *
+ * \return None
+ */
+void tc956xmac_link_change_set_power(struct tc956xmac_priv *priv, enum TC956X_PORT_LINK_CHANGE_STATE state)
+{
+	void *nrst_reg = NULL, *nclk_reg = NULL, *commonrst_reg = NULL, *commonclk_reg = NULL;
+	u32 nrst_val = 0, nclk_val = 0, commonrst_val = 0, commonclk_val = 0;
+	static u32 pm_saved_cmn_linkdown_rst, pm_saved_cmn_linkdown_clk;
+	int ret;
+	bool enable_en = true;
+
+	if (mac_power_save_at_link_down == ENABLE) {
+		KPRINT_INFO("-->%s : Port %d %s", __func__, priv->port_num, priv->dev->name);
+		/* Select register address by port */
+		if (priv->port_num == 0) {
+			nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET;
+			nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+		} else {
+			nrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL1_OFFSET;
+			nclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL1_OFFSET;
+		}
+		if (state == LINK_DOWN) {
+			KPRINT_INFO("%s : Port %d %s Set Power for Link Down", __func__, priv->port_num, priv->dev->name);
+			nrst_val = readl(nrst_reg);
+			nclk_val = readl(nclk_reg);
+			KPRINT_INFO("%s : Port %d %s Rd RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+				nrst_val, nclk_val);
+			/* Save register values before Asserting reset and Clock Disable */
+			priv->pm_saved_linkdown_rst = ((~nrst_val) & NRSTCTRL_LINK_DOWN_SAVE); /* Save Non-Common De-Asserted Resets */
+			priv->pm_saved_linkdown_clk = (nclk_val & NCLKCTRL_LINK_DOWN_SAVE); /* Save Non-Common Enabled Clocks */
+			KPRINT_INFO("%s : Port %d %s priv->pm_saved_linkdown_rst %x priv->pm_saved_linkdown_clk %x", __func__,
+				priv->port_num, priv->dev->name, priv->pm_saved_linkdown_rst, priv->pm_saved_linkdown_clk);
+			/* Assert Reset and Disable Clock */
+			nrst_val = nrst_val | NRSTCTRL_LINK_DOWN;
+			nclk_val = nclk_val & ~NCLKCTRL_LINK_DOWN;
+			KPRINT_INFO("%s : Port %d %s Wr RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+				nrst_val, nclk_val);
+			writel(nrst_val, nrst_reg);
+			writel(nclk_val, nclk_reg);
+			tx956x_pci_shrd_mem[priv->pci_bd].eth_link_down_cnt++; /* Increment counter for Link Down */
+			if (tx956x_pci_shrd_mem[priv->pci_bd].eth_link_down_cnt == TC956X_ALL_MAC_PORT_LINK_DOWN) {
+				/* Save Common register values */
+				commonrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET;
+				commonclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+				commonrst_val = readl(commonrst_reg);
+				commonclk_val = readl(commonclk_reg);
+				KPRINT_INFO("%s : Port %d %s Common Rd RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+					commonrst_val, commonclk_val);
+				pm_saved_cmn_linkdown_rst = ((~commonrst_val) & NRSTCTRL_LINK_DOWN_CMN_SAVE); /* Save Common De-Asserted Resets */
+				pm_saved_cmn_linkdown_clk = commonclk_val & NCLKCTRL_LINK_DOWN_CMN_SAVE; /* Save Common Enabled Clocks */
+				KPRINT_INFO("%s : Port %d %s pm_saved_cmn_linkdown_rst %x pm_saved_cmn_linkdown_clk %x", __func__,
+					priv->port_num, priv->dev->name, pm_saved_cmn_linkdown_rst, pm_saved_cmn_linkdown_clk);
+			}
+			priv->port_link_down = true; /* Set per port flag to true */
+		} else if (state == LINK_UP) {
+			KPRINT_INFO("%s : Port %d %s Set Power for Link Up", __func__, priv->port_num, priv->dev->name);
+			if (tx956x_pci_shrd_mem[priv->pci_bd].eth_link_down_cnt == TC956X_ALL_MAC_PORT_LINK_DOWN) {
+				/* Restore Common register values */
+				KPRINT_INFO("%s : Port %d %s pm_saved_cmn_linkdown_clk %x, pm_saved_cmn_linkdown_rst %x", __func__,
+					priv->port_num, priv->dev->name, pm_saved_cmn_linkdown_clk, pm_saved_cmn_linkdown_rst);
+				/* Enable Common Clock and De-Assert Common Resets */
+				commonclk_reg = priv->tc956x_SFR_pci_base_addr + NCLKCTRL0_OFFSET;
+				commonrst_reg = priv->tc956x_SFR_pci_base_addr + NRSTCTRL0_OFFSET;
+				commonclk_val = readl(commonclk_reg);
+				commonrst_val = readl(commonrst_reg);
+				KPRINT_INFO("%s : Port %d %s Common Rd CLK Reg:%x, RST Reg:%x ", __func__, priv->port_num, priv->dev->name,
+					commonclk_val, commonrst_val);
+				/* Clear Common Clocks only when both port suspends */
+				commonclk_val = (commonclk_val | pm_saved_cmn_linkdown_clk); /* Enable Common Saved Clock */
+				commonrst_val = (commonrst_val & (~pm_saved_cmn_linkdown_rst)); /* De-assert Common Saved Reset */
+				writel(commonclk_val, commonclk_reg);
+				writel(commonrst_val, commonrst_reg);
+				KPRINT_INFO("%s : Port %d %s Common Wr CLK Reg:%x, RST Reg:%x ", __func__, priv->port_num, priv->dev->name,
+					commonclk_val, commonrst_val);
+				KPRINT_INFO("%s : Port %d %s Common Rd CLK Reg:%x, RST Reg:%x", __func__, priv->port_num, priv->dev->name,
+					readl(commonclk_reg), readl(commonrst_reg));
+			}
+			/* Restore register values */
+			KPRINT_INFO("%s : Port %d %s pm_saved_linkdown_clk %x, pm_saved_linkdown_rst %x", __func__,
+				priv->port_num, priv->dev->name, priv->pm_saved_linkdown_clk, priv->pm_saved_linkdown_rst);
+			nclk_val = readl(nclk_reg);
+			nrst_val = readl(nrst_reg);
+			KPRINT_INFO("%s : Port %d %s Rd CLK Reg:%x, RST Reg:%x", __func__, priv->port_num, priv->dev->name,
+				nrst_val, nclk_val);
+			/* Restore values same as before link down */
+			nclk_val = (nclk_val | priv->pm_saved_linkdown_clk); /* Enable Saved Clock */
+			nrst_val = (nrst_val & (~(priv->pm_saved_linkdown_rst))); /* De-assert Saved Reset */
+			writel(nclk_val, nclk_reg);
+			writel(nrst_val, nrst_reg);
+			KPRINT_INFO("%s : Port %d %s Wr CLK Reg:%x, RST Reg:%x ", __func__, priv->port_num, priv->dev->name,
+				nclk_val, nrst_val);
+
+			tx956x_pci_shrd_mem[priv->pci_bd].eth_link_down_cnt--; /* Decrement Counter Only when this api called */
+			priv->port_link_down = false;
+
+			/* Re-Init XPCS module as MACxPONRST is asserted during link-down */
+			ret = tc956x_xpcs_init(priv, priv->xpcsaddr);
+			if (ret < 0)
+				KPRINT_INFO("XPCS initialization error\n");
+
+			/*C37 AN enable*/
+			if ((priv->plat->interface == PHY_INTERFACE_MODE_10GKR) ||
+				(priv->port_interface == ENABLE_2500BASE_X_INTERFACE)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) /* TC956X_Host_Driver-industrial_limited_tested_20241025_V_04-00-01-QPSSW-216.patch */
+				|| (priv->plat->interface == PHY_INTERFACE_MODE_10GBASER)
+#endif
+				)
+				enable_en = false;
+			else if (priv->plat->interface == PHY_INTERFACE_MODE_SGMII) {
+				if (priv->is_sgmii_2p5g == true)
+					enable_en = false;
+				else
+					enable_en = true;
+			} else
+				enable_en = true;
+
+			tc956x_xpcs_ctrl_ane(priv, enable_en);
+		}
+		KPRINT_INFO("%s : Port %d %s Rd RST Reg:%x, CLK Reg:%x", __func__, priv->port_num, priv->dev->name,
+			readl(nrst_reg), readl(nclk_reg));
+		KPRINT_INFO("<--%s : Port %d %s", __func__, priv->port_num,  priv->dev->name);
+	} else {
+		KPRINT_INFO("-->%s : status of Power saving at Link down %d", __func__, mac_power_save_at_link_down);
+	}
+
+}
+#endif
+
+#ifndef MODULE
+static int __init tc956xmac_cmdline_opt(char *str)
+{
+	char *opt;
+
+	if (!str || !*str)
+		return -EINVAL;
+	while ((opt = strsep(&str, ",")) != NULL) {
+		if (!strncmp(opt, "debug:", 6)) {
+			if (kstrtoint(opt + 6, 0, &debug))
+				goto err;
+		} else if (!strncmp(opt, "phyaddr:", 8)) {
+			if (kstrtoint(opt + 8, 0, &phyaddr))
+				goto err;
+		} else if (!strncmp(opt, "buf_sz:", 7)) {
+			if (kstrtoint(opt + 7, 0, &buf_sz))
+				goto err;
+		} else if (!strncmp(opt, "tc:", 3)) {
+			if (kstrtoint(opt + 3, 0, &tc))
+				goto err;
+		} else if (!strncmp(opt, "watchdog:", 9)) {
+			if (kstrtoint(opt + 9, 0, &watchdog))
+				goto err;
+		} else if (!strncmp(opt, "flow_ctrl:", 10)) {
+			if (kstrtoint(opt + 10, 0, &flow_ctrl))
+				goto err;
+		} else if (!strncmp(opt, "pause:", 6)) {
+			if (kstrtoint(opt + 6, 0, &pause))
+				goto err;
+		} else if (!strncmp(opt, "eee_timer:", 10)) {
+			if (kstrtoint(opt + 10, 0, &eee_timer))
+				goto err;
+		} else if (!strncmp(opt, "chain_mode:", 11)) {
+			if (kstrtoint(opt + 11, 0, &chain_mode))
+				goto err;
+		}
+	}
+	return 0;
+
+err:
+	pr_err("%s: ERROR broken module parameter conversion", __func__);
+	return -EINVAL;
+}
+
+__setup("tc956xmaceth=", tc956xmac_cmdline_opt);
+#endif /* MODULE */
+
+#ifdef TC956X
+int tc956xmac_init(void)
+{
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+	/* Create debugfs main directory if it doesn't exist yet */
+	if (!tc956xmac_fs_dir)
+		tc956xmac_fs_dir = debugfs_create_dir(TC956X_RESOURCE_NAME, NULL);
+#endif
+#endif /* TC956X_SRIOV_PF */
+
+	return 0;
+}
+
+void tc956xmac_exit(void)
+{
+#ifdef TC956X_SRIOV_PF
+#ifdef CONFIG_DEBUG_FS
+	debugfs_remove_recursive(tc956xmac_fs_dir);
+#endif
+#endif /* TC956X_SRIOV_PF */
+}
+#endif
+
+#ifndef TC956X
+MODULE_DESCRIPTION("TC956X PCI Express Ethernet Network Driver");
+MODULE_AUTHOR("Toshiba Electronic Devices & Storage Corporation");
+MODULE_LICENSE("GPL v2");
+MODULE_VERSION(DRV_MODULE_VERSION);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_mdio.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_mdio.c
@@ -0,0 +1,867 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_mdio.c
+ *
+ * Copyright (C) 2007-2009  STMicroelectronics Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  05 Jul 2021 : 1. Used Systick handler instead of Driver kernel timer to process transmitted Tx descriptors.
+ *                2. XFI interface support and module parameters for selection of Port0 and Port1 interface
+ *  VERSION     : 01-00-01
+ *  20 Jul 2021 : 1. MAX C22 address changed to 3. Print not corrected for C45 PHY selection
+ *  VERSION     : 01-00-03
+ *  24 Nov 2021 : 1. Restricted MDIO access when no PHY found or MDIO registration fails
+ *                2. Added mdio lock for making mii bus of private member to null to avoid parallel accessing to MDIO bus
+ *  VERSION     : 01-00-23
+ *  03 Dec 2021 : 1. Max C22/C45 PHY address changed to PHY_MAX_ADDR.
+ *  VERSION     : 01-00-29
+ *  27 Dec 2021 : 1. Initialisation of mii private variable.
+ *  VERSION     : 01-00-32
+ *  21 Oct 2022 : 1. MDIO registration failures treated as error -ENODEV
+ *  VERSION     : 01-00-56
+ *
+ *  26 Dec 2023 : 1. Kernel 6.6 Porting changes
+ *  VERSION     : 01-03-59
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *  VERSION     : 04-00
+ */
+
+#include <linux/gpio/consumer.h>
+#include <linux/io.h>
+#include <linux/iopoll.h>
+#include <linux/mii.h>
+#include <linux/of_mdio.h>
+#include <linux/phy.h>
+#include <linux/property.h>
+#include <linux/slab.h>
+
+#include "dwxgmac2.h"
+#include "tc956xmac.h"
+
+#define MII_BUSY 0x00000001
+#define MII_WRITE 0x00000002
+#define MII_DATA_MASK GENMASK(15, 0)
+
+/* GMAC4 defines */
+#define MII_GMAC4_GOC_SHIFT		2
+#define MII_GMAC4_REG_ADDR_SHIFT	16
+#define MII_GMAC4_WRITE		(1 << MII_GMAC4_GOC_SHIFT)
+#define MII_GMAC4_READ			(3 << MII_GMAC4_GOC_SHIFT)
+#define MII_GMAC4_C45E			BIT(1)
+
+/* XGMAC defines */
+#define MII_XGMAC_SADDR			BIT(18)
+#define MII_XGMAC_CMD_SHIFT		16
+#define MII_XGMAC_WRITE			(1 << MII_XGMAC_CMD_SHIFT)
+#define MII_XGMAC_READ			(3 << MII_XGMAC_CMD_SHIFT)
+#define MII_XGMAC_BUSY			BIT(22)
+#define MII_XGMAC_MAX_C22ADDR		3
+#define MII_XGMAC_C22P_MASK		GENMASK(MII_XGMAC_MAX_C22ADDR, 0)
+#define MII_XGMAC_PA_SHIFT		16
+#define MII_XGMAC_DA_SHIFT		21
+#define MII_XGMAC_CRS			BIT(31)
+#define MII_XGMAC_CRS_SHIFT		31
+
+/*Preamble support*/
+#define MII_XGMAC_PSE_SHIFT		30
+#define MII_XGMAC_PSE			BIT(30)
+#define MII_XGMAC_DISABLE_PSE	0xBFFFFFFF
+
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+#define MII_XGMAC_DA_MASK		0x1F
+#define MII_XGMAC_PHYREG_MASK		0xFFFF
+#define MII_AQR113C_PHY_GLOBAL_DEV		0x1E
+#define MII_AQR113C_PHY_GLBL_100M_REG_ADDR		0x31B
+#define MII_AQR113C_PHY_GLBL_1G_REG_ADDR		0x31C
+#define MII_AQR113C_AN_EN_SGMII_MODE_MASK		0xB
+#define MII_AQR113C_AN_DIS_SGMII_DIS		0x0
+#endif /* #ifdef TC956X_MAGIC_PACKET_WOL_CONF */
+
+#define TC956X_MII_ADDR_C45					(1<<30)
+#define TC956X_MII_DEVADDR_C45_SHIFT		16
+#define TC956X_MII_REGADDR_C45_MASK			GENMASK(15, 0)
+
+static int tc956xmac_xgmac2_c45_format(struct tc956xmac_priv *priv, int phyaddr,
+				    int phyreg, u32 *hw_addr)
+{
+	u32 tmp;
+
+	/* Set port as Clause 45 */
+	tmp = readl(priv->ioaddr + XGMAC_MDIO_C22P);
+	tmp &= ~BIT(phyaddr);
+	writel(tmp, priv->ioaddr + XGMAC_MDIO_C22P);
+
+	*hw_addr = (phyaddr << MII_XGMAC_PA_SHIFT) | (phyreg & 0xffff);
+	*hw_addr |= (phyreg >> TC956X_MII_DEVADDR_C45_SHIFT) << MII_XGMAC_DA_SHIFT;
+	return 0;
+}
+
+static int tc956xmac_xgmac2_c22_format(struct tc956xmac_priv *priv, int phyaddr,
+				    int phyreg, u32 *hw_addr)
+{
+	u32 tmp;
+
+	/* Set port as Clause 22 */
+	tmp = readl(priv->ioaddr + XGMAC_MDIO_C22P);
+	tmp |= BIT(phyaddr);
+	writel(tmp, priv->ioaddr + XGMAC_MDIO_C22P);
+
+	*hw_addr = (phyaddr << MII_XGMAC_PA_SHIFT) | (phyreg & 0x1f);
+	return 0;
+}
+
+static int __tc956xmac_xgmac2_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
+{
+	struct net_device *ndev = bus->priv;
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	unsigned int mii_address = priv->hw->mii.addr;
+	unsigned int mii_data = priv->hw->mii.data;
+	u32 tmp, addr, value = MII_XGMAC_BUSY;
+	int ret;
+
+	if (priv->plat->cphy_read)
+		return priv->plat->cphy_read(priv, phyaddr, phyreg);
+
+	/* Wait until any existing MII operation is complete */
+	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
+			       !(tmp & MII_XGMAC_BUSY), /*100*/1, 10000))
+		return -EBUSY;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+	if ((priv->plat->c45_needed == true) && (phyreg < 0x1F)) {
+		if (phyreg == 0)
+			phyreg = (MII_ADDR_C45 | ((PHY_CL45_CTRL_REG_MMD_BANK) << 16) | (PHY_CL45_CTRL_REG_ADDR));
+		else if (phyreg == 1)
+			phyreg = (MII_ADDR_C45 | ((PHY_CL45_STATUS_REG_MMD_BANK) << 16) | (PHY_CL45_STATUS_REG_ADDR));
+		else if (phyreg == 2)
+			phyreg = (MII_ADDR_C45 | ((PHY_CL45_PHYID1_MMD_BANK) << 16) | (PHY_CL45_PHYID1_ADDR));
+		else if (phyreg == 3)
+			phyreg = (MII_ADDR_C45 | ((PHY_CL45_PHYID2_MMD_BANK) << 16) | (PHY_CL45_PHYID2_ADDR));
+		else
+			netdev_dbg(priv->dev, "%s Clause 45 register not defined for PHY register 0x%x\n", __func__, phyreg);
+
+	}
+#endif
+
+	if (phyreg & TC956X_MII_ADDR_C45) {
+		phyreg &= ~TC956X_MII_ADDR_C45;
+
+		ret = tc956xmac_xgmac2_c45_format(priv, phyaddr, phyreg, &addr);
+		if (ret)
+			return ret;
+	} else {
+		ret = tc956xmac_xgmac2_c22_format(priv, phyaddr, phyreg, &addr);
+		if (ret)
+			return ret;
+
+		value |= MII_XGMAC_SADDR;
+	}
+
+	value |= (priv->clk_csr << priv->hw->mii.clk_csr_shift)
+		& priv->hw->mii.clk_csr_mask;
+
+	value &= ~MII_XGMAC_CRS;
+	value |= (priv->plat->clk_crs << MII_XGMAC_CRS_SHIFT);
+
+	value |= MII_XGMAC_READ;
+
+	/*Preamble support*/
+	if (priv->plat->pse == 1)
+		value |= MII_XGMAC_PSE;	/*Set PSE for preamble supperssion*/
+	else
+		value &= MII_XGMAC_DISABLE_PSE; /* Reset PSE for preamble supperssion disable*/
+
+	/* Wait until any existing MII operation is complete */
+	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
+			       !(tmp & MII_XGMAC_BUSY), /*100*/1, 10000))
+		return -EBUSY;
+
+	/* Set the MII address register to read */
+	writel(addr, priv->ioaddr + mii_address);
+	writel(value, priv->ioaddr + mii_data);
+
+	/* Wait until any existing MII operation is complete */
+	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
+			       !(tmp & MII_XGMAC_BUSY), /*100*/10, 10000))
+		return -EBUSY;
+
+	/* Read the data from the MII data register */
+	return readl(priv->ioaddr + mii_data) & GENMASK(15, 0);
+}
+/**
+ * tc956xmac_xgmac2_mdio_read
+ * @bus: points to the mii_bus structure
+ * @phyaddr: MII addr
+ * @phyreg: MII reg
+ * Description: Check whether MDIO bus is registered successfully or not
+ * if registered then access MDIO for Read operation
+ */
+static int tc956xmac_xgmac2_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
+{
+	return bus->priv ?
+		__tc956xmac_xgmac2_mdio_read(bus, phyaddr, phyreg) : -EIO;
+}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+/**
+ * tc956xmac_xgmac2_mdio_read_c45
+ * @bus: points to the mii_bus structure
+ * @phyaddr: MII addr
+ * @devad: device (MMD) address
+ * @phyreg: MII reg
+ * Description: Check whether MDIO bus is registered successfully or not
+ * if registered then access MDIO for C45 Read operation
+ */
+static int tc956xmac_xgmac2_mdio_read_c45(struct mii_bus *bus, int phyaddr,
+				       int devad, int phyreg)
+{
+	return bus->priv ? __tc956xmac_xgmac2_mdio_read(bus, phyaddr,
+		TC956X_MII_ADDR_C45 | (devad << TC956X_MII_DEVADDR_C45_SHIFT) | phyreg) : -EIO;
+}
+#endif /* KERNEL_VERSION(6, 3, 0) */
+
+static int __tc956xmac_xgmac2_mdio_write(struct mii_bus *bus, int phyaddr,
+				    int phyreg, u16 phydata)
+{
+	struct net_device *ndev = bus->priv;
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	unsigned int mii_address = priv->hw->mii.addr;
+	unsigned int mii_data = priv->hw->mii.data;
+	u32 addr, tmp, value = MII_XGMAC_BUSY;
+	int ret;
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	u32 devtype = 0, datareg = 0, dataval = 0;
+#endif
+
+	if (priv->plat->cphy_write)
+		return priv->plat->cphy_write(priv, phyaddr, phyreg, phydata);
+
+	/* Wait until any existing MII operation is complete */
+	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
+			       !(tmp & MII_XGMAC_BUSY), /*100*/1, 10000))
+		return -EBUSY;
+
+	if (phyreg & TC956X_MII_ADDR_C45) {
+		phyreg &= ~TC956X_MII_ADDR_C45;
+
+		ret = tc956xmac_xgmac2_c45_format(priv, phyaddr, phyreg, &addr);
+		if (ret)
+			return ret;
+	} else {
+		ret = tc956xmac_xgmac2_c22_format(priv, phyaddr, phyreg, &addr);
+		if (ret)
+			return ret;
+
+		value |= MII_XGMAC_SADDR;
+	}
+
+	value |= (priv->clk_csr << priv->hw->mii.clk_csr_shift)
+		& priv->hw->mii.clk_csr_mask;
+
+	value &= ~MII_XGMAC_CRS;
+	value |= (priv->plat->clk_crs << MII_XGMAC_CRS_SHIFT);
+
+	value |= phydata;
+	value |= MII_XGMAC_WRITE;
+
+	/*Preamble support*/
+	if (priv->plat->pse == 1)
+		value |= MII_XGMAC_PSE;	/*Set PSE for preamble supperssion*/
+	else
+		value &= MII_XGMAC_DISABLE_PSE; /* Reset PSE for preamble supperssion disable*/
+
+	/* Wait until any existing MII operation is complete */
+	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
+			       !(tmp & MII_XGMAC_BUSY), /*100*/1, 10000))
+		return -EBUSY;
+
+#ifdef TC956X_MAGIC_PACKET_WOL_CONF
+	/* NOTE: Following changes specific to AQR PHY while configuring WOL. */
+	if (priv->plat->interface != PHY_INTERFACE_MODE_SGMII) {
+		/* If we are updating SGMII configurtaion in Non-SGMII interface mode */
+		devtype = ((addr >> MII_XGMAC_DA_SHIFT) & MII_XGMAC_DA_MASK);
+		datareg = (addr & MII_XGMAC_PHYREG_MASK);
+		dataval = (value);
+		if (priv->wol_config_enabled == false) {
+			/* Check for 1e.31b = 0x0b and 1e.31c = 0x0b */
+			if (((devtype == MII_AQR113C_PHY_GLOBAL_DEV) &&
+				(datareg == MII_AQR113C_PHY_GLBL_100M_REG_ADDR) &&
+				((dataval & MII_AQR113C_AN_EN_SGMII_MODE_MASK) == MII_AQR113C_AN_EN_SGMII_MODE_MASK)) ||
+				((devtype == MII_AQR113C_PHY_GLOBAL_DEV) &&
+				(datareg == MII_AQR113C_PHY_GLBL_1G_REG_ADDR) &&
+				((dataval & MII_AQR113C_AN_EN_SGMII_MODE_MASK) == MII_AQR113C_AN_EN_SGMII_MODE_MASK))) {
+				priv->wol_config_enabled = true; /* Enable SGMII SERDES Flag */
+				KPRINT_INFO("%s Port %d %s: Changing flag priv->wol_config_enabled to %d\n", __func__, priv->port_num, priv->dev->name, priv->wol_config_enabled);
+			}
+		} else if (((devtype == MII_AQR113C_PHY_GLOBAL_DEV) && /* Check for 1e.31b = 0x00 and 1e.31c = 0x00 */
+			(datareg == MII_AQR113C_PHY_GLBL_100M_REG_ADDR) &&
+			((dataval & MII_AQR113C_AN_EN_SGMII_MODE_MASK) == MII_AQR113C_AN_DIS_SGMII_DIS)) ||
+			((devtype == MII_AQR113C_PHY_GLOBAL_DEV) &&
+			(datareg == MII_AQR113C_PHY_GLBL_1G_REG_ADDR) &&
+			((dataval & MII_AQR113C_AN_EN_SGMII_MODE_MASK) == MII_AQR113C_AN_DIS_SGMII_DIS))) {
+			priv->wol_config_enabled = false; /* Disable SGMII SERDES Flag */
+			KPRINT_INFO("%s Port %d %s: Changing flag priv->wol_config_enabled to %d\n", __func__, priv->port_num, priv->dev->name, priv->wol_config_enabled);
+		}
+	}
+#endif
+	/* Set the MII address register to write */
+	writel(addr, priv->ioaddr + mii_address);
+	writel(value, priv->ioaddr + mii_data);
+
+	/*Preamble support*/
+	/* TC956X_Host_Driver-industrial_limited_tested_20241030_V_04-00-01-QPSSW-215.patch */
+#ifdef TC956X_SAMP_PHY_AQR_DRV_PSE_ENABLED
+	if ((priv->dev->phydev) && (priv->dev->phydev->priv != NULL)) {
+		if (*((int *)priv->dev->phydev->priv) == 1)
+			priv->plat->pse = 1;
+		else
+			priv->plat->pse = 0;
+	}
+#else
+	priv->plat->pse = 0;
+#endif
+	/* Wait until any existing MII operation is complete */
+	return readl_poll_timeout(priv->ioaddr + mii_data, tmp,
+				  !(tmp & MII_XGMAC_BUSY), /*100*/10, 10000);
+}
+/**
+ * tc956xmac_xgmac2_mdio_write
+ * @bus: points to the mii_bus structure
+ * @phyaddr: MII addr
+ * @phyreg: MII reg
+ * @phydata: data to write into PHY reg
+ * Description: Check whether MDIO bus is registered successfully or not
+ * if registered then access MDIO for write operation
+ */
+static int tc956xmac_xgmac2_mdio_write(struct mii_bus *bus, int phyaddr,
+				    int phyreg, u16 phydata)
+{
+	return bus->priv ?
+		__tc956xmac_xgmac2_mdio_write(bus, phyaddr, phyreg, phydata) : -EIO;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+/**
+ * tc956xmac_xgmac2_mdio_write_c45
+ * @bus: points to the mii_bus structure
+ * @phyaddr: MII addr
+ * @devad: device (MMD) address
+ * @phyreg: MII reg
+ * @phydata: data to write into PHY reg
+ * Description: Check whether MDIO bus is registered successfully or not
+ * if registered then access MDIO for C45 Write operation
+ */
+static int tc956xmac_xgmac2_mdio_write_c45(struct mii_bus *bus, int phyaddr,
+					int devad, int phyreg, u16 phydata)
+{
+	return bus->priv ? __tc956xmac_xgmac2_mdio_write(bus, phyaddr,
+		TC956X_MII_ADDR_C45 | (devad << TC956X_MII_DEVADDR_C45_SHIFT) | phyreg, phydata) : -EIO;
+}
+#endif /* KERNEL_VERSION(6, 3, 0) */
+
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+
+/**
+ * tc956xmac_mdio_read
+ * @bus: points to the mii_bus structure
+ * @phyaddr: MII addr
+ * @phyreg: MII reg
+ * Description: it reads data from the MII register from within the phy device.
+ * For the 7111 GMAC, we must set the bit 0 in the MII address register while
+ * accessing the PHY registers.
+ * Fortunately, it seems this has no drawback for the 7109 MAC.
+ */
+static int tc956xmac_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
+{
+	struct net_device *ndev = bus->priv;
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	unsigned int mii_address = priv->hw->mii.addr;
+	unsigned int mii_data = priv->hw->mii.data;
+	u32 value = MII_BUSY;
+	int data = 0;
+	u32 v;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+	if ((priv->plat->c45_needed == true) && (phyreg < 0x1F)) {
+		if (phyreg == 0)
+			phyreg = (MII_ADDR_C45 | (PHY_CL45_CTRL_REG_MMD_BANK << 16) | PHY_CL45_CTRL_REG_ADDR);
+		else if (phyreg == 1)
+			phyreg = (MII_ADDR_C45 | (PHY_CL45_STATUS_REG_MMD_BANK << 16) | PHY_CL45_STATUS_REG_ADDR);
+		else if (phyreg == 2)
+			phyreg = (MII_ADDR_C45 | (PHY_CL45_PHYID1_MMD_BANK << 16) | PHY_CL45_PHYID1_ADDR);
+		else if (phyreg == 3)
+			phyreg = (MII_ADDR_C45 | (PHY_CL45_PHYID2_MMD_BANK << 16) | PHY_CL45_PHYID2_ADDR);
+		else
+			netdev_dbg(priv->dev, "%s Clause 45 register not defined for PHY register 0x%x\n", __func__, phyreg);
+
+	}
+#endif
+
+	value |= (phyaddr << priv->hw->mii.addr_shift)
+		& priv->hw->mii.addr_mask;
+	value |= (phyreg << priv->hw->mii.reg_shift) & priv->hw->mii.reg_mask;
+	value |= (priv->clk_csr << priv->hw->mii.clk_csr_shift)
+		& priv->hw->mii.clk_csr_mask;
+	if (priv->plat->has_gmac4) {
+		value |= MII_GMAC4_READ;
+		if (phyreg & TC956X_MII_ADDR_C45) {
+			value |= MII_GMAC4_C45E;
+			value &= ~priv->hw->mii.reg_mask;
+			value |= ((phyreg >> TC956X_MII_DEVADDR_C45_SHIFT) <<
+			       priv->hw->mii.reg_shift) &
+			       priv->hw->mii.reg_mask;
+
+			data |= (phyreg & TC956X_MII_REGADDR_C45_MASK) <<
+				MII_GMAC4_REG_ADDR_SHIFT;
+		}
+	}
+
+	if (readl_poll_timeout(priv->ioaddr + mii_address, v, !(v & MII_BUSY),
+			       100, 10000))
+		return -EBUSY;
+
+	writel(data, priv->ioaddr + mii_data);
+	writel(value, priv->ioaddr + mii_address);
+
+	if (readl_poll_timeout(priv->ioaddr + mii_address, v, !(v & MII_BUSY),
+			       100, 10000))
+		return -EBUSY;
+
+	/* Read the data from the MII data register */
+	data = (int)readl(priv->ioaddr + mii_data) & MII_DATA_MASK;
+
+	return data;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+/**
+ * tc956xmac_mdio_read_c45
+ * @bus: points to the mii_bus structure
+ * @phyaddr: MII addr
+ * @devad: device (MMD) address
+ * @phyreg: MII reg
+ * Description: it reads data from the MII register from within the phy device.
+ * For the 7111 GMAC, we must set the bit 0 in the MII address register while
+ * accessing the PHY registers.
+ * Fortunately, it seems this has no drawback for the 7109 MAC.
+ */
+static int tc956xmac_mdio_read_c45(struct mii_bus *bus, int phyaddr, int devad,
+				int phyreg)
+{
+	return tc956xmac_mdio_read(bus, phyaddr,
+		TC956X_MII_ADDR_C45 | (devad << TC956X_MII_DEVADDR_C45_SHIFT) | phyreg);
+}
+#endif /* KERNEL_VERSION(6, 3, 0) */
+
+/**
+ * tc956xmac_mdio_write
+ * @bus: points to the mii_bus structure
+ * @phyaddr: MII addr
+ * @phyreg: MII reg
+ * @phydata: phy data
+ * Description: it writes the data into the MII register from within the device.
+ */
+static int tc956xmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
+			     u16 phydata)
+{
+	struct net_device *ndev = bus->priv;
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	unsigned int mii_address = priv->hw->mii.addr;
+	unsigned int mii_data = priv->hw->mii.data;
+	u32 value = MII_BUSY;
+	int data = phydata;
+	u32 v;
+
+	value |= (phyaddr << priv->hw->mii.addr_shift)
+		& priv->hw->mii.addr_mask;
+	value |= (phyreg << priv->hw->mii.reg_shift) & priv->hw->mii.reg_mask;
+
+	value |= (priv->clk_csr << priv->hw->mii.clk_csr_shift)
+		& priv->hw->mii.clk_csr_mask;
+	if (priv->plat->has_gmac4) {
+		value |= MII_GMAC4_WRITE;
+		if (phyreg & TC956X_MII_ADDR_C45) {
+			value |= MII_GMAC4_C45E;
+			value &= ~priv->hw->mii.reg_mask;
+			value |= ((phyreg >> TC956X_MII_DEVADDR_C45_SHIFT) <<
+			       priv->hw->mii.reg_shift) &
+			       priv->hw->mii.reg_mask;
+
+			data |= (phyreg & TC956X_MII_REGADDR_C45_MASK) <<
+				MII_GMAC4_REG_ADDR_SHIFT;
+		}
+	} else {
+		value |= MII_WRITE;
+	}
+
+	/* Wait until any existing MII operation is complete */
+	if (readl_poll_timeout(priv->ioaddr + mii_address, v, !(v & MII_BUSY),
+			       100, 10000))
+		return -EBUSY;
+
+	/* Set the MII address register to write */
+	writel(data, priv->ioaddr + mii_data);
+	writel(value, priv->ioaddr + mii_address);
+
+	/* Wait until any existing MII operation is complete */
+	return readl_poll_timeout(priv->ioaddr + mii_address, v, !(v & MII_BUSY),
+				  100, 10000);
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+/**
+ * tc956xmac_mdio_write_c45
+ * @bus: points to the mii_bus structure
+ * @phyaddr: MII addr
+ * @phyreg: MII reg
+ * @devad: device address to read
+ * @phydata: phy data
+ * Description: it writes the data into the MII register from within the device.
+ */
+static int tc956xmac_mdio_write_c45(struct mii_bus *bus, int phyaddr,
+				 int devad, int phyreg, u16 phydata)
+{
+	return tc956xmac_mdio_write(bus, phyaddr,
+		TC956X_MII_ADDR_C45 | (devad << TC956X_MII_DEVADDR_C45_SHIFT) | phyreg, phydata);
+}
+#endif /* KERNEL_VERSION(6, 3, 0) */
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+/**
+ * tc956xmac_mdio_reset
+ * @bus: points to the mii_bus structure
+ * Description: reset the MII bus
+ */
+int tc956xmac_mdio_reset(struct mii_bus *bus)
+{
+#if IS_ENABLED(CONFIG_TC956XMAC_PLATFORM)
+	struct net_device *ndev = bus->priv;
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	unsigned int mii_address = priv->hw->mii.addr;
+
+#ifdef CONFIG_OF
+	if (priv->device->of_node) {
+		struct gpio_desc *reset_gpio;
+		u32 delays[3] = { 0, 0, 0 };
+
+		reset_gpio = devm_gpiod_get_optional(priv->device,
+						     "snps,reset",
+						     GPIOD_OUT_LOW);
+		if (IS_ERR(reset_gpio))
+			return PTR_ERR(reset_gpio);
+
+		device_property_read_u32_array(priv->device,
+					       "snps,reset-delays-us",
+					       delays, ARRAY_SIZE(delays));
+
+		if (delays[0])
+			msleep(DIV_ROUND_UP(delays[0], 1000));
+
+		gpiod_set_value_cansleep(reset_gpio, 1);
+		if (delays[1])
+			msleep(DIV_ROUND_UP(delays[1], 1000));
+
+		gpiod_set_value_cansleep(reset_gpio, 0);
+		if (delays[2])
+			msleep(DIV_ROUND_UP(delays[2], 1000));
+	}
+#endif
+
+	/* This is a workaround for problems with the STE101P PHY.
+	 * It doesn't complete its reset until at least one clock cycle
+	 * on MDC, so perform a dummy mdio read. To be updated for GMAC4
+	 * if needed.
+	 */
+	if (!priv->plat->has_gmac4)
+		writel(0, priv->ioaddr + mii_address);
+#endif
+	return 0;
+}
+
+/**
+ * tc956xmac_mdio_register
+ * @ndev: net device structure
+ * Description: it registers the MII bus
+ */
+int tc956xmac_mdio_register(struct net_device *ndev)
+{
+	int err = 0;
+	struct mii_bus *new_bus;
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+	struct tc956xmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
+	struct device_node *mdio_node = priv->plat->mdio_node;
+	struct device *dev = ndev->dev.parent;
+	int addr, found, start_addr;
+
+	if (!mdio_bus_data)
+		return 0;
+
+	new_bus = mdiobus_alloc();
+	if (!new_bus)
+		return -ENOMEM;
+
+	if (mdio_bus_data->irqs)
+		memcpy(new_bus->irq, mdio_bus_data->irqs, sizeof(new_bus->irq));
+
+	new_bus->name = "tc956xmac";
+
+	if (priv->plat->has_xgmac) {
+		new_bus->read = &tc956xmac_xgmac2_mdio_read;
+		new_bus->write = &tc956xmac_xgmac2_mdio_write;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+		new_bus->read_c45 = &tc956xmac_xgmac2_mdio_read_c45;
+		new_bus->write_c45 = &tc956xmac_xgmac2_mdio_write_c45;
+#endif
+#ifndef TC956X
+		/* Check if DT specified an unsupported phy addr */
+		if (priv->plat->phy_addr > MII_XGMAC_MAX_C22ADDR)
+			dev_err(dev, "Unsupported phy_addr (max=%d)\n",
+					MII_XGMAC_MAX_C22ADDR);
+#endif
+	}
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	else {
+		new_bus->read = &tc956xmac_mdio_read;
+		new_bus->write = &tc956xmac_mdio_write;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+		if (priv->plat->has_gmac4) {
+			new_bus->read_c45 = &tc956xmac_mdio_read_c45;
+			new_bus->write_c45 = &tc956xmac_mdio_write_c45;
+		}
+#endif
+	}
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+
+	if (mdio_bus_data->needs_reset)
+		new_bus->reset = &tc956xmac_mdio_reset;
+
+	snprintf(new_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+		 new_bus->name, priv->plat->bus_id);
+
+	new_bus->priv = ndev;
+	new_bus->phy_mask = mdio_bus_data->phy_mask;
+	new_bus->parent = priv->device;
+#ifdef TC956X
+	err = mdiobus_register(new_bus);
+#else
+	err = of_mdiobus_register(new_bus, mdio_node);
+#endif
+	if (err != 0) {
+		err = -ENODEV;
+		dev_err(dev, "Cannot register the MDIO bus\n");
+		goto bus_register_fail;
+	}
+
+	/* Looks like we need a dummy read for XGMAC only and C45 PHYs */
+	if (priv->plat->has_xgmac)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+		tc956xmac_xgmac2_mdio_read(new_bus, 0, MII_ADDR_C45);
+#else
+		tc956xmac_xgmac2_mdio_read_c45(new_bus, 0, 0, 0);
+#endif
+
+#ifndef TC956X
+	if (priv->plat->phy_node || mdio_node || priv->plat->has_xgmac)
+		goto bus_register_done;
+#endif
+	found = 0;
+
+	/* Select the PHY address to be detected as specififed by user */
+	start_addr = priv->plat->start_phy_addr;
+
+	for (addr = start_addr; addr < PHY_MAX_ADDR; addr++) {
+
+#ifdef TC956X
+		int phy_reg_read;
+
+		if (priv->plat->c45_needed == true)
+			break;
+
+		/* For C22 based PHYs, check for Status to detect PHY */
+#ifdef TC956X
+		phy_reg_read = tc956xmac_xgmac2_mdio_read(new_bus, addr, MII_BMSR);
+#endif
+
+		if (phy_reg_read != -EBUSY && phy_reg_read != -ENODEV) {
+			if (phy_reg_read != 0x0000 && phy_reg_read != 0xffff) {
+				if (priv->plat->c45_needed == true)
+					NMSGPR_INFO(priv->device,
+					    "TC956X: [1] Phy detected C45 at ID/ADDR %d\n", addr);
+				else
+					NMSGPR_INFO(priv->device,
+					    "TC956X: [1] Phy detected C22 at ID/ADDR %d\n", addr);
+#else
+		struct phy_device *phydev = mdiobus_get_phy(new_bus, addr);
+
+		if (!phydev)
+			continue;
+#endif
+			/*
+			 * If an IRQ was provided to be assigned after
+			 * the bus probe, do it here.
+			 */
+			if (!mdio_bus_data->irqs &&
+			    (mdio_bus_data->probed_phy_irq > 0)) {
+				new_bus->irq[addr] = mdio_bus_data->probed_phy_irq;
+#ifndef TC956X
+				phydev->irq = mdio_bus_data->probed_phy_irq;
+#endif
+			}
+
+			/*
+			 * If we're going to bind the MAC to this PHY bus,
+			 * and no PHY number was provided to the MAC,
+			 * use the one probed here.
+			 */
+			if (priv->plat->phy_addr == -1)
+				priv->plat->phy_addr = addr;
+#ifndef TC956X
+			phy_attached_info(phydev);
+#endif
+			found = 1;
+			break;
+#ifdef TC956X
+			}
+		} else {
+			NMSGPR_ALERT(priv->device, "TC956X: Error reading the phy register"\
+			" MII_BMSR for phy ID/ADDR %d\n", addr);
+		}
+#endif
+	}
+	/* If C22 PHY is not found, probe for C45 based PHY*/
+	if (!found) {
+		for (addr = start_addr; addr < PHY_MAX_ADDR; addr++) {
+
+#ifdef TC956X
+			int phy_reg_read1, phy_reg_read2, phy_id;
+
+			/* For C45 based PHYs, check for PHY ID to detect PHY */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+			phy_reg_read1 = tc956xmac_xgmac2_mdio_read(new_bus, addr,
+								((PHY_CL45_PHYID1_REG) | MII_ADDR_C45));
+			phy_reg_read2 = tc956xmac_xgmac2_mdio_read(new_bus, addr,
+								((PHY_CL45_PHYID2_REG) | MII_ADDR_C45));
+#else
+			phy_reg_read1 = tc956xmac_xgmac2_mdio_read_c45(new_bus, addr,
+								PHY_CL45_PHYID1_MMD_BANK, PHY_CL45_PHYID1_ADDR);
+			phy_reg_read2 = tc956xmac_xgmac2_mdio_read_c45(new_bus, addr,
+								PHY_CL45_PHYID2_MMD_BANK, PHY_CL45_PHYID2_ADDR);
+#endif
+
+			if (phy_reg_read1 != -EBUSY && phy_reg_read2 != -EBUSY) {
+				phy_id = ((phy_reg_read1 << 16) | phy_reg_read2);
+				if (phy_id != 0x00000000 && phy_id != 0xffffffff) {
+					NMSGPR_INFO(priv->device,
+							"TC956X: [2] Phy detected C45 at ID/ADDR %d\n", addr);
+
+#else
+					struct phy_device *phydev = mdiobus_get_phy(new_bus, addr);
+
+					if (!phydev)
+						continue;
+#endif
+					/*
+					 * If an IRQ was provided to be assigned after
+					 * the bus probe, do it here.
+					 */
+					if (!mdio_bus_data->irqs &&
+					    (mdio_bus_data->probed_phy_irq > 0)) {
+						new_bus->irq[addr] = mdio_bus_data->probed_phy_irq;
+#ifndef TC956X
+						phydev->irq = mdio_bus_data->probed_phy_irq;
+#endif
+					}
+
+					/*
+					 * If we're going to bind the MAC to this PHY bus,
+					 * and no PHY number was provided to the MAC,
+					 * use the one probed here.
+					 */
+					if (priv->plat->phy_addr == -1)
+						priv->plat->phy_addr = addr;
+
+#ifndef TC956X
+					phy_attached_info(phydev);
+#endif
+					found = 1;
+					break;
+#ifdef TC956X
+				}
+			} else {
+				NMSGPR_ALERT(priv->device, "TC956X: Error reading the phy register"\
+				    " MII_BMSR for phy ID/ADDR %d\n", addr);
+			}
+#endif
+		}
+	}
+
+	if (!found && !mdio_node) {
+		dev_warn(dev, "No PHY found\n");
+		goto bus_no_phy_found;
+	}
+#ifndef TC956X
+bus_register_done:
+#endif
+	priv->mii = new_bus;
+
+	return 0;
+bus_no_phy_found:
+	err = -ENODEV;
+	mdiobus_unregister(new_bus);
+bus_register_fail:
+	/* Set bus->priv to NULL, so that any future calls to bus read/write can avoid bus access.*/
+	mutex_lock(&new_bus->mdio_lock);
+	new_bus->priv = NULL;
+	mutex_unlock(&new_bus->mdio_lock);
+
+	mdiobus_free(new_bus);
+	priv->mii = NULL;
+	return err;
+}
+
+/**
+ * tc956xmac_mdio_unregister
+ * @ndev: net device structure
+ * Description: it unregisters the MII bus
+ */
+int tc956xmac_mdio_unregister(struct net_device *ndev)
+{
+	struct tc956xmac_priv *priv = netdev_priv(ndev);
+
+	if (!priv->mii)
+		return 0;
+
+	mdiobus_unregister(priv->mii);
+	mutex_lock(&priv->mii->mdio_lock);
+	priv->mii->priv = NULL;
+	mutex_unlock(&priv->mii->mdio_lock);
+	mdiobus_free(priv->mii);
+	priv->mii = NULL;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_pcs.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_pcs.h
@@ -0,0 +1,181 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_pcs.h
+ *
+ * Copyright (C) 2016 STMicroelectronics (R&D) Limited
+ * Copyright (C) 2021 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ */
+
+#ifndef __TC956XMAC_PCS_H__
+#define __TC956XMAC_PCS_H__
+
+#include <linux/slab.h>
+#include <linux/io.h>
+#include "common.h"
+
+/* PCS registers (AN/TBI/SGMII/RGMII) offsets */
+#define GMAC_AN_CTRL(x)		(x)		/* AN control */
+#define GMAC_AN_STATUS(x)	(x + 0x4)	/* AN status */
+#define GMAC_ANE_ADV(x)		(x + 0x8)	/* ANE Advertisement */
+#define GMAC_ANE_LPA(x)		(x + 0xc)	/* ANE link partener ability */
+#define GMAC_ANE_EXP(x)		(x + 0x10)	/* ANE expansion */
+#define GMAC_TBI(x)		(x + 0x14)	/* TBI extend status */
+
+/* AN Configuration defines */
+#define GMAC_AN_CTRL_RAN	BIT(9)	/* Restart Auto-Negotiation */
+#define GMAC_AN_CTRL_ANE	BIT(12)	/* Auto-Negotiation Enable */
+#define GMAC_AN_CTRL_ELE	BIT(14)	/* External Loopback Enable */
+#define GMAC_AN_CTRL_ECD	BIT(16)	/* Enable Comma Detect */
+#define GMAC_AN_CTRL_LR		BIT(17)	/* Lock to Reference */
+#define GMAC_AN_CTRL_SGMRAL	BIT(18)	/* SGMII RAL Control */
+
+/* AN Status defines */
+#define GMAC_AN_STATUS_LS	BIT(2)	/* Link Status 0:down 1:up */
+#define GMAC_AN_STATUS_ANA	BIT(3)	/* Auto-Negotiation Ability */
+#define GMAC_AN_STATUS_ANC	BIT(5)	/* Auto-Negotiation Complete */
+#define GMAC_AN_STATUS_ES	BIT(8)	/* Extended Status */
+
+/* ADV and LPA defines */
+#define GMAC_ANE_FD		BIT(5)
+#define GMAC_ANE_HD		BIT(6)
+#define GMAC_ANE_PSE		GENMASK(8, 7)
+#define GMAC_ANE_PSE_SHIFT	7
+#define GMAC_ANE_RFE		GENMASK(13, 12)
+#define GMAC_ANE_RFE_SHIFT	12
+#define GMAC_ANE_ACK		BIT(14)
+
+/**
+ * dwmac_pcs_isr - TBI, RTBI, or SGMII PHY ISR
+ * @ioaddr: IO registers pointer
+ * @reg: Base address of the AN Control Register.
+ * @intr_status: GMAC core interrupt status
+ * @x: pointer to log these events as stats
+ * Description: it is the ISR for PCS events: Auto-Negotiation Completed and
+ * Link status.
+ */
+static inline void dwmac_pcs_isr(void __iomem *ioaddr, u32 reg,
+				 unsigned int intr_status,
+				 struct tc956xmac_extra_stats *x)
+{
+	u32 val = readl(ioaddr + GMAC_AN_STATUS(reg));
+
+	if (intr_status & PCS_ANE_IRQ) {
+		x->irq_pcs_ane_n++;
+		if (val & GMAC_AN_STATUS_ANC)
+			pr_info("tc956xmac_pcs: ANE process completed\n");
+	}
+
+	if (intr_status & PCS_LINK_IRQ) {
+		x->irq_pcs_link_n++;
+		if (val & GMAC_AN_STATUS_LS)
+			pr_info("tc956xmac_pcs: Link Up\n");
+		else
+			pr_info("tc956xmac_pcs: Link Down\n");
+	}
+}
+
+/**
+ * dwmac_rane - To restart ANE
+ * @ioaddr: IO registers pointer
+ * @reg: Base address of the AN Control Register.
+ * @restart: to restart ANE
+ * Description: this is to just restart the Auto-Negotiation.
+ */
+static inline void dwmac_rane(void __iomem *ioaddr, u32 reg, bool restart)
+{
+	u32 value = readl(ioaddr + GMAC_AN_CTRL(reg));
+
+	if (restart)
+		value |= GMAC_AN_CTRL_RAN;
+
+	writel(value, ioaddr + GMAC_AN_CTRL(reg));
+}
+
+/**
+ * dwmac_ctrl_ane - To program the AN Control Register.
+ * @ioaddr: IO registers pointer
+ * @reg: Base address of the AN Control Register.
+ * @ane: to enable the auto-negotiation
+ * @srgmi_ral: to manage MAC-2-MAC SGMII connections.
+ * @loopback: to cause the PHY to loopback tx data into rx path.
+ * Description: this is the main function to configure the AN control register
+ * and init the ANE, select loopback (usually for debugging purpose) and
+ * configure SGMII RAL.
+ */
+static inline void dwmac_ctrl_ane(void __iomem *ioaddr, u32 reg, bool ane,
+				  bool srgmi_ral, bool loopback)
+{
+	u32 value = readl(ioaddr + GMAC_AN_CTRL(reg));
+
+	/* Enable and restart the Auto-Negotiation */
+	if (ane)
+		value |= GMAC_AN_CTRL_ANE | GMAC_AN_CTRL_RAN;
+
+	/* In case of MAC-2-MAC connection, block is configured to operate
+	 * according to MAC conf register.
+	 */
+	if (srgmi_ral)
+		value |= GMAC_AN_CTRL_SGMRAL;
+
+	if (loopback)
+		value |= GMAC_AN_CTRL_ELE;
+
+	writel(value, ioaddr + GMAC_AN_CTRL(reg));
+}
+
+/**
+ * dwmac_get_adv_lp - Get ADV and LP cap
+ * @ioaddr: IO registers pointer
+ * @reg: Base address of the AN Control Register.
+ * @adv_lp: structure to store the adv,lp status
+ * Description: this is to expose the ANE advertisement and Link partner ability
+ * status to ethtool support.
+ */
+static inline void dwmac_get_adv_lp(void __iomem *ioaddr, u32 reg,
+				    struct rgmii_adv *adv_lp)
+{
+	u32 value = readl(ioaddr + GMAC_ANE_ADV(reg));
+
+	if (value & GMAC_ANE_FD)
+		adv_lp->duplex = DUPLEX_FULL;
+	if (value & GMAC_ANE_HD)
+		adv_lp->duplex |= DUPLEX_HALF;
+
+	adv_lp->pause = (value & GMAC_ANE_PSE) >> GMAC_ANE_PSE_SHIFT;
+
+	value = readl(ioaddr + GMAC_ANE_LPA(reg));
+
+	if (value & GMAC_ANE_FD)
+		adv_lp->lp_duplex = DUPLEX_FULL;
+	if (value & GMAC_ANE_HD)
+		adv_lp->lp_duplex = DUPLEX_HALF;
+
+	adv_lp->lp_pause = (value & GMAC_ANE_PSE) >> GMAC_ANE_PSE_SHIFT;
+}
+#endif /* __TC956XMAC_PCS_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_ptp.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_ptp.c
@@ -0,0 +1,351 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_ptp.c
+ *
+ * Copyright (C) 2013  Vayavya Labs Pvt Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Vayavya Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  26 Dec 2023 : 1. Kernel 6.6 Porting changes
+ *  VERSION     : 01-03-59
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *  VERSION     : 04-00
+ */
+
+#include "tc956xmac.h"
+#include "tc956xmac_ptp.h"
+#include "dwxgmac2.h"
+#include "common.h"
+
+/**
+ * tc956xmac_adjust_freq
+ *
+ * @ptp: pointer to ptp_clock_info structure
+ * @ppb: desired period change in parts ber billion
+ *
+ * Description: this function will adjust the frequency of hardware clock.
+ */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 2, 0)
+static int tc956xmac_adjust_freq(struct ptp_clock_info *ptp, s32 ppb)
+#else
+static int tc956xmac_adjust_freq(struct ptp_clock_info *ptp, long scaled_ppm)
+#endif
+{
+#ifdef TC956X_SRIOV_PF
+	struct tc956xmac_priv *priv =
+	    container_of(ptp, struct tc956xmac_priv, ptp_clock_ops);
+	unsigned long flags;
+	u32 addend;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 2, 0)
+	u32 diff;
+	int neg_adj = 0;
+	u64 adj;
+
+	if (ppb < 0) {
+		neg_adj = 1;
+		ppb = -ppb;
+	}
+
+	addend = priv->default_addend;
+	adj = addend;
+	adj *= ppb;
+	diff = div_u64(adj, 1000000000ULL);
+	addend = neg_adj ? (addend - diff) : (addend + diff);
+#else
+	addend = adjust_by_scaled_ppm(priv->default_addend, scaled_ppm);
+#endif
+	spin_lock_irqsave(&priv->ptp_lock, flags);
+	tc956xmac_config_addend(priv, priv->ptpaddr, addend);
+	spin_unlock_irqrestore(&priv->ptp_lock, flags);
+
+	return 0;
+#else
+	return -ENOTSUPP;
+#endif
+}
+
+/**
+ * tc956xmac_adjust_time
+ *
+ * @ptp: pointer to ptp_clock_info structure
+ * @delta: desired change in nanoseconds
+ *
+ * Description: this function will shift/adjust the hardware clock time.
+ */
+static int tc956xmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)
+{
+#ifdef TC956X_SRIOV_PF
+	struct tc956xmac_priv *priv =
+	    container_of(ptp, struct tc956xmac_priv, ptp_clock_ops);
+	unsigned long flags;
+	u32 sec, nsec;
+	u32 quotient, reminder;
+	int neg_adj = 0;
+	bool xmac;
+
+	xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
+
+	if (delta < 0) {
+		neg_adj = 1;
+		delta = -delta;
+	}
+
+	quotient = div_u64_rem(delta, 1000000000ULL, &reminder);
+	sec = quotient;
+	nsec = reminder;
+
+	spin_lock_irqsave(&priv->ptp_lock, flags);
+	tc956xmac_adjust_systime(priv, priv->ptpaddr, sec, nsec, neg_adj, xmac);
+	spin_unlock_irqrestore(&priv->ptp_lock, flags);
+
+	return 0;
+#else
+	return -ENOTSUPP;
+#endif
+}
+
+/**
+ * tc956xmac_get_time
+ *
+ * @ptp: pointer to ptp_clock_info structure
+ * @ts: pointer to hold time/result
+ *
+ * Description: this function will read the current time from the
+ * hardware clock and store it in @ts.
+ */
+static int tc956xmac_get_time(struct ptp_clock_info *ptp, struct timespec64 *ts)
+{
+	struct tc956xmac_priv *priv =
+	    container_of(ptp, struct tc956xmac_priv, ptp_clock_ops);
+	unsigned long flags;
+	u64 ns = 0;
+
+	spin_lock_irqsave(&priv->ptp_lock, flags);
+	tc956xmac_get_systime(priv, priv->ptpaddr, &ns);
+	spin_unlock_irqrestore(&priv->ptp_lock, flags);
+
+	*ts = ns_to_timespec64(ns);
+
+	return 0;
+}
+
+/**
+ * tc956xmac_set_time
+ *
+ * @ptp: pointer to ptp_clock_info structure
+ * @ts: time value to set
+ *
+ * Description: this function will set the current time on the
+ * hardware clock.
+ */
+static int tc956xmac_set_time(struct ptp_clock_info *ptp,
+			   const struct timespec64 *ts)
+{
+#ifdef TC956X_SRIOV_PF
+	struct tc956xmac_priv *priv =
+	    container_of(ptp, struct tc956xmac_priv, ptp_clock_ops);
+	unsigned long flags;
+
+	spin_lock_irqsave(&priv->ptp_lock, flags);
+	tc956xmac_init_systime(priv, priv->ptpaddr, ts->tv_sec, ts->tv_nsec);
+	spin_unlock_irqrestore(&priv->ptp_lock, flags);
+
+	return 0;
+#else
+	return -ENOTSUPP;
+#endif
+}
+
+
+static int tc956xmac_enable(struct ptp_clock_info *ptp,
+			 struct ptp_clock_request *rq, int on)
+{
+	int ret = -EOPNOTSUPP;
+
+#ifdef TC956X_SRIOV_PF
+	struct tc956xmac_priv *priv =
+	    container_of(ptp, struct tc956xmac_priv, ptp_clock_ops);
+	struct tc956xmac_pps_cfg *cfg;
+	unsigned long flags;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+	u32 aux_cntrl_en, val, msi_out_val;
+#endif
+
+	switch (rq->type) {
+	case PTP_CLK_REQ_PEROUT:
+		/* Reject requests with unsupported flags */
+		if (rq->perout.flags)
+			return -EOPNOTSUPP;
+
+		cfg = &priv->pps[rq->perout.index];
+
+		cfg->start.tv_sec = rq->perout.start.sec;
+		cfg->start.tv_nsec = rq->perout.start.nsec;
+		cfg->period.tv_sec = rq->perout.period.sec;
+		cfg->period.tv_nsec = rq->perout.period.nsec;
+
+		spin_lock_irqsave(&priv->ptp_lock, flags);
+		ret = tc956xmac_flex_pps_config(priv, priv->ioaddr,
+					     rq->perout.index, cfg, on,
+					     priv->sub_second_inc,
+					     priv->systime_flags);
+		spin_unlock_irqrestore(&priv->ptp_lock, flags);
+		break;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+/*Added Support for external timestamp event */
+	case PTP_CLK_REQ_EXTTS:
+		aux_cntrl_en = readl(priv->ioaddr + XGMAC_MAC_AUX_CTRL);
+		if (on)
+			aux_cntrl_en |= XGMAC_ATSEN0;
+		else
+			aux_cntrl_en &= ~XGMAC_ATSEN0;
+
+		/* Auxiliary timestamp FIFO clear */
+		aux_cntrl_en |= XGMAC_ATSFC;
+		writel(aux_cntrl_en, priv->ioaddr + XGMAC_MAC_AUX_CTRL);
+		msi_out_val = readl(priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->port_num, 0));
+		if (on) {
+			if (priv->port_num == RM_PF0_ID) {
+				val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+				val &= ~TRIG00_MASK;
+				val |= (0x1 << TRIG00_SHIFT);	/* set bit 4 GPIO1 TRIG00 */
+				writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+			}
+			if (priv->port_num == RM_PF1_ID) {
+				val = readl(priv->ioaddr + NFUNCEN4_OFFSET);
+				val &= ~TRIG10_MASK;
+				val |= (0x1 << TRIG10_SHIFT);	/* set bit 12 GPIO3 TRIG10 */
+				writel(val, priv->ioaddr + NFUNCEN4_OFFSET);
+			}
+
+			spin_lock_irqsave(&priv->ptp_lock, flags);
+			msi_out_val |= (0x1 << TC956X_MSI_OUT_INTR_EVENT);
+			/* Enable the Trig interrupt */
+			val = readl(priv->ioaddr + XGMAC_INT_EN);
+			val |= (0x1 << TSIE_SHIFT); /* set bit 12req=50000000Hz */
+			writel(val, priv->ioaddr + XGMAC_INT_EN);
+			spin_unlock_irqrestore(&priv->ptp_lock, flags);
+			netdev_dbg(priv->dev, "Auxiliary Snapshot enabled.\n");
+		} else {
+			msi_out_val &= ~(0x1 << TC956X_MSI_OUT_INTR_EVENT);
+			netdev_dbg(priv->dev, "Auxiliary Snapshot disabled.\n");
+		}
+		writel(msi_out_val, priv->ioaddr + TC956X_MSI_OUT_EN_OFFSET(priv->port_num, 0));
+		/* wait for auxts fifo clear to finish */
+		ret = readl_poll_timeout(priv->ioaddr + XGMAC_MAC_AUX_CTRL, aux_cntrl_en,
+				 !(aux_cntrl_en & XGMAC_ATSFC),
+				 10, 10000);
+		break;
+#endif
+	default:
+		break;
+	}
+#endif
+	return ret;
+}
+
+
+/* structure describing a PTP hardware clock */
+static struct ptp_clock_info tc956xmac_ptp_clock_ops = {
+	.owner = THIS_MODULE,
+#ifdef TC956X_SRIOV_PF
+	.name = "tc956xmac ptp",
+#else
+	.name = "tc956xmac vf ptp",
+#endif
+	.max_adj = 62500000,
+	.n_alarm = 0,
+	.n_ext_ts = 0, /* will be overwritten in tc956xmac_ptp_register */
+	.n_per_out = 0, /* will be overwritten in tc956xmac_ptp_register */
+	.n_pins = 0,
+	.pps = 0,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 2, 0)
+	.adjfreq = tc956xmac_adjust_freq,
+#else
+	.adjfine = tc956xmac_adjust_freq,
+#endif
+	.adjtime = tc956xmac_adjust_time,
+	.gettime64 = tc956xmac_get_time,
+	.settime64 = tc956xmac_set_time,
+#ifdef TC956X_UNSUPPORTED_UNTESTED_FEATURE
+	.enable = tc956xmac_enable,
+#endif /* TC956X_UNSUPPORTED_UNTESTED_FEATURE */
+};
+
+/**
+ * tc956xmac_ptp_register
+ * @priv: driver private structure
+ * Description: this function will register the ptp clock driver
+ * to kernel. It also does some house keeping work.
+ */
+void tc956xmac_ptp_register(struct tc956xmac_priv *priv)
+{
+	int i;
+
+	for (i = 0; i < priv->dma_cap.pps_out_num; i++) {
+		if (i >= TC956XMAC_PPS_MAX)
+			break;
+		priv->pps[i].available = true;
+	}
+
+	if (priv->plat->ptp_max_adj)
+		tc956xmac_ptp_clock_ops.max_adj = priv->plat->ptp_max_adj;
+#ifdef TC956X_SRIOV_PF
+	tc956xmac_ptp_clock_ops.n_per_out = priv->dma_cap.pps_out_num;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
+	tc956xmac_ptp_clock_ops.n_ext_ts = priv->dma_cap.aux_snapshot_n;
+#endif
+#endif
+	spin_lock_init(&priv->ptp_lock);
+	priv->ptp_clock_ops = tc956xmac_ptp_clock_ops;
+
+	priv->ptp_clock = ptp_clock_register(&priv->ptp_clock_ops,
+					     priv->device);
+	if (IS_ERR(priv->ptp_clock)) {
+		netdev_err(priv->dev, "ptp_clock_register failed\n");
+		priv->ptp_clock = NULL;
+	} else if (priv->ptp_clock)
+		netdev_info(priv->dev, "registered PTP clock\n");
+}
+
+/**
+ * tc956xmac_ptp_unregister
+ * @priv: driver private structure
+ * Description: this function will remove/unregister the ptp clock driver
+ * from the kernel.
+ */
+void tc956xmac_ptp_unregister(struct tc956xmac_priv *priv)
+{
+	if (priv->ptp_clock) {
+		ptp_clock_unregister(priv->ptp_clock);
+		priv->ptp_clock = NULL;
+		pr_debug("Removed PTP HW clock successfully on %s\n",
+			 priv->dev->name);
+	}
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_ptp.h
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_ptp.h
@@ -0,0 +1,122 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_ptp.h
+ *
+ * Copyright (C) 2013  Vayavya Labs Pvt Ltd
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Vayavya Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *  VERSION     : 04-00
+ */
+
+#ifndef	__TC956XMAC_PTP_H__
+#define	__TC956XMAC_PTP_H__
+
+#define	PTP_XGMAC_OFFSET	(MAC_OFFSET + 0xd00)
+#define	PTP_GMAC4_OFFSET	(MAC_OFFSET + 0xb00)
+#define	PTP_GMAC3_X_OFFSET	(MAC_OFFSET + 0x700)
+
+#define	PTP_XGMAC_OFFSET_BASE		(0xd00)
+#define	PTP_GMAC4_OFFSET_BASE		(0xb00)
+#define	PTP_GMAC3_X_OFFSET_BASE	(0x700)
+
+/* IEEE 1588 PTP register offsets */
+#define	PTP_TCR		0x00	/* Timestamp Control Reg */
+#define	PTP_SSIR	0x04	/* Sub-Second Increment Reg */
+#define	PTP_STSR	0x08	/* System Time – Seconds Regr */
+#define	PTP_STNSR	0x0c	/* System Time – Nanoseconds Reg */
+#define	PTP_STSUR	0x10	/* System Time – Seconds Update Reg */
+#define	PTP_STNSUR	0x14	/* System Time – Nanoseconds Update Reg */
+#define	PTP_TAR		0x18	/* Timestamp Addend Reg */
+#define	PTP_ATNR	0x48	/* Auxiliary Timestamp - Nanoseconds Reg */
+#define	PTP_ATSR	0x4c	/* Auxiliary Timestamp - Seconds Reg */
+
+#define PTP_TS_STATUS	0x20	/* Timestamp status Reg */
+
+#define PTP_ATS_NSEC	0x48	/* MAC_Auxiliary_Timestamp_Seconds */
+#define PTP_ATS_SEC		0x4C	/* MAC_Auxiliary_Timestamp_Nanoseconds */
+
+#define	PTP_STNSUR_ADDSUB_SHIFT	31
+#define	PTP_DIGITAL_ROLLOVER_MODE	0x3B9ACA00	/* 10e9-1 ns */
+#define	PTP_BINARY_ROLLOVER_MODE	0x80000000	/* ~0.466 ns */
+
+/* PTP Timestamp control register defines */
+#define	PTP_TCR_TSENA		BIT(0)	/* Timestamp Enable */
+#define	PTP_TCR_TSCFUPDT	BIT(1)	/* Timestamp Fine/Coarse Update */
+#define	PTP_TCR_TSINIT		BIT(2)	/* Timestamp Initialize */
+#define	PTP_TCR_TSUPDT		BIT(3)	/* Timestamp Update */
+#define	PTP_TCR_TSTRIG		BIT(4)	/* Timestamp Interrupt Trigger Enable */
+#define	PTP_TCR_TSADDREG	BIT(5)	/* Addend Reg Update */
+#define PTP_TCR_PTGE		BIT(6)	/* Presentation Time Generation Enable */
+#define	PTP_TCR_TSENALL		BIT(8)	/* Enable Timestamp for All Frames */
+#define	PTP_TCR_TSCTRLSSR	BIT(9)	/* Digital or Binary Rollover Control */
+/* Enable PTP packet Processing for Version 2 Format */
+#define	PTP_TCR_TSVER2ENA	BIT(10)
+/* Enable Processing of PTP over Ethernet Frames */
+#define	PTP_TCR_TSIPENA		BIT(11)
+/* Enable Processing of PTP Frames Sent over IPv6-UDP */
+#define	PTP_TCR_TSIPV6ENA	BIT(12)
+/* Enable Processing of PTP Frames Sent over IPv4-UDP */
+#define	PTP_TCR_TSIPV4ENA	BIT(13)
+/* Enable Timestamp Snapshot for Event Messages */
+#define	PTP_TCR_TSEVNTENA	BIT(14)
+/* Enable Snapshot for Messages Relevant to Master */
+#define	PTP_TCR_TSMSTRENA	BIT(15)
+/* Select PTP packets for Taking Snapshots
+ * On gmac4 specifically:
+ * Enable SYNC, Pdelay_Req, Pdelay_Resp when TSEVNTENA is enabled.
+ * or
+ * Enable  SYNC, Follow_Up, Delay_Req, Delay_Resp, Pdelay_Req, Pdelay_Resp,
+ * Pdelay_Resp_Follow_Up if TSEVNTENA is disabled
+ */
+#define	PTP_TCR_SNAPTYPSEL_1	BIT(16)
+#define	PTP_GMAC4_TCR_SNAPTYPSEL_1	GENMASK(17, 16)
+#define PTP_TCR_SNAPTYPSEL_1_LPOS	(16)
+/* Enable MAC address for PTP Frame Filtering */
+#define	PTP_TCR_TSENMACADDR	BIT(18)
+#define	PTP_TCR_ASMEN		BIT(28)
+
+#define PTP_TCR_MODE_MASK	(0x3C000)
+#define PTP_TCR_MC_UC_LPOS	(18)
+
+
+/* SSIR defines */
+#define	PTP_SSIR_SSINC_MASK		0xff
+#define	GMAC4_PTP_SSIR_SSINC_SHIFT	16
+//#ifdef TC956X
+#define PTP_SSIR_SNSINC_MASK		0xff
+#define GMAC4_PTP_SSIR_SNSINC_SHIFT	8
+//#endif
+
+/* MAC Timestamp Status */
+#define MAC_TS_ATSNS_MASK	GENMASK(29, 25)
+#define MAC_TS_ATSNS_SHIFT	25
+
+#endif	/* __TC956XMAC_PTP_H__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_selftests.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_selftests.c
@@ -0,0 +1,1696 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_selftests.c
+ *
+ * Copyright (C) 2019 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2024 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *
+ *  13 Feb 2024 : 1. Merged CPE and Automotive package
+ *                2. Updated with Register Configuration Check.
+ *  VERSION     : 04-00
+ *  06 Mar 2024 : 1. Kernel 6.6.1 Porting changes
+ *  VERSION     : 04-00
+ */
+
+#include <linux/bitrev.h>
+#include <linux/completion.h>
+#include <linux/crc32.h>
+#include <linux/ethtool.h>
+#include <linux/ip.h>
+#include <linux/phy.h>
+#include <linux/udp.h>
+#include <net/pkt_cls.h>
+#include <net/pkt_sched.h>
+#include <net/tcp.h>
+#include <net/udp.h>
+#include <net/tc_act/tc_gact.h>
+#include "tc956xmac.h"
+
+struct tc956xmachdr {
+	__be32 version;
+	__be64 magic;
+	u8 id;
+} __packed;
+
+#define TC956XMAC_TEST_PKT_SIZE (sizeof(struct ethhdr) + sizeof(struct iphdr) + \
+			      sizeof(struct tc956xmachdr))
+#define TC956XMAC_TEST_PKT_MAGIC	0xdeadcafecafedeadULL
+#define TC956XMAC_LB_TIMEOUT	msecs_to_jiffies(200)
+#define TC956XMAC_PTP_TIMEOUT	msecs_to_jiffies(2000)
+#define MMC_COUNTER_INITIAL_VALUE 0
+/*#define SELFTEST_NOT_SUPPORTED*/
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+static int filter_vlan_id;
+#endif
+
+struct tc956xmac_packet_attrs {
+	int vlan;
+	int vlan_id_in;
+	int vlan_id_out;
+	unsigned char *src;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 146)
+	unsigned char *dst;
+#else
+	const unsigned char *dst;
+#endif
+	u32 ip_src;
+	u32 ip_dst;
+	int tcp;
+	int sport;
+	int dport;
+	u32 exp_hash;
+	int dont_wait;
+	int timeout;
+	int size;
+	int max_size;
+	int remove_sa;
+	u8 id;
+	int sarc;
+	u16 queue_mapping;
+	u64 timestamp;
+};
+
+static u8 tc956xmac_test_next_id;
+
+static struct sk_buff *tc956xmac_test_get_udp_skb(struct tc956xmac_priv *priv,
+					       struct tc956xmac_packet_attrs *attr)
+{
+	struct sk_buff *skb = NULL;
+	struct udphdr *uhdr = NULL;
+	struct tcphdr *thdr = NULL;
+	struct tc956xmachdr *shdr;
+	struct ethhdr *ehdr;
+	struct iphdr *ihdr;
+	int iplen, size;
+
+	size = attr->size + TC956XMAC_TEST_PKT_SIZE;
+	if (attr->vlan) {
+		size += 4;
+		if (attr->vlan > 1)
+			size += 4;
+	}
+
+	if (attr->tcp)
+		size += sizeof(struct tcphdr);
+	else
+		size += sizeof(struct udphdr);
+
+	if (attr->max_size && (attr->max_size > size))
+		size = attr->max_size;
+
+	skb = netdev_alloc_skb(priv->dev, size);
+	if (!skb)
+		return NULL;
+
+	prefetchw(skb->data);
+
+	if (attr->vlan > 1)
+		ehdr = skb_push(skb, ETH_HLEN + 8);
+	else if (attr->vlan)
+		ehdr = skb_push(skb, ETH_HLEN + 4);
+	else if (attr->remove_sa)
+		ehdr = skb_push(skb, ETH_HLEN - 6);
+	else
+		ehdr = skb_push(skb, ETH_HLEN);
+	skb_reset_mac_header(skb);
+
+	skb_set_network_header(skb, skb->len);
+	ihdr = skb_put(skb, sizeof(*ihdr));
+
+	skb_set_transport_header(skb, skb->len);
+	if (attr->tcp)
+		thdr = skb_put(skb, sizeof(*thdr));
+	else
+		uhdr = skb_put(skb, sizeof(*uhdr));
+
+	if (!attr->remove_sa)
+		eth_zero_addr(ehdr->h_source);
+	eth_zero_addr(ehdr->h_dest);
+	if (attr->src && !attr->remove_sa)
+		ether_addr_copy(ehdr->h_source, attr->src);
+	if (attr->dst)
+		ether_addr_copy(ehdr->h_dest, attr->dst);
+
+	if (!attr->remove_sa) {
+		ehdr->h_proto = htons(ETH_P_IP);
+	} else {
+		__be16 *ptr = (__be16 *)ehdr;
+
+		/* HACK */
+		ptr[3] = htons(ETH_P_IP);
+	}
+
+	if (attr->vlan) {
+		__be16 *tag, *proto;
+
+		if (!attr->remove_sa) {
+			tag = (void *)ehdr + ETH_HLEN;
+			proto = (void *)ehdr + (2 * ETH_ALEN);
+		} else {
+			tag = (void *)ehdr + ETH_HLEN - 6;
+			proto = (void *)ehdr + ETH_ALEN;
+		}
+
+		proto[0] = htons(ETH_P_8021Q);
+		tag[0] = htons(attr->vlan_id_out);
+		tag[1] = htons(ETH_P_IP);
+		if (attr->vlan > 1) {
+			proto[0] = htons(ETH_P_8021AD);
+			tag[1] = htons(ETH_P_8021Q);
+			tag[2] = htons(attr->vlan_id_in);
+			tag[3] = htons(ETH_P_IP);
+		}
+	}
+
+	if (attr->tcp) {
+		thdr->source = htons(attr->sport);
+		thdr->dest = htons(attr->dport);
+		thdr->doff = sizeof(struct tcphdr) / 4;
+		thdr->check = 0;
+	} else {
+		uhdr->source = htons(attr->sport);
+		uhdr->dest = htons(attr->dport);
+		uhdr->len = htons(sizeof(*shdr) + sizeof(*uhdr) + attr->size);
+		if (attr->max_size)
+			uhdr->len = htons(attr->max_size -
+					  (sizeof(*ihdr) + sizeof(*ehdr)));
+		uhdr->check = 0;
+	}
+
+	ihdr->ihl = 5;
+	ihdr->ttl = 32;
+	ihdr->version = 4;
+	if (attr->tcp)
+		ihdr->protocol = IPPROTO_TCP;
+	else
+		ihdr->protocol = IPPROTO_UDP;
+	iplen = sizeof(*ihdr) + sizeof(*shdr) + attr->size;
+	if (attr->tcp)
+		iplen += sizeof(*thdr);
+	else
+		iplen += sizeof(*uhdr);
+
+	if (attr->max_size)
+		iplen = attr->max_size - sizeof(*ehdr);
+
+	ihdr->tot_len = htons(iplen);
+	ihdr->frag_off = 0;
+	ihdr->saddr = htonl(attr->ip_src);
+	ihdr->daddr = htonl(attr->ip_dst);
+	ihdr->tos = 0;
+	ihdr->id = 0;
+	ip_send_check(ihdr);
+
+	shdr = skb_put(skb, sizeof(*shdr));
+	shdr->version = 0;
+	shdr->magic = cpu_to_be64(TC956XMAC_TEST_PKT_MAGIC);
+	attr->id = tc956xmac_test_next_id;
+	shdr->id = tc956xmac_test_next_id++;
+
+	if (attr->size)
+		skb_put(skb, attr->size);
+	if (attr->max_size && (attr->max_size > skb->len))
+		skb_put(skb, attr->max_size - skb->len);
+
+	skb->csum = 0;
+	skb->ip_summed = CHECKSUM_PARTIAL;
+	if (attr->tcp) {
+		thdr->check = ~tcp_v4_check(skb->len, ihdr->saddr, ihdr->daddr, 0);
+		skb->csum_start = skb_transport_header(skb) - skb->head;
+		skb->csum_offset = offsetof(struct tcphdr, check);
+	} else {
+		udp4_hwcsum(skb, ihdr->saddr, ihdr->daddr);
+	}
+
+	skb->protocol = htons(ETH_P_IP);
+	skb->pkt_type = PACKET_HOST;
+	skb->dev = priv->dev;
+
+	if (attr->timestamp)
+		skb->tstamp = ns_to_ktime(attr->timestamp);
+
+	return skb;
+}
+
+struct tc956xmac_test_priv {
+	struct tc956xmac_packet_attrs *packet;
+	struct packet_type pt;
+	struct completion comp;
+	int double_vlan;
+	int vlan_id;
+	int ok;
+};
+
+static int tc956xmac_test_loopback_validate(struct sk_buff *skb,
+					 struct net_device *ndev,
+					 struct packet_type *pt,
+					 struct net_device *orig_ndev)
+{
+	struct tc956xmac_test_priv *tpriv = pt->af_packet_priv;
+	unsigned char *src = tpriv->packet->src;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 146)
+	unsigned char *dst = tpriv->packet->dst;
+#else
+	const unsigned char *dst = tpriv->packet->dst;
+#endif
+	struct tc956xmachdr *shdr;
+	struct ethhdr *ehdr;
+	struct udphdr *uhdr;
+	struct tcphdr *thdr;
+	struct iphdr *ihdr;
+
+	skb = skb_unshare(skb, GFP_ATOMIC);
+	if (!skb)
+		goto out;
+
+	if (skb_linearize(skb))
+		goto out;
+	if (skb_headlen(skb) < (TC956XMAC_TEST_PKT_SIZE - ETH_HLEN))
+		goto out;
+
+	ehdr = (struct ethhdr *)skb_mac_header(skb);
+	if (dst) {
+		if (!ether_addr_equal_unaligned(ehdr->h_dest, dst))
+			goto out;
+	}
+	if (tpriv->packet->sarc) {
+		if (!ether_addr_equal_unaligned(ehdr->h_source, ehdr->h_dest))
+			goto out;
+	} else if (src) {
+		if (!ether_addr_equal_unaligned(ehdr->h_source, src))
+			goto out;
+	}
+
+	ihdr = ip_hdr(skb);
+	if (tpriv->double_vlan)
+		ihdr = (struct iphdr *)(skb_network_header(skb) + 4);
+
+	if (tpriv->packet->tcp) {
+		if (ihdr->protocol != IPPROTO_TCP)
+			goto out;
+
+		thdr = (struct tcphdr *)((u8 *)ihdr + 4 * ihdr->ihl);
+		if (thdr->dest != htons(tpriv->packet->dport))
+			goto out;
+
+		shdr = (struct tc956xmachdr *)((u8 *)thdr + sizeof(*thdr));
+	} else {
+		if (ihdr->protocol != IPPROTO_UDP)
+			goto out;
+
+		uhdr = (struct udphdr *)((u8 *)ihdr + 4 * ihdr->ihl);
+		if (uhdr->dest != htons(tpriv->packet->dport))
+			goto out;
+
+		shdr = (struct tc956xmachdr *)((u8 *)uhdr + sizeof(*uhdr));
+	}
+
+	if (shdr->magic != cpu_to_be64(TC956XMAC_TEST_PKT_MAGIC))
+		goto out;
+	if (tpriv->packet->exp_hash && !skb->hash)
+		goto out;
+	if (tpriv->packet->id != shdr->id)
+		goto out;
+
+	tpriv->ok = true;
+	complete(&tpriv->comp);
+out:
+	kfree_skb(skb);
+	return 0;
+}
+
+static int __tc956xmac_test_loopback(struct tc956xmac_priv *priv,
+				  struct tc956xmac_packet_attrs *attr)
+{
+	struct tc956xmac_test_priv *tpriv;
+	struct sk_buff *skb = NULL;
+	int ret = 0;
+
+	tpriv = kzalloc(sizeof(*tpriv), GFP_KERNEL);
+	if (!tpriv)
+		return -ENOMEM;
+
+	tpriv->ok = false;
+	init_completion(&tpriv->comp);
+
+	tpriv->pt.type = htons(ETH_P_IP);
+	tpriv->pt.func = tc956xmac_test_loopback_validate;
+	tpriv->pt.dev = priv->dev;
+	tpriv->pt.af_packet_priv = tpriv;
+	tpriv->packet = attr;
+
+	if (!attr->dont_wait)
+		dev_add_pack(&tpriv->pt);
+
+	skb = tc956xmac_test_get_udp_skb(priv, attr);
+	if (!skb) {
+		ret = -ENOMEM;
+		goto cleanup;
+	}
+
+	attr->queue_mapping = HOST_BEST_EFF_CH;
+	ret = dev_direct_xmit(skb, attr->queue_mapping);
+	if (ret)
+		goto cleanup;
+
+	if (attr->dont_wait)
+		goto cleanup;
+
+	if (!attr->timeout)
+		attr->timeout = TC956XMAC_LB_TIMEOUT;
+
+	wait_for_completion_timeout(&tpriv->comp, attr->timeout);
+	ret = tpriv->ok ? 0 : -ETIMEDOUT;
+
+cleanup:
+	if (!attr->dont_wait)
+		dev_remove_pack(&tpriv->pt);
+	kfree(tpriv);
+	return ret;
+}
+
+static int tc956xmac_test_mac_loopback(struct tc956xmac_priv *priv)
+{
+	struct tc956xmac_packet_attrs attr = { };
+
+	attr.dst = priv->dev->dev_addr;
+	return __tc956xmac_test_loopback(priv, &attr);
+}
+
+static int tc956xmac_test_phy_loopback(struct tc956xmac_priv *priv)
+{
+	struct tc956xmac_packet_attrs attr = { };
+	int ret;
+
+	if (!priv->dev->phydev)
+		return -EBUSY;
+	ret = phy_loopback(priv->dev->phydev, true);
+	if (ret)
+		return ret;
+
+	msleep(7000);
+	attr.dst = priv->dev->dev_addr;
+	ret = __tc956xmac_test_loopback(priv, &attr);
+
+	phy_loopback(priv->dev->phydev, false);
+	msleep(7000);
+
+	return ret;
+}
+
+static int tc956xmac_test_mmc(struct tc956xmac_priv *priv)
+{
+	struct tc956xmac_counters final;
+	int ret;
+
+	memset(&final, 0, sizeof(final));
+
+	if (!priv->dma_cap.rmon)
+		return -EOPNOTSUPP;
+
+	/* Save previous results into internal struct */
+	tc956xmac_mmc_read(priv, priv->mmcaddr, &priv->mmc);
+
+	ret = tc956xmac_test_mac_loopback(priv);
+	if (ret)
+		return ret;
+
+	/* These will be loopback results so no need to save them */
+	tc956xmac_mmc_read(priv, priv->mmcaddr, &final);
+
+	/*
+	 * The number of MMC counters available depends on HW configuration
+	 * so we just use this one to validate the feature. I hope there is
+	 * not a version without this counter.
+	 */
+	if (final.mmc_tx_framecount_g <= MMC_COUNTER_INITIAL_VALUE)
+		return -EINVAL;
+
+	return 0;
+}
+
+#ifdef SELFTEST_NOT_SUPPORTED
+static int tc956xmac_test_eee(struct tc956xmac_priv *priv)
+{
+	struct tc956xmac_extra_stats *initial, *final;
+	int retries = 10;
+	int ret;
+
+	if (!priv->dma_cap.eee || !priv->eee_active)
+		return -EOPNOTSUPP;
+
+	initial = kzalloc(sizeof(*initial), GFP_KERNEL);
+	if (!initial)
+		return -ENOMEM;
+
+	final = kzalloc(sizeof(*final), GFP_KERNEL);
+	if (!final) {
+		ret = -ENOMEM;
+		goto out_free_initial;
+	}
+
+	memcpy(initial, &priv->xstats, sizeof(*initial));
+
+	ret = tc956xmac_test_mac_loopback(priv);
+	if (ret)
+		goto out_free_final;
+
+	/* We have no traffic in the line so, sooner or later it will go LPI */
+	while (--retries) {
+		memcpy(final, &priv->xstats, sizeof(*final));
+
+		if (final->irq_tx_path_in_lpi_mode_n >
+		    initial->irq_tx_path_in_lpi_mode_n)
+			break;
+		msleep(100);
+	}
+
+	if (!retries) {
+		ret = -ETIMEDOUT;
+		goto out_free_final;
+	}
+
+	if (final->irq_tx_path_in_lpi_mode_n <=
+	    initial->irq_tx_path_in_lpi_mode_n) {
+		ret = -EINVAL;
+		goto out_free_final;
+	}
+
+	if (final->irq_tx_path_exit_lpi_mode_n <=
+	    initial->irq_tx_path_exit_lpi_mode_n) {
+		ret = -EINVAL;
+		goto out_free_final;
+	}
+
+out_free_final:
+	kfree(final);
+out_free_initial:
+	kfree(initial);
+	return ret;
+}
+#endif
+
+static int tc956xmac_filter_check(struct tc956xmac_priv *priv)
+{
+	if (!(priv->dev->flags & IFF_PROMISC))
+		return 0;
+
+	netdev_warn(priv->dev, "Test can't be run in promiscuous mode!\n");
+	return -EOPNOTSUPP;
+}
+
+static bool tc956xmac_hash_check(struct tc956xmac_priv *priv, unsigned char *addr)
+{
+	int mc_offset = 32 - priv->hw->mcast_bits_log2;
+	struct netdev_hw_addr *ha;
+	u32 hash, hash_nr;
+
+	/* First compute the hash for desired addr */
+	hash = bitrev32(~crc32_le(~0, addr, 6)) >> mc_offset;
+	hash_nr = hash >> 5;
+	hash = 1 << (hash & 0x1f);
+
+	/* Now, check if it collides with any existing one */
+	netdev_for_each_mc_addr(ha, priv->dev) {
+		u32 nr = bitrev32(~crc32_le(~0, ha->addr, ETH_ALEN)) >> mc_offset;
+
+		if (((nr >> 5) == hash_nr) && ((1 << (nr & 0x1f)) == hash))
+			return false;
+	}
+
+	/* No collisions, address is good to go */
+	return true;
+}
+
+static bool tc956xmac_perfect_check(struct tc956xmac_priv *priv, unsigned char *addr)
+{
+	struct netdev_hw_addr *ha;
+
+	/* Check if it collides with any existing one */
+	netdev_for_each_uc_addr(ha, priv->dev) {
+		if (!memcmp(ha->addr, addr, ETH_ALEN))
+			return false;
+	}
+
+	/* No collisions, address is good to go */
+	return true;
+}
+
+static int tc956xmac_test_hfilt(struct tc956xmac_priv *priv)
+{
+	unsigned char gd_addr[ETH_ALEN] = {0xf1, 0xee, 0xdd, 0xcc, 0xbb, 0xaa};
+	unsigned char bd_addr[ETH_ALEN] = {0xf1, 0xff, 0xff, 0xff, 0xff, 0xff};
+	struct tc956xmac_packet_attrs attr = { };
+	int ret, tries = 256;
+
+	ret = tc956xmac_filter_check(priv);
+	if (ret)
+		return ret;
+
+	if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins)
+		return -EOPNOTSUPP;
+
+	while (--tries) {
+		/* We only need to check the bd_addr for collisions */
+		bd_addr[ETH_ALEN - 1] = tries;
+		if (tc956xmac_hash_check(priv, bd_addr))
+			break;
+	}
+
+	if (!tries)
+		return -EOPNOTSUPP;
+
+	ret = dev_mc_add(priv->dev, gd_addr);
+	if (ret)
+		return ret;
+
+	attr.dst = gd_addr;
+
+	/* Shall receive packet */
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	if (ret)
+		goto cleanup;
+
+	attr.dst = bd_addr;
+
+	/* Shall NOT receive packet */
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	ret = ret ? 0 : -EINVAL;
+
+cleanup:
+	dev_mc_del(priv->dev, gd_addr);
+	return ret;
+}
+
+static int tc956xmac_test_pfilt(struct tc956xmac_priv *priv)
+{
+	unsigned char gd_addr[ETH_ALEN] = {0xf0, 0x01, 0x44, 0x55, 0x66, 0x77};
+	unsigned char bd_addr[ETH_ALEN] = {0xf0, 0xff, 0xff, 0xff, 0xff, 0xff};
+	struct tc956xmac_packet_attrs attr = { };
+	int ret, tries = 256;
+
+	if (tc956xmac_filter_check(priv))
+		return -EOPNOTSUPP;
+	if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries)
+		return -EOPNOTSUPP;
+
+	while (--tries) {
+		/* We only need to check the bd_addr for collisions */
+		bd_addr[ETH_ALEN - 1] = tries;
+		if (tc956xmac_perfect_check(priv, bd_addr))
+			break;
+	}
+
+	if (!tries)
+		return -EOPNOTSUPP;
+
+	ret = dev_uc_add(priv->dev, gd_addr);
+	if (ret)
+		return ret;
+
+	attr.dst = gd_addr;
+
+	/* Shall receive packet */
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	if (ret)
+		goto cleanup;
+
+	attr.dst = bd_addr;
+
+	/* Shall NOT receive packet */
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	ret = ret ? 0 : -EINVAL;
+
+cleanup:
+	dev_uc_del(priv->dev, gd_addr);
+	return ret;
+}
+
+static int tc956xmac_test_mcfilt(struct tc956xmac_priv *priv)
+{
+	unsigned char uc_addr[ETH_ALEN] = {0xf0, 0xff, 0xff, 0xff, 0xff, 0xff};
+	unsigned char mc_addr[ETH_ALEN] = {0xf1, 0xff, 0xff, 0xff, 0xff, 0xff};
+	struct tc956xmac_packet_attrs attr = { };
+	int ret, tries = 256;
+
+	if (tc956xmac_filter_check(priv))
+		return -EOPNOTSUPP;
+	if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries)
+		return -EOPNOTSUPP;
+	if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins)
+		return -EOPNOTSUPP;
+
+	while (--tries) {
+		/* We only need to check the mc_addr for collisions */
+		mc_addr[ETH_ALEN - 1] = tries;
+		if (tc956xmac_hash_check(priv, mc_addr))
+			break;
+	}
+
+	if (!tries)
+		return -EOPNOTSUPP;
+
+	ret = dev_uc_add(priv->dev, uc_addr);
+	if (ret)
+		return ret;
+
+	attr.dst = uc_addr;
+
+	/* Shall receive packet */
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	if (ret)
+		goto cleanup;
+
+	attr.dst = mc_addr;
+
+	/* Shall NOT receive packet */
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	ret = ret ? 0 : -EINVAL;
+
+cleanup:
+	dev_uc_del(priv->dev, uc_addr);
+	return ret;
+}
+
+static int tc956xmac_test_ucfilt(struct tc956xmac_priv *priv)
+{
+	unsigned char uc_addr[ETH_ALEN] = {0xf0, 0xff, 0xff, 0xff, 0xff, 0xff};
+	unsigned char mc_addr[ETH_ALEN] = {0xf1, 0xff, 0xff, 0xff, 0xff, 0xff};
+	struct tc956xmac_packet_attrs attr = { };
+	int ret, tries = 256;
+
+	if (tc956xmac_filter_check(priv))
+		return -EOPNOTSUPP;
+	if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries)
+		return -EOPNOTSUPP;
+	if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins)
+		return -EOPNOTSUPP;
+
+	while (--tries) {
+		/* We only need to check the uc_addr for collisions */
+		uc_addr[ETH_ALEN - 1] = tries;
+		if (tc956xmac_perfect_check(priv, uc_addr))
+			break;
+	}
+
+	if (!tries)
+		return -EOPNOTSUPP;
+
+	ret = dev_mc_add(priv->dev, mc_addr);
+	if (ret)
+		return ret;
+
+	attr.dst = mc_addr;
+
+	/* Shall receive packet */
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	if (ret)
+		goto cleanup;
+
+	attr.dst = uc_addr;
+
+	/* Shall NOT receive packet */
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	ret = ret ? 0 : -EINVAL;
+
+cleanup:
+	dev_mc_del(priv->dev, mc_addr);
+	return ret;
+}
+
+#ifdef SELFTEST_NOT_SUPPORTED
+static int tc956xmac_test_flowctrl_validate(struct sk_buff *skb,
+					 struct net_device *ndev,
+					 struct packet_type *pt,
+					 struct net_device *orig_ndev)
+{
+	struct tc956xmac_test_priv *tpriv = pt->af_packet_priv;
+	struct ethhdr *ehdr;
+
+	ehdr = (struct ethhdr *)skb_mac_header(skb);
+	if (!ether_addr_equal_unaligned(ehdr->h_source, orig_ndev->dev_addr))
+		goto out;
+	if (ehdr->h_proto != htons(ETH_P_PAUSE))
+		goto out;
+
+	tpriv->ok = true;
+	complete(&tpriv->comp);
+out:
+	kfree_skb(skb);
+	return 0;
+}
+
+static int tc956xmac_test_flowctrl(struct tc956xmac_priv *priv)
+{
+	unsigned char paddr[ETH_ALEN] = {0x01, 0x80, 0xC2, 0x00, 0x00, 0x01};
+	struct phy_device *phydev = priv->dev->phydev;
+	u32 rx_cnt = priv->plat->rx_queues_to_use;
+	struct tc956xmac_test_priv *tpriv;
+	unsigned int pkt_count;
+	int i, ret = 0;
+
+	if (!phydev || (!phydev->pause && !phydev->asym_pause))
+		return -EOPNOTSUPP;
+
+	tpriv = kzalloc(sizeof(*tpriv), GFP_KERNEL);
+	if (!tpriv)
+		return -ENOMEM;
+
+	tpriv->ok = false;
+	init_completion(&tpriv->comp);
+	tpriv->pt.type = htons(ETH_P_PAUSE);
+	tpriv->pt.func = tc956xmac_test_flowctrl_validate;
+	tpriv->pt.dev = priv->dev;
+	tpriv->pt.af_packet_priv = tpriv;
+	dev_add_pack(&tpriv->pt);
+
+	/* Compute minimum number of packets to make FIFO full */
+	pkt_count = priv->plat->rx_fifo_size;
+	if (!pkt_count)
+		pkt_count = priv->dma_cap.rx_fifo_size;
+	pkt_count /= 1400;
+	pkt_count *= 2;
+
+	for (i = 0; i < rx_cnt; i++)
+		tc956xmac_stop_rx(priv, priv->ioaddr, i);
+
+	ret = dev_set_promiscuity(priv->dev, 1);
+	if (ret)
+		goto cleanup;
+
+	ret = dev_mc_add(priv->dev, paddr);
+	if (ret)
+		goto cleanup;
+
+	for (i = 0; i < pkt_count; i++) {
+		struct tc956xmac_packet_attrs attr = { };
+
+		attr.dst = priv->dev->dev_addr;
+		attr.dont_wait = true;
+		attr.size = 1400;
+
+		ret = __tc956xmac_test_loopback(priv, &attr);
+		if (ret)
+			goto cleanup;
+		if (tpriv->ok)
+			break;
+	}
+
+	/* Wait for some time in case RX Watchdog is enabled */
+	msleep(200);
+
+	for (i = 0; i < rx_cnt; i++) {
+		struct tc956xmac_channel *ch = &priv->channel[i];
+		u32 tail;
+
+		tail = priv->rx_queue[i].dma_rx_phy +
+			(DMA_RX_SIZE * sizeof(struct dma_desc));
+
+		tc956xmac_set_rx_tail_ptr(priv, priv->ioaddr, tail, i);
+		tc956xmac_start_rx(priv, priv->ioaddr, i);
+
+		local_bh_disable();
+		napi_reschedule(&ch->rx_napi);
+		local_bh_enable();
+	}
+
+	wait_for_completion_timeout(&tpriv->comp, TC956XMAC_LB_TIMEOUT);
+	ret = tpriv->ok ? 0 : -ETIMEDOUT;
+
+cleanup:
+	dev_mc_del(priv->dev, paddr);
+	dev_set_promiscuity(priv->dev, -1);
+	dev_remove_pack(&tpriv->pt);
+	kfree(tpriv);
+	return ret;
+}
+
+#endif
+
+static int tc956xmac_test_vlan_validate(struct sk_buff *skb,
+				     struct net_device *ndev,
+				     struct packet_type *pt,
+				     struct net_device *orig_ndev)
+{
+	struct tc956xmac_test_priv *tpriv = pt->af_packet_priv;
+	struct tc956xmachdr *shdr;
+	struct ethhdr *ehdr;
+	struct udphdr *uhdr;
+	struct iphdr *ihdr;
+	u16 proto;
+
+	proto = tpriv->double_vlan ? ETH_P_8021AD : ETH_P_8021Q;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+	/* VLAN Fields of SKB buffer is not updated from Kernel 6.2.0
+	 * So VLAN fields of received packets are updated at Receiver.
+	 */
+	__vlan_hwaccel_put_tag(skb, htons(proto), filter_vlan_id);
+#endif
+
+	skb = skb_unshare(skb, GFP_ATOMIC);
+	if (!skb)
+		goto out;
+
+	if (skb_linearize(skb))
+		goto out;
+	if (skb_headlen(skb) < (TC956XMAC_TEST_PKT_SIZE - ETH_HLEN))
+		goto out;
+
+	if (tpriv->vlan_id) {
+		if (skb->vlan_proto != htons(proto))
+			goto out;
+		if (skb->vlan_tci != tpriv->vlan_id) {
+			/* Means filter did not work. */
+			tpriv->ok = false;
+			complete(&tpriv->comp);
+			goto out;
+		}
+	}
+
+	ehdr = (struct ethhdr *)skb_mac_header(skb);
+	if (!ether_addr_equal_unaligned(ehdr->h_dest, tpriv->packet->dst))
+		goto out;
+
+	ihdr = ip_hdr(skb);
+	if (tpriv->double_vlan)
+		ihdr = (struct iphdr *)(skb_network_header(skb) + 4);
+	if (ihdr->protocol != IPPROTO_UDP)
+		goto out;
+
+	uhdr = (struct udphdr *)((u8 *)ihdr + 4 * ihdr->ihl);
+	if (uhdr->dest != htons(tpriv->packet->dport))
+		goto out;
+
+	shdr = (struct tc956xmachdr *)((u8 *)uhdr + sizeof(*uhdr));
+	if (shdr->magic != cpu_to_be64(TC956XMAC_TEST_PKT_MAGIC))
+		goto out;
+
+	tpriv->ok = true;
+	complete(&tpriv->comp);
+
+out:
+	kfree_skb(skb);
+	return 0;
+}
+
+static int __tc956xmac_test_vlanfilt(struct tc956xmac_priv *priv)
+{
+	struct tc956xmac_packet_attrs attr = { };
+	struct tc956xmac_test_priv *tpriv;
+	struct sk_buff *skb = NULL;
+	int ret = 0, i;
+
+	tpriv = kzalloc(sizeof(*tpriv), GFP_KERNEL);
+	if (!tpriv)
+		return -ENOMEM;
+
+	tpriv->ok = false;
+	init_completion(&tpriv->comp);
+
+	tpriv->pt.type = htons(ETH_P_IP);
+	tpriv->pt.func = tc956xmac_test_vlan_validate;
+	tpriv->pt.dev = priv->dev;
+	tpriv->pt.af_packet_priv = tpriv;
+	tpriv->packet = &attr;
+
+	/*
+	 * As we use HASH filtering, false positives may appear. This is a
+	 * specially chosen ID so that adjacent IDs (+4) have different
+	 * HASH values.
+	 */
+	tpriv->vlan_id = 0x123;
+	dev_add_pack(&tpriv->pt);
+
+	ret = vlan_vid_add(priv->dev, htons(ETH_P_8021Q), tpriv->vlan_id);
+	if (ret)
+		goto cleanup;
+
+	for (i = 0; i < 4; i++) {
+		attr.vlan = 1;
+		attr.vlan_id_out = tpriv->vlan_id + i;
+		attr.dst = priv->dev->dev_addr;
+		attr.sport = 9;
+		attr.dport = 9;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+		filter_vlan_id = attr.vlan_id_out;
+#endif
+		skb = tc956xmac_test_get_udp_skb(priv, &attr);
+		if (!skb) {
+			ret = -ENOMEM;
+			goto vlan_del;
+		}
+
+		ret = dev_direct_xmit(skb, HOST_BEST_EFF_CH);
+		if (ret)
+			goto vlan_del;
+
+		wait_for_completion_timeout(&tpriv->comp, TC956XMAC_LB_TIMEOUT);
+		ret = tpriv->ok ? 0 : -ETIMEDOUT;
+		if (ret && !i) {
+			goto vlan_del;
+		} else if (!ret && i) {
+			ret = -EINVAL;
+			goto vlan_del;
+		} else {
+			ret = 0;
+		}
+
+		tpriv->ok = false;
+	}
+
+vlan_del:
+	vlan_vid_del(priv->dev, htons(ETH_P_8021Q), tpriv->vlan_id);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+	filter_vlan_id = 0;
+#endif
+cleanup:
+	dev_remove_pack(&tpriv->pt);
+	kfree(tpriv);
+	return ret;
+}
+
+static int tc956xmac_test_vlanfilt(struct tc956xmac_priv *priv)
+{
+	if (!priv->dma_cap.vlhash)
+		return -EOPNOTSUPP;
+
+	return __tc956xmac_test_vlanfilt(priv);
+}
+
+static int tc956xmac_test_vlanfilt_perfect(struct tc956xmac_priv *priv)
+{
+	int ret, prev_cap = priv->dma_cap.vlhash;
+
+	if (!(priv->dev->features & NETIF_F_HW_VLAN_CTAG_FILTER))
+		return -EOPNOTSUPP;
+
+	priv->dma_cap.vlhash = 0;
+	ret = __tc956xmac_test_vlanfilt(priv);
+	priv->dma_cap.vlhash = prev_cap;
+
+	return ret;
+}
+#ifdef SELFTEST_NOT_SUPPORTED
+static int __tc956xmac_test_dvlanfilt(struct tc956xmac_priv *priv)
+{
+	struct tc956xmac_packet_attrs attr = { };
+	struct tc956xmac_test_priv *tpriv;
+	struct sk_buff *skb = NULL;
+	int ret = 0, i;
+
+	tpriv = kzalloc(sizeof(*tpriv), GFP_KERNEL);
+	if (!tpriv)
+		return -ENOMEM;
+
+	tpriv->ok = false;
+	tpriv->double_vlan = true;
+	init_completion(&tpriv->comp);
+
+	tpriv->pt.type = htons(ETH_P_8021Q);
+	tpriv->pt.func = tc956xmac_test_vlan_validate;
+	tpriv->pt.dev = priv->dev;
+	tpriv->pt.af_packet_priv = tpriv;
+	tpriv->packet = &attr;
+
+	/*
+	 * As we use HASH filtering, false positives may appear. This is a
+	 * specially chosen ID so that adjacent IDs (+4) have different
+	 * HASH values.
+	 */
+	tpriv->vlan_id = 0x123;
+	dev_add_pack(&tpriv->pt);
+
+	ret = vlan_vid_add(priv->dev, htons(ETH_P_8021AD), tpriv->vlan_id);
+	if (ret)
+		goto cleanup;
+
+	for (i = 0; i < 4; i++) {
+		attr.vlan = 2;
+		attr.vlan_id_out = tpriv->vlan_id + i;
+		attr.dst = priv->dev->dev_addr;
+		attr.sport = 9;
+		attr.dport = 9;
+
+		skb = tc956xmac_test_get_udp_skb(priv, &attr);
+		if (!skb) {
+			ret = -ENOMEM;
+			goto vlan_del;
+		}
+
+		ret = dev_direct_xmit(skb, HOST_BEST_EFF_CH);
+		if (ret)
+			goto vlan_del;
+
+		wait_for_completion_timeout(&tpriv->comp, TC956XMAC_LB_TIMEOUT);
+		ret = tpriv->ok ? 0 : -ETIMEDOUT;
+		if (ret && !i) {
+			goto vlan_del;
+		} else if (!ret && i) {
+			ret = -EINVAL;
+			goto vlan_del;
+		} else {
+			ret = 0;
+		}
+
+		tpriv->ok = false;
+	}
+
+vlan_del:
+	vlan_vid_del(priv->dev, htons(ETH_P_8021AD), tpriv->vlan_id);
+cleanup:
+	dev_remove_pack(&tpriv->pt);
+	kfree(tpriv);
+	return ret;
+}
+
+static int tc956xmac_test_dvlanfilt(struct tc956xmac_priv *priv)
+{
+	if (!priv->dma_cap.vlhash)
+		return -EOPNOTSUPP;
+
+	return __tc956xmac_test_dvlanfilt(priv);
+}
+
+static int tc956xmac_test_dvlanfilt_perfect(struct tc956xmac_priv *priv)
+{
+	int ret, prev_cap = priv->dma_cap.vlhash;
+
+	if (!(priv->dev->features & NETIF_F_HW_VLAN_STAG_FILTER))
+		return -EOPNOTSUPP;
+
+	priv->dma_cap.vlhash = 0;
+	ret = __tc956xmac_test_dvlanfilt(priv);
+	priv->dma_cap.vlhash = prev_cap;
+
+	return ret;
+}
+#endif
+#ifdef TC956X_FRP_ENABLE
+static int tc956xmac_test_rxp(struct tc956xmac_priv *priv)
+{
+	unsigned char addr[ETH_ALEN] = {0xde, 0xad, 0xbe, 0xef, 0x00, 0x00};
+	struct tc_cls_u32_offload cls_u32 = { };
+	struct tc956xmac_packet_attrs attr = { };
+	struct tc_action **actions, *act;
+	struct tc_u32_sel *sel;
+	struct tcf_exts *exts;
+	int ret, i, nk = 1;
+
+	if (!tc_can_offload(priv->dev))
+		return -EOPNOTSUPP;
+	if (!priv->dma_cap.frpsel)
+		return -EOPNOTSUPP;
+
+	sel = kzalloc(sizeof(*sel) + nk * sizeof(struct tc_u32_key), GFP_KERNEL);
+	if (!sel)
+		return -ENOMEM;
+
+	exts = kzalloc(sizeof(*exts), GFP_KERNEL);
+	if (!exts) {
+		ret = -ENOMEM;
+		goto cleanup_sel;
+	}
+
+	actions = kzalloc(nk * sizeof(*actions), GFP_KERNEL);
+	if (!actions) {
+		ret = -ENOMEM;
+		goto cleanup_exts;
+	}
+
+	act = kzalloc(nk * sizeof(*act), GFP_KERNEL);
+	if (!act) {
+		ret = -ENOMEM;
+		goto cleanup_actions;
+	}
+
+	cls_u32.command = TC_CLSU32_NEW_KNODE;
+	cls_u32.common.chain_index = 0;
+	cls_u32.common.protocol = htons(ETH_P_ALL);
+	cls_u32.knode.exts = exts;
+	cls_u32.knode.sel = sel;
+	cls_u32.knode.handle = 0x123;
+
+	exts->nr_actions = nk;
+	exts->actions = actions;
+	for (i = 0; i < nk; i++) {
+		struct tcf_gact *gact = to_gact(&act[i]);
+
+		actions[i] = &act[i];
+		gact->tcf_action = TC_ACT_SHOT;
+	}
+
+	sel->nkeys = nk;
+	sel->offshift = 0;
+	sel->keys[0].off = 6;
+	sel->keys[0].val = htonl(0xdeadbeef);
+	sel->keys[0].mask = ~0x0;
+
+	ret = tc956xmac_tc_setup_cls_u32(priv, &cls_u32);
+	if (ret)
+		goto cleanup_act;
+
+	attr.dst = priv->dev->dev_addr;
+	attr.src = addr;
+
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	ret = ret ? 0 : -EINVAL; /* Shall NOT receive packet */
+
+	cls_u32.command = TC_CLSU32_DELETE_KNODE;
+	tc956xmac_tc_setup_cls_u32(priv, &cls_u32);
+
+cleanup_act:
+	kfree(act);
+cleanup_actions:
+	kfree(actions);
+cleanup_exts:
+	kfree(exts);
+cleanup_sel:
+	kfree(sel);
+	return ret;
+}
+#endif
+
+static int tc956xmac_test_reg_sai(struct tc956xmac_priv *priv)
+{
+	unsigned char src[ETH_ALEN] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+	struct tc956xmac_packet_attrs attr = { };
+	int ret;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	if (!priv->dma_cap.vlins)
+		return -EOPNOTSUPP;
+
+	attr.remove_sa = true;
+	attr.sarc = true;
+	attr.src = src;
+	attr.dst = priv->dev->dev_addr;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	tc956xmac_set_umac_addr(priv, priv->hw, (unsigned char*)priv->dev->dev_addr, 0, PF_DRIVER);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	if (tc956xmac_sarc_configure(priv, priv->ioaddr, 0x2))
+		return -EOPNOTSUPP;
+
+	ret = __tc956xmac_test_loopback(priv, &attr);
+
+	tc956xmac_sarc_configure(priv, priv->ioaddr, 0x0);
+	return ret;
+}
+
+static int tc956xmac_test_reg_sar(struct tc956xmac_priv *priv)
+{
+	unsigned char src[ETH_ALEN] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+	struct tc956xmac_packet_attrs attr = { };
+	int ret;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	if (!priv->dma_cap.vlins)
+		return -EOPNOTSUPP;
+
+	attr.sarc = true;
+	attr.src = src;
+	attr.dst = priv->dev->dev_addr;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	tc956xmac_set_umac_addr(priv, priv->hw, (unsigned char*)priv->dev->dev_addr, 0, PF_DRIVER);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.mac_filter, flags);
+#endif
+
+	if (tc956xmac_sarc_configure(priv, priv->ioaddr, 0x3))
+		return -EOPNOTSUPP;
+
+	ret = __tc956xmac_test_loopback(priv, &attr);
+
+	tc956xmac_sarc_configure(priv, priv->ioaddr, 0x0);
+	return ret;
+}
+
+
+static int tc956xmac_test_vlanoff_common(struct tc956xmac_priv *priv, bool svlan)
+{
+	struct tc956xmac_packet_attrs attr = { };
+	struct tc956xmac_test_priv *tpriv;
+	struct sk_buff *skb = NULL;
+	int ret = 0;
+	u16 proto;
+
+	if (!priv->dma_cap.vlins)
+		return -EOPNOTSUPP;
+
+	tpriv = kzalloc(sizeof(*tpriv), GFP_KERNEL);
+	if (!tpriv)
+		return -ENOMEM;
+
+	proto = svlan ? ETH_P_8021AD : ETH_P_8021Q;
+
+	tpriv->ok = false;
+	tpriv->double_vlan = svlan;
+	init_completion(&tpriv->comp);
+
+	tpriv->pt.type = svlan ? htons(ETH_P_8021Q) : htons(ETH_P_IP);
+	tpriv->pt.func = tc956xmac_test_vlan_validate;
+	tpriv->pt.dev = priv->dev;
+	tpriv->pt.af_packet_priv = tpriv;
+	tpriv->packet = &attr;
+	tpriv->vlan_id = 0x123;
+	dev_add_pack(&tpriv->pt);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+	filter_vlan_id = tpriv->vlan_id;
+#endif
+	ret = vlan_vid_add(priv->dev, htons(proto), tpriv->vlan_id);
+	if (ret)
+		goto cleanup;
+
+	attr.dst = priv->dev->dev_addr;
+
+	skb = tc956xmac_test_get_udp_skb(priv, &attr);
+	if (!skb) {
+		ret = -ENOMEM;
+		goto vlan_del;
+	}
+
+	__vlan_hwaccel_put_tag(skb, htons(proto), tpriv->vlan_id);
+	skb->protocol = htons(proto);
+
+	ret = dev_direct_xmit(skb, HOST_BEST_EFF_CH);
+	if (ret)
+		goto vlan_del;
+
+	wait_for_completion_timeout(&tpriv->comp, TC956XMAC_LB_TIMEOUT);
+	ret = tpriv->ok ? 0 : -ETIMEDOUT;
+
+vlan_del:
+	vlan_vid_del(priv->dev, htons(proto), tpriv->vlan_id);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+	filter_vlan_id = 0;
+#endif
+cleanup:
+	dev_remove_pack(&tpriv->pt);
+	kfree(tpriv);
+	return ret;
+}
+
+static int tc956xmac_test_vlanoff(struct tc956xmac_priv *priv)
+{
+	return tc956xmac_test_vlanoff_common(priv, false);
+}
+
+
+static int __tc956xmac_test_jumbo(struct tc956xmac_priv *priv, u16 queue)
+{
+	struct tc956xmac_packet_attrs attr = { };
+	int size = priv->dma_buf_sz;
+
+	attr.dst = priv->dev->dev_addr;
+	attr.max_size = size - ETH_FCS_LEN;
+	attr.queue_mapping = queue;
+
+	return __tc956xmac_test_loopback(priv, &attr);
+}
+
+static int tc956xmac_test_jumbo(struct tc956xmac_priv *priv)
+{
+	return __tc956xmac_test_jumbo(priv, 0);
+}
+
+#ifdef SELFTEST_NOT_SUPPORTED
+
+static int tc956xmac_test_tbs(struct tc956xmac_priv *priv)
+{
+#define TC956XMAC_TBS_LT_OFFSET		(500 * 1000 * 1000) /* 500 ms*/
+	struct tc956xmac_packet_attrs attr = { };
+	struct tc_etf_qopt_offload qopt;
+	u64 start_time, curr_time = 0;
+	unsigned long flags;
+	int ret, i;
+
+	if (!priv->hwts_tx_en)
+		return -EOPNOTSUPP;
+
+	/* Find first TBS enabled Queue, if any */
+	for (i = 0; i < priv->plat->tx_queues_to_use; i++)
+		if (priv->tx_queue[i].tbs & TC956XMAC_TBS_AVAIL)
+			break;
+
+	if (i >= priv->plat->tx_queues_to_use)
+		return -EOPNOTSUPP;
+
+	qopt.enable = true;
+	qopt.queue = i;
+
+	ret = tc956xmac_tc_setup_etf(priv, &qopt);
+	if (ret)
+		return ret;
+
+	spin_lock_irqsave(&priv->ptp_lock, flags);
+	tc956xmac_get_systime(priv, priv->ptpaddr, &curr_time);
+	spin_unlock_irqrestore(&priv->ptp_lock, flags);
+
+	if (!curr_time) {
+		ret = -EOPNOTSUPP;
+		goto fail_disable;
+	}
+
+	start_time = curr_time;
+	curr_time += TC956XMAC_TBS_LT_OFFSET;
+
+	attr.dst = priv->dev->dev_addr;
+	attr.timestamp = curr_time;
+	attr.timeout = nsecs_to_jiffies(2 * TC956XMAC_TBS_LT_OFFSET);
+	attr.queue_mapping = i;
+
+	ret = __tc956xmac_test_loopback(priv, &attr);
+	if (ret)
+		goto fail_disable;
+
+	/* Check if expected time has elapsed */
+	spin_lock_irqsave(&priv->ptp_lock, flags);
+	tc956xmac_get_systime(priv, priv->ptpaddr, &curr_time);
+	spin_unlock_irqrestore(&priv->ptp_lock, flags);
+
+	if ((curr_time - start_time) < TC956XMAC_TBS_LT_OFFSET)
+		ret = -EINVAL;
+
+fail_disable:
+	qopt.enable = false;
+	tc956xmac_tc_setup_etf(priv, &qopt);
+	return ret;
+}
+
+static int tc956xmac_test_ptp_validate(struct sk_buff *skb,
+				    struct net_device *ndev,
+				    struct packet_type *pt,
+				    struct net_device *orig_ndev)
+{
+	unsigned char dst[ETH_ALEN] = { 0x01, 0x1b, 0x19, 0x00, 0x00, 0x00 };
+	struct tc956xmac_test_priv *tpriv = pt->af_packet_priv;
+	struct ethhdr *ehdr;
+
+	ehdr = (struct ethhdr *)skb_mac_header(skb);
+	if (!ether_addr_equal(ehdr->h_source, orig_ndev->dev_addr))
+		goto out;
+	if (!ether_addr_equal(ehdr->h_dest, dst))
+		goto out;
+
+	tpriv->ok = true;
+	complete(&tpriv->comp);
+out:
+	kfree_skb(skb);
+	return 0;
+}
+
+static int tc956xmac_test_ptp_offload(struct tc956xmac_priv *priv)
+{
+#define TC956XMAC_PTP_CNT			10
+	struct tc956xmac_test_priv *tpriv;
+	int ret, i;
+
+	if (!priv->dma_cap.ptoen)
+		return -EOPNOTSUPP;
+	if (!priv->hwts_tx_en)
+		return -EOPNOTSUPP;
+
+	tpriv = kzalloc(sizeof(*tpriv), GFP_KERNEL);
+	if (!tpriv)
+		return -ENOMEM;
+
+	tpriv->ok = false;
+	init_completion(&tpriv->comp);
+
+	tpriv->pt.type = htons(ETH_P_1588);
+	tpriv->pt.func = tc956xmac_test_ptp_validate;
+	tpriv->pt.dev = priv->dev;
+	tpriv->pt.af_packet_priv = tpriv;
+	dev_add_pack(&tpriv->pt);
+
+	ret = dev_set_promiscuity(priv->dev, 1);
+	if (ret)
+		goto cleanup;
+
+	ret = tc956xmac_set_ptp_offload(priv, priv->ioaddr, true);
+	if (ret)
+		goto cleanup;
+
+	for (i = 0; i < TC956XMAC_PTP_CNT; i++) {
+		wait_for_completion_timeout(&tpriv->comp, TC956XMAC_PTP_TIMEOUT);
+		ret = tpriv->ok ? 0 : -ETIMEDOUT;
+		if (ret)
+			goto cleanup;
+	}
+
+cleanup:
+	tc956xmac_set_ptp_offload(priv, priv->ioaddr, false);
+	dev_set_promiscuity(priv->dev, -1);
+	dev_remove_pack(&tpriv->pt);
+	kfree(tpriv);
+	return ret;
+}
+#endif
+
+#define TC956XMAC_LOOPBACK_NONE	0
+#define TC956XMAC_LOOPBACK_MAC	1
+#define TC956XMAC_LOOPBACK_PHY	2
+
+static const struct tc956xmac_test {
+	char name[ETH_GSTRING_LEN];
+	int lb;
+	int (*fn)(struct tc956xmac_priv *priv);
+} tc956xmac_selftests[] = {
+	{
+		.name = "MAC Loopback               ",
+		.lb = TC956XMAC_LOOPBACK_MAC,
+		.fn = tc956xmac_test_mac_loopback,
+	}, {
+		.name = "PHY Loopback               ",
+		.lb = TC956XMAC_LOOPBACK_NONE, /* Test will handle it */
+		.fn = tc956xmac_test_phy_loopback,
+	}, {
+		.name = "MMC Counters               ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_mmc,
+	},
+#ifdef SELFTEST_NOT_SUPPORTED
+	{
+		.name = "EEE                        ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_eee,
+	},
+#endif
+	{
+		.name = "Hash Filter MC             ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_hfilt,
+	}, {
+		.name = "Perfect Filter UC          ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_pfilt,
+	}, {
+		.name = "MC Filter                  ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_mcfilt,
+	}, {
+		.name = "UC Filter                  ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_ucfilt,
+	},
+#ifdef SELFTEST_NOT_SUPPORTED
+	{
+		.name = "Flow Control               ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_flowctrl,
+	},
+#endif
+	{
+		.name = "VLAN Filtering             ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_vlanfilt,
+	}, {
+		.name = "VLAN Filtering (perf)      ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_vlanfilt_perfect,
+	},
+#ifdef SELFTEST_NOT_SUPPORTED
+	{
+		.name = "Double VLAN Filter         ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_dvlanfilt,
+	}, {
+		.name = "Double VLAN Filter (perf)  ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_dvlanfilt_perfect,
+	},
+#endif
+#ifdef TC956X_FRP_ENABLE
+	{
+		.name = "Flexible RX Parser         ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_rxp,
+	},
+#endif
+	{
+		.name = "SA Insertion (reg)         ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_reg_sai,
+	}, {
+		.name = "SA Replacement (reg)       ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_reg_sar,
+	}, {
+		.name = "VLAN TX Insertion          ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_vlanoff,
+	}, {
+		.name = "Jumbo Frame                ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_jumbo,
+	},
+#ifdef SELFTEST_NOT_SUPPORTED
+	{
+		.name = "TBS (ETF Scheduler)        ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_tbs,
+	}, {
+		.name = "PTP Offload                ",
+		.lb = TC956XMAC_LOOPBACK_PHY,
+		.fn = tc956xmac_test_ptp_offload,
+	},
+#endif
+};
+
+void tc956xmac_selftest_run(struct net_device *dev,
+			 struct ethtool_test *etest, u64 *buf)
+{
+	struct tc956xmac_priv *priv = netdev_priv(dev);
+	int count = tc956xmac_selftest_get_count(priv);
+	int i, ret, phy_loopback_enabled = 0;
+
+	memset(buf, 0, sizeof(*buf) * count);
+	tc956xmac_test_next_id = 0;
+
+	if (etest->flags != ETH_TEST_FL_OFFLINE) {
+		netdev_err(priv->dev, "Only offline tests are supported\n");
+		etest->flags |= ETH_TEST_FL_FAILED;
+		return;
+	} else if (!netif_carrier_ok(dev)) {
+		netdev_err(priv->dev, "You need valid Link to execute tests\n");
+		etest->flags |= ETH_TEST_FL_FAILED;
+		return;
+	}
+
+	/* Wait for queues drain */
+	msleep(200);
+
+	for (i = 0; i < count; i++) {
+		ret = 0;
+
+		switch (tc956xmac_selftests[i].lb) {
+		case TC956XMAC_LOOPBACK_PHY:
+			ret = -EOPNOTSUPP;
+			if ((dev->phydev) && !(phy_loopback_enabled)) {
+				ret = phy_loopback(dev->phydev, true);
+				msleep(7000);
+				phy_loopback_enabled = 1;
+			} else {
+				ret = 0;
+			}
+
+			if (!ret)
+				break;
+			fallthrough;
+		case TC956XMAC_LOOPBACK_MAC:
+			ret = tc956xmac_set_mac_loopback(priv, priv->ioaddr, true);
+			break;
+		case TC956XMAC_LOOPBACK_NONE:
+			break;
+		default:
+			ret = -EOPNOTSUPP;
+			break;
+		}
+
+		/*
+		 * First tests will always be MAC / PHY loobpack. If any of
+		 * them is not supported we abort earlier.
+		 */
+		if (ret) {
+			netdev_err(priv->dev, "Loopback is not supported\n");
+			etest->flags |= ETH_TEST_FL_FAILED;
+			break;
+		}
+
+		ret = tc956xmac_selftests[i].fn(priv);
+		if (ret && (ret != -EOPNOTSUPP))
+			etest->flags |= ETH_TEST_FL_FAILED;
+		buf[i] = ret;
+
+		switch (tc956xmac_selftests[i].lb) {
+			/* Fallthrough */
+		case TC956XMAC_LOOPBACK_MAC:
+			tc956xmac_set_mac_loopback(priv, priv->ioaddr, false);
+			break;
+		default:
+			break;
+		}
+	}
+
+	if (dev->phydev) {
+		ret = phy_loopback(dev->phydev, false);
+		msleep(7000);
+	}
+}
+
+void tc956xmac_selftest_get_strings(struct tc956xmac_priv *priv, u8 *data)
+{
+	u8 *p = data;
+	int i;
+
+	for (i = 0; i < tc956xmac_selftest_get_count(priv); i++) {
+		snprintf(p, ETH_GSTRING_LEN, "%2d. %s", i + 1,
+			 tc956xmac_selftests[i].name);
+		p += ETH_GSTRING_LEN;
+	}
+}
+
+int tc956xmac_selftest_get_count(struct tc956xmac_priv *priv)
+{
+	return ARRAY_SIZE(tc956xmac_selftests);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/qps615/tc956xmac_tc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/qps615/tc956xmac_tc.c
@@ -0,0 +1,1338 @@
+/*
+ * TC956X ethernet driver.
+ *
+ * tc956xmac_tc.c
+ *
+ * Copyright (C) 2018 Synopsys, Inc. and/or its affiliates.
+ * Copyright (C) 2023 Toshiba Electronic Devices & Storage Corporation
+ *
+ * This file has been derived from the STMicro and Synopsys Linux driver,
+ * and developed or modified for TC956X.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/*! History:
+ *  20 Jan 2021 : Initial Version
+ *  VERSION     : 00-01
+ *
+ *  15 Mar 2021 : Base lined
+ *  VERSION     : 01-00
+ *  10 Nov 2023 : 1. Kernel 6.1 Porting changes
+ *  VERSION     : 01-02-59
+ *
+ *  26 Dec 2023 : 1. Kernel 6.6 Porting changes
+ *              : 2. Added the support for TC commands taprio and flower
+ *  VERSION     : 01-03-59
+ */
+
+#include <net/pkt_cls.h>
+#include <net/tc_act/tc_gact.h>
+#include "common.h"
+#include "tc956xmac.h"
+#include "dwxgmac2.h"
+
+#ifdef TC956X_SRIOV_PF
+static void tc_fill_all_pass_entry(struct tc956xmac_tc_entry *entry)
+#elif defined TC956X_SRIOV_VF
+static void tc_fill_all_pass_entry(struct tc956xmac_tc_entry *entry, struct tc956xmac_priv *priv)
+#endif
+{
+	memset(entry, 0, sizeof(*entry));
+	entry->in_use = true;
+	entry->is_last = true;
+	entry->is_frag = false;
+	entry->prio = ~0x0;
+	entry->handle = 0;
+	entry->val.match_data = 0x0;
+	entry->val.match_en = 0x0;
+	entry->val.af = 1;
+#ifdef TC956X_SRIOV_PF
+	entry->val.dma_ch_no = TC956X_TC_DEFAULT_DMA_CH;
+#elif defined TC956X_SRIOV_VF
+	entry->val.dma_ch_no = (1 << priv->plat->best_effort_ch_no);
+#endif
+}
+
+static struct tc956xmac_tc_entry *tc_find_entry(struct tc956xmac_priv *priv,
+					     struct tc_cls_u32_offload *cls,
+					     bool free)
+{
+	struct tc956xmac_tc_entry *entry, *first = NULL, *dup = NULL;
+	u32 loc = cls->knode.handle;
+	int i;
+
+	for (i = 0; i < priv->tc_entries_max; i++) {
+		entry = &priv->tc_entries[i];
+		if (!entry->in_use && !first && free)
+			first = entry;
+		if ((entry->handle == loc) && !free && !entry->is_frag)
+			dup = entry;
+	}
+
+	if (dup)
+		return dup;
+	if (first) {
+		first->handle = loc;
+		first->in_use = true;
+
+		/* Reset HW values */
+		memset(&first->val, 0, sizeof(first->val));
+	}
+
+	return first;
+}
+
+static int tc_fill_actions(struct tc956xmac_tc_entry *entry,
+			   struct tc956xmac_tc_entry *frag,
+			   struct tc_cls_u32_offload *cls)
+{
+	struct tc956xmac_tc_entry *action_entry = entry;
+	const struct tc_action *act;
+	struct tcf_exts *exts;
+	int i;
+
+	exts = cls->knode.exts;
+	if (!tcf_exts_has_actions(exts))
+		return -EINVAL;
+	if (frag)
+		action_entry = frag;
+
+	tcf_exts_for_each_action(i, act, exts) {
+		/* Accept */
+		if (is_tcf_gact_ok(act)) {
+			action_entry->val.af = 1;
+			break;
+		}
+		/* Drop */
+		if (is_tcf_gact_shot(act)) {
+			action_entry->val.rf = 1;
+			break;
+		}
+
+		/* Unsupported */
+		/* return -EINVAL; */
+	}
+
+	return 0;
+}
+
+static int tc_fill_entry(struct tc956xmac_priv *priv,
+			 struct tc_cls_u32_offload *cls)
+{
+	struct tc956xmac_tc_entry *entry, *frag = NULL;
+	struct tc_u32_sel *sel = cls->knode.sel;
+	u32 off, data, mask, real_off, rem;
+	u32 prio = cls->common.prio << 16;
+	int ret;
+
+	/* Only 1 match per entry */
+	if (sel->nkeys <= 0 || sel->nkeys > 1)
+		return -EINVAL;
+
+	off = sel->keys[0].off << sel->offshift;
+	data = sel->keys[0].val;
+	mask = sel->keys[0].mask;
+
+	switch (ntohs(cls->common.protocol)) {
+	case ETH_P_ALL:
+		break;
+	case ETH_P_IP:
+		off += ETH_HLEN;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (off > priv->tc_off_max)
+		return -EINVAL;
+
+	real_off = off / 4;
+	rem = off % 4;
+
+	entry = tc_find_entry(priv, cls, true);
+	if (!entry)
+		return -EINVAL;
+
+	if (rem) {
+		frag = tc_find_entry(priv, cls, true);
+		if (!frag) {
+			ret = -EINVAL;
+			goto err_unuse;
+		}
+
+		entry->frag_ptr = frag;
+		entry->val.match_en = (mask << (rem * 8)) &
+			GENMASK(31, rem * 8);
+		entry->val.match_data = (data << (rem * 8)) &
+			GENMASK(31, rem * 8);
+		entry->val.frame_offset = real_off;
+		entry->prio = prio;
+
+		frag->val.match_en = (mask >> (rem * 8)) &
+			GENMASK(rem * 8 - 1, 0);
+		frag->val.match_data = (data >> (rem * 8)) &
+			GENMASK(rem * 8 - 1, 0);
+		frag->val.frame_offset = real_off + 1;
+		frag->prio = prio;
+		frag->is_frag = true;
+	} else {
+		entry->frag_ptr = NULL;
+		entry->val.match_en = mask;
+		entry->val.match_data = data;
+		entry->val.frame_offset = real_off;
+		entry->prio = prio;
+	}
+#ifdef TC956X_SRIOV_PF
+	entry->val.dma_ch_no = TC956X_TC_DEFAULT_DMA_CH;
+#elif defined TC956X_SRIOV_VF
+	entry->val.dma_ch_no = (1 << priv->plat->best_effort_ch_no);
+#endif
+	ret = tc_fill_actions(entry, frag, cls);
+	if (ret)
+		goto err_unuse;
+
+	return 0;
+
+err_unuse:
+	if (frag)
+		frag->in_use = false;
+	entry->in_use = false;
+	return ret;
+}
+
+static void tc_unfill_entry(struct tc956xmac_priv *priv,
+			    struct tc_cls_u32_offload *cls)
+{
+	struct tc956xmac_tc_entry *entry;
+
+	entry = tc_find_entry(priv, cls, false);
+	if (!entry)
+		return;
+
+	entry->in_use = false;
+	if (entry->frag_ptr) {
+		entry = entry->frag_ptr;
+		entry->is_frag = false;
+		entry->in_use = false;
+	}
+}
+
+static int tc_config_knode(struct tc956xmac_priv *priv,
+			   struct tc_cls_u32_offload *cls)
+{
+	int ret;
+	u32 val, i = 0;
+	void __iomem *ioaddr = priv->hw->pcsr;
+	struct tc956xmac_rx_parser_cfg *cfg = &priv->plat->rxp_cfg;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+
+	ret = tc_fill_entry(priv, cls);
+	if (ret)
+		return ret;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.frp, flags);
+#endif
+	ret = tc956xmac_rxp_config(priv, priv->hw->pcsr, priv->tc_entries,
+			priv->tc_entries_max);
+	if (ret)
+		goto err_unfill;
+
+	val = readl(ioaddr + XGMAC_MTL_RXP_CONTROL_STATUS);
+	cfg->nve = val & XGMAC_NVE;
+	cfg->npe = val & XGMAC_NVE;
+	for (i = 0 ; i < cfg->nve ; i++)
+		memcpy(&cfg->entries[i], &priv->tc_entries[i].val, sizeof(*cfg->entries));
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.frp, flags);
+#endif
+	return 0;
+
+err_unfill:
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.frp, flags);
+#endif
+	tc_unfill_entry(priv, cls);
+	return ret;
+}
+
+static int tc_delete_knode(struct tc956xmac_priv *priv,
+			   struct tc_cls_u32_offload *cls)
+{
+	int ret;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	/* Set entry and fragments as not used */
+	tc_unfill_entry(priv, cls);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.frp, flags);
+#endif
+
+	ret = tc956xmac_rxp_config(priv, priv->hw->pcsr, priv->tc_entries,
+			priv->tc_entries_max);
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.frp, flags);
+#endif
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int tc_setup_cls_u32(struct tc956xmac_priv *priv,
+			    struct tc_cls_u32_offload *cls)
+{
+#ifdef TC956X_SRIOV_VF
+	/* This is feature not supported from VF as this will impact
+	 * the entire MAC
+	 */
+	return -EOPNOTSUPP;
+#endif
+	switch (cls->command) {
+	case TC_CLSU32_REPLACE_KNODE:
+		tc_unfill_entry(priv, cls);
+		fallthrough;
+	case TC_CLSU32_NEW_KNODE:
+		return tc_config_knode(priv, cls);
+	case TC_CLSU32_DELETE_KNODE:
+		return tc_delete_knode(priv, cls);
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+
+static int tc_rfs_init(struct tc956xmac_priv *priv)
+{
+	int i;
+
+	priv->rfs_entries_max[TC956X_RFS_T_VLAN] = 8;
+	priv->rfs_entries_max[TC956X_RFS_T_LLDP] = 1;
+	priv->rfs_entries_max[TC956X_RFS_T_1588] = 1;
+
+	for (i = 0; i < TC956X_RFS_T_MAX; i++)
+		priv->rfs_entries_total += priv->rfs_entries_max[i];
+
+	priv->rfs_entries = devm_kcalloc(priv->device,
+					 priv->rfs_entries_total,
+					 sizeof(*priv->rfs_entries),
+					 GFP_KERNEL);
+	if (!priv->rfs_entries)
+		return -ENOMEM;
+
+	dev_info(priv->device, "Enabled RFS Flow TC (entries=%d)\n",
+		 priv->rfs_entries_total);
+
+	return 0;
+}
+
+static int tc_init(struct tc956xmac_priv *priv, void *data)
+{
+	struct dma_features *dma_cap = &priv->dma_cap;
+	unsigned int count;
+	int ret, i;
+
+	if (dma_cap->l3l4fnum) {
+		priv->flow_entries_max = dma_cap->l3l4fnum;
+		priv->flow_entries = devm_kcalloc(priv->device,
+						  dma_cap->l3l4fnum,
+						  sizeof(*priv->flow_entries),
+						  GFP_KERNEL);
+		if (!priv->flow_entries)
+			return -ENOMEM;
+
+		for (i = 0; i < priv->flow_entries_max; i++)
+			priv->flow_entries[i].idx = i;
+
+		dev_info(priv->device, "Enabled Flow TC (entries=%d)\n",
+			 priv->flow_entries_max);
+	}
+
+	ret = tc_rfs_init(priv);
+	if (ret)
+		return -ENOMEM;
+
+	/* Fail silently as we can still use remaining features, e.g. CBS */
+	if (!dma_cap->frpsel)
+		return 0;
+
+	switch (dma_cap->frpbs) {
+	case 0x0:
+		priv->tc_off_max = SIXTY_FOUR;
+		break;
+	case 0x1:
+		priv->tc_off_max = ONE_TWENTY_EIGHT;
+		break;
+	case 0x2:
+		priv->tc_off_max = TWO_FIFTY_SIX;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	count = dma_cap->frpes;
+
+	/* Reserve one last filter which lets all pass */
+	priv->tc_entries_max = count;
+	priv->tc_entries = devm_kcalloc(priv->device,
+			count, sizeof(*priv->tc_entries), GFP_KERNEL);
+	if (!priv->tc_entries)
+		return -ENOMEM;
+
+#ifdef TC956X_SRIOV_PF
+	tc_fill_all_pass_entry(&priv->tc_entries[count - 1]);
+#elif defined TC956X_SRIOV_VF
+	tc_fill_all_pass_entry(&priv->tc_entries[count - 1], priv);
+#endif
+
+	dev_info(priv->device, "Enabling HW TC (entries=%d, max_off=%d)\n",
+			priv->tc_entries_max, priv->tc_off_max);
+	return 0;
+}
+
+static int tc_setup_cbs(struct tc956xmac_priv *priv,
+			struct tc_cbs_qopt_offload *qopt)
+{
+	u32 tx_queues_count = priv->plat->tx_queues_to_use;
+	u32 queue = qopt->queue;
+	u32 ptr, speed_div;
+	u32 mode_to_use;
+	u64 value;
+	int ret;
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	unsigned long flags;
+#endif
+	/* Queue 0 is not AVB capable */
+	if (queue <= 0 || queue >= tx_queues_count)
+		return -EINVAL;
+#if defined(TC956X_SRIOV_PF) | defined(TC956X_SRIOV_VF)
+	/* Only allows if Queue is allocated to PF */
+	if (priv->plat->tx_queues_cfg[qopt->queue].mode_to_use ==
+							MTL_QUEUE_DISABLE)
+		return -EINVAL;
+#endif
+	if (!priv->dma_cap.av)
+		return -EOPNOTSUPP;
+
+	mode_to_use = priv->plat->tx_queues_cfg[queue].mode_to_use;
+	/* Return when mode is other than AVB */
+	if (mode_to_use != MTL_QUEUE_AVB) {
+		DBGPR_FUNC(priv->device, "--> %s (mode_to_use != MTL_QUEUE_AVB) mode_to_use %d\n", __func__, mode_to_use);
+		return -EINVAL;
+	}
+
+#ifndef TC956X
+	if (mode_to_use == MTL_QUEUE_DCB && qopt->enable) {
+		ret = tc956xmac_dma_qmode(priv, priv->ioaddr, queue, MTL_QUEUE_AVB);
+		if (ret)
+			return ret;
+
+		priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_AVB;
+	} else if (!qopt->enable) {
+		/* Removed : when called "tc del" code Changing property
+		 * such as mode from AVB to DCB and reset register values
+		 */
+
+		ret = tc956xmac_dma_qmode(priv, priv->ioaddr, queue, MTL_QUEUE_DCB);
+		if (ret)
+			return ret;
+
+		priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
+
+		return 0;
+	}
+#endif
+
+	/* Port Transmit Rate and Speed Divider */
+	switch (priv->speed) {
+	case SPEED_10000:
+		ptr = 32;
+		speed_div = SPD_DIV_10G;
+		break;
+	case SPEED_5000:
+		ptr = 32;
+		speed_div = SPD_DIV_5G;
+		break;
+	case SPEED_2500:
+		ptr = 8;
+		speed_div = SPD_DIV_2_5G;
+		break;
+	case SPEED_1000:
+		ptr = 8;
+		speed_div = SPD_DIV_1G;
+		break;
+	case SPEED_100:
+		ptr = 4;
+		speed_div = SPD_DIV_100M;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_lock_irqsave(&priv->spn_lock.cbs, flags);
+#endif
+	/* Final adjustments for HW */
+	value = div_s64(qopt->idleslope * 1024ll * ptr, speed_div);
+	priv->plat->tx_queues_cfg[queue].idle_slope = value & GENMASK(20, 0);
+
+	value = div_s64(-qopt->sendslope * 1024ll * ptr, speed_div);
+	priv->plat->tx_queues_cfg[queue].send_slope = value & GENMASK(15, 0);
+
+	value = qopt->hicredit * 1024ll * 8;
+	priv->plat->tx_queues_cfg[queue].high_credit = value & GENMASK(28, 0);
+
+	value = qopt->locredit * 1024ll * 8;
+	priv->plat->tx_queues_cfg[queue].low_credit = value & GENMASK(28, 0);
+
+#ifndef TC956X_SRIOV_VF
+	ret = tc956xmac_config_cbs(priv, priv->hw,
+				priv->plat->tx_queues_cfg[queue].send_slope,
+				priv->plat->tx_queues_cfg[queue].idle_slope,
+				priv->plat->tx_queues_cfg[queue].high_credit,
+				priv->plat->tx_queues_cfg[queue].low_credit,
+				queue);
+#elif (defined TC956X_SRIOV_VF)
+	ret = tc956xmac_config_cbs(priv,
+			priv->plat->tx_queues_cfg[queue].send_slope,
+			priv->plat->tx_queues_cfg[queue].idle_slope,
+			priv->plat->tx_queues_cfg[queue].high_credit,
+			priv->plat->tx_queues_cfg[queue].low_credit,
+			queue);
+#endif
+
+	if (ret) {
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+		spin_unlock_irqrestore(&priv->spn_lock.cbs, flags);
+#endif
+		return ret;
+	}
+
+	if (priv->speed == SPEED_100) {
+		priv->cbs_speed100_cfg[queue].send_slope =
+			priv->plat->tx_queues_cfg[queue].send_slope;
+		priv->cbs_speed100_cfg[queue].idle_slope =
+			priv->plat->tx_queues_cfg[queue].idle_slope;
+		priv->cbs_speed100_cfg[queue].high_credit =
+			priv->plat->tx_queues_cfg[queue].high_credit;
+		priv->cbs_speed100_cfg[queue].low_credit =
+			priv->plat->tx_queues_cfg[queue].low_credit;
+	} else if (priv->speed == SPEED_1000) {
+		priv->cbs_speed1000_cfg[queue].send_slope =
+			priv->plat->tx_queues_cfg[queue].send_slope;
+		priv->cbs_speed1000_cfg[queue].idle_slope =
+			priv->plat->tx_queues_cfg[queue].idle_slope;
+		priv->cbs_speed1000_cfg[queue].high_credit =
+			priv->plat->tx_queues_cfg[queue].high_credit;
+		priv->cbs_speed1000_cfg[queue].low_credit =
+			priv->plat->tx_queues_cfg[queue].low_credit;
+	} else if (priv->speed == SPEED_10000) {
+		priv->cbs_speed10000_cfg[queue].send_slope =
+			priv->plat->tx_queues_cfg[queue].send_slope;
+		priv->cbs_speed10000_cfg[queue].idle_slope =
+			priv->plat->tx_queues_cfg[queue].idle_slope;
+		priv->cbs_speed10000_cfg[queue].high_credit =
+			priv->plat->tx_queues_cfg[queue].high_credit;
+		priv->cbs_speed10000_cfg[queue].low_credit =
+			priv->plat->tx_queues_cfg[queue].low_credit;
+	} else if (priv->speed == SPEED_2500) {
+		priv->cbs_speed2500_cfg[queue].send_slope =
+			priv->plat->tx_queues_cfg[queue].send_slope;
+		priv->cbs_speed2500_cfg[queue].idle_slope =
+			priv->plat->tx_queues_cfg[queue].idle_slope;
+		priv->cbs_speed2500_cfg[queue].high_credit =
+			priv->plat->tx_queues_cfg[queue].high_credit;
+		priv->cbs_speed2500_cfg[queue].low_credit =
+			priv->plat->tx_queues_cfg[queue].low_credit;
+	} else if (priv->speed == SPEED_5000) {
+		priv->cbs_speed5000_cfg[queue].send_slope =
+			priv->plat->tx_queues_cfg[queue].send_slope;
+		priv->cbs_speed5000_cfg[queue].idle_slope =
+			priv->plat->tx_queues_cfg[queue].idle_slope;
+		priv->cbs_speed5000_cfg[queue].high_credit =
+			priv->plat->tx_queues_cfg[queue].high_credit;
+		priv->cbs_speed5000_cfg[queue].low_credit =
+			priv->plat->tx_queues_cfg[queue].low_credit;
+	} else {
+	}
+
+#if defined(TC956X_SRIOV_PF) && defined(TC956X_SRIOV_LOCK)
+	spin_unlock_irqrestore(&priv->spn_lock.cbs, flags);
+#endif
+	dev_info(priv->device, "CBS queue %d: send %d, idle %d, hi %d, lo %d\n",
+			queue, qopt->sendslope, qopt->idleslope,
+			qopt->hicredit, qopt->locredit);
+	return 0;
+}
+
+static int tc_parse_flow_actions(struct tc956xmac_priv *priv,
+				 struct flow_action *action,
+				 struct tc956xmac_flow_entry *entry)
+{
+	struct flow_action_entry *act;
+	int i;
+
+	if (!flow_action_has_entries(action))
+		return -EINVAL;
+
+	flow_action_for_each(i, act, action) {
+		switch (act->id) {
+		case FLOW_ACTION_DROP:
+			entry->action |= TC956XMAC_FLOW_ACTION_DROP;
+			return 0;
+		default:
+			break;
+		}
+	}
+
+	/* Nothing to do, maybe inverse filter ? */
+	return 0;
+}
+
+static int tc_add_basic_flow(struct tc956xmac_priv *priv,
+			     struct flow_cls_offload *cls,
+			     struct tc956xmac_flow_entry *entry)
+{
+	struct flow_rule *rule = flow_cls_offload_flow_rule(cls);
+	struct flow_dissector *dissector = rule->match.dissector;
+	struct flow_match_basic match;
+
+	/* Nothing to do here */
+	if (!dissector_uses_key(dissector, FLOW_DISSECTOR_KEY_BASIC))
+		return -EINVAL;
+
+	flow_rule_match_basic(rule, &match);
+	entry->ip_proto = match.key->ip_proto;
+	return 0;
+}
+
+static int tc_add_ip4_flow(struct tc956xmac_priv *priv,
+			   struct flow_cls_offload *cls,
+			   struct tc956xmac_flow_entry *entry)
+{
+	struct flow_rule *rule = flow_cls_offload_flow_rule(cls);
+	struct flow_dissector *dissector = rule->match.dissector;
+	bool inv = entry->action & TC956XMAC_FLOW_ACTION_DROP;
+	struct flow_match_ipv4_addrs match;
+	u32 hw_match;
+	int ret;
+
+	/* Nothing to do here */
+	if (!dissector_uses_key(dissector, FLOW_DISSECTOR_KEY_IPV4_ADDRS))
+		return -EINVAL;
+
+	flow_rule_match_ipv4_addrs(rule, &match);
+	hw_match = ntohl(match.key->src) & ntohl(match.mask->src);
+	if (hw_match) {
+		ret = tc956xmac_config_l3_filter(priv, priv->hw, entry->idx, true,
+					      false, true, inv, hw_match);
+		if (ret)
+			return ret;
+	}
+
+	hw_match = ntohl(match.key->dst) & ntohl(match.mask->dst);
+	if (hw_match) {
+		ret = tc956xmac_config_l3_filter(priv, priv->hw, entry->idx, true,
+					      false, false, inv, hw_match);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int tc_add_ports_flow(struct tc956xmac_priv *priv,
+			     struct flow_cls_offload *cls,
+			     struct tc956xmac_flow_entry *entry)
+{
+	struct flow_rule *rule = flow_cls_offload_flow_rule(cls);
+	struct flow_dissector *dissector = rule->match.dissector;
+	bool inv = entry->action & TC956XMAC_FLOW_ACTION_DROP;
+	struct flow_match_ports match;
+	u32 hw_match;
+	bool is_udp;
+	int ret;
+
+	/* Nothing to do here */
+	if (!dissector_uses_key(dissector, FLOW_DISSECTOR_KEY_PORTS))
+		return -EINVAL;
+
+	switch (entry->ip_proto) {
+	case IPPROTO_TCP:
+		is_udp = false;
+		break;
+	case IPPROTO_UDP:
+		is_udp = true;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	flow_rule_match_ports(rule, &match);
+
+	hw_match = ntohs(match.key->src) & ntohs(match.mask->src);
+	if (hw_match) {
+		ret = tc956xmac_config_l4_filter(priv, priv->hw, entry->idx, true,
+					      is_udp, true, inv, hw_match);
+		if (ret)
+			return ret;
+	}
+
+	hw_match = ntohs(match.key->dst) & ntohs(match.mask->dst);
+	if (hw_match) {
+		ret = tc956xmac_config_l4_filter(priv, priv->hw, entry->idx, true,
+					      is_udp, false, inv, hw_match);
+		if (ret)
+			return ret;
+	}
+
+	entry->is_l4 = true;
+	return 0;
+}
+
+static struct tc956xmac_flow_entry *tc_find_flow(struct tc956xmac_priv *priv,
+					      struct flow_cls_offload *cls,
+					      bool get_free)
+{
+	int i;
+
+	for (i = 0; i < priv->flow_entries_max; i++) {
+		struct tc956xmac_flow_entry *entry = &priv->flow_entries[i];
+
+		if (entry->cookie == cls->cookie)
+			return entry;
+		if (get_free && (entry->in_use == false))
+			return entry;
+	}
+
+	return NULL;
+}
+
+static struct {
+	int (*fn)(struct tc956xmac_priv *priv, struct flow_cls_offload *cls,
+		  struct tc956xmac_flow_entry *entry);
+} tc_flow_parsers[] = {
+	{ .fn = tc_add_basic_flow },
+	{ .fn = tc_add_ip4_flow },
+	{ .fn = tc_add_ports_flow },
+};
+
+static struct tc956xmac_rfs_entry *tc_find_rfs(struct tc956xmac_priv *priv,
+					    struct flow_cls_offload *cls,
+					    bool get_free)
+{
+	int i;
+
+	for (i = 0; i < priv->rfs_entries_total; i++) {
+		struct tc956xmac_rfs_entry *entry = &priv->rfs_entries[i];
+
+		if (entry->cookie == cls->cookie)
+			return entry;
+		if (get_free && entry->in_use == false)
+			return entry;
+	}
+
+	return NULL;
+}
+
+#define ETHER_TYPE_FULL_MASK	cpu_to_be16(~0)
+
+static int tc_add_ethtype_flow(struct tc956xmac_priv *priv,
+			       struct flow_cls_offload *cls)
+{
+	struct tc956xmac_rfs_entry *entry = tc_find_rfs(priv, cls, false);
+	struct flow_rule *rule = flow_cls_offload_flow_rule(cls);
+	struct flow_dissector *dissector = rule->match.dissector;
+	int tc = tc_classid_to_hwtc(priv->dev, cls->classid);
+	struct flow_match_basic match;
+
+	if (!entry) {
+		entry = tc_find_rfs(priv, cls, true);
+		if (!entry)
+			return -ENOENT;
+	}
+
+	/* Nothing to do here */
+	if (!dissector_uses_key(dissector, FLOW_DISSECTOR_KEY_BASIC))
+		return -EINVAL;
+
+	if (tc < 0) {
+		netdev_err(priv->dev, "Invalid traffic class\n");
+		return -EINVAL;
+	}
+
+	flow_rule_match_basic(rule, &match);
+
+	if (match.mask->n_proto) {
+		u16 etype = ntohs(match.key->n_proto);
+
+		if (match.mask->n_proto != ETHER_TYPE_FULL_MASK) {
+			netdev_err(priv->dev, "Only full mask is supported for EthType filter");
+			return -EINVAL;
+		}
+		switch (etype) {
+		case ETH_P_LLDP:
+			if (priv->rfs_entries_cnt[TC956X_RFS_T_LLDP] >=
+			    priv->rfs_entries_max[TC956X_RFS_T_LLDP])
+				return -ENOENT;
+
+			entry->type = TC956X_RFS_T_LLDP;
+			priv->rfs_entries_cnt[TC956X_RFS_T_LLDP]++;
+
+			tc956xmac_rx_queue_routing(priv, priv->hw,
+						PACKET_DCBCPQ, tc);
+			break;
+		case ETH_P_1588:
+			if (priv->rfs_entries_cnt[TC956X_RFS_T_1588] >=
+			    priv->rfs_entries_max[TC956X_RFS_T_1588])
+				return -ENOENT;
+
+			entry->type = TC956X_RFS_T_1588;
+			priv->rfs_entries_cnt[TC956X_RFS_T_1588]++;
+
+			tc956xmac_rx_queue_routing(priv, priv->hw,
+						PACKET_PTPQ, tc);
+			break;
+		default:
+			netdev_err(priv->dev, "EthType(0x%x) is not supported", etype);
+			return -EINVAL;
+		}
+
+		entry->in_use = true;
+		entry->cookie = cls->cookie;
+		entry->tc = tc;
+		entry->etype = etype;
+
+		return 0;
+	}
+	return -EINVAL;
+}
+
+#define VLAN_PRIO_FULL_MASK (0x07)
+
+static int tc_add_vlan_flow(struct tc956xmac_priv *priv,
+			    struct flow_cls_offload *cls)
+{
+	struct tc956xmac_rfs_entry *entry = tc_find_rfs(priv, cls, false);
+	struct flow_rule *rule = flow_cls_offload_flow_rule(cls);
+	struct flow_dissector *dissector = rule->match.dissector;
+	int tc = tc_classid_to_hwtc(priv->dev, cls->classid);
+	struct flow_match_vlan match;
+
+	if (!entry) {
+		entry = tc_find_rfs(priv, cls, true);
+		if (!entry)
+			return -ENOENT;
+	}
+
+	if (priv->rfs_entries_cnt[TC956X_RFS_T_VLAN] >=
+	    priv->rfs_entries_max[TC956X_RFS_T_VLAN])
+		return -ENOENT;
+
+	/* Nothing to do here */
+	if (!dissector_uses_key(dissector, FLOW_DISSECTOR_KEY_VLAN))
+		return -EINVAL;
+
+	if (tc < 0) {
+		netdev_err(priv->dev, "Invalid traffic class\n");
+		return -EINVAL;
+	}
+
+	flow_rule_match_vlan(rule, &match);
+	if (match.mask->vlan_priority) {
+		u32 prio;
+
+		if (match.mask->vlan_priority != VLAN_PRIO_FULL_MASK) {
+			netdev_err(priv->dev, "Only full mask is supported for VLAN priority");
+			return -EINVAL;
+		}
+
+		prio = BIT(match.key->vlan_priority);
+		tc956xmac_rx_queue_prio(priv, priv->hw, prio, tc);
+
+		entry->in_use = true;
+		entry->cookie = cls->cookie;
+		entry->tc = tc;
+		entry->type = TC956X_RFS_T_VLAN;
+		priv->rfs_entries_cnt[TC956X_RFS_T_VLAN]++;
+	}
+	return 0;
+}
+
+static int tc_add_flow(struct tc956xmac_priv *priv,
+		       struct flow_cls_offload *cls)
+{
+	struct tc956xmac_flow_entry *entry = tc_find_flow(priv, cls, false);
+	struct flow_rule *rule = flow_cls_offload_flow_rule(cls);
+	int i, ret;
+
+	if (!entry) {
+		entry = tc_find_flow(priv, cls, true);
+		if (!entry)
+			return -ENOENT;
+	}
+
+	ret = tc_parse_flow_actions(priv, &rule->action, entry);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < ARRAY_SIZE(tc_flow_parsers); i++) {
+		ret = tc_flow_parsers[i].fn(priv, cls, entry);
+		if (!ret) {
+			entry->in_use = true;
+			continue;
+		}
+	}
+
+	if (!entry->in_use)
+		return -EINVAL;
+
+	entry->cookie = cls->cookie;
+	return 0;
+}
+
+static int tc_del_flow(struct tc956xmac_priv *priv,
+		       struct flow_cls_offload *cls)
+{
+	struct tc956xmac_flow_entry *entry = tc_find_flow(priv, cls, false);
+	int ret;
+
+	if (!entry || !entry->in_use)
+		return -ENOENT;
+
+	if (entry->is_l4) {
+		ret = tc956xmac_config_l4_filter(priv, priv->hw, entry->idx, false,
+					      false, false, false, 0);
+	} else {
+		ret = tc956xmac_config_l3_filter(priv, priv->hw, entry->idx, false,
+					      false, false, false, 0);
+	}
+
+	entry->in_use = false;
+	entry->cookie = 0;
+	entry->is_l4 = false;
+	return ret;
+}
+
+static int tc_del_ethtype_flow(struct tc956xmac_priv *priv,
+			       struct flow_cls_offload *cls)
+{
+	struct tc956xmac_rfs_entry *entry = tc_find_rfs(priv, cls, false);
+
+	if (!entry || !entry->in_use ||
+	    entry->type < TC956X_RFS_T_LLDP ||
+	    entry->type > TC956X_RFS_T_1588)
+		return -ENOENT;
+
+	switch (entry->etype) {
+	case ETH_P_LLDP:
+		tc956xmac_rx_queue_routing(priv, priv->hw,
+					PACKET_DCBCPQ, 0);
+		priv->rfs_entries_cnt[TC956X_RFS_T_LLDP]--;
+		break;
+	case ETH_P_1588:
+		tc956xmac_rx_queue_routing(priv, priv->hw,
+					PACKET_PTPQ, 0);
+		priv->rfs_entries_cnt[TC956X_RFS_T_1588]--;
+		break;
+	default:
+		netdev_err(priv->dev, "EthType(0x%x) is not supported",
+			   entry->etype);
+		return -EINVAL;
+	}
+
+	entry->in_use = false;
+	entry->cookie = 0;
+	entry->tc = 0;
+	entry->etype = 0;
+	entry->type = 0;
+
+	return 0;
+}
+
+static int tc_del_vlan_flow(struct tc956xmac_priv *priv,
+			    struct flow_cls_offload *cls)
+{
+	struct tc956xmac_rfs_entry *entry = tc_find_rfs(priv, cls, false);
+
+	if (!entry || !entry->in_use || entry->type != TC956X_RFS_T_VLAN)
+		return -ENOENT;
+
+	tc956xmac_rx_queue_prio(priv, priv->hw, 0, entry->tc);
+
+	entry->in_use = false;
+	entry->cookie = 0;
+	entry->tc = 0;
+	entry->type = 0;
+
+	priv->rfs_entries_cnt[TC956X_RFS_T_VLAN]--;
+
+	return 0;
+}
+
+static int tc_add_flow_cls(struct tc956xmac_priv *priv,
+			   struct flow_cls_offload *cls)
+{
+	int ret;
+
+	ret = tc_add_flow(priv, cls);
+	if (!ret)
+		return ret;
+	ret = tc_add_ethtype_flow(priv, cls);
+	if (!ret)
+		return ret;
+
+	return tc_add_vlan_flow(priv, cls);
+}
+
+static int tc_del_flow_cls(struct tc956xmac_priv *priv,
+			   struct flow_cls_offload *cls)
+{
+	int ret;
+
+	ret = tc_del_flow(priv, cls);
+	if (!ret)
+		return ret;
+
+	ret = tc_del_ethtype_flow(priv, cls);
+	if (!ret)
+		return ret;
+
+	return tc_del_vlan_flow(priv, cls);
+}
+
+static int tc_setup_cls(struct tc956xmac_priv *priv,
+			struct flow_cls_offload *cls)
+{
+	int ret = 0;
+
+	/* When RSS is enabled, the filtering will be bypassed */
+	if (priv->rss.enable)
+		return -EBUSY;
+
+	switch (cls->command) {
+	case FLOW_CLS_REPLACE:
+		ret = tc_add_flow_cls(priv, cls);
+		break;
+	case FLOW_CLS_DESTROY:
+		ret = tc_del_flow_cls(priv, cls);
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return ret;
+}
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 5, 0)
+struct timespec64 tc956x_calc_basetime(ktime_t old_base_time,
+					   ktime_t current_time,
+					   u64 cycle_time)
+{
+	struct timespec64 time;
+
+	if (ktime_after(old_base_time, current_time)) {
+		time = ktime_to_timespec64(old_base_time);
+	} else {
+		s64 n;
+		ktime_t base_time;
+
+		n = div64_s64(ktime_sub_ns(current_time, old_base_time),
+			      cycle_time);
+		base_time = ktime_add_ns(old_base_time,
+					 (n + 1) * cycle_time);
+
+		time = ktime_to_timespec64(base_time);
+	}
+
+	return time;
+}
+
+static int tc_setup_taprio(struct tc956xmac_priv *priv,
+			   struct tc_taprio_qopt_offload *qopt)
+{
+	u32 size, wid = priv->dma_cap.estwid, dep = priv->dma_cap.estdep;
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	u64 quotient;
+	u32 reminder;
+#endif
+	struct plat_tc956xmacenet_data *plat = priv->plat;
+	struct timespec64 time;
+	bool fpe = false;
+	int i, ret = 0;
+
+	u64 system_time;
+	ktime_t current_time_ns;
+
+	u32 tx_channels_count = priv->plat->tx_queues_to_use;
+	u32 chan = 0;
+	unsigned long gates;
+
+	if (!priv->dma_cap.estsel)
+		return -EOPNOTSUPP;
+
+	switch (wid) {
+	case 0x1:
+		wid = SIXTEEN;
+		break;
+	case 0x2:
+		wid = TWENTY;
+		break;
+	case 0x3:
+		wid = TWENTY_FOUR;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	switch (dep) {
+	case 0x1:
+		dep = SIXTY_FOUR;
+		break;
+	case 0x2:
+		dep = ONE_TWENTY_EIGHT;
+		break;
+	case 0x3:
+		dep = TWO_FIFTY_SIX;
+		break;
+	case 0x4:
+		dep = FIVE_HUNDRED_TWELVE;
+		break;
+	case 0x5:
+		dep = THOUSAND_TWENTY_FOUR;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 4, 5)
+	if (!qopt->enable)
+		goto disable;
+#else
+	if (qopt->cmd == TAPRIO_CMD_DESTROY)
+		goto disable;
+	else if (qopt->cmd != TAPRIO_CMD_REPLACE)
+		return -EOPNOTSUPP;
+#endif
+	if (qopt->num_entries >= dep)
+		return -EINVAL;
+	if (!qopt->base_time)
+		return -ERANGE;
+	if (!qopt->cycle_time)
+		return -ERANGE;
+
+	if (!plat->est) {
+		plat->est = devm_kzalloc(priv->device, sizeof(*plat->est),
+					 GFP_KERNEL);
+		if (!plat->est)
+			return -ENOMEM;
+	} else {
+		memset(plat->est, 0, sizeof(*plat->est));
+	}
+
+	size = qopt->num_entries;
+
+	priv->plat->est->gcl_size = size;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 4, 5)
+	priv->plat->est->enable = qopt->enable;
+#else
+	priv->plat->est->enable = qopt->cmd == TAPRIO_CMD_REPLACE;
+#endif
+	for (i = 0; i < size; i++) {
+		s64 delta_ns = qopt->entries[i].interval;
+		unsigned long gate_list = qopt->entries[i].gate_mask;
+
+		gates = 0;
+		for (chan = 0; chan < tx_channels_count; chan++) {
+#ifdef TC956X_SRIOV_PF
+			if (priv->plat->tx_q_in_use[chan] == TC956X_DISABLE_QUEUE)
+				continue;
+#endif
+
+			if (priv->plat->gate_mask == 1) { /* kernel returns gate_mask with tc_map_to_queue_mask. so queue mask to tc map to be done */
+				if (test_bit(chan, &gate_list))
+					set_bit(priv->plat->tx_queues_cfg[chan].traffic_class, &gates);
+			}
+		}
+
+		if (priv->plat->gate_mask == 0) /* If tc_map_to_queue_mask disabled, then no need of queue mask to tc map */
+			gates = gate_list;
+
+		if (delta_ns > GENMASK(wid, 0))
+			return -ERANGE;
+		if (gates > GENMASK(31 - wid, 0))
+			return -ERANGE;
+
+		switch (qopt->entries[i].command) {
+		case TC_TAPRIO_CMD_SET_GATES:
+			if (fpe)
+				return -EINVAL;
+			break;
+		case TC_TAPRIO_CMD_SET_AND_HOLD:
+			gates |= BIT(0);
+			fpe = true;
+			break;
+		case TC_TAPRIO_CMD_SET_AND_RELEASE:
+			gates &= ~BIT(0);
+			fpe = true;
+			break;
+		default:
+			return -EOPNOTSUPP;
+		}
+
+		priv->plat->est->gcl[i] = delta_ns | (gates << wid);
+	}
+
+	/* Adjust for real system time */
+
+	tc956xmac_get_systime(priv, priv->ptpaddr, &system_time);
+	current_time_ns = ns_to_ktime(system_time);
+	time = tc956x_calc_basetime(qopt->base_time, current_time_ns, qopt->cycle_time);
+
+	tc956xmac_get_systime(priv, priv->ptpaddr, &system_time);
+
+	priv->plat->est->btr[0] = (u32)time.tv_nsec;
+	priv->plat->est->btr[1] = (u32)time.tv_sec;
+#ifndef CONFIG_ARCH_DMA_ADDR_T_64BIT
+	quotient = div_u64_rem(qopt->cycle_time, NSEC_PER_SEC, &reminder);
+	priv->plat->est->ctr[0] = reminder;
+	priv->plat->est->ctr[1] = (u32) quotient;
+#else
+	priv->plat->est->ctr[0] = (u32)(qopt->cycle_time % NSEC_PER_SEC);
+	priv->plat->est->ctr[1] = (u32)(qopt->cycle_time / NSEC_PER_SEC);
+#endif
+
+	if (fpe && !priv->dma_cap.fpesel)
+		return -EOPNOTSUPP;
+#ifdef TC956X_UNSUPPORTED_UNTESTED
+	ret = tc956xmac_fpe_configure(priv, priv->ioaddr,
+				   priv->plat->tx_queues_to_use,
+				   priv->plat->rx_queues_to_use, fpe);
+	if (ret && fpe) {
+		netdev_err(priv->dev, "failed to enable Frame Preemption\n");
+		return ret;
+	}
+#endif
+	ret = tc956xmac_est_configure(priv, priv->ioaddr, priv->plat->est,
+				   priv->plat->clk_ptp_rate);
+	if (ret) {
+		netdev_err(priv->dev, "failed to configure EST\n");
+		goto disable;
+	}
+
+	netdev_info(priv->dev, "configured EST\n");
+	return 0;
+
+disable:
+	priv->plat->est->enable = false;
+	tc956xmac_est_configure(priv, priv->ioaddr, priv->plat->est,
+			     priv->plat->clk_ptp_rate);
+	return ret;
+}
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(6, 2, 16)
+static int tc_query_caps(struct tc956xmac_priv *priv,
+			 struct tc_query_caps_base *base)
+{
+	switch (base->type) {
+	case TC_SETUP_QDISC_TAPRIO: {
+		struct tc_taprio_caps *caps = base->caps;
+
+		if (!priv->dma_cap.estsel)
+			return -EOPNOTSUPP;
+
+		caps->gate_mask_per_txq = true;
+		if (caps->gate_mask_per_txq)
+			priv->plat->gate_mask = 1;
+		else
+			priv->plat->gate_mask = 0;
+
+		return 0;
+	}
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+#endif
+#endif
+
+static int tc_setup_etf(struct tc956xmac_priv *priv,
+			struct tc_etf_qopt_offload *qopt)
+{
+#ifndef TC956X_SRIOV_VF
+	u8 vf;
+#endif
+	bool is_pf_ch = false;
+
+	if (!priv->dma_cap.tbssel)
+		return -EOPNOTSUPP;
+	if (qopt->queue >= priv->plat->tx_queues_to_use)
+		return -EINVAL;
+#ifdef TC956X_SRIOV_VF
+	/* Only allows if Queue is allocated to VF */
+	if (priv->plat->tx_queues_cfg[qopt->queue].mode_to_use ==
+							MTL_QUEUE_DISABLE)
+		return -EINVAL;
+#else
+#ifdef TC956X_AUTOMOTIVE_CONFIG
+	vf = priv->dma_vf_map[qopt->queue];
+	if (vf == 0)
+		is_pf_ch = true;
+
+#else
+	vf = priv->dma_vf_map[qopt->queue];
+	if (vf == 3)
+		is_pf_ch = true;
+#endif
+#endif
+	if (!(priv->tx_queue[qopt->queue].tbs & TC956XMAC_TBS_AVAIL)) {
+		if (is_pf_ch == false && priv->fn_id_info.vf_no != 0)
+			return -EINVAL;
+		else if (is_pf_ch == true)
+			return -EINVAL;
+	}
+
+	if (qopt->enable)
+		priv->tx_queue[qopt->queue].tbs |= TC956XMAC_TBS_EN;
+	else
+		priv->tx_queue[qopt->queue].tbs &= ~TC956XMAC_TBS_EN;
+
+#ifndef TC956X_SRIOV_VF
+	if (is_pf_ch == false && priv->fn_id_info.vf_no == 0)
+		tc956x_mbx_wrap_setup_etf(priv, qopt->queue, vf);
+#endif
+
+	netdev_info(priv->dev, "%s ETF for Queue %d\n",
+		    qopt->enable ? "enabled" : "disabled", qopt->queue);
+	return 0;
+}
+
+const struct tc956xmac_tc_ops dwmac510_tc_ops = {
+	.init = tc_init,
+	.setup_cls_u32 = tc_setup_cls_u32,
+	.setup_cbs = tc_setup_cbs,
+	.setup_cls = tc_setup_cls,
+#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 5, 0)
+	.setup_taprio = tc_setup_taprio,
+#if LINUX_VERSION_CODE > KERNEL_VERSION(6, 2, 16)
+	.query_caps = tc_query_caps,
+#endif
+#endif
+	.setup_etf = tc_setup_etf,
+};
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/Kbuild
+++ linux-qcom-6.8.0/ubuntu/qcom/video/Kbuild
@@ -0,0 +1,75 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+#$(info "VIDEO_KERNEL_ROOT is: $(VIDEO_KERNEL_ROOT)")
+#$(info "MACHINE is: $(MACHINE)")
+
+# Include Architecture configurations
+ifneq ($(KBUILD_EXTRA_CONFIGS),)
+include $(KBUILD_EXTRA_CONFIGS)
+endif
+
+# List of all camera-kernel headers
+video_include_dirs := $(shell dirname `find $(VIDEO_KERNEL_ROOT) -name '*.h'` | uniq)
+
+# Include Kernel headers
+LINUXINCLUDE +=                                 \
+    -I$(KERNEL_ROOT)                            \
+    $(addprefix -I,$(video_include_dirs))         \
+    -I$(VIDEO_KERNEL_ROOT)/vidc/inc \
+    -I$(VIDEO_KERNEL_ROOT)/variant/common/inc \
+    -I$(VIDEO_KERNEL_ROOT)/variant/iris2/inc \
+    -I$(VIDEO_KERNEL_ROOT)/variant/iris3/inc \
+    -I$(VIDEO_KERNEL_ROOT)/platform/common/inc \
+    -I$(VIDEO_KERNEL_ROOT)/platform/qcm6490/inc \
+    -I$(VIDEO_KERNEL_ROOT)/platform/sm8550/inc \
+    -I$(VIDEO_KERNEL_ROOT)/platform/sa8775p/inc \
+    -I$(VIDEO_KERNEL_ROOT)/platform/qcs8300/inc \
+    -I$(VIDEO_KERNEL_ROOT)/include/uapi/vidc/media \
+    -I$(VIDEO_KERNEL_ROOT)/include/uapi/vidc/ \
+    -I$(VIDEO_KERNEL_ROOT)/
+
+# After creating lists, add content of 'ccflags-m' variable to 'ccflags-y' one.
+ccflags-y += ${ccflags-m}
+ccflags-y += -Wmissing-prototypes
+ccflags-y += -Werror
+ccflags-y += -Wno-enum-conversion
+
+iris_vpu-y := \
+                  vidc/src/msm_vidc_debug.o \
+                  vidc/src/msm_vidc_v4l2.o \
+                  vidc/src/msm_vidc_vb2.o \
+                  vidc/src/msm_vidc.o \
+                  vidc/src/msm_vdec.o \
+                  vidc/src/msm_venc.o \
+                  vidc/src/msm_vidc_driver.o \
+                  vidc/src/msm_vidc_control.o \
+                  vidc/src/msm_vidc_buffer.o \
+                  vidc/src/msm_vidc_power.o \
+                  vidc/src/msm_vidc_probe.o \
+                  vidc/src/resources.o \
+                  vidc/src/firmware.o \
+                  vidc/src/msm_vidc_memory.o \
+                  vidc/src/msm_vidc_memory_ext.o \
+                  vidc/src/venus_hfi.o \
+                  vidc/src/venus_hfi_queue.o \
+                  vidc/src/hfi_packet.o \
+                  vidc/src/venus_hfi_response.o \
+                  vidc/src/msm_vidc_fence.o \
+                  vidc/src/msm_vidc_state.o \
+                  platform/common/src/msm_vidc_platform.o \
+                  platform/common/src/msm_vidc_platform_ext.o \
+                  platform/qcm6490/src/msm_vidc_qcm6490.o \
+                  platform/sa8775p/src/msm_vidc_sa8775p.o \
+                  platform/qcs8300/src/msm_vidc_qcs8300.o \
+                  variant/common/src/msm_vidc_variant.o \
+                  variant/iris3/src/msm_vidc_buffer_iris3.o \
+                  variant/iris3/src/msm_vidc_iris3.o \
+                  variant/iris3/src/msm_vidc_power_iris3.o \
+                  variant/iris3/src/msm_vidc_bus_iris3.o \
+                  variant/iris3/src/msm_vidc_clock_iris3.o \
+                  variant/iris2/src/msm_vidc_buffer_iris2.o \
+                  variant/iris2/src/msm_vidc_iris2.o \
+                  variant/iris2/src/msm_vidc_power_iris2.o
+
+obj-m += iris_vpu.o
+BOARD_VENDOR_KERNEL_MODULES += $(KERNEL_MODULES_OUT)/iris_vpu.ko
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/Makefile
+++ linux-qcom-6.8.0/ubuntu/qcom/video/Makefile
@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+M := $(shell pwd)
+KBUILD_OPTIONS += VIDEO_KERNEL_ROOT=$(M)
+
+VIDEO_COMPILE_TIME = $(shell date)
+VIDEO_COMPILE_HOST = $(shell uname -n)
+
+vidc_generated_h: $(shell find . -iname "*.c") $(shell find . -iname "*.h") $(shell find . -iname "*.mk")
+	echo '#define VIDEO_COMPILE_TIME "$(VIDEO_COMPILE_TIME)"' > vidc_generated_h
+	echo '#define VIDEO_COMPILE_HOST "$(VIDEO_COMPILE_HOST)"' >> vidc_generated_h
+
+all:
+	$(MAKE) -C $(KERNEL_SRC) M=$(M) modules $(KBUILD_OPTIONS)
+
+modules: vidc_generated_h
+
+modules_install:
+	$(MAKE) INSTALL_MOD_STRIP=1 -C $(KERNEL_SRC) M=$(M) modules_install
+
+%:
+	$(MAKE) -C $(KERNEL_SRC) M=$(M) $@ $(KBUILD_OPTIONS)
+
+clean:
+	rm -f *.o *.ko *.mod.c *.mod.o *~ .*.cmd
+	rm -rf .tmp_versions
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/include/uapi/vidc/media/v4l2_vidc_extensions.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/include/uapi/vidc/media/v4l2_vidc_extensions.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __V4l2_VIDC_EXTENSIONS_H__
+#define __V4l2_VIDC_EXTENSIONS_H__
+
+#include <linux/types.h>
+#include <linux/v4l2-controls.h>
+
+/* AV1 */
+#ifndef V4L2_PIX_FMT_AV1
+#define V4L2_PIX_FMT_AV1                        v4l2_fourcc('A', 'V', '1', '0')
+#endif
+
+#ifndef V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE
+#define V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE    (3)
+#endif
+
+/* vendor controls start */
+#ifdef V4L2_CTRL_CLASS_CODEC
+#define V4L2_CID_MPEG_VIDC_BASE (V4L2_CTRL_CLASS_CODEC | 0x2000)
+#else
+#define V4L2_CID_MPEG_VIDC_BASE (V4L2_CTRL_CLASS_MPEG | 0x2000)
+#endif
+
+#define V4L2_MPEG_MSM_VIDC_DISABLE 0
+#define V4L2_MPEG_MSM_VIDC_ENABLE 1
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/common/inc/kalama_technology.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/common/inc/kalama_technology.h
@@ -0,0 +1,239 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "perf_static_model.h"
+
+#define ENABLE_FINEBITRATE_SUBUHD60 0
+
+/*
+ * Chipset Generation Technology: SW/FW overhead profiling
+ * need update with new numbers
+ */
+static u32 frequency_table_kalama[2][6] __attribute__((unused)) = {
+	/* //make lowsvs_D1 as invalid; */
+	{533, 444, 366, 338, 240, 0},
+	{800, 666, 549, 507, 360, 0},
+};
+
+ /*
+  * TODO Move to kalama.c
+  * TODO Replace hardcoded values with
+  * ENCODER_VPP_TARGET_CLK_PER_MB_KALAMA in CPP file.
+  */
+
+ /* Tensilica cycles */
+#define DECODER_VPP_FW_OVERHEAD_KALAMA                                                  66234
+
+/* Tensilica cycles; this is measured in Lahaina 1stage with FW profiling */
+#define DECODER_VPPVSP1STAGE_FW_OVERHEAD_KALAMA                                         93000
+
+#define DECODER_VSP_FW_OVERHEAD_KALAMA \
+	(DECODER_VPPVSP1STAGE_FW_OVERHEAD_KALAMA - DECODER_VPP_FW_OVERHEAD_KALAMA)
+
+/* Tensilica cycles; encoder has ARP register */
+#define ENCODER_VPP_FW_OVERHEAD_KALAMA                                                  48405
+
+#define ENCODER_VPPVSP1STAGE_FW_OVERHEAD_KALAMA \
+	(ENCODER_VPP_FW_OVERHEAD_KALAMA + DECODER_VSP_FW_OVERHEAD_KALAMA)
+
+#define DECODER_SW_OVERHEAD_KALAMA                                                      489583
+#define ENCODER_SW_OVERHEAD_KALAMA                                                      489583
+
+/* Video IP Core Technology: pipefloor and pipe penlaty */
+static u32 encoder_vpp_target_clk_per_mb_kalama[2] __attribute__((unused)) = {320, 675};
+static u32 decoder_vpp_target_clk_per_mb_kalama __attribute__((unused)) = 200;
+
+/*
+ * These pipe penalty numbers only applies to 4 pipe
+ * For 2pipe and 1pipe, these numbers need recalibrate
+ */
+static u32 pipe_penalty_kalama[3][3] __attribute__((unused)) = {
+	/* NON AV1 */
+	{1059, 1059, 1059},
+	/* AV1 RECOMMENDED TILE 1080P_V2XH1, UHD_V2X2, 8KUHD_V8X2 */
+	{1410, 1248, 1226},
+	/* AV1 YOUTUBE/NETFLIX TILE 1080P_V4XH2_V4X1, UHD_V8X4_V8X1, 8KUHD_V8X8_V8X1 */
+	{2039, 2464, 1191},
+};
+
+/*
+ * Video IP Core Technology: bitrate constraint
+ * HW limit bitrate table (these values are measured end to end fw/sw impacts are also considered)
+ * TODO Can we convert to Cycles/MB? This will remove DIVISION.
+ */
+static u32 bitrate_table_kalama_2stage_fp[5][10] __attribute__((unused)) = {
+	/* h264 cavlc */
+	{0, 220, 220, 220, 220, 220, 220, 220, 220, 220},
+	/* h264 cabac */
+	{0, 140, 150, 160, 175, 190, 190, 190, 190, 190},
+	/* h265 */
+	{90, 140, 160, 180, 190, 200, 200, 200, 200, 200},
+	/* vp9 */
+	{90, 90, 90, 90, 90, 90, 90, 90, 90, 90},
+	/* av1 */
+	{130, 130, 120, 120, 120, 120, 120, 120, 120, 120},
+};
+
+/*
+ * HW limit bitrate table (these values are measured
+ * end to end fw/sw impacts are also considered)
+ */
+static u32 bitrate_table_kalama_1stage_fp[5][10] __attribute__((unused)) = {
+    /* 1-stage assume IPPP */
+	/* h264 cavlc */
+	{0, 220, 220, 220, 220, 220, 220, 220, 220, 220},
+	/* h264 cabac */
+	{0, 110, 150, 150, 150, 150, 150, 150, 150, 150},
+	/* h265 */
+	{0, 140, 150, 150, 150, 150, 150, 150, 150, 150},
+	/* vp9 */
+	{0, 70, 70, 70, 70, 70, 70, 70, 70, 70},
+	/* av1 */
+	{0, 100, 100, 100, 100, 100, 100, 100, 100, 100},
+};
+
+/* rec pwc and power bitrate table */
+static u32 bitrate_table_kalama_rec_fp[5][10] __attribute__((unused)) = {
+	/* rec. worst bitrate based on bitrate table */
+#if ENABLE_FINEBITRATE_SUBUHD60
+	/* h264 cavlc */
+	{0, 168, 150, 120, 100, 90, 50, 32, 20, 14},
+	/* h264 cabac 8bit */
+	{0, 134, 109, 84, 67, 56, 35, 23, 14, 10},
+	/* h265 10bit assumption */
+	{70, 140, 116, 92, 74, 62, 39, 25, 16, 11},
+	/* vp9 (profiled content from youtube and nflx) */
+	{70, 70, 65, 55, 45, 35, 20, 8, 6, 5},
+	/* av1 (profiled content from youtube and nflx) */
+	{100, 100, 85, 70, 55, 30, 15, 5, 5, 5},
+#else
+	/* h264 cavlc */
+	{0, 168, 150, 120, 100, 90, 90, 90, 90, 90},
+	/* h264 cabac 8bit */
+	{0, 134, 109, 84, 67, 56, 56, 56, 56, 56},
+	/* h265 10bit assumption */
+	{70, 140, 116, 92, 74, 62, 62, 62, 62, 62},
+	/* vp9 */
+	{70, 70, 65, 55, 45, 35, 35, 35, 35, 35},
+	/* av1 */
+	{100, 100, 85, 70, 55, 50, 50, 50, 50, 50},
+#endif
+};
+
+static u32 input_bitrate_fp __attribute__((unused));
+
+/* 8KUHD60; UHD240; 1080p960  with B */
+static u32 fp_pixel_count_bar0 __attribute__((unused)) = 3840 * 2160 * 240;
+/* 8KUHD60; UHD240; 1080p960  without B */
+static u32 fp_pixel_count_bar1 __attribute__((unused)) = 3840 * 2160 * 240;
+/* 1080p720 */
+static u32 fp_pixel_count_bar2 __attribute__((unused)) = 3840 * 2160 * 180;
+/* UHD120 */
+static u32 fp_pixel_count_bar3 __attribute__((unused)) = 3840 * 2160 * 120;
+/* UHD90 */
+static u32 fp_pixel_count_bar4 __attribute__((unused)) = 3840 * 2160 * 90;
+/* UHD60 */
+static u32 fp_pixel_count_bar5 __attribute__((unused)) = 3840 * 2160 * 60;
+/* UHD30; FHD120; HD240 */
+static u32 fp_pixel_count_bar6 __attribute__((unused)) = 3840 * 2160 * 30;
+/* FHD60 */
+static u32 fp_pixel_count_bar7 __attribute__((unused)) = 1920 * 1080 * 60;
+/* FHD30 */
+static u32 fp_pixel_count_bar8 __attribute__((unused)) = 1920 * 1080 * 30;
+/* HD30 */
+static u32 fp_pixel_count_bar9 __attribute__((unused)) = 1280 * 720 * 30;
+
+static u32 codec_encoder_gop_complexity_table_fp[8][3] __attribute__((unused));
+static u32 codec_mbspersession_kalama __attribute__((unused));
+
+static u32 cr_table_basic_kalama[7][4] __attribute__((unused)) = {
+	{1920, 1080, 20, 40},
+	{3840, 2160, 42, 84},
+	{4096, 2160, 44, 88},
+	{4096, 2304, 48, 96},
+	{1280, 720, 7, 14},
+	{2560, 1440, 32, 64},
+	{7680, 4320, 84, 168},
+};
+
+/* 100x */
+static u32 dpbopb_ubwc30_cr_table_cratio_kalama[7][12] __attribute__((unused)) = {
+	{237, 399, 272, 137, 225, 158, 185, 259, 203, 138, 167, 152},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+	{237, 399, 272, 137, 225, 158, 185, 259, 203, 138, 167, 152},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+};
+
+/* 100x */
+static u32 rpb_ubwc30_cr_table_cratio_kalama[7][12] __attribute__((unused)) = {
+	{193, 294, 218, 135, 214, 155, 175, 241, 191, 139, 162, 149},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+	{193, 294, 218, 135, 214, 155, 175, 241, 191, 139, 162, 149},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+};
+
+/* 100x */
+static u32 ipblossy_ubwc30_cr_table_cratio_kalama[7][12] __attribute__((unused)) = {
+	{215, 215, 215, 174, 174, 174, 266, 266, 266, 231, 231, 231},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+	{215, 215, 215, 174, 174, 174, 266, 266, 266, 231, 231, 231},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+};
+
+/* 100x */
+static u32 ipblossless_ubwc30_cr_table_cratio_kalama[7][12] __attribute__((unused)) = {
+	{185, 215, 194, 147, 178, 159, 162, 181, 169, 138, 161, 146},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+	{185, 215, 194, 147, 178, 159, 162, 181, 169, 138, 161, 146},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+};
+
+/* 100x */
+static u32 en_original_compression_factor_rgba_pwd_kalama __attribute__((unused)) = 243;
+/* 100x */
+static u32 en_original_compression_factor_rgba_avg_kalama __attribute__((unused)) = 454;
+
+static u32 av1_num_tiles_kalama[7][3] __attribute__((unused)) = {
+	{2, 1, 1},
+	{4, 2, 2},
+	{4, 2, 2},
+	{4, 2, 2},
+	{1, 1, 1},
+	{2, 1, 1},
+	{16, 4, 4},
+};
+
+/*                                H   I   J         K   L   M      N   O   P
+ *         TotalW   Total R       Frequency         Write         Read
+ * Name                           B   b   P         B   b   P      B   b   P
+ * I3B4b1P    0.5    1.875        3   4   1         1   0   1      2   2   1
+ * I1B2b1P    0.5    1.75         1   2   1         1   0   1      2   2   1
+ * IbP        0.5    1.5          0   1   1         1   0   1      2   2   1
+ * IPP        1      1            0   0   1         1   0   1      2   2   1
+ * P          1      1            0   0   1         1   0   1      2   2   1
+ * smallB     0      2            0   1   0         1   0   1      2   2   1
+ * bigB       1      2            1   0   0         1   0   1      2   2   1
+ *
+ * Total W = SUMPRODUCT(H16:J16, K16 : M16) / SUM(H16:J16)
+ * Total R = SUMPRODUCT(H16:J16, N16 : P16) / SUM(H16:J16)
+ */
+
+/* 1000x */
+static u32 kalama_en_readfactor[7] __attribute__((unused)) = {1000, 1500, 1750, 1875, 1000, 2000, 2000};
+/* 1000x */
+static u32 kalama_en_writefactor[7] __attribute__((unused)) = {1000, 500, 500, 500, 1000, 0, 1000};
+static u32 kalama_en_frame_num_parallel __attribute__((unused)) = 1;
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/common/inc/msm_vidc_platform.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/common/inc/msm_vidc_platform.h
@@ -0,0 +1,388 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_PLATFORM_H_
+#define _MSM_VIDC_PLATFORM_H_
+
+#include <linux/platform_device.h>
+#include <media/v4l2-ctrls.h>
+
+#include "msm_vidc_internal.h"
+#include "msm_vidc_core.h"
+
+#define DDR_TYPE_LPDDR4   0x6
+#define DDR_TYPE_LPDDR4X  0x7
+#define DDR_TYPE_LPDDR5   0x8
+#define DDR_TYPE_LPDDR5X  0x9
+
+#define UBWC_CONFIG(mc, ml, hbb, bs1, bs2, bs3, bsp) \
+{	                                                 \
+	.max_channels = mc,                              \
+	.mal_length = ml,                                \
+	.highest_bank_bit = hbb,                         \
+	.bank_swzl_level = bs1,                          \
+	.bank_swz2_level = bs2,                          \
+	.bank_swz3_level = bs3,                          \
+	.bank_spreading = bsp,                           \
+}
+
+#define EFUSE_ENTRY(sa, s, m, sh, p) \
+{	                                 \
+	.start_address = sa,             \
+	.size = s,                       \
+	.mask = m,                       \
+	.shift = sh,                     \
+	.purpose = p                     \
+}
+
+extern u32 vpe_csc_custom_matrix_coeff[MAX_MATRIX_COEFFS];
+extern u32 vpe_csc_custom_bias_coeff[MAX_BIAS_COEFFS];
+extern u32 vpe_csc_custom_limit_coeff[MAX_LIMIT_COEFFS];
+
+struct bw_table {
+	const char      *name;
+	u32              min_kbps;
+	u32              max_kbps;
+};
+
+struct pd_table {
+	const char      *name;
+};
+
+struct regulator_table {
+	const char      *name;
+	bool             hw_trigger;
+};
+
+struct clk_table {
+	const char      *name;
+	u32              clk_id;
+	bool             scaling;
+};
+
+struct clk_rst_table {
+	const char      *name;
+	bool             exclusive_release;
+};
+
+struct subcache_table {
+	const char      *name;
+	u32              llcc_id;
+};
+
+struct context_bank_table {
+	const char      *name;
+	u32              start;
+	u32              size;
+	bool             secure;
+	bool             dma_coherant;
+	u32              region;
+	u64              dma_mask;
+};
+
+struct freq_table {
+	unsigned long    freq;
+};
+
+struct reg_preset_table {
+	u32              reg;
+	u32              value;
+	u32              mask;
+};
+
+struct device_region_table {
+	const char      *name;
+	phys_addr_t      phy_addr;
+	u32              size;
+	u32              dev_addr;
+	u32              region;
+};
+
+struct msm_vidc_ubwc_config_data {
+	u32              max_channels;
+	u32              mal_length;
+	u32              highest_bank_bit;
+	u32              bank_swzl_level;
+	u32              bank_swz2_level;
+	u32              bank_swz3_level;
+	u32              bank_spreading;
+};
+
+struct codec_info {
+	u32 v4l2_codec;
+	enum msm_vidc_codec_type vidc_codec;
+	const char *pixfmt_name;
+};
+
+struct color_format_info {
+	u32 v4l2_color_format;
+	enum msm_vidc_colorformat_type vidc_color_format;
+	const char *pixfmt_name;
+};
+
+struct color_primaries_info {
+	u32 v4l2_color_primaries;
+	enum msm_vidc_color_primaries vidc_color_primaries;
+};
+
+struct transfer_char_info {
+	u32 v4l2_transfer_char;
+	enum msm_vidc_transfer_characteristics vidc_transfer_char;
+};
+
+struct matrix_coeff_info {
+	u32 v4l2_matrix_coeff;
+	enum msm_vidc_matrix_coefficients vidc_matrix_coeff;
+};
+
+struct msm_platform_core_capability {
+	enum msm_vidc_core_capability_type type;
+	u32 value;
+};
+
+struct msm_platform_inst_capability {
+	enum msm_vidc_inst_capability_type cap_id;
+	enum msm_vidc_domain_type domain;
+	enum msm_vidc_codec_type codec;
+	s32 min;
+	s32 max;
+	u32 step_or_mask;
+	s32 value;
+	u32 v4l2_id;
+	u32 hfi_id;
+	enum msm_vidc_inst_capability_flags flags;
+};
+
+struct msm_platform_inst_cap_dependency {
+	enum msm_vidc_inst_capability_type cap_id;
+	enum msm_vidc_domain_type domain;
+	enum msm_vidc_codec_type codec;
+	enum msm_vidc_inst_capability_type children[MAX_CAP_CHILDREN];
+	int (*adjust)(void *inst, struct v4l2_ctrl *ctrl);
+	int (*set)(void *inst, enum msm_vidc_inst_capability_type cap_id);
+};
+
+struct msm_vidc_compat_handle {
+	const char *compat;
+	int (*init_platform)(struct msm_vidc_core *core);
+	int (*init_iris)(struct msm_vidc_core *core);
+};
+
+struct msm_vidc_csc_coeff {
+	u32 *vpe_csc_custom_matrix_coeff;
+	u32 *vpe_csc_custom_bias_coeff;
+	u32 *vpe_csc_custom_limit_coeff;
+};
+
+struct msm_vidc_efuse_data {
+	u32 start_address;
+	u32 size;
+	u32 mask;
+	u32 shift;
+	enum efuse_purpose purpose;
+};
+
+struct msm_vidc_format_capability {
+	struct codec_info *codec_info;
+	u32 codec_info_size;
+	struct color_format_info *color_format_info;
+	u32 color_format_info_size;
+	struct color_primaries_info *color_prim_info;
+	u32 color_prim_info_size;
+	struct transfer_char_info *transfer_char_info;
+	u32 transfer_char_info_size;
+	struct matrix_coeff_info *matrix_coeff_info;
+	u32 matrix_coeff_info_size;
+};
+
+enum vpu_version {
+	VPU_VERSION_IRIS33 = 1,
+	VPU_VERSION_IRIS33_2P, // IRIS3 2 PIPE
+	VPU_VERSION_IRIS2_2P, // IRIS2 2 PIPE
+};
+
+struct msm_vidc_platform_data {
+	const struct bw_table *bw_tbl;
+	unsigned int bw_tbl_size;
+	const struct regulator_table *regulator_tbl;
+	unsigned int regulator_tbl_size;
+	const struct pd_table *pd_tbl;
+	unsigned int pd_tbl_size;
+	const char * const *opp_tbl;
+	unsigned int opp_tbl_size;
+	const struct clk_table *clk_tbl;
+	unsigned int clk_tbl_size;
+	const struct clk_rst_table *clk_rst_tbl;
+	unsigned int clk_rst_tbl_size;
+	const struct subcache_table *subcache_tbl;
+	unsigned int subcache_tbl_size;
+	const struct context_bank_table *context_bank_tbl;
+	unsigned int context_bank_tbl_size;
+	struct freq_table *freq_tbl;
+	unsigned int freq_tbl_size;
+	const struct reg_preset_table *reg_prst_tbl;
+	unsigned int reg_prst_tbl_size;
+	const struct device_region_table *dev_reg_tbl;
+	unsigned int dev_reg_tbl_size;
+	struct msm_vidc_ubwc_config_data *ubwc_config;
+	const char *fwname;
+	u32 pas_id;
+	bool supports_mmrm;
+	struct msm_platform_core_capability *core_data;
+	u32 core_data_size;
+	struct msm_platform_inst_capability *inst_cap_data;
+	u32 inst_cap_data_size;
+	struct msm_platform_inst_cap_dependency *inst_cap_dependency_data;
+	u32 inst_cap_dependency_data_size;
+	struct msm_vidc_csc_coeff csc_data;
+	struct msm_vidc_efuse_data *efuse_data;
+	unsigned int efuse_data_size;
+	unsigned int sku_version;
+	unsigned int vpu_ver;
+	struct msm_vidc_format_capability *format_data;
+	const u32 *psc_avc_tbl;
+	unsigned int psc_avc_tbl_size;
+	const u32 *psc_hevc_tbl;
+	unsigned int psc_hevc_tbl_size;
+	const u32 *psc_vp9_tbl;
+	unsigned int psc_vp9_tbl_size;
+	const u32 *psc_av1_tbl;
+	unsigned int psc_av1_tbl_size;
+	const u32 *dec_input_prop_avc;
+	unsigned int dec_input_prop_size_avc;
+	const u32 *dec_input_prop_hevc;
+	unsigned int dec_input_prop_size_hevc;
+	const u32 *dec_input_prop_vp9;
+	unsigned int dec_input_prop_size_vp9;
+	const u32 *dec_input_prop_av1;
+	unsigned int dec_input_prop_size_av1;
+	const u32 *dec_output_prop_avc;
+	unsigned int dec_output_prop_size_avc;
+	const u32 *dec_output_prop_hevc;
+	unsigned int dec_output_prop_size_hevc;
+	const u32 *dec_output_prop_vp9;
+	unsigned int dec_output_prop_size_vp9;
+	const u32 *dec_output_prop_av1;
+	unsigned int dec_output_prop_size_av1;
+	const u32  *msm_vidc_ssr_type;
+	unsigned int msm_vidc_ssr_type_size;
+
+};
+
+struct msm_vidc_platform {
+	struct msm_vidc_platform_data data;
+};
+
+static inline bool is_sys_cache_present(struct msm_vidc_core *core)
+{
+	return !!core->platform->data.subcache_tbl_size;
+}
+
+static inline bool is_mmrm_supported(struct msm_vidc_core *core)
+{
+	return !!core->platform->data.supports_mmrm;
+}
+
+int msm_vidc_init_platform(struct msm_vidc_core *core);
+int msm_vidc_read_efuse(struct msm_vidc_core *core);
+
+/* control framework support functions */
+
+enum msm_vidc_inst_capability_type msm_vidc_get_cap_id(struct msm_vidc_inst *inst, u32 id);
+int msm_vidc_update_cap_value(struct msm_vidc_inst *inst, u32 cap,
+			      s32 adjusted_val, const char *func);
+bool is_parent_available(struct msm_vidc_inst *inst, u32 cap_id,
+			 u32 check_parent, const char *func);
+int msm_vidc_get_parent_value(struct msm_vidc_inst *inst, u32 cap, u32 parent,
+			      s32 *value, const char *func);
+u32 msm_vidc_get_port_info(struct msm_vidc_inst *inst,
+			   enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_v4l2_menu_to_hfi(struct msm_vidc_inst *inst,
+			      enum msm_vidc_inst_capability_type cap_id, u32 *value);
+int msm_vidc_v4l2_to_hfi_enum(struct msm_vidc_inst *inst,
+			      enum msm_vidc_inst_capability_type cap_id, u32 *value);
+int msm_vidc_packetize_control(struct msm_vidc_inst *inst,
+			       enum msm_vidc_inst_capability_type cap_id, u32 payload_type,
+			       void *hfi_val, u32 payload_size, const char *func);
+int msm_vidc_adjust_bitrate(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_layer_bitrate(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_bitrate_mode(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_entropy_mode(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_profile(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_ltr_count(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_use_ltr(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_mark_ltr(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_delta_based_rc(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_output_order(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_input_buf_host_max_count(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_output_buf_host_max_count(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_transform_8x8(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_chroma_qp_index_offset(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_slice_count(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_layer_count(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_gop_size(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_b_frame(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_peak_bitrate(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_hevc_min_qp(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_hevc_max_qp(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_hevc_i_frame_qp(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_hevc_p_frame_qp(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_hevc_b_frame_qp(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_blur_type(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_blur_resolution(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_brs(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_bitrate_boost(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_min_quality(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_enc_lowlatency_mode(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_dec_lowlatency_mode(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_session_priority(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_roi_info(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_all_intra(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_dec_outbuf_fence_type(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_dec_outbuf_fence_direction(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_dec_slice_mode(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_preprocess(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_eva_stats(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_sei_mastering_disp(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_sei_cll(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_hdr10plus(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_transcoding_stats(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_set_header_mode(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_deblock_mode(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_min_qp(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_max_qp(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_frame_qp(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_req_sync_frame(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_chroma_qp_index_offset(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_slice_count(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_layer_count_and_type(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_gop_size(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_bitrate(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_layer_bitrate(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_u32(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_u32_packed(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_u32_enum(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_constant_quality(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_vbr_related_properties(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_cbr_related_properties(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_use_and_mark_ltr(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_nal_length(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_session_priority(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_flip(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_rotation(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_blur_resolution(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_stage(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_pipe(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_csc_custom_matrix(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_level(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_preprocess(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_reserve_duration(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_q16(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_vui_timing_info(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_outbuf_fence_type(void *instance, enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_outbuf_fence_direction(void *instance, enum msm_vidc_inst_capability_type cap_id);
+
+#endif // _MSM_VIDC_PLATFORM_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/common/inc/msm_vidc_platform_ext.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/common/inc/msm_vidc_platform_ext.h
@@ -0,0 +1,268 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_PLATFORM_EXT_H_
+#define _MSM_VIDC_PLATFORM_EXT_H_
+
+#include "msm_vidc_control.h"
+
+/* HEIC encoder and decoder */
+#define V4L2_PIX_FMT_VIDC_HEIC                  v4l2_fourcc('H', 'E', 'I', 'C')
+
+#define V4L2_META_FMT_VIDC                      v4l2_fourcc('Q', 'M', 'E', 'T')
+
+#ifndef V4L2_CID_MPEG_VIDC_SECURE
+#define V4L2_CID_MPEG_VIDC_SECURE               (V4L2_CID_MPEG_VIDC_BASE + 0x1)
+#endif
+
+#ifndef V4L2_CID_MPEG_VIDC_LOWLATENCY_REQUEST
+#define V4L2_CID_MPEG_VIDC_LOWLATENCY_REQUEST   (V4L2_CID_MPEG_VIDC_BASE + 0x3)
+#endif
+
+/* FIXme: */
+#define V4L2_CID_MPEG_VIDC_CODEC_CONFIG         (V4L2_CID_MPEG_VIDC_BASE + 0x4)
+#define V4L2_CID_MPEG_VIDC_FRAME_RATE           (V4L2_CID_MPEG_VIDC_BASE + 0x5)
+#define V4L2_CID_MPEG_VIDC_OPERATING_RATE       (V4L2_CID_MPEG_VIDC_BASE + 0x6)
+
+#ifndef V4L2_CID_MPEG_VIDC_TIME_DELTA_BASED_RC
+#define V4L2_CID_MPEG_VIDC_TIME_DELTA_BASED_RC  (V4L2_CID_MPEG_VIDC_BASE + 0xD)
+#endif
+
+/* Encoder quality controls */
+#define V4L2_CID_MPEG_VIDC_CONTENT_ADAPTIVE_CODING                            \
+	(V4L2_CID_MPEG_VIDC_BASE + 0xE)
+#define V4L2_CID_MPEG_VIDC_QUALITY_BITRATE_BOOST                              \
+	(V4L2_CID_MPEG_VIDC_BASE + 0xF)
+#define V4L2_CID_MPEG_VIDC_VIDEO_BLUR_TYPES                                   \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x10)
+enum v4l2_mpeg_vidc_blur_types {
+	VIDC_BLUR_NONE               = 0x0,
+	VIDC_BLUR_EXTERNAL           = 0x1,
+	VIDC_BLUR_ADAPTIVE           = 0x2,
+};
+
+/* (blur width) << 16 | (blur height) */
+#define V4L2_CID_MPEG_VIDC_VIDEO_BLUR_RESOLUTION                              \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x11)
+/* TODO: jdas: compound control for matrix */
+#define V4L2_CID_MPEG_VIDC_VIDEO_VPE_CSC_CUSTOM_MATRIX                        \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x12)
+#define V4L2_CID_MPEG_VIDC_METADATA_LTR_MARK_USE_DETAILS                      \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x13)
+#define V4L2_CID_MPEG_VIDC_METADATA_SEQ_HEADER_NAL                            \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x14)
+#define V4L2_CID_MPEG_VIDC_METADATA_DPB_LUMA_CHROMA_MISR                      \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x15)
+#define V4L2_CID_MPEG_VIDC_METADATA_OPB_LUMA_CHROMA_MISR                      \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x16)
+#define V4L2_CID_MPEG_VIDC_METADATA_INTERLACE                                 \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x17)
+#define V4L2_CID_MPEG_VIDC_METADATA_CONCEALED_MB_COUNT                        \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x18)
+#define V4L2_CID_MPEG_VIDC_METADATA_HISTOGRAM_INFO                            \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x19)
+#define V4L2_CID_MPEG_VIDC_METADATA_SEI_MASTERING_DISPLAY_COLOUR              \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x1A)
+#define V4L2_CID_MPEG_VIDC_METADATA_SEI_CONTENT_LIGHT_LEVEL                   \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x1B)
+#define V4L2_CID_MPEG_VIDC_METADATA_HDR10PLUS                                 \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x1C)
+#define V4L2_CID_MPEG_VIDC_METADATA_EVA_STATS                                 \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x1D)
+#define V4L2_CID_MPEG_VIDC_METADATA_BUFFER_TAG                                \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x1E)
+#define V4L2_CID_MPEG_VIDC_METADATA_SUBFRAME_OUTPUT                           \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x1F)
+#define V4L2_CID_MPEG_VIDC_METADATA_ROI_INFO                                  \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x20)
+#define V4L2_CID_MPEG_VIDC_METADATA_TIMESTAMP                                 \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x21)
+#define V4L2_CID_MPEG_VIDC_METADATA_ENC_QP_METADATA                           \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x22)
+#define V4L2_CID_MPEG_VIDC_MIN_BITSTREAM_SIZE_OVERWRITE                       \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x23)
+#define V4L2_CID_MPEG_VIDC_METADATA_BITSTREAM_RESOLUTION                      \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x24)
+#define V4L2_CID_MPEG_VIDC_METADATA_CROP_OFFSETS                              \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x25)
+#define V4L2_CID_MPEG_VIDC_METADATA_SALIENCY_INFO                             \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x26)
+#define V4L2_CID_MPEG_VIDC_METADATA_TRANSCODE_STAT_INFO                       \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x27)
+
+/* Encoder Super frame control */
+#define V4L2_CID_MPEG_VIDC_SUPERFRAME           (V4L2_CID_MPEG_VIDC_BASE + 0x28)
+/* Thumbnail Mode control */
+#define V4L2_CID_MPEG_VIDC_THUMBNAIL_MODE       (V4L2_CID_MPEG_VIDC_BASE + 0x29)
+
+/* Priority control */
+#ifndef V4L2_CID_MPEG_VIDC_PRIORITY
+#define V4L2_CID_MPEG_VIDC_PRIORITY             (V4L2_CID_MPEG_VIDC_BASE + 0x2A)
+#endif
+
+/* Metadata DPB Tag List*/
+#define V4L2_CID_MPEG_VIDC_METADATA_DPB_TAG_LIST                             \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x2B)
+/* Encoder Input Compression Ratio control */
+#define V4L2_CID_MPEG_VIDC_ENC_INPUT_COMPRESSION_RATIO                       \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x2C)
+#define V4L2_CID_MPEG_VIDC_METADATA_DEC_QP_METADATA                           \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x2E)
+
+/* Encoder Complexity control */
+#ifndef V4L2_CID_MPEG_VIDC_VENC_COMPLEXITY
+#define V4L2_CID_MPEG_VIDC_VENC_COMPLEXITY                                   \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x2F)
+#endif
+
+/* Decoder Max Number of Reorder Frames */
+#ifndef V4L2_CID_MPEG_VIDC_METADATA_MAX_NUM_REORDER_FRAMES
+#define V4L2_CID_MPEG_VIDC_METADATA_MAX_NUM_REORDER_FRAMES                   \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x30)
+#endif
+
+/* Control IDs for AV1 */
+#define V4L2_CID_MPEG_VIDC_AV1_PROFILE        (V4L2_CID_MPEG_VIDC_BASE + 0x31)
+enum v4l2_mpeg_vidc_av1_profile {
+	V4L2_MPEG_VIDC_AV1_PROFILE_MAIN            = 0,
+	V4L2_MPEG_VIDC_AV1_PROFILE_HIGH            = 1,
+	V4L2_MPEG_VIDC_AV1_PROFILE_PROFESSIONAL    = 2,
+};
+
+#define V4L2_CID_MPEG_VIDC_AV1_LEVEL           (V4L2_CID_MPEG_VIDC_BASE + 0x32)
+enum v4l2_mpeg_vidc_av1_level {
+	V4L2_MPEG_VIDC_AV1_LEVEL_2_0  = 0,
+	V4L2_MPEG_VIDC_AV1_LEVEL_2_1  = 1,
+	V4L2_MPEG_VIDC_AV1_LEVEL_2_2  = 2,
+	V4L2_MPEG_VIDC_AV1_LEVEL_2_3  = 3,
+	V4L2_MPEG_VIDC_AV1_LEVEL_3_0  = 4,
+	V4L2_MPEG_VIDC_AV1_LEVEL_3_1  = 5,
+	V4L2_MPEG_VIDC_AV1_LEVEL_3_2  = 6,
+	V4L2_MPEG_VIDC_AV1_LEVEL_3_3  = 7,
+	V4L2_MPEG_VIDC_AV1_LEVEL_4_0  = 8,
+	V4L2_MPEG_VIDC_AV1_LEVEL_4_1  = 9,
+	V4L2_MPEG_VIDC_AV1_LEVEL_4_2  = 10,
+	V4L2_MPEG_VIDC_AV1_LEVEL_4_3  = 11,
+	V4L2_MPEG_VIDC_AV1_LEVEL_5_0  = 12,
+	V4L2_MPEG_VIDC_AV1_LEVEL_5_1  = 13,
+	V4L2_MPEG_VIDC_AV1_LEVEL_5_2  = 14,
+	V4L2_MPEG_VIDC_AV1_LEVEL_5_3  = 15,
+	V4L2_MPEG_VIDC_AV1_LEVEL_6_0  = 16,
+	V4L2_MPEG_VIDC_AV1_LEVEL_6_1  = 17,
+	V4L2_MPEG_VIDC_AV1_LEVEL_6_2  = 18,
+	V4L2_MPEG_VIDC_AV1_LEVEL_6_3  = 19,
+	V4L2_MPEG_VIDC_AV1_LEVEL_7_0  = 20,
+	V4L2_MPEG_VIDC_AV1_LEVEL_7_1  = 21,
+	V4L2_MPEG_VIDC_AV1_LEVEL_7_2  = 22,
+	V4L2_MPEG_VIDC_AV1_LEVEL_7_3  = 23,
+};
+
+#define V4L2_CID_MPEG_VIDC_AV1_TIER        (V4L2_CID_MPEG_VIDC_BASE + 0x33)
+enum v4l2_mpeg_vidc_av1_tier {
+	V4L2_MPEG_VIDC_AV1_TIER_MAIN  = 0,
+	V4L2_MPEG_VIDC_AV1_TIER_HIGH  = 1,
+};
+
+/* Decoder Timestamp Reorder control */
+#define V4L2_CID_MPEG_VIDC_TS_REORDER           (V4L2_CID_MPEG_VIDC_BASE + 0x34)
+/* AV1 Decoder Film Grain */
+#define V4L2_CID_MPEG_VIDC_AV1D_FILM_GRAIN_PRESENT                           \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x35)
+/* Enables Output buffer fence id via input metadata */
+#define V4L2_CID_MPEG_VIDC_METADATA_OUTBUF_FENCE                             \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x38)
+/* Control to set fence id to driver in order get corresponding fence fd */
+#define V4L2_CID_MPEG_VIDC_SW_FENCE_ID                                       \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x39)
+/*
+ * Control to get fence fd from driver for the fence id
+ * set via V4L2_CID_MPEG_VIDC_SW_FENCE_ID
+ */
+#define V4L2_CID_MPEG_VIDC_SW_FENCE_FD                                       \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x3A)
+#define V4L2_CID_MPEG_VIDC_METADATA_PICTURE_TYPE                             \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x3B)
+
+/* Encoder Slice Delivery Mode
+ * set format has a dependency on this control
+ * and gets invoked when this control is updated.
+ */
+#define V4L2_CID_MPEG_VIDC_HEVC_ENCODE_DELIVERY_MODE                          \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x3C)
+
+#define V4L2_CID_MPEG_VIDC_H264_ENCODE_DELIVERY_MODE                          \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x3D)
+
+#define V4L2_CID_MPEG_VIDC_CRITICAL_PRIORITY                                 \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x3E)
+#define V4L2_CID_MPEG_VIDC_RESERVE_DURATION                                  \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x3F)
+
+#define V4L2_CID_MPEG_VIDC_METADATA_DOLBY_RPU                                 \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x40)
+
+#define V4L2_CID_MPEG_VIDC_CLIENT_ID                                          \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x41)
+
+#define V4L2_CID_MPEG_VIDC_LAST_FLAG_EVENT_ENABLE                             \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x42)
+
+#ifndef V4L2_CID_MPEG_VIDC_VUI_TIMING_INFO
+#define V4L2_CID_MPEG_VIDC_VUI_TIMING_INFO                                    \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x43)
+#endif
+
+#define V4L2_CID_MPEG_VIDC_EARLY_NOTIFY_ENABLE                                \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x44)
+
+#define V4L2_CID_MPEG_VIDC_EARLY_NOTIFY_LINE_COUNT                            \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x45)
+
+/*
+ * This control is introduced to overcome v4l2 limitation
+ * of allowing only standard colorspace info via s_fmt.
+ * v4l_sanitize_colorspace() is introduced in s_fmt ioctl
+ * to reject private colorspace. Through this control, client
+ * can set private colorspace info and/or use this control
+ * to set colorspace dynamically.
+ * The control value is 32 bits packed as:
+ *      [ 0 -  7] : matrix coefficients
+ *      [ 8 - 15] : transfer characteristics
+ *      [16 - 23] : colour primaries
+ *      [24 - 31] : range
+ * This control is only for encoder.
+ * Currently g_fmt in v4l2 does not santize colorspace,
+ * hence this control is not introduced for decoder.
+ */
+#define V4L2_CID_MPEG_VIDC_SIGNAL_COLOR_INFO                                  \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x46)
+
+/* control to enable csc */
+#define V4L2_CID_MPEG_VIDC_CSC                                                \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x47)
+
+#define V4L2_CID_MPEG_VIDC_DRIVER_VERSION                                     \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x48)
+
+#define V4L2_CID_MPEG_VIDC_GRID_WIDTH                                         \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x49)
+
+#define V4L2_CID_MPEG_VIDC_MAX_NUM_REORDER_FRAMES                             \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x4A)
+
+#define V4L2_CID_MPEG_VIDC_INTERLACE                                          \
+	(V4L2_CID_MPEG_VIDC_BASE + 0x4B)
+
+int msm_vidc_adjust_ir_period(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_dec_frame_rate(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_dec_operating_rate(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_adjust_delivery_mode(void *instance, struct v4l2_ctrl *ctrl);
+int msm_vidc_set_ir_period(void *instance,
+			   enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_set_signal_color_info(void *instance,
+				   enum msm_vidc_inst_capability_type cap_id);
+int msm_vidc_adjust_csc(void *instance, struct v4l2_ctrl *ctrl);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/common/inc/perf_static_model.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/common/inc/perf_static_model.h
@@ -0,0 +1,240 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _PERF_STATIC_MODEL_H_
+#define _PERF_STATIC_MODEL_H_
+
+#include <linux/types.h>
+
+/* Reordered CODECS to match Bitrate Table rows */
+#define CODEC_H264_CAVLC                        0
+#define CODEC_H264                              1
+#define CODEC_HEVC                              2
+#define CODEC_VP9                               3
+#define CODEC_AV1                               4
+
+#define CODEC_BSE_FrameFactor                   0
+#define CODEC_BSE_MBFactor                      1
+#define CODEC_BSE_LUC_SIZE                      2
+
+#define CODEC_GOP_IPP                           0
+#define CODEC_GOP_IbP                           1
+#define CODEC_GOP_I1B2b1P                       2
+#define CODEC_GOP_I3B4b1P                       3
+#define CODEC_GOP_PONLY                         4
+#define CODEC_GOP_bONLY                         5
+#define CODEC_GOP_BONLY                         6
+#define CODEC_GOP_IONLY                         7
+
+#define CODEC_ENCODER_GOP_Bb_ENTRY              0
+#define CODEC_ENCODER_GOP_P_ENTRY               1
+#define CODEC_ENCODER_GOP_FACTORY_ENTRY         2
+
+#define CODEC_ENTROPY_CODING_CAVLC              0
+#define CODEC_ENTROPY_CODING_CABAC              1
+
+#define CODEC_VSPVPP_MODE_1S                    1
+#define CODEC_VSPVPP_MODE_2S                    2
+
+#define COMP_SETTING_PWC                        0
+#define COMP_SETTING_AVG                        1
+#define COMP_SETTING_POWER                      2
+
+#define CODEC_BITDEPTH_8                        8
+#define CODEC_BITDEPTH_10                       10
+
+#define ENCODE_YUV                              0
+#define ENCODE_RGB                              1
+
+#define COMPLEXITY_PWC                          0
+#define COMPLEXITY_AVG                          1
+#define COMPLEXITY_POWER                        2
+
+#define MAX_LINE                                2048
+#ifndef VENUS_MAX_FILENAME_LENGTH
+#define VENUS_MAX_FILENAME_LENGTH               1024
+#endif
+
+#define CODEC_ENCODER                           1
+#define CODEC_DECODER                           2
+
+#define COMPLEXITY_THRESHOLD                    2
+
+enum chipset_generation {
+	MSM_KONA = 0,
+	MSM_LAHAINA,
+	MSM_WAIPIO,
+	MSM_MAKENA,
+	MSM_KALAMA,
+	MSM_QOGNITION,
+	MSM_PINEAPPLE,
+	MSM_MAX,
+};
+
+enum regression_mode {
+	/* ignores client set cr and bitrate settings */
+	REGRESSION_MODE_SANITY = 1,
+	/* cr and bitrate default mode */
+	REGRESSION_MODE_DEFAULT,
+	/* custom mode where client will set cr and bitrate values */
+	REGRESSION_MODE_CUSTOM,
+};
+
+/*
+ * If firmware provided motion_vector_complexity is >= 2 then set the
+ * complexity_setting as PWC (performance worst case)
+ * If the motion_vector_complexity is < 2 then set the complexity_setting
+ * as AVG (average case value)
+ */
+enum complexity_setting {
+	COMPLEXITY_SETTING_PWC = 0,
+	COMPLEXITY_SETTING_AVG = 1,
+	COMPLEXITY_SETTING_PWR = 2,
+};
+
+/*
+ * If firmware provided motion_vector_complexity is >= 2 then set the
+ * refframe_complexity as PWC (performance worst case)
+ * If the motion_vector_complexity is < 2 then set the refframe_complexity
+ * as AVG (average case value)
+ */
+enum refframe_complexity {
+	REFFRAME_COMPLEXITY_PWC = 4,
+	REFFRAME_COMPLEXITY_AVG = 2,
+	REFFRAME_COMPLEXITY_PWR = 1,
+};
+
+struct api_calculation_input {
+	/*2: decoder; 1: encoder */
+	u32 decoder_or_encoder;
+
+	/* enum chipset_generation */
+	u32 chipset_gen;
+
+	u32 codec;
+	u32 lcu_size;
+	u32 pipe_num;
+	u32 frame_rate;
+	u32 frame_width;
+	u32 frame_height;
+	u32 vsp_vpp_mode;
+	u32 entropy_coding_mode;
+	u32 hierachical_layer;
+
+	/* PWC, AVG/POWER */
+	u32 complexity_setting;
+
+	u32 status_llc_onoff;
+	u32 bitdepth;
+	u32 linear_opb;
+
+	/* AV1D FG */
+	u32 split_opb;
+
+	u32 linear_ipb;
+	u32 lossy_ipb;
+	u32 ipb_yuvrgb;
+	u32 encoder_multiref;
+	u32 bitrate_mbps;
+	u32 refframe_complexity;
+	u32 cr_ipb;
+	u32 cr_rpb;
+	u32 cr_dpb;
+	u32 cr_opb;
+	u32  av1d_commer_tile_enable;
+	u32 regression_mode;
+
+	/* used in aurora for depth map decode */
+	u32 lumaonly_decode;
+
+	/* used in freq and bitrate table selection*/
+	u32 vpu_ver;
+};
+
+struct corner_voting {
+	u32 percent_lowbound;
+	u32 percent_highbound;
+};
+
+struct api_calculation_freq_output {
+	u32 vpp_min_freq;
+	u32 vsp_min_freq;
+	u32 tensilica_min_freq;
+	u32 hw_min_freq;
+	u32 enc_hqmode;
+	struct corner_voting usecase_corner;
+};
+
+struct api_calculation_bw_output {
+	u32 vsp_read_noc;
+	u32 vsp_write_noc;
+	u32 vsp_read_ddr;
+	u32 vsp_write_ddr;
+	u32 vsp_rd_wr_total_noc;
+	u32 vsp_rd_wr_total_ddr;
+
+	u32 collocated_rd_noc;
+	u32 collocated_wr_noc;
+	u32 collocated_rd_ddr;
+	u32 collocated_wr_ddr;
+	u32 collocated_rd_wr_total_noc;
+	u32 collocated_rd_wr_total_ddr;
+
+	u32 dpb_rd_y_noc;
+	u32 dpb_rd_crcb_noc;
+	u32 dpb_rdwr_duetooverlap_noc;
+	u32 dpb_wr_noc;
+	u32 dpb_rd_y_ddr;
+	u32 dpb_rd_crcb_ddr;
+	u32 dpb_rdwr_duetooverlap_ddr;
+	u32 dpb_wr_ddr;
+	u32 dpb_rd_wr_total_noc;
+	u32 dpb_rd_wr_total_ddr;
+
+	u32 opb_write_total_noc;
+	u32 opb_write_total_ddr;
+
+	u32 ipb_rd_total_noc;
+	u32 ipb_rd_total_ddr;
+
+	u32 bse_tlb_rd_noc;
+	u32 bse_tlb_wr_noc;
+	u32 bse_tlb_rd_ddr;
+	u32 bse_tlb_wr_ddr;
+	u32 bse_rd_wr_total_noc;
+	u32 bse_rd_wr_total_ddr;
+
+	u32 statistics_rd_noc;
+	u32 statistics_wr_noc;
+	u32 statistics_rd_ddr;
+	u32 statistics_wr_ddr;
+
+	u32 mmu_rd_noc;
+	u32 mmu_rd_ddr;
+
+	u32 noc_bw_rd;
+	u32 noc_bw_wr;
+	u32 ddr_bw_rd;
+	u32 ddr_bw_wr;
+
+	/* llc BW components for aurora */
+	u32 dpb_rd_y_llc;
+	u32 dpb_rd_crcb_llc;
+	u32 dpb_wr_llc;
+	u32 bse_tlb_rd_llc;
+	u32 bse_tlb_wr_llc;
+	u32 vsp_read_llc;
+	u32 vsp_write_llc;
+
+	u32 llc_bw_rd;
+	u32 llc_bw_wr;
+};
+
+int msm_vidc_calculate_frequency(struct api_calculation_input codec_input,
+				 struct api_calculation_freq_output *codec_output);
+int msm_vidc_calculate_bandwidth(struct api_calculation_input codec_input,
+				 struct api_calculation_bw_output *codec_output);
+
+#endif /*_PERF_STATIC_MODEL_H_ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/common/src/msm_vidc_platform.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/common/src/msm_vidc_platform.c
@@ -0,0 +1,3542 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/io.h>
+#include <linux/of.h>
+
+#include "msm_vidc_platform.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_v4l2.h"
+#include "msm_vidc_vb2.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_memory.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_fence.h"
+#include "hfi_packet.h"
+#include "hfi_property.h"
+#include "venus_hfi.h"
+
+#include "msm_vidc_sa8775p.h"
+#include "msm_vidc_qcs8300.h"
+#include "msm_vidc_qcm6490.h"
+#include "msm_vidc_iris3.h"
+#include "msm_vidc_iris2.h"
+
+#define CAP_TO_8BIT_QP(a) {          \
+	if ((a) < MIN_QP_8BIT)                 \
+		(a) = MIN_QP_8BIT;             \
+}
+
+/*
+ * Below calculation for number of reference frames
+ * is picked up from hfi macro HFI_IRIS3_ENC_RECON_BUF_COUNT
+ */
+#define SLIDING_WINDOW_REF_FRAMES(codec, total_hp_layers, ltr_count, num_ref) {   \
+	if (codec == MSM_VIDC_HEVC) {                                          \
+		num_ref = (total_hp_layers + 1) >> 1;                          \
+	} else if (codec == MSM_VIDC_H264) {                                   \
+		if (total_hp_layers < 4)                                       \
+			num_ref = (total_hp_layers - 1);                       \
+		else                                                           \
+			num_ref = total_hp_layers;                             \
+	}                                                                      \
+	if (ltr_count)                                                         \
+		num_ref = num_ref + ltr_count;                                 \
+}
+
+/*
+ * Custom conversion coefficients for resolution: 176x144 negative
+ * coeffs are converted to s4.9 format
+ * (e.g. -22 converted to ((1 << 13) - 22)
+ * 3x3 transformation matrix coefficients in s4.9 fixed point format
+ */
+u32 vpe_csc_custom_matrix_coeff[MAX_MATRIX_COEFFS] = {
+	440, 8140, 8098, 0, 460, 52, 0, 34, 463
+};
+
+/* offset coefficients in s9 fixed point format */
+u32 vpe_csc_custom_bias_coeff[MAX_BIAS_COEFFS] = {
+	53, 0, 4
+};
+
+/* clamping value for Y/U/V([min,max] for Y/U/V) */
+u32 vpe_csc_custom_limit_coeff[MAX_LIMIT_COEFFS] = {
+	16, 235, 16, 240, 16, 240
+};
+
+static struct v4l2_file_operations msm_v4l2_file_operations = {
+	.owner                          = THIS_MODULE,
+	.open                           = msm_v4l2_open,
+	.release                        = msm_v4l2_close,
+	.unlocked_ioctl                 = video_ioctl2,
+	.poll                           = msm_v4l2_poll,
+	.mmap                           = msm_v4l2_mmap,
+};
+
+static struct v4l2_ioctl_ops msm_v4l2_ioctl_ops_enc = {
+	.vidioc_querycap                = msm_v4l2_querycap,
+	.vidioc_enum_fmt_vid_cap        = msm_v4l2_enum_fmt,
+	.vidioc_enum_fmt_vid_out        = msm_v4l2_enum_fmt,
+	.vidioc_enum_fmt_meta_cap       = msm_v4l2_enum_fmt,
+	.vidioc_enum_fmt_meta_out       = msm_v4l2_enum_fmt,
+	.vidioc_enum_framesizes         = msm_v4l2_enum_framesizes,
+	.vidioc_enum_frameintervals     = msm_v4l2_enum_frameintervals,
+	.vidioc_try_fmt_vid_cap_mplane  = msm_v4l2_try_fmt,
+	.vidioc_try_fmt_vid_out_mplane  = msm_v4l2_try_fmt,
+	.vidioc_try_fmt_meta_cap        = msm_v4l2_try_fmt,
+	.vidioc_try_fmt_meta_out        = msm_v4l2_try_fmt,
+	.vidioc_s_fmt_vid_cap           = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_vid_out           = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_vid_cap_mplane    = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_vid_out_mplane    = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_meta_out          = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_meta_cap          = msm_v4l2_s_fmt,
+	.vidioc_g_fmt_vid_cap           = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_vid_out           = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_vid_cap_mplane    = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_vid_out_mplane    = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_meta_out          = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_meta_cap          = msm_v4l2_g_fmt,
+	.vidioc_g_selection             = msm_v4l2_g_selection,
+	.vidioc_s_selection             = msm_v4l2_s_selection,
+	.vidioc_s_parm                  = msm_v4l2_s_parm,
+	.vidioc_g_parm                  = msm_v4l2_g_parm,
+	.vidioc_reqbufs                 = msm_v4l2_reqbufs,
+	.vidioc_querybuf                = msm_v4l2_querybuf,
+	.vidioc_create_bufs             = msm_v4l2_create_bufs,
+	.vidioc_prepare_buf             = msm_v4l2_prepare_buf,
+	.vidioc_expbuf                  = msm_v4l2_export_buf,
+	.vidioc_qbuf                    = msm_v4l2_qbuf,
+	.vidioc_dqbuf                   = msm_v4l2_dqbuf,
+	.vidioc_streamon                = msm_v4l2_streamon,
+	.vidioc_streamoff               = msm_v4l2_streamoff,
+	.vidioc_queryctrl               = msm_v4l2_queryctrl,
+	.vidioc_querymenu               = msm_v4l2_querymenu,
+	.vidioc_subscribe_event         = msm_v4l2_subscribe_event,
+	.vidioc_unsubscribe_event       = msm_v4l2_unsubscribe_event,
+	.vidioc_try_encoder_cmd         = msm_v4l2_try_encoder_cmd,
+	.vidioc_encoder_cmd             = msm_v4l2_encoder_cmd,
+};
+
+static struct v4l2_ioctl_ops msm_v4l2_ioctl_ops_dec = {
+	.vidioc_querycap                = msm_v4l2_querycap,
+	.vidioc_enum_fmt_vid_cap        = msm_v4l2_enum_fmt,
+	.vidioc_enum_fmt_vid_out        = msm_v4l2_enum_fmt,
+	.vidioc_enum_fmt_meta_cap       = msm_v4l2_enum_fmt,
+	.vidioc_enum_fmt_meta_out       = msm_v4l2_enum_fmt,
+	.vidioc_enum_framesizes         = msm_v4l2_enum_framesizes,
+	.vidioc_enum_frameintervals     = msm_v4l2_enum_frameintervals,
+	.vidioc_try_fmt_vid_cap_mplane  = msm_v4l2_try_fmt,
+	.vidioc_try_fmt_vid_out_mplane  = msm_v4l2_try_fmt,
+	.vidioc_try_fmt_meta_cap        = msm_v4l2_try_fmt,
+	.vidioc_try_fmt_meta_out        = msm_v4l2_try_fmt,
+	.vidioc_s_fmt_vid_cap           = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_vid_out           = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_vid_cap_mplane    = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_vid_out_mplane    = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_meta_out          = msm_v4l2_s_fmt,
+	.vidioc_s_fmt_meta_cap          = msm_v4l2_s_fmt,
+	.vidioc_g_fmt_vid_cap           = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_vid_out           = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_vid_cap_mplane    = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_vid_out_mplane    = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_meta_out          = msm_v4l2_g_fmt,
+	.vidioc_g_fmt_meta_cap          = msm_v4l2_g_fmt,
+	.vidioc_g_selection             = msm_v4l2_g_selection,
+	.vidioc_s_selection             = msm_v4l2_s_selection,
+	.vidioc_reqbufs                 = msm_v4l2_reqbufs,
+	.vidioc_querybuf                = msm_v4l2_querybuf,
+	.vidioc_create_bufs             = msm_v4l2_create_bufs,
+	.vidioc_prepare_buf             = msm_v4l2_prepare_buf,
+	.vidioc_expbuf                  = msm_v4l2_export_buf,
+	.vidioc_qbuf                    = msm_v4l2_qbuf,
+	.vidioc_dqbuf                   = msm_v4l2_dqbuf,
+	.vidioc_streamon                = msm_v4l2_streamon,
+	.vidioc_streamoff               = msm_v4l2_streamoff,
+	.vidioc_queryctrl               = msm_v4l2_queryctrl,
+	.vidioc_querymenu               = msm_v4l2_querymenu,
+	.vidioc_subscribe_event         = msm_v4l2_subscribe_event,
+	.vidioc_unsubscribe_event       = msm_v4l2_unsubscribe_event,
+	.vidioc_try_decoder_cmd         = msm_v4l2_try_decoder_cmd,
+	.vidioc_decoder_cmd             = msm_v4l2_decoder_cmd,
+};
+
+static struct v4l2_ctrl_ops msm_v4l2_ctrl_ops = {
+	.s_ctrl                         = msm_v4l2_op_s_ctrl,
+	.g_volatile_ctrl                = msm_v4l2_op_g_volatile_ctrl,
+};
+
+static struct vb2_ops msm_vb2_ops = {
+	.queue_setup                    = msm_vb2_queue_setup,
+	.start_streaming                = msm_vb2_start_streaming,
+	.buf_queue                      = msm_vb2_buf_queue,
+	.stop_streaming                 = msm_vb2_stop_streaming,
+	.buf_out_validate               = msm_vb2_buf_out_validate,
+	.buf_request_complete           = msm_vb2_request_complete,
+};
+
+static struct vb2_mem_ops msm_vb2_mem_ops = {
+	.alloc                          = msm_vb2_alloc,
+	.put                            = msm_vb2_put,
+	.mmap                           = msm_vb2_mmap,
+	.get_dmabuf                     = msm_vb2_get_dmabuf,
+	.attach_dmabuf                  = msm_vb2_attach_dmabuf,
+	.detach_dmabuf                  = msm_vb2_detach_dmabuf,
+	.map_dmabuf                     = msm_vb2_map_dmabuf,
+	.unmap_dmabuf                   = msm_vb2_unmap_dmabuf,
+};
+
+static struct media_device_ops msm_v4l2_media_ops = {
+	.req_validate                   = msm_v4l2_request_validate,
+	.req_queue                      = msm_v4l2_request_queue,
+};
+
+static struct v4l2_m2m_ops msm_v4l2_m2m_ops = {
+	.device_run                     = msm_v4l2_m2m_device_run,
+	.job_abort                      = msm_v4l2_m2m_job_abort,
+};
+
+static const struct msm_vidc_compat_handle compat_handle[] = {
+	{
+		.compat                     = "qcom,sa8775p-iris",
+		.init_platform              = msm_vidc_init_platform_sa8775p,
+		.init_iris                  = msm_vidc_init_iris3,
+	},
+	{
+		.compat                     = "qcom,qcm6490-iris-vpu",
+		.init_platform              = msm_vidc_init_platform_qcm6490,
+		.init_iris                  = msm_vidc_init_iris2,
+	},
+	{
+		.compat                     = "qcom,qcs8300-iris",
+		.init_platform              = msm_vidc_init_platform_qcs8300,
+		.init_iris                  = msm_vidc_init_iris3,
+	},
+};
+
+static int msm_vidc_init_ops(struct msm_vidc_core *core)
+{
+	d_vpr_h("%s: initialize ops\n", __func__);
+	core->v4l2_file_ops = &msm_v4l2_file_operations;
+	core->v4l2_ioctl_ops_enc = &msm_v4l2_ioctl_ops_enc;
+	core->v4l2_ioctl_ops_dec = &msm_v4l2_ioctl_ops_dec;
+	core->v4l2_ctrl_ops = &msm_v4l2_ctrl_ops;
+	core->vb2_ops = &msm_vb2_ops;
+	core->vb2_mem_ops = &msm_vb2_mem_ops;
+	core->media_device_ops = &msm_v4l2_media_ops;
+	core->v4l2_m2m_ops = &msm_v4l2_m2m_ops;
+	core->mem_ops = get_mem_ops();
+	if (!core->mem_ops) {
+		d_vpr_e("%s: invalid memory ops\n", __func__);
+		return -EINVAL;
+	}
+	core->res_ops = get_resources_ops();
+	if (!core->res_ops) {
+		d_vpr_e("%s: invalid resource ops\n", __func__);
+		return -EINVAL;
+	}
+	core->fence_ops = get_dma_fence_ops();
+	if (!core->fence_ops) {
+		d_vpr_e("%s: invalid dma fence ops\n", __func__);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int msm_vidc_init_platform_variant(struct msm_vidc_core *core)
+{
+	struct device *dev = NULL;
+	int i, rc = 0;
+
+	dev = &core->pdev->dev;
+
+	d_vpr_h("%s()\n", __func__);
+
+	/* select platform based on compatible match */
+	for (i = 0; i < ARRAY_SIZE(compat_handle); i++) {
+		if (of_device_is_compatible(dev->of_node, compat_handle[i].compat)) {
+			rc = compat_handle[i].init_platform(core);
+			if (rc) {
+				d_vpr_e("%s: (%s) init failed with %d\n",
+					__func__, compat_handle[i].compat, rc);
+				return rc;
+			}
+			break;
+		}
+	}
+
+	/* handle unknown compat type */
+	if (i == ARRAY_SIZE(compat_handle)) {
+		d_vpr_e("%s: Unsupported device: (%s)\n", __func__, dev_name(dev));
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int msm_vidc_init_vpu(struct msm_vidc_core *core)
+{
+	struct device *dev = NULL;
+	int i, rc = 0;
+
+	dev = &core->pdev->dev;
+
+	/* select platform based on compatible match */
+	for (i = 0; i < ARRAY_SIZE(compat_handle); i++) {
+		if (of_device_is_compatible(dev->of_node, compat_handle[i].compat)) {
+			rc = compat_handle[i].init_iris(core);
+			if (rc) {
+				d_vpr_e("%s: (%s) init failed with %d\n",
+					__func__, compat_handle[i].compat, rc);
+				return rc;
+			}
+			break;
+		}
+	}
+
+	/* handle unknown compat type */
+	if (i == ARRAY_SIZE(compat_handle)) {
+		d_vpr_e("%s: Unsupported device: (%s)\n", __func__, dev_name(dev));
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int msm_vidc_init_platform(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	struct msm_vidc_platform *platform = NULL;
+
+	d_vpr_h("%s()\n", __func__);
+
+	platform = devm_kzalloc(&core->pdev->dev,
+				sizeof(struct msm_vidc_platform), GFP_KERNEL);
+	if (!platform) {
+		d_vpr_e("%s: failed to alloc memory for platform\n", __func__);
+		return -ENOMEM;
+	}
+
+	core->platform = platform;
+
+	/* selected ops can be re-assigned in platform specific file */
+	rc = msm_vidc_init_ops(core);
+	if (rc)
+		return rc;
+
+	rc = msm_vidc_init_platform_variant(core);
+	if (rc)
+		return rc;
+
+	rc = msm_vidc_init_vpu(core);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_read_efuse(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	void __iomem *base;
+	u32 i = 0, efuse = 0, efuse_data_count = 0;
+	struct msm_vidc_efuse_data *efuse_data = NULL;
+	struct msm_vidc_platform_data *platform_data;
+
+	platform_data = &core->platform->data;
+	efuse_data = platform_data->efuse_data;
+	efuse_data_count = platform_data->efuse_data_size;
+
+	if (!efuse_data)
+		return 0;
+
+	for (i = 0; i < efuse_data_count; i++) {
+		switch (efuse_data[i].purpose) {
+		case SKU_VERSION:
+			base = devm_ioremap(&core->pdev->dev, efuse_data[i].start_address,
+					efuse_data[i].size);
+			if (!base) {
+				d_vpr_e("failed efuse: start %#x, size %d\n",
+					efuse_data[i].start_address,
+					efuse_data[i].size);
+				return -EINVAL;
+			}
+			efuse = readl_relaxed(base);
+			platform_data->sku_version =
+					(efuse & efuse_data[i].mask) >>
+					efuse_data[i].shift;
+			break;
+		default:
+			break;
+		}
+		if (platform_data->sku_version) {
+			d_vpr_h("efuse 0x%x, platform version 0x%x\n",
+				efuse, platform_data->sku_version);
+			break;
+		}
+	}
+	return rc;
+}
+
+/****************** control framework utility functions **********************/
+
+enum msm_vidc_inst_capability_type msm_vidc_get_cap_id(struct msm_vidc_inst *inst, u32 id)
+{
+	enum msm_vidc_inst_capability_type i = INST_CAP_NONE + 1;
+
+	enum msm_vidc_inst_capability_type cap_id = INST_CAP_NONE;
+
+	do {
+		if (inst->capabilities[i].v4l2_id == id) {
+			cap_id = inst->capabilities[i].cap_id;
+			break;
+		}
+		i++;
+	} while (i < INST_CAP_MAX);
+
+	return cap_id;
+}
+
+int msm_vidc_update_cap_value(struct msm_vidc_inst *inst, u32 cap_id,
+			      s32 adjusted_val, const char *func)
+{
+	int prev_value = 0;
+
+	prev_value = inst->capabilities[cap_id].value;
+
+	if (is_meta_cap(inst, cap_id)) {
+		if (adjusted_val & MSM_VIDC_META_ENABLE &&
+		    adjusted_val & MSM_VIDC_META_DYN_ENABLE) {
+			i_vpr_e(inst,
+				"%s: %s cannot be enabled both statically and dynamically",
+				__func__, cap_name(cap_id));
+			return -EINVAL;
+		}
+		/*
+		 * cumulative control value if client set same metadata
+		 * control multiple times.
+		 */
+		if (adjusted_val & MSM_VIDC_META_ENABLE ||
+		    adjusted_val & MSM_VIDC_META_DYN_ENABLE) {
+			/* enable metadata */
+			inst->capabilities[cap_id].value |= adjusted_val;
+		} else {
+			/* disable metadata */
+			inst->capabilities[cap_id].value &= ~adjusted_val;
+		}
+	} else {
+		inst->capabilities[cap_id].value = adjusted_val;
+	}
+
+	if (prev_value != inst->capabilities[cap_id].value) {
+		i_vpr_h(inst,
+			"%s: updated database: name: %s, value: %#x -> %#x\n",
+			func, cap_name(cap_id),
+			prev_value, inst->capabilities[cap_id].value);
+	}
+
+	return 0;
+}
+
+bool is_parent_available(struct msm_vidc_inst *inst,
+			 u32 cap_id, u32 check_parent, const char *func)
+{
+	int i = 0;
+	u32 cap_child;
+
+	if (!is_valid_cap_id(cap_id) || !is_valid_cap_id(check_parent))
+		return false;
+
+	while (i < MAX_CAP_CHILDREN &&
+	       inst->capabilities[check_parent].children[i]) {
+		cap_child = inst->capabilities[check_parent].children[i];
+		if (cap_child == cap_id)
+			return true;
+		i++;
+	}
+
+	i_vpr_e(inst,
+		"%s: missing parent %s for %s\n",
+		func, cap_name(check_parent), cap_name(cap_id));
+	return false;
+}
+
+int msm_vidc_get_parent_value(struct msm_vidc_inst *inst,
+			      u32 cap_id, u32 parent, s32 *value, const char *func)
+{
+	int rc = 0;
+
+	if (is_parent_available(inst, cap_id, parent, func)) {
+		switch (parent) {
+		case BITRATE_MODE:
+			*value = inst->hfi_rc_type;
+			break;
+		case LAYER_TYPE:
+			*value = inst->hfi_layer_type;
+			break;
+		default:
+			*value = inst->capabilities[parent].value;
+			break;
+		}
+	} else {
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+u32 msm_vidc_get_port_info(struct msm_vidc_inst *inst,
+			   enum msm_vidc_inst_capability_type cap_id)
+{
+	if (inst->capabilities[cap_id].flags & CAP_FLAG_INPUT_PORT &&
+	    inst->capabilities[cap_id].flags & CAP_FLAG_OUTPUT_PORT) {
+		if (inst->bufq[OUTPUT_PORT].vb2q->streaming)
+			return get_hfi_port(inst, INPUT_PORT);
+		else
+			return get_hfi_port(inst, OUTPUT_PORT);
+	}
+
+	if (inst->capabilities[cap_id].flags & CAP_FLAG_INPUT_PORT)
+		return get_hfi_port(inst, INPUT_PORT);
+	else if (inst->capabilities[cap_id].flags & CAP_FLAG_OUTPUT_PORT)
+		return get_hfi_port(inst, OUTPUT_PORT);
+	else
+		return HFI_PORT_NONE;
+}
+
+int msm_vidc_v4l2_menu_to_hfi(struct msm_vidc_inst *inst,
+			      enum msm_vidc_inst_capability_type cap_id, u32 *value)
+{
+	switch (cap_id) {
+	case ENTROPY_MODE:
+		switch (inst->capabilities[cap_id].value) {
+		case V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC:
+			*value = 1;
+			break;
+		case V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC:
+			*value = 0;
+			break;
+		default:
+			*value = 1;
+			goto set_default;
+		}
+		return 0;
+	default:
+		i_vpr_e(inst,
+			"%s: mapping not specified for ctrl_id: %#x\n",
+			__func__, inst->capabilities[cap_id].v4l2_id);
+		return -EINVAL;
+	}
+
+set_default:
+	i_vpr_e(inst,
+		"%s: invalid value %d for ctrl id: %#x. Set default: %u\n",
+		__func__, inst->capabilities[cap_id].value,
+		inst->capabilities[cap_id].v4l2_id, *value);
+	return 0;
+}
+
+int msm_vidc_v4l2_to_hfi_enum(struct msm_vidc_inst *inst,
+			      enum msm_vidc_inst_capability_type cap_id, u32 *value)
+{
+	switch (cap_id) {
+	case BITRATE_MODE:
+		*value = inst->hfi_rc_type;
+		return 0;
+	case PROFILE:
+	case LEVEL:
+	case HEVC_TIER:
+	case AV1_TIER:
+	case BLUR_TYPES:
+		*value = inst->capabilities[cap_id].value;
+		return 0;
+	case LAYER_TYPE:
+		if (inst->codec == MSM_VIDC_HEVC) {
+			switch (inst->capabilities[cap_id].value) {
+			case V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B:
+				*value = HFI_HIER_B;
+				break;
+			case V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P:
+				//TODO (AS): check if this is right mapping
+				*value = HFI_HIER_P_SLIDING_WINDOW;
+				break;
+			default:
+				*value = HFI_HIER_P_SLIDING_WINDOW;
+				goto set_default;
+			}
+		}
+		return 0;
+	case ROTATION:
+		switch (inst->capabilities[cap_id].value) {
+		case 0:
+			*value = HFI_ROTATION_NONE;
+			break;
+		case 90:
+			*value = HFI_ROTATION_90;
+			break;
+		case 180:
+			*value = HFI_ROTATION_180;
+			break;
+		case 270:
+			*value = HFI_ROTATION_270;
+			break;
+		default:
+			*value = HFI_ROTATION_NONE;
+			goto set_default;
+		}
+		return 0;
+	case LF_MODE:
+		if (inst->codec == MSM_VIDC_HEVC) {
+			switch (inst->capabilities[cap_id].value) {
+			case V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_ENABLED:
+				*value = HFI_DEBLOCK_ALL_BOUNDARY;
+				break;
+			case V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_DISABLED:
+				*value = HFI_DEBLOCK_DISABLE;
+				break;
+			case DB_HEVC_DISABLE_SLICE_BOUNDARY:
+				*value = HFI_DEBLOCK_DISABLE_AT_SLICE_BOUNDARY;
+				break;
+			default:
+				*value = HFI_DEBLOCK_ALL_BOUNDARY;
+				goto set_default;
+			}
+		} else if (inst->codec == MSM_VIDC_H264) {
+			switch (inst->capabilities[cap_id].value) {
+			case V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED:
+				*value = HFI_DEBLOCK_ALL_BOUNDARY;
+				break;
+			case V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED:
+				*value = HFI_DEBLOCK_DISABLE;
+				break;
+			case DB_H264_DISABLE_SLICE_BOUNDARY:
+				*value = HFI_DEBLOCK_DISABLE_AT_SLICE_BOUNDARY;
+				break;
+			default:
+				*value = HFI_DEBLOCK_ALL_BOUNDARY;
+				goto set_default;
+			}
+		}
+		return 0;
+	case NAL_LENGTH_FIELD:
+		switch (inst->capabilities[cap_id].value) {
+		case V4L2_MPEG_VIDEO_HEVC_SIZE_4:
+			*value = HFI_NAL_LENGTH_SIZE_4;
+			break;
+		default:
+			*value = HFI_NAL_LENGTH_STARTCODES;
+			goto set_default;
+		}
+		return 0;
+	default:
+		i_vpr_e(inst,
+			"%s: mapping not specified for ctrl_id: %#x\n",
+			__func__, inst->capabilities[cap_id].v4l2_id);
+		return -EINVAL;
+	}
+
+set_default:
+	i_vpr_e(inst,
+		"%s: invalid value %d for ctrl id: %#x. Set default: %u\n",
+		__func__, inst->capabilities[cap_id].value,
+		inst->capabilities[cap_id].v4l2_id, *value);
+	return 0;
+}
+
+int msm_vidc_packetize_control(struct msm_vidc_inst *inst,
+			       enum msm_vidc_inst_capability_type cap_id, u32 payload_type,
+			       void *hfi_val, u32 payload_size, const char *func)
+{
+	int rc = 0;
+	u64 payload = 0;
+
+	if (payload_size > sizeof(u32)) {
+		i_vpr_e(inst, "%s: payload size is more than u32 for cap[%d] %s\n",
+			func, cap_id, cap_name(cap_id));
+		return -EINVAL;
+	}
+
+	if (payload_size == sizeof(u32))
+		payload = *(u32 *)hfi_val;
+	else if (payload_size == sizeof(u8))
+		payload = *(u8 *)hfi_val;
+	else if (payload_size == sizeof(u16))
+		payload = *(u16 *)hfi_val;
+
+	i_vpr_h(inst, FMT_STRING_SET_CAP,
+		cap_name(cap_id), inst->capabilities[cap_id].value, payload);
+
+	rc = venus_hfi_session_property(inst,
+					inst->capabilities[cap_id].hfi_id,
+					HFI_HOST_FLAGS_NONE,
+					msm_vidc_get_port_info(inst, cap_id),
+					payload_type,
+					hfi_val,
+					payload_size);
+	if (rc) {
+		i_vpr_e(inst, "%s: failed to set cap[%d] %s to fw\n",
+			func, cap_id, cap_name(cap_id));
+		return rc;
+	}
+
+	return 0;
+}
+
+/*************** End of control framework utility functions ******************/
+
+/*********************** Control Adjust functions ****************************/
+
+int msm_vidc_adjust_entropy_mode(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 profile = -1;
+
+	/* ctrl is always NULL in streamon case */
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[ENTROPY_MODE].value;
+
+	if (inst->codec != MSM_VIDC_H264) {
+		i_vpr_e(inst,
+			"%s: incorrect entry in database. fix the database\n",
+			__func__);
+		return 0;
+	}
+
+	if (msm_vidc_get_parent_value(inst, ENTROPY_MODE, PROFILE, &profile, __func__))
+		return -EINVAL;
+
+	if (profile == V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE ||
+	    profile == V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE)
+		adjusted_value = V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC;
+
+	msm_vidc_update_cap_value(inst, ENTROPY_MODE, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_bitrate_mode(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	int lossless, frame_rc, bitrate_mode, frame_skip;
+	u32 hfi_value = 0;
+
+	bitrate_mode = inst->capabilities[BITRATE_MODE].value;
+	lossless = inst->capabilities[LOSSLESS].value;
+	frame_rc = inst->capabilities[FRAME_RC_ENABLE].value;
+	frame_skip = inst->capabilities[FRAME_SKIP_MODE].value;
+
+	if (lossless ||
+	    (msm_vidc_lossless_encode && inst->codec == MSM_VIDC_HEVC)) {
+		hfi_value = HFI_RC_LOSSLESS;
+		goto update;
+	}
+
+	if (!frame_rc && !is_image_session(inst)) {
+		hfi_value = HFI_RC_OFF;
+		goto update;
+	}
+
+	if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) {
+		hfi_value = HFI_RC_VBR_CFR;
+	} else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_CBR) {
+		if (frame_skip)
+			hfi_value = HFI_RC_CBR_VFR;
+		else
+			hfi_value = HFI_RC_CBR_CFR;
+	} else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_CQ) {
+		hfi_value = HFI_RC_CQ;
+	} else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_MBR) {
+		hfi_value = HFI_RC_MBR;
+	}
+
+update:
+	inst->hfi_rc_type = hfi_value;
+	i_vpr_h(inst, "%s: hfi rc type: %#x\n",
+		__func__, inst->hfi_rc_type);
+
+	return 0;
+}
+
+int msm_vidc_adjust_profile(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 pix_fmt = -1;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[PROFILE].value;
+
+	/* PIX_FMTS dependency is common across all chipsets.
+	 * Hence, PIX_FMTS must be specified as Parent for HEVC profile.
+	 * Otherwise it would be a database error that should be fixed.
+	 */
+	if (msm_vidc_get_parent_value(inst, PROFILE, PIX_FMTS,
+				      &pix_fmt, __func__))
+		return -EINVAL;
+
+	/* 10 bit profile for 10 bit color format */
+	if (pix_fmt == MSM_VIDC_FMT_TP10C || pix_fmt == MSM_VIDC_FMT_P010) {
+		if (is_image_session(inst))
+			adjusted_value = V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE;
+		else
+			adjusted_value = V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10;
+	} else {
+		/* 8 bit profile for 8 bit color format */
+		if (is_image_session(inst))
+			adjusted_value = V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_STILL_PICTURE;
+		else
+			adjusted_value = V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN;
+	}
+
+	msm_vidc_update_cap_value(inst, PROFILE, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_ltr_count(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1, all_intra = 0, pix_fmts = MSM_VIDC_FMT_NONE;
+	s32 layer_type = -1, enh_layer_count = -1;
+	u32 num_ref_frames = 0, max_exceeding_ref_frames = 0;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[LTR_COUNT].value;
+
+	if (msm_vidc_get_parent_value(inst, LTR_COUNT, BITRATE_MODE,
+				      &rc_type, __func__))
+		return -EINVAL;
+
+	if ((rc_type != HFI_RC_OFF &&
+	     rc_type != HFI_RC_CBR_CFR &&
+	     rc_type != HFI_RC_CBR_VFR)) {
+		adjusted_value = 0;
+		i_vpr_h(inst,
+			"%s: ltr count unsupported, rc_type: %#x\n",
+			__func__, rc_type);
+		goto exit;
+	}
+
+	if (is_valid_cap(inst, ALL_INTRA)) {
+		if (msm_vidc_get_parent_value(inst, LTR_COUNT,
+					      ALL_INTRA, &all_intra, __func__))
+			return -EINVAL;
+		if (all_intra) {
+			adjusted_value = 0;
+			goto exit;
+		}
+	}
+
+	if (!msm_vidc_get_parent_value(inst, LTR_COUNT, PIX_FMTS,
+				       &pix_fmts, __func__)) {
+		if (is_10bit_colorformat(pix_fmts))
+			adjusted_value = 0;
+	}
+
+	if (!msm_vidc_get_parent_value(inst, LTR_COUNT, ENH_LAYER_COUNT,
+				       &enh_layer_count, __func__) &&
+	    !msm_vidc_get_parent_value(inst, LTR_COUNT, LAYER_TYPE,
+				       &layer_type, __func__)) {
+		if (layer_type == HFI_HIER_P_SLIDING_WINDOW) {
+			SLIDING_WINDOW_REF_FRAMES(inst->codec,
+						  inst->capabilities[ENH_LAYER_COUNT].value + 1,
+						  adjusted_value, num_ref_frames);
+			if (num_ref_frames > MAX_ENCODING_REFERNCE_FRAMES) {
+				/*
+				 * reduce ltr count to avoid num ref
+				 * frames going beyond limit
+				 */
+				max_exceeding_ref_frames = num_ref_frames -
+					MAX_ENCODING_REFERNCE_FRAMES;
+				if (adjusted_value >= max_exceeding_ref_frames)
+					adjusted_value -= max_exceeding_ref_frames;
+				else
+					adjusted_value = 0;
+			}
+		}
+		i_vpr_h(inst,
+			"%s: ltr count %d enh_layers %d layer_type %d\n",
+			__func__, adjusted_value,
+			inst->capabilities[ENH_LAYER_COUNT].value,
+			layer_type);
+	}
+
+exit:
+	msm_vidc_update_cap_value(inst, LTR_COUNT, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_use_ltr(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, ltr_count;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[USE_LTR].value;
+
+	/*
+	 * Since USE_LTR is only set dynamically, and LTR_COUNT is static
+	 * control, no need to make LTR_COUNT as parent for USE_LTR as
+	 * LTR_COUNT value will always be updated when dynamically USE_LTR
+	 * is set
+	 */
+	ltr_count = inst->capabilities[LTR_COUNT].value;
+	if (!ltr_count)
+		return 0;
+
+	if (adjusted_value <= 0 ||
+	    adjusted_value > ((1 << ltr_count) - 1)) {
+		/*
+		 * USE_LTR is bitmask value, hence should be
+		 * > 0 and <= (2 ^ LTR_COUNT) - 1
+		 */
+		i_vpr_e(inst, "%s: invalid value %d\n",
+			__func__, adjusted_value);
+		return 0;
+	}
+
+	/* USE_LTR value is a bitmask value */
+	msm_vidc_update_cap_value(inst, USE_LTR, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_mark_ltr(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, ltr_count;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[MARK_LTR].value;
+
+	/*
+	 * Since MARK_LTR is only set dynamically, and LTR_COUNT is static
+	 * control, no need to make LTR_COUNT as parent for MARK_LTR as
+	 * LTR_COUNT value will always be updated when dynamically MARK_LTR
+	 * is set
+	 */
+	ltr_count = inst->capabilities[LTR_COUNT].value;
+	if (!ltr_count)
+		return 0;
+
+	if (adjusted_value < 0 ||
+	    adjusted_value > (ltr_count - 1)) {
+		/* MARK_LTR value should be >= 0 and <= (LTR_COUNT - 1) */
+		i_vpr_e(inst, "%s: invalid value %d\n",
+			__func__, adjusted_value);
+		return 0;
+	}
+
+	msm_vidc_update_cap_value(inst, MARK_LTR, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_delta_based_rc(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[TIME_DELTA_BASED_RC].value;
+
+	if (msm_vidc_get_parent_value(inst, TIME_DELTA_BASED_RC, BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	if (rc_type == HFI_RC_OFF || rc_type == HFI_RC_CQ)
+		adjusted_value = 0;
+
+	msm_vidc_update_cap_value(inst, TIME_DELTA_BASED_RC, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_output_order(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	s32 tn_mode = -1, display_delay = -1, display_delay_enable = -1;
+	u32 adjusted_value;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[OUTPUT_ORDER].value;
+
+	if (msm_vidc_get_parent_value(inst, OUTPUT_ORDER, DISPLAY_DELAY,
+				      &display_delay, __func__) ||
+		msm_vidc_get_parent_value(inst, OUTPUT_ORDER, DISPLAY_DELAY_ENABLE,
+					  &display_delay_enable, __func__))
+		return -EINVAL;
+
+	if (display_delay_enable && !display_delay)
+		adjusted_value = 1;
+
+	if (is_valid_cap(inst, THUMBNAIL_MODE)) {
+		if (msm_vidc_get_parent_value(inst, OUTPUT_ORDER, THUMBNAIL_MODE,
+					      &tn_mode, __func__))
+			return -EINVAL;
+
+		if (tn_mode == 1)
+			adjusted_value = 1;
+	}
+
+	msm_vidc_update_cap_value(inst, OUTPUT_ORDER, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_input_buf_host_max_count(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	u32 adjusted_value;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[INPUT_BUF_HOST_MAX_COUNT].value;
+
+	if (msm_vidc_is_super_buffer(inst) || is_image_session(inst))
+		adjusted_value = DEFAULT_MAX_HOST_BURST_BUF_COUNT;
+
+	msm_vidc_update_cap_value(inst, INPUT_BUF_HOST_MAX_COUNT, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_output_buf_host_max_count(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	u32 adjusted_value;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[OUTPUT_BUF_HOST_MAX_COUNT].value;
+
+	if (msm_vidc_is_super_buffer(inst) || is_image_session(inst) ||
+	    is_enc_slice_delivery_mode(inst))
+		adjusted_value = DEFAULT_MAX_HOST_BURST_BUF_COUNT;
+
+	msm_vidc_update_cap_value(inst, OUTPUT_BUF_HOST_MAX_COUNT, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_transform_8x8(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 profile = -1;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[TRANSFORM_8X8].value;
+
+	if (inst->codec != MSM_VIDC_H264) {
+		i_vpr_e(inst,
+			"%s: incorrect entry in database. fix the database\n",
+			__func__);
+		return 0;
+	}
+
+	if (msm_vidc_get_parent_value(inst, TRANSFORM_8X8,
+				      PROFILE, &profile, __func__))
+		return -EINVAL;
+
+	if (profile != V4L2_MPEG_VIDEO_H264_PROFILE_HIGH &&
+	    profile != V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH)
+		adjusted_value = 0;
+
+	msm_vidc_update_cap_value(inst, TRANSFORM_8X8, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_chroma_qp_index_offset(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[CHROMA_QP_INDEX_OFFSET].value;
+
+	if (adjusted_value != MIN_CHROMA_QP_OFFSET)
+		adjusted_value = MAX_CHROMA_QP_OFFSET;
+
+	msm_vidc_update_cap_value(inst, CHROMA_QP_INDEX_OFFSET, adjusted_value, __func__);
+
+	return 0;
+}
+
+static bool msm_vidc_check_all_layer_bitrate_set(struct msm_vidc_inst *inst)
+{
+	bool layer_bitrate_set = true;
+	u32 cap_id = 0, i, enh_layer_count;
+	u32 layer_br_caps[6] = {L0_BR, L1_BR, L2_BR, L3_BR, L4_BR, L5_BR};
+
+	enh_layer_count = inst->capabilities[ENH_LAYER_COUNT].value;
+
+	for (i = 0; i <= enh_layer_count; i++) {
+		if (i >= ARRAY_SIZE(layer_br_caps))
+			break;
+		cap_id = layer_br_caps[i];
+		if (!(inst->capabilities[cap_id].flags & CAP_FLAG_CLIENT_SET)) {
+			layer_bitrate_set = false;
+			break;
+		}
+	}
+
+	return layer_bitrate_set;
+}
+
+static u32 msm_vidc_get_cumulative_bitrate(struct msm_vidc_inst *inst)
+{
+	int i;
+	u32 cap_id = 0;
+	u32 cumulative_br = 0;
+	s32 enh_layer_count;
+	u32 layer_br_caps[6] = {L0_BR, L1_BR, L2_BR, L3_BR, L4_BR, L5_BR};
+
+	enh_layer_count = inst->capabilities[ENH_LAYER_COUNT].value;
+
+	for (i = 0; i <= enh_layer_count; i++) {
+		if (i >= ARRAY_SIZE(layer_br_caps))
+			break;
+		cap_id = layer_br_caps[i];
+		cumulative_br += inst->capabilities[cap_id].value;
+	}
+
+	return cumulative_br;
+}
+
+int msm_vidc_adjust_slice_count(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	struct v4l2_format *output_fmt;
+	s32 adjusted_value, rc_type = -1, slice_mode, all_intra = 0,
+		enh_layer_count = 0;
+	u32 slice_val, mbpf = 0, mbps = 0, max_mbpf = 0, max_mbps = 0, bitrate = 0;
+	u32 update_cap, max_avg_slicesize, output_width, output_height;
+	u32 min_width, min_height, max_width, max_height, fps;
+
+	slice_mode = ctrl ? ctrl->val :
+		inst->capabilities[SLICE_MODE].value;
+
+	if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE)
+		return 0;
+
+	bitrate = inst->capabilities[BIT_RATE].value;
+
+	if (msm_vidc_get_parent_value(inst, SLICE_MODE,
+				      BITRATE_MODE, &rc_type, __func__) ||
+	    msm_vidc_get_parent_value(inst, SLICE_MODE,
+				      ENH_LAYER_COUNT, &enh_layer_count, __func__))
+		return -EINVAL;
+
+	if (enh_layer_count && msm_vidc_check_all_layer_bitrate_set(inst))
+		bitrate = msm_vidc_get_cumulative_bitrate(inst);
+
+	fps = inst->capabilities[FRAME_RATE].value >> 16;
+	if (fps > MAX_SLICES_FRAME_RATE ||
+	    (rc_type != HFI_RC_OFF && rc_type != HFI_RC_CBR_CFR &&
+	    rc_type != HFI_RC_CBR_VFR)) {
+		adjusted_value = V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE;
+		update_cap = SLICE_MODE;
+		i_vpr_h(inst,
+			"%s: slice unsupported, fps: %u, rc_type: %#x\n",
+			__func__, fps, rc_type);
+		goto exit;
+	}
+
+	if (is_valid_cap(inst, ALL_INTRA)) {
+		if (msm_vidc_get_parent_value(inst, SLICE_MODE,
+					      ALL_INTRA, &all_intra, __func__))
+			return -EINVAL;
+
+		if (all_intra == 1) {
+			adjusted_value = V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE;
+			update_cap = SLICE_MODE;
+			i_vpr_h(inst, "%s: slice unsupported, all_intra %d\n", __func__, all_intra);
+			goto exit;
+		}
+	}
+
+	output_fmt = &inst->fmts[OUTPUT_PORT];
+	output_width = output_fmt->fmt.pix_mp.width;
+	output_height = output_fmt->fmt.pix_mp.height;
+
+	max_width = (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) ?
+		MAX_MB_SLICE_WIDTH : MAX_BYTES_SLICE_WIDTH;
+	max_height = (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) ?
+		MAX_MB_SLICE_HEIGHT : MAX_BYTES_SLICE_HEIGHT;
+	min_width = (inst->codec == MSM_VIDC_HEVC) ?
+		MIN_HEVC_SLICE_WIDTH : MIN_AVC_SLICE_WIDTH;
+	min_height = MIN_SLICE_HEIGHT;
+
+	/*
+	 * For V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB:
+	 * - width >= 384 and height >= 128
+	 * - width and height <= 4096
+	 * For V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES:
+	 * - width >= 192 and height >= 128
+	 * - width and height <= 1920
+	 */
+	if (output_width < min_width || output_height < min_height ||
+	    output_width > max_width || output_height > max_width) {
+		adjusted_value = V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE;
+		update_cap = SLICE_MODE;
+		i_vpr_h(inst,
+			"%s: slice unsupported, codec: %#x wxh: [%dx%d]\n",
+			__func__, inst->codec, output_width, output_height);
+		goto exit;
+	}
+
+	mbpf = NUM_MBS_PER_FRAME(output_height, output_width);
+	mbps = NUM_MBS_PER_SEC(output_height, output_width, fps);
+	max_mbpf = NUM_MBS_PER_FRAME(max_height, max_width);
+	max_mbps = NUM_MBS_PER_SEC(max_height, max_width, MAX_SLICES_FRAME_RATE);
+
+	if (mbpf > max_mbpf || mbps > max_mbps) {
+		adjusted_value = V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE;
+		update_cap = SLICE_MODE;
+		i_vpr_h(inst,
+			"%s: Unsupported, mbpf[%u] > max[%u], mbps[%u] > max[%u]\n",
+			__func__, mbpf, max_mbpf, mbps, max_mbps);
+		goto exit;
+	}
+
+	if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) {
+		update_cap = SLICE_MAX_MB;
+		slice_val = inst->capabilities[SLICE_MAX_MB].value;
+		slice_val = max(slice_val, mbpf / MAX_SLICES_PER_FRAME);
+	} else {
+		slice_val = inst->capabilities[SLICE_MAX_BYTES].value;
+		update_cap = SLICE_MAX_BYTES;
+		if (rc_type != HFI_RC_OFF) {
+			max_avg_slicesize = ((bitrate / fps) / 8) /
+				MAX_SLICES_PER_FRAME;
+			slice_val = max(slice_val, max_avg_slicesize);
+		}
+	}
+	adjusted_value = slice_val;
+
+exit:
+	msm_vidc_update_cap_value(inst, update_cap, adjusted_value, __func__);
+
+	return 0;
+}
+
+static int msm_vidc_adjust_static_layer_count_and_type(struct msm_vidc_inst *inst, s32 layer_count)
+{
+	bool hb_requested = false;
+
+	if (!layer_count) {
+		i_vpr_h(inst, "client not enabled layer encoding\n");
+		goto exit;
+	}
+
+	if (inst->hfi_rc_type == HFI_RC_CQ) {
+		i_vpr_h(inst, "rc type is CQ, disabling layer encoding\n");
+		layer_count = 0;
+		goto exit;
+	}
+
+	if (inst->codec == MSM_VIDC_H264) {
+		if (!inst->capabilities[LAYER_ENABLE].value) {
+			layer_count = 0;
+			goto exit;
+		}
+
+		hb_requested = (inst->capabilities[LAYER_TYPE].value ==
+				V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B) ?
+				true : false;
+	} else if (inst->codec == MSM_VIDC_HEVC) {
+		hb_requested = (inst->capabilities[LAYER_TYPE].value ==
+				V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B) ?
+				true : false;
+	}
+
+	if (hb_requested && inst->hfi_rc_type != HFI_RC_VBR_CFR) {
+		i_vpr_h(inst,
+			"%s: HB layer encoding is supported for VBR rc only\n",
+			__func__);
+		layer_count = 0;
+		goto exit;
+	}
+
+	/* decide hfi layer type */
+	if (hb_requested) {
+		inst->hfi_layer_type = HFI_HIER_B;
+	} else {
+		/* HP requested */
+		inst->hfi_layer_type = HFI_HIER_P_SLIDING_WINDOW;
+		if (inst->codec == MSM_VIDC_H264 &&
+		    inst->hfi_rc_type == HFI_RC_VBR_CFR)
+			inst->hfi_layer_type = HFI_HIER_P_HYBRID_LTR;
+	}
+
+	/* sanitize layer count based on layer type and codec, and rc type */
+	if (inst->hfi_layer_type == HFI_HIER_B) {
+		if (layer_count > MAX_ENH_LAYER_HB)
+			layer_count = MAX_ENH_LAYER_HB;
+	} else if (inst->hfi_layer_type == HFI_HIER_P_HYBRID_LTR) {
+		if (layer_count > MAX_AVC_ENH_LAYER_HYBRID_HP)
+			layer_count = MAX_AVC_ENH_LAYER_HYBRID_HP;
+	} else if (inst->hfi_layer_type == HFI_HIER_P_SLIDING_WINDOW) {
+		if (inst->codec == MSM_VIDC_H264) {
+			if (layer_count > MAX_AVC_ENH_LAYER_SLIDING_WINDOW)
+				layer_count = MAX_AVC_ENH_LAYER_SLIDING_WINDOW;
+		} else if (inst->codec == MSM_VIDC_HEVC) {
+			if (inst->hfi_rc_type == HFI_RC_VBR_CFR) {
+				if (layer_count > MAX_HEVC_VBR_ENH_LAYER_SLIDING_WINDOW)
+					layer_count = MAX_HEVC_VBR_ENH_LAYER_SLIDING_WINDOW;
+			} else {
+				if (layer_count > MAX_HEVC_NON_VBR_ENH_LAYER_SLIDING_WINDOW)
+					layer_count = MAX_HEVC_NON_VBR_ENH_LAYER_SLIDING_WINDOW;
+			}
+		}
+	}
+
+exit:
+	msm_vidc_update_cap_value(inst, ENH_LAYER_COUNT, layer_count, __func__);
+	inst->capabilities[ENH_LAYER_COUNT].max = layer_count;
+	return 0;
+}
+
+int msm_vidc_adjust_layer_count(void *instance, struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+
+	s32 client_layer_count;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	client_layer_count = ctrl ? ctrl->val :
+		inst->capabilities[ENH_LAYER_COUNT].value;
+
+	if (!is_parent_available(inst, ENH_LAYER_COUNT,
+				 BITRATE_MODE, __func__))
+		return -EINVAL;
+
+	if (!inst->bufq[OUTPUT_PORT].vb2q->streaming) {
+		rc = msm_vidc_adjust_static_layer_count_and_type(inst, client_layer_count);
+		if (rc)
+			goto exit;
+	} else {
+		if (inst->hfi_rc_type == HFI_RC_CBR_CFR ||
+		    inst->hfi_rc_type == HFI_RC_CBR_VFR) {
+			i_vpr_h(inst,
+				"%s: ignoring dynamic layer count change for CBR mode\n",
+				__func__);
+			goto exit;
+		}
+
+		if (inst->hfi_layer_type == HFI_HIER_P_HYBRID_LTR ||
+		    inst->hfi_layer_type == HFI_HIER_P_SLIDING_WINDOW) {
+			/* dynamic layer count change is only supported for HP */
+			if (client_layer_count >
+				inst->capabilities[ENH_LAYER_COUNT].max)
+				client_layer_count =
+					inst->capabilities[ENH_LAYER_COUNT].max;
+
+			msm_vidc_update_cap_value(inst, ENH_LAYER_COUNT,
+						  client_layer_count, __func__);
+		}
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_adjust_gop_size(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 adjusted_value, enh_layer_count = -1;
+	u32 min_gop_size, num_subgops;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[GOP_SIZE].value;
+
+	if (msm_vidc_get_parent_value(inst, GOP_SIZE,
+				      ENH_LAYER_COUNT, &enh_layer_count, __func__))
+		return -EINVAL;
+
+	if (!enh_layer_count)
+		goto exit;
+
+	/*
+	 * Layer encoding needs GOP size to be multiple of subgop size
+	 * And subgop size is 2 ^ number of enhancement layers.
+	 */
+
+	/* v4l2 layer count is the number of enhancement layers */
+	min_gop_size = 1 << enh_layer_count;
+	num_subgops = (adjusted_value + (min_gop_size >> 1)) /
+			min_gop_size;
+	if (num_subgops)
+		adjusted_value = num_subgops * min_gop_size;
+	else
+		adjusted_value = min_gop_size;
+
+exit:
+	msm_vidc_update_cap_value(inst, GOP_SIZE, adjusted_value, __func__);
+	return 0;
+}
+
+int msm_vidc_adjust_b_frame(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 adjusted_value, enh_layer_count = -1;
+	const u32 max_bframe_size = inst->capabilities[B_FRAME].max;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[B_FRAME].value;
+
+	if (msm_vidc_get_parent_value(inst, B_FRAME,
+				      ENH_LAYER_COUNT, &enh_layer_count, __func__))
+		return -EINVAL;
+
+	if (!enh_layer_count || inst->hfi_layer_type != HFI_HIER_B) {
+		adjusted_value = 0;
+		goto exit;
+	}
+
+	adjusted_value = (1 << enh_layer_count) - 1;
+	/* Allowed Bframe values are 0, 1, 3, 7 */
+	if (adjusted_value > max_bframe_size)
+		adjusted_value = max_bframe_size;
+
+exit:
+	msm_vidc_update_cap_value(inst, B_FRAME, adjusted_value, __func__);
+	return 0;
+}
+
+int msm_vidc_adjust_bitrate(void *instance, struct v4l2_ctrl *ctrl)
+{
+	int i, rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	s32 adjusted_value, enh_layer_count;
+	u32 cumulative_bitrate = 0, cap_id = 0, cap_value = 0;
+	u32 layer_br_caps[6] = {L0_BR, L1_BR, L2_BR, L3_BR, L4_BR, L5_BR};
+	u32 max_bitrate = 0;
+
+	/* ignore layer bitrate when total bitrate is set */
+	if (inst->capabilities[BIT_RATE].flags & CAP_FLAG_CLIENT_SET) {
+		/*
+		 * For static case, ctrl is null.
+		 * For dynamic case, only BIT_RATE cap uses this adjust function.
+		 * Hence, no need to check for ctrl id to be BIT_RATE control, and not
+		 * any of layer bitrate controls.
+		 */
+		adjusted_value = ctrl ? ctrl->val : inst->capabilities[BIT_RATE].value;
+		msm_vidc_update_cap_value(inst, BIT_RATE, adjusted_value, __func__);
+
+		return 0;
+	}
+
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming)
+		return 0;
+
+	if (msm_vidc_get_parent_value(inst, BIT_RATE,
+				      ENH_LAYER_COUNT, &enh_layer_count, __func__))
+		return -EINVAL;
+
+	/* get max bit rate for current session config*/
+	max_bitrate = msm_vidc_get_max_bitrate(inst);
+	if (inst->capabilities[BIT_RATE].value > max_bitrate)
+		msm_vidc_update_cap_value(inst, BIT_RATE, max_bitrate, __func__);
+
+	/*
+	 * ENH_LAYER_COUNT cap max is positive only if
+	 * layer encoding is enabled during streamon.
+	 */
+	if (inst->capabilities[ENH_LAYER_COUNT].max) {
+		if (!msm_vidc_check_all_layer_bitrate_set(inst)) {
+			i_vpr_h(inst,
+				"%s: client did not set all layer bitrates\n",
+				__func__);
+			return 0;
+		}
+
+		cumulative_bitrate = msm_vidc_get_cumulative_bitrate(inst);
+
+		/* cap layer bitrates to max supported bitrate */
+		if (cumulative_bitrate > max_bitrate) {
+			u32 decrement_in_value = 0;
+			u32 decrement_in_percent = ((cumulative_bitrate - max_bitrate) * 100) /
+				max_bitrate;
+
+			cumulative_bitrate = 0;
+			for (i = 0; i <= enh_layer_count; i++) {
+				if (i >= ARRAY_SIZE(layer_br_caps))
+					break;
+				cap_id = layer_br_caps[i];
+				cap_value = inst->capabilities[cap_id].value;
+
+				decrement_in_value = (cap_value *
+					decrement_in_percent) / 100;
+				cumulative_bitrate += (cap_value - decrement_in_value);
+
+				/*
+				 * cap value for the L*_BR is changed. Hence, update cap,
+				 * and add to FW_LIST to set new values to firmware.
+				 */
+				msm_vidc_update_cap_value(inst, cap_id,
+							  (cap_value - decrement_in_value),
+							  __func__);
+			}
+		}
+
+		i_vpr_h(inst,
+			"%s: update BIT_RATE with cumulative bitrate\n",
+			__func__);
+		msm_vidc_update_cap_value(inst, BIT_RATE, cumulative_bitrate, __func__);
+	}
+
+	return rc;
+}
+
+int msm_vidc_adjust_layer_bitrate(void *instance, struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	u32 cumulative_bitrate = 0;
+	u32 client_set_cap_id = INST_CAP_NONE;
+	u32 old_br = 0, new_br = 0, exceeded_br = 0;
+	s32 max_bitrate;
+
+	if (!ctrl)
+		return 0;
+
+	/* ignore layer bitrate when total bitrate is set */
+	if (inst->capabilities[BIT_RATE].flags & CAP_FLAG_CLIENT_SET)
+		return 0;
+
+	/*
+	 * This is no-op function because layer bitrates were already adjusted
+	 * in msm_vidc_adjust_bitrate function
+	 */
+	if (!inst->bufq[OUTPUT_PORT].vb2q->streaming)
+		return 0;
+
+	/*
+	 * ENH_LAYER_COUNT cap max is positive only if
+	 * layer encoding is enabled during streamon.
+	 */
+	if (!inst->capabilities[ENH_LAYER_COUNT].max) {
+		i_vpr_e(inst, "%s: layers not enabled\n", __func__);
+		return -EINVAL;
+	}
+
+	if (!msm_vidc_check_all_layer_bitrate_set(inst)) {
+		i_vpr_h(inst,
+			"%s: client did not set all layer bitrates\n",
+			__func__);
+		return 0;
+	}
+
+	client_set_cap_id = msm_vidc_get_cap_id(inst, ctrl->id);
+	if (client_set_cap_id == INST_CAP_NONE) {
+		i_vpr_e(inst, "%s: could not find cap_id for ctrl %s\n",
+			__func__, ctrl->name);
+		return -EINVAL;
+	}
+
+	cumulative_bitrate = msm_vidc_get_cumulative_bitrate(inst);
+	max_bitrate = inst->capabilities[BIT_RATE].max;
+	old_br = inst->capabilities[client_set_cap_id].value;
+	new_br = ctrl->val;
+
+	/*
+	 * new bitrate is not supposed to cause cumulative bitrate to
+	 * exceed max supported bitrate
+	 */
+
+	if ((cumulative_bitrate - old_br + new_br) > max_bitrate) {
+		/* adjust new bitrate */
+		exceeded_br = (cumulative_bitrate - old_br + new_br) - max_bitrate;
+		new_br = ctrl->val - exceeded_br;
+	}
+	msm_vidc_update_cap_value(inst, client_set_cap_id, new_br, __func__);
+
+	/* adjust totol bitrate cap */
+	i_vpr_h(inst,
+		"%s: update BIT_RATE with cumulative bitrate\n",
+		__func__);
+	msm_vidc_update_cap_value(inst, BIT_RATE,
+				  msm_vidc_get_cumulative_bitrate(inst), __func__);
+
+	return rc;
+}
+
+int msm_vidc_adjust_peak_bitrate(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1, bitrate = -1;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[PEAK_BITRATE].value;
+
+	if (msm_vidc_get_parent_value(inst, PEAK_BITRATE,
+				      BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	if (rc_type != HFI_RC_CBR_CFR &&
+	    rc_type != HFI_RC_CBR_VFR)
+		return 0;
+
+	if (msm_vidc_get_parent_value(inst, PEAK_BITRATE,
+				      BIT_RATE, &bitrate, __func__))
+		return -EINVAL;
+
+	/* Peak Bitrate should be larger than or equal to avg bitrate */
+	if (inst->capabilities[PEAK_BITRATE].flags & CAP_FLAG_CLIENT_SET) {
+		if (adjusted_value < bitrate)
+			adjusted_value = bitrate;
+	} else {
+		adjusted_value = inst->capabilities[BIT_RATE].value;
+	}
+
+	msm_vidc_update_cap_value(inst, PEAK_BITRATE,
+				  adjusted_value, __func__);
+
+	return 0;
+}
+
+static int msm_vidc_adjust_hevc_qp(struct msm_vidc_inst *inst,
+				   enum msm_vidc_inst_capability_type cap_id)
+{
+	s32 pix_fmt = -1;
+
+	if (!(inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)) {
+		i_vpr_e(inst,
+			"%s: incorrect cap[%d] %s entry in database, fix database\n",
+			__func__, cap_id, cap_name(cap_id));
+		return -EINVAL;
+	}
+
+	if (msm_vidc_get_parent_value(inst, cap_id,
+				      PIX_FMTS, &pix_fmt, __func__))
+		return -EINVAL;
+
+	if (pix_fmt == MSM_VIDC_FMT_P010 || pix_fmt == MSM_VIDC_FMT_TP10C)
+		goto exit;
+
+	CAP_TO_8BIT_QP(inst->capabilities[cap_id].value);
+	if (cap_id == MIN_FRAME_QP) {
+		CAP_TO_8BIT_QP(inst->capabilities[I_FRAME_MIN_QP].value);
+		CAP_TO_8BIT_QP(inst->capabilities[P_FRAME_MIN_QP].value);
+		CAP_TO_8BIT_QP(inst->capabilities[B_FRAME_MIN_QP].value);
+	} else if (cap_id == MAX_FRAME_QP) {
+		CAP_TO_8BIT_QP(inst->capabilities[I_FRAME_MAX_QP].value);
+		CAP_TO_8BIT_QP(inst->capabilities[P_FRAME_MAX_QP].value);
+		CAP_TO_8BIT_QP(inst->capabilities[B_FRAME_MAX_QP].value);
+	}
+
+exit:
+	return 0;
+}
+
+int msm_vidc_adjust_hevc_min_qp(void *instance, struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	if (ctrl)
+		msm_vidc_update_cap_value(inst, MIN_FRAME_QP,
+					  ctrl->val, __func__);
+
+	rc = msm_vidc_adjust_hevc_qp(inst, MIN_FRAME_QP);
+
+	return rc;
+}
+
+int msm_vidc_adjust_hevc_max_qp(void *instance, struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	if (ctrl)
+		msm_vidc_update_cap_value(inst, MAX_FRAME_QP, ctrl->val, __func__);
+
+	rc = msm_vidc_adjust_hevc_qp(inst, MAX_FRAME_QP);
+
+	return rc;
+}
+
+int msm_vidc_adjust_hevc_i_frame_qp(void *instance, struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	if (ctrl)
+		msm_vidc_update_cap_value(inst, I_FRAME_QP, ctrl->val, __func__);
+
+	rc = msm_vidc_adjust_hevc_qp(inst, I_FRAME_QP);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_adjust_hevc_p_frame_qp(void *instance, struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	if (ctrl)
+		msm_vidc_update_cap_value(inst, P_FRAME_QP, ctrl->val, __func__);
+
+	rc = msm_vidc_adjust_hevc_qp(inst, P_FRAME_QP);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_adjust_hevc_b_frame_qp(void *instance, struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	if (ctrl)
+		msm_vidc_update_cap_value(inst, B_FRAME_QP, ctrl->val, __func__);
+
+	rc = msm_vidc_adjust_hevc_qp(inst, B_FRAME_QP);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_adjust_blur_type(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1, roi_enable = -1;
+	s32 pix_fmts = -1, min_quality = -1;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[BLUR_TYPES].value;
+
+	if (adjusted_value == MSM_VIDC_BLUR_NONE)
+		return 0;
+
+	if (msm_vidc_get_parent_value(inst, BLUR_TYPES, BITRATE_MODE,
+				      &rc_type, __func__) ||
+	    msm_vidc_get_parent_value(inst, BLUR_TYPES, MIN_QUALITY,
+				      &min_quality, __func__))
+		return -EINVAL;
+
+	if (adjusted_value == MSM_VIDC_BLUR_EXTERNAL) {
+		if (is_scaling_enabled(inst) || min_quality)
+			adjusted_value = MSM_VIDC_BLUR_NONE;
+	} else if (adjusted_value == MSM_VIDC_BLUR_ADAPTIVE) {
+		if (is_valid_cap(inst, META_ROI_INFO)) {
+			if (msm_vidc_get_parent_value(inst, BLUR_TYPES,
+						      META_ROI_INFO, &roi_enable, __func__))
+				return -EINVAL;
+			if (is_meta_tx_inp_enabled(inst, META_ROI_INFO)) {
+				adjusted_value = MSM_VIDC_BLUR_NONE;
+				goto exit;
+			}
+		}
+
+		if (is_scaling_enabled(inst) || min_quality ||
+		    (rc_type != HFI_RC_VBR_CFR &&
+		    rc_type != HFI_RC_CBR_CFR &&
+		    rc_type != HFI_RC_CBR_VFR)) {
+			adjusted_value = MSM_VIDC_BLUR_NONE;
+			goto exit;
+		}
+
+		if (inst->codec == MSM_VIDC_HEVC) {
+			if (msm_vidc_get_parent_value(inst, BLUR_TYPES, PIX_FMTS,
+						      &pix_fmts, __func__))
+				return -EINVAL;
+			if (is_10bit_colorformat(pix_fmts))
+				adjusted_value = MSM_VIDC_BLUR_NONE;
+		}
+	}
+
+exit:
+	msm_vidc_update_cap_value(inst, BLUR_TYPES, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_all_intra(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 gop_size = -1, bframe = -1;
+	u32 width, height, fps, mbps, max_mbps;
+
+	adjusted_value = inst->capabilities[ALL_INTRA].value;
+
+	if (msm_vidc_get_parent_value(inst, ALL_INTRA, GOP_SIZE,
+				      &gop_size, __func__) ||
+	    msm_vidc_get_parent_value(inst, ALL_INTRA, B_FRAME,
+				      &bframe, __func__))
+		return -EINVAL;
+
+	width = inst->crop.width;
+	height = inst->crop.height;
+	fps =  msm_vidc_get_fps(inst);
+	mbps = NUM_MBS_PER_SEC(height, width, fps);
+	core = inst->core;
+	max_mbps = core->capabilities[MAX_MBPS_ALL_INTRA].value;
+
+	if (mbps > max_mbps) {
+		adjusted_value = 0;
+		i_vpr_h(inst, "%s: mbps %d exceeds max supported mbps %d\n",
+			__func__, mbps, max_mbps);
+		goto exit;
+	}
+
+	if (!gop_size && !bframe)
+		adjusted_value = 1;
+
+exit:
+	msm_vidc_update_cap_value(inst, ALL_INTRA, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_blur_resolution(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 blur_type = -1;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[BLUR_RESOLUTION].value;
+
+	if (msm_vidc_get_parent_value(inst, BLUR_RESOLUTION, BLUR_TYPES,
+				      &blur_type, __func__))
+		return -EINVAL;
+
+	if (blur_type != MSM_VIDC_BLUR_EXTERNAL)
+		return 0;
+
+	msm_vidc_update_cap_value(inst, BLUR_RESOLUTION,
+				  adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_brs(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1, layer_enabled = -1, layer_type = -1;
+	bool hp_requested = false;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[CONTENT_ADAPTIVE_CODING].value;
+
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming)
+		return 0;
+
+	if (msm_vidc_get_parent_value(inst, CONTENT_ADAPTIVE_CODING,
+				      BITRATE_MODE, &rc_type, __func__) ||
+	    msm_vidc_get_parent_value(inst, CONTENT_ADAPTIVE_CODING,
+				      LAYER_ENABLE, &layer_enabled, __func__) ||
+	    msm_vidc_get_parent_value(inst, CONTENT_ADAPTIVE_CODING,
+				      LAYER_TYPE, &layer_type, __func__))
+		return -EINVAL;
+
+	/*
+	 * -BRS is supported only for VBR rc type.
+	 *  Hence, do not adjust or set to firmware for non VBR rc's
+	 * -If HP is enabled then BRS is not allowed.
+	 */
+	if (rc_type != HFI_RC_VBR_CFR) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+	if (inst->codec == MSM_VIDC_H264)
+		layer_type = V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P;
+	else if (inst->codec == MSM_VIDC_HEVC)
+		layer_type = V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P;
+
+	hp_requested = (inst->capabilities[LAYER_TYPE].value == layer_type);
+
+	/*
+	 * Disable BRS in case of HP encoding
+	 * Hence set adjust value to 0.
+	 */
+	if (layer_enabled == 1 && hp_requested) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+adjust:
+	msm_vidc_update_cap_value(inst, CONTENT_ADAPTIVE_CODING,
+				  adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_bitrate_boost(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 min_quality = -1, rc_type = -1;
+	u32 max_bitrate = 0, bitrate = 0;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[BITRATE_BOOST].value;
+
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming)
+		return 0;
+
+	if (msm_vidc_get_parent_value(inst, BITRATE_BOOST,
+				      MIN_QUALITY, &min_quality, __func__) ||
+	    msm_vidc_get_parent_value(inst, BITRATE_BOOST,
+				      BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	/*
+	 * Bitrate Boost are supported only for VBR rc type.
+	 * Hence, do not adjust or set to firmware for non VBR rc's
+	 */
+	if (rc_type != HFI_RC_VBR_CFR) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+	if (min_quality) {
+		adjusted_value = MAX_BITRATE_BOOST;
+		goto adjust;
+	}
+
+	max_bitrate = msm_vidc_get_max_bitrate(inst);
+	bitrate = inst->capabilities[BIT_RATE].value;
+	if (adjusted_value) {
+		if ((bitrate + bitrate / (100 / adjusted_value)) > max_bitrate) {
+			i_vpr_h(inst,
+				"%s: bitrate %d is beyond max bitrate %d, remove bitrate boost\n",
+				__func__, max_bitrate, bitrate);
+			adjusted_value = 0;
+		}
+	}
+
+adjust:
+	msm_vidc_update_cap_value(inst, BITRATE_BOOST, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_min_quality(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 roi_enable = -1, rc_type = -1, enh_layer_count = -1, pix_fmts = -1;
+	u32 width, height, frame_rate;
+	struct v4l2_format *f;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[MIN_QUALITY].value;
+
+	/*
+	 * Although MIN_QUALITY is static, one of its parents,
+	 * ENH_LAYER_COUNT is dynamic cap. Hence, dynamic call
+	 * may be made for MIN_QUALITY via ENH_LAYER_COUNT.
+	 * Therefore, below streaming check is required to avoid
+	 * runtime modification of MIN_QUALITY.
+	 */
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming)
+		return 0;
+
+	if (msm_vidc_get_parent_value(inst, MIN_QUALITY,
+				      BITRATE_MODE, &rc_type, __func__) ||
+	    msm_vidc_get_parent_value(inst, MIN_QUALITY,
+				      ENH_LAYER_COUNT, &enh_layer_count, __func__))
+		return -EINVAL;
+
+	/*
+	 * Min Quality is supported only for VBR rc type.
+	 * Hence, do not adjust or set to firmware for non VBR rc's
+	 */
+	if (rc_type != HFI_RC_VBR_CFR) {
+		adjusted_value = 0;
+		goto update_and_exit;
+	}
+
+	frame_rate = inst->capabilities[FRAME_RATE].value >> 16;
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	/*
+	 * VBR Min Quality not supported for:
+	 * - HEVC 10bit
+	 * - ROI support
+	 * - HP encoding
+	 * - External Blur
+	 * - Resolution beyond 1080P
+	 * (It will fall back to CQCAC 25% or 0% (CAC) or CQCAC-OFF)
+	 */
+	if (inst->codec == MSM_VIDC_HEVC) {
+		if (msm_vidc_get_parent_value(inst, MIN_QUALITY,
+					      PIX_FMTS, &pix_fmts, __func__))
+			return -EINVAL;
+
+		if (is_10bit_colorformat(pix_fmts)) {
+			i_vpr_h(inst,
+				"%s: min quality is supported only for 8 bit\n",
+				__func__);
+			adjusted_value = 0;
+			goto update_and_exit;
+		}
+	}
+
+	if (res_is_greater_than(width, height, 1920, 1080)) {
+		i_vpr_h(inst, "%s: unsupported res, wxh %ux%u\n",
+			__func__, width, height);
+		adjusted_value = 0;
+		goto update_and_exit;
+	}
+
+	if (frame_rate > 60) {
+		i_vpr_h(inst, "%s: unsupported fps %u\n",
+			__func__, frame_rate);
+		adjusted_value = 0;
+		goto update_and_exit;
+	}
+
+	if (is_valid_cap(inst, META_ROI_INFO)) {
+		if (msm_vidc_get_parent_value(inst, MIN_QUALITY,
+					      META_ROI_INFO, &roi_enable, __func__))
+			return -EINVAL;
+		if (is_meta_tx_inp_enabled(inst, META_ROI_INFO)) {
+			i_vpr_h(inst,
+				"%s: min quality not supported with roi metadata\n",
+				__func__);
+			adjusted_value = 0;
+			goto update_and_exit;
+		}
+	}
+
+	if (enh_layer_count > 0 && inst->hfi_layer_type != HFI_HIER_B) {
+		i_vpr_h(inst,
+			"%s: min quality not supported for HP encoding\n",
+			__func__);
+		adjusted_value = 0;
+		goto update_and_exit;
+	}
+
+	/* Above conditions are met. Hence enable min quality */
+	adjusted_value = MAX_SUPPORTED_MIN_QUALITY;
+
+update_and_exit:
+	msm_vidc_update_cap_value(inst, MIN_QUALITY, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_preprocess(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 brs = 0;
+	u32 width, height, frame_rate, operating_rate, max_fps;
+	struct v4l2_format *f;
+
+	adjusted_value = inst->capabilities[REQUEST_PREPROCESS].value;
+
+	width = inst->crop.width;
+	height = inst->crop.height;
+	frame_rate = msm_vidc_get_frame_rate(inst);
+	operating_rate = msm_vidc_get_operating_rate(inst);
+
+	max_fps = max(frame_rate, operating_rate);
+	f = &inst->fmts[OUTPUT_PORT];
+
+	/*
+	 * enable preprocess if
+	 * BRS enabled and upto 4k @ 60 fps
+	 */
+	if (is_valid_cap(inst, CONTENT_ADAPTIVE_CODING)) {
+		if (msm_vidc_get_parent_value(inst,
+					      REQUEST_PREPROCESS,
+					      CONTENT_ADAPTIVE_CODING,
+					      &brs, __func__))
+			return -EINVAL;
+		if (brs == 0) {
+			/* preprocess not required as BRS not enabled */
+			adjusted_value = 0;
+			goto update_preprocess;
+		}
+	} else {
+		/* preprocess not required as BRS not available */
+		adjusted_value = 0;
+		goto update_preprocess;
+	}
+
+	if (res_is_less_than_or_equal_to(width, height, 3840, 2160) &&
+	    max_fps <= 60)
+		adjusted_value = 1;
+	else
+		adjusted_value = 0;
+
+update_preprocess:
+	msm_vidc_update_cap_value(inst, REQUEST_PREPROCESS, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_enc_lowlatency_mode(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[LOWLATENCY_MODE].value;
+
+	if (msm_vidc_get_parent_value(inst, LOWLATENCY_MODE, BITRATE_MODE,
+				      &rc_type, __func__))
+		return -EINVAL;
+
+	if (rc_type == HFI_RC_CBR_CFR ||
+	    rc_type == HFI_RC_CBR_VFR ||
+	    is_enc_slice_delivery_mode(inst))
+		adjusted_value = 1;
+
+	msm_vidc_update_cap_value(inst, LOWLATENCY_MODE, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_dec_lowlatency_mode(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 outbuf_fence = MSM_VIDC_META_DISABLE;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[LOWLATENCY_MODE].value;
+
+	if (is_valid_cap(inst, META_OUTBUF_FENCE)) {
+		if (msm_vidc_get_parent_value(inst, LOWLATENCY_MODE, META_OUTBUF_FENCE,
+					      &outbuf_fence, __func__))
+			return -EINVAL;
+		/* enable lowlatency if outbuf fence is enabled */
+		if (outbuf_fence & MSM_VIDC_META_ENABLE &&
+		    outbuf_fence & MSM_VIDC_META_RX_INPUT)
+			adjusted_value = 1;
+	}
+
+	msm_vidc_update_cap_value(inst, LOWLATENCY_MODE, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_session_priority(void *instance, struct v4l2_ctrl *ctrl)
+{
+	int adjusted_value;
+
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	/*
+	 * Priority handling
+	 * Client will set 0 (realtime), (1 to 4) (non-realtime)
+	 * When driver setting priority to firmware, driver adds
+	 * FIRMWARE_PRIORITY_OFFSET (1) for all sessions except
+	 * non-critical sessions. So finally firmware priority values ranges
+	 * from 0 (Critical session), 1 (realtime session),
+	 * (2 to 5) (non-realtime session).
+	 * Driver may move decode realtime sessions to non-realtime by
+	 * increasing priority by 1 to RT sessions in HW overloaded cases.
+	 * Following will be priority based on requirement -
+	 *  ___________________________________________________________
+	 *  |  Description    |    HAL Value     |Driver value|FW Value|
+	 *  |_________________|__________________|____________|________|
+	 *  |Critical Priority| Vendor Extension | Via control|   0    |
+	 *  |      RT         |        0         |      0     |   1    |
+	 *  |      NRT        |     -1 to -4     |     1-4    |  2-5   |
+	 *  |_________________|__________________|____________|________|
+	 */
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[PRIORITY].value;
+
+	msm_vidc_update_cap_value(inst, PRIORITY, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_roi_info(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1, pix_fmt = -1;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[META_ROI_INFO].value;
+
+	if (msm_vidc_get_parent_value(inst, META_ROI_INFO, BITRATE_MODE,
+				      &rc_type, __func__))
+		return -EINVAL;
+
+	if (msm_vidc_get_parent_value(inst, META_ROI_INFO, PIX_FMTS,
+				      &pix_fmt, __func__))
+		return -EINVAL;
+
+	if ((rc_type != HFI_RC_VBR_CFR && rc_type != HFI_RC_CBR_CFR &&
+	     rc_type != HFI_RC_CBR_VFR) || !is_8bit_colorformat(pix_fmt) ||
+	     is_scaling_enabled(inst) || is_rotation_90_or_270(inst))
+		adjusted_value = 0;
+
+	msm_vidc_update_cap_value(inst, META_ROI_INFO, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_dec_outbuf_fence_type(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst_cap *capability;
+	s32 adjusted_value, meta_outbuf_fence = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	struct msm_vidc_core *core;
+
+	capability = inst->capabilities;
+	core = inst->core;
+
+	adjusted_value = ctrl ? ctrl->val :
+		capability[OUTBUF_FENCE_TYPE].value;
+
+	if (msm_vidc_get_parent_value(inst, OUTBUF_FENCE_TYPE,
+				      META_OUTBUF_FENCE, &meta_outbuf_fence, __func__))
+		return -EINVAL;
+
+	if (is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE)) {
+		if (core->capabilities[SUPPORTS_SYNX_FENCE].value)
+			adjusted_value = MSM_VIDC_SYNX_V2_FENCE;
+		else
+			adjusted_value = MSM_VIDC_SW_FENCE;
+	} else {
+		adjusted_value = MSM_VIDC_FENCE_NONE;
+	}
+
+	msm_vidc_update_cap_value(inst, OUTBUF_FENCE_TYPE, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_dec_outbuf_fence_direction(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst_cap *capability;
+	s32 adjusted_value, meta_outbuf_fence = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	struct msm_vidc_core *core;
+
+	capability = inst->capabilities;
+	core = inst->core;
+
+	adjusted_value = ctrl ? ctrl->val :
+		capability[OUTBUF_FENCE_DIRECTION].value;
+
+	if (msm_vidc_get_parent_value(inst, OUTBUF_FENCE_DIRECTION,
+				      META_OUTBUF_FENCE, &meta_outbuf_fence, __func__))
+		return -EINVAL;
+
+	if (is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE))
+		adjusted_value = MSM_VIDC_FENCE_DIR_TX;
+	else
+		adjusted_value = MSM_VIDC_FENCE_DIR_NONE;
+
+	msm_vidc_update_cap_value(inst, OUTBUF_FENCE_DIRECTION, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_dec_slice_mode(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 adjusted_value = 0;
+	s32 low_latency = -1;
+	s32 picture_order = -1;
+	s32 outbuf_fence = 0;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[SLICE_DECODE].value;
+
+	if (msm_vidc_get_parent_value(inst, SLICE_DECODE, LOWLATENCY_MODE,
+				      &low_latency, __func__) ||
+	    msm_vidc_get_parent_value(inst, SLICE_DECODE, OUTPUT_ORDER,
+				      &picture_order, __func__) ||
+	    msm_vidc_get_parent_value(inst, SLICE_DECODE, META_OUTBUF_FENCE,
+				      &outbuf_fence, __func__))
+		return -EINVAL;
+
+	if (!low_latency || !picture_order ||
+	    !is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE))
+		adjusted_value = 0;
+
+	msm_vidc_update_cap_value(inst, SLICE_DECODE, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_eva_stats(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[META_EVA_STATS].value;
+
+	if (msm_vidc_get_parent_value(inst, META_EVA_STATS, BITRATE_MODE,
+				      &rc_type, __func__))
+		return -EINVAL;
+
+	/* disable Eva stats metadata for CQ rate control */
+	if (rc_type == HFI_RC_CQ) {
+		i_vpr_h(inst, "%s: unsupported for CQ rate control\n", __func__);
+		adjusted_value = 0;
+	}
+
+	msm_vidc_update_cap_value(inst, META_EVA_STATS, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_sei_mastering_disp(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 profile = -1;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[META_SEI_MASTERING_DISP].value;
+
+	if (msm_vidc_get_parent_value(inst, META_SEI_MASTERING_DISP, PROFILE,
+				      &profile, __func__))
+		return -EINVAL;
+
+	if (inst->codec != MSM_VIDC_HEVC && inst->codec != MSM_VIDC_HEIC) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+	if ((inst->codec == MSM_VIDC_HEVC &&
+	     profile != V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10) ||
+	     (inst->codec == MSM_VIDC_HEIC &&
+	     profile != V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE)) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+adjust:
+	msm_vidc_update_cap_value(inst, META_SEI_MASTERING_DISP,
+				  adjusted_value, __func__);
+	return 0;
+}
+
+int msm_vidc_adjust_sei_cll(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 profile = -1;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[META_SEI_CLL].value;
+
+	if (msm_vidc_get_parent_value(inst, META_SEI_CLL, PROFILE,
+				      &profile, __func__))
+		return -EINVAL;
+
+	if (inst->codec != MSM_VIDC_HEVC && inst->codec != MSM_VIDC_HEIC) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+	if ((inst->codec == MSM_VIDC_HEVC &&
+	     profile != V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10) ||
+	    (inst->codec == MSM_VIDC_HEIC &&
+	     profile != V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE)) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+adjust:
+	msm_vidc_update_cap_value(inst, META_SEI_CLL, adjusted_value, __func__);
+	return 0;
+}
+
+int msm_vidc_adjust_hdr10plus(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 profile = -1;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[META_HDR10PLUS].value;
+
+	if (msm_vidc_get_parent_value(inst, META_HDR10PLUS, PROFILE,
+				      &profile, __func__))
+		return -EINVAL;
+
+	if (inst->codec != MSM_VIDC_HEVC && inst->codec != MSM_VIDC_HEIC) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+	if ((inst->codec == MSM_VIDC_HEVC &&
+	     profile != V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10) ||
+	    (inst->codec == MSM_VIDC_HEIC &&
+	     profile != V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE)) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+adjust:
+	msm_vidc_update_cap_value(inst, META_HDR10PLUS, adjusted_value, __func__);
+	return 0;
+}
+
+int msm_vidc_adjust_transcoding_stats(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1;
+	u32 width, height, fps;
+	struct v4l2_format *f;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[META_TRANSCODING_STAT_INFO].value;
+
+	if (msm_vidc_get_parent_value(inst, META_TRANSCODING_STAT_INFO,
+				      BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	/*
+	 * transcoding stats metadata is supported for:
+	 * - VBR bitrate mode
+	 * - fps <= 60
+	 * - Resolution <= 4K
+	 */
+	if (rc_type != HFI_RC_VBR_CFR) {
+		i_vpr_h(inst, "%s: unsupported rc_type: %#x\n",
+			__func__, rc_type);
+		adjusted_value = 0;
+		goto exit;
+	}
+
+	fps = inst->capabilities[FRAME_RATE].value >> 16;
+	if (fps > MAX_TRANSCODING_STATS_FRAME_RATE) {
+		i_vpr_h(inst, "%s: unsupported fps %u\n", __func__, fps);
+		adjusted_value = 0;
+		goto exit;
+	}
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	if (res_is_greater_than(width, height,
+				MAX_TRANSCODING_STATS_WIDTH, MAX_TRANSCODING_STATS_HEIGHT)) {
+		i_vpr_h(inst, "%s: unsupported res, wxh %ux%u\n",
+			__func__, width, height);
+		adjusted_value = 0;
+		goto exit;
+	}
+
+exit:
+	msm_vidc_update_cap_value(inst, META_TRANSCODING_STAT_INFO,
+				  adjusted_value, __func__);
+
+	return 0;
+}
+
+/******************* End of Control Adjust functions *************************/
+
+/************************* Control Set functions *****************************/
+
+int msm_vidc_set_header_mode(void *instance,
+			     enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	int header_mode, prepend_sps_pps;
+	u32 hfi_value = 0;
+
+	header_mode = inst->capabilities[cap_id].value;
+	prepend_sps_pps = inst->capabilities[PREPEND_SPSPPS_TO_IDR].value;
+
+	/* prioritize PREPEND_SPSPPS_TO_IDR mode over other header modes */
+	if (prepend_sps_pps)
+		hfi_value = HFI_SEQ_HEADER_PREFIX_WITH_SYNC_FRAME;
+	else if (header_mode == V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME)
+		hfi_value = HFI_SEQ_HEADER_JOINED_WITH_1ST_FRAME;
+	else
+		hfi_value = HFI_SEQ_HEADER_SEPERATE_FRAME;
+
+	if (is_meta_rx_out_enabled(inst, META_SEQ_HDR_NAL))
+		hfi_value |= HFI_SEQ_HEADER_METADATA;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_deblock_mode(void *instance,
+			      enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 alpha = 0, beta = 0;
+	u32 lf_mode, hfi_value = 0, lf_offset = 6;
+
+	rc = msm_vidc_v4l2_to_hfi_enum(inst, LF_MODE, &lf_mode);
+	if (rc)
+		return -EINVAL;
+
+	beta = inst->capabilities[LF_BETA].value + lf_offset;
+	alpha = inst->capabilities[LF_ALPHA].value + lf_offset;
+	hfi_value = (alpha << 16) | (beta << 8) | lf_mode;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_32_PACKED,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_constant_quality(void *instance,
+				  enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = 0;
+	s32 rc_type = -1;
+
+	if (msm_vidc_get_parent_value(inst, cap_id,
+				      BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	if (rc_type != HFI_RC_CQ)
+		return 0;
+
+	hfi_value = inst->capabilities[cap_id].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_vbr_related_properties(void *instance,
+					enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = 0;
+	s32 rc_type = -1;
+
+	if (msm_vidc_get_parent_value(inst, cap_id,
+				      BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	if (rc_type != HFI_RC_VBR_CFR)
+		return 0;
+
+	hfi_value = inst->capabilities[cap_id].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_cbr_related_properties(void *instance,
+					enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = 0;
+	s32 rc_type = -1;
+
+	if (msm_vidc_get_parent_value(inst, cap_id,
+				      BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	if (rc_type != HFI_RC_CBR_VFR &&
+	    rc_type != HFI_RC_CBR_CFR)
+		return 0;
+
+	hfi_value = inst->capabilities[cap_id].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_use_and_mark_ltr(void *instance,
+				  enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = 0;
+
+	if (!inst->capabilities[LTR_COUNT].value ||
+	    inst->capabilities[cap_id].value ==
+	    INVALID_DEFAULT_MARK_OR_USE_LTR) {
+		i_vpr_h(inst,
+			"%s: LTR_COUNT: %d %s: %d, cap %s is not set\n",
+			__func__, inst->capabilities[LTR_COUNT].value,
+			cap_name(cap_id),
+			inst->capabilities[cap_id].value,
+			cap_name(cap_id));
+		return 0;
+	}
+
+	hfi_value = inst->capabilities[cap_id].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_min_qp(void *instance,
+			enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	s32 i_frame_qp = 0, p_frame_qp = 0, b_frame_qp = 0, min_qp_enable = 0;
+	u32 i_qp_enable = 0, p_qp_enable = 0, b_qp_enable = 0;
+	u32 client_qp_enable = 0, hfi_value = 0, offset = 0;
+
+	if (inst->capabilities[MIN_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+		min_qp_enable = 1;
+
+	if (min_qp_enable ||
+	    (inst->capabilities[I_FRAME_MIN_QP].flags & CAP_FLAG_CLIENT_SET))
+		i_qp_enable = 1;
+	if (min_qp_enable ||
+	    (inst->capabilities[P_FRAME_MIN_QP].flags & CAP_FLAG_CLIENT_SET))
+		p_qp_enable = 1;
+	if (min_qp_enable ||
+	    (inst->capabilities[B_FRAME_MIN_QP].flags & CAP_FLAG_CLIENT_SET))
+		b_qp_enable = 1;
+
+	client_qp_enable = i_qp_enable | p_qp_enable << 1 | b_qp_enable << 2;
+	if (!client_qp_enable) {
+		i_vpr_h(inst,
+			"%s: client did not set min qp, cap %s is not set\n",
+			__func__, cap_name(cap_id));
+		return 0;
+	}
+
+	if (is_10bit_colorformat(inst->capabilities[PIX_FMTS].value))
+		offset = 12;
+
+	/*
+	 * I_FRAME_MIN_QP, P_FRAME_MIN_QP, B_FRAME_MIN_QP,
+	 * MIN_FRAME_QP caps have default value as MIN_QP_10BIT values.
+	 * Hence, if client sets either one among MIN_FRAME_QP
+	 * and (I_FRAME_MIN_QP or P_FRAME_MIN_QP or B_FRAME_MIN_QP),
+	 * max of both caps will result into client set value.
+	 */
+	i_frame_qp = max(inst->capabilities[I_FRAME_MIN_QP].value,
+			 inst->capabilities[MIN_FRAME_QP].value) + offset;
+	p_frame_qp = max(inst->capabilities[P_FRAME_MIN_QP].value,
+			 inst->capabilities[MIN_FRAME_QP].value) + offset;
+	b_frame_qp = max(inst->capabilities[B_FRAME_MIN_QP].value,
+			 inst->capabilities[MIN_FRAME_QP].value) + offset;
+
+	hfi_value = i_frame_qp | p_frame_qp << 8 | b_frame_qp << 16 |
+		client_qp_enable << 24;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_32_PACKED,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_max_qp(void *instance,
+			enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	s32 i_frame_qp = 0, p_frame_qp = 0, b_frame_qp = 0, max_qp_enable = 0;
+	u32 i_qp_enable = 0, p_qp_enable = 0, b_qp_enable = 0;
+	u32 client_qp_enable = 0, hfi_value = 0, offset = 0;
+
+	if (inst->capabilities[MAX_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+		max_qp_enable = 1;
+
+	if (max_qp_enable ||
+	    (inst->capabilities[I_FRAME_MAX_QP].flags & CAP_FLAG_CLIENT_SET))
+		i_qp_enable = 1;
+	if (max_qp_enable ||
+	    (inst->capabilities[P_FRAME_MAX_QP].flags & CAP_FLAG_CLIENT_SET))
+		p_qp_enable = 1;
+	if (max_qp_enable ||
+	    (inst->capabilities[B_FRAME_MAX_QP].flags & CAP_FLAG_CLIENT_SET))
+		b_qp_enable = 1;
+
+	client_qp_enable = i_qp_enable | p_qp_enable << 1 | b_qp_enable << 2;
+	if (!client_qp_enable) {
+		i_vpr_h(inst,
+			"%s: client did not set max qp, cap %s is not set\n",
+			__func__, cap_name(cap_id));
+		return 0;
+	}
+
+	if (is_10bit_colorformat(inst->capabilities[PIX_FMTS].value))
+		offset = 12;
+
+	/*
+	 * I_FRAME_MAX_QP, P_FRAME_MAX_QP, B_FRAME_MAX_QP,
+	 * MAX_FRAME_QP caps have default value as MAX_QP values.
+	 * Hence, if client sets either one among MAX_FRAME_QP
+	 * and (I_FRAME_MAX_QP or P_FRAME_MAX_QP or B_FRAME_MAX_QP),
+	 * min of both caps will result into client set value.
+	 */
+	i_frame_qp = min(inst->capabilities[I_FRAME_MAX_QP].value,
+			 inst->capabilities[MAX_FRAME_QP].value) + offset;
+	p_frame_qp = min(inst->capabilities[P_FRAME_MAX_QP].value,
+			 inst->capabilities[MAX_FRAME_QP].value) + offset;
+	b_frame_qp = min(inst->capabilities[B_FRAME_MAX_QP].value,
+			 inst->capabilities[MAX_FRAME_QP].value) + offset;
+
+	hfi_value = i_frame_qp | p_frame_qp << 8 | b_frame_qp << 16 |
+		client_qp_enable << 24;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_32_PACKED,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_frame_qp(void *instance,
+			  enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	struct msm_vidc_inst_cap *capab;
+	s32 i_frame_qp = 0, p_frame_qp = 0, b_frame_qp = 0;
+	u32 i_qp_enable = 0, p_qp_enable = 0, b_qp_enable = 0;
+	u32 client_qp_enable = 0, hfi_value = 0, offset = 0;
+	s32 rc_type = -1;
+
+	capab = inst->capabilities;
+
+	if (msm_vidc_get_parent_value(inst, cap_id,
+				      BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming) {
+		if (rc_type != HFI_RC_OFF) {
+			i_vpr_h(inst,
+				"%s: dynamic qp not allowed for rc type %d\n",
+				__func__, rc_type);
+			return 0;
+		}
+	}
+
+	if (rc_type == HFI_RC_OFF) {
+		/* Mandatorily set for rc off case */
+		i_qp_enable = 1;
+		p_qp_enable = 1;
+		b_qp_enable = 1;
+	} else {
+		/* Set only if client has set for NON rc off case */
+		if (capab[I_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+			i_qp_enable = 1;
+		if (capab[P_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+			p_qp_enable = 1;
+		if (capab[B_FRAME_QP].flags & CAP_FLAG_CLIENT_SET)
+			b_qp_enable = 1;
+	}
+
+	client_qp_enable = i_qp_enable | p_qp_enable << 1 | b_qp_enable << 2;
+	if (!client_qp_enable) {
+		i_vpr_h(inst,
+			"%s: client did not set frame qp, cap %s is not set\n",
+			__func__, cap_name(cap_id));
+		return 0;
+	}
+
+	if (is_10bit_colorformat(capab[PIX_FMTS].value))
+		offset = 12;
+
+	i_frame_qp = capab[I_FRAME_QP].value + offset;
+	p_frame_qp = capab[P_FRAME_QP].value + offset;
+	b_frame_qp = capab[B_FRAME_QP].value + offset;
+
+	hfi_value = i_frame_qp | p_frame_qp << 8 | b_frame_qp << 16 |
+		client_qp_enable << 24;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_32_PACKED,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_req_sync_frame(void *instance,
+				enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 prepend_spspps;
+	u32 hfi_value = 0;
+
+	prepend_spspps = inst->capabilities[PREPEND_SPSPPS_TO_IDR].value;
+	if (prepend_spspps)
+		hfi_value = HFI_SYNC_FRAME_REQUEST_WITH_PREFIX_SEQ_HDR;
+	else
+		hfi_value = HFI_SYNC_FRAME_REQUEST_WITHOUT_SEQ_HDR;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_chroma_qp_index_offset(void *instance,
+					enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = 0, chroma_qp_offset_mode = 0, chroma_qp = 0;
+	u32 offset = 12;
+
+	if (inst->capabilities[cap_id].flags & CAP_FLAG_CLIENT_SET)
+		chroma_qp_offset_mode = HFI_FIXED_CHROMAQP_OFFSET;
+	else
+		chroma_qp_offset_mode = HFI_ADAPTIVE_CHROMAQP_OFFSET;
+
+	chroma_qp = inst->capabilities[cap_id].value + offset;
+	hfi_value = chroma_qp_offset_mode | chroma_qp << 8 | chroma_qp << 16;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_32_PACKED,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_slice_count(void *instance,
+			     enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 slice_mode = -1;
+	u32 hfi_value = 0, set_cap_id = 0;
+
+	slice_mode = inst->capabilities[SLICE_MODE].value;
+
+	if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE) {
+		i_vpr_h(inst, "%s: slice mode is: %u, ignore setting to fw\n",
+			__func__, slice_mode);
+		return 0;
+	}
+	if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) {
+		hfi_value = (inst->codec == MSM_VIDC_HEVC) ?
+			((inst->capabilities[SLICE_MAX_MB].value + 3) / 4) :
+			inst->capabilities[SLICE_MAX_MB].value;
+		set_cap_id = SLICE_MAX_MB;
+	} else if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES) {
+		hfi_value = inst->capabilities[SLICE_MAX_BYTES].value;
+		set_cap_id = SLICE_MAX_BYTES;
+	}
+
+	rc = msm_vidc_packetize_control(inst, set_cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_nal_length(void *instance,
+			    enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = HFI_NAL_LENGTH_STARTCODES;
+
+	if (!inst->capabilities[WITHOUT_STARTCODE].value) {
+		hfi_value = HFI_NAL_LENGTH_STARTCODES;
+	} else {
+		rc = msm_vidc_v4l2_to_hfi_enum(inst, NAL_LENGTH_FIELD, &hfi_value);
+		if (rc)
+			return -EINVAL;
+	}
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_layer_count_and_type(void *instance,
+				      enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_layer_count, hfi_layer_type = 0;
+
+	if (!inst->bufq[OUTPUT_PORT].vb2q->streaming) {
+		/* set layer type */
+		hfi_layer_type = inst->hfi_layer_type;
+		cap_id = LAYER_TYPE;
+
+		rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+						&hfi_layer_type, sizeof(u32), __func__);
+		if (rc)
+			goto exit;
+	} else {
+		if (inst->hfi_layer_type == HFI_HIER_B) {
+			i_vpr_l(inst,
+				"%s: HB dyn layers change is not supported\n",
+				__func__);
+			return 0;
+		}
+	}
+
+	/* set layer count */
+	cap_id = ENH_LAYER_COUNT;
+	/* hfi baselayer starts from 1 */
+	hfi_layer_count = inst->capabilities[ENH_LAYER_COUNT].value + 1;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_layer_count, sizeof(u32), __func__);
+	if (rc)
+		goto exit;
+
+exit:
+	return rc;
+}
+
+int msm_vidc_set_gop_size(void *instance,
+			  enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value;
+
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming) {
+		if (inst->hfi_layer_type == HFI_HIER_B) {
+			i_vpr_l(inst,
+				"%s: HB dyn GOP setting is not supported\n",
+				__func__);
+			return 0;
+		}
+	}
+
+	hfi_value = inst->capabilities[GOP_SIZE].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_bitrate(void *instance,
+			 enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = 0;
+
+	/* set Total Bitrate */
+	if (inst->capabilities[BIT_RATE].flags & CAP_FLAG_CLIENT_SET)
+		goto set_total_bitrate;
+
+	/*
+	 * During runtime, if BIT_RATE cap CLIENT_SET flag is not set,
+	 * then this function will be called due to change in ENH_LAYER_COUNT.
+	 * In this case, client did not change bitrate, hence, no need to set
+	 * to fw.
+	 */
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming)
+		return 0;
+
+set_total_bitrate:
+	hfi_value = inst->capabilities[BIT_RATE].value;
+	rc = msm_vidc_packetize_control(inst, BIT_RATE, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_layer_bitrate(void *instance,
+			       enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = 0;
+
+	if (!inst->bufq[OUTPUT_PORT].vb2q->streaming)
+		return 0;
+
+	/* set Total Bitrate */
+	if (inst->capabilities[BIT_RATE].flags & CAP_FLAG_CLIENT_SET) {
+		i_vpr_h(inst,
+			"%s: Total bitrate is set, ignore layer bitrate\n",
+			__func__);
+		return 0;
+	}
+
+	/*
+	 * ENH_LAYER_COUNT cap max is positive only if
+	 *    layer encoding is enabled during streamon.
+	 */
+	if (!inst->capabilities[ENH_LAYER_COUNT].max ||
+	    !msm_vidc_check_all_layer_bitrate_set(inst)) {
+		i_vpr_h(inst,
+			"%s: invalid layer bitrate, ignore setting to fw\n",
+			__func__);
+		return 0;
+	}
+
+	/*
+	 * Accept layerwise bitrate but set total bitrate which was already
+	 * adjusted based on layer bitrate
+	 */
+	hfi_value = inst->capabilities[BIT_RATE].value;
+	rc = msm_vidc_packetize_control(inst, BIT_RATE, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_session_priority(void *instance,
+				  enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	u32 hfi_value = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	hfi_value = inst->capabilities[cap_id].value;
+	if (!is_critical_priority_session(inst))
+		hfi_value = inst->capabilities[cap_id].value +
+			inst->capabilities[FIRMWARE_PRIORITY_OFFSET].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_flip(void *instance,
+		      enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	u32 hflip, vflip, hfi_value = HFI_DISABLE_FLIP;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	hflip = inst->capabilities[HFLIP].value;
+	vflip = inst->capabilities[VFLIP].value;
+
+	if (hflip)
+		hfi_value |= HFI_HORIZONTAL_FLIP;
+
+	if (vflip)
+		hfi_value |= HFI_VERTICAL_FLIP;
+
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming) {
+		if (hfi_value != HFI_DISABLE_FLIP) {
+			rc = msm_vidc_set_req_sync_frame(inst,
+							 REQUEST_I_FRAME);
+			if (rc)
+				return rc;
+		}
+	}
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_preprocess(void *instance,
+			    enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_rotation(void *instance,
+			  enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value;
+
+	rc = msm_vidc_v4l2_to_hfi_enum(inst, cap_id, &hfi_value);
+	if (rc)
+		return -EINVAL;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_blur_resolution(void *instance,
+				 enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 blur_type = -1;
+	u32 hfi_value, blur_width, blur_height;
+
+	if (msm_vidc_get_parent_value(inst, cap_id,
+				      BLUR_TYPES, &blur_type, __func__))
+		return -EINVAL;
+
+	if (blur_type != MSM_VIDC_BLUR_EXTERNAL)
+		return 0;
+
+	hfi_value = inst->capabilities[cap_id].value;
+
+	blur_width = (hfi_value & 0xFFFF0000) >> 16;
+	blur_height = hfi_value & 0xFFFF;
+
+	if (blur_width > inst->crop.width ||
+	    blur_height > inst->crop.height) {
+		i_vpr_e(inst,
+			"%s: blur wxh: %dx%d exceeds crop wxh: %dx%d\n",
+			__func__, blur_width, blur_height,
+			inst->crop.width, inst->crop.height);
+		hfi_value = 0;
+	}
+
+	if (blur_width == inst->crop.width &&
+	    blur_height == inst->crop.height) {
+		i_vpr_e(inst,
+			"%s: blur wxh: %dx%d is equal to crop wxh: %dx%d\n",
+			__func__, blur_width, blur_height,
+			inst->crop.width, inst->crop.height);
+		hfi_value = 0;
+	}
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_32_PACKED,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_venc_set_csc_coeff(struct msm_vidc_inst *inst,
+				  const char *prop_name, u32 hfi_id, void *payload,
+	u32 payload_size, u32 row_count, u32 column_count)
+{
+	int rc = 0;
+
+	i_vpr_h(inst,
+		"set cap: name: %24s, hard coded %dx%d matrix array\n",
+		prop_name, row_count, column_count);
+	rc = venus_hfi_session_property(inst,
+					hfi_id,
+					HFI_HOST_FLAGS_NONE,
+					HFI_PORT_BITSTREAM,
+					HFI_PAYLOAD_S32_ARRAY,
+					payload,
+					payload_size);
+	if (rc) {
+		i_vpr_e(inst,
+			"%s: failed to set %s to fw\n",
+			__func__, prop_name);
+	}
+
+	return rc;
+}
+
+int msm_vidc_set_csc_custom_matrix(void *instance,
+				   enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	int i;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	struct msm_vidc_core *core;
+	struct msm_vidc_csc_coeff *csc_coeff;
+	s32 matrix_payload[MAX_MATRIX_COEFFS + 2];
+	s32 csc_bias_payload[MAX_BIAS_COEFFS + 2];
+	s32 csc_limit_payload[MAX_LIMIT_COEFFS + 2];
+
+	core = inst->core;
+	csc_coeff = &core->platform->data.csc_data;
+
+	if (!inst->capabilities[cap_id].value ||
+	    !inst->capabilities[CSC].value) {
+		i_vpr_h(inst,
+			"%s: ignored as custom martix %u, csc %u\n",
+			__func__, inst->capabilities[cap_id].value,
+			inst->capabilities[CSC].value);
+		return 0;
+	}
+
+	/*
+	 * first 2 u32's of payload in each case are for
+	 * row and column count, next remaining u32's are
+	 * for the actual payload values.
+	 */
+
+	/* set custom matrix */
+	matrix_payload[0] = 3;
+	matrix_payload[1] = 3;
+
+	for (i = 0; i < MAX_MATRIX_COEFFS; i++) {
+		if ((i + 2) >= ARRAY_SIZE(matrix_payload))
+			break;
+		matrix_payload[i + 2] =
+			csc_coeff->vpe_csc_custom_matrix_coeff[i];
+	}
+
+	rc = msm_venc_set_csc_coeff(inst, "CSC_CUSTOM_MATRIX",
+				    HFI_PROP_CSC_MATRIX, &matrix_payload[0],
+				    ARRAY_SIZE(matrix_payload) * sizeof(s32),
+				    matrix_payload[0], matrix_payload[1]);
+	if (rc)
+		return rc;
+
+	/* set csc bias */
+	csc_bias_payload[0] = 1;
+	csc_bias_payload[1] = 3;
+
+	for (i = 0; i < MAX_BIAS_COEFFS; i++) {
+		if ((i + 2) >= ARRAY_SIZE(csc_bias_payload))
+			break;
+		csc_bias_payload[i + 2] =
+			csc_coeff->vpe_csc_custom_bias_coeff[i];
+	}
+
+	rc = msm_venc_set_csc_coeff(inst, "CSC_BIAS",
+				    HFI_PROP_CSC_BIAS, &csc_bias_payload[0],
+				    ARRAY_SIZE(csc_bias_payload) * sizeof(s32),
+				    csc_bias_payload[0], csc_bias_payload[1]);
+	if (rc)
+		return rc;
+
+	/* set csc limit */
+	csc_limit_payload[0] = 1;
+	csc_limit_payload[1] = 6;
+
+	for (i = 0; i < MAX_LIMIT_COEFFS; i++) {
+		if ((i + 2) >= ARRAY_SIZE(csc_limit_payload))
+			break;
+		csc_limit_payload[i + 2] =
+			csc_coeff->vpe_csc_custom_limit_coeff[i];
+	}
+
+	rc = msm_venc_set_csc_coeff(inst, "CSC_LIMIT",
+				    HFI_PROP_CSC_LIMIT, &csc_limit_payload[0],
+				    ARRAY_SIZE(csc_limit_payload) * sizeof(s32),
+				    csc_limit_payload[0], csc_limit_payload[1]);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_reserve_duration(void *instance,
+				  enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	u32 hfi_value = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	/* reserve hardware only when input port is streaming*/
+	if (!inst->bufq[INPUT_PORT].vb2q->streaming)
+		return 0;
+
+	if (!(inst->capabilities[cap_id].flags & CAP_FLAG_CLIENT_SET))
+		return 0;
+
+	inst->capabilities[cap_id].flags &= (~CAP_FLAG_CLIENT_SET);
+
+	if (!is_critical_priority_session(inst)) {
+		i_vpr_h(inst, "%s: reserve duration allowed only for critical session\n", __func__);
+		return 0;
+	}
+
+	hfi_value = inst->capabilities[cap_id].value;
+
+	rc = venus_hfi_reserve_hardware(inst, hfi_value);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_level(void *instance,
+		       enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = 0;
+
+	hfi_value = inst->capabilities[cap_id].value;
+	if (!(inst->capabilities[cap_id].flags & CAP_FLAG_CLIENT_SET))
+		hfi_value = HFI_LEVEL_NONE;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_q16(void *instance,
+		     enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value = 0;
+
+	hfi_value = inst->capabilities[cap_id].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_Q16,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_u32(void *instance,
+		     enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value;
+
+	if (inst->capabilities[cap_id].flags & CAP_FLAG_MENU) {
+		rc = msm_vidc_v4l2_menu_to_hfi(inst, cap_id, &hfi_value);
+		if (rc)
+			return -EINVAL;
+	} else {
+		hfi_value = inst->capabilities[cap_id].value;
+	}
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_u32_packed(void *instance,
+			    enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value;
+
+	if (inst->capabilities[cap_id].flags & CAP_FLAG_MENU) {
+		rc = msm_vidc_v4l2_menu_to_hfi(inst, cap_id, &hfi_value);
+		if (rc)
+			return -EINVAL;
+	} else {
+		hfi_value = inst->capabilities[cap_id].value;
+	}
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_32_PACKED,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_u32_enum(void *instance,
+			  enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value;
+
+	rc = msm_vidc_v4l2_to_hfi_enum(inst, cap_id, &hfi_value);
+	if (rc)
+		return -EINVAL;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_stage(void *instance,
+		       enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	u32 stage = 0;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	core = inst->core;
+
+	rc = call_session_op(core, decide_work_mode, inst);
+	if (rc) {
+		i_vpr_e(inst, "%s: decide_work_mode failed\n", __func__);
+		return -EINVAL;
+	}
+
+	stage = inst->capabilities[STAGE].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&stage, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_pipe(void *instance,
+		      enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	u32 pipe;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	core = inst->core;
+
+	rc = call_session_op(core, decide_work_route, inst);
+	if (rc) {
+		i_vpr_e(inst, "%s: decide_work_route failed\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	pipe = inst->capabilities[PIPE].value;
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&pipe, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_vui_timing_info(void *instance,
+				 enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value;
+
+	/*
+	 * hfi is HFI_PROP_DISABLE_VUI_TIMING_INFO and v4l2 cap is
+	 * V4L2_CID_MPEG_VIDC_VUI_TIMING_INFO and hence reverse
+	 * the hfi_value from cap_id value.
+	 */
+	if (inst->capabilities[cap_id].value == 1)
+		hfi_value = 0;
+	else
+		hfi_value = 1;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_outbuf_fence_type(void *instance,
+				   enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value;
+
+	if (inst->capabilities[OUTBUF_FENCE_TYPE].value ==
+	    MSM_VIDC_FENCE_NONE)
+		return 0;
+
+	hfi_value = inst->capabilities[cap_id].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_set_outbuf_fence_direction(void *instance,
+					enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 hfi_value;
+
+	if (inst->capabilities[OUTBUF_FENCE_DIRECTION].value ==
+	    MSM_VIDC_FENCE_DIR_NONE)
+		return 0;
+
+	hfi_value = inst->capabilities[cap_id].value;
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_U32_ENUM,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+/********************* End of Control Set functions **************************/
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/common/src/msm_vidc_platform_ext.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/common/src/msm_vidc_platform_ext.c
@@ -0,0 +1,259 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <media/v4l2_vidc_extensions.h>
+#include "msm_vidc_platform_ext.h"
+#include "hfi_packet.h"
+#include "hfi_property.h"
+#include "venus_hfi.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_driver.h"
+#include "msm_venc.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_debug.h"
+
+int msm_vidc_adjust_ir_period(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value, all_intra = 0, roi_enable = 0,
+		pix_fmts = MSM_VIDC_FMT_NONE;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[IR_PERIOD].value;
+
+	if (msm_vidc_get_parent_value(inst, IR_PERIOD, ALL_INTRA,
+				      &all_intra, __func__) ||
+		msm_vidc_get_parent_value(inst, IR_PERIOD, META_ROI_INFO,
+					  &roi_enable, __func__))
+		return -EINVAL;
+
+	if (all_intra) {
+		adjusted_value = 0;
+		i_vpr_h(inst, "%s: intra refresh unsupported, all intra: %d\n",
+			__func__, all_intra);
+		goto exit;
+	}
+
+	if (roi_enable) {
+		i_vpr_h(inst,
+			"%s: intra refresh unsupported with roi metadata\n",
+			__func__);
+		adjusted_value = 0;
+		goto exit;
+	}
+
+	if (inst->codec == MSM_VIDC_HEVC) {
+		if (msm_vidc_get_parent_value(inst, IR_PERIOD,
+					      PIX_FMTS, &pix_fmts, __func__))
+			return -EINVAL;
+
+		if (is_10bit_colorformat(pix_fmts)) {
+			i_vpr_h(inst,
+				"%s: intra refresh is supported only for 8 bit\n",
+				__func__);
+			adjusted_value = 0;
+			goto exit;
+		}
+	}
+
+	/*
+	 * BITRATE_MODE dependency is NOT common across all chipsets.
+	 * Hence, do not return error if not specified as one of the parent.
+	 */
+	if (is_parent_available(inst, IR_PERIOD, BITRATE_MODE, __func__) &&
+	    inst->hfi_rc_type != HFI_RC_CBR_CFR &&
+	    inst->hfi_rc_type != HFI_RC_CBR_VFR)
+		adjusted_value = 0;
+
+exit:
+	msm_vidc_update_cap_value(inst, IR_PERIOD, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_dec_frame_rate(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 adjusted_value = 0;
+
+	if (is_encode_session(inst)) {
+		d_vpr_e("%s: adjust framerate invalid for enc\n", __func__);
+		return -EINVAL;
+	}
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[FRAME_RATE].value;
+	msm_vidc_update_cap_value(inst, FRAME_RATE, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_dec_operating_rate(void *instance, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 adjusted_value = 0;
+
+	if (is_encode_session(inst)) {
+		d_vpr_e("%s: adjust operating rate invalid for enc\n", __func__);
+		return -EINVAL;
+	}
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[OPERATING_RATE].value;
+	msm_vidc_update_cap_value(inst, OPERATING_RATE, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_delivery_mode(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	s32 slice_mode = -1;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	if (is_decode_session(inst))
+		return 0;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[DELIVERY_MODE].value;
+
+	if (msm_vidc_get_parent_value(inst, DELIVERY_MODE, SLICE_MODE,
+				      &slice_mode, __func__))
+		return -EINVAL;
+
+	/* Slice encode delivery mode is only supported for Max MB slice mode */
+	if (slice_mode != V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB)
+		adjusted_value = 0;
+
+	msm_vidc_update_cap_value(inst, DELIVERY_MODE, adjusted_value, __func__);
+
+	return 0;
+}
+
+int msm_vidc_set_ir_period(void *instance,
+			   enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 ir_type = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	if (inst->capabilities[IR_TYPE].value ==
+	    V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM) {
+		if (inst->bufq[OUTPUT_PORT].vb2q->streaming) {
+			i_vpr_h(inst, "%s: dynamic random intra refresh not allowed\n",
+				__func__);
+			return 0;
+		}
+		ir_type = HFI_PROP_IR_RANDOM_PERIOD;
+	} else if (inst->capabilities[IR_TYPE].value ==
+		   V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC) {
+		ir_type = HFI_PROP_IR_CYCLIC_PERIOD;
+	} else {
+		i_vpr_e(inst, "%s: invalid ir_type %u\n",
+			__func__, inst->capabilities[IR_TYPE].cap_id);
+		return -EINVAL;
+	}
+
+	rc = venus_hfi_set_ir_period(inst, ir_type, cap_id);
+	if (rc) {
+		i_vpr_e(inst, "%s: failed to set ir period %d\n",
+			__func__, inst->capabilities[IR_PERIOD].value);
+		return rc;
+	}
+
+	return rc;
+}
+
+int msm_vidc_set_signal_color_info(void *instance,
+				   enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	u32 color_info, matrix_coeff, transfer_char, primaries, range;
+	u32 full_range = 0;
+	u32 colour_description_present_flag = 0;
+	u32 video_signal_type_present_flag = 0, hfi_value = 0;
+	struct v4l2_format *input_fmt;
+	u32 pix_fmt;
+	/* Unspecified video format */
+	u32 video_format = 5;
+
+	if (!(inst->capabilities[cap_id].flags & CAP_FLAG_CLIENT_SET)) {
+		i_vpr_h(inst, "%s: colorspace not configured via control\n", __func__);
+		return 0;
+	}
+
+	color_info = inst->capabilities[cap_id].value;
+	matrix_coeff = color_info & 0xFF;
+	transfer_char = (color_info & 0xFF00) >> 8;
+	primaries = (color_info & 0xFF0000) >> 16;
+	range = (color_info & 0xFF000000) >> 24;
+
+	input_fmt = &inst->fmts[INPUT_PORT];
+	pix_fmt = v4l2_colorformat_to_driver(inst,
+					     input_fmt->fmt.pix_mp.pixelformat, __func__);
+	if (primaries != V4L2_COLORSPACE_DEFAULT ||
+	    matrix_coeff != V4L2_YCBCR_ENC_DEFAULT ||
+	    transfer_char != V4L2_XFER_FUNC_DEFAULT) {
+		colour_description_present_flag = 1;
+		video_signal_type_present_flag = 1;
+		primaries = v4l2_color_primaries_to_driver(inst,
+							   primaries, __func__);
+		matrix_coeff = v4l2_matrix_coeff_to_driver(inst,
+							   matrix_coeff, __func__);
+		transfer_char = v4l2_transfer_char_to_driver(inst,
+							     transfer_char, __func__);
+	} else if (is_rgba_colorformat(pix_fmt)) {
+		colour_description_present_flag = 1;
+		video_signal_type_present_flag = 1;
+		primaries = MSM_VIDC_PRIMARIES_BT709;
+		matrix_coeff = MSM_VIDC_MATRIX_COEFF_BT709;
+		transfer_char = MSM_VIDC_TRANSFER_BT709;
+		full_range = 0;
+	}
+
+	if (range != V4L2_QUANTIZATION_DEFAULT) {
+		video_signal_type_present_flag = 1;
+		full_range = range == V4L2_QUANTIZATION_FULL_RANGE ? 1 : 0;
+	}
+
+	hfi_value = (matrix_coeff & 0xFF) |
+		((transfer_char << 8) & 0xFF00) |
+		((primaries << 16) & 0xFF0000) |
+		((colour_description_present_flag << 24) & 0x1000000) |
+		((full_range << 25) & 0x2000000) |
+		((video_format << 26) & 0x1C000000) |
+		((video_signal_type_present_flag << 29) & 0x20000000);
+
+	rc = msm_vidc_packetize_control(inst, cap_id, HFI_PAYLOAD_32_PACKED,
+					&hfi_value, sizeof(u32), __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_adjust_csc(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	s32 pix_fmt = -1;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+
+	if (is_decode_session(inst))
+		return 0;
+
+	adjusted_value = ctrl ? ctrl->val : inst->capabilities[CSC].value;
+
+	if (msm_vidc_get_parent_value(inst, CSC, PIX_FMTS,
+				      &pix_fmt, __func__))
+		return -EINVAL;
+
+	/* disable csc for 10-bit encoding */
+	if (is_10bit_colorformat(pix_fmt))
+		adjusted_value = 0;
+
+	msm_vidc_update_cap_value(inst, CSC, adjusted_value, __func__);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/qcm6490/inc/msm_vidc_qcm6490.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/qcm6490/inc/msm_vidc_qcm6490.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_QCM6490_H_
+#define _MSM_VIDC_QCM6490_H_
+
+#include "msm_vidc_core.h"
+
+int msm_vidc_init_platform_qcm6490(struct msm_vidc_core *core);
+
+#endif // _MSM_VIDC_QCM6490_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/qcm6490/src/msm_vidc_qcm6490.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/qcm6490/src/msm_vidc_qcm6490.c
@@ -0,0 +1,2504 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/clock/qcom,gcc-sc7280.h>
+#include <dt-bindings/clock/qcom,videocc-sc7280.h>
+
+#include <linux/soc/qcom/llcc-qcom.h>
+
+#include <media/v4l2_vidc_extensions.h>
+#include "msm_vidc_qcm6490.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_platform_ext.h"
+#include "msm_vidc_memory_ext.h"
+#include "msm_vidc_synx.h"
+#include "resources_ext.h"
+#include "msm_vidc_iris2.h"
+#include "hfi_property.h"
+#include "hfi_command.h"
+#include "venus_hfi.h"
+
+/* version: major[24:31], minor[16:23], revision[0:15] */
+#define DRIVER_VERSION          0x04000000
+#define DEFAULT_VIDEO_CONCEAL_COLOR_BLACK 0x8020010
+#define MINIMUM_FPS             1
+#define MAXIMUM_FPS_DEC         480
+#define MAXIMUM_FPS_ENC         240
+#define MAX_LTR_FRAME_COUNT     2
+#define MAX_BASE_LAYER_PRIORITY_ID 63
+#define MIN_CHROMA_QP_OFFSET    -12
+#define MAX_CHROMA_QP_OFFSET    0
+#define MAX_BITRATE             100000000
+#define DEFAULT_BITRATE         20000000
+#define MAX_QP                  51
+#define DEFAULT_QP              20
+#define MAX_CONSTANT_QUALITY    100
+#define MIN_SLICE_BYTE_SIZE     512
+#define MAX_SLICE_BYTE_SIZE       \
+    ((MAX_BITRATE) >> 3)
+#define MAX_SLICE_MB_SIZE         \
+    (((4096 + 15) >> 4) * ((2176 + 15) >> 4))
+
+#define ENC     MSM_VIDC_ENCODER
+#define DEC     MSM_VIDC_DECODER
+#define H264    MSM_VIDC_H264
+#define HEVC    MSM_VIDC_HEVC
+#define VP9     MSM_VIDC_VP9
+#define HEIC    MSM_VIDC_HEIC
+#define CODECS_ALL    (H264 | HEVC | VP9 | HEIC)
+#define MAXIMUM_OVERRIDE_VP9_FPS 60
+
+static struct codec_info codec_data_qcm6490[] = {
+    {
+        .v4l2_codec  = V4L2_PIX_FMT_H264,
+        .vidc_codec  = MSM_VIDC_H264,
+        .pixfmt_name = "AVC",
+    },
+    {
+        .v4l2_codec  = V4L2_PIX_FMT_HEVC,
+        .vidc_codec  = MSM_VIDC_HEVC,
+        .pixfmt_name = "HEVC",
+    },
+    {
+        .v4l2_codec  = V4L2_PIX_FMT_VP9,
+        .vidc_codec  = MSM_VIDC_VP9,
+        .pixfmt_name = "VP9",
+    },
+    {
+        .v4l2_codec  = V4L2_PIX_FMT_VIDC_HEIC,
+        .vidc_codec  = MSM_VIDC_HEIC,
+        .pixfmt_name = "HEIC",
+    },
+};
+
+static struct color_format_info color_format_data_qcm6490[] = {
+    {
+        .v4l2_color_format = V4L2_PIX_FMT_NV12,
+        .vidc_color_format = MSM_VIDC_FMT_NV12,
+        .pixfmt_name       = "NV12",
+    },
+    {
+        .v4l2_color_format = V4L2_PIX_FMT_NV21,
+        .vidc_color_format = MSM_VIDC_FMT_NV21,
+        .pixfmt_name       = "NV21",
+    },
+    {
+        .v4l2_color_format = V4L2_PIX_FMT_QC08C,
+        .vidc_color_format = MSM_VIDC_FMT_NV12C,
+        .pixfmt_name       = "NV12C",
+    },
+    {
+        .v4l2_color_format = V4L2_PIX_FMT_QC10C,
+        .vidc_color_format = MSM_VIDC_FMT_TP10C,
+        .pixfmt_name       = "TP10C",
+    },
+    {
+        .v4l2_color_format = V4L2_PIX_FMT_RGBA32,
+        .vidc_color_format = MSM_VIDC_FMT_RGBA8888,
+        .pixfmt_name       = "RGBA",
+    },
+    {
+        .v4l2_color_format = V4L2_PIX_FMT_P010,
+        .vidc_color_format = MSM_VIDC_FMT_P010,
+        .pixfmt_name       = "P010",
+    },
+    {
+        .v4l2_color_format = V4L2_META_FMT_VIDC,
+        .vidc_color_format = MSM_VIDC_FMT_META,
+        .pixfmt_name       = "META",
+    },
+};
+
+static struct color_primaries_info color_primaries_data_qcm6490[] = {
+    {
+        .v4l2_color_primaries  = V4L2_COLORSPACE_DEFAULT,
+        .vidc_color_primaries  = MSM_VIDC_PRIMARIES_RESERVED,
+    },
+    {
+        .v4l2_color_primaries  = V4L2_COLORSPACE_DEFAULT,
+        .vidc_color_primaries  = MSM_VIDC_PRIMARIES_UNSPECIFIED,
+    },
+    {
+        .v4l2_color_primaries  = V4L2_COLORSPACE_REC709,
+        .vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT709,
+    },
+    {
+        .v4l2_color_primaries  = V4L2_COLORSPACE_470_SYSTEM_M,
+        .vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT470_SYSTEM_M,
+    },
+    {
+        .v4l2_color_primaries  = V4L2_COLORSPACE_470_SYSTEM_BG,
+        .vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT470_SYSTEM_BG,
+    },
+    {
+        .v4l2_color_primaries  = V4L2_COLORSPACE_SMPTE170M,
+        .vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT601_525,
+    },
+    {
+        .v4l2_color_primaries  = V4L2_COLORSPACE_SMPTE240M,
+        .vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_ST240M,
+    },
+    {
+        .v4l2_color_primaries  = V4L2_COLORSPACE_BT2020,
+        .vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT2020,
+    },
+    {
+        .v4l2_color_primaries  = V4L2_COLORSPACE_DCI_P3,
+        .vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_RP431_2,
+    },
+};
+
+static struct transfer_char_info transfer_char_data_qcm6490[] = {
+    {
+        .v4l2_transfer_char  = V4L2_XFER_FUNC_DEFAULT,
+        .vidc_transfer_char  = MSM_VIDC_TRANSFER_RESERVED,
+    },
+    {
+        .v4l2_transfer_char  = V4L2_XFER_FUNC_DEFAULT,
+        .vidc_transfer_char  = MSM_VIDC_TRANSFER_UNSPECIFIED,
+    },
+    {
+        .v4l2_transfer_char  = V4L2_XFER_FUNC_709,
+        .vidc_transfer_char  = MSM_VIDC_TRANSFER_BT709,
+    },
+    {
+        .v4l2_transfer_char  = V4L2_XFER_FUNC_SMPTE240M,
+        .vidc_transfer_char  = MSM_VIDC_TRANSFER_SMPTE_ST240M,
+    },
+    {
+        .v4l2_transfer_char  = V4L2_XFER_FUNC_SRGB,
+        .vidc_transfer_char  = MSM_VIDC_TRANSFER_SRGB_SYCC,
+    },
+    {
+        .v4l2_transfer_char  = V4L2_XFER_FUNC_SMPTE2084,
+        .vidc_transfer_char  = MSM_VIDC_TRANSFER_SMPTE_ST2084_PQ,
+    },
+};
+
+static struct matrix_coeff_info matrix_coeff_data_qcm6490[] = {
+    {
+        .v4l2_matrix_coeff  = V4L2_YCBCR_ENC_DEFAULT,
+        .vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_RESERVED,
+    },
+    {
+        .v4l2_matrix_coeff  = V4L2_YCBCR_ENC_DEFAULT,
+        .vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_UNSPECIFIED,
+    },
+    {
+        .v4l2_matrix_coeff  = V4L2_YCBCR_ENC_709,
+        .vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT709,
+    },
+    {
+        .v4l2_matrix_coeff  = V4L2_YCBCR_ENC_XV709,
+        .vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT709,
+    },
+    {
+        .v4l2_matrix_coeff  = V4L2_YCBCR_ENC_XV601,
+        .vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT470_SYS_BG_OR_BT601_625,
+    },
+    {
+        .v4l2_matrix_coeff  = V4L2_YCBCR_ENC_601,
+        .vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT601_525_BT1358_525_OR_625,
+    },
+    {
+        .v4l2_matrix_coeff  = V4L2_YCBCR_ENC_SMPTE240M,
+        .vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_SMPTE_ST240,
+    },
+    {
+        .v4l2_matrix_coeff  = V4L2_YCBCR_ENC_BT2020,
+        .vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT2020_NON_CONSTANT,
+    },
+    {
+        .v4l2_matrix_coeff  = V4L2_YCBCR_ENC_BT2020_CONST_LUM,
+        .vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT2020_CONSTANT,
+    },
+};
+
+static struct msm_platform_core_capability core_data_qcm6490[] = {
+    /* {type, value} */
+    {ENC_CODECS, H264 | HEVC | HEIC},
+    {DEC_CODECS, H264 | HEVC | VP9 | HEIC},
+    {MAX_SESSION_COUNT, 16},
+    {MAX_NUM_720P_SESSIONS, 8},
+    {MAX_NUM_1080P_SESSIONS, 4},
+    {MAX_NUM_4K_SESSIONS, 2},
+    {MAX_SECURE_SESSION_COUNT, 3},
+    {MAX_RT_MBPF, 69362}, /* ((4096x2176)/256) x 2 */
+    {MAX_MBPF, 77522}, /* ((4096x2176)/256) x 2 + (1920x1088)/256 */
+    /* max_load 3840x2176@120fps*/
+    /* Concurrency: UHD@30 decode + UHD@30 encode */
+    {MAX_MBPS, 2088960}, /* max_load 4096x2176@60fps */
+    {MAX_IMAGE_MBPF, 1048576},  /* (16384x16384)/256 */
+    {MAX_MBPF_HQ, 8160}, /* ((1920x1088)/256) */
+    {MAX_MBPS_HQ, 244800}, /* ((1920x1088)/256)@30fps */
+    {MAX_MBPF_B_FRAME, 8160},/* ((1920x1088)/256) */
+    {MAX_MBPS_B_FRAME, 489600}, /* ((1920x1088)/256) MBs@60fps */
+    {MAX_MBPS_ALL_INTRA, 489600}, /* ((1920x1088)/256)@60fps */
+    {MAX_ENH_LAYER_COUNT, 5},
+    {NUM_VPP_PIPE, 1},
+    {SW_PC, 1},
+    {FW_UNLOAD, 0},
+    {HW_RESPONSE_TIMEOUT, HW_RESPONSE_TIMEOUT_VALUE}, /* 1000 ms */
+    {SW_PC_DELAY,         SW_PC_DELAY_VALUE        }, /* 1500 ms (>HW_RESPONSE_TIMEOUT)*/
+    {FW_UNLOAD_DELAY,     FW_UNLOAD_DELAY_VALUE    }, /* 3000 ms (>SW_PC_DELAY)*/
+    {PAGEFAULT_NON_FATAL, 1},
+    {PAGETABLE_CACHING, 0},
+    {DCVS, 1},
+    {DECODE_BATCH, 0},
+    {DECODE_BATCH_TIMEOUT, 200},
+    {STATS_TIMEOUT_MS, 2000},
+    {AV_SYNC_WINDOW_SIZE, 40},
+    {NON_FATAL_FAULTS, 1},
+    {ENC_AUTO_FRAMERATE, 0},
+    {DEVICE_CAPS, V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_META_CAPTURE |
+        V4L2_CAP_STREAMING},
+    {SUPPORTS_SYNX_FENCE, 0},
+    {SUPPORTS_REQUESTS, 0},
+};
+
+static struct msm_platform_inst_capability instance_cap_data_qcm6490[] = {
+    /* {cap, domain, codec,
+     *      min, max, step_or_mask, value,
+     *      v4l2_id,
+     *      hfi_id,
+     *      flags}
+     */
+    {DRV_VERSION, DEC|ENC, CODECS_ALL,
+        0, INT_MAX, 1, DRIVER_VERSION,
+        V4L2_CID_MPEG_VIDC_DRIVER_VERSION},
+
+    {FRAME_WIDTH, DEC, CODECS_ALL, 96, 4096, 1, 1920},
+
+    {FRAME_WIDTH, ENC, CODECS_ALL, 128, 4096, 1, 1920},
+
+    {FRAME_WIDTH, ENC, HEIC, 128, 16384, 1, 16384},
+
+    {LOSSLESS_FRAME_WIDTH, ENC, H264 | HEVC, 128, 4096, 1, 1920},
+
+    {SECURE_FRAME_WIDTH, DEC, CODECS_ALL, 96, 4096, 1, 1920},
+
+    {SECURE_FRAME_WIDTH, ENC, CODECS_ALL, 128, 4096, 1, 1920},
+
+    {FRAME_HEIGHT, DEC, CODECS_ALL, 96, 4096, 1, 1080},
+
+    {FRAME_HEIGHT, ENC, CODECS_ALL, 128, 4096, 1, 1080},
+
+    {FRAME_HEIGHT, ENC, HEIC, 128, 16384, 1, 16384},
+
+    {LOSSLESS_FRAME_HEIGHT, ENC, CODECS_ALL, 128, 4096, 1, 1080},
+
+    {SECURE_FRAME_HEIGHT, DEC, CODECS_ALL, 96, 4096, 1, 1080},
+
+    {SECURE_FRAME_HEIGHT, ENC, CODECS_ALL, 128, 4096, 1, 1080},
+
+    {PIX_FMTS, ENC | DEC, H264,
+        MSM_VIDC_FMT_NV12,
+        MSM_VIDC_FMT_NV12C,
+        MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C,
+        MSM_VIDC_FMT_NV12C},
+
+    {PIX_FMTS, ENC | DEC, HEVC,
+        MSM_VIDC_FMT_NV12,
+        MSM_VIDC_FMT_TP10C,
+        MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C |
+        MSM_VIDC_FMT_P010 | MSM_VIDC_FMT_TP10C,
+        MSM_VIDC_FMT_NV12C},
+
+    {PIX_FMTS, ENC, HEIC,
+        MSM_VIDC_FMT_NV12,
+        MSM_VIDC_FMT_P010,
+        MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_P010,
+        MSM_VIDC_FMT_NV12},
+
+    {PIX_FMTS, DEC, HEIC,
+        MSM_VIDC_FMT_NV12,
+        MSM_VIDC_FMT_TP10C,
+        MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C |
+        MSM_VIDC_FMT_P010 | MSM_VIDC_FMT_TP10C,
+        MSM_VIDC_FMT_NV12C},
+
+    {PIX_FMTS, DEC, VP9,
+        MSM_VIDC_FMT_NV12,
+        MSM_VIDC_FMT_TP10C,
+        MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C |
+        MSM_VIDC_FMT_P010 | MSM_VIDC_FMT_TP10C,
+        MSM_VIDC_FMT_NV12C},
+
+    {MIN_BUFFERS_INPUT, ENC | DEC, CODECS_ALL, 0, 64, 1, 4,
+        V4L2_CID_MIN_BUFFERS_FOR_OUTPUT,
+        0,
+        CAP_FLAG_VOLATILE},
+
+    {MIN_BUFFERS_INPUT, ENC | DEC, HEIC, 0, 64, 1, 1,
+        V4L2_CID_MIN_BUFFERS_FOR_OUTPUT,
+        0,
+        CAP_FLAG_VOLATILE},
+
+    {MIN_BUFFERS_OUTPUT, ENC | DEC, CODECS_ALL,
+        0, 64, 1, 4,
+        V4L2_CID_MIN_BUFFERS_FOR_CAPTURE,
+        HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_VOLATILE},
+
+    /* (4096 * 2176) / 256 */
+    {MBPF, ENC, CODECS_ALL, 64, 34816, 1, 34816},
+
+    /* ((16384x16384)/256) */
+    {MBPF, ENC, HEIC, 36, 1048576, 1, 1048576},
+
+    /* (4096 * 2176) / 256 */
+    {MBPF, DEC, CODECS_ALL, 36, 34816, 1, 34816},
+
+    /* ((8192x8192)/256) */
+    {MBPF, DEC, HEIC, 64, 65536,  1, 65536 },
+
+    /* (4096 * 2176) / 256 */
+    {LOSSLESS_MBPF, ENC, H264 | HEVC, 64, 34816, 1, 34816},
+
+    /* Batch Mode Decode */
+    /* BATCH_MBPF + 2 is done for chipsets other than lanai
+     * due to timeline constraints since msm_vidc_allow_decode_batch
+     * has checks to allow batching for less than BATCH_MBPF.
+     * Same applies for BATCH_FPS.
+     */
+    /* (1920 * 1088) / 256 */
+    {BATCH_MBPF, DEC, H264 | HEVC | VP9, 64, 8162, 1, 8162},
+
+    {BATCH_FPS, DEC, H264 | HEVC | VP9, 1, 61, 1, 61},
+
+    /* (4096 * 2176) / 256 */
+    {SECURE_MBPF, ENC | DEC, H264 | HEVC | VP9, 64, 34816, 1, 34816},
+
+    {FRAME_RATE, ENC, CODECS_ALL,
+        (MINIMUM_FPS << 16), (MAXIMUM_FPS_ENC << 16),
+        1, (DEFAULT_FPS << 16),
+        0,
+        HFI_PROP_FRAME_RATE,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {FRAME_RATE, ENC, HEIC,
+        (MINIMUM_FPS << 16), (MAXIMUM_FPS_ENC << 16),
+        1, (MINIMUM_FPS << 16),
+        0,
+        HFI_PROP_FRAME_RATE,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {FRAME_RATE, DEC, CODECS_ALL,
+        (MINIMUM_FPS << 16), (MAXIMUM_FPS_DEC << 16),
+        1, (DEFAULT_FPS << 16),
+        V4L2_CID_MPEG_VIDC_FRAME_RATE,
+        0,
+        CAP_FLAG_OUTPUT_PORT |
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {FRAME_RATE, DEC, VP9,
+        (MINIMUM_FPS << 16), (MAXIMUM_OVERRIDE_VP9_FPS << 16),
+        1, (DEFAULT_FPS << 16),
+        V4L2_CID_MPEG_VIDC_FRAME_RATE,
+        0,
+        CAP_FLAG_OUTPUT_PORT |
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {OPERATING_RATE, ENC, CODECS_ALL,
+        (MINIMUM_FPS << 16), INT_MAX,
+        1, (DEFAULT_FPS << 16)},
+
+    {OPERATING_RATE, DEC, CODECS_ALL,
+        (MINIMUM_FPS << 16), INT_MAX,
+        1, (DEFAULT_FPS << 16),
+        V4L2_CID_MPEG_VIDC_OPERATING_RATE,
+        0,
+        CAP_FLAG_OUTPUT_PORT |
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {INPUT_RATE, ENC | DEC, CODECS_ALL,
+        (MINIMUM_FPS << 16), INT_MAX,
+        1, (DEFAULT_FPS << 16)},
+
+    {TIMESTAMP_RATE, ENC | DEC, CODECS_ALL,
+        (MINIMUM_FPS << 16), INT_MAX,
+        1, (DEFAULT_FPS << 16)},
+
+    {SCALE_FACTOR, ENC, H264 | HEVC, 1, 8, 1, 8},
+
+    {MB_CYCLES_VSP, ENC, CODECS_ALL, 25, 25, 1, 25},
+
+    {MB_CYCLES_VSP, DEC, CODECS_ALL, 25, 25, 1, 25},
+
+    {MB_CYCLES_VSP, DEC, VP9, 60, 60, 1, 60},
+
+    {MB_CYCLES_VPP, ENC, CODECS_ALL, 675, 675, 1, 675},
+
+    {MB_CYCLES_VPP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+    {MB_CYCLES_LP, ENC, CODECS_ALL, 320, 320, 1, 320},
+
+    {MB_CYCLES_LP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+    {MB_CYCLES_FW, ENC | DEC, CODECS_ALL, 436000, 436000, 1, 436000},
+
+    {MB_CYCLES_FW_VPP, ENC | DEC, CODECS_ALL, 166667, 166667, 1, 166667},
+
+    {ENC_RING_BUFFER_COUNT, ENC, CODECS_ALL,
+        0, 0, 1, 0},
+
+    {CLIENT_ID, ENC | DEC, CODECS_ALL,
+        INVALID_CLIENT_ID, INT_MAX, 1, INVALID_CLIENT_ID,
+        V4L2_CID_MPEG_VIDC_CLIENT_ID},
+
+    {SECURE_MODE, ENC | DEC, H264 | HEVC | VP9,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_SECURE,
+        HFI_PROP_SECURE,
+        CAP_FLAG_NONE},
+
+    /*
+     * Client will enable V4L2_CID_MPEG_VIDC_METADATA_OUTBUF_FENCE
+     * to get fence_id in input metadata buffer done.
+     */
+    {META_OUTBUF_FENCE, DEC, H264 | HEVC | VP9,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_OUTBUF_FENCE,
+        HFI_PROP_FENCE,
+        CAP_FLAG_BITMASK | CAP_FLAG_META | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    /*
+     * Client to do set_ctrl with FENCE_ID to set fence_id
+     * and then client will do get_ctrl with FENCE_FD to get
+     * fence_fd corresponding to client set fence_id.
+     */
+    {FENCE_ID, DEC, CODECS_ALL,
+        0, INT_MAX, 1, 0,
+        V4L2_CID_MPEG_VIDC_SW_FENCE_ID,
+        0,
+        CAP_FLAG_DYNAMIC_ALLOWED | CAP_FLAG_OUTPUT_PORT},
+
+    {FENCE_FD, DEC, CODECS_ALL,
+        INVALID_FD, INT_MAX, 1, INVALID_FD,
+        V4L2_CID_MPEG_VIDC_SW_FENCE_FD,
+        0,
+        CAP_FLAG_VOLATILE},
+
+    {TS_REORDER, DEC, H264 | HEVC,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_TS_REORDER},
+
+    {HFLIP, ENC, CODECS_ALL,
+        0, 1, 1, 0,
+        V4L2_CID_HFLIP,
+        HFI_PROP_FLIP,
+        CAP_FLAG_OUTPUT_PORT |
+            CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {VFLIP, ENC, CODECS_ALL,
+        0, 1, 1, 0,
+        V4L2_CID_VFLIP,
+        HFI_PROP_FLIP,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {ROTATION, ENC, CODECS_ALL,
+        0, 270, 90, 0,
+        V4L2_CID_ROTATE,
+        HFI_PROP_ROTATION,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {SUPER_FRAME, ENC, H264 | HEVC,
+        0, 32, 1, 0,
+        V4L2_CID_MPEG_VIDC_SUPERFRAME, 0,
+        CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {SLICE_DECODE, DEC, H264 | HEVC,
+        V4L2_MPEG_MSM_VIDC_DISABLE,
+        V4L2_MPEG_MSM_VIDC_DISABLE,
+        0,
+        V4L2_MPEG_MSM_VIDC_DISABLE,
+        V4L2_CID_MPEG_VIDEO_DECODER_SLICE_INTERFACE,
+        0},
+
+    {HEADER_MODE, ENC, CODECS_ALL,
+        V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE,
+        V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+        BIT(V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE) |
+        BIT(V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME),
+        V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+        V4L2_CID_MPEG_VIDEO_HEADER_MODE,
+        HFI_PROP_SEQ_HEADER_MODE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {PREPEND_SPSPPS_TO_IDR, ENC, CODECS_ALL,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDEO_PREPEND_SPSPPS_TO_IDR},
+
+    {VUI_TIMING_INFO, ENC, CODECS_ALL,
+        V4L2_MPEG_MSM_VIDC_DISABLE,
+        V4L2_MPEG_MSM_VIDC_ENABLE,
+        1, V4L2_MPEG_MSM_VIDC_DISABLE,
+        V4L2_CID_MPEG_VIDC_VUI_TIMING_INFO,
+        HFI_PROP_DISABLE_VUI_TIMING_INFO,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {WITHOUT_STARTCODE, ENC, CODECS_ALL,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDEO_HEVC_WITHOUT_STARTCODE,
+        HFI_PROP_NAL_LENGTH_FIELD,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {NAL_LENGTH_FIELD, ENC, CODECS_ALL,
+        V4L2_MPEG_VIDEO_HEVC_SIZE_0,
+        V4L2_MPEG_VIDEO_HEVC_SIZE_4,
+        BIT(V4L2_MPEG_VIDEO_HEVC_SIZE_0) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_SIZE_4),
+        V4L2_MPEG_VIDEO_HEVC_SIZE_0,
+        V4L2_CID_MPEG_VIDEO_HEVC_SIZE_OF_LENGTH_FIELD,
+        HFI_PROP_NAL_LENGTH_FIELD,
+        CAP_FLAG_MENU | CAP_FLAG_OUTPUT_PORT},
+
+    /* TODO: Firmware introduced enumeration type for this
+     * with and without seq header.
+     */
+    {REQUEST_I_FRAME, ENC, H264 | HEVC,
+        0, 0, 0, 0,
+        V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
+        HFI_PROP_REQUEST_SYNC_FRAME,
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    /* Enc: Keeping CABAC and CAVLC as same bitrate.
+     * Dec: there's no use of Bitrate cap
+     */
+    {BIT_RATE, ENC, H264 | HEVC,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_BITRATE,
+        HFI_PROP_TOTAL_BITRATE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {BITRATE_MODE, ENC, H264,
+        V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+        V4L2_MPEG_VIDEO_BITRATE_MODE_MBR,
+        BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) |
+        BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CBR) |
+        BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_MBR),
+        V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+        V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+        HFI_PROP_RATE_CONTROL,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {BITRATE_MODE, ENC, HEVC,
+        V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+        V4L2_MPEG_VIDEO_BITRATE_MODE_MBR,
+        BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) |
+        BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CBR) |
+        BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CQ) |
+        BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_MBR),
+        V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+        V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+        HFI_PROP_RATE_CONTROL,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {BITRATE_MODE, ENC, HEIC,
+        V4L2_MPEG_VIDEO_BITRATE_MODE_CQ,
+        V4L2_MPEG_VIDEO_BITRATE_MODE_CQ,
+        BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CQ),
+        V4L2_MPEG_VIDEO_BITRATE_MODE_CQ,
+        V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+        HFI_PROP_RATE_CONTROL,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {CABAC_MAX_BITRATE, ENC, H264 | HEVC, 0,
+        160000000, 1, 160000000},
+
+    {CAVLC_MAX_BITRATE, ENC, H264, 0,
+        160000000, 1, 160000000},
+
+    {ALLINTRA_MAX_BITRATE, ENC, H264 | HEVC, 0,
+        160000000, 1, 160000000},
+
+    {LOWLATENCY_MAX_BITRATE, ENC, H264 | HEVC, 0,
+        70000000, 1, 70000000},
+
+    {NUM_COMV, DEC, CODECS_ALL,
+        0, INT_MAX, 1, 0},
+
+    {LOSSLESS, ENC, HEVC,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDEO_HEVC_LOSSLESS_CU},
+
+    {FRAME_SKIP_MODE, ENC, H264 | HEVC | HEIC,
+        V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+        V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT,
+        BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED) |
+        BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_LEVEL_LIMIT) |
+        BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT),
+        V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+        V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE,
+        0,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {FRAME_RC_ENABLE, ENC, H264 | HEVC | HEIC,
+        0, 1, 1, 1,
+        V4L2_CID_MPEG_VIDEO_FRAME_RC_ENABLE},
+
+    {CONSTANT_QUALITY, ENC, HEVC,
+        1, MAX_CONSTANT_QUALITY, 1, 90,
+        V4L2_CID_MPEG_VIDEO_CONSTANT_QUALITY,
+        HFI_PROP_CONSTANT_QUALITY,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {CONSTANT_QUALITY, ENC, HEIC,
+        1, MAX_CONSTANT_QUALITY, 1, 100,
+        V4L2_CID_MPEG_VIDEO_CONSTANT_QUALITY,
+        HFI_PROP_CONSTANT_QUALITY,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {GOP_SIZE, ENC, CODECS_ALL,
+        0, INT_MAX, 1, 2 * DEFAULT_FPS - 1,
+        V4L2_CID_MPEG_VIDEO_GOP_SIZE,
+        HFI_PROP_MAX_GOP_FRAMES,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {GOP_SIZE, ENC, HEIC,
+        0, INT_MAX, 1, 0 /* all intra */,
+        V4L2_CID_MPEG_VIDEO_GOP_SIZE,
+        HFI_PROP_MAX_GOP_FRAMES,
+        CAP_FLAG_OUTPUT_PORT |
+            CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {GOP_CLOSURE, ENC, H264 | HEVC,
+        0, 1, 1, 1,
+        V4L2_CID_MPEG_VIDEO_GOP_CLOSURE,
+        0},
+
+    {B_FRAME, ENC, H264 | HEVC,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDEO_B_FRAMES,
+        HFI_PROP_MAX_B_FRAMES,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {B_FRAME, ENC, HEIC,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDEO_B_FRAMES,
+        HFI_PROP_MAX_B_FRAMES,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {BLUR_TYPES, ENC, H264 | HEVC,
+        MSM_VIDC_BLUR_NONE, MSM_VIDC_BLUR_EXTERNAL,
+        BIT(MSM_VIDC_BLUR_NONE) | BIT(MSM_VIDC_BLUR_EXTERNAL),
+        MSM_VIDC_BLUR_NONE,
+        V4L2_CID_MPEG_VIDC_VIDEO_BLUR_TYPES,
+        HFI_PROP_BLUR_TYPES,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {BLUR_RESOLUTION, ENC, H264 | HEVC,
+        0, S32_MAX, 1, 0,
+        V4L2_CID_MPEG_VIDC_VIDEO_BLUR_RESOLUTION,
+        HFI_PROP_BLUR_RESOLUTION,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+        CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {CSC, ENC, CODECS_ALL,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_CSC,
+        HFI_PROP_CSC,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {CSC_CUSTOM_MATRIX, ENC, CODECS_ALL,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_VIDEO_VPE_CSC_CUSTOM_MATRIX,
+        HFI_PROP_CSC_MATRIX,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {LOWLATENCY_MODE, ENC, H264 | HEVC,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_LOWLATENCY_REQUEST,
+        0,
+        CAP_FLAG_NONE},
+
+    {LOWLATENCY_MODE, DEC, H264 | HEVC | VP9,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_LOWLATENCY_REQUEST,
+        HFI_PROP_SEQ_CHANGE_AT_SYNC_FRAME,
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {LTR_COUNT, ENC, H264 | HEVC,
+        0, MAX_LTR_FRAME_COUNT, 1, 0,
+        V4L2_CID_MPEG_VIDEO_LTR_COUNT,
+        HFI_PROP_LTR_COUNT,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {USE_LTR, ENC, H264 | HEVC,
+        0,
+        ((1 << MAX_LTR_FRAME_COUNT) - 1),
+        0, 0,
+        V4L2_CID_MPEG_VIDEO_USE_LTR_FRAMES,
+        HFI_PROP_LTR_USE,
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {MARK_LTR, ENC, H264 | HEVC,
+        INVALID_DEFAULT_MARK_OR_USE_LTR,
+        (MAX_LTR_FRAME_COUNT - 1),
+        1, INVALID_DEFAULT_MARK_OR_USE_LTR,
+        V4L2_CID_MPEG_VIDEO_FRAME_LTR_INDEX,
+        HFI_PROP_LTR_MARK,
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {BASELAYER_PRIORITY, ENC, H264,
+        0, MAX_BASE_LAYER_PRIORITY_ID, 1, 0,
+        V4L2_CID_MPEG_VIDEO_BASELAYER_PRIORITY_ID,
+        HFI_PROP_BASELAYER_PRIORITYID,
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {IR_TYPE, ENC, H264 | HEVC,
+        V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+        V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC,
+        BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM) |
+        BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC),
+        V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+        V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE,
+        0,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {IR_PERIOD, ENC, H264 | HEVC,
+        0, INT_MAX, 1, 0,
+        V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD,
+        0,
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_OUTPUT_PORT |
+        CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {AU_DELIMITER, ENC, H264 | HEVC,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDEO_AU_DELIMITER,
+        HFI_PROP_AUD,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {TIME_DELTA_BASED_RC, ENC, H264 | HEVC,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_TIME_DELTA_BASED_RC,
+        HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {TIME_DELTA_BASED_RC, ENC, HEIC,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_TIME_DELTA_BASED_RC,
+        HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {CONTENT_ADAPTIVE_CODING, ENC, H264 | HEVC,
+        0, 1, 1, 1,
+        V4L2_CID_MPEG_VIDC_CONTENT_ADAPTIVE_CODING,
+        HFI_PROP_CONTENT_ADAPTIVE_CODING,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {REQUEST_PREPROCESS, ENC, H264 | HEVC,
+        MSM_VIDC_PREPROCESS_NONE,
+        MSM_VIDC_PREPROCESS_NONE,
+        BIT(MSM_VIDC_PREPROCESS_NONE),
+        MSM_VIDC_PREPROCESS_NONE,
+        0, HFI_PROP_REQUEST_PREPROCESS,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {BITRATE_BOOST, ENC, H264 | HEVC,
+        0, MAX_BITRATE_BOOST, 25, MAX_BITRATE_BOOST,
+        V4L2_CID_MPEG_VIDC_QUALITY_BITRATE_BOOST,
+        HFI_PROP_BITRATE_BOOST,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {MIN_QUALITY, ENC, H264 | HEVC,
+        0, MAX_SUPPORTED_MIN_QUALITY, 70, MAX_SUPPORTED_MIN_QUALITY,
+        0,
+        HFI_PROP_MAINTAIN_MIN_QUALITY,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {VBV_DELAY, ENC, H264 | HEVC,
+        200, 300, 100, 300,
+        V4L2_CID_MPEG_VIDEO_VBV_DELAY,
+        HFI_PROP_VBV_DELAY,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {PEAK_BITRATE, ENC, H264 | HEVC,
+        /* default peak bitrate is 10% larger than avg bitrate */
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_BITRATE_PEAK,
+        HFI_PROP_TOTAL_PEAK_BITRATE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {MIN_FRAME_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+        V4L2_CID_MPEG_VIDEO_H264_MIN_QP,
+        HFI_PROP_MIN_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {MIN_FRAME_QP, ENC, HEVC | HEIC,
+        MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+        V4L2_CID_MPEG_VIDEO_HEVC_MIN_QP,
+        HFI_PROP_MIN_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {I_FRAME_MIN_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+        V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MIN_QP},
+
+    {I_FRAME_MIN_QP, ENC, HEVC | HEIC,
+        MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+        V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MIN_QP},
+
+    {P_FRAME_MIN_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+        V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MIN_QP},
+
+    {P_FRAME_MIN_QP, ENC, HEVC | HEIC,
+        MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+        V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MIN_QP},
+
+    {B_FRAME_MIN_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+        V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MIN_QP},
+
+    {B_FRAME_MIN_QP, ENC, HEVC | HEIC,
+        MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+        V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MIN_QP},
+
+    {MAX_FRAME_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+        V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
+        HFI_PROP_MAX_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {MAX_FRAME_QP, ENC, HEVC | HEIC,
+        MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+        V4L2_CID_MPEG_VIDEO_HEVC_MAX_QP,
+        HFI_PROP_MAX_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {I_FRAME_MAX_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+        V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MAX_QP},
+
+    {I_FRAME_MAX_QP, ENC, HEVC | HEIC,
+        MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+        V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MAX_QP},
+
+    {P_FRAME_MAX_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+        V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MAX_QP},
+
+    {P_FRAME_MAX_QP, ENC, HEVC | HEIC,
+        MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+        V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MAX_QP},
+
+    {B_FRAME_MAX_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+        V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MAX_QP},
+
+    {B_FRAME_MAX_QP, ENC, HEVC | HEIC,
+        MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+        V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MAX_QP},
+
+    {I_FRAME_QP, ENC, HEVC,
+        MIN_QP_10BIT, MAX_QP, 1, DEFAULT_QP,
+        V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_QP,
+        HFI_PROP_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {I_FRAME_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+        V4L2_CID_MPEG_VIDEO_H264_I_FRAME_QP,
+        HFI_PROP_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {P_FRAME_QP, ENC, HEVC,
+        MIN_QP_10BIT, MAX_QP, 1, DEFAULT_QP,
+        V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_QP,
+        HFI_PROP_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {P_FRAME_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+        V4L2_CID_MPEG_VIDEO_H264_P_FRAME_QP,
+        HFI_PROP_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {B_FRAME_QP, ENC, HEVC,
+        MIN_QP_10BIT, MAX_QP, 1, DEFAULT_QP,
+        V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_QP,
+        HFI_PROP_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {B_FRAME_QP, ENC, H264,
+        MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+        V4L2_CID_MPEG_VIDEO_H264_B_FRAME_QP,
+        HFI_PROP_QP_PACKED,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {LAYER_TYPE, ENC, HEVC,
+        V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B,
+        V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+        BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P),
+        V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+        V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_TYPE,
+        HFI_PROP_LAYER_ENCODING_TYPE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LAYER_TYPE, ENC, H264,
+        V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B,
+        V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+        BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B) |
+        BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P),
+        V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+        V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_TYPE,
+        HFI_PROP_LAYER_ENCODING_TYPE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LAYER_ENABLE, ENC, H264,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING,
+        HFI_PROP_LAYER_ENCODING_TYPE,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {LAYER_ENABLE, ENC, HEVC,
+        0, 1, 1, 0,
+        0,
+        0,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {ENH_LAYER_COUNT, ENC, HEVC,
+        0, 5, 1, 0,
+        V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_LAYER,
+        HFI_PROP_LAYER_COUNT,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {ENH_LAYER_COUNT, ENC, H264,
+        0, 5, 1, 0,
+        V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_LAYER,
+        HFI_PROP_LAYER_COUNT,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+    {L0_BR, ENC, H264,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L0_BR,
+        HFI_PROP_BITRATE_LAYER1,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L0_BR, ENC, HEVC,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L0_BR,
+        HFI_PROP_BITRATE_LAYER1,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L1_BR, ENC, H264,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L1_BR,
+        HFI_PROP_BITRATE_LAYER2,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L1_BR, ENC, HEVC,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L1_BR,
+        HFI_PROP_BITRATE_LAYER2,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L2_BR, ENC, H264,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L2_BR,
+        HFI_PROP_BITRATE_LAYER3,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L2_BR, ENC, HEVC,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L2_BR,
+        HFI_PROP_BITRATE_LAYER3,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L3_BR, ENC, H264,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L3_BR,
+        HFI_PROP_BITRATE_LAYER4,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+    {L3_BR, ENC, HEVC,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L3_BR,
+        HFI_PROP_BITRATE_LAYER4,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L4_BR, ENC, H264,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L4_BR,
+        HFI_PROP_BITRATE_LAYER5,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L4_BR, ENC, HEVC,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L4_BR,
+        HFI_PROP_BITRATE_LAYER5,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L5_BR, ENC, H264,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L5_BR,
+        HFI_PROP_BITRATE_LAYER6,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {L5_BR, ENC, HEVC,
+        1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+        V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L5_BR,
+        HFI_PROP_BITRATE_LAYER6,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+            CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {ENTROPY_MODE, ENC, H264,
+        V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC,
+        V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+        BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) |
+        BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC),
+        V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+        V4L2_CID_MPEG_VIDEO_H264_ENTROPY_MODE,
+        HFI_PROP_CABAC_SESSION,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {ENTROPY_MODE, DEC, H264 | HEVC | VP9,
+        V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC,
+        V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+        BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) |
+        BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC),
+        V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+        0,
+        HFI_PROP_CABAC_SESSION},
+
+    {PROFILE, ENC | DEC, H264,
+        V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+        V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH,
+        BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+        BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH) |
+        BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+        BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+        BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH),
+        V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+        V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+        HFI_PROP_PROFILE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {PROFILE, ENC | DEC, HEVC | HEIC,
+        V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+        V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE,
+        BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_STILL_PICTURE) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE),
+        V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+        V4L2_CID_MPEG_VIDEO_HEVC_PROFILE,
+        HFI_PROP_PROFILE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {PROFILE, DEC, VP9,
+        V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+        V4L2_MPEG_VIDEO_VP9_PROFILE_2,
+        BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_0) |
+        BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_2),
+        V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+        V4L2_CID_MPEG_VIDEO_VP9_PROFILE,
+        HFI_PROP_PROFILE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LEVEL, ENC, H264,
+        V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+        V4L2_MPEG_VIDEO_H264_LEVEL_5_1,
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1),
+        V4L2_MPEG_VIDEO_H264_LEVEL_5_1,
+        V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+        HFI_PROP_LEVEL,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LEVEL, ENC, HEVC|HEIC,
+        V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+        V4L2_MPEG_VIDEO_HEVC_LEVEL_5,
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5),
+        V4L2_MPEG_VIDEO_HEVC_LEVEL_5,
+        V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+        HFI_PROP_LEVEL,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LEVEL, DEC, H264,
+        V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+        V4L2_MPEG_VIDEO_H264_LEVEL_5_2,
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1) |
+        BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_2),
+        V4L2_MPEG_VIDEO_H264_LEVEL_5_2,
+        V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+        HFI_PROP_LEVEL,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LEVEL, DEC, HEVC|HEIC,
+        V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+        V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1,
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1),
+        V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1,
+        V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+        HFI_PROP_LEVEL,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LEVEL, DEC, VP9,
+        V4L2_MPEG_VIDEO_VP9_LEVEL_1_0,
+        V4L2_MPEG_VIDEO_VP9_LEVEL_5_1,
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_0) |
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_1) |
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_0) |
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_1) |
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_0) |
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_1) |
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_0) |
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_1) |
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_0) |
+        BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_1),
+        V4L2_MPEG_VIDEO_VP9_LEVEL_5_1,
+        V4L2_CID_MPEG_VIDEO_VP9_LEVEL,
+        HFI_PROP_LEVEL,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {HEVC_TIER, ENC | DEC, HEVC,
+        V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+        V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+        BIT(V4L2_MPEG_VIDEO_HEVC_TIER_MAIN) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_TIER_HIGH),
+        V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+        V4L2_CID_MPEG_VIDEO_HEVC_TIER,
+        HFI_PROP_TIER,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {HEVC_TIER, ENC | DEC, HEIC,
+        V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+        V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+        BIT(V4L2_MPEG_VIDEO_HEVC_TIER_MAIN),
+        V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+        V4L2_CID_MPEG_VIDEO_HEVC_TIER,
+        HFI_PROP_TIER,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LF_MODE, ENC, H264,
+        V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED,
+        DB_H264_DISABLE_SLICE_BOUNDARY,
+        BIT(V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED) |
+        BIT(V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED) |
+        BIT(DB_H264_DISABLE_SLICE_BOUNDARY),
+        V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED,
+        V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE,
+        HFI_PROP_DEBLOCKING_MODE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LF_MODE, ENC, HEVC | HEIC,
+        V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_DISABLED,
+        DB_HEVC_DISABLE_SLICE_BOUNDARY,
+        BIT(V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_DISABLED) |
+        BIT(V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_ENABLED) |
+        BIT(DB_HEVC_DISABLE_SLICE_BOUNDARY),
+        V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_ENABLED,
+        V4L2_CID_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE,
+        HFI_PROP_DEBLOCKING_MODE,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {LF_ALPHA, ENC, H264,
+        -6, 6, 1, 0,
+        V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA},
+
+    {LF_ALPHA, ENC, HEVC | HEIC,
+        -6, 6, 1, 0,
+        V4L2_CID_MPEG_VIDEO_HEVC_LF_TC_OFFSET_DIV2},
+
+    {LF_BETA, ENC, H264,
+        -6, 6, 1, 0,
+        V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA},
+
+    {LF_BETA, ENC, HEVC | HEIC,
+        -6, 6, 1, 0,
+        V4L2_CID_MPEG_VIDEO_HEVC_LF_BETA_OFFSET_DIV2},
+
+    {SLICE_MODE, ENC, H264 | HEVC,
+        V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+        V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES,
+        BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE) |
+        BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) |
+        BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES),
+        V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+        V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE,
+        0,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {SLICE_MODE, ENC, HEIC,
+        V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+        V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+        BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE),
+        V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+        V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE,
+        0,
+        CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+    {SLICE_MAX_BYTES, ENC, H264 | HEVC,
+        MIN_SLICE_BYTE_SIZE, MAX_SLICE_BYTE_SIZE,
+        1, MIN_SLICE_BYTE_SIZE,
+        V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_BYTES,
+        HFI_PROP_MULTI_SLICE_BYTES_COUNT,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {SLICE_MAX_MB, ENC, H264 | HEVC,
+        1, MAX_SLICE_MB_SIZE, 1, 1,
+        V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_MB,
+        HFI_PROP_MULTI_SLICE_MB_COUNT,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {MB_RC, ENC, H264 | HEVC,
+        0, 1, 1, 1,
+        V4L2_CID_MPEG_VIDEO_MB_RC_ENABLE,
+        0,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {TRANSFORM_8X8, ENC, H264,
+        0, 1, 1, 1,
+        V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM,
+        HFI_PROP_8X8_TRANSFORM,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {CHROMA_QP_INDEX_OFFSET, ENC, HEVC,
+        MIN_CHROMA_QP_OFFSET, MAX_CHROMA_QP_OFFSET,
+        1, MAX_CHROMA_QP_OFFSET,
+        V4L2_CID_MPEG_VIDEO_H264_CHROMA_QP_INDEX_OFFSET,
+        HFI_PROP_CHROMA_QP_OFFSET,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {DISPLAY_DELAY_ENABLE, DEC, H264 | HEVC | VP9,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE,
+        HFI_PROP_DECODE_ORDER_OUTPUT,
+        CAP_FLAG_INPUT_PORT},
+
+    {DISPLAY_DELAY, DEC, H264 | HEVC | VP9,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY,
+        HFI_PROP_DECODE_ORDER_OUTPUT,
+        CAP_FLAG_INPUT_PORT},
+
+    {OUTPUT_ORDER, DEC, H264 | HEVC | VP9,
+        0, 1, 1, 0,
+        0,
+        HFI_PROP_DECODE_ORDER_OUTPUT,
+        CAP_FLAG_INPUT_PORT},
+
+    {INPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+        DEFAULT_MAX_HOST_BUF_COUNT, DEFAULT_MAX_HOST_BURST_BUF_COUNT,
+        1, DEFAULT_MAX_HOST_BUF_COUNT,
+        0,
+        HFI_PROP_BUFFER_HOST_MAX_COUNT,
+        CAP_FLAG_INPUT_PORT},
+
+    {OUTPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+        DEFAULT_MAX_HOST_BUF_COUNT, DEFAULT_MAX_HOST_BURST_BUF_COUNT,
+        1, DEFAULT_MAX_HOST_BUF_COUNT,
+        0,
+        HFI_PROP_BUFFER_HOST_MAX_COUNT,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {CONCEAL_COLOR_8BIT, DEC, CODECS_ALL, 0x0, 0xff3fcff, 1,
+        DEFAULT_VIDEO_CONCEAL_COLOR_BLACK,
+        V4L2_CID_MPEG_VIDEO_MUTE_YUV,
+        HFI_PROP_CONCEAL_COLOR_8BIT,
+        CAP_FLAG_INPUT_PORT},
+
+    {CONCEAL_COLOR_10BIT, DEC, CODECS_ALL, 0x0, 0x3fffffff, 1,
+        DEFAULT_VIDEO_CONCEAL_COLOR_BLACK,
+        V4L2_CID_MPEG_VIDEO_MUTE_YUV,
+        HFI_PROP_CONCEAL_COLOR_10BIT,
+        CAP_FLAG_INPUT_PORT},
+
+    {STAGE, DEC|ENC, CODECS_ALL,
+        MSM_VIDC_STAGE_1,
+        MSM_VIDC_STAGE_2, 1,
+        MSM_VIDC_STAGE_2,
+        0,
+        HFI_PROP_STAGE},
+
+    {PIPE, DEC|ENC, CODECS_ALL,
+        MSM_VIDC_PIPE_1,
+        MSM_VIDC_PIPE_1, 1,
+        MSM_VIDC_PIPE_1,
+        0,
+        HFI_PROP_PIPE},
+
+    {POC, DEC, H264,
+        0, 2, 1, 1,
+        0,
+        HFI_PROP_PIC_ORDER_CNT_TYPE,
+        CAP_FLAG_VOLATILE},
+
+    /*
+     * value of MAX_NUM_REORDER_FRAMES is 32 packed as mentioned below
+     * (max_num_reorder_count << 16) | max_dec_frame_buffering_count
+     */
+    {MAX_NUM_REORDER_FRAMES, DEC, H264 | HEVC,
+        0, INT_MAX, 1, 0,
+        V4L2_CID_MPEG_VIDC_MAX_NUM_REORDER_FRAMES,
+        HFI_PROP_MAX_NUM_REORDER_FRAMES,
+        CAP_FLAG_VOLATILE},
+
+    {QUALITY_MODE, ENC, CODECS_ALL,
+        MSM_VIDC_MAX_QUALITY_MODE,
+        MSM_VIDC_POWER_SAVE_MODE, 1,
+        MSM_VIDC_POWER_SAVE_MODE},
+
+    {CODED_FRAMES, DEC, H264 | HEVC | HEIC,
+        CODED_FRAMES_PROGRESSIVE, CODED_FRAMES_INTERLACE,
+        1, CODED_FRAMES_PROGRESSIVE,
+        V4L2_CID_MPEG_VIDC_INTERLACE,
+        HFI_PROP_CODED_FRAMES,
+        CAP_FLAG_VOLATILE},
+
+    {BIT_DEPTH, DEC, CODECS_ALL, BIT_DEPTH_8, BIT_DEPTH_10, 1, BIT_DEPTH_8,
+        0,
+        HFI_PROP_LUMA_CHROMA_BIT_DEPTH},
+
+    {CODEC_CONFIG, DEC, H264 | HEVC | HEIC, 0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_CODEC_CONFIG, 0,
+        CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {BITSTREAM_SIZE_OVERWRITE, DEC, CODECS_ALL, 0, INT_MAX, 1, 0,
+        V4L2_CID_MPEG_VIDC_MIN_BITSTREAM_SIZE_OVERWRITE},
+
+    {THUMBNAIL_MODE, DEC, CODECS_ALL,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_THUMBNAIL_MODE,
+        HFI_PROP_THUMBNAIL_MODE,
+        CAP_FLAG_INPUT_PORT},
+
+    {DEFAULT_HEADER, DEC, CODECS_ALL,
+        0, 1, 1, 0,
+        0,
+        HFI_PROP_DEC_DEFAULT_HEADER},
+
+    {RAP_FRAME, DEC, CODECS_ALL,
+        0, 1, 1, 1,
+        0,
+        HFI_PROP_DEC_START_FROM_RAP_FRAME,
+        CAP_FLAG_INPUT_PORT},
+
+    {SEQ_CHANGE_AT_SYNC_FRAME, DEC, CODECS_ALL,
+        0, 1, 1, 1,
+        0,
+        HFI_PROP_SEQ_CHANGE_AT_SYNC_FRAME,
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {PRIORITY, DEC|ENC, CODECS_ALL,
+        0, 4, 1, 4,
+        V4L2_CID_MPEG_VIDC_PRIORITY,
+        HFI_PROP_SESSION_PRIORITY,
+        CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {ENC_IP_CR, ENC, CODECS_ALL,
+        0, S32_MAX, 1, 0,
+        V4L2_CID_MPEG_VIDC_ENC_INPUT_COMPRESSION_RATIO,
+        0, CAP_FLAG_DYNAMIC_ALLOWED},
+    {LAST_FLAG_EVENT_ENABLE, DEC | ENC, CODECS_ALL,
+        0, 1, 1, 0,
+        V4L2_CID_MPEG_VIDC_LAST_FLAG_EVENT_ENABLE},
+    {ALL_INTRA, ENC, H264 | HEVC,
+        0, 1, 1, 0,
+        0,
+        0,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {META_LTR_MARK_USE, ENC, H264 | HEVC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_LTR_MARK_USE_DETAILS,
+        HFI_PROP_LTR_MARK_USE_DETAILS,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_SEQ_HDR_NAL, ENC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_SEQ_HEADER_NAL,
+        HFI_PROP_METADATA_SEQ_HEADER_NAL,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_DPB_MISR, DEC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_DPB_LUMA_CHROMA_MISR,
+        HFI_PROP_DPB_LUMA_CHROMA_MISR,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_OPB_MISR, DEC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_OPB_LUMA_CHROMA_MISR,
+        HFI_PROP_OPB_LUMA_CHROMA_MISR,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_INTERLACE, DEC, H264,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_INTERLACE,
+        HFI_PROP_INTERLACE_INFO,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_TIMESTAMP, DEC | ENC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_TIMESTAMP,
+        HFI_PROP_TIMESTAMP,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_CONCEALED_MB_CNT, DEC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_CONCEALED_MB_COUNT,
+        HFI_PROP_CONEALED_MB_COUNT,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_HIST_INFO, DEC, HEVC | VP9,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_HISTOGRAM_INFO,
+        HFI_PROP_HISTOGRAM_INFO,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_TRANSCODING_STAT_INFO, DEC, HEVC | H264,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_TRANSCODE_STAT_INFO,
+        HFI_PROP_TRANSCODING_STAT_INFO,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_TRANSCODING_STAT_INFO, ENC, HEVC | H264,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_TRANSCODE_STAT_INFO,
+        HFI_PROP_TRANSCODING_STAT_INFO,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_PICTURE_TYPE, DEC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_PICTURE_TYPE,
+        HFI_PROP_PICTURE_TYPE,
+        CAP_FLAG_BITMASK | CAP_FLAG_META | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {META_SEI_MASTERING_DISP, ENC, HEVC | HEIC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE |
+        MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_SEI_MASTERING_DISPLAY_COLOUR,
+        HFI_PROP_SEI_MASTERING_DISPLAY_COLOUR,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_SEI_MASTERING_DISP, DEC, HEVC | HEIC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+            MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_SEI_MASTERING_DISPLAY_COLOUR,
+        HFI_PROP_SEI_MASTERING_DISPLAY_COLOUR,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_SEI_CLL, ENC, HEVC | HEIC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE |
+        MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_SEI_CONTENT_LIGHT_LEVEL,
+        HFI_PROP_SEI_CONTENT_LIGHT_LEVEL,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_SEI_CLL, DEC, HEVC | HEIC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+            MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_SEI_CONTENT_LIGHT_LEVEL,
+        HFI_PROP_SEI_CONTENT_LIGHT_LEVEL,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_HDR10PLUS, ENC, HEVC | HEIC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE |
+        MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_HDR10PLUS,
+        HFI_PROP_SEI_HDR10PLUS_USERDATA,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_HDR10PLUS, DEC, HEVC | HEIC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+            MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_HDR10PLUS,
+        HFI_PROP_SEI_HDR10PLUS_USERDATA,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_EVA_STATS, ENC, H264 | HEVC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE |
+        MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_EVA_STATS,
+        HFI_PROP_EVA_STAT_INFO,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_BUF_TAG, ENC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_TX_INPUT |
+            MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_BUFFER_TAG,
+        HFI_PROP_BUFFER_TAG,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    /*
+     * when fence enabled, client needs output buffer_tag
+     * in input metadata buffer done.
+     */
+    {META_BUF_TAG, DEC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_TX_INPUT |
+            MSM_VIDC_META_TX_OUTPUT | MSM_VIDC_META_RX_INPUT |
+            MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_BUFFER_TAG,
+        HFI_PROP_BUFFER_TAG,
+        CAP_FLAG_BITMASK | CAP_FLAG_META | CAP_FLAG_DYNAMIC_ALLOWED},
+
+    {META_DPB_TAG_LIST, DEC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_DPB_TAG_LIST,
+        HFI_PROP_DPB_TAG_LIST,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_SUBFRAME_OUTPUT, ENC, HEIC | H264 | HEVC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_SUBFRAME_OUTPUT,
+        HFI_PROP_SUBFRAME_OUTPUT,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_SUBFRAME_OUTPUT, DEC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_SUBFRAME_OUTPUT,
+        HFI_PROP_SUBFRAME_OUTPUT,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_ENC_QP_METADATA, ENC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_ENC_QP_METADATA,
+        HFI_PROP_ENC_QP_METADATA,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_ROI_INFO, ENC, H264 | HEVC,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_TX_INPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_ROI_INFO,
+        HFI_PROP_ROI_INFO,
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {META_DEC_QP_METADATA, DEC, CODECS_ALL,
+        MSM_VIDC_META_DISABLE,
+        MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+        0, MSM_VIDC_META_DISABLE,
+        V4L2_CID_MPEG_VIDC_METADATA_DEC_QP_METADATA,
+        HFI_PROP_DEC_QP_METADATA,
+        CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+    {GRID_ENABLE, ENC, HEIC,
+        0, 1, 1, 1,
+        0,
+        HFI_PROP_HEIC_GRID_ENABLE,
+        CAP_FLAG_OUTPUT_PORT},
+
+    {GRID_SIZE, ENC, HEIC,
+        HEIC_GRID_WIDTH, HEIC_GRID_WIDTH * 2,
+        HEIC_GRID_WIDTH, HEIC_GRID_WIDTH,
+        V4L2_CID_MPEG_VIDC_GRID_WIDTH},
+
+    {COMPLEXITY, ENC, H264 | HEVC,
+        0, 100,
+        1, DEFAULT_COMPLEXITY,
+        V4L2_CID_MPEG_VIDC_VENC_COMPLEXITY},
+
+    {SIGNAL_COLOR_INFO, ENC, CODECS_ALL,
+        0, INT_MAX, 1, 0,
+        V4L2_CID_MPEG_VIDC_SIGNAL_COLOR_INFO,
+        HFI_PROP_SIGNAL_COLOR_INFO,
+        CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+};
+
+static struct msm_platform_inst_cap_dependency instance_cap_dependency_data_qcm6490[] = {
+    /* {cap, domain, codec,
+     *      parents,
+     *      children,
+     *      adjust, set}
+     */
+
+    {PIX_FMTS, ENC, H264,
+        {META_ROI_INFO, IR_PERIOD, CSC}},
+
+    {PIX_FMTS, ENC, HEVC,
+        {PROFILE, MIN_FRAME_QP, MAX_FRAME_QP, I_FRAME_QP, P_FRAME_QP,
+            B_FRAME_QP, META_ROI_INFO, MIN_QUALITY, BLUR_TYPES, IR_PERIOD,
+            LTR_COUNT, CSC}},
+
+    {PIX_FMTS, ENC, HEIC,
+        {PROFILE, CSC}},
+
+    {PIX_FMTS, DEC, HEVC | HEIC,
+        {PROFILE}},
+
+    {FRAME_RATE, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_q16},
+
+    {FRAME_RATE, DEC, CODECS_ALL,
+        {0},
+        msm_vidc_adjust_dec_frame_rate},
+
+    {OPERATING_RATE, DEC, CODECS_ALL,
+        {0},
+        msm_vidc_adjust_dec_operating_rate},
+
+    {ENC_RING_BUFFER_COUNT, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        NULL},
+
+    {SECURE_MODE, ENC | DEC, H264 | HEVC | VP9,
+        {0},
+        NULL,
+        msm_vidc_set_u32},
+
+    {META_OUTBUF_FENCE, DEC, H264 | HEVC | VP9,
+        {LOWLATENCY_MODE},
+        NULL,
+        NULL},
+
+    {HFLIP, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_flip},
+
+    {VFLIP, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_flip},
+
+    {ROTATION, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_rotation},
+
+    {SUPER_FRAME, ENC, H264 | HEVC,
+        {INPUT_BUF_HOST_MAX_COUNT, OUTPUT_BUF_HOST_MAX_COUNT},
+        NULL,
+        NULL},
+
+    {SLICE_DECODE, DEC, H264 | HEVC,
+        {0},
+        NULL,
+        NULL},
+
+    {HEADER_MODE, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_header_mode},
+
+    {WITHOUT_STARTCODE, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_nal_length},
+
+    {REQUEST_I_FRAME, ENC, H264 | HEVC,
+        {0},
+        NULL,
+        msm_vidc_set_req_sync_frame},
+
+    {BIT_RATE, ENC, H264,
+        {PEAK_BITRATE, BITRATE_BOOST, L0_BR},
+        msm_vidc_adjust_bitrate,
+        msm_vidc_set_bitrate},
+
+    {BIT_RATE, ENC, HEVC,
+        {PEAK_BITRATE, BITRATE_BOOST, L0_BR},
+        msm_vidc_adjust_bitrate,
+        msm_vidc_set_bitrate},
+
+    {BITRATE_MODE, ENC, H264,
+        {LTR_COUNT, IR_PERIOD, TIME_DELTA_BASED_RC, I_FRAME_QP,
+            P_FRAME_QP, B_FRAME_QP, ENH_LAYER_COUNT, BIT_RATE,
+            META_ROI_INFO, MIN_QUALITY, BITRATE_BOOST, VBV_DELAY,
+            PEAK_BITRATE, SLICE_MODE, CONTENT_ADAPTIVE_CODING,
+            BLUR_TYPES, LOWLATENCY_MODE, META_TRANSCODING_STAT_INFO},
+        msm_vidc_adjust_bitrate_mode,
+        msm_vidc_set_u32_enum},
+
+    {BITRATE_MODE, ENC, HEVC,
+        {LTR_COUNT, IR_PERIOD, TIME_DELTA_BASED_RC, I_FRAME_QP,
+            P_FRAME_QP, B_FRAME_QP, CONSTANT_QUALITY, ENH_LAYER_COUNT,
+            BIT_RATE, META_ROI_INFO, MIN_QUALITY, BITRATE_BOOST, VBV_DELAY,
+            PEAK_BITRATE, SLICE_MODE, CONTENT_ADAPTIVE_CODING,
+            BLUR_TYPES, LOWLATENCY_MODE, META_EVA_STATS, META_TRANSCODING_STAT_INFO},
+        msm_vidc_adjust_bitrate_mode,
+        msm_vidc_set_u32_enum},
+
+    {BITRATE_MODE, ENC, HEIC,
+        {TIME_DELTA_BASED_RC, CONSTANT_QUALITY},
+        msm_vidc_adjust_bitrate_mode,
+        msm_vidc_set_u32_enum},
+
+    {CONSTANT_QUALITY, ENC, HEVC | HEIC,
+        {0},
+        NULL,
+        msm_vidc_set_constant_quality},
+
+    {GOP_SIZE, ENC, CODECS_ALL,
+        {ALL_INTRA},
+        msm_vidc_adjust_gop_size,
+        msm_vidc_set_gop_size},
+
+    {GOP_SIZE, ENC, HEIC,
+        {0},
+        NULL,
+        msm_vidc_set_u32},
+
+    {B_FRAME, ENC, H264 | HEVC,
+        {ALL_INTRA},
+        msm_vidc_adjust_b_frame,
+        msm_vidc_set_u32},
+
+    {B_FRAME, ENC, HEIC,
+        {0},
+        NULL,
+        msm_vidc_set_u32},
+
+    {BLUR_TYPES, ENC, H264 | HEVC,
+        {BLUR_RESOLUTION},
+        msm_vidc_adjust_blur_type,
+        msm_vidc_set_u32_enum},
+
+    {BLUR_RESOLUTION, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_blur_resolution,
+        msm_vidc_set_blur_resolution},
+
+    {CSC, ENC, CODECS_ALL,
+        {0},
+        msm_vidc_adjust_csc,
+        msm_vidc_set_u32},
+
+    {CSC_CUSTOM_MATRIX, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_csc_custom_matrix},
+
+    {LOWLATENCY_MODE, ENC, H264 | HEVC,
+        {STAGE, BIT_RATE},
+        msm_vidc_adjust_enc_lowlatency_mode,
+        NULL},
+
+    {LOWLATENCY_MODE, DEC, H264 | HEVC | VP9,
+        {STAGE},
+        msm_vidc_adjust_dec_lowlatency_mode,
+        NULL},
+
+    {LTR_COUNT, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_ltr_count,
+        msm_vidc_set_u32},
+
+    {USE_LTR, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_use_ltr,
+        msm_vidc_set_use_and_mark_ltr},
+
+    {MARK_LTR, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_mark_ltr,
+        msm_vidc_set_use_and_mark_ltr},
+
+    {IR_PERIOD, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_ir_period,
+        msm_vidc_set_ir_period},
+
+    {AU_DELIMITER, ENC, H264 | HEVC,
+        {0},
+        NULL,
+        msm_vidc_set_u32},
+
+    {BASELAYER_PRIORITY, ENC, H264,
+        {0},
+        NULL,
+        msm_vidc_set_u32},
+
+    {TIME_DELTA_BASED_RC, ENC, CODECS_ALL,
+        {0},
+        msm_vidc_adjust_delta_based_rc,
+        msm_vidc_set_u32},
+
+    {CONTENT_ADAPTIVE_CODING, ENC, H264 | HEVC,
+        {REQUEST_PREPROCESS},
+        msm_vidc_adjust_brs,
+        msm_vidc_set_vbr_related_properties},
+
+    {REQUEST_PREPROCESS, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_preprocess,
+        msm_vidc_set_preprocess},
+
+    {BITRATE_BOOST, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_bitrate_boost,
+        msm_vidc_set_vbr_related_properties},
+
+    {MIN_QUALITY, ENC, H264 | HEVC,
+        {BLUR_TYPES, BITRATE_BOOST},
+        msm_vidc_adjust_min_quality,
+        msm_vidc_set_u32},
+
+    {VBV_DELAY, ENC, H264 | HEVC,
+        {0},
+        NULL,
+        msm_vidc_set_cbr_related_properties},
+
+    {PEAK_BITRATE, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_peak_bitrate,
+        msm_vidc_set_cbr_related_properties},
+
+    {MIN_FRAME_QP, ENC, H264,
+        {0},
+        NULL,
+        msm_vidc_set_min_qp},
+
+    {MIN_FRAME_QP, ENC, HEVC,
+        {0},
+        msm_vidc_adjust_hevc_min_qp,
+        msm_vidc_set_min_qp},
+
+    {MAX_FRAME_QP, ENC, H264,
+        {0},
+        NULL,
+        msm_vidc_set_max_qp},
+
+    {MAX_FRAME_QP, ENC, HEVC,
+        {0},
+        msm_vidc_adjust_hevc_max_qp,
+        msm_vidc_set_max_qp},
+
+    {I_FRAME_QP, ENC, HEVC,
+        {0},
+        msm_vidc_adjust_hevc_i_frame_qp,
+        msm_vidc_set_frame_qp},
+
+    {I_FRAME_QP, ENC, H264,
+        {0},
+        NULL,
+        msm_vidc_set_frame_qp},
+
+    {P_FRAME_QP, ENC, HEVC,
+        {0},
+        msm_vidc_adjust_hevc_p_frame_qp,
+        msm_vidc_set_frame_qp},
+
+    {P_FRAME_QP, ENC, H264,
+        {0},
+        NULL,
+        msm_vidc_set_frame_qp},
+
+    {B_FRAME_QP, ENC, HEVC,
+        {0},
+        msm_vidc_adjust_hevc_b_frame_qp,
+        msm_vidc_set_frame_qp},
+
+    {B_FRAME_QP, ENC, H264,
+        {0},
+        NULL,
+        msm_vidc_set_frame_qp},
+
+    {LAYER_TYPE, ENC, H264 | HEVC,
+        {CONTENT_ADAPTIVE_CODING, LTR_COUNT}},
+
+    {LAYER_ENABLE, ENC, H264 | HEVC,
+        {CONTENT_ADAPTIVE_CODING}},
+
+    {ENH_LAYER_COUNT, ENC, H264 | HEVC,
+        {GOP_SIZE, B_FRAME, BIT_RATE, MIN_QUALITY, SLICE_MODE, LTR_COUNT},
+        msm_vidc_adjust_layer_count,
+        msm_vidc_set_layer_count_and_type},
+
+    {L0_BR, ENC, H264 | HEVC,
+        {L1_BR},
+        msm_vidc_adjust_layer_bitrate,
+        msm_vidc_set_layer_bitrate},
+
+    {L1_BR, ENC, H264 | HEVC,
+        {L2_BR},
+        msm_vidc_adjust_layer_bitrate,
+        msm_vidc_set_layer_bitrate},
+
+    {L2_BR, ENC, H264 | HEVC,
+        {L3_BR},
+        msm_vidc_adjust_layer_bitrate,
+        msm_vidc_set_layer_bitrate},
+
+    {L3_BR, ENC, H264 | HEVC,
+        {L4_BR},
+        msm_vidc_adjust_layer_bitrate,
+        msm_vidc_set_layer_bitrate},
+
+    {L4_BR, ENC, H264 | HEVC,
+        {L5_BR},
+        msm_vidc_adjust_layer_bitrate,
+        msm_vidc_set_layer_bitrate},
+
+    {L5_BR, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_layer_bitrate,
+        msm_vidc_set_layer_bitrate},
+
+    {ENTROPY_MODE, ENC, H264,
+        {BIT_RATE},
+        msm_vidc_adjust_entropy_mode,
+        msm_vidc_set_u32},
+
+    {PROFILE, ENC, H264,
+        {ENTROPY_MODE, TRANSFORM_8X8},
+        NULL,
+        msm_vidc_set_u32_enum},
+
+    {PROFILE, DEC, H264,
+        {ENTROPY_MODE},
+        NULL,
+        msm_vidc_set_u32_enum},
+
+    {PROFILE, ENC, HEVC | HEIC,
+        {META_SEI_MASTERING_DISP, META_SEI_CLL, META_HDR10PLUS},
+        msm_vidc_adjust_profile,
+        msm_vidc_set_u32_enum},
+
+    {PROFILE, DEC, HEVC | HEIC,
+        {0},
+        msm_vidc_adjust_profile,
+        msm_vidc_set_u32_enum},
+
+    {PROFILE, DEC, VP9,
+        {0},
+        NULL,
+        msm_vidc_set_u32_enum},
+
+    {LEVEL, DEC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_u32_enum},
+
+    {LEVEL, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_level},
+
+    {HEVC_TIER, ENC | DEC, HEVC | HEIC,
+        {0},
+        NULL,
+        msm_vidc_set_u32_enum},
+
+    {LF_MODE, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_deblock_mode},
+
+    {SLICE_MODE, ENC, H264 | HEVC,
+        {STAGE},
+        msm_vidc_adjust_slice_count,
+        msm_vidc_set_slice_count},
+
+    {SLICE_MODE, ENC, HEIC,
+        {0},
+        msm_vidc_adjust_slice_count,
+        msm_vidc_set_slice_count},
+
+    {TRANSFORM_8X8, ENC, H264,
+        {0},
+        msm_vidc_adjust_transform_8x8,
+        msm_vidc_set_u32},
+
+    {CHROMA_QP_INDEX_OFFSET, ENC, HEVC,
+        {0},
+        msm_vidc_adjust_chroma_qp_index_offset,
+        msm_vidc_set_chroma_qp_index_offset},
+
+    {DISPLAY_DELAY_ENABLE, DEC, H264 | HEVC | VP9,
+        {OUTPUT_ORDER},
+        NULL,
+        NULL},
+
+    {DISPLAY_DELAY, DEC, H264 | HEVC | VP9,
+        {OUTPUT_ORDER},
+        NULL,
+        NULL},
+
+    {OUTPUT_ORDER, DEC, H264 | HEVC | VP9,
+        {0},
+        msm_vidc_adjust_output_order,
+        msm_vidc_set_u32},
+
+    {INPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+        {0},
+        msm_vidc_adjust_input_buf_host_max_count,
+        msm_vidc_set_u32},
+
+    {INPUT_BUF_HOST_MAX_COUNT, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_input_buf_host_max_count,
+        msm_vidc_set_u32},
+
+    {OUTPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+        {0},
+        msm_vidc_adjust_output_buf_host_max_count,
+        msm_vidc_set_u32},
+
+    {OUTPUT_BUF_HOST_MAX_COUNT, ENC, H264 | HEVC,
+        {0},
+        msm_vidc_adjust_output_buf_host_max_count,
+        msm_vidc_set_u32},
+
+    {CONCEAL_COLOR_8BIT, DEC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_u32_packed},
+
+    {CONCEAL_COLOR_10BIT, DEC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_u32_packed},
+
+    {STAGE, ENC | DEC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_stage},
+
+    {STAGE, ENC, H264 | HEVC,
+        {0},
+        NULL,
+        msm_vidc_set_stage},
+
+    {STAGE, DEC, H264 | HEVC | VP9,
+        {0},
+        NULL,
+        msm_vidc_set_stage},
+
+    {PIPE, DEC | ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_pipe},
+
+    {THUMBNAIL_MODE, DEC, H264 | HEVC | VP9,
+        {OUTPUT_ORDER},
+        NULL,
+        msm_vidc_set_u32},
+
+    {THUMBNAIL_MODE, DEC, HEIC,
+        {0},
+        NULL,
+        msm_vidc_set_u32},
+
+    {RAP_FRAME, DEC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_u32},
+
+    {PRIORITY, DEC | ENC, CODECS_ALL,
+        {0},
+        msm_vidc_adjust_session_priority,
+        msm_vidc_set_session_priority},
+
+    {ALL_INTRA, ENC, H264 | HEVC,
+        {LTR_COUNT, IR_PERIOD, SLICE_MODE, BIT_RATE},
+        msm_vidc_adjust_all_intra,
+        NULL},
+
+    {META_EVA_STATS, ENC, HEVC,
+        {0},
+        msm_vidc_adjust_eva_stats,
+        NULL},
+
+    {META_ROI_INFO, ENC, H264 | HEVC,
+        {MIN_QUALITY, IR_PERIOD, BLUR_TYPES},
+        msm_vidc_adjust_roi_info,
+        NULL},
+
+    {GRID_ENABLE, ENC, HEIC,
+        {0},
+        NULL,
+        msm_vidc_set_u32},
+
+    {VUI_TIMING_INFO, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_vui_timing_info},
+
+    {SIGNAL_COLOR_INFO, ENC, CODECS_ALL,
+        {0},
+        NULL,
+        msm_vidc_set_signal_color_info},
+
+    {META_SEI_MASTERING_DISP, ENC, HEVC | HEIC,
+        {0},
+        msm_vidc_adjust_sei_mastering_disp,
+        NULL},
+
+    {META_SEI_CLL, ENC, HEVC | HEIC,
+        {0},
+        msm_vidc_adjust_sei_cll,
+        NULL},
+
+    {META_HDR10PLUS, ENC, HEVC | HEIC,
+        {0},
+        msm_vidc_adjust_hdr10plus,
+        NULL},
+
+    {META_TRANSCODING_STAT_INFO, ENC, HEVC | H264,
+        {0},
+        msm_vidc_adjust_transcoding_stats,
+        NULL},
+};
+
+/* Default UBWC config for LPDDR5 */
+static struct msm_vidc_ubwc_config_data ubwc_config_qcm6490[] = {
+    UBWC_CONFIG(8, 32, 15, 0, 1, 1, 1),
+};
+
+static struct msm_vidc_efuse_data efuse_data_qcm6490[] = {
+    /* IRIS_MULTIPIPE_DISABLE - max 4K@30 */
+    EFUSE_ENTRY(0x221C8118, 4, 0x400, 0xA, SKU_VERSION),
+};
+
+static struct msm_vidc_format_capability format_data_qcm6490 = {
+    .codec_info = codec_data_qcm6490,
+    .codec_info_size = ARRAY_SIZE(codec_data_qcm6490),
+    .color_format_info = color_format_data_qcm6490,
+    .color_format_info_size = ARRAY_SIZE(color_format_data_qcm6490),
+    .color_prim_info = color_primaries_data_qcm6490,
+    .color_prim_info_size = ARRAY_SIZE(color_primaries_data_qcm6490),
+    .transfer_char_info = transfer_char_data_qcm6490,
+    .transfer_char_info_size = ARRAY_SIZE(transfer_char_data_qcm6490),
+    .matrix_coeff_info = matrix_coeff_data_qcm6490,
+    .matrix_coeff_info_size = ARRAY_SIZE(matrix_coeff_data_qcm6490),
+};
+
+/* name, min_kbps, max_kbps */
+static const struct bw_table qcm6490_bw_table[] = {
+    { "iris-cnoc",  1000, 1000     },
+    { "iris-ddr",   1000, 10000000 }
+};
+
+/* name, hw_trigger */
+
+static const struct pd_table qcm6490_pd_table[] = {
+    { "venus"   },
+    { "vcodec0" },
+};
+
+/* name, clock id, scaling */
+static const struct clk_table qcm6490_clk_table[] = {
+    { "bus",     VIDEO_CC_MVSC_CTL_AXI_CLK,      0 },
+    { "iface",   VIDEO_CC_VENUS_AHB_CLK,         0 },
+    { "vcodec_core",     VIDEO_CC_MVS0_CORE_CLK, 1},
+    { "core",      VIDEO_CC_MVSC_CORE_CLK,       1 },
+    { "vcodec_bus",  VIDEO_CC_MVS0_AXI_CLK,      0 },
+
+};
+
+/* name, start, size, secure, dma_coherant, region, dma_mask */
+const struct context_bank_table qcm6490_context_bank_table[] = {
+    {"qcom,vidc,cb-ns", 0x25800000, 0x0, 0, 1, MSM_VIDC_NON_SECURE, 0xe0000000 - 1},
+    {"qcom,vidc,cb-sec-non-pxl",   0x01000000, 0x24800000, 1, 0, MSM_VIDC_SECURE_NONPIXEL,  0 },
+};
+
+/* freq */
+static struct freq_table qcm6490_freq_table_sku0[] = {
+    {460000048}, {424000000}, {335000000}, {240000000}, {133333000},
+};
+
+static struct freq_table qcm6490_freq_table_sku1[] __attribute__((unused)) = {
+    {240000000}
+};
+
+/* register, value, mask */
+static const struct reg_preset_table qcm6490_reg_preset_table[] = {
+    { 0xB0088, 0x0,        0x11      },
+};
+
+/* decoder properties */
+static const u32 qcm6490_vdec_psc_avc[] = {
+    HFI_PROP_BITSTREAM_RESOLUTION,
+    HFI_PROP_CROP_OFFSETS,
+    HFI_PROP_CODED_FRAMES,
+    HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+    HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+    HFI_PROP_PIC_ORDER_CNT_TYPE,
+    HFI_PROP_PROFILE,
+    HFI_PROP_LEVEL,
+    HFI_PROP_SIGNAL_COLOR_INFO,
+    HFI_PROP_MAX_NUM_REORDER_FRAMES,
+};
+
+static const u32 qcm6490_vdec_psc_hevc[] = {
+    HFI_PROP_BITSTREAM_RESOLUTION,
+    HFI_PROP_CROP_OFFSETS,
+    HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+    HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+    HFI_PROP_PROFILE,
+    HFI_PROP_LEVEL,
+    HFI_PROP_TIER,
+    HFI_PROP_SIGNAL_COLOR_INFO,
+    HFI_PROP_MAX_NUM_REORDER_FRAMES,
+};
+
+static const u32 qcm6490_vdec_psc_vp9[] = {
+    HFI_PROP_BITSTREAM_RESOLUTION,
+    HFI_PROP_CROP_OFFSETS,
+    HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+    HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+    HFI_PROP_PROFILE,
+    HFI_PROP_LEVEL,
+};
+
+static const u32 qcm6490_vdec_input_properties_avc[] = {
+    HFI_PROP_NO_OUTPUT,
+    HFI_PROP_SUBFRAME_INPUT,
+    HFI_PROP_DPB_LIST,
+};
+
+static const u32 qcm6490_vdec_input_properties_hevc[] = {
+    HFI_PROP_NO_OUTPUT,
+    HFI_PROP_SUBFRAME_INPUT,
+    HFI_PROP_DPB_LIST,
+};
+
+static const u32 qcm6490_vdec_input_properties_vp9[] = {
+    HFI_PROP_NO_OUTPUT,
+    HFI_PROP_SUBFRAME_INPUT,
+    HFI_PROP_DPB_LIST,
+};
+
+static const u32 qcm6490_vdec_output_properties_avc[] = {
+    HFI_PROP_WORST_COMPRESSION_RATIO,
+    HFI_PROP_WORST_COMPLEXITY_FACTOR,
+    HFI_PROP_PICTURE_TYPE,
+    HFI_PROP_CABAC_SESSION,
+    HFI_PROP_FENCE,
+};
+
+static const u32 qcm6490_vdec_output_properties_hevc[] = {
+    HFI_PROP_WORST_COMPRESSION_RATIO,
+    HFI_PROP_WORST_COMPLEXITY_FACTOR,
+    HFI_PROP_PICTURE_TYPE,
+    HFI_PROP_FENCE,
+};
+
+static const u32 qcm6490_vdec_output_properties_vp9[] = {
+    HFI_PROP_WORST_COMPRESSION_RATIO,
+    HFI_PROP_WORST_COMPLEXITY_FACTOR,
+    HFI_PROP_PICTURE_TYPE,
+    HFI_PROP_FENCE,
+};
+
+static const struct msm_vidc_platform_data qcm6490_data = {
+    /* resources dependent on other module */
+    .bw_tbl = qcm6490_bw_table,
+    .bw_tbl_size = ARRAY_SIZE(qcm6490_bw_table),
+    .clk_tbl = qcm6490_clk_table,
+    .clk_tbl_size = ARRAY_SIZE(qcm6490_clk_table),
+
+    /* populate context bank */
+    .context_bank_tbl = qcm6490_context_bank_table,
+    .context_bank_tbl_size = ARRAY_SIZE(qcm6490_context_bank_table),
+
+    /* platform specific resources */
+    .freq_tbl = qcm6490_freq_table_sku0,
+    .freq_tbl_size = ARRAY_SIZE(qcm6490_freq_table_sku0),
+    .reg_prst_tbl = qcm6490_reg_preset_table,
+    .reg_prst_tbl_size = ARRAY_SIZE(qcm6490_reg_preset_table),
+#if 0
+    .opp_tbl = qcm6490_opp_table,
+    .opp_tbl_size = ARRAY_SIZE(qcm6490_opp_table),
+#endif
+    .pd_tbl = qcm6490_pd_table,
+    .pd_tbl_size = ARRAY_SIZE(qcm6490_pd_table),
+    .fwname = "qcom/vpu-2.0/vpu20_1v",
+    .pas_id = 9,
+    .supports_mmrm = 0,
+
+    /* caps related resorces */
+    .core_data = core_data_qcm6490,
+    .core_data_size = ARRAY_SIZE(core_data_qcm6490),
+    .inst_cap_data = instance_cap_data_qcm6490,
+    .inst_cap_data_size = ARRAY_SIZE(instance_cap_data_qcm6490),
+    .inst_cap_dependency_data = instance_cap_dependency_data_qcm6490,
+    .inst_cap_dependency_data_size = ARRAY_SIZE(instance_cap_dependency_data_qcm6490),
+    .csc_data.vpe_csc_custom_bias_coeff = vpe_csc_custom_bias_coeff,
+    .csc_data.vpe_csc_custom_matrix_coeff = vpe_csc_custom_matrix_coeff,
+    .csc_data.vpe_csc_custom_limit_coeff = vpe_csc_custom_limit_coeff,
+    .ubwc_config = ubwc_config_qcm6490,
+    .format_data = &format_data_qcm6490,
+
+    /* decoder properties related*/
+    .psc_avc_tbl = qcm6490_vdec_psc_avc,
+    .psc_avc_tbl_size = ARRAY_SIZE(qcm6490_vdec_psc_avc),
+    .psc_hevc_tbl = qcm6490_vdec_psc_hevc,
+    .psc_hevc_tbl_size = ARRAY_SIZE(qcm6490_vdec_psc_hevc),
+    .psc_vp9_tbl = qcm6490_vdec_psc_vp9,
+    .psc_vp9_tbl_size = ARRAY_SIZE(qcm6490_vdec_psc_vp9),
+    .dec_input_prop_avc = qcm6490_vdec_input_properties_avc,
+    .dec_input_prop_hevc = qcm6490_vdec_input_properties_hevc,
+    .dec_input_prop_vp9 = qcm6490_vdec_input_properties_vp9,
+    .dec_input_prop_size_avc = ARRAY_SIZE(qcm6490_vdec_input_properties_avc),
+    .dec_input_prop_size_hevc = ARRAY_SIZE(qcm6490_vdec_input_properties_hevc),
+    .dec_input_prop_size_vp9 = ARRAY_SIZE(qcm6490_vdec_input_properties_vp9),
+    .dec_output_prop_avc = qcm6490_vdec_output_properties_avc,
+    .dec_output_prop_hevc = qcm6490_vdec_output_properties_hevc,
+    .dec_output_prop_vp9 = qcm6490_vdec_output_properties_vp9,
+    .dec_output_prop_size_avc = ARRAY_SIZE(qcm6490_vdec_output_properties_avc),
+    .dec_output_prop_size_hevc = ARRAY_SIZE(qcm6490_vdec_output_properties_hevc),
+    .dec_output_prop_size_vp9 = ARRAY_SIZE(qcm6490_vdec_output_properties_vp9),
+
+    /* Fuse specific resources */
+    .efuse_data = efuse_data_qcm6490,
+    .efuse_data_size = ARRAY_SIZE(efuse_data_qcm6490),
+    .sku_version = SKU_VERSION_0,
+};
+
+static int msm_vidc_init_data(struct msm_vidc_core *core)
+{
+    struct device *dev = NULL;
+    int rc = 0;
+
+    dev = &core->pdev->dev;
+
+    d_vpr_h("%s: initialize qcm6490 data\n", __func__);
+
+    core->platform->data = qcm6490_data;
+
+    core->mem_ops = get_mem_ops();
+    if (!core->mem_ops) {
+        d_vpr_e("%s: invalid memory ext ops\n", __func__);
+        return -EINVAL;
+    }
+    core->res_ops = get_resources_ops();
+    if (!core->res_ops) {
+        d_vpr_e("%s: invalid resource ext ops\n", __func__);
+        return -EINVAL;
+    }
+
+    return rc;
+}
+
+int msm_vidc_init_platform_qcm6490(struct msm_vidc_core *core)
+{
+    int rc = 0;
+
+    rc = msm_vidc_init_data(core);
+    if (rc)
+        return rc;
+
+    return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/qcs8300/inc/msm_vidc_qcs8300.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/qcs8300/inc/msm_vidc_qcs8300.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_QCS8300_H_
+#define _MSM_VIDC_QCS8300_H_
+
+#include "msm_vidc_core.h"
+
+int msm_vidc_init_platform_qcs8300(struct msm_vidc_core *core);
+
+#endif // _MSM_VIDC_QCS8300_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/qcs8300/src/msm_vidc_qcs8300.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/qcs8300/src/msm_vidc_qcs8300.c
@@ -0,0 +1,2586 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/clock/qcom,qcs8300-gcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-videocc.h>
+#include <media/v4l2_vidc_extensions.h>
+#include "hfi_command.h"
+#include "hfi_property.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_iris3.h"
+#include "msm_vidc_qcs8300.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_platform_ext.h"
+#include "msm_vidc_memory_ext.h"
+/* version: major[24:31], minor[16:23], revision[0:15] */
+#define DRIVER_VERSION          0x04000000
+#define DEFAULT_VIDEO_CONCEAL_COLOR_BLACK 0x8020010
+#define MAX_LTR_FRAME_COUNT     2
+#define MAX_BASE_LAYER_PRIORITY_ID 63
+#define MAX_OP_POINT            31
+#define MAX_BITRATE             245000000
+#define DEFAULT_BITRATE         20000000
+#define MINIMUM_FPS             1
+#define MAXIMUM_FPS             480
+#define MAX_QP                  51
+#define DEFAULT_QP              20
+#define MAX_CONSTANT_QUALITY    100
+#define MIN_SLICE_BYTE_SIZE     512
+#define MAX_SLICE_BYTE_SIZE       \
+    ((MAX_BITRATE) >> 3)
+#define MAX_SLICE_MB_SIZE         \
+    (((4096 + 15) >> 4) * ((2160 + 15) >> 4))
+
+#define ENC     MSM_VIDC_ENCODER
+#define DEC     MSM_VIDC_DECODER
+#define H264    MSM_VIDC_H264
+#define HEVC    MSM_VIDC_HEVC
+#define VP9     MSM_VIDC_VP9
+#define AV1     MSM_VIDC_AV1
+#define CODECS_ALL        (H264 | HEVC | VP9 | AV1)
+#define ENC_CODECS_ALL    (H264 | HEVC)
+#define MAXIMUM_OVERRIDE_VP9_FPS 200
+
+static struct codec_info codec_data_qcs8300[] = {
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_H264,
+		.vidc_codec  = MSM_VIDC_H264,
+		.pixfmt_name = "AVC",
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_HEVC,
+		.vidc_codec  = MSM_VIDC_HEVC,
+		.pixfmt_name = "HEVC",
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_VP9,
+		.vidc_codec  = MSM_VIDC_VP9,
+		.pixfmt_name = "VP9",
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_AV1,
+		.vidc_codec  = MSM_VIDC_AV1,
+		.pixfmt_name = "AV1",
+	},
+};
+
+static struct color_format_info color_format_data_qcs8300[] = {
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_NV12,
+		.vidc_color_format = MSM_VIDC_FMT_NV12,
+		.pixfmt_name       = "NV12",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_NV21,
+		.vidc_color_format = MSM_VIDC_FMT_NV21,
+		.pixfmt_name       = "NV21",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_QC08C,
+		.vidc_color_format = MSM_VIDC_FMT_NV12C,
+		.pixfmt_name       = "NV12C",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_QC10C,
+		.vidc_color_format = MSM_VIDC_FMT_TP10C,
+		.pixfmt_name       = "TP10C",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_RGBA32,
+		.vidc_color_format = MSM_VIDC_FMT_RGBA8888,
+		.pixfmt_name       = "RGBA",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_P010,
+		.vidc_color_format = MSM_VIDC_FMT_P010,
+		.pixfmt_name       = "P010",
+	},
+	{
+		.v4l2_color_format = V4L2_META_FMT_VIDC,
+		.vidc_color_format = MSM_VIDC_FMT_META,
+		.pixfmt_name       = "META",
+	},
+};
+
+static struct color_primaries_info color_primaries_data_qcs8300[] = {
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_DEFAULT,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_RESERVED,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_DEFAULT,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_UNSPECIFIED,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_REC709,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT709,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_470_SYSTEM_M,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT470_SYSTEM_M,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_470_SYSTEM_BG,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT470_SYSTEM_BG,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_SMPTE170M,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT601_525,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_SMPTE240M,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_ST240M,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_VIDC_GENERIC_FILM,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_GENERIC_FILM,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_BT2020,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT2020,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_DCI_P3,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_RP431_2,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_VIDC_EG431,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_EG431_1,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_VIDC_EBU_TECH,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_EBU_TECH,
+	},
+};
+
+static struct transfer_char_info transfer_char_data_qcs8300[] = {
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_DEFAULT,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_RESERVED,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_DEFAULT,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_UNSPECIFIED,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_709,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT709,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT470_SYSTEM_M,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT470_SYSTEM_M,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT470_SYSTEM_BG,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT470_SYSTEM_BG,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT601_525_OR_625,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT601_525_OR_625,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_SMPTE240M,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_SMPTE_ST240M,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_LINEAR,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_LINEAR,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_XVYCC,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_XVYCC,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT1361,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT1361_0,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_SRGB,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_SRGB_SYCC,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT2020,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT2020_14,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_SMPTE2084,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_SMPTE_ST2084_PQ,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_ST428,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_SMPTE_ST428_1,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_HLG,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT2100_2_HLG,
+	},
+};
+
+static struct matrix_coeff_info matrix_coeff_data_qcs8300[] = {
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_DEFAULT,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_RESERVED,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_DEFAULT,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_UNSPECIFIED,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_VIDC_SRGB_OR_SMPTE_ST428,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_SRGB_SMPTE_ST428_1,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_709,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT709,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_XV709,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT709,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_VIDC_FCC47_73_682,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_FCC_TITLE_47,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_XV601,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT470_SYS_BG_OR_BT601_625,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_601,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT601_525_BT1358_525_OR_625,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_SMPTE240M,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_SMPTE_ST240,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_BT2020,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT2020_NON_CONSTANT,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_BT2020_CONST_LUM,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT2020_CONSTANT,
+	},
+};
+
+static struct msm_platform_core_capability core_data_qcs8300[] = {
+	/* {type, value} */
+	{ENC_CODECS, H264|HEVC},
+	{DEC_CODECS, H264|HEVC|VP9|AV1},
+	{MAX_SESSION_COUNT, 16},
+	{MAX_NUM_720P_SESSIONS, 16},
+	{MAX_NUM_1080P_SESSIONS, 16},
+	{MAX_NUM_4K_SESSIONS, 4},
+	{MAX_SECURE_SESSION_COUNT, 3},
+	{MAX_RT_MBPF, (((4096 * 2176) / 256) * 4)},	/* (4096*2176)/256 * 4 */
+	{MAX_MBPF, (((4096 * 2176) / 256) * 4)}, /* (4096*2176)/256 * 4 */
+	{MAX_MBPS, (((3840 * 2176) / 256) * 120)},	/* max_load 3840x2176@120fps */
+	{MAX_IMAGE_MBPF, ((16384 * 16384) / 256)},  /* (16384x16384)/256 */
+	{MAX_MBPF_HQ, ((1280 * 720) / 256)}, /* ((1280*720)/256)) */
+	{MAX_MBPS_HQ, (((1280 * 720) / 256) * 30)}, /* ((1280*720)/256))@30fps */
+	{MAX_MBPF_B_FRAME, ((1920 * 1088) / 256 * 2)}, /* (1920*1088)/256 * 2 */
+	{MAX_MBPS_B_FRAME, (((1920 * 1088 ) / 256) * 120)}, /* ((1920*1088)/256)@120fps */
+	{MAX_MBPS_ALL_INTRA, (((1920 * 1088) / 256) * 120)}, /* ((1920*1088)/256)@120fps */
+	{MAX_ENH_LAYER_COUNT, 5},
+	{NUM_VPP_PIPE, 2},
+	{SW_PC, 1},
+	{FW_UNLOAD, 0},
+	{HW_RESPONSE_TIMEOUT, HW_RESPONSE_TIMEOUT_VALUE}, /* 1000 ms */
+	{SW_PC_DELAY,         SW_PC_DELAY_VALUE        }, /* 1500 ms (>HW_RESPONSE_TIMEOUT)*/
+	{FW_UNLOAD_DELAY,     FW_UNLOAD_DELAY_VALUE    }, /* 3000 ms (>SW_PC_DELAY)*/
+	{PAGEFAULT_NON_FATAL, 1},
+	{PAGETABLE_CACHING, 0},
+	{DCVS, 1},
+	{DECODE_BATCH, 1},
+	{DECODE_BATCH_TIMEOUT, 200},
+	{STATS_TIMEOUT_MS, 2000},
+	{AV_SYNC_WINDOW_SIZE, 40},
+	{NON_FATAL_FAULTS, 1},
+	{ENC_AUTO_FRAMERATE, 0},
+	{DEVICE_CAPS, V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_META_CAPTURE |
+		V4L2_CAP_STREAMING},
+	{SUPPORTS_SYNX_FENCE, 0},
+	{SUPPORTS_REQUESTS, 0},
+};
+
+static struct msm_platform_inst_capability instance_cap_data_qcs8300[] = {
+	/* {cap, domain, codec,
+	 *      min, max, step_or_mask, value,
+	 *      v4l2_id,
+	 *      hfi_id,
+	 *      flags}
+	 */
+	{DRV_VERSION, DEC|ENC, CODECS_ALL,
+		0, INT_MAX, 1, DRIVER_VERSION,
+		V4L2_CID_MPEG_VIDC_DRIVER_VERSION},
+
+	{FRAME_WIDTH, DEC, CODECS_ALL, 96, 4096, 1, 1920},
+
+	{FRAME_WIDTH, ENC, ENC_CODECS_ALL, 128, 4096, 1, 1920},
+
+	{LOSSLESS_FRAME_WIDTH, ENC, HEVC, 96, 1280, 1, 1280},
+
+	{SECURE_FRAME_WIDTH, DEC, H264|HEVC|VP9, 96, 4096, 1, 1920},
+
+	{SECURE_FRAME_WIDTH, ENC, ENC_CODECS_ALL, 128, 4096, 1, 1920},
+
+	{FRAME_HEIGHT, DEC, CODECS_ALL, 96, 4096, 1, 1080},
+
+	{FRAME_HEIGHT, ENC, ENC_CODECS_ALL, 128, 4096, 1, 1080},
+
+	{LOSSLESS_FRAME_HEIGHT, ENC, HEVC, 96, 720, 1, 720},
+
+	{SECURE_FRAME_HEIGHT, DEC, H264|HEVC|VP9, 96, 4096, 1, 1080},
+
+	{SECURE_FRAME_HEIGHT, ENC, ENC_CODECS_ALL, 128, 4096, 1, 1080},
+
+	{PIX_FMTS, ENC | DEC, H264,
+		MSM_VIDC_FMT_NV12,
+		MSM_VIDC_FMT_NV12C,
+		MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C,
+		MSM_VIDC_FMT_NV12C},
+
+	{PIX_FMTS, ENC | DEC, HEVC,
+		MSM_VIDC_FMT_NV12,
+		MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C |
+		MSM_VIDC_FMT_P010 | MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12C},
+
+	{PIX_FMTS, DEC, VP9 | AV1,
+		MSM_VIDC_FMT_NV12,
+		MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C |
+		MSM_VIDC_FMT_P010 | MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12C},
+
+	{MIN_BUFFERS_INPUT, ENC | DEC, CODECS_ALL, 0, 64, 1, 4,
+		V4L2_CID_MIN_BUFFERS_FOR_OUTPUT,
+		0,
+		CAP_FLAG_VOLATILE},
+
+	{MIN_BUFFERS_OUTPUT, ENC | DEC, CODECS_ALL, 0, 64, 1, 4,
+		V4L2_CID_MIN_BUFFERS_FOR_CAPTURE,
+		HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_VOLATILE},
+
+	/* (4096 * 2176) / 256 */
+	{MBPF, ENC, CODECS_ALL, 64, 34816, 1, 34816},
+
+	{MBPF, DEC, CODECS_ALL, 36, 34816, 1, 34816},
+
+	/* (4096 * 2176) / 256 */
+	{MBPF, DEC, VP9, 36, 34816, 1, 34816},
+
+	/* (4096 * 2176) / 256 */
+	{LOSSLESS_MBPF, ENC, ENC_CODECS_ALL, 64, 34816, 1, 34816},
+
+	/* Batch Mode Decode */
+	/* TODO: update with new values based on updated voltage corner */
+	{BATCH_MBPF, DEC, CODECS_ALL, 64, 34816, 1, 34816},
+
+	/* (4096 * 2176) / 256 */
+	{BATCH_FPS, DEC, CODECS_ALL, 1, 120, 1, 120},
+
+	{SECURE_MBPF, ENC | DEC, CODECS_ALL, 64, 34816, 1, 34816},
+
+	{FRAME_RATE, ENC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_FPS << 16),
+		1, (DEFAULT_FPS << 16),
+		0,
+		HFI_PROP_FRAME_RATE,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{FRAME_RATE, DEC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_FPS << 16),
+		1, (DEFAULT_FPS << 16),
+		V4L2_CID_MPEG_VIDC_FRAME_RATE,
+		0,
+		CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{OPERATING_RATE, ENC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_FPS << 16),
+		1, (DEFAULT_FPS << 16)},
+
+	{OPERATING_RATE, DEC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_FPS << 16),
+		1, (DEFAULT_FPS << 16),
+		V4L2_CID_MPEG_VIDC_OPERATING_RATE,
+		0,
+		CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{OPERATING_RATE, DEC, VP9,
+		(MINIMUM_FPS << 16), (MAXIMUM_OVERRIDE_VP9_FPS << 16),
+		1, (DEFAULT_FPS << 16),
+		V4L2_CID_MPEG_VIDC_OPERATING_RATE,
+		0,
+		CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{INPUT_RATE, ENC | DEC, CODECS_ALL,
+		(MINIMUM_FPS << 16), INT_MAX,
+		1, (DEFAULT_FPS << 16)},
+
+	{TIMESTAMP_RATE, ENC | DEC, CODECS_ALL,
+		(MINIMUM_FPS << 16), INT_MAX,
+		1, (DEFAULT_FPS << 16)},
+
+	{SCALE_FACTOR, ENC, H264 | HEVC, 1, 8, 1, 8},
+
+	{MB_CYCLES_VSP, ENC, CODECS_ALL, 25, 25, 1, 25},
+
+	{MB_CYCLES_VSP, DEC, CODECS_ALL, 25, 25, 1, 25},
+
+	{MB_CYCLES_VSP, DEC, VP9 | AV1, 60, 60, 1, 60},
+
+	{MB_CYCLES_VPP, ENC, CODECS_ALL, 675, 675, 1, 675},
+
+	{MB_CYCLES_VPP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+	{MB_CYCLES_LP, ENC, CODECS_ALL, 320, 320, 1, 320},
+
+	{MB_CYCLES_LP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+	{MB_CYCLES_FW, ENC | DEC, CODECS_ALL, 326389, 326389, 1, 326389},
+
+	{MB_CYCLES_FW_VPP, ENC | DEC, CODECS_ALL, 44156, 44156, 1, 44156},
+
+	{ENC_RING_BUFFER_COUNT, ENC, CODECS_ALL, 0, 0, 1, 0},
+
+	{CLIENT_ID, ENC | DEC, CODECS_ALL,
+		INVALID_CLIENT_ID, INT_MAX, 1, INVALID_CLIENT_ID,
+		V4L2_CID_MPEG_VIDC_CLIENT_ID},
+
+	{SECURE_MODE, ENC | DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_SECURE,
+		HFI_PROP_SECURE,
+		CAP_FLAG_NONE},
+
+	/*
+	 * Client will enable V4L2_CID_MPEG_VIDC_METADATA_OUTBUF_FENCE
+	 * to get fence_id in input metadata buffer done.
+	 */
+	{META_OUTBUF_FENCE, DEC, H264 | HEVC | VP9 | AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_OUTBUF_FENCE,
+		HFI_PROP_FENCE,
+		CAP_FLAG_BITMASK | CAP_FLAG_META | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	/*
+	 * Client to do set_ctrl with FENCE_ID to set fence_id
+	 * and then client will do get_ctrl with FENCE_FD to get
+	 * fence_fd corresponding to client set fence_id.
+	 */
+	{FENCE_ID, DEC, CODECS_ALL,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_SW_FENCE_ID,
+		0,
+		CAP_FLAG_DYNAMIC_ALLOWED | CAP_FLAG_OUTPUT_PORT},
+
+	{FENCE_FD, DEC, CODECS_ALL,
+		INVALID_FD, INT_MAX, 1, INVALID_FD,
+		V4L2_CID_MPEG_VIDC_SW_FENCE_FD,
+		0,
+		CAP_FLAG_VOLATILE},
+
+	{TS_REORDER, DEC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_TS_REORDER},
+
+	{HFLIP, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_HFLIP,
+		HFI_PROP_FLIP,
+		CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{VFLIP, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_VFLIP,
+		HFI_PROP_FLIP,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ROTATION, ENC, CODECS_ALL,
+		0, 270, 90, 0,
+		V4L2_CID_ROTATE,
+		HFI_PROP_ROTATION,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{SUPER_FRAME, ENC, H264 | HEVC,
+		0, 32, 1, 0,
+		V4L2_CID_MPEG_VIDC_SUPERFRAME, 0,
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{SLICE_DECODE, DEC, H264 | HEVC | AV1,
+		V4L2_MPEG_MSM_VIDC_DISABLE,
+		V4L2_MPEG_MSM_VIDC_DISABLE,
+		0,
+		V4L2_MPEG_MSM_VIDC_DISABLE,
+		V4L2_CID_MPEG_VIDEO_DECODER_SLICE_INTERFACE,
+		0},
+
+	{HEADER_MODE, ENC, CODECS_ALL,
+		V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE,
+		V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+		BIT(V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE) |
+		BIT(V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME),
+		V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+		V4L2_CID_MPEG_VIDEO_HEADER_MODE,
+		HFI_PROP_SEQ_HEADER_MODE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{PREPEND_SPSPPS_TO_IDR, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_PREPEND_SPSPPS_TO_IDR},
+
+	{VUI_TIMING_INFO, ENC, CODECS_ALL,
+		V4L2_MPEG_MSM_VIDC_DISABLE,
+		V4L2_MPEG_MSM_VIDC_ENABLE,
+		1, V4L2_MPEG_MSM_VIDC_DISABLE,
+		V4L2_CID_MPEG_VIDC_VUI_TIMING_INFO,
+		HFI_PROP_DISABLE_VUI_TIMING_INFO,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{WITHOUT_STARTCODE, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_WITHOUT_STARTCODE,
+		HFI_PROP_NAL_LENGTH_FIELD,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{WITHOUT_STARTCODE, DEC, AV1,
+		0, 0, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_WITHOUT_STARTCODE,
+		HFI_PROP_NAL_LENGTH_FIELD,
+		CAP_FLAG_INPUT_PORT},
+	{NAL_LENGTH_FIELD, ENC, CODECS_ALL,
+		V4L2_MPEG_VIDEO_HEVC_SIZE_0,
+		V4L2_MPEG_VIDEO_HEVC_SIZE_4,
+		BIT(V4L2_MPEG_VIDEO_HEVC_SIZE_0) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_SIZE_4),
+		V4L2_MPEG_VIDEO_HEVC_SIZE_0,
+		V4L2_CID_MPEG_VIDEO_HEVC_SIZE_OF_LENGTH_FIELD,
+		HFI_PROP_NAL_LENGTH_FIELD,
+		CAP_FLAG_MENU | CAP_FLAG_OUTPUT_PORT},
+
+	/* TODO: Firmware introduced enumeration type for this
+	 * with and without seq header.
+	 */
+	{REQUEST_I_FRAME, ENC, H264 | HEVC,
+		0, 0, 0, 0,
+		V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
+		HFI_PROP_REQUEST_SYNC_FRAME,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	/* Enc: Keeping CABAC and CAVLC as same bitrate.
+	 * Dec: there's no use of Bitrate cap
+	 */
+	{BIT_RATE, ENC, H264 | HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_BITRATE,
+		HFI_PROP_TOTAL_BITRATE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{BITRATE_MODE, ENC, H264,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_MBR,
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_MBR),
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+		HFI_PROP_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{BITRATE_MODE, ENC, HEVC,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_MBR,
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CQ)  |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_MBR),
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+		HFI_PROP_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{CABAC_MAX_BITRATE, ENC, H264 | HEVC, 0,
+		160000000, 1, 160000000},
+
+	{CAVLC_MAX_BITRATE, ENC, H264, 0,
+		220000000, 1, 220000000},
+
+	{ALLINTRA_MAX_BITRATE, ENC, H264 | HEVC, 0,
+		245000000, 1, 245000000},
+
+	{LOWLATENCY_MAX_BITRATE, ENC, H264 | HEVC, 0,
+		70000000, 1, 70000000},
+
+	{NUM_COMV, DEC, CODECS_ALL,
+		0, INT_MAX, 1, 0},
+
+	{LOSSLESS, ENC, HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_LOSSLESS_CU},
+
+	{FRAME_SKIP_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT,
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED) |
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_LEVEL_LIMIT) |
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT),
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+		V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{FRAME_RC_ENABLE, ENC, H264 | HEVC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_FRAME_RC_ENABLE},
+
+	{CONSTANT_QUALITY, ENC, HEVC,
+		1, MAX_CONSTANT_QUALITY, 1, 90,
+		V4L2_CID_MPEG_VIDEO_CONSTANT_QUALITY,
+		HFI_PROP_CONSTANT_QUALITY,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{GOP_SIZE, ENC, CODECS_ALL,
+		0, INT_MAX, 1, 2 * DEFAULT_FPS - 1,
+		V4L2_CID_MPEG_VIDEO_GOP_SIZE,
+		HFI_PROP_MAX_GOP_FRAMES,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{GOP_CLOSURE, ENC, H264 | HEVC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_GOP_CLOSURE,
+		0},
+
+	{B_FRAME, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_B_FRAMES,
+		HFI_PROP_MAX_B_FRAMES,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{BLUR_TYPES, ENC, H264 | HEVC,
+		MSM_VIDC_BLUR_NONE, MSM_VIDC_BLUR_EXTERNAL,
+		BIT(MSM_VIDC_BLUR_NONE) | BIT(MSM_VIDC_BLUR_EXTERNAL),
+		MSM_VIDC_BLUR_NONE,
+		V4L2_CID_MPEG_VIDC_VIDEO_BLUR_TYPES,
+		HFI_PROP_BLUR_TYPES,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{BLUR_RESOLUTION, ENC, H264 | HEVC,
+		0, S32_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_VIDEO_BLUR_RESOLUTION,
+		HFI_PROP_BLUR_RESOLUTION,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{CSC, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_CSC,
+		HFI_PROP_CSC,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{CSC_CUSTOM_MATRIX, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_VIDEO_VPE_CSC_CUSTOM_MATRIX,
+		HFI_PROP_CSC_MATRIX,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{LOWLATENCY_MODE, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_LOWLATENCY_REQUEST,
+		0,
+		CAP_FLAG_NONE},
+
+	{LOWLATENCY_MODE, DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_LOWLATENCY_REQUEST,
+		HFI_PROP_SEQ_CHANGE_AT_SYNC_FRAME,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{LTR_COUNT, ENC, H264 | HEVC,
+		0, MAX_LTR_FRAME_COUNT, 1, 0,
+		V4L2_CID_MPEG_VIDEO_LTR_COUNT,
+		HFI_PROP_LTR_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{USE_LTR, ENC, H264 | HEVC,
+		0,
+		((1 << MAX_LTR_FRAME_COUNT) - 1),
+		0, 0,
+		V4L2_CID_MPEG_VIDEO_USE_LTR_FRAMES,
+		HFI_PROP_LTR_USE,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{MARK_LTR, ENC, H264 | HEVC,
+		INVALID_DEFAULT_MARK_OR_USE_LTR,
+		(MAX_LTR_FRAME_COUNT - 1),
+		1, INVALID_DEFAULT_MARK_OR_USE_LTR,
+		V4L2_CID_MPEG_VIDEO_FRAME_LTR_INDEX,
+		HFI_PROP_LTR_MARK,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{BASELAYER_PRIORITY, ENC, H264,
+		0, MAX_BASE_LAYER_PRIORITY_ID, 1, 0,
+		V4L2_CID_MPEG_VIDEO_BASELAYER_PRIORITY_ID,
+		HFI_PROP_BASELAYER_PRIORITYID,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{IR_TYPE, ENC, H264 | HEVC,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC,
+		BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM) |
+		BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC),
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{IR_PERIOD, ENC, H264 | HEVC,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD,
+		0,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{AU_DELIMITER, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_AU_DELIMITER,
+		HFI_PROP_AUD,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{TIME_DELTA_BASED_RC, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_TIME_DELTA_BASED_RC,
+		HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{CONTENT_ADAPTIVE_CODING, ENC, H264 | HEVC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDC_CONTENT_ADAPTIVE_CODING,
+		HFI_PROP_CONTENT_ADAPTIVE_CODING,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{REQUEST_PREPROCESS, ENC, H264 | HEVC,
+		MSM_VIDC_PREPROCESS_NONE,
+		MSM_VIDC_PREPROCESS_TYPE0,
+		BIT(MSM_VIDC_PREPROCESS_NONE) |
+		BIT(MSM_VIDC_PREPROCESS_TYPE0),
+		MSM_VIDC_PREPROCESS_NONE,
+		0, HFI_PROP_REQUEST_PREPROCESS,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{BITRATE_BOOST, ENC, H264 | HEVC,
+		0, MAX_BITRATE_BOOST, 25, MAX_BITRATE_BOOST,
+		V4L2_CID_MPEG_VIDC_QUALITY_BITRATE_BOOST,
+		HFI_PROP_BITRATE_BOOST,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{MIN_QUALITY, ENC, H264 | HEVC,
+		0, MAX_SUPPORTED_MIN_QUALITY, 70, MAX_SUPPORTED_MIN_QUALITY,
+		0,
+		HFI_PROP_MAINTAIN_MIN_QUALITY,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{VBV_DELAY, ENC, H264 | HEVC,
+		100, 300, 100, 300,  // if the min value is wrong?
+		V4L2_CID_MPEG_VIDEO_VBV_DELAY,
+		HFI_PROP_VBV_DELAY,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{PEAK_BITRATE, ENC, H264 | HEVC,
+		/* default peak bitrate is 10% larger than avg bitrate */
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_BITRATE_PEAK,
+		HFI_PROP_TOTAL_PEAK_BITRATE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{MIN_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_MIN_QP,
+		HFI_PROP_MIN_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{MIN_FRAME_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_MIN_QP,
+		HFI_PROP_MIN_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{I_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MIN_QP},
+
+	{I_FRAME_MIN_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MIN_QP},
+
+	{P_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MIN_QP},
+
+	{P_FRAME_MIN_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MIN_QP},
+
+	{B_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MIN_QP},
+
+	{B_FRAME_MIN_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MIN_QP},
+
+	{MAX_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
+		HFI_PROP_MAX_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{MAX_FRAME_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_MAX_QP,
+		HFI_PROP_MAX_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{I_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MAX_QP},
+
+	{I_FRAME_MAX_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MAX_QP},
+
+	{P_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MAX_QP},
+
+	{P_FRAME_MAX_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MAX_QP},
+
+	{B_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MAX_QP},
+
+	{B_FRAME_MAX_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MAX_QP},
+
+	{I_FRAME_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{I_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{P_FRAME_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{P_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{B_FRAME_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{B_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{LAYER_TYPE, ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B,
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+		BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P),
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_TYPE,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LAYER_TYPE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B,
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+		BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B) |
+		BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P),
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_TYPE,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LAYER_ENABLE, ENC, H264,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{LAYER_ENABLE, ENC, HEVC,
+		0, 1, 1, 0,
+		0,
+		0,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{ENH_LAYER_COUNT, ENC, HEVC,
+		0, 5, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_LAYER,
+		HFI_PROP_LAYER_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ENH_LAYER_COUNT, ENC, H264,
+		0, 5, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_LAYER,
+		HFI_PROP_LAYER_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ENH_LAYER_COUNT, DEC, AV1,
+		0, MAX_OP_POINT, 1, 0,
+		0,
+		HFI_PROP_AV1_OP_POINT,
+		CAP_FLAG_INPUT_PORT},
+
+	{L0_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L0_BR,
+		HFI_PROP_BITRATE_LAYER1,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L0_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L0_BR,
+		HFI_PROP_BITRATE_LAYER1,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L1_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L1_BR,
+		HFI_PROP_BITRATE_LAYER2,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L1_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L1_BR,
+		HFI_PROP_BITRATE_LAYER2,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L2_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L2_BR,
+		HFI_PROP_BITRATE_LAYER3,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L2_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L2_BR,
+		HFI_PROP_BITRATE_LAYER3,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L3_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L3_BR,
+		HFI_PROP_BITRATE_LAYER4,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+	{L3_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L3_BR,
+		HFI_PROP_BITRATE_LAYER4,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L4_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L4_BR,
+		HFI_PROP_BITRATE_LAYER5,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L4_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L4_BR,
+		HFI_PROP_BITRATE_LAYER5,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L5_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L5_BR,
+		HFI_PROP_BITRATE_LAYER6,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L5_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L5_BR,
+		HFI_PROP_BITRATE_LAYER6,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ENTROPY_MODE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) |
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC),
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		V4L2_CID_MPEG_VIDEO_H264_ENTROPY_MODE,
+		HFI_PROP_CABAC_SESSION,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{ENTROPY_MODE, DEC, H264 | HEVC | VP9 | AV1,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) |
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC),
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		0,
+		HFI_PROP_CABAC_SESSION},
+
+	{PROFILE, ENC | DEC, H264,
+		V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+		V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH,
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH),
+		V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{PROFILE, ENC | DEC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE,
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_STILL_PICTURE) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE),
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+		V4L2_CID_MPEG_VIDEO_HEVC_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{PROFILE, DEC, VP9,
+		V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+		V4L2_MPEG_VIDEO_VP9_PROFILE_2,
+		BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_2),
+		V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+		V4L2_CID_MPEG_VIDEO_VP9_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{PROFILE, DEC, AV1,
+		V4L2_MPEG_VIDC_AV1_PROFILE_MAIN,
+		V4L2_MPEG_VIDC_AV1_PROFILE_MAIN,
+		BIT(V4L2_MPEG_VIDC_AV1_PROFILE_MAIN),
+		V4L2_MPEG_VIDC_AV1_PROFILE_MAIN,
+		V4L2_CID_MPEG_VIDC_AV1_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_H264_LEVEL_6_0,
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_0),
+		V4L2_MPEG_VIDEO_H264_LEVEL_5_0,
+		V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2),
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_5,
+		V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, DEC, H264,
+		V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_H264_LEVEL_6_2,
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_2),
+		V4L2_MPEG_VIDEO_H264_LEVEL_6_1,
+		V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, DEC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_1)|
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2),
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_6_1,
+		V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, DEC, VP9,
+		V4L2_MPEG_VIDEO_VP9_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_VP9_LEVEL_6_0,
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_6_0),
+		V4L2_MPEG_VIDEO_VP9_LEVEL_6_0,
+		V4L2_CID_MPEG_VIDEO_VP9_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, DEC, AV1,
+		V4L2_MPEG_VIDC_AV1_LEVEL_2_0,
+		V4L2_MPEG_VIDC_AV1_LEVEL_6_1,
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_2_3) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_3_3) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_4_3) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_5_3) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_6_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_6_1),
+		V4L2_MPEG_VIDC_AV1_LEVEL_6_1,
+		V4L2_CID_MPEG_VIDC_AV1_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{AV1_TIER, DEC, AV1,
+		V4L2_MPEG_VIDC_AV1_TIER_MAIN,
+		V4L2_MPEG_VIDC_AV1_TIER_HIGH,
+		BIT(V4L2_MPEG_VIDC_AV1_TIER_MAIN) |
+		BIT(V4L2_MPEG_VIDC_AV1_TIER_HIGH),
+		V4L2_MPEG_VIDC_AV1_TIER_HIGH,
+		V4L2_CID_MPEG_VIDC_AV1_TIER,
+		HFI_PROP_TIER,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{HEVC_TIER, ENC | DEC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+		V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+		BIT(V4L2_MPEG_VIDEO_HEVC_TIER_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_TIER_HIGH),
+		V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+		V4L2_CID_MPEG_VIDEO_HEVC_TIER,
+		HFI_PROP_TIER,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LF_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED,
+		DB_H264_DISABLE_SLICE_BOUNDARY,
+		BIT(V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED) |
+		BIT(V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED) |
+		BIT(DB_H264_DISABLE_SLICE_BOUNDARY),
+		V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED,
+		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE,
+		HFI_PROP_DEBLOCKING_MODE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LF_MODE, ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_DISABLED,
+		DB_HEVC_DISABLE_SLICE_BOUNDARY,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_DISABLED) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_ENABLED) |
+		BIT(DB_HEVC_DISABLE_SLICE_BOUNDARY),
+		V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_ENABLED,
+		V4L2_CID_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE,
+		HFI_PROP_DEBLOCKING_MODE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LF_ALPHA, ENC, H264,
+		-6, 6, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA},
+
+	{LF_ALPHA, ENC, HEVC,
+		-6, 6, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_LF_TC_OFFSET_DIV2},
+
+	{LF_BETA, ENC, H264,
+		-6, 6, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA},
+
+	{LF_BETA, ENC, HEVC,
+		-6, 6, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_LF_BETA_OFFSET_DIV2},
+
+	{SLICE_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES,
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE) |
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) |
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES),
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{SLICE_MAX_BYTES, ENC, H264 | HEVC,
+		MIN_SLICE_BYTE_SIZE, MAX_SLICE_BYTE_SIZE,
+		1, MIN_SLICE_BYTE_SIZE,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_BYTES,
+		HFI_PROP_MULTI_SLICE_BYTES_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{SLICE_MAX_MB, ENC, H264 | HEVC,
+		1, MAX_SLICE_MB_SIZE, 1, 1,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_MB,
+		HFI_PROP_MULTI_SLICE_MB_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{MB_RC, ENC, H264 | HEVC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_MB_RC_ENABLE,
+		0,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{TRANSFORM_8X8, ENC, H264,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM,
+		HFI_PROP_8X8_TRANSFORM,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{CHROMA_QP_INDEX_OFFSET, ENC, HEVC,
+		MIN_CHROMA_QP_OFFSET, MAX_CHROMA_QP_OFFSET,
+		1, MAX_CHROMA_QP_OFFSET,
+		V4L2_CID_MPEG_VIDEO_H264_CHROMA_QP_INDEX_OFFSET,
+		HFI_PROP_CHROMA_QP_OFFSET,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{DISPLAY_DELAY_ENABLE, DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT},
+
+	{DISPLAY_DELAY, DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT},
+
+	{OUTPUT_ORDER, DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT},
+
+	{INPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		DEFAULT_MAX_HOST_BUF_COUNT, DEFAULT_MAX_HOST_BURST_BUF_COUNT,
+		1, DEFAULT_MAX_HOST_BUF_COUNT,
+		0,
+		HFI_PROP_BUFFER_HOST_MAX_COUNT,
+		CAP_FLAG_INPUT_PORT},
+
+	{OUTPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		DEFAULT_MAX_HOST_BUF_COUNT, DEFAULT_MAX_HOST_BURST_BUF_COUNT,
+		1, DEFAULT_MAX_HOST_BUF_COUNT,
+		0,
+		HFI_PROP_BUFFER_HOST_MAX_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{CONCEAL_COLOR_8BIT, DEC, CODECS_ALL, 0x0, 0xff3fcff, 1,
+		DEFAULT_VIDEO_CONCEAL_COLOR_BLACK,
+		V4L2_CID_MPEG_VIDEO_MUTE_YUV,
+		HFI_PROP_CONCEAL_COLOR_8BIT,
+		CAP_FLAG_INPUT_PORT},
+
+	{CONCEAL_COLOR_10BIT, DEC, CODECS_ALL, 0x0, 0x3fffffff, 1,
+		DEFAULT_VIDEO_CONCEAL_COLOR_BLACK,
+		V4L2_CID_MPEG_VIDEO_MUTE_YUV,
+		HFI_PROP_CONCEAL_COLOR_10BIT,
+		CAP_FLAG_INPUT_PORT},
+
+	{STAGE, DEC|ENC, CODECS_ALL,
+		MSM_VIDC_STAGE_1,
+		MSM_VIDC_STAGE_2, 1,
+		MSM_VIDC_STAGE_2,
+		0,
+		HFI_PROP_STAGE},
+
+	{PIPE, DEC|ENC, CODECS_ALL,
+		MSM_VIDC_PIPE_1,
+		MSM_VIDC_PIPE_2, 1,
+		MSM_VIDC_PIPE_2,
+		0,
+		HFI_PROP_PIPE},  //modify pipe num
+
+	{POC, DEC, H264,
+		0, 2, 1, 1,
+		0,
+		HFI_PROP_PIC_ORDER_CNT_TYPE,
+		CAP_FLAG_VOLATILE},
+
+	/*
+	 * value of MAX_NUM_REORDER_FRAMES is 32 packed as mentioned below
+	 * (max_num_reorder_count << 16) | max_dec_frame_buffering_count
+	 */
+	{MAX_NUM_REORDER_FRAMES, DEC, H264 | HEVC,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_MAX_NUM_REORDER_FRAMES,
+		HFI_PROP_MAX_NUM_REORDER_FRAMES,
+		CAP_FLAG_VOLATILE},
+
+	{QUALITY_MODE, ENC, CODECS_ALL,
+		MSM_VIDC_MAX_QUALITY_MODE,
+		MSM_VIDC_POWER_SAVE_MODE, 1,
+		MSM_VIDC_POWER_SAVE_MODE},
+
+	{CODED_FRAMES, DEC, H264 | HEVC,
+		CODED_FRAMES_PROGRESSIVE, CODED_FRAMES_INTERLACE,
+		1, CODED_FRAMES_PROGRESSIVE,
+		V4L2_CID_MPEG_VIDC_INTERLACE,
+		HFI_PROP_CODED_FRAMES,
+		CAP_FLAG_VOLATILE},
+
+	{BIT_DEPTH, DEC, CODECS_ALL, BIT_DEPTH_8, BIT_DEPTH_10, 1, BIT_DEPTH_8,
+		0,
+		HFI_PROP_LUMA_CHROMA_BIT_DEPTH},
+
+	{CODEC_CONFIG, DEC, H264 | HEVC | AV1, 0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_CODEC_CONFIG, 0,
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{BITSTREAM_SIZE_OVERWRITE, DEC, CODECS_ALL, 0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_MIN_BITSTREAM_SIZE_OVERWRITE},
+
+	{THUMBNAIL_MODE, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_THUMBNAIL_MODE,
+		HFI_PROP_THUMBNAIL_MODE,
+		CAP_FLAG_INPUT_PORT},
+
+	{DEFAULT_HEADER, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_DEC_DEFAULT_HEADER},
+
+	{RAP_FRAME, DEC, CODECS_ALL,
+		0, 1, 1, 1,
+		0,
+		HFI_PROP_DEC_START_FROM_RAP_FRAME,
+		CAP_FLAG_INPUT_PORT},
+
+	{SEQ_CHANGE_AT_SYNC_FRAME, DEC, CODECS_ALL,
+		0, 1, 1, 1,
+		0,
+		HFI_PROP_SEQ_CHANGE_AT_SYNC_FRAME,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{PRIORITY, DEC|ENC, CODECS_ALL,
+		0, 4, 1, 4,
+		V4L2_CID_MPEG_VIDC_PRIORITY,
+		HFI_PROP_SESSION_PRIORITY,
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ENC_IP_CR, ENC, CODECS_ALL,
+		0, S32_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_ENC_INPUT_COMPRESSION_RATIO,
+		0, CAP_FLAG_DYNAMIC_ALLOWED},
+	{FILM_GRAIN, DEC, AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_AV1D_FILM_GRAIN_PRESENT,
+		HFI_PROP_AV1_FILM_GRAIN_PRESENT,
+		CAP_FLAG_VOLATILE},
+
+	{SUPER_BLOCK, DEC, AV1,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_AV1_SUPER_BLOCK_ENABLED},
+
+	{DRAP, DEC, AV1,
+		0, S32_MAX, 1, 0,
+		0,
+		HFI_PROP_AV1_DRAP_CONFIG,
+		CAP_FLAG_INPUT_PORT},
+
+	{LAST_FLAG_EVENT_ENABLE, DEC | ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_LAST_FLAG_EVENT_ENABLE},
+
+	{META_BITSTREAM_RESOLUTION, DEC, AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_BITSTREAM_RESOLUTION,
+		HFI_PROP_BITSTREAM_RESOLUTION,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_CROP_OFFSETS, DEC, AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_CROP_OFFSETS,
+		HFI_PROP_CROP_OFFSETS,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{ALL_INTRA, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		0,
+		0,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{META_LTR_MARK_USE, ENC, H264 | HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_LTR_MARK_USE_DETAILS,
+		HFI_PROP_LTR_MARK_USE_DETAILS,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SEQ_HDR_NAL, ENC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEQ_HEADER_NAL,
+		HFI_PROP_METADATA_SEQ_HEADER_NAL,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_DPB_MISR, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_DPB_LUMA_CHROMA_MISR,
+		HFI_PROP_DPB_LUMA_CHROMA_MISR,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_OPB_MISR, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_OPB_LUMA_CHROMA_MISR,
+		HFI_PROP_OPB_LUMA_CHROMA_MISR,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_INTERLACE, DEC, H264,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_INTERLACE,
+		HFI_PROP_INTERLACE_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_TIMESTAMP, DEC | ENC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_TIMESTAMP,
+		HFI_PROP_TIMESTAMP,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_CONCEALED_MB_CNT, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_CONCEALED_MB_COUNT,
+		HFI_PROP_CONEALED_MB_COUNT,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_HIST_INFO, DEC, HEVC | AV1 | VP9,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_HISTOGRAM_INFO,
+		HFI_PROP_HISTOGRAM_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_TRANSCODING_STAT_INFO, DEC, HEVC | H264,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_TRANSCODE_STAT_INFO,
+		HFI_PROP_TRANSCODING_STAT_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_TRANSCODING_STAT_INFO, ENC, HEVC | H264,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_TRANSCODE_STAT_INFO,
+		HFI_PROP_TRANSCODING_STAT_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_PICTURE_TYPE, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_PICTURE_TYPE,
+		HFI_PROP_PICTURE_TYPE,
+		CAP_FLAG_BITMASK | CAP_FLAG_META | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{META_SEI_MASTERING_DISP, ENC, HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE |
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEI_MASTERING_DISPLAY_COLOUR,
+		HFI_PROP_SEI_MASTERING_DISPLAY_COLOUR,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SEI_MASTERING_DISP, DEC, HEVC | AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEI_MASTERING_DISPLAY_COLOUR,
+		HFI_PROP_SEI_MASTERING_DISPLAY_COLOUR,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SEI_CLL, ENC, HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE |
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEI_CONTENT_LIGHT_LEVEL,
+		HFI_PROP_SEI_CONTENT_LIGHT_LEVEL,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SEI_CLL, DEC, HEVC | AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEI_CONTENT_LIGHT_LEVEL,
+		HFI_PROP_SEI_CONTENT_LIGHT_LEVEL,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_HDR10PLUS, ENC, HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE |
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_HDR10PLUS,
+		HFI_PROP_SEI_HDR10PLUS_USERDATA,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_HDR10PLUS, DEC, HEVC | AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_HDR10PLUS,
+		HFI_PROP_SEI_HDR10PLUS_USERDATA,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_EVA_STATS, ENC, H264 | HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE |
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_EVA_STATS,
+		HFI_PROP_EVA_STAT_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_BUF_TAG, ENC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_TX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_BUFFER_TAG,
+		HFI_PROP_BUFFER_TAG,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	/*
+	 * when fence enabled, client needs output buffer_tag
+	 * in input metadata buffer done.
+	 */
+	{META_BUF_TAG, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_TX_INPUT |
+			MSM_VIDC_META_TX_OUTPUT | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_BUFFER_TAG,
+		HFI_PROP_BUFFER_TAG,
+		CAP_FLAG_BITMASK | CAP_FLAG_META | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{META_DPB_TAG_LIST, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_DPB_TAG_LIST,
+		HFI_PROP_DPB_TAG_LIST,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SUBFRAME_OUTPUT, ENC, H264 | HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SUBFRAME_OUTPUT,
+		HFI_PROP_SUBFRAME_OUTPUT,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SUBFRAME_OUTPUT, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SUBFRAME_OUTPUT,
+		HFI_PROP_SUBFRAME_OUTPUT,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_ENC_QP_METADATA, ENC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_ENC_QP_METADATA,
+		HFI_PROP_ENC_QP_METADATA,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_ROI_INFO, ENC, H264 | HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_ROI_INFO,
+		HFI_PROP_ROI_INFO,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_DEC_QP_METADATA, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_DEC_QP_METADATA,
+		HFI_PROP_DEC_QP_METADATA,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{COMPLEXITY, ENC, H264 | HEVC,
+		0, 100,
+		1, DEFAULT_COMPLEXITY,
+		V4L2_CID_MPEG_VIDC_VENC_COMPLEXITY},
+
+	{DELIVERY_MODE, ENC, HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_HEVC_ENCODE_DELIVERY_MODE,
+		HFI_PROP_ENABLE_SLICE_DELIVERY,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{DELIVERY_MODE, ENC, H264,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_H264_ENCODE_DELIVERY_MODE,
+		HFI_PROP_ENABLE_SLICE_DELIVERY,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{SIGNAL_COLOR_INFO, ENC, CODECS_ALL,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_SIGNAL_COLOR_INFO,
+		HFI_PROP_SIGNAL_COLOR_INFO,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+};
+
+static struct msm_platform_inst_cap_dependency instance_cap_dependency_data_qcs8300[] = {
+	/* {cap, domain, codec,
+	 *      children,
+	 *      adjust, set}
+	 */
+
+	{PIX_FMTS, ENC, H264,
+		{META_ROI_INFO, IR_PERIOD, CSC}},
+
+	{PIX_FMTS, ENC, HEVC,
+		{PROFILE, MIN_FRAME_QP, MAX_FRAME_QP, I_FRAME_QP, P_FRAME_QP,
+			B_FRAME_QP, META_ROI_INFO, MIN_QUALITY, BLUR_TYPES, IR_PERIOD,
+			LTR_COUNT, CSC}},
+
+	{PIX_FMTS, DEC, HEVC,
+		{PROFILE}},
+
+	{FRAME_RATE, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_q16},
+
+	{FRAME_RATE, DEC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_dec_frame_rate},
+
+	{OPERATING_RATE, DEC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_dec_operating_rate},
+
+	{ENC_RING_BUFFER_COUNT, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		NULL},
+
+	{SECURE_MODE, ENC | DEC, H264 | HEVC | VP9 | AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{META_OUTBUF_FENCE, DEC, H264 | HEVC | VP9 | AV1,
+		{LOWLATENCY_MODE},
+		NULL,
+		NULL},
+
+	{HFLIP, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_flip},
+
+	{VFLIP, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_flip},
+
+	{ROTATION, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_rotation},
+
+	{SUPER_FRAME, ENC, H264 | HEVC,
+		{INPUT_BUF_HOST_MAX_COUNT, OUTPUT_BUF_HOST_MAX_COUNT},
+		NULL,
+		NULL},
+
+	{SLICE_DECODE, DEC, H264 | HEVC | AV1,
+		{0},
+		NULL,
+		NULL},
+
+	{HEADER_MODE, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_header_mode},
+
+	{WITHOUT_STARTCODE, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_nal_length},
+
+	{WITHOUT_STARTCODE, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{REQUEST_I_FRAME, ENC, H264 | HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_req_sync_frame},
+
+	{BIT_RATE, ENC, H264,
+		{PEAK_BITRATE, BITRATE_BOOST, L0_BR},
+		msm_vidc_adjust_bitrate,
+		msm_vidc_set_bitrate},
+
+	{BIT_RATE, ENC, HEVC,
+		{PEAK_BITRATE, BITRATE_BOOST, L0_BR},
+		msm_vidc_adjust_bitrate,
+		msm_vidc_set_bitrate},
+
+	{BITRATE_MODE, ENC, H264,
+		{LTR_COUNT, IR_PERIOD, TIME_DELTA_BASED_RC, I_FRAME_QP,
+			P_FRAME_QP, B_FRAME_QP, ENH_LAYER_COUNT, BIT_RATE,
+			META_ROI_INFO, MIN_QUALITY, BITRATE_BOOST, VBV_DELAY,
+			PEAK_BITRATE, SLICE_MODE, CONTENT_ADAPTIVE_CODING,
+			BLUR_TYPES, LOWLATENCY_MODE, META_TRANSCODING_STAT_INFO},
+		msm_vidc_adjust_bitrate_mode,
+		msm_vidc_set_u32_enum},
+
+	{BITRATE_MODE, ENC, HEVC,
+		{LTR_COUNT, IR_PERIOD, TIME_DELTA_BASED_RC, I_FRAME_QP,
+			P_FRAME_QP, B_FRAME_QP, CONSTANT_QUALITY, ENH_LAYER_COUNT,
+			BIT_RATE, META_ROI_INFO, MIN_QUALITY, BITRATE_BOOST, VBV_DELAY,
+			PEAK_BITRATE, SLICE_MODE, CONTENT_ADAPTIVE_CODING,
+			BLUR_TYPES, LOWLATENCY_MODE, META_EVA_STATS, META_TRANSCODING_STAT_INFO},
+		msm_vidc_adjust_bitrate_mode,
+		msm_vidc_set_u32_enum},
+
+	{CONSTANT_QUALITY, ENC, HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_constant_quality},
+
+	{GOP_SIZE, ENC, CODECS_ALL,
+		{ALL_INTRA},
+		msm_vidc_adjust_gop_size,
+		msm_vidc_set_gop_size},
+
+	{B_FRAME, ENC, H264 | HEVC,
+		{ALL_INTRA},
+		msm_vidc_adjust_b_frame,
+		msm_vidc_set_u32},
+
+	{BLUR_TYPES, ENC, H264 | HEVC,
+		{BLUR_RESOLUTION},
+		msm_vidc_adjust_blur_type,
+		msm_vidc_set_u32_enum},
+
+	{BLUR_RESOLUTION, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_blur_resolution,
+		msm_vidc_set_blur_resolution},
+
+	{CSC, ENC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_csc,
+		msm_vidc_set_u32},
+
+	{CSC_CUSTOM_MATRIX, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_csc_custom_matrix},
+
+	{LOWLATENCY_MODE, ENC, H264 | HEVC,
+		{STAGE, BIT_RATE},
+		msm_vidc_adjust_enc_lowlatency_mode,
+		NULL},
+
+	{LOWLATENCY_MODE, DEC, H264 | HEVC | VP9 | AV1,
+		{STAGE},
+		msm_vidc_adjust_dec_lowlatency_mode,
+		NULL},
+
+	{LTR_COUNT, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_ltr_count,
+		msm_vidc_set_u32},
+
+	{USE_LTR, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_use_ltr,
+		msm_vidc_set_use_and_mark_ltr},
+
+	{MARK_LTR, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_mark_ltr,
+		msm_vidc_set_use_and_mark_ltr},
+
+	{IR_PERIOD, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_ir_period,
+		msm_vidc_set_ir_period},
+
+	{AU_DELIMITER, ENC, H264 | HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{BASELAYER_PRIORITY, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{TIME_DELTA_BASED_RC, ENC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_delta_based_rc,
+		msm_vidc_set_u32},
+
+	{CONTENT_ADAPTIVE_CODING, ENC, H264 | HEVC,
+		{REQUEST_PREPROCESS},
+		msm_vidc_adjust_brs,
+		msm_vidc_set_vbr_related_properties},
+
+	{REQUEST_PREPROCESS, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_preprocess,
+		msm_vidc_set_preprocess},
+
+	{BITRATE_BOOST, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_bitrate_boost,
+		msm_vidc_set_vbr_related_properties},
+
+	{MIN_QUALITY, ENC, H264 | HEVC,
+		{BLUR_TYPES, BITRATE_BOOST},
+		msm_vidc_adjust_min_quality,
+		msm_vidc_set_u32},
+
+	{VBV_DELAY, ENC, H264 | HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_cbr_related_properties},
+
+	{PEAK_BITRATE, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_peak_bitrate,
+		msm_vidc_set_cbr_related_properties},
+
+	{MIN_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_min_qp},
+
+	{MIN_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_min_qp,
+		msm_vidc_set_min_qp},
+
+	{MAX_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_max_qp},
+
+	{MAX_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_max_qp,
+		msm_vidc_set_max_qp},
+
+	{I_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_i_frame_qp,
+		msm_vidc_set_frame_qp},
+
+	{I_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_frame_qp},
+
+	{P_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_p_frame_qp,
+		msm_vidc_set_frame_qp},
+
+	{P_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_frame_qp},
+
+	{B_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_b_frame_qp,
+		msm_vidc_set_frame_qp},
+
+	{B_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_frame_qp},
+
+	{LAYER_TYPE, ENC, H264 | HEVC,
+		{CONTENT_ADAPTIVE_CODING, LTR_COUNT}},
+
+	{LAYER_ENABLE, ENC, H264 | HEVC,
+		{CONTENT_ADAPTIVE_CODING}},
+
+	{ENH_LAYER_COUNT, ENC, H264 | HEVC,
+		{GOP_SIZE, B_FRAME, BIT_RATE, MIN_QUALITY, SLICE_MODE, LTR_COUNT},
+		msm_vidc_adjust_layer_count,
+		msm_vidc_set_layer_count_and_type},
+
+	{ENH_LAYER_COUNT, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{L0_BR, ENC, H264 | HEVC,
+		{L1_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L1_BR, ENC, H264 | HEVC,
+		{L2_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L2_BR, ENC, H264 | HEVC,
+		{L3_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L3_BR, ENC, H264 | HEVC,
+		{L4_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L4_BR, ENC, H264 | HEVC,
+		{L5_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L5_BR, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{ENTROPY_MODE, ENC, H264,
+		{BIT_RATE},
+		msm_vidc_adjust_entropy_mode,
+		msm_vidc_set_u32},
+
+	{PROFILE, ENC, H264,
+		{ENTROPY_MODE, TRANSFORM_8X8},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{PROFILE, DEC, H264,
+		{ENTROPY_MODE},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{PROFILE, ENC, HEVC,
+		{META_SEI_MASTERING_DISP, META_SEI_CLL, META_HDR10PLUS},
+		msm_vidc_adjust_profile,
+		msm_vidc_set_u32_enum},
+
+	{PROFILE, DEC, HEVC,
+		{0},
+		msm_vidc_adjust_profile,
+		msm_vidc_set_u32_enum},
+
+	{PROFILE, DEC, VP9 | AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{LEVEL, DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{LEVEL, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_level},
+
+	{AV1_TIER, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{HEVC_TIER, ENC | DEC, HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{LF_MODE, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_deblock_mode},
+
+	{SLICE_MODE, ENC, H264 | HEVC,
+		{STAGE, DELIVERY_MODE},
+		msm_vidc_adjust_slice_count,
+		msm_vidc_set_slice_count},
+
+	{TRANSFORM_8X8, ENC, H264,
+		{0},
+		msm_vidc_adjust_transform_8x8,
+		msm_vidc_set_u32},
+
+	{CHROMA_QP_INDEX_OFFSET, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_chroma_qp_index_offset,
+		msm_vidc_set_chroma_qp_index_offset},
+
+	{DISPLAY_DELAY_ENABLE, DEC, H264 | HEVC | VP9 | AV1,
+		{OUTPUT_ORDER},
+		NULL,
+		NULL},
+
+	{DISPLAY_DELAY, DEC, H264 | HEVC | VP9 | AV1,
+		{OUTPUT_ORDER},
+		NULL,
+		NULL},
+
+	{OUTPUT_ORDER, DEC, H264 | HEVC | VP9 | AV1,
+		{0},
+		msm_vidc_adjust_output_order,
+		msm_vidc_set_u32},
+
+	{INPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_input_buf_host_max_count,
+		msm_vidc_set_u32},
+
+	{INPUT_BUF_HOST_MAX_COUNT, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_input_buf_host_max_count,
+		msm_vidc_set_u32},
+
+	{OUTPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_output_buf_host_max_count,
+		msm_vidc_set_u32},
+
+	{OUTPUT_BUF_HOST_MAX_COUNT, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_output_buf_host_max_count,
+		msm_vidc_set_u32},
+
+	{CONCEAL_COLOR_8BIT, DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_u32_packed},
+
+	{CONCEAL_COLOR_10BIT, DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_u32_packed},
+
+	{STAGE, ENC | DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_stage},
+
+	{STAGE, ENC, H264 | HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_stage},
+
+	{STAGE, DEC, H264 | HEVC | VP9 | AV1,
+		{0},
+		NULL,
+		msm_vidc_set_stage},
+
+	{PIPE, DEC | ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_pipe},
+
+	{THUMBNAIL_MODE, DEC, H264 | HEVC | VP9 | AV1,
+		{OUTPUT_ORDER},
+		NULL,
+		msm_vidc_set_u32},
+
+	{RAP_FRAME, DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{PRIORITY, DEC | ENC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_session_priority,
+		msm_vidc_set_session_priority},
+
+	{DRAP, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{ALL_INTRA, ENC, H264 | HEVC,
+		{LTR_COUNT, IR_PERIOD, SLICE_MODE, BIT_RATE},
+		msm_vidc_adjust_all_intra,
+		NULL},
+
+	{META_EVA_STATS, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_eva_stats,
+		NULL},
+
+	{META_ROI_INFO, ENC, H264 | HEVC,
+		{MIN_QUALITY, IR_PERIOD, BLUR_TYPES},
+		msm_vidc_adjust_roi_info,
+		NULL},
+
+	{VUI_TIMING_INFO, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_vui_timing_info},
+
+	{DELIVERY_MODE, ENC, H264|HEVC,
+		{LOWLATENCY_MODE, OUTPUT_BUF_HOST_MAX_COUNT},
+		msm_vidc_adjust_delivery_mode,
+		msm_vidc_set_u32},
+
+	{SIGNAL_COLOR_INFO, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_signal_color_info},
+
+	{DRAP, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{META_SEI_MASTERING_DISP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_sei_mastering_disp,
+		NULL},
+
+	{META_SEI_CLL, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_sei_cll,
+		NULL},
+
+	{META_HDR10PLUS, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hdr10plus,
+		NULL},
+
+	{META_TRANSCODING_STAT_INFO, ENC, HEVC | H264,
+		{0},
+		msm_vidc_adjust_transcoding_stats,
+		NULL},
+};
+
+/* Default UBWC config for LPDDR5 */
+static struct msm_vidc_ubwc_config_data ubwc_config_qcs8300[] = {
+	UBWC_CONFIG(8, 32, 16, 0, 1, 1, 1), //sync with auto
+};
+
+static struct msm_vidc_efuse_data efuse_data_qcs8300[] = {
+	/* IRIS_MULTIPIPE_DISABLE - max 4K@30 */
+	EFUSE_ENTRY(0x221C8118, 4, 0x400, 0xA, SKU_VERSION),
+};
+static struct msm_vidc_format_capability format_data_qcs8300 = {
+	.codec_info = codec_data_qcs8300,
+	.codec_info_size = ARRAY_SIZE(codec_data_qcs8300),
+	.color_format_info = color_format_data_qcs8300,
+	.color_format_info_size = ARRAY_SIZE(color_format_data_qcs8300),
+	.color_prim_info = color_primaries_data_qcs8300,
+	.color_prim_info_size = ARRAY_SIZE(color_primaries_data_qcs8300),
+	.transfer_char_info = transfer_char_data_qcs8300,
+	.transfer_char_info_size = ARRAY_SIZE(transfer_char_data_qcs8300),
+	.matrix_coeff_info = matrix_coeff_data_qcs8300,
+	.matrix_coeff_info_size = ARRAY_SIZE(matrix_coeff_data_qcs8300),
+};
+
+/* name, min_kbps, max_kbps */
+static const struct bw_table qcs8300_bw_table[] = {
+	{ "iris-cnoc",  1000, 1000     },
+	{ "iris-ddr",   1000, 15000000 },
+};
+
+/* name */
+static const struct pd_table qcs8300_pd_table[] = {
+	{ "iris-ctl" },
+	{ "vcodec"   },
+};
+
+/* name */
+static const char * const qcs8300_opp_pd_table[] = { "mx", "mmcx", NULL };
+
+/* name, clock id, scaling */
+static const struct clk_table qcs8300_clk_table[] = {
+	{ "gcc_video_axi0",         GCC_VIDEO_AXI0_CLK,     0 },
+	{ "core_clk",               VIDEO_CC_MVS0C_CLK,     0 },
+	{ "vcodec_clk",             VIDEO_CC_MVS0_CLK,      1 },
+};
+
+/* name, exclusive_release */
+static const struct clk_rst_table qcs8300_clk_reset_table[] = {
+	{ "video_axi_reset",        0  },
+};
+
+/* name, start, size, secure, dma_coherant, region, dma_mask */
+const struct context_bank_table qcs8300_context_bank_table[] = {
+	{"qcom,vidc,cb-ns", 0x25800000, 0xba800000, 0, 1, MSM_VIDC_NON_SECURE, 0 },
+	{"qcom,vidc,cb-ns-pxl", 0x00100000, 0xdff00000, 0, 1, MSM_VIDC_NON_SECURE_PIXEL, 0 },
+	{"qcom,vidc,cb-sec-non-pxl",   0x01000000, 0x24800000, 1, 0, MSM_VIDC_SECURE_NONPIXEL,  0 },
+};
+
+/* freq */
+static struct freq_table qcs8300_freq_table[] = {
+	{560000000}, {533000000}, {444000000}, {366000000}  //same with sa8775p, sync from auto
+};
+
+/* register, value, mask */
+static const struct reg_preset_table qcs8300_reg_preset_table[] = {
+	{ 0xB0088, 0x0, 0x11 },
+};
+
+/* decoder properties */
+static const u32 qcs8300_vdec_psc_avc[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_CODED_FRAMES,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PIC_ORDER_CNT_TYPE,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+	HFI_PROP_MAX_NUM_REORDER_FRAMES,
+};
+
+static const u32 qcs8300_vdec_psc_hevc[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_TIER,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+	HFI_PROP_MAX_NUM_REORDER_FRAMES,
+};
+
+static const u32 qcs8300_vdec_psc_vp9[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+};
+
+static const u32 qcs8300_vdec_psc_av1[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_AV1_FILM_GRAIN_PRESENT,
+	HFI_PROP_AV1_SUPER_BLOCK_ENABLED,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_TIER,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+};
+
+static const u32 qcs8300_vdec_input_properties_avc[] = {
+	HFI_PROP_NO_OUTPUT,
+	HFI_PROP_SUBFRAME_INPUT,
+};
+
+static const u32 qcs8300_vdec_input_properties_hevc[] = {
+	HFI_PROP_NO_OUTPUT,
+	HFI_PROP_SUBFRAME_INPUT,
+};
+
+static const u32 qcs8300_vdec_input_properties_vp9[] = {
+	HFI_PROP_NO_OUTPUT,
+	HFI_PROP_SUBFRAME_INPUT,
+};
+
+static const u32 qcs8300_vdec_input_properties_av1[] = {
+	HFI_PROP_NO_OUTPUT,
+	HFI_PROP_SUBFRAME_INPUT,
+	HFI_PROP_DPB_LIST,
+	HFI_PROP_AV1_TILE_ROWS_COLUMNS,
+	HFI_PROP_AV1_UNIFORM_TILE_SPACING,
+};
+
+static const u32 qcs8300_vdec_output_properties_avc[] = {
+	HFI_PROP_WORST_COMPRESSION_RATIO,
+	HFI_PROP_WORST_COMPLEXITY_FACTOR,
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+	HFI_PROP_CABAC_SESSION,
+};
+
+static const u32 qcs8300_vdec_output_properties_hevc[] = {
+	HFI_PROP_WORST_COMPRESSION_RATIO,
+	HFI_PROP_WORST_COMPLEXITY_FACTOR,
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+};
+
+static const u32 qcs8300_vdec_output_properties_vp9[] = {
+	HFI_PROP_WORST_COMPRESSION_RATIO,
+	HFI_PROP_WORST_COMPLEXITY_FACTOR,
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+};
+
+static const u32 qcs8300_vdec_output_properties_av1[] = {
+	HFI_PROP_WORST_COMPRESSION_RATIO,
+	HFI_PROP_WORST_COMPLEXITY_FACTOR,
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+	HFI_PROP_CABAC_SESSION,
+};
+
+static const struct msm_vidc_platform_data qcs8300_data = {
+	/* resources dependent on other module */
+	.bw_tbl = qcs8300_bw_table,
+	.bw_tbl_size = ARRAY_SIZE(qcs8300_bw_table),
+	.clk_tbl = qcs8300_clk_table,
+	.clk_tbl_size = ARRAY_SIZE(qcs8300_clk_table),
+	.clk_rst_tbl = qcs8300_clk_reset_table,
+	.clk_rst_tbl_size = ARRAY_SIZE(qcs8300_clk_reset_table),
+	.subcache_tbl = NULL,
+	.subcache_tbl_size = 0,
+
+	/* populate context bank */
+	.context_bank_tbl = qcs8300_context_bank_table,
+	.context_bank_tbl_size = ARRAY_SIZE(qcs8300_context_bank_table),
+
+	/* populate power domain and opp table */
+	.pd_tbl = qcs8300_pd_table,
+	.pd_tbl_size = ARRAY_SIZE(qcs8300_pd_table),
+	.opp_tbl = qcs8300_opp_pd_table,
+	.opp_tbl_size = ARRAY_SIZE(qcs8300_opp_pd_table),
+
+
+	/* platform specific resources */
+	.freq_tbl = qcs8300_freq_table,
+	.freq_tbl_size = ARRAY_SIZE(qcs8300_freq_table),
+	.reg_prst_tbl = qcs8300_reg_preset_table,
+	.reg_prst_tbl_size = ARRAY_SIZE(qcs8300_reg_preset_table),
+	.fwname = "./qcom/vpu-3.0/vpu30_4v",
+	.pas_id = 9,
+	.supports_mmrm = 0,
+
+	/* caps related resorces */
+	.core_data = core_data_qcs8300,
+	.core_data_size = ARRAY_SIZE(core_data_qcs8300),
+	.inst_cap_data = instance_cap_data_qcs8300,
+	.inst_cap_data_size = ARRAY_SIZE(instance_cap_data_qcs8300),
+	.inst_cap_dependency_data = instance_cap_dependency_data_qcs8300,
+	.inst_cap_dependency_data_size = ARRAY_SIZE(instance_cap_dependency_data_qcs8300),
+	.csc_data.vpe_csc_custom_bias_coeff = vpe_csc_custom_bias_coeff,
+	.csc_data.vpe_csc_custom_matrix_coeff = vpe_csc_custom_matrix_coeff,
+	.csc_data.vpe_csc_custom_limit_coeff = vpe_csc_custom_limit_coeff,
+	.ubwc_config = ubwc_config_qcs8300,
+	.format_data = &format_data_qcs8300,
+
+	/* decoder properties related*/
+	.psc_avc_tbl = qcs8300_vdec_psc_avc,
+	.psc_avc_tbl_size = ARRAY_SIZE(qcs8300_vdec_psc_avc),
+	.psc_hevc_tbl = qcs8300_vdec_psc_hevc,
+	.psc_hevc_tbl_size = ARRAY_SIZE(qcs8300_vdec_psc_hevc),
+	.psc_vp9_tbl = qcs8300_vdec_psc_vp9,
+	.psc_vp9_tbl_size = ARRAY_SIZE(qcs8300_vdec_psc_vp9),
+	.psc_av1_tbl = qcs8300_vdec_psc_av1,
+	.psc_av1_tbl_size = ARRAY_SIZE(qcs8300_vdec_psc_av1),
+	.dec_input_prop_avc = qcs8300_vdec_input_properties_avc,
+	.dec_input_prop_hevc = qcs8300_vdec_input_properties_hevc,
+	.dec_input_prop_vp9 = qcs8300_vdec_input_properties_vp9,
+	.dec_input_prop_av1 = qcs8300_vdec_input_properties_av1,
+	.dec_input_prop_size_avc = ARRAY_SIZE(qcs8300_vdec_input_properties_avc),
+	.dec_input_prop_size_hevc = ARRAY_SIZE(qcs8300_vdec_input_properties_hevc),
+	.dec_input_prop_size_vp9 = ARRAY_SIZE(qcs8300_vdec_input_properties_vp9),
+	.dec_input_prop_size_av1 = ARRAY_SIZE(qcs8300_vdec_input_properties_av1),
+	.dec_output_prop_avc = qcs8300_vdec_output_properties_avc,
+	.dec_output_prop_hevc = qcs8300_vdec_output_properties_hevc,
+	.dec_output_prop_vp9 = qcs8300_vdec_output_properties_vp9,
+	.dec_output_prop_av1 = qcs8300_vdec_output_properties_av1,
+	.dec_output_prop_size_avc = ARRAY_SIZE(qcs8300_vdec_output_properties_avc),
+	.dec_output_prop_size_hevc = ARRAY_SIZE(qcs8300_vdec_output_properties_hevc),
+	.dec_output_prop_size_vp9 = ARRAY_SIZE(qcs8300_vdec_output_properties_vp9),
+	.dec_output_prop_size_av1 = ARRAY_SIZE(qcs8300_vdec_output_properties_av1),
+
+	/* Fuse specific resources */
+	.efuse_data = efuse_data_qcs8300,
+	.efuse_data_size = ARRAY_SIZE(efuse_data_qcs8300),
+	.sku_version = SKU_VERSION_0,
+};
+
+static int msm_vidc_init_data(struct msm_vidc_core *core)
+{
+	d_vpr_h("%s: initialize qcs8300 data\n", __func__);
+
+	core->platform->data = qcs8300_data;
+
+	core->mem_ops = get_mem_ops_ext();
+	if (!core->mem_ops) {
+		d_vpr_e("%s: invalid memory ext ops\n", __func__);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int msm_vidc_init_platform_qcs8300(struct msm_vidc_core *core)
+{
+	return msm_vidc_init_data(core);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/sa8775p/inc/msm_vidc_sa8775p.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/sa8775p/inc/msm_vidc_sa8775p.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_SA8775P_H_
+#define _MSM_VIDC_SA8775P_H_
+
+#include "msm_vidc_core.h"
+
+int msm_vidc_init_platform_sa8775p(struct msm_vidc_core *core);
+
+#endif // _MSM_VIDC_SA8775P_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/sa8775p/src/msm_vidc_sa8775p.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/sa8775p/src/msm_vidc_sa8775p.c
@@ -0,0 +1,2741 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <dt-bindings/clock/qcom,sa8775p-gcc.h>
+#include <dt-bindings/clock/qcom,sa8775p-videocc.h>
+#include <media/v4l2_vidc_extensions.h>
+#include "hfi_command.h"
+#include "hfi_property.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_iris3.h"
+#include "msm_vidc_sa8775p.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_platform_ext.h"
+#include "msm_vidc_memory_ext.h"
+/* version: major[24:31], minor[16:23], revision[0:15] */
+#define DRIVER_VERSION          0x04000000
+#define DEFAULT_VIDEO_CONCEAL_COLOR_BLACK 0x8020010
+#define MAX_LTR_FRAME_COUNT     2
+#define MAX_BASE_LAYER_PRIORITY_ID 63
+#define MAX_OP_POINT            31
+#define MAX_BITRATE             245000000
+#define DEFAULT_BITRATE         20000000
+#define MINIMUM_FPS             1
+#define MAXIMUM_FPS             480
+#define MAXIMUM_DEC_FPS         960
+#define MAX_QP                  51
+#define DEFAULT_QP              20
+#define MAX_CONSTANT_QUALITY    100
+#define MIN_SLICE_BYTE_SIZE     512
+#define MAX_SLICE_BYTE_SIZE       \
+    ((MAX_BITRATE) >> 3)
+#define MAX_SLICE_MB_SIZE         \
+    (((4096 + 15) >> 4) * ((2304 + 15) >> 4))
+
+#define ENC     MSM_VIDC_ENCODER
+#define DEC     MSM_VIDC_DECODER
+#define H264    MSM_VIDC_H264
+#define HEVC    MSM_VIDC_HEVC
+#define VP9     MSM_VIDC_VP9
+#define AV1     MSM_VIDC_AV1
+#define HEIC    MSM_VIDC_HEIC
+#define CODECS_ALL    (H264 | HEVC | VP9 | HEIC | AV1)
+
+static struct codec_info codec_data_sa8775p[] = {
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_H264,
+		.vidc_codec  = MSM_VIDC_H264,
+		.pixfmt_name = "AVC",
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_HEVC,
+		.vidc_codec  = MSM_VIDC_HEVC,
+		.pixfmt_name = "HEVC",
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_VP9,
+		.vidc_codec  = MSM_VIDC_VP9,
+		.pixfmt_name = "VP9",
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_AV1,
+		.vidc_codec  = MSM_VIDC_AV1,
+		.pixfmt_name = "AV1",
+	},
+	{
+		.v4l2_codec  = V4L2_PIX_FMT_VIDC_HEIC,
+		.vidc_codec  = MSM_VIDC_HEIC,
+		.pixfmt_name = "HEIC",
+	},
+};
+
+static struct color_format_info color_format_data_sa8775p[] = {
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_NV12,
+		.vidc_color_format = MSM_VIDC_FMT_NV12,
+		.pixfmt_name       = "NV12",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_NV21,
+		.vidc_color_format = MSM_VIDC_FMT_NV21,
+		.pixfmt_name       = "NV21",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_QC08C,
+		.vidc_color_format = MSM_VIDC_FMT_NV12C,
+		.pixfmt_name       = "NV12C",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_QC10C,
+		.vidc_color_format = MSM_VIDC_FMT_TP10C,
+		.pixfmt_name       = "TP10C",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_RGBA32,
+		.vidc_color_format = MSM_VIDC_FMT_RGBA8888,
+		.pixfmt_name       = "RGBA",
+	},
+	{
+		.v4l2_color_format = V4L2_PIX_FMT_P010,
+		.vidc_color_format = MSM_VIDC_FMT_P010,
+		.pixfmt_name       = "P010",
+	},
+	{
+		.v4l2_color_format = V4L2_META_FMT_VIDC,
+		.vidc_color_format = MSM_VIDC_FMT_META,
+		.pixfmt_name       = "META",
+	},
+};
+
+static struct color_primaries_info color_primaries_data_sa8775p[] = {
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_DEFAULT,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_RESERVED,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_DEFAULT,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_UNSPECIFIED,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_REC709,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT709,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_470_SYSTEM_M,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT470_SYSTEM_M,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_470_SYSTEM_BG,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT470_SYSTEM_BG,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_SMPTE170M,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT601_525,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_SMPTE240M,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_ST240M,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_VIDC_GENERIC_FILM,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_GENERIC_FILM,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_BT2020,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_BT2020,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_DCI_P3,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_RP431_2,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_VIDC_EG431,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_EG431_1,
+	},
+	{
+		.v4l2_color_primaries  = V4L2_COLORSPACE_VIDC_EBU_TECH,
+		.vidc_color_primaries  = MSM_VIDC_PRIMARIES_SMPTE_EBU_TECH,
+	},
+};
+
+static struct transfer_char_info transfer_char_data_sa8775p[] = {
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_DEFAULT,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_RESERVED,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_DEFAULT,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_UNSPECIFIED,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_709,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT709,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT470_SYSTEM_M,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT470_SYSTEM_M,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT470_SYSTEM_BG,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT470_SYSTEM_BG,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT601_525_OR_625,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT601_525_OR_625,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_SMPTE240M,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_SMPTE_ST240M,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_LINEAR,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_LINEAR,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_XVYCC,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_XVYCC,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT1361,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT1361_0,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_SRGB,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_SRGB_SYCC,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_BT2020,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT2020_14,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_SMPTE2084,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_SMPTE_ST2084_PQ,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_ST428,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_SMPTE_ST428_1,
+	},
+	{
+		.v4l2_transfer_char  = V4L2_XFER_FUNC_VIDC_HLG,
+		.vidc_transfer_char  = MSM_VIDC_TRANSFER_BT2100_2_HLG,
+	},
+};
+
+static struct matrix_coeff_info matrix_coeff_data_sa8775p[] = {
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_DEFAULT,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_RESERVED,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_DEFAULT,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_UNSPECIFIED,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_VIDC_SRGB_OR_SMPTE_ST428,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_SRGB_SMPTE_ST428_1,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_709,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT709,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_XV709,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT709,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_VIDC_FCC47_73_682,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_FCC_TITLE_47,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_XV601,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT470_SYS_BG_OR_BT601_625,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_601,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT601_525_BT1358_525_OR_625,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_SMPTE240M,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_SMPTE_ST240,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_BT2020,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT2020_NON_CONSTANT,
+	},
+	{
+		.v4l2_matrix_coeff  = V4L2_YCBCR_ENC_BT2020_CONST_LUM,
+		.vidc_matrix_coeff  = MSM_VIDC_MATRIX_COEFF_BT2020_CONSTANT,
+	},
+};
+
+static struct msm_platform_core_capability core_data_sa8775p[] = {
+	/* {type, value} */
+	{ENC_CODECS, H264|HEVC|HEIC},
+	{DEC_CODECS, H264|HEVC|VP9|AV1|HEIC},
+	{MAX_SESSION_COUNT, 32},
+	{MAX_NUM_720P_SESSIONS, 32},
+	{MAX_NUM_1080P_SESSIONS, 32},
+	{MAX_NUM_4K_SESSIONS, 8},
+	{MAX_NUM_8K_SESSIONS, 2},
+	{MAX_SECURE_SESSION_COUNT, 3},
+	{MAX_RT_MBPF, 174080},	/* (8192x4352)/256 + (4096x2176)/256*/
+	{MAX_MBPF, 278528}, /* ((8192x4352)/256) * 2 */
+	{MAX_MBPS, 7833600},	/* max_load
+					 * 7680x4320@60fps or 3840x2176@240fps
+					 * which is greater than 4096x2176@120fps,
+					 * 8192x4320@48fps
+					 */
+	{MAX_IMAGE_MBPF, 1048576},  /* (16384x16384)/256 */
+	{MAX_MBPF_HQ, 8160}, /* ((1920x1088)/256) */
+	{MAX_MBPS_HQ, 489600}, /* ((1920x1088)/256)@60fps */
+	{MAX_MBPF_B_FRAME, 32640}, /* 3840x2176/256 */
+	{MAX_MBPS_B_FRAME, 1958400}, /* 3840x2176/256 MBs@60fps */
+	{MAX_MBPS_ALL_INTRA, 2088960}, /* 4096x2176/256 MBs@60fps */
+	{MAX_ENH_LAYER_COUNT, 5},
+	{NUM_VPP_PIPE, 4},
+	{SW_PC, 1},
+	{FW_UNLOAD, 0},
+	{HW_RESPONSE_TIMEOUT, HW_RESPONSE_TIMEOUT_VALUE}, /* 1000 ms */
+	{SW_PC_DELAY,         SW_PC_DELAY_VALUE        }, /* 1500 ms (>HW_RESPONSE_TIMEOUT)*/
+	{FW_UNLOAD_DELAY,     FW_UNLOAD_DELAY_VALUE    }, /* 3000 ms (>SW_PC_DELAY)*/
+	{PAGEFAULT_NON_FATAL, 1},
+	{PAGETABLE_CACHING, 0},
+	{DCVS, 0},
+	{DECODE_BATCH, 0},
+	{DECODE_BATCH_TIMEOUT, 200},
+	{STATS_TIMEOUT_MS, 2000},
+	{AV_SYNC_WINDOW_SIZE, 40},
+	{NON_FATAL_FAULTS, 1},
+	{ENC_AUTO_FRAMERATE, 0},
+	{DEVICE_CAPS, V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_META_CAPTURE |
+		V4L2_CAP_STREAMING},
+	{SUPPORTS_SYNX_FENCE, 0},
+	{SUPPORTS_REQUESTS, 0},
+};
+
+static struct msm_platform_inst_capability instance_cap_data_sa8775p[] = {
+	/* {cap, domain, codec,
+	 *      min, max, step_or_mask, value,
+	 *      v4l2_id,
+	 *      hfi_id,
+	 *      flags}
+	 */
+	{DRV_VERSION, DEC|ENC, CODECS_ALL,
+		0, INT_MAX, 1, DRIVER_VERSION,
+		V4L2_CID_MPEG_VIDC_DRIVER_VERSION},
+
+	{FRAME_WIDTH, DEC, CODECS_ALL, 96, 8192, 1, 1920},
+
+	{FRAME_WIDTH, DEC, VP9, 96, 4096, 1, 1920},
+
+	{FRAME_WIDTH, ENC, CODECS_ALL, 128, 8192, 1, 1920},
+
+	{FRAME_WIDTH, ENC, HEVC, 96, 8192, 1, 1920},
+
+	{FRAME_WIDTH, ENC, HEIC, 128, 16384, 1, 16384},
+
+	{LOSSLESS_FRAME_WIDTH, ENC, CODECS_ALL, 128, 4096, 1, 1920},
+
+	{LOSSLESS_FRAME_WIDTH, ENC, HEVC, 96, 4096, 1, 1920},
+
+	{SECURE_FRAME_WIDTH, DEC, CODECS_ALL, 96, 4096, 1, 1920},
+
+	{SECURE_FRAME_WIDTH, ENC, CODECS_ALL, 128, 4096, 1, 1920},
+
+	{SECURE_FRAME_WIDTH, ENC, HEVC, 96, 4096, 1, 1920},
+
+	{FRAME_HEIGHT, DEC, CODECS_ALL, 96, 8192, 1, 1080},
+
+	{FRAME_HEIGHT, DEC, VP9, 96, 4096, 1, 1080},
+
+	{FRAME_HEIGHT, ENC, CODECS_ALL, 128, 8192, 1, 1080},
+
+	{FRAME_HEIGHT, ENC, HEVC, 96, 8192, 1, 1080},
+
+	{FRAME_HEIGHT, ENC, HEIC, 128, 16384, 1, 16384},
+
+	{LOSSLESS_FRAME_HEIGHT, ENC, CODECS_ALL, 128, 4096, 1, 1080},
+
+	{LOSSLESS_FRAME_HEIGHT, ENC, HEVC, 96, 4096, 1, 1080},
+
+	{SECURE_FRAME_HEIGHT, DEC, CODECS_ALL, 96, 4096, 1, 1080},
+
+	{SECURE_FRAME_HEIGHT, ENC, CODECS_ALL, 128, 4096, 1, 1080},
+
+	{SECURE_FRAME_HEIGHT, ENC, HEVC, 96, 4096, 1, 1080},
+
+	{PIX_FMTS, ENC | DEC, H264,
+		MSM_VIDC_FMT_NV12,
+		MSM_VIDC_FMT_NV12C,
+		MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C,
+		MSM_VIDC_FMT_NV12C},
+
+	{PIX_FMTS, ENC | DEC, HEVC | AV1,
+		MSM_VIDC_FMT_NV12,
+		MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C |
+		MSM_VIDC_FMT_P010 | MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12C},
+
+	{PIX_FMTS, ENC, HEIC,
+		MSM_VIDC_FMT_NV12,
+		MSM_VIDC_FMT_P010,
+		MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_P010,
+		MSM_VIDC_FMT_NV12},
+
+	{PIX_FMTS, DEC, HEIC,
+		MSM_VIDC_FMT_NV12,
+		MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C |
+		MSM_VIDC_FMT_P010 | MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12C},
+
+	{PIX_FMTS, DEC, VP9,
+		MSM_VIDC_FMT_NV12,
+		MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12 | MSM_VIDC_FMT_NV21 | MSM_VIDC_FMT_NV12C |
+		MSM_VIDC_FMT_P010 | MSM_VIDC_FMT_TP10C,
+		MSM_VIDC_FMT_NV12C},
+
+	{MIN_BUFFERS_INPUT, ENC | DEC, CODECS_ALL, 0, 64, 1, 4,
+		V4L2_CID_MIN_BUFFERS_FOR_OUTPUT,
+		0,
+		CAP_FLAG_VOLATILE},
+
+	{MIN_BUFFERS_INPUT, ENC | DEC, HEIC, 0, 64, 1, 1,
+		V4L2_CID_MIN_BUFFERS_FOR_OUTPUT,
+		0,
+		CAP_FLAG_VOLATILE},
+
+	{MIN_BUFFERS_OUTPUT, ENC | DEC, CODECS_ALL,
+		0, 64, 1, 4,
+		V4L2_CID_MIN_BUFFERS_FOR_CAPTURE,
+		HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_VOLATILE},
+
+	/* (8192 * 4320) / 256 */
+	{MBPF, ENC, CODECS_ALL, 64, 138240, 1, 138240},
+
+	{MBPF, ENC, HEVC, 36, 138240, 1, 138240},
+
+	/* ((16384x16384)/256) */
+	{MBPF, ENC, HEIC, 36, 1048576, 1, 1048576},
+
+	{MBPF, DEC, CODECS_ALL, 36, 138240, 1, 138240},
+
+	/* (4096 * 2304) / 256 */
+	{MBPF, DEC, VP9, 36, 36864, 1, 36864},
+
+	/* ((8192x8192)/256) */
+	{MBPF, DEC, HEIC, 64, 262144,  1, 262144 },
+
+	/* (4096 * 2304) / 256 */
+	{LOSSLESS_MBPF, ENC, H264|HEVC, 64, 36864, 1, 36864},
+
+	/* Batch Mode Decode */
+	/* TODO: update with new values based on updated voltage corner */
+	{BATCH_MBPF, DEC, H264|HEVC|VP9|AV1, 64, 34816, 1, 34816},
+
+	/* (4096 * 2304) / 256 */
+	{BATCH_FPS, DEC, H264|HEVC|VP9|AV1, 1, 120, 1, 120},
+
+	{SECURE_MBPF, ENC|DEC, H264|HEVC|VP9|AV1, 64, 36864, 1, 36864},
+
+	{SECURE_MBPF, ENC, HEVC, 36, 36864, 1, 36864},
+
+	{FRAME_RATE, ENC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_FPS << 16),
+		1, (DEFAULT_FPS << 16),
+		0,
+		HFI_PROP_FRAME_RATE,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{FRAME_RATE, ENC, HEIC,
+		(MINIMUM_FPS << 16), (MAXIMUM_FPS << 16),
+		1, (MINIMUM_FPS << 16),
+		0,
+		HFI_PROP_FRAME_RATE,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{FRAME_RATE, DEC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_DEC_FPS << 16),
+		1, (DEFAULT_FPS << 16),
+		V4L2_CID_MPEG_VIDC_FRAME_RATE,
+		0,
+		CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{OPERATING_RATE, ENC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_FPS << 16),
+		1, (DEFAULT_FPS << 16)},
+
+	{OPERATING_RATE, DEC, CODECS_ALL,
+		(MINIMUM_FPS << 16), (MAXIMUM_DEC_FPS << 16),
+		1, (DEFAULT_FPS << 16),
+		V4L2_CID_MPEG_VIDC_OPERATING_RATE,
+		0,
+		CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{INPUT_RATE, ENC | DEC, CODECS_ALL,
+		(MINIMUM_FPS << 16), INT_MAX,
+		1, (DEFAULT_FPS << 16)},
+
+	{TIMESTAMP_RATE, ENC | DEC, CODECS_ALL,
+		(MINIMUM_FPS << 16), INT_MAX,
+		1, (DEFAULT_FPS << 16)},
+
+	{SCALE_FACTOR, ENC, H264 | HEVC, 1, 8, 1, 8},
+
+	{MB_CYCLES_VSP, ENC, CODECS_ALL, 25, 25, 1, 25},
+
+	{MB_CYCLES_VSP, DEC, CODECS_ALL, 25, 25, 1, 25},
+
+	{MB_CYCLES_VSP, DEC, VP9 | AV1, 60, 60, 1, 60},
+
+	{MB_CYCLES_VPP, ENC, CODECS_ALL, 675, 675, 1, 675},
+
+	{MB_CYCLES_VPP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+	{MB_CYCLES_LP, ENC, CODECS_ALL, 320, 320, 1, 320},
+
+	{MB_CYCLES_LP, DEC, CODECS_ALL, 200, 200, 1, 200},
+
+	{MB_CYCLES_FW, ENC|DEC, CODECS_ALL, 489583, 489583, 1, 489583},
+
+	{MB_CYCLES_FW_VPP, ENC, CODECS_ALL, 48405, 48405, 1, 48405},
+
+	{ENC_RING_BUFFER_COUNT, ENC, CODECS_ALL,
+		0, 0, 1, 0},
+
+	{CLIENT_ID, ENC | DEC, CODECS_ALL,
+		INVALID_CLIENT_ID, INT_MAX, 1, INVALID_CLIENT_ID,
+		V4L2_CID_MPEG_VIDC_CLIENT_ID},
+
+	{SECURE_MODE, ENC | DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_SECURE,
+		HFI_PROP_SECURE,
+		CAP_FLAG_NONE},
+
+	/*
+	 * Client will enable V4L2_CID_MPEG_VIDC_METADATA_OUTBUF_FENCE
+	 * to get fence_id in input metadata buffer done.
+	 */
+	{META_OUTBUF_FENCE, DEC, H264 | HEVC | VP9 | AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_OUTBUF_FENCE,
+		HFI_PROP_FENCE,
+		CAP_FLAG_BITMASK | CAP_FLAG_META | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	/*
+	 * Client to do set_ctrl with FENCE_ID to set fence_id
+	 * and then client will do get_ctrl with FENCE_FD to get
+	 * fence_fd corresponding to client set fence_id.
+	 */
+	{FENCE_ID, DEC, CODECS_ALL,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_SW_FENCE_ID,
+		0,
+		CAP_FLAG_DYNAMIC_ALLOWED | CAP_FLAG_OUTPUT_PORT},
+
+	{FENCE_FD, DEC, CODECS_ALL,
+		INVALID_FD, INT_MAX, 1, INVALID_FD,
+		V4L2_CID_MPEG_VIDC_SW_FENCE_FD,
+		0,
+		CAP_FLAG_VOLATILE},
+
+	{TS_REORDER, DEC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_TS_REORDER},
+
+	{HFLIP, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_HFLIP,
+		HFI_PROP_FLIP,
+		CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{VFLIP, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_VFLIP,
+		HFI_PROP_FLIP,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ROTATION, ENC, CODECS_ALL,
+		0, 270, 90, 0,
+		V4L2_CID_ROTATE,
+		HFI_PROP_ROTATION,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{SUPER_FRAME, ENC, H264 | HEVC,
+		0, 32, 1, 0,
+		V4L2_CID_MPEG_VIDC_SUPERFRAME, 0,
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{SLICE_DECODE, DEC, H264 | HEVC | AV1,
+		V4L2_MPEG_MSM_VIDC_DISABLE,
+		V4L2_MPEG_MSM_VIDC_DISABLE,
+		0,
+		V4L2_MPEG_MSM_VIDC_DISABLE,
+		V4L2_CID_MPEG_VIDEO_DECODER_SLICE_INTERFACE,
+		0},
+
+	{HEADER_MODE, ENC, CODECS_ALL,
+		V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE,
+		V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+		BIT(V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE) |
+		BIT(V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME),
+		V4L2_MPEG_VIDEO_HEADER_MODE_JOINED_WITH_1ST_FRAME,
+		V4L2_CID_MPEG_VIDEO_HEADER_MODE,
+		HFI_PROP_SEQ_HEADER_MODE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{PREPEND_SPSPPS_TO_IDR, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_PREPEND_SPSPPS_TO_IDR},
+
+	{VUI_TIMING_INFO, ENC, CODECS_ALL,
+		V4L2_MPEG_MSM_VIDC_DISABLE,
+		V4L2_MPEG_MSM_VIDC_ENABLE,
+		1, V4L2_MPEG_MSM_VIDC_DISABLE,
+		V4L2_CID_MPEG_VIDC_VUI_TIMING_INFO,
+		HFI_PROP_DISABLE_VUI_TIMING_INFO,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{WITHOUT_STARTCODE, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_WITHOUT_STARTCODE,
+		HFI_PROP_NAL_LENGTH_FIELD,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{WITHOUT_STARTCODE, DEC, AV1,
+		0, 0, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_WITHOUT_STARTCODE,
+		HFI_PROP_NAL_LENGTH_FIELD,
+		CAP_FLAG_INPUT_PORT},
+	{NAL_LENGTH_FIELD, ENC, CODECS_ALL,
+		V4L2_MPEG_VIDEO_HEVC_SIZE_0,
+		V4L2_MPEG_VIDEO_HEVC_SIZE_4,
+		BIT(V4L2_MPEG_VIDEO_HEVC_SIZE_0) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_SIZE_4),
+		V4L2_MPEG_VIDEO_HEVC_SIZE_0,
+		V4L2_CID_MPEG_VIDEO_HEVC_SIZE_OF_LENGTH_FIELD,
+		HFI_PROP_NAL_LENGTH_FIELD,
+		CAP_FLAG_MENU | CAP_FLAG_OUTPUT_PORT},
+
+	/* TODO: Firmware introduced enumeration type for this
+	 * with and without seq header.
+	 */
+	{REQUEST_I_FRAME, ENC, H264 | HEVC,
+		0, 0, 0, 0,
+		V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
+		HFI_PROP_REQUEST_SYNC_FRAME,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	/* Enc: Keeping CABAC and CAVLC as same bitrate.
+	 * Dec: there's no use of Bitrate cap
+	 */
+	{BIT_RATE, ENC, H264 | HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_BITRATE,
+		HFI_PROP_TOTAL_BITRATE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{BITRATE_MODE, ENC, H264,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_MBR,
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_MBR),
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+		HFI_PROP_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{BITRATE_MODE, ENC, HEVC,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_MBR,
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_VBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CBR) |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CQ)  |
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_MBR),
+		V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
+		V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+		HFI_PROP_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{BITRATE_MODE, ENC, HEIC,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_CQ,
+		V4L2_MPEG_VIDEO_BITRATE_MODE_CQ,
+		BIT(V4L2_MPEG_VIDEO_BITRATE_MODE_CQ),
+		V4L2_MPEG_VIDEO_BITRATE_MODE_CQ,
+		V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+		HFI_PROP_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{CABAC_MAX_BITRATE, ENC, H264 | HEVC, 0,
+		160000000, 1, 160000000},
+
+	{CAVLC_MAX_BITRATE, ENC, H264, 0,
+		220000000, 1, 220000000},
+
+	{ALLINTRA_MAX_BITRATE, ENC, H264 | HEVC, 0,
+		245000000, 1, 245000000},
+
+	{LOWLATENCY_MAX_BITRATE, ENC, H264 | HEVC, 0,
+		70000000, 1, 70000000},
+
+	{NUM_COMV, DEC, CODECS_ALL,
+		0, INT_MAX, 1, 0},
+
+	{LOSSLESS, ENC, HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_LOSSLESS_CU},
+
+	{FRAME_SKIP_MODE, ENC, H264 | HEVC | HEIC,
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT,
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED) |
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_LEVEL_LIMIT) |
+		BIT(V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT),
+		V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED,
+		V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{FRAME_RC_ENABLE, ENC, H264 | HEVC | HEIC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_FRAME_RC_ENABLE},
+
+	{CONSTANT_QUALITY, ENC, HEVC,
+		1, MAX_CONSTANT_QUALITY, 1, 90,
+		V4L2_CID_MPEG_VIDEO_CONSTANT_QUALITY,
+		HFI_PROP_CONSTANT_QUALITY,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{CONSTANT_QUALITY, ENC, HEIC,
+		1, MAX_CONSTANT_QUALITY, 1, 100,
+		V4L2_CID_MPEG_VIDEO_CONSTANT_QUALITY,
+		HFI_PROP_CONSTANT_QUALITY,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{GOP_SIZE, ENC, CODECS_ALL,
+		0, INT_MAX, 1, 2 * DEFAULT_FPS - 1,
+		V4L2_CID_MPEG_VIDEO_GOP_SIZE,
+		HFI_PROP_MAX_GOP_FRAMES,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{GOP_SIZE, ENC, HEIC,
+		0, INT_MAX, 1, 0 /* all intra */,
+		V4L2_CID_MPEG_VIDEO_GOP_SIZE,
+		HFI_PROP_MAX_GOP_FRAMES,
+		CAP_FLAG_OUTPUT_PORT |
+			CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{GOP_CLOSURE, ENC, H264 | HEVC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_GOP_CLOSURE,
+		0},
+
+	{B_FRAME, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_B_FRAMES,
+		HFI_PROP_MAX_B_FRAMES,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{B_FRAME, ENC, HEIC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_B_FRAMES,
+		HFI_PROP_MAX_B_FRAMES,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{BLUR_TYPES, ENC, H264 | HEVC,
+		MSM_VIDC_BLUR_NONE, MSM_VIDC_BLUR_EXTERNAL,
+		BIT(MSM_VIDC_BLUR_NONE) | BIT(MSM_VIDC_BLUR_EXTERNAL),
+		MSM_VIDC_BLUR_NONE,
+		V4L2_CID_MPEG_VIDC_VIDEO_BLUR_TYPES,
+		HFI_PROP_BLUR_TYPES,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{BLUR_RESOLUTION, ENC, H264 | HEVC,
+		0, S32_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_VIDEO_BLUR_RESOLUTION,
+		HFI_PROP_BLUR_RESOLUTION,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{CSC, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_CSC,
+		HFI_PROP_CSC,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{CSC_CUSTOM_MATRIX, ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_VIDEO_VPE_CSC_CUSTOM_MATRIX,
+		HFI_PROP_CSC_MATRIX,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{LOWLATENCY_MODE, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_LOWLATENCY_REQUEST,
+		0,
+		CAP_FLAG_NONE},
+
+	{LOWLATENCY_MODE, DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_LOWLATENCY_REQUEST,
+		HFI_PROP_SEQ_CHANGE_AT_SYNC_FRAME,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{LTR_COUNT, ENC, H264 | HEVC,
+		0, MAX_LTR_FRAME_COUNT, 1, 0,
+		V4L2_CID_MPEG_VIDEO_LTR_COUNT,
+		HFI_PROP_LTR_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{USE_LTR, ENC, H264 | HEVC,
+		0,
+		((1 << MAX_LTR_FRAME_COUNT) - 1),
+		0, 0,
+		V4L2_CID_MPEG_VIDEO_USE_LTR_FRAMES,
+		HFI_PROP_LTR_USE,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{MARK_LTR, ENC, H264 | HEVC,
+		INVALID_DEFAULT_MARK_OR_USE_LTR,
+		(MAX_LTR_FRAME_COUNT - 1),
+		1, INVALID_DEFAULT_MARK_OR_USE_LTR,
+		V4L2_CID_MPEG_VIDEO_FRAME_LTR_INDEX,
+		HFI_PROP_LTR_MARK,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{BASELAYER_PRIORITY, ENC, H264,
+		0, MAX_BASE_LAYER_PRIORITY_ID, 1, 0,
+		V4L2_CID_MPEG_VIDEO_BASELAYER_PRIORITY_ID,
+		HFI_PROP_BASELAYER_PRIORITYID,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{IR_TYPE, ENC, H264 | HEVC,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC,
+		BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM) |
+		BIT(V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC),
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_RANDOM,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{IR_PERIOD, ENC, H264 | HEVC,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD,
+		0,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_OUTPUT_PORT |
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{AU_DELIMITER, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_AU_DELIMITER,
+		HFI_PROP_AUD,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{TIME_DELTA_BASED_RC, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_TIME_DELTA_BASED_RC,
+		HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{TIME_DELTA_BASED_RC, ENC, HEIC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_TIME_DELTA_BASED_RC,
+		HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{CONTENT_ADAPTIVE_CODING, ENC, H264 | HEVC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDC_CONTENT_ADAPTIVE_CODING,
+		HFI_PROP_CONTENT_ADAPTIVE_CODING,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{REQUEST_PREPROCESS, ENC, H264 | HEVC,
+		MSM_VIDC_PREPROCESS_NONE,
+		MSM_VIDC_PREPROCESS_TYPE0,
+		BIT(MSM_VIDC_PREPROCESS_NONE) |
+		BIT(MSM_VIDC_PREPROCESS_TYPE0),
+		MSM_VIDC_PREPROCESS_NONE,
+		0, HFI_PROP_REQUEST_PREPROCESS,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{BITRATE_BOOST, ENC, H264 | HEVC,
+		0, MAX_BITRATE_BOOST, 25, MAX_BITRATE_BOOST,
+		V4L2_CID_MPEG_VIDC_QUALITY_BITRATE_BOOST,
+		HFI_PROP_BITRATE_BOOST,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{MIN_QUALITY, ENC, H264 | HEVC,
+		0, MAX_SUPPORTED_MIN_QUALITY, 70, MAX_SUPPORTED_MIN_QUALITY,
+		0,
+		HFI_PROP_MAINTAIN_MIN_QUALITY,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{VBV_DELAY, ENC, H264 | HEVC,
+		200, 300, 100, 300,
+		V4L2_CID_MPEG_VIDEO_VBV_DELAY,
+		HFI_PROP_VBV_DELAY,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{PEAK_BITRATE, ENC, H264 | HEVC,
+		/* default peak bitrate is 10% larger than avg bitrate */
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_BITRATE_PEAK,
+		HFI_PROP_TOTAL_PEAK_BITRATE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{MIN_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_MIN_QP,
+		HFI_PROP_MIN_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{MIN_FRAME_QP, ENC, HEVC | HEIC,
+		MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_MIN_QP,
+		HFI_PROP_MIN_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{I_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MIN_QP},
+
+	{I_FRAME_MIN_QP, ENC, HEVC | HEIC,
+		MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MIN_QP},
+
+	{P_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MIN_QP},
+
+	{P_FRAME_MIN_QP, ENC, HEVC | HEIC,
+		MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MIN_QP},
+
+	{B_FRAME_MIN_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MIN_QP_8BIT,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MIN_QP},
+
+	{B_FRAME_MIN_QP, ENC, HEVC | HEIC,
+		MIN_QP_10BIT, MAX_QP, 1, MIN_QP_10BIT,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MIN_QP},
+
+	{MAX_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
+		HFI_PROP_MAX_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{MAX_FRAME_QP, ENC, HEVC | HEIC,
+		MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_MAX_QP,
+		HFI_PROP_MAX_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{I_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MAX_QP},
+
+	{I_FRAME_MAX_QP, ENC, HEVC | HEIC,
+		MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_MAX_QP},
+
+	{P_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MAX_QP},
+
+	{P_FRAME_MAX_QP, ENC, HEVC | HEIC,
+		MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_MAX_QP},
+
+	{B_FRAME_MAX_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_MAX_QP},
+
+	{B_FRAME_MAX_QP, ENC, HEVC | HEIC,
+		MIN_QP_10BIT, MAX_QP, 1, MAX_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_MAX_QP},
+
+	{I_FRAME_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{I_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_I_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{P_FRAME_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_P_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{P_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_P_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{B_FRAME_QP, ENC, HEVC,
+		MIN_QP_10BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_HEVC_B_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{B_FRAME_QP, ENC, H264,
+		MIN_QP_8BIT, MAX_QP, 1, DEFAULT_QP,
+		V4L2_CID_MPEG_VIDEO_H264_B_FRAME_QP,
+		HFI_PROP_QP_PACKED,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{LAYER_TYPE, ENC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B,
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+		BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P),
+		V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_P,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_TYPE,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LAYER_TYPE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B,
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+		BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B) |
+		BIT(V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P),
+		V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_P,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_TYPE,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LAYER_ENABLE, ENC, H264,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING,
+		HFI_PROP_LAYER_ENCODING_TYPE,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{LAYER_ENABLE, ENC, HEVC,
+		0, 1, 1, 0,
+		0,
+		0,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{ENH_LAYER_COUNT, ENC, HEVC,
+		0, 5, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_LAYER,
+		HFI_PROP_LAYER_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ENH_LAYER_COUNT, ENC, H264,
+		0, 5, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_LAYER,
+		HFI_PROP_LAYER_COUNT,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ENH_LAYER_COUNT, DEC, AV1,
+		0, MAX_OP_POINT, 1, 0,
+		0,
+		HFI_PROP_AV1_OP_POINT,
+		CAP_FLAG_INPUT_PORT},
+
+	{L0_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L0_BR,
+		HFI_PROP_BITRATE_LAYER1,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L0_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L0_BR,
+		HFI_PROP_BITRATE_LAYER1,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L1_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L1_BR,
+		HFI_PROP_BITRATE_LAYER2,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L1_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L1_BR,
+		HFI_PROP_BITRATE_LAYER2,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L2_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L2_BR,
+		HFI_PROP_BITRATE_LAYER3,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L2_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L2_BR,
+		HFI_PROP_BITRATE_LAYER3,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L3_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L3_BR,
+		HFI_PROP_BITRATE_LAYER4,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+	{L3_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L3_BR,
+		HFI_PROP_BITRATE_LAYER4,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L4_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L4_BR,
+		HFI_PROP_BITRATE_LAYER5,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L4_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L4_BR,
+		HFI_PROP_BITRATE_LAYER5,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L5_BR, ENC, H264,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_H264_HIER_CODING_L5_BR,
+		HFI_PROP_BITRATE_LAYER6,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{L5_BR, ENC, HEVC,
+		1, MAX_BITRATE, 1, DEFAULT_BITRATE,
+		V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L5_BR,
+		HFI_PROP_BITRATE_LAYER6,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_INPUT_PORT |
+			CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ENTROPY_MODE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) |
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC),
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		V4L2_CID_MPEG_VIDEO_H264_ENTROPY_MODE,
+		HFI_PROP_CABAC_SESSION,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{ENTROPY_MODE, DEC, H264 | HEVC | VP9 | AV1,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC,
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) |
+		BIT(V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC),
+		V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+		0,
+		HFI_PROP_CABAC_SESSION},
+
+	{PROFILE, ENC | DEC, H264,
+		V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+		V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH,
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH),
+		V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{PROFILE, ENC | DEC, HEVC | HEIC,
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE,
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_STILL_PICTURE) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE),
+		V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN,
+		V4L2_CID_MPEG_VIDEO_HEVC_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{PROFILE, DEC, VP9,
+		V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+		V4L2_MPEG_VIDEO_VP9_PROFILE_2,
+		BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_PROFILE_2),
+		V4L2_MPEG_VIDEO_VP9_PROFILE_0,
+		V4L2_CID_MPEG_VIDEO_VP9_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{PROFILE, DEC, AV1,
+		V4L2_MPEG_VIDC_AV1_PROFILE_MAIN,
+		V4L2_MPEG_VIDC_AV1_PROFILE_MAIN,
+		BIT(V4L2_MPEG_VIDC_AV1_PROFILE_MAIN),
+		V4L2_MPEG_VIDC_AV1_PROFILE_MAIN,
+		V4L2_CID_MPEG_VIDC_AV1_PROFILE,
+		HFI_PROP_PROFILE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_H264_LEVEL_6_0,
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_0),
+		V4L2_MPEG_VIDEO_H264_LEVEL_5_0,
+		V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, ENC, HEVC | HEIC,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2),
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_5,
+		V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, DEC, H264,
+		V4L2_MPEG_VIDEO_H264_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_H264_LEVEL_6_2,
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_0) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_1) |
+		BIT(V4L2_MPEG_VIDEO_H264_LEVEL_6_2),
+		V4L2_MPEG_VIDEO_H264_LEVEL_6_1,
+		V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, DEC, HEVC | HEIC,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_1,
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_1)|
+		BIT(V4L2_MPEG_VIDEO_HEVC_LEVEL_6_2),
+		V4L2_MPEG_VIDEO_HEVC_LEVEL_6_1,
+		V4L2_CID_MPEG_VIDEO_HEVC_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, DEC, VP9,
+		V4L2_MPEG_VIDEO_VP9_LEVEL_1_0,
+		V4L2_MPEG_VIDEO_VP9_LEVEL_6_0,
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_1_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDEO_VP9_LEVEL_6_0),
+		V4L2_MPEG_VIDEO_VP9_LEVEL_6_0,
+		V4L2_CID_MPEG_VIDEO_VP9_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LEVEL, DEC, AV1,
+		V4L2_MPEG_VIDC_AV1_LEVEL_2_0,
+		V4L2_MPEG_VIDC_AV1_LEVEL_6_1,
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_2_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_2_1) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_2_2) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_2_3) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_3_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_3_1) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_3_2) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_3_3) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_4_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_4_1) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_4_2) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_4_3) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_5_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_5_1) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_5_2) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_5_3) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_6_0) |
+		BIT(V4L2_MPEG_VIDC_AV1_LEVEL_6_1),
+		V4L2_MPEG_VIDC_AV1_LEVEL_6_1,
+		V4L2_CID_MPEG_VIDC_AV1_LEVEL,
+		HFI_PROP_LEVEL,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{AV1_TIER, DEC, AV1,
+		V4L2_MPEG_VIDC_AV1_TIER_MAIN,
+		V4L2_MPEG_VIDC_AV1_TIER_HIGH,
+		BIT(V4L2_MPEG_VIDC_AV1_TIER_MAIN) |
+		BIT(V4L2_MPEG_VIDC_AV1_TIER_HIGH),
+		V4L2_MPEG_VIDC_AV1_TIER_HIGH,
+		V4L2_CID_MPEG_VIDC_AV1_TIER,
+		HFI_PROP_TIER,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{HEVC_TIER, ENC | DEC, HEVC,
+		V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+		V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+		BIT(V4L2_MPEG_VIDEO_HEVC_TIER_MAIN) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_TIER_HIGH),
+		V4L2_MPEG_VIDEO_HEVC_TIER_HIGH,
+		V4L2_CID_MPEG_VIDEO_HEVC_TIER,
+		HFI_PROP_TIER,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{HEVC_TIER, ENC | DEC, HEIC,
+		V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+		V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+		BIT(V4L2_MPEG_VIDEO_HEVC_TIER_MAIN),
+		V4L2_MPEG_VIDEO_HEVC_TIER_MAIN,
+		V4L2_CID_MPEG_VIDEO_HEVC_TIER,
+		HFI_PROP_TIER,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LF_MODE, ENC, H264,
+		V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED,
+		DB_H264_DISABLE_SLICE_BOUNDARY,
+		BIT(V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED) |
+		BIT(V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED) |
+		BIT(DB_H264_DISABLE_SLICE_BOUNDARY),
+		V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED,
+		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE,
+		HFI_PROP_DEBLOCKING_MODE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LF_MODE, ENC, HEVC | HEIC,
+		V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_DISABLED,
+		DB_HEVC_DISABLE_SLICE_BOUNDARY,
+		BIT(V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_DISABLED) |
+		BIT(V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_ENABLED) |
+		BIT(DB_HEVC_DISABLE_SLICE_BOUNDARY),
+		V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_ENABLED,
+		V4L2_CID_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE,
+		HFI_PROP_DEBLOCKING_MODE,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{LF_ALPHA, ENC, H264,
+		-6, 6, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA},
+
+	{LF_ALPHA, ENC, HEVC | HEIC,
+		-6, 6, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_LF_TC_OFFSET_DIV2},
+
+	{LF_BETA, ENC, H264,
+		-6, 6, 1, 0,
+		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA},
+
+	{LF_BETA, ENC, HEVC | HEIC,
+		-6, 6, 1, 0,
+		V4L2_CID_MPEG_VIDEO_HEVC_LF_BETA_OFFSET_DIV2},
+
+	{SLICE_MODE, ENC, H264 | HEVC,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES,
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE) |
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB) |
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES),
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{SLICE_MODE, ENC, HEIC,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		BIT(V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE),
+		V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_SINGLE,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE,
+		0,
+		CAP_FLAG_OUTPUT_PORT | CAP_FLAG_MENU},
+
+	{SLICE_MAX_BYTES, ENC, H264 | HEVC,
+		MIN_SLICE_BYTE_SIZE, MAX_SLICE_BYTE_SIZE,
+		1, MIN_SLICE_BYTE_SIZE,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_BYTES,
+		HFI_PROP_MULTI_SLICE_BYTES_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{SLICE_MAX_MB, ENC, H264 | HEVC,
+		1, MAX_SLICE_MB_SIZE, 1, 1,
+		V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_MB,
+		HFI_PROP_MULTI_SLICE_MB_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{MB_RC, ENC, H264 | HEVC,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_MB_RC_ENABLE,
+		0,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{TRANSFORM_8X8, ENC, H264,
+		0, 1, 1, 1,
+		V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM,
+		HFI_PROP_8X8_TRANSFORM,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{CHROMA_QP_INDEX_OFFSET, ENC, HEVC,
+		MIN_CHROMA_QP_OFFSET, MAX_CHROMA_QP_OFFSET,
+		1, MAX_CHROMA_QP_OFFSET,
+		V4L2_CID_MPEG_VIDEO_H264_CHROMA_QP_INDEX_OFFSET,
+		HFI_PROP_CHROMA_QP_OFFSET,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{DISPLAY_DELAY_ENABLE, DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT},
+
+	{DISPLAY_DELAY, DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT},
+
+	{OUTPUT_ORDER, DEC, H264 | HEVC | VP9 | AV1,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_DECODE_ORDER_OUTPUT,
+		CAP_FLAG_INPUT_PORT},
+
+	{INPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		DEFAULT_MAX_HOST_BUF_COUNT, DEFAULT_MAX_HOST_BURST_BUF_COUNT,
+		1, DEFAULT_MAX_HOST_BUF_COUNT,
+		0,
+		HFI_PROP_BUFFER_HOST_MAX_COUNT,
+		CAP_FLAG_INPUT_PORT},
+
+	{OUTPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		DEFAULT_MAX_HOST_BUF_COUNT, DEFAULT_MAX_HOST_BURST_BUF_COUNT,
+		1, DEFAULT_MAX_HOST_BUF_COUNT,
+		0,
+		HFI_PROP_BUFFER_HOST_MAX_COUNT,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{CONCEAL_COLOR_8BIT, DEC, CODECS_ALL, 0x0, 0xff3fcff, 1,
+		DEFAULT_VIDEO_CONCEAL_COLOR_BLACK,
+		V4L2_CID_MPEG_VIDEO_MUTE_YUV,
+		HFI_PROP_CONCEAL_COLOR_8BIT,
+		CAP_FLAG_INPUT_PORT},
+
+	{CONCEAL_COLOR_10BIT, DEC, CODECS_ALL, 0x0, 0x3fffffff, 1,
+		DEFAULT_VIDEO_CONCEAL_COLOR_BLACK,
+		V4L2_CID_MPEG_VIDEO_MUTE_YUV,
+		HFI_PROP_CONCEAL_COLOR_10BIT,
+		CAP_FLAG_INPUT_PORT},
+
+	{STAGE, DEC|ENC, CODECS_ALL,
+		MSM_VIDC_STAGE_1,
+		MSM_VIDC_STAGE_2, 1,
+		MSM_VIDC_STAGE_2,
+		0,
+		HFI_PROP_STAGE},
+
+	{PIPE, DEC|ENC, CODECS_ALL,
+		MSM_VIDC_PIPE_1,
+		MSM_VIDC_PIPE_4, 1,
+		MSM_VIDC_PIPE_4,
+		0,
+		HFI_PROP_PIPE},
+
+	{POC, DEC, H264,
+		0, 2, 1, 1,
+		0,
+		HFI_PROP_PIC_ORDER_CNT_TYPE,
+		CAP_FLAG_VOLATILE},
+
+	/*
+	 * value of MAX_NUM_REORDER_FRAMES is 32 packed as mentioned below
+	 * (max_num_reorder_count << 16) | max_dec_frame_buffering_count
+	 */
+	{MAX_NUM_REORDER_FRAMES, DEC, H264 | HEVC,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_MAX_NUM_REORDER_FRAMES,
+		HFI_PROP_MAX_NUM_REORDER_FRAMES,
+		CAP_FLAG_VOLATILE},
+
+	{QUALITY_MODE, ENC, CODECS_ALL,
+		MSM_VIDC_MAX_QUALITY_MODE,
+		MSM_VIDC_POWER_SAVE_MODE, 1,
+		MSM_VIDC_POWER_SAVE_MODE},
+
+	{CODED_FRAMES, DEC, H264 | HEVC | HEIC,
+		CODED_FRAMES_PROGRESSIVE, CODED_FRAMES_INTERLACE,
+		1, CODED_FRAMES_PROGRESSIVE,
+		V4L2_CID_MPEG_VIDC_INTERLACE,
+		HFI_PROP_CODED_FRAMES,
+		CAP_FLAG_VOLATILE},
+
+	{BIT_DEPTH, DEC, CODECS_ALL, BIT_DEPTH_8, BIT_DEPTH_10, 1, BIT_DEPTH_8,
+		0,
+		HFI_PROP_LUMA_CHROMA_BIT_DEPTH},
+
+	{CODEC_CONFIG, DEC, H264 | HEVC | HEIC | AV1, 0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_CODEC_CONFIG, 0,
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{BITSTREAM_SIZE_OVERWRITE, DEC, CODECS_ALL, 0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_MIN_BITSTREAM_SIZE_OVERWRITE},
+
+	{THUMBNAIL_MODE, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_THUMBNAIL_MODE,
+		HFI_PROP_THUMBNAIL_MODE,
+		CAP_FLAG_INPUT_PORT},
+
+	{DEFAULT_HEADER, DEC, CODECS_ALL,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_DEC_DEFAULT_HEADER},
+
+	{RAP_FRAME, DEC, CODECS_ALL,
+		0, 1, 1, 1,
+		0,
+		HFI_PROP_DEC_START_FROM_RAP_FRAME,
+		CAP_FLAG_INPUT_PORT},
+
+	{SEQ_CHANGE_AT_SYNC_FRAME, DEC, CODECS_ALL,
+		0, 1, 1, 1,
+		0,
+		HFI_PROP_SEQ_CHANGE_AT_SYNC_FRAME,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{PRIORITY, DEC|ENC, CODECS_ALL,
+		0, 4, 1, 4,
+		V4L2_CID_MPEG_VIDC_PRIORITY,
+		HFI_PROP_SESSION_PRIORITY,
+		CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{ENC_IP_CR, ENC, CODECS_ALL,
+		0, S32_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_ENC_INPUT_COMPRESSION_RATIO,
+		0, CAP_FLAG_DYNAMIC_ALLOWED},
+	{FILM_GRAIN, DEC, AV1,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_AV1D_FILM_GRAIN_PRESENT,
+		HFI_PROP_AV1_FILM_GRAIN_PRESENT,
+		CAP_FLAG_VOLATILE},
+
+	{SUPER_BLOCK, DEC, AV1,
+		0, 1, 1, 0,
+		0,
+		HFI_PROP_AV1_SUPER_BLOCK_ENABLED},
+
+	{DRAP, DEC, AV1,
+		0, S32_MAX, 1, 0,
+		0,
+		HFI_PROP_AV1_DRAP_CONFIG,
+		CAP_FLAG_INPUT_PORT},
+
+	{LAST_FLAG_EVENT_ENABLE, DEC | ENC, CODECS_ALL,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_LAST_FLAG_EVENT_ENABLE},
+
+	{META_BITSTREAM_RESOLUTION, DEC, AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_BITSTREAM_RESOLUTION,
+		HFI_PROP_BITSTREAM_RESOLUTION,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_CROP_OFFSETS, DEC, AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_CROP_OFFSETS,
+		HFI_PROP_CROP_OFFSETS,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{ALL_INTRA, ENC, H264 | HEVC,
+		0, 1, 1, 0,
+		0,
+		0,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{META_LTR_MARK_USE, ENC, H264 | HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_LTR_MARK_USE_DETAILS,
+		HFI_PROP_LTR_MARK_USE_DETAILS,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SEQ_HDR_NAL, ENC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEQ_HEADER_NAL,
+		HFI_PROP_METADATA_SEQ_HEADER_NAL,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_DPB_MISR, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_DPB_LUMA_CHROMA_MISR,
+		HFI_PROP_DPB_LUMA_CHROMA_MISR,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_OPB_MISR, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_OPB_LUMA_CHROMA_MISR,
+		HFI_PROP_OPB_LUMA_CHROMA_MISR,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_INTERLACE, DEC, H264,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_INTERLACE,
+		HFI_PROP_INTERLACE_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_TIMESTAMP, DEC | ENC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_TIMESTAMP,
+		HFI_PROP_TIMESTAMP,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_CONCEALED_MB_CNT, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_CONCEALED_MB_COUNT,
+		HFI_PROP_CONEALED_MB_COUNT,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_HIST_INFO, DEC, HEVC | AV1 | VP9,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_HISTOGRAM_INFO,
+		HFI_PROP_HISTOGRAM_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_TRANSCODING_STAT_INFO, DEC, HEVC | H264,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_TRANSCODE_STAT_INFO,
+		HFI_PROP_TRANSCODING_STAT_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_TRANSCODING_STAT_INFO, ENC, HEVC | H264,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_TRANSCODE_STAT_INFO,
+		HFI_PROP_TRANSCODING_STAT_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_PICTURE_TYPE, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_PICTURE_TYPE,
+		HFI_PROP_PICTURE_TYPE,
+		CAP_FLAG_BITMASK | CAP_FLAG_META | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{META_SEI_MASTERING_DISP, ENC, HEVC | HEIC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE |
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEI_MASTERING_DISPLAY_COLOUR,
+		HFI_PROP_SEI_MASTERING_DISPLAY_COLOUR,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SEI_MASTERING_DISP, DEC, HEVC | HEIC | AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEI_MASTERING_DISPLAY_COLOUR,
+		HFI_PROP_SEI_MASTERING_DISPLAY_COLOUR,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SEI_CLL, ENC, HEVC | HEIC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE |
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEI_CONTENT_LIGHT_LEVEL,
+		HFI_PROP_SEI_CONTENT_LIGHT_LEVEL,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SEI_CLL, DEC, HEVC | HEIC | AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SEI_CONTENT_LIGHT_LEVEL,
+		HFI_PROP_SEI_CONTENT_LIGHT_LEVEL,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_HDR10PLUS, ENC, HEVC | HEIC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE |
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_HDR10PLUS,
+		HFI_PROP_SEI_HDR10PLUS_USERDATA,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_HDR10PLUS, DEC, HEVC | HEIC | AV1,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_HDR10PLUS,
+		HFI_PROP_SEI_HDR10PLUS_USERDATA,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_EVA_STATS, ENC, H264 | HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE |
+		MSM_VIDC_META_DYN_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_EVA_STATS,
+		HFI_PROP_EVA_STAT_INFO,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_BUF_TAG, ENC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_TX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_BUFFER_TAG,
+		HFI_PROP_BUFFER_TAG,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	/*
+	 * when fence enabled, client needs output buffer_tag
+	 * in input metadata buffer done.
+	 */
+	{META_BUF_TAG, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_TX_INPUT |
+			MSM_VIDC_META_TX_OUTPUT | MSM_VIDC_META_RX_INPUT |
+			MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_BUFFER_TAG,
+		HFI_PROP_BUFFER_TAG,
+		CAP_FLAG_BITMASK | CAP_FLAG_META | CAP_FLAG_DYNAMIC_ALLOWED},
+
+	{META_DPB_TAG_LIST, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_DPB_TAG_LIST,
+		HFI_PROP_DPB_TAG_LIST,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SUBFRAME_OUTPUT, ENC, HEIC | H264 | HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SUBFRAME_OUTPUT,
+		HFI_PROP_SUBFRAME_OUTPUT,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_SUBFRAME_OUTPUT, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_SUBFRAME_OUTPUT,
+		HFI_PROP_SUBFRAME_OUTPUT,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_ENC_QP_METADATA, ENC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_ENC_QP_METADATA,
+		HFI_PROP_ENC_QP_METADATA,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_ROI_INFO, ENC, H264 | HEVC,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_TX_INPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_ROI_INFO,
+		HFI_PROP_ROI_INFO,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{META_DEC_QP_METADATA, DEC, CODECS_ALL,
+		MSM_VIDC_META_DISABLE,
+		MSM_VIDC_META_ENABLE | MSM_VIDC_META_RX_OUTPUT,
+		0, MSM_VIDC_META_DISABLE,
+		V4L2_CID_MPEG_VIDC_METADATA_DEC_QP_METADATA,
+		HFI_PROP_DEC_QP_METADATA,
+		CAP_FLAG_BITMASK | CAP_FLAG_META},
+
+	{GRID_ENABLE, ENC, HEIC,
+		0, 1, 1, 1,
+		0,
+		HFI_PROP_HEIC_GRID_ENABLE,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{GRID_SIZE, ENC, HEIC,
+		HEIC_GRID_WIDTH, HEIC_GRID_WIDTH * 2,
+		HEIC_GRID_WIDTH, HEIC_GRID_WIDTH,
+		V4L2_CID_MPEG_VIDC_GRID_WIDTH},
+
+	{COMPLEXITY, ENC, H264 | HEVC,
+		0, 100,
+		1, DEFAULT_COMPLEXITY,
+		V4L2_CID_MPEG_VIDC_VENC_COMPLEXITY},
+
+	{DELIVERY_MODE, ENC, HEVC,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_HEVC_ENCODE_DELIVERY_MODE,
+		HFI_PROP_ENABLE_SLICE_DELIVERY,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{DELIVERY_MODE, ENC, H264,
+		0, 1, 1, 0,
+		V4L2_CID_MPEG_VIDC_H264_ENCODE_DELIVERY_MODE,
+		HFI_PROP_ENABLE_SLICE_DELIVERY,
+		CAP_FLAG_OUTPUT_PORT},
+
+	{SIGNAL_COLOR_INFO, ENC, CODECS_ALL,
+		0, INT_MAX, 1, 0,
+		V4L2_CID_MPEG_VIDC_SIGNAL_COLOR_INFO,
+		HFI_PROP_SIGNAL_COLOR_INFO,
+		CAP_FLAG_INPUT_PORT | CAP_FLAG_DYNAMIC_ALLOWED},
+};
+
+static struct msm_platform_inst_cap_dependency instance_cap_dependency_data_sa8775p[] = {
+	/* {cap, domain, codec,
+	 *      children,
+	 *      adjust, set}
+	 */
+
+	{PIX_FMTS, ENC, H264,
+		{META_ROI_INFO, IR_PERIOD, CSC}},
+
+	{PIX_FMTS, ENC, HEVC,
+		{PROFILE, MIN_FRAME_QP, MAX_FRAME_QP, I_FRAME_QP, P_FRAME_QP,
+			B_FRAME_QP, META_ROI_INFO, MIN_QUALITY, BLUR_TYPES, IR_PERIOD,
+			LTR_COUNT, CSC}},
+
+	{PIX_FMTS, ENC, HEIC,
+		{PROFILE, CSC}},
+
+	{PIX_FMTS, DEC, HEVC | HEIC,
+		{PROFILE}},
+
+	{FRAME_RATE, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_q16},
+
+	{FRAME_RATE, DEC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_dec_frame_rate},
+
+	{OPERATING_RATE, DEC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_dec_operating_rate},
+
+	{ENC_RING_BUFFER_COUNT, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		NULL},
+
+	{SECURE_MODE, ENC | DEC, H264 | HEVC | VP9 | AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{META_OUTBUF_FENCE, DEC, H264 | HEVC | VP9 | AV1,
+		{LOWLATENCY_MODE},
+		NULL,
+		NULL},
+
+	{HFLIP, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_flip},
+
+	{VFLIP, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_flip},
+
+	{ROTATION, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_rotation},
+
+	{SUPER_FRAME, ENC, H264 | HEVC,
+		{INPUT_BUF_HOST_MAX_COUNT, OUTPUT_BUF_HOST_MAX_COUNT},
+		NULL,
+		NULL},
+
+	{SLICE_DECODE, DEC, H264 | HEVC | AV1,
+		{0},
+		NULL,
+		NULL},
+
+	{HEADER_MODE, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_header_mode},
+
+	{WITHOUT_STARTCODE, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_nal_length},
+
+	{WITHOUT_STARTCODE, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{REQUEST_I_FRAME, ENC, H264 | HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_req_sync_frame},
+
+	{BIT_RATE, ENC, H264,
+		{PEAK_BITRATE, BITRATE_BOOST, L0_BR},
+		msm_vidc_adjust_bitrate,
+		msm_vidc_set_bitrate},
+
+	{BIT_RATE, ENC, HEVC,
+		{PEAK_BITRATE, BITRATE_BOOST, L0_BR},
+		msm_vidc_adjust_bitrate,
+		msm_vidc_set_bitrate},
+
+	{BITRATE_MODE, ENC, H264,
+		{LTR_COUNT, IR_PERIOD, TIME_DELTA_BASED_RC, I_FRAME_QP,
+			P_FRAME_QP, B_FRAME_QP, ENH_LAYER_COUNT, BIT_RATE,
+			META_ROI_INFO, MIN_QUALITY, BITRATE_BOOST, VBV_DELAY,
+			PEAK_BITRATE, SLICE_MODE, CONTENT_ADAPTIVE_CODING,
+			BLUR_TYPES, LOWLATENCY_MODE, META_TRANSCODING_STAT_INFO},
+		msm_vidc_adjust_bitrate_mode,
+		msm_vidc_set_u32_enum},
+
+	{BITRATE_MODE, ENC, HEVC,
+		{LTR_COUNT, IR_PERIOD, TIME_DELTA_BASED_RC, I_FRAME_QP,
+			P_FRAME_QP, B_FRAME_QP, CONSTANT_QUALITY, ENH_LAYER_COUNT,
+			BIT_RATE, META_ROI_INFO, MIN_QUALITY, BITRATE_BOOST, VBV_DELAY,
+			PEAK_BITRATE, SLICE_MODE, CONTENT_ADAPTIVE_CODING,
+			BLUR_TYPES, LOWLATENCY_MODE, META_EVA_STATS, META_TRANSCODING_STAT_INFO},
+		msm_vidc_adjust_bitrate_mode,
+		msm_vidc_set_u32_enum},
+
+	{BITRATE_MODE, ENC, HEIC,
+		{TIME_DELTA_BASED_RC, CONSTANT_QUALITY},
+		msm_vidc_adjust_bitrate_mode,
+		msm_vidc_set_u32_enum},
+
+	{CONSTANT_QUALITY, ENC, HEVC | HEIC,
+		{0},
+		NULL,
+		msm_vidc_set_constant_quality},
+
+	{GOP_SIZE, ENC, CODECS_ALL,
+		{ALL_INTRA},
+		msm_vidc_adjust_gop_size,
+		msm_vidc_set_gop_size},
+
+	{GOP_SIZE, ENC, HEIC,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{B_FRAME, ENC, H264 | HEVC,
+		{ALL_INTRA},
+		msm_vidc_adjust_b_frame,
+		msm_vidc_set_u32},
+
+	{B_FRAME, ENC, HEIC,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{BLUR_TYPES, ENC, H264 | HEVC,
+		{BLUR_RESOLUTION},
+		msm_vidc_adjust_blur_type,
+		msm_vidc_set_u32_enum},
+
+	{BLUR_RESOLUTION, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_blur_resolution,
+		msm_vidc_set_blur_resolution},
+
+	{CSC, ENC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_csc,
+		msm_vidc_set_u32},
+
+	{CSC_CUSTOM_MATRIX, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_csc_custom_matrix},
+
+	{LOWLATENCY_MODE, ENC, H264 | HEVC,
+		{STAGE, BIT_RATE},
+		msm_vidc_adjust_enc_lowlatency_mode,
+		NULL},
+
+	{LOWLATENCY_MODE, DEC, H264 | HEVC | VP9 | AV1,
+		{STAGE},
+		msm_vidc_adjust_dec_lowlatency_mode,
+		NULL},
+
+	{LTR_COUNT, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_ltr_count,
+		msm_vidc_set_u32},
+
+	{USE_LTR, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_use_ltr,
+		msm_vidc_set_use_and_mark_ltr},
+
+	{MARK_LTR, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_mark_ltr,
+		msm_vidc_set_use_and_mark_ltr},
+
+	{IR_PERIOD, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_ir_period,
+		msm_vidc_set_ir_period},
+
+	{AU_DELIMITER, ENC, H264 | HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{BASELAYER_PRIORITY, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{TIME_DELTA_BASED_RC, ENC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_delta_based_rc,
+		msm_vidc_set_u32},
+
+	{CONTENT_ADAPTIVE_CODING, ENC, H264 | HEVC,
+		{REQUEST_PREPROCESS},
+		msm_vidc_adjust_brs,
+		msm_vidc_set_vbr_related_properties},
+
+	{REQUEST_PREPROCESS, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_preprocess,
+		msm_vidc_set_preprocess},
+
+	{BITRATE_BOOST, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_bitrate_boost,
+		msm_vidc_set_vbr_related_properties},
+
+	{MIN_QUALITY, ENC, H264 | HEVC,
+		{BLUR_TYPES, BITRATE_BOOST},
+		msm_vidc_adjust_min_quality,
+		msm_vidc_set_u32},
+
+	{VBV_DELAY, ENC, H264 | HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_cbr_related_properties},
+
+	{PEAK_BITRATE, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_peak_bitrate,
+		msm_vidc_set_cbr_related_properties},
+
+	{MIN_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_min_qp},
+
+	{MIN_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_min_qp,
+		msm_vidc_set_min_qp},
+
+	{MAX_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_max_qp},
+
+	{MAX_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_max_qp,
+		msm_vidc_set_max_qp},
+
+	{I_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_i_frame_qp,
+		msm_vidc_set_frame_qp},
+
+	{I_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_frame_qp},
+
+	{P_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_p_frame_qp,
+		msm_vidc_set_frame_qp},
+
+	{P_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_frame_qp},
+
+	{B_FRAME_QP, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_hevc_b_frame_qp,
+		msm_vidc_set_frame_qp},
+
+	{B_FRAME_QP, ENC, H264,
+		{0},
+		NULL,
+		msm_vidc_set_frame_qp},
+
+	{LAYER_TYPE, ENC, H264 | HEVC,
+		{CONTENT_ADAPTIVE_CODING, LTR_COUNT}},
+
+	{LAYER_ENABLE, ENC, H264 | HEVC,
+		{CONTENT_ADAPTIVE_CODING}},
+
+	{ENH_LAYER_COUNT, ENC, H264 | HEVC,
+		{GOP_SIZE, B_FRAME, BIT_RATE, MIN_QUALITY, SLICE_MODE, LTR_COUNT},
+		msm_vidc_adjust_layer_count,
+		msm_vidc_set_layer_count_and_type},
+
+	{ENH_LAYER_COUNT, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{L0_BR, ENC, H264 | HEVC,
+		{L1_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L1_BR, ENC, H264 | HEVC,
+		{L2_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L2_BR, ENC, H264 | HEVC,
+		{L3_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L3_BR, ENC, H264 | HEVC,
+		{L4_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L4_BR, ENC, H264 | HEVC,
+		{L5_BR},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{L5_BR, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_layer_bitrate,
+		msm_vidc_set_layer_bitrate},
+
+	{ENTROPY_MODE, ENC, H264,
+		{BIT_RATE},
+		msm_vidc_adjust_entropy_mode,
+		msm_vidc_set_u32},
+
+	{PROFILE, ENC, H264,
+		{ENTROPY_MODE, TRANSFORM_8X8},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{PROFILE, DEC, H264,
+		{ENTROPY_MODE},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{PROFILE, ENC, HEVC | HEIC,
+		{META_SEI_MASTERING_DISP, META_SEI_CLL, META_HDR10PLUS},
+		msm_vidc_adjust_profile,
+		msm_vidc_set_u32_enum},
+
+	{PROFILE, DEC, HEVC | HEIC,
+		{0},
+		msm_vidc_adjust_profile,
+		msm_vidc_set_u32_enum},
+
+	{PROFILE, DEC, VP9 | AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{LEVEL, DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{LEVEL, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_level},
+
+	{AV1_TIER, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{HEVC_TIER, ENC | DEC, HEVC | HEIC,
+		{0},
+		NULL,
+		msm_vidc_set_u32_enum},
+
+	{LF_MODE, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_deblock_mode},
+
+	{SLICE_MODE, ENC, H264 | HEVC,
+		{STAGE, DELIVERY_MODE},
+		msm_vidc_adjust_slice_count,
+		msm_vidc_set_slice_count},
+
+	{SLICE_MODE, ENC, HEIC,
+		{0},
+		msm_vidc_adjust_slice_count,
+		msm_vidc_set_slice_count},
+
+	{TRANSFORM_8X8, ENC, H264,
+		{0},
+		msm_vidc_adjust_transform_8x8,
+		msm_vidc_set_u32},
+
+	{CHROMA_QP_INDEX_OFFSET, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_chroma_qp_index_offset,
+		msm_vidc_set_chroma_qp_index_offset},
+
+	{DISPLAY_DELAY_ENABLE, DEC, H264 | HEVC | VP9 | AV1,
+		{OUTPUT_ORDER},
+		NULL,
+		NULL},
+
+	{DISPLAY_DELAY, DEC, H264 | HEVC | VP9 | AV1,
+		{OUTPUT_ORDER},
+		NULL,
+		NULL},
+
+	{OUTPUT_ORDER, DEC, H264 | HEVC | VP9 | AV1,
+		{0},
+		msm_vidc_adjust_output_order,
+		msm_vidc_set_u32},
+
+	{INPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_input_buf_host_max_count,
+		msm_vidc_set_u32},
+
+	{INPUT_BUF_HOST_MAX_COUNT, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_input_buf_host_max_count,
+		msm_vidc_set_u32},
+
+	{OUTPUT_BUF_HOST_MAX_COUNT, ENC | DEC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_output_buf_host_max_count,
+		msm_vidc_set_u32},
+
+	{OUTPUT_BUF_HOST_MAX_COUNT, ENC, H264 | HEVC,
+		{0},
+		msm_vidc_adjust_output_buf_host_max_count,
+		msm_vidc_set_u32},
+
+	{CONCEAL_COLOR_8BIT, DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_u32_packed},
+
+	{CONCEAL_COLOR_10BIT, DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_u32_packed},
+
+	{STAGE, ENC | DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_stage},
+
+	{STAGE, ENC, H264 | HEVC,
+		{0},
+		NULL,
+		msm_vidc_set_stage},
+
+	{STAGE, DEC, H264 | HEVC | VP9 | AV1,
+		{0},
+		NULL,
+		msm_vidc_set_stage},
+
+	{PIPE, DEC | ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_pipe},
+
+	{THUMBNAIL_MODE, DEC, H264 | HEVC | VP9 | AV1,
+		{OUTPUT_ORDER},
+		NULL,
+		msm_vidc_set_u32},
+
+	{THUMBNAIL_MODE, DEC, HEIC,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{RAP_FRAME, DEC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{PRIORITY, DEC | ENC, CODECS_ALL,
+		{0},
+		msm_vidc_adjust_session_priority,
+		msm_vidc_set_session_priority},
+
+	{DRAP, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{ALL_INTRA, ENC, H264 | HEVC,
+		{LTR_COUNT, IR_PERIOD, SLICE_MODE, BIT_RATE},
+		msm_vidc_adjust_all_intra,
+		NULL},
+
+	{META_EVA_STATS, ENC, HEVC,
+		{0},
+		msm_vidc_adjust_eva_stats,
+		NULL},
+
+	{META_ROI_INFO, ENC, H264 | HEVC,
+		{MIN_QUALITY, IR_PERIOD, BLUR_TYPES},
+		msm_vidc_adjust_roi_info,
+		NULL},
+
+	{GRID_ENABLE, ENC, HEIC,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{VUI_TIMING_INFO, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_vui_timing_info},
+
+	{DELIVERY_MODE, ENC, H264|HEVC,
+		{LOWLATENCY_MODE, OUTPUT_BUF_HOST_MAX_COUNT},
+		msm_vidc_adjust_delivery_mode,
+		msm_vidc_set_u32},
+
+	{SIGNAL_COLOR_INFO, ENC, CODECS_ALL,
+		{0},
+		NULL,
+		msm_vidc_set_signal_color_info},
+
+	{DRAP, DEC, AV1,
+		{0},
+		NULL,
+		msm_vidc_set_u32},
+
+	{META_SEI_MASTERING_DISP, ENC, HEVC | HEIC,
+		{0},
+		msm_vidc_adjust_sei_mastering_disp,
+		NULL},
+
+	{META_SEI_CLL, ENC, HEVC | HEIC,
+		{0},
+		msm_vidc_adjust_sei_cll,
+		NULL},
+
+	{META_HDR10PLUS, ENC, HEVC | HEIC,
+		{0},
+		msm_vidc_adjust_hdr10plus,
+		NULL},
+
+	{META_TRANSCODING_STAT_INFO, ENC, HEVC | H264,
+		{0},
+		msm_vidc_adjust_transcoding_stats,
+		NULL},
+};
+
+/* Default UBWC config for LPDDR5 */
+static struct msm_vidc_ubwc_config_data ubwc_config_sa8775p[] = {
+	UBWC_CONFIG(8, 32, 13, 0, 0, 1, 1),
+};
+
+static struct msm_vidc_efuse_data efuse_data_sa8775p[] = {
+	/* IRIS_MULTIPIPE_DISABLE - max 4K@30 */
+	EFUSE_ENTRY(0x221C8118, 4, 0x400, 0xA, SKU_VERSION),
+};
+static struct msm_vidc_format_capability format_data_sa8775p = {
+	.codec_info = codec_data_sa8775p,
+	.codec_info_size = ARRAY_SIZE(codec_data_sa8775p),
+	.color_format_info = color_format_data_sa8775p,
+	.color_format_info_size = ARRAY_SIZE(color_format_data_sa8775p),
+	.color_prim_info = color_primaries_data_sa8775p,
+	.color_prim_info_size = ARRAY_SIZE(color_primaries_data_sa8775p),
+	.transfer_char_info = transfer_char_data_sa8775p,
+	.transfer_char_info_size = ARRAY_SIZE(transfer_char_data_sa8775p),
+	.matrix_coeff_info = matrix_coeff_data_sa8775p,
+	.matrix_coeff_info_size = ARRAY_SIZE(matrix_coeff_data_sa8775p),
+};
+
+/* name, min_kbps, max_kbps */
+static const struct bw_table sa8775p_bw_table[] = {
+	{ "iris-cnoc",  1000, 1000     },
+	{ "iris-ddr",   1000, 15000000 },
+};
+
+/* name */
+static const struct pd_table sa8775p_pd_table[] = {
+	{ "iris-ctl" },
+	{ "vcodec"   },
+};
+
+/* name */
+static const char * const sa8775p_opp_pd_table[] = { "mx", "mmcx", NULL };
+
+/* name, clock id, scaling */
+static const struct clk_table sa8775p_clk_table[] = {
+	{ "gcc_video_axi0",         GCC_VIDEO_AXI0_CLK,     0 },
+	{ "core_clk",               VIDEO_CC_MVS0C_CLK,     0 },
+	{ "vcodec_clk",             VIDEO_CC_MVS0_CLK,      1 },
+};
+
+/* name, exclusive_release */
+static const struct clk_rst_table sa8775p_clk_reset_table[] = {
+	{ "video_axi_reset",        0  },
+};
+
+/* name, start, size, secure, dma_coherant, region, dma_mask */
+const struct context_bank_table sa8775p_context_bank_table[] = {
+	{"qcom,vidc,cb-ns", 0x25800000, 0xba800000, 0, 1, MSM_VIDC_NON_SECURE, 0},
+	{"qcom,vidc,cb-ns-pxl", 0x00100000, 0xdff00000, 0, 1, MSM_VIDC_NON_SECURE_PIXEL, 0},
+	{"qcom,vidc,cb-sec-non-pxl",   0x01400000, 0x24400000, 1, 0, MSM_VIDC_SECURE_NONPIXEL, 0},
+};
+
+/* freq */
+static struct freq_table sa8775p_freq_table[] = {
+	{560000000}, {533000000}, {444000000}, {366000000}
+};
+
+/* register, value, mask */
+static const struct reg_preset_table sa8775p_reg_preset_table[] = {
+	{ 0xB0088, 0x0, 0x11 },
+};
+
+/* decoder properties */
+static const u32 sa8775p_vdec_psc_avc[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_CODED_FRAMES,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PIC_ORDER_CNT_TYPE,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+	HFI_PROP_MAX_NUM_REORDER_FRAMES,
+};
+
+static const u32 sa8775p_vdec_psc_hevc[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_TIER,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+	HFI_PROP_MAX_NUM_REORDER_FRAMES,
+};
+
+static const u32 sa8775p_vdec_psc_vp9[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+};
+
+static const u32 sa8775p_vdec_psc_av1[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+	HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+	HFI_PROP_AV1_FILM_GRAIN_PRESENT,
+	HFI_PROP_AV1_SUPER_BLOCK_ENABLED,
+	HFI_PROP_PROFILE,
+	HFI_PROP_LEVEL,
+	HFI_PROP_TIER,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+};
+
+static const u32 sa8775p_vdec_input_properties_avc[] = {
+	HFI_PROP_NO_OUTPUT,
+	HFI_PROP_SUBFRAME_INPUT,
+};
+
+static const u32 sa8775p_vdec_input_properties_hevc[] = {
+	HFI_PROP_NO_OUTPUT,
+	HFI_PROP_SUBFRAME_INPUT,
+};
+
+static const u32 sa8775p_vdec_input_properties_vp9[] = {
+	HFI_PROP_NO_OUTPUT,
+	HFI_PROP_SUBFRAME_INPUT,
+};
+
+static const u32 sa8775p_vdec_input_properties_av1[] = {
+	HFI_PROP_NO_OUTPUT,
+	HFI_PROP_SUBFRAME_INPUT,
+	HFI_PROP_DPB_LIST,
+	HFI_PROP_AV1_TILE_ROWS_COLUMNS,
+	HFI_PROP_AV1_UNIFORM_TILE_SPACING,
+};
+
+static const u32 sa8775p_vdec_output_properties_avc[] = {
+	HFI_PROP_WORST_COMPRESSION_RATIO,
+	HFI_PROP_WORST_COMPLEXITY_FACTOR,
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+	HFI_PROP_CABAC_SESSION,
+};
+
+static const u32 sa8775p_vdec_output_properties_hevc[] = {
+	HFI_PROP_WORST_COMPRESSION_RATIO,
+	HFI_PROP_WORST_COMPLEXITY_FACTOR,
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+};
+
+static const u32 sa8775p_vdec_output_properties_vp9[] = {
+	HFI_PROP_WORST_COMPRESSION_RATIO,
+	HFI_PROP_WORST_COMPLEXITY_FACTOR,
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+};
+
+static const u32 sa8775p_vdec_output_properties_av1[] = {
+	HFI_PROP_WORST_COMPRESSION_RATIO,
+	HFI_PROP_WORST_COMPLEXITY_FACTOR,
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_DPB_LIST,
+	HFI_PROP_CABAC_SESSION,
+};
+
+static const struct msm_vidc_platform_data sa8775p_data = {
+	/* resources dependent on other module */
+	.bw_tbl = sa8775p_bw_table,
+	.bw_tbl_size = ARRAY_SIZE(sa8775p_bw_table),
+	.clk_tbl = sa8775p_clk_table,
+	.clk_tbl_size = ARRAY_SIZE(sa8775p_clk_table),
+	.clk_rst_tbl = sa8775p_clk_reset_table,
+	.clk_rst_tbl_size = ARRAY_SIZE(sa8775p_clk_reset_table),
+	.subcache_tbl = NULL,
+	.subcache_tbl_size = 0,
+
+	/* populate context bank */
+	.context_bank_tbl = sa8775p_context_bank_table,
+	.context_bank_tbl_size = ARRAY_SIZE(sa8775p_context_bank_table),
+
+	/* populate power domain and opp table */
+	.pd_tbl = sa8775p_pd_table,
+	.pd_tbl_size = ARRAY_SIZE(sa8775p_pd_table),
+	.opp_tbl = sa8775p_opp_pd_table,
+	.opp_tbl_size = ARRAY_SIZE(sa8775p_opp_pd_table),
+
+	/* platform specific resources */
+	.freq_tbl = sa8775p_freq_table,
+	.freq_tbl_size = ARRAY_SIZE(sa8775p_freq_table),
+	.reg_prst_tbl = sa8775p_reg_preset_table,
+	.reg_prst_tbl_size = ARRAY_SIZE(sa8775p_reg_preset_table),
+	.fwname = "./qcom/vpu-3.0/vpu30_4v_16mb",
+	.pas_id = 9,
+	.supports_mmrm = 0,
+
+	/* caps related resorces */
+	.core_data = core_data_sa8775p,
+	.core_data_size = ARRAY_SIZE(core_data_sa8775p),
+	.inst_cap_data = instance_cap_data_sa8775p,
+	.inst_cap_data_size = ARRAY_SIZE(instance_cap_data_sa8775p),
+	.inst_cap_dependency_data = instance_cap_dependency_data_sa8775p,
+	.inst_cap_dependency_data_size = ARRAY_SIZE(instance_cap_dependency_data_sa8775p),
+	.csc_data.vpe_csc_custom_bias_coeff = vpe_csc_custom_bias_coeff,
+	.csc_data.vpe_csc_custom_matrix_coeff = vpe_csc_custom_matrix_coeff,
+	.csc_data.vpe_csc_custom_limit_coeff = vpe_csc_custom_limit_coeff,
+	.ubwc_config = ubwc_config_sa8775p,
+	.format_data = &format_data_sa8775p,
+
+	/* decoder properties related*/
+	.psc_avc_tbl = sa8775p_vdec_psc_avc,
+	.psc_avc_tbl_size = ARRAY_SIZE(sa8775p_vdec_psc_avc),
+	.psc_hevc_tbl = sa8775p_vdec_psc_hevc,
+	.psc_hevc_tbl_size = ARRAY_SIZE(sa8775p_vdec_psc_hevc),
+	.psc_vp9_tbl = sa8775p_vdec_psc_vp9,
+	.psc_vp9_tbl_size = ARRAY_SIZE(sa8775p_vdec_psc_vp9),
+	.psc_av1_tbl = sa8775p_vdec_psc_av1,
+	.psc_av1_tbl_size = ARRAY_SIZE(sa8775p_vdec_psc_av1),
+	.dec_input_prop_avc = sa8775p_vdec_input_properties_avc,
+	.dec_input_prop_hevc = sa8775p_vdec_input_properties_hevc,
+	.dec_input_prop_vp9 = sa8775p_vdec_input_properties_vp9,
+	.dec_input_prop_av1 = sa8775p_vdec_input_properties_av1,
+	.dec_input_prop_size_avc = ARRAY_SIZE(sa8775p_vdec_input_properties_avc),
+	.dec_input_prop_size_hevc = ARRAY_SIZE(sa8775p_vdec_input_properties_hevc),
+	.dec_input_prop_size_vp9 = ARRAY_SIZE(sa8775p_vdec_input_properties_vp9),
+	.dec_input_prop_size_av1 = ARRAY_SIZE(sa8775p_vdec_input_properties_av1),
+	.dec_output_prop_avc = sa8775p_vdec_output_properties_avc,
+	.dec_output_prop_hevc = sa8775p_vdec_output_properties_hevc,
+	.dec_output_prop_vp9 = sa8775p_vdec_output_properties_vp9,
+	.dec_output_prop_av1 = sa8775p_vdec_output_properties_av1,
+	.dec_output_prop_size_avc = ARRAY_SIZE(sa8775p_vdec_output_properties_avc),
+	.dec_output_prop_size_hevc = ARRAY_SIZE(sa8775p_vdec_output_properties_hevc),
+	.dec_output_prop_size_vp9 = ARRAY_SIZE(sa8775p_vdec_output_properties_vp9),
+	.dec_output_prop_size_av1 = ARRAY_SIZE(sa8775p_vdec_output_properties_av1),
+
+	/* Fuse specific resources */
+	.efuse_data = efuse_data_sa8775p,
+	.efuse_data_size = ARRAY_SIZE(efuse_data_sa8775p),
+	.sku_version = SKU_VERSION_0,
+};
+
+static int msm_vidc_init_data(struct msm_vidc_core *core)
+{
+	d_vpr_h("%s: initialize sa8775p data\n", __func__);
+
+	core->platform->data = sa8775p_data;
+
+	core->mem_ops = get_mem_ops_ext();
+	if (!core->mem_ops) {
+		d_vpr_e("%s: invalid memory ext ops\n", __func__);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int msm_vidc_init_platform_sa8775p(struct msm_vidc_core *core)
+{
+	return msm_vidc_init_data(core);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/platform/sm8550/inc/msm_vidc_sm8550.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/platform/sm8550/inc/msm_vidc_sm8550.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_SM8550_H_
+#define _MSM_VIDC_SM8550_H_
+
+#include "msm_vidc_core.h"
+
+int msm_vidc_init_platform_sm8550(struct msm_vidc_core *core);
+
+#endif // _MSM_VIDC_SM8550_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/common/inc/msm_vidc_variant.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/common/inc/msm_vidc_variant.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_VARIANT_H_
+#define _MSM_VIDC_VARIANT_H_
+
+#include <linux/types.h>
+
+struct msm_vidc_core;
+
+int __write_register_masked(struct msm_vidc_core *core, u32 reg, u32 value,
+		u32 mask);
+int __write_register(struct msm_vidc_core *core, u32 reg, u32 value);
+int __read_register(struct msm_vidc_core *core, u32 reg, u32 *value);
+int __read_register_with_poll_timeout(struct msm_vidc_core *core, u32 reg,
+		u32 mask, u32 exp_val, u32 sleep_us, u32 timeout_us);
+int __set_registers(struct msm_vidc_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/common/src/msm_vidc_variant.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/common/src/msm_vidc_variant.c
@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/errno.h>
+#include <linux/iopoll.h>
+
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_state.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_variant.h"
+#include "msm_vidc_platform.h"
+#include "venus_hfi.h"
+
+int __write_register(struct msm_vidc_core *core, u32 reg, u32 value)
+{
+	u32 hwiosymaddr = reg;
+	u8 *base_addr;
+	int rc = 0;
+
+	rc = __strict_check(core, __func__);
+	if (rc)
+		return rc;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE)) {
+		d_vpr_e("HFI Write register failed : Power is OFF\n");
+		return -EINVAL;
+	}
+
+	base_addr = core->resource->register_base_addr;
+	d_vpr_l("regwrite(%pK + %#x) = %#x\n", base_addr, hwiosymaddr, value);
+	base_addr += hwiosymaddr;
+	writel_relaxed(value, base_addr);
+
+	/* Memory barrier to make sure value is written into the register */
+	wmb();
+
+	return rc;
+}
+
+/*
+ * Argument mask is used to specify which bits to update. In case mask is 0x11,
+ * only bits 0 & 4 will be updated with corresponding bits from value. To update
+ * entire register with value, set mask = 0xFFFFFFFF.
+ */
+int __write_register_masked(struct msm_vidc_core *core, u32 reg, u32 value,
+			    u32 mask)
+{
+	u32 prev_val, new_val;
+	u8 *base_addr;
+	int rc = 0;
+
+	rc = __strict_check(core, __func__);
+	if (rc)
+		return rc;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE)) {
+		d_vpr_e("%s: register write failed, power is off\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	base_addr = core->resource->register_base_addr;
+	base_addr += reg;
+
+	prev_val = readl_relaxed(base_addr);
+	/*
+	 * Memory barrier to ensure register read is correct
+	 */
+	rmb();
+
+	new_val = (prev_val & ~mask) | (value & mask);
+	d_vpr_l(
+		"Base addr: %pK, writing to: %#x, previous-value: %#x, value: %#x, mask: %#x, new-value: %#x...\n",
+		base_addr, reg, prev_val, value, mask, new_val);
+	writel_relaxed(new_val, base_addr);
+	/*
+	 * Memory barrier to make sure value is written into the register.
+	 */
+	wmb();
+
+	return rc;
+}
+
+int __read_register(struct msm_vidc_core *core, u32 reg, u32 *value)
+{
+	int rc = 0;
+	u8 *base_addr;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE)) {
+		d_vpr_e("HFI Read register failed : Power is OFF\n");
+		return -EINVAL;
+	}
+
+	base_addr = core->resource->register_base_addr;
+
+	*value = readl_relaxed(base_addr + reg);
+	/*
+	 * Memory barrier to make sure value is read correctly from the
+	 * register.
+	 */
+	rmb();
+	d_vpr_l("regread(%pK + %#x) = %#x\n", base_addr, reg, *value);
+
+	return rc;
+}
+
+int __read_register_with_poll_timeout(struct msm_vidc_core *core, u32 reg,
+				      u32 mask, u32 exp_val, u32 sleep_us,
+				      u32 timeout_us)
+{
+	int rc = 0;
+	u32 val = 0;
+	u8 *addr;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE)) {
+		d_vpr_e("%s failed: Power is OFF\n", __func__);
+		return -EINVAL;
+	}
+
+	addr = (u8 *)core->resource->register_base_addr + reg;
+
+	rc = readl_relaxed_poll_timeout(addr, val, ((val & mask) == exp_val), sleep_us, timeout_us);
+	/*
+	 * Memory barrier to make sure value is read correctly from the
+	 * register.
+	 */
+	rmb();
+	d_vpr_l(
+		"regread(%pK + %#x) = %#x. rc %d, mask %#x, exp_val %#x, cond %u, sleep %u, timeout %u\n",
+		core->resource->register_base_addr, reg, val, rc, mask, exp_val,
+		((val & mask) == exp_val), sleep_us, timeout_us);
+
+	return rc;
+}
+
+int __set_registers(struct msm_vidc_core *core)
+{
+	const struct reg_preset_table *reg_prst;
+	unsigned int prst_count;
+	int cnt, rc = 0;
+
+	reg_prst = core->platform->data.reg_prst_tbl;
+	prst_count = core->platform->data.reg_prst_tbl_size;
+
+	/* skip if there is no preset reg available */
+	if (!reg_prst || !prst_count)
+		return 0;
+
+	for (cnt = 0; cnt < prst_count; cnt++) {
+		rc = __write_register_masked(core, reg_prst[cnt].reg,
+				reg_prst[cnt].value, reg_prst[cnt].mask);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris2/inc/fixedpoint.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris2/inc/fixedpoint.h
@@ -0,0 +1,69 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifdef _FIXP_ARITH_H
+#error "This implementation is meant to override fixp-arith.h, don't use both"
+#endif
+
+#ifndef _FIXEDPOINT_H_
+#define _FIXEDPOINT_H_
+
+#include <linux/types.h>
+#include <linux/bits.h>
+
+/*
+ * Normally would typedef'ed, but checkpatch doesn't like typedef.
+ * Also should be normally typedef'ed to intmax_t but that doesn't seem to be
+ * available in the kernel
+ */
+#define fp_t size_t
+
+/* (Arbitrarily) make the first 25% of the bits to be the fractional bits */
+#define FP_FRACTIONAL_BITS ((sizeof(fp_t) * 8) / 4)
+
+#define FP(__i, __f_n, __f_d) \
+	((((fp_t)(__i)) << FP_FRACTIONAL_BITS) + \
+	(((__f_n) << FP_FRACTIONAL_BITS) / (__f_d)))
+
+#define FP_INT(__i) FP(__i, 0, 1)
+#define FP_ONE FP_INT(1)
+#define FP_ZERO FP_INT(0)
+
+static inline size_t fp_frac_base(void)
+{
+	return GENMASK(FP_FRACTIONAL_BITS - 1, 0);
+}
+
+static inline size_t fp_frac(fp_t a)
+{
+	return a & GENMASK(FP_FRACTIONAL_BITS - 1, 0);
+}
+
+static inline size_t fp_int(fp_t a)
+{
+	return a >> FP_FRACTIONAL_BITS;
+}
+
+static inline size_t fp_round(fp_t a)
+{
+	/* is the fractional part >= frac_max / 2? */
+	bool round_up = fp_frac(a) >= fp_frac_base() / 2;
+
+	return fp_int(a) + round_up;
+}
+
+static inline fp_t fp_mult(fp_t a, fp_t b)
+{
+	return (a * b) >> FP_FRACTIONAL_BITS;
+}
+
+
+static inline fp_t fp_div(fp_t a, fp_t b)
+{
+	return (a << FP_FRACTIONAL_BITS) / b;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris2/inc/hfi_buffer_iris2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris2/inc/hfi_buffer_iris2.h
@@ -0,0 +1,1458 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __HFI_BUFFER_IRIS2__
+#define __HFI_BUFFER_IRIS2__
+
+#include <linux/types.h>
+#include "hfi_property.h"
+
+typedef u8      HFI_U8;
+typedef s8      HFI_S8;
+typedef u16     HFI_U16;
+typedef s16     HFI_S16;
+typedef u32     HFI_U32;
+typedef s32     HFI_S32;
+typedef u64     HFI_U64;
+typedef HFI_U32 HFI_BOOL;
+
+#ifndef MIN
+#define  MIN(x, y) (((x) < (y)) ? (x) : (y))
+#endif
+
+#ifndef MAX
+#define  MAX(x, y) (((x) > (y)) ? (x) : (y))
+#endif
+
+#define HFI_ALIGNMENT_4096 (4096)
+
+#define BUF_SIZE_ALIGN_16 (16)
+#define BUF_SIZE_ALIGN_32 (32)
+#define BUF_SIZE_ALIGN_64 (64)
+#define BUF_SIZE_ALIGN_128 (128)
+#define BUF_SIZE_ALIGN_256 (256)
+#define BUF_SIZE_ALIGN_512 (512)
+#define BUF_SIZE_ALIGN_4096 (4096)
+
+#define HFI_ALIGN(a, b) (((b) & ((b) - 1)) ? (((a) + (b) - 1) / \
+	(b) * (b)) : (((a) + (b) - 1) & (~((b) - 1))))
+
+#define HFI_WORKMODE_1 1
+#define HFI_WORKMODE_2 2
+
+#define HFI_DEFAULT_METADATA_STRIDE_MULTIPLE (64)
+#define HFI_DEFAULT_METADATA_BUFFERHEIGHT_MULTIPLE (16)
+
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT (8)
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH (32)
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_HEIGHT (8)
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_WIDTH (16)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_HEIGHT (4)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_WIDTH (48)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_HEIGHT (4)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_WIDTH (24)
+#define HFI_COLOR_FORMAT_RGBA8888_UBWC_TILE_HEIGHT (4)
+#define HFI_COLOR_FORMAT_RGBA8888_UBWC_TILE_WIDTH (16)
+
+#define HFI_NV12_IL_CALC_Y_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width, stride_multiple))
+
+#define HFI_NV12_IL_CALC_Y_BUFHEIGHT(buf_height, frame_height, \
+	min_buf_height_multiple) (buf_height = HFI_ALIGN(frame_height, \
+	min_buf_height_multiple))
+
+#define HFI_NV12_IL_CALC_UV_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width, stride_multiple))
+
+#define HFI_NV12_IL_CALC_UV_BUFHEIGHT(buf_height, frame_height, \
+	min_buf_height_multiple) (buf_height = HFI_ALIGN(((frame_height + 1) \
+	 >> 1),	min_buf_height_multiple))
+
+#define HFI_NV12_IL_CALC_BUF_SIZE(buf_size, y_bufSize, y_stride, y_buf_height, \
+	uv_buf_size, uv_stride, uv_buf_height) \
+	do { \
+		y_bufSize = (y_stride * y_buf_height); \
+		uv_buf_size = (uv_stride * uv_buf_height); \
+		buf_size = HFI_ALIGN(y_bufSize + uv_buf_size, HFI_ALIGNMENT_4096); \
+	} while (0)
+
+#define HFI_NV12_UBWC_IL_CALC_Y_BUF_SIZE(y_bufSize, y_stride, y_buf_height) \
+	(y_bufSize = HFI_ALIGN(y_stride * y_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_NV12_UBWC_IL_CALC_UV_BUF_SIZE(uv_buf_size, \
+	uv_stride, uv_buf_height) \
+	(uv_buf_size = HFI_ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_NV12_UBWC_IL_CALC_BUF_SIZE_V2(buf_size,\
+	frame_width, frame_height, y_stride_multiple,\
+	y_buffer_height_multiple, uv_stride_multiple, \
+	uv_buffer_height_multiple, y_metadata_stride_multiple, \
+	y_metadata_buffer_height_multiple, \
+	uv_metadata_stride_multiple, uv_metadata_buffer_height_multiple) \
+	do { \
+		HFI_U32 y_buf_size, uv_buf_size, y_meta_size, uv_meta_size;   \
+		HFI_U32 stride, _height; \
+		HFI_U32 half_height = (frame_height + 1) >> 1; \
+		HFI_NV12_IL_CALC_Y_STRIDE(stride, frame_width,\
+					y_stride_multiple); \
+		HFI_NV12_IL_CALC_Y_BUFHEIGHT(_height, half_height,\
+					y_buffer_height_multiple); \
+		HFI_NV12_UBWC_IL_CALC_Y_BUF_SIZE(y_buf_size, stride, _height);\
+		HFI_NV12_IL_CALC_UV_STRIDE(stride, frame_width, \
+					uv_stride_multiple); \
+		HFI_NV12_IL_CALC_UV_BUFHEIGHT(_height, half_height, \
+					uv_buffer_height_multiple); \
+		HFI_NV12_UBWC_IL_CALC_UV_BUF_SIZE(uv_buf_size, stride, _height);\
+		HFI_UBWC_CALC_METADATA_PLANE_STRIDE(stride, frame_width,\
+				y_metadata_stride_multiple, \
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH);\
+		HFI_UBWC_METADATA_PLANE_BUFHEIGHT(_height, half_height, \
+				y_metadata_buffer_height_multiple,\
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT);\
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(y_meta_size, stride, \
+				_height);    \
+		HFI_UBWC_UV_METADATA_PLANE_STRIDE(stride, frame_width,\
+				uv_metadata_stride_multiple, \
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_WIDTH); \
+		HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(_height, half_height,\
+				uv_metadata_buffer_height_multiple,\
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_HEIGHT);\
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(uv_meta_size, stride, \
+				 _height); \
+		buf_size = (y_buf_size + uv_buf_size + y_meta_size + \
+			uv_meta_size) << 1;\
+	} while (0)
+
+#define HFI_YUV420_TP10_CALC_Y_STRIDE(stride, frame_width, stride_multiple) \
+	do { \
+		stride = HFI_ALIGN(frame_width, 192); \
+		stride = HFI_ALIGN(stride * 4 / 3, stride_multiple); \
+	} while (0)
+
+#define HFI_YUV420_TP10_CALC_Y_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(frame_height, min_buf_height_multiple))
+
+#define HFI_YUV420_TP10_CALC_UV_STRIDE(stride, frame_width, stride_multiple) \
+	do { \
+		stride = HFI_ALIGN(frame_width, 192); \
+		stride = HFI_ALIGN(stride * 4 / 3, stride_multiple); \
+	} while (0)
+
+#define HFI_YUV420_TP10_CALC_UV_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(((frame_height + 1) >> 1), \
+			min_buf_height_multiple))
+
+#define HFI_YUV420_TP10_CALC_BUF_SIZE(buf_size, y_buf_size, y_stride,\
+		y_buf_height, uv_buf_size, uv_stride, uv_buf_height) \
+	do { \
+		y_buf_size = (y_stride * y_buf_height); \
+		uv_buf_size = (uv_stride * uv_buf_height); \
+		buf_size = y_buf_size + uv_buf_size; \
+	} while (0)
+
+#define HFI_YUV420_TP10_UBWC_CALC_Y_BUF_SIZE(y_buf_size, y_stride, \
+					y_buf_height) \
+	(y_buf_size = HFI_ALIGN(y_stride * y_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_YUV420_TP10_UBWC_CALC_UV_BUF_SIZE(uv_buf_size, uv_stride, \
+					uv_buf_height) \
+	(uv_buf_size = HFI_ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_YUV420_TP10_UBWC_CALC_BUF_SIZE(buf_size, y_stride, y_buf_height, \
+	uv_stride, uv_buf_height, y_md_stride, y_md_height, uv_md_stride, \
+	uv_md_height)\
+	do { \
+		HFI_U32 y_data_size, uv_data_size, y_md_size, uv_md_size; \
+		HFI_YUV420_TP10_UBWC_CALC_Y_BUF_SIZE(y_data_size, y_stride,\
+						y_buf_height); \
+		HFI_YUV420_TP10_UBWC_CALC_UV_BUF_SIZE(uv_data_size, uv_stride, \
+						uv_buf_height); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(y_md_size, y_md_stride, \
+						y_md_height); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(uv_md_size, uv_md_stride, \
+						uv_md_height); \
+		buf_size = y_data_size + uv_data_size + y_md_size + \
+						uv_md_size; \
+	} while (0)
+
+#define HFI_YUV420_P010_CALC_Y_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width * 2, stride_multiple))
+
+#define HFI_YUV420_P010_CALC_Y_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(frame_height, min_buf_height_multiple))
+
+#define HFI_YUV420_P010_CALC_UV_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width * 2, stride_multiple))
+
+#define HFI_YUV420_P010_CALC_UV_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(((frame_height + 1) >> 1), \
+			min_buf_height_multiple))
+
+#define HFI_YUV420_P010_CALC_BUF_SIZE(buf_size, y_data_size, y_stride, \
+	y_buf_height, uv_data_size, uv_stride, uv_buf_height) \
+	do { \
+		y_data_size = HFI_ALIGN(y_stride * y_buf_height, \
+				HFI_ALIGNMENT_4096);\
+		uv_data_size = HFI_ALIGN(uv_stride * uv_buf_height, \
+				HFI_ALIGNMENT_4096); \
+		buf_size = y_data_size + uv_data_size; \
+	} while (0)
+
+#define HFI_RGB888_CALC_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = ((frame_width * 3) + stride_multiple - 1) & \
+			 (0xffffffff - (stride_multiple - 1)))
+
+#define HFI_RGB888_CALC_BUFHEIGHT(buf_height, frame_height, \
+			min_buf_height_multiple) \
+	(buf_height = ((frame_height + min_buf_height_multiple - 1) & \
+			(0xffffffff - (min_buf_height_multiple - 1))))
+
+#define HFI_RGB888_CALC_BUF_SIZE(buf_size, stride, buf_height) \
+	(buf_size = ((stride) * (buf_height)))
+
+#define HFI_RGBA8888_CALC_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN((frame_width << 2), stride_multiple))
+
+#define HFI_RGBA8888_CALC_BUFHEIGHT(buf_height, frame_height, \
+			min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(frame_height, min_buf_height_multiple))
+
+#define HFI_RGBA8888_CALC_BUF_SIZE(buf_size, stride, buf_height) \
+	(buf_size = (stride) * (buf_height))
+
+#define HFI_RGBA8888_UBWC_CALC_DATA_PLANE_BUF_SIZE(buf_size, stride, \
+				buf_height) \
+	(buf_size = HFI_ALIGN((stride) * (buf_height), HFI_ALIGNMENT_4096))
+
+#define HFI_RGBA8888_UBWC_BUF_SIZE(buf_size, data_buf_size, \
+	metadata_buffer_size, stride, buf_height, _metadata_tride, \
+	_metadata_buf_height) \
+	do { \
+		HFI_RGBA8888_UBWC_CALC_DATA_PLANE_BUF_SIZE(data_buf_size, \
+				stride, buf_height); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(metadata_buffer_size, \
+				_metadata_tride, _metadata_buf_height); \
+		buf_size = data_buf_size + metadata_buffer_size; \
+	} while (0)
+
+#define HFI_UBWC_CALC_METADATA_PLANE_STRIDE(metadata_stride, frame_width,\
+	metadata_stride_multiple, tile_width_in_pels) \
+	(metadata_stride = HFI_ALIGN(((frame_width + (tile_width_in_pels - 1)) /\
+	tile_width_in_pels), metadata_stride_multiple))
+
+#define HFI_UBWC_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, frame_height, \
+	metadata_height_multiple, tile_height_in_pels) \
+	(metadata_buf_height = HFI_ALIGN(((frame_height + \
+	(tile_height_in_pels - 1)) / tile_height_in_pels), \
+	metadata_height_multiple))
+
+#define HFI_UBWC_UV_METADATA_PLANE_STRIDE(metadata_stride, frame_width, \
+	metadata_stride_multiple, tile_width_in_pels) \
+	(metadata_stride = HFI_ALIGN(((((frame_width + 1) >> 1) +\
+	(tile_width_in_pels - 1)) / tile_width_in_pels), \
+	metadata_stride_multiple))
+
+#define HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, frame_height,\
+	metadata_height_multiple, tile_height_in_pels) \
+	(metadata_buf_height = HFI_ALIGN(((((frame_height + 1) >> 1) + \
+	(tile_height_in_pels - 1)) / tile_height_in_pels), \
+	metadata_height_multiple))
+
+#define HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(buffer_size, _metadata_tride, \
+					_metadata_buf_height) \
+	(buffer_size = HFI_ALIGN(_metadata_tride * _metadata_buf_height, \
+					HFI_ALIGNMENT_4096))
+
+#define BUFFER_ALIGNMENT_512_BYTES 512
+#define BUFFER_ALIGNMENT_256_BYTES 256
+#define BUFFER_ALIGNMENT_128_BYTES 128
+#define BUFFER_ALIGNMENT_64_BYTES 64
+#define BUFFER_ALIGNMENT_32_BYTES 32
+#define BUFFER_ALIGNMENT_16_BYTES 16
+#define BUFFER_ALIGNMENT_8_BYTES 8
+#define BUFFER_ALIGNMENT_4_BYTES 4
+
+#define VENUS_DMA_ALIGNMENT BUFFER_ALIGNMENT_256_BYTES
+
+#define MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE 640
+#define MAX_FE_NBR_DATA_CB_LINE_BUFFER_SIZE 320
+#define MAX_FE_NBR_DATA_CR_LINE_BUFFER_SIZE 320
+
+#define MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE (128 / 8)
+
+#define MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE (64 * 2 * 3)
+#define MAX_PE_NBR_DATA_LCU32_LINE_BUFFER_SIZE (32 * 2 * 3)
+#define MAX_PE_NBR_DATA_LCU16_LINE_BUFFER_SIZE (16 * 2 * 3)
+
+#define MAX_TILE_COLUMNS 32
+
+#define SIZE_VPSS_LB(Size, frame_width, frame_height, num_vpp_pipes) \
+	do { \
+		HFI_U32 vpss_4tap_top_buffer_size, vpss_div2_top_buffer_size, \
+		vpss_4tap_left_buffer_size, vpss_div2_left_buffer_size; \
+		HFI_U32 opb_wr_top_line_luma_buffer_size, \
+		opb_wr_top_line_chroma_buffer_size, \
+		opb_lb_wr_llb_y_buffer_size,\
+		opb_lb_wr_llb_uv_buffer_size; \
+		HFI_U32 macrotiling_size; \
+		vpss_4tap_top_buffer_size = vpss_div2_top_buffer_size = \
+		vpss_4tap_left_buffer_size = vpss_div2_left_buffer_size = 0; \
+		macrotiling_size = 32; \
+		opb_wr_top_line_luma_buffer_size = HFI_ALIGN(frame_width, \
+			macrotiling_size) / macrotiling_size * 256; \
+			opb_wr_top_line_luma_buffer_size = \
+		HFI_ALIGN(opb_wr_top_line_luma_buffer_size, \
+		VENUS_DMA_ALIGNMENT) + (MAX_TILE_COLUMNS - 1) * 256; \
+		opb_wr_top_line_luma_buffer_size = \
+		MAX(opb_wr_top_line_luma_buffer_size, (32 * \
+			HFI_ALIGN(frame_height, 8))); \
+		opb_wr_top_line_chroma_buffer_size = \
+			opb_wr_top_line_luma_buffer_size;\
+		opb_lb_wr_llb_uv_buffer_size = opb_lb_wr_llb_y_buffer_size = \
+			HFI_ALIGN((HFI_ALIGN(frame_height, 8) / (4 / 2)) * 64,\
+					   BUFFER_ALIGNMENT_32_BYTES); \
+		Size = num_vpp_pipes * 2 * (vpss_4tap_top_buffer_size +  \
+						vpss_div2_top_buffer_size) +  \
+			   2 * (vpss_4tap_left_buffer_size + \
+					vpss_div2_left_buffer_size) + \
+			   opb_wr_top_line_luma_buffer_size + \
+			   opb_wr_top_line_chroma_buffer_size + \
+			   opb_lb_wr_llb_uv_buffer_size + \
+			   opb_lb_wr_llb_y_buffer_size; \
+	} while (0)
+
+#define VPP_CMD_MAX_SIZE (1 << 20)
+#define NUM_HW_PIC_BUF 32
+#define BIN_BUFFER_THRESHOLD (1280 * 736)
+#define H264D_MAX_SLICE 1800
+#define SIZE_H264D_BUFTAB_T (256)
+#define SIZE_H264D_HW_PIC_T (1 << 11)
+#define SIZE_H264D_BSE_CMD_PER_BUF (32 * 4)
+#define SIZE_H264D_VPP_CMD_PER_BUF (512)
+
+#define SIZE_H264D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	(MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE * HFI_ALIGN(frame_width, 16) * 3)
+
+#define SIZE_H264D_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4))
+
+#define SIZE_H264D_LB_FE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4))
+
+#define SIZE_H264D_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	(MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4))
+
+#define SIZE_H264D_LB_SE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4))
+
+#define SIZE_H264D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	(MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE *  ((frame_width + 15) >> 4))
+
+#define SIZE_H264D_LB_VSP_TOP(frame_width, frame_height) \
+	((((frame_width + 15) >> 4) << 7))
+
+#define SIZE_H264D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	(HFI_ALIGN(frame_height, 16) * 32)
+
+#define SIZE_H264D_QP(frame_width, frame_height) \
+	(((frame_width + 63) >> 6) * ((frame_height + 63) >> 6) * 128)
+
+#define SIZE_HW_PIC(size_per_buf) \
+	(NUM_HW_PIC_BUF * size_per_buf)
+
+#define SIZE_H264D_BSE_CMD_BUF(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 _height = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_32_BYTES);  \
+		_size = MIN((((_height + 15) >> 4) * 48), H264D_MAX_SLICE) *\
+					  SIZE_H264D_BSE_CMD_PER_BUF; \
+	} while (0)
+
+#define SIZE_H264D_VPP_CMD_BUF(_size, frame_width, frame_height)    \
+	do { \
+		HFI_U32 _height = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_32_BYTES); \
+		_size = MIN((((_height + 15) >> 4) * 48), H264D_MAX_SLICE) * \
+					SIZE_H264D_VPP_CMD_PER_BUF; \
+		if (_size > VPP_CMD_MAX_SIZE) { \
+			_size = VPP_CMD_MAX_SIZE; \
+		} \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H264D(coMV_size, frame_width, \
+			frame_height, _yuv_bufcount_min) \
+	do { \
+		HFI_U32 frame_width_in_mbs = ((frame_width + 15) >> 4); \
+		HFI_U32 frame_height_in_mbs = ((frame_height + 15) >> 4); \
+		HFI_U32 col_mv_aligned_width = (frame_width_in_mbs << 7); \
+		HFI_U32 col_zero_aligned_width = (frame_width_in_mbs << 2); \
+		HFI_U32 col_zero_size = 0, size_colloc = 0; \
+		col_mv_aligned_width = HFI_ALIGN(col_mv_aligned_width, \
+					BUFFER_ALIGNMENT_16_BYTES); \
+		col_zero_aligned_width = HFI_ALIGN(col_zero_aligned_width, \
+					BUFFER_ALIGNMENT_16_BYTES); \
+		col_zero_size = col_zero_aligned_width * \
+					((frame_height_in_mbs + 1) >> 1); \
+		col_zero_size = HFI_ALIGN(col_zero_size, \
+				BUFFER_ALIGNMENT_64_BYTES);  \
+		col_zero_size <<= 1; \
+		col_zero_size = HFI_ALIGN(col_zero_size, \
+				BUFFER_ALIGNMENT_512_BYTES); \
+		size_colloc = col_mv_aligned_width * ((frame_height_in_mbs + \
+				1) >> 1); \
+		size_colloc = HFI_ALIGN(size_colloc, \
+				BUFFER_ALIGNMENT_64_BYTES); \
+		size_colloc <<= 1; \
+		size_colloc = HFI_ALIGN(size_colloc, \
+				BUFFER_ALIGNMENT_512_BYTES); \
+		size_colloc += (col_zero_size + SIZE_H264D_BUFTAB_T * 2); \
+		coMV_size = size_colloc * (_yuv_bufcount_min); \
+		coMV_size += BUFFER_ALIGNMENT_512_BYTES; \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_H264D(_size, frame_width, frame_height, \
+								num_vpp_pipes) \
+	do { \
+		HFI_U32 _size_bse, _size_vpp; \
+		SIZE_H264D_BSE_CMD_BUF(_size_bse, frame_width, frame_height); \
+		SIZE_H264D_VPP_CMD_BUF(_size_vpp, frame_width, frame_height); \
+		_size = HFI_ALIGN(_size_bse, VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(_size_vpp, VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_HW_PIC(SIZE_H264D_HW_PIC_T), \
+			VENUS_DMA_ALIGNMENT); \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H264D(_size, frame_width, frame_height, \
+							  is_opb, num_vpp_pipes)            \
+	do { \
+		HFI_U32 vpss_lb_size = 0; \
+		_size = HFI_ALIGN(SIZE_H264D_LB_FE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_FE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_FE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H264D_LB_SE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_SE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * \
+			num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H264D_LB_PE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_VSP_TOP(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_RECON_DMA_METADATA_WR\
+			(frame_width, frame_height), \
+			VENUS_DMA_ALIGNMENT) * 2 + HFI_ALIGN(SIZE_H264D_QP\
+			(frame_width, frame_height), VENUS_DMA_ALIGNMENT); \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height, \
+						num_vpp_pipes); \
+		} \
+		_size = HFI_ALIGN((_size + vpss_lb_size), \
+			VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define H264_CABAC_HDR_RATIO_HD_TOT 1
+#define H264_CABAC_RES_RATIO_HD_TOT 3
+
+#define SIZE_H264D_HW_BIN_BUFFER(_size, frame_width, frame_height, \
+				delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 size_yuv, size_bin_hdr, size_bin_res; \
+		size_yuv = ((frame_width * frame_height) <= \
+			BIN_BUFFER_THRESHOLD) ?\
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) : \
+			((frame_width * frame_height * 3) >> 1); \
+		size_bin_hdr = size_yuv * H264_CABAC_HDR_RATIO_HD_TOT; \
+		size_bin_res = size_yuv * H264_CABAC_RES_RATIO_HD_TOT; \
+		size_bin_hdr = size_bin_hdr * (((((HFI_U32)(delay)) & 31) /\
+				10) + 2) / 2; \
+		size_bin_res = size_bin_res * (((((HFI_U32)(delay)) & 31) /\
+				10) + 2) / 2; \
+		size_bin_hdr = HFI_ALIGN(size_bin_hdr / num_vpp_pipes,\
+				VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		size_bin_res = HFI_ALIGN(size_bin_res / num_vpp_pipes, \
+			VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		_size = size_bin_hdr + size_bin_res; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H264D(_size, frame_width, frame_height, is_interlaced, \
+			delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 n_aligned_w = HFI_ALIGN(frame_width, \
+				BUFFER_ALIGNMENT_16_BYTES);\
+		HFI_U32 n_aligned_h = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_16_BYTES); \
+		if (!is_interlaced)  { \
+			SIZE_H264D_HW_BIN_BUFFER(_size, n_aligned_w, \
+				n_aligned_h, delay, num_vpp_pipes); \
+		} else { \
+			_size = 0;  \
+		} \
+	} while (0)
+
+#define NUM_SLIST_BUF_H264 (256 + 32)
+#define SIZE_SLIST_BUF_H264 (512)
+#define SIZE_SEI_USERDATA (4096)
+#define H264_NUM_FRM_INFO (66)
+#define H264_DISPLAY_BUF_SIZE (3328)
+#define SIZE_DOLBY_RPU_METADATA (41 * 1024)
+#define HFI_BUFFER_PERSIST_H264D(_size, rpu_enabled) \
+	(_size = HFI_ALIGN((SIZE_SLIST_BUF_H264 * NUM_SLIST_BUF_H264 + \
+	H264_DISPLAY_BUF_SIZE * H264_NUM_FRM_INFO + \
+	NUM_HW_PIC_BUF * SIZE_SEI_USERDATA + \
+	(rpu_enabled) * NUM_HW_PIC_BUF * SIZE_DOLBY_RPU_METADATA), \
+	VENUS_DMA_ALIGNMENT))
+
+#define LCU_MAX_SIZE_PELS 64
+#define LCU_MIN_SIZE_PELS 16
+
+#define H265D_MAX_SLICE 1200
+#define SIZE_H265D_HW_PIC_T SIZE_H264D_HW_PIC_T
+#define SIZE_H265D_BSE_CMD_PER_BUF (16 * sizeof(HFI_U32))
+#define SIZE_H265D_VPP_CMD_PER_BUF (256)
+
+#define SIZE_H265D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	(MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE * \
+	(HFI_ALIGN(frame_width, 64) + 8) * 2)
+
+#define SIZE_H265D_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * \
+	(HFI_ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS))
+
+#define SIZE_H265D_LB_FE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * \
+	(HFI_ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS))
+
+#define SIZE_H265D_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	((LCU_MAX_SIZE_PELS / 8 * (128 / 8)) * ((frame_width + 15) >> 4))
+
+#define SIZE_H265D_LB_SE_LEFT_CTRL(frame_width, frame_height)    \
+	(MAX(((frame_height + 16 - 1) / 8) * \
+		MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,     \
+	MAX(((frame_height + 32 - 1) / 8) * \
+		MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 64 - 1) / 8) * \
+		MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE)))
+
+#define SIZE_H265D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	(MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE * (HFI_ALIGN(frame_width, \
+	LCU_MIN_SIZE_PELS) / LCU_MIN_SIZE_PELS))
+
+#define SIZE_H265D_LB_VSP_TOP(frame_width, frame_height) \
+	(((frame_width + 63) >> 6) * 128)
+
+#define SIZE_H265D_LB_VSP_LEFT(frame_width, frame_height) \
+	(((frame_height + 63) >> 6) * 128)
+
+#define SIZE_H265D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	SIZE_H264D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height)
+
+#define SIZE_H265D_QP(frame_width, frame_height) \
+		SIZE_H264D_QP(frame_width, frame_height)
+
+#define SIZE_H265D_BSE_CMD_BUF(_size, frame_width, frame_height)\
+	do { \
+		_size = HFI_ALIGN(((HFI_ALIGN(frame_width, \
+		LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS) * \
+		(HFI_ALIGN(frame_height, LCU_MAX_SIZE_PELS) /\
+		LCU_MIN_SIZE_PELS)) * NUM_HW_PIC_BUF, VENUS_DMA_ALIGNMENT);  \
+		_size = MIN(_size, H265D_MAX_SLICE + 1);          \
+		_size = 2 * _size * SIZE_H265D_BSE_CMD_PER_BUF;     \
+	} while (0)
+
+#define SIZE_H265D_VPP_CMD_BUF(_size, frame_width, frame_height)  \
+	do { \
+		_size = HFI_ALIGN(((HFI_ALIGN(frame_width, LCU_MAX_SIZE_PELS) /\
+		LCU_MIN_SIZE_PELS) * (HFI_ALIGN(frame_height, \
+		LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS)) * \
+		NUM_HW_PIC_BUF, VENUS_DMA_ALIGNMENT);  \
+		_size = MIN(_size, H265D_MAX_SLICE + 1);    \
+		_size = HFI_ALIGN(_size, 4);  \
+		_size = 2 * _size * SIZE_H265D_VPP_CMD_PER_BUF; \
+		if (_size > VPP_CMD_MAX_SIZE) { \
+			_size = VPP_CMD_MAX_SIZE;   \
+		}                          \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H265D(_size, frame_width, frame_height, \
+							_yuv_bufcount_min) \
+	do { \
+		_size = HFI_ALIGN(((((frame_width + 15) >> 4) * \
+			((frame_height + 15) >> 4)) << 8), \
+			BUFFER_ALIGNMENT_512_BYTES); \
+		_size *= _yuv_bufcount_min; \
+		_size += BUFFER_ALIGNMENT_512_BYTES; \
+	} while (0)
+
+#define HDR10_HIST_EXTRADATA_SIZE (4 * 1024)
+
+#define HFI_BUFFER_NON_COMV_H265D(_size, frame_width, frame_height, \
+				num_vpp_pipes) \
+	do { \
+		HFI_U32 _size_bse, _size_vpp; \
+		SIZE_H265D_BSE_CMD_BUF(_size_bse, frame_width, \
+		frame_height); \
+		SIZE_H265D_VPP_CMD_BUF(_size_vpp, frame_width, \
+		frame_height);  \
+		_size = HFI_ALIGN(_size_bse, VENUS_DMA_ALIGNMENT) +     \
+			HFI_ALIGN(_size_vpp, VENUS_DMA_ALIGNMENT) +     \
+			HFI_ALIGN(NUM_HW_PIC_BUF * 20 * 22 * 4, \
+			VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(2 * sizeof(HFI_U16) *           \
+			(HFI_ALIGN(frame_width, LCU_MAX_SIZE_PELS) / \
+			LCU_MIN_SIZE_PELS) * (HFI_ALIGN(frame_height, \
+			LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS), \
+			VENUS_DMA_ALIGNMENT) +                \
+			HFI_ALIGN(SIZE_HW_PIC(SIZE_H265D_HW_PIC_T), \
+			VENUS_DMA_ALIGNMENT) + \
+			HDR10_HIST_EXTRADATA_SIZE;           \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT);  \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H265D(_size, frame_width, frame_height, \
+			is_opb, num_vpp_pipes) \
+	do { \
+		HFI_U32 vpss_lb_size = 0; \
+		_size = HFI_ALIGN(SIZE_H265D_LB_FE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_FE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_FE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H265D_LB_SE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H265D_LB_SE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_PE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_VSP_TOP(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) +        \
+			HFI_ALIGN(SIZE_H265D_LB_VSP_LEFT(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H265D_LB_RECON_DMA_METADATA_WR\
+			(frame_width, frame_height), \
+			VENUS_DMA_ALIGNMENT) * 4 +  \
+			HFI_ALIGN(SIZE_H265D_QP(frame_width, frame_height),\
+			VENUS_DMA_ALIGNMENT);           \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height,\
+						 num_vpp_pipes); \
+		} \
+		_size = HFI_ALIGN((_size + vpss_lb_size), \
+			VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define H265_CABAC_HDR_RATIO_HD_TOT 2
+#define H265_CABAC_RES_RATIO_HD_TOT 2
+
+#define SIZE_H265D_HW_BIN_BUFFER(_size, frame_width, frame_height, \
+				delay, num_vpp_pipes)    \
+	do { \
+		HFI_U32 size_yuv, size_bin_hdr, size_bin_res;     \
+		size_yuv = ((frame_width * frame_height) <= \
+			BIN_BUFFER_THRESHOLD) ? \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) : \
+			((frame_width * frame_height * 3) >> 1); \
+		size_bin_hdr = size_yuv * H265_CABAC_HDR_RATIO_HD_TOT;    \
+		size_bin_res = size_yuv * H265_CABAC_RES_RATIO_HD_TOT;   \
+		size_bin_hdr = size_bin_hdr * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2;    \
+		size_bin_res = size_bin_res * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2;    \
+		size_bin_hdr = HFI_ALIGN(size_bin_hdr / \
+			num_vpp_pipes, VENUS_DMA_ALIGNMENT) * \
+			num_vpp_pipes;  \
+		size_bin_res = HFI_ALIGN(size_bin_res / num_vpp_pipes,\
+			VENUS_DMA_ALIGNMENT) * num_vpp_pipes;  \
+		_size = size_bin_hdr + size_bin_res;    \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H265D(_size, frame_width, frame_height, \
+				is_interlaced, delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 n_aligned_w = HFI_ALIGN(frame_width, \
+				BUFFER_ALIGNMENT_16_BYTES); \
+		HFI_U32 n_aligned_h = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_16_BYTES); \
+		if (!is_interlaced) { \
+			SIZE_H265D_HW_BIN_BUFFER(_size, n_aligned_w, \
+			n_aligned_h, delay, num_vpp_pipes); \
+		} else { \
+			_size = 0; \
+		} \
+	} while (0)
+
+#define SIZE_SLIST_BUF_H265 (1 << 10)
+#define NUM_SLIST_BUF_H265 (80 + 20)
+#define H265_NUM_TILE_COL 32
+#define H265_NUM_TILE_ROW 128
+#define H265_NUM_TILE (H265_NUM_TILE_ROW * H265_NUM_TILE_COL + 1)
+#define H265_NUM_FRM_INFO (48)
+#define H265_DISPLAY_BUF_SIZE (3072)
+#define HFI_BUFFER_PERSIST_H265D(_size, rpu_enabled) \
+	(_size = HFI_ALIGN((SIZE_SLIST_BUF_H265 * NUM_SLIST_BUF_H265 + \
+	H265_NUM_FRM_INFO * H265_DISPLAY_BUF_SIZE + \
+	H265_NUM_TILE * sizeof(HFI_U32) + NUM_HW_PIC_BUF * SIZE_SEI_USERDATA + \
+	(rpu_enabled) * NUM_HW_PIC_BUF * SIZE_DOLBY_RPU_METADATA),\
+	VENUS_DMA_ALIGNMENT))
+
+#define SIZE_VPXD_LB_FE_LEFT_CTRL(frame_width, frame_height)   \
+	MAX(((frame_height + 15) >> 4) * \
+	MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE, \
+	MAX(((frame_height + 31) >> 5) * \
+	MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 63) >> 6) * MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE))
+#define SIZE_VPXD_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(((HFI_ALIGN(frame_width, 64) + 8) * 10 * 2))
+#define SIZE_VPXD_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	(((frame_width + 15) >> 4) * MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE)
+#define SIZE_VPXD_LB_SE_LEFT_CTRL(frame_width, frame_height)  \
+	MAX(((frame_height + 15) >> 4) * \
+	MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,\
+	MAX(((frame_height + 31) >> 5) * \
+	MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 63) >> 6) * MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE))
+#define SIZE_VPXD_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	HFI_ALIGN((HFI_ALIGN(frame_height, 8) / (4 / 2)) * 64,\
+	BUFFER_ALIGNMENT_32_BYTES)
+#define SIZE_MP2D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(frame_width, 16) + 8) * 10 * 2)
+#define SIZE_VP9D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(HFI_ALIGN(frame_width, 8), 64) + 8) * 10 * 2)
+#define SIZE_MP2D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(frame_width, 16) >> 4) * 64)
+#define SIZE_VP9D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(HFI_ALIGN(frame_width, 8), 64) >> 6) * 176)
+#define SIZE_MP2D_LB_VSP_TOP(frame_width, frame_height) \
+	(((HFI_ALIGN(frame_width, 16) >> 4) * 64 / 2) + 256)
+#define SIZE_VP9D_LB_VSP_TOP(frame_width, frame_height) \
+	((((HFI_ALIGN(HFI_ALIGN(frame_width, 8), 64) >> 6) * 64 * 8) + 256))
+
+#define HFI_IRIS2_VP9D_COMV_SIZE \
+	((((8192 + 63) >> 6) * ((4320 + 63) >> 6) * 8 * 8 * 2 * 8))
+
+#define SIZE_VP9D_QP(frame_width, frame_height) \
+	SIZE_H264D_QP(frame_width, frame_height)
+
+#define HFI_IRIS2_VP9D_LB_SIZE(_size, frame_width, frame_height, num_vpp_pipes)\
+	do { \
+		_size = HFI_ALIGN(SIZE_VPXD_LB_FE_LEFT_CTRL(frame_width, \
+		frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_LEFT_CTRL(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_VP9D_LB_VSP_TOP(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VPXD_LB_FE_TOP_CTRL(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + 2 * \
+		HFI_ALIGN(SIZE_VPXD_LB_RECON_DMA_METADATA_WR \
+		(frame_width, frame_height), VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_TOP_CTRL(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VP9D_LB_PE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VP9D_LB_FE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VP9D_QP(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_VP9D(_size, frame_width, frame_height, \
+		_yuv_bufcount_min, is_opb, num_vpp_pipes) \
+	do { \
+		HFI_U32 _lb_size = 0;                  \
+		HFI_U32 vpss_lb_size = 0;              \
+		HFI_IRIS2_VP9D_LB_SIZE(_lb_size, frame_width, frame_height,\
+			num_vpp_pipes);             \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height, \
+			num_vpp_pipes); \
+		} \
+		_size = _lb_size + vpss_lb_size; \
+	} while (0)
+
+#define VPX_DECODER_FRAME_CONCURENCY_LVL (2)
+#define VPX_DECODER_FRAME_BIN_HDR_BUDGET_RATIO 1 / 2
+#define VPX_DECODER_FRAME_BIN_RES_BUDGET_RATIO 3 / 2
+
+#define HFI_BUFFER_BIN_VP9D(_size, frame_width, frame_height, \
+				is_interlaced, num_vpp_pipes) \
+	do { \
+		HFI_U32 _size_yuv = HFI_ALIGN(frame_width, \
+		BUFFER_ALIGNMENT_16_BYTES) *\
+		HFI_ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES) * 3 / 2;  \
+		if (!is_interlaced) { \
+			_size = HFI_ALIGN(((MAX(_size_yuv, \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1)) * \
+			VPX_DECODER_FRAME_BIN_HDR_BUDGET_RATIO * \
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes), \
+			VENUS_DMA_ALIGNMENT) + HFI_ALIGN(((MAX(_size_yuv, \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1)) * \
+			VPX_DECODER_FRAME_BIN_RES_BUDGET_RATIO * \
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes), \
+			VENUS_DMA_ALIGNMENT);  \
+			_size = _size * num_vpp_pipes;   \
+		}              \
+		else \
+			_size = 0;     \
+	} while (0)
+
+#define VP9_NUM_FRAME_INFO_BUF 32
+#define VP9_NUM_PROBABILITY_TABLE_BUF (VP9_NUM_FRAME_INFO_BUF + 4)
+#define VP9_PROB_TABLE_SIZE (3840)
+#define VP9_FRAME_INFO_BUF_SIZE (6144)
+
+#define VP9_UDC_HEADER_BUF_SIZE (3 * 128)
+#define MAX_SUPERFRAME_HEADER_LEN (34)
+#define CCE_TILE_OFFSET_SIZE HFI_ALIGN(32 * 4 * 4, BUFFER_ALIGNMENT_32_BYTES)
+
+#define HFI_BUFFER_PERSIST_VP9D(_size) \
+	(_size = HFI_ALIGN(VP9_NUM_PROBABILITY_TABLE_BUF * VP9_PROB_TABLE_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(HFI_IRIS2_VP9D_COMV_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(MAX_SUPERFRAME_HEADER_LEN, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(VP9_UDC_HEADER_BUF_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(VP9_NUM_FRAME_INFO_BUF * \
+	CCE_TILE_OFFSET_SIZE, VENUS_DMA_ALIGNMENT) + \
+	HFI_ALIGN(VP9_NUM_FRAME_INFO_BUF * VP9_FRAME_INFO_BUF_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HDR10_HIST_EXTRADATA_SIZE)
+
+#define HFI_BUFFER_LINE_MP2D(_size, frame_width, frame_height, \
+_yuv_bufcount_min, is_opb, num_vpp_pipes)           \
+	do { \
+		HFI_U32 vpss_lb_size = 0;     \
+		_size = HFI_ALIGN(SIZE_VPXD_LB_FE_LEFT_CTRL(frame_width, \
+		frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_LEFT_CTRL(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_MP2D_LB_VSP_TOP(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) + HFI_ALIGN(SIZE_VPXD_LB_FE_TOP_CTRL\
+		(frame_width, frame_height), VENUS_DMA_ALIGNMENT) + \
+		2 * HFI_ALIGN(SIZE_VPXD_LB_RECON_DMA_METADATA_WR(frame_width,\
+		frame_height), VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_TOP_CTRL(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_MP2D_LB_PE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_MP2D_LB_FE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT); \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height, \
+						num_vpp_pipes); \
+		} \
+		_size += vpss_lb_size; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_MP2D(_size, frame_width, frame_height, is_interlaced) 0
+
+#define QMATRIX_SIZE (sizeof(HFI_U32) * 128 + 256)
+#define MP2D_QPDUMP_SIZE 115200
+#define HFI_BUFFER_PERSIST_MP2D(_size) \
+	(_size = QMATRIX_SIZE + MP2D_QPDUMP_SIZE;)
+
+#define HFI_BUFFER_BITSTREAM_ENC(size, frame_width, frame_height, \
+			rc_type, is_ten_bit) \
+	do { \
+		HFI_U32 aligned_width, aligned_height, bitstream_size; \
+		aligned_width = HFI_ALIGN(frame_width, 32); \
+		aligned_height = HFI_ALIGN(frame_height, 32); \
+		bitstream_size = aligned_width * aligned_height * 3; \
+		if (aligned_width * aligned_height > (4096 * 2176)) { \
+			bitstream_size = (bitstream_size >> 3); \
+		} \
+		else if (bitstream_size > (1280 * 720)) { \
+			bitstream_size = (bitstream_size >> 2); \
+		} else { \
+			bitstream_size = (bitstream_size << 1);\
+		} \
+		if ((rc_type == HFI_RC_CQ) || (rc_type == HFI_RC_OFF))  { \
+			bitstream_size = (bitstream_size << 1);\
+		} \
+		if (is_ten_bit) { \
+			bitstream_size = (bitstream_size) + \
+					(bitstream_size >> 2); \
+		} \
+		size = HFI_ALIGN(bitstream_size, HFI_ALIGNMENT_4096); \
+	} while (0)
+
+#define SIZE_ROI_METADATA_ENC(size_roi, frame_width, frame_height, lcu_size)\
+	do { \
+		HFI_U32 width_in_lcus = 0, height_in_lcus = 0, n_shift = 0;    \
+		HFI_U32 n_lcu_size = lcu_size;              \
+		while (n_lcu_size && !(n_lcu_size & 0x1)) { \
+			n_shift++;                          \
+			n_lcu_size = n_lcu_size >> 1;       \
+		}                                           \
+		width_in_lcus = (frame_width + (lcu_size - 1)) >> n_shift; \
+		height_in_lcus = (frame_height + (lcu_size - 1)) >> n_shift;  \
+		size_roi = (((width_in_lcus + 7) >> 3) << 3) * \
+					height_in_lcus * 2 + 256; \
+	} while (0)
+
+#define HFI_BUFFER_INPUT_METADATA_ENC(size, frame_width, frame_height, \
+				is_roi_enabled, lcu_size) \
+	do { \
+		HFI_U32 roi_size = 0; \
+		if (is_roi_enabled) { \
+			SIZE_ROI_METADATA_ENC(roi_size, frame_width, \
+				frame_height, lcu_size); \
+		} \
+		size = roi_size + 16384; \
+		size = HFI_ALIGN(size, HFI_ALIGNMENT_4096); \
+	} while (0)
+
+#define HFI_BUFFER_INPUT_METADATA_H264E(size_metadata, frame_width, \
+		frame_height, is_roi_enabled)    \
+	do { \
+		HFI_BUFFER_INPUT_METADATA_ENC(size_metadata, frame_width, \
+			frame_height, is_roi_enabled, 16); \
+	} while (0)
+
+#define HFI_BUFFER_INPUT_METADATA_H265E(size_metadata, frame_width, \
+		frame_height, is_roi_enabled)    \
+	do { \
+		HFI_BUFFER_INPUT_METADATA_ENC(size_metadata, frame_width, \
+			frame_height, is_roi_enabled, 32); \
+	} while (0)
+
+#define HFI_BUFFER_ARP_ENC(size) \
+	do { \
+		size = 204800; \
+	} while (0)
+
+#define HFI_MAX_COL_FRAME 6
+#define HFI_VENUS_VENC_TRE_WB_BUFF_SIZE (65 << 4) // bytes
+#define HFI_VENUS_VENC_DB_LINE_BUFF_PER_MB 512
+#define HFI_VENUS_VPPSG_MAX_REGISTERS 2048
+#define HFI_VENUS_WIDTH_ALIGNMENT 128
+#define HFI_VENUS_WIDTH_TEN_BIT_ALIGNMENT 192
+#define HFI_VENUS_HEIGHT_ALIGNMENT 32
+#define VENUS_METADATA_STRIDE_MULTIPLE 64
+#define VENUS_METADATA_HEIGHT_MULTIPLE 16
+
+#ifndef SYSTEM_LAL_TILE10
+#define SYSTEM_LAL_TILE10 192
+#endif
+
+#define HFI_IRIS2_ENC_RECON_BUF_COUNT(num_recon, n_bframe, ltr_count, \
+	_total_hp_layers, _total_hb_layers, hybrid_hp, codec_standard) \
+	do { \
+		HFI_U32 num_ref = 1; \
+		if (n_bframe) \
+			num_ref = 2; \
+		if (_total_hp_layers > 1) { \
+			if (hybrid_hp) \
+				num_ref = (_total_hp_layers + 1) >> 1; \
+			else if (codec_standard == HFI_CODEC_ENCODE_HEVC) \
+				num_ref = (_total_hp_layers + 1) >> 1; \
+			else if (codec_standard == HFI_CODEC_ENCODE_AVC && \
+				_total_hp_layers < 4) \
+				num_ref = (_total_hp_layers - 1);  \
+			else \
+				num_ref = _total_hp_layers; \
+		} \
+		if (ltr_count) \
+			num_ref = num_ref + ltr_count; \
+		if (_total_hb_layers > 1) { \
+			if (codec_standard == HFI_CODEC_ENCODE_HEVC) \
+				num_ref = (_total_hb_layers); \
+			else if (codec_standard == HFI_CODEC_ENCODE_AVC) \
+				num_ref = (1 << (_total_hb_layers - 2)) + 1; \
+		} \
+		num_recon = num_ref + 1; \
+	} while (0)
+
+#define SIZE_BIN_BITSTREAM_ENC(_size, rc_type, frame_width, frame_height, \
+		work_mode, lcu_size) \
+	do { \
+		HFI_U32 size_aligned_width = 0, size_aligned_height = 0; \
+		HFI_U32 bitstream_size_eval = 0; \
+		size_aligned_width = HFI_ALIGN((frame_width), lcu_size); \
+		size_aligned_height = HFI_ALIGN((frame_height), lcu_size); \
+		if (work_mode == HFI_WORKMODE_2) { \
+			if ((rc_type == HFI_RC_CQ) || (rc_type == HFI_RC_OFF)) { \
+				bitstream_size_eval = (((size_aligned_width) * \
+							(size_aligned_height) * 3) >> 1); \
+			} \
+			else { \
+				bitstream_size_eval = ((size_aligned_width) * \
+							(size_aligned_height) * 3); \
+				if (rc_type == HFI_RC_LOSSLESS) { \
+					bitstream_size_eval = (bitstream_size_eval * 3 >> 2); \
+				} \
+				else if ((size_aligned_width * size_aligned_height) > \
+					(4096 * 2176)) { \
+					bitstream_size_eval >>= 3; \
+				} \
+				else if ((size_aligned_width * size_aligned_height) > \
+					(480 * 320)) { \
+					bitstream_size_eval >>= 2; \
+				} \
+				if (lcu_size == 32) { \
+					bitstream_size_eval = (bitstream_size_eval * 5 >> 2); \
+				} \
+			} \
+		} else { \
+			bitstream_size_eval = size_aligned_width * \
+					size_aligned_height * 3; \
+		} \
+		_size = HFI_ALIGN(bitstream_size_eval, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define SIZE_ENC_SINGLE_PIPE(size, rc_type, bitbin_size, num_vpp_pipes, \
+			frame_width, frame_height, lcu_size) \
+	do { \
+		HFI_U32 size_single_pipe_eval = 0, sao_bin_buffer_size = 0, \
+			_padded_bin_sz = 0; \
+		HFI_U32 size_aligned_width = 0, size_aligned_height = 0; \
+		size_aligned_width = HFI_ALIGN((frame_width), lcu_size); \
+		size_aligned_height = HFI_ALIGN((frame_height), lcu_size); \
+		if ((size_aligned_width * size_aligned_height) > \
+			(3840 * 2160)) { \
+			size_single_pipe_eval = (bitbin_size / num_vpp_pipes); \
+		} \
+		else if (num_vpp_pipes > 2) { \
+			size_single_pipe_eval = bitbin_size / 2; \
+		} else { \
+			size_single_pipe_eval = bitbin_size; \
+		} \
+		if (rc_type == HFI_RC_LOSSLESS) { \
+			size_single_pipe_eval = (size_single_pipe_eval << 1); \
+		} \
+		sao_bin_buffer_size = (64 * ((((frame_width) + \
+				BUFFER_ALIGNMENT_32_BYTES) * ((frame_height) +\
+				BUFFER_ALIGNMENT_32_BYTES)) >> 10)) + 384; \
+		_padded_bin_sz = HFI_ALIGN(size_single_pipe_eval, \
+				VENUS_DMA_ALIGNMENT);\
+		size_single_pipe_eval = sao_bin_buffer_size + _padded_bin_sz; \
+		size_single_pipe_eval = HFI_ALIGN(size_single_pipe_eval, \
+				VENUS_DMA_ALIGNMENT); \
+		size = size_single_pipe_eval; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_ENC(_size, rc_type, frame_width, frame_height, lcu_size, \
+				work_mode, num_vpp_pipes)           \
+	do { \
+		HFI_U32 bitstream_size = 0, total_bitbin_buffers = 0, \
+			size_single_pipe = 0, bitbin_size = 0; \
+		SIZE_BIN_BITSTREAM_ENC(bitstream_size, rc_type, frame_width, \
+			frame_height, work_mode, lcu_size);         \
+		if (work_mode == HFI_WORKMODE_2) { \
+			total_bitbin_buffers = 3; \
+			bitbin_size = bitstream_size * 17 / 10; \
+			bitbin_size = HFI_ALIGN(bitbin_size, \
+				VENUS_DMA_ALIGNMENT); \
+		} \
+		else if ((lcu_size == 16) || (num_vpp_pipes > 1)) { \
+			total_bitbin_buffers = 1; \
+			bitbin_size = bitstream_size; \
+		} \
+		if (total_bitbin_buffers > 0) { \
+			SIZE_ENC_SINGLE_PIPE(size_single_pipe, rc_type, bitbin_size, \
+				num_vpp_pipes, frame_width, frame_height, lcu_size); \
+			bitbin_size = size_single_pipe * num_vpp_pipes; \
+			_size = HFI_ALIGN(bitbin_size, VENUS_DMA_ALIGNMENT) * \
+					total_bitbin_buffers + 512; \
+		} else { \
+			/* Avoid 512 Bytes allocation in case of 1Pipe HEVC Direct Mode*/ \
+			_size = 0; \
+			} \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H264E(_size, rc_type, frame_width, frame_height, \
+				work_mode, num_vpp_pipes)    \
+	do { \
+		HFI_BUFFER_BIN_ENC(_size, rc_type, frame_width, frame_height, 16, \
+				work_mode, num_vpp_pipes); \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H265E(_size, rc_type, frame_width, frame_height, \
+				work_mode, num_vpp_pipes)    \
+	do { \
+		HFI_BUFFER_BIN_ENC(_size, rc_type, frame_width, frame_height, 32,\
+				work_mode, num_vpp_pipes); \
+	} while (0)
+
+#define SIZE_ENC_SLICE_INFO_BUF(num_lcu_in_frame) HFI_ALIGN((256 + \
+		(num_lcu_in_frame << 4)), VENUS_DMA_ALIGNMENT)
+#define SIZE_LINE_BUF_CTRL(frame_width_coded) \
+		HFI_ALIGN(frame_width_coded, VENUS_DMA_ALIGNMENT)
+#define SIZE_LINE_BUF_CTRL_ID2(frame_width_coded) \
+		HFI_ALIGN(frame_width_coded, VENUS_DMA_ALIGNMENT)
+
+#define SIZE_LINEBUFF_DATA(_size, is_ten_bit, frame_width_coded) \
+	do { \
+		_size = is_ten_bit ? (((((10 * (frame_width_coded) +\
+		 1024) + (VENUS_DMA_ALIGNMENT - 1)) & \
+		 (~(VENUS_DMA_ALIGNMENT - 1))) * 1) + \
+		(((((10 * (frame_width_coded) + 1024) >> 1) + \
+		(VENUS_DMA_ALIGNMENT - 1)) & (~(VENUS_DMA_ALIGNMENT - 1))) * \
+		2)) : (((((8 * (frame_width_coded) + 1024) + \
+		(VENUS_DMA_ALIGNMENT - 1)) \
+		& (~(VENUS_DMA_ALIGNMENT - 1))) * 1) + \
+		(((((8 * (frame_width_coded) +\
+		1024) >> 1) + (VENUS_DMA_ALIGNMENT - 1)) & \
+		(~(VENUS_DMA_ALIGNMENT - 1))) * 2)); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_CTRL(_size, standard, frame_height_coded, \
+				num_vpp_pipes_enc) \
+	do { \
+		_size = (standard == HFI_CODEC_ENCODE_HEVC) ? \
+			(((frame_height_coded) + \
+			(BUF_SIZE_ALIGN_32)) / BUF_SIZE_ALIGN_32 * 4 * 16) : \
+			(((frame_height_coded) + 15) / 16 * 5 * 16); \
+		if ((num_vpp_pipes_enc) > 1) { \
+			_size += BUFFER_ALIGNMENT_512_BYTES; \
+			_size = HFI_ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) *\
+				(num_vpp_pipes_enc); \
+		} \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_RECON_PIX(_size, is_ten_bit, frame_height_coded, \
+				num_vpp_pipes_enc) \
+	do { \
+		_size = (((is_ten_bit + 1) * 2 * (frame_height_coded) + \
+		VENUS_DMA_ALIGNMENT) + \
+		(VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1) & \
+		(~((VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1)) * 1; \
+	} while (0)
+
+#define SIZE_TOP_LINEBUFF_CTRL_FE(_size, frame_width_coded, standard) \
+	do { \
+		_size = (standard == HFI_CODEC_ENCODE_HEVC) ? (64 * \
+		((frame_width_coded) >> 5)) : (VENUS_DMA_ALIGNMENT + 16 * \
+		((frame_width_coded) >> 4)); \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_CTRL_FE(frame_height_coded, num_vpp_pipes_enc) \
+	((((VENUS_DMA_ALIGNMENT + 64 * ((frame_height_coded) >> 4)) +         \
+	   (VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1) &          \
+	  (~((VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1)) * 1) *  \
+	 num_vpp_pipes_enc)
+
+#define SIZE_LEFT_LINEBUFF_METADATA_RECON_Y(_size, frame_height_coded, \
+		is_ten_bit, num_vpp_pipes_enc) \
+	do { \
+		_size = ((VENUS_DMA_ALIGNMENT + 64 * ((frame_height_coded) / \
+		(8 * (is_ten_bit ? 4 : 8)))));   \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+		_size = (_size * num_vpp_pipes_enc); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_METADATA_RECON_UV(_size, frame_height_coded, \
+			is_ten_bit, num_vpp_pipes_enc) \
+	do { \
+		_size = ((VENUS_DMA_ALIGNMENT + 64 * ((frame_height_coded) / \
+				(4 * (is_ten_bit ? 4 : 8)))));    \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+		_size = (_size * num_vpp_pipes_enc); \
+	} while (0)
+
+#define SIZE_LINEBUFF_RECON_PIX(_size, is_ten_bit, frame_width_coded) \
+	do   { \
+		_size = ((is_ten_bit ? 3 : 2) * (frame_width_coded));         \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT);             \
+	} while (0)
+
+#define SIZE_SLICE_CMD_BUFFER (HFI_ALIGN(20480, VENUS_DMA_ALIGNMENT))
+#define SIZE_SPS_PPS_SLICE_HDR (2048 + 4096)
+
+#define SIZE_FRAME_RC_BUF_SIZE(_size, standard, frame_height_coded, \
+			num_vpp_pipes_enc) \
+	do { \
+		_size = (standard == HFI_CODEC_ENCODE_HEVC) ? (256 + 16 * \
+			(14 + ((((frame_height_coded) >> 5) + 7) >> 3))) : \
+			(256 + 16 * (14 + ((((frame_height_coded) >> 4) + 7) >> 3))); \
+		_size *= 11; \
+		if (num_vpp_pipes_enc > 1) { \
+			_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT) * \
+					num_vpp_pipes_enc;\
+		} \
+		_size = HFI_ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) * \
+				HFI_MAX_COL_FRAME; \
+	} while (0)
+
+#define ENC_BITCNT_BUF_SIZE(num_lcu_in_frame) HFI_ALIGN((256 + \
+		(4 * (num_lcu_in_frame))), VENUS_DMA_ALIGNMENT)
+#define ENC_BITMAP_BUF_SIZE(num_lcu_in_frame) HFI_ALIGN((256 + \
+		((num_lcu_in_frame) >> 3)), VENUS_DMA_ALIGNMENT)
+#define SIZE_LINE_BUF_SDE(frame_width_coded) HFI_ALIGN((256 + \
+		(16 * ((frame_width_coded) >> 4))), VENUS_DMA_ALIGNMENT)
+
+#define SIZE_BSE_SLICE_CMD_BUF ((((8192 << 2) + 7) & (~7)) * 3)
+
+#define SIZE_LAMBDA_LUT (256 * 11)
+#define SIZE_OVERRIDE_BUF(num_lcumb) (HFI_ALIGN(((16 * (((num_lcumb) + 7)\
+		>> 3))), VENUS_DMA_ALIGNMENT) * 2)
+#define SIZE_IR_BUF(num_lcu_in_frame) HFI_ALIGN((((((num_lcu_in_frame) << 1) + 7) &\
+	(~7)) * 3), VENUS_DMA_ALIGNMENT)
+
+#define SIZE_VPSS_LINE_BUF(num_vpp_pipes_enc, frame_height_coded, \
+			frame_width_coded) \
+	(HFI_ALIGN(((((((8192) >> 2) << 5) * (num_vpp_pipes_enc)) + 64) + \
+	(((((MAX((frame_width_coded), (frame_height_coded)) + 3) >> 2) << 5) +\
+	256) * 16)), VENUS_DMA_ALIGNMENT))
+
+#define SIZE_TOP_LINE_BUF_FIRST_STG_SAO(frame_width_coded) \
+	HFI_ALIGN((16 * ((frame_width_coded) >> 5)), VENUS_DMA_ALIGNMENT)
+
+#define HFI_BUFFER_LINE_ENC(_size, frame_width, frame_height, is_ten_bit, \
+			num_vpp_pipes_enc, lcu_size, standard) \
+	do { \
+		HFI_U32 width_in_lcus = 0, height_in_lcus = 0, \
+			frame_width_coded = 0, frame_height_coded = 0; \
+		HFI_U32 line_buff_data_size = 0, left_line_buff_ctrl_size = 0, \
+			left_line_buff_recon_pix_size = 0, \
+			top_line_buff_ctrl_fe_size = 0; \
+		HFI_U32 left_line_buff_metadata_recon__y__size = 0, \
+			left_line_buff_metadata_recon__uv__size = 0, \
+			line_buff_recon_pix_size = 0;          \
+		width_in_lcus = ((frame_width) + (lcu_size)-1) / (lcu_size); \
+		height_in_lcus = ((frame_height) + (lcu_size)-1) / (lcu_size); \
+		frame_width_coded = width_in_lcus * (lcu_size); \
+		frame_height_coded = height_in_lcus * (lcu_size); \
+		SIZE_LINEBUFF_DATA(line_buff_data_size, is_ten_bit, \
+			frame_width_coded);\
+		SIZE_LEFT_LINEBUFF_CTRL(left_line_buff_ctrl_size, standard, \
+			frame_height_coded, num_vpp_pipes_enc); \
+		SIZE_LEFT_LINEBUFF_RECON_PIX(left_line_buff_recon_pix_size, \
+			is_ten_bit, frame_height_coded, num_vpp_pipes_enc); \
+		SIZE_TOP_LINEBUFF_CTRL_FE(top_line_buff_ctrl_fe_size, \
+			frame_width_coded, standard); \
+		SIZE_LEFT_LINEBUFF_METADATA_RECON_Y\
+			(left_line_buff_metadata_recon__y__size, \
+			frame_height_coded, is_ten_bit, num_vpp_pipes_enc); \
+		SIZE_LEFT_LINEBUFF_METADATA_RECON_UV\
+			(left_line_buff_metadata_recon__uv__size, \
+			frame_height_coded, is_ten_bit, num_vpp_pipes_enc); \
+		SIZE_LINEBUFF_RECON_PIX(line_buff_recon_pix_size, is_ten_bit,\
+			frame_width_coded); \
+		_size = SIZE_LINE_BUF_CTRL(frame_width_coded) + \
+			SIZE_LINE_BUF_CTRL_ID2(frame_width_coded) + \
+			line_buff_data_size + \
+			left_line_buff_ctrl_size + \
+			left_line_buff_recon_pix_size + \
+			top_line_buff_ctrl_fe_size + \
+			left_line_buff_metadata_recon__y__size + \
+			left_line_buff_metadata_recon__uv__size + \
+			line_buff_recon_pix_size + \
+		SIZE_LEFT_LINEBUFF_CTRL_FE(frame_height_coded, \
+			num_vpp_pipes_enc) + SIZE_LINE_BUF_SDE(frame_width_coded) + \
+		SIZE_VPSS_LINE_BUF(num_vpp_pipes_enc, frame_height_coded, \
+			frame_width_coded) + \
+		SIZE_TOP_LINE_BUF_FIRST_STG_SAO(frame_width_coded); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H264E(_size, frame_width, frame_height, is_ten_bit, \
+		num_vpp_pipes)                   \
+	do { \
+		HFI_BUFFER_LINE_ENC(_size, frame_width, frame_height, 0, \
+			num_vpp_pipes, 16, HFI_CODEC_ENCODE_AVC); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H265E(_size, frame_width, frame_height, is_ten_bit, \
+			num_vpp_pipes)                          \
+	do { \
+		HFI_BUFFER_LINE_ENC(_size, frame_width, frame_height, \
+		is_ten_bit, num_vpp_pipes, 32, HFI_CODEC_ENCODE_HEVC); \
+	} while (0)
+
+#define HFI_BUFFER_COMV_ENC(_size, frame_width, frame_height, lcu_size, \
+			num_recon, standard) \
+	do { \
+		HFI_U32 size_colloc_mv = 0, size_colloc_rc = 0; \
+		HFI_U32 mb_width = ((frame_width) + 15) >> 4; \
+		HFI_U32 mb_height = ((frame_height) + 15) >> 4; \
+		HFI_U32 width_in_lcus = ((frame_width) + (lcu_size)-1) /\
+					(lcu_size); \
+		HFI_U32 height_in_lcus = ((frame_height) + (lcu_size)-1) / \
+					(lcu_size); \
+		HFI_U32 num_lcu_in_frame = width_in_lcus * height_in_lcus; \
+		size_colloc_mv = (standard == HFI_CODEC_ENCODE_HEVC) ? \
+		(16 * ((num_lcu_in_frame << 2) + BUFFER_ALIGNMENT_32_BYTES)) : \
+		(3 * 16 * (width_in_lcus * height_in_lcus +\
+		BUFFER_ALIGNMENT_32_BYTES)); \
+		size_colloc_mv = HFI_ALIGN(size_colloc_mv, \
+		VENUS_DMA_ALIGNMENT) * num_recon; \
+		size_colloc_rc = (((mb_width + 7) >> 3) * 16 * 2 * mb_height); \
+		size_colloc_rc = HFI_ALIGN(size_colloc_rc, \
+		VENUS_DMA_ALIGNMENT) * HFI_MAX_COL_FRAME; \
+		_size = size_colloc_mv + size_colloc_rc; \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H264E(_size, frame_width, frame_height, num_recon) \
+	do { \
+		HFI_BUFFER_COMV_ENC(_size, frame_width, frame_height, 16, \
+			num_recon, HFI_CODEC_ENCODE_AVC); \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H265E(_size, frame_width, frame_height, num_recon) \
+	do { \
+		HFI_BUFFER_COMV_ENC(_size, frame_width, frame_height, 32,\
+			num_recon, HFI_CODEC_ENCODE_HEVC); \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_ENC(_size, frame_width, frame_height, \
+			num_vpp_pipes_enc, lcu_size, standard) \
+	do { \
+		HFI_U32 width_in_lcus = 0, height_in_lcus = 0, \
+		frame_width_coded = 0, frame_height_coded = 0, \
+		num_lcu_in_frame = 0, num_lcumb = 0; \
+		HFI_U32	frame_rc_buf_size = 0; \
+		width_in_lcus = ((frame_width) + (lcu_size)-1) / (lcu_size); \
+		height_in_lcus = ((frame_height) + (lcu_size)-1) / (lcu_size); \
+		num_lcu_in_frame = width_in_lcus * height_in_lcus; \
+		frame_width_coded = width_in_lcus * (lcu_size); \
+		frame_height_coded = height_in_lcus * (lcu_size); \
+		num_lcumb = (frame_height_coded / lcu_size) * \
+		((frame_width_coded + lcu_size * 8) / lcu_size); \
+		SIZE_FRAME_RC_BUF_SIZE(frame_rc_buf_size, standard, \
+		frame_height_coded, num_vpp_pipes_enc); \
+		_size = SIZE_ENC_SLICE_INFO_BUF(num_lcu_in_frame) + \
+			   SIZE_SLICE_CMD_BUFFER + \
+			   SIZE_SPS_PPS_SLICE_HDR + \
+			   frame_rc_buf_size + \
+			   ENC_BITCNT_BUF_SIZE(num_lcu_in_frame) + \
+			   ENC_BITMAP_BUF_SIZE(num_lcu_in_frame) + \
+			   SIZE_BSE_SLICE_CMD_BUF + \
+			   SIZE_LAMBDA_LUT + \
+			   SIZE_OVERRIDE_BUF(num_lcumb) + \
+			   SIZE_IR_BUF(num_lcu_in_frame); \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_H264E(_size, frame_width, frame_height, \
+				num_vpp_pipes_enc) \
+	do { \
+		HFI_BUFFER_NON_COMV_ENC(_size, frame_width, frame_height, \
+				num_vpp_pipes_enc, 16, HFI_CODEC_ENCODE_AVC); \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_H265E(_size, frame_width, frame_height, \
+				num_vpp_pipes_enc) \
+	do { \
+		HFI_BUFFER_NON_COMV_ENC(_size, frame_width, frame_height, \
+			num_vpp_pipes_enc, 32, HFI_CODEC_ENCODE_HEVC); \
+	} while (0)
+
+#define SIZE_ENC_REF_BUFFER(size, frame_width, frame_height) \
+	do { \
+		HFI_U32 u_buffer_width = 0, u_buffer_height = 0, \
+			u_chroma_buffer_height = 0; \
+		u_buffer_height = HFI_ALIGN(frame_height, \
+			HFI_VENUS_HEIGHT_ALIGNMENT); \
+		u_chroma_buffer_height = frame_height >> 1; \
+		u_chroma_buffer_height = HFI_ALIGN(u_chroma_buffer_height, \
+			HFI_VENUS_HEIGHT_ALIGNMENT); \
+		u_buffer_width = HFI_ALIGN(frame_width, \
+			HFI_VENUS_WIDTH_ALIGNMENT); \
+		size = (u_buffer_height + u_chroma_buffer_height) * \
+			u_buffer_width; \
+	} while (0)
+
+#define SIZE_ENC_TEN_BIT_REF_BUFFER(size, frame_width, frame_height) \
+	do { \
+		HFI_U32 ref_buf_height = 0, ref_luma_stride_in_bytes = 0, \
+		u_ref_stride = 0, luma_size = 0, ref_chrm_height_in_bytes = 0, \
+		chroma_size = 0, ref_buf_size = 0; \
+		ref_buf_height = (frame_height + \
+		(HFI_VENUS_HEIGHT_ALIGNMENT - 1)) \
+		& (~(HFI_VENUS_HEIGHT_ALIGNMENT - 1)); \
+		ref_luma_stride_in_bytes = ((frame_width + \
+		SYSTEM_LAL_TILE10 - 1) / SYSTEM_LAL_TILE10) * \
+		SYSTEM_LAL_TILE10; \
+		u_ref_stride = 4 * (ref_luma_stride_in_bytes / 3); \
+		u_ref_stride = (u_ref_stride + (BUF_SIZE_ALIGN_128 - 1)) &\
+			(~(BUF_SIZE_ALIGN_128 - 1)); \
+		luma_size = ref_buf_height * u_ref_stride; \
+		ref_chrm_height_in_bytes = (((frame_height + 1) >> 1) + \
+			(BUF_SIZE_ALIGN_32 - 1)) & (~(BUF_SIZE_ALIGN_32 - 1)); \
+		chroma_size = u_ref_stride * ref_chrm_height_in_bytes; \
+		luma_size = (luma_size + (BUF_SIZE_ALIGN_4096 - 1)) & \
+			(~(BUF_SIZE_ALIGN_4096 - 1)); \
+		chroma_size = (chroma_size + (BUF_SIZE_ALIGN_4096 - 1)) & \
+			(~(BUF_SIZE_ALIGN_4096 - 1)); \
+		ref_buf_size = luma_size + chroma_size; \
+		size = ref_buf_size; \
+	} while (0)
+
+#define HFI_BUFFER_DPB_ENC(_size, frame_width, frame_height, is_ten_bit) \
+	do { \
+		HFI_U32 metadata_stride, metadata_buf_height, meta_size_y, \
+			meta_size_c; \
+		HFI_U32 ten_bit_ref_buf_size = 0, ref_buf_size = 0; \
+		if (!is_ten_bit) { \
+			SIZE_ENC_REF_BUFFER(ref_buf_size, frame_width, \
+				frame_height); \
+			HFI_UBWC_CALC_METADATA_PLANE_STRIDE(metadata_stride, \
+				(frame_width), 64, \
+				HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH); \
+			HFI_UBWC_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, \
+				(frame_height), 16, \
+				HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_y, \
+				metadata_stride, metadata_buf_height); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_c, \
+				metadata_stride, metadata_buf_height); \
+			_size = ref_buf_size + meta_size_y + meta_size_c; \
+		} else { \
+			SIZE_ENC_TEN_BIT_REF_BUFFER(ten_bit_ref_buf_size, \
+				frame_width, frame_height); \
+			HFI_UBWC_CALC_METADATA_PLANE_STRIDE(metadata_stride, \
+				frame_width, VENUS_METADATA_STRIDE_MULTIPLE, \
+			HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_WIDTH); \
+			HFI_UBWC_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, \
+				frame_height, VENUS_METADATA_HEIGHT_MULTIPLE, \
+			HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_HEIGHT); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_y, \
+				metadata_stride, metadata_buf_height); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_c, \
+				metadata_stride, metadata_buf_height); \
+			_size = ten_bit_ref_buf_size + meta_size_y + \
+				meta_size_c; \
+		} \
+	} while (0)
+
+#define HFI_BUFFER_DPB_H264E(_size, frame_width, frame_height) \
+	do { \
+		HFI_BUFFER_DPB_ENC(_size, frame_width, frame_height, 0); \
+	} while (0)
+
+#define HFI_BUFFER_DPB_H265E(_size, frame_width, frame_height, is_ten_bit) \
+	do { \
+		HFI_BUFFER_DPB_ENC(_size, frame_width, frame_height, is_ten_bit); \
+	} while (0)
+
+#define HFI_BUFFER_VPSS_ENC(vpss_size, dswidth, dsheight, ds_enable, blur, is_ten_bit) \
+	do { \
+		vpss_size = 0; \
+		if (ds_enable || blur) { \
+			HFI_BUFFER_DPB_ENC(vpss_size, dswidth, dsheight, is_ten_bit); \
+		} \
+	} while (0)
+
+#define HFI_IRIS2_ENC_MIN_INPUT_BUF_COUNT(numInput, TotalHBLayers) \
+	do { \
+		numInput = 3;                                             \
+		if (TotalHBLayers >= 2) { \
+			numInput = (1 << (TotalHBLayers - 1)) + 2;        \
+		}                                                         \
+	} while (0)
+
+#endif /* __HFI_BUFFER_IRIS2__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris2/inc/msm_vidc_buffer_iris2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris2/inc/msm_vidc_buffer_iris2.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_MSM_VIDC_BUFFER_IRIS2_H__
+#define __H_MSM_VIDC_BUFFER_IRIS2_H__
+
+#include "msm_vidc_inst.h"
+
+int msm_buffer_size_iris2(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type);
+int msm_buffer_min_count_iris2(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type);
+int msm_buffer_extra_count_iris2(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type);
+
+#endif // __H_MSM_VIDC_BUFFER_IRIS2_H__
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris2/inc/msm_vidc_bus.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris2/inc/msm_vidc_bus.h
@@ -0,0 +1,187 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_MSM_VIDC_BUS_DEFS_H__
+#define __H_MSM_VIDC_BUS_DEFS_H__
+
+#include "fixedpoint.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_internal.h"
+
+#define COMPRESSION_RATIO_MAX 5
+
+/* converts Mbps to bps (the "b" part can be bits or bytes based on context) */
+#define kbps(__mbps) ((__mbps) * 1000)
+#define bps(__mbps) (kbps(__mbps) * 1000)
+
+#define GENERATE_COMPRESSION_PROFILE(__bpp, __worst) {              \
+	.bpp = __bpp,                                                          \
+	.ratio = __worst,                \
+}
+
+/*
+ * The below table is a structural representation of the following table:
+ *  Resolution |    Bitrate |              Compression Ratio          |
+ * ............|............|.........................................|
+ * Width Height|Average High|Avg_8bpc Worst_8bpc Avg_10bpc Worst_10bpc|
+ *  1280    720|      7   14|    1.69       1.28      1.49        1.23|
+ *  1920   1080|     20   40|    1.69       1.28      1.49        1.23|
+ *  2560   1440|     32   64|     2.2       1.26      1.97        1.22|
+ *  3840   2160|     42   84|     2.2       1.26      1.97        1.22|
+ *  4096   2160|     44   88|     2.2       1.26      1.97        1.22|
+ *  4096   2304|     48   96|     2.2       1.26      1.97        1.22|
+ */
+static struct lut {
+	int frame_size; /* width x height */
+	int frame_rate;
+	unsigned long bitrate;
+	struct {
+		int bpp;
+		fp_t ratio;
+	} compression_ratio[COMPRESSION_RATIO_MAX];
+} const LUT[] = {
+	{
+		.frame_size = 1280 * 720,
+		.frame_rate = 30,
+		.bitrate = 14,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 28, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 23, 100)),
+		}
+	},
+	{
+		.frame_size = 1280 * 720,
+		.frame_rate = 60,
+		.bitrate = 22,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 28, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 23, 100)),
+		}
+	},
+	{
+		.frame_size = 1920 * 1088,
+		.frame_rate = 30,
+		.bitrate = 40,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 28, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 23, 100)),
+		}
+	},
+	{
+		.frame_size = 1920 * 1088,
+		.frame_rate = 60,
+		.bitrate = 64,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 28, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 23, 100)),
+		}
+	},
+	{
+		.frame_size = 2560 * 1440,
+		.frame_rate = 30,
+		.bitrate = 64,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 2560 * 1440,
+		.frame_rate = 60,
+		.bitrate = 102,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 3840 * 2160,
+		.frame_rate = 30,
+		.bitrate = 84,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 3840 * 2160,
+		.frame_rate = 60,
+		.bitrate = 134,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 4096 * 2160,
+		.frame_rate = 30,
+		.bitrate = 88,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 4096 * 2160,
+		.frame_rate = 60,
+		.bitrate = 141,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 4096 * 2304,
+		.frame_rate = 30,
+		.bitrate = 96,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 4096 * 2304,
+		.frame_rate = 60,
+		.bitrate = 154,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+};
+
+#define DUMP_HEADER_MAGIC 0xdeadbeef
+#define DUMP_FP_FMT "%FP" /* special format for fp_t */
+
+struct lut const *__lut(int width, int height, int fps);
+fp_t __compression_ratio(struct lut const *entry, int bpp);
+
+
+#endif // __H_MSM_VIDC_BUS_DEFS_H__
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris2/inc/msm_vidc_iris2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris2/inc/msm_vidc_iris2.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_IRIS2_H_
+#define _MSM_VIDC_IRIS2_H_
+
+#include "msm_vidc_core.h"
+
+int msm_vidc_init_iris2(struct msm_vidc_core *core);
+int msm_vidc_adjust_blur_type_iris2(void *instance, struct v4l2_ctrl *ctrl);
+
+#endif // _MSM_VIDC_IRIS2_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris2/inc/msm_vidc_power_iris2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris2/inc/msm_vidc_power_iris2.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_MSM_VIDC_POWER_IRIS2_H__
+#define __H_MSM_VIDC_POWER_IRIS2_H__
+
+#include "msm_vidc_inst.h"
+#include "msm_vidc_power.h"
+
+u64 msm_vidc_calc_freq_iris2(struct msm_vidc_inst *inst, u32 data_size);
+int msm_vidc_calc_bw_iris2(struct msm_vidc_inst *inst,
+		struct vidc_bus_vote_data *vote_data);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris2/src/msm_vidc_buffer_iris2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris2/src/msm_vidc_buffer_iris2.c
@@ -0,0 +1,582 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "hfi_property.h"
+#include "hfi_buffer_iris2.h"
+#include "msm_vidc_buffer_iris2.h"
+#include "msm_vidc_buffer.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_media_info.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_debug.h"
+
+static u32 msm_vidc_decoder_bin_size_iris2(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes;
+	struct v4l2_format *f;
+	bool is_interlaced;
+	u32 vpp_delay;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	if (inst->decode_vpp_delay.enable)
+		vpp_delay = inst->decode_vpp_delay.size;
+	else
+		vpp_delay = DEFAULT_BSE_VPP_DELAY;
+	if (inst->capabilities[CODED_FRAMES].value ==
+			CODED_FRAMES_PROGRESSIVE)
+		is_interlaced = false;
+	else
+		is_interlaced = true;
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_BIN_H264D(size, width, height,
+			is_interlaced, vpp_delay, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_BIN_H265D(size, width, height,
+			0, vpp_delay, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_VP9)
+		HFI_BUFFER_BIN_VP9D(size, width, height,
+			0, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_comv_size_iris2(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, out_min_count, vpp_delay;
+	struct v4l2_format *f;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	if (inst->decode_vpp_delay.enable)
+		vpp_delay = inst->decode_vpp_delay.size;
+	else
+		vpp_delay = DEFAULT_BSE_VPP_DELAY;
+	out_min_count = inst->buffers.output.min_count;
+	out_min_count = max(vpp_delay + 1, out_min_count);
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_COMV_H264D(size, width, height, out_min_count);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_COMV_H265D(size, width, height, out_min_count);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_non_comv_size_iris2(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes;
+	struct msm_vidc_core *core;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_NON_COMV_H264D(size, width, height, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_NON_COMV_H265D(size, width, height, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_line_size_iris2(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, out_min_count, num_vpp_pipes, vpp_delay;
+	struct v4l2_format *f;
+	bool is_opb;
+	u32 color_fmt;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+
+	color_fmt = v4l2_colorformat_to_driver(inst,
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+	if (is_linear_colorformat(color_fmt))
+		is_opb = true;
+	else
+		is_opb = false;
+	/*
+	 * assume worst case, since color format is unknown at this
+	 * time
+	 */
+	is_opb = true;
+
+	if (inst->decode_vpp_delay.enable)
+		vpp_delay = inst->decode_vpp_delay.size;
+	else
+		vpp_delay = DEFAULT_BSE_VPP_DELAY;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	out_min_count = inst->buffers.output.min_count;
+	out_min_count = max(vpp_delay + 1, out_min_count);
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_LINE_H264D(size, width, height, is_opb,
+			num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_LINE_H265D(size, width, height, is_opb,
+			num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_VP9)
+		HFI_BUFFER_LINE_VP9D(size, width, height, out_min_count,
+			is_opb, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_persist_size_iris2(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 rpu_enabled = 0;
+
+	if (inst->capabilities[META_DOLBY_RPU].value)
+		rpu_enabled = 1;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_PERSIST_H264D(size, rpu_enabled);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_PERSIST_H265D(size, rpu_enabled);
+	else if (inst->codec == MSM_VIDC_VP9)
+		HFI_BUFFER_PERSIST_VP9D(size);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_dpb_size_iris2(struct msm_vidc_inst *inst)
+{
+
+	u32 color_fmt, width, height, size = 0;
+	struct v4l2_format *f;
+
+	color_fmt = inst->capabilities[PIX_FMTS].value;
+	if (!is_linear_colorformat(color_fmt))
+		return size;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (color_fmt == MSM_VIDC_FMT_NV12) {
+		color_fmt = MSM_VIDC_FMT_NV12C;
+		HFI_NV12_UBWC_IL_CALC_BUF_SIZE_V2(size, width, height,
+			video_y_stride_bytes(color_fmt, width),
+			video_y_scanlines(color_fmt, height),
+			video_uv_stride_bytes(color_fmt, width),
+			video_uv_scanlines(color_fmt, height),
+			video_y_meta_stride(color_fmt, width),
+			video_y_meta_scanlines(color_fmt, height),
+			video_uv_meta_stride(color_fmt, width),
+			video_uv_meta_scanlines(color_fmt, height));
+	} else if (color_fmt == MSM_VIDC_FMT_P010) {
+		color_fmt = MSM_VIDC_FMT_TP10C;
+		HFI_YUV420_TP10_UBWC_CALC_BUF_SIZE(size,
+			video_y_stride_bytes(color_fmt, width),
+			video_y_scanlines(color_fmt, height),
+			video_uv_stride_bytes(color_fmt, width),
+			video_uv_scanlines(color_fmt, height),
+			video_y_meta_stride(color_fmt, width),
+			video_y_meta_scanlines(color_fmt, height),
+			video_uv_meta_stride(color_fmt, width),
+			video_uv_meta_scanlines(color_fmt, height));
+	}
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+/* encoder internal buffers */
+static u32 msm_vidc_encoder_bin_size_iris2(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes, stage;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	stage = inst->capabilities[STAGE].value;
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_BIN_H264E(size, inst->hfi_rc_type, width,
+			height, stage, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_BIN_H265E(size, inst->hfi_rc_type, width,
+			height, stage, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_get_recon_buf_count(struct msm_vidc_inst *inst)
+{
+	u32 num_buf_recon = 0;
+	s32 n_bframe, ltr_count, hp_layers = 0, hb_layers = 0;
+	bool is_hybrid_hp = false;
+	u32 hfi_codec = 0;
+
+	n_bframe = inst->capabilities[B_FRAME].value;
+	ltr_count = inst->capabilities[LTR_COUNT].value;
+
+	if (inst->hfi_layer_type == HFI_HIER_B) {
+		hb_layers = inst->capabilities[ENH_LAYER_COUNT].value + 1;
+	} else {
+		hp_layers = inst->capabilities[ENH_LAYER_COUNT].value + 1;
+		if (inst->hfi_layer_type == HFI_HIER_P_HYBRID_LTR)
+			is_hybrid_hp = true;
+	}
+
+	if (inst->codec == MSM_VIDC_H264)
+		hfi_codec = HFI_CODEC_ENCODE_AVC;
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		hfi_codec = HFI_CODEC_ENCODE_HEVC;
+
+	HFI_IRIS2_ENC_RECON_BUF_COUNT(num_buf_recon, n_bframe, ltr_count,
+			hp_layers, hb_layers, is_hybrid_hp, hfi_codec);
+
+	return num_buf_recon;
+}
+
+static u32 msm_vidc_encoder_comv_size_iris2(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, num_recon = 0;
+	struct v4l2_format *f;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	num_recon = msm_vidc_get_recon_buf_count(inst);
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_COMV_H264E(size, width, height, num_recon);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_COMV_H265E(size, width, height, num_recon);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_non_comv_size_iris2(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_NON_COMV_H264E(size, width, height, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_NON_COMV_H265E(size, width, height, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_line_size_iris2(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, pixfmt, num_vpp_pipes;
+	bool is_tenbit = false;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	pixfmt = inst->capabilities[PIX_FMTS].value;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	is_tenbit = (pixfmt == MSM_VIDC_FMT_P010 || pixfmt == MSM_VIDC_FMT_TP10C);
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_LINE_H264E(size, width, height, is_tenbit, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_LINE_H265E(size, width, height, is_tenbit, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_dpb_size_iris2(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, pixfmt;
+	struct v4l2_format *f;
+	bool is_tenbit;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	pixfmt = inst->capabilities[PIX_FMTS].value;
+	is_tenbit = (pixfmt == MSM_VIDC_FMT_P010 || pixfmt == MSM_VIDC_FMT_TP10C);
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_DPB_H264E(size, width, height);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_DPB_H265E(size, width, height, is_tenbit);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_arp_size_iris2(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+
+	HFI_BUFFER_ARP_ENC(size);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_vpss_size_iris2(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	bool ds_enable = false, is_tenbit = false, blur = false;
+	u32 rotation_val = HFI_ROTATION_NONE;
+	u32 width, height, driver_colorfmt;
+	struct v4l2_format *f;
+
+	ds_enable = is_scaling_enabled(inst);
+	msm_vidc_v4l2_to_hfi_enum(inst, ROTATION, &rotation_val);
+
+	f = &inst->fmts[OUTPUT_PORT];
+	if (is_rotation_90_or_270(inst)) {
+		/*
+		 * output width and height are rotated,
+		 * so unrotate them to use as arguments to
+		 * HFI_BUFFER_VPSS_ENC.
+		 */
+		width = f->fmt.pix_mp.height;
+		height = f->fmt.pix_mp.width;
+	} else {
+		width = f->fmt.pix_mp.width;
+		height = f->fmt.pix_mp.height;
+	}
+
+	f = &inst->fmts[INPUT_PORT];
+	driver_colorfmt = v4l2_colorformat_to_driver(inst,
+			f->fmt.pix_mp.pixelformat, __func__);
+	is_tenbit = is_10bit_colorformat(driver_colorfmt);
+	if (inst->capabilities[BLUR_TYPES].value != MSM_VIDC_BLUR_NONE)
+		blur = true;
+
+	HFI_BUFFER_VPSS_ENC(size, width, height, ds_enable, blur, is_tenbit);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+struct msm_vidc_buf_type_handle {
+	enum msm_vidc_buffer_type type;
+	u32 (*handle)(struct msm_vidc_inst *inst);
+};
+
+int msm_buffer_size_iris2(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int i;
+	u32 size = 0, buf_type_handle_size = 0;
+	const struct msm_vidc_buf_type_handle *buf_type_handle_arr = NULL;
+	static const struct msm_vidc_buf_type_handle dec_buf_type_handle[] = {
+		{MSM_VIDC_BUF_INPUT,           msm_vidc_decoder_input_size              },
+		{MSM_VIDC_BUF_OUTPUT,          msm_vidc_decoder_output_size             },
+		{MSM_VIDC_BUF_INPUT_META,      msm_vidc_decoder_input_meta_size         },
+		{MSM_VIDC_BUF_OUTPUT_META,     msm_vidc_decoder_output_meta_size        },
+		{MSM_VIDC_BUF_BIN,             msm_vidc_decoder_bin_size_iris2          },
+		{MSM_VIDC_BUF_COMV,            msm_vidc_decoder_comv_size_iris2         },
+		{MSM_VIDC_BUF_NON_COMV,        msm_vidc_decoder_non_comv_size_iris2     },
+		{MSM_VIDC_BUF_LINE,            msm_vidc_decoder_line_size_iris2         },
+		{MSM_VIDC_BUF_PERSIST,         msm_vidc_decoder_persist_size_iris2      },
+		{MSM_VIDC_BUF_DPB,             msm_vidc_decoder_dpb_size_iris2          },
+	};
+	static const struct msm_vidc_buf_type_handle enc_buf_type_handle[] = {
+		{MSM_VIDC_BUF_INPUT,           msm_vidc_encoder_input_size              },
+		{MSM_VIDC_BUF_OUTPUT,          msm_vidc_encoder_output_size             },
+		{MSM_VIDC_BUF_INPUT_META,      msm_vidc_encoder_input_meta_size         },
+		{MSM_VIDC_BUF_OUTPUT_META,     msm_vidc_encoder_output_meta_size        },
+		{MSM_VIDC_BUF_BIN,             msm_vidc_encoder_bin_size_iris2          },
+		{MSM_VIDC_BUF_COMV,            msm_vidc_encoder_comv_size_iris2         },
+		{MSM_VIDC_BUF_NON_COMV,        msm_vidc_encoder_non_comv_size_iris2     },
+		{MSM_VIDC_BUF_LINE,            msm_vidc_encoder_line_size_iris2         },
+		{MSM_VIDC_BUF_DPB,             msm_vidc_encoder_dpb_size_iris2          },
+		{MSM_VIDC_BUF_ARP,             msm_vidc_encoder_arp_size_iris2          },
+		{MSM_VIDC_BUF_VPSS,            msm_vidc_encoder_vpss_size_iris2         },
+	};
+
+	if (is_decode_session(inst)) {
+		buf_type_handle_size = ARRAY_SIZE(dec_buf_type_handle);
+		buf_type_handle_arr = dec_buf_type_handle;
+	} else if (is_encode_session(inst)) {
+		buf_type_handle_size = ARRAY_SIZE(enc_buf_type_handle);
+		buf_type_handle_arr = enc_buf_type_handle;
+	}
+
+	/* handle invalid session */
+	if (!buf_type_handle_arr || !buf_type_handle_size) {
+		i_vpr_e(inst, "%s: invalid session %d\n", __func__, inst->domain);
+		return size;
+	}
+
+	/* fetch buffer size */
+	for (i = 0; i < buf_type_handle_size; i++) {
+		if (buf_type_handle_arr[i].type == buffer_type) {
+			size = buf_type_handle_arr[i].handle(inst);
+			break;
+		}
+	}
+
+	/* handle unknown buffer type */
+	if (i == buf_type_handle_size) {
+		i_vpr_e(inst, "%s: unknown buffer type %#x\n", __func__, buffer_type);
+		goto exit;
+	}
+
+	i_vpr_l(inst, "buffer_size: type: %11s,  size: %9u\n", buf_name(buffer_type), size);
+
+exit:
+	return size;
+}
+
+static int msm_vidc_input_min_count_iris2(struct msm_vidc_inst *inst)
+{
+	u32 input_min_count = 0;
+	u32 total_hb_layer = 0;
+
+	if (is_decode_session(inst)) {
+		input_min_count = MIN_DEC_INPUT_BUFFERS;
+	} else if (is_encode_session(inst)) {
+		total_hb_layer = is_hierb_type_requested(inst) ?
+			inst->capabilities[ENH_LAYER_COUNT].value + 1 : 0;
+		if (inst->codec == MSM_VIDC_H264 &&
+			!inst->capabilities[LAYER_ENABLE].value) {
+			total_hb_layer = 0;
+		}
+		HFI_IRIS2_ENC_MIN_INPUT_BUF_COUNT(input_min_count,
+			total_hb_layer);
+	} else {
+		i_vpr_e(inst, "%s: invalid domain %d\n", __func__, inst->domain);
+		return 0;
+	}
+
+	if (is_thumbnail_session(inst) || is_image_session(inst))
+		input_min_count = 1;
+
+	return input_min_count;
+}
+
+static int msm_buffer_dpb_count(struct msm_vidc_inst *inst)
+{
+	int count = 0;
+	u32 color_fmt;
+
+	/* decoder dpb buffer count */
+	if (is_decode_session(inst)) {
+		color_fmt = inst->capabilities[PIX_FMTS].value;
+		if (is_linear_colorformat(color_fmt)) {
+			count = inst->fw_min_count ?
+						inst->fw_min_count : inst->buffers.output.min_count;
+        }
+		return count;
+	}
+
+	/* encoder dpb buffer count */
+	return msm_vidc_get_recon_buf_count(inst);
+}
+
+int msm_buffer_min_count_iris2(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int count = 0;
+
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_INPUT:
+	case MSM_VIDC_BUF_INPUT_META:
+		count = msm_vidc_input_min_count_iris2(inst);
+		break;
+	case MSM_VIDC_BUF_OUTPUT:
+	case MSM_VIDC_BUF_OUTPUT_META:
+		count = msm_vidc_output_min_count(inst);
+		break;
+	case MSM_VIDC_BUF_BIN:
+	case MSM_VIDC_BUF_COMV:
+	case MSM_VIDC_BUF_NON_COMV:
+	case MSM_VIDC_BUF_LINE:
+	case MSM_VIDC_BUF_PERSIST:
+	case MSM_VIDC_BUF_ARP:
+	case MSM_VIDC_BUF_VPSS:
+		count = msm_vidc_internal_buffer_count(inst, buffer_type);
+		break;
+	case MSM_VIDC_BUF_DPB:
+		count = msm_buffer_dpb_count(inst);
+		break;
+	default:
+		break;
+	}
+
+	i_vpr_l(inst, "  min_count: type: %11s, count: %9u\n", buf_name(buffer_type), count);
+	return count;
+}
+
+int msm_buffer_extra_count_iris2(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int count = 0;
+
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_INPUT:
+	case MSM_VIDC_BUF_INPUT_META:
+		count = msm_vidc_input_extra_count(inst);
+		break;
+	case MSM_VIDC_BUF_OUTPUT:
+	case MSM_VIDC_BUF_OUTPUT_META:
+		count = msm_vidc_output_extra_count(inst);
+		break;
+	default:
+		break;
+	}
+
+	i_vpr_l(inst, "extra_count: type: %11s, count: %9u\n", buf_name(buffer_type), count);
+	return count;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris2/src/msm_vidc_iris2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris2/src/msm_vidc_iris2.c
@@ -0,0 +1,994 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/iopoll.h>
+#include "msm_vidc_iris2.h"
+#include "msm_vidc_buffer_iris2.h"
+#include "msm_vidc_power_iris2.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_buffer.h"
+#include "msm_vidc_state.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_variant.h"
+#include "venus_hfi.h"
+
+#define VIDEO_ARCH_LX 1
+
+#define VCODEC_BASE_OFFS_IRIS2                 0x00000000
+#define AON_MVP_NOC_RESET                      0x0001F000
+#define CPU_BASE_OFFS_IRIS2                    0x000A0000
+#define AON_BASE_OFFS			               0x000E0000
+#define CPU_CS_BASE_OFFS_IRIS2		           (CPU_BASE_OFFS_IRIS2)
+#define CPU_IC_BASE_OFFS_IRIS2		           (CPU_BASE_OFFS_IRIS2)
+
+#define CPU_CS_A2HSOFTINTCLR_IRIS2             (CPU_CS_BASE_OFFS_IRIS2 + 0x1C)
+#define CPU_CS_VCICMD_IRIS2                    (CPU_CS_BASE_OFFS_IRIS2 + 0x20)
+#define CPU_CS_VCICMDARG0_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x24)
+#define CPU_CS_VCICMDARG1_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x28)
+#define CPU_CS_VCICMDARG2_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x2C)
+#define CPU_CS_VCICMDARG3_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x30)
+#define CPU_CS_VMIMSG_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x34)
+#define CPU_CS_VMIMSGAG0_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x38)
+#define CPU_CS_VMIMSGAG1_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x3C)
+#define CPU_CS_SCIACMD_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x48)
+#define CPU_CS_H2XSOFTINTEN_IRIS2	(CPU_CS_BASE_OFFS_IRIS2 + 0x148)
+
+/* HFI_CTRL_STATUS */
+#define CPU_CS_SCIACMDARG0_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x4C)
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_ERROR_STATUS_BMSK_IRIS2	0xfe
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_PC_READY_IRIS2           0x100
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_INIT_IDLE_MSG_BMSK_IRIS2     0x40000000
+
+/* HFI_QTBL_INFO */
+#define CPU_CS_SCIACMDARG1_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x50)
+
+/* HFI_QTBL_ADDR */
+#define CPU_CS_SCIACMDARG2_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x54)
+
+/* HFI_VERSION_INFO */
+#define CPU_CS_SCIACMDARG3_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x58)
+
+/* SFR_ADDR */
+#define CPU_CS_SCIBCMD_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x5C)
+
+/* MMAP_ADDR */
+#define CPU_CS_SCIBCMDARG0_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x60)
+
+/* UC_REGION_ADDR */
+#define CPU_CS_SCIBARG1_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x64)
+
+/* UC_REGION_ADDR */
+#define CPU_CS_SCIBARG2_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x68)
+
+#define CPU_CS_AHB_BRIDGE_SYNC_RESET            (CPU_CS_BASE_OFFS_IRIS2 + 0x160)
+#define CPU_CS_AHB_BRIDGE_SYNC_RESET_STATUS     (CPU_CS_BASE_OFFS_IRIS2 + 0x164)
+
+/* FAL10 Feature Control */
+#define CPU_CS_X2RPMh_IRIS2		(CPU_CS_BASE_OFFS_IRIS2 + 0x168)
+#define CPU_CS_X2RPMh_MASK0_BMSK_IRIS2	0x1
+#define CPU_CS_X2RPMh_MASK0_SHFT_IRIS2	0x0
+#define CPU_CS_X2RPMh_MASK1_BMSK_IRIS2	0x2
+#define CPU_CS_X2RPMh_MASK1_SHFT_IRIS2	0x1
+#define CPU_CS_X2RPMh_SWOVERRIDE_BMSK_IRIS2	0x4
+#define CPU_CS_X2RPMh_SWOVERRIDE_SHFT_IRIS2	0x3
+
+#define CPU_IC_SOFTINT_IRIS2		(CPU_IC_BASE_OFFS_IRIS2 + 0x150)
+#define CPU_IC_SOFTINT_H2A_SHFT_IRIS2	0x0
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: AON_MVP_NOC_RESET_REGISTERS
+ * --------------------------------------------------------------------------
+ */
+#define AON_WRAPPER_MVP_NOC_RESET_REQ   (AON_MVP_NOC_RESET + 0x000)
+#define AON_WRAPPER_MVP_NOC_RESET_ACK   (AON_MVP_NOC_RESET + 0x004)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: wrapper
+ * --------------------------------------------------------------------------
+ */
+#define WRAPPER_BASE_OFFS_IRIS2		0x000B0000
+#define WRAPPER_INTR_STATUS_IRIS2	(WRAPPER_BASE_OFFS_IRIS2 + 0x0C)
+#define WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS2	0x8
+#define WRAPPER_INTR_STATUS_A2H_BMSK_IRIS2	0x4
+
+#define WRAPPER_INTR_MASK_IRIS2		(WRAPPER_BASE_OFFS_IRIS2 + 0x10)
+#define WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS2	0x8
+#define WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS2	0x4
+
+#define WRAPPER_CPU_CLOCK_CONFIG_IRIS2	(WRAPPER_BASE_OFFS_IRIS2 + 0x2000)
+#define WRAPPER_CPU_CGC_DIS_IRIS2	(WRAPPER_BASE_OFFS_IRIS2 + 0x2010)
+#define WRAPPER_CPU_STATUS_IRIS2	(WRAPPER_BASE_OFFS_IRIS2 + 0x2014)
+
+#define WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS2	(WRAPPER_BASE_OFFS_IRIS2 + 0x54)
+#define WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS2	(WRAPPER_BASE_OFFS_IRIS2 + 0x58)
+#define WRAPPER_CORE_POWER_STATUS			(WRAPPER_BASE_OFFS_IRIS2 + 0x80)
+#define WRAPPER_CORE_POWER_CONTROL			(WRAPPER_BASE_OFFS_IRIS2 + 0x84)
+#define WRAPPER_CORE_CLOCK_CONFIG_IRIS2		(WRAPPER_BASE_OFFS_IRIS2 + 0x88)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: tz_wrapper
+ * --------------------------------------------------------------------------
+ */
+#define WRAPPER_TZ_BASE_OFFS	0x000C0000
+#define WRAPPER_TZ_CPU_CLOCK_CONFIG	(WRAPPER_TZ_BASE_OFFS)
+#define WRAPPER_TZ_CPU_STATUS	(WRAPPER_TZ_BASE_OFFS + 0x10)
+
+#define CTRL_INIT_IRIS2		CPU_CS_SCIACMD_IRIS2
+
+#define CTRL_STATUS_IRIS2	CPU_CS_SCIACMDARG0_IRIS2
+#define CTRL_ERROR_STATUS__M_IRIS2 \
+		CPU_CS_SCIACMDARG0_HFI_CTRL_ERROR_STATUS_BMSK_IRIS2
+#define CTRL_INIT_IDLE_MSG_BMSK_IRIS2 \
+		CPU_CS_SCIACMDARG0_HFI_CTRL_INIT_IDLE_MSG_BMSK_IRIS2
+#define CTRL_STATUS_PC_READY_IRIS2 \
+		CPU_CS_SCIACMDARG0_HFI_CTRL_PC_READY_IRIS2
+
+
+#define QTBL_INFO_IRIS2		CPU_CS_SCIACMDARG1_IRIS2
+
+#define QTBL_ADDR_IRIS2		CPU_CS_SCIACMDARG2_IRIS2
+
+#define VERSION_INFO_IRIS2	    CPU_CS_SCIACMDARG3_IRIS2
+
+#define SFR_ADDR_IRIS2		    CPU_CS_SCIBCMD_IRIS2
+#define MMAP_ADDR_IRIS2		CPU_CS_SCIBCMDARG0_IRIS2
+#define UC_REGION_ADDR_IRIS2	CPU_CS_SCIBARG1_IRIS2
+#define UC_REGION_SIZE_IRIS2	CPU_CS_SCIBARG2_IRIS2
+
+#define AON_WRAPPER_MVP_NOC_LPI_CONTROL	(AON_BASE_OFFS)
+#define AON_WRAPPER_MVP_NOC_LPI_STATUS	(AON_BASE_OFFS + 0x4)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: VCODEC_SS registers
+ * --------------------------------------------------------------------------
+ */
+#define VCODEC_SS_IDLE_STATUSn           (VCODEC_BASE_OFFS_IRIS2 + 0x70)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: vcodec noc error log registers (iris2)
+ * --------------------------------------------------------------------------
+ */
+#define VCODEC_NOC_VIDEO_A_NOC_BASE_OFFS		0x00010000
+#define VCODEC_NOC_ERL_MAIN_SWID_LOW			0x00011200
+#define VCODEC_NOC_ERL_MAIN_SWID_HIGH			0x00011204
+#define VCODEC_NOC_ERL_MAIN_MAINCTL_LOW			0x00011208
+#define VCODEC_NOC_ERL_MAIN_ERRVLD_LOW			0x00011210
+#define VCODEC_NOC_ERL_MAIN_ERRCLR_LOW			0x00011218
+#define VCODEC_NOC_ERL_MAIN_ERRLOG0_LOW			0x00011220
+#define VCODEC_NOC_ERL_MAIN_ERRLOG0_HIGH		0x00011224
+#define VCODEC_NOC_ERL_MAIN_ERRLOG1_LOW			0x00011228
+#define VCODEC_NOC_ERL_MAIN_ERRLOG1_HIGH		0x0001122C
+#define VCODEC_NOC_ERL_MAIN_ERRLOG2_LOW			0x00011230
+#define VCODEC_NOC_ERL_MAIN_ERRLOG2_HIGH		0x00011234
+#define VCODEC_NOC_ERL_MAIN_ERRLOG3_LOW			0x00011238
+#define VCODEC_NOC_ERL_MAIN_ERRLOG3_HIGH		0x0001123C
+
+static int __interrupt_init_iris2(struct msm_vidc_core *core)
+{
+	u32 mask_val = 0;
+	int rc = 0;
+
+	/* All interrupts should be disabled initially 0x1F6 : Reset value */
+	rc = __read_register(core, WRAPPER_INTR_MASK_IRIS2, &mask_val);
+	if (rc)
+		return rc;
+
+	/* Write 0 to unmask CPU and WD interrupts */
+	mask_val &= ~(WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS2 |
+			WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS2);
+	rc = __write_register(core, WRAPPER_INTR_MASK_IRIS2, mask_val);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __setup_ucregion_memory_map_iris2(struct msm_vidc_core *core)
+{
+	u32 value;
+	int rc = 0;
+
+	value = (u32)core->iface_q_table.align_device_addr;
+	rc = __write_register(core, UC_REGION_ADDR_IRIS2, value);
+	if (rc)
+		return rc;
+
+	value = SHARED_QSIZE;
+	rc = __write_register(core, UC_REGION_SIZE_IRIS2, value);
+	if (rc)
+		return rc;
+
+	value = (u32)core->iface_q_table.align_device_addr;
+	rc = __write_register(core, QTBL_ADDR_IRIS2, value);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, QTBL_INFO_IRIS2, 0x01);
+	if (rc)
+		return rc;
+
+	/* update queues vaddr for debug purpose */
+	value = (u32)((u64)core->iface_q_table.align_virtual_addr);
+	rc = __write_register(core, CPU_CS_VCICMDARG0_IRIS2, value);
+	if (rc)
+		return rc;
+
+	value = (u32)((u64)core->iface_q_table.align_virtual_addr >> 32);
+	rc = __write_register(core, CPU_CS_VCICMDARG1_IRIS2, value);
+	if (rc)
+		return rc;
+
+	if (core->sfr.align_device_addr) {
+		value = (u32)core->sfr.align_device_addr + VIDEO_ARCH_LX;
+		rc = __write_register(core, SFR_ADDR_IRIS2, value);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int __switch_gdsc_mode_iris2(struct msm_vidc_core *core, bool sw_mode)
+{
+	int rc;
+
+	if (sw_mode) {
+		rc = __write_register(core, WRAPPER_CORE_POWER_CONTROL, 0x0);
+		if (rc)
+			return rc;
+		rc = __read_register_with_poll_timeout(core, WRAPPER_CORE_POWER_STATUS,
+						       BIT(1), 0x2, 200, 2000);
+		if (rc) {
+			d_vpr_e("%s: Failed to read WRAPPER_CORE_POWER_STATUS register to 0x1\n",
+				__func__);
+			return rc;
+		}
+	} else {
+		rc = __write_register(core, WRAPPER_CORE_POWER_CONTROL, 0x1);
+		if (rc)
+			return rc;
+		rc = __read_register_with_poll_timeout(core, WRAPPER_CORE_POWER_STATUS,
+						       BIT(1), 0x0, 200, 2000);
+		if (rc) {
+			d_vpr_e("%s: Failed to read WRAPPER_CORE_POWER_STATUS register to 0x0\n",
+				__func__);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int __power_off_iris2_hardware(struct msm_vidc_core *core)
+{
+	int rc = 0, i;
+	u32 value = 0;
+
+	if (is_core_sub_state(core, CORE_SUBSTATE_FW_PWR_CTRL)) {
+		d_vpr_h("%s: hardware power control enabled\n", __func__);
+		goto disable_power;
+	}
+
+	/*
+	 * check to make sure core clock branch enabled else
+	 * we cannot read vcodec top idle register
+	 */
+	rc = __read_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS2, &value);
+	if (rc)
+		return rc;
+
+	if (value) {
+		d_vpr_h("%s: core clock config not enabled, enabling it to read vcodec registers\n",
+			__func__);
+		rc = __write_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS2, 0);
+		if (rc)
+			return rc;
+	}
+
+	/*
+	 * add MNoC idle check before collapsing MVS0 per HPG update
+	 * poll for NoC DMA idle -> HPG 6.1.1
+	 */
+	for (i = 0; i < core->capabilities[NUM_VPP_PIPE].value; i++) {
+		rc = __read_register_with_poll_timeout(core, VCODEC_SS_IDLE_STATUSn + 4*i,
+				0x400000, 0x400000, 2000, 20000);
+		if (rc)
+			d_vpr_h("%s: VCODEC_SS_IDLE_STATUSn (%d) is not idle (%#x)\n",
+				__func__, i, value);
+	}
+
+	/*
+	 * Reset both sides of 2 ahb2ahb_bridges (TZ and non-TZ)
+	 * do we need to check status register here?
+	 */
+	rc = __write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x3);
+	if (rc)
+		return rc;
+	rc = __write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x2);
+	if (rc)
+		return rc;
+	rc = __write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x0);
+	if (rc)
+		return rc;
+
+disable_power:
+	/* power down process */
+	rc = call_res_op(core, gdsc_off, core, "vcodec0");
+	if (rc) {
+		d_vpr_e("%s: disable power domain vcodec failed\n", __func__);
+		rc = 0;
+	}
+
+	rc = call_res_op(core, clk_disable, core, "vcodec_bus");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare vcodec_bus failed\n", __func__);
+		rc = 0;
+	}
+
+	rc = call_res_op(core, clk_disable, core, "vcodec_core");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare vcodec_core failed\n", __func__);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int __power_off_iris2_controller(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	/*
+	 * mask fal10_veto QLPAC error since fal10_veto can go 1
+	 * when pwwait == 0 and clamped to 0 -> HPG 6.1.2
+	 */
+	rc = __write_register(core, CPU_CS_X2RPMh_IRIS2, 0x3);
+	if (rc)
+		return rc;
+
+	/* Set Debug bridge Low power */
+	rc = __write_register(core, WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS2, 0x7);
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS2,
+			0x7, 0x7, 200, 2000);
+	if (rc)
+		d_vpr_h("%s: debug bridge low power failed\n", __func__);
+
+	/* Debug bridge LPI release */
+	rc = __write_register(core, WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS2, 0x0);
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS2,
+			0xffffffff, 0x0, 200, 2000);
+	if (rc)
+		d_vpr_h("%s: debug bridge release failed\n", __func__);
+
+	rc = call_res_op(core, clk_disable, core, "core");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare bus failed\n", __func__);
+		rc = 0;
+	}
+
+	rc = call_res_op(core, clk_disable, core, "iface");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare bus failed\n", __func__);
+		rc = 0;
+	}
+
+	rc = call_res_op(core, clk_disable, core, "bus");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare bus failed\n", __func__);
+		rc = 0;
+	}
+
+	rc = call_res_op(core, reset_bridge, core);
+	if (rc) {
+		d_vpr_e("%s: reset bridge failed\n", __func__);
+		rc = 0;
+	}
+
+	/* power down process */
+	rc = call_res_op(core, gdsc_off, core, "venus");
+	if (rc) {
+		d_vpr_e("%s: disable regulator venus failed\n", __func__);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int __power_off_iris2(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE))
+		return 0;
+
+	/**
+	 * Reset video_cc_mvs0_clk_src value to resolve MMRM high video
+	 * clock projection issue.
+	 */
+	rc = call_res_op(core, set_clks, core, 0);
+	if (rc)
+		d_vpr_e("%s: resetting clocks failed\n", __func__);
+
+	if (__power_off_iris2_hardware(core))
+		d_vpr_e("%s: failed to power off hardware\n", __func__);
+
+	if (__power_off_iris2_controller(core))
+		d_vpr_e("%s: failed to power off controller\n", __func__);
+
+	rc = call_res_op(core, set_bw, core, 0, 0);
+	if (rc)
+		d_vpr_e("%s: failed to unvote buses\n", __func__);
+
+	if (!call_venus_op(core, watchdog, core, core->intr_status))
+		disable_irq_nosync(core->resource->irq);
+
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE, 0, __func__);
+
+	return rc;
+}
+
+static int __power_on_iris2_controller(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = call_res_op(core, gdsc_on, core, "venus");
+	if (rc)
+		goto fail_regulator;
+
+	rc = call_res_op(core, reset_bridge, core);
+	if (rc)
+		goto fail_reset_ahb2axi;
+
+	rc = call_res_op(core, clk_enable, core, "core");
+	if (rc)
+		goto fail_clk_axi;
+
+	rc = call_res_op(core, clk_enable, core, "iface");
+	if (rc)
+		goto fail_clk_axi;
+
+	rc = call_res_op(core, clk_enable, core, "bus");
+	if (rc)
+		goto fail_clk_controller;
+
+	return 0;
+
+fail_clk_controller:
+	call_res_op(core, clk_disable, core, "core");
+	call_res_op(core, clk_disable, core, "iface");
+	call_res_op(core, clk_disable, core, "bus");
+fail_clk_axi:
+fail_reset_ahb2axi:
+	call_res_op(core, gdsc_off, core, "venus");
+fail_regulator:
+	return rc;
+}
+
+static int __power_on_iris2_hardware(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = call_res_op(core, gdsc_on, core, "vcodec0");
+	if (rc)
+		goto fail_regulator;
+
+	/* video controller and hardware powered on successfully */
+	rc = msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_POWER_ENABLE, __func__);
+	if (rc)
+		goto fail_power_on_substate;
+
+	rc = call_res_op(core, gdsc_sw_ctrl, core);
+	if (rc)
+		goto fail_sw_ctrl;
+
+	rc = call_res_op(core, clk_enable, core, "vcodec_bus");
+	if (rc)
+		goto fail_bus_clk;
+
+	rc = call_res_op(core, clk_enable, core, "vcodec_core");
+	if (rc)
+		goto fail_core_clk;
+
+	return 0;
+
+fail_core_clk:
+	call_res_op(core, clk_disable, core, "vcodec_bus");
+fail_bus_clk:
+	call_res_op(core, gdsc_hw_ctrl, core);
+fail_power_on_substate:
+fail_sw_ctrl:
+	call_res_op(core, gdsc_off, core, "vcodec0");
+fail_regulator:
+	return rc;
+}
+
+static int __power_on_iris2(struct msm_vidc_core *core)
+{
+	struct frequency_table *freq_tbl;
+	u32 freq = 0;
+	int rc = 0;
+
+	if (is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE))
+		return 0;
+
+	if (!core_in_valid_state(core)) {
+		d_vpr_e("%s: invalid core state %s\n",
+			__func__, core_state_name(core->state));
+		return -EINVAL;
+	}
+
+	/* Vote for all hardware resources */
+	rc = call_res_op(core, set_bw, core, INT_MAX, INT_MAX);
+	if (rc) {
+		d_vpr_e("%s: failed to vote buses, rc %d\n", __func__, rc);
+		goto fail_vote_buses;
+	}
+
+	rc = __power_on_iris2_controller(core);
+	if (rc) {
+		d_vpr_e("%s: failed to power on iris2 controller\n", __func__);
+		goto fail_power_on_controller;
+	}
+
+	rc = __power_on_iris2_hardware(core);
+	if (rc) {
+		d_vpr_e("%s: failed to power on iris2 hardware\n", __func__);
+		goto fail_power_on_hardware;
+	}
+
+	freq_tbl = core->resource->freq_set.freq_tbl;
+	freq = core->power.clk_freq ? core->power.clk_freq :
+				      freq_tbl[0].freq;
+
+	rc = call_res_op(core, set_clks, core, freq);
+	if (rc) {
+		d_vpr_e("%s: failed to scale clocks\n", __func__);
+		rc = 0;
+	}
+
+	core->power.clk_freq = freq;
+
+	/*
+	 * Re-program all of the registers that get reset as a result of
+	 * regulator_disable() and _enable()
+	 */
+	__set_registers(core);
+
+	__interrupt_init_iris2(core);
+	core->intr_status = 0;
+	enable_irq(core->resource->irq);
+
+	return rc;
+
+fail_power_on_hardware:
+	__power_off_iris2_controller(core);
+fail_power_on_controller:
+	call_res_op(core, set_bw, core, 0, 0);
+fail_vote_buses:
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE, 0, __func__);
+	return rc;
+}
+
+static int __prepare_pc_iris2(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 wfi_status = 0, idle_status = 0, pc_ready = 0;
+	u32 ctrl_status = 0;
+
+	rc = __read_register(core, CTRL_STATUS_IRIS2, &ctrl_status);
+	if (rc)
+		return rc;
+
+	pc_ready = ctrl_status & CTRL_STATUS_PC_READY_IRIS2;
+	idle_status = ctrl_status & BIT(30);
+
+	if (pc_ready) {
+		d_vpr_h("Already in pc_ready state\n");
+		return 0;
+	}
+	rc = __read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (rc)
+		return rc;
+
+	wfi_status &= BIT(0);
+	if (!wfi_status || !idle_status) {
+		d_vpr_e("Skipping PC, wfi status not set\n");
+		goto skip_power_off;
+	}
+
+	rc = __prepare_pc(core);
+	if (rc) {
+		d_vpr_e("Failed __prepare_pc %d\n", rc);
+		goto skip_power_off;
+	}
+
+	rc = __read_register_with_poll_timeout(core, CTRL_STATUS_IRIS2,
+			CTRL_STATUS_PC_READY_IRIS2, CTRL_STATUS_PC_READY_IRIS2, 250, 2500);
+	if (rc) {
+		d_vpr_e("%s: Skip PC. Ctrl status not set\n", __func__);
+		goto skip_power_off;
+	}
+
+	rc = __read_register_with_poll_timeout(core, WRAPPER_TZ_CPU_STATUS,
+			BIT(0), 0x1, 250, 2500);
+	if (rc) {
+		d_vpr_e("%s: Skip PC. Wfi status not set\n", __func__);
+		goto skip_power_off;
+	}
+	return rc;
+
+skip_power_off:
+	rc = __read_register(core, CTRL_STATUS_IRIS2, &ctrl_status);
+	if (rc)
+		return rc;
+	rc = __read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (rc)
+		return rc;
+	wfi_status &= BIT(0);
+	d_vpr_e("Skip PC, wfi=%#x, idle=%#x, pcr=%#x, ctrl=%#x)\n",
+		wfi_status, idle_status, pc_ready, ctrl_status);
+	return -EAGAIN;
+}
+
+static int __raise_interrupt_iris2(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = __write_register(core, CPU_IC_SOFTINT_IRIS2, 1 << CPU_IC_SOFTINT_H2A_SHFT_IRIS2);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __watchdog_iris2(struct msm_vidc_core *core, u32 intr_status)
+{
+	int rc = 0;
+
+	if (intr_status & WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS2) {
+		d_vpr_e("%s: received watchdog interrupt\n", __func__);
+		rc = 1;
+	}
+
+	return rc;
+}
+
+static int __noc_error_info_iris2(struct msm_vidc_core *core)
+{
+	/*
+	 * we are not supposed to access vcodec subsystem registers
+	 * unless vcodec core clock WRAPPER_CORE_CLOCK_CONFIG_IRIS2 is enabled.
+	 * core clock might have been disabled by video firmware as part of
+	 * inter frame power collapse (power plane control feature).
+	 */
+
+	/*
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_SWID_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_SWID_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_SWID_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_SWID_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_MAINCTL_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_MAINCTL_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRVLD_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRVLD_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRCLR_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRCLR_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG0_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG0_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG0_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG0_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG1_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG1_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG1_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG1_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG2_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG2_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG2_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG2_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG3_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG3_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG3_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG3_HIGH:     %#x\n", val);
+	 */
+
+	return 0;
+}
+
+static int __clear_interrupt_iris2(struct msm_vidc_core *core)
+{
+	u32 intr_status = 0, mask = 0;
+	int rc = 0;
+
+	rc = __read_register(core, WRAPPER_INTR_STATUS_IRIS2, &intr_status);
+	if (rc)
+		return rc;
+
+	mask = (WRAPPER_INTR_STATUS_A2H_BMSK_IRIS2|
+		WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS2|
+		CTRL_INIT_IDLE_MSG_BMSK_IRIS2);
+
+	if (intr_status & mask) {
+		core->intr_status |= intr_status;
+		core->reg_count++;
+		d_vpr_l("INTERRUPT: times: %d interrupt_status: %d\n",
+			core->reg_count, intr_status);
+	} else {
+		core->spur_count++;
+	}
+
+	rc = __write_register(core, CPU_CS_A2HSOFTINTCLR_IRIS2, 1);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __boot_firmware_iris2(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 ctrl_init_val = 0, ctrl_status = 0, count = 0, max_tries = 1000;
+
+	rc = __setup_ucregion_memory_map_iris2(core);
+	if (rc)
+		return rc;
+
+	ctrl_init_val = BIT(0);
+
+	rc = __write_register(core, CTRL_INIT_IRIS2, ctrl_init_val);
+	if (rc)
+		return rc;
+
+	while (!ctrl_status && count < max_tries) {
+		rc = __read_register(core, CTRL_STATUS_IRIS2, &ctrl_status);
+		if (rc)
+			return rc;
+
+		if ((ctrl_status & CTRL_ERROR_STATUS__M_IRIS2) == 0x4) {
+			d_vpr_e("invalid setting for UC_REGION\n");
+			break;
+		}
+
+		usleep_range(50, 100);
+		count++;
+	}
+
+	if (count >= max_tries) {
+		d_vpr_e("Error booting up vidc firmware\n");
+		return -ETIME;
+	}
+
+	/* Enable interrupt before sending commands to venus */
+	rc = __write_register(core, CPU_CS_H2XSOFTINTEN_IRIS2, 0x1);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, CPU_CS_X2RPMh_IRIS2, 0x0);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_vidc_decide_work_mode_iris2(struct msm_vidc_inst *inst)
+{
+	u32 work_mode;
+	struct v4l2_format *inp_f;
+	u32 width, height;
+	bool res_ok = false;
+
+	work_mode = MSM_VIDC_STAGE_2;
+	inp_f = &inst->fmts[INPUT_PORT];
+
+	if (is_image_decode_session(inst))
+		work_mode = MSM_VIDC_STAGE_1;
+
+	if (is_image_session(inst))
+		goto exit;
+
+	if (is_decode_session(inst)) {
+		height = inp_f->fmt.pix_mp.height;
+		width = inp_f->fmt.pix_mp.width;
+		res_ok = res_is_less_than(width, height, 1280, 720);
+		if (inst->capabilities[CODED_FRAMES].value ==
+				CODED_FRAMES_INTERLACE ||
+			inst->capabilities[LOWLATENCY_MODE].value ||
+			res_ok) {
+			work_mode = MSM_VIDC_STAGE_1;
+		}
+	} else if (is_encode_session(inst)) {
+		height = inst->crop.height;
+		width = inst->crop.width;
+		res_ok = !res_is_greater_than(width, height, 4096, 2160);
+		if (res_ok &&
+			(inst->capabilities[LOWLATENCY_MODE].value)) {
+			work_mode = MSM_VIDC_STAGE_1;
+		}
+
+		if (inst->hfi_rc_type == HFI_RC_CBR_CFR ||
+			inst->hfi_rc_type == HFI_RC_CBR_VFR)
+				work_mode = MSM_VIDC_STAGE_1;
+
+		if (inst->capabilities[LOSSLESS].value)
+			work_mode = MSM_VIDC_STAGE_2;
+
+		if (!inst->capabilities[GOP_SIZE].value)
+			work_mode = MSM_VIDC_STAGE_2;
+	} else {
+		i_vpr_e(inst, "%s: invalid session type\n", __func__);
+		return -EINVAL;
+	}
+
+exit:
+	i_vpr_h(inst, "Configuring work mode = %u low latency = %u, gop size = %u\n",
+		work_mode, inst->capabilities[LOWLATENCY_MODE].value,
+		inst->capabilities[GOP_SIZE].value);
+	msm_vidc_update_cap_value(inst, STAGE, work_mode, __func__);
+
+	return 0;
+}
+
+static int msm_vidc_decide_work_route_iris2(struct msm_vidc_inst *inst)
+{
+	u32 work_route;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+	work_route = core->capabilities[NUM_VPP_PIPE].value;
+
+	if (is_image_session(inst))
+		goto exit;
+
+	if (is_decode_session(inst)) {
+		if (inst->capabilities[CODED_FRAMES].value ==
+				CODED_FRAMES_INTERLACE)
+			work_route = MSM_VIDC_PIPE_1;
+	} else if (is_encode_session(inst)) {
+		u32 slice_mode;
+
+		slice_mode = inst->capabilities[SLICE_MODE].value;
+
+		/*TODO Pipe=1 for legacy CBR*/
+		if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES)
+			work_route = MSM_VIDC_PIPE_1;
+
+	} else {
+		i_vpr_e(inst, "%s: invalid session type\n", __func__);
+		return -EINVAL;
+	}
+
+exit:
+	i_vpr_h(inst, "Configuring work route = %u", work_route);
+	msm_vidc_update_cap_value(inst, PIPE, work_route, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_blur_type_iris2(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1, cac = -1;
+	s32 pix_fmts = -1, min_quality = -1;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[BLUR_TYPES].value;
+
+	if (adjusted_value == MSM_VIDC_BLUR_NONE)
+		return 0;
+
+	if (msm_vidc_get_parent_value(inst, BLUR_TYPES, BITRATE_MODE,
+		&rc_type, __func__) ||
+		msm_vidc_get_parent_value(inst, BLUR_TYPES,
+		CONTENT_ADAPTIVE_CODING, &cac, __func__) ||
+		msm_vidc_get_parent_value(inst, BLUR_TYPES, PIX_FMTS,
+		&pix_fmts, __func__) ||
+		msm_vidc_get_parent_value(inst, BLUR_TYPES, MIN_QUALITY,
+		&min_quality, __func__))
+		return -EINVAL;
+
+	if (adjusted_value == MSM_VIDC_BLUR_EXTERNAL) {
+		if (is_scaling_enabled(inst) || min_quality)
+			adjusted_value = MSM_VIDC_BLUR_NONE;
+	} else if (adjusted_value == MSM_VIDC_BLUR_ADAPTIVE) {
+		if (is_scaling_enabled(inst) || min_quality ||
+			(rc_type != HFI_RC_VBR_CFR) ||
+			!cac ||
+			is_10bit_colorformat(pix_fmts)) {
+			adjusted_value = MSM_VIDC_BLUR_NONE;
+		}
+	}
+
+	msm_vidc_update_cap_value(inst, BLUR_TYPES,
+		adjusted_value, __func__);
+
+	return 0;
+}
+
+static int msm_vidc_decide_quality_mode_iris2(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 mbpf, mbps, max_hq_mbpf, max_hq_mbps;
+	u32 mode = MSM_VIDC_POWER_SAVE_MODE;
+
+	if (!is_encode_session(inst))
+		return 0;
+
+	/* image session always runs at quality mode */
+	if (is_image_session(inst)) {
+		mode = MSM_VIDC_MAX_QUALITY_MODE;
+		goto exit;
+	}
+
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	mbps = mbpf * msm_vidc_get_fps(inst);
+	core = inst->core;
+	max_hq_mbpf = core->capabilities[MAX_MBPF_HQ].value;;
+	max_hq_mbps = core->capabilities[MAX_MBPS_HQ].value;;
+
+	/* NRT session to have max quality unless client configures lesser complexity */
+	if (!is_realtime_session(inst) && mbpf <= max_hq_mbpf) {
+		mode = MSM_VIDC_MAX_QUALITY_MODE;
+		if (inst->capabilities[COMPLEXITY].value < DEFAULT_COMPLEXITY)
+			mode = MSM_VIDC_POWER_SAVE_MODE;
+		goto exit;
+	}
+
+	/* Power saving always disabled for CQ and LOSSLESS RC modes. */
+	if (inst->capabilities[LOSSLESS].value ||
+		(mbpf <= max_hq_mbpf && mbps <= max_hq_mbps))
+		mode = MSM_VIDC_MAX_QUALITY_MODE;
+
+exit:
+	msm_vidc_update_cap_value(inst, QUALITY_MODE, mode, __func__);
+
+	return 0;
+}
+
+static struct msm_vidc_venus_ops iris2_ops = {
+	.boot_firmware = __boot_firmware_iris2,
+	.raise_interrupt = __raise_interrupt_iris2,
+	.clear_interrupt = __clear_interrupt_iris2,
+	.power_on = __power_on_iris2,
+	.power_off = __power_off_iris2,
+	.prepare_pc = __prepare_pc_iris2,
+	.watchdog = __watchdog_iris2,
+	.noc_error_info = __noc_error_info_iris2,
+	.switch_gdsc_mode = __switch_gdsc_mode_iris2,
+};
+
+static struct msm_vidc_session_ops msm_session_ops = {
+	.buffer_size = msm_buffer_size_iris2,
+	.min_count = msm_buffer_min_count_iris2,
+	.extra_count = msm_buffer_extra_count_iris2,
+	.calc_freq = msm_vidc_calc_freq_iris2,
+	.calc_bw = msm_vidc_calc_bw_iris2,
+	.decide_work_route = msm_vidc_decide_work_route_iris2,
+	.decide_work_mode = msm_vidc_decide_work_mode_iris2,
+	.decide_quality_mode = msm_vidc_decide_quality_mode_iris2,
+};
+
+int msm_vidc_init_iris2(struct msm_vidc_core *core)
+{
+	d_vpr_h("%s()\n", __func__);
+	core->venus_ops = &iris2_ops;
+	core->session_ops = &msm_session_ops;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris2/src/msm_vidc_power_iris2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris2/src/msm_vidc_power_iris2.c
@@ -0,0 +1,706 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_power_iris2.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_debug.h"
+
+u64 msm_vidc_calc_freq_iris2(struct msm_vidc_inst *inst, u32 data_size)
+{
+	u64 freq = 0;
+	struct msm_vidc_core *core;
+	u64 vsp_cycles = 0, vpp_cycles = 0, fw_cycles = 0;
+	u64 fw_vpp_cycles = 0, bitrate = 0;
+	u32 vpp_cycles_per_mb;
+	u32 mbs_per_second;
+	u32 operating_rate, vsp_factor_num = 1, vsp_factor_den = 1;
+	u32 base_cycles = 0;
+	u32 fps, mbpf;
+
+	core = inst->core;
+
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	fps = inst->max_rate;
+	mbs_per_second = mbpf * fps;
+
+	/*
+	 * Calculate vpp, vsp, fw cycles separately for encoder and decoder.
+	 * Even though, most part is common now, in future it may change
+	 * between them.
+	 */
+	fw_cycles = fps * inst->capabilities[MB_CYCLES_FW].value;
+	fw_vpp_cycles = fps * inst->capabilities[MB_CYCLES_FW_VPP].value;
+
+	if (is_encode_session(inst)) {
+		vpp_cycles_per_mb = is_low_power_session(inst) ?
+			inst->capabilities[MB_CYCLES_LP].value :
+			inst->capabilities[MB_CYCLES_VPP].value;
+
+		vpp_cycles = mbs_per_second * vpp_cycles_per_mb /
+			inst->capabilities[PIPE].value;
+
+		/* Factor 1.25 for IbP and 1.375 for I1B2b1P GOP structure */
+		if (inst->capabilities[B_FRAME].value > 1)
+			vpp_cycles += (vpp_cycles / 4) + (vpp_cycles / 8);
+		else if (inst->capabilities[B_FRAME].value)
+			vpp_cycles += vpp_cycles / 4;
+		/* 21 / 20 is minimum overhead factor */
+		vpp_cycles += max(div_u64(vpp_cycles, 20), fw_vpp_cycles);
+		/* 1.01 is multi-pipe overhead */
+		if (inst->capabilities[PIPE].value > 1)
+			vpp_cycles += div_u64(vpp_cycles, 100);
+		/*
+		 * 1080p@480fps usecase needs exactly 338MHz
+		 * without any margin left. Hence, adding 2 percent
+		 * extra to bump it to next level (366MHz).
+		 */
+		if (fps == 480)
+			vpp_cycles += div_u64(vpp_cycles * 2, 100);
+
+		/*
+		 * Add 5 percent extra for 720p@960fps use case
+		 * to bump it to next level (366MHz).
+		 */
+		if (fps == 960)
+			vpp_cycles += div_u64(vpp_cycles * 5, 100);
+
+		/* VSP */
+		/* bitrate is based on fps, scale it using operating rate */
+		operating_rate = inst->capabilities[OPERATING_RATE].value >> 16;
+		if (operating_rate >
+			(inst->capabilities[FRAME_RATE].value >> 16) &&
+			(inst->capabilities[FRAME_RATE].value >> 16)) {
+			vsp_factor_num = operating_rate;
+			vsp_factor_den = inst->capabilities[FRAME_RATE].value >> 16;
+		}
+		vsp_cycles = div_u64(((u64)inst->capabilities[BIT_RATE].value *
+					vsp_factor_num), vsp_factor_den);
+
+		base_cycles = inst->capabilities[MB_CYCLES_VSP].value;
+		if (inst->codec == MSM_VIDC_VP9) {
+			vsp_cycles = div_u64(vsp_cycles * 170, 100);
+		} else if (inst->capabilities[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			vsp_cycles = div_u64(vsp_cycles * 135, 100);
+		} else {
+			base_cycles = 0;
+			vsp_cycles = div_u64(vsp_cycles, 2);
+		}
+		/* VSP FW Overhead 1.05 */
+		vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+		if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_1)
+			vsp_cycles = vsp_cycles * 3;
+
+		vsp_cycles += mbs_per_second * base_cycles;
+
+	} else if (is_decode_session(inst)) {
+		/* VPP */
+		vpp_cycles = mbs_per_second * inst->capabilities[MB_CYCLES_VPP].value /
+			inst->capabilities[PIPE].value;
+		/* 21 / 20 is minimum overhead factor */
+		vpp_cycles += max(vpp_cycles / 20, fw_vpp_cycles);
+		/* 1.059 is multi-pipe overhead */
+		if (inst->capabilities[PIPE].value > 1)
+			vpp_cycles += div_u64(vpp_cycles * 59, 1000);
+
+		/* VSP */
+		base_cycles = inst->has_bframe ?
+				80 : inst->capabilities[MB_CYCLES_VSP].value;
+		bitrate = fps * data_size * 8;
+		vsp_cycles = bitrate;
+
+		if (inst->codec == MSM_VIDC_VP9) {
+			vsp_cycles = div_u64(vsp_cycles * 170, 100);
+		} else if (inst->capabilities[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			vsp_cycles = div_u64(vsp_cycles * 135, 100);
+		} else {
+			base_cycles = 0;
+			vsp_cycles = div_u64(vsp_cycles, 2);
+		}
+		/* VSP FW overhead 1.05 */
+		vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+		if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_1)
+			vsp_cycles = vsp_cycles * 3;
+
+		vsp_cycles += mbs_per_second * base_cycles;
+
+		/* Add 25 percent extra for 960fps use case */
+		if (fps >= 960)
+			vsp_cycles += div_u64(vpp_cycles * 25, 100);
+
+		if (inst->codec == MSM_VIDC_VP9 &&
+				inst->capabilities[STAGE].value ==
+					MSM_VIDC_STAGE_2 &&
+				inst->capabilities[PIPE].value == 4 &&
+				bitrate > 90000000)
+			vsp_cycles = msm_vidc_max_freq(inst);
+	} else {
+		i_vpr_e(inst, "%s: Unknown session type\n", __func__);
+		return msm_vidc_max_freq(inst);
+	}
+
+	freq = max(vpp_cycles, vsp_cycles);
+	freq = max(freq, fw_cycles);
+
+	i_vpr_p(inst, "%s: filled len %d, required freq %llu, fps %u, mbpf %u\n",
+		__func__, data_size, freq, fps, mbpf);
+
+	return freq;
+}
+
+static u64 __calculate_decoder(struct vidc_bus_vote_data *d)
+{
+	/*
+	 * XXX: Don't fool around with any of the hardcoded numbers unless you
+	 * know /exactly/ what you're doing.  Many of these numbers are
+	 * measured heuristics and hardcoded numbers taken from the firmware.
+	 */
+	/* Decoder parameters */
+	int width, height, lcu_size, fps, dpb_bpp;
+	bool unified_dpb_opb, dpb_compression_enabled = true,
+		opb_compression_enabled = false,
+		llc_ref_read_l2_cache_enabled = false,
+		llc_top_line_buf_enabled = false;
+	fp_t dpb_read_compression_factor, dpb_opb_scaling_ratio,
+		dpb_write_compression_factor, opb_write_compression_factor,
+		qsmmu_bw_overhead_factor;
+	bool is_h264_category = true;
+
+	/* Derived parameters */
+	int lcu_per_frame, collocated_bytes_per_lcu, tnbr_per_lcu;
+	unsigned long bitrate;
+	unsigned int num_vpp_pipes;
+
+	fp_t bins_to_bit_factor, vsp_read_factor, vsp_write_factor,
+		dpb_factor, dpb_write_factor, y_bw_no_ubwc_8bpp;
+	fp_t y_bw_no_ubwc_10bpp = 0, y_bw_10bpp_p010 = 0,
+	     motion_vector_complexity = 0;
+	fp_t	dpb_total = 0;
+
+	/* Output parameters */
+	struct {
+		fp_t vsp_read, vsp_write, collocated_read, collocated_write,
+			dpb_read, dpb_write, opb_read, opb_write,
+			line_buffer_read, line_buffer_write,
+			total;
+	} ddr = {0};
+
+	struct {
+		fp_t dpb_read, line_buffer_read, line_buffer_write, total;
+	} llc = {0};
+
+	unsigned long ret = 0;
+	unsigned int integer_part, frac_part;
+
+	width = max(d->input_width, BASELINE_DIMENSIONS.width);
+	height = max(d->input_height, BASELINE_DIMENSIONS.height);
+
+	fps = d->fps;
+
+	lcu_size = d->lcu_size;
+
+	dpb_bpp = __bpp(d->color_formats[0]);
+
+	unified_dpb_opb = d->num_formats == 1;
+
+	dpb_opb_scaling_ratio = fp_div(FP_INT(d->input_width * d->input_height),
+		FP_INT(d->output_width * d->output_height));
+
+	opb_compression_enabled = d->num_formats >= 2 &&
+		__ubwc(d->color_formats[1]);
+
+	integer_part = Q16_INT(d->compression_ratio);
+	frac_part = Q16_FRAC(d->compression_ratio);
+	dpb_read_compression_factor = FP(integer_part, frac_part, 100);
+
+	integer_part = Q16_INT(d->complexity_factor);
+	frac_part = Q16_FRAC(d->complexity_factor);
+	motion_vector_complexity = FP(integer_part, frac_part, 100);
+
+	dpb_write_compression_factor = dpb_read_compression_factor;
+	opb_write_compression_factor = opb_compression_enabled ?
+		dpb_write_compression_factor : FP_ONE;
+
+	num_vpp_pipes = d->num_vpp_pipes;
+
+	if (d->codec == MSM_VIDC_HEVC ||
+		d->codec == MSM_VIDC_HEIC ||
+		d->codec == MSM_VIDC_VP9) {
+		/* H264, VP8, MPEG2 use the same settings */
+		/* HEVC, VP9 use the same setting */
+		is_h264_category = false;
+	}
+	if (d->use_sys_cache) {
+		llc_ref_read_l2_cache_enabled = true;
+		if (is_h264_category)
+			llc_top_line_buf_enabled = true;
+	}
+
+	/* Derived parameters setup */
+	lcu_per_frame = DIV_ROUND_UP(width, lcu_size) *
+		DIV_ROUND_UP(height, lcu_size);
+
+	bitrate = DIV_ROUND_UP(d->bitrate, 1000000);
+
+	bins_to_bit_factor = FP_INT(4);
+
+	vsp_write_factor = bins_to_bit_factor;
+	vsp_read_factor = bins_to_bit_factor + FP_INT(2);
+
+	collocated_bytes_per_lcu = lcu_size == 16 ? 16 :
+				lcu_size == 32 ? 64 : 256;
+
+	dpb_factor = FP(1, 50, 100);
+	dpb_write_factor = FP(1, 5, 100);
+
+	/* This change is applicable for all IRIS2 targets,
+	 * But currently being done only for IRIS2 with 2 pipe
+	 * and 1 pipe due to timeline constraints.
+	 */
+	if (num_vpp_pipes != 4)
+		tnbr_per_lcu = lcu_size == 16 ? 64 :
+			lcu_size == 32 ? 64 : 128;
+	else
+		tnbr_per_lcu = lcu_size == 16 ? 128 :
+			lcu_size == 32 ? 64 : 128;
+
+	/* .... For DDR & LLC  ...... */
+	ddr.vsp_read = fp_div(fp_mult(FP_INT(bitrate),
+				vsp_read_factor), FP_INT(8));
+	ddr.vsp_write = fp_div(fp_mult(FP_INT(bitrate),
+				vsp_write_factor), FP_INT(8));
+
+	ddr.collocated_read = fp_div(FP_INT(lcu_per_frame *
+			collocated_bytes_per_lcu * fps), FP_INT(bps(1)));
+	ddr.collocated_write = ddr.collocated_read;
+
+	y_bw_no_ubwc_8bpp = fp_div(FP_INT(width * height * fps),
+		FP_INT(1000 * 1000));
+
+	if (dpb_bpp != 8) {
+		y_bw_no_ubwc_10bpp =
+			fp_div(fp_mult(y_bw_no_ubwc_8bpp, FP_INT(256)),
+				FP_INT(192));
+		y_bw_10bpp_p010 = y_bw_no_ubwc_8bpp * 2;
+	}
+
+	ddr.dpb_read = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	ddr.dpb_read = fp_div(fp_mult(ddr.dpb_read,
+			fp_mult(dpb_factor, motion_vector_complexity)),
+			dpb_read_compression_factor);
+
+	ddr.dpb_write = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	ddr.dpb_write = fp_div(fp_mult(ddr.dpb_write,
+			fp_mult(dpb_factor, dpb_write_factor)),
+			dpb_write_compression_factor);
+
+	dpb_total = ddr.dpb_read + ddr.dpb_write;
+
+	if (llc_ref_read_l2_cache_enabled) {
+		ddr.dpb_read = fp_div(ddr.dpb_read, is_h264_category ?
+					FP(1, 30, 100) : FP(1, 14, 100));
+		llc.dpb_read = dpb_total - ddr.dpb_write - ddr.dpb_read;
+	}
+
+	ddr.opb_read = FP_ZERO;
+	ddr.opb_write = unified_dpb_opb ? FP_ZERO : (dpb_bpp == 8 ?
+		y_bw_no_ubwc_8bpp : (opb_compression_enabled ?
+		y_bw_no_ubwc_10bpp : y_bw_10bpp_p010));
+	ddr.opb_write = fp_div(fp_mult(dpb_factor, ddr.opb_write),
+		fp_mult(dpb_opb_scaling_ratio, opb_write_compression_factor));
+
+	ddr.line_buffer_read =
+		fp_div(FP_INT(tnbr_per_lcu * lcu_per_frame * fps),
+			FP_INT(bps(1)));
+	ddr.line_buffer_write = ddr.line_buffer_read;
+	if (llc_top_line_buf_enabled) {
+		llc.line_buffer_read = ddr.line_buffer_read;
+		llc.line_buffer_write = ddr.line_buffer_write;
+		ddr.line_buffer_write = ddr.line_buffer_read = FP_ZERO;
+	}
+
+	ddr.total = ddr.vsp_read + ddr.vsp_write +
+		ddr.collocated_read + ddr.collocated_write +
+		ddr.dpb_read + ddr.dpb_write +
+		ddr.opb_read + ddr.opb_write +
+		ddr.line_buffer_read + ddr.line_buffer_write;
+
+	qsmmu_bw_overhead_factor = FP(1, 3, 100);
+
+	ddr.total = fp_mult(ddr.total, qsmmu_bw_overhead_factor);
+	llc.total = llc.dpb_read + llc.line_buffer_read +
+			llc.line_buffer_write + ddr.total;
+
+	/* Add 25 percent extra for 960fps use case */
+	if (fps >= 960) {
+		ddr.total += div_u64(ddr.total * 25, 100);
+		llc.total += div_u64(llc.total * 25, 100);
+	}
+
+	/* Dump all the variables for easier debugging */
+	if (msm_vidc_debug & VIDC_BUS) {
+		struct dump dump[] = {
+		{"DECODER PARAMETERS", "", DUMP_HEADER_MAGIC},
+		{"lcu size", "%d", lcu_size},
+		{"dpb bitdepth", "%d", dpb_bpp},
+		{"frame rate", "%d", fps},
+		{"dpb/opb unified", "%d", unified_dpb_opb},
+		{"dpb/opb downscaling ratio", DUMP_FP_FMT,
+			dpb_opb_scaling_ratio},
+		{"dpb compression", "%d", dpb_compression_enabled},
+		{"opb compression", "%d", opb_compression_enabled},
+		{"dpb read compression factor", DUMP_FP_FMT,
+			dpb_read_compression_factor},
+		{"dpb write compression factor", DUMP_FP_FMT,
+			dpb_write_compression_factor},
+		{"frame width", "%d", width},
+		{"frame height", "%d", height},
+		{"llc ref read l2 cache enabled", "%d",
+			llc_ref_read_l2_cache_enabled},
+		{"llc top line buf enabled", "%d",
+			llc_top_line_buf_enabled},
+
+		{"DERIVED PARAMETERS (1)", "", DUMP_HEADER_MAGIC},
+		{"lcus/frame", "%d", lcu_per_frame},
+		{"bitrate (Mbit/sec)", "%d", bitrate},
+		{"bins to bit factor", DUMP_FP_FMT, bins_to_bit_factor},
+		{"dpb write factor", DUMP_FP_FMT, dpb_write_factor},
+		{"vsp read factor", DUMP_FP_FMT, vsp_read_factor},
+		{"vsp write factor", DUMP_FP_FMT, vsp_write_factor},
+		{"tnbr/lcu", "%d", tnbr_per_lcu},
+		{"collocated bytes/LCU", "%d", collocated_bytes_per_lcu},
+		{"bw for NV12 8bpc)", DUMP_FP_FMT, y_bw_no_ubwc_8bpp},
+		{"bw for NV12 10bpc)", DUMP_FP_FMT, y_bw_no_ubwc_10bpp},
+
+		{"DERIVED PARAMETERS (2)", "", DUMP_HEADER_MAGIC},
+		{"mv complexity", DUMP_FP_FMT, motion_vector_complexity},
+		{"qsmmu_bw_overhead_factor", DUMP_FP_FMT,
+			qsmmu_bw_overhead_factor},
+
+		{"INTERMEDIATE DDR B/W", "", DUMP_HEADER_MAGIC},
+		{"vsp read", DUMP_FP_FMT, ddr.vsp_read},
+		{"vsp write", DUMP_FP_FMT, ddr.vsp_write},
+		{"collocated read", DUMP_FP_FMT, ddr.collocated_read},
+		{"collocated write", DUMP_FP_FMT, ddr.collocated_write},
+		{"line buffer read", DUMP_FP_FMT, ddr.line_buffer_read},
+		{"line buffer write", DUMP_FP_FMT, ddr.line_buffer_write},
+		{"opb read", DUMP_FP_FMT, ddr.opb_read},
+		{"opb write", DUMP_FP_FMT, ddr.opb_write},
+		{"dpb read", DUMP_FP_FMT, ddr.dpb_read},
+		{"dpb write", DUMP_FP_FMT, ddr.dpb_write},
+		{"dpb total", DUMP_FP_FMT, dpb_total},
+		{"INTERMEDIATE LLC B/W", "", DUMP_HEADER_MAGIC},
+		{"llc dpb read", DUMP_FP_FMT, llc.dpb_read},
+		{"llc line buffer read", DUMP_FP_FMT, llc.line_buffer_read},
+		{"llc line buffer write", DUMP_FP_FMT, llc.line_buffer_write},
+
+		};
+		__dump(dump, ARRAY_SIZE(dump));
+	}
+
+	d->calc_bw_ddr = kbps(fp_round(ddr.total));
+	d->calc_bw_llcc = kbps(fp_round(llc.total));
+
+	return ret;
+}
+
+static u64 __calculate_encoder(struct vidc_bus_vote_data *d)
+{
+	/*
+	 * XXX: Don't fool around with any of the hardcoded numbers unless you
+	 * know /exactly/ what you're doing.  Many of these numbers are
+	 * measured heuristics and hardcoded numbers taken from the firmware.
+	 */
+	/* Encoder Parameters */
+	int width, height, fps, lcu_size, bitrate, lcu_per_frame,
+		collocated_bytes_per_lcu, tnbr_per_lcu, dpb_bpp,
+		original_color_format, vertical_tile_width, rotation;
+	bool work_mode_1, original_compression_enabled,
+		low_power, cropping_or_scaling,
+		b_frames_enabled = false,
+		llc_ref_chroma_cache_enabled = false,
+		llc_top_line_buf_enabled = false,
+		llc_vpss_rot_line_buf_enabled = false;
+
+	unsigned int bins_to_bit_factor;
+	fp_t dpb_compression_factor,
+		original_compression_factor,
+		original_compression_factor_y,
+		y_bw_no_ubwc_8bpp, y_bw_no_ubwc_10bpp = 0, y_bw_10bpp_p010 = 0,
+		input_compression_factor,
+		downscaling_ratio,
+		ref_y_read_bw_factor, ref_cbcr_read_bw_factor,
+		recon_write_bw_factor,
+		total_ref_read_crcb,
+		qsmmu_bw_overhead_factor;
+	fp_t integer_part, frac_part;
+	unsigned long ret = 0;
+
+	/* Output parameters */
+	struct {
+		fp_t vsp_read, vsp_write, collocated_read, collocated_write,
+			ref_read_y, ref_read_crcb, ref_write,
+			ref_write_overlap, orig_read,
+			line_buffer_read, line_buffer_write,
+			total;
+	} ddr = {0};
+
+	struct {
+		fp_t ref_read_crcb, line_buffer, total;
+	} llc = {0};
+
+	/* Encoder Parameters setup */
+	rotation = d->rotation;
+	cropping_or_scaling = false;
+	vertical_tile_width = 960;
+	/*
+	 * recon_write_bw_factor varies according to resolution and bit-depth,
+	 * here use 1.08(1.075) for worst case.
+	 * Similar for ref_y_read_bw_factor, it can reach 1.375 for worst case,
+	 * here use 1.3 for average case, and can somewhat balance the
+	 * worst case assumption for UBWC CR factors.
+	 */
+	recon_write_bw_factor = FP(1, 8, 100);
+	ref_y_read_bw_factor = FP(1, 30, 100);
+	ref_cbcr_read_bw_factor = FP(1, 50, 100);
+
+
+	/* Derived Parameters */
+	fps = d->fps;
+	width = max(d->output_width, BASELINE_DIMENSIONS.width);
+	height = max(d->output_height, BASELINE_DIMENSIONS.height);
+	downscaling_ratio = fp_div(FP_INT(d->input_width * d->input_height),
+		FP_INT(d->output_width * d->output_height));
+	downscaling_ratio = max(downscaling_ratio, FP_ONE);
+	bitrate = d->bitrate > 0 ? DIV_ROUND_UP(d->bitrate, 1000000) :
+		__lut(width, height, fps)->bitrate;
+	lcu_size = d->lcu_size;
+	lcu_per_frame = DIV_ROUND_UP(width, lcu_size) *
+		DIV_ROUND_UP(height, lcu_size);
+	tnbr_per_lcu = 16;
+
+	dpb_bpp = __bpp(d->color_formats[0]);
+
+	y_bw_no_ubwc_8bpp = fp_div(FP_INT(width * height * fps),
+		FP_INT(1000 * 1000));
+
+	if (dpb_bpp != 8) {
+		y_bw_no_ubwc_10bpp = fp_div(fp_mult(y_bw_no_ubwc_8bpp,
+			FP_INT(256)), FP_INT(192));
+		y_bw_10bpp_p010 = y_bw_no_ubwc_8bpp * 2;
+	}
+
+	b_frames_enabled = d->b_frames_enabled;
+	original_color_format = d->num_formats >= 1 ?
+		d->color_formats[0] : MSM_VIDC_FMT_NV12C;
+
+	original_compression_enabled = __ubwc(original_color_format);
+
+	work_mode_1 = d->work_mode == MSM_VIDC_STAGE_1;
+	low_power = d->power_mode == VIDC_POWER_LOW;
+	bins_to_bit_factor = 4;
+
+	if (d->use_sys_cache) {
+		llc_ref_chroma_cache_enabled = true;
+		llc_top_line_buf_enabled = true,
+		llc_vpss_rot_line_buf_enabled = true;
+	}
+
+	integer_part = Q16_INT(d->compression_ratio);
+	frac_part = Q16_FRAC(d->compression_ratio);
+	dpb_compression_factor = FP(integer_part, frac_part, 100);
+
+	integer_part = Q16_INT(d->input_cr);
+	frac_part = Q16_FRAC(d->input_cr);
+	input_compression_factor = FP(integer_part, frac_part, 100);
+
+	original_compression_factor = original_compression_factor_y =
+		!original_compression_enabled ? FP_ONE :
+		__compression_ratio(__lut(width, height, fps), dpb_bpp);
+	/* use input cr if it is valid (not 1), otherwise use lut */
+	if (original_compression_enabled &&
+		input_compression_factor != FP_ONE) {
+		original_compression_factor = input_compression_factor;
+		/* Luma usually has lower compression factor than Chroma,
+		 * input cf is overall cf, add 1.08 factor for Luma cf
+		 */
+		original_compression_factor_y =
+			input_compression_factor > FP(1, 8, 100) ?
+			fp_div(input_compression_factor, FP(1, 8, 100)) :
+			input_compression_factor;
+	}
+
+	ddr.vsp_read = fp_div(FP_INT(bitrate * bins_to_bit_factor), FP_INT(8));
+	ddr.vsp_write = ddr.vsp_read + fp_div(FP_INT(bitrate), FP_INT(8));
+
+	collocated_bytes_per_lcu = lcu_size == 16 ? 16 :
+				lcu_size == 32 ? 64 : 256;
+
+	ddr.collocated_read = fp_div(FP_INT(lcu_per_frame *
+			collocated_bytes_per_lcu * fps), FP_INT(bps(1)));
+
+	ddr.collocated_write = ddr.collocated_read;
+
+	ddr.ref_read_y = dpb_bpp == 8 ?
+		y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	if (b_frames_enabled)
+		ddr.ref_read_y = ddr.ref_read_y * 2;
+	ddr.ref_read_y = fp_div(ddr.ref_read_y, dpb_compression_factor);
+
+	ddr.ref_read_crcb = fp_mult((ddr.ref_read_y / 2),
+		ref_cbcr_read_bw_factor);
+
+	if (width > vertical_tile_width) {
+		ddr.ref_read_y = fp_mult(ddr.ref_read_y,
+			ref_y_read_bw_factor);
+	}
+
+	if (llc_ref_chroma_cache_enabled) {
+		total_ref_read_crcb = ddr.ref_read_crcb;
+		ddr.ref_read_crcb = fp_div(ddr.ref_read_crcb,
+					   ref_cbcr_read_bw_factor);
+		llc.ref_read_crcb = total_ref_read_crcb - ddr.ref_read_crcb;
+	}
+
+	ddr.ref_write = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	ddr.ref_write = fp_div(fp_mult(ddr.ref_write, FP(1, 50, 100)),
+			dpb_compression_factor);
+
+	if (width > vertical_tile_width) {
+		ddr.ref_write_overlap = fp_mult(ddr.ref_write,
+			(recon_write_bw_factor - FP_ONE));
+		ddr.ref_write = fp_mult(ddr.ref_write, recon_write_bw_factor);
+	}
+
+	ddr.orig_read = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp :
+		(original_compression_enabled ? y_bw_no_ubwc_10bpp :
+		y_bw_10bpp_p010);
+	ddr.orig_read = fp_div(fp_mult(fp_mult(ddr.orig_read, FP(1, 50, 100)),
+		downscaling_ratio), original_compression_factor);
+	if (rotation == 90 || rotation == 270)
+		ddr.orig_read *= lcu_size == 32 ? (dpb_bpp == 8 ? 1 : 3) : 2;
+
+	ddr.line_buffer_read =
+		fp_div(FP_INT(tnbr_per_lcu * lcu_per_frame * fps),
+			FP_INT(bps(1)));
+
+	ddr.line_buffer_write = ddr.line_buffer_read;
+	if (llc_top_line_buf_enabled) {
+		llc.line_buffer = ddr.line_buffer_read + ddr.line_buffer_write;
+		ddr.line_buffer_read = ddr.line_buffer_write = FP_ZERO;
+	}
+
+	ddr.total = ddr.vsp_read + ddr.vsp_write +
+		ddr.collocated_read + ddr.collocated_write +
+		ddr.ref_read_y + ddr.ref_read_crcb +
+		ddr.ref_write + ddr.ref_write_overlap +
+		ddr.orig_read +
+		ddr.line_buffer_read + ddr.line_buffer_write;
+
+	qsmmu_bw_overhead_factor = FP(1, 3, 100);
+	ddr.total = fp_mult(ddr.total, qsmmu_bw_overhead_factor);
+	llc.total = llc.ref_read_crcb + llc.line_buffer + ddr.total;
+
+	if (msm_vidc_debug & VIDC_BUS) {
+		struct dump dump[] = {
+		{"ENCODER PARAMETERS", "", DUMP_HEADER_MAGIC},
+		{"width", "%d", width},
+		{"height", "%d", height},
+		{"fps", "%d", fps},
+		{"dpb bitdepth", "%d", dpb_bpp},
+		{"input downscaling ratio", DUMP_FP_FMT, downscaling_ratio},
+		{"rotation", "%d", rotation},
+		{"cropping or scaling", "%d", cropping_or_scaling},
+		{"low power mode", "%d", low_power},
+		{"work Mode", "%d", work_mode_1},
+		{"B frame enabled", "%d", b_frames_enabled},
+		{"original frame format", "%#x", original_color_format},
+		{"original compression enabled", "%d",
+			original_compression_enabled},
+		{"dpb compression factor", DUMP_FP_FMT,
+			dpb_compression_factor},
+		{"input compression factor", DUMP_FP_FMT,
+			input_compression_factor},
+		{"llc ref chroma cache enabled", DUMP_FP_FMT,
+		llc_ref_chroma_cache_enabled},
+		{"llc top line buf enabled", DUMP_FP_FMT,
+			llc_top_line_buf_enabled},
+		{"llc vpss rot line buf enabled ", DUMP_FP_FMT,
+			llc_vpss_rot_line_buf_enabled},
+
+		{"DERIVED PARAMETERS", "", DUMP_HEADER_MAGIC},
+		{"lcu size", "%d", lcu_size},
+		{"bitrate (Mbit/sec)", "%lu", bitrate},
+		{"bins to bit factor", "%u", bins_to_bit_factor},
+		{"original compression factor", DUMP_FP_FMT,
+			original_compression_factor},
+		{"original compression factor y", DUMP_FP_FMT,
+			original_compression_factor_y},
+		{"qsmmu_bw_overhead_factor",
+			 DUMP_FP_FMT, qsmmu_bw_overhead_factor},
+		{"bw for NV12 8bpc)", DUMP_FP_FMT, y_bw_no_ubwc_8bpp},
+		{"bw for NV12 10bpc)", DUMP_FP_FMT, y_bw_no_ubwc_10bpp},
+
+		{"INTERMEDIATE B/W DDR", "", DUMP_HEADER_MAGIC},
+		{"vsp read", DUMP_FP_FMT, ddr.vsp_read},
+		{"vsp write", DUMP_FP_FMT, ddr.vsp_write},
+		{"collocated read", DUMP_FP_FMT, ddr.collocated_read},
+		{"collocated write", DUMP_FP_FMT, ddr.collocated_write},
+		{"ref read y", DUMP_FP_FMT, ddr.ref_read_y},
+		{"ref read crcb", DUMP_FP_FMT, ddr.ref_read_crcb},
+		{"ref write", DUMP_FP_FMT, ddr.ref_write},
+		{"ref write overlap", DUMP_FP_FMT, ddr.ref_write_overlap},
+		{"original read", DUMP_FP_FMT, ddr.orig_read},
+		{"line buffer read", DUMP_FP_FMT, ddr.line_buffer_read},
+		{"line buffer write", DUMP_FP_FMT, ddr.line_buffer_write},
+		{"INTERMEDIATE LLC B/W", "", DUMP_HEADER_MAGIC},
+		{"llc ref read crcb", DUMP_FP_FMT, llc.ref_read_crcb},
+		{"llc line buffer", DUMP_FP_FMT, llc.line_buffer},
+		};
+		__dump(dump, ARRAY_SIZE(dump));
+	}
+
+	d->calc_bw_ddr = kbps(fp_round(ddr.total));
+	d->calc_bw_llcc = kbps(fp_round(llc.total));
+
+	return ret;
+}
+
+static u64 __calculate(struct msm_vidc_inst *inst, struct vidc_bus_vote_data *d)
+{
+	u64 value = 0;
+
+	switch (d->domain) {
+	case MSM_VIDC_ENCODER:
+		value = __calculate_encoder(d);
+		break;
+	case MSM_VIDC_DECODER:
+		value = __calculate_decoder(d);
+		break;
+	default:
+		i_vpr_e(inst, "%s: Unknown Domain %#x", __func__, d->domain);
+	}
+
+	return value;
+}
+
+int msm_vidc_calc_bw_iris2(struct msm_vidc_inst *inst,
+		struct vidc_bus_vote_data *vidc_data)
+{
+	int value = 0;
+
+	if (!vidc_data)
+		return value;
+
+	value = __calculate(inst, vidc_data);
+
+	return value;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris3/inc/hfi_buffer_iris3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris3/inc/hfi_buffer_iris3.h
@@ -0,0 +1,1800 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __HFI_BUFFER_IRIS3__
+#define __HFI_BUFFER_IRIS3__
+
+#include <linux/types.h>
+#include "hfi_property.h"
+
+typedef u8      HFI_U8;
+typedef s8      HFI_S8;
+typedef u16     HFI_U16;
+typedef s16     HFI_S16;
+typedef u32     HFI_U32;
+typedef s32     HFI_S32;
+typedef u64     HFI_U64;
+typedef HFI_U32 HFI_BOOL;
+
+#ifndef MIN
+#define  MIN(x, y) (((x) < (y)) ? (x) : (y))
+#endif
+
+#ifndef MAX
+#define  MAX(x, y) (((x) > (y)) ? (x) : (y))
+#endif
+
+#define HFI_ALIGNMENT_4096 (4096)
+
+#define BUF_SIZE_ALIGN_16 (16)
+#define BUF_SIZE_ALIGN_32 (32)
+#define BUF_SIZE_ALIGN_64 (64)
+#define BUF_SIZE_ALIGN_128 (128)
+#define BUF_SIZE_ALIGN_256 (256)
+#define BUF_SIZE_ALIGN_512 (512)
+#define BUF_SIZE_ALIGN_4096 (4096)
+
+#define HFI_ALIGN(a, b) (((b) & ((b) - 1)) ? (((a) + (b) - 1) / \
+	(b) * (b)) : (((a) + (b) - 1) & (~((b) - 1))))
+
+#define HFI_WORKMODE_1 1
+#define HFI_WORKMODE_2 2
+
+#define HFI_DEFAULT_METADATA_STRIDE_MULTIPLE (64)
+#define HFI_DEFAULT_METADATA_BUFFERHEIGHT_MULTIPLE (16)
+
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT (8)
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH (32)
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_HEIGHT (8)
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_WIDTH (16)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_HEIGHT (4)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_WIDTH (48)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_HEIGHT (4)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_WIDTH (24)
+#define HFI_COLOR_FORMAT_RGBA8888_UBWC_TILE_HEIGHT (4)
+#define HFI_COLOR_FORMAT_RGBA8888_UBWC_TILE_WIDTH (16)
+
+#define HFI_NV12_IL_CALC_Y_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width, stride_multiple))
+
+#define HFI_NV12_IL_CALC_Y_BUFHEIGHT(buf_height, frame_height, \
+	min_buf_height_multiple) (buf_height = HFI_ALIGN(frame_height, \
+	min_buf_height_multiple))
+
+#define HFI_NV12_IL_CALC_UV_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width, stride_multiple))
+
+#define HFI_NV12_IL_CALC_UV_BUFHEIGHT(buf_height, frame_height, \
+	min_buf_height_multiple) (buf_height = HFI_ALIGN(((frame_height + 1) \
+	 >> 1),	min_buf_height_multiple))
+
+#define HFI_NV12_IL_CALC_BUF_SIZE(buf_size, y_bufSize, y_stride, y_buf_height, \
+	uv_buf_size, uv_stride, uv_buf_height) \
+	do { \
+		y_bufSize = (y_stride * y_buf_height); \
+		uv_buf_size = (uv_stride * uv_buf_height); \
+		buf_size = HFI_ALIGN(y_bufSize + uv_buf_size, HFI_ALIGNMENT_4096); \
+	} while (0)
+
+#define HFI_NV12_UBWC_IL_CALC_Y_BUF_SIZE(y_bufSize, y_stride, y_buf_height) \
+	(y_bufSize = HFI_ALIGN(y_stride * y_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_NV12_UBWC_IL_CALC_UV_BUF_SIZE(uv_buf_size, \
+	uv_stride, uv_buf_height) \
+	(uv_buf_size = HFI_ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_NV12_UBWC_IL_CALC_BUF_SIZE_V2(buf_size,\
+	frame_width, frame_height, y_stride_multiple,\
+	y_buffer_height_multiple, uv_stride_multiple, \
+	uv_buffer_height_multiple, y_metadata_stride_multiple, \
+	y_metadata_buffer_height_multiple, \
+	uv_metadata_stride_multiple, uv_metadata_buffer_height_multiple) \
+	do { \
+		HFI_U32 y_buf_size, uv_buf_size, y_meta_size, uv_meta_size;   \
+		HFI_U32 stride, _height; \
+		HFI_U32 half_height = (frame_height + 1) >> 1; \
+		HFI_NV12_IL_CALC_Y_STRIDE(stride, frame_width,\
+					y_stride_multiple); \
+		HFI_NV12_IL_CALC_Y_BUFHEIGHT(_height, half_height,\
+					y_buffer_height_multiple); \
+		HFI_NV12_UBWC_IL_CALC_Y_BUF_SIZE(y_buf_size, stride, _height);\
+		HFI_NV12_IL_CALC_UV_STRIDE(stride, frame_width, \
+					uv_stride_multiple); \
+		HFI_NV12_IL_CALC_UV_BUFHEIGHT(_height, half_height, \
+					uv_buffer_height_multiple); \
+		HFI_NV12_UBWC_IL_CALC_UV_BUF_SIZE(uv_buf_size, stride, _height);\
+		HFI_UBWC_CALC_METADATA_PLANE_STRIDE(stride, frame_width,\
+				y_metadata_stride_multiple, \
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH);\
+		HFI_UBWC_METADATA_PLANE_BUFHEIGHT(_height, half_height, \
+				y_metadata_buffer_height_multiple,\
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT);\
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(y_meta_size, stride, \
+				_height);    \
+		HFI_UBWC_UV_METADATA_PLANE_STRIDE(stride, frame_width,\
+				uv_metadata_stride_multiple, \
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_WIDTH); \
+		HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(_height, half_height,\
+				uv_metadata_buffer_height_multiple,\
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_HEIGHT);\
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(uv_meta_size, stride, \
+				 _height); \
+		buf_size = (y_buf_size + uv_buf_size + y_meta_size + \
+			uv_meta_size) << 1;\
+	} while (0)
+
+#define HFI_YUV420_TP10_CALC_Y_STRIDE(stride, frame_width, stride_multiple) \
+	do { \
+		stride = HFI_ALIGN(frame_width, 192); \
+		stride = HFI_ALIGN(stride * 4 / 3, stride_multiple); \
+	} while (0)
+
+#define HFI_YUV420_TP10_CALC_Y_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(frame_height, min_buf_height_multiple))
+
+#define HFI_YUV420_TP10_CALC_UV_STRIDE(stride, frame_width, stride_multiple) \
+	do { \
+		stride = HFI_ALIGN(frame_width, 192); \
+		stride = HFI_ALIGN(stride * 4 / 3, stride_multiple); \
+	} while (0)
+
+#define HFI_YUV420_TP10_CALC_UV_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(((frame_height + 1) >> 1), \
+			min_buf_height_multiple))
+
+#define HFI_YUV420_TP10_CALC_BUF_SIZE(buf_size, y_buf_size, y_stride,\
+		y_buf_height, uv_buf_size, uv_stride, uv_buf_height) \
+	do { \
+		y_buf_size = (y_stride * y_buf_height); \
+		uv_buf_size = (uv_stride * uv_buf_height); \
+		buf_size = y_buf_size + uv_buf_size; \
+	} while (0)
+
+#define HFI_YUV420_TP10_UBWC_CALC_Y_BUF_SIZE(y_buf_size, y_stride, \
+					y_buf_height) \
+	(y_buf_size = HFI_ALIGN(y_stride * y_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_YUV420_TP10_UBWC_CALC_UV_BUF_SIZE(uv_buf_size, uv_stride, \
+					uv_buf_height) \
+	(uv_buf_size = HFI_ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_YUV420_TP10_UBWC_CALC_BUF_SIZE(buf_size, y_stride, y_buf_height, \
+	uv_stride, uv_buf_height, y_md_stride, y_md_height, uv_md_stride, \
+	uv_md_height)\
+	do { \
+		HFI_U32 y_data_size, uv_data_size, y_md_size, uv_md_size; \
+		HFI_YUV420_TP10_UBWC_CALC_Y_BUF_SIZE(y_data_size, y_stride,\
+						y_buf_height); \
+		HFI_YUV420_TP10_UBWC_CALC_UV_BUF_SIZE(uv_data_size, uv_stride, \
+						uv_buf_height); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(y_md_size, y_md_stride, \
+						y_md_height); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(uv_md_size, uv_md_stride, \
+						uv_md_height); \
+		buf_size = y_data_size + uv_data_size + y_md_size + \
+						uv_md_size; \
+	} while (0)
+
+#define HFI_YUV420_P010_CALC_Y_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width * 2, stride_multiple))
+
+#define HFI_YUV420_P010_CALC_Y_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(frame_height, min_buf_height_multiple))
+
+#define HFI_YUV420_P010_CALC_UV_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width * 2, stride_multiple))
+
+#define HFI_YUV420_P010_CALC_UV_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(((frame_height + 1) >> 1), \
+			min_buf_height_multiple))
+
+#define HFI_YUV420_P010_CALC_BUF_SIZE(buf_size, y_data_size, y_stride, \
+	y_buf_height, uv_data_size, uv_stride, uv_buf_height) \
+	do { \
+		y_data_size = HFI_ALIGN(y_stride * y_buf_height, \
+				HFI_ALIGNMENT_4096);\
+		uv_data_size = HFI_ALIGN(uv_stride * uv_buf_height, \
+				HFI_ALIGNMENT_4096); \
+		buf_size = y_data_size + uv_data_size; \
+	} while (0)
+
+#define HFI_RGB888_CALC_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = ((frame_width * 3) + stride_multiple - 1) & \
+			 (0xffffffff - (stride_multiple - 1)))
+
+#define HFI_RGB888_CALC_BUFHEIGHT(buf_height, frame_height, \
+			min_buf_height_multiple) \
+	(buf_height = ((frame_height + min_buf_height_multiple - 1) & \
+			(0xffffffff - (min_buf_height_multiple - 1))))
+
+#define HFI_RGB888_CALC_BUF_SIZE(buf_size, stride, buf_height) \
+	(buf_size = ((stride) * (buf_height)))
+
+#define HFI_RGBA8888_CALC_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN((frame_width << 2), stride_multiple))
+
+#define HFI_RGBA8888_CALC_BUFHEIGHT(buf_height, frame_height, \
+			min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(frame_height, min_buf_height_multiple))
+
+#define HFI_RGBA8888_CALC_BUF_SIZE(buf_size, stride, buf_height) \
+	(buf_size = (stride) * (buf_height))
+
+#define HFI_RGBA8888_UBWC_CALC_DATA_PLANE_BUF_SIZE(buf_size, stride, \
+				buf_height) \
+	(buf_size = HFI_ALIGN((stride) * (buf_height), HFI_ALIGNMENT_4096))
+
+#define HFI_RGBA8888_UBWC_BUF_SIZE(buf_size, data_buf_size, \
+	metadata_buffer_size, stride, buf_height, _metadata_tride, \
+	_metadata_buf_height) \
+	do { \
+		HFI_RGBA8888_UBWC_CALC_DATA_PLANE_BUF_SIZE(data_buf_size, \
+				stride, buf_height); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(metadata_buffer_size, \
+				_metadata_tride, _metadata_buf_height); \
+		buf_size = data_buf_size + metadata_buffer_size; \
+	} while (0)
+
+#define HFI_UBWC_CALC_METADATA_PLANE_STRIDE(metadata_stride, frame_width,\
+	metadata_stride_multiple, tile_width_in_pels) \
+	((metadata_stride = HFI_ALIGN(((frame_width + (tile_width_in_pels - 1)) /\
+	tile_width_in_pels), metadata_stride_multiple)))
+
+#define HFI_UBWC_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, frame_height, \
+	metadata_height_multiple, tile_height_in_pels) \
+	((metadata_buf_height = HFI_ALIGN(((frame_height + \
+	(tile_height_in_pels - 1)) / tile_height_in_pels), \
+	metadata_height_multiple)))
+
+#define HFI_UBWC_UV_METADATA_PLANE_STRIDE(metadata_stride, frame_width, \
+	metadata_stride_multiple, tile_width_in_pels) \
+	((metadata_stride = HFI_ALIGN(((((frame_width + 1) >> 1) +\
+	(tile_width_in_pels - 1)) / tile_width_in_pels), \
+	metadata_stride_multiple)))
+
+#define HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, frame_height,\
+	metadata_height_multiple, tile_height_in_pels) \
+	(metadata_buf_height = HFI_ALIGN(((((frame_height + 1) >> 1) + \
+	(tile_height_in_pels - 1)) / tile_height_in_pels), \
+	metadata_height_multiple))
+
+#define HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(buffer_size, _metadata_tride, \
+					_metadata_buf_height) \
+	((buffer_size = HFI_ALIGN(_metadata_tride * _metadata_buf_height, \
+					HFI_ALIGNMENT_4096)))
+
+#define BUFFER_ALIGNMENT_512_BYTES 512
+#define BUFFER_ALIGNMENT_256_BYTES 256
+#define BUFFER_ALIGNMENT_128_BYTES 128
+#define BUFFER_ALIGNMENT_64_BYTES 64
+#define BUFFER_ALIGNMENT_32_BYTES 32
+#define BUFFER_ALIGNMENT_16_BYTES 16
+#define BUFFER_ALIGNMENT_8_BYTES 8
+#define BUFFER_ALIGNMENT_4_BYTES 4
+
+#define VENUS_DMA_ALIGNMENT BUFFER_ALIGNMENT_256_BYTES
+
+#define MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE 640
+#define MAX_FE_NBR_DATA_CB_LINE_BUFFER_SIZE 320
+#define MAX_FE_NBR_DATA_CR_LINE_BUFFER_SIZE 320
+
+#define MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE (128 / 8)
+
+#define MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE (64 * 2 * 3)
+#define MAX_PE_NBR_DATA_LCU32_LINE_BUFFER_SIZE (32 * 2 * 3)
+#define MAX_PE_NBR_DATA_LCU16_LINE_BUFFER_SIZE (16 * 2 * 3)
+
+#define MAX_TILE_COLUMNS 32
+
+#define SIZE_VPSS_LB(Size, frame_width, frame_height, num_vpp_pipes) \
+	do { \
+		HFI_U32 vpss_4tap_top_buffer_size, vpss_div2_top_buffer_size, \
+		vpss_4tap_left_buffer_size, vpss_div2_left_buffer_size; \
+		HFI_U32 opb_wr_top_line_luma_buffer_size, \
+		opb_wr_top_line_chroma_buffer_size, \
+		opb_lb_wr_llb_y_buffer_size,\
+		opb_lb_wr_llb_uv_buffer_size; \
+		HFI_U32 macrotiling_size; \
+		vpss_4tap_top_buffer_size = vpss_div2_top_buffer_size = \
+		vpss_4tap_left_buffer_size = vpss_div2_left_buffer_size = 0; \
+		macrotiling_size = 32; \
+		opb_wr_top_line_luma_buffer_size = HFI_ALIGN(frame_width, \
+			macrotiling_size) / macrotiling_size * 256; \
+			opb_wr_top_line_luma_buffer_size = \
+		HFI_ALIGN(opb_wr_top_line_luma_buffer_size, \
+		VENUS_DMA_ALIGNMENT) + (MAX_TILE_COLUMNS - 1) * 256; \
+		opb_wr_top_line_luma_buffer_size = \
+		MAX(opb_wr_top_line_luma_buffer_size, (32 * \
+			HFI_ALIGN(frame_height, 8))); \
+		opb_wr_top_line_chroma_buffer_size = \
+			opb_wr_top_line_luma_buffer_size;\
+		opb_lb_wr_llb_uv_buffer_size = opb_lb_wr_llb_y_buffer_size = \
+			HFI_ALIGN((HFI_ALIGN(frame_height, 8) / (4 / 2)) * 64,\
+					   BUFFER_ALIGNMENT_32_BYTES); \
+		Size = num_vpp_pipes * 2 * (vpss_4tap_top_buffer_size +  \
+						vpss_div2_top_buffer_size) +  \
+			   2 * (vpss_4tap_left_buffer_size + \
+					vpss_div2_left_buffer_size) + \
+			   opb_wr_top_line_luma_buffer_size + \
+			   opb_wr_top_line_chroma_buffer_size + \
+			   opb_lb_wr_llb_uv_buffer_size + \
+			   opb_lb_wr_llb_y_buffer_size; \
+	} while (0)
+
+#define VPP_CMD_MAX_SIZE (1 << 20)
+#define NUM_HW_PIC_BUF 32
+#define BIN_BUFFER_THRESHOLD (1280 * 736)
+#define H264D_MAX_SLICE 1800
+#define SIZE_H264D_BUFTAB_T (256)
+#define SIZE_H264D_HW_PIC_T (1 << 11)
+#define SIZE_H264D_BSE_CMD_PER_BUF (32 * 4)
+#define SIZE_H264D_VPP_CMD_PER_BUF (512)
+
+#define SIZE_H264D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	(MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE * HFI_ALIGN(frame_width, 16) * 3)
+
+#define SIZE_H264D_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4))
+
+#define SIZE_H264D_LB_FE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4))
+
+#define SIZE_H264D_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	(MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4))
+
+#define SIZE_H264D_LB_SE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4))
+
+#define SIZE_H264D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	(MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE *  ((frame_width + 15) >> 4))
+
+#define SIZE_H264D_LB_VSP_TOP(frame_width, frame_height) \
+	((((frame_width + 15) >> 4) << 7))
+
+#define SIZE_H264D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	(HFI_ALIGN(frame_height, 16) * 32)
+
+#define SIZE_H264D_QP(frame_width, frame_height) \
+	(((frame_width + 63) >> 6) * ((frame_height + 63) >> 6) * 128)
+
+#define SIZE_HW_PIC(size_per_buf) \
+	(NUM_HW_PIC_BUF * size_per_buf)
+
+#define SIZE_H264D_BSE_CMD_BUF(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 _height = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_32_BYTES);  \
+		_size = MIN((((_height + 15) >> 4) * 48), H264D_MAX_SLICE) *\
+					  SIZE_H264D_BSE_CMD_PER_BUF; \
+	} while (0)
+
+#define SIZE_H264D_VPP_CMD_BUF(_size, frame_width, frame_height)    \
+	do { \
+		HFI_U32 _height = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_32_BYTES); \
+		_size = MIN((((_height + 15) >> 4) * 48), H264D_MAX_SLICE) * \
+					SIZE_H264D_VPP_CMD_PER_BUF; \
+		if (_size > VPP_CMD_MAX_SIZE) { \
+			_size = VPP_CMD_MAX_SIZE; \
+		} \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H264D(coMV_size, frame_width, \
+			frame_height, _comv_bufcount) \
+	do { \
+		HFI_U32 frame_width_in_mbs = ((frame_width + 15) >> 4); \
+		HFI_U32 frame_height_in_mbs = ((frame_height + 15) >> 4); \
+		HFI_U32 col_mv_aligned_width = (frame_width_in_mbs << 7); \
+		HFI_U32 col_zero_aligned_width = (frame_width_in_mbs << 2); \
+		HFI_U32 col_zero_size = 0, size_colloc = 0; \
+		col_mv_aligned_width = HFI_ALIGN(col_mv_aligned_width, \
+					BUFFER_ALIGNMENT_16_BYTES); \
+		col_zero_aligned_width = HFI_ALIGN(col_zero_aligned_width, \
+					BUFFER_ALIGNMENT_16_BYTES); \
+		col_zero_size = col_zero_aligned_width * \
+					((frame_height_in_mbs + 1) >> 1); \
+		col_zero_size = HFI_ALIGN(col_zero_size, \
+				BUFFER_ALIGNMENT_64_BYTES);  \
+		col_zero_size <<= 1; \
+		col_zero_size = HFI_ALIGN(col_zero_size, \
+				BUFFER_ALIGNMENT_512_BYTES); \
+		size_colloc = col_mv_aligned_width * ((frame_height_in_mbs + \
+				1) >> 1); \
+		size_colloc = HFI_ALIGN(size_colloc, \
+				BUFFER_ALIGNMENT_64_BYTES); \
+		size_colloc <<= 1; \
+		size_colloc = HFI_ALIGN(size_colloc, \
+				BUFFER_ALIGNMENT_512_BYTES); \
+		size_colloc += (col_zero_size + SIZE_H264D_BUFTAB_T * 2); \
+		coMV_size = size_colloc * (_comv_bufcount); \
+		coMV_size += BUFFER_ALIGNMENT_512_BYTES; \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_H264D(_size, frame_width, frame_height, \
+								num_vpp_pipes) \
+	do { \
+		HFI_U32 _size_bse, _size_vpp; \
+		SIZE_H264D_BSE_CMD_BUF(_size_bse, frame_width, frame_height); \
+		SIZE_H264D_VPP_CMD_BUF(_size_vpp, frame_width, frame_height); \
+		_size = HFI_ALIGN(_size_bse, VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(_size_vpp, VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_HW_PIC(SIZE_H264D_HW_PIC_T), \
+			VENUS_DMA_ALIGNMENT); \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H264D(_size, frame_width, frame_height, \
+							  is_opb, num_vpp_pipes)            \
+	do { \
+		HFI_U32 vpss_lb_size = 0; \
+		_size = HFI_ALIGN(SIZE_H264D_LB_FE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_FE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_FE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H264D_LB_SE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_SE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * \
+			num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H264D_LB_PE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_VSP_TOP(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_RECON_DMA_METADATA_WR\
+			(frame_width, frame_height), \
+			VENUS_DMA_ALIGNMENT) * 2 + HFI_ALIGN(SIZE_H264D_QP\
+			(frame_width, frame_height), VENUS_DMA_ALIGNMENT); \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height, \
+						num_vpp_pipes); \
+		} \
+		_size = HFI_ALIGN((_size + vpss_lb_size), \
+			VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define H264_CABAC_HDR_RATIO_HD_TOT 1
+#define H264_CABAC_RES_RATIO_HD_TOT 3
+
+#define SIZE_H264D_HW_BIN_BUFFER(_size, frame_width, frame_height, \
+				delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 size_yuv, size_bin_hdr, size_bin_res; \
+		size_yuv = ((frame_width * frame_height) <= \
+			BIN_BUFFER_THRESHOLD) ?\
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) : \
+			((frame_width * frame_height * 3) >> 1); \
+		size_bin_hdr = size_yuv * H264_CABAC_HDR_RATIO_HD_TOT; \
+		size_bin_res = size_yuv * H264_CABAC_RES_RATIO_HD_TOT; \
+		size_bin_hdr = size_bin_hdr * (((((HFI_U32)(delay)) & 31) /\
+				10) + 2) / 2; \
+		size_bin_res = size_bin_res * (((((HFI_U32)(delay)) & 31) /\
+				10) + 2) / 2; \
+		size_bin_hdr = HFI_ALIGN(size_bin_hdr / num_vpp_pipes,\
+				VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		size_bin_res = HFI_ALIGN(size_bin_res / num_vpp_pipes, \
+			VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		_size = size_bin_hdr + size_bin_res; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H264D(_size, frame_width, frame_height, is_interlaced, \
+			delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 n_aligned_w = HFI_ALIGN(frame_width, \
+				BUFFER_ALIGNMENT_16_BYTES);\
+		HFI_U32 n_aligned_h = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_16_BYTES); \
+		if (!is_interlaced)  { \
+			SIZE_H264D_HW_BIN_BUFFER(_size, n_aligned_w, \
+				n_aligned_h, delay, num_vpp_pipes); \
+		} else { \
+			_size = 0;  \
+		} \
+	} while (0)
+
+#define NUM_SLIST_BUF_H264 (256 + 32)
+#define SIZE_SLIST_BUF_H264 (512)
+#define SIZE_SEI_USERDATA (4096)
+#define H264_NUM_FRM_INFO (66)
+#define H264_DISPLAY_BUF_SIZE (3328)
+#define SIZE_DOLBY_RPU_METADATA (41 * 1024)
+#define HFI_BUFFER_PERSIST_H264D(_size, rpu_enabled) \
+	(_size = HFI_ALIGN((SIZE_SLIST_BUF_H264 * NUM_SLIST_BUF_H264 + \
+	H264_DISPLAY_BUF_SIZE * H264_NUM_FRM_INFO + \
+	NUM_HW_PIC_BUF * SIZE_SEI_USERDATA + \
+	rpu_enabled * NUM_HW_PIC_BUF * SIZE_DOLBY_RPU_METADATA), \
+	VENUS_DMA_ALIGNMENT))
+
+#define LCU_MAX_SIZE_PELS 64
+#define LCU_MIN_SIZE_PELS 16
+
+#define H265D_MAX_SLICE 1200
+#define SIZE_H265D_HW_PIC_T SIZE_H264D_HW_PIC_T
+#define SIZE_H265D_BSE_CMD_PER_BUF (16 * sizeof(HFI_U32))
+#define SIZE_H265D_VPP_CMD_PER_BUF (256)
+
+#define SIZE_H265D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	(MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE * \
+	(HFI_ALIGN(frame_width, 64) + 8) * 2)
+
+#define SIZE_H265D_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * \
+	(HFI_ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS))
+
+#define SIZE_H265D_LB_FE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * \
+	(HFI_ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS))
+
+#define SIZE_H265D_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	((LCU_MAX_SIZE_PELS / 8 * (128 / 8)) * ((frame_width + 15) >> 4))
+
+#define SIZE_H265D_LB_SE_LEFT_CTRL(frame_width, frame_height)    \
+	(MAX(((frame_height + 16 - 1) / 8) * \
+		MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,     \
+	MAX(((frame_height + 32 - 1) / 8) * \
+		MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 64 - 1) / 8) * \
+		MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE)))
+
+#define SIZE_H265D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	(MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE * (HFI_ALIGN(frame_width, \
+	LCU_MIN_SIZE_PELS) / LCU_MIN_SIZE_PELS))
+
+#define SIZE_H265D_LB_VSP_TOP(frame_width, frame_height) \
+	(((frame_width + 63) >> 6) * 128)
+
+#define SIZE_H265D_LB_VSP_LEFT(frame_width, frame_height) \
+	(((frame_height + 63) >> 6) * 128)
+
+#define SIZE_H265D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	SIZE_H264D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height)
+
+#define SIZE_H265D_QP(frame_width, frame_height) \
+		SIZE_H264D_QP(frame_width, frame_height)
+
+#define SIZE_H265D_BSE_CMD_BUF(_size, frame_width, frame_height)\
+	do { \
+		_size = HFI_ALIGN(((HFI_ALIGN(frame_width, \
+		LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS) * \
+		(HFI_ALIGN(frame_height, LCU_MAX_SIZE_PELS) /\
+		LCU_MIN_SIZE_PELS)) * NUM_HW_PIC_BUF, VENUS_DMA_ALIGNMENT);  \
+		_size = MIN(_size, H265D_MAX_SLICE + 1);          \
+		_size = 2 * _size * SIZE_H265D_BSE_CMD_PER_BUF;     \
+	} while (0)
+
+#define SIZE_H265D_VPP_CMD_BUF(_size, frame_width, frame_height)  \
+	do { \
+		_size = HFI_ALIGN(((HFI_ALIGN(frame_width, LCU_MAX_SIZE_PELS) /\
+		LCU_MIN_SIZE_PELS) * (HFI_ALIGN(frame_height, \
+		LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS)) * \
+		NUM_HW_PIC_BUF, VENUS_DMA_ALIGNMENT);  \
+		_size = MIN(_size, H265D_MAX_SLICE + 1);    \
+		_size = HFI_ALIGN(_size, 4);  \
+		_size = 2 * _size * SIZE_H265D_VPP_CMD_PER_BUF; \
+		if (_size > VPP_CMD_MAX_SIZE) { \
+			_size = VPP_CMD_MAX_SIZE;   \
+		}                          \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H265D(_size, frame_width, frame_height, \
+							_comv_bufcount) \
+	do { \
+		_size = HFI_ALIGN(((((frame_width + 15) >> 4) * \
+			((frame_height + 15) >> 4)) << 8), \
+			BUFFER_ALIGNMENT_512_BYTES); \
+		_size *= _comv_bufcount; \
+		_size += BUFFER_ALIGNMENT_512_BYTES; \
+	} while (0)
+
+#define HDR10_HIST_EXTRADATA_SIZE (4 * 1024)
+
+#define HFI_BUFFER_NON_COMV_H265D(_size, frame_width, frame_height, \
+				num_vpp_pipes) \
+	do { \
+		HFI_U32 _size_bse, _size_vpp; \
+		SIZE_H265D_BSE_CMD_BUF(_size_bse, frame_width, \
+		frame_height); \
+		SIZE_H265D_VPP_CMD_BUF(_size_vpp, frame_width, \
+		frame_height);  \
+		_size = HFI_ALIGN(_size_bse, VENUS_DMA_ALIGNMENT) +     \
+			HFI_ALIGN(_size_vpp, VENUS_DMA_ALIGNMENT) +     \
+			HFI_ALIGN(NUM_HW_PIC_BUF * 20 * 22 * 4, \
+			VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(2 * sizeof(HFI_U16) *           \
+			(HFI_ALIGN(frame_width, LCU_MAX_SIZE_PELS) / \
+			LCU_MIN_SIZE_PELS) * (HFI_ALIGN(frame_height, \
+			LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS), \
+			VENUS_DMA_ALIGNMENT) +                \
+			HFI_ALIGN(SIZE_HW_PIC(SIZE_H265D_HW_PIC_T), \
+			VENUS_DMA_ALIGNMENT) + \
+			HDR10_HIST_EXTRADATA_SIZE;           \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT);  \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H265D(_size, frame_width, frame_height, \
+			is_opb, num_vpp_pipes) \
+	do { \
+		HFI_U32 vpss_lb_size = 0; \
+		_size = HFI_ALIGN(SIZE_H265D_LB_FE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_FE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_FE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H265D_LB_SE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H265D_LB_SE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_PE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_VSP_TOP(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) +        \
+			HFI_ALIGN(SIZE_H265D_LB_VSP_LEFT(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H265D_LB_RECON_DMA_METADATA_WR\
+			(frame_width, frame_height), \
+			VENUS_DMA_ALIGNMENT) * 4 +  \
+			HFI_ALIGN(SIZE_H265D_QP(frame_width, frame_height),\
+			VENUS_DMA_ALIGNMENT);           \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height,\
+						 num_vpp_pipes); \
+		} \
+		_size = HFI_ALIGN((_size + vpss_lb_size), \
+			VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define H265_CABAC_HDR_RATIO_HD_TOT 2
+#define H265_CABAC_RES_RATIO_HD_TOT 2
+
+#define SIZE_H265D_HW_BIN_BUFFER(_size, frame_width, frame_height, \
+				delay, num_vpp_pipes)    \
+	do { \
+		HFI_U32 size_yuv, size_bin_hdr, size_bin_res;     \
+		size_yuv = ((frame_width * frame_height) <= \
+			BIN_BUFFER_THRESHOLD) ? \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) : \
+			((frame_width * frame_height * 3) >> 1); \
+		size_bin_hdr = size_yuv * H265_CABAC_HDR_RATIO_HD_TOT;    \
+		size_bin_res = size_yuv * H265_CABAC_RES_RATIO_HD_TOT;   \
+		size_bin_hdr = size_bin_hdr * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2;    \
+		size_bin_res = size_bin_res * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2;    \
+		size_bin_hdr = HFI_ALIGN(size_bin_hdr / \
+			num_vpp_pipes, VENUS_DMA_ALIGNMENT) * \
+			num_vpp_pipes;  \
+		size_bin_res = HFI_ALIGN(size_bin_res / num_vpp_pipes,\
+			VENUS_DMA_ALIGNMENT) * num_vpp_pipes;  \
+		_size = size_bin_hdr + size_bin_res;    \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H265D(_size, frame_width, frame_height, \
+				is_interlaced, delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 n_aligned_w = HFI_ALIGN(frame_width, \
+				BUFFER_ALIGNMENT_16_BYTES); \
+		HFI_U32 n_aligned_h = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_16_BYTES); \
+		if (!is_interlaced) { \
+			SIZE_H265D_HW_BIN_BUFFER(_size, n_aligned_w, \
+			n_aligned_h, delay, num_vpp_pipes); \
+		} else { \
+			_size = 0; \
+		} \
+	} while (0)
+
+#define SIZE_SLIST_BUF_H265 (1 << 10)
+#define NUM_SLIST_BUF_H265 (80 + 20)
+#define H265_NUM_TILE_COL 32
+#define H265_NUM_TILE_ROW 128
+#define H265_NUM_TILE (H265_NUM_TILE_ROW * H265_NUM_TILE_COL + 1)
+#define H265_NUM_FRM_INFO (48)
+#define H265_DISPLAY_BUF_SIZE (3072)
+#define HFI_BUFFER_PERSIST_H265D(_size, rpu_enabled) \
+	(_size = HFI_ALIGN((SIZE_SLIST_BUF_H265 * NUM_SLIST_BUF_H265 + \
+	H265_NUM_FRM_INFO * H265_DISPLAY_BUF_SIZE + \
+	H265_NUM_TILE * sizeof(HFI_U32) + NUM_HW_PIC_BUF * SIZE_SEI_USERDATA + \
+	rpu_enabled * NUM_HW_PIC_BUF * SIZE_DOLBY_RPU_METADATA),\
+	VENUS_DMA_ALIGNMENT))
+
+#define SIZE_VPXD_LB_FE_LEFT_CTRL(frame_width, frame_height)   \
+	MAX(((frame_height + 15) >> 4) * \
+	MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE, \
+	MAX(((frame_height + 31) >> 5) * \
+	MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 63) >> 6) * MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE))
+#define SIZE_VPXD_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(((HFI_ALIGN(frame_width, 64) + 8) * 10 * 2))
+#define SIZE_VPXD_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	(((frame_width + 15) >> 4) * MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE)
+#define SIZE_VPXD_LB_SE_LEFT_CTRL(frame_width, frame_height)  \
+	MAX(((frame_height + 15) >> 4) * \
+	MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,\
+	MAX(((frame_height + 31) >> 5) * \
+	MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 63) >> 6) * MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE))
+#define SIZE_VPXD_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	HFI_ALIGN((HFI_ALIGN(frame_height, 8) / (4 / 2)) * 64,\
+	BUFFER_ALIGNMENT_32_BYTES)
+#define SIZE_MP2D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(frame_width, 16) + 8) * 10 * 2)
+#define SIZE_VP9D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(HFI_ALIGN(frame_width, 8), 64) + 8) * 10 * 2)
+#define SIZE_MP2D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(frame_width, 16) >> 4) * 64)
+#define SIZE_VP9D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(HFI_ALIGN(frame_width, 8), 64) >> 6) * 176)
+#define SIZE_MP2D_LB_VSP_TOP(frame_width, frame_height) \
+	(((HFI_ALIGN(frame_width, 16) >> 4) * 64 / 2) + 256)
+#define SIZE_VP9D_LB_VSP_TOP(frame_width, frame_height) \
+	((((HFI_ALIGN(HFI_ALIGN(frame_width, 8), 64) >> 6) * 64 * 8) + 256))
+
+#define HFI_IRIS3_VP9D_COMV_SIZE \
+	((((8192 + 63) >> 6) * ((4320 + 63) >> 6) * 8 * 8 * 2 * 8))
+
+#define SIZE_VP9D_QP(frame_width, frame_height) \
+	SIZE_H264D_QP(frame_width, frame_height)
+
+#define HFI_IRIS3_VP9D_LB_SIZE(_size, frame_width, frame_height, num_vpp_pipes)\
+	do { \
+		_size = HFI_ALIGN(SIZE_VPXD_LB_FE_LEFT_CTRL(frame_width, \
+		frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_LEFT_CTRL(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_VP9D_LB_VSP_TOP(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VPXD_LB_FE_TOP_CTRL(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + 2 * \
+		HFI_ALIGN(SIZE_VPXD_LB_RECON_DMA_METADATA_WR \
+		(frame_width, frame_height), VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_TOP_CTRL(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VP9D_LB_PE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VP9D_LB_FE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VP9D_QP(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_VP9D(_size, frame_width, frame_height, \
+		_yuv_bufcount_min, is_opb, num_vpp_pipes) \
+	do { \
+		HFI_U32 _lb_size = 0;                  \
+		HFI_U32 vpss_lb_size = 0;              \
+		HFI_IRIS3_VP9D_LB_SIZE(_lb_size, frame_width, frame_height,\
+			num_vpp_pipes);             \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height, \
+			num_vpp_pipes); \
+		} \
+		_size = _lb_size + vpss_lb_size; \
+	} while (0)
+
+#define VPX_DECODER_FRAME_CONCURENCY_LVL (2)
+#define VPX_DECODER_FRAME_BIN_HDR_BUDGET_RATIO 1 / 2
+#define VPX_DECODER_FRAME_BIN_RES_BUDGET_RATIO 3 / 2
+
+#define HFI_BUFFER_BIN_VP9D(_size, frame_width, frame_height, \
+				is_interlaced, num_vpp_pipes) \
+	do { \
+		HFI_U32 _size_yuv = HFI_ALIGN(frame_width, \
+		BUFFER_ALIGNMENT_16_BYTES) *\
+		HFI_ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES) * 3 / 2;  \
+		if (!is_interlaced) { \
+			_size = HFI_ALIGN(((MAX(_size_yuv, \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1)) * \
+			VPX_DECODER_FRAME_BIN_HDR_BUDGET_RATIO * \
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes), \
+			VENUS_DMA_ALIGNMENT) + HFI_ALIGN(((MAX(_size_yuv, \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1)) * \
+			VPX_DECODER_FRAME_BIN_RES_BUDGET_RATIO * \
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes), \
+			VENUS_DMA_ALIGNMENT);  \
+			_size = _size * num_vpp_pipes;   \
+		}              \
+		else \
+			_size = 0;     \
+	} while (0)
+
+#define VP9_NUM_FRAME_INFO_BUF 32
+#define VP9_NUM_PROBABILITY_TABLE_BUF (VP9_NUM_FRAME_INFO_BUF + 4)
+#define VP9_PROB_TABLE_SIZE (3840)
+#define VP9_FRAME_INFO_BUF_SIZE (6144)
+
+#define VP9_UDC_HEADER_BUF_SIZE (3 * 128)
+#define MAX_SUPERFRAME_HEADER_LEN (34)
+#define CCE_TILE_OFFSET_SIZE HFI_ALIGN(32 * 4 * 4, BUFFER_ALIGNMENT_32_BYTES)
+
+#define HFI_BUFFER_PERSIST_VP9D(_size) \
+	(_size = HFI_ALIGN(VP9_NUM_PROBABILITY_TABLE_BUF * VP9_PROB_TABLE_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(HFI_IRIS3_VP9D_COMV_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(MAX_SUPERFRAME_HEADER_LEN, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(VP9_UDC_HEADER_BUF_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(VP9_NUM_FRAME_INFO_BUF * \
+	CCE_TILE_OFFSET_SIZE, VENUS_DMA_ALIGNMENT) + \
+	HFI_ALIGN(VP9_NUM_FRAME_INFO_BUF * VP9_FRAME_INFO_BUF_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HDR10_HIST_EXTRADATA_SIZE)
+
+#define HFI_BUFFER_LINE_MP2D(_size, frame_width, frame_height, \
+_yuv_bufcount_min, is_opb, num_vpp_pipes)           \
+	do { \
+		HFI_U32 vpss_lb_size = 0;     \
+		_size = HFI_ALIGN(SIZE_VPXD_LB_FE_LEFT_CTRL(frame_width, \
+		frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_LEFT_CTRL(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_MP2D_LB_VSP_TOP(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) + HFI_ALIGN(SIZE_VPXD_LB_FE_TOP_CTRL\
+		(frame_width, frame_height), VENUS_DMA_ALIGNMENT) + \
+		2 * HFI_ALIGN(SIZE_VPXD_LB_RECON_DMA_METADATA_WR(frame_width,\
+		frame_height), VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_TOP_CTRL(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_MP2D_LB_PE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_MP2D_LB_FE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT); \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height, \
+						num_vpp_pipes); \
+		} \
+		_size += vpss_lb_size; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_MP2D(_size, frame_width, frame_height, is_interlaced) 0
+
+#define QMATRIX_SIZE (sizeof(HFI_U32) * 128 + 256)
+#define MP2D_QPDUMP_SIZE 115200
+#define HFI_BUFFER_PERSIST_MP2D(_size) \
+	(_size = QMATRIX_SIZE + MP2D_QPDUMP_SIZE;)
+
+#define AV1D_LCU_MAX_SIZE_PELS 128
+#define AV1D_LCU_MIN_SIZE_PELS 64
+#define AV1D_MAX_TILE_COLS     64
+
+#define HFI_BUFFER_COMV_AV1D(_size, frame_width, frame_height, \
+				_comv_bufcount) \
+	do { \
+		_size = 2 * HFI_ALIGN(MAX(((frame_width + 63) / 64) * \
+				((frame_height + 63) / 64) * 512, \
+				((frame_width + 127) / 128) * \
+				((frame_height + 127) / 128) * 2816), \
+				VENUS_DMA_ALIGNMENT); \
+		_size *= _comv_bufcount; \
+	} while (0)
+
+#define SIZE_AV1D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	(HFI_ALIGN(frame_width, AV1D_LCU_MAX_SIZE_PELS) * ((16 * 10) >> 3) + \
+	HFI_ALIGN(frame_width, AV1D_LCU_MAX_SIZE_PELS) / 2 * ((16 * 6) >> 3) * 2)
+
+#define SIZE_AV1D_LB_FE_LEFT_DATA(frame_width, frame_height) \
+	(32 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 16) + \
+	16 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / 2 + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 8) * 2 + \
+	24 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 16) + \
+	24 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / 2 + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 12) * 2 + \
+	24 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 16) + \
+	16 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 16) + \
+	16 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / 2 + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 12) * 2)
+
+#define SIZE_AV1D_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(10 * ((frame_width + AV1D_LCU_MIN_SIZE_PELS - 1) / \
+		AV1D_LCU_MIN_SIZE_PELS) * 128 / 8)
+
+#define SIZE_AV1D_LB_FE_LEFT_CTRL(frame_width, frame_height) \
+	(16 * ((HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / 16) + \
+	(HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+	AV1D_LCU_MIN_SIZE_PELS)) + \
+	3 * 16 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+	AV1D_LCU_MIN_SIZE_PELS))
+
+#define SIZE_AV1D_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	(((frame_width + 7) / 8) * 16)
+
+#define SIZE_AV1D_LB_SE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX(((frame_height + 15) / 16) * MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE, \
+	MAX(((frame_height + 31) / 32) * MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 63) / 64) * MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE)))
+
+#define SIZE_AV1D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	(MAX(((frame_width + 15) / 16) * MAX_PE_NBR_DATA_LCU16_LINE_BUFFER_SIZE, \
+	MAX(((frame_width + 31) / 32) * MAX_PE_NBR_DATA_LCU32_LINE_BUFFER_SIZE, \
+	((frame_width + 63) / 64) * MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE)))
+
+#define SIZE_AV1D_LB_VSP_TOP(frame_width, frame_height) \
+	(MAX(((frame_width + 63) / 64) * 1280, ((frame_width + 127) / 128) * 2304))
+
+#define SIZE_AV1D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	((HFI_ALIGN(frame_height, 8) / (4 / 2)) * 64)
+
+#define SIZE_AV1D_QP(frame_width, frame_height) \
+	SIZE_H264D_QP(frame_width, frame_height)
+
+#define SIZE_AV1D_LB_OPB_WR1_NV12_UBWC(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 y_width, y_width_a = 128; \
+		HFI_NV12_IL_CALC_Y_STRIDE(y_width, frame_width, y_width_a); \
+		_size = (256 * ((y_width + 31) / 32 + (AV1D_MAX_TILE_COLS - 1))); \
+	} while (0)
+
+#define SIZE_AV1D_LB_OPB_WR1_TP10_UBWC(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 y_width, y_width_a = 256; \
+		HFI_YUV420_TP10_CALC_Y_STRIDE(y_width, frame_width, y_width_a); \
+		_size = (256 * ((y_width + 47) / 48 + (AV1D_MAX_TILE_COLS - 1))); \
+	} while (0)
+
+#define SIZE_AV1D_IBC_NV12_UBWC(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 y_width_a = 128, y_height_a = 32; \
+		HFI_U32 uv_width_a = 128, uv_height_a = 32; \
+		HFI_U32 yBufSize, uvBufSize, y_width, y_height, uv_width, uv_height; \
+		HFI_U32 y_meta_width_a = 64, y_meta_height_a = 16; \
+		HFI_U32 uv_meta_width_a = 64, uv_meta_height_a = 16; \
+		HFI_U32 meta_height, meta_stride, meta_size; \
+		HFI_U32 tile_width_y = HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH; \
+		HFI_U32 tile_height_y = HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT; \
+		HFI_U32 tile_width_uv = HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_WIDTH; \
+		HFI_U32 tile_height_uv = \
+		    HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_HEIGHT; \
+		HFI_NV12_IL_CALC_Y_STRIDE(y_width, frame_width, y_width_a); \
+		HFI_NV12_IL_CALC_Y_BUFHEIGHT(y_height, frame_height, y_height_a); \
+		HFI_NV12_IL_CALC_UV_STRIDE(uv_width, frame_width, uv_width_a); \
+		HFI_NV12_IL_CALC_UV_BUFHEIGHT(uv_height, frame_height, uv_height_a); \
+		HFI_NV12_UBWC_IL_CALC_Y_BUF_SIZE(yBufSize, y_width, y_height); \
+		HFI_NV12_UBWC_IL_CALC_UV_BUF_SIZE(uvBufSize, uv_width, uv_height); \
+		_size = yBufSize + uvBufSize; \
+		HFI_UBWC_CALC_METADATA_PLANE_STRIDE(meta_stride, frame_width, \
+							y_meta_width_a, tile_width_y); \
+		HFI_UBWC_METADATA_PLANE_BUFHEIGHT(meta_height, frame_height, \
+							y_meta_height_a, tile_height_y); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size, \
+							meta_stride, meta_height); \
+		_size += meta_size; \
+		HFI_UBWC_UV_METADATA_PLANE_STRIDE(meta_stride, frame_width, \
+						uv_meta_width_a, tile_width_uv); \
+		HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(meta_height, frame_height, \
+						uv_meta_height_a, tile_height_uv); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size, \
+						meta_stride, meta_height); \
+		_size += meta_size; \
+	} while (0)
+
+#define SIZE_AV1D_IBC_TP10_UBWC(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 y_width_a = 256, y_height_a = 16, \
+			uv_width_a = 256, uv_height_a = 16; \
+		HFI_U32 yBufSize, uvBufSize, y_width, y_height, uv_width, uv_height; \
+		HFI_U32 y_meta_width_a = 64, y_meta_height_a = 16, \
+			uv_meta_width_a = 64, uv_meta_height_a = 16; \
+		HFI_U32 meta_height, meta_stride, meta_size; \
+		HFI_U32 tile_width_y = HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_WIDTH; \
+		HFI_U32 tile_height_y = HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_HEIGHT; \
+		HFI_U32 tile_width_uv = HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_WIDTH; \
+		HFI_U32 tile_height_uv = \
+			HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_HEIGHT; \
+		HFI_YUV420_TP10_CALC_Y_STRIDE(y_width, frame_width, y_width_a); \
+		HFI_YUV420_TP10_CALC_Y_BUFHEIGHT(y_height, frame_height, y_height_a); \
+		HFI_YUV420_TP10_CALC_UV_STRIDE(uv_width, frame_width, uv_width_a); \
+		HFI_YUV420_TP10_CALC_UV_BUFHEIGHT(uv_height, frame_height, \
+						uv_height_a); \
+		HFI_YUV420_TP10_UBWC_CALC_Y_BUF_SIZE(yBufSize, y_width, y_height); \
+		HFI_YUV420_TP10_UBWC_CALC_UV_BUF_SIZE(uvBufSize, uv_width, uv_height); \
+		_size = yBufSize + uvBufSize; \
+		HFI_UBWC_CALC_METADATA_PLANE_STRIDE(meta_stride, frame_width, \
+			y_meta_width_a, tile_width_y); \
+		HFI_UBWC_METADATA_PLANE_BUFHEIGHT(meta_height, frame_height, \
+			y_meta_height_a, tile_height_y); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size, \
+			meta_stride, meta_height); \
+		_size += meta_size; \
+		HFI_UBWC_UV_METADATA_PLANE_STRIDE(meta_stride, frame_width, \
+			uv_meta_width_a, tile_width_uv); \
+		HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(meta_height, frame_height, \
+			uv_meta_height_a, tile_height_uv); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size, \
+			meta_stride, meta_height); \
+		_size += meta_size; \
+	} while (0)
+
+#define HFI_BUFFER_LINE_AV1D(_size, frame_width, frame_height, isOPB, \
+			num_vpp_pipes) \
+	do { \
+		HFI_U32 vpssLBSize, opbwr1BufSize, opbwr8, opbwr10; \
+		_size = HFI_ALIGN(SIZE_AV1D_LB_FE_TOP_DATA(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_FE_TOP_CTRL(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_FE_LEFT_DATA(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_AV1D_LB_FE_LEFT_CTRL(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_AV1D_LB_SE_LEFT_CTRL(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_AV1D_LB_SE_TOP_CTRL(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_PE_TOP_DATA(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_VSP_TOP(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_RECON_DMA_METADATA_WR(frame_width, \
+				frame_height), \
+			VENUS_DMA_ALIGNMENT) * 2 + \
+			HFI_ALIGN(SIZE_AV1D_QP(frame_width, frame_height), \
+			VENUS_DMA_ALIGNMENT); \
+		SIZE_AV1D_LB_OPB_WR1_NV12_UBWC(opbwr8, frame_width, frame_height); \
+		SIZE_AV1D_LB_OPB_WR1_TP10_UBWC(opbwr10, frame_width, frame_height); \
+		opbwr1BufSize = MAX(opbwr8, opbwr10); \
+		_size = HFI_ALIGN((_size + opbwr1BufSize), VENUS_DMA_ALIGNMENT); \
+		if (isOPB) { \
+			SIZE_VPSS_LB(vpssLBSize, frame_width, frame_height, num_vpp_pipes); \
+			_size = HFI_ALIGN((_size + vpssLBSize), VENUS_DMA_ALIGNMENT); \
+		} \
+	} while (0)
+
+#define HFI_BUFFER_IBC_AV1D(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 ibc8, ibc10; \
+		SIZE_AV1D_IBC_NV12_UBWC(ibc8, frame_width, frame_height); \
+		SIZE_AV1D_IBC_TP10_UBWC(ibc10, frame_width, frame_height); \
+		_size = HFI_ALIGN(MAX(ibc8, ibc10), VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define AV1_CABAC_HDR_RATIO_HD_TOT 2
+#define AV1_CABAC_RES_RATIO_HD_TOT 2
+/* some content need more bin buffer,
+ * but limit buffer size for high resolution
+ */
+#define SIZE_AV1D_HW_BIN_BUFFER(_size, frame_width, frame_height, delay, \
+				num_vpp_pipes) \
+	do { \
+		HFI_U32 size_yuv, size_bin_hdr, size_bin_res; \
+		size_yuv = ((frame_width * frame_height) <= BIN_BUFFER_THRESHOLD) ? \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) : \
+			((frame_width * frame_height * 3) >> 1); \
+		size_bin_hdr = size_yuv * AV1_CABAC_HDR_RATIO_HD_TOT; \
+		size_bin_res = size_yuv * AV1_CABAC_RES_RATIO_HD_TOT; \
+		size_bin_hdr = size_bin_hdr * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2; \
+		size_bin_res = size_bin_res * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2; \
+		size_bin_hdr = HFI_ALIGN(size_bin_hdr / num_vpp_pipes, \
+					 VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		size_bin_res = HFI_ALIGN(size_bin_res / num_vpp_pipes, \
+					 VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		_size = size_bin_hdr + size_bin_res; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_AV1D(_size, frame_width, frame_height, isInterlaced, \
+				delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 nAlignedW = HFI_ALIGN(frame_width, BUFFER_ALIGNMENT_16_BYTES); \
+		HFI_U32 nAlignedH = HFI_ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES); \
+		if (!isInterlaced) { \
+			SIZE_AV1D_HW_BIN_BUFFER(_size, nAlignedW, nAlignedH, \
+						delay, num_vpp_pipes); \
+		} else { \
+			_size = 0; \
+		} \
+	} while (0)
+
+#define AV1D_NUM_HW_PIC_BUF    16
+#define AV1D_NUM_FRAME_HEADERS 16
+
+#define SIZE_AV1D_SEQUENCE_HEADER 768
+#define SIZE_AV1D_METADATA        512
+#define SIZE_AV1D_FRAME_HEADER    1280
+#define SIZE_AV1D_TILE_OFFSET     65536
+#define SIZE_AV1D_QM              3328
+#define SIZE_AV1D_PROB_TABLE      22784
+
+#define AV1D_SIZE_BSE_COL_MV_64x64 512
+#define AV1D_SIZE_BSE_COL_MV_128x128 2816
+#define SIZE_AV1D_COL_MV MAX((((8192 + 63) / 64) * ((4352 + 63) / 64) *        \
+				AV1D_SIZE_BSE_COL_MV_64x64),                   \
+				(((8192 + 127) / 128) * ((4352 + 127) / 128) * \
+				AV1D_SIZE_BSE_COL_MV_128x128))
+
+#define HFI_BUFFER_PERSIST_AV1D(_size, max_width, max_height, total_ref_count) \
+	do { \
+		HFI_U32 comv_size; \
+		HFI_BUFFER_COMV_AV1D(comv_size, max_width, max_height, total_ref_count); \
+		_size = \
+		HFI_ALIGN((SIZE_AV1D_SEQUENCE_HEADER * 2 + \
+		SIZE_AV1D_METADATA + \
+		AV1D_NUM_HW_PIC_BUF * (SIZE_AV1D_TILE_OFFSET + SIZE_AV1D_QM) + \
+		AV1D_NUM_FRAME_HEADERS * (SIZE_AV1D_FRAME_HEADER + \
+		2 * SIZE_AV1D_PROB_TABLE) + \
+		comv_size + HDR10_HIST_EXTRADATA_SIZE + \
+		SIZE_AV1D_METADATA * AV1D_NUM_HW_PIC_BUF), VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define HFI_BUFFER_BITSTREAM_ENC(size, frame_width, frame_height, \
+			rc_type, is_ten_bit) \
+	do { \
+		HFI_U32 aligned_width, aligned_height, bitstream_size, yuv_size; \
+		aligned_width = HFI_ALIGN(frame_width, 32); \
+		aligned_height = HFI_ALIGN(frame_height, 32); \
+		bitstream_size = aligned_width * aligned_height * 3; \
+		yuv_size = (aligned_width * aligned_height * 3) >> 1; \
+		if (aligned_width * aligned_height > (4096 * 2176)) { \
+		    /* bitstream_size = 0.25 * yuv_size; */ \
+			bitstream_size = (bitstream_size >> 3); \
+		} \
+		else if (aligned_width * aligned_height > (1280 * 720)) { \
+		    /* bitstream_size = 0.5 * yuv_size; */ \
+			bitstream_size = (bitstream_size >> 2); \
+		} else { \
+		    /* bitstream_size = 2 * yuv_size; */ \
+		} \
+		if (((rc_type == HFI_RC_CQ) || (rc_type == HFI_RC_OFF)) \
+			&& (bitstream_size < yuv_size))  { \
+			bitstream_size = (bitstream_size << 1);\
+		} \
+		if (is_ten_bit) { \
+			bitstream_size = (bitstream_size) + \
+					(bitstream_size >> 2); \
+		} \
+		size = HFI_ALIGN(bitstream_size, HFI_ALIGNMENT_4096); \
+	} while (0)
+
+#define HFI_IRIS3_ENC_TILE_SIZE_INFO(tile_size, tile_count, last_tile_size, \
+				frame_width_coded, codec_standard, num_vpp_pipes) \
+	do { \
+		HFI_U32 without_tile_enc_width, min_tile_size, fixed_tile_width; \
+		if (num_vpp_pipes == 4) { \
+			min_tile_size = 352; \
+			fixed_tile_width = 960; \
+		} \
+		else if (num_vpp_pipes == 2) { \
+			min_tile_size = 256; \
+			fixed_tile_width = 768; \
+		} \
+		else { \
+			min_tile_size = 256; \
+			fixed_tile_width = 672; \
+		} \
+		without_tile_enc_width = min_tile_size + fixed_tile_width; \
+		if ((codec_standard == HFI_CODEC_ENCODE_HEVC) && \
+			(frame_width_coded > without_tile_enc_width)) { \
+			tile_size = fixed_tile_width; \
+			tile_count = (frame_width_coded + tile_size - 1) / tile_size; \
+			last_tile_size = (frame_width_coded - (tile_size * (tile_count - 1))); \
+			if (last_tile_size < min_tile_size) { \
+				tile_count -= 1; \
+				last_tile_size = (tile_size + min_tile_size); \
+			} \
+		} else { \
+			tile_size = frame_width_coded; \
+			tile_count = 1; \
+			last_tile_size = 0; \
+		} \
+	} while (0)
+
+#define HFI_IRIS3_ENC_MB_BASED_MULTI_SLICE_COUNT(total_slice_count, frame_width, frame_height, \
+			codec_standard, multi_slice_max_mb_count, num_vpp_pipes) \
+	do { \
+		HFI_U32 tile_size, tile_count, last_tile_size, \
+			slice_count_per_tile, slice_count_in_last_tile; \
+		HFI_U32 mbs_in_one_tile, mbs_in_last_tile; \
+		HFI_U32 frame_width_coded, frame_height_coded, lcu_size; \
+		lcu_size = (codec_standard == HFI_CODEC_ENCODE_HEVC) ? 32 : 16; \
+		frame_width_coded = HFI_ALIGN(frame_width, lcu_size); \
+		frame_height_coded = HFI_ALIGN(frame_height, lcu_size); \
+		HFI_IRIS3_ENC_TILE_SIZE_INFO(tile_size, tile_count, last_tile_size, \
+			frame_width_coded, codec_standard, num_vpp_pipes); \
+		mbs_in_one_tile = (tile_size * frame_height_coded) / (lcu_size * lcu_size); \
+		slice_count_per_tile = \
+			(mbs_in_one_tile + multi_slice_max_mb_count - 1) / \
+			(multi_slice_max_mb_count); \
+		if (last_tile_size) { \
+			mbs_in_last_tile = \
+				(last_tile_size * frame_height_coded) / (lcu_size * lcu_size); \
+			slice_count_in_last_tile = \
+				(mbs_in_last_tile + multi_slice_max_mb_count - 1) / \
+				(multi_slice_max_mb_count); \
+			total_slice_count = \
+				(slice_count_per_tile * (tile_count - 1)) + \
+				slice_count_in_last_tile; \
+		} else { \
+			total_slice_count = (slice_count_per_tile * tile_count); \
+		} \
+	} while (0)
+
+#define SIZE_ROI_METADATA_ENC(size_roi, frame_width, frame_height, lcu_size)\
+	do { \
+		HFI_U32 width_in_lcus = 0, height_in_lcus = 0, n_shift = 0;    \
+		HFI_U32 n_lcu_size = lcu_size;              \
+		while (n_lcu_size && !(n_lcu_size & 0x1)) { \
+			n_shift++;                          \
+			n_lcu_size = n_lcu_size >> 1;       \
+		}                                           \
+		width_in_lcus = (frame_width + (lcu_size - 1)) >> n_shift; \
+		height_in_lcus = (frame_height + (lcu_size - 1)) >> n_shift;  \
+		size_roi = (((width_in_lcus + 7) >> 3) << 3) * \
+					height_in_lcus * 2 + 256; \
+	} while (0)
+
+#define HFI_BUFFER_INPUT_METADATA_ENC(size, frame_width, frame_height, \
+				is_roi_enabled, lcu_size) \
+	do { \
+		HFI_U32 roi_size = 0; \
+		if (is_roi_enabled) { \
+			SIZE_ROI_METADATA_ENC(roi_size, frame_width, \
+				frame_height, lcu_size); \
+		} \
+		size = roi_size + 16384; \
+		size = HFI_ALIGN(size, HFI_ALIGNMENT_4096); \
+	} while (0)
+
+#define HFI_BUFFER_INPUT_METADATA_H264E(size_metadata, frame_width, \
+		frame_height, is_roi_enabled)    \
+	do { \
+		HFI_BUFFER_INPUT_METADATA_ENC(size_metadata, frame_width, \
+			frame_height, is_roi_enabled, 16); \
+	} while (0)
+
+#define HFI_BUFFER_INPUT_METADATA_H265E(size_metadata, frame_width, \
+		frame_height, is_roi_enabled)    \
+	do { \
+		HFI_BUFFER_INPUT_METADATA_ENC(size_metadata, frame_width, \
+			frame_height, is_roi_enabled, 32); \
+	} while (0)
+
+#define HFI_BUFFER_ARP_ENC(size) \
+	do { \
+		size = 204800; \
+	} while (0)
+
+#define HFI_MAX_COL_FRAME 6
+#define HFI_VENUS_VENC_TRE_WB_BUFF_SIZE (65 << 4) // bytes
+#define HFI_VENUS_VENC_DB_LINE_BUFF_PER_MB 512
+#define HFI_VENUS_VPPSG_MAX_REGISTERS 2048
+#define HFI_VENUS_WIDTH_ALIGNMENT 128
+#define HFI_VENUS_WIDTH_TEN_BIT_ALIGNMENT 192
+#define HFI_VENUS_HEIGHT_ALIGNMENT 32
+#define VENUS_METADATA_STRIDE_MULTIPLE 64
+#define VENUS_METADATA_HEIGHT_MULTIPLE 16
+
+#ifndef SYSTEM_LAL_TILE10
+#define SYSTEM_LAL_TILE10 192
+#endif
+
+#define HFI_IRIS3_ENC_RECON_BUF_COUNT(num_recon, n_bframe, ltr_count, \
+	_total_hp_layers, _total_hb_layers, hybrid_hp, codec_standard) \
+	do { \
+		HFI_U32 num_ref = 1; \
+		if (n_bframe) \
+			num_ref = 2; \
+		if (_total_hp_layers > 1) { \
+			if (hybrid_hp) \
+				num_ref = (_total_hp_layers + 1) >> 1; \
+			else if (codec_standard == HFI_CODEC_ENCODE_HEVC) \
+				num_ref = (_total_hp_layers + 1) >> 1; \
+			else if (codec_standard == HFI_CODEC_ENCODE_AVC && \
+				_total_hp_layers < 4) \
+				num_ref = (_total_hp_layers - 1);  \
+			else \
+				num_ref = _total_hp_layers; \
+		} \
+		if (ltr_count) \
+			num_ref = num_ref + ltr_count; \
+		if (_total_hb_layers > 1) { \
+			if (codec_standard == HFI_CODEC_ENCODE_HEVC) \
+				num_ref = (_total_hb_layers); \
+			else if (codec_standard == HFI_CODEC_ENCODE_AVC) \
+				num_ref = (1 << (_total_hb_layers - 2)) + 1; \
+		} \
+		num_recon = num_ref + 1; \
+	} while (0)
+
+#define SIZE_BIN_BITSTREAM_ENC(_size, rc_type, frame_width, frame_height, \
+		work_mode, lcu_size, profile) \
+	do { \
+		HFI_U32 size_aligned_width = 0, size_aligned_height = 0; \
+		HFI_U32 bitstream_size_eval = 0; \
+		size_aligned_width = HFI_ALIGN((frame_width), lcu_size); \
+		size_aligned_height = HFI_ALIGN((frame_height), lcu_size); \
+		if (work_mode == HFI_WORKMODE_2) { \
+			if ((rc_type == HFI_RC_CQ) || (rc_type == HFI_RC_OFF)) { \
+				bitstream_size_eval = (((size_aligned_width) * \
+							(size_aligned_height) * 3) >> 1); \
+			} \
+			else { \
+				bitstream_size_eval = ((size_aligned_width) * \
+							(size_aligned_height) * 3); \
+				if (rc_type == HFI_RC_LOSSLESS) { \
+					bitstream_size_eval = (bitstream_size_eval * 3 >> 2); \
+				} \
+				else if ((size_aligned_width * size_aligned_height) > \
+					(4096 * 2176)) { \
+					bitstream_size_eval >>= 3; \
+				} \
+				else if ((size_aligned_width * size_aligned_height) > \
+					(480 * 320)) { \
+					bitstream_size_eval >>= 2; \
+				} \
+				if (profile == HFI_H265_PROFILE_MAIN_10 || \
+					profile == HFI_H265_PROFILE_MAIN_10_STILL_PICTURE) { \
+					bitstream_size_eval = (bitstream_size_eval * 5 >> 2); \
+				} \
+			} \
+		} else { \
+			bitstream_size_eval = size_aligned_width * \
+					size_aligned_height * 3; \
+		} \
+		_size = HFI_ALIGN(bitstream_size_eval, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define SIZE_ENC_SINGLE_PIPE(size, rc_type, bitbin_size, num_vpp_pipes, \
+			frame_width, frame_height, lcu_size) \
+	do { \
+		HFI_U32 size_single_pipe_eval = 0, sao_bin_buffer_size = 0, \
+			_padded_bin_sz = 0; \
+		HFI_U32 size_aligned_width = 0, size_aligned_height = 0; \
+		size_aligned_width = HFI_ALIGN((frame_width), lcu_size); \
+		size_aligned_height = HFI_ALIGN((frame_height), lcu_size); \
+		if ((size_aligned_width * size_aligned_height) > \
+			(3840 * 2160)) { \
+			size_single_pipe_eval = (bitbin_size / num_vpp_pipes); \
+		} \
+		else if (num_vpp_pipes > 2) { \
+			size_single_pipe_eval = bitbin_size / 2; \
+		} else { \
+			size_single_pipe_eval = bitbin_size; \
+		} \
+		if (rc_type == HFI_RC_LOSSLESS) { \
+			size_single_pipe_eval = (size_single_pipe_eval << 1); \
+		} \
+		sao_bin_buffer_size = (64 * ((((frame_width) + \
+				BUFFER_ALIGNMENT_32_BYTES) * ((frame_height) +\
+				BUFFER_ALIGNMENT_32_BYTES)) >> 10)) + 384; \
+		_padded_bin_sz = HFI_ALIGN(size_single_pipe_eval, \
+				VENUS_DMA_ALIGNMENT);\
+		size_single_pipe_eval = sao_bin_buffer_size + _padded_bin_sz; \
+		size_single_pipe_eval = HFI_ALIGN(size_single_pipe_eval, \
+				VENUS_DMA_ALIGNMENT); \
+		size = size_single_pipe_eval; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_ENC(_size, rc_type, frame_width, frame_height, lcu_size, \
+				work_mode, num_vpp_pipes, profile)           \
+	do { \
+		HFI_U32 bitstream_size = 0, total_bitbin_buffers = 0, \
+			size_single_pipe = 0, bitbin_size = 0; \
+		SIZE_BIN_BITSTREAM_ENC(bitstream_size, rc_type, frame_width, \
+			frame_height, work_mode, lcu_size, profile);         \
+		if (work_mode == HFI_WORKMODE_2) { \
+			total_bitbin_buffers = 3; \
+			bitbin_size = bitstream_size * 12 / 10; \
+			bitbin_size = HFI_ALIGN(bitbin_size, \
+				VENUS_DMA_ALIGNMENT); \
+		} \
+		else if ((lcu_size == 16) || (num_vpp_pipes > 1)) { \
+			total_bitbin_buffers = 1; \
+			bitbin_size = bitstream_size; \
+		} \
+		if (total_bitbin_buffers > 0) { \
+			SIZE_ENC_SINGLE_PIPE(size_single_pipe, rc_type, bitbin_size, \
+				num_vpp_pipes, frame_width, frame_height, lcu_size); \
+			bitbin_size = size_single_pipe * num_vpp_pipes; \
+			_size = HFI_ALIGN(bitbin_size, VENUS_DMA_ALIGNMENT) * \
+					total_bitbin_buffers + 512; \
+		} \
+		else \
+			/* Avoid 512 Bytes allocation in case of 1Pipe HEVC Direct Mode*/ \
+			_size = 0; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H264E(_size, rc_type, frame_width, frame_height, \
+				work_mode, num_vpp_pipes, profile)    \
+	do { \
+		HFI_BUFFER_BIN_ENC(_size, rc_type, frame_width, frame_height, 16, \
+				work_mode, num_vpp_pipes, profile); \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H265E(_size, rc_type, frame_width, frame_height, \
+				work_mode, num_vpp_pipes, profile)    \
+	do { \
+		HFI_BUFFER_BIN_ENC(_size, rc_type, frame_width, frame_height, 32,\
+				work_mode, num_vpp_pipes, profile); \
+	} while (0)
+
+#define SIZE_ENC_SLICE_INFO_BUF(num_lcu_in_frame) HFI_ALIGN((256 + \
+		(num_lcu_in_frame << 4)), VENUS_DMA_ALIGNMENT)
+#define SIZE_LINE_BUF_CTRL(frame_width_coded) \
+		HFI_ALIGN(frame_width_coded, VENUS_DMA_ALIGNMENT)
+#define SIZE_LINE_BUF_CTRL_ID2(frame_width_coded) \
+		HFI_ALIGN(frame_width_coded, VENUS_DMA_ALIGNMENT)
+
+#define SIZE_LINEBUFF_DATA(_size, is_ten_bit, frame_width_coded) \
+	do { \
+		_size = is_ten_bit ? (((((10 * (frame_width_coded) +\
+		 1024) + (VENUS_DMA_ALIGNMENT - 1)) & \
+		 (~(VENUS_DMA_ALIGNMENT - 1))) * 1) + \
+		(((((10 * (frame_width_coded) + 1024) >> 1) + \
+		(VENUS_DMA_ALIGNMENT - 1)) & (~(VENUS_DMA_ALIGNMENT - 1))) * \
+		2)) : (((((8 * (frame_width_coded) + 1024) + \
+		(VENUS_DMA_ALIGNMENT - 1)) \
+		& (~(VENUS_DMA_ALIGNMENT - 1))) * 1) + \
+		(((((8 * (frame_width_coded) +\
+		1024) >> 1) + (VENUS_DMA_ALIGNMENT - 1)) & \
+		(~(VENUS_DMA_ALIGNMENT - 1))) * 2)); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_CTRL(_size, standard, frame_height_coded, \
+				num_vpp_pipes_enc) \
+	do { \
+		_size = (standard == HFI_CODEC_ENCODE_HEVC) ? \
+			(((frame_height_coded) + \
+			(BUF_SIZE_ALIGN_32)) / BUF_SIZE_ALIGN_32 * 4 * 16) : \
+			(((frame_height_coded) + 15) / 16 * 5 * 16); \
+		if ((num_vpp_pipes_enc) > 1) { \
+			_size += BUFFER_ALIGNMENT_512_BYTES; \
+			_size = HFI_ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) *\
+				(num_vpp_pipes_enc); \
+		} \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_RECON_PIX(_size, is_ten_bit, frame_height_coded, \
+				num_vpp_pipes_enc) \
+	do { \
+		_size = (((is_ten_bit + 1) * 2 * (frame_height_coded) + \
+		VENUS_DMA_ALIGNMENT) + \
+		(VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1) & \
+		(~((VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1)) * 1; \
+	} while (0)
+
+#define SIZE_TOP_LINEBUFF_CTRL_FE(_size, frame_width_coded, standard) \
+	do { \
+		_size = (standard == HFI_CODEC_ENCODE_HEVC) ? (64 * \
+		((frame_width_coded) >> 5)) : (VENUS_DMA_ALIGNMENT + 16 * \
+		((frame_width_coded) >> 4)); \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_CTRL_FE(frame_height_coded, num_vpp_pipes_enc) \
+	((((VENUS_DMA_ALIGNMENT + 64 * ((frame_height_coded) >> 4)) +         \
+	   (VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1) &          \
+	  (~((VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1)) * 1) *  \
+	 num_vpp_pipes_enc)
+
+#define SIZE_LEFT_LINEBUFF_METADATA_RECON_Y(_size, frame_height_coded, \
+		is_ten_bit, num_vpp_pipes_enc) \
+	do { \
+		_size = ((VENUS_DMA_ALIGNMENT + 64 * ((frame_height_coded) / \
+		(8 * (is_ten_bit ? 4 : 8)))));   \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+		_size = (_size * num_vpp_pipes_enc); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_METADATA_RECON_UV(_size, frame_height_coded, \
+			is_ten_bit, num_vpp_pipes_enc) \
+	do { \
+		_size = ((VENUS_DMA_ALIGNMENT + 64 * ((frame_height_coded) / \
+				(4 * (is_ten_bit ? 4 : 8)))));    \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+		_size = (_size * num_vpp_pipes_enc); \
+	} while (0)
+
+#define SIZE_LINEBUFF_RECON_PIX(_size, is_ten_bit, frame_width_coded) \
+	do   { \
+		_size = ((is_ten_bit ? 3 : 2) * (frame_width_coded));         \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT);             \
+	} while (0)
+
+#define SIZE_SLICE_CMD_BUFFER (HFI_ALIGN(20480, VENUS_DMA_ALIGNMENT))
+#define SIZE_SPS_PPS_SLICE_HDR (2048 + 4096)
+
+#define SIZE_FRAME_RC_BUF_SIZE(_size, standard, frame_height_coded, \
+			num_vpp_pipes_enc) \
+	do { \
+		_size = (standard == HFI_CODEC_ENCODE_HEVC) ? (256 + 16 * \
+			(14 + ((((frame_height_coded) >> 5) + 7) >> 3))) : \
+			(256 + 16 * (14 + ((((frame_height_coded) >> 4) + 7) >> 3))); \
+		_size *= 11; \
+		if (num_vpp_pipes_enc > 1) { \
+			_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT) * \
+					num_vpp_pipes_enc;\
+		} \
+		_size = HFI_ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) * \
+				HFI_MAX_COL_FRAME; \
+	} while (0)
+
+#define ENC_BITCNT_BUF_SIZE(num_lcu_in_frame) HFI_ALIGN((256 + \
+		(4 * (num_lcu_in_frame))), VENUS_DMA_ALIGNMENT)
+#define ENC_BITMAP_BUF_SIZE(num_lcu_in_frame) HFI_ALIGN((256 + \
+		((num_lcu_in_frame) >> 3)), VENUS_DMA_ALIGNMENT)
+#define SIZE_LINE_BUF_SDE(frame_width_coded) HFI_ALIGN((256 + \
+		(16 * ((frame_width_coded) >> 4))), VENUS_DMA_ALIGNMENT)
+
+#define SIZE_BSE_SLICE_CMD_BUF ((((8192 << 2) + 7) & (~7)) * 3)
+
+#define SIZE_LAMBDA_LUT (256 * 11)
+#define SIZE_OVERRIDE_BUF(num_lcumb) (HFI_ALIGN(((16 * (((num_lcumb) + 7)\
+		>> 3))), VENUS_DMA_ALIGNMENT) * 2)
+#define SIZE_IR_BUF(num_lcu_in_frame) HFI_ALIGN((((((num_lcu_in_frame) << 1) + 7) &\
+	(~7)) * 3), VENUS_DMA_ALIGNMENT)
+
+#define SIZE_VPSS_LINE_BUF(num_vpp_pipes_enc, frame_height_coded, \
+			frame_width_coded) \
+	(HFI_ALIGN(((((((8192) >> 2) << 5) * (num_vpp_pipes_enc)) + 64) + \
+	(((((MAX((frame_width_coded), (frame_height_coded)) + 3) >> 2) << 5) +\
+	256) * 16)), VENUS_DMA_ALIGNMENT))
+
+#define SIZE_TOP_LINE_BUF_FIRST_STG_SAO(frame_width_coded) \
+	HFI_ALIGN((16 * ((frame_width_coded) >> 5)), VENUS_DMA_ALIGNMENT)
+
+#define HFI_BUFFER_LINE_ENC(_size, frame_width, frame_height, is_ten_bit, \
+			num_vpp_pipes_enc, lcu_size, standard) \
+	do { \
+		HFI_U32 width_in_lcus = 0, height_in_lcus = 0, \
+			frame_width_coded = 0, frame_height_coded = 0; \
+		HFI_U32 line_buff_data_size = 0, left_line_buff_ctrl_size = 0, \
+			left_line_buff_recon_pix_size = 0, \
+			top_line_buff_ctrl_fe_size = 0; \
+		HFI_U32 left_line_buff_metadata_recon__y__size = 0, \
+			left_line_buff_metadata_recon__uv__size = 0, \
+			line_buff_recon_pix_size = 0;          \
+		width_in_lcus = ((frame_width) + (lcu_size)-1) / (lcu_size); \
+		height_in_lcus = ((frame_height) + (lcu_size)-1) / (lcu_size); \
+		frame_width_coded = width_in_lcus * (lcu_size); \
+		frame_height_coded = height_in_lcus * (lcu_size); \
+		SIZE_LINEBUFF_DATA(line_buff_data_size, is_ten_bit, \
+			frame_width_coded);\
+		SIZE_LEFT_LINEBUFF_CTRL(left_line_buff_ctrl_size, standard, \
+			frame_height_coded, num_vpp_pipes_enc); \
+		SIZE_LEFT_LINEBUFF_RECON_PIX(left_line_buff_recon_pix_size, \
+			is_ten_bit, frame_height_coded, num_vpp_pipes_enc); \
+		SIZE_TOP_LINEBUFF_CTRL_FE(top_line_buff_ctrl_fe_size, \
+			frame_width_coded, standard); \
+		SIZE_LEFT_LINEBUFF_METADATA_RECON_Y\
+			(left_line_buff_metadata_recon__y__size, \
+			frame_height_coded, is_ten_bit, num_vpp_pipes_enc); \
+		SIZE_LEFT_LINEBUFF_METADATA_RECON_UV\
+			(left_line_buff_metadata_recon__uv__size, \
+			frame_height_coded, is_ten_bit, num_vpp_pipes_enc); \
+		SIZE_LINEBUFF_RECON_PIX(line_buff_recon_pix_size, is_ten_bit,\
+			frame_width_coded); \
+		_size = SIZE_LINE_BUF_CTRL(frame_width_coded) + \
+			SIZE_LINE_BUF_CTRL_ID2(frame_width_coded) + \
+			line_buff_data_size + \
+			left_line_buff_ctrl_size + \
+			left_line_buff_recon_pix_size + \
+			top_line_buff_ctrl_fe_size + \
+			left_line_buff_metadata_recon__y__size + \
+			left_line_buff_metadata_recon__uv__size + \
+			line_buff_recon_pix_size + \
+		SIZE_LEFT_LINEBUFF_CTRL_FE(frame_height_coded, \
+			num_vpp_pipes_enc) + SIZE_LINE_BUF_SDE(frame_width_coded) + \
+		SIZE_VPSS_LINE_BUF(num_vpp_pipes_enc, frame_height_coded, \
+			frame_width_coded) + \
+		SIZE_TOP_LINE_BUF_FIRST_STG_SAO(frame_width_coded); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H264E(_size, frame_width, frame_height, is_ten_bit, \
+		num_vpp_pipes)                   \
+	do { \
+		HFI_BUFFER_LINE_ENC(_size, frame_width, frame_height, 0, \
+			num_vpp_pipes, 16, HFI_CODEC_ENCODE_AVC); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H265E(_size, frame_width, frame_height, is_ten_bit, \
+			num_vpp_pipes)                          \
+	do { \
+		HFI_BUFFER_LINE_ENC(_size, frame_width, frame_height, \
+		is_ten_bit, num_vpp_pipes, 32, HFI_CODEC_ENCODE_HEVC); \
+	} while (0)
+
+#define HFI_BUFFER_COMV_ENC(_size, frame_width, frame_height, lcu_size, \
+			num_recon, standard) \
+	do { \
+		HFI_U32 size_colloc_mv = 0, size_colloc_rc = 0; \
+		HFI_U32 mb_width = ((frame_width) + 15) >> 4; \
+		HFI_U32 mb_height = ((frame_height) + 15) >> 4; \
+		HFI_U32 width_in_lcus = ((frame_width) + (lcu_size)-1) /\
+					(lcu_size); \
+		HFI_U32 height_in_lcus = ((frame_height) + (lcu_size)-1) / \
+					(lcu_size); \
+		HFI_U32 num_lcu_in_frame = width_in_lcus * height_in_lcus; \
+		size_colloc_mv = (standard == HFI_CODEC_ENCODE_HEVC) ? \
+		(16 * ((num_lcu_in_frame << 2) + BUFFER_ALIGNMENT_32_BYTES)) : \
+		(3 * 16 * (width_in_lcus * height_in_lcus +\
+		BUFFER_ALIGNMENT_32_BYTES)); \
+		size_colloc_mv = HFI_ALIGN(size_colloc_mv, \
+		VENUS_DMA_ALIGNMENT) * num_recon; \
+		size_colloc_rc = (((mb_width + 7) >> 3) * 16 * 2 * mb_height); \
+		size_colloc_rc = HFI_ALIGN(size_colloc_rc, \
+		VENUS_DMA_ALIGNMENT) * HFI_MAX_COL_FRAME; \
+		_size = size_colloc_mv + size_colloc_rc; \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H264E(_size, frame_width, frame_height, num_recon) \
+	do { \
+		HFI_BUFFER_COMV_ENC(_size, frame_width, frame_height, 16, \
+			num_recon, HFI_CODEC_ENCODE_AVC); \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H265E(_size, frame_width, frame_height, num_recon) \
+	do { \
+		HFI_BUFFER_COMV_ENC(_size, frame_width, frame_height, 32,\
+			num_recon, HFI_CODEC_ENCODE_HEVC); \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_ENC(_size, frame_width, frame_height, \
+			num_vpp_pipes_enc, lcu_size, standard) \
+	do { \
+		HFI_U32 width_in_lcus = 0, height_in_lcus = 0, \
+		frame_width_coded = 0, frame_height_coded = 0, \
+		num_lcu_in_frame = 0, num_lcumb = 0; \
+		HFI_U32	frame_rc_buf_size = 0; \
+		width_in_lcus = ((frame_width) + (lcu_size)-1) / (lcu_size); \
+		height_in_lcus = ((frame_height) + (lcu_size)-1) / (lcu_size); \
+		num_lcu_in_frame = width_in_lcus * height_in_lcus; \
+		frame_width_coded = width_in_lcus * (lcu_size); \
+		frame_height_coded = height_in_lcus * (lcu_size); \
+		num_lcumb = (frame_height_coded / lcu_size) * \
+		((frame_width_coded + lcu_size * 8) / lcu_size); \
+		SIZE_FRAME_RC_BUF_SIZE(frame_rc_buf_size, standard, \
+		frame_height_coded, num_vpp_pipes_enc); \
+		_size = SIZE_ENC_SLICE_INFO_BUF(num_lcu_in_frame) + \
+			   SIZE_SLICE_CMD_BUFFER + \
+			   SIZE_SPS_PPS_SLICE_HDR + \
+			   frame_rc_buf_size + \
+			   ENC_BITCNT_BUF_SIZE(num_lcu_in_frame) + \
+			   ENC_BITMAP_BUF_SIZE(num_lcu_in_frame) + \
+			   SIZE_BSE_SLICE_CMD_BUF + \
+			   SIZE_LAMBDA_LUT + \
+			   SIZE_OVERRIDE_BUF(num_lcumb) + \
+			   SIZE_IR_BUF(num_lcu_in_frame); \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_H264E(_size, frame_width, frame_height, \
+				num_vpp_pipes_enc) \
+	do { \
+		HFI_BUFFER_NON_COMV_ENC(_size, frame_width, frame_height, \
+				num_vpp_pipes_enc, 16, HFI_CODEC_ENCODE_AVC); \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_H265E(_size, frame_width, frame_height, \
+				num_vpp_pipes_enc) \
+	do { \
+		HFI_BUFFER_NON_COMV_ENC(_size, frame_width, frame_height, \
+			num_vpp_pipes_enc, 32, HFI_CODEC_ENCODE_HEVC); \
+	} while (0)
+
+#define SIZE_ENC_REF_BUFFER(size, frame_width, frame_height) \
+	do { \
+		HFI_U32 u_buffer_width = 0, u_buffer_height = 0, \
+			u_chroma_buffer_height = 0; \
+		u_buffer_height = HFI_ALIGN(frame_height, \
+			HFI_VENUS_HEIGHT_ALIGNMENT); \
+		u_chroma_buffer_height = frame_height >> 1; \
+		u_chroma_buffer_height = HFI_ALIGN(u_chroma_buffer_height, \
+			HFI_VENUS_HEIGHT_ALIGNMENT); \
+		u_buffer_width = HFI_ALIGN(frame_width, \
+			HFI_VENUS_WIDTH_ALIGNMENT); \
+		size = (u_buffer_height + u_chroma_buffer_height) * \
+			u_buffer_width; \
+	} while (0)
+
+#define SIZE_ENC_TEN_BIT_REF_BUFFER(size, frame_width, frame_height) \
+	do { \
+		HFI_U32 ref_buf_height = 0, ref_luma_stride_in_bytes = 0, \
+		u_ref_stride = 0, luma_size = 0, ref_chrm_height_in_bytes = 0, \
+		chroma_size = 0, ref_buf_size = 0; \
+		ref_buf_height = (frame_height + \
+		(HFI_VENUS_HEIGHT_ALIGNMENT - 1)) \
+		& (~(HFI_VENUS_HEIGHT_ALIGNMENT - 1)); \
+		ref_luma_stride_in_bytes = ((frame_width + \
+		SYSTEM_LAL_TILE10 - 1) / SYSTEM_LAL_TILE10) * \
+		SYSTEM_LAL_TILE10; \
+		u_ref_stride = 4 * (ref_luma_stride_in_bytes / 3); \
+		u_ref_stride = (u_ref_stride + (BUF_SIZE_ALIGN_128 - 1)) &\
+			(~(BUF_SIZE_ALIGN_128 - 1)); \
+		luma_size = ref_buf_height * u_ref_stride; \
+		ref_chrm_height_in_bytes = (((frame_height + 1) >> 1) + \
+			(BUF_SIZE_ALIGN_32 - 1)) & (~(BUF_SIZE_ALIGN_32 - 1)); \
+		chroma_size = u_ref_stride * ref_chrm_height_in_bytes; \
+		luma_size = (luma_size + (BUF_SIZE_ALIGN_4096 - 1)) & \
+			(~(BUF_SIZE_ALIGN_4096 - 1)); \
+		chroma_size = (chroma_size + (BUF_SIZE_ALIGN_4096 - 1)) & \
+			(~(BUF_SIZE_ALIGN_4096 - 1)); \
+		ref_buf_size = luma_size + chroma_size; \
+		size = ref_buf_size; \
+	} while (0)
+
+#define HFI_BUFFER_DPB_ENC(_size, frame_width, frame_height, is_ten_bit) \
+	do { \
+		HFI_U32 metadata_stride, metadata_buf_height, meta_size_y, \
+			meta_size_c; \
+		HFI_U32 ten_bit_ref_buf_size = 0, ref_buf_size = 0; \
+		if (!is_ten_bit) { \
+			SIZE_ENC_REF_BUFFER(ref_buf_size, frame_width, \
+				frame_height); \
+			HFI_UBWC_CALC_METADATA_PLANE_STRIDE(metadata_stride, \
+				(frame_width), 64, \
+				HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH); \
+			HFI_UBWC_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, \
+				(frame_height), 16, \
+				HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_y, \
+				metadata_stride, metadata_buf_height); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_c, \
+				metadata_stride, metadata_buf_height); \
+			_size = ref_buf_size + meta_size_y + meta_size_c; \
+		} else { \
+			SIZE_ENC_TEN_BIT_REF_BUFFER(ten_bit_ref_buf_size, \
+				frame_width, frame_height); \
+			HFI_UBWC_CALC_METADATA_PLANE_STRIDE(metadata_stride, \
+				frame_width, VENUS_METADATA_STRIDE_MULTIPLE, \
+			HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_WIDTH); \
+			HFI_UBWC_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, \
+				frame_height, VENUS_METADATA_HEIGHT_MULTIPLE, \
+			HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_HEIGHT); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_y, \
+				metadata_stride, metadata_buf_height); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_c, \
+				metadata_stride, metadata_buf_height); \
+			_size = ten_bit_ref_buf_size + meta_size_y + \
+				meta_size_c; \
+		} \
+	} while (0)
+
+#define HFI_BUFFER_DPB_H264E(_size, frame_width, frame_height) \
+	do { \
+		HFI_BUFFER_DPB_ENC(_size, frame_width, frame_height, 0); \
+	} while (0)
+
+#define HFI_BUFFER_DPB_H265E(_size, frame_width, frame_height, is_ten_bit) \
+	do { \
+		HFI_BUFFER_DPB_ENC(_size, frame_width, frame_height, is_ten_bit); \
+	} while (0)
+
+#define HFI_BUFFER_VPSS_ENC(vpss_size, dswidth, dsheight, ds_enable, blur, is_ten_bit) \
+	do { \
+		vpss_size = 0; \
+		if (ds_enable || blur) { \
+			HFI_BUFFER_DPB_ENC(vpss_size, dswidth, dsheight, is_ten_bit); \
+		} \
+	} while (0)
+
+#define HFI_IRIS3_ENC_MIN_INPUT_BUF_COUNT(numInput, TotalHBLayers) \
+	do { \
+		numInput = 3;                                             \
+		if (TotalHBLayers >= 2) { \
+			numInput = (1 << (TotalHBLayers - 1)) + 2;        \
+		}                                                         \
+	} while (0)
+
+#endif /* __HFI_BUFFER_IRIS3__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris3/inc/msm_vidc_buffer_iris3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris3/inc/msm_vidc_buffer_iris3.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_MSM_VIDC_BUFFER_IRIS3_H__
+#define __H_MSM_VIDC_BUFFER_IRIS3_H__
+
+#include "msm_vidc_inst.h"
+
+int msm_buffer_size_iris3(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type);
+int msm_buffer_min_count_iris3(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type);
+int msm_buffer_extra_count_iris3(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type);
+
+#endif // __H_MSM_VIDC_BUFFER_IRIS3_H__
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris3/inc/msm_vidc_iris3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris3/inc/msm_vidc_iris3.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_IRIS3_H_
+#define _MSM_VIDC_IRIS3_H_
+
+#include "msm_vidc_core.h"
+
+int msm_vidc_init_iris3(struct msm_vidc_core *core);
+int msm_vidc_adjust_bitrate_boost_iris3(void *instance, struct v4l2_ctrl *ctrl);
+
+#endif // _MSM_VIDC_IRIS3_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris3/inc/msm_vidc_power_iris3.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris3/inc/msm_vidc_power_iris3.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_MSM_VIDC_POWER_IRIS3_H__
+#define __H_MSM_VIDC_POWER_IRIS3_H__
+
+#include "msm_vidc_inst.h"
+#include "msm_vidc_power.h"
+
+#define ENABLE_LEGACY_POWER_CALCULATIONS  0
+
+u64 msm_vidc_calc_freq_iris3(struct msm_vidc_inst *inst, u32 data_size);
+int msm_vidc_calc_bw_iris3(struct msm_vidc_inst *inst,
+		struct vidc_bus_vote_data *vote_data);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris3/src/msm_vidc_buffer_iris3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris3/src/msm_vidc_buffer_iris3.c
@@ -0,0 +1,738 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_buffer_iris3.h"
+#include "msm_vidc_buffer.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_debug.h"
+#include "msm_media_info.h"
+#include "msm_vidc_platform.h"
+#include "hfi_property.h"
+#include "hfi_buffer_iris3.h"
+
+static u32 msm_vidc_decoder_bin_size_iris3(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes;
+	struct v4l2_format *f;
+	bool is_interlaced;
+	u32 vpp_delay;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	if (inst->decode_vpp_delay.enable)
+		vpp_delay = inst->decode_vpp_delay.size;
+	else
+		vpp_delay = DEFAULT_BSE_VPP_DELAY;
+	if (inst->capabilities[CODED_FRAMES].value ==
+			CODED_FRAMES_PROGRESSIVE)
+		is_interlaced = false;
+	else
+		is_interlaced = true;
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_BIN_H264D(size, width, height,
+			is_interlaced, vpp_delay, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_BIN_H265D(size, width, height,
+			0, vpp_delay, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_VP9)
+		HFI_BUFFER_BIN_VP9D(size, width, height,
+			0, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_AV1)
+		HFI_BUFFER_BIN_AV1D(size, width, height, is_interlaced,
+			0, num_vpp_pipes);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_comv_size_iris3(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, num_comv, vpp_delay;
+	struct v4l2_format *f;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_AV1) {
+		/*
+		 * AV1 requires larger COMV buffer size to meet performance
+		 * for certain use cases. Increase the COMV buffer size by
+		 * increasing COMV bufcount. Use lower count for 8k to
+		 * achieve performance but save memory.
+		 */
+		if (res_is_greater_than(width, height, 4096, 2176))
+			num_comv = inst->buffers.output.min_count + 3;
+		else
+			num_comv = inst->buffers.output.min_count + 7;
+	} else {
+		num_comv = inst->buffers.output.min_count;
+	}
+	msm_vidc_update_cap_value(inst, NUM_COMV, num_comv, __func__);
+
+	if (inst->codec == MSM_VIDC_HEIC
+		&& is_thumbnail_session(inst)) {
+		vpp_delay = 0;
+	} else {
+		if (inst->decode_vpp_delay.enable)
+			vpp_delay = inst->decode_vpp_delay.size;
+		else
+			vpp_delay = DEFAULT_BSE_VPP_DELAY;
+	}
+
+	num_comv = max(vpp_delay + 1, num_comv);
+	if (inst->codec == MSM_VIDC_H264) {
+		HFI_BUFFER_COMV_H264D(size, width, height, num_comv);
+	} else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC) {
+		HFI_BUFFER_COMV_H265D(size, width, height, num_comv);
+	} else if (inst->codec == MSM_VIDC_AV1) {
+		/*
+		 * When DRAP is enabled, COMV buffer is part of PERSIST buffer and
+		 * should not be allocated separately.
+		 * When DRAP is disabled, COMV buffer must be allocated.
+		 */
+		if (inst->capabilities[DRAP].value)
+			size = 0;
+		else
+			HFI_BUFFER_COMV_AV1D(size, width, height, num_comv);
+	}
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_non_comv_size_iris3(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes;
+	struct msm_vidc_core *core;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_NON_COMV_H264D(size, width, height, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_NON_COMV_H265D(size, width, height, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_line_size_iris3(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, out_min_count, num_vpp_pipes, vpp_delay;
+	struct v4l2_format *f;
+	bool is_opb;
+	u32 color_fmt;
+
+	core = inst->core;
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+
+	color_fmt = v4l2_colorformat_to_driver(inst,
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+	if (is_linear_colorformat(color_fmt))
+		is_opb = true;
+	else
+		is_opb = false;
+	/*
+	 * assume worst case, since color format is unknown at this
+	 * time.
+	 */
+	is_opb = true;
+
+	if (inst->decode_vpp_delay.enable)
+		vpp_delay = inst->decode_vpp_delay.size;
+	else
+		vpp_delay = DEFAULT_BSE_VPP_DELAY;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	out_min_count = inst->buffers.output.min_count;
+	out_min_count = max(vpp_delay + 1, out_min_count);
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_LINE_H264D(size, width, height, is_opb,
+			num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_LINE_H265D(size, width, height, is_opb,
+			num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_VP9)
+		HFI_BUFFER_LINE_VP9D(size, width, height, out_min_count,
+			is_opb, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_AV1)
+		HFI_BUFFER_LINE_AV1D(size, width, height, is_opb,
+			num_vpp_pipes);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_partial_data_size_iris3(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height;
+	struct v4l2_format *f;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_AV1)
+		HFI_BUFFER_IBC_AV1D(size, width, height);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_persist_size_iris3(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 rpu_enabled = 0;
+
+	if (inst->capabilities[META_DOLBY_RPU].value)
+		rpu_enabled = 1;
+
+	if (inst->codec == MSM_VIDC_H264) {
+		HFI_BUFFER_PERSIST_H264D(size, rpu_enabled);
+	} else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC) {
+		HFI_BUFFER_PERSIST_H265D(size, rpu_enabled);
+	} else if (inst->codec == MSM_VIDC_VP9) {
+		HFI_BUFFER_PERSIST_VP9D(size);
+	} else if (inst->codec == MSM_VIDC_AV1) {
+		/*
+		 * When DRAP is enabled, COMV buffer is part of PERSIST buffer and
+		 * should not be allocated separately. PERSIST buffer should include
+		 * COMV buffer calculated with width, height, refcount.
+		 * When DRAP is disabled, COMV buffer should not be included in PERSIST
+		 * buffer.
+		 */
+		if (inst->capabilities[DRAP].value)
+			HFI_BUFFER_PERSIST_AV1D(size,
+				inst->capabilities[FRAME_WIDTH].max,
+				inst->capabilities[FRAME_HEIGHT].max, 16);
+		else
+			HFI_BUFFER_PERSIST_AV1D(size, 0, 0, 0);
+	}
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_dpb_size_iris3(struct msm_vidc_inst *inst)
+{
+
+	u32 size = 0;
+	u32 color_fmt;
+	u32 width, height;
+	struct v4l2_format *f;
+
+	/*
+	 * For legacy codecs (non-AV1), DPB is calculated only
+	 * for linear formats. For AV1, DPB is needed for film-grain
+	 * enabled bitstreams (UBWC & linear).
+	 */
+	color_fmt = inst->capabilities[PIX_FMTS].value;
+	if (!is_linear_colorformat(color_fmt)) {
+		if (inst->codec != MSM_VIDC_AV1)
+			return size;
+
+		if (inst->codec == MSM_VIDC_AV1 &&
+			!inst->capabilities[FILM_GRAIN].value)
+			return size;
+	}
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (color_fmt == MSM_VIDC_FMT_NV12 ||
+		color_fmt == MSM_VIDC_FMT_NV12C) {
+		color_fmt = MSM_VIDC_FMT_NV12C;
+		HFI_NV12_UBWC_IL_CALC_BUF_SIZE_V2(size, width, height,
+			video_y_stride_bytes(color_fmt, width),
+			video_y_scanlines(color_fmt, height),
+			video_uv_stride_bytes(color_fmt, width),
+			video_uv_scanlines(color_fmt, height),
+			video_y_meta_stride(color_fmt, width),
+			video_y_meta_scanlines(color_fmt, height),
+			video_uv_meta_stride(color_fmt, width),
+			video_uv_meta_scanlines(color_fmt, height));
+	} else if (color_fmt == MSM_VIDC_FMT_P010 ||
+		color_fmt == MSM_VIDC_FMT_TP10C) {
+		color_fmt = MSM_VIDC_FMT_TP10C;
+		HFI_YUV420_TP10_UBWC_CALC_BUF_SIZE(size,
+			video_y_stride_bytes(color_fmt, width),
+			video_y_scanlines(color_fmt, height),
+			video_uv_stride_bytes(color_fmt, width),
+			video_uv_scanlines(color_fmt, height),
+			video_y_meta_stride(color_fmt, width),
+			video_y_meta_scanlines(color_fmt, height),
+			video_uv_meta_stride(color_fmt, width),
+			video_uv_meta_scanlines(color_fmt, height));
+	}
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+/* encoder internal buffers */
+static u32 msm_vidc_encoder_bin_size_iris3(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes, stage, profile;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	stage = inst->capabilities[STAGE].value;
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	profile = inst->capabilities[PROFILE].value;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_BIN_H264E(size, inst->hfi_rc_type, width,
+			height, stage, num_vpp_pipes, profile);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_BIN_H265E(size, inst->hfi_rc_type, width,
+			height, stage, num_vpp_pipes, profile);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_get_recon_buf_count(struct msm_vidc_inst *inst)
+{
+	u32 num_buf_recon = 0;
+	s32 n_bframe, ltr_count, hp_layers = 0, hb_layers = 0;
+	bool is_hybrid_hp = false;
+	u32 hfi_codec = 0;
+
+	n_bframe = inst->capabilities[B_FRAME].value;
+	ltr_count = inst->capabilities[LTR_COUNT].value;
+
+	if (inst->hfi_layer_type == HFI_HIER_B) {
+		hb_layers = inst->capabilities[ENH_LAYER_COUNT].value + 1;
+	} else {
+		hp_layers = inst->capabilities[ENH_LAYER_COUNT].value + 1;
+		if (inst->hfi_layer_type == HFI_HIER_P_HYBRID_LTR)
+			is_hybrid_hp = true;
+	}
+
+	if (inst->codec == MSM_VIDC_H264)
+		hfi_codec = HFI_CODEC_ENCODE_AVC;
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		hfi_codec = HFI_CODEC_ENCODE_HEVC;
+
+	HFI_IRIS3_ENC_RECON_BUF_COUNT(num_buf_recon, n_bframe, ltr_count,
+			hp_layers, hb_layers, is_hybrid_hp, hfi_codec);
+
+	return num_buf_recon;
+}
+
+static u32 msm_vidc_encoder_comv_size_iris3(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, num_recon = 0;
+	struct v4l2_format *f;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	num_recon = msm_vidc_get_recon_buf_count(inst);
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_COMV_H264E(size, width, height, num_recon);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_COMV_H265E(size, width, height, num_recon);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_non_comv_size_iris3(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_NON_COMV_H264E(size, width, height, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_NON_COMV_H265E(size, width, height, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_line_size_iris3(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, pixfmt, num_vpp_pipes;
+	bool is_tenbit = false;
+	struct v4l2_format *f;
+
+	core = inst->core;
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	pixfmt = inst->capabilities[PIX_FMTS].value;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	is_tenbit = (pixfmt == MSM_VIDC_FMT_P010 || pixfmt == MSM_VIDC_FMT_TP10C);
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_LINE_H264E(size, width, height, is_tenbit, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_LINE_H265E(size, width, height, is_tenbit, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_dpb_size_iris3(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, pixfmt;
+	struct v4l2_format *f;
+	bool is_tenbit;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	pixfmt = inst->capabilities[PIX_FMTS].value;
+	is_tenbit = (pixfmt == MSM_VIDC_FMT_P010 || pixfmt == MSM_VIDC_FMT_TP10C);
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_DPB_H264E(size, width, height);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_DPB_H265E(size, width, height, is_tenbit);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_arp_size_iris3(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+
+	HFI_BUFFER_ARP_ENC(size);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_vpss_size_iris3(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	bool ds_enable = false, is_tenbit = false, blur = false;
+	u32 rotation_val = HFI_ROTATION_NONE;
+	u32 width, height, driver_colorfmt;
+	struct v4l2_format *f;
+
+	ds_enable = is_scaling_enabled(inst);
+	msm_vidc_v4l2_to_hfi_enum(inst, ROTATION, &rotation_val);
+
+	f = &inst->fmts[OUTPUT_PORT];
+	if (is_rotation_90_or_270(inst)) {
+		/*
+		 * output width and height are rotated,
+		 * so unrotate them to use as arguments to
+		 * HFI_BUFFER_VPSS_ENC.
+		 */
+		width = f->fmt.pix_mp.height;
+		height = f->fmt.pix_mp.width;
+	} else {
+		width = f->fmt.pix_mp.width;
+		height = f->fmt.pix_mp.height;
+	}
+
+	f = &inst->fmts[INPUT_PORT];
+	driver_colorfmt = v4l2_colorformat_to_driver(inst,
+			f->fmt.pix_mp.pixelformat, __func__);
+	is_tenbit = is_10bit_colorformat(driver_colorfmt);
+	if (inst->capabilities[BLUR_TYPES].value != MSM_VIDC_BLUR_NONE)
+		blur = true;
+
+	HFI_BUFFER_VPSS_ENC(size, width, height, ds_enable, blur, is_tenbit);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_output_size_iris3(struct msm_vidc_inst *inst)
+{
+	u32 frame_size;
+	struct v4l2_format *f;
+	bool is_ten_bit = false;
+	int bitrate_mode, frame_rc;
+	u32 hfi_rc_type = HFI_RC_VBR_CFR;
+	enum msm_vidc_codec_type codec;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	codec = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+	if (codec == MSM_VIDC_HEVC || codec == MSM_VIDC_HEIC)
+		is_ten_bit = true;
+
+	bitrate_mode = inst->capabilities[BITRATE_MODE].value;
+	frame_rc = inst->capabilities[FRAME_RC_ENABLE].value;
+	if (!frame_rc && !is_image_session(inst))
+		hfi_rc_type = HFI_RC_OFF;
+	else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_CQ)
+		hfi_rc_type = HFI_RC_CQ;
+
+	HFI_BUFFER_BITSTREAM_ENC(frame_size, f->fmt.pix_mp.width,
+		f->fmt.pix_mp.height, hfi_rc_type, is_ten_bit);
+
+	frame_size = msm_vidc_enc_delivery_mode_based_output_buf_size(inst, frame_size);
+
+	return frame_size;
+}
+
+struct msm_vidc_buf_type_handle {
+	enum msm_vidc_buffer_type type;
+	u32 (*handle)(struct msm_vidc_inst *inst);
+};
+
+int msm_buffer_size_iris3(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int i;
+	u32 size = 0, buf_type_handle_size = 0;
+	const struct msm_vidc_buf_type_handle *buf_type_handle_arr = NULL;
+	static const struct msm_vidc_buf_type_handle dec_buf_type_handle[] = {
+		{MSM_VIDC_BUF_INPUT,           msm_vidc_decoder_input_size              },
+		{MSM_VIDC_BUF_OUTPUT,          msm_vidc_decoder_output_size             },
+		{MSM_VIDC_BUF_INPUT_META,      msm_vidc_decoder_input_meta_size         },
+		{MSM_VIDC_BUF_OUTPUT_META,     msm_vidc_decoder_output_meta_size        },
+		{MSM_VIDC_BUF_BIN,             msm_vidc_decoder_bin_size_iris3          },
+		{MSM_VIDC_BUF_COMV,            msm_vidc_decoder_comv_size_iris3         },
+		{MSM_VIDC_BUF_NON_COMV,        msm_vidc_decoder_non_comv_size_iris3     },
+		{MSM_VIDC_BUF_LINE,            msm_vidc_decoder_line_size_iris3         },
+		{MSM_VIDC_BUF_PERSIST,         msm_vidc_decoder_persist_size_iris3      },
+		{MSM_VIDC_BUF_DPB,             msm_vidc_decoder_dpb_size_iris3          },
+		{MSM_VIDC_BUF_PARTIAL_DATA,    msm_vidc_decoder_partial_data_size_iris3 },
+	};
+	static const struct msm_vidc_buf_type_handle enc_buf_type_handle[] = {
+		{MSM_VIDC_BUF_INPUT,           msm_vidc_encoder_input_size              },
+		{MSM_VIDC_BUF_OUTPUT,          msm_vidc_encoder_output_size_iris3       },
+		{MSM_VIDC_BUF_INPUT_META,      msm_vidc_encoder_input_meta_size         },
+		{MSM_VIDC_BUF_OUTPUT_META,     msm_vidc_encoder_output_meta_size        },
+		{MSM_VIDC_BUF_BIN,             msm_vidc_encoder_bin_size_iris3          },
+		{MSM_VIDC_BUF_COMV,            msm_vidc_encoder_comv_size_iris3         },
+		{MSM_VIDC_BUF_NON_COMV,        msm_vidc_encoder_non_comv_size_iris3     },
+		{MSM_VIDC_BUF_LINE,            msm_vidc_encoder_line_size_iris3         },
+		{MSM_VIDC_BUF_DPB,             msm_vidc_encoder_dpb_size_iris3          },
+		{MSM_VIDC_BUF_ARP,             msm_vidc_encoder_arp_size_iris3          },
+		{MSM_VIDC_BUF_VPSS,            msm_vidc_encoder_vpss_size_iris3         },
+	};
+
+	if (is_decode_session(inst)) {
+		buf_type_handle_size = ARRAY_SIZE(dec_buf_type_handle);
+		buf_type_handle_arr = dec_buf_type_handle;
+	} else if (is_encode_session(inst)) {
+		buf_type_handle_size = ARRAY_SIZE(enc_buf_type_handle);
+		buf_type_handle_arr = enc_buf_type_handle;
+	}
+
+	/* handle invalid session */
+	if (!buf_type_handle_arr || !buf_type_handle_size) {
+		i_vpr_e(inst, "%s: invalid session %d\n", __func__, inst->domain);
+		return size;
+	}
+
+	/* fetch buffer size */
+	for (i = 0; i < buf_type_handle_size; i++) {
+		if (buf_type_handle_arr[i].type == buffer_type) {
+			size = buf_type_handle_arr[i].handle(inst);
+			break;
+		}
+	}
+
+	/* handle unknown buffer type */
+	if (i == buf_type_handle_size) {
+		i_vpr_e(inst, "%s: unknown buffer type %#x\n", __func__, buffer_type);
+		goto exit;
+	}
+
+	i_vpr_l(inst, "buffer_size: type: %11s,  size: %9u\n", buf_name(buffer_type), size);
+
+exit:
+	return size;
+}
+
+static int msm_vidc_input_min_count_iris3(struct msm_vidc_inst *inst)
+{
+	u32 input_min_count = 0;
+	u32 total_hb_layer = 0;
+
+	if (is_decode_session(inst)) {
+		input_min_count = MIN_DEC_INPUT_BUFFERS;
+	} else if (is_encode_session(inst)) {
+		total_hb_layer = is_hierb_type_requested(inst) ?
+			inst->capabilities[ENH_LAYER_COUNT].value + 1 : 0;
+		if (inst->codec == MSM_VIDC_H264 &&
+			!inst->capabilities[LAYER_ENABLE].value) {
+			total_hb_layer = 0;
+		}
+		HFI_IRIS3_ENC_MIN_INPUT_BUF_COUNT(input_min_count,
+			total_hb_layer);
+	} else {
+		i_vpr_e(inst, "%s: invalid domain %d\n", __func__, inst->domain);
+		return 0;
+	}
+
+	if (is_thumbnail_session(inst) || is_image_session(inst))
+		input_min_count = 1;
+
+	return input_min_count;
+}
+
+static int msm_buffer_dpb_count(struct msm_vidc_inst *inst)
+{
+	int count = 0;
+	u32 color_fmt;
+
+	/* decoder dpb buffer count */
+	if (is_decode_session(inst)) {
+		color_fmt = inst->capabilities[PIX_FMTS].value;
+		if (is_linear_colorformat(color_fmt) ||
+                (inst->codec == MSM_VIDC_AV1 &&
+                (inst->capabilities[FILM_GRAIN].value))) {
+			count = inst->fw_min_count ?
+						inst->fw_min_count : inst->buffers.output.min_count;
+        }
+
+		return count;
+	}
+
+	/* encoder dpb buffer count */
+	return msm_vidc_get_recon_buf_count(inst);
+}
+
+static int msm_buffer_delivery_mode_based_min_count_iris3(struct msm_vidc_inst *inst,
+	uint32_t count)
+{
+	struct v4l2_format *f;
+	struct msm_vidc_core *core = NULL;
+	u32 width, height, total_num_slices = 1;
+	u32 hfi_codec = 0;
+	u32 max_mbs_per_slice = 0;
+	u32 slice_mode = 0;
+	u32 delivery_mode = 0;
+	u32 num_vpp_pipes;
+
+	slice_mode = inst->capabilities[SLICE_MODE].value;
+	delivery_mode = inst->capabilities[DELIVERY_MODE].value;
+
+	if (slice_mode != V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB ||
+		(!delivery_mode))
+		return count;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	max_mbs_per_slice = inst->capabilities[SLICE_MAX_MB].value;
+
+	if (inst->codec == MSM_VIDC_H264)
+		hfi_codec = HFI_CODEC_ENCODE_AVC;
+	else if (inst->codec == MSM_VIDC_HEVC)
+		hfi_codec = HFI_CODEC_ENCODE_HEVC;
+
+	core = inst->core;
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+
+	HFI_IRIS3_ENC_MB_BASED_MULTI_SLICE_COUNT(total_num_slices, width, height,
+			hfi_codec, max_mbs_per_slice, num_vpp_pipes);
+
+	return (total_num_slices * count);
+}
+
+int msm_buffer_min_count_iris3(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int count = 0;
+
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_INPUT:
+	case MSM_VIDC_BUF_INPUT_META:
+		count = msm_vidc_input_min_count_iris3(inst);
+		break;
+	case MSM_VIDC_BUF_OUTPUT:
+	case MSM_VIDC_BUF_OUTPUT_META:
+		count = msm_vidc_output_min_count(inst);
+		count = msm_buffer_delivery_mode_based_min_count_iris3(inst, count);
+		break;
+	case MSM_VIDC_BUF_BIN:
+	case MSM_VIDC_BUF_COMV:
+	case MSM_VIDC_BUF_NON_COMV:
+	case MSM_VIDC_BUF_LINE:
+	case MSM_VIDC_BUF_PERSIST:
+	case MSM_VIDC_BUF_ARP:
+	case MSM_VIDC_BUF_VPSS:
+	case MSM_VIDC_BUF_PARTIAL_DATA:
+		count = msm_vidc_internal_buffer_count(inst, buffer_type);
+		break;
+	case MSM_VIDC_BUF_DPB:
+		count = msm_buffer_dpb_count(inst);
+		break;
+	default:
+		break;
+	}
+
+	i_vpr_l(inst, "  min_count: type: %11s, count: %9u\n", buf_name(buffer_type), count);
+	return count;
+}
+
+int msm_buffer_extra_count_iris3(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int count = 0;
+
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_INPUT:
+	case MSM_VIDC_BUF_INPUT_META:
+		count = msm_vidc_input_extra_count(inst);
+		break;
+	case MSM_VIDC_BUF_OUTPUT:
+	case MSM_VIDC_BUF_OUTPUT_META:
+		count = msm_vidc_output_extra_count(inst);
+		break;
+	default:
+		break;
+	}
+
+	i_vpr_l(inst, "extra_count: type: %11s, count: %9u\n", buf_name(buffer_type), count);
+	return count;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris3/src/msm_vidc_bus_iris3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris3/src/msm_vidc_bus_iris3.c
@@ -0,0 +1,928 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_debug.h"
+#include "kalama_technology.h"
+
+static u32 calculate_number_lcus_kalama(u32 width, u32 height, u32 lcu_size)
+{
+	u32 mbs_width = (width % lcu_size) ?
+		(width / lcu_size + 1) : (width / lcu_size);
+	u32 mbs_height = (height % lcu_size) ?
+		(height / lcu_size + 1) : (height / lcu_size);
+
+	return mbs_width * mbs_height;
+}
+
+static u32 calculate_number_ubwctiles_kalama(
+		u32 width, u32 height, u32 tile_w, u32 tile_h)
+{
+	u32 tiles_width = (width % tile_w) ?
+		(width / tile_w + 1) : (width / tile_w);
+	u32 tiles_height = (height % tile_h) ?
+		(height / tile_h + 1) : (height / tile_h);
+
+	return tiles_width * tiles_height;
+}
+
+struct compression_factors {
+	u32 dpb_cf_y;
+	u32 dpb_cf_cbcr;
+	u32 opb_cf_ycbcr;
+	u32 dpb_cr_y;
+	u32 ipb_cr_y;
+	u32 ipb_cr;
+} compression_factor;
+
+static u32 get_compression_factors(struct compression_factors *compression_factor,
+		struct api_calculation_input codec_input)
+{
+	u8 cr_index_entry, cr_index_y, cr_index_c, cr_index_uni;
+	u32 frame_width;
+	u32 frame_height;
+
+	frame_width = codec_input.frame_width;
+	frame_height = codec_input.frame_height;
+	if (frame_width * frame_height <= 1920 * 1080)
+		cr_index_entry = 0;
+	else
+		cr_index_entry = 1;
+
+	if (codec_input.bitdepth == CODEC_BITDEPTH_8) {
+		/* NOT PWC or average and power case */
+		if (codec_input.complexity_setting != 0) {
+			cr_index_y = 0;
+			cr_index_c = 1;
+			cr_index_uni = 2;
+		} else {
+			cr_index_y = 3;
+			cr_index_c = 4;
+			cr_index_uni = 5;
+		}
+	} else {
+		/* NOT PWC or average and power case */
+		if (codec_input.complexity_setting != 0) {
+			cr_index_y = 6;
+			cr_index_c = 7;
+			cr_index_uni = 8;
+		} else {
+			cr_index_y = 9;
+			cr_index_c = 10;
+			cr_index_uni = 11;
+		}
+	}
+
+	if (codec_input.decoder_or_encoder == CODEC_DECODER) {
+		compression_factor->dpb_cf_y =
+			dpbopb_ubwc30_cr_table_cratio_kalama[cr_index_entry][cr_index_y];
+		compression_factor->dpb_cf_cbcr =
+			dpbopb_ubwc30_cr_table_cratio_kalama[cr_index_entry][cr_index_c];
+		compression_factor->opb_cf_ycbcr =
+			dpbopb_ubwc30_cr_table_cratio_kalama[cr_index_entry][cr_index_uni];
+
+		if ((codec_input.regression_mode == 3) &&
+			/* input cr numbers from interface */
+			((codec_input.cr_dpb != 0) || (codec_input.cr_opb != 0))) {
+			compression_factor->dpb_cf_y = (u32)(codec_input.cr_dpb * 100);
+			compression_factor->dpb_cf_cbcr = (u32)(codec_input.cr_dpb * 100);
+			compression_factor->opb_cf_ycbcr = (u32)(codec_input.cr_opb * 100);
+		}
+	} else { /* encoder */
+		/*
+		 * IPB CR Table Choice; static sheet (if framewidth<3840, use lossless table)
+		 * (else, use lossy table)
+		 * stick to this choice for SW purpose (no change for SW)
+		 */
+		if (frame_width < 3840) {
+			compression_factor->ipb_cr =
+				ipblossless_ubwc30_cr_table_cratio_kalama[cr_index_entry]
+					[cr_index_uni];
+			compression_factor->ipb_cr_y =
+				ipblossless_ubwc30_cr_table_cratio_kalama[cr_index_entry]
+					[cr_index_y];
+		} else {
+			compression_factor->ipb_cr =
+				ipblossy_ubwc30_cr_table_cratio_kalama[cr_index_entry]
+					[cr_index_uni];
+			compression_factor->ipb_cr_y =
+				ipblossy_ubwc30_cr_table_cratio_kalama[cr_index_entry]
+					[cr_index_y];
+		}
+
+		compression_factor->dpb_cf_y =
+			rpb_ubwc30_cr_table_cratio_kalama[cr_index_entry][cr_index_y];
+
+		compression_factor->dpb_cf_cbcr =
+			rpb_ubwc30_cr_table_cratio_kalama[cr_index_entry][cr_index_c];
+
+		if ((codec_input.regression_mode == 3) &&
+			/* input cr from interface */
+			((codec_input.cr_ipb != 0) || (codec_input.cr_rpb != 0))) {
+			compression_factor->dpb_cf_y = (u32)(codec_input.cr_rpb * 100);
+			compression_factor->dpb_cf_cbcr = (u32)(codec_input.cr_rpb * 100);
+			compression_factor->ipb_cr_y = (u32)(codec_input.cr_ipb * 100);
+		}
+	}
+
+	return 0;
+}
+
+static int calculate_bandwidth_decoder_iris3(
+		struct api_calculation_input codec_input,
+		struct api_calculation_bw_output *codec_output)
+{
+	/* common control parameters */
+	u32 frame_width;
+	u32 frame_height;
+	u32 frame_lcu_size = 16; /* initialized to h264 */
+	u32 lcu_per_frame;
+	u32 target_bitrate;
+	u32 collocated_bytes_per_lcu = 16; /* initialized to h264 */
+	u32 av1d_segment_read_per_lcu;
+	u32 av1d_fe_leftlinebuffer_perlcu_tileboudary;
+
+	u32 frame420_y_bw_linear_8bpp;
+	u32 frame420_y_bw_no_ubwc_tile_10bpp;
+	u32 frame420_y_bw_linear_10bpp;
+
+	u16 ubwc_tile_w;
+	u16 ubwc_tile_h;
+
+	u32 dpb_compression_factor_y;
+	u32 dpb_compression_factor_cbcr;
+
+	u32 reconstructed_write_bw_factor_rd;
+	u32 reference_y_read_bw_factor;
+	u32 reference_cbcr_read_bw_factor;
+
+	/* decoder control parameters */
+	u32 decoder_vsp_read_factor = 6;
+	u32 bins_to_bits_factor = 4;
+
+	u32 dpb_to_opb_ratios_ds = 1;
+
+	u8 llc_enabled_ref_y_rd = 1;
+	u8 llc_enable_ref_crcb_rd = 1;
+	u8 llc_enabled_bse_tlb = 1;
+	/* this is for 2pipe and 1pipe LLC */
+	u8 llc_enable_probtable_av1d_21pipe = 0;
+
+	u32 opb_compression_factor_ycbcr;
+	u32 dpb_ubwc_tile_width_pixels;
+	u32 dpb_ubwc_tile_height_pixels;
+	u32 decoder_frame_complexity_factor;
+	u32 llc_saving = 130; /* Initialized to H264 */
+
+	u16 av1_tile_numbers;
+	u32 av1_collated_seg_buffer_rd_wr;
+	/* need divide by 1M at later step; */
+	u32 av1_probability_table_rdwr_bytesperframe = 22784;
+	u32 av1_fe_left_line_buffer_rdwr;
+
+	u32 bse_tlb_byte_per_lcu = 0;
+
+	u32 large_bw_calculation_fp = 0;
+
+	llc_enabled_ref_y_rd = (codec_input.status_llc_onoff) ? 1 : 0;
+	llc_enable_ref_crcb_rd = (codec_input.status_llc_onoff) ? 1 : 0;
+	/* H265D BSE tlb in LLC will be pored in Kailua */
+	llc_enabled_bse_tlb = (codec_input.status_llc_onoff) ? 1 : 0;
+
+	frame_width = codec_input.frame_width;
+	frame_height = codec_input.frame_height;
+	if ((codec_input.codec == CODEC_H264) ||
+		(codec_input.codec == CODEC_H264_CAVLC)) {
+		frame_lcu_size = 16;
+		collocated_bytes_per_lcu = 16;
+		llc_saving = 130;
+	} else if (codec_input.codec == CODEC_HEVC) {
+		if (codec_input.lcu_size == 32) {
+			frame_lcu_size = 32;
+			collocated_bytes_per_lcu = 64;
+			llc_saving = 114;
+		} else if (codec_input.lcu_size == 64) {
+			frame_lcu_size = 64;
+			collocated_bytes_per_lcu = 256;
+			llc_saving = 107;
+		}
+	} else if (codec_input.codec == CODEC_VP9) {
+		if (codec_input.lcu_size == 32) {
+			frame_lcu_size = 32;
+			collocated_bytes_per_lcu = 64;
+			llc_saving = 114;
+		} else if (codec_input.lcu_size == 64) {
+			frame_lcu_size = 64;
+			collocated_bytes_per_lcu = 256;
+			llc_saving = 107;
+		}
+	} else if (codec_input.codec == CODEC_AV1) {
+		u32 av1d_leftline_cdef = (2944 + 896 + 896);
+		u32 av1d_leftline_scaling = (2176 + 1408 + 1408);
+		u32 av1d_leftline_fg = (1280);
+		u32 av1d_leftline_lr = (1536 + 1024 + 1024);
+
+		av1d_fe_leftlinebuffer_perlcu_tileboudary =
+			av1d_leftline_cdef + av1d_leftline_scaling +
+			av1d_leftline_fg + av1d_leftline_lr;
+
+		if (codec_input.lcu_size == 128) {
+			frame_lcu_size = 128;
+			collocated_bytes_per_lcu = 4 * 512;
+			av1d_segment_read_per_lcu = 512;
+			llc_saving = 104;
+		} else if (codec_input.lcu_size == 32) {
+			frame_lcu_size = 32;
+			collocated_bytes_per_lcu = 4 * 512 / (128 * 128 / 32 / 32);
+			av1d_segment_read_per_lcu = 512 / (128 * 128 / 32 / 32);
+			av1d_fe_leftlinebuffer_perlcu_tileboudary =
+				av1d_fe_leftlinebuffer_perlcu_tileboudary / (128 * 128 / 32 / 32);
+			llc_saving = 114;
+		} else if (codec_input.lcu_size == 64) {
+			frame_lcu_size = 64;
+			collocated_bytes_per_lcu = 4 * 512 / (128 * 128 / 64 / 64);
+			av1d_segment_read_per_lcu = 512 / (128 * 128 / 64 / 64);
+			av1d_fe_leftlinebuffer_perlcu_tileboudary =
+				av1d_fe_leftlinebuffer_perlcu_tileboudary / (128 * 128 / 64 / 64);
+			llc_saving = 107;
+		}
+	}
+
+	lcu_per_frame =
+		calculate_number_lcus_kalama(frame_width, frame_height, frame_lcu_size);
+
+	target_bitrate = (u32)(codec_input.bitrate_mbps); /* Mbps */
+
+	ubwc_tile_w = (codec_input.bitdepth == CODEC_BITDEPTH_8) ? 32 : 48;
+	ubwc_tile_h = (codec_input.bitdepth == CODEC_BITDEPTH_8) ? 8 : 4;
+
+	frame420_y_bw_linear_8bpp =
+		((calculate_number_ubwctiles_kalama(frame_width, frame_height, 32, 8) *
+		256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+	frame420_y_bw_no_ubwc_tile_10bpp =
+		((calculate_number_ubwctiles_kalama(frame_width, frame_height, 48, 4) *
+		256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+	frame420_y_bw_linear_10bpp = ((frame_width * frame_height *
+		codec_input.frame_rate * 2 + 999) / 1000 + 999) / 1000;
+
+	/* TODO Integrate Compression Ratio returned by FW */
+	get_compression_factors(&compression_factor, codec_input);
+	dpb_compression_factor_y = compression_factor.dpb_cf_y;
+	dpb_compression_factor_cbcr = compression_factor.dpb_cf_cbcr;
+	opb_compression_factor_ycbcr = compression_factor.opb_cf_ycbcr;
+
+	dpb_ubwc_tile_width_pixels = ubwc_tile_w;
+
+	dpb_ubwc_tile_height_pixels = ubwc_tile_h;
+
+	decoder_frame_complexity_factor =
+		(codec_input.complexity_setting == 0) ?
+		400 : ((codec_input.complexity_setting == 1) ? 266 : 100);
+
+	reconstructed_write_bw_factor_rd = (codec_input.complexity_setting == 0) ?
+		105 : 100;
+
+	reference_y_read_bw_factor = llc_saving;
+
+	reference_cbcr_read_bw_factor = llc_saving;
+
+	if (codec_input.codec == CODEC_AV1) {
+		u8 av1tile_index_entry, av1tile_complexity;
+
+		if (frame_width * frame_height <= 1280 * 720)
+			av1tile_index_entry = 4;
+		else if (frame_width * frame_height <= 1920 * 1080)
+			av1tile_index_entry = 0;
+		else if (frame_width * frame_height <= 2560 * 1440)
+			av1tile_index_entry = 5;
+		else if (frame_width * frame_height <= 4096 * 2304)
+			av1tile_index_entry = 1;
+		else
+			av1tile_index_entry = 6;
+
+		/* NOT PWC //or average and power case */
+		if (codec_input.complexity_setting != 0)
+			av1tile_complexity = 1;
+		else
+			av1tile_complexity = 0;
+
+		av1_tile_numbers = av1_num_tiles_kalama[av1tile_index_entry][av1tile_complexity];
+
+		/* these bw can be ignored */
+		av1_collated_seg_buffer_rd_wr =
+			((av1d_segment_read_per_lcu * lcu_per_frame *
+			codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+		av1_fe_left_line_buffer_rdwr =
+			(((av1d_fe_leftlinebuffer_perlcu_tileboudary *
+			frame_height * (av1_tile_numbers > 1 ? av1_tile_numbers / 2 : 0)
+			+ 999) / 1000 + 999) / 1000 + (frame_lcu_size - 1)) / frame_lcu_size;
+	}
+
+	if (codec_input.codec == CODEC_HEVC) {
+		if (codec_input.lcu_size == 32)
+			bse_tlb_byte_per_lcu = 64;
+		else if (codec_input.lcu_size == 16)
+			bse_tlb_byte_per_lcu = 32;
+		else
+			bse_tlb_byte_per_lcu = 128;
+	} else if ((codec_input.codec == CODEC_H264) ||
+		(codec_input.codec == CODEC_H264_CAVLC)) {
+		bse_tlb_byte_per_lcu = 64;
+	} else if (codec_input.codec == CODEC_VP9) {
+		bse_tlb_byte_per_lcu = 304;
+	} else if (codec_input.codec == CODEC_AV1) {
+		if (codec_input.lcu_size == 128)
+			bse_tlb_byte_per_lcu = 2064;
+		else if (codec_input.lcu_size == 64)
+			bse_tlb_byte_per_lcu = 1056;
+		else if (codec_input.lcu_size == 32)
+			bse_tlb_byte_per_lcu = 2064 / (128 * 128 / 32 / 32);
+	}
+
+	codec_output->noc_bw_rd = 0;
+	codec_output->noc_bw_wr = 0;
+	codec_output->ddr_bw_rd = 0;
+	codec_output->ddr_bw_wr = 0;
+
+	large_bw_calculation_fp = 0;
+	large_bw_calculation_fp = ((target_bitrate *
+		decoder_vsp_read_factor + 7) / 8);
+
+	codec_output->vsp_read_noc = large_bw_calculation_fp;
+
+	codec_output->vsp_read_ddr = codec_output->vsp_read_noc;
+
+	large_bw_calculation_fp = ((target_bitrate *
+		bins_to_bits_factor + 7) / 8);
+
+	codec_output->vsp_write_noc = large_bw_calculation_fp;
+	codec_output->vsp_write_ddr = codec_output->vsp_write_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->vsp_read_noc;
+	codec_output->ddr_bw_rd += codec_output->vsp_read_ddr;
+	codec_output->noc_bw_wr += codec_output->vsp_write_noc;
+	codec_output->ddr_bw_wr += codec_output->vsp_write_ddr;
+
+	large_bw_calculation_fp = 0;
+	large_bw_calculation_fp = ((collocated_bytes_per_lcu *
+		lcu_per_frame * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+	codec_output->collocated_rd_noc = large_bw_calculation_fp;
+	codec_output->collocated_wr_noc = codec_output->collocated_rd_noc;
+	codec_output->collocated_rd_ddr = codec_output->collocated_rd_noc;
+	codec_output->collocated_wr_ddr = codec_output->collocated_wr_noc;
+
+	codec_output->collocated_rd_wr_total_noc =
+		(u32)(codec_output->collocated_rd_noc + codec_output->collocated_wr_noc);
+
+	codec_output->collocated_rd_wr_total_ddr =
+		codec_output->collocated_rd_wr_total_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->collocated_rd_noc;
+	codec_output->noc_bw_wr += codec_output->collocated_wr_noc;
+	codec_output->ddr_bw_rd += codec_output->collocated_rd_ddr;
+	codec_output->ddr_bw_wr += codec_output->collocated_wr_ddr;
+
+	large_bw_calculation_fp = 0;
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp :
+		frame420_y_bw_no_ubwc_tile_10bpp) * decoder_frame_complexity_factor;
+
+	large_bw_calculation_fp =
+		(large_bw_calculation_fp + dpb_compression_factor_y - 1) /
+		dpb_compression_factor_y;
+
+	codec_output->dpb_rd_y_noc = large_bw_calculation_fp;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp : frame420_y_bw_no_ubwc_tile_10bpp) *
+		decoder_frame_complexity_factor;
+
+	large_bw_calculation_fp =
+		(large_bw_calculation_fp + dpb_compression_factor_cbcr - 1) /
+		dpb_compression_factor_cbcr / 2;
+
+	codec_output->dpb_rd_crcb_noc = large_bw_calculation_fp;
+	codec_output->dpb_rdwr_duetooverlap_noc = 0;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp : frame420_y_bw_no_ubwc_tile_10bpp) *
+		reconstructed_write_bw_factor_rd;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp : frame420_y_bw_no_ubwc_tile_10bpp) *
+		reconstructed_write_bw_factor_rd;
+
+	large_bw_calculation_fp = large_bw_calculation_fp *
+		(dpb_compression_factor_y / 2 + dpb_compression_factor_cbcr);
+
+	large_bw_calculation_fp = (large_bw_calculation_fp + dpb_compression_factor_y - 1) /
+		dpb_compression_factor_y;
+
+	large_bw_calculation_fp =
+		(large_bw_calculation_fp + dpb_compression_factor_cbcr - 1) /
+		dpb_compression_factor_cbcr;
+
+	codec_output->dpb_wr_noc = large_bw_calculation_fp;
+
+	codec_output->dpb_rd_y_ddr = (llc_enabled_ref_y_rd) ?
+		((codec_output->dpb_rd_y_noc * 100 + reference_y_read_bw_factor - 1) /
+		reference_y_read_bw_factor) : codec_output->dpb_rd_y_noc;
+
+	codec_output->dpb_rd_crcb_ddr = (llc_enable_ref_crcb_rd) ?
+		((codec_output->dpb_rd_crcb_noc * 100 +
+		reference_cbcr_read_bw_factor - 1) /
+		reference_cbcr_read_bw_factor) : codec_output->dpb_rd_crcb_noc;
+
+	codec_output->dpb_rdwr_duetooverlap_ddr = 0;
+	codec_output->dpb_wr_ddr = codec_output->dpb_wr_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->dpb_rd_y_noc;
+	codec_output->noc_bw_rd += codec_output->dpb_rd_crcb_noc;
+	codec_output->noc_bw_rd += codec_output->dpb_rdwr_duetooverlap_noc;
+	codec_output->noc_bw_wr += codec_output->dpb_wr_noc;
+	codec_output->ddr_bw_rd += codec_output->dpb_rd_y_ddr;
+	codec_output->ddr_bw_rd += codec_output->dpb_rd_crcb_ddr;
+	codec_output->ddr_bw_rd += codec_output->dpb_rdwr_duetooverlap_ddr;
+	codec_output->ddr_bw_wr += codec_output->dpb_wr_ddr;
+
+	if (codec_input.linear_opb || codec_input.split_opb) {
+		if (codec_input.linear_opb) {
+			if (codec_input.bitdepth == CODEC_BITDEPTH_8) {
+				large_bw_calculation_fp = ((frame420_y_bw_linear_8bpp) *
+				3 / 2 / dpb_to_opb_ratios_ds);
+
+				codec_output->opb_write_total_noc = large_bw_calculation_fp;
+			} else {
+				large_bw_calculation_fp = ((frame420_y_bw_linear_10bpp) *
+				3 / 2 / dpb_to_opb_ratios_ds);
+
+				codec_output->opb_write_total_noc = large_bw_calculation_fp;
+			}
+		} else { /* (CODEC_INPUT.split_opb) */
+			if (codec_input.bitdepth == CODEC_BITDEPTH_8) {
+				large_bw_calculation_fp =
+					(frame420_y_bw_linear_8bpp * 3 / 2 / dpb_to_opb_ratios_ds *
+					100 + opb_compression_factor_ycbcr - 1) /
+					opb_compression_factor_ycbcr;
+
+				codec_output->opb_write_total_noc = large_bw_calculation_fp;
+			} else {
+				large_bw_calculation_fp =
+					(frame420_y_bw_no_ubwc_tile_10bpp * 3 / 2 /
+					dpb_to_opb_ratios_ds * 100 +
+					opb_compression_factor_ycbcr - 1) /
+					opb_compression_factor_ycbcr;
+
+				codec_output->opb_write_total_noc = large_bw_calculation_fp;
+			}
+		}
+	} else {
+		codec_output->opb_write_total_noc = 0;
+	}
+
+	codec_output->opb_write_total_ddr = codec_output->opb_write_total_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_wr += codec_output->opb_write_total_noc;
+	codec_output->ddr_bw_wr += codec_output->opb_write_total_ddr;
+
+	large_bw_calculation_fp = ((bse_tlb_byte_per_lcu * lcu_per_frame *
+		codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+	codec_output->bse_tlb_rd_noc = large_bw_calculation_fp;
+
+	if (llc_enabled_bse_tlb)
+		codec_output->bse_tlb_rd_ddr = 0;
+	else
+		codec_output->bse_tlb_rd_ddr = codec_output->bse_tlb_rd_noc;
+
+	codec_output->bse_tlb_wr_noc = codec_output->bse_tlb_rd_noc;
+
+	if (llc_enabled_bse_tlb)
+		codec_output->bse_tlb_wr_ddr = 0;
+	else
+		codec_output->bse_tlb_wr_ddr = codec_output->bse_tlb_wr_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->bse_tlb_rd_noc;
+	codec_output->ddr_bw_rd += codec_output->bse_tlb_rd_ddr;
+	codec_output->noc_bw_wr += codec_output->bse_tlb_wr_noc;
+	codec_output->ddr_bw_wr += codec_output->bse_tlb_wr_ddr;
+
+	if (codec_input.codec == CODEC_AV1) {
+		codec_output->statistics_rd_noc = (av1_collated_seg_buffer_rd_wr +
+			av1_probability_table_rdwr_bytesperframe * av1_tile_numbers /
+			1000 / 1000 + av1_fe_left_line_buffer_rdwr);
+
+		codec_output->statistics_wr_noc = (av1_collated_seg_buffer_rd_wr +
+			av1_probability_table_rdwr_bytesperframe * av1_tile_numbers /
+			1000 / 1000 + av1_fe_left_line_buffer_rdwr);
+
+		if (llc_enable_probtable_av1d_21pipe) {
+			/* assert(CODEC_INPUT.pipe_num != 4); */
+			codec_output->statistics_rd_ddr = codec_output->statistics_rd_noc -
+				av1_probability_table_rdwr_bytesperframe *
+				av1_tile_numbers / 1000 / 1000;
+
+			codec_output->statistics_wr_ddr = codec_output->statistics_wr_noc -
+				av1_probability_table_rdwr_bytesperframe *
+				av1_tile_numbers / 1000 / 1000;
+		} else {
+			codec_output->statistics_rd_ddr = codec_output->statistics_rd_noc;
+			codec_output->statistics_wr_ddr = codec_output->statistics_wr_noc;
+		}
+
+		/* accumulation */
+		codec_output->noc_bw_rd += codec_output->statistics_rd_noc;
+		codec_output->ddr_bw_rd += codec_output->statistics_rd_ddr;
+		codec_output->noc_bw_wr += codec_output->statistics_wr_noc;
+		codec_output->ddr_bw_wr += codec_output->statistics_wr_ddr;
+	}
+
+
+	codec_output->mmu_rd_ddr = 0;
+	codec_output->mmu_rd_noc = 0;
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->mmu_rd_noc;
+	codec_output->ddr_bw_rd += codec_output->mmu_rd_ddr;
+
+	return 0;
+}
+
+static int calculate_bandwidth_encoder_iris3(
+		struct api_calculation_input codec_input,
+		struct api_calculation_bw_output *codec_output)
+{
+	/* common control parameters */
+	u32 frame_width;
+	u32 frame_height;
+	u32 frame_lcu_size;
+	u32 lcu_per_frame;
+	u32 target_bitrate;
+	u32 collocated_bytes_per_lcu;
+
+	u32 frame420_y_bw_linear_8bpp;
+	u32 frame420_y_bw_no_ubwc_tile_10bpp;
+	u32 frame420_y_bw_linear_10bpp;
+
+	u16 ubwc_tile_w;
+	u16 ubwc_tile_h;
+
+	u32 dpb_compression_factor_y;
+	u32 dpb_compression_factor_cbcr;
+
+	u32 reconstructed_write_bw_factor_rd;
+	u32 reference_y_read_bw_factor;
+	u32 reference_crcb_read_bw_factor;
+
+	/* encoder control parameters */
+	u32 en_vertical_tiles_width = 960;
+
+	u8 en_rotation_90_270 = 0;
+	/* TODO Can we use (codec_input.status_llc_onoff) for enc_llc_*? */
+	u8 en_llc_enable_ref_rd_crcb = 0;
+	u8 en_llc_enable_rec_wr_uncompleted = 0;
+	u8 en_llc_enable_ref_rd_y_overlap = 0;
+
+	u32 en_bins_to_bits_factor = 4;
+	u32 en_search_windows_size_horizontal = 96;
+
+	u32 en_tile_number;
+	u32 ipb_compression_factor_y;
+	u32 ipb_compression_factor;
+
+	u32 large_bw_calculation_fp = 0;
+
+	/* TODO Are these really needed in Encoder? */
+	u32 bse_tlb_byte_per_lcu = 0;
+	u8 llc_enabled_bse_tlb = 1;
+
+	/*H265D BSE tlb in LLC will be pored in Kailua */
+	llc_enabled_bse_tlb = (codec_input.status_llc_onoff) ? 1 : 0;
+
+	frame_width = codec_input.frame_width;
+	frame_height = codec_input.frame_height;
+	if ((codec_input.codec == CODEC_H264) ||
+		(codec_input.codec == CODEC_H264_CAVLC)) {
+		frame_lcu_size = 16;
+		collocated_bytes_per_lcu = 16;
+	} else if (codec_input.codec == CODEC_HEVC) {
+		frame_lcu_size = 32;
+		collocated_bytes_per_lcu = 64;
+	} else {
+		/* TODO What is the value for VP9, AV1? */
+		frame_lcu_size = 16;
+		collocated_bytes_per_lcu = 16; /* TODO Fixes Uninitialized compilation error. */
+	}
+
+	lcu_per_frame =
+		calculate_number_lcus_kalama(frame_width, frame_height, frame_lcu_size);
+
+	bse_tlb_byte_per_lcu = 16; /* TODO Should be in common declaration */
+
+	target_bitrate = (u32)(codec_input.bitrate_mbps); /* Mbps */
+
+	ubwc_tile_w = (codec_input.bitdepth == CODEC_BITDEPTH_8) ? 32 : 48;
+	ubwc_tile_h = (codec_input.bitdepth == CODEC_BITDEPTH_8) ? 8 : 4;
+
+	/* yuv */
+	if (codec_input.ipb_yuvrgb == 0) {
+		frame420_y_bw_linear_8bpp =
+			((calculate_number_ubwctiles_kalama(frame_width, frame_height,
+			32, 8) * 256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+	} else { /* RGBA */
+		frame420_y_bw_linear_8bpp =
+			((calculate_number_ubwctiles_kalama(frame_width, frame_height,
+			6, 4) * 256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+	}
+
+	frame420_y_bw_no_ubwc_tile_10bpp =
+		((calculate_number_ubwctiles_kalama(frame_width, frame_height, 48, 4) *
+		256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+	frame420_y_bw_linear_10bpp = ((frame_width * frame_height *
+		codec_input.frame_rate * 2 + 999) / 1000 + 999) / 1000;
+
+	/* TODO Integrate Compression Ratio returned by FW */
+	get_compression_factors(&compression_factor, codec_input);
+	dpb_compression_factor_y = compression_factor.dpb_cf_y;
+	dpb_compression_factor_cbcr = compression_factor.dpb_cf_cbcr;
+	ipb_compression_factor_y = compression_factor.ipb_cr_y;
+	ipb_compression_factor = compression_factor.ipb_cr;
+
+	en_tile_number = (frame_width % en_vertical_tiles_width) ?
+		((frame_width / en_vertical_tiles_width) + 1) :
+		(frame_width / en_vertical_tiles_width);
+
+	en_tile_number = en_tile_number * 100;
+
+	/* ceil is same as excel roundup (float, 0); */
+	reconstructed_write_bw_factor_rd = ((en_tile_number - 100) * 2 *
+		((codec_input.lcu_size + ubwc_tile_w - 1) / ubwc_tile_w) *
+		ubwc_tile_w + (frame_width - 1)) / (frame_width)+100;
+
+	reference_y_read_bw_factor = ((en_tile_number - 100) * 2 *
+		((en_search_windows_size_horizontal + ubwc_tile_w - 1) / ubwc_tile_w) *
+		ubwc_tile_w + (frame_width - 1)) / frame_width + 100;
+
+	reference_crcb_read_bw_factor = 150;
+
+	codec_output->noc_bw_rd = 0;
+	codec_output->noc_bw_wr = 0;
+	codec_output->ddr_bw_rd = 0;
+	codec_output->ddr_bw_wr = 0;
+
+	large_bw_calculation_fp = (target_bitrate * en_bins_to_bits_factor + 7) / 8;
+	codec_output->vsp_read_noc = large_bw_calculation_fp;
+	codec_output->vsp_read_ddr = codec_output->vsp_read_noc;
+	large_bw_calculation_fp = (target_bitrate + 7) / 8;
+
+	codec_output->vsp_write_noc = codec_output->vsp_read_noc +
+		large_bw_calculation_fp;
+
+	codec_output->vsp_write_ddr = codec_output->vsp_write_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->vsp_read_noc;
+	codec_output->ddr_bw_rd += codec_output->vsp_read_ddr;
+	codec_output->noc_bw_wr += codec_output->vsp_write_noc;
+	codec_output->ddr_bw_wr += codec_output->vsp_write_ddr;
+
+	large_bw_calculation_fp = ((collocated_bytes_per_lcu * lcu_per_frame *
+		codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+	codec_output->collocated_rd_noc = large_bw_calculation_fp;
+	codec_output->collocated_wr_noc = codec_output->collocated_rd_noc;
+	codec_output->collocated_rd_ddr = codec_output->collocated_rd_noc;
+	codec_output->collocated_wr_ddr = codec_output->collocated_wr_noc;
+
+	codec_output->collocated_rd_wr_total_noc =
+		(u32)(codec_output->collocated_rd_noc + codec_output->collocated_wr_noc);
+	codec_output->collocated_rd_wr_total_ddr =
+		codec_output->collocated_rd_wr_total_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->collocated_rd_noc;
+	codec_output->noc_bw_wr += codec_output->collocated_wr_noc;
+	codec_output->ddr_bw_rd += codec_output->collocated_rd_ddr;
+	codec_output->ddr_bw_wr += codec_output->collocated_wr_ddr;
+
+	large_bw_calculation_fp = 0;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp :
+		frame420_y_bw_no_ubwc_tile_10bpp) * reference_y_read_bw_factor;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp *
+		kalama_en_readfactor[codec_input.hierachical_layer]);
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		dpb_compression_factor_y - 1) / dpb_compression_factor_y;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp + 999) / 1000;
+
+	codec_output->dpb_rd_y_noc = large_bw_calculation_fp;
+
+	large_bw_calculation_fp = 0;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp :
+		frame420_y_bw_no_ubwc_tile_10bpp) * reference_crcb_read_bw_factor / 2;
+
+	large_bw_calculation_fp = large_bw_calculation_fp *
+		kalama_en_readfactor[codec_input.hierachical_layer];
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		dpb_compression_factor_cbcr - 1) / dpb_compression_factor_cbcr;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp + 999) / 1000;
+	codec_output->dpb_rd_crcb_noc = large_bw_calculation_fp;
+
+	large_bw_calculation_fp = 0;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp : frame420_y_bw_no_ubwc_tile_10bpp) *
+		reconstructed_write_bw_factor_rd *
+		kalama_en_writefactor[codec_input.hierachical_layer] /
+		kalama_en_frame_num_parallel;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp + 999) / 1000;
+
+	large_bw_calculation_fp = large_bw_calculation_fp *
+		(dpb_compression_factor_cbcr + dpb_compression_factor_y / 2);
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		dpb_compression_factor_y - 1) / dpb_compression_factor_y;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		dpb_compression_factor_cbcr - 1) / dpb_compression_factor_cbcr;
+
+	codec_output->dpb_wr_noc = large_bw_calculation_fp;
+
+	/*
+	 * Summary:
+	 * by default (for both HFR and HSR cases) :
+	 *      -Any resolution and fps >= 120, enable layering.
+	 * (120 -> 3, 240 -> 4, 480 -> 5)
+	 *      - (once we enable layering) : 50 per cent frames are Non - reference
+	 *  frames.recon write is disable by Venus firmware
+	 * 	- Customer has ability to enable / disable layering.
+	 *  Hence, recon write savings would not be there if
+	 *  customer explicitly disables layer encoding.
+	 */
+
+	/*HFR Cases use alternating rec write if not PWC*/
+	if ((codec_input.frame_rate >= 120) && (codec_input.complexity_setting != 0))
+		codec_output->dpb_wr_noc = codec_output->dpb_wr_noc / 2;
+
+	/* for power cases with [B1] adaptive non-ref b frame */
+	/* power caes IbP non reference b */
+	if ((codec_input.hierachical_layer >= 1) &&
+		(codec_input.hierachical_layer <= 3) &&
+		(codec_input.complexity_setting != 0))
+		codec_output->dpb_wr_noc = codec_output->dpb_wr_noc / 2;
+
+	large_bw_calculation_fp = 0;
+	large_bw_calculation_fp = codec_output->dpb_wr_noc *
+		(reconstructed_write_bw_factor_rd - 100);
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		reconstructed_write_bw_factor_rd - 1) / reconstructed_write_bw_factor_rd;
+
+	codec_output->dpb_rdwr_duetooverlap_noc = large_bw_calculation_fp;
+
+	codec_output->dpb_rd_y_ddr = (en_llc_enable_ref_rd_y_overlap) ?
+		(codec_output->dpb_rd_y_noc * 100 + reference_y_read_bw_factor - 1) /
+		reference_y_read_bw_factor : codec_output->dpb_rd_y_noc;
+
+	codec_output->dpb_rd_crcb_ddr = (en_llc_enable_ref_rd_crcb) ?
+		(codec_output->dpb_rd_crcb_noc * 100 + reference_crcb_read_bw_factor - 1) /
+		reference_crcb_read_bw_factor : codec_output->dpb_rd_crcb_noc;
+
+	codec_output->dpb_rdwr_duetooverlap_ddr = (en_llc_enable_rec_wr_uncompleted) ?
+		0 : codec_output->dpb_rdwr_duetooverlap_noc;
+
+	codec_output->dpb_wr_ddr = (en_llc_enable_rec_wr_uncompleted) ?
+		0 : codec_output->dpb_wr_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->dpb_rd_y_noc;
+	codec_output->noc_bw_rd += codec_output->dpb_rd_crcb_noc;
+	codec_output->noc_bw_rd += codec_output->dpb_rdwr_duetooverlap_noc;
+	codec_output->noc_bw_wr += codec_output->dpb_wr_noc;
+	codec_output->ddr_bw_rd += codec_output->dpb_rd_y_ddr;
+	codec_output->ddr_bw_rd += codec_output->dpb_rd_crcb_ddr;
+	codec_output->ddr_bw_rd += codec_output->dpb_rdwr_duetooverlap_ddr;
+	codec_output->ddr_bw_wr += codec_output->dpb_wr_ddr;
+
+	if (codec_input.bitdepth == CODEC_BITDEPTH_8) {
+		if (codec_input.ipb_yuvrgb == 0) { /* yuv */
+			large_bw_calculation_fp = ((frame420_y_bw_linear_8bpp) * 3 / 2);
+			codec_output->ipb_rd_total_noc = large_bw_calculation_fp;
+			if (codec_input.linear_ipb == 0) {
+				codec_output->ipb_rd_total_noc =
+					(large_bw_calculation_fp * 100 +
+					ipb_compression_factor - 1) / ipb_compression_factor;
+			}
+		} else { /* rgb */
+			large_bw_calculation_fp = frame420_y_bw_linear_8bpp;
+			codec_output->ipb_rd_total_noc = large_bw_calculation_fp;
+			if (codec_input.linear_ipb == 0) {
+				if (codec_input.complexity_setting == 0) /* pwc */
+					codec_output->ipb_rd_total_noc =
+						(large_bw_calculation_fp * 100 +
+						en_original_compression_factor_rgba_pwd_kalama
+						- 1) /
+						en_original_compression_factor_rgba_pwd_kalama;
+				else
+					codec_output->ipb_rd_total_noc =
+					(large_bw_calculation_fp * 100 +
+					en_original_compression_factor_rgba_avg_kalama - 1) /
+					en_original_compression_factor_rgba_avg_kalama;
+			}
+		}
+	} else {
+		if (codec_input.linear_ipb == 1) {
+			large_bw_calculation_fp = (frame420_y_bw_linear_10bpp) * 3 / 2;
+			codec_output->ipb_rd_total_noc = large_bw_calculation_fp;
+		} else {
+			large_bw_calculation_fp = (frame420_y_bw_no_ubwc_tile_10bpp *
+				300 / 2 + ipb_compression_factor - 1) / ipb_compression_factor;
+			codec_output->ipb_rd_total_noc = large_bw_calculation_fp;
+		}
+	}
+
+	if (en_rotation_90_270) {
+		if (codec_input.codec == CODEC_HEVC) {
+			if ((codec_input.bitdepth == CODEC_BITDEPTH_8) &&
+					(codec_input.ipb_yuvrgb == 0))
+				codec_output->ipb_rd_total_noc = codec_output->ipb_rd_total_noc
+					* 1;
+			else
+				codec_output->ipb_rd_total_noc = codec_output->ipb_rd_total_noc
+					* 3;
+		} else {
+			codec_output->ipb_rd_total_noc = codec_output->ipb_rd_total_noc * 2;
+		}
+	}
+
+	codec_output->ipb_rd_total_ddr = codec_output->ipb_rd_total_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->ipb_rd_total_noc;
+	codec_output->ddr_bw_rd += codec_output->ipb_rd_total_ddr;
+
+	codec_output->bse_tlb_rd_noc =
+		((bse_tlb_byte_per_lcu * lcu_per_frame * codec_input.frame_rate + 999)
+		/ 1000 + 999) / 1000;
+
+	if (llc_enabled_bse_tlb) /* TODO should be common declaration */
+		codec_output->bse_tlb_rd_ddr = 0;
+	else
+		codec_output->bse_tlb_rd_ddr = codec_output->bse_tlb_rd_noc;
+
+	codec_output->bse_tlb_wr_noc = codec_output->bse_tlb_rd_noc;
+
+	if (llc_enabled_bse_tlb)
+		codec_output->bse_tlb_wr_ddr = 0;
+	else
+		codec_output->bse_tlb_wr_ddr = codec_output->bse_tlb_wr_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->bse_tlb_rd_noc;
+	codec_output->ddr_bw_rd += codec_output->bse_tlb_rd_ddr;
+	codec_output->noc_bw_wr += codec_output->bse_tlb_wr_noc;
+	codec_output->ddr_bw_wr += codec_output->bse_tlb_wr_ddr;
+
+	codec_output->mmu_rd_ddr = 0;
+	codec_output->mmu_rd_noc = 0;
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->mmu_rd_noc;
+	codec_output->ddr_bw_rd += codec_output->mmu_rd_ddr;
+
+	return 0;
+}
+
+int msm_vidc_calculate_bandwidth(struct api_calculation_input codec_input,
+		struct api_calculation_bw_output *codec_output)
+{
+	int rc = 0;
+
+	if (codec_input.decoder_or_encoder == CODEC_DECODER) {
+		rc = calculate_bandwidth_decoder_iris3(codec_input, codec_output);
+	} else if (codec_input.decoder_or_encoder == CODEC_ENCODER) {
+		rc = calculate_bandwidth_encoder_iris3(codec_input, codec_output);
+	} else {
+		d_vpr_e("%s: invalid codec %u\n", __func__, codec_input.decoder_or_encoder);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris3/src/msm_vidc_clock_iris3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris3/src/msm_vidc_clock_iris3.c
@@ -0,0 +1,557 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_debug.h"
+#include "kalama_technology.h"
+
+static u32 calculate_number_mbs_kalama(u32 width, u32 height, u32 lcu_size)
+{
+	u32 mbs_width = (width % lcu_size) ?
+		(width / lcu_size + 1) : (width / lcu_size);
+
+	u32 mbs_height = (height % lcu_size) ?
+		(height / lcu_size + 1) : (height / lcu_size);
+
+	return mbs_width * mbs_height * (lcu_size / 16) * (lcu_size / 16);
+}
+
+static int initialize_encoder_complexity_table(void)
+{
+	/* Beging Calculate Encoder GOP Complexity Table and HW Floor numbers */
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_Bb_ENTRY] = 70000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_P_ENTRY] = 10000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_Bb_ENTRY] * 150 +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_P_ENTRY] * 100);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] +
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_P_ENTRY] - 1);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] /
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_P_ENTRY]);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_Bb_ENTRY] = 30000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_P_ENTRY] = 10000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_Bb_ENTRY] * 150 +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_P_ENTRY] * 100);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] +
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_P_ENTRY] - 1);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] /
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_P_ENTRY]);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_Bb_ENTRY] = 10000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_P_ENTRY] = 10000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_Bb_ENTRY] * 150 +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_P_ENTRY] * 100);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] +
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_P_ENTRY] - 1);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] /
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_P_ENTRY]);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_Bb_ENTRY] = 0;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_P_ENTRY] = 1;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_Bb_ENTRY] * 150 +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_P_ENTRY] * 100);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] +
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_P_ENTRY] - 1);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] /
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_P_ENTRY]);
+
+	return 0;
+}
+
+static u32 get_bitrate_entry(u32 pixle_count)
+{
+	u32 bitrate_entry = 0;
+
+	if (pixle_count >= fp_pixel_count_bar1)
+		bitrate_entry = 1;
+	else if (pixle_count >= fp_pixel_count_bar2)
+		bitrate_entry = 2;
+	else if (pixle_count >= fp_pixel_count_bar3)
+		bitrate_entry = 3;
+	else if (pixle_count >= fp_pixel_count_bar4)
+		bitrate_entry = 4;
+	else if (pixle_count >= fp_pixel_count_bar5)
+		bitrate_entry = 5;
+	else if (pixle_count >= fp_pixel_count_bar6)
+		bitrate_entry = 6;
+	else if (pixle_count >= fp_pixel_count_bar7)
+		bitrate_entry = 7;
+	else if (pixle_count >= fp_pixel_count_bar8)
+		bitrate_entry = 8;
+	else if (pixle_count >= fp_pixel_count_bar9)
+		bitrate_entry = 9;
+	else
+		bitrate_entry = 9;
+
+	return bitrate_entry;
+}
+
+static int calculate_vsp_min_freq(struct api_calculation_input codec_input,
+		struct api_calculation_freq_output *codec_output)
+{
+	/*
+	 * VSP calculation
+	 * different methodology from Lahaina
+	 */
+	u32 vsp_hw_min_frequency = 0;
+	/* UInt32 decoder_vsp_fw_overhead = 100 + 5; // amplified by 100x */
+	u32 fw_sw_vsp_offset = 1000 + 55;      /* amplified by 1000x */
+
+	/*
+	 * Ignore fw_sw_vsp_offset, as this is baked into the reference bitrate tables.
+	 *  As a consequence remove x1000 multipler as well.
+	 */
+	u32 codec = codec_input.codec;
+	/* UInt32 *bitratetable; */
+	u32 pixle_count = codec_input.frame_width *
+		codec_input.frame_height * codec_input.frame_rate;
+
+	u8 bitrate_entry = get_bitrate_entry(pixle_count); /* TODO EXTRACT */
+
+	input_bitrate_fp = ((u32)(codec_input.bitrate_mbps * 100 + 99)) / 100;
+	vsp_hw_min_frequency = frequency_table_kalama[0][1] * input_bitrate_fp * 1000;
+
+	/* 8KUHD60fps with B frame */
+	if ((pixle_count >= fp_pixel_count_bar0) &&
+		(codec_input.hierachical_layer != CODEC_GOP_IPP)) {
+		/*
+		 *  FORMULA: VSPfreq = NOMINAL * (InputBitrate / ReferenceBitrate);
+		 *  ReferenceBitrate = 0 for,
+		 *     - 1Stage TURBO, all Codecs.
+		 *     - 2Stage TURBO, H264 & H265.
+		 *
+		 *  8KUHD60fps with B frame
+		 *     - bitrate_entry = 0
+		 *     - Clock=NOMINAL for H264 & 2Stage H265. Because bitrate
+		 *       table entry for TURBO is 0.
+		 *
+		 *  TODO : Reduce these conditions by removing the zero entries from Bitrate table.
+		 */
+		vsp_hw_min_frequency = frequency_table_kalama[0][1] *
+			input_bitrate_fp * 1000;
+
+		if (codec_input.codec == CODEC_AV1)
+			vsp_hw_min_frequency = frequency_table_kalama[0][0] *
+				input_bitrate_fp * 1000;
+
+		if ((codec_input.codec == CODEC_H264) ||
+			(codec_input.codec == CODEC_H264_CAVLC) ||
+			((codec_input.codec == CODEC_HEVC) &&
+			(codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_1S))) {
+			vsp_hw_min_frequency =
+				DIV_ROUND_UP(frequency_table_kalama[0][1], fw_sw_vsp_offset);
+		} else if (((codec_input.codec == CODEC_HEVC) &&
+			(codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_2S))
+			|| (codec_input.codec == CODEC_VP9)
+			|| (codec_input.codec == CODEC_AV1)) {
+			if (codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_2S) {
+				vsp_hw_min_frequency = DIV_ROUND_UP(vsp_hw_min_frequency,
+					(bitrate_table_kalama_2stage_fp[codec][0] *
+					fw_sw_vsp_offset));
+			} else {
+				vsp_hw_min_frequency = DIV_ROUND_UP(vsp_hw_min_frequency,
+					(bitrate_table_kalama_1stage_fp[codec][0] *
+					fw_sw_vsp_offset));
+			}
+		}
+	} else {
+		vsp_hw_min_frequency = frequency_table_kalama[0][1] *
+			input_bitrate_fp * 1000;
+
+		if (codec_input.codec == CODEC_AV1 && bitrate_entry == 1)
+			vsp_hw_min_frequency = frequency_table_kalama[0][0] *
+				input_bitrate_fp * 1000;
+
+		if ((codec_input.codec == CODEC_H264_CAVLC) &&
+			(codec_input.entropy_coding_mode == CODEC_ENTROPY_CODING_CAVLC))
+			codec = CODEC_H264_CAVLC;
+		else if ((codec_input.codec == CODEC_H264) &&
+			(codec_input.entropy_coding_mode == CODEC_ENTROPY_CODING_CABAC))
+			codec = CODEC_H264;
+
+		if (codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_2S)
+			vsp_hw_min_frequency = DIV_ROUND_UP(vsp_hw_min_frequency,
+				(bitrate_table_kalama_2stage_fp[codec][bitrate_entry]) *
+					fw_sw_vsp_offset);
+		else
+			vsp_hw_min_frequency = DIV_ROUND_UP(vsp_hw_min_frequency,
+				(bitrate_table_kalama_1stage_fp[codec][bitrate_entry]) *
+					fw_sw_vsp_offset);
+	}
+
+	codec_output->vsp_min_freq = vsp_hw_min_frequency;
+	return 0;
+}
+
+static u32 calculate_pipe_penalty(struct api_calculation_input codec_input)
+{
+	u32 pipe_penalty_codec = 0;
+	u8 avid_commercial_content = 0;
+	u32 pixel_count = 0;
+
+	/* decoder */
+	if (codec_input.decoder_or_encoder == CODEC_DECODER) {
+		pipe_penalty_codec = pipe_penalty_kalama[0][0];
+		avid_commercial_content = codec_input.av1d_commer_tile_enable;
+		if (codec_input.codec == CODEC_AV1) {
+			pixel_count = codec_input.frame_width * codec_input.frame_height;
+			if (pixel_count <= 1920 * 1080)
+				pipe_penalty_codec =
+					pipe_penalty_kalama[avid_commercial_content + 1][0];
+			else if (pixel_count < 3840 * 2160)
+				pipe_penalty_codec =
+					(pipe_penalty_kalama[avid_commercial_content + 1][0] +
+					pipe_penalty_kalama[avid_commercial_content + 1][1]) / 2;
+			else if ((pixel_count == 3840 * 2160) ||
+				(pixel_count == 4096 * 2160) || (pixel_count == 4096 * 2304))
+				pipe_penalty_codec =
+					pipe_penalty_kalama[avid_commercial_content + 1][1];
+			else if (pixel_count < 7680 * 4320)
+				pipe_penalty_codec =
+					(pipe_penalty_kalama[avid_commercial_content + 1][1] +
+					pipe_penalty_kalama[avid_commercial_content + 1][2]) / 2;
+			else
+				pipe_penalty_codec =
+					pipe_penalty_kalama[avid_commercial_content + 1][2];
+		}
+	} else {
+		pipe_penalty_codec = 101;
+	}
+
+	return pipe_penalty_codec;
+}
+
+static int calculate_vpp_min_freq(struct api_calculation_input codec_input,
+		struct api_calculation_freq_output *codec_output)
+{
+	u32 vpp_hw_min_frequency = 0;
+	u32 fmin = 0;
+	u32 tensilica_min_frequency = 0;
+	u32 decoder_vsp_fw_overhead = 100 + 5; /* amplified by 100x */
+	/* UInt32 fw_sw_vsp_offset = 1000 + 55;       amplified by 1000x */
+	/* TODO from calculate_sw_vsp_min_freq */
+	u32 vsp_hw_min_frequency = codec_output->vsp_min_freq;
+	u32 pipe_penalty_codec = 0;
+	u32 fmin_fwoverhead105 = 0;
+	u32 fmin_measured_fwoverhead = 0;
+	u32 lpmode_uhd_cycle_permb = 0;
+	u32 hqmode1080p_cycle_permb = 0;
+	u32 encoder_vpp_target_clk_per_mb = 0;
+
+	codec_mbspersession_kalama =
+		calculate_number_mbs_kalama(codec_input.frame_width,
+		codec_input.frame_height, codec_input.lcu_size) *
+		codec_input.frame_rate;
+
+	/* Section 2. 0  VPP/VSP calculation */
+	if (codec_input.decoder_or_encoder == CODEC_DECODER) { /* decoder */
+		vpp_hw_min_frequency = ((decoder_vpp_target_clk_per_mb_kalama) *
+			(codec_mbspersession_kalama) + codec_input.pipe_num - 1) /
+			(codec_input.pipe_num);
+
+		vpp_hw_min_frequency = (vpp_hw_min_frequency + 99999) / 1000000;
+
+		if (codec_input.pipe_num > 1) {
+			pipe_penalty_codec = calculate_pipe_penalty(codec_input);
+			vpp_hw_min_frequency = (vpp_hw_min_frequency *
+				pipe_penalty_codec + 999) / 1000;
+		}
+
+		if (codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_2S) {
+			/* FW overhead, convert FW cycles to impact to one pipe */
+			u64 decoder_vpp_fw_overhead = 0;
+
+			decoder_vpp_fw_overhead =
+				DIV_ROUND_UP((DECODER_VPP_FW_OVERHEAD_KALAMA * 10 *
+				codec_input.frame_rate), 15);
+
+			decoder_vpp_fw_overhead =
+				DIV_ROUND_UP((decoder_vpp_fw_overhead * 1000),
+				(codec_mbspersession_kalama *
+				decoder_vpp_target_clk_per_mb_kalama / codec_input.pipe_num));
+
+			decoder_vpp_fw_overhead += 1000;
+			decoder_vpp_fw_overhead = (decoder_vpp_fw_overhead < 1050) ?
+				1050 : decoder_vpp_fw_overhead;
+
+			/* VPP HW + FW */
+			if (codec_input.linear_opb == 1 &&
+			    codec_input.bitdepth == CODEC_BITDEPTH_10)
+				/* multiply by 1.20 for 10b case */
+				decoder_vpp_fw_overhead = 1200 + decoder_vpp_fw_overhead - 1000;
+
+			vpp_hw_min_frequency = (vpp_hw_min_frequency *
+				decoder_vpp_fw_overhead + 999) / 1000;
+
+			/* VSP HW+FW */
+			vsp_hw_min_frequency =
+				(vsp_hw_min_frequency * decoder_vsp_fw_overhead + 99) / 100;
+
+			fmin = (vpp_hw_min_frequency > vsp_hw_min_frequency) ?
+				vpp_hw_min_frequency : vsp_hw_min_frequency;
+		} else {
+			/* 1-stage need SW cycles + FW cycles + HW time */
+			if (codec_input.linear_opb == 1 &&
+			    codec_input.bitdepth == CODEC_BITDEPTH_10)
+				/* multiply by 1.20 for 10b linear case */
+				vpp_hw_min_frequency =
+					(vpp_hw_min_frequency * 1200 + 999) / 1000;
+
+			/*
+			 * HW time
+			 * comment: 02/23/2021 SY: the bitrate is measured bitrate,
+			 * the overlapping effect is already considered into bitrate.
+			 * no need to add extra anymore
+			 */
+			fmin = (vpp_hw_min_frequency > vsp_hw_min_frequency) ?
+				vpp_hw_min_frequency : vsp_hw_min_frequency;
+
+			/* FW time */
+			fmin_fwoverhead105 = (fmin * 105 + 99) / 100;
+			fmin_measured_fwoverhead = fmin +
+				(((DECODER_VPPVSP1STAGE_FW_OVERHEAD_KALAMA *
+				codec_input.frame_rate * 10 + 14) / 15 + 999) / 1000 + 999) /
+				1000;
+
+			fmin = (fmin_fwoverhead105 > fmin_measured_fwoverhead) ?
+				fmin_fwoverhead105 : fmin_measured_fwoverhead;
+		}
+
+		tensilica_min_frequency = (DECODER_SW_OVERHEAD_KALAMA * 10 + 14) / 15;
+		tensilica_min_frequency = (tensilica_min_frequency + 999) / 1000;
+		tensilica_min_frequency = tensilica_min_frequency * codec_input.frame_rate;
+		tensilica_min_frequency = (tensilica_min_frequency + 999) / 1000;
+		fmin = (tensilica_min_frequency > fmin) ? tensilica_min_frequency : fmin;
+	} else { /* encoder */
+		/* Decide LP/HQ */
+		u8 hq_mode = 0;
+
+		if (codec_input.pipe_num > 1)
+			if (codec_input.frame_width * codec_input.frame_height <=
+				1920 * 1080)
+				if (codec_input.frame_width * codec_input.frame_height *
+					codec_input.frame_rate <= 1920 * 1080 * 60)
+					hq_mode = 1;
+
+		codec_output->enc_hqmode = hq_mode;
+
+		/* Section 1. 0 */
+		/* TODO ONETIME call, should be in another place. */
+		initialize_encoder_complexity_table();
+
+		/* End Calculate Encoder GOP Complexity Table */
+
+		/* VPP base cycle */
+		lpmode_uhd_cycle_permb = (320 *
+			codec_encoder_gop_complexity_table_fp
+			[codec_input.hierachical_layer][CODEC_ENCODER_GOP_FACTORY_ENTRY]
+			+ 99) / 100;
+
+		if ((codec_input.frame_width == 1920) &&
+			((codec_input.frame_height == 1080) ||
+			(codec_input.frame_height == 1088)) &&
+			(codec_input.frame_rate >= 480))
+			lpmode_uhd_cycle_permb = (90 * 4 *
+				codec_encoder_gop_complexity_table_fp
+				[codec_input.hierachical_layer][CODEC_ENCODER_GOP_FACTORY_ENTRY]
+				+ 99) / 100;
+
+		if ((codec_input.frame_width == 1280) &&
+			((codec_input.frame_height == 720) ||
+			(codec_input.frame_height == 768)) &&
+			(codec_input.frame_rate >= 960))
+			lpmode_uhd_cycle_permb = (99 * 4 *
+				codec_encoder_gop_complexity_table_fp
+				[codec_input.hierachical_layer][CODEC_ENCODER_GOP_FACTORY_ENTRY]
+				+ 99) / 100;
+
+		hqmode1080p_cycle_permb = (675 *
+			codec_encoder_gop_complexity_table_fp
+			[codec_input.hierachical_layer][CODEC_ENCODER_GOP_FACTORY_ENTRY]
+			+ 99) / 100;
+
+		encoder_vpp_target_clk_per_mb = (hq_mode) ?
+			hqmode1080p_cycle_permb : lpmode_uhd_cycle_permb;
+
+		vpp_hw_min_frequency = ((encoder_vpp_target_clk_per_mb) *
+			(codec_mbspersession_kalama) + codec_input.pipe_num - 1) /
+			(codec_input.pipe_num);
+
+		vpp_hw_min_frequency = (vpp_hw_min_frequency + 99999) / 1000000;
+
+		if (codec_input.pipe_num > 1) {
+			u32 pipe_penalty_codec = 101;
+
+			vpp_hw_min_frequency = (vpp_hw_min_frequency *
+				pipe_penalty_codec + 99) / 100;
+		}
+
+		if (codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_2S) {
+			/* FW overhead, convert FW cycles to impact to one pipe */
+			u64 encoder_vpp_fw_overhead = 0;
+
+			encoder_vpp_fw_overhead =
+				DIV_ROUND_UP((ENCODER_VPP_FW_OVERHEAD_KALAMA * 10 *
+				codec_input.frame_rate), 15);
+
+			encoder_vpp_fw_overhead =
+				DIV_ROUND_UP((encoder_vpp_fw_overhead * 1000),
+				(codec_mbspersession_kalama * encoder_vpp_target_clk_per_mb /
+				codec_input.pipe_num));
+
+			encoder_vpp_fw_overhead += 1000;
+
+			encoder_vpp_fw_overhead = (encoder_vpp_fw_overhead < 1050) ?
+				1050 : encoder_vpp_fw_overhead;
+
+			/* VPP HW + FW */
+			vpp_hw_min_frequency = (vpp_hw_min_frequency *
+				encoder_vpp_fw_overhead + 999) / 1000;
+
+			/* TODO : decoder_vsp_fw_overhead? */
+			vsp_hw_min_frequency = (vsp_hw_min_frequency *
+				decoder_vsp_fw_overhead + 99) / 100;
+
+			fmin = (vpp_hw_min_frequency > vsp_hw_min_frequency) ?
+				vpp_hw_min_frequency : vsp_hw_min_frequency;
+		} else {
+			/* HW time */
+			fmin = (vpp_hw_min_frequency > vsp_hw_min_frequency) ?
+				vpp_hw_min_frequency : vsp_hw_min_frequency;
+
+			/* FW time */
+			fmin_fwoverhead105 = (fmin * 105 + 99) / 100;
+			fmin_measured_fwoverhead = fmin +
+				(((DECODER_VPPVSP1STAGE_FW_OVERHEAD_KALAMA *
+				codec_input.frame_rate * 10 + 14) / 15 + 999) /
+				1000 + 999) / 1000;
+
+			fmin = (fmin_fwoverhead105 > fmin_measured_fwoverhead) ?
+				fmin_fwoverhead105 : fmin_measured_fwoverhead;
+			/* SW time */
+		}
+
+		tensilica_min_frequency = (ENCODER_SW_OVERHEAD_KALAMA * 10 + 14) / 15;
+		tensilica_min_frequency = (tensilica_min_frequency + 999) / 1000;
+
+		tensilica_min_frequency = tensilica_min_frequency *
+			codec_input.frame_rate;
+
+		tensilica_min_frequency = (tensilica_min_frequency + 999) / 1000;
+
+		fmin = (tensilica_min_frequency > fmin) ?
+			tensilica_min_frequency : fmin;
+	}
+
+	codec_output->vpp_min_freq = vpp_hw_min_frequency;
+	codec_output->vsp_min_freq = vsp_hw_min_frequency;
+	codec_output->tensilica_min_freq = tensilica_min_frequency;
+	codec_output->hw_min_freq = fmin;
+
+	return 0;
+}
+
+int msm_vidc_calculate_frequency(struct api_calculation_input codec_input,
+		struct api_calculation_freq_output *codec_output)
+{
+	int rc = 0;
+
+	rc = calculate_vsp_min_freq(codec_input, codec_output);
+	if (rc)
+		return rc;
+
+	rc = calculate_vpp_min_freq(codec_input, codec_output);
+	if (rc)
+		return rc;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris3/src/msm_vidc_iris3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris3/src/msm_vidc_iris3.c
@@ -0,0 +1,1097 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iopoll.h>
+
+#include "msm_vidc_iris3.h"
+#include "msm_vidc_buffer_iris3.h"
+#include "msm_vidc_power_iris3.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_buffer.h"
+#include "msm_vidc_state.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_variant.h"
+#include "venus_hfi.h"
+
+#define VIDEO_ARCH_LX 1
+
+#define VCODEC_BASE_OFFS_IRIS3                 0x00000000
+#define AON_MVP_NOC_RESET                      0x0001F000
+#define CPU_BASE_OFFS_IRIS3                    0x000A0000
+#define AON_BASE_OFFS			               0x000E0000
+#define CPU_CS_BASE_OFFS_IRIS3		           (CPU_BASE_OFFS_IRIS3)
+#define CPU_IC_BASE_OFFS_IRIS3		           (CPU_BASE_OFFS_IRIS3)
+
+#define CPU_CS_A2HSOFTINTCLR_IRIS3             (CPU_CS_BASE_OFFS_IRIS3 + 0x1C)
+#define CPU_CS_VCICMD_IRIS3                    (CPU_CS_BASE_OFFS_IRIS3 + 0x20)
+#define CPU_CS_VCICMDARG0_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x24)
+#define CPU_CS_VCICMDARG1_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x28)
+#define CPU_CS_VCICMDARG2_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x2C)
+#define CPU_CS_VCICMDARG3_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x30)
+#define CPU_CS_VMIMSG_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x34)
+#define CPU_CS_VMIMSGAG0_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x38)
+#define CPU_CS_VMIMSGAG1_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x3C)
+#define CPU_CS_SCIACMD_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x48)
+#define CPU_CS_H2XSOFTINTEN_IRIS3	(CPU_CS_BASE_OFFS_IRIS3 + 0x148)
+
+/* HFI_CTRL_STATUS */
+#define CPU_CS_SCIACMDARG0_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x4C)
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_ERROR_STATUS_BMSK_IRIS3	0xfe
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_PC_READY_IRIS3           0x100
+#define CPU_CS_SCIACMDARG0_HFI_CTRL_INIT_IDLE_MSG_BMSK_IRIS3     0x40000000
+
+/* HFI_QTBL_INFO */
+#define CPU_CS_SCIACMDARG1_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x50)
+
+/* HFI_QTBL_ADDR */
+#define CPU_CS_SCIACMDARG2_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x54)
+
+/* HFI_VERSION_INFO */
+#define CPU_CS_SCIACMDARG3_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x58)
+
+/* SFR_ADDR */
+#define CPU_CS_SCIBCMD_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x5C)
+
+/* MMAP_ADDR */
+#define CPU_CS_SCIBCMDARG0_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x60)
+
+/* UC_REGION_ADDR */
+#define CPU_CS_SCIBARG1_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x64)
+
+/* UC_REGION_ADDR */
+#define CPU_CS_SCIBARG2_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x68)
+
+#define CPU_CS_AHB_BRIDGE_SYNC_RESET            (CPU_CS_BASE_OFFS_IRIS3 + 0x160)
+#define CPU_CS_AHB_BRIDGE_SYNC_RESET_STATUS     (CPU_CS_BASE_OFFS_IRIS3 + 0x164)
+
+/* FAL10 Feature Control */
+#define CPU_CS_X2RPMh_IRIS3		(CPU_CS_BASE_OFFS_IRIS3 + 0x168)
+#define CPU_CS_X2RPMh_MASK0_BMSK_IRIS3	0x1
+#define CPU_CS_X2RPMh_MASK0_SHFT_IRIS3	0x0
+#define CPU_CS_X2RPMh_MASK1_BMSK_IRIS3	0x2
+#define CPU_CS_X2RPMh_MASK1_SHFT_IRIS3	0x1
+#define CPU_CS_X2RPMh_SWOVERRIDE_BMSK_IRIS3	0x4
+#define CPU_CS_X2RPMh_SWOVERRIDE_SHFT_IRIS3	0x3
+
+#define CPU_IC_SOFTINT_IRIS3		(CPU_IC_BASE_OFFS_IRIS3 + 0x150)
+#define CPU_IC_SOFTINT_H2A_SHFT_IRIS3	0x0
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: AON_MVP_NOC_RESET_REGISTERS
+ * --------------------------------------------------------------------------
+ */
+#define AON_WRAPPER_MVP_NOC_RESET_REQ   (AON_MVP_NOC_RESET + 0x000)
+#define AON_WRAPPER_MVP_NOC_RESET_ACK   (AON_MVP_NOC_RESET + 0x004)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: wrapper
+ * --------------------------------------------------------------------------
+ */
+#define WRAPPER_BASE_OFFS_IRIS3		0x000B0000
+#define WRAPPER_INTR_STATUS_IRIS3	(WRAPPER_BASE_OFFS_IRIS3 + 0x0C)
+#define WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS3	0x8
+#define WRAPPER_INTR_STATUS_A2H_BMSK_IRIS3	0x4
+
+#define WRAPPER_INTR_MASK_IRIS3		(WRAPPER_BASE_OFFS_IRIS3 + 0x10)
+#define WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS3	0x8
+#define WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS3	0x4
+
+#define WRAPPER_CPU_CLOCK_CONFIG_IRIS3	(WRAPPER_BASE_OFFS_IRIS3 + 0x2000)
+#define WRAPPER_CPU_CGC_DIS_IRIS3	(WRAPPER_BASE_OFFS_IRIS3 + 0x2010)
+#define WRAPPER_CPU_STATUS_IRIS3	(WRAPPER_BASE_OFFS_IRIS3 + 0x2014)
+
+#define WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS3	(WRAPPER_BASE_OFFS_IRIS3 + 0x54)
+#define WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS3	(WRAPPER_BASE_OFFS_IRIS3 + 0x58)
+#define WRAPPER_IRIS_CPU_NOC_LPI_CONTROL	(WRAPPER_BASE_OFFS_IRIS3 + 0x5C)
+#define WRAPPER_IRIS_CPU_NOC_LPI_STATUS		(WRAPPER_BASE_OFFS_IRIS3 + 0x60)
+#define WRAPPER_CORE_POWER_STATUS		(WRAPPER_BASE_OFFS_IRIS3 + 0x80)
+#define WRAPPER_CORE_POWER_CONTROL		(WRAPPER_BASE_OFFS_IRIS3 + 0x84)
+#define WRAPPER_CORE_CLOCK_CONFIG_IRIS3		(WRAPPER_BASE_OFFS_IRIS3 + 0x88)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: tz_wrapper
+ * --------------------------------------------------------------------------
+ */
+#define WRAPPER_TZ_BASE_OFFS	0x000C0000
+#define WRAPPER_TZ_CPU_CLOCK_CONFIG	(WRAPPER_TZ_BASE_OFFS)
+#define WRAPPER_TZ_CPU_STATUS	(WRAPPER_TZ_BASE_OFFS + 0x10)
+#define WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG	(WRAPPER_TZ_BASE_OFFS + 0x14)
+#define WRAPPER_TZ_QNS4PDXFIFO_RESET	(WRAPPER_TZ_BASE_OFFS + 0x18)
+
+#define CTRL_INIT_IRIS3		CPU_CS_SCIACMD_IRIS3
+
+#define CTRL_STATUS_IRIS3	CPU_CS_SCIACMDARG0_IRIS3
+#define CTRL_ERROR_STATUS__M_IRIS3 \
+		CPU_CS_SCIACMDARG0_HFI_CTRL_ERROR_STATUS_BMSK_IRIS3
+#define CTRL_INIT_IDLE_MSG_BMSK_IRIS3 \
+		CPU_CS_SCIACMDARG0_HFI_CTRL_INIT_IDLE_MSG_BMSK_IRIS3
+#define CTRL_STATUS_PC_READY_IRIS3 \
+		CPU_CS_SCIACMDARG0_HFI_CTRL_PC_READY_IRIS3
+
+
+#define QTBL_INFO_IRIS3		CPU_CS_SCIACMDARG1_IRIS3
+
+#define QTBL_ADDR_IRIS3		CPU_CS_SCIACMDARG2_IRIS3
+
+#define VERSION_INFO_IRIS3	    CPU_CS_SCIACMDARG3_IRIS3
+
+#define SFR_ADDR_IRIS3		    CPU_CS_SCIBCMD_IRIS3
+#define MMAP_ADDR_IRIS3		CPU_CS_SCIBCMDARG0_IRIS3
+#define UC_REGION_ADDR_IRIS3	CPU_CS_SCIBARG1_IRIS3
+#define UC_REGION_SIZE_IRIS3	CPU_CS_SCIBARG2_IRIS3
+
+#define AON_WRAPPER_MVP_NOC_LPI_CONTROL	(AON_BASE_OFFS)
+#define AON_WRAPPER_MVP_NOC_LPI_STATUS	(AON_BASE_OFFS + 0x4)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: VCODEC_SS registers
+ * --------------------------------------------------------------------------
+ */
+#define VCODEC_SS_IDLE_STATUSn           (VCODEC_BASE_OFFS_IRIS3 + 0x70)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: vcodec noc error log registers (iris3)
+ * --------------------------------------------------------------------------
+ */
+#define VCODEC_NOC_VIDEO_A_NOC_BASE_OFFS		0x00010000
+#define VCODEC_NOC_ERL_MAIN_SWID_LOW			0x00011200
+#define VCODEC_NOC_ERL_MAIN_SWID_HIGH			0x00011204
+#define VCODEC_NOC_ERL_MAIN_MAINCTL_LOW			0x00011208
+#define VCODEC_NOC_ERL_MAIN_ERRVLD_LOW			0x00011210
+#define VCODEC_NOC_ERL_MAIN_ERRCLR_LOW			0x00011218
+#define VCODEC_NOC_ERL_MAIN_ERRLOG0_LOW			0x00011220
+#define VCODEC_NOC_ERL_MAIN_ERRLOG0_HIGH		0x00011224
+#define VCODEC_NOC_ERL_MAIN_ERRLOG1_LOW			0x00011228
+#define VCODEC_NOC_ERL_MAIN_ERRLOG1_HIGH		0x0001122C
+#define VCODEC_NOC_ERL_MAIN_ERRLOG2_LOW			0x00011230
+#define VCODEC_NOC_ERL_MAIN_ERRLOG2_HIGH		0x00011234
+#define VCODEC_NOC_ERL_MAIN_ERRLOG3_LOW			0x00011238
+#define VCODEC_NOC_ERL_MAIN_ERRLOG3_HIGH		0x0001123C
+
+static int __interrupt_init_iris3(struct msm_vidc_core *core)
+{
+	u32 mask_val = 0;
+	int rc = 0;
+
+	/* All interrupts should be disabled initially 0x1F6 : Reset value */
+	rc = __read_register(core, WRAPPER_INTR_MASK_IRIS3, &mask_val);
+	if (rc)
+		return rc;
+
+	/* Write 0 to unmask CPU and WD interrupts */
+	mask_val &= ~(WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS3 |
+			WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS3);
+	rc = __write_register(core, WRAPPER_INTR_MASK_IRIS3, mask_val);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __setup_ucregion_memory_map_iris3(struct msm_vidc_core *core)
+{
+	u32 value;
+	int rc = 0;
+
+	value = (u32)core->iface_q_table.align_device_addr;
+	rc = __write_register(core, UC_REGION_ADDR_IRIS3, value);
+	if (rc)
+		return rc;
+
+	value = SHARED_QSIZE;
+	rc = __write_register(core, UC_REGION_SIZE_IRIS3, value);
+	if (rc)
+		return rc;
+
+	value = (u32)core->iface_q_table.align_device_addr;
+	rc = __write_register(core, QTBL_ADDR_IRIS3, value);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, QTBL_INFO_IRIS3, 0x01);
+	if (rc)
+		return rc;
+
+	/* update queues vaddr for debug purpose */
+	value = (u32)((u64)core->iface_q_table.align_virtual_addr);
+	rc = __write_register(core, CPU_CS_VCICMDARG0_IRIS3, value);
+	if (rc)
+		return rc;
+
+	value = (u32)((u64)core->iface_q_table.align_virtual_addr >> 32);
+	rc = __write_register(core, CPU_CS_VCICMDARG1_IRIS3, value);
+	if (rc)
+		return rc;
+
+	if (core->sfr.align_device_addr) {
+		value = (u32)core->sfr.align_device_addr + VIDEO_ARCH_LX;
+		rc = __write_register(core, SFR_ADDR_IRIS3, value);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int __switch_gdsc_mode_iris3(struct msm_vidc_core *core, bool sw_mode)
+{
+	int rc;
+
+	if (sw_mode) {
+		rc = __write_register(core, WRAPPER_CORE_POWER_CONTROL, 0x0);
+		if (rc)
+			return rc;
+		rc = __read_register_with_poll_timeout(core, WRAPPER_CORE_POWER_STATUS,
+						       BIT(1), 0x2, 200, 2000);
+		if (rc) {
+			d_vpr_e("%s: Failed to read WRAPPER_CORE_POWER_STATUS register to 0x1\n",
+				__func__);
+			return rc;
+		}
+	} else {
+		rc = __write_register(core, WRAPPER_CORE_POWER_CONTROL, 0x1);
+		if (rc)
+			return rc;
+		rc = __read_register_with_poll_timeout(core, WRAPPER_CORE_POWER_STATUS,
+						       BIT(1), 0x0, 200, 2000);
+		if (rc) {
+			d_vpr_e("%s: Failed to read WRAPPER_CORE_POWER_STATUS register to 0x0\n",
+				__func__);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static bool is_iris3_hw_power_collapsed(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 value = 0, pwr_status = 0;
+
+	rc = __read_register(core, WRAPPER_CORE_POWER_STATUS, &value);
+	if (rc)
+		return false;
+
+	/* if BIT(1) is 1 then video hw power is on else off */
+	pwr_status = value & BIT(1);
+	return pwr_status ? false : true;
+}
+
+static int __power_off_iris3_hardware(struct msm_vidc_core *core)
+{
+	int rc = 0, i;
+	u32 value = 0;
+	bool pwr_collapsed = false;
+
+	/*
+	 * Incase hw power control is enabled, for both CPU WD, video
+	 * hw unresponsive cases, check for power status to decide on
+	 * executing NOC reset sequence before disabling power. If there
+	 * is no CPU WD and hw power control is enabled, fw is expected
+	 * to power collapse video hw always.
+	 */
+	if (is_core_sub_state(core, CORE_SUBSTATE_FW_PWR_CTRL)) {
+		pwr_collapsed = is_iris3_hw_power_collapsed(core);
+		if (is_core_sub_state(core, CORE_SUBSTATE_CPU_WATCHDOG) ||
+			is_core_sub_state(core, CORE_SUBSTATE_VIDEO_UNRESPONSIVE)) {
+			if (pwr_collapsed) {
+				d_vpr_e("%s: video hw power collapsed %s\n",
+					__func__, core->sub_state_name);
+				goto disable_power;
+			} else {
+				d_vpr_e("%s: video hw is power ON %s\n",
+					__func__, core->sub_state_name);
+			}
+		} else {
+			if (!pwr_collapsed)
+				d_vpr_e("%s: video hw is not power collapsed\n", __func__);
+
+			d_vpr_h("%s: disabling hw power\n", __func__);
+			goto disable_power;
+		}
+	}
+
+	/*
+	 * check to make sure core clock branch enabled else
+	 * we cannot read vcodec top idle register
+	 */
+	rc = __read_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS3, &value);
+	if (rc)
+		return rc;
+
+	if (value) {
+		d_vpr_h("%s: core clock config not enabled, enabling it to read vcodec registers\n",
+			__func__);
+		rc = __write_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS3, 0);
+		if (rc)
+			return rc;
+	}
+
+	/*
+	 * add MNoC idle check before collapsing MVS0 per HPG update
+	 * poll for NoC DMA idle -> HPG 6.1.1
+	 */
+	for (i = 0; i < core->capabilities[NUM_VPP_PIPE].value; i++) {
+		rc = __read_register_with_poll_timeout(core, VCODEC_SS_IDLE_STATUSn + 4*i,
+				0x400000, 0x400000, 2000, 20000);
+		if (rc)
+			d_vpr_h("%s: VCODEC_SS_IDLE_STATUSn (%d) is not idle (%#x)\n",
+				__func__, i, value);
+	}
+
+	/* Apply partial reset on MSF interface and wait for ACK */
+	rc = __write_register(core, AON_WRAPPER_MVP_NOC_RESET_REQ, 0x3);
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, AON_WRAPPER_MVP_NOC_RESET_ACK,
+			0x3, 0x3, 200, 2000);
+	if (rc)
+		d_vpr_h("%s: AON_WRAPPER_MVP_NOC_RESET assert failed\n", __func__);
+
+	/* De-assert partial reset on MSF interface and wait for ACK */
+	rc = __write_register(core, AON_WRAPPER_MVP_NOC_RESET_REQ, 0x0);
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, AON_WRAPPER_MVP_NOC_RESET_ACK,
+			0x3, 0x0, 200, 2000);
+	if (rc)
+		d_vpr_h("%s: AON_WRAPPER_MVP_NOC_RESET de-assert failed\n", __func__);
+
+	/*
+	 * Reset both sides of 2 ahb2ahb_bridges (TZ and non-TZ)
+	 * do we need to check status register here?
+	 */
+	rc = __write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x3);
+	if (rc)
+		return rc;
+	rc = __write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x2);
+	if (rc)
+		return rc;
+	rc = __write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x0);
+	if (rc)
+		return rc;
+
+disable_power:
+	/* power down process */
+	rc = call_res_op(core, gdsc_off, core, "vcodec");
+	if (rc) {
+		d_vpr_e("%s: disable regulator vcodec failed\n", __func__);
+		rc = 0;
+	}
+
+	rc = call_res_op(core, clk_disable, core, "vcodec_clk");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare vcodec_clk failed\n", __func__);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int __power_off_iris3_controller(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	/*
+	 * mask fal10_veto QLPAC error since fal10_veto can go 1
+	 * when pwwait == 0 and clamped to 0 -> HPG 6.1.2
+	 */
+	rc = __write_register(core, CPU_CS_X2RPMh_IRIS3, 0x3);
+	if (rc)
+		return rc;
+
+	/* set MNoC to low power, set PD_NOC_QREQ (bit 0) */
+	rc = __write_register_masked(core, AON_WRAPPER_MVP_NOC_LPI_CONTROL,
+			0x1, BIT(0));
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, AON_WRAPPER_MVP_NOC_LPI_STATUS,
+			0x1, 0x1, 200, 2000);
+	if (rc)
+		d_vpr_h("%s: AON_WRAPPER_MVP_NOC_LPI_CONTROL failed\n", __func__);
+
+	/* Set Iris CPU NoC to Low power */
+	rc = __write_register_masked(core, WRAPPER_IRIS_CPU_NOC_LPI_CONTROL,
+			0x1, BIT(0));
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, WRAPPER_IRIS_CPU_NOC_LPI_STATUS,
+			0x1, 0x1, 200, 2000);
+	if (rc)
+		d_vpr_h("%s: WRAPPER_IRIS_CPU_NOC_LPI_CONTROL failed\n", __func__);
+
+	/* Debug bridge LPI release */
+	rc = __write_register(core, WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS3, 0x0);
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS3,
+			0xffffffff, 0x0, 200, 2000);
+	if (rc)
+		d_vpr_h("%s: debug bridge release failed\n", __func__);
+
+	/* Reset MVP QNS4PDXFIFO */
+	rc = __write_register(core, WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG, 0x3);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, WRAPPER_TZ_QNS4PDXFIFO_RESET, 0x1);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, WRAPPER_TZ_QNS4PDXFIFO_RESET, 0x0);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG, 0x0);
+	if (rc)
+		return rc;
+
+	/* Turn off MVP MVS0C core clock */
+	rc = call_res_op(core, clk_disable, core, "core_clk");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare core_clk failed\n", __func__);
+		rc = 0;
+	}
+
+	/* power down process */
+	rc = call_res_op(core, gdsc_off, core, "iris-ctl");
+	if (rc) {
+		d_vpr_e("%s: disable regulator iris-ctl failed\n", __func__);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int __power_off_iris3(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE))
+		return 0;
+
+	/**
+	 * Reset video_cc_mvs0_clk_src value to resolve MMRM high video
+	 * clock projection issue.
+	 */
+	rc = call_res_op(core, set_clks, core, 0);
+	if (rc)
+		d_vpr_e("%s: resetting clocks failed\n", __func__);
+
+	if (__power_off_iris3_hardware(core))
+		d_vpr_e("%s: failed to power off hardware\n", __func__);
+
+	if (__power_off_iris3_controller(core))
+		d_vpr_e("%s: failed to power off controller\n", __func__);
+
+	rc = call_res_op(core, set_bw, core, 0, 0);
+	if (rc)
+		d_vpr_e("%s: failed to unvote buses\n", __func__);
+
+	if (!call_venus_op(core, watchdog, core, core->intr_status))
+		disable_irq_nosync(core->resource->irq);
+
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE, 0, __func__);
+
+	return rc;
+}
+
+static int __power_on_iris3_controller(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = call_res_op(core, gdsc_on, core, "iris-ctl");
+	if (rc)
+		goto fail_regulator;
+
+	rc = call_res_op(core, reset_bridge, core);
+	if (rc)
+		goto fail_reset_ahb2axi;
+
+	rc = call_res_op(core, clk_enable, core, "gcc_video_axi0");
+	if (rc)
+		goto fail_clk_axi;
+
+	rc = call_res_op(core, clk_enable, core, "core_clk");
+	if (rc)
+		goto fail_clk_controller;
+
+	return 0;
+
+fail_clk_controller:
+	call_res_op(core, clk_disable, core, "gcc_video_axi0");
+fail_clk_axi:
+fail_reset_ahb2axi:
+	call_res_op(core, gdsc_off, core, "iris-ctl");
+fail_regulator:
+	return rc;
+}
+
+static int __power_on_iris3_hardware(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	/* When the vcodec GDSC is powered on, it moves into HW control. As it moves into HW control,
+	 * vcodec is initiated with power down sequence. Driver then requests for migrating GDSC into
+	 * sw control, which implies power up sequence for vcodec. Due to b2b switch of power off and
+	 * on for video hardware, it ends up in transient state and hungs eventually.
+	 * Writing the register explicitly to avoid power off sequence when HW control is set.
+	 */
+	writel_relaxed(0x0, (u8 *)core->resource->register_base_addr + WRAPPER_CORE_POWER_CONTROL);
+
+	rc = call_res_op(core, gdsc_on, core, "vcodec");
+	if (rc)
+		goto fail_regulator;
+
+	/* video controller and hardware powered on successfully */
+	rc = msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_POWER_ENABLE, __func__);
+	if (rc)
+		goto fail_power_on_substate;
+
+	rc = call_res_op(core, gdsc_sw_ctrl, core);
+	if (rc)
+		goto fail_sw_ctrl;
+
+	rc = call_res_op(core, clk_enable, core, "vcodec_clk");
+	if (rc)
+		goto fail_clk_controller;
+
+	return 0;
+
+fail_clk_controller:
+	call_res_op(core, gdsc_hw_ctrl, core);
+fail_sw_ctrl:
+fail_power_on_substate:
+	call_res_op(core, gdsc_off, core, "vcodec");
+fail_regulator:
+	return rc;
+}
+
+static int __power_on_iris3(struct msm_vidc_core *core)
+{
+	struct frequency_table *freq_tbl;
+	u32 freq = 0;
+	int rc = 0;
+
+	if (is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE))
+		return 0;
+
+	if (!core_in_valid_state(core)) {
+		d_vpr_e("%s: invalid core state %s\n",
+			__func__, core_state_name(core->state));
+		return -EINVAL;
+	}
+
+	/* Vote for all hardware resources */
+	rc = call_res_op(core, set_bw, core, INT_MAX, INT_MAX);
+	if (rc) {
+		d_vpr_e("%s: failed to vote buses, rc %d\n", __func__, rc);
+		goto fail_vote_buses;
+	}
+
+	rc = __power_on_iris3_controller(core);
+	if (rc) {
+		d_vpr_e("%s: failed to power on iris3 controller\n", __func__);
+		goto fail_power_on_controller;
+	}
+
+	rc = __power_on_iris3_hardware(core);
+	if (rc) {
+		d_vpr_e("%s: failed to power on iris3 hardware\n", __func__);
+		goto fail_power_on_hardware;
+	}
+
+	freq_tbl = core->resource->freq_set.freq_tbl;
+	freq = core->power.clk_freq ? core->power.clk_freq :
+				      freq_tbl[0].freq;
+
+	rc = call_res_op(core, set_clks, core, freq);
+	if (rc) {
+		d_vpr_e("%s: failed to scale clocks\n", __func__);
+		rc = 0;
+	}
+	/*
+	 * Re-program all of the registers that get reset as a result of
+	 * regulator_disable() and _enable()
+	 */
+	__set_registers(core);
+
+	__interrupt_init_iris3(core);
+	core->intr_status = 0;
+	enable_irq(core->resource->irq);
+
+	return rc;
+fail_power_on_hardware:
+	__power_off_iris3_controller(core);
+fail_power_on_controller:
+	call_res_op(core, set_bw, core, 0, 0);
+fail_vote_buses:
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE, 0, __func__);
+	return rc;
+}
+
+static int __prepare_pc_iris3(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 wfi_status = 0, idle_status = 0, pc_ready = 0;
+	u32 ctrl_status = 0;
+
+	rc = __read_register(core, CTRL_STATUS_IRIS3, &ctrl_status);
+	if (rc)
+		return rc;
+
+	pc_ready = ctrl_status & CTRL_STATUS_PC_READY_IRIS3;
+	idle_status = ctrl_status & BIT(30);
+
+	if (pc_ready) {
+		d_vpr_h("Already in pc_ready state\n");
+		return 0;
+	}
+	rc = __read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (rc)
+		return rc;
+
+	wfi_status &= BIT(0);
+	if (!wfi_status || !idle_status) {
+		d_vpr_e("Skipping PC, wfi status not set\n");
+		goto skip_power_off;
+	}
+
+	rc = __prepare_pc(core);
+	if (rc) {
+		d_vpr_e("Failed __prepare_pc %d\n", rc);
+		goto skip_power_off;
+	}
+
+	rc = __read_register_with_poll_timeout(core, CTRL_STATUS_IRIS3,
+			CTRL_STATUS_PC_READY_IRIS3, CTRL_STATUS_PC_READY_IRIS3, 250, 2500);
+	if (rc) {
+		d_vpr_e("%s: Skip PC. Ctrl status not set\n", __func__);
+		goto skip_power_off;
+	}
+
+	rc = __read_register_with_poll_timeout(core, WRAPPER_TZ_CPU_STATUS,
+			BIT(0), 0x1, 250, 2500);
+	if (rc) {
+		d_vpr_e("%s: Skip PC. Wfi status not set\n", __func__);
+		goto skip_power_off;
+	}
+	return rc;
+
+skip_power_off:
+	rc = __read_register(core, CTRL_STATUS_IRIS3, &ctrl_status);
+	if (rc)
+		return rc;
+	rc = __read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (rc)
+		return rc;
+	wfi_status &= BIT(0);
+	d_vpr_e("Skip PC, wfi=%#x, idle=%#x, pcr=%#x, ctrl=%#x)\n",
+		wfi_status, idle_status, pc_ready, ctrl_status);
+	return -EAGAIN;
+}
+
+static int __raise_interrupt_iris3(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = __write_register(core, CPU_IC_SOFTINT_IRIS3, 1 << CPU_IC_SOFTINT_H2A_SHFT_IRIS3);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __watchdog_iris3(struct msm_vidc_core *core, u32 intr_status)
+{
+	int rc = 0;
+
+	if (intr_status & WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS3) {
+		d_vpr_e("%s: received watchdog interrupt\n", __func__);
+		rc = 1;
+	}
+
+	return rc;
+}
+
+static int __noc_error_info_iris3(struct msm_vidc_core *core)
+{
+	/*
+	 * we are not supposed to access vcodec subsystem registers
+	 * unless vcodec core clock WRAPPER_CORE_CLOCK_CONFIG_IRIS3 is enabled.
+	 * core clock might have been disabled by video firmware as part of
+	 * inter frame power collapse (power plane control feature).
+	 */
+
+	/*
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_SWID_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_SWID_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_SWID_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_SWID_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_MAINCTL_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_MAINCTL_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRVLD_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRVLD_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRCLR_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRCLR_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG0_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG0_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG0_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG0_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG1_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG1_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG1_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG1_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG2_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG2_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG2_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG2_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG3_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG3_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG3_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG3_HIGH:     %#x\n", val);
+	 */
+
+	return 0;
+}
+
+static int __clear_interrupt_iris3(struct msm_vidc_core *core)
+{
+	u32 intr_status = 0, mask = 0;
+	int rc = 0;
+
+	rc = __read_register(core, WRAPPER_INTR_STATUS_IRIS3, &intr_status);
+	if (rc)
+		return rc;
+
+	mask = (WRAPPER_INTR_STATUS_A2H_BMSK_IRIS3|
+		WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS3|
+		CTRL_INIT_IDLE_MSG_BMSK_IRIS3);
+
+	if (intr_status & mask) {
+		core->intr_status |= intr_status;
+		core->reg_count++;
+		d_vpr_l("INTERRUPT: times: %d interrupt_status: %d\n",
+			core->reg_count, intr_status);
+	} else {
+		core->spur_count++;
+	}
+
+	rc = __write_register(core, CPU_CS_A2HSOFTINTCLR_IRIS3, 1);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __boot_firmware_iris3(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 ctrl_init_val = 0, ctrl_status = 0, count = 0, max_tries = 1000;
+
+	rc = __setup_ucregion_memory_map_iris3(core);
+	if (rc)
+		return rc;
+
+	ctrl_init_val = BIT(0);
+
+	rc = __write_register(core, CTRL_INIT_IRIS3, ctrl_init_val);
+	if (rc)
+		return rc;
+
+	while (!ctrl_status && count < max_tries) {
+		rc = __read_register(core, CTRL_STATUS_IRIS3, &ctrl_status);
+		if (rc)
+			return rc;
+
+		rc = __read_register(core, CTRL_INIT_IRIS3, &ctrl_init_val);
+		if (rc)
+			return rc;
+
+		if ((ctrl_status & CTRL_ERROR_STATUS__M_IRIS3) == 0x4) {
+			d_vpr_e("invalid setting for UC_REGION\n");
+			break;
+		}
+
+		usleep_range(50, 100);
+		count++;
+	}
+
+	if (count >= max_tries) {
+		d_vpr_e("Error booting up vidc firmware\n");
+		d_vpr_e("ctrl status %#x, ctrl init %#x\n", ctrl_status, ctrl_init_val);
+		return -ETIME;
+	}
+
+	/* Enable interrupt before sending commands to venus */
+	rc = __write_register(core, CPU_CS_H2XSOFTINTEN_IRIS3, 0x1);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, CPU_CS_X2RPMh_IRIS3, 0x0);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_vidc_decide_work_mode_iris3(struct msm_vidc_inst *inst)
+{
+	u32 work_mode;
+	struct v4l2_format *inp_f;
+	u32 width, height;
+	bool res_ok = false;
+
+	work_mode = MSM_VIDC_STAGE_2;
+	inp_f = &inst->fmts[INPUT_PORT];
+
+	if (is_image_decode_session(inst))
+		work_mode = MSM_VIDC_STAGE_1;
+
+	if (is_image_session(inst))
+		goto exit;
+
+	if (is_decode_session(inst)) {
+		height = inp_f->fmt.pix_mp.height;
+		width = inp_f->fmt.pix_mp.width;
+		res_ok = res_is_less_than(width, height, 1280, 720);
+		if (inst->capabilities[CODED_FRAMES].value ==
+				CODED_FRAMES_INTERLACE ||
+			inst->capabilities[LOWLATENCY_MODE].value ||
+			res_ok) {
+			work_mode = MSM_VIDC_STAGE_1;
+		}
+	} else if (is_encode_session(inst)) {
+		height = inst->crop.height;
+		width = inst->crop.width;
+		res_ok = !res_is_greater_than(width, height, 4096, 2160);
+		if (res_ok &&
+			(inst->capabilities[LOWLATENCY_MODE].value)) {
+			work_mode = MSM_VIDC_STAGE_1;
+		}
+
+		if (inst->capabilities[SLICE_MODE].value ==
+			V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES) {
+			work_mode = MSM_VIDC_STAGE_1;
+		}
+
+		if (inst->hfi_rc_type == HFI_RC_CBR_CFR ||
+			inst->hfi_rc_type == HFI_RC_CBR_VFR)
+				work_mode = MSM_VIDC_STAGE_1;
+
+		if (inst->capabilities[LOSSLESS].value)
+			work_mode = MSM_VIDC_STAGE_2;
+
+		if (!inst->capabilities[GOP_SIZE].value)
+			work_mode = MSM_VIDC_STAGE_2;
+	} else {
+		i_vpr_e(inst, "%s: invalid session type\n", __func__);
+		return -EINVAL;
+	}
+
+exit:
+	i_vpr_h(inst, "Configuring work mode = %u low latency = %u, gop size = %u\n",
+		work_mode, inst->capabilities[LOWLATENCY_MODE].value,
+		inst->capabilities[GOP_SIZE].value);
+	msm_vidc_update_cap_value(inst, STAGE, work_mode, __func__);
+
+	return 0;
+}
+
+static int msm_vidc_decide_work_route_iris3(struct msm_vidc_inst *inst)
+{
+	u32 work_route;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+	work_route = core->capabilities[NUM_VPP_PIPE].value;
+
+	if (is_image_session(inst))
+		goto exit;
+
+	if (is_decode_session(inst)) {
+		if (inst->capabilities[CODED_FRAMES].value ==
+				CODED_FRAMES_INTERLACE)
+			work_route = MSM_VIDC_PIPE_1;
+	} else if (is_encode_session(inst)) {
+		u32 slice_mode;
+
+		slice_mode = inst->capabilities[SLICE_MODE].value;
+
+		/*TODO Pipe=1 for legacy CBR*/
+		if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES)
+			work_route = MSM_VIDC_PIPE_1;
+
+	} else {
+		i_vpr_e(inst, "%s: invalid session type\n", __func__);
+		return -EINVAL;
+	}
+
+exit:
+	i_vpr_h(inst, "Configuring work route = %u", work_route);
+	msm_vidc_update_cap_value(inst, PIPE, work_route, __func__);
+
+	return 0;
+}
+
+static int msm_vidc_decide_quality_mode_iris3(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 mbpf, mbps, max_hq_mbpf, max_hq_mbps;
+	u32 mode = MSM_VIDC_POWER_SAVE_MODE;
+
+	if (!is_encode_session(inst))
+		return 0;
+
+	/* image or lossless or all intra runs at quality mode */
+	if (is_image_session(inst) || inst->capabilities[LOSSLESS].value ||
+		inst->capabilities[ALL_INTRA].value) {
+		mode = MSM_VIDC_MAX_QUALITY_MODE;
+		goto decision_done;
+	}
+
+	/* for lesser complexity, make LP for all resolution */
+	if (inst->capabilities[COMPLEXITY].value < DEFAULT_COMPLEXITY) {
+		mode = MSM_VIDC_POWER_SAVE_MODE;
+		goto decision_done;
+	}
+
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	mbps = mbpf * msm_vidc_get_fps(inst);
+	core = inst->core;
+	max_hq_mbpf = core->capabilities[MAX_MBPF_HQ].value;;
+	max_hq_mbps = core->capabilities[MAX_MBPS_HQ].value;;
+
+	if (!is_realtime_session(inst)) {
+		if (((inst->capabilities[COMPLEXITY].flags & CAP_FLAG_CLIENT_SET) &&
+			(inst->capabilities[COMPLEXITY].value >= DEFAULT_COMPLEXITY)) ||
+			mbpf <= max_hq_mbpf) {
+			mode = MSM_VIDC_MAX_QUALITY_MODE;
+			goto decision_done;
+		}
+	}
+
+	if (mbpf <= max_hq_mbpf && mbps <= max_hq_mbps)
+		mode = MSM_VIDC_MAX_QUALITY_MODE;
+
+decision_done:
+	msm_vidc_update_cap_value(inst, QUALITY_MODE, mode, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_bitrate_boost_iris3(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1;
+	u32 width, height, frame_rate;
+	struct v4l2_format *f;
+	u32 max_bitrate = 0, bitrate = 0;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[BITRATE_BOOST].value;
+
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming)
+		return 0;
+
+	if (msm_vidc_get_parent_value(inst, BITRATE_BOOST,
+		BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	/*
+	 * Bitrate Boost are supported only for VBR rc type.
+	 * Hence, do not adjust or set to firmware for non VBR rc's
+	 */
+	if (rc_type != HFI_RC_VBR_CFR) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+	frame_rate = inst->capabilities[FRAME_RATE].value >> 16;
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	/*
+	 * honor client set bitrate boost
+	 * if client did not set, keep max bitrate boost upto 4k@60fps
+	 * and remove bitrate boost after 4k@60fps
+	 */
+	if (inst->capabilities[BITRATE_BOOST].flags & CAP_FLAG_CLIENT_SET) {
+		/* accept client set bitrate boost value as is */
+	} else {
+		if (res_is_less_than_or_equal_to(width, height, 4096, 2176) &&
+			frame_rate <= 60)
+			adjusted_value = MAX_BITRATE_BOOST;
+		else
+			adjusted_value = 0;
+	}
+
+	max_bitrate = msm_vidc_get_max_bitrate(inst);
+	bitrate = inst->capabilities[BIT_RATE].value;
+	if (adjusted_value) {
+		if ((bitrate + bitrate / (100 / adjusted_value)) > max_bitrate) {
+			i_vpr_h(inst,
+				"%s: bitrate %d is beyond max bitrate %d, remove bitrate boost\n",
+				__func__, max_bitrate, bitrate);
+			adjusted_value = 0;
+		}
+	}
+adjust:
+	msm_vidc_update_cap_value(inst, BITRATE_BOOST, adjusted_value, __func__);
+
+	return 0;
+}
+
+
+
+static struct msm_vidc_venus_ops iris3_ops = {
+	.boot_firmware = __boot_firmware_iris3,
+	.raise_interrupt = __raise_interrupt_iris3,
+	.clear_interrupt = __clear_interrupt_iris3,
+	.power_on = __power_on_iris3,
+	.power_off = __power_off_iris3,
+	.prepare_pc = __prepare_pc_iris3,
+	.watchdog = __watchdog_iris3,
+	.noc_error_info = __noc_error_info_iris3,
+	.switch_gdsc_mode = __switch_gdsc_mode_iris3,
+};
+
+static struct msm_vidc_session_ops msm_session_ops = {
+	.buffer_size = msm_buffer_size_iris3,
+	.min_count = msm_buffer_min_count_iris3,
+	.extra_count = msm_buffer_extra_count_iris3,
+	.calc_freq = msm_vidc_calc_freq_iris3,
+	.calc_bw = msm_vidc_calc_bw_iris3,
+	.decide_work_route = msm_vidc_decide_work_route_iris3,
+	.decide_work_mode = msm_vidc_decide_work_mode_iris3,
+	.decide_quality_mode = msm_vidc_decide_quality_mode_iris3,
+};
+
+int msm_vidc_init_iris3(struct msm_vidc_core *core)
+{
+	d_vpr_h("%s()\n", __func__);
+	core->venus_ops = &iris3_ops;
+	core->session_ops = &msm_session_ops;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris3/src/msm_vidc_power_iris3.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris3/src/msm_vidc_power_iris3.c
@@ -0,0 +1,1161 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "kalama_technology.h"
+
+#include "msm_vidc_driver.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_power.h"
+#include "msm_vidc_power_iris3.h"
+
+static u64 __calculate_decoder(struct vidc_bus_vote_data *d);
+static u64 __calculate_encoder(struct vidc_bus_vote_data *d);
+static u64 __calculate(struct msm_vidc_inst *inst, struct vidc_bus_vote_data *d);
+static u64 msm_vidc_calc_freq_iris3_legacy(struct msm_vidc_inst *inst, u32 data_size);
+
+static int msm_vidc_init_codec_input_freq(struct msm_vidc_inst *inst, u32 data_size,
+		struct api_calculation_input *codec_input)
+{
+	enum msm_vidc_port_type port;
+	u32 color_fmt;
+
+	if (is_encode_session(inst)) {
+		codec_input->decoder_or_encoder = CODEC_ENCODER;
+	} else if (is_decode_session(inst)) {
+		codec_input->decoder_or_encoder = CODEC_DECODER;
+	} else {
+		d_vpr_e("%s: invalid domain %d\n", __func__, inst->domain);
+		return -EINVAL;
+	}
+
+	codec_input->chipset_gen = MSM_KALAMA;
+
+	if (inst->codec == MSM_VIDC_H264) {
+		codec_input->codec    = CODEC_H264;
+		codec_input->lcu_size = 16;
+		if (inst->capabilities[ENTROPY_MODE].value ==
+				V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC)
+			codec_input->entropy_coding_mode = CODEC_ENTROPY_CODING_CABAC;
+		else
+			codec_input->entropy_coding_mode = CODEC_ENTROPY_CODING_CAVLC;
+	} else if (inst->codec == MSM_VIDC_HEVC) {
+		codec_input->codec    = CODEC_HEVC;
+		codec_input->lcu_size = 32;
+	} else if (inst->codec == MSM_VIDC_VP9) {
+		codec_input->codec    = CODEC_VP9;
+		codec_input->lcu_size = 16;
+	} else if (inst->codec == MSM_VIDC_AV1) {
+		codec_input->codec    = CODEC_AV1;
+		codec_input->lcu_size = 32;
+	} else {
+		d_vpr_e("%s: invalid codec %d\n", __func__, inst->codec);
+		return -EINVAL;
+	}
+
+	codec_input->pipe_num = inst->capabilities[PIPE].value;
+	codec_input->frame_rate = inst->max_rate;
+
+	port = is_decode_session(inst) ? INPUT_PORT : OUTPUT_PORT;
+	codec_input->frame_width = inst->fmts[port].fmt.pix_mp.width;
+	codec_input->frame_height = inst->fmts[port].fmt.pix_mp.height;
+
+	if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_1) {
+		codec_input->vsp_vpp_mode = CODEC_VSPVPP_MODE_1S;
+	} else if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_2) {
+		codec_input->vsp_vpp_mode = CODEC_VSPVPP_MODE_2S;
+	} else {
+		d_vpr_e("%s: invalid stage %d\n", __func__,
+				inst->capabilities[STAGE].value);
+		return -EINVAL;
+	}
+
+	if (inst->capabilities[BIT_DEPTH].value == BIT_DEPTH_8)
+		codec_input->bitdepth = CODEC_BITDEPTH_8;
+	else
+		codec_input->bitdepth = CODEC_BITDEPTH_10;
+
+	/*
+	 * Used for calculating Encoder GOP Complexity
+	 * hierachical_layer= 0..7 used as Array Index
+	 * inst->capabilities[B_FRAME].value=[ 0 1 2]
+	 * TODO how to map?
+	 */
+
+	/* set as IPP */
+	codec_input->hierachical_layer = 0;
+
+	if (is_decode_session(inst))
+		color_fmt = v4l2_colorformat_to_driver(inst,
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+	else
+		color_fmt = v4l2_colorformat_to_driver(inst,
+			inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+
+	codec_input->linear_opb = is_linear_colorformat(color_fmt);
+	codec_input->bitrate_mbps =
+		(codec_input->frame_rate * data_size * 8) / 1000000;
+
+	/* disable av1d commercial tile */
+	codec_input->av1d_commer_tile_enable = 0;
+	/* set as sanity mode */
+	codec_input->regression_mode = 1;
+
+	return 0;
+}
+
+static int msm_vidc_init_codec_input_bus(struct msm_vidc_inst *inst, struct vidc_bus_vote_data *d,
+		struct api_calculation_input *codec_input)
+{
+	u32 complexity_factor_int = 0, complexity_factor_frac = 0;
+	bool opb_compression_enabled = false;
+
+	if (!d)
+		return -EINVAL;
+
+	if (d->domain == MSM_VIDC_ENCODER) {
+		codec_input->decoder_or_encoder = CODEC_ENCODER;
+	} else if (d->domain == MSM_VIDC_DECODER) {
+		codec_input->decoder_or_encoder = CODEC_DECODER;
+	} else {
+		d_vpr_e("%s: invalid domain %d\n", __func__, d->domain);
+		return -EINVAL;
+	}
+
+	codec_input->chipset_gen = MSM_KALAMA;
+
+	if (d->codec == MSM_VIDC_H264) {
+		codec_input->codec = CODEC_H264;
+	} else if (d->codec == MSM_VIDC_HEVC) {
+		codec_input->codec = CODEC_HEVC;
+	} else if (d->codec == MSM_VIDC_VP9) {
+		codec_input->codec = CODEC_VP9;
+	} else if (d->codec == MSM_VIDC_AV1) {
+		codec_input->codec = CODEC_AV1;
+	} else {
+		d_vpr_e("%s: invalid codec %d\n", __func__, d->codec);
+		return -EINVAL;
+	}
+
+	codec_input->lcu_size = d->lcu_size;
+	codec_input->pipe_num = d->num_vpp_pipes;
+	codec_input->frame_rate = d->fps;
+	codec_input->frame_width = d->input_width;
+	codec_input->frame_height = d->input_height;
+
+	if (d->work_mode == MSM_VIDC_STAGE_1) {
+		codec_input->vsp_vpp_mode = CODEC_VSPVPP_MODE_1S;
+	} else if (d->work_mode == MSM_VIDC_STAGE_2) {
+		codec_input->vsp_vpp_mode = CODEC_VSPVPP_MODE_2S;
+	} else {
+		d_vpr_e("%s: invalid stage %d\n", __func__, d->work_mode);
+		return -EINVAL;
+	}
+
+	if (inst->capabilities[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+		codec_input->entropy_coding_mode = CODEC_ENTROPY_CODING_CABAC;
+	} else if (inst->capabilities[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) {
+		codec_input->entropy_coding_mode = CODEC_ENTROPY_CODING_CAVLC;
+	} else {
+		d_vpr_e("%s: invalid entropy %d\n", __func__,
+				inst->capabilities[ENTROPY_MODE].value);
+		return -EINVAL;
+	}
+
+	/*
+	 * Used for calculating Encoder GOP Complexity
+	 * hierachical_layer= 0..7 used as Array Index
+	 * TODO how to map?
+	 */
+	codec_input->hierachical_layer = 0; /* set as IPP */
+
+	/*
+	 * If the calculated motion_vector_complexity is > 2 then set the
+	 * complexity_setting and refframe_complexity to be pwc(performance worst case)
+	 * values. If the motion_vector_complexity is < 2 then set the complexity_setting
+	 * and refframe_complexity to be average case values.
+	 */
+
+	complexity_factor_int = Q16_INT(d->complexity_factor);
+	complexity_factor_frac = Q16_FRAC(d->complexity_factor);
+
+	if (complexity_factor_int < COMPLEXITY_THRESHOLD ||
+		(complexity_factor_int == COMPLEXITY_THRESHOLD &&
+		complexity_factor_frac == 0)) {
+		/* set as average case values */
+		codec_input->complexity_setting = COMPLEXITY_SETTING_AVG;
+		codec_input->refframe_complexity = REFFRAME_COMPLEXITY_AVG;
+	} else {
+		/* set as pwc */
+		codec_input->complexity_setting = COMPLEXITY_SETTING_PWC;
+		codec_input->refframe_complexity = REFFRAME_COMPLEXITY_PWC;
+	}
+
+	codec_input->status_llc_onoff = d->use_sys_cache;
+
+	if (__bpp(d->color_formats[0]) == 8)
+		codec_input->bitdepth = CODEC_BITDEPTH_8;
+	else
+		codec_input->bitdepth = CODEC_BITDEPTH_10;
+
+	if (d->num_formats == 1) {
+		codec_input->split_opb = 0;
+		codec_input->linear_opb = !__ubwc(d->color_formats[0]);
+	} else if (d->num_formats == 2) {
+		codec_input->split_opb = 1;
+		codec_input->linear_opb = !__ubwc(d->color_formats[1]);
+	} else {
+		d_vpr_e("%s: invalid num_formats %d\n",
+			__func__, d->num_formats);
+		return -EINVAL;
+	}
+
+	codec_input->linear_ipb = 0;   /* set as ubwc ipb */
+
+	/* TODO Confirm if we always LOSSLESS mode ie lossy_ipb = 0*/
+	codec_input->lossy_ipb = 0;   /* set as lossless ipb */
+
+	/* TODO Confirm if no multiref */
+	codec_input->encoder_multiref = 0;	/* set as no multiref */
+	codec_input->bitrate_mbps = (d->bitrate / 1000000); /* bps 10;	set as 10mbps */
+
+	opb_compression_enabled = d->num_formats >= 2 && __ubwc(d->color_formats[1]);
+
+	/* ANDROID CR is in Q16 format, StaticModel CR in x100 format */
+	codec_input->cr_dpb = ((Q16_INT(d->compression_ratio)*100) +
+		Q16_FRAC(d->compression_ratio));
+
+	codec_input->cr_opb = opb_compression_enabled ?
+		codec_input->cr_dpb : FP_ONE;
+
+	codec_input->cr_ipb = ((Q16_INT(d->input_cr)*100) + Q16_FRAC(d->input_cr));
+	codec_input->cr_rpb = codec_input->cr_dpb;  /* cr_rpb ony for encoder */
+
+	/* disable by default, only enable for aurora depth map session */
+	codec_input->lumaonly_decode = 0;
+	/* TODO: disable av1d commercial tile */
+	codec_input->av1d_commer_tile_enable = 0;
+	/* set as custom regression mode, as are using cr,cf values from FW */
+	codec_input->regression_mode = REGRESSION_MODE_CUSTOM;
+
+
+	/* Dump all the variables for easier debugging */
+	if (msm_vidc_debug & VIDC_BUS) {
+		struct dump dump[] = {
+		{"complexity_factor_int", "%d", complexity_factor_int},
+		{"complexity_factor_frac", "%d", complexity_factor_frac},
+		{"refframe_complexity", "%d", codec_input->refframe_complexity},
+		{"complexity_setting", "%d", codec_input->complexity_setting},
+		{"cr_dpb", "%d", codec_input->cr_dpb},
+		{"cr_opb", "%d", codec_input->cr_opb},
+		{"cr_ipb", "%d", codec_input->cr_ipb},
+		{"cr_rpb", "%d", codec_input->cr_rpb},
+		{"lcu size", "%d", codec_input->lcu_size},
+		{"pipe number", "%d", codec_input->pipe_num},
+		{"frame_rate", "%d", codec_input->frame_rate},
+		{"frame_width", "%d", codec_input->frame_width},
+		{"frame_height", "%d", codec_input->frame_height},
+		{"work_mode", "%d", d->work_mode},
+		{"encoder_or_decode", "%d", inst->domain},
+		{"chipset_gen", "%d", codec_input->chipset_gen},
+		{"codec_input", "%d", codec_input->codec},
+		{"entropy_coding_mode", "%d", codec_input->entropy_coding_mode},
+		{"hierachical_layer", "%d", codec_input->hierachical_layer},
+		{"status_llc_onoff", "%d", codec_input->status_llc_onoff},
+		{"bit_depth", "%d", codec_input->bitdepth},
+		{"split_opb", "%d", codec_input->split_opb},
+		{"linear_opb", "%d", codec_input->linear_opb},
+		{"linear_ipb", "%d", codec_input->linear_ipb},
+		{"lossy_ipb", "%d", codec_input->lossy_ipb},
+		{"encoder_multiref", "%d", codec_input->encoder_multiref},
+		{"bitrate_mbps", "%d", codec_input->bitrate_mbps},
+		{"lumaonly_decode", "%d", codec_input->lumaonly_decode},
+		{"av1d_commer_tile_enable", "%d", codec_input->av1d_commer_tile_enable},
+		{"regression_mode", "%d", codec_input->regression_mode},
+		};
+		__dump(dump, ARRAY_SIZE(dump));
+	}
+
+	return 0;
+}
+
+static u64 msm_vidc_calc_freq_iris3_new(struct msm_vidc_inst *inst, u32 data_size)
+{
+	u64 freq = 0;
+	struct msm_vidc_core *core;
+	int ret = 0;
+	struct api_calculation_input codec_input;
+	struct api_calculation_freq_output codec_output;
+	u32 fps, mbpf;
+
+	core = inst->core;
+
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	fps = inst->max_rate;
+
+	memset(&codec_input, 0, sizeof(struct api_calculation_input));
+	memset(&codec_output, 0, sizeof(struct api_calculation_freq_output));
+	ret = msm_vidc_init_codec_input_freq(inst, data_size, &codec_input);
+	if (ret)
+		return freq;
+	ret = msm_vidc_calculate_frequency(codec_input, &codec_output);
+	if (ret)
+		return freq;
+	freq = codec_output.hw_min_freq * 1000000; /* Convert to Hz */
+
+	i_vpr_p(inst, "%s: filled len %d, required freq %llu, fps %u, mbpf %u\n",
+		__func__, data_size, freq, fps, mbpf);
+
+	if (inst->codec == MSM_VIDC_AV1 ||
+		(inst->iframe && is_hevc_10bit_decode_session(inst))) {
+		/*
+		 * for AV1 or HEVC 10bit and iframe case only allow TURBO and
+		 * limit to NOM for all other cases
+		 */
+	} else {
+		/* limit to NOM, index 0 is TURBO, index 1 is NOM clock rate */
+		if (core->resource->freq_set.count >= 2 &&
+			freq > core->resource->freq_set.freq_tbl[1].freq)
+			freq = core->resource->freq_set.freq_tbl[1].freq;
+	}
+
+	return freq;
+}
+
+static int msm_vidc_calc_bw_iris3_new(struct msm_vidc_inst *inst,
+		struct vidc_bus_vote_data *vidc_data)
+{
+	u32 ret = 0;
+	struct api_calculation_input codec_input;
+	struct api_calculation_bw_output codec_output;
+
+	memset(&codec_input, 0, sizeof(struct api_calculation_input));
+	memset(&codec_output, 0, sizeof(struct api_calculation_bw_output));
+
+	ret = msm_vidc_init_codec_input_bus(inst, vidc_data, &codec_input);
+	if (ret)
+		return ret;
+	ret = msm_vidc_calculate_bandwidth(codec_input, &codec_output);
+	if (ret)
+		return ret;
+
+	vidc_data->calc_bw_ddr = kbps(codec_output.ddr_bw_rd + codec_output.ddr_bw_wr);
+	vidc_data->calc_bw_llcc = kbps(codec_output.noc_bw_rd + codec_output.noc_bw_wr);
+
+	i_vpr_l(inst, "%s: calc_bw_ddr %llu calc_bw_llcc %llu",
+		__func__, vidc_data->calc_bw_ddr, vidc_data->calc_bw_llcc);
+
+	return ret;
+}
+
+u64 msm_vidc_calc_freq_iris3(struct msm_vidc_inst *inst, u32 data_size)
+{
+	u64 freq = 0;
+
+	if (ENABLE_LEGACY_POWER_CALCULATIONS)
+		freq = msm_vidc_calc_freq_iris3_legacy(inst, data_size);
+	else
+		freq = msm_vidc_calc_freq_iris3_new(inst, data_size);
+
+	return freq;
+}
+
+static u64 msm_vidc_calc_freq_iris3_legacy(struct msm_vidc_inst *inst, u32 data_size)
+{
+	u64 freq = 0;
+	struct msm_vidc_core *core;
+	u64 vsp_cycles = 0, vpp_cycles = 0, fw_cycles = 0;
+	u64 fw_vpp_cycles = 0, bitrate = 0;
+	u32 vpp_cycles_per_mb;
+	u32 mbs_per_second;
+	u32 operating_rate, vsp_factor_num = 1, vsp_factor_den = 1;
+	u32 base_cycles = 0;
+	u32 fps, mbpf;
+
+	core = inst->core;
+
+	if (!core->resource || !core->resource->freq_set.freq_tbl ||
+		!core->resource->freq_set.count) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return freq;
+	}
+
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	fps = inst->max_rate;
+	mbs_per_second = mbpf * fps;
+
+	/*
+	 * Calculate vpp, vsp, fw cycles separately for encoder and decoder.
+	 * Even though, most part is common now, in future it may change
+	 * between them.
+	 */
+	fw_cycles = fps * inst->capabilities[MB_CYCLES_FW].value;
+	fw_vpp_cycles = fps * inst->capabilities[MB_CYCLES_FW_VPP].value;
+
+	if (is_encode_session(inst)) {
+		vpp_cycles_per_mb = is_low_power_session(inst) ?
+			inst->capabilities[MB_CYCLES_LP].value :
+			inst->capabilities[MB_CYCLES_VPP].value;
+
+		vpp_cycles = mbs_per_second * vpp_cycles_per_mb /
+			inst->capabilities[PIPE].value;
+
+		/* Factor 1.25 for IbP and 1.375 for I1B2b1P GOP structure */
+		if (inst->capabilities[B_FRAME].value > 1)
+			vpp_cycles += (vpp_cycles / 4) + (vpp_cycles / 8);
+		else if (inst->capabilities[B_FRAME].value)
+			vpp_cycles += vpp_cycles / 4;
+		/* 21 / 20 is minimum overhead factor */
+		vpp_cycles += max(div_u64(vpp_cycles, 20), fw_vpp_cycles);
+		/* 1.01 is multi-pipe overhead */
+		if (inst->capabilities[PIPE].value > 1)
+			vpp_cycles += div_u64(vpp_cycles, 100);
+		/*
+		 * 1080p@480fps usecase needs exactly 338MHz
+		 * without any margin left. Hence, adding 2 percent
+		 * extra to bump it to next level (366MHz).
+		 */
+		if (fps == 480)
+			vpp_cycles += div_u64(vpp_cycles * 2, 100);
+
+		/*
+		 * Add 5 percent extra for 720p@960fps use case
+		 * to bump it to next level (366MHz).
+		 */
+		if (fps == 960)
+			vpp_cycles += div_u64(vpp_cycles * 5, 100);
+
+		/* increase vpp_cycles by 50% for preprocessing */
+		if (inst->capabilities[REQUEST_PREPROCESS].value)
+			vpp_cycles = vpp_cycles + vpp_cycles / 2;
+
+		/* VSP */
+		/* bitrate is based on fps, scale it using operating rate */
+		operating_rate = inst->capabilities[OPERATING_RATE].value >> 16;
+		if (operating_rate >
+			(inst->capabilities[FRAME_RATE].value >> 16) &&
+			(inst->capabilities[FRAME_RATE].value >> 16)) {
+			vsp_factor_num = operating_rate;
+			vsp_factor_den = inst->capabilities[FRAME_RATE].value >> 16;
+		}
+		vsp_cycles = div_u64(((u64)inst->capabilities[BIT_RATE].value *
+					vsp_factor_num), vsp_factor_den);
+
+		base_cycles = inst->capabilities[MB_CYCLES_VSP].value;
+		if (inst->codec == MSM_VIDC_VP9) {
+			vsp_cycles = div_u64(vsp_cycles * 170, 100);
+		} else if (inst->capabilities[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			vsp_cycles = div_u64(vsp_cycles * 135, 100);
+		} else {
+			base_cycles = 0;
+			vsp_cycles = div_u64(vsp_cycles, 2);
+		}
+		/* VSP FW Overhead 1.05 */
+		vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+		if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_1)
+			vsp_cycles = vsp_cycles * 3;
+
+		vsp_cycles += mbs_per_second * base_cycles;
+
+	} else if (is_decode_session(inst)) {
+		/* VPP */
+		vpp_cycles = mbs_per_second * inst->capabilities[MB_CYCLES_VPP].value /
+			inst->capabilities[PIPE].value;
+		/* 21 / 20 is minimum overhead factor */
+		vpp_cycles += max(vpp_cycles / 20, fw_vpp_cycles);
+		if (inst->capabilities[PIPE].value > 1) {
+			if (inst->codec == MSM_VIDC_AV1) {
+				/*
+				 * Additional vpp_cycles are required for bitstreams with
+				 * 128x128 superblock and non-recommended tile settings.
+				 * recommended tiles: 1080P_V2XH1, UHD_V2X2, 8KUHD_V8X2
+				 * non-recommended tiles: 1080P_V4XH2_V4X1, UHD_V8X4_V8X1,
+				 * 8KUHD_V8X8_V8X1
+				 */
+				if (inst->capabilities[SUPER_BLOCK].value)
+					vpp_cycles += div_u64(vpp_cycles * 1464, 1000);
+				else
+					vpp_cycles += div_u64(vpp_cycles * 410, 1000);
+			} else {
+				/* 1.059 is multi-pipe overhead */
+				vpp_cycles += div_u64(vpp_cycles * 59, 1000);
+			}
+		}
+
+		/* VSP */
+		if (inst->codec == MSM_VIDC_AV1) {
+			/*
+			 * For AV1: Use VSP calculations from Kalama perf model.
+			 * For legacy codecs, use vsp_cycles based on legacy MB_CYCLES_VSP.
+			 */
+			u32 decoder_vsp_fw_overhead = 105;
+			u32 fw_sw_vsp_offset = 1055;
+			u64 vsp_hw_min_frequency = 0;
+			u32 input_bitrate_mbps = 0;
+			u32 bitrate_2stage[2] = {130, 120};
+			u32 bitrate_1stage = 100;
+			u32 width, height;
+			u32 bitrate_entry, freq_entry, freq_tbl_value;
+			struct frequency_table *freq_tbl;
+			struct v4l2_format *out_f = &inst->fmts[OUTPUT_PORT];
+
+			width = out_f->fmt.pix_mp.width;
+			height = out_f->fmt.pix_mp.height;
+
+			bitrate_entry = 1;
+			/* 8KUHD60, UHD240, 1080p960 */
+			if (width * height * fps >= 3840 * 2160 * 240)
+				bitrate_entry = 0;
+
+			freq_entry = bitrate_entry;
+
+			freq_tbl = core->resource->freq_set.freq_tbl;
+			freq_tbl_value = freq_tbl[freq_entry].freq / 1000000;
+
+			input_bitrate_mbps = fps * data_size * 8 / (1024 * 1024);
+			vsp_hw_min_frequency = freq_tbl_value * 1000 * input_bitrate_mbps;
+
+			if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_2) {
+				vsp_hw_min_frequency +=
+					(bitrate_2stage[bitrate_entry] * fw_sw_vsp_offset - 1);
+				vsp_hw_min_frequency = div_u64(vsp_hw_min_frequency,
+					(bitrate_2stage[bitrate_entry] * fw_sw_vsp_offset));
+				/* VSP fw overhead 1.05 */
+				vsp_hw_min_frequency = div_u64(vsp_hw_min_frequency *
+					decoder_vsp_fw_overhead + 99, 100);
+			} else {
+				vsp_hw_min_frequency += (bitrate_1stage * fw_sw_vsp_offset - 1);
+				vsp_hw_min_frequency = div_u64(vsp_hw_min_frequency,
+					(bitrate_1stage * fw_sw_vsp_offset));
+			}
+
+			vsp_cycles = vsp_hw_min_frequency * 1000000;
+		} else {
+			base_cycles = inst->has_bframe ?
+					80 : inst->capabilities[MB_CYCLES_VSP].value;
+			bitrate = fps * data_size * 8;
+			vsp_cycles = bitrate;
+
+			if (inst->codec == MSM_VIDC_VP9) {
+				vsp_cycles = div_u64(vsp_cycles * 170, 100);
+			} else if (inst->capabilities[ENTROPY_MODE].value ==
+				V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+				vsp_cycles = div_u64(vsp_cycles * 135, 100);
+			} else {
+				base_cycles = 0;
+				vsp_cycles = div_u64(vsp_cycles, 2);
+			}
+			/* VSP FW overhead 1.05 */
+			vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+			if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_1)
+				vsp_cycles = vsp_cycles * 3;
+
+			vsp_cycles += mbs_per_second * base_cycles;
+
+			/* Add 25 percent extra for 960fps use case */
+			if (fps >= 960)
+				vsp_cycles += div_u64(vpp_cycles * 25, 100);
+
+			/* Add 25 percent extra for HEVC 10bit all intra use case */
+			if (inst->iframe && is_hevc_10bit_decode_session(inst))
+				vsp_cycles += div_u64(vsp_cycles * 25, 100);
+
+			if (inst->codec == MSM_VIDC_VP9 &&
+					inst->capabilities[STAGE].value ==
+						MSM_VIDC_STAGE_2 &&
+					inst->capabilities[PIPE].value == 4 &&
+					bitrate > 90000000)
+				vsp_cycles = msm_vidc_max_freq(inst);
+		}
+	} else {
+		i_vpr_e(inst, "%s: Unknown session type\n", __func__);
+		return msm_vidc_max_freq(inst);
+	}
+
+	freq = max(vpp_cycles, vsp_cycles);
+	freq = max(freq, fw_cycles);
+
+	if (inst->codec == MSM_VIDC_AV1 ||
+		(inst->iframe && is_hevc_10bit_decode_session(inst))) {
+		/*
+		 * for AV1 or HEVC 10bit and iframe case only allow TURBO and
+		 * limit to NOM for all other cases
+		 */
+	} else {
+		/* limit to NOM, index 0 is TURBO, index 1 is NOM clock rate */
+		if (core->resource->freq_set.count >= 2 &&
+		    freq > core->resource->freq_set.freq_tbl[1].freq)
+			freq = core->resource->freq_set.freq_tbl[1].freq;
+	}
+
+	i_vpr_p(inst, "%s: filled len %d, required freq %llu, fps %u, mbpf %u\n",
+		__func__, data_size, freq, fps, mbpf);
+
+	return freq;
+}
+
+static u64 __calculate_decoder(struct vidc_bus_vote_data *d)
+{
+	/*
+	 * XXX: Don't fool around with any of the hardcoded numbers unless you
+	 * know /exactly/ what you're doing.  Many of these numbers are
+	 * measured heuristics and hardcoded numbers taken from the firmware.
+	 */
+	/* Decoder parameters */
+	int width, height, lcu_size, fps, dpb_bpp;
+	bool unified_dpb_opb, dpb_compression_enabled = true,
+		opb_compression_enabled = false,
+		llc_ref_read_l2_cache_enabled = false,
+		llc_top_line_buf_enabled = false;
+	fp_t dpb_read_compression_factor, dpb_opb_scaling_ratio,
+		dpb_write_compression_factor, opb_write_compression_factor,
+		qsmmu_bw_overhead_factor;
+	bool is_h264_category = (d->codec == MSM_VIDC_H264) ? true : false;
+
+	/* Derived parameters */
+	int lcu_per_frame, collocated_bytes_per_lcu, tnbr_per_lcu;
+	unsigned long bitrate;
+
+	fp_t bins_to_bit_factor, vsp_read_factor, vsp_write_factor,
+		dpb_factor, dpb_write_factor, y_bw_no_ubwc_8bpp;
+	fp_t y_bw_no_ubwc_10bpp = 0, y_bw_10bpp_p010 = 0,
+	     motion_vector_complexity = 0;
+	fp_t	dpb_total = 0;
+
+	/* Output parameters */
+	struct {
+		fp_t vsp_read, vsp_write, collocated_read, collocated_write,
+			dpb_read, dpb_write, opb_read, opb_write,
+			line_buffer_read, line_buffer_write,
+			total;
+	} ddr = {0};
+
+	struct {
+		fp_t dpb_read, line_buffer_read, line_buffer_write, total;
+	} llc = {0};
+
+	unsigned long ret = 0;
+	unsigned int integer_part, frac_part;
+
+	width = max(d->input_width, BASELINE_DIMENSIONS.width);
+	height = max(d->input_height, BASELINE_DIMENSIONS.height);
+
+	fps = d->fps;
+
+	lcu_size = d->lcu_size;
+
+	dpb_bpp = __bpp(d->color_formats[0]);
+
+	unified_dpb_opb = d->num_formats == 1;
+
+	dpb_opb_scaling_ratio = fp_div(FP_INT(d->input_width * d->input_height),
+		FP_INT(d->output_width * d->output_height));
+
+	opb_compression_enabled = d->num_formats >= 2 &&
+		__ubwc(d->color_formats[1]);
+
+	integer_part = Q16_INT(d->compression_ratio);
+	frac_part = Q16_FRAC(d->compression_ratio);
+	dpb_read_compression_factor = FP(integer_part, frac_part, 100);
+
+	integer_part = Q16_INT(d->complexity_factor);
+	frac_part = Q16_FRAC(d->complexity_factor);
+	motion_vector_complexity = FP(integer_part, frac_part, 100);
+
+	dpb_write_compression_factor = dpb_read_compression_factor;
+	opb_write_compression_factor = opb_compression_enabled ?
+		dpb_write_compression_factor : FP_ONE;
+
+	if (d->use_sys_cache) {
+		llc_ref_read_l2_cache_enabled = true;
+		if (is_h264_category)
+			llc_top_line_buf_enabled = true;
+	}
+
+	/* Derived parameters setup */
+	lcu_per_frame = DIV_ROUND_UP(width, lcu_size) *
+		DIV_ROUND_UP(height, lcu_size);
+
+	bitrate = DIV_ROUND_UP(d->bitrate, 1000000);
+
+	bins_to_bit_factor = FP_INT(4);
+
+	vsp_write_factor = bins_to_bit_factor;
+	vsp_read_factor = bins_to_bit_factor + FP_INT(2);
+
+	collocated_bytes_per_lcu = lcu_size == 16 ? 16 :
+				lcu_size == 32 ? 64 : 256;
+
+	if (d->codec == MSM_VIDC_AV1) {
+		collocated_bytes_per_lcu = 4 * 512; /* lcu_size = 128 */
+		if (lcu_size == 32)
+			collocated_bytes_per_lcu = 4 * 512 / (128 * 128 / 32 / 32);
+		else if (lcu_size == 64)
+			collocated_bytes_per_lcu = 4 * 512 / (128 * 128 / 64 / 64);
+	}
+
+	dpb_factor = FP(1, 50, 100);
+	dpb_write_factor = FP(1, 5, 100);
+
+	tnbr_per_lcu = lcu_size == 16 ? 128 :
+		lcu_size == 32 ? 64 : 128;
+
+	/* .... For DDR & LLC  ...... */
+	ddr.vsp_read = fp_div(fp_mult(FP_INT(bitrate),
+				vsp_read_factor), FP_INT(8));
+	ddr.vsp_write = fp_div(fp_mult(FP_INT(bitrate),
+				vsp_write_factor), FP_INT(8));
+
+	ddr.collocated_read = fp_div(FP_INT(lcu_per_frame *
+			collocated_bytes_per_lcu * fps), FP_INT(bps(1)));
+	ddr.collocated_write = ddr.collocated_read;
+
+	y_bw_no_ubwc_8bpp = fp_div(FP_INT(width * height * fps),
+		FP_INT(1000 * 1000));
+
+	if (dpb_bpp != 8) {
+		y_bw_no_ubwc_10bpp =
+			fp_div(fp_mult(y_bw_no_ubwc_8bpp, FP_INT(256)),
+				FP_INT(192));
+		y_bw_10bpp_p010 = y_bw_no_ubwc_8bpp * 2;
+	}
+
+	ddr.dpb_read = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	ddr.dpb_read = fp_div(fp_mult(ddr.dpb_read,
+			fp_mult(dpb_factor, motion_vector_complexity)),
+			dpb_read_compression_factor);
+
+	ddr.dpb_write = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	ddr.dpb_write = fp_div(fp_mult(ddr.dpb_write,
+			fp_mult(dpb_factor, dpb_write_factor)),
+			dpb_write_compression_factor);
+
+	dpb_total = ddr.dpb_read + ddr.dpb_write;
+
+	if (llc_ref_read_l2_cache_enabled) {
+		ddr.dpb_read = fp_div(ddr.dpb_read, is_h264_category ?
+					FP(1, 30, 100) : FP(1, 14, 100));
+		llc.dpb_read = dpb_total - ddr.dpb_write - ddr.dpb_read;
+	}
+
+	ddr.opb_read = FP_ZERO;
+	ddr.opb_write = unified_dpb_opb ? FP_ZERO : (dpb_bpp == 8 ?
+		y_bw_no_ubwc_8bpp : (opb_compression_enabled ?
+		y_bw_no_ubwc_10bpp : y_bw_10bpp_p010));
+	ddr.opb_write = fp_div(fp_mult(dpb_factor, ddr.opb_write),
+		fp_mult(dpb_opb_scaling_ratio, opb_write_compression_factor));
+
+	ddr.line_buffer_read =
+		fp_div(FP_INT(tnbr_per_lcu * lcu_per_frame * fps),
+			FP_INT(bps(1)));
+
+	if (is_h264_category)
+		ddr.line_buffer_write = fp_div(ddr.line_buffer_read, FP_INT(2));
+	else
+		ddr.line_buffer_write = ddr.line_buffer_read;
+	if (llc_top_line_buf_enabled) {
+		llc.line_buffer_read = ddr.line_buffer_read;
+		llc.line_buffer_write = ddr.line_buffer_write;
+		ddr.line_buffer_write = ddr.line_buffer_read = FP_ZERO;
+	}
+
+	ddr.total = ddr.vsp_read + ddr.vsp_write +
+		ddr.collocated_read + ddr.collocated_write +
+		ddr.dpb_read + ddr.dpb_write +
+		ddr.opb_read + ddr.opb_write +
+		ddr.line_buffer_read + ddr.line_buffer_write;
+
+	qsmmu_bw_overhead_factor = FP(1, 3, 100);
+
+	ddr.total = fp_mult(ddr.total, qsmmu_bw_overhead_factor);
+	llc.total = llc.dpb_read + llc.line_buffer_read +
+			llc.line_buffer_write + ddr.total;
+
+	/* Add 25 percent extra for 960fps use case */
+	if (fps >= 960) {
+		ddr.total += div_u64(ddr.total * 25, 100);
+		llc.total += div_u64(llc.total * 25, 100);
+	}
+
+	/* Dump all the variables for easier debugging */
+	if (msm_vidc_debug & VIDC_BUS) {
+		struct dump dump[] = {
+		{"DECODER PARAMETERS", "", DUMP_HEADER_MAGIC},
+		{"lcu size", "%d", lcu_size},
+		{"dpb bitdepth", "%d", dpb_bpp},
+		{"frame rate", "%d", fps},
+		{"dpb/opb unified", "%d", unified_dpb_opb},
+		{"dpb/opb downscaling ratio", DUMP_FP_FMT,
+			dpb_opb_scaling_ratio},
+		{"dpb compression", "%d", dpb_compression_enabled},
+		{"opb compression", "%d", opb_compression_enabled},
+		{"dpb read compression factor", DUMP_FP_FMT,
+			dpb_read_compression_factor},
+		{"dpb write compression factor", DUMP_FP_FMT,
+			dpb_write_compression_factor},
+		{"frame width", "%d", width},
+		{"frame height", "%d", height},
+		{"llc ref read l2 cache enabled", "%d",
+			llc_ref_read_l2_cache_enabled},
+		{"llc top line buf enabled", "%d",
+			llc_top_line_buf_enabled},
+
+		{"DERIVED PARAMETERS (1)", "", DUMP_HEADER_MAGIC},
+		{"lcus/frame", "%d", lcu_per_frame},
+		{"bitrate (Mbit/sec)", "%d", bitrate},
+		{"bins to bit factor", DUMP_FP_FMT, bins_to_bit_factor},
+		{"dpb write factor", DUMP_FP_FMT, dpb_write_factor},
+		{"vsp read factor", DUMP_FP_FMT, vsp_read_factor},
+		{"vsp write factor", DUMP_FP_FMT, vsp_write_factor},
+		{"tnbr/lcu", "%d", tnbr_per_lcu},
+		{"collocated bytes/LCU", "%d", collocated_bytes_per_lcu},
+		{"bw for NV12 8bpc)", DUMP_FP_FMT, y_bw_no_ubwc_8bpp},
+		{"bw for NV12 10bpc)", DUMP_FP_FMT, y_bw_no_ubwc_10bpp},
+
+		{"DERIVED PARAMETERS (2)", "", DUMP_HEADER_MAGIC},
+		{"mv complexity", DUMP_FP_FMT, motion_vector_complexity},
+		{"qsmmu_bw_overhead_factor", DUMP_FP_FMT,
+			qsmmu_bw_overhead_factor},
+
+		{"INTERMEDIATE DDR B/W", "", DUMP_HEADER_MAGIC},
+		{"vsp read", DUMP_FP_FMT, ddr.vsp_read},
+		{"vsp write", DUMP_FP_FMT, ddr.vsp_write},
+		{"collocated read", DUMP_FP_FMT, ddr.collocated_read},
+		{"collocated write", DUMP_FP_FMT, ddr.collocated_write},
+		{"line buffer read", DUMP_FP_FMT, ddr.line_buffer_read},
+		{"line buffer write", DUMP_FP_FMT, ddr.line_buffer_write},
+		{"opb read", DUMP_FP_FMT, ddr.opb_read},
+		{"opb write", DUMP_FP_FMT, ddr.opb_write},
+		{"dpb read", DUMP_FP_FMT, ddr.dpb_read},
+		{"dpb write", DUMP_FP_FMT, ddr.dpb_write},
+		{"dpb total", DUMP_FP_FMT, dpb_total},
+		{"INTERMEDIATE LLC B/W", "", DUMP_HEADER_MAGIC},
+		{"llc dpb read", DUMP_FP_FMT, llc.dpb_read},
+		{"llc line buffer read", DUMP_FP_FMT, llc.line_buffer_read},
+		{"llc line buffer write", DUMP_FP_FMT, llc.line_buffer_write},
+
+		};
+		__dump(dump, ARRAY_SIZE(dump));
+	}
+
+	d->calc_bw_ddr = kbps(fp_round(ddr.total));
+	d->calc_bw_llcc = kbps(fp_round(llc.total));
+
+	return ret;
+}
+
+static u64 __calculate_encoder(struct vidc_bus_vote_data *d)
+{
+	/*
+	 * XXX: Don't fool around with any of the hardcoded numbers unless you
+	 * know /exactly/ what you're doing.  Many of these numbers are
+	 * measured heuristics and hardcoded numbers taken from the firmware.
+	 */
+	/* Encoder Parameters */
+	int width, height, fps, lcu_size, bitrate, lcu_per_frame,
+		collocated_bytes_per_lcu, tnbr_per_lcu, dpb_bpp,
+		original_color_format, vertical_tile_width, rotation;
+	bool work_mode_1, original_compression_enabled,
+		low_power, cropping_or_scaling,
+		b_frames_enabled = false,
+		llc_ref_chroma_cache_enabled = false,
+		llc_top_line_buf_enabled = false,
+		llc_vpss_rot_line_buf_enabled = false,
+		vpss_preprocessing_enabled = false;
+
+	unsigned int bins_to_bit_factor;
+	fp_t dpb_compression_factor,
+		original_compression_factor,
+		original_compression_factor_y,
+		y_bw_no_ubwc_8bpp, y_bw_no_ubwc_10bpp = 0, y_bw_10bpp_p010 = 0,
+		input_compression_factor,
+		downscaling_ratio,
+		ref_y_read_bw_factor, ref_cbcr_read_bw_factor,
+		recon_write_bw_factor,
+		total_ref_read_crcb,
+		qsmmu_bw_overhead_factor;
+	fp_t integer_part, frac_part;
+	unsigned long ret = 0;
+
+	/* Output parameters */
+	struct {
+		fp_t vsp_read, vsp_write, collocated_read, collocated_write,
+			ref_read_y, ref_read_crcb, ref_write,
+			ref_write_overlap, orig_read,
+			line_buffer_read, line_buffer_write,
+			total;
+	} ddr = {0};
+
+	struct {
+		fp_t ref_read_crcb, line_buffer, total;
+	} llc = {0};
+
+	/* Encoder Parameters setup */
+	rotation = d->rotation;
+	cropping_or_scaling = false;
+	vertical_tile_width = 960;
+	/*
+	 * recon_write_bw_factor varies according to resolution and bit-depth,
+	 * here use 1.08(1.075) for worst case.
+	 * Similar for ref_y_read_bw_factor, it can reach 1.375 for worst case,
+	 * here use 1.3 for average case, and can somewhat balance the
+	 * worst case assumption for UBWC CR factors.
+	 */
+	recon_write_bw_factor = FP(1, 8, 100);
+	ref_y_read_bw_factor = FP(1, 30, 100);
+	ref_cbcr_read_bw_factor = FP(1, 50, 100);
+
+
+	/* Derived Parameters */
+	fps = d->fps;
+	width = max(d->output_width, BASELINE_DIMENSIONS.width);
+	height = max(d->output_height, BASELINE_DIMENSIONS.height);
+	downscaling_ratio = fp_div(FP_INT(d->input_width * d->input_height),
+		FP_INT(d->output_width * d->output_height));
+	downscaling_ratio = max(downscaling_ratio, FP_ONE);
+	bitrate = d->bitrate > 0 ? DIV_ROUND_UP(d->bitrate, 1000000) :
+		__lut(width, height, fps)->bitrate;
+	lcu_size = d->lcu_size;
+	lcu_per_frame = DIV_ROUND_UP(width, lcu_size) *
+		DIV_ROUND_UP(height, lcu_size);
+	tnbr_per_lcu = 16;
+
+	dpb_bpp = __bpp(d->color_formats[0]);
+
+	y_bw_no_ubwc_8bpp = fp_div(FP_INT(width * height * fps),
+		FP_INT(1000 * 1000));
+
+	if (dpb_bpp != 8) {
+		y_bw_no_ubwc_10bpp = fp_div(fp_mult(y_bw_no_ubwc_8bpp,
+			FP_INT(256)), FP_INT(192));
+		y_bw_10bpp_p010 = y_bw_no_ubwc_8bpp * 2;
+	}
+
+	b_frames_enabled = d->b_frames_enabled;
+	original_color_format = d->num_formats >= 1 ?
+		d->color_formats[0] : MSM_VIDC_FMT_NV12C;
+
+	original_compression_enabled = __ubwc(original_color_format);
+
+	work_mode_1 = d->work_mode == MSM_VIDC_STAGE_1;
+	low_power = d->power_mode == VIDC_POWER_LOW;
+	bins_to_bit_factor = 4;
+	vpss_preprocessing_enabled = d->vpss_preprocessing_enabled;
+
+	if (d->use_sys_cache) {
+		llc_ref_chroma_cache_enabled = true;
+		llc_top_line_buf_enabled = true,
+		llc_vpss_rot_line_buf_enabled = true;
+	}
+
+	integer_part = Q16_INT(d->compression_ratio);
+	frac_part = Q16_FRAC(d->compression_ratio);
+	dpb_compression_factor = FP(integer_part, frac_part, 100);
+
+	integer_part = Q16_INT(d->input_cr);
+	frac_part = Q16_FRAC(d->input_cr);
+	input_compression_factor = FP(integer_part, frac_part, 100);
+
+	original_compression_factor = original_compression_factor_y =
+		!original_compression_enabled ? FP_ONE :
+		__compression_ratio(__lut(width, height, fps), dpb_bpp);
+	/* use input cr if it is valid (not 1), otherwise use lut */
+	if (original_compression_enabled &&
+		input_compression_factor != FP_ONE) {
+		original_compression_factor = input_compression_factor;
+		/* Luma usually has lower compression factor than Chroma,
+		 * input cf is overall cf, add 1.08 factor for Luma cf
+		 */
+		original_compression_factor_y =
+			input_compression_factor > FP(1, 8, 100) ?
+			fp_div(input_compression_factor, FP(1, 8, 100)) :
+			input_compression_factor;
+	}
+
+	ddr.vsp_read = fp_div(FP_INT(bitrate * bins_to_bit_factor), FP_INT(8));
+	ddr.vsp_write = ddr.vsp_read + fp_div(FP_INT(bitrate), FP_INT(8));
+
+	collocated_bytes_per_lcu = lcu_size == 16 ? 16 :
+				lcu_size == 32 ? 64 : 256;
+
+	ddr.collocated_read = fp_div(FP_INT(lcu_per_frame *
+			collocated_bytes_per_lcu * fps), FP_INT(bps(1)));
+
+	ddr.collocated_write = ddr.collocated_read;
+
+	ddr.ref_read_y = dpb_bpp == 8 ?
+		y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	if (b_frames_enabled)
+		ddr.ref_read_y = ddr.ref_read_y * 2;
+	ddr.ref_read_y = fp_div(ddr.ref_read_y, dpb_compression_factor);
+
+	ddr.ref_read_crcb = fp_mult((ddr.ref_read_y / 2),
+		ref_cbcr_read_bw_factor);
+
+	if (width > vertical_tile_width) {
+		ddr.ref_read_y = fp_mult(ddr.ref_read_y,
+			ref_y_read_bw_factor);
+	}
+
+	if (llc_ref_chroma_cache_enabled) {
+		total_ref_read_crcb = ddr.ref_read_crcb;
+		ddr.ref_read_crcb = fp_div(ddr.ref_read_crcb,
+					   ref_cbcr_read_bw_factor);
+		llc.ref_read_crcb = total_ref_read_crcb - ddr.ref_read_crcb;
+	}
+
+	ddr.ref_write = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	ddr.ref_write = fp_div(fp_mult(ddr.ref_write, FP(1, 50, 100)),
+			dpb_compression_factor);
+
+	if (width > vertical_tile_width) {
+		ddr.ref_write_overlap = fp_mult(ddr.ref_write,
+			(recon_write_bw_factor - FP_ONE));
+		ddr.ref_write = fp_mult(ddr.ref_write, recon_write_bw_factor);
+	}
+
+	/* double ref_write */
+	if (vpss_preprocessing_enabled)
+		ddr.ref_write = ddr.ref_write * 2;
+
+	ddr.orig_read = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp :
+		(original_compression_enabled ? y_bw_no_ubwc_10bpp :
+		y_bw_10bpp_p010);
+	ddr.orig_read = fp_div(fp_mult(fp_mult(ddr.orig_read, FP(1, 50, 100)),
+		downscaling_ratio), original_compression_factor);
+	if (rotation == 90 || rotation == 270)
+		ddr.orig_read *= lcu_size == 32 ? (dpb_bpp == 8 ? 1 : 3) : 2;
+
+	/* double orig_read */
+	if (vpss_preprocessing_enabled)
+		ddr.orig_read = ddr.orig_read * 2;
+
+	ddr.line_buffer_read =
+		fp_div(FP_INT(tnbr_per_lcu * lcu_per_frame * fps),
+			FP_INT(bps(1)));
+
+	ddr.line_buffer_write = ddr.line_buffer_read;
+	if (llc_top_line_buf_enabled) {
+		llc.line_buffer = ddr.line_buffer_read + ddr.line_buffer_write;
+		ddr.line_buffer_read = ddr.line_buffer_write = FP_ZERO;
+	}
+
+	ddr.total = ddr.vsp_read + ddr.vsp_write +
+		ddr.collocated_read + ddr.collocated_write +
+		ddr.ref_read_y + ddr.ref_read_crcb +
+		ddr.ref_write + ddr.ref_write_overlap +
+		ddr.orig_read +
+		ddr.line_buffer_read + ddr.line_buffer_write;
+
+	qsmmu_bw_overhead_factor = FP(1, 3, 100);
+	ddr.total = fp_mult(ddr.total, qsmmu_bw_overhead_factor);
+	llc.total = llc.ref_read_crcb + llc.line_buffer + ddr.total;
+
+	if (msm_vidc_debug & VIDC_BUS) {
+		struct dump dump[] = {
+		{"ENCODER PARAMETERS", "", DUMP_HEADER_MAGIC},
+		{"width", "%d", width},
+		{"height", "%d", height},
+		{"fps", "%d", fps},
+		{"dpb bitdepth", "%d", dpb_bpp},
+		{"input downscaling ratio", DUMP_FP_FMT, downscaling_ratio},
+		{"rotation", "%d", rotation},
+		{"cropping or scaling", "%d", cropping_or_scaling},
+		{"low power mode", "%d", low_power},
+		{"work Mode", "%d", work_mode_1},
+		{"B frame enabled", "%d", b_frames_enabled},
+		{"original frame format", "%#x", original_color_format},
+		{"VPSS preprocessing", "%d", vpss_preprocessing_enabled},
+		{"original compression enabled", "%d",
+			original_compression_enabled},
+		{"dpb compression factor", DUMP_FP_FMT,
+			dpb_compression_factor},
+		{"input compression factor", DUMP_FP_FMT,
+			input_compression_factor},
+		{"llc ref chroma cache enabled", DUMP_FP_FMT,
+		llc_ref_chroma_cache_enabled},
+		{"llc top line buf enabled", DUMP_FP_FMT,
+			llc_top_line_buf_enabled},
+		{"llc vpss rot line buf enabled ", DUMP_FP_FMT,
+			llc_vpss_rot_line_buf_enabled},
+
+		{"DERIVED PARAMETERS", "", DUMP_HEADER_MAGIC},
+		{"lcu size", "%d", lcu_size},
+		{"bitrate (Mbit/sec)", "%lu", bitrate},
+		{"bins to bit factor", "%u", bins_to_bit_factor},
+		{"original compression factor", DUMP_FP_FMT,
+			original_compression_factor},
+		{"original compression factor y", DUMP_FP_FMT,
+			original_compression_factor_y},
+		{"qsmmu_bw_overhead_factor",
+			 DUMP_FP_FMT, qsmmu_bw_overhead_factor},
+		{"bw for NV12 8bpc)", DUMP_FP_FMT, y_bw_no_ubwc_8bpp},
+		{"bw for NV12 10bpc)", DUMP_FP_FMT, y_bw_no_ubwc_10bpp},
+
+		{"INTERMEDIATE B/W DDR", "", DUMP_HEADER_MAGIC},
+		{"vsp read", DUMP_FP_FMT, ddr.vsp_read},
+		{"vsp write", DUMP_FP_FMT, ddr.vsp_write},
+		{"collocated read", DUMP_FP_FMT, ddr.collocated_read},
+		{"collocated write", DUMP_FP_FMT, ddr.collocated_write},
+		{"ref read y", DUMP_FP_FMT, ddr.ref_read_y},
+		{"ref read crcb", DUMP_FP_FMT, ddr.ref_read_crcb},
+		{"ref write", DUMP_FP_FMT, ddr.ref_write},
+		{"ref write overlap", DUMP_FP_FMT, ddr.ref_write_overlap},
+		{"original read", DUMP_FP_FMT, ddr.orig_read},
+		{"line buffer read", DUMP_FP_FMT, ddr.line_buffer_read},
+		{"line buffer write", DUMP_FP_FMT, ddr.line_buffer_write},
+		{"INTERMEDIATE LLC B/W", "", DUMP_HEADER_MAGIC},
+		{"llc ref read crcb", DUMP_FP_FMT, llc.ref_read_crcb},
+		{"llc line buffer", DUMP_FP_FMT, llc.line_buffer},
+		};
+		__dump(dump, ARRAY_SIZE(dump));
+	}
+
+	d->calc_bw_ddr = kbps(fp_round(ddr.total));
+	d->calc_bw_llcc = kbps(fp_round(llc.total));
+
+	return ret;
+}
+
+static u64 __calculate(struct msm_vidc_inst *inst, struct vidc_bus_vote_data *d)
+{
+	u64 value = 0;
+
+	switch (d->domain) {
+	case MSM_VIDC_ENCODER:
+		value = __calculate_encoder(d);
+		break;
+	case MSM_VIDC_DECODER:
+		value = __calculate_decoder(d);
+		break;
+	default:
+		i_vpr_e(inst, "%s: Unknown Domain %#x", __func__, d->domain);
+	}
+
+	return value;
+}
+
+int msm_vidc_calc_bw_iris3(struct msm_vidc_inst *inst,
+		struct vidc_bus_vote_data *vidc_data)
+{
+	int value = 0;
+
+	if (!vidc_data)
+		return value;
+
+	if (ENABLE_LEGACY_POWER_CALCULATIONS)
+		value = __calculate(inst, vidc_data);
+	else
+		value = msm_vidc_calc_bw_iris3_new(inst, vidc_data);
+
+	return value;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris33/inc/hfi_buffer_iris33.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris33/inc/hfi_buffer_iris33.h
@@ -0,0 +1,1802 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __HFI_BUFFER_IRIS3_3__
+#define __HFI_BUFFER_IRIS3_3__
+
+#include <linux/types.h>
+#include "hfi_property.h"
+
+typedef u8      HFI_U8;
+typedef s8      HFI_S8;
+typedef u16     HFI_U16;
+typedef s16     HFI_S16;
+typedef u32     HFI_U32;
+typedef s32     HFI_S32;
+typedef u64     HFI_U64;
+typedef HFI_U32 HFI_BOOL;
+
+#ifndef MIN
+#define  MIN(x, y) (((x) < (y)) ? (x) : (y))
+#endif
+
+#ifndef MAX
+#define  MAX(x, y) (((x) > (y)) ? (x) : (y))
+#endif
+
+#define HFI_ALIGNMENT_4096 (4096)
+
+#define BUF_SIZE_ALIGN_16 (16)
+#define BUF_SIZE_ALIGN_32 (32)
+#define BUF_SIZE_ALIGN_64 (64)
+#define BUF_SIZE_ALIGN_128 (128)
+#define BUF_SIZE_ALIGN_256 (256)
+#define BUF_SIZE_ALIGN_512 (512)
+#define BUF_SIZE_ALIGN_4096 (4096)
+
+#define HFI_ALIGN(a, b) (((b) & ((b) - 1)) ? (((a) + (b) - 1) / \
+	(b) * (b)) : (((a) + (b) - 1) & (~((b) - 1))))
+
+#define HFI_WORKMODE_1 1
+#define HFI_WORKMODE_2 2
+
+#define HFI_DEFAULT_METADATA_STRIDE_MULTIPLE (64)
+#define HFI_DEFAULT_METADATA_BUFFERHEIGHT_MULTIPLE (16)
+
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT (8)
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH (32)
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_HEIGHT (8)
+#define HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_WIDTH (16)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_HEIGHT (4)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_WIDTH (48)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_HEIGHT (4)
+#define HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_WIDTH (24)
+#define HFI_COLOR_FORMAT_RGBA8888_UBWC_TILE_HEIGHT (4)
+#define HFI_COLOR_FORMAT_RGBA8888_UBWC_TILE_WIDTH (16)
+
+#define HFI_NV12_IL_CALC_Y_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width, stride_multiple))
+
+#define HFI_NV12_IL_CALC_Y_BUFHEIGHT(buf_height, frame_height, \
+	min_buf_height_multiple) (buf_height = HFI_ALIGN(frame_height, \
+	min_buf_height_multiple))
+
+#define HFI_NV12_IL_CALC_UV_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width, stride_multiple))
+
+#define HFI_NV12_IL_CALC_UV_BUFHEIGHT(buf_height, frame_height, \
+	min_buf_height_multiple) (buf_height = HFI_ALIGN(((frame_height + 1) \
+	 >> 1),	min_buf_height_multiple))
+
+#define HFI_NV12_IL_CALC_BUF_SIZE(buf_size, y_bufSize, y_stride, y_buf_height, \
+	uv_buf_size, uv_stride, uv_buf_height) \
+	do { \
+		y_bufSize = (y_stride * y_buf_height); \
+		uv_buf_size = (uv_stride * uv_buf_height); \
+		buf_size = HFI_ALIGN(y_bufSize + uv_buf_size, HFI_ALIGNMENT_4096); \
+	} while (0)
+
+#define HFI_NV12_UBWC_IL_CALC_Y_BUF_SIZE(y_bufSize, y_stride, y_buf_height) \
+	(y_bufSize = HFI_ALIGN(y_stride * y_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_NV12_UBWC_IL_CALC_UV_BUF_SIZE(uv_buf_size, \
+	uv_stride, uv_buf_height) \
+	(uv_buf_size = HFI_ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_NV12_UBWC_IL_CALC_BUF_SIZE_V2(buf_size,\
+	frame_width, frame_height, y_stride_multiple,\
+	y_buffer_height_multiple, uv_stride_multiple, \
+	uv_buffer_height_multiple, y_metadata_stride_multiple, \
+	y_metadata_buffer_height_multiple, \
+	uv_metadata_stride_multiple, uv_metadata_buffer_height_multiple, binterlace) \
+	do { \
+		HFI_U32 y_buf_size, uv_buf_size, y_meta_size, uv_meta_size;   \
+		HFI_U32 stride, _height; \
+		HFI_U32 half_height = (frame_height + 1) >> 1; \
+		HFI_NV12_IL_CALC_Y_STRIDE(stride, frame_width,\
+					y_stride_multiple); \
+		HFI_NV12_IL_CALC_Y_BUFHEIGHT(_height, half_height,\
+					y_buffer_height_multiple); \
+		HFI_NV12_UBWC_IL_CALC_Y_BUF_SIZE(y_buf_size, stride, _height);\
+		HFI_NV12_IL_CALC_UV_STRIDE(stride, frame_width, \
+					uv_stride_multiple); \
+		HFI_NV12_IL_CALC_UV_BUFHEIGHT(_height, half_height, \
+					uv_buffer_height_multiple); \
+		HFI_NV12_UBWC_IL_CALC_UV_BUF_SIZE(uv_buf_size, stride, _height);\
+		HFI_UBWC_CALC_METADATA_PLANE_STRIDE(stride, frame_width,\
+				y_metadata_stride_multiple, \
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH);\
+		HFI_UBWC_METADATA_PLANE_BUFHEIGHT(_height, half_height, \
+				y_metadata_buffer_height_multiple,\
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT);\
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(y_meta_size, stride, \
+				_height);    \
+		HFI_UBWC_UV_METADATA_PLANE_STRIDE(stride, frame_width,\
+				uv_metadata_stride_multiple, \
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_WIDTH); \
+		HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(_height, half_height,\
+				uv_metadata_buffer_height_multiple,\
+			HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_HEIGHT);\
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(uv_meta_size, stride, \
+				 _height); \
+		buf_size = (y_buf_size + uv_buf_size + y_meta_size + \
+			uv_meta_size) << binterlace;\
+	} while (0)
+
+#define HFI_YUV420_TP10_CALC_Y_STRIDE(stride, frame_width, stride_multiple) \
+	do { \
+		stride = HFI_ALIGN(frame_width, 192); \
+		stride = HFI_ALIGN(stride * 4 / 3, stride_multiple); \
+	} while (0)
+
+#define HFI_YUV420_TP10_CALC_Y_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(frame_height, min_buf_height_multiple))
+
+#define HFI_YUV420_TP10_CALC_UV_STRIDE(stride, frame_width, stride_multiple) \
+	do { \
+		stride = HFI_ALIGN(frame_width, 192); \
+		stride = HFI_ALIGN(stride * 4 / 3, stride_multiple); \
+	} while (0)
+
+#define HFI_YUV420_TP10_CALC_UV_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(((frame_height + 1) >> 1), \
+			min_buf_height_multiple))
+
+#define HFI_YUV420_TP10_CALC_BUF_SIZE(buf_size, y_buf_size, y_stride,\
+		y_buf_height, uv_buf_size, uv_stride, uv_buf_height) \
+	do { \
+		y_buf_size = (y_stride * y_buf_height); \
+		uv_buf_size = (uv_stride * uv_buf_height); \
+		buf_size = y_buf_size + uv_buf_size; \
+	} while (0)
+
+#define HFI_YUV420_TP10_UBWC_CALC_Y_BUF_SIZE(y_buf_size, y_stride, \
+					y_buf_height) \
+	(y_buf_size = HFI_ALIGN(y_stride * y_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_YUV420_TP10_UBWC_CALC_UV_BUF_SIZE(uv_buf_size, uv_stride, \
+					uv_buf_height) \
+	(uv_buf_size = HFI_ALIGN(uv_stride * uv_buf_height, HFI_ALIGNMENT_4096))
+
+#define HFI_YUV420_TP10_UBWC_CALC_BUF_SIZE(buf_size, y_stride, y_buf_height, \
+	uv_stride, uv_buf_height, y_md_stride, y_md_height, uv_md_stride, \
+	uv_md_height)\
+	do { \
+		HFI_U32 y_data_size, uv_data_size, y_md_size, uv_md_size; \
+		HFI_YUV420_TP10_UBWC_CALC_Y_BUF_SIZE(y_data_size, y_stride,\
+						y_buf_height); \
+		HFI_YUV420_TP10_UBWC_CALC_UV_BUF_SIZE(uv_data_size, uv_stride, \
+						uv_buf_height); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(y_md_size, y_md_stride, \
+						y_md_height); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(uv_md_size, uv_md_stride, \
+						uv_md_height); \
+		buf_size = y_data_size + uv_data_size + y_md_size + \
+						uv_md_size; \
+	} while (0)
+
+#define HFI_YUV420_P010_CALC_Y_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width * 2, stride_multiple))
+
+#define HFI_YUV420_P010_CALC_Y_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(frame_height, min_buf_height_multiple))
+
+#define HFI_YUV420_P010_CALC_UV_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN(frame_width * 2, stride_multiple))
+
+#define HFI_YUV420_P010_CALC_UV_BUFHEIGHT(buf_height, frame_height, \
+				min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(((frame_height + 1) >> 1), \
+			min_buf_height_multiple))
+
+#define HFI_YUV420_P010_CALC_BUF_SIZE(buf_size, y_data_size, y_stride, \
+	y_buf_height, uv_data_size, uv_stride, uv_buf_height) \
+	do { \
+		y_data_size = HFI_ALIGN(y_stride * y_buf_height, \
+				HFI_ALIGNMENT_4096);\
+		uv_data_size = HFI_ALIGN(uv_stride * uv_buf_height, \
+				HFI_ALIGNMENT_4096); \
+		buf_size = y_data_size + uv_data_size; \
+	} while (0)
+
+#define HFI_RGB888_CALC_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = ((frame_width * 3) + stride_multiple - 1) & \
+			 (0xffffffff - (stride_multiple - 1)))
+
+#define HFI_RGB888_CALC_BUFHEIGHT(buf_height, frame_height, \
+			min_buf_height_multiple) \
+	(buf_height = ((frame_height + min_buf_height_multiple - 1) & \
+			(0xffffffff - (min_buf_height_multiple - 1))))
+
+#define HFI_RGB888_CALC_BUF_SIZE(buf_size, stride, buf_height) \
+	(buf_size = ((stride) * (buf_height)))
+
+#define HFI_RGBA8888_CALC_STRIDE(stride, frame_width, stride_multiple) \
+	(stride = HFI_ALIGN((frame_width << 2), stride_multiple))
+
+#define HFI_RGBA8888_CALC_BUFHEIGHT(buf_height, frame_height, \
+			min_buf_height_multiple) \
+	(buf_height = HFI_ALIGN(frame_height, min_buf_height_multiple))
+
+#define HFI_RGBA8888_CALC_BUF_SIZE(buf_size, stride, buf_height) \
+	(buf_size = (stride) * (buf_height))
+
+#define HFI_RGBA8888_UBWC_CALC_DATA_PLANE_BUF_SIZE(buf_size, stride, \
+				buf_height) \
+	(buf_size = HFI_ALIGN((stride) * (buf_height), HFI_ALIGNMENT_4096))
+
+#define HFI_RGBA8888_UBWC_BUF_SIZE(buf_size, data_buf_size, \
+	metadata_buffer_size, stride, buf_height, _metadata_tride, \
+	_metadata_buf_height) \
+	do { \
+		HFI_RGBA8888_UBWC_CALC_DATA_PLANE_BUF_SIZE(data_buf_size, \
+				stride, buf_height); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(metadata_buffer_size, \
+				_metadata_tride, _metadata_buf_height); \
+		buf_size = data_buf_size + metadata_buffer_size; \
+	} while (0)
+
+#define HFI_UBWC_CALC_METADATA_PLANE_STRIDE(metadata_stride, frame_width,\
+	metadata_stride_multiple, tile_width_in_pels) \
+	((metadata_stride = HFI_ALIGN(((frame_width + (tile_width_in_pels - 1)) /\
+	tile_width_in_pels), metadata_stride_multiple)))
+
+#define HFI_UBWC_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, frame_height, \
+	metadata_height_multiple, tile_height_in_pels) \
+	((metadata_buf_height = HFI_ALIGN(((frame_height + \
+	(tile_height_in_pels - 1)) / tile_height_in_pels), \
+	metadata_height_multiple)))
+
+#define HFI_UBWC_UV_METADATA_PLANE_STRIDE(metadata_stride, frame_width, \
+	metadata_stride_multiple, tile_width_in_pels) \
+	((metadata_stride = HFI_ALIGN(((((frame_width + 1) >> 1) +\
+	(tile_width_in_pels - 1)) / tile_width_in_pels), \
+	metadata_stride_multiple)))
+
+#define HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, frame_height,\
+	metadata_height_multiple, tile_height_in_pels) \
+	(metadata_buf_height = HFI_ALIGN(((((frame_height + 1) >> 1) + \
+	(tile_height_in_pels - 1)) / tile_height_in_pels), \
+	metadata_height_multiple))
+
+#define HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(buffer_size, _metadata_tride, \
+					_metadata_buf_height) \
+	((buffer_size = HFI_ALIGN(_metadata_tride * _metadata_buf_height, \
+					HFI_ALIGNMENT_4096)))
+
+#define BUFFER_ALIGNMENT_512_BYTES 512
+#define BUFFER_ALIGNMENT_256_BYTES 256
+#define BUFFER_ALIGNMENT_128_BYTES 128
+#define BUFFER_ALIGNMENT_64_BYTES 64
+#define BUFFER_ALIGNMENT_32_BYTES 32
+#define BUFFER_ALIGNMENT_16_BYTES 16
+#define BUFFER_ALIGNMENT_8_BYTES 8
+#define BUFFER_ALIGNMENT_4_BYTES 4
+
+#define VENUS_DMA_ALIGNMENT BUFFER_ALIGNMENT_256_BYTES
+
+#define MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE 64
+#define MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE 640
+#define MAX_FE_NBR_DATA_CB_LINE_BUFFER_SIZE 320
+#define MAX_FE_NBR_DATA_CR_LINE_BUFFER_SIZE 320
+
+#define MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE (128 / 8)
+#define MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE (128 / 8)
+
+#define MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE (64 * 2 * 3)
+#define MAX_PE_NBR_DATA_LCU32_LINE_BUFFER_SIZE (32 * 2 * 3)
+#define MAX_PE_NBR_DATA_LCU16_LINE_BUFFER_SIZE (16 * 2 * 3)
+
+#define MAX_TILE_COLUMNS 32
+
+#define SIZE_VPSS_LB(Size, frame_width, frame_height, num_vpp_pipes) \
+	do { \
+		HFI_U32 vpss_4tap_top_buffer_size, vpss_div2_top_buffer_size, \
+		vpss_4tap_left_buffer_size, vpss_div2_left_buffer_size; \
+		HFI_U32 opb_wr_top_line_luma_buffer_size, \
+		opb_wr_top_line_chroma_buffer_size, \
+		opb_lb_wr_llb_y_buffer_size,\
+		opb_lb_wr_llb_uv_buffer_size; \
+		HFI_U32 macrotiling_size; \
+		vpss_4tap_top_buffer_size = vpss_div2_top_buffer_size = \
+		vpss_4tap_left_buffer_size = vpss_div2_left_buffer_size = 0; \
+		macrotiling_size = 32; \
+		opb_wr_top_line_luma_buffer_size = HFI_ALIGN(frame_width, \
+			macrotiling_size) / macrotiling_size * 256; \
+			opb_wr_top_line_luma_buffer_size = \
+		HFI_ALIGN(opb_wr_top_line_luma_buffer_size, \
+		VENUS_DMA_ALIGNMENT) + (MAX_TILE_COLUMNS - 1) * 256; \
+		opb_wr_top_line_luma_buffer_size = \
+		MAX(opb_wr_top_line_luma_buffer_size, (32 * \
+			HFI_ALIGN(frame_height, 8))); \
+		opb_wr_top_line_chroma_buffer_size = \
+			opb_wr_top_line_luma_buffer_size;\
+		opb_lb_wr_llb_uv_buffer_size = opb_lb_wr_llb_y_buffer_size = \
+			HFI_ALIGN((HFI_ALIGN(frame_height, 8) / (4 / 2)) * 64,\
+					   BUFFER_ALIGNMENT_32_BYTES); \
+		Size = num_vpp_pipes * 2 * (vpss_4tap_top_buffer_size +  \
+						vpss_div2_top_buffer_size) +  \
+			   2 * (vpss_4tap_left_buffer_size + \
+					vpss_div2_left_buffer_size) + \
+			   opb_wr_top_line_luma_buffer_size + \
+			   opb_wr_top_line_chroma_buffer_size + \
+			   opb_lb_wr_llb_uv_buffer_size + \
+			   opb_lb_wr_llb_y_buffer_size; \
+	} while (0)
+
+#define VPP_CMD_MAX_SIZE (1 << 20)
+#define NUM_HW_PIC_BUF 32
+#define BIN_BUFFER_THRESHOLD (1280 * 736)
+#define H264D_MAX_SLICE 1800
+#define SIZE_H264D_BUFTAB_T (256)
+#define SIZE_H264D_HW_PIC_T (1 << 11)
+#define SIZE_H264D_BSE_CMD_PER_BUF (32 * 4)
+#define SIZE_H264D_VPP_CMD_PER_BUF (512)
+
+#define SIZE_H264D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	(MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE * HFI_ALIGN(frame_width, 16) * 3)
+
+#define SIZE_H264D_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4))
+
+#define SIZE_H264D_LB_FE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4))
+
+#define SIZE_H264D_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	(MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_width + 15) >> 4))
+
+#define SIZE_H264D_LB_SE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * ((frame_height + 15) >> 4))
+
+#define SIZE_H264D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	(MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE *  ((frame_width + 15) >> 4))
+
+#define SIZE_H264D_LB_VSP_TOP(frame_width, frame_height) \
+	((((frame_width + 15) >> 4) << 7))
+
+#define SIZE_H264D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	(HFI_ALIGN(frame_height, 16) * 32)
+
+#define SIZE_H264D_QP(frame_width, frame_height) \
+	(((frame_width + 63) >> 6) * ((frame_height + 63) >> 6) * 128)
+
+#define SIZE_HW_PIC(size_per_buf) \
+	(NUM_HW_PIC_BUF * size_per_buf)
+
+#define SIZE_H264D_BSE_CMD_BUF(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 _height = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_32_BYTES);  \
+		_size = MIN((((_height + 15) >> 4) * 48), H264D_MAX_SLICE) *\
+					  SIZE_H264D_BSE_CMD_PER_BUF; \
+	} while (0)
+
+#define SIZE_H264D_VPP_CMD_BUF(_size, frame_width, frame_height)    \
+	do { \
+		HFI_U32 _height = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_32_BYTES); \
+		_size = MIN((((_height + 15) >> 4) * 48), H264D_MAX_SLICE) * \
+					SIZE_H264D_VPP_CMD_PER_BUF; \
+		if (_size > VPP_CMD_MAX_SIZE) { \
+			_size = VPP_CMD_MAX_SIZE; \
+		} \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H264D(coMV_size, frame_width, \
+			frame_height, _comv_bufcount) \
+	do { \
+		HFI_U32 frame_width_in_mbs = ((frame_width + 15) >> 4); \
+		HFI_U32 frame_height_in_mbs = ((frame_height + 15) >> 4); \
+		HFI_U32 col_mv_aligned_width = (frame_width_in_mbs << 7); \
+		HFI_U32 col_zero_aligned_width = (frame_width_in_mbs << 2); \
+		HFI_U32 col_zero_size = 0, size_colloc = 0; \
+		col_mv_aligned_width = HFI_ALIGN(col_mv_aligned_width, \
+					BUFFER_ALIGNMENT_16_BYTES); \
+		col_zero_aligned_width = HFI_ALIGN(col_zero_aligned_width, \
+					BUFFER_ALIGNMENT_16_BYTES); \
+		col_zero_size = col_zero_aligned_width * \
+					((frame_height_in_mbs + 1) >> 1); \
+		col_zero_size = HFI_ALIGN(col_zero_size, \
+				BUFFER_ALIGNMENT_64_BYTES);  \
+		col_zero_size <<= 1; \
+		col_zero_size = HFI_ALIGN(col_zero_size, \
+				BUFFER_ALIGNMENT_512_BYTES); \
+		size_colloc = col_mv_aligned_width * ((frame_height_in_mbs + \
+				1) >> 1); \
+		size_colloc = HFI_ALIGN(size_colloc, \
+				BUFFER_ALIGNMENT_64_BYTES); \
+		size_colloc <<= 1; \
+		size_colloc = HFI_ALIGN(size_colloc, \
+				BUFFER_ALIGNMENT_512_BYTES); \
+		size_colloc += (col_zero_size + SIZE_H264D_BUFTAB_T * 2); \
+		coMV_size = size_colloc * (_comv_bufcount); \
+		coMV_size += BUFFER_ALIGNMENT_512_BYTES; \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_H264D(_size, frame_width, frame_height, \
+								num_vpp_pipes) \
+	do { \
+		HFI_U32 _size_bse, _size_vpp; \
+		SIZE_H264D_BSE_CMD_BUF(_size_bse, frame_width, frame_height); \
+		SIZE_H264D_VPP_CMD_BUF(_size_vpp, frame_width, frame_height); \
+		_size = HFI_ALIGN(_size_bse, VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(_size_vpp, VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_HW_PIC(SIZE_H264D_HW_PIC_T), \
+			VENUS_DMA_ALIGNMENT); \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H264D(_size, frame_width, frame_height, \
+							  is_opb, num_vpp_pipes)            \
+	do { \
+		HFI_U32 vpss_lb_size = 0; \
+		_size = HFI_ALIGN(SIZE_H264D_LB_FE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_FE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_FE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H264D_LB_SE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_SE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * \
+			num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H264D_LB_PE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_VSP_TOP(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H264D_LB_RECON_DMA_METADATA_WR\
+			(frame_width, frame_height), \
+			VENUS_DMA_ALIGNMENT) * 2 + HFI_ALIGN(SIZE_H264D_QP\
+			(frame_width, frame_height), VENUS_DMA_ALIGNMENT); \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height, \
+						num_vpp_pipes); \
+		} \
+		_size = HFI_ALIGN((_size + vpss_lb_size), \
+			VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define H264_CABAC_HDR_RATIO_HD_TOT 1
+#define H264_CABAC_RES_RATIO_HD_TOT 3
+
+#define SIZE_H264D_HW_BIN_BUFFER(_size, frame_width, frame_height, \
+				delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 size_yuv, size_bin_hdr, size_bin_res; \
+		size_yuv = ((frame_width * frame_height) <= \
+			BIN_BUFFER_THRESHOLD) ?\
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) : \
+			((frame_width * frame_height * 3) >> 1); \
+		size_bin_hdr = size_yuv * H264_CABAC_HDR_RATIO_HD_TOT; \
+		size_bin_res = size_yuv * H264_CABAC_RES_RATIO_HD_TOT; \
+		size_bin_hdr = size_bin_hdr * (((((HFI_U32)(delay)) & 31) /\
+				10) + 2) / 2; \
+		size_bin_res = size_bin_res * (((((HFI_U32)(delay)) & 31) /\
+				10) + 2) / 2; \
+		size_bin_hdr = HFI_ALIGN(size_bin_hdr / num_vpp_pipes,\
+				VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		size_bin_res = HFI_ALIGN(size_bin_res / num_vpp_pipes, \
+			VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		_size = size_bin_hdr + size_bin_res; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H264D(_size, frame_width, frame_height, is_interlaced, \
+			delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 n_aligned_w = HFI_ALIGN(frame_width, \
+				BUFFER_ALIGNMENT_16_BYTES);\
+		HFI_U32 n_aligned_h = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_16_BYTES); \
+		if (!is_interlaced)  { \
+			SIZE_H264D_HW_BIN_BUFFER(_size, n_aligned_w, \
+				n_aligned_h, delay, num_vpp_pipes); \
+		} else { \
+			_size = 0;  \
+		} \
+	} while (0)
+
+#define NUM_SLIST_BUF_H264 (256 + 32)
+#define SIZE_SLIST_BUF_H264 (512)
+#define SIZE_SEI_USERDATA (4096)
+#define H264_NUM_FRM_INFO (66)
+#define H264_DISPLAY_BUF_SIZE (3328)
+#define SIZE_DOLBY_RPU_METADATA (41 * 1024)
+#define HFI_BUFFER_PERSIST_H264D(_size, rpu_enabled) \
+	(_size = HFI_ALIGN((SIZE_SLIST_BUF_H264 * NUM_SLIST_BUF_H264 + \
+	H264_DISPLAY_BUF_SIZE * H264_NUM_FRM_INFO + \
+	NUM_HW_PIC_BUF * SIZE_SEI_USERDATA + \
+	rpu_enabled * NUM_HW_PIC_BUF * SIZE_DOLBY_RPU_METADATA), \
+	VENUS_DMA_ALIGNMENT))
+
+#define LCU_MAX_SIZE_PELS 64
+#define LCU_MIN_SIZE_PELS 16
+
+#define H265D_MAX_SLICE 1200
+#define SIZE_H265D_HW_PIC_T SIZE_H264D_HW_PIC_T
+#define SIZE_H265D_BSE_CMD_PER_BUF (16 * sizeof(HFI_U32))
+#define SIZE_H265D_VPP_CMD_PER_BUF (256)
+
+#define SIZE_H265D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	(MAX_FE_NBR_DATA_LUMA_LINE_BUFFER_SIZE * \
+	(HFI_ALIGN(frame_width, 64) + 8) * 2)
+
+#define SIZE_H265D_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * \
+	(HFI_ALIGN(frame_width, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS))
+
+#define SIZE_H265D_LB_FE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE * \
+	(HFI_ALIGN(frame_height, LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS))
+
+#define SIZE_H265D_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	((LCU_MAX_SIZE_PELS / 8 * (128 / 8)) * ((frame_width + 15) >> 4))
+
+#define SIZE_H265D_LB_SE_LEFT_CTRL(frame_width, frame_height)    \
+	(MAX(((frame_height + 16 - 1) / 8) * \
+		MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,     \
+	MAX(((frame_height + 32 - 1) / 8) * \
+		MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 64 - 1) / 8) * \
+		MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE)))
+
+#define SIZE_H265D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	(MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE * (HFI_ALIGN(frame_width, \
+	LCU_MIN_SIZE_PELS) / LCU_MIN_SIZE_PELS))
+
+#define SIZE_H265D_LB_VSP_TOP(frame_width, frame_height) \
+	(((frame_width + 63) >> 6) * 128)
+
+#define SIZE_H265D_LB_VSP_LEFT(frame_width, frame_height) \
+	(((frame_height + 63) >> 6) * 128)
+
+#define SIZE_H265D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	SIZE_H264D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height)
+
+#define SIZE_H265D_QP(frame_width, frame_height) \
+		SIZE_H264D_QP(frame_width, frame_height)
+
+#define SIZE_H265D_BSE_CMD_BUF(_size, frame_width, frame_height)\
+	do { \
+		_size = HFI_ALIGN(((HFI_ALIGN(frame_width, \
+		LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS) * \
+		(HFI_ALIGN(frame_height, LCU_MAX_SIZE_PELS) /\
+		LCU_MIN_SIZE_PELS)) * NUM_HW_PIC_BUF, VENUS_DMA_ALIGNMENT);  \
+		_size = MIN(_size, H265D_MAX_SLICE + 1);          \
+		_size = 2 * _size * SIZE_H265D_BSE_CMD_PER_BUF;     \
+	} while (0)
+
+#define SIZE_H265D_VPP_CMD_BUF(_size, frame_width, frame_height)  \
+	do { \
+		_size = HFI_ALIGN(((HFI_ALIGN(frame_width, LCU_MAX_SIZE_PELS) /\
+		LCU_MIN_SIZE_PELS) * (HFI_ALIGN(frame_height, \
+		LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS)) * \
+		NUM_HW_PIC_BUF, VENUS_DMA_ALIGNMENT);  \
+		_size = MIN(_size, H265D_MAX_SLICE + 1);    \
+		_size = HFI_ALIGN(_size, 4);  \
+		_size = 2 * _size * SIZE_H265D_VPP_CMD_PER_BUF; \
+		if (_size > VPP_CMD_MAX_SIZE) { \
+			_size = VPP_CMD_MAX_SIZE;   \
+		}                          \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H265D(_size, frame_width, frame_height, \
+							_comv_bufcount) \
+	do { \
+		_size = HFI_ALIGN(((((frame_width + 15) >> 4) * \
+			((frame_height + 15) >> 4)) << 8), \
+			BUFFER_ALIGNMENT_512_BYTES); \
+		_size *= _comv_bufcount; \
+		_size += BUFFER_ALIGNMENT_512_BYTES; \
+	} while (0)
+
+#define HDR10_HIST_EXTRADATA_SIZE (4 * 1024)
+
+#define HFI_BUFFER_NON_COMV_H265D(_size, frame_width, frame_height, \
+				num_vpp_pipes) \
+	do { \
+		HFI_U32 _size_bse, _size_vpp; \
+		SIZE_H265D_BSE_CMD_BUF(_size_bse, frame_width, \
+		frame_height); \
+		SIZE_H265D_VPP_CMD_BUF(_size_vpp, frame_width, \
+		frame_height);  \
+		_size = HFI_ALIGN(_size_bse, VENUS_DMA_ALIGNMENT) +     \
+			HFI_ALIGN(_size_vpp, VENUS_DMA_ALIGNMENT) +     \
+			HFI_ALIGN(NUM_HW_PIC_BUF * 20 * 22 * 4, \
+			VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(2 * sizeof(HFI_U16) *           \
+			(HFI_ALIGN(frame_width, LCU_MAX_SIZE_PELS) / \
+			LCU_MIN_SIZE_PELS) * (HFI_ALIGN(frame_height, \
+			LCU_MAX_SIZE_PELS) / LCU_MIN_SIZE_PELS), \
+			VENUS_DMA_ALIGNMENT) +                \
+			HFI_ALIGN(SIZE_HW_PIC(SIZE_H265D_HW_PIC_T), \
+			VENUS_DMA_ALIGNMENT) + \
+			HDR10_HIST_EXTRADATA_SIZE;           \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT);  \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H265D(_size, frame_width, frame_height, \
+			is_opb, num_vpp_pipes) \
+	do { \
+		HFI_U32 vpss_lb_size = 0; \
+		_size = HFI_ALIGN(SIZE_H265D_LB_FE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_FE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_FE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H265D_LB_SE_LEFT_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H265D_LB_SE_TOP_CTRL(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_PE_TOP_DATA(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_H265D_LB_VSP_TOP(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) +        \
+			HFI_ALIGN(SIZE_H265D_LB_VSP_LEFT(frame_width, \
+			frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_H265D_LB_RECON_DMA_METADATA_WR\
+			(frame_width, frame_height), \
+			VENUS_DMA_ALIGNMENT) * 4 +  \
+			HFI_ALIGN(SIZE_H265D_QP(frame_width, frame_height),\
+			VENUS_DMA_ALIGNMENT);           \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height,\
+						 num_vpp_pipes); \
+		} \
+		_size = HFI_ALIGN((_size + vpss_lb_size), \
+			VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define H265_CABAC_HDR_RATIO_HD_TOT 2
+#define H265_CABAC_RES_RATIO_HD_TOT 2
+
+#define SIZE_H265D_HW_BIN_BUFFER(_size, frame_width, frame_height, \
+				delay, num_vpp_pipes)    \
+	do { \
+		HFI_U32 size_yuv, size_bin_hdr, size_bin_res;     \
+		size_yuv = ((frame_width * frame_height) <= \
+			BIN_BUFFER_THRESHOLD) ? \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) : \
+			((frame_width * frame_height * 3) >> 1); \
+		size_bin_hdr = size_yuv * H265_CABAC_HDR_RATIO_HD_TOT;    \
+		size_bin_res = size_yuv * H265_CABAC_RES_RATIO_HD_TOT;   \
+		size_bin_hdr = size_bin_hdr * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2;    \
+		size_bin_res = size_bin_res * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2;    \
+		size_bin_hdr = HFI_ALIGN(size_bin_hdr / \
+			num_vpp_pipes, VENUS_DMA_ALIGNMENT) * \
+			num_vpp_pipes;  \
+		size_bin_res = HFI_ALIGN(size_bin_res / num_vpp_pipes,\
+			VENUS_DMA_ALIGNMENT) * num_vpp_pipes;  \
+		_size = size_bin_hdr + size_bin_res;    \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H265D(_size, frame_width, frame_height, \
+				is_interlaced, delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 n_aligned_w = HFI_ALIGN(frame_width, \
+				BUFFER_ALIGNMENT_16_BYTES); \
+		HFI_U32 n_aligned_h = HFI_ALIGN(frame_height, \
+				BUFFER_ALIGNMENT_16_BYTES); \
+		if (!is_interlaced) { \
+			SIZE_H265D_HW_BIN_BUFFER(_size, n_aligned_w, \
+			n_aligned_h, delay, num_vpp_pipes); \
+		} else { \
+			_size = 0; \
+		} \
+	} while (0)
+
+#define SIZE_SLIST_BUF_H265 (1 << 10)
+#define NUM_SLIST_BUF_H265 (80 + 20)
+#define H265_NUM_TILE_COL 32
+#define H265_NUM_TILE_ROW 128
+#define H265_NUM_TILE (H265_NUM_TILE_ROW * H265_NUM_TILE_COL + 1)
+#define H265_NUM_FRM_INFO (48)
+#define H265_DISPLAY_BUF_SIZE (3072)
+#define HFI_BUFFER_PERSIST_H265D(_size, rpu_enabled) \
+	(_size = HFI_ALIGN((SIZE_SLIST_BUF_H265 * NUM_SLIST_BUF_H265 + \
+	H265_NUM_FRM_INFO * H265_DISPLAY_BUF_SIZE + \
+	H265_NUM_TILE * sizeof(HFI_U32) + NUM_HW_PIC_BUF * SIZE_SEI_USERDATA + \
+	rpu_enabled * NUM_HW_PIC_BUF * SIZE_DOLBY_RPU_METADATA),\
+	VENUS_DMA_ALIGNMENT))
+
+#define SIZE_VPXD_LB_FE_LEFT_CTRL(frame_width, frame_height)   \
+	MAX(((frame_height + 15) >> 4) * \
+	MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE, \
+	MAX(((frame_height + 31) >> 5) * \
+	MAX_FE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 63) >> 6) * MAX_FE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE))
+#define SIZE_VPXD_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(((HFI_ALIGN(frame_width, 64) + 8) * 10 * 2))
+#define SIZE_VPXD_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	(((frame_width + 15) >> 4) * MAX_FE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE)
+#define SIZE_VPXD_LB_SE_LEFT_CTRL(frame_width, frame_height)  \
+	MAX(((frame_height + 15) >> 4) * \
+	MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE,\
+	MAX(((frame_height + 31) >> 5) * \
+	MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 63) >> 6) * MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE))
+#define SIZE_VPXD_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	HFI_ALIGN((HFI_ALIGN(frame_height, 8) / (4 / 2)) * 64,\
+	BUFFER_ALIGNMENT_32_BYTES)
+#define SIZE_MP2D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(frame_width, 16) + 8) * 10 * 2)
+#define SIZE_VP9D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(HFI_ALIGN(frame_width, 8), 64) + 8) * 10 * 2)
+#define SIZE_MP2D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(frame_width, 16) >> 4) * 64)
+#define SIZE_VP9D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	((HFI_ALIGN(HFI_ALIGN(frame_width, 8), 64) >> 6) * 176)
+#define SIZE_MP2D_LB_VSP_TOP(frame_width, frame_height) \
+	(((HFI_ALIGN(frame_width, 16) >> 4) * 64 / 2) + 256)
+#define SIZE_VP9D_LB_VSP_TOP(frame_width, frame_height) \
+	((((HFI_ALIGN(HFI_ALIGN(frame_width, 8), 64) >> 6) * 64 * 8) + 256))
+
+#define HFI_IRIS3_VP9D_COMV_SIZE \
+	((((8192 + 63) >> 6) * ((4320 + 63) >> 6) * 8 * 8 * 2 * 8))
+
+#define SIZE_VP9D_QP(frame_width, frame_height) \
+	SIZE_H264D_QP(frame_width, frame_height)
+
+#define HFI_IRIS3_VP9D_LB_SIZE(_size, frame_width, frame_height, num_vpp_pipes)\
+	do { \
+		_size = HFI_ALIGN(SIZE_VPXD_LB_FE_LEFT_CTRL(frame_width, \
+		frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_LEFT_CTRL(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_VP9D_LB_VSP_TOP(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VPXD_LB_FE_TOP_CTRL(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + 2 * \
+		HFI_ALIGN(SIZE_VPXD_LB_RECON_DMA_METADATA_WR \
+		(frame_width, frame_height), VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_TOP_CTRL(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VP9D_LB_PE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VP9D_LB_FE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VP9D_QP(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_VP9D(_size, frame_width, frame_height, \
+		_yuv_bufcount_min, is_opb, num_vpp_pipes) \
+	do { \
+		HFI_U32 _lb_size = 0;                  \
+		HFI_U32 vpss_lb_size = 0;              \
+		HFI_IRIS3_VP9D_LB_SIZE(_lb_size, frame_width, frame_height,\
+			num_vpp_pipes);             \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height, \
+			num_vpp_pipes); \
+		} \
+		_size = _lb_size + vpss_lb_size; \
+	} while (0)
+
+#define VPX_DECODER_FRAME_CONCURENCY_LVL (2)
+#define VPX_DECODER_FRAME_BIN_HDR_BUDGET_RATIO 1 / 2
+#define VPX_DECODER_FRAME_BIN_RES_BUDGET_RATIO 3 / 2
+
+#define HFI_BUFFER_BIN_VP9D(_size, frame_width, frame_height, \
+				is_interlaced, num_vpp_pipes) \
+	do { \
+		HFI_U32 _size_yuv = HFI_ALIGN(frame_width, \
+		BUFFER_ALIGNMENT_16_BYTES) *\
+		HFI_ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES) * 3 / 2;  \
+		if (!is_interlaced) { \
+			_size = HFI_ALIGN(((MAX(_size_yuv, \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1)) * \
+			VPX_DECODER_FRAME_BIN_HDR_BUDGET_RATIO * \
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes), \
+			VENUS_DMA_ALIGNMENT) + HFI_ALIGN(((MAX(_size_yuv, \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1)) * \
+			VPX_DECODER_FRAME_BIN_RES_BUDGET_RATIO * \
+			VPX_DECODER_FRAME_CONCURENCY_LVL) / num_vpp_pipes), \
+			VENUS_DMA_ALIGNMENT);  \
+			_size = _size * num_vpp_pipes;   \
+		}              \
+		else \
+			_size = 0;     \
+	} while (0)
+
+#define VP9_NUM_FRAME_INFO_BUF 32
+#define VP9_NUM_PROBABILITY_TABLE_BUF (VP9_NUM_FRAME_INFO_BUF + 4)
+#define VP9_PROB_TABLE_SIZE (3840)
+#define VP9_FRAME_INFO_BUF_SIZE (6144)
+
+#define VP9_UDC_HEADER_BUF_SIZE (3 * 128)
+#define MAX_SUPERFRAME_HEADER_LEN (34)
+#define CCE_TILE_OFFSET_SIZE HFI_ALIGN(32 * 4 * 4, BUFFER_ALIGNMENT_32_BYTES)
+
+#define HFI_BUFFER_PERSIST_VP9D(_size) \
+	(_size = HFI_ALIGN(VP9_NUM_PROBABILITY_TABLE_BUF * VP9_PROB_TABLE_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(HFI_IRIS3_VP9D_COMV_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(MAX_SUPERFRAME_HEADER_LEN, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(VP9_UDC_HEADER_BUF_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HFI_ALIGN(VP9_NUM_FRAME_INFO_BUF * \
+	CCE_TILE_OFFSET_SIZE, VENUS_DMA_ALIGNMENT) + \
+	HFI_ALIGN(VP9_NUM_FRAME_INFO_BUF * VP9_FRAME_INFO_BUF_SIZE, \
+	VENUS_DMA_ALIGNMENT) + HDR10_HIST_EXTRADATA_SIZE)
+
+#define HFI_BUFFER_LINE_MP2D(_size, frame_width, frame_height, \
+_yuv_bufcount_min, is_opb, num_vpp_pipes)           \
+	do { \
+		HFI_U32 vpss_lb_size = 0;     \
+		_size = HFI_ALIGN(SIZE_VPXD_LB_FE_LEFT_CTRL(frame_width, \
+		frame_height), VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_LEFT_CTRL(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+		HFI_ALIGN(SIZE_MP2D_LB_VSP_TOP(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) + HFI_ALIGN(SIZE_VPXD_LB_FE_TOP_CTRL\
+		(frame_width, frame_height), VENUS_DMA_ALIGNMENT) + \
+		2 * HFI_ALIGN(SIZE_VPXD_LB_RECON_DMA_METADATA_WR(frame_width,\
+		frame_height), VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_VPXD_LB_SE_TOP_CTRL(frame_width, frame_height),\
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_MP2D_LB_PE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT) + \
+		HFI_ALIGN(SIZE_MP2D_LB_FE_TOP_DATA(frame_width, frame_height), \
+		VENUS_DMA_ALIGNMENT); \
+		if (is_opb) { \
+			SIZE_VPSS_LB(vpss_lb_size, frame_width, frame_height, \
+						num_vpp_pipes); \
+		} \
+		_size += vpss_lb_size; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_MP2D(_size, frame_width, frame_height, is_interlaced) 0
+
+#define QMATRIX_SIZE (sizeof(HFI_U32) * 128 + 256)
+#define MP2D_QPDUMP_SIZE 115200
+#define HFI_BUFFER_PERSIST_MP2D(_size) \
+	(_size = QMATRIX_SIZE + MP2D_QPDUMP_SIZE;)
+
+#define AV1D_LCU_MAX_SIZE_PELS 128
+#define AV1D_LCU_MIN_SIZE_PELS 64
+#define AV1D_MAX_TILE_COLS     64
+
+#define HFI_BUFFER_COMV_AV1D(_size, frame_width, frame_height, \
+				_comv_bufcount) \
+	do { \
+		_size = 2 * HFI_ALIGN(MAX(((frame_width + 63) / 64) * \
+				((frame_height + 63) / 64) * 512, \
+				((frame_width + 127) / 128) * \
+				((frame_height + 127) / 128) * 2816), \
+				VENUS_DMA_ALIGNMENT); \
+		_size *= _comv_bufcount; \
+	} while (0)
+
+#define SIZE_AV1D_LB_FE_TOP_DATA(frame_width, frame_height) \
+	(HFI_ALIGN(frame_width, AV1D_LCU_MAX_SIZE_PELS) * ((16 * 10) >> 3) + \
+	HFI_ALIGN(frame_width, AV1D_LCU_MAX_SIZE_PELS) / 2 * ((16 * 6) >> 3) * 2)
+
+#define SIZE_AV1D_LB_FE_LEFT_DATA(frame_width, frame_height) \
+	(32 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 16) + \
+	16 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / 2 + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 8) * 2 + \
+	24 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 16) + \
+	24 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / 2 + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 12) * 2 + \
+	24 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 16) + \
+	16 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 16) + \
+	16 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / 2 + \
+		HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+		AV1D_LCU_MIN_SIZE_PELS * 12) * 2)
+
+#define SIZE_AV1D_LB_FE_TOP_CTRL(frame_width, frame_height) \
+	(10 * ((frame_width + AV1D_LCU_MIN_SIZE_PELS - 1) / \
+		AV1D_LCU_MIN_SIZE_PELS) * 128 / 8)
+
+#define SIZE_AV1D_LB_FE_LEFT_CTRL(frame_width, frame_height) \
+	(16 * ((HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / 16) + \
+	(HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+	AV1D_LCU_MIN_SIZE_PELS)) + \
+	3 * 16 * (HFI_ALIGN(frame_height, AV1D_LCU_MAX_SIZE_PELS) / \
+	AV1D_LCU_MIN_SIZE_PELS))
+
+#define SIZE_AV1D_LB_SE_TOP_CTRL(frame_width, frame_height) \
+	(((frame_width + 7) / 8) * 16)
+
+#define SIZE_AV1D_LB_SE_LEFT_CTRL(frame_width, frame_height) \
+	(MAX(((frame_height + 15) / 16) * MAX_SE_NBR_CTRL_LCU16_LINE_BUFFER_SIZE, \
+	MAX(((frame_height + 31) / 32) * MAX_SE_NBR_CTRL_LCU32_LINE_BUFFER_SIZE, \
+	((frame_height + 63) / 64) * MAX_SE_NBR_CTRL_LCU64_LINE_BUFFER_SIZE)))
+
+#define SIZE_AV1D_LB_PE_TOP_DATA(frame_width, frame_height) \
+	(MAX(((frame_width + 15) / 16) * MAX_PE_NBR_DATA_LCU16_LINE_BUFFER_SIZE, \
+	MAX(((frame_width + 31) / 32) * MAX_PE_NBR_DATA_LCU32_LINE_BUFFER_SIZE, \
+	((frame_width + 63) / 64) * MAX_PE_NBR_DATA_LCU64_LINE_BUFFER_SIZE)))
+
+#define SIZE_AV1D_LB_VSP_TOP(frame_width, frame_height) \
+	(MAX(((frame_width + 63) / 64) * 1280, ((frame_width + 127) / 128) * 2304))
+
+#define SIZE_AV1D_LB_RECON_DMA_METADATA_WR(frame_width, frame_height) \
+	((HFI_ALIGN(frame_height, 8) / (4 / 2)) * 64)
+
+#define SIZE_AV1D_QP(frame_width, frame_height) \
+	SIZE_H264D_QP(frame_width, frame_height)
+
+#define SIZE_AV1D_LB_OPB_WR1_NV12_UBWC(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 y_width, y_width_a = 128; \
+		HFI_NV12_IL_CALC_Y_STRIDE(y_width, frame_width, y_width_a); \
+		_size = (256 * ((y_width + 31) / 32 + (AV1D_MAX_TILE_COLS - 1))); \
+	} while (0)
+
+#define SIZE_AV1D_LB_OPB_WR1_TP10_UBWC(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 y_width, y_width_a = 256; \
+		HFI_YUV420_TP10_CALC_Y_STRIDE(y_width, frame_width, y_width_a); \
+		_size = (256 * ((y_width + 47) / 48 + (AV1D_MAX_TILE_COLS - 1))); \
+	} while (0)
+
+#define SIZE_AV1D_IBC_NV12_UBWC(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 y_width_a = 128, y_height_a = 32; \
+		HFI_U32 uv_width_a = 128, uv_height_a = 32; \
+		HFI_U32 yBufSize, uvBufSize, y_width, y_height, uv_width, uv_height; \
+		HFI_U32 y_meta_width_a = 64, y_meta_height_a = 16; \
+		HFI_U32 uv_meta_width_a = 64, uv_meta_height_a = 16; \
+		HFI_U32 meta_height, meta_stride, meta_size; \
+		HFI_U32 tile_width_y = HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH; \
+		HFI_U32 tile_height_y = HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT; \
+		HFI_U32 tile_width_uv = HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_WIDTH; \
+		HFI_U32 tile_height_uv = \
+		    HFI_COLOR_FORMAT_YUV420_NV12_UBWC_UV_TILE_HEIGHT; \
+		HFI_NV12_IL_CALC_Y_STRIDE(y_width, frame_width, y_width_a); \
+		HFI_NV12_IL_CALC_Y_BUFHEIGHT(y_height, frame_height, y_height_a); \
+		HFI_NV12_IL_CALC_UV_STRIDE(uv_width, frame_width, uv_width_a); \
+		HFI_NV12_IL_CALC_UV_BUFHEIGHT(uv_height, frame_height, uv_height_a); \
+		HFI_NV12_UBWC_IL_CALC_Y_BUF_SIZE(yBufSize, y_width, y_height); \
+		HFI_NV12_UBWC_IL_CALC_UV_BUF_SIZE(uvBufSize, uv_width, uv_height); \
+		_size = yBufSize + uvBufSize; \
+		HFI_UBWC_CALC_METADATA_PLANE_STRIDE(meta_stride, frame_width, \
+							y_meta_width_a, tile_width_y); \
+		HFI_UBWC_METADATA_PLANE_BUFHEIGHT(meta_height, frame_height, \
+							y_meta_height_a, tile_height_y); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size, \
+							meta_stride, meta_height); \
+		_size += meta_size; \
+		HFI_UBWC_UV_METADATA_PLANE_STRIDE(meta_stride, frame_width, \
+						uv_meta_width_a, tile_width_uv); \
+		HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(meta_height, frame_height, \
+						uv_meta_height_a, tile_height_uv); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size, \
+						meta_stride, meta_height); \
+		_size += meta_size; \
+	} while (0)
+
+#define SIZE_AV1D_IBC_TP10_UBWC(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 y_width_a = 256, y_height_a = 16, \
+			uv_width_a = 256, uv_height_a = 16; \
+		HFI_U32 yBufSize, uvBufSize, y_width, y_height, uv_width, uv_height; \
+		HFI_U32 y_meta_width_a = 64, y_meta_height_a = 16, \
+			uv_meta_width_a = 64, uv_meta_height_a = 16; \
+		HFI_U32 meta_height, meta_stride, meta_size; \
+		HFI_U32 tile_width_y = HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_WIDTH; \
+		HFI_U32 tile_height_y = HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_HEIGHT; \
+		HFI_U32 tile_width_uv = HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_WIDTH; \
+		HFI_U32 tile_height_uv = \
+			HFI_COLOR_FORMAT_YUV420_TP10_UBWC_UV_TILE_HEIGHT; \
+		HFI_YUV420_TP10_CALC_Y_STRIDE(y_width, frame_width, y_width_a); \
+		HFI_YUV420_TP10_CALC_Y_BUFHEIGHT(y_height, frame_height, y_height_a); \
+		HFI_YUV420_TP10_CALC_UV_STRIDE(uv_width, frame_width, uv_width_a); \
+		HFI_YUV420_TP10_CALC_UV_BUFHEIGHT(uv_height, frame_height, \
+						uv_height_a); \
+		HFI_YUV420_TP10_UBWC_CALC_Y_BUF_SIZE(yBufSize, y_width, y_height); \
+		HFI_YUV420_TP10_UBWC_CALC_UV_BUF_SIZE(uvBufSize, uv_width, uv_height); \
+		_size = yBufSize + uvBufSize; \
+		HFI_UBWC_CALC_METADATA_PLANE_STRIDE(meta_stride, frame_width, \
+			y_meta_width_a, tile_width_y); \
+		HFI_UBWC_METADATA_PLANE_BUFHEIGHT(meta_height, frame_height, \
+			y_meta_height_a, tile_height_y); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size, \
+			meta_stride, meta_height); \
+		_size += meta_size; \
+		HFI_UBWC_UV_METADATA_PLANE_STRIDE(meta_stride, frame_width, \
+			uv_meta_width_a, tile_width_uv); \
+		HFI_UBWC_UV_METADATA_PLANE_BUFHEIGHT(meta_height, frame_height, \
+			uv_meta_height_a, tile_height_uv); \
+		HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size, \
+			meta_stride, meta_height); \
+		_size += meta_size; \
+	} while (0)
+
+#define HFI_BUFFER_LINE_AV1D(_size, frame_width, frame_height, isOPB, \
+			num_vpp_pipes) \
+	do { \
+		HFI_U32 vpssLBSize, opbwr1BufSize, opbwr8, opbwr10; \
+		_size = HFI_ALIGN(SIZE_AV1D_LB_FE_TOP_DATA(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_FE_TOP_CTRL(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_FE_LEFT_DATA(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_AV1D_LB_FE_LEFT_CTRL(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_AV1D_LB_SE_LEFT_CTRL(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) * num_vpp_pipes + \
+			HFI_ALIGN(SIZE_AV1D_LB_SE_TOP_CTRL(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_PE_TOP_DATA(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_VSP_TOP(frame_width, frame_height), \
+				VENUS_DMA_ALIGNMENT) + \
+			HFI_ALIGN(SIZE_AV1D_LB_RECON_DMA_METADATA_WR(frame_width, \
+				frame_height), \
+			VENUS_DMA_ALIGNMENT) * 2 + \
+			HFI_ALIGN(SIZE_AV1D_QP(frame_width, frame_height), \
+			VENUS_DMA_ALIGNMENT); \
+		SIZE_AV1D_LB_OPB_WR1_NV12_UBWC(opbwr8, frame_width, frame_height); \
+		SIZE_AV1D_LB_OPB_WR1_TP10_UBWC(opbwr10, frame_width, frame_height); \
+		opbwr1BufSize = MAX(opbwr8, opbwr10); \
+		_size = HFI_ALIGN((_size + opbwr1BufSize), VENUS_DMA_ALIGNMENT); \
+		if (isOPB) { \
+			SIZE_VPSS_LB(vpssLBSize, frame_width, frame_height, num_vpp_pipes); \
+			_size = HFI_ALIGN((_size + vpssLBSize), VENUS_DMA_ALIGNMENT); \
+		} \
+	} while (0)
+
+#define HFI_BUFFER_IBC_AV1D(_size, frame_width, frame_height) \
+	do { \
+		HFI_U32 ibc8, ibc10; \
+		SIZE_AV1D_IBC_NV12_UBWC(ibc8, frame_width, frame_height); \
+		SIZE_AV1D_IBC_TP10_UBWC(ibc10, frame_width, frame_height); \
+		_size = HFI_ALIGN(MAX(ibc8, ibc10), VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define AV1_CABAC_HDR_RATIO_HD_TOT 2
+#define AV1_CABAC_RES_RATIO_HD_TOT 2
+/* some content need more bin buffer,
+ * but limit buffer size for high resolution
+ */
+#define SIZE_AV1D_HW_BIN_BUFFER(_size, frame_width, frame_height, delay, \
+				num_vpp_pipes) \
+	do { \
+		HFI_U32 size_yuv, size_bin_hdr, size_bin_res; \
+		size_yuv = ((frame_width * frame_height) <= BIN_BUFFER_THRESHOLD) ? \
+			((BIN_BUFFER_THRESHOLD * 3) >> 1) : \
+			((frame_width * frame_height * 3) >> 1); \
+		size_bin_hdr = size_yuv * AV1_CABAC_HDR_RATIO_HD_TOT; \
+		size_bin_res = size_yuv * AV1_CABAC_RES_RATIO_HD_TOT; \
+		size_bin_hdr = size_bin_hdr * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2; \
+		size_bin_res = size_bin_res * \
+			(((((HFI_U32)(delay)) & 31) / 10) + 2) / 2; \
+		size_bin_hdr = HFI_ALIGN(size_bin_hdr / num_vpp_pipes, \
+					 VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		size_bin_res = HFI_ALIGN(size_bin_res / num_vpp_pipes, \
+					 VENUS_DMA_ALIGNMENT) * num_vpp_pipes; \
+		_size = size_bin_hdr + size_bin_res; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_AV1D(_size, frame_width, frame_height, isInterlaced, \
+				delay, num_vpp_pipes) \
+	do { \
+		HFI_U32 nAlignedW = HFI_ALIGN(frame_width, BUFFER_ALIGNMENT_16_BYTES); \
+		HFI_U32 nAlignedH = HFI_ALIGN(frame_height, BUFFER_ALIGNMENT_16_BYTES); \
+		if (!isInterlaced) { \
+			SIZE_AV1D_HW_BIN_BUFFER(_size, nAlignedW, nAlignedH, \
+						delay, num_vpp_pipes); \
+		} else { \
+			_size = 0; \
+		} \
+	} while (0)
+
+#define AV1D_NUM_HW_PIC_BUF    16
+#define AV1D_NUM_FRAME_HEADERS 16
+
+#define SIZE_AV1D_SEQUENCE_HEADER 768
+#define SIZE_AV1D_METADATA        512
+#define SIZE_AV1D_FRAME_HEADER    1280
+#define SIZE_AV1D_TILE_OFFSET     65536
+#define SIZE_AV1D_QM              3328
+#define SIZE_AV1D_PROB_TABLE      22784
+
+#define AV1D_SIZE_BSE_COL_MV_64x64 512
+#define AV1D_SIZE_BSE_COL_MV_128x128 2816
+#define SIZE_AV1D_COL_MV MAX((((8192 + 63) / 64) * ((4352 + 63) / 64) *        \
+				AV1D_SIZE_BSE_COL_MV_64x64),                   \
+				(((8192 + 127) / 128) * ((4352 + 127) / 128) * \
+				AV1D_SIZE_BSE_COL_MV_128x128))
+
+#define HFI_BUFFER_PERSIST_AV1D(_size, max_width, max_height, total_ref_count) \
+	do { \
+		HFI_U32 comv_size; \
+		HFI_BUFFER_COMV_AV1D(comv_size, max_width, max_height, total_ref_count); \
+		_size = \
+		HFI_ALIGN((SIZE_AV1D_SEQUENCE_HEADER * 2 + \
+		SIZE_AV1D_METADATA + \
+		AV1D_NUM_HW_PIC_BUF * (SIZE_AV1D_TILE_OFFSET + SIZE_AV1D_QM) + \
+		AV1D_NUM_FRAME_HEADERS * (SIZE_AV1D_FRAME_HEADER + \
+		2 * SIZE_AV1D_PROB_TABLE) + \
+		comv_size + HDR10_HIST_EXTRADATA_SIZE + \
+		SIZE_AV1D_METADATA * AV1D_NUM_HW_PIC_BUF), VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define HFI_BUFFER_BITSTREAM_ENC(size, frame_width, frame_height, \
+			rc_type, is_ten_bit) \
+	do { \
+		HFI_U32 aligned_width, aligned_height, bitstream_size, yuv_size; \
+		aligned_width = HFI_ALIGN(frame_width, 32); \
+		aligned_height = HFI_ALIGN(frame_height, 32); \
+		bitstream_size = aligned_width * aligned_height * 3; \
+		yuv_size = (aligned_width * aligned_height * 3) >> 1; \
+		if (aligned_width * aligned_height > (4096 * 2176)) { \
+		    /* bitstream_size = 0.25 * yuv_size; */ \
+			bitstream_size = (bitstream_size >> 3); \
+		} \
+		else if (aligned_width * aligned_height > (1280 * 720)) { \
+		    /* bitstream_size = 0.5 * yuv_size; */ \
+			bitstream_size = (bitstream_size >> 2); \
+		} else { \
+		    /* bitstream_size = 2 * yuv_size; */ \
+		} \
+		if (((rc_type == HFI_RC_CQ) || (rc_type == HFI_RC_OFF)) \
+			&& (bitstream_size < yuv_size))  { \
+			bitstream_size = (bitstream_size << 1);\
+		} \
+		if (is_ten_bit) { \
+			bitstream_size = (bitstream_size) + \
+					(bitstream_size >> 2); \
+		} \
+		size = HFI_ALIGN(bitstream_size, HFI_ALIGNMENT_4096); \
+	} while (0)
+
+#define HFI_IRIS3_ENC_TILE_SIZE_INFO(tile_size, tile_count, last_tile_size, \
+				frame_width_coded, codec_standard, num_vpp_pipes) \
+	do { \
+		HFI_U32 without_tile_enc_width, min_tile_size, fixed_tile_width; \
+		if (num_vpp_pipes == 4) { \
+			min_tile_size = 352; \
+			fixed_tile_width = 960; \
+		} \
+		else if (num_vpp_pipes == 2) { \
+			min_tile_size = 256; \
+			fixed_tile_width = 768; \
+		} \
+		else { \
+			min_tile_size = 256; \
+			fixed_tile_width = 672; \
+		} \
+		without_tile_enc_width = min_tile_size + fixed_tile_width; \
+		if ((codec_standard == HFI_CODEC_ENCODE_HEVC) && \
+			(frame_width_coded > without_tile_enc_width)) { \
+			tile_size = fixed_tile_width; \
+			tile_count = (frame_width_coded + tile_size - 1) / tile_size; \
+			last_tile_size = (frame_width_coded - (tile_size * (tile_count - 1))); \
+			if (last_tile_size < min_tile_size) { \
+				tile_count -= 1; \
+				last_tile_size = (tile_size + min_tile_size); \
+			} \
+		} else { \
+			tile_size = frame_width_coded; \
+			tile_count = 1; \
+			last_tile_size = 0; \
+		} \
+	} while (0)
+
+#define HFI_IRIS3_ENC_MB_BASED_MULTI_SLICE_COUNT(total_slice_count, frame_width, frame_height, \
+			codec_standard, multi_slice_max_mb_count, num_vpp_pipes) \
+	do { \
+		HFI_U32 tile_size, tile_count, last_tile_size, \
+			slice_count_per_tile, slice_count_in_last_tile; \
+		HFI_U32 mbs_in_one_tile, mbs_in_last_tile; \
+		HFI_U32 frame_width_coded, frame_height_coded, lcu_size; \
+		lcu_size = (codec_standard == HFI_CODEC_ENCODE_HEVC) ? 32 : 16; \
+		frame_width_coded = HFI_ALIGN(frame_width, lcu_size); \
+		frame_height_coded = HFI_ALIGN(frame_height, lcu_size); \
+		HFI_IRIS3_ENC_TILE_SIZE_INFO(tile_size, tile_count, last_tile_size, \
+			frame_width_coded, codec_standard, num_vpp_pipes); \
+		mbs_in_one_tile = (tile_size * frame_height_coded) / (lcu_size * lcu_size); \
+		slice_count_per_tile = \
+			(mbs_in_one_tile + multi_slice_max_mb_count - 1) / \
+			(multi_slice_max_mb_count); \
+		if (last_tile_size) { \
+			mbs_in_last_tile = \
+				(last_tile_size * frame_height_coded) / (lcu_size * lcu_size); \
+			slice_count_in_last_tile = \
+				(mbs_in_last_tile + multi_slice_max_mb_count - 1) / \
+				(multi_slice_max_mb_count); \
+			total_slice_count = \
+				(slice_count_per_tile * (tile_count - 1)) + \
+				slice_count_in_last_tile; \
+		} else { \
+			total_slice_count = (slice_count_per_tile * tile_count); \
+		} \
+	} while (0)
+
+#define SIZE_ROI_METADATA_ENC(size_roi, frame_width, frame_height, lcu_size)\
+	do { \
+		HFI_U32 width_in_lcus = 0, height_in_lcus = 0, n_shift = 0;    \
+		HFI_U32 n_lcu_size = lcu_size;              \
+		while (n_lcu_size && !(n_lcu_size & 0x1)) { \
+			n_shift++;                          \
+			n_lcu_size = n_lcu_size >> 1;       \
+		}                                           \
+		width_in_lcus = (frame_width + (lcu_size - 1)) >> n_shift; \
+		height_in_lcus = (frame_height + (lcu_size - 1)) >> n_shift;  \
+		size_roi = (((width_in_lcus + 7) >> 3) << 3) * \
+					height_in_lcus * 2 + 256; \
+	} while (0)
+
+#define HFI_BUFFER_INPUT_METADATA_ENC(size, frame_width, frame_height, \
+				is_roi_enabled, lcu_size) \
+	do { \
+		HFI_U32 roi_size = 0; \
+		if (is_roi_enabled) { \
+			SIZE_ROI_METADATA_ENC(roi_size, frame_width, \
+				frame_height, lcu_size); \
+		} \
+		size = roi_size + 16384; \
+		size = HFI_ALIGN(size, HFI_ALIGNMENT_4096); \
+	} while (0)
+
+#define HFI_BUFFER_INPUT_METADATA_H264E(size_metadata, frame_width, \
+		frame_height, is_roi_enabled)    \
+	do { \
+		HFI_BUFFER_INPUT_METADATA_ENC(size_metadata, frame_width, \
+			frame_height, is_roi_enabled, 16); \
+	} while (0)
+
+#define HFI_BUFFER_INPUT_METADATA_H265E(size_metadata, frame_width, \
+		frame_height, is_roi_enabled)    \
+	do { \
+		HFI_BUFFER_INPUT_METADATA_ENC(size_metadata, frame_width, \
+			frame_height, is_roi_enabled, 32); \
+	} while (0)
+
+#define HFI_BUFFER_ARP_ENC(size) \
+	do { \
+		size = 204800; \
+	} while (0)
+
+#define HFI_MAX_COL_FRAME 6
+#define HFI_VENUS_VENC_TRE_WB_BUFF_SIZE (65 << 4) // bytes
+#define HFI_VENUS_VENC_DB_LINE_BUFF_PER_MB 512
+#define HFI_VENUS_VPPSG_MAX_REGISTERS 2048
+#define HFI_VENUS_WIDTH_ALIGNMENT 128
+#define HFI_VENUS_WIDTH_TEN_BIT_ALIGNMENT 192
+#define HFI_VENUS_HEIGHT_ALIGNMENT 32
+#define VENUS_METADATA_STRIDE_MULTIPLE 64
+#define VENUS_METADATA_HEIGHT_MULTIPLE 16
+
+#ifndef SYSTEM_LAL_TILE10
+#define SYSTEM_LAL_TILE10 192
+#endif
+
+#define HFI_IRIS3_ENC_RECON_BUF_COUNT(num_recon, n_bframe, ltr_count, \
+	_total_hp_layers, _total_hb_layers, hybrid_hp, codec_standard) \
+	do { \
+		HFI_U32 num_ref = 1; \
+		if (n_bframe) \
+			num_ref = 2; \
+		if (_total_hp_layers > 1) { \
+			if (hybrid_hp) \
+				num_ref = (_total_hp_layers + 1) >> 1; \
+			else if (codec_standard == HFI_CODEC_ENCODE_HEVC) \
+				num_ref = (_total_hp_layers + 1) >> 1; \
+			else if (codec_standard == HFI_CODEC_ENCODE_AVC && \
+				_total_hp_layers < 4) \
+				num_ref = (_total_hp_layers - 1);  \
+			else \
+				num_ref = _total_hp_layers; \
+		} \
+		if (ltr_count) \
+			num_ref = num_ref + ltr_count; \
+		if (_total_hb_layers > 1) { \
+			if (codec_standard == HFI_CODEC_ENCODE_HEVC) \
+				num_ref = (_total_hb_layers); \
+			else if (codec_standard == HFI_CODEC_ENCODE_AVC) \
+				num_ref = (1 << (_total_hb_layers - 2)) + 1; \
+		} \
+		num_recon = num_ref + 1; \
+	} while (0)
+
+#define SIZE_BIN_BITSTREAM_ENC(_size, rc_type, frame_width, frame_height, \
+		work_mode, lcu_size, profile) \
+	do { \
+		HFI_U32 size_aligned_width = 0, size_aligned_height = 0; \
+		HFI_U32 bitstream_size_eval = 0; \
+		size_aligned_width = HFI_ALIGN((frame_width), lcu_size); \
+		size_aligned_height = HFI_ALIGN((frame_height), lcu_size); \
+		if (work_mode == HFI_WORKMODE_2) { \
+			if ((rc_type == HFI_RC_CQ) || (rc_type == HFI_RC_OFF)) { \
+				bitstream_size_eval = (((size_aligned_width) * \
+							(size_aligned_height) * 3) >> 1); \
+			} \
+			else { \
+				bitstream_size_eval = ((size_aligned_width) * \
+							(size_aligned_height) * 3); \
+				if (rc_type == HFI_RC_LOSSLESS) { \
+					bitstream_size_eval = (bitstream_size_eval * 3 >> 2); \
+				} \
+				else if ((size_aligned_width * size_aligned_height) > \
+					(4096 * 2176)) { \
+					bitstream_size_eval >>= 3; \
+				} \
+				else if ((size_aligned_width * size_aligned_height) > \
+					(480 * 320)) { \
+					bitstream_size_eval >>= 2; \
+				} \
+				if (profile == HFI_H265_PROFILE_MAIN_10 || \
+					profile == HFI_H265_PROFILE_MAIN_10_STILL_PICTURE) { \
+					bitstream_size_eval = (bitstream_size_eval * 5 >> 2); \
+				} \
+			} \
+		} else { \
+			bitstream_size_eval = size_aligned_width * \
+					size_aligned_height * 3; \
+		} \
+		_size = HFI_ALIGN(bitstream_size_eval, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define SIZE_ENC_SINGLE_PIPE(size, rc_type, bitbin_size, num_vpp_pipes, \
+			frame_width, frame_height, lcu_size) \
+	do { \
+		HFI_U32 size_single_pipe_eval = 0, sao_bin_buffer_size = 0, \
+			_padded_bin_sz = 0; \
+		HFI_U32 size_aligned_width = 0, size_aligned_height = 0; \
+		size_aligned_width = HFI_ALIGN((frame_width), lcu_size); \
+		size_aligned_height = HFI_ALIGN((frame_height), lcu_size); \
+		if ((size_aligned_width * size_aligned_height) > \
+			(3840 * 2160)) { \
+			size_single_pipe_eval = (bitbin_size / num_vpp_pipes); \
+		} \
+		else if (num_vpp_pipes > 2) { \
+			size_single_pipe_eval = bitbin_size / 2; \
+		} else { \
+			size_single_pipe_eval = bitbin_size; \
+		} \
+		if (rc_type == HFI_RC_LOSSLESS) { \
+			size_single_pipe_eval = (size_single_pipe_eval << 1); \
+		} \
+		sao_bin_buffer_size = (64 * ((((frame_width) + \
+				BUFFER_ALIGNMENT_32_BYTES) * ((frame_height) +\
+				BUFFER_ALIGNMENT_32_BYTES)) >> 10)) + 384; \
+		_padded_bin_sz = HFI_ALIGN(size_single_pipe_eval, \
+				VENUS_DMA_ALIGNMENT);\
+		size_single_pipe_eval = sao_bin_buffer_size + _padded_bin_sz; \
+		size_single_pipe_eval = HFI_ALIGN(size_single_pipe_eval, \
+				VENUS_DMA_ALIGNMENT); \
+		size = size_single_pipe_eval; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_ENC(_size, rc_type, frame_width, frame_height, lcu_size, \
+			work_mode, num_vpp_pipes, profile, ring_buf_count) \
+	do { \
+		HFI_U32 bitstream_size = 0, total_bitbin_buffers = 0, \
+			size_single_pipe = 0, bitbin_size = 0; \
+		SIZE_BIN_BITSTREAM_ENC(bitstream_size, rc_type, frame_width, \
+			frame_height, work_mode, lcu_size, profile);         \
+		if (work_mode == HFI_WORKMODE_2) { \
+			total_bitbin_buffers = (ring_buf_count > 3) ? ring_buf_count : 3; \
+			bitbin_size = bitstream_size * 17 / 10; \
+			bitbin_size = HFI_ALIGN(bitbin_size, \
+				VENUS_DMA_ALIGNMENT); \
+		} \
+		else if ((lcu_size == 16) || (num_vpp_pipes > 1)) { \
+			total_bitbin_buffers = 1; \
+			bitbin_size = bitstream_size; \
+		} \
+		if (total_bitbin_buffers > 0) { \
+			SIZE_ENC_SINGLE_PIPE(size_single_pipe, rc_type, bitbin_size, \
+				num_vpp_pipes, frame_width, frame_height, lcu_size); \
+			bitbin_size = size_single_pipe * num_vpp_pipes; \
+			_size = HFI_ALIGN(bitbin_size, VENUS_DMA_ALIGNMENT) * \
+					total_bitbin_buffers + 512; \
+		} \
+		else \
+			/* Avoid 512 Bytes allocation in case of 1Pipe HEVC Direct Mode*/ \
+			_size = 0; \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H264E(_size, rc_type, frame_width, frame_height, \
+			work_mode, num_vpp_pipes, profile, ring_buf_count) \
+	do { \
+		HFI_BUFFER_BIN_ENC(_size, rc_type, frame_width, frame_height, 16, \
+			work_mode, num_vpp_pipes, profile, ring_buf_count); \
+	} while (0)
+
+#define HFI_BUFFER_BIN_H265E(_size, rc_type, frame_width, frame_height, \
+			work_mode, num_vpp_pipes, profile, ring_buf_count)    \
+	do { \
+		HFI_BUFFER_BIN_ENC(_size, rc_type, frame_width, frame_height, 32,\
+			work_mode, num_vpp_pipes, profile, ring_buf_count); \
+	} while (0)
+
+#define SIZE_ENC_SLICE_INFO_BUF(num_lcu_in_frame) HFI_ALIGN((256 + \
+		(num_lcu_in_frame << 4)), VENUS_DMA_ALIGNMENT)
+#define SIZE_LINE_BUF_CTRL(frame_width_coded) \
+		HFI_ALIGN(frame_width_coded, VENUS_DMA_ALIGNMENT)
+#define SIZE_LINE_BUF_CTRL_ID2(frame_width_coded) \
+		HFI_ALIGN(frame_width_coded, VENUS_DMA_ALIGNMENT)
+
+#define SIZE_LINEBUFF_DATA(_size, is_ten_bit, frame_width_coded) \
+	do { \
+		_size = is_ten_bit ? (((((10 * (frame_width_coded) +\
+		 1024) + (VENUS_DMA_ALIGNMENT - 1)) & \
+		 (~(VENUS_DMA_ALIGNMENT - 1))) * 1) + \
+		(((((10 * (frame_width_coded) + 1024) >> 1) + \
+		(VENUS_DMA_ALIGNMENT - 1)) & (~(VENUS_DMA_ALIGNMENT - 1))) * \
+		2)) : (((((8 * (frame_width_coded) + 1024) + \
+		(VENUS_DMA_ALIGNMENT - 1)) \
+		& (~(VENUS_DMA_ALIGNMENT - 1))) * 1) + \
+		(((((8 * (frame_width_coded) +\
+		1024) >> 1) + (VENUS_DMA_ALIGNMENT - 1)) & \
+		(~(VENUS_DMA_ALIGNMENT - 1))) * 2)); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_CTRL(_size, standard, frame_height_coded, \
+				num_vpp_pipes_enc) \
+	do { \
+		_size = (standard == HFI_CODEC_ENCODE_HEVC) ? \
+			(((frame_height_coded) + \
+			(BUF_SIZE_ALIGN_32)) / BUF_SIZE_ALIGN_32 * 4 * 16) : \
+			(((frame_height_coded) + 15) / 16 * 5 * 16); \
+		if ((num_vpp_pipes_enc) > 1) { \
+			_size += BUFFER_ALIGNMENT_512_BYTES; \
+			_size = HFI_ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) *\
+				(num_vpp_pipes_enc); \
+		} \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_RECON_PIX(_size, is_ten_bit, frame_height_coded, \
+				num_vpp_pipes_enc) \
+	do { \
+		_size = (((is_ten_bit + 1) * 2 * (frame_height_coded) + \
+		VENUS_DMA_ALIGNMENT) + \
+		(VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1) & \
+		(~((VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1)) * 1; \
+	} while (0)
+
+#define SIZE_TOP_LINEBUFF_CTRL_FE(_size, frame_width_coded, standard) \
+	do { \
+		_size = (standard == HFI_CODEC_ENCODE_HEVC) ? (64 * \
+		((frame_width_coded) >> 5)) : (VENUS_DMA_ALIGNMENT + 16 * \
+		((frame_width_coded) >> 4)); \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_CTRL_FE(frame_height_coded, num_vpp_pipes_enc) \
+	((((VENUS_DMA_ALIGNMENT + 64 * ((frame_height_coded) >> 4)) +         \
+	   (VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1) &          \
+	  (~((VENUS_DMA_ALIGNMENT << (num_vpp_pipes_enc - 1)) - 1)) * 1) *  \
+	 num_vpp_pipes_enc)
+
+#define SIZE_LEFT_LINEBUFF_METADATA_RECON_Y(_size, frame_height_coded, \
+		is_ten_bit, num_vpp_pipes_enc) \
+	do { \
+		_size = ((VENUS_DMA_ALIGNMENT + 64 * ((frame_height_coded) / \
+		(8 * (is_ten_bit ? 4 : 8)))));   \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+		_size = (_size * num_vpp_pipes_enc); \
+	} while (0)
+
+#define SIZE_LEFT_LINEBUFF_METADATA_RECON_UV(_size, frame_height_coded, \
+			is_ten_bit, num_vpp_pipes_enc) \
+	do { \
+		_size = ((VENUS_DMA_ALIGNMENT + 64 * ((frame_height_coded) / \
+				(4 * (is_ten_bit ? 4 : 8)))));    \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT); \
+		_size = (_size * num_vpp_pipes_enc); \
+	} while (0)
+
+#define SIZE_LINEBUFF_RECON_PIX(_size, is_ten_bit, frame_width_coded) \
+	do   { \
+		_size = ((is_ten_bit ? 3 : 2) * (frame_width_coded));         \
+		_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT);             \
+	} while (0)
+
+#define SIZE_SLICE_CMD_BUFFER (HFI_ALIGN(20480, VENUS_DMA_ALIGNMENT))
+#define SIZE_SPS_PPS_SLICE_HDR (2048 + 4096)
+
+#define SIZE_FRAME_RC_BUF_SIZE(_size, standard, frame_height_coded, \
+			num_vpp_pipes_enc) \
+	do { \
+		_size = (standard == HFI_CODEC_ENCODE_HEVC) ? (256 + 16 * \
+			(14 + ((((frame_height_coded) >> 5) + 7) >> 3))) : \
+			(256 + 16 * (14 + ((((frame_height_coded) >> 4) + 7) >> 3))); \
+		_size *= 11; \
+		if (num_vpp_pipes_enc > 1) { \
+			_size = HFI_ALIGN(_size, VENUS_DMA_ALIGNMENT) * \
+					num_vpp_pipes_enc;\
+		} \
+		_size = HFI_ALIGN(_size, BUFFER_ALIGNMENT_512_BYTES) * \
+				HFI_MAX_COL_FRAME; \
+	} while (0)
+
+#define ENC_BITCNT_BUF_SIZE(num_lcu_in_frame) HFI_ALIGN((256 + \
+		(4 * (num_lcu_in_frame))), VENUS_DMA_ALIGNMENT)
+#define ENC_BITMAP_BUF_SIZE(num_lcu_in_frame) HFI_ALIGN((256 + \
+		((num_lcu_in_frame) >> 3)), VENUS_DMA_ALIGNMENT)
+#define SIZE_LINE_BUF_SDE(frame_width_coded) HFI_ALIGN((256 + \
+		(16 * ((frame_width_coded) >> 4))), VENUS_DMA_ALIGNMENT)
+
+#define SIZE_BSE_SLICE_CMD_BUF ((((8192 << 2) + 7) & (~7)) * 3)
+
+#define SIZE_LAMBDA_LUT (256 * 11)
+#define SIZE_OVERRIDE_BUF(num_lcumb) (HFI_ALIGN(((16 * (((num_lcumb) + 7)\
+		>> 3))), VENUS_DMA_ALIGNMENT) * 2)
+#define SIZE_IR_BUF(num_lcu_in_frame) HFI_ALIGN((((((num_lcu_in_frame) << 1) + 7) &\
+	(~7)) * 3), VENUS_DMA_ALIGNMENT)
+
+#define SIZE_VPSS_LINE_BUF(num_vpp_pipes_enc, frame_height_coded, \
+			frame_width_coded) \
+	(HFI_ALIGN(((((((8192) >> 2) << 5) * (num_vpp_pipes_enc)) + 64) + \
+	(((((MAX((frame_width_coded), (frame_height_coded)) + 3) >> 2) << 5) +\
+	256) * 16)), VENUS_DMA_ALIGNMENT))
+
+#define SIZE_TOP_LINE_BUF_FIRST_STG_SAO(frame_width_coded) \
+	HFI_ALIGN((16 * ((frame_width_coded) >> 5)), VENUS_DMA_ALIGNMENT)
+
+#define HFI_BUFFER_LINE_ENC(_size, frame_width, frame_height, is_ten_bit, \
+			num_vpp_pipes_enc, lcu_size, standard) \
+	do { \
+		HFI_U32 width_in_lcus = 0, height_in_lcus = 0, \
+			frame_width_coded = 0, frame_height_coded = 0; \
+		HFI_U32 line_buff_data_size = 0, left_line_buff_ctrl_size = 0, \
+			left_line_buff_recon_pix_size = 0, \
+			top_line_buff_ctrl_fe_size = 0; \
+		HFI_U32 left_line_buff_metadata_recon__y__size = 0, \
+			left_line_buff_metadata_recon__uv__size = 0, \
+			line_buff_recon_pix_size = 0;          \
+		width_in_lcus = ((frame_width) + (lcu_size)-1) / (lcu_size); \
+		height_in_lcus = ((frame_height) + (lcu_size)-1) / (lcu_size); \
+		frame_width_coded = width_in_lcus * (lcu_size); \
+		frame_height_coded = height_in_lcus * (lcu_size); \
+		SIZE_LINEBUFF_DATA(line_buff_data_size, is_ten_bit, \
+			frame_width_coded);\
+		SIZE_LEFT_LINEBUFF_CTRL(left_line_buff_ctrl_size, standard, \
+			frame_height_coded, num_vpp_pipes_enc); \
+		SIZE_LEFT_LINEBUFF_RECON_PIX(left_line_buff_recon_pix_size, \
+			is_ten_bit, frame_height_coded, num_vpp_pipes_enc); \
+		SIZE_TOP_LINEBUFF_CTRL_FE(top_line_buff_ctrl_fe_size, \
+			frame_width_coded, standard); \
+		SIZE_LEFT_LINEBUFF_METADATA_RECON_Y\
+			(left_line_buff_metadata_recon__y__size, \
+			frame_height_coded, is_ten_bit, num_vpp_pipes_enc); \
+		SIZE_LEFT_LINEBUFF_METADATA_RECON_UV\
+			(left_line_buff_metadata_recon__uv__size, \
+			frame_height_coded, is_ten_bit, num_vpp_pipes_enc); \
+		SIZE_LINEBUFF_RECON_PIX(line_buff_recon_pix_size, is_ten_bit,\
+			frame_width_coded); \
+		_size = SIZE_LINE_BUF_CTRL(frame_width_coded) + \
+			SIZE_LINE_BUF_CTRL_ID2(frame_width_coded) + \
+			line_buff_data_size + \
+			left_line_buff_ctrl_size + \
+			left_line_buff_recon_pix_size + \
+			top_line_buff_ctrl_fe_size + \
+			left_line_buff_metadata_recon__y__size + \
+			left_line_buff_metadata_recon__uv__size + \
+			line_buff_recon_pix_size + \
+		SIZE_LEFT_LINEBUFF_CTRL_FE(frame_height_coded, \
+			num_vpp_pipes_enc) + SIZE_LINE_BUF_SDE(frame_width_coded) + \
+		SIZE_VPSS_LINE_BUF(num_vpp_pipes_enc, frame_height_coded, \
+			frame_width_coded) + \
+		SIZE_TOP_LINE_BUF_FIRST_STG_SAO(frame_width_coded); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H264E(_size, frame_width, frame_height, is_ten_bit, \
+		num_vpp_pipes)                   \
+	do { \
+		HFI_BUFFER_LINE_ENC(_size, frame_width, frame_height, 0, \
+			num_vpp_pipes, 16, HFI_CODEC_ENCODE_AVC); \
+	} while (0)
+
+#define HFI_BUFFER_LINE_H265E(_size, frame_width, frame_height, is_ten_bit, \
+			num_vpp_pipes)                          \
+	do { \
+		HFI_BUFFER_LINE_ENC(_size, frame_width, frame_height, \
+		is_ten_bit, num_vpp_pipes, 32, HFI_CODEC_ENCODE_HEVC); \
+	} while (0)
+
+#define HFI_BUFFER_COMV_ENC(_size, frame_width, frame_height, lcu_size, \
+			num_recon, standard) \
+	do { \
+		HFI_U32 size_colloc_mv = 0, size_colloc_rc = 0; \
+		HFI_U32 mb_width = ((frame_width) + 15) >> 4; \
+		HFI_U32 mb_height = ((frame_height) + 15) >> 4; \
+		HFI_U32 width_in_lcus = ((frame_width) + (lcu_size)-1) /\
+					(lcu_size); \
+		HFI_U32 height_in_lcus = ((frame_height) + (lcu_size)-1) / \
+					(lcu_size); \
+		HFI_U32 num_lcu_in_frame = width_in_lcus * height_in_lcus; \
+		size_colloc_mv = (standard == HFI_CODEC_ENCODE_HEVC) ? \
+		(16 * ((num_lcu_in_frame << 2) + BUFFER_ALIGNMENT_32_BYTES)) : \
+		(3 * 16 * (width_in_lcus * height_in_lcus +\
+		BUFFER_ALIGNMENT_32_BYTES)); \
+		size_colloc_mv = HFI_ALIGN(size_colloc_mv, \
+		VENUS_DMA_ALIGNMENT) * num_recon; \
+		size_colloc_rc = (((mb_width + 7) >> 3) * 16 * 2 * mb_height); \
+		size_colloc_rc = HFI_ALIGN(size_colloc_rc, \
+		VENUS_DMA_ALIGNMENT) * HFI_MAX_COL_FRAME; \
+		_size = size_colloc_mv + size_colloc_rc; \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H264E(_size, frame_width, frame_height, num_recon) \
+	do { \
+		HFI_BUFFER_COMV_ENC(_size, frame_width, frame_height, 16, \
+			num_recon, HFI_CODEC_ENCODE_AVC); \
+	} while (0)
+
+#define HFI_BUFFER_COMV_H265E(_size, frame_width, frame_height, num_recon) \
+	do { \
+		HFI_BUFFER_COMV_ENC(_size, frame_width, frame_height, 32,\
+			num_recon, HFI_CODEC_ENCODE_HEVC); \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_ENC(_size, frame_width, frame_height, \
+			num_vpp_pipes_enc, lcu_size, standard) \
+	do { \
+		HFI_U32 width_in_lcus = 0, height_in_lcus = 0, \
+		frame_width_coded = 0, frame_height_coded = 0, \
+		num_lcu_in_frame = 0, num_lcumb = 0; \
+		HFI_U32	frame_rc_buf_size = 0; \
+		width_in_lcus = ((frame_width) + (lcu_size)-1) / (lcu_size); \
+		height_in_lcus = ((frame_height) + (lcu_size)-1) / (lcu_size); \
+		num_lcu_in_frame = width_in_lcus * height_in_lcus; \
+		frame_width_coded = width_in_lcus * (lcu_size); \
+		frame_height_coded = height_in_lcus * (lcu_size); \
+		num_lcumb = (frame_height_coded / lcu_size) * \
+		((frame_width_coded + lcu_size * 8) / lcu_size); \
+		SIZE_FRAME_RC_BUF_SIZE(frame_rc_buf_size, standard, \
+		frame_height_coded, num_vpp_pipes_enc); \
+		_size = SIZE_ENC_SLICE_INFO_BUF(num_lcu_in_frame) + \
+			   SIZE_SLICE_CMD_BUFFER + \
+			   SIZE_SPS_PPS_SLICE_HDR + \
+			   frame_rc_buf_size + \
+			   ENC_BITCNT_BUF_SIZE(num_lcu_in_frame) + \
+			   ENC_BITMAP_BUF_SIZE(num_lcu_in_frame) + \
+			   SIZE_BSE_SLICE_CMD_BUF + \
+			   SIZE_LAMBDA_LUT + \
+			   SIZE_OVERRIDE_BUF(num_lcumb) + \
+			   SIZE_IR_BUF(num_lcu_in_frame); \
+	} while (0)
+
+#define HFI_BUFFER_NON_COMV_H264E(_size, frame_width, frame_height, \
+				num_vpp_pipes_enc) \
+	do { \
+		HFI_BUFFER_NON_COMV_ENC(_size, frame_width, frame_height, \
+				num_vpp_pipes_enc, 16, HFI_CODEC_ENCODE_AVC); \
+	} while (0)
+
+#define SIZE_ONE_SLICE_BUF 256
+#define HFI_BUFFER_NON_COMV_H265E(_size, frame_width, frame_height, \
+				num_vpp_pipes_enc) \
+	do { \
+		HFI_BUFFER_NON_COMV_ENC(_size, frame_width, frame_height, \
+			num_vpp_pipes_enc, 32, HFI_CODEC_ENCODE_HEVC); \
+		_size += SIZE_ONE_SLICE_BUF; \
+	} while (0)
+
+#define SIZE_ENC_REF_BUFFER(size, frame_width, frame_height) \
+	do { \
+		HFI_U32 u_buffer_width = 0, u_buffer_height = 0, \
+			u_chroma_buffer_height = 0; \
+		u_buffer_height = HFI_ALIGN(frame_height, \
+			HFI_VENUS_HEIGHT_ALIGNMENT); \
+		u_chroma_buffer_height = frame_height >> 1; \
+		u_chroma_buffer_height = HFI_ALIGN(u_chroma_buffer_height, \
+			HFI_VENUS_HEIGHT_ALIGNMENT); \
+		u_buffer_width = HFI_ALIGN(frame_width, \
+			HFI_VENUS_WIDTH_ALIGNMENT); \
+		size = (u_buffer_height + u_chroma_buffer_height) * \
+			u_buffer_width; \
+	} while (0)
+
+#define SIZE_ENC_TEN_BIT_REF_BUFFER(size, frame_width, frame_height) \
+	do { \
+		HFI_U32 ref_buf_height = 0, ref_luma_stride_in_bytes = 0, \
+		u_ref_stride = 0, luma_size = 0, ref_chrm_height_in_bytes = 0, \
+		chroma_size = 0, ref_buf_size = 0; \
+		ref_buf_height = (frame_height + \
+		(HFI_VENUS_HEIGHT_ALIGNMENT - 1)) \
+		& (~(HFI_VENUS_HEIGHT_ALIGNMENT - 1)); \
+		ref_luma_stride_in_bytes = ((frame_width + \
+		SYSTEM_LAL_TILE10 - 1) / SYSTEM_LAL_TILE10) * \
+		SYSTEM_LAL_TILE10; \
+		u_ref_stride = 4 * (ref_luma_stride_in_bytes / 3); \
+		u_ref_stride = (u_ref_stride + (BUF_SIZE_ALIGN_128 - 1)) &\
+			(~(BUF_SIZE_ALIGN_128 - 1)); \
+		luma_size = ref_buf_height * u_ref_stride; \
+		ref_chrm_height_in_bytes = (((frame_height + 1) >> 1) + \
+			(BUF_SIZE_ALIGN_32 - 1)) & (~(BUF_SIZE_ALIGN_32 - 1)); \
+		chroma_size = u_ref_stride * ref_chrm_height_in_bytes; \
+		luma_size = (luma_size + (BUF_SIZE_ALIGN_4096 - 1)) & \
+			(~(BUF_SIZE_ALIGN_4096 - 1)); \
+		chroma_size = (chroma_size + (BUF_SIZE_ALIGN_4096 - 1)) & \
+			(~(BUF_SIZE_ALIGN_4096 - 1)); \
+		ref_buf_size = luma_size + chroma_size; \
+		size = ref_buf_size; \
+	} while (0)
+
+#define HFI_BUFFER_DPB_ENC(_size, frame_width, frame_height, is_ten_bit) \
+	do { \
+		HFI_U32 metadata_stride, metadata_buf_height, meta_size_y, \
+			meta_size_c; \
+		HFI_U32 ten_bit_ref_buf_size = 0, ref_buf_size = 0; \
+		if (!is_ten_bit) { \
+			SIZE_ENC_REF_BUFFER(ref_buf_size, frame_width, \
+				frame_height); \
+			HFI_UBWC_CALC_METADATA_PLANE_STRIDE(metadata_stride, \
+				(frame_width), 64, \
+				HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_WIDTH); \
+			HFI_UBWC_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, \
+				(frame_height), 16, \
+				HFI_COLOR_FORMAT_YUV420_NV12_UBWC_Y_TILE_HEIGHT); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_y, \
+				metadata_stride, metadata_buf_height); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_c, \
+				metadata_stride, metadata_buf_height); \
+			_size = ref_buf_size + meta_size_y + meta_size_c; \
+		} else { \
+			SIZE_ENC_TEN_BIT_REF_BUFFER(ten_bit_ref_buf_size, \
+				frame_width, frame_height); \
+			HFI_UBWC_CALC_METADATA_PLANE_STRIDE(metadata_stride, \
+				frame_width, VENUS_METADATA_STRIDE_MULTIPLE, \
+			HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_WIDTH); \
+			HFI_UBWC_METADATA_PLANE_BUFHEIGHT(metadata_buf_height, \
+				frame_height, VENUS_METADATA_HEIGHT_MULTIPLE, \
+			HFI_COLOR_FORMAT_YUV420_TP10_UBWC_Y_TILE_HEIGHT); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_y, \
+				metadata_stride, metadata_buf_height); \
+			HFI_UBWC_METADATA_PLANE_BUFFER_SIZE(meta_size_c, \
+				metadata_stride, metadata_buf_height); \
+			_size = ten_bit_ref_buf_size + meta_size_y + \
+				meta_size_c; \
+		} \
+	} while (0)
+
+#define HFI_BUFFER_DPB_H264E(_size, frame_width, frame_height) \
+	do { \
+		HFI_BUFFER_DPB_ENC(_size, frame_width, frame_height, 0); \
+	} while (0)
+
+#define HFI_BUFFER_DPB_H265E(_size, frame_width, frame_height, is_ten_bit) \
+	do { \
+		HFI_BUFFER_DPB_ENC(_size, frame_width, frame_height, is_ten_bit); \
+	} while (0)
+
+#define HFI_BUFFER_VPSS_ENC(vpss_size, dswidth, dsheight, ds_enable, blur, is_ten_bit) \
+	do { \
+		vpss_size = 0; \
+		if (ds_enable || blur) { \
+			HFI_BUFFER_DPB_ENC(vpss_size, dswidth, dsheight, is_ten_bit); \
+		} \
+	} while (0)
+
+#define HFI_IRIS3_ENC_MIN_INPUT_BUF_COUNT(numInput, TotalHBLayers) \
+	do { \
+		numInput = 3;                                             \
+		if (TotalHBLayers >= 2) { \
+			numInput = (1 << (TotalHBLayers - 1)) + 2;        \
+		}                                                         \
+	} while (0)
+
+#endif /* __HFI_BUFFER_IRIS3_3__ */
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris33/inc/msm_vidc_buffer_iris33.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris33/inc/msm_vidc_buffer_iris33.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_MSM_VIDC_BUFFER_IRIS3_3_H__
+#define __H_MSM_VIDC_BUFFER_IRIS3_3_H__
+
+#include "msm_vidc_inst.h"
+
+int msm_buffer_size_iris33(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type);
+int msm_buffer_min_count_iris33(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type);
+int msm_buffer_extra_count_iris33(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type);
+
+#endif // __H_MSM_VIDC_BUFFER_IRIS3_3_H__
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris33/inc/msm_vidc_iris33.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris33/inc/msm_vidc_iris33.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_IRIS3_3_H_
+#define _MSM_VIDC_IRIS3_3_H_
+
+#include "msm_vidc_core.h"
+
+#if defined(CONFIG_MSM_VIDC_PINEAPPLE)
+int msm_vidc_init_iris33(struct msm_vidc_core *core);
+int msm_vidc_adjust_bitrate_boost_iris33(void *instance, struct v4l2_ctrl *ctrl);
+#else
+static inline int msm_vidc_init_iris33(struct msm_vidc_core *core)
+{
+	return -EINVAL;
+}
+
+static inline int msm_vidc_adjust_bitrate_boost_iris33(void *instance, struct v4l2_ctrl *ctrl)
+{
+	return -EINVAL;
+}
+#endif
+
+#endif // _MSM_VIDC_IRIS3_3_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris33/inc/msm_vidc_power_iris33.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris33/inc/msm_vidc_power_iris33.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_MSM_VIDC_POWER_IRIS3_3_H__
+#define __H_MSM_VIDC_POWER_IRIS3_3_H__
+
+#include "msm_vidc_inst.h"
+#include "msm_vidc_power.h"
+
+#define ENABLE_LEGACY_POWER_CALCULATIONS  0
+
+int msm_vidc_ring_buf_count_iris33(struct msm_vidc_inst *inst, u32 data_size);
+u64 msm_vidc_calc_freq_iris33(struct msm_vidc_inst *inst, u32 data_size);
+int msm_vidc_calc_bw_iris33(struct msm_vidc_inst *inst,
+		struct vidc_bus_vote_data *vote_data);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris33/src/msm_vidc_buffer_iris33.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris33/src/msm_vidc_buffer_iris33.c
@@ -0,0 +1,743 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_buffer_iris33.h"
+#include "msm_vidc_buffer.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_debug.h"
+#include "msm_media_info.h"
+#include "msm_vidc_platform.h"
+#include "hfi_property.h"
+#include "hfi_buffer_iris33.h"
+
+static u32 msm_vidc_decoder_bin_size_iris33(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes;
+	struct v4l2_format *f;
+	bool is_interlaced;
+	u32 vpp_delay;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	if (inst->decode_vpp_delay.enable)
+		vpp_delay = inst->decode_vpp_delay.size;
+	else
+		vpp_delay = DEFAULT_BSE_VPP_DELAY;
+	if (inst->capabilities[CODED_FRAMES].value ==
+			CODED_FRAMES_PROGRESSIVE)
+		is_interlaced = false;
+	else
+		is_interlaced = true;
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_BIN_H264D(size, width, height,
+			is_interlaced, vpp_delay, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_BIN_H265D(size, width, height,
+			0, vpp_delay, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_VP9)
+		HFI_BUFFER_BIN_VP9D(size, width, height,
+			0, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_AV1)
+		HFI_BUFFER_BIN_AV1D(size, width, height, is_interlaced,
+			0, num_vpp_pipes);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_comv_size_iris33(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, num_comv, vpp_delay;
+	struct v4l2_format *f;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_AV1) {
+		/*
+		 * AV1 requires larger COMV buffer size to meet performance
+		 * for certain use cases. Increase the COMV buffer size by
+		 * increasing COMV bufcount. Use lower count for 8k to
+		 * achieve performance but save memory.
+		 */
+		if (res_is_greater_than(width, height, 4096, 2176))
+			num_comv = inst->fw_min_count ?
+				inst->fw_min_count + 3 : inst->buffers.output.min_count + 3;
+		else
+			num_comv = inst->fw_min_count ?
+				inst->fw_min_count + 7 : inst->buffers.output.min_count + 7;
+	} else {
+		num_comv = inst->buffers.output.min_count;
+	}
+	msm_vidc_update_cap_value(inst, NUM_COMV, num_comv, __func__);
+
+	if (inst->codec == MSM_VIDC_HEIC
+		&& is_thumbnail_session(inst)) {
+		vpp_delay = 0;
+	} else {
+		if (inst->decode_vpp_delay.enable)
+			vpp_delay = inst->decode_vpp_delay.size;
+		else
+			vpp_delay = DEFAULT_BSE_VPP_DELAY;
+	}
+
+	num_comv = max(vpp_delay + 1, num_comv);
+	if (inst->codec == MSM_VIDC_H264) {
+		HFI_BUFFER_COMV_H264D(size, width, height, num_comv);
+	} else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC) {
+		HFI_BUFFER_COMV_H265D(size, width, height, num_comv);
+	} else if (inst->codec == MSM_VIDC_AV1) {
+		/*
+		 * When DRAP is enabled, COMV buffer is part of PERSIST buffer and
+		 * should not be allocated separately.
+		 * When DRAP is disabled, COMV buffer must be allocated.
+		 */
+		if (inst->capabilities[DRAP].value)
+			size = 0;
+		else
+			HFI_BUFFER_COMV_AV1D(size, width, height, num_comv);
+	}
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_non_comv_size_iris33(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes;
+	struct msm_vidc_core *core;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_NON_COMV_H264D(size, width, height, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_NON_COMV_H265D(size, width, height, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_line_size_iris33(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, out_min_count, num_vpp_pipes, vpp_delay;
+	struct v4l2_format *f;
+	bool is_opb;
+	u32 color_fmt;
+
+	core = inst->core;
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+
+	color_fmt = v4l2_colorformat_to_driver(inst,
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+	if (is_linear_colorformat(color_fmt))
+		is_opb = true;
+	else
+		is_opb = false;
+	/*
+	 * assume worst case, since color format is unknown at this
+	 * time.
+	 */
+	is_opb = true;
+
+	if (inst->decode_vpp_delay.enable)
+		vpp_delay = inst->decode_vpp_delay.size;
+	else
+		vpp_delay = DEFAULT_BSE_VPP_DELAY;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	out_min_count = inst->buffers.output.min_count;
+	out_min_count = max(vpp_delay + 1, out_min_count);
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_LINE_H264D(size, width, height, is_opb,
+			num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_LINE_H265D(size, width, height, is_opb,
+			num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_VP9)
+		HFI_BUFFER_LINE_VP9D(size, width, height, out_min_count,
+			is_opb, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_AV1)
+		HFI_BUFFER_LINE_AV1D(size, width, height, is_opb,
+			num_vpp_pipes);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_partial_data_size_iris33(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height;
+	struct v4l2_format *f;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_AV1)
+		HFI_BUFFER_IBC_AV1D(size, width, height);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_persist_size_iris33(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 rpu_enabled = 0;
+
+	if (inst->capabilities[META_DOLBY_RPU].value)
+		rpu_enabled = 1;
+
+	if (inst->codec == MSM_VIDC_H264) {
+		HFI_BUFFER_PERSIST_H264D(size, rpu_enabled);
+	} else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC) {
+		HFI_BUFFER_PERSIST_H265D(size, rpu_enabled);
+	} else if (inst->codec == MSM_VIDC_VP9) {
+		HFI_BUFFER_PERSIST_VP9D(size);
+	} else if (inst->codec == MSM_VIDC_AV1) {
+		/*
+		 * When DRAP is enabled, COMV buffer is part of PERSIST buffer and
+		 * should not be allocated separately. PERSIST buffer should include
+		 * COMV buffer calculated with width, height, refcount.
+		 * When DRAP is disabled, COMV buffer should not be included in PERSIST
+		 * buffer.
+		 */
+		if (inst->capabilities[DRAP].value)
+			HFI_BUFFER_PERSIST_AV1D(size,
+				inst->capabilities[FRAME_WIDTH].max,
+				inst->capabilities[FRAME_HEIGHT].max, 16);
+		else
+			HFI_BUFFER_PERSIST_AV1D(size, 0, 0, 0);
+	}
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_decoder_dpb_size_iris33(struct msm_vidc_inst *inst)
+{
+
+	u32 size = 0;
+	u32 color_fmt;
+	u32 width, height;
+	u32 interlace = 0;
+	struct v4l2_format *f;
+
+	/*
+	 * For legacy codecs (non-AV1), DPB is calculated only
+	 * for linear formats. For AV1, DPB is needed for film-grain
+	 * enabled bitstreams (UBWC & linear).
+	 */
+	color_fmt = inst->capabilities[PIX_FMTS].value;
+	if (!is_linear_colorformat(color_fmt)) {
+		if (inst->codec != MSM_VIDC_AV1)
+			return size;
+
+		if (inst->codec == MSM_VIDC_AV1 &&
+			!inst->capabilities[FILM_GRAIN].value)
+			return size;
+	}
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+
+	if (inst->codec == MSM_VIDC_H264 &&
+		res_is_less_than_or_equal_to(width, height, 1920, 1088))
+		interlace = 1;
+
+	if (color_fmt == MSM_VIDC_FMT_NV12 ||
+		color_fmt == MSM_VIDC_FMT_NV12C) {
+		color_fmt = MSM_VIDC_FMT_NV12C;
+		HFI_NV12_UBWC_IL_CALC_BUF_SIZE_V2(size, width, height,
+			video_y_stride_bytes(color_fmt, width),
+			video_y_scanlines(color_fmt, height),
+			video_uv_stride_bytes(color_fmt, width),
+			video_uv_scanlines(color_fmt, height),
+			video_y_meta_stride(color_fmt, width),
+			video_y_meta_scanlines(color_fmt, height),
+			video_uv_meta_stride(color_fmt, width),
+			video_uv_meta_scanlines(color_fmt, height),
+			interlace);
+	} else if (color_fmt == MSM_VIDC_FMT_P010 ||
+		color_fmt == MSM_VIDC_FMT_TP10C) {
+		color_fmt = MSM_VIDC_FMT_TP10C;
+		HFI_YUV420_TP10_UBWC_CALC_BUF_SIZE(size,
+			video_y_stride_bytes(color_fmt, width),
+			video_y_scanlines(color_fmt, height),
+			video_uv_stride_bytes(color_fmt, width),
+			video_uv_scanlines(color_fmt, height),
+			video_y_meta_stride(color_fmt, width),
+			video_y_meta_scanlines(color_fmt, height),
+			video_uv_meta_stride(color_fmt, width),
+			video_uv_meta_scanlines(color_fmt, height));
+	}
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+/* encoder internal buffers */
+static u32 msm_vidc_encoder_bin_size_iris33(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes, stage, profile, ring_buf_count;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	stage = inst->capabilities[STAGE].value;
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	profile = inst->capabilities[PROFILE].value;
+	ring_buf_count = inst->capabilities[ENC_RING_BUFFER_COUNT].value;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_BIN_H264E(size, inst->hfi_rc_type, width,
+			height, stage, num_vpp_pipes, profile, ring_buf_count);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_BIN_H265E(size, inst->hfi_rc_type, width,
+			height, stage, num_vpp_pipes, profile, ring_buf_count);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_get_recon_buf_count(struct msm_vidc_inst *inst)
+{
+	u32 num_buf_recon = 0;
+	s32 n_bframe, ltr_count, hp_layers = 0, hb_layers = 0;
+	bool is_hybrid_hp = false;
+	u32 hfi_codec = 0;
+
+	n_bframe = inst->capabilities[B_FRAME].value;
+	ltr_count = inst->capabilities[LTR_COUNT].value;
+
+	if (inst->hfi_layer_type == HFI_HIER_B) {
+		hb_layers = inst->capabilities[ENH_LAYER_COUNT].value + 1;
+	} else {
+		hp_layers = inst->capabilities[ENH_LAYER_COUNT].value + 1;
+		if (inst->hfi_layer_type == HFI_HIER_P_HYBRID_LTR)
+			is_hybrid_hp = true;
+	}
+
+	if (inst->codec == MSM_VIDC_H264)
+		hfi_codec = HFI_CODEC_ENCODE_AVC;
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		hfi_codec = HFI_CODEC_ENCODE_HEVC;
+
+	HFI_IRIS3_ENC_RECON_BUF_COUNT(num_buf_recon, n_bframe, ltr_count,
+			hp_layers, hb_layers, is_hybrid_hp, hfi_codec);
+
+	return num_buf_recon;
+}
+
+static u32 msm_vidc_encoder_comv_size_iris33(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, num_recon = 0;
+	struct v4l2_format *f;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	num_recon = msm_vidc_get_recon_buf_count(inst);
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_COMV_H264E(size, width, height, num_recon);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_COMV_H265E(size, width, height, num_recon);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_non_comv_size_iris33(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, num_vpp_pipes;
+	struct v4l2_format *f;
+
+	core = inst->core;
+
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_NON_COMV_H264E(size, width, height, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_NON_COMV_H265E(size, width, height, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_line_size_iris33(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 size = 0;
+	u32 width, height, pixfmt, num_vpp_pipes;
+	bool is_tenbit = false;
+	struct v4l2_format *f;
+
+	core = inst->core;
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	pixfmt = inst->capabilities[PIX_FMTS].value;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	is_tenbit = (pixfmt == MSM_VIDC_FMT_P010 || pixfmt == MSM_VIDC_FMT_TP10C);
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_LINE_H264E(size, width, height, is_tenbit, num_vpp_pipes);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_LINE_H265E(size, width, height, is_tenbit, num_vpp_pipes);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_dpb_size_iris33(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 width, height, pixfmt;
+	struct v4l2_format *f;
+	bool is_tenbit;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	pixfmt = inst->capabilities[PIX_FMTS].value;
+	is_tenbit = (pixfmt == MSM_VIDC_FMT_P010 || pixfmt == MSM_VIDC_FMT_TP10C);
+
+	if (inst->codec == MSM_VIDC_H264)
+		HFI_BUFFER_DPB_H264E(size, width, height);
+	else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC)
+		HFI_BUFFER_DPB_H265E(size, width, height, is_tenbit);
+
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_arp_size_iris33(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+
+	HFI_BUFFER_ARP_ENC(size);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_vpss_size_iris33(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	bool ds_enable = false, is_tenbit = false, blur = false;
+	u32 rotation_val = HFI_ROTATION_NONE;
+	u32 width, height, driver_colorfmt;
+	struct v4l2_format *f;
+
+	ds_enable = is_scaling_enabled(inst);
+	msm_vidc_v4l2_to_hfi_enum(inst, ROTATION, &rotation_val);
+
+	f = &inst->fmts[OUTPUT_PORT];
+	if (is_rotation_90_or_270(inst)) {
+		/*
+		 * output width and height are rotated,
+		 * so unrotate them to use as arguments to
+		 * HFI_BUFFER_VPSS_ENC.
+		 */
+		width = f->fmt.pix_mp.height;
+		height = f->fmt.pix_mp.width;
+	} else {
+		width = f->fmt.pix_mp.width;
+		height = f->fmt.pix_mp.height;
+	}
+
+	f = &inst->fmts[INPUT_PORT];
+	driver_colorfmt = v4l2_colorformat_to_driver(inst,
+			f->fmt.pix_mp.pixelformat, __func__);
+	is_tenbit = is_10bit_colorformat(driver_colorfmt);
+	if (inst->capabilities[BLUR_TYPES].value != MSM_VIDC_BLUR_NONE)
+		blur = true;
+
+	HFI_BUFFER_VPSS_ENC(size, width, height, ds_enable, blur, is_tenbit);
+	i_vpr_l(inst, "%s: size %d\n", __func__, size);
+	return size;
+}
+
+static u32 msm_vidc_encoder_output_size_iris33(struct msm_vidc_inst *inst)
+{
+	u32 frame_size;
+	struct v4l2_format *f;
+	bool is_ten_bit = false;
+	int bitrate_mode, frame_rc;
+	u32 hfi_rc_type = HFI_RC_VBR_CFR;
+	enum msm_vidc_codec_type codec;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	codec = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+	if (codec == MSM_VIDC_HEVC || codec == MSM_VIDC_HEIC)
+		is_ten_bit = true;
+
+	bitrate_mode = inst->capabilities[BITRATE_MODE].value;
+	frame_rc = inst->capabilities[FRAME_RC_ENABLE].value;
+	if (!frame_rc && !is_image_session(inst))
+		hfi_rc_type = HFI_RC_OFF;
+	else if (bitrate_mode == V4L2_MPEG_VIDEO_BITRATE_MODE_CQ)
+		hfi_rc_type = HFI_RC_CQ;
+
+	HFI_BUFFER_BITSTREAM_ENC(frame_size, f->fmt.pix_mp.width,
+		f->fmt.pix_mp.height, hfi_rc_type, is_ten_bit);
+
+	frame_size = msm_vidc_enc_delivery_mode_based_output_buf_size(inst, frame_size);
+
+	return frame_size;
+}
+
+struct msm_vidc_buf_type_handle {
+	enum msm_vidc_buffer_type type;
+	u32 (*handle)(struct msm_vidc_inst *inst);
+};
+
+int msm_buffer_size_iris33(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int i;
+	u32 size = 0, buf_type_handle_size = 0;
+	const struct msm_vidc_buf_type_handle *buf_type_handle_arr = NULL;
+	static const struct msm_vidc_buf_type_handle dec_buf_type_handle[] = {
+		{MSM_VIDC_BUF_INPUT,           msm_vidc_decoder_input_size              },
+		{MSM_VIDC_BUF_OUTPUT,          msm_vidc_decoder_output_size             },
+		{MSM_VIDC_BUF_INPUT_META,      msm_vidc_decoder_input_meta_size         },
+		{MSM_VIDC_BUF_OUTPUT_META,     msm_vidc_decoder_output_meta_size        },
+		{MSM_VIDC_BUF_BIN,             msm_vidc_decoder_bin_size_iris33         },
+		{MSM_VIDC_BUF_COMV,            msm_vidc_decoder_comv_size_iris33        },
+		{MSM_VIDC_BUF_NON_COMV,        msm_vidc_decoder_non_comv_size_iris33    },
+		{MSM_VIDC_BUF_LINE,            msm_vidc_decoder_line_size_iris33        },
+		{MSM_VIDC_BUF_PERSIST,         msm_vidc_decoder_persist_size_iris33     },
+		{MSM_VIDC_BUF_DPB,             msm_vidc_decoder_dpb_size_iris33         },
+		{MSM_VIDC_BUF_PARTIAL_DATA,    msm_vidc_decoder_partial_data_size_iris33 },
+	};
+	static const struct msm_vidc_buf_type_handle enc_buf_type_handle[] = {
+		{MSM_VIDC_BUF_INPUT,           msm_vidc_encoder_input_size              },
+		{MSM_VIDC_BUF_OUTPUT,          msm_vidc_encoder_output_size_iris33      },
+		{MSM_VIDC_BUF_INPUT_META,      msm_vidc_encoder_input_meta_size         },
+		{MSM_VIDC_BUF_OUTPUT_META,     msm_vidc_encoder_output_meta_size        },
+		{MSM_VIDC_BUF_BIN,             msm_vidc_encoder_bin_size_iris33         },
+		{MSM_VIDC_BUF_COMV,            msm_vidc_encoder_comv_size_iris33        },
+		{MSM_VIDC_BUF_NON_COMV,        msm_vidc_encoder_non_comv_size_iris33    },
+		{MSM_VIDC_BUF_LINE,            msm_vidc_encoder_line_size_iris33        },
+		{MSM_VIDC_BUF_DPB,             msm_vidc_encoder_dpb_size_iris33         },
+		{MSM_VIDC_BUF_ARP,             msm_vidc_encoder_arp_size_iris33         },
+		{MSM_VIDC_BUF_VPSS,            msm_vidc_encoder_vpss_size_iris33        },
+	};
+
+	if (is_decode_session(inst)) {
+		buf_type_handle_size = ARRAY_SIZE(dec_buf_type_handle);
+		buf_type_handle_arr = dec_buf_type_handle;
+	} else if (is_encode_session(inst)) {
+		buf_type_handle_size = ARRAY_SIZE(enc_buf_type_handle);
+		buf_type_handle_arr = enc_buf_type_handle;
+	}
+
+	/* handle invalid session */
+	if (!buf_type_handle_arr || !buf_type_handle_size) {
+		i_vpr_e(inst, "%s: invalid session %d\n", __func__, inst->domain);
+		return size;
+	}
+
+	/* fetch buffer size */
+	for (i = 0; i < buf_type_handle_size; i++) {
+		if (buf_type_handle_arr[i].type == buffer_type) {
+			size = buf_type_handle_arr[i].handle(inst);
+			break;
+		}
+	}
+
+	/* handle unknown buffer type */
+	if (i == buf_type_handle_size) {
+		i_vpr_e(inst, "%s: unknown buffer type %#x\n", __func__, buffer_type);
+		goto exit;
+	}
+
+	i_vpr_l(inst, "buffer_size: type: %11s,  size: %9u\n", buf_name(buffer_type), size);
+
+exit:
+	return size;
+}
+
+static int msm_vidc_input_min_count_iris33(struct msm_vidc_inst *inst)
+{
+	u32 input_min_count = 0;
+	u32 total_hb_layer = 0;
+
+	if (is_decode_session(inst)) {
+		input_min_count = MIN_DEC_INPUT_BUFFERS;
+	} else if (is_encode_session(inst)) {
+		total_hb_layer = is_hierb_type_requested(inst) ?
+			inst->capabilities[ENH_LAYER_COUNT].value + 1 : 0;
+		if (inst->codec == MSM_VIDC_H264 &&
+			!inst->capabilities[LAYER_ENABLE].value) {
+			total_hb_layer = 0;
+		}
+		HFI_IRIS3_ENC_MIN_INPUT_BUF_COUNT(input_min_count,
+			total_hb_layer);
+	} else {
+		i_vpr_e(inst, "%s: invalid domain %d\n", __func__, inst->domain);
+		return 0;
+	}
+
+	if (is_thumbnail_session(inst) || is_image_session(inst))
+		input_min_count = 1;
+
+	return input_min_count;
+}
+
+static int msm_buffer_dpb_count(struct msm_vidc_inst *inst)
+{
+	int count = 0;
+
+	/* encoder dpb buffer count */
+	if (is_encode_session(inst))
+		return msm_vidc_get_recon_buf_count(inst);
+
+	/* decoder dpb buffer count */
+	if (is_split_mode_enabled(inst)) {
+		count = inst->fw_min_count ?
+			inst->fw_min_count : inst->buffers.output.min_count;
+	}
+
+	return count;
+}
+
+static int msm_buffer_delivery_mode_based_min_count_iris33(struct msm_vidc_inst *inst,
+	uint32_t count)
+{
+	struct v4l2_format *f;
+	struct msm_vidc_core *core = NULL;
+	u32 width, height, total_num_slices = 1;
+	u32 hfi_codec = 0;
+	u32 max_mbs_per_slice = 0;
+	u32 slice_mode = 0;
+	u32 delivery_mode = 0;
+	u32 num_vpp_pipes;
+
+	slice_mode = inst->capabilities[SLICE_MODE].value;
+	delivery_mode = inst->capabilities[DELIVERY_MODE].value;
+
+	if (slice_mode != V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB ||
+		(!delivery_mode))
+		return count;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	max_mbs_per_slice = inst->capabilities[SLICE_MAX_MB].value;
+
+	if (inst->codec == MSM_VIDC_H264)
+		hfi_codec = HFI_CODEC_ENCODE_AVC;
+	else if (inst->codec == MSM_VIDC_HEVC)
+		hfi_codec = HFI_CODEC_ENCODE_HEVC;
+
+	core = inst->core;
+	num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+
+	HFI_IRIS3_ENC_MB_BASED_MULTI_SLICE_COUNT(total_num_slices, width, height,
+			hfi_codec, max_mbs_per_slice, num_vpp_pipes);
+
+	return (total_num_slices * count);
+}
+
+int msm_buffer_min_count_iris33(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int count = 0;
+
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_INPUT:
+	case MSM_VIDC_BUF_INPUT_META:
+		count = msm_vidc_input_min_count_iris33(inst);
+		break;
+	case MSM_VIDC_BUF_OUTPUT:
+	case MSM_VIDC_BUF_OUTPUT_META:
+		count = msm_vidc_output_min_count(inst);
+		count = msm_buffer_delivery_mode_based_min_count_iris33(inst, count);
+		break;
+	case MSM_VIDC_BUF_BIN:
+	case MSM_VIDC_BUF_COMV:
+	case MSM_VIDC_BUF_NON_COMV:
+	case MSM_VIDC_BUF_LINE:
+	case MSM_VIDC_BUF_PERSIST:
+	case MSM_VIDC_BUF_ARP:
+	case MSM_VIDC_BUF_VPSS:
+	case MSM_VIDC_BUF_PARTIAL_DATA:
+		count = msm_vidc_internal_buffer_count(inst, buffer_type);
+		break;
+	case MSM_VIDC_BUF_DPB:
+		count = msm_buffer_dpb_count(inst);
+		break;
+	default:
+		break;
+	}
+
+	i_vpr_l(inst, "  min_count: type: %11s, count: %9u\n", buf_name(buffer_type), count);
+	return count;
+}
+
+int msm_buffer_extra_count_iris33(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int count = 0;
+
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_INPUT:
+	case MSM_VIDC_BUF_INPUT_META:
+		count = msm_vidc_input_extra_count(inst);
+		break;
+	case MSM_VIDC_BUF_OUTPUT:
+	case MSM_VIDC_BUF_OUTPUT_META:
+		count = msm_vidc_output_extra_count(inst);
+		break;
+	default:
+		break;
+	}
+
+	i_vpr_l(inst, "extra_count: type: %11s, count: %9u\n", buf_name(buffer_type), count);
+	return count;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris33/src/msm_vidc_bus_iris33.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris33/src/msm_vidc_bus_iris33.c
@@ -0,0 +1,1051 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "perf_static_model.h"
+#include "msm_vidc_debug.h"
+
+/* 100x */
+static u32 dpbopb_ubwc30_cr_table_cratio_iris33[7][12] = {
+	{237, 399, 272, 137, 225, 158, 185, 259, 203, 138, 167, 152},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+	{237, 399, 272, 137, 225, 158, 185, 259, 203, 138, 167, 152},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+	{269, 404, 302, 202, 367, 238, 210, 299, 232, 134, 181, 149},
+};
+
+/* 100x */
+static u32 rpb_ubwc30_cr_table_cratio_iris33[7][12] = {
+	{193, 294, 218, 135, 214, 155, 175, 241, 191, 139, 162, 149},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+	{193, 294, 218, 135, 214, 155, 175, 241, 191, 139, 162, 149},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+	{285, 406, 316, 207, 373, 243, 201, 280, 221, 139, 177, 152},
+};
+
+/* 100x */
+static u32 ipblossy_ubwc30_cr_table_cratio_iris33[7][12] = {
+	{215, 215, 215, 174, 174, 174, 266, 266, 266, 231, 231, 231},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+	{215, 215, 215, 174, 174, 174, 266, 266, 266, 231, 231, 231},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+	{254, 254, 254, 219, 219, 219, 292, 292, 292, 249, 249, 249},
+};
+
+/* 100x */
+static u32 ipblossless_ubwc30_cr_table_cratio_iris33[7][12] = {
+	{185, 215, 194, 147, 178, 159, 162, 181, 169, 138, 161, 146},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+	{185, 215, 194, 147, 178, 159, 162, 181, 169, 138, 161, 146},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+	{186, 217, 195, 151, 183, 161, 164, 182, 170, 140, 168, 148},
+};
+
+/* 100x */
+static u32 en_original_compression_factor_rgba_pwd_iris33 = 243;
+/* 100x */
+static u32 en_original_compression_factor_rgba_avg_iris33 = 454;
+
+static u32 av1_num_tiles_iris33[7][3] = {
+	{2, 1, 1},
+	{4, 2, 2},
+	{4, 2, 2},
+	{4, 2, 2},
+	{1, 1, 1},
+	{2, 1, 1},
+	{16, 4, 4},
+};
+
+/*                                H   I   J         K   L   M      N   O   P
+ *         TotalW   Total R       Frequency         Write         Read
+ * Name                           B   b   P         B   b   P      B   b   P
+ * I3B4b1P    0.5    1.875        3   4   1         1   0   1      2   2   1
+ * I1B2b1P    0.5    1.75         1   2   1         1   0   1      2   2   1
+ * IbP        0.5    1.5          0   1   1         1   0   1      2   2   1
+ * IPP        1      1            0   0   1         1   0   1      2   2   1
+ * P          1      1            0   0   1         1   0   1      2   2   1
+ * smallB     0      2            0   1   0         1   0   1      2   2   1
+ * bigB       1      2            1   0   0         1   0   1      2   2   1
+ *
+ * Total W = SUMPRODUCT(H16:J16, K16 : M16) / SUM(H16:J16)
+ * Total R = SUMPRODUCT(H16:J16, N16 : P16) / SUM(H16:J16)
+ */
+
+/* 1000x */
+static u32 pineapple_en_readfactor[8] = {1000, 1500, 1750, 1875, 1000, 2000, 2000, 1000};
+/* 1000x */
+static u32 pineapple_en_writefactor[8] = {1000, 500, 500, 500, 1000, 0, 1000, 1000};
+static u32 pineapple_en_frame_num_parallel = 1;
+
+u32 calculate_number_lcus_iris33(u32 width, u32 height, u32 lcu_size)
+{
+	u32 mbs_width = (width % lcu_size) ?
+		(width / lcu_size + 1) : (width / lcu_size);
+	u32 mbs_height = (height % lcu_size) ?
+		(height / lcu_size + 1) : (height / lcu_size);
+
+	return mbs_width * mbs_height;
+}
+
+u32 calculate_number_ubwctiles_iris33(
+		u32 width, u32 height, u32 tile_w, u32 tile_h)
+{
+	u32 tiles_width = (width % tile_w) ?
+		(width / tile_w + 1) : (width / tile_w);
+	u32 tiles_height = (height % tile_h) ?
+		(height / tile_h + 1) : (height / tile_h);
+
+	return tiles_width * tiles_height;
+}
+
+struct compression_factors {
+	u32 dpb_cf_y;
+	u32 dpb_cf_cbcr;
+	u32 opb_cf_ycbcr;
+	u32 dpb_cr_y;
+	u32 ipb_cr_y;
+	u32 ipb_cr;
+} compression_factor;
+
+u32 get_compression_factors(struct compression_factors *compression_factor,
+		struct api_calculation_input codec_input)
+{
+	u8 cr_index_entry, cr_index_y, cr_index_c, cr_index_uni;
+	u32 frame_width;
+	u32 frame_height;
+
+	frame_width = codec_input.frame_width;
+	frame_height = codec_input.frame_height;
+	if (frame_width * frame_height <= 1920 * 1080)
+		cr_index_entry = 0;
+	else
+		cr_index_entry = 1;
+
+	if (codec_input.bitdepth == CODEC_BITDEPTH_8) {
+		/* NOT PWC or average and power case */
+		if (codec_input.complexity_setting != 0) {
+			cr_index_y = 0;
+			cr_index_c = 1;
+			cr_index_uni = 2;
+		} else {
+			cr_index_y = 3;
+			cr_index_c = 4;
+			cr_index_uni = 5;
+		}
+	} else {
+		/* NOT PWC or average and power case */
+		if (codec_input.complexity_setting != 0) {
+			cr_index_y = 6;
+			cr_index_c = 7;
+			cr_index_uni = 8;
+		} else {
+			cr_index_y = 9;
+			cr_index_c = 10;
+			cr_index_uni = 11;
+		}
+	}
+
+	if (codec_input.decoder_or_encoder == CODEC_DECODER) {
+		compression_factor->dpb_cf_y =
+			dpbopb_ubwc30_cr_table_cratio_iris33[cr_index_entry][cr_index_y];
+		compression_factor->dpb_cf_cbcr =
+			dpbopb_ubwc30_cr_table_cratio_iris33[cr_index_entry][cr_index_c];
+		compression_factor->opb_cf_ycbcr =
+			dpbopb_ubwc30_cr_table_cratio_iris33[cr_index_entry][cr_index_uni];
+
+		if ((codec_input.regression_mode == 3) &&
+			/* input cr numbers from interface */
+			((codec_input.cr_dpb != 0) || (codec_input.cr_opb != 0))) {
+			compression_factor->dpb_cf_y = codec_input.cr_dpb;
+			compression_factor->dpb_cf_cbcr = codec_input.cr_dpb;
+			compression_factor->opb_cf_ycbcr = codec_input.cr_opb;
+		}
+	} else { /* encoder */
+		/*
+		 * IPB CR Table Choice; static sheet (if framewidth<3840, use lossless table)
+		 * (else, use lossy table)
+		 * stick to this choice for SW purpose (no change for SW)
+		 */
+		if (frame_width < 3840) {
+			compression_factor->ipb_cr =
+				ipblossless_ubwc30_cr_table_cratio_iris33[cr_index_entry]
+					[cr_index_uni];
+			compression_factor->ipb_cr_y =
+				ipblossless_ubwc30_cr_table_cratio_iris33[cr_index_entry]
+					[cr_index_y];
+		} else {
+			compression_factor->ipb_cr =
+				ipblossy_ubwc30_cr_table_cratio_iris33[cr_index_entry]
+					[cr_index_uni];
+			compression_factor->ipb_cr_y =
+				ipblossy_ubwc30_cr_table_cratio_iris33[cr_index_entry]
+					[cr_index_y];
+		}
+
+		compression_factor->dpb_cf_y =
+			rpb_ubwc30_cr_table_cratio_iris33[cr_index_entry][cr_index_y];
+
+		compression_factor->dpb_cf_cbcr =
+			rpb_ubwc30_cr_table_cratio_iris33[cr_index_entry][cr_index_c];
+
+		if ((codec_input.regression_mode == 3) &&
+			/* input cr from interface */
+			((codec_input.cr_ipb != 0) || (codec_input.cr_rpb != 0))) {
+			compression_factor->dpb_cf_y = codec_input.cr_rpb;
+			compression_factor->dpb_cf_cbcr = codec_input.cr_rpb;
+			compression_factor->ipb_cr_y = codec_input.cr_ipb;
+		}
+	}
+
+	return 0;
+}
+
+static int calculate_bandwidth_decoder_iris33(
+		struct api_calculation_input codec_input,
+		struct api_calculation_bw_output *codec_output)
+{
+	/* common control parameters */
+	u32 frame_width;
+	u32 frame_height;
+	u32 frame_lcu_size = 16; /* initialized to h264 */
+	u32 lcu_per_frame;
+	u32 target_bitrate;
+	u32 collocated_bytes_per_lcu = 16; /* initialized to h264 */
+	u32 av1d_segment_read_per_lcu;
+	u32 av1d_fe_leftlinebuffer_perlcu_tileboudary;
+
+	u32 frame420_y_bw_linear_8bpp;
+	u32 frame420_y_bw_no_ubwc_tile_10bpp;
+	u32 frame420_y_bw_linear_10bpp;
+
+	u16 ubwc_tile_w;
+	u16 ubwc_tile_h;
+
+	u32 dpb_compression_factor_y;
+	u32 dpb_compression_factor_cbcr;
+
+	u32 reconstructed_write_bw_factor_rd;
+	u32 reference_y_read_bw_factor;
+	u32 reference_cbcr_read_bw_factor;
+
+	/* decoder control parameters */
+	u32 decoder_vsp_read_factor = 6;
+	u32 bins_to_bits_factor = 4;
+
+	u32 dpb_to_opb_ratios_ds = 1;
+
+	u8 llc_enabled_ref_y_rd;
+	u8 llc_enable_ref_crcb_rd;
+	u8 llc_enabled_bse_tlb;
+
+	/* this is for 2pipe and 1pipe LLC */
+	u8 llc_enable_probtable_av1d_21pipe = 0;
+
+	u32 opb_compression_factor_ycbcr;
+	u32 dpb_ubwc_tile_width_pixels;
+	u32 dpb_ubwc_tile_height_pixels;
+	u32 decoder_frame_complexity_factor;
+	u32 llc_saving = 130; /* Initialized to H264 */
+
+	u16 av1_tile_numbers;
+	u32 av1_collated_seg_buffer_rd_wr;
+	/* need divide by 1M at later step; */
+	u32 av1_probability_table_rdwr_bytesperframe = 22784;
+	u32 av1_fe_left_line_buffer_rdwr;
+
+	u32 bse_tlb_byte_per_lcu = 0;
+
+	u32 large_bw_calculation_fp = 0;
+
+	if (codec_input.pipe_num == 4) {
+		llc_enabled_ref_y_rd = 1;
+		llc_enable_ref_crcb_rd = 1;
+		llc_enabled_bse_tlb = 1;
+	} else if (codec_input.pipe_num == 2) {
+		llc_enabled_ref_y_rd = 0; // llc 128kb for palawan
+		llc_enable_ref_crcb_rd = 0;
+		llc_enabled_bse_tlb = (codec_input.status_llc_onoff == 1) ? 1 : 0;
+	}
+
+	llc_enabled_ref_y_rd = (codec_input.status_llc_onoff) ? 1 : 0;
+	llc_enable_ref_crcb_rd = (codec_input.status_llc_onoff) ? 1 : 0;
+	/* H265D BSE tlb in LLC will be pored in Kailua */
+	llc_enabled_bse_tlb = (codec_input.status_llc_onoff) ? 1 : 0;
+
+	frame_width = codec_input.frame_width;
+	frame_height = codec_input.frame_height;
+	if ((codec_input.codec == CODEC_H264) ||
+		(codec_input.codec == CODEC_H264_CAVLC)) {
+		frame_lcu_size = 16;
+		collocated_bytes_per_lcu = 16;
+		llc_saving = 130;
+	} else if (codec_input.codec == CODEC_HEVC) {
+		if (codec_input.lcu_size == 32) {
+			frame_lcu_size = 32;
+			collocated_bytes_per_lcu = 64;
+			llc_saving = 114;
+		} else if (codec_input.lcu_size == 64) {
+			frame_lcu_size = 64;
+			collocated_bytes_per_lcu = 256;
+			llc_saving = 107;
+		}
+	} else if (codec_input.codec == CODEC_VP9) {
+		if (codec_input.lcu_size == 32) {
+			frame_lcu_size = 32;
+			collocated_bytes_per_lcu = 64;
+			llc_saving = 114;
+		} else if (codec_input.lcu_size == 64) {
+			frame_lcu_size = 64;
+			collocated_bytes_per_lcu = 256;
+			llc_saving = 107;
+		}
+	} else if (codec_input.codec == CODEC_AV1) {
+		u32 av1d_leftline_cdef = (2944 + 896 + 896);
+		u32 av1d_leftline_scaling = (2176 + 1408 + 1408);
+		u32 av1d_leftline_fg = (1280);
+		u32 av1d_leftline_lr = (1536 + 1024 + 1024);
+
+		av1d_fe_leftlinebuffer_perlcu_tileboudary =
+			av1d_leftline_cdef + av1d_leftline_scaling +
+			av1d_leftline_fg + av1d_leftline_lr;
+
+		if (codec_input.lcu_size == 128) {
+			frame_lcu_size = 128;
+			collocated_bytes_per_lcu = 4 * 512;
+			av1d_segment_read_per_lcu = 512;
+			llc_saving = 104;
+		} else if (codec_input.lcu_size == 32) {
+			frame_lcu_size = 32;
+			collocated_bytes_per_lcu = 4 * 512 / (128 * 128 / 32 / 32);
+			av1d_segment_read_per_lcu = 512 / (128 * 128 / 32 / 32);
+			av1d_fe_leftlinebuffer_perlcu_tileboudary =
+				av1d_fe_leftlinebuffer_perlcu_tileboudary / (128 * 128 / 32 / 32);
+			llc_saving = 114;
+		} else if (codec_input.lcu_size == 64) {
+			frame_lcu_size = 64;
+			collocated_bytes_per_lcu = 4 * 512 / (128 * 128 / 64 / 64);
+			av1d_segment_read_per_lcu = 512 / (128 * 128 / 64 / 64);
+			av1d_fe_leftlinebuffer_perlcu_tileboudary =
+				av1d_fe_leftlinebuffer_perlcu_tileboudary / (128 * 128 / 64 / 64);
+			llc_saving = 107;
+		}
+	}
+
+	lcu_per_frame =
+		calculate_number_lcus_iris33(frame_width, frame_height, frame_lcu_size);
+
+	target_bitrate = (u32)(codec_input.bitrate_mbps); /* Mbps */
+
+	ubwc_tile_w = (codec_input.bitdepth == CODEC_BITDEPTH_8) ? 32 : 48;
+	ubwc_tile_h = (codec_input.bitdepth == CODEC_BITDEPTH_8) ? 8 : 4;
+
+	frame420_y_bw_linear_8bpp =
+		((calculate_number_ubwctiles_iris33(frame_width, frame_height, 32, 8) *
+		256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+	frame420_y_bw_no_ubwc_tile_10bpp =
+		((calculate_number_ubwctiles_iris33(frame_width, frame_height, 48, 4) *
+		256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+	frame420_y_bw_linear_10bpp = ((frame_width * frame_height *
+		codec_input.frame_rate * 2 + 999) / 1000 + 999) / 1000;
+
+	/* TODO Integrate Compression Ratio returned by FW */
+	get_compression_factors(&compression_factor, codec_input);
+	dpb_compression_factor_y = compression_factor.dpb_cf_y;
+	dpb_compression_factor_cbcr = compression_factor.dpb_cf_cbcr;
+	opb_compression_factor_ycbcr = compression_factor.opb_cf_ycbcr;
+
+	dpb_ubwc_tile_width_pixels = ubwc_tile_w;
+
+	dpb_ubwc_tile_height_pixels = ubwc_tile_h;
+
+	decoder_frame_complexity_factor =
+		(codec_input.complexity_setting == 0) ?
+		400 : ((codec_input.complexity_setting == 1) ? 266 : 100);
+
+	reconstructed_write_bw_factor_rd = (codec_input.complexity_setting == 0) ?
+		105 : 100;
+
+	reference_y_read_bw_factor = llc_saving;
+
+	reference_cbcr_read_bw_factor = llc_saving;
+
+	if (codec_input.codec == CODEC_AV1) {
+		u8 av1tile_index_entry, av1tile_complexity;
+
+		if (frame_width * frame_height <= 1280 * 720)
+			av1tile_index_entry = 4;
+		else if (frame_width * frame_height <= 1920 * 1080)
+			av1tile_index_entry = 0;
+		else if (frame_width * frame_height <= 2560 * 1440)
+			av1tile_index_entry = 5;
+		else if (frame_width * frame_height <= 4096 * 2304)
+			av1tile_index_entry = 1;
+		else
+			av1tile_index_entry = 6;
+
+		/* NOT PWC or average and power case */
+		if (codec_input.complexity_setting != 0)
+			av1tile_complexity = 1;
+		else
+			av1tile_complexity = 0;
+
+		av1_tile_numbers = av1_num_tiles_iris33[av1tile_index_entry][av1tile_complexity];
+
+		/* these bw can be ignored */
+		av1_collated_seg_buffer_rd_wr =
+			((av1d_segment_read_per_lcu * lcu_per_frame *
+			codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+		av1_fe_left_line_buffer_rdwr =
+			(((av1d_fe_leftlinebuffer_perlcu_tileboudary *
+			frame_height * (av1_tile_numbers > 1 ? av1_tile_numbers / 2 : 0)
+			+ 999) / 1000 + 999) / 1000 + (frame_lcu_size - 1)) / frame_lcu_size;
+	}
+
+	if (codec_input.codec == CODEC_HEVC) {
+		if (codec_input.lcu_size == 32)
+			bse_tlb_byte_per_lcu = 64;
+		else if (codec_input.lcu_size == 16)
+			bse_tlb_byte_per_lcu = 32;
+		else
+			bse_tlb_byte_per_lcu = 128;
+	} else if ((codec_input.codec == CODEC_H264) ||
+		(codec_input.codec == CODEC_H264_CAVLC)) {
+		bse_tlb_byte_per_lcu = 64;
+	} else if (codec_input.codec == CODEC_VP9) {
+		bse_tlb_byte_per_lcu = 304;
+	} else if (codec_input.codec == CODEC_AV1) {
+		if (codec_input.lcu_size == 128)
+			bse_tlb_byte_per_lcu = 2064;
+		else if (codec_input.lcu_size == 64)
+			bse_tlb_byte_per_lcu = 1056;
+		else if (codec_input.lcu_size == 32)
+			bse_tlb_byte_per_lcu = 2064 / (128 * 128 / 32 / 32);
+	}
+
+	codec_output->noc_bw_rd = 0;
+	codec_output->noc_bw_wr = 0;
+	codec_output->ddr_bw_rd = 0;
+	codec_output->ddr_bw_wr = 0;
+
+	large_bw_calculation_fp = 0;
+	large_bw_calculation_fp = ((target_bitrate *
+		decoder_vsp_read_factor + 7) / 8);
+
+	codec_output->vsp_read_noc = large_bw_calculation_fp;
+
+	codec_output->vsp_read_ddr = codec_output->vsp_read_noc;
+
+	large_bw_calculation_fp = ((target_bitrate *
+		bins_to_bits_factor + 7) / 8);
+
+	codec_output->vsp_write_noc = large_bw_calculation_fp;
+	codec_output->vsp_write_ddr = codec_output->vsp_write_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->vsp_read_noc;
+	codec_output->ddr_bw_rd += codec_output->vsp_read_ddr;
+	codec_output->noc_bw_wr += codec_output->vsp_write_noc;
+	codec_output->ddr_bw_wr += codec_output->vsp_write_ddr;
+
+	large_bw_calculation_fp = 0;
+	large_bw_calculation_fp = ((collocated_bytes_per_lcu *
+		lcu_per_frame * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+	codec_output->collocated_rd_noc = large_bw_calculation_fp;
+	codec_output->collocated_wr_noc = codec_output->collocated_rd_noc;
+	codec_output->collocated_rd_ddr = codec_output->collocated_rd_noc;
+	codec_output->collocated_wr_ddr = codec_output->collocated_wr_noc;
+
+	codec_output->collocated_rd_wr_total_noc =
+		(u32)(codec_output->collocated_rd_noc + codec_output->collocated_wr_noc);
+
+	codec_output->collocated_rd_wr_total_ddr =
+		codec_output->collocated_rd_wr_total_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->collocated_rd_noc;
+	codec_output->noc_bw_wr += codec_output->collocated_wr_noc;
+	codec_output->ddr_bw_rd += codec_output->collocated_rd_ddr;
+	codec_output->ddr_bw_wr += codec_output->collocated_wr_ddr;
+
+	large_bw_calculation_fp = 0;
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp :
+		frame420_y_bw_no_ubwc_tile_10bpp) * decoder_frame_complexity_factor;
+
+	large_bw_calculation_fp =
+		(large_bw_calculation_fp + dpb_compression_factor_y - 1) /
+		dpb_compression_factor_y;
+
+	codec_output->dpb_rd_y_noc = large_bw_calculation_fp;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp : frame420_y_bw_no_ubwc_tile_10bpp) *
+		decoder_frame_complexity_factor;
+
+	large_bw_calculation_fp =
+		(large_bw_calculation_fp + dpb_compression_factor_cbcr - 1) /
+		dpb_compression_factor_cbcr / 2;
+
+	codec_output->dpb_rd_crcb_noc = large_bw_calculation_fp;
+	codec_output->dpb_rdwr_duetooverlap_noc = 0;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp : frame420_y_bw_no_ubwc_tile_10bpp) *
+		reconstructed_write_bw_factor_rd;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp : frame420_y_bw_no_ubwc_tile_10bpp) *
+		reconstructed_write_bw_factor_rd;
+
+	large_bw_calculation_fp = large_bw_calculation_fp *
+		(dpb_compression_factor_y / 2 + dpb_compression_factor_cbcr);
+
+	large_bw_calculation_fp = (large_bw_calculation_fp + dpb_compression_factor_y - 1) /
+		dpb_compression_factor_y;
+
+	large_bw_calculation_fp =
+		(large_bw_calculation_fp + dpb_compression_factor_cbcr - 1) /
+		dpb_compression_factor_cbcr;
+
+	codec_output->dpb_wr_noc = large_bw_calculation_fp;
+
+	codec_output->dpb_rd_y_ddr = (llc_enabled_ref_y_rd) ?
+		((codec_output->dpb_rd_y_noc * 100 + reference_y_read_bw_factor - 1) /
+		reference_y_read_bw_factor) : codec_output->dpb_rd_y_noc;
+
+	codec_output->dpb_rd_crcb_ddr = (llc_enable_ref_crcb_rd) ?
+		((codec_output->dpb_rd_crcb_noc * 100 +
+		reference_cbcr_read_bw_factor - 1) /
+		reference_cbcr_read_bw_factor) : codec_output->dpb_rd_crcb_noc;
+
+	codec_output->dpb_rdwr_duetooverlap_ddr = 0;
+	codec_output->dpb_wr_ddr = codec_output->dpb_wr_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->dpb_rd_y_noc;
+	codec_output->noc_bw_rd += codec_output->dpb_rd_crcb_noc;
+	codec_output->noc_bw_rd += codec_output->dpb_rdwr_duetooverlap_noc;
+	codec_output->noc_bw_wr += codec_output->dpb_wr_noc;
+	codec_output->ddr_bw_rd += codec_output->dpb_rd_y_ddr;
+	codec_output->ddr_bw_rd += codec_output->dpb_rd_crcb_ddr;
+	codec_output->ddr_bw_rd += codec_output->dpb_rdwr_duetooverlap_ddr;
+	codec_output->ddr_bw_wr += codec_output->dpb_wr_ddr;
+
+	if (codec_input.linear_opb || codec_input.split_opb) {
+		if (codec_input.linear_opb) {
+			if (codec_input.bitdepth == CODEC_BITDEPTH_8) {
+				large_bw_calculation_fp = ((frame420_y_bw_linear_8bpp) *
+				3 / 2 / dpb_to_opb_ratios_ds);
+
+				codec_output->opb_write_total_noc = large_bw_calculation_fp;
+			} else {
+				large_bw_calculation_fp = ((frame420_y_bw_linear_10bpp) *
+				3 / 2 / dpb_to_opb_ratios_ds);
+
+				codec_output->opb_write_total_noc = large_bw_calculation_fp;
+			}
+		} else { /* (CODEC_INPUT.split_opb) */
+			if (codec_input.bitdepth == CODEC_BITDEPTH_8) {
+				large_bw_calculation_fp =
+					(frame420_y_bw_linear_8bpp * 3 / 2 / dpb_to_opb_ratios_ds *
+					100 + opb_compression_factor_ycbcr - 1) /
+					opb_compression_factor_ycbcr;
+
+				codec_output->opb_write_total_noc = large_bw_calculation_fp;
+			} else {
+				large_bw_calculation_fp =
+					(frame420_y_bw_no_ubwc_tile_10bpp * 3 / 2 /
+					dpb_to_opb_ratios_ds * 100 +
+					opb_compression_factor_ycbcr - 1) /
+					opb_compression_factor_ycbcr;
+
+				codec_output->opb_write_total_noc = large_bw_calculation_fp;
+			}
+		}
+	} else {
+		codec_output->opb_write_total_noc = 0;
+	}
+
+	codec_output->opb_write_total_ddr = codec_output->opb_write_total_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_wr += codec_output->opb_write_total_noc;
+	codec_output->ddr_bw_wr += codec_output->opb_write_total_ddr;
+
+	large_bw_calculation_fp = ((bse_tlb_byte_per_lcu * lcu_per_frame *
+		codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+	codec_output->bse_tlb_rd_noc = large_bw_calculation_fp;
+
+	if (llc_enabled_bse_tlb)
+		codec_output->bse_tlb_rd_ddr = 0;
+	else
+		codec_output->bse_tlb_rd_ddr = codec_output->bse_tlb_rd_noc;
+
+	codec_output->bse_tlb_wr_noc = codec_output->bse_tlb_rd_noc;
+
+	if (llc_enabled_bse_tlb)
+		codec_output->bse_tlb_wr_ddr = 0;
+	else
+		codec_output->bse_tlb_wr_ddr = codec_output->bse_tlb_wr_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->bse_tlb_rd_noc;
+	codec_output->ddr_bw_rd += codec_output->bse_tlb_rd_ddr;
+	codec_output->noc_bw_wr += codec_output->bse_tlb_wr_noc;
+	codec_output->ddr_bw_wr += codec_output->bse_tlb_wr_ddr;
+
+	if (codec_input.codec == CODEC_AV1) {
+		codec_output->statistics_rd_noc = (av1_collated_seg_buffer_rd_wr +
+			av1_probability_table_rdwr_bytesperframe * av1_tile_numbers /
+			1000 / 1000 + av1_fe_left_line_buffer_rdwr);
+
+		codec_output->statistics_wr_noc = (av1_collated_seg_buffer_rd_wr +
+			av1_probability_table_rdwr_bytesperframe * av1_tile_numbers /
+			1000 / 1000 + av1_fe_left_line_buffer_rdwr);
+
+		if (llc_enable_probtable_av1d_21pipe) {
+			/* assert(CODEC_INPUT.pipe_num != 4); */
+			codec_output->statistics_rd_ddr = codec_output->statistics_rd_noc -
+				av1_probability_table_rdwr_bytesperframe *
+				av1_tile_numbers / 1000 / 1000;
+
+			codec_output->statistics_wr_ddr = codec_output->statistics_wr_noc -
+				av1_probability_table_rdwr_bytesperframe *
+				av1_tile_numbers / 1000 / 1000;
+		} else {
+			codec_output->statistics_rd_ddr = codec_output->statistics_rd_noc;
+			codec_output->statistics_wr_ddr = codec_output->statistics_wr_noc;
+		}
+
+		/* accumulation */
+		codec_output->noc_bw_rd += codec_output->statistics_rd_noc;
+		codec_output->ddr_bw_rd += codec_output->statistics_rd_ddr;
+		codec_output->noc_bw_wr += codec_output->statistics_wr_noc;
+		codec_output->ddr_bw_wr += codec_output->statistics_wr_ddr;
+	}
+
+
+	codec_output->mmu_rd_ddr = 0;
+	codec_output->mmu_rd_noc = 0;
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->mmu_rd_noc;
+	codec_output->ddr_bw_rd += codec_output->mmu_rd_ddr;
+
+	return 0;
+}
+
+static int calculate_bandwidth_encoder_iris33(
+		struct api_calculation_input codec_input,
+		struct api_calculation_bw_output *codec_output)
+{
+	/* common control parameters */
+	u32 frame_width;
+	u32 frame_height;
+	u32 frame_lcu_size;
+	u32 lcu_per_frame;
+	u32 target_bitrate;
+	u32 collocated_bytes_per_lcu;
+
+	u32 frame420_y_bw_linear_8bpp;
+	u32 frame420_y_bw_no_ubwc_tile_10bpp;
+	u32 frame420_y_bw_linear_10bpp;
+
+	u16 ubwc_tile_w;
+	u16 ubwc_tile_h;
+
+	u32 dpb_compression_factor_y;
+	u32 dpb_compression_factor_cbcr;
+
+	u32 reconstructed_write_bw_factor_rd;
+	u32 reference_y_read_bw_factor;
+	u32 reference_crcb_read_bw_factor;
+
+	u32 en_vertical_tiles_width = 960;
+	u32 en_search_windows_size_horizontal = 96;
+
+	u8 en_rotation_90_270 = 0;
+	/* TODO Can we use (codec_input.status_llc_onoff) for enc_llc_*? */
+	u8 en_llc_enable_ref_rd_crcb = 0;
+	u8 en_llc_enable_rec_wr_uncompleted = 0;
+	u8 en_llc_enable_ref_rd_y_overlap = 0;
+
+	u32 en_bins_to_bits_factor = 4;
+
+	u32 en_tile_number;
+	u32 ipb_compression_factor_y;
+	u32 ipb_compression_factor;
+
+	u32 large_bw_calculation_fp = 0;
+
+	/* TODO Are these really needed in Encoder? */
+	u32 bse_tlb_byte_per_lcu = 0;
+	u8 llc_enabled_bse_tlb = 1;
+
+	/*H265D BSE tlb in LLC will be pored in Kailua */
+	llc_enabled_bse_tlb = (codec_input.status_llc_onoff) ? 1 : 0;
+
+	/* encoder control parameters
+	 * iris3 2pipe uses 768 vertical tile width for IPP GoP
+	 */
+	if (codec_input.pipe_num == 2) {
+		en_vertical_tiles_width =
+		(codec_input.hierachical_layer == CODEC_GOP_IPP) ? 768 : 576;
+		// search ranges for iris3 2pipe
+		en_search_windows_size_horizontal =
+		(codec_input.hierachical_layer == CODEC_GOP_IPP) ? 192 : 96;
+	}
+
+	frame_width = codec_input.frame_width;
+	frame_height = codec_input.frame_height;
+	if ((codec_input.codec == CODEC_H264) ||
+		(codec_input.codec == CODEC_H264_CAVLC)) {
+		frame_lcu_size = 16;
+		collocated_bytes_per_lcu = 16;
+	} else if (codec_input.codec == CODEC_HEVC) {
+		frame_lcu_size = 32;
+		collocated_bytes_per_lcu = 64;
+	} else {
+		/* TODO What is the value for VP9, AV1? */
+		frame_lcu_size = 16;
+		collocated_bytes_per_lcu = 16; /* TODO Fixes Uninitialized compilation error. */
+	}
+
+	lcu_per_frame =
+		calculate_number_lcus_iris33(frame_width, frame_height, frame_lcu_size);
+
+	bse_tlb_byte_per_lcu = 16; /* TODO Should be in common declaration */
+
+	target_bitrate = (u32)(codec_input.bitrate_mbps); /* Mbps */
+
+	ubwc_tile_w = (codec_input.bitdepth == CODEC_BITDEPTH_8) ? 32 : 48;
+	ubwc_tile_h = (codec_input.bitdepth == CODEC_BITDEPTH_8) ? 8 : 4;
+
+	/* yuv */
+	if (codec_input.ipb_yuvrgb == 0) {
+		frame420_y_bw_linear_8bpp =
+			((calculate_number_ubwctiles_iris33(frame_width, frame_height,
+			32, 8) * 256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+	} else { /* RGBA */
+		frame420_y_bw_linear_8bpp =
+			((calculate_number_ubwctiles_iris33(frame_width, frame_height,
+			16, 4) * 256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+	}
+
+	frame420_y_bw_no_ubwc_tile_10bpp =
+		((calculate_number_ubwctiles_iris33(frame_width, frame_height, 48, 4) *
+		256 * codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+	frame420_y_bw_linear_10bpp = ((frame_width * frame_height *
+		codec_input.frame_rate * 2 + 999) / 1000 + 999) / 1000;
+
+	/* TODO Integrate Compression Ratio returned by FW */
+	get_compression_factors(&compression_factor, codec_input);
+	dpb_compression_factor_y = compression_factor.dpb_cf_y;
+	dpb_compression_factor_cbcr = compression_factor.dpb_cf_cbcr;
+	ipb_compression_factor_y = compression_factor.ipb_cr_y;
+	ipb_compression_factor = compression_factor.ipb_cr;
+
+	en_tile_number = (frame_width % en_vertical_tiles_width) ?
+		((frame_width / en_vertical_tiles_width) + 1) :
+		(frame_width / en_vertical_tiles_width);
+
+	en_tile_number = en_tile_number * 100;
+
+	/* ceil is same as excel roundup (float, 0); */
+	reconstructed_write_bw_factor_rd = ((en_tile_number - 100) * 2 *
+		((codec_input.lcu_size + ubwc_tile_w - 1) / ubwc_tile_w) *
+		ubwc_tile_w + (frame_width - 1)) / (frame_width)+100;
+
+	reference_y_read_bw_factor = ((en_tile_number - 100) * 2 *
+		((en_search_windows_size_horizontal + ubwc_tile_w - 1) / ubwc_tile_w) *
+		ubwc_tile_w + (frame_width - 1)) / frame_width + 100;
+
+	reference_crcb_read_bw_factor = 150;
+
+	codec_output->noc_bw_rd = 0;
+	codec_output->noc_bw_wr = 0;
+	codec_output->ddr_bw_rd = 0;
+	codec_output->ddr_bw_wr = 0;
+
+	large_bw_calculation_fp = (target_bitrate * en_bins_to_bits_factor + 7) / 8;
+	codec_output->vsp_read_noc = large_bw_calculation_fp;
+	codec_output->vsp_read_ddr = codec_output->vsp_read_noc;
+	large_bw_calculation_fp = (target_bitrate + 7) / 8;
+
+	codec_output->vsp_write_noc = codec_output->vsp_read_noc +
+		large_bw_calculation_fp;
+
+	codec_output->vsp_write_ddr = codec_output->vsp_write_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->vsp_read_noc;
+	codec_output->ddr_bw_rd += codec_output->vsp_read_ddr;
+	codec_output->noc_bw_wr += codec_output->vsp_write_noc;
+	codec_output->ddr_bw_wr += codec_output->vsp_write_ddr;
+
+	large_bw_calculation_fp = ((collocated_bytes_per_lcu * lcu_per_frame *
+		codec_input.frame_rate + 999) / 1000 + 999) / 1000;
+
+	codec_output->collocated_rd_noc = large_bw_calculation_fp;
+	codec_output->collocated_wr_noc = codec_output->collocated_rd_noc;
+	codec_output->collocated_rd_ddr = codec_output->collocated_rd_noc;
+	codec_output->collocated_wr_ddr = codec_output->collocated_wr_noc;
+
+	codec_output->collocated_rd_wr_total_noc =
+		(u32)(codec_output->collocated_rd_noc + codec_output->collocated_wr_noc);
+	codec_output->collocated_rd_wr_total_ddr =
+		codec_output->collocated_rd_wr_total_noc;
+
+	/* I frame only */
+	if (codec_input.hierachical_layer == CODEC_GOP_IONLY) {
+		codec_output->collocated_rd_noc = 0;
+		codec_output->collocated_wr_noc = 0;
+		codec_output->collocated_rd_ddr = 0;
+		codec_output->collocated_wr_ddr = 0;
+		codec_output->collocated_rd_wr_total_noc = 0;
+		codec_output->collocated_rd_wr_total_ddr = 0;
+	}
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->collocated_rd_noc;
+	codec_output->noc_bw_wr += codec_output->collocated_wr_noc;
+	codec_output->ddr_bw_rd += codec_output->collocated_rd_ddr;
+	codec_output->ddr_bw_wr += codec_output->collocated_wr_ddr;
+
+	large_bw_calculation_fp = 0;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp :
+		frame420_y_bw_no_ubwc_tile_10bpp) * reference_y_read_bw_factor;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp *
+		pineapple_en_readfactor[codec_input.hierachical_layer]);
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		dpb_compression_factor_y - 1) / dpb_compression_factor_y;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp + 999) / 1000;
+
+	codec_output->dpb_rd_y_noc = large_bw_calculation_fp;
+
+	large_bw_calculation_fp = 0;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp :
+		frame420_y_bw_no_ubwc_tile_10bpp) * reference_crcb_read_bw_factor / 2;
+
+	large_bw_calculation_fp = large_bw_calculation_fp *
+		pineapple_en_readfactor[codec_input.hierachical_layer];
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		dpb_compression_factor_cbcr - 1) / dpb_compression_factor_cbcr;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp + 999) / 1000;
+	codec_output->dpb_rd_crcb_noc = large_bw_calculation_fp;
+
+	large_bw_calculation_fp = 0;
+
+	large_bw_calculation_fp = ((codec_input.bitdepth == CODEC_BITDEPTH_8) ?
+		frame420_y_bw_linear_8bpp : frame420_y_bw_no_ubwc_tile_10bpp) *
+		reconstructed_write_bw_factor_rd *
+		pineapple_en_writefactor[codec_input.hierachical_layer] /
+		pineapple_en_frame_num_parallel;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp + 999) / 1000;
+
+	large_bw_calculation_fp = large_bw_calculation_fp *
+		(dpb_compression_factor_cbcr + dpb_compression_factor_y / 2);
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		dpb_compression_factor_y - 1) / dpb_compression_factor_y;
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		dpb_compression_factor_cbcr - 1) / dpb_compression_factor_cbcr;
+
+	codec_output->dpb_wr_noc = large_bw_calculation_fp;
+
+	/*
+	 * Summary:
+	 * by default (for both HFR and HSR cases) :
+	 *      -Any resolution and fps >= 120, enable layering.
+	 * (120 -> 3, 240 -> 4, 480 -> 5)
+	 *      - (once we enable layering) : 50 per cent frames are Non - reference
+	 *  frames.recon write is disable by Venus firmware
+	 *      - Customer has ability to enable / disable layering.
+	 *  Hence, recon write savings would not be there if
+	 *  customer explicitly disables layer encoding.
+	 */
+
+	/*HFR Cases use alternating rec write if not PWC*/
+	if ((codec_input.frame_rate >= 120) && (codec_input.complexity_setting != 0))
+		codec_output->dpb_wr_noc = codec_output->dpb_wr_noc / 2;
+
+	/* for power cases with [B1] adaptive non-ref b frame */
+	/* power caes IbP non reference b */
+	if ((codec_input.hierachical_layer >= 1) &&
+		(codec_input.hierachical_layer <= 3) &&
+		(codec_input.complexity_setting != 0))
+		codec_output->dpb_wr_noc = codec_output->dpb_wr_noc / 2;
+
+	large_bw_calculation_fp = 0;
+	large_bw_calculation_fp = codec_output->dpb_wr_noc *
+		(reconstructed_write_bw_factor_rd - 100);
+
+	large_bw_calculation_fp = (large_bw_calculation_fp +
+		reconstructed_write_bw_factor_rd - 1) / reconstructed_write_bw_factor_rd;
+
+	codec_output->dpb_rdwr_duetooverlap_noc = large_bw_calculation_fp;
+
+	codec_output->dpb_rd_y_ddr = (en_llc_enable_ref_rd_y_overlap) ?
+		(codec_output->dpb_rd_y_noc * 100 + reference_y_read_bw_factor - 1) /
+		reference_y_read_bw_factor : codec_output->dpb_rd_y_noc;
+
+	codec_output->dpb_rd_crcb_ddr = (en_llc_enable_ref_rd_crcb) ?
+		(codec_output->dpb_rd_crcb_noc * 100 + reference_crcb_read_bw_factor - 1) /
+		reference_crcb_read_bw_factor : codec_output->dpb_rd_crcb_noc;
+
+	codec_output->dpb_rdwr_duetooverlap_ddr = (en_llc_enable_rec_wr_uncompleted) ?
+		0 : codec_output->dpb_rdwr_duetooverlap_noc;
+
+	codec_output->dpb_wr_ddr = (en_llc_enable_rec_wr_uncompleted) ?
+		0 : codec_output->dpb_wr_noc;
+
+	/* I frame only */
+	if (codec_input.hierachical_layer == CODEC_GOP_IONLY) {
+		codec_output->dpb_rd_y_noc = 0;
+		codec_output->dpb_rd_crcb_noc = 0;
+		codec_output->dpb_rdwr_duetooverlap_noc = 0;
+		codec_output->dpb_wr_noc = 0;
+		codec_output->dpb_rd_y_ddr = 0;
+		codec_output->dpb_rd_crcb_ddr = 0;
+		codec_output->dpb_rdwr_duetooverlap_ddr = 0;
+		codec_output->dpb_wr_ddr = 0;
+	}
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->dpb_rd_y_noc;
+	codec_output->noc_bw_rd += codec_output->dpb_rd_crcb_noc;
+	codec_output->noc_bw_rd += codec_output->dpb_rdwr_duetooverlap_noc;
+	codec_output->noc_bw_wr += codec_output->dpb_wr_noc;
+	codec_output->ddr_bw_rd += codec_output->dpb_rd_y_ddr;
+	codec_output->ddr_bw_rd += codec_output->dpb_rd_crcb_ddr;
+	codec_output->ddr_bw_rd += codec_output->dpb_rdwr_duetooverlap_ddr;
+	codec_output->ddr_bw_wr += codec_output->dpb_wr_ddr;
+
+	if (codec_input.bitdepth == CODEC_BITDEPTH_8) {
+		if (codec_input.ipb_yuvrgb == 0) { /* yuv */
+			large_bw_calculation_fp = ((frame420_y_bw_linear_8bpp) * 3 / 2);
+			codec_output->ipb_rd_total_noc = large_bw_calculation_fp;
+			if (codec_input.linear_ipb == 0) {
+				codec_output->ipb_rd_total_noc =
+					(large_bw_calculation_fp * 100 +
+					 ipb_compression_factor - 1) /
+					ipb_compression_factor;
+			}
+		} else { /* rgb */
+			large_bw_calculation_fp = frame420_y_bw_linear_8bpp;
+			codec_output->ipb_rd_total_noc = large_bw_calculation_fp;
+			if (codec_input.linear_ipb == 0) {
+				if (codec_input.complexity_setting == 0) /* pwc */
+					codec_output->ipb_rd_total_noc =
+						(large_bw_calculation_fp * 100 +
+						 en_original_compression_factor_rgba_pwd_iris33
+						 - 1) /
+						en_original_compression_factor_rgba_pwd_iris33;
+				else
+					codec_output->ipb_rd_total_noc =
+					(large_bw_calculation_fp * 100 +
+					en_original_compression_factor_rgba_avg_iris33 - 1) /
+					en_original_compression_factor_rgba_avg_iris33;
+			}
+		}
+	} else {
+		if (codec_input.linear_ipb == 1) {
+			large_bw_calculation_fp = (frame420_y_bw_linear_10bpp) * 3 / 2;
+			codec_output->ipb_rd_total_noc = large_bw_calculation_fp;
+		} else {
+			large_bw_calculation_fp = (frame420_y_bw_no_ubwc_tile_10bpp *
+				300 / 2 + ipb_compression_factor - 1) / ipb_compression_factor;
+			codec_output->ipb_rd_total_noc = large_bw_calculation_fp;
+		}
+	}
+
+	if (en_rotation_90_270) {
+		if (codec_input.codec == CODEC_HEVC) {
+			if ((codec_input.bitdepth == CODEC_BITDEPTH_8) &&
+					(codec_input.ipb_yuvrgb == 0))
+				codec_output->ipb_rd_total_noc = codec_output->ipb_rd_total_noc
+					* 1;
+			else
+				codec_output->ipb_rd_total_noc = codec_output->ipb_rd_total_noc
+					* 3;
+		} else {
+			codec_output->ipb_rd_total_noc = codec_output->ipb_rd_total_noc * 2;
+		}
+	}
+
+	codec_output->ipb_rd_total_ddr = codec_output->ipb_rd_total_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->ipb_rd_total_noc;
+	codec_output->ddr_bw_rd += codec_output->ipb_rd_total_ddr;
+
+	codec_output->bse_tlb_rd_noc =
+		((bse_tlb_byte_per_lcu * lcu_per_frame * codec_input.frame_rate + 999)
+		/ 1000 + 999) / 1000;
+
+	if (llc_enabled_bse_tlb) /* TODO should be common declaration */
+		codec_output->bse_tlb_rd_ddr = 0;
+	else
+		codec_output->bse_tlb_rd_ddr = codec_output->bse_tlb_rd_noc;
+
+	codec_output->bse_tlb_wr_noc = codec_output->bse_tlb_rd_noc;
+
+	if (llc_enabled_bse_tlb)
+		codec_output->bse_tlb_wr_ddr = 0;
+	else
+		codec_output->bse_tlb_wr_ddr = codec_output->bse_tlb_wr_noc;
+
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->bse_tlb_rd_noc;
+	codec_output->ddr_bw_rd += codec_output->bse_tlb_rd_ddr;
+	codec_output->noc_bw_wr += codec_output->bse_tlb_wr_noc;
+	codec_output->ddr_bw_wr += codec_output->bse_tlb_wr_ddr;
+
+	codec_output->mmu_rd_ddr = 0;
+	codec_output->mmu_rd_noc = 0;
+	/* accumulation */
+	codec_output->noc_bw_rd += codec_output->mmu_rd_noc;
+	codec_output->ddr_bw_rd += codec_output->mmu_rd_ddr;
+
+	return 0;
+}
+
+int msm_vidc_calculate_bandwidth(struct api_calculation_input codec_input,
+		struct api_calculation_bw_output *codec_output)
+{
+	int rc = 0;
+
+	if (codec_input.decoder_or_encoder == CODEC_DECODER) {
+		rc = calculate_bandwidth_decoder_iris33(codec_input, codec_output);
+	} else if (codec_input.decoder_or_encoder == CODEC_ENCODER) {
+		rc = calculate_bandwidth_encoder_iris33(codec_input, codec_output);
+	} else {
+		d_vpr_e("%s: invalid codec\n", codec_input.decoder_or_encoder);
+		return -EINVAL;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris33/src/msm_vidc_clock_iris33.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris33/src/msm_vidc_clock_iris33.c
@@ -0,0 +1,726 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "perf_static_model.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_platform.h"
+
+#define ENABLE_FINEBITRATE_SUBUHD60 0
+
+static u32 codec_encoder_gop_complexity_table_fp[8][3];
+static u32 codec_mbspersession_iris33;
+static u32 input_bitrate_fp;
+
+/*
+ * Chipset Generation Technology: SW/FW overhead profiling
+ * need update with new numbers
+ */
+static u32 frequency_table_iris33[2][6] = {
+	/* //make lowsvs_D1 as invalid; */
+	{533, 480, 435, 380, 300, 196},
+	{840, 720, 652, 570, 450, 294},
+};
+
+static u32 frequency_table_iris33_2p[2][6] = {
+	/* //make lowsvs_D1 as invalid; */
+	{ 533, 444, 366, 338, 240, 192 },
+	{ 800, 666, 549, 507, 360, 288 },
+};
+
+ /*
+  * TODO Move to pineapple.c
+  * TODO Replace hardcoded values with
+  * ENCODER_VPP_TARGET_CLK_PER_MB_IRIS33 in CPP file.
+  */
+
+/* Tensilica cycles profiled by FW team in lanai device Feb 2022 */
+#define DECODER_VPP_FW_OVERHEAD_IRIS33_AV1D                                            ((80000*3)/2)
+#define DECODER_VPP_FW_OVERHEAD_IRIS33_NONAV1D                                         ((60000*3)/2)
+
+ /* Tensilica cycles */
+#define DECODER_VPP_FW_OVERHEAD_IRIS33                                                  (0)
+
+/* Tensilica cycles; this is measured in Lahaina 1stage with FW profiling */
+#define DECODER_VPPVSP1STAGE_FW_OVERHEAD_IRIS33                                         (93000)
+
+#define DECODER_VSP_FW_OVERHEAD_IRIS33 \
+	(DECODER_VPPVSP1STAGE_FW_OVERHEAD_IRIS33 - DECODER_VPP_FW_OVERHEAD_IRIS33)
+
+/* Tensilica cycles; encoder has ARP register */
+#define ENCODER_VPP_FW_OVERHEAD_IRIS33                                                  (69000*3/2)
+
+#define ENCODER_VPPVSP1STAGE_FW_OVERHEAD_IRIS33 \
+	(ENCODER_VPP_FW_OVERHEAD_IRIS33 + DECODER_VSP_FW_OVERHEAD_IRIS33)
+
+#define DECODER_SW_OVERHEAD_IRIS33                                                      (489583)
+#define ENCODER_SW_OVERHEAD_IRIS33                                                      (489583)
+
+/* Video IP Core Technology: pipefloor and pipe penlaty */
+// static u32 encoder_vpp_target_clk_per_mb_iris33[2] = {320, 675};
+static u32 decoder_vpp_target_clk_per_mb_iris33 = 200;
+
+/*
+ * These pipe penalty numbers only applies to 4 pipe
+ * For 2pipe and 1pipe, these numbers need recalibrate
+ */
+static u32 pipe_penalty_iris33[3][3] = {
+	/* NON AV1 */
+	{1059, 1059, 1059},
+	/* AV1 RECOMMENDED TILE 1080P_V2XH1, UHD_V2X2, 8KUHD_V8X2 */
+	{1410, 1248, 1226},
+	/* AV1 YOUTUBE/NETFLIX TILE 1080P_V4XH2_V4X1, UHD_V8X4_V8X1, 8KUHD_V8X8_V8X1 */
+	{2039, 2464, 1191},
+};
+
+static u32 pipe_penalty_iris33_2p[3][3] = {
+	/* NON AV1 */
+	{ 1059, 1059, 1059 },
+	/* AV1 RECOMMENDED TILE 1080P_V2XH1, UHD_V2X2, 8KUHD_V8X2 */
+	{ 1123, 1079, 1079 },
+	/* AV1 YOUTUBE/NETFLIX TILE 1080P_V4XH2_V4X1, UHD_V8X4_V8X1, 8KUHD_V8X8_V8X1 */
+	{ 1197, 1287, 1051 },
+};
+
+/*
+ * Video IP Core Technology: bitrate constraint
+ * HW limit bitrate table (these values are measured end to end fw/sw impacts are also considered)
+ * TODO Can we convert to Cycles/MB? This will remove DIVISION.
+ */
+static u32 bitrate_table_iris33_2stage_fp[5][10] = {
+	/* h264 cavlc */
+	{0, 220, 220, 220, 220, 220, 220, 220, 220, 220},
+	/* h264 cabac */
+	{0, 140, 150, 160, 175, 190, 190, 190, 190, 190},
+	/* h265 */
+	{90, 140, 160, 180, 190, 200, 200, 200, 200, 200},
+	/* vp9 */
+	{90, 90, 90, 90, 90, 90, 90, 90, 90, 90},
+	/* av1 */
+	{130, 130, 120, 120, 120, 120, 120, 120, 120, 120},
+};
+
+static u32 bitrate_table_iris33_2p_2stage_fp[5][10] = {
+	/* h264 cavlc */
+	{ 0, 220, 220, 220, 220, 220, 220, 220, 220, 220 },
+	/* h264 cabac */
+	{ 0, 140, 150, 160, 160, 160, 160, 160, 160, 160 },
+	/* h265 */
+	{ 90, 140, 160, 160, 160, 160, 160, 160, 160, 160 },
+	/*vp9 */
+	{ 90, 90, 90, 90, 90, 90, 90, 90, 90, 90 },
+	{ 130, 130, 120, 120, 120, 120, 120, 120, 120, 120 },
+};
+
+/*
+ * HW limit bitrate table (these values are measured
+ * end to end fw/sw impacts are also considered)
+ */
+static u32 bitrate_table_iris33_1stage_fp[5][10] = { /* 1-stage assume IPPP */
+	/* h264 cavlc */
+	{0, 220, 220, 220, 220, 220, 220, 220, 220, 220},
+	/* h264 cabac */
+	{0, 110, 150, 150, 150, 150, 150, 150, 150, 150},
+	/* h265 */
+	{0, 140, 150, 150, 150, 150, 150, 150, 150, 150},
+	/* vp9 */
+	{0, 70, 70, 70, 70, 70, 70, 70, 70, 70},
+	/* av1 */
+	{0, 100, 100, 100, 100, 100, 100, 100, 100, 100},
+};
+
+/* 8KUHD60; UHD240; 1080p960  with B */
+static u32 fp_pixel_count_bar0 = 3840 * 2160 * 240;
+/* 8KUHD60; UHD240; 1080p960  without B */
+static u32 fp_pixel_count_bar1 = 3840 * 2160 * 240;
+/* 1080p720 */
+static u32 fp_pixel_count_bar2 = 3840 * 2160 * 180;
+/* UHD120 */
+static u32 fp_pixel_count_bar3 = 3840 * 2160 * 120;
+/* UHD90 */
+static u32 fp_pixel_count_bar4 = 3840 * 2160 * 90;
+/* UHD60 */
+static u32 fp_pixel_count_bar5 = 3840 * 2160 * 60;
+/* UHD30; FHD120; HD240 */
+static u32 fp_pixel_count_bar6 = 3840 * 2160 * 30;
+/* FHD60 */
+static u32 fp_pixel_count_bar7 = 1920 * 1080 * 60;
+/* FHD30 */
+static u32 fp_pixel_count_bar8 = 1920 * 1080 * 30;
+/* HD30 */
+static u32 fp_pixel_count_bar9 = 1280 * 720 * 30;
+
+static u32 calculate_number_mbs_iris33(u32 width, u32 height, u32 lcu_size)
+{
+	u32 mbs_width = (width % lcu_size) ?
+		(width / lcu_size + 1) : (width / lcu_size);
+
+	u32 mbs_height = (height % lcu_size) ?
+		(height / lcu_size + 1) : (height / lcu_size);
+
+	return mbs_width * mbs_height * (lcu_size / 16) * (lcu_size / 16);
+}
+
+static int initialize_encoder_complexity_table(void)
+{
+	/* Beging Calculate Encoder GOP Complexity Table and HW Floor numbers */
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_Bb_ENTRY] = 70000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_P_ENTRY] = 10000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_Bb_ENTRY] * 150 +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_P_ENTRY] * 100);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] +
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_P_ENTRY] - 1);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] /
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I3B4b1P][CODEC_ENCODER_GOP_P_ENTRY]);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_Bb_ENTRY] = 30000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_P_ENTRY] = 10000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_Bb_ENTRY] * 150 +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_P_ENTRY] * 100);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] +
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_P_ENTRY] - 1);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_FACTORY_ENTRY] /
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_I1B2b1P][CODEC_ENCODER_GOP_P_ENTRY]);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_Bb_ENTRY] = 10000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_P_ENTRY] = 10000;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_Bb_ENTRY] * 150 +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_P_ENTRY] * 100);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] +
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_P_ENTRY] - 1);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_FACTORY_ENTRY] /
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IbP][CODEC_ENCODER_GOP_P_ENTRY]);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_Bb_ENTRY] = 0;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_P_ENTRY] = 1;
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_Bb_ENTRY] * 150 +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_P_ENTRY] * 100);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] +
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_P_ENTRY] - 1);
+
+	codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] =
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_FACTORY_ENTRY] /
+		(codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_Bb_ENTRY] +
+		codec_encoder_gop_complexity_table_fp
+		[CODEC_GOP_IPP][CODEC_ENCODER_GOP_P_ENTRY]);
+
+	return 0;
+}
+
+u32 get_bitrate_entry(u32 pixle_count)
+{
+	u32 bitrate_entry = 0;
+
+	if (pixle_count >= fp_pixel_count_bar1)
+		bitrate_entry = 1;
+	else if (pixle_count >= fp_pixel_count_bar2)
+		bitrate_entry = 2;
+	else if (pixle_count >= fp_pixel_count_bar3)
+		bitrate_entry = 3;
+	else if (pixle_count >= fp_pixel_count_bar4)
+		bitrate_entry = 4;
+	else if (pixle_count >= fp_pixel_count_bar5)
+		bitrate_entry = 5;
+	else if (pixle_count >= fp_pixel_count_bar6)
+		bitrate_entry = 6;
+	else if (pixle_count >= fp_pixel_count_bar7)
+		bitrate_entry = 7;
+	else if (pixle_count >= fp_pixel_count_bar8)
+		bitrate_entry = 8;
+	else if (pixle_count >= fp_pixel_count_bar9)
+		bitrate_entry = 9;
+	else
+		bitrate_entry = 9;
+
+	return bitrate_entry;
+}
+
+static int calculate_vsp_min_freq(struct api_calculation_input codec_input,
+		struct api_calculation_freq_output *codec_output)
+{
+	u32 (*frequency_table_value)[6];
+	u32 (*bitrate_table_2stage_value)[10];
+	/*
+	 * VSP calculation
+	 * different methodology from Lahaina
+	 */
+	u32 vsp_hw_min_frequency = 0;
+	/* UInt32 decoder_vsp_fw_overhead = 100 + 5; // amplified by 100x */
+	u32 fw_sw_vsp_offset = 1000 + 55;      /* amplified by 1000x */
+
+	/*
+	 * Ignore fw_sw_vsp_offset, as this is baked into the reference bitrate tables.
+	 *  As a consequence remove x1000 multipler as well.
+	 */
+	u32 codec = codec_input.codec;
+	/* UInt32 *bitratetable; */
+	u32 pixle_count = codec_input.frame_width *
+		codec_input.frame_height * codec_input.frame_rate;
+
+	u8 bitrate_entry = get_bitrate_entry(pixle_count); /* TODO EXTRACT */
+
+	input_bitrate_fp = ((u32)(codec_input.bitrate_mbps * 100 + 99)) / 100;
+
+	if (codec_input.vpu_ver == VPU_VERSION_IRIS33) {
+		frequency_table_value = frequency_table_iris33;
+		bitrate_table_2stage_value = bitrate_table_iris33_2stage_fp;
+	} else if (codec_input.vpu_ver == VPU_VERSION_IRIS33_2P) {
+		frequency_table_value = frequency_table_iris33_2p;
+		bitrate_table_2stage_value = bitrate_table_iris33_2p_2stage_fp;
+	}
+
+	/* 8KUHD60fps with B frame */
+	if ((pixle_count >= fp_pixel_count_bar0) &&
+		(codec_input.hierachical_layer != CODEC_GOP_IPP)) {
+		/*
+		 *  FORMULA: VSPfreq = NOMINAL * (InputBitrate / ReferenceBitrate);
+		 *  ReferenceBitrate = 0 for,
+		 *     - 1Stage TURBO, all Codecs.
+		 *     - 2Stage TURBO, H264 & H265.
+		 *
+		 *  8KUHD60fps with B frame
+		 *     - bitrate_entry = 0
+		 *     - Clock=NOMINAL for H264 & 2Stage H265. Because bitrate
+		 *       table entry for TURBO is 0.
+		 *
+		 *  TODO : Reduce these conditions by removing the zero entries from Bitrate table.
+		 */
+
+		vsp_hw_min_frequency = frequency_table_value[0][2] *
+			input_bitrate_fp * 1000;
+
+		if (codec_input.codec == CODEC_AV1)
+			vsp_hw_min_frequency = frequency_table_value[0][1] *
+				input_bitrate_fp * 1000;
+
+		if ((codec_input.codec == CODEC_H264) ||
+			(codec_input.codec == CODEC_H264_CAVLC)) {
+			vsp_hw_min_frequency = (frequency_table_value[0][2] * 1000 +
+				(fw_sw_vsp_offset - 1));
+			vsp_hw_min_frequency =
+				DIV_ROUND_UP(vsp_hw_min_frequency, fw_sw_vsp_offset);
+		} else {
+			if (codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_2S) {
+				vsp_hw_min_frequency = vsp_hw_min_frequency +
+					(bitrate_table_2stage_value[codec][0] *
+					fw_sw_vsp_offset - 1);
+				vsp_hw_min_frequency = DIV_ROUND_UP(vsp_hw_min_frequency,
+					(bitrate_table_2stage_value[codec][0]) *
+						fw_sw_vsp_offset);
+			} else {
+				vsp_hw_min_frequency = vsp_hw_min_frequency +
+					(bitrate_table_iris33_1stage_fp[codec][0] *
+					fw_sw_vsp_offset - 1);
+				vsp_hw_min_frequency = DIV_ROUND_UP(vsp_hw_min_frequency,
+					(bitrate_table_iris33_1stage_fp[codec][0]) *
+						fw_sw_vsp_offset);
+			}
+		}
+	} else {
+		vsp_hw_min_frequency = frequency_table_value[0][2] *
+			input_bitrate_fp * 1000;
+
+		if (codec_input.codec == CODEC_AV1 && bitrate_entry == 1)
+			vsp_hw_min_frequency = frequency_table_value[0][1] *
+				input_bitrate_fp * 1000;
+
+		if (codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_2S) {
+			vsp_hw_min_frequency = vsp_hw_min_frequency +
+				(bitrate_table_2stage_value[codec][bitrate_entry] *
+				fw_sw_vsp_offset - 1);
+			vsp_hw_min_frequency = DIV_ROUND_UP(vsp_hw_min_frequency,
+				(bitrate_table_2stage_value[codec][bitrate_entry]) *
+					fw_sw_vsp_offset);
+		} else {
+			vsp_hw_min_frequency = vsp_hw_min_frequency +
+				(bitrate_table_iris33_1stage_fp[codec][bitrate_entry] *
+				fw_sw_vsp_offset - 1);
+			vsp_hw_min_frequency = DIV_ROUND_UP(vsp_hw_min_frequency,
+				(bitrate_table_iris33_1stage_fp[codec][bitrate_entry]) *
+					fw_sw_vsp_offset);
+		}
+	}
+
+	codec_output->vsp_min_freq = vsp_hw_min_frequency;
+	return 0;
+}
+
+static u32 calculate_pipe_penalty(struct api_calculation_input codec_input)
+{
+	u32 pipe_penalty_codec = 0;
+	u8 avid_commercial_content = 0;
+	u32 pixel_count = 0;
+	u32 (*pipe_penalty_value)[3];
+
+	if (codec_input.vpu_ver == VPU_VERSION_IRIS33)
+		pipe_penalty_value = pipe_penalty_iris33;
+	else if (codec_input.vpu_ver == VPU_VERSION_IRIS33_2P)
+		pipe_penalty_value = pipe_penalty_iris33_2p;
+
+	/* decoder */
+	if (codec_input.decoder_or_encoder == CODEC_DECODER) {
+		pipe_penalty_codec = pipe_penalty_value[0][0];
+		avid_commercial_content = codec_input.av1d_commer_tile_enable;
+		if (codec_input.codec == CODEC_AV1) {
+			pixel_count = codec_input.frame_width * codec_input.frame_height;
+			if (pixel_count <= 1920 * 1080)
+				pipe_penalty_codec =
+					pipe_penalty_value[avid_commercial_content + 1][0];
+			else if (pixel_count < 3840 * 2160)
+				pipe_penalty_codec =
+					(pipe_penalty_value[avid_commercial_content + 1][0] +
+					pipe_penalty_value[avid_commercial_content + 1][1]) / 2;
+			else if ((pixel_count == 3840 * 2160) ||
+				(pixel_count == 4096 * 2160) || (pixel_count == 4096 * 2304))
+				pipe_penalty_codec =
+					pipe_penalty_value[avid_commercial_content + 1][1];
+			else if (pixel_count < 7680 * 4320)
+				pipe_penalty_codec =
+					(pipe_penalty_value[avid_commercial_content + 1][1] +
+					pipe_penalty_value[avid_commercial_content + 1][2]) / 2;
+			else
+				pipe_penalty_codec =
+					pipe_penalty_value[avid_commercial_content + 1][2];
+		}
+	} else {
+		pipe_penalty_codec = 101;
+	}
+
+	return pipe_penalty_codec;
+}
+
+static int calculate_vpp_min_freq(struct api_calculation_input codec_input,
+		struct api_calculation_freq_output *codec_output)
+{
+	u32 vpp_hw_min_frequency = 0;
+	u32 fmin = 0;
+	u32 tensilica_min_frequency = 0;
+	u32 decoder_vsp_fw_overhead = 100 + 5; /* amplified by 100x */
+	/* UInt32 fw_sw_vsp_offset = 1000 + 55;       amplified by 1000x */
+	/* TODO from calculate_sw_vsp_min_freq */
+	u32 vsp_hw_min_frequency = codec_output->vsp_min_freq;
+	u32 pipe_penalty_codec = 0;
+	u32 fmin_fwoverhead105 = 0;
+	u32 fmin_measured_fwoverhead = 0;
+	u32 lpmode_uhd_cycle_permb = 0;
+	u32 hqmode1080p_cycle_permb = 0;
+	u32 encoder_vpp_target_clk_per_mb = 0;
+	u32 decoder_vpp_fw_overhead = DECODER_VPP_FW_OVERHEAD_IRIS33;
+
+	codec_mbspersession_iris33 =
+		calculate_number_mbs_iris33(codec_input.frame_width,
+		codec_input.frame_height, codec_input.lcu_size) *
+		codec_input.frame_rate;
+
+	/* Section 2. 0  VPP/VSP calculation */
+	if (codec_input.decoder_or_encoder == CODEC_DECODER) { /* decoder */
+		vpp_hw_min_frequency = ((decoder_vpp_target_clk_per_mb_iris33) *
+			(codec_mbspersession_iris33) + codec_input.pipe_num - 1) /
+			(codec_input.pipe_num);
+
+		vpp_hw_min_frequency = (vpp_hw_min_frequency + 99999) / 1000000;
+
+		if (codec_input.pipe_num > 1) {
+			pipe_penalty_codec = calculate_pipe_penalty(codec_input);
+			vpp_hw_min_frequency = (vpp_hw_min_frequency *
+				pipe_penalty_codec + 999) / 1000;
+		}
+
+		if (codec_input.codec == CODEC_AV1)
+			decoder_vpp_fw_overhead = DECODER_VPP_FW_OVERHEAD_IRIS33_AV1D;
+		else
+			decoder_vpp_fw_overhead = DECODER_VPP_FW_OVERHEAD_IRIS33_NONAV1D;
+
+		if (codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_2S) {
+			/* FW overhead, convert FW cycles to impact to one pipe */
+
+			decoder_vpp_fw_overhead =
+				DIV_ROUND_UP((decoder_vpp_fw_overhead * 10 *
+				codec_input.frame_rate), 15);
+
+			decoder_vpp_fw_overhead =
+				DIV_ROUND_UP((decoder_vpp_fw_overhead * 1000),
+				(codec_mbspersession_iris33 *
+				decoder_vpp_target_clk_per_mb_iris33 / codec_input.pipe_num));
+
+			decoder_vpp_fw_overhead += 1000;
+			decoder_vpp_fw_overhead = (decoder_vpp_fw_overhead < 1050) ?
+				1050 : decoder_vpp_fw_overhead;
+
+			/* VPP HW + FW */
+			if (codec_input.linear_opb == 1 &&
+			    codec_input.bitdepth == CODEC_BITDEPTH_10)
+				/* multiply by 1.20 for 10b case */
+				decoder_vpp_fw_overhead = 1200 + decoder_vpp_fw_overhead - 1000;
+
+			vpp_hw_min_frequency = (vpp_hw_min_frequency *
+				decoder_vpp_fw_overhead + 999) / 1000;
+
+			/* VSP HW+FW */
+			vsp_hw_min_frequency =
+				(vsp_hw_min_frequency * decoder_vsp_fw_overhead + 99) / 100;
+
+			fmin = (vpp_hw_min_frequency > vsp_hw_min_frequency) ?
+				vpp_hw_min_frequency : vsp_hw_min_frequency;
+		} else {
+			/* 1-stage need SW cycles + FW cycles + HW time */
+			if (codec_input.linear_opb == 1 &&
+			    codec_input.bitdepth == CODEC_BITDEPTH_10)
+				/* multiply by 1.20 for 10b linear case */
+				vpp_hw_min_frequency =
+					(vpp_hw_min_frequency * 1200 + 999) / 1000;
+
+			/*
+			 * HW time
+			 * comment: 02/23/2021 SY: the bitrate is measured bitrate,
+			 * the overlapping effect is already considered into bitrate.
+			 * no need to add extra anymore
+			 */
+			fmin = (vpp_hw_min_frequency > vsp_hw_min_frequency) ?
+				vpp_hw_min_frequency : vsp_hw_min_frequency;
+
+			/* FW time */
+			fmin_fwoverhead105 = (fmin * 105 + 99) / 100;
+			fmin_measured_fwoverhead = fmin +
+				(((DECODER_VPPVSP1STAGE_FW_OVERHEAD_IRIS33 *
+				codec_input.frame_rate * 10 + 14) / 15 + 999) / 1000 + 999) /
+				1000;
+
+			fmin = (fmin_fwoverhead105 > fmin_measured_fwoverhead) ?
+				fmin_fwoverhead105 : fmin_measured_fwoverhead;
+		}
+
+		tensilica_min_frequency = (DECODER_SW_OVERHEAD_IRIS33 * 10 + 14) / 15;
+		tensilica_min_frequency = (tensilica_min_frequency + 999) / 1000;
+		tensilica_min_frequency = tensilica_min_frequency * codec_input.frame_rate;
+		tensilica_min_frequency = (tensilica_min_frequency + 999) / 1000;
+		fmin = (tensilica_min_frequency > fmin) ? tensilica_min_frequency : fmin;
+	} else { /* encoder */
+		/* Decide LP/HQ */
+		u8 hq_mode = 0;
+
+		if (codec_input.pipe_num > 1)
+			if (codec_input.frame_width * codec_input.frame_height <=
+				1920 * 1080)
+				if (codec_input.frame_width * codec_input.frame_height *
+					codec_input.frame_rate <= 1920 * 1080 * 60)
+					hq_mode = 1;
+
+		codec_output->enc_hqmode = hq_mode;
+
+		/* Section 1. 0 */
+		/* TODO ONETIME call, should be in another place. */
+		initialize_encoder_complexity_table();
+
+		/* End Calculate Encoder GOP Complexity Table */
+
+		/* VPP base cycle */
+		lpmode_uhd_cycle_permb = (320 *
+			codec_encoder_gop_complexity_table_fp
+			[codec_input.hierachical_layer][CODEC_ENCODER_GOP_FACTORY_ENTRY]
+			+ 99) / 100;
+
+		if ((codec_input.frame_width == 1920) &&
+			((codec_input.frame_height == 1080) ||
+			(codec_input.frame_height == 1088)) &&
+			(codec_input.frame_rate >= 480))
+			lpmode_uhd_cycle_permb = (90 * 4 *
+				codec_encoder_gop_complexity_table_fp
+				[codec_input.hierachical_layer][CODEC_ENCODER_GOP_FACTORY_ENTRY]
+				+ 99) / 100;
+
+		if ((codec_input.frame_width == 1280) &&
+			((codec_input.frame_height == 720) ||
+			(codec_input.frame_height == 768)) &&
+			(codec_input.frame_rate >= 960))
+			lpmode_uhd_cycle_permb = (99 * 4 *
+				codec_encoder_gop_complexity_table_fp
+				[codec_input.hierachical_layer][CODEC_ENCODER_GOP_FACTORY_ENTRY]
+				+ 99) / 100;
+
+		hqmode1080p_cycle_permb = (675 *
+			codec_encoder_gop_complexity_table_fp
+			[codec_input.hierachical_layer][CODEC_ENCODER_GOP_FACTORY_ENTRY]
+			+ 99) / 100;
+
+		encoder_vpp_target_clk_per_mb = (hq_mode) ?
+			hqmode1080p_cycle_permb : lpmode_uhd_cycle_permb;
+
+		vpp_hw_min_frequency = ((encoder_vpp_target_clk_per_mb) *
+			(codec_mbspersession_iris33) + codec_input.pipe_num - 1) /
+			(codec_input.pipe_num);
+
+		vpp_hw_min_frequency = (vpp_hw_min_frequency + 99999) / 1000000;
+
+		if (codec_input.pipe_num > 1) {
+			u32 pipe_penalty_codec = 101;
+
+			vpp_hw_min_frequency = (vpp_hw_min_frequency *
+				pipe_penalty_codec + 99) / 100;
+		}
+
+		if (codec_input.vsp_vpp_mode == CODEC_VSPVPP_MODE_2S) {
+			/* FW overhead, convert FW cycles to impact to one pipe */
+			u64 encoder_vpp_fw_overhead = 0;
+
+			encoder_vpp_fw_overhead =
+				DIV_ROUND_UP((ENCODER_VPP_FW_OVERHEAD_IRIS33 * 10 *
+				codec_input.frame_rate), 15);
+
+			encoder_vpp_fw_overhead =
+				DIV_ROUND_UP((encoder_vpp_fw_overhead * 1000),
+				(codec_mbspersession_iris33 * encoder_vpp_target_clk_per_mb /
+				codec_input.pipe_num));
+
+			encoder_vpp_fw_overhead += 1000;
+
+			encoder_vpp_fw_overhead = (encoder_vpp_fw_overhead < 1050) ?
+				1050 : encoder_vpp_fw_overhead;
+
+			/* VPP HW + FW */
+			vpp_hw_min_frequency = (vpp_hw_min_frequency *
+				encoder_vpp_fw_overhead + 999) / 1000;
+
+			/* TODO : decoder_vsp_fw_overhead? */
+			vsp_hw_min_frequency = (vsp_hw_min_frequency *
+				decoder_vsp_fw_overhead + 99) / 100;
+
+			fmin = (vpp_hw_min_frequency > vsp_hw_min_frequency) ?
+				vpp_hw_min_frequency : vsp_hw_min_frequency;
+		} else {
+			/* HW time */
+			fmin = (vpp_hw_min_frequency > vsp_hw_min_frequency) ?
+				vpp_hw_min_frequency : vsp_hw_min_frequency;
+
+			/* FW time */
+			fmin_fwoverhead105 = (fmin * 105 + 99) / 100;
+			fmin_measured_fwoverhead = fmin +
+				(((DECODER_VPPVSP1STAGE_FW_OVERHEAD_IRIS33 *
+				codec_input.frame_rate * 10 + 14) / 15 + 999) /
+				1000 + 999) / 1000;
+
+			fmin = (fmin_fwoverhead105 > fmin_measured_fwoverhead) ?
+				fmin_fwoverhead105 : fmin_measured_fwoverhead;
+			/* SW time */
+		}
+
+		tensilica_min_frequency = (ENCODER_SW_OVERHEAD_IRIS33 * 10 + 14) / 15;
+		tensilica_min_frequency = (tensilica_min_frequency + 999) / 1000;
+
+		tensilica_min_frequency = tensilica_min_frequency *
+			codec_input.frame_rate;
+
+		tensilica_min_frequency = (tensilica_min_frequency + 999) / 1000;
+
+		fmin = (tensilica_min_frequency > fmin) ?
+			tensilica_min_frequency : fmin;
+	}
+
+	codec_output->vpp_min_freq = vpp_hw_min_frequency;
+	codec_output->vsp_min_freq = vsp_hw_min_frequency;
+	codec_output->tensilica_min_freq = tensilica_min_frequency;
+	codec_output->hw_min_freq = fmin;
+
+	return 0;
+}
+
+int msm_vidc_calculate_frequency(struct api_calculation_input codec_input,
+		struct api_calculation_freq_output *codec_output)
+{
+	int rc = 0;
+
+	rc = calculate_vsp_min_freq(codec_input, codec_output);
+	if (rc)
+		return rc;
+
+	rc = calculate_vpp_min_freq(codec_input, codec_output);
+	if (rc)
+		return rc;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris33/src/msm_vidc_iris33.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris33/src/msm_vidc_iris33.c
@@ -0,0 +1,1434 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/reset.h>
+#include "msm_vidc_iris33.h"
+#include "msm_vidc_buffer_iris33.h"
+#include "msm_vidc_power_iris33.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_buffer.h"
+#include "msm_vidc_state.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_variant.h"
+#include "venus_hfi.h"
+
+#define VIDEO_ARCH_LX 1
+
+#define VCODEC_BASE_OFFS_IRIS33                 0x00000000
+#define VCODEC_CPU_CS_IRIS33                    0x000A0000
+#define AON_BASE_OFFS                           0x000E0000
+
+#define VCODEC_VPU_CPU_CS_VCICMDARG0_IRIS33                 (VCODEC_CPU_CS_IRIS33 + 0x24)
+#define VCODEC_VPU_CPU_CS_VCICMDARG1_IRIS33                 (VCODEC_CPU_CS_IRIS33 + 0x28)
+#define VCODEC_VPU_CPU_CS_SCIACMD_IRIS33                    (VCODEC_CPU_CS_IRIS33 + 0x48)
+#define VCODEC_VPU_CPU_CS_SCIACMDARG0_IRIS33                (VCODEC_CPU_CS_IRIS33 + 0x4C)
+#define VCODEC_VPU_CPU_CS_SCIACMDARG1_IRIS33                (VCODEC_CPU_CS_IRIS33 + 0x50)
+#define VCODEC_VPU_CPU_CS_SCIACMDARG2_IRIS33                (VCODEC_CPU_CS_IRIS33 + 0x54)
+#define VCODEC_VPU_CPU_CS_SCIBCMD_IRIS33                    (VCODEC_CPU_CS_IRIS33 + 0x5C)
+#define VCODEC_VPU_CPU_CS_SCIBCMDARG0_IRIS33                (VCODEC_CPU_CS_IRIS33 + 0x60)
+#define VCODEC_VPU_CPU_CS_SCIBARG1_IRIS33                   (VCODEC_CPU_CS_IRIS33 + 0x64)
+#define VCODEC_VPU_CPU_CS_SCIBARG2_IRIS33                   (VCODEC_CPU_CS_IRIS33 + 0x68)
+
+#define HFI_CTRL_INIT_IRIS33                          VCODEC_VPU_CPU_CS_SCIACMD_IRIS33
+#define HFI_CTRL_STATUS_IRIS33                        VCODEC_VPU_CPU_CS_SCIACMDARG0_IRIS33
+typedef enum {
+    HFI_CTRL_NOT_INIT                   = 0x0,
+    HFI_CTRL_READY                      = 0x1,
+    HFI_CTRL_ERROR_FATAL                = 0x2,
+    HFI_CTRL_ERROR_UC_REGION_NOT_SET    = 0x4,
+    HFI_CTRL_ERROR_HW_FENCE_QUEUE       = 0x8,
+    HFI_CTRL_PC_READY                   = 0x100,
+    HFI_CTRL_VCODEC_IDLE                = 0x40000000
+} hfi_ctrl_status_type;
+
+#define HFI_QTBL_INFO_IRIS33                          VCODEC_VPU_CPU_CS_SCIACMDARG1_IRIS33
+typedef enum {
+    HFI_QTBL_DISABLED    = 0x00,
+    HFI_QTBL_ENABLED     = 0x01,
+} hfi_qtbl_status_type;
+
+#define HFI_QTBL_ADDR_IRIS33                          VCODEC_VPU_CPU_CS_SCIACMDARG2_IRIS33
+#define HFI_MMAP_ADDR_IRIS33                          VCODEC_VPU_CPU_CS_SCIBCMDARG0_IRIS33
+#define HFI_UC_REGION_ADDR_IRIS33                     VCODEC_VPU_CPU_CS_SCIBARG1_IRIS33
+#define HFI_UC_REGION_SIZE_IRIS33                     VCODEC_VPU_CPU_CS_SCIBARG2_IRIS33
+#define HFI_DEVICE_REGION_ADDR_IRIS33                 VCODEC_VPU_CPU_CS_VCICMDARG0_IRIS33
+#define HFI_DEVICE_REGION_SIZE_IRIS33                 VCODEC_VPU_CPU_CS_VCICMDARG1_IRIS33
+#define HFI_SFR_ADDR_IRIS33                           VCODEC_VPU_CPU_CS_SCIBCMD_IRIS33
+
+#define CPU_CS_A2HSOFTINTCLR_IRIS33             (VCODEC_CPU_CS_IRIS33 + 0x1C)
+#define CPU_CS_H2XSOFTINTEN_IRIS33	(VCODEC_CPU_CS_IRIS33 + 0x148)
+
+#define CPU_CS_AHB_BRIDGE_SYNC_RESET            (VCODEC_CPU_CS_IRIS33 + 0x160)
+
+/* FAL10 Feature Control */
+#define CPU_CS_X2RPMh_IRIS33		(VCODEC_CPU_CS_IRIS33 + 0x168)
+
+#define CPU_IC_SOFTINT_IRIS33		(VCODEC_CPU_CS_IRIS33 + 0x150)
+#define CPU_IC_SOFTINT_H2A_SHFT_IRIS33	0x0
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: wrapper
+ * --------------------------------------------------------------------------
+ */
+#define WRAPPER_BASE_OFFS_IRIS33		0x000B0000
+#define WRAPPER_INTR_STATUS_IRIS33	(WRAPPER_BASE_OFFS_IRIS33 + 0x0C)
+#define WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS33	0x8
+#define WRAPPER_INTR_STATUS_A2H_BMSK_IRIS33	0x4
+
+#define WRAPPER_INTR_MASK_IRIS33		(WRAPPER_BASE_OFFS_IRIS33 + 0x10)
+#define WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS33	0x8
+#define WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS33	0x4
+
+#define WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS33	(WRAPPER_BASE_OFFS_IRIS33 + 0x54)
+#define WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS33	(WRAPPER_BASE_OFFS_IRIS33 + 0x58)
+#define WRAPPER_IRIS_CPU_NOC_LPI_CONTROL	(WRAPPER_BASE_OFFS_IRIS33 + 0x5C)
+#define WRAPPER_IRIS_CPU_NOC_LPI_STATUS		(WRAPPER_BASE_OFFS_IRIS33 + 0x60)
+#define WRAPPER_CORE_POWER_STATUS		(WRAPPER_BASE_OFFS_IRIS33 + 0x80)
+#define WRAPPER_CORE_POWER_CONTROL		(WRAPPER_BASE_OFFS_IRIS33 + 0x84)
+#define WRAPPER_CORE_CLOCK_CONFIG_IRIS33		(WRAPPER_BASE_OFFS_IRIS33 + 0x88)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: tz_wrapper
+ * --------------------------------------------------------------------------
+ */
+#define WRAPPER_TZ_BASE_OFFS	0x000C0000
+#define WRAPPER_TZ_CPU_STATUS	(WRAPPER_TZ_BASE_OFFS + 0x10)
+#define WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG	(WRAPPER_TZ_BASE_OFFS + 0x14)
+#define WRAPPER_TZ_QNS4PDXFIFO_RESET	(WRAPPER_TZ_BASE_OFFS + 0x18)
+
+#define AON_WRAPPER_MVP_NOC_LPI_CONTROL	(AON_BASE_OFFS)
+#define AON_WRAPPER_MVP_NOC_LPI_STATUS	(AON_BASE_OFFS + 0x4)
+#define AON_WRAPPER_MVP_NOC_CORE_SW_RESET (AON_BASE_OFFS + 0x18)
+#define AON_WRAPPER_MVP_NOC_CORE_CLK_CONTROL (AON_BASE_OFFS + 0x20)
+#define AON_WRAPPER_SPARE (AON_BASE_OFFS + 0x28)
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: VCODEC_SS registers
+ * --------------------------------------------------------------------------
+ */
+#define VCODEC_SS_IDLE_STATUSn           (VCODEC_BASE_OFFS_IRIS33 + 0x70)
+
+/*
+ * --------------------------------------------------------------------------
+ * MODULE: VCODEC_NOC
+ * --------------------------------------------------------------------------
+ */
+#define NOC_BASE_OFFS   0x00010000
+
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_MAINCTL_LOW_IRIS33   (NOC_BASE_OFFS + 0xA008)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRCLR_LOW_IRIS33    (NOC_BASE_OFFS + 0xA018)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_LOW_IRIS33   (NOC_BASE_OFFS + 0xA020)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_HIGH_IRIS33  (NOC_BASE_OFFS + 0xA024)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_LOW_IRIS33   (NOC_BASE_OFFS + 0xA028)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_HIGH_IRIS33  (NOC_BASE_OFFS + 0xA02C)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_LOW_IRIS33   (NOC_BASE_OFFS + 0xA030)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_HIGH_IRIS33  (NOC_BASE_OFFS + 0xA034)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_LOW_IRIS33   (NOC_BASE_OFFS + 0xA038)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_HIGH_IRIS33  (NOC_BASE_OFFS + 0xA03C)
+#define NOC_SIDEBANDMANAGER_MAIN_SIDEBANDMANAGER_FAULTINEN0_LOW_IRIS33 (NOC_BASE_OFFS + 0x7040)
+
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_MAINCTL_LOW_IRIS33_2P   (NOC_BASE_OFFS + 0x3508)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRCLR_LOW_IRIS33_2P    (NOC_BASE_OFFS + 0x3518)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_LOW_IRIS33_2P   (NOC_BASE_OFFS + 0x3520)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_HIGH_IRIS33_2P  (NOC_BASE_OFFS + 0x3524)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_LOW_IRIS33_2P   (NOC_BASE_OFFS + 0x3528)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_HIGH_IRIS33_2P  (NOC_BASE_OFFS + 0x352C)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_LOW_IRIS33_2P   (NOC_BASE_OFFS + 0x3530)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_HIGH_IRIS33_2P  (NOC_BASE_OFFS + 0x3534)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_LOW_IRIS33_2P   (NOC_BASE_OFFS + 0x3538)
+#define NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_HIGH_IRIS33_2P  (NOC_BASE_OFFS + 0x353C)
+#define NOC_SIDEBANDMANAGER_MAIN_SIDEBANDMANAGER_FAULTINEN0_LOW_IRIS33_2P (NOC_BASE_OFFS + 0x3240)
+
+static int __interrupt_init_iris33(struct msm_vidc_core *core)
+{
+	u32 mask_val = 0;
+	int rc = 0;
+
+	/* All interrupts should be disabled initially 0x1F6 : Reset value */
+	rc = __read_register(core, WRAPPER_INTR_MASK_IRIS33, &mask_val);
+	if (rc)
+		return rc;
+
+	/* Write 0 to unmask CPU and WD interrupts */
+	mask_val &= ~(WRAPPER_INTR_MASK_A2HWD_BMSK_IRIS33 |
+			WRAPPER_INTR_MASK_A2HCPU_BMSK_IRIS33);
+	rc = __write_register(core, WRAPPER_INTR_MASK_IRIS33, mask_val);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __get_device_region_info(struct msm_vidc_core *core,
+	u32 *min_dev_addr, u32 *dev_reg_size)
+{
+	struct device_region_set *dev_set;
+	u32 min_addr, max_addr, count = 0;
+	int rc = 0;
+
+	dev_set = &core->resource->device_region_set;
+
+	if (!dev_set->count) {
+		d_vpr_h("%s: device region not available\n", __func__);
+		return 0;
+	}
+
+	min_addr = 0xFFFFFFFF;
+	max_addr = 0x0;
+	for (count = 0; count < dev_set->count; count++) {
+		if (dev_set->device_region_tbl[count].dev_addr > max_addr)
+			max_addr = dev_set->device_region_tbl[count].dev_addr +
+				dev_set->device_region_tbl[count].size;
+		if (dev_set->device_region_tbl[count].dev_addr < min_addr)
+			min_addr = dev_set->device_region_tbl[count].dev_addr;
+	}
+	if (min_addr == 0xFFFFFFFF || max_addr == 0x0) {
+		d_vpr_e("%s: invalid device region\n", __func__);
+		return -EINVAL;
+	}
+
+	*min_dev_addr = min_addr;
+	*dev_reg_size = max_addr - min_addr;
+
+	return rc;
+}
+
+static int __program_bootup_registers_iris33(struct msm_vidc_core *core)
+{
+	u32 min_dev_reg_addr = 0, dev_reg_size = 0;
+	u32 value;
+	int rc = 0;
+
+	value = (u32)core->iface_q_table.align_device_addr;
+	rc = __write_register(core, HFI_UC_REGION_ADDR_IRIS33, value);
+	if (rc)
+		return rc;
+
+	value = SHARED_QSIZE;
+	rc = __write_register(core, HFI_UC_REGION_SIZE_IRIS33, value);
+	if (rc)
+		return rc;
+
+	value = (u32)core->iface_q_table.align_device_addr;
+	rc = __write_register(core, HFI_QTBL_ADDR_IRIS33, value);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, HFI_QTBL_INFO_IRIS33, HFI_QTBL_ENABLED);
+	if (rc)
+		return rc;
+
+	if (core->mmap_buf.align_device_addr) {
+		value = (u32)core->mmap_buf.align_device_addr;
+		rc = __write_register(core, HFI_MMAP_ADDR_IRIS33, value);
+		if (rc)
+			return rc;
+	} else {
+		d_vpr_e("%s: skip mmap buffer programming\n", __func__);
+		/* ignore the error for now for backward compatibility */
+		/* return -EINVAL; */
+	}
+
+	rc = __get_device_region_info(core, &min_dev_reg_addr, &dev_reg_size);
+	if (rc)
+		return rc;
+
+	if (min_dev_reg_addr && dev_reg_size) {
+		rc = __write_register(core, HFI_DEVICE_REGION_ADDR_IRIS33, min_dev_reg_addr);
+		if (rc)
+			return rc;
+
+		rc = __write_register(core, HFI_DEVICE_REGION_SIZE_IRIS33, dev_reg_size);
+		if (rc)
+			return rc;
+	} else {
+		d_vpr_e("%s: skip device region programming\n", __func__);
+		/* ignore the error for now for backward compatibility */
+		/* return -EINVAL; */
+	}
+
+	if (core->sfr.align_device_addr) {
+		value = (u32)core->sfr.align_device_addr + VIDEO_ARCH_LX;
+		rc = __write_register(core, HFI_SFR_ADDR_IRIS33, value);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+static bool is_iris33_hw_power_collapsed(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 value = 0, pwr_status = 0;
+
+	rc = __read_register(core, WRAPPER_CORE_POWER_STATUS, &value);
+	if (rc)
+		return false;
+
+	/* if BIT(1) is 1 then video hw power is on else off */
+	pwr_status = value & BIT(1);
+	return pwr_status ? false : true;
+}
+
+static int __switch_gdsc_mode_iris33(struct msm_vidc_core *core, bool sw_mode)
+{
+	int rc;
+
+	if (sw_mode) {
+		rc = __write_register(core, WRAPPER_CORE_POWER_CONTROL, 0x0);
+		if (rc)
+			return rc;
+		rc = __read_register_with_poll_timeout(core, WRAPPER_CORE_POWER_STATUS,
+						       BIT(1), 0x2, 200, 2000);
+		if (rc) {
+			d_vpr_e("%s: Failed to read WRAPPER_CORE_POWER_STATUS register to 0x1\n",
+				__func__);
+			return rc;
+		}
+	} else {
+		rc = __write_register(core, WRAPPER_CORE_POWER_CONTROL, 0x1);
+		if (rc)
+			return rc;
+		rc = __read_register_with_poll_timeout(core, WRAPPER_CORE_POWER_STATUS,
+						       BIT(1), 0x0, 200, 2000);
+		if (rc) {
+			d_vpr_e("%s: Failed to read WRAPPER_CORE_POWER_STATUS register to 0x0\n",
+				__func__);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int __power_off_iris33_hardware(struct msm_vidc_core *core)
+{
+	int rc = 0, i;
+	u32 value = 0;
+	bool pwr_collapsed = false;
+
+	/*
+	 * Incase hw power control is enabled, for any error case
+	 * CPU WD, video hw unresponsive cases, NOC error case etc,
+	 * execute NOC reset sequence before disabling power. If there
+	 * is no CPU WD and hw power control is enabled, fw is expected
+	 * to power collapse video hw always.
+	 */
+	if (is_core_sub_state(core, CORE_SUBSTATE_FW_PWR_CTRL)) {
+		pwr_collapsed = is_iris33_hw_power_collapsed(core);
+		if (pwr_collapsed) {
+			d_vpr_h("%s: video hw power collapsed %s\n",
+				__func__, core->sub_state_name);
+			goto disable_power;
+		} else {
+			d_vpr_e("%s: video hw is power ON, try power collpase hw %s\n",
+				__func__, core->sub_state_name);
+		}
+	}
+
+	/*
+	 * check to make sure core clock branch enabled else
+	 * we cannot read vcodec top idle register
+	 */
+	rc = __read_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS33, &value);
+	if (rc)
+		return rc;
+
+	if (value) {
+		d_vpr_e("%s: core clock config not enabled, enabling it to read vcodec registers\n",
+			__func__);
+		rc = __write_register(core, WRAPPER_CORE_CLOCK_CONFIG_IRIS33, 0);
+		if (rc)
+			return rc;
+	}
+
+	/*
+	 * add MNoC idle check before collapsing MVS0 per HPG update
+	 * poll for NoC DMA idle -> HPG 6.1.1
+	 */
+	for (i = 0; i < core->capabilities[NUM_VPP_PIPE].value; i++) {
+		rc = __read_register_with_poll_timeout(core, VCODEC_SS_IDLE_STATUSn + 4*i,
+				0x400000, 0x400000, 2000, 20000);
+		if (rc)
+			d_vpr_e("%s: VCODEC_SS_IDLE_STATUSn (%d) is not idle (%#x)\n",
+				__func__, i, value);
+	}
+
+	/* set MNoC to low power, set PD_NOC_QREQ (bit 0) */
+	rc = __write_register_masked(core, AON_WRAPPER_MVP_NOC_LPI_CONTROL,
+					0x1, BIT(0));
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, AON_WRAPPER_MVP_NOC_LPI_STATUS,
+					0x1, 0x1, 200, 2000);
+	if (rc)
+		d_vpr_e("%s: AON_WRAPPER_MVP_NOC_LPI_CONTROL failed\n", __func__);
+
+	rc = __write_register_masked(core, AON_WRAPPER_MVP_NOC_LPI_CONTROL,
+					0x0, BIT(0));
+	if (rc)
+		return rc;
+
+	/*
+	 * Reset both sides of 2 ahb2ahb_bridges (TZ and non-TZ)
+	 * do we need to check status register here?
+	 */
+	rc = __write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x3);
+	if (rc)
+		return rc;
+	rc = __write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x2);
+	if (rc)
+		return rc;
+	rc = __write_register(core, CPU_CS_AHB_BRIDGE_SYNC_RESET, 0x0);
+	if (rc)
+		return rc;
+
+disable_power:
+	/* power down process */
+	rc = call_res_op(core, gdsc_off, core, "vcodec");
+	if (rc) {
+		d_vpr_e("%s: disable regulator vcodec failed\n", __func__);
+		rc = 0;
+	}
+
+	rc = call_res_op(core, clk_disable, core, "video_cc_mvs0_clk");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare video_cc_mvs0_clk failed\n", __func__);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int __power_off_iris33_controller(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	int value = 0;
+
+	/*
+	 * mask fal10_veto QLPAC error since fal10_veto can go 1
+	 * when pwwait == 0 and clamped to 0 -> HPG 6.1.2
+	 */
+	rc = __write_register(core, CPU_CS_X2RPMh_IRIS33, 0x3);
+	if (rc)
+		return rc;
+
+	/* Set Iris CPU NoC to Low power */
+	rc = __write_register_masked(core, WRAPPER_IRIS_CPU_NOC_LPI_CONTROL,
+			0x1, BIT(0));
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, WRAPPER_IRIS_CPU_NOC_LPI_STATUS,
+			0x1, 0x1, 200, 2000);
+	if (rc)
+		d_vpr_e("%s: WRAPPER_IRIS_CPU_NOC_LPI_CONTROL failed\n", __func__);
+
+	/* Debug bridge LPI release */
+	rc = __write_register(core, WRAPPER_DEBUG_BRIDGE_LPI_CONTROL_IRIS33, 0x0);
+	if (rc)
+		return rc;
+
+	rc = __read_register_with_poll_timeout(core, WRAPPER_DEBUG_BRIDGE_LPI_STATUS_IRIS33,
+			0xffffffff, 0x0, 200, 2000);
+	if (rc)
+		d_vpr_e("%s: debug bridge release failed\n", __func__);
+
+	/* Reset MVP QNS4PDXFIFO */
+	rc = __write_register(core, WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG, 0x3);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, WRAPPER_TZ_QNS4PDXFIFO_RESET, 0x1);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, WRAPPER_TZ_QNS4PDXFIFO_RESET, 0x0);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG, 0x0);
+	if (rc)
+		return rc;
+
+	/* assert and deassert axi and mvs0c resets */
+	rc = call_res_op(core, reset_control_assert, core, "video_axi_reset");
+	if (rc)
+		d_vpr_e("%s: assert video_axi_reset failed\n", __func__);
+	/* set retain mem and peripheral before asset mvs0c reset */
+	rc = call_res_op(core, clk_set_flag, core,
+		"video_cc_mvs0c_clk", MSM_VIDC_CLKFLAG_RETAIN_MEM);
+	if (rc)
+		d_vpr_e("%s: set retain mem failed\n", __func__);
+	rc = call_res_op(core, clk_set_flag, core,
+		"video_cc_mvs0c_clk", MSM_VIDC_CLKFLAG_RETAIN_PERIPH);
+	if (rc)
+		d_vpr_e("%s: set retain peripheral failed\n", __func__);
+	rc = call_res_op(core, reset_control_assert, core, "video_mvs0c_reset");
+	if (rc)
+		d_vpr_e("%s: assert video_mvs0c_reset failed\n", __func__);
+	usleep_range(400, 500);
+	rc = call_res_op(core, reset_control_deassert, core, "video_axi_reset");
+	if (rc)
+		d_vpr_e("%s: de-assert video_axi_reset failed\n", __func__);
+	rc = call_res_op(core, reset_control_deassert, core, "video_mvs0c_reset");
+	if (rc)
+		d_vpr_e("%s: de-assert video_mvs0c_reset failed\n", __func__);
+
+	/* Disable MVP NoC clock */
+	rc = __write_register_masked(core, AON_WRAPPER_MVP_NOC_CORE_CLK_CONTROL,
+			0x1, BIT(0));
+	if (rc)
+		return rc;
+
+	/* enable MVP NoC reset */
+	rc = __write_register_masked(core, AON_WRAPPER_MVP_NOC_CORE_SW_RESET,
+			0x1, BIT(0));
+	if (rc)
+		return rc;
+
+	/*
+	 * need to acquire "video_xo_reset" before assert and release
+	 * after de-assert "video_xo_reset" reset clock to avoid other
+	 * drivers (eva driver) operating on this shared reset clock
+	 * and AON_WRAPPER_SPARE register in parallel.
+	 */
+	rc = call_res_op(core, reset_control_acquire, core, "video_xo_reset");
+	if (rc) {
+		d_vpr_e("%s: failed to acquire video_xo_reset control\n", __func__);
+		goto skip_video_xo_reset;
+	}
+
+	/* poll AON spare register bit0 to become zero with 50ms timeout */
+	rc = __read_register_with_poll_timeout(core, AON_WRAPPER_SPARE,
+			0x1, 0x0, 1000, 50 * 1000);
+	if (rc)
+		d_vpr_e("%s: AON spare register is not zero\n", __func__);
+
+	/* enable bit(1) to avoid cvp noc xo reset */
+	rc = __write_register(core, AON_WRAPPER_SPARE, value | 0x2);
+	if (rc)
+		goto exit;
+
+	/* assert video_cc XO reset */
+	rc = call_res_op(core, reset_control_assert, core, "video_xo_reset");
+	if (rc)
+		d_vpr_e("%s: assert video_xo_reset failed\n", __func__);
+
+	/* De-assert MVP NoC reset */
+	rc = __write_register_masked(core, AON_WRAPPER_MVP_NOC_CORE_SW_RESET,
+			0x0, BIT(0));
+	if (rc)
+		d_vpr_e("%s: MVP_NOC_CORE_SW_RESET failed\n", __func__);
+
+	/* De-assert video_cc XO reset */
+	usleep_range(80, 100);
+	rc = call_res_op(core, reset_control_deassert, core, "video_xo_reset");
+	if (rc)
+		d_vpr_e("%s: deassert video_xo_reset failed\n", __func__);
+
+	/* reset AON spare register */
+	rc = __write_register(core, AON_WRAPPER_SPARE, 0x0);
+	if (rc)
+		goto exit;
+
+	/* release reset control for other consumers */
+	rc = call_res_op(core, reset_control_release, core, "video_xo_reset");
+	if (rc)
+		d_vpr_e("%s: failed to release video_xo_reset reset\n", __func__);
+
+skip_video_xo_reset:
+	/* Enable MVP NoC clock */
+	rc = __write_register_masked(core, AON_WRAPPER_MVP_NOC_CORE_CLK_CONTROL,
+			0x0, BIT(0));
+	if (rc)
+		return rc;
+
+	/* remove retain mem and retain peripheral */
+	rc = call_res_op(core, clk_set_flag, core,
+		"video_cc_mvs0c_clk", MSM_VIDC_CLKFLAG_NORETAIN_PERIPH);
+	if (rc)
+		d_vpr_e("%s: set noretain peripheral failed\n", __func__);
+
+	rc = call_res_op(core, clk_set_flag, core,
+		"video_cc_mvs0c_clk", MSM_VIDC_CLKFLAG_NORETAIN_MEM);
+	if (rc)
+		d_vpr_e("%s: set noretain mem failed\n", __func__);
+
+	/* Turn off MVP MVS0C core clock */
+	rc = call_res_op(core, clk_disable, core, "video_cc_mvs0c_clk");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare video_cc_mvs0c_clk failed\n", __func__);
+		rc = 0;
+	}
+
+	/* power down process */
+	rc = call_res_op(core, gdsc_off, core, "iris-ctl");
+	if (rc) {
+		d_vpr_e("%s: disable regulator iris-ctl failed\n", __func__);
+		rc = 0;
+	}
+
+	/* Turn off GCC AXI clock */
+	rc = call_res_op(core, clk_disable, core, "gcc_video_axi0_clk");
+	if (rc) {
+		d_vpr_e("%s: disable unprepare gcc_video_axi0_clk failed\n", __func__);
+		rc = 0;
+	}
+
+	return rc;
+
+exit:
+	call_res_op(core, reset_control_release, core, "video_xo_reset");
+	return rc;
+}
+
+static int __power_off_iris33(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE))
+		return 0;
+
+	/**
+	 * Reset video_cc_mvs0_clk_src value to resolve MMRM high video
+	 * clock projection issue.
+	 */
+	rc = call_res_op(core, set_clks, core, 0);
+	if (rc)
+		d_vpr_e("%s: resetting clocks failed\n", __func__);
+
+	if (__power_off_iris33_hardware(core))
+		d_vpr_e("%s: failed to power off hardware\n", __func__);
+
+	if (__power_off_iris33_controller(core))
+		d_vpr_e("%s: failed to power off controller\n", __func__);
+
+	rc = call_res_op(core, set_bw, core, 0, 0);
+	if (rc)
+		d_vpr_e("%s: failed to unvote buses\n", __func__);
+
+	if (!call_venus_op(core, watchdog, core, core->intr_status))
+		disable_irq_nosync(core->resource->irq);
+
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE, 0, __func__);
+
+	return rc;
+}
+
+static int __power_on_iris33_controller(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = call_res_op(core, gdsc_on, core, "iris-ctl");
+	if (rc)
+		goto fail_regulator;
+
+	rc = call_res_op(core, reset_control_assert, core, "video_axi_reset");
+	if (rc)
+		goto fail_reset_assert_axi;
+	rc = call_res_op(core, reset_control_assert, core, "video_mvs0c_reset");
+	if (rc)
+		goto fail_reset_assert_mvs0c;
+	/* add usleep between assert and deassert */
+	usleep_range(1000, 1100);
+	rc = call_res_op(core, reset_control_deassert, core, "video_axi_reset");
+	if (rc)
+		goto fail_reset_deassert_axi;
+	rc = call_res_op(core, reset_control_deassert, core, "video_mvs0c_reset");
+	if (rc)
+		goto fail_reset_deassert_mvs0c;
+
+	rc = call_res_op(core, clk_enable, core, "gcc_video_axi0_clk");
+	if (rc)
+		goto fail_clk_axi;
+
+	rc = call_res_op(core, clk_enable, core, "video_cc_mvs0c_clk");
+	if (rc)
+		goto fail_clk_controller;
+
+	return 0;
+
+fail_clk_controller:
+	call_res_op(core, clk_disable, core, "gcc_video_axi0_clk");
+fail_clk_axi:
+fail_reset_deassert_mvs0c:
+fail_reset_deassert_axi:
+	call_res_op(core, reset_control_deassert, core, "video_mvs0c_reset");
+fail_reset_assert_mvs0c:
+	call_res_op(core, reset_control_deassert, core, "video_axi_reset");
+fail_reset_assert_axi:
+	call_res_op(core, gdsc_off, core, "iris-ctl");
+fail_regulator:
+	return rc;
+}
+
+static int __power_on_iris33_hardware(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = call_res_op(core, gdsc_on, core, "vcodec");
+	if (rc)
+		goto fail_regulator;
+
+	rc = call_res_op(core, clk_enable, core, "video_cc_mvs0_clk");
+	if (rc)
+		goto fail_clk_controller;
+
+	return 0;
+
+fail_clk_controller:
+	call_res_op(core, gdsc_off, core, "vcodec");
+fail_regulator:
+	return rc;
+}
+
+static int __power_on_iris33(struct msm_vidc_core *core)
+{
+	struct frequency_table *freq_tbl;
+	u32 freq = 0;
+	int rc = 0;
+
+	if (is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE))
+		return 0;
+
+	if (!core_in_valid_state(core)) {
+		d_vpr_e("%s: invalid core state %s\n",
+			__func__, core_state_name(core->state));
+		return -EINVAL;
+	}
+
+	/* Vote for all hardware resources */
+	rc = call_res_op(core, set_bw, core, INT_MAX, INT_MAX);
+	if (rc) {
+		d_vpr_e("%s: failed to vote buses, rc %d\n", __func__, rc);
+		goto fail_vote_buses;
+	}
+
+	rc = __power_on_iris33_controller(core);
+	if (rc) {
+		d_vpr_e("%s: failed to power on iris33 controller\n", __func__);
+		goto fail_power_on_controller;
+	}
+
+	rc = __power_on_iris33_hardware(core);
+	if (rc) {
+		d_vpr_e("%s: failed to power on iris33 hardware\n", __func__);
+		goto fail_power_on_hardware;
+	}
+	/* video controller and hardware powered on successfully */
+	rc = msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_POWER_ENABLE, __func__);
+	if (rc)
+		goto fail_power_on_substate;
+
+	freq_tbl = core->resource->freq_set.freq_tbl;
+	freq = core->power.clk_freq ? core->power.clk_freq :
+				      freq_tbl[0].freq;
+
+	rc = call_res_op(core, set_clks, core, freq);
+	if (rc) {
+		d_vpr_e("%s: failed to scale clocks\n", __func__);
+		rc = 0;
+	}
+	/*
+	 * Re-program all of the registers that get reset as a result of
+	 * regulator_disable() and _enable()
+	 * When video module writing to QOS registers EVA module is not
+	 * supposed to do video_xo_reset operations else we will see register
+	 * access failure, so acquire video_xo_reset to ensure EVA module is
+	 * not doing assert or de-assert on video_xo_reset.
+	 */
+	rc = call_res_op(core, reset_control_acquire, core, "video_xo_reset");
+	if (rc) {
+		d_vpr_e("%s: failed to acquire video_xo_reset control\n", __func__);
+		goto fail_assert_xo_reset;
+	}
+
+	__set_registers(core);
+
+	/*
+	 * Programm NOC error registers before releasing xo reset
+	 * Clear error logger registers and then enable StallEn
+	 */
+	if (core->platform->data.vpu_ver == VPU_VERSION_IRIS33) {
+		rc = __write_register(core,
+				NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRCLR_LOW_IRIS33, 0x1);
+		if (rc) {
+			d_vpr_e(
+				"%s: error clearing NOC_MAIN_ERRORLOGGER_ERRCLR_LOW\n",
+				__func__);
+			goto fail_program_noc_regs;
+		}
+
+		rc = __write_register(core,
+				NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_MAINCTL_LOW_IRIS33, 0x3);
+		if (rc) {
+			d_vpr_e(
+				"%s: failed to set NOC_ERL_MAIN_ERRORLOGGER_MAINCTL_LOW\n",
+				__func__);
+			goto fail_program_noc_regs;
+		}
+		rc = __write_register(core,
+				NOC_SIDEBANDMANAGER_MAIN_SIDEBANDMANAGER_FAULTINEN0_LOW_IRIS33,
+				0x1);
+		if (rc) {
+			d_vpr_e(
+				"%s: failed to set NOC_SIDEBANDMANAGER_FAULTINEN0_LOW\n",
+				__func__);
+			goto fail_program_noc_regs;
+		}
+	} else if (core->platform->data.vpu_ver == VPU_VERSION_IRIS33_2P) {
+		rc = __write_register(core,
+				NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRCLR_LOW_IRIS33_2P, 0x1);
+		if (rc) {
+			d_vpr_e(
+				"%s: error clearing NOC_MAIN_ERRORLOGGER_ERRCLR_LOW\n",
+				__func__);
+			goto fail_program_noc_regs;
+		}
+
+		rc = __write_register(core,
+				NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_MAINCTL_LOW_IRIS33_2P, 0x3);
+		if (rc) {
+			d_vpr_e(
+				"%s: failed to set NOC_ERL_MAIN_ERRORLOGGER_MAINCTL_LOW\n",
+				__func__);
+			goto fail_program_noc_regs;
+		}
+		rc = __write_register(core,
+				NOC_SIDEBANDMANAGER_MAIN_SIDEBANDMANAGER_FAULTINEN0_LOW_IRIS33_2P,
+				0x1);
+		if (rc) {
+			d_vpr_e(
+				"%s: failed to set NOC_SIDEBANDMANAGER_FAULTINEN0_LOW\n",
+				__func__);
+			goto fail_program_noc_regs;
+		}
+	}
+
+	/* release reset control for other consumers */
+	rc = call_res_op(core, reset_control_release, core, "video_xo_reset");
+	if (rc) {
+		d_vpr_e("%s: failed to release video_xo_reset reset\n", __func__);
+		goto fail_deassert_xo_reset;
+	}
+
+	__interrupt_init_iris33(core);
+	core->intr_status = 0;
+	enable_irq(core->resource->irq);
+
+	return rc;
+
+fail_program_noc_regs:
+	call_res_op(core, reset_control_release, core, "video_xo_reset");
+fail_deassert_xo_reset:
+fail_assert_xo_reset:
+fail_power_on_substate:
+	__power_off_iris33_hardware(core);
+fail_power_on_hardware:
+	__power_off_iris33_controller(core);
+fail_power_on_controller:
+	call_res_op(core, set_bw, core, 0, 0);
+fail_vote_buses:
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE, 0, __func__);
+
+	return rc;
+}
+
+static int __prepare_pc_iris33(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 wfi_status = 0, idle_status = 0, pc_ready = 0;
+	u32 ctrl_status = 0;
+
+	rc = __read_register(core, HFI_CTRL_STATUS_IRIS33, &ctrl_status);
+	if (rc)
+		return rc;
+
+	pc_ready = ctrl_status & HFI_CTRL_PC_READY;
+	idle_status = ctrl_status & BIT(30);
+
+	if (pc_ready) {
+		d_vpr_h("Already in pc_ready state\n");
+		return 0;
+	}
+	rc = __read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (rc)
+		return rc;
+
+	wfi_status &= BIT(0);
+	if (!wfi_status || !idle_status) {
+		d_vpr_e("Skipping PC, wfi status not set\n");
+		goto skip_power_off;
+	}
+
+	rc = __prepare_pc(core);
+	if (rc) {
+		d_vpr_e("Failed __prepare_pc %d\n", rc);
+		goto skip_power_off;
+	}
+
+	rc = __read_register_with_poll_timeout(core, HFI_CTRL_STATUS_IRIS33,
+			HFI_CTRL_PC_READY, HFI_CTRL_PC_READY, 250, 2500);
+	if (rc) {
+		d_vpr_e("%s: Skip PC. Ctrl status not set\n", __func__);
+		goto skip_power_off;
+	}
+
+	rc = __read_register_with_poll_timeout(core, WRAPPER_TZ_CPU_STATUS,
+			BIT(0), 0x1, 250, 2500);
+	if (rc) {
+		d_vpr_e("%s: Skip PC. Wfi status not set\n", __func__);
+		goto skip_power_off;
+	}
+	return rc;
+
+skip_power_off:
+	rc = __read_register(core, HFI_CTRL_STATUS_IRIS33, &ctrl_status);
+	if (rc)
+		return rc;
+	rc = __read_register(core, WRAPPER_TZ_CPU_STATUS, &wfi_status);
+	if (rc)
+		return rc;
+	wfi_status &= BIT(0);
+	d_vpr_e("Skip PC, wfi=%#x, idle=%#x, pcr=%#x, ctrl=%#x)\n",
+		wfi_status, idle_status, pc_ready, ctrl_status);
+	return -EAGAIN;
+}
+
+static int __raise_interrupt_iris33(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = __write_register(core, CPU_IC_SOFTINT_IRIS33, 1 << CPU_IC_SOFTINT_H2A_SHFT_IRIS33);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __watchdog_iris33(struct msm_vidc_core *core, u32 intr_status)
+{
+	int rc = 0;
+
+	if (intr_status & WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS33) {
+		d_vpr_e("%s: received watchdog interrupt\n", __func__);
+		rc = 1;
+	}
+
+	return rc;
+}
+
+static int __read_noc_err_register_iris33(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 value;
+
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_LOW_IRIS33, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_LOW:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_HIGH_IRIS33, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_HIGH:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_LOW_IRIS33, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_LOW:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_HIGH_IRIS33, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_HIGH:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_LOW_IRIS33, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_LOW:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_HIGH_IRIS33, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_HIGH:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_LOW_IRIS33, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_LOW:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_HIGH_IRIS33, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_HIGH:  %#x\n",
+			__func__, value);
+
+	return rc;
+}
+
+static int __read_noc_err_register_iris33_2p(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 value;
+
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_LOW_IRIS33_2P, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_LOW:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_HIGH_IRIS33_2P, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG0_HIGH:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_LOW_IRIS33_2P, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_LOW:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_HIGH_IRIS33_2P, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG1_HIGH:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_LOW_IRIS33_2P, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_LOW:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_HIGH_IRIS33_2P, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG2_HIGH:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_LOW_IRIS33_2P, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_LOW:  %#x\n",
+			__func__, value);
+	rc = __read_register(core,
+			NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_HIGH_IRIS33_2P, &value);
+	if (!rc)
+		d_vpr_e("%s: NOC_ERL_ERRORLOGGER_MAIN_ERRORLOGGER_ERRLOG3_HIGH:  %#x\n",
+			__func__, value);
+
+	return rc;
+}
+
+static int __noc_error_info_iris33(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	/*
+	 * we are not supposed to access vcodec subsystem registers
+	 * unless vcodec core clock WRAPPER_CORE_CLOCK_CONFIG_IRIS33 is enabled.
+	 * core clock might have been disabled by video firmware as part of
+	 * inter frame power collapse (power plane control feature).
+	 */
+
+	/*
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_SWID_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_SWID_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_SWID_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_SWID_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_MAINCTL_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_MAINCTL_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRVLD_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRVLD_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRCLR_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRCLR_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG0_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG0_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG0_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG0_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG1_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG1_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG1_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG1_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG2_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG2_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG2_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG2_HIGH:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG3_LOW);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG3_LOW:     %#x\n", val);
+	val = __read_register(core, VCODEC_NOC_ERL_MAIN_ERRLOG3_HIGH);
+	d_vpr_e("VCODEC_NOC_ERL_MAIN_ERRLOG3_HIGH:     %#x\n", val);
+	 */
+
+	if (is_iris33_hw_power_collapsed(core)) {
+		d_vpr_e("%s: video hardware already power collapsed\n", __func__);
+		return rc;
+	}
+
+	/*
+	 * Acquire video_xo_reset to ensure EVA module is
+	 * not doing assert or de-assert on video_xo_reset
+	 * while reading noc registers
+	 */
+	d_vpr_e("%s: read NOC ERR LOG registers\n", __func__);
+	rc = call_res_op(core, reset_control_acquire, core, "video_xo_reset");
+	if (rc) {
+		d_vpr_e("%s: failed to acquire video_xo_reset control\n", __func__);
+		goto fail_assert_xo_reset;
+	}
+
+	if (core->platform->data.vpu_ver == VPU_VERSION_IRIS33)
+		rc = __read_noc_err_register_iris33(core);
+	else if (core->platform->data.vpu_ver == VPU_VERSION_IRIS33_2P)
+		rc = __read_noc_err_register_iris33_2p(core);
+
+	/* release reset control for other consumers */
+	rc = call_res_op(core, reset_control_release, core, "video_xo_reset");
+	if (rc) {
+		d_vpr_e("%s: failed to release video_xo_reset reset\n", __func__);
+		goto fail_deassert_xo_reset;
+	}
+
+fail_deassert_xo_reset:
+fail_assert_xo_reset:
+	MSM_VIDC_FATAL(true);
+	return rc;
+}
+
+static int __clear_interrupt_iris33(struct msm_vidc_core *core)
+{
+	u32 intr_status = 0, mask = 0;
+	int rc = 0;
+
+	rc = __read_register(core, WRAPPER_INTR_STATUS_IRIS33, &intr_status);
+	if (rc)
+		return rc;
+
+	mask = (WRAPPER_INTR_STATUS_A2H_BMSK_IRIS33|
+		WRAPPER_INTR_STATUS_A2HWD_BMSK_IRIS33|
+		HFI_CTRL_VCODEC_IDLE);
+
+	if (intr_status & mask) {
+		core->intr_status |= intr_status;
+		core->reg_count++;
+		d_vpr_l("INTERRUPT: times: %d interrupt_status: %d\n",
+			core->reg_count, intr_status);
+	} else {
+		core->spur_count++;
+	}
+
+	rc = __write_register(core, CPU_CS_A2HSOFTINTCLR_IRIS33, 1);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __boot_firmware_iris33(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 ctrl_init_val = 0, ctrl_status = 0, count = 0, max_tries = 1000;
+
+	rc = __program_bootup_registers_iris33(core);
+	if (rc)
+		return rc;
+
+	ctrl_init_val = BIT(0);
+
+	rc = __write_register(core, HFI_CTRL_INIT_IRIS33, ctrl_init_val);
+	if (rc)
+		return rc;
+
+	while (count < max_tries) {
+		rc = __read_register(core, HFI_CTRL_STATUS_IRIS33, &ctrl_status);
+		if (rc)
+			return rc;
+
+		rc = __read_register(core, HFI_CTRL_INIT_IRIS33, &ctrl_init_val);
+		if (rc)
+			return rc;
+
+		if ((ctrl_status & HFI_CTRL_ERROR_FATAL) ||
+			(ctrl_status & HFI_CTRL_ERROR_UC_REGION_NOT_SET) ||
+			(ctrl_status & HFI_CTRL_ERROR_HW_FENCE_QUEUE)) {
+			d_vpr_e("%s: boot firmware failed, ctrl status %#x\n",
+				__func__, ctrl_status);
+			return -EINVAL;
+		} else if (ctrl_status & HFI_CTRL_READY) {
+			d_vpr_h("%s: boot firmware is successful, ctrl status %#x\n",
+				__func__, ctrl_status);
+			break;
+		}
+
+		usleep_range(50, 100);
+		count++;
+	}
+
+	if (count >= max_tries) {
+		d_vpr_e("Error booting up vidc firmware, ctrl status %#x, ctrl init %#x\n",
+			ctrl_status, ctrl_init_val);
+		return -ETIME;
+	}
+
+	/* Enable interrupt before sending commands to venus */
+	rc = __write_register(core, CPU_CS_H2XSOFTINTEN_IRIS33, 0x1);
+	if (rc)
+		return rc;
+
+	rc = __write_register(core, CPU_CS_X2RPMh_IRIS33, 0x0);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_decide_work_mode_iris33(struct msm_vidc_inst *inst)
+{
+	u32 work_mode;
+	struct v4l2_format *inp_f;
+	u32 width, height;
+	bool res_ok = false;
+
+	work_mode = MSM_VIDC_STAGE_2;
+	inp_f = &inst->fmts[INPUT_PORT];
+
+	if (is_image_decode_session(inst))
+		work_mode = MSM_VIDC_STAGE_1;
+
+	if (is_image_session(inst))
+		goto exit;
+
+	if (is_decode_session(inst)) {
+		height = inp_f->fmt.pix_mp.height;
+		width = inp_f->fmt.pix_mp.width;
+		res_ok = res_is_less_than(width, height, 1280, 720);
+		if (inst->capabilities[CODED_FRAMES].value ==
+				CODED_FRAMES_INTERLACE ||
+			inst->capabilities[LOWLATENCY_MODE].value ||
+			res_ok) {
+			work_mode = MSM_VIDC_STAGE_1;
+		}
+	} else if (is_encode_session(inst)) {
+		height = inst->crop.height;
+		width = inst->crop.width;
+		res_ok = !res_is_greater_than(width, height, 4096, 2160);
+		if (res_ok &&
+			(inst->capabilities[LOWLATENCY_MODE].value)) {
+			work_mode = MSM_VIDC_STAGE_1;
+		}
+		if (inst->capabilities[SLICE_MODE].value ==
+			V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES) {
+			work_mode = MSM_VIDC_STAGE_1;
+		}
+
+		if (inst->hfi_rc_type == HFI_RC_CBR_CFR ||
+			inst->hfi_rc_type == HFI_RC_CBR_VFR)
+				work_mode = MSM_VIDC_STAGE_1;
+
+		if (inst->capabilities[LOSSLESS].value)
+			work_mode = MSM_VIDC_STAGE_2;
+
+		if (!inst->capabilities[GOP_SIZE].value)
+			work_mode = MSM_VIDC_STAGE_2;
+	} else {
+		i_vpr_e(inst, "%s: invalid session type\n", __func__);
+		return -EINVAL;
+	}
+
+exit:
+	i_vpr_h(inst, "Configuring work mode = %u low latency = %u, gop size = %u\n",
+		work_mode, inst->capabilities[LOWLATENCY_MODE].value,
+		inst->capabilities[GOP_SIZE].value);
+	msm_vidc_update_cap_value(inst, STAGE, work_mode, __func__);
+
+	return 0;
+}
+
+int msm_vidc_decide_work_route_iris33(struct msm_vidc_inst *inst)
+{
+	u32 work_route;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+	work_route = core->capabilities[NUM_VPP_PIPE].value;
+
+	if (is_image_session(inst))
+		goto exit;
+
+	if (is_decode_session(inst)) {
+		if (inst->capabilities[CODED_FRAMES].value ==
+				CODED_FRAMES_INTERLACE)
+			work_route = MSM_VIDC_PIPE_1;
+	} else if (is_encode_session(inst)) {
+		u32 slice_mode;
+
+		slice_mode = inst->capabilities[SLICE_MODE].value;
+
+		/*TODO Pipe=1 for legacy CBR*/
+		if (slice_mode == V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_BYTES)
+			work_route = MSM_VIDC_PIPE_1;
+
+	} else {
+		i_vpr_e(inst, "%s: invalid session type\n", __func__);
+		return -EINVAL;
+	}
+
+exit:
+	i_vpr_h(inst, "Configuring work route = %u", work_route);
+	msm_vidc_update_cap_value(inst, PIPE, work_route, __func__);
+
+	return 0;
+}
+
+int msm_vidc_decide_quality_mode_iris33(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 mbpf, mbps, max_hq_mbpf, max_hq_mbps;
+	u32 mode = MSM_VIDC_POWER_SAVE_MODE;
+
+	if (!is_encode_session(inst))
+		return 0;
+
+	/* image or lossless or all intra runs at quality mode */
+	if (is_image_session(inst) || inst->capabilities[LOSSLESS].value ||
+		inst->capabilities[ALL_INTRA].value) {
+		mode = MSM_VIDC_MAX_QUALITY_MODE;
+		goto decision_done;
+	}
+
+	/* for lesser complexity, make LP for all resolution */
+	if (inst->capabilities[COMPLEXITY].value < DEFAULT_COMPLEXITY) {
+		mode = MSM_VIDC_POWER_SAVE_MODE;
+		goto decision_done;
+	}
+
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	mbps = mbpf * msm_vidc_get_fps(inst);
+	core = inst->core;
+	max_hq_mbpf = core->capabilities[MAX_MBPF_HQ].value;;
+	max_hq_mbps = core->capabilities[MAX_MBPS_HQ].value;;
+
+	if (!is_realtime_session(inst)) {
+		if (((inst->capabilities[COMPLEXITY].flags & CAP_FLAG_CLIENT_SET) &&
+			(inst->capabilities[COMPLEXITY].value >= DEFAULT_COMPLEXITY)) ||
+			mbpf <= max_hq_mbpf) {
+			mode = MSM_VIDC_MAX_QUALITY_MODE;
+			goto decision_done;
+		}
+	}
+
+	if (mbpf <= max_hq_mbpf && mbps <= max_hq_mbps)
+		mode = MSM_VIDC_MAX_QUALITY_MODE;
+
+decision_done:
+	msm_vidc_update_cap_value(inst, QUALITY_MODE, mode, __func__);
+
+	return 0;
+}
+
+int msm_vidc_adjust_bitrate_boost_iris33(void *instance, struct v4l2_ctrl *ctrl)
+{
+	s32 adjusted_value;
+	struct msm_vidc_inst *inst = (struct msm_vidc_inst *)instance;
+	s32 rc_type = -1;
+	u32 width, height, frame_rate;
+	struct v4l2_format *f;
+	u32 max_bitrate = 0, bitrate = 0;
+
+	adjusted_value = ctrl ? ctrl->val :
+		inst->capabilities[BITRATE_BOOST].value;
+
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming)
+		return 0;
+
+	if (msm_vidc_get_parent_value(inst, BITRATE_BOOST,
+		BITRATE_MODE, &rc_type, __func__))
+		return -EINVAL;
+
+	/*
+	 * Bitrate Boost are supported only for VBR rc type.
+	 * Hence, do not adjust or set to firmware for non VBR rc's
+	 */
+	if (rc_type != HFI_RC_VBR_CFR) {
+		adjusted_value = 0;
+		goto adjust;
+	}
+
+	frame_rate = inst->capabilities[FRAME_RATE].value >> 16;
+	f = &inst->fmts[OUTPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	/*
+	 * honor client set bitrate boost
+	 * if client did not set, keep max bitrate boost upto 4k@60fps
+	 * and remove bitrate boost after 4k@60fps
+	 */
+	if (inst->capabilities[BITRATE_BOOST].flags & CAP_FLAG_CLIENT_SET) {
+		/* accept client set bitrate boost value as is */
+	} else {
+		if (res_is_less_than_or_equal_to(width, height, 4096, 2176) &&
+			frame_rate <= 60)
+			adjusted_value = MAX_BITRATE_BOOST;
+		else
+			adjusted_value = 0;
+	}
+
+	max_bitrate = msm_vidc_get_max_bitrate(inst);
+	bitrate = inst->capabilities[BIT_RATE].value;
+	if (adjusted_value) {
+		if ((bitrate + bitrate / (100 / adjusted_value)) > max_bitrate) {
+			i_vpr_h(inst,
+				"%s: bitrate %d is beyond max bitrate %d, remove bitrate boost\n",
+				__func__, max_bitrate, bitrate);
+			adjusted_value = 0;
+		}
+	}
+adjust:
+	msm_vidc_update_cap_value(inst, BITRATE_BOOST, adjusted_value, __func__);
+
+	return 0;
+}
+
+
+
+static struct msm_vidc_venus_ops iris33_ops = {
+	.boot_firmware = __boot_firmware_iris33,
+	.raise_interrupt = __raise_interrupt_iris33,
+	.clear_interrupt = __clear_interrupt_iris33,
+	.power_on = __power_on_iris33,
+	.power_off = __power_off_iris33,
+	.prepare_pc = __prepare_pc_iris33,
+	.watchdog = __watchdog_iris33,
+	.noc_error_info = __noc_error_info_iris33,
+	.switch_gdsc_mode = __switch_gdsc_mode_iris33,
+};
+
+static struct msm_vidc_session_ops msm_session_ops = {
+	.buffer_size = msm_buffer_size_iris33,
+	.min_count = msm_buffer_min_count_iris33,
+	.extra_count = msm_buffer_extra_count_iris33,
+	.ring_buf_count = msm_vidc_ring_buf_count_iris33,
+	.calc_freq = msm_vidc_calc_freq_iris33,
+	.calc_bw = msm_vidc_calc_bw_iris33,
+	.decide_work_route = msm_vidc_decide_work_route_iris33,
+	.decide_work_mode = msm_vidc_decide_work_mode_iris33,
+	.decide_quality_mode = msm_vidc_decide_quality_mode_iris33,
+};
+
+int msm_vidc_init_iris33(struct msm_vidc_core *core)
+{
+	d_vpr_h("%s()\n", __func__);
+	core->venus_ops = &iris33_ops;
+	core->session_ops = &msm_session_ops;
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/variant/iris33/src/msm_vidc_power_iris33.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/variant/iris33/src/msm_vidc_power_iris33.c
@@ -0,0 +1,1366 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_power_iris33.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_debug.h"
+#include "perf_static_model.h"
+#include "msm_vidc_power.h"
+
+#define VPP_MIN_FREQ_MARGIN_PERCENT                   5 /* to be tuned */
+
+static u64 __calculate_decoder(struct vidc_bus_vote_data *d);
+static u64 __calculate_encoder(struct vidc_bus_vote_data *d);
+static u64 __calculate(struct msm_vidc_inst *inst, struct vidc_bus_vote_data *d);
+static u64 msm_vidc_calc_freq_iris33_legacy(struct msm_vidc_inst *inst, u32 data_size);
+
+
+static int msm_vidc_get_hier_layer_val(struct msm_vidc_inst *inst)
+{
+	int hierachical_layer = CODEC_GOP_IPP;
+
+	if (is_encode_session(inst)) {
+		if (inst->capabilities[ALL_INTRA].value) {
+			/* no P and B frames case */
+			hierachical_layer = CODEC_GOP_IONLY;
+		} else if (inst->capabilities[B_FRAME].value == 0) {
+			/* no B frames case */
+			hierachical_layer = CODEC_GOP_IPP;
+		} else { /* P and B frames enabled case */
+			if (inst->capabilities[ENH_LAYER_COUNT].value == 0 ||
+				inst->capabilities[ENH_LAYER_COUNT].value == 1)
+				hierachical_layer = CODEC_GOP_IbP;
+			else if (inst->capabilities[ENH_LAYER_COUNT].value == 2)
+				hierachical_layer = CODEC_GOP_I1B2b1P;
+			else
+				hierachical_layer = CODEC_GOP_I3B4b1P;
+		}
+	}
+
+	return hierachical_layer;
+}
+
+static int msm_vidc_init_codec_input_freq(struct msm_vidc_inst *inst, u32 data_size,
+		struct api_calculation_input *codec_input)
+{
+	enum msm_vidc_port_type port;
+	u32 color_fmt, tile_rows_columns = 0;
+	struct msm_vidc_core *core;
+
+	if (is_encode_session(inst)) {
+		codec_input->decoder_or_encoder = CODEC_ENCODER;
+	} else if (is_decode_session(inst)) {
+		codec_input->decoder_or_encoder = CODEC_DECODER;
+	} else {
+		d_vpr_e("%s: invalid domain %d\n", __func__, inst->domain);
+		return -EINVAL;
+	}
+
+	codec_input->chipset_gen = MSM_PINEAPPLE;
+
+	if (inst->codec == MSM_VIDC_H264) {
+		codec_input->codec    = CODEC_H264;
+		codec_input->lcu_size = 16;
+		if (inst->capabilities[ENTROPY_MODE].value ==
+				V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			codec_input->entropy_coding_mode = CODEC_ENTROPY_CODING_CABAC;
+			codec_input->codec = CODEC_H264;
+		} else {
+			codec_input->entropy_coding_mode = CODEC_ENTROPY_CODING_CAVLC;
+			codec_input->codec = CODEC_H264_CAVLC;
+		}
+	} else if (inst->codec == MSM_VIDC_HEVC) {
+		codec_input->codec    = CODEC_HEVC;
+		codec_input->lcu_size = 32;
+	} else if (inst->codec == MSM_VIDC_VP9) {
+		codec_input->codec    = CODEC_VP9;
+		codec_input->lcu_size = 32;
+	} else if (inst->codec == MSM_VIDC_AV1) {
+		codec_input->codec    = CODEC_AV1;
+		codec_input->lcu_size =
+			inst->capabilities[SUPER_BLOCK].value ? 128 : 64;
+	} else {
+		d_vpr_e("%s: invalid codec %d\n", __func__, inst->codec);
+		return -EINVAL;
+	}
+
+	codec_input->pipe_num = inst->capabilities[PIPE].value;
+	codec_input->frame_rate = inst->max_rate;
+
+	port = is_decode_session(inst) ? INPUT_PORT : OUTPUT_PORT;
+	codec_input->frame_width = inst->fmts[port].fmt.pix_mp.width;
+	codec_input->frame_height = inst->fmts[port].fmt.pix_mp.height;
+
+	if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_1) {
+		codec_input->vsp_vpp_mode = CODEC_VSPVPP_MODE_1S;
+	} else if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_2) {
+		codec_input->vsp_vpp_mode = CODEC_VSPVPP_MODE_2S;
+	} else {
+		d_vpr_e("%s: invalid stage %d\n", __func__,
+				inst->capabilities[STAGE].value);
+		return -EINVAL;
+	}
+
+	if (inst->capabilities[BIT_DEPTH].value == BIT_DEPTH_8)
+		codec_input->bitdepth = CODEC_BITDEPTH_8;
+	else
+		codec_input->bitdepth = CODEC_BITDEPTH_10;
+
+	codec_input->hierachical_layer =
+		msm_vidc_get_hier_layer_val(inst);
+
+	if (is_decode_session(inst))
+		color_fmt = v4l2_colorformat_to_driver(inst,
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+	else
+		color_fmt = v4l2_colorformat_to_driver(inst,
+			inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+
+	codec_input->linear_opb = is_linear_colorformat(color_fmt);
+
+	if (is_decode_session(inst))
+		codec_input->bitrate_mbps =
+			(codec_input->frame_rate * data_size * 8) / 1000000;
+	else
+		codec_input->bitrate_mbps =
+			inst->capabilities[BIT_RATE].value / 1000000;
+
+	/* av1d commercial tile */
+	if (inst->codec == MSM_VIDC_AV1 && codec_input->lcu_size == 128) {
+		tile_rows_columns = inst->power.fw_av1_tile_rows *
+			inst->power.fw_av1_tile_columns;
+
+		/* check resolution and tile info */
+		codec_input->av1d_commer_tile_enable = 1;
+
+		if (res_is_less_than_or_equal_to(codec_input->frame_width,
+				codec_input->frame_height, 1920, 1088)) {
+			if (tile_rows_columns <= 2)
+				codec_input->av1d_commer_tile_enable = 0;
+		} else if (res_is_less_than_or_equal_to(codec_input->frame_width,
+				codec_input->frame_height, 4096, 2172)) {
+			if (tile_rows_columns <= 4)
+				codec_input->av1d_commer_tile_enable = 0;
+		} else if (res_is_less_than_or_equal_to(codec_input->frame_width,
+				codec_input->frame_height, 8192, 4320)) {
+			if (tile_rows_columns <= 16)
+				codec_input->av1d_commer_tile_enable = 0;
+		}
+	} else {
+		codec_input->av1d_commer_tile_enable = 0;
+	}
+
+	/* set as sanity mode, this regression mode has no effect on power calculations */
+	codec_input->regression_mode = REGRESSION_MODE_SANITY;
+
+	core = inst->core;
+	codec_input->vpu_ver = core->platform->data.vpu_ver;
+
+	return 0;
+}
+
+static int msm_vidc_init_codec_input_bus(struct msm_vidc_inst *inst, struct vidc_bus_vote_data *d,
+		struct api_calculation_input *codec_input)
+{
+	u32 complexity_factor_int = 0, complexity_factor_frac = 0, tile_rows_columns = 0;
+	bool opb_compression_enabled = false;
+	struct msm_vidc_core *core;
+
+	if (!d)
+		return -EINVAL;
+
+	if (d->domain == MSM_VIDC_ENCODER) {
+		codec_input->decoder_or_encoder = CODEC_ENCODER;
+	} else if (d->domain == MSM_VIDC_DECODER) {
+		codec_input->decoder_or_encoder = CODEC_DECODER;
+	} else {
+		d_vpr_e("%s: invalid domain %d\n", __func__, d->domain);
+		return -EINVAL;
+	}
+
+	codec_input->chipset_gen = MSM_PINEAPPLE;
+
+	if (d->codec == MSM_VIDC_H264) {
+		if (inst->capabilities[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			codec_input->entropy_coding_mode = CODEC_ENTROPY_CODING_CABAC;
+			codec_input->codec = CODEC_H264;
+		} else if (inst->capabilities[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC) {
+			codec_input->entropy_coding_mode = CODEC_ENTROPY_CODING_CAVLC;
+			codec_input->codec = CODEC_H264_CAVLC;
+		} else {
+			d_vpr_e("%s: invalid entropy %d\n", __func__,
+				inst->capabilities[ENTROPY_MODE].value);
+			return -EINVAL;
+		}
+	} else if (d->codec == MSM_VIDC_HEVC) {
+		codec_input->codec = CODEC_HEVC;
+	} else if (d->codec == MSM_VIDC_VP9) {
+		codec_input->codec = CODEC_VP9;
+	} else if (d->codec == MSM_VIDC_AV1) {
+		codec_input->codec = CODEC_AV1;
+	} else {
+		d_vpr_e("%s: invalid codec %d\n", __func__, d->codec);
+		return -EINVAL;
+	}
+
+	codec_input->lcu_size = d->lcu_size;
+	codec_input->pipe_num = d->num_vpp_pipes;
+	codec_input->frame_rate = d->fps;
+	codec_input->frame_width = d->input_width;
+	codec_input->frame_height = d->input_height;
+
+	if (d->work_mode == MSM_VIDC_STAGE_1) {
+		codec_input->vsp_vpp_mode = CODEC_VSPVPP_MODE_1S;
+	} else if (d->work_mode == MSM_VIDC_STAGE_2) {
+		codec_input->vsp_vpp_mode = CODEC_VSPVPP_MODE_2S;
+	} else {
+		d_vpr_e("%s: invalid stage %d\n", __func__, d->work_mode);
+		return -EINVAL;
+	}
+
+	codec_input->hierachical_layer =
+		msm_vidc_get_hier_layer_val(inst);
+
+	/*
+	 * If the calculated motion_vector_complexity is > 2 then set the
+	 * complexity_setting and refframe_complexity to be pwc(performance worst case)
+	 * values. If the motion_vector_complexity is < 2 then set the complexity_setting
+	 * and refframe_complexity to be average case values.
+	 */
+
+	complexity_factor_int = Q16_INT(d->complexity_factor);
+	complexity_factor_frac = Q16_FRAC(d->complexity_factor);
+
+	if (complexity_factor_int < COMPLEXITY_THRESHOLD ||
+		(complexity_factor_int == COMPLEXITY_THRESHOLD &&
+		complexity_factor_frac == 0)) {
+		/* set as average case values */
+		codec_input->complexity_setting = COMPLEXITY_SETTING_AVG;
+		codec_input->refframe_complexity = REFFRAME_COMPLEXITY_AVG;
+	} else {
+		/* set as pwc */
+		codec_input->complexity_setting = COMPLEXITY_SETTING_PWC;
+		codec_input->refframe_complexity = REFFRAME_COMPLEXITY_PWC;
+	}
+
+	codec_input->status_llc_onoff = d->use_sys_cache;
+
+	if (__bpp(d->color_formats[0]) == 8)
+		codec_input->bitdepth = CODEC_BITDEPTH_8;
+	else
+		codec_input->bitdepth = CODEC_BITDEPTH_10;
+
+	if (d->num_formats == 1) {
+		codec_input->split_opb = 0;
+		codec_input->linear_opb = !__ubwc(d->color_formats[0]);
+	} else if (d->num_formats == 2) {
+		codec_input->split_opb = 1;
+		codec_input->linear_opb = !__ubwc(d->color_formats[1]);
+	} else {
+		d_vpr_e("%s: invalid num_formats %d\n",
+			__func__, d->num_formats);
+		return -EINVAL;
+	}
+
+	codec_input->linear_ipb = 0;   /* set as ubwc ipb */
+
+	/* TODO Confirm if we always LOSSLESS mode ie lossy_ipb = 0*/
+	codec_input->lossy_ipb = 0;   /* set as lossless ipb */
+
+	/* TODO Confirm if no multiref */
+	codec_input->encoder_multiref = 0;  /* set as no multiref */
+	codec_input->bitrate_mbps = (d->bitrate / 1000000);
+
+	opb_compression_enabled = d->num_formats >= 2 && __ubwc(d->color_formats[1]);
+
+	/* video driver CR is in Q16 format, StaticModel CR in x100 format */
+	if (d->domain == MSM_VIDC_DECODER) {
+		codec_input->cr_dpb = ((Q16_INT(d->compression_ratio)*100) +
+			Q16_FRAC(d->compression_ratio));
+		codec_input->cr_opb = codec_input->cr_dpb;
+		if (codec_input->split_opb == 1) {
+			/* need to check the value if linear opb, currently set min cr */
+			codec_input->cr_opb = 100;
+		}
+	} else {
+		codec_input->cr_ipb = ((Q16_INT(d->input_cr)*100) + Q16_FRAC(d->input_cr));
+		codec_input->cr_rpb = ((Q16_INT(d->compression_ratio)*100) +
+			Q16_FRAC(d->compression_ratio));
+	}
+
+	/* disable by default, only enable for aurora depth map session */
+	codec_input->lumaonly_decode = 0;
+
+	/* set as custom regression mode, as are using cr,cf values from FW */
+	codec_input->regression_mode = REGRESSION_MODE_CUSTOM;
+
+	/* av1d commercial tile */
+	if (inst->codec == MSM_VIDC_AV1 && codec_input->lcu_size == 128) {
+		tile_rows_columns = inst->power.fw_av1_tile_rows *
+			inst->power.fw_av1_tile_columns;
+
+		/* check resolution and tile info */
+		codec_input->av1d_commer_tile_enable = 1;
+
+		if (res_is_less_than_or_equal_to(codec_input->frame_width,
+				codec_input->frame_height, 1920, 1088)) {
+			if (tile_rows_columns <= 2)
+				codec_input->av1d_commer_tile_enable = 0;
+		} else if (res_is_less_than_or_equal_to(codec_input->frame_width,
+				codec_input->frame_height, 4096, 2172)) {
+			if (tile_rows_columns <= 4)
+				codec_input->av1d_commer_tile_enable = 0;
+		} else if (res_is_less_than_or_equal_to(codec_input->frame_width,
+				codec_input->frame_height, 8192, 4320)) {
+			if (tile_rows_columns <= 16)
+				codec_input->av1d_commer_tile_enable = 0;
+		}
+	} else {
+		codec_input->av1d_commer_tile_enable = 0;
+	}
+
+	core = inst->core;
+	codec_input->vpu_ver = core->platform->data.vpu_ver;
+
+	/* Dump all the variables for easier debugging */
+	if (msm_vidc_debug & VIDC_BUS) {
+		struct dump dump[] = {
+		{"complexity_factor_int", "%d", complexity_factor_int},
+		{"complexity_factor_frac", "%d", complexity_factor_frac},
+		{"refframe_complexity", "%d", codec_input->refframe_complexity},
+		{"complexity_setting", "%d", codec_input->complexity_setting},
+		{"cr_dpb", "%d", codec_input->cr_dpb},
+		{"cr_opb", "%d", codec_input->cr_opb},
+		{"cr_ipb", "%d", codec_input->cr_ipb},
+		{"cr_rpb", "%d", codec_input->cr_rpb},
+		{"lcu size", "%d", codec_input->lcu_size},
+		{"pipe number", "%d", codec_input->pipe_num},
+		{"frame_rate", "%d", codec_input->frame_rate},
+		{"frame_width", "%d", codec_input->frame_width},
+		{"frame_height", "%d", codec_input->frame_height},
+		{"work_mode", "%d", d->work_mode},
+		{"encoder_or_decode", "%d", inst->domain},
+		{"chipset_gen", "%d", codec_input->chipset_gen},
+		{"codec_input", "%d", codec_input->codec},
+		{"entropy_coding_mode", "%d", codec_input->entropy_coding_mode},
+		{"hierachical_layer", "%d", codec_input->hierachical_layer},
+		{"status_llc_onoff", "%d", codec_input->status_llc_onoff},
+		{"bit_depth", "%d", codec_input->bitdepth},
+		{"split_opb", "%d", codec_input->split_opb},
+		{"linear_opb", "%d", codec_input->linear_opb},
+		{"linear_ipb", "%d", codec_input->linear_ipb},
+		{"lossy_ipb", "%d", codec_input->lossy_ipb},
+		{"encoder_multiref", "%d", codec_input->encoder_multiref},
+		{"bitrate_mbps", "%d", codec_input->bitrate_mbps},
+		{"lumaonly_decode", "%d", codec_input->lumaonly_decode},
+		{"av1d_commer_tile_enable", "%d", codec_input->av1d_commer_tile_enable},
+		{"regression_mode", "%d", codec_input->regression_mode},
+		{"vpu_ver", "%d", codec_input->vpu_ver},
+		};
+		__dump(dump, ARRAY_SIZE(dump));
+	}
+
+	return 0;
+}
+
+static bool is_vpp_cycles_close_to_freq_corner(struct msm_vidc_core *core,
+	u64 vpp_min_freq)
+{
+	u64 margin_freq = 0;
+	u64 closest_freq_upper_corner = 0;
+	u32 margin_percent = 0;
+	int i = 0;
+
+	if (!core || !core->resource || !core->resource->freq_set.freq_tbl ||
+		!core->resource->freq_set.count) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return false;
+	}
+
+	vpp_min_freq = vpp_min_freq * 1000000; /* convert to hz */
+
+	closest_freq_upper_corner =
+		core->resource->freq_set.freq_tbl[0].freq;
+
+	/* return true if vpp_min_freq is more than max frequency */
+	if (vpp_min_freq > closest_freq_upper_corner)
+		return true;
+
+	/* get the closest freq corner for vpp_min_freq */
+	for (i = 0; i < core->resource->freq_set.count; i++) {
+		if (vpp_min_freq <=
+			core->resource->freq_set.freq_tbl[i].freq) {
+			closest_freq_upper_corner =
+				core->resource->freq_set.freq_tbl[i].freq;
+		} else {
+			break;
+		}
+	}
+
+	margin_freq = closest_freq_upper_corner - vpp_min_freq;
+	margin_percent = div_u64((margin_freq * 100), closest_freq_upper_corner);
+
+	/* check if margin is less than cutoff */
+	if (margin_percent < VPP_MIN_FREQ_MARGIN_PERCENT)
+		return true;
+
+	return false;
+}
+
+static u64 msm_vidc_calc_freq_iris33_new(struct msm_vidc_inst *inst, u32 data_size)
+{
+	u64 freq = 0;
+	struct msm_vidc_core *core;
+	int ret = 0;
+	struct api_calculation_input codec_input;
+	struct api_calculation_freq_output codec_output;
+	u32 fps, mbpf;
+
+	core = inst->core;
+
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	fps = inst->max_rate;
+
+	memset(&codec_input, 0, sizeof(struct api_calculation_input));
+	memset(&codec_output, 0, sizeof(struct api_calculation_freq_output));
+	ret = msm_vidc_init_codec_input_freq(inst, data_size, &codec_input);
+	if (ret)
+		return freq;
+	ret = msm_vidc_calculate_frequency(codec_input, &codec_output);
+	if (ret)
+		return freq;
+
+	if (is_encode_session(inst)) {
+		if (!inst->capabilities[ENC_RING_BUFFER_COUNT].value &&
+			is_vpp_cycles_close_to_freq_corner(core,
+				codec_output.vpp_min_freq)) {
+			/*
+			 * if ring buffer not enabled and required vpp cycles
+			 * is too close to the frequency corner then increase
+			 * the vpp cycles by VPP_MIN_FREQ_MARGIN_PERCENT
+			 */
+			codec_output.vpp_min_freq += div_u64(
+				codec_output.vpp_min_freq *
+				VPP_MIN_FREQ_MARGIN_PERCENT, 100);
+			codec_output.hw_min_freq = max(
+				codec_output.hw_min_freq,
+				codec_output.vpp_min_freq);
+		}
+	}
+
+	freq = (u64)codec_output.hw_min_freq * 1000000; /* Convert to Hz */
+
+	i_vpr_p(inst,
+		"%s: filled len %d, required freq %llu, vpp %u, vsp %u, tensilica %u, hw_freq %u, fps %u, mbpf %u\n",
+		__func__, data_size, freq, codec_output.vpp_min_freq,
+		codec_output.vsp_min_freq, codec_output.tensilica_min_freq,
+		codec_output.hw_min_freq, fps, mbpf);
+
+	if (!is_realtime_session(inst) ||
+	    inst->codec == MSM_VIDC_AV1 ||
+	    is_lowlatency_session(inst) ||
+	    (inst->iframe && is_hevc_10bit_decode_session(inst))) {
+		/*
+		 * TURBO is only allowed for:
+		 * - NRT decoding/encoding session
+		 * - AV1 decoding session
+		 * - Low latency session
+		 * - 10-bit I-Frame decoding session
+		 * limit to NOM for all other cases
+		 */
+	} else {
+		/* limit to NOM, index 0 is TURBO, index 1 is NOM clock rate */
+		if (core->resource->freq_set.count >= 2 &&
+				freq > core->resource->freq_set.freq_tbl[1].freq)
+			freq = core->resource->freq_set.freq_tbl[1].freq;
+	}
+
+	return freq;
+}
+
+static int msm_vidc_calc_bw_iris33_new(struct msm_vidc_inst *inst,
+		struct vidc_bus_vote_data *vidc_data)
+{
+	u32 ret = 0;
+	struct api_calculation_input codec_input;
+	struct api_calculation_bw_output codec_output;
+
+	memset(&codec_input, 0, sizeof(struct api_calculation_input));
+	memset(&codec_output, 0, sizeof(struct api_calculation_bw_output));
+
+	ret = msm_vidc_init_codec_input_bus(inst, vidc_data, &codec_input);
+	if (ret)
+		return ret;
+	ret = msm_vidc_calculate_bandwidth(codec_input, &codec_output);
+	if (ret)
+		return ret;
+
+	vidc_data->calc_bw_ddr = kbps(codec_output.ddr_bw_rd + codec_output.ddr_bw_wr);
+	vidc_data->calc_bw_llcc = kbps(codec_output.noc_bw_rd + codec_output.noc_bw_wr);
+
+	i_vpr_l(inst, "%s: calc_bw_ddr %lu calc_bw_llcc %lu",
+		__func__, vidc_data->calc_bw_ddr, vidc_data->calc_bw_llcc);
+
+	return ret;
+}
+
+u64 msm_vidc_calc_freq_iris33(struct msm_vidc_inst *inst, u32 data_size)
+{
+	u64 freq = 0;
+
+	if (ENABLE_LEGACY_POWER_CALCULATIONS)
+		freq = msm_vidc_calc_freq_iris33_legacy(inst, data_size);
+	else
+		freq = msm_vidc_calc_freq_iris33_new(inst, data_size);
+
+	return freq;
+}
+
+u64 msm_vidc_calc_freq_iris33_legacy(struct msm_vidc_inst *inst, u32 data_size)
+{
+	u64 freq = 0;
+	struct msm_vidc_core *core;
+	u64 vsp_cycles = 0, vpp_cycles = 0, fw_cycles = 0;
+	u64 fw_vpp_cycles = 0, bitrate = 0;
+	u32 vpp_cycles_per_mb;
+	u32 mbs_per_second;
+	u32 operating_rate, vsp_factor_num = 1, vsp_factor_den = 1;
+	u32 base_cycles = 0;
+	u32 fps, mbpf;
+
+	core = inst->core;
+
+	if (!core->resource || !core->resource->freq_set.freq_tbl ||
+		!core->resource->freq_set.count) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return freq;
+	}
+
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	fps = inst->max_rate;
+	mbs_per_second = mbpf * fps;
+
+	/*
+	 * Calculate vpp, vsp, fw cycles separately for encoder and decoder.
+	 * Even though, most part is common now, in future it may change
+	 * between them.
+	 */
+	fw_cycles = fps * inst->capabilities[MB_CYCLES_FW].value;
+	fw_vpp_cycles = fps * inst->capabilities[MB_CYCLES_FW_VPP].value;
+
+	if (is_encode_session(inst)) {
+		vpp_cycles_per_mb = is_low_power_session(inst) ?
+			inst->capabilities[MB_CYCLES_LP].value :
+			inst->capabilities[MB_CYCLES_VPP].value;
+
+		vpp_cycles = mbs_per_second * vpp_cycles_per_mb /
+			inst->capabilities[PIPE].value;
+
+		/* Factor 1.25 for IbP and 1.375 for I1B2b1P GOP structure */
+		if (inst->capabilities[B_FRAME].value > 1)
+			vpp_cycles += (vpp_cycles / 4) + (vpp_cycles / 8);
+		else if (inst->capabilities[B_FRAME].value)
+			vpp_cycles += vpp_cycles / 4;
+		/* 21 / 20 is minimum overhead factor */
+		vpp_cycles += max(div_u64(vpp_cycles, 20), fw_vpp_cycles);
+		/* 1.01 is multi-pipe overhead */
+		if (inst->capabilities[PIPE].value > 1)
+			vpp_cycles += div_u64(vpp_cycles, 100);
+		/*
+		 * 1080p@480fps usecase needs exactly 338MHz
+		 * without any margin left. Hence, adding 2 percent
+		 * extra to bump it to next level (366MHz).
+		 */
+		if (fps == 480)
+			vpp_cycles += div_u64(vpp_cycles * 2, 100);
+
+		/*
+		 * Add 5 percent extra for 720p@960fps use case
+		 * to bump it to next level (366MHz).
+		 */
+		if (fps == 960)
+			vpp_cycles += div_u64(vpp_cycles * 5, 100);
+
+		/* increase vpp_cycles by 50% for preprocessing */
+		if (inst->capabilities[REQUEST_PREPROCESS].value)
+			vpp_cycles = vpp_cycles + vpp_cycles / 2;
+
+		/* VSP */
+		/* bitrate is based on fps, scale it using operating rate */
+		operating_rate = inst->capabilities[OPERATING_RATE].value >> 16;
+		if (operating_rate >
+			(inst->capabilities[FRAME_RATE].value >> 16) &&
+			(inst->capabilities[FRAME_RATE].value >> 16)) {
+			vsp_factor_num = operating_rate;
+			vsp_factor_den = inst->capabilities[FRAME_RATE].value >> 16;
+		}
+		vsp_cycles = div_u64(((u64)inst->capabilities[BIT_RATE].value *
+					vsp_factor_num), vsp_factor_den);
+
+		base_cycles = inst->capabilities[MB_CYCLES_VSP].value;
+		if (inst->codec == MSM_VIDC_VP9) {
+			vsp_cycles = div_u64(vsp_cycles * 170, 100);
+		} else if (inst->capabilities[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+			vsp_cycles = div_u64(vsp_cycles * 135, 100);
+		} else {
+			base_cycles = 0;
+			vsp_cycles = div_u64(vsp_cycles, 2);
+		}
+		/* VSP FW Overhead 1.05 */
+		vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+		if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_1)
+			vsp_cycles = vsp_cycles * 3;
+
+		vsp_cycles += mbs_per_second * base_cycles;
+
+	} else if (is_decode_session(inst)) {
+		/* VPP */
+		vpp_cycles = mbs_per_second * inst->capabilities[MB_CYCLES_VPP].value /
+			inst->capabilities[PIPE].value;
+		/* 21 / 20 is minimum overhead factor */
+		vpp_cycles += max(vpp_cycles / 20, fw_vpp_cycles);
+		if (inst->capabilities[PIPE].value > 1) {
+			if (inst->codec == MSM_VIDC_AV1) {
+				/*
+				 * Additional vpp_cycles are required for bitstreams with
+				 * 128x128 superblock and non-recommended tile settings.
+				 * recommended tiles: 1080P_V2XH1, UHD_V2X2, 8KUHD_V8X2
+				 * non-recommended tiles: 1080P_V4XH2_V4X1, UHD_V8X4_V8X1,
+				 * 8KUHD_V8X8_V8X1
+				 */
+				if (inst->capabilities[SUPER_BLOCK].value)
+					vpp_cycles += div_u64(vpp_cycles * 1464, 1000);
+				else
+					vpp_cycles += div_u64(vpp_cycles * 410, 1000);
+			} else {
+				/* 1.059 is multi-pipe overhead */
+				vpp_cycles += div_u64(vpp_cycles * 59, 1000);
+			}
+		}
+
+		/* VSP */
+		if (inst->codec == MSM_VIDC_AV1) {
+			/*
+			 * For AV1: Use VSP calculations from Lanai perf model.
+			 * For legacy codecs, use vsp_cycles based on legacy MB_CYCLES_VSP.
+			 */
+			u32 decoder_vsp_fw_overhead = 105;
+			u32 fw_sw_vsp_offset = 1055;
+			u64 vsp_hw_min_frequency = 0;
+			u32 input_bitrate_mbps = 0;
+			u32 bitrate_2stage[2] = {130, 120};
+			u32 bitrate_1stage = 100;
+			u32 width, height;
+			u32 bitrate_entry, freq_entry, freq_tbl_value;
+			struct frequency_table *freq_tbl;
+			struct v4l2_format *out_f = &inst->fmts[OUTPUT_PORT];
+
+			width = out_f->fmt.pix_mp.width;
+			height = out_f->fmt.pix_mp.height;
+
+			bitrate_entry = 1;
+			/* 8KUHD60, UHD240, 1080p960 */
+			if (width * height * fps >= 3840 * 2160 * 240)
+				bitrate_entry = 0;
+
+			freq_entry = bitrate_entry;
+
+			freq_tbl = core->resource->freq_set.freq_tbl;
+			freq_tbl_value = freq_tbl[freq_entry].freq / 1000000;
+
+			input_bitrate_mbps = fps * data_size * 8 / (1024 * 1024);
+			vsp_hw_min_frequency = freq_tbl_value * 1000 * input_bitrate_mbps;
+
+			if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_2) {
+				vsp_hw_min_frequency +=
+					(bitrate_2stage[bitrate_entry] * fw_sw_vsp_offset - 1);
+				vsp_hw_min_frequency = div_u64(vsp_hw_min_frequency,
+					(bitrate_2stage[bitrate_entry] * fw_sw_vsp_offset));
+				/* VSP fw overhead 1.05 */
+				vsp_hw_min_frequency = div_u64(vsp_hw_min_frequency *
+					decoder_vsp_fw_overhead + 99, 100);
+			} else {
+				vsp_hw_min_frequency += (bitrate_1stage * fw_sw_vsp_offset - 1);
+				vsp_hw_min_frequency = div_u64(vsp_hw_min_frequency,
+					(bitrate_1stage * fw_sw_vsp_offset));
+			}
+
+			vsp_cycles = vsp_hw_min_frequency * 1000000;
+		} else {
+			base_cycles = inst->has_bframe ?
+					80 : inst->capabilities[MB_CYCLES_VSP].value;
+			bitrate = fps * data_size * 8;
+			vsp_cycles = bitrate;
+
+			if (inst->codec == MSM_VIDC_VP9) {
+				vsp_cycles = div_u64(vsp_cycles * 170, 100);
+			} else if (inst->capabilities[ENTROPY_MODE].value ==
+				V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC) {
+				vsp_cycles = div_u64(vsp_cycles * 135, 100);
+			} else {
+				base_cycles = 0;
+				vsp_cycles = div_u64(vsp_cycles, 2);
+			}
+			/* VSP FW overhead 1.05 */
+			vsp_cycles = div_u64(vsp_cycles * 21, 20);
+
+			if (inst->capabilities[STAGE].value == MSM_VIDC_STAGE_1)
+				vsp_cycles = vsp_cycles * 3;
+
+			vsp_cycles += mbs_per_second * base_cycles;
+
+			/* Add 25 percent extra for 960fps use case */
+			if (fps >= 960)
+				vsp_cycles += div_u64(vpp_cycles * 25, 100);
+
+			/* Add 25 percent extra for HEVC 10bit all intra use case */
+			if (inst->iframe && is_hevc_10bit_decode_session(inst))
+				vsp_cycles += div_u64(vsp_cycles * 25, 100);
+
+			if (inst->codec == MSM_VIDC_VP9 &&
+					inst->capabilities[STAGE].value ==
+						MSM_VIDC_STAGE_2 &&
+					inst->capabilities[PIPE].value == 4 &&
+					bitrate > 90000000)
+				vsp_cycles = msm_vidc_max_freq(inst);
+		}
+	} else {
+		i_vpr_e(inst, "%s: Unknown session type\n", __func__);
+		return msm_vidc_max_freq(inst);
+	}
+
+	freq = max(vpp_cycles, vsp_cycles);
+	freq = max(freq, fw_cycles);
+
+	i_vpr_p(inst,
+		"%s: filled len %d, required freq %llu, vpp %llu, vsp %llu, fw_cycles %llu, fps %u, mbpf %u\n",
+		__func__, data_size, freq,
+		vpp_cycles, vsp_cycles, fw_cycles, fps, mbpf);
+
+	if (inst->codec == MSM_VIDC_AV1 || (inst->iframe && is_hevc_10bit_decode_session(inst)) ||
+			(!is_realtime_session(inst))) {
+		/*
+		 * TURBO is only allowed for:
+		 *     1. AV1 decoding session
+		 *     2. 10-bit I-Frame decoding session
+		 *     3. NRT decoding/encoding session
+		 * limit to NOM for all other cases
+		 */
+	} else {
+		/* limit to NOM, index 0 is TURBO, index 1 is NOM clock rate */
+		if (core->resource->freq_set.count >= 2 &&
+				freq > core->resource->freq_set.freq_tbl[1].freq)
+			freq = core->resource->freq_set.freq_tbl[1].freq;
+	}
+
+	return freq;
+}
+
+static u64 __calculate_decoder(struct vidc_bus_vote_data *d)
+{
+	/*
+	 * XXX: Don't fool around with any of the hardcoded numbers unless you
+	 * know /exactly/ what you're doing.  Many of these numbers are
+	 * measured heuristics and hardcoded numbers taken from the firmware.
+	 */
+	/* Decoder parameters */
+	int width, height, lcu_size, fps, dpb_bpp;
+	bool unified_dpb_opb, dpb_compression_enabled = true,
+		opb_compression_enabled = false,
+		llc_ref_read_l2_cache_enabled = false,
+		llc_top_line_buf_enabled = false;
+	fp_t dpb_read_compression_factor, dpb_opb_scaling_ratio,
+		dpb_write_compression_factor, opb_write_compression_factor,
+		qsmmu_bw_overhead_factor;
+	bool is_h264_category = (d->codec == MSM_VIDC_H264) ? true : false;
+
+	/* Derived parameters */
+	int lcu_per_frame, collocated_bytes_per_lcu, tnbr_per_lcu;
+	unsigned long bitrate;
+
+	fp_t bins_to_bit_factor, vsp_read_factor, vsp_write_factor,
+		dpb_factor, dpb_write_factor, y_bw_no_ubwc_8bpp;
+	fp_t y_bw_no_ubwc_10bpp = 0, y_bw_10bpp_p010 = 0,
+	     motion_vector_complexity = 0;
+	fp_t	dpb_total = 0;
+
+	/* Output parameters */
+	struct {
+		fp_t vsp_read, vsp_write, collocated_read, collocated_write,
+			dpb_read, dpb_write, opb_read, opb_write,
+			line_buffer_read, line_buffer_write,
+			total;
+	} ddr = {0};
+
+	struct {
+		fp_t dpb_read, line_buffer_read, line_buffer_write, total;
+	} llc = {0};
+
+	unsigned long ret = 0;
+	unsigned int integer_part, frac_part;
+
+	width = max(d->input_width, BASELINE_DIMENSIONS.width);
+	height = max(d->input_height, BASELINE_DIMENSIONS.height);
+
+	fps = d->fps;
+
+	lcu_size = d->lcu_size;
+
+	dpb_bpp = __bpp(d->color_formats[0]);
+
+	unified_dpb_opb = d->num_formats == 1;
+
+	dpb_opb_scaling_ratio = fp_div(FP_INT(d->input_width * d->input_height),
+		FP_INT(d->output_width * d->output_height));
+
+	opb_compression_enabled = d->num_formats >= 2 &&
+		__ubwc(d->color_formats[1]);
+
+	integer_part = Q16_INT(d->compression_ratio);
+	frac_part = Q16_FRAC(d->compression_ratio);
+	dpb_read_compression_factor = FP(integer_part, frac_part, 100);
+
+	integer_part = Q16_INT(d->complexity_factor);
+	frac_part = Q16_FRAC(d->complexity_factor);
+	motion_vector_complexity = FP(integer_part, frac_part, 100);
+
+	dpb_write_compression_factor = dpb_read_compression_factor;
+	opb_write_compression_factor = opb_compression_enabled ?
+		dpb_write_compression_factor : FP_ONE;
+
+	if (d->use_sys_cache) {
+		llc_ref_read_l2_cache_enabled = true;
+		if (is_h264_category)
+			llc_top_line_buf_enabled = true;
+	}
+
+	/* Derived parameters setup */
+	lcu_per_frame = DIV_ROUND_UP(width, lcu_size) *
+		DIV_ROUND_UP(height, lcu_size);
+
+	bitrate = DIV_ROUND_UP(d->bitrate, 1000000);
+
+	bins_to_bit_factor = FP_INT(4);
+
+	vsp_write_factor = bins_to_bit_factor;
+	vsp_read_factor = bins_to_bit_factor + FP_INT(2);
+
+	collocated_bytes_per_lcu = lcu_size == 16 ? 16 :
+				lcu_size == 32 ? 64 : 256;
+
+	if (d->codec == MSM_VIDC_AV1) {
+		collocated_bytes_per_lcu = 4 * 512; /* lcu_size = 128 */
+		if (lcu_size == 32)
+			collocated_bytes_per_lcu = 4 * 512 / (128 * 128 / 32 / 32);
+		else if (lcu_size == 64)
+			collocated_bytes_per_lcu = 4 * 512 / (128 * 128 / 64 / 64);
+	}
+
+	dpb_factor = FP(1, 50, 100);
+	dpb_write_factor = FP(1, 5, 100);
+
+	tnbr_per_lcu = lcu_size == 16 ? 128 :
+		lcu_size == 32 ? 64 : 128;
+
+	/* .... For DDR & LLC  ...... */
+	ddr.vsp_read = fp_div(fp_mult(FP_INT(bitrate),
+				vsp_read_factor), FP_INT(8));
+	ddr.vsp_write = fp_div(fp_mult(FP_INT(bitrate),
+				vsp_write_factor), FP_INT(8));
+
+	ddr.collocated_read = fp_div(FP_INT(lcu_per_frame *
+			collocated_bytes_per_lcu * fps), FP_INT(bps(1)));
+	ddr.collocated_write = ddr.collocated_read;
+
+	y_bw_no_ubwc_8bpp = fp_div(FP_INT(width * height * fps),
+		FP_INT(1000 * 1000));
+
+	if (dpb_bpp != 8) {
+		y_bw_no_ubwc_10bpp =
+			fp_div(fp_mult(y_bw_no_ubwc_8bpp, FP_INT(256)),
+				FP_INT(192));
+		y_bw_10bpp_p010 = y_bw_no_ubwc_8bpp * 2;
+	}
+
+	ddr.dpb_read = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	ddr.dpb_read = fp_div(fp_mult(ddr.dpb_read,
+			fp_mult(dpb_factor, motion_vector_complexity)),
+			dpb_read_compression_factor);
+
+	ddr.dpb_write = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	ddr.dpb_write = fp_div(fp_mult(ddr.dpb_write,
+			fp_mult(dpb_factor, dpb_write_factor)),
+			dpb_write_compression_factor);
+
+	dpb_total = ddr.dpb_read + ddr.dpb_write;
+
+	if (llc_ref_read_l2_cache_enabled) {
+		ddr.dpb_read = fp_div(ddr.dpb_read, is_h264_category ?
+					FP(1, 30, 100) : FP(1, 14, 100));
+		llc.dpb_read = dpb_total - ddr.dpb_write - ddr.dpb_read;
+	}
+
+	ddr.opb_read = FP_ZERO;
+	ddr.opb_write = unified_dpb_opb ? FP_ZERO : (dpb_bpp == 8 ?
+		y_bw_no_ubwc_8bpp : (opb_compression_enabled ?
+		y_bw_no_ubwc_10bpp : y_bw_10bpp_p010));
+	ddr.opb_write = fp_div(fp_mult(dpb_factor, ddr.opb_write),
+		fp_mult(dpb_opb_scaling_ratio, opb_write_compression_factor));
+
+	ddr.line_buffer_read =
+		fp_div(FP_INT(tnbr_per_lcu * lcu_per_frame * fps),
+			FP_INT(bps(1)));
+
+	if (is_h264_category)
+		ddr.line_buffer_write = fp_div(ddr.line_buffer_read, FP_INT(2));
+	else
+		ddr.line_buffer_write = ddr.line_buffer_read;
+	if (llc_top_line_buf_enabled) {
+		llc.line_buffer_read = ddr.line_buffer_read;
+		llc.line_buffer_write = ddr.line_buffer_write;
+		ddr.line_buffer_write = ddr.line_buffer_read = FP_ZERO;
+	}
+
+	ddr.total = ddr.vsp_read + ddr.vsp_write +
+		ddr.collocated_read + ddr.collocated_write +
+		ddr.dpb_read + ddr.dpb_write +
+		ddr.opb_read + ddr.opb_write +
+		ddr.line_buffer_read + ddr.line_buffer_write;
+
+	qsmmu_bw_overhead_factor = FP(1, 3, 100);
+
+	ddr.total = fp_mult(ddr.total, qsmmu_bw_overhead_factor);
+	llc.total = llc.dpb_read + llc.line_buffer_read +
+			llc.line_buffer_write + ddr.total;
+
+	/* Add 25 percent extra for 960fps use case */
+	if (fps >= 960) {
+		ddr.total += div_u64(ddr.total * 25, 100);
+		llc.total += div_u64(llc.total * 25, 100);
+	}
+
+	/* Dump all the variables for easier debugging */
+	if (msm_vidc_debug & VIDC_BUS) {
+		struct dump dump[] = {
+		{"DECODER PARAMETERS", "", DUMP_HEADER_MAGIC},
+		{"lcu size", "%d", lcu_size},
+		{"dpb bitdepth", "%d", dpb_bpp},
+		{"frame rate", "%d", fps},
+		{"dpb/opb unified", "%d", unified_dpb_opb},
+		{"dpb/opb downscaling ratio", DUMP_FP_FMT,
+			dpb_opb_scaling_ratio},
+		{"dpb compression", "%d", dpb_compression_enabled},
+		{"opb compression", "%d", opb_compression_enabled},
+		{"dpb read compression factor", DUMP_FP_FMT,
+			dpb_read_compression_factor},
+		{"dpb write compression factor", DUMP_FP_FMT,
+			dpb_write_compression_factor},
+		{"frame width", "%d", width},
+		{"frame height", "%d", height},
+		{"llc ref read l2 cache enabled", "%d",
+			llc_ref_read_l2_cache_enabled},
+		{"llc top line buf enabled", "%d",
+			llc_top_line_buf_enabled},
+
+		{"DERIVED PARAMETERS (1)", "", DUMP_HEADER_MAGIC},
+		{"lcus/frame", "%d", lcu_per_frame},
+		{"bitrate (Mbit/sec)", "%d", bitrate},
+		{"bins to bit factor", DUMP_FP_FMT, bins_to_bit_factor},
+		{"dpb write factor", DUMP_FP_FMT, dpb_write_factor},
+		{"vsp read factor", DUMP_FP_FMT, vsp_read_factor},
+		{"vsp write factor", DUMP_FP_FMT, vsp_write_factor},
+		{"tnbr/lcu", "%d", tnbr_per_lcu},
+		{"collocated bytes/LCU", "%d", collocated_bytes_per_lcu},
+		{"bw for NV12 8bpc)", DUMP_FP_FMT, y_bw_no_ubwc_8bpp},
+		{"bw for NV12 10bpc)", DUMP_FP_FMT, y_bw_no_ubwc_10bpp},
+
+		{"DERIVED PARAMETERS (2)", "", DUMP_HEADER_MAGIC},
+		{"mv complexity", DUMP_FP_FMT, motion_vector_complexity},
+		{"qsmmu_bw_overhead_factor", DUMP_FP_FMT,
+			qsmmu_bw_overhead_factor},
+
+		{"INTERMEDIATE DDR B/W", "", DUMP_HEADER_MAGIC},
+		{"vsp read", DUMP_FP_FMT, ddr.vsp_read},
+		{"vsp write", DUMP_FP_FMT, ddr.vsp_write},
+		{"collocated read", DUMP_FP_FMT, ddr.collocated_read},
+		{"collocated write", DUMP_FP_FMT, ddr.collocated_write},
+		{"line buffer read", DUMP_FP_FMT, ddr.line_buffer_read},
+		{"line buffer write", DUMP_FP_FMT, ddr.line_buffer_write},
+		{"opb read", DUMP_FP_FMT, ddr.opb_read},
+		{"opb write", DUMP_FP_FMT, ddr.opb_write},
+		{"dpb read", DUMP_FP_FMT, ddr.dpb_read},
+		{"dpb write", DUMP_FP_FMT, ddr.dpb_write},
+		{"dpb total", DUMP_FP_FMT, dpb_total},
+		{"INTERMEDIATE LLC B/W", "", DUMP_HEADER_MAGIC},
+		{"llc dpb read", DUMP_FP_FMT, llc.dpb_read},
+		{"llc line buffer read", DUMP_FP_FMT, llc.line_buffer_read},
+		{"llc line buffer write", DUMP_FP_FMT, llc.line_buffer_write},
+
+		};
+		__dump(dump, ARRAY_SIZE(dump));
+	}
+
+	d->calc_bw_ddr = kbps(fp_round(ddr.total));
+	d->calc_bw_llcc = kbps(fp_round(llc.total));
+
+	return ret;
+}
+
+static u64 __calculate_encoder(struct vidc_bus_vote_data *d)
+{
+	/*
+	 * XXX: Don't fool around with any of the hardcoded numbers unless you
+	 * know /exactly/ what you're doing.  Many of these numbers are
+	 * measured heuristics and hardcoded numbers taken from the firmware.
+	 */
+	/* Encoder Parameters */
+	int width, height, fps, lcu_size, bitrate, lcu_per_frame,
+		collocated_bytes_per_lcu, tnbr_per_lcu, dpb_bpp,
+		original_color_format, vertical_tile_width, rotation;
+	bool work_mode_1, original_compression_enabled,
+		low_power, cropping_or_scaling,
+		b_frames_enabled = false,
+		llc_ref_chroma_cache_enabled = false,
+		llc_top_line_buf_enabled = false,
+		llc_vpss_rot_line_buf_enabled = false,
+		vpss_preprocessing_enabled = false;
+
+	unsigned int bins_to_bit_factor;
+	fp_t dpb_compression_factor,
+		original_compression_factor,
+		original_compression_factor_y,
+		y_bw_no_ubwc_8bpp, y_bw_no_ubwc_10bpp = 0, y_bw_10bpp_p010 = 0,
+		input_compression_factor,
+		downscaling_ratio,
+		ref_y_read_bw_factor, ref_cbcr_read_bw_factor,
+		recon_write_bw_factor,
+		total_ref_read_crcb,
+		qsmmu_bw_overhead_factor;
+	fp_t integer_part, frac_part;
+	unsigned long ret = 0;
+
+	/* Output parameters */
+	struct {
+		fp_t vsp_read, vsp_write, collocated_read, collocated_write,
+			ref_read_y, ref_read_crcb, ref_write,
+			ref_write_overlap, orig_read,
+			line_buffer_read, line_buffer_write,
+			total;
+	} ddr = {0};
+
+	struct {
+		fp_t ref_read_crcb, line_buffer, total;
+	} llc = {0};
+
+	/* Encoder Parameters setup */
+	rotation = d->rotation;
+	cropping_or_scaling = false;
+	vertical_tile_width = 960;
+	/*
+	 * recon_write_bw_factor varies according to resolution and bit-depth,
+	 * here use 1.08(1.075) for worst case.
+	 * Similar for ref_y_read_bw_factor, it can reach 1.375 for worst case,
+	 * here use 1.3 for average case, and can somewhat balance the
+	 * worst case assumption for UBWC CR factors.
+	 */
+	recon_write_bw_factor = FP(1, 8, 100);
+	ref_y_read_bw_factor = FP(1, 30, 100);
+	ref_cbcr_read_bw_factor = FP(1, 50, 100);
+
+
+	/* Derived Parameters */
+	fps = d->fps;
+	width = max(d->output_width, BASELINE_DIMENSIONS.width);
+	height = max(d->output_height, BASELINE_DIMENSIONS.height);
+	downscaling_ratio = fp_div(FP_INT(d->input_width * d->input_height),
+		FP_INT(d->output_width * d->output_height));
+	downscaling_ratio = max(downscaling_ratio, FP_ONE);
+	bitrate = d->bitrate > 0 ? DIV_ROUND_UP(d->bitrate, 1000000) :
+		__lut(width, height, fps)->bitrate;
+	lcu_size = d->lcu_size;
+	lcu_per_frame = DIV_ROUND_UP(width, lcu_size) *
+		DIV_ROUND_UP(height, lcu_size);
+	tnbr_per_lcu = 16;
+
+	dpb_bpp = __bpp(d->color_formats[0]);
+
+	y_bw_no_ubwc_8bpp = fp_div(FP_INT(width * height * fps),
+		FP_INT(1000 * 1000));
+
+	if (dpb_bpp != 8) {
+		y_bw_no_ubwc_10bpp = fp_div(fp_mult(y_bw_no_ubwc_8bpp,
+			FP_INT(256)), FP_INT(192));
+		y_bw_10bpp_p010 = y_bw_no_ubwc_8bpp * 2;
+	}
+
+	b_frames_enabled = d->b_frames_enabled;
+	original_color_format = d->num_formats >= 1 ?
+		d->color_formats[0] : MSM_VIDC_FMT_NV12C;
+
+	original_compression_enabled = __ubwc(original_color_format);
+
+	work_mode_1 = d->work_mode == MSM_VIDC_STAGE_1;
+	low_power = d->power_mode == VIDC_POWER_LOW;
+	bins_to_bit_factor = 4;
+	vpss_preprocessing_enabled = d->vpss_preprocessing_enabled;
+
+	if (d->use_sys_cache) {
+		llc_ref_chroma_cache_enabled = true;
+		llc_top_line_buf_enabled = true,
+		llc_vpss_rot_line_buf_enabled = true;
+	}
+
+	integer_part = Q16_INT(d->compression_ratio);
+	frac_part = Q16_FRAC(d->compression_ratio);
+	dpb_compression_factor = FP(integer_part, frac_part, 100);
+
+	integer_part = Q16_INT(d->input_cr);
+	frac_part = Q16_FRAC(d->input_cr);
+	input_compression_factor = FP(integer_part, frac_part, 100);
+
+	original_compression_factor = original_compression_factor_y =
+		!original_compression_enabled ? FP_ONE :
+		__compression_ratio(__lut(width, height, fps), dpb_bpp);
+	/* use input cr if it is valid (not 1), otherwise use lut */
+	if (original_compression_enabled &&
+		input_compression_factor != FP_ONE) {
+		original_compression_factor = input_compression_factor;
+		/* Luma usually has lower compression factor than Chroma,
+		 * input cf is overall cf, add 1.08 factor for Luma cf
+		 */
+		original_compression_factor_y =
+			input_compression_factor > FP(1, 8, 100) ?
+			fp_div(input_compression_factor, FP(1, 8, 100)) :
+			input_compression_factor;
+	}
+
+	ddr.vsp_read = fp_div(FP_INT(bitrate * bins_to_bit_factor), FP_INT(8));
+	ddr.vsp_write = ddr.vsp_read + fp_div(FP_INT(bitrate), FP_INT(8));
+
+	collocated_bytes_per_lcu = lcu_size == 16 ? 16 :
+				lcu_size == 32 ? 64 : 256;
+
+	ddr.collocated_read = fp_div(FP_INT(lcu_per_frame *
+			collocated_bytes_per_lcu * fps), FP_INT(bps(1)));
+
+	ddr.collocated_write = ddr.collocated_read;
+
+	ddr.ref_read_y = dpb_bpp == 8 ?
+		y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	if (b_frames_enabled)
+		ddr.ref_read_y = ddr.ref_read_y * 2;
+	ddr.ref_read_y = fp_div(ddr.ref_read_y, dpb_compression_factor);
+
+	ddr.ref_read_crcb = fp_mult((ddr.ref_read_y / 2),
+		ref_cbcr_read_bw_factor);
+
+	if (width > vertical_tile_width) {
+		ddr.ref_read_y = fp_mult(ddr.ref_read_y,
+			ref_y_read_bw_factor);
+	}
+
+	if (llc_ref_chroma_cache_enabled) {
+		total_ref_read_crcb = ddr.ref_read_crcb;
+		ddr.ref_read_crcb = fp_div(ddr.ref_read_crcb,
+					   ref_cbcr_read_bw_factor);
+		llc.ref_read_crcb = total_ref_read_crcb - ddr.ref_read_crcb;
+	}
+
+	ddr.ref_write = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp : y_bw_no_ubwc_10bpp;
+	ddr.ref_write = fp_div(fp_mult(ddr.ref_write, FP(1, 50, 100)),
+			dpb_compression_factor);
+
+	if (width > vertical_tile_width) {
+		ddr.ref_write_overlap = fp_mult(ddr.ref_write,
+			(recon_write_bw_factor - FP_ONE));
+		ddr.ref_write = fp_mult(ddr.ref_write, recon_write_bw_factor);
+	}
+
+	/* double ref_write */
+	if (vpss_preprocessing_enabled)
+		ddr.ref_write = ddr.ref_write * 2;
+
+	ddr.orig_read = dpb_bpp == 8 ? y_bw_no_ubwc_8bpp :
+		(original_compression_enabled ? y_bw_no_ubwc_10bpp :
+		y_bw_10bpp_p010);
+	ddr.orig_read = fp_div(fp_mult(fp_mult(ddr.orig_read, FP(1, 50, 100)),
+		downscaling_ratio), original_compression_factor);
+	if (rotation == 90 || rotation == 270)
+		ddr.orig_read *= lcu_size == 32 ? (dpb_bpp == 8 ? 1 : 3) : 2;
+
+	/* double orig_read */
+	if (vpss_preprocessing_enabled)
+		ddr.orig_read = ddr.orig_read * 2;
+
+	ddr.line_buffer_read =
+		fp_div(FP_INT(tnbr_per_lcu * lcu_per_frame * fps),
+			FP_INT(bps(1)));
+
+	ddr.line_buffer_write = ddr.line_buffer_read;
+	if (llc_top_line_buf_enabled) {
+		llc.line_buffer = ddr.line_buffer_read + ddr.line_buffer_write;
+		ddr.line_buffer_read = ddr.line_buffer_write = FP_ZERO;
+	}
+
+	ddr.total = ddr.vsp_read + ddr.vsp_write +
+		ddr.collocated_read + ddr.collocated_write +
+		ddr.ref_read_y + ddr.ref_read_crcb +
+		ddr.ref_write + ddr.ref_write_overlap +
+		ddr.orig_read +
+		ddr.line_buffer_read + ddr.line_buffer_write;
+
+	qsmmu_bw_overhead_factor = FP(1, 3, 100);
+	ddr.total = fp_mult(ddr.total, qsmmu_bw_overhead_factor);
+	llc.total = llc.ref_read_crcb + llc.line_buffer + ddr.total;
+
+	if (msm_vidc_debug & VIDC_BUS) {
+		struct dump dump[] = {
+		{"ENCODER PARAMETERS", "", DUMP_HEADER_MAGIC},
+		{"width", "%d", width},
+		{"height", "%d", height},
+		{"fps", "%d", fps},
+		{"dpb bitdepth", "%d", dpb_bpp},
+		{"input downscaling ratio", DUMP_FP_FMT, downscaling_ratio},
+		{"rotation", "%d", rotation},
+		{"cropping or scaling", "%d", cropping_or_scaling},
+		{"low power mode", "%d", low_power},
+		{"work Mode", "%d", work_mode_1},
+		{"B frame enabled", "%d", b_frames_enabled},
+		{"original frame format", "%#x", original_color_format},
+		{"VPSS preprocessing", "%d", vpss_preprocessing_enabled},
+		{"original compression enabled", "%d",
+			original_compression_enabled},
+		{"dpb compression factor", DUMP_FP_FMT,
+			dpb_compression_factor},
+		{"input compression factor", DUMP_FP_FMT,
+			input_compression_factor},
+		{"llc ref chroma cache enabled", DUMP_FP_FMT,
+		llc_ref_chroma_cache_enabled},
+		{"llc top line buf enabled", DUMP_FP_FMT,
+			llc_top_line_buf_enabled},
+		{"llc vpss rot line buf enabled ", DUMP_FP_FMT,
+			llc_vpss_rot_line_buf_enabled},
+
+		{"DERIVED PARAMETERS", "", DUMP_HEADER_MAGIC},
+		{"lcu size", "%d", lcu_size},
+		{"bitrate (Mbit/sec)", "%lu", bitrate},
+		{"bins to bit factor", "%u", bins_to_bit_factor},
+		{"original compression factor", DUMP_FP_FMT,
+			original_compression_factor},
+		{"original compression factor y", DUMP_FP_FMT,
+			original_compression_factor_y},
+		{"qsmmu_bw_overhead_factor",
+			 DUMP_FP_FMT, qsmmu_bw_overhead_factor},
+		{"bw for NV12 8bpc)", DUMP_FP_FMT, y_bw_no_ubwc_8bpp},
+		{"bw for NV12 10bpc)", DUMP_FP_FMT, y_bw_no_ubwc_10bpp},
+
+		{"INTERMEDIATE B/W DDR", "", DUMP_HEADER_MAGIC},
+		{"vsp read", DUMP_FP_FMT, ddr.vsp_read},
+		{"vsp write", DUMP_FP_FMT, ddr.vsp_write},
+		{"collocated read", DUMP_FP_FMT, ddr.collocated_read},
+		{"collocated write", DUMP_FP_FMT, ddr.collocated_write},
+		{"ref read y", DUMP_FP_FMT, ddr.ref_read_y},
+		{"ref read crcb", DUMP_FP_FMT, ddr.ref_read_crcb},
+		{"ref write", DUMP_FP_FMT, ddr.ref_write},
+		{"ref write overlap", DUMP_FP_FMT, ddr.ref_write_overlap},
+		{"original read", DUMP_FP_FMT, ddr.orig_read},
+		{"line buffer read", DUMP_FP_FMT, ddr.line_buffer_read},
+		{"line buffer write", DUMP_FP_FMT, ddr.line_buffer_write},
+		{"INTERMEDIATE LLC B/W", "", DUMP_HEADER_MAGIC},
+		{"llc ref read crcb", DUMP_FP_FMT, llc.ref_read_crcb},
+		{"llc line buffer", DUMP_FP_FMT, llc.line_buffer},
+		};
+		__dump(dump, ARRAY_SIZE(dump));
+	}
+
+	d->calc_bw_ddr = kbps(fp_round(ddr.total));
+	d->calc_bw_llcc = kbps(fp_round(llc.total));
+
+	return ret;
+}
+
+static u64 __calculate(struct msm_vidc_inst *inst, struct vidc_bus_vote_data *d)
+{
+	u64 value = 0;
+
+	switch (d->domain) {
+	case MSM_VIDC_ENCODER:
+		value = __calculate_encoder(d);
+		break;
+	case MSM_VIDC_DECODER:
+		value = __calculate_decoder(d);
+		break;
+	default:
+		i_vpr_e(inst, "%s: Unknown Domain %#x", __func__, d->domain);
+	}
+
+	return value;
+}
+
+int msm_vidc_calc_bw_iris33(struct msm_vidc_inst *inst,
+		struct vidc_bus_vote_data *vidc_data)
+{
+	int value = 0;
+
+	if (!vidc_data)
+		return value;
+
+	if (ENABLE_LEGACY_POWER_CALCULATIONS)
+		value = __calculate(inst, vidc_data);
+	else
+		value = msm_vidc_calc_bw_iris33_new(inst, vidc_data);
+
+	return value;
+}
+
+int msm_vidc_ring_buf_count_iris33(struct msm_vidc_inst *inst, u32 data_size)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct api_calculation_input codec_input;
+	struct api_calculation_freq_output codec_output;
+
+	core = inst->core;
+
+	if (!core->resource || !core->resource->freq_set.freq_tbl ||
+		!core->resource->freq_set.count) {
+		i_vpr_e(inst, "%s: invalid frequency table\n", __func__);
+		return -EINVAL;
+	}
+
+	if (ENABLE_LEGACY_POWER_CALCULATIONS)
+		return 0;
+
+	memset(&codec_input, 0, sizeof(struct api_calculation_input));
+	memset(&codec_output, 0, sizeof(struct api_calculation_freq_output));
+	rc = msm_vidc_init_codec_input_freq(inst, data_size, &codec_input);
+	if (rc)
+		return rc;
+	rc = msm_vidc_calculate_frequency(codec_input, &codec_output);
+	if (rc)
+		return rc;
+
+	/* check if vpp_min_freq is exceeding closest freq corner margin */
+	if (is_vpp_cycles_close_to_freq_corner(core,
+		codec_output.vpp_min_freq)) {
+		/* enable ring buffer */
+		i_vpr_h(inst,
+			"%s: vpp_min_freq %d, ring_buffer_count %d\n",
+			__func__, codec_output.vpp_min_freq, MAX_ENC_RING_BUF_COUNT);
+		inst->capabilities[ENC_RING_BUFFER_COUNT].value =
+			MAX_ENC_RING_BUF_COUNT;
+	} else {
+		inst->capabilities[ENC_RING_BUFFER_COUNT].value = 0;
+	}
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/firmware.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/firmware.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_FIRMWARE_H_
+#define _MSM_VIDC_FIRMWARE_H_
+
+struct msm_vidc_core;
+
+int fw_load(struct msm_vidc_core *core);
+int fw_unload(struct msm_vidc_core *core);
+int fw_suspend(struct msm_vidc_core *core);
+int fw_resume(struct msm_vidc_core *core);
+void fw_coredump(struct msm_vidc_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/fixedpoint.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/fixedpoint.h
@@ -0,0 +1,68 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifdef _FIXP_ARITH_H
+#error "This implementation is meant to override fixp-arith.h, don't use both"
+#endif
+
+#ifndef _FIXEDPOINT_H_
+#define _FIXEDPOINT_H_
+
+#include <linux/types.h>
+#include <linux/bits.h>
+
+/*
+ * Normally would typedef'ed, but checkpatch doesn't like typedef.
+ * Also should be normally typedef'ed to intmax_t but that doesn't seem to be
+ * available in the kernel
+ */
+#define fp_t size_t
+
+/* (Arbitrarily) make the first 25% of the bits to be the fractional bits */
+#define FP_FRACTIONAL_BITS ((sizeof(fp_t) * 8) / 4)
+
+#define FP(__i, __f_n, __f_d) \
+	((((fp_t)(__i)) << FP_FRACTIONAL_BITS) + \
+	(((__f_n) << FP_FRACTIONAL_BITS) / (__f_d)))
+
+#define FP_INT(__i) FP(__i, 0, 1)
+#define FP_ONE FP_INT(1)
+#define FP_ZERO FP_INT(0)
+
+static inline size_t fp_frac_base(void)
+{
+	return GENMASK(FP_FRACTIONAL_BITS - 1, 0);
+}
+
+static inline size_t fp_frac(fp_t a)
+{
+	return a & GENMASK(FP_FRACTIONAL_BITS - 1, 0);
+}
+
+static inline size_t fp_int(fp_t a)
+{
+	return a >> FP_FRACTIONAL_BITS;
+}
+
+static inline size_t fp_round(fp_t a)
+{
+	/* is the fractional part >= frac_max / 2? */
+	bool round_up = fp_frac(a) >= fp_frac_base() / 2;
+
+	return fp_int(a) + round_up;
+}
+
+static inline fp_t fp_mult(fp_t a, fp_t b)
+{
+	return (a * b) >> FP_FRACTIONAL_BITS;
+}
+
+static inline fp_t fp_div(fp_t a, fp_t b)
+{
+	return (a << FP_FRACTIONAL_BITS) / b;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/hfi_command.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/hfi_command.h
@@ -0,0 +1,190 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_HFI_COMMAND_H__
+#define __H_HFI_COMMAND_H__
+
+//todo: DP: remove below headers
+#include <linux/types.h>
+#include <linux/bits.h>
+
+#define HFI_VIDEO_ARCH_LX               0x1
+
+struct hfi_header {
+	u32 size;
+	u32 session_id;
+	u32 header_id;
+	u32 reserved[4];
+	u32 num_packets;
+};
+
+struct hfi_packet {
+	u32 size;
+	u32 type;
+	u32 flags;
+	u32 payload_info;
+	u32 port;
+	u32 packet_id;
+	u32 reserved[2];
+};
+
+struct hfi_buffer {
+	u32 type;
+	u32 index;
+	u64 base_address;
+	u32 addr_offset;
+	u32 buffer_size;
+	u32 data_offset;
+	u32 data_size;
+	u64 timestamp;
+	u32 flags;
+	u32 reserved[5];
+};
+
+enum hfi_packet_host_flags {
+	HFI_HOST_FLAGS_NONE                = 0x00000000,
+	HFI_HOST_FLAGS_INTR_REQUIRED       = 0x00000001,
+	HFI_HOST_FLAGS_RESPONSE_REQUIRED   = 0x00000002,
+	HFI_HOST_FLAGS_NON_DISCARDABLE     = 0x00000004,
+	HFI_HOST_FLAGS_GET_PROPERTY        = 0x00000008,
+};
+
+enum hfi_packet_firmware_flags {
+	HFI_FW_FLAGS_NONE          = 0x00000000,
+	HFI_FW_FLAGS_SUCCESS       = 0x00000001,
+	HFI_FW_FLAGS_INFORMATION   = 0x00000002,
+	HFI_FW_FLAGS_SESSION_ERROR = 0x00000004,
+	HFI_FW_FLAGS_SYSTEM_ERROR  = 0x00000008,
+};
+
+enum hfi_packet_payload_info {
+	HFI_PAYLOAD_NONE      = 0x00000000,
+	HFI_PAYLOAD_U32       = 0x00000001,
+	HFI_PAYLOAD_S32       = 0x00000002,
+	HFI_PAYLOAD_U64       = 0x00000003,
+	HFI_PAYLOAD_S64       = 0x00000004,
+	HFI_PAYLOAD_STRUCTURE = 0x00000005,
+	HFI_PAYLOAD_BLOB      = 0x00000006,
+	HFI_PAYLOAD_STRING    = 0x00000007,
+	HFI_PAYLOAD_Q16       = 0x00000008,
+	HFI_PAYLOAD_U32_ENUM  = 0x00000009,
+	HFI_PAYLOAD_32_PACKED = 0x0000000a,
+	HFI_PAYLOAD_U32_ARRAY = 0x0000000b,
+	HFI_PAYLOAD_S32_ARRAY = 0x0000000c,
+	HFI_PAYLOAD_64_PACKED = 0x0000000d,
+};
+
+enum hfi_packet_port_type {
+	HFI_PORT_NONE      = 0x00000000,
+	HFI_PORT_BITSTREAM = 0x00000001,
+	HFI_PORT_RAW       = 0x00000002,
+};
+
+enum hfi_buffer_type {
+	HFI_BUFFER_BITSTREAM      = 0x00000001,
+	HFI_BUFFER_RAW            = 0x00000002,
+	HFI_BUFFER_METADATA       = 0x00000003,
+	HFI_BUFFER_SUBCACHE       = 0x00000004,
+	HFI_BUFFER_PARTIAL_DATA   = 0x00000005,
+	HFI_BUFFER_DPB            = 0x00000006,
+	HFI_BUFFER_BIN            = 0x00000007,
+	HFI_BUFFER_LINE           = 0x00000008,
+	HFI_BUFFER_ARP            = 0x00000009,
+	HFI_BUFFER_COMV           = 0x0000000A,
+	HFI_BUFFER_NON_COMV       = 0x0000000B,
+	HFI_BUFFER_PERSIST        = 0x0000000C,
+	HFI_BUFFER_VPSS           = 0x0000000D,
+};
+
+enum hfi_buffer_host_flags {
+	HFI_BUF_HOST_FLAG_NONE               = 0x00000000,
+	HFI_BUF_HOST_FLAG_RELEASE            = 0x00000001,
+	HFI_BUF_HOST_FLAG_READONLY           = 0x00000010,
+	HFI_BUF_HOST_FLAG_CODEC_CONFIG       = 0x00000100,
+	HFI_BUF_HOST_FLAGS_CB_NON_SECURE       = 0x00000200,
+	HFI_BUF_HOST_FLAGS_CB_SECURE_PIXEL     = 0x00000400,
+	HFI_BUF_HOST_FLAGS_CB_SECURE_BITSTREAM = 0x00000800,
+	HFI_BUF_HOST_FLAGS_CB_SECURE_NON_PIXEL = 0x00001000,
+	HFI_BUF_HOST_FLAGS_CB_NON_SECURE_PIXEL = 0x00002000,
+};
+
+enum hfi_buffer_firmware_flags {
+	HFI_BUF_FW_FLAG_NONE            = 0x00000000,
+	HFI_BUF_FW_FLAG_RELEASE_DONE    = 0x00000001,
+	HFI_BUF_FW_FLAG_READONLY        = 0x00000010,
+	HFI_BUF_FW_FLAG_CODEC_CONFIG    = 0x00000100,
+	HFI_BUF_FW_FLAG_LAST            = 0x10000000,
+	HFI_BUF_FW_FLAG_PSC_LAST        = 0x20000000,
+};
+
+enum hfi_metapayload_header_flags {
+	HFI_METADATA_FLAGS_NONE         = 0x00000000,
+	HFI_METADATA_FLAGS_TOP_FIELD    = 0x00000001,
+	HFI_METADATA_FLAGS_BOTTOM_FIELD = 0x00000002,
+};
+
+struct metabuf_header {
+	u32 count;
+	u32 size;
+	u32 version;
+	u32 reserved[5];
+};
+
+struct metapayload_header {
+	u32 type;
+	u32 size;
+	u32 version;
+	u32 offset;
+	u32 flags;
+	u32 reserved[3];
+};
+
+enum hfi_property_mode_type {
+	HFI_MODE_NONE                 = 0x00000000,
+	HFI_MODE_PORT_SETTINGS_CHANGE = 0x00000001,
+	HFI_MODE_PROPERTY             = 0x00000002,
+	HFI_MODE_METADATA             = 0x00000004,
+	HFI_MODE_DYNAMIC_METADATA     = 0x00000005,
+};
+
+enum hfi_reserve_type {
+	HFI_RESERVE_START = 0x1,
+	HFI_RESERVE_STOP  = 0x2,
+};
+
+#define HFI_CMD_BEGIN                                           0x01000000
+#define HFI_CMD_INIT                                            0x01000001
+#define HFI_CMD_POWER_COLLAPSE                                  0x01000002
+#define HFI_CMD_OPEN                                            0x01000003
+#define HFI_CMD_CLOSE                                           0x01000004
+#define HFI_CMD_START                                           0x01000005
+#define HFI_CMD_STOP                                            0x01000006
+#define HFI_CMD_DRAIN                                           0x01000007
+#define HFI_CMD_RESUME                                          0x01000008
+#define HFI_CMD_BUFFER                                          0x01000009
+#define HFI_CMD_DELIVERY_MODE                                   0x0100000A
+#define HFI_CMD_SUBSCRIBE_MODE                                  0x0100000B
+#define HFI_CMD_SETTINGS_CHANGE                                 0x0100000C
+
+#define HFI_SSR_TYPE_SW_ERR_FATAL       0x1
+#define HFI_SSR_TYPE_SW_DIV_BY_ZERO     0x2
+#define HFI_SSR_TYPE_CPU_WDOG_IRQ       0x3
+#define HFI_SSR_TYPE_NOC_ERROR          0x4
+#define HFI_BITMASK_HW_CLIENT_ID                        0x000000f0
+#define HFI_BITMASK_SSR_TYPE                            0x0000000f
+#define HFI_CMD_SSR                                             0x0100000D
+
+#define HFI_STABILITY_TYPE_VCODEC_HUNG        0x1
+#define HFI_STABILITY_TYPE_ENC_BUFFER_FULL    0x2
+#define HFI_BITMASK_STABILITY_TYPE                      0x0000000f
+#define HFI_CMD_STABILITY                                       0x0100000E
+
+#define HFI_CMD_RESERVE                                         0x0100000F
+#define HFI_CMD_FLUSH                                           0x01000010
+#define HFI_CMD_PAUSE                                           0x01000011
+#define HFI_CMD_END                                             0x01FFFFFF
+
+#endif //__H_HFI_COMMAND_H__
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/hfi_packet.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/hfi_packet.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _HFI_PACKET_H_
+#define _HFI_PACKET_H_
+
+#include "msm_vidc_internal.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "hfi_command.h"
+#include "hfi_property.h"
+
+u32 get_hfi_port(struct msm_vidc_inst *inst,
+		 enum msm_vidc_port_type port);
+u32 get_hfi_port_from_buffer_type(struct msm_vidc_inst *inst,
+				  enum msm_vidc_buffer_type buffer_type);
+u32 hfi_buf_type_from_driver(enum msm_vidc_domain_type domain,
+			     enum msm_vidc_buffer_type buffer_type);
+u32 hfi_buf_type_to_driver(enum msm_vidc_domain_type domain,
+			   enum hfi_buffer_type buffer_type,
+			   enum hfi_packet_port_type port_type);
+u32 get_hfi_codec(struct msm_vidc_inst *inst);
+u32 get_hfi_colorformat(struct msm_vidc_inst *inst,
+			enum msm_vidc_colorformat_type colorformat);
+int get_hfi_buffer(struct msm_vidc_inst *inst,
+		   struct msm_vidc_buffer *buffer,
+		   struct hfi_buffer *buf);
+int hfi_create_header(u8 *packet, u32 packet_size,
+		      u32 session_id, u32 header_id);
+int hfi_create_packet(u8 *packet, u32 packet_size,
+		      u32 pkt_type, u32 pkt_flags,
+		      u32 payload_type, u32 port,
+		      u32 packet_id, void *payload,
+		      u32 payload_size);
+int hfi_create_buffer(u8 *packet, u32 packet_size, u32 *offset,
+		      enum msm_vidc_domain_type domain,
+		      struct msm_vidc_buffer *data);
+int hfi_packet_sys_init(struct msm_vidc_core *core,
+			u8 *pkt, u32 pkt_size);
+int hfi_packet_image_version(struct msm_vidc_core *core,
+			     u8 *pkt, u32 pkt_size);
+int hfi_packet_sys_pc_prep(struct msm_vidc_core *core,
+			   u8 *pkt, u32 pkt_size);
+int hfi_packet_sys_debug_config(struct msm_vidc_core *core,
+				u8 *pkt, u32 pkt_size,
+				u32 debug_config);
+int hfi_packet_session_command(struct msm_vidc_inst *inst,
+			       u32 pkt_type, u32 flags,
+			       u32 port, u32 session_id,
+			       u32 payload_type, void *payload,
+			       u32 payload_size);
+int hfi_packet_sys_intraframe_powercollapse(struct msm_vidc_core *core,
+					    u8 *pkt, u32 pkt_size,
+					    u32 enable);
+
+#endif // _HFI_PACKET_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/hfi_property.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/hfi_property.h
@@ -0,0 +1,667 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_HFI_PROPERTY_H__
+#define __H_HFI_PROPERTY_H__
+
+//todo: DP: remove below header
+#include <linux/types.h>
+
+#define HFI_PROP_BEGIN                                          0x03000000
+#define HFI_PROP_IMAGE_VERSION                                  0x03000001
+#define HFI_PROP_INTRA_FRAME_POWER_COLLAPSE                     0x03000002
+#define HFI_PROP_UBWC_MAX_CHANNELS                              0x03000003
+#define HFI_PROP_UBWC_MAL_LENGTH                                0x03000004
+#define HFI_PROP_UBWC_HBB                                       0x03000005
+#define HFI_PROP_UBWC_BANK_SWZL_LEVEL1                          0x03000006
+#define HFI_PROP_UBWC_BANK_SWZL_LEVEL2                          0x03000007
+#define HFI_PROP_UBWC_BANK_SWZL_LEVEL3                          0x03000008
+#define HFI_PROP_UBWC_BANK_SPREADING                            0x03000009
+
+enum hfi_debug_config {
+	HFI_DEBUG_CONFIG_DEFAULT = 0x00000000,
+	HFI_DEBUG_CONFIG_CLRDBGQ = 0x00000001,
+	HFI_DEBUG_CONFIG_WFI     = 0x00000002,
+	HFI_DEBUG_CONFIG_ARM9WD  = 0x00000004,
+};
+
+#define HFI_PROP_DEBUG_CONFIG                                   0x0300000a
+
+enum hfi_debug_log_level {
+	HFI_DEBUG_LOG_NONE   = 0x00000000,
+	HFI_DEBUG_LOG_ERROR  = 0x00000001,
+	HFI_DEBUG_LOG_FATAL  = 0x00000002,
+	HFI_DEBUG_LOG_PERF   = 0x00000004,
+	HFI_DEBUG_LOG_HIGH   = 0x00000008,
+	HFI_DEBUG_LOG_MEDIUM = 0x00000010,
+	HFI_DEBUG_LOG_LOW    = 0x00000020,
+};
+
+struct hfi_debug_header {
+	u32   size;
+	u32   debug_level;
+	u32   reserved[2];
+};
+
+#define HFI_PROP_DEBUG_LOG_LEVEL                                0x0300000b
+
+#define HFI_PROP_FENCE_CLIENT_DATA                              0x0300000d
+
+enum hfi_codec_type {
+	HFI_CODEC_DECODE_AVC   = 1,
+	HFI_CODEC_ENCODE_AVC   = 2,
+	HFI_CODEC_DECODE_HEVC  = 3,
+	HFI_CODEC_ENCODE_HEVC  = 4,
+	HFI_CODEC_DECODE_VP9   = 5,
+	HFI_CODEC_DECODE_MPEG2 = 6,
+	HFI_CODEC_DECODE_AV1   = 7,
+};
+
+#define HFI_PROP_CODEC                                          0x03000100
+
+enum hfi_color_format {
+	HFI_COLOR_FMT_OPAQUE        = 0,
+	HFI_COLOR_FMT_NV12          = 1,
+	HFI_COLOR_FMT_NV12_UBWC     = 2,
+	HFI_COLOR_FMT_P010          = 3,
+	HFI_COLOR_FMT_TP10_UBWC     = 4,
+	HFI_COLOR_FMT_RGBA8888      = 5,
+	HFI_COLOR_FMT_RGBA8888_UBWC = 6,
+	HFI_COLOR_FMT_NV21          = 7,
+};
+
+#define HFI_PROP_COLOR_FORMAT                                   0x03000101
+
+#define HFI_PROP_SECURE                                         0x03000102
+
+#define HFI_BITMASK_BITSTREAM_WIDTH                             0xffff0000
+#define HFI_BITMASK_BITSTREAM_HEIGHT                            0x0000ffff
+#define HFI_PROP_BITSTREAM_RESOLUTION                           0x03000103
+
+#define HFI_BITMASK_LINEAR_STRIDE             0xffff0000
+#define HFI_BITMASK_LINEAR_SCANLINE           0x0000ffff
+#define HFI_PROP_LINEAR_STRIDE_SCANLINE                        0x03000104
+
+#define HFI_BITMASK_CROP_RIGHT_OFFSET        0xffff0000
+#define HFI_BITMASK_CROP_BOTTOM_OFFSET       0x0000ffff
+#define HFI_BITMASK_CROP_LEFT_OFFSET         0xffff0000
+#define HFI_BITMASK_CROP_TOP_OFFSET          0x0000ffff
+#define HFI_PROP_CROP_OFFSETS                                   0x03000105
+
+#define HFI_PROP_SESSION_PRIORITY                               0x03000106
+
+enum hfi_avc_profile_type {
+	HFI_AVC_PROFILE_BASELINE             = 0,
+	HFI_AVC_PROFILE_CONSTRAINED_BASELINE = 1,
+	HFI_AVC_PROFILE_MAIN                 = 2,
+	HFI_AVC_PROFILE_HIGH                 = 4,
+	HFI_AVC_PROFILE_CONSTRAINED_HIGH     = 17
+};
+
+enum hfi_hevc_profile_type {
+	HFI_H265_PROFILE_MAIN                  = 0,
+	HFI_H265_PROFILE_MAIN_STILL_PICTURE    = 1,
+	HFI_H265_PROFILE_MAIN_10               = 2,
+	HFI_H265_PROFILE_MAIN_10_STILL_PICTURE = 3,
+};
+
+enum hfi_vp9_profile_type {
+	HFI_VP9_PROFILE_0 = 0,
+	HFI_VP9_PROFILE_1 = 1,
+	HFI_VP9_PROFILE_2 = 2,
+	HFI_VP9_PROFILE_3 = 3,
+};
+
+enum hfi_mpeg2_profile_type {
+	HFI_MP2_PROFILE_SIMPLE = 0,
+	HFI_MP2_PROFILE_MAIN   = 1,
+};
+
+enum hfi_av1_profile_type {
+	HFI_AV1_PROFILE_MAIN = 0,
+	HFI_AV1_PROFILE_HIGH = 1,
+	HFI_AV1_PROFILE_PROF = 2,
+};
+
+#define HFI_PROP_PROFILE                                        0x03000107
+
+enum hfi_avc_level_type {
+	HFI_AVC_LEVEL_1_0 = 0,
+	HFI_AVC_LEVEL_1B  = 1,
+	HFI_AVC_LEVEL_1_1 = 2,
+	HFI_AVC_LEVEL_1_2 = 3,
+	HFI_AVC_LEVEL_1_3 = 4,
+	HFI_AVC_LEVEL_2_0 = 5,
+	HFI_AVC_LEVEL_2_1 = 6,
+	HFI_AVC_LEVEL_2_2 = 7,
+	HFI_AVC_LEVEL_3_0 = 8,
+	HFI_AVC_LEVEL_3_1 = 9,
+	HFI_AVC_LEVEL_3_2 = 10,
+	HFI_AVC_LEVEL_4_0 = 11,
+	HFI_AVC_LEVEL_4_1 = 12,
+	HFI_AVC_LEVEL_4_2 = 13,
+	HFI_AVC_LEVEL_5_0 = 14,
+	HFI_AVC_LEVEL_5_1 = 15,
+	HFI_AVC_LEVEL_5_2 = 16,
+	HFI_AVC_LEVEL_6_0 = 17,
+	HFI_AVC_LEVEL_6_1 = 18,
+	HFI_AVC_LEVEL_6_2 = 19,
+};
+
+enum hfi_hevc_level_type {
+	HFI_H265_LEVEL_1   = 0,
+	HFI_H265_LEVEL_2   = 1,
+	HFI_H265_LEVEL_2_1 = 2,
+	HFI_H265_LEVEL_3   = 3,
+	HFI_H265_LEVEL_3_1 = 4,
+	HFI_H265_LEVEL_4   = 5,
+	HFI_H265_LEVEL_4_1 = 6,
+	HFI_H265_LEVEL_5   = 7,
+	HFI_H265_LEVEL_5_1 = 8,
+	HFI_H265_LEVEL_5_2 = 9,
+	HFI_H265_LEVEL_6   = 10,
+	HFI_H265_LEVEL_6_1 = 11,
+	HFI_H265_LEVEL_6_2 = 12,
+};
+
+enum hfi_vp9_level_type {
+	HFI_VP9_LEVEL_1_0 = 0,
+	HFI_VP9_LEVEL_1_1 = 1,
+	HFI_VP9_LEVEL_2_0 = 2,
+	HFI_VP9_LEVEL_2_1 = 3,
+	HFI_VP9_LEVEL_3_0 = 4,
+	HFI_VP9_LEVEL_3_1 = 5,
+	HFI_VP9_LEVEL_4_0 = 6,
+	HFI_VP9_LEVEL_4_1 = 7,
+	HFI_VP9_LEVEL_5_0 = 8,
+	HFI_VP9_LEVEL_5_1 = 9,
+	HFI_VP9_LEVEL_6_0 = 10,
+	HFI_VP9_LEVEL_6_1 = 11,
+};
+
+enum hfi_mpeg2_level_type {
+	HFI_MP2_LEVEL_LOW       = 0,
+	HFI_MP2_LEVEL_MAIN      = 1,
+	HFI_MP2_LEVEL_HIGH_1440 = 2,
+	HFI_MP2_LEVEL_HIGH      = 3,
+};
+
+enum hfi_av1_level_type {
+	HFI_AV1_LEVEL_2_0 = 0,
+	HFI_AV1_LEVEL_2_1 = 1,
+	HFI_AV1_LEVEL_2_2 = 2,
+	HFI_AV1_LEVEL_2_3 = 3,
+	HFI_AV1_LEVEL_3_0 = 4,
+	HFI_AV1_LEVEL_3_1 = 5,
+	HFI_AV1_LEVEL_3_2 = 6,
+	HFI_AV1_LEVEL_3_3 = 7,
+	HFI_AV1_LEVEL_4_0 = 8,
+	HFI_AV1_LEVEL_4_1 = 9,
+	HFI_AV1_LEVEL_4_2 = 10,
+	HFI_AV1_LEVEL_4_3 = 11,
+	HFI_AV1_LEVEL_5_0 = 12,
+	HFI_AV1_LEVEL_5_1 = 13,
+	HFI_AV1_LEVEL_5_2 = 14,
+	HFI_AV1_LEVEL_5_3 = 15,
+	HFI_AV1_LEVEL_6_0 = 16,
+	HFI_AV1_LEVEL_6_1 = 17,
+	HFI_AV1_LEVEL_6_2 = 18,
+	HFI_AV1_LEVEL_6_3 = 19,
+	HFI_AV1_LEVEL_7_0 = 20,
+	HFI_AV1_LEVEL_7_1 = 21,
+	HFI_AV1_LEVEL_7_2 = 22,
+	HFI_AV1_LEVEL_7_3 = 23,
+	HFI_AV1_LEVEL_MAX = 31,
+};
+
+enum hfi_codec_level_type {
+	HFI_LEVEL_NONE = 0xFFFFFFFF,
+};
+
+#define HFI_PROP_LEVEL                                          0x03000108
+
+enum hfi_hevc_tier_type {
+	HFI_H265_TIER_MAIN = 0,
+	HFI_H265_TIER_HIGH = 1,
+};
+
+enum hfi_av1_tier_type {
+	HFI_AV1_TIER_MAIN = 0,
+	HFI_AV1_TIER_HIGH = 1,
+};
+
+#define HFI_PROP_TIER                                           0x03000109
+
+#define HFI_PROP_STAGE                                          0x0300010a
+
+#define HFI_PROP_PIPE                                           0x0300010b
+
+#define HFI_PROP_FRAME_RATE                                     0x0300010c
+
+#define HFI_BITMASK_CONCEAL_LUMA       0x000003ff
+#define HFI_BITMASK_CONCEAL_CB         0x000ffC00
+#define HFI_BITMASK_CONCEAL_CR         0x3ff00000
+#define HFI_PROP_CONCEAL_COLOR_8BIT                             0x0300010d
+
+#define HFI_BITMASK_CONCEAL_LUMA       0x000003ff
+#define HFI_BITMASK_CONCEAL_CB         0x000ffC00
+#define HFI_BITMASK_CONCEAL_CR         0x3ff00000
+#define HFI_PROP_CONCEAL_COLOR_10BIT                            0x0300010e
+
+#define HFI_BITMASK_LUMA_BIT_DEPTH     0xffff0000
+#define HFI_BITMASK_CHROMA_BIT_DEPTH   0x0000ffff
+#define HFI_PROP_LUMA_CHROMA_BIT_DEPTH                          0x0300010f
+
+#define HFI_BITMASK_FRAME_MBS_ONLY_FLAG           0x00000001
+#define HFI_BITMASK_MB_ADAPTIVE_FRAME_FIELD_FLAG  0x00000002
+#define HFI_PROP_CODED_FRAMES                                   0x03000120
+
+#define HFI_PROP_CABAC_SESSION                                  0x03000121
+
+#define HFI_PROP_8X8_TRANSFORM                                  0x03000122
+
+#define HFI_PROP_BUFFER_HOST_MAX_COUNT                          0x03000123
+
+#define HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT                     0x03000124
+
+#define HFI_PROP_BUFFER_MAXDPB_COUNT                            0x03000125
+
+#define HFI_PROP_BUFFER_MAX_NUM_REFERENCE                       0x03000126
+
+#define HFI_PROP_MAX_NUM_REORDER_FRAMES                         0x03000127
+
+#define HFI_PROP_PIC_ORDER_CNT_TYPE                             0x03000128
+
+enum hfi_deblock_mode {
+	HFI_DEBLOCK_ALL_BOUNDARY              = 0x0,
+	HFI_DEBLOCK_DISABLE                   = 0x1,
+	HFI_DEBLOCK_DISABLE_AT_SLICE_BOUNDARY = 0x2,
+};
+
+#define HFI_PROP_DEBLOCKING_MODE                                0x03000129
+
+enum hfi_rate_control {
+	HFI_RC_VBR_CFR        = 0x00000000,
+	HFI_RC_CBR_CFR        = 0x00000001,
+	HFI_RC_CQ             = 0x00000002,
+	HFI_RC_OFF            = 0x00000003,
+	HFI_RC_CBR_VFR        = 0x00000004,
+	HFI_RC_LOSSLESS       = 0x00000005,
+	HFI_RC_MBR            = 0x00000006,
+};
+
+#define HFI_PROP_RATE_CONTROL                                   0x0300012a
+
+#define HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL                  0x0300012b
+
+#define HFI_PROP_CONTENT_ADAPTIVE_CODING                        0x0300012c
+
+#define HFI_PROP_BITRATE_BOOST                                  0x0300012d
+
+#define HFI_BITMASK_QP_I          0x000000ff
+#define HFI_BITMASK_QP_P          0x0000ff00
+#define HFI_BITMASK_QP_B          0x00ff0000
+#define HFI_BITMASK_QP_ENABLE     0x0f000000
+#define HFI_BITMASK_QP_LAYERS     0xf0000000
+#define HFI_PROP_QP_PACKED                                      0x0300012e
+
+#define HFI_PROP_MIN_QP_PACKED                                  0x0300012f
+
+#define HFI_PROP_MAX_QP_PACKED                                  0x03000130
+
+#define HFI_PROP_IR_RANDOM_PERIOD                               0x03000131
+
+#define HFI_PROP_MULTI_SLICE_MB_COUNT                           0x03000132
+
+#define HFI_PROP_MULTI_SLICE_BYTES_COUNT                        0x03000133
+
+#define HFI_PROP_LTR_COUNT                                      0x03000134
+
+#define HFI_PROP_LTR_MARK                                       0x03000135
+
+#define HFI_PROP_LTR_USE                                        0x03000136
+
+#define HFI_PROP_LTR_MARK_USE_DETAILS                           0x03000137
+
+enum hfi_layer_encoding_type {
+	HFI_HIER_P_SLIDING_WINDOW = 0x1,
+	HFI_HIER_P_HYBRID_LTR     = 0x2,
+	HFI_HIER_B                = 0x3,
+};
+
+#define HFI_PROP_LAYER_ENCODING_TYPE                            0x03000138
+
+#define HFI_PROP_LAYER_COUNT                                    0x03000139
+
+enum hfi_chromaqp_offset_mode {
+	HFI_ADAPTIVE_CHROMAQP_OFFSET = 0x0,
+	HFI_FIXED_CHROMAQP_OFFSET = 0x1,
+};
+
+#define HFI_BITMASK_CHROMA_CB_OFFSET     0x0000ffff
+#define HFI_BITMASK_CHROMA_CR_OFFSET     0xffff0000
+#define HFI_PROP_CHROMA_QP_OFFSET                               0x0300013a
+
+#define HFI_PROP_TOTAL_BITRATE                                  0x0300013b
+
+#define HFI_PROP_BITRATE_LAYER1                                 0x0300013c
+
+#define HFI_PROP_BITRATE_LAYER2                                 0x0300013d
+
+#define HFI_PROP_BITRATE_LAYER3                                 0x0300013e
+
+#define HFI_PROP_BITRATE_LAYER4                                 0x0300013f
+
+#define HFI_PROP_BITRATE_LAYER5                                 0x03000140
+
+#define HFI_PROP_BITRATE_LAYER6                                 0x03000141
+
+#define HFI_PROP_BASELAYER_PRIORITYID                           0x03000142
+
+#define HFI_PROP_CONSTANT_QUALITY                               0x03000143
+
+#define HFI_PROP_HEIC_GRID_ENABLE                               0x03000144
+
+enum hfi_syncframe_request_mode {
+	HFI_SYNC_FRAME_REQUEST_WITHOUT_SEQ_HDR           = 0x00000001,
+	HFI_SYNC_FRAME_REQUEST_WITH_PREFIX_SEQ_HDR       = 0x00000002,
+};
+
+#define HFI_PROP_REQUEST_SYNC_FRAME                             0x03000145
+
+#define HFI_PROP_MAX_GOP_FRAMES                                 0x03000146
+
+#define HFI_PROP_MAX_B_FRAMES                                   0x03000147
+
+enum hfi_quality_mode {
+	HFI_MODE_MAX_QUALITY = 0x1,
+	HFI_MODE_POWER_SAVE  = 0x2,
+};
+
+#define HFI_PROP_QUALITY_MODE                                   0x03000148
+
+enum hfi_seq_header_mode {
+	HFI_SEQ_HEADER_SEPERATE_FRAME         = 0x00000001,
+	HFI_SEQ_HEADER_JOINED_WITH_1ST_FRAME  = 0x00000002,
+	HFI_SEQ_HEADER_PREFIX_WITH_SYNC_FRAME = 0x00000004,
+	HFI_SEQ_HEADER_METADATA               = 0x00000008,
+};
+
+#define HFI_PROP_SEQ_HEADER_MODE                                0x03000149
+
+#define HFI_PROP_METADATA_SEQ_HEADER_NAL                        0x0300014a
+
+enum hfi_rotation {
+	HFI_ROTATION_NONE = 0x00000000,
+	HFI_ROTATION_90   = 0x00000001,
+	HFI_ROTATION_180  = 0x00000002,
+	HFI_ROTATION_270  = 0x00000003,
+};
+
+#define HFI_PROP_ROTATION                                       0x0300014b
+
+enum hfi_flip {
+	HFI_DISABLE_FLIP    = 0x00000000,
+	HFI_HORIZONTAL_FLIP = 0x00000001,
+	HFI_VERTICAL_FLIP   = 0x00000002,
+};
+
+#define HFI_PROP_FLIP                                           0x0300014c
+
+#define HFI_PROP_SCALAR                                         0x0300014d
+
+enum hfi_blur_types {
+	HFI_BLUR_NONE     = 0x00000000,
+	HFI_BLUR_EXTERNAL = 0x00000001,
+	HFI_BLUR_ADAPTIVE = 0x00000002,
+};
+
+#define HFI_PROP_BLUR_TYPES                                     0x0300014e
+
+#define HFI_BITMASK_BLUR_WIDTH        0xffff0000
+#define HFI_BITMASK_BLUR_HEIGHT       0x0000ffff
+#define HFI_PROP_BLUR_RESOLUTION                                0x0300014f
+
+#define HFI_BITMASK_SPS_ID            0x000000ff
+#define HFI_BITMASK_PPS_ID            0x0000ff00
+#define HFI_BITMASK_VPS_ID            0x00ff0000
+#define HFI_PROP_SEQUENCE_HEADER_IDS                            0x03000150
+
+#define HFI_PROP_AUD                                            0x03000151
+
+#define HFI_PROP_DPB_LUMA_CHROMA_MISR                           0x03000153
+
+#define HFI_PROP_OPB_LUMA_CHROMA_MISR                           0x03000154
+
+#define HFI_BITMASK_QP_I               0x000000ff
+#define HFI_BITMASK_QP_P               0x0000ff00
+#define HFI_BITMASK_QP_B               0x00ff0000
+#define HFI_BITMASK_QP_ENABLE          0x0f000000
+#define HFI_BITMASK_QP_LAYERS          0xf0000000
+#define HFI_PROP_SIGNAL_COLOR_INFO                              0x03000155
+
+enum hfi_interlace_info {
+	HFI_INTERLACE_INFO_NONE                = 0x00000000,
+	HFI_FRAME_PROGRESSIVE                  = 0x00000001,
+	HFI_FRAME_MBAFF                        = 0x00000002,
+	HFI_FRAME_INTERLEAVE_TOPFIELD_FIRST    = 0x00000004,
+	HFI_FRAME_INTERLEAVE_BOTTOMFIELD_FIRST = 0x00000008,
+	HFI_FRAME_INTERLACE_TOPFIELD_FIRST     = 0x00000010,
+	HFI_FRAME_INTERLACE_BOTTOMFIELD_FIRST  = 0x00000020,
+};
+
+#define HFI_PROP_INTERLACE_INFO                                 0x03000156
+
+#define HFI_PROP_CSC                                            0x03000157
+
+#define HFI_PROP_CSC_MATRIX                                     0x03000158
+
+#define HFI_PROP_CSC_BIAS                                       0x03000159
+
+#define HFI_PROP_CSC_LIMIT                                      0x0300015a
+
+#define HFI_PROP_DECODE_ORDER_OUTPUT                            0x0300015b
+
+#define HFI_PROP_TIMESTAMP                                      0x0300015c
+
+#define HFI_PROP_FRAMERATE_FROM_BITSTREAM                       0x0300015d
+
+#define HFI_PROP_SEI_RECOVERY_POINT                             0x0300015e
+
+#define HFI_PROP_CONEALED_MB_COUNT                              0x0300015f
+
+#define HFI_BITMASK_SAR_WIDTH        0xffff0000
+#define HFI_BITMASK_SAR_HEIGHT       0x0000ffff
+#define HFI_PROP_SAR_RESOLUTION                                 0x03000160
+
+#define HFI_PROP_HISTOGRAM_INFO                                 0x03000161
+
+enum hfi_picture_type {
+	HFI_PICTURE_IDR = 0x00000001,
+	HFI_PICTURE_P   = 0x00000002,
+	HFI_PICTURE_B   = 0x00000004,
+	HFI_PICTURE_I   = 0x00000008,
+	HFI_PICTURE_CRA = 0x00000010,
+	HFI_PICTURE_BLA = 0x00000020,
+	HFI_PICTURE_NOSHOW = 0x00000040,
+};
+
+#define HFI_PROP_PICTURE_TYPE                                   0x03000162
+
+#define HFI_PROP_SEI_MASTERING_DISPLAY_COLOUR                   0x03000163
+
+#define HFI_PROP_SEI_CONTENT_LIGHT_LEVEL                        0x03000164
+
+#define HFI_PROP_SEI_HDR10PLUS_USERDATA                         0x03000165
+
+#define HFI_PROP_SEI_STREAM_USERDATA                            0x03000166
+
+#define HFI_PROP_EVA_STAT_INFO                                  0x03000167
+
+#define HFI_PROP_DEC_DEFAULT_HEADER                             0x03000168
+
+#define HFI_PROP_DEC_START_FROM_RAP_FRAME                       0x03000169
+
+#define HFI_PROP_NO_OUTPUT                                      0x0300016a
+
+#define HFI_PROP_BUFFER_TAG                                     0x0300016b
+
+#define HFI_PROP_BUFFER_MARK                                    0x0300016c
+
+#define HFI_PROP_SUBFRAME_OUTPUT                                0x0300016d
+
+#define HFI_PROP_ENC_QP_METADATA                                0x0300016e
+
+#define HFI_PROP_DEC_QP_METADATA                                0x0300016f
+
+#define HFI_PROP_SEI_FRAME_PACKING_ARRANGEMENT                  0x03000170
+
+#define HFI_PROP_SEI_PAN_SCAN_RECT                              0x03000171
+
+#define HFI_PROP_THUMBNAIL_MODE                                 0x03000172
+
+#define HFI_PROP_ROI_INFO                                       0x03000173
+
+#define HFI_PROP_WORST_COMPRESSION_RATIO                        0x03000174
+
+#define HFI_PROP_WORST_COMPLEXITY_FACTOR                        0x03000175
+
+#define HFI_PROP_VBV_DELAY                                      0x03000176
+
+#define HFI_PROP_SEQ_CHANGE_AT_SYNC_FRAME                       0x03000177
+
+#define HFI_BITMASK_RAW_WIDTH                           0xffff0000
+#define HFI_BITMASK_RAW_HEIGHT                          0x0000ffff
+#define HFI_PROP_RAW_RESOLUTION                                 0x03000178
+
+#define HFI_PROP_DPB_TAG_LIST                                   0x03000179
+
+#define HFI_PROP_DPB_LIST                                       0x0300017A
+
+enum hfi_nal_length_field_type {
+	HFI_NAL_LENGTH_STARTCODES           = 0,
+	HFI_NAL_LENGTH_SIZE_4               = 4,
+};
+
+#define HFI_PROP_NAL_LENGTH_FIELD                               0x0300017B
+
+#define HFI_PROP_TOTAL_PEAK_BITRATE                             0x0300017C
+
+#define HFI_PROP_MAINTAIN_MIN_QUALITY                           0x0300017D
+
+#define HFI_PROP_IR_CYCLIC_PERIOD                               0x0300017E
+
+#define HFI_PROP_ENABLE_SLICE_DELIVERY                          0x0300017F
+
+#define HFI_PROP_AV1_FILM_GRAIN_PRESENT                         0x03000180
+
+#define HFI_PROP_AV1_SUPER_BLOCK_ENABLED                        0x03000181
+
+#define HFI_PROP_AV1_OP_POINT                                   0x03000182
+
+#define HFI_PROP_SUBFRAME_INPUT                                 0x03000183
+
+#define HFI_PROP_OPB_ENABLE                                     0x03000184
+
+#define HFI_PROP_AV1_TILE_ROWS_COLUMNS                          0x03000187
+
+#define HFI_PROP_AV1_DRAP_CONFIG                                0x03000189
+
+enum hfi_saliency_type {
+	HFI_SALIENCY_NONE,
+	HFI_SALIENCY_TYPE0,
+};
+
+#define HFI_PROP_ROI_AS_SALIENCY_INFO                           0x0300018A
+
+#define HFI_PROP_FENCE                                          0x0300018B
+
+#define HFI_PROP_REQUEST_PREPROCESS                             0x0300018E
+
+#define HFI_PROP_UBWC_STRIDE_SCANLINE                           0x03000190
+
+#define HFI_PROP_TRANSCODING_STAT_INFO                          0x03000191
+
+#define HFI_PROP_DOLBY_RPU_METADATA                             0x03000192
+
+#define HFI_PROP_COMV_BUFFER_COUNT                              0x03000193
+
+#define HFI_PROP_DISABLE_VUI_TIMING_INFO                        0x03000194
+
+#define HFI_PROP_SLICE_DECODE                                   0x03000196
+
+#define HFI_PROP_AV1_UNIFORM_TILE_SPACING                       0x03000197
+
+#define HFI_PROP_ENC_RING_BIN_BUF                               0x0300019C
+
+/* u32 */
+enum hfi_fence_type {
+	HFI_SW_FENCE                      = 0x00000001,
+	HFI_SYNX_V2_FENCE                 = 0x00000002,
+};
+
+#define HFI_PROP_FENCE_TYPE                                     0x0300019D
+
+enum hfi_fence_direction_type {
+	HFI_FENCE_TX_ENABLE          = 0x00000001,
+	HFI_FENCE_RX_ENABLE          = 0x00000002,
+};
+
+#define HFI_PROP_FENCE_DIRECTION                                0x0300019E
+
+#define HFI_PROP_FENCE_ERROR_DATA_CORRUPT                       0x0300019F
+
+#define HFI_PROP_END                                            0x03FFFFFF
+
+#define HFI_SESSION_ERROR_BEGIN                                 0x04000000
+
+#define HFI_ERROR_UNKNOWN_SESSION                               0x04000001
+
+#define HFI_ERROR_MAX_SESSIONS                                  0x04000002
+
+#define HFI_ERROR_FATAL                                         0x04000003
+
+#define HFI_ERROR_INVALID_STATE                                 0x04000004
+
+#define HFI_ERROR_INSUFFICIENT_RESOURCES                        0x04000005
+
+#define HFI_ERROR_BUFFER_NOT_SET                                0x04000006
+
+#define HFI_ERROR_DRAP_CONFIG_EXCEED                            0x04000007
+
+#define HFI_SESSION_ERROR_END                                   0x04FFFFFF
+
+#define HFI_SYSTEM_ERROR_BEGIN                                  0x05000000
+
+#define HFI_SYS_ERROR_WD_TIMEOUT                                0x05000001
+
+#define HFI_SYS_ERROR_NOC                                       0x05000002
+
+#define HFI_SYS_ERROR_FATAL                                     0x05000003
+
+#define HFI_SYSTEM_ERROR_END                                    0x05FFFFFF
+
+#define HFI_INFORMATION_BEGIN                                   0x06000000
+
+#define HFI_INFO_UNSUPPORTED                                    0x06000001
+
+#define HFI_INFO_DATA_CORRUPT                                   0x06000002
+
+#define HFI_INFO_NEGATIVE_TIMESTAMP                             0x06000003
+
+#define HFI_INFO_BUFFER_OVERFLOW                                0x06000004
+
+#define HFI_INFO_VCODEC_RESET                                   0x06000005
+
+#define HFI_INFO_HFI_FLAG_DRAIN_LAST                            0x06000006
+
+#define HFI_INFO_HFI_FLAG_PSC_LAST                              0x06000007
+
+#define HFI_INFO_FENCE_SIGNAL_ERROR                             0x06000008
+
+#define HFI_INFORMATION_END                                     0x06FFFFFF
+
+#endif //__H_HFI_PROPERTY_H__
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_media_info.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_media_info.h
@@ -0,0 +1,612 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __MSM_MEDIA_INFO_H__
+#define __MSM_MEDIA_INFO_H__
+
+#include "msm_vidc_internal.h"
+
+/* Width and Height should be multiple of 16 */
+#define INTERLACE_WIDTH_MAX 1920
+#define INTERLACE_HEIGHT_MAX 1920
+#define INTERLACE_MB_PER_FRAME_MAX ((1920 * 1088) / 256)
+
+#ifndef MSM_MEDIA_ALIGN
+#define MSM_MEDIA_ALIGN(__sz, __align) (((__align) & ((__align) - 1)) ?\
+	((((__sz) + (__align) - 1) / (__align)) * (__align)) :\
+	(((__sz) + (__align) - 1) & (~((__align) - 1))))
+#endif
+
+#ifndef MSM_MEDIA_ROUNDUP
+#define MSM_MEDIA_ROUNDUP(__sz, __r) (((__sz) + ((__r) - 1)) / (__r))
+#endif
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static inline unsigned int video_y_stride_bytes(unsigned int colorformat,
+						unsigned int width)
+{
+	unsigned int alignment, stride = 0;
+
+	if (!width)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV12:
+	case MSM_VIDC_FMT_NV21:
+	case MSM_VIDC_FMT_NV12C:
+		alignment = 128;
+		stride = MSM_MEDIA_ALIGN(width, alignment);
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		alignment = 256;
+		stride = MSM_MEDIA_ALIGN(width, 192);
+		stride = MSM_MEDIA_ALIGN(stride * 4 / 3, alignment);
+		break;
+	case MSM_VIDC_FMT_P010:
+		alignment = 256;
+		stride = MSM_MEDIA_ALIGN(width * 2, alignment);
+		break;
+	default:
+		break;
+	}
+invalid_input:
+	return stride;
+}
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static inline unsigned int video_y_stride_pix(unsigned int colorformat,
+					      unsigned int width)
+{
+	unsigned int alignment, stride = 0;
+
+	if (!width)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV12:
+	case MSM_VIDC_FMT_NV21:
+	case MSM_VIDC_FMT_NV12C:
+	case MSM_VIDC_FMT_P010:
+		alignment = 128;
+		stride = MSM_MEDIA_ALIGN(width, alignment);
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		alignment = 192;
+		stride = MSM_MEDIA_ALIGN(width, alignment);
+		break;
+	default:
+		break;
+	}
+
+invalid_input:
+	return stride;
+}
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static inline unsigned int video_uv_stride_bytes(unsigned int colorformat,
+						 unsigned int width)
+{
+	unsigned int alignment, stride = 0;
+
+	if (!width)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV21:
+	case MSM_VIDC_FMT_NV12:
+	case MSM_VIDC_FMT_NV12C:
+		alignment = 128;
+		stride = MSM_MEDIA_ALIGN(width, alignment);
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		alignment = 256;
+		stride = MSM_MEDIA_ALIGN(width, 192);
+		stride = MSM_MEDIA_ALIGN(stride * 4 / 3, alignment);
+		break;
+	case MSM_VIDC_FMT_P010:
+		alignment = 256;
+		stride = MSM_MEDIA_ALIGN(width * 2, alignment);
+		break;
+	default:
+		break;
+	}
+invalid_input:
+	return stride;
+}
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static inline unsigned int video_uv_stride_pix(unsigned int colorformat,
+					       unsigned int width)
+{
+	unsigned int alignment, stride = 0;
+
+	if (!width)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV21:
+	case MSM_VIDC_FMT_NV12:
+	case MSM_VIDC_FMT_NV12C:
+	case MSM_VIDC_FMT_P010:
+		alignment = 128;
+		stride = MSM_MEDIA_ALIGN(width, alignment);
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		alignment = 192;
+		stride = MSM_MEDIA_ALIGN(width, alignment);
+		break;
+	default:
+		break;
+	}
+invalid_input:
+	return stride;
+}
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @height
+ * Progressive: height
+ * Interlaced: (height+1)>>1
+ */
+static inline unsigned int video_y_scanlines(unsigned int colorformat,
+					     unsigned int height)
+{
+	unsigned int alignment, sclines = 0;
+
+	if (!height)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV12:
+	case MSM_VIDC_FMT_NV21:
+	case MSM_VIDC_FMT_NV12C:
+	case MSM_VIDC_FMT_P010:
+		alignment = 32;
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		alignment = 16;
+		break;
+	default:
+		return 0;
+	}
+	sclines = MSM_MEDIA_ALIGN(height, alignment);
+invalid_input:
+	return sclines;
+}
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @height
+ * Progressive: height
+ * Interlaced: (height+1)>>1
+ */
+static inline unsigned int video_uv_scanlines(unsigned int colorformat,
+					      unsigned int height)
+{
+	unsigned int alignment, sclines = 0;
+
+	if (!height)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV21:
+	case MSM_VIDC_FMT_NV12:
+	case MSM_VIDC_FMT_TP10C:
+	case MSM_VIDC_FMT_P010:
+		alignment = 16;
+		break;
+	case MSM_VIDC_FMT_NV12C:
+		alignment = 32;
+		break;
+	default:
+		goto invalid_input;
+	}
+
+	sclines = MSM_MEDIA_ALIGN((height + 1) >> 1, alignment);
+
+invalid_input:
+	return sclines;
+}
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static inline unsigned int video_y_meta_stride(unsigned int colorformat,
+					       unsigned int width)
+{
+	int y_tile_width = 0, y_meta_stride = 0;
+
+	if (!width)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV12C:
+		y_tile_width = 32;
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		y_tile_width = 48;
+		break;
+	default:
+		goto invalid_input;
+	}
+
+	y_meta_stride = MSM_MEDIA_ROUNDUP(width, y_tile_width);
+	y_meta_stride = MSM_MEDIA_ALIGN(y_meta_stride, 64);
+
+invalid_input:
+	return y_meta_stride;
+}
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @height
+ * Progressive: height
+ * Interlaced: (height+1)>>1
+ */
+static inline unsigned int video_y_meta_scanlines(unsigned int colorformat,
+						  unsigned int height)
+{
+	int y_tile_height = 0, y_meta_scanlines = 0;
+
+	if (!height)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV12C:
+		y_tile_height = 8;
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		y_tile_height = 4;
+		break;
+	default:
+		goto invalid_input;
+	}
+
+	y_meta_scanlines = MSM_MEDIA_ROUNDUP(height, y_tile_height);
+	y_meta_scanlines = MSM_MEDIA_ALIGN(y_meta_scanlines, 16);
+
+invalid_input:
+	return y_meta_scanlines;
+}
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @width
+ * Progressive: width
+ * Interlaced: width
+ */
+static inline unsigned int video_uv_meta_stride(unsigned int colorformat,
+						unsigned int width)
+{
+	int uv_tile_width = 0, uv_meta_stride = 0;
+
+	if (!width)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV12C:
+		uv_tile_width = 16;
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		uv_tile_width = 24;
+		break;
+	default:
+		goto invalid_input;
+	}
+
+	uv_meta_stride = MSM_MEDIA_ROUNDUP((width + 1) >> 1, uv_tile_width);
+	uv_meta_stride = MSM_MEDIA_ALIGN(uv_meta_stride, 64);
+
+invalid_input:
+	return uv_meta_stride;
+}
+
+/*
+ * Function arguments:
+ * @v4l2_fmt
+ * @height
+ * Progressive: height
+ * Interlaced: (height+1)>>1
+ */
+static inline unsigned int video_uv_meta_scanlines(unsigned int colorformat,
+						   unsigned int height)
+{
+	int uv_tile_height = 0, uv_meta_scanlines = 0;
+
+	if (!height)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV12C:
+		uv_tile_height = 8;
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		uv_tile_height = 4;
+		break;
+	default:
+		goto invalid_input;
+	}
+
+	uv_meta_scanlines = MSM_MEDIA_ROUNDUP((height + 1) >> 1, uv_tile_height);
+	uv_meta_scanlines = MSM_MEDIA_ALIGN(uv_meta_scanlines, 16);
+
+invalid_input:
+	return uv_meta_scanlines;
+}
+
+static inline unsigned int video_rgb_stride_bytes(unsigned int colorformat,
+						  unsigned int width)
+{
+	unsigned int alignment = 0, stride = 0, bpp = 4;
+
+	if (!width)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_RGBA8888C:
+	case MSM_VIDC_FMT_RGBA8888:
+		alignment = 256;
+		break;
+	default:
+		goto invalid_input;
+	}
+
+	stride = MSM_MEDIA_ALIGN(width * bpp, alignment);
+
+invalid_input:
+	return stride;
+}
+
+static inline unsigned int video_rgb_stride_pix(unsigned int colorformat,
+						unsigned int width)
+{
+	unsigned int bpp = 4;
+
+	return video_rgb_stride_bytes(colorformat, width) / bpp;
+}
+
+static inline unsigned int video_rgb_scanlines(unsigned int colorformat,
+					       unsigned int height)
+{
+	unsigned int alignment = 0, scanlines = 0;
+
+	if (!height)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_RGBA8888C:
+		alignment = 16;
+		break;
+	case MSM_VIDC_FMT_RGBA8888:
+		alignment = 32;
+		break;
+	default:
+		goto invalid_input;
+	}
+
+	scanlines = MSM_MEDIA_ALIGN(height, alignment);
+
+invalid_input:
+	return scanlines;
+}
+
+static inline unsigned int video_rgb_meta_stride(unsigned int colorformat,
+						 unsigned int width)
+{
+	int rgb_tile_width = 0, rgb_meta_stride = 0;
+
+	if (!width)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_RGBA8888C:
+	case MSM_VIDC_FMT_RGBA8888:
+		rgb_tile_width = 16;
+		break;
+	default:
+		goto invalid_input;
+	}
+
+	rgb_meta_stride = MSM_MEDIA_ROUNDUP(width, rgb_tile_width);
+	rgb_meta_stride = MSM_MEDIA_ALIGN(rgb_meta_stride, 64);
+
+invalid_input:
+	return rgb_meta_stride;
+}
+
+static inline unsigned int video_rgb_meta_scanlines(unsigned int colorformat,
+						    unsigned int height)
+{
+	int rgb_tile_height = 0, rgb_meta_scanlines = 0;
+
+	if (!height)
+		goto invalid_input;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_RGBA8888C:
+	case MSM_VIDC_FMT_RGBA8888:
+		rgb_tile_height = 4;
+		break;
+	default:
+		goto invalid_input;
+	}
+
+	rgb_meta_scanlines = MSM_MEDIA_ROUNDUP(height, rgb_tile_height);
+	rgb_meta_scanlines = MSM_MEDIA_ALIGN(rgb_meta_scanlines, 16);
+
+invalid_input:
+	return rgb_meta_scanlines;
+}
+
+static inline unsigned int video_buffer_size(unsigned int colorformat,
+					     unsigned int pix_width,
+					     unsigned int pix_height,
+					     unsigned int interlace)
+{
+	unsigned int size = 0;
+	unsigned int y_plane, uv_plane, y_stride,
+		uv_stride, y_sclines, uv_sclines;
+	unsigned int y_ubwc_plane = 0, uv_ubwc_plane = 0;
+	unsigned int y_meta_stride = 0, y_meta_scanlines = 0;
+	unsigned int uv_meta_stride = 0, uv_meta_scanlines = 0;
+	unsigned int y_meta_plane = 0, uv_meta_plane = 0;
+	unsigned int rgb_stride = 0, rgb_scanlines = 0;
+	unsigned int rgb_plane = 0, rgb_ubwc_plane = 0, rgb_meta_plane = 0;
+	unsigned int rgb_meta_stride = 0, rgb_meta_scanlines = 0;
+
+	if (!pix_width || !pix_height)
+		goto invalid_input;
+
+	y_stride = video_y_stride_bytes(colorformat, pix_width);
+	uv_stride = video_uv_stride_bytes(colorformat, pix_width);
+	y_sclines = video_y_scanlines(colorformat, pix_height);
+	uv_sclines = video_uv_scanlines(colorformat, pix_height);
+	rgb_stride = video_rgb_stride_bytes(colorformat, pix_width);
+	rgb_scanlines = video_rgb_scanlines(colorformat, pix_height);
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV21:
+	case MSM_VIDC_FMT_NV12:
+	case MSM_VIDC_FMT_P010:
+		y_plane = y_stride * y_sclines;
+		uv_plane = uv_stride * uv_sclines;
+		size = y_plane + uv_plane;
+		break;
+	case MSM_VIDC_FMT_NV12C:
+		y_meta_stride = video_y_meta_stride(colorformat, pix_width);
+		uv_meta_stride = video_uv_meta_stride(colorformat, pix_width);
+		if (!interlace && colorformat == MSM_VIDC_FMT_NV12C) {
+			y_ubwc_plane = MSM_MEDIA_ALIGN(y_stride * y_sclines, 4096);
+			uv_ubwc_plane = MSM_MEDIA_ALIGN(uv_stride * uv_sclines, 4096);
+			y_meta_scanlines =
+				video_y_meta_scanlines(colorformat, pix_height);
+			y_meta_plane = MSM_MEDIA_ALIGN(y_meta_stride *
+						       y_meta_scanlines, 4096);
+			uv_meta_scanlines =
+				video_uv_meta_scanlines(colorformat, pix_height);
+			uv_meta_plane = MSM_MEDIA_ALIGN(uv_meta_stride *
+							uv_meta_scanlines,
+							4096);
+			size = (y_ubwc_plane + uv_ubwc_plane + y_meta_plane +
+				uv_meta_plane);
+		} else {
+			if (pix_width <= INTERLACE_WIDTH_MAX &&
+				pix_height <= INTERLACE_HEIGHT_MAX &&
+				(pix_height * pix_width) / 256 <= INTERLACE_MB_PER_FRAME_MAX) {
+				y_sclines =
+					video_y_scanlines(colorformat, (pix_height + 1) >> 1);
+				y_ubwc_plane =
+					MSM_MEDIA_ALIGN(y_stride * y_sclines, 4096);
+				uv_sclines =
+					video_uv_scanlines(colorformat, (pix_height + 1) >> 1);
+				uv_ubwc_plane =
+					MSM_MEDIA_ALIGN(uv_stride * uv_sclines, 4096);
+				y_meta_scanlines =
+				video_y_meta_scanlines(colorformat, (pix_height + 1) >> 1);
+				y_meta_plane = MSM_MEDIA_ALIGN(y_meta_stride *
+							       y_meta_scanlines,
+							       4096);
+				uv_meta_scanlines =
+				video_uv_meta_scanlines(colorformat, (pix_height + 1) >> 1);
+				uv_meta_plane = MSM_MEDIA_ALIGN(uv_meta_stride *
+								uv_meta_scanlines,
+								4096);
+				size = (y_ubwc_plane + uv_ubwc_plane + y_meta_plane +
+					uv_meta_plane)*2;
+			} else {
+				y_sclines = video_y_scanlines(colorformat, pix_height);
+				y_ubwc_plane =
+					MSM_MEDIA_ALIGN(y_stride * y_sclines, 4096);
+				uv_sclines = video_uv_scanlines(colorformat, pix_height);
+				uv_ubwc_plane =
+					MSM_MEDIA_ALIGN(uv_stride * uv_sclines, 4096);
+				y_meta_scanlines =
+					video_y_meta_scanlines(colorformat, pix_height);
+				y_meta_plane = MSM_MEDIA_ALIGN(y_meta_stride *
+							       y_meta_scanlines,
+							       4096);
+				uv_meta_scanlines =
+					video_uv_meta_scanlines(colorformat, pix_height);
+				uv_meta_plane = MSM_MEDIA_ALIGN(uv_meta_stride *
+								uv_meta_scanlines,
+								4096);
+				size = (y_ubwc_plane + uv_ubwc_plane + y_meta_plane +
+					uv_meta_plane);
+			}
+		}
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		y_ubwc_plane = MSM_MEDIA_ALIGN(y_stride * y_sclines, 4096);
+		uv_ubwc_plane = MSM_MEDIA_ALIGN(uv_stride * uv_sclines, 4096);
+		y_meta_stride = video_y_meta_stride(colorformat, pix_width);
+		y_meta_scanlines = video_y_meta_scanlines(colorformat, pix_height);
+		y_meta_plane = MSM_MEDIA_ALIGN(y_meta_stride *
+					       y_meta_scanlines, 4096);
+		uv_meta_stride = video_uv_meta_stride(colorformat, pix_width);
+		uv_meta_scanlines = video_uv_meta_scanlines(colorformat, pix_height);
+		uv_meta_plane = MSM_MEDIA_ALIGN(uv_meta_stride *
+						uv_meta_scanlines,
+						4096);
+
+		size = y_ubwc_plane + uv_ubwc_plane + y_meta_plane +
+			uv_meta_plane;
+		break;
+	case MSM_VIDC_FMT_RGBA8888C:
+		rgb_ubwc_plane = MSM_MEDIA_ALIGN(rgb_stride * rgb_scanlines,
+						 4096);
+		rgb_meta_stride = video_rgb_meta_stride(colorformat, pix_width);
+		rgb_meta_scanlines = video_rgb_meta_scanlines(colorformat,
+							      pix_height);
+		rgb_meta_plane = MSM_MEDIA_ALIGN(rgb_meta_stride *
+						 rgb_meta_scanlines, 4096);
+		size = rgb_ubwc_plane + rgb_meta_plane;
+		break;
+	case MSM_VIDC_FMT_RGBA8888:
+		rgb_plane = MSM_MEDIA_ALIGN(rgb_stride * rgb_scanlines, 4096);
+		size = rgb_plane;
+		break;
+	default:
+		break;
+	}
+
+invalid_input:
+	size = MSM_MEDIA_ALIGN(size, 4096);
+	return size;
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vdec.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vdec.h
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VDEC_H_
+#define _MSM_VDEC_H_
+
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+
+int msm_vdec_streamoff_input(struct msm_vidc_inst *inst);
+int msm_vdec_streamon_input(struct msm_vidc_inst *inst);
+int msm_vdec_streamoff_output(struct msm_vidc_inst *inst);
+int msm_vdec_streamon_output(struct msm_vidc_inst *inst);
+int msm_vdec_qbuf(struct msm_vidc_inst *inst, struct vb2_buffer *vb2);
+int msm_vdec_try_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_vdec_s_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_vdec_g_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_vdec_s_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s);
+int msm_vdec_g_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s);
+int msm_vdec_subscribe_event(struct msm_vidc_inst *inst,
+			     const struct v4l2_event_subscription *sub);
+int msm_vdec_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f);
+int msm_vdec_inst_init(struct msm_vidc_inst *inst);
+int msm_vdec_inst_deinit(struct msm_vidc_inst *inst);
+int msm_vdec_init_input_subcr_params(struct msm_vidc_inst *inst);
+int msm_vdec_input_port_settings_change(struct msm_vidc_inst *inst);
+int msm_vdec_output_port_settings_change(struct msm_vidc_inst *inst);
+int msm_vdec_stop_cmd(struct msm_vidc_inst *inst);
+int msm_vdec_start_cmd(struct msm_vidc_inst *inst);
+int msm_vdec_handle_release_buffer(struct msm_vidc_inst *inst,
+				   struct msm_vidc_buffer *buf);
+int msm_vdec_set_num_comv(struct msm_vidc_inst *inst);
+int msm_vdec_subscribe_metadata(struct msm_vidc_inst *inst,
+				enum msm_vidc_port_type port);
+int msm_vdec_get_input_internal_buffers(struct msm_vidc_inst *inst);
+int msm_vdec_create_input_internal_buffers(struct msm_vidc_inst *inst);
+int msm_vdec_queue_input_internal_buffers(struct msm_vidc_inst *inst);
+int msm_vdec_release_input_internal_buffers(struct msm_vidc_inst *inst);
+
+#endif // _MSM_VDEC_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_venc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_venc.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VENC_H_
+#define _MSM_VENC_H_
+
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+
+int msm_venc_streamoff_input(struct msm_vidc_inst *inst);
+int msm_venc_streamon_input(struct msm_vidc_inst *inst);
+int msm_venc_streamoff_output(struct msm_vidc_inst *inst);
+int msm_venc_streamon_output(struct msm_vidc_inst *inst);
+int msm_venc_qbuf(struct msm_vidc_inst *inst, struct vb2_buffer *vb2);
+int msm_venc_stop_cmd(struct msm_vidc_inst *inst);
+int msm_venc_start_cmd(struct msm_vidc_inst *inst);
+int msm_venc_try_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_venc_s_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_venc_s_fmt_output(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_venc_g_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_venc_s_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s);
+int msm_venc_g_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s);
+int msm_venc_s_param(struct msm_vidc_inst *inst,
+		     struct v4l2_streamparm *s_parm);
+int msm_venc_g_param(struct msm_vidc_inst *inst,
+		     struct v4l2_streamparm *s_parm);
+int msm_venc_subscribe_event(struct msm_vidc_inst *inst,
+			     const struct v4l2_event_subscription *sub);
+int msm_venc_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f);
+int msm_venc_inst_init(struct msm_vidc_inst *inst);
+int msm_venc_inst_deinit(struct msm_vidc_inst *inst);
+
+#endif // _MSM_VENC_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc.h
@@ -0,0 +1,60 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_H_
+#define _MSM_VIDC_H_
+
+#include <linux/videodev2.h>
+#include <media/media-device.h>
+
+union msm_v4l2_cmd {
+	struct v4l2_decoder_cmd dec;
+	struct v4l2_encoder_cmd enc;
+};
+
+void *msm_vidc_open(struct msm_vidc_core *core, u32 session_type);
+int msm_vidc_close(struct msm_vidc_inst *inst);
+int msm_vidc_querycap(struct msm_vidc_inst *inst, struct v4l2_capability *cap);
+int msm_vidc_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f);
+int msm_vidc_try_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_vidc_s_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_vidc_g_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f);
+int msm_vidc_s_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s);
+int msm_vidc_g_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s);
+int msm_vidc_s_param(struct msm_vidc_inst *inst, struct v4l2_streamparm *sp);
+int msm_vidc_g_param(struct msm_vidc_inst *inst, struct v4l2_streamparm *sp);
+int msm_vidc_reqbufs(struct msm_vidc_inst *inst, struct v4l2_requestbuffers *b);
+int msm_vidc_querybuf(struct msm_vidc_inst *inst, struct v4l2_buffer *b);
+int msm_vidc_create_bufs(struct msm_vidc_inst *inst, struct v4l2_create_buffers *b);
+int msm_vidc_prepare_buf(struct msm_vidc_inst *inst, struct media_device *mdev,
+			 struct v4l2_buffer *b);
+int msm_vidc_exportbuf(struct msm_vidc_inst *inst, struct media_device *mdev,
+		       struct v4l2_exportbuffer *eb);
+int msm_vidc_release_buffer(struct msm_vidc_inst *inst, int buffer_type,
+			    unsigned int buffer_index);
+int msm_vidc_qbuf(struct msm_vidc_inst *inst, struct media_device *mdev,
+		  struct v4l2_buffer *b);
+int msm_vidc_dqbuf(struct msm_vidc_inst *inst, struct v4l2_buffer *b);
+int msm_vidc_streamon(struct msm_vidc_inst *inst, enum v4l2_buf_type i);
+int msm_vidc_query_ctrl(struct msm_vidc_inst *inst, struct v4l2_queryctrl *ctrl);
+int msm_vidc_query_menu(struct msm_vidc_inst *inst, struct v4l2_querymenu *qmenu);
+int msm_vidc_streamoff(struct msm_vidc_inst *inst, enum v4l2_buf_type i);
+int msm_vidc_try_cmd(struct msm_vidc_inst *inst, union msm_v4l2_cmd *cmd);
+int msm_vidc_start_cmd(struct msm_vidc_inst *inst);
+int msm_vidc_stop_cmd(struct msm_vidc_inst *inst);
+int msm_vidc_poll(struct msm_vidc_inst *inst, struct file *filp,
+		  struct poll_table_struct *pt);
+int msm_vidc_mmap(struct msm_vidc_inst *inst, struct file *filp, struct vm_area_struct *vma);
+int msm_vidc_subscribe_event(struct msm_vidc_inst *inst,
+			     const struct v4l2_event_subscription *sub);
+int msm_vidc_unsubscribe_event(struct msm_vidc_inst *inst,
+			       const struct v4l2_event_subscription *sub);
+int msm_vidc_dqevent(struct msm_vidc_inst *inst, struct v4l2_event *event);
+int msm_vidc_g_crop(struct msm_vidc_inst *inst, struct v4l2_crop *a);
+int msm_vidc_enum_framesizes(struct msm_vidc_inst *inst, struct v4l2_frmsizeenum *fsize);
+int msm_vidc_enum_frameintervals(struct msm_vidc_inst *inst, struct v4l2_frmivalenum *fival);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_buffer.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_buffer.h
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_MSM_VIDC_BUFFER_H__
+#define __H_MSM_VIDC_BUFFER_H__
+
+#include "msm_vidc_inst.h"
+
+#define MIN_DEC_INPUT_BUFFERS  4
+#define MIN_DEC_OUTPUT_BUFFERS 4
+
+#define MIN_ENC_INPUT_BUFFERS  4
+#define MIN_ENC_OUTPUT_BUFFERS 4
+
+#define DCVS_ENC_EXTRA_INPUT_BUFFERS  4
+#define DCVS_DEC_EXTRA_OUTPUT_BUFFERS 4
+
+u32 msm_vidc_input_min_count(struct msm_vidc_inst *inst);
+u32 msm_vidc_output_min_count(struct msm_vidc_inst *inst);
+u32 msm_vidc_input_extra_count(struct msm_vidc_inst *inst);
+u32 msm_vidc_output_extra_count(struct msm_vidc_inst *inst);
+u32 msm_vidc_internal_buffer_count(struct msm_vidc_inst *inst,
+				   enum msm_vidc_buffer_type buffer_type);
+u32 msm_vidc_decoder_input_size(struct msm_vidc_inst *inst);
+u32 msm_vidc_decoder_output_size(struct msm_vidc_inst *inst);
+u32 msm_vidc_decoder_input_meta_size(struct msm_vidc_inst *inst);
+u32 msm_vidc_decoder_output_meta_size(struct msm_vidc_inst *inst);
+u32 msm_vidc_encoder_input_size(struct msm_vidc_inst *inst);
+u32 msm_vidc_encoder_output_size(struct msm_vidc_inst *inst);
+u32 msm_vidc_encoder_input_meta_size(struct msm_vidc_inst *inst);
+u32 msm_vidc_encoder_output_meta_size(struct msm_vidc_inst *inst);
+u32 msm_vidc_enc_delivery_mode_based_output_buf_size(struct msm_vidc_inst *inst,
+						     u32 frame_size);
+
+#endif // __H_MSM_VIDC_BUFFER_H__
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_control.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_control.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_CONTROL_H_
+#define _MSM_VIDC_CONTROL_H_
+
+#include "msm_vidc_internal.h"
+#include "msm_vidc_inst.h"
+
+int msm_vidc_ctrl_handler_init(struct msm_vidc_inst *inst, bool init);
+int msm_vidc_ctrl_handler_deinit(struct msm_vidc_inst *inst);
+int msm_v4l2_op_s_ctrl(struct v4l2_ctrl *ctrl);
+int msm_v4l2_op_g_volatile_ctrl(struct v4l2_ctrl *ctrl);
+int msm_vidc_s_ctrl(struct msm_vidc_inst *inst, struct v4l2_ctrl *ctrl);
+int msm_vidc_prepare_dependency_list(struct msm_vidc_inst *inst);
+int msm_vidc_adjust_v4l2_properties(struct msm_vidc_inst *inst);
+int msm_vidc_set_v4l2_properties(struct msm_vidc_inst *inst);
+bool is_valid_cap_id(enum msm_vidc_inst_capability_type cap_id);
+bool is_valid_cap(struct msm_vidc_inst *inst,
+		  enum msm_vidc_inst_capability_type cap_id);
+enum msm_vidc_inst_capability_type
+	msm_vidc_get_cap_id(struct msm_vidc_inst *inst, u32 id);
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_core.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_core.h
@@ -0,0 +1,132 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_CORE_H_
+#define _MSM_VIDC_CORE_H_
+
+#include <linux/platform_device.h>
+
+#include "msm_vidc_internal.h"
+#include "msm_vidc_state.h"
+#include "venus_hfi_queue.h"
+#include "resources.h"
+
+struct msm_vidc_core;
+
+#define MAX_EVENTS   30
+
+#define call_venus_op(d, op, ...)			\
+	(((d) && (d)->venus_ops && (d)->venus_ops->op) ? \
+	((d)->venus_ops->op(__VA_ARGS__)) : 0)
+
+struct msm_vidc_venus_ops {
+	int (*boot_firmware)(struct msm_vidc_core *core);
+	int (*raise_interrupt)(struct msm_vidc_core *core);
+	int (*clear_interrupt)(struct msm_vidc_core *core);
+	int (*prepare_pc)(struct msm_vidc_core *core);
+	int (*power_on)(struct msm_vidc_core *core);
+	int (*power_off)(struct msm_vidc_core *core);
+	int (*watchdog)(struct msm_vidc_core *core, u32 intr_status);
+	int (*noc_error_info)(struct msm_vidc_core *core);
+	int (*switch_gdsc_mode)(struct msm_vidc_core *core, bool sw_mode);
+};
+
+struct msm_vidc_synx_fence_data {
+	u32                             client_id;
+	void                           *session;
+	u32                             client_flags; /* not used */
+	struct msm_vidc_mem             queue;
+};
+
+struct msm_vidc_mem_addr {
+	u32 align_device_addr;
+	u8 *align_virtual_addr;
+	u32 mem_size;
+	struct msm_vidc_mem mem;
+};
+
+struct msm_vidc_iface_q_info {
+	void *q_hdr;
+	struct msm_vidc_mem_addr q_array;
+};
+
+struct msm_video_device {
+	enum msm_vidc_domain_type              type;
+	struct video_device                    vdev;
+	struct v4l2_m2m_dev                   *m2m_dev;
+};
+
+struct msm_vidc_core_power {
+	u64 clk_freq;
+	u64 bw_ddr;
+	u64 bw_llcc;
+};
+
+struct msm_vidc_core {
+	struct platform_device                *pdev;
+	struct msm_video_device                vdev[2];
+	struct v4l2_device                     v4l2_dev;
+	struct media_device                    media_dev;
+	struct list_head                       instances;
+	struct list_head                       dangling_instances;
+	struct dentry                         *debugfs_parent;
+	struct dentry                         *debugfs_root;
+	char                                   fw_version[MAX_NAME_LENGTH];
+	enum msm_vidc_core_state               state;
+	int                                  (*state_handle)(struct msm_vidc_core *core,
+							     enum msm_vidc_core_event_type type,
+							     struct msm_vidc_event_data *data);
+	enum msm_vidc_core_sub_state           sub_state;
+	char                                   sub_state_name[MAX_NAME_LENGTH];
+	struct mutex                           lock;
+	struct msm_vidc_resource              *resource;
+	struct msm_vidc_platform              *platform;
+	u32                                    intr_status;
+	u32                                    spur_count;
+	u32                                    reg_count;
+	u32                                    enc_codecs_count;
+	u32                                    dec_codecs_count;
+	struct msm_vidc_core_capability        capabilities[CORE_CAP_MAX + 1];
+	struct msm_vidc_inst_capability       *inst_caps;
+	struct msm_vidc_mem_addr               sfr;
+	struct msm_vidc_mem_addr               iface_q_table;
+	struct msm_vidc_mem_addr               mmap_buf;
+	struct msm_vidc_mem_addr               aon_reg;
+	struct msm_vidc_mem_addr               fence_reg;
+	struct msm_vidc_mem_addr               qtimer_reg;
+	struct msm_vidc_iface_q_info           iface_queues[VIDC_IFACEQ_NUMQ];
+	struct delayed_work                    pm_work;
+	struct workqueue_struct               *pm_workq;
+	struct workqueue_struct               *batch_workq;
+	struct delayed_work                    fw_unload_work;
+	struct work_struct                     ssr_work;
+	struct msm_vidc_core_power             power;
+	struct msm_vidc_ssr                    ssr;
+	u32                                    skip_pc_count;
+	u32                                    last_packet_type;
+	u8                                    *packet;
+	u32                                    packet_size;
+	u8                                    *response_packet;
+	struct v4l2_file_operations           *v4l2_file_ops;
+	struct v4l2_ioctl_ops                 *v4l2_ioctl_ops_enc;
+	struct v4l2_ioctl_ops                 *v4l2_ioctl_ops_dec;
+	struct v4l2_ctrl_ops                  *v4l2_ctrl_ops;
+	struct vb2_ops                        *vb2_ops;
+	struct vb2_mem_ops                    *vb2_mem_ops;
+	struct v4l2_m2m_ops                   *v4l2_m2m_ops;
+	struct msm_vidc_venus_ops             *venus_ops;
+	const struct msm_vidc_resources_ops   *res_ops;
+	struct msm_vidc_session_ops           *session_ops;
+	const struct msm_vidc_memory_ops      *mem_ops;
+	struct media_device_ops               *media_device_ops;
+	const struct msm_vidc_fence_ops       *fence_ops;
+	u32                                    header_id;
+	u32                                    packet_id;
+	u32                                    sys_init_id;
+	struct msm_vidc_synx_fence_data        synx_fence_data;
+};
+
+#endif // _MSM_VIDC_CORE_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_debug.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_debug.h
@@ -0,0 +1,225 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __MSM_VIDC_DEBUG__
+#define __MSM_VIDC_DEBUG__
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/debugfs.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+
+struct msm_vidc_core;
+struct msm_vidc_inst;
+
+#ifndef VIDC_DBG_LABEL
+#define VIDC_DBG_LABEL "msm_vidc"
+#endif
+
+/* Allow only 6 prints/sec */
+#define VIDC_DBG_SESSION_RATELIMIT_INTERVAL (1 * HZ)
+#define VIDC_DBG_SESSION_RATELIMIT_BURST 6
+
+#define VIDC_DBG_TAG_INST VIDC_DBG_LABEL ": %4s: %s: "
+#define VIDC_DBG_TAG_CORE VIDC_DBG_LABEL ": %4s: %08x: %s: "
+#define FW_DBG_TAG VIDC_DBG_LABEL ": %6s: "
+#define DEFAULT_SID ((u32)-1)
+
+#ifndef MSM_VIDC_EMPTY_BRACE
+#define MSM_VIDC_EMPTY_BRACE {},
+#endif
+
+extern unsigned int msm_vidc_debug;
+extern unsigned int msm_fw_debug;
+extern bool msm_vidc_lossless_encode;
+extern bool msm_vidc_syscache_disable;
+extern int msm_vidc_clock_voting;
+extern int msm_vidc_ddr_bw;
+extern int msm_vidc_llc_bw;
+extern bool msm_vidc_fw_dump;
+extern unsigned int msm_vidc_enable_bugon;
+extern bool msm_vidc_synx_fence_enable;
+
+/* do not modify the log message as it is used in test scripts */
+#define FMT_STRING_SET_CTRL \
+	"%s: state %s, name %s, id 0x%x value %d\n"
+#define FMT_STRING_STATE_CHANGE \
+	"%s: state changed to %s from %s\n"
+#define FMT_STRING_MSG_SFR \
+	"SFR Message from FW: %s\n"
+#define FMT_STRING_FAULT_HANDLER \
+	"%s: faulting address: %lx\n"
+#define FMT_STRING_SET_CAP \
+	"set cap: name: %24s, cap value: %#10x, hfi: %#10llx\n"
+
+/* To enable messages OR these values and
+ * echo the result to debugfs file.
+ *
+ * To enable all messages set msm_vidc_debug = 0x101F
+ */
+
+enum vidc_msg_prio_drv {
+	VIDC_ERR        = 0x00000001,
+	VIDC_HIGH       = 0x00000002,
+	VIDC_LOW        = 0x00000004,
+	VIDC_PERF       = 0x00000008,
+	VIDC_PKT        = 0x00000010,
+	VIDC_BUS        = 0x00000020,
+	VIDC_STAT       = 0x00000040,
+	VIDC_ENCODER    = 0x00000100,
+	VIDC_DECODER    = 0x00000200,
+	VIDC_PRINTK     = 0x10000000,
+	VIDC_FTRACE     = 0x20000000,
+};
+
+enum vidc_msg_prio_fw {
+	FW_LOW          = 0x00000001,
+	FW_MED          = 0x00000002,
+	FW_HIGH         = 0x00000004,
+	FW_ERROR        = 0x00000008,
+	FW_FATAL        = 0x00000010,
+	FW_PERF         = 0x00000020,
+	FW_CACHE_LOW    = 0x00000100,
+	FW_CACHE_MED    = 0x00000200,
+	FW_CACHE_HIGH   = 0x00000400,
+	FW_CACHE_ERROR  = 0x00000800,
+	FW_CACHE_FATAL  = 0x00001000,
+	FW_CACHE_PERF   = 0x00002000,
+	FW_PRINTK       = 0x10000000,
+	FW_FTRACE       = 0x20000000,
+};
+
+#define DRV_LOG        (VIDC_ERR | VIDC_PRINTK)
+#define DRV_LOGSHIFT   (0)
+#define DRV_LOGMASK    (0x0FFFFFFF)
+
+#define FW_LOG         (FW_ERROR | FW_FATAL | FW_PRINTK)
+#define FW_LOGSHIFT    (0)
+#define FW_LOGMASK     (0x0FFFFFFF)
+
+#define dprintk_inst(__level, __level_str, inst, __fmt, ...) \
+	do { \
+		if (msm_vidc_debug & VIDC_FTRACE) { \
+			if (inst && (msm_vidc_debug & (__level))) { \
+				trace_printk(VIDC_DBG_TAG_INST __fmt, \
+					__level_str, \
+					inst->debug_str, \
+					##__VA_ARGS__); \
+			} \
+		} else { \
+			if (inst && (msm_vidc_debug & (__level))) { \
+				pr_info(VIDC_DBG_TAG_INST __fmt, \
+					__level_str, \
+					inst->debug_str, \
+					##__VA_ARGS__); \
+			} \
+		} \
+	} while (0)
+
+#define i_vpr_e(inst, __fmt, ...) dprintk_inst(VIDC_ERR,  "err ", inst, __fmt, ##__VA_ARGS__)
+#define i_vpr_i(inst, __fmt, ...) dprintk_inst(VIDC_HIGH, "high", inst, __fmt, ##__VA_ARGS__)
+#define i_vpr_h(inst, __fmt, ...) dprintk_inst(VIDC_HIGH, "high", inst, __fmt, ##__VA_ARGS__)
+#define i_vpr_l(inst, __fmt, ...) dprintk_inst(VIDC_LOW,  "low ", inst, __fmt, ##__VA_ARGS__)
+#define i_vpr_p(inst, __fmt, ...) dprintk_inst(VIDC_PERF, "perf", inst, __fmt, ##__VA_ARGS__)
+#define i_vpr_t(inst, __fmt, ...) dprintk_inst(VIDC_PKT,  "pkt ", inst, __fmt, ##__VA_ARGS__)
+#define i_vpr_b(inst, __fmt, ...) dprintk_inst(VIDC_BUS,  "bus ", inst, __fmt, ##__VA_ARGS__)
+#define i_vpr_s(inst, __fmt, ...) dprintk_inst(VIDC_STAT, "stat", inst, __fmt, ##__VA_ARGS__)
+
+#define i_vpr_hp(inst, __fmt, ...) \
+	dprintk_inst(VIDC_HIGH | VIDC_PERF, "high", inst, __fmt, ##__VA_ARGS__)
+#define i_vpr_hs(inst, __fmt, ...) \
+	dprintk_inst(VIDC_HIGH | VIDC_STAT, "stat", inst, __fmt, ##__VA_ARGS__)
+
+#define dprintk_core(__level, __level_str, __fmt, ...) \
+	do { \
+		if (msm_vidc_debug & VIDC_FTRACE) { \
+			if (msm_vidc_debug & (__level)) { \
+				trace_printk(VIDC_DBG_TAG_CORE __fmt, \
+					__level_str, \
+					DEFAULT_SID, \
+					"codec", \
+					##__VA_ARGS__); \
+			} \
+		} else { \
+			if (msm_vidc_debug & (__level)) { \
+				pr_info(VIDC_DBG_TAG_CORE __fmt, \
+					__level_str, \
+					DEFAULT_SID, \
+					"codec", \
+					##__VA_ARGS__); \
+			} \
+		} \
+	} while (0)
+
+#define d_vpr_e(__fmt, ...) dprintk_core(VIDC_ERR,  "err ", __fmt, ##__VA_ARGS__)
+#define d_vpr_h(__fmt, ...) dprintk_core(VIDC_HIGH, "high", __fmt, ##__VA_ARGS__)
+#define d_vpr_l(__fmt, ...) dprintk_core(VIDC_LOW,  "low ", __fmt, ##__VA_ARGS__)
+#define d_vpr_p(__fmt, ...) dprintk_core(VIDC_PERF, "perf", __fmt, ##__VA_ARGS__)
+#define d_vpr_t(__fmt, ...) dprintk_core(VIDC_PKT,  "pkt ", __fmt, ##__VA_ARGS__)
+#define d_vpr_b(__fmt, ...) dprintk_core(VIDC_BUS,  "bus ", __fmt, ##__VA_ARGS__)
+#define d_vpr_s(__fmt, ...) dprintk_core(VIDC_STAT, "stat", __fmt, ##__VA_ARGS__)
+#define d_vpr_hs(__fmt, ...) \
+	dprintk_core(VIDC_HIGH | VIDC_STAT, "high", __fmt, ##__VA_ARGS__)
+
+#define dprintk_ratelimit(__level, __level_str, __fmt, ...) \
+	do { \
+		if (msm_vidc_check_ratelimit()) { \
+			dprintk_core(__level, __level_str, __fmt, ##__VA_ARGS__); \
+		} \
+	} while (0)
+
+#define dprintk_firmware(__level, __fmt, ...)	\
+	do { \
+		if ((msm_fw_debug & (__level)) & FW_PRINTK) { \
+			pr_info(FW_DBG_TAG __fmt, \
+				"fw", \
+				##__VA_ARGS__); \
+		} else if ((msm_fw_debug & (__level)) & FW_FTRACE) { \
+			trace_printk(FW_DBG_TAG __fmt, \
+				"fw", \
+				##__VA_ARGS__); \
+		} \
+	} while (0)
+
+#define MSM_VIDC_FATAL(value)	\
+	do { \
+		if (value) { \
+			d_vpr_e("bug on\n"); \
+			BUG_ON(value); \
+		} \
+	} while (0)
+
+enum msm_vidc_debugfs_event {
+	MSM_VIDC_DEBUGFS_EVENT_ETB,
+	MSM_VIDC_DEBUGFS_EVENT_EBD,
+	MSM_VIDC_DEBUGFS_EVENT_FTB,
+	MSM_VIDC_DEBUGFS_EVENT_FBD,
+};
+
+enum msm_vidc_bug_on_error {
+	MSM_VIDC_BUG_ON_FATAL             = BIT(0),
+	MSM_VIDC_BUG_ON_NOC               = BIT(1),
+	MSM_VIDC_BUG_ON_WD_TIMEOUT        = BIT(2),
+};
+
+struct dentry *msm_vidc_debugfs_init_drv(void);
+struct dentry *msm_vidc_debugfs_init_core(struct msm_vidc_core *core);
+struct dentry *msm_vidc_debugfs_init_inst(struct msm_vidc_inst *inst,
+					  struct dentry *parent);
+void msm_vidc_debugfs_deinit_inst(struct msm_vidc_inst *inst);
+void msm_vidc_debugfs_update(struct msm_vidc_inst *inst,
+			     enum msm_vidc_debugfs_event e);
+int msm_vidc_check_ratelimit(void);
+void msm_vidc_show_stats(struct msm_vidc_inst *inst);
+
+static inline bool is_stats_enabled(void)
+{
+	return !!(msm_vidc_debug & VIDC_STAT);
+}
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_driver.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_driver.h
@@ -0,0 +1,648 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_DRIVER_H_
+#define _MSM_VIDC_DRIVER_H_
+
+#include <linux/workqueue.h>
+#include <linux/iommu.h>
+#include "msm_vidc_internal.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_inst.h"
+
+#define MSM_VIDC_SESSION_INACTIVE_THRESHOLD_MS 1000
+
+/* Offset base for buffers on the destination queue - used to distinguish
+ * between source and destination buffers when mmapping - they receive the same
+ * offsets but for different queues */
+#define SRC_META_QUEUE_OFF_BASE	(1 << 29)
+#define DST_QUEUE_OFF_BASE	(1 << 30)
+#define DST_META_QUEUE_OFF_BASE	(1 << 31)
+
+
+enum msm_vidc_debugfs_event;
+
+static inline bool is_decode_session(struct msm_vidc_inst *inst)
+{
+	return inst->domain == MSM_VIDC_DECODER;
+}
+
+static inline bool is_encode_session(struct msm_vidc_inst *inst)
+{
+	return inst->domain == MSM_VIDC_ENCODER;
+}
+
+static inline bool is_image_encode_session(struct msm_vidc_inst *inst)
+{
+	return inst->codec == MSM_VIDC_HEIC && inst->domain == MSM_VIDC_ENCODER;
+}
+
+static inline bool is_image_decode_session(struct msm_vidc_inst *inst)
+{
+	return inst->codec == MSM_VIDC_HEIC && inst->domain == MSM_VIDC_DECODER;
+}
+
+static inline bool is_image_session(struct msm_vidc_inst *inst)
+{
+	return inst->codec == MSM_VIDC_HEIC;
+}
+
+static inline bool is_secure_session(struct msm_vidc_inst *inst)
+{
+	return !!(inst->capabilities[SECURE_MODE].value);
+}
+
+static inline bool is_input_buffer(enum msm_vidc_buffer_type buffer_type)
+{
+	return buffer_type == MSM_VIDC_BUF_INPUT;
+}
+
+static inline bool is_output_buffer(enum msm_vidc_buffer_type buffer_type)
+{
+	return buffer_type == MSM_VIDC_BUF_OUTPUT;
+}
+
+static inline bool is_input_meta_buffer(enum msm_vidc_buffer_type buffer_type)
+{
+	return buffer_type == MSM_VIDC_BUF_INPUT_META;
+}
+
+static inline bool is_output_meta_buffer(enum msm_vidc_buffer_type buffer_type)
+{
+	return buffer_type == MSM_VIDC_BUF_OUTPUT_META;
+}
+
+static inline bool is_ts_reorder_allowed(struct msm_vidc_inst *inst)
+{
+	return !!(inst->capabilities[TS_REORDER].value &&
+		is_decode_session(inst) && !is_image_session(inst));
+}
+
+static inline bool is_scaling_enabled(struct msm_vidc_inst *inst)
+{
+	return inst->crop.left != inst->compose.left ||
+		inst->crop.top != inst->compose.top ||
+		inst->crop.width != inst->compose.width ||
+		inst->crop.height != inst->compose.height;
+}
+
+static inline bool is_rotation_90_or_270(struct msm_vidc_inst *inst)
+{
+	return inst->capabilities[ROTATION].value == 90 ||
+		inst->capabilities[ROTATION].value == 270;
+}
+
+static inline bool is_internal_buffer(enum msm_vidc_buffer_type buffer_type)
+{
+	return buffer_type == MSM_VIDC_BUF_BIN ||
+		buffer_type == MSM_VIDC_BUF_ARP ||
+		buffer_type == MSM_VIDC_BUF_COMV ||
+		buffer_type == MSM_VIDC_BUF_NON_COMV ||
+		buffer_type == MSM_VIDC_BUF_LINE ||
+		buffer_type == MSM_VIDC_BUF_DPB ||
+		buffer_type == MSM_VIDC_BUF_PERSIST ||
+		buffer_type == MSM_VIDC_BUF_VPSS ||
+		buffer_type == MSM_VIDC_BUF_PARTIAL_DATA;
+}
+
+static inline bool is_meta_cap(struct msm_vidc_inst *inst, u32 cap)
+{
+	if (inst->capabilities[cap].flags & CAP_FLAG_META)
+		return true;
+
+	return false;
+}
+
+static inline bool is_meta_rx_inp_enabled(struct msm_vidc_inst *inst, u32 cap)
+{
+	bool enabled = false;
+
+	if (!is_meta_cap(inst, cap))
+		return false;
+
+	if (inst->capabilities[cap].value & MSM_VIDC_META_ENABLE &&
+		inst->capabilities[cap].value & MSM_VIDC_META_RX_INPUT)
+		enabled = true;
+
+	return enabled;
+}
+
+static inline bool is_meta_rx_out_enabled(struct msm_vidc_inst *inst, u32 cap)
+{
+	bool enabled = false;
+
+	if (!is_meta_cap(inst, cap))
+		return false;
+
+	if (inst->capabilities[cap].value & MSM_VIDC_META_ENABLE &&
+		inst->capabilities[cap].value & MSM_VIDC_META_RX_OUTPUT)
+		enabled = true;
+
+	return enabled;
+}
+
+static inline bool is_meta_tx_inp_enabled(struct msm_vidc_inst *inst, u32 cap)
+{
+	bool enabled = false;
+
+	if (!is_meta_cap(inst, cap))
+		return false;
+
+	if (inst->capabilities[cap].value & MSM_VIDC_META_ENABLE &&
+		inst->capabilities[cap].value & MSM_VIDC_META_TX_INPUT)
+		enabled = true;
+
+	return enabled;
+}
+
+static inline bool is_dyn_meta_tx_inp_enabled(struct msm_vidc_inst *inst, u32 cap)
+{
+	bool enabled = false;
+
+	if (!is_meta_cap(inst, cap))
+		return false;
+
+	if (inst->capabilities[cap].value & MSM_VIDC_META_DYN_ENABLE &&
+		inst->capabilities[cap].value & MSM_VIDC_META_TX_INPUT)
+		enabled = true;
+
+	return enabled;
+}
+
+static inline bool is_meta_tx_out_enabled(struct msm_vidc_inst *inst, u32 cap)
+{
+	bool enabled = false;
+
+	if (!is_meta_cap(inst, cap))
+		return false;
+
+	if (inst->capabilities[cap].value & MSM_VIDC_META_ENABLE &&
+		inst->capabilities[cap].value & MSM_VIDC_META_TX_OUTPUT)
+		enabled = true;
+
+	return enabled;
+}
+
+static inline bool is_dyn_meta_tx_out_enabled(struct msm_vidc_inst *inst, u32 cap)
+{
+	bool enabled = false;
+
+	if (!is_meta_cap(inst, cap))
+		return false;
+
+	if (inst->capabilities[cap].value & MSM_VIDC_META_DYN_ENABLE &&
+		inst->capabilities[cap].value & MSM_VIDC_META_TX_OUTPUT)
+		enabled = true;
+
+	return enabled;
+}
+
+static inline bool is_any_meta_tx_out_enabled(struct msm_vidc_inst *inst)
+{
+	bool enabled = false;
+	u32 i;
+
+	for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+		if (is_meta_tx_out_enabled(inst, i) ||
+			is_dyn_meta_tx_out_enabled(inst, i)) {
+			enabled = true;
+			break;
+		}
+	}
+
+	return enabled;
+}
+
+static inline bool is_any_meta_tx_inp_enabled(struct msm_vidc_inst *inst)
+{
+	bool enabled = false;
+	u32 i;
+
+	for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+		if (is_meta_tx_inp_enabled(inst, i) ||
+			is_dyn_meta_tx_inp_enabled(inst, i)) {
+			enabled = true;
+			break;
+		}
+	}
+
+	return enabled;
+}
+
+static inline bool is_input_meta_enabled(struct msm_vidc_inst *inst)
+{
+	bool enabled = false;
+	u32 i;
+
+	for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+		if (is_meta_tx_inp_enabled(inst, i) ||
+			is_dyn_meta_tx_inp_enabled(inst, i) ||
+			is_meta_rx_inp_enabled(inst, i)) {
+			enabled = true;
+			break;
+		}
+	}
+
+	return enabled;
+}
+
+static inline bool is_output_meta_enabled(struct msm_vidc_inst *inst)
+{
+	bool enabled = false;
+	u32 i;
+
+	for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+		if (is_meta_tx_out_enabled(inst, i) ||
+			is_dyn_meta_tx_out_enabled(inst, i) ||
+			is_meta_rx_out_enabled(inst, i)) {
+			enabled = true;
+			break;
+		}
+	}
+
+	return enabled;
+}
+
+static inline bool is_meta_enabled(struct msm_vidc_inst *inst, unsigned int type)
+{
+	bool enabled = false;
+
+	if (type == MSM_VIDC_BUF_INPUT)
+		enabled = is_input_meta_enabled(inst);
+	else if (type == MSM_VIDC_BUF_OUTPUT)
+		enabled = is_output_meta_enabled(inst);
+
+	return enabled;
+}
+
+static inline bool is_outbuf_fence_enabled(struct msm_vidc_inst *inst)
+{
+	return is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE);
+}
+
+static inline bool is_linear_yuv_colorformat(enum msm_vidc_colorformat_type colorformat)
+{
+	return colorformat == MSM_VIDC_FMT_NV12 ||
+		colorformat == MSM_VIDC_FMT_NV21 ||
+		colorformat == MSM_VIDC_FMT_P010;
+}
+
+static inline bool is_linear_rgba_colorformat(enum msm_vidc_colorformat_type colorformat)
+{
+	return colorformat == MSM_VIDC_FMT_RGBA8888;
+}
+
+static inline bool is_linear_colorformat(enum msm_vidc_colorformat_type colorformat)
+{
+	return is_linear_yuv_colorformat(colorformat) || is_linear_rgba_colorformat(colorformat);
+}
+
+static inline bool is_ubwc_colorformat(enum msm_vidc_colorformat_type colorformat)
+{
+	return colorformat == MSM_VIDC_FMT_NV12C ||
+		colorformat == MSM_VIDC_FMT_TP10C ||
+		colorformat == MSM_VIDC_FMT_RGBA8888C;
+}
+
+static inline bool is_10bit_colorformat(enum msm_vidc_colorformat_type colorformat)
+{
+	return colorformat == MSM_VIDC_FMT_P010 ||
+		colorformat == MSM_VIDC_FMT_TP10C;
+}
+
+static inline bool is_8bit_colorformat(enum msm_vidc_colorformat_type colorformat)
+{
+	return colorformat == MSM_VIDC_FMT_NV12 ||
+		colorformat == MSM_VIDC_FMT_NV12C ||
+		colorformat == MSM_VIDC_FMT_NV21 ||
+		colorformat == MSM_VIDC_FMT_RGBA8888 ||
+		colorformat == MSM_VIDC_FMT_RGBA8888C;
+}
+
+static inline bool is_rgba_colorformat(enum msm_vidc_colorformat_type colorformat)
+{
+	return colorformat == MSM_VIDC_FMT_RGBA8888 ||
+		colorformat == MSM_VIDC_FMT_RGBA8888C;
+}
+
+static inline bool is_split_mode_enabled(struct msm_vidc_inst *inst)
+{
+	if (!is_decode_session(inst))
+		return false;
+
+	if (is_linear_colorformat(inst->capabilities[PIX_FMTS].value) ||
+		(inst->codec == MSM_VIDC_AV1 &&
+		inst->capabilities[FILM_GRAIN].value))
+		return true;
+
+	return false;
+}
+
+static inline bool is_thumbnail_session(struct msm_vidc_inst *inst)
+{
+	return !!(inst->capabilities[THUMBNAIL_MODE].value);
+}
+
+static inline bool is_low_power_session(struct msm_vidc_inst *inst)
+{
+	return (inst->capabilities[QUALITY_MODE].value ==
+		MSM_VIDC_POWER_SAVE_MODE);
+}
+
+static inline bool is_realtime_session(struct msm_vidc_inst *inst)
+{
+	return inst->capabilities[PRIORITY].value == 0 ? true : false;
+}
+
+static inline bool is_critical_priority_session(struct msm_vidc_inst *inst)
+{
+	return !!(inst->capabilities[CRITICAL_PRIORITY].value);
+}
+
+static inline bool is_lowlatency_session(struct msm_vidc_inst *inst)
+{
+	return !!(inst->capabilities[LOWLATENCY_MODE].value);
+}
+
+static inline bool is_hierb_type_requested(struct msm_vidc_inst *inst)
+{
+	return (inst->codec == MSM_VIDC_H264 &&
+			inst->capabilities[LAYER_TYPE].value ==
+				V4L2_MPEG_VIDEO_H264_HIERARCHICAL_CODING_B) ||
+			(inst->codec == MSM_VIDC_HEVC &&
+			inst->capabilities[LAYER_TYPE].value ==
+				V4L2_MPEG_VIDEO_HEVC_HIERARCHICAL_CODING_B);
+}
+
+static inline bool is_active_session(u64 prev, u64 curr)
+{
+	u64 ts_delta;
+
+	if (!prev || !curr)
+		return true;
+
+	ts_delta = (prev < curr) ? curr - prev : prev - curr;
+
+	return ((ts_delta / NSEC_PER_MSEC) <=
+			MSM_VIDC_SESSION_INACTIVE_THRESHOLD_MS);
+}
+
+static inline bool is_session_error(struct msm_vidc_inst *inst)
+{
+	return inst->state == MSM_VIDC_ERROR;
+}
+
+static inline bool is_secure_region(enum msm_vidc_buffer_region region)
+{
+	return !(region == MSM_VIDC_NON_SECURE ||
+			region == MSM_VIDC_NON_SECURE_PIXEL);
+}
+
+static inline bool is_enc_slice_delivery_mode(struct msm_vidc_inst *inst)
+{
+	if (is_decode_session(inst))
+		return false;
+
+	return (inst->capabilities[SLICE_MODE].value ==
+			V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB &&
+			inst->capabilities[DELIVERY_MODE].value);
+}
+
+const char *cap_name(enum msm_vidc_inst_capability_type cap_id);
+const char *v4l2_pixelfmt_name(struct msm_vidc_inst *inst, u32 pixelfmt);
+const char *v4l2_type_name(u32 port);
+void print_vidc_buffer(u32 tag, const char *tag_str, const char *str,
+		       struct msm_vidc_inst *inst, struct msm_vidc_buffer *vbuf);
+void print_vb2_buffer(const char *str, struct msm_vidc_inst *inst,
+		      struct vb2_buffer *vb2);
+enum msm_vidc_codec_type v4l2_codec_to_driver(struct msm_vidc_inst *inst,
+					      u32 v4l2_codec, const char *func);
+u32 v4l2_codec_from_driver(struct msm_vidc_inst *inst, enum msm_vidc_codec_type codec,
+			   const char *func);
+enum msm_vidc_colorformat_type v4l2_colorformat_to_driver(struct msm_vidc_inst *inst,
+							  u32 colorformat, const char *func);
+u32 v4l2_colorformat_from_driver(struct msm_vidc_inst *inst,
+				 enum msm_vidc_colorformat_type colorformat,
+				 const char *func);
+u32 v4l2_color_primaries_to_driver(struct msm_vidc_inst *inst,
+				   u32 v4l2_primaries, const char *func);
+u32 v4l2_color_primaries_from_driver(struct msm_vidc_inst *inst,
+				     u32 vidc_color_primaries, const char *func);
+u32 v4l2_transfer_char_to_driver(struct msm_vidc_inst *inst,
+				 u32 v4l2_transfer_char, const char *func);
+u32 v4l2_transfer_char_from_driver(struct msm_vidc_inst *inst,
+				   u32 vidc_transfer_char, const char *func);
+u32 v4l2_matrix_coeff_to_driver(struct msm_vidc_inst *inst,
+				u32 v4l2_matrix_coeff, const char *func);
+u32 v4l2_matrix_coeff_from_driver(struct msm_vidc_inst *inst,
+				  u32 vidc_matrix_coeff, const char *func);
+int v4l2_type_to_driver_port(struct msm_vidc_inst *inst, u32 type,
+			     const char *func);
+const char *allow_name(enum msm_vidc_allow allow);
+int msm_vidc_create_internal_buffer(struct msm_vidc_inst *inst,
+				    enum msm_vidc_buffer_type buffer_type, u32 index);
+int msm_vidc_get_internal_buffers(struct msm_vidc_inst *inst,
+				  enum msm_vidc_buffer_type buffer_type);
+int msm_vidc_create_internal_buffers(struct msm_vidc_inst *inst,
+				     enum msm_vidc_buffer_type buffer_type);
+int msm_vidc_queue_internal_buffers(struct msm_vidc_inst *inst,
+				    enum msm_vidc_buffer_type buffer_type);
+int msm_vidc_alloc_and_queue_session_internal_buffers(struct msm_vidc_inst *inst,
+						      enum msm_vidc_buffer_type buffer_type);
+int msm_vidc_release_internal_buffers(struct msm_vidc_inst *inst,
+				      enum msm_vidc_buffer_type buffer_type);
+int msm_vidc_vb2_buffer_done(struct msm_vidc_inst *inst,
+			     struct msm_vidc_buffer *buf);
+int msm_vidc_remove_dangling_session(struct msm_vidc_inst *inst);
+int msm_vidc_remove_session(struct msm_vidc_inst *inst);
+int msm_vidc_add_session(struct msm_vidc_inst *inst);
+int msm_vidc_session_open(struct msm_vidc_inst *inst);
+int msm_vidc_session_set_codec(struct msm_vidc_inst *inst);
+int msm_vidc_session_set_secure_mode(struct msm_vidc_inst *inst);
+int msm_vidc_session_set_default_header(struct msm_vidc_inst *inst);
+int msm_vidc_session_streamoff(struct msm_vidc_inst *inst,
+			       enum msm_vidc_port_type port);
+int msm_vidc_session_close(struct msm_vidc_inst *inst);
+int msm_vidc_kill_session(struct msm_vidc_inst *inst);
+int msm_vidc_get_inst_capability(struct msm_vidc_inst *inst);
+int msm_vidc_change_core_state(struct msm_vidc_core *core,
+			       enum msm_vidc_core_state request_state,
+			       const char *func);
+int msm_vidc_change_core_sub_state(struct msm_vidc_core *core,
+				   enum msm_vidc_core_sub_state clear_sub_states,
+				   enum msm_vidc_core_sub_state set_sub_states,
+				   const char *func);
+int msm_vidc_core_init(struct msm_vidc_core *core);
+int msm_vidc_core_init_wait(struct msm_vidc_core *core);
+int msm_vidc_core_deinit(struct msm_vidc_core *core, bool force);
+int msm_vidc_print_residency_stats(struct msm_vidc_core *core);
+int msm_vidc_reset_residency_stats(struct msm_vidc_core *core);
+int msm_vidc_core_deinit_locked(struct msm_vidc_core *core, bool force);
+int msm_vidc_inst_timeout(struct msm_vidc_inst *inst);
+int msm_vidc_print_buffer_info(struct msm_vidc_inst *inst);
+int msm_vidc_print_inst_info(struct msm_vidc_inst *inst);
+void msm_vidc_print_core_info(struct msm_vidc_core *core);
+int msm_vidc_smmu_fault_handler(struct iommu_domain *domain,
+				struct device *dev, unsigned long iova,
+				int flags, void *data);
+int msm_vidc_trigger_ssr(struct msm_vidc_core *core,
+			 u64 trigger_ssr_val);
+void msm_vidc_ssr_handler(struct work_struct *work);
+int msm_vidc_trigger_stability(struct msm_vidc_core *core,
+			       u64 trigger_stability_val);
+void msm_vidc_stability_handler(struct work_struct *work);
+int cancel_stability_work_sync(struct msm_vidc_inst *inst);
+void msm_vidc_fw_unload_handler(struct work_struct *work);
+int msm_vidc_suspend(struct msm_vidc_core *core);
+void msm_vidc_batch_handler(struct work_struct *work);
+int msm_vidc_v4l2_fh_init(struct msm_vidc_inst *inst);
+int msm_vidc_v4l2_fh_deinit(struct msm_vidc_inst *inst);
+int msm_vidc_vb2_queue_init(struct msm_vidc_inst *inst);
+int msm_vidc_vb2_queue_deinit(struct msm_vidc_inst *inst);
+int msm_vidc_get_control(struct msm_vidc_inst *inst, struct v4l2_ctrl *ctrl);
+struct msm_vidc_buffers *msm_vidc_get_buffers(struct msm_vidc_inst *inst,
+					      enum msm_vidc_buffer_type buffer_type,
+					      const char *func);
+struct msm_vidc_mem_list *msm_vidc_get_mem_info(struct msm_vidc_inst *inst,
+						enum msm_vidc_buffer_type buffer_type,
+						const char *func);
+struct msm_vidc_buffer *msm_vidc_get_driver_buf(struct msm_vidc_inst *inst,
+						struct vb2_buffer *vb2);
+int msm_vidc_allocate_buffers(struct msm_vidc_inst *inst,
+			  enum msm_vidc_buffer_type buf_type, u32 num_buffers);
+int msm_vidc_free_buffers(struct msm_vidc_inst *inst,
+			  enum msm_vidc_buffer_type buf_type);
+void msm_vidc_update_stats(struct msm_vidc_inst *inst,
+			   struct msm_vidc_buffer *buf,
+			   enum msm_vidc_debugfs_event etype);
+void msm_vidc_stats_handler(struct work_struct *work);
+int schedule_stats_work(struct msm_vidc_inst *inst);
+int cancel_stats_work_sync(struct msm_vidc_inst *inst);
+void msm_vidc_print_stats(struct msm_vidc_inst *inst);
+void msm_vidc_print_memory_stats(struct msm_vidc_inst *inst);
+enum msm_vidc_buffer_type v4l2_type_to_driver(u32 type, const char *func);
+u32 v4l2_type_from_driver(enum msm_vidc_buffer_type buffer_type,
+	const char *func);
+
+int msm_vidc_buf_queue(struct msm_vidc_inst *inst, struct msm_vidc_buffer *buf);
+int msm_vidc_queue_buffer_single(struct msm_vidc_inst *inst,
+				 struct vb2_buffer *vb2);
+int msm_vidc_queue_deferred_buffers(struct msm_vidc_inst *inst,
+				    enum msm_vidc_buffer_type buf_type);
+int msm_vidc_destroy_internal_buffer(struct msm_vidc_inst *inst,
+				     struct msm_vidc_buffer *buffer);
+void msm_vidc_destroy_buffers(struct msm_vidc_inst *inst);
+int msm_vidc_flush_buffers(struct msm_vidc_inst *inst,
+			   enum msm_vidc_buffer_type type);
+int msm_vidc_flush_read_only_buffers(struct msm_vidc_inst *inst,
+				     enum msm_vidc_buffer_type type);
+struct msm_vidc_buffer *get_meta_buffer(struct msm_vidc_inst *inst,
+					struct msm_vidc_buffer *vbuf);
+struct msm_vidc_inst *get_inst_ref(struct msm_vidc_core *core,
+				   struct msm_vidc_inst *instance);
+struct msm_vidc_inst *get_inst(struct msm_vidc_core *core,
+			       u32 session_id);
+void put_inst(struct msm_vidc_inst *inst);
+bool msm_vidc_allow_metadata_delivery(struct msm_vidc_inst *inst,
+				      u32 cap_id, u32 port);
+bool msm_vidc_allow_metadata_subscription(struct msm_vidc_inst *inst,
+					  u32 cap_id, u32 port);
+bool msm_vidc_allow_property(struct msm_vidc_inst *inst, u32 hfi_id);
+enum msm_vidc_allow msm_vidc_allow_input_psc(struct msm_vidc_inst *inst);
+bool msm_vidc_allow_drain_last_flag(struct msm_vidc_inst *inst);
+bool msm_vidc_allow_psc_last_flag(struct msm_vidc_inst *inst);
+enum msm_vidc_allow msm_vidc_allow_pm_suspend(struct msm_vidc_core *core);
+int msm_vidc_state_change_streamon(struct msm_vidc_inst *inst,
+		enum msm_vidc_port_type port);
+int msm_vidc_state_change_streamoff(struct msm_vidc_inst *inst,
+		enum msm_vidc_port_type port);
+int msm_vidc_state_change_input_psc(struct msm_vidc_inst *inst);
+int msm_vidc_state_change_drain_last_flag(struct msm_vidc_inst *inst);
+int msm_vidc_state_change_psc_last_flag(struct msm_vidc_inst *inst);
+int msm_vidc_process_drain(struct msm_vidc_inst *inst);
+int msm_vidc_process_resume(struct msm_vidc_inst *inst);
+int msm_vidc_process_streamon_input(struct msm_vidc_inst *inst);
+int msm_vidc_process_streamon_output(struct msm_vidc_inst *inst);
+int msm_vidc_process_stop_done(struct msm_vidc_inst *inst,
+			       enum signal_session_response signal_type);
+int msm_vidc_process_drain_done(struct msm_vidc_inst *inst);
+int msm_vidc_process_drain_last_flag(struct msm_vidc_inst *inst);
+int msm_vidc_process_psc_last_flag(struct msm_vidc_inst *inst);
+int msm_vidc_get_mbs_per_frame(struct msm_vidc_inst *inst);
+u32 msm_vidc_get_max_bitrate(struct msm_vidc_inst *inst);
+int msm_vidc_get_fps(struct msm_vidc_inst *inst);
+int msm_vidc_num_buffers(struct msm_vidc_inst *inst,
+			 enum msm_vidc_buffer_type type,
+			 enum msm_vidc_buffer_attributes attr);
+void core_lock(struct msm_vidc_core *core, const char *function);
+void core_unlock(struct msm_vidc_core *core, const char *function);
+void inst_lock(struct msm_vidc_inst *inst, const char *function);
+void inst_unlock(struct msm_vidc_inst *inst, const char *function);
+void client_lock(struct msm_vidc_inst *inst, const char *function);
+void client_unlock(struct msm_vidc_inst *inst, const char *function);
+int msm_vidc_update_bitstream_buffer_size(struct msm_vidc_inst *inst);
+int msm_vidc_update_meta_port_settings(struct msm_vidc_inst *inst);
+int msm_vidc_update_buffer_count(struct msm_vidc_inst *inst, u32 port);
+void msm_vidc_schedule_core_deinit(struct msm_vidc_core *core);
+bool msm_vidc_is_super_buffer(struct msm_vidc_inst *inst);
+int msm_vidc_init_core_caps(struct msm_vidc_core *core);
+int msm_vidc_init_instance_caps(struct msm_vidc_core *core);
+int msm_vidc_deinit_core_caps(struct msm_vidc_core *core);
+int msm_vidc_update_debug_str(struct msm_vidc_inst *inst);
+void msm_vidc_allow_dcvs(struct msm_vidc_inst *inst);
+bool msm_vidc_allow_decode_batch(struct msm_vidc_inst *inst);
+int msm_vidc_check_session_supported(struct msm_vidc_inst *inst);
+int msm_vidc_check_core_mbps(struct msm_vidc_inst *inst);
+int msm_vidc_check_core_mbpf(struct msm_vidc_inst *inst);
+int msm_vidc_check_scaling_supported(struct msm_vidc_inst *inst);
+int msm_vidc_update_timestamp_rate(struct msm_vidc_inst *inst, u64 timestamp);
+int msm_vidc_set_auto_framerate(struct msm_vidc_inst *inst, u64 timestamp);
+int msm_vidc_get_timestamp_rate(struct msm_vidc_inst *inst);
+int msm_vidc_flush_ts(struct msm_vidc_inst *inst);
+int msm_vidc_ts_reorder_insert_timestamp(struct msm_vidc_inst *inst, u64 timestamp);
+int msm_vidc_ts_reorder_remove_timestamp(struct msm_vidc_inst *inst, u64 timestamp);
+int msm_vidc_ts_reorder_get_first_timestamp(struct msm_vidc_inst *inst, u64 *timestamp);
+int msm_vidc_ts_reorder_flush(struct msm_vidc_inst *inst);
+const char *buf_name(enum msm_vidc_buffer_type type);
+bool res_is_greater_than(u32 width, u32 height,
+			 u32 ref_width, u32 ref_height);
+bool res_is_greater_than_or_equal_to(u32 width, u32 height,
+				     u32 ref_width, u32 ref_height);
+bool res_is_less_than(u32 width, u32 height,
+		      u32 ref_width, u32 ref_height);
+bool res_is_less_than_or_equal_to(u32 width, u32 height,
+				  u32 ref_width, u32 ref_height);
+bool is_hevc_10bit_decode_session(struct msm_vidc_inst *inst);
+int signal_session_msg_receipt(struct msm_vidc_inst *inst,
+			       enum signal_session_response cmd);
+int msm_vidc_get_properties(struct msm_vidc_inst *inst);
+int msm_vidc_update_input_rate(struct msm_vidc_inst *inst, u64 time_us);
+int msm_vidc_add_buffer_stats(struct msm_vidc_inst *inst,
+			      struct msm_vidc_buffer *buf, u64 timestamp);
+int msm_vidc_remove_buffer_stats(struct msm_vidc_inst *inst,
+				 struct msm_vidc_buffer *buf, u64 timestamp);
+int msm_vidc_flush_buffer_stats(struct msm_vidc_inst *inst);
+int msm_vidc_get_input_rate(struct msm_vidc_inst *inst);
+int msm_vidc_get_frame_rate(struct msm_vidc_inst *inst);
+int msm_vidc_get_operating_rate(struct msm_vidc_inst *inst);
+int msm_vidc_alloc_and_queue_input_internal_buffers(struct msm_vidc_inst *inst);
+int vb2_buffer_to_driver(struct vb2_buffer *vb2, struct msm_vidc_buffer *buf);
+bool is_ssr_type_allowed(struct msm_vidc_core *core, u32 type);
+struct msm_vidc_buffer *msm_vidc_fetch_buffer(struct msm_vidc_inst *inst,
+					      struct vb2_buffer *vb2);
+struct context_bank_info
+	*msm_vidc_get_context_bank_for_region(struct msm_vidc_core *core,
+					      enum msm_vidc_buffer_region region);
+struct context_bank_info
+	*msm_vidc_get_context_bank_for_device(struct msm_vidc_core *core, struct device *dev);
+
+int msm_vidc_qbuf_cache_operation(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf);
+int msm_vidc_dqbuf_cache_operation(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf);
+
+#endif // _MSM_VIDC_DRIVER_H_
+
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_events.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_events.h
@@ -0,0 +1,300 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#if !defined(_TRACE_MSM_VIDC_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_MSM_VIDC_H
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM msm_vidc_events
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE msm_vidc_events
+
+#include <linux/tracepoint.h>
+
+#include "msm_vidc_inst.h"
+
+DECLARE_EVENT_CLASS(msm_v4l2_vidc_inst,
+
+	TP_PROTO(char *dummy, struct msm_vidc_inst *inst),
+
+	TP_ARGS(dummy, inst),
+
+	TP_STRUCT__entry(
+		__field(char *, dummy)
+		__field(const char *, debug_str)
+	),
+
+	TP_fast_assign(
+		__entry->dummy = dummy;
+		__entry->debug_str = inst ? inst->debug_str : (u8 *)"";
+	),
+
+	TP_printk("%s: %s\n", __entry->dummy, __entry->debug_str)
+);
+
+DEFINE_EVENT(msm_v4l2_vidc_inst, msm_v4l2_vidc_open,
+
+	TP_PROTO(char *dummy, struct msm_vidc_inst *inst),
+
+	TP_ARGS(dummy, inst)
+);
+
+DEFINE_EVENT(msm_v4l2_vidc_inst, msm_v4l2_vidc_close,
+
+	TP_PROTO(char *dummy, struct msm_vidc_inst *inst),
+
+	TP_ARGS(dummy, inst)
+);
+
+DECLARE_EVENT_CLASS(msm_v4l2_vidc_fw_load,
+
+	TP_PROTO(char *dummy),
+
+	TP_ARGS(dummy),
+
+	TP_STRUCT__entry(
+		__field(char *, dummy)
+	),
+
+	TP_fast_assign(
+		__entry->dummy = dummy;
+	),
+
+	TP_printk("%s\n", __entry->dummy)
+);
+
+DEFINE_EVENT(msm_v4l2_vidc_fw_load, msm_v4l2_vidc_fw_load,
+
+	TP_PROTO(char *dummy),
+
+	TP_ARGS(dummy)
+);
+
+DECLARE_EVENT_CLASS(msm_vidc_driver,
+
+	TP_PROTO(struct msm_vidc_inst *inst, const char *func,
+		const char *old_state, const char *new_state),
+
+	TP_ARGS(inst, func, old_state, new_state),
+
+	TP_STRUCT__entry(
+		__field(const char *, debug_str)
+		__field(const char *, func)
+		__field(const char *, old_state)
+		__field(const char *, new_state)
+	),
+
+	TP_fast_assign(
+		__entry->debug_str = inst ? inst->debug_str : (u8 *)"";
+		__entry->func = func;
+		__entry->old_state = old_state;
+		__entry->new_state = new_state;
+	),
+
+	TP_printk("%s: %s: state changed to %s from %s\n",
+		__entry->debug_str,
+		__entry->func,
+		__entry->new_state,
+		__entry->old_state)
+);
+
+DEFINE_EVENT(msm_vidc_driver, msm_vidc_common_state_change,
+
+	TP_PROTO(struct msm_vidc_inst *inst, const char *func,
+		const char *old_state, const char *new_state),
+
+	TP_ARGS(inst, func, old_state, new_state)
+);
+
+DECLARE_EVENT_CLASS(venus_hfi_var,
+
+	TP_PROTO(u32 cp_start, u32 cp_size,
+		u32 cp_nonpixel_start, u32 cp_nonpixel_size),
+
+	TP_ARGS(cp_start, cp_size, cp_nonpixel_start, cp_nonpixel_size),
+
+	TP_STRUCT__entry(
+		__field(u32, cp_start)
+		__field(u32, cp_size)
+		__field(u32, cp_nonpixel_start)
+		__field(u32, cp_nonpixel_size)
+	),
+
+	TP_fast_assign(
+		__entry->cp_start = cp_start;
+		__entry->cp_size = cp_size;
+		__entry->cp_nonpixel_start = cp_nonpixel_start;
+		__entry->cp_nonpixel_size = cp_nonpixel_size;
+	),
+
+	TP_printk(
+		"TZBSP_MEM_PROTECT_VIDEO_VAR done, cp_start : 0x%x, cp_size : 0x%x, cp_nonpixel_start : 0x%x, cp_nonpixel_size : 0x%x\n",
+		__entry->cp_start,
+		__entry->cp_size,
+		__entry->cp_nonpixel_start,
+		__entry->cp_nonpixel_size)
+);
+
+DEFINE_EVENT(venus_hfi_var, venus_hfi_var_done,
+
+	TP_PROTO(u32 cp_start, u32 cp_size,
+		u32 cp_nonpixel_start, u32 cp_nonpixel_size),
+
+	TP_ARGS(cp_start, cp_size, cp_nonpixel_start, cp_nonpixel_size)
+);
+
+DECLARE_EVENT_CLASS(msm_v4l2_vidc_buffer_events,
+
+	TP_PROTO(struct msm_vidc_inst *inst, const char *str, const char *buf_type,
+			struct msm_vidc_buffer *vbuf, unsigned long inode, long ref_count),
+
+	TP_ARGS(inst, str, buf_type, vbuf, inode, ref_count),
+
+	TP_STRUCT__entry(
+		__field(u8 *, debug_str)
+		__field(const char *, str)
+		__field(const char *, buf_type)
+		__field(u32, index)
+		__field(int, fd)
+		__field(u32, data_offset)
+		__field(u64, device_addr)
+		__field(unsigned long, inode)
+		__field(long, ref_count)
+		__field(u32, buffer_size)
+		__field(u32, data_size)
+		__field(u32, flags)
+		__field(u64, timestamp)
+		__field(int, attr)
+		__field(u64, etb)
+		__field(u64, ebd)
+		__field(u64, ftb)
+		__field(u64, fbd)
+	),
+
+	TP_fast_assign(
+		__entry->debug_str = inst ? inst->debug_str : (u8 *)"";
+		__entry->str = str;
+		__entry->buf_type = buf_type;
+		__entry->index = vbuf ? vbuf->index : -1;
+		__entry->fd = vbuf ? vbuf->fd : 0;
+		__entry->data_offset = vbuf ? vbuf->data_offset : 0;
+		__entry->device_addr = vbuf ? vbuf->device_addr : 0;
+		__entry->inode = inode;
+		__entry->ref_count = ref_count;
+		__entry->buffer_size = vbuf ? vbuf->buffer_size : 0;
+		__entry->data_size = vbuf ? vbuf->data_size : 0;
+		__entry->flags = vbuf ? vbuf->flags : 0;
+		__entry->timestamp = vbuf ? vbuf->timestamp : 0;
+		__entry->attr = vbuf ? vbuf->attr : 0;
+		__entry->etb = inst ? inst->debug_count.etb : 0;
+		__entry->ebd = inst ? inst->debug_count.ebd : 0;
+		__entry->ftb = inst ? inst->debug_count.ftb : 0;
+		__entry->fbd = inst ? inst->debug_count.fbd : 0;
+	),
+
+	TP_printk(
+		"%s: %s: %s: idx %2d fd %3d off %d daddr %#llx inode %8lu ref %2ld size %8d filled %8d flags %#x ts %8lld attr %#x counts(etb ebd ftb fbd) %4llu %4llu %4llu %4llu\n",
+		__entry->debug_str, __entry->str, __entry->buf_type, __entry->index, __entry->fd,
+		__entry->data_offset, __entry->device_addr, __entry->inode, __entry->ref_count,
+		__entry->buffer_size, __entry->data_size, __entry->flags, __entry->timestamp,
+		__entry->attr, __entry->etb, __entry->ebd, __entry->ftb, __entry->fbd)
+);
+
+DEFINE_EVENT(msm_v4l2_vidc_buffer_events, msm_v4l2_vidc_buffer_event_log,
+
+	TP_PROTO(struct msm_vidc_inst *inst, const char *str, const char *buf_type,
+		struct msm_vidc_buffer *vbuf, unsigned long inode, long ref_count),
+
+	TP_ARGS(inst, str, buf_type, vbuf, inode, ref_count)
+);
+
+DECLARE_EVENT_CLASS(msm_vidc_perf,
+
+	TP_PROTO(struct msm_vidc_inst *inst, u64 clk_freq, u64 bw_ddr, u64 bw_llcc),
+
+	TP_ARGS(inst, clk_freq, bw_ddr, bw_llcc),
+
+	TP_STRUCT__entry(
+		__field(u8 *, debug_str)
+		__field(u64, curr_freq)
+		__field(u32, ddr_bw)
+		__field(u32, sys_cache_bw)
+		__field(u32, dcvs_flags)
+		__field(u64, clk_freq)
+		__field(u64, bw_ddr)
+		__field(u64, bw_llcc)
+	),
+
+	TP_fast_assign(
+		__entry->debug_str = inst ? inst->debug_str : (u8 *)"";
+		__entry->curr_freq = inst ? inst->power.curr_freq : 0;
+		__entry->ddr_bw = inst ? inst->power.ddr_bw : 0;
+		__entry->sys_cache_bw = inst ? inst->power.sys_cache_bw : 0;
+		__entry->dcvs_flags = inst ? inst->power.dcvs_flags : 0;
+		__entry->clk_freq = clk_freq;
+		__entry->bw_ddr = bw_ddr;
+		__entry->bw_llcc = bw_llcc;
+	),
+
+	TP_printk("%s: power: inst: clk %lld ddr %d llcc %d dcvs flags %#x, core: clk %lld ddr %lld llcc %lld\n",
+		__entry->debug_str, __entry->curr_freq, __entry->ddr_bw, __entry->sys_cache_bw,
+		__entry->dcvs_flags, __entry->clk_freq, __entry->bw_ddr, __entry->bw_llcc)
+);
+
+DEFINE_EVENT(msm_vidc_perf, msm_vidc_perf_power_scale,
+
+	TP_PROTO(struct msm_vidc_inst *inst, u64 clk_freq, u64 bw_ddr, u64 bw_llcc),
+
+	TP_ARGS(inst, clk_freq, bw_ddr, bw_llcc)
+);
+
+DECLARE_EVENT_CLASS(msm_vidc_buffer_dma_ops,
+
+	TP_PROTO(const char *buffer_op, void *dmabuf, u8 size, void *kvaddr,
+			const char *buf_name, u8 secure, u32 region),
+
+	TP_ARGS(buffer_op, dmabuf, size, kvaddr, buf_name, secure, region),
+
+	TP_STRUCT__entry(
+		__field(const char *, buffer_op)
+		__field(void *, dmabuf)
+		__field(u8, size)
+		__field(void *, kvaddr)
+		__field(const char *, buf_name)
+		__field(u8, secure)
+		__field(u32, region)
+	),
+
+	TP_fast_assign(
+		__entry->buffer_op = buffer_op;
+		__entry->dmabuf = dmabuf;
+		__entry->size = size;
+		__entry->kvaddr = kvaddr;
+		__entry->buf_name = buf_name;
+		__entry->secure = secure;
+		__entry->region = region;
+	),
+
+	TP_printk(
+		"%s: dmabuf %pK, size %d, kvaddr %pK, buffer_type %s, secure %d, region %d\n",
+		__entry->buffer_op, __entry->dmabuf, __entry->size, __entry->kvaddr,
+		__entry->buf_name, __entry->secure, __entry->region)
+);
+
+DEFINE_EVENT(msm_vidc_buffer_dma_ops, msm_vidc_dma_buffer,
+
+	TP_PROTO(const char *buffer_op, void *dmabuf, u8 size, void *kvaddr,
+			const char *buf_name, u8 secure, u32 region),
+
+	TP_ARGS(buffer_op, dmabuf, size, kvaddr, buf_name, secure, region)
+);
+
+#endif
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_fence.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_fence.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __H_MSM_VIDC_FENCE_H__
+#define __H_MSM_VIDC_FENCE_H__
+
+#include "msm_vidc_inst.h"
+#include "msm_vidc_buffer.h"
+
+int msm_vidc_fence_init(struct msm_vidc_inst *inst);
+void msm_vidc_fence_deinit(struct msm_vidc_inst *inst);
+
+#define call_fence_op(c, op, ...)                  \
+	(((c) && (c)->fence_ops && (c)->fence_ops->op) ? \
+	((c)->fence_ops->op(__VA_ARGS__)) : 0)
+
+struct msm_vidc_fence_ops {
+	int (*fence_register)(struct msm_vidc_core *core);
+	int (*fence_deregister)(struct msm_vidc_core *core);
+	struct msm_vidc_fence *(*fence_create)(struct msm_vidc_inst *inst);
+	int (*fence_create_fd)(struct msm_vidc_inst *inst,
+			       struct msm_vidc_fence *fence);
+	void (*fence_destroy)(struct msm_vidc_inst *inst,
+			      u64 fence_id);
+	int (*fence_signal)(struct msm_vidc_inst *inst,
+			    u64 fence_id);
+	void (*fence_recover)(struct msm_vidc_core *core);
+};
+
+const struct msm_vidc_fence_ops *get_dma_fence_ops(void);
+struct msm_vidc_fence *msm_vidc_fence_create(struct msm_vidc_inst *inst);
+int msm_vidc_get_fence_fd(struct msm_vidc_inst *inst, int *fence_fd);
+
+#endif // __H_MSM_VIDC_FENCE_H__
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_inst.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_inst.h
@@ -0,0 +1,150 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_INST_H_
+#define _MSM_VIDC_INST_H_
+
+#include "msm_vidc_internal.h"
+#include "msm_vidc_memory.h"
+#include "msm_vidc_state.h"
+#include "hfi_property.h"
+
+struct msm_vidc_inst;
+
+#define call_session_op(c, op, ...)			\
+	(((c) && (c)->session_ops && (c)->session_ops->op) ? \
+	((c)->session_ops->op(__VA_ARGS__)) : 0)
+
+struct msm_vidc_session_ops {
+	u64 (*calc_freq)(struct msm_vidc_inst *inst, u32 data_size);
+	int (*calc_bw)(struct msm_vidc_inst *inst,
+		       struct vidc_bus_vote_data *vote_data);
+	int (*decide_work_route)(struct msm_vidc_inst *inst);
+	int (*decide_work_mode)(struct msm_vidc_inst *inst);
+	int (*decide_quality_mode)(struct msm_vidc_inst *inst);
+	int (*buffer_size)(struct msm_vidc_inst *inst, enum msm_vidc_buffer_type type);
+	int (*min_count)(struct msm_vidc_inst *inst, enum msm_vidc_buffer_type type);
+	int (*extra_count)(struct msm_vidc_inst *inst, enum msm_vidc_buffer_type type);
+	int (*ring_buf_count)(struct msm_vidc_inst *inst, u32 data_size);
+};
+
+struct msm_vidc_mem_list_info {
+	struct msm_vidc_mem_list        bin;
+	struct msm_vidc_mem_list        arp;
+	struct msm_vidc_mem_list        comv;
+	struct msm_vidc_mem_list        non_comv;
+	struct msm_vidc_mem_list        line;
+	struct msm_vidc_mem_list        dpb;
+	struct msm_vidc_mem_list        persist;
+	struct msm_vidc_mem_list        vpss;
+	struct msm_vidc_mem_list        partial_data;
+};
+
+struct msm_vidc_buffers_info {
+	struct msm_vidc_buffers        input;
+	struct msm_vidc_buffers        output;
+	struct msm_vidc_buffers        read_only;
+	struct msm_vidc_buffers        input_meta;
+	struct msm_vidc_buffers        output_meta;
+	struct msm_vidc_buffers        bin;
+	struct msm_vidc_buffers        arp;
+	struct msm_vidc_buffers        comv;
+	struct msm_vidc_buffers        non_comv;
+	struct msm_vidc_buffers        line;
+	struct msm_vidc_buffers        dpb;
+	struct msm_vidc_buffers        persist;
+	struct msm_vidc_buffers        vpss;
+	struct msm_vidc_buffers        partial_data;
+};
+
+struct buf_queue {
+	struct vb2_queue *vb2q;
+};
+
+struct msm_vidc_inst {
+	struct list_head                   list;
+	struct mutex                       lock;
+	struct mutex                       ctx_q_lock;
+	struct mutex                       client_lock;
+	enum msm_vidc_state                state;
+	int                              (*event_handle)(struct msm_vidc_inst *inst,
+							 enum msm_vidc_event event,
+							 void *data);
+	enum msm_vidc_sub_state            sub_state;
+	char                               sub_state_name[MAX_NAME_LENGTH];
+	enum msm_vidc_domain_type          domain;
+	enum msm_vidc_codec_type           codec;
+	void                              *core;
+	struct kref                        kref;
+	u32                                session_id;
+	u8                                 debug_str[24];
+	void                              *packet;
+	u32                                packet_size;
+	struct v4l2_format                 fmts[MAX_PORT];
+	struct v4l2_ctrl_handler           ctrl_handler;
+	struct v4l2_fh                     fh;
+	struct v4l2_m2m_dev               *m2m_dev;
+	struct v4l2_m2m_ctx               *m2m_ctx;
+	u32                                num_ctrls;
+	enum hfi_rate_control              hfi_rc_type;
+	enum hfi_layer_encoding_type       hfi_layer_type;
+	bool                               request;
+	struct buf_queue                   bufq[MAX_PORT];
+	struct msm_vidc_rectangle          crop;
+	struct msm_vidc_rectangle          compose;
+	struct msm_vidc_power              power;
+	struct vidc_bus_vote_data          bus_data;
+	struct msm_memory_pool             pool[MSM_MEM_POOL_MAX];
+	struct msm_vidc_buffers_info       buffers;
+	struct msm_vidc_mem_list_info      mem_info;
+	struct msm_vidc_timestamps         timestamps;
+	struct msm_vidc_timestamps         ts_reorder; /* struct msm_vidc_timestamp */
+	struct msm_vidc_subscription_params       subcr_params[MAX_PORT];
+	struct msm_vidc_hfi_frame_info     hfi_frame_info;
+	struct msm_vidc_decode_batch       decode_batch;
+	struct msm_vidc_decode_vpp_delay   decode_vpp_delay;
+	struct msm_vidc_session_idle       session_idle;
+	struct delayed_work                stats_work;
+	struct work_struct                 stability_work;
+	struct msm_vidc_stability          stability;
+	struct workqueue_struct           *workq;
+	struct list_head                   enc_input_crs;
+	struct list_head                   dmabuf_tracker; /* struct msm_memory_dmabuf */
+	struct list_head                   input_timer_list; /* struct msm_vidc_input_timer */
+	struct list_head                   caps_list;
+	struct list_head                   children_list; /* struct msm_vidc_inst_cap_entry */
+	struct list_head                   firmware_list; /* struct msm_vidc_inst_cap_entry */
+	struct list_head                   pending_pkts; /* struct hfi_pending_packet */
+	struct list_head                   fence_list; /* struct msm_vidc_fence */
+	struct list_head                   buffer_stats_list; /* struct msm_vidc_buffer_stats */
+	bool                               once_per_session_set;
+	bool                               ipsc_properties_set;
+	bool                               opsc_properties_set;
+	bool                               caps_list_prepared;
+	struct dentry                     *debugfs_root;
+	struct msm_vidc_debug              debug;
+	struct debug_buf_count             debug_count;
+	struct msm_vidc_statistics         stats;
+	struct msm_vidc_inst_cap           capabilities[INST_CAP_MAX + 1];
+	struct completion                  completions[MAX_SIGNAL];
+	struct msm_vidc_fence_context      fence_context;
+	bool                               active;
+	u64                                last_qbuf_time_ns;
+	u64                                initial_time_us;
+	u32                                max_input_data_size;
+	u32                                dpb_list_payload[MAX_DPB_LIST_ARRAY_SIZE];
+	bool                               input_dpb_list_enabled;
+	bool                               output_dpb_list_enabled;
+	u32                                auto_framerate;
+	u32                                max_rate;
+	bool                               has_bframe;
+	bool                               ir_enabled;
+	u32                                adjust_priority;
+	bool                               iframe;
+	u32                                fw_min_count;
+};
+
+#endif // _MSM_VIDC_INST_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_internal.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_internal.h
@@ -0,0 +1,1063 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_INTERNAL_H_
+#define _MSM_VIDC_INTERNAL_H_
+
+#include <linux/version.h>
+#include <linux/bits.h>
+#include <linux/workqueue.h>
+#include <linux/spinlock.h>
+#include <linux/sync_file.h>
+#include <linux/dma-fence.h>
+#include <media/v4l2-dev.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ctrls.h>
+#include <media/v4l2-mem2mem.h>
+#include <media/videobuf2-core.h>
+#include <media/videobuf2-memops.h>
+#include <media/videobuf2-v4l2.h>
+
+struct msm_vidc_inst;
+
+/* start of vidc specific colorspace definitions */
+/*
+ * V4L2_COLORSPACE_VIDC_START, V4L2_XFER_FUNC_VIDC_START
+ * and V4L2_YCBCR_VIDC_START are introduced because
+ * V4L2_COLORSPACE_LAST, V4L2_XFER_FUNC_LAST, and
+ * V4L2_YCBCR_ENC_LAST respectively are not accessible
+ * in userspace. These values are needed in userspace
+ * to check if the colorspace info is private.
+ */
+#define V4L2_COLORSPACE_VIDC_START           100
+#define V4L2_COLORSPACE_VIDC_GENERIC_FILM    101
+#define V4L2_COLORSPACE_VIDC_EG431           102
+#define V4L2_COLORSPACE_VIDC_EBU_TECH        103
+
+#define V4L2_XFER_FUNC_VIDC_START            200
+#define V4L2_XFER_FUNC_VIDC_BT470_SYSTEM_M   201
+#define V4L2_XFER_FUNC_VIDC_BT470_SYSTEM_BG  202
+#define V4L2_XFER_FUNC_VIDC_BT601_525_OR_625 203
+#define V4L2_XFER_FUNC_VIDC_LINEAR           204
+#define V4L2_XFER_FUNC_VIDC_XVYCC            205
+#define V4L2_XFER_FUNC_VIDC_BT1361           206
+#define V4L2_XFER_FUNC_VIDC_BT2020           207
+#define V4L2_XFER_FUNC_VIDC_ST428            208
+#define V4L2_XFER_FUNC_VIDC_HLG              209
+
+/* should be 255 or below due to u8 limitation */
+#define V4L2_YCBCR_VIDC_START                240
+#define V4L2_YCBCR_VIDC_SRGB_OR_SMPTE_ST428  241
+#define V4L2_YCBCR_VIDC_FCC47_73_682         242
+/* end of vidc specific colorspace definitions */
+
+/* TODO : remove once available in mainline kernel */
+#ifndef V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE
+#define V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE    (3)
+#endif
+
+enum msm_vidc_blur_types {
+	MSM_VIDC_BLUR_NONE               = 0x0,
+	MSM_VIDC_BLUR_EXTERNAL           = 0x1,
+	MSM_VIDC_BLUR_ADAPTIVE           = 0x2,
+};
+
+/* various Metadata - encoder & decoder */
+enum msm_vidc_metadata_bits {
+	MSM_VIDC_META_DISABLE          = 0x0,
+	MSM_VIDC_META_ENABLE           = 0x1,
+	MSM_VIDC_META_TX_INPUT         = 0x2,
+	MSM_VIDC_META_TX_OUTPUT        = 0x4,
+	MSM_VIDC_META_RX_INPUT         = 0x8,
+	MSM_VIDC_META_RX_OUTPUT        = 0x10,
+	MSM_VIDC_META_DYN_ENABLE       = 0x20,
+	MSM_VIDC_META_MAX              = 0x40,
+};
+
+#define MSM_VIDC_METADATA_SIZE             (4 * 4096) /* 16 KB */
+#define ENCODE_INPUT_METADATA_SIZE         (512 * 4096) /* 2 MB */
+#define DECODE_INPUT_METADATA_SIZE         MSM_VIDC_METADATA_SIZE
+#define MSM_VIDC_METADATA_DOLBY_RPU_SIZE   (41 * 1024) /* 41 KB */
+
+#define MAX_NAME_LENGTH   128
+#define VENUS_VERSION_LENGTH 128
+#define MAX_MATRIX_COEFFS 9
+#define MAX_BIAS_COEFFS   3
+#define MAX_LIMIT_COEFFS  6
+#define MAX_DEBUGFS_NAME  50
+#define DEFAULT_HEIGHT    240
+#define DEFAULT_WIDTH     320
+#define DEFAULT_FPS       30
+#define MAXIMUM_VP9_FPS   60
+#define NRT_PRIORITY_OFFSET        2
+#define RT_DEC_DOWN_PRORITY_OFFSET 1
+#define MAX_SUPPORTED_INSTANCES  16
+#define DEFAULT_BSE_VPP_DELAY    2
+#define MAX_CAP_PARENTS          20
+#define MAX_CAP_CHILDREN         20
+#define DEFAULT_MAX_HOST_BUF_COUNT  64
+#define DEFAULT_MAX_HOST_BURST_BUF_COUNT 256
+#define BIT_DEPTH_8 (8 << 16 | 8)
+#define BIT_DEPTH_10 (10 << 16 | 10)
+#define CODED_FRAMES_PROGRESSIVE 0x0
+#define CODED_FRAMES_INTERLACE 0x1
+#define MAX_VP9D_INST_COUNT     16
+/* TODO: move below macros to waipio.c */
+#define MAX_ENH_LAYER_HB        3
+#define MAX_HEVC_VBR_ENH_LAYER_SLIDING_WINDOW         5
+#define MAX_HEVC_NON_VBR_ENH_LAYER_SLIDING_WINDOW     3
+#define MAX_AVC_ENH_LAYER_SLIDING_WINDOW      3
+#define MAX_AVC_ENH_LAYER_HYBRID_HP           5
+#define INVALID_DEFAULT_MARK_OR_USE_LTR      -1
+#define MAX_SLICES_PER_FRAME                128
+#define MAX_SLICES_FRAME_RATE                60
+#define MAX_MB_SLICE_WIDTH                 4096
+#define MAX_MB_SLICE_HEIGHT                2160
+#define MAX_BYTES_SLICE_WIDTH              1920
+#define MAX_BYTES_SLICE_HEIGHT             1088
+#define MIN_HEVC_SLICE_WIDTH                384
+#define MIN_AVC_SLICE_WIDTH                 192
+#define MIN_SLICE_HEIGHT                    128
+#define MAX_BITRATE_BOOST                    25
+#define MAX_SUPPORTED_MIN_QUALITY            70
+#define MIN_CHROMA_QP_OFFSET                -12
+#define MAX_CHROMA_QP_OFFSET                  0
+#define MIN_QP_10BIT                        -11
+#define MIN_QP_8BIT                           1
+#define INVALID_FD                           -1
+#define INVALID_CLIENT_ID                    -1
+#define MAX_ENCODING_REFERNCE_FRAMES          7
+#define MAX_LTR_FRAME_COUNT_5                 5
+#define MAX_LTR_FRAME_COUNT_2                 2
+#define MAX_ENC_RING_BUF_COUNT                5 /* to be tuned */
+#define MAX_TRANSCODING_STATS_FRAME_RATE     60
+#define MAX_TRANSCODING_STATS_WIDTH        4096
+#define MAX_TRANSCODING_STATS_HEIGHT       2304
+#define HEIC_GRID_WIDTH                     512
+
+#define DCVS_WINDOW 16
+#define ENC_FPS_WINDOW 3
+#define DEC_FPS_WINDOW 10
+#define INPUT_TIMER_LIST_SIZE 30
+
+#define DEFAULT_COMPLEXITY 50
+
+#define INPUT_MPLANE V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE
+#define OUTPUT_MPLANE V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE
+#define INPUT_META_PLANE V4L2_BUF_TYPE_META_OUTPUT
+#define OUTPUT_META_PLANE V4L2_BUF_TYPE_META_CAPTURE
+
+#define VIDC_IFACEQ_MAX_PKT_SIZE                1024
+#define VIDC_IFACEQ_MED_PKT_SIZE                768
+#define VIDC_IFACEQ_MIN_PKT_SIZE                8
+#define VIDC_IFACEQ_VAR_SMALL_PKT_SIZE          100
+#define VIDC_IFACEQ_VAR_LARGE_PKT_SIZE          512
+#define VIDC_IFACEQ_VAR_HUGE_PKT_SIZE          (1024 * 4)
+
+#define NUM_MBS_PER_SEC(__height, __width, __fps) \
+	(NUM_MBS_PER_FRAME(__height, __width) * __fps)
+
+#define NUM_MBS_PER_FRAME(__height, __width) \
+	((ALIGN(__height, 16) / 16) * (ALIGN(__width, 16) / 16))
+
+#ifdef V4L2_CTRL_CLASS_CODEC
+#define IS_PRIV_CTRL(idx) ( \
+	(V4L2_CTRL_ID2WHICH(idx) == V4L2_CTRL_CLASS_CODEC) && \
+	V4L2_CTRL_DRIVER_PRIV(idx))
+#else
+#define IS_PRIV_CTRL(idx) ( \
+	(V4L2_CTRL_ID2WHICH(idx) == V4L2_CTRL_CLASS_MPEG) && \
+	V4L2_CTRL_DRIVER_PRIV(idx))
+#endif
+
+#define BUFFER_ALIGNMENT_SIZE(x) x
+#define NUM_MBS_360P (((480 + 15) >> 4) * ((360 + 15) >> 4))
+#define NUM_MBS_720P (((1280 + 15) >> 4) * ((720 + 15) >> 4))
+#define NUM_MBS_4k (((4096 + 15) >> 4) * ((2304 + 15) >> 4))
+#define MB_SIZE_IN_PIXEL (16 * 16)
+
+#define DB_H264_DISABLE_SLICE_BOUNDARY \
+		V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED_AT_SLICE_BOUNDARY
+
+#define DB_HEVC_DISABLE_SLICE_BOUNDARY \
+		V4L2_MPEG_VIDEO_HEVC_LOOP_FILTER_MODE_DISABLED_AT_SLICE_BOUNDARY
+
+/*
+ * Convert Q16 number into Integer and Fractional part upto 2 places.
+ * Ex : 105752 / 65536 = 1.61; 1.61 in Q16 = 105752;
+ * Integer part =  105752 / 65536 = 1;
+ * Reminder = 105752 * 0xFFFF = 40216; Last 16 bits.
+ * Fractional part = 40216 * 100 / 65536 = 61;
+ * Now convert to FP(1, 61, 100).
+ */
+#define Q16_INT(q) ((q) >> 16)
+#define Q16_FRAC(q) ((((q) & 0xFFFF) * 100) >> 16)
+
+/* define timeout values */
+#define HW_RESPONSE_TIMEOUT_VALUE     (1000)
+#define SW_PC_DELAY_VALUE             (HW_RESPONSE_TIMEOUT_VALUE + 500)
+#define FW_UNLOAD_DELAY_VALUE         (SW_PC_DELAY_VALUE + 1500)
+
+#define MAX_DPB_COUNT 32
+ /*
+  * max dpb count in firmware = 16
+  * each dpb: 4 words - <base_address, addr_offset, data_offset>
+  * dpb list array size = 16 * 4
+  * dpb payload size = 16 * 4 * 4
+  */
+#define MAX_DPB_LIST_ARRAY_SIZE (16 * 4)
+#define MAX_DPB_LIST_PAYLOAD_SIZE (16 * 4 * 4)
+
+#define GENERATE_ENUM(ENUM) ENUM,
+#define GENERATE_STRING(STRING) (#STRING),
+
+/* append MSM_VIDC_ to prepare enum */
+#define GENERATE_MSM_VIDC_ENUM(ENUM) MSM_VIDC_##ENUM,
+
+/* append MSM_VIDC_BUF_ to prepare enum */
+#define GENERATE_MSM_VIDC_BUF_ENUM(ENUM) MSM_VIDC_BUF_##ENUM,
+
+/**
+ * msm_vidc_prepare_dependency_list() api will prepare caps_list by looping over
+ * enums(msm_vidc_inst_capability_type) from 0 to INST_CAP_MAX and arranges the
+ * node in such a way that parents willbe at the front and dependent children
+ * in the back.
+ *
+ * caps_list preparation may become CPU intensive task, so to save CPU cycles,
+ * organize enum in proper order(leaf caps at the beginning and dependent parent caps
+ * at back), so that during caps_list preparation num CPU cycles spent will reduce.
+ *
+ * Note: It will work, if enum kept at different places, but not efficient.
+ *
+ * - place all metadata cap(META_*) af the front.
+ * - place all leaf(no child) enums before PROFILE cap.
+ * - place all intermittent(having both parent and child) enums before FRAME_WIDTH cap.
+ * - place all root(no parent) enums before INST_CAP_MAX cap.
+ */
+#define FOREACH_CAP(CAP) {                        \
+	CAP(INST_CAP_NONE)                        \
+	CAP(META_SEQ_HDR_NAL)                     \
+	CAP(META_BITSTREAM_RESOLUTION)            \
+	CAP(META_CROP_OFFSETS)                    \
+	CAP(META_DPB_MISR)                        \
+	CAP(META_OPB_MISR)                        \
+	CAP(META_INTERLACE)                       \
+	CAP(META_OUTBUF_FENCE)                    \
+	CAP(META_LTR_MARK_USE)                    \
+	CAP(META_TIMESTAMP)                       \
+	CAP(META_CONCEALED_MB_CNT)                \
+	CAP(META_HIST_INFO)                       \
+	CAP(META_PICTURE_TYPE)                    \
+	CAP(META_SEI_MASTERING_DISP)              \
+	CAP(META_SEI_CLL)                         \
+	CAP(META_HDR10PLUS)                       \
+	CAP(META_BUF_TAG)                         \
+	CAP(META_DPB_TAG_LIST)                    \
+	CAP(META_SUBFRAME_OUTPUT)                 \
+	CAP(META_ENC_QP_METADATA)                 \
+	CAP(META_DEC_QP_METADATA)                 \
+	CAP(META_MAX_NUM_REORDER_FRAMES)          \
+	CAP(META_EVA_STATS)                       \
+	CAP(META_ROI_INFO)                        \
+	CAP(META_SALIENCY_INFO)                   \
+	CAP(META_TRANSCODING_STAT_INFO)           \
+	CAP(META_DOLBY_RPU)                       \
+	CAP(DRV_VERSION)                          \
+	CAP(MIN_FRAME_QP)                         \
+	CAP(MAX_FRAME_QP)                         \
+	CAP(I_FRAME_QP)                           \
+	CAP(P_FRAME_QP)                           \
+	CAP(B_FRAME_QP)                           \
+	CAP(TIME_DELTA_BASED_RC)                  \
+	CAP(CONSTANT_QUALITY)                     \
+	CAP(VBV_DELAY)                            \
+	CAP(PEAK_BITRATE)                         \
+	CAP(ENTROPY_MODE)                         \
+	CAP(TRANSFORM_8X8)                        \
+	CAP(STAGE)                                \
+	CAP(LTR_COUNT)                            \
+	CAP(IR_PERIOD)                            \
+	CAP(BITRATE_BOOST)                        \
+	CAP(BLUR_RESOLUTION)                      \
+	CAP(OUTPUT_ORDER)                         \
+	CAP(INPUT_BUF_HOST_MAX_COUNT)             \
+	CAP(OUTPUT_BUF_HOST_MAX_COUNT)            \
+	CAP(DELIVERY_MODE)                        \
+	CAP(VUI_TIMING_INFO)                      \
+	CAP(SLICE_DECODE)                         \
+	CAP(INBUF_FENCE_TYPE)                     \
+	CAP(OUTBUF_FENCE_TYPE)                    \
+	CAP(INBUF_FENCE_DIRECTION)                \
+	CAP(OUTBUF_FENCE_DIRECTION)               \
+	CAP(PROFILE)                              \
+	CAP(ENH_LAYER_COUNT)                      \
+	CAP(BIT_RATE)                             \
+	CAP(LOWLATENCY_MODE)                      \
+	CAP(GOP_SIZE)                             \
+	CAP(B_FRAME)                              \
+	CAP(ALL_INTRA)                            \
+	CAP(MIN_QUALITY)                          \
+	CAP(CONTENT_ADAPTIVE_CODING)              \
+	CAP(BLUR_TYPES)                           \
+	CAP(REQUEST_PREPROCESS)                   \
+	CAP(SLICE_MODE)                           \
+	CAP(FRAME_WIDTH)                          \
+	CAP(LOSSLESS_FRAME_WIDTH)                 \
+	CAP(SECURE_FRAME_WIDTH)                   \
+	CAP(FRAME_HEIGHT)                         \
+	CAP(LOSSLESS_FRAME_HEIGHT)                \
+	CAP(SECURE_FRAME_HEIGHT)                  \
+	CAP(PIX_FMTS)                             \
+	CAP(MIN_BUFFERS_INPUT)                    \
+	CAP(MIN_BUFFERS_OUTPUT)                   \
+	CAP(MBPF)                                 \
+	CAP(BATCH_MBPF)                           \
+	CAP(BATCH_FPS)                            \
+	CAP(LOSSLESS_MBPF)                        \
+	CAP(SECURE_MBPF)                          \
+	CAP(FRAME_RATE)                           \
+	CAP(OPERATING_RATE)                       \
+	CAP(INPUT_RATE)                           \
+	CAP(TIMESTAMP_RATE)                       \
+	CAP(SCALE_FACTOR)                         \
+	CAP(MB_CYCLES_VSP)                        \
+	CAP(MB_CYCLES_VPP)                        \
+	CAP(MB_CYCLES_LP)                         \
+	CAP(MB_CYCLES_FW)                         \
+	CAP(MB_CYCLES_FW_VPP)                     \
+	CAP(ENC_RING_BUFFER_COUNT)                \
+	CAP(CLIENT_ID)                            \
+	CAP(SECURE_MODE)                          \
+	CAP(FENCE_ID)                             \
+	CAP(FENCE_FD)                             \
+	CAP(FENCE_ERROR_DATA_CORRUPT)             \
+	CAP(TS_REORDER)                           \
+	CAP(HFLIP)                                \
+	CAP(VFLIP)                                \
+	CAP(ROTATION)                             \
+	CAP(SUPER_FRAME)                          \
+	CAP(HEADER_MODE)                          \
+	CAP(PREPEND_SPSPPS_TO_IDR)                \
+	CAP(WITHOUT_STARTCODE)                    \
+	CAP(NAL_LENGTH_FIELD)                     \
+	CAP(REQUEST_I_FRAME)                      \
+	CAP(BITRATE_MODE)                         \
+	CAP(LOSSLESS)                             \
+	CAP(FRAME_SKIP_MODE)                      \
+	CAP(FRAME_RC_ENABLE)                      \
+	CAP(GOP_CLOSURE)                          \
+	CAP(CSC)                                  \
+	CAP(CSC_CUSTOM_MATRIX)                    \
+	CAP(USE_LTR)                              \
+	CAP(MARK_LTR)                             \
+	CAP(BASELAYER_PRIORITY)                   \
+	CAP(IR_TYPE)                              \
+	CAP(AU_DELIMITER)                         \
+	CAP(GRID_ENABLE)                          \
+	CAP(GRID_SIZE)                            \
+	CAP(I_FRAME_MIN_QP)                       \
+	CAP(P_FRAME_MIN_QP)                       \
+	CAP(B_FRAME_MIN_QP)                       \
+	CAP(I_FRAME_MAX_QP)                       \
+	CAP(P_FRAME_MAX_QP)                       \
+	CAP(B_FRAME_MAX_QP)                       \
+	CAP(LAYER_TYPE)                           \
+	CAP(LAYER_ENABLE)                         \
+	CAP(L0_BR)                                \
+	CAP(L1_BR)                                \
+	CAP(L2_BR)                                \
+	CAP(L3_BR)                                \
+	CAP(L4_BR)                                \
+	CAP(L5_BR)                                \
+	CAP(LEVEL)                                \
+	CAP(HEVC_TIER)                            \
+	CAP(AV1_TIER)                             \
+	CAP(DISPLAY_DELAY_ENABLE)                 \
+	CAP(DISPLAY_DELAY)                        \
+	CAP(CONCEAL_COLOR_8BIT)                   \
+	CAP(CONCEAL_COLOR_10BIT)                  \
+	CAP(LF_MODE)                              \
+	CAP(LF_ALPHA)                             \
+	CAP(LF_BETA)                              \
+	CAP(SLICE_MAX_BYTES)                      \
+	CAP(SLICE_MAX_MB)                         \
+	CAP(MB_RC)                                \
+	CAP(CHROMA_QP_INDEX_OFFSET)               \
+	CAP(PIPE)                                 \
+	CAP(POC)                                  \
+	CAP(MAX_NUM_REORDER_FRAMES)               \
+	CAP(CODED_FRAMES)                         \
+	CAP(BIT_DEPTH)                            \
+	CAP(CODEC_CONFIG)                         \
+	CAP(BITSTREAM_SIZE_OVERWRITE)             \
+	CAP(THUMBNAIL_MODE)                       \
+	CAP(DEFAULT_HEADER)                       \
+	CAP(RAP_FRAME)                            \
+	CAP(SEQ_CHANGE_AT_SYNC_FRAME)             \
+	CAP(QUALITY_MODE)                         \
+	CAP(PRIORITY)                             \
+	CAP(FIRMWARE_PRIORITY_OFFSET)             \
+	CAP(CRITICAL_PRIORITY)                    \
+	CAP(RESERVE_DURATION)                     \
+	CAP(FILM_GRAIN)                           \
+	CAP(SUPER_BLOCK)                          \
+	CAP(DRAP)                                 \
+	CAP(ENC_IP_CR)                            \
+	CAP(COMPLEXITY)                           \
+	CAP(CABAC_MAX_BITRATE)                    \
+	CAP(CAVLC_MAX_BITRATE)                    \
+	CAP(ALLINTRA_MAX_BITRATE)                 \
+	CAP(LOWLATENCY_MAX_BITRATE)               \
+	CAP(LAST_FLAG_EVENT_ENABLE)               \
+	CAP(NUM_COMV)                             \
+	CAP(SIGNAL_COLOR_INFO)                    \
+	CAP(INST_CAP_MAX)                         \
+}
+
+#define FOREACH_BUF_TYPE(BUF_TYPE) {              \
+	BUF_TYPE(NONE)                            \
+	BUF_TYPE(INPUT)                           \
+	BUF_TYPE(OUTPUT)                          \
+	BUF_TYPE(INPUT_META)                      \
+	BUF_TYPE(OUTPUT_META)                     \
+	BUF_TYPE(READ_ONLY)                       \
+	BUF_TYPE(INTERFACE_QUEUE)                 \
+	BUF_TYPE(BIN)                             \
+	BUF_TYPE(ARP)                             \
+	BUF_TYPE(COMV)                            \
+	BUF_TYPE(NON_COMV)                        \
+	BUF_TYPE(LINE)                            \
+	BUF_TYPE(DPB)                             \
+	BUF_TYPE(PERSIST)                         \
+	BUF_TYPE(VPSS)                            \
+	BUF_TYPE(PARTIAL_DATA)                    \
+}
+
+#define FOREACH_ALLOW(ALLOW) {                    \
+	ALLOW(MSM_VIDC_DISALLOW)                  \
+	ALLOW(MSM_VIDC_ALLOW)                     \
+	ALLOW(MSM_VIDC_DEFER)                     \
+	ALLOW(MSM_VIDC_DISCARD)                   \
+	ALLOW(MSM_VIDC_IGNORE)                    \
+}
+
+enum msm_vidc_domain_type {
+	MSM_VIDC_ENCODER           = BIT(0),
+	MSM_VIDC_DECODER           = BIT(1),
+};
+
+enum msm_vidc_codec_type {
+	MSM_VIDC_H264              = BIT(0),
+	MSM_VIDC_HEVC              = BIT(1),
+	MSM_VIDC_VP9               = BIT(2),
+	MSM_VIDC_HEIC              = BIT(3),
+	MSM_VIDC_AV1               = BIT(4),
+};
+
+enum msm_vidc_colorformat_type {
+	MSM_VIDC_FMT_NONE          = 0,
+	MSM_VIDC_FMT_NV12C         = BIT(0),
+	MSM_VIDC_FMT_NV12          = BIT(1),
+	MSM_VIDC_FMT_NV21          = BIT(2),
+	MSM_VIDC_FMT_TP10C         = BIT(3),
+	MSM_VIDC_FMT_P010          = BIT(4),
+	MSM_VIDC_FMT_RGBA8888C     = BIT(5),
+	MSM_VIDC_FMT_RGBA8888      = BIT(6),
+	MSM_VIDC_FMT_META          = BIT(31),
+};
+
+enum msm_vidc_buffer_type FOREACH_BUF_TYPE(GENERATE_MSM_VIDC_BUF_ENUM);
+
+/* always match with v4l2 flags V4L2_BUF_FLAG_* */
+enum msm_vidc_buffer_flags {
+	MSM_VIDC_BUF_FLAG_KEYFRAME         = 0x00000008,
+	MSM_VIDC_BUF_FLAG_PFRAME           = 0x00000010,
+	MSM_VIDC_BUF_FLAG_BFRAME           = 0x00000020,
+	MSM_VIDC_BUF_FLAG_ERROR            = 0x00000040,
+	MSM_VIDC_BUF_FLAG_LAST             = 0x00100000,
+	/* codec config is a vendor specific flag */
+	MSM_VIDC_BUF_FLAG_CODECCONFIG      = 0x01000000,
+	/* sub frame is a vendor specific flag */
+	MSM_VIDC_BUF_FLAG_SUBFRAME         = 0x02000000,
+};
+
+enum msm_vidc_buffer_attributes {
+	MSM_VIDC_ATTR_DEFERRED                  = BIT(0),
+	MSM_VIDC_ATTR_READ_ONLY                 = BIT(1),
+	MSM_VIDC_ATTR_PENDING_RELEASE           = BIT(2),
+	MSM_VIDC_ATTR_QUEUED                    = BIT(3),
+	MSM_VIDC_ATTR_DEQUEUED                  = BIT(4),
+	MSM_VIDC_ATTR_BUFFER_DONE               = BIT(5),
+	MSM_VIDC_ATTR_RELEASE_ELIGIBLE          = BIT(6),
+};
+
+enum msm_vidc_buffer_region {
+	MSM_VIDC_REGION_NONE = 0,
+	MSM_VIDC_NON_SECURE,
+	MSM_VIDC_NON_SECURE_PIXEL,
+	MSM_VIDC_SECURE_PIXEL,
+	MSM_VIDC_SECURE_NONPIXEL,
+	MSM_VIDC_SECURE_BITSTREAM,
+	MSM_VIDC_REGION_MAX,
+};
+
+enum msm_vidc_device_region {
+	MSM_VIDC_DEVICE_REGION_NONE = 0,
+	MSM_VIDC_AON,
+	MSM_VIDC_PROTOCOL_FENCE_CLIENT_VPU,
+	MSM_VIDC_QTIMER,
+	MSM_VIDC_DEVICE_REGION_MAX,
+};
+
+enum msm_vidc_port_type {
+	INPUT_PORT = 0,
+	OUTPUT_PORT,
+	INPUT_META_PORT,
+	OUTPUT_META_PORT,
+	PORT_NONE,
+	MAX_PORT,
+};
+
+enum msm_vidc_stage_type {
+	MSM_VIDC_STAGE_NONE = 0,
+	MSM_VIDC_STAGE_1 = 1,
+	MSM_VIDC_STAGE_2 = 2,
+};
+
+enum msm_vidc_pipe_type {
+	MSM_VIDC_PIPE_NONE = 0,
+	MSM_VIDC_PIPE_1 = 1,
+	MSM_VIDC_PIPE_2 = 2,
+	MSM_VIDC_PIPE_4 = 4,
+};
+
+enum msm_vidc_quality_mode {
+	MSM_VIDC_MAX_QUALITY_MODE = 0x1,
+	MSM_VIDC_POWER_SAVE_MODE = 0x2,
+};
+
+enum msm_vidc_color_primaries {
+	MSM_VIDC_PRIMARIES_RESERVED                         = 0,
+	MSM_VIDC_PRIMARIES_BT709                            = 1,
+	MSM_VIDC_PRIMARIES_UNSPECIFIED                      = 2,
+	MSM_VIDC_PRIMARIES_BT470_SYSTEM_M                   = 4,
+	MSM_VIDC_PRIMARIES_BT470_SYSTEM_BG                  = 5,
+	MSM_VIDC_PRIMARIES_BT601_525                        = 6,
+	MSM_VIDC_PRIMARIES_SMPTE_ST240M                     = 7,
+	MSM_VIDC_PRIMARIES_GENERIC_FILM                     = 8,
+	MSM_VIDC_PRIMARIES_BT2020                           = 9,
+	MSM_VIDC_PRIMARIES_SMPTE_ST428_1                    = 10,
+	MSM_VIDC_PRIMARIES_SMPTE_RP431_2                    = 11,
+	MSM_VIDC_PRIMARIES_SMPTE_EG431_1                    = 12,
+	MSM_VIDC_PRIMARIES_SMPTE_EBU_TECH                   = 22,
+};
+
+enum msm_vidc_transfer_characteristics {
+	MSM_VIDC_TRANSFER_RESERVED                          = 0,
+	MSM_VIDC_TRANSFER_BT709                             = 1,
+	MSM_VIDC_TRANSFER_UNSPECIFIED                       = 2,
+	MSM_VIDC_TRANSFER_BT470_SYSTEM_M                    = 4,
+	MSM_VIDC_TRANSFER_BT470_SYSTEM_BG                   = 5,
+	MSM_VIDC_TRANSFER_BT601_525_OR_625                  = 6,
+	MSM_VIDC_TRANSFER_SMPTE_ST240M                      = 7,
+	MSM_VIDC_TRANSFER_LINEAR                            = 8,
+	MSM_VIDC_TRANSFER_LOG_100_1                         = 9,
+	MSM_VIDC_TRANSFER_LOG_SQRT                          = 10,
+	MSM_VIDC_TRANSFER_XVYCC                             = 11,
+	MSM_VIDC_TRANSFER_BT1361_0                          = 12,
+	MSM_VIDC_TRANSFER_SRGB_SYCC                         = 13,
+	MSM_VIDC_TRANSFER_BT2020_14                         = 14,
+	MSM_VIDC_TRANSFER_BT2020_15                         = 15,
+	MSM_VIDC_TRANSFER_SMPTE_ST2084_PQ                   = 16,
+	MSM_VIDC_TRANSFER_SMPTE_ST428_1                     = 17,
+	MSM_VIDC_TRANSFER_BT2100_2_HLG                      = 18,
+};
+
+enum msm_vidc_matrix_coefficients {
+	MSM_VIDC_MATRIX_COEFF_SRGB_SMPTE_ST428_1             = 0,
+	MSM_VIDC_MATRIX_COEFF_BT709                          = 1,
+	MSM_VIDC_MATRIX_COEFF_UNSPECIFIED                    = 2,
+	MSM_VIDC_MATRIX_COEFF_RESERVED                       = 3,
+	MSM_VIDC_MATRIX_COEFF_FCC_TITLE_47                   = 4,
+	MSM_VIDC_MATRIX_COEFF_BT470_SYS_BG_OR_BT601_625      = 5,
+	MSM_VIDC_MATRIX_COEFF_BT601_525_BT1358_525_OR_625    = 6,
+	MSM_VIDC_MATRIX_COEFF_SMPTE_ST240                    = 7,
+	MSM_VIDC_MATRIX_COEFF_YCGCO                          = 8,
+	MSM_VIDC_MATRIX_COEFF_BT2020_NON_CONSTANT            = 9,
+	MSM_VIDC_MATRIX_COEFF_BT2020_CONSTANT                = 10,
+	MSM_VIDC_MATRIX_COEFF_SMPTE_ST2085                   = 11,
+	MSM_VIDC_MATRIX_COEFF_SMPTE_CHROM_DERV_NON_CONSTANT  = 12,
+	MSM_VIDC_MATRIX_COEFF_SMPTE_CHROM_DERV_CONSTANT      = 13,
+	MSM_VIDC_MATRIX_COEFF_BT2100                         = 14,
+};
+
+enum msm_vidc_preprocess_type {
+	MSM_VIDC_PREPROCESS_NONE = BIT(0),
+	MSM_VIDC_PREPROCESS_TYPE0 = BIT(1),
+};
+
+enum msm_vidc_core_capability_type {
+	CORE_CAP_NONE = 0,
+	ENC_CODECS,
+	DEC_CODECS,
+	MAX_SESSION_COUNT,
+	MAX_NUM_720P_SESSIONS,
+	MAX_NUM_1080P_SESSIONS,
+	MAX_NUM_4K_SESSIONS,
+	MAX_NUM_8K_SESSIONS,
+	MAX_SECURE_SESSION_COUNT,
+	MAX_LOAD,
+	MAX_RT_MBPF,
+	MAX_MBPF,
+	MAX_MBPS,
+	MAX_IMAGE_MBPF,
+	MAX_MBPF_HQ,
+	MAX_MBPS_HQ,
+	MAX_MBPF_B_FRAME,
+	MAX_MBPS_B_FRAME,
+	MAX_MBPS_ALL_INTRA,
+	MAX_ENH_LAYER_COUNT,
+	NUM_VPP_PIPE,
+	SW_PC,
+	SW_PC_DELAY,
+	FW_UNLOAD,
+	FW_UNLOAD_DELAY,
+	HW_RESPONSE_TIMEOUT,
+	PREFIX_BUF_COUNT_PIX,
+	PREFIX_BUF_SIZE_PIX,
+	PREFIX_BUF_COUNT_NON_PIX,
+	PREFIX_BUF_SIZE_NON_PIX,
+	PAGEFAULT_NON_FATAL,
+	PAGETABLE_CACHING,
+	DCVS,
+	DECODE_BATCH,
+	DECODE_BATCH_TIMEOUT,
+	STATS_TIMEOUT_MS,
+	AV_SYNC_WINDOW_SIZE,
+	CLK_FREQ_THRESHOLD,
+	NON_FATAL_FAULTS,
+	ENC_AUTO_FRAMERATE,
+	DEVICE_CAPS,
+	SUPPORTS_REQUESTS,
+	SUPPORTS_SYNX_FENCE,
+	SSR_TYPE,
+	CORE_CAP_MAX,
+};
+
+enum msm_vidc_inst_capability_type FOREACH_CAP(GENERATE_ENUM);
+
+enum msm_vidc_inst_capability_flags {
+	CAP_FLAG_NONE                    = 0,
+	CAP_FLAG_DYNAMIC_ALLOWED         = BIT(0),
+	CAP_FLAG_MENU                    = BIT(1),
+	CAP_FLAG_INPUT_PORT              = BIT(2),
+	CAP_FLAG_OUTPUT_PORT             = BIT(3),
+	CAP_FLAG_CLIENT_SET              = BIT(4),
+	CAP_FLAG_BITMASK                 = BIT(5),
+	CAP_FLAG_VOLATILE                = BIT(6),
+	CAP_FLAG_META                    = BIT(7),
+};
+
+struct msm_vidc_inst_cap {
+	enum msm_vidc_inst_capability_type cap_id;
+	s32 min;
+	s32 max;
+	u32 step_or_mask;
+	s32 value;
+	u32 v4l2_id;
+	u32 hfi_id;
+	enum msm_vidc_inst_capability_flags flags;
+	enum msm_vidc_inst_capability_type children[MAX_CAP_CHILDREN];
+	int (*adjust)(void *inst,
+		      struct v4l2_ctrl *ctrl);
+	int (*set)(void *inst,
+		   enum msm_vidc_inst_capability_type cap_id);
+};
+
+struct msm_vidc_inst_capability {
+	enum msm_vidc_domain_type domain;
+	enum msm_vidc_codec_type codec;
+	struct msm_vidc_inst_cap cap[INST_CAP_MAX + 1];
+};
+
+struct msm_vidc_core_capability {
+	enum msm_vidc_core_capability_type type;
+	u32 value;
+};
+
+struct msm_vidc_inst_cap_entry {
+	/* list of struct msm_vidc_inst_cap_entry */
+	struct list_head list;
+	enum msm_vidc_inst_capability_type cap_id;
+};
+
+struct msm_vidc_event_data {
+	union {
+		bool                         bval;
+		u32                          uval;
+		u64                          uval64;
+		s32                          val;
+		s64                          val64;
+		void                        *ptr;
+	} edata;
+};
+
+struct debug_buf_count {
+	u64 etb;
+	u64 ftb;
+	u64 fbd;
+	u64 ebd;
+};
+
+struct msm_vidc_statistics {
+	struct debug_buf_count             count;
+	u64                                data_size;
+	u64                                time_ms;
+	u32                                avg_bw_llcc;
+	u32                                avg_bw_ddr;
+};
+
+enum efuse_purpose {
+	SKU_VERSION = 0,
+};
+
+enum sku_version {
+	SKU_VERSION_0 = 0,
+	SKU_VERSION_1,
+	SKU_VERSION_2,
+};
+
+enum msm_vidc_ssr_trigger_type {
+	SSR_ERR_FATAL = 1,
+	SSR_SW_DIV_BY_ZERO,
+	SSR_HW_WDOG_IRQ,
+};
+
+enum msm_vidc_stability_trigger_type {
+	STABILITY_VCODEC_HUNG = 1,
+	STABILITY_ENC_BUFFER_FULL,
+};
+
+enum msm_vidc_cache_op {
+	MSM_VIDC_CACHE_CLEAN,
+	MSM_VIDC_CACHE_INVALIDATE,
+	MSM_VIDC_CACHE_CLEAN_INVALIDATE,
+};
+
+enum msm_vidc_dcvs_flags {
+	MSM_VIDC_DCVS_INCR               = BIT(0),
+	MSM_VIDC_DCVS_DECR               = BIT(1),
+};
+
+enum msm_vidc_clock_properties {
+	CLOCK_PROP_HAS_SCALING           = BIT(0),
+	CLOCK_PROP_HAS_MEM_RETENTION     = BIT(1),
+};
+
+enum profiling_points {
+	FRAME_PROCESSING       = 0,
+	MAX_PROFILING_POINTS,
+};
+
+enum signal_session_response {
+	SIGNAL_CMD_STOP_INPUT = 0,
+	SIGNAL_CMD_STOP_OUTPUT,
+	SIGNAL_CMD_CLOSE,
+	MAX_SIGNAL,
+};
+
+struct profile_data {
+	u64                    start;
+	u64                    stop;
+	u64                    cumulative;
+	char                   name[64];
+	u32                    sampling;
+	u64                    average;
+};
+
+struct msm_vidc_debug {
+	struct profile_data    pdata[MAX_PROFILING_POINTS];
+	u32                    profile;
+	u32                    samples;
+};
+
+struct msm_vidc_input_cr_data {
+	struct list_head       list;
+	u32                    index;
+	u32                    input_cr;
+};
+
+struct msm_vidc_session_idle {
+	bool                   idle;
+	u64                    last_activity_time_ns;
+};
+
+struct msm_vidc_color_info {
+	u32 colorspace;
+	u32 ycbcr_enc;
+	u32 xfer_func;
+	u32 quantization;
+};
+
+struct msm_vidc_rectangle {
+	u32 left;
+	u32 top;
+	u32 width;
+	u32 height;
+};
+
+struct msm_vidc_subscription_params {
+	u32                    bitstream_resolution;
+	u32                    crop_offsets[2];
+	u32                    bit_depth;
+	u32                    coded_frames;
+	u32                    fw_min_count;
+	u32                    pic_order_cnt;
+	u32                    color_info;
+	u32                    profile;
+	u32                    level;
+	u32                    tier;
+	u32                    av1_film_grain_present;
+	u32                    av1_super_block_enabled;
+	u32                    max_num_reorder_frames;
+};
+
+struct msm_vidc_hfi_frame_info {
+	u32                    picture_type;
+	u32                    no_output;
+	u32                    subframe_input;
+	u32                    cr;
+	u32                    cf;
+	u32                    data_corrupt;
+	u32                    overflow;
+	u32                    fence_id;
+	u32                    fence_error;
+	u32                    av1_tile_rows_columns;
+	bool                   av1_non_uniform_tile_spacing;
+};
+
+struct msm_vidc_decode_vpp_delay {
+	bool                   enable;
+	u32                    size;
+};
+
+struct msm_vidc_decode_batch {
+	bool                   enable;
+	u32                    size;
+	struct delayed_work    work;
+};
+
+enum msm_vidc_power_mode {
+	VIDC_POWER_NORMAL = 0,
+	VIDC_POWER_LOW,
+	VIDC_POWER_TURBO,
+};
+
+struct vidc_bus_vote_data {
+	enum msm_vidc_domain_type domain;
+	enum msm_vidc_codec_type codec;
+	enum msm_vidc_power_mode power_mode;
+	u32 color_formats[2];
+	int num_formats; /* 1 = DPB-OPB unified; 2 = split */
+	int input_height, input_width, bitrate;
+	int output_height, output_width;
+	int rotation;
+	int compression_ratio;
+	int complexity_factor;
+	int input_cr;
+	u32 lcu_size;
+	u32 fps;
+	u32 work_mode;
+	bool use_sys_cache;
+	bool b_frames_enabled;
+	u64 calc_bw_ddr;
+	u64 calc_bw_llcc;
+	u32 num_vpp_pipes;
+	bool vpss_preprocessing_enabled;
+};
+
+struct msm_vidc_power {
+	enum msm_vidc_power_mode power_mode;
+	u32                    buffer_counter;
+	u32                    min_threshold;
+	u32                    nom_threshold;
+	u32                    max_threshold;
+	bool                   dcvs_mode;
+	u32                    dcvs_window;
+	u64                    min_freq;
+	u64                    curr_freq;
+	u32                    ddr_bw;
+	u32                    sys_cache_bw;
+	u32                    dcvs_flags;
+	u32                    fw_cr;
+	u32                    fw_cf;
+	u32                    fw_av1_tile_rows;
+	u32                    fw_av1_tile_columns;
+};
+
+enum msm_vidc_fence_type {
+	MSM_VIDC_FENCE_NONE         = 0,
+	MSM_VIDC_SW_FENCE           = 1,
+	MSM_VIDC_SYNX_V2_FENCE      = 2,
+};
+
+enum msm_vidc_fence_direction {
+	MSM_VIDC_FENCE_DIR_NONE    = 0,
+	MSM_VIDC_FENCE_DIR_TX      = 1,
+	MSM_VIDC_FENCE_DIR_RX      = 2,
+};
+
+struct msm_vidc_fence_context {
+	char                      name[MAX_NAME_LENGTH];
+	u64                       ctx_num;
+	u64                       seq_num;
+};
+
+struct msm_vidc_fence {
+	struct list_head            list;
+	struct dma_fence            dma_fence;
+	char                        name[MAX_NAME_LENGTH];
+	spinlock_t                  lock;
+	struct sync_file            *sync_file;
+	int                         fd;
+	u64                         fence_id;
+	void                        *session;
+};
+
+struct msm_vidc_mem {
+	struct list_head            list;
+	enum msm_vidc_buffer_type   type;
+	enum msm_vidc_buffer_region region;
+	u32                         size;
+	u8                          secure:1;
+	u8                          map_kernel:1;
+	struct dma_buf             *dmabuf;
+	/*
+	 * Kalama uses Kernel Version 5.15.x,
+	 * Pineapple uses Kernel version 5.18.x
+	 */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 16, 0))
+	struct iosys_map            dmabuf_map;
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0))
+	struct dma_buf_map          dmabuf_map;
+#endif
+	void                       *kvaddr;
+	dma_addr_t                  device_addr;
+	unsigned long               attrs;
+	u32                         refcount;
+	struct sg_table            *table;
+	struct dma_buf_attachment  *attach;
+	phys_addr_t                 phys_addr;
+	enum dma_data_direction     direction;
+};
+
+struct msm_vidc_mem_list {
+	struct list_head            list; // list of "struct msm_vidc_mem"
+};
+
+struct msm_vidc_buffer {
+	struct list_head                   list;
+	struct msm_vidc_inst              *inst;
+	enum msm_vidc_buffer_type          type;
+	enum msm_vidc_buffer_region        region;
+	u32                                index;
+	int                                fd;
+	u32                                buffer_size;
+	u32                                data_offset;
+	u32                                data_size;
+	u64                                device_addr;
+	u32                                flags;
+	u64                                timestamp;
+	enum msm_vidc_buffer_attributes    attr;
+	void                              *dmabuf;
+	struct sg_table                   *sg_table;
+	struct dma_buf_attachment         *attach;
+	struct vb2_vmarea_handler          handler;
+	refcount_t                         refcount;
+	unsigned long                      dma_attrs;
+	void                              *kvaddr;
+	u32                                dbuf_get:1;
+	u64                                fence_id;
+	u32                                start_time_ms;
+	u32                                end_time_ms;
+};
+
+struct msm_vidc_buffers {
+	struct list_head       list; // list of "struct msm_vidc_buffer"
+	u32                    min_count;
+	u32                    extra_count;
+	u32                    actual_count;
+	u32                    size;
+	bool                   reuse;
+};
+
+struct msm_vidc_buffer_stats {
+	struct list_head                   list;
+	u32                                frame_num;
+	u64                                timestamp;
+	u32                                etb_time_ms;
+	u32                                ebd_time_ms;
+	u32                                ftb_time_ms;
+	u32                                fbd_time_ms;
+	u32                                data_size;
+	u32                                flags;
+	u32                                ts_offset;
+};
+
+enum msm_vidc_buffer_stats_flag {
+	MSM_VIDC_STATS_FLAG_CORRUPT        = BIT(0),
+	MSM_VIDC_STATS_FLAG_OVERFLOW       = BIT(1),
+	MSM_VIDC_STATS_FLAG_NO_OUTPUT      = BIT(2),
+	MSM_VIDC_STATS_FLAG_SUBFRAME_INPUT = BIT(3),
+};
+
+struct msm_vidc_sort {
+	struct list_head       list;
+	s64                    val;
+};
+
+struct msm_vidc_timestamp {
+	struct msm_vidc_sort   sort;
+	u64                    rank;
+};
+
+struct msm_vidc_timestamps {
+	struct list_head       list;
+	u32                    count;
+	u64                    rank;
+};
+
+struct msm_vidc_input_timer {
+	struct list_head       list;
+	u64                    time_us;
+};
+
+enum msm_vidc_allow FOREACH_ALLOW(GENERATE_ENUM);
+
+struct msm_vidc_ssr {
+	enum msm_vidc_ssr_trigger_type     ssr_type;
+	u32                                sub_client_id;
+	u32                                test_addr;
+};
+
+struct msm_vidc_stability {
+	enum msm_vidc_stability_trigger_type     stability_type;
+	u32                                      sub_client_id;
+	u32                                      value;
+};
+
+struct msm_vidc_sfr {
+	u32 buf_size;
+	u8 rg_data[1];
+};
+
+struct msm_vidc_ctrl_data {
+	bool skip_s_ctrl;
+};
+
+#endif // _MSM_VIDC_INTERNAL_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_memory.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_memory.h
@@ -0,0 +1,101 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_MEMORY_H_
+#define _MSM_VIDC_MEMORY_H_
+
+#include "msm_vidc_internal.h"
+
+struct msm_vidc_core;
+struct msm_vidc_inst;
+
+#define MSM_MEM_POOL_PACKET_SIZE 1024
+
+struct msm_memory_dmabuf {
+	struct list_head       list;
+	struct dma_buf        *dmabuf;
+	u32                    refcount;
+};
+
+enum msm_memory_pool_type {
+	MSM_MEM_POOL_BUFFER  = 0,
+	MSM_MEM_POOL_ALLOC_MAP,
+	MSM_MEM_POOL_TIMESTAMP,
+	MSM_MEM_POOL_DMABUF,
+	MSM_MEM_POOL_PACKET,
+	MSM_MEM_POOL_BUF_TIMER,
+	MSM_MEM_POOL_BUF_STATS,
+	MSM_MEM_POOL_MAX,
+};
+
+enum msm_memory_cache_type {
+	MSM_MEM_CACHE_CLEAN = 0,
+	MSM_MEM_CACHE_INVALIDATE,
+	MSM_MEM_CACHE_CLEAN_INVALIDATE,
+};
+
+struct msm_memory_alloc_header {
+	struct list_head       list;
+	u32                    type;
+	bool                   busy;
+	void                  *buf;
+};
+
+struct msm_memory_pool {
+	u32                    size;
+	char                  *name;
+	struct list_head       free_pool; /* list of struct msm_memory_alloc_header */
+	struct list_head       busy_pool; /* list of struct msm_memory_alloc_header */
+};
+
+void *msm_vidc_pool_alloc(struct msm_vidc_inst *inst,
+			  enum msm_memory_pool_type type);
+void msm_vidc_pool_free(struct msm_vidc_inst *inst, void *vidc_buf);
+int msm_vidc_pools_init(struct msm_vidc_inst *inst);
+void msm_vidc_pools_deinit(struct msm_vidc_inst *inst);
+
+#define call_mem_op(c, op, ...)                  \
+	(((c) && (c)->mem_ops && (c)->mem_ops->op) ? \
+	((c)->mem_ops->op(__VA_ARGS__)) : 0)
+
+struct msm_vidc_memory_ops {
+	struct dma_buf *(*dma_buf_get)(struct msm_vidc_inst *inst,
+				       int fd);
+	void (*dma_buf_put)(struct msm_vidc_inst *inst,
+			    struct dma_buf *dmabuf);
+	void (*dma_buf_put_completely)(struct msm_vidc_inst *inst,
+				       struct msm_memory_dmabuf *buf);
+	struct dma_buf_attachment *(*dma_buf_attach)(struct msm_vidc_core *core,
+						     struct dma_buf *dbuf, struct device *dev);
+	int (*dma_buf_detach)(struct msm_vidc_core *core, struct dma_buf *dbuf,
+			      struct dma_buf_attachment *attach);
+	struct sg_table
+		*(*dma_buf_map_attachment)(struct msm_vidc_core *core,
+					   struct dma_buf_attachment *attach);
+	int (*dma_buf_unmap_attachment)(struct msm_vidc_core *core,
+					struct dma_buf_attachment *attach,
+					struct sg_table *table);
+	int (*memory_alloc_map)(struct msm_vidc_core *core,
+				struct msm_vidc_mem *mem);
+	int (*memory_unmap_free)(struct msm_vidc_core *core,
+				 struct msm_vidc_mem *mem);
+	int (*mem_dma_map_page)(struct msm_vidc_core *core,
+				struct msm_vidc_mem *mem);
+	int (*mem_dma_unmap_page)(struct msm_vidc_core *core,
+				  struct msm_vidc_mem *mem);
+	u32 (*buffer_region)(struct msm_vidc_inst *inst,
+			     enum msm_vidc_buffer_type buffer_type);
+	int (*iommu_map)(struct msm_vidc_core *core,
+			 struct msm_vidc_mem *mem);
+	int (*iommu_unmap)(struct msm_vidc_core *core,
+			   struct msm_vidc_mem *mem);
+};
+
+const struct msm_vidc_memory_ops *get_mem_ops(void);
+int msm_memory_cache_operations(struct msm_vidc_inst *inst,
+	struct dma_buf *dbuf, enum msm_memory_cache_type cache_type);
+
+#endif // _MSM_VIDC_MEMORY_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_memory_ext.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_memory_ext.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_MEMORY_EXT_H_
+#define _MSM_VIDC_MEMORY_EXT_H_
+
+#include "msm_vidc_memory.h"
+
+const struct msm_vidc_memory_ops *get_mem_ops_ext(void);
+
+#endif // _MSM_VIDC_MEMORY_EXT_H_
\ No newline at end of file
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_power.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_power.h
@@ -0,0 +1,257 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_POWER_H_
+#define _MSM_VIDC_POWER_H_
+
+#include "fixedpoint.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_inst.h"
+
+#define COMPRESSION_RATIO_MAX 5
+
+/* TODO: Move to dtsi OR use source clock instead of branch clock.*/
+#define MSM_VIDC_CLOCK_SOURCE_SCALING_RATIO 1
+
+enum vidc_bus_type {
+	PERF,
+	DDR,
+	LLCC,
+};
+
+/*
+ * Minimum dimensions for which to calculate bandwidth.
+ * This means that anything bandwidth(0, 0) ==
+ * bandwidth(BASELINE_DIMENSIONS.width, BASELINE_DIMENSIONS.height)
+ */
+static const struct {
+	int height, width;
+} BASELINE_DIMENSIONS = {
+	.width = 1280,
+	.height = 720,
+};
+
+/* converts Mbps to bps (the "b" part can be bits or bytes based on context) */
+#define kbps(__mbps) ((__mbps) * 1000)
+#define bps(__mbps) (kbps(__mbps) * 1000)
+
+#define GENERATE_COMPRESSION_PROFILE(__bpp, __worst) {              \
+	.bpp = __bpp,                                                          \
+	.ratio = __worst,                \
+}
+
+/*
+ * The below table is a structural representation of the following table:
+ *  Resolution |    Bitrate |              Compression Ratio          |
+ * ............|............|.........................................|
+ * Width Height|Average High|Avg_8bpc Worst_8bpc Avg_10bpc Worst_10bpc|
+ *  1280    720|      7   14|    1.69       1.28      1.49        1.23|
+ *  1920   1080|     20   40|    1.69       1.28      1.49        1.23|
+ *  2560   1440|     32   64|     2.2       1.26      1.97        1.22|
+ *  3840   2160|     42   84|     2.2       1.26      1.97        1.22|
+ *  4096   2160|     44   88|     2.2       1.26      1.97        1.22|
+ *  4096   2304|     48   96|     2.2       1.26      1.97        1.22|
+ */
+static struct lut {
+	int frame_size; /* width x height */
+	int frame_rate;
+	unsigned long bitrate;
+	struct {
+		int bpp;
+		fp_t ratio;
+	} compression_ratio[COMPRESSION_RATIO_MAX];
+} const LUT[] = {
+	{
+		.frame_size = 1280 * 720,
+		.frame_rate = 30,
+		.bitrate = 14,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 28, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 23, 100)),
+		}
+	},
+	{
+		.frame_size = 1280 * 720,
+		.frame_rate = 60,
+		.bitrate = 22,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 28, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 23, 100)),
+		}
+	},
+	{
+		.frame_size = 1920 * 1088,
+		.frame_rate = 30,
+		.bitrate = 40,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 28, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 23, 100)),
+		}
+	},
+	{
+		.frame_size = 1920 * 1088,
+		.frame_rate = 60,
+		.bitrate = 64,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 28, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 23, 100)),
+		}
+	},
+	{
+		.frame_size = 2560 * 1440,
+		.frame_rate = 30,
+		.bitrate = 64,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 2560 * 1440,
+		.frame_rate = 60,
+		.bitrate = 102,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 3840 * 2160,
+		.frame_rate = 30,
+		.bitrate = 84,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 3840 * 2160,
+		.frame_rate = 60,
+		.bitrate = 134,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 4096 * 2160,
+		.frame_rate = 30,
+		.bitrate = 88,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 4096 * 2160,
+		.frame_rate = 60,
+		.bitrate = 141,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 4096 * 2304,
+		.frame_rate = 30,
+		.bitrate = 96,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+	{
+		.frame_size = 4096 * 2304,
+		.frame_rate = 60,
+		.bitrate = 154,
+		.compression_ratio = {
+			GENERATE_COMPRESSION_PROFILE(8,
+					FP(1, 26, 100)),
+			GENERATE_COMPRESSION_PROFILE(10,
+					FP(1, 22, 100)),
+		}
+	},
+};
+
+static inline u32 get_type_frm_name(const char *name)
+{
+	if (!strcmp(name, "iris-llcc"))
+		return LLCC;
+	else if (!strcmp(name, "iris-ddr"))
+		return DDR;
+	else
+		return PERF;
+}
+
+#define DUMP_HEADER_MAGIC 0xdeadbeef
+#define DUMP_FP_FMT "%FP" /* special format for fp_t */
+
+struct dump {
+	char *key;
+	char *format;
+	size_t val;
+};
+
+struct lut const *__lut(int width, int height, int fps);
+fp_t __compression_ratio(struct lut const *entry, int bpp);
+void __dump(struct dump dump[], int len);
+
+static inline bool __ubwc(enum msm_vidc_colorformat_type f)
+{
+	switch (f) {
+	case MSM_VIDC_FMT_NV12C:
+	case MSM_VIDC_FMT_TP10C:
+		return true;
+	default:
+		return false;
+	}
+}
+
+static inline int __bpp(enum msm_vidc_colorformat_type f)
+{
+	switch (f) {
+	case MSM_VIDC_FMT_NV12:
+	case MSM_VIDC_FMT_NV21:
+	case MSM_VIDC_FMT_NV12C:
+	case MSM_VIDC_FMT_RGBA8888C:
+		return 8;
+	case MSM_VIDC_FMT_P010:
+	case MSM_VIDC_FMT_TP10C:
+		return 10;
+	default:
+		d_vpr_e("Unsupported colorformat (%x)", f);
+		return INT_MAX;
+	}
+}
+
+u64 msm_vidc_max_freq(struct msm_vidc_inst *inst);
+int msm_vidc_scale_power(struct msm_vidc_inst *inst, bool scale_buses);
+void msm_vidc_power_data_reset(struct msm_vidc_inst *inst);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_state.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_state.h
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_STATE_H_
+#define _MSM_VIDC_STATE_H_
+
+#include "msm_vidc_internal.h"
+
+struct msm_vidc_core;
+
+#define FOREACH_CORE_STATE(CORE_STATE) {               \
+	CORE_STATE(CORE_DEINIT)                        \
+	CORE_STATE(CORE_INIT_WAIT)                     \
+	CORE_STATE(CORE_INIT)                          \
+	CORE_STATE(CORE_ERROR)                         \
+}
+
+#define FOREACH_EVENT(EVENT) {                         \
+	EVENT(TRY_FMT)                                 \
+	EVENT(S_FMT)                                   \
+	EVENT(REQBUFS)                                 \
+	EVENT(S_CTRL)                                  \
+	EVENT(STREAMON)                                \
+	EVENT(STREAMOFF)                               \
+	EVENT(CMD_START)                               \
+	EVENT(CMD_STOP)                                \
+	EVENT(BUF_QUEUE)                               \
+}
+
+enum msm_vidc_core_state FOREACH_CORE_STATE(GENERATE_MSM_VIDC_ENUM);
+
+enum msm_vidc_core_sub_state {
+	CORE_SUBSTATE_NONE                   = 0x0,
+	CORE_SUBSTATE_POWER_ENABLE           = BIT(0),
+	CORE_SUBSTATE_GDSC_HANDOFF           = BIT(1),
+	CORE_SUBSTATE_PM_SUSPEND             = BIT(2),
+	CORE_SUBSTATE_FW_PWR_CTRL            = BIT(3),
+	CORE_SUBSTATE_PAGE_FAULT             = BIT(4),
+	CORE_SUBSTATE_CPU_WATCHDOG           = BIT(5),
+	CORE_SUBSTATE_VIDEO_UNRESPONSIVE     = BIT(6),
+	CORE_SUBSTATE_MAX                    = BIT(7),
+};
+
+enum msm_vidc_core_event_type {
+	CORE_EVENT_NONE                      = BIT(0),
+	CORE_EVENT_UPDATE_SUB_STATE          = BIT(1),
+};
+
+#define FOREACH_STATE(STATE) {                    \
+	STATE(OPEN)                               \
+	STATE(INPUT_STREAMING)                    \
+	STATE(OUTPUT_STREAMING)                   \
+	STATE(STREAMING)                          \
+	STATE(CLOSE)                              \
+	STATE(ERROR)                              \
+}
+
+enum msm_vidc_state FOREACH_STATE(GENERATE_MSM_VIDC_ENUM);
+
+#define MSM_VIDC_SUB_STATE_NONE          0
+#define MSM_VIDC_MAX_SUB_STATES          7
+/*
+ * max value of inst->sub_state if all
+ * the 6 valid bits are set i.e 111111==>63
+ */
+#define MSM_VIDC_MAX_SUB_STATE_VALUE     ((1 << MSM_VIDC_MAX_SUB_STATES) - 1)
+
+enum msm_vidc_sub_state {
+	MSM_VIDC_DRAIN                     = BIT(0),
+	MSM_VIDC_DRC                       = BIT(1),
+	MSM_VIDC_DRAIN_LAST_BUFFER         = BIT(2),
+	MSM_VIDC_DRC_LAST_BUFFER           = BIT(3),
+	MSM_VIDC_INPUT_PAUSE               = BIT(4),
+	MSM_VIDC_OUTPUT_PAUSE              = BIT(5),
+	MSM_VIDC_FIRST_IPSC                = BIT(6),
+};
+
+enum msm_vidc_event FOREACH_EVENT(GENERATE_MSM_VIDC_ENUM);
+
+/* core statemachine functions */
+enum msm_vidc_allow
+	msm_vidc_allow_core_state_change(struct msm_vidc_core *core,
+					 enum msm_vidc_core_state req_state);
+int msm_vidc_update_core_state(struct msm_vidc_core *core,
+			       enum msm_vidc_core_state request_state,
+			       const char *func);
+bool core_in_valid_state(struct msm_vidc_core *core);
+bool is_core_state(struct msm_vidc_core *core, enum msm_vidc_core_state state);
+bool is_core_sub_state(struct msm_vidc_core *core,
+		       enum msm_vidc_core_sub_state sub_state);
+const char *core_state_name(enum msm_vidc_core_state state);
+const char *core_sub_state_name(enum msm_vidc_core_sub_state sub_state);
+
+/* inst statemachine functions */
+bool is_drc_pending(struct msm_vidc_inst *inst);
+bool is_drain_pending(struct msm_vidc_inst *inst);
+int msm_vidc_update_state(struct msm_vidc_inst *inst,
+			  enum msm_vidc_state request_state,
+			  const char *func);
+int msm_vidc_change_state(struct msm_vidc_inst *inst,
+			  enum msm_vidc_state request_state,
+			  const char *func);
+int msm_vidc_change_sub_state(struct msm_vidc_inst *inst,
+			      enum msm_vidc_sub_state clear_sub_state,
+			      enum msm_vidc_sub_state set_sub_state,
+			      const char *func);
+const char *state_name(enum msm_vidc_state state);
+const char *sub_state_name(enum msm_vidc_sub_state sub_state);
+bool is_state(struct msm_vidc_inst *inst, enum msm_vidc_state state);
+bool is_sub_state(struct msm_vidc_inst *inst,
+		  enum msm_vidc_sub_state sub_state);
+
+#endif // _MSM_VIDC_STATE_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_synx.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_synx.h
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _H_MSM_VIDC_SYNX_H_
+#define _H_MSM_VIDC_SYNX_H_
+
+#include "msm_vidc_fence.h"
+
+const struct msm_vidc_fence_ops *get_synx_fence_ops(void);
+
+#endif //_H_MSM_VIDC_SYNX_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_v4l2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_v4l2.h
@@ -0,0 +1,82 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_V4L2_H_
+#define _MSM_VIDC_V4L2_H_
+
+#include <linux/poll.h>
+#include <linux/fs.h>
+#include <media/v4l2-dev.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-ctrls.h>
+
+int msm_v4l2_open(struct file *filp);
+int msm_v4l2_close(struct file *filp);
+int msm_v4l2_querycap(struct file *filp, void *fh,
+		      struct v4l2_capability *cap);
+int msm_v4l2_enum_fmt(struct file *file, void *fh,
+		      struct v4l2_fmtdesc *f);
+int msm_v4l2_try_fmt(struct file *file, void *fh,
+		     struct v4l2_format *f);
+int msm_v4l2_s_fmt(struct file *file, void *fh,
+		   struct v4l2_format *f);
+int msm_v4l2_g_fmt(struct file *file, void *fh,
+		   struct v4l2_format *f);
+int msm_v4l2_s_selection(struct file *file, void *fh,
+			 struct v4l2_selection *s);
+int msm_v4l2_g_selection(struct file *file, void *fh,
+			 struct v4l2_selection *s);
+int msm_v4l2_s_parm(struct file *file, void *fh,
+		    struct v4l2_streamparm *a);
+int msm_v4l2_g_parm(struct file *file, void *fh,
+		    struct v4l2_streamparm *a);
+int msm_v4l2_reqbufs(struct file *file, void *fh,
+		     struct v4l2_requestbuffers *b);
+int msm_v4l2_querybuf(struct file *file, void *fh,
+		      struct v4l2_buffer *b);
+int msm_v4l2_create_bufs(struct file *filp, void *fh,
+			 struct v4l2_create_buffers *b);
+int msm_v4l2_prepare_buf(struct file *filp, void *fh,
+			 struct v4l2_buffer *b);
+int msm_v4l2_export_buf(struct file *filp, void *fh,
+			struct v4l2_exportbuffer *eb);
+int msm_v4l2_qbuf(struct file *file, void *fh,
+		  struct v4l2_buffer *b);
+int msm_v4l2_dqbuf(struct file *file, void *fh,
+		   struct v4l2_buffer *b);
+int msm_v4l2_streamon(struct file *file, void *fh,
+		      enum v4l2_buf_type i);
+int msm_v4l2_streamoff(struct file *file, void *fh,
+		       enum v4l2_buf_type i);
+int msm_v4l2_subscribe_event(struct v4l2_fh *fh,
+			     const struct v4l2_event_subscription *sub);
+int msm_v4l2_unsubscribe_event(struct v4l2_fh *fh,
+			       const struct v4l2_event_subscription *sub);
+int msm_v4l2_try_decoder_cmd(struct file *file, void *fh,
+			     struct v4l2_decoder_cmd *enc);
+int msm_v4l2_decoder_cmd(struct file *file, void *fh,
+			 struct v4l2_decoder_cmd *dec);
+int msm_v4l2_try_encoder_cmd(struct file *file, void *fh,
+			     struct v4l2_encoder_cmd *enc);
+int msm_v4l2_encoder_cmd(struct file *file, void *fh,
+			 struct v4l2_encoder_cmd *enc);
+int msm_v4l2_enum_framesizes(struct file *file, void *fh,
+			     struct v4l2_frmsizeenum *fsize);
+int msm_v4l2_enum_frameintervals(struct file *file, void *fh,
+				 struct v4l2_frmivalenum *fival);
+int msm_v4l2_queryctrl(struct file *file, void *fh,
+		       struct v4l2_queryctrl *ctrl);
+int msm_v4l2_querymenu(struct file *file, void *fh,
+		       struct v4l2_querymenu *qmenu);
+unsigned int msm_v4l2_poll(struct file *filp,
+			   struct poll_table_struct *pt);
+int msm_v4l2_mmap(struct file *filp, struct vm_area_struct *vma);
+int msm_v4l2_request_validate(struct media_request *req);
+void msm_v4l2_request_queue(struct media_request *req);
+void msm_v4l2_m2m_device_run(void *priv);
+void msm_v4l2_m2m_job_abort(void *priv);
+
+#endif // _MSM_VIDC_V4L2_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/msm_vidc_vb2.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/msm_vidc_vb2.h
@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_VB2_H_
+#define _MSM_VIDC_VB2_H_
+
+#include <media/videobuf2-core.h>
+#include <media/videobuf2-v4l2.h>
+#include "msm_vidc_inst.h"
+
+struct vb2_queue *msm_vidc_get_vb2q(struct msm_vidc_inst *inst,
+				    u32 type, const char *func);
+
+/* vb2_mem_ops */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
+void *msm_vb2_alloc(struct device *dev, unsigned long attrs,
+		    unsigned long size, enum dma_data_direction dma_dir,
+		    gfp_t gfp_flags);
+void *msm_vb2_attach_dmabuf(struct device *dev,
+			    struct dma_buf *dbuf,
+			    unsigned long size,
+			    enum dma_data_direction dma_dir);
+#else
+void *msm_vb2_alloc(struct vb2_buffer *vb, struct device *dev,
+		    unsigned long size);
+void *msm_vb2_attach_dmabuf(struct vb2_buffer *vb, struct device *dev,
+			    struct dma_buf *dbuf, unsigned long size);
+#endif
+
+void msm_vb2_put(void *buf_priv);
+int msm_vb2_mmap(void *buf_priv, struct vm_area_struct *vma);
+struct dma_buf *msm_vb2_get_dmabuf(struct vb2_buffer *vb,
+				   void *buf_priv,
+				   unsigned long flags);
+void msm_vb2_detach_dmabuf(void *buf_priv);
+int msm_vb2_map_dmabuf(void *buf_priv);
+void msm_vb2_unmap_dmabuf(void *buf_priv);
+
+/* vb2_ops */
+int msm_vb2_queue_setup(struct vb2_queue *q,
+			unsigned int *num_buffers,
+			unsigned int *num_planes,
+			unsigned int sizes[],
+			struct device *alloc_devs[]);
+int msm_vidc_start_streaming(struct msm_vidc_inst *inst, struct vb2_queue *q);
+int msm_vidc_stop_streaming(struct msm_vidc_inst *inst, struct vb2_queue *q);
+int msm_vb2_start_streaming(struct vb2_queue *q, unsigned int count);
+void msm_vb2_stop_streaming(struct vb2_queue *q);
+void msm_vb2_buf_queue(struct vb2_buffer *vb2);
+int msm_vb2_buf_out_validate(struct vb2_buffer *vb);
+void msm_vb2_request_complete(struct vb2_buffer *vb);
+#endif // _MSM_VIDC_VB2_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/resources.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/resources.h
@@ -0,0 +1,293 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _MSM_VIDC_RESOURCES_H_
+#define _MSM_VIDC_RESOURCES_H_
+
+struct icc_path;
+struct regulator;
+struct clk;
+struct reset_control;
+struct llcc_slice_desc;
+struct iommu_domain;
+struct device;
+struct msm_vidc_core;
+
+/*
+ * These are helper macros to iterate over various lists within
+ * msm_vidc_core->resource. The intention is to cut down on a lot
+ * of boiler-plate code
+ */
+
+/* Read as "for each 'thing' in a set of 'thingies'" */
+#define venus_hfi_for_each_thing(__device, __thing, __thingy) \
+	venus_hfi_for_each_thing_continue(__device, __thing, __thingy, 0)
+
+#define venus_hfi_for_each_thing_reverse(__device, __thing, __thingy) \
+	venus_hfi_for_each_thing_reverse_continue(__device, __thing, __thingy, \
+			(__device)->resource->__thingy##_set.count - 1)
+
+/* TODO: the __from parameter technically not required since we can figure it
+ * out with some pointer magic (i.e. __thing - __thing##_tbl[0]).  If this macro
+ * sees extensive use, probably worth cleaning it up but for now omitting it
+ * since it introduces unnecessary complexity.
+ */
+#define venus_hfi_for_each_thing_continue(__device, __thing, __thingy, __from) \
+	for (__thing = &(__device)->resource->\
+			__thingy##_set.__thingy##_tbl[__from]; \
+		__thing < &(__device)->resource->__thingy##_set.__thingy##_tbl[0] + \
+			((__device)->resource->__thingy##_set.count - __from); \
+		++__thing)
+
+#define venus_hfi_for_each_thing_reverse_continue(__device, __thing, __thingy, \
+		__from) \
+	for (__thing = &(__device)->resource->\
+			__thingy##_set.__thingy##_tbl[__from]; \
+		__thing >= &(__device)->resource->__thingy##_set.__thingy##_tbl[0]; \
+		--__thing)
+
+/* Bus set helpers */
+#define venus_hfi_for_each_bus(__device, __binfo) \
+	venus_hfi_for_each_thing(__device, __binfo, bus)
+#define venus_hfi_for_each_bus_reverse(__device, __binfo) \
+	venus_hfi_for_each_thing_reverse(__device, __binfo, bus)
+
+/* Regular set helpers */
+#define venus_hfi_for_each_regulator(__device, __rinfo) \
+	venus_hfi_for_each_thing(__device, __rinfo, regulator)
+#define venus_hfi_for_each_regulator_reverse(__device, __rinfo) \
+	venus_hfi_for_each_thing_reverse(__device, __rinfo, regulator)
+#define venus_hfi_for_each_regulator_reverse_continue(__device, __rinfo, \
+		__from) \
+	venus_hfi_for_each_thing_reverse_continue(__device, __rinfo, \
+			regulator, __from)
+
+/* Power domain set helpers */
+#define venus_hfi_for_each_power_domain(__device, __pdinfo) \
+	venus_hfi_for_each_thing(__device, __pdinfo, power_domain)
+
+/* Clock set helpers */
+#define venus_hfi_for_each_clock(__device, __cinfo) \
+	venus_hfi_for_each_thing(__device, __cinfo, clock)
+#define venus_hfi_for_each_clock_reverse(__device, __cinfo) \
+	venus_hfi_for_each_thing_reverse(__device, __cinfo, clock)
+
+/* Reset clock set helpers */
+#define venus_hfi_for_each_reset_clock(__device, __rcinfo) \
+	venus_hfi_for_each_thing(__device, __rcinfo, reset)
+#define venus_hfi_for_each_reset_clock_reverse(__device, __rcinfo) \
+	venus_hfi_for_each_thing_reverse(__device, __rcinfo, reset)
+#define venus_hfi_for_each_reset_clock_reverse_continue(__device, __rinfo, \
+		__from) \
+	venus_hfi_for_each_thing_reverse_continue(__device, __rinfo, \
+			reset, __from)
+
+/* Subcache set helpers */
+#define venus_hfi_for_each_subcache(__device, __sinfo) \
+	venus_hfi_for_each_thing(__device, __sinfo, subcache)
+#define venus_hfi_for_each_subcache_reverse(__device, __sinfo) \
+	venus_hfi_for_each_thing_reverse(__device, __sinfo, subcache)
+
+/* Contextbank set helpers */
+#define venus_hfi_for_each_context_bank(__device, __sinfo) \
+	venus_hfi_for_each_thing(__device, __sinfo, context_bank)
+#define venus_hfi_for_each_context_bank_reverse(__device, __sinfo) \
+	venus_hfi_for_each_thing_reverse(__device, __sinfo, context_bank)
+
+/* Device region set helper */
+#define venus_hfi_for_each_device_region(__device, __sinfo) \
+	venus_hfi_for_each_thing(__device, __sinfo, device_region)
+
+enum msm_vidc_branch_mem_flags {
+	MSM_VIDC_CLKFLAG_RETAIN_PERIPH,
+	MSM_VIDC_CLKFLAG_NORETAIN_PERIPH,
+	MSM_VIDC_CLKFLAG_RETAIN_MEM,
+	MSM_VIDC_CLKFLAG_NORETAIN_MEM,
+	MSM_VIDC_CLKFLAG_PERIPH_OFF_SET,
+	MSM_VIDC_CLKFLAG_PERIPH_OFF_CLEAR,
+};
+
+struct bus_info {
+	struct icc_path           *icc;
+	const char                *name;
+	u32                        min_kbps;
+	u32                        max_kbps;
+};
+
+struct bus_set {
+	struct bus_info           *bus_tbl;
+	u32                        count;
+};
+
+struct regulator_info {
+	struct regulator          *regulator;
+	const char                *name;
+	bool                       hw_power_collapse;
+};
+
+struct regulator_set {
+	struct regulator_info     *regulator_tbl;
+	u32                        count;
+};
+
+struct power_domain_info {
+	struct device             *genpd_dev;
+	const char                *name;
+};
+
+struct power_domain_set {
+	struct power_domain_info  *power_domain_tbl;
+	u32                        count;
+};
+
+struct clock_residency {
+	struct list_head           list;
+	u64                        rate;
+	u64                        start_time_us;
+	u64                        total_time_us;
+};
+
+struct clock_info {
+	struct clk                *clk;
+	const char                *name;
+	u32                        clk_id;
+	bool                       has_scaling;
+	u64                        prev;
+#ifdef CONFIG_MSM_MMRM
+	struct mmrm_client        *mmrm_client;
+#endif
+	struct list_head           residency_list;  /* list of struct clock_residency */
+};
+
+struct clock_set {
+	struct clock_info         *clock_tbl;
+	u32                        count;
+};
+
+struct reset_info {
+	struct reset_control      *rst;
+	const char                *name;
+	bool                       exclusive_release;
+};
+
+struct reset_set {
+	struct reset_info         *reset_tbl;
+	u32                        count;
+};
+
+struct subcache_info {
+	struct llcc_slice_desc    *subcache;
+	const char                *name;
+	u32                        llcc_id;
+	bool                       isactive;
+};
+
+struct subcache_set {
+	struct subcache_info      *subcache_tbl;
+	u32                        count;
+	bool                       set_to_fw;
+};
+
+struct addr_range {
+	u32                        start;
+	u32                        size;
+};
+
+struct context_bank_info {
+	const char                *name;
+	struct addr_range          addr_range;
+	bool                       secure;
+	bool                       dma_coherant;
+	struct device             *dev;
+	struct iommu_domain       *domain;
+	u32                        region;
+	u64                        dma_mask;
+};
+
+struct context_bank_set {
+	struct context_bank_info  *context_bank_tbl;
+	u32                        count;
+};
+
+struct frequency_table {
+	unsigned long freq;
+};
+
+struct freq_set {
+	struct frequency_table    *freq_tbl;
+	u32                        count;
+};
+
+struct device_region_info {
+	const char          *name;
+	phys_addr_t          phy_addr;
+	u32                  size;
+	u32                  dev_addr;
+	u32                  region;
+};
+
+struct device_region_set {
+	struct device_region_info  *device_region_tbl;
+	u32                         count;
+};
+
+struct msm_vidc_resource {
+	u8 __iomem                *register_base_addr;
+	u32                        irq;
+	struct bus_set             bus_set;
+	struct regulator_set       regulator_set;
+	struct power_domain_set    power_domain_set;
+	struct clock_set           clock_set;
+	struct reset_set           reset_set;
+	struct subcache_set        subcache_set;
+	struct context_bank_set    context_bank_set;
+	struct freq_set            freq_set;
+	struct device_region_set   device_region_set;
+	int                        fw_cookie;
+};
+
+#define call_res_op(c, op, ...)                  \
+	(((c) && (c)->res_ops && (c)->res_ops->op) ? \
+	((c)->res_ops->op(__VA_ARGS__)) : 0)
+
+struct msm_vidc_resources_ops {
+	int (*init)(struct msm_vidc_core *core);
+
+	int (*reset_bridge)(struct msm_vidc_core *core);
+	int (*reset_control_acquire)(struct msm_vidc_core *core,
+				     const char *name);
+	int (*reset_control_release)(struct msm_vidc_core *core,
+				     const char *name);
+	int (*reset_control_assert)(struct msm_vidc_core *core,
+				    const char *name);
+	int (*reset_control_deassert)(struct msm_vidc_core *core,
+				      const char *name);
+
+	int (*gdsc_init)(struct msm_vidc_core *core);
+	int (*gdsc_on)(struct msm_vidc_core *core, const char *name);
+	int (*gdsc_off)(struct msm_vidc_core *core, const char *name);
+	int (*gdsc_hw_ctrl)(struct msm_vidc_core *core);
+	int (*gdsc_sw_ctrl)(struct msm_vidc_core *core);
+
+	int (*llcc)(struct msm_vidc_core *core, bool enable);
+	int (*set_bw)(struct msm_vidc_core *core, unsigned long bw_ddr,
+		      unsigned long bw_llcc);
+	int (*set_clks)(struct msm_vidc_core *core, u64 rate);
+
+	int (*clk_disable)(struct msm_vidc_core *core, const char *name);
+	int (*clk_enable)(struct msm_vidc_core *core, const char *name);
+	int (*clk_set_flag)(struct msm_vidc_core *core,
+			    const char *name,
+			    enum msm_vidc_branch_mem_flags flag);
+	int (*clk_print_residency_stats)(struct msm_vidc_core *core);
+	int (*clk_reset_residency_stats)(struct msm_vidc_core *core);
+	int (*clk_update_residency_stats)(struct msm_vidc_core *core,
+					  struct clock_info *cl, u64 rate);
+};
+
+const struct msm_vidc_resources_ops *get_resources_ops(void);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/resources_ext.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/resources_ext.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _RESOURCES_EXT_H_
+#define _RESOURCES_EXT_H_
+
+struct msm_vidc_resources_ops;
+
+const struct msm_vidc_resources_ops *get_res_ops_ext(void);
+
+#endif // _RESOURCES_EXT_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/venus_hfi.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/venus_hfi.h
@@ -0,0 +1,85 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _VENUS_HFI_H_
+#define _VENUS_HFI_H_
+
+#include <linux/irqreturn.h>
+#include <linux/clk.h>
+#include <linux/regulator/consumer.h>
+#include <linux/clk-provider.h>
+
+#include "msm_vidc_internal.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+
+#define VIDC_MAX_PC_SKIP_COUNT	10
+
+struct vidc_buffer_addr_info {
+	enum msm_vidc_buffer_type buffer_type;
+	u32 buffer_size;
+	u32 num_buffers;
+	u32 align_device_addr;
+	u32 extradata_addr;
+	u32 extradata_size;
+	u32 response_required;
+};
+
+struct hfi_pending_packet {
+	struct list_head       list;
+	void                  *data;
+};
+
+int __strict_check(struct msm_vidc_core *core,
+		   const char *function);
+int venus_hfi_session_property(struct msm_vidc_inst *inst,
+			       u32 pkt_type, u32 flags, u32 port,
+			       u32 payload_type, void *payload,
+			       u32 payload_size);
+int venus_hfi_session_command(struct msm_vidc_inst *inst,
+			      u32 cmd, enum msm_vidc_port_type port,
+			      u32 payload_type,
+			      void *payload, u32 payload_size);
+int venus_hfi_queue_buffer(struct msm_vidc_inst *inst,
+			   struct msm_vidc_buffer *buffer,
+			   struct msm_vidc_buffer *metabuf);
+int venus_hfi_queue_super_buffer(struct msm_vidc_inst *inst,
+				 struct msm_vidc_buffer *buffer,
+				 struct msm_vidc_buffer *metabuf);
+int venus_hfi_release_buffer(struct msm_vidc_inst *inst,
+			     struct msm_vidc_buffer *buffer);
+int venus_hfi_start(struct msm_vidc_inst *inst, enum msm_vidc_port_type port);
+int venus_hfi_stop(struct msm_vidc_inst *inst, enum msm_vidc_port_type port);
+int venus_hfi_session_close(struct msm_vidc_inst *inst);
+int venus_hfi_session_open(struct msm_vidc_inst *inst);
+int venus_hfi_session_pause(struct msm_vidc_inst *inst, enum msm_vidc_port_type port);
+int venus_hfi_session_resume(struct msm_vidc_inst *inst,
+			     enum msm_vidc_port_type port, u32 payload);
+int venus_hfi_session_drain(struct msm_vidc_inst *inst, enum msm_vidc_port_type port);
+int venus_hfi_session_set_codec(struct msm_vidc_inst *inst);
+int venus_hfi_session_set_secure_mode(struct msm_vidc_inst *inst);
+int venus_hfi_core_init(struct msm_vidc_core *core);
+int venus_hfi_core_deinit(struct msm_vidc_core *core, bool force);
+int venus_hfi_noc_error_info(struct msm_vidc_core *core);
+int venus_hfi_suspend(struct msm_vidc_core *core);
+int venus_hfi_trigger_ssr(struct msm_vidc_core *core, u32 type,
+			  u32 client_id, u32 addr);
+int venus_hfi_trigger_stability(struct msm_vidc_inst *inst, u32 type,
+				u32 client_id, u32 val);
+int venus_hfi_reserve_hardware(struct msm_vidc_inst *inst, u32 duration);
+int venus_hfi_scale_clocks(struct msm_vidc_inst *inst, u64 freq);
+int venus_hfi_scale_buses(struct msm_vidc_inst *inst, u64 bw_ddr, u64 bw_llcc);
+int venus_hfi_set_ir_period(struct msm_vidc_inst *inst, u32 ir_type,
+			    enum msm_vidc_inst_capability_type cap_id);
+void venus_hfi_pm_work_handler(struct work_struct *work);
+irqreturn_t venus_hfi_isr(int irq, void *data);
+irqreturn_t venus_hfi_isr_handler(int irq, void *data);
+int __prepare_pc(struct msm_vidc_core *core);
+struct device_region_info
+	*venus_hfi_get_device_region_info(struct msm_vidc_core *core,
+					  enum msm_vidc_device_region region);
+
+#endif // _VENUS_HFI_H_
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/venus_hfi_queue.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/venus_hfi_queue.h
@@ -0,0 +1,96 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _VENUS_HFI_QUEUE_H_
+#define _VENUS_HFI_QUEUE_H_
+
+#include <linux/types.h>
+
+#include "msm_vidc_internal.h"
+
+#define HFI_MASK_QHDR_TX_TYPE			0xff000000
+#define HFI_MASK_QHDR_RX_TYPE			0x00ff0000
+#define HFI_MASK_QHDR_PRI_TYPE			0x0000ff00
+#define HFI_MASK_QHDR_Q_ID_TYPE			0x000000ff
+#define HFI_Q_ID_HOST_TO_CTRL_CMD_Q		0
+#define HFI_Q_ID_CTRL_TO_HOST_MSG_Q		1
+#define HFI_Q_ID_CTRL_TO_HOST_DEBUG_Q		2
+#define HFI_MASK_QHDR_STATUS			0x000000ff
+
+#define VIDC_IFACEQ_NUMQ                3
+#define VIDC_IFACEQ_CMDQ_IDX            0
+#define VIDC_IFACEQ_MSGQ_IDX            1
+#define VIDC_IFACEQ_DBGQ_IDX            2
+#define VIDC_IFACEQ_MAX_BUF_COUNT       50
+#define VIDC_IFACE_MAX_PARALLEL_CLNTS   16
+#define VIDC_IFACEQ_DFLT_QHDR           0x01010000
+
+struct hfi_queue_table_header {
+	u32 qtbl_version;
+	u32 qtbl_size;
+	u32 qtbl_qhdr0_offset;
+	u32 qtbl_qhdr_size;
+	u32 qtbl_num_q;
+	u32 qtbl_num_active_q;
+	void *device_addr;
+	char name[256];
+};
+
+struct hfi_queue_header {
+	u32 qhdr_status;
+	u32 qhdr_start_addr;
+	u32 qhdr_type;
+	u32 qhdr_q_size;
+	u32 qhdr_pkt_size;
+	u32 qhdr_pkt_drop_cnt;
+	u32 qhdr_rx_wm;
+	u32 qhdr_tx_wm;
+	u32 qhdr_rx_req;
+	u32 qhdr_tx_req;
+	u32 qhdr_rx_irq_status;
+	u32 qhdr_tx_irq_status;
+	u32 qhdr_read_idx;
+	u32 qhdr_write_idx;
+};
+
+#define VIDC_IFACEQ_TABLE_SIZE	(sizeof(struct hfi_queue_table_header) + \
+			sizeof(struct hfi_queue_header) * VIDC_IFACEQ_NUMQ)
+
+#define VIDC_IFACEQ_QUEUE_SIZE	(VIDC_IFACEQ_MAX_PKT_SIZE *  \
+	VIDC_IFACEQ_MAX_BUF_COUNT * VIDC_IFACE_MAX_PARALLEL_CLNTS)
+
+#define VIDC_IFACEQ_GET_QHDR_START_ADDR(ptr, i)     \
+	((void *)((ptr + sizeof(struct hfi_queue_table_header)) + \
+		(i * sizeof(struct hfi_queue_header))))
+
+#define QDSS_SIZE	4096
+#define SFR_SIZE	4096
+#define MMAP_BUF_SIZE	4096
+
+#define QUEUE_SIZE	(VIDC_IFACEQ_TABLE_SIZE + \
+			(VIDC_IFACEQ_QUEUE_SIZE * VIDC_IFACEQ_NUMQ))
+
+#define ALIGNED_QDSS_SIZE	ALIGN(QDSS_SIZE, SZ_4K)
+#define ALIGNED_SFR_SIZE	ALIGN(SFR_SIZE, SZ_4K)
+#define ALIGNED_MMAP_BUF_SIZE	ALIGN(MMAP_BUF_SIZE, SZ_4K)
+#define ALIGNED_QUEUE_SIZE	ALIGN(QUEUE_SIZE, SZ_4K)
+#define SHARED_QSIZE		ALIGN(ALIGNED_SFR_SIZE + ALIGNED_QUEUE_SIZE + \
+				      ALIGNED_QDSS_SIZE + ALIGNED_MMAP_BUF_SIZE, SZ_1M)
+#define TOTAL_QSIZE	(SHARED_QSIZE - ALIGNED_SFR_SIZE - ALIGNED_QDSS_SIZE - \
+					ALIGNED_MMAP_BUF_SIZE)
+
+struct msm_vidc_core;
+
+int venus_hfi_queue_cmd_write(struct msm_vidc_core *core, void *pkt);
+int venus_hfi_queue_cmd_write_intr(struct msm_vidc_core *core, void *pkt,
+				   bool allow_intr);
+int venus_hfi_queue_msg_read(struct msm_vidc_core *core, void *pkt);
+int venus_hfi_queue_dbg_read(struct msm_vidc_core *core, void *pkt);
+void venus_hfi_queue_deinit(struct msm_vidc_core *core);
+int venus_hfi_queue_init(struct msm_vidc_core *core);
+int venus_hfi_reset_queue_header(struct msm_vidc_core *core);
+
+#endif
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/inc/venus_hfi_response.h
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/inc/venus_hfi_response.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __VENUS_HFI_RESPONSE_H__
+#define __VENUS_HFI_RESPONSE_H__
+
+#include "hfi_packet.h"
+
+int handle_response(struct msm_vidc_core *core,
+		    void *response);
+int validate_packet(u8 *response_pkt, u8 *core_resp_pkt,
+		    u32 core_resp_pkt_size, const char *func);
+bool is_valid_port(struct msm_vidc_inst *inst, u32 port,
+		   const char *func);
+bool is_valid_hfi_buffer_type(struct msm_vidc_inst *inst,
+			      u32 buffer_type, const char *func);
+int handle_system_error(struct msm_vidc_core *core,
+			struct hfi_packet *pkt);
+int handle_release_output_buffer(struct msm_vidc_inst *inst,
+				 struct hfi_buffer *buffer);
+
+#endif // __VENUS_HFI_RESPONSE_H__
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/firmware.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/firmware.c
@@ -0,0 +1,295 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+#include <linux/types.h>
+#include <linux/list.h>
+#include <linux/of_address.h>
+#include <linux/devcoredump.h>
+#include <linux/firmware.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/soc/qcom/mdt_loader.h>
+#include <linux/soc/qcom/smem.h>
+
+#include "msm_vidc_core.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_events.h"
+#include "msm_vidc_platform.h"
+#include "firmware.h"
+
+#define MAX_FIRMWARE_NAME_SIZE	128
+
+struct tzbsp_memprot {
+	u32 cp_start;
+	u32 cp_size;
+	u32 cp_nonpixel_start;
+	u32 cp_nonpixel_size;
+};
+
+enum tzbsp_video_state {
+	TZBSP_VIDEO_STATE_SUSPEND = 0,
+	TZBSP_VIDEO_STATE_RESUME = 1,
+	TZBSP_VIDEO_STATE_RESTORE_THRESHOLD = 2,
+};
+
+static int protect_cp_mem(struct msm_vidc_core *core)
+{
+	struct tzbsp_memprot memprot;
+	int rc = 0;
+	struct context_bank_info *cb;
+
+	memprot.cp_start = 0x0;
+	memprot.cp_size = 0x0;
+	memprot.cp_nonpixel_start = 0x0;
+	memprot.cp_nonpixel_size = 0x0;
+
+	venus_hfi_for_each_context_bank(core, cb) {
+		if (cb->region == MSM_VIDC_NON_SECURE) {
+			memprot.cp_size = cb->addr_range.start;
+
+			d_vpr_h("%s: memprot.cp_size: %#x\n",
+				__func__, memprot.cp_size);
+		}
+
+		if (cb->region == MSM_VIDC_SECURE_NONPIXEL) {
+			memprot.cp_nonpixel_start = cb->addr_range.start;
+			memprot.cp_nonpixel_size = cb->addr_range.size;
+
+			d_vpr_h("%s: cp_nonpixel_start: %#x size: %#x\n",
+				__func__, memprot.cp_nonpixel_start,
+				memprot.cp_nonpixel_size);
+		}
+	}
+
+	rc = qcom_scm_mem_protect_video_var(memprot.cp_start, memprot.cp_size,
+			memprot.cp_nonpixel_start, memprot.cp_nonpixel_size);
+	if (rc)
+		d_vpr_e("Failed to protect memory(%d)\n", rc);
+
+	trace_venus_hfi_var_done(memprot.cp_start, memprot.cp_size,
+				 memprot.cp_nonpixel_start, memprot.cp_nonpixel_size);
+
+	return rc;
+}
+
+static int __load_fw_to_memory(struct platform_device *pdev,
+			       const char *fw_name)
+{
+	int rc = 0;
+	const struct firmware *firmware = NULL;
+	struct msm_vidc_core *core;
+	char firmware_name[MAX_FIRMWARE_NAME_SIZE] = { 0 };
+	struct device_node *node = NULL;
+	struct resource res = { 0 };
+	phys_addr_t phys = 0;
+	size_t res_size = 0;
+	ssize_t fw_size = 0;
+	void *virt = NULL;
+	int pas_id = 0;
+
+	if (!fw_name || !(*fw_name) || !pdev) {
+		d_vpr_e("%s: Invalid inputs\n", __func__);
+		return -EINVAL;
+	}
+	if (strlen(fw_name) >= MAX_FIRMWARE_NAME_SIZE - 4) {
+		d_vpr_e("%s: Invalid fw name\n", __func__);
+		return -EINVAL;
+	}
+
+	core = dev_get_drvdata(&pdev->dev);
+	if (!core) {
+		d_vpr_e("%s: core not found in device %s",
+			__func__, dev_name(&pdev->dev));
+		return -EINVAL;
+	}
+	scnprintf(firmware_name, ARRAY_SIZE(firmware_name), "%s.mbn", fw_name);
+
+	pas_id = core->platform->data.pas_id;
+
+	node = of_parse_phandle(pdev->dev.of_node, "memory-region", 0);
+	if (!node) {
+		d_vpr_e("%s: failed to read \"memory-region\"\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	rc = of_address_to_resource(node, 0, &res);
+	if (rc) {
+		d_vpr_e("%s: failed to read \"memory-region\", error %d\n",
+			__func__, rc);
+		goto exit;
+	}
+	phys = res.start;
+	res_size = (size_t)resource_size(&res);
+
+	rc = request_firmware(&firmware, firmware_name, &pdev->dev);
+	if (rc) {
+		d_vpr_e("%s: failed to request fw \"%s\", error %d\n",
+			__func__, firmware_name, rc);
+		goto exit;
+	}
+
+	fw_size = qcom_mdt_get_size(firmware);
+	if (fw_size < 0 || res_size < (size_t)fw_size) {
+		rc = -EINVAL;
+		d_vpr_e("%s: out of bound fw image fw size: %ld, res_size: %lu",
+			__func__, fw_size, res_size);
+		goto exit;
+	}
+
+	virt = memremap(phys, res_size, MEMREMAP_WC);
+	if (!virt) {
+		d_vpr_e("%s: failed to remap fw memory phys %pa[p]\n",
+			__func__, &phys);
+		return -ENOMEM;
+	}
+
+	/* prevent system suspend during fw_load */
+	pm_stay_awake(pdev->dev.parent);
+	rc = qcom_mdt_load(&pdev->dev, firmware, firmware_name,
+			   pas_id, virt, phys, res_size, NULL);
+	pm_relax(pdev->dev.parent);
+	if (rc) {
+		d_vpr_e("%s: error %d loading fw \"%s\"\n",
+			__func__, rc, firmware_name);
+		goto exit;
+	}
+	rc = qcom_scm_pas_auth_and_reset(pas_id);
+	if (rc) {
+		d_vpr_e("%s: error %d authenticating fw \"%s\"\n",
+			__func__, rc, firmware_name);
+		goto exit;
+	}
+
+	memunmap(virt);
+	release_firmware(firmware);
+	d_vpr_h("%s: firmware \"%s\" loaded successfully\n",
+		__func__, firmware_name);
+
+	return pas_id;
+
+exit:
+	if (virt)
+		memunmap(virt);
+	if (firmware)
+		release_firmware(firmware);
+
+	return rc;
+}
+
+int fw_load(struct msm_vidc_core *core)
+{
+	int rc;
+
+	if (!core->resource->fw_cookie) {
+		core->resource->fw_cookie = __load_fw_to_memory(core->pdev,
+								core->platform->data.fwname);
+		if (core->resource->fw_cookie <= 0) {
+			d_vpr_e("%s: firmware download failed %d\n",
+				__func__, core->resource->fw_cookie);
+			core->resource->fw_cookie = 0;
+			return -ENOMEM;
+		}
+	}
+
+	rc = protect_cp_mem(core);
+	if (rc) {
+		d_vpr_e("%s: protect memory failed\n", __func__);
+		goto fail_protect_mem;
+	}
+
+	return rc;
+
+fail_protect_mem:
+	if (core->resource->fw_cookie)
+		qcom_scm_pas_shutdown(core->resource->fw_cookie);
+	core->resource->fw_cookie = 0;
+	return rc;
+}
+
+int fw_unload(struct msm_vidc_core *core)
+{
+	int ret;
+
+	if (!core->resource->fw_cookie)
+		return -EINVAL;
+
+	ret = qcom_scm_pas_shutdown(core->resource->fw_cookie);
+	if (ret)
+		d_vpr_e("Firmware unload failed rc=%d\n", ret);
+
+	core->resource->fw_cookie = 0;
+
+	return ret;
+}
+
+int fw_suspend(struct msm_vidc_core *core)
+{
+	return qcom_scm_set_remote_state(TZBSP_VIDEO_STATE_SUSPEND, 0);
+}
+
+int fw_resume(struct msm_vidc_core *core)
+{
+	return qcom_scm_set_remote_state(TZBSP_VIDEO_STATE_RESUME, 0);
+}
+
+void fw_coredump(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	struct platform_device *pdev;
+	struct device_node *node = NULL;
+	struct resource res = {0};
+	phys_addr_t mem_phys = 0;
+	size_t res_size = 0;
+	void *mem_va = NULL;
+	char *data = NULL, *dump = NULL;
+	u64 total_size;
+
+	pdev = core->pdev;
+
+	node = of_parse_phandle(pdev->dev.of_node, "memory-region", 0);
+	if (!node) {
+		d_vpr_e("%s: DT error getting \"memory-region\" property\n",
+			__func__);
+		return;
+	}
+
+	rc = of_address_to_resource(node, 0, &res);
+	if (rc) {
+		d_vpr_e("%s: error %d while getting \"memory-region\" resource\n",
+			__func__, rc);
+		return;
+	}
+
+	mem_phys = res.start;
+	res_size = (size_t)resource_size(&res);
+
+	mem_va = memremap(mem_phys, res_size, MEMREMAP_WC);
+	if (!mem_va) {
+		d_vpr_e("%s: unable to remap firmware memory\n", __func__);
+		return;
+	}
+	total_size = res_size + TOTAL_QSIZE + ALIGNED_SFR_SIZE;
+
+	data = vmalloc(total_size);
+	if (!data) {
+		memunmap(mem_va);
+		return;
+	}
+	dump = data;
+
+	/* copy firmware dump */
+	memcpy(data, mem_va, res_size);
+	memunmap(mem_va);
+
+	/* copy queues(cmd, msg, dbg) dump(along with headers) */
+	data += res_size;
+	memcpy(data, (char *)core->iface_q_table.align_virtual_addr, TOTAL_QSIZE);
+
+	/* copy sfr dump */
+	data += TOTAL_QSIZE;
+	memcpy(data, (char *)core->sfr.align_virtual_addr, ALIGNED_SFR_SIZE);
+
+	dev_coredumpv(&pdev->dev, dump, total_size, GFP_KERNEL);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/hfi_packet.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/hfi_packet.c
@@ -0,0 +1,708 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "hfi_packet.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_debug.h"
+
+u32 get_hfi_port(struct msm_vidc_inst *inst,
+		 enum msm_vidc_port_type port)
+{
+	u32 hfi_port = HFI_PORT_NONE;
+
+	if (is_decode_session(inst)) {
+		switch (port) {
+		case INPUT_PORT:
+		case INPUT_META_PORT:
+			hfi_port = HFI_PORT_BITSTREAM;
+			break;
+		case OUTPUT_PORT:
+		case OUTPUT_META_PORT:
+			hfi_port = HFI_PORT_RAW;
+			break;
+		default:
+			i_vpr_e(inst, "%s: invalid port type %d\n",
+				__func__, port);
+			break;
+		}
+	} else if (is_encode_session(inst)) {
+		switch (port) {
+		case INPUT_PORT:
+		case INPUT_META_PORT:
+			hfi_port = HFI_PORT_RAW;
+			break;
+		case OUTPUT_PORT:
+		case OUTPUT_META_PORT:
+			hfi_port = HFI_PORT_BITSTREAM;
+			break;
+		default:
+			i_vpr_e(inst, "%s: invalid port type %d\n",
+				__func__, port);
+			break;
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid domain %#x\n",
+			__func__, inst->domain);
+	}
+
+	return hfi_port;
+}
+
+u32 get_hfi_port_from_buffer_type(struct msm_vidc_inst *inst,
+				  enum msm_vidc_buffer_type buffer_type)
+{
+	u32 hfi_port = HFI_PORT_NONE;
+
+	if (is_decode_session(inst)) {
+		switch (buffer_type) {
+		case MSM_VIDC_BUF_INPUT:
+		case MSM_VIDC_BUF_INPUT_META:
+		case MSM_VIDC_BUF_BIN:
+		case MSM_VIDC_BUF_COMV:
+		case MSM_VIDC_BUF_NON_COMV:
+		case MSM_VIDC_BUF_LINE:
+		case MSM_VIDC_BUF_PARTIAL_DATA:
+			hfi_port = HFI_PORT_BITSTREAM;
+			break;
+		case MSM_VIDC_BUF_OUTPUT:
+		case MSM_VIDC_BUF_OUTPUT_META:
+		case MSM_VIDC_BUF_DPB:
+			hfi_port = HFI_PORT_RAW;
+			break;
+		case MSM_VIDC_BUF_PERSIST:
+			hfi_port = HFI_PORT_NONE;
+			break;
+		default:
+			i_vpr_e(inst, "%s: invalid buffer type %d\n",
+				__func__, buffer_type);
+			break;
+		}
+	} else if (is_encode_session(inst)) {
+		switch (buffer_type) {
+		case MSM_VIDC_BUF_INPUT:
+		case MSM_VIDC_BUF_INPUT_META:
+		case MSM_VIDC_BUF_VPSS:
+			hfi_port = HFI_PORT_RAW;
+			break;
+		case MSM_VIDC_BUF_OUTPUT:
+		case MSM_VIDC_BUF_OUTPUT_META:
+		case MSM_VIDC_BUF_BIN:
+		case MSM_VIDC_BUF_COMV:
+		case MSM_VIDC_BUF_NON_COMV:
+		case MSM_VIDC_BUF_LINE:
+		case MSM_VIDC_BUF_DPB:
+			hfi_port = HFI_PORT_BITSTREAM;
+			break;
+		case MSM_VIDC_BUF_ARP:
+			hfi_port = HFI_PORT_NONE;
+			break;
+		default:
+			i_vpr_e(inst, "%s: invalid buffer type %d\n",
+				__func__, buffer_type);
+			break;
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid domain %#x\n",
+			__func__, inst->domain);
+	}
+
+	return hfi_port;
+}
+
+u32 hfi_buf_type_from_driver(enum msm_vidc_domain_type domain,
+			     enum msm_vidc_buffer_type buffer_type)
+{
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_INPUT:
+		if (domain == MSM_VIDC_DECODER)
+			return HFI_BUFFER_BITSTREAM;
+		else
+			return HFI_BUFFER_RAW;
+	case MSM_VIDC_BUF_OUTPUT:
+		if (domain == MSM_VIDC_DECODER)
+			return HFI_BUFFER_RAW;
+		else
+			return HFI_BUFFER_BITSTREAM;
+	case MSM_VIDC_BUF_INPUT_META:
+	case MSM_VIDC_BUF_OUTPUT_META:
+		return HFI_BUFFER_METADATA;
+	case MSM_VIDC_BUF_BIN:
+		return HFI_BUFFER_BIN;
+	case MSM_VIDC_BUF_ARP:
+		return HFI_BUFFER_ARP;
+	case MSM_VIDC_BUF_COMV:
+		return HFI_BUFFER_COMV;
+	case MSM_VIDC_BUF_NON_COMV:
+		return HFI_BUFFER_NON_COMV;
+	case MSM_VIDC_BUF_LINE:
+		return HFI_BUFFER_LINE;
+	case MSM_VIDC_BUF_DPB:
+		return HFI_BUFFER_DPB;
+	case MSM_VIDC_BUF_PERSIST:
+		return HFI_BUFFER_PERSIST;
+	case MSM_VIDC_BUF_VPSS:
+		return HFI_BUFFER_VPSS;
+	case MSM_VIDC_BUF_PARTIAL_DATA:
+		return HFI_BUFFER_PARTIAL_DATA;
+	default:
+		d_vpr_e("invalid buffer type %d\n",
+			buffer_type);
+		return 0;
+	}
+}
+
+u32 hfi_buf_type_to_driver(enum msm_vidc_domain_type domain,
+			   enum hfi_buffer_type buffer_type, enum hfi_packet_port_type port_type)
+{
+	switch (buffer_type) {
+	case HFI_BUFFER_BITSTREAM:
+		if (domain == MSM_VIDC_DECODER)
+			return MSM_VIDC_BUF_INPUT;
+		else
+			return MSM_VIDC_BUF_OUTPUT;
+	case HFI_BUFFER_RAW:
+		if (domain == MSM_VIDC_DECODER)
+			return MSM_VIDC_BUF_OUTPUT;
+		else
+			return MSM_VIDC_BUF_INPUT;
+	case HFI_BUFFER_METADATA:
+		if (domain == MSM_VIDC_DECODER)
+			if (port_type == HFI_PORT_BITSTREAM)
+				return MSM_VIDC_BUF_INPUT_META;
+			else
+				return MSM_VIDC_BUF_OUTPUT_META;
+		else
+			if (port_type == HFI_PORT_BITSTREAM)
+				return MSM_VIDC_BUF_OUTPUT_META;
+			else
+				return MSM_VIDC_BUF_INPUT_META;
+	case HFI_BUFFER_BIN:
+		return MSM_VIDC_BUF_BIN;
+	case HFI_BUFFER_ARP:
+		return MSM_VIDC_BUF_ARP;
+	case HFI_BUFFER_COMV:
+		return MSM_VIDC_BUF_COMV;
+	case HFI_BUFFER_NON_COMV:
+		return MSM_VIDC_BUF_NON_COMV;
+	case HFI_BUFFER_LINE:
+		return MSM_VIDC_BUF_LINE;
+	case HFI_BUFFER_DPB:
+		return MSM_VIDC_BUF_DPB;
+	case HFI_BUFFER_PERSIST:
+		return MSM_VIDC_BUF_PERSIST;
+	case HFI_BUFFER_VPSS:
+		return MSM_VIDC_BUF_VPSS;
+	case HFI_BUFFER_PARTIAL_DATA:
+		return MSM_VIDC_BUF_PARTIAL_DATA;
+	default:
+		d_vpr_e("invalid buffer type %d\n",
+			buffer_type);
+		return 0;
+	}
+}
+
+u32 get_hfi_codec(struct msm_vidc_inst *inst)
+{
+	switch (inst->codec) {
+	case MSM_VIDC_H264:
+		if (is_encode_session(inst))
+			return HFI_CODEC_ENCODE_AVC;
+		else
+			return HFI_CODEC_DECODE_AVC;
+	case MSM_VIDC_HEVC:
+	case MSM_VIDC_HEIC:
+		if (is_encode_session(inst))
+			return HFI_CODEC_ENCODE_HEVC;
+		else
+			return HFI_CODEC_DECODE_HEVC;
+	case MSM_VIDC_VP9:
+		return HFI_CODEC_DECODE_VP9;
+	case MSM_VIDC_AV1:
+		return HFI_CODEC_DECODE_AV1;
+	default:
+		i_vpr_e(inst, "invalid codec %d, domain %d\n",
+			inst->codec, inst->domain);
+		return 0;
+	}
+}
+
+u32 get_hfi_colorformat(struct msm_vidc_inst *inst,
+			enum msm_vidc_colorformat_type colorformat)
+{
+	u32 hfi_colorformat = HFI_COLOR_FMT_NV12_UBWC;
+
+	switch (colorformat) {
+	case MSM_VIDC_FMT_NV12:
+		hfi_colorformat = HFI_COLOR_FMT_NV12;
+		break;
+	case MSM_VIDC_FMT_NV12C:
+		hfi_colorformat = HFI_COLOR_FMT_NV12_UBWC;
+		break;
+	case MSM_VIDC_FMT_P010:
+		hfi_colorformat = HFI_COLOR_FMT_P010;
+		break;
+	case MSM_VIDC_FMT_TP10C:
+		hfi_colorformat = HFI_COLOR_FMT_TP10_UBWC;
+		break;
+	case MSM_VIDC_FMT_RGBA8888:
+		hfi_colorformat = HFI_COLOR_FMT_RGBA8888;
+		break;
+	case MSM_VIDC_FMT_RGBA8888C:
+		hfi_colorformat = HFI_COLOR_FMT_RGBA8888_UBWC;
+		break;
+	case MSM_VIDC_FMT_NV21:
+		hfi_colorformat = HFI_COLOR_FMT_NV21;
+		break;
+	default:
+		i_vpr_e(inst, "%s: invalid colorformat %d\n",
+			__func__, colorformat);
+		break;
+	}
+
+	return hfi_colorformat;
+}
+
+static u32 get_hfi_region_flag(enum msm_vidc_buffer_region region)
+{
+	switch (region) {
+	case MSM_VIDC_NON_SECURE:
+		return HFI_BUF_HOST_FLAGS_CB_NON_SECURE;
+	case MSM_VIDC_NON_SECURE_PIXEL:
+		return HFI_BUF_HOST_FLAGS_CB_NON_SECURE_PIXEL;
+	case MSM_VIDC_SECURE_PIXEL:
+		return HFI_BUF_HOST_FLAGS_CB_SECURE_PIXEL;
+	case MSM_VIDC_SECURE_NONPIXEL:
+		return HFI_BUF_HOST_FLAGS_CB_SECURE_NON_PIXEL;
+	case MSM_VIDC_SECURE_BITSTREAM:
+		return HFI_BUF_HOST_FLAGS_CB_SECURE_BITSTREAM;
+	case MSM_VIDC_REGION_MAX:
+	case MSM_VIDC_REGION_NONE:
+	default:
+		return HFI_BUF_HOST_FLAG_NONE;
+	}
+}
+
+int get_hfi_buffer(struct msm_vidc_inst *inst,
+		   struct msm_vidc_buffer *buffer, struct hfi_buffer *buf)
+{
+	memset(buf, 0, sizeof(struct hfi_buffer));
+	buf->type = hfi_buf_type_from_driver(inst->domain, buffer->type);
+	buf->index = buffer->index;
+	buf->base_address = buffer->device_addr;
+	buf->addr_offset = 0;
+	buf->buffer_size = buffer->buffer_size;
+	/*
+	 * for decoder input buffers, firmware (BSE HW) needs 256 aligned
+	 * buffer size otherwise it will truncate or ignore the data after 256
+	 * aligned size which may lead to error concealment
+	 */
+	if (is_decode_session(inst) && is_input_buffer(buffer->type))
+		buf->buffer_size = ALIGN(buffer->buffer_size, 256);
+	buf->data_offset = buffer->data_offset;
+	buf->data_size = buffer->data_size;
+	if (buffer->attr & MSM_VIDC_ATTR_READ_ONLY)
+		buf->flags |= HFI_BUF_HOST_FLAG_READONLY;
+	if (buffer->attr & MSM_VIDC_ATTR_PENDING_RELEASE)
+		buf->flags |= HFI_BUF_HOST_FLAG_RELEASE;
+	if (buffer->flags & MSM_VIDC_BUF_FLAG_CODECCONFIG)
+		buf->flags |= HFI_BUF_HOST_FLAG_CODEC_CONFIG;
+	buf->flags |= get_hfi_region_flag(buffer->region);
+	buf->timestamp = buffer->timestamp;
+
+	return 0;
+}
+
+int hfi_create_header(u8 *packet, u32 packet_size, u32 session_id,
+		      u32 header_id)
+{
+	struct hfi_header *hdr = (struct hfi_header *)packet;
+
+	if (!packet || packet_size < sizeof(struct hfi_header)) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	memset(hdr, 0, sizeof(struct hfi_header));
+
+	hdr->size = sizeof(struct hfi_header);
+	hdr->session_id = session_id;
+	hdr->header_id = header_id;
+	hdr->num_packets = 0;
+	return 0;
+}
+
+int hfi_create_packet(u8 *packet, u32 packet_size,
+		      u32 pkt_type, u32 pkt_flags, u32 payload_type, u32 port,
+		      u32 packet_id, void *payload, u32 payload_size)
+{
+	struct hfi_header *hdr;
+	struct hfi_packet *pkt;
+	u32 pkt_size;
+
+	if (!packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	hdr = (struct hfi_header *)packet;
+	if (hdr->size < sizeof(struct hfi_header)) {
+		d_vpr_e("%s: invalid hdr size %d\n", __func__, hdr->size);
+		return -EINVAL;
+	}
+	pkt = (struct hfi_packet *)(packet + hdr->size);
+	pkt_size = sizeof(struct hfi_packet) + payload_size;
+	if (packet_size < hdr->size  + pkt_size) {
+		d_vpr_e("%s: invalid packet_size %d, %d %d\n",
+			__func__, packet_size, hdr->size, pkt_size);
+		return -EINVAL;
+	}
+	memset(pkt, 0, pkt_size);
+	pkt->size = pkt_size;
+	pkt->type = pkt_type;
+	pkt->flags = pkt_flags;
+	pkt->payload_info = payload_type;
+	pkt->port = port;
+	pkt->packet_id = packet_id;
+	if (payload_size)
+		memcpy((u8 *)pkt + sizeof(struct hfi_packet),
+		       payload, payload_size);
+
+	hdr->num_packets++;
+	hdr->size += pkt->size;
+	return 0;
+}
+
+int hfi_packet_sys_init(struct msm_vidc_core *core,
+			u8 *pkt, u32 pkt_size)
+{
+	int rc = 0;
+	u32 payload = 0;
+	u32 synx_client_data[2];
+
+	rc = hfi_create_header(pkt, pkt_size,
+			       0 /*session_id*/,
+			       core->header_id++);
+	if (rc)
+		goto err_sys_init;
+
+	/* HFI_CMD_SYSTEM_INIT */
+	payload = HFI_VIDEO_ARCH_LX;
+	d_vpr_h("%s: arch %d\n", __func__, payload);
+	core->sys_init_id = core->packet_id++;
+	rc = hfi_create_packet(pkt, pkt_size,
+			       HFI_CMD_INIT,
+			       (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+			       HFI_HOST_FLAGS_INTR_REQUIRED |
+			       HFI_HOST_FLAGS_NON_DISCARDABLE),
+			       HFI_PAYLOAD_U32,
+			       HFI_PORT_NONE,
+			       core->sys_init_id,
+			       &payload,
+			       sizeof(u32));
+	if (rc)
+		goto err_sys_init;
+
+	/* HFI_PROP_UBWC_MAX_CHANNELS */
+	payload = core->platform->data.ubwc_config->max_channels;
+	d_vpr_h("%s: ubwc max channels %d\n", __func__, payload);
+	rc = hfi_create_packet(pkt, pkt_size,
+			       HFI_PROP_UBWC_MAX_CHANNELS,
+			       HFI_HOST_FLAGS_NONE,
+			       HFI_PAYLOAD_U32,
+			       HFI_PORT_NONE,
+			       core->packet_id++,
+			       &payload,
+			       sizeof(u32));
+	if (rc)
+		goto err_sys_init;
+
+	/* HFI_PROP_UBWC_MAL_LENGTH */
+	payload = core->platform->data.ubwc_config->mal_length;
+	d_vpr_h("%s: ubwc mal length %d\n", __func__, payload);
+	rc = hfi_create_packet(pkt, pkt_size,
+			       HFI_PROP_UBWC_MAL_LENGTH,
+			       HFI_HOST_FLAGS_NONE,
+			       HFI_PAYLOAD_U32,
+			       HFI_PORT_NONE,
+			       core->packet_id++,
+			       &payload,
+			       sizeof(u32));
+	if (rc)
+		goto err_sys_init;
+
+	/* HFI_PROP_UBWC_HBB */
+	payload = core->platform->data.ubwc_config->highest_bank_bit;
+	d_vpr_h("%s: ubwc hbb %d\n", __func__, payload);
+	rc = hfi_create_packet(pkt, pkt_size,
+			       HFI_PROP_UBWC_HBB,
+			       HFI_HOST_FLAGS_NONE,
+			       HFI_PAYLOAD_U32,
+			       HFI_PORT_NONE,
+			       core->packet_id++,
+			       &payload,
+			       sizeof(u32));
+	if (rc)
+		goto err_sys_init;
+
+	/* HFI_PROP_UBWC_BANK_SWZL_LEVEL1 */
+	payload = core->platform->data.ubwc_config->bank_swzl_level;
+	d_vpr_h("%s: ubwc swzl1 %d\n", __func__, payload);
+	rc = hfi_create_packet(pkt, pkt_size,
+				   HFI_PROP_UBWC_BANK_SWZL_LEVEL1,
+				   HFI_HOST_FLAGS_NONE,
+				   HFI_PAYLOAD_U32,
+				   HFI_PORT_NONE,
+				   core->packet_id++,
+				   &payload,
+				   sizeof(u32));
+	if (rc)
+		goto err_sys_init;
+
+	/* HFI_PROP_UBWC_BANK_SWZL_LEVEL2 */
+	payload = core->platform->data.ubwc_config->bank_swz2_level;
+	d_vpr_h("%s: ubwc swzl2 %d\n", __func__, payload);
+	rc = hfi_create_packet(pkt, pkt_size,
+			       HFI_PROP_UBWC_BANK_SWZL_LEVEL2,
+			       HFI_HOST_FLAGS_NONE,
+			       HFI_PAYLOAD_U32,
+			       HFI_PORT_NONE,
+			       core->packet_id++,
+			       &payload,
+			       sizeof(u32));
+	if (rc)
+		goto err_sys_init;
+
+	/* HFI_PROP_UBWC_BANK_SWZL_LEVEL3 */
+	payload = core->platform->data.ubwc_config->bank_swz3_level;
+	d_vpr_h("%s: ubwc swzl3 %d\n", __func__, payload);
+	rc = hfi_create_packet(pkt, pkt_size,
+			       HFI_PROP_UBWC_BANK_SWZL_LEVEL3,
+			       HFI_HOST_FLAGS_NONE,
+			       HFI_PAYLOAD_U32,
+			       HFI_PORT_NONE,
+			       core->packet_id++,
+			       &payload,
+			       sizeof(u32));
+	if (rc)
+		goto err_sys_init;
+
+	/* HFI_PROP_UBWC_BANK_SPREADING */
+	payload = core->platform->data.ubwc_config->bank_spreading;
+	d_vpr_h("%s: ubwc bank spreading %d\n", __func__, payload);
+	rc = hfi_create_packet(pkt, pkt_size,
+			       HFI_PROP_UBWC_BANK_SPREADING,
+			       HFI_HOST_FLAGS_NONE,
+			       HFI_PAYLOAD_U32,
+			       HFI_PORT_NONE,
+			       core->packet_id++,
+			       &payload,
+			       sizeof(u32));
+	if (rc)
+		goto err_sys_init;
+
+	/* HFI_PROP_FENCE_CLIENT_DATA */
+	if (core->capabilities[SUPPORTS_SYNX_FENCE].value) {
+		synx_client_data[0] = core->synx_fence_data.client_id;
+		synx_client_data[1] = core->synx_fence_data.client_flags;
+		d_vpr_h("%s: synx fence client id: %u client flags: %u\n",
+			__func__, synx_client_data[0], synx_client_data[1]);
+		rc = hfi_create_packet(pkt, pkt_size,
+					HFI_PROP_FENCE_CLIENT_DATA,
+					HFI_HOST_FLAGS_NONE,
+					HFI_PAYLOAD_U32_ARRAY,
+					HFI_PORT_NONE,
+					core->packet_id++,
+					synx_client_data,
+					sizeof(u32) * 2);
+		if (rc)
+			goto err_sys_init;
+	}
+
+	d_vpr_h("System init packet created\n");
+	return rc;
+
+err_sys_init:
+	d_vpr_e("%s: create packet failed\n", __func__);
+	return rc;
+}
+
+int hfi_packet_image_version(struct msm_vidc_core *core,
+			      u8 *pkt, u32 pkt_size)
+{
+	int rc = 0;
+
+	rc = hfi_create_header(pkt, pkt_size,
+			       0 /*session_id*/,
+			       core->header_id++);
+	if (rc)
+		goto err_img_version;
+
+	/* HFI_PROP_IMAGE_VERSION */
+	rc = hfi_create_packet(pkt, pkt_size,
+				   HFI_PROP_IMAGE_VERSION,
+				   (HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				   HFI_HOST_FLAGS_INTR_REQUIRED |
+				   HFI_HOST_FLAGS_GET_PROPERTY),
+				   HFI_PAYLOAD_NONE,
+				   HFI_PORT_NONE,
+				   core->packet_id++,
+				   NULL, 0);
+	if (rc)
+		goto err_img_version;
+
+	d_vpr_h("Image version packet created\n");
+	return rc;
+
+err_img_version:
+	d_vpr_e("%s: create packet failed\n", __func__);
+	return rc;
+}
+
+int hfi_packet_sys_pc_prep(struct msm_vidc_core *core,
+			    u8 *pkt, u32 pkt_size)
+{
+	int rc = 0;
+
+	rc = hfi_create_header(pkt, pkt_size,
+			       0 /*session_id*/,
+			       core->header_id++);
+	if (rc)
+		goto err_sys_pc;
+
+	/* HFI_CMD_POWER_COLLAPSE */
+	rc = hfi_create_packet(pkt, pkt_size,
+				   HFI_CMD_POWER_COLLAPSE,
+				   HFI_HOST_FLAGS_NONE,
+				   HFI_PAYLOAD_NONE,
+				   HFI_PORT_NONE,
+				   core->packet_id++,
+				   NULL, 0);
+	if (rc)
+		goto err_sys_pc;
+
+	d_vpr_h("Power collapse packet created\n");
+	return rc;
+
+err_sys_pc:
+	d_vpr_e("%s: create packet failed\n", __func__);
+	return rc;
+}
+
+int hfi_packet_sys_debug_config(struct msm_vidc_core *core,
+				 u8 *pkt, u32 pkt_size, u32 debug_config)
+{
+	int rc = 0;
+	u32 payload = 0;
+
+	rc = hfi_create_header(pkt, pkt_size,
+			       0 /*session_id*/,
+			       core->header_id++);
+	if (rc)
+		goto err_debug;
+
+	/* HFI_PROP_DEBUG_CONFIG */
+	payload = 0; /*TODO:Change later*/
+	rc = hfi_create_packet(pkt, pkt_size,
+			       HFI_PROP_DEBUG_CONFIG,
+			       HFI_HOST_FLAGS_NONE,
+			       HFI_PAYLOAD_U32_ENUM,
+			       HFI_PORT_NONE,
+			       core->packet_id++,
+			       &payload,
+			       sizeof(u32));
+	if (rc)
+		goto err_debug;
+
+	/* HFI_PROP_DEBUG_LOG_LEVEL */
+	payload = debug_config; /*TODO:Change later*/
+	rc = hfi_create_packet(pkt, pkt_size,
+			       HFI_PROP_DEBUG_LOG_LEVEL,
+			       HFI_HOST_FLAGS_NONE,
+			       HFI_PAYLOAD_U32_ENUM,
+			       HFI_PORT_NONE,
+			       core->packet_id++,
+			       &payload,
+			       sizeof(u32));
+	if (rc)
+		goto err_debug;
+
+err_debug:
+	if (rc)
+		d_vpr_e("%s: create packet failed\n", __func__);
+
+	return rc;
+}
+
+int hfi_packet_session_command(struct msm_vidc_inst *inst,
+				u32 pkt_type, u32 flags, u32 port, u32 session_id,
+				u32 payload_type, void *payload, u32 payload_size)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+				   session_id,
+				   core->header_id++);
+	if (rc)
+		goto err_cmd;
+
+	rc = hfi_create_packet(inst->packet,
+				inst->packet_size,
+				pkt_type,
+				flags,
+				payload_type,
+				port,
+				core->packet_id++,
+				payload,
+				payload_size);
+	if (rc)
+		goto err_cmd;
+
+	i_vpr_h(inst, "Command packet 0x%x created\n", pkt_type);
+	return rc;
+
+err_cmd:
+	i_vpr_e(inst, "%s: create packet failed\n", __func__);
+	return rc;
+}
+
+int hfi_packet_sys_intraframe_powercollapse(struct msm_vidc_core *core,
+	u8 *pkt, u32 pkt_size, u32 enable)
+{
+	int rc = 0;
+	u32 payload = 0;
+
+	rc = hfi_create_header(pkt, pkt_size,
+		0 /*session_id*/,
+		core->header_id++);
+	if (rc)
+		goto err;
+
+	/* HFI_PROP_INTRA_FRAME_POWER_COLLAPSE */
+	payload = enable;
+	d_vpr_h("%s: intra frame power collapse %d\n", __func__, payload);
+	rc = hfi_create_packet(pkt, pkt_size,
+		HFI_PROP_INTRA_FRAME_POWER_COLLAPSE,
+		HFI_HOST_FLAGS_NONE,
+		HFI_PAYLOAD_U32,
+		HFI_PORT_NONE,
+		core->packet_id++,
+		&payload,
+		sizeof(u32));
+	if (rc)
+		goto err;
+
+	d_vpr_h("IFPC packet created\n");
+	return rc;
+
+err:
+	d_vpr_e("%s: create packet failed\n", __func__);
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vdec.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vdec.c
@@ -0,0 +1,2677 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_media_info.h"
+#include <linux/v4l2-common.h>
+
+#include "msm_vdec.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_power.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_memory.h"
+#include "venus_hfi.h"
+#include "hfi_packet.h"
+
+/* TODO: update based on clips */
+#define MAX_DEC_BATCH_SIZE 6
+#define SKIP_BATCH_WINDOW 100
+
+static const u32 msm_vdec_internal_buffer_type[] = {
+	MSM_VIDC_BUF_BIN,
+	MSM_VIDC_BUF_COMV,
+	MSM_VIDC_BUF_NON_COMV,
+	MSM_VIDC_BUF_LINE,
+	MSM_VIDC_BUF_PARTIAL_DATA,
+};
+
+static const u32 msm_vdec_output_internal_buffer_type[] = {
+	MSM_VIDC_BUF_DPB,
+};
+
+struct msm_vdec_prop_type_handle {
+	u32 type;
+	int (*handle)(struct msm_vidc_inst *inst, enum msm_vidc_port_type port);
+};
+
+static int msm_vdec_codec_change(struct msm_vidc_inst *inst, u32 v4l2_codec)
+{
+	int rc = 0;
+	bool session_init = false;
+
+	if (!inst->codec)
+		session_init = true;
+
+	if (inst->codec && inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat == v4l2_codec)
+		return 0;
+
+	i_vpr_h(inst, "%s: codec changed from %s to %s\n",
+		__func__, v4l2_pixelfmt_name(inst, inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat),
+		v4l2_pixelfmt_name(inst, v4l2_codec));
+
+	inst->codec = v4l2_codec_to_driver(inst, v4l2_codec, __func__);
+	if (!inst->codec) {
+		i_vpr_e(inst, "%s: invalid codec %#x\n", __func__, v4l2_codec);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat = v4l2_codec;
+	rc = msm_vidc_update_debug_str(inst);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_get_inst_capability(inst);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_ctrl_handler_init(inst, session_init);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_update_buffer_count(inst, INPUT_PORT);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_update_buffer_count(inst, OUTPUT_PORT);
+	if (rc)
+		goto exit;
+
+exit:
+	return rc;
+}
+
+static int msm_vdec_set_bitstream_resolution(struct msm_vidc_inst *inst,
+					      enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 resolution;
+
+	resolution = inst->fmts[INPUT_PORT].fmt.pix_mp.width << 16 |
+		inst->fmts[INPUT_PORT].fmt.pix_mp.height;
+	i_vpr_h(inst, "%s: width: %d height: %d\n", __func__,
+		inst->fmts[INPUT_PORT].fmt.pix_mp.width,
+		inst->fmts[INPUT_PORT].fmt.pix_mp.height);
+	inst->subcr_params[port].bitstream_resolution = resolution;
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_BITSTREAM_RESOLUTION,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					HFI_PAYLOAD_U32,
+					&resolution,
+					sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_linear_stride_scanline(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 stride_y, scanline_y, stride_uv, scanline_uv;
+	u32 payload[2];
+	enum msm_vidc_colorformat_type colorformat;
+
+	colorformat = v4l2_colorformat_to_driver(inst,
+						 inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat,
+						 __func__);
+
+	if (!is_linear_yuv_colorformat(colorformat))
+		return 0;
+
+	stride_y = inst->fmts[OUTPUT_PORT].fmt.pix_mp.width;
+	scanline_y = inst->fmts[OUTPUT_PORT].fmt.pix_mp.height;
+	stride_uv = stride_y;
+	scanline_uv = scanline_y / 2;
+
+	payload[0] = stride_y << 16 | scanline_y;
+	payload[1] = stride_uv << 16 | scanline_uv;
+	i_vpr_h(inst, "%s: stride_y: %d scanline_y: %d "
+		"stride_uv: %d, scanline_uv: %d", __func__,
+		stride_y, scanline_y, stride_uv, scanline_uv);
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_LINEAR_STRIDE_SCANLINE,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, OUTPUT_PORT),
+					HFI_PAYLOAD_U64,
+					&payload,
+					sizeof(u64));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_ubwc_stride_scanline(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 stride_y, scanline_y, stride_uv, scanline_uv;
+	u32 meta_stride_y, meta_scanline_y, meta_stride_uv, meta_scanline_uv;
+	u32 payload[4];
+	struct v4l2_format *f;
+	u32 pix_fmt, width, height, colorformat;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	pix_fmt = f->fmt.pix_mp.pixelformat;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	colorformat = v4l2_colorformat_to_driver(inst, pix_fmt, __func__);
+
+	if (inst->codec != MSM_VIDC_AV1 ||
+		(!is_ubwc_colorformat(colorformat)))
+		return 0;
+
+	stride_y = video_y_stride_bytes(colorformat, width);
+	scanline_y = video_y_scanlines(colorformat, height);
+	stride_uv = video_uv_stride_bytes(colorformat, width);
+	scanline_uv = video_uv_scanlines(colorformat, height);
+
+	meta_stride_y = video_y_meta_stride(colorformat, width);
+	meta_scanline_y = video_y_meta_scanlines(colorformat, height);
+	meta_stride_uv = video_uv_meta_stride(colorformat, width);
+	meta_scanline_uv = video_uv_meta_scanlines(colorformat, height);
+
+	payload[0] = stride_y << 16 | scanline_y;
+	payload[1] = stride_uv << 16 | scanline_uv;
+	payload[2] = meta_stride_y << 16 | meta_scanline_y;
+	payload[3] = meta_stride_uv << 16 | meta_scanline_uv;
+
+	i_vpr_h(inst, "%s: stride_y: %d scanline_y: %d "
+		"stride_uv: %d scanline_uv: %d "
+		"meta_stride_y: %d meta_scanline_y: %d "
+		"meta_stride_uv: %d, meta_scanline_uv: %d",
+		__func__,
+		stride_y, scanline_y, stride_uv, scanline_uv,
+		meta_stride_y, meta_scanline_y,
+		meta_stride_uv, meta_scanline_uv);
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_UBWC_STRIDE_SCANLINE,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, OUTPUT_PORT),
+					HFI_PAYLOAD_U32_ARRAY,
+					&payload[0],
+					sizeof(u32) * 4);
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_crop_offsets(struct msm_vidc_inst *inst,
+				      enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 left_offset, top_offset, right_offset, bottom_offset;
+	u32 payload[2] = {0};
+
+	left_offset = inst->crop.left;
+	top_offset = inst->crop.top;
+	right_offset = (inst->fmts[INPUT_PORT].fmt.pix_mp.width -
+		inst->crop.width);
+	bottom_offset = (inst->fmts[INPUT_PORT].fmt.pix_mp.height -
+		inst->crop.height);
+
+	payload[0] = left_offset << 16 | top_offset;
+	payload[1] = right_offset << 16 | bottom_offset;
+	i_vpr_h(inst, "%s: left_offset: %d top_offset: %d "
+		"right_offset: %d bottom_offset: %d", __func__,
+		left_offset, top_offset, right_offset, bottom_offset);
+	inst->subcr_params[port].crop_offsets[0] = payload[0];
+	inst->subcr_params[port].crop_offsets[1] = payload[1];
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_CROP_OFFSETS,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					HFI_PAYLOAD_64_PACKED,
+					&payload,
+					sizeof(u64));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_bit_depth(struct msm_vidc_inst *inst,
+				   enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 pix_fmt;
+	u32 bitdepth = 8 << 16 | 8;
+	enum msm_vidc_colorformat_type colorformat;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	pix_fmt = inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat;
+	colorformat = v4l2_colorformat_to_driver(inst, pix_fmt, __func__);
+	if (is_10bit_colorformat(colorformat))
+		bitdepth = 10 << 16 | 10;
+
+	inst->subcr_params[port].bit_depth = bitdepth;
+	msm_vidc_update_cap_value(inst, BIT_DEPTH, bitdepth, __func__);
+	i_vpr_h(inst, "%s: bit depth: %#x", __func__, bitdepth);
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_LUMA_CHROMA_BIT_DEPTH,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					HFI_PAYLOAD_U32,
+					&bitdepth,
+					sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+//todo: enable when needed
+/*
+static int msm_vdec_set_cabac(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 cabac = 0;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	cabac = inst->capabilities[ENTROPY_MODE].value;
+	inst->subcr_params[port].cabac = cabac;
+	i_vpr_h(inst, "%s: entropy mode: %d", __func__, cabac);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_CABAC_SESSION,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_U32,
+			&cabac,
+			sizeof(u32));
+	if (rc)
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+
+	return rc;
+}
+ */
+static int msm_vdec_set_coded_frames(struct msm_vidc_inst *inst,
+				      enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 coded_frames = 0;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	if (inst->capabilities[CODED_FRAMES].value ==
+			CODED_FRAMES_PROGRESSIVE)
+		coded_frames = HFI_BITMASK_FRAME_MBS_ONLY_FLAG;
+	inst->subcr_params[port].coded_frames = coded_frames;
+	i_vpr_h(inst, "%s: coded frames: %d", __func__, coded_frames);
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_CODED_FRAMES,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					HFI_PAYLOAD_U32,
+					&coded_frames,
+					sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_min_output_count(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 min_output;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	min_output = inst->buffers.output.min_count;
+	inst->subcr_params[port].fw_min_count = min_output;
+	i_vpr_h(inst, "%s: firmware min output count: %d",
+		__func__, min_output);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_U32,
+			&min_output,
+			sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+	return rc;
+}
+
+static int msm_vdec_set_picture_order_count(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 poc = 0;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	inst->subcr_params[port].pic_order_cnt = poc;
+	i_vpr_h(inst, "%s: picture order count: %d", __func__, poc);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_PIC_ORDER_CNT_TYPE,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_U32,
+			&poc,
+			sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_max_num_reorder_frames(struct msm_vidc_inst *inst,
+						enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 reorder_frames = 0;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	reorder_frames = inst->subcr_params[port].max_num_reorder_frames;
+	i_vpr_h(inst, "%s: max reorder frames count: %d", __func__, reorder_frames);
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_MAX_NUM_REORDER_FRAMES,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					HFI_PAYLOAD_U32,
+					&reorder_frames,
+					sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_colorspace(struct msm_vidc_inst *inst,
+				    enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 primaries = MSM_VIDC_PRIMARIES_RESERVED;
+	u32 matrix_coeff = MSM_VIDC_MATRIX_COEFF_RESERVED;
+	u32 transfer_char = MSM_VIDC_TRANSFER_RESERVED;
+	u32 full_range = V4L2_QUANTIZATION_DEFAULT;
+	u32 colour_description_present_flag = 0;
+	u32 video_signal_type_present_flag = 0, color_info = 0;
+	/* Unspecified video format */
+	u32 video_format = 5;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	if (inst->codec == MSM_VIDC_VP9)
+		return 0;
+
+	if (inst->fmts[port].fmt.pix_mp.colorspace != V4L2_COLORSPACE_DEFAULT ||
+	    inst->fmts[port].fmt.pix_mp.ycbcr_enc != V4L2_YCBCR_ENC_DEFAULT ||
+	    inst->fmts[port].fmt.pix_mp.xfer_func != V4L2_XFER_FUNC_DEFAULT) {
+		colour_description_present_flag = 1;
+		video_signal_type_present_flag = 1;
+		primaries = v4l2_color_primaries_to_driver(inst,
+			inst->fmts[port].fmt.pix_mp.colorspace, __func__);
+		matrix_coeff = v4l2_matrix_coeff_to_driver(inst,
+			inst->fmts[port].fmt.pix_mp.ycbcr_enc, __func__);
+		transfer_char = v4l2_transfer_char_to_driver(inst,
+			inst->fmts[port].fmt.pix_mp.xfer_func, __func__);
+	}
+
+	if (inst->fmts[port].fmt.pix_mp.quantization !=
+	    V4L2_QUANTIZATION_DEFAULT) {
+		video_signal_type_present_flag = 1;
+		full_range = inst->fmts[port].fmt.pix_mp.quantization ==
+			V4L2_QUANTIZATION_FULL_RANGE ? 1 : 0;
+	}
+
+	color_info = (matrix_coeff & 0xFF) |
+		((transfer_char << 8) & 0xFF00) |
+		((primaries << 16) & 0xFF0000) |
+		((colour_description_present_flag << 24) & 0x1000000) |
+		((full_range << 25) & 0x2000000) |
+		((video_format << 26) & 0x1C000000) |
+		((video_signal_type_present_flag << 29) & 0x20000000);
+
+	inst->subcr_params[port].color_info = color_info;
+	i_vpr_h(inst, "%s: color info: %#x\n", __func__, color_info);
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_SIGNAL_COLOR_INFO,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					HFI_PAYLOAD_32_PACKED,
+					&color_info,
+						sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_profile(struct msm_vidc_inst *inst,
+				 enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 profile;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	profile = inst->capabilities[PROFILE].value;
+	inst->subcr_params[port].profile = profile;
+	i_vpr_h(inst, "%s: profile: %d", __func__, profile);
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_PROFILE,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					HFI_PAYLOAD_U32_ENUM,
+					&profile,
+					sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_level(struct msm_vidc_inst *inst,
+			       enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 level;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	level = inst->capabilities[LEVEL].value;
+	inst->subcr_params[port].level = level;
+	i_vpr_h(inst, "%s: level: %d", __func__, level);
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_LEVEL,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					HFI_PAYLOAD_U32_ENUM,
+					&level,
+					sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_tier(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 tier;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	tier = inst->capabilities[HEVC_TIER].value;
+	inst->subcr_params[port].tier = tier;
+	i_vpr_h(inst, "%s: tier: %d", __func__, tier);
+	rc = venus_hfi_session_property(inst,
+					HFI_PROP_TIER,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					HFI_PAYLOAD_U32_ENUM,
+					&tier,
+					sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_av1_film_grain_present(struct msm_vidc_inst *inst,
+						enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 fg_present;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	inst->subcr_params[port].av1_film_grain_present =
+		inst->capabilities[FILM_GRAIN].value;
+	fg_present = inst->subcr_params[port].av1_film_grain_present;
+	i_vpr_h(inst, "%s: film grain present: %d", __func__, fg_present);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_AV1_FILM_GRAIN_PRESENT,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_U32_ENUM,
+			&fg_present,
+			sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_av1_superblock_enabled(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 sb_enabled;
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	inst->subcr_params[port].av1_super_block_enabled =
+		inst->capabilities[SUPER_BLOCK].value;
+	sb_enabled = inst->subcr_params[port].av1_super_block_enabled;
+	i_vpr_h(inst, "%s: super block enabled: %d", __func__, sb_enabled);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_AV1_SUPER_BLOCK_ENABLED,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_U32_ENUM,
+			&sb_enabled,
+			sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_opb_enable(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 opb_enable = 0;
+
+	if (inst->codec != MSM_VIDC_AV1)
+		return 0;
+
+	if (is_split_mode_enabled(inst))
+		opb_enable = 1;
+
+	i_vpr_h(inst, "%s: OPB enable: %d",  __func__, opb_enable);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_OPB_ENABLE,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, OUTPUT_PORT),
+			HFI_PAYLOAD_U32,
+			&opb_enable,
+			sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_colorformat(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 pixelformat;
+	enum msm_vidc_colorformat_type colorformat;
+	u32 hfi_colorformat;
+
+	pixelformat = inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat;
+	colorformat = v4l2_colorformat_to_driver(inst, pixelformat, __func__);
+	hfi_colorformat = get_hfi_colorformat(inst, colorformat);
+	i_vpr_h(inst, "%s: hfi colorformat: %d",
+		__func__, hfi_colorformat);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_COLOR_FORMAT,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, OUTPUT_PORT),
+			HFI_PAYLOAD_U32,
+			&hfi_colorformat,
+			sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_set_output_properties(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = msm_vdec_set_opb_enable(inst);
+	if (rc)
+		return rc;
+
+	rc = msm_vdec_set_colorformat(inst);
+	if (rc)
+		return rc;
+
+	rc = msm_vdec_set_linear_stride_scanline(inst);
+	if (rc)
+		return rc;
+
+	rc = msm_vdec_set_ubwc_stride_scanline(inst);
+	if (rc)
+		return rc;
+
+	rc = msm_vidc_set_session_priority(inst, PRIORITY);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static bool msm_vdec_check_outbuf_fence_allowed(struct msm_vidc_inst *inst)
+{
+	u32 reorder_count = inst->capabilities[MAX_NUM_REORDER_FRAMES].value >> 16;
+
+	/* no need of checking for reordering/interlace for vp9/av1 */
+	if (inst->codec == MSM_VIDC_VP9 || inst->codec == MSM_VIDC_AV1)
+		return true;
+
+	if (inst->capabilities[CODED_FRAMES].value == CODED_FRAMES_INTERLACE ||
+		(!inst->capabilities[OUTPUT_ORDER].value && reorder_count)) {
+		i_vpr_e(inst,
+			"%s: outbuf tx fence is unsupported for coded frames %d or output order %d and reorder frames %d\n",
+			__func__, inst->capabilities[CODED_FRAMES].value,
+			inst->capabilities[OUTPUT_ORDER].value,
+			(inst->capabilities[MAX_NUM_REORDER_FRAMES].value >> 16));
+		return false;
+	}
+
+	return true;
+}
+
+int msm_vdec_get_input_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 i = 0;
+
+	for (i = 0; i < ARRAY_SIZE(msm_vdec_internal_buffer_type); i++) {
+		rc = msm_vidc_get_internal_buffers(inst, msm_vdec_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_get_output_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = msm_vidc_get_internal_buffers(inst, MSM_VIDC_BUF_DPB);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_vdec_destroy_internal_buffers(struct msm_vidc_inst *inst,
+		enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf, *dummy;
+	const u32 *internal_buf_type;
+	u32 i, len;
+
+	if (port == INPUT_PORT) {
+		internal_buf_type = msm_vdec_internal_buffer_type;
+		len = ARRAY_SIZE(msm_vdec_internal_buffer_type);
+	} else {
+		internal_buf_type = msm_vdec_output_internal_buffer_type;
+		len = ARRAY_SIZE(msm_vdec_output_internal_buffer_type);
+	}
+
+	for (i = 0; i < len; i++) {
+		buffers = msm_vidc_get_buffers(inst, internal_buf_type[i], __func__);
+		if (!buffers)
+			return -EINVAL;
+
+		if (buffers->reuse) {
+			i_vpr_l(inst, "%s: reuse enabled for %s\n", __func__,
+				buf_name(internal_buf_type[i]));
+			continue;
+		}
+
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+			/*
+			 * do not destroy internal buffer (DPB buffer) if firmware
+			 * did not return it, so skip if QUEUED flag is present
+			 */
+			if (buf->attr & MSM_VIDC_ATTR_QUEUED)
+				continue;
+
+			i_vpr_h(inst,
+				"%s: destroying internal buffer: type %d idx %d fd %d addr %#llx size %d\n",
+				__func__, buf->type, buf->index, buf->fd,
+				buf->device_addr, buf->buffer_size);
+
+			rc = msm_vidc_destroy_internal_buffer(inst, buf);
+			if (rc)
+				return rc;
+		}
+	}
+
+	return 0;
+}
+
+int msm_vdec_create_input_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 i = 0;
+
+	for (i = 0; i < ARRAY_SIZE(msm_vdec_internal_buffer_type); i++) {
+		rc = msm_vidc_create_internal_buffers(inst, msm_vdec_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int msm_vdec_create_output_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = msm_vidc_create_internal_buffers(inst, MSM_VIDC_BUF_DPB);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+int msm_vdec_queue_input_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 i = 0;
+
+	for (i = 0; i < ARRAY_SIZE(msm_vdec_internal_buffer_type); i++) {
+		rc = msm_vidc_queue_internal_buffers(inst, msm_vdec_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int msm_vdec_queue_output_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = msm_vidc_queue_internal_buffers(inst, MSM_VIDC_BUF_DPB);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+int msm_vdec_release_input_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 i = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	for (i = 0; i < ARRAY_SIZE(msm_vdec_internal_buffer_type); i++) {
+		rc = msm_vidc_release_internal_buffers(inst, msm_vdec_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int msm_vdec_subscribe_input_port_settings_change(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	u32 payload[32] = {0};
+	u32 i, j;
+	u32 subscribe_psc_size;
+	const u32 *psc;
+	static const struct msm_vdec_prop_type_handle prop_type_handle_arr[] = {
+		{HFI_PROP_BITSTREAM_RESOLUTION,          msm_vdec_set_bitstream_resolution   },
+		{HFI_PROP_CROP_OFFSETS,                  msm_vdec_set_crop_offsets           },
+		{HFI_PROP_LUMA_CHROMA_BIT_DEPTH,         msm_vdec_set_bit_depth              },
+		{HFI_PROP_CODED_FRAMES,                  msm_vdec_set_coded_frames           },
+		{HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT,    msm_vdec_set_min_output_count       },
+		{HFI_PROP_PIC_ORDER_CNT_TYPE,            msm_vdec_set_picture_order_count    },
+		{HFI_PROP_MAX_NUM_REORDER_FRAMES,        msm_vdec_set_max_num_reorder_frames },
+		{HFI_PROP_SIGNAL_COLOR_INFO,             msm_vdec_set_colorspace             },
+		{HFI_PROP_PROFILE,                       msm_vdec_set_profile                },
+		{HFI_PROP_LEVEL,                         msm_vdec_set_level                  },
+		{HFI_PROP_TIER,                          msm_vdec_set_tier                   },
+		{HFI_PROP_AV1_FILM_GRAIN_PRESENT,        msm_vdec_set_av1_film_grain_present },
+		{HFI_PROP_AV1_SUPER_BLOCK_ENABLED,       msm_vdec_set_av1_superblock_enabled },
+	};
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	core = inst->core;
+	payload[0] = HFI_MODE_PORT_SETTINGS_CHANGE;
+	if (inst->codec == MSM_VIDC_H264) {
+		subscribe_psc_size = core->platform->data.psc_avc_tbl_size;
+		psc = core->platform->data.psc_avc_tbl;
+	} else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC) {
+		subscribe_psc_size = core->platform->data.psc_hevc_tbl_size;
+		psc = core->platform->data.psc_hevc_tbl;
+	} else if (inst->codec == MSM_VIDC_VP9) {
+		subscribe_psc_size = core->platform->data.psc_vp9_tbl_size;
+		psc = core->platform->data.psc_vp9_tbl;
+	} else if (inst->codec == MSM_VIDC_AV1) {
+		subscribe_psc_size = core->platform->data.psc_av1_tbl_size;
+		psc = core->platform->data.psc_av1_tbl;
+	} else {
+		i_vpr_e(inst, "%s: unsupported codec: %d\n", __func__, inst->codec);
+		psc = NULL;
+		return -EINVAL;
+	}
+
+	if (!psc || !subscribe_psc_size) {
+		i_vpr_e(inst, "%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	payload[0] = HFI_MODE_PORT_SETTINGS_CHANGE;
+	for (i = 0; i < subscribe_psc_size; i++)
+		payload[i + 1] = psc[i];
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_SUBSCRIBE_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			((subscribe_psc_size + 1) *
+			sizeof(u32)));
+
+	for (i = 0; i < subscribe_psc_size; i++) {
+		/* set session properties */
+		for (j = 0; j < ARRAY_SIZE(prop_type_handle_arr); j++) {
+			if (prop_type_handle_arr[j].type == psc[i]) {
+				rc = prop_type_handle_arr[j].handle(inst, port);
+				if (rc)
+					goto exit;
+				break;
+			}
+		}
+
+		/* is property type unknown ? */
+		if (j == ARRAY_SIZE(prop_type_handle_arr))
+			i_vpr_e(inst, "%s: unknown property %#x\n", __func__, psc[i]);
+	}
+
+exit:
+	return rc;
+}
+
+static int msm_vdec_subscribe_property(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 payload[32] = {0};
+	u32 i, count = 0;
+	bool allow = false;
+	struct msm_vidc_core *core;
+	u32 subscribe_prop_size;
+	const u32 *subcribe_prop;
+
+	core = inst->core;
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	payload[0] = HFI_MODE_PROPERTY;
+
+	if (port == INPUT_PORT) {
+		if (inst->codec == MSM_VIDC_H264) {
+			subscribe_prop_size = core->platform->data.dec_input_prop_size_avc;
+			subcribe_prop = core->platform->data.dec_input_prop_avc;
+		} else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC) {
+			subscribe_prop_size = core->platform->data.dec_input_prop_size_hevc;
+			subcribe_prop = core->platform->data.dec_input_prop_hevc;
+		} else if (inst->codec == MSM_VIDC_VP9) {
+			subscribe_prop_size = core->platform->data.dec_input_prop_size_vp9;
+			subcribe_prop = core->platform->data.dec_input_prop_vp9;
+		} else if (inst->codec == MSM_VIDC_AV1) {
+			subscribe_prop_size = core->platform->data.dec_input_prop_size_av1;
+			subcribe_prop = core->platform->data.dec_input_prop_av1;
+		} else {
+			i_vpr_e(inst, "%s: unsupported codec: %d\n", __func__, inst->codec);
+			subcribe_prop = NULL;
+			return -EINVAL;
+		}
+
+		for (i = 0; i < subscribe_prop_size; i++) {
+			allow = msm_vidc_allow_property(inst,
+				subcribe_prop[i]);
+			if (allow) {
+				payload[count + 1] = subcribe_prop[i];
+				count++;
+			}
+
+			if (subcribe_prop[i] == HFI_PROP_DPB_LIST) {
+				inst->input_dpb_list_enabled = true;
+				i_vpr_h(inst, "%s: DPB_LIST suscribed on input port", __func__);
+			}
+		}
+	} else if (port == OUTPUT_PORT) {
+		if (inst->codec == MSM_VIDC_H264) {
+			subscribe_prop_size = core->platform->data.dec_output_prop_size_avc;
+			subcribe_prop = core->platform->data.dec_output_prop_avc;
+		} else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC) {
+			subscribe_prop_size = core->platform->data.dec_output_prop_size_hevc;
+			subcribe_prop = core->platform->data.dec_output_prop_hevc;
+		} else if (inst->codec == MSM_VIDC_VP9) {
+			subscribe_prop_size = core->platform->data.dec_output_prop_size_vp9;
+			subcribe_prop = core->platform->data.dec_output_prop_vp9;
+		} else if (inst->codec == MSM_VIDC_AV1) {
+			subscribe_prop_size = core->platform->data.dec_output_prop_size_av1;
+			subcribe_prop = core->platform->data.dec_output_prop_av1;
+		} else {
+			i_vpr_e(inst, "%s: unsupported codec: %d\n", __func__, inst->codec);
+			subcribe_prop = NULL;
+			return -EINVAL;
+		}
+		for (i = 0; i < subscribe_prop_size; i++) {
+			allow = msm_vidc_allow_property(inst,
+				subcribe_prop[i]);
+			if (allow) {
+				payload[count + 1] = subcribe_prop[i];
+				count++;
+			}
+
+			if (subcribe_prop[i] == HFI_PROP_DPB_LIST) {
+				inst->output_dpb_list_enabled = true;
+				i_vpr_h(inst, "%s: DPB_LIST suscribed on output port", __func__);
+			}
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid port: %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_SUBSCRIBE_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			(count + 1) * sizeof(u32));
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vdec_subscribe_metadata(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 payload[32] = {0};
+	u32 i, count = 0;
+
+	i_vpr_h(inst, "%s() port %d\n", __func__, port);
+
+	payload[0] = HFI_MODE_METADATA;
+	if (port == INPUT_PORT) {
+		for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+			if (is_meta_rx_inp_enabled(inst, i) &&
+				msm_vidc_allow_metadata_subscription(
+					inst, i, port)) {
+				if (count + 1 >= sizeof(payload) / sizeof(u32)) {
+					i_vpr_e(inst,
+						"%s: input metadatas (%u) exceeded limit (%lu)\n",
+						__func__, count, sizeof(payload) / sizeof(u32));
+					return -EINVAL;
+				}
+				payload[count + 1] = inst->capabilities[i].hfi_id;
+				count++;
+			}
+		}
+	} else if (port == OUTPUT_PORT) {
+		for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+			if (is_meta_rx_out_enabled(inst, i) &&
+				msm_vidc_allow_metadata_subscription(
+					inst, i, port)) {
+				if (count + 1 >= sizeof(payload) / sizeof(u32)) {
+					i_vpr_e(inst,
+						"%s: input metadatas (%u) exceeded limit (%lu)\n",
+						__func__, count, sizeof(payload) / sizeof(u32));
+					return -EINVAL;
+				}
+				payload[count + 1] = inst->capabilities[i].hfi_id;
+				count++;
+			}
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid port: %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_SUBSCRIBE_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			(count + 1) * sizeof(u32));
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_vdec_set_delivery_mode_metadata(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 payload[32] = {0};
+	u32 i, count = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	payload[0] = HFI_MODE_METADATA;
+
+	if (port == INPUT_PORT) {
+		for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+			if (is_meta_tx_inp_enabled(inst, i)) {
+				if (count + 1 >= sizeof(payload) / sizeof(u32)) {
+					i_vpr_e(inst,
+						"%s: input metadatas (%u) exceeded limit (%lu)\n",
+						__func__, count, sizeof(payload) / sizeof(u32));
+					return -EINVAL;
+				}
+				payload[count + 1] = inst->capabilities[i].hfi_id;
+				count++;
+			}
+		}
+	} else if (port == OUTPUT_PORT) {
+		for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+			if (is_meta_tx_out_enabled(inst, i)  &&
+				msm_vidc_allow_metadata_delivery(
+					inst, i, port)) {
+				if (count + 1 >= sizeof(payload) / sizeof(u32)) {
+					i_vpr_e(inst,
+						"%s: input metadatas (%u) exceeded limit (%lu)\n",
+						__func__, count, sizeof(payload) / sizeof(u32));
+					return -EINVAL;
+				}
+				payload[count + 1] = inst->capabilities[i].hfi_id;
+				count++;
+			}
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid port: %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_DELIVERY_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			(count + 1) * sizeof(u32));
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_vdec_set_delivery_mode_property(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 payload[32] = {0};
+	u32 i, count = 0;
+	static const u32 property_output_list[] = {
+		META_OUTBUF_FENCE,
+	};
+	static const u32 property_input_list[] = {};
+
+	i_vpr_h(inst, "%s() port %d\n", __func__, port);
+
+	payload[0] = HFI_MODE_PROPERTY;
+
+	if (port == INPUT_PORT) {
+		for (i = 0; i < ARRAY_SIZE(property_input_list); i++) {
+			if (inst->capabilities[property_input_list[i]].value) {
+				payload[count + 1] =
+					inst->capabilities[property_input_list[i]].hfi_id;
+				count++;
+			}
+		}
+	} else if (port == OUTPUT_PORT) {
+		for (i = 0; i < ARRAY_SIZE(property_output_list); i++) {
+			if (property_output_list[i] == META_OUTBUF_FENCE) {
+				if (is_meta_rx_inp_enabled(inst,
+					META_OUTBUF_FENCE)) {
+					/*
+					 * if output buffer fence enabled via
+					 * META_OUTBUF_FENCE, then driver will send
+					 * fence id via HFI_PROP_FENCE to firmware.
+					 * So enable HFI_PROP_FENCE property as
+					 * delivery mode property.
+					 */
+					payload[++count] =
+						inst->capabilities[property_output_list[i]].hfi_id;
+				}
+				continue;
+			}
+			if (inst->capabilities[property_output_list[i]].value) {
+				payload[count + 1] =
+					inst->capabilities[property_output_list[i]].hfi_id;
+				count++;
+			}
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid port: %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_DELIVERY_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			(count + 1) * sizeof(u32));
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vdec_init_input_subcr_params(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_subscription_params *subsc_params;
+	u32 left_offset, top_offset, right_offset, bottom_offset;
+	u32 primaries, matrix_coeff, transfer_char;
+	u32 full_range = 0, video_format = 0;
+	u32 colour_description_present_flag = 0;
+	u32 video_signal_type_present_flag = 0;
+
+	subsc_params = &inst->subcr_params[INPUT_PORT];
+
+	subsc_params->bitstream_resolution =
+		inst->fmts[INPUT_PORT].fmt.pix_mp.width << 16 |
+		inst->fmts[INPUT_PORT].fmt.pix_mp.height;
+
+	left_offset = inst->crop.left;
+	top_offset = inst->crop.top;
+	right_offset = (inst->fmts[INPUT_PORT].fmt.pix_mp.width -
+			inst->crop.width);
+	bottom_offset = (inst->fmts[INPUT_PORT].fmt.pix_mp.height -
+			inst->crop.height);
+	subsc_params->crop_offsets[0] =
+			left_offset << 16 | top_offset;
+	subsc_params->crop_offsets[1] =
+			right_offset << 16 | bottom_offset;
+
+	subsc_params->fw_min_count = inst->buffers.output.min_count;
+
+	primaries = v4l2_color_primaries_to_driver(inst,
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.colorspace, __func__);
+	matrix_coeff = v4l2_matrix_coeff_to_driver(inst,
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.ycbcr_enc, __func__);
+	transfer_char = v4l2_transfer_char_to_driver(inst,
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.xfer_func, __func__);
+	full_range = inst->fmts[OUTPUT_PORT].fmt.pix_mp.quantization ==
+		V4L2_QUANTIZATION_FULL_RANGE ? 1 : 0;
+	subsc_params->color_info =
+		(matrix_coeff & 0xFF) |
+		((transfer_char << 8) & 0xFF00) |
+		((primaries << 16) & 0xFF0000) |
+		((colour_description_present_flag << 24) & 0x1000000) |
+		((full_range << 25) & 0x2000000) |
+		((video_format << 26) & 0x1C000000) |
+		((video_signal_type_present_flag << 29) & 0x20000000);
+
+	subsc_params->profile = inst->capabilities[PROFILE].value;
+	subsc_params->level = inst->capabilities[LEVEL].value;
+	subsc_params->tier = inst->capabilities[HEVC_TIER].value;
+	subsc_params->pic_order_cnt = inst->capabilities[POC].value;
+	subsc_params->max_num_reorder_frames = inst->capabilities[MAX_NUM_REORDER_FRAMES].value;
+	subsc_params->bit_depth = inst->capabilities[BIT_DEPTH].value;
+	if (inst->capabilities[CODED_FRAMES].value ==
+			CODED_FRAMES_PROGRESSIVE)
+		subsc_params->coded_frames = HFI_BITMASK_FRAME_MBS_ONLY_FLAG;
+	else
+		subsc_params->coded_frames = 0;
+
+	return 0;
+}
+
+int msm_vdec_set_num_comv(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 num_comv = 0;
+
+	num_comv = inst->capabilities[NUM_COMV].value;
+	i_vpr_h(inst, "%s: num COMV: %d", __func__, num_comv);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_COMV_BUFFER_COUNT,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, INPUT_PORT),
+			HFI_PAYLOAD_U32,
+			&num_comv,
+			sizeof(u32));
+	if (rc) {
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_read_input_subcr_params(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_subscription_params subsc_params;
+	struct msm_vidc_core *core;
+	u32 width, height;
+	u32 primaries, matrix_coeff, transfer_char;
+	u32 full_range = 0;
+	u32 colour_description_present_flag = 0;
+	u32 video_signal_type_present_flag = 0;
+	enum msm_vidc_colorformat_type output_fmt;
+
+	core = inst->core;
+
+	subsc_params = inst->subcr_params[INPUT_PORT];
+	width = (subsc_params.bitstream_resolution &
+		HFI_BITMASK_BITSTREAM_WIDTH) >> 16;
+	height = subsc_params.bitstream_resolution &
+		HFI_BITMASK_BITSTREAM_HEIGHT;
+
+	inst->fmts[INPUT_PORT].fmt.pix_mp.width = width;
+	inst->fmts[INPUT_PORT].fmt.pix_mp.height = height;
+
+	output_fmt = v4l2_colorformat_to_driver(inst,
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+
+	inst->fmts[OUTPUT_PORT].fmt.pix_mp.width = video_y_stride_pix(
+		output_fmt, width);
+	inst->fmts[OUTPUT_PORT].fmt.pix_mp.height = video_y_scanlines(
+		output_fmt, height);
+	inst->fmts[OUTPUT_PORT].fmt.pix_mp.plane_fmt[0].bytesperline =
+		video_y_stride_bytes(output_fmt, width);
+	inst->fmts[OUTPUT_PORT].fmt.pix_mp.plane_fmt[0].sizeimage =
+		call_session_op(core, buffer_size, inst, MSM_VIDC_BUF_OUTPUT);
+	//inst->buffers.output.size = inst->fmts[OUTPUT_PORT].fmt.pix_mp.plane_fmt[0].sizeimage;
+
+	matrix_coeff = subsc_params.color_info & 0xFF;
+	transfer_char = (subsc_params.color_info & 0xFF00) >> 8;
+	primaries = (subsc_params.color_info & 0xFF0000) >> 16;
+	colour_description_present_flag =
+		(subsc_params.color_info & 0x1000000) >> 24;
+	full_range = (subsc_params.color_info & 0x2000000) >> 25;
+	video_signal_type_present_flag =
+		(subsc_params.color_info & 0x20000000) >> 29;
+
+	inst->fmts[OUTPUT_PORT].fmt.pix_mp.colorspace = V4L2_COLORSPACE_DEFAULT;
+	inst->fmts[OUTPUT_PORT].fmt.pix_mp.xfer_func = V4L2_XFER_FUNC_DEFAULT;
+	inst->fmts[OUTPUT_PORT].fmt.pix_mp.ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+	inst->fmts[OUTPUT_PORT].fmt.pix_mp.quantization = V4L2_QUANTIZATION_DEFAULT;
+
+	if (video_signal_type_present_flag) {
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.quantization =
+			full_range ?
+			V4L2_QUANTIZATION_FULL_RANGE :
+			V4L2_QUANTIZATION_LIM_RANGE;
+		if (colour_description_present_flag) {
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.colorspace =
+				v4l2_color_primaries_from_driver(inst, primaries, __func__);
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.xfer_func =
+				v4l2_transfer_char_from_driver(inst, transfer_char, __func__);
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.ycbcr_enc =
+				v4l2_matrix_coeff_from_driver(inst, matrix_coeff, __func__);
+		} else {
+			i_vpr_h(inst,
+				"%s: color description flag is not present\n",
+				__func__);
+		}
+	} else {
+		i_vpr_h(inst, "%s: video_signal type is not present\n",
+			__func__);
+	}
+
+	/* align input port color info with output port */
+	inst->fmts[INPUT_PORT].fmt.pix_mp.colorspace =
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.colorspace;
+	inst->fmts[INPUT_PORT].fmt.pix_mp.xfer_func =
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.xfer_func;
+	inst->fmts[INPUT_PORT].fmt.pix_mp.ycbcr_enc =
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.ycbcr_enc;
+	inst->fmts[INPUT_PORT].fmt.pix_mp.quantization =
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.quantization;
+
+	inst->crop.top = subsc_params.crop_offsets[0] & 0xFFFF;
+	inst->crop.left = (subsc_params.crop_offsets[0] >> 16) & 0xFFFF;
+	inst->crop.height = inst->fmts[INPUT_PORT].fmt.pix_mp.height -
+		(subsc_params.crop_offsets[1] & 0xFFFF) - inst->crop.top;
+	inst->crop.width = inst->fmts[INPUT_PORT].fmt.pix_mp.width -
+		((subsc_params.crop_offsets[1] >> 16) & 0xFFFF) - inst->crop.left;
+
+	msm_vidc_update_cap_value(inst, PROFILE, subsc_params.profile, __func__);
+	msm_vidc_update_cap_value(inst, LEVEL, subsc_params.level, __func__);
+	msm_vidc_update_cap_value(inst, HEVC_TIER, subsc_params.tier, __func__);
+	msm_vidc_update_cap_value(inst, POC, subsc_params.pic_order_cnt, __func__);
+	msm_vidc_update_cap_value(inst, MAX_NUM_REORDER_FRAMES,
+		subsc_params.max_num_reorder_frames, __func__);
+	if (subsc_params.bit_depth == BIT_DEPTH_8)
+		msm_vidc_update_cap_value(inst, BIT_DEPTH, BIT_DEPTH_8, __func__);
+	else
+		msm_vidc_update_cap_value(inst, BIT_DEPTH, BIT_DEPTH_10, __func__);
+	if (subsc_params.coded_frames & HFI_BITMASK_FRAME_MBS_ONLY_FLAG)
+		msm_vidc_update_cap_value(inst, CODED_FRAMES, CODED_FRAMES_PROGRESSIVE, __func__);
+	else
+		msm_vidc_update_cap_value(inst, CODED_FRAMES, CODED_FRAMES_INTERLACE, __func__);
+	if (inst->codec == MSM_VIDC_AV1) {
+		msm_vidc_update_cap_value(inst, FILM_GRAIN,
+			subsc_params.av1_film_grain_present, __func__);
+		msm_vidc_update_cap_value(inst, SUPER_BLOCK,
+			subsc_params.av1_super_block_enabled, __func__);
+	}
+
+	inst->fw_min_count = subsc_params.fw_min_count;
+	inst->buffers.output.min_count = call_session_op(core,
+		min_count, inst, MSM_VIDC_BUF_OUTPUT);
+	inst->buffers.output.extra_count = call_session_op(core,
+		extra_count, inst, MSM_VIDC_BUF_OUTPUT);
+	inst->buffers.output_meta.min_count = inst->buffers.output.min_count;
+	inst->buffers.output_meta.extra_count = inst->buffers.output.extra_count;
+	if (is_thumbnail_session(inst) && inst->codec != MSM_VIDC_VP9) {
+		if (inst->buffers.output.min_count != 1) {
+			i_vpr_e(inst, "%s: invalid min count %d in thumbnail case\n",
+				__func__, inst->buffers.output.min_count);
+			msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		}
+	}
+
+	return 0;
+}
+
+int msm_vdec_input_port_settings_change(struct msm_vidc_inst *inst)
+{
+	u32 rc = 0;
+	struct v4l2_event event = {0};
+
+	if (!inst->bufq[INPUT_PORT].vb2q->streaming) {
+		i_vpr_e(inst, "%s: input port not streaming\n",
+			__func__);
+		return 0;
+	}
+
+	rc = msm_vdec_read_input_subcr_params(inst);
+	if (rc)
+		return rc;
+
+	event.type = V4L2_EVENT_SOURCE_CHANGE;
+	event.u.src_change.changes = V4L2_EVENT_SRC_CH_RESOLUTION;
+	v4l2_event_queue_fh(&inst->fh, &event);
+
+	return rc;
+}
+
+int msm_vdec_output_port_settings_change(struct msm_vidc_inst *inst)
+{
+	return 0;
+}
+
+int msm_vdec_streamoff_input(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = msm_vidc_session_streamoff(inst, INPUT_PORT);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+int msm_vdec_streamon_input(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	if (is_input_meta_enabled(inst) &&
+		!inst->bufq[INPUT_META_PORT].vb2q->streaming) {
+		i_vpr_e(inst,
+			"%s: Meta port must be streamed on before data port\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	rc = msm_vidc_check_session_supported(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vidc_set_v4l2_properties(inst);
+	if (rc)
+		goto error;
+
+	/* Decide bse vpp delay after work mode */
+	//msm_vidc_set_bse_vpp_delay(inst);
+
+	rc = msm_vdec_get_input_internal_buffers(inst);
+	if (rc)
+		goto error;
+	/* check for memory after all buffers calculation */
+	//rc = msm_vidc_check_memory_supported(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_destroy_internal_buffers(inst, INPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_create_input_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_queue_input_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	if (!inst->ipsc_properties_set) {
+		rc = msm_vdec_subscribe_input_port_settings_change(
+			inst, INPUT_PORT);
+		if (rc)
+			goto error;
+		inst->ipsc_properties_set = true;
+	}
+
+	rc = msm_vdec_subscribe_property(inst, INPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_subscribe_metadata(inst, INPUT_PORT);
+	if (rc)
+		goto error;
+
+	/*
+	 * Subscribe output metadatas in input port sequence as well so that
+	 * metadatas detected in bitstream before output port is started
+	 * are not missed.
+	 * Example: AV1 HDR metadata which can be part of
+	 * first ETB (sequence header OBU + metadata OBU)
+	 */
+	rc = msm_vdec_subscribe_metadata(inst, OUTPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_set_delivery_mode_metadata(inst, INPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vidc_process_streamon_input(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vidc_flush_ts(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vidc_ts_reorder_flush(inst);
+	if (rc)
+		goto error;
+
+	return 0;
+
+error:
+	i_vpr_e(inst, "%s: failed\n", __func__);
+	return rc;
+}
+
+static int schedule_batch_work(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	mod_delayed_work(core->batch_workq, &inst->decode_batch.work,
+		msecs_to_jiffies(core->capabilities[DECODE_BATCH_TIMEOUT].value));
+
+	return 0;
+}
+
+static int cancel_batch_work(struct msm_vidc_inst *inst)
+{
+	if (!inst) {
+		d_vpr_e("%s: Invalid arguments\n", __func__);
+		return -EINVAL;
+	}
+	cancel_delayed_work(&inst->decode_batch.work);
+
+	return 0;
+}
+
+int msm_vdec_streamoff_output(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	/* cancel pending batch work */
+	cancel_batch_work(inst);
+	rc = msm_vidc_session_streamoff(inst, OUTPUT_PORT);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int msm_vdec_subscribe_output_port_settings_change(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	u32 payload[32] = {0};
+	u32 prop_type, payload_size, payload_type;
+	u32 i;
+	struct msm_vidc_subscription_params subsc_params;
+	u32 subscribe_psc_size = 0;
+	const u32 *psc = NULL;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	core = inst->core;
+
+	payload[0] = HFI_MODE_PORT_SETTINGS_CHANGE;
+	if (inst->codec == MSM_VIDC_H264) {
+		subscribe_psc_size = core->platform->data.psc_avc_tbl_size;
+		psc = core->platform->data.psc_avc_tbl;
+	} else if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC) {
+		subscribe_psc_size = core->platform->data.psc_hevc_tbl_size;
+		psc = core->platform->data.psc_hevc_tbl;
+	} else if (inst->codec == MSM_VIDC_VP9) {
+		subscribe_psc_size = core->platform->data.psc_vp9_tbl_size;
+		psc = core->platform->data.psc_vp9_tbl;
+	} else if (inst->codec == MSM_VIDC_AV1) {
+		subscribe_psc_size = core->platform->data.psc_av1_tbl_size;
+		psc = core->platform->data.psc_av1_tbl;
+	} else {
+		i_vpr_e(inst, "%s: unsupported codec: %d\n", __func__, inst->codec);
+		psc = NULL;
+		return -EINVAL;
+	}
+
+	if (!psc || !subscribe_psc_size) {
+		i_vpr_e(inst, "%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	payload[0] = HFI_MODE_PORT_SETTINGS_CHANGE;
+	for (i = 0; i < subscribe_psc_size; i++)
+		payload[i + 1] = psc[i];
+
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_SUBSCRIBE_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			((subscribe_psc_size + 1) *
+			sizeof(u32)));
+
+	subsc_params = inst->subcr_params[port];
+	for (i = 0; i < subscribe_psc_size; i++) {
+		payload[0] = 0;
+		payload[1] = 0;
+		payload_size = 0;
+		payload_type = 0;
+		prop_type = psc[i];
+		switch (prop_type) {
+		case HFI_PROP_BITSTREAM_RESOLUTION:
+			payload[0] = subsc_params.bitstream_resolution;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_CROP_OFFSETS:
+			payload[0] = subsc_params.crop_offsets[0];
+			payload[1] = subsc_params.crop_offsets[1];
+			payload_size = sizeof(u64);
+			payload_type = HFI_PAYLOAD_64_PACKED;
+			break;
+		case HFI_PROP_LUMA_CHROMA_BIT_DEPTH:
+			payload[0] = subsc_params.bit_depth;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_CODED_FRAMES:
+			payload[0] = subsc_params.coded_frames;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT:
+			payload[0] = subsc_params.fw_min_count;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_PIC_ORDER_CNT_TYPE:
+			payload[0] = subsc_params.pic_order_cnt;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_SIGNAL_COLOR_INFO:
+			payload[0] = subsc_params.color_info;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_PROFILE:
+			payload[0] = subsc_params.profile;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_LEVEL:
+			payload[0] = subsc_params.level;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_TIER:
+			payload[0] = subsc_params.tier;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_AV1_FILM_GRAIN_PRESENT:
+			payload[0] = subsc_params.av1_film_grain_present;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_AV1_SUPER_BLOCK_ENABLED:
+			payload[0] = subsc_params.av1_super_block_enabled;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		case HFI_PROP_MAX_NUM_REORDER_FRAMES:
+			payload[0] = subsc_params.max_num_reorder_frames;
+			payload_size = sizeof(u32);
+			payload_type = HFI_PAYLOAD_U32;
+			break;
+		default:
+			i_vpr_e(inst, "%s: unknown property %#x\n", __func__,
+				prop_type);
+			prop_type = 0;
+			rc = -EINVAL;
+			break;
+		}
+		if (prop_type) {
+			rc = venus_hfi_session_property(inst,
+					prop_type,
+					HFI_HOST_FLAGS_NONE,
+					get_hfi_port(inst, port),
+					payload_type,
+					&payload,
+					payload_size);
+			if (rc)
+				return rc;
+		}
+	}
+
+	return rc;
+}
+
+int msm_vdec_streamon_output(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	if (is_output_meta_enabled(inst) &&
+		!inst->bufq[OUTPUT_META_PORT].vb2q->streaming) {
+		i_vpr_e(inst,
+			"%s: Meta port must be streamed on before data port\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	if (inst->capabilities[CODED_FRAMES].value == CODED_FRAMES_INTERLACE &&
+		!is_ubwc_colorformat(inst->capabilities[PIX_FMTS].value)) {
+		i_vpr_e(inst,
+			"%s: interlace with non-ubwc color format is unsupported\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	rc = msm_vidc_check_session_supported(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_set_output_properties(inst);
+	if (rc)
+		goto error;
+
+	if (is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE)) {
+		if (!msm_vdec_check_outbuf_fence_allowed(inst)) {
+			rc = -EINVAL;
+			goto error;
+		}
+	}
+
+	if (!inst->opsc_properties_set) {
+		memcpy(&inst->subcr_params[OUTPUT_PORT],
+				&inst->subcr_params[INPUT_PORT],
+				sizeof(inst->subcr_params[INPUT_PORT]));
+		rc = msm_vdec_subscribe_output_port_settings_change(inst, OUTPUT_PORT);
+		if (rc)
+			goto error;
+		inst->opsc_properties_set = true;
+	}
+
+	rc = msm_vdec_subscribe_property(inst, OUTPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_subscribe_metadata(inst, OUTPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_set_delivery_mode_property(inst, OUTPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_set_delivery_mode_metadata(inst, OUTPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_get_output_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_destroy_internal_buffers(inst, OUTPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_create_output_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vidc_process_streamon_output(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vdec_queue_output_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	return 0;
+
+error:
+	i_vpr_e(inst, "%s: failed\n", __func__);
+	msm_vdec_streamoff_output(inst);
+	return rc;
+}
+
+static inline enum msm_vidc_allow msm_vdec_allow_queue_deferred_buffers(
+	struct msm_vidc_inst *inst)
+{
+	int count;
+
+	/* do not defer buffers initially to avoid latency issues */
+	if (inst->power.buffer_counter <= SKIP_BATCH_WINDOW)
+		return MSM_VIDC_ALLOW;
+
+	/* defer qbuf, if pending buffers count less than batch size */
+	count = msm_vidc_num_buffers(inst, MSM_VIDC_BUF_OUTPUT, MSM_VIDC_ATTR_DEFERRED);
+	if (count < inst->decode_batch.size)
+		return MSM_VIDC_DEFER;
+
+	return MSM_VIDC_ALLOW;
+}
+
+static int msm_vdec_qbuf_batch(struct msm_vidc_inst *inst,
+	struct vb2_buffer *vb2)
+{
+	struct msm_vidc_buffer *buf = NULL;
+	enum msm_vidc_allow allow;
+	int rc;
+
+	if (!inst->decode_batch.size) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	buf = msm_vidc_get_driver_buf(inst, vb2);
+	if (!buf)
+		return -EINVAL;
+
+	if (is_state(inst, MSM_VIDC_OPEN) ||
+		is_state(inst, MSM_VIDC_INPUT_STREAMING)) {
+		print_vidc_buffer(VIDC_LOW, "low ", "qbuf deferred", inst, buf);
+		return 0;
+	}
+
+	allow = msm_vdec_allow_queue_deferred_buffers(inst);
+	if (allow == MSM_VIDC_DISALLOW) {
+		i_vpr_e(inst, "%s: queue deferred buffers not allowed\n", __func__);
+		return -EINVAL;
+	} else if (allow == MSM_VIDC_DEFER) {
+		print_vidc_buffer(VIDC_LOW, "low ", "batch-qbuf deferred", inst, buf);
+		schedule_batch_work(inst);
+		return 0;
+	}
+
+	cancel_batch_work(inst);
+	rc = msm_vidc_queue_deferred_buffers(inst, MSM_VIDC_BUF_OUTPUT);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_vdec_release_eligible_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_buffer *ro_buf;
+
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		/* release only release eligible read-only buffers */
+		if (!(ro_buf->attr & MSM_VIDC_ATTR_RELEASE_ELIGIBLE))
+			continue;
+		/* skip releasing buffers for which release cmd was already sent */
+		if (ro_buf->attr & MSM_VIDC_ATTR_PENDING_RELEASE)
+			continue;
+		rc = venus_hfi_release_buffer(inst, ro_buf);
+		if (rc)
+			return rc;
+		ro_buf->attr |= MSM_VIDC_ATTR_PENDING_RELEASE;
+		ro_buf->attr &= ~MSM_VIDC_ATTR_RELEASE_ELIGIBLE;
+		print_vidc_buffer(VIDC_LOW, "low ", "release buf", inst, ro_buf);
+	}
+
+	return rc;
+}
+
+static int msm_vdec_release_nonref_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 fw_ro_count = 0, nonref_ro_count = 0;
+	struct msm_vidc_buffer *ro_buf;
+	int i = 0;
+	bool found = false;
+
+	/* count read_only buffers which are not pending release in read_only list */
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		if (!(ro_buf->attr & MSM_VIDC_ATTR_READ_ONLY))
+			continue;
+		if (ro_buf->attr & MSM_VIDC_ATTR_PENDING_RELEASE)
+			continue;
+		fw_ro_count++;
+	}
+
+	if (fw_ro_count <= MAX_DPB_COUNT)
+		return 0;
+
+	/*
+	 * Mark those read only buffers present in read_only list as
+	 * non-reference if that buffer is not part of dpb_list_payload.
+	 * count such non-ref read only buffers as nonref_ro_count.
+	 * dpb_list_payload details:
+	 * payload[0-1]           : 64 bits base_address of DPB-1
+	 * payload[2]             : 32 bits addr_offset  of DPB-1
+	 * payload[3]             : 32 bits data_offset  of DPB-1
+	 */
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		found = false;
+		if (!(ro_buf->attr & MSM_VIDC_ATTR_READ_ONLY))
+			continue;
+		if (ro_buf->attr & MSM_VIDC_ATTR_PENDING_RELEASE)
+			continue;
+		for (i = 0; (i + 3) < MAX_DPB_LIST_ARRAY_SIZE; i = i + 4) {
+			if (ro_buf->device_addr == inst->dpb_list_payload[i] &&
+				ro_buf->data_offset == inst->dpb_list_payload[i + 3]) {
+				found = true;
+				break;
+			}
+		}
+		if (!found)
+			nonref_ro_count++;
+	}
+
+
+	if (nonref_ro_count <= inst->buffers.output.min_count)
+		return 0;
+
+	i_vpr_l(inst, "%s: fw ro buf count %d, non-ref ro count %d\n",
+		__func__, fw_ro_count, nonref_ro_count);
+
+	/* release the eligible buffers as per above condition */
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		found = false;
+		if (!(ro_buf->attr & MSM_VIDC_ATTR_READ_ONLY))
+			continue;
+		if (ro_buf->attr & MSM_VIDC_ATTR_PENDING_RELEASE)
+			continue;
+		for (i = 0; (i + 3) < MAX_DPB_LIST_ARRAY_SIZE; i = i + 4) {
+			if (ro_buf->device_addr == inst->dpb_list_payload[i] &&
+				ro_buf->data_offset == inst->dpb_list_payload[i + 3]) {
+				found = true;
+				break;
+			}
+		}
+		if (!found) {
+			ro_buf->attr |= MSM_VIDC_ATTR_PENDING_RELEASE;
+			print_vidc_buffer(VIDC_LOW, "low ", "release buf", inst, ro_buf);
+			rc = venus_hfi_release_buffer(inst, ro_buf);
+			if (rc)
+				return rc;
+		}
+	}
+
+	return rc;
+}
+
+int msm_vdec_qbuf(struct msm_vidc_inst *inst, struct vb2_buffer *vb2)
+{
+	int rc = 0;
+
+	if (inst->adjust_priority) {
+		s32 priority = inst->capabilities[PRIORITY].value;
+
+		priority += inst->adjust_priority;
+		inst->adjust_priority = 0;
+		msm_vidc_update_cap_value(inst, PRIORITY, priority, __func__);
+		msm_vidc_set_session_priority(inst, PRIORITY);
+	}
+
+	/* batch decoder output & meta buffer only */
+	if (inst->decode_batch.enable && vb2->type == OUTPUT_MPLANE)
+		rc = msm_vdec_qbuf_batch(inst, vb2);
+	else
+		rc = msm_vidc_queue_buffer_single(inst, vb2);
+	if (rc)
+		return rc;
+
+	/*
+	 * if DPB_LIST property is subscribed on output port, then
+	 * driver needs to hold at least MAX_BPB_COUNT of read only
+	 * buffers. So call msm_vdec_release_nonref_buffers() to handle
+	 * the same.
+	 */
+	if (vb2->type == OUTPUT_MPLANE) {
+		if (inst->input_dpb_list_enabled)
+			rc = msm_vdec_release_eligible_buffers(inst);
+		else if (inst->output_dpb_list_enabled)
+			rc = msm_vdec_release_nonref_buffers(inst);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vdec_alloc_and_queue_additional_dpb_buffers(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buffer = NULL;
+	int i, cur_min_count = 0, rc = 0;
+
+	/* get latest min_count and size */
+	rc = msm_vidc_get_internal_buffers(inst, MSM_VIDC_BUF_DPB);
+	if (rc)
+		return rc;
+
+	buffers = msm_vidc_get_buffers(inst, MSM_VIDC_BUF_DPB, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	/* get current min_count */
+	list_for_each_entry(buffer, &buffers->list, list)
+		cur_min_count++;
+
+	/* skip alloc and queue */
+	if (cur_min_count >= buffers->min_count)
+		return 0;
+
+	i_vpr_h(inst, "%s: dpb buffer count increased from %u -> %u\n",
+		__func__, cur_min_count, buffers->min_count);
+
+	/* allocate additional DPB buffers */
+	for (i = cur_min_count; i < buffers->min_count; i++) {
+		rc = msm_vidc_create_internal_buffer(inst, MSM_VIDC_BUF_DPB, i);
+		if (rc)
+			return rc;
+	}
+
+	/* queue additional DPB buffers */
+	rc = msm_vidc_queue_internal_buffers(inst, MSM_VIDC_BUF_DPB);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+int msm_vdec_stop_cmd(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	i_vpr_h(inst, "received cmd: drain\n");
+	rc = msm_vidc_process_drain(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vdec_start_cmd(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	i_vpr_h(inst, "received cmd: resume\n");
+	vb2_clear_last_buffer_dequeued(inst->bufq[OUTPUT_META_PORT].vb2q);
+	vb2_clear_last_buffer_dequeued(inst->bufq[OUTPUT_PORT].vb2q);
+
+	if (inst->capabilities[CODED_FRAMES].value == CODED_FRAMES_INTERLACE &&
+		!is_ubwc_colorformat(inst->capabilities[PIX_FMTS].value)) {
+		i_vpr_e(inst,
+			"%s: interlace with non-ubwc color format is unsupported\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	/* tune power features */
+	inst->decode_batch.enable = msm_vidc_allow_decode_batch(inst);
+	msm_vidc_allow_dcvs(inst);
+	msm_vidc_power_data_reset(inst);
+
+	/*
+	 * client is completing partial port reconfiguration,
+	 * hence reallocate input internal buffers before input port
+	 * is resumed.
+	 */
+	if (is_sub_state(inst, MSM_VIDC_DRC) &&
+		is_sub_state(inst, MSM_VIDC_DRC_LAST_BUFFER) &&
+		is_sub_state(inst, MSM_VIDC_INPUT_PAUSE)) {
+		i_vpr_h(inst, "%s: alloc and queue input internal buffers\n",
+			__func__);
+		rc = msm_vidc_alloc_and_queue_input_internal_buffers(inst);
+		if (rc)
+			return rc;
+
+		rc = msm_vidc_set_stage(inst, STAGE);
+		if (rc)
+			return rc;
+
+		rc = msm_vidc_set_pipe(inst, PIPE);
+		if (rc)
+			return rc;
+	}
+
+	/* allocate and queue extra dpb buffers */
+	rc = msm_vdec_alloc_and_queue_additional_dpb_buffers(inst);
+	if (rc)
+		return rc;
+
+	/* queue pending deferred buffers */
+	rc = msm_vidc_queue_deferred_buffers(inst, MSM_VIDC_BUF_OUTPUT);
+	if (rc)
+		return rc;
+
+	/* print final buffer counts & size details */
+	msm_vidc_print_buffer_info(inst);
+
+	/* print internal buffer memory usage stats */
+	msm_vidc_print_memory_stats(inst);
+
+	rc = msm_vidc_process_resume(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vdec_try_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+	struct v4l2_pix_format_mplane *pixmp = &f->fmt.pix_mp;
+	u32 pix_fmt;
+
+	memset(pixmp->reserved, 0, sizeof(pixmp->reserved));
+	if (f->type == INPUT_MPLANE) {
+		pix_fmt = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+		if (!pix_fmt) {
+			i_vpr_e(inst, "%s: unsupported codec, set current params\n", __func__);
+			f->fmt.pix_mp.width = inst->fmts[INPUT_PORT].fmt.pix_mp.width;
+			f->fmt.pix_mp.height = inst->fmts[INPUT_PORT].fmt.pix_mp.height;
+			f->fmt.pix_mp.pixelformat = inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat;
+			pix_fmt = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+		}
+	} else if (f->type == OUTPUT_MPLANE) {
+		pix_fmt = v4l2_colorformat_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+		if (!pix_fmt) {
+			i_vpr_e(inst, "%s: unsupported format, set current params\n", __func__);
+			f->fmt.pix_mp.pixelformat = inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat;
+			f->fmt.pix_mp.width = inst->fmts[OUTPUT_PORT].fmt.pix_mp.width;
+			f->fmt.pix_mp.height = inst->fmts[OUTPUT_PORT].fmt.pix_mp.height;
+		}
+		if (inst->bufq[INPUT_PORT].vb2q->streaming) {
+			f->fmt.pix_mp.height = inst->fmts[INPUT_PORT].fmt.pix_mp.height;
+			f->fmt.pix_mp.width = inst->fmts[INPUT_PORT].fmt.pix_mp.width;
+		}
+	} else if (f->type == INPUT_META_PLANE) {
+		f->fmt.meta.dataformat = inst->fmts[INPUT_META_PORT].fmt.meta.dataformat;
+		f->fmt.meta.buffersize = inst->fmts[INPUT_META_PORT].fmt.meta.buffersize;
+	} else if (f->type == OUTPUT_META_PLANE) {
+		f->fmt.meta.dataformat = inst->fmts[OUTPUT_META_PORT].fmt.meta.dataformat;
+		f->fmt.meta.buffersize = inst->fmts[OUTPUT_META_PORT].fmt.meta.buffersize;
+	} else {
+		i_vpr_e(inst, "%s: invalid type %d\n", __func__, f->type);
+		return -EINVAL;
+	}
+
+	if (pixmp->field == V4L2_FIELD_ANY)
+		pixmp->field = V4L2_FIELD_NONE;
+
+	pixmp->num_planes = 1;
+	return rc;
+}
+
+
+int msm_vdec_s_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct v4l2_format *fmt, *output_fmt;
+	u32 codec_align;
+	enum msm_vidc_colorformat_type colorformat;
+
+	core = inst->core;
+	msm_vdec_try_fmt(inst, f);
+
+	if (f->type == INPUT_MPLANE) {
+		if (inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat !=
+			f->fmt.pix_mp.pixelformat) {
+			rc = msm_vdec_codec_change(inst, f->fmt.pix_mp.pixelformat);
+			if (rc)
+				goto err_invalid_fmt;
+		}
+
+		fmt = &inst->fmts[INPUT_PORT];
+		fmt->type = INPUT_MPLANE;
+
+		codec_align = inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat ==
+			V4L2_PIX_FMT_HEVC ? 32 : 16;
+		fmt->fmt.pix_mp.width = ALIGN(f->fmt.pix_mp.width, codec_align);
+		fmt->fmt.pix_mp.height = ALIGN(f->fmt.pix_mp.height, codec_align);
+		fmt->fmt.pix_mp.num_planes = 1;
+		fmt->fmt.pix_mp.plane_fmt[0].bytesperline = 0;
+		fmt->fmt.pix_mp.plane_fmt[0].sizeimage = call_session_op(core,
+			buffer_size, inst, MSM_VIDC_BUF_INPUT);
+		inst->buffers.input.min_count = call_session_op(core,
+			min_count, inst, MSM_VIDC_BUF_INPUT);
+		inst->buffers.input.extra_count = call_session_op(core,
+			extra_count, inst, MSM_VIDC_BUF_INPUT);
+		if (inst->buffers.input.actual_count <
+			inst->buffers.input.min_count +
+			inst->buffers.input.extra_count) {
+			inst->buffers.input.actual_count =
+				inst->buffers.input.min_count +
+				inst->buffers.input.extra_count;
+		}
+		inst->buffers.input.size =
+			fmt->fmt.pix_mp.plane_fmt[0].sizeimage;
+		/* update input port color info */
+		fmt->fmt.pix_mp.colorspace = f->fmt.pix_mp.colorspace;
+		fmt->fmt.pix_mp.xfer_func = f->fmt.pix_mp.xfer_func;
+		fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+		fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization;
+		/* update output port color info */
+		output_fmt = &inst->fmts[OUTPUT_PORT];
+		output_fmt->fmt.pix_mp.colorspace = f->fmt.pix_mp.colorspace;
+		output_fmt->fmt.pix_mp.xfer_func = f->fmt.pix_mp.xfer_func;
+		output_fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+		output_fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization;
+
+		/* update crop dimensions */
+		inst->crop.left = inst->crop.top = 0;
+		inst->crop.width = f->fmt.pix_mp.width;
+		inst->crop.height = f->fmt.pix_mp.height;
+		i_vpr_h(inst,
+			"%s: type: INPUT, codec %s width %d height %d size %u min_count %d extra_count %d\n",
+			__func__, v4l2_pixelfmt_name(inst, f->fmt.pix_mp.pixelformat),
+			f->fmt.pix_mp.width, f->fmt.pix_mp.height,
+			fmt->fmt.pix_mp.plane_fmt[0].sizeimage,
+			inst->buffers.input.min_count,
+			inst->buffers.input.extra_count);
+	} else if (f->type == INPUT_META_PLANE) {
+		fmt = &inst->fmts[INPUT_META_PORT];
+		fmt->type = INPUT_META_PLANE;
+		fmt->fmt.meta.dataformat =
+			v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+		fmt->fmt.meta.buffersize = call_session_op(core,
+			buffer_size, inst, MSM_VIDC_BUF_INPUT_META);
+		inst->buffers.input_meta.min_count =
+				inst->buffers.input.min_count;
+		inst->buffers.input_meta.extra_count =
+				inst->buffers.input.extra_count;
+		inst->buffers.input_meta.actual_count =
+				inst->buffers.input.actual_count;
+		inst->buffers.input_meta.size = fmt->fmt.meta.buffersize;
+		i_vpr_h(inst,
+			"%s: type: INPUT_META, size %u min_count %d extra_count %d\n",
+			__func__, fmt->fmt.meta.buffersize,
+			inst->buffers.input_meta.min_count,
+			inst->buffers.input_meta.extra_count);
+	} else if (f->type == OUTPUT_MPLANE) {
+		fmt = &inst->fmts[OUTPUT_PORT];
+		fmt->type = OUTPUT_MPLANE;
+		if (inst->bufq[INPUT_PORT].vb2q->streaming) {
+			f->fmt.pix_mp.height = inst->fmts[INPUT_PORT].fmt.pix_mp.height;
+			f->fmt.pix_mp.width = inst->fmts[INPUT_PORT].fmt.pix_mp.width;
+		}
+		fmt->fmt.pix_mp.pixelformat = f->fmt.pix_mp.pixelformat;
+		colorformat = v4l2_colorformat_to_driver(inst, fmt->fmt.pix_mp.pixelformat,
+			__func__);
+		fmt->fmt.pix_mp.width = video_y_stride_pix(
+			colorformat, f->fmt.pix_mp.width);
+		fmt->fmt.pix_mp.height = video_y_scanlines(
+			colorformat, f->fmt.pix_mp.height);
+		fmt->fmt.pix_mp.num_planes = 1;
+		fmt->fmt.pix_mp.plane_fmt[0].bytesperline =
+			video_y_stride_bytes(
+			colorformat, f->fmt.pix_mp.width);
+		fmt->fmt.pix_mp.plane_fmt[0].sizeimage = call_session_op(core,
+			buffer_size, inst, MSM_VIDC_BUF_OUTPUT);
+
+		if (!inst->bufq[INPUT_PORT].vb2q->streaming)
+			inst->buffers.output.min_count = call_session_op(core,
+				min_count, inst, MSM_VIDC_BUF_OUTPUT);
+		inst->buffers.output.extra_count = call_session_op(core,
+			extra_count, inst, MSM_VIDC_BUF_OUTPUT);
+		if (inst->buffers.output.actual_count <
+			inst->buffers.output.min_count +
+			inst->buffers.output.extra_count) {
+			inst->buffers.output.actual_count =
+				inst->buffers.output.min_count +
+				inst->buffers.output.extra_count;
+		}
+		inst->buffers.output.size =
+			fmt->fmt.pix_mp.plane_fmt[0].sizeimage;
+		msm_vidc_update_cap_value(inst, PIX_FMTS, colorformat, __func__);
+
+		/* update crop while input port is not streaming */
+		if (!inst->bufq[INPUT_PORT].vb2q->streaming) {
+			inst->crop.top = 0;
+			inst->crop.left = 0;
+			inst->crop.width = f->fmt.pix_mp.width;
+			inst->crop.height = f->fmt.pix_mp.height;
+		}
+		i_vpr_h(inst,
+			"%s: type: OUTPUT, format %s width %d height %d size %u min_count %d extra_count %d\n",
+			__func__, v4l2_pixelfmt_name(inst, fmt->fmt.pix_mp.pixelformat),
+			fmt->fmt.pix_mp.width, fmt->fmt.pix_mp.height,
+			fmt->fmt.pix_mp.plane_fmt[0].sizeimage,
+			inst->buffers.output.min_count,
+			inst->buffers.output.extra_count);
+	} else if (f->type == OUTPUT_META_PLANE) {
+		fmt = &inst->fmts[OUTPUT_META_PORT];
+		fmt->type = OUTPUT_META_PLANE;
+		fmt->fmt.meta.dataformat =
+			v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+		fmt->fmt.meta.buffersize = call_session_op(core,
+			buffer_size, inst, MSM_VIDC_BUF_OUTPUT_META);
+		inst->buffers.output_meta.min_count =
+				inst->buffers.output.min_count;
+		inst->buffers.output_meta.extra_count =
+				inst->buffers.output.extra_count;
+		inst->buffers.output_meta.actual_count =
+				inst->buffers.output.actual_count;
+		inst->buffers.output_meta.size = fmt->fmt.meta.buffersize;
+		i_vpr_h(inst,
+			"%s: type: OUTPUT_META, size %u min_count %d extra_count %d\n",
+			__func__, fmt->fmt.meta.buffersize,
+			inst->buffers.output_meta.min_count,
+			inst->buffers.output_meta.extra_count);
+	} else {
+		i_vpr_e(inst, "%s: invalid type %d\n", __func__, f->type);
+		goto err_invalid_fmt;
+	}
+	memcpy(f, fmt, sizeof(struct v4l2_format));
+
+err_invalid_fmt:
+	return rc;
+}
+
+int msm_vdec_g_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+	int port;
+
+	port = v4l2_type_to_driver_port(inst, f->type, __func__);
+	if (port < 0)
+		return -EINVAL;
+
+	memcpy(f, &inst->fmts[port], sizeof(struct v4l2_format));
+
+	return rc;
+}
+
+int msm_vdec_s_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s)
+{
+	i_vpr_e(inst, "%s: unsupported\n", __func__);
+	return -EINVAL;
+}
+
+int msm_vdec_g_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s)
+{
+	if (s->type != OUTPUT_MPLANE && s->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) {
+		i_vpr_e(inst, "%s: invalid type %d\n", __func__, s->type);
+		return -EINVAL;
+	}
+
+	switch (s->target) {
+	case V4L2_SEL_TGT_CROP_BOUNDS:
+	case V4L2_SEL_TGT_CROP_DEFAULT:
+	case V4L2_SEL_TGT_CROP:
+	case V4L2_SEL_TGT_COMPOSE_BOUNDS:
+	case V4L2_SEL_TGT_COMPOSE_PADDED:
+	case V4L2_SEL_TGT_COMPOSE_DEFAULT:
+	case V4L2_SEL_TGT_COMPOSE:
+		s->r.left = inst->crop.left;
+		s->r.top = inst->crop.top;
+		s->r.width = inst->crop.width;
+		s->r.height = inst->crop.height;
+		break;
+	default:
+		i_vpr_e(inst, "%s: invalid target %d\n",
+			__func__, s->target);
+		return -EINVAL;
+	}
+	i_vpr_h(inst, "%s: target %d, r [%d, %d, %d, %d]\n",
+		__func__, s->target, s->r.top, s->r.left,
+		s->r.width, s->r.height);
+	return 0;
+}
+
+int msm_vdec_subscribe_event(struct msm_vidc_inst *inst,
+		const struct v4l2_event_subscription *sub)
+{
+	int rc = 0;
+
+	switch (sub->type) {
+	case V4L2_EVENT_EOS:
+		rc = v4l2_event_subscribe(&inst->fh, sub, MAX_EVENTS, NULL);
+		break;
+	case V4L2_EVENT_SOURCE_CHANGE:
+		rc = v4l2_src_change_event_subscribe(&inst->fh, sub);
+		break;
+	case V4L2_EVENT_CTRL:
+		rc = v4l2_ctrl_subscribe_event(&inst->fh, sub);
+		break;
+	default:
+		i_vpr_e(inst, "%s: invalid type %d id %d\n", __func__, sub->type, sub->id);
+		return -EINVAL;
+	}
+
+	if (rc)
+		i_vpr_e(inst, "%s: failed, type %d id %d\n",
+			__func__, sub->type, sub->id);
+	return rc;
+}
+
+static int msm_vdec_check_colorformat_supported(struct msm_vidc_inst *inst,
+		enum msm_vidc_colorformat_type colorformat)
+{
+	bool supported = true;
+
+	/* do not reject coloformats before streamon */
+	if (!inst->bufq[INPUT_PORT].vb2q->streaming)
+		return true;
+
+	/*
+	 * bit_depth 8 bit supports 8 bit colorformats only
+	 * bit_depth 10 bit supports 10 bit colorformats only
+	 * interlace supports ubwc colorformats only
+	 */
+	if (inst->capabilities[BIT_DEPTH].value == BIT_DEPTH_8 &&
+		!is_8bit_colorformat(colorformat))
+		supported = false;
+	if (inst->capabilities[BIT_DEPTH].value == BIT_DEPTH_10 &&
+		!is_10bit_colorformat(colorformat))
+		supported = false;
+	if (inst->capabilities[CODED_FRAMES].value ==
+		CODED_FRAMES_INTERLACE &&
+		!is_ubwc_colorformat(colorformat))
+		supported = false;
+
+	return supported;
+}
+
+int msm_vdec_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	u32 array[32] = {0};
+	u32 i = 0;
+
+	if (f->index >= ARRAY_SIZE(array)) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+
+	if (f->type == INPUT_MPLANE) {
+		u32 codecs = core->capabilities[DEC_CODECS].value;
+		u32 idx = 0;
+
+		for (i = 0; i <= 31; i++) {
+			if (codecs & BIT(i)) {
+				if (idx >= ARRAY_SIZE(array))
+					break;
+				array[idx] = codecs & BIT(i);
+				idx++;
+			}
+		}
+		if (!array[f->index])
+			return -EINVAL;
+		f->pixelformat = v4l2_codec_from_driver(inst, array[f->index],
+				__func__);
+		if (!f->pixelformat)
+			return -EINVAL;
+		f->flags = V4L2_FMT_FLAG_COMPRESSED | V4L2_FMT_FLAG_DYN_RESOLUTION;
+		strscpy(f->description, "codec", sizeof(f->description));
+	} else if (f->type == OUTPUT_MPLANE) {
+		u32 formats = inst->capabilities[PIX_FMTS].step_or_mask;
+		u32 idx = 0;
+
+		for (i = 0; i <= 31; i++) {
+			if (formats & BIT(i)) {
+				if (idx >= ARRAY_SIZE(array))
+					break;
+				if (msm_vdec_check_colorformat_supported(inst,
+						formats & BIT(i))) {
+					array[idx] = formats & BIT(i);
+					idx++;
+				}
+			}
+		}
+		if (!array[f->index])
+			return -EINVAL;
+		f->pixelformat = v4l2_colorformat_from_driver(inst, array[f->index],
+				__func__);
+		if (!f->pixelformat)
+			return -EINVAL;
+		strscpy(f->description, "colorformat", sizeof(f->description));
+	} else if (f->type == INPUT_META_PLANE || f->type == OUTPUT_META_PLANE) {
+		if (!f->index) {
+			f->pixelformat =
+				v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+			strscpy(f->description, "metadata", sizeof(f->description));
+		} else {
+			return -EINVAL;
+		}
+	}
+	memset(f->reserved, 0, sizeof(f->reserved));
+
+	i_vpr_h(inst, "%s: index %d, %s: %s, flags %#x\n",
+		__func__, f->index, f->description,
+		v4l2_pixelfmt_name(inst, f->pixelformat), f->flags);
+	return rc;
+}
+
+int msm_vdec_inst_init(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct v4l2_format *f;
+	enum msm_vidc_colorformat_type colorformat;
+
+	core = inst->core;
+
+	INIT_DELAYED_WORK(&inst->decode_batch.work, msm_vidc_batch_handler);
+	if (core->capabilities[DECODE_BATCH].value) {
+		inst->decode_batch.enable = true;
+		inst->decode_batch.size = MAX_DEC_BATCH_SIZE;
+	}
+
+	if (core->capabilities[DCVS].value && inst->codec != MSM_VIDC_AV1)
+		inst->power.dcvs_mode = true;
+
+	f = &inst->fmts[INPUT_PORT];
+	f->type = INPUT_MPLANE;
+	f->fmt.pix_mp.width = DEFAULT_WIDTH;
+	f->fmt.pix_mp.height = DEFAULT_HEIGHT;
+	f->fmt.pix_mp.pixelformat = V4L2_PIX_FMT_H264;
+	f->fmt.pix_mp.num_planes = 1;
+	f->fmt.pix_mp.plane_fmt[0].bytesperline = 0;
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = call_session_op(core,
+		buffer_size, inst, MSM_VIDC_BUF_INPUT);
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	inst->buffers.input.min_count = call_session_op(core,
+		min_count, inst, MSM_VIDC_BUF_INPUT);
+	inst->buffers.input.extra_count = call_session_op(core,
+		extra_count, inst, MSM_VIDC_BUF_INPUT);
+	inst->buffers.input.actual_count =
+			inst->buffers.input.min_count +
+			inst->buffers.input.extra_count;
+	inst->buffers.input.size = f->fmt.pix_mp.plane_fmt[0].sizeimage;
+
+	inst->crop.left = inst->crop.top = 0;
+	inst->crop.width = f->fmt.pix_mp.width;
+	inst->crop.height = f->fmt.pix_mp.height;
+
+	f = &inst->fmts[INPUT_META_PORT];
+	f->type = INPUT_META_PLANE;
+	f->fmt.meta.dataformat =
+		v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);;
+	f->fmt.meta.buffersize = MSM_VIDC_METADATA_SIZE;
+	inst->buffers.input_meta.min_count = 0;
+	inst->buffers.input_meta.extra_count = 0;
+	inst->buffers.input_meta.actual_count = 0;
+	inst->buffers.input_meta.size = 0;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	f->type = OUTPUT_MPLANE;
+	f->fmt.pix_mp.pixelformat =
+		v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_NV12C, __func__);
+	colorformat = v4l2_colorformat_to_driver(inst,
+		f->fmt.pix_mp.pixelformat, __func__);
+	f->fmt.pix_mp.width = video_y_stride_pix(colorformat, DEFAULT_WIDTH);
+	f->fmt.pix_mp.height = video_y_scanlines(colorformat, DEFAULT_HEIGHT);
+	f->fmt.pix_mp.num_planes = 1;
+	f->fmt.pix_mp.plane_fmt[0].bytesperline =
+		video_y_stride_bytes(colorformat, DEFAULT_WIDTH);
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = call_session_op(core,
+		buffer_size, inst, MSM_VIDC_BUF_OUTPUT);
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	f->fmt.pix_mp.colorspace = V4L2_COLORSPACE_DEFAULT;
+	f->fmt.pix_mp.xfer_func = V4L2_XFER_FUNC_DEFAULT;
+	f->fmt.pix_mp.ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+	f->fmt.pix_mp.quantization = V4L2_QUANTIZATION_DEFAULT;
+	inst->buffers.output.min_count = call_session_op(core,
+		min_count, inst, MSM_VIDC_BUF_OUTPUT);
+	inst->buffers.output.extra_count = call_session_op(core,
+		extra_count, inst, MSM_VIDC_BUF_OUTPUT);
+	inst->buffers.output.actual_count =
+			inst->buffers.output.min_count +
+			inst->buffers.output.extra_count;
+	inst->buffers.output.size = f->fmt.pix_mp.plane_fmt[0].sizeimage;
+	inst->fw_min_count = 0;
+
+	f = &inst->fmts[OUTPUT_META_PORT];
+	f->type = OUTPUT_META_PLANE;
+	f->fmt.meta.dataformat =
+		v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+	f->fmt.meta.buffersize = MSM_VIDC_METADATA_SIZE;
+	inst->buffers.output_meta.min_count = 0;
+	inst->buffers.output_meta.extra_count = 0;
+	inst->buffers.output_meta.actual_count = 0;
+	inst->buffers.output_meta.size = 0;
+	inst->input_dpb_list_enabled = false;
+	inst->output_dpb_list_enabled = false;
+
+	rc = msm_vdec_codec_change(inst,
+			inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vdec_inst_deinit(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	/* cancel pending batch work */
+	cancel_batch_work(inst);
+	rc = msm_vidc_ctrl_handler_deinit(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_venc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_venc.c
@@ -0,0 +1,1874 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_media_info.h"
+
+#include "msm_venc.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_power.h"
+#include "msm_vidc_debug.h"
+#include "venus_hfi.h"
+#include "hfi_packet.h"
+#include "msm_vidc_platform.h"
+
+static const u32 msm_venc_input_set_prop[] = {
+	HFI_PROP_COLOR_FORMAT,
+	HFI_PROP_RAW_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_LINEAR_STRIDE_SCANLINE,
+	HFI_PROP_SIGNAL_COLOR_INFO,
+};
+
+static const u32 msm_venc_output_set_prop[] = {
+	HFI_PROP_BITSTREAM_RESOLUTION,
+	HFI_PROP_CROP_OFFSETS,
+	HFI_PROP_CSC,
+};
+
+static const u32 msm_venc_input_subscribe_for_properties[] = {
+	HFI_PROP_NO_OUTPUT,
+};
+
+static const u32 msm_venc_output_subscribe_for_properties[] = {
+	HFI_PROP_PICTURE_TYPE,
+	HFI_PROP_BUFFER_MARK,
+	HFI_PROP_WORST_COMPRESSION_RATIO,
+};
+
+static const u32 msm_venc_output_internal_buffer_type[] = {
+	MSM_VIDC_BUF_BIN,
+	MSM_VIDC_BUF_COMV,
+	MSM_VIDC_BUF_NON_COMV,
+	MSM_VIDC_BUF_LINE,
+	MSM_VIDC_BUF_DPB,
+};
+
+static const u32 msm_venc_input_internal_buffer_type[] = {
+	MSM_VIDC_BUF_VPSS,
+};
+
+struct msm_venc_prop_type_handle {
+	u32 type;
+	int (*handle)(struct msm_vidc_inst *inst, enum msm_vidc_port_type port);
+};
+
+static int msm_venc_codec_change(struct msm_vidc_inst *inst, u32 v4l2_codec)
+{
+	int rc = 0;
+	bool session_init = false;
+
+	if (!inst->codec)
+		session_init = true;
+
+	if (inst->codec && inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat == v4l2_codec)
+		return 0;
+
+	i_vpr_h(inst, "%s: codec changed from %s to %s\n",
+		__func__, v4l2_pixelfmt_name(inst, inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat),
+		v4l2_pixelfmt_name(inst, v4l2_codec));
+
+	inst->codec = v4l2_codec_to_driver(inst, v4l2_codec, __func__);
+	if (!inst->codec) {
+		i_vpr_e(inst, "%s: invalid codec %#x\n", __func__, v4l2_codec);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat = v4l2_codec;
+	rc = msm_vidc_update_debug_str(inst);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_get_inst_capability(inst);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_ctrl_handler_init(inst, session_init);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_update_buffer_count(inst, INPUT_PORT);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_update_buffer_count(inst, OUTPUT_PORT);
+	if (rc)
+		goto exit;
+
+exit:
+	return rc;
+}
+
+/* todo: add logs for each property once finalised */
+static int msm_venc_set_colorformat(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 pixelformat;
+	enum msm_vidc_colorformat_type colorformat;
+	u32 hfi_colorformat;
+
+	if (port != INPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	pixelformat = inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat;
+	colorformat = v4l2_colorformat_to_driver(inst, pixelformat, __func__);
+	if (!(colorformat & inst->capabilities[PIX_FMTS].step_or_mask)) {
+		i_vpr_e(inst, "%s: invalid pixelformat %s\n",
+			__func__, v4l2_pixelfmt_name(inst, pixelformat));
+		return -EINVAL;
+	}
+
+	hfi_colorformat = get_hfi_colorformat(inst, colorformat);
+	i_vpr_h(inst, "%s: hfi colorformat: %#x", __func__,
+		hfi_colorformat);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_COLOR_FORMAT,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_U32_ENUM,
+			&hfi_colorformat,
+			sizeof(u32));
+	if (rc)
+		return rc;
+	return 0;
+}
+
+static int msm_venc_set_stride_scanline(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 color_format, stride_y, scanline_y;
+	u32 stride_uv = 0, scanline_uv = 0;
+	u32 payload[2];
+	u32 grid_size;
+
+	if (port != INPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	color_format = inst->capabilities[PIX_FMTS].value;
+	if (!is_linear_colorformat(color_format)) {
+		i_vpr_h(inst,
+			"%s: not a linear color fmt, property is not set\n",
+			__func__);
+		return 0;
+	}
+
+	if (is_image_session(inst)) {
+		grid_size = inst->capabilities[GRID_SIZE].value;
+		stride_y = ALIGN(inst->fmts[INPUT_PORT].fmt.pix_mp.width, grid_size);
+		scanline_y = ALIGN(inst->fmts[INPUT_PORT].fmt.pix_mp.height, grid_size);
+	} else if (is_rgba_colorformat(color_format)) {
+		stride_y = video_rgb_stride_pix(color_format,
+			inst->fmts[INPUT_PORT].fmt.pix_mp.width);
+		scanline_y = video_rgb_scanlines(color_format,
+			inst->fmts[INPUT_PORT].fmt.pix_mp.height);
+	} else {
+		stride_y = video_y_stride_pix(color_format,
+			inst->fmts[INPUT_PORT].fmt.pix_mp.width);
+		scanline_y = video_y_scanlines(color_format,
+			inst->fmts[INPUT_PORT].fmt.pix_mp.height);
+	}
+	if (color_format == MSM_VIDC_FMT_NV12 ||
+		color_format == MSM_VIDC_FMT_P010 ||
+		color_format == MSM_VIDC_FMT_NV21) {
+		stride_uv = stride_y;
+		scanline_uv = scanline_y / 2;
+	}
+
+	payload[0] = stride_y << 16 | scanline_y;
+	payload[1] = stride_uv << 16 | scanline_uv;
+	i_vpr_h(inst, "%s: stride_y: %d scanline_y: %d "
+		"stride_uv: %d, scanline_uv: %d", __func__,
+		stride_y, scanline_y, stride_uv, scanline_uv);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_LINEAR_STRIDE_SCANLINE,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_64_PACKED,
+			&payload,
+			sizeof(u64));
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int msm_venc_set_raw_resolution(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 resolution;
+
+	if (port != INPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	resolution = (inst->fmts[port].fmt.pix_mp.width << 16) |
+		inst->fmts[port].fmt.pix_mp.height;
+	i_vpr_h(inst, "%s: width: %d height: %d\n", __func__,
+			inst->fmts[port].fmt.pix_mp.width, inst->fmts[port].fmt.pix_mp.height);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_RAW_RESOLUTION,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_32_PACKED,
+			&resolution,
+			sizeof(u32));
+	if (rc)
+		return rc;
+	return 0;
+}
+
+static int msm_venc_set_bitstream_resolution(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 resolution;
+
+	if (port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	resolution = (inst->fmts[port].fmt.pix_mp.width << 16) |
+		inst->fmts[port].fmt.pix_mp.height;
+	i_vpr_h(inst, "%s: width: %d height: %d\n", __func__,
+			inst->fmts[port].fmt.pix_mp.width,
+			inst->fmts[port].fmt.pix_mp.height);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_BITSTREAM_RESOLUTION,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_32_PACKED,
+			&resolution,
+			sizeof(u32));
+	if (rc)
+		return rc;
+	return 0;
+}
+
+static int msm_venc_set_crop_offsets(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 left_offset, top_offset, right_offset, bottom_offset;
+	u32 crop[2] = {0};
+	u32 width, height;
+
+	if (port != OUTPUT_PORT && port != INPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	if (port == INPUT_PORT) {
+		left_offset = inst->crop.left;
+		top_offset = inst->crop.top;
+		width = inst->crop.width;
+		height = inst->crop.height;
+	} else {
+		left_offset = inst->compose.left;
+		top_offset = inst->compose.top;
+		width = inst->compose.width;
+		height = inst->compose.height;
+		if (is_rotation_90_or_270(inst)) {
+			width = inst->compose.height;
+			height = inst->compose.width;
+		}
+	}
+
+	right_offset = (inst->fmts[port].fmt.pix_mp.width - width);
+	bottom_offset = (inst->fmts[port].fmt.pix_mp.height - height);
+
+	if (is_image_session(inst))
+		right_offset = bottom_offset = 0;
+
+	crop[0] = left_offset << 16 | top_offset;
+	crop[1] = right_offset << 16 | bottom_offset;
+	i_vpr_h(inst, "%s: left_offset: %d top_offset: %d "
+		"right_offset: %d bottom_offset: %d", __func__,
+		left_offset, top_offset, right_offset, bottom_offset);
+
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_CROP_OFFSETS,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, port),
+			HFI_PAYLOAD_64_PACKED,
+			&crop,
+			sizeof(u64));
+	if (rc)
+		return rc;
+	return 0;
+}
+
+static int msm_venc_set_colorspace(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 primaries = MSM_VIDC_PRIMARIES_RESERVED;
+	u32 matrix_coeff = MSM_VIDC_MATRIX_COEFF_RESERVED;
+	u32 transfer_char = MSM_VIDC_TRANSFER_RESERVED;
+	u32 full_range = 0;
+	u32 colour_description_present_flag = 0;
+	u32 video_signal_type_present_flag = 0, payload = 0;
+	/* Unspecified video format */
+	u32 video_format = 5;
+	struct v4l2_format *input_fmt;
+	u32 pix_fmt;
+
+	if (port != INPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	if (inst->capabilities[SIGNAL_COLOR_INFO].flags & CAP_FLAG_CLIENT_SET) {
+		i_vpr_h(inst, "%s: client configured colorspace via control\n", __func__);
+		return 0;
+	}
+
+	input_fmt = &inst->fmts[INPUT_PORT];
+	pix_fmt = v4l2_colorformat_to_driver(inst,
+		input_fmt->fmt.pix_mp.pixelformat, __func__);
+	if (inst->fmts[port].fmt.pix_mp.colorspace != V4L2_COLORSPACE_DEFAULT ||
+	    inst->fmts[port].fmt.pix_mp.ycbcr_enc != V4L2_YCBCR_ENC_DEFAULT ||
+	    inst->fmts[port].fmt.pix_mp.xfer_func != V4L2_XFER_FUNC_DEFAULT) {
+		colour_description_present_flag = 1;
+		video_signal_type_present_flag = 1;
+		primaries = v4l2_color_primaries_to_driver(inst,
+			inst->fmts[port].fmt.pix_mp.colorspace, __func__);
+		matrix_coeff = v4l2_matrix_coeff_to_driver(inst,
+			inst->fmts[port].fmt.pix_mp.ycbcr_enc, __func__);
+		transfer_char = v4l2_transfer_char_to_driver(inst,
+			inst->fmts[port].fmt.pix_mp.xfer_func, __func__);
+	} else if (is_rgba_colorformat(pix_fmt)) {
+		colour_description_present_flag = 1;
+		video_signal_type_present_flag = 1;
+		primaries = MSM_VIDC_PRIMARIES_BT709;
+		matrix_coeff = MSM_VIDC_MATRIX_COEFF_BT709;
+		transfer_char = MSM_VIDC_TRANSFER_BT709;
+		full_range = 0;
+	}
+
+	if (inst->fmts[port].fmt.pix_mp.quantization !=
+	    V4L2_QUANTIZATION_DEFAULT) {
+		video_signal_type_present_flag = 1;
+		full_range = inst->fmts[port].fmt.pix_mp.quantization ==
+			V4L2_QUANTIZATION_FULL_RANGE ? 1 : 0;
+	}
+
+	payload = (matrix_coeff & 0xFF) |
+		((transfer_char << 8) & 0xFF00) |
+		((primaries << 16) & 0xFF0000) |
+		((colour_description_present_flag << 24) & 0x1000000) |
+		((full_range << 25) & 0x2000000) |
+		((video_format << 26) & 0x1C000000) |
+		((video_signal_type_present_flag << 29) & 0x20000000);
+	i_vpr_h(inst, "%s: color info: %#x\n", __func__, payload);
+	rc = venus_hfi_session_property(inst,
+		HFI_PROP_SIGNAL_COLOR_INFO,
+		HFI_HOST_FLAGS_NONE,
+		get_hfi_port(inst, port),
+		HFI_PAYLOAD_32_PACKED,
+		&payload,
+		sizeof(u32));
+	if (rc)
+		return rc;
+	return 0;
+}
+
+static int msm_venc_set_csc(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 csc = 0;
+
+	if (port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	csc = inst->capabilities[CSC].value;
+	i_vpr_h(inst, "%s: csc: %u\n", __func__, csc);
+	rc = venus_hfi_session_property(inst,
+		HFI_PROP_CSC,
+		HFI_HOST_FLAGS_NONE,
+		get_hfi_port(inst, port),
+		HFI_PAYLOAD_U32,
+		&csc,
+		sizeof(u32));
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int msm_venc_set_quality_mode(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core = inst->core;
+	u32 mode;
+
+	rc = call_session_op(core, decide_quality_mode, inst);
+	if (rc) {
+		i_vpr_e(inst, "%s: decide_work_route failed\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	mode = inst->capabilities[QUALITY_MODE].value;
+	i_vpr_h(inst, "%s: quality_mode: %u\n", __func__, mode);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_QUALITY_MODE,
+			HFI_HOST_FLAGS_NONE,
+			HFI_PORT_BITSTREAM,
+			HFI_PAYLOAD_U32_ENUM,
+			&mode,
+			sizeof(u32));
+	if (rc)
+		return rc;
+	return 0;
+}
+
+static int msm_venc_set_ring_buffer_count(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_inst_cap *cap;
+
+	cap = &inst->capabilities[ENC_RING_BUFFER_COUNT];
+
+	if (!cap->set)
+		return 0;
+
+	rc = cap->set(inst, ENC_RING_BUFFER_COUNT);
+	if (rc) {
+		i_vpr_e(inst, "%s: set cap failed\n", __func__);
+		return rc;
+	}
+
+	return 0;
+}
+
+static int msm_venc_set_input_properties(struct msm_vidc_inst *inst)
+{
+	int i, j, rc = 0;
+	static const struct msm_venc_prop_type_handle prop_type_handle_arr[] = {
+		{HFI_PROP_COLOR_FORMAT,               msm_venc_set_colorformat                 },
+		{HFI_PROP_RAW_RESOLUTION,             msm_venc_set_raw_resolution              },
+		{HFI_PROP_CROP_OFFSETS,               msm_venc_set_crop_offsets                },
+		{HFI_PROP_LINEAR_STRIDE_SCANLINE,     msm_venc_set_stride_scanline             },
+		{HFI_PROP_SIGNAL_COLOR_INFO,          msm_venc_set_colorspace                  },
+	};
+
+	i_vpr_h(inst, "%s()\n", __func__);
+	for (i = 0; i < ARRAY_SIZE(msm_venc_input_set_prop); i++) {
+		/* set session input properties */
+		for (j = 0; j < ARRAY_SIZE(prop_type_handle_arr); j++) {
+			if (prop_type_handle_arr[j].type == msm_venc_input_set_prop[i]) {
+				rc = prop_type_handle_arr[j].handle(inst, INPUT_PORT);
+				if (rc)
+					goto exit;
+				break;
+			}
+		}
+
+		/* is property type unknown ? */
+		if (j == ARRAY_SIZE(prop_type_handle_arr))
+			i_vpr_e(inst, "%s: unknown property %#x\n", __func__,
+				msm_venc_input_set_prop[i]);
+	}
+
+exit:
+	return rc;
+}
+
+static int msm_venc_set_output_properties(struct msm_vidc_inst *inst)
+{
+	int i, j, rc = 0;
+	static const struct msm_venc_prop_type_handle prop_type_handle_arr[] = {
+		{HFI_PROP_BITSTREAM_RESOLUTION,       msm_venc_set_bitstream_resolution    },
+		{HFI_PROP_CROP_OFFSETS,               msm_venc_set_crop_offsets            },
+		{HFI_PROP_CSC,                        msm_venc_set_csc                     },
+	};
+
+	i_vpr_h(inst, "%s()\n", __func__);
+	for (i = 0; i < ARRAY_SIZE(msm_venc_output_set_prop); i++) {
+		/* set session output properties */
+		for (j = 0; j < ARRAY_SIZE(prop_type_handle_arr); j++) {
+			if (prop_type_handle_arr[j].type == msm_venc_output_set_prop[i]) {
+				rc = prop_type_handle_arr[j].handle(inst, OUTPUT_PORT);
+				if (rc)
+					goto exit;
+				break;
+			}
+		}
+
+		/* is property type unknown ? */
+		if (j == ARRAY_SIZE(prop_type_handle_arr))
+			i_vpr_e(inst, "%s: unknown property %#x\n", __func__,
+				msm_venc_output_set_prop[i]);
+	}
+
+exit:
+	return rc;
+}
+
+static int msm_venc_set_internal_properties(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	rc = msm_venc_set_quality_mode(inst);
+	if (rc)
+		return rc;
+
+	rc = msm_venc_set_ring_buffer_count(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_venc_get_input_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int i, rc = 0;
+
+	for (i = 0; i < ARRAY_SIZE(msm_venc_input_internal_buffer_type); i++) {
+		rc = msm_vidc_get_internal_buffers(inst,
+			msm_venc_input_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int msm_venc_destroy_internal_buffers(struct msm_vidc_inst *inst,
+		enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf, *dummy;
+	const u32 *internal_buf_type;
+	u32 i, len;
+
+	if (port == INPUT_PORT) {
+		internal_buf_type = msm_venc_input_internal_buffer_type;
+		len = ARRAY_SIZE(msm_venc_input_internal_buffer_type);
+	} else {
+		internal_buf_type = msm_venc_output_internal_buffer_type;
+		len = ARRAY_SIZE(msm_venc_output_internal_buffer_type);
+	}
+
+	for (i = 0; i < len; i++) {
+		buffers = msm_vidc_get_buffers(inst, internal_buf_type[i], __func__);
+		if (!buffers)
+			return -EINVAL;
+
+		if (buffers->reuse) {
+			i_vpr_l(inst, "%s: reuse enabled for %s\n", __func__,
+				buf_name(internal_buf_type[i]));
+			continue;
+		}
+
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+			i_vpr_h(inst,
+				"%s: destroying internal buffer: type %d idx %d fd %d addr %#llx size %d\n",
+				__func__, buf->type, buf->index, buf->fd,
+				buf->device_addr, buf->buffer_size);
+
+			rc = msm_vidc_destroy_internal_buffer(inst, buf);
+			if (rc)
+				return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int msm_venc_create_input_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int i, rc = 0;
+
+	for (i = 0; i < ARRAY_SIZE(msm_venc_input_internal_buffer_type); i++) {
+		rc = msm_vidc_create_internal_buffers(inst,
+			msm_venc_input_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int msm_venc_queue_input_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int i, rc = 0;
+
+	for (i = 0; i < ARRAY_SIZE(msm_venc_input_internal_buffer_type); i++) {
+		rc = msm_vidc_queue_internal_buffers(inst,
+			msm_venc_input_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int msm_venc_get_output_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int i, rc = 0;
+
+	for (i = 0; i < ARRAY_SIZE(msm_venc_output_internal_buffer_type); i++) {
+		rc = msm_vidc_get_internal_buffers(inst,
+			msm_venc_output_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int msm_venc_create_output_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int i, rc = 0;
+
+	for (i = 0; i < ARRAY_SIZE(msm_venc_output_internal_buffer_type); i++) {
+		rc = msm_vidc_create_internal_buffers(inst,
+			msm_venc_output_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int msm_venc_queue_output_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int i, rc = 0;
+
+	for (i = 0; i < ARRAY_SIZE(msm_venc_output_internal_buffer_type); i++) {
+		rc = msm_vidc_queue_internal_buffers(inst,
+			msm_venc_output_internal_buffer_type[i]);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int msm_venc_property_subscription(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 payload[32] = {0};
+	u32 i;
+	u32 payload_size = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	payload[0] = HFI_MODE_PROPERTY;
+	if (port == INPUT_PORT) {
+		for (i = 0; i < ARRAY_SIZE(msm_venc_input_subscribe_for_properties); i++)
+			payload[i + 1] = msm_venc_input_subscribe_for_properties[i];
+		payload_size = (ARRAY_SIZE(msm_venc_input_subscribe_for_properties) + 1) *
+				sizeof(u32);
+	} else if (port == OUTPUT_PORT) {
+		for (i = 0; i < ARRAY_SIZE(msm_venc_output_subscribe_for_properties); i++)
+			payload[i + 1] = msm_venc_output_subscribe_for_properties[i];
+		payload_size = (ARRAY_SIZE(msm_venc_output_subscribe_for_properties) + 1) *
+				sizeof(u32);
+	} else {
+		i_vpr_e(inst, "%s: invalid port: %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_SUBSCRIBE_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			payload_size);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_venc_metadata_delivery(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 payload[32] = {0};
+	u32 i, count = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	payload[0] = HFI_MODE_METADATA;
+
+	if (port == INPUT_PORT) {
+		for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+			if (is_meta_tx_inp_enabled(inst, i)) {
+				if (count + 1 >= sizeof(payload) / sizeof(u32)) {
+					i_vpr_e(inst,
+						"%s: input metadatas (%u) exceeded limit (%lu)\n",
+						__func__, count, sizeof(payload) / sizeof(u32));
+					return -EINVAL;
+				}
+				payload[count + 1] = inst->capabilities[i].hfi_id;
+				count++;
+			}
+		}
+	} else if (port == OUTPUT_PORT) {
+		for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+			if (is_meta_tx_out_enabled(inst, i)) {
+				if (count + 1 >= sizeof(payload) / sizeof(u32)) {
+					i_vpr_e(inst,
+						"%s: input metadatas (%u) exceeded limit (%lu)\n",
+						__func__, count, sizeof(payload) / sizeof(u32));
+					return -EINVAL;
+				}
+				payload[count + 1] = inst->capabilities[i].hfi_id;
+				count++;
+			}
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid port: %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_DELIVERY_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			(count + 1) * sizeof(u32));
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_venc_dynamic_metadata_delivery(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 payload[32] = {0};
+	u32 i, count = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	payload[0] = HFI_MODE_DYNAMIC_METADATA;
+
+	if (port != INPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port: %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+		if (is_dyn_meta_tx_inp_enabled(inst, i)) {
+			if (count + 1 >= sizeof(payload) / sizeof(u32)) {
+				i_vpr_e(inst,
+					"%s: dynamic input metadatas (%u) exceeded limit (%lu)\n",
+					__func__, count, sizeof(payload) / sizeof(u32));
+				return -EINVAL;
+			}
+			payload[count + 1] = inst->capabilities[i].hfi_id;
+			count++;
+		}
+	}
+
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_DELIVERY_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			(count + 1) * sizeof(u32));
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int msm_venc_metadata_subscription(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	u32 payload[32] = {0};
+	u32 i, count = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	payload[0] = HFI_MODE_METADATA;
+
+	if (port == INPUT_PORT) {
+		for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+			if (is_meta_rx_inp_enabled(inst, i)) {
+				if (count + 1 >= sizeof(payload) / sizeof(u32)) {
+					i_vpr_e(inst,
+						"%s: input metadatas (%u) exceeded limit (%lu)\n",
+						__func__, count, sizeof(payload) / sizeof(u32));
+					return -EINVAL;
+				}
+				payload[count + 1] = inst->capabilities[i].hfi_id;
+				count++;
+			}
+		}
+	} else if (port == OUTPUT_PORT) {
+		for (i = INST_CAP_NONE + 1; i < INST_CAP_MAX; i++) {
+			if (is_meta_rx_out_enabled(inst, i)) {
+				if (count + 1 >= sizeof(payload) / sizeof(u32)) {
+					i_vpr_e(inst,
+						"%s: input metadatas (%u) exceeded limit (%lu)\n",
+						__func__, count, sizeof(payload) / sizeof(u32));
+					return -EINVAL;
+				}
+				payload[count + 1] = inst->capabilities[i].hfi_id;
+				count++;
+			}
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid port: %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	rc = venus_hfi_session_command(inst,
+			HFI_CMD_SUBSCRIBE_MODE,
+			port,
+			HFI_PAYLOAD_U32_ARRAY,
+			&payload[0],
+			(count + 1) * sizeof(u32));
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_venc_streamoff_input(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = msm_vidc_session_streamoff(inst, INPUT_PORT);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+int msm_venc_streamon_input(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	if (is_input_meta_enabled(inst) &&
+		!inst->bufq[INPUT_META_PORT].vb2q->streaming) {
+		i_vpr_e(inst,
+			"%s: Meta port must be streamed on before data port\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	rc = msm_vidc_check_session_supported(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vidc_check_scaling_supported(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_set_input_properties(inst);
+	if (rc)
+		goto error;
+
+	/* Decide bse vpp delay after work mode */
+	//msm_vidc_set_bse_vpp_delay(inst);
+
+	rc = msm_venc_get_input_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_destroy_internal_buffers(inst, INPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_create_input_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_queue_input_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_property_subscription(inst, INPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_metadata_delivery(inst, INPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_dynamic_metadata_delivery(inst, INPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vidc_process_streamon_input(inst);
+	if (rc)
+		goto error;
+
+	return 0;
+
+error:
+	i_vpr_e(inst, "%s: failed\n", __func__);
+	return rc;
+}
+
+int msm_venc_qbuf(struct msm_vidc_inst *inst, struct vb2_buffer *vb2)
+{
+	int rc = 0;
+
+	rc = msm_vidc_queue_buffer_single(inst, vb2);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_venc_stop_cmd(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	i_vpr_h(inst, "received cmd: drain\n");
+	rc = msm_vidc_process_drain(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_venc_start_cmd(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	i_vpr_h(inst, "received cmd: resume\n");
+
+	vb2_clear_last_buffer_dequeued(inst->bufq[OUTPUT_META_PORT].vb2q);
+	vb2_clear_last_buffer_dequeued(inst->bufq[OUTPUT_PORT].vb2q);
+
+	/* tune power features */
+	msm_vidc_allow_dcvs(inst);
+	msm_vidc_power_data_reset(inst);
+
+	/* print final buffer counts & size details */
+	msm_vidc_print_buffer_info(inst);
+
+	/* print internal buffer memory usage stats */
+	msm_vidc_print_memory_stats(inst);
+
+	rc = msm_vidc_process_resume(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_venc_streamoff_output(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	/* restore LAYER_COUNT max allowed value */
+	inst->capabilities[ENH_LAYER_COUNT].max =
+		core->capabilities[MAX_ENH_LAYER_COUNT].value;
+
+	rc = msm_vidc_session_streamoff(inst, OUTPUT_PORT);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+int msm_venc_streamon_output(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	if (is_output_meta_enabled(inst) &&
+		!inst->bufq[OUTPUT_META_PORT].vb2q->streaming) {
+		i_vpr_e(inst,
+			"%s: Meta port must be streamed on before data port\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	rc = msm_venc_set_output_properties(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_vidc_set_v4l2_properties(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_set_internal_properties(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_get_output_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_destroy_internal_buffers(inst, OUTPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_create_output_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_queue_output_internal_buffers(inst);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_property_subscription(inst, OUTPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_venc_metadata_subscription(inst, OUTPUT_PORT);
+	if (rc)
+		goto error;
+
+	rc = msm_vidc_process_streamon_output(inst);
+	if (rc)
+		goto error;
+
+	return 0;
+
+error:
+	i_vpr_e(inst, "%s: failed\n", __func__);
+	msm_venc_streamoff_output(inst);
+	return rc;
+}
+
+int msm_venc_try_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+	struct v4l2_pix_format_mplane *pixmp = &f->fmt.pix_mp;
+	u32 pix_fmt;
+
+	memset(pixmp->reserved, 0, sizeof(pixmp->reserved));
+
+	if (f->type == INPUT_MPLANE) {
+		pix_fmt = v4l2_colorformat_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+		if (!pix_fmt) {
+			i_vpr_e(inst, "%s: unsupported format, set current params\n", __func__);
+			f->fmt.pix_mp.pixelformat = inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat;
+			f->fmt.pix_mp.width = inst->fmts[INPUT_PORT].fmt.pix_mp.width;
+			f->fmt.pix_mp.height = inst->fmts[INPUT_PORT].fmt.pix_mp.height;
+			pix_fmt = v4l2_colorformat_to_driver(inst,
+				f->fmt.pix_mp.pixelformat, __func__);
+		}
+	} else if (f->type == OUTPUT_MPLANE) {
+		pix_fmt = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+		if (!pix_fmt) {
+			i_vpr_e(inst, "%s: unsupported codec, set current params\n", __func__);
+			f->fmt.pix_mp.width = inst->fmts[OUTPUT_PORT].fmt.pix_mp.width;
+			f->fmt.pix_mp.height = inst->fmts[OUTPUT_PORT].fmt.pix_mp.height;
+			f->fmt.pix_mp.pixelformat = inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat;
+		}
+	} else if (f->type == INPUT_META_PLANE) {
+		f->fmt.meta.dataformat = inst->fmts[INPUT_META_PORT].fmt.meta.dataformat;
+		f->fmt.meta.buffersize = inst->fmts[INPUT_META_PORT].fmt.meta.buffersize;
+	} else if (f->type == OUTPUT_META_PLANE) {
+		f->fmt.meta.dataformat = inst->fmts[OUTPUT_META_PORT].fmt.meta.dataformat;
+		f->fmt.meta.buffersize = inst->fmts[OUTPUT_META_PORT].fmt.meta.buffersize;
+	} else {
+		i_vpr_e(inst, "%s: invalid type %d\n", __func__, f->type);
+		return -EINVAL;
+	}
+
+	if (pixmp->field == V4L2_FIELD_ANY)
+		pixmp->field = V4L2_FIELD_NONE;
+	pixmp->num_planes = 1;
+
+	return rc;
+}
+
+int msm_venc_s_fmt_output(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+	struct v4l2_format *fmt;
+	struct msm_vidc_core *core;
+	u32 codec_align;
+	u32 width, height;
+	enum msm_vidc_codec_type codec;
+
+	core = inst->core;
+	msm_venc_try_fmt(inst, f);
+
+	fmt = &inst->fmts[OUTPUT_PORT];
+	if (fmt->fmt.pix_mp.pixelformat != f->fmt.pix_mp.pixelformat) {
+		rc = msm_venc_codec_change(inst, f->fmt.pix_mp.pixelformat);
+		if (rc)
+			return rc;
+	}
+	fmt->type = OUTPUT_MPLANE;
+
+	codec = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+
+	codec_align = (codec == MSM_VIDC_HEVC ||
+		codec == MSM_VIDC_HEIC) ? 32 : 16;
+	/* use rotated width height if rotation is enabled */
+	width = inst->compose.width;
+	height = inst->compose.height;
+	if (is_rotation_90_or_270(inst)) {
+		width = inst->compose.height;
+		height = inst->compose.width;
+	}
+	/* width, height is readonly for client */
+	fmt->fmt.pix_mp.width = ALIGN(width, codec_align);
+	fmt->fmt.pix_mp.height = ALIGN(height, codec_align);
+	/* use grid dimension for image session */
+	if (is_image_session(inst))
+		fmt->fmt.pix_mp.width = fmt->fmt.pix_mp.height =
+			inst->capabilities[GRID_SIZE].value;
+	fmt->fmt.pix_mp.num_planes = 1;
+	fmt->fmt.pix_mp.plane_fmt[0].bytesperline = 0;
+	fmt->fmt.pix_mp.plane_fmt[0].sizeimage = call_session_op(core,
+		buffer_size, inst, MSM_VIDC_BUF_OUTPUT);
+	/* video hw supports conversion to V4L2_COLORSPACE_REC709 only */
+	if (f->fmt.pix_mp.colorspace != V4L2_COLORSPACE_DEFAULT &&
+	    f->fmt.pix_mp.colorspace != V4L2_COLORSPACE_REC709)
+		f->fmt.pix_mp.colorspace = V4L2_COLORSPACE_DEFAULT;
+	fmt->fmt.pix_mp.colorspace = f->fmt.pix_mp.colorspace;
+	fmt->fmt.pix_mp.xfer_func = f->fmt.pix_mp.xfer_func;
+	fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+	fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization;
+	inst->buffers.output.min_count = call_session_op(core,
+		min_count, inst, MSM_VIDC_BUF_OUTPUT);
+	inst->buffers.output.extra_count = call_session_op(core,
+		extra_count, inst, MSM_VIDC_BUF_OUTPUT);
+	if (inst->buffers.output.actual_count <
+		inst->buffers.output.min_count +
+		inst->buffers.output.extra_count) {
+		inst->buffers.output.actual_count =
+			inst->buffers.output.min_count +
+			inst->buffers.output.extra_count;
+	}
+	inst->buffers.output.size =
+		fmt->fmt.pix_mp.plane_fmt[0].sizeimage;
+
+	/* reset metadata buffer size with updated resolution*/
+	msm_vidc_update_meta_port_settings(inst);
+
+	i_vpr_h(inst,
+		"%s: type: OUTPUT, codec %s width %d height %d size %u min_count %d extra_count %d\n",
+		__func__, v4l2_pixelfmt_name(inst, fmt->fmt.pix_mp.pixelformat),
+		fmt->fmt.pix_mp.width, fmt->fmt.pix_mp.height,
+		fmt->fmt.pix_mp.plane_fmt[0].sizeimage,
+		inst->buffers.output.min_count,
+		inst->buffers.output.extra_count);
+
+	/* finally update client format */
+	memcpy(f, fmt, sizeof(struct v4l2_format));
+	return rc;
+}
+
+static int msm_venc_s_fmt_output_meta(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+	struct v4l2_format *fmt;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	fmt = &inst->fmts[OUTPUT_META_PORT];
+	fmt->type = OUTPUT_META_PLANE;
+	fmt->fmt.meta.dataformat =
+		v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+	fmt->fmt.meta.buffersize = call_session_op(core,
+		buffer_size, inst, MSM_VIDC_BUF_OUTPUT_META);
+	inst->buffers.output_meta.min_count =
+			inst->buffers.output.min_count;
+	inst->buffers.output_meta.extra_count =
+			inst->buffers.output.extra_count;
+	inst->buffers.output_meta.actual_count =
+			inst->buffers.output.actual_count;
+	inst->buffers.output_meta.size = fmt->fmt.meta.buffersize;
+
+	memcpy(f, fmt, sizeof(struct v4l2_format));
+
+	i_vpr_h(inst, "%s: type: OUTPUT_META, size %u min_count %d extra_count %d\n",
+		__func__, fmt->fmt.meta.buffersize,
+		inst->buffers.output_meta.min_count,
+		inst->buffers.output_meta.extra_count);
+
+	return rc;
+}
+
+static int msm_venc_s_fmt_input(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+	struct v4l2_format *fmt, *output_fmt;
+	struct msm_vidc_core *core;
+	u32 pix_fmt, width, height, size, bytesperline;
+
+	core = inst->core;
+	msm_venc_try_fmt(inst, f);
+
+	pix_fmt = v4l2_colorformat_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+	msm_vidc_update_cap_value(inst, PIX_FMTS, pix_fmt, __func__);
+
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+
+	if (is_image_session(inst)) {
+		bytesperline = ALIGN(f->fmt.pix_mp.width,
+			inst->capabilities[GRID_SIZE].value) *
+			(is_10bit_colorformat(pix_fmt) ? 2 : 1);
+	} else if (is_rgba_colorformat(pix_fmt)) {
+		bytesperline = video_rgb_stride_bytes(pix_fmt, f->fmt.pix_mp.width);
+	} else {
+		bytesperline = video_y_stride_bytes(pix_fmt, f->fmt.pix_mp.width);
+	}
+
+	fmt = &inst->fmts[INPUT_PORT];
+	fmt->type = INPUT_MPLANE;
+	fmt->fmt.pix_mp.width = video_y_stride_pix(pix_fmt, width);
+	fmt->fmt.pix_mp.height = video_y_scanlines(pix_fmt, height);
+	fmt->fmt.pix_mp.num_planes = 1;
+	fmt->fmt.pix_mp.pixelformat = f->fmt.pix_mp.pixelformat;
+	fmt->fmt.pix_mp.plane_fmt[0].bytesperline = bytesperline;
+	size = call_session_op(core, buffer_size, inst, MSM_VIDC_BUF_INPUT);
+	fmt->fmt.pix_mp.plane_fmt[0].sizeimage = size;
+	/* update input port colorspace info */
+	fmt->fmt.pix_mp.colorspace = f->fmt.pix_mp.colorspace;
+	fmt->fmt.pix_mp.xfer_func = f->fmt.pix_mp.xfer_func;
+	fmt->fmt.pix_mp.ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+	fmt->fmt.pix_mp.quantization = f->fmt.pix_mp.quantization;
+	/*
+	 * Update output port colorspace info.
+	 * NOTE: If client needs CSC, then client needs to ensure setting
+	 * output port color after setting input color info.
+	 */
+	output_fmt = &inst->fmts[OUTPUT_PORT];
+	output_fmt->fmt.pix_mp.colorspace = fmt->fmt.pix_mp.colorspace;
+	output_fmt->fmt.pix_mp.xfer_func = fmt->fmt.pix_mp.xfer_func;
+	output_fmt->fmt.pix_mp.ycbcr_enc = fmt->fmt.pix_mp.ycbcr_enc;
+	output_fmt->fmt.pix_mp.quantization = fmt->fmt.pix_mp.quantization;
+
+	inst->buffers.input.min_count = call_session_op(core,
+		min_count, inst, MSM_VIDC_BUF_INPUT);
+	inst->buffers.input.extra_count = call_session_op(core,
+		extra_count, inst, MSM_VIDC_BUF_INPUT);
+	if (inst->buffers.input.actual_count <
+		inst->buffers.input.min_count +
+		inst->buffers.input.extra_count) {
+		inst->buffers.input.actual_count =
+			inst->buffers.input.min_count +
+			inst->buffers.input.extra_count;
+	}
+	inst->buffers.input.size = size;
+
+	if (f->fmt.pix_mp.width != inst->crop.width ||
+		f->fmt.pix_mp.height != inst->crop.height) {
+
+		/* reset crop dimensions with updated resolution */
+		inst->crop.top = inst->crop.left = 0;
+		inst->crop.width = f->fmt.pix_mp.width;
+		inst->crop.height = f->fmt.pix_mp.height;
+
+		/* reset compose dimensions with updated resolution */
+		inst->compose.top = inst->compose.left = 0;
+		inst->compose.width = f->fmt.pix_mp.width;
+		inst->compose.height = f->fmt.pix_mp.height;
+
+		/* update output format */
+		rc = msm_venc_s_fmt_output(inst, output_fmt);
+		if (rc)
+			return rc;
+	}
+
+	/* reset metadata buffer size with updated resolution*/
+	msm_vidc_update_meta_port_settings(inst);
+
+	i_vpr_h(inst,
+		"%s: type: INPUT, format %s width %d height %d size %u min_count %d extra_count %d\n",
+		__func__, v4l2_pixelfmt_name(inst, fmt->fmt.pix_mp.pixelformat),
+		fmt->fmt.pix_mp.width, fmt->fmt.pix_mp.height,
+		fmt->fmt.pix_mp.plane_fmt[0].sizeimage,
+		inst->buffers.input.min_count,
+		inst->buffers.input.extra_count);
+
+	/* finally update client format */
+	memcpy(f, fmt, sizeof(struct v4l2_format));
+
+	return rc;
+}
+
+static int msm_venc_s_fmt_input_meta(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+	struct v4l2_format *fmt;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	fmt = &inst->fmts[INPUT_META_PORT];
+	fmt->type = INPUT_META_PLANE;
+	fmt->fmt.meta.dataformat =
+		v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+	fmt->fmt.meta.buffersize = call_session_op(core,
+		buffer_size, inst, MSM_VIDC_BUF_INPUT_META);
+	inst->buffers.input_meta.min_count =
+			inst->buffers.input.min_count;
+	inst->buffers.input_meta.extra_count =
+			inst->buffers.input.extra_count;
+	inst->buffers.input_meta.actual_count =
+			inst->buffers.input.actual_count;
+	inst->buffers.input_meta.size = fmt->fmt.meta.buffersize;
+
+	memcpy(f, fmt, sizeof(struct v4l2_format));
+
+	i_vpr_h(inst, "%s: type: INPUT_META, size %u min_count %d extra_count %d\n",
+		__func__, fmt->fmt.meta.buffersize,
+		inst->buffers.input_meta.min_count,
+		inst->buffers.input_meta.extra_count);
+
+	return rc;
+}
+
+int msm_venc_s_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+
+	if (f->type == INPUT_MPLANE) {
+		rc = msm_venc_s_fmt_input(inst, f);
+		if (rc)
+			goto exit;
+	} else if (f->type == INPUT_META_PLANE) {
+		rc = msm_venc_s_fmt_input_meta(inst, f);
+		if (rc)
+			goto exit;
+	} else if (f->type == OUTPUT_MPLANE) {
+		rc = msm_venc_s_fmt_output(inst, f);
+		if (rc)
+			goto exit;
+	} else if (f->type == OUTPUT_META_PLANE) {
+		rc = msm_venc_s_fmt_output_meta(inst, f);
+		if (rc)
+			goto exit;
+	} else {
+		i_vpr_e(inst, "%s: invalid type %d\n", __func__, f->type);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+exit:
+	if (rc)
+		i_vpr_e(inst, "%s: failed\n", __func__);
+
+	return rc;
+}
+
+int msm_venc_g_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+	int port;
+
+	port = v4l2_type_to_driver_port(inst, f->type, __func__);
+	if (port < 0)
+		return -EINVAL;
+
+	memcpy(f, &inst->fmts[port], sizeof(struct v4l2_format));
+
+	return rc;
+}
+
+int msm_venc_s_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s)
+{
+	int rc = 0;
+	struct v4l2_format *output_fmt;
+
+	if (s->type != INPUT_MPLANE && s->type != V4L2_BUF_TYPE_VIDEO_OUTPUT) {
+		i_vpr_e(inst, "%s: invalid type %d\n", __func__, s->type);
+		return -EINVAL;
+	}
+
+	switch (s->target) {
+	case V4L2_SEL_TGT_CROP:
+		if (s->r.left || s->r.top) {
+			i_vpr_h(inst, "%s: unsupported top %d or left %d\n",
+				__func__, s->r.left, s->r.top);
+			s->r.left = s->r.top = 0;
+		}
+		if (s->r.width > inst->fmts[INPUT_PORT].fmt.pix_mp.width) {
+			i_vpr_h(inst, "%s: unsupported width %d, fmt width %d\n",
+				__func__, s->r.width,
+				inst->fmts[INPUT_PORT].fmt.pix_mp.width);
+			s->r.width = inst->fmts[INPUT_PORT].fmt.pix_mp.width;
+		}
+		if (s->r.height > inst->fmts[INPUT_PORT].fmt.pix_mp.height) {
+			i_vpr_h(inst, "%s: unsupported height %d, fmt height %d\n",
+				__func__, s->r.height,
+				inst->fmts[INPUT_PORT].fmt.pix_mp.height);
+			s->r.height = inst->fmts[INPUT_PORT].fmt.pix_mp.height;
+		}
+
+		inst->crop.left = s->r.left;
+		inst->crop.top = s->r.top;
+		inst->crop.width = s->r.width;
+		inst->crop.height = s->r.height;
+		/* adjust compose such that it is within crop */
+		inst->compose.left = inst->crop.left;
+		inst->compose.top = inst->crop.top;
+		inst->compose.width = inst->crop.width;
+		inst->compose.height = inst->crop.height;
+		/* update output format based on new crop dimensions */
+		output_fmt = &inst->fmts[OUTPUT_PORT];
+		rc = msm_venc_s_fmt_output(inst, output_fmt);
+		if (rc)
+			return rc;
+		break;
+	case V4L2_SEL_TGT_COMPOSE:
+		if (s->r.left < inst->crop.left) {
+			i_vpr_e(inst,
+				"%s: compose left (%d) less than crop left (%d)\n",
+				__func__, s->r.left, inst->crop.left);
+			s->r.left = inst->crop.left;
+		}
+		if (s->r.top < inst->crop.top) {
+			i_vpr_e(inst,
+				"%s: compose top (%d) less than crop top (%d)\n",
+				__func__, s->r.top, inst->crop.top);
+			s->r.top = inst->crop.top;
+		}
+		if (s->r.width > inst->crop.width) {
+			i_vpr_e(inst,
+				"%s: compose width (%d) greate than crop width (%d)\n",
+				__func__, s->r.width, inst->crop.width);
+			s->r.width = inst->crop.width;
+		}
+		if (s->r.height > inst->crop.height) {
+			i_vpr_e(inst,
+				"%s: compose height (%d) greate than crop height (%d)\n",
+				__func__, s->r.height, inst->crop.height);
+			s->r.height = inst->crop.height;
+		}
+		inst->compose.left = s->r.left;
+		inst->compose.top = s->r.top;
+		inst->compose.width = s->r.width;
+		inst->compose.height = s->r.height;
+
+		if (is_scaling_enabled(inst)) {
+			i_vpr_h(inst,
+				"%s: scaling enabled, crop: l %d t %d w %d h %d compose: l %d t %d w %d h %d\n",
+				__func__, inst->crop.left, inst->crop.top,
+				inst->crop.width, inst->crop.height,
+				inst->compose.left, inst->compose.top,
+				inst->compose.width, inst->compose.height);
+		}
+
+		/* update output format based on new compose dimensions */
+		output_fmt = &inst->fmts[OUTPUT_PORT];
+		rc = msm_venc_s_fmt_output(inst, output_fmt);
+		if (rc)
+			return rc;
+		break;
+	default:
+		i_vpr_e(inst, "%s: invalid target %d\n",
+				__func__, s->target);
+		rc = -EINVAL;
+		break;
+	}
+	if (!rc)
+		i_vpr_h(inst, "%s: target %d, r [%d, %d, %d, %d]\n",
+			__func__, s->target, s->r.top, s->r.left,
+			s->r.width, s->r.height);
+	return rc;
+}
+
+int msm_venc_g_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s)
+{
+	int rc = 0;
+
+	if (s->type != INPUT_MPLANE && s->type != V4L2_BUF_TYPE_VIDEO_OUTPUT) {
+		i_vpr_e(inst, "%s: invalid type %d\n", __func__, s->type);
+		return -EINVAL;
+	}
+
+	switch (s->target) {
+	case V4L2_SEL_TGT_CROP_BOUNDS:
+	case V4L2_SEL_TGT_CROP_DEFAULT:
+	case V4L2_SEL_TGT_CROP:
+		s->r.left = inst->crop.left;
+		s->r.top = inst->crop.top;
+		s->r.width = inst->crop.width;
+		s->r.height = inst->crop.height;
+		break;
+	case V4L2_SEL_TGT_COMPOSE_BOUNDS:
+	case V4L2_SEL_TGT_COMPOSE_PADDED:
+	case V4L2_SEL_TGT_COMPOSE_DEFAULT:
+	case V4L2_SEL_TGT_COMPOSE:
+		s->r.left = inst->compose.left;
+		s->r.top = inst->compose.top;
+		s->r.width = inst->compose.width;
+		s->r.height = inst->compose.height;
+		break;
+	default:
+		i_vpr_e(inst, "%s: invalid target %d\n",
+			__func__, s->target);
+		rc = -EINVAL;
+		break;
+	}
+	if (!rc)
+		i_vpr_h(inst, "%s: target %d, r [%d, %d, %d, %d]\n",
+			__func__, s->target, s->r.top, s->r.left,
+			s->r.width, s->r.height);
+	return rc;
+}
+
+int msm_venc_s_param(struct msm_vidc_inst *inst,
+		struct v4l2_streamparm *s_parm)
+{
+	int rc = 0;
+	struct v4l2_fract *timeperframe = NULL;
+	u32 input_rate_q16, max_rate_q16;
+	u32 input_rate, default_rate;
+	bool is_frame_rate = false;
+
+	if (s_parm->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		/* operating rate */
+		timeperframe = &s_parm->parm.output.timeperframe;
+		max_rate_q16 = inst->capabilities[OPERATING_RATE].max;
+		default_rate = inst->capabilities[OPERATING_RATE].value >> 16;
+		s_parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
+	} else {
+		/* frame rate */
+		timeperframe = &s_parm->parm.capture.timeperframe;
+		is_frame_rate = true;
+		max_rate_q16 = inst->capabilities[FRAME_RATE].max;
+		default_rate = inst->capabilities[FRAME_RATE].value >> 16;
+		s_parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME;
+	}
+
+	if (!timeperframe->denominator || !timeperframe->numerator) {
+		i_vpr_e(inst, "%s: type %s, invalid rate, update with default\n",
+			 __func__, v4l2_type_name(s_parm->type));
+		if (!timeperframe->numerator)
+			timeperframe->numerator = 1;
+		if (!timeperframe->denominator)
+			timeperframe->denominator = default_rate;
+	}
+
+	input_rate = (timeperframe->denominator / timeperframe->numerator);
+	if (input_rate > (max_rate_q16 >> 16)) {
+		input_rate_q16 = max_rate_q16;
+		i_vpr_h(inst, "%s: type %s, %s value %u limited to %u\n",
+			__func__, v4l2_type_name(s_parm->type),
+			is_frame_rate ? "frame rate" : "operating rate",
+			input_rate_q16, max_rate_q16);
+	} else {
+		input_rate_q16 = input_rate << 16;
+		input_rate_q16 |=
+			(timeperframe->denominator % timeperframe->numerator);
+	}
+
+	i_vpr_h(inst, "%s: type %s, %s value %u.%u\n",
+		__func__, v4l2_type_name(s_parm->type),
+		is_frame_rate ? "frame rate" : "operating rate",
+		input_rate_q16 >> 16, input_rate_q16 & 0xffff);
+
+	msm_vidc_update_cap_value(inst, is_frame_rate ? FRAME_RATE : OPERATING_RATE,
+		input_rate_q16, __func__);
+	if (is_realtime_session(inst) &&
+		((s_parm->type == INPUT_MPLANE && inst->bufq[INPUT_PORT].vb2q->streaming) ||
+		(s_parm->type == OUTPUT_MPLANE && inst->bufq[OUTPUT_PORT].vb2q->streaming))) {
+		rc = msm_vidc_check_core_mbps(inst);
+		if (rc) {
+			i_vpr_e(inst, "%s: unsupported load\n", __func__);
+			goto reset_rate;
+		}
+	}
+
+	if (is_frame_rate)
+		inst->capabilities[FRAME_RATE].flags |= CAP_FLAG_CLIENT_SET;
+	else
+		inst->capabilities[OPERATING_RATE].flags |= CAP_FLAG_CLIENT_SET;
+	/*
+	 * In static case, frame rate is set via
+	 * inst database set function mentioned in
+	 * FRAME_RATE cap id.
+	 * In dynamic case, frame rate is set like below.
+	 */
+	if (inst->bufq[OUTPUT_PORT].vb2q->streaming) {
+		rc = venus_hfi_session_property(inst,
+			HFI_PROP_FRAME_RATE,
+			HFI_HOST_FLAGS_NONE,
+			HFI_PORT_BITSTREAM,
+			HFI_PAYLOAD_Q16,
+			&input_rate_q16,
+			sizeof(u32));
+		if (rc) {
+			i_vpr_e(inst,
+				"%s: failed to set frame rate to fw\n", __func__);
+			goto exit;
+		}
+		inst->auto_framerate = input_rate_q16;
+	}
+
+	return 0;
+
+reset_rate:
+	if (rc) {
+		i_vpr_e(inst, "%s: setting rate %u failed, reset to %u\n", __func__,
+			input_rate_q16 >> 16, default_rate);
+		msm_vidc_update_cap_value(inst, is_frame_rate ? FRAME_RATE : OPERATING_RATE,
+			default_rate << 16, __func__);
+	}
+exit:
+	return rc;
+}
+
+int msm_venc_g_param(struct msm_vidc_inst *inst,
+		struct v4l2_streamparm *s_parm)
+{
+	struct v4l2_fract *timeperframe = NULL;
+
+	if (s_parm->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		timeperframe = &s_parm->parm.output.timeperframe;
+		timeperframe->numerator = 1;
+		timeperframe->denominator =
+			inst->capabilities[OPERATING_RATE].value >> 16;
+		s_parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
+	} else {
+		timeperframe = &s_parm->parm.capture.timeperframe;
+		timeperframe->numerator = 1;
+		timeperframe->denominator =
+			inst->capabilities[FRAME_RATE].value >> 16;
+		s_parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME;
+	}
+
+	i_vpr_h(inst, "%s: type %s, num %u denom %u\n",
+		__func__, v4l2_type_name(s_parm->type), timeperframe->numerator,
+		timeperframe->denominator);
+	return 0;
+}
+
+int msm_venc_subscribe_event(struct msm_vidc_inst *inst,
+		const struct v4l2_event_subscription *sub)
+{
+	int rc = 0;
+
+	switch (sub->type) {
+	case V4L2_EVENT_EOS:
+		rc = v4l2_event_subscribe(&inst->fh, sub, MAX_EVENTS, NULL);
+		break;
+	case V4L2_EVENT_CTRL:
+		rc = v4l2_ctrl_subscribe_event(&inst->fh, sub);
+		break;
+	default:
+		i_vpr_e(inst, "%s: invalid type %d id %d\n", __func__, sub->type, sub->id);
+		return -EINVAL;
+	}
+
+	if (rc)
+		i_vpr_e(inst, "%s: failed, type %d id %d\n",
+			__func__, sub->type, sub->id);
+	return rc;
+}
+
+int msm_venc_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	u32 array[32] = {0};
+	u32 i = 0;
+
+	if (f->index >= ARRAY_SIZE(array)) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+
+	if (f->type == OUTPUT_MPLANE) {
+		u32 codecs = core->capabilities[ENC_CODECS].value;
+		u32 idx = 0;
+
+		for (i = 0; i <= 31; i++) {
+			if (codecs & BIT(i)) {
+				if (idx >= ARRAY_SIZE(array))
+					break;
+				/* v4l2-compliance does not support private codecs */
+				if ((codecs & BIT(i)) == MSM_VIDC_HEIC)
+					continue;
+				array[idx] = codecs & BIT(i);
+				idx++;
+			}
+		}
+		if (!array[f->index])
+			return -EINVAL;
+		f->pixelformat = v4l2_codec_from_driver(inst, array[f->index],
+				__func__);
+		if (!f->pixelformat)
+			return -EINVAL;
+		f->flags = V4L2_FMT_FLAG_COMPRESSED;
+		strscpy(f->description, "codec", sizeof(f->description));
+	} else if (f->type == INPUT_MPLANE) {
+		u32 formats = inst->capabilities[PIX_FMTS].step_or_mask;
+		u32 idx = 0;
+
+		for (i = 0; i <= 31; i++) {
+			if (formats & BIT(i)) {
+				if (idx >= ARRAY_SIZE(array))
+					break;
+				array[idx] = formats & BIT(i);
+				idx++;
+			}
+		}
+		if (!array[f->index])
+			return -EINVAL;
+		f->pixelformat = v4l2_colorformat_from_driver(inst, array[f->index],
+				__func__);
+		if (!f->pixelformat)
+			return -EINVAL;
+		strscpy(f->description, "colorformat", sizeof(f->description));
+	} else if (f->type == INPUT_META_PLANE || f->type == OUTPUT_META_PLANE) {
+		if (!f->index) {
+			f->pixelformat =
+				v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+			strscpy(f->description, "metadata", sizeof(f->description));
+		} else {
+			return -EINVAL;
+		}
+	}
+	memset(f->reserved, 0, sizeof(f->reserved));
+
+	i_vpr_h(inst, "%s: index %d, %s: %s, flags %#x\n",
+		__func__, f->index, f->description,
+		v4l2_pixelfmt_name(inst, f->pixelformat), f->flags);
+	return rc;
+}
+
+int msm_venc_inst_init(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct v4l2_format *f;
+	enum msm_vidc_colorformat_type colorformat;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	core = inst->core;
+
+	if (core->capabilities[DCVS].value)
+		inst->power.dcvs_mode = true;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	f->type = OUTPUT_MPLANE;
+	f->fmt.pix_mp.width = DEFAULT_WIDTH;
+	f->fmt.pix_mp.height = DEFAULT_HEIGHT;
+	f->fmt.pix_mp.pixelformat = V4L2_PIX_FMT_H264;
+	f->fmt.pix_mp.num_planes = 1;
+	f->fmt.pix_mp.plane_fmt[0].bytesperline = 0;
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = call_session_op(core,
+		buffer_size, inst, MSM_VIDC_BUF_OUTPUT);
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	f->fmt.pix_mp.colorspace = V4L2_COLORSPACE_DEFAULT;
+	f->fmt.pix_mp.xfer_func = V4L2_XFER_FUNC_DEFAULT;
+	f->fmt.pix_mp.ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+	f->fmt.pix_mp.quantization = V4L2_QUANTIZATION_DEFAULT;
+	inst->buffers.output.min_count = call_session_op(core,
+		min_count, inst, MSM_VIDC_BUF_OUTPUT);
+	inst->buffers.output.extra_count = call_session_op(core,
+		extra_count, inst, MSM_VIDC_BUF_OUTPUT);
+	inst->buffers.output.actual_count =
+			inst->buffers.output.min_count +
+			inst->buffers.output.extra_count;
+	inst->buffers.output.size = f->fmt.pix_mp.plane_fmt[0].sizeimage;
+
+	inst->crop.left = inst->crop.top = 0;
+	inst->crop.width = f->fmt.pix_mp.width;
+	inst->crop.height = f->fmt.pix_mp.height;
+
+	inst->compose.left = inst->compose.top = 0;
+	inst->compose.width = f->fmt.pix_mp.width;
+	inst->compose.height = f->fmt.pix_mp.height;
+
+	f = &inst->fmts[OUTPUT_META_PORT];
+	f->type = OUTPUT_META_PLANE;
+	f->fmt.meta.dataformat =
+		v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+	f->fmt.meta.buffersize = MSM_VIDC_METADATA_SIZE;
+	inst->buffers.output_meta.min_count = 0;
+	inst->buffers.output_meta.extra_count = 0;
+	inst->buffers.output_meta.actual_count = 0;
+	inst->buffers.output_meta.size = 0;
+
+	f = &inst->fmts[INPUT_PORT];
+	f->type = INPUT_MPLANE;
+	f->fmt.pix_mp.pixelformat =
+		v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_NV12C, __func__);
+	f->fmt.pix_mp.width = DEFAULT_WIDTH;
+	f->fmt.pix_mp.height = DEFAULT_HEIGHT;
+	f->fmt.pix_mp.num_planes = 1;
+	colorformat = v4l2_colorformat_to_driver(inst, f->fmt.pix_mp.pixelformat,
+		__func__);
+	f->fmt.pix_mp.plane_fmt[0].bytesperline =
+		video_y_stride_bytes(colorformat, DEFAULT_WIDTH);
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = call_session_op(core,
+		buffer_size, inst, MSM_VIDC_BUF_INPUT);
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	f->fmt.pix_mp.colorspace = V4L2_COLORSPACE_DEFAULT;
+	f->fmt.pix_mp.xfer_func = V4L2_XFER_FUNC_DEFAULT;
+	f->fmt.pix_mp.ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+	f->fmt.pix_mp.quantization = V4L2_QUANTIZATION_DEFAULT;
+	inst->buffers.input.min_count = call_session_op(core,
+		min_count, inst, MSM_VIDC_BUF_INPUT);
+	inst->buffers.input.extra_count = call_session_op(core,
+		extra_count, inst, MSM_VIDC_BUF_INPUT);
+	inst->buffers.input.actual_count =
+			inst->buffers.input.min_count +
+			inst->buffers.input.extra_count;
+	inst->buffers.input.size = f->fmt.pix_mp.plane_fmt[0].sizeimage;
+
+	f = &inst->fmts[INPUT_META_PORT];
+	f->type = INPUT_META_PLANE;
+	f->fmt.meta.dataformat =
+		v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+	f->fmt.meta.buffersize = MSM_VIDC_METADATA_SIZE;
+	inst->buffers.input_meta.min_count = 0;
+	inst->buffers.input_meta.extra_count = 0;
+	inst->buffers.input_meta.actual_count = 0;
+	inst->buffers.input_meta.size = 0;
+
+	inst->hfi_rc_type = HFI_RC_VBR_CFR;
+	inst->hfi_layer_type = HFI_HIER_P_SLIDING_WINDOW;
+
+	rc = msm_venc_codec_change(inst,
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_venc_inst_deinit(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = msm_vidc_ctrl_handler_deinit(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc.c
@@ -0,0 +1,952 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/types.h>
+#include <linux/hash.h>
+
+#include "msm_vidc_core.h"
+#include "msm_vidc_inst.h"
+#include "msm_vdec.h"
+#include "msm_venc.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_vb2.h"
+#include "msm_vidc_v4l2.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_power.h"
+#include "msm_vidc_fence.h"
+#include "msm_vidc_memory.h"
+#include "venus_hfi_response.h"
+#include "msm_vidc.h"
+
+extern const char video_banner[];
+
+#define MSM_VIDC_DRV_NAME "msm_vidc_driver"
+#define MSM_VIDC_BUS_NAME "platform:msm_vidc_bus"
+
+/* kernel/msm-4.19 */
+#define MSM_VIDC_VERSION     ((5 << 16) + (10 << 8) + 0)
+
+static inline bool valid_v4l2_buffer(struct v4l2_buffer *b,
+		struct msm_vidc_inst *inst)
+{
+	if (b->type == INPUT_MPLANE || b->type == OUTPUT_MPLANE)
+		return b->length > 0;
+	else if (b->type == INPUT_META_PLANE || b->type == OUTPUT_META_PLANE)
+		return true;
+
+	return false;
+}
+
+static int get_poll_flags(struct msm_vidc_inst *inst, u32 port)
+{
+	int poll = 0;
+	struct vb2_queue *q = NULL;
+	struct vb2_buffer *vb = NULL;
+	unsigned long flags = 0;
+
+	if (port >= MAX_PORT) {
+		d_vpr_e("%s: invalid params, inst %pK, port %d\n",
+			__func__, inst, port);
+		return poll;
+	}
+	q = inst->bufq[port].vb2q;
+
+	spin_lock_irqsave(&q->done_lock, flags);
+	if (!list_empty(&q->done_list))
+		vb = list_first_entry(&q->done_list, struct vb2_buffer,
+							  done_entry);
+	if (vb && (vb->state == VB2_BUF_STATE_DONE ||
+			   vb->state == VB2_BUF_STATE_ERROR)) {
+		if (port == OUTPUT_PORT || port == OUTPUT_META_PORT)
+			poll |= POLLIN | POLLRDNORM;
+		else if (port == INPUT_PORT || port == INPUT_META_PORT)
+			poll |= POLLOUT | POLLWRNORM;
+	}
+	spin_unlock_irqrestore(&q->done_lock, flags);
+
+	return poll;
+}
+
+int msm_vidc_poll(struct msm_vidc_inst *inst, struct file *filp,
+		struct poll_table_struct *wait)
+{
+	int poll = 0;
+
+	poll_wait(filp, &inst->fh.wait, wait);
+	poll_wait(filp, &inst->bufq[INPUT_META_PORT].vb2q->done_wq, wait);
+	poll_wait(filp, &inst->bufq[OUTPUT_META_PORT].vb2q->done_wq, wait);
+	poll_wait(filp, &inst->bufq[INPUT_PORT].vb2q->done_wq, wait);
+	poll_wait(filp, &inst->bufq[OUTPUT_PORT].vb2q->done_wq, wait);
+
+	if (v4l2_event_pending(&inst->fh))
+		poll |= POLLPRI;
+
+	poll |= get_poll_flags(inst, INPUT_META_PORT);
+	poll |= get_poll_flags(inst, OUTPUT_META_PORT);
+	poll |= get_poll_flags(inst, INPUT_PORT);
+	poll |= get_poll_flags(inst, OUTPUT_PORT);
+
+	return poll;
+}
+
+int msm_vidc_mmap(struct msm_vidc_inst *inst, struct file *filp, struct vm_area_struct *vma)
+{
+	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+	int ret = 0;
+
+	if (offset < SRC_META_QUEUE_OFF_BASE) {
+		ret = vb2_mmap(inst->bufq[INPUT_PORT].vb2q, vma);
+	} else if (offset < DST_QUEUE_OFF_BASE){
+		vma->vm_pgoff -= (SRC_META_QUEUE_OFF_BASE >> PAGE_SHIFT);
+		ret = vb2_mmap(inst->bufq[INPUT_META_PORT].vb2q, vma);
+	} else if (offset < DST_META_QUEUE_OFF_BASE){
+		vma->vm_pgoff -= (DST_QUEUE_OFF_BASE>> PAGE_SHIFT);
+		ret = vb2_mmap(inst->bufq[OUTPUT_PORT].vb2q, vma);
+	} else {
+		vma->vm_pgoff -= (DST_META_QUEUE_OFF_BASE >> PAGE_SHIFT);
+		ret = vb2_mmap(inst->bufq[OUTPUT_META_PORT].vb2q, vma);
+	}
+
+	return ret;
+}
+
+int msm_vidc_querycap(struct msm_vidc_inst *inst, struct v4l2_capability *cap)
+{
+	strscpy(cap->driver, MSM_VIDC_DRV_NAME, sizeof(cap->driver));
+	strscpy(cap->bus_info, MSM_VIDC_BUS_NAME, sizeof(cap->bus_info));
+	cap->version = MSM_VIDC_VERSION;
+
+	memset(cap->reserved, 0, sizeof(cap->reserved));
+
+	if (is_decode_session(inst))
+		strscpy(cap->card, "msm_vidc_decoder", sizeof(cap->card));
+	else if (is_encode_session(inst))
+		strscpy(cap->card, "msm_vidc_encoder", sizeof(cap->card));
+	else
+		return -EINVAL;
+
+	return 0;
+}
+
+int msm_vidc_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f)
+{
+	if (is_decode_session(inst))
+		return msm_vdec_enum_fmt(inst, f);
+	if (is_encode_session(inst))
+		return msm_venc_enum_fmt(inst, f);
+
+	return -EINVAL;
+}
+
+int msm_vidc_query_ctrl(struct msm_vidc_inst *inst, struct v4l2_queryctrl *q_ctrl)
+{
+	int rc = 0;
+	struct v4l2_ctrl *ctrl;
+
+	ctrl = v4l2_ctrl_find(&inst->ctrl_handler, q_ctrl->id);
+	if (!ctrl) {
+		i_vpr_e(inst, "%s: get_ctrl failed for id %d\n",
+			__func__, q_ctrl->id);
+		return -EINVAL;
+	}
+	q_ctrl->minimum = ctrl->minimum;
+	q_ctrl->maximum = ctrl->maximum;
+	q_ctrl->default_value = ctrl->default_value;
+	q_ctrl->flags = 0;
+	q_ctrl->step = ctrl->step;
+	i_vpr_h(inst,
+		"query ctrl: %s: min %d, max %d, default %d step %d flags %#x\n",
+		ctrl->name, q_ctrl->minimum, q_ctrl->maximum,
+		q_ctrl->default_value, q_ctrl->step, q_ctrl->flags);
+	return rc;
+}
+
+int msm_vidc_query_menu(struct msm_vidc_inst *inst, struct v4l2_querymenu *qmenu)
+{
+	int rc = 0;
+	struct v4l2_ctrl *ctrl;
+
+	ctrl = v4l2_ctrl_find(&inst->ctrl_handler, qmenu->id);
+	if (!ctrl) {
+		i_vpr_e(inst, "%s: get_ctrl failed for id %d\n",
+			__func__, qmenu->id);
+		return -EINVAL;
+	}
+	if (ctrl->type != V4L2_CTRL_TYPE_MENU) {
+		i_vpr_e(inst, "%s: ctrl: %s: type (%d) is not MENU type\n",
+			__func__, ctrl->name, ctrl->type);
+		return -EINVAL;
+	}
+	if (qmenu->index < ctrl->minimum || qmenu->index > ctrl->maximum)
+		return -EINVAL;
+
+	if (ctrl->menu_skip_mask & (1 << qmenu->index))
+		rc = -EINVAL;
+
+	i_vpr_h(inst,
+		"%s: ctrl: %s: min %lld, max %lld, menu_skip_mask %lld, qmenu: id %u, index %d, %s\n",
+		__func__, ctrl->name, ctrl->minimum, ctrl->maximum,
+		ctrl->menu_skip_mask, qmenu->id, qmenu->index,
+		rc ? "not supported" : "supported");
+	return rc;
+}
+
+int msm_vidc_try_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+
+	if (is_decode_session(inst))
+		rc = msm_vdec_try_fmt(inst, f);
+	if (is_encode_session(inst))
+		rc = msm_venc_try_fmt(inst, f);
+
+	if (rc)
+		i_vpr_e(inst, "%s: try_fmt(%d) failed %d\n",
+			__func__, f->type, rc);
+	return rc;
+}
+
+int msm_vidc_s_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+
+	if (is_decode_session(inst))
+		rc = msm_vdec_s_fmt(inst, f);
+	if (is_encode_session(inst))
+		rc = msm_venc_s_fmt(inst, f);
+
+	if (rc)
+		i_vpr_e(inst, "%s: s_fmt(%d) failed %d\n",
+			__func__, f->type, rc);
+	return rc;
+}
+
+int msm_vidc_g_fmt(struct msm_vidc_inst *inst, struct v4l2_format *f)
+{
+	int rc = 0;
+
+	if (is_decode_session(inst))
+		rc = msm_vdec_g_fmt(inst, f);
+	if (is_encode_session(inst))
+		rc = msm_venc_g_fmt(inst, f);
+	if (rc)
+		return rc;
+
+	if (f->type == INPUT_MPLANE || f->type == OUTPUT_MPLANE)
+		i_vpr_h(inst, "%s: type %s format %s width %d height %d size %d\n",
+			__func__, v4l2_type_name(f->type),
+			v4l2_pixelfmt_name(inst, f->fmt.pix_mp.pixelformat),
+			f->fmt.pix_mp.width, f->fmt.pix_mp.height,
+			f->fmt.pix_mp.plane_fmt[0].sizeimage);
+	else if (f->type == INPUT_META_PLANE || f->type == OUTPUT_META_PLANE)
+		i_vpr_h(inst, "%s: type %s size %d\n",
+			__func__, v4l2_type_name(f->type), f->fmt.meta.buffersize);
+
+	return 0;
+}
+
+int msm_vidc_s_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s)
+{
+	int rc = 0;
+
+	if (is_decode_session(inst))
+		rc = msm_vdec_s_selection(inst, s);
+	if (is_encode_session(inst))
+		rc = msm_venc_s_selection(inst, s);
+
+	return rc;
+}
+
+int msm_vidc_g_selection(struct msm_vidc_inst *inst, struct v4l2_selection *s)
+{
+	int rc = 0;
+
+	if (is_decode_session(inst))
+		rc = msm_vdec_g_selection(inst, s);
+	if (is_encode_session(inst))
+		rc = msm_venc_g_selection(inst, s);
+
+	return rc;
+}
+
+int msm_vidc_s_param(struct msm_vidc_inst *inst, struct v4l2_streamparm *param)
+{
+	int rc = 0;
+
+	if (param->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE &&
+		param->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
+		return -EINVAL;
+
+	if (is_encode_session(inst)) {
+		rc = msm_venc_s_param(inst, param);
+	} else {
+		i_vpr_e(inst, "%s: invalid domain %#x\n",
+			__func__, inst->domain);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int msm_vidc_g_param(struct msm_vidc_inst *inst, struct v4l2_streamparm *param)
+{
+	int rc = 0;
+
+	if (param->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE &&
+		param->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
+		return -EINVAL;
+
+	if (is_encode_session(inst)) {
+		rc = msm_venc_g_param(inst, param);
+	} else {
+		i_vpr_e(inst, "%s: invalid domain %#x\n",
+			__func__, inst->domain);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int msm_vidc_reqbufs(struct msm_vidc_inst *inst, struct v4l2_requestbuffers *b)
+{
+	int rc = 0;
+	int port;
+
+	port = v4l2_type_to_driver_port(inst, b->type, __func__);
+	if (port < 0) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = vb2_reqbufs(inst->bufq[port].vb2q, b);
+	if (rc) {
+		i_vpr_e(inst, "%s: vb2_reqbufs(%d) failed, %d\n",
+			__func__, b->type, rc);
+		goto exit;
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_querybuf(struct msm_vidc_inst *inst, struct v4l2_buffer *b)
+{
+	int rc = 0;
+	int port;
+
+	port = v4l2_type_to_driver_port(inst, b->type, __func__);
+	if (port < 0) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = vb2_querybuf(inst->bufq[port].vb2q, b);
+	if (rc) {
+		i_vpr_e(inst, "%s: vb2_querybuf(%d) failed, %d\n",
+			__func__, b->type, rc);
+		goto exit;
+	}
+
+	if (b->memory == V4L2_MEMORY_MMAP) {
+		switch (port) {
+		case INPUT_PORT:
+			b->m.planes[0].m.mem_offset += 0;
+			break;
+		case INPUT_META_PORT:
+			b->m.planes[0].m.mem_offset += SRC_META_QUEUE_OFF_BASE;
+			break;
+		case OUTPUT_PORT:
+			b->m.planes[0].m.mem_offset += DST_QUEUE_OFF_BASE;
+			break;
+		case OUTPUT_META_PORT:
+			b->m.planes[0].m.mem_offset += DST_META_QUEUE_OFF_BASE;
+			break;
+		default:
+			break;
+		}
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_create_bufs(struct msm_vidc_inst *inst, struct v4l2_create_buffers *b)
+{
+	int rc = 0;
+	int port;
+	struct v4l2_format *f;
+
+	f = &b->format;
+	port = v4l2_type_to_driver_port(inst, f->type, __func__);
+	if (port < 0) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = vb2_create_bufs(inst->bufq[port].vb2q, b);
+	if (rc) {
+		i_vpr_e(inst, "%s: vb2_create_bufs(%d) failed, %d\n",
+			__func__, f->type, rc);
+		goto exit;
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_prepare_buf(struct msm_vidc_inst *inst, struct media_device *mdev,
+	struct v4l2_buffer *b)
+{
+	int rc = 0;
+	struct vb2_queue *q;
+
+	if (!valid_v4l2_buffer(b, inst)) {
+		d_vpr_e("%s: invalid params %pK %pK\n", __func__, inst, b);
+		return -EINVAL;
+	}
+
+	q = msm_vidc_get_vb2q(inst, b->type, __func__);
+	if (!q) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = vb2_prepare_buf(q, mdev, b);
+	if (rc) {
+		i_vpr_e(inst, "%s: failed with %d\n", __func__, rc);
+		goto exit;
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_exportbuf(struct msm_vidc_inst *inst, struct media_device *mdev,
+		       struct v4l2_exportbuffer *eb)
+{
+	int rc = 0;
+	struct vb2_queue *q;
+
+	q = msm_vidc_get_vb2q(inst, eb->type, __func__);
+	if (!q) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = vb2_expbuf(q, eb);
+	if (rc) {
+		i_vpr_e(inst, "%s: vb2_expbuf(%d) failed, %d\n",
+			__func__, eb->type, rc);
+		goto exit;
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_qbuf(struct msm_vidc_inst *inst, struct media_device *mdev,
+		struct v4l2_buffer *b)
+{
+	int rc = 0;
+	struct vb2_queue *q;
+
+	if (!valid_v4l2_buffer(b, inst)) {
+		d_vpr_e("%s: invalid params %pK %pK\n", __func__, inst, b);
+		return -EINVAL;
+	}
+
+	q = msm_vidc_get_vb2q(inst, b->type, __func__);
+	if (!q) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = vb2_qbuf(q, mdev, b);
+	if (rc)
+		i_vpr_e(inst, "%s: failed with %d\n", __func__, rc);
+
+exit:
+	return rc;
+}
+
+int msm_vidc_dqbuf(struct msm_vidc_inst *inst, struct v4l2_buffer *b)
+{
+	int rc = 0;
+	struct vb2_queue *q;
+
+	if (!valid_v4l2_buffer(b, inst)) {
+		d_vpr_e("%s: invalid params %pK %pK\n", __func__, inst, b);
+		return -EINVAL;
+	}
+
+	q = msm_vidc_get_vb2q(inst, b->type, __func__);
+	if (!q) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = vb2_dqbuf(q, b, true);
+	if (rc == -EAGAIN) {
+		goto exit;
+	} else if (rc) {
+		i_vpr_l(inst, "%s: failed with %d\n", __func__, rc);
+		goto exit;
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_streamon(struct msm_vidc_inst *inst, enum v4l2_buf_type type)
+{
+	int rc = 0;
+	int port;
+
+	port = v4l2_type_to_driver_port(inst, type, __func__);
+	if (port < 0) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = vb2_streamon(inst->bufq[port].vb2q, type);
+	if (rc) {
+		i_vpr_e(inst, "%s: vb2_streamon(%d) failed, %d\n",
+			__func__, type, rc);
+		goto exit;
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_streamoff(struct msm_vidc_inst *inst, enum v4l2_buf_type type)
+{
+	int rc = 0;
+	int port;
+
+	port = v4l2_type_to_driver_port(inst, type, __func__);
+	if (port < 0) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = vb2_streamoff(inst->bufq[port].vb2q, type);
+	if (rc) {
+		i_vpr_e(inst, "%s: vb2_streamoff(%d) failed, %d\n",
+			__func__, type, rc);
+		goto exit;
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_try_cmd(struct msm_vidc_inst *inst, union msm_v4l2_cmd *cmd)
+{
+	int rc = 0;
+	struct v4l2_decoder_cmd *dec = NULL;
+	struct v4l2_encoder_cmd *enc = NULL;
+
+	if (is_decode_session(inst)) {
+		dec = (struct v4l2_decoder_cmd *)cmd;
+		i_vpr_h(inst, "%s: cmd %d\n", __func__, dec->cmd);
+		if (dec->cmd != V4L2_DEC_CMD_STOP && dec->cmd != V4L2_DEC_CMD_START)
+			return -EINVAL;
+		dec->flags = 0;
+		if (dec->cmd == V4L2_DEC_CMD_STOP) {
+			dec->stop.pts = 0;
+		} else if (dec->cmd == V4L2_DEC_CMD_START) {
+			dec->start.speed = 0;
+			dec->start.format = V4L2_DEC_START_FMT_NONE;
+		}
+	} else if (is_encode_session(inst)) {
+		enc = (struct v4l2_encoder_cmd *)cmd;
+		i_vpr_h(inst, "%s: cmd %d\n", __func__, enc->cmd);
+		if (enc->cmd != V4L2_ENC_CMD_STOP && enc->cmd != V4L2_ENC_CMD_START)
+			return -EINVAL;
+		enc->flags = 0;
+	}
+
+	return rc;
+}
+
+int msm_vidc_start_cmd(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	if (!is_decode_session(inst) && !is_encode_session(inst)) {
+		i_vpr_e(inst, "%s: invalid session %d\n", __func__, inst->domain);
+		return -EINVAL;
+	}
+
+	if (is_decode_session(inst)) {
+		rc = msm_vdec_start_cmd(inst);
+		if (rc)
+			return rc;
+	} else if (is_encode_session(inst)) {
+		rc = msm_venc_start_cmd(inst);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+int msm_vidc_stop_cmd(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	if (!is_decode_session(inst) && !is_encode_session(inst)) {
+		i_vpr_e(inst, "%s: invalid session %d\n", __func__, inst->domain);
+		return -EINVAL;
+	}
+
+	if (is_decode_session(inst)) {
+		rc = msm_vdec_stop_cmd(inst);
+		if (rc)
+			return rc;
+	} else if (is_encode_session(inst)) {
+		rc = msm_venc_stop_cmd(inst);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+int msm_vidc_enum_framesizes(struct msm_vidc_inst *inst, struct v4l2_frmsizeenum *fsize)
+{
+	enum msm_vidc_colorformat_type colorfmt;
+	enum msm_vidc_codec_type codec;
+	u32 meta_fmt;
+
+	/* only index 0 allowed as per v4l2 spec */
+	if (fsize->index)
+		return -EINVAL;
+
+	meta_fmt = v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+	if (fsize->pixel_format != meta_fmt) {
+		/* validate pixel format */
+		codec = v4l2_codec_to_driver(inst, fsize->pixel_format, __func__);
+		if (!codec) {
+			colorfmt = v4l2_colorformat_to_driver(inst, fsize->pixel_format,
+				__func__);
+			if (colorfmt == MSM_VIDC_FMT_NONE) {
+				i_vpr_e(inst, "%s: unsupported pix fmt %#x\n",
+					__func__, fsize->pixel_format);
+				return -EINVAL;
+			}
+		}
+	}
+
+	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
+	fsize->stepwise.min_width = inst->capabilities[FRAME_WIDTH].min;
+	fsize->stepwise.max_width = inst->capabilities[FRAME_WIDTH].max;
+	fsize->stepwise.step_width =
+		inst->capabilities[FRAME_WIDTH].step_or_mask;
+	fsize->stepwise.min_height = inst->capabilities[FRAME_HEIGHT].min;
+	fsize->stepwise.max_height = inst->capabilities[FRAME_HEIGHT].max;
+	fsize->stepwise.step_height =
+		inst->capabilities[FRAME_HEIGHT].step_or_mask;
+
+	return 0;
+}
+
+int msm_vidc_enum_frameintervals(struct msm_vidc_inst *inst, struct v4l2_frmivalenum *fival)
+{
+	struct msm_vidc_core *core;
+	enum msm_vidc_colorformat_type colorfmt;
+	u32 fps, mbpf;
+	u32 meta_fmt;
+
+	if (is_decode_session(inst)) {
+		i_vpr_e(inst, "%s: not supported by decoder\n", __func__);
+		return -ENOTTY;
+	}
+
+	core = inst->core;
+
+
+	/* only index 0 allowed as per v4l2 spec */
+	if (fival->index)
+		return -EINVAL;
+
+	meta_fmt = v4l2_colorformat_from_driver(inst, MSM_VIDC_FMT_META, __func__);
+	if (fival->pixel_format != meta_fmt) {
+		/* validate pixel format */
+		colorfmt = v4l2_colorformat_to_driver(inst, fival->pixel_format, __func__);
+		if (colorfmt == MSM_VIDC_FMT_NONE) {
+			i_vpr_e(inst, "%s: unsupported pix fmt %#x\n",
+				__func__, fival->pixel_format);
+			return -EINVAL;
+		}
+	}
+
+	/* validate resolution */
+	if (fival->width > inst->capabilities[FRAME_WIDTH].max ||
+		fival->width < inst->capabilities[FRAME_WIDTH].min ||
+		fival->height > inst->capabilities[FRAME_HEIGHT].max ||
+		fival->height < inst->capabilities[FRAME_HEIGHT].min) {
+		i_vpr_e(inst, "%s: unsupported resolution %u x %u\n", __func__,
+			fival->width, fival->height);
+		return -EINVAL;
+	}
+
+	/* calculate max supported fps for a given resolution */
+	mbpf = NUM_MBS_PER_FRAME(fival->height, fival->width);
+	fps = core->capabilities[MAX_MBPS].value / mbpf;
+
+	fival->type = V4L2_FRMIVAL_TYPE_STEPWISE;
+	fival->stepwise.min.numerator = 1;
+	fival->stepwise.min.denominator = 1;
+	fival->stepwise.max.numerator = 1;
+	fival->stepwise.max.denominator = min_t(u32, fps, inst->capabilities[FRAME_RATE].max);
+	fival->stepwise.step.numerator = 1;
+	fival->stepwise.step.denominator = inst->capabilities[FRAME_RATE].max;
+
+	return 0;
+}
+
+int msm_vidc_subscribe_event(struct msm_vidc_inst *inst,
+		const struct v4l2_event_subscription *sub)
+{
+	int rc = 0;
+
+	i_vpr_h(inst, "%s: type %d id %d\n", __func__, sub->type, sub->id);
+
+	if (is_decode_session(inst))
+		rc = msm_vdec_subscribe_event(inst, sub);
+	if (is_encode_session(inst))
+		rc = msm_venc_subscribe_event(inst, sub);
+
+	return rc;
+}
+
+int msm_vidc_unsubscribe_event(struct msm_vidc_inst *inst,
+		const struct v4l2_event_subscription *sub)
+{
+	int rc = 0;
+
+	i_vpr_h(inst, "%s: type %d id %d\n", __func__, sub->type, sub->id);
+	rc = v4l2_event_unsubscribe(&inst->fh, sub);
+	if (rc)
+		i_vpr_e(inst, "%s: failed, type %d id %d\n",
+			 __func__, sub->type, sub->id);
+	return rc;
+}
+
+int msm_vidc_dqevent(struct msm_vidc_inst *inst, struct v4l2_event *event)
+{
+	int rc = 0;
+
+	rc = v4l2_event_dequeue(&inst->fh, event, false);
+	if (rc)
+		i_vpr_e(inst, "%s: fialed\n", __func__);
+	return rc;
+}
+
+void *msm_vidc_open(struct msm_vidc_core *core, u32 session_type)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = NULL;
+	int i = 0;
+
+	d_vpr_h("%s: %s\n", __func__, video_banner);
+
+	if (session_type != MSM_VIDC_DECODER &&
+	    session_type != MSM_VIDC_ENCODER) {
+		d_vpr_e("%s: invalid session_type %d\n",
+			__func__, session_type);
+		return NULL;
+	}
+
+	rc = msm_vidc_core_init(core);
+	if (rc)
+		return NULL;
+
+	rc = msm_vidc_core_init_wait(core);
+	if (rc)
+		return NULL;
+
+	inst = vzalloc(sizeof(*inst));
+	if (!inst) {
+		d_vpr_e("%s: allocation failed\n", __func__);
+		return NULL;
+	}
+
+	inst->core = core;
+	inst->domain = session_type;
+	inst->session_id = hash32_ptr(inst);
+	msm_vidc_update_state(inst, MSM_VIDC_OPEN, __func__);
+	inst->sub_state = MSM_VIDC_SUB_STATE_NONE;
+	strscpy(inst->sub_state_name, "SUB_STATE_NONE", sizeof(inst->sub_state_name));
+	inst->active = true;
+	inst->request = false;
+	inst->ipsc_properties_set = false;
+	inst->opsc_properties_set = false;
+	inst->caps_list_prepared = false;
+	inst->has_bframe = false;
+	inst->iframe = false;
+	inst->auto_framerate = DEFAULT_FPS << 16;
+	inst->initial_time_us = ktime_get_ns() / 1000;
+	kref_init(&inst->kref);
+	mutex_init(&inst->lock);
+	mutex_init(&inst->ctx_q_lock);
+	mutex_init(&inst->client_lock);
+	msm_vidc_update_debug_str(inst);
+	i_vpr_h(inst, "Opening video instance: %d\n", session_type);
+
+	rc = msm_vidc_add_session(inst);
+	if (rc) {
+		i_vpr_e(inst, "%s: failed to add session\n", __func__);
+		goto fail_add_session;
+	}
+
+	rc = msm_vidc_pools_init(inst);
+	if (rc) {
+		i_vpr_e(inst, "%s: failed to init pool buffers\n", __func__);
+		goto fail_pools_init;
+	}
+	INIT_LIST_HEAD(&inst->caps_list);
+	INIT_LIST_HEAD(&inst->timestamps.list);
+	INIT_LIST_HEAD(&inst->ts_reorder.list);
+	INIT_LIST_HEAD(&inst->buffers.input.list);
+	INIT_LIST_HEAD(&inst->buffers.input_meta.list);
+	INIT_LIST_HEAD(&inst->buffers.output.list);
+	INIT_LIST_HEAD(&inst->buffers.output_meta.list);
+	INIT_LIST_HEAD(&inst->buffers.read_only.list);
+	INIT_LIST_HEAD(&inst->buffers.bin.list);
+	INIT_LIST_HEAD(&inst->buffers.arp.list);
+	INIT_LIST_HEAD(&inst->buffers.comv.list);
+	INIT_LIST_HEAD(&inst->buffers.non_comv.list);
+	INIT_LIST_HEAD(&inst->buffers.line.list);
+	INIT_LIST_HEAD(&inst->buffers.dpb.list);
+	INIT_LIST_HEAD(&inst->buffers.persist.list);
+	INIT_LIST_HEAD(&inst->buffers.vpss.list);
+	INIT_LIST_HEAD(&inst->buffers.partial_data.list);
+	INIT_LIST_HEAD(&inst->mem_info.bin.list);
+	INIT_LIST_HEAD(&inst->mem_info.arp.list);
+	INIT_LIST_HEAD(&inst->mem_info.comv.list);
+	INIT_LIST_HEAD(&inst->mem_info.non_comv.list);
+	INIT_LIST_HEAD(&inst->mem_info.line.list);
+	INIT_LIST_HEAD(&inst->mem_info.dpb.list);
+	INIT_LIST_HEAD(&inst->mem_info.persist.list);
+	INIT_LIST_HEAD(&inst->mem_info.vpss.list);
+	INIT_LIST_HEAD(&inst->mem_info.partial_data.list);
+	INIT_LIST_HEAD(&inst->children_list);
+	INIT_LIST_HEAD(&inst->firmware_list);
+	INIT_LIST_HEAD(&inst->enc_input_crs);
+	INIT_LIST_HEAD(&inst->dmabuf_tracker);
+	INIT_LIST_HEAD(&inst->input_timer_list);
+	INIT_LIST_HEAD(&inst->pending_pkts);
+	INIT_LIST_HEAD(&inst->fence_list);
+	INIT_LIST_HEAD(&inst->buffer_stats_list);
+	for (i = 0; i < MAX_SIGNAL; i++)
+		init_completion(&inst->completions[i]);
+
+	inst->workq = create_singlethread_workqueue("workq");
+	if (!inst->workq) {
+		i_vpr_e(inst, "%s: create workq failed\n", __func__);
+		goto fail_create_workq;
+	}
+
+	INIT_DELAYED_WORK(&inst->stats_work, msm_vidc_stats_handler);
+	INIT_WORK(&inst->stability_work, msm_vidc_stability_handler);
+
+	rc = msm_vidc_v4l2_fh_init(inst);
+	if (rc)
+		goto fail_eventq_init;
+
+	rc = msm_vidc_vb2_queue_init(inst);
+	if (rc)
+		goto fail_vb2q_init;
+
+	if (is_decode_session(inst))
+		rc = msm_vdec_inst_init(inst);
+	else if (is_encode_session(inst))
+		rc = msm_venc_inst_init(inst);
+	if (rc)
+		goto fail_inst_init;
+
+	rc = msm_vidc_fence_init(inst);
+	if (rc)
+		goto fail_fence_init;
+
+	/* reset clock residency stats */
+	msm_vidc_reset_residency_stats(core);
+
+	msm_vidc_scale_power(inst, true);
+
+	rc = msm_vidc_session_open(inst);
+	if (rc) {
+		msm_vidc_core_deinit(core, true);
+		goto fail_session_open;
+	}
+
+	inst->debugfs_root =
+		msm_vidc_debugfs_init_inst(inst, core->debugfs_root);
+	if (!inst->debugfs_root)
+		i_vpr_h(inst, "%s: debugfs not available\n", __func__);
+
+	return inst;
+
+fail_session_open:
+	msm_vidc_fence_deinit(inst);
+fail_fence_init:
+	if (is_decode_session(inst))
+		msm_vdec_inst_deinit(inst);
+	else if (is_encode_session(inst))
+		msm_venc_inst_deinit(inst);
+fail_inst_init:
+	msm_vidc_vb2_queue_deinit(inst);
+fail_vb2q_init:
+	msm_vidc_v4l2_fh_deinit(inst);
+fail_eventq_init:
+	destroy_workqueue(inst->workq);
+fail_create_workq:
+	msm_vidc_pools_deinit(inst);
+fail_pools_init:
+	msm_vidc_remove_session(inst);
+	msm_vidc_remove_dangling_session(inst);
+fail_add_session:
+	mutex_destroy(&inst->client_lock);
+	mutex_destroy(&inst->ctx_q_lock);
+	mutex_destroy(&inst->lock);
+	vfree(inst);
+	return NULL;
+}
+
+int msm_vidc_close(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	/* print final stats */
+	msm_vidc_print_stats(inst);
+	/* print internal buffer memory usage stats */
+	msm_vidc_print_memory_stats(inst);
+	msm_vidc_print_residency_stats(core);
+	msm_vidc_session_close(inst);
+	msm_vidc_change_state(inst, MSM_VIDC_CLOSE, __func__);
+	inst->sub_state = MSM_VIDC_SUB_STATE_NONE;
+	strscpy(inst->sub_state_name, "SUB_STATE_NONE", sizeof(inst->sub_state_name));
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	cancel_stability_work_sync(inst);
+	cancel_stats_work_sync(inst);
+	msm_vidc_show_stats(inst);
+	put_inst(inst);
+	msm_vidc_schedule_core_deinit(core);
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_buffer.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_buffer.c
@@ -0,0 +1,462 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_media_info.h"
+#include "msm_vidc_buffer.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_debug.h"
+
+/* Generic function for all targets. Not being used for iris2 */
+u32 msm_vidc_input_min_count(struct msm_vidc_inst *inst)
+{
+	u32 input_min_count = 0;
+	u32 hb_enh_layer = 0;
+
+	if (is_decode_session(inst)) {
+		input_min_count = MIN_DEC_INPUT_BUFFERS;
+	} else if (is_encode_session(inst)) {
+		input_min_count = MIN_ENC_INPUT_BUFFERS;
+		if (is_hierb_type_requested(inst)) {
+			hb_enh_layer =
+				inst->capabilities[ENH_LAYER_COUNT].value;
+			if (inst->codec == MSM_VIDC_H264 &&
+				!inst->capabilities[LAYER_ENABLE].value) {
+				hb_enh_layer = 0;
+			}
+			if (hb_enh_layer)
+				input_min_count = (1 << hb_enh_layer) + 2;
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid domain %d\n",
+			__func__, inst->domain);
+		return 0;
+	}
+
+	if (is_thumbnail_session(inst) || is_image_session(inst))
+		input_min_count = 1;
+
+	return input_min_count;
+}
+
+u32 msm_vidc_output_min_count(struct msm_vidc_inst *inst)
+{
+	u32 output_min_count;
+
+	if (!is_decode_session(inst) && !is_encode_session(inst))
+		return 0;
+
+	if (is_thumbnail_session(inst))
+		return 1;
+
+	if (is_encode_session(inst))
+		return MIN_ENC_OUTPUT_BUFFERS;
+
+	/* decoder handling below */
+	/* fw_min_count > 0 indicates reconfig event has already arrived */
+	if (inst->fw_min_count) {
+		/* TODO: need to update condition to include AVC/HEVC as well */
+		if (is_split_mode_enabled(inst) &&
+			(inst->codec == MSM_VIDC_AV1 ||
+			inst->codec == MSM_VIDC_VP9)) {
+			/*
+			 * return opb min buffer count as min(4, fw_min_count)
+			 * fw min count is used for dpb min count
+			 */
+			return min_t(u32, 4, inst->fw_min_count);
+		} else {
+			return inst->fw_min_count;
+		}
+	}
+
+	/* initial handling before reconfig event arrived */
+	switch (inst->codec) {
+	case MSM_VIDC_H264:
+	case MSM_VIDC_HEVC:
+		output_min_count = 4;
+		break;
+	case MSM_VIDC_VP9:
+		output_min_count = 9;
+		break;
+	case MSM_VIDC_AV1:
+		output_min_count = 11;
+		break;
+	case MSM_VIDC_HEIC:
+		output_min_count = 3;
+		break;
+	default:
+		output_min_count = 4;
+		break;
+	}
+
+	return output_min_count;
+}
+
+u32 msm_vidc_input_extra_count(struct msm_vidc_inst *inst)
+{
+	u32 count = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	/*
+	 * no extra buffers for thumbnail session because
+	 * neither dcvs nor batching will be enabled
+	 */
+	if (is_thumbnail_session(inst) || is_image_session(inst))
+		return 0;
+
+	if (is_decode_session(inst)) {
+		/*
+		 * if decode batching enabled, ensure minimum batch size
+		 * count of input buffers present on input port
+		 */
+		if (core->capabilities[DECODE_BATCH].value &&
+			inst->decode_batch.enable) {
+			if (inst->buffers.input.min_count < inst->decode_batch.size) {
+				count = inst->decode_batch.size -
+					inst->buffers.input.min_count;
+			}
+		}
+	} else if (is_encode_session(inst)) {
+		/* add dcvs buffers, if platform supports dcvs */
+		if (core->capabilities[DCVS].value)
+			count = DCVS_ENC_EXTRA_INPUT_BUFFERS;
+	}
+
+	return count;
+}
+
+u32 msm_vidc_output_extra_count(struct msm_vidc_inst *inst)
+{
+	u32 count = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	/*
+	 * no extra buffers for thumbnail session because
+	 * neither dcvs nor batching will be enabled
+	 */
+	if (is_thumbnail_session(inst) || is_image_session(inst))
+		return 0;
+
+	if (is_decode_session(inst)) {
+		/* add dcvs buffers, if platform supports dcvs */
+		if (core->capabilities[DCVS].value && inst->codec != MSM_VIDC_AV1)
+			count = DCVS_DEC_EXTRA_OUTPUT_BUFFERS;
+		/*
+		 * if decode batching enabled, ensure minimum batch size
+		 * count of extra output buffers added on output port
+		 */
+		if (core->capabilities[DECODE_BATCH].value &&
+			inst->decode_batch.enable &&
+			count < inst->decode_batch.size)
+			count = inst->decode_batch.size;
+
+	}
+
+	return count;
+}
+
+u32 msm_vidc_internal_buffer_count(struct msm_vidc_inst *inst,
+	enum msm_vidc_buffer_type buffer_type)
+{
+	u32 count = 0;
+
+	if (is_encode_session(inst))
+		return 1;
+
+	if (is_decode_session(inst)) {
+		if (buffer_type == MSM_VIDC_BUF_BIN ||
+			buffer_type == MSM_VIDC_BUF_LINE ||
+			buffer_type == MSM_VIDC_BUF_PERSIST ||
+			buffer_type == MSM_VIDC_BUF_PARTIAL_DATA) {
+			count = 1;
+		} else if (buffer_type == MSM_VIDC_BUF_COMV ||
+			buffer_type == MSM_VIDC_BUF_NON_COMV) {
+			if (inst->codec == MSM_VIDC_H264 ||
+				inst->codec == MSM_VIDC_HEVC ||
+				inst->codec == MSM_VIDC_HEIC ||
+				inst->codec == MSM_VIDC_AV1)
+				count = 1;
+			else
+				count = 0;
+		} else {
+			i_vpr_e(inst, "%s: unsupported buffer type %s\n",
+				__func__, buf_name(buffer_type));
+			count = 0;
+		}
+	}
+
+	return count;
+}
+
+u32 msm_vidc_decoder_input_size(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *i;
+	u32 count = 0;
+
+	u32 frame_size, num_mbs;
+	u32 div_factor = 1;
+	u32 base_res_mbs = NUM_MBS_4k;
+	struct v4l2_format *f;
+	u32 bitstream_size_overwrite = 0;
+	enum msm_vidc_codec_type codec;
+
+	bitstream_size_overwrite =
+		inst->capabilities[BITSTREAM_SIZE_OVERWRITE].value;
+	if (bitstream_size_overwrite) {
+		frame_size = bitstream_size_overwrite;
+		i_vpr_h(inst, "client configured bitstream buffer size %d\n",
+			frame_size);
+		return frame_size;
+	}
+
+	/*
+	 * Decoder input size calculation:
+	 * For 8k resolution, buffer size is calculated as 8k mbs / 4 and
+	 * for 8k cases we expect width/height to be set always.
+	 * In all other cases, buffer size is calculated as
+	 * 4k mbs for VP8/VP9 and 4k / 2 for remaining codecs.
+	 */
+	f = &inst->fmts[INPUT_PORT];
+	codec = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+	num_mbs = msm_vidc_get_mbs_per_frame(inst);
+	if (num_mbs > NUM_MBS_4k) {
+		div_factor = 4;
+		base_res_mbs = inst->capabilities[MBPF].value;
+	} else {
+		base_res_mbs = NUM_MBS_4k;
+		if (codec == MSM_VIDC_VP9)
+			div_factor = 1;
+		else
+			div_factor = 2;
+	}
+
+	if (is_secure_session(inst))
+		div_factor = div_factor << 1;
+
+	core = inst->core;
+
+	list_for_each_entry(i, &core->instances, list)
+		count++;
+
+	/* For image session, use the actual resolution to calc buffer size */
+	if (is_image_session(inst) || count > 16) {
+		base_res_mbs = num_mbs;
+		div_factor = 1;
+	}
+
+	frame_size = base_res_mbs * MB_SIZE_IN_PIXEL * 3 / 2 / div_factor;
+
+	 /* multiply by 10/8 (1.25) to get size for 10 bit case */
+	if (codec == MSM_VIDC_VP9 || codec == MSM_VIDC_AV1 ||
+		codec == MSM_VIDC_HEVC || codec == MSM_VIDC_HEIC)
+		frame_size = frame_size + (frame_size >> 2);
+
+	i_vpr_h(inst, "set input buffer size to %d\n", frame_size);
+
+	return ALIGN(frame_size, SZ_4K);
+}
+
+u32 msm_vidc_decoder_output_size(struct msm_vidc_inst *inst)
+{
+	u32 size;
+	struct v4l2_format *f;
+	enum msm_vidc_colorformat_type colorformat;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	colorformat = v4l2_colorformat_to_driver(inst, f->fmt.pix_mp.pixelformat,
+		__func__);
+	size = video_buffer_size(colorformat, f->fmt.pix_mp.width,
+			f->fmt.pix_mp.height, true);
+	return size;
+}
+
+u32 msm_vidc_decoder_input_meta_size(struct msm_vidc_inst *inst)
+{
+	return MSM_VIDC_METADATA_SIZE;
+}
+
+u32 msm_vidc_decoder_output_meta_size(struct msm_vidc_inst *inst)
+{
+	u32 size = MSM_VIDC_METADATA_SIZE;
+
+	if (inst->capabilities[META_DOLBY_RPU].value)
+		size += MSM_VIDC_METADATA_DOLBY_RPU_SIZE;
+
+	return ALIGN(size, SZ_4K);
+}
+
+u32 msm_vidc_encoder_input_size(struct msm_vidc_inst *inst)
+{
+	u32 size;
+	struct v4l2_format *f;
+	u32 width, height;
+	enum msm_vidc_colorformat_type colorformat;
+
+	f = &inst->fmts[INPUT_PORT];
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	colorformat = v4l2_colorformat_to_driver(inst, f->fmt.pix_mp.pixelformat,
+		__func__);
+	if (is_image_session(inst)) {
+		width = ALIGN(width, inst->capabilities[GRID_SIZE].value);
+		height = ALIGN(height, inst->capabilities[GRID_SIZE].value);
+	}
+	size = video_buffer_size(colorformat, width, height, true);
+	return size;
+}
+
+u32 msm_vidc_enc_delivery_mode_based_output_buf_size(struct msm_vidc_inst *inst,
+	u32 frame_size)
+{
+	u32 slice_size;
+	u32 width, height;
+	u32 width_in_lcus, height_in_lcus, lcu_size;
+	u32 total_mb_count;
+	struct v4l2_format *f;
+
+	f = &inst->fmts[OUTPUT_PORT];
+
+	if (f->fmt.pix_mp.pixelformat != V4L2_PIX_FMT_HEVC &&
+		f->fmt.pix_mp.pixelformat != V4L2_PIX_FMT_H264)
+		return frame_size;
+
+	if (inst->capabilities[SLICE_MODE].value != V4L2_MPEG_VIDEO_MULTI_SLICE_MODE_MAX_MB)
+		return frame_size;
+
+	if (!is_enc_slice_delivery_mode(inst))
+		return frame_size;
+
+	lcu_size = (f->fmt.pix_mp.pixelformat == V4L2_PIX_FMT_HEVC) ? 32 : 16;
+	width = f->fmt.pix_mp.width;
+	height = f->fmt.pix_mp.height;
+	width_in_lcus = (width + lcu_size - 1) / lcu_size;
+	height_in_lcus = (height + lcu_size - 1) / lcu_size;
+	total_mb_count = width_in_lcus * height_in_lcus;
+
+	slice_size = ((frame_size * inst->capabilities[SLICE_MAX_MB].value)
+					+ total_mb_count - 1) / total_mb_count;
+
+	slice_size = ALIGN(slice_size, SZ_4K);
+	return slice_size;
+}
+
+u32 msm_vidc_encoder_output_size(struct msm_vidc_inst *inst)
+{
+	u32 frame_size;
+	u32 mbs_per_frame;
+	u32 width, height;
+	struct v4l2_format *f;
+	enum msm_vidc_codec_type codec;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	codec = v4l2_codec_to_driver(inst, f->fmt.pix_mp.pixelformat, __func__);
+	/*
+	 * Encoder output size calculation: 32 Align width/height
+	 * For heic session : YUVsize * 2
+	 * For resolution <= 480x360p : YUVsize * 2
+	 * For resolution > 360p & <= 4K : YUVsize / 2
+	 * For resolution > 4k : YUVsize / 4
+	 * Initially frame_size = YUVsize * 2;
+	 */
+
+	width = ALIGN(f->fmt.pix_mp.width, BUFFER_ALIGNMENT_SIZE(32));
+	height = ALIGN(f->fmt.pix_mp.height, BUFFER_ALIGNMENT_SIZE(32));
+	mbs_per_frame = NUM_MBS_PER_FRAME(width, height);
+	frame_size = (width * height * 3);
+
+	/* Image session: 2 x yuv size */
+	if (is_image_session(inst) ||
+		inst->capabilities[BITRATE_MODE].value == V4L2_MPEG_VIDEO_BITRATE_MODE_CQ)
+		goto skip_calc;
+
+	if (mbs_per_frame <= NUM_MBS_360P)
+		(void)frame_size; /* Default frame_size = YUVsize * 2 */
+	else if (mbs_per_frame <= NUM_MBS_4k)
+		frame_size = frame_size >> 2;
+	else
+		frame_size = frame_size >> 3;
+
+	/*if ((inst->rc_type == RATE_CONTROL_OFF) ||
+		(inst->rc_type == V4L2_MPEG_VIDEO_BITRATE_MODE_CQ))
+		frame_size = frame_size << 1;
+
+	if (inst->rc_type == RATE_CONTROL_LOSSLESS)
+		frame_size = (width * height * 9) >> 2;
+	 */
+
+skip_calc:
+	/* multiply by 10/8 (1.25) to get size for 10 bit case
+	 */
+	if (codec == MSM_VIDC_HEVC || codec == MSM_VIDC_HEIC)
+		frame_size = frame_size + (frame_size >> 2);
+
+	frame_size = ALIGN(frame_size, SZ_4K);
+	frame_size = msm_vidc_enc_delivery_mode_based_output_buf_size(inst, frame_size);
+
+	return frame_size;
+}
+
+static inline u32 ROI_METADATA_SIZE(
+	u32 width, u32 height, u32 lcu_size) {
+	u32 lcu_width = 0;
+	u32 lcu_height = 0;
+	u32 n_shift = 0;
+
+	while (lcu_size && !(lcu_size & 0x1)) {
+		n_shift++;
+		lcu_size = lcu_size >> 1;
+	}
+	lcu_width = (width + (lcu_size - 1)) >> n_shift;
+	lcu_height = (height + (lcu_size - 1)) >> n_shift;
+
+	return (((lcu_width + 7) >> 3) << 3) * lcu_height * 2;
+}
+
+u32 msm_vidc_encoder_input_meta_size(struct msm_vidc_inst *inst)
+{
+	u32 size = 0;
+	u32 lcu_size = 0;
+	struct v4l2_format *f;
+	u32 width, height;
+
+	size = MSM_VIDC_METADATA_SIZE;
+
+	if (inst->capabilities[META_ROI_INFO].value) {
+		lcu_size = 16;
+
+		f = &inst->fmts[OUTPUT_PORT];
+		if (f->fmt.pix_mp.pixelformat == V4L2_PIX_FMT_HEVC)
+			lcu_size = 32;
+
+		f = &inst->fmts[INPUT_PORT];
+		width = f->fmt.pix_mp.width;
+		height = f->fmt.pix_mp.height;
+		if (is_image_session(inst)) {
+			width = ALIGN(width, inst->capabilities[GRID_SIZE].value);
+			height = ALIGN(height, inst->capabilities[GRID_SIZE].value);
+		}
+		size += ROI_METADATA_SIZE(width, height, lcu_size);
+		size = ALIGN(size, SZ_4K);
+	}
+
+	if (inst->capabilities[META_DOLBY_RPU].value) {
+		size += MSM_VIDC_METADATA_DOLBY_RPU_SIZE;
+		size = ALIGN(size, SZ_4K);
+	}
+	return size;
+}
+
+u32 msm_vidc_encoder_output_meta_size(struct msm_vidc_inst *inst)
+{
+	return MSM_VIDC_METADATA_SIZE;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_control.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_control.c
@@ -0,0 +1,1079 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_venc.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_internal.h"
+
+extern struct msm_vidc_core *g_core;
+
+static bool is_priv_ctrl(u32 id)
+{
+	bool private = false;
+
+	if (IS_PRIV_CTRL(id))
+		return true;
+
+	/*
+	 * Treat below standard controls as private because
+	 * we have added custom values to the controls
+	 */
+	switch (id) {
+	/*
+	 * TODO: V4L2_CID_MPEG_VIDEO_HEVC_PROFILE is std ctrl. But
+	 * V4L2_MPEG_VIDEO_HEVC_PROFILE_MAIN_10_STILL_PICTURE support is not
+	 * available yet. Hence, make this as private ctrl for time being
+	 */
+	case V4L2_CID_MPEG_VIDEO_HEVC_PROFILE:
+		private = true;
+		break;
+	default:
+		private = false;
+		break;
+	}
+
+	return private;
+}
+
+static const char *const mpeg_video_blur_types[] = {
+	"Blur None",
+	"Blur External",
+	"Blur Adaptive",
+	NULL,
+};
+
+static const char *const mpeg_video_hevc_profile[] = {
+	"Main",
+	"Main Still Picture",
+	"Main 10",
+	"Main 10 Still Picture",
+	NULL,
+};
+
+static const char * const av1_profile[] = {
+	"Main",
+	"High",
+	"Professional",
+	NULL,
+};
+
+static const char * const av1_level[] = {
+	"2.0",
+	"2.1",
+	"2.2",
+	"2.3",
+	"3.0",
+	"3.1",
+	"3.2",
+	"3.3",
+	"4.0",
+	"4.1",
+	"4.2",
+	"4.3",
+	"5.0",
+	"5.1",
+	"5.2",
+	"5.3",
+	"6.0",
+	"6.1",
+	"6.2",
+	"6.3",
+	"7.0",
+	"7.1",
+	"7.2",
+	"7.3",
+	NULL,
+};
+
+static const char * const av1_tier[] = {
+	"Main",
+	"High",
+	NULL,
+};
+
+static const char *const mpeg_video_vidc_ir_type[] = {
+	"Random",
+	"Cyclic",
+	NULL,
+};
+
+static const char * const *msm_vidc_get_qmenu_type(
+		struct msm_vidc_inst *inst, u32 cap_id)
+{
+	switch (cap_id) {
+	case BLUR_TYPES:
+		return mpeg_video_blur_types;
+	case PROFILE:
+		if (inst->codec == MSM_VIDC_HEVC || inst->codec == MSM_VIDC_HEIC) {
+			return mpeg_video_hevc_profile;
+		} else if (inst->codec == MSM_VIDC_AV1) {
+			return av1_profile;
+		} else {
+			i_vpr_e(inst, "%s: invalid codec type %d for cap id %d\n",
+				__func__, inst->codec, cap_id);
+			return NULL;
+		}
+	case LEVEL:
+		if (inst->codec == MSM_VIDC_AV1) {
+			return av1_level;
+		} else {
+			i_vpr_e(inst, "%s: invalid codec type %d for cap id %d\n",
+				__func__, inst->codec, cap_id);
+			return NULL;
+		}
+	case AV1_TIER:
+		return av1_tier;
+	case IR_TYPE:
+		return mpeg_video_vidc_ir_type;
+	default:
+		i_vpr_e(inst, "%s: No available qmenu for cap id %d\n",
+			__func__, cap_id);
+		return NULL;
+	}
+}
+
+static inline bool has_children(struct msm_vidc_inst_cap *cap)
+{
+	return !!cap->children[0];
+}
+
+static inline bool is_leaf(struct msm_vidc_inst_cap *cap)
+{
+	return !has_children(cap);
+}
+
+bool is_valid_cap_id(enum msm_vidc_inst_capability_type cap_id)
+{
+	return cap_id > INST_CAP_NONE && cap_id < INST_CAP_MAX;
+}
+
+bool is_valid_cap(struct msm_vidc_inst *inst,
+		enum msm_vidc_inst_capability_type cap_id)
+{
+	if (cap_id <= INST_CAP_NONE || cap_id >= INST_CAP_MAX)
+		return false;
+
+	return !!inst->capabilities[cap_id].cap_id;
+}
+
+static inline bool is_all_childrens_visited(
+	struct msm_vidc_inst_cap *cap, bool lookup[INST_CAP_MAX]) {
+	bool found = true;
+	int i;
+
+	for (i = 0; i < MAX_CAP_CHILDREN; i++) {
+		if (cap->children[i] == INST_CAP_NONE)
+			continue;
+
+		if (!lookup[cap->children[i]]) {
+			found = false;
+			break;
+		}
+	}
+	return found;
+}
+
+static int add_node_list(struct list_head *list, enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_inst_cap_entry *entry = NULL;
+
+	entry = vzalloc(sizeof(*entry));
+	if (!entry) {
+		d_vpr_e("%s: allocation failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	INIT_LIST_HEAD(&entry->list);
+	entry->cap_id = cap_id;
+	list_add(&entry->list, list);
+
+	return rc;
+}
+
+static int add_node(
+	struct list_head *list, struct msm_vidc_inst_cap *lcap, bool lookup[INST_CAP_MAX])
+{
+	int rc = 0;
+
+	if (lookup[lcap->cap_id])
+		return 0;
+
+	rc = add_node_list(list, lcap->cap_id);
+	if (rc)
+		return rc;
+
+	lookup[lcap->cap_id] = true;
+	return 0;
+}
+
+
+
+static int msm_vidc_add_capid_to_fw_list(struct msm_vidc_inst *inst,
+	enum msm_vidc_inst_capability_type cap_id)
+{
+	struct msm_vidc_inst_cap_entry *entry = NULL;
+	int rc = 0;
+
+	/* skip adding if cap_id already present in firmware list */
+	list_for_each_entry(entry, &inst->firmware_list, list) {
+		if (entry->cap_id == cap_id) {
+			i_vpr_l(inst,
+				"%s: cap[%d] %s already present in fw list\n",
+				__func__, cap_id, cap_name(cap_id));
+			return 0;
+		}
+	}
+
+	rc = add_node_list(&inst->firmware_list, cap_id);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int msm_vidc_add_children(struct msm_vidc_inst *inst,
+	enum msm_vidc_inst_capability_type cap_id)
+{
+	struct msm_vidc_inst_cap *cap;
+	int i, rc = 0;
+
+	cap = &inst->capabilities[cap_id];
+
+	for (i = 0; i < MAX_CAP_CHILDREN; i++) {
+		if (!cap->children[i])
+			break;
+
+		if (!is_valid_cap_id(cap->children[i]))
+			continue;
+
+		rc = add_node_list(&inst->children_list, cap->children[i]);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vidc_adjust_cap(struct msm_vidc_inst *inst,
+	enum msm_vidc_inst_capability_type cap_id,
+	struct v4l2_ctrl *ctrl, const char *func)
+{
+	struct msm_vidc_inst_cap *cap;
+	int rc = 0;
+
+	/* validate cap_id */
+	if (!is_valid_cap_id(cap_id))
+		return 0;
+
+	/* validate cap */
+	cap = &inst->capabilities[cap_id];
+	if (!is_valid_cap(inst, cap->cap_id))
+		return 0;
+
+	/* check if adjust supported */
+	if (!cap->adjust) {
+		if (ctrl)
+			msm_vidc_update_cap_value(inst, cap_id, ctrl->val, func);
+		return 0;
+	}
+
+	/* call adjust */
+	rc = cap->adjust(inst, ctrl);
+	if (rc) {
+		i_vpr_e(inst, "%s: adjust cap failed for %s\n", func, cap_name(cap_id));
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vidc_set_cap(struct msm_vidc_inst *inst,
+	enum msm_vidc_inst_capability_type cap_id,
+	const char *func)
+{
+	struct msm_vidc_inst_cap *cap;
+	int rc = 0;
+
+	/* validate cap_id */
+	if (!is_valid_cap_id(cap_id))
+		return 0;
+
+	/* validate cap */
+	cap = &inst->capabilities[cap_id];
+	if (!is_valid_cap(inst, cap->cap_id))
+		return 0;
+
+	/* check if set supported */
+	if (!cap->set)
+		return 0;
+
+	/* call set */
+	rc = cap->set(inst, cap_id);
+	if (rc) {
+		i_vpr_e(inst, "%s: set cap failed for %s\n", func, cap_name(cap_id));
+		return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vidc_adjust_dynamic_property(struct msm_vidc_inst *inst,
+	enum msm_vidc_inst_capability_type cap_id, struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst_cap_entry *entry = NULL, *temp = NULL;
+	struct msm_vidc_inst_cap *cap;
+	s32 prev_value;
+	int rc = 0;
+
+	cap = &inst->capabilities[0];
+
+	/* sanitize cap_id */
+	if (!is_valid_cap_id(cap_id)) {
+		i_vpr_e(inst, "%s: invalid cap_id %u\n", __func__, cap_id);
+		return -EINVAL;
+	}
+
+	if (!(cap[cap_id].flags & CAP_FLAG_DYNAMIC_ALLOWED)) {
+		i_vpr_h(inst,
+			"%s: dynamic setting of cap[%d] %s is not allowed\n",
+			__func__, cap_id, cap_name(cap_id));
+		return -EBUSY;
+	}
+	i_vpr_h(inst, "%s: cap[%d] %s\n", __func__, cap_id, cap_name(cap_id));
+
+	prev_value = cap[cap_id].value;
+	rc = msm_vidc_adjust_cap(inst, cap_id, ctrl, __func__);
+	if (rc)
+		return rc;
+
+	if (cap[cap_id].value == prev_value && cap_id == GOP_SIZE) {
+		/*
+		 * Ignore setting same GOP size value to firmware to avoid
+		 * unnecessary generation of IDR frame.
+		 */
+		return 0;
+	}
+
+	/* add cap_id to firmware list always */
+	rc = msm_vidc_add_capid_to_fw_list(inst, cap_id);
+	if (rc)
+		goto error;
+
+	/* add children only if cap value modified */
+	if (cap[cap_id].value == prev_value)
+		return 0;
+
+	rc = msm_vidc_add_children(inst, cap_id);
+	if (rc)
+		goto error;
+
+	list_for_each_entry_safe(entry, temp, &inst->children_list, list) {
+		if (!is_valid_cap_id(entry->cap_id)) {
+			rc = -EINVAL;
+			goto error;
+		}
+
+		if (!cap[entry->cap_id].adjust) {
+			i_vpr_e(inst, "%s: child cap must have ajdust function %s\n",
+				__func__, cap_name(entry->cap_id));
+			rc = -EINVAL;
+			goto error;
+		}
+
+		prev_value = cap[entry->cap_id].value;
+		rc = msm_vidc_adjust_cap(inst, entry->cap_id, NULL, __func__);
+		if (rc)
+			goto error;
+
+		/* add children if cap value modified */
+		if (cap[entry->cap_id].value != prev_value) {
+			/* add cap_id to firmware list always */
+			rc = msm_vidc_add_capid_to_fw_list(inst, entry->cap_id);
+			if (rc)
+				goto error;
+
+			rc = msm_vidc_add_children(inst, entry->cap_id);
+			if (rc)
+				goto error;
+		}
+
+		list_del_init(&entry->list);
+		vfree(entry);
+	}
+
+	/* expecting children_list to be empty */
+	if (!list_empty(&inst->children_list)) {
+		i_vpr_e(inst, "%s: child_list is not empty\n", __func__);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	return 0;
+error:
+	list_for_each_entry_safe(entry, temp, &inst->children_list, list) {
+		i_vpr_e(inst, "%s: child list: %s\n", __func__, cap_name(entry->cap_id));
+		list_del_init(&entry->list);
+		vfree(entry);
+	}
+	list_for_each_entry_safe(entry, temp, &inst->firmware_list, list) {
+		i_vpr_e(inst, "%s: fw list: %s\n", __func__, cap_name(entry->cap_id));
+		list_del_init(&entry->list);
+		vfree(entry);
+	}
+
+	return rc;
+}
+
+static int msm_vidc_set_dynamic_property(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_inst_cap_entry *entry = NULL, *temp = NULL;
+	int rc = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	list_for_each_entry_safe(entry, temp, &inst->firmware_list, list) {
+		rc = msm_vidc_set_cap(inst, entry->cap_id, __func__);
+		if (rc)
+			goto error;
+
+		list_del_init(&entry->list);
+		vfree(entry);
+	}
+
+	return 0;
+error:
+	list_for_each_entry_safe(entry, temp, &inst->firmware_list, list) {
+		i_vpr_e(inst, "%s: fw list: %s\n", __func__, cap_name(entry->cap_id));
+		list_del_init(&entry->list);
+		vfree(entry);
+	}
+
+	return rc;
+}
+
+int msm_vidc_ctrl_handler_deinit(struct msm_vidc_inst *inst)
+{
+	i_vpr_h(inst, "%s(): num ctrls %d\n", __func__, inst->num_ctrls);
+	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+	memset(&inst->ctrl_handler, 0, sizeof(struct v4l2_ctrl_handler));
+
+	return 0;
+}
+
+int msm_vidc_ctrl_handler_init(struct msm_vidc_inst *inst, bool init)
+{
+	int rc = 0;
+	struct msm_vidc_inst_cap *cap;
+	struct msm_vidc_core *core;
+	int idx = 0;
+	struct v4l2_ctrl_config ctrl_cfg = {0};
+	int num_ctrls = 0, ctrl_idx = 0;
+	u64 codecs_count, step_or_mask;
+
+	core = inst->core;
+	cap = &inst->capabilities[0];
+
+	if (!core->v4l2_ctrl_ops) {
+		i_vpr_e(inst, "%s: no control ops\n", __func__);
+		return -EINVAL;
+	}
+
+	for (idx = 0; idx < INST_CAP_MAX; idx++) {
+		if (cap[idx].v4l2_id)
+			num_ctrls++;
+	}
+	if (!num_ctrls) {
+		i_vpr_e(inst, "%s: no ctrls available in cap database\n",
+			__func__);
+		return -EINVAL;
+	}
+
+	if (init) {
+		codecs_count = is_encode_session(inst) ?
+			core->enc_codecs_count :
+			core->dec_codecs_count;
+		rc = v4l2_ctrl_handler_init(&inst->ctrl_handler,
+			INST_CAP_MAX * codecs_count);
+		if (rc) {
+			i_vpr_e(inst, "control handler init failed, %d\n",
+					inst->ctrl_handler.error);
+			goto error;
+		}
+	}
+
+	for (idx = 0; idx < INST_CAP_MAX; idx++) {
+		struct v4l2_ctrl *ctrl;
+
+		if (!cap[idx].v4l2_id)
+			continue;
+
+		if (ctrl_idx >= num_ctrls) {
+			i_vpr_e(inst,
+				"%s: invalid ctrl %#x, max allowed %d\n",
+				__func__, cap[idx].v4l2_id,
+				num_ctrls);
+			rc = -EINVAL;
+			goto error;
+		}
+		i_vpr_l(inst,
+			"%s: cap[%d] %24s, value %d min %d max %d step_or_mask %#x flags %#x v4l2_id %#x hfi_id %#x\n",
+			__func__, idx, cap_name(idx),
+			cap[idx].value,
+			cap[idx].min,
+			cap[idx].max,
+			cap[idx].step_or_mask,
+			cap[idx].flags,
+			cap[idx].v4l2_id,
+			cap[idx].hfi_id);
+
+		memset(&ctrl_cfg, 0, sizeof(struct v4l2_ctrl_config));
+
+		/*
+		 * few controls might have been already initialized in instance initialization,
+		 * so modify the range values for them instead of initializing them again
+		 */
+		if (!init) {
+			struct msm_vidc_ctrl_data ctrl_priv_data;
+
+			ctrl = v4l2_ctrl_find(&inst->ctrl_handler, cap[idx].v4l2_id);
+			if (ctrl) {
+				step_or_mask = (cap[idx].flags & CAP_FLAG_MENU) ?
+					~(cap[idx].step_or_mask) :
+					cap[idx].step_or_mask;
+				memset(&ctrl_priv_data, 0, sizeof(struct msm_vidc_ctrl_data));
+				ctrl_priv_data.skip_s_ctrl = true;
+				ctrl->priv = &ctrl_priv_data;
+				v4l2_ctrl_modify_range(ctrl,
+					cap[idx].min,
+					cap[idx].max,
+					step_or_mask,
+					cap[idx].value);
+				/* reset private data to null to ensure s_ctrl not skipped */
+				ctrl->priv = NULL;
+				continue;
+			}
+		}
+
+		if (is_priv_ctrl(cap[idx].v4l2_id)) {
+			/* add private control */
+			ctrl_cfg.def = cap[idx].value;
+			ctrl_cfg.flags = 0;
+			ctrl_cfg.id = cap[idx].v4l2_id;
+			ctrl_cfg.max = cap[idx].max;
+			ctrl_cfg.min = cap[idx].min;
+			ctrl_cfg.ops = core->v4l2_ctrl_ops;
+			if (cap[idx].flags & CAP_FLAG_MENU)
+				ctrl_cfg.type = V4L2_CTRL_TYPE_MENU;
+			else if (cap[idx].flags & CAP_FLAG_BITMASK)
+				ctrl_cfg.type = V4L2_CTRL_TYPE_BITMASK;
+			else
+				ctrl_cfg.type = V4L2_CTRL_TYPE_INTEGER;
+			if (is_meta_cap(inst, idx)) {
+				/* bitmask is expected to be enabled for meta controls */
+				if (ctrl_cfg.type != V4L2_CTRL_TYPE_BITMASK) {
+					i_vpr_e(inst,
+						"%s: missing bitmask for cap %s\n",
+						__func__, cap_name(idx));
+					rc = -EINVAL;
+					goto error;
+				}
+			}
+			if (ctrl_cfg.type == V4L2_CTRL_TYPE_MENU) {
+				ctrl_cfg.menu_skip_mask =
+					~(cap[idx].step_or_mask);
+				ctrl_cfg.qmenu = msm_vidc_get_qmenu_type(inst,
+					cap[idx].cap_id);
+			} else {
+				ctrl_cfg.step =
+					cap[idx].step_or_mask;
+			}
+			ctrl_cfg.name = cap_name(cap[idx].cap_id);
+			if (!ctrl_cfg.name) {
+				i_vpr_e(inst, "%s: %#x ctrl name is null\n",
+					__func__, ctrl_cfg.id);
+				rc = -EINVAL;
+				goto error;
+			}
+			ctrl = v4l2_ctrl_new_custom(&inst->ctrl_handler,
+					&ctrl_cfg, NULL);
+		} else {
+			if (cap[idx].flags & CAP_FLAG_MENU) {
+				ctrl = v4l2_ctrl_new_std_menu(
+					&inst->ctrl_handler,
+					core->v4l2_ctrl_ops,
+					cap[idx].v4l2_id,
+					cap[idx].max,
+					~(cap[idx].step_or_mask),
+					cap[idx].value);
+			} else {
+				ctrl = v4l2_ctrl_new_std(&inst->ctrl_handler,
+					core->v4l2_ctrl_ops,
+					cap[idx].v4l2_id,
+					cap[idx].min,
+					cap[idx].max,
+					cap[idx].step_or_mask,
+					cap[idx].value);
+			}
+		}
+		if (!ctrl) {
+			i_vpr_e(inst, "%s: invalid ctrl %#x cap %24s\n", __func__,
+				cap[idx].v4l2_id, cap_name(idx));
+			rc = -EINVAL;
+			goto error;
+		}
+
+		rc = inst->ctrl_handler.error;
+		if (rc) {
+			i_vpr_e(inst,
+				"error adding ctrl (%#x) to ctrl handle, %d\n",
+				cap[idx].v4l2_id,
+				inst->ctrl_handler.error);
+			goto error;
+		}
+
+		if (cap[idx].flags & CAP_FLAG_VOLATILE)
+			ctrl->flags |= V4L2_CTRL_FLAG_VOLATILE;
+
+		ctrl->flags |= V4L2_CTRL_FLAG_EXECUTE_ON_WRITE;
+		ctrl_idx++;
+	}
+	inst->num_ctrls = num_ctrls;
+	i_vpr_h(inst, "%s(): num ctrls %d\n", __func__, inst->num_ctrls);
+
+	return 0;
+error:
+	msm_vidc_ctrl_handler_deinit(inst);
+
+	return rc;
+}
+
+static int msm_vidc_update_buffer_count_if_needed(struct msm_vidc_inst *inst,
+	enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	bool update_input_port = false, update_output_port = false;
+
+	switch (cap_id) {
+	case LAYER_TYPE:
+	case ENH_LAYER_COUNT:
+	case LAYER_ENABLE:
+		update_input_port = true;
+		break;
+	case THUMBNAIL_MODE:
+	case PRIORITY:
+		update_input_port = true;
+		update_output_port = true;
+		break;
+	default:
+		update_input_port = false;
+		update_output_port = false;
+		break;
+	}
+
+	if (update_input_port) {
+		rc = msm_vidc_update_buffer_count(inst, INPUT_PORT);
+		if (rc)
+			return rc;
+	}
+	if (update_output_port) {
+		rc = msm_vidc_update_buffer_count(inst, OUTPUT_PORT);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int msm_vidc_allow_secure_session(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_inst *i;
+	struct msm_vidc_core *core;
+	u32 count = 0;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	list_for_each_entry(i, &core->instances, list) {
+		if (i->capabilities[SECURE_MODE].value)
+			count++;
+	}
+
+	if (count > core->capabilities[MAX_SECURE_SESSION_COUNT].value) {
+		i_vpr_e(inst,
+			"%s: total secure sessions %d exceeded max limit %d\n",
+			__func__, count,
+			core->capabilities[MAX_SECURE_SESSION_COUNT].value);
+		rc = -EINVAL;
+	}
+	core_unlock(core, __func__);
+
+	return rc;
+}
+
+int msm_v4l2_op_g_volatile_ctrl(struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst;
+
+	if (!ctrl) {
+		d_vpr_e("%s: invalid ctrl parameter\n", __func__);
+		return -EINVAL;
+	}
+
+	inst = container_of(ctrl->handler,
+			    struct msm_vidc_inst, ctrl_handler);
+	inst = get_inst_ref(g_core, inst);
+	if (!inst) {
+		d_vpr_e("%s: could not find inst for ctrl %s id %#x\n",
+			__func__, ctrl->name, ctrl->id);
+		return -EINVAL;
+	}
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+
+	rc = msm_vidc_get_control(inst, ctrl);
+	if (rc) {
+		i_vpr_e(inst, "%s: failed for ctrl %s id %#x\n",
+			__func__, ctrl->name, ctrl->id);
+		goto unlock;
+	} else {
+		i_vpr_h(inst, "%s: ctrl %s id %#x, value %d\n",
+			__func__, ctrl->name, ctrl->id, ctrl->val);
+	}
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+	return rc;
+}
+
+static int msm_vidc_update_static_property(struct msm_vidc_inst *inst,
+	enum msm_vidc_inst_capability_type cap_id, struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+
+	if (cap_id == DRV_VERSION) {
+		i_vpr_h(inst, "%s: driver version update not allowed\n",
+			__func__);
+		return 0;
+	}
+
+	/* update value to db */
+	msm_vidc_update_cap_value(inst, cap_id, ctrl->val, __func__);
+
+	if (cap_id == CLIENT_ID) {
+		rc = msm_vidc_update_debug_str(inst);
+		if (rc)
+			return rc;
+	}
+
+	if (cap_id == SECURE_MODE) {
+		if (ctrl->val) {
+			rc = msm_vidc_allow_secure_session(inst);
+			if (rc)
+				return rc;
+		}
+	}
+
+	if (cap_id == ROTATION) {
+		struct v4l2_format *output_fmt;
+
+		output_fmt = &inst->fmts[OUTPUT_PORT];
+		rc = msm_venc_s_fmt_output(inst, output_fmt);
+		if (rc)
+			return rc;
+	}
+
+	if (cap_id == DELIVERY_MODE) {
+		struct v4l2_format *output_fmt;
+
+		output_fmt = &inst->fmts[OUTPUT_PORT];
+		rc = msm_venc_s_fmt_output(inst, output_fmt);
+		if (rc)
+			return rc;
+	}
+
+	if (cap_id == BITSTREAM_SIZE_OVERWRITE) {
+		rc = msm_vidc_update_bitstream_buffer_size(inst);
+		if (rc)
+			return rc;
+	}
+
+	/* call this explicitly to adjust client priority */
+	if (cap_id == PRIORITY) {
+		rc = msm_vidc_adjust_session_priority(inst, ctrl);
+		if (rc)
+			return rc;
+	}
+
+	if (cap_id == CRITICAL_PRIORITY)
+		msm_vidc_update_cap_value(inst, PRIORITY, 0, __func__);
+
+	if (cap_id == ENH_LAYER_COUNT && inst->codec == MSM_VIDC_HEVC) {
+		u32 enable;
+
+		/* enable LAYER_ENABLE cap if HEVC_HIER enh layers > 0 */
+		if (ctrl->val > 0)
+			enable = 1;
+		else
+			enable = 0;
+
+		msm_vidc_update_cap_value(inst, LAYER_ENABLE, enable, __func__);
+	}
+	if (is_meta_cap(inst, cap_id)) {
+		rc = msm_vidc_update_meta_port_settings(inst);
+		if (rc)
+			return rc;
+	}
+
+	rc = msm_vidc_update_buffer_count_if_needed(inst, cap_id);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_s_ctrl(struct msm_vidc_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	enum msm_vidc_inst_capability_type cap_id;
+	struct msm_vidc_inst_cap *cap;
+	int rc = 0;
+	u32 port;
+
+	cap = &inst->capabilities[0];
+
+	i_vpr_h(inst, FMT_STRING_SET_CTRL,
+		__func__, state_name(inst->state), ctrl->name, ctrl->id, ctrl->val);
+
+	cap_id = msm_vidc_get_cap_id(inst, ctrl->id);
+	if (!is_valid_cap_id(cap_id)) {
+		i_vpr_e(inst, "%s: invalid cap_id for ctrl %s\n", __func__, ctrl->name);
+		return -EINVAL;
+	}
+
+	/* mark client set flag */
+	cap[cap_id].flags |= CAP_FLAG_CLIENT_SET;
+
+	port = is_encode_session(inst) ? OUTPUT_PORT : INPUT_PORT;
+	if (!inst->bufq[port].vb2q->streaming) {
+		/* static case */
+		rc = msm_vidc_update_static_property(inst, cap_id, ctrl);
+		if (rc)
+			return rc;
+	} else {
+		/* dynamic case */
+		rc = msm_vidc_adjust_dynamic_property(inst, cap_id, ctrl);
+		if (rc)
+			return rc;
+
+		rc = msm_vidc_set_dynamic_property(inst);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+int msm_v4l2_op_s_ctrl(struct v4l2_ctrl *ctrl)
+{
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_ctrl_data *priv_ctrl_data;
+	int rc = 0;
+
+	if (!ctrl) {
+		d_vpr_e("%s: invalid ctrl parameter\n", __func__);
+		return -EINVAL;
+	}
+
+	/*
+	 * v4l2_ctrl_modify_range may internally call s_ctrl
+	 * which will again try to acquire lock leading to deadlock,
+	 * Add check to avoid such scenario.
+	 */
+	priv_ctrl_data = ctrl->priv ? ctrl->priv : NULL;
+	if (priv_ctrl_data && priv_ctrl_data->skip_s_ctrl) {
+		d_vpr_l("%s: skip s_ctrl (%s)\n", __func__, ctrl->name);
+		return 0;
+	}
+
+	inst = container_of(ctrl->handler, struct msm_vidc_inst, ctrl_handler);
+	inst = get_inst_ref(g_core, inst);
+	if (!inst) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	rc = inst->event_handle(inst, MSM_VIDC_S_CTRL, ctrl);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+	return rc;
+}
+
+int msm_vidc_prepare_dependency_list(struct msm_vidc_inst *inst)
+{
+	struct list_head leaf_list, opt_list;
+	struct msm_vidc_inst_cap *cap, *lcap, *temp_cap;
+	struct msm_vidc_inst_cap_entry *entry = NULL, *temp = NULL;
+	bool leaf_visited[INST_CAP_MAX];
+	bool opt_visited[INST_CAP_MAX];
+	int tmp_count_total, tmp_count, num_nodes = 0;
+	int i, rc = 0;
+
+	cap = &inst->capabilities[0];
+
+	if (!list_empty(&inst->caps_list)) {
+		i_vpr_h(inst, "%s: dependency list already prepared\n", __func__);
+		return 0;
+	}
+
+	/* init local list and lookup table entries */
+	INIT_LIST_HEAD(&leaf_list);
+	INIT_LIST_HEAD(&opt_list);
+	memset(&leaf_visited, 0, sizeof(leaf_visited));
+	memset(&opt_visited, 0, sizeof(opt_visited));
+
+	/* populate leaf nodes first */
+	for (i = 1; i < INST_CAP_MAX; i++) {
+		lcap = &cap[i];
+		if (!is_valid_cap(inst, lcap->cap_id))
+			continue;
+
+		/* sanitize cap value */
+		if (i != lcap->cap_id) {
+			i_vpr_e(inst, "%s: cap id mismatch. expected %s, actual %s\n",
+				__func__, cap_name(i), cap_name(lcap->cap_id));
+			rc = -EINVAL;
+			goto error;
+		}
+
+		/* add all leaf nodes */
+		if (is_leaf(lcap)) {
+			rc = add_node(&leaf_list, lcap, leaf_visited);
+			if (rc)
+				goto error;
+		} else {
+			rc = add_node(&opt_list, lcap, opt_visited);
+			if (rc)
+				goto error;
+		}
+	}
+
+	/* find total optional list entries */
+	list_for_each_entry(entry, &opt_list, list)
+		num_nodes++;
+
+	/* used for loop detection */
+	tmp_count_total = num_nodes;
+	tmp_count = num_nodes;
+
+	/* sort final outstanding nodes */
+	list_for_each_entry_safe(entry, temp, &opt_list, list) {
+		/* initially remove entry from opt list */
+		list_del_init(&entry->list);
+		opt_visited[entry->cap_id] = false;
+		tmp_count--;
+		temp_cap = &cap[entry->cap_id];
+
+		/**
+		 * if all child are visited then add this entry to
+		 * leaf list else add it to the end of optional list.
+		 */
+		if (is_all_childrens_visited(temp_cap, leaf_visited)) {
+			list_add(&entry->list, &leaf_list);
+			leaf_visited[entry->cap_id] = true;
+			tmp_count_total--;
+		} else {
+			list_add_tail(&entry->list, &opt_list);
+			opt_visited[entry->cap_id] = true;
+		}
+
+		/* detect loop */
+		if (!tmp_count) {
+			if (num_nodes == tmp_count_total) {
+				i_vpr_e(inst, "%s: loop detected in subgraph %d\n",
+					__func__, num_nodes);
+				rc = -EINVAL;
+				goto error;
+			}
+			num_nodes = tmp_count_total;
+			tmp_count = tmp_count_total;
+		}
+	}
+
+	/* expecting opt_list to be empty */
+	if (!list_empty(&opt_list)) {
+		i_vpr_e(inst, "%s: opt_list is not empty\n", __func__);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	/* move elements to &inst->caps_list from local */
+	list_replace_init(&leaf_list, &inst->caps_list);
+
+	return 0;
+error:
+	list_for_each_entry_safe(entry, temp, &opt_list, list) {
+		i_vpr_e(inst, "%s: opt_list: %s\n", __func__, cap_name(entry->cap_id));
+		list_del_init(&entry->list);
+		vfree(entry);
+	}
+	list_for_each_entry_safe(entry, temp, &leaf_list, list) {
+		i_vpr_e(inst, "%s: leaf_list: %s\n", __func__, cap_name(entry->cap_id));
+		list_del_init(&entry->list);
+		vfree(entry);
+	}
+	return rc;
+}
+
+int msm_vidc_adjust_v4l2_properties(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_inst_cap_entry *entry = NULL, *temp = NULL;
+	int rc = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	/* adjust all possible caps from caps_list */
+	list_for_each_entry_safe(entry, temp, &inst->caps_list, list) {
+		i_vpr_l(inst, "%s: cap: id %3u, name %s\n", __func__,
+			entry->cap_id, cap_name(entry->cap_id));
+
+		rc = msm_vidc_adjust_cap(inst, entry->cap_id, NULL, __func__);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+int msm_vidc_set_v4l2_properties(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_inst_cap_entry *entry = NULL, *temp = NULL;
+	int rc = 0;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+
+	/* set all caps from caps_list */
+	list_for_each_entry_safe(entry, temp, &inst->caps_list, list) {
+		rc = msm_vidc_set_cap(inst, entry->cap_id, __func__);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_debug.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_debug.c
@@ -0,0 +1,816 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define CREATE_TRACE_POINTS
+#include "msm_vidc_debug.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_events.h"
+
+extern struct msm_vidc_core *g_core;
+
+#define MAX_SSR_STRING_LEN         64
+#define MAX_STABILITY_STRING_LEN   64
+#define MAX_DEBUG_LEVEL_STRING_LEN 15
+#define MSM_VIDC_MIN_STATS_DELAY_MS     200
+#define MSM_VIDC_MAX_STATS_DELAY_MS     10000
+
+unsigned int msm_vidc_debug = DRV_LOG;
+unsigned int msm_fw_debug = FW_LOG;
+
+/* disabled synx fence by default temporarily */
+bool msm_vidc_synx_fence_enable = false;
+
+static int debug_level_set_drv(const char *val,
+	const struct kernel_param *kp)
+{
+	struct msm_vidc_core *core = NULL;
+	unsigned int dvalue;
+	int ret;
+
+	if (!kp || !kp->arg || !val) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	ret = kstrtouint(val, 0, &dvalue);
+	if (ret)
+		return ret;
+
+	msm_vidc_debug = dvalue;
+
+	core = *(struct msm_vidc_core **)kp->arg;
+
+	if (!core) {
+		d_vpr_e("%s: Invalid core/capabilities\n", __func__);
+		return 0;
+	}
+
+	/* check if driver is more than default level */
+	if ((dvalue & DRV_LOGMASK) & ~(DRV_LOG)) {
+		core->capabilities[HW_RESPONSE_TIMEOUT].value = 4 * HW_RESPONSE_TIMEOUT_VALUE;
+		core->capabilities[SW_PC_DELAY].value         = 4 * SW_PC_DELAY_VALUE;
+		core->capabilities[FW_UNLOAD_DELAY].value     = 4 * FW_UNLOAD_DELAY_VALUE;
+	} else {
+		/* reset timeout values, if user reduces the logging */
+		core->capabilities[HW_RESPONSE_TIMEOUT].value = HW_RESPONSE_TIMEOUT_VALUE;
+		core->capabilities[SW_PC_DELAY].value         = SW_PC_DELAY_VALUE;
+		core->capabilities[FW_UNLOAD_DELAY].value     = FW_UNLOAD_DELAY_VALUE;
+	}
+
+	d_vpr_h(
+		"timeout updated for driver: hw_response %u, sw_pc %u, fw_unload %u, debug_level %#x\n",
+		core->capabilities[HW_RESPONSE_TIMEOUT].value,
+		core->capabilities[SW_PC_DELAY].value,
+		core->capabilities[FW_UNLOAD_DELAY].value,
+		msm_vidc_debug);
+
+	return 0;
+}
+
+static int debug_level_set_fw(const char *val,
+	const struct kernel_param *kp)
+{
+	struct msm_vidc_core *core = NULL;
+	unsigned int dvalue;
+	int ret;
+
+	if (!kp || !kp->arg || !val) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	ret = kstrtouint(val, 0, &dvalue);
+	if (ret)
+		return ret;
+
+	msm_fw_debug = dvalue;
+
+	core = *(struct msm_vidc_core **)kp->arg;
+
+	if (!core) {
+		d_vpr_e("%s: Invalid core/capabilities\n", __func__);
+		return 0;
+	}
+
+	/* check if firmware is more than default level */
+	if ((dvalue & FW_LOGMASK) & ~(FW_LOG)) {
+		core->capabilities[HW_RESPONSE_TIMEOUT].value = 4 * HW_RESPONSE_TIMEOUT_VALUE;
+		core->capabilities[SW_PC_DELAY].value         = 4 * SW_PC_DELAY_VALUE;
+		core->capabilities[FW_UNLOAD_DELAY].value     = 4 * FW_UNLOAD_DELAY_VALUE;
+	} else {
+		/* reset timeout values, if user reduces the logging */
+		core->capabilities[HW_RESPONSE_TIMEOUT].value = HW_RESPONSE_TIMEOUT_VALUE;
+		core->capabilities[SW_PC_DELAY].value         = SW_PC_DELAY_VALUE;
+		core->capabilities[FW_UNLOAD_DELAY].value     = FW_UNLOAD_DELAY_VALUE;
+	}
+
+	d_vpr_h(
+		"timeout updated for firmware: hw_response %u, sw_pc %u, fw_unload %u, debug_level %#x\n",
+		core->capabilities[HW_RESPONSE_TIMEOUT].value,
+		core->capabilities[SW_PC_DELAY].value,
+		core->capabilities[FW_UNLOAD_DELAY].value,
+		msm_fw_debug);
+
+	return 0;
+}
+
+static int debug_level_get_drv(char *buffer, const struct kernel_param *kp)
+{
+	return scnprintf(buffer, PAGE_SIZE, "%#x", msm_vidc_debug);
+}
+
+static int debug_level_get_fw(char *buffer, const struct kernel_param *kp)
+{
+	return scnprintf(buffer, PAGE_SIZE, "%#x", msm_fw_debug);
+}
+
+static const struct kernel_param_ops msm_vidc_debug_fops = {
+	.set = debug_level_set_drv,
+	.get = debug_level_get_drv,
+};
+
+static const struct kernel_param_ops msm_fw_debug_fops = {
+	.set = debug_level_set_fw,
+	.get = debug_level_get_fw,
+};
+
+static int fw_dump_set(const char *val,
+	const struct kernel_param *kp)
+{
+	unsigned int dvalue;
+	int ret;
+
+	if (!kp || !kp->arg || !val) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	ret = kstrtouint(val, 0, &dvalue);
+	if (ret)
+		return ret;
+
+	msm_vidc_fw_dump = dvalue;
+
+	d_vpr_h("fw dump %s\n", msm_vidc_fw_dump ? "Enabled" : "Disabled");
+
+	return 0;
+}
+
+static int fw_dump_get(char *buffer, const struct kernel_param *kp)
+{
+	return scnprintf(buffer, PAGE_SIZE, "%#x", msm_vidc_fw_dump);
+}
+
+static const struct kernel_param_ops msm_vidc_fw_dump_fops = {
+	.set = fw_dump_set,
+	.get = fw_dump_get,
+};
+
+static int synx_fence_set(const char *val,
+	const struct kernel_param *kp)
+{
+	unsigned int dvalue;
+	int ret;
+
+	if (!kp || !kp->arg || !val) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	ret = kstrtouint(val, 0, &dvalue);
+	if (ret)
+		return ret;
+
+	msm_vidc_synx_fence_enable = dvalue;
+
+	return 0;
+}
+
+static int synx_fence_get(char *buffer, const struct kernel_param *kp)
+{
+	return scnprintf(buffer, PAGE_SIZE, "%#x", msm_vidc_synx_fence_enable);
+}
+
+static const struct kernel_param_ops msm_vidc_synx_fence_debug_fops = {
+	.set = synx_fence_set,
+	.get = synx_fence_get,
+};
+
+module_param_cb(msm_vidc_debug, &msm_vidc_debug_fops, &g_core, 0644);
+module_param_cb(msm_fw_debug, &msm_fw_debug_fops, &g_core, 0644);
+module_param_cb(msm_vidc_fw_dump, &msm_vidc_fw_dump_fops, &g_core, 0644);
+module_param_cb(msm_vidc_synx_fence_enable,
+	&msm_vidc_synx_fence_debug_fops, &g_core, 0644);
+
+bool msm_vidc_lossless_encode = !true;
+EXPORT_SYMBOL(msm_vidc_lossless_encode);
+
+bool msm_vidc_syscache_disable = !true;
+EXPORT_SYMBOL(msm_vidc_syscache_disable);
+
+int msm_vidc_clock_voting = !1;
+int msm_vidc_ddr_bw = !1;
+int msm_vidc_llc_bw = !1;
+
+bool msm_vidc_fw_dump = !true;
+EXPORT_SYMBOL(msm_vidc_fw_dump);
+
+unsigned int msm_vidc_enable_bugon = !1;
+EXPORT_SYMBOL(msm_vidc_enable_bugon);
+
+#define MAX_DBG_BUF_SIZE 4096
+
+struct core_inst_pair {
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *inst;
+};
+
+/* debug fs support */
+static inline void tic(struct msm_vidc_inst *inst, enum profiling_points p,
+				 char *b)
+{
+	if (!inst->debug.pdata[p].name[0])
+		memcpy(inst->debug.pdata[p].name, b, 64);
+	if (inst->debug.pdata[p].sampling) {
+		inst->debug.pdata[p].start = ktime_get_ns() / 1000 / 1000;
+		inst->debug.pdata[p].sampling = false;
+	}
+}
+
+static inline void toc(struct msm_vidc_inst *inst, enum profiling_points p)
+{
+	if (!inst->debug.pdata[p].sampling) {
+		inst->debug.pdata[p].stop = ktime_get_ns() / 1000 / 1000;
+		inst->debug.pdata[p].cumulative += inst->debug.pdata[p].stop -
+			inst->debug.pdata[p].start;
+		inst->debug.pdata[p].sampling = true;
+	}
+}
+
+void msm_vidc_show_stats(struct msm_vidc_inst *inst)
+{
+	int x;
+
+	for (x = 0; x < MAX_PROFILING_POINTS; x++) {
+		if (inst->debug.pdata[x].name[0]) {
+			if (inst->debug.samples) {
+				i_vpr_p(inst, "%s averaged %llu ms/sample\n",
+						inst->debug.pdata[x].name,
+						inst->debug.pdata[x].cumulative /
+						inst->debug.samples);
+			}
+
+			i_vpr_p(inst, "%s Samples: %d\n",
+				inst->debug.pdata[x].name, inst->debug.samples);
+		}
+	}
+}
+
+static u32 write_str(char *buffer,
+		size_t size, const char *fmt, ...)
+{
+	va_list args;
+	u32 len;
+
+	va_start(args, fmt);
+	len = vscnprintf(buffer, size, fmt, args);
+	va_end(args);
+	return len;
+}
+
+static ssize_t core_info_read(struct file *file, char __user *buf,
+	size_t count, loff_t *ppos)
+{
+	struct msm_vidc_core *core = file->private_data;
+	char *cur, *end, *dbuf = NULL;
+	ssize_t len = 0;
+
+	if (!core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, core);
+		return 0;
+	}
+
+	dbuf = vzalloc(MAX_DBG_BUF_SIZE);
+	if (!dbuf) {
+		d_vpr_e("%s: allocation failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	cur = dbuf;
+	end = cur + MAX_DBG_BUF_SIZE;
+
+	cur += write_str(cur, end - cur, "Core state: %d\n", core->state);
+
+	cur += write_str(cur, end - cur,
+		"FW version : %s\n", core->fw_version);
+	cur += write_str(cur, end - cur,
+		"register_base: 0x%x\n", core->resource->register_base_addr);
+	cur += write_str(cur, end - cur, "irq: %u\n", core->resource->irq);
+
+	len = simple_read_from_buffer(buf, count, ppos,
+		dbuf, cur - dbuf);
+
+	vfree(dbuf);
+	return len;
+}
+
+static const struct file_operations core_info_fops = {
+	.open = simple_open,
+	.read = core_info_read,
+};
+
+static ssize_t stats_delay_write_ms(struct file *filp, const char __user *buf,
+		size_t count, loff_t *ppos)
+{
+	int rc = 0;
+	struct msm_vidc_core *core = filp->private_data;
+	char kbuf[MAX_DEBUG_LEVEL_STRING_LEN] = {0};
+	u32 delay_ms = 0;
+
+	if (!core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, core);
+		return 0;
+	}
+
+	/* filter partial writes and invalid commands */
+	if (*ppos != 0 || count >= sizeof(kbuf) || count == 0) {
+		d_vpr_e("returning error - pos %lld, count %lu\n", *ppos, count);
+		rc = -EINVAL;
+	}
+
+	rc = simple_write_to_buffer(kbuf, sizeof(kbuf) - 1, ppos, buf, count);
+	if (rc < 0) {
+		d_vpr_e("%s: User memory fault\n", __func__);
+		rc = -EFAULT;
+		goto exit;
+	}
+
+	rc = kstrtoint(kbuf, 0, &delay_ms);
+	if (rc) {
+		d_vpr_e("returning error err %d\n", rc);
+		rc = -EINVAL;
+		goto exit;
+	}
+	delay_ms = clamp_t(u32, delay_ms, MSM_VIDC_MIN_STATS_DELAY_MS, MSM_VIDC_MAX_STATS_DELAY_MS);
+	core->capabilities[STATS_TIMEOUT_MS].value = delay_ms;
+	d_vpr_h("Stats delay is updated to - %d ms\n", delay_ms);
+
+exit:
+	return rc;
+}
+
+static ssize_t stats_delay_read_ms(struct file *file, char __user *buf,
+		size_t count, loff_t *ppos)
+{
+	size_t len;
+	char kbuf[MAX_DEBUG_LEVEL_STRING_LEN];
+	struct msm_vidc_core *core = file->private_data;
+
+	if (!core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, core);
+		return 0;
+	}
+
+	len = scnprintf(kbuf, sizeof(kbuf), "%u\n", core->capabilities[STATS_TIMEOUT_MS].value);
+	return simple_read_from_buffer(buf, count, ppos, kbuf, len);
+}
+
+static const struct file_operations stats_delay_fops = {
+	.open = simple_open,
+	.write = stats_delay_write_ms,
+	.read = stats_delay_read_ms,
+};
+
+static ssize_t trigger_ssr_write(struct file *filp, const char __user *buf,
+	size_t count, loff_t *ppos)
+{
+	unsigned long ssr_trigger_val = 0;
+	int rc = 0;
+	struct msm_vidc_core *core = filp->private_data;
+	size_t size = MAX_SSR_STRING_LEN;
+	char kbuf[MAX_SSR_STRING_LEN + 1] = { 0 };
+
+	if (!core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, core);
+		return 0;
+	}
+
+	if (!buf)
+		return -EINVAL;
+
+	if (!count)
+		goto exit;
+
+	if (count < size)
+		size = count;
+
+	if (copy_from_user(kbuf, buf, size)) {
+		d_vpr_e("%s: User memory fault\n", __func__);
+		rc = -EFAULT;
+		goto exit;
+	}
+
+	rc = kstrtoul(kbuf, 0, &ssr_trigger_val);
+	if (rc) {
+		d_vpr_e("returning error err %d\n", rc);
+		rc = -EINVAL;
+	} else {
+		msm_vidc_trigger_ssr(core, ssr_trigger_val);
+		rc = count;
+	}
+exit:
+	return rc;
+}
+
+static const struct file_operations ssr_fops = {
+	.open = simple_open,
+	.write = trigger_ssr_write,
+};
+
+static ssize_t trigger_stability_write(struct file *filp, const char __user *buf,
+	size_t count, loff_t *ppos)
+{
+	unsigned long stability_trigger_val = 0;
+	int rc = 0;
+	struct msm_vidc_core *core = filp->private_data;
+	size_t size = MAX_STABILITY_STRING_LEN;
+	char kbuf[MAX_STABILITY_STRING_LEN + 1] = { 0 };
+
+	if (!core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, core);
+		return 0;
+	}
+
+	if (!buf)
+		return -EINVAL;
+
+	if (!count)
+		goto exit;
+
+	if (count < size)
+		size = count;
+
+	if (copy_from_user(kbuf, buf, size)) {
+		d_vpr_e("%s: User memory fault\n", __func__);
+		rc = -EFAULT;
+		goto exit;
+	}
+
+	rc = kstrtoul(kbuf, 0, &stability_trigger_val);
+	if (rc) {
+		d_vpr_e("%s: returning error err %d\n", __func__, rc);
+		rc = -EINVAL;
+	} else {
+		msm_vidc_trigger_stability(core, stability_trigger_val);
+		rc = count;
+	}
+exit:
+	return rc;
+}
+
+static const struct file_operations stability_fops = {
+	.open = simple_open,
+	.write = trigger_stability_write,
+};
+
+struct dentry *msm_vidc_debugfs_init_drv(void)
+{
+	struct dentry *dir = NULL;
+
+	dir = debugfs_create_dir("msm_vidc", NULL);
+	if (IS_ERR_OR_NULL(dir)) {
+		dir = NULL;
+		goto failed_create_dir;
+	}
+
+	debugfs_create_u32("core_clock_voting", 0644, dir,
+			&msm_vidc_clock_voting);
+	debugfs_create_u32("ddr_bw_kbps", 0644, dir,
+			&msm_vidc_ddr_bw);
+	debugfs_create_u32("llc_bw_kbps", 0644, dir,
+			&msm_vidc_llc_bw);
+	debugfs_create_bool("disable_video_syscache", 0644, dir,
+			&msm_vidc_syscache_disable);
+	debugfs_create_bool("lossless_encoding", 0644, dir,
+			&msm_vidc_lossless_encode);
+	debugfs_create_u32("enable_bugon", 0644, dir,
+			&msm_vidc_enable_bugon);
+
+	return dir;
+
+failed_create_dir:
+	if (dir)
+		debugfs_remove_recursive(dir);
+
+	return NULL;
+}
+
+struct dentry *msm_vidc_debugfs_init_core(struct msm_vidc_core *core)
+{
+	struct dentry *dir = NULL;
+	char debugfs_name[MAX_DEBUGFS_NAME];
+	struct dentry *parent;
+
+	if (!core->debugfs_parent) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		goto failed_create_dir;
+	}
+	parent = core->debugfs_parent;
+
+	snprintf(debugfs_name, MAX_DEBUGFS_NAME, "core");
+	dir = debugfs_create_dir(debugfs_name, parent);
+	if (IS_ERR_OR_NULL(dir)) {
+		dir = NULL;
+		d_vpr_e("Failed to create debugfs for msm_vidc\n");
+		goto failed_create_dir;
+	}
+	if (!debugfs_create_file("info", 0444, dir, core, &core_info_fops)) {
+		d_vpr_e("debugfs_create_file: fail\n");
+		goto failed_create_dir;
+	}
+	if (!debugfs_create_file("trigger_ssr", 0200,
+			dir, core, &ssr_fops)) {
+		d_vpr_e("debugfs_create_file: fail\n");
+		goto failed_create_dir;
+	}
+	if (!debugfs_create_file("trigger_stability", 0200, dir, core, &stability_fops)) {
+		d_vpr_e("trigger_stability debugfs_create_file: fail\n");
+		goto failed_create_dir;
+	}
+	if (!debugfs_create_file("stats_delay_ms", 0644, dir, core, &stats_delay_fops)) {
+		d_vpr_e("debugfs_create_file: fail\n");
+		goto failed_create_dir;
+	}
+failed_create_dir:
+	return dir;
+}
+
+static int inst_info_open(struct inode *inode, struct file *file)
+{
+	d_vpr_l("Open inode ptr: %pK\n", inode->i_private);
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+static int publish_unreleased_reference(struct msm_vidc_inst *inst,
+		char **dbuf, char *end)
+{
+	return 0;
+}
+
+static ssize_t inst_info_read(struct file *file, char __user *buf,
+		size_t count, loff_t *ppos)
+{
+	struct core_inst_pair *idata = file->private_data;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *inst;
+	char *cur, *end, *dbuf = NULL;
+	int i, j;
+	ssize_t len = 0;
+	struct v4l2_format *f;
+
+	if (!idata || !idata->core || !idata->inst) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, idata);
+		return 0;
+	}
+
+	core = idata->core;
+	inst = idata->inst;
+
+	inst = get_inst(core, inst->session_id);
+	if (!inst) {
+		d_vpr_h("%s: instance has become obsolete", __func__);
+		return 0;
+	}
+
+	dbuf = vzalloc(MAX_DBG_BUF_SIZE);
+	if (!dbuf) {
+		i_vpr_e(inst, "%s: allocation failed\n", __func__);
+		len = -ENOMEM;
+		goto failed_alloc;
+	}
+
+	cur = dbuf;
+	end = cur + MAX_DBG_BUF_SIZE;
+
+	f = &inst->fmts[OUTPUT_PORT];
+	cur += write_str(cur, end - cur, "==============================\n");
+	cur += write_str(cur, end - cur, "INSTANCE: %pK (%s)\n", inst,
+		is_encode_session(inst) ? "Encoder" : "Decoder");
+	cur += write_str(cur, end - cur, "==============================\n");
+	cur += write_str(cur, end - cur, "core: %pK\n", inst->core);
+	cur += write_str(cur, end - cur, "height: %d\n", f->fmt.pix_mp.height);
+	cur += write_str(cur, end - cur, "width: %d\n", f->fmt.pix_mp.width);
+	cur += write_str(cur, end - cur, "fps: %d\n",
+			inst->capabilities[FRAME_RATE].value >> 16);
+	cur += write_str(cur, end - cur, "state: %d\n", inst->state);
+	cur += write_str(cur, end - cur, "secure: %d\n",
+		is_secure_session(inst));
+	cur += write_str(cur, end - cur, "-----------Formats-------------\n");
+	for (i = 0; i < MAX_PORT; i++) {
+		if (i != INPUT_PORT && i != OUTPUT_PORT)
+			continue;
+		f = &inst->fmts[i];
+		cur += write_str(cur, end - cur, "capability: %s\n",
+			i == INPUT_PORT ? "Output" : "Capture");
+		cur += write_str(cur, end - cur, "planes : %d\n",
+			f->fmt.pix_mp.num_planes);
+		cur += write_str(cur, end - cur,
+			"type: %s\n", i == INPUT_PORT ?
+			"Output" : "Capture");
+		cur += write_str(cur, end - cur, "count: %u\n",
+				inst->bufq[i].vb2q->num_buffers);
+
+		for (j = 0; j < f->fmt.pix_mp.num_planes; j++)
+			cur += write_str(cur, end - cur,
+				"size for plane %d: %u\n",
+				j, f->fmt.pix_mp.plane_fmt[j].sizeimage);
+
+		cur += write_str(cur, end - cur, "\n");
+	}
+	cur += write_str(cur, end - cur, "-------------------------------\n");
+	cur += write_str(cur, end - cur, "ETB Count: %d\n",
+		inst->debug_count.etb);
+	cur += write_str(cur, end - cur, "EBD Count: %d\n",
+		inst->debug_count.ebd);
+	cur += write_str(cur, end - cur, "FTB Count: %d\n",
+		inst->debug_count.ftb);
+	cur += write_str(cur, end - cur, "FBD Count: %d\n",
+		inst->debug_count.fbd);
+
+	publish_unreleased_reference(inst, &cur, end);
+	len = simple_read_from_buffer(buf, count, ppos,
+		dbuf, cur - dbuf);
+
+	vfree(dbuf);
+failed_alloc:
+	put_inst(inst);
+	return len;
+}
+
+static int inst_info_release(struct inode *inode, struct file *file)
+{
+	d_vpr_l("Release inode ptr: %pK\n", inode->i_private);
+	file->private_data = NULL;
+	return 0;
+}
+
+static const struct file_operations inst_info_fops = {
+	.open = inst_info_open,
+	.read = inst_info_read,
+	.release = inst_info_release,
+};
+
+struct dentry *msm_vidc_debugfs_init_inst(struct msm_vidc_inst *inst, struct dentry *parent)
+{
+	struct dentry *dir = NULL, *info = NULL;
+	char debugfs_name[MAX_DEBUGFS_NAME];
+	struct core_inst_pair *idata = NULL;
+
+	snprintf(debugfs_name, MAX_DEBUGFS_NAME, "inst_%d", inst->session_id);
+
+	idata = vzalloc(sizeof(*idata));
+	if (!idata) {
+		i_vpr_e(inst, "%s: allocation failed\n", __func__);
+		goto exit;
+	}
+
+	idata->core = inst->core;
+	idata->inst = inst;
+
+	dir = debugfs_create_dir(debugfs_name, parent);
+	if (IS_ERR_OR_NULL(dir)) {
+		dir = NULL;
+		i_vpr_e(inst,
+			"%s: Failed to create debugfs for msm_vidc\n",
+			__func__);
+		goto failed_create_dir;
+	}
+
+	info = debugfs_create_file("info", 0444, dir,
+			idata, &inst_info_fops);
+	if (IS_ERR_OR_NULL(info)) {
+		i_vpr_e(inst, "%s: debugfs_create_file: fail\n",
+			__func__);
+		goto failed_create_file;
+	}
+
+	dir->d_inode->i_private = info->d_inode->i_private;
+	inst->debug.pdata[FRAME_PROCESSING].sampling = true;
+	return dir;
+
+failed_create_file:
+	debugfs_remove_recursive(dir);
+	dir = NULL;
+failed_create_dir:
+	vfree(idata);
+exit:
+	return dir;
+}
+
+void msm_vidc_debugfs_deinit_inst(struct msm_vidc_inst *inst)
+{
+	struct dentry *dentry = NULL;
+
+	if (!inst->debugfs_root)
+		return;
+
+	dentry = inst->debugfs_root;
+	if (dentry->d_inode) {
+		i_vpr_l(inst, "%s: Destroy %pK\n",
+			__func__, dentry->d_inode->i_private);
+		vfree(dentry->d_inode->i_private);
+		dentry->d_inode->i_private = NULL;
+	}
+	debugfs_remove_recursive(dentry);
+	inst->debugfs_root = NULL;
+}
+
+void msm_vidc_debugfs_update(struct msm_vidc_inst *inst,
+	enum msm_vidc_debugfs_event e)
+{
+	struct msm_vidc_debug *d;
+	char a[64] = "Frame processing";
+
+	d = &inst->debug;
+
+	switch (e) {
+	case MSM_VIDC_DEBUGFS_EVENT_ETB:
+		inst->debug_count.etb++;
+		if (inst->debug_count.ebd &&
+			inst->debug_count.ftb > inst->debug_count.fbd) {
+			d->pdata[FRAME_PROCESSING].name[0] = '\0';
+			tic(inst, FRAME_PROCESSING, a);
+		}
+		break;
+	case MSM_VIDC_DEBUGFS_EVENT_EBD:
+		inst->debug_count.ebd++;
+		/*
+		 * Host needs to ensure FW atleast have 2 buffers available always
+		 * one for HW processing and another for fw processing in parallel
+		 * to avoid FW starving for buffers
+		 */
+		if (inst->debug_count.etb < (inst->debug_count.ebd + 2)) {
+			toc(inst, FRAME_PROCESSING);
+			i_vpr_p(inst,
+				"EBD: FW needs input buffers. Processed etb %llu ebd %llu ftb %llu fbd %llu\n",
+				inst->debug_count.etb, inst->debug_count.ebd,
+				inst->debug_count.ftb, inst->debug_count.fbd);
+		}
+		if (inst->debug_count.fbd &&
+			inst->debug_count.ftb < (inst->debug_count.fbd + 2))
+			i_vpr_p(inst,
+				"EBD: FW needs output buffers. Processed etb %llu ebd %llu ftb %llu fbd %llu\n",
+				inst->debug_count.etb, inst->debug_count.ebd,
+				inst->debug_count.ftb, inst->debug_count.fbd);
+		break;
+	case MSM_VIDC_DEBUGFS_EVENT_FTB:
+		inst->debug_count.ftb++;
+		if (inst->debug_count.ebd &&
+			inst->debug_count.etb > inst->debug_count.ebd) {
+			d->pdata[FRAME_PROCESSING].name[0] = '\0';
+			tic(inst, FRAME_PROCESSING, a);
+		}
+		break;
+	case MSM_VIDC_DEBUGFS_EVENT_FBD:
+		inst->debug_count.fbd++;
+		inst->debug.samples++;
+		/*
+		 * Host needs to ensure FW atleast have 2 buffers available always
+		 * one for HW processing and another for fw processing in parallel
+		 * to avoid FW starving for buffers
+		 */
+		if (inst->debug_count.ftb < (inst->debug_count.fbd + 2)) {
+			toc(inst, FRAME_PROCESSING);
+			i_vpr_p(inst,
+				"FBD: FW needs output buffers. Processed etb %llu ebd %llu ftb %llu fbd %llu\n",
+				inst->debug_count.etb, inst->debug_count.ebd,
+				inst->debug_count.ftb, inst->debug_count.fbd);
+		}
+		if (inst->debug_count.ebd &&
+			inst->debug_count.etb < (inst->debug_count.ebd + 2))
+			i_vpr_p(inst,
+				"FBD: FW needs input buffers. Processed etb %llu ebd %llu ftb %llu fbd %llu\n",
+				inst->debug_count.etb, inst->debug_count.ebd,
+				inst->debug_count.ftb, inst->debug_count.fbd);
+		break;
+	default:
+		i_vpr_e(inst, "invalid event in debugfs: %d\n", e);
+		break;
+	}
+}
+
+int msm_vidc_check_ratelimit(void)
+{
+	static DEFINE_RATELIMIT_STATE(_rs,
+				VIDC_DBG_SESSION_RATELIMIT_INTERVAL,
+				VIDC_DBG_SESSION_RATELIMIT_BURST);
+	return __ratelimit(&_rs);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_driver.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_driver.c
@@ -0,0 +1,5598 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iommu.h>
+#include <linux/workqueue.h>
+#include "msm_media_info.h"
+
+#include "msm_vidc_driver.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_memory.h"
+#include "msm_vidc_state.h"
+#include "msm_vidc_power.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc.h"
+#include "msm_vdec.h"
+#include "msm_venc.h"
+#include "msm_vidc_fence.h"
+#include "venus_hfi.h"
+#include "venus_hfi_response.h"
+#include "hfi_packet.h"
+#include "msm_vidc_events.h"
+
+extern struct msm_vidc_core *g_core;
+
+#define is_odd(val) ((val) % 2 == 1)
+#define check_in_range(val, min, max) (((min) <= (val)) && ((val) <= (max)))
+#define COUNT_BITS(a, out) {       \
+	while ((a) >= 1) {          \
+		(out) += (a) & (1); \
+		(a) >>= (1);        \
+	}                           \
+}
+
+#define SSR_TYPE 0x0000000F
+#define SSR_TYPE_SHIFT 0
+#define SSR_SUB_CLIENT_ID 0x000000F0
+#define SSR_SUB_CLIENT_ID_SHIFT 4
+#define SSR_ADDR_ID 0xFFFFFFFF00000000
+#define SSR_ADDR_SHIFT 32
+
+#define STABILITY_TYPE 0x0000000F
+#define STABILITY_TYPE_SHIFT 0
+#define STABILITY_SUB_CLIENT_ID 0x000000F0
+#define STABILITY_SUB_CLIENT_ID_SHIFT 4
+#define STABILITY_PAYLOAD_ID 0xFFFFFFFF00000000
+#define STABILITY_PAYLOAD_SHIFT 32
+
+/* do not modify the cap names as it is used in test scripts */
+static const char * const cap_name_arr[] =
+	FOREACH_CAP(GENERATE_STRING);
+
+const char *cap_name(enum msm_vidc_inst_capability_type cap_id)
+{
+	const char *name = "UNKNOWN CAP";
+
+	if (cap_id >= ARRAY_SIZE(cap_name_arr))
+		goto exit;
+
+	name = cap_name_arr[cap_id];
+
+exit:
+	return name;
+}
+
+static const char * const buf_type_name_arr[] =
+	FOREACH_BUF_TYPE(GENERATE_STRING);
+
+const char *buf_name(enum msm_vidc_buffer_type type)
+{
+	const char *name = "UNKNOWN BUF";
+
+	if (type >= ARRAY_SIZE(buf_type_name_arr))
+		goto exit;
+
+	name = buf_type_name_arr[type];
+
+exit:
+	return name;
+}
+
+static const char * const inst_allow_name_arr[] =
+	FOREACH_ALLOW(GENERATE_STRING);
+
+const char *allow_name(enum msm_vidc_allow allow)
+{
+	const char *name = "UNKNOWN";
+
+	if (allow >= ARRAY_SIZE(inst_allow_name_arr))
+		goto exit;
+
+	name = inst_allow_name_arr[allow];
+
+exit:
+	return name;
+}
+
+const char *v4l2_type_name(u32 port)
+{
+	switch (port) {
+	case INPUT_MPLANE:      return "INPUT";
+	case OUTPUT_MPLANE:     return "OUTPUT";
+	case INPUT_META_PLANE:  return "INPUT_META";
+	case OUTPUT_META_PLANE: return "OUTPUT_META";
+	}
+
+	return "UNKNOWN";
+}
+
+const char *v4l2_pixelfmt_name(struct msm_vidc_inst *inst, u32 pixfmt)
+{
+	struct msm_vidc_core *core;
+	const struct codec_info *codec_info;
+	const struct color_format_info *color_format_info;
+	u32 i, size;
+
+	core = inst->core;
+	codec_info = core->platform->data.format_data->codec_info;
+	size = core->platform->data.format_data->codec_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (codec_info[i].v4l2_codec == pixfmt)
+			return codec_info[i].pixfmt_name;
+	}
+
+	color_format_info = core->platform->data.format_data->color_format_info;
+	size = core->platform->data.format_data->color_format_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (color_format_info[i].v4l2_color_format == pixfmt)
+			return color_format_info[i].pixfmt_name;
+	}
+
+	return "UNKNOWN";
+}
+
+void print_vidc_buffer(u32 tag, const char *tag_str, const char *str, struct msm_vidc_inst *inst,
+		struct msm_vidc_buffer *vbuf)
+{
+	struct dma_buf *dbuf;
+	struct inode *f_inode;
+	unsigned long inode_num = 0;
+	long ref_count = -1;
+
+	if (!vbuf || !tag_str || !str)
+		return;
+
+	dbuf = (struct dma_buf *)vbuf->dmabuf;
+	if (dbuf && dbuf->file) {
+		f_inode = file_inode(dbuf->file);
+		if (f_inode) {
+			inode_num = f_inode->i_ino;
+			ref_count = file_count(dbuf->file);
+		}
+	}
+
+	dprintk_inst(tag, tag_str, inst,
+		"%s: %s: idx %2d fd %3d off %d daddr %#llx inode %8lu ref %2ld size %8d filled %8d flags %#x ts %8lld attr %#x dbuf_get %d attach %d map %d counts(etb ebd ftb fbd) %4llu %4llu %4llu %4llu\n",
+		str, buf_name(vbuf->type),
+		vbuf->index, vbuf->fd, vbuf->data_offset,
+		vbuf->device_addr, inode_num, ref_count, vbuf->buffer_size,
+		vbuf->data_size, vbuf->flags, vbuf->timestamp, vbuf->attr,
+		vbuf->dbuf_get, vbuf->attach ? 1 : 0, vbuf->sg_table ? 1 : 0,
+		inst->debug_count.etb, inst->debug_count.ebd,
+		inst->debug_count.ftb, inst->debug_count.fbd);
+
+	trace_msm_v4l2_vidc_buffer_event_log(inst, str, buf_name(vbuf->type), vbuf,
+		inode_num, ref_count);
+}
+
+void print_vb2_buffer(const char *str, struct msm_vidc_inst *inst,
+		struct vb2_buffer *vb2)
+{
+	if (vb2->type == INPUT_MPLANE || vb2->type == OUTPUT_MPLANE) {
+		i_vpr_e(inst,
+			"%s: %s: idx %2d fd %d off %d size %d filled %d\n",
+			str, vb2->type == INPUT_MPLANE ? "INPUT" : "OUTPUT",
+			vb2->index, vb2->planes[0].m.fd,
+			vb2->planes[0].data_offset, vb2->planes[0].length,
+			vb2->planes[0].bytesused);
+	} else if (vb2->type == INPUT_META_PLANE || vb2->type == OUTPUT_META_PLANE) {
+		i_vpr_e(inst,
+			"%s: %s: idx %2d fd %d off %d size %d filled %d\n",
+			str, vb2->type == INPUT_MPLANE ? "INPUT_META" : "OUTPUT_META",
+			vb2->index, vb2->planes[0].m.fd,
+			vb2->planes[0].data_offset, vb2->planes[0].length,
+			vb2->planes[0].bytesused);
+	}
+}
+
+static void print_buffer_stats(u32 tag, const char *tag_str, struct msm_vidc_inst *inst,
+		struct msm_vidc_buffer_stats *stats)
+{
+	if (!tag_str || !stats)
+		return;
+
+	/* skip flushed buffer stats */
+	if (!stats->etb_time_ms || !stats->ebd_time_ms ||
+	    !stats->ftb_time_ms || !stats->fbd_time_ms)
+		return;
+
+	dprintk_inst(tag, tag_str, inst,
+		"f.no %4u ts %16llu (etb ebd ftb fbd)ms %6u %6u %6u %6u (ebd-etb fbd-etb etb-ftb)ms %4d %4d %4d size %8u attr %#x\n",
+		stats->frame_num, stats->timestamp, stats->etb_time_ms, stats->ebd_time_ms,
+		stats->ftb_time_ms, stats->fbd_time_ms, stats->ebd_time_ms - stats->etb_time_ms,
+		stats->fbd_time_ms - stats->etb_time_ms, stats->etb_time_ms - stats->ftb_time_ms,
+		stats->data_size, stats->flags);
+}
+
+static u32 msm_vidc_get_buffer_stats_flag(struct msm_vidc_inst *inst)
+{
+	u32 flags = 0;
+
+	if (inst->hfi_frame_info.data_corrupt)
+		flags |= MSM_VIDC_STATS_FLAG_CORRUPT;
+
+	if (inst->hfi_frame_info.overflow)
+		flags |= MSM_VIDC_STATS_FLAG_OVERFLOW;
+
+	if (inst->hfi_frame_info.no_output)
+		flags |= MSM_VIDC_STATS_FLAG_NO_OUTPUT;
+
+	if (inst->hfi_frame_info.subframe_input)
+		flags |= MSM_VIDC_STATS_FLAG_SUBFRAME_INPUT;
+
+	return flags;
+}
+
+int msm_vidc_suspend(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = venus_hfi_suspend(core);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_add_buffer_stats(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf, u64 timestamp)
+{
+	struct msm_vidc_buffer_stats *stats = NULL;
+
+	if (!(msm_vidc_debug & VIDC_LOW))
+		return 0;
+
+	/* stats applicable only to input & output buffers */
+	if (!is_input_buffer(buf->type) && !is_output_buffer(buf->type))
+		return -EINVAL;
+
+	/* update start timestamp */
+	buf->start_time_ms = (ktime_get_ns() / 1000 - inst->initial_time_us) / 1000;
+
+	/* add buffer stats only in ETB path */
+	if (!is_input_buffer(buf->type))
+		return 0;
+
+	stats = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_BUF_STATS);
+	if (!stats)
+		return -ENOMEM;
+	INIT_LIST_HEAD(&stats->list);
+	list_add_tail(&stats->list, &inst->buffer_stats_list);
+
+	stats->frame_num = inst->debug_count.etb;
+	stats->timestamp = timestamp;
+	stats->ts_offset = 0;
+	stats->etb_time_ms = buf->start_time_ms;
+	if (is_decode_session(inst))
+		stats->data_size =  buf->data_size;
+
+	return 0;
+}
+
+int msm_vidc_remove_buffer_stats(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf, u64 timestamp)
+{
+	struct msm_vidc_buffer_stats *stats = NULL, *dummy_stats = NULL;
+	struct msm_vidc_buffer_stats *prev_stats = NULL;
+	bool remove_stat = false, is_first_stat = false;;
+
+	if (!(msm_vidc_debug & VIDC_LOW))
+		return 0;
+
+	/* stats applicable only to input & output buffers */
+	if (!is_input_buffer(buf->type) && !is_output_buffer(buf->type))
+		return -EINVAL;
+
+	/* update end timestamp */
+	buf->end_time_ms = (ktime_get_ns() / 1000 - inst->initial_time_us) / 1000;
+
+	list_for_each_entry_safe(stats, dummy_stats, &inst->buffer_stats_list, list) {
+		if (stats->timestamp - stats->ts_offset != timestamp)
+			continue;
+
+		remove_stat = false;
+		if (is_input_buffer(buf->type)) {
+			/* skip - ebd already updated(multiple input - single output case) */
+			if (stats->ebd_time_ms)
+				continue;
+
+			/* ebd: update end ts and return */
+			stats->ebd_time_ms = buf->end_time_ms;
+			stats->flags |= msm_vidc_get_buffer_stats_flag(inst);
+
+			/* multi in - single out (interlace/slice decoding case) */
+			is_first_stat = list_is_first(&stats->list, &inst->buffer_stats_list);
+			if (!is_first_stat) {
+				prev_stats = list_prev_entry(stats, list);
+
+				/* add offset if FW requires more etb's to process output */
+				if (prev_stats->flags & MSM_VIDC_STATS_FLAG_SUBFRAME_INPUT)
+					stats->ts_offset = stats->timestamp - prev_stats->timestamp;
+			}
+
+			/* remove entry - no output attached */
+			remove_stat = !!(stats->flags & MSM_VIDC_STATS_FLAG_NO_OUTPUT);
+			remove_stat |= stats->ebd_time_ms && stats->fbd_time_ms;
+		} else if (is_output_buffer(buf->type)) {
+			/* skip - ebd already updated(encoder superframe case) */
+			if (stats->fbd_time_ms)
+				continue;
+
+			/* fbd: update end ts */
+			stats->ftb_time_ms = buf->start_time_ms;
+			stats->fbd_time_ms = buf->end_time_ms;
+			stats->flags |= msm_vidc_get_buffer_stats_flag(inst);
+			if (is_encode_session(inst))
+				stats->data_size = buf->data_size;
+
+			remove_stat |= stats->ebd_time_ms && stats->fbd_time_ms;
+		}
+		/* remove stats node */
+		if (remove_stat) {
+			list_del_init(&stats->list);
+			print_buffer_stats(VIDC_LOW, "low ", inst, stats);
+			msm_vidc_pool_free(inst, stats);
+		}
+	}
+
+	return 0;
+}
+
+int msm_vidc_flush_buffer_stats(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_buffer_stats *stats, *dummy_stats;
+
+	i_vpr_l(inst, "%s: flush buffer_stats list\n", __func__);
+	list_for_each_entry_safe(stats, dummy_stats, &inst->buffer_stats_list, list) {
+		list_del_init(&stats->list);
+		msm_vidc_pool_free(inst, stats);
+	}
+
+	/* reset initial ts as well to avoid huge delta */
+	inst->initial_time_us = ktime_get_ns() / 1000;
+
+	return 0;
+}
+
+enum msm_vidc_buffer_type v4l2_type_to_driver(u32 type, const char *func)
+{
+	enum msm_vidc_buffer_type buffer_type = 0;
+
+	switch (type) {
+	case INPUT_MPLANE:
+		buffer_type = MSM_VIDC_BUF_INPUT;
+		break;
+	case OUTPUT_MPLANE:
+		buffer_type = MSM_VIDC_BUF_OUTPUT;
+		break;
+	case INPUT_META_PLANE:
+		buffer_type = MSM_VIDC_BUF_INPUT_META;
+		break;
+	case OUTPUT_META_PLANE:
+		buffer_type = MSM_VIDC_BUF_OUTPUT_META;
+		break;
+	default:
+		d_vpr_e("%s: invalid v4l2 buffer type %#x\n", func, type);
+		break;
+	}
+	return buffer_type;
+}
+
+u32 v4l2_type_from_driver(enum msm_vidc_buffer_type buffer_type,
+	const char *func)
+{
+	u32 type = 0;
+
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_INPUT:
+		type = INPUT_MPLANE;
+		break;
+	case MSM_VIDC_BUF_OUTPUT:
+		type = OUTPUT_MPLANE;
+		break;
+	case MSM_VIDC_BUF_INPUT_META:
+		type = INPUT_META_PLANE;
+		break;
+	case MSM_VIDC_BUF_OUTPUT_META:
+		type = OUTPUT_META_PLANE;
+		break;
+	default:
+		d_vpr_e("%s: invalid driver buffer type %d\n",
+			func, buffer_type);
+		break;
+	}
+	return type;
+}
+
+enum msm_vidc_codec_type v4l2_codec_to_driver(struct msm_vidc_inst *inst,
+	u32 v4l2_codec, const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct codec_info *codec_info;
+	u32 i, size;
+	enum msm_vidc_codec_type codec = 0;
+
+	core = inst->core;
+	codec_info = core->platform->data.format_data->codec_info;
+	size = core->platform->data.format_data->codec_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (codec_info[i].v4l2_codec == v4l2_codec)
+			return codec_info[i].vidc_codec;
+	}
+
+	d_vpr_h("%s: invalid v4l2 codec %#x\n", func, v4l2_codec);
+	return codec;
+}
+
+u32 v4l2_codec_from_driver(struct msm_vidc_inst *inst,
+	enum msm_vidc_codec_type codec, const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct codec_info *codec_info;
+	u32 i, size;
+	u32 v4l2_codec = 0;
+
+	core = inst->core;
+	codec_info = core->platform->data.format_data->codec_info;
+	size = core->platform->data.format_data->codec_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (codec_info[i].vidc_codec == codec)
+			return codec_info[i].v4l2_codec;
+	}
+
+	d_vpr_e("%s: invalid driver codec %#x\n", func, codec);
+	return v4l2_codec;
+}
+
+enum msm_vidc_colorformat_type v4l2_colorformat_to_driver(
+	struct msm_vidc_inst *inst,
+	u32 v4l2_colorformat, const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct color_format_info *color_format_info;
+	u32 i, size;
+	enum msm_vidc_colorformat_type colorformat = 0;
+
+	core = inst->core;
+	color_format_info = core->platform->data.format_data->color_format_info;
+	size = core->platform->data.format_data->color_format_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (color_format_info[i].v4l2_color_format == v4l2_colorformat)
+			return color_format_info[i].vidc_color_format;
+	}
+
+	d_vpr_e("%s: invalid v4l2 color format %#x\n", func, v4l2_colorformat);
+	return colorformat;
+}
+
+u32 v4l2_colorformat_from_driver(struct msm_vidc_inst *inst,
+	enum msm_vidc_colorformat_type colorformat,
+	const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct color_format_info *color_format_info;
+	u32 i, size;
+	u32 v4l2_colorformat = 0;
+
+	core = inst->core;
+	color_format_info = core->platform->data.format_data->color_format_info;
+	size = core->platform->data.format_data->color_format_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (color_format_info[i].vidc_color_format == colorformat)
+			return color_format_info[i].v4l2_color_format;
+	}
+
+	d_vpr_e("%s: invalid driver color format %#x\n", func, colorformat);
+	return v4l2_colorformat;
+}
+
+u32 v4l2_color_primaries_to_driver(struct msm_vidc_inst *inst,
+	u32 v4l2_primaries, const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct color_primaries_info *color_prim_info;
+	u32 i, size;
+	u32 vidc_color_primaries = MSM_VIDC_PRIMARIES_RESERVED;
+
+	core = inst->core;
+	color_prim_info = core->platform->data.format_data->color_prim_info;
+	size = core->platform->data.format_data->color_prim_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (color_prim_info[i].v4l2_color_primaries == v4l2_primaries)
+			return color_prim_info[i].vidc_color_primaries;
+	}
+
+	i_vpr_e(inst, "%s: invalid v4l2 color primaries %d\n",
+		func, v4l2_primaries);
+
+	return vidc_color_primaries;
+}
+
+u32 v4l2_color_primaries_from_driver(struct msm_vidc_inst *inst,
+	u32 vidc_color_primaries, const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct color_primaries_info *color_prim_info;
+	u32 i, size;
+	u32 v4l2_primaries = V4L2_COLORSPACE_DEFAULT;
+
+	core = inst->core;
+	color_prim_info = core->platform->data.format_data->color_prim_info;
+	size = core->platform->data.format_data->color_prim_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (color_prim_info[i].vidc_color_primaries == vidc_color_primaries)
+			return color_prim_info[i].v4l2_color_primaries;
+	}
+
+	i_vpr_e(inst, "%s: invalid hfi color primaries %d\n",
+		func, vidc_color_primaries);
+
+	return v4l2_primaries;
+}
+
+u32 v4l2_transfer_char_to_driver(struct msm_vidc_inst *inst,
+	u32 v4l2_transfer_char, const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct transfer_char_info *transfer_char_info;
+	u32 i, size;
+	u32 vidc_transfer_char = MSM_VIDC_TRANSFER_RESERVED;
+
+	core = inst->core;
+	transfer_char_info = core->platform->data.format_data->transfer_char_info;
+	size = core->platform->data.format_data->transfer_char_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (transfer_char_info[i].v4l2_transfer_char == v4l2_transfer_char)
+			return transfer_char_info[i].vidc_transfer_char;
+	}
+
+	i_vpr_e(inst, "%s: invalid v4l2 transfer char %d\n",
+		func, v4l2_transfer_char);
+
+	return vidc_transfer_char;
+}
+
+u32 v4l2_transfer_char_from_driver(struct msm_vidc_inst *inst,
+	u32 vidc_transfer_char, const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct transfer_char_info *transfer_char_info;
+	u32 i, size;
+	u32  v4l2_transfer_char = V4L2_XFER_FUNC_DEFAULT;
+
+	core = inst->core;
+	transfer_char_info = core->platform->data.format_data->transfer_char_info;
+	size = core->platform->data.format_data->transfer_char_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (transfer_char_info[i].vidc_transfer_char == vidc_transfer_char)
+			return transfer_char_info[i].v4l2_transfer_char;
+	}
+
+	i_vpr_e(inst, "%s: invalid hfi transfer char %d\n",
+			func, vidc_transfer_char);
+
+	return v4l2_transfer_char;
+}
+
+u32 v4l2_matrix_coeff_to_driver(struct msm_vidc_inst *inst,
+	u32 v4l2_matrix_coeff, const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct matrix_coeff_info *matrix_coeff_info;
+	u32 i, size;
+	u32 vidc_matrix_coeff = MSM_VIDC_MATRIX_COEFF_RESERVED;
+
+	core = inst->core;
+	matrix_coeff_info = core->platform->data.format_data->matrix_coeff_info;
+	size = core->platform->data.format_data->matrix_coeff_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (matrix_coeff_info[i].v4l2_matrix_coeff == v4l2_matrix_coeff)
+			return matrix_coeff_info[i].vidc_matrix_coeff;
+	}
+
+	i_vpr_e(inst, "%s: invalid v4l2 matrix coeff %d\n",
+		func, v4l2_matrix_coeff);
+
+	return vidc_matrix_coeff;
+}
+
+u32 v4l2_matrix_coeff_from_driver(struct msm_vidc_inst *inst,
+	u32 vidc_matrix_coeff, const char *func)
+{
+	struct msm_vidc_core *core;
+	const struct matrix_coeff_info *matrix_coeff_info;
+	u32 i, size;
+	u32 v4l2_matrix_coeff = V4L2_YCBCR_ENC_DEFAULT;
+
+	core = inst->core;
+	matrix_coeff_info = core->platform->data.format_data->matrix_coeff_info;
+	size = core->platform->data.format_data->matrix_coeff_info_size;
+
+	for (i = 0; i < size; i++) {
+		if (matrix_coeff_info[i].vidc_matrix_coeff == vidc_matrix_coeff)
+			return matrix_coeff_info[i].v4l2_matrix_coeff;
+	}
+
+	i_vpr_e(inst, "%s: invalid hfi matrix coeff %d\n",
+		func, vidc_matrix_coeff);
+
+	return v4l2_matrix_coeff;
+}
+
+int v4l2_type_to_driver_port(struct msm_vidc_inst *inst, u32 type,
+	const char *func)
+{
+	int port;
+
+	if (type == INPUT_MPLANE) {
+		port = INPUT_PORT;
+	} else if (type == INPUT_META_PLANE) {
+		port = INPUT_META_PORT;
+	} else if (type == OUTPUT_MPLANE) {
+		port = OUTPUT_PORT;
+	} else if (type == OUTPUT_META_PLANE) {
+		port = OUTPUT_META_PORT;
+	} else {
+		i_vpr_e(inst, "%s: port not found for v4l2 type %d\n",
+			func, type);
+		port = -EINVAL;
+	}
+
+	return port;
+}
+
+struct msm_vidc_buffers *msm_vidc_get_buffers(
+	struct msm_vidc_inst *inst, enum msm_vidc_buffer_type buffer_type,
+	const char *func)
+{
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_INPUT:
+		return &inst->buffers.input;
+	case MSM_VIDC_BUF_INPUT_META:
+		return &inst->buffers.input_meta;
+	case MSM_VIDC_BUF_OUTPUT:
+		return &inst->buffers.output;
+	case MSM_VIDC_BUF_OUTPUT_META:
+		return &inst->buffers.output_meta;
+	case MSM_VIDC_BUF_READ_ONLY:
+		return &inst->buffers.read_only;
+	case MSM_VIDC_BUF_BIN:
+		return &inst->buffers.bin;
+	case MSM_VIDC_BUF_ARP:
+		return &inst->buffers.arp;
+	case MSM_VIDC_BUF_COMV:
+		return &inst->buffers.comv;
+	case MSM_VIDC_BUF_NON_COMV:
+		return &inst->buffers.non_comv;
+	case MSM_VIDC_BUF_LINE:
+		return &inst->buffers.line;
+	case MSM_VIDC_BUF_DPB:
+		return &inst->buffers.dpb;
+	case MSM_VIDC_BUF_PERSIST:
+		return &inst->buffers.persist;
+	case MSM_VIDC_BUF_VPSS:
+		return &inst->buffers.vpss;
+	case MSM_VIDC_BUF_PARTIAL_DATA:
+		return &inst->buffers.partial_data;
+	case MSM_VIDC_BUF_INTERFACE_QUEUE:
+		return NULL;
+	default:
+		i_vpr_e(inst, "%s: invalid driver buffer type %d\n",
+			func, buffer_type);
+		return NULL;
+	}
+}
+
+struct msm_vidc_mem_list *msm_vidc_get_mem_info(
+	struct msm_vidc_inst *inst, enum msm_vidc_buffer_type buffer_type,
+	const char *func)
+{
+	switch (buffer_type) {
+	case MSM_VIDC_BUF_BIN:
+		return &inst->mem_info.bin;
+	case MSM_VIDC_BUF_ARP:
+		return &inst->mem_info.arp;
+	case MSM_VIDC_BUF_COMV:
+		return &inst->mem_info.comv;
+	case MSM_VIDC_BUF_NON_COMV:
+		return &inst->mem_info.non_comv;
+	case MSM_VIDC_BUF_LINE:
+		return &inst->mem_info.line;
+	case MSM_VIDC_BUF_DPB:
+		return &inst->mem_info.dpb;
+	case MSM_VIDC_BUF_PERSIST:
+		return &inst->mem_info.persist;
+	case MSM_VIDC_BUF_VPSS:
+		return &inst->mem_info.vpss;
+	case MSM_VIDC_BUF_PARTIAL_DATA:
+		return &inst->mem_info.partial_data;
+	default:
+		i_vpr_e(inst, "%s: invalid driver buffer type %d\n",
+			func, buffer_type);
+		return NULL;
+	}
+}
+
+bool res_is_greater_than(u32 width, u32 height,
+	u32 ref_width, u32 ref_height)
+{
+	u32 num_mbs = NUM_MBS_PER_FRAME(height, width);
+	u32 max_side = max(ref_width, ref_height);
+
+	if (num_mbs > NUM_MBS_PER_FRAME(ref_height, ref_width) ||
+		width > max_side ||
+		height > max_side)
+		return true;
+	else
+		return false;
+}
+
+bool res_is_greater_than_or_equal_to(u32 width, u32 height,
+	u32 ref_width, u32 ref_height)
+{
+	u32 num_mbs = NUM_MBS_PER_FRAME(height, width);
+	u32 max_side = max(ref_width, ref_height);
+
+	if (num_mbs >= NUM_MBS_PER_FRAME(ref_height, ref_width) ||
+		width >= max_side ||
+		height >= max_side)
+		return true;
+	else
+		return false;
+}
+
+bool res_is_less_than(u32 width, u32 height,
+	u32 ref_width, u32 ref_height)
+{
+	u32 num_mbs = NUM_MBS_PER_FRAME(height, width);
+	u32 max_side = max(ref_width, ref_height);
+
+	if (num_mbs < NUM_MBS_PER_FRAME(ref_height, ref_width) &&
+		width < max_side &&
+		height < max_side)
+		return true;
+	else
+		return false;
+}
+
+bool res_is_less_than_or_equal_to(u32 width, u32 height,
+	u32 ref_width, u32 ref_height)
+{
+	u32 num_mbs = NUM_MBS_PER_FRAME(height, width);
+	u32 max_side = max(ref_width, ref_height);
+
+	if (num_mbs <= NUM_MBS_PER_FRAME(ref_height, ref_width) &&
+		width <= max_side &&
+		height <= max_side)
+		return true;
+	else
+		return false;
+}
+
+int msm_vidc_qbuf_cache_operation(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf)
+{
+	int rc = 0;
+	enum msm_memory_cache_type cache_type;
+
+	if (!inst || !buf) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	if (is_decode_session(inst) || is_encode_session(inst)) {
+		switch (buf->type) {
+		case MSM_VIDC_BUF_INPUT:
+			cache_type = MSM_MEM_CACHE_CLEAN_INVALIDATE;
+			break;
+		case MSM_VIDC_BUF_OUTPUT:
+			cache_type = MSM_MEM_CACHE_INVALIDATE;
+			break;
+		default:
+			i_vpr_e(inst, "%s: invalid driver buffer type %d\n",
+				__func__, buf->type);
+			return -EINVAL;
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid session type %d\n", __func__, inst->domain);
+		return -EINVAL;
+	}
+
+	if (buf->dmabuf) {
+		rc = msm_memory_cache_operations(inst, buf->dmabuf, cache_type);
+		if (rc)
+			print_vidc_buffer(VIDC_ERR, "err ", "qbuf cache ops failed", inst, buf);
+	}
+
+	return rc;
+}
+
+int msm_vidc_dqbuf_cache_operation(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf)
+{
+	int rc = 0;
+	enum msm_memory_cache_type cache_type = MSM_MEM_CACHE_INVALIDATE;
+	bool skip = false;
+
+	if (!inst || !buf) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	if (is_decode_session(inst) || is_encode_session(inst)) {
+		switch (buf->type) {
+		case MSM_VIDC_BUF_INPUT:
+			skip = true;
+			break;
+		case MSM_VIDC_BUF_OUTPUT:
+			cache_type = MSM_MEM_CACHE_INVALIDATE;
+			break;
+		default:
+			i_vpr_e(inst, "%s: invalid driver buffer type %d\n",
+				__func__, buf->type);
+			return -EINVAL;
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid session type %d\n", __func__, inst->domain);
+		return -EINVAL;
+	}
+
+	/* skip caching for input buffer done(both encode & decode session) */
+	if (skip)
+		return 0;
+
+	if (buf->dmabuf) {
+		rc = msm_memory_cache_operations(inst, buf->dmabuf, cache_type);
+		if (rc)
+			print_vidc_buffer(VIDC_ERR, "err ", "dqbuf cache ops failed", inst, buf);
+	}
+
+	return rc;
+}
+
+int signal_session_msg_receipt(struct msm_vidc_inst *inst,
+	enum signal_session_response cmd)
+{
+	if (cmd < MAX_SIGNAL)
+		complete(&inst->completions[cmd]);
+	return 0;
+}
+
+bool msm_vidc_allow_metadata_delivery(struct msm_vidc_inst *inst, u32 cap_id,
+	u32 port)
+{
+	return true;
+}
+
+bool msm_vidc_allow_metadata_subscription(struct msm_vidc_inst *inst, u32 cap_id,
+	u32 port)
+{
+	bool is_allowed = true;
+
+	if (port == INPUT_PORT) {
+		switch (cap_id) {
+		case META_BUF_TAG:
+		case META_BITSTREAM_RESOLUTION:
+		case META_CROP_OFFSETS:
+		case META_SEI_MASTERING_DISP:
+		case META_SEI_CLL:
+		case META_HDR10PLUS:
+			if (!is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE)) {
+				i_vpr_h(inst,
+					"%s: cap: %24s not allowed as output buffer fence is disabled\n",
+					__func__, cap_name(cap_id));
+				is_allowed = false;
+			}
+			break;
+		case META_DPB_TAG_LIST:
+			if (!is_ubwc_colorformat(inst->capabilities[PIX_FMTS].value)) {
+				i_vpr_h(inst,
+					"%s: cap: %24s not allowed for split mode\n",
+					__func__, cap_name(cap_id));
+				is_allowed = false;
+			}
+			break;
+		default:
+			is_allowed = true;
+			break;
+		}
+	} else if (port == OUTPUT_PORT) {
+		is_allowed = true;
+	} else {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		is_allowed = false;
+	}
+
+	return is_allowed;
+}
+
+bool msm_vidc_allow_property(struct msm_vidc_inst *inst, u32 hfi_id)
+{
+	bool is_allowed = true;
+
+	switch (hfi_id) {
+	case HFI_PROP_AV1_TILE_ROWS_COLUMNS:
+	case HFI_PROP_AV1_UNIFORM_TILE_SPACING:
+		if (inst->codec == MSM_VIDC_AV1)
+			is_allowed = true;
+		else
+			is_allowed = false;
+		break;
+	case HFI_PROP_FENCE:
+		if (!is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE)) {
+			i_vpr_h(inst,
+				"%s: cap: %24s not enabled, hence not allowed to subscribe\n",
+				__func__, cap_name(META_OUTBUF_FENCE));
+			is_allowed = false;
+		}
+		break;
+	default:
+		is_allowed = true;
+		break;
+	}
+
+	return is_allowed;
+}
+
+enum msm_vidc_allow msm_vidc_allow_input_psc(struct msm_vidc_inst *inst)
+{
+	enum msm_vidc_allow allow = MSM_VIDC_ALLOW;
+
+	/*
+	 * if drc sequence is not completed by client, fw is not
+	 * expected to raise another ipsc
+	 */
+	if (is_sub_state(inst, MSM_VIDC_DRC)) {
+		i_vpr_e(inst, "%s: not allowed in sub state %s\n",
+			__func__, inst->sub_state_name);
+		return MSM_VIDC_DISALLOW;
+	}
+
+	return allow;
+}
+
+bool msm_vidc_allow_drain_last_flag(struct msm_vidc_inst *inst)
+{
+	/*
+	 * drain last flag is expected only when DRAIN, INPUT_PAUSE
+	 * is set and DRAIN_LAST_BUFFER is not set
+	 */
+	if (is_sub_state(inst, MSM_VIDC_DRAIN) &&
+		is_sub_state(inst, MSM_VIDC_INPUT_PAUSE) &&
+		!is_sub_state(inst, MSM_VIDC_DRAIN_LAST_BUFFER))
+		return true;
+
+	i_vpr_e(inst, "%s: not allowed in sub state %s\n",
+			__func__, inst->sub_state_name);
+	return false;
+}
+
+bool msm_vidc_allow_psc_last_flag(struct msm_vidc_inst *inst)
+{
+	/*
+	 * drc last flag is expected only when DRC, INPUT_PAUSE
+	 * is set and DRC_LAST_BUFFER is not set
+	 */
+	if (is_sub_state(inst, MSM_VIDC_DRC) &&
+		is_sub_state(inst, MSM_VIDC_INPUT_PAUSE) &&
+		!is_sub_state(inst, MSM_VIDC_DRC_LAST_BUFFER))
+		return true;
+
+	i_vpr_e(inst, "%s: not allowed in sub state %s\n",
+			__func__, inst->sub_state_name);
+
+	return false;
+}
+
+enum msm_vidc_allow msm_vidc_allow_pm_suspend(struct msm_vidc_core *core)
+{
+	/* core must be in valid state to do pm_suspend */
+	if (!core_in_valid_state(core)) {
+		d_vpr_e("%s: invalid core state %s\n",
+			__func__, core_state_name(core->state));
+		return MSM_VIDC_DISALLOW;
+	}
+
+	/* check if power is enabled */
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE)) {
+		d_vpr_h("%s: Power already disabled\n", __func__);
+		return MSM_VIDC_IGNORE;
+	}
+
+	return MSM_VIDC_ALLOW;
+}
+
+bool is_hevc_10bit_decode_session(struct msm_vidc_inst *inst)
+{
+	bool is10bit = false;
+	enum msm_vidc_colorformat_type colorformat;
+
+	/* in case of decoder session return false */
+	if (!is_decode_session(inst))
+		return false;
+
+	colorformat = v4l2_colorformat_to_driver(inst,
+		inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+
+	if (colorformat == MSM_VIDC_FMT_TP10C || colorformat == MSM_VIDC_FMT_P010)
+		is10bit = true;
+
+	return is_decode_session(inst) &&
+				inst->codec == MSM_VIDC_HEVC &&
+				is10bit;
+}
+
+int msm_vidc_state_change_streamon(struct msm_vidc_inst *inst,
+		enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	enum msm_vidc_state new_state = MSM_VIDC_ERROR;
+
+	if (port == INPUT_META_PORT || port == OUTPUT_META_PORT)
+		return 0;
+
+	if (port == INPUT_PORT) {
+		if (is_state(inst, MSM_VIDC_OPEN))
+			new_state = MSM_VIDC_INPUT_STREAMING;
+		else if (is_state(inst, MSM_VIDC_OUTPUT_STREAMING))
+			new_state = MSM_VIDC_STREAMING;
+	} else if (port == OUTPUT_PORT) {
+		if (is_state(inst, MSM_VIDC_OPEN))
+			new_state = MSM_VIDC_OUTPUT_STREAMING;
+		else if (is_state(inst, MSM_VIDC_INPUT_STREAMING))
+			new_state = MSM_VIDC_STREAMING;
+	}
+
+	rc = msm_vidc_change_state(inst, new_state, __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_state_change_streamoff(struct msm_vidc_inst *inst,
+		enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	enum msm_vidc_state new_state = MSM_VIDC_ERROR;
+
+	if (port == INPUT_META_PORT || port == OUTPUT_META_PORT)
+		return 0;
+
+	if (port == INPUT_PORT) {
+		if (is_state(inst, MSM_VIDC_INPUT_STREAMING))
+			new_state = MSM_VIDC_OPEN;
+		else if (is_state(inst, MSM_VIDC_STREAMING))
+			new_state = MSM_VIDC_OUTPUT_STREAMING;
+	} else if (port == OUTPUT_PORT) {
+		if (is_state(inst, MSM_VIDC_OUTPUT_STREAMING))
+			new_state = MSM_VIDC_OPEN;
+		else if (is_state(inst, MSM_VIDC_STREAMING))
+			new_state = MSM_VIDC_INPUT_STREAMING;
+	}
+	rc = msm_vidc_change_state(inst, new_state, __func__);
+	if (rc)
+		goto exit;
+
+exit:
+	return rc;
+}
+
+int msm_vidc_process_drain(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = venus_hfi_session_drain(inst, INPUT_PORT);
+	if (rc)
+		return rc;
+	rc = msm_vidc_change_sub_state(inst, 0, MSM_VIDC_DRAIN, __func__);
+	if (rc)
+		return rc;
+
+	msm_vidc_scale_power(inst, true);
+
+	return rc;
+}
+
+int msm_vidc_process_resume(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	enum msm_vidc_sub_state clear_sub_state = MSM_VIDC_SUB_STATE_NONE;
+	bool drain_pending = false;
+
+	msm_vidc_scale_power(inst, true);
+
+	/* first check DRC pending else check drain pending */
+	if (is_sub_state(inst, MSM_VIDC_DRC) &&
+		is_sub_state(inst, MSM_VIDC_DRC_LAST_BUFFER)) {
+		clear_sub_state = MSM_VIDC_DRC | MSM_VIDC_DRC_LAST_BUFFER;
+		/*
+		 * if drain sequence is not completed then do not resume here.
+		 * client will eventually complete drain sequence in which ports
+		 * will be resumed.
+		 */
+		drain_pending = is_sub_state(inst, MSM_VIDC_DRAIN) &&
+			is_sub_state(inst, MSM_VIDC_DRAIN_LAST_BUFFER);
+		if (!drain_pending) {
+			if (is_sub_state(inst, MSM_VIDC_INPUT_PAUSE)) {
+				rc = venus_hfi_session_resume(inst, INPUT_PORT,
+						HFI_CMD_SETTINGS_CHANGE);
+				if (rc)
+					return rc;
+				clear_sub_state |= MSM_VIDC_INPUT_PAUSE;
+			}
+			if (is_sub_state(inst, MSM_VIDC_OUTPUT_PAUSE) &&
+			    !is_encode_session(inst)) {
+				rc = venus_hfi_session_resume(inst, OUTPUT_PORT,
+						HFI_CMD_SETTINGS_CHANGE);
+				if (rc)
+					return rc;
+				clear_sub_state |= MSM_VIDC_OUTPUT_PAUSE;
+			}
+		}
+	} else if (is_sub_state(inst, MSM_VIDC_DRAIN) &&
+			   is_sub_state(inst, MSM_VIDC_DRAIN_LAST_BUFFER)) {
+		clear_sub_state = MSM_VIDC_DRAIN | MSM_VIDC_DRAIN_LAST_BUFFER;
+		if (is_sub_state(inst, MSM_VIDC_INPUT_PAUSE)) {
+			rc = venus_hfi_session_resume(inst, INPUT_PORT, HFI_CMD_DRAIN);
+			if (rc)
+				return rc;
+			clear_sub_state |= MSM_VIDC_INPUT_PAUSE;
+		}
+		if (is_sub_state(inst, MSM_VIDC_OUTPUT_PAUSE) &&
+		    !is_encode_session(inst)) {
+			rc = venus_hfi_session_resume(inst, OUTPUT_PORT, HFI_CMD_DRAIN);
+			if (rc)
+				return rc;
+			clear_sub_state |= MSM_VIDC_OUTPUT_PAUSE;
+		}
+	}
+
+	rc = msm_vidc_change_sub_state(inst, clear_sub_state, 0, __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_process_streamon_input(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	enum msm_vidc_sub_state clear_sub_state = MSM_VIDC_SUB_STATE_NONE;
+	enum msm_vidc_sub_state set_sub_state = MSM_VIDC_SUB_STATE_NONE;
+
+	msm_vidc_scale_power(inst, true);
+
+	rc = venus_hfi_start(inst, INPUT_PORT);
+	if (rc)
+		return rc;
+
+	/* clear input pause substate immediately */
+	if (is_sub_state(inst, MSM_VIDC_INPUT_PAUSE)) {
+		rc = msm_vidc_change_sub_state(inst, MSM_VIDC_INPUT_PAUSE, 0, __func__);
+		if (rc)
+			return rc;
+	}
+
+	/*
+	 * if DRC sequence is not completed by the client then PAUSE
+	 * firmware input port to avoid firmware raising IPSC again.
+	 * When client completes DRC or DRAIN sequences, firmware
+	 * input port will be resumed.
+	 */
+	if (is_sub_state(inst, MSM_VIDC_DRC) ||
+		is_sub_state(inst, MSM_VIDC_DRAIN) ||
+		is_sub_state(inst, MSM_VIDC_FIRST_IPSC)) {
+		if (!is_sub_state(inst, MSM_VIDC_INPUT_PAUSE)) {
+			rc = venus_hfi_session_pause(inst, INPUT_PORT);
+			if (rc)
+				return rc;
+			set_sub_state = MSM_VIDC_INPUT_PAUSE;
+		}
+	}
+
+	rc = msm_vidc_state_change_streamon(inst, INPUT_PORT);
+	if (rc)
+		return rc;
+
+	rc = msm_vidc_change_sub_state(inst, clear_sub_state, set_sub_state, __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_process_streamon_output(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	enum msm_vidc_sub_state clear_sub_state = MSM_VIDC_SUB_STATE_NONE;
+	enum msm_vidc_sub_state set_sub_state = MSM_VIDC_SUB_STATE_NONE;
+	bool drain_pending = false;
+	bool drc_pending = false;
+
+	msm_vidc_scale_power(inst, true);
+
+	/*
+	 * client completed drc sequence, reset DRC and
+	 * MSM_VIDC_DRC_LAST_BUFFER substates
+	 */
+	drc_pending = is_sub_state(inst, MSM_VIDC_DRC) &&
+		is_sub_state(inst, MSM_VIDC_DRC_LAST_BUFFER);
+
+	drain_pending = is_sub_state(inst, MSM_VIDC_DRAIN) &&
+		is_sub_state(inst, MSM_VIDC_DRAIN_LAST_BUFFER);
+
+	if (drc_pending) {
+		clear_sub_state = MSM_VIDC_DRC | MSM_VIDC_DRC_LAST_BUFFER;
+	} else if (drain_pending) {
+		clear_sub_state = MSM_VIDC_DRAIN | MSM_VIDC_DRAIN_LAST_BUFFER;
+	}
+
+	/*
+	 * Client is completing port reconfiguration, hence reallocate
+	 * input internal buffers before input port is resumed.
+	 * Drc sub-state cannot be checked because DRC sub-state will
+	 * not be set during initial port reconfiguration.
+	 */
+	if (is_decode_session(inst) &&
+		is_sub_state(inst, MSM_VIDC_INPUT_PAUSE)) {
+		rc = msm_vidc_alloc_and_queue_input_internal_buffers(inst);
+		if (rc)
+			return rc;
+		rc = msm_vidc_set_stage(inst, STAGE);
+		if (rc)
+			return rc;
+		rc = msm_vidc_set_pipe(inst, PIPE);
+		if (rc)
+			return rc;
+		/*
+		 * Input port subscription for metadata may be changed.
+		 * For eg: due to IPSC, driver may have disabled tx
+		 * type output fence, hence fence related metadatas
+		 * to recieve on input port will be disabled by HAL.
+		 * Hence, update metadata subscription properties
+		 * on INPUT port before sending RESUME command to FW.
+		 */
+		i_vpr_l(inst, "%s: reset input port subscribe metadata\n",
+			__func__);
+		rc = msm_vdec_subscribe_metadata(inst, INPUT_PORT);
+		if (rc)
+			return rc;
+	}
+
+	/*
+	 * fw input port is paused due to ipsc. now that client
+	 * completed drc sequence, resume fw input port provided
+	 * drain is not pending and input port is streaming.
+	 */
+	if (is_sub_state(inst, MSM_VIDC_INPUT_PAUSE) &&
+		is_state(inst, MSM_VIDC_INPUT_STREAMING)) {
+		if (!drain_pending) {
+			rc = venus_hfi_session_resume(inst, INPUT_PORT,
+						      HFI_CMD_SETTINGS_CHANGE);
+			if (rc)
+				return rc;
+		} else {
+			rc = venus_hfi_session_resume(inst, INPUT_PORT,
+						      HFI_CMD_DRAIN);
+			if (rc)
+				return rc;
+		}
+		clear_sub_state |= MSM_VIDC_INPUT_PAUSE;
+	}
+
+	if (is_sub_state(inst, MSM_VIDC_FIRST_IPSC))
+		clear_sub_state |= MSM_VIDC_FIRST_IPSC;
+
+	rc = venus_hfi_start(inst, OUTPUT_PORT);
+	if (rc)
+		return rc;
+
+	/* clear output pause substate immediately */
+	if (is_sub_state(inst, MSM_VIDC_OUTPUT_PAUSE)) {
+		rc = msm_vidc_change_sub_state(inst, MSM_VIDC_OUTPUT_PAUSE, 0, __func__);
+		if (rc)
+			return rc;
+	}
+
+	rc = msm_vidc_state_change_streamon(inst, OUTPUT_PORT);
+	if (rc)
+		return rc;
+
+	rc = msm_vidc_change_sub_state(inst, clear_sub_state, set_sub_state, __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_process_stop_done(struct msm_vidc_inst *inst,
+		enum signal_session_response signal_type)
+{
+	int rc = 0;
+	enum msm_vidc_sub_state set_sub_state = MSM_VIDC_SUB_STATE_NONE;
+
+	if (signal_type == SIGNAL_CMD_STOP_INPUT) {
+		set_sub_state = MSM_VIDC_INPUT_PAUSE;
+		/*
+		 * FW is expected to return DRC LAST flag before input
+		 * stop done if DRC sequence is pending
+		 */
+		if (is_sub_state(inst, MSM_VIDC_DRC) &&
+			!is_sub_state(inst, MSM_VIDC_DRC_LAST_BUFFER)) {
+			i_vpr_e(inst, "%s: drc last flag pkt not received\n", __func__);
+			msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		}
+		/*
+		 * for a decode session, FW is expected to return
+		 * DRAIN LAST flag before input stop done if
+		 * DRAIN sequence is pending
+		 */
+		if (is_decode_session(inst) &&
+			is_sub_state(inst, MSM_VIDC_DRAIN) &&
+			!is_sub_state(inst, MSM_VIDC_DRAIN_LAST_BUFFER)) {
+			i_vpr_e(inst, "%s: drain last flag pkt not received\n", __func__);
+			msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		}
+	} else if (signal_type == SIGNAL_CMD_STOP_OUTPUT) {
+		set_sub_state = MSM_VIDC_OUTPUT_PAUSE;
+	}
+
+	rc = msm_vidc_change_sub_state(inst, 0, set_sub_state, __func__);
+	if (rc)
+		return rc;
+
+	signal_session_msg_receipt(inst, signal_type);
+	return rc;
+}
+
+int msm_vidc_process_drain_done(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	if (is_sub_state(inst, MSM_VIDC_DRAIN)) {
+		rc = msm_vidc_change_sub_state(inst, 0, MSM_VIDC_INPUT_PAUSE, __func__);
+		if (rc)
+			return rc;
+	} else {
+		i_vpr_e(inst, "%s: unexpected drain done\n", __func__);
+	}
+
+	return rc;
+}
+
+int msm_vidc_process_drain_last_flag(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct v4l2_event event = {0};
+
+	rc = msm_vidc_state_change_drain_last_flag(inst);
+	if (rc)
+		return rc;
+
+	if (!inst->capabilities[LAST_FLAG_EVENT_ENABLE].value) {
+		i_vpr_h(inst, "%s: last flag event not enabled\n", __func__);
+		return 0;
+	}
+
+	event.type = V4L2_EVENT_EOS;
+	v4l2_event_queue_fh(&inst->fh, &event);
+
+	return rc;
+}
+
+int msm_vidc_process_psc_last_flag(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct v4l2_event event = {0};
+
+	rc = msm_vidc_state_change_psc_last_flag(inst);
+	if (rc)
+		return rc;
+
+	if (!inst->capabilities[LAST_FLAG_EVENT_ENABLE].value) {
+		i_vpr_h(inst, "%s: last flag event not enabled\n", __func__);
+		return 0;
+	}
+
+	event.type = V4L2_EVENT_EOS;
+	v4l2_event_queue_fh(&inst->fh, &event);
+
+	return rc;
+}
+
+int msm_vidc_state_change_input_psc(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	enum msm_vidc_sub_state set_sub_state = MSM_VIDC_SUB_STATE_NONE;
+
+	/*
+	 * if output port is not streaming, then do not set DRC substate
+	 * because DRC_LAST_FLAG is not going to be received. Update
+	 * INPUT_PAUSE substate only
+	 */
+	if (is_state(inst, MSM_VIDC_INPUT_STREAMING) ||
+		is_state(inst, MSM_VIDC_OPEN))
+		set_sub_state = MSM_VIDC_INPUT_PAUSE | MSM_VIDC_FIRST_IPSC;
+	else
+		set_sub_state = MSM_VIDC_DRC | MSM_VIDC_INPUT_PAUSE;
+
+	rc = msm_vidc_change_sub_state(inst, 0, set_sub_state, __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_state_change_drain_last_flag(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	enum msm_vidc_sub_state set_sub_state = MSM_VIDC_SUB_STATE_NONE;
+
+	set_sub_state = MSM_VIDC_DRAIN_LAST_BUFFER | MSM_VIDC_OUTPUT_PAUSE;
+	rc = msm_vidc_change_sub_state(inst, 0, set_sub_state, __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_state_change_psc_last_flag(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	enum msm_vidc_sub_state set_sub_state = MSM_VIDC_SUB_STATE_NONE;
+
+	set_sub_state = MSM_VIDC_DRC_LAST_BUFFER | MSM_VIDC_OUTPUT_PAUSE;
+	rc = msm_vidc_change_sub_state(inst, 0, set_sub_state, __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_get_fence_fd(struct msm_vidc_inst *inst, int *fence_fd)
+{
+	int rc = 0;
+	struct msm_vidc_fence *fence, *dummy_fence;
+	struct msm_vidc_core *core;
+	bool found = false;
+
+	*fence_fd = INVALID_FD;
+	core = inst->core;
+
+	list_for_each_entry_safe(fence, dummy_fence, &inst->fence_list, list) {
+		if (fence->fence_id ==
+			(u64)inst->capabilities[FENCE_ID].value) {
+			found = true;
+			break;
+		}
+	}
+
+	if (!found) {
+		i_vpr_h(inst, "%s: could not find matching fence for fence id: %d\n",
+			__func__, inst->capabilities[FENCE_ID].value);
+		goto exit;
+	}
+
+	if (fence->fd == INVALID_FD) {
+		rc = call_fence_op(core, fence_create_fd, inst, fence);
+		if (rc)
+			goto exit;
+	}
+
+	*fence_fd = fence->fd;
+
+exit:
+	return rc;
+}
+
+int msm_vidc_get_control(struct msm_vidc_inst *inst, struct v4l2_ctrl *ctrl)
+{
+	int rc = 0;
+	enum msm_vidc_inst_capability_type cap_id;
+
+	cap_id = msm_vidc_get_cap_id(inst, ctrl->id);
+	if (!is_valid_cap_id(cap_id)) {
+		i_vpr_e(inst, "%s: could not find cap_id for ctrl %s\n",
+		__func__, ctrl->name);
+		return -EINVAL;
+	}
+
+	switch (cap_id) {
+	case MIN_BUFFERS_OUTPUT:
+		ctrl->val = inst->buffers.output.min_count +
+			inst->buffers.output.extra_count;
+		i_vpr_h(inst, "g_min: output buffers %d\n", ctrl->val);
+		break;
+	case MIN_BUFFERS_INPUT:
+		ctrl->val = inst->buffers.input.min_count +
+			inst->buffers.input.extra_count;
+		i_vpr_h(inst, "g_min: input buffers %d\n", ctrl->val);
+		break;
+	case FILM_GRAIN:
+		ctrl->val = inst->capabilities[FILM_GRAIN].value;
+		i_vpr_h(inst, "%s: film grain present: %d\n",
+			 __func__, ctrl->val);
+		break;
+	case FENCE_FD:
+		rc = msm_vidc_get_fence_fd(inst, &ctrl->val);
+		if (!rc)
+			i_vpr_l(inst, "%s: fence fd: %d\n",
+				__func__, ctrl->val);
+		break;
+	case MAX_NUM_REORDER_FRAMES:
+		ctrl->val = inst->capabilities[MAX_NUM_REORDER_FRAMES].value;
+		i_vpr_h(inst, "%s: max num reorder frames: %d\n",
+			__func__, ctrl->val);
+		break;
+	case CODED_FRAMES:
+		ctrl->val = inst->capabilities[CODED_FRAMES].value;
+		i_vpr_h(inst, "%s: coded frames: %d\n", __func__, ctrl->val);
+		break;
+	default:
+		i_vpr_e(inst, "invalid ctrl %s id %d\n",
+			ctrl->name, ctrl->id);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+int msm_vidc_get_mbs_per_frame(struct msm_vidc_inst *inst)
+{
+	int height = 0, width = 0;
+	struct v4l2_format *inp_f;
+
+	if (is_decode_session(inst)) {
+		inp_f = &inst->fmts[INPUT_PORT];
+		width = max(inp_f->fmt.pix_mp.width, inst->crop.width);
+		height = max(inp_f->fmt.pix_mp.height, inst->crop.height);
+	} else if (is_encode_session(inst)) {
+		width = inst->crop.width;
+		height = inst->crop.height;
+	}
+
+	return NUM_MBS_PER_FRAME(height, width);
+}
+
+int msm_vidc_get_fps(struct msm_vidc_inst *inst)
+{
+	int fps;
+	u32 frame_rate, operating_rate;
+
+	frame_rate = msm_vidc_get_frame_rate(inst);
+	operating_rate = msm_vidc_get_operating_rate(inst);
+
+	if (operating_rate > frame_rate)
+		fps = operating_rate ? operating_rate : 1;
+	else
+		fps = frame_rate;
+
+	return fps;
+}
+
+int msm_vidc_num_buffers(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type type, enum msm_vidc_buffer_attributes attr)
+{
+	int count = 0;
+	struct msm_vidc_buffer *vbuf;
+	struct msm_vidc_buffers *buffers;
+
+	if (is_output_buffer(type)) {
+		buffers = &inst->buffers.output;
+	} else if (is_input_buffer(type)) {
+		buffers = &inst->buffers.input;
+	} else {
+		i_vpr_e(inst, "%s: invalid buffer type %#x\n",
+				__func__, type);
+		return count;
+	}
+
+	list_for_each_entry(vbuf, &buffers->list, list) {
+		if (vbuf->type != type)
+			continue;
+		if (!(vbuf->attr & attr))
+			continue;
+		count++;
+	}
+
+	return count;
+}
+
+int vb2_buffer_to_driver(struct vb2_buffer *vb2,
+	struct msm_vidc_buffer *buf)
+{
+	int rc = 0;
+	struct vb2_v4l2_buffer *vbuf;
+
+	if (!vb2 || !buf) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	vbuf = to_vb2_v4l2_buffer(vb2);
+
+	buf->fd = vb2->planes[0].m.fd;
+	buf->data_offset = vb2->planes[0].data_offset;
+	buf->data_size = vb2->planes[0].bytesused - vb2->planes[0].data_offset;
+	buf->buffer_size = vb2->planes[0].length;
+	buf->timestamp = vb2->timestamp;
+	buf->flags = vbuf->flags;
+	buf->attr = 0;
+	buf->fence_id = 0;
+
+	return rc;
+}
+
+static int msm_vidc_process_readonly_buffers(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf)
+{
+	int rc = 0;
+	struct msm_vidc_buffer *ro_buf, *dummy;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	if (!is_decode_session(inst) || !is_output_buffer(buf->type))
+		return 0;
+
+	/*
+	 * check if read_only buffer is present in read_only list
+	 * if present: add ro flag to buf provided buffer is not
+	 * pending release
+	 */
+	list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+		if (ro_buf->device_addr != buf->device_addr)
+			continue;
+		if (ro_buf->attr & MSM_VIDC_ATTR_READ_ONLY &&
+			!(ro_buf->attr & MSM_VIDC_ATTR_PENDING_RELEASE)) {
+			/* add READ_ONLY to the buffer going to the firmware */
+			buf->attr |= MSM_VIDC_ATTR_READ_ONLY;
+			/*
+			 * remove READ_ONLY on the read_only list buffer so that
+			 * it will get removed from the read_only list below
+			 */
+			ro_buf->attr &= ~MSM_VIDC_ATTR_READ_ONLY;
+			break;
+		}
+	}
+
+	/* remove ro buffers if not required anymore */
+	list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+		/* if read only buffer do not remove */
+		if (ro_buf->attr & MSM_VIDC_ATTR_READ_ONLY)
+			continue;
+
+		print_vidc_buffer(VIDC_LOW, "low ", "ro buf removed", inst, ro_buf);
+		/* unmap the buffer if driver holds mapping */
+		if (ro_buf->sg_table && ro_buf->attach) {
+			call_mem_op(core, dma_buf_unmap_attachment, core,
+				ro_buf->attach, ro_buf->sg_table);
+			call_mem_op(core, dma_buf_detach, core,
+				ro_buf->dmabuf, ro_buf->attach);
+			ro_buf->sg_table = NULL;
+			ro_buf->attach = NULL;
+		}
+		if (ro_buf->dbuf_get) {
+			call_mem_op(core, dma_buf_put, inst, ro_buf->dmabuf);
+			ro_buf->dmabuf = NULL;
+			ro_buf->dbuf_get = 0;
+		}
+
+		list_del_init(&ro_buf->list);
+		msm_vidc_pool_free(inst, ro_buf);
+	}
+
+	return rc;
+}
+
+int msm_vidc_set_auto_framerate(struct msm_vidc_inst *inst, u64 timestamp)
+{
+	struct msm_vidc_core *core;
+	struct msm_vidc_timestamp *ts;
+	struct msm_vidc_timestamp *prev = NULL;
+	u32 counter = 0, prev_fr = 0, curr_fr = 0;
+	u64 time_us = 0;
+	int rc = 0;
+
+	core = inst->core;
+	if (!core->capabilities[ENC_AUTO_FRAMERATE].value ||
+			is_image_session(inst) || msm_vidc_is_super_buffer(inst) ||
+			!inst->capabilities[TIME_DELTA_BASED_RC].value)
+		goto exit;
+
+	rc = msm_vidc_update_timestamp_rate(inst, timestamp);
+	if (rc)
+		goto exit;
+
+	list_for_each_entry(ts, &inst->timestamps.list, sort.list) {
+		if (prev) {
+			time_us = ts->sort.val - prev->sort.val;
+			prev_fr = curr_fr;
+			curr_fr = time_us ? DIV64_U64_ROUND_CLOSEST(USEC_PER_SEC, time_us) << 16 :
+					inst->auto_framerate;
+			if (curr_fr > inst->capabilities[FRAME_RATE].max)
+				curr_fr = inst->capabilities[FRAME_RATE].max;
+		}
+		prev = ts;
+		counter++;
+	}
+
+	if (counter < ENC_FPS_WINDOW)
+		goto exit;
+
+	/* if framerate changed and stable for 2 frames, set to firmware */
+	if (curr_fr == prev_fr && curr_fr != inst->auto_framerate) {
+		i_vpr_l(inst, "%s: updated fps:  %u -> %u\n", __func__,
+				inst->auto_framerate >> 16, curr_fr >> 16);
+		rc = venus_hfi_session_property(inst,
+				HFI_PROP_FRAME_RATE,
+				HFI_HOST_FLAGS_NONE,
+				HFI_PORT_BITSTREAM,
+				HFI_PAYLOAD_Q16,
+				&curr_fr,
+				sizeof(u32));
+		if (rc) {
+			i_vpr_e(inst, "%s: set auto frame rate failed\n",
+				__func__);
+			goto exit;
+		}
+		inst->auto_framerate = curr_fr;
+	}
+exit:
+	return rc;
+}
+
+int msm_vidc_update_input_rate(struct msm_vidc_inst *inst, u64 time_us)
+{
+	struct msm_vidc_input_timer *input_timer;
+	struct msm_vidc_input_timer *prev_timer = NULL;
+	struct msm_vidc_core *core;
+	u64 counter = 0;
+	u64 input_timer_sum_us = 0;
+
+	core = inst->core;
+
+	input_timer = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_BUF_TIMER);
+	if (!input_timer)
+		return -ENOMEM;
+
+	input_timer->time_us = time_us;
+	INIT_LIST_HEAD(&input_timer->list);
+	list_add_tail(&input_timer->list, &inst->input_timer_list);
+	list_for_each_entry(input_timer, &inst->input_timer_list, list) {
+		if (prev_timer) {
+			input_timer_sum_us += input_timer->time_us - prev_timer->time_us;
+			counter++;
+		}
+		prev_timer = input_timer;
+	}
+
+	if (input_timer_sum_us && counter >= INPUT_TIMER_LIST_SIZE)
+		inst->capabilities[INPUT_RATE].value =
+			(s32)(DIV64_U64_ROUND_CLOSEST(counter * 1000000,
+				input_timer_sum_us) << 16);
+
+	/* delete the first entry once counter >= INPUT_TIMER_LIST_SIZE */
+	if (counter >= INPUT_TIMER_LIST_SIZE) {
+		input_timer = list_first_entry(&inst->input_timer_list,
+				struct msm_vidc_input_timer, list);
+		list_del_init(&input_timer->list);
+		msm_vidc_pool_free(inst, input_timer);
+	}
+
+	return 0;
+}
+
+static int msm_vidc_flush_input_timer(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_input_timer *input_timer, *dummy_timer;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	i_vpr_l(inst, "%s: flush input_timer list\n", __func__);
+	list_for_each_entry_safe(input_timer, dummy_timer, &inst->input_timer_list, list) {
+		list_del_init(&input_timer->list);
+		msm_vidc_pool_free(inst, input_timer);
+	}
+	return 0;
+}
+
+int msm_vidc_get_input_rate(struct msm_vidc_inst *inst)
+{
+	return inst->capabilities[INPUT_RATE].value >> 16;
+}
+
+int msm_vidc_get_timestamp_rate(struct msm_vidc_inst *inst)
+{
+	return inst->capabilities[TIMESTAMP_RATE].value >> 16;
+}
+
+int msm_vidc_get_frame_rate(struct msm_vidc_inst *inst)
+{
+	return inst->capabilities[FRAME_RATE].value >> 16;
+}
+
+int msm_vidc_get_operating_rate(struct msm_vidc_inst *inst)
+{
+	return inst->capabilities[OPERATING_RATE].value >> 16;
+}
+
+static int msm_vidc_insert_sort(struct list_head *head,
+	struct msm_vidc_sort *entry)
+{
+	struct msm_vidc_sort *first, *node;
+	struct msm_vidc_sort *prev = NULL;
+	bool is_inserted = false;
+
+	if (!head || !entry) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	if (list_empty(head)) {
+		list_add(&entry->list, head);
+		return 0;
+	}
+
+	first = list_first_entry(head, struct msm_vidc_sort, list);
+	if (entry->val < first->val) {
+		list_add(&entry->list, head);
+		return 0;
+	}
+
+	list_for_each_entry(node, head, list) {
+		if (prev &&
+			entry->val >= prev->val && entry->val <= node->val) {
+			list_add(&entry->list, &prev->list);
+			is_inserted = true;
+			break;
+		}
+		prev = node;
+	}
+
+	if (!is_inserted && prev)
+		list_add(&entry->list, &prev->list);
+
+	return 0;
+}
+
+static struct msm_vidc_timestamp *msm_vidc_get_least_rank_ts(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_timestamp *ts, *final = NULL;
+	u64 least_rank = INT_MAX;
+
+	list_for_each_entry(ts, &inst->timestamps.list, sort.list) {
+		if (ts->rank < least_rank) {
+			least_rank = ts->rank;
+			final = ts;
+		}
+	}
+
+	return final;
+}
+
+int msm_vidc_flush_ts(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_timestamp *temp, *ts = NULL;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	list_for_each_entry_safe(ts, temp, &inst->timestamps.list, sort.list) {
+		i_vpr_l(inst, "%s: flushing ts: val %llu, rank %llu\n",
+			__func__, ts->sort.val, ts->rank);
+		list_del(&ts->sort.list);
+		msm_vidc_pool_free(inst, ts);
+	}
+	inst->timestamps.count = 0;
+	inst->timestamps.rank = 0;
+
+	return 0;
+}
+
+int msm_vidc_update_timestamp_rate(struct msm_vidc_inst *inst, u64 timestamp)
+{
+	struct msm_vidc_timestamp *ts, *prev = NULL;
+	struct msm_vidc_core *core;
+	int rc = 0;
+	u32 window_size = 0;
+	u32 timestamp_rate = 0;
+	u64 ts_ms = 0;
+	u32 counter = 0;
+
+	core = inst->core;
+
+	ts = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_TIMESTAMP);
+	if (!ts) {
+		i_vpr_e(inst, "%s: ts alloc failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	INIT_LIST_HEAD(&ts->sort.list);
+	ts->sort.val = timestamp;
+	ts->rank = inst->timestamps.rank++;
+	rc = msm_vidc_insert_sort(&inst->timestamps.list, &ts->sort);
+	if (rc)
+		return rc;
+	inst->timestamps.count++;
+
+	if (is_encode_session(inst))
+		window_size = ENC_FPS_WINDOW;
+	else
+		window_size = DEC_FPS_WINDOW;
+
+	/* keep sliding window */
+	if (inst->timestamps.count > window_size) {
+		ts = msm_vidc_get_least_rank_ts(inst);
+		if (!ts) {
+			i_vpr_e(inst, "%s: least rank ts is NULL\n", __func__);
+			return -EINVAL;
+		}
+		inst->timestamps.count--;
+		list_del(&ts->sort.list);
+		msm_vidc_pool_free(inst, ts);
+	}
+
+	/* Calculate timestamp rate */
+	list_for_each_entry(ts, &inst->timestamps.list, sort.list) {
+		if (prev) {
+			if (ts->sort.val == prev->sort.val)
+				continue;
+			ts_ms += div_u64(ts->sort.val - prev->sort.val, 1000000);
+			counter++;
+		}
+		prev = ts;
+	}
+	if (ts_ms)
+		timestamp_rate = (u32)div_u64((u64)counter * 1000, ts_ms);
+
+	msm_vidc_update_cap_value(inst, TIMESTAMP_RATE, timestamp_rate << 16, __func__);
+
+	return 0;
+}
+
+int msm_vidc_ts_reorder_insert_timestamp(struct msm_vidc_inst *inst, u64 timestamp)
+{
+	struct msm_vidc_timestamp *ts;
+	struct msm_vidc_core *core;
+	int rc = 0;
+
+	core = inst->core;
+
+	/* allocate ts from pool */
+	ts = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_TIMESTAMP);
+	if (!ts) {
+		i_vpr_e(inst, "%s: ts alloc failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	/* initialize ts node */
+	INIT_LIST_HEAD(&ts->sort.list);
+	ts->sort.val = timestamp;
+	rc = msm_vidc_insert_sort(&inst->ts_reorder.list, &ts->sort);
+	if (rc)
+		return rc;
+	inst->ts_reorder.count++;
+
+	return 0;
+}
+
+int msm_vidc_ts_reorder_remove_timestamp(struct msm_vidc_inst *inst, u64 timestamp)
+{
+	struct msm_vidc_timestamp *ts, *temp;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	/* remove matching node */
+	list_for_each_entry_safe(ts, temp, &inst->ts_reorder.list, sort.list) {
+		if (ts->sort.val == timestamp) {
+			list_del_init(&ts->sort.list);
+			inst->ts_reorder.count--;
+			msm_vidc_pool_free(inst, ts);
+			break;
+		}
+	}
+
+	return 0;
+}
+
+int msm_vidc_ts_reorder_get_first_timestamp(struct msm_vidc_inst *inst, u64 *timestamp)
+{
+	struct msm_vidc_timestamp *ts;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	/* check if list empty */
+	if (list_empty(&inst->ts_reorder.list)) {
+		i_vpr_e(inst, "%s: list empty. ts %lld\n", __func__, *timestamp);
+		return -EINVAL;
+	}
+
+	/* get 1st node from reorder list */
+	ts = list_first_entry(&inst->ts_reorder.list,
+		struct msm_vidc_timestamp, sort.list);
+	list_del_init(&ts->sort.list);
+
+	/* copy timestamp */
+	*timestamp = ts->sort.val;
+
+	inst->ts_reorder.count--;
+	msm_vidc_pool_free(inst, ts);
+
+	return 0;
+}
+
+int msm_vidc_ts_reorder_flush(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_timestamp *temp, *ts = NULL;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	/* flush all entries */
+	list_for_each_entry_safe(ts, temp, &inst->ts_reorder.list, sort.list) {
+		i_vpr_l(inst, "%s: flushing ts: val %lld\n", __func__, ts->sort.val);
+		list_del(&ts->sort.list);
+		msm_vidc_pool_free(inst, ts);
+	}
+	inst->ts_reorder.count = 0;
+
+	return 0;
+}
+
+struct msm_vidc_buffer *msm_vidc_get_driver_buf(struct msm_vidc_inst *inst,
+	struct vb2_buffer *vb2)
+{
+	int rc = 0;
+	struct msm_vidc_buffer *buf;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	buf = msm_vidc_fetch_buffer(inst, vb2);
+	if (!buf) {
+		i_vpr_e(inst, "%s: failed to fetch buffer\n", __func__);
+		return NULL;
+	}
+
+	rc = vb2_buffer_to_driver(vb2, buf);
+	if (rc)
+		return NULL;
+
+	/* treat every buffer as deferred buffer initially */
+	buf->attr |= MSM_VIDC_ATTR_DEFERRED;
+
+	if (is_decode_session(inst) && is_output_buffer(buf->type)) {
+		/* get a reference */
+		if (!buf->dbuf_get && !buf->kvaddr) {
+			buf->dmabuf = call_mem_op(core, dma_buf_get, inst, buf->fd);
+			if (!buf->dmabuf)
+				return NULL;
+			buf->dbuf_get = 1;
+		}
+	}
+
+	return buf;
+}
+
+int msm_vidc_allocate_buffers(struct msm_vidc_inst *inst,
+	enum msm_vidc_buffer_type buf_type, u32 num_buffers)
+{
+	int rc = 0;
+	int idx = 0;
+	struct msm_vidc_buffer *buf = NULL;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *i;
+	u32 count = 0;
+
+	core = inst->core;
+
+	buffers = msm_vidc_get_buffers(inst, buf_type, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	list_for_each_entry(i, &buffers->list, list)
+		count++;
+
+	for (idx = 0; idx < num_buffers; idx++, count++) {
+		buf = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_BUFFER);
+		if (!buf) {
+			i_vpr_e(inst, "%s: alloc failed\n", __func__);
+			return -EINVAL;
+		}
+		INIT_LIST_HEAD(&buf->list);
+		list_add_tail(&buf->list, &buffers->list);
+		buf->type = buf_type;
+		buf->index = count;
+		buf->region = call_mem_op(core, buffer_region, inst, buf_type);
+	}
+	i_vpr_h(inst, "%s: allocated %d buffers for type %s\n",
+		__func__, num_buffers, buf_name(buf_type));
+
+	return rc;
+}
+
+int msm_vidc_free_buffers(struct msm_vidc_inst *inst,
+	enum msm_vidc_buffer_type buf_type)
+{
+	int rc = 0;
+	int buf_count = 0;
+	struct msm_vidc_buffer *buf, *dummy;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	buffers = msm_vidc_get_buffers(inst, buf_type, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+		buf_count++;
+		print_vidc_buffer(VIDC_LOW, "low ", "free buffer", inst, buf);
+		list_del_init(&buf->list);
+		msm_vidc_pool_free(inst, buf);
+	}
+	i_vpr_h(inst, "%s: freed %d buffers for type %s\n",
+		__func__, buf_count, buf_name(buf_type));
+
+	return rc;
+}
+
+struct msm_vidc_buffer *msm_vidc_fetch_buffer(struct msm_vidc_inst *inst,
+	struct vb2_buffer *vb2)
+{
+	struct msm_vidc_buffer *buf = NULL;
+	struct msm_vidc_buffers *buffers;
+	enum msm_vidc_buffer_type buf_type;
+	bool found = false;
+
+	buf_type = v4l2_type_to_driver(vb2->type, __func__);
+	if (!buf_type)
+		return NULL;
+
+	buffers = msm_vidc_get_buffers(inst, buf_type, __func__);
+	if (!buffers)
+		return NULL;
+
+	list_for_each_entry(buf, &buffers->list, list) {
+		if (buf->index == vb2->index) {
+			found = true;
+			break;
+		}
+	}
+
+	if (!found) {
+		i_vpr_e(inst, "%s: buffer not found for index %d for vb2 buffer type %s\n",
+			__func__, vb2->index, v4l2_type_name(vb2->type));
+		return NULL;
+	}
+
+	return buf;
+}
+
+struct msm_vidc_buffer *get_meta_buffer(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf)
+{
+	struct msm_vidc_buffer *mbuf;
+	struct msm_vidc_buffers *buffers;
+	bool found = false;
+
+	if (is_input_buffer(buf->type)) {
+		buffers = &inst->buffers.input_meta;
+	} else if (is_output_buffer(buf->type)) {
+		buffers = &inst->buffers.output_meta;
+	} else {
+		i_vpr_e(inst, "%s: invalid buffer type %d\n",
+			__func__, buf->type);
+		return NULL;
+	}
+	list_for_each_entry(mbuf, &buffers->list, list) {
+		if (mbuf->index == buf->index) {
+			found = true;
+			break;
+		}
+	}
+	if (!found)
+		return NULL;
+
+	return mbuf;
+}
+
+bool msm_vidc_is_super_buffer(struct msm_vidc_inst *inst)
+{
+	return !!inst->capabilities[SUPER_FRAME].value;
+}
+
+static bool is_single_session(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	u32 count = 0;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	list_for_each_entry(inst, &core->instances, list)
+		count++;
+	core_unlock(core, __func__);
+
+	return count == 1;
+}
+
+void msm_vidc_allow_dcvs(struct msm_vidc_inst *inst)
+{
+	bool allow = false;
+	struct msm_vidc_core *core;
+	u32 fps;
+
+	core = inst->core;
+
+	allow = !msm_vidc_clock_voting;
+	if (!allow) {
+		i_vpr_h(inst, "%s: core_clock_voting is set\n", __func__);
+		goto exit;
+	}
+
+	allow = core->capabilities[DCVS].value;
+	if (!allow) {
+		i_vpr_h(inst, "%s: core doesn't support dcvs\n", __func__);
+		goto exit;
+	}
+
+	allow = (inst->codec != MSM_VIDC_AV1);
+	if (!allow) {
+		i_vpr_h(inst, "%s: unsupported codec\n", __func__);
+		goto exit;
+	}
+
+	allow = !inst->decode_batch.enable;
+	if (!allow) {
+		i_vpr_h(inst, "%s: decode_batching enabled\n", __func__);
+		goto exit;
+	}
+
+	allow = !msm_vidc_is_super_buffer(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: encode_batching(super_buffer) enabled\n", __func__);
+		goto exit;
+	}
+
+	allow = !is_thumbnail_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: thumbnail session\n", __func__);
+		goto exit;
+	}
+
+	allow = !is_critical_priority_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: critical priority session\n", __func__);
+		goto exit;
+	}
+
+	allow = !is_image_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: image session\n", __func__);
+		goto exit;
+	}
+
+	allow = !is_lowlatency_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: lowlatency session\n", __func__);
+		goto exit;
+	}
+
+	fps =  msm_vidc_get_fps(inst);
+	if (is_decode_session(inst) &&
+			fps >= inst->capabilities[FRAME_RATE].max) {
+		allow = false;
+		i_vpr_h(inst, "%s: unsupported fps %d\n", __func__, fps);
+		goto exit;
+	}
+
+exit:
+	i_vpr_hp(inst, "%s: dcvs: %s\n", __func__, allow ? "enabled" : "disabled");
+
+	inst->power.dcvs_flags = 0;
+	inst->power.dcvs_mode = allow;
+}
+
+bool msm_vidc_allow_decode_batch(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_inst_cap *cap;
+	struct msm_vidc_core *core;
+	bool allow = false;
+	u32 value = 0;
+
+	core = inst->core;
+	cap = &inst->capabilities[0];
+
+	allow = inst->decode_batch.enable;
+	if (!allow) {
+		i_vpr_h(inst, "%s: batching already disabled\n", __func__);
+		goto exit;
+	}
+
+	allow = core->capabilities[DECODE_BATCH].value;
+	if (!allow) {
+		i_vpr_h(inst, "%s: core doesn't support batching\n", __func__);
+		goto exit;
+	}
+
+	allow = is_single_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: multiple sessions running\n", __func__);
+		goto exit;
+	}
+
+	allow = is_decode_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: not a decoder session\n", __func__);
+		goto exit;
+	}
+
+	allow = !is_thumbnail_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: thumbnail session\n", __func__);
+		goto exit;
+	}
+
+	allow = !is_image_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: image session\n", __func__);
+		goto exit;
+	}
+
+	allow = is_realtime_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: non-realtime session\n", __func__);
+		goto exit;
+	}
+
+	allow = !is_lowlatency_session(inst);
+	if (!allow) {
+		i_vpr_h(inst, "%s: lowlatency session\n", __func__);
+		goto exit;
+	}
+
+	value = msm_vidc_get_fps(inst);
+	allow = value < cap[BATCH_FPS].value;
+	if (!allow) {
+		i_vpr_h(inst, "%s: unsupported fps %u, max %u\n", __func__,
+			value, cap[BATCH_FPS].value);
+		goto exit;
+	}
+
+	value = msm_vidc_get_mbs_per_frame(inst);
+	allow = value < cap[BATCH_MBPF].value;
+	if (!allow) {
+		i_vpr_h(inst, "%s: unsupported mbpf %u, max %u\n", __func__,
+			value, cap[BATCH_MBPF].value);
+		goto exit;
+	}
+
+exit:
+	i_vpr_hp(inst, "%s: batching: %s\n", __func__, allow ? "enabled" : "disabled");
+
+	return allow;
+}
+
+static void msm_vidc_update_input_cr(struct msm_vidc_inst *inst, u32 idx, u32 cr)
+{
+	struct msm_vidc_input_cr_data *temp = NULL, *next = NULL;
+	bool found = false;
+
+	list_for_each_entry_safe(temp, next, &inst->enc_input_crs, list) {
+		if (temp->index == idx) {
+			temp->input_cr = cr;
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		temp = NULL;
+		temp = vzalloc(sizeof(*temp));
+		if (!temp) {
+			i_vpr_e(inst, "%s: allocation failed\n", __func__);
+			return;
+		}
+		temp->index = idx;
+		temp->input_cr = cr;
+		list_add_tail(&temp->list, &inst->enc_input_crs);
+	}
+}
+
+void msm_vidc_update_stats(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf, enum msm_vidc_debugfs_event etype)
+{
+	if ((is_decode_session(inst) && etype == MSM_VIDC_DEBUGFS_EVENT_ETB) ||
+		(is_encode_session(inst) && etype == MSM_VIDC_DEBUGFS_EVENT_FBD))
+		inst->stats.data_size += buf->data_size;
+
+	msm_vidc_debugfs_update(inst, etype);
+}
+
+void msm_vidc_print_stats(struct msm_vidc_inst *inst)
+{
+	u32 frame_rate, operating_rate, achieved_fps, priority, etb, ebd, ftb, fbd, dt_ms;
+	u64 bitrate_kbps = 0, time_ms = ktime_get_ns() / 1000 / 1000;
+
+	etb = inst->debug_count.etb - inst->stats.count.etb;
+	ebd = inst->debug_count.ebd - inst->stats.count.ebd;
+	ftb = inst->debug_count.ftb - inst->stats.count.ftb;
+	fbd = inst->debug_count.fbd - inst->stats.count.fbd;
+	frame_rate = inst->capabilities[FRAME_RATE].value >> 16;
+	operating_rate = inst->capabilities[OPERATING_RATE].value >> 16;
+	priority =  inst->capabilities[PRIORITY].value;
+
+	dt_ms = time_ms - inst->stats.time_ms;
+	achieved_fps = (fbd * 1000) / dt_ms;
+	bitrate_kbps = (inst->stats.data_size * 8 * 1000) / (dt_ms * 1024);
+
+	i_vpr_hs(inst,
+		"counts (etb,ebd,ftb,fbd): %u %u %u %u (total %llu %llu %llu %llu), achieved bitrate %lldKbps fps %u/s, frame rate %u, operating rate %u, priority %u, avg bw llcc %ukhz, avb bw ddr %ukhz, dt %ums\n",
+		etb, ebd, ftb, fbd, inst->debug_count.etb, inst->debug_count.ebd,
+		inst->debug_count.ftb, inst->debug_count.fbd, bitrate_kbps,
+		achieved_fps, frame_rate, operating_rate, priority,
+		inst->stats.avg_bw_llcc, inst->stats.avg_bw_ddr, dt_ms);
+
+	inst->stats.count = inst->debug_count;
+	inst->stats.data_size = 0;
+	inst->stats.avg_bw_llcc = 0;
+	inst->stats.avg_bw_ddr = 0;
+	inst->stats.time_ms = time_ms;
+}
+
+void msm_vidc_print_memory_stats(struct msm_vidc_inst *inst)
+{
+	static enum msm_vidc_buffer_type buf_type_arr[9] = {
+		MSM_VIDC_BUF_BIN,
+		MSM_VIDC_BUF_ARP,
+		MSM_VIDC_BUF_COMV,
+		MSM_VIDC_BUF_NON_COMV,
+		MSM_VIDC_BUF_LINE,
+		MSM_VIDC_BUF_DPB,
+		MSM_VIDC_BUF_PERSIST,
+		MSM_VIDC_BUF_VPSS,
+		MSM_VIDC_BUF_PARTIAL_DATA,
+	};
+	u32 count_arr[9];
+	u32 size_arr[9];
+	u32 size_kb_arr[9];
+	u64 total_size = 0;
+	struct msm_vidc_buffers *buffers;
+	int cnt;
+
+	/* reset array values */
+	memset(&count_arr, 0, sizeof(count_arr));
+	memset(&size_arr, 0, sizeof(size_arr));
+	memset(&size_kb_arr, 0, sizeof(size_kb_arr));
+
+	/* populate buffer details */
+	for (cnt = 0; cnt < 9; cnt++) {
+		buffers = msm_vidc_get_buffers(inst, buf_type_arr[cnt], __func__);
+		if (!buffers)
+			continue;
+
+		size_arr[cnt] = buffers->size;
+		count_arr[cnt] = buffers->min_count;
+		size_kb_arr[cnt] = (size_arr[cnt] * count_arr[cnt]) / 1024;
+		total_size += size_arr[cnt] * count_arr[cnt];
+	}
+
+	/* print internal memory stats */
+	i_vpr_hs(inst,
+		"%s %u kb(%ux%d) %s %u kb(%ux%d) %s %u kb(%ux%d) %s %u kb(%ux%d) %s %u kb(%ux%d) %s %u kb(%ux%d) %s %u kb(%ux%d) %s %u kb(%ux%d) %s %u kb(%ux%d) total %llu kb\n",
+		buf_name(buf_type_arr[0]), size_kb_arr[0], size_arr[0], count_arr[0],
+		buf_name(buf_type_arr[1]), size_kb_arr[1], size_arr[1], count_arr[1],
+		buf_name(buf_type_arr[2]), size_kb_arr[2], size_arr[2], count_arr[2],
+		buf_name(buf_type_arr[3]), size_kb_arr[3], size_arr[3], count_arr[3],
+		buf_name(buf_type_arr[4]), size_kb_arr[4], size_arr[4], count_arr[4],
+		buf_name(buf_type_arr[5]), size_kb_arr[5], size_arr[5], count_arr[5],
+		buf_name(buf_type_arr[6]), size_kb_arr[6], size_arr[6], count_arr[6],
+		buf_name(buf_type_arr[7]), size_kb_arr[7], size_arr[7], count_arr[7],
+		buf_name(buf_type_arr[8]), size_kb_arr[8], size_arr[8], count_arr[8],
+		(total_size / 1024));
+}
+
+int schedule_stats_work(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	if (!is_stats_enabled()) {
+		i_vpr_h(inst, "%s: stats not enabled. Skip scheduling\n", __func__);
+		return 0;
+	}
+
+	/**
+	 * Hfi session is already closed and inst also going to be
+	 * closed soon. So skip scheduling new stats_work to avoid
+	 * use-after-free issues with close sequence.
+	 */
+	if (!inst->packet) {
+		i_vpr_e(inst, "skip scheduling stats_work\n");
+		return 0;
+	}
+	core = inst->core;
+	mod_delayed_work(inst->workq, &inst->stats_work,
+		msecs_to_jiffies(core->capabilities[STATS_TIMEOUT_MS].value));
+
+	return 0;
+}
+
+int cancel_stats_work_sync(struct msm_vidc_inst *inst)
+{
+	cancel_delayed_work_sync(&inst->stats_work);
+
+	return 0;
+}
+
+void msm_vidc_stats_handler(struct work_struct *work)
+{
+	struct msm_vidc_inst *inst;
+
+	inst = container_of(work, struct msm_vidc_inst, stats_work.work);
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+
+	inst_lock(inst, __func__);
+	msm_vidc_print_stats(inst);
+	schedule_stats_work(inst);
+	inst_unlock(inst, __func__);
+
+	put_inst(inst);
+}
+
+static int msm_vidc_queue_buffer(struct msm_vidc_inst *inst, struct msm_vidc_buffer *buf)
+{
+	struct msm_vidc_buffer *meta;
+	enum msm_vidc_debugfs_event etype;
+	int rc = 0;
+	u32 cr = 0;
+
+	if (is_encode_session(inst) && is_input_buffer(buf->type)) {
+		cr = inst->capabilities[ENC_IP_CR].value;
+		msm_vidc_update_input_cr(inst, buf->index, cr);
+		msm_vidc_update_cap_value(inst, ENC_IP_CR, 0, __func__);
+	}
+
+	if (is_decode_session(inst) && is_input_buffer(buf->type) &&
+		inst->capabilities[CODEC_CONFIG].value) {
+		buf->flags |= MSM_VIDC_BUF_FLAG_CODECCONFIG;
+		msm_vidc_update_cap_value(inst, CODEC_CONFIG, 0, __func__);
+	}
+
+	if (is_decode_session(inst) && is_output_buffer(buf->type)) {
+		rc = msm_vidc_process_readonly_buffers(inst, buf);
+		if (rc)
+			return rc;
+	}
+
+	print_vidc_buffer(VIDC_HIGH, "high", "qbuf", inst, buf);
+	meta = get_meta_buffer(inst, buf);
+	if (meta && meta->attr & MSM_VIDC_ATTR_DEFERRED)
+		print_vidc_buffer(VIDC_LOW, "low ", "qbuf", inst, meta);
+	else
+		meta = NULL;
+
+	if (!meta && is_meta_enabled(inst, buf->type)) {
+		print_vidc_buffer(VIDC_ERR, "err ", "missing meta for", inst, buf);
+		return -EINVAL;
+	}
+
+	rc = msm_vidc_qbuf_cache_operation(inst, buf);
+	if (rc)
+		return rc;
+
+	if (msm_vidc_is_super_buffer(inst) && is_input_buffer(buf->type))
+		rc = venus_hfi_queue_super_buffer(inst, buf, meta);
+	else
+		rc = venus_hfi_queue_buffer(inst, buf, meta);
+	if (rc)
+		return rc;
+
+	buf->attr &= ~MSM_VIDC_ATTR_DEFERRED;
+	buf->attr |= MSM_VIDC_ATTR_QUEUED;
+	if (meta) {
+		meta->attr &= ~MSM_VIDC_ATTR_DEFERRED;
+		meta->attr |= MSM_VIDC_ATTR_QUEUED;
+	}
+
+	/* insert timestamp for ts_reorder enable case */
+	if (is_ts_reorder_allowed(inst) && is_input_buffer(buf->type)) {
+		rc = msm_vidc_ts_reorder_insert_timestamp(inst, buf->timestamp);
+		if (rc)
+			i_vpr_e(inst, "%s: insert timestamp failed\n", __func__);
+	}
+
+	if (is_input_buffer(buf->type))
+		inst->power.buffer_counter++;
+
+	if (is_input_buffer(buf->type))
+		etype = MSM_VIDC_DEBUGFS_EVENT_ETB;
+	else
+		etype = MSM_VIDC_DEBUGFS_EVENT_FTB;
+
+	msm_vidc_update_stats(inst, buf, etype);
+
+	return 0;
+}
+
+int msm_vidc_alloc_and_queue_input_internal_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = msm_vdec_get_input_internal_buffers(inst);
+	if (rc)
+		return rc;
+
+	rc = msm_vdec_release_input_internal_buffers(inst);
+	if (rc)
+		return rc;
+
+	rc = msm_vdec_create_input_internal_buffers(inst);
+	if (rc)
+		return rc;
+
+	rc = msm_vdec_queue_input_internal_buffers(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_queue_deferred_buffers(struct msm_vidc_inst *inst, enum msm_vidc_buffer_type buf_type)
+{
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf;
+	int rc = 0;
+
+	buffers = msm_vidc_get_buffers(inst, buf_type, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	msm_vidc_scale_power(inst, true);
+
+	list_for_each_entry(buf, &buffers->list, list) {
+		if (!(buf->attr & MSM_VIDC_ATTR_DEFERRED))
+			continue;
+		rc = msm_vidc_queue_buffer(inst, buf);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+int msm_vidc_buf_queue(struct msm_vidc_inst *inst, struct msm_vidc_buffer *buf)
+{
+	int rc = 0;
+
+	msm_vidc_scale_power(inst, is_input_buffer(buf->type));
+
+	rc = msm_vidc_queue_buffer(inst, buf);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+int msm_vidc_queue_buffer_single(struct msm_vidc_inst *inst, struct vb2_buffer *vb2)
+{
+	int rc = 0;
+	struct msm_vidc_buffer *buf = NULL;
+	struct msm_vidc_fence *fence = NULL;
+	struct msm_vidc_core *core = NULL;
+
+	core = inst->core;
+
+	buf = msm_vidc_get_driver_buf(inst, vb2);
+	if (!buf)
+		return -EINVAL;
+
+	if (is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE) &&
+		is_output_buffer(buf->type)) {
+		fence = call_fence_op(core, fence_create, inst);
+		if (!fence)
+			return -EINVAL;
+		buf->fence_id = fence->fence_id;
+	}
+
+	rc = inst->event_handle(inst, MSM_VIDC_BUF_QUEUE, buf);
+	if (rc)
+		goto exit;
+
+exit:
+	if (rc) {
+		i_vpr_e(inst, "%s: qbuf failed\n", __func__);
+		if (fence)
+			call_fence_op(core, fence_destroy, inst, fence->fence_id);
+	}
+	return rc;
+}
+
+int msm_vidc_destroy_internal_buffer(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buffer)
+{
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_mem_list *mem_list;
+	struct msm_vidc_mem *mem, *mem_dummy;
+	struct msm_vidc_buffer *buf, *dummy;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	if (!is_internal_buffer(buffer->type)) {
+		i_vpr_e(inst, "%s: type: %s is not internal\n",
+			__func__, buf_name(buffer->type));
+		return 0;
+	}
+
+	i_vpr_h(inst, "%s: destroy: type: %8s, size: %9u, device_addr %#llx\n", __func__,
+		buf_name(buffer->type), buffer->buffer_size, buffer->device_addr);
+
+	buffers = msm_vidc_get_buffers(inst, buffer->type, __func__);
+	if (!buffers)
+		return -EINVAL;
+	mem_list = msm_vidc_get_mem_info(inst, buffer->type, __func__);
+	if (!mem_list)
+		return -EINVAL;
+
+	list_for_each_entry_safe(mem, mem_dummy, &mem_list->list, list) {
+		if (mem->dmabuf == buffer->dmabuf) {
+			call_mem_op(core, memory_unmap_free, core, mem);
+			list_del(&mem->list);
+			msm_vidc_pool_free(inst, mem);
+			break;
+		}
+	}
+
+	list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+		if (buf->dmabuf == buffer->dmabuf) {
+			list_del(&buf->list);
+			msm_vidc_pool_free(inst, buf);
+			break;
+		}
+	}
+
+	return 0;
+}
+
+int msm_vidc_get_internal_buffers(struct msm_vidc_inst *inst,
+	enum msm_vidc_buffer_type buffer_type)
+{
+	u32 buf_size;
+	u32 buf_count;
+	struct msm_vidc_core *core;
+	struct msm_vidc_buffers *buffers;
+
+	core = inst->core;
+
+	buf_size = call_session_op(core, buffer_size,
+		inst, buffer_type);
+
+	buf_count = call_session_op(core, min_count,
+		inst, buffer_type);
+
+	buffers = msm_vidc_get_buffers(inst, buffer_type, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	/*
+	 * In a usecase when film grain is initially present, dpb buffers
+	 * are allocated and in the middle of the session, if film grain
+	 * is disabled, then dpb internal buffers should be destroyed.
+	 * When film grain is disabled, buffer_size op call returns 0.
+	 * To ensure buffers->reuse is set to false, add check to detect
+	 * if buf_size has become zero. Do the same for buf_count as well.
+	 */
+	if (is_split_mode_enabled(inst) && is_sub_state(inst, MSM_VIDC_FIRST_IPSC)) {
+		buffers->reuse = false;
+		buffers->size = buf_size;
+		buffers->min_count = buf_count;
+	} else if (buf_size && buf_size <= buffers->size &&
+		buf_count && buf_count <= buffers->min_count) {
+		buffers->reuse = true;
+	} else {
+		buffers->reuse = false;
+		buffers->size = buf_size;
+		buffers->min_count = buf_count;
+	}
+	return 0;
+}
+
+int msm_vidc_create_internal_buffer(struct msm_vidc_inst *inst,
+	enum msm_vidc_buffer_type buffer_type, u32 index)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_mem_list *mem_list;
+	struct msm_vidc_buffer *buffer;
+	struct msm_vidc_mem *mem;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	if (!is_internal_buffer(buffer_type)) {
+		i_vpr_e(inst, "%s: type %s is not internal\n",
+			__func__, buf_name(buffer_type));
+		return 0;
+	}
+
+	buffers = msm_vidc_get_buffers(inst, buffer_type, __func__);
+	if (!buffers)
+		return -EINVAL;
+	mem_list = msm_vidc_get_mem_info(inst, buffer_type, __func__);
+	if (!mem_list)
+		return -EINVAL;
+
+	if (!buffers->size)
+		return 0;
+
+	buffer = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_BUFFER);
+	if (!buffer) {
+		i_vpr_e(inst, "%s: buf alloc failed\n", __func__);
+		return -ENOMEM;
+	}
+	INIT_LIST_HEAD(&buffer->list);
+	buffer->type = buffer_type;
+	buffer->index = index;
+	buffer->buffer_size = buffers->size;
+	list_add_tail(&buffer->list, &buffers->list);
+
+	mem = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_ALLOC_MAP);
+	if (!mem) {
+		i_vpr_e(inst, "%s: mem poo alloc failed\n", __func__);
+		return -ENOMEM;
+	}
+	INIT_LIST_HEAD(&mem->list);
+	mem->type = buffer_type;
+	mem->region = call_mem_op(core, buffer_region, inst, buffer_type);
+	mem->size = buffer->buffer_size;
+	mem->secure = is_secure_region(mem->region);
+	rc = call_mem_op(core, memory_alloc_map, core, mem);
+	if (rc)
+		return -ENOMEM;
+	list_add_tail(&mem->list, &mem_list->list);
+
+	buffer->dmabuf = mem->dmabuf;
+	buffer->device_addr = mem->device_addr;
+	buffer->region = mem->region;
+	i_vpr_h(inst, "%s: create: type: %8s, size: %9u, device_addr %#llx\n", __func__,
+		buf_name(buffer_type), buffers->size, buffer->device_addr);
+
+	return 0;
+}
+
+int msm_vidc_create_internal_buffers(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	int i;
+
+	buffers = msm_vidc_get_buffers(inst, buffer_type, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	if (buffers->reuse) {
+		i_vpr_l(inst, "%s: reuse enabled for %s\n", __func__, buf_name(buffer_type));
+		return 0;
+	}
+
+	for (i = 0; i < buffers->min_count; i++) {
+		rc = msm_vidc_create_internal_buffer(inst, buffer_type, i);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+int msm_vidc_queue_internal_buffers(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buffer, *dummy;
+
+	if (!is_internal_buffer(buffer_type)) {
+		i_vpr_e(inst, "%s: %s is not internal\n", __func__, buf_name(buffer_type));
+		return 0;
+	}
+
+	/*
+	 * Set HFI_PROP_COMV_BUFFER_COUNT to firmware even if COMV buffer
+	 * is reused.
+	 */
+	if (is_decode_session(inst) && buffer_type == MSM_VIDC_BUF_COMV) {
+		rc = msm_vdec_set_num_comv(inst);
+		if (rc)
+			return rc;
+	}
+
+	buffers = msm_vidc_get_buffers(inst, buffer_type, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	list_for_each_entry_safe(buffer, dummy, &buffers->list, list) {
+		/* do not queue pending release buffers */
+		if (buffer->attr & MSM_VIDC_ATTR_PENDING_RELEASE)
+			continue;
+		/* do not queue already queued buffers */
+		if (buffer->attr & MSM_VIDC_ATTR_QUEUED)
+			continue;
+		rc = venus_hfi_queue_buffer(inst, buffer, NULL);
+		if (rc)
+			return rc;
+		/* mark queued */
+		buffer->attr |= MSM_VIDC_ATTR_QUEUED;
+
+		i_vpr_h(inst, "%s: queue: type: %8s, size: %9u, device_addr %#llx\n", __func__,
+			buf_name(buffer->type), buffer->buffer_size, buffer->device_addr);
+	}
+
+	return 0;
+}
+
+int msm_vidc_alloc_and_queue_session_internal_buffers(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int rc = 0;
+
+	if (buffer_type != MSM_VIDC_BUF_ARP &&
+		buffer_type != MSM_VIDC_BUF_PERSIST) {
+		i_vpr_e(inst, "%s: invalid buffer type: %s\n",
+			__func__, buf_name(buffer_type));
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = msm_vidc_get_internal_buffers(inst, buffer_type);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_create_internal_buffers(inst, buffer_type);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_queue_internal_buffers(inst, buffer_type);
+	if (rc)
+		goto exit;
+
+exit:
+	return rc;
+}
+
+int msm_vidc_release_internal_buffers(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type buffer_type)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buffer, *dummy;
+	if (!is_internal_buffer(buffer_type)) {
+		i_vpr_e(inst, "%s: %s is not internal\n",
+			__func__, buf_name(buffer_type));
+		return 0;
+	}
+
+	buffers = msm_vidc_get_buffers(inst, buffer_type, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	if (buffers->reuse) {
+		i_vpr_l(inst, "%s: reuse enabled for %s buf\n",
+			__func__, buf_name(buffer_type));
+		return 0;
+	}
+
+	list_for_each_entry_safe(buffer, dummy, &buffers->list, list) {
+		/* do not release already pending release buffers */
+		if (buffer->attr & MSM_VIDC_ATTR_PENDING_RELEASE)
+			continue;
+		/* release only queued buffers */
+		if (!(buffer->attr & MSM_VIDC_ATTR_QUEUED))
+			continue;
+		rc = venus_hfi_release_buffer(inst, buffer);
+		if (rc)
+			return rc;
+		/* mark pending release */
+		buffer->attr |= MSM_VIDC_ATTR_PENDING_RELEASE;
+
+		i_vpr_h(inst, "%s: release: type: %8s, size: %9u, device_addr %#llx\n", __func__,
+			buf_name(buffer->type), buffer->buffer_size, buffer->device_addr);
+	}
+
+	return 0;
+}
+
+int msm_vidc_vb2_buffer_done(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buf)
+{
+	int type, port, state;
+	struct vb2_queue *q;
+	struct vb2_buffer *vb2;
+	struct vb2_v4l2_buffer *vbuf;
+	bool found;
+
+	type = v4l2_type_from_driver(buf->type, __func__);
+	if (!type)
+		return -EINVAL;
+	port = v4l2_type_to_driver_port(inst, type, __func__);
+	if (port < 0)
+		return -EINVAL;
+
+	q = inst->bufq[port].vb2q;
+	if (!q->streaming) {
+		i_vpr_e(inst, "%s: port %d is not streaming\n",
+			__func__, port);
+		return -EINVAL;
+	}
+
+	found = false;
+	list_for_each_entry(vb2, &q->queued_list, queued_entry) {
+		if (vb2->state != VB2_BUF_STATE_ACTIVE)
+			continue;
+		if (vb2->index == buf->index) {
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		print_vidc_buffer(VIDC_ERR, "err ", "vb2 not found for", inst, buf);
+		return -EINVAL;
+	}
+	/**
+	 * v4l2 clears buffer state related flags. For driver errors
+	 * send state as error to avoid skipping V4L2_BUF_FLAG_ERROR
+	 * flag at v4l2 side.
+	 */
+	if (buf->flags & MSM_VIDC_BUF_FLAG_ERROR)
+		state = VB2_BUF_STATE_ERROR;
+	else
+		state = VB2_BUF_STATE_DONE;
+
+	vbuf = to_vb2_v4l2_buffer(vb2);
+	vbuf->flags = buf->flags;
+	vb2->timestamp = buf->timestamp;
+	vb2->planes[0].bytesused = buf->data_size + vb2->planes[0].data_offset;
+	vb2_buffer_done(vb2, state);
+
+	return 0;
+}
+
+int msm_vidc_v4l2_fh_init(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	int index;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	/* do not init, if already inited */
+	if (inst->fh.vdev) {
+		i_vpr_e(inst, "%s: already inited\n", __func__);
+		return -EINVAL;
+	}
+
+	if (is_decode_session(inst))
+		index = 0;
+	else if (is_encode_session(inst))
+		index = 1;
+	else
+		return -EINVAL;
+
+	v4l2_fh_init(&inst->fh, &core->vdev[index].vdev);
+	inst->fh.ctrl_handler = &inst->ctrl_handler;
+	v4l2_fh_add(&inst->fh);
+
+	return rc;
+}
+
+int msm_vidc_v4l2_fh_deinit(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	/* do not deinit, if not already inited */
+	if (!inst->fh.vdev) {
+		i_vpr_h(inst, "%s: already not inited\n", __func__);
+		return 0;
+	}
+
+	v4l2_fh_del(&inst->fh);
+	inst->fh.ctrl_handler = NULL;
+	v4l2_fh_exit(&inst->fh);
+
+	return rc;
+}
+
+static int vb2q_init(struct msm_vidc_inst *inst,
+	struct vb2_queue *q, enum v4l2_buf_type type)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	q->type = type;
+	q->io_modes = VB2_MMAP | VB2_DMABUF;
+	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
+	q->ops = core->vb2_ops;
+	q->mem_ops = core->vb2_mem_ops;
+	q->drv_priv = inst;
+	q->copy_timestamp = 1;
+	rc = vb2_queue_init(q);
+	if (rc)
+		i_vpr_e(inst, "%s: vb2_queue_init failed for type %d\n",
+				__func__, type);
+	return rc;
+}
+
+static int m2m_queue_init(void *priv, struct vb2_queue *src_vq,
+	struct vb2_queue *dst_vq)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst = priv;
+	struct msm_vidc_core *core;
+
+	if (!inst || !inst->core || !src_vq || !dst_vq) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+
+	src_vq->supports_requests = core->capabilities[SUPPORTS_REQUESTS].value;
+	src_vq->lock = &inst->ctx_q_lock;
+	src_vq->dev = &core->pdev->dev;
+	rc = vb2q_init(inst, src_vq, INPUT_MPLANE);
+	if (rc)
+		goto fail_input_vb2q_init;
+	inst->bufq[INPUT_PORT].vb2q = src_vq;
+
+	dst_vq->lock = src_vq->lock;
+	dst_vq->dev = &core->pdev->dev;
+	rc = vb2q_init(inst, dst_vq, OUTPUT_MPLANE);
+	if (rc)
+		goto fail_out_vb2q_init;
+	inst->bufq[OUTPUT_PORT].vb2q = dst_vq;
+	return rc;
+
+fail_out_vb2q_init:
+	vb2_queue_release(inst->bufq[INPUT_PORT].vb2q);
+fail_input_vb2q_init:
+	return rc;
+}
+
+int msm_vidc_vb2_queue_init(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	if (inst->m2m_dev) {
+		i_vpr_e(inst, "%s: vb2q already inited\n", __func__);
+		return -EINVAL;
+	}
+
+	inst->m2m_dev = v4l2_m2m_init(core->v4l2_m2m_ops);
+	if (IS_ERR(inst->m2m_dev)) {
+		i_vpr_e(inst, "%s: failed to initialize v4l2 m2m device\n", __func__);
+		rc = PTR_ERR(inst->m2m_dev);
+		goto fail_m2m_init;
+	}
+
+	/* v4l2_m2m_ctx_init will do input & output queues initialization */
+	inst->m2m_ctx = v4l2_m2m_ctx_init(inst->m2m_dev, inst, m2m_queue_init);
+	if (!inst->m2m_ctx) {
+		rc = -EINVAL;
+		i_vpr_e(inst, "%s: v4l2_m2m_ctx_init failed\n", __func__);
+		goto fail_m2m_ctx_init;
+	}
+	inst->fh.m2m_ctx = inst->m2m_ctx;
+
+	inst->bufq[INPUT_META_PORT].vb2q = vzalloc(sizeof(*inst->bufq[INPUT_META_PORT].vb2q));
+	if (!inst->bufq[INPUT_META_PORT].vb2q) {
+		i_vpr_e(inst, "%s: allocation failed\n", __func__);
+		rc = -ENOMEM;
+		goto fail_in_meta_alloc;
+	}
+
+	/* do input meta port queues initialization */
+	rc = vb2q_init(inst, inst->bufq[INPUT_META_PORT].vb2q, INPUT_META_PLANE);
+	if (rc)
+		goto fail_in_meta_vb2q_init;
+
+	inst->bufq[OUTPUT_META_PORT].vb2q = vzalloc(sizeof(*inst->bufq[OUTPUT_META_PORT].vb2q));
+	if (!inst->bufq[OUTPUT_META_PORT].vb2q) {
+		i_vpr_e(inst, "%s: allocation failed\n", __func__);
+		rc = -ENOMEM;
+		goto fail_out_meta_alloc;
+	}
+
+	/* do output meta port queues initialization */
+	rc = vb2q_init(inst, inst->bufq[OUTPUT_META_PORT].vb2q, OUTPUT_META_PLANE);
+	if (rc)
+		goto fail_out_meta_vb2q_init;
+
+	return 0;
+
+fail_out_meta_vb2q_init:
+	vfree(inst->bufq[OUTPUT_META_PORT].vb2q);
+	inst->bufq[OUTPUT_META_PORT].vb2q = NULL;
+fail_out_meta_alloc:
+	vb2_queue_release(inst->bufq[INPUT_META_PORT].vb2q);
+fail_in_meta_vb2q_init:
+	vfree(inst->bufq[INPUT_META_PORT].vb2q);
+	inst->bufq[INPUT_META_PORT].vb2q = NULL;
+fail_in_meta_alloc:
+	v4l2_m2m_ctx_release(inst->m2m_ctx);
+	inst->m2m_ctx = NULL;
+	inst->fh.m2m_ctx = NULL;
+	inst->bufq[OUTPUT_PORT].vb2q = NULL;
+	inst->bufq[INPUT_PORT].vb2q = NULL;
+fail_m2m_ctx_init:
+	v4l2_m2m_release(inst->m2m_dev);
+	inst->m2m_dev = NULL;
+fail_m2m_init:
+	return rc;
+}
+
+int msm_vidc_vb2_queue_deinit(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	if (!inst->m2m_dev) {
+		i_vpr_h(inst, "%s: vb2q already deinited\n", __func__);
+		return 0;
+	}
+
+	/*
+	 * vb2_queue_release() for input and output queues
+	 * is called from v4l2_m2m_ctx_release()
+	 */
+	v4l2_m2m_ctx_release(inst->m2m_ctx);
+	inst->m2m_ctx = NULL;
+	inst->bufq[OUTPUT_PORT].vb2q = NULL;
+	inst->bufq[INPUT_PORT].vb2q = NULL;
+	v4l2_m2m_release(inst->m2m_dev);
+	inst->m2m_dev = NULL;
+
+	vb2_queue_release(inst->bufq[OUTPUT_META_PORT].vb2q);
+	vfree(inst->bufq[OUTPUT_META_PORT].vb2q);
+	inst->bufq[OUTPUT_META_PORT].vb2q = NULL;
+	vb2_queue_release(inst->bufq[INPUT_META_PORT].vb2q);
+	vfree(inst->bufq[INPUT_META_PORT].vb2q);
+	inst->bufq[INPUT_META_PORT].vb2q = NULL;
+
+	return rc;
+}
+
+int msm_vidc_add_session(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_inst *i;
+	struct msm_vidc_core *core;
+	u32 count = 0;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	if (core->state != MSM_VIDC_CORE_INIT) {
+		i_vpr_e(inst, "%s: invalid state %s\n",
+			__func__, core_state_name(core->state));
+		rc = -EINVAL;
+		goto unlock;
+	}
+	list_for_each_entry(i, &core->instances, list)
+		count++;
+
+	if (count < core->capabilities[MAX_SESSION_COUNT].value) {
+		list_add_tail(&inst->list, &core->instances);
+	} else {
+		i_vpr_e(inst, "%s: max limit %d already running %d sessions\n",
+			__func__, core->capabilities[MAX_SESSION_COUNT].value, count);
+		rc = -EAGAIN;
+	}
+unlock:
+	core_unlock(core, __func__);
+
+	return rc;
+}
+
+int msm_vidc_remove_session(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_inst *i, *temp;
+	struct msm_vidc_core *core;
+	u32 count = 0;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	list_for_each_entry_safe(i, temp, &core->instances, list) {
+		if (i->session_id == inst->session_id) {
+			list_move_tail(&i->list, &core->dangling_instances);
+			i_vpr_h(inst, "%s: removed session %#x\n",
+				__func__, i->session_id);
+		}
+	}
+	list_for_each_entry(i, &core->instances, list)
+		count++;
+	i_vpr_h(inst, "%s: remaining sessions %d\n", __func__, count);
+	core_unlock(core, __func__);
+
+	return 0;
+}
+
+int msm_vidc_remove_dangling_session(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_inst *i, *temp;
+	struct msm_vidc_core *core;
+	u32 count = 0, dcount = 0;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	list_for_each_entry_safe(i, temp, &core->dangling_instances, list) {
+		if (i->session_id == inst->session_id) {
+			list_del_init(&i->list);
+			i_vpr_h(inst, "%s: removed dangling session %#x\n",
+				__func__, i->session_id);
+			break;
+		}
+	}
+	list_for_each_entry(i, &core->instances, list)
+		count++;
+	list_for_each_entry(i, &core->dangling_instances, list)
+		dcount++;
+	i_vpr_h(inst, "%s: remaining sessions. active %d, dangling %d\n",
+		__func__, count, dcount);
+	core_unlock(core, __func__);
+
+	return 0;
+}
+
+int msm_vidc_session_open(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	inst->packet_size = 4096;
+	inst->packet = vzalloc(inst->packet_size);
+	if (!inst->packet) {
+		i_vpr_e(inst, "%s: allocation failed\n", __func__);
+		return -ENOMEM;
+	}
+
+	rc = venus_hfi_session_open(inst);
+	if (rc)
+		goto error;
+
+	return 0;
+error:
+	i_vpr_e(inst, "%s(): session open failed\n", __func__);
+	vfree(inst->packet);
+	inst->packet = NULL;
+	return rc;
+}
+
+int msm_vidc_session_set_codec(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = venus_hfi_session_set_codec(inst);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+int msm_vidc_session_set_secure_mode(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	rc = venus_hfi_session_set_secure_mode(inst);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+int msm_vidc_session_set_default_header(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	u32 default_header = false;
+
+	default_header = inst->capabilities[DEFAULT_HEADER].value;
+	i_vpr_h(inst, "%s: default header: %d", __func__, default_header);
+	rc = venus_hfi_session_property(inst,
+			HFI_PROP_DEC_DEFAULT_HEADER,
+			HFI_HOST_FLAGS_NONE,
+			get_hfi_port(inst, INPUT_PORT),
+			HFI_PAYLOAD_U32,
+			&default_header,
+			sizeof(u32));
+	if (rc)
+		i_vpr_e(inst, "%s: set property failed\n", __func__);
+	return rc;
+}
+
+int msm_vidc_session_streamoff(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	int count = 0;
+	struct msm_vidc_core *core;
+	enum signal_session_response signal_type;
+	enum msm_vidc_buffer_type buffer_type;
+
+	if (port == INPUT_PORT) {
+		signal_type = SIGNAL_CMD_STOP_INPUT;
+		buffer_type = MSM_VIDC_BUF_INPUT;
+	} else if (port == OUTPUT_PORT) {
+		signal_type = SIGNAL_CMD_STOP_OUTPUT;
+		buffer_type = MSM_VIDC_BUF_OUTPUT;
+	} else {
+		i_vpr_e(inst, "%s: invalid port: %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	rc = venus_hfi_stop(inst, port);
+	if (rc)
+		goto error;
+
+	core = inst->core;
+	i_vpr_h(inst, "%s: wait on port: %d for time: %d ms\n",
+		__func__, port, core->capabilities[HW_RESPONSE_TIMEOUT].value);
+	inst_unlock(inst, __func__);
+	rc = wait_for_completion_timeout(
+			&inst->completions[signal_type],
+			msecs_to_jiffies(
+			core->capabilities[HW_RESPONSE_TIMEOUT].value));
+	if (!rc) {
+		i_vpr_e(inst, "%s: session stop timed out for port: %d\n",
+				__func__, port);
+		rc = -ETIMEDOUT;
+		msm_vidc_inst_timeout(inst);
+	} else {
+		rc = 0;
+	}
+	inst_lock(inst, __func__);
+
+	if (rc)
+		goto error;
+
+	if (port == INPUT_PORT) {
+		/* flush input timer list */
+		msm_vidc_flush_input_timer(inst);
+	}
+
+	/* no more queued buffers after streamoff */
+	count = msm_vidc_num_buffers(inst, buffer_type, MSM_VIDC_ATTR_QUEUED);
+	if (!count) {
+		i_vpr_h(inst, "%s: stop successful on port: %d\n",
+			__func__, port);
+	} else {
+		i_vpr_e(inst,
+			"%s: %d buffers pending with firmware on port: %d\n",
+			__func__, count, port);
+		rc = -EINVAL;
+		goto error;
+	}
+
+	rc = msm_vidc_state_change_streamoff(inst, port);
+	if (rc)
+		goto error;
+
+	/* flush deferred buffers */
+	msm_vidc_flush_buffers(inst, buffer_type);
+	msm_vidc_flush_read_only_buffers(inst, buffer_type);
+	return 0;
+
+error:
+	msm_vidc_kill_session(inst);
+	msm_vidc_flush_buffers(inst, buffer_type);
+	msm_vidc_flush_read_only_buffers(inst, buffer_type);
+	return rc;
+}
+
+int msm_vidc_session_close(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	bool wait_for_response;
+
+	core = inst->core;
+
+	wait_for_response = true;
+	rc = venus_hfi_session_close(inst);
+	if (rc) {
+		i_vpr_e(inst, "%s: session close cmd failed\n", __func__);
+		wait_for_response = false;
+	}
+
+	/* we are not supposed to send any more commands after close */
+	i_vpr_h(inst, "%s: free session packet data\n", __func__);
+	vfree(inst->packet);
+	inst->packet = NULL;
+
+	if (wait_for_response) {
+		i_vpr_h(inst, "%s: wait on close for time: %d ms\n",
+		__func__, core->capabilities[HW_RESPONSE_TIMEOUT].value);
+		inst_unlock(inst, __func__);
+		rc = wait_for_completion_timeout(
+				&inst->completions[SIGNAL_CMD_CLOSE],
+				msecs_to_jiffies(
+				core->capabilities[HW_RESPONSE_TIMEOUT].value));
+		if (!rc) {
+			i_vpr_e(inst, "%s: session close timed out\n", __func__);
+			rc = -ETIMEDOUT;
+			msm_vidc_inst_timeout(inst);
+		} else {
+			rc = 0;
+			i_vpr_h(inst, "%s: close successful\n", __func__);
+		}
+		inst_lock(inst, __func__);
+	}
+
+	return rc;
+}
+
+int msm_vidc_kill_session(struct msm_vidc_inst *inst)
+{
+	if (!inst->session_id) {
+		i_vpr_e(inst, "%s: already killed\n", __func__);
+		return 0;
+	}
+
+	i_vpr_e(inst, "%s: killing session\n", __func__);
+	msm_vidc_session_close(inst);
+	msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+
+	return 0;
+}
+
+int msm_vidc_get_inst_capability(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	int i;
+	u32 codecs_count = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	codecs_count = core->enc_codecs_count + core->dec_codecs_count;
+
+	for (i = 0; i < codecs_count; i++) {
+		if (core->inst_caps[i].domain == inst->domain &&
+			core->inst_caps[i].codec == inst->codec) {
+			i_vpr_h(inst,
+				"%s: copied capabilities with %#x codec, %#x domain\n",
+				__func__, inst->codec, inst->domain);
+			memcpy(&inst->capabilities[0], &core->inst_caps[i].cap[0],
+			(INST_CAP_MAX + 1) * sizeof(struct msm_vidc_inst_cap));
+		}
+	}
+
+	return rc;
+}
+
+int msm_vidc_init_core_caps(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	int i, num_platform_caps;
+	struct msm_platform_core_capability *platform_data;
+
+	platform_data = core->platform->data.core_data;
+	if (!platform_data) {
+		d_vpr_e("%s: platform core data is NULL\n",
+				__func__);
+			rc = -EINVAL;
+			goto exit;
+	}
+
+	num_platform_caps = core->platform->data.core_data_size;
+
+	/* loop over platform caps */
+	for (i = 0; i < num_platform_caps && i < CORE_CAP_MAX; i++) {
+		core->capabilities[platform_data[i].type].type = platform_data[i].type;
+		core->capabilities[platform_data[i].type].value = platform_data[i].value;
+	}
+
+exit:
+	return rc;
+}
+
+static int update_inst_capability(struct msm_platform_inst_capability *in,
+		struct msm_vidc_inst_capability *capability)
+{
+	if (!in || !capability) {
+		d_vpr_e("%s: invalid params %pK %pK\n",
+			__func__, in, capability);
+		return -EINVAL;
+	}
+	if (in->cap_id >= INST_CAP_MAX) {
+		d_vpr_e("%s: invalid cap id %d\n", __func__, in->cap_id);
+		return -EINVAL;
+	}
+
+	capability->cap[in->cap_id].cap_id = in->cap_id;
+	capability->cap[in->cap_id].min = in->min;
+	capability->cap[in->cap_id].max = in->max;
+	capability->cap[in->cap_id].step_or_mask = in->step_or_mask;
+	capability->cap[in->cap_id].value = in->value;
+	capability->cap[in->cap_id].flags = in->flags;
+	capability->cap[in->cap_id].v4l2_id = in->v4l2_id;
+	capability->cap[in->cap_id].hfi_id = in->hfi_id;
+
+	return 0;
+}
+
+static int update_inst_cap_dependency(
+	struct msm_platform_inst_cap_dependency *in,
+	struct msm_vidc_inst_capability *capability)
+{
+	if (!in || !capability) {
+		d_vpr_e("%s: invalid params %pK %pK\n",
+			__func__, in, capability);
+		return -EINVAL;
+	}
+	if (in->cap_id >= INST_CAP_MAX) {
+		d_vpr_e("%s: invalid cap id %d\n", __func__, in->cap_id);
+		return -EINVAL;
+	}
+
+	if (capability->cap[in->cap_id].cap_id != in->cap_id) {
+		d_vpr_e("%s: invalid cap id %d\n", __func__, in->cap_id);
+		return -EINVAL;
+	}
+
+	memcpy(capability->cap[in->cap_id].children, in->children,
+		sizeof(capability->cap[in->cap_id].children));
+	capability->cap[in->cap_id].adjust = in->adjust;
+	capability->cap[in->cap_id].set = in->set;
+
+	return 0;
+}
+
+int msm_vidc_init_instance_caps(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u8 enc_valid_codecs, dec_valid_codecs;
+	u8 count_bits, codecs_count = 0;
+	u8 enc_codecs_count = 0, dec_codecs_count = 0;
+	int i, j, check_bit;
+	int num_platform_cap_data, num_platform_cap_dependency_data;
+	struct msm_platform_inst_capability *platform_cap_data = NULL;
+	struct msm_platform_inst_cap_dependency *platform_cap_dependency_data = NULL;
+
+	platform_cap_data = core->platform->data.inst_cap_data;
+	if (!platform_cap_data) {
+		d_vpr_e("%s: platform instance cap data is NULL\n",
+				__func__);
+			rc = -EINVAL;
+		goto error;
+	}
+
+	platform_cap_dependency_data = core->platform->data.inst_cap_dependency_data;
+	if (!platform_cap_dependency_data) {
+		d_vpr_e("%s: platform instance cap dependency data is NULL\n",
+				__func__);
+			rc = -EINVAL;
+		goto error;
+	}
+
+	enc_valid_codecs = core->capabilities[ENC_CODECS].value;
+	count_bits = enc_valid_codecs;
+	COUNT_BITS(count_bits, enc_codecs_count);
+	core->enc_codecs_count = enc_codecs_count;
+
+	dec_valid_codecs = core->capabilities[DEC_CODECS].value;
+	count_bits = dec_valid_codecs;
+	COUNT_BITS(count_bits, dec_codecs_count);
+	core->dec_codecs_count = dec_codecs_count;
+
+	codecs_count = enc_codecs_count + dec_codecs_count;
+	core->inst_caps = devm_kzalloc(&core->pdev->dev,
+		codecs_count * sizeof(struct msm_vidc_inst_capability), GFP_KERNEL);
+	if (!core->inst_caps) {
+		d_vpr_e("%s: failed to alloc memory for instance caps\n", __func__);
+		rc = -ENOMEM;
+		goto error;
+	}
+
+	check_bit = 0;
+	/* determine codecs for enc domain */
+	for (i = 0; i < enc_codecs_count; i++) {
+		while (check_bit < (sizeof(enc_valid_codecs) * 8)) {
+			if (enc_valid_codecs & BIT(check_bit)) {
+				core->inst_caps[i].domain = MSM_VIDC_ENCODER;
+				core->inst_caps[i].codec = enc_valid_codecs &
+						BIT(check_bit);
+				check_bit++;
+				break;
+			}
+			check_bit++;
+		}
+	}
+
+	/* reset checkbit to check from 0th bit of decoder codecs set bits*/
+	check_bit = 0;
+	/* determine codecs for dec domain */
+	for (; i < codecs_count; i++) {
+		while (check_bit < (sizeof(dec_valid_codecs) * 8)) {
+			if (dec_valid_codecs & BIT(check_bit)) {
+				core->inst_caps[i].domain = MSM_VIDC_DECODER;
+				core->inst_caps[i].codec = dec_valid_codecs &
+						BIT(check_bit);
+				check_bit++;
+				break;
+			}
+			check_bit++;
+		}
+	}
+
+	num_platform_cap_data = core->platform->data.inst_cap_data_size;
+	num_platform_cap_dependency_data = core->platform->data.inst_cap_dependency_data_size;
+	d_vpr_h("%s: num caps %d, dependency %d\n", __func__,
+		num_platform_cap_data, num_platform_cap_dependency_data);
+
+	/* loop over each platform capability */
+	for (i = 0; i < num_platform_cap_data; i++) {
+		/* select matching core codec and update it */
+		for (j = 0; j < codecs_count; j++) {
+			if ((platform_cap_data[i].domain &
+				core->inst_caps[j].domain) &&
+				(platform_cap_data[i].codec &
+				core->inst_caps[j].codec)) {
+				/* update core capability */
+				rc = update_inst_capability(&platform_cap_data[i],
+					&core->inst_caps[j]);
+				if (rc)
+					return rc;
+			}
+		}
+	}
+
+	/* loop over each platform dependency capability */
+	for (i = 0; i < num_platform_cap_dependency_data; i++) {
+		/* select matching core codec and update it */
+		for (j = 0; j < codecs_count; j++) {
+			if ((platform_cap_dependency_data[i].domain &
+				core->inst_caps[j].domain) &&
+				(platform_cap_dependency_data[i].codec &
+				core->inst_caps[j].codec)) {
+				/* update core dependency capability */
+				rc = update_inst_cap_dependency(
+					&platform_cap_dependency_data[i],
+					&core->inst_caps[j]);
+				if (rc)
+					return rc;
+			}
+		}
+	}
+
+error:
+	return rc;
+}
+
+int msm_vidc_core_deinit_locked(struct msm_vidc_core *core, bool force)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst, *dummy;
+	enum msm_vidc_allow allow;
+
+	rc = __strict_check(core, __func__);
+	if (rc) {
+		d_vpr_e("%s(): core was not locked\n", __func__);
+		return rc;
+	}
+
+	if (is_core_state(core, MSM_VIDC_CORE_DEINIT))
+		return 0;
+
+	/* print error for state change not allowed case */
+	allow = msm_vidc_allow_core_state_change(core, MSM_VIDC_CORE_DEINIT);
+	if (allow != MSM_VIDC_ALLOW)
+		d_vpr_e("%s: %s core state change %s -> %s\n", __func__,
+			allow_name(allow), core_state_name(core->state),
+			core_state_name(MSM_VIDC_CORE_DEINIT));
+
+	if (force) {
+		d_vpr_e("%s(): force deinit core\n", __func__);
+	} else {
+		/* in normal case, deinit core only if no session present */
+		if (!list_empty(&core->instances)) {
+			d_vpr_h("%s(): skip deinit\n", __func__);
+			return 0;
+		} else {
+			d_vpr_h("%s(): deinit core\n", __func__);
+		}
+	}
+
+	venus_hfi_core_deinit(core, force);
+
+	/* unlink all sessions from core, if any */
+	list_for_each_entry_safe(inst, dummy, &core->instances, list) {
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		list_move_tail(&inst->list, &core->dangling_instances);
+	}
+	msm_vidc_change_core_state(core, MSM_VIDC_CORE_DEINIT, __func__);
+
+	return rc;
+}
+
+int msm_vidc_core_deinit(struct msm_vidc_core *core, bool force)
+{
+	int rc = 0;
+
+	core_lock(core, __func__);
+	rc = msm_vidc_core_deinit_locked(core, force);
+	core_unlock(core, __func__);
+
+	return rc;
+}
+
+int msm_vidc_core_init_wait(struct msm_vidc_core *core)
+{
+	const int interval = 10;
+	int max_tries, count = 0, rc = 0;
+
+	core_lock(core, __func__);
+	if (is_core_state(core, MSM_VIDC_CORE_INIT)) {
+		rc = 0;
+		goto unlock;
+	} else if (is_core_state(core, MSM_VIDC_CORE_DEINIT) ||
+		   is_core_state(core, MSM_VIDC_CORE_ERROR)) {
+		d_vpr_e("%s: invalid core state %s\n",
+			__func__, core_state_name(core->state));
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	d_vpr_h("%s(): waiting for state change\n", __func__);
+	max_tries = core->capabilities[HW_RESPONSE_TIMEOUT].value / interval;
+	while (count < max_tries) {
+		if (core->state != MSM_VIDC_CORE_INIT_WAIT)
+			break;
+
+		core_unlock(core, __func__);
+		msleep_interruptible(interval);
+		core_lock(core, __func__);
+		count++;
+	}
+	d_vpr_h("%s: state %s, interval %u, count %u, max_tries %u\n", __func__,
+		core_state_name(core->state), interval, count, max_tries);
+
+	if (is_core_state(core, MSM_VIDC_CORE_INIT)) {
+		d_vpr_h("%s: sys init successful\n", __func__);
+		rc = 0;
+		goto unlock;
+	} else if (is_core_state(core, MSM_VIDC_CORE_INIT_WAIT)) {
+		d_vpr_h("%s: sys init wait timedout. state %s\n",
+			__func__, core_state_name(core->state));
+		msm_vidc_change_core_state(core, MSM_VIDC_CORE_ERROR, __func__);
+		/* mark video hw unresponsive */
+		msm_vidc_change_core_sub_state(core,
+			0, CORE_SUBSTATE_VIDEO_UNRESPONSIVE, __func__);
+		/* core deinit to handle error */
+		msm_vidc_core_deinit_locked(core, true);
+		rc = -EINVAL;
+		goto unlock;
+	} else {
+		d_vpr_e("%s: invalid core state %s\n",
+			__func__, core_state_name(core->state));
+		rc = -EINVAL;
+		goto unlock;
+	}
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int msm_vidc_core_init(struct msm_vidc_core *core)
+{
+	enum msm_vidc_allow allow;
+	int rc = 0;
+
+	core_lock(core, __func__);
+	if (core_in_valid_state(core)) {
+		goto unlock;
+	} else if (is_core_state(core, MSM_VIDC_CORE_ERROR)) {
+		d_vpr_e("%s: invalid core state %s\n",
+			__func__, core_state_name(core->state));
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	/* print error for state change not allowed case */
+	allow = msm_vidc_allow_core_state_change(core, MSM_VIDC_CORE_INIT_WAIT);
+	if (allow != MSM_VIDC_ALLOW)
+		d_vpr_e("%s: %s core state change %s -> %s\n", __func__,
+			allow_name(allow), core_state_name(core->state),
+			core_state_name(MSM_VIDC_CORE_INIT_WAIT));
+
+	msm_vidc_change_core_state(core, MSM_VIDC_CORE_INIT_WAIT, __func__);
+	/* clear PM suspend from core sub_state */
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_PM_SUSPEND, 0, __func__);
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_PAGE_FAULT, 0, __func__);
+
+	rc = venus_hfi_core_init(core);
+	if (rc) {
+		msm_vidc_change_core_state(core, MSM_VIDC_CORE_ERROR, __func__);
+		d_vpr_e("%s: core init failed\n", __func__);
+		/* do core deinit to handle error */
+		msm_vidc_core_deinit_locked(core, true);
+		goto unlock;
+	}
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int msm_vidc_print_residency_stats(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	core_lock(core, __func__);
+	rc = call_res_op(core, clk_print_residency_stats, core);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int msm_vidc_reset_residency_stats(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	core_lock(core, __func__);
+	rc = call_res_op(core, clk_reset_residency_stats, core);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int msm_vidc_inst_timeout(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *instance;
+	bool found;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	/*
+	 * All sessions will be removed from core list in core deinit,
+	 * do not deinit core from a session which is not present in
+	 * core list.
+	 */
+	found = false;
+	list_for_each_entry(instance, &core->instances, list) {
+		if (instance == inst) {
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		i_vpr_e(inst,
+			"%s: session not available in core list\n", __func__);
+		rc = -EINVAL;
+		goto unlock;
+	}
+	/* mark video hw unresponsive */
+	msm_vidc_change_core_state(core, MSM_VIDC_CORE_ERROR, __func__);
+	msm_vidc_change_core_sub_state(core,
+		0, CORE_SUBSTATE_VIDEO_UNRESPONSIVE, __func__);
+
+	/* call core deinit for a valid instance timeout case */
+	msm_vidc_core_deinit_locked(core, true);
+
+unlock:
+	core_unlock(core, __func__);
+
+	return rc;
+}
+
+int msm_vidc_print_buffer_info(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_buffers *buffers;
+	int i;
+
+	/* Print buffer details */
+	for (i = 1; i < ARRAY_SIZE(buf_type_name_arr); i++) {
+		buffers = msm_vidc_get_buffers(inst, i, __func__);
+		if (!buffers)
+			continue;
+
+		i_vpr_h(inst,
+			"buf: type: %15s, min %2d, extra %2d, actual %2d, size %9u, reuse %d\n",
+			buf_name(i), buffers->min_count,
+			buffers->extra_count, buffers->actual_count,
+			buffers->size, buffers->reuse);
+	}
+
+	return 0;
+}
+
+int msm_vidc_print_inst_info(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf;
+	enum msm_vidc_port_type port;
+	bool is_secure, is_decode;
+	u32 bit_depth, bit_rate, frame_rate, width, height;
+	struct dma_buf *dbuf;
+	struct inode *f_inode;
+	unsigned long inode_num = 0;
+	long ref_count = -1;
+	int i = 0;
+
+	is_secure = is_secure_session(inst);
+	is_decode = is_decode_session(inst);
+	port = is_decode ? INPUT_PORT : OUTPUT_PORT;
+	width = inst->fmts[port].fmt.pix_mp.width;
+	height = inst->fmts[port].fmt.pix_mp.height;
+	bit_depth = inst->capabilities[BIT_DEPTH].value & 0xFFFF;
+	bit_rate = inst->capabilities[BIT_RATE].value;
+	frame_rate = inst->capabilities[FRAME_RATE].value >> 16;
+
+	i_vpr_e(inst, "%s %s session, HxW: %d x %d, fps: %d, bitrate: %d, bit-depth: %d\n",
+		is_secure ? "Secure" : "Non-Secure",
+		is_decode ? "Decode" : "Encode",
+		height, width,
+		frame_rate, bit_rate, bit_depth);
+
+	/* Print buffer details */
+	for (i = 1; i < ARRAY_SIZE(buf_type_name_arr); i++) {
+		buffers = msm_vidc_get_buffers(inst, i, __func__);
+		if (!buffers)
+			continue;
+
+		i_vpr_e(inst, "count: type: %11s, min: %2d, extra: %2d, actual: %2d\n",
+			buf_name(i), buffers->min_count,
+			buffers->extra_count, buffers->actual_count);
+
+		list_for_each_entry(buf, &buffers->list, list) {
+			if (!buf->dmabuf)
+				continue;
+			dbuf = (struct dma_buf *)buf->dmabuf;
+			if (dbuf && dbuf->file) {
+				f_inode = file_inode(dbuf->file);
+				if (f_inode) {
+					inode_num = f_inode->i_ino;
+					ref_count = file_count(dbuf->file);
+				}
+			}
+			i_vpr_e(inst,
+				"buf: type: %11s, index: %2d, fd: %4d, size: %9u, off: %8u, filled: %9u, daddr: %#llx, inode: %8lu, ref: %2ld, flags: %8x, ts: %16lld, attr: %8x\n",
+				buf_name(i), buf->index, buf->fd, buf->buffer_size,
+				buf->data_offset, buf->data_size, buf->device_addr,
+				inode_num, ref_count, buf->flags, buf->timestamp, buf->attr);
+		}
+	}
+
+	return 0;
+}
+
+void msm_vidc_print_core_info(struct msm_vidc_core *core)
+{
+	struct msm_vidc_inst *inst = NULL;
+	struct msm_vidc_inst *instances[MAX_SUPPORTED_INSTANCES];
+	s32 num_instances = 0;
+
+	core_lock(core, __func__);
+	list_for_each_entry(inst, &core->instances, list)
+		instances[num_instances++] = inst;
+	core_unlock(core, __func__);
+
+	while (num_instances--) {
+		inst = instances[num_instances];
+		inst = get_inst_ref(core, inst);
+		if (!inst)
+			continue;
+		inst_lock(inst, __func__);
+		msm_vidc_print_inst_info(inst);
+		inst_unlock(inst, __func__);
+		put_inst(inst);
+	}
+}
+
+int msm_vidc_smmu_fault_handler(struct iommu_domain *domain,
+		struct device *dev, unsigned long iova, int flags, void *data)
+{
+	struct msm_vidc_core *core = data;
+
+	if (is_core_sub_state(core, CORE_SUBSTATE_PAGE_FAULT)) {
+		if (core->capabilities[NON_FATAL_FAULTS].value) {
+			dprintk_ratelimit(VIDC_ERR, "err ",
+					"%s: non-fatal pagefault address: %lx\n",
+					__func__, iova);
+			return 0;
+		}
+	}
+
+	d_vpr_e(FMT_STRING_FAULT_HANDLER, __func__, iova);
+
+	/* mark smmu fault as handled */
+	core_lock(core, __func__);
+	msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_PAGE_FAULT, __func__);
+	core_unlock(core, __func__);
+
+	msm_vidc_print_core_info(core);
+	/*
+	 * Return -ENOSYS to elicit the default behaviour of smmu driver.
+	 * If we return -ENOSYS, then smmu driver assumes page fault handler
+	 * is not installed and prints a list of useful debug information like
+	 * FAR, SID etc. This information is not printed if we return 0.
+	 */
+	return -ENOSYS;
+}
+
+bool is_ssr_type_allowed(struct msm_vidc_core *core, u32 type)
+{
+	u32 i;
+	const u32 *ssr_type = core->platform->data.msm_vidc_ssr_type;
+	u32 ssr_type_size = core->platform->data.msm_vidc_ssr_type_size;
+
+	for (i = 0; i < ssr_type_size; i++) {
+		if (type == ssr_type[i])
+			return true;
+	}
+	return false;
+}
+
+int msm_vidc_trigger_ssr(struct msm_vidc_core *core,
+		u64 trigger_ssr_val)
+{
+	struct msm_vidc_ssr *ssr;
+
+	ssr = &core->ssr;
+	/*
+	 * <test_addr><sub_client_id><ssr_type>
+	 * ssr_type: 0-3 bits
+	 * sub_client_id: 4-7 bits
+	 * reserved: 8-31 bits
+	 * test_addr: 32-63 bits
+	 */
+	d_vpr_e("%s: trigger ssr is called. trigger ssr val: %#llx\n",
+		__func__, trigger_ssr_val);
+
+	if (!is_ssr_type_allowed(core, trigger_ssr_val)) {
+		d_vpr_h("SSR Type %#llx is not allowed\n", trigger_ssr_val);
+		return 0;
+	}
+
+	ssr->ssr_type = (trigger_ssr_val &
+			(unsigned long)SSR_TYPE) >> SSR_TYPE_SHIFT;
+	ssr->sub_client_id = (trigger_ssr_val &
+			(unsigned long)SSR_SUB_CLIENT_ID) >> SSR_SUB_CLIENT_ID_SHIFT;
+	ssr->test_addr = (trigger_ssr_val &
+			(unsigned long)SSR_ADDR_ID) >> SSR_ADDR_SHIFT;
+	schedule_work(&core->ssr_work);
+	return 0;
+}
+
+void msm_vidc_ssr_handler(struct work_struct *work)
+{
+	int rc;
+	struct msm_vidc_core *core;
+	struct msm_vidc_ssr *ssr;
+
+	core = container_of(work, struct msm_vidc_core, ssr_work);
+	if (!core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, core);
+		return;
+	}
+	ssr = &core->ssr;
+
+	d_vpr_e("%s: ssr handler is called, core state: %s\n",
+		__func__, core_state_name(core->state));
+	core_lock(core, __func__);
+	if (is_core_state(core, MSM_VIDC_CORE_INIT)) {
+		/*
+		 * In current implementation, user-initiated SSR triggers
+		 * a fatal error from hardware. However, there is no way
+		 * to know if fatal error is due to SSR or not. Handle
+		 * user SSR as non-fatal.
+		 */
+		rc = venus_hfi_trigger_ssr(core, ssr->ssr_type,
+			ssr->sub_client_id, ssr->test_addr);
+		if (rc)
+			d_vpr_e("%s: trigger_ssr failed\n", __func__);
+	} else {
+		d_vpr_e("%s: video core not initialized\n", __func__);
+	}
+	core_unlock(core, __func__);
+}
+
+int msm_vidc_trigger_stability(struct msm_vidc_core *core,
+		u64 trigger_stability_val)
+{
+	struct msm_vidc_inst *inst = NULL;
+	struct msm_vidc_stability stability;
+
+	/*
+	 * <payload><sub_client_id><stability_type>
+	 * stability_type: 0-3 bits
+	 * sub_client_id: 4-7 bits
+	 * reserved: 8-31 bits
+	 * payload: 32-63 bits
+	 */
+	memset(&stability, 0, sizeof(struct msm_vidc_stability));
+	stability.stability_type = (trigger_stability_val &
+			(unsigned long)STABILITY_TYPE) >> STABILITY_TYPE_SHIFT;
+	stability.sub_client_id = (trigger_stability_val &
+			(unsigned long)STABILITY_SUB_CLIENT_ID) >> STABILITY_SUB_CLIENT_ID_SHIFT;
+	stability.value = (trigger_stability_val &
+			(unsigned long)STABILITY_PAYLOAD_ID) >> STABILITY_PAYLOAD_SHIFT;
+
+	core_lock(core, __func__);
+	list_for_each_entry(inst, &core->instances, list) {
+		memcpy(&inst->stability, &stability, sizeof(struct msm_vidc_stability));
+		schedule_work(&inst->stability_work);
+	}
+	core_unlock(core, __func__);
+
+	return 0;
+}
+
+void msm_vidc_stability_handler(struct work_struct *work)
+{
+	int rc;
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_stability *stability;
+
+	inst = container_of(work, struct msm_vidc_inst, stability_work);
+	inst = get_inst_ref(g_core, inst);
+	if (!inst) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+
+	inst_lock(inst, __func__);
+	stability = &inst->stability;
+	rc = venus_hfi_trigger_stability(inst, stability->stability_type,
+		stability->sub_client_id, stability->value);
+	if (rc)
+		i_vpr_e(inst, "%s: trigger_stability failed\n", __func__);
+	inst_unlock(inst, __func__);
+
+	put_inst(inst);
+}
+
+int cancel_stability_work_sync(struct msm_vidc_inst *inst)
+{
+	if (!inst) {
+		d_vpr_e("%s: Invalid arguments\n", __func__);
+		return -EINVAL;
+	}
+	cancel_work_sync(&inst->stability_work);
+
+	return 0;
+}
+
+void msm_vidc_fw_unload_handler(struct work_struct *work)
+{
+	struct msm_vidc_core *core = NULL;
+	int rc = 0;
+
+	core = container_of(work, struct msm_vidc_core, fw_unload_work.work);
+	if (!core) {
+		d_vpr_e("%s: invalid work or core handle\n", __func__);
+		return;
+	}
+
+	d_vpr_h("%s: deinitializing video core\n", __func__);
+	rc = msm_vidc_core_deinit(core, false);
+	if (rc)
+		d_vpr_e("%s: Failed to deinit core\n", __func__);
+
+}
+
+void msm_vidc_batch_handler(struct work_struct *work)
+{
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_core *core;
+	int rc = 0;
+
+	inst = container_of(work, struct msm_vidc_inst, decode_batch.work.work);
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+
+	core = inst->core;
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: failled. Session error\n", __func__);
+		goto exit;
+	}
+
+	if (is_core_sub_state(core, CORE_SUBSTATE_PM_SUSPEND)) {
+		i_vpr_h(inst, "%s: device in pm suspend state\n", __func__);
+		goto exit;
+	}
+
+	if (is_state(inst, MSM_VIDC_OPEN) ||
+		is_state(inst, MSM_VIDC_INPUT_STREAMING)) {
+		i_vpr_e(inst, "%s: not allowed in state: %s\n", __func__,
+			state_name(inst->state));
+		goto exit;
+	}
+
+	i_vpr_h(inst, "%s: queue pending batch buffers\n", __func__);
+	rc = msm_vidc_queue_deferred_buffers(inst, MSM_VIDC_BUF_OUTPUT);
+	if (rc) {
+		i_vpr_e(inst, "%s: batch qbufs failed\n", __func__);
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+	}
+
+exit:
+	inst_unlock(inst, __func__);
+	put_inst(inst);
+}
+
+int msm_vidc_flush_buffers(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type type)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf, *dummy;
+	enum msm_vidc_buffer_type buffer_type[2];
+	int i;
+
+	core = inst->core;
+
+	if (is_input_buffer(type)) {
+		buffer_type[0] = MSM_VIDC_BUF_INPUT_META;
+		buffer_type[1] = MSM_VIDC_BUF_INPUT;
+	} else if (is_output_buffer(type)) {
+		buffer_type[0] = MSM_VIDC_BUF_OUTPUT_META;
+		buffer_type[1] = MSM_VIDC_BUF_OUTPUT;
+	} else {
+		i_vpr_h(inst, "%s: invalid buffer type %d\n",
+			__func__, type);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(buffer_type); i++) {
+		buffers = msm_vidc_get_buffers(inst, buffer_type[i], __func__);
+		if (!buffers)
+			return -EINVAL;
+
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+			if (buf->attr & MSM_VIDC_ATTR_QUEUED ||
+				buf->attr & MSM_VIDC_ATTR_DEFERRED) {
+				print_vidc_buffer(VIDC_HIGH, "high", "flushing buffer", inst, buf);
+				if (!(buf->attr & MSM_VIDC_ATTR_BUFFER_DONE)) {
+					if (is_decode_session(inst) &&
+					    is_output_buffer(buf->type)) {
+						if (buf->dbuf_get) {
+							call_mem_op(core, dma_buf_put,
+								    inst, buf->dmabuf);
+							buf->dbuf_get = 0;
+						}
+					}
+					buf->data_size = 0;
+					msm_vidc_vb2_buffer_done(inst, buf);
+				}
+			}
+		}
+	}
+
+	return rc;
+}
+
+int msm_vidc_flush_read_only_buffers(struct msm_vidc_inst *inst,
+		enum msm_vidc_buffer_type type)
+{
+	int rc = 0;
+	struct msm_vidc_buffer *ro_buf, *dummy;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	if (!is_decode_session(inst) || !is_output_buffer(type))
+		return 0;
+
+	list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+		if (ro_buf->attr & MSM_VIDC_ATTR_READ_ONLY)
+			continue;
+		print_vidc_buffer(VIDC_ERR, "high", "flush ro buf", inst, ro_buf);
+		if (ro_buf->attach && ro_buf->sg_table)
+			call_mem_op(core, dma_buf_unmap_attachment, core,
+				ro_buf->attach, ro_buf->sg_table);
+		if (ro_buf->attach && ro_buf->dmabuf)
+			call_mem_op(core, dma_buf_detach, core,
+				ro_buf->dmabuf, ro_buf->attach);
+		if (ro_buf->dbuf_get)
+			call_mem_op(core, dma_buf_put, inst, ro_buf->dmabuf);
+		ro_buf->attach = NULL;
+		ro_buf->sg_table = NULL;
+		ro_buf->dmabuf = NULL;
+		ro_buf->dbuf_get = 0;
+		ro_buf->kvaddr = NULL;
+		ro_buf->device_addr = 0x0;
+		ro_buf->handler.put = NULL;
+		ro_buf->handler.arg = NULL;
+		list_del_init(&ro_buf->list);
+		msm_vidc_pool_free(inst, ro_buf);
+	}
+
+	return rc;
+}
+
+void msm_vidc_destroy_buffers(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf, *dummy;
+	struct msm_vidc_timestamp *ts, *dummy_ts;
+	struct msm_memory_dmabuf *dbuf, *dummy_dbuf;
+	struct msm_vidc_input_timer *timer, *dummy_timer;
+	struct msm_vidc_buffer_stats *stats, *dummy_stats;
+	struct msm_vidc_inst_cap_entry *entry, *dummy_entry;
+	struct msm_vidc_input_cr_data *cr, *dummy_cr;
+	struct msm_vidc_fence *fence, *dummy_fence;
+	struct msm_vidc_core *core;
+
+	static const enum msm_vidc_buffer_type ext_buf_types[] = {
+		MSM_VIDC_BUF_INPUT,
+		MSM_VIDC_BUF_OUTPUT,
+		MSM_VIDC_BUF_INPUT_META,
+		MSM_VIDC_BUF_OUTPUT_META,
+	};
+	static const enum msm_vidc_buffer_type internal_buf_types[] = {
+		MSM_VIDC_BUF_BIN,
+		MSM_VIDC_BUF_ARP,
+		MSM_VIDC_BUF_COMV,
+		MSM_VIDC_BUF_NON_COMV,
+		MSM_VIDC_BUF_LINE,
+		MSM_VIDC_BUF_DPB,
+		MSM_VIDC_BUF_PERSIST,
+		MSM_VIDC_BUF_VPSS,
+		MSM_VIDC_BUF_PARTIAL_DATA,
+	};
+	int i;
+
+	core = inst->core;
+
+	for (i = 0; i < ARRAY_SIZE(internal_buf_types); i++) {
+		buffers = msm_vidc_get_buffers(inst, internal_buf_types[i], __func__);
+		if (!buffers)
+			continue;
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+			i_vpr_h(inst,
+				"destroying internal buffer: type %d idx %d fd %d addr %#llx size %d\n",
+				buf->type, buf->index, buf->fd, buf->device_addr, buf->buffer_size);
+			msm_vidc_destroy_internal_buffer(inst, buf);
+		}
+	}
+
+	/*
+	 * read_only list does not take dma ref_count using dma_buf_get().
+	 * dma_buf ptr will be obselete when its ref_count reaches zero.
+	 * Hence printthe dma_buf info before releasing the ref count.
+	 */
+	list_for_each_entry_safe(buf, dummy, &inst->buffers.read_only.list, list) {
+		print_vidc_buffer(VIDC_ERR, "err ", "destroying ro buf", inst, buf);
+		if (buf->attach && buf->sg_table)
+			call_mem_op(core, dma_buf_unmap_attachment, core,
+				buf->attach, buf->sg_table);
+		if (buf->attach && buf->dmabuf)
+			call_mem_op(core, dma_buf_detach, core, buf->dmabuf, buf->attach);
+		if (buf->kvaddr && buf->device_addr && refcount_read(&buf->refcount) > 0)
+			i_vpr_e(inst, "%s: destroying ro buffer with Non-Zero refcount %d, daddr 0x%llx\n",
+					__func__, refcount_read(&buf->refcount), buf->device_addr);
+		if (buf->dbuf_get)
+			call_mem_op(core, dma_buf_put, inst, buf->dmabuf);
+		list_del_init(&buf->list);
+		msm_vidc_pool_free(inst, buf);
+	}
+
+	for (i = 0; i < ARRAY_SIZE(ext_buf_types); i++) {
+		buffers = msm_vidc_get_buffers(inst, ext_buf_types[i], __func__);
+		if (!buffers)
+			continue;
+
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+			if (buf->attach && buf->sg_table)
+				call_mem_op(core, dma_buf_unmap_attachment, core,
+					buf->attach, buf->sg_table);
+			if (buf->attach && buf->dmabuf)
+				call_mem_op(core, dma_buf_detach, core, buf->dmabuf, buf->attach);
+			if (buf->kvaddr && buf->device_addr && refcount_read(&buf->refcount) > 0)
+				i_vpr_e(inst, "%s: destroying ext buffer with Non-Zero refcount %d, daddr 0x%llx\n",
+						__func__, refcount_read(&buf->refcount), buf->device_addr);
+			if (buf->dbuf_get) {
+				print_vidc_buffer(VIDC_ERR, "err ", "destroying: put dmabuf",
+						  inst, buf);
+				call_mem_op(core, dma_buf_put, inst, buf->dmabuf);
+			}
+			list_del_init(&buf->list);
+			msm_vidc_pool_free(inst, buf);
+		}
+	}
+
+	list_for_each_entry_safe(ts, dummy_ts, &inst->timestamps.list, sort.list) {
+		i_vpr_e(inst, "%s: removing ts: val %lld, rank %lld\n",
+			__func__, ts->sort.val, ts->rank);
+		list_del(&ts->sort.list);
+		msm_vidc_pool_free(inst, ts);
+	}
+
+	list_for_each_entry_safe(ts, dummy_ts, &inst->ts_reorder.list, sort.list) {
+		i_vpr_e(inst, "%s: removing reorder ts: val %lld\n",
+			__func__, ts->sort.val);
+		list_del(&ts->sort.list);
+		msm_vidc_pool_free(inst, ts);
+	}
+
+	list_for_each_entry_safe(timer, dummy_timer, &inst->input_timer_list, list) {
+		i_vpr_e(inst, "%s: removing input_timer %lld\n",
+			__func__, timer->time_us);
+		list_del(&timer->list);
+		msm_vidc_pool_free(inst, timer);
+	}
+
+	list_for_each_entry_safe(stats, dummy_stats, &inst->buffer_stats_list, list) {
+		print_buffer_stats(VIDC_ERR, "err ", inst, stats);
+		list_del(&stats->list);
+		msm_vidc_pool_free(inst, stats);
+	}
+
+	list_for_each_entry_safe(dbuf, dummy_dbuf, &inst->dmabuf_tracker, list) {
+		struct dma_buf *dmabuf;
+		struct inode *f_inode;
+		unsigned long inode_num = 0;
+
+		dmabuf = dbuf->dmabuf;
+		if (dmabuf && dmabuf->file) {
+			f_inode = file_inode(dmabuf->file);
+			if (f_inode)
+				inode_num = f_inode->i_ino;
+		}
+		i_vpr_e(inst, "%s: removing dma_buf %p, inode %lu, refcount %u\n",
+			__func__, dbuf->dmabuf, inode_num, dbuf->refcount);
+		call_mem_op(core, dma_buf_put_completely, inst, dbuf);
+	}
+
+	list_for_each_entry_safe(entry, dummy_entry, &inst->firmware_list, list) {
+		i_vpr_e(inst, "%s: fw list: %s\n", __func__, cap_name(entry->cap_id));
+		list_del(&entry->list);
+		vfree(entry);
+	}
+
+	list_for_each_entry_safe(entry, dummy_entry, &inst->children_list, list) {
+		i_vpr_e(inst, "%s: child list: %s\n", __func__, cap_name(entry->cap_id));
+		list_del(&entry->list);
+		vfree(entry);
+	}
+
+	list_for_each_entry_safe(entry, dummy_entry, &inst->caps_list, list) {
+		list_del(&entry->list);
+		vfree(entry);
+	}
+
+	list_for_each_entry_safe(cr, dummy_cr, &inst->enc_input_crs, list) {
+		list_del(&cr->list);
+		vfree(cr);
+	}
+
+	list_for_each_entry_safe(fence, dummy_fence, &inst->fence_list, list) {
+		i_vpr_e(inst, "%s: destroying fence %s\n", __func__, fence->name);
+		call_fence_op(core, fence_destroy, inst, fence->fence_id);
+	}
+
+	/* destroy buffers from pool */
+	msm_vidc_pools_deinit(inst);
+}
+
+static void msm_vidc_close_helper(struct kref *kref)
+{
+	struct msm_vidc_inst *inst = container_of(kref,
+		struct msm_vidc_inst, kref);
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	i_vpr_h(inst, "%s()\n", __func__);
+	msm_vidc_debugfs_deinit_inst(inst);
+	msm_vidc_fence_deinit(inst);
+	if (is_decode_session(inst))
+		msm_vdec_inst_deinit(inst);
+	else if (is_encode_session(inst))
+		msm_venc_inst_deinit(inst);
+	/**
+	 * Lock is not necessay here, but in force close case,
+	 * vb2q_deinit() will attempt to call stop_streaming()
+	 * vb2 callback and i.e expecting inst lock to be taken.
+	 * So acquire lock before calling vb2q_deinit.
+	 */
+	inst_lock(inst, __func__);
+	msm_vidc_vb2_queue_deinit(inst);
+	msm_vidc_v4l2_fh_deinit(inst);
+	inst_unlock(inst, __func__);
+	destroy_workqueue(inst->workq);
+	msm_vidc_destroy_buffers(inst);
+	msm_vidc_remove_session(inst);
+	msm_vidc_remove_dangling_session(inst);
+	mutex_destroy(&inst->client_lock);
+	mutex_destroy(&inst->ctx_q_lock);
+	mutex_destroy(&inst->lock);
+	vfree(inst);
+}
+
+struct msm_vidc_inst *get_inst_ref(struct msm_vidc_core *core,
+		struct msm_vidc_inst *instance)
+{
+	struct msm_vidc_inst *inst = NULL;
+	bool matches = false;
+
+	mutex_lock(&core->lock);
+	list_for_each_entry(inst, &core->instances, list) {
+		if (inst == instance) {
+			matches = true;
+			break;
+		}
+	}
+	inst = (matches && kref_get_unless_zero(&inst->kref)) ? inst : NULL;
+	mutex_unlock(&core->lock);
+	return inst;
+}
+
+struct msm_vidc_inst *get_inst(struct msm_vidc_core *core,
+		u32 session_id)
+{
+	struct msm_vidc_inst *inst = NULL;
+	bool matches = false;
+
+	mutex_lock(&core->lock);
+	list_for_each_entry(inst, &core->instances, list) {
+		if (inst->session_id == session_id) {
+			matches = true;
+			break;
+		}
+	}
+	inst = (matches && kref_get_unless_zero(&inst->kref)) ? inst : NULL;
+	mutex_unlock(&core->lock);
+	return inst;
+}
+
+void put_inst(struct msm_vidc_inst *inst)
+{
+	kref_put(&inst->kref, msm_vidc_close_helper);
+}
+
+void core_lock(struct msm_vidc_core *core, const char *function)
+{
+	mutex_lock(&core->lock);
+}
+
+void core_unlock(struct msm_vidc_core *core, const char *function)
+{
+	mutex_unlock(&core->lock);
+}
+
+void inst_lock(struct msm_vidc_inst *inst, const char *function)
+{
+	mutex_lock(&inst->lock);
+}
+
+void inst_unlock(struct msm_vidc_inst *inst, const char *function)
+{
+	mutex_unlock(&inst->lock);
+}
+
+void client_lock(struct msm_vidc_inst *inst, const char *function)
+{
+	mutex_lock(&inst->client_lock);
+}
+
+void client_unlock(struct msm_vidc_inst *inst, const char *function)
+{
+	mutex_unlock(&inst->client_lock);
+}
+
+int msm_vidc_update_bitstream_buffer_size(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	struct v4l2_format *fmt;
+
+	core = inst->core;
+
+	if (is_decode_session(inst)) {
+		fmt = &inst->fmts[INPUT_PORT];
+		fmt->fmt.pix_mp.plane_fmt[0].sizeimage = call_session_op(core,
+			buffer_size, inst, MSM_VIDC_BUF_INPUT);
+	}
+
+	return 0;
+}
+
+int msm_vidc_update_meta_port_settings(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	struct v4l2_format *fmt;
+
+	core = inst->core;
+
+	fmt = &inst->fmts[INPUT_META_PORT];
+	fmt->fmt.meta.buffersize = call_session_op(core,
+		buffer_size, inst, MSM_VIDC_BUF_INPUT_META);
+	inst->buffers.input_meta.min_count =
+			inst->buffers.input.min_count;
+	inst->buffers.input_meta.extra_count =
+			inst->buffers.input.extra_count;
+	inst->buffers.input_meta.actual_count =
+			inst->buffers.input.actual_count;
+	inst->buffers.input_meta.size = fmt->fmt.meta.buffersize;
+
+	fmt = &inst->fmts[OUTPUT_META_PORT];
+	fmt->fmt.meta.buffersize = call_session_op(core,
+		buffer_size, inst, MSM_VIDC_BUF_OUTPUT_META);
+	inst->buffers.output_meta.min_count =
+			inst->buffers.output.min_count;
+	inst->buffers.output_meta.extra_count =
+			inst->buffers.output.extra_count;
+	inst->buffers.output_meta.actual_count =
+			inst->buffers.output.actual_count;
+	inst->buffers.output_meta.size = fmt->fmt.meta.buffersize;
+	return 0;
+}
+
+int msm_vidc_update_buffer_count(struct msm_vidc_inst *inst, u32 port)
+{
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	switch (port) {
+	case INPUT_PORT:
+		inst->buffers.input.min_count = call_session_op(core,
+			min_count, inst, MSM_VIDC_BUF_INPUT);
+		inst->buffers.input.extra_count = call_session_op(core,
+			extra_count, inst, MSM_VIDC_BUF_INPUT);
+		if (inst->buffers.input.actual_count <
+			inst->buffers.input.min_count +
+			inst->buffers.input.extra_count) {
+			inst->buffers.input.actual_count =
+				inst->buffers.input.min_count +
+				inst->buffers.input.extra_count;
+		}
+		if (is_input_meta_enabled(inst)) {
+			inst->buffers.input_meta.min_count =
+					inst->buffers.input.min_count;
+			inst->buffers.input_meta.extra_count =
+					inst->buffers.input.extra_count;
+			inst->buffers.input_meta.actual_count =
+					inst->buffers.input.actual_count;
+		} else {
+			inst->buffers.input_meta.min_count = 0;
+			inst->buffers.input_meta.extra_count = 0;
+			inst->buffers.input_meta.actual_count = 0;
+		}
+		i_vpr_h(inst, "%s: type:  INPUT, count: min %u, extra %u, actual %u\n", __func__,
+			inst->buffers.input.min_count,
+			inst->buffers.input.extra_count,
+			inst->buffers.input.actual_count);
+		break;
+	case OUTPUT_PORT:
+		if (!inst->bufq[INPUT_PORT].vb2q->streaming)
+			inst->buffers.output.min_count = call_session_op(core,
+				min_count, inst, MSM_VIDC_BUF_OUTPUT);
+		inst->buffers.output.extra_count = call_session_op(core,
+			extra_count, inst, MSM_VIDC_BUF_OUTPUT);
+		if (inst->buffers.output.actual_count <
+			inst->buffers.output.min_count +
+			inst->buffers.output.extra_count) {
+			inst->buffers.output.actual_count =
+				inst->buffers.output.min_count +
+				inst->buffers.output.extra_count;
+		}
+		if (is_output_meta_enabled(inst)) {
+			inst->buffers.output_meta.min_count =
+					inst->buffers.output.min_count;
+			inst->buffers.output_meta.extra_count =
+					inst->buffers.output.extra_count;
+			inst->buffers.output_meta.actual_count =
+					inst->buffers.output.actual_count;
+		} else {
+			inst->buffers.output_meta.min_count = 0;
+			inst->buffers.output_meta.extra_count = 0;
+			inst->buffers.output_meta.actual_count = 0;
+		}
+		i_vpr_h(inst, "%s: type: OUTPUT, count: min %u, extra %u, actual %u\n", __func__,
+			inst->buffers.output.min_count,
+			inst->buffers.output.extra_count,
+			inst->buffers.output.actual_count);
+		break;
+	default:
+		d_vpr_e("%s unknown port %d\n", __func__, port);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+void msm_vidc_schedule_core_deinit(struct msm_vidc_core *core)
+{
+	if (!core->capabilities[FW_UNLOAD].value)
+		return;
+
+	cancel_delayed_work(&core->fw_unload_work);
+
+	schedule_delayed_work(&core->fw_unload_work,
+		msecs_to_jiffies(core->capabilities[FW_UNLOAD_DELAY].value));
+
+	d_vpr_h("firmware unload delayed by %u ms\n",
+		core->capabilities[FW_UNLOAD_DELAY].value);
+
+	return;
+}
+
+static const char *get_codec_str(enum msm_vidc_codec_type type)
+{
+	switch (type) {
+	case MSM_VIDC_H264: return " avc";
+	case MSM_VIDC_HEVC: return "hevc";
+	case MSM_VIDC_VP9:  return " vp9";
+	case MSM_VIDC_AV1:  return " av1";
+	case MSM_VIDC_HEIC: return "heic";
+	}
+
+	return "....";
+}
+
+static const char *get_domain_str(enum msm_vidc_domain_type type)
+{
+	switch (type) {
+	case MSM_VIDC_ENCODER: return "E";
+	case MSM_VIDC_DECODER: return "D";
+	}
+
+	return ".";
+}
+
+int msm_vidc_update_debug_str(struct msm_vidc_inst *inst)
+{
+	u32 sid;
+	int client_id = INVALID_CLIENT_ID;
+	const char *codec;
+	const char *domain;
+
+	if (!inst) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	client_id = inst->capabilities[CLIENT_ID].value;
+
+	sid = inst->session_id;
+	codec = get_codec_str(inst->codec);
+	domain = get_domain_str(inst->domain);
+	if (client_id != INVALID_CLIENT_ID) {
+		snprintf(inst->debug_str, sizeof(inst->debug_str), "%08x: %s%s_%d",
+			sid, codec, domain, client_id);
+	} else {
+		snprintf(inst->debug_str, sizeof(inst->debug_str), "%08x: %s%s",
+			sid, codec, domain);
+	}
+	d_vpr_h("%s: sid: %08x, codec: %s, domain: %s, final: %s\n",
+		__func__, sid, codec, domain, inst->debug_str);
+
+	return 0;
+}
+
+static int msm_vidc_print_running_instances_info(struct msm_vidc_core *core)
+{
+	struct msm_vidc_inst *inst;
+	u32 height, width, fps, orate;
+	struct msm_vidc_inst_cap *cap;
+	struct v4l2_format *out_f;
+	struct v4l2_format *inp_f;
+	char prop[64];
+
+	d_vpr_e("Print all running instances\n");
+	d_vpr_e("%6s | %6s | %5s | %5s | %5s\n", "width", "height", "fps", "orate", "prop");
+
+	core_lock(core, __func__);
+	list_for_each_entry(inst, &core->instances, list) {
+		out_f = &inst->fmts[OUTPUT_PORT];
+		inp_f = &inst->fmts[INPUT_PORT];
+		cap = &inst->capabilities[0];
+		memset(&prop, 0, sizeof(prop));
+
+		width = max(out_f->fmt.pix_mp.width, inp_f->fmt.pix_mp.width);
+		height = max(out_f->fmt.pix_mp.height, inp_f->fmt.pix_mp.height);
+		fps = cap[FRAME_RATE].value >> 16;
+		orate = cap[OPERATING_RATE].value >> 16;
+
+		if (is_realtime_session(inst))
+			strlcat(prop, "RT ", sizeof(prop));
+		else
+			strlcat(prop, "NRT", sizeof(prop));
+
+		if (is_thumbnail_session(inst))
+			strlcat(prop, "+THUMB", sizeof(prop));
+
+		if (is_image_session(inst))
+			strlcat(prop, "+IMAGE", sizeof(prop));
+
+		i_vpr_e(inst, "%6u | %6u | %5u | %5u | %5s\n", width, height, fps, orate, prop);
+	}
+	core_unlock(core, __func__);
+
+	return 0;
+}
+
+static int msm_vidc_get_inst_load(struct msm_vidc_inst *inst)
+{
+	u32 mbpf, fps;
+	u32 input_rate, timestamp_rate, operating_rate;
+
+	if (!inst) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	/*
+	 * Encoder: consider frame rate
+	 * Decoder: consider max(frame rate, operating rate,
+	 *          timestamp rate, input queue rate)
+	 */
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	fps = msm_vidc_get_frame_rate(inst);
+
+	if (is_decode_session(inst)) {
+		input_rate = msm_vidc_get_input_rate(inst);
+		timestamp_rate = msm_vidc_get_timestamp_rate(inst);
+		operating_rate = msm_vidc_get_operating_rate(inst);
+		fps = max(fps, operating_rate);
+		fps = max(fps, input_rate);
+		fps = max(fps, timestamp_rate);
+	}
+
+	return mbpf * fps;
+}
+
+static bool msm_vidc_ignore_session_load(struct msm_vidc_inst *inst)
+{
+	if (!is_realtime_session(inst) || is_thumbnail_session(inst) ||
+		is_image_session(inst) || is_session_error(inst))
+		return true;
+
+	return false;
+}
+
+int msm_vidc_check_core_mbps(struct msm_vidc_inst *inst)
+{
+	u64 mbps = 0, total_mbps = 0, enc_mbps = 0, critical_mbps = 0;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *instance;
+
+	core = inst->core;
+
+	/* skip mbps check for non-realtime, thumnail, image sessions */
+	if (msm_vidc_ignore_session_load(inst)) {
+		i_vpr_h(inst,
+			"%s: skip mbps check due to NRT %d, TH %d, IMG %d, error session %d\n",
+			__func__, !is_realtime_session(inst), is_thumbnail_session(inst),
+			is_image_session(inst), is_session_error(inst));
+		return 0;
+	}
+
+	core_lock(core, __func__);
+	list_for_each_entry(instance, &core->instances, list) {
+		if (is_critical_priority_session(instance))
+			critical_mbps += msm_vidc_get_inst_load(instance);
+	}
+	core_unlock(core, __func__);
+
+	if (critical_mbps > core->capabilities[MAX_MBPS].value) {
+		i_vpr_e(inst, "%s: Hardware overloaded with critical sessions. needed %llu, max %u",
+			__func__, critical_mbps, core->capabilities[MAX_MBPS].value);
+		return -ENOMEM;
+	}
+
+	core_lock(core, __func__);
+	list_for_each_entry(instance, &core->instances, list) {
+
+		/* ignore thumbnail, image, non realtime, error sessions */
+		if (msm_vidc_ignore_session_load(instance))
+			continue;
+
+		mbps = msm_vidc_get_inst_load(instance);
+		total_mbps += mbps;
+		if (is_encode_session(instance))
+			enc_mbps += mbps;
+	}
+	core_unlock(core, __func__);
+
+	if (is_encode_session(inst)) {
+		/* reject encoder if all encoders mbps is greater than MAX_MBPS */
+		if (enc_mbps > core->capabilities[MAX_MBPS].value) {
+			i_vpr_e(inst, "%s: Hardware overloaded. needed %llu, max %u", __func__,
+				mbps, core->capabilities[MAX_MBPS].value);
+			return -ENOMEM;
+		}
+		/*
+		 * if total_mbps is greater than max_mbps then reduce all decoders
+		 * priority by 1 to allow this encoder
+		 */
+		if (total_mbps > core->capabilities[MAX_MBPS].value) {
+			core_lock(core, __func__);
+			list_for_each_entry(instance, &core->instances, list) {
+				/* reduce realtime decode sessions priority */
+				if (is_decode_session(instance) && is_realtime_session(instance)) {
+					instance->adjust_priority = RT_DEC_DOWN_PRORITY_OFFSET;
+					i_vpr_h(inst, "%s: pending adjust priority by %d\n",
+						__func__, instance->adjust_priority);
+				}
+			}
+			core_unlock(core, __func__);
+		}
+	} else if (is_decode_session(inst)) {
+		/*
+		 * if total_mbps is greater than max_mbps then allow this
+		 * decoder by reducing its piority (moving it to NRT)
+		 */
+		if (total_mbps > core->capabilities[MAX_MBPS].value) {
+			inst->adjust_priority = RT_DEC_DOWN_PRORITY_OFFSET;
+			i_vpr_h(inst, "%s: pending adjust priority by %d\n",
+				__func__, inst->adjust_priority);
+		}
+	}
+
+	i_vpr_h(inst, "%s: HW load needed %llu is within max %u", __func__,
+			total_mbps, core->capabilities[MAX_MBPS].value);
+
+	return 0;
+}
+
+int msm_vidc_check_core_mbpf(struct msm_vidc_inst *inst)
+{
+	u32 video_mbpf = 0, image_mbpf = 0, video_rt_mbpf = 0;
+	u32 critical_mbpf = 0;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *instance;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	list_for_each_entry(instance, &core->instances, list) {
+		if (is_critical_priority_session(instance))
+			critical_mbpf += msm_vidc_get_mbs_per_frame(instance);
+	}
+	core_unlock(core, __func__);
+
+	if (critical_mbpf > core->capabilities[MAX_MBPF].value) {
+		i_vpr_e(inst, "%s: Hardware overloaded with critical sessions. needed %u, max %u",
+			__func__, critical_mbpf, core->capabilities[MAX_MBPF].value);
+		return -ENOMEM;
+	}
+
+	core_lock(core, __func__);
+	list_for_each_entry(instance, &core->instances, list) {
+		/* ignore thumbnail session */
+		if (is_thumbnail_session(instance))
+			continue;
+
+		if (is_image_session(instance))
+			image_mbpf += msm_vidc_get_mbs_per_frame(instance);
+		else
+			video_mbpf += msm_vidc_get_mbs_per_frame(instance);
+	}
+	core_unlock(core, __func__);
+
+	if (video_mbpf > core->capabilities[MAX_MBPF].value) {
+		i_vpr_e(inst, "%s: video overloaded. needed %u, max %u", __func__,
+			video_mbpf, core->capabilities[MAX_MBPF].value);
+		return -ENOMEM;
+	}
+
+	if (image_mbpf > core->capabilities[MAX_IMAGE_MBPF].value) {
+		i_vpr_e(inst, "%s: image overloaded. needed %u, max %u", __func__,
+			image_mbpf, core->capabilities[MAX_IMAGE_MBPF].value);
+		return -ENOMEM;
+	}
+
+	core_lock(core, __func__);
+	/* check real-time video sessions max limit */
+	list_for_each_entry(instance, &core->instances, list) {
+		if (msm_vidc_ignore_session_load(instance))
+			continue;
+
+		video_rt_mbpf += msm_vidc_get_mbs_per_frame(instance);
+	}
+	core_unlock(core, __func__);
+
+	if (video_rt_mbpf > core->capabilities[MAX_RT_MBPF].value) {
+		i_vpr_e(inst, "%s: real-time video overloaded. needed %u, max %u",
+			__func__, video_rt_mbpf, core->capabilities[MAX_RT_MBPF].value);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+static int msm_vidc_check_inst_mbpf(struct msm_vidc_inst *inst)
+{
+	u32 mbpf = 0, max_mbpf = 0;
+	struct msm_vidc_inst_cap *cap;
+
+	cap = &inst->capabilities[0];
+
+	if (is_secure_session(inst))
+		max_mbpf = cap[SECURE_MBPF].max;
+	else if (is_encode_session(inst) && cap[LOSSLESS].value)
+		max_mbpf = cap[LOSSLESS_MBPF].max;
+	else
+		max_mbpf = cap[MBPF].max;
+
+	/* check current session mbpf */
+	mbpf = msm_vidc_get_mbs_per_frame(inst);
+	if (mbpf > max_mbpf) {
+		i_vpr_e(inst, "%s: session overloaded. needed %u, max %u", __func__,
+			mbpf, max_mbpf);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+u32 msm_vidc_get_max_bitrate(struct msm_vidc_inst *inst)
+{
+	u32 max_bitrate = 0x7fffffff;
+
+	if (inst->capabilities[LOWLATENCY_MODE].value)
+		max_bitrate = min(max_bitrate,
+			(u32)inst->capabilities[LOWLATENCY_MAX_BITRATE].max);
+
+	if (inst->capabilities[ALL_INTRA].value)
+		max_bitrate = min(max_bitrate,
+			(u32)inst->capabilities[ALLINTRA_MAX_BITRATE].max);
+
+	if (inst->codec == MSM_VIDC_HEVC) {
+		max_bitrate = min(max_bitrate,
+			(u32)inst->capabilities[CABAC_MAX_BITRATE].max);
+	} else if (inst->codec == MSM_VIDC_H264) {
+		if (inst->capabilities[ENTROPY_MODE].value ==
+			V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC)
+			max_bitrate = min(max_bitrate,
+				(u32)inst->capabilities[CAVLC_MAX_BITRATE].max);
+		else
+			max_bitrate = min(max_bitrate,
+				(u32)inst->capabilities[CABAC_MAX_BITRATE].max);
+	}
+	if (max_bitrate == 0x7fffffff || !max_bitrate)
+		max_bitrate = min(max_bitrate, (u32)inst->capabilities[BIT_RATE].max);
+
+	return max_bitrate;
+}
+
+static bool msm_vidc_allow_image_encode_session(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_inst_cap *cap;
+	struct v4l2_format *fmt;
+	u32 min_width, min_height, max_width, max_height, pix_fmt, profile;
+	bool allow = false;
+
+	cap = &inst->capabilities[0];
+
+	if (!is_image_encode_session(inst)) {
+		i_vpr_e(inst, "%s: not an image encode session\n", __func__);
+		return false;
+	}
+
+	pix_fmt = cap[PIX_FMTS].value;
+	profile = cap[PROFILE].value;
+
+	/* is input with & height is in allowed range */
+	min_width = cap[FRAME_WIDTH].min;
+	max_width = cap[FRAME_WIDTH].max;
+	min_height = cap[FRAME_HEIGHT].min;
+	max_height = cap[FRAME_HEIGHT].max;
+	fmt = &inst->fmts[INPUT_PORT];
+	if (!check_in_range(fmt->fmt.pix_mp.width, min_width, max_width) ||
+		!check_in_range(fmt->fmt.pix_mp.height, min_height, max_height)) {
+		i_vpr_e(inst, "unsupported wxh [%u x %u], allowed [%u x %u] to [%u x %u]\n",
+			fmt->fmt.pix_mp.width, fmt->fmt.pix_mp.height,
+			min_width, min_height, max_width, max_height);
+		allow = false;
+		goto exit;
+	}
+
+	/* is linear yuv color fmt */
+	allow = is_linear_yuv_colorformat(pix_fmt);
+	if (!allow) {
+		i_vpr_e(inst, "%s: compressed fmt: %#x\n", __func__, pix_fmt);
+		goto exit;
+	}
+
+	/* is output grid dimension */
+	fmt = &inst->fmts[OUTPUT_PORT];
+	allow = fmt->fmt.pix_mp.width == cap[GRID_SIZE].value;
+	allow &= fmt->fmt.pix_mp.height == cap[GRID_SIZE].value;
+	if (!allow) {
+		i_vpr_e(inst, "%s: output is not a grid dimension: %u x %u\n", __func__,
+			fmt->fmt.pix_mp.width, fmt->fmt.pix_mp.height);
+		goto exit;
+	}
+
+	/* is bitrate mode CQ */
+	allow = cap[BITRATE_MODE].value == V4L2_MPEG_VIDEO_BITRATE_MODE_CQ;
+	if (!allow) {
+		i_vpr_e(inst, "%s: bitrate mode is not CQ: %#x\n", __func__,
+			cap[BITRATE_MODE].value);
+		goto exit;
+	}
+
+	/* is all intra */
+	allow = !cap[GOP_SIZE].value;
+	allow &= !cap[B_FRAME].value;
+	if (!allow) {
+		i_vpr_e(inst, "%s: not all intra: gop: %u, bframe: %u\n", __func__,
+			cap[GOP_SIZE].value, cap[B_FRAME].value);
+		goto exit;
+	}
+
+	/* is time delta based rc disabled */
+	allow = !cap[TIME_DELTA_BASED_RC].value;
+	if (!allow) {
+		i_vpr_e(inst, "%s: time delta based rc not disabled: %#x\n", __func__,
+			cap[TIME_DELTA_BASED_RC].value);
+		goto exit;
+	}
+
+	/* is frame skip mode disabled */
+	allow = !cap[FRAME_SKIP_MODE].value;
+	if (!allow) {
+		i_vpr_e(inst, "%s: frame skip mode not disabled: %#x\n", __func__,
+			cap[FRAME_SKIP_MODE].value);
+		goto exit;
+	}
+
+exit:
+	if (!allow)
+		i_vpr_e(inst, "%s: current session not allowed\n", __func__);
+
+	return allow;
+}
+
+static int msm_vidc_check_resolution_supported(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_inst_cap *cap;
+	u32 width = 0, height = 0, min_width, min_height,
+		max_width, max_height;
+	bool is_interlaced = false;
+
+	cap = &inst->capabilities[0];
+
+	if (is_decode_session(inst)) {
+		width = inst->fmts[INPUT_PORT].fmt.pix_mp.width;
+		height = inst->fmts[INPUT_PORT].fmt.pix_mp.height;
+	} else if (is_encode_session(inst)) {
+		width = inst->crop.width;
+		height = inst->crop.height;
+	}
+
+	if (is_secure_session(inst)) {
+		min_width = cap[SECURE_FRAME_WIDTH].min;
+		max_width = cap[SECURE_FRAME_WIDTH].max;
+		min_height = cap[SECURE_FRAME_HEIGHT].min;
+		max_height = cap[SECURE_FRAME_HEIGHT].max;
+	} else if (is_encode_session(inst) && cap[LOSSLESS].value) {
+		min_width = cap[LOSSLESS_FRAME_WIDTH].min;
+		max_width = cap[LOSSLESS_FRAME_WIDTH].max;
+		min_height = cap[LOSSLESS_FRAME_HEIGHT].min;
+		max_height = cap[LOSSLESS_FRAME_HEIGHT].max;
+	} else {
+		min_width = cap[FRAME_WIDTH].min;
+		max_width = cap[FRAME_WIDTH].max;
+		min_height = cap[FRAME_HEIGHT].min;
+		max_height = cap[FRAME_HEIGHT].max;
+	}
+
+	/* check if input width and height is in supported range */
+	if (is_decode_session(inst) || is_encode_session(inst)) {
+		if (!check_in_range(width, min_width, max_width) ||
+			!check_in_range(height, min_height, max_height)) {
+			i_vpr_e(inst,
+				"%s: unsupported input wxh [%u x %u], allowed range: [%u x %u] to [%u x %u]\n",
+				__func__, width, height, min_width,
+				min_height, max_width, max_height);
+			return -EINVAL;
+		}
+	}
+
+	/* check interlace supported resolution */
+	is_interlaced = cap[CODED_FRAMES].value == CODED_FRAMES_INTERLACE;
+	if (is_interlaced && (width > INTERLACE_WIDTH_MAX || height > INTERLACE_HEIGHT_MAX ||
+		NUM_MBS_PER_FRAME(width, height) > INTERLACE_MB_PER_FRAME_MAX)) {
+		i_vpr_e(inst, "%s: unsupported interlace wxh [%u x %u], max [%u x %u]\n",
+			__func__, width, height, INTERLACE_WIDTH_MAX, INTERLACE_HEIGHT_MAX);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int msm_vidc_check_max_sessions(struct msm_vidc_inst *inst)
+{
+	u32 width = 0, height = 0;
+	u32 num_1080p_sessions = 0, num_4k_sessions = 0, num_8k_sessions = 0;
+	struct msm_vidc_inst *i;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	list_for_each_entry(i, &core->instances, list) {
+		/* skip image sessions count */
+		if (is_image_session(i))
+			continue;
+
+		if (is_decode_session(i)) {
+			width = i->fmts[INPUT_PORT].fmt.pix_mp.width;
+			height = i->fmts[INPUT_PORT].fmt.pix_mp.height;
+		} else if (is_encode_session(i)) {
+			width = i->crop.width;
+			height = i->crop.height;
+		}
+
+		/*
+		 * one 8k session equals to 64 720p sessions in reality.
+		 * So for one 8k session the number of 720p sessions will
+		 * exceed max supported session count(16), hence one 8k session
+		 * will be rejected as well.
+		 * Therefore, treat one 8k session equal to two 4k sessions and
+		 * one 4k session equal to two 1080p sessions and
+		 * one 1080p session equal to two 720p sessions. This equation
+		 * will make one 8k session equal to eight 720p sessions
+		 * which looks good.
+		 *
+		 * Do not treat resolutions above 4k as 8k session instead
+		 * treat (4K + half 4k) above as 8k session
+		 */
+		if (res_is_greater_than(width, height, 4096 + (4096 >> 1), 2176 + (2176 >> 1))) {
+			num_8k_sessions += 1;
+			num_4k_sessions += 2;
+			num_1080p_sessions += 4;
+		} else if (res_is_greater_than(width, height, 1920 + (1920 >> 1),
+					       1088 + (1088 >> 1))) {
+			num_4k_sessions += 1;
+			num_1080p_sessions += 2;
+		} else if (res_is_greater_than(width, height, 1280 + (1280 >> 1),
+					       736 + (736 >> 1))) {
+			num_1080p_sessions += 1;
+		}
+	}
+	core_unlock(core, __func__);
+
+	if (num_8k_sessions > core->capabilities[MAX_NUM_8K_SESSIONS].value) {
+		i_vpr_e(inst, "%s: total 8k sessions %d, exceeded max limit %d\n",
+			__func__, num_8k_sessions,
+			core->capabilities[MAX_NUM_8K_SESSIONS].value);
+		return -ENOMEM;
+	}
+
+	if (num_4k_sessions > core->capabilities[MAX_NUM_4K_SESSIONS].value) {
+		i_vpr_e(inst, "%s: total 4K sessions %d, exceeded max limit %d\n",
+			__func__, num_4k_sessions,
+			core->capabilities[MAX_NUM_4K_SESSIONS].value);
+		return -ENOMEM;
+	}
+
+	if (num_1080p_sessions > core->capabilities[MAX_NUM_1080P_SESSIONS].value) {
+		i_vpr_e(inst, "%s: total 1080p sessions %d, exceeded max limit %d\n",
+			__func__, num_1080p_sessions,
+			core->capabilities[MAX_NUM_1080P_SESSIONS].value);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+int msm_vidc_check_session_supported(struct msm_vidc_inst *inst)
+{
+	bool allow = false;
+	int rc = 0;
+
+	if (is_image_session(inst) && is_secure_session(inst)) {
+		i_vpr_e(inst, "%s: secure image session not supported\n", __func__);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = msm_vidc_check_core_mbps(inst);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_check_core_mbpf(inst);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_check_inst_mbpf(inst);
+	if (rc)
+		goto exit;
+
+	rc = msm_vidc_check_resolution_supported(inst);
+	if (rc)
+		goto exit;
+
+	/* check image capabilities */
+	if (is_image_encode_session(inst)) {
+		allow = msm_vidc_allow_image_encode_session(inst);
+		if (!allow) {
+			rc = -EINVAL;
+			goto exit;
+		}
+	}
+
+	rc = msm_vidc_check_max_sessions(inst);
+	if (rc)
+		goto exit;
+
+exit:
+	if (rc) {
+		i_vpr_e(inst, "%s: current session not supported\n", __func__);
+		msm_vidc_print_running_instances_info(inst->core);
+	}
+
+	return rc;
+}
+
+int msm_vidc_check_scaling_supported(struct msm_vidc_inst *inst)
+{
+	u32 iwidth, owidth, iheight, oheight, ds_factor;
+
+	if (is_image_session(inst) || is_decode_session(inst)) {
+		i_vpr_h(inst, "%s: Scaling is supported for encode session only\n", __func__);
+		return 0;
+	}
+
+	if (!is_scaling_enabled(inst)) {
+		i_vpr_h(inst, "%s: Scaling not enabled. skip scaling check\n", __func__);
+		return 0;
+	}
+
+	iwidth = inst->crop.width;
+	iheight = inst->crop.height;
+	owidth = inst->compose.width;
+	oheight = inst->compose.height;
+	ds_factor = inst->capabilities[SCALE_FACTOR].value;
+
+	/* upscaling: encoder doesnot support upscaling */
+	if (owidth > iwidth || oheight > iheight) {
+		i_vpr_e(inst, "%s: upscale not supported: input [%u x %u], output [%u x %u]\n",
+			__func__, iwidth, iheight, owidth, oheight);
+		return -EINVAL;
+	}
+
+	/* downscaling: only supported upto 1/8 of width & 1/8 of height */
+	if (iwidth > owidth * ds_factor || iheight > oheight * ds_factor) {
+		i_vpr_e(inst,
+			"%s: unsupported ratio: input [%u x %u], output [%u x %u], ratio %u\n",
+			__func__, iwidth, iheight, owidth, oheight, ds_factor);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+struct msm_vidc_fw_query_params {
+	u32 hfi_prop_name;
+	u32 port;
+};
+
+int msm_vidc_get_properties(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	int i;
+
+	static const struct msm_vidc_fw_query_params fw_query_params[] = {
+		{HFI_PROP_STAGE, HFI_PORT_NONE},
+		{HFI_PROP_PIPE, HFI_PORT_NONE},
+		{HFI_PROP_QUALITY_MODE, HFI_PORT_BITSTREAM}
+	};
+
+	for (i = 0; i < ARRAY_SIZE(fw_query_params); i++) {
+
+		if (is_decode_session(inst)) {
+			if (fw_query_params[i].hfi_prop_name == HFI_PROP_QUALITY_MODE)
+				continue;
+		}
+
+		i_vpr_l(inst, "%s: querying fw for property %#x\n", __func__,
+				fw_query_params[i].hfi_prop_name);
+
+		rc = venus_hfi_session_property(inst,
+				fw_query_params[i].hfi_prop_name,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED |
+				HFI_HOST_FLAGS_GET_PROPERTY),
+				fw_query_params[i].port,
+				HFI_PAYLOAD_NONE,
+				NULL,
+				0);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+struct context_bank_info *msm_vidc_get_context_bank_for_region(
+	struct msm_vidc_core *core, enum msm_vidc_buffer_region region)
+{
+	struct context_bank_info *cb = NULL, *match = NULL;
+
+	if (!region || region >= MSM_VIDC_REGION_MAX) {
+		d_vpr_e("Invalid region %#x\n", region);
+		return NULL;
+	}
+
+	venus_hfi_for_each_context_bank(core, cb) {
+		if (cb->region == region) {
+			match = cb;
+			break;
+		}
+	}
+	if (!match)
+		d_vpr_e("cb not found for region %#x\n", region);
+
+	return match;
+}
+
+struct context_bank_info *msm_vidc_get_context_bank_for_device(
+	struct msm_vidc_core *core, struct device *dev)
+{
+	struct context_bank_info *cb = NULL, *match = NULL;
+
+	venus_hfi_for_each_context_bank(core, cb) {
+		if (of_device_is_compatible(dev->of_node, cb->name)) {
+			match = cb;
+			break;
+		}
+	}
+	if (!match)
+		d_vpr_e("cb not found for dev %s\n", dev_name(dev));
+
+	return match;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_fence.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_fence.c
@@ -0,0 +1,205 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_fence.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_debug.h"
+
+static const char *msm_vidc_dma_fence_get_driver_name(struct dma_fence *df)
+{
+	struct msm_vidc_fence *fence;
+
+	if (df) {
+		fence = container_of(df, struct msm_vidc_fence, dma_fence);
+		return fence->name;
+	}
+	return "msm_vidc_dma_fence_get_driver_name: invalid fence";
+}
+
+static const char *msm_vidc_dma_fence_get_timeline_name(struct dma_fence *df)
+{
+	struct msm_vidc_fence *fence;
+
+	if (df) {
+		fence = container_of(df, struct msm_vidc_fence, dma_fence);
+		return fence->name;
+	}
+	return "msm_vidc_dma_fence_get_timeline_name: invalid fence";
+}
+
+static void msm_vidc_dma_fence_release(struct dma_fence *df)
+{
+	struct msm_vidc_fence *fence;
+
+	if (df) {
+		fence = container_of(df, struct msm_vidc_fence, dma_fence);
+		d_vpr_l("%s: name %s\n", __func__, fence->name);
+		vfree(fence);
+	} else {
+		d_vpr_e("%s: invalid fence\n", __func__);
+	}
+}
+
+static const struct dma_fence_ops msm_vidc_dma_fence_ops = {
+	.get_driver_name = msm_vidc_dma_fence_get_driver_name,
+	.get_timeline_name = msm_vidc_dma_fence_get_timeline_name,
+	.release = msm_vidc_dma_fence_release,
+};
+
+struct msm_vidc_fence *msm_vidc_fence_create(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_fence *fence = NULL;
+
+	fence = vzalloc(sizeof(*fence));
+	if (!fence) {
+		i_vpr_e(inst, "%s: allocation failed\n", __func__);
+		return NULL;
+	}
+
+	fence->fd = INVALID_FD;
+	spin_lock_init(&fence->lock);
+	dma_fence_init(&fence->dma_fence, &msm_vidc_dma_fence_ops,
+		&fence->lock, inst->fence_context.ctx_num,
+		++inst->fence_context.seq_num);
+	snprintf(fence->name, sizeof(fence->name), "%s: %llu",
+		inst->fence_context.name, inst->fence_context.seq_num);
+
+	/* reset seqno to avoid going beyond INT_MAX */
+	if (inst->fence_context.seq_num >= INT_MAX)
+		inst->fence_context.seq_num = 0;
+
+	fence->fence_id = fence->dma_fence.seqno;
+
+	INIT_LIST_HEAD(&fence->list);
+	list_add_tail(&fence->list, &inst->fence_list);
+	i_vpr_l(inst, "%s: created %s\n", __func__, fence->name);
+
+	return fence;
+}
+
+static int msm_vidc_dma_fence_create_fd(struct msm_vidc_inst *inst,
+	struct msm_vidc_fence *fence)
+{
+	int rc = 0;
+
+	fence->fd = get_unused_fd_flags(0);
+	if (fence->fd < 0) {
+		i_vpr_e(inst, "%s: getting fd (%d) failed\n", __func__,
+			fence->fd);
+		rc = -EINVAL;
+		goto err_fd;
+	}
+	fence->sync_file = sync_file_create(&fence->dma_fence);
+	if (!fence->sync_file) {
+		i_vpr_e(inst, "%s: sync_file_create failed\n", __func__);
+		rc = -EINVAL;
+		goto err_sync_file;
+	}
+	fd_install(fence->fd, fence->sync_file->file);
+
+	i_vpr_l(inst, "%s: created fd %d for fence %s\n", __func__,
+		fence->fd, fence->name);
+
+	return 0;
+
+err_sync_file:
+	put_unused_fd(fence->fd);
+err_fd:
+	return rc;
+}
+
+static struct msm_vidc_fence *msm_vidc_get_dma_fence_from_id(
+	struct msm_vidc_inst *inst, u64 fence_id)
+{
+	struct msm_vidc_fence *fence, *dummy_fence;
+	bool found = false;
+
+	list_for_each_entry_safe(fence, dummy_fence, &inst->fence_list, list) {
+		if (fence->fence_id == fence_id) {
+			found = true;
+			break;
+		}
+	}
+
+	if (!found) {
+		i_vpr_l(inst, "%s: no fence available for id: %llu\n",
+			__func__, fence_id);
+		return NULL;
+	}
+
+	return fence;
+}
+
+static int msm_vidc_fence_signal(struct msm_vidc_inst *inst, u64 fence_id)
+{
+	int rc = 0;
+	struct msm_vidc_fence *fence;
+
+	fence = msm_vidc_get_dma_fence_from_id(inst, fence_id);
+	if (!fence) {
+		i_vpr_e(inst, "%s: no fence available to signal with id: %llu\n",
+			__func__, fence_id);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	i_vpr_l(inst, "%s: fence %s\n", __func__, fence->name);
+	list_del_init(&fence->list);
+
+	dma_fence_signal(&fence->dma_fence);
+	dma_fence_put(&fence->dma_fence);
+
+exit:
+	return rc;
+}
+
+
+static void msm_vidc_fence_destroy(struct msm_vidc_inst *inst, u64 fence_id)
+{
+	struct msm_vidc_fence *fence;
+
+	fence = msm_vidc_get_dma_fence_from_id(inst, fence_id);
+	if (!fence)
+		return;
+
+	i_vpr_l(inst, "%s: fence %s\n", __func__, fence->name);
+	list_del_init(&fence->list);
+	dma_fence_set_error(&fence->dma_fence, -EINVAL);
+	dma_fence_signal(&fence->dma_fence);
+	dma_fence_put(&fence->dma_fence);
+}
+
+int msm_vidc_fence_init(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	inst->fence_context.ctx_num = dma_fence_context_alloc(1);
+	snprintf(inst->fence_context.name, sizeof(inst->fence_context.name),
+		"msm_vidc_fence: %s: %llu", inst->debug_str,
+		inst->fence_context.ctx_num);
+	i_vpr_h(inst, "%s: %s\n", __func__, inst->fence_context.name);
+
+	return rc;
+}
+
+void msm_vidc_fence_deinit(struct msm_vidc_inst *inst)
+{
+	i_vpr_h(inst, "%s: %s\n", __func__, inst->fence_context.name);
+	inst->fence_context.ctx_num = 0;
+	snprintf(inst->fence_context.name, sizeof(inst->fence_context.name),
+		"%s", "");
+}
+
+static const struct msm_vidc_fence_ops msm_dma_fence_ops = {
+	.fence_create             = msm_vidc_fence_create,
+	.fence_destroy            = msm_vidc_fence_destroy,
+	.fence_signal             = msm_vidc_fence_signal,
+	.fence_create_fd          = msm_vidc_dma_fence_create_fd,
+};
+
+const struct msm_vidc_fence_ops *get_dma_fence_ops(void)
+{
+	return &msm_dma_fence_ops;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_memory.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_memory.c
@@ -0,0 +1,650 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/dma-buf.h>
+#include <linux/dma-heap.h>
+#include <linux/dma-mapping.h>
+
+#include "msm_vidc_memory.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_events.h"
+#include "msm_vidc_platform.h"
+#include "venus_hfi.h"
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 16, 0))
+	MODULE_IMPORT_NS(DMA_BUF);
+#endif
+
+struct msm_vidc_type_size_name {
+	enum msm_memory_pool_type type;
+	u32                       size;
+	char                     *name;
+};
+
+static const struct msm_vidc_type_size_name buftype_size_name_arr[] = {
+	{MSM_MEM_POOL_BUFFER,     sizeof(struct msm_vidc_buffer),     "MSM_MEM_POOL_BUFFER"     },
+	{MSM_MEM_POOL_ALLOC_MAP,  sizeof(struct msm_vidc_mem),        "MSM_MEM_POOL_ALLOC_MAP"  },
+	{MSM_MEM_POOL_TIMESTAMP,  sizeof(struct msm_vidc_timestamp),  "MSM_MEM_POOL_TIMESTAMP"  },
+	{MSM_MEM_POOL_DMABUF,     sizeof(struct msm_memory_dmabuf),   "MSM_MEM_POOL_DMABUF"     },
+	{MSM_MEM_POOL_PACKET,     sizeof(struct hfi_pending_packet) + MSM_MEM_POOL_PACKET_SIZE,
+		"MSM_MEM_POOL_PACKET"},
+	{MSM_MEM_POOL_BUF_TIMER,  sizeof(struct msm_vidc_input_timer), "MSM_MEM_POOL_BUF_TIMER" },
+	{MSM_MEM_POOL_BUF_STATS,  sizeof(struct msm_vidc_buffer_stats), "MSM_MEM_POOL_BUF_STATS"},
+};
+
+void *msm_vidc_pool_alloc(struct msm_vidc_inst *inst, enum msm_memory_pool_type type)
+{
+	struct msm_memory_alloc_header *hdr = NULL;
+	struct msm_memory_pool *pool;
+
+	if (type < 0 || type >= MSM_MEM_POOL_MAX) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return NULL;
+	}
+	pool = &inst->pool[type];
+
+	if (!list_empty(&pool->free_pool)) {
+		/* get 1st node from free pool */
+		hdr = list_first_entry(&pool->free_pool,
+			struct msm_memory_alloc_header, list);
+
+		/* move node from free pool to busy pool */
+		list_move_tail(&hdr->list, &pool->busy_pool);
+
+		/* reset existing data */
+		memset((char *)hdr->buf, 0, pool->size);
+
+		/* set busy flag to true. This is to catch double free request */
+		hdr->busy = true;
+
+		return hdr->buf;
+	}
+
+	hdr = vzalloc(pool->size + sizeof(struct msm_memory_alloc_header));
+	if (!hdr) {
+		i_vpr_e(inst, "%s: allocation failed\n", __func__);
+		return NULL;
+	}
+
+	INIT_LIST_HEAD(&hdr->list);
+	hdr->type = type;
+	hdr->busy = true;
+	hdr->buf = (void *)(hdr + 1);
+	list_add_tail(&hdr->list, &pool->busy_pool);
+
+	return hdr->buf;
+}
+
+void msm_vidc_pool_free(struct msm_vidc_inst *inst, void *vidc_buf)
+{
+	struct msm_memory_alloc_header *hdr;
+	struct msm_memory_pool *pool;
+
+	if (!vidc_buf) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return;
+	}
+	hdr = (struct msm_memory_alloc_header *)vidc_buf - 1;
+
+	/* sanitize buffer addr */
+	if (hdr->buf != vidc_buf) {
+		i_vpr_e(inst, "%s: invalid buf addr %p\n", __func__, vidc_buf);
+		return;
+	}
+
+	/* sanitize pool type */
+	if (hdr->type < 0 || hdr->type >= MSM_MEM_POOL_MAX) {
+		i_vpr_e(inst, "%s: invalid pool type %#x\n", __func__, hdr->type);
+		return;
+	}
+	pool = &inst->pool[hdr->type];
+
+	/* catch double-free request */
+	if (!hdr->busy) {
+		i_vpr_e(inst, "%s: double free request. type %s, addr %p\n", __func__,
+			pool->name, vidc_buf);
+		return;
+	}
+	hdr->busy = false;
+
+	/* move node from busy pool to free pool */
+	list_move_tail(&hdr->list, &pool->free_pool);
+}
+
+static void msm_vidc_destroy_pool_buffers(struct msm_vidc_inst *inst,
+	enum msm_memory_pool_type type)
+{
+	struct msm_memory_alloc_header *hdr, *dummy;
+	struct msm_memory_pool *pool;
+	u32 fcount = 0, bcount = 0;
+
+	if (type < 0 || type >= MSM_MEM_POOL_MAX) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return;
+	}
+	pool = &inst->pool[type];
+
+	/* detect memleak: busy pool is expected to be empty here */
+	if (!list_empty(&pool->busy_pool))
+		i_vpr_e(inst, "%s: destroy request on active buffer. type %s\n",
+			__func__, pool->name);
+
+	/* destroy all free buffers */
+	list_for_each_entry_safe(hdr, dummy, &pool->free_pool, list) {
+		list_del(&hdr->list);
+		vfree(hdr);
+		fcount++;
+	}
+
+	/* destroy all busy buffers */
+	list_for_each_entry_safe(hdr, dummy, &pool->busy_pool, list) {
+		list_del(&hdr->list);
+		vfree(hdr);
+		bcount++;
+	}
+
+	i_vpr_h(inst, "%s: type: %23s, count: free %2u, busy %2u\n",
+		__func__, pool->name, fcount, bcount);
+}
+
+int msm_vidc_pools_init(struct msm_vidc_inst *inst)
+{
+	u32 i;
+
+	if (ARRAY_SIZE(buftype_size_name_arr) != MSM_MEM_POOL_MAX) {
+		i_vpr_e(inst, "%s: num elements mismatch %lu %u\n", __func__,
+			ARRAY_SIZE(buftype_size_name_arr), MSM_MEM_POOL_MAX);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < MSM_MEM_POOL_MAX; i++) {
+		if (i != buftype_size_name_arr[i].type) {
+			i_vpr_e(inst, "%s: type mismatch %u %u\n", __func__,
+				i, buftype_size_name_arr[i].type);
+			return -EINVAL;
+		}
+		inst->pool[i].size = buftype_size_name_arr[i].size;
+		inst->pool[i].name = buftype_size_name_arr[i].name;
+		INIT_LIST_HEAD(&inst->pool[i].free_pool);
+		INIT_LIST_HEAD(&inst->pool[i].busy_pool);
+	}
+
+	return 0;
+}
+
+void msm_vidc_pools_deinit(struct msm_vidc_inst *inst)
+{
+	u32 i = 0;
+
+	/* destroy all buffers from all pool types */
+	for (i = 0; i < MSM_MEM_POOL_MAX; i++)
+		msm_vidc_destroy_pool_buffers(inst, i);
+}
+
+static struct dma_buf *msm_vidc_dma_buf_get(struct msm_vidc_inst *inst, int fd)
+{
+	struct msm_memory_dmabuf *buf = NULL;
+	struct dma_buf *dmabuf = NULL;
+	bool found = false;
+
+	/* get local dmabuf ref for tracking */
+	dmabuf = dma_buf_get(fd);
+	if (IS_ERR_OR_NULL(dmabuf)) {
+		d_vpr_e("Failed to get dmabuf for %d, error %ld\n",
+				fd, PTR_ERR(dmabuf));
+		return NULL;
+	}
+
+	/* track dmabuf - inc refcount if already present */
+	list_for_each_entry(buf, &inst->dmabuf_tracker, list) {
+		if (buf->dmabuf == dmabuf) {
+			buf->refcount++;
+			found = true;
+			break;
+		}
+	}
+	if (found) {
+		/* put local dmabuf ref */
+		dma_buf_put(dmabuf);
+		return dmabuf;
+	}
+
+	/* get tracker instance from pool */
+	buf = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_DMABUF);
+	if (!buf) {
+		i_vpr_e(inst, "%s: dmabuf alloc failed\n", __func__);
+		dma_buf_put(dmabuf);
+		return NULL;
+	}
+	/* hold dmabuf strong ref in tracker */
+	buf->dmabuf = dmabuf;
+	buf->refcount = 1;
+	INIT_LIST_HEAD(&buf->list);
+
+	/* add new dmabuf entry to tracker */
+	list_add_tail(&buf->list, &inst->dmabuf_tracker);
+
+	return dmabuf;
+}
+
+static void msm_vidc_dma_buf_put(struct msm_vidc_inst *inst, struct dma_buf *dmabuf)
+{
+	struct msm_memory_dmabuf *buf = NULL;
+	bool found = false;
+
+	if (!dmabuf) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+
+	/* track dmabuf - dec refcount if already present */
+	list_for_each_entry(buf, &inst->dmabuf_tracker, list) {
+		if (buf->dmabuf == dmabuf) {
+			buf->refcount--;
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		i_vpr_e(inst, "%s: invalid dmabuf %p\n", __func__, dmabuf);
+		return;
+	}
+
+	/* non-zero refcount - do nothing */
+	if (buf->refcount)
+		return;
+
+	/* remove dmabuf entry from tracker */
+	list_del(&buf->list);
+
+	/* release dmabuf strong ref from tracker */
+	dma_buf_put(buf->dmabuf);
+
+	/* put tracker instance back to pool */
+	msm_vidc_pool_free(inst, buf);
+}
+
+static void msm_vidc_dma_buf_put_completely(struct msm_vidc_inst *inst,
+	struct msm_memory_dmabuf *buf)
+{
+	if (!buf) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+
+	while (buf->refcount) {
+		buf->refcount--;
+		if (!buf->refcount) {
+			/* remove dmabuf entry from tracker */
+			list_del(&buf->list);
+
+			/* release dmabuf strong ref from tracker */
+			dma_buf_put(buf->dmabuf);
+
+			/* put tracker instance back to pool */
+			msm_vidc_pool_free(inst, buf);
+			break;
+		}
+	}
+}
+
+static struct dma_buf_attachment *msm_vidc_dma_buf_attach(struct msm_vidc_core *core,
+	struct dma_buf *dbuf, struct device *dev)
+{
+	int rc = 0;
+	struct dma_buf_attachment *attach = NULL;
+
+	if (!dbuf || !dev) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return NULL;
+	}
+
+	attach = dma_buf_attach(dbuf, dev);
+	if (IS_ERR_OR_NULL(attach)) {
+		rc = PTR_ERR(attach) ? PTR_ERR(attach) : -1;
+		d_vpr_e("Failed to attach dmabuf, error %d\n", rc);
+		return NULL;
+	}
+
+	return attach;
+}
+
+static int msm_vidc_dma_buf_detach(struct msm_vidc_core *core,
+	struct dma_buf *dbuf, struct dma_buf_attachment *attach)
+{
+	int rc = 0;
+
+	if (!dbuf || !attach) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	dma_buf_detach(dbuf, attach);
+
+	return rc;
+}
+
+static int msm_vidc_dma_buf_unmap_attachment(struct msm_vidc_core *core,
+	struct dma_buf_attachment *attach, struct sg_table *table)
+{
+	int rc = 0;
+
+	if (!attach || !table) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	dma_buf_unmap_attachment(attach, table, DMA_BIDIRECTIONAL);
+
+	return rc;
+}
+
+static struct sg_table *msm_vidc_dma_buf_map_attachment(
+	struct msm_vidc_core *core, struct dma_buf_attachment *attach)
+{
+	int rc = 0;
+	struct sg_table *table = NULL;
+
+	if (!attach) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return NULL;
+	}
+
+	table = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
+	if (IS_ERR_OR_NULL(table)) {
+		rc = PTR_ERR(table) ? PTR_ERR(table) : -1;
+		d_vpr_e("Failed to map table, error %d\n", rc);
+		return NULL;
+	}
+	if (!table->sgl) {
+		d_vpr_e("%s: sgl is NULL\n", __func__);
+		msm_vidc_dma_buf_unmap_attachment(core, attach, table);
+		return NULL;
+	}
+
+	return table;
+}
+
+static int msm_vidc_memory_alloc_map(struct msm_vidc_core *core, struct msm_vidc_mem *mem)
+{
+	int size = 0;
+	struct context_bank_info *cb = NULL;
+
+	if (!mem) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	size = ALIGN(mem->size, SZ_4K);
+	mem->attrs = DMA_ATTR_WRITE_COMBINE;
+
+	cb = msm_vidc_get_context_bank_for_region(core, mem->region);
+	if (!cb) {
+		d_vpr_e("%s: failed to get context bank device\n", __func__);
+		return -EIO;
+	}
+
+	mem->kvaddr = dma_alloc_attrs(cb->dev, size, &mem->device_addr, GFP_KERNEL,
+		mem->attrs);
+	if (!mem->kvaddr) {
+		d_vpr_e("%s: dma_alloc_attrs returned NULL\n", __func__);
+		return -ENOMEM;
+	}
+
+	d_vpr_h(
+		"%s: dmabuf %pK, size %d, buffer_type %s, secure %d, region %d\n",
+		__func__, mem->kvaddr, mem->size, buf_name(mem->type),
+		mem->secure, mem->region);
+
+	return 0;
+}
+
+static int msm_vidc_memory_unmap_free(struct msm_vidc_core *core, struct msm_vidc_mem *mem)
+{
+	int rc = 0;
+	struct context_bank_info *cb = NULL;
+
+	if (!mem || !mem->device_addr || !mem->kvaddr) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	d_vpr_h(
+		"%s: dmabuf %lluK, size %u, kvaddr %pK, buffer_type %s, secure %d, region %d\n",
+		__func__, mem->device_addr, mem->size, mem->kvaddr,
+		buf_name(mem->type), mem->secure, mem->region);
+
+	cb = msm_vidc_get_context_bank_for_region(core, mem->region);
+	if (!cb) {
+		d_vpr_e("%s: failed to get context bank device\n", __func__);
+		return -EIO;
+	}
+
+	dma_free_attrs(cb->dev, mem->size, mem->kvaddr, mem->device_addr,
+		mem->attrs);
+
+	mem->kvaddr = NULL;
+	mem->device_addr = 0;
+
+	return rc;
+}
+
+static int msm_vidc_dma_map_page(struct msm_vidc_core *core,
+	struct msm_vidc_mem *mem)
+{
+	int rc = 0;
+	struct context_bank_info *cb = NULL;
+	dma_addr_t dma_addr;
+
+	if (!mem) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	if (mem->refcount) {
+		mem->refcount++;
+		goto exit;
+	}
+
+	cb = msm_vidc_get_context_bank_for_region(core, mem->region);
+	if (!cb) {
+		d_vpr_e("%s: Failed to get context bank device\n",
+			__func__);
+		rc = -EIO;
+		goto error;
+	}
+
+	/* map and obtain dma address for physically contiguous memory */
+	dma_addr = dma_map_page(cb->dev, phys_to_page(mem->phys_addr),
+		0, (size_t)mem->size, mem->direction);
+
+	rc = dma_mapping_error(cb->dev, dma_addr);
+	if (rc) {
+		d_vpr_e("%s: Failed to map memory\n", __func__);
+		goto error;
+	}
+
+	mem->device_addr = dma_addr;
+	mem->refcount++;
+
+exit:
+	d_vpr_l(
+		"%s: type %11s, device_addr %#llx, size %u region %d, refcount %d\n",
+		__func__, buf_name(mem->type), mem->device_addr,
+		mem->size, mem->region, mem->refcount);
+
+	return 0;
+
+error:
+	return rc;
+}
+
+static int msm_vidc_dma_unmap_page(struct msm_vidc_core *core,
+	struct msm_vidc_mem *mem)
+{
+	int rc = 0;
+	struct context_bank_info *cb = NULL;
+
+	if (!mem) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	if (mem->refcount) {
+		mem->refcount--;
+	} else {
+		d_vpr_e("unmap called while refcount is zero already\n");
+		return -EINVAL;
+	}
+
+	cb = msm_vidc_get_context_bank_for_region(core, mem->region);
+	if (!cb) {
+		d_vpr_e("%s: Failed to get context bank device\n",
+			__func__);
+		rc = -EIO;
+		goto exit;
+	}
+
+	d_vpr_l(
+		"%s: type %11s, device_addr %#llx, refcount %d, region %d\n",
+		__func__, buf_name(mem->type), mem->device_addr,
+		mem->refcount, mem->region);
+
+	if (mem->refcount)
+		goto exit;
+
+	dma_unmap_page(cb->dev, (dma_addr_t)(mem->device_addr),
+		mem->size, mem->direction);
+
+	mem->device_addr = 0x0;
+
+exit:
+	return rc;
+}
+
+static u32 msm_vidc_buffer_region(struct msm_vidc_inst *inst,
+	enum msm_vidc_buffer_type buffer_type)
+{
+	return MSM_VIDC_NON_SECURE;
+}
+
+static int msm_vidc_iommu_map(struct msm_vidc_core *core, struct msm_vidc_mem *mem)
+{
+	int rc = 0;
+	struct context_bank_info *cb = NULL;
+
+	if (!mem) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	cb = msm_vidc_get_context_bank_for_region(core, mem->region);
+	if (!cb) {
+		d_vpr_e("%s: failed to get context bank device for region: %d\n",
+			__func__, mem->region);
+		return -EIO;
+	}
+
+	rc = iommu_map(cb->domain, mem->device_addr, mem->phys_addr,
+		mem->size, IOMMU_READ | IOMMU_WRITE | IOMMU_MMIO, GFP_KERNEL);
+	if (rc) {
+		d_vpr_e("iommu_map failed for device_addr 0x%llx, size %d, rc:%d\n",
+			mem->device_addr, mem->size, rc);
+		return rc;
+	}
+
+	d_vpr_h("%s: phys_addr %#llx size %d device_addr %#llx, mem_region %d\n",
+		__func__, mem->phys_addr, mem->size, mem->device_addr, mem->region);
+
+	return rc;
+}
+
+static int msm_vidc_iommu_unmap(struct msm_vidc_core *core, struct msm_vidc_mem *mem)
+{
+	int rc = 0;
+	struct context_bank_info *cb = NULL;
+
+	if (!mem) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	cb = msm_vidc_get_context_bank_for_region(core, mem->region);
+	if (!cb) {
+		d_vpr_e("%s: failed to get context bank device for region: %d\n",
+			__func__, mem->region);
+		return -EIO;
+	}
+
+	d_vpr_h("%s: phys_addr %#llx size %d device_addr %#llx, mem_region %d\n",
+		__func__, mem->phys_addr, mem->size, mem->device_addr, mem->region);
+
+	iommu_unmap(cb->domain, mem->device_addr, mem->size);
+	mem->device_addr = 0x0;
+	mem->phys_addr = 0x0;
+	mem->size = 0;
+
+	return rc;
+}
+
+static const struct msm_vidc_memory_ops msm_mem_ops = {
+	.dma_buf_get                    = msm_vidc_dma_buf_get,
+	.dma_buf_put                    = msm_vidc_dma_buf_put,
+	.dma_buf_put_completely         = msm_vidc_dma_buf_put_completely,
+	.dma_buf_attach                 = msm_vidc_dma_buf_attach,
+	.dma_buf_detach                 = msm_vidc_dma_buf_detach,
+	.dma_buf_map_attachment         = msm_vidc_dma_buf_map_attachment,
+	.dma_buf_unmap_attachment       = msm_vidc_dma_buf_unmap_attachment,
+	.memory_alloc_map               = msm_vidc_memory_alloc_map,
+	.memory_unmap_free              = msm_vidc_memory_unmap_free,
+	.mem_dma_map_page               = msm_vidc_dma_map_page,
+	.mem_dma_unmap_page             = msm_vidc_dma_unmap_page,
+	.buffer_region                  = msm_vidc_buffer_region,
+	.iommu_map                      = msm_vidc_iommu_map,
+	.iommu_unmap                    = msm_vidc_iommu_unmap,
+};
+
+const struct msm_vidc_memory_ops *get_mem_ops(void)
+{
+	return &msm_mem_ops;
+}
+
+int msm_memory_cache_operations(struct msm_vidc_inst *inst,
+	struct dma_buf *dbuf, enum msm_memory_cache_type cache_type)
+{
+	int rc = 0;
+
+	if (!inst || !dbuf) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	switch (cache_type) {
+	case MSM_MEM_CACHE_CLEAN:
+	case MSM_MEM_CACHE_CLEAN_INVALIDATE:
+		rc = dma_buf_begin_cpu_access(dbuf, DMA_TO_DEVICE);
+		if (rc)
+			break;
+		rc = dma_buf_end_cpu_access(dbuf, DMA_FROM_DEVICE);
+		break;
+	case MSM_MEM_CACHE_INVALIDATE:
+		rc = dma_buf_begin_cpu_access(dbuf, DMA_FROM_DEVICE);
+		if (rc)
+			break;
+		rc = dma_buf_end_cpu_access(dbuf, DMA_FROM_DEVICE);
+		break;
+	default:
+		i_vpr_e(inst, "%s: cache (%d) operation not supported\n",
+			__func__, cache_type);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_memory_ext.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_memory_ext.c
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/dma-buf.h>
+#include <linux/dma-heap.h>
+#include <linux/qcom-dma-mapping.h>
+#include <linux/mem-buf.h>
+#include <soc/qcom/secure_buffer.h>
+
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_events.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_memory.h"
+
+static u32 msm_vidc_buffer_region_ext(struct msm_vidc_inst *inst,
+	enum msm_vidc_buffer_type buffer_type)
+{
+	u32 region = MSM_VIDC_NON_SECURE;
+
+    switch (buffer_type) {
+    case MSM_VIDC_BUF_ARP:
+        region = MSM_VIDC_NON_SECURE;
+        break;
+    case MSM_VIDC_BUF_INPUT:
+        if (is_encode_session(inst))
+            region = MSM_VIDC_NON_SECURE_PIXEL;
+        else
+            region = MSM_VIDC_NON_SECURE;
+        break;
+    case MSM_VIDC_BUF_OUTPUT:
+        if (is_encode_session(inst))
+            region = MSM_VIDC_NON_SECURE;
+        else
+            region = MSM_VIDC_NON_SECURE_PIXEL;
+        break;
+    case MSM_VIDC_BUF_DPB:
+    case MSM_VIDC_BUF_VPSS:
+    case MSM_VIDC_BUF_PARTIAL_DATA:
+        region = MSM_VIDC_NON_SECURE_PIXEL;
+        break;
+    case MSM_VIDC_BUF_INPUT_META:
+    case MSM_VIDC_BUF_OUTPUT_META:
+    case MSM_VIDC_BUF_BIN:
+    case MSM_VIDC_BUF_COMV:
+    case MSM_VIDC_BUF_NON_COMV:
+    case MSM_VIDC_BUF_LINE:
+    case MSM_VIDC_BUF_PERSIST:
+        region = MSM_VIDC_NON_SECURE;
+        break;
+    default:
+        i_vpr_e(inst, "%s: invalid driver buffer type %d\n",
+            __func__, buffer_type);
+    }
+
+	return region;
+}
+
+inline const struct msm_vidc_memory_ops *get_mem_ops_ext(void)
+{
+	const struct msm_vidc_memory_ops *mem_ops = get_mem_ops();
+	static struct msm_vidc_memory_ops mem_ops_ext;
+
+	memcpy(&mem_ops_ext, mem_ops, sizeof(struct msm_vidc_memory_ops));
+	mem_ops_ext.buffer_region     = msm_vidc_buffer_region_ext;
+
+	return &mem_ops_ext;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_power.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_power.c
@@ -0,0 +1,660 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_power.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_buffer.h"
+#include "venus_hfi.h"
+#include "msm_vidc_events.h"
+
+/* Q16 Format */
+#define MSM_VIDC_MIN_UBWC_COMPLEXITY_FACTOR (1 << 16)
+#define MSM_VIDC_MAX_UBWC_COMPLEXITY_FACTOR (4 << 16)
+#define MSM_VIDC_MIN_UBWC_COMPRESSION_RATIO (1 << 16)
+#define MSM_VIDC_MAX_UBWC_COMPRESSION_RATIO (5 << 16)
+#define PASSIVE_VOTE 1000
+
+/**
+ * Utility function to enforce some of our assumptions.  Spam calls to this
+ * in hotspots in code to double check some of the assumptions that we hold.
+ */
+struct lut const *__lut(int width, int height, int fps)
+{
+	int frame_size = height * width, c = 0;
+
+	do {
+		if (LUT[c].frame_size >= frame_size && LUT[c].frame_rate >= fps)
+			return &LUT[c];
+	} while (++c < ARRAY_SIZE(LUT));
+
+	return &LUT[ARRAY_SIZE(LUT) - 1];
+}
+
+fp_t __compression_ratio(struct lut const *entry, int bpp)
+{
+	int c = 0;
+
+	for (c = 0; c < COMPRESSION_RATIO_MAX; ++c) {
+		if (entry->compression_ratio[c].bpp == bpp)
+			return entry->compression_ratio[c].ratio;
+	}
+
+	WARN(true, "Shouldn't be here, LUT possibly corrupted?\n");
+	return FP_ZERO; /* impossible */
+}
+
+
+void __dump(struct dump dump[], int len)
+{
+	int c = 0;
+
+	for (c = 0; c < len; ++c) {
+		char format_line[128] = "", formatted_line[128] = "";
+
+		if (dump[c].val == DUMP_HEADER_MAGIC) {
+			snprintf(formatted_line, sizeof(formatted_line), "%s\n",
+					 dump[c].key);
+		} else {
+			bool fp_format = !strcmp(dump[c].format, DUMP_FP_FMT);
+
+			if (!fp_format) {
+				snprintf(format_line, sizeof(format_line),
+						 "    %-35s: %s\n", dump[c].key,
+						 dump[c].format);
+				snprintf(formatted_line, sizeof(formatted_line),
+						 format_line, dump[c].val);
+			} else {
+				size_t integer_part, fractional_part;
+
+				integer_part = fp_int(dump[c].val);
+				fractional_part = fp_frac(dump[c].val);
+				snprintf(formatted_line, sizeof(formatted_line),
+						 "    %-35s: %zd + %zd/%zd\n",
+						 dump[c].key, integer_part,
+						 fractional_part,
+						 fp_frac_base());
+
+
+			}
+		}
+		d_vpr_b("%s", formatted_line);
+	}
+}
+
+u64 msm_vidc_max_freq(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+	struct frequency_table *freq_tbl;
+	u64 freq = 0;
+
+	core = inst->core;
+
+	if (!core->resource || !core->resource->freq_set.freq_tbl ||
+		!core->resource->freq_set.count) {
+		i_vpr_e(inst, "%s: invalid frequency table\n", __func__);
+		return freq;
+	}
+	freq_tbl = core->resource->freq_set.freq_tbl;
+	freq = freq_tbl[0].freq;
+
+	i_vpr_l(inst, "%s: rate = %llu\n", __func__, freq);
+	return freq;
+}
+
+static int fill_dynamic_stats(struct msm_vidc_inst *inst,
+	struct vidc_bus_vote_data *vote_data)
+{
+	struct msm_vidc_input_cr_data *temp, *next;
+	u32 cf = MSM_VIDC_MAX_UBWC_COMPLEXITY_FACTOR;
+	u32 cr = MSM_VIDC_MIN_UBWC_COMPRESSION_RATIO;
+	u32 input_cr = MSM_VIDC_MIN_UBWC_COMPRESSION_RATIO;
+	u32 frame_size;
+
+	if (inst->power.fw_cr)
+		cr = inst->power.fw_cr;
+
+	if (inst->power.fw_cf) {
+		cf = inst->power.fw_cf;
+		frame_size = (msm_vidc_get_mbs_per_frame(inst) / (32 * 8) * 3) / 2;
+		if (frame_size)
+			cf = cf / frame_size;
+	}
+
+	list_for_each_entry_safe(temp, next, &inst->enc_input_crs, list)
+		input_cr = min(input_cr, temp->input_cr);
+
+	vote_data->compression_ratio = cr;
+	vote_data->complexity_factor = cf;
+	vote_data->input_cr = input_cr;
+
+	/* Sanitize CF values from HW */
+	cf = clamp_t(u32, cf, MSM_VIDC_MIN_UBWC_COMPLEXITY_FACTOR,
+			MSM_VIDC_MAX_UBWC_COMPLEXITY_FACTOR);
+	cr = clamp_t(u32, cr, MSM_VIDC_MIN_UBWC_COMPRESSION_RATIO,
+			MSM_VIDC_MAX_UBWC_COMPRESSION_RATIO);
+	input_cr = clamp_t(u32, input_cr, MSM_VIDC_MIN_UBWC_COMPRESSION_RATIO,
+			MSM_VIDC_MAX_UBWC_COMPRESSION_RATIO);
+
+	vote_data->compression_ratio = cr;
+	vote_data->complexity_factor = cf;
+	vote_data->input_cr = input_cr;
+
+	i_vpr_l(inst,
+		"Input CR = %d Recon CR = %d Complexity Factor = %d\n",
+		vote_data->input_cr, vote_data->compression_ratio,
+		vote_data->complexity_factor);
+
+	return 0;
+}
+
+static int msm_vidc_set_buses(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *temp;
+	u64 total_bw_ddr = 0, total_bw_llcc = 0;
+	u64 curr_time_ns;
+
+	core = inst->core;
+
+	mutex_lock(&core->lock);
+	curr_time_ns = ktime_get_ns();
+	list_for_each_entry(temp, &core->instances, list) {
+		/* skip for session where no input is there to process */
+		if (!temp->max_input_data_size)
+			continue;
+
+		/* skip inactive session bus bandwidth */
+		if (!is_active_session(temp->last_qbuf_time_ns, curr_time_ns)) {
+			temp->active = false;
+			continue;
+		}
+
+		if (temp->power.power_mode == VIDC_POWER_TURBO) {
+			total_bw_ddr = total_bw_llcc = INT_MAX;
+			break;
+		}
+
+		total_bw_ddr += temp->power.ddr_bw;
+		total_bw_llcc += temp->power.sys_cache_bw;
+	}
+	mutex_unlock(&core->lock);
+
+	/* Incase of no video frames to process ensure min passive voting for Tensilica */
+	if (!total_bw_ddr)
+		total_bw_ddr = PASSIVE_VOTE;
+
+	if (msm_vidc_ddr_bw) {
+		d_vpr_l("msm_vidc_ddr_bw %d\n", msm_vidc_ddr_bw);
+		total_bw_ddr = msm_vidc_ddr_bw;
+	}
+
+	if (msm_vidc_llc_bw) {
+		d_vpr_l("msm_vidc_llc_bw %d\n", msm_vidc_llc_bw);
+		total_bw_llcc = msm_vidc_llc_bw;
+	}
+
+	rc = venus_hfi_scale_buses(inst, total_bw_ddr, total_bw_llcc);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int msm_vidc_scale_buses(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct vidc_bus_vote_data *vote_data;
+	struct v4l2_format *out_f;
+	struct v4l2_format *inp_f;
+	u32 operating_rate, frame_rate;
+
+	core = inst->core;
+	if (!core->resource) {
+		i_vpr_e(inst, "%s: invalid resource params\n", __func__);
+		return -EINVAL;
+	}
+	vote_data = &inst->bus_data;
+
+	vote_data->power_mode = VIDC_POWER_NORMAL;
+	if (inst->power.buffer_counter < DCVS_WINDOW || is_image_session(inst))
+		vote_data->power_mode = VIDC_POWER_TURBO;
+
+	if (vote_data->power_mode == VIDC_POWER_TURBO)
+		goto set_buses;
+
+	out_f = &inst->fmts[OUTPUT_PORT];
+	inp_f = &inst->fmts[INPUT_PORT];
+
+	vote_data->codec = inst->codec;
+	vote_data->input_width = inp_f->fmt.pix_mp.width;
+	vote_data->input_height = inp_f->fmt.pix_mp.height;
+	vote_data->output_width = out_f->fmt.pix_mp.width;
+	vote_data->output_height = out_f->fmt.pix_mp.height;
+	vote_data->lcu_size = (inst->codec == MSM_VIDC_HEVC ||
+			inst->codec == MSM_VIDC_VP9) ? 32 : 16;
+	if (inst->codec == MSM_VIDC_AV1)
+		vote_data->lcu_size =
+			inst->capabilities[SUPER_BLOCK].value ? 128 : 64;
+	vote_data->fps = inst->max_rate;
+
+	if (is_encode_session(inst)) {
+		vote_data->domain = MSM_VIDC_ENCODER;
+		vote_data->bitrate = inst->capabilities[BIT_RATE].value;
+		vote_data->rotation = inst->capabilities[ROTATION].value;
+		vote_data->b_frames_enabled =
+			inst->capabilities[B_FRAME].value > 0;
+
+		/* scale bitrate if operating rate is larger than frame rate */
+		frame_rate = msm_vidc_get_frame_rate(inst);
+		operating_rate = inst->max_rate;
+		if (frame_rate && operating_rate && operating_rate > frame_rate)
+			vote_data->bitrate = (vote_data->bitrate / frame_rate) * operating_rate;
+
+		vote_data->num_formats = 1;
+		vote_data->color_formats[0] = v4l2_colorformat_to_driver(inst,
+			inst->fmts[INPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+		vote_data->vpss_preprocessing_enabled =
+			inst->capabilities[REQUEST_PREPROCESS].value;
+	} else if (is_decode_session(inst)) {
+		u32 color_format;
+
+		vote_data->domain = MSM_VIDC_DECODER;
+		vote_data->bitrate = inst->max_input_data_size * vote_data->fps * 8;
+		color_format = v4l2_colorformat_to_driver(inst,
+			inst->fmts[OUTPUT_PORT].fmt.pix_mp.pixelformat, __func__);
+		if (is_linear_colorformat(color_format)) {
+			vote_data->num_formats = 2;
+			/*
+			 * 0 index - dpb colorformat
+			 * 1 index - opb colorformat
+			 */
+			if (is_10bit_colorformat(color_format))
+				vote_data->color_formats[0] = MSM_VIDC_FMT_TP10C;
+			else
+				vote_data->color_formats[0] = MSM_VIDC_FMT_NV12;
+
+			vote_data->color_formats[1] = color_format;
+		} else if (inst->codec == MSM_VIDC_AV1 &&
+			inst->capabilities[FILM_GRAIN].value) {
+			/*
+			 * UBWC formats with AV1 film grain requires dpb-opb
+			 * split mode
+			 */
+			vote_data->num_formats = 2;
+			vote_data->color_formats[0] =
+				vote_data->color_formats[1] = color_format;
+		} else {
+			vote_data->num_formats = 1;
+			vote_data->color_formats[0] = color_format;
+		}
+	}
+	vote_data->work_mode = inst->capabilities[STAGE].value;
+	if (core->resource->subcache_set.set_to_fw)
+		vote_data->use_sys_cache = true;
+	vote_data->num_vpp_pipes = core->capabilities[NUM_VPP_PIPE].value;
+	fill_dynamic_stats(inst, vote_data);
+
+	call_session_op(core, calc_bw, inst, vote_data);
+
+	inst->power.ddr_bw = vote_data->calc_bw_ddr;
+	inst->power.sys_cache_bw = vote_data->calc_bw_llcc;
+
+	if (!inst->stats.avg_bw_llcc)
+		inst->stats.avg_bw_llcc = inst->power.sys_cache_bw;
+	else
+		inst->stats.avg_bw_llcc =
+			(inst->stats.avg_bw_llcc + inst->power.sys_cache_bw) / 2;
+
+	if (!inst->stats.avg_bw_ddr)
+		inst->stats.avg_bw_ddr = inst->power.ddr_bw;
+	else
+		inst->stats.avg_bw_ddr =
+			(inst->stats.avg_bw_ddr + inst->power.ddr_bw) / 2;
+
+set_buses:
+	inst->power.power_mode = vote_data->power_mode;
+	rc = msm_vidc_set_buses(inst);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int msm_vidc_set_clocks(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *temp;
+	u64 freq;
+	u64 rate = 0;
+	bool increment, decrement;
+	u64 curr_time_ns;
+	int i = 0;
+
+	core = inst->core;
+
+	if (!core->resource || !core->resource->freq_set.freq_tbl ||
+		!core->resource->freq_set.count) {
+		d_vpr_e("%s: invalid frequency table\n", __func__);
+		return -EINVAL;
+	}
+
+	mutex_lock(&core->lock);
+	increment = false;
+	decrement = true;
+	freq = 0;
+	curr_time_ns = ktime_get_ns();
+	list_for_each_entry(temp, &core->instances, list) {
+		/* skip for session where no input is there to process */
+		if (!temp->max_input_data_size)
+			continue;
+
+		/* skip inactive session clock rate */
+		if (!is_active_session(temp->last_qbuf_time_ns, curr_time_ns)) {
+			temp->active = false;
+			continue;
+		}
+		freq += temp->power.min_freq;
+
+		if (msm_vidc_clock_voting) {
+			d_vpr_l("msm_vidc_clock_voting %d\n", msm_vidc_clock_voting);
+			freq = msm_vidc_clock_voting;
+			decrement = false;
+			break;
+		}
+		/* increment even if one session requested for it */
+		if (temp->power.dcvs_flags & MSM_VIDC_DCVS_INCR)
+			increment = true;
+		/* decrement only if all sessions requested for it */
+		if (!(temp->power.dcvs_flags & MSM_VIDC_DCVS_DECR))
+			decrement = false;
+	}
+
+	/*
+	 * keep checking from lowest to highest rate until
+	 * table rate >= requested rate
+	 */
+	for (i = core->resource->freq_set.count - 1; i >= 0; i--) {
+		rate = core->resource->freq_set.freq_tbl[i].freq;
+		if (rate >= freq)
+			break;
+	}
+	if (i < 0)
+		i = 0;
+	if (increment) {
+		if (i > 0)
+			rate = core->resource->freq_set.freq_tbl[i - 1].freq;
+	} else if (decrement) {
+		if (i < (int)(core->platform->data.freq_tbl_size - 1))
+			rate = core->resource->freq_set.freq_tbl[i + 1].freq;
+	}
+	core->power.clk_freq = (u32)rate;
+
+	i_vpr_p(inst, "%s: clock rate %llu requested %llu increment %d decrement %d\n",
+		__func__, rate, freq, increment, decrement);
+	mutex_unlock(&core->lock);
+
+	rc = venus_hfi_scale_clocks(inst, rate);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int msm_vidc_apply_dcvs(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	int bufs_with_fw = 0;
+	struct msm_vidc_power *power;
+
+	/* skip dcvs */
+	if (!inst->power.dcvs_mode)
+		return 0;
+
+	power = &inst->power;
+
+	if (is_decode_session(inst)) {
+		bufs_with_fw = msm_vidc_num_buffers(inst,
+			MSM_VIDC_BUF_OUTPUT, MSM_VIDC_ATTR_QUEUED);
+	} else {
+		bufs_with_fw = msm_vidc_num_buffers(inst,
+			MSM_VIDC_BUF_INPUT, MSM_VIDC_ATTR_QUEUED);
+	}
+
+	/* +1 as one buffer is going to be queued after the function */
+	bufs_with_fw += 1;
+
+	/*
+	 * DCVS decides clock level based on below algorithm
+	 *
+	 * Limits :
+	 * min_threshold : Buffers required for reference by FW.
+	 * nom_threshold : Midpoint of Min and Max thresholds
+	 * max_threshold : Min Threshold + DCVS extra buffers, allocated
+	 *				   for smooth flow.
+	 * 1) When buffers outside FW are reaching client's extra buffers,
+	 *    FW is slow and will impact pipeline, Increase clock.
+	 * 2) When pending buffers with FW are less than FW requested,
+	 *    pipeline has cushion to absorb FW slowness, Decrease clocks.
+	 * 3) When DCVS has engaged(Inc or Dec):
+	 *    For decode:
+	 *        - Pending buffers with FW transitions past the nom_threshold,
+	 *        switch to calculated load, this smoothens the clock transitions.
+	 *    For encode:
+	 *        - Always switch to calculated load.
+	 * 4) Otherwise maintain previous Load config.
+	 */
+	if (bufs_with_fw >= power->max_threshold) {
+		power->dcvs_flags = MSM_VIDC_DCVS_INCR;
+		goto exit;
+	} else if (bufs_with_fw < power->min_threshold) {
+		power->dcvs_flags = MSM_VIDC_DCVS_DECR;
+		goto exit;
+	}
+
+	/* encoder: dcvs window handling */
+	if (is_encode_session(inst)) {
+		power->dcvs_flags = 0;
+		goto exit;
+	}
+
+	/* decoder: dcvs window handling */
+	if ((power->dcvs_flags & MSM_VIDC_DCVS_DECR && bufs_with_fw >= power->nom_threshold) ||
+		(power->dcvs_flags & MSM_VIDC_DCVS_INCR && bufs_with_fw <= power->nom_threshold)) {
+		power->dcvs_flags = 0;
+	}
+
+exit:
+	i_vpr_p(inst, "dcvs: bufs_with_fw %d th[%d %d %d] flags %#x\n",
+		bufs_with_fw, power->min_threshold,
+		power->nom_threshold, power->max_threshold,
+		power->dcvs_flags);
+
+	return rc;
+}
+
+static int msm_vidc_scale_clocks(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	if (inst->power.buffer_counter < DCVS_WINDOW ||
+	    is_image_session(inst) ||
+	    is_sub_state(inst, MSM_VIDC_DRC) ||
+	    is_sub_state(inst, MSM_VIDC_DRAIN)) {
+		inst->power.min_freq = msm_vidc_max_freq(inst);
+		inst->power.dcvs_flags = 0;
+	} else if (msm_vidc_clock_voting) {
+		inst->power.min_freq = msm_vidc_clock_voting;
+		inst->power.dcvs_flags = 0;
+	} else {
+		inst->power.min_freq =
+			call_session_op(core, calc_freq, inst, inst->max_input_data_size);
+		msm_vidc_apply_dcvs(inst);
+	}
+	inst->power.curr_freq = inst->power.min_freq;
+	msm_vidc_set_clocks(inst);
+
+	return 0;
+}
+
+int msm_vidc_scale_power(struct msm_vidc_inst *inst, bool scale_buses)
+{
+	struct msm_vidc_core *core;
+	struct msm_vidc_buffer *vbuf;
+	u32 data_size = 0;
+	u32 cnt = 0;
+	u32 fps;
+	u32 frame_rate, operating_rate;
+	u32 timestamp_rate = 0, input_rate = 0;
+
+	core = inst->core;
+
+	if (!inst->active) {
+		/* scale buses for inactive -> active session */
+		scale_buses = true;
+		inst->active = true;
+	}
+
+	/*
+	 * consider avg. filled length in decode batching case
+	 * to avoid overvoting for the entire batch due to single
+	 * frame with huge filled length
+	 */
+	if (inst->decode_batch.enable) {
+		list_for_each_entry(vbuf, &inst->buffers.input.list, list) {
+			if (vbuf->attr & MSM_VIDC_ATTR_DEFERRED ||
+				vbuf->attr & MSM_VIDC_ATTR_QUEUED) {
+				data_size += vbuf->data_size;
+				cnt++;
+			}
+		}
+		if (cnt)
+			data_size /= cnt;
+	} else {
+		list_for_each_entry(vbuf, &inst->buffers.input.list, list)
+			data_size = max(data_size, vbuf->data_size);
+	}
+	inst->max_input_data_size = data_size;
+
+	frame_rate = msm_vidc_get_frame_rate(inst);
+	operating_rate = msm_vidc_get_operating_rate(inst);
+	fps = max(frame_rate, operating_rate);
+	/*
+	 * Consider input queuing rate power scaling in below scenarios
+	 * decoder: non-realtime and realtime as well because client
+	 *          may not set the frame rate / operating rate and
+	 *          we need to rely on input queue rate
+	 * encoder: non-realtime only, for realtime client is expected to
+	 *          queue input buffers at the set frame rate / operating rate
+	 */
+	if (is_decode_session(inst) ||
+		(is_encode_session(inst) && !is_realtime_session(inst))) {
+		/*
+		 * when buffer detected fps is more than client set value by 12.5%,
+		 * utilize buffer detected fps to scale clock.
+		 */
+		timestamp_rate = msm_vidc_get_timestamp_rate(inst);
+		input_rate = msm_vidc_get_input_rate(inst);
+		if (timestamp_rate > (fps + fps / 8))
+			fps = timestamp_rate;
+
+		if (input_rate > fps) {
+			fps = input_rate;
+			/*
+			 * add 6.25% more fps for NRT session to increase power to make
+			 * firmware processing little faster than client queuing rate
+			 */
+			if (!is_realtime_session(inst))
+				fps = fps + fps / 16;
+		}
+	}
+	inst->max_rate = fps;
+
+	/* no pending inputs - skip scale power */
+	if (!inst->max_input_data_size)
+		return 0;
+
+	if (msm_vidc_scale_clocks(inst))
+		i_vpr_e(inst, "failed to scale clock\n");
+
+	if (scale_buses) {
+		if (msm_vidc_scale_buses(inst))
+			i_vpr_e(inst, "failed to scale bus\n");
+	}
+
+	i_vpr_hp(inst,
+		"power: inst: clk %lld ddr %d llcc %d dcvs flags %#x fps %u (%u %u %u %u) core: clk %lld ddr %lld llcc %lld\n",
+		inst->power.curr_freq, inst->power.ddr_bw,
+		inst->power.sys_cache_bw, inst->power.dcvs_flags,
+		inst->max_rate, frame_rate, operating_rate, timestamp_rate,
+		input_rate, core->power.clk_freq, core->power.bw_ddr,
+		core->power.bw_llcc);
+
+	trace_msm_vidc_perf_power_scale(inst, core->power.clk_freq,
+		core->power.bw_ddr, core->power.bw_llcc);
+
+	return 0;
+}
+
+static void msm_vidc_dcvs_data_reset(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_power *dcvs;
+	u32 min_count, actual_count, max_count;
+
+	dcvs = &inst->power;
+	if (is_encode_session(inst)) {
+		min_count = inst->buffers.input.min_count;
+		actual_count = inst->buffers.input.actual_count;
+		max_count = min((min_count + DCVS_ENC_EXTRA_INPUT_BUFFERS), actual_count);
+	} else if (is_decode_session(inst)) {
+		min_count = inst->buffers.output.min_count;
+		actual_count = inst->buffers.output.actual_count;
+		max_count = min((min_count + DCVS_DEC_EXTRA_OUTPUT_BUFFERS), actual_count);
+	} else {
+		i_vpr_e(inst, "%s: invalid domain type %d\n",
+			__func__, inst->domain);
+		return;
+	}
+
+	dcvs->min_threshold = min_count;
+	dcvs->max_threshold = max_count;
+	dcvs->dcvs_window = min_count < max_count ? max_count - min_count : 0;
+	dcvs->nom_threshold = dcvs->min_threshold + (dcvs->dcvs_window / 2);
+	dcvs->dcvs_flags = 0;
+
+	i_vpr_p(inst, "%s: dcvs: thresholds [%d %d %d] flags %#x\n",
+		__func__, dcvs->min_threshold,
+		dcvs->nom_threshold, dcvs->max_threshold,
+		dcvs->dcvs_flags);
+}
+
+void msm_vidc_power_data_reset(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	i_vpr_hp(inst, "%s\n", __func__);
+
+	msm_vidc_dcvs_data_reset(inst);
+
+	inst->power.buffer_counter = 0;
+	inst->power.fw_cr = 0;
+	inst->power.fw_cf = INT_MAX;
+	inst->power.fw_av1_tile_rows = 1;
+	inst->power.fw_av1_tile_columns = 1;
+
+	rc = msm_vidc_scale_power(inst, true);
+	if (rc)
+		i_vpr_e(inst, "%s: failed to scale power\n", __func__);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_probe.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_probe.c
@@ -0,0 +1,1018 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/workqueue.h>
+#include <linux/module.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/component.h>
+#include <linux/interrupt.h>
+#include <linux/iommu.h>
+#include <linux/version.h>
+#include <linux/stringify.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 16, 0))
+#include <linux/dma-iommu.h>
+#endif
+#ifdef CONFIG_MSM_MMRM
+#include <linux/soc/qcom/msm_mmrm.h>
+#endif
+
+#include "msm_vidc_internal.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_state.h"
+#include "msm_vidc_fence.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_memory.h"
+#include "venus_hfi.h"
+
+#define BASE_DEVICE_NUMBER 32
+
+struct msm_vidc_core *g_core;
+
+const char video_banner[] = "Video-Banner: (" __stringify(VIDEO_COMPILE_BY) "@"
+	__stringify(VIDEO_COMPILE_HOST) ") (" __stringify(VIDEO_COMPILE_TIME) ")";
+
+static inline bool is_video_device(struct device *dev)
+{
+	return !!(of_device_is_compatible(dev->of_node, "qcom,sm8550-vidc") ||
+		of_device_is_compatible(dev->of_node, "qcom,qcm6490-iris-vpu") ||
+		of_device_is_compatible(dev->of_node, "qcom,sa8775p-iris") ||
+		of_device_is_compatible(dev->of_node, "qcom,qcs8300-iris"));
+}
+
+static inline bool is_video_context_bank_device_node(struct device_node *of_node)
+{
+	return !!(of_device_is_compatible(of_node, "qcom,vidc,cb-ns") ||
+			of_device_is_compatible(of_node, "qcom,vidc,cb-ns-pxl") ||
+			of_device_is_compatible(of_node, "qcom,vidc,cb-sec-non-pxl"));
+}
+
+static inline bool is_video_context_bank_device(struct device *dev)
+{
+	return is_video_context_bank_device_node(dev->of_node);
+}
+
+static int msm_vidc_init_resources(struct msm_vidc_core *core)
+{
+	struct msm_vidc_resource *res = NULL;
+	int rc = 0;
+
+	res = devm_kzalloc(&core->pdev->dev, sizeof(*res), GFP_KERNEL);
+	if (!res) {
+		d_vpr_e("%s: failed to alloc memory for resource\n", __func__);
+		return -ENOMEM;
+	}
+	core->resource = res;
+
+	rc = call_res_op(core, init, core);
+	if (rc) {
+		d_vpr_e("%s: Failed to init resources: %d\n", __func__, rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+static ssize_t sku_version_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct msm_vidc_core *core;
+
+	/*
+	 * Default sku version: 0
+	 * driver possibly not probed yet or not the main device.
+	 */
+	if (!dev || !dev->driver)
+		return 0;
+
+	core = dev_get_drvdata(dev);
+	if (!core || !core->platform) {
+		d_vpr_e("%s: invalid core\n", __func__);
+		return 0;
+	}
+
+	return scnprintf(buf, PAGE_SIZE, "%d",
+			core->platform->data.sku_version);
+}
+
+static DEVICE_ATTR_RO(sku_version);
+
+static struct attribute *msm_vidc_core_attrs[] = {
+	&dev_attr_sku_version.attr,
+	NULL
+};
+
+static struct attribute_group msm_vidc_core_attr_group = {
+	.attrs = msm_vidc_core_attrs,
+};
+
+static const struct of_device_id msm_vidc_dt_match[] = {
+	{.compatible = "qcom,qcm6490-iris-vpu"},
+	{.compatible = "qcom,sm8550-vidc"},
+	{.compatible = "qcom,sa8775p-iris"},
+	{.compatible = "qcom,qcs8300-iris"},
+	{.compatible = "qcom,vidc,cb-ns"},
+	{.compatible = "qcom,vidc,cb-ns-pxl"},
+	{.compatible = "qcom,vidc,cb-sec-non-pxl"},
+	MSM_VIDC_EMPTY_BRACE
+};
+MODULE_DEVICE_TABLE(of, msm_vidc_dt_match);
+
+static void msm_vidc_release_video_device(struct video_device *vdev)
+{
+	d_vpr_e("%s:\n", __func__);
+}
+
+static void msm_vidc_unregister_video_device(struct msm_vidc_core *core,
+		enum msm_vidc_domain_type type)
+{
+	int index;
+
+	d_vpr_h("%s: domain %d\n", __func__, type);
+
+	if (type == MSM_VIDC_DECODER)
+		index = 0;
+	else if (type == MSM_VIDC_ENCODER)
+		index = 1;
+	else
+		return;
+
+
+#ifdef CONFIG_MEDIA_CONTROLLER
+	v4l2_m2m_unregister_media_controller(core->vdev[index].m2m_dev);
+	v4l2_m2m_release(core->vdev[index].m2m_dev);
+#endif
+	//rc = device_create_file(&core->vdev[index].vdev.dev, &dev_attr_link_name);
+	video_set_drvdata(&core->vdev[index].vdev, NULL);
+	video_unregister_device(&core->vdev[index].vdev);
+	//memset vdev to 0
+}
+
+static int msm_vidc_register_video_device(struct msm_vidc_core *core,
+		enum msm_vidc_domain_type type, int nr)
+{
+	int rc = 0;
+	int index, media_index;
+
+	d_vpr_h("%s: domain %d\n", __func__, type);
+
+	if (type == MSM_VIDC_DECODER) {
+		index = 0;
+		media_index = MEDIA_ENT_F_PROC_VIDEO_DECODER;
+	} else if (type == MSM_VIDC_ENCODER) {
+		index = 1;
+		media_index = MEDIA_ENT_F_PROC_VIDEO_ENCODER;
+	} else {
+		return -EINVAL;
+	}
+
+	core->vdev[index].vdev.release =
+		msm_vidc_release_video_device;
+	core->vdev[index].vdev.fops = core->v4l2_file_ops;
+	if (type == MSM_VIDC_DECODER)
+		core->vdev[index].vdev.ioctl_ops = core->v4l2_ioctl_ops_dec;
+	else
+		core->vdev[index].vdev.ioctl_ops = core->v4l2_ioctl_ops_enc;
+	core->vdev[index].vdev.vfl_dir = VFL_DIR_M2M;
+	core->vdev[index].type = type;
+	core->vdev[index].vdev.v4l2_dev = &core->v4l2_dev;
+	core->vdev[index].vdev.device_caps = core->capabilities[DEVICE_CAPS].value;
+	rc = video_register_device(&core->vdev[index].vdev,
+					VFL_TYPE_VIDEO, nr);
+	if (rc) {
+		d_vpr_e("Failed to register the video device\n");
+		return rc;
+	}
+	video_set_drvdata(&core->vdev[index].vdev, core);
+	//rc = device_create_file(&core->vdev[index].vdev.dev, &dev_attr_link_name);
+	if (rc) {
+		d_vpr_e("Failed to create video device file\n");
+		goto video_reg_failed;
+	}
+#ifdef CONFIG_MEDIA_CONTROLLER
+	core->vdev[index].m2m_dev = v4l2_m2m_init(core->v4l2_m2m_ops);
+	if (IS_ERR(core->vdev[index].m2m_dev)) {
+		d_vpr_e("Failed to initialize V4L2 M2M device\n");
+		rc = PTR_ERR(core->vdev[index].m2m_dev);
+		goto m2m_init_failed;
+	}
+	rc = v4l2_m2m_register_media_controller(core->vdev[index].m2m_dev,
+			&core->vdev[index].vdev, media_index);
+	if (rc) {
+		d_vpr_e("%s: m2m_dev controller register failed for session type %d\n",
+			__func__, index);
+		goto m2m_mc_failed;
+	}
+#endif
+
+	return 0;
+#ifdef CONFIG_MEDIA_CONTROLLER
+m2m_mc_failed:
+	v4l2_m2m_release(core->vdev[index].m2m_dev);
+m2m_init_failed:
+#endif
+video_reg_failed:
+	video_unregister_device(&core->vdev[index].vdev);
+
+	return rc;
+}
+
+static int msm_vidc_initialize_media(struct msm_vidc_core *core)
+{
+	int rc = 0, nr = BASE_DEVICE_NUMBER;
+
+	rc = v4l2_device_register(&core->pdev->dev, &core->v4l2_dev);
+	if (rc) {
+		d_vpr_e("Failed to register v4l2 device\n");
+		return -EINVAL;
+	}
+
+#ifdef CONFIG_MEDIA_CONTROLLER
+	core->media_dev.dev = &core->pdev->dev;
+	strscpy(core->media_dev.model, "msm_vidc_media", sizeof(core->media_dev.model));
+	media_device_init(&core->media_dev);
+	core->media_dev.ops = core->media_device_ops;
+	core->v4l2_dev.mdev = &core->media_dev;
+#endif
+
+	/* setup the decoder device */
+	rc = msm_vidc_register_video_device(core, MSM_VIDC_DECODER, nr);
+	if (rc) {
+		d_vpr_e("Failed to register video decoder\n");
+		goto dec_reg_failed;
+	}
+
+	/* setup the encoder device */
+	rc = msm_vidc_register_video_device(core, MSM_VIDC_ENCODER, nr + 1);
+	if (rc) {
+		d_vpr_e("Failed to register video encoder\n");
+		goto enc_reg_failed;
+	}
+#ifdef CONFIG_MEDIA_CONTROLLER
+	rc = media_device_register(&core->media_dev);
+	if (rc) {
+		d_vpr_e("%s: media_device_register failed with %d\n", __func__, rc);
+		goto media_reg_failed;
+	}
+#endif
+
+	return rc;
+#ifdef CONFIG_MEDIA_CONTROLLER
+media_reg_failed:
+#endif
+	msm_vidc_unregister_video_device(core, MSM_VIDC_ENCODER);
+enc_reg_failed:
+	msm_vidc_unregister_video_device(core, MSM_VIDC_DECODER);
+dec_reg_failed:
+#ifdef CONFIG_MEDIA_CONTROLLER
+	media_device_cleanup(&core->media_dev);
+#endif
+	v4l2_device_unregister(&core->v4l2_dev);
+
+	return rc;
+}
+
+static int msm_vidc_deinitialize_media(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+#ifdef CONFIG_MEDIA_CONTROLLER
+	media_device_unregister(&core->media_dev);
+#endif
+	msm_vidc_unregister_video_device(core, MSM_VIDC_ENCODER);
+	msm_vidc_unregister_video_device(core, MSM_VIDC_DECODER);
+#ifdef CONFIG_MEDIA_CONTROLLER
+	media_device_cleanup(&core->media_dev);
+#endif
+	v4l2_device_unregister(&core->v4l2_dev);
+
+	return rc;
+}
+
+#ifdef CONFIG_MSM_MMRM
+static int msm_vidc_check_mmrm_support(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!is_mmrm_supported(core))
+		goto exit;
+
+	if (!mmrm_client_check_scaling_supported(MMRM_CLIENT_CLOCK, 0)) {
+		d_vpr_e("%s: MMRM not supported\n", __func__);
+		core->platform->data.supports_mmrm = 0;
+	}
+
+exit:
+	d_vpr_h("%s: %d\n", __func__, is_mmrm_supported(core));
+	return rc;
+}
+#else
+static int msm_vidc_check_mmrm_support(struct msm_vidc_core *core)
+{
+	core->platform->data.supports_mmrm = 0;
+
+	return 0;
+}
+#endif
+
+static int msm_vidc_deinitialize_core(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!core) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	d_vpr_h("%s()\n", __func__);
+
+	mutex_destroy(&core->lock);
+	msm_vidc_update_core_state(core, MSM_VIDC_CORE_DEINIT, __func__);
+
+	if (core->batch_workq)
+		destroy_workqueue(core->batch_workq);
+
+	if (core->pm_workq)
+		destroy_workqueue(core->pm_workq);
+
+	core->batch_workq = NULL;
+	core->pm_workq = NULL;
+
+	return rc;
+}
+
+static int msm_vidc_initialize_core(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	d_vpr_h("%s()\n", __func__);
+
+	msm_vidc_update_core_state(core, MSM_VIDC_CORE_DEINIT, __func__);
+
+	core->pm_workq = create_singlethread_workqueue("pm_workq");
+	if (!core->pm_workq) {
+		d_vpr_e("%s: create pm workq failed\n", __func__);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	core->batch_workq = create_singlethread_workqueue("batch_workq");
+	if (!core->batch_workq) {
+		d_vpr_e("%s: create batch workq failed\n", __func__);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	core->packet_size = VIDC_IFACEQ_VAR_HUGE_PKT_SIZE;
+	core->packet = devm_kzalloc(&core->pdev->dev, core->packet_size, GFP_KERNEL);
+	if (!core->packet) {
+		d_vpr_e("%s: failed to alloc core packet\n", __func__);
+		rc = -ENOMEM;
+		goto exit;
+	}
+
+	core->response_packet = devm_kzalloc(&core->pdev->dev, core->packet_size, GFP_KERNEL);
+	if (!core->packet) {
+		d_vpr_e("%s: failed to alloc core response packet\n", __func__);
+		rc = -ENOMEM;
+		goto exit;
+	}
+
+	mutex_init(&core->lock);
+	INIT_LIST_HEAD(&core->instances);
+	INIT_LIST_HEAD(&core->dangling_instances);
+
+	INIT_DELAYED_WORK(&core->pm_work, venus_hfi_pm_work_handler);
+	INIT_DELAYED_WORK(&core->fw_unload_work, msm_vidc_fw_unload_handler);
+	INIT_WORK(&core->ssr_work, msm_vidc_ssr_handler);
+
+	return 0;
+exit:
+	if (core->batch_workq)
+		destroy_workqueue(core->batch_workq);
+	if (core->pm_workq)
+		destroy_workqueue(core->pm_workq);
+	core->batch_workq = NULL;
+	core->pm_workq = NULL;
+
+	return rc;
+}
+
+static void msm_vidc_devm_deinit_core(void *res)
+{
+	struct msm_vidc_core *core = res;
+
+	d_vpr_h("%s()\n", __func__);
+	msm_vidc_deinitialize_core(core);
+}
+
+static int msm_vidc_devm_init_core(struct device *dev, struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!dev || !core) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	rc = msm_vidc_initialize_core(core);
+	if (rc) {
+		d_vpr_e("%s: init failed with %d\n", __func__, rc);
+		return rc;
+	}
+
+	rc = devm_add_action_or_reset(dev, msm_vidc_devm_deinit_core, (void *)core);
+	if (rc)
+		return -EINVAL;
+
+	return rc;
+}
+
+static void msm_vidc_devm_debugfs_put(void *res)
+{
+	struct dentry *parent = res;
+
+	d_vpr_h("%s()\n", __func__);
+	debugfs_remove_recursive(parent);
+}
+
+static struct dentry *msm_vidc_devm_debugfs_get(struct device *dev)
+{
+	struct dentry *parent = NULL;
+	int rc = 0;
+
+	if (!dev) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return NULL;
+	}
+
+	parent = msm_vidc_debugfs_init_drv();
+	if (!parent)
+		return NULL;
+
+	rc = devm_add_action_or_reset(dev, msm_vidc_devm_debugfs_put, (void *)parent);
+	if (rc)
+		return NULL;
+
+	return parent;
+}
+
+static int msm_vidc_setup_context_bank(struct msm_vidc_core *core,
+	struct device *dev)
+{
+	struct context_bank_info *cb = NULL;
+	int rc = 0;
+
+	cb = msm_vidc_get_context_bank_for_device(core, dev);
+	if (!cb) {
+		d_vpr_e("%s: Failed to get context bank device for %s\n",
+			 __func__, dev_name(dev));
+		return -EIO;
+	}
+
+	/* populate dev & domain field */
+	cb->dev = dev;
+	cb->domain = iommu_get_domain_for_dev(cb->dev);
+	if (!cb->domain) {
+		d_vpr_e("%s: Failed to get iommu domain for %s\n", __func__, dev_name(dev));
+		return -EIO;
+	}
+
+	if (cb->dma_mask) {
+		rc = dma_set_mask_and_coherent(cb->dev, cb->dma_mask);
+		if (rc) {
+			d_vpr_e("%s: dma_set_mask_and_coherent failed\n", __func__);
+			return rc;
+		}
+	}
+
+	/*
+	 * When memory is fragmented, below configuration increases the
+	 * possibility to get a mapping for buffer in the configured CB.
+	 */
+
+	/* remove kernel version condition once below api is whitelisted in pineapple */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 16, 0))
+	iommu_dma_enable_best_fit_algo(cb->dev);
+#endif
+
+	/*
+	 * configure device segment size and segment boundary to ensure
+	 * iommu mapping returns one mapping (which is required for partial
+	 * cache operations)
+	 */
+	if (!dev->dma_parms)
+		dev->dma_parms =
+			devm_kzalloc(dev, sizeof(*dev->dma_parms), GFP_KERNEL);
+	dma_set_max_seg_size(dev, (unsigned int)DMA_BIT_MASK(32));
+	dma_set_seg_boundary(dev, (unsigned long)DMA_BIT_MASK(64));
+
+	iommu_set_fault_handler(cb->domain,
+		msm_vidc_smmu_fault_handler, (void *)core);
+
+	d_vpr_h(
+		"%s: name %s addr start %x size %x secure %d dma_coherant %d "
+		"region %d dev_name %s domain %pK dma_mask %llu\n",
+		__func__, cb->name, cb->addr_range.start,
+		cb->addr_range.size, cb->secure, cb->dma_coherant,
+		cb->region, dev_name(cb->dev), cb->domain, cb->dma_mask);
+
+	return rc;
+}
+
+static int msm_vidc_component_compare_of(struct device *dev, void *data)
+{
+	return dev->of_node == data;
+}
+
+static void msm_vidc_component_release_of(struct device *dev, void *data)
+{
+	d_vpr_h("%s(): %s\n", __func__, of_node_full_name(data));
+	of_node_put(data);
+}
+
+static int msm_vidc_component_bind(struct device *dev,
+	struct device *parent, void *data)
+{
+	struct msm_vidc_core *core;
+	int rc = 0;
+
+	if (!dev || !parent || !data) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = (struct msm_vidc_core *)data;
+
+	if (!dev->parent || dev->parent != parent) {
+		d_vpr_e("%s: failed to find a parent for %s\n",
+			__func__, dev_name(dev));
+		return -ENODEV;
+	}
+
+	rc = msm_vidc_setup_context_bank(core, dev);
+	if (rc) {
+		d_vpr_e("%s: Failed to probe context bank - %s\n",
+			__func__, dev_name(dev));
+		return rc;
+	}
+
+	d_vpr_h("%s: Successfully probed context bank - %s\n",
+		__func__, dev_name(dev));
+
+	return rc;
+}
+
+static void msm_vidc_component_unbind(struct device *dev,
+	struct device *parent, void *data)
+{
+	d_vpr_h("%s(): %s\n", __func__, dev_name(dev));
+}
+
+static int msm_vidc_component_master_bind(struct device *dev)
+{
+	struct msm_vidc_core *core = dev_get_drvdata(dev);
+	int rc = 0;
+
+	d_vpr_h("%s(): %s\n", __func__, dev_name(dev));
+
+	rc = component_bind_all(dev, core);
+	if (rc) {
+		d_vpr_e("%s: sub-device bind failed. rc %d\n", __func__, rc);
+		return rc;
+	}
+
+	if (core->capabilities[SUPPORTS_SYNX_FENCE].value) {
+		if (msm_vidc_synx_fence_enable) {
+			/* register for synx fence */
+			rc = call_fence_op(core, fence_register, core);
+			if (rc) {
+				d_vpr_e("%s: failed to register synx fence\n",
+					__func__);
+				core->capabilities[SUPPORTS_SYNX_FENCE].value = 0;
+				return rc;
+			}
+		} else {
+			/* override synx fence ops with dma fence ops */
+			core->fence_ops = get_dma_fence_ops();
+			if (!core->fence_ops) {
+				d_vpr_e("%s: invalid dma fence ops\n", __func__);
+				return -EINVAL;
+			}
+			core->capabilities[SUPPORTS_SYNX_FENCE].value = 0;
+		}
+	}
+
+	rc = msm_vidc_initialize_media(core);
+	if (rc) {
+		d_vpr_e("%s: media initialization failed\n", __func__);
+		return rc;
+	}
+
+	rc = venus_hfi_queue_init(core);
+	if (rc) {
+		d_vpr_e("%s: interface queues init failed\n", __func__);
+		goto queues_deinit;
+	}
+
+	rc = msm_vidc_core_init(core);
+	if (rc) {
+		d_vpr_e("%s: sys init failed\n", __func__);
+		goto queues_deinit;
+	}
+
+	d_vpr_h("%s(): succssful\n", __func__);
+
+	return 0;
+
+queues_deinit:
+	venus_hfi_queue_deinit(core);
+	/**
+	 * queues and core can be inited again during session_open.
+	 * So don't declare as probe failure.
+	 */
+	return 0;
+}
+
+static void msm_vidc_component_master_unbind(struct device *dev)
+{
+	struct msm_vidc_core *core = dev_get_drvdata(dev);
+
+	d_vpr_h("%s(): %s\n", __func__, dev_name(dev));
+
+	msm_vidc_core_deinit(core, true);
+	venus_hfi_queue_deinit(core);
+	msm_vidc_deinitialize_media(core);
+	call_fence_op(core, fence_deregister, core);
+	component_unbind_all(dev, core);
+
+	d_vpr_h("%s(): succssful\n", __func__);
+}
+
+static const struct component_ops msm_vidc_component_ops = {
+	.bind           = msm_vidc_component_bind,
+	.unbind         = msm_vidc_component_unbind,
+};
+
+static const struct component_master_ops msm_vidc_component_master_ops = {
+	.bind           = msm_vidc_component_master_bind,
+	.unbind         = msm_vidc_component_master_unbind,
+};
+
+static int msm_vidc_remove_video_device(struct platform_device *pdev)
+{
+	struct msm_vidc_core *core;
+
+	if (!pdev) {
+		d_vpr_e("%s: invalid input %pK", __func__, pdev);
+		return -EINVAL;
+	}
+
+	core = dev_get_drvdata(&pdev->dev);
+	if (!core) {
+		d_vpr_e("%s: invalid core\n", __func__);
+		return -EINVAL;
+	}
+
+	d_vpr_h("%s()\n", __func__);
+
+	/* destroy component master and deallocate match data */
+	component_master_del(&pdev->dev, &msm_vidc_component_master_ops);
+
+	d_vpr_h("depopulating sub devices\n");
+	/*
+	 * Trigger remove for each sub-device i.e. qcom,context-bank,xxxx
+	 * When msm_vidc_remove is called for each sub-device, destroy
+	 * context-bank mappings.
+	 */
+	of_platform_depopulate(&pdev->dev);
+
+	sysfs_remove_group(&pdev->dev.kobj, &msm_vidc_core_attr_group);
+
+	dev_set_drvdata(&pdev->dev, NULL);
+	g_core = NULL;
+	d_vpr_h("%s(): succssful\n", __func__);
+
+	return 0;
+}
+
+static int msm_vidc_remove_context_bank(struct platform_device *pdev)
+{
+	d_vpr_h("%s(): %s\n", __func__, dev_name(&pdev->dev));
+
+	component_del(&pdev->dev, &msm_vidc_component_ops);
+
+	return 0;
+}
+
+static int msm_vidc_remove(struct platform_device *pdev)
+{
+	/*
+	 * Sub devices remove will be triggered by of_platform_depopulate()
+	 * after core_deinit(). It return immediately after completing
+	 * sub-device remove.
+	 */
+	if (is_video_device(&pdev->dev))
+		return msm_vidc_remove_video_device(pdev);
+	else if (is_video_context_bank_device(&pdev->dev))
+		return msm_vidc_remove_context_bank(pdev);
+
+	/* How did we end up here? */
+	WARN_ON(1);
+	return -EINVAL;
+}
+
+static int msm_vidc_probe_video_device(struct platform_device *pdev)
+{
+	int rc = 0;
+	struct component_match *match = NULL;
+	struct msm_vidc_core *core = NULL;
+	struct device_node *child = NULL;
+	int cb_count = 0;
+
+	d_vpr_h("%s: %s\n", __func__, dev_name(&pdev->dev));
+
+	core = devm_kzalloc(&pdev->dev, sizeof(struct msm_vidc_core), GFP_KERNEL);
+	if (!core) {
+		d_vpr_e("%s: failed to alloc memory for core\n", __func__);
+		return -ENOMEM;
+	}
+	g_core = core;
+
+	core->pdev = pdev;
+	dev_set_drvdata(&pdev->dev, core);
+
+	core->debugfs_parent = msm_vidc_devm_debugfs_get(&pdev->dev);
+	if (!core->debugfs_parent)
+		d_vpr_h("Failed to create debugfs for msm_vidc\n");
+
+	rc = msm_vidc_devm_init_core(&pdev->dev, core);
+	if (rc) {
+		d_vpr_e("%s: init core failed with %d\n", __func__, rc);
+		goto init_core_failed;
+	}
+
+	rc = msm_vidc_init_platform(core);
+	if (rc) {
+		d_vpr_e("%s: init platform failed with %d\n", __func__, rc);
+		rc = -EINVAL;
+		goto init_plat_failed;
+	}
+
+	rc = msm_vidc_init_resources(core);
+	if (rc) {
+		d_vpr_e("%s: init resource failed with %d\n", __func__, rc);
+		goto init_res_failed;
+	}
+
+	rc = msm_vidc_init_core_caps(core);
+	if (rc) {
+		d_vpr_e("%s: init core caps failed with %d\n", __func__, rc);
+		goto init_res_failed;
+	}
+
+	rc = msm_vidc_init_instance_caps(core);
+	if (rc) {
+		d_vpr_e("%s: init inst cap failed with %d\n", __func__, rc);
+		goto init_inst_caps_fail;
+	}
+
+	rc = sysfs_create_group(&pdev->dev.kobj, &msm_vidc_core_attr_group);
+	if (rc) {
+		d_vpr_e("Failed to create attributes\n");
+		goto init_group_failed;
+	}
+
+	rc = msm_vidc_check_mmrm_support(core);
+	if (rc) {
+		d_vpr_e("Failed to check MMRM scaling support\n");
+		rc = 0; /* Ignore error */
+	}
+
+	core->debugfs_root = msm_vidc_debugfs_init_core(core);
+	if (!core->debugfs_root)
+		d_vpr_h("Failed to init debugfs core\n");
+
+	/* registering sub-device with component model framework */
+	for_each_available_child_of_node(pdev->dev.of_node, child) {
+		/* consider only context bank devices */
+		if (!is_video_context_bank_device_node(child))
+			continue;
+
+		/* take refcount on device node */
+		of_node_get(child);
+
+		/* add entry into component_match array */
+		component_match_add_release(&pdev->dev, &match, msm_vidc_component_release_of,
+			msm_vidc_component_compare_of, child);
+		if (IS_ERR(match)) {
+			of_node_put(child);
+			rc = PTR_ERR(match) ? PTR_ERR(match) : -ENOMEM;
+			d_vpr_e("%s: component match add release failed\n", __func__);
+			goto sub_dev_failed;
+		}
+
+		/* count context bank devices */
+		cb_count++;
+	}
+
+	d_vpr_h("populating sub devices. count %d\n", cb_count);
+	/*
+	 * Trigger probe for each sub-device i.e. qcom,msm-vidc,context-bank.
+	 * When msm_vidc_probe is called for each sub-device, parse the
+	 * context-bank details.
+	 */
+	rc = of_platform_populate(pdev->dev.of_node, msm_vidc_dt_match, NULL,
+			&pdev->dev);
+	if (rc) {
+		d_vpr_e("Failed to trigger probe for sub-devices\n");
+		goto sub_dev_failed;
+	}
+
+	/**
+	 * create and try to bring up aggregate device for master.
+	 * match is a component_match_array and acts as a placeholder for
+	 * components added via component_add().
+	 */
+	rc = component_master_add_with_match(&pdev->dev, &msm_vidc_component_master_ops, match);
+	if (rc) {
+		d_vpr_e("%s: component master add with match failed\n", __func__);
+		goto master_add_failed;
+	}
+
+	d_vpr_h("%s(): succssful\n", __func__);
+
+	return rc;
+
+master_add_failed:
+	of_platform_depopulate(&pdev->dev);
+sub_dev_failed:
+	sysfs_remove_group(&pdev->dev.kobj, &msm_vidc_core_attr_group);
+init_group_failed:
+init_inst_caps_fail:
+init_res_failed:
+init_plat_failed:
+init_core_failed:
+	dev_set_drvdata(&pdev->dev, NULL);
+	g_core = NULL;
+
+	return rc;
+}
+
+static int msm_vidc_probe_context_bank(struct platform_device *pdev)
+{
+	d_vpr_h("%s(): %s\n", __func__, dev_name(&pdev->dev));
+
+	return component_add(&pdev->dev, &msm_vidc_component_ops);
+}
+
+static int msm_vidc_probe(struct platform_device *pdev)
+{
+	d_vpr_h("%s()\n", __func__);
+
+	if (!pdev) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	/*
+	 * Sub devices probe will be triggered by of_platform_populate() towards
+	 * the end of the probe function after msm-vidc device probe is
+	 * completed. Return immediately after completing sub-device probe.
+	 */
+	if (is_video_device(&pdev->dev))
+		return msm_vidc_probe_video_device(pdev);
+	else if (is_video_context_bank_device(&pdev->dev))
+		return msm_vidc_probe_context_bank(pdev);
+
+	/* How did we end up here? */
+	WARN_ON(1);
+	return -EINVAL;
+}
+
+static int msm_vidc_pm_suspend(struct device *dev)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	enum msm_vidc_allow allow = MSM_VIDC_DISALLOW;
+
+	/*
+	 * Bail out if
+	 * - driver possibly not probed yet
+	 * - not the main device. We don't support power management on
+	 *   subdevices (e.g. context banks)
+	 */
+	if (!dev || !dev->driver || !is_video_device(dev))
+		return 0;
+
+	core = dev_get_drvdata(dev);
+	if (!core) {
+		d_vpr_e("%s: invalid core\n", __func__);
+		return -EINVAL;
+	}
+
+	core_lock(core, __func__);
+	allow = msm_vidc_allow_pm_suspend(core);
+
+	if (allow == MSM_VIDC_IGNORE) {
+		d_vpr_h("%s: pm already suspended\n", __func__);
+		msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_PM_SUSPEND, __func__);
+		rc = 0;
+		goto unlock;
+	} else if (allow != MSM_VIDC_ALLOW) {
+		d_vpr_h("%s: pm suspend not allowed\n", __func__);
+		rc = 0;
+		goto unlock;
+	}
+
+	d_vpr_h("%s\n", __func__);
+	rc = msm_vidc_suspend(core);
+	if (rc == -ENOTSUPP)
+		rc = 0;
+	else if (rc)
+		d_vpr_e("Failed to suspend: %d\n", rc);
+	else
+		msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_PM_SUSPEND, __func__);
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+static int msm_vidc_pm_resume(struct device *dev)
+{
+	struct msm_vidc_core *core;
+
+	/*
+	 * Bail out if
+	 * - driver possibly not probed yet
+	 * - not the main device. We don't support power management on
+	 *   subdevices (e.g. context banks)
+	 */
+	if (!dev || !dev->driver || !is_video_device(dev))
+		return 0;
+
+	core = dev_get_drvdata(dev);
+	if (!core) {
+		d_vpr_e("%s: invalid core\n", __func__);
+		return -EINVAL;
+	}
+
+	d_vpr_h("%s\n", __func__);
+
+	/* remove PM suspend from core sub_state */
+	core_lock(core, __func__);
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_PM_SUSPEND, 0, __func__);
+	core_unlock(core, __func__);
+
+	return 0;
+}
+
+static const struct dev_pm_ops msm_vidc_pm_ops = {
+	SET_SYSTEM_SLEEP_PM_OPS(msm_vidc_pm_suspend, msm_vidc_pm_resume)
+};
+
+struct platform_driver msm_vidc_driver = {
+	.probe = msm_vidc_probe,
+	.remove = msm_vidc_remove,
+	.driver = {
+		.name = "msm_vidc_v4l2",
+		.of_match_table = msm_vidc_dt_match,
+		.pm = &msm_vidc_pm_ops,
+		.probe_type = PROBE_PREFER_ASYNCHRONOUS,
+	},
+};
+
+static int __init msm_vidc_init(void)
+{
+	int rc = 0;
+
+	d_vpr_h("%s: %s\n", __func__, video_banner);
+
+	rc = platform_driver_register(&msm_vidc_driver);
+	if (rc) {
+		d_vpr_e("Failed to register platform driver\n");
+		return rc;
+	}
+	d_vpr_h("%s(): succssful\n", __func__);
+
+	return 0;
+}
+
+static void __exit msm_vidc_exit(void)
+{
+	d_vpr_h("%s()\n", __func__);
+
+	platform_driver_unregister(&msm_vidc_driver);
+	d_vpr_h("%s(): succssful\n", __func__);
+}
+
+module_init(msm_vidc_init);
+module_exit(msm_vidc_exit);
+
+MODULE_SOFTDEP("pre: subsys-pil-tz msm-mmrm");
+MODULE_LICENSE("GPL v2");
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_state.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_state.c
@@ -0,0 +1,1559 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_control.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_state.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_vb2.h"
+#include "msm_vidc.h"
+#include "msm_vidc_events.h"
+#include "venus_hfi.h"
+
+bool core_in_valid_state(struct msm_vidc_core *core)
+{
+	return (core->state == MSM_VIDC_CORE_INIT ||
+		core->state == MSM_VIDC_CORE_INIT_WAIT);
+}
+
+bool is_core_state(struct msm_vidc_core *core, enum msm_vidc_core_state state)
+{
+	return core->state == state;
+}
+
+bool is_drc_pending(struct msm_vidc_inst *inst)
+{
+	return is_sub_state(inst, MSM_VIDC_DRC) &&
+		is_sub_state(inst, MSM_VIDC_DRC_LAST_BUFFER);
+}
+
+bool is_drain_pending(struct msm_vidc_inst *inst)
+{
+	return is_sub_state(inst, MSM_VIDC_DRAIN) &&
+		is_sub_state(inst, MSM_VIDC_DRAIN_LAST_BUFFER);
+}
+
+static const char * const core_state_name_arr[] =
+	FOREACH_CORE_STATE(GENERATE_STRING);
+
+const char *core_state_name(enum msm_vidc_core_state state)
+{
+	const char *name = "UNKNOWN STATE";
+
+	if (state >= ARRAY_SIZE(core_state_name_arr))
+		goto exit;
+
+	name = core_state_name_arr[state];
+
+exit:
+	return name;
+}
+
+static const char * const event_name_arr[] =
+	FOREACH_EVENT(GENERATE_STRING);
+
+static const char *event_name(enum msm_vidc_event event)
+{
+	const char *name = "UNKNOWN EVENT";
+
+	if (event >= ARRAY_SIZE(event_name_arr))
+		goto exit;
+
+	name = event_name_arr[event];
+
+exit:
+	return name;
+}
+
+static int __strict_inst_check(struct msm_vidc_inst *inst, const char *function)
+{
+	bool fatal = !mutex_is_locked(&inst->lock);
+
+	WARN_ON(fatal);
+
+	return fatal ? -EINVAL : 0;
+}
+
+static int msm_vidc_core_deinit_state(struct msm_vidc_core *core,
+	enum msm_vidc_core_event_type type,
+	struct msm_vidc_event_data *data)
+{
+	int rc = 0;
+
+	switch (type) {
+	case CORE_EVENT_UPDATE_SUB_STATE:
+	{
+		u32 req_sub_state;
+		u32 allow_mask = -1;
+
+		req_sub_state = data->edata.uval;
+
+		/* none of the requested substate supported */
+		if (!(req_sub_state & allow_mask)) {
+			d_vpr_e("%s: invalid substate update request %#x\n",
+				__func__, req_sub_state);
+			return -EINVAL;
+		}
+
+		/* update core substate */
+		core->sub_state |= req_sub_state & allow_mask;
+		return rc;
+	}
+	default: {
+		d_vpr_e("%s: unexpected core event type %u\n",
+			__func__, type);
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+static int msm_vidc_core_init_wait_state(struct msm_vidc_core *core,
+	enum msm_vidc_core_event_type type,
+	struct msm_vidc_event_data *data)
+{
+	int rc = 0;
+
+	switch (type) {
+	case CORE_EVENT_UPDATE_SUB_STATE:
+	{
+		u32 req_sub_state;
+		u32 allow_mask = -1;
+
+		req_sub_state = data->edata.uval;
+
+		/* none of the requested substate supported */
+		if (!(req_sub_state & allow_mask)) {
+			d_vpr_e("%s: invalid substate update request %#x\n",
+				__func__, req_sub_state);
+			return -EINVAL;
+		}
+
+		/* update core substate */
+		core->sub_state |= req_sub_state & allow_mask;
+		return rc;
+	}
+	default: {
+		d_vpr_e("%s: unexpected core event type %u\n",
+			__func__, type);
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+static int msm_vidc_core_init_state(struct msm_vidc_core *core,
+	enum msm_vidc_core_event_type type,
+	struct msm_vidc_event_data *data)
+{
+	int rc = 0;
+
+	switch (type) {
+	case CORE_EVENT_UPDATE_SUB_STATE:
+	{
+		u32 req_sub_state;
+		u32 allow_mask = -1;
+
+		req_sub_state = data->edata.uval;
+
+		/* none of the requested substate supported */
+		if (!(req_sub_state & allow_mask)) {
+			d_vpr_e("%s: invalid substate update request %#x\n",
+				__func__, req_sub_state);
+			return -EINVAL;
+		}
+
+		/* update core substate */
+		core->sub_state |= req_sub_state & allow_mask;
+		return rc;
+	}
+	default: {
+		d_vpr_e("%s: unexpected core event type %u\n",
+			__func__, type);
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+static int msm_vidc_core_error_state(struct msm_vidc_core *core,
+	enum msm_vidc_core_event_type type,
+	struct msm_vidc_event_data *data)
+{
+	int rc = 0;
+
+	switch (type) {
+	case CORE_EVENT_UPDATE_SUB_STATE:
+	{
+		u32 req_sub_state;
+		u32 allow_mask = -1;
+
+		req_sub_state = data->edata.uval;
+
+		/* none of the requested substate supported */
+		if (!(req_sub_state & allow_mask)) {
+			d_vpr_e("%s: invalid substate update request %#x\n",
+				__func__, req_sub_state);
+			return -EINVAL;
+		}
+
+		/* update core substate */
+		core->sub_state |= req_sub_state & allow_mask;
+		return rc;
+	}
+	default: {
+		d_vpr_e("%s: unexpected core event type %u\n",
+			__func__, type);
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+struct msm_vidc_core_state_handle {
+	enum msm_vidc_core_state   state;
+	int                      (*handle)(struct msm_vidc_core *core,
+				   enum msm_vidc_core_event_type type,
+				   struct msm_vidc_event_data *data);
+};
+
+static struct msm_vidc_core_state_handle *msm_vidc_get_core_state_handle(
+	enum msm_vidc_core_state req_state)
+{
+	int cnt;
+	struct msm_vidc_core_state_handle *core_state_handle = NULL;
+	static struct msm_vidc_core_state_handle state_handle[] = {
+		{MSM_VIDC_CORE_DEINIT,      msm_vidc_core_deinit_state      },
+		{MSM_VIDC_CORE_INIT_WAIT,   msm_vidc_core_init_wait_state   },
+		{MSM_VIDC_CORE_INIT,        msm_vidc_core_init_state        },
+		{MSM_VIDC_CORE_ERROR,       msm_vidc_core_error_state       },
+	};
+
+	for (cnt = 0; cnt < ARRAY_SIZE(state_handle); cnt++) {
+		if (state_handle[cnt].state == req_state) {
+			core_state_handle = &state_handle[cnt];
+			break;
+		}
+	}
+
+	/* if req_state does not exist in the table */
+	if (cnt == ARRAY_SIZE(state_handle)) {
+		d_vpr_e("%s: invalid core state \"%s\" requested\n",
+			__func__, core_state_name(req_state));
+		return core_state_handle;
+	}
+
+	return core_state_handle;
+}
+
+int msm_vidc_update_core_state(struct msm_vidc_core *core,
+	enum msm_vidc_core_state request_state, const char *func)
+{
+	struct msm_vidc_core_state_handle *state_handle = NULL;
+	int rc = 0;
+
+	/* get core state handler for requested state */
+	state_handle = msm_vidc_get_core_state_handle(request_state);
+	if (!state_handle)
+		return -EINVAL;
+
+	d_vpr_h("%s: core state changed to %s from %s\n", func,
+		core_state_name(state_handle->state), core_state_name(core->state));
+
+	/* finally update core state and handler */
+	core->state = state_handle->state;
+	core->state_handle = state_handle->handle;
+
+	return rc;
+}
+
+struct msm_vidc_core_state_allow {
+	enum msm_vidc_core_state   from;
+	enum msm_vidc_core_state   to;
+	enum msm_vidc_allow        allow;
+};
+
+enum msm_vidc_allow msm_vidc_allow_core_state_change(
+	struct msm_vidc_core *core,
+	enum msm_vidc_core_state req_state)
+{
+	int cnt;
+	enum msm_vidc_allow allow = MSM_VIDC_DISALLOW;
+	static struct msm_vidc_core_state_allow state[] = {
+		/* from, to, allow */
+		{MSM_VIDC_CORE_DEINIT,      MSM_VIDC_CORE_DEINIT,      MSM_VIDC_IGNORE    },
+		{MSM_VIDC_CORE_DEINIT,      MSM_VIDC_CORE_INIT_WAIT,   MSM_VIDC_ALLOW     },
+		{MSM_VIDC_CORE_DEINIT,      MSM_VIDC_CORE_INIT,        MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_CORE_DEINIT,      MSM_VIDC_CORE_ERROR,       MSM_VIDC_IGNORE    },
+		{MSM_VIDC_CORE_INIT_WAIT,   MSM_VIDC_CORE_DEINIT,      MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_CORE_INIT_WAIT,   MSM_VIDC_CORE_INIT_WAIT,   MSM_VIDC_IGNORE    },
+		{MSM_VIDC_CORE_INIT_WAIT,   MSM_VIDC_CORE_INIT,        MSM_VIDC_ALLOW     },
+		{MSM_VIDC_CORE_INIT_WAIT,   MSM_VIDC_CORE_ERROR,       MSM_VIDC_ALLOW     },
+		{MSM_VIDC_CORE_INIT,        MSM_VIDC_CORE_DEINIT,      MSM_VIDC_ALLOW     },
+		{MSM_VIDC_CORE_INIT,        MSM_VIDC_CORE_INIT_WAIT,   MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_CORE_INIT,        MSM_VIDC_CORE_INIT,        MSM_VIDC_IGNORE    },
+		{MSM_VIDC_CORE_INIT,        MSM_VIDC_CORE_ERROR,       MSM_VIDC_ALLOW     },
+		{MSM_VIDC_CORE_ERROR,       MSM_VIDC_CORE_DEINIT,      MSM_VIDC_ALLOW     },
+		{MSM_VIDC_CORE_ERROR,       MSM_VIDC_CORE_INIT_WAIT,   MSM_VIDC_IGNORE    },
+		{MSM_VIDC_CORE_ERROR,       MSM_VIDC_CORE_INIT,        MSM_VIDC_IGNORE    },
+		{MSM_VIDC_CORE_ERROR,       MSM_VIDC_CORE_ERROR,       MSM_VIDC_IGNORE    },
+	};
+
+	for (cnt = 0; cnt < ARRAY_SIZE(state); cnt++) {
+		if (state[cnt].from == core->state && state[cnt].to == req_state) {
+			allow = state[cnt].allow;
+			break;
+		}
+	}
+
+	return allow;
+}
+
+int msm_vidc_change_core_state(struct msm_vidc_core *core,
+	enum msm_vidc_core_state request_state, const char *func)
+{
+	enum msm_vidc_allow allow;
+	int rc = 0;
+
+	/* core must be locked */
+	rc = __strict_check(core, func);
+	if (rc) {
+		d_vpr_e("%s(): core was not locked\n", func);
+		return rc;
+	}
+
+	/* current and requested state is same */
+	if (core->state == request_state)
+		return 0;
+
+	/* check if requested state movement is allowed */
+	allow = msm_vidc_allow_core_state_change(core, request_state);
+	if (allow == MSM_VIDC_IGNORE) {
+		d_vpr_h("%s: %s core state change %s -> %s\n", func,
+			allow_name(allow), core_state_name(core->state),
+			core_state_name(request_state));
+		return 0;
+	} else if (allow == MSM_VIDC_DISALLOW) {
+		d_vpr_e("%s: %s core state change %s -> %s\n", func,
+			allow_name(allow), core_state_name(core->state),
+			core_state_name(request_state));
+		return -EINVAL;
+	}
+
+	/* go ahead and update core state */
+	rc = msm_vidc_update_core_state(core, request_state, func);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+bool is_core_sub_state(struct msm_vidc_core *core,
+	enum msm_vidc_core_sub_state sub_state)
+{
+	return !!(core->sub_state & sub_state);
+}
+
+const char *core_sub_state_name(enum msm_vidc_core_sub_state sub_state)
+{
+	switch (sub_state) {
+	case CORE_SUBSTATE_NONE:                 return "NONE ";
+	case CORE_SUBSTATE_GDSC_HANDOFF:         return "GDSC_HANDOFF ";
+	case CORE_SUBSTATE_PM_SUSPEND:           return "PM_SUSPEND ";
+	case CORE_SUBSTATE_FW_PWR_CTRL:          return "FW_PWR_CTRL ";
+	case CORE_SUBSTATE_POWER_ENABLE:         return "POWER_ENABLE ";
+	case CORE_SUBSTATE_PAGE_FAULT:           return "PAGE_FAULT ";
+	case CORE_SUBSTATE_CPU_WATCHDOG:         return "CPU_WATCHDOG ";
+	case CORE_SUBSTATE_VIDEO_UNRESPONSIVE:   return "VIDEO_UNRESPONSIVE ";
+	case CORE_SUBSTATE_MAX:                  return "MAX ";
+	}
+
+	return "UNKNOWN ";
+}
+
+static int prepare_core_sub_state_name(enum msm_vidc_core_sub_state sub_state,
+	char *buf, u32 size)
+{
+	int i = 0;
+
+	if (!buf || !size)
+		return -EINVAL;
+
+	strscpy(buf, "\0", size);
+	if (sub_state == CORE_SUBSTATE_NONE) {
+		strscpy(buf, "CORE_SUBSTATE_NONE", size);
+		return 0;
+	}
+
+	for (i = 0; BIT(i) < CORE_SUBSTATE_MAX; i++) {
+		if (sub_state & BIT(i))
+			strlcat(buf, core_sub_state_name(BIT(i)), size);
+	}
+
+	return 0;
+}
+
+static int msm_vidc_update_core_sub_state(struct msm_vidc_core *core,
+	enum msm_vidc_core_sub_state sub_state, const char *func)
+{
+	struct msm_vidc_event_data data;
+	char sub_state_name[MAX_NAME_LENGTH];
+	int ret = 0, rc = 0;
+
+	/* no substate update */
+	if (!sub_state)
+		return 0;
+
+	/* invoke update core substate event */
+	memset(&data, 0, sizeof(struct msm_vidc_event_data));
+	data.edata.uval = sub_state;
+	rc = core->state_handle(core, CORE_EVENT_UPDATE_SUB_STATE, &data);
+	if (rc) {
+		ret = prepare_core_sub_state_name(sub_state,
+			 sub_state_name, sizeof(sub_state_name) - 1);
+		if (!ret)
+			d_vpr_e("%s: state %s, requested invalid core substate %s\n",
+				func, core_state_name(core->state), sub_state_name);
+		return rc;
+	}
+
+	return rc;
+}
+
+int msm_vidc_change_core_sub_state(struct msm_vidc_core *core,
+		enum msm_vidc_core_sub_state clear_sub_state,
+		enum msm_vidc_core_sub_state set_sub_state, const char *func)
+{
+	int rc = 0;
+	enum msm_vidc_core_sub_state prev_sub_state;
+
+	/* core must be locked */
+	rc = __strict_check(core, func);
+	if (rc) {
+		d_vpr_e("%s(): core was not locked\n", func);
+		return rc;
+	}
+
+	/* sanitize core state handler */
+	if (!core->state_handle) {
+		d_vpr_e("%s: invalid core state handle\n", __func__);
+		return -EINVAL;
+	}
+
+	/* final value will not change */
+	if (clear_sub_state == set_sub_state)
+		return 0;
+
+	/* sanitize clear & set value */
+	if (set_sub_state > CORE_SUBSTATE_MAX ||
+		clear_sub_state > CORE_SUBSTATE_MAX) {
+		d_vpr_e("%s: invalid sub states. clear %#x or set %#x\n",
+			func, clear_sub_state, set_sub_state);
+		return -EINVAL;
+	}
+
+	prev_sub_state = core->sub_state;
+
+	/* set sub state */
+	rc = msm_vidc_update_core_sub_state(core, set_sub_state, func);
+	if (rc)
+		return rc;
+
+	/* check if all core substates updated */
+	if ((core->sub_state & set_sub_state) != set_sub_state)
+		d_vpr_e("%s: all substates not updated %#x, expected %#x\n",
+			func, core->sub_state & set_sub_state, set_sub_state);
+
+	/* clear sub state */
+	core->sub_state &= ~clear_sub_state;
+
+	/* print substates only when there is a change */
+	if (core->sub_state != prev_sub_state) {
+		rc = prepare_core_sub_state_name(core->sub_state, core->sub_state_name,
+			sizeof(core->sub_state_name) - 1);
+		if (!rc)
+			d_vpr_h("%s: core sub state changed to %s\n", func, core->sub_state_name);
+	}
+
+	return 0;
+}
+
+/* do not modify the state names as it is used in test scripts */
+static const char * const state_name_arr[] =
+	FOREACH_STATE(GENERATE_STRING);
+
+const char *state_name(enum msm_vidc_state state)
+{
+	const char *name = "UNKNOWN STATE";
+
+	if (state >= ARRAY_SIZE(state_name_arr))
+		goto exit;
+
+	name = state_name_arr[state];
+
+exit:
+	return name;
+}
+
+bool is_state(struct msm_vidc_inst *inst, enum msm_vidc_state state)
+{
+	return inst->state == state;
+}
+
+bool is_sub_state(struct msm_vidc_inst *inst, enum msm_vidc_sub_state sub_state)
+{
+	return (inst->sub_state & sub_state);
+}
+
+const char *sub_state_name(enum msm_vidc_sub_state sub_state)
+{
+	switch (sub_state) {
+	case MSM_VIDC_DRAIN:               return "DRAIN ";
+	case MSM_VIDC_DRC:                 return "DRC ";
+	case MSM_VIDC_DRAIN_LAST_BUFFER:   return "DRAIN_LAST_BUFFER ";
+	case MSM_VIDC_DRC_LAST_BUFFER:     return "DRC_LAST_BUFFER ";
+	case MSM_VIDC_INPUT_PAUSE:         return "INPUT_PAUSE ";
+	case MSM_VIDC_OUTPUT_PAUSE:        return "OUTPUT_PAUSE ";
+	case MSM_VIDC_FIRST_IPSC:          return "FIRST_IPSC ";
+	}
+
+	return "SUB_STATE_NONE";
+}
+
+static int prepare_sub_state_name(enum msm_vidc_sub_state sub_state,
+	char *buf, u32 size)
+{
+	int i = 0;
+
+	if (!buf || !size)
+		return -EINVAL;
+
+	strscpy(buf, "\0", size);
+	if (sub_state == MSM_VIDC_SUB_STATE_NONE) {
+		strscpy(buf, "SUB_STATE_NONE", size);
+		return 0;
+	}
+
+	for (i = 0; i < MSM_VIDC_MAX_SUB_STATES; i++) {
+		if (sub_state & BIT(i))
+			strlcat(buf, sub_state_name(BIT(i)), size);
+	}
+
+	return 0;
+}
+
+struct msm_vidc_state_allow {
+	enum msm_vidc_state        from;
+	enum msm_vidc_state        to;
+	enum msm_vidc_allow        allow;
+};
+
+static enum msm_vidc_allow msm_vidc_allow_state_change(
+	struct msm_vidc_inst *inst,
+	enum msm_vidc_state req_state)
+{
+	int cnt;
+	enum msm_vidc_allow allow = MSM_VIDC_DISALLOW;
+	static struct msm_vidc_state_allow state[] = {
+		/* from, to, allow */
+		{MSM_VIDC_OPEN,             MSM_VIDC_OPEN,               MSM_VIDC_IGNORE    },
+		{MSM_VIDC_OPEN,             MSM_VIDC_INPUT_STREAMING,    MSM_VIDC_ALLOW     },
+		{MSM_VIDC_OPEN,             MSM_VIDC_OUTPUT_STREAMING,   MSM_VIDC_ALLOW     },
+		{MSM_VIDC_OPEN,             MSM_VIDC_STREAMING,          MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_OPEN,             MSM_VIDC_CLOSE,              MSM_VIDC_ALLOW     },
+		{MSM_VIDC_OPEN,             MSM_VIDC_ERROR,              MSM_VIDC_ALLOW     },
+
+		{MSM_VIDC_INPUT_STREAMING,  MSM_VIDC_OPEN,               MSM_VIDC_ALLOW     },
+		{MSM_VIDC_INPUT_STREAMING,  MSM_VIDC_INPUT_STREAMING,    MSM_VIDC_IGNORE    },
+		{MSM_VIDC_INPUT_STREAMING,  MSM_VIDC_OUTPUT_STREAMING,   MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_INPUT_STREAMING,  MSM_VIDC_STREAMING,          MSM_VIDC_ALLOW     },
+		{MSM_VIDC_INPUT_STREAMING,  MSM_VIDC_CLOSE,              MSM_VIDC_ALLOW     },
+		{MSM_VIDC_INPUT_STREAMING,  MSM_VIDC_ERROR,              MSM_VIDC_ALLOW     },
+
+		{MSM_VIDC_OUTPUT_STREAMING, MSM_VIDC_OPEN,               MSM_VIDC_ALLOW     },
+		{MSM_VIDC_OUTPUT_STREAMING, MSM_VIDC_INPUT_STREAMING,    MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_OUTPUT_STREAMING, MSM_VIDC_OUTPUT_STREAMING,   MSM_VIDC_IGNORE    },
+		{MSM_VIDC_OUTPUT_STREAMING, MSM_VIDC_STREAMING,          MSM_VIDC_ALLOW     },
+		{MSM_VIDC_OUTPUT_STREAMING, MSM_VIDC_CLOSE,              MSM_VIDC_ALLOW     },
+		{MSM_VIDC_OUTPUT_STREAMING, MSM_VIDC_ERROR,              MSM_VIDC_ALLOW     },
+
+		{MSM_VIDC_STREAMING,        MSM_VIDC_OPEN,               MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_STREAMING,        MSM_VIDC_INPUT_STREAMING,    MSM_VIDC_ALLOW     },
+		{MSM_VIDC_STREAMING,        MSM_VIDC_OUTPUT_STREAMING,   MSM_VIDC_ALLOW     },
+		{MSM_VIDC_STREAMING,        MSM_VIDC_STREAMING,          MSM_VIDC_IGNORE    },
+		{MSM_VIDC_STREAMING,        MSM_VIDC_CLOSE,              MSM_VIDC_ALLOW     },
+		{MSM_VIDC_STREAMING,        MSM_VIDC_ERROR,              MSM_VIDC_ALLOW     },
+
+		{MSM_VIDC_CLOSE,            MSM_VIDC_OPEN,               MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_CLOSE,            MSM_VIDC_INPUT_STREAMING,    MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_CLOSE,            MSM_VIDC_OUTPUT_STREAMING,   MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_CLOSE,            MSM_VIDC_STREAMING,          MSM_VIDC_DISALLOW  },
+		{MSM_VIDC_CLOSE,            MSM_VIDC_CLOSE,              MSM_VIDC_IGNORE    },
+		{MSM_VIDC_CLOSE,            MSM_VIDC_ERROR,              MSM_VIDC_IGNORE    },
+
+		{MSM_VIDC_ERROR,            MSM_VIDC_OPEN,               MSM_VIDC_IGNORE    },
+		{MSM_VIDC_ERROR,            MSM_VIDC_INPUT_STREAMING,    MSM_VIDC_IGNORE    },
+		{MSM_VIDC_ERROR,            MSM_VIDC_OUTPUT_STREAMING,   MSM_VIDC_IGNORE    },
+		{MSM_VIDC_ERROR,            MSM_VIDC_STREAMING,          MSM_VIDC_IGNORE    },
+		{MSM_VIDC_ERROR,            MSM_VIDC_CLOSE,              MSM_VIDC_IGNORE    },
+		{MSM_VIDC_ERROR,            MSM_VIDC_ERROR,              MSM_VIDC_IGNORE    },
+	};
+
+	for (cnt = 0; cnt < ARRAY_SIZE(state); cnt++) {
+		if (state[cnt].from == inst->state && state[cnt].to == req_state) {
+			allow = state[cnt].allow;
+			break;
+		}
+	}
+
+	return allow;
+}
+
+static int msm_vidc_open_state(struct msm_vidc_inst *inst,
+	enum msm_vidc_event event, void *data)
+{
+	int rc = 0;
+
+	/* inst must be locked */
+	rc = __strict_inst_check(inst, __func__);
+	if (rc) {
+		i_vpr_e(inst, "%s(): inst was not locked\n", __func__);
+		return -EINVAL;
+	}
+
+	switch (event) {
+	case MSM_VIDC_TRY_FMT:
+	{
+		struct v4l2_format *f = (struct v4l2_format *)data;
+
+		/* allow try_fmt request in open state */
+		rc = msm_vidc_try_fmt(inst, f);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_S_FMT:
+	{
+		struct v4l2_format *f = (struct v4l2_format *)data;
+
+		/* allow s_fmt request in open state */
+		rc = msm_vidc_s_fmt(inst, f);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_S_CTRL:
+	{
+		struct v4l2_ctrl *ctrl = (struct v4l2_ctrl *)data;
+
+		/* allow set_control request in open state */
+		rc = msm_vidc_s_ctrl(inst, ctrl);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_REQBUFS:
+	{
+		struct v4l2_requestbuffers *b = (struct v4l2_requestbuffers *)data;
+
+		/* allow reqbufs request in open state */
+		rc = msm_vidc_reqbufs(inst, b);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_STREAMON:
+	{
+		struct vb2_queue *q = (struct vb2_queue *)data;
+
+		/* allow streamon request in open state */
+		rc = msm_vidc_start_streaming(inst, q);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_STREAMOFF:
+	{
+		struct vb2_queue *q = (struct vb2_queue *)data;
+
+		/* ignore streamoff request in open state */
+		i_vpr_h(inst, "%s: streamoff of (%s) ignored in state (%s)\n",
+			__func__, v4l2_type_name(q->type), state_name(inst->state));
+		break;
+	}
+	case MSM_VIDC_CMD_START:
+	{
+		/* disallow start cmd request in open state */
+		i_vpr_e(inst, "%s: (%s) not allowed, sub_state (%s)\n",
+			__func__, event_name(event), inst->sub_state_name);
+
+		return -EBUSY;
+	}
+	case MSM_VIDC_CMD_STOP:
+	{
+		/* ignore stop cmd request in open state */
+		i_vpr_h(inst, "%s: (%s) ignored, sub_state (%s)\n",
+			__func__, event_name(event), inst->sub_state_name);
+		break;
+	}
+	case MSM_VIDC_BUF_QUEUE:
+	{
+		struct msm_vidc_buffer *buf = (struct msm_vidc_buffer *)data;
+
+		/* defer qbuf request in open state */
+		print_vidc_buffer(VIDC_LOW, "low ", "qbuf deferred", inst, buf);
+		break;
+	}
+	default:
+	{
+		i_vpr_e(inst, "%s: unexpected event %s\n", __func__, event_name(event));
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+static int msm_vidc_input_streaming_state(struct msm_vidc_inst *inst,
+	enum msm_vidc_event event, void *data)
+{
+	int rc = 0;
+
+	/* inst must be locked */
+	rc = __strict_inst_check(inst, __func__);
+	if (rc) {
+		i_vpr_e(inst, "%s(): inst was not locked\n", __func__);
+		return -EINVAL;
+	}
+
+	switch (event) {
+	case MSM_VIDC_BUF_QUEUE:
+	{
+		struct msm_vidc_buffer *buf = (struct msm_vidc_buffer *)data;
+
+		/* defer meta port */
+		if (buf->type == MSM_VIDC_BUF_INPUT_META || buf->type == MSM_VIDC_BUF_OUTPUT_META) {
+			print_vidc_buffer(VIDC_LOW, "low ", "qbuf deferred", inst, buf);
+			return 0;
+		}
+
+		/* disallow */
+		if (!is_input_buffer(buf->type) && !is_output_buffer(buf->type)) {
+			i_vpr_e(inst, "%s: invalid buf type %u\n", __func__, buf->type);
+			return -EINVAL;
+		}
+
+		/* defer output port */
+		if (is_output_buffer(buf->type)) {
+			print_vidc_buffer(VIDC_LOW, "low ", "qbuf deferred", inst, buf);
+			return 0;
+		}
+
+		rc = msm_vidc_buf_queue(inst, buf);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_TRY_FMT:
+	{
+		struct v4l2_format *f = (struct v4l2_format *)data;
+
+		/* disallow */
+		if (f->type == INPUT_MPLANE || f->type == INPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: (%s) not allowed for (%s) port\n",
+				__func__, event_name(event), v4l2_type_name(f->type));
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_try_fmt(inst, f);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_S_FMT:
+	{
+		struct v4l2_format *f = (struct v4l2_format *)data;
+
+		/* disallow */
+		if (f->type == INPUT_MPLANE || f->type == INPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: (%s) not allowed for (%s) port\n",
+				__func__, event_name(event), v4l2_type_name(f->type));
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_s_fmt(inst, f);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_S_CTRL:
+	{
+		struct v4l2_ctrl *ctrl = (struct v4l2_ctrl *)data;
+		u32 cap_id = msm_vidc_get_cap_id(inst, ctrl->id);
+
+		if (cap_id == INST_CAP_NONE) {
+			i_vpr_e(inst, "%s: invalid cap_id %u\n", __func__, cap_id);
+			return -EINVAL;
+		}
+
+		/* disallow */
+		if (is_decode_session(inst)) {
+			/* check dynamic allowed if master port is streaming */
+			if (!(inst->capabilities[cap_id].flags & CAP_FLAG_DYNAMIC_ALLOWED)) {
+				i_vpr_e(inst, "%s: cap_id %#x (%s) not allowed in state %s\n",
+					__func__, cap_id, cap_name(cap_id),
+					state_name(inst->state));
+				return -EINVAL;
+			}
+		}
+
+		rc = msm_vidc_s_ctrl(inst, ctrl);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_REQBUFS:
+	{
+		struct v4l2_requestbuffers *b = (struct v4l2_requestbuffers *)data;
+
+		/* disallow */
+		if (b->type == INPUT_MPLANE || b->type == INPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: (%s) not allowed for (%s) port\n",
+				__func__, event_name(event), v4l2_type_name(b->type));
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_reqbufs(inst, b);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_STREAMON:
+	{
+		struct vb2_queue *q = (struct vb2_queue *)data;
+
+		/* disallow */
+		if (q->type == INPUT_MPLANE || q->type == INPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: (%s) not allowed for (%s) type\n",
+				__func__, event_name(event), v4l2_type_name(q->type));
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_start_streaming(inst, q);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_STREAMOFF:
+	{
+		struct vb2_queue *q = (struct vb2_queue *)data;
+
+		/* ignore */
+		if (q->type == OUTPUT_MPLANE || q->type == OUTPUT_META_PLANE) {
+			i_vpr_h(inst, "%s: streamoff of (%s) ignored in state (%s)\n",
+				__func__, v4l2_type_name(q->type), state_name(inst->state));
+			return 0;
+		}
+
+		/* disallow */
+		if (q->type == INPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: streamoff of (%s) not allowed in state (%s)\n",
+				__func__, v4l2_type_name(q->type), state_name(inst->state));
+			return -EINVAL;
+		}
+
+		/* sanitize type field */
+		if (q->type != INPUT_MPLANE) {
+			i_vpr_e(inst, "%s: invalid type %d\n", __func__, q->type);
+			return -EINVAL;
+		}
+
+		rc = msm_vidc_stop_streaming(inst, q);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_CMD_START:
+	{
+		/* disallow if START called for non DRC/drain cases */
+		if (!is_drc_pending(inst) && !is_drain_pending(inst)) {
+			i_vpr_e(inst, "%s: (%s) not allowed, sub_state (%s)\n",
+				__func__, event_name(event), inst->sub_state_name);
+			return -EBUSY;
+		}
+
+		/* client would call start(resume) to complete DRC/drain sequence */
+		rc = msm_vidc_start_cmd(inst);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_CMD_STOP:
+	{
+		/* back to back drain not allowed */
+		if (is_sub_state(inst, MSM_VIDC_DRAIN)) {
+			i_vpr_e(inst, "%s: drain (%s) not allowed, sub_state (%s)\n\n",
+				__func__, event_name(event), inst->sub_state_name);
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_stop_cmd(inst);
+		if (rc)
+			return rc;
+		break;
+	}
+	default:
+	{
+		i_vpr_e(inst, "%s: unexpected event %s\n", __func__, event_name(event));
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+static int msm_vidc_output_streaming_state(struct msm_vidc_inst *inst,
+	enum msm_vidc_event event, void *data)
+{
+	int rc = 0;
+
+	/* inst must be locked */
+	rc = __strict_inst_check(inst, __func__);
+	if (rc) {
+		i_vpr_e(inst, "%s(): inst was not locked\n", __func__);
+		return -EINVAL;
+	}
+
+	switch (event) {
+	case MSM_VIDC_BUF_QUEUE:
+	{
+		struct msm_vidc_buffer *buf = (struct msm_vidc_buffer *)data;
+
+		/* defer meta port */
+		if (buf->type == MSM_VIDC_BUF_INPUT_META || buf->type == MSM_VIDC_BUF_OUTPUT_META) {
+			print_vidc_buffer(VIDC_LOW, "low ", "qbuf deferred", inst, buf);
+			return 0;
+		}
+
+		/* disallow */
+		if (!is_input_buffer(buf->type) && !is_output_buffer(buf->type)) {
+			i_vpr_e(inst, "%s: invalid buf type %u\n", __func__, buf->type);
+			return -EINVAL;
+		}
+
+		/* defer input port */
+		if (is_input_buffer(buf->type)) {
+			print_vidc_buffer(VIDC_LOW, "low ", "qbuf deferred", inst, buf);
+			return 0;
+		}
+
+		rc = msm_vidc_buf_queue(inst, buf);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_TRY_FMT:
+	{
+		struct v4l2_format *f = (struct v4l2_format *)data;
+
+		/* disallow */
+		if (f->type == OUTPUT_MPLANE || f->type == OUTPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: (%s) not allowed for (%s) port\n",
+				__func__, event_name(event), v4l2_type_name(f->type));
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_try_fmt(inst, f);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_S_FMT:
+	{
+		struct v4l2_format *f = (struct v4l2_format *)data;
+
+		/* disallow */
+		if (f->type == OUTPUT_MPLANE || f->type == OUTPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: (%s) not allowed for (%s) port\n",
+				__func__, event_name(event), v4l2_type_name(f->type));
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_s_fmt(inst, f);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_S_CTRL:
+	{
+		struct v4l2_ctrl *ctrl = (struct v4l2_ctrl *)data;
+		u32 cap_id = msm_vidc_get_cap_id(inst, ctrl->id);
+
+		if (cap_id == INST_CAP_NONE) {
+			i_vpr_e(inst, "%s: invalid cap_id %u\n", __func__, cap_id);
+			return -EINVAL;
+		}
+
+		/* disallow */
+		if (is_encode_session(inst)) {
+			/* check dynamic allowed if master port is streaming */
+			if (!(inst->capabilities[cap_id].flags & CAP_FLAG_DYNAMIC_ALLOWED)) {
+				i_vpr_e(inst, "%s: cap_id %#x not allowed in state %s\n",
+					__func__, cap_id, state_name(inst->state));
+				return -EINVAL;
+			}
+		}
+
+		rc = msm_vidc_s_ctrl(inst, ctrl);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_REQBUFS:
+	{
+		struct v4l2_requestbuffers *b = (struct v4l2_requestbuffers *)data;
+
+		/* disallow */
+		if (b->type == OUTPUT_MPLANE || b->type == OUTPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: (%s) not allowed for (%s) port\n",
+				__func__, event_name(event), v4l2_type_name(b->type));
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_reqbufs(inst, b);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_STREAMON:
+	{
+		struct vb2_queue *q = (struct vb2_queue *)data;
+
+		/* disallow */
+		if (q->type == OUTPUT_MPLANE || q->type == OUTPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: (%s) not allowed for (%s) type\n",
+				__func__, event_name(event), v4l2_type_name(q->type));
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_start_streaming(inst, q);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_STREAMOFF:
+	{
+		struct vb2_queue *q = (struct vb2_queue *)data;
+
+		/* ignore */
+		if (q->type == INPUT_MPLANE || q->type == INPUT_META_PLANE) {
+			i_vpr_h(inst, "%s: streamoff of (%s) ignored in state (%s)\n",
+				__func__, v4l2_type_name(q->type), state_name(inst->state));
+			return 0;
+		}
+
+		/* disallow */
+		if (q->type == OUTPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: streamoff of (%s) not allowed in state (%s)\n",
+				__func__, v4l2_type_name(q->type), state_name(inst->state));
+			return -EINVAL;
+		}
+
+		/* sanitize type field */
+		if (q->type != OUTPUT_MPLANE) {
+			i_vpr_e(inst, "%s: invalid type %d\n", __func__, q->type);
+			return -EINVAL;
+		}
+
+		rc = msm_vidc_stop_streaming(inst, q);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_CMD_START:
+	{
+		/* disallow if START called for non DRC/drain cases */
+		if (!is_drc_pending(inst) && !is_drain_pending(inst)) {
+			i_vpr_e(inst, "%s: (%s) not allowed, sub_state (%s)\n",
+				__func__, event_name(event), inst->sub_state_name);
+			return -EBUSY;
+		}
+
+		/* client would call start(resume) to complete DRC/drain sequence */
+		rc = msm_vidc_start_cmd(inst);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_CMD_STOP:
+	{
+		/* drain not allowed as input is not streaming */
+		i_vpr_e(inst, "%s: drain (%s) not allowed, sub state %s\n",
+			__func__, event_name(event), inst->sub_state_name);
+		return -EBUSY;
+	}
+	default: {
+		i_vpr_e(inst, "%s: unexpected event %s\n", __func__, event_name(event));
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+static int msm_vidc_streaming_state(struct msm_vidc_inst *inst,
+	enum msm_vidc_event event, void *data)
+{
+	int rc = 0;
+
+	/* inst must be locked */
+	rc = __strict_inst_check(inst, __func__);
+	if (rc) {
+		i_vpr_e(inst, "%s(): inst was not locked\n", __func__);
+		return -EINVAL;
+	}
+
+	switch (event) {
+	case MSM_VIDC_BUF_QUEUE:
+	{
+		struct msm_vidc_buffer *buf = (struct msm_vidc_buffer *)data;
+
+		/* defer meta port */
+		if (buf->type == MSM_VIDC_BUF_INPUT_META || buf->type == MSM_VIDC_BUF_OUTPUT_META) {
+			print_vidc_buffer(VIDC_LOW, "low ", "qbuf deferred", inst, buf);
+			return 0;
+		}
+
+		/* disallow */
+		if (!is_input_buffer(buf->type) && !is_output_buffer(buf->type)) {
+			i_vpr_e(inst, "%s: invalid buf type %u\n", __func__, buf->type);
+			return -EINVAL;
+		}
+
+		rc = msm_vidc_buf_queue(inst, buf);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_S_CTRL:
+	{
+		struct v4l2_ctrl *ctrl = (struct v4l2_ctrl *)data;
+		u32 cap_id = msm_vidc_get_cap_id(inst, ctrl->id);
+
+		if (cap_id == INST_CAP_NONE) {
+			i_vpr_e(inst, "%s: invalid cap_id %u\n", __func__, cap_id);
+			return -EINVAL;
+		}
+
+		/* disallow */
+		if (!(inst->capabilities[cap_id].flags & CAP_FLAG_DYNAMIC_ALLOWED)) {
+			i_vpr_e(inst, "%s: cap_id %#x not allowed in state %s\n",
+				__func__, cap_id, state_name(inst->state));
+			return -EINVAL;
+		}
+
+		rc = msm_vidc_s_ctrl(inst, ctrl);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_STREAMOFF:
+	{
+		struct vb2_queue *q = (struct vb2_queue *)data;
+
+		/* disallow */
+		if (q->type == INPUT_META_PLANE || q->type == OUTPUT_META_PLANE) {
+			i_vpr_e(inst, "%s: streamoff of (%s) not allowed in state (%s)\n",
+				__func__, v4l2_type_name(q->type), state_name(inst->state));
+			return -EINVAL;
+		}
+
+		/* sanitize type field */
+		if (q->type != INPUT_MPLANE && q->type != OUTPUT_MPLANE) {
+			i_vpr_e(inst, "%s: invalid type %d\n", __func__, q->type);
+			return -EINVAL;
+		}
+
+		rc = msm_vidc_stop_streaming(inst, q);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_CMD_START:
+	{
+		/* disallow if START called for non DRC/drain cases */
+		if (!is_drc_pending(inst) && !is_drain_pending(inst)) {
+			i_vpr_e(inst, "%s: (%s) not allowed, sub_state (%s)\n",
+				__func__, event_name(event), inst->sub_state_name);
+			return -EBUSY;
+		}
+
+		/* client would call start(resume) to complete DRC/drain sequence */
+		rc = msm_vidc_start_cmd(inst);
+		if (rc)
+			return rc;
+		break;
+	}
+	case MSM_VIDC_CMD_STOP:
+	{
+		/* back to back drain not allowed */
+		if (is_sub_state(inst, MSM_VIDC_DRAIN)) {
+			i_vpr_e(inst, "%s: drain (%s) not allowed, sub_state (%s)\n\n",
+				__func__, event_name(event), inst->sub_state_name);
+			return -EBUSY;
+		}
+
+		rc = msm_vidc_stop_cmd(inst);
+		if (rc)
+			return rc;
+		break;
+	}
+	default: {
+		i_vpr_e(inst, "%s: unexpected event %s\n", __func__, event_name(event));
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+static int msm_vidc_close_state(struct msm_vidc_inst *inst,
+	enum msm_vidc_event event, void *data)
+{
+	int rc = 0;
+
+	/* inst must be locked */
+	rc = __strict_inst_check(inst, __func__);
+	if (rc) {
+		i_vpr_e(inst, "%s(): inst was not locked\n", __func__);
+		return -EINVAL;
+	}
+
+	switch (event) {
+	case MSM_VIDC_STREAMOFF:
+	{
+		struct vb2_queue *q = (struct vb2_queue *)data;
+
+		rc = msm_vidc_stop_streaming(inst, q);
+		if (rc)
+			return rc;
+		break;
+	}
+	default: {
+		i_vpr_e(inst, "%s: unexpected event %s\n", __func__, event_name(event));
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+static int msm_vidc_error_state(struct msm_vidc_inst *inst,
+	enum msm_vidc_event event, void *data)
+{
+	int rc = 0;
+
+	/* inst must be locked */
+	rc = __strict_inst_check(inst, __func__);
+	if (rc) {
+		i_vpr_e(inst, "%s(): inst was not locked\n", __func__);
+		return -EINVAL;
+	}
+
+	switch (event) {
+	case MSM_VIDC_STREAMOFF:
+	{
+		struct vb2_queue *q = (struct vb2_queue *)data;
+
+		rc = msm_vidc_stop_streaming(inst, q);
+		if (rc)
+			return rc;
+		break;
+	}
+	default: {
+		i_vpr_e(inst, "%s: unexpected event %s\n", __func__, event_name(event));
+		return -EINVAL;
+	}
+	}
+
+	return rc;
+}
+
+struct msm_vidc_state_handle {
+	enum msm_vidc_state   state;
+	int                 (*handle)(struct msm_vidc_inst *inst,
+		enum msm_vidc_event event, void *data);
+};
+
+static struct msm_vidc_state_handle *msm_vidc_get_state_handle(
+	struct msm_vidc_inst *inst,
+	enum msm_vidc_state req_state)
+{
+	int cnt;
+	struct msm_vidc_state_handle *inst_state_handle = NULL;
+	static struct msm_vidc_state_handle state_handle[] = {
+		{MSM_VIDC_OPEN,             msm_vidc_open_state             },
+		{MSM_VIDC_INPUT_STREAMING,  msm_vidc_input_streaming_state  },
+		{MSM_VIDC_OUTPUT_STREAMING, msm_vidc_output_streaming_state },
+		{MSM_VIDC_STREAMING,        msm_vidc_streaming_state        },
+		{MSM_VIDC_CLOSE,            msm_vidc_close_state            },
+		{MSM_VIDC_ERROR,            msm_vidc_error_state            },
+	};
+
+	for (cnt = 0; cnt < ARRAY_SIZE(state_handle); cnt++) {
+		if (state_handle[cnt].state == req_state) {
+			inst_state_handle = &state_handle[cnt];
+			break;
+		}
+	}
+
+	/* check if req_state does not exist in the table */
+	if (cnt == ARRAY_SIZE(state_handle)) {
+		i_vpr_e(inst, "%s: invalid state %s\n", __func__, state_name(req_state));
+		return inst_state_handle;
+	}
+
+	return inst_state_handle;
+}
+
+int msm_vidc_update_state(struct msm_vidc_inst *inst,
+	enum msm_vidc_state request_state, const char *func)
+{
+	struct msm_vidc_state_handle *state_handle = NULL;
+	int rc = 0;
+
+	/* get inst state handler for requested state */
+	state_handle = msm_vidc_get_state_handle(inst, request_state);
+	if (!state_handle)
+		return -EINVAL;
+
+	if (request_state == MSM_VIDC_ERROR)
+		i_vpr_e(inst, FMT_STRING_STATE_CHANGE,
+		   func, state_name(request_state), state_name(inst->state));
+	else
+		i_vpr_h(inst, FMT_STRING_STATE_CHANGE,
+		   func, state_name(request_state), state_name(inst->state));
+
+	trace_msm_vidc_common_state_change(inst, func, state_name(inst->state),
+			state_name(request_state));
+
+	/* finally update inst state and handler */
+	inst->state = state_handle->state;
+	inst->event_handle = state_handle->handle;
+
+	return rc;
+}
+
+int msm_vidc_change_state(struct msm_vidc_inst *inst,
+		enum msm_vidc_state request_state, const char *func)
+{
+	enum msm_vidc_allow allow;
+	int rc;
+
+	if (is_session_error(inst)) {
+		i_vpr_h(inst,
+			"%s: inst is in bad state, can not change state to %s\n",
+			func, state_name(request_state));
+		return 0;
+	}
+
+	/* current and requested state is same */
+	if (inst->state == request_state)
+		return 0;
+
+	/* check if requested state movement is allowed */
+	allow = msm_vidc_allow_state_change(inst, request_state);
+	if (allow != MSM_VIDC_ALLOW) {
+		i_vpr_e(inst, "%s: %s state change %s -> %s\n", func,
+			allow_name(allow), state_name(inst->state),
+			state_name(request_state));
+		return (allow == MSM_VIDC_DISALLOW ? -EINVAL : 0);
+	}
+
+	/* go ahead and update inst state */
+	rc = msm_vidc_update_state(inst, request_state, func);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+struct msm_vidc_sub_state_allow {
+	enum msm_vidc_state            state;
+	enum msm_vidc_allow            allow;
+	u32                            sub_state_mask;
+};
+
+static int msm_vidc_set_sub_state(struct msm_vidc_inst *inst,
+	enum msm_vidc_sub_state sub_state, const char *func)
+{
+	char sub_state_name[MAX_NAME_LENGTH];
+	int cnt, rc = 0;
+	static struct msm_vidc_sub_state_allow sub_state_allow[] = {
+		/* state, allow, sub_state */
+		{MSM_VIDC_OPEN,              MSM_VIDC_DISALLOW,    MSM_VIDC_DRC                 |
+								   MSM_VIDC_DRAIN               |
+								   MSM_VIDC_DRC_LAST_BUFFER     |
+								   MSM_VIDC_DRAIN_LAST_BUFFER   |
+								   MSM_VIDC_INPUT_PAUSE         |
+								   MSM_VIDC_OUTPUT_PAUSE         },
+
+		{MSM_VIDC_INPUT_STREAMING,   MSM_VIDC_DISALLOW,    MSM_VIDC_DRC_LAST_BUFFER     |
+								   MSM_VIDC_DRAIN_LAST_BUFFER   |
+								   MSM_VIDC_OUTPUT_PAUSE         },
+		{MSM_VIDC_INPUT_STREAMING,   MSM_VIDC_ALLOW,       MSM_VIDC_DRC                 |
+								   MSM_VIDC_DRAIN               |
+								   MSM_VIDC_INPUT_PAUSE         |
+								   MSM_VIDC_FIRST_IPSC           },
+
+		{MSM_VIDC_OUTPUT_STREAMING,  MSM_VIDC_DISALLOW,    MSM_VIDC_DRC                 |
+								   MSM_VIDC_DRAIN               |
+								   MSM_VIDC_INPUT_PAUSE          },
+		{MSM_VIDC_OUTPUT_STREAMING,  MSM_VIDC_ALLOW,       MSM_VIDC_DRC_LAST_BUFFER     |
+								   MSM_VIDC_DRAIN_LAST_BUFFER   |
+								   MSM_VIDC_OUTPUT_PAUSE         },
+
+		{MSM_VIDC_STREAMING,         MSM_VIDC_ALLOW,       MSM_VIDC_DRC                 |
+								   MSM_VIDC_DRAIN               |
+								   MSM_VIDC_DRC_LAST_BUFFER     |
+								   MSM_VIDC_DRAIN_LAST_BUFFER   |
+								   MSM_VIDC_INPUT_PAUSE         |
+								   MSM_VIDC_OUTPUT_PAUSE         },
+
+		{MSM_VIDC_CLOSE,             MSM_VIDC_ALLOW,       MSM_VIDC_DRC                 |
+								   MSM_VIDC_DRAIN               |
+								   MSM_VIDC_DRC_LAST_BUFFER     |
+								   MSM_VIDC_DRAIN_LAST_BUFFER   |
+								   MSM_VIDC_INPUT_PAUSE         |
+								   MSM_VIDC_OUTPUT_PAUSE         },
+
+		{MSM_VIDC_ERROR,             MSM_VIDC_ALLOW,       MSM_VIDC_DRC                 |
+								   MSM_VIDC_DRAIN               |
+								   MSM_VIDC_DRC_LAST_BUFFER     |
+								   MSM_VIDC_DRAIN_LAST_BUFFER   |
+								   MSM_VIDC_INPUT_PAUSE         |
+								   MSM_VIDC_OUTPUT_PAUSE         },
+	};
+
+	/* no substate to update */
+	if (!sub_state)
+		return 0;
+
+	/* check if any substate is disallowed */
+	for (cnt = 0; cnt < ARRAY_SIZE(sub_state_allow); cnt++) {
+		/* skip other states */
+		if (sub_state_allow[cnt].state != inst->state)
+			continue;
+
+		/* continue if not disallowed */
+		if (sub_state_allow[cnt].allow != MSM_VIDC_DISALLOW)
+			continue;
+
+		if (sub_state_allow[cnt].sub_state_mask & sub_state) {
+			prepare_sub_state_name(sub_state, sub_state_name, sizeof(sub_state_name));
+			i_vpr_e(inst, "%s: state (%s), disallow substate (%s)\n",
+				func, state_name(inst->state), sub_state_name);
+			return -EINVAL;
+		}
+	}
+
+	/* remove ignorable substates from a given substate */
+	for (cnt = 0; cnt < ARRAY_SIZE(sub_state_allow); cnt++) {
+		/* skip other states */
+		if (sub_state_allow[cnt].state != inst->state)
+			continue;
+
+		/* continue if not ignored */
+		if (sub_state_allow[cnt].allow != MSM_VIDC_IGNORE)
+			continue;
+
+		if (sub_state_allow[cnt].sub_state_mask & sub_state) {
+			prepare_sub_state_name(sub_state, sub_state_name, sizeof(sub_state_name));
+			i_vpr_h(inst, "%s: state (%s), ignore substate (%s)\n",
+				func, state_name(inst->state), sub_state_name);
+
+			/* remove ignorable substate bits from actual */
+			sub_state &= ~(sub_state_allow[cnt].sub_state_mask & sub_state);
+			break;
+		}
+	}
+
+	/* check if all substate bits are allowed */
+	for (cnt = 0; cnt < ARRAY_SIZE(sub_state_allow); cnt++) {
+		/* skip other states */
+		if (sub_state_allow[cnt].state != inst->state)
+			continue;
+
+		/* continue if not allowed */
+		if (sub_state_allow[cnt].allow != MSM_VIDC_ALLOW)
+			continue;
+
+		if ((sub_state_allow[cnt].sub_state_mask & sub_state) != sub_state) {
+			prepare_sub_state_name(sub_state, sub_state_name, sizeof(sub_state_name));
+			i_vpr_e(inst, "%s: state (%s), not all substates allowed (%s)\n",
+				func, state_name(inst->state), sub_state_name);
+			return -EINVAL;
+		}
+	}
+
+	/* update substate */
+	inst->sub_state |= sub_state;
+
+	return rc;
+}
+
+int msm_vidc_change_sub_state(struct msm_vidc_inst *inst,
+		enum msm_vidc_sub_state clear_sub_state,
+		enum msm_vidc_sub_state set_sub_state, const char *func)
+{
+	enum msm_vidc_sub_state prev_sub_state;
+	int rc = 0;
+
+	if (is_session_error(inst)) {
+		i_vpr_h(inst,
+			"%s: inst is in bad state, can not change sub state\n", func);
+		return 0;
+	}
+
+	/* final value will not change */
+	if (!clear_sub_state && !set_sub_state)
+		return 0;
+
+	/* sanitize clear & set value */
+	if ((clear_sub_state & set_sub_state) ||
+		(set_sub_state > MSM_VIDC_MAX_SUB_STATE_VALUE) ||
+		(clear_sub_state > MSM_VIDC_MAX_SUB_STATE_VALUE)) {
+		i_vpr_e(inst, "%s: invalid sub states to clear %#x or set %#x\n",
+			func, clear_sub_state, set_sub_state);
+		return -EINVAL;
+	}
+
+	prev_sub_state = inst->sub_state;
+
+	/* set sub state */
+	rc = msm_vidc_set_sub_state(inst, set_sub_state, __func__);
+	if (rc)
+		return rc;
+
+	/* clear sub state */
+	inst->sub_state &= ~clear_sub_state;
+
+	/* print substates only when there is a change */
+	if (inst->sub_state != prev_sub_state) {
+		rc = prepare_sub_state_name(inst->sub_state, inst->sub_state_name,
+			sizeof(inst->sub_state_name));
+		if (!rc)
+			i_vpr_h(inst, "%s: state %s and sub state changed to %s\n",
+				func, state_name(inst->state), inst->sub_state_name);
+	}
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_synx.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_synx.c
@@ -0,0 +1,344 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <msm_hw_fence_synx_translation.h>
+#include "msm_vidc_core.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_fence.h"
+#include "msm_vidc_debug.h"
+#include <synx_api.h>
+
+#define MSM_VIDC_SYNX_FENCE_CLIENT_ID      SYNX_CLIENT_HW_FENCE_VID_CTX0
+#define MSM_VIDC_SYNX_CREATE_DMA_FENCE     SYNX_CREATE_DMA_FENCE
+#define MAX_SYNX_FENCE_SESSION_NAME        64
+
+static const char *msm_vidc_synx_dma_fence_get_driver_name(struct dma_fence *df)
+{
+	struct msm_vidc_fence *fence;
+
+	if (df) {
+		fence = container_of(df, struct msm_vidc_fence, dma_fence);
+		return fence->name;
+	}
+	return "msm_vidc_synx_dma_fence_get_driver_name: invalid fence";
+}
+
+static const char *msm_vidc_synx_dma_fence_get_timeline_name(struct dma_fence *df)
+{
+	struct msm_vidc_fence *fence;
+
+	if (df) {
+		fence = container_of(df, struct msm_vidc_fence, dma_fence);
+		return fence->name;
+	}
+	return "msm_vidc_synx_dma_fence_get_timeline_name: invalid fence";
+}
+
+static void msm_vidc_synx_fence_release(struct dma_fence *df)
+{
+	struct msm_vidc_fence *fence;
+	int rc = 0;
+
+	if (!df) {
+		d_vpr_e("%s: invalid dma fence\n", __func__);
+		return;
+	}
+
+	fence = container_of(df, struct msm_vidc_fence, dma_fence);
+	if (!fence) {
+		d_vpr_e("%s: invalid fence\n", __func__);
+		return;
+	}
+	d_vpr_l("%s: name %s\n", __func__, fence->name);
+
+	/* destroy associated synx fence */
+	if (fence->session) {
+		rc = synx_hwfence_release((struct synx_session *)fence->session,
+			(u32)fence->fence_id);
+		if (rc)
+			d_vpr_e("%s: failed to destroy synx fence for %s\n",
+				__func__, fence->name);
+	}
+
+	vfree(fence);
+	return;
+}
+
+static const struct dma_fence_ops msm_vidc_synx_dma_fence_ops = {
+	.get_driver_name = msm_vidc_synx_dma_fence_get_driver_name,
+	.get_timeline_name = msm_vidc_synx_dma_fence_get_timeline_name,
+	.release = msm_vidc_synx_fence_release,
+};
+
+static struct msm_vidc_fence *msm_vidc_get_synx_fence_from_id(
+	struct msm_vidc_inst *inst, u64 fence_id)
+{
+	struct msm_vidc_fence *fence, *dummy_fence;
+	bool found = false;
+
+	list_for_each_entry_safe(fence, dummy_fence, &inst->fence_list, list) {
+		if (fence->fence_id == fence_id) {
+			found = true;
+			break;
+		}
+	}
+
+	if (!found) {
+		i_vpr_l(inst, "%s: no fence available for id: %u\n",
+			__func__, fence_id);
+		return NULL;
+	}
+
+	return fence;
+}
+
+static void msm_vidc_synx_fence_destroy(struct msm_vidc_inst *inst, u64 fence_id)
+{
+	struct msm_vidc_fence *fence;
+
+	fence = msm_vidc_get_synx_fence_from_id(inst, fence_id);
+	if (!fence)
+		return;
+
+	i_vpr_e(inst, "%s: fence %s\n", __func__, fence->name);
+	list_del_init(&fence->list);
+
+	dma_fence_set_error(&fence->dma_fence, -EINVAL);
+	dma_fence_signal(&fence->dma_fence);
+	dma_fence_put(&fence->dma_fence);
+}
+
+static int msm_vidc_synx_fence_register(struct msm_vidc_core *core)
+{
+	struct synx_initialization_params params;
+	struct synx_session *session = NULL;
+	char synx_session_name[MAX_SYNX_FENCE_SESSION_NAME];
+	struct synx_queue_desc queue_desc;
+
+	if (!core->capabilities[SUPPORTS_SYNX_FENCE].value)
+		return 0;
+
+	/* fill synx_initialization_params */
+	memset(&params, 0, sizeof(struct synx_initialization_params));
+	memset(&queue_desc, 0, sizeof(struct synx_queue_desc));
+
+	params.id = (enum synx_client_id)MSM_VIDC_SYNX_FENCE_CLIENT_ID;
+	snprintf(synx_session_name, MAX_SYNX_FENCE_SESSION_NAME,
+		"video synx fence");
+	params.name = synx_session_name;
+	params.ptr = &queue_desc;
+	params.flags = SYNX_INIT_MAX; /* unused */
+
+	session =
+		(struct synx_session *)synx_hwfence_initialize(&params);
+	if (IS_ERR_OR_NULL(session)) {
+		d_vpr_e("%s: invalid synx fence session\n", __func__);
+		return -EINVAL;
+	}
+
+	/* fill core synx fence data */
+	core->synx_fence_data.client_id = (u32)params.id;
+	core->synx_fence_data.client_flags = (u32)params.flags;
+	core->synx_fence_data.session = (void *)session;
+	core->synx_fence_data.queue.size = (u32)queue_desc.size;
+	core->synx_fence_data.queue.kvaddr = queue_desc.vaddr;
+	core->synx_fence_data.queue.phys_addr = (phys_addr_t)queue_desc.dev_addr;
+
+	core->synx_fence_data.queue.type = MSM_VIDC_BUF_INTERFACE_QUEUE;
+	core->synx_fence_data.queue.region = MSM_VIDC_NON_SECURE;
+	core->synx_fence_data.queue.direction = DMA_BIDIRECTIONAL;
+
+	d_vpr_h("%s: successfully registered synx fence\n", __func__);
+	return 0;
+}
+
+static int msm_vidc_synx_fence_deregister(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!core->capabilities[SUPPORTS_SYNX_FENCE].value)
+		return 0;
+
+	rc = synx_hwfence_uninitialize(
+		(struct synx_session *)core->synx_fence_data.session);
+	if (rc) {
+		d_vpr_e("%s: failed to deregister synx fence\n", __func__);
+		/* ignore error */
+		rc = 0;
+	} else {
+		d_vpr_l("%s: successfully deregistered synx fence\n", __func__);
+	}
+
+	return rc;
+}
+
+static struct msm_vidc_fence *msm_vidc_synx_dma_fence_create(struct msm_vidc_inst *inst)
+{
+	struct msm_vidc_fence *fence = NULL;
+
+	fence = vzalloc(sizeof(*fence));
+	if (!fence) {
+		i_vpr_e(inst, "%s: allocation failed\n", __func__);
+		return NULL;
+	}
+
+	fence->fd = INVALID_FD;
+	spin_lock_init(&fence->lock);
+	dma_fence_init(&fence->dma_fence, &msm_vidc_synx_dma_fence_ops,
+		&fence->lock, inst->fence_context.ctx_num,
+		++inst->fence_context.seq_num);
+	snprintf(fence->name, sizeof(fence->name), "synx %s: %llu",
+		inst->fence_context.name, inst->fence_context.seq_num);
+
+	fence->fence_id = fence->dma_fence.seqno;
+
+	INIT_LIST_HEAD(&fence->list);
+	list_add_tail(&fence->list, &inst->fence_list);
+	i_vpr_l(inst, "%s: created %s\n", __func__, fence->name);
+
+	return fence;
+}
+
+static struct msm_vidc_fence *msm_vidc_synx_fence_create(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_fence *fence = NULL;
+	struct msm_vidc_core *core = NULL;
+	struct synx_create_params params;
+	u32 fence_id = 0;
+
+	core = inst->core;
+
+	/* return if synx fence is not supported */
+	if (!core->capabilities[SUPPORTS_SYNX_FENCE].value)
+		return NULL;
+
+	/* create dma fence */
+	fence = msm_vidc_synx_dma_fence_create(inst);
+	if (!fence) {
+		i_vpr_e(inst, "%s: failed to create dma fence\n", __func__);
+		return NULL;
+	}
+
+	if (!core->synx_fence_data.session) {
+		i_vpr_e(inst, "%s: invalid synx fence session\n", __func__);
+		goto destroy_dma_fence;
+	}
+
+	/* fill synx fence params structure */
+	memset(&params, 0, sizeof(struct synx_create_params));
+	params.name = fence->name;
+	params.fence = (void *)&fence->dma_fence;
+	params.h_synx = &fence_id;
+	params.flags = MSM_VIDC_SYNX_CREATE_DMA_FENCE;
+
+	/* create hw fence */
+	rc = synx_hwfence_create(
+		(struct synx_session *)core->synx_fence_data.session,
+		&params);
+	if (rc) {
+		i_vpr_e(inst, "%s: failed to create hw fence for %s",
+			__func__, fence->name);
+		goto destroy_dma_fence;
+	}
+
+	fence->fence_id = (u64)(*(params.h_synx));
+	/* this copy of hw fence client handle is req. to destroy synx fence */
+	fence->session = core->synx_fence_data.session;
+	i_vpr_l(inst, "%s: successfully created synx fence with id: %llu",
+		__func__, fence->fence_id);
+
+	return fence;
+
+destroy_dma_fence:
+	msm_vidc_synx_fence_destroy(inst, fence->fence_id);
+	return NULL;
+}
+
+int msm_vidc_synx_fence_create_fd(struct msm_vidc_inst *inst,
+	struct msm_vidc_fence *fence)
+{
+	int rc = 0;
+
+	fence->fd = get_unused_fd_flags(0);
+	if (fence->fd < 0) {
+		i_vpr_e(inst, "%s: getting fd (%d) failed\n", __func__,
+			fence->fd);
+		rc = -EINVAL;
+		goto err_fd;
+	}
+	fence->sync_file = sync_file_create(&fence->dma_fence);
+	if (!fence->sync_file) {
+		i_vpr_e(inst, "%s: sync_file_create failed\n", __func__);
+		rc = -EINVAL;
+		goto err_sync_file;
+	}
+	fd_install(fence->fd, fence->sync_file->file);
+
+	i_vpr_l(inst, "%s: created fd %d for fence %s\n", __func__,
+		fence->fd, fence->name);
+
+	return 0;
+
+err_sync_file:
+	put_unused_fd(fence->fd);
+err_fd:
+	return rc;
+}
+
+static int msm_vidc_synx_fence_signal(struct msm_vidc_inst *inst, u64 fence_id)
+{
+	int rc = 0;
+	struct msm_vidc_fence *fence;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	fence = msm_vidc_get_synx_fence_from_id(inst, fence_id);
+	if (!fence) {
+		i_vpr_e(inst, "%s: no fence available to signal with id: %u\n",
+			__func__, fence_id);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	i_vpr_l(inst, "%s: fence %s\n", __func__, fence->name);
+	list_del_init(&fence->list);
+
+	dma_fence_signal(&fence->dma_fence);
+	dma_fence_put(&fence->dma_fence);
+
+exit:
+	return rc;
+}
+
+static void msm_vidc_synx_fence_recover(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = synx_hwfence_recover(
+		(enum synx_client_id)core->synx_fence_data.client_id);
+	if (rc)
+		d_vpr_e("%s: failed to recover synx fences for client id: %d",
+			__func__,
+			(enum synx_client_id)core->synx_fence_data.client_id);
+
+	return;
+}
+
+const struct msm_vidc_fence_ops *get_synx_fence_ops(void)
+{
+	static struct msm_vidc_fence_ops synx_ops;
+
+	synx_ops.fence_register      = msm_vidc_synx_fence_register;
+	synx_ops.fence_deregister    = msm_vidc_synx_fence_deregister;
+	synx_ops.fence_create        = msm_vidc_synx_fence_create;
+	synx_ops.fence_create_fd     = msm_vidc_synx_fence_create_fd;
+	synx_ops.fence_destroy       = msm_vidc_synx_fence_destroy;
+	synx_ops.fence_signal        = msm_vidc_synx_fence_signal;
+	synx_ops.fence_recover       = msm_vidc_synx_fence_recover;
+
+	return &synx_ops;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_v4l2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_v4l2.c
@@ -0,0 +1,1041 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_v4l2.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc.h"
+#include "msm_vidc_events.h"
+
+extern struct msm_vidc_core *g_core;
+
+static struct msm_vidc_inst *get_vidc_inst(struct file *filp, void *fh)
+{
+	if (!filp || !filp->private_data)
+		return NULL;
+	return container_of(filp->private_data,
+					struct msm_vidc_inst, fh);
+}
+
+unsigned int msm_v4l2_poll(struct file *filp, struct poll_table_struct *pt)
+{
+	int poll = 0;
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, NULL);
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return POLLERR;
+	}
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		poll = POLLERR;
+		goto exit;
+	}
+	poll = msm_vidc_poll((void *)inst, filp, pt);
+	if (poll)
+		goto exit;
+
+exit:
+	put_inst(inst);
+	return poll;
+}
+
+int msm_v4l2_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, NULL);
+	int ret;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -ENOMEM;
+	}
+
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	ret = msm_vidc_mmap((void *)inst, filp, vma);
+
+exit:
+	put_inst(inst);
+	return ret;
+}
+
+int msm_v4l2_open(struct file *filp)
+{
+	struct video_device *vdev = video_devdata(filp);
+	struct msm_video_device *vid_dev =
+		container_of(vdev, struct msm_video_device, vdev);
+	struct msm_vidc_core *core = video_drvdata(filp);
+	struct msm_vidc_inst *inst;
+
+	trace_msm_v4l2_vidc_open("START", NULL);
+	inst = msm_vidc_open(core, vid_dev->type);
+	if (!inst) {
+		d_vpr_e("Failed to create instance, type = %d\n",
+			vid_dev->type);
+		trace_msm_v4l2_vidc_open("END", NULL);
+		return -ENOMEM;
+	}
+	filp->private_data = &(inst->fh);
+	trace_msm_v4l2_vidc_open("END", inst);
+	return 0;
+}
+
+int msm_v4l2_close(struct file *filp)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst;
+
+	inst = get_vidc_inst(filp, NULL);
+	if (!inst) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	trace_msm_v4l2_vidc_close("START", inst);
+
+	rc = msm_vidc_close(inst);
+	filp->private_data = NULL;
+	trace_msm_v4l2_vidc_close("END", NULL);
+	return rc;
+}
+
+int msm_v4l2_querycap(struct file *filp, void *fh,
+			struct v4l2_capability *cap)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !cap) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_querycap((void *)inst, cap);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_enum_fmt(struct file *filp, void *fh,
+					struct v4l2_fmtdesc *f)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !f) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_enum_fmt((void *)inst, f);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_try_fmt(struct file *filp, void *fh, struct v4l2_format *f)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !f) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = inst->event_handle(inst, MSM_VIDC_TRY_FMT, f);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_s_fmt(struct file *filp, void *fh,
+					struct v4l2_format *f)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !f) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = inst->event_handle(inst, MSM_VIDC_S_FMT, f);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_g_fmt(struct file *filp, void *fh,
+					struct v4l2_format *f)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !f) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_g_fmt((void *)inst, f);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_s_selection(struct file *filp, void *fh,
+					struct v4l2_selection *s)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !s) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_s_selection((void *)inst, s);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_g_selection(struct file *filp, void *fh,
+					struct v4l2_selection *s)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !s) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_g_selection((void *)inst, s);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_s_parm(struct file *filp, void *fh,
+					struct v4l2_streamparm *a)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !a) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_s_param((void *)inst, a);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_g_parm(struct file *filp, void *fh,
+					struct v4l2_streamparm *a)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !a) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_g_param((void *)inst, a);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_reqbufs(struct file *filp, void *fh,
+				struct v4l2_requestbuffers *b)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !b) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = inst->event_handle(inst, MSM_VIDC_REQBUFS, b);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_querybuf(struct file *filp, void *fh,
+				struct v4l2_buffer *b)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !b) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_querybuf((void *)inst, b);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_create_bufs(struct file *filp, void *fh,
+				struct v4l2_create_buffers *b)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !b) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_create_bufs((void *)inst, b);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_prepare_buf(struct file *filp, void *fh,
+				struct v4l2_buffer *b)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	struct video_device *vdev = video_devdata(filp);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !b) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_prepare_buf((void *)inst, vdev->v4l2_dev->mdev, b);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_export_buf(struct file *filp, void *fh,
+			struct v4l2_exportbuffer *eb)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	struct video_device *vdev = video_devdata(filp);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !eb) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_exportbuf((void *)inst, vdev->v4l2_dev->mdev, eb);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_qbuf(struct file *filp, void *fh,
+				struct v4l2_buffer *b)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	struct video_device *vdev = video_devdata(filp);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !b) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	/*
+	 * [1] If request_fd enabled, msm_vb2_buf_queue() is not called from here.
+	 *   instead it's called as part of msm_v4l2_request_queue().
+	 *   Hence inst lock should be acquired in common function i.e
+	 *   msm_vb2_buf_queue, to handle both requests and non-request
+	 *   scenarios.
+	 * [2] If request_fd is disabled, inst_lock can be acquired here.
+	 *   Acquiring inst_lock from here will ensure RO list insertion
+	 *   and deletion i.e. attach/map will happen under lock.
+	 * Currently, request_fd is disabled. Therefore, acquire inst_lock
+	 * from this function to ensure RO list insertion/updation is under
+	 * lock to avoid stability usecase.
+	 */
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	rc = msm_vidc_qbuf(inst, vdev->v4l2_dev->mdev, b);
+	if (rc)
+		goto exit;
+
+exit:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_dqbuf(struct file *filp, void *fh,
+				struct v4l2_buffer *b)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !b) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	rc = msm_vidc_dqbuf(inst, b);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_streamon(struct file *filp, void *fh,
+				enum v4l2_buf_type i)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto exit;
+	}
+
+	rc = msm_vidc_streamon((void *)inst, i);
+	if (rc)
+		goto exit;
+
+exit:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_streamoff(struct file *filp, void *fh,
+				enum v4l2_buf_type i)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	rc = msm_vidc_streamoff((void *)inst, i);
+	if (rc)
+		i_vpr_e(inst, "%s: msm_vidc_stramoff failed\n", __func__);
+
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_subscribe_event(struct v4l2_fh *fh,
+				const struct v4l2_event_subscription *sub)
+{
+	struct msm_vidc_inst *inst;
+	int rc = 0;
+
+	inst = container_of(fh, struct msm_vidc_inst, fh);
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !sub) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_subscribe_event((void *)inst, sub);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_unsubscribe_event(struct v4l2_fh *fh,
+				const struct v4l2_event_subscription *sub)
+{
+	struct msm_vidc_inst *inst;
+	int rc = 0;
+
+	inst = container_of(fh, struct msm_vidc_inst, fh);
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !sub) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	rc = msm_vidc_unsubscribe_event((void *)inst, sub);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_try_decoder_cmd(struct file *filp, void *fh,
+			     struct v4l2_decoder_cmd *dec)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !dec) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_try_cmd(inst, (union msm_v4l2_cmd *)dec);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_decoder_cmd(struct file *filp, void *fh,
+				struct v4l2_decoder_cmd *dec)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	enum msm_vidc_event event;
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	if (!dec) {
+		i_vpr_e(inst, "%s: invalid params\n", __func__);
+		rc = -EINVAL;
+		goto unlock;
+	}
+	if (dec->cmd != V4L2_DEC_CMD_START &&
+		dec->cmd != V4L2_DEC_CMD_STOP) {
+		i_vpr_e(inst, "%s: invalid cmd %#x\n", __func__, dec->cmd);
+		rc = -EINVAL;
+		goto unlock;
+	}
+	event = (dec->cmd == V4L2_DEC_CMD_START ? MSM_VIDC_CMD_START : MSM_VIDC_CMD_STOP);
+	rc = inst->event_handle(inst, event, NULL);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_try_encoder_cmd(struct file *filp, void *fh,
+			     struct v4l2_encoder_cmd *enc)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !enc) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_try_cmd(inst, (union msm_v4l2_cmd *)enc);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_encoder_cmd(struct file *filp, void *fh,
+				struct v4l2_encoder_cmd *enc)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	enum msm_vidc_event event;
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	if (!enc) {
+		i_vpr_e(inst, "%s: invalid params\n", __func__);
+		rc = -EINVAL;
+		goto unlock;
+	}
+	if (enc->cmd != V4L2_ENC_CMD_START &&
+		enc->cmd != V4L2_ENC_CMD_STOP) {
+		i_vpr_e(inst, "%s: invalid cmd %#x\n", __func__, enc->cmd);
+		rc = -EINVAL;
+		goto unlock;
+	}
+	event = (enc->cmd == V4L2_ENC_CMD_START ? MSM_VIDC_CMD_START : MSM_VIDC_CMD_STOP);
+	rc = inst->event_handle(inst, event, NULL);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_enum_framesizes(struct file *filp, void *fh,
+				struct v4l2_frmsizeenum *fsize)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !fsize) {
+		d_vpr_e("%s: invalid params: %pK %pK\n",
+				__func__, inst, fsize);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_enum_framesizes((void *)inst, fsize);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_enum_frameintervals(struct file *filp, void *fh,
+				struct v4l2_frmivalenum *fival)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !fival) {
+		d_vpr_e("%s: invalid params: %pK %pK\n",
+			__func__, inst, fival);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_enum_frameintervals((void *)inst, fival);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_queryctrl(struct file *filp, void *fh,
+	struct v4l2_queryctrl *ctrl)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !ctrl) {
+		d_vpr_e("%s: invalid instance\n", __func__);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_query_ctrl((void *)inst, ctrl);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_querymenu(struct file *filp, void *fh,
+	struct v4l2_querymenu *qmenu)
+{
+	struct msm_vidc_inst *inst = get_vidc_inst(filp, fh);
+	int rc = 0;
+
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !qmenu) {
+		d_vpr_e("%s: invalid params %pK %pK\n",
+			__func__, inst, qmenu);
+		return -EINVAL;
+	}
+
+	client_lock(inst, __func__);
+	inst_lock(inst, __func__);
+	if (is_session_error(inst)) {
+		i_vpr_e(inst, "%s: inst in error state\n", __func__);
+		rc = -EBUSY;
+		goto unlock;
+	}
+	rc = msm_vidc_query_menu((void *)inst, qmenu);
+	if (rc)
+		goto unlock;
+
+unlock:
+	inst_unlock(inst, __func__);
+	client_unlock(inst, __func__);
+	put_inst(inst);
+
+	return rc;
+}
+
+int msm_v4l2_request_validate(struct media_request *req)
+{
+	d_vpr_l("%s()\n", __func__);
+	return vb2_request_validate(req);
+}
+
+void msm_v4l2_request_queue(struct media_request *req)
+{
+	d_vpr_l("%s()\n", __func__);
+	v4l2_m2m_request_queue(req);
+}
+
+void msm_v4l2_m2m_device_run(void *priv)
+{
+	d_vpr_l("%s()\n", __func__);
+}
+
+void msm_v4l2_m2m_job_abort(void *priv)
+{
+	struct msm_vidc_inst *inst = priv;
+
+	if (!inst) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+	i_vpr_h(inst, "%s: m2m job aborted\n", __func__);
+	v4l2_m2m_job_finish(inst->m2m_dev, inst->m2m_ctx);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/msm_vidc_vb2.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/msm_vidc_vb2.c
@@ -0,0 +1,1090 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "msm_vidc_vb2.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_inst.h"
+#include "msm_vidc_internal.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_power.h"
+#include "msm_vidc_debug.h"
+#include "msm_vdec.h"
+#include "msm_venc.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_platform.h"
+
+extern struct msm_vidc_core *g_core;
+
+static void msm_vb2_vm_open(struct vm_area_struct *vma);
+static void msm_vb2_vm_close(struct vm_area_struct *vma);
+
+struct vb2_queue *msm_vidc_get_vb2q(struct msm_vidc_inst *inst,
+	u32 type, const char *func)
+{
+	struct vb2_queue *q = NULL;
+
+	if (type == INPUT_MPLANE) {
+		q = inst->bufq[INPUT_PORT].vb2q;
+	} else if (type == OUTPUT_MPLANE) {
+		q = inst->bufq[OUTPUT_PORT].vb2q;
+	} else if (type == INPUT_META_PLANE) {
+		q = inst->bufq[INPUT_META_PORT].vb2q;
+	} else if (type == OUTPUT_META_PLANE) {
+		q = inst->bufq[OUTPUT_META_PORT].vb2q;
+	} else {
+		i_vpr_e(inst, "%s: invalid buffer type %d\n",
+			__func__, type);
+	}
+	return q;
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0))
+void *msm_vb2_alloc(struct device *dev, unsigned long attrs,
+	unsigned long size, enum dma_data_direction dma_dir,
+	gfp_t gfp_flags)
+{
+	return (void *)0xdeadbeef;
+}
+
+void *msm_vb2_attach_dmabuf(struct device *dev, struct dma_buf *dbuf,
+	unsigned long size, enum dma_data_direction dma_dir)
+{
+	return (void *)0xdeadbeef;
+}
+
+#else
+void *msm_vb2_alloc(struct vb2_buffer *vb, struct device *dev,
+		    unsigned long size)
+{
+	struct context_bank_info *cb = NULL;
+	enum msm_vidc_buffer_region region;
+	enum msm_vidc_buffer_type buf_type;
+	struct msm_vidc_buffer *buf;
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_core *core;
+
+	if (!vb || !dev || !vb->vb2_queue)
+		return ERR_PTR(-EINVAL);
+
+	inst = vb->vb2_queue->drv_priv;
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, inst);
+		return ERR_PTR(-EINVAL);
+	}
+
+	core = inst->core;
+
+	buf_type = v4l2_type_to_driver(vb->type, __func__);
+
+	buf = msm_vidc_fetch_buffer(inst, vb);
+	if (!buf) {
+		i_vpr_e(inst, "%s: failed to fetch buffer\n", __func__);
+		goto error;
+	}
+
+	region = call_mem_op(core, buffer_region, inst, buf_type);
+	cb = msm_vidc_get_context_bank_for_region(inst->core, region);
+	if (!cb) {
+		i_vpr_e(inst, "%s: failed to get context bank device\n", __func__);
+		goto error;
+	}
+
+	buf->inst = inst;
+	buf->type = buf_type;
+	buf->index = vb->index;
+	buf->buffer_size = size;
+	buf->dma_attrs = vb->vb2_queue->dma_attrs;
+
+	buf->kvaddr = dma_alloc_attrs(cb->dev,
+				      buf->buffer_size,
+				      &buf->device_addr,
+				      GFP_KERNEL | vb->vb2_queue->gfp_flags,
+				      buf->dma_attrs);
+	if (!buf->kvaddr) {
+		i_vpr_e(inst, "dma alloc of size %lu failed\n", size);
+		goto error;
+	}
+
+	buf->handler.refcount = &buf->refcount;
+	buf->handler.put = msm_vb2_put;
+	buf->handler.arg = buf;
+
+	refcount_set(&buf->refcount, 1);
+
+	return buf;
+
+error:
+	msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+	put_inst(inst);
+	return ERR_PTR(-ENOMEM);
+}
+
+void *msm_vb2_attach_dmabuf(struct vb2_buffer *vb, struct device *dev,
+	struct dma_buf *dbuf, unsigned long size)
+{
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_core *core;
+	struct msm_vidc_buffer *buf = NULL;
+	struct msm_vidc_buffer *ro_buf, *dummy;
+
+	if (!vb || !dev || !dbuf || !vb->vb2_queue) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return NULL;
+	}
+	inst = vb->vb2_queue->drv_priv;
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, inst);
+		return NULL;
+	}
+	core = inst->core;
+
+	buf = msm_vidc_fetch_buffer(inst, vb);
+	if (!buf) {
+		i_vpr_e(inst, "%s: failed to fetch buffer\n", __func__);
+		buf = NULL;
+		goto exit;
+	}
+	buf->inst = inst;
+	buf->dmabuf = dbuf;
+
+	if (is_decode_session(inst) && is_output_buffer(buf->type)) {
+		list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+			if (ro_buf->dmabuf != buf->dmabuf)
+				continue;
+			print_vidc_buffer(VIDC_LOW, "low ", "attach: found ro buf", inst, ro_buf);
+			buf->attach = ro_buf->attach;
+			ro_buf->attach = NULL;
+			goto exit;
+		}
+	}
+
+	buf->attach = call_mem_op(core, dma_buf_attach, core, dbuf, dev);
+	if (!buf->attach) {
+		buf->attach = NULL;
+		buf = NULL;
+		goto exit;
+	}
+	print_vidc_buffer(VIDC_LOW, "low ", "attach", inst, buf);
+
+exit:
+	if (!buf)
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+	put_inst(inst);
+	return buf;
+}
+#endif
+
+void msm_vb2_vm_open(struct vm_area_struct *vma)
+{
+	struct vb2_vmarea_handler *h = vma->vm_private_data;
+
+	if (IS_ERR_OR_NULL(h))
+		return;
+
+	refcount_inc(h->refcount);
+}
+
+void msm_vb2_vm_close(struct vm_area_struct *vma)
+{
+	struct vb2_vmarea_handler *h = vma->vm_private_data;
+
+	if (IS_ERR_OR_NULL(h))
+		return;
+
+	if (h->put && h->arg)
+		h->put(h->arg);
+}
+
+static const struct vm_operations_struct msm_vb2_vm_dma_ops = {
+	.open = msm_vb2_vm_open,
+	.close = msm_vb2_vm_close,
+};
+
+void msm_vb2_put(void *buf_priv)
+{
+	struct msm_vidc_buffer *buf = buf_priv;
+	enum msm_vidc_buffer_region region;
+	struct context_bank_info *cb;
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_core *core;
+
+	if (IS_ERR_OR_NULL(buf_priv))
+		return;
+
+	inst = buf->inst;
+	if (!inst || !inst->core)
+		return;
+
+	core = inst->core;
+
+	if (refcount_read(&buf->refcount) == 0)
+		return;
+
+	region = call_mem_op(core, buffer_region, inst, buf->type);
+	cb = msm_vidc_get_context_bank_for_region(inst->core, region);
+	if (!cb) {
+		i_vpr_e(inst, "%s: failed to get context bank device\n", __func__);
+		return;
+	}
+
+	if (!refcount_dec_and_test(&buf->refcount))
+		return;
+
+	if (buf->kvaddr && buf->device_addr) {
+		dma_free_attrs(cb->dev, buf->buffer_size, buf->kvaddr,
+			       buf->device_addr, buf->dma_attrs);
+		buf->kvaddr = NULL;
+		buf->device_addr = 0x0;
+	}
+	put_inst(inst);
+}
+
+int msm_vb2_mmap(void *buf_priv, struct vm_area_struct *vma)
+{
+	struct msm_vidc_buffer *buf = buf_priv;
+	enum msm_vidc_buffer_region region;
+	struct context_bank_info *cb;
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_core *core;
+	int ret;
+
+	if (IS_ERR_OR_NULL(buf_priv))
+		return -EINVAL;
+
+	inst = buf->inst;
+    if (!inst || !inst->core)
+		return -EINVAL;
+
+    core = inst->core;
+
+	region = call_mem_op(core, buffer_region, inst, buf->type);
+	cb = msm_vidc_get_context_bank_for_region(inst->core, region);
+	if (!cb) {
+		i_vpr_e(inst, "%s: failed to get context bank device\n", __func__);
+		return 0;
+	}
+
+	ret = dma_mmap_attrs(cb->dev, vma, buf->kvaddr, buf->device_addr,
+			     buf->buffer_size, buf->dma_attrs);
+	if (ret) {
+		i_vpr_e(inst, "Remapping memory failed, error: %d\n", ret);
+		return ret;
+	}
+
+	vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP);
+	vma->vm_private_data	= &buf->handler;
+	vma->vm_ops		= &msm_vb2_vm_dma_ops;
+
+	vma->vm_ops->open(vma);
+
+	return 0;
+}
+
+struct msm_vb2_attachment {
+	struct sg_table sgt;
+	enum dma_data_direction dma_dir;
+};
+
+static int msm_vb2_dmabuf_ops_attach(struct dma_buf *dbuf,
+				     struct dma_buf_attachment *dbuf_attach)
+{
+	struct msm_vb2_attachment *attach;
+	unsigned int i;
+	struct scatterlist *rd, *wr;
+	struct sg_table *sgt;
+	struct msm_vidc_buffer *buf = dbuf->priv;
+	int ret;
+
+	attach = kzalloc(sizeof(*attach), GFP_KERNEL);
+	if (!attach)
+		return -ENOMEM;
+
+	sgt = &attach->sgt;
+	/* Copy the buf->base_sgt scatter list to the attachment, as we can't
+	 * map the same scatter list to multiple attachments at the same time.
+	 */
+	ret = sg_alloc_table(sgt, buf->sg_table->orig_nents, GFP_KERNEL);
+	if (ret) {
+		kfree(attach);
+		return -ENOMEM;
+	}
+
+	rd = buf->sg_table->sgl;
+	wr = sgt->sgl;
+	for (i = 0; i < sgt->orig_nents; ++i) {
+		sg_set_page(wr, sg_page(rd), rd->length, rd->offset);
+		rd = sg_next(rd);
+		wr = sg_next(wr);
+	}
+
+	attach->dma_dir = DMA_NONE;
+	dbuf_attach->priv = attach;
+
+	return 0;
+}
+
+static void msm_vb2_dmabuf_ops_detach(struct dma_buf *dbuf,
+	struct dma_buf_attachment *db_attach)
+{
+	struct msm_vb2_attachment *attach = db_attach->priv;
+	struct sg_table *sgt;
+
+	if (!attach)
+		return;
+
+	sgt = &attach->sgt;
+
+	/* release the scatterlist cache */
+	if (attach->dma_dir != DMA_NONE)
+		/*
+		 * Cache sync can be skipped here, as the vb2_dc memory is
+		 * allocated from device coherent memory, which means the
+		 * memory locations do not require any explicit cache
+		 * maintenance prior or after being used by the device.
+		 */
+		dma_unmap_sgtable(db_attach->dev, sgt, attach->dma_dir,
+				  DMA_ATTR_SKIP_CPU_SYNC);
+	sg_free_table(sgt);
+	kfree(attach);
+	db_attach->priv = NULL;
+}
+
+static struct sg_table *msm_vb2_dmabuf_ops_map(
+	struct dma_buf_attachment *db_attach, enum dma_data_direction dma_dir)
+{
+	struct msm_vb2_attachment *attach = db_attach->priv;
+	struct sg_table *sgt;
+
+	sgt = &attach->sgt;
+	/* return previously mapped sg table */
+	if (attach->dma_dir == dma_dir)
+		return sgt;
+
+	/* release any previous cache */
+	if (attach->dma_dir != DMA_NONE) {
+		dma_unmap_sgtable(db_attach->dev, sgt, attach->dma_dir,
+				  DMA_ATTR_SKIP_CPU_SYNC);
+		attach->dma_dir = DMA_NONE;
+	}
+
+	/*
+	 * mapping to the client with new direction, no cache sync
+	 * required see comment in msm_vb2_dmabuf_ops_detach()
+	 */
+	if (dma_map_sgtable(db_attach->dev, sgt, dma_dir,
+			    DMA_ATTR_SKIP_CPU_SYNC)) {
+		pr_err("failed to map scatterlist\n");
+		return ERR_PTR(-EIO);
+	}
+
+	attach->dma_dir = dma_dir;
+
+	return sgt;
+}
+
+static void msm_vb2_dmabuf_ops_unmap(struct dma_buf_attachment *db_attach,
+	struct sg_table *sgt, enum dma_data_direction dma_dir)
+{
+	/* nothing to be done here */
+}
+
+static void msm_vb2_dmabuf_ops_release(struct dma_buf *dbuf)
+{
+	/* drop reference obtained in vb2_dc_get_dmabuf */
+	msm_vb2_put(dbuf->priv);
+}
+
+static int
+msm_vb2_dmabuf_ops_begin_cpu_access(struct dma_buf *dbuf,
+				   enum dma_data_direction direction)
+{
+	return 0;
+}
+
+static int
+msm_vb2_dmabuf_ops_end_cpu_access(struct dma_buf *dbuf,
+				 enum dma_data_direction direction)
+{
+	return 0;
+}
+
+static int msm_vb2_dmabuf_ops_mmap(struct dma_buf *dbuf,
+	struct vm_area_struct *vma)
+{
+	return msm_vb2_mmap(dbuf->priv, vma);
+}
+
+static const struct dma_buf_ops msm_vb2_dmabuf_ops = {
+	.attach = msm_vb2_dmabuf_ops_attach,
+	.detach = msm_vb2_dmabuf_ops_detach,
+	.map_dma_buf = msm_vb2_dmabuf_ops_map,
+	.unmap_dma_buf = msm_vb2_dmabuf_ops_unmap,
+	.begin_cpu_access = msm_vb2_dmabuf_ops_begin_cpu_access,
+	.end_cpu_access = msm_vb2_dmabuf_ops_end_cpu_access,
+	.mmap = msm_vb2_dmabuf_ops_mmap,
+	.release = msm_vb2_dmabuf_ops_release,
+};
+
+static struct sg_table *vb2_dc_get_base_sgt(struct msm_vidc_buffer *buf)
+{
+	struct msm_vidc_inst *inst = buf->inst;
+	struct msm_vidc_core *core = inst->core;
+	struct context_bank_info *cb = NULL;
+	enum msm_vidc_buffer_region region;
+	struct sg_table *sgt;
+	int ret;
+
+	sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
+	if (!sgt) {
+		i_vpr_e(inst, "%s: failed to alloc sg_table\n", __func__);
+		return NULL;
+	}
+
+	region = call_mem_op(core, buffer_region, inst, buf->type);
+	cb = msm_vidc_get_context_bank_for_region(inst->core, region);
+	if (!cb) {
+		i_vpr_e(inst, "%s: failed to get context bank device\n", __func__);
+		return NULL;
+	}
+
+	ret = dma_get_sgtable_attrs(cb->dev, sgt, buf->kvaddr, buf->device_addr,
+				    buf->buffer_size, buf->dma_attrs);
+	if (ret < 0) {
+		i_vpr_e(inst, "%s: failed to get scatterlist from DMA API\n", __func__);
+		kfree(sgt);
+		return NULL;
+	}
+
+	return sgt;
+}
+
+struct dma_buf *msm_vb2_get_dmabuf(struct vb2_buffer *vb,
+				  void *buf_priv,
+				  unsigned long flags)
+{
+	struct dma_buf_export_info exp_info = { .exp_name = KBUILD_MODNAME, \
+						.owner = THIS_MODULE };
+	struct msm_vidc_buffer *buf = buf_priv;
+	struct msm_vidc_inst *inst = buf->inst;
+	struct dma_buf *dbuf;
+
+	exp_info.ops = &msm_vb2_dmabuf_ops;
+	exp_info.size = buf->buffer_size;
+	exp_info.flags = flags;
+	exp_info.priv = buf;
+
+	if (!buf->sg_table)
+		buf->sg_table = vb2_dc_get_base_sgt(buf);
+
+	if (WARN_ON(!buf->sg_table))
+		return NULL;
+
+	dbuf = dma_buf_export(&exp_info);
+	if (IS_ERR(dbuf)) {
+		i_vpr_e(inst, "%s: failed to export dma buf\n", __func__);
+		return NULL;
+	}
+
+	/* dmabuf keeps reference to vb2 buffer */
+	refcount_inc(&buf->refcount);
+
+	return dbuf;
+}
+
+void msm_vb2_detach_dmabuf(void *buf_priv)
+{
+	struct msm_vidc_buffer *vbuf = buf_priv;
+	struct msm_vidc_buffer *ro_buf, *dummy;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *inst;
+
+	if (!vbuf || !vbuf->inst) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+	inst = vbuf->inst;
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, inst);
+		return;
+	}
+	core = inst->core;
+
+	if (is_decode_session(inst) && is_output_buffer(vbuf->type)) {
+		list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+			if (ro_buf->dmabuf != vbuf->dmabuf)
+				continue;
+			print_vidc_buffer(VIDC_LOW, "low ", "detach: found ro buf", inst, ro_buf);
+			ro_buf->attach = vbuf->attach;
+			vbuf->attach = NULL;
+			goto exit;
+		}
+	}
+
+	print_vidc_buffer(VIDC_LOW, "low ", "detach", inst, vbuf);
+	if (vbuf->attach && vbuf->dmabuf) {
+		call_mem_op(core, dma_buf_detach, core, vbuf->dmabuf, vbuf->attach);
+		vbuf->attach = NULL;
+	}
+
+exit:
+	vbuf->dmabuf = NULL;
+	vbuf->inst = NULL;
+	return;
+}
+
+int msm_vb2_map_dmabuf(void *buf_priv)
+{
+	int rc = 0;
+	struct msm_vidc_buffer *buf = buf_priv;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_buffer *ro_buf, *dummy;
+
+	if (!buf || !buf->inst) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	inst = buf->inst;
+	inst = get_inst_ref(g_core, inst);
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+
+	if (is_decode_session(inst) && is_output_buffer(buf->type)) {
+		list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+			if (ro_buf->dmabuf != buf->dmabuf)
+				continue;
+			print_vidc_buffer(VIDC_LOW, "low ", "map: found ro buf", inst, ro_buf);
+			buf->sg_table = ro_buf->sg_table;
+			buf->device_addr = ro_buf->device_addr;
+			ro_buf->sg_table = NULL;
+			goto exit;
+		}
+	}
+
+	buf->sg_table = call_mem_op(core, dma_buf_map_attachment, core, buf->attach);
+	if (!buf->sg_table || !buf->sg_table->sgl) {
+		buf->sg_table = NULL;
+		rc = -ENOMEM;
+		goto exit;
+	}
+	buf->device_addr = sg_dma_address(buf->sg_table->sgl);
+	print_vidc_buffer(VIDC_HIGH, "high", "map", inst, buf);
+
+exit:
+	if (rc)
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+	put_inst(inst);
+	return rc;
+}
+
+void msm_vb2_unmap_dmabuf(void *buf_priv)
+{
+	struct msm_vidc_buffer *vbuf = buf_priv;
+	struct msm_vidc_buffer *ro_buf, *dummy;
+	struct msm_vidc_core *core;
+	struct msm_vidc_inst *inst;
+
+	if (!vbuf || !vbuf->inst) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+	inst = vbuf->inst;
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, inst);
+		return;
+	}
+	core = inst->core;
+
+	if (is_decode_session(inst) && is_output_buffer(vbuf->type)) {
+		list_for_each_entry_safe(ro_buf, dummy, &inst->buffers.read_only.list, list) {
+			if (ro_buf->dmabuf != vbuf->dmabuf)
+				continue;
+			print_vidc_buffer(VIDC_LOW, "low ", "unmap: found ro buf", inst, ro_buf);
+			ro_buf->sg_table = vbuf->sg_table;
+			vbuf->sg_table = NULL;
+			vbuf->device_addr = 0x0;
+			goto exit;
+		}
+	}
+
+	print_vidc_buffer(VIDC_HIGH, "high", "unmap", inst, vbuf);
+	if (vbuf->attach && vbuf->sg_table) {
+		call_mem_op(core, dma_buf_unmap_attachment, core, vbuf->attach, vbuf->sg_table);
+		vbuf->sg_table = NULL;
+		vbuf->device_addr = 0x0;
+	}
+
+exit:
+	return;
+}
+
+int msm_vb2_queue_setup(struct vb2_queue *q,
+		unsigned int *num_buffers, unsigned int *num_planes,
+		unsigned int sizes[], struct device *alloc_devs[])
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_core *core;
+	int port;
+	struct v4l2_format *f;
+	enum msm_vidc_buffer_type buffer_type = 0;
+	enum msm_vidc_buffer_region region = MSM_VIDC_REGION_NONE;
+	struct context_bank_info *cb = NULL;
+	struct msm_vidc_buffers *buffers;
+
+	if (!q || !num_buffers || !num_planes
+		|| !sizes || !q->drv_priv) {
+		d_vpr_e("%s: invalid params, q = %pK, %pK, %pK\n",
+			__func__, q, num_buffers, num_planes);
+		return -EINVAL;
+	}
+	inst = q->drv_priv;
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params %pK\n", __func__, inst);
+		return -EINVAL;
+	}
+	core = inst->core;
+
+	port = v4l2_type_to_driver_port(inst, q->type, __func__);
+	if (port < 0)
+		return -EINVAL;
+
+	if (!is_state(inst, MSM_VIDC_STREAMING)) {
+		/* prepare dependency list once per session */
+		if (!inst->caps_list_prepared) {
+			rc = msm_vidc_prepare_dependency_list(inst);
+			if (rc)
+				return rc;
+			inst->caps_list_prepared = true;
+		}
+
+		/* adjust v4l2 properties for master port */
+		if ((is_encode_session(inst) && port == OUTPUT_PORT) ||
+			(is_decode_session(inst) && port == INPUT_PORT)) {
+			rc = msm_vidc_adjust_v4l2_properties(inst);
+			if (rc) {
+				i_vpr_e(inst, "%s: failed to adjust properties\n", __func__);
+				return rc;
+			}
+		}
+	}
+
+	if (*num_planes && (port == INPUT_PORT || port == OUTPUT_PORT)) {
+		f = &inst->fmts[port];
+		if (*num_planes != f->fmt.pix_mp.num_planes) {
+			i_vpr_e(inst, "%s: requested num_planes %d not supported %d\n",
+			__func__, *num_planes, f->fmt.pix_mp.num_planes);
+			return -EINVAL;
+		}
+		if (sizes[0] < inst->fmts[port].fmt.pix_mp.plane_fmt[0].sizeimage) {
+			i_vpr_e(inst, "%s: requested size %d not acceptable\n",
+			__func__, sizes[0]);
+			return -EINVAL;
+		}
+	}
+
+	buffer_type = v4l2_type_to_driver(q->type, __func__);
+	if (!buffer_type)
+		return -EINVAL;
+
+	if (!is_state(inst, MSM_VIDC_STREAMING) && !(*num_buffers)) {
+		rc = msm_vidc_free_buffers(inst, buffer_type);
+		if (rc) {
+			i_vpr_e(inst, "%s: failed to free buffers, type %s\n",
+				__func__, v4l2_type_name(q->type));
+			return rc;
+		}
+	}
+
+	buffers = msm_vidc_get_buffers(inst, buffer_type, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	buffers->min_count = call_session_op(core, min_count, inst, buffer_type);
+	buffers->extra_count = call_session_op(core, extra_count, inst, buffer_type);
+
+	if ((q->num_buffers + *num_buffers) < (buffers->min_count + buffers->extra_count)) {
+		*num_buffers = buffers->min_count + buffers->extra_count;
+		buffers->actual_count = *num_buffers;
+	} else {
+		buffers->actual_count += *num_buffers;
+	}
+	*num_planes = 1;
+
+	buffers->size = call_session_op(core, buffer_size, inst, buffer_type);
+	if (port == INPUT_PORT || port == OUTPUT_PORT) {
+		inst->fmts[port].fmt.pix_mp.plane_fmt[0].sizeimage = buffers->size;
+		sizes[0] = inst->fmts[port].fmt.pix_mp.plane_fmt[0].sizeimage;
+	} else if (port == OUTPUT_META_PORT) {
+		inst->fmts[port].fmt.meta.buffersize = buffers->size;
+		sizes[0] = inst->fmts[port].fmt.meta.buffersize;
+	} else if (port == INPUT_META_PORT) {
+		inst->fmts[port].fmt.meta.buffersize = buffers->size;
+		if (inst->capabilities[SUPER_FRAME].value)
+			sizes[0] = inst->capabilities[SUPER_FRAME].value *
+				inst->fmts[port].fmt.meta.buffersize;
+		else
+			sizes[0] = inst->fmts[port].fmt.meta.buffersize;
+	}
+
+	rc = msm_vidc_allocate_buffers(inst, buffer_type, *num_buffers);
+	if (rc) {
+		i_vpr_e(inst, "%s: failed to allocate buffers, type %s\n",
+			__func__, v4l2_type_name(q->type));
+		return rc;
+	}
+
+	region = call_mem_op(core, buffer_region, inst, buffer_type);
+	cb = msm_vidc_get_context_bank_for_region(core, region);
+	if (!cb) {
+		d_vpr_e("%s: Failed to get context bank device\n",
+			__func__);
+		return -EIO;
+	}
+	q->dev = cb->dev;
+
+	i_vpr_h(inst,
+		"queue_setup: type %s num_buffers %d sizes[0] %d cb %s\n",
+		v4l2_type_name(q->type), *num_buffers, sizes[0], cb->name);
+	return rc;
+}
+
+int msm_vb2_start_streaming(struct vb2_queue *q, unsigned int count)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst;
+
+	if (!q || !q->drv_priv) {
+		d_vpr_e("%s: invalid input, q = %pK\n", __func__, q);
+		return -EINVAL;
+	}
+	inst = q->drv_priv;
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	rc = inst->event_handle(inst, MSM_VIDC_STREAMON, q);
+	if (rc) {
+		i_vpr_e(inst, "Streamon: %s failed\n", v4l2_type_name(q->type));
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		goto exit;
+	}
+
+exit:
+	return rc;
+}
+
+int msm_vidc_start_streaming(struct msm_vidc_inst *inst, struct vb2_queue *q)
+{
+	enum msm_vidc_buffer_type buf_type;
+	int rc = 0;
+
+	if (q->type == INPUT_META_PLANE || q->type == OUTPUT_META_PLANE) {
+		i_vpr_h(inst, "%s: nothing to start on %s\n",
+			__func__, v4l2_type_name(q->type));
+		return 0;
+	}
+	if (q->type != INPUT_MPLANE && q->type != OUTPUT_MPLANE) {
+		i_vpr_e(inst, "%s: invalid type %d\n", __func__, q->type);
+		return -EINVAL;
+	}
+	if (!is_decode_session(inst) && !is_encode_session(inst)) {
+		i_vpr_e(inst, "%s: invalid session %d\n", __func__, inst->domain);
+		return -EINVAL;
+	}
+	i_vpr_h(inst, "Streamon: %s\n", v4l2_type_name(q->type));
+
+	if (!inst->once_per_session_set) {
+		inst->once_per_session_set = true;
+		rc = msm_vidc_session_set_codec(inst);
+		if (rc)
+			return rc;
+
+		rc = msm_vidc_session_set_secure_mode(inst);
+		if (rc)
+			return rc;
+
+		if (is_encode_session(inst)) {
+			rc = msm_vidc_alloc_and_queue_session_internal_buffers(inst,
+				MSM_VIDC_BUF_ARP);
+			if (rc)
+				return rc;
+		} else if (is_decode_session(inst)) {
+			rc = msm_vidc_session_set_default_header(inst);
+			if (rc)
+				return rc;
+
+			rc = msm_vidc_alloc_and_queue_session_internal_buffers(inst,
+				MSM_VIDC_BUF_PERSIST);
+			if (rc)
+				return rc;
+		}
+	}
+
+	if (is_decode_session(inst))
+		inst->decode_batch.enable = msm_vidc_allow_decode_batch(inst);
+
+	msm_vidc_allow_dcvs(inst);
+	msm_vidc_power_data_reset(inst);
+
+	if (q->type == INPUT_MPLANE) {
+		if (is_decode_session(inst))
+			rc = msm_vdec_streamon_input(inst);
+		else if (is_encode_session(inst))
+			rc = msm_venc_streamon_input(inst);
+	} else if (q->type == OUTPUT_MPLANE) {
+		if (is_decode_session(inst))
+			rc = msm_vdec_streamon_output(inst);
+		else if (is_encode_session(inst))
+			rc = msm_venc_streamon_output(inst);
+	}
+	if (rc)
+		return rc;
+
+	/* print final buffer counts & size details */
+	msm_vidc_print_buffer_info(inst);
+
+	/* print internal buffer memory usage stats */
+	msm_vidc_print_memory_stats(inst);
+
+	buf_type = v4l2_type_to_driver(q->type, __func__);
+	if (!buf_type)
+		return -EINVAL;
+
+	/* queue pending buffers */
+	rc = msm_vidc_queue_deferred_buffers(inst, buf_type);
+	if (rc)
+		return rc;
+
+	/* initialize statistics timer(one time) */
+	if (!inst->stats.time_ms)
+		inst->stats.time_ms = ktime_get_ns() / 1000 / 1000;
+
+	/* schedule to print buffer statistics */
+	rc = schedule_stats_work(inst);
+	if (rc)
+		return rc;
+
+	if ((q->type == INPUT_MPLANE && inst->bufq[OUTPUT_PORT].vb2q->streaming) ||
+		(q->type == OUTPUT_MPLANE && inst->bufq[INPUT_PORT].vb2q->streaming)) {
+		rc = msm_vidc_get_properties(inst);
+		if (rc)
+			return rc;
+	}
+
+	i_vpr_h(inst, "Streamon: %s successful\n", v4l2_type_name(q->type));
+	return rc;
+}
+
+int msm_vidc_stop_streaming(struct msm_vidc_inst *inst, struct vb2_queue *q)
+{
+	int rc = 0;
+
+	if (q->type == INPUT_META_PLANE || q->type == OUTPUT_META_PLANE) {
+		i_vpr_h(inst, "%s: nothing to stop on %s\n",
+			__func__, v4l2_type_name(q->type));
+		return 0;
+	}
+	if (q->type != INPUT_MPLANE && q->type != OUTPUT_MPLANE) {
+		i_vpr_e(inst, "%s: invalid type %d\n", __func__, q->type);
+		return -EINVAL;
+	}
+	if (!is_decode_session(inst) && !is_encode_session(inst)) {
+		i_vpr_e(inst, "%s: invalid session %d\n", __func__, inst->domain);
+		return -EINVAL;
+	}
+	i_vpr_h(inst, "Streamoff: %s\n", v4l2_type_name(q->type));
+
+	if (q->type == INPUT_MPLANE) {
+		if (is_decode_session(inst))
+			rc = msm_vdec_streamoff_input(inst);
+		else if (is_encode_session(inst))
+			rc = msm_venc_streamoff_input(inst);
+	} else if (q->type == OUTPUT_MPLANE) {
+		if (is_decode_session(inst))
+			rc = msm_vdec_streamoff_output(inst);
+		else if (is_encode_session(inst))
+			rc = msm_venc_streamoff_output(inst);
+	}
+	if (rc)
+		return rc;
+
+	/* Input port streamoff */
+	if (q->type == INPUT_MPLANE) {
+		/* flush timestamps list */
+		msm_vidc_flush_ts(inst);
+
+		/* flush buffer_stats list */
+		msm_vidc_flush_buffer_stats(inst);
+	}
+
+	/* print internal buffer memory usage stats */
+	msm_vidc_print_memory_stats(inst);
+
+	i_vpr_h(inst, "Streamoff: %s successful\n", v4l2_type_name(q->type));
+	return rc;
+}
+
+void msm_vb2_stop_streaming(struct vb2_queue *q)
+{
+	struct msm_vidc_inst *inst;
+	int rc = 0;
+
+	if (!q || !q->drv_priv) {
+		d_vpr_e("%s: invalid input, q = %pK\n", __func__, q);
+		return;
+	}
+	inst = q->drv_priv;
+	if (!inst) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+
+	rc = inst->event_handle(inst, MSM_VIDC_STREAMOFF, q);
+	if (rc) {
+		i_vpr_e(inst, "Streamoff: %s failed\n", v4l2_type_name(q->type));
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+	}
+
+	return;
+}
+
+void msm_vb2_buf_queue(struct vb2_buffer *vb2)
+{
+	int rc = 0;
+	struct msm_vidc_inst *inst;
+	struct msm_vidc_core *core;
+	u64 timestamp_us = 0;
+	u64 ktime_ns = ktime_get_ns();
+
+	if (!vb2) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+
+	inst = vb2_get_drv_priv(vb2->vb2_queue);
+	if (!inst || !inst->core) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return;
+	}
+	core = inst->core;
+
+	/*
+	 * As part of every qbuf initalise request to true.
+	 * If there are any dynamic controls associated with qbuf,
+	 * they will set as part s_ctrl() from v4l2_ctrl_request_setup().
+	 * Once v4l2_ctrl_request_setup() is done, reset request variable.
+	 * If the buffer does not have any requests with it, then
+	 * v4l2_ctrl_request_setup() will return 0.
+	 */
+	if (core->capabilities[SUPPORTS_REQUESTS].value) {
+		/*
+		 * If Request API is enabled:
+		 * Call request_setup and request_complete without acquiring lock
+		 * to avoid deadlock issues because request_setup or request_complete
+		 * would call .s_ctrl and .g_volatile_ctrl respectively which acquire
+		 * lock too.
+		 */
+		inst->request = true;
+		rc = v4l2_ctrl_request_setup(vb2->req_obj.req,
+				&inst->ctrl_handler);
+		inst->request = false;
+		v4l2_ctrl_request_complete(vb2->req_obj.req, &inst->ctrl_handler);
+		if (rc) {
+			i_vpr_e(inst, "%s: request setup failed, error %d\n",
+				__func__, rc);
+			goto exit;
+		}
+	}
+
+	if (!vb2->planes[0].bytesused) {
+		if (vb2->type == INPUT_MPLANE) {
+			/* Expecting non-zero filledlen on INPUT port */
+			i_vpr_e(inst,
+				"%s: zero bytesused input buffer not supported\n", __func__);
+			rc = -EINVAL;
+			goto exit;
+		}
+		if ((vb2->type == OUTPUT_META_PLANE && is_any_meta_tx_out_enabled(inst)) ||
+			(vb2->type == INPUT_META_PLANE && is_any_meta_tx_inp_enabled(inst))) {
+			/*
+			 * vb2 is not allowing client to pass data in output meta plane.
+			 * adjust the bytesused as client will send buffer tag metadata
+			 * in output meta plane if DPB_TAG_LIST, or OUTBUF_FENCE metadata
+			 * is enabled.
+			 */
+			vb2->planes[0].bytesused = vb2->planes[0].length;
+		}
+	}
+
+	if (is_encode_session(inst) && vb2->type == INPUT_MPLANE) {
+		timestamp_us = div_u64(vb2->timestamp, 1000);
+		msm_vidc_set_auto_framerate(inst, timestamp_us);
+	}
+	inst->last_qbuf_time_ns = ktime_ns;
+
+	if (vb2->type == INPUT_MPLANE) {
+		rc = msm_vidc_update_input_rate(inst, div_u64(ktime_ns, 1000));
+		if (rc)
+			goto exit;
+	}
+
+	if (is_decode_session(inst))
+		rc = msm_vdec_qbuf(inst, vb2);
+	else if (is_encode_session(inst))
+		rc = msm_venc_qbuf(inst, vb2);
+	else
+		rc = -EINVAL;
+	if (rc) {
+		print_vb2_buffer("failed vb2-qbuf", inst, vb2);
+		goto exit;
+	}
+
+exit:
+	if (rc) {
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		vb2_buffer_done(vb2, VB2_BUF_STATE_ERROR);
+	}
+}
+
+int msm_vb2_buf_out_validate(struct vb2_buffer *vb)
+{
+	struct vb2_v4l2_buffer *vbuf;
+
+	if (!vb) {
+		d_vpr_e("%s: invalid vb\n", __func__);
+		return -EINVAL;
+	}
+
+	vbuf = to_vb2_v4l2_buffer(vb);
+	vbuf->field = V4L2_FIELD_NONE;
+	return 0;
+}
+
+void msm_vb2_request_complete(struct vb2_buffer *vb)
+{
+	struct msm_vidc_inst *inst;
+
+	if (!vb) {
+		d_vpr_e("%s: invalid vb\n", __func__);
+		return;
+	}
+	inst = vb2_get_drv_priv(vb->vb2_queue);
+	if (!inst) {
+		d_vpr_e("%s: invalid inst\n", __func__);
+		return;
+	}
+
+	i_vpr_l(inst, "%s: vb type %d, index %d\n",
+		__func__, vb->type, vb->index);
+	v4l2_ctrl_request_complete(vb->req_obj.req, &inst->ctrl_handler);
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/resources.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/resources.c
@@ -0,0 +1,1775 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/sort.h>
+#include <linux/clk.h>
+#include <linux/pm_runtime.h>
+#include <linux/pm_domain.h>
+#include <linux/pm_opp.h>
+#include <linux/reset.h>
+#include <linux/interconnect.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+#ifdef CONFIG_MSM_MMRM
+#include <linux/soc/qcom/msm_mmrm.h>
+#endif
+
+#include "msm_vidc_core.h"
+#include "msm_vidc_power.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_driver.h"
+#include "msm_vidc_platform.h"
+#include "venus_hfi.h"
+
+/* Less than 50MBps is treated as trivial BW change */
+#define TRIVIAL_BW_THRESHOLD 50000
+#define TRIVIAL_BW_CHANGE(a, b) \
+	((a) > (b) ? (a) - (b) < TRIVIAL_BW_THRESHOLD : \
+		(b) - (a) < TRIVIAL_BW_THRESHOLD)
+
+static struct clock_residency *get_residency_stats(struct clock_info *cl, u64 rate);
+static int __update_residency_stats(struct msm_vidc_core *core,
+		struct clock_info *cl, u64 rate);
+enum reset_state {
+	INIT = 1,
+	ASSERT,
+	DEASSERT,
+};
+
+/* A comparator to compare loads (needed later on) */
+static inline int cmp(const void *a, const void *b)
+{
+	/* want to sort in reverse so flip the comparison */
+	return ((struct freq_table *)b)->freq -
+		((struct freq_table *)a)->freq;
+}
+
+static void __fatal_error(bool fatal)
+{
+	WARN_ON(fatal);
+}
+
+static void devm_llcc_release(void *res)
+{
+	d_vpr_h("%s()\n", __func__);
+	llcc_slice_putd((struct llcc_slice_desc *)res);
+}
+
+static struct llcc_slice_desc *devm_llcc_get(struct device *dev, u32 id)
+{
+	struct llcc_slice_desc *llcc = NULL;
+	int rc = 0;
+
+	llcc = llcc_slice_getd(id);
+	if (!llcc)
+		return NULL;
+
+	/**
+	 * register release callback with devm, so that when device goes
+	 * out of scope(during remove sequence), devm will take care of
+	 * de-register part by invoking release callback.
+	 */
+	rc = devm_add_action_or_reset(dev, devm_llcc_release, (void *)llcc);
+	if (rc)
+		return NULL;
+
+	return llcc;
+}
+
+#ifdef CONFIG_MSM_MMRM
+static void devm_mmrm_release(void *res)
+{
+	d_vpr_h("%s()\n", __func__);
+	mmrm_client_deregister((struct mmrm_client *)res);
+}
+
+static struct mmrm_client *devm_mmrm_get(struct device *dev, struct mmrm_client_desc *desc)
+{
+	struct mmrm_client *mmrm = NULL;
+	int rc = 0;
+
+	mmrm = mmrm_client_register(desc);
+	if (!mmrm)
+		return NULL;
+
+	/**
+	 * register release callback with devm, so that when device goes
+	 * out of scope(during remove sequence), devm will take care of
+	 * de-register part by invoking release callback.
+	 */
+	rc = devm_add_action_or_reset(dev, devm_mmrm_release, (void *)mmrm);
+	if (rc)
+		return NULL;
+
+	return mmrm;
+}
+#endif
+
+static void devm_pd_release(void *res)
+{
+	struct device *pd = (struct device *)res;
+
+	d_vpr_h("%s(): %s\n", __func__, dev_name(pd));
+	dev_pm_domain_detach(pd, true);
+}
+
+static struct device *devm_pd_get(struct device *dev, const char *name)
+{
+	struct device *pd = NULL;
+	int rc = 0;
+
+	pd = dev_pm_domain_attach_by_name(dev, name);
+	if (!pd) {
+		d_vpr_e("%s: pm domain attach failed %s\n", __func__, name);
+		return NULL;
+	}
+
+	rc = devm_add_action_or_reset(dev, devm_pd_release, (void *)pd);
+	if (rc) {
+		d_vpr_e("%s: add action or reset failed %s\n", __func__, name);
+		return NULL;
+	}
+
+	return pd;
+}
+
+static void devm_opp_dl_release(void *res)
+{
+	struct device_link *link = (struct device_link *)res;
+
+	d_vpr_h("%s(): %s\n", __func__, dev_name(&link->link_dev));
+	device_link_del(link);
+}
+
+static int devm_opp_dl_get(struct device *dev, struct device *supplier)
+{
+	u32 flag = DL_FLAG_RPM_ACTIVE | DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS;
+	struct device_link *link = NULL;
+	int rc = 0;
+
+	link = device_link_add(dev, supplier, flag);
+	if (!link) {
+		d_vpr_e("%s: device link add failed\n", __func__);
+		return -EINVAL;
+	}
+
+	rc = devm_add_action_or_reset(dev, devm_opp_dl_release, (void *)link);
+	if (rc) {
+		d_vpr_e("%s: add action or reset failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static void devm_pm_runtime_put_sync(void *res)
+{
+	struct device *dev = (struct device *)res;
+
+	d_vpr_h("%s(): %s\n", __func__, dev_name(dev));
+	pm_runtime_put_sync(dev);
+}
+
+static int devm_pm_runtime_get_sync(struct device *dev)
+{
+	int rc = 0;
+
+	rc = pm_runtime_get_sync(dev);
+	if (rc < 0) {
+		d_vpr_e("%s: pm domain get sync failed\n", __func__);
+		return rc;
+	}
+
+	rc = devm_add_action_or_reset(dev, devm_pm_runtime_put_sync, (void *)dev);
+	if (rc) {
+		d_vpr_e("%s: add action or reset failed\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __opp_set_rate(struct msm_vidc_core *core, u64 freq)
+{
+	unsigned long opp_freq = 0;
+	struct dev_pm_opp *opp;
+	int rc = 0;
+
+	opp_freq = freq;
+
+	/* find max(ceil) freq from opp table */
+	opp = dev_pm_opp_find_freq_ceil(&core->pdev->dev, &opp_freq);
+	if (IS_ERR(opp)) {
+		opp = dev_pm_opp_find_freq_floor(&core->pdev->dev, &opp_freq);
+		if (IS_ERR(opp)) {
+			d_vpr_e("%s: unable to find freq %llu in opp table\n", __func__, freq);
+			return -EINVAL;
+		}
+	}
+	dev_pm_opp_put(opp);
+
+	/* print freq value */
+	d_vpr_h("%s: set rate %lu (requested %llu)\n",
+		__func__, opp_freq, freq);
+
+	/* scale freq to power up mxc & mmcx */
+	rc = dev_pm_opp_set_rate(&core->pdev->dev, opp_freq);
+	if (rc) {
+		d_vpr_e("%s: failed to set rate\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __init_register_base(struct msm_vidc_core *core)
+{
+	struct msm_vidc_resource *res;
+
+	res = core->resource;
+
+	res->register_base_addr = devm_platform_ioremap_resource(core->pdev, 0);
+	if (IS_ERR(res->register_base_addr)) {
+		d_vpr_e("%s: map reg addr failed %ld\n",
+			__func__, PTR_ERR(res->register_base_addr));
+		return -EINVAL;
+	}
+	d_vpr_h("%s: reg_base %#llx\n", __func__, (uint64_t)res->register_base_addr);
+
+	return 0;
+}
+
+static int __init_irq(struct msm_vidc_core *core)
+{
+	struct msm_vidc_resource *res;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 16, 0))
+	struct resource *kres;
+#endif
+	int rc = 0;
+
+	res = core->resource;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 16, 0))
+	res->irq = platform_get_irq(core->pdev, 0);
+#else
+	kres = platform_get_resource(core->pdev, IORESOURCE_IRQ, 0);
+	res->irq = kres ? kres->start : -1;
+#endif
+	if (res->irq < 0)
+		d_vpr_e("%s: get irq failed, %d\n", __func__, res->irq);
+
+	d_vpr_h("%s: irq %d\n", __func__, res->irq);
+
+	rc = devm_request_threaded_irq(&core->pdev->dev, res->irq, venus_hfi_isr,
+			venus_hfi_isr_handler, IRQF_TRIGGER_HIGH, "msm-vidc", core);
+	if (rc) {
+		d_vpr_e("%s: Failed to allocate venus IRQ\n", __func__);
+		return rc;
+	}
+	disable_irq_nosync(res->irq);
+
+	return rc;
+}
+
+static int __init_bus(struct msm_vidc_core *core)
+{
+	const struct bw_table *bus_tbl;
+	struct bus_set *interconnects;
+	struct bus_info *binfo = NULL;
+	u32 bus_count = 0, cnt = 0;
+	int rc = 0;
+
+	interconnects = &core->resource->bus_set;
+
+	bus_tbl = core->platform->data.bw_tbl;
+	bus_count = core->platform->data.bw_tbl_size;
+
+	if (!bus_tbl || !bus_count) {
+		d_vpr_e("%s: invalid bus tbl 0x%p or count %u\n",
+			__func__, bus_tbl, bus_count);
+		return -EINVAL;
+	}
+
+	/* allocate bus_set */
+	interconnects->bus_tbl = devm_kzalloc(&core->pdev->dev,
+			sizeof(*interconnects->bus_tbl) * bus_count, GFP_KERNEL);
+	if (!interconnects->bus_tbl) {
+		d_vpr_e("%s: failed to alloc memory for bus table\n", __func__);
+		return -ENOMEM;
+	}
+	interconnects->count = bus_count;
+
+	/* populate bus field from platform data */
+	for (cnt = 0; cnt < interconnects->count; cnt++) {
+		interconnects->bus_tbl[cnt].name = bus_tbl[cnt].name;
+		interconnects->bus_tbl[cnt].min_kbps = bus_tbl[cnt].min_kbps;
+		interconnects->bus_tbl[cnt].max_kbps = bus_tbl[cnt].max_kbps;
+	}
+
+	/* print bus fields */
+	venus_hfi_for_each_bus(core, binfo) {
+		d_vpr_h("%s: name %s min_kbps %u max_kbps %u\n",
+			__func__, binfo->name, binfo->min_kbps, binfo->max_kbps);
+	}
+
+	/* get interconnect handle */
+	venus_hfi_for_each_bus(core, binfo) {
+		if (!strcmp(binfo->name, "venus-llcc")) {
+			if (msm_vidc_syscache_disable) {
+				d_vpr_h("%s: skipping LLC bus init: %s\n", __func__,
+					binfo->name);
+				continue;
+			}
+		}
+		binfo->icc = devm_of_icc_get(&core->pdev->dev, binfo->name);
+		if (IS_ERR_OR_NULL(binfo->icc)) {
+			d_vpr_e("%s: failed to get bus: %s\n", __func__, binfo->name);
+			rc = PTR_ERR(binfo->icc) ?
+				PTR_ERR(binfo->icc) : -EBADHANDLE;
+			binfo->icc = NULL;
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int __init_power_domains(struct msm_vidc_core *core)
+{
+	struct power_domain_info *pdinfo = NULL;
+	const struct pd_table *pd_tbl;
+	struct power_domain_set *pds;
+	struct device **opp_vdevs = NULL;
+	const char * const *opp_tbl;
+	u32 pd_count = 0, opp_count = 0, cnt = 0;
+	int rc = 0;
+
+	pds = &core->resource->power_domain_set;
+
+	pd_tbl = core->platform->data.pd_tbl;
+	pd_count = core->platform->data.pd_tbl_size;
+
+	/* skip init if power domain not supported */
+	if (!pd_count) {
+		d_vpr_h("%s: power domain entries not available in db\n", __func__);
+		return 0;
+	}
+
+	/* sanitize power domain table */
+	if (!pd_tbl) {
+		d_vpr_e("%s: invalid power domain tbl\n", __func__);
+		return -EINVAL;
+	}
+
+	/* allocate power_domain_set */
+	pds->power_domain_tbl = devm_kzalloc(&core->pdev->dev,
+			sizeof(*pds->power_domain_tbl) * pd_count, GFP_KERNEL);
+	if (!pds->power_domain_tbl) {
+		d_vpr_e("%s: failed to alloc memory for pd table\n", __func__);
+		return -ENOMEM;
+	}
+	pds->count = pd_count;
+
+	/* populate power domain fields */
+	for (cnt = 0; cnt < pds->count; cnt++)
+		pds->power_domain_tbl[cnt].name = pd_tbl[cnt].name;
+
+	/* print power domain fields */
+	venus_hfi_for_each_power_domain(core, pdinfo)
+		d_vpr_h("%s: pd name %s\n", __func__, pdinfo->name);
+
+	/* get power domain handle */
+	venus_hfi_for_each_power_domain(core, pdinfo) {
+		pdinfo->genpd_dev = devm_pd_get(&core->pdev->dev, pdinfo->name);
+		if (IS_ERR_OR_NULL(pdinfo->genpd_dev)) {
+			rc = PTR_ERR(pdinfo->genpd_dev) ?
+				PTR_ERR(pdinfo->genpd_dev) : -EBADHANDLE;
+			d_vpr_e("%s: failed to get pd: %s\n", __func__, pdinfo->name);
+			pdinfo->genpd_dev = NULL;
+			return rc;
+		}
+	}
+
+	opp_tbl = core->platform->data.opp_tbl;
+	opp_count = core->platform->data.opp_tbl_size;
+
+	/* skip init if opp not supported */
+	if (opp_count < 2) {
+		d_vpr_h("%s: opp entries not available\n", __func__);
+		goto enable_runtime_pm;
+	}
+
+	/* sanitize opp table */
+	if (!opp_tbl) {
+		d_vpr_e("%s: invalid opp table\n", __func__);
+		return -EINVAL;
+	}
+
+	/* ignore NULL entry at the end of table */
+	opp_count -= 1;
+
+	/* print opp table entries */
+	for (cnt = 0; cnt < opp_count; cnt++)
+		d_vpr_e("%s: opp name %s\n", __func__, opp_tbl[cnt]);
+
+	/* populate opp power domains(for rails) */
+	rc = devm_pm_opp_attach_genpd(&core->pdev->dev, opp_tbl, &opp_vdevs);
+	if (rc)
+		return rc;
+
+	/* create device_links b/w consumer(dev) and multiple suppliers(mx, mmcx) */
+	for (cnt = 0; cnt < opp_count; cnt++) {
+		rc = devm_opp_dl_get(&core->pdev->dev, opp_vdevs[cnt]);
+		if (rc) {
+			d_vpr_e("%s: failed to create dl: %s\n",
+				__func__, dev_name(opp_vdevs[cnt]));
+			return rc;
+		}
+	}
+
+	/* initialize opp table from device tree */
+	rc = devm_pm_opp_of_add_table(&core->pdev->dev);
+	if (rc) {
+		d_vpr_e("%s: failed to add opp table\n", __func__);
+		return rc;
+	}
+
+	/**
+	 * 1. power up mx & mmcx supply for RCG(mvs0_clk_src)
+	 * 2. power up gdsc0c for mvs0c branch clk
+	 * 3. power up gdsc0 for mvs0 branch clk
+	 */
+
+	/**
+	 * power up mxc, mmcx rails to enable supply for
+	 * RCG(video_cc_mvs0_clk_src)
+	 */
+	/* enable runtime pm */
+enable_runtime_pm:
+	rc = devm_pm_runtime_enable(&core->pdev->dev);
+	if (rc) {
+		d_vpr_e("%s: failed to enable runtime pm\n", __func__);
+		return rc;
+	}
+	/* power up rails(mxc & mmcx) */
+	rc = devm_pm_runtime_get_sync(&core->pdev->dev);
+	if (rc) {
+		d_vpr_e("%s: failed to get sync runtime pm\n", __func__);
+		return rc;
+	}
+
+	return rc;
+}
+
+static int __init_clocks(struct msm_vidc_core *core)
+{
+	struct clock_residency *residency = NULL;
+	const struct clk_table *clk_tbl;
+	struct freq_table *freq_tbl;
+	struct clock_set *clocks;
+	struct clock_info *cinfo = NULL;
+	u32 clk_count = 0, freq_count = 0;
+	int fcnt = 0, cnt = 0, rc = 0;
+
+	clocks = &core->resource->clock_set;
+
+	clk_tbl = core->platform->data.clk_tbl;
+	clk_count = core->platform->data.clk_tbl_size;
+
+	if (!clk_tbl || !clk_count) {
+		d_vpr_e("%s: invalid clock tbl 0x%p or count %d\n",
+			__func__, clk_tbl, clk_count);
+		return -EINVAL;
+	}
+
+	/* allocate clock_set */
+	clocks->clock_tbl = devm_kzalloc(&core->pdev->dev,
+			sizeof(*clocks->clock_tbl) * clk_count, GFP_KERNEL);
+	if (!clocks->clock_tbl) {
+		d_vpr_e("%s: failed to alloc memory for clock table\n", __func__);
+		return -ENOMEM;
+	}
+	clocks->count = clk_count;
+
+	/* populate clock field from platform data */
+	for (cnt = 0; cnt < clocks->count; cnt++) {
+		clocks->clock_tbl[cnt].name = clk_tbl[cnt].name;
+		clocks->clock_tbl[cnt].clk_id = clk_tbl[cnt].clk_id;
+		clocks->clock_tbl[cnt].has_scaling = clk_tbl[cnt].scaling;
+	}
+
+	freq_tbl = core->platform->data.freq_tbl;
+	freq_count = core->platform->data.freq_tbl_size;
+
+	/* populate clk residency stats table */
+	for (cnt = 0; cnt < clocks->count; cnt++) {
+		/* initialize residency_list */
+		INIT_LIST_HEAD(&clocks->clock_tbl[cnt].residency_list);
+
+		/* skip if scaling not supported */
+		if (!clocks->clock_tbl[cnt].has_scaling)
+			continue;
+
+		for (fcnt = 0; fcnt < freq_count; fcnt++) {
+			residency = devm_kzalloc(&core->pdev->dev,
+				sizeof(struct clock_residency), GFP_KERNEL);
+			if (!residency) {
+				d_vpr_e("%s: failed to alloc clk residency stat node\n", __func__);
+				return -ENOMEM;
+			}
+
+			if (!freq_tbl) {
+				d_vpr_e("%s: invalid freq tbl 0x%p\n", __func__, freq_tbl);
+				return -EINVAL;
+			}
+
+			/* update residency node */
+			residency->rate = freq_tbl[fcnt].freq;
+			residency->start_time_us = 0;
+			residency->total_time_us = 0;
+			INIT_LIST_HEAD(&residency->list);
+
+			/* add entry into residency_list */
+			list_add_tail(&residency->list, &clocks->clock_tbl[cnt].residency_list);
+		}
+	}
+
+	/* print clock fields */
+	venus_hfi_for_each_clock(core, cinfo) {
+		d_vpr_h("%s: clock name %s clock id %#x scaling %d\n",
+			__func__, cinfo->name, cinfo->clk_id, cinfo->has_scaling);
+	}
+
+	/* get clock handle */
+	venus_hfi_for_each_clock(core, cinfo) {
+		cinfo->clk = devm_clk_get(&core->pdev->dev, cinfo->name);
+		if (IS_ERR_OR_NULL(cinfo->clk)) {
+			d_vpr_e("%s: failed to get clock: %s\n", __func__, cinfo->name);
+			rc = PTR_ERR(cinfo->clk) ?
+				PTR_ERR(cinfo->clk) : -EINVAL;
+			cinfo->clk = NULL;
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int __init_reset_clocks(struct msm_vidc_core *core)
+{
+	const struct clk_rst_table *rst_tbl;
+	struct reset_set *rsts;
+	struct reset_info *rinfo = NULL;
+	u32 rst_count = 0, cnt = 0;
+	int rc = 0;
+
+	rsts = &core->resource->reset_set;
+
+	rst_tbl = core->platform->data.clk_rst_tbl;
+	rst_count = core->platform->data.clk_rst_tbl_size;
+
+	if (!rst_tbl || !rst_count) {
+		d_vpr_e("%s: invalid reset tbl 0x%p or count %d\n",
+			__func__, rst_tbl, rst_count);
+		return 0;
+	}
+
+	/* allocate reset_set */
+	rsts->reset_tbl = devm_kzalloc(&core->pdev->dev,
+			sizeof(*rsts->reset_tbl) * rst_count, GFP_KERNEL);
+	if (!rsts->reset_tbl) {
+		d_vpr_e("%s: failed to alloc memory for reset table\n", __func__);
+		return -ENOMEM;
+	}
+	rsts->count = rst_count;
+
+	/* populate clock field from platform data */
+	for (cnt = 0; cnt < rsts->count; cnt++) {
+		rsts->reset_tbl[cnt].name = rst_tbl[cnt].name;
+		rsts->reset_tbl[cnt].exclusive_release = rst_tbl[cnt].exclusive_release;
+	}
+
+	/* print reset clock fields */
+	venus_hfi_for_each_reset_clock(core, rinfo) {
+		d_vpr_h("%s: reset clk %s, exclusive %d\n",
+			__func__, rinfo->name, rinfo->exclusive_release);
+	}
+
+	/* get reset clock handle */
+	venus_hfi_for_each_reset_clock(core, rinfo) {
+		if (rinfo->exclusive_release)
+			rinfo->rst = devm_reset_control_get_exclusive_released(
+				&core->pdev->dev, rinfo->name);
+		else
+			rinfo->rst = devm_reset_control_get(&core->pdev->dev, rinfo->name);
+		if (IS_ERR_OR_NULL(rinfo->rst)) {
+			d_vpr_e("%s: failed to get reset clock: %s\n", __func__, rinfo->name);
+			rc = PTR_ERR(rinfo->rst) ?
+				PTR_ERR(rinfo->rst) : -EINVAL;
+			rinfo->rst = NULL;
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int __init_subcaches(struct msm_vidc_core *core)
+{
+	const struct subcache_table *llcc_tbl;
+	struct subcache_set *caches;
+	struct subcache_info *sinfo = NULL;
+	u32 llcc_count = 0, cnt = 0;
+	int rc = 0;
+
+	caches = &core->resource->subcache_set;
+
+	/* skip init if subcache not available */
+	if (!is_sys_cache_present(core))
+		return 0;
+
+	llcc_tbl = core->platform->data.subcache_tbl;
+	llcc_count = core->platform->data.subcache_tbl_size;
+
+	if (!llcc_tbl || !llcc_count) {
+		d_vpr_e("%s: invalid llcc tbl 0x%p or count %d\n",
+			__func__, llcc_tbl, llcc_count);
+		return -EINVAL;
+	}
+
+	/* allocate clock_set */
+	caches->subcache_tbl = devm_kzalloc(&core->pdev->dev,
+			sizeof(*caches->subcache_tbl) * llcc_count, GFP_KERNEL);
+	if (!caches->subcache_tbl) {
+		d_vpr_e("%s: failed to alloc memory for subcache table\n", __func__);
+		return -ENOMEM;
+	}
+	caches->count = llcc_count;
+
+	/* populate subcache fields from platform data */
+	for (cnt = 0; cnt < caches->count; cnt++) {
+		caches->subcache_tbl[cnt].name = llcc_tbl[cnt].name;
+		caches->subcache_tbl[cnt].llcc_id = llcc_tbl[cnt].llcc_id;
+	}
+
+	/* print subcache fields */
+	venus_hfi_for_each_subcache(core, sinfo) {
+		d_vpr_h("%s: name %s subcache id %d\n",
+			__func__, sinfo->name, sinfo->llcc_id);
+	}
+
+	/* get subcache/llcc handle */
+	venus_hfi_for_each_subcache(core, sinfo) {
+		sinfo->subcache = devm_llcc_get(&core->pdev->dev, sinfo->llcc_id);
+		if (IS_ERR_OR_NULL(sinfo->subcache)) {
+			d_vpr_e("%s: failed to get subcache: %d\n", __func__, sinfo->llcc_id);
+			rc = PTR_ERR(sinfo->subcache) ?
+				PTR_ERR(sinfo->subcache) : -EBADHANDLE;
+			sinfo->subcache = NULL;
+			return rc;
+		}
+	}
+
+	return rc;
+}
+
+static int __init_freq_table(struct msm_vidc_core *core)
+{
+	struct freq_table *freq_tbl;
+	struct freq_set *clks;
+	u32 freq_count = 0, cnt = 0;
+	int rc = 0;
+
+	clks = &core->resource->freq_set;
+
+	freq_tbl = core->platform->data.freq_tbl;
+	freq_count = core->platform->data.freq_tbl_size;
+
+	if (!freq_tbl || !freq_count) {
+		d_vpr_e("%s: invalid freq tbl 0x%p or count %d\n",
+			__func__, freq_tbl, freq_count);
+		return -EINVAL;
+	}
+
+	/* allocate freq_set */
+	clks->freq_tbl = devm_kzalloc(&core->pdev->dev,
+			sizeof(*clks->freq_tbl) * freq_count, GFP_KERNEL);
+	if (!clks->freq_tbl) {
+		d_vpr_e("%s: failed to alloc memory for freq table\n", __func__);
+		return -ENOMEM;
+	}
+	clks->count = freq_count;
+
+	/* populate freq field from platform data */
+	for (cnt = 0; cnt < clks->count; cnt++)
+		clks->freq_tbl[cnt].freq = freq_tbl[cnt].freq;
+
+	/* sort freq table */
+	sort(clks->freq_tbl, clks->count, sizeof(*clks->freq_tbl), cmp, NULL);
+
+	/* print freq field freq_set */
+	d_vpr_h("%s: updated freq table\n", __func__);
+	for (cnt = 0; cnt < clks->count; cnt++)
+		d_vpr_h("%s:\t %lu\n", __func__, clks->freq_tbl[cnt].freq);
+
+	return rc;
+}
+
+static int __init_context_banks(struct msm_vidc_core *core)
+{
+	const struct context_bank_table *cb_tbl;
+	struct context_bank_set *cbs;
+	struct context_bank_info *cbinfo = NULL;
+	u32 cb_count = 0, cnt = 0;
+	int rc = 0;
+
+	cbs = &core->resource->context_bank_set;
+
+	cb_tbl = core->platform->data.context_bank_tbl;
+	cb_count = core->platform->data.context_bank_tbl_size;
+
+	if (!cb_tbl || !cb_count) {
+		d_vpr_e("%s: invalid context bank tbl 0x%p or count %d\n",
+			__func__, cb_tbl, cb_count);
+		return -EINVAL;
+	}
+
+	/* allocate context_bank table */
+	cbs->context_bank_tbl = devm_kzalloc(&core->pdev->dev,
+			sizeof(*cbs->context_bank_tbl) * cb_count, GFP_KERNEL);
+	if (!cbs->context_bank_tbl) {
+		d_vpr_e("%s: failed to alloc memory for context_bank table\n", __func__);
+		return -ENOMEM;
+	}
+	cbs->count = cb_count;
+
+	/**
+	 * populate context bank field from platform data except
+	 * dev & domain which are assigned as part of context bank
+	 * probe sequence
+	 */
+	for (cnt = 0; cnt < cbs->count; cnt++) {
+		cbs->context_bank_tbl[cnt].name = cb_tbl[cnt].name;
+		cbs->context_bank_tbl[cnt].addr_range.start = cb_tbl[cnt].start;
+		cbs->context_bank_tbl[cnt].addr_range.size = cb_tbl[cnt].size;
+		cbs->context_bank_tbl[cnt].secure = cb_tbl[cnt].secure;
+		cbs->context_bank_tbl[cnt].dma_coherant = cb_tbl[cnt].dma_coherant;
+		cbs->context_bank_tbl[cnt].region = cb_tbl[cnt].region;
+		cbs->context_bank_tbl[cnt].dma_mask = cb_tbl[cnt].dma_mask;
+	}
+
+	/* print context_bank fiels */
+	venus_hfi_for_each_context_bank(core, cbinfo) {
+		d_vpr_h("%s: name %s addr start %#x size %#x secure %d "
+			"coherant %d region %d dma_mask %llu\n",
+			__func__, cbinfo->name, cbinfo->addr_range.start,
+			cbinfo->addr_range.size, cbinfo->secure,
+			cbinfo->dma_coherant, cbinfo->region, cbinfo->dma_mask);
+	}
+
+	return rc;
+}
+
+static int __init_device_region(struct msm_vidc_core *core)
+{
+	const struct device_region_table *dev_reg_tbl;
+	struct device_region_set *dev_set;
+	struct device_region_info *dev_reg_info;
+	u32 dev_reg_count = 0, cnt = 0;
+	int rc = 0;
+
+	dev_set = &core->resource->device_region_set;
+
+	dev_reg_tbl = core->platform->data.dev_reg_tbl;
+	dev_reg_count = core->platform->data.dev_reg_tbl_size;
+
+	if (!dev_reg_tbl || !dev_reg_count) {
+		d_vpr_h("%s: device regions not available\n", __func__);
+		return 0;
+	}
+
+	/* allocate device region table */
+	dev_set->device_region_tbl = devm_kzalloc(&core->pdev->dev,
+			sizeof(*dev_set->device_region_tbl) * dev_reg_count, GFP_KERNEL);
+	if (!dev_set->device_region_tbl) {
+		d_vpr_e("%s: failed to alloc memory for device region table\n", __func__);
+		return -ENOMEM;
+	}
+	dev_set->count = dev_reg_count;
+
+	/* populate device region fields from platform data */
+	for (cnt = 0; cnt < dev_set->count; cnt++) {
+		dev_set->device_region_tbl[cnt].name = dev_reg_tbl[cnt].name;
+		dev_set->device_region_tbl[cnt].phy_addr = dev_reg_tbl[cnt].phy_addr;
+		dev_set->device_region_tbl[cnt].size = dev_reg_tbl[cnt].size;
+		dev_set->device_region_tbl[cnt].dev_addr = dev_reg_tbl[cnt].dev_addr;
+		dev_set->device_region_tbl[cnt].region = dev_reg_tbl[cnt].region;
+	}
+
+	/* print device region fields */
+	venus_hfi_for_each_device_region(core, dev_reg_info) {
+		d_vpr_h("%s: name %s phy_addr %#llx size %#x dev_addr %#x dev_region %d\n",
+			__func__, dev_reg_info->name, dev_reg_info->phy_addr, dev_reg_info->size,
+			dev_reg_info->dev_addr, dev_reg_info->region);
+	}
+
+	return rc;
+}
+
+#ifdef CONFIG_MSM_MMRM
+static int __register_mmrm(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	struct clock_info *cl;
+
+	/* skip if platform does not support mmrm */
+	if (!is_mmrm_supported(core)) {
+		d_vpr_h("%s: MMRM not supported\n", __func__);
+		return 0;
+	}
+
+	/* get mmrm handle for each clock sources */
+	venus_hfi_for_each_clock(core, cl) {
+		struct mmrm_client_desc desc;
+		char *name = (char *)desc.client_info.desc.name;
+
+		// TODO: set notifier data vals
+		struct mmrm_client_notifier_data notifier_data = {
+			MMRM_CLIENT_RESOURCE_VALUE_CHANGE,
+			{{0, 0}},
+			NULL};
+
+		// TODO: add callback fn
+		desc.notifier_callback_fn = NULL;
+
+		if (!cl->has_scaling)
+			continue;
+
+		if (IS_ERR_OR_NULL(cl->clk)) {
+			d_vpr_e("%s: Invalid clock: %s\n", __func__, cl->name);
+			return PTR_ERR(cl->clk) ? PTR_ERR(cl->clk) : -EINVAL;
+		}
+
+		desc.client_type = MMRM_CLIENT_CLOCK;
+		desc.client_info.desc.client_domain = MMRM_CLIENT_DOMAIN_VIDEO;
+		desc.client_info.desc.client_id = cl->clk_id;
+		strscpy(name, cl->name, sizeof(desc.client_info.desc.name));
+		desc.client_info.desc.clk = cl->clk;
+		desc.priority = MMRM_CLIENT_PRIOR_LOW;
+		desc.pvt_data = notifier_data.pvt_data;
+
+		d_vpr_h("%s: domain(%d) cid(%d) name(%s) clk(%pK)\n",
+			__func__,
+			desc.client_info.desc.client_domain,
+			desc.client_info.desc.client_id,
+			desc.client_info.desc.name,
+			desc.client_info.desc.clk);
+
+		d_vpr_h("%s: type(%d) pri(%d) pvt(%pK) notifier(%pK)\n",
+			__func__,
+			desc.client_type,
+			desc.priority,
+			desc.pvt_data,
+			desc.notifier_callback_fn);
+
+		cl->mmrm_client = devm_mmrm_get(&core->pdev->dev, &desc);
+		if (!cl->mmrm_client) {
+			d_vpr_e("%s: Failed to register clk(%s): %d\n",
+				__func__, cl->name, rc);
+			return -EINVAL;
+		}
+	}
+
+	return rc;
+}
+#else
+static int __register_mmrm(struct msm_vidc_core *core)
+{
+	return 0;
+}
+#endif
+
+static int __enable_power_domains(struct msm_vidc_core *core, const char *name)
+{
+	struct power_domain_info *pdinfo = NULL;
+	int rc = 0;
+
+	/* power up rails(mxc & mmcx) to enable RCG(video_cc_mvs0_clk_src) */
+	if (core->platform->data.opp_tbl) { 
+		rc = __opp_set_rate(core, ULONG_MAX);
+		if (rc) {
+			d_vpr_e("%s: opp setrate failed\n", __func__);
+			return rc;
+		}
+	}
+
+	/* power up (gdsc0/gdsc0c) to enable (mvs0/mvs0c) branch clock */
+	venus_hfi_for_each_power_domain(core, pdinfo) {
+		if (strcmp(pdinfo->name, name))
+			continue;
+
+		rc = pm_runtime_get_sync(pdinfo->genpd_dev);
+		if (rc < 0) {
+			d_vpr_e("%s: failed to get sync: %s\n", __func__, pdinfo->name);
+			return rc;
+		}
+		d_vpr_h("%s: enabled power doamin %s\n", __func__, pdinfo->name);
+	}
+
+	/* power domains are moved to HW ctrl by default after calling get_sync() */
+	msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_GDSC_HANDOFF, __func__);
+
+	return 0;
+}
+
+static int __disable_power_domains(struct msm_vidc_core *core, const char *name)
+{
+	struct power_domain_info *pdinfo = NULL;
+	int rc = 0;
+
+	/* power down (gdsc0/gdsc0c) to disable (mvs0/mvs0c) branch clock */
+	venus_hfi_for_each_power_domain(core, pdinfo) {
+		if (strcmp(pdinfo->name, name))
+			continue;
+
+		rc = pm_runtime_put_sync(pdinfo->genpd_dev);
+		if (rc < 0) {
+			d_vpr_e("%s: failed to put sync: %s\n", __func__, pdinfo->name);
+			return rc;
+		}
+		d_vpr_h("%s: disabled power domain %s\n", __func__, pdinfo->name);
+	}
+
+	/* power down rails(mxc & mmcx) to disable RCG(video_cc_mvs0_clk_src) */
+	if (core->platform->data.opp_tbl) {
+		rc = __opp_set_rate(core, 0);
+		if (rc) {
+			d_vpr_e("%s: opp setrate failed\n", __func__);
+			return rc;
+		}
+	}
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_GDSC_HANDOFF, 0, __func__);
+
+	return 0;
+}
+
+static int __hand_off_power_domains(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (is_core_sub_state(core, CORE_SUBSTATE_GDSC_HANDOFF)) {
+		d_vpr_h("%s: power domains are already in HW ctrl mode\n",
+			__func__);
+		return 0;
+	}
+
+	rc = call_venus_op(core, switch_gdsc_mode, core, false);
+	if (rc) {
+		d_vpr_e("Failed to switch GDSC into HW control, err: %d\n", rc);
+		return rc;
+	}
+
+	d_vpr_h("%s: moved power doamin into HW control\n", __func__);
+	msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_GDSC_HANDOFF, __func__);
+
+	return 0;
+}
+
+static int __acquire_power_domains(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_GDSC_HANDOFF)) {
+		d_vpr_h("%s: power domains are already in SW ctrl mode\n",
+			__func__);
+		return 0;
+	}
+
+	rc = call_venus_op(core, switch_gdsc_mode, core, true);
+	if (rc) {
+		d_vpr_e("Failed to switch GDSC into SW control, err: %d\n", rc);
+		return rc;
+	}
+
+	d_vpr_h("%s: moved power doamin into SW control\n", __func__);
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_GDSC_HANDOFF, 0, __func__);
+
+	return 0;
+}
+
+static int __disable_subcaches(struct msm_vidc_core *core)
+{
+	struct subcache_info *sinfo;
+	int rc = 0;
+
+	if (msm_vidc_syscache_disable || !is_sys_cache_present(core))
+		return 0;
+
+	/* De-activate subcaches */
+	venus_hfi_for_each_subcache_reverse(core, sinfo) {
+		if (!sinfo->isactive)
+			continue;
+
+		d_vpr_h("%s: De-activate subcache %s\n", __func__, sinfo->name);
+		rc = llcc_slice_deactivate(sinfo->subcache);
+		if (rc) {
+			d_vpr_e("Failed to de-activate %s: %d\n",
+				sinfo->name, rc);
+		}
+		sinfo->isactive = false;
+	}
+
+	return 0;
+}
+
+static int __enable_subcaches(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	u32 c = 0;
+	struct subcache_info *sinfo;
+
+	if (msm_vidc_syscache_disable || !is_sys_cache_present(core))
+		return 0;
+
+	/* Activate subcaches */
+	venus_hfi_for_each_subcache(core, sinfo) {
+		rc = llcc_slice_activate(sinfo->subcache);
+		if (rc) {
+			d_vpr_e("Failed to activate %s: %d\n", sinfo->name, rc);
+			__fatal_error(true);
+			goto err_activate_fail;
+		}
+		sinfo->isactive = true;
+		d_vpr_h("Activated subcache %s\n", sinfo->name);
+		c++;
+	}
+
+	d_vpr_h("Activated %d Subcaches to Venus\n", c);
+
+	return 0;
+
+err_activate_fail:
+	__disable_subcaches(core);
+	return rc;
+}
+
+static int llcc_enable(struct msm_vidc_core *core, bool enable)
+{
+	int ret;
+
+	if (enable)
+		ret = __enable_subcaches(core);
+	else
+		ret = __disable_subcaches(core);
+
+	return ret;
+}
+
+static int __vote_bandwidth(struct bus_info *bus, unsigned long bw_kbps)
+{
+	int rc = 0;
+
+	if (!bus->icc) {
+		d_vpr_e("%s: invalid bus\n", __func__);
+		return -EINVAL;
+	}
+
+	d_vpr_p("Voting bus %s to ab %lu kBps\n", bus->name, bw_kbps);
+
+	rc = icc_set_bw(bus->icc, bw_kbps, 0);
+	if (rc)
+		d_vpr_e("Failed voting bus %s to ab %lu, rc=%d\n",
+			bus->name, bw_kbps, rc);
+
+	return rc;
+}
+
+static int __unvote_buses(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	struct bus_info *bus = NULL;
+
+	core->power.bw_ddr = 0;
+	core->power.bw_llcc = 0;
+
+	venus_hfi_for_each_bus(core, bus) {
+		rc = __vote_bandwidth(bus, 0);
+		if (rc)
+			goto err_unknown_device;
+	}
+
+err_unknown_device:
+	return rc;
+}
+
+static int __vote_buses(struct msm_vidc_core *core,
+			unsigned long bw_ddr, unsigned long bw_llcc)
+{
+	int rc = 0;
+	struct bus_info *bus = NULL;
+	unsigned long bw_kbps = 0, bw_prev = 0;
+	enum vidc_bus_type type;
+
+	venus_hfi_for_each_bus(core, bus) {
+		if (bus && bus->icc) {
+			type = get_type_frm_name(bus->name);
+
+			if (type == DDR) {
+				bw_kbps = bw_ddr;
+				bw_prev = core->power.bw_ddr;
+			} else if (type == LLCC) {
+				bw_kbps = bw_llcc;
+				bw_prev = core->power.bw_llcc;
+			} else {
+				bw_kbps = bus->max_kbps;
+				bw_prev = core->power.bw_ddr ?
+						bw_kbps : 0;
+			}
+
+			/* ensure freq is within limits */
+			bw_kbps = clamp_t(typeof(bw_kbps), bw_kbps,
+						 bus->min_kbps, bus->max_kbps);
+
+			if (TRIVIAL_BW_CHANGE(bw_kbps, bw_prev) && bw_prev) {
+				d_vpr_l("Skip voting bus %s to %lu kBps\n",
+					bus->name, bw_kbps);
+				continue;
+			}
+
+			rc = __vote_bandwidth(bus, bw_kbps);
+
+			if (type == DDR)
+				core->power.bw_ddr = bw_kbps;
+			else if (type == LLCC)
+				core->power.bw_llcc = bw_kbps;
+		} else {
+			d_vpr_e("No BUS to Vote\n");
+		}
+	}
+
+	return rc;
+}
+
+static int set_bw(struct msm_vidc_core *core, unsigned long bw_ddr,
+		  unsigned long bw_llcc)
+{
+	if (!bw_ddr && !bw_llcc)
+		return __unvote_buses(core);
+
+	return __vote_buses(core, bw_ddr, bw_llcc);
+}
+
+static int print_residency_stats(struct msm_vidc_core *core, struct clock_info *cl)
+{
+	struct clock_residency *residency = NULL;
+	u64 total_time_us = 0;
+	int rc = 0;
+
+	/* skip if scaling not supported */
+	if (!cl->has_scaling)
+		return 0;
+
+	/* grand total residency time */
+	list_for_each_entry(residency, &cl->residency_list, list)
+		total_time_us += residency->total_time_us;
+
+	/* sanity check to avoid divide by 0 */
+	total_time_us = (total_time_us > 0) ? total_time_us : 1;
+
+	/* print residency percent for each clock */
+	list_for_each_entry(residency, &cl->residency_list, list) {
+		d_vpr_hs("%s: %s clock rate [%llu] total %llu us residency %llu%%\n",
+			__func__, cl->name, residency->rate, residency->total_time_us,
+			(residency->total_time_us * 100 + total_time_us / 2) / total_time_us);
+	}
+
+	return rc;
+}
+
+static int reset_residency_stats(struct msm_vidc_core *core, struct clock_info *cl)
+{
+	struct clock_residency *residency = NULL;
+	int rc = 0;
+
+	/* skip if scaling not supported */
+	if (!cl->has_scaling)
+		return 0;
+
+	d_vpr_h("%s: reset %s residency stats\n", __func__, cl->name);
+
+	/* reset clock residency stats */
+	list_for_each_entry(residency, &cl->residency_list, list) {
+		residency->start_time_us = 0;
+		residency->total_time_us = 0;
+	}
+	/*
+	 * During the reset make sure to update start time of the clk prev freq,
+	 * because the prev clk freq might not be 0 so when the next seesion start
+	 * voting from that freq, then those resideny print will not come in stats
+	 */
+	residency = get_residency_stats(cl, cl->prev);
+	if (residency)
+		residency->start_time_us = ktime_get_ns() / 1000;
+	return rc;
+}
+
+static struct clock_residency *get_residency_stats(struct clock_info *cl, u64 rate)
+{
+	struct clock_residency *residency = NULL;
+	bool found = false;
+
+	if (!cl) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return NULL;
+	}
+
+	list_for_each_entry(residency, &cl->residency_list, list) {
+		if (residency->rate == rate) {
+			found = true;
+			break;
+		}
+	}
+
+	return found ? residency : NULL;
+}
+
+static int __update_residency_stats(struct msm_vidc_core *core,
+		struct clock_info *cl, u64 rate)
+{
+	struct clock_residency *cur_residency = NULL, *prev_residency = NULL;
+	u64 cur_time_us = 0;
+	int rc = 0;
+
+	/* skip update if high or stats logs not enabled */
+	if (!(msm_vidc_debug & (VIDC_HIGH | VIDC_STAT)))
+		return 0;
+
+	/* skip update if scaling not supported */
+	if (!cl->has_scaling)
+		return 0;
+
+	/* skip update if rate not changed */
+	if (rate == cl->prev)
+		return 0;
+
+	/* get current time in ns */
+	cur_time_us = ktime_get_ns() / 1000;
+
+	/* update previous rate residency end or total time */
+	prev_residency = get_residency_stats(cl, cl->prev);
+	if (prev_residency) {
+		if (prev_residency->start_time_us)
+			prev_residency->total_time_us += cur_time_us -
+			    prev_residency->start_time_us;
+
+		/* reset start time us */
+		prev_residency->start_time_us = 0;
+	}
+
+	/* clk disable case - no need to update new entry */
+	if (rate == 0)
+		return 0;
+
+	/* check if rate entry is present */
+	cur_residency = get_residency_stats(cl, rate);
+	if (!cur_residency) {
+		d_vpr_e("%s: entry not found. rate %llu\n", __func__, rate);
+		return -EINVAL;
+	}
+
+	/* update residency start time for current rate/freq */
+	cur_residency->start_time_us = cur_time_us;
+
+	return rc;
+}
+
+static int __set_clk_rate(struct msm_vidc_core *core, struct clock_info *cl,
+			  u64 rate)
+{
+	int rc = 0;
+
+	/* update clock residency stats */
+	__update_residency_stats(core, cl, rate);
+
+	/* bail early if requested clk rate is not changed */
+	if (rate == cl->prev)
+		return 0;
+
+	d_vpr_p("Scaling clock %s to %llu, prev %llu\n",
+		cl->name, rate, cl->prev);
+
+	rc = clk_set_rate(cl->clk, rate);
+	if (rc) {
+		d_vpr_e("%s: Failed to set clock rate %llu %s: %d\n",
+			__func__, rate, cl->name, rc);
+		return rc;
+	}
+
+	cl->prev = rate;
+
+	return rc;
+}
+
+static int __set_clocks(struct msm_vidc_core *core, u64 freq)
+{
+	struct clock_info *cl;
+	int rc = 0;
+
+	/* scale mxc & mmcx rails */
+	if (core->platform->data.opp_tbl) { 
+		rc = __opp_set_rate(core, freq);
+		if (rc) {
+			d_vpr_e("%s: opp setrate failed %lld\n", __func__, freq);
+			return rc;
+		}
+	}
+
+	venus_hfi_for_each_clock(core, cl) {
+		if (cl->has_scaling) {
+			rc = __set_clk_rate(core, cl, freq);
+			if (rc)
+				return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int __disable_unprepare_clock(struct msm_vidc_core *core,
+				     const char *clk_name)
+{
+	int rc = 0;
+	struct clock_info *cl;
+	bool found;
+
+	found = false;
+	venus_hfi_for_each_clock(core, cl) {
+		if (!cl->clk) {
+			d_vpr_e("%s: invalid clock %s\n", __func__, cl->name);
+			return -EINVAL;
+		}
+		if (strcmp(cl->name, clk_name))
+			continue;
+		found = true;
+		clk_disable_unprepare(cl->clk);
+		if (cl->has_scaling)
+			__set_clk_rate(core, cl, 0);
+		cl->prev = 0;
+		d_vpr_h("%s: clock %s disable unprepared\n", __func__, cl->name);
+		break;
+	}
+	if (!found) {
+		d_vpr_e("%s: clock %s not found\n", __func__, clk_name);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int __prepare_enable_clock(struct msm_vidc_core *core,
+				  const char *clk_name)
+{
+	int rc = 0;
+	struct clock_info *cl;
+	bool found;
+	u64 rate = 0;
+
+	found = false;
+	venus_hfi_for_each_clock(core, cl) {
+		if (!cl->clk) {
+			d_vpr_e("%s: invalid clock\n", __func__);
+			return -EINVAL;
+		}
+		if (strcmp(cl->name, clk_name))
+			continue;
+		found = true;
+		/*
+		 * For the clocks we control, set the rate prior to preparing
+		 * them.  Since we don't really have a load at this point, scale
+		 * it to the lowest frequency possible
+		 */
+		if (cl->has_scaling) {
+			/* reset clk residency stats */
+			reset_residency_stats(core, cl);
+
+			rate = clk_round_rate(cl->clk, 0);
+			/**
+			 * source clock is already multipled with scaling ratio and __set_clk_rate
+			 * attempts to multiply again. So divide scaling ratio before calling
+			 * __set_clk_rate.
+			 */
+			rate = rate / MSM_VIDC_CLOCK_SOURCE_SCALING_RATIO;
+			__set_clk_rate(core, cl, rate);
+		}
+
+		rc = clk_prepare_enable(cl->clk);
+		if (rc) {
+			d_vpr_e("%s: failed to enable clock %s\n",
+				__func__, cl->name);
+			return rc;
+		}
+		if (!__clk_is_enabled(cl->clk)) {
+			d_vpr_e("%s: clock %s not enabled\n",
+				__func__, cl->name);
+			clk_disable_unprepare(cl->clk);
+			if (cl->has_scaling)
+				__set_clk_rate(core, cl, 0);
+			return -EINVAL;
+		}
+		d_vpr_h("%s: clock %s prepare enabled\n", __func__, cl->name);
+		break;
+	}
+	if (!found) {
+		d_vpr_e("%s: clock %s not found\n", __func__, clk_name);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int __init_resources(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = __init_register_base(core);
+	if (rc)
+		return rc;
+
+	rc = __init_irq(core);
+	if (rc)
+		return rc;
+
+	rc = __init_bus(core);
+	if (rc)
+		return rc;
+
+	rc = call_res_op(core, gdsc_init, core);
+	if (rc)
+		return rc;
+
+	rc = __init_clocks(core);
+	if (rc)
+		return rc;
+
+	rc = __init_reset_clocks(core);
+	if (rc)
+		return rc;
+
+	rc = __init_subcaches(core);
+	if (rc)
+		return rc;
+
+	rc = __init_freq_table(core);
+	if (rc)
+		return rc;
+
+	rc = __init_context_banks(core);
+	if (rc)
+		return rc;
+
+	rc = __init_device_region(core);
+	if (rc)
+		return rc;
+
+	rc = __register_mmrm(core);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int __reset_control_acquire_name(struct msm_vidc_core *core,
+		const char *name)
+{
+	struct reset_info *rcinfo = NULL;
+	int rc = 0, count = 0;
+	bool found = false;
+
+	venus_hfi_for_each_reset_clock(core, rcinfo) {
+		if (strcmp(rcinfo->name, name))
+			continue;
+
+		/* this function is valid only for exclusive_release reset clocks*/
+		if (!rcinfo->exclusive_release) {
+			d_vpr_e("%s: unsupported reset control (%s), exclusive %d\n",
+				__func__, name, rcinfo->exclusive_release);
+			return -EINVAL;
+		}
+
+		found = true;
+		/* reset_control_acquire is exposed in kernel version 6 */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 0, 0))
+		do {
+			rc = reset_control_acquire(rcinfo->rst);
+			if (!rc)
+				break;
+
+			d_vpr_e("%s: failed to acquire video_xo_reset control, count %d\n",
+				__func__, count);
+			count++;
+			usleep_range(1000, 1500);
+		} while (count < 1000);
+
+		if (count >= 1000) {
+			d_vpr_e("%s: timeout acquiring video_xo_reset\n", __func__);
+			rc = -EINVAL;
+			MSM_VIDC_FATAL(true);
+		}
+#else
+		rc = -EINVAL;
+#endif
+		if (rc)
+			d_vpr_e("%s: failed to acquire reset control (%s), rc = %d\n",
+				__func__, rcinfo->name, rc);
+		else
+			d_vpr_h("%s: acquire reset control (%s)\n",
+				__func__, rcinfo->name);
+		break;
+	}
+	/* Faced this issue for volcano which doesn't support xo_reset
+	 * skip this check and return success
+	 */
+	if (!found) {
+		d_vpr_e("%s: reset control (%s) not found but returning success\n",
+			__func__, name);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int __reset_control_release_name(struct msm_vidc_core *core,
+		const char *name)
+{
+	struct reset_info *rcinfo = NULL;
+	int rc = 0;
+	bool found = false;
+
+	venus_hfi_for_each_reset_clock(core, rcinfo) {
+		if (strcmp(rcinfo->name, name))
+			continue;
+
+		/* this function is valid only for exclusive_release reset clocks*/
+		if (!rcinfo->exclusive_release) {
+			d_vpr_e("%s: unsupported reset control (%s), exclusive %d\n",
+				__func__, name, rcinfo->exclusive_release);
+			return -EINVAL;
+		}
+
+		found = true;
+		/* reset_control_release exposed in kernel version 6 */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 0, 0))
+		reset_control_release(rcinfo->rst);
+#else
+		rc = -EINVAL;
+#endif
+		if (rc)
+			d_vpr_e("%s: release reset control (%s) failed\n",
+				__func__, rcinfo->name);
+		else
+			d_vpr_h("%s: release reset control (%s) done\n",
+				__func__, rcinfo->name);
+		break;
+	}
+	/* Faced this issue for volcano which doesn't support xo_reset
+	 * skip this check and return success
+	 */
+	if (!found) {
+		d_vpr_e("%s: reset control (%s) not found but returning success\n",
+			__func__, name);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+static int __reset_control_assert_name(struct msm_vidc_core *core,
+		const char *name)
+{
+	struct reset_info *rcinfo = NULL;
+	int rc = 0;
+	bool found = false;
+
+	venus_hfi_for_each_reset_clock(core, rcinfo) {
+		if (strcmp(rcinfo->name, name))
+			continue;
+
+		found = true;
+		rc = reset_control_assert(rcinfo->rst);
+		if (rc)
+			d_vpr_e("%s: failed to assert reset control (%s), rc = %d\n",
+				__func__, rcinfo->name, rc);
+		else
+			d_vpr_h("%s: assert reset control (%s)\n",
+				__func__, rcinfo->name);
+		break;
+	}
+	if (!found) {
+		d_vpr_e("%s: reset control (%s) not found\n", __func__, name);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int __reset_control_deassert_name(struct msm_vidc_core *core,
+		const char *name)
+{
+	struct reset_info *rcinfo = NULL;
+	int rc = 0;
+	bool found = false;
+
+	venus_hfi_for_each_reset_clock(core, rcinfo) {
+		if (strcmp(rcinfo->name, name))
+			continue;
+		found = true;
+		rc = reset_control_deassert(rcinfo->rst);
+		if (rc)
+			d_vpr_e("%s: deassert reset control for (%s) failed, rc %d\n",
+					__func__, rcinfo->name, rc);
+		else
+			d_vpr_h("%s: deassert reset control (%s)\n",
+					__func__, rcinfo->name);
+		break;
+	}
+	if (!found) {
+		d_vpr_e("%s: reset control (%s) not found\n", __func__, name);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int __reset_control_deassert(struct msm_vidc_core *core)
+{
+	struct reset_info *rcinfo = NULL;
+	int rc = 0;
+
+	venus_hfi_for_each_reset_clock(core, rcinfo) {
+		rc = reset_control_deassert(rcinfo->rst);
+		if (rc) {
+			d_vpr_e("%s: deassert reset control failed. rc = %d\n", __func__, rc);
+			continue;
+		}
+		d_vpr_h("%s: deassert reset control %s\n", __func__, rcinfo->name);
+	}
+
+	return rc;
+}
+
+static int __reset_control_assert(struct msm_vidc_core *core)
+{
+	struct reset_info *rcinfo = NULL;
+	int rc = 0, cnt = 0;
+
+	venus_hfi_for_each_reset_clock(core, rcinfo) {
+		if (!rcinfo->rst) {
+			d_vpr_e("%s: invalid reset clock %s\n",
+				__func__, rcinfo->name);
+			return -EINVAL;
+		}
+		rc = reset_control_assert(rcinfo->rst);
+		if (rc) {
+			d_vpr_e("%s: failed to assert reset control %s, rc = %d\n",
+				__func__, rcinfo->name, rc);
+			goto deassert_reset_control;
+		}
+		cnt++;
+		d_vpr_h("%s: assert reset control %s, count %d\n", __func__, rcinfo->name, cnt);
+
+		usleep_range(1000, 1100);
+	}
+
+	return rc;
+deassert_reset_control:
+	venus_hfi_for_each_reset_clock_reverse_continue(core, rcinfo, cnt) {
+		d_vpr_e("%s: deassert reset control %s\n", __func__, rcinfo->name);
+		reset_control_deassert(rcinfo->rst);
+	}
+
+	return rc;
+}
+
+static int __reset_ahb2axi_bridge(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = __reset_control_assert(core);
+	if (rc)
+		return rc;
+
+	rc = __reset_control_deassert(core);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int __print_clock_residency_stats(struct msm_vidc_core *core)
+{
+	struct clock_info *cl;
+	int rc = 0;
+
+	venus_hfi_for_each_clock(core, cl) {
+		/* skip if scaling not supported */
+		if (!cl->has_scaling)
+			continue;
+
+		/*
+		 * residency for the last clk corner entry will be updated in stats
+		 * only if we call update residency with rate 0
+		 */
+		__update_residency_stats(core, cl, 0);
+
+		/* print clock residency stats */
+		print_residency_stats(core, cl);
+	}
+
+	return rc;
+}
+
+static int __reset_clock_residency_stats(struct msm_vidc_core *core)
+{
+	struct clock_info *cl;
+	int rc = 0;
+
+	venus_hfi_for_each_clock(core, cl) {
+		/* skip if scaling not supported */
+		if (!cl->has_scaling)
+			continue;
+
+		/* reset clock residency stats */
+		reset_residency_stats(core, cl);
+	}
+
+	return rc;
+}
+
+static const struct msm_vidc_resources_ops res_ops = {
+	.init = __init_resources,
+	.reset_bridge = __reset_ahb2axi_bridge,
+	.reset_control_acquire = __reset_control_acquire_name,
+	.reset_control_release = __reset_control_release_name,
+	.reset_control_assert = __reset_control_assert_name,
+	.reset_control_deassert = __reset_control_deassert_name,
+	.gdsc_init = __init_power_domains,
+	.gdsc_on = __enable_power_domains,
+	.gdsc_off = __disable_power_domains,
+	.gdsc_hw_ctrl = __hand_off_power_domains,
+	.gdsc_sw_ctrl = __acquire_power_domains,
+	.llcc = llcc_enable,
+	.set_bw = set_bw,
+	.set_clks = __set_clocks,
+	.clk_enable = __prepare_enable_clock,
+	.clk_disable = __disable_unprepare_clock,
+	.clk_print_residency_stats = __print_clock_residency_stats,
+	.clk_reset_residency_stats = __reset_clock_residency_stats,
+	.clk_update_residency_stats = __update_residency_stats,
+};
+
+const struct msm_vidc_resources_ops *get_resources_ops(void)
+{
+	return &res_ops;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/venus_hfi.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/venus_hfi.c
@@ -0,0 +1,2022 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/iommu.h>
+#include <linux/soc/qcom/smem.h>
+#include <linux/irqreturn.h>
+#include <linux/of_address.h>
+#include <linux/firmware.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/soc/qcom/mdt_loader.h>
+#include <linux/soc/qcom/llcc-qcom.h>
+#include <linux/iopoll.h>
+
+#include "venus_hfi.h"
+#include "msm_vidc_core.h"
+#include "msm_vidc_control.h"
+#include "msm_vidc_power.h"
+#include "msm_vidc_platform.h"
+#include "msm_vidc_memory.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_driver.h"
+#include "hfi_packet.h"
+#include "venus_hfi_response.h"
+#include "venus_hfi_queue.h"
+#include "msm_vidc_events.h"
+#include "msm_vidc_state.h"
+#include "firmware.h"
+
+#define update_offset(offset, val)		((offset) += (val))
+#define update_timestamp(ts, val) \
+	do { \
+		do_div((ts), NSEC_PER_USEC); \
+		(ts) += (val); \
+		(ts) *= NSEC_PER_USEC; \
+	} while (0)
+
+extern struct msm_vidc_core *g_core;
+
+static int __resume(struct msm_vidc_core *core);
+static int __suspend(struct msm_vidc_core *core);
+
+static void __fatal_error(bool fatal)
+{
+	WARN_ON(fatal);
+}
+
+int __strict_check(struct msm_vidc_core *core, const char *function)
+{
+	bool fatal = !mutex_is_locked(&core->lock);
+
+	__fatal_error(fatal);
+
+	if (fatal)
+		d_vpr_e("%s: strict check failed\n", function);
+
+	return fatal ? -EINVAL : 0;
+}
+
+static bool __valdiate_session(struct msm_vidc_core *core,
+		struct msm_vidc_inst *inst, const char *func)
+{
+	bool valid = false;
+	struct msm_vidc_inst *temp;
+	int rc = 0;
+
+	rc = __strict_check(core, __func__);
+	if (rc)
+		return false;
+
+	list_for_each_entry(temp, &core->instances, list) {
+		if (temp == inst) {
+			valid = true;
+			break;
+		}
+	}
+	if (!valid)
+		i_vpr_e(inst, "%s: invalid session\n", func);
+
+	return valid;
+}
+
+static void __schedule_power_collapse_work(struct msm_vidc_core *core)
+{
+	if (!core->capabilities[SW_PC].value) {
+		d_vpr_l("software power collapse not enabled\n");
+		return;
+	}
+
+	if (!mod_delayed_work(core->pm_workq, &core->pm_work,
+			msecs_to_jiffies(core->capabilities[SW_PC_DELAY].value))) {
+		d_vpr_h("power collapse already scheduled\n");
+	} else {
+		d_vpr_l("power collapse scheduled for %d ms\n",
+			core->capabilities[SW_PC_DELAY].value);
+	}
+}
+
+static void __cancel_power_collapse_work(struct msm_vidc_core *core)
+{
+	if (!core->capabilities[SW_PC].value)
+		return;
+
+	cancel_delayed_work(&core->pm_work);
+}
+
+static void __flush_debug_queue(struct msm_vidc_core *core,
+	u8 *packet, u32 packet_size)
+{
+	u8 *log;
+	struct hfi_debug_header *pkt;
+	bool local_packet = false;
+	enum vidc_msg_prio_fw log_level_fw = msm_fw_debug;
+
+	if (!packet || !packet_size) {
+		packet = vzalloc(VIDC_IFACEQ_VAR_HUGE_PKT_SIZE);
+		if (!packet) {
+			d_vpr_e("%s: allocation failed\n", __func__);
+			return;
+		}
+		packet_size = VIDC_IFACEQ_VAR_HUGE_PKT_SIZE;
+
+		local_packet = true;
+
+		/*
+		 * Local packet is used when error occurred.
+		 * It is good to print these logs to printk as well.
+		 */
+		log_level_fw |= FW_PRINTK;
+	}
+
+	while (!venus_hfi_queue_dbg_read(core, packet)) {
+		pkt = (struct hfi_debug_header *)packet;
+
+		if (pkt->size < sizeof(struct hfi_debug_header)) {
+			d_vpr_e("%s: invalid pkt size %d\n",
+				__func__, pkt->size);
+			continue;
+		}
+		if (pkt->size >= packet_size) {
+			d_vpr_e("%s: pkt size[%d] >= packet_size[%d]\n",
+				__func__, pkt->size, packet_size);
+			continue;
+		}
+
+		packet[pkt->size] = '\0';
+		/*
+		 * All fw messages starts with new line character. This
+		 * causes dprintk to print this message in two lines
+		 * in the kernel log. Ignoring the first character
+		 * from the message fixes this to print it in a single
+		 * line.
+		 */
+		log = (u8 *)packet + sizeof(struct hfi_debug_header) + 1;
+		dprintk_firmware(log_level_fw, "%s", log);
+	}
+
+	if (local_packet)
+		vfree(packet);
+}
+
+static int __cmdq_write(struct msm_vidc_core *core, void *pkt)
+{
+	int rc;
+
+	rc = __resume(core);
+	if (rc)
+		return rc;
+
+	rc = venus_hfi_queue_cmd_write(core, pkt);
+	if (!rc)
+		__schedule_power_collapse_work(core);
+
+	return rc;
+}
+
+static int __cmdq_write_intr(struct msm_vidc_core *core, void *pkt, bool allow_intr)
+{
+	int rc;
+
+	rc = __resume(core);
+	if (rc)
+		return rc;
+
+	rc = venus_hfi_queue_cmd_write_intr(core, pkt, allow_intr);
+	if (!rc)
+		__schedule_power_collapse_work(core);
+
+	return rc;
+}
+
+static int __sys_set_debug(struct msm_vidc_core *core, u32 debug)
+{
+	int rc = 0;
+
+	rc = hfi_packet_sys_debug_config(core, core->packet,
+			core->packet_size, debug);
+	if (rc)
+		goto exit;
+
+	rc = __cmdq_write(core, core->packet);
+	if (rc)
+		goto exit;
+
+exit:
+	if (rc)
+		d_vpr_e("Debug mode setting to FW failed\n");
+
+	return rc;
+}
+
+static int __sys_set_power_control(struct msm_vidc_core *core, bool enable)
+{
+	int rc = 0;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_GDSC_HANDOFF)) {
+		d_vpr_e("%s: skipping as power control hanfoff was not done\n",
+			__func__);
+		return rc;
+	}
+
+	if (!core_in_valid_state(core)) {
+		d_vpr_e("%s: invalid core state %s\n",
+			__func__, core_state_name(core->state));
+		return rc;
+	}
+
+	rc = hfi_packet_sys_intraframe_powercollapse(core,
+		core->packet, core->packet_size, enable);
+	if (rc)
+		return rc;
+
+	rc = __cmdq_write(core, core->packet);
+	if (rc)
+		return rc;
+
+	rc = msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_FW_PWR_CTRL, __func__);
+	if (rc)
+		return rc;
+
+	d_vpr_h("%s: set hardware power control successful\n", __func__);
+
+	return rc;
+}
+
+int __prepare_pc(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = hfi_packet_sys_pc_prep(core, core->packet, core->packet_size);
+	if (rc) {
+		d_vpr_e("Failed to create sys pc prep pkt\n");
+		goto err_pc_prep;
+	}
+
+	if (__cmdq_write(core, core->packet))
+		rc = -ENOTEMPTY;
+	if (rc)
+		d_vpr_e("Failed to prepare venus for power off");
+err_pc_prep:
+	return rc;
+}
+
+static int __power_collapse(struct msm_vidc_core *core, bool force)
+{
+	int rc = 0;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE)) {
+		d_vpr_h("%s: Power already disabled\n", __func__);
+		goto exit;
+	}
+
+	if (!core_in_valid_state(core)) {
+		d_vpr_e("%s: Core not in init state\n", __func__);
+		return -EINVAL;
+	}
+
+	__flush_debug_queue(core, (!force ? core->packet : NULL), core->packet_size);
+
+	rc = call_venus_op(core, prepare_pc, core);
+	if (rc)
+		goto skip_power_off;
+
+	rc = __suspend(core);
+	if (rc)
+		d_vpr_e("Failed __suspend\n");
+
+exit:
+	return rc;
+
+skip_power_off:
+	d_vpr_e("%s: skipped\n", __func__);
+	return -EAGAIN;
+}
+
+static int __release_subcaches(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	struct subcache_info *sinfo;
+	struct hfi_buffer buf;
+
+	if (msm_vidc_syscache_disable || !is_sys_cache_present(core))
+		return 0;
+
+	if (!core->resource->subcache_set.set_to_fw) {
+		d_vpr_h("Subcaches not set to Venus\n");
+		return 0;
+	}
+
+	rc = hfi_create_header(core->packet, core->packet_size,
+		0, core->header_id++);
+	if (rc)
+		return rc;
+
+	memset(&buf, 0, sizeof(struct hfi_buffer));
+	buf.type = HFI_BUFFER_SUBCACHE;
+	buf.flags = HFI_BUF_HOST_FLAG_RELEASE;
+
+	venus_hfi_for_each_subcache_reverse(core, sinfo) {
+		if (!sinfo->isactive)
+			continue;
+
+		buf.index = sinfo->subcache->slice_id;
+		buf.buffer_size = sinfo->subcache->slice_size;
+
+		rc = hfi_create_packet(core->packet,
+			core->packet_size,
+			HFI_CMD_BUFFER,
+			HFI_BUF_HOST_FLAG_NONE,
+			HFI_PAYLOAD_STRUCTURE,
+			HFI_PORT_NONE,
+			core->packet_id++,
+			&buf,
+			sizeof(buf));
+		if (rc)
+			return rc;
+	}
+
+	/* Set resource to Venus for activated subcaches */
+	rc = __cmdq_write(core, core->packet);
+	if (rc)
+		return rc;
+
+	venus_hfi_for_each_subcache_reverse(core, sinfo) {
+		if (!sinfo->isactive)
+			continue;
+
+		d_vpr_h("%s: release Subcache id %d size %lu done\n",
+			__func__, sinfo->subcache->slice_id,
+			sinfo->subcache->slice_size);
+	}
+	core->resource->subcache_set.set_to_fw = false;
+
+	return 0;
+}
+
+static int __set_subcaches(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	struct subcache_info *sinfo;
+	struct hfi_buffer buf;
+
+	if (msm_vidc_syscache_disable ||
+		!is_sys_cache_present(core)) {
+		return 0;
+	}
+
+	if (core->resource->subcache_set.set_to_fw) {
+		d_vpr_h("Subcaches already set to Venus\n");
+		return 0;
+	}
+
+	rc = hfi_create_header(core->packet, core->packet_size,
+		0, core->header_id++);
+	if (rc)
+		goto err_fail_set_subacaches;
+
+	memset(&buf, 0, sizeof(struct hfi_buffer));
+	buf.type = HFI_BUFFER_SUBCACHE;
+	buf.flags = HFI_BUF_HOST_FLAG_NONE;
+
+	venus_hfi_for_each_subcache(core, sinfo) {
+		if (!sinfo->isactive)
+			continue;
+		buf.index = sinfo->subcache->slice_id;
+		buf.buffer_size = sinfo->subcache->slice_size;
+
+		rc = hfi_create_packet(core->packet,
+			core->packet_size,
+			HFI_CMD_BUFFER,
+			HFI_BUF_HOST_FLAG_NONE,
+			HFI_PAYLOAD_STRUCTURE,
+			HFI_PORT_NONE,
+			core->packet_id++,
+			&buf,
+			sizeof(buf));
+		if (rc)
+			goto err_fail_set_subacaches;
+	}
+
+	/* Set resource to Venus for activated subcaches */
+	rc = __cmdq_write(core, core->packet);
+	if (rc)
+		goto err_fail_set_subacaches;
+
+	venus_hfi_for_each_subcache(core, sinfo) {
+		if (!sinfo->isactive)
+			continue;
+		d_vpr_h("%s: set Subcache id %d size %lu done\n",
+			__func__, sinfo->subcache->slice_id,
+			sinfo->subcache->slice_size);
+	}
+	core->resource->subcache_set.set_to_fw = true;
+
+	return 0;
+
+err_fail_set_subacaches:
+	call_res_op(core, llcc, core, false);
+	return rc;
+}
+
+static int __venus_power_off(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE))
+		return 0;
+
+	rc = call_venus_op(core, power_off, core);
+	if (rc) {
+		d_vpr_e("Failed to power off, err: %d\n", rc);
+		return rc;
+	}
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE, 0, __func__);
+
+	return rc;
+}
+
+static int __venus_power_on(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE))
+		return 0;
+
+	rc = call_venus_op(core, power_on, core);
+	if (rc) {
+		d_vpr_e("Failed to power on, err: %d\n", rc);
+		return rc;
+	}
+
+	rc = msm_vidc_change_core_sub_state(core, 0, CORE_SUBSTATE_POWER_ENABLE, __func__);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int __suspend(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE)) {
+		d_vpr_h("Power already disabled\n");
+		return 0;
+	}
+
+	rc = __strict_check(core, __func__);
+	if (rc)
+		return rc;
+
+	d_vpr_h("Entering suspend\n");
+
+	rc = fw_suspend(core);
+	if (rc) {
+		d_vpr_e("Failed to suspend video core %d\n", rc);
+		goto err_tzbsp_suspend;
+	}
+
+	call_res_op(core, llcc, core, false);
+
+	__venus_power_off(core);
+	d_vpr_h("Venus power off\n");
+	return rc;
+
+err_tzbsp_suspend:
+	return rc;
+}
+
+static int __resume(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (is_core_sub_state(core, CORE_SUBSTATE_POWER_ENABLE)) {
+		goto exit;
+	} else if (!core_in_valid_state(core)) {
+		d_vpr_e("%s: core not in valid state\n", __func__);
+		return -EINVAL;
+	}
+
+	rc = __strict_check(core, __func__);
+	if (rc)
+		return rc;
+
+	d_vpr_h("Resuming from power collapse\n");
+	/* reset handoff done from core sub_state */
+	rc = msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_GDSC_HANDOFF, 0, __func__);
+	if (rc)
+		return rc;
+	/* reset hw pwr ctrl from core sub_state */
+	rc = msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_FW_PWR_CTRL, 0, __func__);
+	if (rc)
+		return rc;
+
+	rc = __venus_power_on(core);
+	if (rc) {
+		d_vpr_e("Failed to power on venus\n");
+		goto err_venus_power_on;
+	}
+
+	/* Reboot the firmware */
+	rc = fw_resume(core);
+	if (rc) {
+		d_vpr_e("Failed to resume video core %d\n", rc);
+		goto err_set_video_state;
+	}
+
+	/*
+	 * Hand off control of regulators to h/w _after_ loading fw.
+	 * Note that the GDSC will turn off when switching from normal
+	 * (s/w triggered) to fast (HW triggered) unless the h/w vote is
+	 * present.
+	 */
+	call_res_op(core, gdsc_hw_ctrl, core);
+
+	/* Wait for boot completion */
+	rc = call_venus_op(core, boot_firmware, core);
+	if (rc) {
+		d_vpr_e("Failed to reset venus core\n");
+		goto err_reset_core;
+	}
+
+	__sys_set_debug(core, (msm_fw_debug & FW_LOGMASK) >> FW_LOGSHIFT);
+
+	rc = call_res_op(core, llcc, core, true);
+	if (rc) {
+		d_vpr_e("Failed to activate subcache\n");
+		goto err_reset_core;
+	}
+	__set_subcaches(core);
+
+	rc = __sys_set_power_control(core, true);
+	if (rc) {
+		d_vpr_e("%s: set power control failed\n", __func__);
+		call_res_op(core, gdsc_sw_ctrl, core);
+		rc = 0;
+	}
+
+	d_vpr_h("Resumed from power collapse\n");
+exit:
+	/* Don't reset skip_pc_count for SYS_PC_PREP cmd */
+	//if (core->last_packet_type != HFI_CMD_SYS_PC_PREP)
+	//	core->skip_pc_count = 0;
+	return rc;
+err_reset_core:
+	fw_suspend(core);
+err_set_video_state:
+	__venus_power_off(core);
+err_venus_power_on:
+	d_vpr_e("Failed to resume from power collapse\n");
+	return rc;
+}
+
+static int __load_fw(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	d_vpr_h("%s: loading video firmware\n", __func__);
+
+	/* clear all substates */
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_MAX - 1, 0, __func__);
+
+	trace_msm_v4l2_vidc_fw_load("START");
+	rc = __venus_power_on(core);
+	if (rc) {
+		d_vpr_e("%s: power on failed\n", __func__);
+		goto fail_power;
+	}
+
+	rc = fw_load(core);
+	if (rc)
+		goto fail_load_fw;
+
+	/*
+	 * Hand off control of regulators to h/w _after_ loading fw.
+	 * Note that the GDSC will turn off when switching from normal
+	 * (s/w triggered) to fast (HW triggered) unless the h/w vote is
+	 * present.
+	 */
+	call_res_op(core, gdsc_hw_ctrl, core);
+	trace_msm_v4l2_vidc_fw_load("END");
+
+	return rc;
+fail_load_fw:
+	__venus_power_off(core);
+fail_power:
+	trace_msm_v4l2_vidc_fw_load("END");
+	return rc;
+}
+
+static void __unload_fw(struct msm_vidc_core *core)
+{
+	if (!core->resource->fw_cookie)
+		return;
+
+	cancel_delayed_work(&core->pm_work);
+	fw_unload(core);
+	__venus_power_off(core);
+
+	/* clear all substates */
+	msm_vidc_change_core_sub_state(core, CORE_SUBSTATE_MAX - 1, 0, __func__);
+
+	d_vpr_h("%s unloaded video firmware\n", __func__);
+}
+
+static int __response_handler(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (call_venus_op(core, watchdog, core, core->intr_status)) {
+		struct hfi_packet pkt = {.type = HFI_SYS_ERROR_WD_TIMEOUT};
+
+		core_lock(core, __func__);
+		msm_vidc_change_core_state(core, MSM_VIDC_CORE_ERROR, __func__);
+		/* mark cpu watchdog error */
+		msm_vidc_change_core_sub_state(core,
+			0, CORE_SUBSTATE_CPU_WATCHDOG, __func__);
+		d_vpr_e("%s: CPU WD error received\n", __func__);
+		core_unlock(core, __func__);
+
+		return handle_system_error(core, &pkt);
+	}
+
+	memset(core->response_packet, 0, core->packet_size);
+	while (!venus_hfi_queue_msg_read(core, core->response_packet)) {
+		rc = handle_response(core, core->response_packet);
+		if (rc)
+			continue;
+		/* check for system error */
+		if (core->state != MSM_VIDC_CORE_INIT)
+			break;
+		memset(core->response_packet, 0, core->packet_size);
+	}
+
+	__schedule_power_collapse_work(core);
+	__flush_debug_queue(core, core->response_packet, core->packet_size);
+
+	return rc;
+}
+
+irqreturn_t venus_hfi_isr(int irq, void *data)
+{
+	disable_irq_nosync(irq);
+	return IRQ_WAKE_THREAD;
+}
+
+irqreturn_t venus_hfi_isr_handler(int irq, void *data)
+{
+	struct msm_vidc_core *core = data;
+	int num_responses = 0, rc = 0;
+
+	d_vpr_l("%s: received interrupt from hardware\n", __func__);
+
+	if (!core) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return IRQ_NONE;
+	}
+
+	core_lock(core, __func__);
+	rc = __resume(core);
+	if (rc) {
+		d_vpr_e("%s: Power on failed\n", __func__);
+		core_unlock(core, __func__);
+		goto exit;
+	}
+	call_venus_op(core, clear_interrupt, core);
+	core_unlock(core, __func__);
+
+	num_responses = __response_handler(core);
+
+exit:
+	if (!call_venus_op(core, watchdog, core, core->intr_status))
+		enable_irq(irq);
+
+	return IRQ_HANDLED;
+}
+
+void venus_hfi_pm_work_handler(struct work_struct *work)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	core = container_of(work, struct msm_vidc_core, pm_work.work);
+
+	core_lock(core, __func__);
+	d_vpr_h("%s: try power collapse\n", __func__);
+	/*
+	 * It is ok to check this variable outside the lock since
+	 * it is being updated in this context only
+	 */
+	if (core->skip_pc_count >= VIDC_MAX_PC_SKIP_COUNT) {
+		d_vpr_e("Failed to PC for %d times\n",
+				core->skip_pc_count);
+		core->skip_pc_count = 0;
+		msm_vidc_change_core_state(core, MSM_VIDC_CORE_ERROR, __func__);
+		/* mark video hw unresponsive */
+		msm_vidc_change_core_sub_state(core,
+			0, CORE_SUBSTATE_VIDEO_UNRESPONSIVE, __func__);
+		/* do core deinit to handle error */
+		msm_vidc_core_deinit_locked(core, true);
+		goto unlock;
+	}
+
+	/* core already deinited - skip power collapse */
+	if (is_core_state(core, MSM_VIDC_CORE_DEINIT)) {
+		d_vpr_e("%s: invalid core state %s\n",
+			__func__, core_state_name(core->state));
+		goto unlock;
+	}
+
+	rc = __power_collapse(core, false);
+	switch (rc) {
+	case 0:
+		core->skip_pc_count = 0;
+		/* Cancel pending delayed works if any */
+		__cancel_power_collapse_work(core);
+		d_vpr_h("%s: power collapse successful!\n", __func__);
+		break;
+	case -EBUSY:
+		core->skip_pc_count = 0;
+		d_vpr_h("%s: retry PC as dsp is busy\n", __func__);
+		__schedule_power_collapse_work(core);
+		break;
+	case -EAGAIN:
+		core->skip_pc_count++;
+		d_vpr_e("%s: retry power collapse (count %d)\n",
+			__func__, core->skip_pc_count);
+		__schedule_power_collapse_work(core);
+		break;
+	default:
+		d_vpr_e("%s: power collapse failed\n", __func__);
+		break;
+	}
+unlock:
+	core_unlock(core, __func__);
+}
+
+static int __sys_init(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc =  hfi_packet_sys_init(core, core->packet, core->packet_size);
+	if (rc)
+		return rc;
+
+	rc = __cmdq_write(core, core->packet);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+static int __sys_image_version(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = hfi_packet_image_version(core, core->packet, core->packet_size);
+	if (rc)
+		return rc;
+
+	rc = __cmdq_write(core, core->packet);
+	if (rc)
+		return rc;
+
+	return 0;
+}
+
+int venus_hfi_core_init(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	d_vpr_h("%s(): core %pK\n", __func__, core);
+
+	rc = __strict_check(core, __func__);
+	if (rc)
+		return rc;
+
+	rc = venus_hfi_queue_init(core);
+	if (rc)
+		goto error;
+
+	rc = __load_fw(core);
+	if (rc)
+		goto error;
+
+	rc = call_venus_op(core, boot_firmware, core);
+	if (rc)
+		goto error;
+
+	rc = call_res_op(core, llcc, core, true);
+	if (rc)
+		goto error;
+
+	rc = __sys_init(core);
+	if (rc)
+		goto error;
+
+	rc = __sys_image_version(core);
+	if (rc)
+		goto error;
+
+	rc = __sys_set_debug(core, (msm_fw_debug & FW_LOGMASK) >> FW_LOGSHIFT);
+	if (rc)
+		goto error;
+
+	rc = __set_subcaches(core);
+	if (rc)
+		goto error;
+
+	rc = __sys_set_power_control(core, true);
+	if (rc) {
+		d_vpr_e("%s: set power control failed\n", __func__);
+		call_res_op(core, gdsc_sw_ctrl, core);
+		rc = 0;
+	}
+
+	d_vpr_h("%s(): successful\n", __func__);
+	return 0;
+
+error:
+	d_vpr_e("%s(): failed\n", __func__);
+	return rc;
+}
+
+int venus_hfi_core_deinit(struct msm_vidc_core *core, bool force)
+{
+	int rc = 0;
+
+	d_vpr_h("%s(): core %pK\n", __func__, core);
+	rc = __strict_check(core, __func__);
+	if (rc)
+		return rc;
+
+	if (is_core_state(core, MSM_VIDC_CORE_DEINIT))
+		return 0;
+	__resume(core);
+	__flush_debug_queue(core, (!force ? core->packet : NULL), core->packet_size);
+	__release_subcaches(core);
+	call_res_op(core, llcc, core, false);
+	__unload_fw(core);
+	/**
+	 * coredump need to be called after firmware unload, coredump also
+	 * copying queues memory. So need to be called before queues deinit.
+	 */
+	if (msm_vidc_fw_dump)
+		fw_coredump(core);
+
+	return 0;
+}
+
+int venus_hfi_noc_error_info(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	if (!core->capabilities[NON_FATAL_FAULTS].value)
+		return 0;
+
+	core_lock(core, __func__);
+	if (is_core_state(core, MSM_VIDC_CORE_DEINIT))
+		goto unlock;
+
+	/* resume venus before accessing noc registers */
+	rc = __resume(core);
+	if (rc) {
+		d_vpr_e("%s: Power on failed\n", __func__);
+		goto unlock;
+	}
+
+	call_venus_op(core, noc_error_info, core);
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_suspend(struct msm_vidc_core *core)
+{
+	int rc = 0;
+
+	rc = __strict_check(core, __func__);
+	if (rc)
+		return rc;
+
+	if (!core->capabilities[SW_PC].value) {
+		d_vpr_h("Skip suspending venus\n");
+		return 0;
+	}
+
+	d_vpr_h("Suspending Venus\n");
+	rc = __power_collapse(core, true);
+	if (!rc) {
+		/* Cancel pending delayed works if any */
+		__cancel_power_collapse_work(core);
+	} else {
+		d_vpr_e("%s: Venus is busy\n", __func__);
+		rc = -EBUSY;
+	}
+
+	return rc;
+}
+
+int venus_hfi_trigger_ssr(struct msm_vidc_core *core, u32 type,
+	u32 client_id, u32 addr)
+{
+	int rc = 0;
+	u32 payload[2];
+
+	/*
+	 * call resume before preparing ssr hfi packet in core->packet
+	 * otherwise ssr hfi packet in core->packet will be overwritten
+	 * by __resume() call (inside __cmdq_write) which is preparing
+	 * ifpc hfi packets in core->packet
+	 */
+	rc = __resume(core);
+	if (rc)
+		return rc;
+
+	payload[0] = client_id << 4 | type;
+	payload[1] = addr;
+
+	rc = hfi_create_header(core->packet, core->packet_size,
+			   0 /*session_id*/,
+			   core->header_id++);
+	if (rc)
+		goto exit;
+
+	/* HFI_CMD_SSR */
+	rc = hfi_create_packet(core->packet, core->packet_size,
+				   HFI_CMD_SSR,
+				   HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				   HFI_HOST_FLAGS_INTR_REQUIRED,
+				   HFI_PAYLOAD_U64,
+				   HFI_PORT_NONE,
+				   core->packet_id++,
+				   &payload, sizeof(u64));
+	if (rc)
+		goto exit;
+
+	rc = __cmdq_write(core, core->packet);
+	if (rc)
+		goto exit;
+
+exit:
+	if (rc)
+		d_vpr_e("%s(): failed\n", __func__);
+
+	return rc;
+}
+
+int venus_hfi_trigger_stability(struct msm_vidc_inst *inst, u32 type,
+	u32 client_id, u32 val)
+{
+	struct msm_vidc_core *core;
+	u32 payload[2];
+	int rc = 0;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	payload[0] = client_id << 4 | type;
+	payload[1] = val;
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+			   inst->session_id, core->header_id++);
+	if (rc)
+		goto unlock;
+
+	/* HFI_CMD_STABILITY */
+	rc = hfi_create_packet(inst->packet, inst->packet_size,
+				   HFI_CMD_STABILITY,
+				   HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				   HFI_HOST_FLAGS_INTR_REQUIRED,
+				   HFI_PAYLOAD_U64,
+				   HFI_PORT_NONE,
+				   core->packet_id++,
+				   &payload, sizeof(u64));
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_reserve_hardware(struct msm_vidc_inst *inst, u32 duration)
+{
+	struct msm_vidc_core *core;
+	enum hfi_reserve_type payload;
+	int rc = 0;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: Invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	if (duration)
+		payload = HFI_RESERVE_START;
+	else
+		payload = HFI_RESERVE_STOP;
+
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+		inst->session_id, core->header_id++);
+	if (rc)
+		goto unlock;
+
+	rc = hfi_create_packet(inst->packet, inst->packet_size,
+		HFI_CMD_RESERVE,
+		HFI_HOST_FLAGS_NONE,
+		HFI_PAYLOAD_U32_ENUM,
+		HFI_PORT_NONE,
+		core->packet_id++,
+		&payload, sizeof(u32));
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_session_open(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	__sys_set_debug(core, (msm_fw_debug & FW_LOGMASK) >> FW_LOGSHIFT);
+
+	rc = hfi_packet_session_command(inst,
+				HFI_CMD_OPEN,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED),
+				HFI_PORT_NONE,
+				0, /* session_id */
+				HFI_PAYLOAD_U32,
+				&inst->session_id, /* payload */
+				sizeof(u32));
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_session_set_codec(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	u32 codec;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+			inst->session_id, core->header_id++);
+	if (rc)
+		goto unlock;
+
+	codec = get_hfi_codec(inst);
+	rc = hfi_create_packet(inst->packet, inst->packet_size,
+			HFI_PROP_CODEC,
+			HFI_HOST_FLAGS_NONE,
+			HFI_PAYLOAD_U32_ENUM,
+			HFI_PORT_NONE,
+			core->packet_id++,
+			&codec,
+			sizeof(u32));
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_session_set_secure_mode(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	u32 secure_mode;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+			inst->session_id, core->header_id++);
+	if (rc)
+		goto unlock;
+
+	secure_mode = inst->capabilities[SECURE_MODE].value;
+	rc = hfi_create_packet(inst->packet, inst->packet_size,
+			HFI_PROP_SECURE,
+			HFI_HOST_FLAGS_NONE,
+			HFI_PAYLOAD_U32,
+			HFI_PORT_NONE,
+			core->packet_id++,
+			&secure_mode,
+			sizeof(u32));
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+static int venus_hfi_cache_packet(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct hfi_header *hdr;
+	struct hfi_pending_packet *packet;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+
+	hdr = (struct hfi_header *)inst->packet;
+	if (hdr->size < sizeof(struct hfi_header)) {
+		d_vpr_e("%s: invalid hdr size %d\n", __func__, hdr->size);
+		return -EINVAL;
+	}
+
+	packet = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_PACKET);
+	if (!packet) {
+		i_vpr_e(inst, "%s: failed to allocate pending packet\n", __func__);
+		return -ENOMEM;
+	}
+
+	INIT_LIST_HEAD(&packet->list);
+	list_add_tail(&packet->list, &inst->pending_pkts);
+	packet->data = (u8 *)packet + sizeof(struct hfi_pending_packet);
+
+	if (hdr->size > MSM_MEM_POOL_PACKET_SIZE) {
+		i_vpr_e(inst, "%s: header size %d exceeds pool packet size %d\n",
+			__func__, hdr->size, MSM_MEM_POOL_PACKET_SIZE);
+		return -EINVAL;
+	}
+	memcpy(packet->data, inst->packet, hdr->size);
+
+	return rc;
+}
+
+int venus_hfi_session_property(struct msm_vidc_inst *inst,
+	u32 pkt_type, u32 flags, u32 port, u32 payload_type,
+	void *payload, u32 payload_size)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+				inst->session_id, core->header_id++);
+	if (rc)
+		goto unlock;
+	rc = hfi_create_packet(inst->packet, inst->packet_size,
+				pkt_type,
+				flags,
+				payload_type,
+				port,
+				core->packet_id++,
+				payload,
+				payload_size);
+	if (rc)
+		goto unlock;
+
+	/* skip sending packet to firmware */
+	if (inst->request) {
+		rc = venus_hfi_cache_packet(inst);
+		goto unlock;
+	}
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_session_close(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	rc = hfi_packet_session_command(inst,
+				HFI_CMD_CLOSE,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED |
+				HFI_HOST_FLAGS_NON_DISCARDABLE),
+				HFI_PORT_NONE,
+				inst->session_id,
+				HFI_PAYLOAD_NONE,
+				NULL,
+				0);
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_start(struct msm_vidc_inst *inst, enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		goto unlock;
+	}
+
+	rc = hfi_packet_session_command(inst,
+				HFI_CMD_START,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED),
+				get_hfi_port(inst, port),
+				inst->session_id,
+				HFI_PAYLOAD_NONE,
+				NULL,
+				0);
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_stop(struct msm_vidc_inst *inst, enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		goto unlock;
+	}
+
+	rc = hfi_packet_session_command(inst,
+				HFI_CMD_STOP,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED |
+				HFI_HOST_FLAGS_NON_DISCARDABLE),
+				get_hfi_port(inst, port),
+				inst->session_id,
+				HFI_PAYLOAD_NONE,
+				NULL,
+				0);
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_session_pause(struct msm_vidc_inst *inst, enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		goto unlock;
+	}
+
+	rc = hfi_packet_session_command(inst,
+				HFI_CMD_PAUSE,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED),
+				get_hfi_port(inst, port),
+				inst->session_id,
+				HFI_PAYLOAD_NONE,
+				NULL,
+				0);
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_session_resume(struct msm_vidc_inst *inst,
+	enum msm_vidc_port_type port, u32 payload)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	if (port != INPUT_PORT && port != OUTPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		goto unlock;
+	}
+
+	rc = hfi_packet_session_command(inst,
+				HFI_CMD_RESUME,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED),
+				get_hfi_port(inst, port),
+				inst->session_id,
+				HFI_PAYLOAD_U32,
+				&payload,
+				sizeof(u32));
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_session_drain(struct msm_vidc_inst *inst, enum msm_vidc_port_type port)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	if (port != INPUT_PORT) {
+		i_vpr_e(inst, "%s: invalid port %d\n", __func__, port);
+		goto unlock;
+	}
+
+	rc = hfi_packet_session_command(inst,
+				HFI_CMD_DRAIN,
+				(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+				HFI_HOST_FLAGS_INTR_REQUIRED |
+				HFI_HOST_FLAGS_NON_DISCARDABLE),
+				get_hfi_port(inst, port),
+				inst->session_id,
+				HFI_PAYLOAD_NONE,
+				NULL,
+				0);
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_session_command(struct msm_vidc_inst *inst,
+	u32 cmd, enum msm_vidc_port_type port, u32 payload_type,
+	void *payload, u32 payload_size)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+			inst->session_id,
+			core->header_id++);
+	if (rc)
+		goto unlock;
+
+	rc = hfi_create_packet(inst->packet, inst->packet_size,
+			cmd,
+			(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+			HFI_HOST_FLAGS_INTR_REQUIRED),
+			payload_type,
+			get_hfi_port(inst, port),
+			core->packet_id++,
+			payload,
+			payload_size);
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_queue_super_buffer(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buffer, struct msm_vidc_buffer *metabuf)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct hfi_buffer hfi_buffer;
+	struct hfi_buffer hfi_meta_buffer;
+	u32 frame_size, meta_size, batch_size, cnt = 0;
+	u64 ts_delta_us;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	/* Get super yuv buffer */
+	rc = get_hfi_buffer(inst, buffer, &hfi_buffer);
+	if (rc)
+		goto unlock;
+
+	/* Get super meta buffer */
+	if (metabuf) {
+		rc = get_hfi_buffer(inst, metabuf, &hfi_meta_buffer);
+		if (rc)
+			goto unlock;
+	}
+
+	batch_size = inst->capabilities[SUPER_FRAME].value;
+	frame_size = call_session_op(core, buffer_size, inst, MSM_VIDC_BUF_INPUT);
+	meta_size = call_session_op(core, buffer_size, inst, MSM_VIDC_BUF_INPUT_META);
+	ts_delta_us = 1000000 / (inst->capabilities[FRAME_RATE].value >> 16);
+
+	/* Sanitize super yuv buffer */
+	if (frame_size * batch_size != buffer->buffer_size) {
+		i_vpr_e(inst, "%s: invalid super yuv buffer. frame %u, batch %u, buffer size %u\n",
+			__func__, frame_size, batch_size, buffer->buffer_size);
+		goto unlock;
+	}
+
+	/* Sanitize super meta buffer */
+	if (metabuf && meta_size * batch_size > metabuf->buffer_size) {
+		i_vpr_e(inst, "%s: invalid super meta buffer. meta %u, batch %u, buffer size %u\n",
+			__func__, meta_size, batch_size, metabuf->buffer_size);
+		goto unlock;
+	}
+
+	/* Initialize yuv buffer */
+	hfi_buffer.data_size = frame_size;
+	hfi_buffer.addr_offset = 0;
+
+	/* Initialize meta buffer */
+	if (metabuf) {
+		hfi_meta_buffer.data_size = meta_size;
+		hfi_meta_buffer.addr_offset = 0;
+	}
+
+	while (cnt < batch_size) {
+		/* Create header */
+		rc = hfi_create_header(inst->packet, inst->packet_size,
+				inst->session_id, core->header_id++);
+		if (rc)
+			goto unlock;
+
+		/* Create yuv packet */
+		update_offset(hfi_buffer.addr_offset, (cnt ? frame_size : 0u));
+		update_timestamp(hfi_buffer.timestamp, (cnt ? ts_delta_us : 0u));
+		rc = hfi_create_packet(inst->packet,
+				inst->packet_size,
+				HFI_CMD_BUFFER,
+				HFI_HOST_FLAGS_INTR_REQUIRED,
+				HFI_PAYLOAD_STRUCTURE,
+				get_hfi_port_from_buffer_type(inst, buffer->type),
+				core->packet_id++,
+				&hfi_buffer,
+				sizeof(hfi_buffer));
+		if (rc)
+			goto unlock;
+
+		/* Create meta packet */
+		if (metabuf) {
+			update_offset(hfi_meta_buffer.addr_offset, (cnt ? meta_size : 0u));
+			update_timestamp(hfi_meta_buffer.timestamp, (cnt ? ts_delta_us : 0u));
+			rc = hfi_create_packet(inst->packet,
+				inst->packet_size,
+				HFI_CMD_BUFFER,
+				HFI_HOST_FLAGS_INTR_REQUIRED,
+				HFI_PAYLOAD_STRUCTURE,
+				get_hfi_port_from_buffer_type(inst, metabuf->type),
+				core->packet_id++,
+				&hfi_meta_buffer,
+				sizeof(hfi_meta_buffer));
+			if (rc)
+				goto unlock;
+		}
+
+		/* Raise interrupt only for last pkt in the batch */
+		rc = __cmdq_write_intr(inst->core, inst->packet,
+				       (cnt == batch_size - 1));
+		if (rc)
+			goto unlock;
+
+		/* update start timestamp */
+		msm_vidc_add_buffer_stats(inst, buffer, hfi_buffer.timestamp);
+
+		cnt++;
+	}
+unlock:
+	core_unlock(core, __func__);
+	if (rc)
+		i_vpr_e(inst, "%s: queue super buffer failed: %d\n", __func__, rc);
+
+	return rc;
+}
+
+static int venus_hfi_add_pending_packets(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	int num_packets = 0;
+	struct hfi_pending_packet *pkt_info, *dummy;
+	struct hfi_header *hdr, *src_hdr;
+	struct hfi_packet *src_pkt;
+	struct msm_vidc_core *core;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+
+	hdr = (struct hfi_header *)inst->packet;
+	if (hdr->size < sizeof(struct hfi_header)) {
+		i_vpr_e(inst, "%s: invalid hdr size %d\n",
+			__func__, hdr->size);
+		return -EINVAL;
+	}
+
+	list_for_each_entry_safe(pkt_info, dummy, &inst->pending_pkts, list) {
+		src_hdr = (struct hfi_header *)(pkt_info->data);
+		num_packets = src_hdr->num_packets;
+		src_pkt = (struct hfi_packet *)((u8 *)src_hdr + sizeof(struct hfi_header));
+		while (num_packets > 0) {
+			memcpy((u8 *)hdr + hdr->size, (void *)src_pkt, src_pkt->size);
+			hdr->num_packets++;
+			hdr->size += src_pkt->size;
+			num_packets--;
+			src_pkt = (struct hfi_packet *)((u8 *)src_pkt + src_pkt->size);
+			if ((u8 *)src_pkt < (u8 *)src_hdr ||
+					(u8 *)src_pkt > (u8 *)src_hdr + hdr->size) {
+				i_vpr_e(inst, "%s: invalid packet address\n", __func__);
+				return -EINVAL;
+			}
+		}
+		list_del(&pkt_info->list);
+		msm_vidc_pool_free(inst, pkt_info);
+	}
+	return rc;
+}
+
+int venus_hfi_queue_buffer(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buffer, struct msm_vidc_buffer *metabuf)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct hfi_buffer hfi_buffer, hfi_meta_buffer;
+
+	if (!inst->packet) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	rc = get_hfi_buffer(inst, buffer, &hfi_buffer);
+	if (rc)
+		goto unlock;
+
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+			   inst->session_id, core->header_id++);
+	if (rc)
+		goto unlock;
+
+	rc = hfi_create_packet(inst->packet,
+			inst->packet_size,
+			HFI_CMD_BUFFER,
+			HFI_HOST_FLAGS_INTR_REQUIRED,
+			HFI_PAYLOAD_STRUCTURE,
+			get_hfi_port_from_buffer_type(inst, buffer->type),
+			core->packet_id++,
+			&hfi_buffer,
+			sizeof(hfi_buffer));
+	if (rc)
+		goto unlock;
+
+	if (metabuf) {
+		rc = get_hfi_buffer(inst, metabuf, &hfi_meta_buffer);
+		if (rc)
+			goto unlock;
+		rc = hfi_create_packet(inst->packet,
+			inst->packet_size,
+			HFI_CMD_BUFFER,
+			HFI_HOST_FLAGS_INTR_REQUIRED,
+			HFI_PAYLOAD_STRUCTURE,
+			get_hfi_port_from_buffer_type(inst, metabuf->type),
+			core->packet_id++,
+			&hfi_meta_buffer,
+			sizeof(hfi_meta_buffer));
+		if (rc)
+			goto unlock;
+	}
+
+	if (is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE) &&
+		is_output_buffer(buffer->type)) {
+		if (!buffer->fence_id) {
+			i_vpr_e(inst, "%s: fence id cannot be 0\n", __func__);
+			rc = -EINVAL;
+			goto unlock;
+		}
+		rc = hfi_create_packet(inst->packet,
+			inst->packet_size,
+			HFI_PROP_FENCE,
+			0,
+			HFI_PAYLOAD_U64,
+			HFI_PORT_RAW,
+			core->packet_id++,
+			&buffer->fence_id,
+			sizeof(u64));
+		if (rc)
+			goto unlock;
+	}
+
+	rc = venus_hfi_add_pending_packets(inst);
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+	/* update start timestamp */
+	msm_vidc_add_buffer_stats(inst, buffer, hfi_buffer.timestamp);
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_release_buffer(struct msm_vidc_inst *inst,
+	struct msm_vidc_buffer *buffer)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	struct hfi_buffer hfi_buffer;
+
+	if (!inst->packet || !buffer) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+	core = inst->core;
+	core_lock(core, __func__);
+
+	if (!__valdiate_session(core, inst, __func__)) {
+		rc = -EINVAL;
+		goto unlock;
+	}
+
+	rc = get_hfi_buffer(inst, buffer, &hfi_buffer);
+	if (rc)
+		goto unlock;
+
+	/* add release flag */
+	hfi_buffer.flags |= HFI_BUF_HOST_FLAG_RELEASE;
+
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+			   inst->session_id, core->header_id++);
+	if (rc)
+		goto unlock;
+
+	rc = hfi_create_packet(inst->packet,
+			inst->packet_size,
+			HFI_CMD_BUFFER,
+			(HFI_HOST_FLAGS_RESPONSE_REQUIRED |
+			HFI_HOST_FLAGS_INTR_REQUIRED),
+			HFI_PAYLOAD_STRUCTURE,
+			get_hfi_port_from_buffer_type(inst, buffer->type),
+			core->packet_id++,
+			&hfi_buffer,
+			sizeof(hfi_buffer));
+	if (rc)
+		goto unlock;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc)
+		goto unlock;
+
+unlock:
+	core_unlock(core, __func__);
+	return rc;
+}
+
+int venus_hfi_scale_clocks(struct msm_vidc_inst *inst, u64 freq)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	rc = __resume(core);
+	if (rc) {
+		i_vpr_e(inst, "%s: Resume from power collapse failed\n", __func__);
+		goto exit;
+	}
+	rc = call_res_op(core, set_clks, core, freq);
+	if (rc)
+		goto exit;
+
+exit:
+	core_unlock(core, __func__);
+
+	return rc;
+}
+
+int venus_hfi_scale_buses(struct msm_vidc_inst *inst, u64 bw_ddr, u64 bw_llcc)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+	rc = __resume(core);
+	if (rc) {
+		i_vpr_e(inst, "%s: Resume from power collapse failed\n", __func__);
+		goto exit;
+	}
+	rc = call_res_op(core, set_bw, core, bw_ddr, bw_llcc);
+	if (rc)
+		goto exit;
+
+exit:
+	core_unlock(core, __func__);
+
+	return rc;
+}
+
+int venus_hfi_set_ir_period(struct msm_vidc_inst *inst, u32 ir_type,
+	enum msm_vidc_inst_capability_type cap_id)
+{
+	int rc = 0;
+	struct msm_vidc_core *core;
+	u32 ir_period, sync_frame_req = 0;
+
+	core = inst->core;
+
+	core_lock(core, __func__);
+
+	ir_period = inst->capabilities[cap_id].value;
+
+	rc = hfi_create_header(inst->packet, inst->packet_size,
+			       inst->session_id, core->header_id++);
+	if (rc)
+		goto exit;
+
+	/* Request sync frame if ir period enabled dynamically */
+	if (!inst->ir_enabled) {
+		inst->ir_enabled = ((ir_period > 0) ? true : false);
+		if (inst->ir_enabled && inst->bufq[OUTPUT_PORT].vb2q->streaming) {
+			sync_frame_req = HFI_SYNC_FRAME_REQUEST_WITH_PREFIX_SEQ_HDR;
+			rc = hfi_create_packet(inst->packet, inst->packet_size,
+					       HFI_PROP_REQUEST_SYNC_FRAME,
+					       HFI_HOST_FLAGS_NONE,
+					       HFI_PAYLOAD_U32_ENUM,
+					       msm_vidc_get_port_info(inst, REQUEST_I_FRAME),
+					       core->packet_id++,
+					       &sync_frame_req,
+					       sizeof(u32));
+			if (rc)
+				goto exit;
+		}
+	}
+
+	rc = hfi_create_packet(inst->packet, inst->packet_size,
+			       ir_type,
+			       HFI_HOST_FLAGS_NONE,
+			       HFI_PAYLOAD_U32,
+			       msm_vidc_get_port_info(inst, cap_id),
+			       core->packet_id++,
+			       &ir_period,
+			       sizeof(u32));
+	if (rc)
+		goto exit;
+
+	rc = __cmdq_write(inst->core, inst->packet);
+	if (rc) {
+		i_vpr_e(inst, "%s: failed to set inst->capabilities[%d] %s to fw\n",
+			__func__, cap_id, cap_name(cap_id));
+		goto exit;
+	}
+
+exit:
+	core_unlock(core, __func__);
+
+	return rc;
+}
+
+struct device_region_info *venus_hfi_get_device_region_info(
+	struct msm_vidc_core *core, enum msm_vidc_device_region region)
+{
+	struct device_region_info *dev_reg = NULL, *match = NULL;
+
+	if (!region || region >= MSM_VIDC_DEVICE_REGION_MAX) {
+		d_vpr_e("%s: invalid region %#x\n", __func__, region);
+		return NULL;
+	}
+
+	venus_hfi_for_each_device_region(core, dev_reg) {
+		if (dev_reg->region == region) {
+			match = dev_reg;
+			break;
+		}
+	}
+	if (!match)
+		d_vpr_e("%s: device region %d not found\n", __func__, region);
+
+	return match;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/venus_hfi_queue.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/venus_hfi_queue.c
@@ -0,0 +1,654 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "venus_hfi.h"
+#include "venus_hfi_queue.h"
+
+#include "msm_vidc_core.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_memory.h"
+#include "msm_vidc_platform.h"
+
+static void __set_queue_hdr_defaults(struct hfi_queue_header *q_hdr)
+{
+	q_hdr->qhdr_status = 0x1;
+	q_hdr->qhdr_type = VIDC_IFACEQ_DFLT_QHDR;
+	q_hdr->qhdr_q_size = VIDC_IFACEQ_QUEUE_SIZE / 4;
+	q_hdr->qhdr_pkt_size = 0;
+	q_hdr->qhdr_rx_wm = 0x1;
+	q_hdr->qhdr_tx_wm = 0x1;
+	q_hdr->qhdr_rx_req = 0x1;
+	q_hdr->qhdr_tx_req = 0x0;
+	q_hdr->qhdr_rx_irq_status = 0x0;
+	q_hdr->qhdr_tx_irq_status = 0x0;
+	q_hdr->qhdr_read_idx = 0x0;
+	q_hdr->qhdr_write_idx = 0x0;
+}
+
+static void __dump_packet(u8 *packet, const char *function, void *qinfo)
+{
+	u32 c = 0, session_id, packet_size = *(u32 *)packet;
+	const int row_size = 32;
+	struct msm_vidc_iface_q_info *q;
+	struct hfi_queue_header *q_hdr;
+	/*
+	 * row must contain enough for 0xdeadbaad * 8 to be converted into
+	 * "de ad ba ab " * 8 + '\0'
+	 */
+	char row[3 * 32];
+
+	session_id = *((u32 *)packet + 1);
+
+	q = (struct msm_vidc_iface_q_info *)qinfo;
+	q_hdr = (struct hfi_queue_header *)q->q_hdr;
+	d_vpr_t("%08x: %s: %pK: read_idx = %u, write_idx = %u\n",
+		session_id, function, qinfo, q_hdr->qhdr_read_idx, q_hdr->qhdr_write_idx);
+
+	for (c = 0; c * row_size < packet_size; ++c) {
+		int bytes_to_read = ((c + 1) * row_size > packet_size) ?
+			packet_size % row_size : row_size;
+		hex_dump_to_buffer(packet + c * row_size, bytes_to_read,
+				row_size, 4, row, sizeof(row), false);
+		d_vpr_t("%08x: %s\n", session_id, row);
+	}
+}
+
+static int __write_queue(struct msm_vidc_iface_q_info *qinfo, u8 *packet,
+			 bool *rx_req_is_set)
+{
+	struct hfi_queue_header *queue;
+	u32 packet_size_in_words, new_write_idx;
+	u32 empty_space, read_idx, write_idx;
+	u32 *write_ptr;
+
+	if (!qinfo || !packet) {
+		d_vpr_e("%s: invalid params %pK %pK\n",
+			__func__, qinfo, packet);
+		return -EINVAL;
+	} else if (!qinfo->q_array.align_virtual_addr) {
+		d_vpr_e("Queues have already been freed\n");
+		return -EINVAL;
+	}
+
+	queue = (struct hfi_queue_header *)qinfo->q_hdr;
+	if (!queue) {
+		d_vpr_e("queue not present\n");
+		return -ENOENT;
+	}
+
+	if (msm_vidc_debug & VIDC_PKT)
+		__dump_packet(packet, __func__, qinfo);
+
+	// TODO: handle writing packet
+	//d_vpr_e("skip writing packet\n");
+	//return 0;
+
+	packet_size_in_words = (*(u32 *)packet) >> 2;
+	if (!packet_size_in_words || packet_size_in_words >
+		qinfo->q_array.mem_size>>2) {
+		d_vpr_e("Invalid packet size\n");
+		return -ENODATA;
+	}
+
+	read_idx = queue->qhdr_read_idx;
+	write_idx = queue->qhdr_write_idx;
+
+	empty_space = (write_idx >=  read_idx) ?
+		((qinfo->q_array.mem_size>>2) - (write_idx -  read_idx)) :
+		(read_idx - write_idx);
+	if (empty_space <= packet_size_in_words) {
+		queue->qhdr_tx_req =  1;
+		d_vpr_e("Insufficient size (%d) to write (%d)\n",
+					  empty_space, packet_size_in_words);
+		return -ENOTEMPTY;
+	}
+
+	queue->qhdr_tx_req =  0;
+
+	new_write_idx = write_idx + packet_size_in_words;
+	write_ptr = (u32 *)((qinfo->q_array.align_virtual_addr) +
+			(write_idx << 2));
+	if (write_ptr < (u32 *)qinfo->q_array.align_virtual_addr ||
+	    write_ptr > (u32 *)(qinfo->q_array.align_virtual_addr +
+	    qinfo->q_array.mem_size)) {
+		d_vpr_e("Invalid write index\n");
+		return -ENODATA;
+	}
+
+	if (new_write_idx < (qinfo->q_array.mem_size >> 2)) {
+		memcpy(write_ptr, packet, packet_size_in_words << 2);
+	} else {
+		new_write_idx -= qinfo->q_array.mem_size >> 2;
+		memcpy(write_ptr, packet, (packet_size_in_words -
+			new_write_idx) << 2);
+		memcpy((void *)qinfo->q_array.align_virtual_addr,
+			packet + ((packet_size_in_words - new_write_idx) << 2),
+			new_write_idx  << 2);
+	}
+
+	/*
+	 * Memory barrier to make sure packet is written before updating the
+	 * write index
+	 */
+	mb();
+	queue->qhdr_write_idx = new_write_idx;
+	if (rx_req_is_set)
+		*rx_req_is_set = true;
+	/*
+	 * Memory barrier to make sure write index is updated before an
+	 * interrupt is raised on venus.
+	 */
+	mb();
+	return 0;
+}
+
+static int __read_queue(struct msm_vidc_iface_q_info *qinfo, u8 *packet,
+			u32 *pb_tx_req_is_set)
+{
+	struct hfi_queue_header *queue;
+	u32 packet_size_in_words, new_read_idx;
+	u32 *read_ptr;
+	u32 receive_request = 0;
+	u32 read_idx, write_idx;
+	int rc = 0;
+
+	if (!qinfo || !packet || !pb_tx_req_is_set) {
+		d_vpr_e("%s: invalid params %pK %pK %pK\n",
+			__func__, qinfo, packet, pb_tx_req_is_set);
+		return -EINVAL;
+	} else if (!qinfo->q_array.align_virtual_addr) {
+		d_vpr_e("Queues have already been freed\n");
+		return -EINVAL;
+	}
+
+	/*
+	 * Memory barrier to make sure data is valid before
+	 *reading it
+	 */
+	mb();
+	queue = (struct hfi_queue_header *)qinfo->q_hdr;
+
+	if (!queue) {
+		d_vpr_e("Queue memory is not allocated\n");
+		return -ENOMEM;
+	}
+
+	/*
+	 * Do not set receive request for debug queue, if set,
+	 * Venus generates interrupt for debug messages even
+	 * when there is no response message available.
+	 * In general debug queue will not become full as it
+	 * is being emptied out for every interrupt from Venus.
+	 * Venus will anyway generates interrupt if it is full.
+	 */
+	if (queue->qhdr_type & HFI_Q_ID_CTRL_TO_HOST_MSG_Q)
+		receive_request = 1;
+
+	read_idx = queue->qhdr_read_idx;
+	write_idx = queue->qhdr_write_idx;
+
+	if (read_idx == write_idx) {
+		queue->qhdr_rx_req = receive_request;
+		/*
+		 * mb() to ensure qhdr is updated in main memory
+		 * so that venus reads the updated header values
+		 */
+		mb();
+		*pb_tx_req_is_set = 0;
+		d_vpr_l(
+			"%s queue is empty, rx_req = %u, tx_req = %u, read_idx = %u\n",
+			receive_request ? "message" : "debug",
+			queue->qhdr_rx_req, queue->qhdr_tx_req,
+			queue->qhdr_read_idx);
+		return -ENODATA;
+	}
+
+	read_ptr = (u32 *)((qinfo->q_array.align_virtual_addr) +
+				(read_idx << 2));
+	if (read_ptr < (u32 *)qinfo->q_array.align_virtual_addr ||
+	    read_ptr > (u32 *)(qinfo->q_array.align_virtual_addr +
+	    qinfo->q_array.mem_size - sizeof(*read_ptr))) {
+		d_vpr_e("Invalid read index\n");
+		return -ENODATA;
+	}
+
+	packet_size_in_words = (*read_ptr) >> 2;
+	if (!packet_size_in_words) {
+		d_vpr_e("Zero packet size\n");
+		return -ENODATA;
+	}
+
+	new_read_idx = read_idx + packet_size_in_words;
+	if (((packet_size_in_words << 2) <= VIDC_IFACEQ_VAR_HUGE_PKT_SIZE) &&
+		read_idx <= (qinfo->q_array.mem_size >> 2)) {
+		if (new_read_idx < (qinfo->q_array.mem_size >> 2)) {
+			memcpy(packet, read_ptr,
+					packet_size_in_words << 2);
+		} else {
+			new_read_idx -= (qinfo->q_array.mem_size >> 2);
+			memcpy(packet, read_ptr,
+			(packet_size_in_words - new_read_idx) << 2);
+			memcpy(packet + ((packet_size_in_words -
+					new_read_idx) << 2),
+					(u8 *)qinfo->q_array.align_virtual_addr,
+					new_read_idx << 2);
+		}
+	} else {
+		d_vpr_e("BAD packet received, read_idx: %#x, pkt_size: %d\n",
+			read_idx, packet_size_in_words << 2);
+		d_vpr_e("Dropping this packet\n");
+		new_read_idx = write_idx;
+		rc = -ENODATA;
+	}
+
+	queue->qhdr_rx_req = receive_request;
+
+	queue->qhdr_read_idx = new_read_idx;
+	/*
+	 * mb() to ensure qhdr is updated in main memory
+	 * so that venus reads the updated header values
+	 */
+	mb();
+
+	*pb_tx_req_is_set = (queue->qhdr_tx_req == 1) ? 1 : 0;
+
+	if ((msm_vidc_debug & VIDC_PKT) &&
+		!(queue->qhdr_type & HFI_Q_ID_CTRL_TO_HOST_DEBUG_Q)) {
+		__dump_packet(packet, __func__, qinfo);
+	}
+
+	return rc;
+}
+
+/* Writes into cmdq without raising an interrupt */
+static int __iface_cmdq_write_relaxed(struct msm_vidc_core *core,
+				      void *pkt, bool *requires_interrupt)
+{
+	struct msm_vidc_iface_q_info *q_info;
+	//struct vidc_hal_cmd_pkt_hdr *cmd_packet;
+	int rc = -E2BIG;
+
+	rc = __strict_check(core, __func__);
+	if (rc)
+		return rc;
+
+	if (!core_in_valid_state(core)) {
+		d_vpr_e("%s: fw not in init state\n", __func__);
+		rc = -EINVAL;
+		goto err_q_null;
+	}
+
+	//cmd_packet = (struct vidc_hal_cmd_pkt_hdr *)pkt;
+	//core->last_packet_type = cmd_packet->packet_type;
+
+	q_info = &core->iface_queues[VIDC_IFACEQ_CMDQ_IDX];
+	if (!q_info) {
+		d_vpr_e("cannot write to shared Q's\n");
+		goto err_q_null;
+	}
+
+	if (!q_info->q_array.align_virtual_addr) {
+		d_vpr_e("cannot write to shared CMD Q's\n");
+		rc = -ENODATA;
+		goto err_q_null;
+	}
+
+	if (!__write_queue(q_info, (u8 *)pkt, requires_interrupt))
+		rc = 0;
+	else
+		d_vpr_e("queue full\n");
+
+err_q_null:
+	return rc;
+}
+
+int venus_hfi_queue_cmd_write(struct msm_vidc_core *core, void *pkt)
+{
+	bool needs_interrupt = false;
+	int rc = __iface_cmdq_write_relaxed(core, pkt, &needs_interrupt);
+
+	if (!rc && needs_interrupt)
+		call_venus_op(core, raise_interrupt, core);
+
+	return rc;
+}
+
+int venus_hfi_queue_cmd_write_intr(struct msm_vidc_core *core, void *pkt,
+				   bool allow_intr)
+{
+	bool needs_interrupt = false;
+	int rc = __iface_cmdq_write_relaxed(core, pkt, &needs_interrupt);
+
+	if (!rc && allow_intr && needs_interrupt)
+		call_venus_op(core, raise_interrupt, core);
+
+	return rc;
+}
+
+int venus_hfi_queue_msg_read(struct msm_vidc_core *core, void *pkt)
+{
+	u32 tx_req_is_set = 0;
+	int rc = 0;
+	struct msm_vidc_iface_q_info *q_info;
+
+	if (!pkt) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	if (!core_in_valid_state(core)) {
+		d_vpr_e("%s: fw not in init state\n", __func__);
+		rc = -EINVAL;
+		goto read_error_null;
+	}
+
+	q_info = &core->iface_queues[VIDC_IFACEQ_MSGQ_IDX];
+	if (!q_info->q_array.align_virtual_addr) {
+		d_vpr_e("cannot read from shared MSG Q's\n");
+		rc = -ENODATA;
+		goto read_error_null;
+	}
+
+	if (!__read_queue(q_info, (u8 *)pkt, &tx_req_is_set)) {
+		if (tx_req_is_set) {
+			//call_venus_op(core, raise_interrupt, core);
+			d_vpr_e("%s: queue is full\n", __func__);
+			rc = -EINVAL;
+			goto read_error_null;
+		}
+		rc = 0;
+	} else {
+		rc = -ENODATA;
+	}
+
+read_error_null:
+	return rc;
+}
+
+int venus_hfi_queue_dbg_read(struct msm_vidc_core *core, void *pkt)
+{
+	u32 tx_req_is_set = 0;
+	int rc = 0;
+	struct msm_vidc_iface_q_info *q_info;
+
+	if (!pkt) {
+		d_vpr_e("%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	q_info = &core->iface_queues[VIDC_IFACEQ_DBGQ_IDX];
+	if (!q_info->q_array.align_virtual_addr) {
+		d_vpr_e("cannot read from shared DBG Q's\n");
+		rc = -ENODATA;
+		goto dbg_error_null;
+	}
+
+	if (!__read_queue(q_info, (u8 *)pkt, &tx_req_is_set)) {
+		if (tx_req_is_set) {
+			d_vpr_e("%s: queue is full\n", __func__);
+			//call_venus_op(core, raise_interrupt, core);
+			rc = -EINVAL;
+			goto dbg_error_null;
+		}
+		rc = 0;
+	} else {
+		rc = -ENODATA;
+	}
+
+dbg_error_null:
+	return rc;
+}
+
+void venus_hfi_queue_deinit(struct msm_vidc_core *core)
+{
+	int i;
+
+	d_vpr_h("%s: deinitializing interface queue\n", __func__);
+
+	if (!core->iface_q_table.align_virtual_addr) {
+		d_vpr_h("%s: queues already deallocated\n", __func__);
+		return;
+	}
+
+	call_mem_op(core, memory_unmap_free, core, &core->iface_q_table.mem);
+	call_mem_op(core, memory_unmap_free, core, &core->sfr.mem);
+#if 0
+	call_mem_op(core, iommu_unmap, core, &core->aon_reg.mem);
+	call_mem_op(core, iommu_unmap, core, &core->fence_reg.mem);
+	call_mem_op(core, iommu_unmap, core, &core->qtimer_reg.mem);
+#endif
+	call_mem_op(core, memory_unmap_free, core, &core->mmap_buf.mem);
+	call_mem_op(core, mem_dma_unmap_page, core,
+		&core->synx_fence_data.queue);
+
+	for (i = 0; i < VIDC_IFACEQ_NUMQ; i++) {
+		core->iface_queues[i].q_hdr = NULL;
+		core->iface_queues[i].q_array.align_virtual_addr = NULL;
+		core->iface_queues[i].q_array.align_device_addr = 0;
+	}
+
+	core->iface_q_table.align_virtual_addr = NULL;
+	core->iface_q_table.align_device_addr = 0;
+
+	core->sfr.align_virtual_addr = NULL;
+	core->sfr.align_device_addr = 0;
+
+	core->aon_reg.align_virtual_addr = NULL;
+	core->aon_reg.align_device_addr = 0;
+
+	core->fence_reg.align_virtual_addr = NULL;
+	core->fence_reg.align_device_addr = 0;
+
+	core->qtimer_reg.align_virtual_addr = NULL;
+	core->qtimer_reg.align_device_addr = 0;
+
+	core->mmap_buf.align_virtual_addr = NULL;
+	core->mmap_buf.align_device_addr = 0;
+}
+
+int venus_hfi_reset_queue_header(struct msm_vidc_core *core)
+{
+	struct msm_vidc_iface_q_info *iface_q;
+	struct hfi_queue_header *q_hdr;
+	int i, rc = 0;
+
+	for (i = 0; i < VIDC_IFACEQ_NUMQ; i++) {
+		iface_q = &core->iface_queues[i];
+		__set_queue_hdr_defaults(iface_q->q_hdr);
+	}
+
+	iface_q = &core->iface_queues[VIDC_IFACEQ_CMDQ_IDX];
+	q_hdr = iface_q->q_hdr;
+	q_hdr->qhdr_start_addr = iface_q->q_array.align_device_addr;
+	q_hdr->qhdr_type |= HFI_Q_ID_HOST_TO_CTRL_CMD_Q;
+
+	iface_q = &core->iface_queues[VIDC_IFACEQ_MSGQ_IDX];
+	q_hdr = iface_q->q_hdr;
+	q_hdr->qhdr_start_addr = iface_q->q_array.align_device_addr;
+	q_hdr->qhdr_type |= HFI_Q_ID_CTRL_TO_HOST_MSG_Q;
+
+	iface_q = &core->iface_queues[VIDC_IFACEQ_DBGQ_IDX];
+	q_hdr = iface_q->q_hdr;
+	q_hdr->qhdr_start_addr = iface_q->q_array.align_device_addr;
+	q_hdr->qhdr_type |= HFI_Q_ID_CTRL_TO_HOST_DEBUG_Q;
+	/*
+	 * Set receive request to zero on debug queue as there is no
+	 * need of interrupt from video hardware for debug messages
+	 */
+	q_hdr->qhdr_rx_req = 0;
+	return rc;
+}
+
+int venus_hfi_queue_init(struct msm_vidc_core *core)
+{
+	int rc = 0;
+	struct hfi_queue_table_header *q_tbl_hdr;
+	struct hfi_queue_header *q_hdr;
+	struct msm_vidc_iface_q_info *iface_q;
+	struct msm_vidc_mem mem;
+	int offset = 0;
+	u32 *payload;
+	u32 i;
+
+	d_vpr_h("%s: initializing interface queue\n", __func__);
+
+	if (core->iface_q_table.align_virtual_addr) {
+		d_vpr_h("%s: queues already allocated\n", __func__);
+		venus_hfi_reset_queue_header(core);
+		return 0;
+	}
+
+	memset(&mem, 0, sizeof(mem));
+	mem.type = MSM_VIDC_BUF_INTERFACE_QUEUE;
+	mem.region = MSM_VIDC_NON_SECURE;
+	mem.size = TOTAL_QSIZE;
+	mem.secure = false;
+	mem.map_kernel = true;
+	rc = call_mem_op(core, memory_alloc_map, core, &mem);
+	if (rc) {
+		d_vpr_e("%s: alloc and map failed\n", __func__);
+		goto fail_alloc_queue;
+	}
+	core->iface_q_table.align_virtual_addr = mem.kvaddr;
+	core->iface_q_table.align_device_addr = mem.device_addr;
+	core->iface_q_table.mem = mem;
+
+	core->iface_q_table.mem_size = VIDC_IFACEQ_TABLE_SIZE;
+	offset += core->iface_q_table.mem_size;
+
+	for (i = 0; i < VIDC_IFACEQ_NUMQ; i++) {
+		iface_q = &core->iface_queues[i];
+		iface_q->q_array.align_device_addr = mem.device_addr + offset;
+		iface_q->q_array.align_virtual_addr = (void *)((char *)mem.kvaddr + offset);
+		iface_q->q_array.mem_size = VIDC_IFACEQ_QUEUE_SIZE;
+		offset += iface_q->q_array.mem_size;
+		iface_q->q_hdr = VIDC_IFACEQ_GET_QHDR_START_ADDR(
+				core->iface_q_table.align_virtual_addr, i);
+		__set_queue_hdr_defaults(iface_q->q_hdr);
+	}
+
+	q_tbl_hdr = (struct hfi_queue_table_header *)
+			core->iface_q_table.align_virtual_addr;
+	q_tbl_hdr->qtbl_version = 0;
+	q_tbl_hdr->device_addr = (void *)core;
+	strscpy(q_tbl_hdr->name, "msm_v4l2_vidc", sizeof(q_tbl_hdr->name));
+	q_tbl_hdr->qtbl_size = VIDC_IFACEQ_TABLE_SIZE;
+	q_tbl_hdr->qtbl_qhdr0_offset = sizeof(struct hfi_queue_table_header);
+	q_tbl_hdr->qtbl_qhdr_size = sizeof(struct hfi_queue_header);
+	q_tbl_hdr->qtbl_num_q = VIDC_IFACEQ_NUMQ;
+	q_tbl_hdr->qtbl_num_active_q = VIDC_IFACEQ_NUMQ;
+
+	iface_q = &core->iface_queues[VIDC_IFACEQ_CMDQ_IDX];
+	q_hdr = iface_q->q_hdr;
+	q_hdr->qhdr_start_addr = iface_q->q_array.align_device_addr;
+	q_hdr->qhdr_type |= HFI_Q_ID_HOST_TO_CTRL_CMD_Q;
+
+	iface_q = &core->iface_queues[VIDC_IFACEQ_MSGQ_IDX];
+	q_hdr = iface_q->q_hdr;
+	q_hdr->qhdr_start_addr = iface_q->q_array.align_device_addr;
+	q_hdr->qhdr_type |= HFI_Q_ID_CTRL_TO_HOST_MSG_Q;
+
+	iface_q = &core->iface_queues[VIDC_IFACEQ_DBGQ_IDX];
+	q_hdr = iface_q->q_hdr;
+	q_hdr->qhdr_start_addr = iface_q->q_array.align_device_addr;
+	q_hdr->qhdr_type |= HFI_Q_ID_CTRL_TO_HOST_DEBUG_Q;
+	/*
+	 * Set receive request to zero on debug queue as there is no
+	 * need of interrupt from video hardware for debug messages
+	 */
+	q_hdr->qhdr_rx_req = 0;
+
+	/* sfr buffer */
+	memset(&mem, 0, sizeof(mem));
+	mem.type = MSM_VIDC_BUF_INTERFACE_QUEUE;
+	mem.region = MSM_VIDC_NON_SECURE;
+	mem.size = ALIGNED_SFR_SIZE;
+	mem.secure = false;
+	mem.map_kernel = true;
+	rc = call_mem_op(core, memory_alloc_map, core, &mem);
+	if (rc) {
+		d_vpr_e("%s: sfr alloc and map failed\n", __func__);
+		goto fail_alloc_queue;
+	}
+	core->sfr.align_virtual_addr = mem.kvaddr;
+	core->sfr.align_device_addr = mem.device_addr;
+	core->sfr.mem = mem;
+
+	core->sfr.mem_size = ALIGNED_SFR_SIZE;
+	/* write sfr buffer size in first word */
+	*((u32 *)core->sfr.align_virtual_addr) = core->sfr.mem_size;
+
+	/* map synx fence tx/rx queue buffer */
+	if (core->capabilities[SUPPORTS_SYNX_FENCE].value) {
+		/*
+		 * queue memory is already allocated by synx fence
+		 * driver during msm_vidc_synx_fence_register(..) call
+		 */
+		rc = call_mem_op(core, mem_dma_map_page, core,
+			&core->synx_fence_data.queue);
+		if (rc) {
+			d_vpr_e("%s: synx fence queue buffer map failed\n", __func__);
+			goto fail_alloc_queue;
+		}
+	}
+
+	/* allocate 4k buffer for HFI_MMAP_ADDR */
+	memset(&mem, 0, sizeof(mem));
+	mem.type = MSM_VIDC_BUF_INTERFACE_QUEUE;
+	mem.region = MSM_VIDC_NON_SECURE;
+	mem.size = ALIGNED_MMAP_BUF_SIZE;
+	mem.secure = false;
+	mem.map_kernel = true;
+	rc = call_mem_op(core, memory_alloc_map, core, &mem);
+	if (rc) {
+		d_vpr_e("%s: mmap buffer alloc and map failed\n", __func__);
+		goto fail_alloc_queue;
+	}
+	core->mmap_buf.align_virtual_addr = mem.kvaddr;
+	core->mmap_buf.align_device_addr = mem.device_addr;
+	core->mmap_buf.mem_size = ALIGNED_MMAP_BUF_SIZE;
+	core->mmap_buf.mem = mem;
+	/* initialize mmap buffer */
+	/* payload of HFI_MMAP_ADDR:
+	 *     payload[0]     : version
+	 *     ___________________ payloads in version 1 ________________
+	 *     payload[1-2]   : address and size of SFR
+	 *     payload[3-4]   : address and size of IPCC lite memory
+	 *     payload[5-6]   : address and size of AOSS global timers
+	 *     payload[7-8]   : address and size of HW mutex registers
+	 *     payload[9-10]  : address and size of IPCC registers
+	 *     payload[11-12] : address and size of AON registers
+	 *     payload[13-14] : address and size of synx fence queue memory
+	 *     payload[19-20] : address and size of IPC_PROTOCOL4_CLIENT_VERSION registers
+	 *     payload[21-22] : address and size of FENCE QTIMER registers
+	 */
+	memset(core->mmap_buf.align_virtual_addr, 0, ALIGNED_MMAP_BUF_SIZE);
+	payload = ((u32 *)core->mmap_buf.align_virtual_addr);
+	payload[0] = 1;
+#if 0
+	if (core->aon_reg.mem.device_addr) {
+		payload[11] = core->aon_reg.mem.device_addr;
+		payload[12] = core->aon_reg.mem.size;
+	}
+	if (core->synx_fence_data.queue.device_addr) {
+		payload[13] = core->synx_fence_data.queue.device_addr;
+		payload[14] = core->synx_fence_data.queue.size;
+	}
+	if (core->fence_reg.mem.device_addr) {
+		payload[19] = core->fence_reg.mem.device_addr;
+		payload[20] = core->fence_reg.mem.size;
+	}
+#endif
+	if (core->qtimer_reg.mem.device_addr) {
+		payload[21] = core->qtimer_reg.mem.device_addr;
+		payload[22] = core->qtimer_reg.mem.size;
+	}
+
+	return 0;
+
+fail_alloc_queue:
+	return -ENOMEM;
+}
--- linux-qcom-6.8.0.orig/ubuntu/qcom/video/vidc/src/venus_hfi_response.c
+++ linux-qcom-6.8.0/ubuntu/qcom/video/vidc/src/venus_hfi_response.c
@@ -0,0 +1,2034 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <linux/of_address.h>
+
+#include "hfi_packet.h"
+#include "venus_hfi.h"
+#include "venus_hfi_response.h"
+#include "msm_vidc_debug.h"
+#include "msm_vidc_driver.h"
+#include "msm_vdec.h"
+#include "msm_vidc_memory.h"
+#include "msm_vidc_fence.h"
+#include "msm_vidc_platform.h"
+
+#define check_in_range(range, val) (((range.begin) < (val)) && ((range.end) > (val)))
+
+extern struct msm_vidc_core *g_core;
+struct msm_vidc_core_hfi_range {
+	u32 begin;
+	u32 end;
+	int (*handle)(struct msm_vidc_core *core, struct hfi_packet *pkt);
+};
+
+struct msm_vidc_inst_hfi_range {
+	u32 begin;
+	u32 end;
+	int (*handle)(struct msm_vidc_inst *inst, struct hfi_packet *pkt);
+};
+
+struct msm_vidc_hfi_buffer_handle {
+	enum hfi_buffer_type type;
+	int (*handle)(struct msm_vidc_inst *inst, struct hfi_buffer *buffer);
+};
+
+struct msm_vidc_hfi_packet_handle {
+	enum hfi_buffer_type type;
+	int (*handle)(struct msm_vidc_inst *inst, struct hfi_packet *pkt);
+};
+
+static void print_psc_properties(const char *str, struct msm_vidc_inst *inst,
+	struct msm_vidc_subscription_params subsc_params)
+{
+	i_vpr_h(inst,
+		"%s: width %d, height %d, crop offsets[0] %#x, crop offsets[1] %#x, bit depth %#x, coded frames %d fw min count %d, poc %d, color info %d, profile %d, level %d, tier %d, fg present %d, sb enabled %d, max_num_reorder_frames %d, max_dec_frame_buffering_count %d\n",
+		str, (subsc_params.bitstream_resolution & HFI_BITMASK_BITSTREAM_WIDTH) >> 16,
+		(subsc_params.bitstream_resolution & HFI_BITMASK_BITSTREAM_HEIGHT),
+		subsc_params.crop_offsets[0], subsc_params.crop_offsets[1],
+		subsc_params.bit_depth, subsc_params.coded_frames,
+		subsc_params.fw_min_count, subsc_params.pic_order_cnt,
+		subsc_params.color_info, subsc_params.profile, subsc_params.level,
+		subsc_params.tier, subsc_params.av1_film_grain_present,
+		subsc_params.av1_super_block_enabled,
+		(subsc_params.max_num_reorder_frames >> 16),
+		(subsc_params.max_num_reorder_frames & 0x00FF));
+}
+
+static void print_sfr_message(struct msm_vidc_core *core)
+{
+	struct msm_vidc_sfr *vsfr = NULL;
+	u32 vsfr_size = 0;
+	void *p = NULL;
+
+	vsfr = (struct msm_vidc_sfr *)core->sfr.align_virtual_addr;
+	if (vsfr) {
+		if (vsfr->buf_size != core->sfr.mem_size) {
+			d_vpr_e("Invalid SFR buf size %d actual %d\n",
+				vsfr->buf_size, core->sfr.mem_size);
+			return;
+		}
+		vsfr_size = core->sfr.mem_size - sizeof(u32);
+		p = memchr(vsfr->rg_data, '\0', vsfr_size);
+		/* SFR isn't guaranteed to be NULL terminated */
+		if (p == NULL)
+			vsfr->rg_data[vsfr_size - 1] = '\0';
+
+		d_vpr_e(FMT_STRING_MSG_SFR, vsfr->rg_data);
+	}
+}
+
+static u32 vidc_port_from_hfi(struct msm_vidc_inst *inst,
+	enum hfi_packet_port_type hfi_port)
+{
+	enum msm_vidc_port_type port = MAX_PORT;
+
+	if (is_decode_session(inst)) {
+		switch (hfi_port) {
+		case HFI_PORT_BITSTREAM:
+			port = INPUT_PORT;
+			break;
+		case HFI_PORT_RAW:
+			port = OUTPUT_PORT;
+			break;
+		case HFI_PORT_NONE:
+			port = PORT_NONE;
+			break;
+		default:
+			i_vpr_e(inst, "%s: invalid hfi port type %d\n",
+				__func__, hfi_port);
+			break;
+		}
+	} else if (is_encode_session(inst)) {
+		switch (hfi_port) {
+		case HFI_PORT_RAW:
+			port = INPUT_PORT;
+			break;
+		case HFI_PORT_BITSTREAM:
+			port = OUTPUT_PORT;
+			break;
+		case HFI_PORT_NONE:
+			port = PORT_NONE;
+			break;
+		default:
+			i_vpr_e(inst, "%s: invalid hfi port type %d\n",
+				__func__, hfi_port);
+			break;
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid domain %#x\n",
+			__func__, inst->domain);
+	}
+
+	return port;
+}
+
+static bool is_valid_hfi_port(struct msm_vidc_inst *inst, u32 port,
+	u32 buffer_type, const char *func)
+{
+	if (port == HFI_PORT_NONE &&
+		buffer_type != HFI_BUFFER_ARP &&
+		buffer_type != HFI_BUFFER_PERSIST)
+		goto invalid;
+
+	if (port != HFI_PORT_BITSTREAM && port != HFI_PORT_RAW)
+		goto invalid;
+
+	return true;
+
+invalid:
+	i_vpr_e(inst, "%s: invalid port %#x buffer_type %u\n",
+			func, port, buffer_type);
+	return false;
+}
+
+bool is_valid_hfi_buffer_type(struct msm_vidc_inst *inst,
+	u32 buffer_type, const char *func)
+{
+	if (buffer_type != HFI_BUFFER_BITSTREAM &&
+	    buffer_type != HFI_BUFFER_RAW &&
+	    buffer_type != HFI_BUFFER_METADATA &&
+	    buffer_type != HFI_BUFFER_BIN &&
+	    buffer_type != HFI_BUFFER_ARP &&
+	    buffer_type != HFI_BUFFER_COMV &&
+	    buffer_type != HFI_BUFFER_NON_COMV &&
+	    buffer_type != HFI_BUFFER_LINE &&
+	    buffer_type != HFI_BUFFER_DPB &&
+	    buffer_type != HFI_BUFFER_PERSIST &&
+	    buffer_type != HFI_BUFFER_VPSS &&
+	    buffer_type != HFI_BUFFER_PARTIAL_DATA) {
+		i_vpr_e(inst, "%s: invalid buffer type %#x\n",
+			func, buffer_type);
+		return false;
+	}
+	return true;
+}
+
+int validate_packet(u8 *response_pkt, u8 *core_resp_pkt,
+	u32 core_resp_pkt_size, const char *func)
+{
+	u8 *response_limit;
+	u32 response_pkt_size = 0;
+
+	if (!response_pkt || !core_resp_pkt || !core_resp_pkt_size) {
+		d_vpr_e("%s: invalid params\n", func);
+		return -EINVAL;
+	}
+
+	response_limit = core_resp_pkt + core_resp_pkt_size;
+
+	if (response_pkt < core_resp_pkt || response_pkt > response_limit) {
+		d_vpr_e("%s: invalid packet address\n", func);
+		return -EINVAL;
+	}
+
+	response_pkt_size = *(u32 *)response_pkt;
+	if (!response_pkt_size) {
+		d_vpr_e("%s: response packet size cannot be zero\n", func);
+		return -EINVAL;
+	}
+
+	if (response_pkt_size < sizeof(struct hfi_packet)) {
+		d_vpr_e("%s: invalid packet size %d\n",
+			func, response_pkt_size);
+		return -EINVAL;
+	}
+
+	if (response_pkt + response_pkt_size > response_limit) {
+		d_vpr_e("%s: invalid packet size %d\n",
+			func, response_pkt_size);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int validate_hdr_packet(struct msm_vidc_core *core,
+	struct hfi_header *hdr, const char *function)
+{
+	struct hfi_packet *packet;
+	u8 *pkt;
+	int i, rc = 0;
+
+	if (hdr->size < sizeof(struct hfi_header) + sizeof(struct hfi_packet)) {
+		d_vpr_e("%s: invalid header size %d\n", __func__, hdr->size);
+		return -EINVAL;
+	}
+
+	pkt = (u8 *)((u8 *)hdr + sizeof(struct hfi_header));
+
+	/* validate all packets */
+	for (i = 0; i < hdr->num_packets; i++) {
+		packet = (struct hfi_packet *)pkt;
+		rc = validate_packet(pkt, core->response_packet, core->packet_size, function);
+		if (rc)
+			return rc;
+
+		pkt += packet->size;
+	}
+
+	return 0;
+}
+
+static bool check_for_packet_payload(struct msm_vidc_inst *inst,
+	struct hfi_packet *pkt, const char *func)
+{
+	u32 payload_size = 0;
+
+	if (pkt->payload_info == HFI_PAYLOAD_NONE) {
+		i_vpr_h(inst, "%s: no playload available for packet %#x\n",
+			func, pkt->type);
+		return false;
+	}
+
+	switch (pkt->payload_info) {
+	case HFI_PAYLOAD_U32:
+	case HFI_PAYLOAD_S32:
+	case HFI_PAYLOAD_Q16:
+	case HFI_PAYLOAD_U32_ENUM:
+	case HFI_PAYLOAD_32_PACKED:
+		payload_size = 4;
+		break;
+	case HFI_PAYLOAD_U64:
+	case HFI_PAYLOAD_S64:
+	case HFI_PAYLOAD_64_PACKED:
+		payload_size = 8;
+		break;
+	case HFI_PAYLOAD_STRUCTURE:
+		if (pkt->type == HFI_CMD_BUFFER)
+			payload_size = sizeof(struct hfi_buffer);
+		break;
+	default:
+		payload_size = 0;
+		break;
+	}
+
+	if (pkt->size < sizeof(struct hfi_packet) + payload_size) {
+		i_vpr_e(inst,
+			"%s: invalid payload size %u payload type %#x for packet %#x\n",
+			func, pkt->size, pkt->payload_info, pkt->type);
+		return false;
+	}
+
+	return true;
+}
+
+static int handle_session_last_flag_info(struct msm_vidc_inst *inst,
+		struct hfi_packet *pkt)
+{
+	int rc = 0;
+
+	if (pkt->type == HFI_INFO_HFI_FLAG_PSC_LAST) {
+		if (msm_vidc_allow_psc_last_flag(inst))
+			rc = msm_vidc_process_psc_last_flag(inst);
+		else
+			rc = -EINVAL;
+	} else if (pkt->type == HFI_INFO_HFI_FLAG_DRAIN_LAST) {
+		if (msm_vidc_allow_drain_last_flag(inst))
+			rc = msm_vidc_process_drain_last_flag(inst);
+		else
+			rc = -EINVAL;
+	} else {
+		i_vpr_e(inst, "%s: invalid packet type %#x\n", __func__,
+			pkt->type);
+	}
+
+	if (rc)
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+
+	return rc;
+}
+
+static int handle_session_info(struct msm_vidc_inst *inst,
+	struct hfi_packet *pkt)
+{
+	int rc = 0;
+	char *info;
+
+	switch (pkt->type) {
+	case HFI_INFO_UNSUPPORTED:
+		info = "unsupported";
+		break;
+	case HFI_INFO_DATA_CORRUPT:
+		info = "data corrupt";
+		inst->hfi_frame_info.data_corrupt = 1;
+		break;
+	case HFI_INFO_BUFFER_OVERFLOW:
+		info = "buffer overflow";
+		inst->hfi_frame_info.overflow = 1;
+		break;
+	case HFI_INFO_FENCE_SIGNAL_ERROR:
+		info = "synx v2 fence error";
+		inst->hfi_frame_info.fence_error = 1;
+		break;
+	case HFI_INFO_HFI_FLAG_DRAIN_LAST:
+		info = "drain last flag";
+		rc = handle_session_last_flag_info(inst, pkt);
+		break;
+	case HFI_INFO_HFI_FLAG_PSC_LAST:
+		info = "drc last flag";
+		rc = handle_session_last_flag_info(inst, pkt);
+		break;
+	default:
+		info = "unknown";
+		break;
+	}
+
+	i_vpr_h(inst, "session info (%#x): %s\n", pkt->type, info);
+
+	return rc;
+}
+
+static int handle_session_error(struct msm_vidc_inst *inst,
+	struct hfi_packet *pkt)
+{
+	int rc = 0;
+	char *error;
+
+	switch (pkt->type) {
+	case HFI_ERROR_MAX_SESSIONS:
+		error = "exceeded max sessions";
+		break;
+	case HFI_ERROR_UNKNOWN_SESSION:
+		error = "unknown session id";
+		break;
+	case HFI_ERROR_INVALID_STATE:
+		error = "invalid operation for current state";
+		break;
+	case HFI_ERROR_INSUFFICIENT_RESOURCES:
+		error = "insufficient resources";
+		break;
+	case HFI_ERROR_BUFFER_NOT_SET:
+		error = "internal buffers not set";
+		break;
+	case HFI_ERROR_FATAL:
+		error = "fatal error";
+		break;
+	default:
+		error = "unknown";
+		break;
+	}
+
+	i_vpr_e(inst, "%s: session error received %#x: %s\n",
+		__func__, pkt->type, error);
+
+	rc = msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+	return rc;
+}
+
+int handle_system_error(struct msm_vidc_core *core,
+	struct hfi_packet *pkt)
+{
+	bool bug_on = false;
+
+	d_vpr_e("%s: system error received\n", __func__);
+	print_sfr_message(core);
+
+	if (pkt) {
+		/* enable force bugon for requested type */
+		if (pkt->type == HFI_SYS_ERROR_FATAL) {
+			bug_on = !!(msm_vidc_enable_bugon & MSM_VIDC_BUG_ON_FATAL);
+		} else if (pkt->type == HFI_SYS_ERROR_NOC) {
+			bug_on = !!(msm_vidc_enable_bugon & MSM_VIDC_BUG_ON_NOC);
+			venus_hfi_noc_error_info(core);
+		} else if (pkt->type == HFI_SYS_ERROR_WD_TIMEOUT) {
+			bug_on = !!(msm_vidc_enable_bugon & MSM_VIDC_BUG_ON_WD_TIMEOUT);
+		}
+		if (bug_on) {
+			d_vpr_e("%s: force bugon for type %#x\n", __func__, pkt->type);
+			MSM_VIDC_FATAL(true);
+		}
+	}
+
+	msm_vidc_core_deinit(core, true);
+
+	return 0;
+}
+
+static int handle_system_init(struct msm_vidc_core *core,
+	struct hfi_packet *pkt)
+{
+	if (!(pkt->flags & HFI_FW_FLAGS_SUCCESS)) {
+		d_vpr_h("%s: unhandled. flags=%d\n", __func__, pkt->flags);
+		return 0;
+	}
+
+	core_lock(core, __func__);
+	if (pkt->packet_id != core->sys_init_id) {
+		d_vpr_e("%s: invalid pkt id %u, expected %u\n", __func__,
+			pkt->packet_id, core->sys_init_id);
+		goto unlock;
+	}
+
+	msm_vidc_change_core_state(core, MSM_VIDC_CORE_INIT, __func__);
+	d_vpr_h("%s: successful\n", __func__);
+
+unlock:
+	core_unlock(core, __func__);
+	return 0;
+}
+
+static int handle_session_open(struct msm_vidc_inst *inst,
+	struct hfi_packet *pkt)
+{
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful\n", __func__);
+
+	return 0;
+}
+
+static int handle_session_close(struct msm_vidc_inst *inst,
+	struct hfi_packet *pkt)
+{
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful\n", __func__);
+
+	signal_session_msg_receipt(inst, SIGNAL_CMD_CLOSE);
+	return 0;
+}
+
+static int handle_session_start(struct msm_vidc_inst *inst,
+	struct hfi_packet *pkt)
+{
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful for port %d\n",
+			__func__, pkt->port);
+	return 0;
+}
+
+static int handle_session_stop(struct msm_vidc_inst *inst,
+	struct hfi_packet *pkt)
+{
+	int rc = 0;
+	enum signal_session_response signal_type = -1;
+
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful for port %d\n",
+			__func__, pkt->port);
+
+	if (is_encode_session(inst)) {
+		if (pkt->port == HFI_PORT_RAW) {
+			signal_type = SIGNAL_CMD_STOP_INPUT;
+		} else if (pkt->port == HFI_PORT_BITSTREAM) {
+			signal_type = SIGNAL_CMD_STOP_OUTPUT;
+		} else {
+			i_vpr_e(inst, "%s: invalid port: %d\n",
+				__func__, pkt->port);
+			return -EINVAL;
+		}
+	} else if (is_decode_session(inst)) {
+		if (pkt->port == HFI_PORT_RAW) {
+			signal_type = SIGNAL_CMD_STOP_OUTPUT;
+		} else if (pkt->port == HFI_PORT_BITSTREAM) {
+			signal_type = SIGNAL_CMD_STOP_INPUT;
+		} else {
+			i_vpr_e(inst, "%s: invalid port: %d\n",
+				__func__, pkt->port);
+			return -EINVAL;
+		}
+	} else {
+		i_vpr_e(inst, "%s: invalid session\n", __func__);
+		return -EINVAL;
+	}
+
+	if (signal_type != -1) {
+		rc = msm_vidc_process_stop_done(inst, signal_type);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+static int handle_session_drain(struct msm_vidc_inst *inst,
+				struct hfi_packet *pkt)
+{
+	int rc = 0;
+
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful\n", __func__);
+
+	rc = msm_vidc_process_drain_done(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int get_driver_buffer_flags(struct msm_vidc_inst *inst, u32 hfi_flags)
+{
+	u32 driver_flags = 0;
+
+	if (inst->hfi_frame_info.picture_type & HFI_PICTURE_IDR)
+		driver_flags |= MSM_VIDC_BUF_FLAG_KEYFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_P)
+		driver_flags |= MSM_VIDC_BUF_FLAG_PFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_B)
+		driver_flags |= MSM_VIDC_BUF_FLAG_BFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_I)
+		driver_flags |= MSM_VIDC_BUF_FLAG_KEYFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_CRA)
+		driver_flags |= MSM_VIDC_BUF_FLAG_KEYFRAME;
+	else if (inst->hfi_frame_info.picture_type & HFI_PICTURE_BLA)
+		driver_flags |= MSM_VIDC_BUF_FLAG_KEYFRAME;
+
+	if (inst->hfi_frame_info.data_corrupt)
+		driver_flags |= MSM_VIDC_BUF_FLAG_ERROR;
+
+	if (inst->hfi_frame_info.overflow)
+		driver_flags |= MSM_VIDC_BUF_FLAG_ERROR;
+
+	if (inst->hfi_frame_info.no_output) {
+		if (inst->capabilities[META_BUF_TAG].value &&
+			!(hfi_flags & HFI_BUF_FW_FLAG_CODEC_CONFIG))
+			driver_flags |= MSM_VIDC_BUF_FLAG_ERROR;
+	}
+
+	if (inst->hfi_frame_info.subframe_input)
+		if (inst->capabilities[META_BUF_TAG].value)
+			driver_flags |= MSM_VIDC_BUF_FLAG_ERROR;
+
+	if (hfi_flags & HFI_BUF_FW_FLAG_CODEC_CONFIG)
+		driver_flags |= MSM_VIDC_BUF_FLAG_CODECCONFIG;
+
+	if (hfi_flags & HFI_BUF_FW_FLAG_LAST ||
+	    hfi_flags & HFI_BUF_FW_FLAG_PSC_LAST)
+		driver_flags |= MSM_VIDC_BUF_FLAG_LAST;
+
+	/*
+	 * if last flag event is enabled then remove BUF_FLAG_LAST
+	 * because last flag information will be sent via V4L2_EVENT_EOS
+	 */
+	if (inst->capabilities[LAST_FLAG_EVENT_ENABLE].value)
+		driver_flags &= ~MSM_VIDC_BUF_FLAG_LAST;
+
+	return driver_flags;
+}
+
+static int handle_read_only_buffer(struct msm_vidc_inst *inst,
+				   struct msm_vidc_buffer *buf)
+{
+	struct msm_vidc_buffer *ro_buf;
+	struct msm_vidc_core *core;
+	bool found = false;
+
+	core = inst->core;
+
+	if (!is_decode_session(inst) || !is_output_buffer(buf->type))
+		return 0;
+
+	if (!(buf->attr & MSM_VIDC_ATTR_READ_ONLY))
+		return 0;
+
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		if (ro_buf->device_addr == buf->device_addr) {
+			found = true;
+			break;
+		}
+	}
+	/*
+	 * RO flag: add to read_only list if buffer is not present
+	 *          if present, do nothing
+	 */
+	if (!found) {
+		ro_buf = msm_vidc_pool_alloc(inst, MSM_MEM_POOL_BUFFER);
+		if (!ro_buf) {
+			i_vpr_e(inst, "%s: buffer alloc failed\n", __func__);
+			return -ENOMEM;
+		}
+		ro_buf->index = -1;
+		ro_buf->inst = inst;
+		ro_buf->type = buf->type;
+		ro_buf->fd = buf->fd;
+		ro_buf->dmabuf = buf->dmabuf;
+		ro_buf->device_addr = buf->device_addr;
+		ro_buf->kvaddr = buf->kvaddr;
+		ro_buf->handler = buf->handler;
+		ro_buf->refcount = buf->refcount;
+		ro_buf->data_offset = buf->data_offset;
+		ro_buf->dbuf_get = buf->dbuf_get;
+		buf->dbuf_get = 0;
+		INIT_LIST_HEAD(&ro_buf->list);
+		list_add_tail(&ro_buf->list, &inst->buffers.read_only.list);
+		print_vidc_buffer(VIDC_LOW, "low ", "ro buf added", inst, ro_buf);
+	} else {
+		print_vidc_buffer(VIDC_LOW, "low ", "ro buf found", inst, ro_buf);
+	}
+	ro_buf->attr |= MSM_VIDC_ATTR_READ_ONLY;
+
+	return 0;
+}
+
+static int handle_non_read_only_buffer(struct msm_vidc_inst *inst,
+				       struct hfi_buffer *buffer)
+{
+	struct msm_vidc_buffer *ro_buf;
+
+	if (!is_decode_session(inst) || buffer->type != HFI_BUFFER_RAW)
+		return 0;
+
+	if (buffer->flags & HFI_BUF_FW_FLAG_READONLY)
+		return 0;
+
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		if (ro_buf->device_addr == buffer->base_address) {
+			ro_buf->attr &= ~MSM_VIDC_ATTR_READ_ONLY;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int handle_psc_last_flag_buffer(struct msm_vidc_inst *inst,
+				       struct hfi_buffer *buffer)
+{
+	int rc = 0;
+
+	if (!(buffer->flags & HFI_BUF_FW_FLAG_PSC_LAST))
+		return 0;
+
+	if (!msm_vidc_allow_psc_last_flag(inst))
+		return -EINVAL;
+
+	rc = msm_vidc_process_psc_last_flag(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int handle_drain_last_flag_buffer(struct msm_vidc_inst *inst,
+					 struct hfi_buffer *buffer)
+{
+	int rc = 0;
+
+	if (!(buffer->flags & HFI_BUF_FW_FLAG_LAST))
+		return 0;
+
+	if (!msm_vidc_allow_drain_last_flag(inst))
+		return -EINVAL;
+
+	rc = msm_vidc_process_drain_last_flag(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int handle_input_buffer(struct msm_vidc_inst *inst,
+			       struct hfi_buffer *buffer)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf;
+	struct msm_vidc_core *core;
+	u32 frame_size, batch_size;
+	bool found;
+
+	core = inst->core;
+	buffers = msm_vidc_get_buffers(inst, MSM_VIDC_BUF_INPUT, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	found = false;
+	list_for_each_entry(buf, &buffers->list, list) {
+		if (buf->index == buffer->index) {
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		i_vpr_e(inst, "%s: invalid buffer idx %d addr %#llx data_offset %d\n",
+			__func__, buffer->index, buffer->base_address,
+			buffer->data_offset);
+		return -EINVAL;
+	}
+
+	/* attach dequeued flag for, only last frame in the batch */
+	if (msm_vidc_is_super_buffer(inst)) {
+		frame_size = call_session_op(core, buffer_size, inst, MSM_VIDC_BUF_INPUT);
+		batch_size = inst->capabilities[SUPER_FRAME].value;
+		if (!frame_size || !batch_size) {
+			i_vpr_e(inst, "%s: invalid size: frame %u, batch %u\n",
+				__func__, frame_size, batch_size);
+			return -EINVAL;
+		}
+		if (buffer->addr_offset / frame_size < batch_size - 1) {
+			i_vpr_l(inst, "%s: superframe last buffer not reached: %u, %u, %u\n",
+				__func__, buffer->addr_offset, frame_size, batch_size);
+			/* remove buffer stats for all the subframes in a superframe */
+			msm_vidc_remove_buffer_stats(inst, buf, buffer->timestamp);
+			return 0;
+		}
+	}
+
+	if (!(buf->attr & MSM_VIDC_ATTR_QUEUED)) {
+		print_vidc_buffer(VIDC_ERR, "err ", "not queued", inst, buf);
+		return 0;
+	}
+
+	if (is_decode_session(inst) && inst->codec == MSM_VIDC_AV1) {
+		if (inst->hfi_frame_info.av1_tile_rows_columns) {
+			inst->power.fw_av1_tile_rows =
+				inst->hfi_frame_info.av1_tile_rows_columns >> 16;
+			inst->power.fw_av1_tile_columns =
+				inst->hfi_frame_info.av1_tile_rows_columns & 0x0000FFFF;
+		}
+
+		if (inst->hfi_frame_info.av1_non_uniform_tile_spacing)
+			i_vpr_l(inst, "%s: av1_non_uniform_tile_spacing %d\n",
+				__func__, inst->hfi_frame_info.av1_non_uniform_tile_spacing);
+	}
+
+	buf->data_size = buffer->data_size;
+	buf->attr &= ~MSM_VIDC_ATTR_QUEUED;
+	buf->attr |= MSM_VIDC_ATTR_DEQUEUED;
+
+	buf->flags = 0;
+	buf->flags = get_driver_buffer_flags(inst, buffer->flags);
+
+	/* handle ts_reorder for no_output prop attached input buffer */
+	if (is_ts_reorder_allowed(inst) && inst->hfi_frame_info.no_output) {
+		i_vpr_h(inst, "%s: received no_output buffer. remove timestamp %lld\n",
+			__func__, buf->timestamp);
+		msm_vidc_ts_reorder_remove_timestamp(inst, buf->timestamp);
+	}
+
+	print_vidc_buffer(VIDC_HIGH, "high", "dqbuf", inst, buf);
+	msm_vidc_update_stats(inst, buf, MSM_VIDC_DEBUGFS_EVENT_EBD);
+
+	/* ebd: update end timestamp and flags in stats entry */
+	msm_vidc_remove_buffer_stats(inst, buf, buffer->timestamp);
+
+	return rc;
+}
+
+static int msm_vidc_handle_fence_signal(struct msm_vidc_inst *inst,
+					struct msm_vidc_buffer *buf)
+{
+	int rc = 0;
+	bool signal_error = false;
+	struct msm_vidc_core *core = inst->core;
+
+	if (inst->capabilities[OUTBUF_FENCE_TYPE].value ==
+		MSM_VIDC_FENCE_NONE)
+		return 0;
+
+	if (is_meta_rx_inp_enabled(inst, META_OUTBUF_FENCE)) {
+		if (!inst->hfi_frame_info.fence_id) {
+			i_vpr_e(inst,
+				"%s: fence id is not received although fencing is enabled\n",
+				__func__);
+			return -EINVAL;
+		}
+	} else {
+		if (!inst->hfi_frame_info.fence_id) {
+			return 0;
+		}
+		i_vpr_e(inst,
+			"%s: fence id: %d is received although fencing is not enabled\n",
+			__func__, inst->hfi_frame_info.fence_id);
+		signal_error = true;
+		goto signal;
+	}
+
+	if (inst->capabilities[OUTBUF_FENCE_TYPE].value ==
+		MSM_VIDC_SYNX_V2_FENCE) {
+		if (inst->hfi_frame_info.fence_error)
+			signal_error = true;
+	} else if (inst->capabilities[OUTBUF_FENCE_TYPE].value ==
+		MSM_VIDC_SW_FENCE) {
+		if (!buf->data_size)
+			signal_error = true;
+
+		if (inst->hfi_frame_info.fence_error)
+			i_vpr_e(inst,
+				"%s: fence error info received for SW fence\n",
+				__func__);
+	} else {
+		i_vpr_e(inst, "%s: invalid fence type\n", __func__);
+		return -EINVAL;
+	}
+
+signal:
+	/* fence signalling */
+	if (signal_error) {
+		/* signal fence error */
+		i_vpr_l(inst,
+			"%s: signalling fence error for buf idx %d daddr %#llx\n",
+			__func__, buf->index, buf->device_addr);
+		call_fence_op(core, fence_destroy, inst,
+			      inst->hfi_frame_info.fence_id);
+	} else {
+		/* signal fence success*/
+		rc = call_fence_op(core, fence_signal, inst,
+				   inst->hfi_frame_info.fence_id);
+		if (rc) {
+			i_vpr_e(inst, "%s: failed to signal fence\n", __func__);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static int handle_output_buffer(struct msm_vidc_inst *inst,
+				struct hfi_buffer *buffer)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf;
+	struct msm_vidc_core *core;
+	bool found, fatal = false;
+
+	core = inst->core;
+
+	/* handle drain last flag buffer */
+	if (buffer->flags & HFI_BUF_FW_FLAG_LAST) {
+		rc = handle_drain_last_flag_buffer(inst, buffer);
+		if (rc)
+			msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+	}
+
+	if (is_decode_session(inst)) {
+		/* handle release response for decoder output buffer */
+		if (buffer->flags & HFI_BUF_FW_FLAG_RELEASE_DONE)
+			return handle_release_output_buffer(inst, buffer);
+		/* handle psc last flag buffer */
+		if (buffer->flags & HFI_BUF_FW_FLAG_PSC_LAST) {
+			rc = handle_psc_last_flag_buffer(inst, buffer);
+			if (rc)
+				msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		}
+		/* handle non-read only buffer */
+		if (!(buffer->flags & HFI_BUF_FW_FLAG_READONLY)) {
+			rc = handle_non_read_only_buffer(inst, buffer);
+			if (rc)
+				msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		}
+	}
+
+	buffers = msm_vidc_get_buffers(inst, MSM_VIDC_BUF_OUTPUT, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	found = false;
+	list_for_each_entry(buf, &buffers->list, list) {
+		if (!(buf->attr & MSM_VIDC_ATTR_QUEUED))
+			continue;
+		if (is_decode_session(inst))
+			found = (buf->index == buffer->index &&
+				buf->device_addr == buffer->base_address &&
+				buf->data_offset == buffer->data_offset);
+		else
+			found = (buf->index == buffer->index);
+
+		if (found)
+			break;
+	}
+	if (!found) {
+		i_vpr_l(inst, "%s: invalid idx %d daddr %#llx\n",
+			__func__, buffer->index, buffer->base_address);
+		return 0;
+	}
+
+	buf->data_offset = buffer->data_offset;
+	buf->data_size = buffer->data_size;
+	buf->timestamp = buffer->timestamp;
+
+	buf->attr &= ~MSM_VIDC_ATTR_QUEUED;
+	buf->attr |= MSM_VIDC_ATTR_DEQUEUED;
+
+	if (is_encode_session(inst)) {
+		/* encoder output is not expected to be corrupted */
+		if (inst->hfi_frame_info.data_corrupt) {
+			i_vpr_e(inst, "%s: encode output is corrupted\n", __func__);
+			fatal = true;
+		}
+		if (inst->hfi_frame_info.overflow) {
+			/* overflow not expected for image session */
+			if (is_image_session(inst)) {
+				i_vpr_e(inst, "%s: overflow detected for an image session\n",
+					__func__);
+				fatal = true;
+			}
+
+			/* overflow not expected for cbr_cfr session */
+			if (!buffer->data_size && inst->hfi_rc_type == HFI_RC_CBR_CFR) {
+				i_vpr_e(inst, "%s: overflow detected for cbr_cfr session\n",
+					__func__);
+				fatal = true;
+			}
+		}
+		if (fatal)
+			msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+	}
+
+	/*
+	 * reset data size to zero for last flag buffer.
+	 * reset RO flag for last flag buffer.
+	 */
+	if ((buffer->flags & HFI_BUF_FW_FLAG_LAST) ||
+		(buffer->flags & HFI_BUF_FW_FLAG_PSC_LAST)) {
+		if (buffer->data_size) {
+			i_vpr_e(inst, "%s: reset data size to zero for last flag buffer\n",
+				__func__);
+			buf->data_size = 0;
+		}
+		if (buffer->flags & HFI_BUF_FW_FLAG_READONLY) {
+			i_vpr_e(inst, "%s: reset RO flag for last flag buffer\n",
+				__func__);
+			buffer->flags &= ~HFI_BUF_FW_FLAG_READONLY;
+		}
+	}
+
+	if (is_decode_session(inst)) {
+		/* RO flag is not expected when internal dpb buffers are allocated */
+		if (inst->buffers.dpb.size && buffer->flags & HFI_BUF_FW_FLAG_READONLY) {
+			print_vidc_buffer(VIDC_ERR, "err ", "unexpected RO flag", inst, buf);
+			msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		}
+
+		if (buffer->flags & HFI_BUF_FW_FLAG_READONLY) {
+			buf->attr |= MSM_VIDC_ATTR_READ_ONLY;
+			rc = handle_read_only_buffer(inst, buf);
+			if (rc)
+				msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		} else {
+			buf->attr &= ~MSM_VIDC_ATTR_READ_ONLY;
+		}
+
+		if (buf->dbuf_get) {
+			call_mem_op(core, dma_buf_put, inst, buf->dmabuf);
+			buf->dbuf_get = 0;
+		}
+	}
+
+	buf->flags = 0;
+	buf->flags = get_driver_buffer_flags(inst, buffer->flags);
+
+	rc = msm_vidc_handle_fence_signal(inst, buf);
+	if (rc)
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+
+	if (is_decode_session(inst)) {
+		inst->power.fw_cr = inst->hfi_frame_info.cr;
+		inst->power.fw_cf = inst->hfi_frame_info.cf;
+	} else {
+		inst->power.fw_cr = inst->hfi_frame_info.cr;
+	}
+
+	if (!is_image_session(inst) && is_decode_session(inst) && buf->data_size)
+		msm_vidc_update_timestamp_rate(inst, buf->timestamp);
+
+	/* update output buffer timestamp, if ts_reorder is enabled */
+	if (is_ts_reorder_allowed(inst) && buf->data_size)
+		msm_vidc_ts_reorder_get_first_timestamp(inst, &buf->timestamp);
+
+	print_vidc_buffer(VIDC_HIGH, "high", "dqbuf", inst, buf);
+	msm_vidc_update_stats(inst, buf, MSM_VIDC_DEBUGFS_EVENT_FBD);
+
+	/* fbd: print stats and remove entry */
+	msm_vidc_remove_buffer_stats(inst, buf, buffer->timestamp);
+
+	return rc;
+}
+
+static int handle_input_metadata_buffer(struct msm_vidc_inst *inst,
+					struct hfi_buffer *buffer)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf;
+	struct msm_vidc_core *core;
+	u32 frame_size, batch_size;
+	bool found;
+
+	core = inst->core;
+	buffers = msm_vidc_get_buffers(inst, MSM_VIDC_BUF_INPUT_META, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	found = false;
+	list_for_each_entry(buf, &buffers->list, list) {
+		if (buf->index == buffer->index) {
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		i_vpr_e(inst, "%s: invalid idx %d daddr %#llx data_offset %d\n",
+			__func__, buffer->index, buffer->base_address,
+			buffer->data_offset);
+		return -EINVAL;
+	}
+	/* attach dequeued flag for, only last frame in the batch */
+	if (msm_vidc_is_super_buffer(inst)) {
+		frame_size = call_session_op(core, buffer_size, inst, MSM_VIDC_BUF_INPUT_META);
+		batch_size = inst->capabilities[SUPER_FRAME].value;
+		if (!frame_size || !batch_size) {
+			i_vpr_e(inst, "%s: invalid size: frame %u, batch %u\n",
+				__func__, frame_size, batch_size);
+			return -EINVAL;
+		}
+		if (buffer->addr_offset / frame_size < batch_size - 1) {
+			i_vpr_l(inst, "%s: superframe last buffer not reached: %u, %u, %u\n",
+				__func__, buffer->addr_offset, frame_size, batch_size);
+			return 0;
+		}
+	}
+
+	if (!(buf->attr & MSM_VIDC_ATTR_QUEUED)) {
+		print_vidc_buffer(VIDC_ERR, "err ", "not queued", inst, buf);
+		return 0;
+	}
+
+	buf->data_size = buffer->data_size;
+	buf->attr &= ~MSM_VIDC_ATTR_QUEUED;
+	buf->attr |= MSM_VIDC_ATTR_DEQUEUED;
+	buf->flags = 0;
+	if (buffer->flags & HFI_BUF_FW_FLAG_LAST ||
+	    buffer->flags & HFI_BUF_FW_FLAG_PSC_LAST)
+		buf->flags |= MSM_VIDC_BUF_FLAG_LAST;
+
+	/*
+	 * if last flag event is enabled then remove BUF_FLAG_LAST
+	 * because last flag information will be sent via V4L2_EVENT_EOS
+	 */
+	if (inst->capabilities[LAST_FLAG_EVENT_ENABLE].value)
+		buf->flags &= ~MSM_VIDC_BUF_FLAG_LAST;
+
+	print_vidc_buffer(VIDC_LOW, "low ", "dqbuf", inst, buf);
+	return rc;
+}
+
+static int handle_output_metadata_buffer(struct msm_vidc_inst *inst,
+					 struct hfi_buffer *buffer)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf;
+	bool found;
+
+	buffers = msm_vidc_get_buffers(inst, MSM_VIDC_BUF_OUTPUT_META, __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	found = false;
+	list_for_each_entry(buf, &buffers->list, list) {
+		if (buf->index == buffer->index) {
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		i_vpr_e(inst, "%s: invalid idx %d daddr %#llx data_offset %d\n",
+			__func__, buffer->index, buffer->base_address,
+			buffer->data_offset);
+		return -EINVAL;
+	}
+
+	if (!(buf->attr & MSM_VIDC_ATTR_QUEUED)) {
+		print_vidc_buffer(VIDC_ERR, "err ", "not queued", inst, buf);
+		return 0;
+	}
+
+	buf->data_size = buffer->data_size;
+	buf->attr &= ~MSM_VIDC_ATTR_QUEUED;
+	buf->attr |= MSM_VIDC_ATTR_DEQUEUED;
+	buf->flags = 0;
+	if (buffer->flags & HFI_BUF_FW_FLAG_LAST ||
+	    buffer->flags & HFI_BUF_FW_FLAG_PSC_LAST)
+		buf->flags |= MSM_VIDC_BUF_FLAG_LAST;
+
+	/*
+	 * if last flag event is enabled then remove BUF_FLAG_LAST
+	 * because last flag information will be sent via V4L2_EVENT_EOS
+	 */
+	if (inst->capabilities[LAST_FLAG_EVENT_ENABLE].value)
+		buf->flags &= ~MSM_VIDC_BUF_FLAG_LAST;
+
+	print_vidc_buffer(VIDC_LOW, "low ", "dqbuf", inst, buf);
+	return rc;
+}
+
+static bool is_metabuffer_dequeued(struct msm_vidc_inst *inst,
+				   struct msm_vidc_buffer *buf)
+{
+	bool found = false;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buffer;
+	enum msm_vidc_buffer_type buffer_type;
+
+	if (is_input_buffer(buf->type) && is_input_meta_enabled(inst))
+		buffer_type = MSM_VIDC_BUF_INPUT_META;
+	else if (is_output_buffer(buf->type) && is_output_meta_enabled(inst))
+		buffer_type = MSM_VIDC_BUF_OUTPUT_META;
+	else
+		return true;
+
+	buffers = msm_vidc_get_buffers(inst, buffer_type, __func__);
+	if (!buffers)
+		return false;
+
+	list_for_each_entry(buffer, &buffers->list, list) {
+		if (buffer->index == buf->index &&
+			(buffer->attr & MSM_VIDC_ATTR_DEQUEUED ||
+			buffer->attr & MSM_VIDC_ATTR_BUFFER_DONE)) {
+			/*
+			 * For META_OUTBUF_FENCE case, meta buffers are
+			 * dequeued ahead in time and completed vb2 done
+			 * as well. Hence, check for vb2 buffer done flag since
+			 * dequeued flag is already cleared for such buffers
+			 */
+			found = true;
+			break;
+		}
+	}
+	return found;
+}
+
+static int msm_vidc_check_meta_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	int i;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf;
+	static const enum msm_vidc_buffer_type buffer_type[] = {
+		MSM_VIDC_BUF_INPUT,
+		MSM_VIDC_BUF_OUTPUT,
+	};
+
+	for (i = 0; i < ARRAY_SIZE(buffer_type); i++) {
+		buffers = msm_vidc_get_buffers(inst, buffer_type[i], __func__);
+		if (!buffers)
+			return -EINVAL;
+
+		list_for_each_entry(buf, &buffers->list, list) {
+			if (buf->attr & MSM_VIDC_ATTR_DEQUEUED) {
+				if (!is_metabuffer_dequeued(inst, buf)) {
+					print_vidc_buffer(VIDC_ERR, "err ",
+						"meta not dequeued", inst, buf);
+					return -EINVAL;
+				}
+			}
+		}
+	}
+	return rc;
+}
+
+static int handle_dequeue_buffers(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	int i;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf;
+	struct msm_vidc_buffer *dummy;
+	static const enum msm_vidc_buffer_type buffer_type[] = {
+		MSM_VIDC_BUF_INPUT_META,
+		MSM_VIDC_BUF_INPUT,
+		MSM_VIDC_BUF_OUTPUT_META,
+		MSM_VIDC_BUF_OUTPUT,
+	};
+
+	/* check metabuffers dequeued before sending vb2_buffer_done() */
+	rc = msm_vidc_check_meta_buffers(inst);
+	if (rc)
+		return rc;
+
+	for (i = 0; i < ARRAY_SIZE(buffer_type); i++) {
+		buffers = msm_vidc_get_buffers(inst, buffer_type[i], __func__);
+		if (!buffers)
+			return -EINVAL;
+
+		list_for_each_entry_safe(buf, dummy, &buffers->list, list) {
+			if (buf->attr & MSM_VIDC_ATTR_DEQUEUED) {
+				buf->attr &= ~MSM_VIDC_ATTR_DEQUEUED;
+				/*
+				 * do not send vb2_buffer_done when fw returns
+				 * same buffer again
+				 */
+				if (buf->attr & MSM_VIDC_ATTR_BUFFER_DONE) {
+					print_vidc_buffer(VIDC_HIGH, "high",
+						"vb2 done already", inst, buf);
+				} else {
+					buf->attr |= MSM_VIDC_ATTR_BUFFER_DONE;
+
+					rc = msm_vidc_dqbuf_cache_operation(inst, buf);
+					if (rc)
+						return rc;
+
+					rc = msm_vidc_vb2_buffer_done(inst, buf);
+					if (rc) {
+						print_vidc_buffer(VIDC_HIGH, "err ",
+							"vb2 done failed", inst, buf);
+						/* ignore the error */
+						rc = 0;
+					}
+				}
+			}
+		}
+	}
+
+	return rc;
+}
+
+static int handle_release_internal_buffer(struct msm_vidc_inst *inst,
+					  struct hfi_buffer *buffer)
+{
+	int rc = 0;
+	struct msm_vidc_buffers *buffers;
+	struct msm_vidc_buffer *buf;
+	bool found;
+
+	buffers = msm_vidc_get_buffers(inst,
+				       hfi_buf_type_to_driver(inst->domain,
+							      buffer->type, HFI_PORT_NONE),
+				       __func__);
+	if (!buffers)
+		return -EINVAL;
+
+	found = false;
+	list_for_each_entry(buf, &buffers->list, list) {
+		if (buf->device_addr == buffer->base_address) {
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		i_vpr_e(inst, "%s: invalid idx %d daddr %#llx\n",
+			__func__, buffer->index, buffer->base_address);
+		return -EINVAL;
+	}
+
+	if (!is_internal_buffer(buf->type))
+		return 0;
+
+	/* remove QUEUED attribute */
+	buf->attr &= ~MSM_VIDC_ATTR_QUEUED;
+
+	/*
+	 * firmware will return/release internal buffer in two cases
+	 * - driver sent release cmd in which case driver should destroy the buffer
+	 * - as part stop cmd in which case driver can reuse the buffer, so skip
+	 *   destroying the buffer
+	 */
+	if (buf->attr & MSM_VIDC_ATTR_PENDING_RELEASE) {
+		rc = msm_vidc_destroy_internal_buffer(inst, buf);
+		if (rc)
+			return rc;
+	}
+	return rc;
+}
+
+int handle_release_output_buffer(struct msm_vidc_inst *inst,
+				 struct hfi_buffer *buffer)
+{
+	int rc = 0;
+	struct msm_vidc_buffer *buf;
+	bool found = false;
+
+	list_for_each_entry(buf, &inst->buffers.read_only.list, list) {
+		if (buf->device_addr == buffer->base_address &&
+			buf->attr & MSM_VIDC_ATTR_PENDING_RELEASE) {
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		i_vpr_e(inst, "%s: invalid idx %d daddr %#llx\n",
+			__func__, buffer->index, buffer->base_address);
+		return -EINVAL;
+	}
+
+	buf->attr &= ~MSM_VIDC_ATTR_READ_ONLY;
+	buf->attr &= ~MSM_VIDC_ATTR_PENDING_RELEASE;
+	print_vidc_buffer(VIDC_LOW, "low ", "release done", inst, buf);
+
+	return rc;
+}
+
+static int handle_session_buffer(struct msm_vidc_inst *inst,
+				 struct hfi_packet *pkt)
+{
+	int i, rc = 0;
+	struct hfi_buffer *buffer;
+	u32 hfi_handle_size = 0;
+	const struct msm_vidc_hfi_buffer_handle *hfi_handle_arr = NULL;
+	static const struct msm_vidc_hfi_buffer_handle enc_input_hfi_handle[] = {
+		{HFI_BUFFER_METADATA,       handle_input_metadata_buffer      },
+		{HFI_BUFFER_RAW,            handle_input_buffer               },
+		{HFI_BUFFER_VPSS,           handle_release_internal_buffer    },
+	};
+	static const struct msm_vidc_hfi_buffer_handle enc_output_hfi_handle[] = {
+		{HFI_BUFFER_METADATA,       handle_output_metadata_buffer     },
+		{HFI_BUFFER_BITSTREAM,      handle_output_buffer              },
+		{HFI_BUFFER_BIN,            handle_release_internal_buffer    },
+		{HFI_BUFFER_COMV,           handle_release_internal_buffer    },
+		{HFI_BUFFER_NON_COMV,       handle_release_internal_buffer    },
+		{HFI_BUFFER_LINE,           handle_release_internal_buffer    },
+		{HFI_BUFFER_ARP,            handle_release_internal_buffer    },
+		{HFI_BUFFER_DPB,            handle_release_internal_buffer    },
+	};
+	static const struct msm_vidc_hfi_buffer_handle dec_input_hfi_handle[] = {
+		{HFI_BUFFER_METADATA,       handle_input_metadata_buffer      },
+		{HFI_BUFFER_BITSTREAM,      handle_input_buffer               },
+		{HFI_BUFFER_BIN,            handle_release_internal_buffer    },
+		{HFI_BUFFER_COMV,           handle_release_internal_buffer    },
+		{HFI_BUFFER_NON_COMV,       handle_release_internal_buffer    },
+		{HFI_BUFFER_LINE,           handle_release_internal_buffer    },
+		{HFI_BUFFER_PERSIST,        handle_release_internal_buffer    },
+		{HFI_BUFFER_PARTIAL_DATA,   handle_release_internal_buffer    },
+	};
+	static const struct msm_vidc_hfi_buffer_handle dec_output_hfi_handle[] = {
+		{HFI_BUFFER_METADATA,       handle_output_metadata_buffer     },
+		{HFI_BUFFER_RAW,            handle_output_buffer              },
+		{HFI_BUFFER_DPB,            handle_release_internal_buffer    },
+	};
+
+	if (pkt->payload_info == HFI_PAYLOAD_NONE) {
+		i_vpr_h(inst, "%s: received hfi buffer packet without payload\n",
+			__func__);
+		return 0;
+	}
+
+	if (!check_for_packet_payload(inst, pkt, __func__)) {
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		return 0;
+	}
+
+	buffer = (struct hfi_buffer *)((u8 *)pkt + sizeof(struct hfi_packet));
+	if (!is_valid_hfi_buffer_type(inst, buffer->type, __func__)) {
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		return 0;
+	}
+
+	if (!is_valid_hfi_port(inst, pkt->port, buffer->type, __func__)) {
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		return 0;
+	}
+
+	if (is_encode_session(inst)) {
+		if (pkt->port == HFI_PORT_RAW) {
+			hfi_handle_size = ARRAY_SIZE(enc_input_hfi_handle);
+			hfi_handle_arr = enc_input_hfi_handle;
+		} else if (pkt->port == HFI_PORT_BITSTREAM) {
+			hfi_handle_size = ARRAY_SIZE(enc_output_hfi_handle);
+			hfi_handle_arr = enc_output_hfi_handle;
+		}
+	} else if (is_decode_session(inst)) {
+		if (pkt->port == HFI_PORT_BITSTREAM) {
+			hfi_handle_size = ARRAY_SIZE(dec_input_hfi_handle);
+			hfi_handle_arr = dec_input_hfi_handle;
+		} else if (pkt->port == HFI_PORT_RAW) {
+			hfi_handle_size = ARRAY_SIZE(dec_output_hfi_handle);
+			hfi_handle_arr = dec_output_hfi_handle;
+		}
+	}
+
+	/* handle invalid session */
+	if (!hfi_handle_arr || !hfi_handle_size) {
+		i_vpr_e(inst, "%s: invalid session %d\n", __func__, inst->domain);
+		return -EINVAL;
+	}
+
+	/* handle session buffer */
+	for (i = 0; i < hfi_handle_size; i++) {
+		if (hfi_handle_arr[i].type == buffer->type) {
+			rc = hfi_handle_arr[i].handle(inst, buffer);
+			if (rc)
+				return rc;
+			break;
+		}
+	}
+
+	/* handle unknown buffer type */
+	if (i == hfi_handle_size) {
+		i_vpr_e(inst, "%s: port %u, unknown buffer type %#x\n", __func__,
+			pkt->port, buffer->type);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int handle_input_port_settings_change(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+	enum msm_vidc_allow allow = MSM_VIDC_DISALLOW;
+
+	allow = msm_vidc_allow_input_psc(inst);
+	if (allow == MSM_VIDC_DISALLOW) {
+		return -EINVAL;
+	} else if (allow == MSM_VIDC_ALLOW) {
+		rc = msm_vidc_state_change_input_psc(inst);
+		if (rc)
+			return rc;
+		print_psc_properties("INPUT_PSC", inst, inst->subcr_params[INPUT_PORT]);
+		rc = msm_vdec_input_port_settings_change(inst);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int handle_output_port_settings_change(struct msm_vidc_inst *inst)
+{
+	int rc = 0;
+
+	print_psc_properties("OUTPUT_PSC", inst, inst->subcr_params[OUTPUT_PORT]);
+	rc = msm_vdec_output_port_settings_change(inst);
+	if (rc)
+		return rc;
+
+	return rc;
+}
+
+static int handle_port_settings_change(struct msm_vidc_inst *inst,
+				       struct hfi_packet *pkt)
+{
+	int rc = 0;
+
+	i_vpr_h(inst, "%s: Received port settings change, type %d\n",
+		__func__, pkt->port);
+
+	if (pkt->port == HFI_PORT_RAW) {
+		rc = handle_output_port_settings_change(inst);
+		if (rc)
+			goto exit;
+	} else if (pkt->port == HFI_PORT_BITSTREAM) {
+		rc = handle_input_port_settings_change(inst);
+		if (rc)
+			goto exit;
+	} else {
+		i_vpr_e(inst, "%s: invalid port type: %#x\n",
+			__func__, pkt->port);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+exit:
+	if (rc)
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+	return rc;
+}
+
+static int handle_session_subscribe_mode(struct msm_vidc_inst *inst,
+					 struct hfi_packet *pkt)
+{
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful\n", __func__);
+	return 0;
+}
+
+static int handle_session_delivery_mode(struct msm_vidc_inst *inst,
+					struct hfi_packet *pkt)
+{
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful\n", __func__);
+	return 0;
+}
+
+static int handle_session_pause(struct msm_vidc_inst *inst,
+				struct hfi_packet *pkt)
+{
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful\n", __func__);
+	return 0;
+}
+
+static int handle_session_resume(struct msm_vidc_inst *inst,
+				 struct hfi_packet *pkt)
+{
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful\n", __func__);
+	return 0;
+}
+
+static int handle_session_stability(struct msm_vidc_inst *inst,
+				    struct hfi_packet *pkt)
+{
+	if (pkt->flags & HFI_FW_FLAGS_SUCCESS)
+		i_vpr_h(inst, "%s: successful\n", __func__);
+	return 0;
+}
+
+static int handle_session_command(struct msm_vidc_inst *inst,
+				  struct hfi_packet *pkt)
+{
+	int i, rc;
+	static const struct msm_vidc_hfi_packet_handle hfi_pkt_handle[] = {
+		{HFI_CMD_OPEN,              handle_session_open               },
+		{HFI_CMD_CLOSE,             handle_session_close              },
+		{HFI_CMD_START,             handle_session_start              },
+		{HFI_CMD_STOP,              handle_session_stop               },
+		{HFI_CMD_DRAIN,             handle_session_drain              },
+		{HFI_CMD_BUFFER,            handle_session_buffer             },
+		{HFI_CMD_SETTINGS_CHANGE,   handle_port_settings_change       },
+		{HFI_CMD_SUBSCRIBE_MODE,    handle_session_subscribe_mode     },
+		{HFI_CMD_DELIVERY_MODE,     handle_session_delivery_mode      },
+		{HFI_CMD_PAUSE,             handle_session_pause              },
+		{HFI_CMD_RESUME,            handle_session_resume             },
+		{HFI_CMD_STABILITY,         handle_session_stability          },
+	};
+
+	/* handle session pkt */
+	for (i = 0; i < ARRAY_SIZE(hfi_pkt_handle); i++) {
+		if (hfi_pkt_handle[i].type == pkt->type) {
+			rc = hfi_pkt_handle[i].handle(inst, pkt);
+			if (rc)
+				return rc;
+			break;
+		}
+	}
+
+	/* handle unknown buffer type */
+	if (i == ARRAY_SIZE(hfi_pkt_handle)) {
+		i_vpr_e(inst, "%s: Unsupported command type: %#x\n", __func__, pkt->type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int handle_dpb_list_property(struct msm_vidc_inst *inst,
+				    struct hfi_packet *pkt)
+{
+	u32 payload_size, num_words_in_payload;
+	u8 *payload_start;
+	int i = 0;
+	struct msm_vidc_buffer *ro_buf;
+	bool found = false;
+	u64 device_addr;
+
+	if (!is_decode_session(inst)) {
+		i_vpr_e(inst,
+			"%s: unsupported for non-decode session\n", __func__);
+		return -EINVAL;
+	}
+
+	payload_size = pkt->size - sizeof(struct hfi_packet);
+	num_words_in_payload = payload_size / 4;
+	payload_start = (u8 *)((u8 *)pkt + sizeof(struct hfi_packet));
+	memset(inst->dpb_list_payload, 0, MAX_DPB_LIST_ARRAY_SIZE);
+
+	if (payload_size > MAX_DPB_LIST_PAYLOAD_SIZE) {
+		i_vpr_e(inst,
+			"%s: dpb list payload size %d exceeds expected max size %d\n",
+			__func__, payload_size, MAX_DPB_LIST_PAYLOAD_SIZE);
+		msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+		return -EINVAL;
+	}
+	memcpy(inst->dpb_list_payload, payload_start, payload_size);
+
+	/*
+	 * dpb_list_payload details:
+	 * payload[0-1]           : 64 bits base_address of DPB-1
+	 * payload[2]             : 32 bits addr_offset  of DPB-1
+	 * payload[3]             : 32 bits data_offset  of DPB-1
+	 */
+	for (i = 0; (i + 3) < num_words_in_payload; i = i + 4) {
+		i_vpr_l(inst,
+			"%s: base addr %#x %#x, addr offset %#x, data offset %#x\n",
+			__func__, inst->dpb_list_payload[i], inst->dpb_list_payload[i + 1],
+			inst->dpb_list_payload[i + 2], inst->dpb_list_payload[i + 3]);
+	}
+
+	list_for_each_entry(ro_buf, &inst->buffers.read_only.list, list) {
+		found = false;
+		/* do not mark RELEASE_ELIGIBLE for non-read only buffers */
+		if (!(ro_buf->attr & MSM_VIDC_ATTR_READ_ONLY))
+			continue;
+		/* no need to mark RELEASE_ELIGIBLE again */
+		if (ro_buf->attr & MSM_VIDC_ATTR_RELEASE_ELIGIBLE)
+			continue;
+		/*
+		 * do not add RELEASE_ELIGIBLE to buffers for which driver
+		 * sent release cmd already
+		 */
+		if (ro_buf->attr & MSM_VIDC_ATTR_PENDING_RELEASE)
+			continue;
+		for (i = 0; (i + 3) < num_words_in_payload; i = i + 4) {
+			device_addr = *((u64 *)(&inst->dpb_list_payload[i]));
+			if (ro_buf->device_addr == device_addr) {
+				found = true;
+				break;
+			}
+		}
+		/* mark a buffer as RELEASE_ELIGIBLE if not found in dpb list */
+		if (!found)
+			ro_buf->attr |= MSM_VIDC_ATTR_RELEASE_ELIGIBLE;
+	}
+
+	return 0;
+}
+
+static int handle_property_with_payload(struct msm_vidc_inst *inst,
+					struct hfi_packet *pkt, u32 port)
+{
+	int rc = 0;
+	u32 *payload_ptr = NULL;
+
+	payload_ptr = (u32 *)((u8 *)pkt + sizeof(struct hfi_packet));
+	if (!payload_ptr) {
+		i_vpr_e(inst,
+			"%s: payload_ptr cannot be null\n", __func__);
+		return -EINVAL;
+	}
+
+	switch (pkt->type) {
+	case HFI_PROP_BITSTREAM_RESOLUTION:
+		inst->subcr_params[port].bitstream_resolution = payload_ptr[0];
+		break;
+	case HFI_PROP_CROP_OFFSETS:
+		inst->subcr_params[port].crop_offsets[0] = payload_ptr[0];
+		inst->subcr_params[port].crop_offsets[1] = payload_ptr[1];
+		break;
+	case HFI_PROP_LUMA_CHROMA_BIT_DEPTH:
+		inst->subcr_params[port].bit_depth = payload_ptr[0];
+		break;
+	case HFI_PROP_CODED_FRAMES:
+		inst->subcr_params[port].coded_frames = payload_ptr[0];
+		break;
+	case HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT:
+		inst->subcr_params[port].fw_min_count = payload_ptr[0];
+		break;
+	case HFI_PROP_PIC_ORDER_CNT_TYPE:
+		inst->subcr_params[port].pic_order_cnt = payload_ptr[0];
+		break;
+	case HFI_PROP_SIGNAL_COLOR_INFO:
+		inst->subcr_params[port].color_info = payload_ptr[0];
+		break;
+	case HFI_PROP_PROFILE:
+		inst->subcr_params[port].profile = payload_ptr[0];
+		break;
+	case HFI_PROP_LEVEL:
+		inst->subcr_params[port].level = payload_ptr[0];
+		break;
+	case HFI_PROP_TIER:
+		inst->subcr_params[port].tier = payload_ptr[0];
+		break;
+	case HFI_PROP_AV1_FILM_GRAIN_PRESENT:
+		inst->subcr_params[port].av1_film_grain_present = payload_ptr[0];
+		break;
+	case HFI_PROP_AV1_SUPER_BLOCK_ENABLED:
+		inst->subcr_params[port].av1_super_block_enabled = payload_ptr[0];
+		break;
+	case HFI_PROP_MAX_NUM_REORDER_FRAMES:
+		inst->subcr_params[port].max_num_reorder_frames = payload_ptr[0];
+		break;
+	case HFI_PROP_PICTURE_TYPE:
+		inst->hfi_frame_info.picture_type = payload_ptr[0];
+		if (inst->hfi_frame_info.picture_type & HFI_PICTURE_B)
+			inst->has_bframe = true;
+		if (inst->hfi_frame_info.picture_type & HFI_PICTURE_IDR)
+			inst->iframe = true;
+		else
+			inst->iframe = false;
+		break;
+	case HFI_PROP_SUBFRAME_INPUT:
+		if (port != INPUT_PORT) {
+			i_vpr_e(inst,
+				"%s: invalid port: %d for property %#x\n",
+				__func__, pkt->port, pkt->type);
+			break;
+		}
+		inst->hfi_frame_info.subframe_input = 1;
+		break;
+	case HFI_PROP_WORST_COMPRESSION_RATIO:
+		inst->hfi_frame_info.cr = payload_ptr[0];
+		break;
+	case HFI_PROP_WORST_COMPLEXITY_FACTOR:
+		inst->hfi_frame_info.cf = payload_ptr[0];
+		break;
+	case HFI_PROP_AV1_TILE_ROWS_COLUMNS:
+		inst->hfi_frame_info.av1_tile_rows_columns =
+			payload_ptr[0];
+		break;
+	case HFI_PROP_AV1_UNIFORM_TILE_SPACING:
+		if (!payload_ptr[0])
+			inst->hfi_frame_info.av1_non_uniform_tile_spacing = true;
+		break;
+	case HFI_PROP_CABAC_SESSION:
+		if (payload_ptr[0] == 1)
+			msm_vidc_update_cap_value(inst, ENTROPY_MODE,
+						  V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CABAC,
+						  __func__);
+		else
+			msm_vidc_update_cap_value(inst, ENTROPY_MODE,
+						  V4L2_MPEG_VIDEO_H264_ENTROPY_MODE_CAVLC,
+						  __func__);
+		break;
+	case HFI_PROP_DPB_LIST:
+		rc = handle_dpb_list_property(inst, pkt);
+		if (rc)
+			break;
+		break;
+	case HFI_PROP_QUALITY_MODE:
+		if (inst->capabilities[QUALITY_MODE].value !=  payload_ptr[0])
+			i_vpr_e(inst,
+				"%s: fw quality mode(%d) not matching the capability value(%d)\n",
+				__func__,  payload_ptr[0],
+				inst->capabilities[QUALITY_MODE].value);
+		break;
+	case HFI_PROP_STAGE:
+		if (inst->capabilities[STAGE].value !=  payload_ptr[0])
+			i_vpr_e(inst,
+				"%s: fw stage mode(%d) not matching the capability value(%d)\n",
+				__func__,  payload_ptr[0], inst->capabilities[STAGE].value);
+		break;
+	case HFI_PROP_PIPE:
+		if (inst->capabilities[PIPE].value !=  payload_ptr[0])
+			i_vpr_e(inst,
+				"%s: fw pipe mode(%d) not matching the capability value(%d)\n",
+				__func__,  payload_ptr[0], inst->capabilities[PIPE].value);
+		break;
+	case HFI_PROP_FENCE:
+		inst->hfi_frame_info.fence_id = payload_ptr[0];
+		break;
+	default:
+		i_vpr_e(inst, "%s: invalid property %#x\n",
+			__func__, pkt->type);
+		break;
+	}
+
+	return rc;
+}
+
+static int handle_property_without_payload(struct msm_vidc_inst *inst,
+					   struct hfi_packet *pkt,
+					   u32 port)
+{
+	int rc = 0;
+
+	switch (pkt->type) {
+	case HFI_PROP_DPB_LIST:
+		/*
+		 * if fw sends dpb list property without payload,
+		 * it means there are no more reference buffers.
+		 */
+		rc = handle_dpb_list_property(inst, pkt);
+		if (rc)
+			break;
+		break;
+	case HFI_PROP_NO_OUTPUT:
+		if (port != INPUT_PORT) {
+			i_vpr_e(inst,
+				"%s: invalid port: %d for property %#x\n",
+				__func__, pkt->port, pkt->type);
+			break;
+		}
+		i_vpr_h(inst, "received no_output property\n");
+		inst->hfi_frame_info.no_output = 1;
+		break;
+	default:
+		i_vpr_e(inst, "%s: invalid property %#x\n",
+			__func__, pkt->type);
+		break;
+	}
+
+	return rc;
+}
+
+static int handle_session_property(struct msm_vidc_inst *inst,
+				   struct hfi_packet *pkt)
+{
+	int rc = 0;
+	u32 port;
+
+	i_vpr_l(inst, "%s: property type %#x\n", __func__, pkt->type);
+
+	port = vidc_port_from_hfi(inst, pkt->port);
+	if (port >= MAX_PORT) {
+		i_vpr_e(inst,
+			"%s: invalid port: %d for property %#x\n",
+			__func__, pkt->port, pkt->type);
+		return -EINVAL;
+	}
+
+	if (pkt->flags & HFI_FW_FLAGS_INFORMATION) {
+		i_vpr_h(inst,
+			"%s: information flag received for property %#x packet\n",
+			__func__, pkt->type);
+		return 0;
+	}
+
+	if (check_for_packet_payload(inst, pkt, __func__)) {
+		rc = handle_property_with_payload(inst, pkt, port);
+		if (rc)
+			return rc;
+	} else {
+		rc = handle_property_without_payload(inst, pkt, port);
+		if (rc)
+			return rc;
+	}
+
+	return rc;
+}
+
+static int handle_image_version_property(struct msm_vidc_core *core,
+	struct hfi_packet *pkt)
+{
+	u32 i = 0;
+	u8 *str_image_version;
+	u32 req_bytes;
+
+	req_bytes = pkt->size - sizeof(*pkt);
+	if (req_bytes < VENUS_VERSION_LENGTH - 1) {
+		d_vpr_e("%s: bad_pkt: %d\n", __func__, req_bytes);
+		return -EINVAL;
+	}
+	str_image_version = (u8 *)pkt + sizeof(struct hfi_packet);
+	/*
+	 * The version string returned by firmware includes null
+	 * characters at the start and in between. Replace the null
+	 * characters with space, to print the version info.
+	 */
+	for (i = 0; i < VENUS_VERSION_LENGTH - 1; i++) {
+		if (str_image_version[i] != '\0')
+			core->fw_version[i] = str_image_version[i];
+		else
+			core->fw_version[i] = ' ';
+	}
+	core->fw_version[i] = '\0';
+
+	d_vpr_h("%s: F/W version: %s\n", __func__, core->fw_version);
+	return 0;
+}
+
+static int handle_system_property(struct msm_vidc_core *core,
+				  struct hfi_packet *pkt)
+{
+	int rc = 0;
+
+	switch (pkt->type) {
+	case HFI_PROP_IMAGE_VERSION:
+		rc = handle_image_version_property(core, pkt);
+		break;
+	default:
+		d_vpr_h("%s: property type %#x successful\n",
+			__func__, pkt->type);
+		break;
+	}
+	return rc;
+}
+
+static int handle_system_response(struct msm_vidc_core *core,
+				  struct hfi_header *hdr)
+{
+	int rc = 0;
+	struct hfi_packet *packet;
+	u8 *pkt, *start_pkt;
+	int i, j;
+	static const struct msm_vidc_core_hfi_range be[] = {
+		{HFI_SYSTEM_ERROR_BEGIN,   HFI_SYSTEM_ERROR_END,   handle_system_error     },
+		{HFI_PROP_BEGIN,           HFI_PROP_END,           handle_system_property  },
+		{HFI_CMD_BEGIN,            HFI_CMD_END,            handle_system_init      },
+	};
+
+	start_pkt = (u8 *)((u8 *)hdr + sizeof(struct hfi_header));
+	for (i = 0; i < ARRAY_SIZE(be); i++) {
+		pkt = start_pkt;
+		for (j = 0; j < hdr->num_packets; j++) {
+			packet = (struct hfi_packet *)pkt;
+			/* handle system error */
+			if (packet->flags & HFI_FW_FLAGS_SYSTEM_ERROR) {
+				d_vpr_e("%s: received system error %#x\n",
+					__func__, packet->type);
+				rc = handle_system_error(core, packet);
+				if (rc)
+					goto exit;
+				goto exit;
+			}
+			if (check_in_range(be[i], packet->type)) {
+				rc = be[i].handle(core, packet);
+				if (rc)
+					goto exit;
+
+				/* skip processing anymore packets after system error */
+				if (!i) {
+					d_vpr_e("%s: skip processing anymore packets\n", __func__);
+					goto exit;
+				}
+			}
+			pkt += packet->size;
+		}
+	}
+
+exit:
+	return rc;
+}
+
+static int __handle_session_response(struct msm_vidc_inst *inst,
+				     struct hfi_header *hdr)
+{
+	int rc = 0;
+	struct hfi_packet *packet;
+	u8 *pkt, *start_pkt;
+	bool dequeue = false;
+	int i, j;
+	static const struct msm_vidc_inst_hfi_range be[] = {
+		{HFI_SESSION_ERROR_BEGIN,  HFI_SESSION_ERROR_END,  handle_session_error    },
+		{HFI_INFORMATION_BEGIN,    HFI_INFORMATION_END,    handle_session_info     },
+		{HFI_PROP_BEGIN,           HFI_PROP_END,           handle_session_property },
+		{HFI_CMD_BEGIN,            HFI_CMD_END,            handle_session_command  },
+	};
+
+	memset(&inst->hfi_frame_info, 0, sizeof(struct msm_vidc_hfi_frame_info));
+	start_pkt = (u8 *)((u8 *)hdr + sizeof(struct hfi_header));
+	for (i = 0; i < ARRAY_SIZE(be); i++) {
+		pkt = start_pkt;
+		for (j = 0; j < hdr->num_packets; j++) {
+			packet = (struct hfi_packet *)pkt;
+			/* handle session error */
+			if (packet->flags & HFI_FW_FLAGS_SESSION_ERROR) {
+				i_vpr_e(inst, "%s: received session error %#x\n",
+					__func__, packet->type);
+				handle_session_error(inst, packet);
+			}
+			if (check_in_range(be[i], packet->type)) {
+				dequeue |= (packet->type == HFI_CMD_BUFFER);
+				rc = be[i].handle(inst, packet);
+				if (rc)
+					msm_vidc_change_state(inst, MSM_VIDC_ERROR, __func__);
+			}
+			pkt += packet->size;
+		}
+	}
+
+	if (dequeue) {
+		rc = handle_dequeue_buffers(inst);
+		if (rc)
+			return rc;
+	}
+	memset(&inst->hfi_frame_info, 0, sizeof(struct msm_vidc_hfi_frame_info));
+
+	return rc;
+}
+
+static int handle_session_response(struct msm_vidc_core *core,
+				   struct hfi_header *hdr)
+{
+	struct msm_vidc_inst *inst;
+	struct hfi_packet *packet;
+	u8 *pkt;
+	int i, rc = 0;
+	bool found_ipsc = false;
+
+	inst = get_inst(core, hdr->session_id);
+	if (!inst) {
+		d_vpr_e("%s: Invalid inst\n", __func__);
+		return -EINVAL;
+	}
+
+	inst_lock(inst, __func__);
+	/* search for cmd settings change pkt */
+	pkt = (u8 *)((u8 *)hdr + sizeof(struct hfi_header));
+	for (i = 0; i < hdr->num_packets; i++) {
+		packet = (struct hfi_packet *)pkt;
+		if (packet->type == HFI_CMD_SETTINGS_CHANGE) {
+			if (packet->port == HFI_PORT_BITSTREAM) {
+				found_ipsc = true;
+				break;
+			}
+		}
+		pkt += packet->size;
+	}
+
+	/* if ipsc packet is found, initialise subsc_params */
+	if (found_ipsc)
+		msm_vdec_init_input_subcr_params(inst);
+
+	rc = __handle_session_response(inst, hdr);
+	if (rc)
+		goto exit;
+
+exit:
+	inst_unlock(inst, __func__);
+	put_inst(inst);
+	return rc;
+}
+
+int handle_response(struct msm_vidc_core *core, void *response)
+{
+	struct hfi_header *hdr;
+	int rc = 0;
+
+	hdr = (struct hfi_header *)response;
+	rc = validate_hdr_packet(core, hdr, __func__);
+	if (rc) {
+		d_vpr_e("%s: hdr pkt validation failed\n", __func__);
+		return handle_system_error(core, NULL);
+	}
+
+	if (!hdr->session_id)
+		return handle_system_response(core, hdr);
+	else
+		return handle_session_response(core, hdr);
+
+	return 0;
+}
--- linux-qcom-6.8.0.orig/ubuntu/ubuntu-host/Kconfig
+++ linux-qcom-6.8.0/ubuntu/ubuntu-host/Kconfig
@@ -0,0 +1,5 @@
+config UBUNTU_HOST
+	tristate "proc dir for exporting host data to containers"
+	help
+	  Creates an ubuntu-host directory in proc for providing data from
+	  Ubuntu hosts to containers.
--- linux-qcom-6.8.0.orig/ubuntu/ubuntu-host/Makefile
+++ linux-qcom-6.8.0/ubuntu/ubuntu-host/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_UBUNTU_HOST) += ubuntu-host.o
--- linux-qcom-6.8.0.orig/ubuntu/ubuntu-host/ubuntu-host.c
+++ linux-qcom-6.8.0/ubuntu/ubuntu-host/ubuntu-host.c
@@ -0,0 +1,68 @@
+#include <linux/uaccess.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/proc_fs.h>
+#include <asm/uaccess.h>
+
+#define PROC_DIR		"ubuntu-host"
+
+#define ESM_TOKEN_FILE		"esm-token"
+#define ESM_TOKEN_MAX_SIZE		64
+
+static struct proc_dir_entry *proc_dir;
+static char esm_token_buffer[ESM_TOKEN_MAX_SIZE];
+
+static ssize_t esm_token_read(struct file *f, char __user *buf, size_t len,
+			      loff_t *off)
+{
+	return simple_read_from_buffer(buf, len, off, esm_token_buffer,
+				       strlen(esm_token_buffer));
+}
+
+static ssize_t esm_token_write(struct file *f, const char __user *buf,
+			       size_t len, loff_t *off)
+{
+	ssize_t ret;
+
+	if (len >= ESM_TOKEN_MAX_SIZE - 1)
+		return -EINVAL;
+
+	ret = simple_write_to_buffer(esm_token_buffer, ESM_TOKEN_MAX_SIZE - 1,
+				     off, buf, len);
+	if (ret >= 0)
+		esm_token_buffer[ret] = '\0';
+
+	return ret;
+}
+
+static const struct proc_ops esm_token_fops = {
+	.proc_read = esm_token_read,
+	.proc_write = esm_token_write,
+};
+
+static void ubuntu_host_cleanup(void)
+{
+	remove_proc_entry(ESM_TOKEN_FILE, proc_dir);
+	proc_remove(proc_dir);
+}
+
+static int __init ubuntu_host_init(void)
+{
+	proc_dir = proc_mkdir(PROC_DIR, NULL);
+	if (!proc_dir) {
+		pr_err("Failed to create ubuntu-host dir\n");
+		return -ENOMEM;
+	}
+
+	if (!proc_create_data(ESM_TOKEN_FILE, 0644, proc_dir, &esm_token_fops, NULL)) {
+		pr_err("Failed to create esm-tokan file\n");
+		ubuntu_host_cleanup();
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+module_init(ubuntu_host_init);
+module_exit(ubuntu_host_cleanup);
+MODULE_LICENSE("GPL");
--- linux-qcom-6.8.0.orig/virt/kvm/async_pf.c
+++ linux-qcom-6.8.0/virt/kvm/async_pf.c
@@ -87,7 +87,27 @@
 	__kvm_vcpu_wake_up(vcpu);
 
 	mmput(mm);
-	kvm_put_kvm(vcpu->kvm);
+}
+
+static void kvm_flush_and_free_async_pf_work(struct kvm_async_pf *work)
+{
+	/*
+	 * The async #PF is "done", but KVM must wait for the work item itself,
+	 * i.e. async_pf_execute(), to run to completion.  If KVM is a module,
+	 * KVM must ensure *no* code owned by the KVM (the module) can be run
+	 * after the last call to module_put().  Note, flushing the work item
+	 * is always required when the item is taken off the completion queue.
+	 * E.g. even if the vCPU handles the item in the "normal" path, the VM
+	 * could be terminated before async_pf_execute() completes.
+	 *
+	 * Wake all events skip the queue and go straight done, i.e. don't
+	 * need to be flushed (but sanity check that the work wasn't queued).
+	 */
+	if (work->wakeup_all)
+		WARN_ON_ONCE(work->work.func);
+	else
+		flush_work(&work->work);
+	kmem_cache_free(async_pf_cache, work);
 }
 
 void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
@@ -114,7 +134,6 @@
 #else
 		if (cancel_work_sync(&work->work)) {
 			mmput(work->mm);
-			kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
 			kmem_cache_free(async_pf_cache, work);
 		}
 #endif
@@ -126,7 +145,10 @@
 			list_first_entry(&vcpu->async_pf.done,
 					 typeof(*work), link);
 		list_del(&work->link);
-		kmem_cache_free(async_pf_cache, work);
+
+		spin_unlock(&vcpu->async_pf.lock);
+		kvm_flush_and_free_async_pf_work(work);
+		spin_lock(&vcpu->async_pf.lock);
 	}
 	spin_unlock(&vcpu->async_pf.lock);
 
@@ -151,7 +173,7 @@
 
 		list_del(&work->queue);
 		vcpu->async_pf.queued--;
-		kmem_cache_free(async_pf_cache, work);
+		kvm_flush_and_free_async_pf_work(work);
 	}
 }
 
@@ -186,7 +208,6 @@
 	work->arch = *arch;
 	work->mm = current->mm;
 	mmget(work->mm);
-	kvm_get_kvm(work->vcpu->kvm);
 
 	INIT_WORK(&work->work, async_pf_execute);
 
--- linux-qcom-6.8.0.orig/virt/kvm/guest_memfd.c
+++ linux-qcom-6.8.0/virt/kvm/guest_memfd.c
@@ -510,8 +510,10 @@
 	}
 
 	if (folio_test_hwpoison(folio)) {
+		folio_unlock(folio);
+		folio_put(folio);
 		r = -EHWPOISON;
-		goto out_unlock;
+		goto out_fput;
 	}
 
 	page = folio_file_page(folio, index);
@@ -522,7 +524,6 @@
 
 	r = 0;
 
-out_unlock:
 	folio_unlock(folio);
 out_fput:
 	fput(file);
--- linux-qcom-6.8.0.orig/virt/kvm/kvm_main.c
+++ linux-qcom-6.8.0/virt/kvm/kvm_main.c
@@ -4057,12 +4057,13 @@
 {
 	struct kvm *kvm = me->kvm;
 	struct kvm_vcpu *vcpu;
-	int last_boosted_vcpu = me->kvm->last_boosted_vcpu;
+	int last_boosted_vcpu;
 	unsigned long i;
 	int yielded = 0;
 	int try = 3;
 	int pass;
 
+	last_boosted_vcpu = READ_ONCE(kvm->last_boosted_vcpu);
 	kvm_vcpu_set_in_spin_loop(me, true);
 	/*
 	 * We boost the priority of a VCPU that is runnable but not
@@ -4093,7 +4094,7 @@
 
 			yielded = kvm_vcpu_yield_to(vcpu);
 			if (yielded > 0) {
-				kvm->last_boosted_vcpu = i;
+				WRITE_ONCE(kvm->last_boosted_vcpu, i);
 				break;
 			} else if (yielded < 0) {
 				try--;
@@ -5522,6 +5523,7 @@
 EXPORT_SYMBOL_GPL(kvm_rebooting);
 
 static DEFINE_PER_CPU(bool, hardware_enabled);
+static DEFINE_MUTEX(kvm_usage_lock);
 static int kvm_usage_count;
 
 static int __hardware_enable_nolock(void)
@@ -5554,10 +5556,10 @@
 	 * be enabled. Otherwise running VMs would encounter unrecoverable
 	 * errors when scheduled to this CPU.
 	 */
-	mutex_lock(&kvm_lock);
+	mutex_lock(&kvm_usage_lock);
 	if (kvm_usage_count)
 		ret = __hardware_enable_nolock();
-	mutex_unlock(&kvm_lock);
+	mutex_unlock(&kvm_usage_lock);
 	return ret;
 }
 
@@ -5577,10 +5579,10 @@
 
 static int kvm_offline_cpu(unsigned int cpu)
 {
-	mutex_lock(&kvm_lock);
+	mutex_lock(&kvm_usage_lock);
 	if (kvm_usage_count)
 		hardware_disable_nolock(NULL);
-	mutex_unlock(&kvm_lock);
+	mutex_unlock(&kvm_usage_lock);
 	return 0;
 }
 
@@ -5596,9 +5598,9 @@
 static void hardware_disable_all(void)
 {
 	cpus_read_lock();
-	mutex_lock(&kvm_lock);
+	mutex_lock(&kvm_usage_lock);
 	hardware_disable_all_nolock();
-	mutex_unlock(&kvm_lock);
+	mutex_unlock(&kvm_usage_lock);
 	cpus_read_unlock();
 }
 
@@ -5629,7 +5631,7 @@
 	 * enable hardware multiple times.
 	 */
 	cpus_read_lock();
-	mutex_lock(&kvm_lock);
+	mutex_lock(&kvm_usage_lock);
 
 	r = 0;
 
@@ -5643,7 +5645,7 @@
 		}
 	}
 
-	mutex_unlock(&kvm_lock);
+	mutex_unlock(&kvm_usage_lock);
 	cpus_read_unlock();
 
 	return r;
@@ -5671,13 +5673,13 @@
 {
 	/*
 	 * Secondary CPUs and CPU hotplug are disabled across the suspend/resume
-	 * callbacks, i.e. no need to acquire kvm_lock to ensure the usage count
-	 * is stable.  Assert that kvm_lock is not held to ensure the system
-	 * isn't suspended while KVM is enabling hardware.  Hardware enabling
-	 * can be preempted, but the task cannot be frozen until it has dropped
-	 * all locks (userspace tasks are frozen via a fake signal).
+	 * callbacks, i.e. no need to acquire kvm_usage_lock to ensure the usage
+	 * count is stable.  Assert that kvm_usage_lock is not held to ensure
+	 * the system isn't suspended while KVM is enabling hardware.  Hardware
+	 * enabling can be preempted, but the task cannot be frozen until it has
+	 * dropped all locks (userspace tasks are frozen via a fake signal).
 	 */
-	lockdep_assert_not_held(&kvm_lock);
+	lockdep_assert_not_held(&kvm_usage_lock);
 	lockdep_assert_irqs_disabled();
 
 	if (kvm_usage_count)
@@ -5687,7 +5689,7 @@
 
 static void kvm_resume(void)
 {
-	lockdep_assert_not_held(&kvm_lock);
+	lockdep_assert_not_held(&kvm_usage_lock);
 	lockdep_assert_irqs_disabled();
 
 	if (kvm_usage_count)
@@ -6516,106 +6518,3 @@
 	kvm_irqfd_exit();
 }
 EXPORT_SYMBOL_GPL(kvm_exit);
-
-struct kvm_vm_worker_thread_context {
-	struct kvm *kvm;
-	struct task_struct *parent;
-	struct completion init_done;
-	kvm_vm_thread_fn_t thread_fn;
-	uintptr_t data;
-	int err;
-};
-
-static int kvm_vm_worker_thread(void *context)
-{
-	/*
-	 * The init_context is allocated on the stack of the parent thread, so
-	 * we have to locally copy anything that is needed beyond initialization
-	 */
-	struct kvm_vm_worker_thread_context *init_context = context;
-	struct task_struct *parent;
-	struct kvm *kvm = init_context->kvm;
-	kvm_vm_thread_fn_t thread_fn = init_context->thread_fn;
-	uintptr_t data = init_context->data;
-	int err;
-
-	err = kthread_park(current);
-	/* kthread_park(current) is never supposed to return an error */
-	WARN_ON(err != 0);
-	if (err)
-		goto init_complete;
-
-	err = cgroup_attach_task_all(init_context->parent, current);
-	if (err) {
-		kvm_err("%s: cgroup_attach_task_all failed with err %d\n",
-			__func__, err);
-		goto init_complete;
-	}
-
-	set_user_nice(current, task_nice(init_context->parent));
-
-init_complete:
-	init_context->err = err;
-	complete(&init_context->init_done);
-	init_context = NULL;
-
-	if (err)
-		goto out;
-
-	/* Wait to be woken up by the spawner before proceeding. */
-	kthread_parkme();
-
-	if (!kthread_should_stop())
-		err = thread_fn(kvm, data);
-
-out:
-	/*
-	 * Move kthread back to its original cgroup to prevent it lingering in
-	 * the cgroup of the VM process, after the latter finishes its
-	 * execution.
-	 *
-	 * kthread_stop() waits on the 'exited' completion condition which is
-	 * set in exit_mm(), via mm_release(), in do_exit(). However, the
-	 * kthread is removed from the cgroup in the cgroup_exit() which is
-	 * called after the exit_mm(). This causes the kthread_stop() to return
-	 * before the kthread actually quits the cgroup.
-	 */
-	rcu_read_lock();
-	parent = rcu_dereference(current->real_parent);
-	get_task_struct(parent);
-	rcu_read_unlock();
-	cgroup_attach_task_all(parent, current);
-	put_task_struct(parent);
-
-	return err;
-}
-
-int kvm_vm_create_worker_thread(struct kvm *kvm, kvm_vm_thread_fn_t thread_fn,
-				uintptr_t data, const char *name,
-				struct task_struct **thread_ptr)
-{
-	struct kvm_vm_worker_thread_context init_context = {};
-	struct task_struct *thread;
-
-	*thread_ptr = NULL;
-	init_context.kvm = kvm;
-	init_context.parent = current;
-	init_context.thread_fn = thread_fn;
-	init_context.data = data;
-	init_completion(&init_context.init_done);
-
-	thread = kthread_run(kvm_vm_worker_thread, &init_context,
-			     "%s-%d", name, task_pid_nr(current));
-	if (IS_ERR(thread))
-		return PTR_ERR(thread);
-
-	/* kthread_run is never supposed to return NULL */
-	WARN_ON(thread == NULL);
-
-	wait_for_completion(&init_context.init_done);
-
-	if (!init_context.err)
-		*thread_ptr = thread;
-
-	return init_context.err;
-}